diff --git a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/00202722 b/.config/.cache/v24.8.0-arm64-ef5a0af0-501/00202722
deleted file mode 100644
index 703d597..0000000
Binary files a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/00202722 and /dev/null differ
diff --git a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/00529966 b/.config/.cache/v24.8.0-arm64-ef5a0af0-501/00529966
deleted file mode 100644
index 67f5a14..0000000
Binary files a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/00529966 and /dev/null differ
diff --git a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/005fc845 b/.config/.cache/v24.8.0-arm64-ef5a0af0-501/005fc845
deleted file mode 100644
index 8562cbe..0000000
Binary files a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/005fc845 and /dev/null differ
diff --git a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/0066de4c b/.config/.cache/v24.8.0-arm64-ef5a0af0-501/0066de4c
deleted file mode 100644
index af8cb5a..0000000
Binary files a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/0066de4c and /dev/null differ
diff --git a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/00733088 b/.config/.cache/v24.8.0-arm64-ef5a0af0-501/00733088
deleted file mode 100644
index ff0c93b..0000000
Binary files a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/00733088 and /dev/null differ
diff --git a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/0076a15b b/.config/.cache/v24.8.0-arm64-ef5a0af0-501/0076a15b
deleted file mode 100644
index 44a3ac8..0000000
Binary files a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/0076a15b and /dev/null differ
diff --git a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/0085588e b/.config/.cache/v24.8.0-arm64-ef5a0af0-501/0085588e
deleted file mode 100644
index b93cf0c..0000000
Binary files a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/0085588e and /dev/null differ
diff --git a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/0120aba9 b/.config/.cache/v24.8.0-arm64-ef5a0af0-501/0120aba9
deleted file mode 100644
index 399b791..0000000
Binary files a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/0120aba9 and /dev/null differ
diff --git a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/01541c77 b/.config/.cache/v24.8.0-arm64-ef5a0af0-501/01541c77
deleted file mode 100644
index 1dbb905..0000000
Binary files a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/01541c77 and /dev/null differ
diff --git a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/01bfcbe4 b/.config/.cache/v24.8.0-arm64-ef5a0af0-501/01bfcbe4
deleted file mode 100644
index c9bd3ce..0000000
Binary files a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/01bfcbe4 and /dev/null differ
diff --git a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/01d03a4f b/.config/.cache/v24.8.0-arm64-ef5a0af0-501/01d03a4f
deleted file mode 100644
index 197e956..0000000
Binary files a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/01d03a4f and /dev/null differ
diff --git a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/01e015fd b/.config/.cache/v24.8.0-arm64-ef5a0af0-501/01e015fd
deleted file mode 100644
index 8e60dad..0000000
Binary files a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/01e015fd and /dev/null differ
diff --git a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/021162e4 b/.config/.cache/v24.8.0-arm64-ef5a0af0-501/021162e4
deleted file mode 100644
index 96765fc..0000000
Binary files a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/021162e4 and /dev/null differ
diff --git a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/024026d8 b/.config/.cache/v24.8.0-arm64-ef5a0af0-501/024026d8
deleted file mode 100644
index 9427217..0000000
Binary files a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/024026d8 and /dev/null differ
diff --git a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/02aa39b7 b/.config/.cache/v24.8.0-arm64-ef5a0af0-501/02aa39b7
deleted file mode 100644
index 2896365..0000000
Binary files a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/02aa39b7 and /dev/null differ
diff --git a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/02b6c55a b/.config/.cache/v24.8.0-arm64-ef5a0af0-501/02b6c55a
deleted file mode 100644
index 8b0803f..0000000
Binary files a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/02b6c55a and /dev/null differ
diff --git a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/02ba6e0d b/.config/.cache/v24.8.0-arm64-ef5a0af0-501/02ba6e0d
deleted file mode 100644
index 1f44908..0000000
Binary files a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/02ba6e0d and /dev/null differ
diff --git a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/02eb0559 b/.config/.cache/v24.8.0-arm64-ef5a0af0-501/02eb0559
deleted file mode 100644
index 0498540..0000000
Binary files a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/02eb0559 and /dev/null differ
diff --git a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/03458eba b/.config/.cache/v24.8.0-arm64-ef5a0af0-501/03458eba
deleted file mode 100644
index 6fe5c6d..0000000
Binary files a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/03458eba and /dev/null differ
diff --git a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/03903f64 b/.config/.cache/v24.8.0-arm64-ef5a0af0-501/03903f64
deleted file mode 100644
index f0ba22b..0000000
Binary files a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/03903f64 and /dev/null differ
diff --git a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/0398695f b/.config/.cache/v24.8.0-arm64-ef5a0af0-501/0398695f
deleted file mode 100644
index ef8f48e..0000000
Binary files a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/0398695f and /dev/null differ
diff --git a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/03a10a14 b/.config/.cache/v24.8.0-arm64-ef5a0af0-501/03a10a14
deleted file mode 100644
index c560d84..0000000
Binary files a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/03a10a14 and /dev/null differ
diff --git a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/03dafee9 b/.config/.cache/v24.8.0-arm64-ef5a0af0-501/03dafee9
deleted file mode 100644
index c140dad..0000000
Binary files a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/03dafee9 and /dev/null differ
diff --git a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/03edd8f8 b/.config/.cache/v24.8.0-arm64-ef5a0af0-501/03edd8f8
deleted file mode 100644
index aafe499..0000000
Binary files a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/03edd8f8 and /dev/null differ
diff --git a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/043eed0a b/.config/.cache/v24.8.0-arm64-ef5a0af0-501/043eed0a
deleted file mode 100644
index e3eba55..0000000
Binary files a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/043eed0a and /dev/null differ
diff --git a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/0447d204 b/.config/.cache/v24.8.0-arm64-ef5a0af0-501/0447d204
deleted file mode 100644
index cfada28..0000000
Binary files a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/0447d204 and /dev/null differ
diff --git a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/04ad3b90 b/.config/.cache/v24.8.0-arm64-ef5a0af0-501/04ad3b90
deleted file mode 100644
index c51bdca..0000000
Binary files a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/04ad3b90 and /dev/null differ
diff --git a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/04ae8a73 b/.config/.cache/v24.8.0-arm64-ef5a0af0-501/04ae8a73
deleted file mode 100644
index cd1bacf..0000000
Binary files a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/04ae8a73 and /dev/null differ
diff --git a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/04e429ee b/.config/.cache/v24.8.0-arm64-ef5a0af0-501/04e429ee
deleted file mode 100644
index 6153bad..0000000
Binary files a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/04e429ee and /dev/null differ
diff --git a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/0505c736 b/.config/.cache/v24.8.0-arm64-ef5a0af0-501/0505c736
deleted file mode 100644
index f92de7d..0000000
Binary files a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/0505c736 and /dev/null differ
diff --git a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/0507ebfd b/.config/.cache/v24.8.0-arm64-ef5a0af0-501/0507ebfd
deleted file mode 100644
index 3ee4b89..0000000
Binary files a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/0507ebfd and /dev/null differ
diff --git a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/05457eb8 b/.config/.cache/v24.8.0-arm64-ef5a0af0-501/05457eb8
deleted file mode 100644
index f819ca1..0000000
Binary files a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/05457eb8 and /dev/null differ
diff --git a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/054c36fa b/.config/.cache/v24.8.0-arm64-ef5a0af0-501/054c36fa
deleted file mode 100644
index 31740cc..0000000
Binary files a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/054c36fa and /dev/null differ
diff --git a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/058e7ce5 b/.config/.cache/v24.8.0-arm64-ef5a0af0-501/058e7ce5
deleted file mode 100644
index d400cfd..0000000
Binary files a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/058e7ce5 and /dev/null differ
diff --git a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/05d18fbb b/.config/.cache/v24.8.0-arm64-ef5a0af0-501/05d18fbb
deleted file mode 100644
index b13c910..0000000
Binary files a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/05d18fbb and /dev/null differ
diff --git a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/05dc9409 b/.config/.cache/v24.8.0-arm64-ef5a0af0-501/05dc9409
deleted file mode 100644
index b4056e6..0000000
Binary files a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/05dc9409 and /dev/null differ
diff --git a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/05e057fd b/.config/.cache/v24.8.0-arm64-ef5a0af0-501/05e057fd
deleted file mode 100644
index e5b057d..0000000
Binary files a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/05e057fd and /dev/null differ
diff --git a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/05e41d17 b/.config/.cache/v24.8.0-arm64-ef5a0af0-501/05e41d17
deleted file mode 100644
index 08a26d1..0000000
Binary files a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/05e41d17 and /dev/null differ
diff --git a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/05feabe5 b/.config/.cache/v24.8.0-arm64-ef5a0af0-501/05feabe5
deleted file mode 100644
index c56c71f..0000000
Binary files a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/05feabe5 and /dev/null differ
diff --git a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/0611b480 b/.config/.cache/v24.8.0-arm64-ef5a0af0-501/0611b480
deleted file mode 100644
index 83473d1..0000000
Binary files a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/0611b480 and /dev/null differ
diff --git a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/067ce2bf b/.config/.cache/v24.8.0-arm64-ef5a0af0-501/067ce2bf
deleted file mode 100644
index dc85936..0000000
Binary files a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/067ce2bf and /dev/null differ
diff --git a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/067e1bb7 b/.config/.cache/v24.8.0-arm64-ef5a0af0-501/067e1bb7
deleted file mode 100644
index becee4d..0000000
Binary files a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/067e1bb7 and /dev/null differ
diff --git a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/0694a86e b/.config/.cache/v24.8.0-arm64-ef5a0af0-501/0694a86e
deleted file mode 100644
index bb10b49..0000000
Binary files a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/0694a86e and /dev/null differ
diff --git a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/06dd794b b/.config/.cache/v24.8.0-arm64-ef5a0af0-501/06dd794b
deleted file mode 100644
index 0b6320f..0000000
Binary files a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/06dd794b and /dev/null differ
diff --git a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/06e870a2 b/.config/.cache/v24.8.0-arm64-ef5a0af0-501/06e870a2
deleted file mode 100644
index 6b9942c..0000000
Binary files a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/06e870a2 and /dev/null differ
diff --git a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/0713f559 b/.config/.cache/v24.8.0-arm64-ef5a0af0-501/0713f559
deleted file mode 100644
index e776d95..0000000
Binary files a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/0713f559 and /dev/null differ
diff --git a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/0717b662 b/.config/.cache/v24.8.0-arm64-ef5a0af0-501/0717b662
deleted file mode 100644
index bb99639..0000000
Binary files a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/0717b662 and /dev/null differ
diff --git a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/07187463 b/.config/.cache/v24.8.0-arm64-ef5a0af0-501/07187463
deleted file mode 100644
index a6463cf..0000000
Binary files a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/07187463 and /dev/null differ
diff --git a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/07559c53 b/.config/.cache/v24.8.0-arm64-ef5a0af0-501/07559c53
deleted file mode 100644
index c67990e..0000000
Binary files a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/07559c53 and /dev/null differ
diff --git a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/0794ab18 b/.config/.cache/v24.8.0-arm64-ef5a0af0-501/0794ab18
deleted file mode 100644
index 6ad3d76..0000000
Binary files a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/0794ab18 and /dev/null differ
diff --git a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/081dac19 b/.config/.cache/v24.8.0-arm64-ef5a0af0-501/081dac19
deleted file mode 100644
index 1ee933d..0000000
Binary files a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/081dac19 and /dev/null differ
diff --git a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/085ecd65 b/.config/.cache/v24.8.0-arm64-ef5a0af0-501/085ecd65
deleted file mode 100644
index 72a6352..0000000
Binary files a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/085ecd65 and /dev/null differ
diff --git a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/088a65fa b/.config/.cache/v24.8.0-arm64-ef5a0af0-501/088a65fa
deleted file mode 100644
index 59df172..0000000
Binary files a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/088a65fa and /dev/null differ
diff --git a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/089c01bc b/.config/.cache/v24.8.0-arm64-ef5a0af0-501/089c01bc
deleted file mode 100644
index a2877ed..0000000
Binary files a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/089c01bc and /dev/null differ
diff --git a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/08a2a454 b/.config/.cache/v24.8.0-arm64-ef5a0af0-501/08a2a454
deleted file mode 100644
index 52d7df2..0000000
Binary files a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/08a2a454 and /dev/null differ
diff --git a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/08bcca0d b/.config/.cache/v24.8.0-arm64-ef5a0af0-501/08bcca0d
deleted file mode 100644
index 763fef1..0000000
Binary files a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/08bcca0d and /dev/null differ
diff --git a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/08de9372 b/.config/.cache/v24.8.0-arm64-ef5a0af0-501/08de9372
deleted file mode 100644
index fc68294..0000000
Binary files a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/08de9372 and /dev/null differ
diff --git a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/0918a81f b/.config/.cache/v24.8.0-arm64-ef5a0af0-501/0918a81f
deleted file mode 100644
index 9395460..0000000
Binary files a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/0918a81f and /dev/null differ
diff --git a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/096a0199 b/.config/.cache/v24.8.0-arm64-ef5a0af0-501/096a0199
deleted file mode 100644
index 14dd59e..0000000
Binary files a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/096a0199 and /dev/null differ
diff --git a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/096f2e99 b/.config/.cache/v24.8.0-arm64-ef5a0af0-501/096f2e99
deleted file mode 100644
index 00de4dd..0000000
Binary files a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/096f2e99 and /dev/null differ
diff --git a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/098173eb b/.config/.cache/v24.8.0-arm64-ef5a0af0-501/098173eb
deleted file mode 100644
index 143f605..0000000
Binary files a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/098173eb and /dev/null differ
diff --git a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/09c99bc4 b/.config/.cache/v24.8.0-arm64-ef5a0af0-501/09c99bc4
deleted file mode 100644
index 4c0cf40..0000000
Binary files a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/09c99bc4 and /dev/null differ
diff --git a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/09d6f2b0 b/.config/.cache/v24.8.0-arm64-ef5a0af0-501/09d6f2b0
deleted file mode 100644
index badfb2b..0000000
Binary files a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/09d6f2b0 and /dev/null differ
diff --git a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/0a00a4af b/.config/.cache/v24.8.0-arm64-ef5a0af0-501/0a00a4af
deleted file mode 100644
index 55786a1..0000000
Binary files a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/0a00a4af and /dev/null differ
diff --git a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/0a13486c b/.config/.cache/v24.8.0-arm64-ef5a0af0-501/0a13486c
deleted file mode 100644
index 22fc918..0000000
Binary files a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/0a13486c and /dev/null differ
diff --git a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/0a69a08c b/.config/.cache/v24.8.0-arm64-ef5a0af0-501/0a69a08c
deleted file mode 100644
index 5639f1b..0000000
Binary files a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/0a69a08c and /dev/null differ
diff --git a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/0a6ddcdb b/.config/.cache/v24.8.0-arm64-ef5a0af0-501/0a6ddcdb
deleted file mode 100644
index 6caba98..0000000
Binary files a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/0a6ddcdb and /dev/null differ
diff --git a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/0a9804fa b/.config/.cache/v24.8.0-arm64-ef5a0af0-501/0a9804fa
deleted file mode 100644
index bdb0988..0000000
Binary files a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/0a9804fa and /dev/null differ
diff --git a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/0aa463e1 b/.config/.cache/v24.8.0-arm64-ef5a0af0-501/0aa463e1
deleted file mode 100644
index 6c09484..0000000
Binary files a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/0aa463e1 and /dev/null differ
diff --git a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/0acf2994 b/.config/.cache/v24.8.0-arm64-ef5a0af0-501/0acf2994
deleted file mode 100644
index 39b18b4..0000000
Binary files a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/0acf2994 and /dev/null differ
diff --git a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/0ae4b97c b/.config/.cache/v24.8.0-arm64-ef5a0af0-501/0ae4b97c
deleted file mode 100644
index d665f02..0000000
Binary files a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/0ae4b97c and /dev/null differ
diff --git a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/0af7e06d b/.config/.cache/v24.8.0-arm64-ef5a0af0-501/0af7e06d
deleted file mode 100644
index 5c436ac..0000000
Binary files a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/0af7e06d and /dev/null differ
diff --git a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/0b15f48f b/.config/.cache/v24.8.0-arm64-ef5a0af0-501/0b15f48f
deleted file mode 100644
index acbeef3..0000000
Binary files a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/0b15f48f and /dev/null differ
diff --git a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/0b54b8b3 b/.config/.cache/v24.8.0-arm64-ef5a0af0-501/0b54b8b3
deleted file mode 100644
index b8d7a77..0000000
Binary files a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/0b54b8b3 and /dev/null differ
diff --git a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/0b5f850a b/.config/.cache/v24.8.0-arm64-ef5a0af0-501/0b5f850a
deleted file mode 100644
index ac072e2..0000000
Binary files a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/0b5f850a and /dev/null differ
diff --git a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/0b655035 b/.config/.cache/v24.8.0-arm64-ef5a0af0-501/0b655035
deleted file mode 100644
index 76db478..0000000
Binary files a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/0b655035 and /dev/null differ
diff --git a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/0b703ecd b/.config/.cache/v24.8.0-arm64-ef5a0af0-501/0b703ecd
deleted file mode 100644
index 75ebe22..0000000
Binary files a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/0b703ecd and /dev/null differ
diff --git a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/0b7e9373 b/.config/.cache/v24.8.0-arm64-ef5a0af0-501/0b7e9373
deleted file mode 100644
index 90cb953..0000000
Binary files a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/0b7e9373 and /dev/null differ
diff --git a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/0b810f67 b/.config/.cache/v24.8.0-arm64-ef5a0af0-501/0b810f67
deleted file mode 100644
index 5195337..0000000
Binary files a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/0b810f67 and /dev/null differ
diff --git a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/0b8e319e b/.config/.cache/v24.8.0-arm64-ef5a0af0-501/0b8e319e
deleted file mode 100644
index 6c1f083..0000000
Binary files a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/0b8e319e and /dev/null differ
diff --git a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/0bb4919f b/.config/.cache/v24.8.0-arm64-ef5a0af0-501/0bb4919f
deleted file mode 100644
index 258502e..0000000
Binary files a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/0bb4919f and /dev/null differ
diff --git a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/0bbe6ef8 b/.config/.cache/v24.8.0-arm64-ef5a0af0-501/0bbe6ef8
deleted file mode 100644
index 12c691f..0000000
Binary files a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/0bbe6ef8 and /dev/null differ
diff --git a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/0bc0e71a b/.config/.cache/v24.8.0-arm64-ef5a0af0-501/0bc0e71a
deleted file mode 100644
index 1241a2a..0000000
Binary files a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/0bc0e71a and /dev/null differ
diff --git a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/0c053dfe b/.config/.cache/v24.8.0-arm64-ef5a0af0-501/0c053dfe
deleted file mode 100644
index 016f3ff..0000000
Binary files a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/0c053dfe and /dev/null differ
diff --git a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/0c3978f6 b/.config/.cache/v24.8.0-arm64-ef5a0af0-501/0c3978f6
deleted file mode 100644
index 5829a0f..0000000
Binary files a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/0c3978f6 and /dev/null differ
diff --git a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/0c4a99b1 b/.config/.cache/v24.8.0-arm64-ef5a0af0-501/0c4a99b1
deleted file mode 100644
index 2bc8a93..0000000
Binary files a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/0c4a99b1 and /dev/null differ
diff --git a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/0cd7789b b/.config/.cache/v24.8.0-arm64-ef5a0af0-501/0cd7789b
deleted file mode 100644
index a8f7b81..0000000
Binary files a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/0cd7789b and /dev/null differ
diff --git a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/0cdea35e b/.config/.cache/v24.8.0-arm64-ef5a0af0-501/0cdea35e
deleted file mode 100644
index b341a7c..0000000
Binary files a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/0cdea35e and /dev/null differ
diff --git a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/0d3706e1 b/.config/.cache/v24.8.0-arm64-ef5a0af0-501/0d3706e1
deleted file mode 100644
index 69fe229..0000000
Binary files a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/0d3706e1 and /dev/null differ
diff --git a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/0d45c9ee b/.config/.cache/v24.8.0-arm64-ef5a0af0-501/0d45c9ee
deleted file mode 100644
index 19d6db7..0000000
Binary files a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/0d45c9ee and /dev/null differ
diff --git a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/0d463f77 b/.config/.cache/v24.8.0-arm64-ef5a0af0-501/0d463f77
deleted file mode 100644
index b44f790..0000000
Binary files a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/0d463f77 and /dev/null differ
diff --git a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/0dc21d7c b/.config/.cache/v24.8.0-arm64-ef5a0af0-501/0dc21d7c
deleted file mode 100644
index ca1cf11..0000000
Binary files a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/0dc21d7c and /dev/null differ
diff --git a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/0dea69ae b/.config/.cache/v24.8.0-arm64-ef5a0af0-501/0dea69ae
deleted file mode 100644
index 7105fed..0000000
Binary files a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/0dea69ae and /dev/null differ
diff --git a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/0dee0038 b/.config/.cache/v24.8.0-arm64-ef5a0af0-501/0dee0038
deleted file mode 100644
index e420e9d..0000000
Binary files a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/0dee0038 and /dev/null differ
diff --git a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/0e2b7262 b/.config/.cache/v24.8.0-arm64-ef5a0af0-501/0e2b7262
deleted file mode 100644
index bd6c1b9..0000000
Binary files a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/0e2b7262 and /dev/null differ
diff --git a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/0e4abe34 b/.config/.cache/v24.8.0-arm64-ef5a0af0-501/0e4abe34
deleted file mode 100644
index ac5e677..0000000
Binary files a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/0e4abe34 and /dev/null differ
diff --git a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/0e50ded0 b/.config/.cache/v24.8.0-arm64-ef5a0af0-501/0e50ded0
deleted file mode 100644
index 8e08fc1..0000000
Binary files a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/0e50ded0 and /dev/null differ
diff --git a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/0e72102d b/.config/.cache/v24.8.0-arm64-ef5a0af0-501/0e72102d
deleted file mode 100644
index c3f61d3..0000000
Binary files a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/0e72102d and /dev/null differ
diff --git a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/0e8fabc8 b/.config/.cache/v24.8.0-arm64-ef5a0af0-501/0e8fabc8
deleted file mode 100644
index 57ece77..0000000
Binary files a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/0e8fabc8 and /dev/null differ
diff --git a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/0e9343c1 b/.config/.cache/v24.8.0-arm64-ef5a0af0-501/0e9343c1
deleted file mode 100644
index ecf428d..0000000
Binary files a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/0e9343c1 and /dev/null differ
diff --git a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/0e9a6172 b/.config/.cache/v24.8.0-arm64-ef5a0af0-501/0e9a6172
deleted file mode 100644
index 4fb27f9..0000000
Binary files a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/0e9a6172 and /dev/null differ
diff --git a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/0f4018bf b/.config/.cache/v24.8.0-arm64-ef5a0af0-501/0f4018bf
deleted file mode 100644
index 3a86dd4..0000000
Binary files a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/0f4018bf and /dev/null differ
diff --git a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/0f69a4a4 b/.config/.cache/v24.8.0-arm64-ef5a0af0-501/0f69a4a4
deleted file mode 100644
index c497a09..0000000
Binary files a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/0f69a4a4 and /dev/null differ
diff --git a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/0fa53f06 b/.config/.cache/v24.8.0-arm64-ef5a0af0-501/0fa53f06
deleted file mode 100644
index fb9dda6..0000000
Binary files a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/0fa53f06 and /dev/null differ
diff --git a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/0fbe1a94 b/.config/.cache/v24.8.0-arm64-ef5a0af0-501/0fbe1a94
deleted file mode 100644
index c1e23a1..0000000
Binary files a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/0fbe1a94 and /dev/null differ
diff --git a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/0ffa9b87 b/.config/.cache/v24.8.0-arm64-ef5a0af0-501/0ffa9b87
deleted file mode 100644
index 5e86f92..0000000
Binary files a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/0ffa9b87 and /dev/null differ
diff --git a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/100d49aa b/.config/.cache/v24.8.0-arm64-ef5a0af0-501/100d49aa
deleted file mode 100644
index 7e1377d..0000000
Binary files a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/100d49aa and /dev/null differ
diff --git a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/107a1cf3 b/.config/.cache/v24.8.0-arm64-ef5a0af0-501/107a1cf3
deleted file mode 100644
index e565d5e..0000000
Binary files a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/107a1cf3 and /dev/null differ
diff --git a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/10d3eb77 b/.config/.cache/v24.8.0-arm64-ef5a0af0-501/10d3eb77
deleted file mode 100644
index 463bf32..0000000
Binary files a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/10d3eb77 and /dev/null differ
diff --git a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/10edc38a b/.config/.cache/v24.8.0-arm64-ef5a0af0-501/10edc38a
deleted file mode 100644
index d0ecdfe..0000000
Binary files a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/10edc38a and /dev/null differ
diff --git a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/10f8b84d b/.config/.cache/v24.8.0-arm64-ef5a0af0-501/10f8b84d
deleted file mode 100644
index f84af37..0000000
Binary files a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/10f8b84d and /dev/null differ
diff --git a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/11025dd8 b/.config/.cache/v24.8.0-arm64-ef5a0af0-501/11025dd8
deleted file mode 100644
index c5c4061..0000000
Binary files a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/11025dd8 and /dev/null differ
diff --git a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/110fa68b b/.config/.cache/v24.8.0-arm64-ef5a0af0-501/110fa68b
deleted file mode 100644
index 82e32a4..0000000
Binary files a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/110fa68b and /dev/null differ
diff --git a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/1123124f b/.config/.cache/v24.8.0-arm64-ef5a0af0-501/1123124f
deleted file mode 100644
index afafb32..0000000
Binary files a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/1123124f and /dev/null differ
diff --git a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/11277aa3 b/.config/.cache/v24.8.0-arm64-ef5a0af0-501/11277aa3
deleted file mode 100644
index 9ce349f..0000000
Binary files a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/11277aa3 and /dev/null differ
diff --git a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/1130a4fe b/.config/.cache/v24.8.0-arm64-ef5a0af0-501/1130a4fe
deleted file mode 100644
index 2946f82..0000000
Binary files a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/1130a4fe and /dev/null differ
diff --git a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/11390574 b/.config/.cache/v24.8.0-arm64-ef5a0af0-501/11390574
deleted file mode 100644
index 95f89b0..0000000
Binary files a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/11390574 and /dev/null differ
diff --git a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/113ce789 b/.config/.cache/v24.8.0-arm64-ef5a0af0-501/113ce789
deleted file mode 100644
index bcc6534..0000000
Binary files a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/113ce789 and /dev/null differ
diff --git a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/1148810e b/.config/.cache/v24.8.0-arm64-ef5a0af0-501/1148810e
deleted file mode 100644
index 3d57ccd..0000000
Binary files a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/1148810e and /dev/null differ
diff --git a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/1150fa2f b/.config/.cache/v24.8.0-arm64-ef5a0af0-501/1150fa2f
deleted file mode 100644
index 0a8ed1a..0000000
Binary files a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/1150fa2f and /dev/null differ
diff --git a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/117962fd b/.config/.cache/v24.8.0-arm64-ef5a0af0-501/117962fd
deleted file mode 100644
index 87cf706..0000000
Binary files a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/117962fd and /dev/null differ
diff --git a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/11b154d2 b/.config/.cache/v24.8.0-arm64-ef5a0af0-501/11b154d2
deleted file mode 100644
index bfae20a..0000000
Binary files a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/11b154d2 and /dev/null differ
diff --git a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/11c3940e b/.config/.cache/v24.8.0-arm64-ef5a0af0-501/11c3940e
deleted file mode 100644
index d875103..0000000
Binary files a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/11c3940e and /dev/null differ
diff --git a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/1225d501 b/.config/.cache/v24.8.0-arm64-ef5a0af0-501/1225d501
deleted file mode 100644
index a4d3c5e..0000000
Binary files a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/1225d501 and /dev/null differ
diff --git a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/1236b2d1 b/.config/.cache/v24.8.0-arm64-ef5a0af0-501/1236b2d1
deleted file mode 100644
index 9b0dd37..0000000
Binary files a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/1236b2d1 and /dev/null differ
diff --git a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/12373b16 b/.config/.cache/v24.8.0-arm64-ef5a0af0-501/12373b16
deleted file mode 100644
index 253016e..0000000
Binary files a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/12373b16 and /dev/null differ
diff --git a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/12463002 b/.config/.cache/v24.8.0-arm64-ef5a0af0-501/12463002
deleted file mode 100644
index 4da23ac..0000000
Binary files a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/12463002 and /dev/null differ
diff --git a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/1270e579 b/.config/.cache/v24.8.0-arm64-ef5a0af0-501/1270e579
deleted file mode 100644
index 608251f..0000000
Binary files a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/1270e579 and /dev/null differ
diff --git a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/1302807e b/.config/.cache/v24.8.0-arm64-ef5a0af0-501/1302807e
deleted file mode 100644
index 9037e37..0000000
Binary files a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/1302807e and /dev/null differ
diff --git a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/132fab8e b/.config/.cache/v24.8.0-arm64-ef5a0af0-501/132fab8e
deleted file mode 100644
index 3751d68..0000000
Binary files a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/132fab8e and /dev/null differ
diff --git a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/135736b8 b/.config/.cache/v24.8.0-arm64-ef5a0af0-501/135736b8
deleted file mode 100644
index f8ce700..0000000
Binary files a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/135736b8 and /dev/null differ
diff --git a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/137c601c b/.config/.cache/v24.8.0-arm64-ef5a0af0-501/137c601c
deleted file mode 100644
index edddecb..0000000
Binary files a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/137c601c and /dev/null differ
diff --git a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/1428e177 b/.config/.cache/v24.8.0-arm64-ef5a0af0-501/1428e177
deleted file mode 100644
index b237487..0000000
Binary files a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/1428e177 and /dev/null differ
diff --git a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/14290f09 b/.config/.cache/v24.8.0-arm64-ef5a0af0-501/14290f09
deleted file mode 100644
index 38afe76..0000000
Binary files a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/14290f09 and /dev/null differ
diff --git a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/142e8cd1 b/.config/.cache/v24.8.0-arm64-ef5a0af0-501/142e8cd1
deleted file mode 100644
index 221965b..0000000
Binary files a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/142e8cd1 and /dev/null differ
diff --git a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/14341c75 b/.config/.cache/v24.8.0-arm64-ef5a0af0-501/14341c75
deleted file mode 100644
index f72a546..0000000
Binary files a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/14341c75 and /dev/null differ
diff --git a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/143c0aa2 b/.config/.cache/v24.8.0-arm64-ef5a0af0-501/143c0aa2
deleted file mode 100644
index 4527581..0000000
Binary files a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/143c0aa2 and /dev/null differ
diff --git a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/1444f4ad b/.config/.cache/v24.8.0-arm64-ef5a0af0-501/1444f4ad
deleted file mode 100644
index 1e4f13a..0000000
Binary files a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/1444f4ad and /dev/null differ
diff --git a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/1497033b b/.config/.cache/v24.8.0-arm64-ef5a0af0-501/1497033b
deleted file mode 100644
index 3144f5c..0000000
Binary files a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/1497033b and /dev/null differ
diff --git a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/14be9da0 b/.config/.cache/v24.8.0-arm64-ef5a0af0-501/14be9da0
deleted file mode 100644
index ee0cc3f..0000000
Binary files a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/14be9da0 and /dev/null differ
diff --git a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/14c37079 b/.config/.cache/v24.8.0-arm64-ef5a0af0-501/14c37079
deleted file mode 100644
index 60101f0..0000000
Binary files a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/14c37079 and /dev/null differ
diff --git a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/14cf6e4d b/.config/.cache/v24.8.0-arm64-ef5a0af0-501/14cf6e4d
deleted file mode 100644
index 4a19e2e..0000000
Binary files a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/14cf6e4d and /dev/null differ
diff --git a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/14f2bb13 b/.config/.cache/v24.8.0-arm64-ef5a0af0-501/14f2bb13
deleted file mode 100644
index 7036a15..0000000
Binary files a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/14f2bb13 and /dev/null differ
diff --git a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/152c0816 b/.config/.cache/v24.8.0-arm64-ef5a0af0-501/152c0816
deleted file mode 100644
index 22d6745..0000000
Binary files a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/152c0816 and /dev/null differ
diff --git a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/152ecf08 b/.config/.cache/v24.8.0-arm64-ef5a0af0-501/152ecf08
deleted file mode 100644
index 8ad2ae3..0000000
Binary files a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/152ecf08 and /dev/null differ
diff --git a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/15332e6f b/.config/.cache/v24.8.0-arm64-ef5a0af0-501/15332e6f
deleted file mode 100644
index 2f9a0d1..0000000
Binary files a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/15332e6f and /dev/null differ
diff --git a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/15916817 b/.config/.cache/v24.8.0-arm64-ef5a0af0-501/15916817
deleted file mode 100644
index 011897f..0000000
Binary files a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/15916817 and /dev/null differ
diff --git a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/15a30cee b/.config/.cache/v24.8.0-arm64-ef5a0af0-501/15a30cee
deleted file mode 100644
index dbaa4e0..0000000
Binary files a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/15a30cee and /dev/null differ
diff --git a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/15e12c2e b/.config/.cache/v24.8.0-arm64-ef5a0af0-501/15e12c2e
deleted file mode 100644
index 76478a6..0000000
Binary files a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/15e12c2e and /dev/null differ
diff --git a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/15ee9b2d b/.config/.cache/v24.8.0-arm64-ef5a0af0-501/15ee9b2d
deleted file mode 100644
index 0e75aba..0000000
Binary files a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/15ee9b2d and /dev/null differ
diff --git a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/160da151 b/.config/.cache/v24.8.0-arm64-ef5a0af0-501/160da151
deleted file mode 100644
index 8be4507..0000000
Binary files a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/160da151 and /dev/null differ
diff --git a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/161cf2a3 b/.config/.cache/v24.8.0-arm64-ef5a0af0-501/161cf2a3
deleted file mode 100644
index 8932e29..0000000
Binary files a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/161cf2a3 and /dev/null differ
diff --git a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/16214351 b/.config/.cache/v24.8.0-arm64-ef5a0af0-501/16214351
deleted file mode 100644
index 3ba5e3f..0000000
Binary files a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/16214351 and /dev/null differ
diff --git a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/16750e75 b/.config/.cache/v24.8.0-arm64-ef5a0af0-501/16750e75
deleted file mode 100644
index bc29d89..0000000
Binary files a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/16750e75 and /dev/null differ
diff --git a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/167c6bab b/.config/.cache/v24.8.0-arm64-ef5a0af0-501/167c6bab
deleted file mode 100644
index 39e007b..0000000
Binary files a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/167c6bab and /dev/null differ
diff --git a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/1689c765 b/.config/.cache/v24.8.0-arm64-ef5a0af0-501/1689c765
deleted file mode 100644
index 266434c..0000000
Binary files a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/1689c765 and /dev/null differ
diff --git a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/168e7a46 b/.config/.cache/v24.8.0-arm64-ef5a0af0-501/168e7a46
deleted file mode 100644
index 2082417..0000000
Binary files a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/168e7a46 and /dev/null differ
diff --git a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/16d1454b b/.config/.cache/v24.8.0-arm64-ef5a0af0-501/16d1454b
deleted file mode 100644
index 64e32f9..0000000
Binary files a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/16d1454b and /dev/null differ
diff --git a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/16faf240 b/.config/.cache/v24.8.0-arm64-ef5a0af0-501/16faf240
deleted file mode 100644
index 0b935d7..0000000
Binary files a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/16faf240 and /dev/null differ
diff --git a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/176c6645 b/.config/.cache/v24.8.0-arm64-ef5a0af0-501/176c6645
deleted file mode 100644
index 08f6616..0000000
Binary files a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/176c6645 and /dev/null differ
diff --git a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/178e3cb9 b/.config/.cache/v24.8.0-arm64-ef5a0af0-501/178e3cb9
deleted file mode 100644
index 882a50f..0000000
Binary files a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/178e3cb9 and /dev/null differ
diff --git a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/17931f25 b/.config/.cache/v24.8.0-arm64-ef5a0af0-501/17931f25
deleted file mode 100644
index 6515c43..0000000
Binary files a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/17931f25 and /dev/null differ
diff --git a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/1817605b b/.config/.cache/v24.8.0-arm64-ef5a0af0-501/1817605b
deleted file mode 100644
index c86a823..0000000
Binary files a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/1817605b and /dev/null differ
diff --git a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/181e7357 b/.config/.cache/v24.8.0-arm64-ef5a0af0-501/181e7357
deleted file mode 100644
index 264e9cd..0000000
Binary files a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/181e7357 and /dev/null differ
diff --git a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/1823e7bc b/.config/.cache/v24.8.0-arm64-ef5a0af0-501/1823e7bc
deleted file mode 100644
index 183f03b..0000000
Binary files a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/1823e7bc and /dev/null differ
diff --git a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/1829bacf b/.config/.cache/v24.8.0-arm64-ef5a0af0-501/1829bacf
deleted file mode 100644
index 35abc03..0000000
Binary files a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/1829bacf and /dev/null differ
diff --git a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/18470f66 b/.config/.cache/v24.8.0-arm64-ef5a0af0-501/18470f66
deleted file mode 100644
index f0c6284..0000000
Binary files a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/18470f66 and /dev/null differ
diff --git a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/18b36e9f b/.config/.cache/v24.8.0-arm64-ef5a0af0-501/18b36e9f
deleted file mode 100644
index c28704e..0000000
Binary files a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/18b36e9f and /dev/null differ
diff --git a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/19271127 b/.config/.cache/v24.8.0-arm64-ef5a0af0-501/19271127
deleted file mode 100644
index 2ff81dd..0000000
Binary files a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/19271127 and /dev/null differ
diff --git a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/19421288 b/.config/.cache/v24.8.0-arm64-ef5a0af0-501/19421288
deleted file mode 100644
index 8c93d8a..0000000
Binary files a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/19421288 and /dev/null differ
diff --git a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/195adf82 b/.config/.cache/v24.8.0-arm64-ef5a0af0-501/195adf82
deleted file mode 100644
index db55583..0000000
Binary files a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/195adf82 and /dev/null differ
diff --git a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/1984b8ae b/.config/.cache/v24.8.0-arm64-ef5a0af0-501/1984b8ae
deleted file mode 100644
index ab9b41c..0000000
Binary files a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/1984b8ae and /dev/null differ
diff --git a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/19ea97c2 b/.config/.cache/v24.8.0-arm64-ef5a0af0-501/19ea97c2
deleted file mode 100644
index 116c42d..0000000
Binary files a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/19ea97c2 and /dev/null differ
diff --git a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/1a0646ca b/.config/.cache/v24.8.0-arm64-ef5a0af0-501/1a0646ca
deleted file mode 100644
index 698bfac..0000000
Binary files a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/1a0646ca and /dev/null differ
diff --git a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/1a4cb2e5 b/.config/.cache/v24.8.0-arm64-ef5a0af0-501/1a4cb2e5
deleted file mode 100644
index 7360422..0000000
Binary files a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/1a4cb2e5 and /dev/null differ
diff --git a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/1a4d7a8c b/.config/.cache/v24.8.0-arm64-ef5a0af0-501/1a4d7a8c
deleted file mode 100644
index 97930c0..0000000
Binary files a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/1a4d7a8c and /dev/null differ
diff --git a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/1a525896 b/.config/.cache/v24.8.0-arm64-ef5a0af0-501/1a525896
deleted file mode 100644
index 9cfe46e..0000000
Binary files a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/1a525896 and /dev/null differ
diff --git a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/1a66d9f2 b/.config/.cache/v24.8.0-arm64-ef5a0af0-501/1a66d9f2
deleted file mode 100644
index 23cd306..0000000
Binary files a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/1a66d9f2 and /dev/null differ
diff --git a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/1a69fa24 b/.config/.cache/v24.8.0-arm64-ef5a0af0-501/1a69fa24
deleted file mode 100644
index dbe73b1..0000000
Binary files a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/1a69fa24 and /dev/null differ
diff --git a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/1a99ee7c b/.config/.cache/v24.8.0-arm64-ef5a0af0-501/1a99ee7c
deleted file mode 100644
index cfacbf7..0000000
Binary files a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/1a99ee7c and /dev/null differ
diff --git a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/1ad419ea b/.config/.cache/v24.8.0-arm64-ef5a0af0-501/1ad419ea
deleted file mode 100644
index d5f2522..0000000
Binary files a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/1ad419ea and /dev/null differ
diff --git a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/1b0ca130 b/.config/.cache/v24.8.0-arm64-ef5a0af0-501/1b0ca130
deleted file mode 100644
index 731010a..0000000
Binary files a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/1b0ca130 and /dev/null differ
diff --git a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/1b16ed86 b/.config/.cache/v24.8.0-arm64-ef5a0af0-501/1b16ed86
deleted file mode 100644
index 41a89b4..0000000
Binary files a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/1b16ed86 and /dev/null differ
diff --git a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/1b2989fe b/.config/.cache/v24.8.0-arm64-ef5a0af0-501/1b2989fe
deleted file mode 100644
index 8df570e..0000000
Binary files a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/1b2989fe and /dev/null differ
diff --git a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/1bcf31b9 b/.config/.cache/v24.8.0-arm64-ef5a0af0-501/1bcf31b9
deleted file mode 100644
index de5e9e6..0000000
Binary files a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/1bcf31b9 and /dev/null differ
diff --git a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/1bfbc625 b/.config/.cache/v24.8.0-arm64-ef5a0af0-501/1bfbc625
deleted file mode 100644
index 290b9db..0000000
Binary files a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/1bfbc625 and /dev/null differ
diff --git a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/1c2b06e8 b/.config/.cache/v24.8.0-arm64-ef5a0af0-501/1c2b06e8
deleted file mode 100644
index 689bf12..0000000
Binary files a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/1c2b06e8 and /dev/null differ
diff --git a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/1c2bdc78 b/.config/.cache/v24.8.0-arm64-ef5a0af0-501/1c2bdc78
deleted file mode 100644
index 7a11d0f..0000000
Binary files a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/1c2bdc78 and /dev/null differ
diff --git a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/1c4f0722 b/.config/.cache/v24.8.0-arm64-ef5a0af0-501/1c4f0722
deleted file mode 100644
index a0d4aef..0000000
Binary files a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/1c4f0722 and /dev/null differ
diff --git a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/1c64ff4a b/.config/.cache/v24.8.0-arm64-ef5a0af0-501/1c64ff4a
deleted file mode 100644
index 7c05e33..0000000
Binary files a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/1c64ff4a and /dev/null differ
diff --git a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/1c9443fc b/.config/.cache/v24.8.0-arm64-ef5a0af0-501/1c9443fc
deleted file mode 100644
index dddbf84..0000000
Binary files a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/1c9443fc and /dev/null differ
diff --git a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/1cad1ddb b/.config/.cache/v24.8.0-arm64-ef5a0af0-501/1cad1ddb
deleted file mode 100644
index 74d5ee8..0000000
Binary files a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/1cad1ddb and /dev/null differ
diff --git a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/1cb6bf08 b/.config/.cache/v24.8.0-arm64-ef5a0af0-501/1cb6bf08
deleted file mode 100644
index 89c1432..0000000
Binary files a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/1cb6bf08 and /dev/null differ
diff --git a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/1cc6d7ca b/.config/.cache/v24.8.0-arm64-ef5a0af0-501/1cc6d7ca
deleted file mode 100644
index 36a5f3f..0000000
Binary files a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/1cc6d7ca and /dev/null differ
diff --git a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/1ce33fbb b/.config/.cache/v24.8.0-arm64-ef5a0af0-501/1ce33fbb
deleted file mode 100644
index d6be133..0000000
Binary files a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/1ce33fbb and /dev/null differ
diff --git a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/1cf50610 b/.config/.cache/v24.8.0-arm64-ef5a0af0-501/1cf50610
deleted file mode 100644
index cca6fe0..0000000
Binary files a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/1cf50610 and /dev/null differ
diff --git a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/1cf7083f b/.config/.cache/v24.8.0-arm64-ef5a0af0-501/1cf7083f
deleted file mode 100644
index c834925..0000000
Binary files a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/1cf7083f and /dev/null differ
diff --git a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/1d1dbcc8 b/.config/.cache/v24.8.0-arm64-ef5a0af0-501/1d1dbcc8
deleted file mode 100644
index 41517d9..0000000
Binary files a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/1d1dbcc8 and /dev/null differ
diff --git a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/1d28eede b/.config/.cache/v24.8.0-arm64-ef5a0af0-501/1d28eede
deleted file mode 100644
index bbb5df5..0000000
Binary files a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/1d28eede and /dev/null differ
diff --git a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/1d5e4623 b/.config/.cache/v24.8.0-arm64-ef5a0af0-501/1d5e4623
deleted file mode 100644
index c1627cd..0000000
Binary files a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/1d5e4623 and /dev/null differ
diff --git a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/1d8588e2 b/.config/.cache/v24.8.0-arm64-ef5a0af0-501/1d8588e2
deleted file mode 100644
index 319df25..0000000
Binary files a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/1d8588e2 and /dev/null differ
diff --git a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/1d95ce7f b/.config/.cache/v24.8.0-arm64-ef5a0af0-501/1d95ce7f
deleted file mode 100644
index 9d9b4ad..0000000
Binary files a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/1d95ce7f and /dev/null differ
diff --git a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/1dc63009 b/.config/.cache/v24.8.0-arm64-ef5a0af0-501/1dc63009
deleted file mode 100644
index 5145c64..0000000
Binary files a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/1dc63009 and /dev/null differ
diff --git a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/1dcf58ea b/.config/.cache/v24.8.0-arm64-ef5a0af0-501/1dcf58ea
deleted file mode 100644
index 5a6d37d..0000000
Binary files a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/1dcf58ea and /dev/null differ
diff --git a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/1dd6e242 b/.config/.cache/v24.8.0-arm64-ef5a0af0-501/1dd6e242
deleted file mode 100644
index f4983ba..0000000
Binary files a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/1dd6e242 and /dev/null differ
diff --git a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/1dd9a5d6 b/.config/.cache/v24.8.0-arm64-ef5a0af0-501/1dd9a5d6
deleted file mode 100644
index 29cdf1c..0000000
Binary files a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/1dd9a5d6 and /dev/null differ
diff --git a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/1e1e7905 b/.config/.cache/v24.8.0-arm64-ef5a0af0-501/1e1e7905
deleted file mode 100644
index ebf3de5..0000000
Binary files a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/1e1e7905 and /dev/null differ
diff --git a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/1e28acbc b/.config/.cache/v24.8.0-arm64-ef5a0af0-501/1e28acbc
deleted file mode 100644
index bcd6229..0000000
Binary files a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/1e28acbc and /dev/null differ
diff --git a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/1e515348 b/.config/.cache/v24.8.0-arm64-ef5a0af0-501/1e515348
deleted file mode 100644
index a7faf0b..0000000
Binary files a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/1e515348 and /dev/null differ
diff --git a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/1e6e1464 b/.config/.cache/v24.8.0-arm64-ef5a0af0-501/1e6e1464
deleted file mode 100644
index c28c1e7..0000000
Binary files a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/1e6e1464 and /dev/null differ
diff --git a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/1e9a45c2 b/.config/.cache/v24.8.0-arm64-ef5a0af0-501/1e9a45c2
deleted file mode 100644
index 9b54bc5..0000000
Binary files a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/1e9a45c2 and /dev/null differ
diff --git a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/1f1b4316 b/.config/.cache/v24.8.0-arm64-ef5a0af0-501/1f1b4316
deleted file mode 100644
index b9aa5e2..0000000
Binary files a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/1f1b4316 and /dev/null differ
diff --git a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/1f44500d b/.config/.cache/v24.8.0-arm64-ef5a0af0-501/1f44500d
deleted file mode 100644
index 4a289e2..0000000
Binary files a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/1f44500d and /dev/null differ
diff --git a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/1f6fda1b b/.config/.cache/v24.8.0-arm64-ef5a0af0-501/1f6fda1b
deleted file mode 100644
index 5a27f00..0000000
Binary files a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/1f6fda1b and /dev/null differ
diff --git a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/1f7defb1 b/.config/.cache/v24.8.0-arm64-ef5a0af0-501/1f7defb1
deleted file mode 100644
index e08b8ae..0000000
Binary files a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/1f7defb1 and /dev/null differ
diff --git a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/1fc773b8 b/.config/.cache/v24.8.0-arm64-ef5a0af0-501/1fc773b8
deleted file mode 100644
index 3cd2b8f..0000000
Binary files a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/1fc773b8 and /dev/null differ
diff --git a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/1fcba434 b/.config/.cache/v24.8.0-arm64-ef5a0af0-501/1fcba434
deleted file mode 100644
index 6dc46fb..0000000
Binary files a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/1fcba434 and /dev/null differ
diff --git a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/200b8daf b/.config/.cache/v24.8.0-arm64-ef5a0af0-501/200b8daf
deleted file mode 100644
index 786ff68..0000000
Binary files a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/200b8daf and /dev/null differ
diff --git a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/205e27ba b/.config/.cache/v24.8.0-arm64-ef5a0af0-501/205e27ba
deleted file mode 100644
index 0aef8c2..0000000
Binary files a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/205e27ba and /dev/null differ
diff --git a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/2071cfef b/.config/.cache/v24.8.0-arm64-ef5a0af0-501/2071cfef
deleted file mode 100644
index bce6310..0000000
Binary files a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/2071cfef and /dev/null differ
diff --git a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/207d00ef b/.config/.cache/v24.8.0-arm64-ef5a0af0-501/207d00ef
deleted file mode 100644
index 877092e..0000000
Binary files a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/207d00ef and /dev/null differ
diff --git a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/209b9173 b/.config/.cache/v24.8.0-arm64-ef5a0af0-501/209b9173
deleted file mode 100644
index 5870608..0000000
Binary files a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/209b9173 and /dev/null differ
diff --git a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/20f486ef b/.config/.cache/v24.8.0-arm64-ef5a0af0-501/20f486ef
deleted file mode 100644
index 346841f..0000000
Binary files a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/20f486ef and /dev/null differ
diff --git a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/2106197f b/.config/.cache/v24.8.0-arm64-ef5a0af0-501/2106197f
deleted file mode 100644
index da87d80..0000000
Binary files a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/2106197f and /dev/null differ
diff --git a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/21ce9f17 b/.config/.cache/v24.8.0-arm64-ef5a0af0-501/21ce9f17
deleted file mode 100644
index b01e806..0000000
Binary files a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/21ce9f17 and /dev/null differ
diff --git a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/222c9f89 b/.config/.cache/v24.8.0-arm64-ef5a0af0-501/222c9f89
deleted file mode 100644
index 47efb40..0000000
Binary files a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/222c9f89 and /dev/null differ
diff --git a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/225c1917 b/.config/.cache/v24.8.0-arm64-ef5a0af0-501/225c1917
deleted file mode 100644
index 73c8c3d..0000000
Binary files a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/225c1917 and /dev/null differ
diff --git a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/227952e0 b/.config/.cache/v24.8.0-arm64-ef5a0af0-501/227952e0
deleted file mode 100644
index 0f6c399..0000000
Binary files a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/227952e0 and /dev/null differ
diff --git a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/2279bb54 b/.config/.cache/v24.8.0-arm64-ef5a0af0-501/2279bb54
deleted file mode 100644
index 1c074f0..0000000
Binary files a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/2279bb54 and /dev/null differ
diff --git a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/22d351a1 b/.config/.cache/v24.8.0-arm64-ef5a0af0-501/22d351a1
deleted file mode 100644
index cfd7773..0000000
Binary files a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/22d351a1 and /dev/null differ
diff --git a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/22df98ba b/.config/.cache/v24.8.0-arm64-ef5a0af0-501/22df98ba
deleted file mode 100644
index ba62788..0000000
Binary files a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/22df98ba and /dev/null differ
diff --git a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/2300362b b/.config/.cache/v24.8.0-arm64-ef5a0af0-501/2300362b
deleted file mode 100644
index d01c04a..0000000
Binary files a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/2300362b and /dev/null differ
diff --git a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/232e6988 b/.config/.cache/v24.8.0-arm64-ef5a0af0-501/232e6988
deleted file mode 100644
index b13738f..0000000
Binary files a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/232e6988 and /dev/null differ
diff --git a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/238fa0e6 b/.config/.cache/v24.8.0-arm64-ef5a0af0-501/238fa0e6
deleted file mode 100644
index f60fd49..0000000
Binary files a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/238fa0e6 and /dev/null differ
diff --git a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/23b12fa9 b/.config/.cache/v24.8.0-arm64-ef5a0af0-501/23b12fa9
deleted file mode 100644
index 17367f0..0000000
Binary files a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/23b12fa9 and /dev/null differ
diff --git a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/24033e79 b/.config/.cache/v24.8.0-arm64-ef5a0af0-501/24033e79
deleted file mode 100644
index f923997..0000000
Binary files a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/24033e79 and /dev/null differ
diff --git a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/240a8784 b/.config/.cache/v24.8.0-arm64-ef5a0af0-501/240a8784
deleted file mode 100644
index 466e8a4..0000000
Binary files a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/240a8784 and /dev/null differ
diff --git a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/24220670 b/.config/.cache/v24.8.0-arm64-ef5a0af0-501/24220670
deleted file mode 100644
index 9d2d39d..0000000
Binary files a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/24220670 and /dev/null differ
diff --git a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/253d29fd b/.config/.cache/v24.8.0-arm64-ef5a0af0-501/253d29fd
deleted file mode 100644
index 33db74f..0000000
Binary files a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/253d29fd and /dev/null differ
diff --git a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/254af682 b/.config/.cache/v24.8.0-arm64-ef5a0af0-501/254af682
deleted file mode 100644
index 41a5c6d..0000000
Binary files a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/254af682 and /dev/null differ
diff --git a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/25647907 b/.config/.cache/v24.8.0-arm64-ef5a0af0-501/25647907
deleted file mode 100644
index 8f326d9..0000000
Binary files a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/25647907 and /dev/null differ
diff --git a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/25fdd591 b/.config/.cache/v24.8.0-arm64-ef5a0af0-501/25fdd591
deleted file mode 100644
index 6897397..0000000
Binary files a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/25fdd591 and /dev/null differ
diff --git a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/2632560a b/.config/.cache/v24.8.0-arm64-ef5a0af0-501/2632560a
deleted file mode 100644
index 0102ff6..0000000
Binary files a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/2632560a and /dev/null differ
diff --git a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/2666018f b/.config/.cache/v24.8.0-arm64-ef5a0af0-501/2666018f
deleted file mode 100644
index a1feb8e..0000000
Binary files a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/2666018f and /dev/null differ
diff --git a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/26ce2e77 b/.config/.cache/v24.8.0-arm64-ef5a0af0-501/26ce2e77
deleted file mode 100644
index eb98171..0000000
Binary files a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/26ce2e77 and /dev/null differ
diff --git a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/27173795 b/.config/.cache/v24.8.0-arm64-ef5a0af0-501/27173795
deleted file mode 100644
index dcd19f1..0000000
Binary files a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/27173795 and /dev/null differ
diff --git a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/274375f5 b/.config/.cache/v24.8.0-arm64-ef5a0af0-501/274375f5
deleted file mode 100644
index 1eed81e..0000000
Binary files a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/274375f5 and /dev/null differ
diff --git a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/274729ab b/.config/.cache/v24.8.0-arm64-ef5a0af0-501/274729ab
deleted file mode 100644
index 2177a99..0000000
Binary files a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/274729ab and /dev/null differ
diff --git a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/276231b4 b/.config/.cache/v24.8.0-arm64-ef5a0af0-501/276231b4
deleted file mode 100644
index 5e0a5d3..0000000
Binary files a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/276231b4 and /dev/null differ
diff --git a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/2764e3e2 b/.config/.cache/v24.8.0-arm64-ef5a0af0-501/2764e3e2
deleted file mode 100644
index 3acd5f5..0000000
Binary files a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/2764e3e2 and /dev/null differ
diff --git a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/2788f40c b/.config/.cache/v24.8.0-arm64-ef5a0af0-501/2788f40c
deleted file mode 100644
index 68da851..0000000
Binary files a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/2788f40c and /dev/null differ
diff --git a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/27b80af3 b/.config/.cache/v24.8.0-arm64-ef5a0af0-501/27b80af3
deleted file mode 100644
index 0b329a4..0000000
Binary files a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/27b80af3 and /dev/null differ
diff --git a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/282641c4 b/.config/.cache/v24.8.0-arm64-ef5a0af0-501/282641c4
deleted file mode 100644
index fbc6c8b..0000000
Binary files a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/282641c4 and /dev/null differ
diff --git a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/28764a5a b/.config/.cache/v24.8.0-arm64-ef5a0af0-501/28764a5a
deleted file mode 100644
index 174953f..0000000
Binary files a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/28764a5a and /dev/null differ
diff --git a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/28ab45e6 b/.config/.cache/v24.8.0-arm64-ef5a0af0-501/28ab45e6
deleted file mode 100644
index 898b87a..0000000
Binary files a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/28ab45e6 and /dev/null differ
diff --git a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/28d6d196 b/.config/.cache/v24.8.0-arm64-ef5a0af0-501/28d6d196
deleted file mode 100644
index 7052091..0000000
Binary files a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/28d6d196 and /dev/null differ
diff --git a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/28f78bf1 b/.config/.cache/v24.8.0-arm64-ef5a0af0-501/28f78bf1
deleted file mode 100644
index c43c6e1..0000000
Binary files a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/28f78bf1 and /dev/null differ
diff --git a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/2904a21e b/.config/.cache/v24.8.0-arm64-ef5a0af0-501/2904a21e
deleted file mode 100644
index 576350f..0000000
Binary files a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/2904a21e and /dev/null differ
diff --git a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/2919d0ee b/.config/.cache/v24.8.0-arm64-ef5a0af0-501/2919d0ee
deleted file mode 100644
index 6d71268..0000000
Binary files a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/2919d0ee and /dev/null differ
diff --git a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/295015ac b/.config/.cache/v24.8.0-arm64-ef5a0af0-501/295015ac
deleted file mode 100644
index aecd7ac..0000000
Binary files a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/295015ac and /dev/null differ
diff --git a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/299ac979 b/.config/.cache/v24.8.0-arm64-ef5a0af0-501/299ac979
deleted file mode 100644
index f1e9ac6..0000000
Binary files a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/299ac979 and /dev/null differ
diff --git a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/29c07c0f b/.config/.cache/v24.8.0-arm64-ef5a0af0-501/29c07c0f
deleted file mode 100644
index ff0d493..0000000
Binary files a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/29c07c0f and /dev/null differ
diff --git a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/29f30873 b/.config/.cache/v24.8.0-arm64-ef5a0af0-501/29f30873
deleted file mode 100644
index f65a13c..0000000
Binary files a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/29f30873 and /dev/null differ
diff --git a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/2a2c3c57 b/.config/.cache/v24.8.0-arm64-ef5a0af0-501/2a2c3c57
deleted file mode 100644
index d02da75..0000000
Binary files a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/2a2c3c57 and /dev/null differ
diff --git a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/2a7d7502 b/.config/.cache/v24.8.0-arm64-ef5a0af0-501/2a7d7502
deleted file mode 100644
index b5e1435..0000000
Binary files a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/2a7d7502 and /dev/null differ
diff --git a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/2ab84621 b/.config/.cache/v24.8.0-arm64-ef5a0af0-501/2ab84621
deleted file mode 100644
index b00aa9c..0000000
Binary files a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/2ab84621 and /dev/null differ
diff --git a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/2ad8a484 b/.config/.cache/v24.8.0-arm64-ef5a0af0-501/2ad8a484
deleted file mode 100644
index 412b196..0000000
Binary files a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/2ad8a484 and /dev/null differ
diff --git a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/2adac4f8 b/.config/.cache/v24.8.0-arm64-ef5a0af0-501/2adac4f8
deleted file mode 100644
index df00eea..0000000
Binary files a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/2adac4f8 and /dev/null differ
diff --git a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/2ae5551c b/.config/.cache/v24.8.0-arm64-ef5a0af0-501/2ae5551c
deleted file mode 100644
index 4bf273e..0000000
Binary files a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/2ae5551c and /dev/null differ
diff --git a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/2af671d9 b/.config/.cache/v24.8.0-arm64-ef5a0af0-501/2af671d9
deleted file mode 100644
index c1602b1..0000000
Binary files a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/2af671d9 and /dev/null differ
diff --git a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/2afe32db b/.config/.cache/v24.8.0-arm64-ef5a0af0-501/2afe32db
deleted file mode 100644
index 5adf136..0000000
Binary files a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/2afe32db and /dev/null differ
diff --git a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/2b4d10de b/.config/.cache/v24.8.0-arm64-ef5a0af0-501/2b4d10de
deleted file mode 100644
index c8713e4..0000000
Binary files a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/2b4d10de and /dev/null differ
diff --git a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/2b5a9b5f b/.config/.cache/v24.8.0-arm64-ef5a0af0-501/2b5a9b5f
deleted file mode 100644
index 0841fd9..0000000
Binary files a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/2b5a9b5f and /dev/null differ
diff --git a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/2b64e2f8 b/.config/.cache/v24.8.0-arm64-ef5a0af0-501/2b64e2f8
deleted file mode 100644
index 09ef215..0000000
Binary files a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/2b64e2f8 and /dev/null differ
diff --git a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/2b691e80 b/.config/.cache/v24.8.0-arm64-ef5a0af0-501/2b691e80
deleted file mode 100644
index 727eb31..0000000
Binary files a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/2b691e80 and /dev/null differ
diff --git a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/2b69c5c1 b/.config/.cache/v24.8.0-arm64-ef5a0af0-501/2b69c5c1
deleted file mode 100644
index 9e61767..0000000
Binary files a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/2b69c5c1 and /dev/null differ
diff --git a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/2b975d6a b/.config/.cache/v24.8.0-arm64-ef5a0af0-501/2b975d6a
deleted file mode 100644
index 877eb69..0000000
Binary files a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/2b975d6a and /dev/null differ
diff --git a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/2b9f18d8 b/.config/.cache/v24.8.0-arm64-ef5a0af0-501/2b9f18d8
deleted file mode 100644
index 2fbc8f4..0000000
Binary files a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/2b9f18d8 and /dev/null differ
diff --git a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/2be62ed9 b/.config/.cache/v24.8.0-arm64-ef5a0af0-501/2be62ed9
deleted file mode 100644
index 8a6892f..0000000
Binary files a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/2be62ed9 and /dev/null differ
diff --git a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/2bfa1dd9 b/.config/.cache/v24.8.0-arm64-ef5a0af0-501/2bfa1dd9
deleted file mode 100644
index b41ac46..0000000
Binary files a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/2bfa1dd9 and /dev/null differ
diff --git a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/2c019970 b/.config/.cache/v24.8.0-arm64-ef5a0af0-501/2c019970
deleted file mode 100644
index cd6a539..0000000
Binary files a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/2c019970 and /dev/null differ
diff --git a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/2c1bb03e b/.config/.cache/v24.8.0-arm64-ef5a0af0-501/2c1bb03e
deleted file mode 100644
index 0228829..0000000
Binary files a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/2c1bb03e and /dev/null differ
diff --git a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/2c26d1a1 b/.config/.cache/v24.8.0-arm64-ef5a0af0-501/2c26d1a1
deleted file mode 100644
index 14b53fa..0000000
Binary files a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/2c26d1a1 and /dev/null differ
diff --git a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/2c3c5fee b/.config/.cache/v24.8.0-arm64-ef5a0af0-501/2c3c5fee
deleted file mode 100644
index 8372715..0000000
Binary files a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/2c3c5fee and /dev/null differ
diff --git a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/2c7f6f05 b/.config/.cache/v24.8.0-arm64-ef5a0af0-501/2c7f6f05
deleted file mode 100644
index 0e6d13e..0000000
Binary files a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/2c7f6f05 and /dev/null differ
diff --git a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/2c813677 b/.config/.cache/v24.8.0-arm64-ef5a0af0-501/2c813677
deleted file mode 100644
index 77f1f14..0000000
Binary files a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/2c813677 and /dev/null differ
diff --git a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/2c8aff89 b/.config/.cache/v24.8.0-arm64-ef5a0af0-501/2c8aff89
deleted file mode 100644
index 4a6e34e..0000000
Binary files a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/2c8aff89 and /dev/null differ
diff --git a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/2c8d583f b/.config/.cache/v24.8.0-arm64-ef5a0af0-501/2c8d583f
deleted file mode 100644
index cd91f94..0000000
Binary files a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/2c8d583f and /dev/null differ
diff --git a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/2ca256cb b/.config/.cache/v24.8.0-arm64-ef5a0af0-501/2ca256cb
deleted file mode 100644
index b7f7e62..0000000
Binary files a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/2ca256cb and /dev/null differ
diff --git a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/2ccb48bd b/.config/.cache/v24.8.0-arm64-ef5a0af0-501/2ccb48bd
deleted file mode 100644
index 916bf7a..0000000
Binary files a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/2ccb48bd and /dev/null differ
diff --git a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/2d1a6ec7 b/.config/.cache/v24.8.0-arm64-ef5a0af0-501/2d1a6ec7
deleted file mode 100644
index f5aa784..0000000
Binary files a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/2d1a6ec7 and /dev/null differ
diff --git a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/2d1dea60 b/.config/.cache/v24.8.0-arm64-ef5a0af0-501/2d1dea60
deleted file mode 100644
index c11186b..0000000
Binary files a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/2d1dea60 and /dev/null differ
diff --git a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/2d39ef2d b/.config/.cache/v24.8.0-arm64-ef5a0af0-501/2d39ef2d
deleted file mode 100644
index 72451cd..0000000
Binary files a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/2d39ef2d and /dev/null differ
diff --git a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/2d920c3d b/.config/.cache/v24.8.0-arm64-ef5a0af0-501/2d920c3d
deleted file mode 100644
index 998eb16..0000000
Binary files a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/2d920c3d and /dev/null differ
diff --git a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/2dcbfc6c b/.config/.cache/v24.8.0-arm64-ef5a0af0-501/2dcbfc6c
deleted file mode 100644
index 28abb37..0000000
Binary files a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/2dcbfc6c and /dev/null differ
diff --git a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/2de6be43 b/.config/.cache/v24.8.0-arm64-ef5a0af0-501/2de6be43
deleted file mode 100644
index a0bc734..0000000
Binary files a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/2de6be43 and /dev/null differ
diff --git a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/2deff9f3 b/.config/.cache/v24.8.0-arm64-ef5a0af0-501/2deff9f3
deleted file mode 100644
index 48f359a..0000000
Binary files a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/2deff9f3 and /dev/null differ
diff --git a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/2e221951 b/.config/.cache/v24.8.0-arm64-ef5a0af0-501/2e221951
deleted file mode 100644
index 1ebad59..0000000
Binary files a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/2e221951 and /dev/null differ
diff --git a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/2e70e0f8 b/.config/.cache/v24.8.0-arm64-ef5a0af0-501/2e70e0f8
deleted file mode 100644
index f42d036..0000000
Binary files a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/2e70e0f8 and /dev/null differ
diff --git a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/2e945a0b b/.config/.cache/v24.8.0-arm64-ef5a0af0-501/2e945a0b
deleted file mode 100644
index 1efe405..0000000
Binary files a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/2e945a0b and /dev/null differ
diff --git a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/2edc3728 b/.config/.cache/v24.8.0-arm64-ef5a0af0-501/2edc3728
deleted file mode 100644
index 03d2535..0000000
Binary files a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/2edc3728 and /dev/null differ
diff --git a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/2ef8cabf b/.config/.cache/v24.8.0-arm64-ef5a0af0-501/2ef8cabf
deleted file mode 100644
index b654991..0000000
Binary files a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/2ef8cabf and /dev/null differ
diff --git a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/2ef9dcbb b/.config/.cache/v24.8.0-arm64-ef5a0af0-501/2ef9dcbb
deleted file mode 100644
index 30510a2..0000000
Binary files a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/2ef9dcbb and /dev/null differ
diff --git a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/2efa45ee b/.config/.cache/v24.8.0-arm64-ef5a0af0-501/2efa45ee
deleted file mode 100644
index 737ef93..0000000
Binary files a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/2efa45ee and /dev/null differ
diff --git a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/2f44d2fc b/.config/.cache/v24.8.0-arm64-ef5a0af0-501/2f44d2fc
deleted file mode 100644
index 2b407bb..0000000
Binary files a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/2f44d2fc and /dev/null differ
diff --git a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/2f68d357 b/.config/.cache/v24.8.0-arm64-ef5a0af0-501/2f68d357
deleted file mode 100644
index 26c6949..0000000
Binary files a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/2f68d357 and /dev/null differ
diff --git a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/2f7fdfb3 b/.config/.cache/v24.8.0-arm64-ef5a0af0-501/2f7fdfb3
deleted file mode 100644
index 7b62b2f..0000000
Binary files a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/2f7fdfb3 and /dev/null differ
diff --git a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/2f9f27a8 b/.config/.cache/v24.8.0-arm64-ef5a0af0-501/2f9f27a8
deleted file mode 100644
index 0d4ba80..0000000
Binary files a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/2f9f27a8 and /dev/null differ
diff --git a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/2fc0206e b/.config/.cache/v24.8.0-arm64-ef5a0af0-501/2fc0206e
deleted file mode 100644
index 6ed3d85..0000000
Binary files a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/2fc0206e and /dev/null differ
diff --git a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/2fd4222b b/.config/.cache/v24.8.0-arm64-ef5a0af0-501/2fd4222b
deleted file mode 100644
index c10ec55..0000000
Binary files a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/2fd4222b and /dev/null differ
diff --git a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/3009bee6 b/.config/.cache/v24.8.0-arm64-ef5a0af0-501/3009bee6
deleted file mode 100644
index c300507..0000000
Binary files a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/3009bee6 and /dev/null differ
diff --git a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/301eb93b b/.config/.cache/v24.8.0-arm64-ef5a0af0-501/301eb93b
deleted file mode 100644
index 4ad3cbb..0000000
Binary files a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/301eb93b and /dev/null differ
diff --git a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/302ff48a b/.config/.cache/v24.8.0-arm64-ef5a0af0-501/302ff48a
deleted file mode 100644
index aa43402..0000000
Binary files a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/302ff48a and /dev/null differ
diff --git a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/309619e0 b/.config/.cache/v24.8.0-arm64-ef5a0af0-501/309619e0
deleted file mode 100644
index 57c9bb3..0000000
Binary files a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/309619e0 and /dev/null differ
diff --git a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/316bb954 b/.config/.cache/v24.8.0-arm64-ef5a0af0-501/316bb954
deleted file mode 100644
index 1c468cb..0000000
Binary files a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/316bb954 and /dev/null differ
diff --git a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/31848af3 b/.config/.cache/v24.8.0-arm64-ef5a0af0-501/31848af3
deleted file mode 100644
index c13bfd4..0000000
Binary files a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/31848af3 and /dev/null differ
diff --git a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/31a58d94 b/.config/.cache/v24.8.0-arm64-ef5a0af0-501/31a58d94
deleted file mode 100644
index 8348a03..0000000
Binary files a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/31a58d94 and /dev/null differ
diff --git a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/3212221c b/.config/.cache/v24.8.0-arm64-ef5a0af0-501/3212221c
deleted file mode 100644
index 3407476..0000000
Binary files a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/3212221c and /dev/null differ
diff --git a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/3219008a b/.config/.cache/v24.8.0-arm64-ef5a0af0-501/3219008a
deleted file mode 100644
index f7b85c4..0000000
Binary files a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/3219008a and /dev/null differ
diff --git a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/32c721cd b/.config/.cache/v24.8.0-arm64-ef5a0af0-501/32c721cd
deleted file mode 100644
index 1a8a981..0000000
Binary files a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/32c721cd and /dev/null differ
diff --git a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/32dc795d b/.config/.cache/v24.8.0-arm64-ef5a0af0-501/32dc795d
deleted file mode 100644
index 1a412df..0000000
Binary files a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/32dc795d and /dev/null differ
diff --git a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/32e3e1bc b/.config/.cache/v24.8.0-arm64-ef5a0af0-501/32e3e1bc
deleted file mode 100644
index 98132e5..0000000
Binary files a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/32e3e1bc and /dev/null differ
diff --git a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/32e99f75 b/.config/.cache/v24.8.0-arm64-ef5a0af0-501/32e99f75
deleted file mode 100644
index a038498..0000000
Binary files a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/32e99f75 and /dev/null differ
diff --git a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/32fd56f0 b/.config/.cache/v24.8.0-arm64-ef5a0af0-501/32fd56f0
deleted file mode 100644
index 30833e3..0000000
Binary files a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/32fd56f0 and /dev/null differ
diff --git a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/33058b12 b/.config/.cache/v24.8.0-arm64-ef5a0af0-501/33058b12
deleted file mode 100644
index 007198d..0000000
Binary files a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/33058b12 and /dev/null differ
diff --git a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/3309b26d b/.config/.cache/v24.8.0-arm64-ef5a0af0-501/3309b26d
deleted file mode 100644
index 73f1ac2..0000000
Binary files a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/3309b26d and /dev/null differ
diff --git a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/336d0d9b b/.config/.cache/v24.8.0-arm64-ef5a0af0-501/336d0d9b
deleted file mode 100644
index 696b46a..0000000
Binary files a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/336d0d9b and /dev/null differ
diff --git a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/336f907e b/.config/.cache/v24.8.0-arm64-ef5a0af0-501/336f907e
deleted file mode 100644
index 813e8de..0000000
Binary files a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/336f907e and /dev/null differ
diff --git a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/33a7666a b/.config/.cache/v24.8.0-arm64-ef5a0af0-501/33a7666a
deleted file mode 100644
index 004b4ca..0000000
Binary files a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/33a7666a and /dev/null differ
diff --git a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/349a595a b/.config/.cache/v24.8.0-arm64-ef5a0af0-501/349a595a
deleted file mode 100644
index 6004be7..0000000
Binary files a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/349a595a and /dev/null differ
diff --git a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/34dba443 b/.config/.cache/v24.8.0-arm64-ef5a0af0-501/34dba443
deleted file mode 100644
index 88cd2df..0000000
Binary files a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/34dba443 and /dev/null differ
diff --git a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/3509822b b/.config/.cache/v24.8.0-arm64-ef5a0af0-501/3509822b
deleted file mode 100644
index 67b1291..0000000
Binary files a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/3509822b and /dev/null differ
diff --git a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/350b1ee0 b/.config/.cache/v24.8.0-arm64-ef5a0af0-501/350b1ee0
deleted file mode 100644
index c48b57f..0000000
Binary files a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/350b1ee0 and /dev/null differ
diff --git a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/350f39e7 b/.config/.cache/v24.8.0-arm64-ef5a0af0-501/350f39e7
deleted file mode 100644
index a4bc50d..0000000
Binary files a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/350f39e7 and /dev/null differ
diff --git a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/352547d0 b/.config/.cache/v24.8.0-arm64-ef5a0af0-501/352547d0
deleted file mode 100644
index adb518f..0000000
Binary files a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/352547d0 and /dev/null differ
diff --git a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/352bac08 b/.config/.cache/v24.8.0-arm64-ef5a0af0-501/352bac08
deleted file mode 100644
index 4a2d400..0000000
Binary files a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/352bac08 and /dev/null differ
diff --git a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/353a933f b/.config/.cache/v24.8.0-arm64-ef5a0af0-501/353a933f
deleted file mode 100644
index a45642f..0000000
Binary files a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/353a933f and /dev/null differ
diff --git a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/3543e9c5 b/.config/.cache/v24.8.0-arm64-ef5a0af0-501/3543e9c5
deleted file mode 100644
index 3fcff0f..0000000
Binary files a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/3543e9c5 and /dev/null differ
diff --git a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/354594dc b/.config/.cache/v24.8.0-arm64-ef5a0af0-501/354594dc
deleted file mode 100644
index f604a74..0000000
Binary files a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/354594dc and /dev/null differ
diff --git a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/35852f95 b/.config/.cache/v24.8.0-arm64-ef5a0af0-501/35852f95
deleted file mode 100644
index 1765068..0000000
Binary files a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/35852f95 and /dev/null differ
diff --git a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/3590b14e b/.config/.cache/v24.8.0-arm64-ef5a0af0-501/3590b14e
deleted file mode 100644
index 48908a9..0000000
Binary files a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/3590b14e and /dev/null differ
diff --git a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/35ac4ba8 b/.config/.cache/v24.8.0-arm64-ef5a0af0-501/35ac4ba8
deleted file mode 100644
index fab1866..0000000
Binary files a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/35ac4ba8 and /dev/null differ
diff --git a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/35ec51dd b/.config/.cache/v24.8.0-arm64-ef5a0af0-501/35ec51dd
deleted file mode 100644
index b254f22..0000000
Binary files a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/35ec51dd and /dev/null differ
diff --git a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/3608f1ed b/.config/.cache/v24.8.0-arm64-ef5a0af0-501/3608f1ed
deleted file mode 100644
index 4782bef..0000000
Binary files a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/3608f1ed and /dev/null differ
diff --git a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/36094775 b/.config/.cache/v24.8.0-arm64-ef5a0af0-501/36094775
deleted file mode 100644
index d9fdb7c..0000000
Binary files a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/36094775 and /dev/null differ
diff --git a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/362abded b/.config/.cache/v24.8.0-arm64-ef5a0af0-501/362abded
deleted file mode 100644
index 79d5844..0000000
Binary files a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/362abded and /dev/null differ
diff --git a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/363a9046 b/.config/.cache/v24.8.0-arm64-ef5a0af0-501/363a9046
deleted file mode 100644
index 5e96fb2..0000000
Binary files a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/363a9046 and /dev/null differ
diff --git a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/372fb868 b/.config/.cache/v24.8.0-arm64-ef5a0af0-501/372fb868
deleted file mode 100644
index 6c829ca..0000000
Binary files a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/372fb868 and /dev/null differ
diff --git a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/373e24d2 b/.config/.cache/v24.8.0-arm64-ef5a0af0-501/373e24d2
deleted file mode 100644
index 48a5bc0..0000000
Binary files a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/373e24d2 and /dev/null differ
diff --git a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/374d438d b/.config/.cache/v24.8.0-arm64-ef5a0af0-501/374d438d
deleted file mode 100644
index 0032579..0000000
Binary files a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/374d438d and /dev/null differ
diff --git a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/374dd62f b/.config/.cache/v24.8.0-arm64-ef5a0af0-501/374dd62f
deleted file mode 100644
index 8f92c8c..0000000
Binary files a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/374dd62f and /dev/null differ
diff --git a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/377089e2 b/.config/.cache/v24.8.0-arm64-ef5a0af0-501/377089e2
deleted file mode 100644
index ba0d062..0000000
Binary files a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/377089e2 and /dev/null differ
diff --git a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/37795cf0 b/.config/.cache/v24.8.0-arm64-ef5a0af0-501/37795cf0
deleted file mode 100644
index f097104..0000000
Binary files a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/37795cf0 and /dev/null differ
diff --git a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/37aed6db b/.config/.cache/v24.8.0-arm64-ef5a0af0-501/37aed6db
deleted file mode 100644
index 1bab184..0000000
Binary files a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/37aed6db and /dev/null differ
diff --git a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/37d20377 b/.config/.cache/v24.8.0-arm64-ef5a0af0-501/37d20377
deleted file mode 100644
index 55f6f37..0000000
Binary files a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/37d20377 and /dev/null differ
diff --git a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/37fb0c37 b/.config/.cache/v24.8.0-arm64-ef5a0af0-501/37fb0c37
deleted file mode 100644
index 294e831..0000000
Binary files a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/37fb0c37 and /dev/null differ
diff --git a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/387998e6 b/.config/.cache/v24.8.0-arm64-ef5a0af0-501/387998e6
deleted file mode 100644
index 871f25e..0000000
Binary files a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/387998e6 and /dev/null differ
diff --git a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/38b40544 b/.config/.cache/v24.8.0-arm64-ef5a0af0-501/38b40544
deleted file mode 100644
index 6aed459..0000000
Binary files a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/38b40544 and /dev/null differ
diff --git a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/38bee4d3 b/.config/.cache/v24.8.0-arm64-ef5a0af0-501/38bee4d3
deleted file mode 100644
index bd5b8e5..0000000
Binary files a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/38bee4d3 and /dev/null differ
diff --git a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/38d1de9e b/.config/.cache/v24.8.0-arm64-ef5a0af0-501/38d1de9e
deleted file mode 100644
index 617f8e6..0000000
Binary files a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/38d1de9e and /dev/null differ
diff --git a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/38d6cae8 b/.config/.cache/v24.8.0-arm64-ef5a0af0-501/38d6cae8
deleted file mode 100644
index bcb661b..0000000
Binary files a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/38d6cae8 and /dev/null differ
diff --git a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/38f16d20 b/.config/.cache/v24.8.0-arm64-ef5a0af0-501/38f16d20
deleted file mode 100644
index c5f5762..0000000
Binary files a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/38f16d20 and /dev/null differ
diff --git a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/39905778 b/.config/.cache/v24.8.0-arm64-ef5a0af0-501/39905778
deleted file mode 100644
index a8160f2..0000000
Binary files a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/39905778 and /dev/null differ
diff --git a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/39c8084a b/.config/.cache/v24.8.0-arm64-ef5a0af0-501/39c8084a
deleted file mode 100644
index 78eb1aa..0000000
Binary files a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/39c8084a and /dev/null differ
diff --git a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/39c8f78c b/.config/.cache/v24.8.0-arm64-ef5a0af0-501/39c8f78c
deleted file mode 100644
index 5a04fa9..0000000
Binary files a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/39c8f78c and /dev/null differ
diff --git a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/3a0cbff2 b/.config/.cache/v24.8.0-arm64-ef5a0af0-501/3a0cbff2
deleted file mode 100644
index ed0d031..0000000
Binary files a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/3a0cbff2 and /dev/null differ
diff --git a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/3a94e29b b/.config/.cache/v24.8.0-arm64-ef5a0af0-501/3a94e29b
deleted file mode 100644
index 2d148e5..0000000
Binary files a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/3a94e29b and /dev/null differ
diff --git a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/3aa58b37 b/.config/.cache/v24.8.0-arm64-ef5a0af0-501/3aa58b37
deleted file mode 100644
index d13c5f1..0000000
Binary files a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/3aa58b37 and /dev/null differ
diff --git a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/3ab22887 b/.config/.cache/v24.8.0-arm64-ef5a0af0-501/3ab22887
deleted file mode 100644
index 68e09e8..0000000
Binary files a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/3ab22887 and /dev/null differ
diff --git a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/3ad40478 b/.config/.cache/v24.8.0-arm64-ef5a0af0-501/3ad40478
deleted file mode 100644
index f6af90e..0000000
Binary files a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/3ad40478 and /dev/null differ
diff --git a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/3adabecb b/.config/.cache/v24.8.0-arm64-ef5a0af0-501/3adabecb
deleted file mode 100644
index 42e7eb8..0000000
Binary files a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/3adabecb and /dev/null differ
diff --git a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/3af21c13 b/.config/.cache/v24.8.0-arm64-ef5a0af0-501/3af21c13
deleted file mode 100644
index 62526c6..0000000
Binary files a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/3af21c13 and /dev/null differ
diff --git a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/3b027b3a b/.config/.cache/v24.8.0-arm64-ef5a0af0-501/3b027b3a
deleted file mode 100644
index 6a9a188..0000000
Binary files a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/3b027b3a and /dev/null differ
diff --git a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/3b3ad438 b/.config/.cache/v24.8.0-arm64-ef5a0af0-501/3b3ad438
deleted file mode 100644
index 17ff2a4..0000000
Binary files a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/3b3ad438 and /dev/null differ
diff --git a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/3b44920d b/.config/.cache/v24.8.0-arm64-ef5a0af0-501/3b44920d
deleted file mode 100644
index 258d964..0000000
Binary files a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/3b44920d and /dev/null differ
diff --git a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/3b588f3f b/.config/.cache/v24.8.0-arm64-ef5a0af0-501/3b588f3f
deleted file mode 100644
index 4b7a439..0000000
Binary files a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/3b588f3f and /dev/null differ
diff --git a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/3b76d393 b/.config/.cache/v24.8.0-arm64-ef5a0af0-501/3b76d393
deleted file mode 100644
index d05a1b3..0000000
Binary files a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/3b76d393 and /dev/null differ
diff --git a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/3ba99c8a b/.config/.cache/v24.8.0-arm64-ef5a0af0-501/3ba99c8a
deleted file mode 100644
index d7e1632..0000000
Binary files a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/3ba99c8a and /dev/null differ
diff --git a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/3bbd0883 b/.config/.cache/v24.8.0-arm64-ef5a0af0-501/3bbd0883
deleted file mode 100644
index 8cdf8b1..0000000
Binary files a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/3bbd0883 and /dev/null differ
diff --git a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/3c140958 b/.config/.cache/v24.8.0-arm64-ef5a0af0-501/3c140958
deleted file mode 100644
index cd0c893..0000000
Binary files a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/3c140958 and /dev/null differ
diff --git a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/3c4ef8cb b/.config/.cache/v24.8.0-arm64-ef5a0af0-501/3c4ef8cb
deleted file mode 100644
index 4ccb751..0000000
Binary files a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/3c4ef8cb and /dev/null differ
diff --git a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/3c5d5a9e b/.config/.cache/v24.8.0-arm64-ef5a0af0-501/3c5d5a9e
deleted file mode 100644
index f562298..0000000
Binary files a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/3c5d5a9e and /dev/null differ
diff --git a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/3c6efc47 b/.config/.cache/v24.8.0-arm64-ef5a0af0-501/3c6efc47
deleted file mode 100644
index ba72079..0000000
Binary files a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/3c6efc47 and /dev/null differ
diff --git a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/3c711a8e b/.config/.cache/v24.8.0-arm64-ef5a0af0-501/3c711a8e
deleted file mode 100644
index f160f4b..0000000
Binary files a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/3c711a8e and /dev/null differ
diff --git a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/3c7d886b b/.config/.cache/v24.8.0-arm64-ef5a0af0-501/3c7d886b
deleted file mode 100644
index ee10c4f..0000000
Binary files a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/3c7d886b and /dev/null differ
diff --git a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/3c8b5b23 b/.config/.cache/v24.8.0-arm64-ef5a0af0-501/3c8b5b23
deleted file mode 100644
index 5d19030..0000000
Binary files a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/3c8b5b23 and /dev/null differ
diff --git a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/3c8d8c85 b/.config/.cache/v24.8.0-arm64-ef5a0af0-501/3c8d8c85
deleted file mode 100644
index d3243da..0000000
Binary files a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/3c8d8c85 and /dev/null differ
diff --git a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/3cd85a80 b/.config/.cache/v24.8.0-arm64-ef5a0af0-501/3cd85a80
deleted file mode 100644
index c9ece31..0000000
Binary files a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/3cd85a80 and /dev/null differ
diff --git a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/3d06c698 b/.config/.cache/v24.8.0-arm64-ef5a0af0-501/3d06c698
deleted file mode 100644
index a7aac23..0000000
Binary files a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/3d06c698 and /dev/null differ
diff --git a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/3d7294f8 b/.config/.cache/v24.8.0-arm64-ef5a0af0-501/3d7294f8
deleted file mode 100644
index ea65434..0000000
Binary files a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/3d7294f8 and /dev/null differ
diff --git a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/3d9aec38 b/.config/.cache/v24.8.0-arm64-ef5a0af0-501/3d9aec38
deleted file mode 100644
index 68e3e64..0000000
Binary files a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/3d9aec38 and /dev/null differ
diff --git a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/3db7d17b b/.config/.cache/v24.8.0-arm64-ef5a0af0-501/3db7d17b
deleted file mode 100644
index 0197102..0000000
Binary files a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/3db7d17b and /dev/null differ
diff --git a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/3df5674e b/.config/.cache/v24.8.0-arm64-ef5a0af0-501/3df5674e
deleted file mode 100644
index 8871a05..0000000
Binary files a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/3df5674e and /dev/null differ
diff --git a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/3e23d64b b/.config/.cache/v24.8.0-arm64-ef5a0af0-501/3e23d64b
deleted file mode 100644
index 2e5b335..0000000
Binary files a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/3e23d64b and /dev/null differ
diff --git a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/3e5a1ee6 b/.config/.cache/v24.8.0-arm64-ef5a0af0-501/3e5a1ee6
deleted file mode 100644
index 48c3dca..0000000
Binary files a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/3e5a1ee6 and /dev/null differ
diff --git a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/3e9b65fb b/.config/.cache/v24.8.0-arm64-ef5a0af0-501/3e9b65fb
deleted file mode 100644
index 3fdc4d0..0000000
Binary files a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/3e9b65fb and /dev/null differ
diff --git a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/3ee26afd b/.config/.cache/v24.8.0-arm64-ef5a0af0-501/3ee26afd
deleted file mode 100644
index ec5e207..0000000
Binary files a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/3ee26afd and /dev/null differ
diff --git a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/3f42b425 b/.config/.cache/v24.8.0-arm64-ef5a0af0-501/3f42b425
deleted file mode 100644
index db2d194..0000000
Binary files a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/3f42b425 and /dev/null differ
diff --git a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/3f4e07ec b/.config/.cache/v24.8.0-arm64-ef5a0af0-501/3f4e07ec
deleted file mode 100644
index 7872288..0000000
Binary files a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/3f4e07ec and /dev/null differ
diff --git a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/3fa29796 b/.config/.cache/v24.8.0-arm64-ef5a0af0-501/3fa29796
deleted file mode 100644
index e7b50df..0000000
Binary files a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/3fa29796 and /dev/null differ
diff --git a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/3fabe8dd b/.config/.cache/v24.8.0-arm64-ef5a0af0-501/3fabe8dd
deleted file mode 100644
index 8b083c2..0000000
Binary files a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/3fabe8dd and /dev/null differ
diff --git a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/3fc9adb8 b/.config/.cache/v24.8.0-arm64-ef5a0af0-501/3fc9adb8
deleted file mode 100644
index ffff6d7..0000000
Binary files a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/3fc9adb8 and /dev/null differ
diff --git a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/405444ba b/.config/.cache/v24.8.0-arm64-ef5a0af0-501/405444ba
deleted file mode 100644
index f6fa7ba..0000000
Binary files a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/405444ba and /dev/null differ
diff --git a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/406cfc51 b/.config/.cache/v24.8.0-arm64-ef5a0af0-501/406cfc51
deleted file mode 100644
index b8d5452..0000000
Binary files a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/406cfc51 and /dev/null differ
diff --git a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/40821c17 b/.config/.cache/v24.8.0-arm64-ef5a0af0-501/40821c17
deleted file mode 100644
index 22a154a..0000000
Binary files a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/40821c17 and /dev/null differ
diff --git a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/40947e46 b/.config/.cache/v24.8.0-arm64-ef5a0af0-501/40947e46
deleted file mode 100644
index c0c571d..0000000
Binary files a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/40947e46 and /dev/null differ
diff --git a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/40bc9b8b b/.config/.cache/v24.8.0-arm64-ef5a0af0-501/40bc9b8b
deleted file mode 100644
index 7695433..0000000
Binary files a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/40bc9b8b and /dev/null differ
diff --git a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/40d8b670 b/.config/.cache/v24.8.0-arm64-ef5a0af0-501/40d8b670
deleted file mode 100644
index 55d3a57..0000000
Binary files a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/40d8b670 and /dev/null differ
diff --git a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/410c21c2 b/.config/.cache/v24.8.0-arm64-ef5a0af0-501/410c21c2
deleted file mode 100644
index ece5dd0..0000000
Binary files a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/410c21c2 and /dev/null differ
diff --git a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/411da5b1 b/.config/.cache/v24.8.0-arm64-ef5a0af0-501/411da5b1
deleted file mode 100644
index 25068f1..0000000
Binary files a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/411da5b1 and /dev/null differ
diff --git a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/4120eb85 b/.config/.cache/v24.8.0-arm64-ef5a0af0-501/4120eb85
deleted file mode 100644
index 43156d7..0000000
Binary files a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/4120eb85 and /dev/null differ
diff --git a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/412f27cd b/.config/.cache/v24.8.0-arm64-ef5a0af0-501/412f27cd
deleted file mode 100644
index 70a0eef..0000000
Binary files a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/412f27cd and /dev/null differ
diff --git a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/413c4327 b/.config/.cache/v24.8.0-arm64-ef5a0af0-501/413c4327
deleted file mode 100644
index cd4d4bd..0000000
Binary files a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/413c4327 and /dev/null differ
diff --git a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/4148254f b/.config/.cache/v24.8.0-arm64-ef5a0af0-501/4148254f
deleted file mode 100644
index 941f936..0000000
Binary files a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/4148254f and /dev/null differ
diff --git a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/416c870c b/.config/.cache/v24.8.0-arm64-ef5a0af0-501/416c870c
deleted file mode 100644
index c6fb579..0000000
Binary files a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/416c870c and /dev/null differ
diff --git a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/417c2d6b b/.config/.cache/v24.8.0-arm64-ef5a0af0-501/417c2d6b
deleted file mode 100644
index 33e3e2e..0000000
Binary files a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/417c2d6b and /dev/null differ
diff --git a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/41a96132 b/.config/.cache/v24.8.0-arm64-ef5a0af0-501/41a96132
deleted file mode 100644
index 2e1701f..0000000
Binary files a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/41a96132 and /dev/null differ
diff --git a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/41f60308 b/.config/.cache/v24.8.0-arm64-ef5a0af0-501/41f60308
deleted file mode 100644
index 2788373..0000000
Binary files a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/41f60308 and /dev/null differ
diff --git a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/42253372 b/.config/.cache/v24.8.0-arm64-ef5a0af0-501/42253372
deleted file mode 100644
index 8135ef5..0000000
Binary files a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/42253372 and /dev/null differ
diff --git a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/42512df8 b/.config/.cache/v24.8.0-arm64-ef5a0af0-501/42512df8
deleted file mode 100644
index 9b595fa..0000000
Binary files a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/42512df8 and /dev/null differ
diff --git a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/4263928f b/.config/.cache/v24.8.0-arm64-ef5a0af0-501/4263928f
deleted file mode 100644
index 22ae832..0000000
Binary files a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/4263928f and /dev/null differ
diff --git a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/42be2ef9 b/.config/.cache/v24.8.0-arm64-ef5a0af0-501/42be2ef9
deleted file mode 100644
index 304e5c1..0000000
Binary files a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/42be2ef9 and /dev/null differ
diff --git a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/42d5042b b/.config/.cache/v24.8.0-arm64-ef5a0af0-501/42d5042b
deleted file mode 100644
index 4e0b79b..0000000
Binary files a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/42d5042b and /dev/null differ
diff --git a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/42d77f45 b/.config/.cache/v24.8.0-arm64-ef5a0af0-501/42d77f45
deleted file mode 100644
index e9053e3..0000000
Binary files a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/42d77f45 and /dev/null differ
diff --git a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/42fd37ef b/.config/.cache/v24.8.0-arm64-ef5a0af0-501/42fd37ef
deleted file mode 100644
index c741a7b..0000000
Binary files a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/42fd37ef and /dev/null differ
diff --git a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/430512e8 b/.config/.cache/v24.8.0-arm64-ef5a0af0-501/430512e8
deleted file mode 100644
index b761484..0000000
Binary files a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/430512e8 and /dev/null differ
diff --git a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/431a62c8 b/.config/.cache/v24.8.0-arm64-ef5a0af0-501/431a62c8
deleted file mode 100644
index 5ad397b..0000000
Binary files a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/431a62c8 and /dev/null differ
diff --git a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/435fef9f b/.config/.cache/v24.8.0-arm64-ef5a0af0-501/435fef9f
deleted file mode 100644
index a37ab15..0000000
Binary files a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/435fef9f and /dev/null differ
diff --git a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/4389743b b/.config/.cache/v24.8.0-arm64-ef5a0af0-501/4389743b
deleted file mode 100644
index 92069f9..0000000
Binary files a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/4389743b and /dev/null differ
diff --git a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/438a709f b/.config/.cache/v24.8.0-arm64-ef5a0af0-501/438a709f
deleted file mode 100644
index 005f958..0000000
Binary files a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/438a709f and /dev/null differ
diff --git a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/438f2024 b/.config/.cache/v24.8.0-arm64-ef5a0af0-501/438f2024
deleted file mode 100644
index d1e059c..0000000
Binary files a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/438f2024 and /dev/null differ
diff --git a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/43bf980a b/.config/.cache/v24.8.0-arm64-ef5a0af0-501/43bf980a
deleted file mode 100644
index b984014..0000000
Binary files a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/43bf980a and /dev/null differ
diff --git a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/43cbd821 b/.config/.cache/v24.8.0-arm64-ef5a0af0-501/43cbd821
deleted file mode 100644
index 47b6026..0000000
Binary files a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/43cbd821 and /dev/null differ
diff --git a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/4401903e b/.config/.cache/v24.8.0-arm64-ef5a0af0-501/4401903e
deleted file mode 100644
index 1cb798e..0000000
Binary files a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/4401903e and /dev/null differ
diff --git a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/44061531 b/.config/.cache/v24.8.0-arm64-ef5a0af0-501/44061531
deleted file mode 100644
index 6e2958b..0000000
Binary files a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/44061531 and /dev/null differ
diff --git a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/444635ef b/.config/.cache/v24.8.0-arm64-ef5a0af0-501/444635ef
deleted file mode 100644
index f1d03ae..0000000
Binary files a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/444635ef and /dev/null differ
diff --git a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/449fa944 b/.config/.cache/v24.8.0-arm64-ef5a0af0-501/449fa944
deleted file mode 100644
index 58bfdb6..0000000
Binary files a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/449fa944 and /dev/null differ
diff --git a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/44b0223b b/.config/.cache/v24.8.0-arm64-ef5a0af0-501/44b0223b
deleted file mode 100644
index 800ffc8..0000000
Binary files a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/44b0223b and /dev/null differ
diff --git a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/45124322 b/.config/.cache/v24.8.0-arm64-ef5a0af0-501/45124322
deleted file mode 100644
index c215e76..0000000
Binary files a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/45124322 and /dev/null differ
diff --git a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/453102ce b/.config/.cache/v24.8.0-arm64-ef5a0af0-501/453102ce
deleted file mode 100644
index 28adbe9..0000000
Binary files a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/453102ce and /dev/null differ
diff --git a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/456d765b b/.config/.cache/v24.8.0-arm64-ef5a0af0-501/456d765b
deleted file mode 100644
index e04a049..0000000
Binary files a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/456d765b and /dev/null differ
diff --git a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/45798d5d b/.config/.cache/v24.8.0-arm64-ef5a0af0-501/45798d5d
deleted file mode 100644
index 854ebae..0000000
Binary files a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/45798d5d and /dev/null differ
diff --git a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/458f00c5 b/.config/.cache/v24.8.0-arm64-ef5a0af0-501/458f00c5
deleted file mode 100644
index 961d840..0000000
Binary files a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/458f00c5 and /dev/null differ
diff --git a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/45cbbc00 b/.config/.cache/v24.8.0-arm64-ef5a0af0-501/45cbbc00
deleted file mode 100644
index 2d099d2..0000000
Binary files a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/45cbbc00 and /dev/null differ
diff --git a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/45d4d64f b/.config/.cache/v24.8.0-arm64-ef5a0af0-501/45d4d64f
deleted file mode 100644
index 171ae5f..0000000
Binary files a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/45d4d64f and /dev/null differ
diff --git a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/45dd8669 b/.config/.cache/v24.8.0-arm64-ef5a0af0-501/45dd8669
deleted file mode 100644
index cb2f21a..0000000
Binary files a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/45dd8669 and /dev/null differ
diff --git a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/46103ae4 b/.config/.cache/v24.8.0-arm64-ef5a0af0-501/46103ae4
deleted file mode 100644
index 821c70b..0000000
Binary files a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/46103ae4 and /dev/null differ
diff --git a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/461f9543 b/.config/.cache/v24.8.0-arm64-ef5a0af0-501/461f9543
deleted file mode 100644
index 70be2df..0000000
Binary files a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/461f9543 and /dev/null differ
diff --git a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/462dd3f2 b/.config/.cache/v24.8.0-arm64-ef5a0af0-501/462dd3f2
deleted file mode 100644
index 277d168..0000000
Binary files a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/462dd3f2 and /dev/null differ
diff --git a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/465f580c b/.config/.cache/v24.8.0-arm64-ef5a0af0-501/465f580c
deleted file mode 100644
index 2abd860..0000000
Binary files a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/465f580c and /dev/null differ
diff --git a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/468b8923 b/.config/.cache/v24.8.0-arm64-ef5a0af0-501/468b8923
deleted file mode 100644
index abfc9de..0000000
Binary files a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/468b8923 and /dev/null differ
diff --git a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/46a4c730 b/.config/.cache/v24.8.0-arm64-ef5a0af0-501/46a4c730
deleted file mode 100644
index 9c7fc38..0000000
Binary files a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/46a4c730 and /dev/null differ
diff --git a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/46eae43a b/.config/.cache/v24.8.0-arm64-ef5a0af0-501/46eae43a
deleted file mode 100644
index 638b8ef..0000000
Binary files a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/46eae43a and /dev/null differ
diff --git a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/4706777d b/.config/.cache/v24.8.0-arm64-ef5a0af0-501/4706777d
deleted file mode 100644
index 971cafb..0000000
Binary files a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/4706777d and /dev/null differ
diff --git a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/4773e10a b/.config/.cache/v24.8.0-arm64-ef5a0af0-501/4773e10a
deleted file mode 100644
index 2239969..0000000
Binary files a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/4773e10a and /dev/null differ
diff --git a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/47968811 b/.config/.cache/v24.8.0-arm64-ef5a0af0-501/47968811
deleted file mode 100644
index 6809324..0000000
Binary files a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/47968811 and /dev/null differ
diff --git a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/47b5a6db b/.config/.cache/v24.8.0-arm64-ef5a0af0-501/47b5a6db
deleted file mode 100644
index 901bdbf..0000000
Binary files a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/47b5a6db and /dev/null differ
diff --git a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/47d00bad b/.config/.cache/v24.8.0-arm64-ef5a0af0-501/47d00bad
deleted file mode 100644
index b730a41..0000000
Binary files a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/47d00bad and /dev/null differ
diff --git a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/47fce4ca b/.config/.cache/v24.8.0-arm64-ef5a0af0-501/47fce4ca
deleted file mode 100644
index ce269a9..0000000
Binary files a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/47fce4ca and /dev/null differ
diff --git a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/48800678 b/.config/.cache/v24.8.0-arm64-ef5a0af0-501/48800678
deleted file mode 100644
index e95ceee..0000000
Binary files a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/48800678 and /dev/null differ
diff --git a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/48e0d35f b/.config/.cache/v24.8.0-arm64-ef5a0af0-501/48e0d35f
deleted file mode 100644
index f7c16eb..0000000
Binary files a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/48e0d35f and /dev/null differ
diff --git a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/490fe643 b/.config/.cache/v24.8.0-arm64-ef5a0af0-501/490fe643
deleted file mode 100644
index 88073a1..0000000
Binary files a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/490fe643 and /dev/null differ
diff --git a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/4940b337 b/.config/.cache/v24.8.0-arm64-ef5a0af0-501/4940b337
deleted file mode 100644
index c5e7628..0000000
Binary files a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/4940b337 and /dev/null differ
diff --git a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/497a809d b/.config/.cache/v24.8.0-arm64-ef5a0af0-501/497a809d
deleted file mode 100644
index a414b29..0000000
Binary files a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/497a809d and /dev/null differ
diff --git a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/498ced1d b/.config/.cache/v24.8.0-arm64-ef5a0af0-501/498ced1d
deleted file mode 100644
index e6f8117..0000000
Binary files a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/498ced1d and /dev/null differ
diff --git a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/49999104 b/.config/.cache/v24.8.0-arm64-ef5a0af0-501/49999104
deleted file mode 100644
index 785756e..0000000
Binary files a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/49999104 and /dev/null differ
diff --git a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/49ccbc6c b/.config/.cache/v24.8.0-arm64-ef5a0af0-501/49ccbc6c
deleted file mode 100644
index 9410182..0000000
Binary files a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/49ccbc6c and /dev/null differ
diff --git a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/49d0fe21 b/.config/.cache/v24.8.0-arm64-ef5a0af0-501/49d0fe21
deleted file mode 100644
index fb5ebce..0000000
Binary files a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/49d0fe21 and /dev/null differ
diff --git a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/49e9a000 b/.config/.cache/v24.8.0-arm64-ef5a0af0-501/49e9a000
deleted file mode 100644
index 739680e..0000000
Binary files a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/49e9a000 and /dev/null differ
diff --git a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/4a2f67a6 b/.config/.cache/v24.8.0-arm64-ef5a0af0-501/4a2f67a6
deleted file mode 100644
index 2b4b76a..0000000
Binary files a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/4a2f67a6 and /dev/null differ
diff --git a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/4a528544 b/.config/.cache/v24.8.0-arm64-ef5a0af0-501/4a528544
deleted file mode 100644
index c74a801..0000000
Binary files a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/4a528544 and /dev/null differ
diff --git a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/4a850c24 b/.config/.cache/v24.8.0-arm64-ef5a0af0-501/4a850c24
deleted file mode 100644
index eadccf7..0000000
Binary files a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/4a850c24 and /dev/null differ
diff --git a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/4a8eed49 b/.config/.cache/v24.8.0-arm64-ef5a0af0-501/4a8eed49
deleted file mode 100644
index 17c41f2..0000000
Binary files a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/4a8eed49 and /dev/null differ
diff --git a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/4aa120ef b/.config/.cache/v24.8.0-arm64-ef5a0af0-501/4aa120ef
deleted file mode 100644
index d125d15..0000000
Binary files a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/4aa120ef and /dev/null differ
diff --git a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/4bab27a1 b/.config/.cache/v24.8.0-arm64-ef5a0af0-501/4bab27a1
deleted file mode 100644
index ba95094..0000000
Binary files a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/4bab27a1 and /dev/null differ
diff --git a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/4c020fe6 b/.config/.cache/v24.8.0-arm64-ef5a0af0-501/4c020fe6
deleted file mode 100644
index ef7d7f7..0000000
Binary files a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/4c020fe6 and /dev/null differ
diff --git a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/4c08188a b/.config/.cache/v24.8.0-arm64-ef5a0af0-501/4c08188a
deleted file mode 100644
index 1c8cd67..0000000
Binary files a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/4c08188a and /dev/null differ
diff --git a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/4c16f3a5 b/.config/.cache/v24.8.0-arm64-ef5a0af0-501/4c16f3a5
deleted file mode 100644
index 09bcfb7..0000000
Binary files a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/4c16f3a5 and /dev/null differ
diff --git a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/4c3758fc b/.config/.cache/v24.8.0-arm64-ef5a0af0-501/4c3758fc
deleted file mode 100644
index 32f4676..0000000
Binary files a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/4c3758fc and /dev/null differ
diff --git a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/4c8ade89 b/.config/.cache/v24.8.0-arm64-ef5a0af0-501/4c8ade89
deleted file mode 100644
index 5ddc4d5..0000000
Binary files a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/4c8ade89 and /dev/null differ
diff --git a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/4ca1f02c b/.config/.cache/v24.8.0-arm64-ef5a0af0-501/4ca1f02c
deleted file mode 100644
index 62686d3..0000000
Binary files a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/4ca1f02c and /dev/null differ
diff --git a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/4cd28e26 b/.config/.cache/v24.8.0-arm64-ef5a0af0-501/4cd28e26
deleted file mode 100644
index aaada94..0000000
Binary files a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/4cd28e26 and /dev/null differ
diff --git a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/4d4eea0a b/.config/.cache/v24.8.0-arm64-ef5a0af0-501/4d4eea0a
deleted file mode 100644
index 7e682bd..0000000
Binary files a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/4d4eea0a and /dev/null differ
diff --git a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/4d657695 b/.config/.cache/v24.8.0-arm64-ef5a0af0-501/4d657695
deleted file mode 100644
index 22df739..0000000
Binary files a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/4d657695 and /dev/null differ
diff --git a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/4d67258b b/.config/.cache/v24.8.0-arm64-ef5a0af0-501/4d67258b
deleted file mode 100644
index ed8162a..0000000
Binary files a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/4d67258b and /dev/null differ
diff --git a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/4daf3cd2 b/.config/.cache/v24.8.0-arm64-ef5a0af0-501/4daf3cd2
deleted file mode 100644
index 89fac94..0000000
Binary files a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/4daf3cd2 and /dev/null differ
diff --git a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/4df64fb2 b/.config/.cache/v24.8.0-arm64-ef5a0af0-501/4df64fb2
deleted file mode 100644
index 60a4f63..0000000
Binary files a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/4df64fb2 and /dev/null differ
diff --git a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/4e134981 b/.config/.cache/v24.8.0-arm64-ef5a0af0-501/4e134981
deleted file mode 100644
index cb28e12..0000000
Binary files a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/4e134981 and /dev/null differ
diff --git a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/4e476028 b/.config/.cache/v24.8.0-arm64-ef5a0af0-501/4e476028
deleted file mode 100644
index 42e3728..0000000
Binary files a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/4e476028 and /dev/null differ
diff --git a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/4e51a803 b/.config/.cache/v24.8.0-arm64-ef5a0af0-501/4e51a803
deleted file mode 100644
index ecec076..0000000
Binary files a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/4e51a803 and /dev/null differ
diff --git a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/4f37ce88 b/.config/.cache/v24.8.0-arm64-ef5a0af0-501/4f37ce88
deleted file mode 100644
index 9398d41..0000000
Binary files a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/4f37ce88 and /dev/null differ
diff --git a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/4f5e9c21 b/.config/.cache/v24.8.0-arm64-ef5a0af0-501/4f5e9c21
deleted file mode 100644
index 8948ba5..0000000
Binary files a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/4f5e9c21 and /dev/null differ
diff --git a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/4f6b6dd4 b/.config/.cache/v24.8.0-arm64-ef5a0af0-501/4f6b6dd4
deleted file mode 100644
index 8523885..0000000
Binary files a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/4f6b6dd4 and /dev/null differ
diff --git a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/4f6c18c8 b/.config/.cache/v24.8.0-arm64-ef5a0af0-501/4f6c18c8
deleted file mode 100644
index 759a235..0000000
Binary files a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/4f6c18c8 and /dev/null differ
diff --git a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/4f742898 b/.config/.cache/v24.8.0-arm64-ef5a0af0-501/4f742898
deleted file mode 100644
index 698e9f5..0000000
Binary files a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/4f742898 and /dev/null differ
diff --git a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/4f7ee9a2 b/.config/.cache/v24.8.0-arm64-ef5a0af0-501/4f7ee9a2
deleted file mode 100644
index 109844c..0000000
Binary files a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/4f7ee9a2 and /dev/null differ
diff --git a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/4fc5657d b/.config/.cache/v24.8.0-arm64-ef5a0af0-501/4fc5657d
deleted file mode 100644
index 28a6d91..0000000
Binary files a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/4fc5657d and /dev/null differ
diff --git a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/4ff9ba47 b/.config/.cache/v24.8.0-arm64-ef5a0af0-501/4ff9ba47
deleted file mode 100644
index 08d7ece..0000000
Binary files a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/4ff9ba47 and /dev/null differ
diff --git a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/501d89b0 b/.config/.cache/v24.8.0-arm64-ef5a0af0-501/501d89b0
deleted file mode 100644
index 4b47588..0000000
Binary files a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/501d89b0 and /dev/null differ
diff --git a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/5038e4d5 b/.config/.cache/v24.8.0-arm64-ef5a0af0-501/5038e4d5
deleted file mode 100644
index ddbd927..0000000
Binary files a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/5038e4d5 and /dev/null differ
diff --git a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/504e710e b/.config/.cache/v24.8.0-arm64-ef5a0af0-501/504e710e
deleted file mode 100644
index d0644c9..0000000
Binary files a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/504e710e and /dev/null differ
diff --git a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/50581cd1 b/.config/.cache/v24.8.0-arm64-ef5a0af0-501/50581cd1
deleted file mode 100644
index 7ab80c9..0000000
Binary files a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/50581cd1 and /dev/null differ
diff --git a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/508d535d b/.config/.cache/v24.8.0-arm64-ef5a0af0-501/508d535d
deleted file mode 100644
index b7e38cc..0000000
Binary files a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/508d535d and /dev/null differ
diff --git a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/509a5046 b/.config/.cache/v24.8.0-arm64-ef5a0af0-501/509a5046
deleted file mode 100644
index e53a9fa..0000000
Binary files a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/509a5046 and /dev/null differ
diff --git a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/50b7138a b/.config/.cache/v24.8.0-arm64-ef5a0af0-501/50b7138a
deleted file mode 100644
index 7e3ca8d..0000000
Binary files a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/50b7138a and /dev/null differ
diff --git a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/5101057c b/.config/.cache/v24.8.0-arm64-ef5a0af0-501/5101057c
deleted file mode 100644
index 8ba4566..0000000
Binary files a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/5101057c and /dev/null differ
diff --git a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/5157d527 b/.config/.cache/v24.8.0-arm64-ef5a0af0-501/5157d527
deleted file mode 100644
index 09f227b..0000000
Binary files a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/5157d527 and /dev/null differ
diff --git a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/5167aa9d b/.config/.cache/v24.8.0-arm64-ef5a0af0-501/5167aa9d
deleted file mode 100644
index a6e8d91..0000000
Binary files a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/5167aa9d and /dev/null differ
diff --git a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/517a96da b/.config/.cache/v24.8.0-arm64-ef5a0af0-501/517a96da
deleted file mode 100644
index 9f949af..0000000
Binary files a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/517a96da and /dev/null differ
diff --git a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/51883955 b/.config/.cache/v24.8.0-arm64-ef5a0af0-501/51883955
deleted file mode 100644
index c6fa404..0000000
Binary files a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/51883955 and /dev/null differ
diff --git a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/51abee09 b/.config/.cache/v24.8.0-arm64-ef5a0af0-501/51abee09
deleted file mode 100644
index dd018d5..0000000
Binary files a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/51abee09 and /dev/null differ
diff --git a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/51f2ecff b/.config/.cache/v24.8.0-arm64-ef5a0af0-501/51f2ecff
deleted file mode 100644
index ebe28c8..0000000
Binary files a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/51f2ecff and /dev/null differ
diff --git a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/521965d0 b/.config/.cache/v24.8.0-arm64-ef5a0af0-501/521965d0
deleted file mode 100644
index 2c1c11e..0000000
Binary files a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/521965d0 and /dev/null differ
diff --git a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/522694ea b/.config/.cache/v24.8.0-arm64-ef5a0af0-501/522694ea
deleted file mode 100644
index 669a7ff..0000000
Binary files a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/522694ea and /dev/null differ
diff --git a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/522f3f4b b/.config/.cache/v24.8.0-arm64-ef5a0af0-501/522f3f4b
deleted file mode 100644
index 08a4ed7..0000000
Binary files a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/522f3f4b and /dev/null differ
diff --git a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/523a56d4 b/.config/.cache/v24.8.0-arm64-ef5a0af0-501/523a56d4
deleted file mode 100644
index b04cdc1..0000000
Binary files a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/523a56d4 and /dev/null differ
diff --git a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/523a8c44 b/.config/.cache/v24.8.0-arm64-ef5a0af0-501/523a8c44
deleted file mode 100644
index f13b258..0000000
Binary files a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/523a8c44 and /dev/null differ
diff --git a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/525f2b8d b/.config/.cache/v24.8.0-arm64-ef5a0af0-501/525f2b8d
deleted file mode 100644
index b31ce36..0000000
Binary files a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/525f2b8d and /dev/null differ
diff --git a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/52707fd6 b/.config/.cache/v24.8.0-arm64-ef5a0af0-501/52707fd6
deleted file mode 100644
index 7e40c93..0000000
Binary files a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/52707fd6 and /dev/null differ
diff --git a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/52f8bdaa b/.config/.cache/v24.8.0-arm64-ef5a0af0-501/52f8bdaa
deleted file mode 100644
index ddf1838..0000000
Binary files a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/52f8bdaa and /dev/null differ
diff --git a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/53045330 b/.config/.cache/v24.8.0-arm64-ef5a0af0-501/53045330
deleted file mode 100644
index 6ab23fa..0000000
Binary files a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/53045330 and /dev/null differ
diff --git a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/530558ef b/.config/.cache/v24.8.0-arm64-ef5a0af0-501/530558ef
deleted file mode 100644
index d0953ac..0000000
Binary files a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/530558ef and /dev/null differ
diff --git a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/532687f0 b/.config/.cache/v24.8.0-arm64-ef5a0af0-501/532687f0
deleted file mode 100644
index 2c84500..0000000
Binary files a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/532687f0 and /dev/null differ
diff --git a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/5361af3f b/.config/.cache/v24.8.0-arm64-ef5a0af0-501/5361af3f
deleted file mode 100644
index 0fea780..0000000
Binary files a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/5361af3f and /dev/null differ
diff --git a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/536401e6 b/.config/.cache/v24.8.0-arm64-ef5a0af0-501/536401e6
deleted file mode 100644
index f06b26b..0000000
Binary files a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/536401e6 and /dev/null differ
diff --git a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/536b5419 b/.config/.cache/v24.8.0-arm64-ef5a0af0-501/536b5419
deleted file mode 100644
index 226a171..0000000
Binary files a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/536b5419 and /dev/null differ
diff --git a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/5375db12 b/.config/.cache/v24.8.0-arm64-ef5a0af0-501/5375db12
deleted file mode 100644
index 86d0b13..0000000
Binary files a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/5375db12 and /dev/null differ
diff --git a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/53e4fdea b/.config/.cache/v24.8.0-arm64-ef5a0af0-501/53e4fdea
deleted file mode 100644
index edb2251..0000000
Binary files a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/53e4fdea and /dev/null differ
diff --git a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/54536c36 b/.config/.cache/v24.8.0-arm64-ef5a0af0-501/54536c36
deleted file mode 100644
index f04ecb2..0000000
Binary files a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/54536c36 and /dev/null differ
diff --git a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/545aa731 b/.config/.cache/v24.8.0-arm64-ef5a0af0-501/545aa731
deleted file mode 100644
index 5eb026f..0000000
Binary files a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/545aa731 and /dev/null differ
diff --git a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/5461a1e0 b/.config/.cache/v24.8.0-arm64-ef5a0af0-501/5461a1e0
deleted file mode 100644
index cf19423..0000000
Binary files a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/5461a1e0 and /dev/null differ
diff --git a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/54d035c6 b/.config/.cache/v24.8.0-arm64-ef5a0af0-501/54d035c6
deleted file mode 100644
index 8a6a2cb..0000000
Binary files a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/54d035c6 and /dev/null differ
diff --git a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/54f56602 b/.config/.cache/v24.8.0-arm64-ef5a0af0-501/54f56602
deleted file mode 100644
index 2caeff2..0000000
Binary files a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/54f56602 and /dev/null differ
diff --git a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/5520ff44 b/.config/.cache/v24.8.0-arm64-ef5a0af0-501/5520ff44
deleted file mode 100644
index 88f68a0..0000000
Binary files a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/5520ff44 and /dev/null differ
diff --git a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/558436f3 b/.config/.cache/v24.8.0-arm64-ef5a0af0-501/558436f3
deleted file mode 100644
index da246d9..0000000
Binary files a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/558436f3 and /dev/null differ
diff --git a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/55aa99d9 b/.config/.cache/v24.8.0-arm64-ef5a0af0-501/55aa99d9
deleted file mode 100644
index c9ea9af..0000000
Binary files a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/55aa99d9 and /dev/null differ
diff --git a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/55ce816d b/.config/.cache/v24.8.0-arm64-ef5a0af0-501/55ce816d
deleted file mode 100644
index b48af03..0000000
Binary files a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/55ce816d and /dev/null differ
diff --git a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/561881eb b/.config/.cache/v24.8.0-arm64-ef5a0af0-501/561881eb
deleted file mode 100644
index 834b43e..0000000
Binary files a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/561881eb and /dev/null differ
diff --git a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/564ca64b b/.config/.cache/v24.8.0-arm64-ef5a0af0-501/564ca64b
deleted file mode 100644
index de2286c..0000000
Binary files a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/564ca64b and /dev/null differ
diff --git a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/56571e8e b/.config/.cache/v24.8.0-arm64-ef5a0af0-501/56571e8e
deleted file mode 100644
index 64c2d09..0000000
Binary files a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/56571e8e and /dev/null differ
diff --git a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/569adeb1 b/.config/.cache/v24.8.0-arm64-ef5a0af0-501/569adeb1
deleted file mode 100644
index 8ad353f..0000000
Binary files a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/569adeb1 and /dev/null differ
diff --git a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/570be667 b/.config/.cache/v24.8.0-arm64-ef5a0af0-501/570be667
deleted file mode 100644
index 2fbeeef..0000000
Binary files a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/570be667 and /dev/null differ
diff --git a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/5712aad7 b/.config/.cache/v24.8.0-arm64-ef5a0af0-501/5712aad7
deleted file mode 100644
index 97ae4c7..0000000
Binary files a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/5712aad7 and /dev/null differ
diff --git a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/57580346 b/.config/.cache/v24.8.0-arm64-ef5a0af0-501/57580346
deleted file mode 100644
index 327dff7..0000000
Binary files a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/57580346 and /dev/null differ
diff --git a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/57845776 b/.config/.cache/v24.8.0-arm64-ef5a0af0-501/57845776
deleted file mode 100644
index 962103a..0000000
Binary files a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/57845776 and /dev/null differ
diff --git a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/57eaad40 b/.config/.cache/v24.8.0-arm64-ef5a0af0-501/57eaad40
deleted file mode 100644
index 24cacf0..0000000
Binary files a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/57eaad40 and /dev/null differ
diff --git a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/57eb15c3 b/.config/.cache/v24.8.0-arm64-ef5a0af0-501/57eb15c3
deleted file mode 100644
index db6ca8d..0000000
Binary files a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/57eb15c3 and /dev/null differ
diff --git a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/581302c1 b/.config/.cache/v24.8.0-arm64-ef5a0af0-501/581302c1
deleted file mode 100644
index c40d8e7..0000000
Binary files a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/581302c1 and /dev/null differ
diff --git a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/5859b3b9 b/.config/.cache/v24.8.0-arm64-ef5a0af0-501/5859b3b9
deleted file mode 100644
index 2b90114..0000000
Binary files a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/5859b3b9 and /dev/null differ
diff --git a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/58882d7c b/.config/.cache/v24.8.0-arm64-ef5a0af0-501/58882d7c
deleted file mode 100644
index e8cd1cd..0000000
Binary files a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/58882d7c and /dev/null differ
diff --git a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/58b7fcc8 b/.config/.cache/v24.8.0-arm64-ef5a0af0-501/58b7fcc8
deleted file mode 100644
index 61f56af..0000000
Binary files a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/58b7fcc8 and /dev/null differ
diff --git a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/59065892 b/.config/.cache/v24.8.0-arm64-ef5a0af0-501/59065892
deleted file mode 100644
index 746edfd..0000000
Binary files a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/59065892 and /dev/null differ
diff --git a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/5925987f b/.config/.cache/v24.8.0-arm64-ef5a0af0-501/5925987f
deleted file mode 100644
index e7e25f9..0000000
Binary files a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/5925987f and /dev/null differ
diff --git a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/59480892 b/.config/.cache/v24.8.0-arm64-ef5a0af0-501/59480892
deleted file mode 100644
index 7d3666a..0000000
Binary files a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/59480892 and /dev/null differ
diff --git a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/594f6ded b/.config/.cache/v24.8.0-arm64-ef5a0af0-501/594f6ded
deleted file mode 100644
index 9955239..0000000
Binary files a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/594f6ded and /dev/null differ
diff --git a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/59670b7c b/.config/.cache/v24.8.0-arm64-ef5a0af0-501/59670b7c
deleted file mode 100644
index dfe86f5..0000000
Binary files a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/59670b7c and /dev/null differ
diff --git a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/5969e906 b/.config/.cache/v24.8.0-arm64-ef5a0af0-501/5969e906
deleted file mode 100644
index 43080a3..0000000
Binary files a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/5969e906 and /dev/null differ
diff --git a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/59adc900 b/.config/.cache/v24.8.0-arm64-ef5a0af0-501/59adc900
deleted file mode 100644
index 95256e2..0000000
Binary files a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/59adc900 and /dev/null differ
diff --git a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/5a0a6f1c b/.config/.cache/v24.8.0-arm64-ef5a0af0-501/5a0a6f1c
deleted file mode 100644
index 2b13e3d..0000000
Binary files a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/5a0a6f1c and /dev/null differ
diff --git a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/5a2b8be2 b/.config/.cache/v24.8.0-arm64-ef5a0af0-501/5a2b8be2
deleted file mode 100644
index 96495d2..0000000
Binary files a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/5a2b8be2 and /dev/null differ
diff --git a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/5a3beb09 b/.config/.cache/v24.8.0-arm64-ef5a0af0-501/5a3beb09
deleted file mode 100644
index f5dcbc1..0000000
Binary files a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/5a3beb09 and /dev/null differ
diff --git a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/5a7c1e2d b/.config/.cache/v24.8.0-arm64-ef5a0af0-501/5a7c1e2d
deleted file mode 100644
index ed0efc4..0000000
Binary files a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/5a7c1e2d and /dev/null differ
diff --git a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/5a8c0bcd b/.config/.cache/v24.8.0-arm64-ef5a0af0-501/5a8c0bcd
deleted file mode 100644
index 3b4cddb..0000000
Binary files a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/5a8c0bcd and /dev/null differ
diff --git a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/5b0dda5b b/.config/.cache/v24.8.0-arm64-ef5a0af0-501/5b0dda5b
deleted file mode 100644
index deccc6d..0000000
Binary files a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/5b0dda5b and /dev/null differ
diff --git a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/5b5a405a b/.config/.cache/v24.8.0-arm64-ef5a0af0-501/5b5a405a
deleted file mode 100644
index 2f327c0..0000000
Binary files a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/5b5a405a and /dev/null differ
diff --git a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/5b8269e4 b/.config/.cache/v24.8.0-arm64-ef5a0af0-501/5b8269e4
deleted file mode 100644
index f4a3170..0000000
Binary files a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/5b8269e4 and /dev/null differ
diff --git a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/5bbdaf7e b/.config/.cache/v24.8.0-arm64-ef5a0af0-501/5bbdaf7e
deleted file mode 100644
index 6210f86..0000000
Binary files a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/5bbdaf7e and /dev/null differ
diff --git a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/5bc730bc b/.config/.cache/v24.8.0-arm64-ef5a0af0-501/5bc730bc
deleted file mode 100644
index e497037..0000000
Binary files a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/5bc730bc and /dev/null differ
diff --git a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/5c62157a b/.config/.cache/v24.8.0-arm64-ef5a0af0-501/5c62157a
deleted file mode 100644
index cd3a942..0000000
Binary files a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/5c62157a and /dev/null differ
diff --git a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/5c6a0c13 b/.config/.cache/v24.8.0-arm64-ef5a0af0-501/5c6a0c13
deleted file mode 100644
index 3899673..0000000
Binary files a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/5c6a0c13 and /dev/null differ
diff --git a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/5c7113c9 b/.config/.cache/v24.8.0-arm64-ef5a0af0-501/5c7113c9
deleted file mode 100644
index 14d0d6d..0000000
Binary files a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/5c7113c9 and /dev/null differ
diff --git a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/5d030efa b/.config/.cache/v24.8.0-arm64-ef5a0af0-501/5d030efa
deleted file mode 100644
index edfa166..0000000
Binary files a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/5d030efa and /dev/null differ
diff --git a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/5d358da1 b/.config/.cache/v24.8.0-arm64-ef5a0af0-501/5d358da1
deleted file mode 100644
index 07261d5..0000000
Binary files a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/5d358da1 and /dev/null differ
diff --git a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/5d6a54f5 b/.config/.cache/v24.8.0-arm64-ef5a0af0-501/5d6a54f5
deleted file mode 100644
index e8023e6..0000000
Binary files a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/5d6a54f5 and /dev/null differ
diff --git a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/5da716be b/.config/.cache/v24.8.0-arm64-ef5a0af0-501/5da716be
deleted file mode 100644
index 3921c72..0000000
Binary files a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/5da716be and /dev/null differ
diff --git a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/5dbdc58c b/.config/.cache/v24.8.0-arm64-ef5a0af0-501/5dbdc58c
deleted file mode 100644
index 606ae3d..0000000
Binary files a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/5dbdc58c and /dev/null differ
diff --git a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/5dc14156 b/.config/.cache/v24.8.0-arm64-ef5a0af0-501/5dc14156
deleted file mode 100644
index 0e72082..0000000
Binary files a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/5dc14156 and /dev/null differ
diff --git a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/5e4c71e9 b/.config/.cache/v24.8.0-arm64-ef5a0af0-501/5e4c71e9
deleted file mode 100644
index ad2e3a9..0000000
Binary files a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/5e4c71e9 and /dev/null differ
diff --git a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/5e7d198e b/.config/.cache/v24.8.0-arm64-ef5a0af0-501/5e7d198e
deleted file mode 100644
index c2ff445..0000000
Binary files a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/5e7d198e and /dev/null differ
diff --git a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/5e9b530b b/.config/.cache/v24.8.0-arm64-ef5a0af0-501/5e9b530b
deleted file mode 100644
index 58eea2d..0000000
Binary files a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/5e9b530b and /dev/null differ
diff --git a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/5eaf1b8a b/.config/.cache/v24.8.0-arm64-ef5a0af0-501/5eaf1b8a
deleted file mode 100644
index fe07bed..0000000
Binary files a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/5eaf1b8a and /dev/null differ
diff --git a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/5eb87d57 b/.config/.cache/v24.8.0-arm64-ef5a0af0-501/5eb87d57
deleted file mode 100644
index 0ef5f7e..0000000
Binary files a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/5eb87d57 and /dev/null differ
diff --git a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/5eb972b7 b/.config/.cache/v24.8.0-arm64-ef5a0af0-501/5eb972b7
deleted file mode 100644
index 6a9961e..0000000
Binary files a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/5eb972b7 and /dev/null differ
diff --git a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/5ece6065 b/.config/.cache/v24.8.0-arm64-ef5a0af0-501/5ece6065
deleted file mode 100644
index 3579156..0000000
Binary files a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/5ece6065 and /dev/null differ
diff --git a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/5f050856 b/.config/.cache/v24.8.0-arm64-ef5a0af0-501/5f050856
deleted file mode 100644
index c9e5ce2..0000000
Binary files a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/5f050856 and /dev/null differ
diff --git a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/5f5e061d b/.config/.cache/v24.8.0-arm64-ef5a0af0-501/5f5e061d
deleted file mode 100644
index a4df555..0000000
Binary files a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/5f5e061d and /dev/null differ
diff --git a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/5f794a01 b/.config/.cache/v24.8.0-arm64-ef5a0af0-501/5f794a01
deleted file mode 100644
index 77b85af..0000000
Binary files a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/5f794a01 and /dev/null differ
diff --git a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/5f7fe02b b/.config/.cache/v24.8.0-arm64-ef5a0af0-501/5f7fe02b
deleted file mode 100644
index d1d110e..0000000
Binary files a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/5f7fe02b and /dev/null differ
diff --git a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/5fa8fabf b/.config/.cache/v24.8.0-arm64-ef5a0af0-501/5fa8fabf
deleted file mode 100644
index 2fa16b0..0000000
Binary files a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/5fa8fabf and /dev/null differ
diff --git a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/5faadf6a b/.config/.cache/v24.8.0-arm64-ef5a0af0-501/5faadf6a
deleted file mode 100644
index 79fd343..0000000
Binary files a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/5faadf6a and /dev/null differ
diff --git a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/5fb9703e b/.config/.cache/v24.8.0-arm64-ef5a0af0-501/5fb9703e
deleted file mode 100644
index f2f45c7..0000000
Binary files a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/5fb9703e and /dev/null differ
diff --git a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/5fb9cadb b/.config/.cache/v24.8.0-arm64-ef5a0af0-501/5fb9cadb
deleted file mode 100644
index 6917e57..0000000
Binary files a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/5fb9cadb and /dev/null differ
diff --git a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/5fc50041 b/.config/.cache/v24.8.0-arm64-ef5a0af0-501/5fc50041
deleted file mode 100644
index 5c016e5..0000000
Binary files a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/5fc50041 and /dev/null differ
diff --git a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/60254bc4 b/.config/.cache/v24.8.0-arm64-ef5a0af0-501/60254bc4
deleted file mode 100644
index b7ab8aa..0000000
Binary files a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/60254bc4 and /dev/null differ
diff --git a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/602c23e7 b/.config/.cache/v24.8.0-arm64-ef5a0af0-501/602c23e7
deleted file mode 100644
index f3902f8..0000000
Binary files a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/602c23e7 and /dev/null differ
diff --git a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/602c9a9c b/.config/.cache/v24.8.0-arm64-ef5a0af0-501/602c9a9c
deleted file mode 100644
index 4869f92..0000000
Binary files a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/602c9a9c and /dev/null differ
diff --git a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/606dfebe b/.config/.cache/v24.8.0-arm64-ef5a0af0-501/606dfebe
deleted file mode 100644
index 4f29271..0000000
Binary files a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/606dfebe and /dev/null differ
diff --git a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/6093d98b b/.config/.cache/v24.8.0-arm64-ef5a0af0-501/6093d98b
deleted file mode 100644
index 5fc0528..0000000
Binary files a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/6093d98b and /dev/null differ
diff --git a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/60bb7b44 b/.config/.cache/v24.8.0-arm64-ef5a0af0-501/60bb7b44
deleted file mode 100644
index 8fe5617..0000000
Binary files a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/60bb7b44 and /dev/null differ
diff --git a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/617959fb b/.config/.cache/v24.8.0-arm64-ef5a0af0-501/617959fb
deleted file mode 100644
index 9996aec..0000000
Binary files a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/617959fb and /dev/null differ
diff --git a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/6198c1be b/.config/.cache/v24.8.0-arm64-ef5a0af0-501/6198c1be
deleted file mode 100644
index 418899f..0000000
Binary files a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/6198c1be and /dev/null differ
diff --git a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/61996ca4 b/.config/.cache/v24.8.0-arm64-ef5a0af0-501/61996ca4
deleted file mode 100644
index 13deabe..0000000
Binary files a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/61996ca4 and /dev/null differ
diff --git a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/61a20669 b/.config/.cache/v24.8.0-arm64-ef5a0af0-501/61a20669
deleted file mode 100644
index 593bf2b..0000000
Binary files a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/61a20669 and /dev/null differ
diff --git a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/61a355a8 b/.config/.cache/v24.8.0-arm64-ef5a0af0-501/61a355a8
deleted file mode 100644
index 70a00cf..0000000
Binary files a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/61a355a8 and /dev/null differ
diff --git a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/61de8de2 b/.config/.cache/v24.8.0-arm64-ef5a0af0-501/61de8de2
deleted file mode 100644
index 91fe033..0000000
Binary files a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/61de8de2 and /dev/null differ
diff --git a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/61f87294 b/.config/.cache/v24.8.0-arm64-ef5a0af0-501/61f87294
deleted file mode 100644
index 305912b..0000000
Binary files a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/61f87294 and /dev/null differ
diff --git a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/620b92db b/.config/.cache/v24.8.0-arm64-ef5a0af0-501/620b92db
deleted file mode 100644
index 3172b85..0000000
Binary files a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/620b92db and /dev/null differ
diff --git a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/621963b1 b/.config/.cache/v24.8.0-arm64-ef5a0af0-501/621963b1
deleted file mode 100644
index 0b31013..0000000
Binary files a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/621963b1 and /dev/null differ
diff --git a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/6242cbad b/.config/.cache/v24.8.0-arm64-ef5a0af0-501/6242cbad
deleted file mode 100644
index da92065..0000000
Binary files a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/6242cbad and /dev/null differ
diff --git a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/626570bc b/.config/.cache/v24.8.0-arm64-ef5a0af0-501/626570bc
deleted file mode 100644
index 1039a30..0000000
Binary files a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/626570bc and /dev/null differ
diff --git a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/6274cd70 b/.config/.cache/v24.8.0-arm64-ef5a0af0-501/6274cd70
deleted file mode 100644
index 35849f3..0000000
Binary files a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/6274cd70 and /dev/null differ
diff --git a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/62bd262d b/.config/.cache/v24.8.0-arm64-ef5a0af0-501/62bd262d
deleted file mode 100644
index f254f21..0000000
Binary files a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/62bd262d and /dev/null differ
diff --git a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/62fca823 b/.config/.cache/v24.8.0-arm64-ef5a0af0-501/62fca823
deleted file mode 100644
index c976bc9..0000000
Binary files a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/62fca823 and /dev/null differ
diff --git a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/6346cd4c b/.config/.cache/v24.8.0-arm64-ef5a0af0-501/6346cd4c
deleted file mode 100644
index 5fc3127..0000000
Binary files a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/6346cd4c and /dev/null differ
diff --git a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/63697c21 b/.config/.cache/v24.8.0-arm64-ef5a0af0-501/63697c21
deleted file mode 100644
index 932bc3a..0000000
Binary files a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/63697c21 and /dev/null differ
diff --git a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/6390f9cd b/.config/.cache/v24.8.0-arm64-ef5a0af0-501/6390f9cd
deleted file mode 100644
index 1688316..0000000
Binary files a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/6390f9cd and /dev/null differ
diff --git a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/6395ac37 b/.config/.cache/v24.8.0-arm64-ef5a0af0-501/6395ac37
deleted file mode 100644
index f9c9753..0000000
Binary files a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/6395ac37 and /dev/null differ
diff --git a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/63a711ff b/.config/.cache/v24.8.0-arm64-ef5a0af0-501/63a711ff
deleted file mode 100644
index dfb18bf..0000000
Binary files a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/63a711ff and /dev/null differ
diff --git a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/63de9add b/.config/.cache/v24.8.0-arm64-ef5a0af0-501/63de9add
deleted file mode 100644
index 9c14ed3..0000000
Binary files a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/63de9add and /dev/null differ
diff --git a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/63e565ba b/.config/.cache/v24.8.0-arm64-ef5a0af0-501/63e565ba
deleted file mode 100644
index 522d720..0000000
Binary files a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/63e565ba and /dev/null differ
diff --git a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/642dfcdf b/.config/.cache/v24.8.0-arm64-ef5a0af0-501/642dfcdf
deleted file mode 100644
index b7f161c..0000000
Binary files a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/642dfcdf and /dev/null differ
diff --git a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/64a1d207 b/.config/.cache/v24.8.0-arm64-ef5a0af0-501/64a1d207
deleted file mode 100644
index 259abeb..0000000
Binary files a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/64a1d207 and /dev/null differ
diff --git a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/64c88b06 b/.config/.cache/v24.8.0-arm64-ef5a0af0-501/64c88b06
deleted file mode 100644
index f5d64e1..0000000
Binary files a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/64c88b06 and /dev/null differ
diff --git a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/64d12ea0 b/.config/.cache/v24.8.0-arm64-ef5a0af0-501/64d12ea0
deleted file mode 100644
index 62371f3..0000000
Binary files a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/64d12ea0 and /dev/null differ
diff --git a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/64ec1caa b/.config/.cache/v24.8.0-arm64-ef5a0af0-501/64ec1caa
deleted file mode 100644
index f8d16aa..0000000
Binary files a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/64ec1caa and /dev/null differ
diff --git a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/6503ffb1 b/.config/.cache/v24.8.0-arm64-ef5a0af0-501/6503ffb1
deleted file mode 100644
index ea626ce..0000000
Binary files a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/6503ffb1 and /dev/null differ
diff --git a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/65170140 b/.config/.cache/v24.8.0-arm64-ef5a0af0-501/65170140
deleted file mode 100644
index 4ae7b64..0000000
Binary files a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/65170140 and /dev/null differ
diff --git a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/65234fb5 b/.config/.cache/v24.8.0-arm64-ef5a0af0-501/65234fb5
deleted file mode 100644
index a811598..0000000
Binary files a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/65234fb5 and /dev/null differ
diff --git a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/6532a45a b/.config/.cache/v24.8.0-arm64-ef5a0af0-501/6532a45a
deleted file mode 100644
index b93919b..0000000
Binary files a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/6532a45a and /dev/null differ
diff --git a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/6564793c b/.config/.cache/v24.8.0-arm64-ef5a0af0-501/6564793c
deleted file mode 100644
index 0206303..0000000
Binary files a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/6564793c and /dev/null differ
diff --git a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/65950f30 b/.config/.cache/v24.8.0-arm64-ef5a0af0-501/65950f30
deleted file mode 100644
index 43aef5a..0000000
Binary files a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/65950f30 and /dev/null differ
diff --git a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/65a1cb60 b/.config/.cache/v24.8.0-arm64-ef5a0af0-501/65a1cb60
deleted file mode 100644
index ec333b6..0000000
Binary files a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/65a1cb60 and /dev/null differ
diff --git a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/65aec301 b/.config/.cache/v24.8.0-arm64-ef5a0af0-501/65aec301
deleted file mode 100644
index 0b57164..0000000
Binary files a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/65aec301 and /dev/null differ
diff --git a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/65ee89bd b/.config/.cache/v24.8.0-arm64-ef5a0af0-501/65ee89bd
deleted file mode 100644
index 6b5a368..0000000
Binary files a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/65ee89bd and /dev/null differ
diff --git a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/65f30682 b/.config/.cache/v24.8.0-arm64-ef5a0af0-501/65f30682
deleted file mode 100644
index 3e50e98..0000000
Binary files a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/65f30682 and /dev/null differ
diff --git a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/66216d55 b/.config/.cache/v24.8.0-arm64-ef5a0af0-501/66216d55
deleted file mode 100644
index 4fdb2d0..0000000
Binary files a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/66216d55 and /dev/null differ
diff --git a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/674a74bd b/.config/.cache/v24.8.0-arm64-ef5a0af0-501/674a74bd
deleted file mode 100644
index f4e20c9..0000000
Binary files a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/674a74bd and /dev/null differ
diff --git a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/676d1935 b/.config/.cache/v24.8.0-arm64-ef5a0af0-501/676d1935
deleted file mode 100644
index 35a45c0..0000000
Binary files a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/676d1935 and /dev/null differ
diff --git a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/679c13ee b/.config/.cache/v24.8.0-arm64-ef5a0af0-501/679c13ee
deleted file mode 100644
index 736b540..0000000
Binary files a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/679c13ee and /dev/null differ
diff --git a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/67a29b9d b/.config/.cache/v24.8.0-arm64-ef5a0af0-501/67a29b9d
deleted file mode 100644
index 8726a36..0000000
Binary files a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/67a29b9d and /dev/null differ
diff --git a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/6801c452 b/.config/.cache/v24.8.0-arm64-ef5a0af0-501/6801c452
deleted file mode 100644
index 866ef96..0000000
Binary files a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/6801c452 and /dev/null differ
diff --git a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/681bb9ef b/.config/.cache/v24.8.0-arm64-ef5a0af0-501/681bb9ef
deleted file mode 100644
index 0c63893..0000000
Binary files a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/681bb9ef and /dev/null differ
diff --git a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/681be624 b/.config/.cache/v24.8.0-arm64-ef5a0af0-501/681be624
deleted file mode 100644
index a08fcac..0000000
Binary files a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/681be624 and /dev/null differ
diff --git a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/682ed98c b/.config/.cache/v24.8.0-arm64-ef5a0af0-501/682ed98c
deleted file mode 100644
index 5d0be6d..0000000
Binary files a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/682ed98c and /dev/null differ
diff --git a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/684cf474 b/.config/.cache/v24.8.0-arm64-ef5a0af0-501/684cf474
deleted file mode 100644
index dd88f71..0000000
Binary files a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/684cf474 and /dev/null differ
diff --git a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/68566797 b/.config/.cache/v24.8.0-arm64-ef5a0af0-501/68566797
deleted file mode 100644
index 375b325..0000000
Binary files a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/68566797 and /dev/null differ
diff --git a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/6862a54f b/.config/.cache/v24.8.0-arm64-ef5a0af0-501/6862a54f
deleted file mode 100644
index bf5415d..0000000
Binary files a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/6862a54f and /dev/null differ
diff --git a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/68643058 b/.config/.cache/v24.8.0-arm64-ef5a0af0-501/68643058
deleted file mode 100644
index 429f046..0000000
Binary files a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/68643058 and /dev/null differ
diff --git a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/6868be01 b/.config/.cache/v24.8.0-arm64-ef5a0af0-501/6868be01
deleted file mode 100644
index 9037948..0000000
Binary files a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/6868be01 and /dev/null differ
diff --git a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/6875110d b/.config/.cache/v24.8.0-arm64-ef5a0af0-501/6875110d
deleted file mode 100644
index b693b0a..0000000
Binary files a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/6875110d and /dev/null differ
diff --git a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/68ccb385 b/.config/.cache/v24.8.0-arm64-ef5a0af0-501/68ccb385
deleted file mode 100644
index 71c3711..0000000
Binary files a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/68ccb385 and /dev/null differ
diff --git a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/6910cb55 b/.config/.cache/v24.8.0-arm64-ef5a0af0-501/6910cb55
deleted file mode 100644
index e12ce84..0000000
Binary files a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/6910cb55 and /dev/null differ
diff --git a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/6929cc1a b/.config/.cache/v24.8.0-arm64-ef5a0af0-501/6929cc1a
deleted file mode 100644
index bbbf185..0000000
Binary files a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/6929cc1a and /dev/null differ
diff --git a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/694bb1c1 b/.config/.cache/v24.8.0-arm64-ef5a0af0-501/694bb1c1
deleted file mode 100644
index ac5cc31..0000000
Binary files a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/694bb1c1 and /dev/null differ
diff --git a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/6956eca4 b/.config/.cache/v24.8.0-arm64-ef5a0af0-501/6956eca4
deleted file mode 100644
index cccb1a2..0000000
Binary files a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/6956eca4 and /dev/null differ
diff --git a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/6964329f b/.config/.cache/v24.8.0-arm64-ef5a0af0-501/6964329f
deleted file mode 100644
index 0d030f2..0000000
Binary files a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/6964329f and /dev/null differ
diff --git a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/69816c55 b/.config/.cache/v24.8.0-arm64-ef5a0af0-501/69816c55
deleted file mode 100644
index 9b101fd..0000000
Binary files a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/69816c55 and /dev/null differ
diff --git a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/698be7a9 b/.config/.cache/v24.8.0-arm64-ef5a0af0-501/698be7a9
deleted file mode 100644
index 99d1841..0000000
Binary files a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/698be7a9 and /dev/null differ
diff --git a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/6998e0ff b/.config/.cache/v24.8.0-arm64-ef5a0af0-501/6998e0ff
deleted file mode 100644
index 58bbca1..0000000
Binary files a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/6998e0ff and /dev/null differ
diff --git a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/69d8f2e1 b/.config/.cache/v24.8.0-arm64-ef5a0af0-501/69d8f2e1
deleted file mode 100644
index a329ae8..0000000
Binary files a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/69d8f2e1 and /dev/null differ
diff --git a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/69f84c68 b/.config/.cache/v24.8.0-arm64-ef5a0af0-501/69f84c68
deleted file mode 100644
index c301eae..0000000
Binary files a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/69f84c68 and /dev/null differ
diff --git a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/6a0994c7 b/.config/.cache/v24.8.0-arm64-ef5a0af0-501/6a0994c7
deleted file mode 100644
index 3c12b1c..0000000
Binary files a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/6a0994c7 and /dev/null differ
diff --git a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/6a64a8f5 b/.config/.cache/v24.8.0-arm64-ef5a0af0-501/6a64a8f5
deleted file mode 100644
index 1520432..0000000
Binary files a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/6a64a8f5 and /dev/null differ
diff --git a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/6a8b3ac8 b/.config/.cache/v24.8.0-arm64-ef5a0af0-501/6a8b3ac8
deleted file mode 100644
index 13599ca..0000000
Binary files a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/6a8b3ac8 and /dev/null differ
diff --git a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/6aaf22bd b/.config/.cache/v24.8.0-arm64-ef5a0af0-501/6aaf22bd
deleted file mode 100644
index 94c6b63..0000000
Binary files a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/6aaf22bd and /dev/null differ
diff --git a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/6ae8c5df b/.config/.cache/v24.8.0-arm64-ef5a0af0-501/6ae8c5df
deleted file mode 100644
index 03d5f6f..0000000
Binary files a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/6ae8c5df and /dev/null differ
diff --git a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/6b6846e3 b/.config/.cache/v24.8.0-arm64-ef5a0af0-501/6b6846e3
deleted file mode 100644
index 1e71f43..0000000
Binary files a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/6b6846e3 and /dev/null differ
diff --git a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/6bcde4bf b/.config/.cache/v24.8.0-arm64-ef5a0af0-501/6bcde4bf
deleted file mode 100644
index c5c2518..0000000
Binary files a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/6bcde4bf and /dev/null differ
diff --git a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/6c13cedf b/.config/.cache/v24.8.0-arm64-ef5a0af0-501/6c13cedf
deleted file mode 100644
index c9e04a6..0000000
Binary files a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/6c13cedf and /dev/null differ
diff --git a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/6c4ccc5a b/.config/.cache/v24.8.0-arm64-ef5a0af0-501/6c4ccc5a
deleted file mode 100644
index 3e58a61..0000000
Binary files a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/6c4ccc5a and /dev/null differ
diff --git a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/6cb5a999 b/.config/.cache/v24.8.0-arm64-ef5a0af0-501/6cb5a999
deleted file mode 100644
index 6ce882a..0000000
Binary files a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/6cb5a999 and /dev/null differ
diff --git a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/6ce949d6 b/.config/.cache/v24.8.0-arm64-ef5a0af0-501/6ce949d6
deleted file mode 100644
index c5ffc27..0000000
Binary files a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/6ce949d6 and /dev/null differ
diff --git a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/6d7aecf6 b/.config/.cache/v24.8.0-arm64-ef5a0af0-501/6d7aecf6
deleted file mode 100644
index e49471b..0000000
Binary files a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/6d7aecf6 and /dev/null differ
diff --git a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/6dc1e7bf b/.config/.cache/v24.8.0-arm64-ef5a0af0-501/6dc1e7bf
deleted file mode 100644
index 122f23c..0000000
Binary files a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/6dc1e7bf and /dev/null differ
diff --git a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/6dc86327 b/.config/.cache/v24.8.0-arm64-ef5a0af0-501/6dc86327
deleted file mode 100644
index b4e4da4..0000000
Binary files a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/6dc86327 and /dev/null differ
diff --git a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/6dc9db82 b/.config/.cache/v24.8.0-arm64-ef5a0af0-501/6dc9db82
deleted file mode 100644
index a92aa6a..0000000
Binary files a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/6dc9db82 and /dev/null differ
diff --git a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/6e113917 b/.config/.cache/v24.8.0-arm64-ef5a0af0-501/6e113917
deleted file mode 100644
index b0260a7..0000000
Binary files a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/6e113917 and /dev/null differ
diff --git a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/6e55b759 b/.config/.cache/v24.8.0-arm64-ef5a0af0-501/6e55b759
deleted file mode 100644
index 848ab4d..0000000
Binary files a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/6e55b759 and /dev/null differ
diff --git a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/6e5e9da7 b/.config/.cache/v24.8.0-arm64-ef5a0af0-501/6e5e9da7
deleted file mode 100644
index ab8ed90..0000000
Binary files a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/6e5e9da7 and /dev/null differ
diff --git a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/6e6ec59e b/.config/.cache/v24.8.0-arm64-ef5a0af0-501/6e6ec59e
deleted file mode 100644
index 558ea53..0000000
Binary files a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/6e6ec59e and /dev/null differ
diff --git a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/6ecfca11 b/.config/.cache/v24.8.0-arm64-ef5a0af0-501/6ecfca11
deleted file mode 100644
index 1ac745e..0000000
Binary files a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/6ecfca11 and /dev/null differ
diff --git a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/6f122b9a b/.config/.cache/v24.8.0-arm64-ef5a0af0-501/6f122b9a
deleted file mode 100644
index 473913a..0000000
Binary files a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/6f122b9a and /dev/null differ
diff --git a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/6f59cb7d b/.config/.cache/v24.8.0-arm64-ef5a0af0-501/6f59cb7d
deleted file mode 100644
index 916893c..0000000
Binary files a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/6f59cb7d and /dev/null differ
diff --git a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/6f92ff66 b/.config/.cache/v24.8.0-arm64-ef5a0af0-501/6f92ff66
deleted file mode 100644
index 6e60ef3..0000000
Binary files a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/6f92ff66 and /dev/null differ
diff --git a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/6fa3efcd b/.config/.cache/v24.8.0-arm64-ef5a0af0-501/6fa3efcd
deleted file mode 100644
index 8421f70..0000000
Binary files a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/6fa3efcd and /dev/null differ
diff --git a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/6fab89ee b/.config/.cache/v24.8.0-arm64-ef5a0af0-501/6fab89ee
deleted file mode 100644
index c5d1c77..0000000
Binary files a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/6fab89ee and /dev/null differ
diff --git a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/703a0167 b/.config/.cache/v24.8.0-arm64-ef5a0af0-501/703a0167
deleted file mode 100644
index fe7ca22..0000000
Binary files a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/703a0167 and /dev/null differ
diff --git a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/70c355a3 b/.config/.cache/v24.8.0-arm64-ef5a0af0-501/70c355a3
deleted file mode 100644
index 84ec9e7..0000000
Binary files a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/70c355a3 and /dev/null differ
diff --git a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/70f60ad8 b/.config/.cache/v24.8.0-arm64-ef5a0af0-501/70f60ad8
deleted file mode 100644
index 79a9a1f..0000000
Binary files a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/70f60ad8 and /dev/null differ
diff --git a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/71cf2880 b/.config/.cache/v24.8.0-arm64-ef5a0af0-501/71cf2880
deleted file mode 100644
index 2fb1a95..0000000
Binary files a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/71cf2880 and /dev/null differ
diff --git a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/71da1074 b/.config/.cache/v24.8.0-arm64-ef5a0af0-501/71da1074
deleted file mode 100644
index 84828a6..0000000
Binary files a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/71da1074 and /dev/null differ
diff --git a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/71e5a5ff b/.config/.cache/v24.8.0-arm64-ef5a0af0-501/71e5a5ff
deleted file mode 100644
index f4952ff..0000000
Binary files a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/71e5a5ff and /dev/null differ
diff --git a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/720c0c68 b/.config/.cache/v24.8.0-arm64-ef5a0af0-501/720c0c68
deleted file mode 100644
index cdb6cd7..0000000
Binary files a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/720c0c68 and /dev/null differ
diff --git a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/72155eca b/.config/.cache/v24.8.0-arm64-ef5a0af0-501/72155eca
deleted file mode 100644
index fc3f6d6..0000000
Binary files a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/72155eca and /dev/null differ
diff --git a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/72549ee2 b/.config/.cache/v24.8.0-arm64-ef5a0af0-501/72549ee2
deleted file mode 100644
index 5966c67..0000000
Binary files a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/72549ee2 and /dev/null differ
diff --git a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/72568722 b/.config/.cache/v24.8.0-arm64-ef5a0af0-501/72568722
deleted file mode 100644
index 8f251e0..0000000
Binary files a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/72568722 and /dev/null differ
diff --git a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/729dd0b7 b/.config/.cache/v24.8.0-arm64-ef5a0af0-501/729dd0b7
deleted file mode 100644
index bbc16a7..0000000
Binary files a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/729dd0b7 and /dev/null differ
diff --git a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/72d9f5d3 b/.config/.cache/v24.8.0-arm64-ef5a0af0-501/72d9f5d3
deleted file mode 100644
index b33b36c..0000000
Binary files a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/72d9f5d3 and /dev/null differ
diff --git a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/73394bcf b/.config/.cache/v24.8.0-arm64-ef5a0af0-501/73394bcf
deleted file mode 100644
index 8aa0d50..0000000
Binary files a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/73394bcf and /dev/null differ
diff --git a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/739ddb30 b/.config/.cache/v24.8.0-arm64-ef5a0af0-501/739ddb30
deleted file mode 100644
index 60c01b8..0000000
Binary files a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/739ddb30 and /dev/null differ
diff --git a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/73bd1de8 b/.config/.cache/v24.8.0-arm64-ef5a0af0-501/73bd1de8
deleted file mode 100644
index 4dbf319..0000000
Binary files a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/73bd1de8 and /dev/null differ
diff --git a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/73c2578b b/.config/.cache/v24.8.0-arm64-ef5a0af0-501/73c2578b
deleted file mode 100644
index 25e69bd..0000000
Binary files a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/73c2578b and /dev/null differ
diff --git a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/73d0aa1f b/.config/.cache/v24.8.0-arm64-ef5a0af0-501/73d0aa1f
deleted file mode 100644
index 4b619cf..0000000
Binary files a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/73d0aa1f and /dev/null differ
diff --git a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/73f895b0 b/.config/.cache/v24.8.0-arm64-ef5a0af0-501/73f895b0
deleted file mode 100644
index 84dfc00..0000000
Binary files a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/73f895b0 and /dev/null differ
diff --git a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/74039026 b/.config/.cache/v24.8.0-arm64-ef5a0af0-501/74039026
deleted file mode 100644
index 77642d3..0000000
Binary files a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/74039026 and /dev/null differ
diff --git a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/74195846 b/.config/.cache/v24.8.0-arm64-ef5a0af0-501/74195846
deleted file mode 100644
index 8756727..0000000
Binary files a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/74195846 and /dev/null differ
diff --git a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/741d154d b/.config/.cache/v24.8.0-arm64-ef5a0af0-501/741d154d
deleted file mode 100644
index 584128b..0000000
Binary files a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/741d154d and /dev/null differ
diff --git a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/74280970 b/.config/.cache/v24.8.0-arm64-ef5a0af0-501/74280970
deleted file mode 100644
index 0603946..0000000
Binary files a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/74280970 and /dev/null differ
diff --git a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/74896013 b/.config/.cache/v24.8.0-arm64-ef5a0af0-501/74896013
deleted file mode 100644
index 8b284ea..0000000
Binary files a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/74896013 and /dev/null differ
diff --git a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/749b19a1 b/.config/.cache/v24.8.0-arm64-ef5a0af0-501/749b19a1
deleted file mode 100644
index 34a8c91..0000000
Binary files a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/749b19a1 and /dev/null differ
diff --git a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/74aca918 b/.config/.cache/v24.8.0-arm64-ef5a0af0-501/74aca918
deleted file mode 100644
index 1655c2d..0000000
Binary files a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/74aca918 and /dev/null differ
diff --git a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/74dd3d03 b/.config/.cache/v24.8.0-arm64-ef5a0af0-501/74dd3d03
deleted file mode 100644
index 261d204..0000000
Binary files a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/74dd3d03 and /dev/null differ
diff --git a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/74f9fd47 b/.config/.cache/v24.8.0-arm64-ef5a0af0-501/74f9fd47
deleted file mode 100644
index 51eb4af..0000000
Binary files a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/74f9fd47 and /dev/null differ
diff --git a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/750319bf b/.config/.cache/v24.8.0-arm64-ef5a0af0-501/750319bf
deleted file mode 100644
index 8c10718..0000000
Binary files a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/750319bf and /dev/null differ
diff --git a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/7532b2b4 b/.config/.cache/v24.8.0-arm64-ef5a0af0-501/7532b2b4
deleted file mode 100644
index 01b7dde..0000000
Binary files a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/7532b2b4 and /dev/null differ
diff --git a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/75573f55 b/.config/.cache/v24.8.0-arm64-ef5a0af0-501/75573f55
deleted file mode 100644
index ee61051..0000000
Binary files a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/75573f55 and /dev/null differ
diff --git a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/75c4cc79 b/.config/.cache/v24.8.0-arm64-ef5a0af0-501/75c4cc79
deleted file mode 100644
index ae32825..0000000
Binary files a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/75c4cc79 and /dev/null differ
diff --git a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/76463ce8 b/.config/.cache/v24.8.0-arm64-ef5a0af0-501/76463ce8
deleted file mode 100644
index 40bd49d..0000000
Binary files a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/76463ce8 and /dev/null differ
diff --git a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/76753de3 b/.config/.cache/v24.8.0-arm64-ef5a0af0-501/76753de3
deleted file mode 100644
index 5ea8953..0000000
Binary files a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/76753de3 and /dev/null differ
diff --git a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/76a28a49 b/.config/.cache/v24.8.0-arm64-ef5a0af0-501/76a28a49
deleted file mode 100644
index c42ea85..0000000
Binary files a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/76a28a49 and /dev/null differ
diff --git a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/76c8cc55 b/.config/.cache/v24.8.0-arm64-ef5a0af0-501/76c8cc55
deleted file mode 100644
index a5e3cd2..0000000
Binary files a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/76c8cc55 and /dev/null differ
diff --git a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/7711e0a6 b/.config/.cache/v24.8.0-arm64-ef5a0af0-501/7711e0a6
deleted file mode 100644
index c9e9dc7..0000000
Binary files a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/7711e0a6 and /dev/null differ
diff --git a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/7734e182 b/.config/.cache/v24.8.0-arm64-ef5a0af0-501/7734e182
deleted file mode 100644
index 22ea4ba..0000000
Binary files a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/7734e182 and /dev/null differ
diff --git a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/774d0a39 b/.config/.cache/v24.8.0-arm64-ef5a0af0-501/774d0a39
deleted file mode 100644
index e36e1e7..0000000
Binary files a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/774d0a39 and /dev/null differ
diff --git a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/77505d4c b/.config/.cache/v24.8.0-arm64-ef5a0af0-501/77505d4c
deleted file mode 100644
index 6ddffd2..0000000
Binary files a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/77505d4c and /dev/null differ
diff --git a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/775f3a87 b/.config/.cache/v24.8.0-arm64-ef5a0af0-501/775f3a87
deleted file mode 100644
index 4515efb..0000000
Binary files a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/775f3a87 and /dev/null differ
diff --git a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/77ba7e5a b/.config/.cache/v24.8.0-arm64-ef5a0af0-501/77ba7e5a
deleted file mode 100644
index 6d37169..0000000
Binary files a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/77ba7e5a and /dev/null differ
diff --git a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/77c580a3 b/.config/.cache/v24.8.0-arm64-ef5a0af0-501/77c580a3
deleted file mode 100644
index e83c6b7..0000000
Binary files a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/77c580a3 and /dev/null differ
diff --git a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/78021920 b/.config/.cache/v24.8.0-arm64-ef5a0af0-501/78021920
deleted file mode 100644
index 2db1cda..0000000
Binary files a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/78021920 and /dev/null differ
diff --git a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/780da85c b/.config/.cache/v24.8.0-arm64-ef5a0af0-501/780da85c
deleted file mode 100644
index 2d6cf54..0000000
Binary files a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/780da85c and /dev/null differ
diff --git a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/78591458 b/.config/.cache/v24.8.0-arm64-ef5a0af0-501/78591458
deleted file mode 100644
index e0c86f4..0000000
Binary files a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/78591458 and /dev/null differ
diff --git a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/7861c5c8 b/.config/.cache/v24.8.0-arm64-ef5a0af0-501/7861c5c8
deleted file mode 100644
index f19fca0..0000000
Binary files a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/7861c5c8 and /dev/null differ
diff --git a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/786bf217 b/.config/.cache/v24.8.0-arm64-ef5a0af0-501/786bf217
deleted file mode 100644
index 384be21..0000000
Binary files a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/786bf217 and /dev/null differ
diff --git a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/7872743e b/.config/.cache/v24.8.0-arm64-ef5a0af0-501/7872743e
deleted file mode 100644
index ee88a90..0000000
Binary files a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/7872743e and /dev/null differ
diff --git a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/7873b5a5 b/.config/.cache/v24.8.0-arm64-ef5a0af0-501/7873b5a5
deleted file mode 100644
index fc8fd89..0000000
Binary files a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/7873b5a5 and /dev/null differ
diff --git a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/788193c3 b/.config/.cache/v24.8.0-arm64-ef5a0af0-501/788193c3
deleted file mode 100644
index da524ed..0000000
Binary files a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/788193c3 and /dev/null differ
diff --git a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/788ad650 b/.config/.cache/v24.8.0-arm64-ef5a0af0-501/788ad650
deleted file mode 100644
index bebad8e..0000000
Binary files a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/788ad650 and /dev/null differ
diff --git a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/78b19ed6 b/.config/.cache/v24.8.0-arm64-ef5a0af0-501/78b19ed6
deleted file mode 100644
index 93dc11d..0000000
Binary files a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/78b19ed6 and /dev/null differ
diff --git a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/78d562f8 b/.config/.cache/v24.8.0-arm64-ef5a0af0-501/78d562f8
deleted file mode 100644
index 929848c..0000000
Binary files a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/78d562f8 and /dev/null differ
diff --git a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/7905e5a1 b/.config/.cache/v24.8.0-arm64-ef5a0af0-501/7905e5a1
deleted file mode 100644
index 620f2a1..0000000
Binary files a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/7905e5a1 and /dev/null differ
diff --git a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/791e083d b/.config/.cache/v24.8.0-arm64-ef5a0af0-501/791e083d
deleted file mode 100644
index 6b9a3f6..0000000
Binary files a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/791e083d and /dev/null differ
diff --git a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/792f3f04 b/.config/.cache/v24.8.0-arm64-ef5a0af0-501/792f3f04
deleted file mode 100644
index b6b705c..0000000
Binary files a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/792f3f04 and /dev/null differ
diff --git a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/7949a911 b/.config/.cache/v24.8.0-arm64-ef5a0af0-501/7949a911
deleted file mode 100644
index 7bb34ac..0000000
Binary files a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/7949a911 and /dev/null differ
diff --git a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/794bf006 b/.config/.cache/v24.8.0-arm64-ef5a0af0-501/794bf006
deleted file mode 100644
index f465bc6..0000000
Binary files a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/794bf006 and /dev/null differ
diff --git a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/79cabcc4 b/.config/.cache/v24.8.0-arm64-ef5a0af0-501/79cabcc4
deleted file mode 100644
index f3f4695..0000000
Binary files a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/79cabcc4 and /dev/null differ
diff --git a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/79cbf707 b/.config/.cache/v24.8.0-arm64-ef5a0af0-501/79cbf707
deleted file mode 100644
index b00c277..0000000
Binary files a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/79cbf707 and /dev/null differ
diff --git a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/79d1f97d b/.config/.cache/v24.8.0-arm64-ef5a0af0-501/79d1f97d
deleted file mode 100644
index 97fb286..0000000
Binary files a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/79d1f97d and /dev/null differ
diff --git a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/79e2953c b/.config/.cache/v24.8.0-arm64-ef5a0af0-501/79e2953c
deleted file mode 100644
index 169fc74..0000000
Binary files a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/79e2953c and /dev/null differ
diff --git a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/79f90e49 b/.config/.cache/v24.8.0-arm64-ef5a0af0-501/79f90e49
deleted file mode 100644
index f75c367..0000000
Binary files a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/79f90e49 and /dev/null differ
diff --git a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/7a35ab78 b/.config/.cache/v24.8.0-arm64-ef5a0af0-501/7a35ab78
deleted file mode 100644
index 13dae7e..0000000
Binary files a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/7a35ab78 and /dev/null differ
diff --git a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/7a6b9efe b/.config/.cache/v24.8.0-arm64-ef5a0af0-501/7a6b9efe
deleted file mode 100644
index febf5aa..0000000
Binary files a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/7a6b9efe and /dev/null differ
diff --git a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/7a7341f7 b/.config/.cache/v24.8.0-arm64-ef5a0af0-501/7a7341f7
deleted file mode 100644
index 76387f0..0000000
Binary files a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/7a7341f7 and /dev/null differ
diff --git a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/7ad934a5 b/.config/.cache/v24.8.0-arm64-ef5a0af0-501/7ad934a5
deleted file mode 100644
index 978115e..0000000
Binary files a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/7ad934a5 and /dev/null differ
diff --git a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/7ae59044 b/.config/.cache/v24.8.0-arm64-ef5a0af0-501/7ae59044
deleted file mode 100644
index 3199e72..0000000
Binary files a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/7ae59044 and /dev/null differ
diff --git a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/7b0464cd b/.config/.cache/v24.8.0-arm64-ef5a0af0-501/7b0464cd
deleted file mode 100644
index 0e63b66..0000000
Binary files a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/7b0464cd and /dev/null differ
diff --git a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/7b12c96f b/.config/.cache/v24.8.0-arm64-ef5a0af0-501/7b12c96f
deleted file mode 100644
index 2cb41c2..0000000
Binary files a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/7b12c96f and /dev/null differ
diff --git a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/7b18ec21 b/.config/.cache/v24.8.0-arm64-ef5a0af0-501/7b18ec21
deleted file mode 100644
index 04152cd..0000000
Binary files a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/7b18ec21 and /dev/null differ
diff --git a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/7b19bd2f b/.config/.cache/v24.8.0-arm64-ef5a0af0-501/7b19bd2f
deleted file mode 100644
index 42047cf..0000000
Binary files a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/7b19bd2f and /dev/null differ
diff --git a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/7b1ba285 b/.config/.cache/v24.8.0-arm64-ef5a0af0-501/7b1ba285
deleted file mode 100644
index 16967ec..0000000
Binary files a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/7b1ba285 and /dev/null differ
diff --git a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/7b999954 b/.config/.cache/v24.8.0-arm64-ef5a0af0-501/7b999954
deleted file mode 100644
index 05f038e..0000000
Binary files a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/7b999954 and /dev/null differ
diff --git a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/7bca471c b/.config/.cache/v24.8.0-arm64-ef5a0af0-501/7bca471c
deleted file mode 100644
index b58d0ec..0000000
Binary files a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/7bca471c and /dev/null differ
diff --git a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/7bfdc50c b/.config/.cache/v24.8.0-arm64-ef5a0af0-501/7bfdc50c
deleted file mode 100644
index 6355d9f..0000000
Binary files a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/7bfdc50c and /dev/null differ
diff --git a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/7c16313f b/.config/.cache/v24.8.0-arm64-ef5a0af0-501/7c16313f
deleted file mode 100644
index 9d62955..0000000
Binary files a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/7c16313f and /dev/null differ
diff --git a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/7c17b873 b/.config/.cache/v24.8.0-arm64-ef5a0af0-501/7c17b873
deleted file mode 100644
index 6b1a355..0000000
Binary files a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/7c17b873 and /dev/null differ
diff --git a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/7c451662 b/.config/.cache/v24.8.0-arm64-ef5a0af0-501/7c451662
deleted file mode 100644
index 37e4aab..0000000
Binary files a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/7c451662 and /dev/null differ
diff --git a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/7c4bddc8 b/.config/.cache/v24.8.0-arm64-ef5a0af0-501/7c4bddc8
deleted file mode 100644
index ae9f481..0000000
Binary files a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/7c4bddc8 and /dev/null differ
diff --git a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/7ca1e70b b/.config/.cache/v24.8.0-arm64-ef5a0af0-501/7ca1e70b
deleted file mode 100644
index e1df527..0000000
Binary files a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/7ca1e70b and /dev/null differ
diff --git a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/7cae0175 b/.config/.cache/v24.8.0-arm64-ef5a0af0-501/7cae0175
deleted file mode 100644
index c63569e..0000000
Binary files a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/7cae0175 and /dev/null differ
diff --git a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/7cd5f686 b/.config/.cache/v24.8.0-arm64-ef5a0af0-501/7cd5f686
deleted file mode 100644
index 3172820..0000000
Binary files a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/7cd5f686 and /dev/null differ
diff --git a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/7cfd422c b/.config/.cache/v24.8.0-arm64-ef5a0af0-501/7cfd422c
deleted file mode 100644
index 93ef536..0000000
Binary files a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/7cfd422c and /dev/null differ
diff --git a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/7d386448 b/.config/.cache/v24.8.0-arm64-ef5a0af0-501/7d386448
deleted file mode 100644
index 1c37774..0000000
Binary files a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/7d386448 and /dev/null differ
diff --git a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/7d8f6bf4 b/.config/.cache/v24.8.0-arm64-ef5a0af0-501/7d8f6bf4
deleted file mode 100644
index cc5cae3..0000000
Binary files a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/7d8f6bf4 and /dev/null differ
diff --git a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/7d9e7218 b/.config/.cache/v24.8.0-arm64-ef5a0af0-501/7d9e7218
deleted file mode 100644
index e074a75..0000000
Binary files a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/7d9e7218 and /dev/null differ
diff --git a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/7de16947 b/.config/.cache/v24.8.0-arm64-ef5a0af0-501/7de16947
deleted file mode 100644
index 2337cad..0000000
Binary files a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/7de16947 and /dev/null differ
diff --git a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/7e1e821c b/.config/.cache/v24.8.0-arm64-ef5a0af0-501/7e1e821c
deleted file mode 100644
index 7f290c6..0000000
Binary files a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/7e1e821c and /dev/null differ
diff --git a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/7e305e2f b/.config/.cache/v24.8.0-arm64-ef5a0af0-501/7e305e2f
deleted file mode 100644
index 0c2cd61..0000000
Binary files a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/7e305e2f and /dev/null differ
diff --git a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/7e695de5 b/.config/.cache/v24.8.0-arm64-ef5a0af0-501/7e695de5
deleted file mode 100644
index 1925b3e..0000000
Binary files a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/7e695de5 and /dev/null differ
diff --git a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/7e7cc5b2 b/.config/.cache/v24.8.0-arm64-ef5a0af0-501/7e7cc5b2
deleted file mode 100644
index 63ed491..0000000
Binary files a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/7e7cc5b2 and /dev/null differ
diff --git a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/7e929634 b/.config/.cache/v24.8.0-arm64-ef5a0af0-501/7e929634
deleted file mode 100644
index 8fe54c4..0000000
Binary files a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/7e929634 and /dev/null differ
diff --git a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/7e994672 b/.config/.cache/v24.8.0-arm64-ef5a0af0-501/7e994672
deleted file mode 100644
index fe96d4b..0000000
Binary files a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/7e994672 and /dev/null differ
diff --git a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/7eaaf4ff b/.config/.cache/v24.8.0-arm64-ef5a0af0-501/7eaaf4ff
deleted file mode 100644
index 444a689..0000000
Binary files a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/7eaaf4ff and /dev/null differ
diff --git a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/7eda09ff b/.config/.cache/v24.8.0-arm64-ef5a0af0-501/7eda09ff
deleted file mode 100644
index d48a1df..0000000
Binary files a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/7eda09ff and /dev/null differ
diff --git a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/7f1e61ec b/.config/.cache/v24.8.0-arm64-ef5a0af0-501/7f1e61ec
deleted file mode 100644
index 4107d63..0000000
Binary files a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/7f1e61ec and /dev/null differ
diff --git a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/7f316c72 b/.config/.cache/v24.8.0-arm64-ef5a0af0-501/7f316c72
deleted file mode 100644
index 4cd2731..0000000
Binary files a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/7f316c72 and /dev/null differ
diff --git a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/7f5e52ea b/.config/.cache/v24.8.0-arm64-ef5a0af0-501/7f5e52ea
deleted file mode 100644
index d7a9e82..0000000
Binary files a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/7f5e52ea and /dev/null differ
diff --git a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/7fc73234 b/.config/.cache/v24.8.0-arm64-ef5a0af0-501/7fc73234
deleted file mode 100644
index c9df833..0000000
Binary files a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/7fc73234 and /dev/null differ
diff --git a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/7fccdda0 b/.config/.cache/v24.8.0-arm64-ef5a0af0-501/7fccdda0
deleted file mode 100644
index 32361e0..0000000
Binary files a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/7fccdda0 and /dev/null differ
diff --git a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/7ff54a96 b/.config/.cache/v24.8.0-arm64-ef5a0af0-501/7ff54a96
deleted file mode 100644
index ab5b820..0000000
Binary files a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/7ff54a96 and /dev/null differ
diff --git a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/801d8134 b/.config/.cache/v24.8.0-arm64-ef5a0af0-501/801d8134
deleted file mode 100644
index b7ebb9d..0000000
Binary files a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/801d8134 and /dev/null differ
diff --git a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/81213c9e b/.config/.cache/v24.8.0-arm64-ef5a0af0-501/81213c9e
deleted file mode 100644
index 1c78e96..0000000
Binary files a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/81213c9e and /dev/null differ
diff --git a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/81466a26 b/.config/.cache/v24.8.0-arm64-ef5a0af0-501/81466a26
deleted file mode 100644
index aec8b9e..0000000
Binary files a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/81466a26 and /dev/null differ
diff --git a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/814c7c3d b/.config/.cache/v24.8.0-arm64-ef5a0af0-501/814c7c3d
deleted file mode 100644
index 78ef910..0000000
Binary files a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/814c7c3d and /dev/null differ
diff --git a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/81577820 b/.config/.cache/v24.8.0-arm64-ef5a0af0-501/81577820
deleted file mode 100644
index 9575b71..0000000
Binary files a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/81577820 and /dev/null differ
diff --git a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/8193432f b/.config/.cache/v24.8.0-arm64-ef5a0af0-501/8193432f
deleted file mode 100644
index 5623f0f..0000000
Binary files a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/8193432f and /dev/null differ
diff --git a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/81e4c902 b/.config/.cache/v24.8.0-arm64-ef5a0af0-501/81e4c902
deleted file mode 100644
index 0b4c050..0000000
Binary files a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/81e4c902 and /dev/null differ
diff --git a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/82027791 b/.config/.cache/v24.8.0-arm64-ef5a0af0-501/82027791
deleted file mode 100644
index 7fd9d9e..0000000
Binary files a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/82027791 and /dev/null differ
diff --git a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/82310a6c b/.config/.cache/v24.8.0-arm64-ef5a0af0-501/82310a6c
deleted file mode 100644
index f59840e..0000000
Binary files a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/82310a6c and /dev/null differ
diff --git a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/82db177c b/.config/.cache/v24.8.0-arm64-ef5a0af0-501/82db177c
deleted file mode 100644
index 362968f..0000000
Binary files a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/82db177c and /dev/null differ
diff --git a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/82df7d19 b/.config/.cache/v24.8.0-arm64-ef5a0af0-501/82df7d19
deleted file mode 100644
index 6d4edbe..0000000
Binary files a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/82df7d19 and /dev/null differ
diff --git a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/830ac8e9 b/.config/.cache/v24.8.0-arm64-ef5a0af0-501/830ac8e9
deleted file mode 100644
index 805af25..0000000
Binary files a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/830ac8e9 and /dev/null differ
diff --git a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/830d73eb b/.config/.cache/v24.8.0-arm64-ef5a0af0-501/830d73eb
deleted file mode 100644
index 9939cff..0000000
Binary files a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/830d73eb and /dev/null differ
diff --git a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/834cfd74 b/.config/.cache/v24.8.0-arm64-ef5a0af0-501/834cfd74
deleted file mode 100644
index a87429b..0000000
Binary files a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/834cfd74 and /dev/null differ
diff --git a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/8365a153 b/.config/.cache/v24.8.0-arm64-ef5a0af0-501/8365a153
deleted file mode 100644
index 39ea66c..0000000
Binary files a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/8365a153 and /dev/null differ
diff --git a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/8378d349 b/.config/.cache/v24.8.0-arm64-ef5a0af0-501/8378d349
deleted file mode 100644
index 92171c8..0000000
Binary files a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/8378d349 and /dev/null differ
diff --git a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/838b6606 b/.config/.cache/v24.8.0-arm64-ef5a0af0-501/838b6606
deleted file mode 100644
index cdec5e7..0000000
Binary files a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/838b6606 and /dev/null differ
diff --git a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/83aedf3a b/.config/.cache/v24.8.0-arm64-ef5a0af0-501/83aedf3a
deleted file mode 100644
index 2b40e4f..0000000
Binary files a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/83aedf3a and /dev/null differ
diff --git a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/83d4df4a b/.config/.cache/v24.8.0-arm64-ef5a0af0-501/83d4df4a
deleted file mode 100644
index 92d5066..0000000
Binary files a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/83d4df4a and /dev/null differ
diff --git a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/83e782ee b/.config/.cache/v24.8.0-arm64-ef5a0af0-501/83e782ee
deleted file mode 100644
index a2c4d98..0000000
Binary files a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/83e782ee and /dev/null differ
diff --git a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/83f0c41e b/.config/.cache/v24.8.0-arm64-ef5a0af0-501/83f0c41e
deleted file mode 100644
index bdeecda..0000000
Binary files a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/83f0c41e and /dev/null differ
diff --git a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/843c4873 b/.config/.cache/v24.8.0-arm64-ef5a0af0-501/843c4873
deleted file mode 100644
index 666ac3d..0000000
Binary files a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/843c4873 and /dev/null differ
diff --git a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/844e0815 b/.config/.cache/v24.8.0-arm64-ef5a0af0-501/844e0815
deleted file mode 100644
index a23d2c1..0000000
Binary files a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/844e0815 and /dev/null differ
diff --git a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/8457d620 b/.config/.cache/v24.8.0-arm64-ef5a0af0-501/8457d620
deleted file mode 100644
index e9f27b5..0000000
Binary files a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/8457d620 and /dev/null differ
diff --git a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/848633b5 b/.config/.cache/v24.8.0-arm64-ef5a0af0-501/848633b5
deleted file mode 100644
index c5bdaa7..0000000
Binary files a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/848633b5 and /dev/null differ
diff --git a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/8493d69e b/.config/.cache/v24.8.0-arm64-ef5a0af0-501/8493d69e
deleted file mode 100644
index 7994571..0000000
Binary files a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/8493d69e and /dev/null differ
diff --git a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/84945d08 b/.config/.cache/v24.8.0-arm64-ef5a0af0-501/84945d08
deleted file mode 100644
index c57c33b..0000000
Binary files a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/84945d08 and /dev/null differ
diff --git a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/8512c5bf b/.config/.cache/v24.8.0-arm64-ef5a0af0-501/8512c5bf
deleted file mode 100644
index 0af9663..0000000
Binary files a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/8512c5bf and /dev/null differ
diff --git a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/8516996e b/.config/.cache/v24.8.0-arm64-ef5a0af0-501/8516996e
deleted file mode 100644
index bdff3e6..0000000
Binary files a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/8516996e and /dev/null differ
diff --git a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/855b0c29 b/.config/.cache/v24.8.0-arm64-ef5a0af0-501/855b0c29
deleted file mode 100644
index 79b63bf..0000000
Binary files a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/855b0c29 and /dev/null differ
diff --git a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/856fbc9d b/.config/.cache/v24.8.0-arm64-ef5a0af0-501/856fbc9d
deleted file mode 100644
index 7309faf..0000000
Binary files a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/856fbc9d and /dev/null differ
diff --git a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/858e9b77 b/.config/.cache/v24.8.0-arm64-ef5a0af0-501/858e9b77
deleted file mode 100644
index df8b9c8..0000000
Binary files a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/858e9b77 and /dev/null differ
diff --git a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/85d1fbc6 b/.config/.cache/v24.8.0-arm64-ef5a0af0-501/85d1fbc6
deleted file mode 100644
index f649b92..0000000
Binary files a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/85d1fbc6 and /dev/null differ
diff --git a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/85d6a19a b/.config/.cache/v24.8.0-arm64-ef5a0af0-501/85d6a19a
deleted file mode 100644
index 9336917..0000000
Binary files a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/85d6a19a and /dev/null differ
diff --git a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/85db69aa b/.config/.cache/v24.8.0-arm64-ef5a0af0-501/85db69aa
deleted file mode 100644
index 352c426..0000000
Binary files a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/85db69aa and /dev/null differ
diff --git a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/85f0b569 b/.config/.cache/v24.8.0-arm64-ef5a0af0-501/85f0b569
deleted file mode 100644
index 72a4be3..0000000
Binary files a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/85f0b569 and /dev/null differ
diff --git a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/8610d7a3 b/.config/.cache/v24.8.0-arm64-ef5a0af0-501/8610d7a3
deleted file mode 100644
index 6e0a0b9..0000000
Binary files a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/8610d7a3 and /dev/null differ
diff --git a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/8632148e b/.config/.cache/v24.8.0-arm64-ef5a0af0-501/8632148e
deleted file mode 100644
index 3c3307c..0000000
Binary files a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/8632148e and /dev/null differ
diff --git a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/86734f82 b/.config/.cache/v24.8.0-arm64-ef5a0af0-501/86734f82
deleted file mode 100644
index f274101..0000000
Binary files a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/86734f82 and /dev/null differ
diff --git a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/8685b66c b/.config/.cache/v24.8.0-arm64-ef5a0af0-501/8685b66c
deleted file mode 100644
index 33c8a86..0000000
Binary files a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/8685b66c and /dev/null differ
diff --git a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/86c0b999 b/.config/.cache/v24.8.0-arm64-ef5a0af0-501/86c0b999
deleted file mode 100644
index 1b7707d..0000000
Binary files a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/86c0b999 and /dev/null differ
diff --git a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/86ca4219 b/.config/.cache/v24.8.0-arm64-ef5a0af0-501/86ca4219
deleted file mode 100644
index 8b904ca..0000000
Binary files a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/86ca4219 and /dev/null differ
diff --git a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/86ec4626 b/.config/.cache/v24.8.0-arm64-ef5a0af0-501/86ec4626
deleted file mode 100644
index b888a3d..0000000
Binary files a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/86ec4626 and /dev/null differ
diff --git a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/86fbd6d8 b/.config/.cache/v24.8.0-arm64-ef5a0af0-501/86fbd6d8
deleted file mode 100644
index 537d90b..0000000
Binary files a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/86fbd6d8 and /dev/null differ
diff --git a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/8701a173 b/.config/.cache/v24.8.0-arm64-ef5a0af0-501/8701a173
deleted file mode 100644
index 276e207..0000000
Binary files a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/8701a173 and /dev/null differ
diff --git a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/8737de22 b/.config/.cache/v24.8.0-arm64-ef5a0af0-501/8737de22
deleted file mode 100644
index e9e6fd4..0000000
Binary files a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/8737de22 and /dev/null differ
diff --git a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/875e140a b/.config/.cache/v24.8.0-arm64-ef5a0af0-501/875e140a
deleted file mode 100644
index e181a7f..0000000
Binary files a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/875e140a and /dev/null differ
diff --git a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/87a2f871 b/.config/.cache/v24.8.0-arm64-ef5a0af0-501/87a2f871
deleted file mode 100644
index b373016..0000000
Binary files a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/87a2f871 and /dev/null differ
diff --git a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/87a6d335 b/.config/.cache/v24.8.0-arm64-ef5a0af0-501/87a6d335
deleted file mode 100644
index 068a922..0000000
Binary files a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/87a6d335 and /dev/null differ
diff --git a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/87b69ae1 b/.config/.cache/v24.8.0-arm64-ef5a0af0-501/87b69ae1
deleted file mode 100644
index c1f5bbc..0000000
Binary files a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/87b69ae1 and /dev/null differ
diff --git a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/87e63178 b/.config/.cache/v24.8.0-arm64-ef5a0af0-501/87e63178
deleted file mode 100644
index c9c7821..0000000
Binary files a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/87e63178 and /dev/null differ
diff --git a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/87e80328 b/.config/.cache/v24.8.0-arm64-ef5a0af0-501/87e80328
deleted file mode 100644
index a45af82..0000000
Binary files a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/87e80328 and /dev/null differ
diff --git a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/8804b1ce b/.config/.cache/v24.8.0-arm64-ef5a0af0-501/8804b1ce
deleted file mode 100644
index 7c81480..0000000
Binary files a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/8804b1ce and /dev/null differ
diff --git a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/8808bb0a b/.config/.cache/v24.8.0-arm64-ef5a0af0-501/8808bb0a
deleted file mode 100644
index 72399f3..0000000
Binary files a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/8808bb0a and /dev/null differ
diff --git a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/880fc39e b/.config/.cache/v24.8.0-arm64-ef5a0af0-501/880fc39e
deleted file mode 100644
index a80a2dd..0000000
Binary files a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/880fc39e and /dev/null differ
diff --git a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/886ecd78 b/.config/.cache/v24.8.0-arm64-ef5a0af0-501/886ecd78
deleted file mode 100644
index ff0e42c..0000000
Binary files a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/886ecd78 and /dev/null differ
diff --git a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/88757bf0 b/.config/.cache/v24.8.0-arm64-ef5a0af0-501/88757bf0
deleted file mode 100644
index 283e43c..0000000
Binary files a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/88757bf0 and /dev/null differ
diff --git a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/88a1b924 b/.config/.cache/v24.8.0-arm64-ef5a0af0-501/88a1b924
deleted file mode 100644
index db11d70..0000000
Binary files a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/88a1b924 and /dev/null differ
diff --git a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/88e828bf b/.config/.cache/v24.8.0-arm64-ef5a0af0-501/88e828bf
deleted file mode 100644
index 45bfda7..0000000
Binary files a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/88e828bf and /dev/null differ
diff --git a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/890625fd b/.config/.cache/v24.8.0-arm64-ef5a0af0-501/890625fd
deleted file mode 100644
index 78c8f89..0000000
Binary files a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/890625fd and /dev/null differ
diff --git a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/891d6698 b/.config/.cache/v24.8.0-arm64-ef5a0af0-501/891d6698
deleted file mode 100644
index 34b7d2f..0000000
Binary files a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/891d6698 and /dev/null differ
diff --git a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/8987a27b b/.config/.cache/v24.8.0-arm64-ef5a0af0-501/8987a27b
deleted file mode 100644
index 6e693e3..0000000
Binary files a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/8987a27b and /dev/null differ
diff --git a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/89915dbc b/.config/.cache/v24.8.0-arm64-ef5a0af0-501/89915dbc
deleted file mode 100644
index 98588e7..0000000
Binary files a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/89915dbc and /dev/null differ
diff --git a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/89963461 b/.config/.cache/v24.8.0-arm64-ef5a0af0-501/89963461
deleted file mode 100644
index c8e92da..0000000
Binary files a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/89963461 and /dev/null differ
diff --git a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/89a06442 b/.config/.cache/v24.8.0-arm64-ef5a0af0-501/89a06442
deleted file mode 100644
index e91a3da..0000000
Binary files a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/89a06442 and /dev/null differ
diff --git a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/89cfc76b b/.config/.cache/v24.8.0-arm64-ef5a0af0-501/89cfc76b
deleted file mode 100644
index 33e067e..0000000
Binary files a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/89cfc76b and /dev/null differ
diff --git a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/89edc344 b/.config/.cache/v24.8.0-arm64-ef5a0af0-501/89edc344
deleted file mode 100644
index 5f0535d..0000000
Binary files a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/89edc344 and /dev/null differ
diff --git a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/8a25627c b/.config/.cache/v24.8.0-arm64-ef5a0af0-501/8a25627c
deleted file mode 100644
index e045ecc..0000000
Binary files a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/8a25627c and /dev/null differ
diff --git a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/8a2ae8d2 b/.config/.cache/v24.8.0-arm64-ef5a0af0-501/8a2ae8d2
deleted file mode 100644
index e34d8bb..0000000
Binary files a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/8a2ae8d2 and /dev/null differ
diff --git a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/8a68367c b/.config/.cache/v24.8.0-arm64-ef5a0af0-501/8a68367c
deleted file mode 100644
index 5a79642..0000000
Binary files a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/8a68367c and /dev/null differ
diff --git a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/8a6b2bf7 b/.config/.cache/v24.8.0-arm64-ef5a0af0-501/8a6b2bf7
deleted file mode 100644
index 4504c79..0000000
Binary files a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/8a6b2bf7 and /dev/null differ
diff --git a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/8a6f5c8a b/.config/.cache/v24.8.0-arm64-ef5a0af0-501/8a6f5c8a
deleted file mode 100644
index 08e02c5..0000000
Binary files a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/8a6f5c8a and /dev/null differ
diff --git a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/8a872528 b/.config/.cache/v24.8.0-arm64-ef5a0af0-501/8a872528
deleted file mode 100644
index 4dccb68..0000000
Binary files a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/8a872528 and /dev/null differ
diff --git a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/8ac6aaff b/.config/.cache/v24.8.0-arm64-ef5a0af0-501/8ac6aaff
deleted file mode 100644
index f1b6634..0000000
Binary files a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/8ac6aaff and /dev/null differ
diff --git a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/8ad48228 b/.config/.cache/v24.8.0-arm64-ef5a0af0-501/8ad48228
deleted file mode 100644
index 24d0219..0000000
Binary files a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/8ad48228 and /dev/null differ
diff --git a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/8ae7fe43 b/.config/.cache/v24.8.0-arm64-ef5a0af0-501/8ae7fe43
deleted file mode 100644
index 20fcfc2..0000000
Binary files a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/8ae7fe43 and /dev/null differ
diff --git a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/8aee32e2 b/.config/.cache/v24.8.0-arm64-ef5a0af0-501/8aee32e2
deleted file mode 100644
index 00e8c7a..0000000
Binary files a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/8aee32e2 and /dev/null differ
diff --git a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/8b12615e b/.config/.cache/v24.8.0-arm64-ef5a0af0-501/8b12615e
deleted file mode 100644
index 25070dd..0000000
Binary files a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/8b12615e and /dev/null differ
diff --git a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/8b43e284 b/.config/.cache/v24.8.0-arm64-ef5a0af0-501/8b43e284
deleted file mode 100644
index 858570d..0000000
Binary files a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/8b43e284 and /dev/null differ
diff --git a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/8b46d82e b/.config/.cache/v24.8.0-arm64-ef5a0af0-501/8b46d82e
deleted file mode 100644
index 54a3e33..0000000
Binary files a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/8b46d82e and /dev/null differ
diff --git a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/8b497339 b/.config/.cache/v24.8.0-arm64-ef5a0af0-501/8b497339
deleted file mode 100644
index 603c9a2..0000000
Binary files a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/8b497339 and /dev/null differ
diff --git a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/8b5065f9 b/.config/.cache/v24.8.0-arm64-ef5a0af0-501/8b5065f9
deleted file mode 100644
index 428b02a..0000000
Binary files a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/8b5065f9 and /dev/null differ
diff --git a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/8bd3733b b/.config/.cache/v24.8.0-arm64-ef5a0af0-501/8bd3733b
deleted file mode 100644
index 1d09ae0..0000000
Binary files a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/8bd3733b and /dev/null differ
diff --git a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/8c0048c0 b/.config/.cache/v24.8.0-arm64-ef5a0af0-501/8c0048c0
deleted file mode 100644
index 5762e07..0000000
Binary files a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/8c0048c0 and /dev/null differ
diff --git a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/8c0e2b59 b/.config/.cache/v24.8.0-arm64-ef5a0af0-501/8c0e2b59
deleted file mode 100644
index a2e4821..0000000
Binary files a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/8c0e2b59 and /dev/null differ
diff --git a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/8c2697e5 b/.config/.cache/v24.8.0-arm64-ef5a0af0-501/8c2697e5
deleted file mode 100644
index 0d805a0..0000000
Binary files a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/8c2697e5 and /dev/null differ
diff --git a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/8c3b40b3 b/.config/.cache/v24.8.0-arm64-ef5a0af0-501/8c3b40b3
deleted file mode 100644
index 5592c65..0000000
Binary files a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/8c3b40b3 and /dev/null differ
diff --git a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/8c46425c b/.config/.cache/v24.8.0-arm64-ef5a0af0-501/8c46425c
deleted file mode 100644
index d148bd2..0000000
Binary files a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/8c46425c and /dev/null differ
diff --git a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/8c852fb3 b/.config/.cache/v24.8.0-arm64-ef5a0af0-501/8c852fb3
deleted file mode 100644
index 947245b..0000000
Binary files a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/8c852fb3 and /dev/null differ
diff --git a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/8ca8f805 b/.config/.cache/v24.8.0-arm64-ef5a0af0-501/8ca8f805
deleted file mode 100644
index 813fe05..0000000
Binary files a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/8ca8f805 and /dev/null differ
diff --git a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/8cbf6d75 b/.config/.cache/v24.8.0-arm64-ef5a0af0-501/8cbf6d75
deleted file mode 100644
index d24352d..0000000
Binary files a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/8cbf6d75 and /dev/null differ
diff --git a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/8d15e830 b/.config/.cache/v24.8.0-arm64-ef5a0af0-501/8d15e830
deleted file mode 100644
index 7fa462d..0000000
Binary files a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/8d15e830 and /dev/null differ
diff --git a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/8d3fb2cb b/.config/.cache/v24.8.0-arm64-ef5a0af0-501/8d3fb2cb
deleted file mode 100644
index ee4a28b..0000000
Binary files a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/8d3fb2cb and /dev/null differ
diff --git a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/8d74622a b/.config/.cache/v24.8.0-arm64-ef5a0af0-501/8d74622a
deleted file mode 100644
index ccd7240..0000000
Binary files a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/8d74622a and /dev/null differ
diff --git a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/8d7d0a72 b/.config/.cache/v24.8.0-arm64-ef5a0af0-501/8d7d0a72
deleted file mode 100644
index 59bd49b..0000000
Binary files a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/8d7d0a72 and /dev/null differ
diff --git a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/8da19110 b/.config/.cache/v24.8.0-arm64-ef5a0af0-501/8da19110
deleted file mode 100644
index 797f0a7..0000000
Binary files a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/8da19110 and /dev/null differ
diff --git a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/8e343699 b/.config/.cache/v24.8.0-arm64-ef5a0af0-501/8e343699
deleted file mode 100644
index 81e4064..0000000
Binary files a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/8e343699 and /dev/null differ
diff --git a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/8e420b7d b/.config/.cache/v24.8.0-arm64-ef5a0af0-501/8e420b7d
deleted file mode 100644
index bb33f5a..0000000
Binary files a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/8e420b7d and /dev/null differ
diff --git a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/8e5bbd44 b/.config/.cache/v24.8.0-arm64-ef5a0af0-501/8e5bbd44
deleted file mode 100644
index 667bc11..0000000
Binary files a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/8e5bbd44 and /dev/null differ
diff --git a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/8e632299 b/.config/.cache/v24.8.0-arm64-ef5a0af0-501/8e632299
deleted file mode 100644
index 7282e02..0000000
Binary files a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/8e632299 and /dev/null differ
diff --git a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/8e6d753b b/.config/.cache/v24.8.0-arm64-ef5a0af0-501/8e6d753b
deleted file mode 100644
index 5cf4ef8..0000000
Binary files a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/8e6d753b and /dev/null differ
diff --git a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/8ec9ab72 b/.config/.cache/v24.8.0-arm64-ef5a0af0-501/8ec9ab72
deleted file mode 100644
index c54127f..0000000
Binary files a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/8ec9ab72 and /dev/null differ
diff --git a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/8ecb83bb b/.config/.cache/v24.8.0-arm64-ef5a0af0-501/8ecb83bb
deleted file mode 100644
index cad040d..0000000
Binary files a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/8ecb83bb and /dev/null differ
diff --git a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/8f21431a b/.config/.cache/v24.8.0-arm64-ef5a0af0-501/8f21431a
deleted file mode 100644
index 51839c4..0000000
Binary files a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/8f21431a and /dev/null differ
diff --git a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/8f234d82 b/.config/.cache/v24.8.0-arm64-ef5a0af0-501/8f234d82
deleted file mode 100644
index c99d7f3..0000000
Binary files a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/8f234d82 and /dev/null differ
diff --git a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/8f25dad2 b/.config/.cache/v24.8.0-arm64-ef5a0af0-501/8f25dad2
deleted file mode 100644
index 941b1d1..0000000
Binary files a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/8f25dad2 and /dev/null differ
diff --git a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/8f3d37ce b/.config/.cache/v24.8.0-arm64-ef5a0af0-501/8f3d37ce
deleted file mode 100644
index fa982f0..0000000
Binary files a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/8f3d37ce and /dev/null differ
diff --git a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/8f3f2b16 b/.config/.cache/v24.8.0-arm64-ef5a0af0-501/8f3f2b16
deleted file mode 100644
index 3debf3e..0000000
Binary files a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/8f3f2b16 and /dev/null differ
diff --git a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/8f4028ba b/.config/.cache/v24.8.0-arm64-ef5a0af0-501/8f4028ba
deleted file mode 100644
index 005f852..0000000
Binary files a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/8f4028ba and /dev/null differ
diff --git a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/8f692e93 b/.config/.cache/v24.8.0-arm64-ef5a0af0-501/8f692e93
deleted file mode 100644
index a0e9ced..0000000
Binary files a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/8f692e93 and /dev/null differ
diff --git a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/8f70c087 b/.config/.cache/v24.8.0-arm64-ef5a0af0-501/8f70c087
deleted file mode 100644
index ca4e4c9..0000000
Binary files a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/8f70c087 and /dev/null differ
diff --git a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/8f95a8d6 b/.config/.cache/v24.8.0-arm64-ef5a0af0-501/8f95a8d6
deleted file mode 100644
index 07a067f..0000000
Binary files a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/8f95a8d6 and /dev/null differ
diff --git a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/9001ea61 b/.config/.cache/v24.8.0-arm64-ef5a0af0-501/9001ea61
deleted file mode 100644
index e65dac5..0000000
Binary files a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/9001ea61 and /dev/null differ
diff --git a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/90161d45 b/.config/.cache/v24.8.0-arm64-ef5a0af0-501/90161d45
deleted file mode 100644
index 5afa5cc..0000000
Binary files a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/90161d45 and /dev/null differ
diff --git a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/9054e22f b/.config/.cache/v24.8.0-arm64-ef5a0af0-501/9054e22f
deleted file mode 100644
index f447fc0..0000000
Binary files a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/9054e22f and /dev/null differ
diff --git a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/905afa3c b/.config/.cache/v24.8.0-arm64-ef5a0af0-501/905afa3c
deleted file mode 100644
index e94ea7b..0000000
Binary files a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/905afa3c and /dev/null differ
diff --git a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/90af4181 b/.config/.cache/v24.8.0-arm64-ef5a0af0-501/90af4181
deleted file mode 100644
index 6f6d9b0..0000000
Binary files a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/90af4181 and /dev/null differ
diff --git a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/90bd4475 b/.config/.cache/v24.8.0-arm64-ef5a0af0-501/90bd4475
deleted file mode 100644
index bf90acb..0000000
Binary files a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/90bd4475 and /dev/null differ
diff --git a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/90d27f65 b/.config/.cache/v24.8.0-arm64-ef5a0af0-501/90d27f65
deleted file mode 100644
index b1e2b88..0000000
Binary files a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/90d27f65 and /dev/null differ
diff --git a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/90d31b3c b/.config/.cache/v24.8.0-arm64-ef5a0af0-501/90d31b3c
deleted file mode 100644
index 0a347b8..0000000
Binary files a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/90d31b3c and /dev/null differ
diff --git a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/90e2dc22 b/.config/.cache/v24.8.0-arm64-ef5a0af0-501/90e2dc22
deleted file mode 100644
index 7106695..0000000
Binary files a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/90e2dc22 and /dev/null differ
diff --git a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/90f8ea89 b/.config/.cache/v24.8.0-arm64-ef5a0af0-501/90f8ea89
deleted file mode 100644
index 1f8f6a3..0000000
Binary files a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/90f8ea89 and /dev/null differ
diff --git a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/9100af76 b/.config/.cache/v24.8.0-arm64-ef5a0af0-501/9100af76
deleted file mode 100644
index 7678123..0000000
Binary files a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/9100af76 and /dev/null differ
diff --git a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/91318a93 b/.config/.cache/v24.8.0-arm64-ef5a0af0-501/91318a93
deleted file mode 100644
index f62b499..0000000
Binary files a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/91318a93 and /dev/null differ
diff --git a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/914a0d8f b/.config/.cache/v24.8.0-arm64-ef5a0af0-501/914a0d8f
deleted file mode 100644
index ed88c13..0000000
Binary files a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/914a0d8f and /dev/null differ
diff --git a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/91673777 b/.config/.cache/v24.8.0-arm64-ef5a0af0-501/91673777
deleted file mode 100644
index 7aa30b0..0000000
Binary files a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/91673777 and /dev/null differ
diff --git a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/91dc94e9 b/.config/.cache/v24.8.0-arm64-ef5a0af0-501/91dc94e9
deleted file mode 100644
index de2a7df..0000000
Binary files a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/91dc94e9 and /dev/null differ
diff --git a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/9219000a b/.config/.cache/v24.8.0-arm64-ef5a0af0-501/9219000a
deleted file mode 100644
index cbbcfcf..0000000
Binary files a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/9219000a and /dev/null differ
diff --git a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/92ff1095 b/.config/.cache/v24.8.0-arm64-ef5a0af0-501/92ff1095
deleted file mode 100644
index 4dd42b1..0000000
Binary files a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/92ff1095 and /dev/null differ
diff --git a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/93879def b/.config/.cache/v24.8.0-arm64-ef5a0af0-501/93879def
deleted file mode 100644
index 7397fd8..0000000
Binary files a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/93879def and /dev/null differ
diff --git a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/938ebf59 b/.config/.cache/v24.8.0-arm64-ef5a0af0-501/938ebf59
deleted file mode 100644
index 025c4b4..0000000
Binary files a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/938ebf59 and /dev/null differ
diff --git a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/93adbe3e b/.config/.cache/v24.8.0-arm64-ef5a0af0-501/93adbe3e
deleted file mode 100644
index 0bf21b9..0000000
Binary files a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/93adbe3e and /dev/null differ
diff --git a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/93b2204e b/.config/.cache/v24.8.0-arm64-ef5a0af0-501/93b2204e
deleted file mode 100644
index e381d7b..0000000
Binary files a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/93b2204e and /dev/null differ
diff --git a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/93be8c2e b/.config/.cache/v24.8.0-arm64-ef5a0af0-501/93be8c2e
deleted file mode 100644
index 60dad4e..0000000
Binary files a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/93be8c2e and /dev/null differ
diff --git a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/94099ee8 b/.config/.cache/v24.8.0-arm64-ef5a0af0-501/94099ee8
deleted file mode 100644
index 1dfba19..0000000
Binary files a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/94099ee8 and /dev/null differ
diff --git a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/94128a1a b/.config/.cache/v24.8.0-arm64-ef5a0af0-501/94128a1a
deleted file mode 100644
index 362ede1..0000000
Binary files a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/94128a1a and /dev/null differ
diff --git a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/943768ce b/.config/.cache/v24.8.0-arm64-ef5a0af0-501/943768ce
deleted file mode 100644
index 97197f2..0000000
Binary files a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/943768ce and /dev/null differ
diff --git a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/944fc7ea b/.config/.cache/v24.8.0-arm64-ef5a0af0-501/944fc7ea
deleted file mode 100644
index 5c1f1eb..0000000
Binary files a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/944fc7ea and /dev/null differ
diff --git a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/94bcf40f b/.config/.cache/v24.8.0-arm64-ef5a0af0-501/94bcf40f
deleted file mode 100644
index fdb6245..0000000
Binary files a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/94bcf40f and /dev/null differ
diff --git a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/94d46759 b/.config/.cache/v24.8.0-arm64-ef5a0af0-501/94d46759
deleted file mode 100644
index 5e4fac6..0000000
Binary files a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/94d46759 and /dev/null differ
diff --git a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/94e1daf8 b/.config/.cache/v24.8.0-arm64-ef5a0af0-501/94e1daf8
deleted file mode 100644
index e7b2bcc..0000000
Binary files a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/94e1daf8 and /dev/null differ
diff --git a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/94f2d6de b/.config/.cache/v24.8.0-arm64-ef5a0af0-501/94f2d6de
deleted file mode 100644
index f16d765..0000000
Binary files a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/94f2d6de and /dev/null differ
diff --git a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/95072ae7 b/.config/.cache/v24.8.0-arm64-ef5a0af0-501/95072ae7
deleted file mode 100644
index f2b2ce9..0000000
Binary files a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/95072ae7 and /dev/null differ
diff --git a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/95400d1f b/.config/.cache/v24.8.0-arm64-ef5a0af0-501/95400d1f
deleted file mode 100644
index 9d7835e..0000000
Binary files a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/95400d1f and /dev/null differ
diff --git a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/957274b8 b/.config/.cache/v24.8.0-arm64-ef5a0af0-501/957274b8
deleted file mode 100644
index 942f394..0000000
Binary files a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/957274b8 and /dev/null differ
diff --git a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/957d5965 b/.config/.cache/v24.8.0-arm64-ef5a0af0-501/957d5965
deleted file mode 100644
index e842ef6..0000000
Binary files a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/957d5965 and /dev/null differ
diff --git a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/9590269e b/.config/.cache/v24.8.0-arm64-ef5a0af0-501/9590269e
deleted file mode 100644
index d834fbd..0000000
Binary files a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/9590269e and /dev/null differ
diff --git a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/95914307 b/.config/.cache/v24.8.0-arm64-ef5a0af0-501/95914307
deleted file mode 100644
index 734c649..0000000
Binary files a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/95914307 and /dev/null differ
diff --git a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/95bfd4c0 b/.config/.cache/v24.8.0-arm64-ef5a0af0-501/95bfd4c0
deleted file mode 100644
index 2a87cb7..0000000
Binary files a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/95bfd4c0 and /dev/null differ
diff --git a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/95c36137 b/.config/.cache/v24.8.0-arm64-ef5a0af0-501/95c36137
deleted file mode 100644
index fdf9760..0000000
Binary files a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/95c36137 and /dev/null differ
diff --git a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/95d25db5 b/.config/.cache/v24.8.0-arm64-ef5a0af0-501/95d25db5
deleted file mode 100644
index b1fa0f1..0000000
Binary files a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/95d25db5 and /dev/null differ
diff --git a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/95e45b29 b/.config/.cache/v24.8.0-arm64-ef5a0af0-501/95e45b29
deleted file mode 100644
index cc5575d..0000000
Binary files a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/95e45b29 and /dev/null differ
diff --git a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/95f9a703 b/.config/.cache/v24.8.0-arm64-ef5a0af0-501/95f9a703
deleted file mode 100644
index 62421ae..0000000
Binary files a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/95f9a703 and /dev/null differ
diff --git a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/96057327 b/.config/.cache/v24.8.0-arm64-ef5a0af0-501/96057327
deleted file mode 100644
index b61e809..0000000
Binary files a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/96057327 and /dev/null differ
diff --git a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/9624289e b/.config/.cache/v24.8.0-arm64-ef5a0af0-501/9624289e
deleted file mode 100644
index 24d346a..0000000
Binary files a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/9624289e and /dev/null differ
diff --git a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/9636fd64 b/.config/.cache/v24.8.0-arm64-ef5a0af0-501/9636fd64
deleted file mode 100644
index 28e6d57..0000000
Binary files a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/9636fd64 and /dev/null differ
diff --git a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/96386609 b/.config/.cache/v24.8.0-arm64-ef5a0af0-501/96386609
deleted file mode 100644
index c382b3c..0000000
Binary files a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/96386609 and /dev/null differ
diff --git a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/964ae870 b/.config/.cache/v24.8.0-arm64-ef5a0af0-501/964ae870
deleted file mode 100644
index d273dc9..0000000
Binary files a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/964ae870 and /dev/null differ
diff --git a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/967f7314 b/.config/.cache/v24.8.0-arm64-ef5a0af0-501/967f7314
deleted file mode 100644
index a7cb4ed..0000000
Binary files a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/967f7314 and /dev/null differ
diff --git a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/96c9dbf1 b/.config/.cache/v24.8.0-arm64-ef5a0af0-501/96c9dbf1
deleted file mode 100644
index eff2d04..0000000
Binary files a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/96c9dbf1 and /dev/null differ
diff --git a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/96ef615a b/.config/.cache/v24.8.0-arm64-ef5a0af0-501/96ef615a
deleted file mode 100644
index 1bbf1c2..0000000
Binary files a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/96ef615a and /dev/null differ
diff --git a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/9751f3a8 b/.config/.cache/v24.8.0-arm64-ef5a0af0-501/9751f3a8
deleted file mode 100644
index c52afe7..0000000
Binary files a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/9751f3a8 and /dev/null differ
diff --git a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/978063c9 b/.config/.cache/v24.8.0-arm64-ef5a0af0-501/978063c9
deleted file mode 100644
index f44c680..0000000
Binary files a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/978063c9 and /dev/null differ
diff --git a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/978185d3 b/.config/.cache/v24.8.0-arm64-ef5a0af0-501/978185d3
deleted file mode 100644
index 5208934..0000000
Binary files a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/978185d3 and /dev/null differ
diff --git a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/9784d253 b/.config/.cache/v24.8.0-arm64-ef5a0af0-501/9784d253
deleted file mode 100644
index 92509b5..0000000
Binary files a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/9784d253 and /dev/null differ
diff --git a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/97c2aac8 b/.config/.cache/v24.8.0-arm64-ef5a0af0-501/97c2aac8
deleted file mode 100644
index 9595e0b..0000000
Binary files a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/97c2aac8 and /dev/null differ
diff --git a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/97ca8851 b/.config/.cache/v24.8.0-arm64-ef5a0af0-501/97ca8851
deleted file mode 100644
index 2d2563d..0000000
Binary files a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/97ca8851 and /dev/null differ
diff --git a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/97eb186c b/.config/.cache/v24.8.0-arm64-ef5a0af0-501/97eb186c
deleted file mode 100644
index 7e3873b..0000000
Binary files a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/97eb186c and /dev/null differ
diff --git a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/9815308b b/.config/.cache/v24.8.0-arm64-ef5a0af0-501/9815308b
deleted file mode 100644
index c15d743..0000000
Binary files a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/9815308b and /dev/null differ
diff --git a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/982bc37a b/.config/.cache/v24.8.0-arm64-ef5a0af0-501/982bc37a
deleted file mode 100644
index 0504fb5..0000000
Binary files a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/982bc37a and /dev/null differ
diff --git a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/9856fe93 b/.config/.cache/v24.8.0-arm64-ef5a0af0-501/9856fe93
deleted file mode 100644
index 3012d9c..0000000
Binary files a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/9856fe93 and /dev/null differ
diff --git a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/98606bb0 b/.config/.cache/v24.8.0-arm64-ef5a0af0-501/98606bb0
deleted file mode 100644
index ebc8edc..0000000
Binary files a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/98606bb0 and /dev/null differ
diff --git a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/986ff549 b/.config/.cache/v24.8.0-arm64-ef5a0af0-501/986ff549
deleted file mode 100644
index 76f00d5..0000000
Binary files a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/986ff549 and /dev/null differ
diff --git a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/987dfcd3 b/.config/.cache/v24.8.0-arm64-ef5a0af0-501/987dfcd3
deleted file mode 100644
index c1fe786..0000000
Binary files a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/987dfcd3 and /dev/null differ
diff --git a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/991b76e4 b/.config/.cache/v24.8.0-arm64-ef5a0af0-501/991b76e4
deleted file mode 100644
index 7c1b07a..0000000
Binary files a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/991b76e4 and /dev/null differ
diff --git a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/992c75b2 b/.config/.cache/v24.8.0-arm64-ef5a0af0-501/992c75b2
deleted file mode 100644
index 3dc9133..0000000
Binary files a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/992c75b2 and /dev/null differ
diff --git a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/9951b8eb b/.config/.cache/v24.8.0-arm64-ef5a0af0-501/9951b8eb
deleted file mode 100644
index cd178b8..0000000
Binary files a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/9951b8eb and /dev/null differ
diff --git a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/9951f60f b/.config/.cache/v24.8.0-arm64-ef5a0af0-501/9951f60f
deleted file mode 100644
index 00c50df..0000000
Binary files a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/9951f60f and /dev/null differ
diff --git a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/997c53ce b/.config/.cache/v24.8.0-arm64-ef5a0af0-501/997c53ce
deleted file mode 100644
index 47545db..0000000
Binary files a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/997c53ce and /dev/null differ
diff --git a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/99bdcd9f b/.config/.cache/v24.8.0-arm64-ef5a0af0-501/99bdcd9f
deleted file mode 100644
index 9b38317..0000000
Binary files a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/99bdcd9f and /dev/null differ
diff --git a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/99c6b4d6 b/.config/.cache/v24.8.0-arm64-ef5a0af0-501/99c6b4d6
deleted file mode 100644
index 874adf1..0000000
Binary files a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/99c6b4d6 and /dev/null differ
diff --git a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/99c79716 b/.config/.cache/v24.8.0-arm64-ef5a0af0-501/99c79716
deleted file mode 100644
index db12b86..0000000
Binary files a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/99c79716 and /dev/null differ
diff --git a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/99e5718d b/.config/.cache/v24.8.0-arm64-ef5a0af0-501/99e5718d
deleted file mode 100644
index e8dac55..0000000
Binary files a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/99e5718d and /dev/null differ
diff --git a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/99ebd105 b/.config/.cache/v24.8.0-arm64-ef5a0af0-501/99ebd105
deleted file mode 100644
index cf81b84..0000000
Binary files a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/99ebd105 and /dev/null differ
diff --git a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/9ab9c30f b/.config/.cache/v24.8.0-arm64-ef5a0af0-501/9ab9c30f
deleted file mode 100644
index d2108da..0000000
Binary files a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/9ab9c30f and /dev/null differ
diff --git a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/9aea6ed6 b/.config/.cache/v24.8.0-arm64-ef5a0af0-501/9aea6ed6
deleted file mode 100644
index 1b7e237..0000000
Binary files a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/9aea6ed6 and /dev/null differ
diff --git a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/9aec7f64 b/.config/.cache/v24.8.0-arm64-ef5a0af0-501/9aec7f64
deleted file mode 100644
index 2718934..0000000
Binary files a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/9aec7f64 and /dev/null differ
diff --git a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/9af0ddf4 b/.config/.cache/v24.8.0-arm64-ef5a0af0-501/9af0ddf4
deleted file mode 100644
index e7c1951..0000000
Binary files a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/9af0ddf4 and /dev/null differ
diff --git a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/9b089386 b/.config/.cache/v24.8.0-arm64-ef5a0af0-501/9b089386
deleted file mode 100644
index 275fe4e..0000000
Binary files a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/9b089386 and /dev/null differ
diff --git a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/9b225ab4 b/.config/.cache/v24.8.0-arm64-ef5a0af0-501/9b225ab4
deleted file mode 100644
index c3bea67..0000000
Binary files a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/9b225ab4 and /dev/null differ
diff --git a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/9b2c20e0 b/.config/.cache/v24.8.0-arm64-ef5a0af0-501/9b2c20e0
deleted file mode 100644
index 87daad1..0000000
Binary files a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/9b2c20e0 and /dev/null differ
diff --git a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/9b911a47 b/.config/.cache/v24.8.0-arm64-ef5a0af0-501/9b911a47
deleted file mode 100644
index 1730529..0000000
Binary files a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/9b911a47 and /dev/null differ
diff --git a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/9b96952d b/.config/.cache/v24.8.0-arm64-ef5a0af0-501/9b96952d
deleted file mode 100644
index 5a0a7d3..0000000
Binary files a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/9b96952d and /dev/null differ
diff --git a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/9c2dc53b b/.config/.cache/v24.8.0-arm64-ef5a0af0-501/9c2dc53b
deleted file mode 100644
index 0eb62d6..0000000
Binary files a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/9c2dc53b and /dev/null differ
diff --git a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/9c333504 b/.config/.cache/v24.8.0-arm64-ef5a0af0-501/9c333504
deleted file mode 100644
index a1866fd..0000000
Binary files a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/9c333504 and /dev/null differ
diff --git a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/9c33855a b/.config/.cache/v24.8.0-arm64-ef5a0af0-501/9c33855a
deleted file mode 100644
index a94d034..0000000
Binary files a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/9c33855a and /dev/null differ
diff --git a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/9c53f527 b/.config/.cache/v24.8.0-arm64-ef5a0af0-501/9c53f527
deleted file mode 100644
index e9e66cd..0000000
Binary files a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/9c53f527 and /dev/null differ
diff --git a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/9cabce4f b/.config/.cache/v24.8.0-arm64-ef5a0af0-501/9cabce4f
deleted file mode 100644
index d4f9267..0000000
Binary files a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/9cabce4f and /dev/null differ
diff --git a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/9ce0dda3 b/.config/.cache/v24.8.0-arm64-ef5a0af0-501/9ce0dda3
deleted file mode 100644
index 522db64..0000000
Binary files a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/9ce0dda3 and /dev/null differ
diff --git a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/9cec5aa5 b/.config/.cache/v24.8.0-arm64-ef5a0af0-501/9cec5aa5
deleted file mode 100644
index 423693b..0000000
Binary files a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/9cec5aa5 and /dev/null differ
diff --git a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/9e2fa978 b/.config/.cache/v24.8.0-arm64-ef5a0af0-501/9e2fa978
deleted file mode 100644
index 1b9e32d..0000000
Binary files a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/9e2fa978 and /dev/null differ
diff --git a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/9e4051d3 b/.config/.cache/v24.8.0-arm64-ef5a0af0-501/9e4051d3
deleted file mode 100644
index 9e31f84..0000000
Binary files a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/9e4051d3 and /dev/null differ
diff --git a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/9ec81335 b/.config/.cache/v24.8.0-arm64-ef5a0af0-501/9ec81335
deleted file mode 100644
index d37d158..0000000
Binary files a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/9ec81335 and /dev/null differ
diff --git a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/9f1dbdfc b/.config/.cache/v24.8.0-arm64-ef5a0af0-501/9f1dbdfc
deleted file mode 100644
index 1a9b22d..0000000
Binary files a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/9f1dbdfc and /dev/null differ
diff --git a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/9fdee1a2 b/.config/.cache/v24.8.0-arm64-ef5a0af0-501/9fdee1a2
deleted file mode 100644
index 126e6c6..0000000
Binary files a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/9fdee1a2 and /dev/null differ
diff --git a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/9feba7fd b/.config/.cache/v24.8.0-arm64-ef5a0af0-501/9feba7fd
deleted file mode 100644
index 76751de..0000000
Binary files a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/9feba7fd and /dev/null differ
diff --git a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/9ff7cdba b/.config/.cache/v24.8.0-arm64-ef5a0af0-501/9ff7cdba
deleted file mode 100644
index aff3fed..0000000
Binary files a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/9ff7cdba and /dev/null differ
diff --git a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/a00f7887 b/.config/.cache/v24.8.0-arm64-ef5a0af0-501/a00f7887
deleted file mode 100644
index 930a0c5..0000000
Binary files a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/a00f7887 and /dev/null differ
diff --git a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/a03cbf79 b/.config/.cache/v24.8.0-arm64-ef5a0af0-501/a03cbf79
deleted file mode 100644
index 8b0b700..0000000
Binary files a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/a03cbf79 and /dev/null differ
diff --git a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/a0400088 b/.config/.cache/v24.8.0-arm64-ef5a0af0-501/a0400088
deleted file mode 100644
index 442b647..0000000
Binary files a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/a0400088 and /dev/null differ
diff --git a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/a054f7db b/.config/.cache/v24.8.0-arm64-ef5a0af0-501/a054f7db
deleted file mode 100644
index c0589b7..0000000
Binary files a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/a054f7db and /dev/null differ
diff --git a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/a06705a7 b/.config/.cache/v24.8.0-arm64-ef5a0af0-501/a06705a7
deleted file mode 100644
index 3c862ea..0000000
Binary files a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/a06705a7 and /dev/null differ
diff --git a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/a0a45291 b/.config/.cache/v24.8.0-arm64-ef5a0af0-501/a0a45291
deleted file mode 100644
index 0d7f029..0000000
Binary files a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/a0a45291 and /dev/null differ
diff --git a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/a0b4f3bb b/.config/.cache/v24.8.0-arm64-ef5a0af0-501/a0b4f3bb
deleted file mode 100644
index cce27f3..0000000
Binary files a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/a0b4f3bb and /dev/null differ
diff --git a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/a0c67e8c b/.config/.cache/v24.8.0-arm64-ef5a0af0-501/a0c67e8c
deleted file mode 100644
index 50dc056..0000000
Binary files a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/a0c67e8c and /dev/null differ
diff --git a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/a0d0a9cd b/.config/.cache/v24.8.0-arm64-ef5a0af0-501/a0d0a9cd
deleted file mode 100644
index 890e0c2..0000000
Binary files a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/a0d0a9cd and /dev/null differ
diff --git a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/a13cefc2 b/.config/.cache/v24.8.0-arm64-ef5a0af0-501/a13cefc2
deleted file mode 100644
index c26f0bf..0000000
Binary files a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/a13cefc2 and /dev/null differ
diff --git a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/a145437f b/.config/.cache/v24.8.0-arm64-ef5a0af0-501/a145437f
deleted file mode 100644
index 8355463..0000000
Binary files a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/a145437f and /dev/null differ
diff --git a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/a15c7dd9 b/.config/.cache/v24.8.0-arm64-ef5a0af0-501/a15c7dd9
deleted file mode 100644
index 6c47550..0000000
Binary files a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/a15c7dd9 and /dev/null differ
diff --git a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/a1a20c36 b/.config/.cache/v24.8.0-arm64-ef5a0af0-501/a1a20c36
deleted file mode 100644
index 09e5398..0000000
Binary files a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/a1a20c36 and /dev/null differ
diff --git a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/a1b62871 b/.config/.cache/v24.8.0-arm64-ef5a0af0-501/a1b62871
deleted file mode 100644
index 8487477..0000000
Binary files a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/a1b62871 and /dev/null differ
diff --git a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/a1e13361 b/.config/.cache/v24.8.0-arm64-ef5a0af0-501/a1e13361
deleted file mode 100644
index 3b2d481..0000000
Binary files a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/a1e13361 and /dev/null differ
diff --git a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/a2ad0434 b/.config/.cache/v24.8.0-arm64-ef5a0af0-501/a2ad0434
deleted file mode 100644
index b0078b0..0000000
Binary files a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/a2ad0434 and /dev/null differ
diff --git a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/a2c5d249 b/.config/.cache/v24.8.0-arm64-ef5a0af0-501/a2c5d249
deleted file mode 100644
index 410ee35..0000000
Binary files a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/a2c5d249 and /dev/null differ
diff --git a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/a3151b77 b/.config/.cache/v24.8.0-arm64-ef5a0af0-501/a3151b77
deleted file mode 100644
index 8d87c67..0000000
Binary files a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/a3151b77 and /dev/null differ
diff --git a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/a32e5fce b/.config/.cache/v24.8.0-arm64-ef5a0af0-501/a32e5fce
deleted file mode 100644
index 27708dc..0000000
Binary files a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/a32e5fce and /dev/null differ
diff --git a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/a330c6a6 b/.config/.cache/v24.8.0-arm64-ef5a0af0-501/a330c6a6
deleted file mode 100644
index a446a82..0000000
Binary files a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/a330c6a6 and /dev/null differ
diff --git a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/a33b67e1 b/.config/.cache/v24.8.0-arm64-ef5a0af0-501/a33b67e1
deleted file mode 100644
index a9baa0b..0000000
Binary files a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/a33b67e1 and /dev/null differ
diff --git a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/a348ae66 b/.config/.cache/v24.8.0-arm64-ef5a0af0-501/a348ae66
deleted file mode 100644
index 77617d5..0000000
Binary files a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/a348ae66 and /dev/null differ
diff --git a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/a396b633 b/.config/.cache/v24.8.0-arm64-ef5a0af0-501/a396b633
deleted file mode 100644
index 3be7e62..0000000
Binary files a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/a396b633 and /dev/null differ
diff --git a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/a49aed16 b/.config/.cache/v24.8.0-arm64-ef5a0af0-501/a49aed16
deleted file mode 100644
index 83ca2c6..0000000
Binary files a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/a49aed16 and /dev/null differ
diff --git a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/a4f31e17 b/.config/.cache/v24.8.0-arm64-ef5a0af0-501/a4f31e17
deleted file mode 100644
index b4b88dd..0000000
Binary files a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/a4f31e17 and /dev/null differ
diff --git a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/a4f3d1cb b/.config/.cache/v24.8.0-arm64-ef5a0af0-501/a4f3d1cb
deleted file mode 100644
index ec59bf1..0000000
Binary files a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/a4f3d1cb and /dev/null differ
diff --git a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/a534e348 b/.config/.cache/v24.8.0-arm64-ef5a0af0-501/a534e348
deleted file mode 100644
index e55596e..0000000
Binary files a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/a534e348 and /dev/null differ
diff --git a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/a5d75dbf b/.config/.cache/v24.8.0-arm64-ef5a0af0-501/a5d75dbf
deleted file mode 100644
index ca20213..0000000
Binary files a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/a5d75dbf and /dev/null differ
diff --git a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/a6484722 b/.config/.cache/v24.8.0-arm64-ef5a0af0-501/a6484722
deleted file mode 100644
index a6333b5..0000000
Binary files a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/a6484722 and /dev/null differ
diff --git a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/a675d845 b/.config/.cache/v24.8.0-arm64-ef5a0af0-501/a675d845
deleted file mode 100644
index 9722048..0000000
Binary files a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/a675d845 and /dev/null differ
diff --git a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/a69c5858 b/.config/.cache/v24.8.0-arm64-ef5a0af0-501/a69c5858
deleted file mode 100644
index 511ed3d..0000000
Binary files a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/a69c5858 and /dev/null differ
diff --git a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/a6d2e1ed b/.config/.cache/v24.8.0-arm64-ef5a0af0-501/a6d2e1ed
deleted file mode 100644
index 8b817a7..0000000
Binary files a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/a6d2e1ed and /dev/null differ
diff --git a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/a6ff38b6 b/.config/.cache/v24.8.0-arm64-ef5a0af0-501/a6ff38b6
deleted file mode 100644
index 7f45d2d..0000000
Binary files a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/a6ff38b6 and /dev/null differ
diff --git a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/a72aa19c b/.config/.cache/v24.8.0-arm64-ef5a0af0-501/a72aa19c
deleted file mode 100644
index 8df84fb..0000000
Binary files a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/a72aa19c and /dev/null differ
diff --git a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/a7b2fdf5 b/.config/.cache/v24.8.0-arm64-ef5a0af0-501/a7b2fdf5
deleted file mode 100644
index 9e78159..0000000
Binary files a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/a7b2fdf5 and /dev/null differ
diff --git a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/a7e671a2 b/.config/.cache/v24.8.0-arm64-ef5a0af0-501/a7e671a2
deleted file mode 100644
index 6727ba8..0000000
Binary files a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/a7e671a2 and /dev/null differ
diff --git a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/a8072472 b/.config/.cache/v24.8.0-arm64-ef5a0af0-501/a8072472
deleted file mode 100644
index 27ffd56..0000000
Binary files a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/a8072472 and /dev/null differ
diff --git a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/a82ad386 b/.config/.cache/v24.8.0-arm64-ef5a0af0-501/a82ad386
deleted file mode 100644
index cfb0303..0000000
Binary files a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/a82ad386 and /dev/null differ
diff --git a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/a8550558 b/.config/.cache/v24.8.0-arm64-ef5a0af0-501/a8550558
deleted file mode 100644
index dda3c50..0000000
Binary files a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/a8550558 and /dev/null differ
diff --git a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/a8659e0c b/.config/.cache/v24.8.0-arm64-ef5a0af0-501/a8659e0c
deleted file mode 100644
index b41bf61..0000000
Binary files a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/a8659e0c and /dev/null differ
diff --git a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/a870340d b/.config/.cache/v24.8.0-arm64-ef5a0af0-501/a870340d
deleted file mode 100644
index 699cd65..0000000
Binary files a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/a870340d and /dev/null differ
diff --git a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/a889f1cc b/.config/.cache/v24.8.0-arm64-ef5a0af0-501/a889f1cc
deleted file mode 100644
index c0e4df4..0000000
Binary files a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/a889f1cc and /dev/null differ
diff --git a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/a892691b b/.config/.cache/v24.8.0-arm64-ef5a0af0-501/a892691b
deleted file mode 100644
index 5b1ea4f..0000000
Binary files a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/a892691b and /dev/null differ
diff --git a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/a89511c9 b/.config/.cache/v24.8.0-arm64-ef5a0af0-501/a89511c9
deleted file mode 100644
index 6fd7c3b..0000000
Binary files a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/a89511c9 and /dev/null differ
diff --git a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/a8b4fc68 b/.config/.cache/v24.8.0-arm64-ef5a0af0-501/a8b4fc68
deleted file mode 100644
index 21e6809..0000000
Binary files a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/a8b4fc68 and /dev/null differ
diff --git a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/a8f15a56 b/.config/.cache/v24.8.0-arm64-ef5a0af0-501/a8f15a56
deleted file mode 100644
index 5950e65..0000000
Binary files a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/a8f15a56 and /dev/null differ
diff --git a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/a8faa3ac b/.config/.cache/v24.8.0-arm64-ef5a0af0-501/a8faa3ac
deleted file mode 100644
index a9fd779..0000000
Binary files a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/a8faa3ac and /dev/null differ
diff --git a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/a90181a7 b/.config/.cache/v24.8.0-arm64-ef5a0af0-501/a90181a7
deleted file mode 100644
index 4117d70..0000000
Binary files a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/a90181a7 and /dev/null differ
diff --git a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/a9098664 b/.config/.cache/v24.8.0-arm64-ef5a0af0-501/a9098664
deleted file mode 100644
index 99d284f..0000000
Binary files a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/a9098664 and /dev/null differ
diff --git a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/a909d83b b/.config/.cache/v24.8.0-arm64-ef5a0af0-501/a909d83b
deleted file mode 100644
index 5ebb971..0000000
Binary files a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/a909d83b and /dev/null differ
diff --git a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/a94e9d1c b/.config/.cache/v24.8.0-arm64-ef5a0af0-501/a94e9d1c
deleted file mode 100644
index 6aa279c..0000000
Binary files a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/a94e9d1c and /dev/null differ
diff --git a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/a953c2ec b/.config/.cache/v24.8.0-arm64-ef5a0af0-501/a953c2ec
deleted file mode 100644
index 05d6bb0..0000000
Binary files a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/a953c2ec and /dev/null differ
diff --git a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/a9802fde b/.config/.cache/v24.8.0-arm64-ef5a0af0-501/a9802fde
deleted file mode 100644
index 6dcc660..0000000
Binary files a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/a9802fde and /dev/null differ
diff --git a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/a99a9ff9 b/.config/.cache/v24.8.0-arm64-ef5a0af0-501/a99a9ff9
deleted file mode 100644
index cf44c3e..0000000
Binary files a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/a99a9ff9 and /dev/null differ
diff --git a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/a99f21da b/.config/.cache/v24.8.0-arm64-ef5a0af0-501/a99f21da
deleted file mode 100644
index 3c7ed04..0000000
Binary files a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/a99f21da and /dev/null differ
diff --git a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/a9bdfb71 b/.config/.cache/v24.8.0-arm64-ef5a0af0-501/a9bdfb71
deleted file mode 100644
index c3afeb0..0000000
Binary files a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/a9bdfb71 and /dev/null differ
diff --git a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/a9d6bbd2 b/.config/.cache/v24.8.0-arm64-ef5a0af0-501/a9d6bbd2
deleted file mode 100644
index c110041..0000000
Binary files a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/a9d6bbd2 and /dev/null differ
diff --git a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/a9ed420c b/.config/.cache/v24.8.0-arm64-ef5a0af0-501/a9ed420c
deleted file mode 100644
index ae45a93..0000000
Binary files a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/a9ed420c and /dev/null differ
diff --git a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/aa2550c1 b/.config/.cache/v24.8.0-arm64-ef5a0af0-501/aa2550c1
deleted file mode 100644
index 2c14a1d..0000000
Binary files a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/aa2550c1 and /dev/null differ
diff --git a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/aa4f8e3c b/.config/.cache/v24.8.0-arm64-ef5a0af0-501/aa4f8e3c
deleted file mode 100644
index 482f373..0000000
Binary files a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/aa4f8e3c and /dev/null differ
diff --git a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/aa6cdfef b/.config/.cache/v24.8.0-arm64-ef5a0af0-501/aa6cdfef
deleted file mode 100644
index e244cdb..0000000
Binary files a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/aa6cdfef and /dev/null differ
diff --git a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/aaadebbd b/.config/.cache/v24.8.0-arm64-ef5a0af0-501/aaadebbd
deleted file mode 100644
index 84b889d..0000000
Binary files a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/aaadebbd and /dev/null differ
diff --git a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/abc284ea b/.config/.cache/v24.8.0-arm64-ef5a0af0-501/abc284ea
deleted file mode 100644
index 5e9a307..0000000
Binary files a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/abc284ea and /dev/null differ
diff --git a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/abd0eb6f b/.config/.cache/v24.8.0-arm64-ef5a0af0-501/abd0eb6f
deleted file mode 100644
index ab3520e..0000000
Binary files a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/abd0eb6f and /dev/null differ
diff --git a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/abf30681 b/.config/.cache/v24.8.0-arm64-ef5a0af0-501/abf30681
deleted file mode 100644
index 76bfdcb..0000000
Binary files a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/abf30681 and /dev/null differ
diff --git a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/ac1dc43d b/.config/.cache/v24.8.0-arm64-ef5a0af0-501/ac1dc43d
deleted file mode 100644
index 63f7030..0000000
Binary files a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/ac1dc43d and /dev/null differ
diff --git a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/ac50da7c b/.config/.cache/v24.8.0-arm64-ef5a0af0-501/ac50da7c
deleted file mode 100644
index 0f44f14..0000000
Binary files a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/ac50da7c and /dev/null differ
diff --git a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/ac6575fa b/.config/.cache/v24.8.0-arm64-ef5a0af0-501/ac6575fa
deleted file mode 100644
index ca3eb5b..0000000
Binary files a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/ac6575fa and /dev/null differ
diff --git a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/ac8fd782 b/.config/.cache/v24.8.0-arm64-ef5a0af0-501/ac8fd782
deleted file mode 100644
index 846d321..0000000
Binary files a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/ac8fd782 and /dev/null differ
diff --git a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/acac58dc b/.config/.cache/v24.8.0-arm64-ef5a0af0-501/acac58dc
deleted file mode 100644
index a7a45c6..0000000
Binary files a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/acac58dc and /dev/null differ
diff --git a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/accf75e4 b/.config/.cache/v24.8.0-arm64-ef5a0af0-501/accf75e4
deleted file mode 100644
index 92821b5..0000000
Binary files a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/accf75e4 and /dev/null differ
diff --git a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/acdcecaf b/.config/.cache/v24.8.0-arm64-ef5a0af0-501/acdcecaf
deleted file mode 100644
index e408af1..0000000
Binary files a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/acdcecaf and /dev/null differ
diff --git a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/ad47ac7c b/.config/.cache/v24.8.0-arm64-ef5a0af0-501/ad47ac7c
deleted file mode 100644
index c1c0714..0000000
Binary files a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/ad47ac7c and /dev/null differ
diff --git a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/ad99b247 b/.config/.cache/v24.8.0-arm64-ef5a0af0-501/ad99b247
deleted file mode 100644
index d34563a..0000000
Binary files a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/ad99b247 and /dev/null differ
diff --git a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/ada941d3 b/.config/.cache/v24.8.0-arm64-ef5a0af0-501/ada941d3
deleted file mode 100644
index 2702413..0000000
Binary files a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/ada941d3 and /dev/null differ
diff --git a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/ada94401 b/.config/.cache/v24.8.0-arm64-ef5a0af0-501/ada94401
deleted file mode 100644
index 31c5567..0000000
Binary files a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/ada94401 and /dev/null differ
diff --git a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/ae085cba b/.config/.cache/v24.8.0-arm64-ef5a0af0-501/ae085cba
deleted file mode 100644
index 6d3561f..0000000
Binary files a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/ae085cba and /dev/null differ
diff --git a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/ae0b7808 b/.config/.cache/v24.8.0-arm64-ef5a0af0-501/ae0b7808
deleted file mode 100644
index 3cfe129..0000000
Binary files a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/ae0b7808 and /dev/null differ
diff --git a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/ae132666 b/.config/.cache/v24.8.0-arm64-ef5a0af0-501/ae132666
deleted file mode 100644
index 4afad9d..0000000
Binary files a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/ae132666 and /dev/null differ
diff --git a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/ae83fbba b/.config/.cache/v24.8.0-arm64-ef5a0af0-501/ae83fbba
deleted file mode 100644
index 1311a22..0000000
Binary files a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/ae83fbba and /dev/null differ
diff --git a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/ae87b159 b/.config/.cache/v24.8.0-arm64-ef5a0af0-501/ae87b159
deleted file mode 100644
index 98d19ad..0000000
Binary files a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/ae87b159 and /dev/null differ
diff --git a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/aebb6e97 b/.config/.cache/v24.8.0-arm64-ef5a0af0-501/aebb6e97
deleted file mode 100644
index 5e3a2ef..0000000
Binary files a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/aebb6e97 and /dev/null differ
diff --git a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/af088e79 b/.config/.cache/v24.8.0-arm64-ef5a0af0-501/af088e79
deleted file mode 100644
index 6413bb4..0000000
Binary files a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/af088e79 and /dev/null differ
diff --git a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/af231ae4 b/.config/.cache/v24.8.0-arm64-ef5a0af0-501/af231ae4
deleted file mode 100644
index 4acd069..0000000
Binary files a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/af231ae4 and /dev/null differ
diff --git a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/af9d7146 b/.config/.cache/v24.8.0-arm64-ef5a0af0-501/af9d7146
deleted file mode 100644
index cac4dc3..0000000
Binary files a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/af9d7146 and /dev/null differ
diff --git a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/afa5cdb3 b/.config/.cache/v24.8.0-arm64-ef5a0af0-501/afa5cdb3
deleted file mode 100644
index 2dad7be..0000000
Binary files a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/afa5cdb3 and /dev/null differ
diff --git a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/afddb3d3 b/.config/.cache/v24.8.0-arm64-ef5a0af0-501/afddb3d3
deleted file mode 100644
index 1323399..0000000
Binary files a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/afddb3d3 and /dev/null differ
diff --git a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/afe62cf4 b/.config/.cache/v24.8.0-arm64-ef5a0af0-501/afe62cf4
deleted file mode 100644
index 4c53ede..0000000
Binary files a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/afe62cf4 and /dev/null differ
diff --git a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/afea097c b/.config/.cache/v24.8.0-arm64-ef5a0af0-501/afea097c
deleted file mode 100644
index fdfeb24..0000000
Binary files a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/afea097c and /dev/null differ
diff --git a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/b004393e b/.config/.cache/v24.8.0-arm64-ef5a0af0-501/b004393e
deleted file mode 100644
index c880a26..0000000
Binary files a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/b004393e and /dev/null differ
diff --git a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/b03af545 b/.config/.cache/v24.8.0-arm64-ef5a0af0-501/b03af545
deleted file mode 100644
index e83223b..0000000
Binary files a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/b03af545 and /dev/null differ
diff --git a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/b05989b2 b/.config/.cache/v24.8.0-arm64-ef5a0af0-501/b05989b2
deleted file mode 100644
index 4a97770..0000000
Binary files a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/b05989b2 and /dev/null differ
diff --git a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/b06ab843 b/.config/.cache/v24.8.0-arm64-ef5a0af0-501/b06ab843
deleted file mode 100644
index fec05df..0000000
Binary files a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/b06ab843 and /dev/null differ
diff --git a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/b07aab77 b/.config/.cache/v24.8.0-arm64-ef5a0af0-501/b07aab77
deleted file mode 100644
index db972c8..0000000
Binary files a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/b07aab77 and /dev/null differ
diff --git a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/b0836d0f b/.config/.cache/v24.8.0-arm64-ef5a0af0-501/b0836d0f
deleted file mode 100644
index b20b805..0000000
Binary files a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/b0836d0f and /dev/null differ
diff --git a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/b0a5ab8e b/.config/.cache/v24.8.0-arm64-ef5a0af0-501/b0a5ab8e
deleted file mode 100644
index 2b7fee3..0000000
Binary files a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/b0a5ab8e and /dev/null differ
diff --git a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/b0b6c3d0 b/.config/.cache/v24.8.0-arm64-ef5a0af0-501/b0b6c3d0
deleted file mode 100644
index 9bfd452..0000000
Binary files a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/b0b6c3d0 and /dev/null differ
diff --git a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/b0cbd949 b/.config/.cache/v24.8.0-arm64-ef5a0af0-501/b0cbd949
deleted file mode 100644
index 2eb0f5a..0000000
Binary files a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/b0cbd949 and /dev/null differ
diff --git a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/b1012007 b/.config/.cache/v24.8.0-arm64-ef5a0af0-501/b1012007
deleted file mode 100644
index 630bbf7..0000000
Binary files a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/b1012007 and /dev/null differ
diff --git a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/b12e6b28 b/.config/.cache/v24.8.0-arm64-ef5a0af0-501/b12e6b28
deleted file mode 100644
index d7c00c5..0000000
Binary files a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/b12e6b28 and /dev/null differ
diff --git a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/b15f8a23 b/.config/.cache/v24.8.0-arm64-ef5a0af0-501/b15f8a23
deleted file mode 100644
index 5aaf37d..0000000
Binary files a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/b15f8a23 and /dev/null differ
diff --git a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/b163fbca b/.config/.cache/v24.8.0-arm64-ef5a0af0-501/b163fbca
deleted file mode 100644
index 0db625d..0000000
Binary files a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/b163fbca and /dev/null differ
diff --git a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/b176ba7d b/.config/.cache/v24.8.0-arm64-ef5a0af0-501/b176ba7d
deleted file mode 100644
index 9b41d60..0000000
Binary files a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/b176ba7d and /dev/null differ
diff --git a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/b1973814 b/.config/.cache/v24.8.0-arm64-ef5a0af0-501/b1973814
deleted file mode 100644
index f285d25..0000000
Binary files a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/b1973814 and /dev/null differ
diff --git a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/b1e20f54 b/.config/.cache/v24.8.0-arm64-ef5a0af0-501/b1e20f54
deleted file mode 100644
index d0bad4d..0000000
Binary files a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/b1e20f54 and /dev/null differ
diff --git a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/b20f0689 b/.config/.cache/v24.8.0-arm64-ef5a0af0-501/b20f0689
deleted file mode 100644
index b3ee6ee..0000000
Binary files a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/b20f0689 and /dev/null differ
diff --git a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/b2475fe9 b/.config/.cache/v24.8.0-arm64-ef5a0af0-501/b2475fe9
deleted file mode 100644
index 0087e41..0000000
Binary files a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/b2475fe9 and /dev/null differ
diff --git a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/b2a9e7bc b/.config/.cache/v24.8.0-arm64-ef5a0af0-501/b2a9e7bc
deleted file mode 100644
index f1e0b35..0000000
Binary files a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/b2a9e7bc and /dev/null differ
diff --git a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/b2e78577 b/.config/.cache/v24.8.0-arm64-ef5a0af0-501/b2e78577
deleted file mode 100644
index 494d7c1..0000000
Binary files a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/b2e78577 and /dev/null differ
diff --git a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/b31f16d2 b/.config/.cache/v24.8.0-arm64-ef5a0af0-501/b31f16d2
deleted file mode 100644
index 545c694..0000000
Binary files a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/b31f16d2 and /dev/null differ
diff --git a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/b33d439d b/.config/.cache/v24.8.0-arm64-ef5a0af0-501/b33d439d
deleted file mode 100644
index 94c8155..0000000
Binary files a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/b33d439d and /dev/null differ
diff --git a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/b4612ee1 b/.config/.cache/v24.8.0-arm64-ef5a0af0-501/b4612ee1
deleted file mode 100644
index 12c6ad1..0000000
Binary files a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/b4612ee1 and /dev/null differ
diff --git a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/b4babcc9 b/.config/.cache/v24.8.0-arm64-ef5a0af0-501/b4babcc9
deleted file mode 100644
index ca0dc58..0000000
Binary files a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/b4babcc9 and /dev/null differ
diff --git a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/b4e77528 b/.config/.cache/v24.8.0-arm64-ef5a0af0-501/b4e77528
deleted file mode 100644
index cf62c02..0000000
Binary files a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/b4e77528 and /dev/null differ
diff --git a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/b52648d0 b/.config/.cache/v24.8.0-arm64-ef5a0af0-501/b52648d0
deleted file mode 100644
index 172b376..0000000
Binary files a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/b52648d0 and /dev/null differ
diff --git a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/b546089d b/.config/.cache/v24.8.0-arm64-ef5a0af0-501/b546089d
deleted file mode 100644
index 7af661e..0000000
Binary files a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/b546089d and /dev/null differ
diff --git a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/b56d9e75 b/.config/.cache/v24.8.0-arm64-ef5a0af0-501/b56d9e75
deleted file mode 100644
index aaa4a78..0000000
Binary files a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/b56d9e75 and /dev/null differ
diff --git a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/b59403cc b/.config/.cache/v24.8.0-arm64-ef5a0af0-501/b59403cc
deleted file mode 100644
index bc4b4cd..0000000
Binary files a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/b59403cc and /dev/null differ
diff --git a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/b5997266 b/.config/.cache/v24.8.0-arm64-ef5a0af0-501/b5997266
deleted file mode 100644
index 21eceb2..0000000
Binary files a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/b5997266 and /dev/null differ
diff --git a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/b5c3a5c8 b/.config/.cache/v24.8.0-arm64-ef5a0af0-501/b5c3a5c8
deleted file mode 100644
index 8cbe47c..0000000
Binary files a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/b5c3a5c8 and /dev/null differ
diff --git a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/b6792ef2 b/.config/.cache/v24.8.0-arm64-ef5a0af0-501/b6792ef2
deleted file mode 100644
index f19d105..0000000
Binary files a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/b6792ef2 and /dev/null differ
diff --git a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/b69d3af8 b/.config/.cache/v24.8.0-arm64-ef5a0af0-501/b69d3af8
deleted file mode 100644
index 9b56be2..0000000
Binary files a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/b69d3af8 and /dev/null differ
diff --git a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/b6a25258 b/.config/.cache/v24.8.0-arm64-ef5a0af0-501/b6a25258
deleted file mode 100644
index b0f4248..0000000
Binary files a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/b6a25258 and /dev/null differ
diff --git a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/b6c634b8 b/.config/.cache/v24.8.0-arm64-ef5a0af0-501/b6c634b8
deleted file mode 100644
index 2b52842..0000000
Binary files a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/b6c634b8 and /dev/null differ
diff --git a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/b6c9cb54 b/.config/.cache/v24.8.0-arm64-ef5a0af0-501/b6c9cb54
deleted file mode 100644
index cf873d9..0000000
Binary files a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/b6c9cb54 and /dev/null differ
diff --git a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/b6cb1d38 b/.config/.cache/v24.8.0-arm64-ef5a0af0-501/b6cb1d38
deleted file mode 100644
index f4a32fc..0000000
Binary files a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/b6cb1d38 and /dev/null differ
diff --git a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/b70fb712 b/.config/.cache/v24.8.0-arm64-ef5a0af0-501/b70fb712
deleted file mode 100644
index d139042..0000000
Binary files a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/b70fb712 and /dev/null differ
diff --git a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/b73d4dd4 b/.config/.cache/v24.8.0-arm64-ef5a0af0-501/b73d4dd4
deleted file mode 100644
index b7a03de..0000000
Binary files a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/b73d4dd4 and /dev/null differ
diff --git a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/b7407fa5 b/.config/.cache/v24.8.0-arm64-ef5a0af0-501/b7407fa5
deleted file mode 100644
index 37c7797..0000000
Binary files a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/b7407fa5 and /dev/null differ
diff --git a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/b76f7ef4 b/.config/.cache/v24.8.0-arm64-ef5a0af0-501/b76f7ef4
deleted file mode 100644
index 9483238..0000000
Binary files a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/b76f7ef4 and /dev/null differ
diff --git a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/b7731982 b/.config/.cache/v24.8.0-arm64-ef5a0af0-501/b7731982
deleted file mode 100644
index e89b1bb..0000000
Binary files a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/b7731982 and /dev/null differ
diff --git a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/b7ddfc2c b/.config/.cache/v24.8.0-arm64-ef5a0af0-501/b7ddfc2c
deleted file mode 100644
index 2c5e2c6..0000000
Binary files a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/b7ddfc2c and /dev/null differ
diff --git a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/b7df3889 b/.config/.cache/v24.8.0-arm64-ef5a0af0-501/b7df3889
deleted file mode 100644
index b9f3d30..0000000
Binary files a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/b7df3889 and /dev/null differ
diff --git a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/b826b016 b/.config/.cache/v24.8.0-arm64-ef5a0af0-501/b826b016
deleted file mode 100644
index 232daa3..0000000
Binary files a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/b826b016 and /dev/null differ
diff --git a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/b84c0999 b/.config/.cache/v24.8.0-arm64-ef5a0af0-501/b84c0999
deleted file mode 100644
index 7422982..0000000
Binary files a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/b84c0999 and /dev/null differ
diff --git a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/b8c61edf b/.config/.cache/v24.8.0-arm64-ef5a0af0-501/b8c61edf
deleted file mode 100644
index b2ee94d..0000000
Binary files a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/b8c61edf and /dev/null differ
diff --git a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/b90cd478 b/.config/.cache/v24.8.0-arm64-ef5a0af0-501/b90cd478
deleted file mode 100644
index b068f30..0000000
Binary files a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/b90cd478 and /dev/null differ
diff --git a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/b95dde71 b/.config/.cache/v24.8.0-arm64-ef5a0af0-501/b95dde71
deleted file mode 100644
index ae3ee20..0000000
Binary files a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/b95dde71 and /dev/null differ
diff --git a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/b9889aef b/.config/.cache/v24.8.0-arm64-ef5a0af0-501/b9889aef
deleted file mode 100644
index 2831a26..0000000
Binary files a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/b9889aef and /dev/null differ
diff --git a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/b98c8d4f b/.config/.cache/v24.8.0-arm64-ef5a0af0-501/b98c8d4f
deleted file mode 100644
index b6aea38..0000000
Binary files a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/b98c8d4f and /dev/null differ
diff --git a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/b997bfa1 b/.config/.cache/v24.8.0-arm64-ef5a0af0-501/b997bfa1
deleted file mode 100644
index ba429aa..0000000
Binary files a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/b997bfa1 and /dev/null differ
diff --git a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/b9c3bf7e b/.config/.cache/v24.8.0-arm64-ef5a0af0-501/b9c3bf7e
deleted file mode 100644
index 0c6067d..0000000
Binary files a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/b9c3bf7e and /dev/null differ
diff --git a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/b9c63d27 b/.config/.cache/v24.8.0-arm64-ef5a0af0-501/b9c63d27
deleted file mode 100644
index 9592c2e..0000000
Binary files a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/b9c63d27 and /dev/null differ
diff --git a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/b9dbbc3e b/.config/.cache/v24.8.0-arm64-ef5a0af0-501/b9dbbc3e
deleted file mode 100644
index 05a466d..0000000
Binary files a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/b9dbbc3e and /dev/null differ
diff --git a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/ba54b6fb b/.config/.cache/v24.8.0-arm64-ef5a0af0-501/ba54b6fb
deleted file mode 100644
index 3f78898..0000000
Binary files a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/ba54b6fb and /dev/null differ
diff --git a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/ba879da7 b/.config/.cache/v24.8.0-arm64-ef5a0af0-501/ba879da7
deleted file mode 100644
index 98a75bf..0000000
Binary files a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/ba879da7 and /dev/null differ
diff --git a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/bac01297 b/.config/.cache/v24.8.0-arm64-ef5a0af0-501/bac01297
deleted file mode 100644
index 8c3d00e..0000000
Binary files a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/bac01297 and /dev/null differ
diff --git a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/bacc3156 b/.config/.cache/v24.8.0-arm64-ef5a0af0-501/bacc3156
deleted file mode 100644
index b7c2a74..0000000
Binary files a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/bacc3156 and /dev/null differ
diff --git a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/bb341454 b/.config/.cache/v24.8.0-arm64-ef5a0af0-501/bb341454
deleted file mode 100644
index 2990dcb..0000000
Binary files a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/bb341454 and /dev/null differ
diff --git a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/bb444d84 b/.config/.cache/v24.8.0-arm64-ef5a0af0-501/bb444d84
deleted file mode 100644
index f6c4f67..0000000
Binary files a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/bb444d84 and /dev/null differ
diff --git a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/bb4639e2 b/.config/.cache/v24.8.0-arm64-ef5a0af0-501/bb4639e2
deleted file mode 100644
index 0648728..0000000
Binary files a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/bb4639e2 and /dev/null differ
diff --git a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/bb6ad555 b/.config/.cache/v24.8.0-arm64-ef5a0af0-501/bb6ad555
deleted file mode 100644
index d4bd649..0000000
Binary files a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/bb6ad555 and /dev/null differ
diff --git a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/bbad45f5 b/.config/.cache/v24.8.0-arm64-ef5a0af0-501/bbad45f5
deleted file mode 100644
index 9595e04..0000000
Binary files a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/bbad45f5 and /dev/null differ
diff --git a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/bbb03edf b/.config/.cache/v24.8.0-arm64-ef5a0af0-501/bbb03edf
deleted file mode 100644
index 2860ec8..0000000
Binary files a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/bbb03edf and /dev/null differ
diff --git a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/bbc62e9a b/.config/.cache/v24.8.0-arm64-ef5a0af0-501/bbc62e9a
deleted file mode 100644
index d477c50..0000000
Binary files a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/bbc62e9a and /dev/null differ
diff --git a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/bbe5fc4c b/.config/.cache/v24.8.0-arm64-ef5a0af0-501/bbe5fc4c
deleted file mode 100644
index f042d39..0000000
Binary files a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/bbe5fc4c and /dev/null differ
diff --git a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/bc056728 b/.config/.cache/v24.8.0-arm64-ef5a0af0-501/bc056728
deleted file mode 100644
index de34627..0000000
Binary files a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/bc056728 and /dev/null differ
diff --git a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/bc6800b4 b/.config/.cache/v24.8.0-arm64-ef5a0af0-501/bc6800b4
deleted file mode 100644
index 4dbadf1..0000000
Binary files a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/bc6800b4 and /dev/null differ
diff --git a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/bc6f3ce8 b/.config/.cache/v24.8.0-arm64-ef5a0af0-501/bc6f3ce8
deleted file mode 100644
index 7042958..0000000
Binary files a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/bc6f3ce8 and /dev/null differ
diff --git a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/bc84ef6c b/.config/.cache/v24.8.0-arm64-ef5a0af0-501/bc84ef6c
deleted file mode 100644
index b910d48..0000000
Binary files a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/bc84ef6c and /dev/null differ
diff --git a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/bca7dabc b/.config/.cache/v24.8.0-arm64-ef5a0af0-501/bca7dabc
deleted file mode 100644
index 3b3263f..0000000
Binary files a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/bca7dabc and /dev/null differ
diff --git a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/bcbb3771 b/.config/.cache/v24.8.0-arm64-ef5a0af0-501/bcbb3771
deleted file mode 100644
index 15df48e..0000000
Binary files a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/bcbb3771 and /dev/null differ
diff --git a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/bccec9d0 b/.config/.cache/v24.8.0-arm64-ef5a0af0-501/bccec9d0
deleted file mode 100644
index 03d7bfe..0000000
Binary files a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/bccec9d0 and /dev/null differ
diff --git a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/bcf14229 b/.config/.cache/v24.8.0-arm64-ef5a0af0-501/bcf14229
deleted file mode 100644
index a1d4890..0000000
Binary files a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/bcf14229 and /dev/null differ
diff --git a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/bd0005cc b/.config/.cache/v24.8.0-arm64-ef5a0af0-501/bd0005cc
deleted file mode 100644
index 949ba40..0000000
Binary files a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/bd0005cc and /dev/null differ
diff --git a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/bd71104a b/.config/.cache/v24.8.0-arm64-ef5a0af0-501/bd71104a
deleted file mode 100644
index e9715a8..0000000
Binary files a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/bd71104a and /dev/null differ
diff --git a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/bd7a8ea4 b/.config/.cache/v24.8.0-arm64-ef5a0af0-501/bd7a8ea4
deleted file mode 100644
index 3218865..0000000
Binary files a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/bd7a8ea4 and /dev/null differ
diff --git a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/bda5b221 b/.config/.cache/v24.8.0-arm64-ef5a0af0-501/bda5b221
deleted file mode 100644
index 2ff56d2..0000000
Binary files a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/bda5b221 and /dev/null differ
diff --git a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/bde280b7 b/.config/.cache/v24.8.0-arm64-ef5a0af0-501/bde280b7
deleted file mode 100644
index e6c2cdf..0000000
Binary files a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/bde280b7 and /dev/null differ
diff --git a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/be0caada b/.config/.cache/v24.8.0-arm64-ef5a0af0-501/be0caada
deleted file mode 100644
index d12db13..0000000
Binary files a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/be0caada and /dev/null differ
diff --git a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/be9df575 b/.config/.cache/v24.8.0-arm64-ef5a0af0-501/be9df575
deleted file mode 100644
index 821e364..0000000
Binary files a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/be9df575 and /dev/null differ
diff --git a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/bea20755 b/.config/.cache/v24.8.0-arm64-ef5a0af0-501/bea20755
deleted file mode 100644
index 16c079d..0000000
Binary files a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/bea20755 and /dev/null differ
diff --git a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/bea7d3bd b/.config/.cache/v24.8.0-arm64-ef5a0af0-501/bea7d3bd
deleted file mode 100644
index 605dd19..0000000
Binary files a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/bea7d3bd and /dev/null differ
diff --git a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/bee2c2b4 b/.config/.cache/v24.8.0-arm64-ef5a0af0-501/bee2c2b4
deleted file mode 100644
index e80c83b..0000000
Binary files a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/bee2c2b4 and /dev/null differ
diff --git a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/bee94c1e b/.config/.cache/v24.8.0-arm64-ef5a0af0-501/bee94c1e
deleted file mode 100644
index 78e04c3..0000000
Binary files a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/bee94c1e and /dev/null differ
diff --git a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/bf2e6cdd b/.config/.cache/v24.8.0-arm64-ef5a0af0-501/bf2e6cdd
deleted file mode 100644
index d6f957f..0000000
Binary files a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/bf2e6cdd and /dev/null differ
diff --git a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/bf3f984b b/.config/.cache/v24.8.0-arm64-ef5a0af0-501/bf3f984b
deleted file mode 100644
index a325fce..0000000
Binary files a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/bf3f984b and /dev/null differ
diff --git a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/bf448e39 b/.config/.cache/v24.8.0-arm64-ef5a0af0-501/bf448e39
deleted file mode 100644
index 02c8e02..0000000
Binary files a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/bf448e39 and /dev/null differ
diff --git a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/bf4592fc b/.config/.cache/v24.8.0-arm64-ef5a0af0-501/bf4592fc
deleted file mode 100644
index 38d38ae..0000000
Binary files a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/bf4592fc and /dev/null differ
diff --git a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/bf6bf753 b/.config/.cache/v24.8.0-arm64-ef5a0af0-501/bf6bf753
deleted file mode 100644
index b891718..0000000
Binary files a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/bf6bf753 and /dev/null differ
diff --git a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/bf9edec2 b/.config/.cache/v24.8.0-arm64-ef5a0af0-501/bf9edec2
deleted file mode 100644
index 7d0bf14..0000000
Binary files a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/bf9edec2 and /dev/null differ
diff --git a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/c009824f b/.config/.cache/v24.8.0-arm64-ef5a0af0-501/c009824f
deleted file mode 100644
index 933c426..0000000
Binary files a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/c009824f and /dev/null differ
diff --git a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/c12985ab b/.config/.cache/v24.8.0-arm64-ef5a0af0-501/c12985ab
deleted file mode 100644
index 59ca9f5..0000000
Binary files a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/c12985ab and /dev/null differ
diff --git a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/c1877fd4 b/.config/.cache/v24.8.0-arm64-ef5a0af0-501/c1877fd4
deleted file mode 100644
index 42d51dd..0000000
Binary files a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/c1877fd4 and /dev/null differ
diff --git a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/c1b9259d b/.config/.cache/v24.8.0-arm64-ef5a0af0-501/c1b9259d
deleted file mode 100644
index d9c97fd..0000000
Binary files a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/c1b9259d and /dev/null differ
diff --git a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/c1d39545 b/.config/.cache/v24.8.0-arm64-ef5a0af0-501/c1d39545
deleted file mode 100644
index 2771b02..0000000
Binary files a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/c1d39545 and /dev/null differ
diff --git a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/c1dfb594 b/.config/.cache/v24.8.0-arm64-ef5a0af0-501/c1dfb594
deleted file mode 100644
index 184fe35..0000000
Binary files a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/c1dfb594 and /dev/null differ
diff --git a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/c281e6a0 b/.config/.cache/v24.8.0-arm64-ef5a0af0-501/c281e6a0
deleted file mode 100644
index d2f73b7..0000000
Binary files a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/c281e6a0 and /dev/null differ
diff --git a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/c2bf9bd1 b/.config/.cache/v24.8.0-arm64-ef5a0af0-501/c2bf9bd1
deleted file mode 100644
index f5348a8..0000000
Binary files a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/c2bf9bd1 and /dev/null differ
diff --git a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/c30b8e7c b/.config/.cache/v24.8.0-arm64-ef5a0af0-501/c30b8e7c
deleted file mode 100644
index b89cdb4..0000000
Binary files a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/c30b8e7c and /dev/null differ
diff --git a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/c323aa8e b/.config/.cache/v24.8.0-arm64-ef5a0af0-501/c323aa8e
deleted file mode 100644
index 8b379b6..0000000
Binary files a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/c323aa8e and /dev/null differ
diff --git a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/c3973d40 b/.config/.cache/v24.8.0-arm64-ef5a0af0-501/c3973d40
deleted file mode 100644
index 958d159..0000000
Binary files a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/c3973d40 and /dev/null differ
diff --git a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/c409958f b/.config/.cache/v24.8.0-arm64-ef5a0af0-501/c409958f
deleted file mode 100644
index f13e557..0000000
Binary files a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/c409958f and /dev/null differ
diff --git a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/c4143da8 b/.config/.cache/v24.8.0-arm64-ef5a0af0-501/c4143da8
deleted file mode 100644
index 99a51af..0000000
Binary files a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/c4143da8 and /dev/null differ
diff --git a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/c4f932e7 b/.config/.cache/v24.8.0-arm64-ef5a0af0-501/c4f932e7
deleted file mode 100644
index 918e606..0000000
Binary files a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/c4f932e7 and /dev/null differ
diff --git a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/c4fe04ab b/.config/.cache/v24.8.0-arm64-ef5a0af0-501/c4fe04ab
deleted file mode 100644
index c0ea3a6..0000000
Binary files a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/c4fe04ab and /dev/null differ
diff --git a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/c507abb1 b/.config/.cache/v24.8.0-arm64-ef5a0af0-501/c507abb1
deleted file mode 100644
index 5d3ac45..0000000
Binary files a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/c507abb1 and /dev/null differ
diff --git a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/c51a4310 b/.config/.cache/v24.8.0-arm64-ef5a0af0-501/c51a4310
deleted file mode 100644
index 7ecd927..0000000
Binary files a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/c51a4310 and /dev/null differ
diff --git a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/c533014e b/.config/.cache/v24.8.0-arm64-ef5a0af0-501/c533014e
deleted file mode 100644
index 0f7ec15..0000000
Binary files a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/c533014e and /dev/null differ
diff --git a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/c5493723 b/.config/.cache/v24.8.0-arm64-ef5a0af0-501/c5493723
deleted file mode 100644
index d0a9559..0000000
Binary files a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/c5493723 and /dev/null differ
diff --git a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/c589c9e5 b/.config/.cache/v24.8.0-arm64-ef5a0af0-501/c589c9e5
deleted file mode 100644
index 133cef3..0000000
Binary files a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/c589c9e5 and /dev/null differ
diff --git a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/c5a01e4e b/.config/.cache/v24.8.0-arm64-ef5a0af0-501/c5a01e4e
deleted file mode 100644
index 64147ef..0000000
Binary files a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/c5a01e4e and /dev/null differ
diff --git a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/c63fd29d b/.config/.cache/v24.8.0-arm64-ef5a0af0-501/c63fd29d
deleted file mode 100644
index 70a18e4..0000000
Binary files a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/c63fd29d and /dev/null differ
diff --git a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/c6727658 b/.config/.cache/v24.8.0-arm64-ef5a0af0-501/c6727658
deleted file mode 100644
index 77a6399..0000000
Binary files a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/c6727658 and /dev/null differ
diff --git a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/c6c47add b/.config/.cache/v24.8.0-arm64-ef5a0af0-501/c6c47add
deleted file mode 100644
index 213c0be..0000000
Binary files a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/c6c47add and /dev/null differ
diff --git a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/c6ce09e7 b/.config/.cache/v24.8.0-arm64-ef5a0af0-501/c6ce09e7
deleted file mode 100644
index 97d3116..0000000
Binary files a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/c6ce09e7 and /dev/null differ
diff --git a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/c7089761 b/.config/.cache/v24.8.0-arm64-ef5a0af0-501/c7089761
deleted file mode 100644
index 4da10fe..0000000
Binary files a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/c7089761 and /dev/null differ
diff --git a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/c7091932 b/.config/.cache/v24.8.0-arm64-ef5a0af0-501/c7091932
deleted file mode 100644
index 0e64690..0000000
Binary files a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/c7091932 and /dev/null differ
diff --git a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/c70e1ef7 b/.config/.cache/v24.8.0-arm64-ef5a0af0-501/c70e1ef7
deleted file mode 100644
index 444f98c..0000000
Binary files a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/c70e1ef7 and /dev/null differ
diff --git a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/c725fe81 b/.config/.cache/v24.8.0-arm64-ef5a0af0-501/c725fe81
deleted file mode 100644
index 6b86b68..0000000
Binary files a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/c725fe81 and /dev/null differ
diff --git a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/c77cd16f b/.config/.cache/v24.8.0-arm64-ef5a0af0-501/c77cd16f
deleted file mode 100644
index 4a55325..0000000
Binary files a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/c77cd16f and /dev/null differ
diff --git a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/c78d7c2c b/.config/.cache/v24.8.0-arm64-ef5a0af0-501/c78d7c2c
deleted file mode 100644
index fb79887..0000000
Binary files a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/c78d7c2c and /dev/null differ
diff --git a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/c7bd27c2 b/.config/.cache/v24.8.0-arm64-ef5a0af0-501/c7bd27c2
deleted file mode 100644
index d56706c..0000000
Binary files a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/c7bd27c2 and /dev/null differ
diff --git a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/c7cb00cf b/.config/.cache/v24.8.0-arm64-ef5a0af0-501/c7cb00cf
deleted file mode 100644
index 94806ee..0000000
Binary files a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/c7cb00cf and /dev/null differ
diff --git a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/c81871a9 b/.config/.cache/v24.8.0-arm64-ef5a0af0-501/c81871a9
deleted file mode 100644
index 127ae12..0000000
Binary files a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/c81871a9 and /dev/null differ
diff --git a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/c93e518c b/.config/.cache/v24.8.0-arm64-ef5a0af0-501/c93e518c
deleted file mode 100644
index b9dd657..0000000
Binary files a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/c93e518c and /dev/null differ
diff --git a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/c99060ea b/.config/.cache/v24.8.0-arm64-ef5a0af0-501/c99060ea
deleted file mode 100644
index 1ef1fb0..0000000
Binary files a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/c99060ea and /dev/null differ
diff --git a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/ca0a151e b/.config/.cache/v24.8.0-arm64-ef5a0af0-501/ca0a151e
deleted file mode 100644
index a24d961..0000000
Binary files a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/ca0a151e and /dev/null differ
diff --git a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/ca2cd532 b/.config/.cache/v24.8.0-arm64-ef5a0af0-501/ca2cd532
deleted file mode 100644
index 4a1a60a..0000000
Binary files a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/ca2cd532 and /dev/null differ
diff --git a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/ca31ff70 b/.config/.cache/v24.8.0-arm64-ef5a0af0-501/ca31ff70
deleted file mode 100644
index 94a0df7..0000000
Binary files a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/ca31ff70 and /dev/null differ
diff --git a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/ca3233e5 b/.config/.cache/v24.8.0-arm64-ef5a0af0-501/ca3233e5
deleted file mode 100644
index bb5efa0..0000000
Binary files a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/ca3233e5 and /dev/null differ
diff --git a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/ca53eb25 b/.config/.cache/v24.8.0-arm64-ef5a0af0-501/ca53eb25
deleted file mode 100644
index a61d435..0000000
Binary files a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/ca53eb25 and /dev/null differ
diff --git a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/ca6afb8c b/.config/.cache/v24.8.0-arm64-ef5a0af0-501/ca6afb8c
deleted file mode 100644
index 5e1381c..0000000
Binary files a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/ca6afb8c and /dev/null differ
diff --git a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/ca6c8067 b/.config/.cache/v24.8.0-arm64-ef5a0af0-501/ca6c8067
deleted file mode 100644
index 772b3b0..0000000
Binary files a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/ca6c8067 and /dev/null differ
diff --git a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/ca76a9db b/.config/.cache/v24.8.0-arm64-ef5a0af0-501/ca76a9db
deleted file mode 100644
index 7220a3f..0000000
Binary files a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/ca76a9db and /dev/null differ
diff --git a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/caaab80e b/.config/.cache/v24.8.0-arm64-ef5a0af0-501/caaab80e
deleted file mode 100644
index 778a0e9..0000000
Binary files a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/caaab80e and /dev/null differ
diff --git a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/cad1b549 b/.config/.cache/v24.8.0-arm64-ef5a0af0-501/cad1b549
deleted file mode 100644
index 1611283..0000000
Binary files a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/cad1b549 and /dev/null differ
diff --git a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/cad7c976 b/.config/.cache/v24.8.0-arm64-ef5a0af0-501/cad7c976
deleted file mode 100644
index 9bb30bd..0000000
Binary files a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/cad7c976 and /dev/null differ
diff --git a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/cb263841 b/.config/.cache/v24.8.0-arm64-ef5a0af0-501/cb263841
deleted file mode 100644
index 2b9ee46..0000000
Binary files a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/cb263841 and /dev/null differ
diff --git a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/cb33c94b b/.config/.cache/v24.8.0-arm64-ef5a0af0-501/cb33c94b
deleted file mode 100644
index 5d3ef44..0000000
Binary files a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/cb33c94b and /dev/null differ
diff --git a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/cb7ffae0 b/.config/.cache/v24.8.0-arm64-ef5a0af0-501/cb7ffae0
deleted file mode 100644
index 8350e0d..0000000
Binary files a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/cb7ffae0 and /dev/null differ
diff --git a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/cb96dcc1 b/.config/.cache/v24.8.0-arm64-ef5a0af0-501/cb96dcc1
deleted file mode 100644
index bcd26f6..0000000
Binary files a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/cb96dcc1 and /dev/null differ
diff --git a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/cbbc2f04 b/.config/.cache/v24.8.0-arm64-ef5a0af0-501/cbbc2f04
deleted file mode 100644
index 4591c7f..0000000
Binary files a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/cbbc2f04 and /dev/null differ
diff --git a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/cbe1bf0a b/.config/.cache/v24.8.0-arm64-ef5a0af0-501/cbe1bf0a
deleted file mode 100644
index 0432b69..0000000
Binary files a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/cbe1bf0a and /dev/null differ
diff --git a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/cc045072 b/.config/.cache/v24.8.0-arm64-ef5a0af0-501/cc045072
deleted file mode 100644
index e50a014..0000000
Binary files a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/cc045072 and /dev/null differ
diff --git a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/cc0b5d47 b/.config/.cache/v24.8.0-arm64-ef5a0af0-501/cc0b5d47
deleted file mode 100644
index 2fdb066..0000000
Binary files a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/cc0b5d47 and /dev/null differ
diff --git a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/cc1d7a0e b/.config/.cache/v24.8.0-arm64-ef5a0af0-501/cc1d7a0e
deleted file mode 100644
index 2e86754..0000000
Binary files a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/cc1d7a0e and /dev/null differ
diff --git a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/cc3ba232 b/.config/.cache/v24.8.0-arm64-ef5a0af0-501/cc3ba232
deleted file mode 100644
index decd1f1..0000000
Binary files a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/cc3ba232 and /dev/null differ
diff --git a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/cc606a8e b/.config/.cache/v24.8.0-arm64-ef5a0af0-501/cc606a8e
deleted file mode 100644
index 255b00f..0000000
Binary files a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/cc606a8e and /dev/null differ
diff --git a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/cc71664f b/.config/.cache/v24.8.0-arm64-ef5a0af0-501/cc71664f
deleted file mode 100644
index 26c8575..0000000
Binary files a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/cc71664f and /dev/null differ
diff --git a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/cc75c2f7 b/.config/.cache/v24.8.0-arm64-ef5a0af0-501/cc75c2f7
deleted file mode 100644
index c878e28..0000000
Binary files a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/cc75c2f7 and /dev/null differ
diff --git a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/cca58ef3 b/.config/.cache/v24.8.0-arm64-ef5a0af0-501/cca58ef3
deleted file mode 100644
index f94ef2c..0000000
Binary files a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/cca58ef3 and /dev/null differ
diff --git a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/cccb63d8 b/.config/.cache/v24.8.0-arm64-ef5a0af0-501/cccb63d8
deleted file mode 100644
index 797df2d..0000000
Binary files a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/cccb63d8 and /dev/null differ
diff --git a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/cd2606cf b/.config/.cache/v24.8.0-arm64-ef5a0af0-501/cd2606cf
deleted file mode 100644
index 840448f..0000000
Binary files a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/cd2606cf and /dev/null differ
diff --git a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/cd552ca3 b/.config/.cache/v24.8.0-arm64-ef5a0af0-501/cd552ca3
deleted file mode 100644
index 5a89c0a..0000000
Binary files a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/cd552ca3 and /dev/null differ
diff --git a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/ce23d79b b/.config/.cache/v24.8.0-arm64-ef5a0af0-501/ce23d79b
deleted file mode 100644
index cf7ae3c..0000000
Binary files a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/ce23d79b and /dev/null differ
diff --git a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/ce2b75df b/.config/.cache/v24.8.0-arm64-ef5a0af0-501/ce2b75df
deleted file mode 100644
index 124c771..0000000
Binary files a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/ce2b75df and /dev/null differ
diff --git a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/ce2f3fc1 b/.config/.cache/v24.8.0-arm64-ef5a0af0-501/ce2f3fc1
deleted file mode 100644
index b67be9c..0000000
Binary files a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/ce2f3fc1 and /dev/null differ
diff --git a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/ce30a912 b/.config/.cache/v24.8.0-arm64-ef5a0af0-501/ce30a912
deleted file mode 100644
index 1a028bb..0000000
Binary files a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/ce30a912 and /dev/null differ
diff --git a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/ce71125d b/.config/.cache/v24.8.0-arm64-ef5a0af0-501/ce71125d
deleted file mode 100644
index b30ee06..0000000
Binary files a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/ce71125d and /dev/null differ
diff --git a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/ce7d860d b/.config/.cache/v24.8.0-arm64-ef5a0af0-501/ce7d860d
deleted file mode 100644
index 50e784b..0000000
Binary files a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/ce7d860d and /dev/null differ
diff --git a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/cead7c6f b/.config/.cache/v24.8.0-arm64-ef5a0af0-501/cead7c6f
deleted file mode 100644
index ba35830..0000000
Binary files a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/cead7c6f and /dev/null differ
diff --git a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/cebd8262 b/.config/.cache/v24.8.0-arm64-ef5a0af0-501/cebd8262
deleted file mode 100644
index c828f1e..0000000
Binary files a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/cebd8262 and /dev/null differ
diff --git a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/cee09cd3 b/.config/.cache/v24.8.0-arm64-ef5a0af0-501/cee09cd3
deleted file mode 100644
index ea85136..0000000
Binary files a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/cee09cd3 and /dev/null differ
diff --git a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/cf283281 b/.config/.cache/v24.8.0-arm64-ef5a0af0-501/cf283281
deleted file mode 100644
index 0b5e179..0000000
Binary files a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/cf283281 and /dev/null differ
diff --git a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/cf4b8b1f b/.config/.cache/v24.8.0-arm64-ef5a0af0-501/cf4b8b1f
deleted file mode 100644
index 33bfad7..0000000
Binary files a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/cf4b8b1f and /dev/null differ
diff --git a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/cf5f254f b/.config/.cache/v24.8.0-arm64-ef5a0af0-501/cf5f254f
deleted file mode 100644
index fcf5080..0000000
Binary files a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/cf5f254f and /dev/null differ
diff --git a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/cf7854dc b/.config/.cache/v24.8.0-arm64-ef5a0af0-501/cf7854dc
deleted file mode 100644
index 012675e..0000000
Binary files a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/cf7854dc and /dev/null differ
diff --git a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/cf7904bf b/.config/.cache/v24.8.0-arm64-ef5a0af0-501/cf7904bf
deleted file mode 100644
index 8297782..0000000
Binary files a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/cf7904bf and /dev/null differ
diff --git a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/cfe6b504 b/.config/.cache/v24.8.0-arm64-ef5a0af0-501/cfe6b504
deleted file mode 100644
index f760967..0000000
Binary files a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/cfe6b504 and /dev/null differ
diff --git a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/cff4d8f6 b/.config/.cache/v24.8.0-arm64-ef5a0af0-501/cff4d8f6
deleted file mode 100644
index bdcd755..0000000
Binary files a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/cff4d8f6 and /dev/null differ
diff --git a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/d029c401 b/.config/.cache/v24.8.0-arm64-ef5a0af0-501/d029c401
deleted file mode 100644
index 4996a76..0000000
Binary files a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/d029c401 and /dev/null differ
diff --git a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/d0796639 b/.config/.cache/v24.8.0-arm64-ef5a0af0-501/d0796639
deleted file mode 100644
index 0ce6957..0000000
Binary files a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/d0796639 and /dev/null differ
diff --git a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/d0803107 b/.config/.cache/v24.8.0-arm64-ef5a0af0-501/d0803107
deleted file mode 100644
index 277d844..0000000
Binary files a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/d0803107 and /dev/null differ
diff --git a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/d08f870a b/.config/.cache/v24.8.0-arm64-ef5a0af0-501/d08f870a
deleted file mode 100644
index a8a6205..0000000
Binary files a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/d08f870a and /dev/null differ
diff --git a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/d0adf084 b/.config/.cache/v24.8.0-arm64-ef5a0af0-501/d0adf084
deleted file mode 100644
index fc4e645..0000000
Binary files a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/d0adf084 and /dev/null differ
diff --git a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/d0c163fd b/.config/.cache/v24.8.0-arm64-ef5a0af0-501/d0c163fd
deleted file mode 100644
index 113027b..0000000
Binary files a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/d0c163fd and /dev/null differ
diff --git a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/d0c9c656 b/.config/.cache/v24.8.0-arm64-ef5a0af0-501/d0c9c656
deleted file mode 100644
index 338ac06..0000000
Binary files a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/d0c9c656 and /dev/null differ
diff --git a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/d0f8a803 b/.config/.cache/v24.8.0-arm64-ef5a0af0-501/d0f8a803
deleted file mode 100644
index 10ad885..0000000
Binary files a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/d0f8a803 and /dev/null differ
diff --git a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/d103331d b/.config/.cache/v24.8.0-arm64-ef5a0af0-501/d103331d
deleted file mode 100644
index 5ce532a..0000000
Binary files a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/d103331d and /dev/null differ
diff --git a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/d12f09a7 b/.config/.cache/v24.8.0-arm64-ef5a0af0-501/d12f09a7
deleted file mode 100644
index 624753f..0000000
Binary files a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/d12f09a7 and /dev/null differ
diff --git a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/d14899d0 b/.config/.cache/v24.8.0-arm64-ef5a0af0-501/d14899d0
deleted file mode 100644
index c735188..0000000
Binary files a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/d14899d0 and /dev/null differ
diff --git a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/d15f0d30 b/.config/.cache/v24.8.0-arm64-ef5a0af0-501/d15f0d30
deleted file mode 100644
index d1287ee..0000000
Binary files a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/d15f0d30 and /dev/null differ
diff --git a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/d195170b b/.config/.cache/v24.8.0-arm64-ef5a0af0-501/d195170b
deleted file mode 100644
index 31e64c7..0000000
Binary files a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/d195170b and /dev/null differ
diff --git a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/d1a51f0e b/.config/.cache/v24.8.0-arm64-ef5a0af0-501/d1a51f0e
deleted file mode 100644
index 0b0608f..0000000
Binary files a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/d1a51f0e and /dev/null differ
diff --git a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/d1bf54be b/.config/.cache/v24.8.0-arm64-ef5a0af0-501/d1bf54be
deleted file mode 100644
index fbcfa50..0000000
Binary files a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/d1bf54be and /dev/null differ
diff --git a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/d1c65fa6 b/.config/.cache/v24.8.0-arm64-ef5a0af0-501/d1c65fa6
deleted file mode 100644
index e9f0a6d..0000000
Binary files a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/d1c65fa6 and /dev/null differ
diff --git a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/d2995fb6 b/.config/.cache/v24.8.0-arm64-ef5a0af0-501/d2995fb6
deleted file mode 100644
index a813243..0000000
Binary files a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/d2995fb6 and /dev/null differ
diff --git a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/d2c9e842 b/.config/.cache/v24.8.0-arm64-ef5a0af0-501/d2c9e842
deleted file mode 100644
index 57bc423..0000000
Binary files a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/d2c9e842 and /dev/null differ
diff --git a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/d2dfcd90 b/.config/.cache/v24.8.0-arm64-ef5a0af0-501/d2dfcd90
deleted file mode 100644
index a689158..0000000
Binary files a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/d2dfcd90 and /dev/null differ
diff --git a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/d2e0f2d9 b/.config/.cache/v24.8.0-arm64-ef5a0af0-501/d2e0f2d9
deleted file mode 100644
index 24ba04b..0000000
Binary files a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/d2e0f2d9 and /dev/null differ
diff --git a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/d30b791f b/.config/.cache/v24.8.0-arm64-ef5a0af0-501/d30b791f
deleted file mode 100644
index 799e2f7..0000000
Binary files a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/d30b791f and /dev/null differ
diff --git a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/d3173e8f b/.config/.cache/v24.8.0-arm64-ef5a0af0-501/d3173e8f
deleted file mode 100644
index bef7df5..0000000
Binary files a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/d3173e8f and /dev/null differ
diff --git a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/d3395632 b/.config/.cache/v24.8.0-arm64-ef5a0af0-501/d3395632
deleted file mode 100644
index f7f4d1f..0000000
Binary files a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/d3395632 and /dev/null differ
diff --git a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/d34fae2f b/.config/.cache/v24.8.0-arm64-ef5a0af0-501/d34fae2f
deleted file mode 100644
index f03e9cc..0000000
Binary files a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/d34fae2f and /dev/null differ
diff --git a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/d360e7bf b/.config/.cache/v24.8.0-arm64-ef5a0af0-501/d360e7bf
deleted file mode 100644
index ac934e5..0000000
Binary files a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/d360e7bf and /dev/null differ
diff --git a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/d369ae4d b/.config/.cache/v24.8.0-arm64-ef5a0af0-501/d369ae4d
deleted file mode 100644
index 6976cac..0000000
Binary files a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/d369ae4d and /dev/null differ
diff --git a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/d37409dd b/.config/.cache/v24.8.0-arm64-ef5a0af0-501/d37409dd
deleted file mode 100644
index c680dce..0000000
Binary files a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/d37409dd and /dev/null differ
diff --git a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/d37b0b05 b/.config/.cache/v24.8.0-arm64-ef5a0af0-501/d37b0b05
deleted file mode 100644
index aff69f9..0000000
Binary files a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/d37b0b05 and /dev/null differ
diff --git a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/d3875bd8 b/.config/.cache/v24.8.0-arm64-ef5a0af0-501/d3875bd8
deleted file mode 100644
index 9ca2117..0000000
Binary files a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/d3875bd8 and /dev/null differ
diff --git a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/d3986b41 b/.config/.cache/v24.8.0-arm64-ef5a0af0-501/d3986b41
deleted file mode 100644
index a0c4576..0000000
Binary files a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/d3986b41 and /dev/null differ
diff --git a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/d39915d9 b/.config/.cache/v24.8.0-arm64-ef5a0af0-501/d39915d9
deleted file mode 100644
index 949de37..0000000
Binary files a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/d39915d9 and /dev/null differ
diff --git a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/d3aff385 b/.config/.cache/v24.8.0-arm64-ef5a0af0-501/d3aff385
deleted file mode 100644
index f969155..0000000
Binary files a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/d3aff385 and /dev/null differ
diff --git a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/d3c2a8dc b/.config/.cache/v24.8.0-arm64-ef5a0af0-501/d3c2a8dc
deleted file mode 100644
index 03e9f91..0000000
Binary files a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/d3c2a8dc and /dev/null differ
diff --git a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/d3c9a6aa b/.config/.cache/v24.8.0-arm64-ef5a0af0-501/d3c9a6aa
deleted file mode 100644
index 646489c..0000000
Binary files a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/d3c9a6aa and /dev/null differ
diff --git a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/d4253277 b/.config/.cache/v24.8.0-arm64-ef5a0af0-501/d4253277
deleted file mode 100644
index c3bba58..0000000
Binary files a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/d4253277 and /dev/null differ
diff --git a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/d4326fec b/.config/.cache/v24.8.0-arm64-ef5a0af0-501/d4326fec
deleted file mode 100644
index 60bdb8b..0000000
Binary files a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/d4326fec and /dev/null differ
diff --git a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/d4331d09 b/.config/.cache/v24.8.0-arm64-ef5a0af0-501/d4331d09
deleted file mode 100644
index 475b564..0000000
Binary files a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/d4331d09 and /dev/null differ
diff --git a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/d43a80b9 b/.config/.cache/v24.8.0-arm64-ef5a0af0-501/d43a80b9
deleted file mode 100644
index 42a374e..0000000
Binary files a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/d43a80b9 and /dev/null differ
diff --git a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/d444f688 b/.config/.cache/v24.8.0-arm64-ef5a0af0-501/d444f688
deleted file mode 100644
index bed8792..0000000
Binary files a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/d444f688 and /dev/null differ
diff --git a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/d4528b94 b/.config/.cache/v24.8.0-arm64-ef5a0af0-501/d4528b94
deleted file mode 100644
index 4c52329..0000000
Binary files a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/d4528b94 and /dev/null differ
diff --git a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/d4906d4e b/.config/.cache/v24.8.0-arm64-ef5a0af0-501/d4906d4e
deleted file mode 100644
index d1dec6d..0000000
Binary files a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/d4906d4e and /dev/null differ
diff --git a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/d4a07dda b/.config/.cache/v24.8.0-arm64-ef5a0af0-501/d4a07dda
deleted file mode 100644
index edd8614..0000000
Binary files a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/d4a07dda and /dev/null differ
diff --git a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/d4a5d01b b/.config/.cache/v24.8.0-arm64-ef5a0af0-501/d4a5d01b
deleted file mode 100644
index 1f3b276..0000000
Binary files a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/d4a5d01b and /dev/null differ
diff --git a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/d539e3e9 b/.config/.cache/v24.8.0-arm64-ef5a0af0-501/d539e3e9
deleted file mode 100644
index 13b8ac0..0000000
Binary files a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/d539e3e9 and /dev/null differ
diff --git a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/d56d34d3 b/.config/.cache/v24.8.0-arm64-ef5a0af0-501/d56d34d3
deleted file mode 100644
index c1f57a5..0000000
Binary files a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/d56d34d3 and /dev/null differ
diff --git a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/d5c45c92 b/.config/.cache/v24.8.0-arm64-ef5a0af0-501/d5c45c92
deleted file mode 100644
index d972285..0000000
Binary files a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/d5c45c92 and /dev/null differ
diff --git a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/d6339b81 b/.config/.cache/v24.8.0-arm64-ef5a0af0-501/d6339b81
deleted file mode 100644
index 2c1ee1d..0000000
Binary files a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/d6339b81 and /dev/null differ
diff --git a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/d6605a72 b/.config/.cache/v24.8.0-arm64-ef5a0af0-501/d6605a72
deleted file mode 100644
index fabfe01..0000000
Binary files a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/d6605a72 and /dev/null differ
diff --git a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/d69e1d4e b/.config/.cache/v24.8.0-arm64-ef5a0af0-501/d69e1d4e
deleted file mode 100644
index 4b84c3a..0000000
Binary files a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/d69e1d4e and /dev/null differ
diff --git a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/d6e7bb5a b/.config/.cache/v24.8.0-arm64-ef5a0af0-501/d6e7bb5a
deleted file mode 100644
index ec8d34e..0000000
Binary files a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/d6e7bb5a and /dev/null differ
diff --git a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/d71d10eb b/.config/.cache/v24.8.0-arm64-ef5a0af0-501/d71d10eb
deleted file mode 100644
index cfece1d..0000000
Binary files a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/d71d10eb and /dev/null differ
diff --git a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/d74ede27 b/.config/.cache/v24.8.0-arm64-ef5a0af0-501/d74ede27
deleted file mode 100644
index 9380ac5..0000000
Binary files a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/d74ede27 and /dev/null differ
diff --git a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/d78cf059 b/.config/.cache/v24.8.0-arm64-ef5a0af0-501/d78cf059
deleted file mode 100644
index 67b980c..0000000
Binary files a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/d78cf059 and /dev/null differ
diff --git a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/d78dd2c6 b/.config/.cache/v24.8.0-arm64-ef5a0af0-501/d78dd2c6
deleted file mode 100644
index 77b41f5..0000000
Binary files a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/d78dd2c6 and /dev/null differ
diff --git a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/d7c7f93f b/.config/.cache/v24.8.0-arm64-ef5a0af0-501/d7c7f93f
deleted file mode 100644
index 1873fb0..0000000
Binary files a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/d7c7f93f and /dev/null differ
diff --git a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/d88d5f43 b/.config/.cache/v24.8.0-arm64-ef5a0af0-501/d88d5f43
deleted file mode 100644
index 5aa1d85..0000000
Binary files a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/d88d5f43 and /dev/null differ
diff --git a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/d8b4079f b/.config/.cache/v24.8.0-arm64-ef5a0af0-501/d8b4079f
deleted file mode 100644
index 44074ac..0000000
Binary files a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/d8b4079f and /dev/null differ
diff --git a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/d90da890 b/.config/.cache/v24.8.0-arm64-ef5a0af0-501/d90da890
deleted file mode 100644
index 0f07ccc..0000000
Binary files a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/d90da890 and /dev/null differ
diff --git a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/d93d99b8 b/.config/.cache/v24.8.0-arm64-ef5a0af0-501/d93d99b8
deleted file mode 100644
index fe30789..0000000
Binary files a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/d93d99b8 and /dev/null differ
diff --git a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/d9d34b06 b/.config/.cache/v24.8.0-arm64-ef5a0af0-501/d9d34b06
deleted file mode 100644
index e6b37c8..0000000
Binary files a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/d9d34b06 and /dev/null differ
diff --git a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/d9f4e22b b/.config/.cache/v24.8.0-arm64-ef5a0af0-501/d9f4e22b
deleted file mode 100644
index e0c8beb..0000000
Binary files a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/d9f4e22b and /dev/null differ
diff --git a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/da6677c4 b/.config/.cache/v24.8.0-arm64-ef5a0af0-501/da6677c4
deleted file mode 100644
index 5128347..0000000
Binary files a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/da6677c4 and /dev/null differ
diff --git a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/da6fa473 b/.config/.cache/v24.8.0-arm64-ef5a0af0-501/da6fa473
deleted file mode 100644
index 43bea46..0000000
Binary files a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/da6fa473 and /dev/null differ
diff --git a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/db06cb45 b/.config/.cache/v24.8.0-arm64-ef5a0af0-501/db06cb45
deleted file mode 100644
index 210a2ec..0000000
Binary files a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/db06cb45 and /dev/null differ
diff --git a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/db78eabf b/.config/.cache/v24.8.0-arm64-ef5a0af0-501/db78eabf
deleted file mode 100644
index 68e4d3e..0000000
Binary files a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/db78eabf and /dev/null differ
diff --git a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/db7fe5c8 b/.config/.cache/v24.8.0-arm64-ef5a0af0-501/db7fe5c8
deleted file mode 100644
index b14aa21..0000000
Binary files a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/db7fe5c8 and /dev/null differ
diff --git a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/db9705e4 b/.config/.cache/v24.8.0-arm64-ef5a0af0-501/db9705e4
deleted file mode 100644
index f1f1515..0000000
Binary files a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/db9705e4 and /dev/null differ
diff --git a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/db9e6b7e b/.config/.cache/v24.8.0-arm64-ef5a0af0-501/db9e6b7e
deleted file mode 100644
index 360baf1..0000000
Binary files a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/db9e6b7e and /dev/null differ
diff --git a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/dbb62471 b/.config/.cache/v24.8.0-arm64-ef5a0af0-501/dbb62471
deleted file mode 100644
index faf03b1..0000000
Binary files a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/dbb62471 and /dev/null differ
diff --git a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/dc223563 b/.config/.cache/v24.8.0-arm64-ef5a0af0-501/dc223563
deleted file mode 100644
index 016ef84..0000000
Binary files a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/dc223563 and /dev/null differ
diff --git a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/dc226b6d b/.config/.cache/v24.8.0-arm64-ef5a0af0-501/dc226b6d
deleted file mode 100644
index cee6fd6..0000000
Binary files a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/dc226b6d and /dev/null differ
diff --git a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/dc441b12 b/.config/.cache/v24.8.0-arm64-ef5a0af0-501/dc441b12
deleted file mode 100644
index 34c7519..0000000
Binary files a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/dc441b12 and /dev/null differ
diff --git a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/dc7567a7 b/.config/.cache/v24.8.0-arm64-ef5a0af0-501/dc7567a7
deleted file mode 100644
index 2c56cc3..0000000
Binary files a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/dc7567a7 and /dev/null differ
diff --git a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/dc9431ae b/.config/.cache/v24.8.0-arm64-ef5a0af0-501/dc9431ae
deleted file mode 100644
index d5f3631..0000000
Binary files a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/dc9431ae and /dev/null differ
diff --git a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/dca58e0f b/.config/.cache/v24.8.0-arm64-ef5a0af0-501/dca58e0f
deleted file mode 100644
index 99123af..0000000
Binary files a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/dca58e0f and /dev/null differ
diff --git a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/dcb070c3 b/.config/.cache/v24.8.0-arm64-ef5a0af0-501/dcb070c3
deleted file mode 100644
index b6992de..0000000
Binary files a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/dcb070c3 and /dev/null differ
diff --git a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/dd461365 b/.config/.cache/v24.8.0-arm64-ef5a0af0-501/dd461365
deleted file mode 100644
index 4ef635f..0000000
Binary files a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/dd461365 and /dev/null differ
diff --git a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/dd7f921f b/.config/.cache/v24.8.0-arm64-ef5a0af0-501/dd7f921f
deleted file mode 100644
index f7ab2d1..0000000
Binary files a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/dd7f921f and /dev/null differ
diff --git a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/dda38723 b/.config/.cache/v24.8.0-arm64-ef5a0af0-501/dda38723
deleted file mode 100644
index b5b5858..0000000
Binary files a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/dda38723 and /dev/null differ
diff --git a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/dda76d9a b/.config/.cache/v24.8.0-arm64-ef5a0af0-501/dda76d9a
deleted file mode 100644
index be85804..0000000
Binary files a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/dda76d9a and /dev/null differ
diff --git a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/ddcda533 b/.config/.cache/v24.8.0-arm64-ef5a0af0-501/ddcda533
deleted file mode 100644
index 8c6dadd..0000000
Binary files a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/ddcda533 and /dev/null differ
diff --git a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/dde80728 b/.config/.cache/v24.8.0-arm64-ef5a0af0-501/dde80728
deleted file mode 100644
index 01365f4..0000000
Binary files a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/dde80728 and /dev/null differ
diff --git a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/ddf19ae1 b/.config/.cache/v24.8.0-arm64-ef5a0af0-501/ddf19ae1
deleted file mode 100644
index c50b465..0000000
Binary files a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/ddf19ae1 and /dev/null differ
diff --git a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/ddf57781 b/.config/.cache/v24.8.0-arm64-ef5a0af0-501/ddf57781
deleted file mode 100644
index ccd4503..0000000
Binary files a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/ddf57781 and /dev/null differ
diff --git a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/de196a65 b/.config/.cache/v24.8.0-arm64-ef5a0af0-501/de196a65
deleted file mode 100644
index 849a366..0000000
Binary files a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/de196a65 and /dev/null differ
diff --git a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/de863853 b/.config/.cache/v24.8.0-arm64-ef5a0af0-501/de863853
deleted file mode 100644
index 7ea7ae6..0000000
Binary files a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/de863853 and /dev/null differ
diff --git a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/dee30c6c b/.config/.cache/v24.8.0-arm64-ef5a0af0-501/dee30c6c
deleted file mode 100644
index cbd8438..0000000
Binary files a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/dee30c6c and /dev/null differ
diff --git a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/def1654a b/.config/.cache/v24.8.0-arm64-ef5a0af0-501/def1654a
deleted file mode 100644
index 81fa76b..0000000
Binary files a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/def1654a and /dev/null differ
diff --git a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/deffdf4b b/.config/.cache/v24.8.0-arm64-ef5a0af0-501/deffdf4b
deleted file mode 100644
index d4fc5dd..0000000
Binary files a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/deffdf4b and /dev/null differ
diff --git a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/df7fdb2a b/.config/.cache/v24.8.0-arm64-ef5a0af0-501/df7fdb2a
deleted file mode 100644
index f423869..0000000
Binary files a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/df7fdb2a and /dev/null differ
diff --git a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/e0516e43 b/.config/.cache/v24.8.0-arm64-ef5a0af0-501/e0516e43
deleted file mode 100644
index b5aef37..0000000
Binary files a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/e0516e43 and /dev/null differ
diff --git a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/e0d68615 b/.config/.cache/v24.8.0-arm64-ef5a0af0-501/e0d68615
deleted file mode 100644
index 5688973..0000000
Binary files a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/e0d68615 and /dev/null differ
diff --git a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/e0f03ed0 b/.config/.cache/v24.8.0-arm64-ef5a0af0-501/e0f03ed0
deleted file mode 100644
index 6ab48fb..0000000
Binary files a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/e0f03ed0 and /dev/null differ
diff --git a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/e1080e9a b/.config/.cache/v24.8.0-arm64-ef5a0af0-501/e1080e9a
deleted file mode 100644
index 3b32af8..0000000
Binary files a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/e1080e9a and /dev/null differ
diff --git a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/e1310fbf b/.config/.cache/v24.8.0-arm64-ef5a0af0-501/e1310fbf
deleted file mode 100644
index 53b4112..0000000
Binary files a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/e1310fbf and /dev/null differ
diff --git a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/e13f684f b/.config/.cache/v24.8.0-arm64-ef5a0af0-501/e13f684f
deleted file mode 100644
index c153ebb..0000000
Binary files a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/e13f684f and /dev/null differ
diff --git a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/e140108e b/.config/.cache/v24.8.0-arm64-ef5a0af0-501/e140108e
deleted file mode 100644
index a09e8f1..0000000
Binary files a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/e140108e and /dev/null differ
diff --git a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/e1561842 b/.config/.cache/v24.8.0-arm64-ef5a0af0-501/e1561842
deleted file mode 100644
index f84058a..0000000
Binary files a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/e1561842 and /dev/null differ
diff --git a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/e156d2d5 b/.config/.cache/v24.8.0-arm64-ef5a0af0-501/e156d2d5
deleted file mode 100644
index cc70c3c..0000000
Binary files a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/e156d2d5 and /dev/null differ
diff --git a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/e1bc70db b/.config/.cache/v24.8.0-arm64-ef5a0af0-501/e1bc70db
deleted file mode 100644
index 0861f79..0000000
Binary files a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/e1bc70db and /dev/null differ
diff --git a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/e21d721d b/.config/.cache/v24.8.0-arm64-ef5a0af0-501/e21d721d
deleted file mode 100644
index 66afec1..0000000
Binary files a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/e21d721d and /dev/null differ
diff --git a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/e2de6611 b/.config/.cache/v24.8.0-arm64-ef5a0af0-501/e2de6611
deleted file mode 100644
index 3b028e3..0000000
Binary files a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/e2de6611 and /dev/null differ
diff --git a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/e33461e1 b/.config/.cache/v24.8.0-arm64-ef5a0af0-501/e33461e1
deleted file mode 100644
index 9940d00..0000000
Binary files a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/e33461e1 and /dev/null differ
diff --git a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/e346baa6 b/.config/.cache/v24.8.0-arm64-ef5a0af0-501/e346baa6
deleted file mode 100644
index 9e1d4cb..0000000
Binary files a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/e346baa6 and /dev/null differ
diff --git a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/e3f5a8b5 b/.config/.cache/v24.8.0-arm64-ef5a0af0-501/e3f5a8b5
deleted file mode 100644
index 1943870..0000000
Binary files a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/e3f5a8b5 and /dev/null differ
diff --git a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/e40254f5 b/.config/.cache/v24.8.0-arm64-ef5a0af0-501/e40254f5
deleted file mode 100644
index d71ef42..0000000
Binary files a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/e40254f5 and /dev/null differ
diff --git a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/e40bfc2a b/.config/.cache/v24.8.0-arm64-ef5a0af0-501/e40bfc2a
deleted file mode 100644
index 47731d2..0000000
Binary files a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/e40bfc2a and /dev/null differ
diff --git a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/e41a69a9 b/.config/.cache/v24.8.0-arm64-ef5a0af0-501/e41a69a9
deleted file mode 100644
index 2c9969e..0000000
Binary files a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/e41a69a9 and /dev/null differ
diff --git a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/e459d18f b/.config/.cache/v24.8.0-arm64-ef5a0af0-501/e459d18f
deleted file mode 100644
index 57bc160..0000000
Binary files a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/e459d18f and /dev/null differ
diff --git a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/e4804617 b/.config/.cache/v24.8.0-arm64-ef5a0af0-501/e4804617
deleted file mode 100644
index 10f1980..0000000
Binary files a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/e4804617 and /dev/null differ
diff --git a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/e54ef023 b/.config/.cache/v24.8.0-arm64-ef5a0af0-501/e54ef023
deleted file mode 100644
index 7ba5c01..0000000
Binary files a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/e54ef023 and /dev/null differ
diff --git a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/e57e534e b/.config/.cache/v24.8.0-arm64-ef5a0af0-501/e57e534e
deleted file mode 100644
index 97ed152..0000000
Binary files a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/e57e534e and /dev/null differ
diff --git a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/e5a71fa6 b/.config/.cache/v24.8.0-arm64-ef5a0af0-501/e5a71fa6
deleted file mode 100644
index 8e28150..0000000
Binary files a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/e5a71fa6 and /dev/null differ
diff --git a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/e5cde613 b/.config/.cache/v24.8.0-arm64-ef5a0af0-501/e5cde613
deleted file mode 100644
index b96e786..0000000
Binary files a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/e5cde613 and /dev/null differ
diff --git a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/e5d20cb2 b/.config/.cache/v24.8.0-arm64-ef5a0af0-501/e5d20cb2
deleted file mode 100644
index 81edf27..0000000
Binary files a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/e5d20cb2 and /dev/null differ
diff --git a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/e5dce359 b/.config/.cache/v24.8.0-arm64-ef5a0af0-501/e5dce359
deleted file mode 100644
index a9b0cad..0000000
Binary files a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/e5dce359 and /dev/null differ
diff --git a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/e5e8f620 b/.config/.cache/v24.8.0-arm64-ef5a0af0-501/e5e8f620
deleted file mode 100644
index b22bca8..0000000
Binary files a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/e5e8f620 and /dev/null differ
diff --git a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/e616da51 b/.config/.cache/v24.8.0-arm64-ef5a0af0-501/e616da51
deleted file mode 100644
index fa23ab3..0000000
Binary files a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/e616da51 and /dev/null differ
diff --git a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/e62bfb3d b/.config/.cache/v24.8.0-arm64-ef5a0af0-501/e62bfb3d
deleted file mode 100644
index a551220..0000000
Binary files a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/e62bfb3d and /dev/null differ
diff --git a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/e63d132c b/.config/.cache/v24.8.0-arm64-ef5a0af0-501/e63d132c
deleted file mode 100644
index 9aef6a1..0000000
Binary files a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/e63d132c and /dev/null differ
diff --git a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/e64390c0 b/.config/.cache/v24.8.0-arm64-ef5a0af0-501/e64390c0
deleted file mode 100644
index becd925..0000000
Binary files a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/e64390c0 and /dev/null differ
diff --git a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/e65ca0f4 b/.config/.cache/v24.8.0-arm64-ef5a0af0-501/e65ca0f4
deleted file mode 100644
index 5e3c229..0000000
Binary files a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/e65ca0f4 and /dev/null differ
diff --git a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/e67ad8e3 b/.config/.cache/v24.8.0-arm64-ef5a0af0-501/e67ad8e3
deleted file mode 100644
index 29c418d..0000000
Binary files a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/e67ad8e3 and /dev/null differ
diff --git a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/e67e6ae6 b/.config/.cache/v24.8.0-arm64-ef5a0af0-501/e67e6ae6
deleted file mode 100644
index 213c7ef..0000000
Binary files a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/e67e6ae6 and /dev/null differ
diff --git a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/e6808520 b/.config/.cache/v24.8.0-arm64-ef5a0af0-501/e6808520
deleted file mode 100644
index af2ef20..0000000
Binary files a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/e6808520 and /dev/null differ
diff --git a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/e6a66b37 b/.config/.cache/v24.8.0-arm64-ef5a0af0-501/e6a66b37
deleted file mode 100644
index bdd8dca..0000000
Binary files a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/e6a66b37 and /dev/null differ
diff --git a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/e6c33bc1 b/.config/.cache/v24.8.0-arm64-ef5a0af0-501/e6c33bc1
deleted file mode 100644
index 9e2087a..0000000
Binary files a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/e6c33bc1 and /dev/null differ
diff --git a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/e6e3b2ef b/.config/.cache/v24.8.0-arm64-ef5a0af0-501/e6e3b2ef
deleted file mode 100644
index c5b25fe..0000000
Binary files a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/e6e3b2ef and /dev/null differ
diff --git a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/e7139081 b/.config/.cache/v24.8.0-arm64-ef5a0af0-501/e7139081
deleted file mode 100644
index be970fb..0000000
Binary files a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/e7139081 and /dev/null differ
diff --git a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/e723bca0 b/.config/.cache/v24.8.0-arm64-ef5a0af0-501/e723bca0
deleted file mode 100644
index e75eddb..0000000
Binary files a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/e723bca0 and /dev/null differ
diff --git a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/e7318f3a b/.config/.cache/v24.8.0-arm64-ef5a0af0-501/e7318f3a
deleted file mode 100644
index 9d56e0f..0000000
Binary files a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/e7318f3a and /dev/null differ
diff --git a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/e738fef4 b/.config/.cache/v24.8.0-arm64-ef5a0af0-501/e738fef4
deleted file mode 100644
index 19a228e..0000000
Binary files a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/e738fef4 and /dev/null differ
diff --git a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/e7724d79 b/.config/.cache/v24.8.0-arm64-ef5a0af0-501/e7724d79
deleted file mode 100644
index 30b1e70..0000000
Binary files a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/e7724d79 and /dev/null differ
diff --git a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/e7b51d71 b/.config/.cache/v24.8.0-arm64-ef5a0af0-501/e7b51d71
deleted file mode 100644
index 6e1847c..0000000
Binary files a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/e7b51d71 and /dev/null differ
diff --git a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/e80b6302 b/.config/.cache/v24.8.0-arm64-ef5a0af0-501/e80b6302
deleted file mode 100644
index 26797ef..0000000
Binary files a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/e80b6302 and /dev/null differ
diff --git a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/e81cb53a b/.config/.cache/v24.8.0-arm64-ef5a0af0-501/e81cb53a
deleted file mode 100644
index 5f39728..0000000
Binary files a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/e81cb53a and /dev/null differ
diff --git a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/e83cb691 b/.config/.cache/v24.8.0-arm64-ef5a0af0-501/e83cb691
deleted file mode 100644
index 6290605..0000000
Binary files a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/e83cb691 and /dev/null differ
diff --git a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/e8977a48 b/.config/.cache/v24.8.0-arm64-ef5a0af0-501/e8977a48
deleted file mode 100644
index 5bfd755..0000000
Binary files a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/e8977a48 and /dev/null differ
diff --git a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/e8f2e552 b/.config/.cache/v24.8.0-arm64-ef5a0af0-501/e8f2e552
deleted file mode 100644
index 42b278f..0000000
Binary files a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/e8f2e552 and /dev/null differ
diff --git a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/e92b6bc8 b/.config/.cache/v24.8.0-arm64-ef5a0af0-501/e92b6bc8
deleted file mode 100644
index 15eaa85..0000000
Binary files a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/e92b6bc8 and /dev/null differ
diff --git a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/e941432a b/.config/.cache/v24.8.0-arm64-ef5a0af0-501/e941432a
deleted file mode 100644
index 6e336a9..0000000
Binary files a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/e941432a and /dev/null differ
diff --git a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/e99cc1b1 b/.config/.cache/v24.8.0-arm64-ef5a0af0-501/e99cc1b1
deleted file mode 100644
index 96586b1..0000000
Binary files a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/e99cc1b1 and /dev/null differ
diff --git a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/e99d6e7e b/.config/.cache/v24.8.0-arm64-ef5a0af0-501/e99d6e7e
deleted file mode 100644
index 0d30cdf..0000000
Binary files a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/e99d6e7e and /dev/null differ
diff --git a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/e9b84298 b/.config/.cache/v24.8.0-arm64-ef5a0af0-501/e9b84298
deleted file mode 100644
index e5d9edb..0000000
Binary files a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/e9b84298 and /dev/null differ
diff --git a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/e9fe50ed b/.config/.cache/v24.8.0-arm64-ef5a0af0-501/e9fe50ed
deleted file mode 100644
index 8797f9d..0000000
Binary files a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/e9fe50ed and /dev/null differ
diff --git a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/ea33ded1 b/.config/.cache/v24.8.0-arm64-ef5a0af0-501/ea33ded1
deleted file mode 100644
index 20b0915..0000000
Binary files a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/ea33ded1 and /dev/null differ
diff --git a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/ea38f12e b/.config/.cache/v24.8.0-arm64-ef5a0af0-501/ea38f12e
deleted file mode 100644
index a0991ed..0000000
Binary files a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/ea38f12e and /dev/null differ
diff --git a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/ea4b56d8 b/.config/.cache/v24.8.0-arm64-ef5a0af0-501/ea4b56d8
deleted file mode 100644
index 1fea030..0000000
Binary files a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/ea4b56d8 and /dev/null differ
diff --git a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/ea8e0ab2 b/.config/.cache/v24.8.0-arm64-ef5a0af0-501/ea8e0ab2
deleted file mode 100644
index 121d361..0000000
Binary files a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/ea8e0ab2 and /dev/null differ
diff --git a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/ea9d2e93 b/.config/.cache/v24.8.0-arm64-ef5a0af0-501/ea9d2e93
deleted file mode 100644
index bdf3d2c..0000000
Binary files a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/ea9d2e93 and /dev/null differ
diff --git a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/eac663c1 b/.config/.cache/v24.8.0-arm64-ef5a0af0-501/eac663c1
deleted file mode 100644
index a0183e9..0000000
Binary files a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/eac663c1 and /dev/null differ
diff --git a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/eaf4f9f6 b/.config/.cache/v24.8.0-arm64-ef5a0af0-501/eaf4f9f6
deleted file mode 100644
index 5a58c8a..0000000
Binary files a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/eaf4f9f6 and /dev/null differ
diff --git a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/eb0346fc b/.config/.cache/v24.8.0-arm64-ef5a0af0-501/eb0346fc
deleted file mode 100644
index 5ac41f4..0000000
Binary files a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/eb0346fc and /dev/null differ
diff --git a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/eb5128d1 b/.config/.cache/v24.8.0-arm64-ef5a0af0-501/eb5128d1
deleted file mode 100644
index 478026f..0000000
Binary files a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/eb5128d1 and /dev/null differ
diff --git a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/eb654f87 b/.config/.cache/v24.8.0-arm64-ef5a0af0-501/eb654f87
deleted file mode 100644
index 85877b4..0000000
Binary files a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/eb654f87 and /dev/null differ
diff --git a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/eb709f31 b/.config/.cache/v24.8.0-arm64-ef5a0af0-501/eb709f31
deleted file mode 100644
index 2040576..0000000
Binary files a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/eb709f31 and /dev/null differ
diff --git a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/eb71ed2b b/.config/.cache/v24.8.0-arm64-ef5a0af0-501/eb71ed2b
deleted file mode 100644
index 474e123..0000000
Binary files a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/eb71ed2b and /dev/null differ
diff --git a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/ebe19be4 b/.config/.cache/v24.8.0-arm64-ef5a0af0-501/ebe19be4
deleted file mode 100644
index 66a0ea0..0000000
Binary files a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/ebe19be4 and /dev/null differ
diff --git a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/ebff6403 b/.config/.cache/v24.8.0-arm64-ef5a0af0-501/ebff6403
deleted file mode 100644
index ae6e85c..0000000
Binary files a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/ebff6403 and /dev/null differ
diff --git a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/ec0e14f6 b/.config/.cache/v24.8.0-arm64-ef5a0af0-501/ec0e14f6
deleted file mode 100644
index 99c23ba..0000000
Binary files a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/ec0e14f6 and /dev/null differ
diff --git a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/ec57eef2 b/.config/.cache/v24.8.0-arm64-ef5a0af0-501/ec57eef2
deleted file mode 100644
index 7eb087b..0000000
Binary files a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/ec57eef2 and /dev/null differ
diff --git a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/eca34bc0 b/.config/.cache/v24.8.0-arm64-ef5a0af0-501/eca34bc0
deleted file mode 100644
index ae574fa..0000000
Binary files a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/eca34bc0 and /dev/null differ
diff --git a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/eca676d9 b/.config/.cache/v24.8.0-arm64-ef5a0af0-501/eca676d9
deleted file mode 100644
index f1cf44e..0000000
Binary files a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/eca676d9 and /dev/null differ
diff --git a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/ecb89ecd b/.config/.cache/v24.8.0-arm64-ef5a0af0-501/ecb89ecd
deleted file mode 100644
index 47f50c9..0000000
Binary files a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/ecb89ecd and /dev/null differ
diff --git a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/ecc27e33 b/.config/.cache/v24.8.0-arm64-ef5a0af0-501/ecc27e33
deleted file mode 100644
index df90d3f..0000000
Binary files a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/ecc27e33 and /dev/null differ
diff --git a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/ed125732 b/.config/.cache/v24.8.0-arm64-ef5a0af0-501/ed125732
deleted file mode 100644
index 3ee6d8c..0000000
Binary files a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/ed125732 and /dev/null differ
diff --git a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/ed1327ee b/.config/.cache/v24.8.0-arm64-ef5a0af0-501/ed1327ee
deleted file mode 100644
index 718eaee..0000000
Binary files a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/ed1327ee and /dev/null differ
diff --git a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/ed3cd6ac b/.config/.cache/v24.8.0-arm64-ef5a0af0-501/ed3cd6ac
deleted file mode 100644
index 6bbaea1..0000000
Binary files a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/ed3cd6ac and /dev/null differ
diff --git a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/edf2dd87 b/.config/.cache/v24.8.0-arm64-ef5a0af0-501/edf2dd87
deleted file mode 100644
index ba15d4f..0000000
Binary files a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/edf2dd87 and /dev/null differ
diff --git a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/ee21cad6 b/.config/.cache/v24.8.0-arm64-ef5a0af0-501/ee21cad6
deleted file mode 100644
index e71f9f9..0000000
Binary files a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/ee21cad6 and /dev/null differ
diff --git a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/ee98ffd9 b/.config/.cache/v24.8.0-arm64-ef5a0af0-501/ee98ffd9
deleted file mode 100644
index fdbf452..0000000
Binary files a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/ee98ffd9 and /dev/null differ
diff --git a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/eea6f968 b/.config/.cache/v24.8.0-arm64-ef5a0af0-501/eea6f968
deleted file mode 100644
index ca78379..0000000
Binary files a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/eea6f968 and /dev/null differ
diff --git a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/eeb9a4fa b/.config/.cache/v24.8.0-arm64-ef5a0af0-501/eeb9a4fa
deleted file mode 100644
index ed47105..0000000
Binary files a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/eeb9a4fa and /dev/null differ
diff --git a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/eeee9a8b b/.config/.cache/v24.8.0-arm64-ef5a0af0-501/eeee9a8b
deleted file mode 100644
index bd1700c..0000000
Binary files a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/eeee9a8b and /dev/null differ
diff --git a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/ef0a0298 b/.config/.cache/v24.8.0-arm64-ef5a0af0-501/ef0a0298
deleted file mode 100644
index f24e545..0000000
Binary files a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/ef0a0298 and /dev/null differ
diff --git a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/ef470358 b/.config/.cache/v24.8.0-arm64-ef5a0af0-501/ef470358
deleted file mode 100644
index b29b4bc..0000000
Binary files a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/ef470358 and /dev/null differ
diff --git a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/ef51b0ef b/.config/.cache/v24.8.0-arm64-ef5a0af0-501/ef51b0ef
deleted file mode 100644
index ef2c7e7..0000000
Binary files a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/ef51b0ef and /dev/null differ
diff --git a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/ef5cdcde b/.config/.cache/v24.8.0-arm64-ef5a0af0-501/ef5cdcde
deleted file mode 100644
index 4f94142..0000000
Binary files a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/ef5cdcde and /dev/null differ
diff --git a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/efcb819d b/.config/.cache/v24.8.0-arm64-ef5a0af0-501/efcb819d
deleted file mode 100644
index 3beba9f..0000000
Binary files a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/efcb819d and /dev/null differ
diff --git a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/f025ead8 b/.config/.cache/v24.8.0-arm64-ef5a0af0-501/f025ead8
deleted file mode 100644
index d8b7eaf..0000000
Binary files a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/f025ead8 and /dev/null differ
diff --git a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/f036f8e7 b/.config/.cache/v24.8.0-arm64-ef5a0af0-501/f036f8e7
deleted file mode 100644
index 0dcf465..0000000
Binary files a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/f036f8e7 and /dev/null differ
diff --git a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/f0d18456 b/.config/.cache/v24.8.0-arm64-ef5a0af0-501/f0d18456
deleted file mode 100644
index 3044122..0000000
Binary files a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/f0d18456 and /dev/null differ
diff --git a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/f0ee7a9e b/.config/.cache/v24.8.0-arm64-ef5a0af0-501/f0ee7a9e
deleted file mode 100644
index 7ed9355..0000000
Binary files a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/f0ee7a9e and /dev/null differ
diff --git a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/f13f8ddf b/.config/.cache/v24.8.0-arm64-ef5a0af0-501/f13f8ddf
deleted file mode 100644
index 66522ba..0000000
Binary files a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/f13f8ddf and /dev/null differ
diff --git a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/f17ee669 b/.config/.cache/v24.8.0-arm64-ef5a0af0-501/f17ee669
deleted file mode 100644
index 27c9b04..0000000
Binary files a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/f17ee669 and /dev/null differ
diff --git a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/f19784da b/.config/.cache/v24.8.0-arm64-ef5a0af0-501/f19784da
deleted file mode 100644
index f449b7f..0000000
Binary files a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/f19784da and /dev/null differ
diff --git a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/f1af4f57 b/.config/.cache/v24.8.0-arm64-ef5a0af0-501/f1af4f57
deleted file mode 100644
index 3b1231a..0000000
Binary files a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/f1af4f57 and /dev/null differ
diff --git a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/f1c05bdc b/.config/.cache/v24.8.0-arm64-ef5a0af0-501/f1c05bdc
deleted file mode 100644
index 45fc0f2..0000000
Binary files a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/f1c05bdc and /dev/null differ
diff --git a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/f1d50a12 b/.config/.cache/v24.8.0-arm64-ef5a0af0-501/f1d50a12
deleted file mode 100644
index 6862201..0000000
Binary files a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/f1d50a12 and /dev/null differ
diff --git a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/f1d7f67d b/.config/.cache/v24.8.0-arm64-ef5a0af0-501/f1d7f67d
deleted file mode 100644
index 948d742..0000000
Binary files a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/f1d7f67d and /dev/null differ
diff --git a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/f1df5026 b/.config/.cache/v24.8.0-arm64-ef5a0af0-501/f1df5026
deleted file mode 100644
index 0868cc2..0000000
Binary files a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/f1df5026 and /dev/null differ
diff --git a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/f1ee4b25 b/.config/.cache/v24.8.0-arm64-ef5a0af0-501/f1ee4b25
deleted file mode 100644
index b4815c3..0000000
Binary files a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/f1ee4b25 and /dev/null differ
diff --git a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/f223a7d9 b/.config/.cache/v24.8.0-arm64-ef5a0af0-501/f223a7d9
deleted file mode 100644
index fb331d7..0000000
Binary files a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/f223a7d9 and /dev/null differ
diff --git a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/f29f820d b/.config/.cache/v24.8.0-arm64-ef5a0af0-501/f29f820d
deleted file mode 100644
index 3b1d3e0..0000000
Binary files a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/f29f820d and /dev/null differ
diff --git a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/f2b79e88 b/.config/.cache/v24.8.0-arm64-ef5a0af0-501/f2b79e88
deleted file mode 100644
index cd3f5f4..0000000
Binary files a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/f2b79e88 and /dev/null differ
diff --git a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/f2e44450 b/.config/.cache/v24.8.0-arm64-ef5a0af0-501/f2e44450
deleted file mode 100644
index 0dfda27..0000000
Binary files a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/f2e44450 and /dev/null differ
diff --git a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/f322040a b/.config/.cache/v24.8.0-arm64-ef5a0af0-501/f322040a
deleted file mode 100644
index bb723c2..0000000
Binary files a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/f322040a and /dev/null differ
diff --git a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/f32a5f6a b/.config/.cache/v24.8.0-arm64-ef5a0af0-501/f32a5f6a
deleted file mode 100644
index dc12a1d..0000000
Binary files a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/f32a5f6a and /dev/null differ
diff --git a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/f3435adc b/.config/.cache/v24.8.0-arm64-ef5a0af0-501/f3435adc
deleted file mode 100644
index 8a23b94..0000000
Binary files a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/f3435adc and /dev/null differ
diff --git a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/f3b71f53 b/.config/.cache/v24.8.0-arm64-ef5a0af0-501/f3b71f53
deleted file mode 100644
index 1aee5ec..0000000
Binary files a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/f3b71f53 and /dev/null differ
diff --git a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/f3eb8571 b/.config/.cache/v24.8.0-arm64-ef5a0af0-501/f3eb8571
deleted file mode 100644
index d9b892b..0000000
Binary files a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/f3eb8571 and /dev/null differ
diff --git a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/f4415505 b/.config/.cache/v24.8.0-arm64-ef5a0af0-501/f4415505
deleted file mode 100644
index a4d1033..0000000
Binary files a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/f4415505 and /dev/null differ
diff --git a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/f4664e75 b/.config/.cache/v24.8.0-arm64-ef5a0af0-501/f4664e75
deleted file mode 100644
index 454a0c6..0000000
Binary files a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/f4664e75 and /dev/null differ
diff --git a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/f470bff0 b/.config/.cache/v24.8.0-arm64-ef5a0af0-501/f470bff0
deleted file mode 100644
index 95341ea..0000000
Binary files a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/f470bff0 and /dev/null differ
diff --git a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/f47eab5d b/.config/.cache/v24.8.0-arm64-ef5a0af0-501/f47eab5d
deleted file mode 100644
index 991aee0..0000000
Binary files a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/f47eab5d and /dev/null differ
diff --git a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/f48bbfed b/.config/.cache/v24.8.0-arm64-ef5a0af0-501/f48bbfed
deleted file mode 100644
index ac5a3e2..0000000
Binary files a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/f48bbfed and /dev/null differ
diff --git a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/f4971f04 b/.config/.cache/v24.8.0-arm64-ef5a0af0-501/f4971f04
deleted file mode 100644
index c8ab066..0000000
Binary files a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/f4971f04 and /dev/null differ
diff --git a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/f49f66e7 b/.config/.cache/v24.8.0-arm64-ef5a0af0-501/f49f66e7
deleted file mode 100644
index 74e6ba2..0000000
Binary files a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/f49f66e7 and /dev/null differ
diff --git a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/f4cd6439 b/.config/.cache/v24.8.0-arm64-ef5a0af0-501/f4cd6439
deleted file mode 100644
index 9d91622..0000000
Binary files a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/f4cd6439 and /dev/null differ
diff --git a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/f4d7ff4c b/.config/.cache/v24.8.0-arm64-ef5a0af0-501/f4d7ff4c
deleted file mode 100644
index b66aa80..0000000
Binary files a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/f4d7ff4c and /dev/null differ
diff --git a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/f4fbd722 b/.config/.cache/v24.8.0-arm64-ef5a0af0-501/f4fbd722
deleted file mode 100644
index 2ae9db2..0000000
Binary files a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/f4fbd722 and /dev/null differ
diff --git a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/f5090c5c b/.config/.cache/v24.8.0-arm64-ef5a0af0-501/f5090c5c
deleted file mode 100644
index 5534849..0000000
Binary files a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/f5090c5c and /dev/null differ
diff --git a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/f5254b5d b/.config/.cache/v24.8.0-arm64-ef5a0af0-501/f5254b5d
deleted file mode 100644
index 4d2a33b..0000000
Binary files a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/f5254b5d and /dev/null differ
diff --git a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/f577556a b/.config/.cache/v24.8.0-arm64-ef5a0af0-501/f577556a
deleted file mode 100644
index 3254a70..0000000
Binary files a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/f577556a and /dev/null differ
diff --git a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/f58941e7 b/.config/.cache/v24.8.0-arm64-ef5a0af0-501/f58941e7
deleted file mode 100644
index faa949f..0000000
Binary files a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/f58941e7 and /dev/null differ
diff --git a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/f5a3983b b/.config/.cache/v24.8.0-arm64-ef5a0af0-501/f5a3983b
deleted file mode 100644
index bbc5f4d..0000000
Binary files a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/f5a3983b and /dev/null differ
diff --git a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/f5a72653 b/.config/.cache/v24.8.0-arm64-ef5a0af0-501/f5a72653
deleted file mode 100644
index 3b134bd..0000000
Binary files a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/f5a72653 and /dev/null differ
diff --git a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/f5b239ed b/.config/.cache/v24.8.0-arm64-ef5a0af0-501/f5b239ed
deleted file mode 100644
index 8b6b9b4..0000000
Binary files a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/f5b239ed and /dev/null differ
diff --git a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/f5eb764b b/.config/.cache/v24.8.0-arm64-ef5a0af0-501/f5eb764b
deleted file mode 100644
index a2186ad..0000000
Binary files a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/f5eb764b and /dev/null differ
diff --git a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/f5ec1208 b/.config/.cache/v24.8.0-arm64-ef5a0af0-501/f5ec1208
deleted file mode 100644
index 1c7a391..0000000
Binary files a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/f5ec1208 and /dev/null differ
diff --git a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/f6339649 b/.config/.cache/v24.8.0-arm64-ef5a0af0-501/f6339649
deleted file mode 100644
index 9cf1a91..0000000
Binary files a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/f6339649 and /dev/null differ
diff --git a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/f66e98b1 b/.config/.cache/v24.8.0-arm64-ef5a0af0-501/f66e98b1
deleted file mode 100644
index 1248f48..0000000
Binary files a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/f66e98b1 and /dev/null differ
diff --git a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/f69a49e7 b/.config/.cache/v24.8.0-arm64-ef5a0af0-501/f69a49e7
deleted file mode 100644
index 0c34c8b..0000000
Binary files a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/f69a49e7 and /dev/null differ
diff --git a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/f6fb2d76 b/.config/.cache/v24.8.0-arm64-ef5a0af0-501/f6fb2d76
deleted file mode 100644
index 94f4a42..0000000
Binary files a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/f6fb2d76 and /dev/null differ
diff --git a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/f70d0784 b/.config/.cache/v24.8.0-arm64-ef5a0af0-501/f70d0784
deleted file mode 100644
index 7c442a2..0000000
Binary files a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/f70d0784 and /dev/null differ
diff --git a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/f74f2abf b/.config/.cache/v24.8.0-arm64-ef5a0af0-501/f74f2abf
deleted file mode 100644
index ea9bbb8..0000000
Binary files a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/f74f2abf and /dev/null differ
diff --git a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/f7888392 b/.config/.cache/v24.8.0-arm64-ef5a0af0-501/f7888392
deleted file mode 100644
index 6822ec6..0000000
Binary files a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/f7888392 and /dev/null differ
diff --git a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/f788c315 b/.config/.cache/v24.8.0-arm64-ef5a0af0-501/f788c315
deleted file mode 100644
index f4bac93..0000000
Binary files a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/f788c315 and /dev/null differ
diff --git a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/f78eac3f b/.config/.cache/v24.8.0-arm64-ef5a0af0-501/f78eac3f
deleted file mode 100644
index bad823c..0000000
Binary files a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/f78eac3f and /dev/null differ
diff --git a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/f78ecb3b b/.config/.cache/v24.8.0-arm64-ef5a0af0-501/f78ecb3b
deleted file mode 100644
index 0347a4e..0000000
Binary files a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/f78ecb3b and /dev/null differ
diff --git a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/f8058c0d b/.config/.cache/v24.8.0-arm64-ef5a0af0-501/f8058c0d
deleted file mode 100644
index c5a9943..0000000
Binary files a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/f8058c0d and /dev/null differ
diff --git a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/f847e85a b/.config/.cache/v24.8.0-arm64-ef5a0af0-501/f847e85a
deleted file mode 100644
index cd648a2..0000000
Binary files a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/f847e85a and /dev/null differ
diff --git a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/f85709f8 b/.config/.cache/v24.8.0-arm64-ef5a0af0-501/f85709f8
deleted file mode 100644
index d2afbbf..0000000
Binary files a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/f85709f8 and /dev/null differ
diff --git a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/f85ac2e0 b/.config/.cache/v24.8.0-arm64-ef5a0af0-501/f85ac2e0
deleted file mode 100644
index bfc9f77..0000000
Binary files a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/f85ac2e0 and /dev/null differ
diff --git a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/f85c9641 b/.config/.cache/v24.8.0-arm64-ef5a0af0-501/f85c9641
deleted file mode 100644
index 672e855..0000000
Binary files a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/f85c9641 and /dev/null differ
diff --git a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/f895e46e b/.config/.cache/v24.8.0-arm64-ef5a0af0-501/f895e46e
deleted file mode 100644
index e914d15..0000000
Binary files a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/f895e46e and /dev/null differ
diff --git a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/f8a847a9 b/.config/.cache/v24.8.0-arm64-ef5a0af0-501/f8a847a9
deleted file mode 100644
index 6b1ea1a..0000000
Binary files a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/f8a847a9 and /dev/null differ
diff --git a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/f8fed9ae b/.config/.cache/v24.8.0-arm64-ef5a0af0-501/f8fed9ae
deleted file mode 100644
index c7d8439..0000000
Binary files a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/f8fed9ae and /dev/null differ
diff --git a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/f92383bc b/.config/.cache/v24.8.0-arm64-ef5a0af0-501/f92383bc
deleted file mode 100644
index 652f34d..0000000
Binary files a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/f92383bc and /dev/null differ
diff --git a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/f9238602 b/.config/.cache/v24.8.0-arm64-ef5a0af0-501/f9238602
deleted file mode 100644
index 61a5af0..0000000
Binary files a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/f9238602 and /dev/null differ
diff --git a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/f959a22e b/.config/.cache/v24.8.0-arm64-ef5a0af0-501/f959a22e
deleted file mode 100644
index 3156c33..0000000
Binary files a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/f959a22e and /dev/null differ
diff --git a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/f9654c06 b/.config/.cache/v24.8.0-arm64-ef5a0af0-501/f9654c06
deleted file mode 100644
index 4129a03..0000000
Binary files a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/f9654c06 and /dev/null differ
diff --git a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/f99305b9 b/.config/.cache/v24.8.0-arm64-ef5a0af0-501/f99305b9
deleted file mode 100644
index 03564fb..0000000
Binary files a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/f99305b9 and /dev/null differ
diff --git a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/f99da430 b/.config/.cache/v24.8.0-arm64-ef5a0af0-501/f99da430
deleted file mode 100644
index ee84b29..0000000
Binary files a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/f99da430 and /dev/null differ
diff --git a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/f9bf3219 b/.config/.cache/v24.8.0-arm64-ef5a0af0-501/f9bf3219
deleted file mode 100644
index 48f1d94..0000000
Binary files a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/f9bf3219 and /dev/null differ
diff --git a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/fa565887 b/.config/.cache/v24.8.0-arm64-ef5a0af0-501/fa565887
deleted file mode 100644
index 28ef1c1..0000000
Binary files a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/fa565887 and /dev/null differ
diff --git a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/fa681851 b/.config/.cache/v24.8.0-arm64-ef5a0af0-501/fa681851
deleted file mode 100644
index cb209fe..0000000
Binary files a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/fa681851 and /dev/null differ
diff --git a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/fa83f3b6 b/.config/.cache/v24.8.0-arm64-ef5a0af0-501/fa83f3b6
deleted file mode 100644
index 6147d21..0000000
Binary files a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/fa83f3b6 and /dev/null differ
diff --git a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/fa87c358 b/.config/.cache/v24.8.0-arm64-ef5a0af0-501/fa87c358
deleted file mode 100644
index f4e525c..0000000
Binary files a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/fa87c358 and /dev/null differ
diff --git a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/fa8f202e b/.config/.cache/v24.8.0-arm64-ef5a0af0-501/fa8f202e
deleted file mode 100644
index 3812c74..0000000
Binary files a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/fa8f202e and /dev/null differ
diff --git a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/fa9ba91b b/.config/.cache/v24.8.0-arm64-ef5a0af0-501/fa9ba91b
deleted file mode 100644
index ed4e0fe..0000000
Binary files a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/fa9ba91b and /dev/null differ
diff --git a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/fabbe0b7 b/.config/.cache/v24.8.0-arm64-ef5a0af0-501/fabbe0b7
deleted file mode 100644
index b49da00..0000000
Binary files a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/fabbe0b7 and /dev/null differ
diff --git a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/fac9042d b/.config/.cache/v24.8.0-arm64-ef5a0af0-501/fac9042d
deleted file mode 100644
index d1ab4b6..0000000
Binary files a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/fac9042d and /dev/null differ
diff --git a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/faea9034 b/.config/.cache/v24.8.0-arm64-ef5a0af0-501/faea9034
deleted file mode 100644
index cfe6bca..0000000
Binary files a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/faea9034 and /dev/null differ
diff --git a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/faee39e3 b/.config/.cache/v24.8.0-arm64-ef5a0af0-501/faee39e3
deleted file mode 100644
index 7a6fa0b..0000000
Binary files a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/faee39e3 and /dev/null differ
diff --git a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/fb1306dc b/.config/.cache/v24.8.0-arm64-ef5a0af0-501/fb1306dc
deleted file mode 100644
index 9c4a4f2..0000000
Binary files a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/fb1306dc and /dev/null differ
diff --git a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/fb6e91a2 b/.config/.cache/v24.8.0-arm64-ef5a0af0-501/fb6e91a2
deleted file mode 100644
index ff263ad..0000000
Binary files a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/fb6e91a2 and /dev/null differ
diff --git a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/fb787605 b/.config/.cache/v24.8.0-arm64-ef5a0af0-501/fb787605
deleted file mode 100644
index 2cc5eda..0000000
Binary files a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/fb787605 and /dev/null differ
diff --git a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/fb981a60 b/.config/.cache/v24.8.0-arm64-ef5a0af0-501/fb981a60
deleted file mode 100644
index 1a9685f..0000000
Binary files a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/fb981a60 and /dev/null differ
diff --git a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/fba2fb05 b/.config/.cache/v24.8.0-arm64-ef5a0af0-501/fba2fb05
deleted file mode 100644
index 19986fa..0000000
Binary files a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/fba2fb05 and /dev/null differ
diff --git a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/fba8acb9 b/.config/.cache/v24.8.0-arm64-ef5a0af0-501/fba8acb9
deleted file mode 100644
index 7970169..0000000
Binary files a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/fba8acb9 and /dev/null differ
diff --git a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/fc44d68f b/.config/.cache/v24.8.0-arm64-ef5a0af0-501/fc44d68f
deleted file mode 100644
index 41afaac..0000000
Binary files a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/fc44d68f and /dev/null differ
diff --git a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/fc69caae b/.config/.cache/v24.8.0-arm64-ef5a0af0-501/fc69caae
deleted file mode 100644
index 49c3913..0000000
Binary files a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/fc69caae and /dev/null differ
diff --git a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/fcbe6c94 b/.config/.cache/v24.8.0-arm64-ef5a0af0-501/fcbe6c94
deleted file mode 100644
index f6d7d36..0000000
Binary files a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/fcbe6c94 and /dev/null differ
diff --git a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/fd8298eb b/.config/.cache/v24.8.0-arm64-ef5a0af0-501/fd8298eb
deleted file mode 100644
index e23a408..0000000
Binary files a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/fd8298eb and /dev/null differ
diff --git a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/fd82e3aa b/.config/.cache/v24.8.0-arm64-ef5a0af0-501/fd82e3aa
deleted file mode 100644
index 41e298e..0000000
Binary files a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/fd82e3aa and /dev/null differ
diff --git a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/fd8d7422 b/.config/.cache/v24.8.0-arm64-ef5a0af0-501/fd8d7422
deleted file mode 100644
index 6ab8a9f..0000000
Binary files a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/fd8d7422 and /dev/null differ
diff --git a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/fde7271e b/.config/.cache/v24.8.0-arm64-ef5a0af0-501/fde7271e
deleted file mode 100644
index cfb9018..0000000
Binary files a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/fde7271e and /dev/null differ
diff --git a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/fdf99405 b/.config/.cache/v24.8.0-arm64-ef5a0af0-501/fdf99405
deleted file mode 100644
index 695723a..0000000
Binary files a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/fdf99405 and /dev/null differ
diff --git a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/fe4317d6 b/.config/.cache/v24.8.0-arm64-ef5a0af0-501/fe4317d6
deleted file mode 100644
index 48b0a3c..0000000
Binary files a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/fe4317d6 and /dev/null differ
diff --git a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/fe6643a2 b/.config/.cache/v24.8.0-arm64-ef5a0af0-501/fe6643a2
deleted file mode 100644
index c6e6c8d..0000000
Binary files a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/fe6643a2 and /dev/null differ
diff --git a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/fed22034 b/.config/.cache/v24.8.0-arm64-ef5a0af0-501/fed22034
deleted file mode 100644
index a901060..0000000
Binary files a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/fed22034 and /dev/null differ
diff --git a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/fed3b3ec b/.config/.cache/v24.8.0-arm64-ef5a0af0-501/fed3b3ec
deleted file mode 100644
index 8c8610f..0000000
Binary files a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/fed3b3ec and /dev/null differ
diff --git a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/ff2bbe61 b/.config/.cache/v24.8.0-arm64-ef5a0af0-501/ff2bbe61
deleted file mode 100644
index 9a11581..0000000
Binary files a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/ff2bbe61 and /dev/null differ
diff --git a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/ff486b1b b/.config/.cache/v24.8.0-arm64-ef5a0af0-501/ff486b1b
deleted file mode 100644
index 983f580..0000000
Binary files a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/ff486b1b and /dev/null differ
diff --git a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/ff70c24c b/.config/.cache/v24.8.0-arm64-ef5a0af0-501/ff70c24c
deleted file mode 100644
index cd0978d..0000000
Binary files a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/ff70c24c and /dev/null differ
diff --git a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/ff75b07a b/.config/.cache/v24.8.0-arm64-ef5a0af0-501/ff75b07a
deleted file mode 100644
index c3d0e60..0000000
Binary files a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/ff75b07a and /dev/null differ
diff --git a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/ff883565 b/.config/.cache/v24.8.0-arm64-ef5a0af0-501/ff883565
deleted file mode 100644
index 76f407a..0000000
Binary files a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/ff883565 and /dev/null differ
diff --git a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/ff9797c6 b/.config/.cache/v24.8.0-arm64-ef5a0af0-501/ff9797c6
deleted file mode 100644
index 1001249..0000000
Binary files a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/ff9797c6 and /dev/null differ
diff --git a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/ffb8ab78 b/.config/.cache/v24.8.0-arm64-ef5a0af0-501/ffb8ab78
deleted file mode 100644
index f8f8704..0000000
Binary files a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/ffb8ab78 and /dev/null differ
diff --git a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/ffd97c8a b/.config/.cache/v24.8.0-arm64-ef5a0af0-501/ffd97c8a
deleted file mode 100644
index 34eb73f..0000000
Binary files a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/ffd97c8a and /dev/null differ
diff --git a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/ffdeceb6 b/.config/.cache/v24.8.0-arm64-ef5a0af0-501/ffdeceb6
deleted file mode 100644
index 72cb866..0000000
Binary files a/.config/.cache/v24.8.0-arm64-ef5a0af0-501/ffdeceb6 and /dev/null differ
diff --git a/.config/esbuild.config.mjs b/.config/esbuild.config.mjs
index ce7593f..fac3fe2 100644
--- a/.config/esbuild.config.mjs
+++ b/.config/esbuild.config.mjs
@@ -7,6 +7,8 @@ import path from 'node:path'
 import { fileURLToPath } from 'node:url'
 import fg from 'fast-glob'
 
+import { envAsBoolean } from '#socketsecurity/lib/env/helpers'
+
 const __dirname = path.dirname(fileURLToPath(import.meta.url))
 const rootPath = path.join(__dirname, '..')
 const srcPath = path.join(rootPath, 'src')
@@ -20,6 +22,226 @@ const entryPoints = fg.sync('**/*.{ts,mts,cts}', {
   ignore: ['**/*.d.ts', '**/types/**', '**/external/**'],
 })
 
+/**
+ * Plugin to shorten module paths in bundled output with conflict detection.
+ * Uses @babel/parser and magic-string for precise AST-based modifications.
+ */
+function createPathShorteningPlugin() {
+  return {
+    name: 'shorten-module-paths',
+    setup(build) {
+      build.onEnd(async result => {
+        if (!result.outputFiles && result.metafile) {
+          // Dynamic imports to avoid adding to production dependencies
+          const fs = await import('node:fs/promises')
+          const { parse } = await import('@babel/parser')
+          const MagicString = (await import('magic-string')).default
+
+          const outputs = Object.keys(result.metafile.outputs).filter(f =>
+            f.endsWith('.js'),
+          )
+
+          for (const outputPath of outputs) {
+            // eslint-disable-next-line no-await-in-loop
+            const content = await fs.readFile(outputPath, 'utf8')
+            const magicString = new MagicString(content)
+
+            // Track module paths and their shortened versions
+            // Map<originalPath, shortenedPath>
+            const pathMap = new Map()
+            // Track shortened paths to detect conflicts
+            // Map<shortenedPath, originalPath>
+            const conflictDetector = new Map()
+
+            /**
+             * Shorten a module path and detect conflicts.
+             */
+            // eslint-disable-next-line unicorn/consistent-function-scoping
+            const shortenPath = longPath => {
+              if (pathMap.has(longPath)) {
+                return pathMap.get(longPath)
+              }
+
+              let shortPath = longPath
+
+              // Handle pnpm scoped packages
+              // node_modules/.pnpm/@scope+pkg@version/node_modules/@scope/pkg/dist/file.js
+              // -> @scope/pkg/dist/file.js
+              const scopedPnpmMatch = longPath.match(
+                /node_modules\/\.pnpm\/@([^+/]+)\+([^@/]+)@[^/]+\/node_modules\/(@[^/]+\/[^/]+)\/(.+)/,
+              )
+              if (scopedPnpmMatch) {
+                const [, _scope, _pkg, packageName, subpath] = scopedPnpmMatch
+                shortPath = `${packageName}/${subpath}`
+              } else {
+                // Handle pnpm non-scoped packages
+                // node_modules/.pnpm/pkg@version/node_modules/pkg/dist/file.js
+                // -> pkg/dist/file.js
+                const pnpmMatch = longPath.match(
+                  /node_modules\/\.pnpm\/([^@/]+)@[^/]+\/node_modules\/([^/]+)\/(.+)/,
+                )
+                if (pnpmMatch) {
+                  const [, _pkgName, packageName, subpath] = pnpmMatch
+                  shortPath = `${packageName}/${subpath}`
+                }
+              }
+
+              // Detect conflicts
+              if (conflictDetector.has(shortPath)) {
+                const existingPath = conflictDetector.get(shortPath)
+                if (existingPath !== longPath) {
+                  // Conflict detected - keep original path
+                  console.warn(
+                    `⚠ Path conflict detected:\n  "${shortPath}"\n  Maps to: "${existingPath}"\n  Also from: "${longPath}"\n  Keeping original paths to avoid conflict.`,
+                  )
+                  shortPath = longPath
+                }
+              } else {
+                conflictDetector.set(shortPath, longPath)
+              }
+
+              pathMap.set(longPath, shortPath)
+              return shortPath
+            }
+
+            // Parse AST to find all string literals containing module paths
+            try {
+              const ast = parse(content, {
+                sourceType: 'module',
+                plugins: [],
+              })
+
+              // Walk through all comments (esbuild puts module paths in comments)
+              for (const comment of ast.comments || []) {
+                if (
+                  comment.type === 'CommentLine' &&
+                  comment.value.includes('node_modules')
+                ) {
+                  const originalPath = comment.value.trim()
+                  const shortPath = shortenPath(originalPath)
+
+                  if (shortPath !== originalPath) {
+                    // Replace in comment
+                    const commentStart = comment.start
+                    const commentEnd = comment.end
+                    magicString.overwrite(
+                      commentStart,
+                      commentEnd,
+                      `// ${shortPath}`,
+                    )
+                  }
+                }
+              }
+
+              // Walk through all string literals in __commonJS calls
+              const walk = node => {
+                if (!node || typeof node !== 'object') {
+                  return
+                }
+
+                // Check for string literals containing node_modules paths
+                if (
+                  node.type === 'StringLiteral' &&
+                  node.value &&
+                  node.value.includes('node_modules')
+                ) {
+                  const originalPath = node.value
+                  const shortPath = shortenPath(originalPath)
+
+                  if (shortPath !== originalPath) {
+                    // Replace the string content (keep quotes)
+                    magicString.overwrite(
+                      node.start + 1,
+                      node.end - 1,
+                      shortPath,
+                    )
+                  }
+                }
+
+                // Recursively walk all properties
+                for (const key of Object.keys(node)) {
+                  if (key === 'start' || key === 'end' || key === 'loc') {
+                    continue
+                  }
+                  const value = node[key]
+                  if (Array.isArray(value)) {
+                    for (const item of value) {
+                      walk(item)
+                    }
+                  } else {
+                    walk(value)
+                  }
+                }
+              }
+
+              walk(ast.program)
+
+              // Write the modified content
+              // eslint-disable-next-line no-await-in-loop
+              await fs.writeFile(outputPath, magicString.toString(), 'utf8')
+            } catch (error) {
+              console.error(
+                `Failed to shorten paths in ${outputPath}:`,
+                error.message,
+              )
+              // Continue without failing the build
+            }
+          }
+        }
+      })
+    },
+  }
+}
+
+/**
+ * Plugin to resolve internal path aliases (#lib/*, #constants/*, etc.) to relative paths
+ */
+function createPathAliasPlugin() {
+  return {
+    name: 'internal-path-aliases',
+    setup(build) {
+      // Map of path aliases to their actual directories
+      const pathAliases = {
+        '#lib/': srcPath,
+        '#constants/': path.join(srcPath, 'constants'),
+        '#env/': path.join(srcPath, 'env'),
+        '#packages/': path.join(srcPath, 'packages'),
+        '#utils/': path.join(srcPath, 'utils'),
+        '#types': path.join(srcPath, 'types'),
+      }
+
+      // Intercept imports for path aliases
+      for (const [alias, basePath] of Object.entries(pathAliases)) {
+        const isExact = !alias.endsWith('/')
+        const filter = isExact
+          ? new RegExp(`^${alias.replace(/[.*+?^${}()|[\]\\]/g, '\\$&')}$`)
+          : new RegExp(`^${alias.replace(/[.*+?^${}()|[\]\\]/g, '\\$&')}`)
+
+        build.onResolve({ filter }, args => {
+          // Calculate the subpath after the alias
+          const subpath = isExact ? '' : args.path.slice(alias.length)
+          const targetPath = subpath ? path.join(basePath, subpath) : basePath
+
+          // Calculate relative path from the importing file to the target
+          const importer = args.importer || srcPath
+          const importerDir = path.dirname(importer)
+          let relativePath = path.relative(importerDir, targetPath)
+
+          // Ensure relative paths start with ./ or ../
+          if (!relativePath.startsWith('.')) {
+            relativePath = `./${relativePath}`
+          }
+
+          // Normalize to forward slashes for consistency
+          relativePath = relativePath.replace(/\\/g, '/')
+
+          return { path: relativePath, external: true }
+        })
+      }
+    },
+  }
+}
+
 // Build configuration for CommonJS output
 export const buildConfig = {
   entryPoints,
@@ -30,20 +252,33 @@ export const buildConfig = {
   format: 'cjs',
   platform: 'node',
   target: 'node18',
-  sourcemap: true,
-  // Library code should be readable.
+  // Enable source maps for coverage (set COVERAGE=true env var)
+  sourcemap: envAsBoolean(process.env.COVERAGE),
+  // Don't minify - this is a library and minification breaks ESM/CJS interop.
   minify: false,
-  // Can't tree-shake without bundling.
-  treeShaking: false,
+  // Tree-shaking optimization.
+  treeShaking: true,
   metafile: true,
   logLevel: 'info',
 
-  // Note: Cannot use "external" with bundle: false
-  // esbuild automatically treats all imports as external when not bundling
+  // Use plugins for path shortening and aliases
+  plugins: [createPathShorteningPlugin(), createPathAliasPlugin()].filter(
+    Boolean,
+  ),
+
+  // Note: Cannot use "external" with bundle: false.
+  // esbuild automatically treats all imports as external when not bundling.
+
+  // Define constants for optimization
+  define: {
+    'process.env.NODE_ENV': JSON.stringify(
+      process.env.NODE_ENV || 'production',
+    ),
+  },
 
   // Banner for generated code
   banner: {
-    js: '/* Socket Lib - Built with esbuild */',
+    js: '"use strict";\n/* Socket Lib - Built with esbuild */',
   },
 }
 
diff --git a/.config/eslint.config.mjs b/.config/eslint.config.mjs
index 64d7454..875ee37 100644
--- a/.config/eslint.config.mjs
+++ b/.config/eslint.config.mjs
@@ -7,26 +7,21 @@ import {
   includeIgnoreFile,
 } from '@eslint/compat'
 import js from '@eslint/js'
-import { readPackageJsonSync } from '@socketsecurity/registry/lib/packages'
 import { createTypeScriptImportResolver } from 'eslint-import-resolver-typescript'
 import { flatConfigs as origImportXFlatConfigs } from 'eslint-plugin-import-x'
 import nodePlugin from 'eslint-plugin-n'
 import sortDestructureKeysPlugin from 'eslint-plugin-sort-destructure-keys'
 import unicornPlugin from 'eslint-plugin-unicorn'
-import fastGlob from 'fast-glob'
 import globals from 'globals'
 import tsEslint from 'typescript-eslint'
-import constants from '../scripts/constants.mjs'
 
 // Resolve current module paths for proper configuration loading.
 const __filename = fileURLToPath(import.meta.url)
 const __dirname = path.dirname(__filename)
 const require = createRequire(import.meta.url)
 
-const { gitIgnoreFile, npmPackagesPath, relNpmPackagesPath, rootTsConfigPath } =
-  constants
-
 const rootPath = path.dirname(__dirname)
+const rootTsConfigPath = path.join(rootPath, 'tsconfig.json')
 
 // Convert Node.js globals to readonly format for ESLint configuration.
 // This ensures Node.js built-ins are recognized but not modifiable.
@@ -56,33 +51,18 @@ const gitIgnores = {
 // Enable only for comprehensive checks before releases.
 if (process.env.LINT_EXTERNAL) {
   const isNotExternalGlobPattern = p => !/(?:^|[\\/])external/.test(p)
-  biomeIgnores.ignores = biomeIgnores.ignores?.filter(isNotExternalGlobPattern)
-  gitIgnores.ignores = gitIgnores.ignores?.filter(isNotExternalGlobPattern)
+  if (biomeIgnores.ignores) {
+    biomeIgnores.ignores = biomeIgnores.ignores.filter(isNotExternalGlobPattern)
+  }
+  if (gitIgnores.ignores) {
+    gitIgnores.ignores = gitIgnores.ignores.filter(isNotExternalGlobPattern)
+  }
 }
 
-// OPTIMIZATION: Dynamically generate ignore patterns based on package types.
-// This prevents ESLint from checking incompatible module types, reducing
-// false positives and improving linting performance by skipping unnecessary files.
-function getIgnores(isEsm) {
-  return constants.npmPackageNames.flatMap(sockRegPkgName => {
-    const pkgPath = path.join(npmPackagesPath, sockRegPkgName)
-    const { type } = readPackageJsonSync(pkgPath)
-    const ignored = []
-    if (isEsm ? type !== 'module' : type === 'module') {
-      ignored.push(`${relNpmPackagesPath}/${sockRegPkgName}/*`)
-    } else if (!isEsm) {
-      ignored.push(`${relNpmPackagesPath}/${sockRegPkgName}/*.mjs`)
-      if (
-        fastGlob.globSync(['**/*.cjs'], {
-          cwd: pkgPath,
-          ignores: constants.ignoreGlobs,
-        }).length
-      ) {
-        ignored.push(`${relNpmPackagesPath}/${sockRegPkgName}/*.js`)
-      }
-    }
-    return ignored
-  })
+// OPTIMIZATION: For socket-lib (single package), no dynamic ignore patterns needed.
+// This is a simplified version for non-monorepo usage.
+function getIgnores(_isEsm) {
+  return []
 }
 
 function getImportXFlatConfigs(isEsm) {
@@ -152,18 +132,19 @@ function configs(sourceType) {
     // patterns used in package.json "files" fields. In those cases we simplify
     // the glob patterns used.
     'n/no-unpublished-bin': 'error',
+    'no-unexpected-multiline': 'off',
     'n/no-unsupported-features/es-builtins': [
       'error',
       {
         ignores: ['Object.groupBy'],
-        version: constants.maintainedNodeVersions.current,
+        version: '>=22',
       },
     ],
     'n/no-unsupported-features/es-syntax': [
       'error',
       {
         ignores: ['object-map-groupby'],
-        version: constants.maintainedNodeVersions.current,
+        version: '>=22',
       },
     ],
     'n/no-unsupported-features/node-builtins': [
@@ -182,10 +163,10 @@ function configs(sourceType) {
           'ReadableStream',
           'Response',
         ],
-        version: constants.maintainedNodeVersions.current,
+        version: '>=22',
       },
     ],
-    'n/prefer-node-protocol': 'error',
+    'n/prefer-node-protocol': 'off',
     'unicorn/consistent-function-scoping': 'error',
     curly: 'error',
     'no-await-in-loop': 'error',
@@ -258,20 +239,11 @@ function configs(sourceType) {
         parser: tsEslint.parser,
         parserOptions: {
           ...importFlatConfigs.typescript.languageOptions?.parserOptions,
-          projectService: {
-            ...importFlatConfigs.typescript.languageOptions?.parserOptions
-              ?.projectService,
-            allowDefaultProject: [
-              // Add constants type definitions.
-              'registry/src/lib/constants/*.d.ts',
-            ],
-            defaultProject: 'tsconfig.json',
-            // PERFORMANCE TRADEOFF: Increase file match limit from default 8 to 1000.
-            // This slows initial parsing but allows TypeScript-aware linting of all
-            // npm package overrides without requiring individual tsconfig files.
-            maximumDefaultProjectFileMatchCount_THIS_WILL_SLOW_DOWN_LINTING: 1000,
-            tsconfigRootDir: rootPath,
-          },
+          project: [
+            path.join(rootPath, 'tsconfig.json'),
+            path.join(rootPath, 'tsconfig.test.json'),
+          ],
+          tsconfigRootDir: rootPath,
         },
       },
       plugins: {
@@ -336,8 +308,8 @@ function configs(sourceType) {
   ]
 }
 
-export default [
-  gitIgnoreFile,
+const eslintConfig = [
+  gitIgnores,
   biomeIgnores,
   {
     ignores: [
@@ -373,11 +345,16 @@ export default [
     },
   },
   {
-    // Disable import resolution rules for test files importing from scripts.
-    files: ['test/**/*.ts'],
+    // Relax rules for test files - testing code has different conventions
+    files: ['test/**/*.ts', 'test/**/*.mts'],
     rules: {
       'n/no-missing-import': 'off',
       'import-x/no-unresolved': 'off',
+      'line-comment-position': 'off',
+      'unicorn/consistent-function-scoping': 'off',
+      'no-undef': 'off', // TypeScript handles this
+      'no-import-assign': 'off', // Tests intentionally reassign imports to test immutability
+      'no-await-in-loop': 'off', // Tests often need to await in loops
     },
   },
   {
@@ -389,3 +366,6 @@ export default [
     },
   },
 ]
+
+export { eslintConfig }
+export default eslintConfig
diff --git a/.config/isolated-tests.json b/.config/isolated-tests.json
deleted file mode 100644
index 08b8a0e..0000000
--- a/.config/isolated-tests.json
+++ /dev/null
@@ -1,3 +0,0 @@
-{
-  "tests": []
-}
diff --git a/.config/taze.config.mts b/.config/taze.config.mts
index 8a55df6..8714380 100644
--- a/.config/taze.config.mts
+++ b/.config/taze.config.mts
@@ -1,6 +1,6 @@
 import { defineConfig } from 'taze'
 
-export default defineConfig({
+const tazeConfig = defineConfig({
   // Exclude these packages.
   exclude: [
     'debug',
@@ -22,3 +22,6 @@ export default defineConfig({
   // Write to package.json automatically.
   write: true,
 })
+
+export { tazeConfig }
+export default tazeConfig
diff --git a/.config/tsconfig.check.json b/.config/tsconfig.check.json
new file mode 100644
index 0000000..e1e983f
--- /dev/null
+++ b/.config/tsconfig.check.json
@@ -0,0 +1,13 @@
+{
+  "extends": "../tsconfig.json",
+  "compilerOptions": {
+    "noEmit": true,
+    "rootDir": "..",
+    "types": ["node", "vitest"],
+    "skipLibCheck": true,
+    "strict": false,
+    "noImplicitAny": false
+  },
+  "include": ["../src/**/*.ts", "../test/**/*.ts", "../test/**/*.mts"],
+  "exclude": ["../node_modules", "../dist/**/*"]
+}
diff --git a/.config/tsconfig.external-aliases.json b/.config/tsconfig.external-aliases.json
new file mode 100644
index 0000000..6382128
--- /dev/null
+++ b/.config/tsconfig.external-aliases.json
@@ -0,0 +1,29 @@
+{
+  "extends": "./tsconfig.check.json",
+  "compilerOptions": {
+    "paths": {
+      "#constants/*": ["../src/constants/*"],
+      "#env/*": ["../src/env/*"],
+      "#lib/*": ["../src/*"],
+      "#packages/*": ["../src/packages/*"],
+      "#types": ["../src/types"],
+      "#utils/*": ["../src/utils/*"],
+      "cacache": ["../src/external/cacache"],
+      "make-fetch-happen": ["../src/external/make-fetch-happen"],
+      "fast-sort": ["../src/external/fast-sort"],
+      "pacote": ["../src/external/pacote"],
+      "@socketsecurity/lib": ["../../socket-lib/dist/index.d.ts"],
+      "@socketsecurity/lib/*": ["../../socket-lib/dist/*"],
+      "@socketsecurity/registry": [
+        "../../socket-registry/registry/dist/index.d.ts"
+      ],
+      "@socketsecurity/registry/*": ["../../socket-registry/registry/dist/*"],
+      "@socketregistry/packageurl-js": [
+        "../../socket-packageurl-js/dist/index.d.ts"
+      ],
+      "@socketregistry/packageurl-js/*": ["../../socket-packageurl-js/dist/*"],
+      "@socketsecurity/sdk": ["../../socket-sdk-js/dist/index.d.ts"],
+      "@socketsecurity/sdk/*": ["../../socket-sdk-js/dist/*"]
+    }
+  }
+}
diff --git a/.config/vitest.config.isolated.mts b/.config/vitest.config.isolated.mts
index 8940dcb..c0afb62 100644
--- a/.config/vitest.config.isolated.mts
+++ b/.config/vitest.config.isolated.mts
@@ -1,67 +1,75 @@
 /**
- * @fileoverview Vitest configuration for tests requiring full isolation.
- * Used for tests that need vi.doMock() or other module-level mocking.
+ * @fileoverview Vitest configuration for isolated tests
+ * Tests that require full isolation due to shared module state
  */
+
+import path from 'node:path'
+import { fileURLToPath } from 'node:url'
 import { defineConfig } from 'vitest/config'
 
-// Check if coverage is enabled via CLI flags or environment.
-const isCoverageEnabled =
-  process.env.COVERAGE === 'true' ||
-  process.env.npm_lifecycle_event?.includes('coverage') ||
-  process.argv.some(arg => arg.includes('coverage'))
+const __dirname = path.dirname(fileURLToPath(import.meta.url))
+const projectRoot = path.resolve(__dirname, '..')
+
+// Normalize paths for cross-platform glob patterns (forward slashes on Windows)
+const toGlobPath = (pathLike: string): string => pathLike.replaceAll('\\', '/')
 
-export default defineConfig({
+const vitestConfigIsolated = defineConfig({
+  cacheDir: path.resolve(projectRoot, '.cache/vitest-isolated'),
+  resolve: {
+    preserveSymlinks: false,
+    extensions: ['.mts', '.ts', '.mjs', '.js', '.json'],
+    alias: {
+      '#env/ci': path.resolve(projectRoot, 'src/env/ci.ts'),
+      '#env': path.resolve(projectRoot, 'src/env'),
+      '#constants': path.resolve(projectRoot, 'src/constants'),
+      '#lib': path.resolve(projectRoot, 'src/lib'),
+      '#packages': path.resolve(projectRoot, 'src/lib/packages'),
+      '#types': path.resolve(projectRoot, 'src/types.ts'),
+      '#utils': path.resolve(projectRoot, 'src/utils'),
+      cacache: path.resolve(projectRoot, 'src/external/cacache'),
+      'make-fetch-happen': path.resolve(
+        projectRoot,
+        'src/external/make-fetch-happen',
+      ),
+      'fast-sort': path.resolve(projectRoot, 'src/external/fast-sort'),
+      pacote: path.resolve(projectRoot, 'src/external/pacote'),
+      '@socketregistry/scripts': path.resolve(projectRoot, 'scripts'),
+      '@socketsecurity/lib/stdio/prompts': path.resolve(
+        projectRoot,
+        'src/stdio/prompts/index.ts',
+      ),
+      '@socketsecurity/lib': path.resolve(projectRoot, 'src'),
+    },
+  },
   test: {
+    globalSetup: [path.resolve(__dirname, 'vitest-global-setup.mts')],
     globals: false,
     environment: 'node',
-    include: ['test/**/*.test.{js,ts,mjs,mts,cjs}'],
+    include: [
+      toGlobPath(
+        path.resolve(projectRoot, 'test/isolated/**/*.test.{js,ts,mjs,mts}'),
+      ),
+    ],
+    exclude: ['**/node_modules/**', '**/dist/**'],
     reporters: ['default'],
-    setupFiles: ['./test/utils/setup.mts'],
-    // Use forks for full isolation
-    pool: 'forks',
+    // Full isolation for tests that modify shared module state
+    pool: 'threads',
     poolOptions: {
-      forks: {
-        // Use single fork for coverage, parallel otherwise
-        singleFork: isCoverageEnabled,
-        maxForks: isCoverageEnabled ? 1 : 8,
-        minForks: isCoverageEnabled ? 1 : 2,
+      threads: {
+        singleThread: true,
+        maxThreads: 1,
+        minThreads: 1,
+        isolate: true,
+        useAtomics: true,
       },
     },
     testTimeout: 10_000,
     hookTimeout: 10_000,
-    // Share coverage settings with main config
-    coverage: {
-      provider: 'v8',
-      reporter: ['text', 'json', 'html', 'lcov', 'clover'],
-      exclude: [
-        '**/*.config.*',
-        '**/node_modules/**',
-        '**/[.]**',
-        '**/*.d.ts',
-        '**/virtual:*',
-        'coverage/**',
-        'dist/**',
-        'scripts/**',
-        'types/**',
-        'test/**',
-        '**/*.mjs',
-        '**/*.cjs',
-        'src/types.ts',
-        'perf/**',
-        '/scripts/**',
-        '/test/**',
-      ],
-      include: ['src/**/*.{ts,mts,cts}'],
-      all: true,
-      clean: true,
-      skipFull: false,
-      ignoreClassMethods: ['constructor'],
-      thresholds: {
-        lines: 99,
-        functions: 99,
-        branches: 99,
-        statements: 99,
-      },
+    sequence: {
+      concurrent: false,
     },
   },
 })
+
+export { vitestConfigIsolated }
+export default vitestConfigIsolated
diff --git a/.config/vitest.config.mts b/.config/vitest.config.mts
index d7b5918..42497ce 100644
--- a/.config/vitest.config.mts
+++ b/.config/vitest.config.mts
@@ -9,20 +9,23 @@ import { defineConfig } from 'vitest/config'
 const __dirname = path.dirname(fileURLToPath(import.meta.url))
 const projectRoot = path.resolve(__dirname, '..')
 
+// Normalize paths for cross-platform glob patterns (forward slashes on Windows)
+const toGlobPath = (pathLike: string): string => pathLike.replaceAll('\\', '/')
+
 // Coverage mode detection
 const isCoverageEnabled =
   process.env.COVERAGE === 'true' ||
   process.env.npm_lifecycle_event?.includes('coverage') ||
   process.argv.some(arg => arg.includes('coverage'))
 
-export default defineConfig({
+const vitestConfig = defineConfig({
+  cacheDir: path.resolve(projectRoot, '.cache/vitest'),
   resolve: {
     preserveSymlinks: false,
     extensions: isCoverageEnabled
       ? ['.ts', '.mts', '.cts', '.js', '.mjs', '.cjs', '.json']
       : ['.mts', '.ts', '.mjs', '.js', '.json'],
     alias: {
-      '#env/ci': path.resolve(projectRoot, 'src/env/ci.ts'),
       '#env': path.resolve(projectRoot, 'src/env'),
       '#constants': path.resolve(projectRoot, 'src/constants'),
       '#lib': path.resolve(projectRoot, 'src/lib'),
@@ -37,6 +40,10 @@ export default defineConfig({
       'fast-sort': path.resolve(projectRoot, 'src/external/fast-sort'),
       pacote: path.resolve(projectRoot, 'src/external/pacote'),
       '@socketregistry/scripts': path.resolve(projectRoot, 'scripts'),
+      '@socketsecurity/lib/stdio/prompts': path.resolve(
+        projectRoot,
+        'src/stdio/prompts/index.ts',
+      ),
       '@socketsecurity/lib': path.resolve(projectRoot, 'src'),
     },
   },
@@ -45,31 +52,70 @@ export default defineConfig({
     globals: false,
     environment: 'node',
     include: [
-      path.resolve(projectRoot, 'test/**/*.test.{js,ts,mjs,mts,cjs,cts}'),
+      toGlobPath(
+        path.resolve(
+          projectRoot,
+          'test/unit/**/*.test.{js,ts,mjs,mts,cjs,cts}',
+        ),
+      ),
+      toGlobPath(
+        path.resolve(
+          projectRoot,
+          'test/integration/**/*.test.{js,ts,mjs,mts,cjs,cts}',
+        ),
+      ),
     ],
     exclude: [
       '**/node_modules/**',
       '**/dist/**',
+      '**/dist/external/**',
+      toGlobPath(path.resolve(projectRoot, 'test/isolated/**')),
       ...(process.env.INCLUDE_NPM_TESTS
         ? []
-        : [path.resolve(projectRoot, 'test/npm/**')]),
+        : [toGlobPath(path.resolve(projectRoot, 'test/npm/**'))]),
     ],
     reporters: ['default'],
+    // Optimize test execution for speed
+    // Threads are faster than forks
     pool: 'threads',
     poolOptions: {
       threads: {
+        // Maximize parallelism for speed
+        // During coverage, use single thread for deterministic execution
         singleThread: isCoverageEnabled,
         maxThreads: isCoverageEnabled ? 1 : 16,
         minThreads: isCoverageEnabled ? 1 : 4,
-        // Use isolate: false for performance and test compatibility
+        // IMPORTANT: isolate: false for performance and test compatibility
+        //
+        // Tradeoff Analysis:
+        // - isolate: true  = Full isolation, slower, breaks nock/module mocking
+        // - isolate: false = Shared worker context, faster, mocking works
+        //
+        // We choose isolate: false because:
+        // 1. Significant performance improvement (faster test runs)
+        // 2. HTTP mocking works correctly across all test files
+        // 3. Vi.mock() module mocking functions properly
+        // 4. Test state pollution is prevented through proper beforeEach/afterEach
+        // 5. Our tests are designed to clean up after themselves
+        // 6. The rewire module uses globalThis singleton to handle coverage module duplication
         isolate: false,
         useAtomics: true,
       },
     },
+    // Reduce timeouts for faster failures
     testTimeout: 10_000,
     hookTimeout: 10_000,
+    // Speed optimizations
+    sequence: {
+      // Run tests concurrently within suites
+      concurrent: true,
+    },
+    // Bail early on first failure in CI
+    bail: process.env.CI ? 1 : 0,
     server: {
       deps: {
+        // Note: inlining @socketsecurity/lib in coverage mode would cause duplicate module instances
+        // The rewire module uses globalThis singleton to handle this, so inlining is not needed
         inline: isCoverageEnabled ? [/@socketsecurity\/lib/, 'zod'] : ['zod'],
       },
     },
@@ -87,22 +133,36 @@ export default defineConfig({
         'test/**',
         'packages/**',
         'perf/**',
+        // Exclude all dist directory and its contents
         'dist/**',
+        '**/dist/**',
+        '**/{dist,build,out}/**',
+        // Exclude external bundled dependencies from both src and dist
         'src/external/**',
+        'dist/external/**',
+        '**/external/**',
         'src/types.ts',
         'scripts/**',
       ],
-      include: ['src/**/*.{ts,mts,cts}'],
+      include: [
+        'src/**/*.{ts,mts,cts}',
+        // Explicitly exclude external from include
+        '!src/external/**',
+      ],
+      excludeAfterRemap: true,
       all: true,
       clean: true,
       skipFull: false,
       ignoreClassMethods: ['constructor'],
       thresholds: {
-        lines: 1,
-        functions: 68,
+        lines: 68,
+        functions: 70,
         branches: 70,
-        statements: 1,
+        statements: 68,
       },
     },
   },
 })
+
+export { vitestConfig }
+export default vitestConfig
diff --git a/.config/vitest.config.optimized.mts b/.config/vitest.config.optimized.mts
deleted file mode 100644
index c1177a8..0000000
--- a/.config/vitest.config.optimized.mts
+++ /dev/null
@@ -1,123 +0,0 @@
-import path from 'node:path'
-import { fileURLToPath } from 'node:url'
-import { defineConfig } from 'vitest/config'
-
-import { createImportTransformPlugin } from './vitest-plugins/import-transform.mts'
-import { createRequireTransformPlugin } from './vitest-plugins/require-transform.mts'
-
-const __dirname = path.dirname(fileURLToPath(import.meta.url))
-const projectRoot = path.resolve(__dirname, '..')
-
-const isCoverageEnabled =
-  process.env.COVERAGE === 'true' ||
-  process.env.npm_lifecycle_event?.includes('coverage') ||
-  process.argv.some(arg => arg.includes('coverage'))
-
-export default defineConfig({
-  cacheDir: 'node_modules/.vitest',
-  plugins: [
-    createImportTransformPlugin(isCoverageEnabled, __dirname),
-    createRequireTransformPlugin(),
-  ],
-  resolve: {
-    preserveSymlinks: false,
-    extensions: isCoverageEnabled
-      ? ['.ts', '.mts', '.cts', '.js', '.mjs', '.cjs', '.json']
-      : ['.mts', '.ts', '.mjs', '.js', '.json'],
-    alias: [
-      {
-        find: '@socketregistry/scripts',
-        replacement: path.resolve(projectRoot, 'scripts'),
-      },
-      ...(isCoverageEnabled
-        ? [
-            {
-              find: '@socketsecurity/registry',
-              replacement: path.resolve(projectRoot, 'registry/src'),
-            },
-            {
-              find: /^\.\.\/\.\.\/registry\/dist\/(.*)\.js$/,
-              replacement: path.resolve(projectRoot, 'registry/src/$1.ts'),
-            },
-          ]
-        : []),
-    ],
-  },
-  test: {
-    globalSetup: [path.resolve(__dirname, 'vitest-global-setup.mts')],
-    globals: false,
-    environment: 'node',
-    include: ['test/**/*.test.{js,ts,mjs,mts,cjs,cts}'],
-    exclude: [
-      '**/node_modules/**',
-      '**/dist/**',
-      ...(process.env.INCLUDE_NPM_TESTS ? [] : ['test/npm/**']),
-    ],
-    reporters: ['default'],
-
-    // OPTIMIZATIONS for speed
-    pool: 'threads', // Threads are faster than forks for most tests
-    poolOptions: {
-      threads: {
-        // Use all available CPUs for maximum parallelization
-        maxThreads: isCoverageEnabled ? 1 : undefined,
-        minThreads: isCoverageEnabled ? 1 : 4,
-        singleThread: isCoverageEnabled,
-        // Reuse threads to avoid creation overhead
-        isolate: false,
-      },
-    },
-
-    // Reduce timeouts for faster failure detection
-    testTimeout: 30_000, // Reduced from 60s
-    hookTimeout: 30_000, // Reduced from 60s
-
-    // Cache transformation results (moved to vite's cacheDir)
-
-    // Optimize file watching
-    fileParallelism: true,
-
-    // Skip slow operations
-    slowTestThreshold: 1000, // Warn about tests slower than 1s
-
-    server: {
-      deps: {
-        inline: isCoverageEnabled ? [/@socketsecurity\/registry/] : [],
-        // Optimize dependency handling
-        optimizer: {
-          enabled: !isCoverageEnabled,
-        },
-      },
-    },
-
-    coverage: {
-      provider: 'v8',
-      enabled: isCoverageEnabled,
-      reportsDirectory: 'coverage',
-      reporter: ['text', 'json-summary', 'lcov'], // Reduced reporters
-      exclude: [
-        '**/*.config.*',
-        '**/node_modules/**',
-        '**/[.]**',
-        '**/*.d.ts',
-        'coverage/**',
-        'scripts/**',
-        'test/**',
-        'packages/**',
-        'perf/**',
-      ],
-      include: isCoverageEnabled
-        ? ['src/**/*.{ts,mts,cts}']
-        : ['dist/**/*.{js,mjs,cjs}'],
-      all: true,
-      clean: true,
-      skipFull: true, // Skip files with 100% coverage
-      thresholds: {
-        lines: 55,
-        functions: 55,
-        branches: 55,
-        statements: 55,
-      },
-    },
-  },
-})
diff --git a/.env.test b/.env.test
new file mode 100644
index 0000000..fe1b545
--- /dev/null
+++ b/.env.test
@@ -0,0 +1,8 @@
+# Test environment variables
+# This file is used by the test runner via dotenvx
+#
+# REQUIRED: dotenvx on Windows requires this file to exist, even if empty
+# The test runner (scripts/test.mjs) loads this file before running tests
+#
+# Add any test-specific environment variables below
+
diff --git a/.git-hooks/commit-msg b/.git-hooks/commit-msg
new file mode 100755
index 0000000..6319bd9
--- /dev/null
+++ b/.git-hooks/commit-msg
@@ -0,0 +1,73 @@
+#!/bin/bash
+# Socket Security Commit-msg Hook
+# Additional security layer - validates commit even if pre-commit was bypassed.
+
+set -e
+
+# Colors for output.
+RED='\033[0;31m'
+GREEN='\033[0;32m'
+NC='\033[0m'
+
+# Allowed public API key (used in socket-lib).
+ALLOWED_PUBLIC_KEY="sktsec_t_--RAN5U4ivauy4w37-6aoKyYPDt5ZbaT5JBVMqiwKo_api"
+
+ERRORS=0
+
+# Get files in this commit (for security checks).
+COMMITTED_FILES=$(git diff --cached --name-only --diff-filter=ACM 2>/dev/null || printf "\n")
+
+# Quick checks for critical issues in committed files.
+if [ -n "$COMMITTED_FILES" ]; then
+  for file in $COMMITTED_FILES; do
+    if [ -f "$file" ]; then
+      # Check for Socket API keys (except allowed).
+      if grep -E 'sktsec_[a-zA-Z0-9_-]+' "$file" 2>/dev/null | grep -v "$ALLOWED_PUBLIC_KEY" | grep -v 'your_api_key_here' | grep -v 'fake-token' | grep -v 'test-token' | grep -v '\.example' | grep -q .; then
+        printf "${RED}✗ SECURITY: Potential API key detected in commit!${NC}\n"
+        printf "File: %s\n" "$file"
+        ERRORS=$((ERRORS + 1))
+      fi
+
+      # Check for .env files.
+      if echo "$file" | grep -qE '^\.env(\.local)?$'; then
+        printf "${RED}✗ SECURITY: .env file in commit!${NC}\n"
+        ERRORS=$((ERRORS + 1))
+      fi
+    fi
+  done
+fi
+
+# Auto-strip AI attribution from commit message.
+COMMIT_MSG_FILE="$1"
+if [ -f "$COMMIT_MSG_FILE" ]; then
+  # Create a temporary file to store the cleaned message.
+  TEMP_FILE=$(mktemp)
+  REMOVED_LINES=0
+
+  # Read the commit message line by line and filter out AI attribution.
+  while IFS= read -r line || [ -n "$line" ]; do
+    # Check if this line contains AI attribution patterns.
+    if echo "$line" | grep -qiE "(Generated with|Co-Authored-By: Claude|Co-Authored-By: AI|🤖 Generated|AI generated|Claude Code|@anthropic|Assistant:|Generated by Claude|Machine generated)"; then
+      REMOVED_LINES=$((REMOVED_LINES + 1))
+    else
+      # Line doesn't contain AI attribution, keep it.
+      printf '%s\n' "$line" >> "$TEMP_FILE"
+    fi
+  done < "$COMMIT_MSG_FILE"
+
+  # Replace the original commit message with the cleaned version.
+  if [ $REMOVED_LINES -gt 0 ]; then
+    mv "$TEMP_FILE" "$COMMIT_MSG_FILE"
+    printf "${GREEN}✓ Auto-stripped${NC} $REMOVED_LINES AI attribution line(s) from commit message\n"
+  else
+    # No lines were removed, just clean up the temp file.
+    rm -f "$TEMP_FILE"
+  fi
+fi
+
+if [ $ERRORS -gt 0 ]; then
+  printf "${RED}✗ Commit blocked by security validation${NC}\n"
+  exit 1
+fi
+
+exit 0
diff --git a/.git-hooks/pre-commit b/.git-hooks/pre-commit
new file mode 100755
index 0000000..28c0da6
--- /dev/null
+++ b/.git-hooks/pre-commit
@@ -0,0 +1,123 @@
+#!/bin/bash
+# Socket Security Checks
+# Prevents committing sensitive data and common mistakes.
+
+set -e
+
+# Colors for output.
+RED='\033[0;31m'
+YELLOW='\033[1;33m'
+GREEN='\033[0;32m'
+NC='\033[0m'
+
+# Allowed public API key (used in socket-lib).
+ALLOWED_PUBLIC_KEY="sktsec_t_--RAN5U4ivauy4w37-6aoKyYPDt5ZbaT5JBVMqiwKo_api"
+
+printf "${GREEN}Running Socket Security checks...${NC}\n"
+
+# Get list of staged files.
+STAGED_FILES=$(git diff --cached --name-only --diff-filter=ACM)
+
+if [ -z "$STAGED_FILES" ]; then
+  printf "${GREEN}✓ No files to check${NC}\n"
+  exit 0
+fi
+
+ERRORS=0
+
+# Check for .DS_Store files.
+printf "Checking for .DS_Store files...\n"
+if echo "$STAGED_FILES" | grep -q '\.DS_Store'; then
+  printf "${RED}✗ ERROR: .DS_Store file detected!${NC}\n"
+  echo "$STAGED_FILES" | grep '\.DS_Store'
+  ERRORS=$((ERRORS + 1))
+fi
+
+# Check for log files.
+printf "Checking for log files...\n"
+if echo "$STAGED_FILES" | grep -E '\.log$' | grep -v 'test.*\.log'; then
+  printf "${RED}✗ ERROR: Log file detected!${NC}\n"
+  echo "$STAGED_FILES" | grep -E '\.log$' | grep -v 'test.*\.log'
+  ERRORS=$((ERRORS + 1))
+fi
+
+# Check for .env files.
+printf "Checking for .env files...\n"
+if echo "$STAGED_FILES" | grep -E '^\.env(\.local)?$'; then
+  printf "${RED}✗ ERROR: .env or .env.local file detected!${NC}\n"
+  echo "$STAGED_FILES" | grep -E '^\.env(\.local)?$'
+  printf "These files should never be committed. Use .env.example instead.\n"
+  ERRORS=$((ERRORS + 1))
+fi
+
+# Check for hardcoded user paths (generic detection).
+printf "Checking for hardcoded personal paths...\n"
+for file in $STAGED_FILES; do
+  if [ -f "$file" ]; then
+    # Skip test files and hook scripts.
+    if echo "$file" | grep -qE '\.(test|spec)\.|/test/|/tests/|fixtures/|\.git-hooks/|\.husky/'; then
+      continue
+    fi
+
+    # Check for common user path patterns.
+    if grep -E '(/Users/[^/\s]+/|/home/[^/\s]+/|C:\\Users\\[^\\]+\\)' "$file" 2>/dev/null | grep -q .; then
+      printf "${RED}✗ ERROR: Hardcoded personal path found in: $file${NC}\n"
+      grep -n -E '(/Users/[^/\s]+/|/home/[^/\s]+/|C:\\Users\\[^\\]+\\)' "$file" | head -3
+      printf "Replace with relative paths or environment variables.\n"
+      ERRORS=$((ERRORS + 1))
+    fi
+  fi
+done
+
+# Check for Socket API keys.
+printf "Checking for API keys...\n"
+for file in $STAGED_FILES; do
+  if [ -f "$file" ]; then
+    if grep -E 'sktsec_[a-zA-Z0-9_-]+' "$file" 2>/dev/null | grep -v "$ALLOWED_PUBLIC_KEY" | grep -v 'your_api_key_here' | grep -v 'SOCKET_SECURITY_API_KEY=' | grep -v 'fake-token' | grep -v 'test-token' | grep -q .; then
+      printf "${YELLOW}⚠ WARNING: Potential API key found in: $file${NC}\n"
+      grep -n 'sktsec_' "$file" | grep -v "$ALLOWED_PUBLIC_KEY" | grep -v 'your_api_key_here' | grep -v 'fake-token' | grep -v 'test-token' | head -3
+      printf "If this is a real API key, DO NOT COMMIT IT.\n"
+    fi
+  fi
+done
+
+# Check for common secret patterns.
+printf "Checking for potential secrets...\n"
+for file in $STAGED_FILES; do
+  if [ -f "$file" ]; then
+    # Skip test files, example files, and hook scripts.
+    if echo "$file" | grep -qE '\.(test|spec)\.(m?[jt]s|tsx?)$|\.example$|/test/|/tests/|fixtures/|\.git-hooks/|\.husky/'; then
+      continue
+    fi
+
+    # Check for AWS keys.
+    if grep -iE '(aws_access_key|aws_secret|AKIA[0-9A-Z]{16})' "$file" 2>/dev/null | grep -q .; then
+      printf "${RED}✗ ERROR: Potential AWS credentials found in: $file${NC}\n"
+      grep -n -iE '(aws_access_key|aws_secret|AKIA[0-9A-Z]{16})' "$file" | head -3
+      ERRORS=$((ERRORS + 1))
+    fi
+
+    # Check for GitHub tokens.
+    if grep -E 'gh[ps]_[a-zA-Z0-9]{36}' "$file" 2>/dev/null | grep -q .; then
+      printf "${RED}✗ ERROR: Potential GitHub token found in: $file${NC}\n"
+      grep -n -E 'gh[ps]_[a-zA-Z0-9]{36}' "$file" | head -3
+      ERRORS=$((ERRORS + 1))
+    fi
+
+    # Check for private keys.
+    if grep -E '-----BEGIN (RSA |EC |DSA )?PRIVATE KEY-----' "$file" 2>/dev/null | grep -q .; then
+      printf "${RED}✗ ERROR: Private key found in: $file${NC}\n"
+      ERRORS=$((ERRORS + 1))
+    fi
+  fi
+done
+
+if [ $ERRORS -gt 0 ]; then
+  printf "\n"
+  printf "${RED}✗ Security check failed with $ERRORS error(s).${NC}\n"
+  printf "Fix the issues above and try again.\n"
+  exit 1
+fi
+
+printf "${GREEN}✓ All security checks passed!${NC}\n"
+exit 0
diff --git a/.git-hooks/pre-push b/.git-hooks/pre-push
new file mode 100755
index 0000000..aa5235a
--- /dev/null
+++ b/.git-hooks/pre-push
@@ -0,0 +1,154 @@
+#!/bin/bash
+# Socket Security Pre-push Hook
+# MANDATORY ENFORCEMENT LAYER - Cannot be bypassed with --no-verify.
+# Validates all commits being pushed for security issues and AI attribution.
+
+set -e
+
+# Colors for output.
+RED='\033[0;31m'
+YELLOW='\033[1;33m'
+GREEN='\033[0;32m'
+NC='\033[0m'
+
+printf "${GREEN}Running mandatory pre-push validation...${NC}\n"
+
+# Allowed public API key (used in socket-lib).
+ALLOWED_PUBLIC_KEY="sktsec_t_--RAN5U4ivauy4w37-6aoKyYPDt5ZbaT5JBVMqiwKo_api"
+
+# Get the remote name and URL.
+remote="$1"
+url="$2"
+
+TOTAL_ERRORS=0
+
+# Read stdin for refs being pushed.
+while read local_ref local_sha remote_ref remote_sha; do
+  # Get the range of commits being pushed.
+  if [ "$remote_sha" = "0000000000000000000000000000000000000000" ]; then
+    # New branch - check all commits.
+    range="$local_sha"
+  else
+    # Existing branch - check new commits.
+    range="$remote_sha..$local_sha"
+  fi
+
+  ERRORS=0
+
+  # ============================================================================
+  # CHECK 1: Scan commit messages for AI attribution
+  # ============================================================================
+  printf "Checking commit messages for AI attribution...\n"
+
+  # Check each commit in the range for AI patterns.
+  while IFS= read -r commit_sha; do
+    full_msg=$(git log -1 --format='%B' "$commit_sha")
+
+    if echo "$full_msg" | grep -qiE "(Generated with|Co-Authored-By: Claude|Co-Authored-By: AI|🤖 Generated|AI generated|Claude Code|@anthropic|Assistant:|Generated by Claude|Machine generated)"; then
+      if [ $ERRORS -eq 0 ]; then
+        printf "${RED}✗ BLOCKED: AI attribution found in commit messages!${NC}\n"
+        printf "Commits with AI attribution:\n"
+      fi
+      echo "  - $(git log -1 --oneline "$commit_sha")"
+      ERRORS=$((ERRORS + 1))
+    fi
+  done < <(git rev-list "$range")
+
+  if [ $ERRORS -gt 0 ]; then
+    printf "\n"
+    printf "These commits were likely created with --no-verify, bypassing the\n"
+    printf "commit-msg hook that strips AI attribution.\n"
+    printf "\n"
+    printf "To fix:\n"
+    printf "  git rebase -i %s\n" "$remote_sha"
+    printf "  Mark commits as .reword., remove AI attribution, save\n"
+    printf "  git push\n"
+  fi
+
+  # ============================================================================
+  # CHECK 2: File content security checks
+  # ============================================================================
+  printf "Checking files for security issues...\n"
+
+  # Get all files changed in these commits.
+  CHANGED_FILES=$(git diff --name-only "$range" 2>/dev/null || printf "\n")
+
+  if [ -n "$CHANGED_FILES" ]; then
+    # Check for sensitive files.
+    if echo "$CHANGED_FILES" | grep -qE '^\.env(\.local)?$'; then
+      printf "${RED}✗ BLOCKED: Attempting to push .env file!${NC}\n"
+      printf "Files: %s\n" "$(echo "$CHANGED_FILES" | grep -E '^\.env(\.local)?$')"
+      ERRORS=$((ERRORS + 1))
+    fi
+
+    # Check for .DS_Store.
+    if echo "$CHANGED_FILES" | grep -q '\.DS_Store'; then
+      printf "${RED}✗ BLOCKED: .DS_Store file in push!${NC}\n"
+      printf "Files: %s\n" "$(echo "$CHANGED_FILES" | grep '\.DS_Store')"
+      ERRORS=$((ERRORS + 1))
+    fi
+
+    # Check for log files.
+    if echo "$CHANGED_FILES" | grep -E '\.log$' | grep -v 'test.*\.log' | grep -q .; then
+      printf "${RED}✗ BLOCKED: Log file in push!${NC}\n"
+      printf "Files: %s\n" "$(echo "$CHANGED_FILES" | grep -E '\.log$' | grep -v 'test.*\.log')"
+      ERRORS=$((ERRORS + 1))
+    fi
+
+    # Check file contents for secrets.
+    for file in $CHANGED_FILES; do
+      if [ -f "$file" ] && [ ! -d "$file" ]; then
+        # Skip test files, example files, and hook scripts.
+        if echo "$file" | grep -qE '\.(test|spec)\.(m?[jt]s|tsx?)$|\.example$|/test/|/tests/|fixtures/|\.git-hooks/|\.husky/'; then
+          continue
+        fi
+
+        # Check for hardcoded user paths.
+        if grep -E '(/Users/[^/\s]+/|/home/[^/\s]+/|C:\\Users\\[^\\]+\\)' "$file" 2>/dev/null | grep -q .; then
+          printf "${RED}✗ BLOCKED: Hardcoded personal path found in: $file${NC}\n"
+          grep -n -E '(/Users/[^/\s]+/|/home/[^/\s]+/|C:\\Users\\[^\\]+\\)' "$file" | head -3
+          ERRORS=$((ERRORS + 1))
+        fi
+
+        # Check for Socket API keys.
+        if grep -E 'sktsec_[a-zA-Z0-9_-]+' "$file" 2>/dev/null | grep -v "$ALLOWED_PUBLIC_KEY" | grep -v 'your_api_key_here' | grep -v 'SOCKET_SECURITY_API_KEY=' | grep -v 'fake-token' | grep -v 'test-token' | grep -q .; then
+          printf "${RED}✗ BLOCKED: Real API key detected in: $file${NC}\n"
+          grep -n 'sktsec_' "$file" | grep -v "$ALLOWED_PUBLIC_KEY" | grep -v 'your_api_key_here' | grep -v 'fake-token' | grep -v 'test-token' | head -3
+          ERRORS=$((ERRORS + 1))
+        fi
+
+        # Check for AWS keys.
+        if grep -iE '(aws_access_key|aws_secret|AKIA[0-9A-Z]{16})' "$file" 2>/dev/null | grep -q .; then
+          printf "${RED}✗ BLOCKED: Potential AWS credentials found in: $file${NC}\n"
+          grep -n -iE '(aws_access_key|aws_secret|AKIA[0-9A-Z]{16})' "$file" | head -3
+          ERRORS=$((ERRORS + 1))
+        fi
+
+        # Check for GitHub tokens.
+        if grep -E 'gh[ps]_[a-zA-Z0-9]{36}' "$file" 2>/dev/null | grep -q .; then
+          printf "${RED}✗ BLOCKED: Potential GitHub token found in: $file${NC}\n"
+          grep -n -E 'gh[ps]_[a-zA-Z0-9]{36}' "$file" | head -3
+          ERRORS=$((ERRORS + 1))
+        fi
+
+        # Check for private keys.
+        if grep -E '-----BEGIN (RSA |EC |DSA )?PRIVATE KEY-----' "$file" 2>/dev/null | grep -q .; then
+          printf "${RED}✗ BLOCKED: Private key found in: $file${NC}\n"
+          ERRORS=$((ERRORS + 1))
+        fi
+      fi
+    done
+  fi
+
+  TOTAL_ERRORS=$((TOTAL_ERRORS + ERRORS))
+done
+
+if [ $TOTAL_ERRORS -gt 0 ]; then
+  printf "\n"
+  printf "${RED}✗ Push blocked by mandatory validation!${NC}\n"
+  printf "Fix the issues above before pushing.\n"
+  exit 1
+fi
+
+printf "${GREEN}✓ All mandatory validation passed!${NC}\n"
+exit 0
diff --git a/.github/dependabot.yml b/.github/dependabot.yml
index 6840dc6..b5946d1 100644
--- a/.github/dependabot.yml
+++ b/.github/dependabot.yml
@@ -7,6 +7,8 @@ updates:
       day: 'monday'
     cooldown:
       default-days: 7
+    commit-message:
+      prefix: '🤖 Dep Updates'
   - package-ecosystem: 'npm'
     directory: '/'
     schedule:
@@ -14,3 +16,5 @@ updates:
       day: 'monday'
     cooldown:
       default-days: 7
+    commit-message:
+      prefix: '🤖 Dep Updates'
diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index e062681..c855074 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -1,7 +1,10 @@
-name: 🚀 CI Pipeline
+name: ⚡ CI
 
-# Dependencies:
-#   - SocketDev/socket-registry/.github/workflows/ci.yml
+# Optimized CI with:
+# - Separate lint job (1x instead of 6x)
+# - Separate build verification job
+# - Parallel job execution
+# - pnpm dependency caching via setup-node
 
 on:
   push:
@@ -15,17 +18,165 @@ permissions:
   contents: read
 
 jobs:
-  ci:
-    name: Run CI Pipeline
-    uses: SocketDev/socket-registry/.github/workflows/ci.yml@a912e5bd8ec469d2ee13abf592a6b2e5898c006c # main
-    with:
-      coverage-script: 'pnpm run cover --code-only'
-      coverage-report-script: 'pnpm run cover --summary'
+  # Separate lint job - runs once instead of 6x in matrix
+  lint:
+    name: Lint
+    runs-on: ubuntu-latest
+    timeout-minutes: 10
+    steps:
+      - name: Checkout code
+        uses: actions/checkout@08eba0b27e820071cde6df949e0beb9ba4906955 # v4.3.0
+
+      - name: Setup pnpm
+        uses: pnpm/action-setup@9fd676a19091d4595eefd76e4bd31c97133911f1 # v4.2.0
+        with:
+          version: 10
+
+      - name: Setup Node.js
+        uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4.4.0
+        with:
+          node-version: 22
+          cache: 'pnpm'
+
+      - name: Install dependencies
+        run: pnpm install --frozen-lockfile
+
+      - name: Run lint
+        run: pnpm run lint --all
+
+  # Build job - runs once and caches artifacts
+  build:
+    name: Build
+    runs-on: ubuntu-latest
+    timeout-minutes: 10
+    steps:
+      - name: Checkout code
+        uses: actions/checkout@08eba0b27e820071cde6df949e0beb9ba4906955 # v4.3.0
+
+      - name: Setup pnpm
+        uses: pnpm/action-setup@9fd676a19091d4595eefd76e4bd31c97133911f1 # v4.2.0
+        with:
+          version: 10
+
+      - name: Setup Node.js
+        uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4.4.0
+        with:
+          node-version: 22
+          cache: 'pnpm'
+
+      - name: Install dependencies
+        run: pnpm install --frozen-lockfile
+
+      - name: Build project
+        run: pnpm run build
+
+  # Test matrix - reuses build artifacts (main test suite)
+  test:
+    name: Test
+    needs: [lint, build]
+    runs-on: ${{ matrix.os }}
+    timeout-minutes: 15
+    strategy:
       fail-fast: false
-      lint-script: 'pnpm run lint-ci'
-      node-versions: '[20, 22, 24]'
-      os-versions: '["ubuntu-latest", "windows-latest"]'
-      test-script: 'pnpm run test-ci'
-      test-setup-script: 'pnpm run build'
-      type-check-script: 'pnpm run type-ci'
-      type-check-setup-script: 'pnpm run build'
+      matrix:
+        node: ['24.10.0']
+        os: [ubuntu-latest, windows-latest]
+    steps:
+      - name: Checkout code
+        uses: actions/checkout@08eba0b27e820071cde6df949e0beb9ba4906955 # v4.3.0
+
+      - name: Setup pnpm
+        uses: pnpm/action-setup@9fd676a19091d4595eefd76e4bd31c97133911f1 # v4.2.0
+        with:
+          version: 10
+
+      - name: Setup Node.js
+        uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4.4.0
+        with:
+          node-version: ${{ matrix.node }}
+          cache: 'pnpm'
+
+      - name: Install dependencies
+        run: pnpm install --frozen-lockfile
+
+      - name: Build project
+        run: pnpm run build
+
+      - name: Run main tests
+        run: pnpm exec vitest --config .config/vitest.config.mts run
+
+  # Isolated test suite - runs separately with full isolation
+  test-isolated:
+    name: Test (Isolated)
+    needs: [lint, build]
+    runs-on: ubuntu-latest
+    timeout-minutes: 10
+    steps:
+      - name: Checkout code
+        uses: actions/checkout@08eba0b27e820071cde6df949e0beb9ba4906955 # v4.3.0
+
+      - name: Setup pnpm
+        uses: pnpm/action-setup@9fd676a19091d4595eefd76e4bd31c97133911f1 # v4.2.0
+        with:
+          version: 10
+
+      - name: Setup Node.js
+        uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4.4.0
+        with:
+          node-version: 22
+          cache: 'pnpm'
+
+      - name: Install dependencies
+        run: pnpm install --frozen-lockfile
+
+      - name: Build project
+        run: pnpm run build
+
+      - name: Run isolated tests
+        run: pnpm exec vitest --config .config/vitest.config.isolated.mts run
+
+  # Type check - reuses build artifacts
+  type-check:
+    name: Type Check
+    needs: build
+    runs-on: ubuntu-latest
+    timeout-minutes: 10
+    steps:
+      - name: Checkout code
+        uses: actions/checkout@08eba0b27e820071cde6df949e0beb9ba4906955 # v4.3.0
+
+      - name: Setup pnpm
+        uses: pnpm/action-setup@9fd676a19091d4595eefd76e4bd31c97133911f1 # v4.2.0
+        with:
+          version: 10
+
+      - name: Setup Node.js
+        uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4.4.0
+        with:
+          node-version: 22
+          cache: 'pnpm'
+
+      - name: Install dependencies
+        run: pnpm install --frozen-lockfile
+
+      - name: Run type check
+        run: pnpm run check
+
+  # Status check job - used as required check in branch protection
+  ci-success:
+    name: CI Success
+    needs: [lint, build, test, test-isolated, type-check]
+    if: always()
+    runs-on: ubuntu-latest
+    steps:
+      - name: Check job results
+        run: |
+          if [ "${{ needs.lint.result }}" != "success" ] || \
+             [ "${{ needs.build.result }}" != "success" ] || \
+             [ "${{ needs.test.result }}" != "success" ] || \
+             [ "${{ needs.test-isolated.result }}" != "success" ] || \
+             [ "${{ needs.type-check.result }}" != "success" ]; then
+            echo "One or more jobs failed"
+            exit 1
+          fi
+          echo "All CI jobs passed successfully!"
diff --git a/.github/workflows/claude-auto-review.yml b/.github/workflows/claude-auto-review.yml
index 1ef5eec..3f89b57 100644
--- a/.github/workflows/claude-auto-review.yml
+++ b/.github/workflows/claude-auto-review.yml
@@ -1,4 +1,4 @@
-name: Claude Auto Review
+name: 🤖 Claude Auto Review
 
 # Dependencies:
 #   - SocketDev/socket-registry/.github/workflows/claude-auto-review.yml
@@ -15,6 +15,6 @@ permissions:
 
 jobs:
   auto-review:
-    uses: SocketDev/socket-registry/.github/workflows/claude-auto-review.yml@a912e5bd8ec469d2ee13abf592a6b2e5898c006c # main
+    uses: SocketDev/socket-registry/.github/workflows/claude-auto-review.yml@1a96ced97aaa85d61543351b90d6f463b983c46c # main
     secrets:
       anthropic_api_key: ${{ secrets.ANTHROPIC_API_KEY }}
diff --git a/.github/workflows/claude.yml b/.github/workflows/claude.yml
index 7728430..02cf4cc 100644
--- a/.github/workflows/claude.yml
+++ b/.github/workflows/claude.yml
@@ -1,4 +1,4 @@
-name: Claude Code
+name: 🤖 Claude Code
 
 # Dependencies:
 #   - SocketDev/socket-registry/.github/workflows/claude.yml
@@ -22,6 +22,6 @@ permissions:
 
 jobs:
   claude:
-    uses: SocketDev/socket-registry/.github/workflows/claude.yml@a912e5bd8ec469d2ee13abf592a6b2e5898c006c # main
+    uses: SocketDev/socket-registry/.github/workflows/claude.yml@1a96ced97aaa85d61543351b90d6f463b983c46c # main
     secrets:
       anthropic_api_key: ${{ secrets.ANTHROPIC_API_KEY }}
diff --git a/.github/workflows/provenance.yml b/.github/workflows/provenance.yml
index db37616..644bbf8 100644
--- a/.github/workflows/provenance.yml
+++ b/.github/workflows/provenance.yml
@@ -1,4 +1,4 @@
-name: Publish to npm registry
+name: 📦 Publish
 
 # Dependencies:
 #   - SocketDev/socket-registry/.github/workflows/provenance.yml
@@ -21,7 +21,7 @@ permissions:
 
 jobs:
   publish:
-    uses: SocketDev/socket-registry/.github/workflows/provenance.yml@a912e5bd8ec469d2ee13abf592a6b2e5898c006c # main
+    uses: SocketDev/socket-registry/.github/workflows/provenance.yml@1a96ced97aaa85d61543351b90d6f463b983c46c # main
     with:
       debug: ${{ inputs.debug }}
       package-name: '@socketregistry/lib'
diff --git a/.github/workflows/socket-auto-pr.yml b/.github/workflows/socket-auto-pr.yml
index 19a200a..1966581 100644
--- a/.github/workflows/socket-auto-pr.yml
+++ b/.github/workflows/socket-auto-pr.yml
@@ -1,4 +1,4 @@
-name: Socket Fix Auto Pull Request
+name: ⚡ Fix PR
 
 # Dependencies:
 #   - SocketDev/socket-registry/.github/workflows/socket-auto-pr.yml
@@ -24,7 +24,7 @@ permissions:
 
 jobs:
   socket-auto-pr:
-    uses: SocketDev/socket-registry/.github/workflows/socket-auto-pr.yml@a912e5bd8ec469d2ee13abf592a6b2e5898c006c # main
+    uses: SocketDev/socket-registry/.github/workflows/socket-auto-pr.yml@1a96ced97aaa85d61543351b90d6f463b983c46c # main
     with:
       debug: ${{ inputs.debug }}
       autopilot: true
diff --git a/.gitignore b/.gitignore
index 30baf92..91792b1 100644
--- a/.gitignore
+++ b/.gitignore
@@ -1,21 +1,66 @@
-.DS_Store
+# ============================================================================
+# OS-specific files
+# ============================================================================
 ._.DS_Store
+.DS_Store
 Thumbs.db
-/.claude
-/.env
-/.env.local
-/.pnpmfile.cjs
-/.nvm
-/.type-coverage
-/.vscode
-/npm-debug.log
-/yarn.lock
-**/.cache
-**/coverage
-**/dist
-**/node_modules
-**/*.tgz
-**/*.tsbuildinfo
 
-# Allow specific files
-!/.vscode/settings.json
+# ============================================================================
+# Environment and secrets
+# ============================================================================
+.env
+.env.*
+!.env.example
+
+# ============================================================================
+# Node.js dependencies and configuration
+# ============================================================================
+.node-version
+.npmrc.local
+.nvm
+.pnpmfile.cjs
+node_modules/
+npm-debug.log*
+pnpm-debug.log*
+yarn-error.log*
+yarn.lock
+
+# ============================================================================
+# Build outputs and artifacts
+# ============================================================================
+**/.cache/
+.type-coverage/
+coverage/
+dist/
+*.tsbuildinfo
+*.tgz
+*.tmp
+
+# ============================================================================
+# Editor and IDE files
+# ============================================================================
+.idea/
+.vscode/
+!.vscode/settings.json
+*.old
+*.swo
+*.swp
+*~
+
+# ============================================================================
+# Development and debugging
+# ============================================================================
+*.log
+**/.claude/
+
+# ============================================================================
+# Backup and temporary files
+# ============================================================================
+*.backup
+*.bak
+*.orig
+
+# ============================================================================
+# Archive directories
+# ============================================================================
+**/docs/archive/
diff --git a/.husky/commit-msg b/.husky/commit-msg
new file mode 100755
index 0000000..09dec27
--- /dev/null
+++ b/.husky/commit-msg
@@ -0,0 +1,2 @@
+# Run commit message validation and auto-strip AI attribution.
+.git-hooks/commit-msg "$1"
diff --git a/.husky/pre-commit b/.husky/pre-commit
old mode 100644
new mode 100755
index 44c8fd4..a63f88c
--- a/.husky/pre-commit
+++ b/.husky/pre-commit
@@ -1,11 +1,14 @@
+# Optional checks - can be bypassed with --no-verify for fast local commits.
+# Mandatory security checks run in pre-push hook.
+
 if [ -z "${DISABLE_PRECOMMIT_LINT}" ]; then
   pnpm lint --staged
 else
-  echo "Skipping lint due to DISABLE_PRECOMMIT_LINT env var"
+  printf "Skipping lint due to DISABLE_PRECOMMIT_LINT env var\n"
 fi
 
 if [ -z "${DISABLE_PRECOMMIT_TEST}" ]; then
   dotenvx -q run -f .env.precommit -- pnpm test --staged
 else
-  echo "Skipping testing due to DISABLE_PRECOMMIT_TEST env var"
+  printf "Skipping testing due to DISABLE_PRECOMMIT_TEST env var\n"
 fi
diff --git a/.husky/pre-push b/.husky/pre-push
new file mode 100755
index 0000000..e636e3a
--- /dev/null
+++ b/.husky/pre-push
@@ -0,0 +1,2 @@
+# Run pre-push security validation.
+.git-hooks/pre-push "$@"
diff --git a/.husky/security-checks.sh b/.husky/security-checks.sh
new file mode 100755
index 0000000..3b040f8
--- /dev/null
+++ b/.husky/security-checks.sh
@@ -0,0 +1,125 @@
+#!/bin/bash
+# Socket Security Checks
+# Prevents committing sensitive data and common mistakes.
+
+set -e
+
+# Colors for output.
+RED='\033[0;31m'
+YELLOW='\033[1;33m'
+GREEN='\033[0;32m'
+NC='\033[0m'
+
+# Allowed public API key (used in socket-lib and across all Socket repos).
+# This is Socket's official public test API key - safe to commit.
+# NOTE: This value is intentionally identical across all Socket repos.
+ALLOWED_PUBLIC_KEY="sktsec_t_--RAN5U4ivauy4w37-6aoKyYPDt5ZbaT5JBVMqiwKo_api"
+
+printf "${GREEN}Running Socket Security checks...${NC}\n"
+
+# Get list of staged files.
+STAGED_FILES=$(git diff --cached --name-only --diff-filter=ACM)
+
+if [ -z "$STAGED_FILES" ]; then
+  printf "${GREEN}✓ No files to check${NC}\n"
+  exit 0
+fi
+
+ERRORS=0
+
+# Check for .DS_Store files.
+printf "Checking for .DS_Store files...\n"
+if echo "$STAGED_FILES" | grep -q '\.DS_Store'; then
+  printf "${RED}✗ ERROR: .DS_Store file detected!${NC}\n"
+  echo "$STAGED_FILES" | grep '\.DS_Store'
+  ERRORS=$((ERRORS + 1))
+fi
+
+# Check for log files.
+printf "Checking for log files...\n"
+if echo "$STAGED_FILES" | grep -E '\.log$' | grep -v 'test.*\.log'; then
+  printf "${RED}✗ ERROR: Log file detected!${NC}\n"
+  echo "$STAGED_FILES" | grep -E '\.log$' | grep -v 'test.*\.log'
+  ERRORS=$((ERRORS + 1))
+fi
+
+# Check for .env files.
+printf "Checking for .env files...\n"
+if echo "$STAGED_FILES" | grep -E '^\.env(\.local)?$'; then
+  printf "${RED}✗ ERROR: .env or .env.local file detected!${NC}\n"
+  echo "$STAGED_FILES" | grep -E '^\.env(\.local)?$'
+  printf "These files should never be committed. Use .env.example instead.\n"
+  ERRORS=$((ERRORS + 1))
+fi
+
+# Check for hardcoded user paths (generic detection).
+printf "Checking for hardcoded personal paths...\n"
+for file in $STAGED_FILES; do
+  if [ -f "$file" ]; then
+    # Skip test files and hook scripts.
+    if echo "$file" | grep -qE '\.(test|spec)\.|/test/|/tests/|fixtures/|\.git-hooks/|\.husky/'; then
+      continue
+    fi
+
+    # Check for common user path patterns.
+    if grep -E '(/Users/[^/\s]+/|/home/[^/\s]+/|C:\\Users\\[^\\]+\\)' "$file" 2>/dev/null | grep -q .; then
+      printf "${RED}✗ ERROR: Hardcoded personal path found in: $file${NC}\n"
+      grep -n -E '(/Users/[^/\s]+/|/home/[^/\s]+/|C:\\Users\\[^\\]+\\)' "$file" | head -3
+      printf "Replace with relative paths or environment variables.\n"
+      ERRORS=$((ERRORS + 1))
+    fi
+  fi
+done
+
+# Check for Socket API keys.
+printf "Checking for API keys...\n"
+for file in $STAGED_FILES; do
+  if [ -f "$file" ]; then
+    if grep -E 'sktsec_[a-zA-Z0-9_-]+' "$file" 2>/dev/null | grep -v "$ALLOWED_PUBLIC_KEY" | grep -v 'your_api_key_here' | grep -v 'SOCKET_SECURITY_API_KEY=' | grep -v 'fake-token' | grep -v 'test-token' | grep -q .; then
+      printf "${YELLOW}⚠ WARNING: Potential API key found in: $file${NC}\n"
+      grep -n 'sktsec_' "$file" | grep -v "$ALLOWED_PUBLIC_KEY" | grep -v 'your_api_key_here' | grep -v 'fake-token' | grep -v 'test-token' | head -3
+      printf "If this is a real API key, DO NOT COMMIT IT.\n"
+    fi
+  fi
+done
+
+# Check for common secret patterns.
+printf "Checking for potential secrets...\n"
+for file in $STAGED_FILES; do
+  if [ -f "$file" ]; then
+    # Skip test files, example files, and hook scripts.
+    if echo "$file" | grep -qE '\.(test|spec)\.(m?[jt]s|tsx?)$|\.example$|/test/|/tests/|fixtures/|\.git-hooks/|\.husky/'; then
+      continue
+    fi
+
+    # Check for AWS keys.
+    if grep -iE '(aws_access_key|aws_secret|AKIA[0-9A-Z]{16})' "$file" 2>/dev/null | grep -q .; then
+      printf "${RED}✗ ERROR: Potential AWS credentials found in: $file${NC}\n"
+      grep -n -iE '(aws_access_key|aws_secret|AKIA[0-9A-Z]{16})' "$file" | head -3
+      ERRORS=$((ERRORS + 1))
+    fi
+
+    # Check for GitHub tokens.
+    if grep -E 'gh[ps]_[a-zA-Z0-9]{36}' "$file" 2>/dev/null | grep -q .; then
+      printf "${RED}✗ ERROR: Potential GitHub token found in: $file${NC}\n"
+      grep -n -E 'gh[ps]_[a-zA-Z0-9]{36}' "$file" | head -3
+      ERRORS=$((ERRORS + 1))
+    fi
+
+    # Check for private keys.
+    if grep -E '-----BEGIN (RSA |EC |DSA )?PRIVATE KEY-----' "$file" 2>/dev/null | grep -q .; then
+      printf "${RED}✗ ERROR: Private key found in: $file${NC}\n"
+      ERRORS=$((ERRORS + 1))
+    fi
+  fi
+done
+
+if [ $ERRORS -gt 0 ]; then
+  printf "\n"
+  printf "${RED}✗ Security check failed with $ERRORS error(s).${NC}\n"
+  printf "Fix the issues above and try again.\n"
+  exit 1
+fi
+
+printf "${GREEN}✓ All security checks passed!${NC}\n"
+exit 0
diff --git a/.node-version b/.node-version
deleted file mode 100644
index a45fd52..0000000
--- a/.node-version
+++ /dev/null
@@ -1 +0,0 @@
-24
diff --git a/.npmrc b/.npmrc
index 4d26adf..1ca2b5a 100644
--- a/.npmrc
+++ b/.npmrc
@@ -2,6 +2,6 @@
 ignore-scripts=true
 
 # Suppress pnpm workspace warnings
-link-workspace-packages=true
+link-workspace-packages=false
 loglevel=error
-prefer-workspace-packages=true
\ No newline at end of file
+prefer-workspace-packages=false
\ No newline at end of file
diff --git a/CHANGELOG.md b/CHANGELOG.md
index ca257b2..0fcef23 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -5,6 +5,800 @@ All notable changes to this project will be documented in this file.
 The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.1.0/),
 and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 
+## [3.3.0](https://github.com/SocketDev/socket-lib/releases/tag/v3.3.0) - 2025-11-07
+
+### Added
+
+- **Spinner**: New `reason()` and `reasonAndStop()` methods for displaying working/thinking output
+  - `reason(text)`: Display reason text alongside spinner (e.g., "Analyzing dependencies...")
+  - `reasonAndStop(text)`: Display reason text and stop spinner in one call
+  - Normalizes text formatting consistently with other spinner methods
+  - Useful for communicating progress steps during long-running operations
+
+- **Logger**: New `reason()` method and symbol for working/thinking output
+  - `LOG_SYMBOLS.reason`: New symbol for reason output (distinct from info/step symbols)
+  - `reason(message)`: Display reason messages with dedicated symbol
+  - Complements existing info/step/success/error/warning methods
+
+## [3.2.8](https://github.com/SocketDev/socket-lib/releases/tag/v3.2.8) - 2025-11-05
+
+### Fixed
+
+- **build**: Fix CommonJS export script edge cases
+  - Fixed stray semicolons after comment placeholders in transformed modules
+  - Fixed incorrect transformation of `module.exports.default` to `module.module.exports`
+  - Ensures external dependencies and default exports work correctly
+
+## [3.2.7](https://github.com/SocketDev/socket-lib/releases/tag/v3.2.7) - 2025-11-05
+
+### Fixed
+
+- **build-externals**: Disable minification to preserve exports
+  - External dependencies are no longer minified during bundling
+  - Prevents export name mangling that breaks CommonJS interop
+  - Fixes `semver.parse()` and `semver.major()` being undefined
+
+- **build**: Fix CommonJS export interop for TypeScript default exports
+  - Modules with `export default` now work without requiring `.default` accessor
+
+### Changed
+
+- **docs**: Moved packages README to correct location (`src/packages/README.md`)
+
+## [3.2.6](https://github.com/SocketDev/socket-lib/releases/tag/v3.2.6) - 2025-11-05
+
+### Fixed
+
+- **logger**: Replace yoctocolors-cjs rgb() with manual ANSI codes
+  - The yoctocolors-cjs package doesn't have an rgb() method
+  - Manually construct ANSI escape sequences for RGB colors (ESC[38;2;r;g;bm...ESC[39m)
+  - Affects `src/logger.ts` and `src/stdio/prompts.ts` applyColor() functions
+
+## [3.2.5](https://github.com/SocketDev/socket-lib/releases/tag/v3.2.5) - 2025-11-05
+
+### Added
+
+- **scripts**: Add path alias resolution script (`fix-path-aliases.mjs`)
+  - Resolves internal path aliases (`#lib/*`, `#constants/*`, etc.) to relative paths in built CommonJS files
+
+- **build**: Integrate path alias resolution into build pipeline
+  - Add path alias plugin to esbuild config
+  - Integrate `fix-path-aliases.mjs` into build process
+  - Ensures path aliases work correctly in compiled CommonJS output
+
+## [3.2.4](https://github.com/SocketDev/socket-lib/releases/tag/v3.2.4) - 2025-11-04
+
+### Added
+
+- **Logger**: New `time()` method for timing operations with automatic duration reporting
+  - Starts a named timer and returns a `stop()` function
+  - Automatically logs completion with formatted duration (e.g., "Operation completed in 1.23s")
+  - Useful for performance monitoring and debugging
+
+### Fixed
+
+- **Spinner effects**: Fixed star spinner frames by adding trailing space for consistent spacing
+- **Build system**: Fixed external dependency bundling issues
+  - Bundle `@npmcli/package-json` with subpath exports support
+  - Use `src/external` files as bundle entry points for proper module resolution
+  - Bundle libnpmexec from npm instead of using vendored version
+  - Prevent circular dependencies with `createForceNodeModulesPlugin()` to force resolution from node_modules
+
+## [3.2.3](https://github.com/SocketDev/socket-lib/releases/tag/v3.2.3) - 2025-11-03
+
+### Internal
+
+- **Build system**: Added stub infrastructure for external dependency bundling
+  - Created organized `scripts/build-externals/stubs/` directory with utility and active stubs
+  - Added conservative stubs for unused dependencies: `encoding`/`iconv-lite` and `debug`
+  - Reduces external bundle size by ~18KB (9KB from encoding stubs, 9KB from debug stubs)
+
+## [3.2.2](https://github.com/SocketDev/socket-lib/releases/tag/v3.2.2) - 2025-11-03
+
+### Added
+
+- **DLX**: Binary permission management with chmod 0o755 for all package binaries
+  - New `makePackageBinsExecutable()` function ensures all binaries in installed packages are executable
+  - Aligns with npm's cmd-shim approach for binary permissions
+  - Handles both single and multiple binary packages
+  - No-op on Windows (permissions not needed)
+
+- **DLX**: npm-compatible bin resolution via vendored `getBinFromManifest`
+  - Cherry-picked `getBinFromManifest` from libnpmexec@10.1.8 (~1.5 KB)
+  - Avoids 1.1 MB bundle by vendoring single function instead of full package
+  - Provides battle-tested npm bin resolution strategy
+  - Maintains user-friendly fallbacks for edge cases
+
+### Changed
+
+- **DLX**: Enhanced `findBinaryPath()` with npm's resolution strategy
+  - Primary: npm's `getBinFromManifest` (handles standard cases and aliases)
+  - Fallback: user-provided `binaryName` parameter
+  - Fallback: last segment of package name
+  - Last resort: first binary in list
+
+### Performance
+
+- **Optimized package size**: Reduced bundle size through strategic export minimization and vendoring
+  - Vendored `getBinFromManifest` function instead of bundling full libnpmexec (~1.1 MB savings)
+  - Minimized external module exports for better tree-shaking:
+    - `fast-sort`: Now exports only `{ createNewSortInstance }` (2.1 KB, 96% reduction from ~56 KB)
+    - `fast-glob`: Now exports only `{ globStream }` (82 KB bundle)
+    - `del`: Now exports only `{ deleteAsync, deleteSync }` (100 KB bundle)
+    - `streaming-iterables`: Now exports only `{ parallelMap, transform }` (11 KB, 93% reduction from ~168 KB)
+  - Total savings: ~1.3 MB (1.1 MB from vendoring + 211 KB from minimized exports)
+  - Establishes pattern for future external module additions
+
+## [3.2.1](https://github.com/SocketDev/socket-lib/releases/tag/v3.2.1) - 2025-11-02
+
+### Changed
+
+- **Logger/Spinner**: Use module-level constants to prevent duplicate and rogue spinner indicators
+  - Call `getDefaultLogger()` and `getDefaultSpinner()` once at module scope instead of repeated calls
+  - Prevents multiple spinner instances that can cause duplicate or lingering indicators in terminal output
+  - Applied in `src/dlx-manifest.ts`, `src/stdio/mask.ts`, and `src/spinner.ts`
+  - Follows DRY principle and aligns with socket-registry/socket-sdk-js patterns
+
+### Fixed
+
+- **Scripts**: Fixed undefined logger variable in update script
+  - Replaced undefined `log` references with `_logger` throughout `scripts/update.mjs`
+  - Resolves ESLint errors that blocked test execution
+- **Tests**: Improved stdout test stability by checking call delta instead of absolute counts
+  - Fixed flaky CI failures where spy call count was 101 instead of expected 100
+  - More robust approach handles potential state leakage between tests
+- **Tests**: Removed unnecessary 10ms delay in cache-with-ttl test
+  - Cache with memoization enabled updates in-memory storage synchronously
+  - Delay was insufficient in CI and unnecessary given synchronous behavior
+  - Resolves flaky CI failures where cached values returned undefined
+
+## [3.2.0](https://github.com/SocketDev/socket-lib/releases/tag/v3.2.0) - 2025-11-02
+
+### Added
+
+- **DLX**: Unified manifest for packages and binaries
+  - Centralized manifest system for tracking DLX-compatible packages
+  - Simplifies package and binary lookups for dependency-free execution
+
+## [3.1.3](https://github.com/SocketDev/socket-lib/releases/tag/v3.1.3) - 2025-11-02
+
+### Changed
+
+- **Dependencies**: Updated `@socketregistry/packageurl-js` to 1.3.5
+
+## [3.1.2](https://github.com/SocketDev/socket-lib/releases/tag/v3.1.2) - 2025-11-02
+
+### Fixed
+
+- **External dependencies**: Fixed incorrectly marked external dependencies to use wrapper pattern
+  - Updated `src/constants/agents.ts` to use `require('../external/which')` instead of direct imports
+  - Updated `src/zod.ts` to export from `./external/zod'` instead of direct imports
+  - Maintains zero dependencies policy by ensuring all runtime dependencies go through the external wrapper pattern
+- **Spinner**: Fixed undefined properties in setShimmer by handling defaults correctly
+
+## [3.1.1](https://github.com/SocketDev/socket-lib/releases/tag/v3.1.1) - 2025-11-02
+
+### Fixed
+
+- **Cache TTL**: Fixed flaky test by handling persistent cache write failures gracefully
+  - Wrapped `cacache.put` in try/catch to prevent failures when persistent cache writes fail or are slow
+  - In-memory cache is updated synchronously before the persistent write, so immediate reads succeed regardless of persistent cache state
+  - Improves reliability in test environments and when cache directory has issues
+
+## [3.1.0](https://github.com/SocketDev/socket-lib/releases/tag/v3.1.0) - 2025-11-01
+
+### Changed
+
+- **File system utilities**: `safeMkdir` and `safeMkdirSync` now default to `recursive: true`
+  - Nested directories are created by default, simplifying common usage patterns
+
+## [3.0.6](https://github.com/SocketDev/socket-lib/releases/tag/v3.0.6) - 2025-11-01
+
+### Added
+
+- **Build validation**: Added guard against `link:` protocol dependencies in package.json
+  - New `validate-no-link-deps.mjs` script automatically runs during `pnpm run check`
+  - Prevents accidental publication with `link:` dependencies which can cause issues
+  - Recommends using `workspace:` for monorepos or `catalog:` for centralized version management
+  - Validates all dependency fields: dependencies, devDependencies, peerDependencies, optionalDependencies
+
+### Changed
+
+- **Dependencies**: Updated `@socketregistry/packageurl-js` to 1.3.3
+- **Git hooks**: Committed pre-commit and pre-push hook configurations for version control
+- **Scripts**: Removed shebang from `validate-no-link-deps` script (Node.js script, not shell)
+
+## [3.0.5](https://github.com/SocketDev/socket-lib/releases/tag/v3.0.5) - 2025-11-01
+
+### Fixed
+
+- **Critical: Prompts API breaking changes**: Restored working prompts implementation that was accidentally replaced with non-functional stub in v3.0.0
+  - Consolidated all prompts functionality into `src/stdio/prompts.ts`
+  - Removed unimplemented stub from `src/prompts/` that was throwing "not yet implemented" errors
+  - Removed `./prompts` package export (use `@socketsecurity/lib/stdio/prompts` instead)
+  - Restored missing exports: `password`, `search`, `Separator`, and added `createSeparator()` helper
+  - Fixed `Choice` type to use correct `name` property (matching `@inquirer` API, not erroneous `label`)
+
+### Added
+
+- **Theme integration for prompts**: Prompts now automatically use the active theme colors
+  - Prompt messages styled with `colors.prompt`
+  - Descriptions and disabled items styled with `colors.textDim`
+  - Answers and highlights styled with `colors.primary`
+  - Error messages styled with `colors.error`
+  - Success indicators styled with `colors.success`
+  - Exported `createInquirerTheme()` function for converting Socket themes to @inquirer format
+  - Consistent visual experience with Logger and Spinner theme integration
+
+- **Theme parameter support**: Logger, Prompts, and text effects now accept optional `theme` parameter
+  - Pass theme names (`'socket'`, `'sunset'`, `'terracotta'`, `'lush'`, `'ultra'`) or Theme objects
+  - **Logger**: `new Logger({ theme: 'sunset' })` - uses theme-specific symbol colors
+  - **Prompts**: `await input({ message: 'Name:', theme: 'ultra' })` - uses theme for prompt styling
+  - **Text effects**: `applyShimmer(text, state, { theme: 'terracotta' })` - uses theme for shimmer colors
+  - Instance-specific themes override global theme context when provided
+  - Falls back to global theme context when no instance theme specified
+  - **Note**: Spinner already had theme parameter support in v3.0.0
+
+### Removed
+
+- **Unused index entrypoint**: Removed `src/index.ts` and package exports for `"."` and `"./index"`
+  - This was a leftover from socket-registry and not needed for this library
+  - Users should import specific modules directly (e.g., `@socketsecurity/lib/logger`)
+  - Breaking: `import { getDefaultLogger } from '@socketsecurity/lib'` no longer works
+  - Use: `import { getDefaultLogger } from '@socketsecurity/lib/logger'` instead
+
+## [3.0.4](https://github.com/SocketDev/socket-lib/releases/tag/v3.0.4) - 2025-11-01
+
+### Changed
+
+- **Sunset theme**: Updated colors from azure blue to warm orange/purple gradient matching Coana branding
+- **Terracotta theme**: Renamed from `brick` to `terracotta` for better clarity
+
+## [3.0.3](https://github.com/SocketDev/socket-lib/releases/tag/v3.0.3) - 2025-11-01
+
+### Fixed
+
+- **Critical: Node.js ESM/CJS interop completely fixed**: Disabled minification to ensure proper ESM named import detection
+  - Root cause: esbuild minification was breaking Node.js ESM's CJS named export detection
+  - Solution: Disabled minification entirely (`minify: false` in esbuild config)
+  - Libraries should not be minified - consumers minify during their own build process
+  - Unminified esbuild output uses clear `__export` patterns that Node.js ESM natively understands
+  - Removed `fix-commonjs-exports.mjs` build script - no longer needed with unminified code
+  - ESM imports now work reliably: `import { getDefaultLogger } from '@socketsecurity/lib/logger'`
+  - Verified with real-world ESM module testing (`.mjs` files importing from CJS `.js` dist)
+
+## [3.0.2](https://github.com/SocketDev/socket-lib/releases/tag/v3.0.2) - 2025-11-01
+
+### Fixed
+
+- **Critical: Node.js ESM named imports from CommonJS**: Fixed build output to ensure Node.js ESM can properly detect named exports from CommonJS modules
+  - Previously, esbuild's minified export pattern placed `module.exports` before variable definitions, causing "Cannot access before initialization" errors
+  - Build script now uses `@babel/parser` + `magic-string` for safe AST parsing and transformation
+  - Exports are now correctly placed at end of files after all variable definitions
+  - Enables proper ESM named imports: `import { getDefaultLogger, Logger } from '@socketsecurity/lib/logger'`
+  - Fixes socket-cli issue where named imports were failing with obscure initialization errors
+
+## [3.0.1](https://github.com/SocketDev/socket-lib/releases/tag/v3.0.1) - 2025-11-01
+
+### Added
+
+- **Convenience exports from main index**: Added logger and spinner exports to ease v2→v3 migration
+  - Logger: `getDefaultLogger()`, `Logger`, `LOG_SYMBOLS` now available from `@socketsecurity/lib`
+  - Spinner: `getDefaultSpinner()`, `Spinner` now available from `@socketsecurity/lib`
+  - Both main index (`@socketsecurity/lib`) and subpath (`@socketsecurity/lib/logger`, `@socketsecurity/lib/spinner`) imports now work
+  - Both import paths return the same singleton instances
+
+### Fixed
+
+- **Critical: Spinner crashes when calling logger**: Fixed spinner internal calls to use `getDefaultLogger()` instead of removed `logger` export
+  - Spinner methods (`start()`, `stop()`, `success()`, `fail()`, etc.) no longer crash with "logger is not defined" errors
+  - All 5 internal logger access points updated to use the correct v3 API
+  - Resolves runtime errors when using spinners with hoisted variables
+
+### Changed
+
+- **Migration path improvement**: Users can now import logger/spinner from either main index or subpaths, reducing breaking change impact from v3.0.0
+
+## [3.0.0](https://github.com/SocketDev/socket-lib/releases/tag/v3.0.0) - 2025-11-01
+
+### Added
+
+- Theme system with 5 built-in themes: `socket`, `sunset`, `terracotta`, `lush`, `ultra`
+- `setTheme()`, `getTheme()`, `withTheme()`, `withThemeSync()` for theme management
+- `createTheme()`, `extendTheme()`, `resolveColor()` helper functions
+- `onThemeChange()` event listener for theme reactivity
+- `link()` function for themed terminal hyperlinks in `@socketsecurity/lib/links`
+- Logger and spinner now inherit theme colors automatically
+- Spinner methods: `enableShimmer()`, `disableShimmer()`, `setShimmer()`, `updateShimmer()`
+- DLX cross-platform binary resolution (`.cmd`, `.bat`, `.ps1` on Windows)
+- DLX programmatic options aligned with CLI conventions (`force`, `quiet`, `package`)
+
+### Changed
+
+- Theme context uses AsyncLocalStorage instead of manual stack management
+- Promise retry options renamed: `factor` → `backoffFactor`, `minTimeout` → `baseDelayMs`, `maxTimeout` → `maxDelayMs`
+
+### Removed
+
+**BREAKING CHANGES:**
+
+- `pushTheme()` and `popTheme()` - use `withTheme()` or `withThemeSync()` instead
+- `logger` export - use `getDefaultLogger()` instead
+- `spinner` export - use `getDefaultSpinner()` instead
+- `download-lock.ts` - use `process-lock.ts` instead
+- Promise option aliases: `factor`, `minTimeout`, `maxTimeout`
+
+---
+
+# Changelog
+
+All notable changes to this project will be documented in this file.
+
+The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.1.0/),
+and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
+
+## [2.10.3](https://github.com/SocketDev/socket-lib/releases/tag/v2.10.3) - 2025-10-31
+
+### Fixed
+
+- Updated `@socketregistry/packageurl-js` to 1.3.1 to resolve an unintended external dependency
+- **Documentation**: Corrected JSDoc `@example` import paths from `@socketsecurity/registry` to `@socketsecurity/lib` across utility modules
+  - Updated examples in `memoization.ts`, `performance.ts`, `spinner.ts`, `suppress-warnings.ts`, and `tables.ts`
+  - Ensures documentation reflects correct package name after v1.0.0 rename
+
+## [2.10.2](https://github.com/SocketDev/socket-lib/releases/tag/v2.10.2) - 2025-10-31
+
+### Changed
+
+- **Package spec parsing**: Refactored to use official `npm-package-arg` library for robust handling of all npm package specification formats (versions, ranges, tags, git URLs)
+  - Improves reliability when parsing complex package specs
+  - Better handles edge cases in version ranges and scoped packages
+  - Falls back to simple parsing if npm-package-arg fails
+
+### Fixed
+
+- **Scoped package version parsing**: Fixed critical bug where parsePackageSpec was stripping the `@` prefix from scoped packages with versions
+  - Example: `@coana-tech/cli@~14.12.51` was incorrectly parsed as `coana-tech/cli@~14.12.51`
+  - Caused package installation failures for scoped packages in DLX system
+
+## [2.10.1](https://github.com/SocketDev/socket-lib/releases/tag/v2.10.1) - 2025-10-31
+
+### Fixed
+
+- **Process lock directory creation**: Use recursive mkdir to ensure parent directories exist when creating lock directory
+- **Node.js debug flags**: Remove buggy `getNodeDebugFlags()` function that returned debug flags without required argument values
+
+## [2.10.0](https://github.com/SocketDev/socket-lib/releases/tag/v2.10.0) - 2025-10-30
+
+### Added
+
+- **Unified DLX metadata schema**: Standardized `.dlx-metadata.json` format across TypeScript and C++ implementations
+  - Exported `DlxMetadata` interface as canonical schema reference
+  - Core fields: `version`, `cache_key`, `timestamp`, `checksum`, `checksum_algorithm`, `platform`, `arch`, `size`, `source`
+  - Support for `source` tracking (download vs decompression origin)
+  - Reserved `extra` field for implementation-specific data
+  - Comprehensive documentation with examples for both download and decompression use cases
+
+### Changed
+
+- **DLX binary metadata structure**: Updated `writeMetadata()` to use unified schema with additional fields
+  - Now includes `cache_key` (first 16 chars of SHA-512 hash)
+  - Added `size` field for cached binary size
+  - Added `checksum_algorithm` field (currently "sha256")
+  - Restructured to use `source.type` and `source.url` for origin tracking
+  - Maintains backward compatibility in `listDlxCache()` reader
+
+## [2.9.1](https://github.com/SocketDev/socket-lib/releases/tag/v2.9.1) - 2025-10-30
+
+### Added
+
+- **Smart binary detection in dlxPackage**: Automatically finds the correct binary even when package name doesn't match binary name
+  - If package has single binary, uses it automatically regardless of name
+  - Resolves packages like `@socketsecurity/cli` (binary: `socket`) without manual configuration
+  - Falls back to intelligent name matching for multi-binary packages
+- **Optional binaryName parameter**: Added `binaryName` option to `DlxPackageOptions` for explicit binary selection when auto-detection isn't sufficient
+
+### Fixed
+
+- **Binary resolution for scoped packages**: Fixed issue where `dlxPackage` couldn't find binaries when package name didn't match binary name (e.g., `@socketsecurity/cli` with `bin: { socket: '...' }`)
+
+## [2.9.0](https://github.com/SocketDev/socket-lib/releases/tag/v2.9.0) - 2025-10-30
+
+### Added
+
+- **Socket.dev URL constants**: Added centralized URL constants for Socket.dev services
+  - `SOCKET_WEBSITE_URL`: Main Socket.dev website
+  - `SOCKET_CONTACT_URL`: Contact page
+  - `SOCKET_DASHBOARD_URL`: Dashboard homepage
+  - `SOCKET_API_TOKENS_URL`: API tokens settings page
+  - `SOCKET_PRICING_URL`: Pricing information
+  - `SOCKET_STATUS_URL`: Service status page
+  - `SOCKET_DOCS_URL`: Documentation site
+  - Available via `@socketsecurity/lib/constants/socket`
+
+### Changed
+
+- **Enhanced error messages across library**: Comprehensive audit and improvement of error handling
+  - Added actionable error messages with resolution steps throughout modules
+  - Improved file system operation errors (permissions, read-only filesystems, path issues)
+  - Enhanced DLX error messages with clear troubleshooting guidance
+  - Better error context in process locking, binary downloads, and package operations
+  - Consistent error formatting with helpful user guidance
+- **Consolidated process locking**: Standardized on directory-based lock format across all modules
+  - All locking operations now use `process-lock` module exclusively
+  - Lock directories provide atomic guarantees across all filesystems including NFS
+  - Consistent mtime-based stale detection with 5-second timeout (aligned with npm npx)
+  - Automatic cleanup on process exit with proper signal handling
+
+## [2.8.4](https://github.com/SocketDev/socket-lib/releases/tag/v2.8.4) - 2025-10-30
+
+### Added
+
+- **DLX binary helper functions mirror dlx-package pattern**
+  - `downloadBinary`: Download binary with caching (without execution)
+  - `executeBinary`: Execute cached binary without re-downloading
+  - Renamed internal `downloadBinary` to `downloadBinaryFile` to avoid naming conflicts
+  - Maintains feature parity with `downloadPackage`/`executePackage` from dlx-package
+
+## [2.8.3](https://github.com/SocketDev/socket-lib/releases/tag/v2.8.3) - 2025-10-30
+
+### Fixed
+
+- **Logger now fully defers all console access for Node.js internal bootstrap compatibility**: Completed lazy initialization to prevent ERR_CONSOLE_WRITABLE_STREAM errors
+  - Deferred `Object.getOwnPropertySymbols(console)` call until first logger use
+  - Deferred `kGroupIndentationWidth` symbol lookup
+  - Deferred `Object.entries(console)` and prototype method initialization
+  - Ensures logger can be safely imported in Node.js internal bootstrap contexts (e.g., `lib/internal/bootstrap/*.js`) before stdout is initialized
+  - Builds on v2.8.2 console deferring to complete early bootstrap compatibility
+
+## [2.8.2](https://github.com/SocketDev/socket-lib/releases/tag/v2.8.2) - 2025-10-29
+
+### Changed
+
+- Enhanced Logger class to defer Console creation until first use
+  - Eliminates early bootstrap errors when importing logger before stdout is ready
+  - Enables safe logger imports during Node.js early initialization phase
+  - Simplified internal storage with WeakMap-only pattern for constructor args
+
+## [2.8.1](https://github.com/SocketDev/socket-lib/releases/tag/v2.8.1) - 2025-10-29
+
+### Changed
+
+- **Consolidated DLX cache key generation**: Extracted `generateCacheKey` function to shared `dlx.ts` module
+  - Eliminates code duplication between `dlx-binary.ts` and `dlx-package.ts`
+  - Enables consistent cache key generation across the Socket ecosystem
+  - Exports function for use in dependent packages (e.g., socket-cli)
+  - Maintains SHA-512 truncated to 16 chars strategy from v2.8.0
+
+## [2.8.0](https://github.com/SocketDev/socket-lib/releases/tag/v2.8.0) - 2025-10-29
+
+### Changed
+
+- **Enhanced DLX cache key generation with npm/npx compatibility**: Updated cache key strategy to align with npm/npx ecosystem patterns
+  - Changed from SHA-256 (64 chars) to SHA-512 truncated to 16 chars (matching npm/npx)
+  - Optimized for Windows MAX_PATH compatibility (260 character limit)
+  - Accepts collision risk for shorter paths (~1 in 18 quintillion with 1000 entries)
+  - Added support for PURL-style package specifications (e.g., `npm:prettier@3.0.0`, `pypi:requests@2.31.0`)
+  - Documented Socket's shorthand format (without `pkg:` prefix) handled by `@socketregistry/packageurl-js`
+  - References npm/cli v11.6.2 implementation for consistency
+
+## [2.7.0](https://github.com/SocketDev/socket-lib/releases/tag/v2.7.0) - 2025-10-28
+
+### Added
+
+- **DLX cache locking for concurrent installation protection**: Added process-lock protection to dlx-package installation operations
+  - Lock file created at `~/.socket/_dlx/<hash>/.lock` (similar to npm npx's `concurrency.lock`)
+  - Prevents concurrent installations from corrupting the same package cache
+  - Uses 5-second stale timeout and 2-second periodic touching (aligned with npm npx)
+  - Double-check pattern verifies installation after acquiring lock to avoid redundant work
+  - Completes 100% alignment with npm's npx locking strategy
+
+## [2.6.0](https://github.com/SocketDev/socket-lib/releases/tag/v2.6.0) - 2025-10-28
+
+### Changed
+
+- **Process locking aligned with npm npx**: Enhanced process-lock module to match npm's npx locking strategy
+  - Reduced stale timeout from 10 seconds to 5 seconds (matches npm npx)
+  - Added periodic lock touching (2-second interval) to prevent false stale detection during long operations
+  - Implemented second-level granularity for mtime comparison to avoid APFS floating-point precision issues
+  - Added automatic touch timer cleanup on process exit
+  - Timers use `unref()` to prevent keeping process alive
+  - Aligns with npm's npx implementation per https://github.com/npm/cli/pull/8512
+
+## [2.5.0](https://github.com/SocketDev/socket-lib/releases/tag/v2.5.0) - 2025-10-28
+
+### Added
+
+- **Process locking utilities**: Added `ProcessLockManager` class providing cross-platform inter-process synchronization using file-system based locks
+  - Atomic lock acquisition via `mkdir()` for thread-safe operations
+  - Stale lock detection with automatic cleanup (default 10 seconds, aligned with npm's npx strategy)
+  - Exponential backoff with jitter for retry attempts
+  - Process exit handlers for guaranteed cleanup even on abnormal termination
+  - Three main APIs: `acquire()`, `release()`, and `withLock()` (recommended)
+  - Comprehensive test suite with `describe.sequential` for proper isolation
+  - Export: `@socketsecurity/lib/process-lock`
+
+### Changed
+
+- **Script refactoring**: Renamed `spinner.succeed()` to `spinner.success()` for consistency
+- **Script cleanup**: Removed redundant spinner cleanup in interactive-runner
+
+## [2.4.0](https://github.com/SocketDev/socket-lib/releases/tag/v2.4.0) - 2025-10-28
+
+### Changed
+
+- **Download locking aligned with npm**: Reduced default `staleTimeout` in `downloadWithLock()` from 300 seconds to 10 seconds to align with npm's npx locking strategy
+  - Prevents stale locks from blocking downloads for extended periods
+  - Matches npm's battle-tested timeout range (5-10 seconds)
+  - Binary downloads now protected against concurrent corruption
+- **Binary download protection**: `dlxBinary.downloadBinary()` now uses `downloadWithLock()` to prevent corruption when multiple processes download the same binary concurrently
+  - Eliminates race conditions during parallel binary downloads
+  - Maintains checksum verification and executable permissions
+
+## [2.3.0](https://github.com/SocketDev/socket-lib/releases/tag/v2.3.0) - 2025-10-28
+
+### Added
+
+- **Binary utility wrapper functions**: Added `which()` and `whichSync()` wrapper functions to `bin` module
+  - Cross-platform binary lookup that respects PATH environment variable
+  - Synchronous and asynchronous variants for different use cases
+  - Integrates with existing binary resolution utilities
+
+## [2.2.1](https://github.com/SocketDev/socket-lib/releases/tag/v2.2.1) - 2025-10-28
+
+### Fixed
+
+- **Logger write() method**: Fixed `write()` to bypass Console formatting when outputting raw text
+  - Previously, `write()` used Console's internal `_stdout` stream which applied unintended formatting like group indentation
+  - Now stores a reference to the original stdout stream in a dedicated private field (`#originalStdout`) during construction
+  - The `write()` method uses this stored reference to write directly to the raw stream, bypassing all Console formatting layers
+  - Ensures raw text output without any formatting applied, fixing test failures in CI environments where writes after `indent()` were unexpectedly formatted
+
+## [2.2.0](https://github.com/SocketDev/socket-lib/releases/tag/v2.2.0) - 2025-10-28
+
+### Added
+
+- **Logger step symbol**: `logger.step()` now displays a cyan arrow symbol (→ or > in ASCII) before step messages for improved visual separation
+  - New `LOG_SYMBOLS.step` symbol added to the symbol palette
+  - Automatic stripping of existing symbols from step messages
+  - Maintains existing blank line behavior for clear step separation
+
+## [2.1.0](https://github.com/SocketDev/socket-lib/releases/tag/v2.1.0) - 2025-10-28
+
+### Added
+
+- Package manager detection utilities (`detectPackageManager()`, `getPackageManagerInfo()`, `getPackageManagerUserAgent()`)
+- `isInSocketDlx()` utility to check if file path is within `~/.socket/_dlx/`
+- `downloadPackage()` and `executePackage()` functions for separate download and execution of packages
+
+## [2.0.0](https://github.com/SocketDev/socket-lib/releases/tag/v2.0.0) - 2025-10-27
+
+### Breaking Changes
+
+**Environment Variable System Refactor**
+
+This release completely refactors the environment variable system, consolidating 60+ individual env constant files into grouped getter modules with AsyncLocalStorage-based test rewiring.
+
+**Consolidated env files** - Individual files replaced with grouped modules:
+- `env/github.ts` - All GitHub-related env vars (GITHUB_TOKEN, GH_TOKEN, GITHUB_API_URL, etc.)
+- `env/socket.ts` - Socket-specific env vars (SOCKET_API_TOKEN, SOCKET_CACACHE_DIR, etc.)
+- `env/socket-cli.ts` - Socket CLI env vars (SOCKET_CLI_API_TOKEN, SOCKET_CLI_CONFIG, etc.)
+- `env/npm.ts` - NPM-related env vars
+- `env/locale.ts` - Locale env vars (LANG, LC_ALL, LC_MESSAGES)
+- `env/windows.ts` - Windows-specific env vars (USERPROFILE, LOCALAPPDATA, APPDATA, COMSPEC)
+- `env/xdg.ts` - XDG base directory env vars
+- `env/temp-dir.ts` - Temp directory env vars (TEMP, TMP, TMPDIR)
+- `env/test.ts` - Test framework env vars (VITEST, JEST_WORKER_ID)
+
+**Constants → Getter functions** - All env constants converted to functions:
+```typescript
+// Before (v1.x):
+import { GITHUB_TOKEN } from '#env/github-token'
+
+// After (v2.x):
+import { getGithubToken } from '#env/github'
+```
+
+**Deleted files** - Removed 60+ individual env constant files:
+- `env/github-token.ts`, `env/socket-api-token.ts`, etc. → Consolidated into grouped files
+- `env/getters.ts` → Functions moved to their respective grouped files
+
+### Added
+
+**AsyncLocalStorage-Based Test Rewiring**
+
+New `env/rewire.ts` and `path/rewire.ts` modules provides context-isolated environment variable overrides for testing:
+
+```typescript
+import { withEnv, setEnv, resetEnv, getEnvValue } from '#env/rewire'
+
+// Option 1: Isolated context with AsyncLocalStorage
+await withEnv({ CI: '1', NODE_ENV: 'test' }, async () => {
+  // CI env var is '1' only within this block
+  // Concurrent tests don't interfere
+})
+
+// Option 2: Traditional beforeEach/afterEach pattern
+beforeEach(() => {
+  setEnv('CI', '1')
+})
+
+afterEach(() => {
+  resetEnv()
+})
+```
+
+**Features:**
+- Allows toggling between snapshot and live behavior
+- Compatible with `vi.stubEnv()` as fallback
+
+### Changed
+
+- Updated all dynamic `require()` statements to use path aliases (`#constants/*`, `#packages/*`)
+- Improved logger blank line tracking per stream (separate stderr/stdout tracking)
+- Exported `getCacache()` function for external use
+
+## [1.3.6](https://github.com/SocketDev/socket-lib/releases/tag/v1.3.6) - 2025-10-26
+
+### Fixed
+
+- Fixed `debug` module functions being incorrectly tree-shaken as no-ops in bundled output
+  - Removed incorrect `/*@__NO_SIDE_EFFECTS__*/` annotations from `debug()`, `debugDir()`, `debugLog()`, and their `*Ns` variants
+  - These functions have side effects (logging output, spinner manipulation) and should not be removed by bundlers
+  - Fixes issue where `debugLog()` and `debugDir()` were compiled to empty no-op functions
+
+## [1.3.5](https://github.com/SocketDev/socket-lib/releases/tag/v1.3.5) - 2025-10-26
+
+### Added
+
+- Added `createEnvProxy()` utility function to `env` module for Windows-compatible environment variable access
+  - Provides case-insensitive environment variable access (e.g., PATH, Path, path all work)
+  - Smart priority system: overrides > exact match > case-insensitive fallback
+  - Full Proxy implementation with proper handlers for get, set, has, ownKeys, getOwnPropertyDescriptor
+  - Opt-in helper for users who need Windows env var compatibility
+  - Well-documented with usage examples and performance notes
+- Added `findCaseInsensitiveEnvKey()` utility function to `env` module
+  - Searches for environment variable keys using case-insensitive matching
+  - Optimized with length fast path to minimize expensive `toUpperCase()` calls
+  - Useful for cross-platform env var access where case may vary (e.g., PATH vs Path vs path)
+- Added comprehensive test suite for `env` module with 71 tests
+  - Covers `envAsBoolean()`, `envAsNumber()`, `envAsString()` conversion utilities
+  - Tests `createEnvProxy()` with Windows environment variables and edge cases
+  - Validates `findCaseInsensitiveEnvKey()` optimization and behavior
+
+### Fixed
+
+- Fixed `spawn` module to preserve Windows `process.env` Proxy behavior
+  - When no custom environment variables are provided, use `process.env` directly instead of spreading it
+  - Preserves Windows case-insensitive environment variable access (PATH vs Path)
+  - Fixes empty CLI output issue on Windows CI runners
+  - Only spreads `process.env` when merging custom environment variables
+
+## [1.3.4](https://github.com/SocketDev/socket-lib/releases/tag/v1.3.4) - 2025-10-26
+
+### Added
+
+- Added Node.js SIGUSR1 signal handler prevention utilities in `constants/node` module
+  - `supportsNodeDisableSigusr1Flag()`: Detects if Node supports `--disable-sigusr1` flag (v22.14+, v23.7+, v24.8+)
+  - `getNodeDisableSigusr1Flags()`: Returns appropriate flags to prevent debugger attachment
+    - Returns `['--disable-sigusr1']` on supported versions (prevents Signal I/O Thread creation)
+    - Falls back to `['--no-inspect']` on Node 18+ (blocks debugger but still creates thread)
+  - Enables production CLI environments to prevent SIGUSR1 debugger signal handling for security
+
+## [1.3.3](https://github.com/SocketDev/socket-lib/releases/tag/v1.3.3) - 2025-10-24
+
+### Fixed
+
+- Fixed lazy getter bug in `objects` module where `defineGetter`, `defineLazyGetter`, and `defineLazyGetters` had incorrect `/*@__NO_SIDE_EFFECTS__*/` annotations
+  - These functions mutate objects by defining properties, so marking them as side-effect-free caused esbuild to incorrectly tree-shake the calls during bundling
+  - Lazy getters were returning `undefined` instead of their computed values
+  - Removed double wrapping in `defineLazyGetters` where `createLazyGetter` was being called unnecessarily
+
+## [1.3.2](https://github.com/SocketDev/socket-lib/releases/tag/v1.3.2) - 2025-10-24
+
+### Fixed
+
+- Continued fixing of broken external dependency bundling
+
+## [1.3.1](https://github.com/SocketDev/socket-lib/releases/tag/v1.3.1) - 2025-10-24
+
+### Fixed
+
+- Fixed @inquirer modules (`input`, `password`, `search`) not being properly bundled into `dist/external/`
+  - Resolves build failures in downstream packages (socket-cli) that depend on socket-lib
+  - Added missing packages to bundling configuration in `scripts/build-externals.mjs`
+  - All @inquirer packages now ship as zero-dependency bundles
+
+### Added
+
+- Added tests to prevent rogue external stubs in `dist/external/`
+  - Detects stub re-export patterns that indicate incomplete bundling
+  - Verifies all @inquirer modules are properly bundled (> 1KB)
+  - Catches bundling regressions early in CI pipeline
+
+## [1.3.0](https://github.com/SocketDev/socket-lib/releases/tag/v1.3.0) - 2025-10-23
+
+### Added
+
+- Added `validateFiles()` utility function to `fs` module for defensive file access validation
+  - Returns `ValidateFilesResult` with `validPaths` and `invalidPaths` arrays
+  - Filters out unreadable files before processing (common with Yarn Berry PnP virtual filesystem, pnpm symlinks)
+  - Prevents ENOENT errors when files exist in glob results but are not accessible
+  - Comprehensive test coverage for all validation scenarios
+
+## [1.2.0](https://github.com/SocketDev/socket-lib/releases/tag/v1.2.0) - 2025-10-23
+
+### Added
+
+- Added `dlx-package` module for installing and executing npm packages directly
+  - Content-addressed caching using SHA256 hash (like npm's _npx)
+  - Auto-force for version ranges (^, ~, >, <) to get latest within range
+  - Cross-platform support with comprehensive tests (30 tests)
+  - Parses scoped and unscoped package specs correctly
+  - Resolves binaries from package.json bin field
+
+### Changed
+
+- Unified DLX storage under `~/.socket/_dlx/` directory
+  - Binary downloads now use `~/.socket/_dlx/` instead of non-existent cache path
+  - Both npm packages and binaries share parent directory with content-addressed hashing
+- Updated paths.ts documentation to clarify unified directory structure
+
+## [1.1.2] - 2025-10-23
+
+### Fixed
+
+- Fixed broken relative import paths in `packages/isolation.ts` and `packages/provenance.ts` that prevented bundling by external tools
+
+## [1.1.1] - 2025-10-23
+
+### Fixed
+
+- Fixed shimmer text effects not respecting CI environment detection (now disabled in CI to prevent ANSI escape codes in logs)
+
+## [1.1.0] - 2025-10-23
+
+### Added
+
+- Added `filterOutput` option to `stdio/mask` for filtering output chunks before display/buffering
+- Added `overrideExitCode` option to `stdio/mask` for customizing exit codes based on captured output
+- Added comprehensive JSDoc documentation across entire library for enhanced VSCode IntelliSense
+  - Detailed @param, @returns, @template, @throws tags
+  - Practical @example blocks with real-world usage patterns
+  - @default tags showing default values
+  - Enhanced interface property documentation
+
+### Changed
+
+- Improved TypeScript type hints and tooltips throughout library
+- Enhanced documentation for all core utilities (arrays, fs, git, github, http-request, json, logger, objects, path, promises, spawn, spinner, strings)
+- Enhanced documentation for stdio utilities (clear, divider, footer, header, mask, progress, prompts, stderr, stdout)
+- Enhanced documentation for validation utilities (json-parser, types)
+
+## [1.0.5] - 2025-10-22
+
+### Added
+
+- Added support for custom retry delays from onRetry callback
+
+## [1.0.4] - 2025-10-21
+
+### Fixed
+
+- Fixed external dependency paths in root-level source files (corrected require paths from `../external/` to `./external/` in bin, cacache, fs, globs, spawn, spinner, and streams modules)
+
+## [1.0.3] - 2025-10-21
+
+### Fixed
+
+- Fixed external dependency import paths in packages and stdio modules (corrected require paths from `../../external/` to `../external/`)
+
+## [1.0.2] - 2025-10-21
+
+### Fixed
+
+- Fixed module resolution error in packages/normalize module (corrected require path from `../../constants/socket` to `../constants/socket`)
+
 ## [1.0.1] - 2025-10-21
 
 ### Fixed
diff --git a/CLAUDE.md b/CLAUDE.md
index 7e30707..3861d72 100644
--- a/CLAUDE.md
+++ b/CLAUDE.md
@@ -1,14 +1,61 @@
 # CLAUDE.md
 
-🚨 **MANDATORY**: Act as principal-level engineer with deep expertise in TypeScript, Node.js, and library development.
+**MANDATORY**: Act as principal-level engineer. Follow these guidelines exactly.
+
+## CANONICAL REFERENCE
+
+This is a reference to shared Socket standards. See `../socket-registry/CLAUDE.md` for canonical source.
+
+## 👤 USER CONTEXT
+
+- **Identify users by git credentials**: Extract name from git commit author, GitHub account, or context
+- 🚨 **When identity is verified**: ALWAYS use their actual name - NEVER use "the user" or "user"
+- **Direct communication**: Use "you/your" when speaking directly to the verified user
+- **Discussing their work**: Use their actual name when referencing their commits/contributions
+- **Example**: If git shows "John-David Dalton <jdalton@example.com>", refer to them as "John-David"
+- **Other contributors**: Use their actual names from commit history/context
+
+## PRE-ACTION PROTOCOL
+
+**MANDATORY**: Review CLAUDE.md before any action. No exceptions.
+
+## VERIFICATION PROTOCOL
+
+**MANDATORY**: Before claiming any task is complete:
+1. Test the solution end-to-end
+2. Verify all changes work as expected
+3. Run the actual commands to confirm functionality
+4. Never claim "Done" without verification
+
+## ABSOLUTE RULES
+
+- Never create files unless necessary
+- Always prefer editing existing files
+- Forbidden to create docs unless requested
+- Required to do exactly what was asked
+
+## ROLE
+
+Principal Software Engineer: production code, architecture, reliability, ownership.
+
+## EVOLUTION
+
+If user repeats instruction 2+ times, ask: "Should I add this to CLAUDE.md?"
 
 ## 📚 SHARED STANDARDS
 
-**See canonical reference:** `../socket-registry/CLAUDE.md`
+**Canonical reference**: `../socket-registry/CLAUDE.md`
 
-For all shared Socket standards (git workflow, testing, code style, imports, sorting, error handling, cross-platform, CI, etc.), refer to socket-registry/CLAUDE.md.
+All shared standards (git, testing, code style, cross-platform, CI) defined in socket-registry/CLAUDE.md.
 
-**Git Workflow Reminder**: When user says "commit changes" → create actual commits, use small atomic commits, follow all CLAUDE.md rules (NO AI attribution).
+**Quick references**:
+- Commits: [Conventional Commits](https://www.conventionalcommits.org/en/v1.0.0/) `<type>(<scope>): <description>` - NO AI attribution
+- Scripts: Prefer `pnpm run foo --flag` over `foo:bar` scripts
+- Docs: Use `docs/` folder, lowercase-with-hyphens.md filenames, pithy writing with visuals
+- Dependencies: After `package.json` edits, run `pnpm install` to update `pnpm-lock.yaml`
+- Backward Compatibility: NO backward compat - we're our only consumers, make clean breaks
+- Work Safeguards: MANDATORY commit + backup branch before bulk changes
+- Safe Deletion: Use `safeDelete()` from `@socketsecurity/lib/fs` (NEVER `fs.rm/rmSync` or `rm -rf`)
 
 ---
 
@@ -19,6 +66,7 @@ For all shared Socket standards (git workflow, testing, code style, imports, sor
 - ✗ Error/failure - MUST be red (NOT ❌)
 - ⚠ Warning/caution - MUST be yellow (NOT ⚠️)
 - ℹ Info - MUST be blue (NOT ℹ️)
+- → Step/progress - MUST be cyan (NOT ➜ or ▶)
 
 **Color Requirements** (apply color to icon ONLY, not entire message):
 ```javascript
@@ -28,6 +76,7 @@ import colors from 'yoctocolors-cjs'
 `${colors.red('✗')} ${msg}`     // Error
 `${colors.yellow('⚠')} ${msg}`  // Warning
 `${colors.blue('ℹ')} ${msg}`    // Info
+`${colors.cyan('→')} ${msg}`    // Step/Progress
 ```
 
 **Color Package**:
@@ -42,8 +91,8 @@ import colors from 'yoctocolors-cjs'
 - 🎉 Major success/celebration
 
 **General Philosophy**:
-- Prefer colored text-based symbols (✓✗⚠ℹ) for maximum terminal compatibility
-- Always color-code symbols: green=success, red=error, yellow=warning, blue=info
+- Prefer colored text-based symbols (✓✗⚠ℹ→) for maximum terminal compatibility
+- Always color-code symbols: green=success, red=error, yellow=warning, blue=info, cyan=step
 - Use emojis sparingly for emphasis and delight
 - Avoid emoji overload - less is more
 - When in doubt, use plain text
@@ -53,26 +102,38 @@ import colors from 'yoctocolors-cjs'
 ## 🏗️ LIB-SPECIFIC
 
 ### Architecture
-Socket utilities library - Core infrastructure for Socket.dev security tools
-
-**Core Structure**:
-- **Entry**: `src/index.ts` - Main export barrel
-- **Constants**: `src/constants/` - Node.js, npm, package manager constants
-- **Environment**: `src/env/` - Typed environment variable access
-- **Utilities**: `src/lib/` - Core utility functions
-- **Types**: `src/types.ts` - TypeScript type definitions
-- **External**: `src/external/` - Vendored external dependencies
-- **Scripts**: `scripts/` - Build and development scripts
-
-**Path Aliases**:
-- `#constants/*` → `src/constants/*`
-- `#env/*` → `src/env/*`
-- `#lib/*` → `src/lib/*`
-- `#packages/*` → `src/lib/packages/*`
-- `#types` → `src/types`
-- `#utils/*` → `src/utils/*`
-
-**Features**: Type-safe utilities, environment variable helpers, file system operations, package management utilities, path normalization, spawn utilities, CLI effects
+
+Core infrastructure library for Socket.dev security tools.
+
+**Directory structure**:
+```
+src/
+├── index.ts           # Main export barrel
+├── types.ts           # TypeScript type definitions
+├── constants/         # Node.js, npm, package manager constants
+├── env/              # Typed environment variable access
+├── lib/              # Core utility functions
+│   └── packages/     # Package management utilities
+├── external/         # Vendored external dependencies
+└── utils/            # Shared utilities
+
+dist/                 # Build output (CommonJS)
+├── external/         # Bundled external dependencies
+└── ...               # Compiled source files
+
+scripts/              # Build and development scripts
+test/                 # Test files
+```
+
+**Path aliases**:
+```
+#constants/* → src/constants/*
+#env/*       → src/env/*
+#lib/*       → src/lib/*
+#packages/*  → src/lib/packages/*
+#types       → src/types
+#utils/*     → src/utils/*
+```
 
 ### Commands
 - **Build**: `pnpm build` (production build)
@@ -135,11 +196,26 @@ Blank lines between groups, alphabetical within groups.
 
 #### Path Aliases Usage
 - **Internal imports**: Always use path aliases for internal modules
-  - ✅ `import { CI } from '#env/ci'`
-  - ❌ `import { CI } from '../env/ci'`
+  - ✅ `import { getCI } from '#env/ci'`
+  - ❌ `import { getCI } from '../env/ci'`
 - **External modules**: Regular imports
   - ✅ `import path from 'node:path'`
 
+#### Export Patterns
+- **Named exports ONLY**: 🚨 MANDATORY for all library modules
+  - ✅ `export { value }` - Direct named export
+  - ✅ `export { foo, bar, baz }` - Multiple named exports
+  - ❌ `export default value` - FORBIDDEN (breaks dual CJS/ESM compatibility)
+  - ❌ `export default X; export { X as 'module.exports' }` - FORBIDDEN (dual export pattern)
+- **Rationale**: Dual-format (CJS/ESM) compatibility requires consistent named exports
+  - Named exports work identically in both module systems
+  - Default exports require `.default` access, breaking consistency
+  - Build validation enforces this pattern (enabled in CI)
+- **Enforcement**:
+  - Biome linting rule: `"noDefaultExport": "error"`
+  - Build-time validation: `scripts/validate/esm-named-exports.mjs`
+  - CI validation: `scripts/validate/dist-exports.mjs`
+
 ### Package Exports
 
 #### Export Structure
@@ -163,9 +239,11 @@ Or use `scripts/generate-package-exports.mjs` to auto-generate exports.
 
 ### Testing
 
+**Vitest Configuration**: This repo uses the shared vitest configuration pattern documented in `../socket-registry/CLAUDE.md` (see "Vitest Configuration Variants" section). Main config: `.config/vitest.config.mts`
+
 #### Test Structure
-- **Directories**: `test/registry/` - Registry-style tests
-- **Naming**: Match source structure (e.g., `test/registry/lib/spinner.test.ts` for `src/lib/spinner.ts`)
+- **Directories**: `test/` - All test files
+- **Naming**: Match source structure (e.g., `test/spinner.test.ts` for `src/spinner.ts`)
 - **Framework**: Vitest
 - **Coverage**: c8/v8 coverage via Vitest
 
@@ -200,10 +278,42 @@ Some dependencies are vendored in `src/external/`:
 ```
 
 ### CI Integration
-- **Workflow**: `.github/workflows/ci.yml`
-- **Reusable workflow**: References `SocketDev/socket-registry/.github/workflows/ci.yml@<SHA>`
-- **🚨 MANDATORY**: Use full commit SHA, not tags
-- **Format**: `@662bbcab1b7533e24ba8e3446cffd8a7e5f7617e # main`
+
+#### Optimized CI Pipeline
+**Workflow**: `.github/workflows/ci.yml` - Custom optimized pipeline
+
+**Key Optimizations**:
+- **Separate lint job**: Runs once (not 6x in matrix) - saves ~10s
+- **Build caching**: Build runs once, artifacts cached for all jobs - eliminates 5 rebuilds (~8s saved)
+- **Parallel execution**: Lint, build, test, type-check run in parallel where possible
+- **Smart dependencies**: Type-check runs after build completes, tests wait for lint + build
+- **Matrix strategy**: Tests run on Node 20/22/24 × Ubuntu/Windows (6 combinations)
+
+**Performance**:
+- Build time: ~1.6s (esbuild, parallelized)
+- Test execution: ~5s (4582 tests, multi-threaded)
+- Total CI time: ~40-60% faster than previous setup
+- Status check job: Single required check for branch protection
+
+**Job Structure**:
+1. **lint** - Runs Biome linting (once, Node 22/Ubuntu)
+2. **build** - Compiles source, caches dist + node_modules
+3. **test** - Runs test suite on all matrix combinations (uses cached build)
+4. **type-check** - TypeScript type checking (uses cached build)
+5. **ci-success** - Aggregates all job results for branch protection
+
+**Cache Strategy**:
+```yaml
+key: build-${{ github.sha }}-${{ runner.os }}
+path: |
+  dist
+  node_modules
+```
+
+**Previous Setup** (for reference):
+- Used reusable workflow: `SocketDev/socket-registry/.github/workflows/ci.yml@<SHA>`
+- 🚨 MANDATORY: Use full commit SHA, not tags
+- Format: `@662bbcab1b7533e24ba8e3446cffd8a7e5f7617e # main`
 
 ### Development Workflow
 
@@ -221,19 +331,43 @@ Use `pnpm run build:watch` or `pnpm run dev` for development with automatic rebu
 3. Add type definitions
 4. Add to `src/index.ts` if public API
 5. Update `package.json` exports if direct export needed
-6. Add tests in `test/registry/` matching structure
+6. Add tests in `test/` matching structure
 7. Update types and build
 
 ### Common Patterns
 
 #### Environment Variables
-Access via typed helpers in `src/env/`:
+Access via typed getter functions in `src/env/`:
+```typescript
+import { getCI } from '#env/ci'
+import { getNodeEnv } from '#env/node-env'
+import { isTest } from '#env/test'
+```
+
+Each env module exports a pure getter function that accesses only its own environment variable. For fallback logic, compose multiple getters:
 ```typescript
-import { CI } from '#env/ci'
-import { NODE_ENV } from '#env/node-env'
-import { getEnv } from '#env/getters'
+import { getHome } from '#env/home'
+import { getUserProfile } from '#env/userprofile'
+
+const homeDir = getHome() || getUserProfile()  // Cross-platform fallback
 ```
 
+**Testing with rewiring:**
+Environment getters support test rewiring without modifying `process.env`:
+```typescript
+import { setEnv, clearEnv, resetEnv } from '#env/rewire'
+import { getCI } from '#env/ci'
+
+// In test
+setEnv('CI', '1')
+expect(getCI()).toBe(true)
+
+clearEnv('CI')  // Clear single override
+resetEnv()      // Clear all overrides (use in afterEach)
+```
+
+This allows isolated tests without polluting the global process.env state.
+
 #### File System Operations
 Use utilities from `#lib/fs`:
 ```typescript
@@ -252,6 +386,11 @@ Use path utilities from `#lib/paths`:
 import { normalizePath } from '#lib/paths'
 ```
 
+#### Working Directory
+- **🚨 NEVER use `process.chdir()`** - use `{ cwd }` options and absolute paths instead
+  - Breaks tests, worker threads, and causes race conditions
+  - Always pass `{ cwd: absolutePath }` to spawn/exec/fs operations
+
 ### Debugging
 
 #### Common Issues
diff --git a/README.md b/README.md
index 5258821..3fd83e3 100644
--- a/README.md
+++ b/README.md
@@ -1,87 +1,52 @@
 # @socketsecurity/lib
 
 [![Socket Badge](https://socket.dev/api/badge/npm/package/@socketsecurity/lib)](https://socket.dev/npm/package/@socketsecurity/lib)
-[![CI - SocketDev/socket-lib](https://github.com/SocketDev/socket-lib/actions/workflows/ci.yml/badge.svg)](https://github.com/SocketDev/socket-lib/actions/workflows/ci.yml)
+[![CI](https://github.com/SocketDev/socket-lib/actions/workflows/ci.yml/badge.svg)](https://github.com/SocketDev/socket-lib/actions/workflows/ci.yml)
+![Coverage](https://img.shields.io/badge/coverage-83.02%25-brightgreen)
 
 [![Follow @SocketSecurity](https://img.shields.io/twitter/follow/SocketSecurity?style=social)](https://twitter.com/SocketSecurity)
-[![Follow @socket.dev on Bluesky](https://img.shields.io/badge/Follow-@socket.dev-1DA1F2?style=social&logo=bluesky)](https://bsky.app/profile/socket.dev)
 
-> Core utilities, constants, and helper functions for Socket.dev security tools.
+Core library for Socket.dev tools.
 
-## Installation
+## Install
 
 ```bash
-pnpm install @socketsecurity/lib
+pnpm add @socketsecurity/lib
 ```
 
-## Features
-
-- **Constants** — Access Node.js, npm, and package manager constants
-- **Type Definitions** — Full TypeScript support with comprehensive type exports
-- **Helper Utilities** — File system, path, package, and process utilities
-- **Environment Variables** — Typed access to environment variables
-- **Effects** — Visual effects for CLI applications
-
 ## Usage
 
-### Constants
-
-Import Node.js and package manager constants:
-
 ```typescript
-import {
-  NODE_MODULES,
-  PACKAGE_JSON,
-  PNPM_LOCK_YAML,
-  NPM_REGISTRY_URL,
-} from '@socketsecurity/lib/constants/packages'
+// Tree-shakeable exports
+import { Spinner } from '@socketsecurity/lib/spinner'
+import { readJsonFile } from '@socketsecurity/lib/fs'
+import { NODE_MODULES } from '@socketsecurity/lib/constants/packages'
+
+const spinner = Spinner({ text: 'Loading...' })
+spinner.start()
+const pkg = await readJsonFile('./package.json')
+spinner.stop()
 ```
 
-### Environment Variables
+## What's Inside
 
-Access typed environment variables:
+- **Visual Effects** → Spinners, themes, logger
+- **File System** → fs, paths, globs
+- **Package Management** → npm, pnpm, yarn, dlx
+- **Process & Spawn** → Safe process spawning
+- **Environment** → 68 typed env getters
+- **Constants** → Node.js, npm, platform
+- **Utilities** → Arrays, objects, strings, promises
 
-```typescript
-import { getEnv } from '@socketsecurity/lib/env/getters'
-import { NODE_ENV } from '@socketsecurity/lib/env/node-env'
+## Development
 
-const env = getEnv('NODE_ENV')
-console.log(NODE_ENV) // 'production' | 'development' | 'test'
-```
-
-For a complete list of available modules, see the [package.json exports](./package.json).
-
-## Type Definitions
-
-All types are exported for TypeScript projects:
-
-```typescript
-import type {
-  PackageJson,
-  TsConfig,
-  LockFile,
-} from '@socketsecurity/lib/types'
-```
-
-## Utilities
-
-Access utility modules for common operations:
-
-```typescript
-// File system utilities
-import { readJsonFile, writeJsonFile } from '@socketsecurity/lib/fs'
-
-// Package utilities
-import { parsePackageSpec } from '@socketsecurity/lib/packages'
-
-// Path utilities
-import { normalizePath } from '@socketsecurity/lib/paths'
-
-// And many more...
+```bash
+pnpm install    # Install
+pnpm build      # Build
+pnpm test       # Test
+pnpm dev        # Watch mode
 ```
 
-See the [exports map](./package.json) for all available utility modules.
-
 ## License
 
 MIT
diff --git a/biome.json b/biome.json
index 6cb23ee..0578c9c 100644
--- a/biome.json
+++ b/biome.json
@@ -4,6 +4,7 @@
     "includes": [
       "**",
       "!**/.cache",
+      "!**/.claude",
       "!**/.DS_Store",
       "!**/._.DS_Store",
       "!**/.env",
@@ -13,6 +14,8 @@
       "!**/.vscode",
       "!**/coverage",
       "!**/dist",
+      "!**/html",
+      "!**/node_modules",
       "!**/package.json",
       "!**/pnpm-lock.yaml",
       "!packages/npm/**/build",
@@ -61,13 +64,17 @@
   "linter": {
     "rules": {
       "complexity": {
+        "noBannedTypes": "off",
         "useLiteralKeys": "off"
       },
       "style": {
-        "noParameterAssign": "error",
+        "noDefaultExport": "error",
+        "noParameterAssign": "off",
+        "noNonNullAssertion": "off",
         "useAsConstAssertion": "error",
         "useDefaultParameterLast": "error",
         "useEnumInitializers": "error",
+        "useNodejsImportProtocol": "off",
         "useSelfClosingElements": "error",
         "useSingleVarDeclarator": "error",
         "noUnusedTemplateLiteral": "error",
@@ -75,9 +82,18 @@
         "noInferrableTypes": "off",
         "noUselessElse": "error",
         "useNumericSeparators": "error"
+      },
+      "suspicious": {
+        "noExplicitAny": "off",
+        "noAsyncPromiseExecutor": "off",
+        "noAssignInExpressions": "off",
+        "useIterableCallbackReturn": "off"
       }
     }
   },
+  "assist": {
+    "enabled": false
+  },
   "overrides": [
     {
       "includes": ["packages/npm/**/*.d.ts"],
@@ -129,11 +145,22 @@
           },
           "suspicious": {
             "noExplicitAny": "off",
+            "noImportAssign": "off",
             "noShadowRestrictedNames": "off"
           }
         }
       }
     },
+    {
+      "includes": ["test/**/*.ts"],
+      "linter": {
+        "rules": {
+          "suspicious": {
+            "noImportAssign": "off"
+          }
+        }
+      }
+    },
     {
       "includes": ["registry/src/external/**/*.d.ts"],
       "linter": {
@@ -143,6 +170,26 @@
           }
         }
       }
+    },
+    {
+      "includes": ["src/external/**/*.js", "src/external/**/*.cjs"],
+      "linter": {
+        "rules": {
+          "suspicious": {
+            "noRedundantUseStrict": "off"
+          }
+        }
+      }
+    },
+    {
+      "includes": [".config/**/*"],
+      "linter": {
+        "rules": {
+          "style": {
+            "noDefaultExport": "off"
+          }
+        }
+      }
     }
   ]
 }
diff --git a/docs/build.md b/docs/build.md
deleted file mode 100644
index f678a0a..0000000
--- a/docs/build.md
+++ /dev/null
@@ -1,163 +0,0 @@
-# Build Architecture
-
-## External Dependencies
-
-### Overview
-
-The registry uses a specialized architecture for managing dependencies to optimize bundle size and ensure clean separation between bundled and external code.
-
-### Dependency Types
-
-#### dependencies (Runtime)
-
-The following package is a **runtime dependency** because it's a separate package:
-
-```json
-"@socketregistry/packageurl-js": "1.3.0"
-```
-
-This package:
-- Is a separate package that depends on registry
-- Can be re-exported from `src/external/`
-- Is listed in ALLOWED_EXTERNAL_PACKAGES
-
-#### devDependencies (Build-time, Vendored)
-
-Other @socketregistry and @socketsecurity packages are **vendored** into `src/external/`:
-- The source code is copied directly into external files
-- They do NOT need to be listed in any dependencies
-- They are standalone, bundled code
-
-### The src/external/ Layer
-
-#### Purpose
-
-`src/external/` contains **vendored/bundled source code** from dependencies.
-
-#### Import Rules
-
-**Inside src/external/**: Files must contain bundled/vendored code
-```javascript
-// src/external/@socketregistry/is-unicode-supported.js
-// Contains the full source code, not a re-export
-module.exports = function isUnicodeSupported() {
-  // ... implementation ...
-}
-```
-
-**Outside src/external/**: Must use relative paths
-```javascript
-// src/lib/logger.ts - CORRECT
-require('../external/@socketregistry/is-unicode-supported')()
-
-// src/lib/logger.ts - INCORRECT
-require('@socketregistry/is-unicode-supported')
-```
-
-### Validation
-
-The `scripts/validate-external.mjs` script enforces these rules:
-
-- Scans all files in `src/external/`
-- Detects re-exports of `@socketregistry/*` and `@socketsecurity/*` packages (except allowed)
-- Ensures external files contain bundled code, not `require('@package')` re-exports
-
-Run validation:
-```bash
-node scripts/validate-external.mjs
-```
-
-Forbidden patterns in `src/external/` (except ALLOWED_EXTERNAL_PACKAGES):
-- `require('@socketregistry/package-name')`
-- `from '@socketregistry/package-name'`
-- `require('@socketsecurity/package-name')`
-- `from '@socketsecurity/package-name'`
-
-Allowed:
-- `@socketregistry/packageurl-js` - separate package, listed in dependencies
-
-### Build Process
-
-#### src/external/ Files
-
-Files in `src/external/`:
-1. Are validated before build (must be bundled code)
-2. Copied to `dist/external/` by `scripts/rollup/build-external.mjs`
-3. The bundled code is included in the dist output
-
-#### Rollup Configuration
-
-The main rollup config (`.config/rollup.dist.config.mjs`) externalizes:
-- Node.js built-ins
-- `node_modules` dependencies
-- Paths containing `/external/`
-
-### Why This Architecture?
-
-1. **No Runtime Dependencies**: Vendored code means no external dependencies needed
-2. **Clear Boundaries**: `src/external/` contains only bundled/vendored code
-3. **Build-time Validation**: Automatic detection of accidental re-exports
-4. **Smaller Bundles**: Only include what's actually used
-5. **Maintainability**: Clear rules about what external files can contain
-
-### Common Mistakes
-
-❌ **Re-exporting from npm in src/external/**
-```javascript
-// src/external/@socketregistry/yocto-spinner.js - WRONG
-module.exports = require('@socketregistry/yocto-spinner')
-```
-
-❌ **Adding vendored packages to devDependencies**
-```json
-"devDependencies": {
-  "@socketregistry/yocto-spinner": "1.0.24"  // WRONG - it's vendored
-}
-```
-
-❌ **Bare imports outside src/external/**
-```javascript
-// src/lib/logger.ts - WRONG
-require('@socketregistry/is-unicode-supported')
-```
-
-✅ **Correct patterns**
-```javascript
-// src/external/@socketregistry/yocto-spinner.js - CORRECT
-module.exports = function yoctoSpinner(options) {
-  // ... full bundled implementation ...
-}
-```
-
-```javascript
-// src/lib/logger.ts - CORRECT
-require('../external/@socketregistry/is-unicode-supported')
-```
-
-```json
-// package.json - CORRECT
-"dependencies": {
-  "@socketregistry/packageurl-js": "1.3.0"
-}
-```
-
-### Troubleshooting
-
-**"Cannot find module '@socketregistry/package-name'" at runtime**
-
-This means a package is being required directly but isn't in dependencies. Check if:
-1. It should be vendored into `src/external/` as bundled code
-2. It should be added to `dependencies` and ALLOWED_EXTERNAL_PACKAGES
-
-**Validation fails for external file**
-
-The external file contains a re-export instead of bundled code. Either:
-1. Vendor the source code directly into the file
-2. Add the package to ALLOWED_EXTERNAL_PACKAGES and `dependencies` if it's meant to be a runtime dependency
-
-**How to vendor a new dependency**
-
-1. Copy the source code into `src/external/@scope/package-name.js`
-2. Ensure it doesn't `require()` the npm package
-3. Run `pnpm run validate:external` to verify
-4. The code will be bundled during build
diff --git a/package.json b/package.json
index 8e1a7f4..6a05755 100644
--- a/package.json
+++ b/package.json
@@ -1,6 +1,6 @@
 {
   "name": "@socketsecurity/lib",
-  "version": "1.0.1",
+  "version": "3.3.0",
   "license": "MIT",
   "description": "Core utilities and infrastructure for Socket.dev security tools",
   "keywords": [
@@ -20,14 +20,6 @@
     "url": "https://socket.dev"
   },
   "exports": {
-    ".": {
-      "types": "./dist/index.d.ts",
-      "default": "./dist/index.js"
-    },
-    "./index": {
-      "types": "./dist/index.d.ts",
-      "default": "./dist/index.js"
-    },
     "./abort": {
       "types": "./dist/abort.d.ts",
       "default": "./dist/abort.js"
@@ -64,6 +56,10 @@
       "types": "./dist/cache-with-ttl.d.ts",
       "default": "./dist/cache-with-ttl.js"
     },
+    "./colors": {
+      "types": "./dist/colors.d.ts",
+      "default": "./dist/colors.js"
+    },
     "./constants/agents": {
       "types": "./dist/constants/agents.d.ts",
       "default": "./dist/constants/agents.js"
@@ -148,9 +144,13 @@
       "types": "./dist/dlx-binary.d.ts",
       "default": "./dist/dlx-binary.js"
     },
-    "./download-lock": {
-      "types": "./dist/download-lock.d.ts",
-      "default": "./dist/download-lock.js"
+    "./dlx-manifest": {
+      "types": "./dist/dlx-manifest.d.ts",
+      "default": "./dist/dlx-manifest.js"
+    },
+    "./dlx-package": {
+      "types": "./dist/dlx-package.d.ts",
+      "default": "./dist/dlx-package.js"
     },
     "./effects/pulse-frames": {
       "types": "./dist/effects/pulse-frames.d.ts",
@@ -172,53 +172,17 @@
       "types": "./dist/env.d.ts",
       "default": "./dist/env.js"
     },
-    "./env/appdata": {
-      "types": "./dist/env/appdata.d.ts",
-      "default": "./dist/env/appdata.js"
-    },
     "./env/ci": {
       "types": "./dist/env/ci.d.ts",
       "default": "./dist/env/ci.js"
     },
-    "./env/comspec": {
-      "types": "./dist/env/comspec.d.ts",
-      "default": "./dist/env/comspec.js"
-    },
     "./env/debug": {
       "types": "./dist/env/debug.d.ts",
       "default": "./dist/env/debug.js"
     },
-    "./env/getters": {
-      "types": "./dist/env/getters.d.ts",
-      "default": "./dist/env/getters.js"
-    },
-    "./env/github-api-url": {
-      "types": "./dist/env/github-api-url.d.ts",
-      "default": "./dist/env/github-api-url.js"
-    },
-    "./env/github-base-ref": {
-      "types": "./dist/env/github-base-ref.d.ts",
-      "default": "./dist/env/github-base-ref.js"
-    },
-    "./env/github-ref-name": {
-      "types": "./dist/env/github-ref-name.d.ts",
-      "default": "./dist/env/github-ref-name.js"
-    },
-    "./env/github-ref-type": {
-      "types": "./dist/env/github-ref-type.d.ts",
-      "default": "./dist/env/github-ref-type.js"
-    },
-    "./env/github-repository": {
-      "types": "./dist/env/github-repository.d.ts",
-      "default": "./dist/env/github-repository.js"
-    },
-    "./env/github-server-url": {
-      "types": "./dist/env/github-server-url.d.ts",
-      "default": "./dist/env/github-server-url.js"
-    },
-    "./env/github-token": {
-      "types": "./dist/env/github-token.d.ts",
-      "default": "./dist/env/github-token.js"
+    "./env/github": {
+      "types": "./dist/env/github.d.ts",
+      "default": "./dist/env/github.js"
     },
     "./env/helpers": {
       "types": "./dist/env/helpers.d.ts",
@@ -228,25 +192,9 @@
       "types": "./dist/env/home.d.ts",
       "default": "./dist/env/home.js"
     },
-    "./env/jest-worker-id": {
-      "types": "./dist/env/jest-worker-id.d.ts",
-      "default": "./dist/env/jest-worker-id.js"
-    },
-    "./env/lang": {
-      "types": "./dist/env/lang.d.ts",
-      "default": "./dist/env/lang.js"
-    },
-    "./env/lc-all": {
-      "types": "./dist/env/lc-all.d.ts",
-      "default": "./dist/env/lc-all.js"
-    },
-    "./env/lc-messages": {
-      "types": "./dist/env/lc-messages.d.ts",
-      "default": "./dist/env/lc-messages.js"
-    },
-    "./env/localappdata": {
-      "types": "./dist/env/localappdata.d.ts",
-      "default": "./dist/env/localappdata.js"
+    "./env/locale": {
+      "types": "./dist/env/locale.d.ts",
+      "default": "./dist/env/locale.js"
     },
     "./env/node-auth-token": {
       "types": "./dist/env/node-auth-token.d.ts",
@@ -256,25 +204,13 @@
       "types": "./dist/env/node-env.d.ts",
       "default": "./dist/env/node-env.js"
     },
-    "./env/npm-config-registry": {
-      "types": "./dist/env/npm-config-registry.d.ts",
-      "default": "./dist/env/npm-config-registry.js"
-    },
-    "./env/npm-config-user-agent": {
-      "types": "./dist/env/npm-config-user-agent.d.ts",
-      "default": "./dist/env/npm-config-user-agent.js"
+    "./env/npm": {
+      "types": "./dist/env/npm.d.ts",
+      "default": "./dist/env/npm.js"
     },
-    "./env/npm-lifecycle-event": {
-      "types": "./dist/env/npm-lifecycle-event.d.ts",
-      "default": "./dist/env/npm-lifecycle-event.js"
-    },
-    "./env/npm-registry": {
-      "types": "./dist/env/npm-registry.d.ts",
-      "default": "./dist/env/npm-registry.js"
-    },
-    "./env/npm-token": {
-      "types": "./dist/env/npm-token.d.ts",
-      "default": "./dist/env/npm-token.js"
+    "./env/package-manager": {
+      "types": "./dist/env/package-manager.d.ts",
+      "default": "./dist/env/package-manager.js"
     },
     "./env/path": {
       "types": "./dist/env/path.d.ts",
@@ -284,165 +220,45 @@
       "types": "./dist/env/pre-commit.d.ts",
       "default": "./dist/env/pre-commit.js"
     },
+    "./env/rewire": {
+      "types": "./dist/env/rewire.d.ts",
+      "default": "./dist/env/rewire.js"
+    },
     "./env/shell": {
       "types": "./dist/env/shell.d.ts",
       "default": "./dist/env/shell.js"
     },
-    "./env/socket-accept-risks": {
-      "types": "./dist/env/socket-accept-risks.d.ts",
-      "default": "./dist/env/socket-accept-risks.js"
-    },
-    "./env/socket-api-base-url": {
-      "types": "./dist/env/socket-api-base-url.d.ts",
-      "default": "./dist/env/socket-api-base-url.js"
-    },
-    "./env/socket-api-proxy": {
-      "types": "./dist/env/socket-api-proxy.d.ts",
-      "default": "./dist/env/socket-api-proxy.js"
-    },
-    "./env/socket-api-timeout": {
-      "types": "./dist/env/socket-api-timeout.d.ts",
-      "default": "./dist/env/socket-api-timeout.js"
-    },
-    "./env/socket-api-token": {
-      "types": "./dist/env/socket-api-token.d.ts",
-      "default": "./dist/env/socket-api-token.js"
-    },
-    "./env/socket-cacache-dir": {
-      "types": "./dist/env/socket-cacache-dir.d.ts",
-      "default": "./dist/env/socket-cacache-dir.js"
-    },
-    "./env/socket-cli-accept-risks": {
-      "types": "./dist/env/socket-cli-accept-risks.d.ts",
-      "default": "./dist/env/socket-cli-accept-risks.js"
-    },
-    "./env/socket-cli-api-base-url": {
-      "types": "./dist/env/socket-cli-api-base-url.d.ts",
-      "default": "./dist/env/socket-cli-api-base-url.js"
-    },
-    "./env/socket-cli-api-proxy": {
-      "types": "./dist/env/socket-cli-api-proxy.d.ts",
-      "default": "./dist/env/socket-cli-api-proxy.js"
-    },
-    "./env/socket-cli-api-timeout": {
-      "types": "./dist/env/socket-cli-api-timeout.d.ts",
-      "default": "./dist/env/socket-cli-api-timeout.js"
-    },
-    "./env/socket-cli-api-token": {
-      "types": "./dist/env/socket-cli-api-token.d.ts",
-      "default": "./dist/env/socket-cli-api-token.js"
-    },
-    "./env/socket-cli-config": {
-      "types": "./dist/env/socket-cli-config.d.ts",
-      "default": "./dist/env/socket-cli-config.js"
-    },
-    "./env/socket-cli-fix": {
-      "types": "./dist/env/socket-cli-fix.d.ts",
-      "default": "./dist/env/socket-cli-fix.js"
-    },
-    "./env/socket-cli-no-api-token": {
-      "types": "./dist/env/socket-cli-no-api-token.d.ts",
-      "default": "./dist/env/socket-cli-no-api-token.js"
-    },
-    "./env/socket-cli-optimize": {
-      "types": "./dist/env/socket-cli-optimize.d.ts",
-      "default": "./dist/env/socket-cli-optimize.js"
-    },
-    "./env/socket-cli-org-slug": {
-      "types": "./dist/env/socket-cli-org-slug.d.ts",
-      "default": "./dist/env/socket-cli-org-slug.js"
+    "./env/socket": {
+      "types": "./dist/env/socket.d.ts",
+      "default": "./dist/env/socket.js"
     },
-    "./env/socket-cli-shadow-accept-risks": {
-      "types": "./dist/env/socket-cli-shadow-accept-risks.d.ts",
-      "default": "./dist/env/socket-cli-shadow-accept-risks.js"
+    "./env/socket-cli": {
+      "types": "./dist/env/socket-cli.d.ts",
+      "default": "./dist/env/socket-cli.js"
     },
-    "./env/socket-cli-shadow-api-token": {
-      "types": "./dist/env/socket-cli-shadow-api-token.d.ts",
-      "default": "./dist/env/socket-cli-shadow-api-token.js"
+    "./env/socket-cli-shadow": {
+      "types": "./dist/env/socket-cli-shadow.d.ts",
+      "default": "./dist/env/socket-cli-shadow.js"
     },
-    "./env/socket-cli-shadow-bin": {
-      "types": "./dist/env/socket-cli-shadow-bin.d.ts",
-      "default": "./dist/env/socket-cli-shadow-bin.js"
-    },
-    "./env/socket-cli-shadow-progress": {
-      "types": "./dist/env/socket-cli-shadow-progress.d.ts",
-      "default": "./dist/env/socket-cli-shadow-progress.js"
-    },
-    "./env/socket-cli-shadow-silent": {
-      "types": "./dist/env/socket-cli-shadow-silent.d.ts",
-      "default": "./dist/env/socket-cli-shadow-silent.js"
-    },
-    "./env/socket-cli-view-all-risks": {
-      "types": "./dist/env/socket-cli-view-all-risks.d.ts",
-      "default": "./dist/env/socket-cli-view-all-risks.js"
-    },
-    "./env/socket-config": {
-      "types": "./dist/env/socket-config.d.ts",
-      "default": "./dist/env/socket-config.js"
-    },
-    "./env/socket-debug": {
-      "types": "./dist/env/socket-debug.d.ts",
-      "default": "./dist/env/socket-debug.js"
-    },
-    "./env/socket-home": {
-      "types": "./dist/env/socket-home.d.ts",
-      "default": "./dist/env/socket-home.js"
-    },
-    "./env/socket-no-api-token": {
-      "types": "./dist/env/socket-no-api-token.d.ts",
-      "default": "./dist/env/socket-no-api-token.js"
-    },
-    "./env/socket-npm-registry": {
-      "types": "./dist/env/socket-npm-registry.d.ts",
-      "default": "./dist/env/socket-npm-registry.js"
-    },
-    "./env/socket-org-slug": {
-      "types": "./dist/env/socket-org-slug.d.ts",
-      "default": "./dist/env/socket-org-slug.js"
-    },
-    "./env/socket-registry-url": {
-      "types": "./dist/env/socket-registry-url.d.ts",
-      "default": "./dist/env/socket-registry-url.js"
-    },
-    "./env/socket-view-all-risks": {
-      "types": "./dist/env/socket-view-all-risks.d.ts",
-      "default": "./dist/env/socket-view-all-risks.js"
-    },
-    "./env/temp": {
-      "types": "./dist/env/temp.d.ts",
-      "default": "./dist/env/temp.js"
+    "./env/temp-dir": {
+      "types": "./dist/env/temp-dir.d.ts",
+      "default": "./dist/env/temp-dir.js"
     },
     "./env/term": {
       "types": "./dist/env/term.d.ts",
       "default": "./dist/env/term.js"
     },
-    "./env/tmp": {
-      "types": "./dist/env/tmp.d.ts",
-      "default": "./dist/env/tmp.js"
-    },
-    "./env/tmpdir": {
-      "types": "./dist/env/tmpdir.d.ts",
-      "default": "./dist/env/tmpdir.js"
-    },
-    "./env/userprofile": {
-      "types": "./dist/env/userprofile.d.ts",
-      "default": "./dist/env/userprofile.js"
+    "./env/test": {
+      "types": "./dist/env/test.d.ts",
+      "default": "./dist/env/test.js"
     },
-    "./env/vitest": {
-      "types": "./dist/env/vitest.d.ts",
-      "default": "./dist/env/vitest.js"
+    "./env/windows": {
+      "types": "./dist/env/windows.d.ts",
+      "default": "./dist/env/windows.js"
     },
-    "./env/xdg-cache-home": {
-      "types": "./dist/env/xdg-cache-home.d.ts",
-      "default": "./dist/env/xdg-cache-home.js"
-    },
-    "./env/xdg-config-home": {
-      "types": "./dist/env/xdg-config-home.d.ts",
-      "default": "./dist/env/xdg-config-home.js"
-    },
-    "./env/xdg-data-home": {
-      "types": "./dist/env/xdg-data-home.d.ts",
-      "default": "./dist/env/xdg-data-home.js"
+    "./env/xdg": {
+      "types": "./dist/env/xdg.d.ts",
+      "default": "./dist/env/xdg.js"
     },
     "./fs": {
       "types": "./dist/fs.d.ts",
@@ -476,6 +292,18 @@
       "types": "./dist/json.d.ts",
       "default": "./dist/json.js"
     },
+    "./lifecycle-script-names": {
+      "types": "./dist/lifecycle-script-names.d.ts",
+      "default": "./dist/lifecycle-script-names.js"
+    },
+    "./links": {
+      "types": "./dist/links/index.d.ts",
+      "default": "./dist/links/index.js"
+    },
+    "./links/index": {
+      "types": "./dist/links/index.d.ts",
+      "default": "./dist/links/index.js"
+    },
     "./logger": {
       "types": "./dist/logger.d.ts",
       "default": "./dist/logger.js"
@@ -492,6 +320,18 @@
       "types": "./dist/objects.d.ts",
       "default": "./dist/objects.js"
     },
+    "./package-default-node-range": {
+      "types": "./dist/package-default-node-range.d.ts",
+      "default": "./dist/package-default-node-range.js"
+    },
+    "./package-default-socket-categories": {
+      "types": "./dist/package-default-socket-categories.d.ts",
+      "default": "./dist/package-default-socket-categories.js"
+    },
+    "./package-extensions": {
+      "types": "./dist/package-extensions.d.ts",
+      "default": "./dist/package-extensions.js"
+    },
     "./packages": {
       "types": "./dist/packages.d.ts",
       "default": "./dist/packages.js"
@@ -532,10 +372,6 @@
       "types": "./dist/packages/provenance.d.ts",
       "default": "./dist/packages/provenance.js"
     },
-    "./packages/registry": {
-      "types": "./dist/packages/registry.d.ts",
-      "default": "./dist/packages/registry.js"
-    },
     "./packages/specs": {
       "types": "./dist/packages/specs.d.ts",
       "default": "./dist/packages/specs.js"
@@ -552,6 +388,10 @@
       "types": "./dist/paths.d.ts",
       "default": "./dist/paths.js"
     },
+    "./paths/rewire": {
+      "types": "./dist/paths/rewire.d.ts",
+      "default": "./dist/paths/rewire.js"
+    },
     "./performance": {
       "types": "./dist/performance.d.ts",
       "default": "./dist/performance.js"
@@ -560,6 +400,10 @@
       "types": "./plugins/babel-plugin-inline-require-calls.d.ts",
       "default": "./plugins/babel-plugin-inline-require-calls.js"
     },
+    "./process-lock": {
+      "types": "./dist/process-lock.d.ts",
+      "default": "./dist/process-lock.js"
+    },
     "./promise-queue": {
       "types": "./dist/promise-queue.d.ts",
       "default": "./dist/promise-queue.js"
@@ -568,10 +412,6 @@
       "types": "./dist/promises.d.ts",
       "default": "./dist/promises.js"
     },
-    "./prompts": {
-      "types": "./dist/prompts.d.ts",
-      "default": "./dist/prompts.js"
-    },
     "./regexps": {
       "types": "./dist/regexps.d.ts",
       "default": "./dist/regexps.js"
@@ -660,6 +500,30 @@
       "types": "./dist/temporary-executor.d.ts",
       "default": "./dist/temporary-executor.js"
     },
+    "./themes": {
+      "types": "./dist/themes/index.d.ts",
+      "default": "./dist/themes/index.js"
+    },
+    "./themes/context": {
+      "types": "./dist/themes/context.d.ts",
+      "default": "./dist/themes/context.js"
+    },
+    "./themes/index": {
+      "types": "./dist/themes/index.d.ts",
+      "default": "./dist/themes/index.js"
+    },
+    "./themes/themes": {
+      "types": "./dist/themes/themes.d.ts",
+      "default": "./dist/themes/themes.js"
+    },
+    "./themes/types": {
+      "types": "./dist/themes/types.d.ts",
+      "default": "./dist/themes/types.js"
+    },
+    "./themes/utils": {
+      "types": "./dist/themes/utils.d.ts",
+      "default": "./dist/themes/utils.js"
+    },
     "./types": {
       "types": "./dist/types.d.ts",
       "default": "./dist/types.js"
@@ -695,15 +559,16 @@
     "./biome.json": "./biome.json",
     "./data/extensions.json": "./data/extensions.json",
     "./package.json": "./package.json",
-    "./taze.config.json": "./taze.config.json",
     "./tsconfig.dts.json": "./tsconfig.dts.json",
-    "./tsconfig.json": "./tsconfig.json"
+    "./tsconfig.json": "./tsconfig.json",
+    "./tsconfig.test.json": "./tsconfig.test.json"
   },
   "imports": {
     "#constants/*": "./dist/constants/*.js",
     "#env/*": "./dist/env/*.js",
     "#lib/*": "./dist/*.js",
     "#packages/*": "./dist/packages/*.js",
+    "#socketsecurity/lib/*": "@socketsecurity/lib-stable/*",
     "#types": "./dist/types.js",
     "#utils/*": "./dist/utils/*.js"
   },
@@ -713,31 +578,21 @@
     "CHANGELOG.md"
   ],
   "engines": {
-    "node": ">=22"
+    "node": ">=18"
   },
   "sideEffects": false,
   "scripts": {
-    "build": "node scripts/build.mjs",
-    "build:watch": "node scripts/build-js.mjs --watch",
+    "build": "node scripts/build/main.mjs",
     "check": "node scripts/check.mjs",
-    "claude": "node scripts/claude.mjs",
-    "clean": "node scripts/clean.mjs",
-    "cover": "node scripts/cover.mjs",
-    "dev": "pnpm run build:watch",
+    "clean": "node scripts/build/clean.mjs",
+    "cover": "node scripts/test/cover.mjs",
+    "dev": "node scripts/build/main.mjs --watch",
     "fix": "node scripts/lint.mjs --fix",
-    "fix:exports": "node scripts/generate-package-exports.mjs && node scripts/fix-commonjs-exports.mjs",
     "lint": "node scripts/lint.mjs",
-    "lint-ci": "pnpm run lint",
     "prepare": "husky",
     "prepublishOnly": "pnpm run build",
-    "test": "node scripts/test.mjs",
-    "test-ci": "vitest run",
-    "type-ci": "pnpm run check"
-  },
-  "dependencies": {
-    "semver": "7.7.2",
-    "which": "5.0.0",
-    "yoctocolors-cjs": "2.1.3"
+    "test": "node scripts/test/main.mjs",
+    "update": "node scripts/update.mjs"
   },
   "devDependencies": {
     "@babel/core": "7.28.4",
@@ -745,7 +600,8 @@
     "@babel/traverse": "7.28.4",
     "@babel/types": "7.28.4",
     "@biomejs/biome": "2.2.4",
-    "@dotenvx/dotenvx": "1.49.0",
+    "@eslint/compat": "1.4.0",
+    "@eslint/js": "9.38.0",
     "@inquirer/confirm": "5.1.16",
     "@inquirer/input": "4.2.2",
     "@inquirer/password": "4.0.18",
@@ -754,12 +610,13 @@
     "@npmcli/package-json": "7.0.0",
     "@npmcli/promise-spawn": "8.0.3",
     "@socketregistry/is-unicode-supported": "1.0.5",
-    "@socketregistry/packageurl-js": "1.3.0",
-    "@socketregistry/yocto-spinner": "1.0.19",
-    "@types/node": "24.6.2",
+    "@socketregistry/packageurl-js": "1.3.5",
+    "@socketregistry/yocto-spinner": "1.0.25",
+    "@socketsecurity/lib-stable": "https://registry.npmjs.org/@socketsecurity/lib/-/lib-3.3.0.tgz",
+    "@types/node": "24.9.2",
     "@typescript/native-preview": "7.0.0-dev.20250920.1",
-    "@vitest/coverage-v8": "3.2.4",
-    "@vitest/ui": "3.2.4",
+    "@vitest/coverage-v8": "4.0.3",
+    "@vitest/ui": "4.0.3",
     "@yarnpkg/extensions": "2.0.6",
     "cacache": "20.0.1",
     "debug": "4.4.3",
@@ -767,19 +624,23 @@
     "del-cli": "6.0.0",
     "esbuild": "0.25.11",
     "eslint": "9.35.0",
+    "eslint-import-resolver-typescript": "4.4.4",
+    "eslint-plugin-import-x": "4.16.1",
     "eslint-plugin-n": "17.23.1",
+    "eslint-plugin-sort-destructure-keys": "2.0.0",
+    "eslint-plugin-unicorn": "61.0.2",
     "fast-glob": "3.3.3",
     "fast-sort": "3.4.1",
     "get-east-asian-width": "1.3.0",
     "globals": "16.4.0",
     "husky": "9.1.7",
+    "libnpmexec": "^10.1.8",
     "libnpmpack": "9.0.9",
     "lint-staged": "15.2.11",
     "magic-string": "0.30.17",
     "make-fetch-happen": "15.0.2",
     "normalize-package-data": "8.0.0",
     "npm-package-arg": "13.0.0",
-    "npm-run-all2": "8.0.4",
     "pacote": "21.0.1",
     "picomatch": "2.3.1",
     "semver": "7.7.2",
@@ -789,11 +650,11 @@
     "taze": "19.6.0",
     "trash": "10.0.0",
     "type-coverage": "2.29.7",
-    "typescript": "5.7.3",
-    "typescript-eslint": "8.44.1",
+    "typescript": "5.9.2",
+    "typescript-eslint": "8.46.3",
     "validate-npm-package-name": "6.0.2",
     "vite-tsconfig-paths": "5.1.4",
-    "vitest": "3.2.4",
+    "vitest": "4.0.3",
     "which": "5.0.0",
     "yargs-parser": "22.0.0",
     "yoctocolors-cjs": "2.1.3",
diff --git a/plugins/README.md b/plugins/README.md
index 4019b45..e1b91fd 100644
--- a/plugins/README.md
+++ b/plugins/README.md
@@ -1,6 +1,6 @@
 # Babel Plugins
 
-Shared transformation plugins for Socket registry builds.
+Babel transformation plugins exported by `@socketsecurity/lib`.
 
 ## `babel-plugin-inline-require-calls`
 
diff --git a/plugins/babel-plugin-inline-const-enum.mjs b/plugins/babel-plugin-inline-const-enum.mjs
index d0c813f..9c39dad 100644
--- a/plugins/babel-plugin-inline-const-enum.mjs
+++ b/plugins/babel-plugin-inline-const-enum.mjs
@@ -28,7 +28,7 @@
  * @param {boolean} [options.scanDeclarations=false] - Auto-detect enum declarations
  * @returns {object} Babel plugin object
  */
-export default function inlineConstEnum(babel, options = {}) {
+export function inlineConstEnum(babel, options = {}) {
   const { types: t } = babel
   const { enums = {}, scanDeclarations = false } = options
 
diff --git a/plugins/babel-plugin-inline-process-env.mjs b/plugins/babel-plugin-inline-process-env.mjs
index d3c38a0..27cd254 100644
--- a/plugins/babel-plugin-inline-process-env.mjs
+++ b/plugins/babel-plugin-inline-process-env.mjs
@@ -31,7 +31,7 @@
  * process.env.NODE_ENV // → 'production'
  * process.env.DEBUG // → unchanged (not in env)
  */
-export default function inlineProcessEnv(babel, options = {}) {
+export function inlineProcessEnv(babel, options = {}) {
   const { types: t } = babel
   const { env = process.env, exclude = [], include = [] } = options
 
diff --git a/plugins/babel-plugin-inline-require-calls.d.ts b/plugins/babel-plugin-inline-require-calls.d.ts
index fa3bf80..7a4572e 100644
--- a/plugins/babel-plugin-inline-require-calls.d.ts
+++ b/plugins/babel-plugin-inline-require-calls.d.ts
@@ -2,6 +2,6 @@
 
 import type { PluginObj, PluginPass } from '@babel/core'
 
-export default function inlineRequireCalls(babel: {
+export function inlineRequireCalls(babel: {
   types: typeof import('@babel/types')
 }): PluginObj<PluginPass>
diff --git a/plugins/babel-plugin-inline-require-calls.js b/plugins/babel-plugin-inline-require-calls.js
index c0afaf0..961bbee 100644
--- a/plugins/babel-plugin-inline-require-calls.js
+++ b/plugins/babel-plugin-inline-require-calls.js
@@ -1,4 +1,5 @@
 const { createRequire } = require('node:module')
+const fs = require('node:fs')
 const path = require('node:path')
 
 /**
@@ -7,7 +8,7 @@ const path = require('node:path')
  * @param {object} babel - Babel API object
  * @returns {object} Babel plugin object
  */
-module.exports = function inlineRequireCalls(babel) {
+function inlineRequireCalls(babel) {
   const { types: t } = babel
 
   return {
@@ -69,7 +70,6 @@ module.exports = function inlineRequireCalls(babel) {
           ]
 
           // Find the first path that exists.
-          const fs = require('node:fs')
           let resolvedPath = absolutePath
           for (const testPath of possiblePaths) {
             try {
@@ -254,3 +254,5 @@ function valueToASTNode(t, value) {
   }
   throw new Error(`Unsupported value type: ${typeof value}`)
 }
+
+module.exports = { inlineRequireCalls }
diff --git a/plugins/babel-plugin-strip-debug.mjs b/plugins/babel-plugin-strip-debug.mjs
index 67b03d2..6d43c60 100644
--- a/plugins/babel-plugin-strip-debug.mjs
+++ b/plugins/babel-plugin-strip-debug.mjs
@@ -23,7 +23,7 @@
  * @param {string[]} [options.identifiers=['DEBUG']] - Debug identifiers to strip
  * @returns {object} Babel plugin object
  */
-export default function stripDebug(babel, options = {}) {
+export function stripDebug(babel, options = {}) {
   const { types: t } = babel
   const { identifiers = ['DEBUG'] } = options
   const debugIds = new Set(identifiers)
diff --git a/pnpm-lock.yaml b/pnpm-lock.yaml
index 9ffaf66..c140827 100644
--- a/pnpm-lock.yaml
+++ b/pnpm-lock.yaml
@@ -7,16 +7,6 @@ settings:
 importers:
 
   .:
-    dependencies:
-      semver:
-        specifier: 7.7.2
-        version: 7.7.2
-      which:
-        specifier: 5.0.0
-        version: 5.0.0
-      yoctocolors-cjs:
-        specifier: 2.1.3
-        version: 2.1.3
     devDependencies:
       '@babel/core':
         specifier: 7.28.4
@@ -33,24 +23,27 @@ importers:
       '@biomejs/biome':
         specifier: 2.2.4
         version: 2.2.4
-      '@dotenvx/dotenvx':
-        specifier: 1.49.0
-        version: 1.49.0
+      '@eslint/compat':
+        specifier: 1.4.0
+        version: 1.4.0(eslint@9.35.0(jiti@2.6.1))
+      '@eslint/js':
+        specifier: 9.38.0
+        version: 9.38.0
       '@inquirer/confirm':
         specifier: 5.1.16
-        version: 5.1.16(@types/node@24.6.2)
+        version: 5.1.16(@types/node@24.9.2)
       '@inquirer/input':
         specifier: 4.2.2
-        version: 4.2.2(@types/node@24.6.2)
+        version: 4.2.2(@types/node@24.9.2)
       '@inquirer/password':
         specifier: 4.0.18
-        version: 4.0.18(@types/node@24.6.2)
+        version: 4.0.18(@types/node@24.9.2)
       '@inquirer/search':
         specifier: 3.1.1
-        version: 3.1.1(@types/node@24.6.2)
+        version: 3.1.1(@types/node@24.9.2)
       '@inquirer/select':
         specifier: 4.3.2
-        version: 4.3.2(@types/node@24.6.2)
+        version: 4.3.2(@types/node@24.9.2)
       '@npmcli/package-json':
         specifier: 7.0.0
         version: 7.0.0
@@ -61,23 +54,26 @@ importers:
         specifier: 1.0.5
         version: 1.0.5
       '@socketregistry/packageurl-js':
-        specifier: 1.3.0
-        version: 1.3.0
+        specifier: 1.3.5
+        version: 1.3.5
       '@socketregistry/yocto-spinner':
-        specifier: 1.0.19
-        version: 1.0.19
+        specifier: 1.0.25
+        version: 1.0.25
+      '@socketsecurity/lib-stable':
+        specifier: https://registry.npmjs.org/@socketsecurity/lib/-/lib-3.3.0.tgz
+        version: '@socketsecurity/lib@3.3.0(typescript@5.9.2)'
       '@types/node':
-        specifier: 24.6.2
-        version: 24.6.2
+        specifier: 24.9.2
+        version: 24.9.2
       '@typescript/native-preview':
         specifier: 7.0.0-dev.20250920.1
         version: 7.0.0-dev.20250920.1
       '@vitest/coverage-v8':
-        specifier: 3.2.4
-        version: 3.2.4(vitest@3.2.4)
+        specifier: 4.0.3
+        version: 4.0.3(vitest@4.0.3)
       '@vitest/ui':
-        specifier: 3.2.4
-        version: 3.2.4(vitest@3.2.4)
+        specifier: 4.0.3
+        version: 4.0.3(vitest@4.0.3)
       '@yarnpkg/extensions':
         specifier: 2.0.6
         version: 2.0.6(@yarnpkg/core@4.4.4(typanion@3.14.0))
@@ -99,9 +95,21 @@ importers:
       eslint:
         specifier: 9.35.0
         version: 9.35.0(jiti@2.6.1)
+      eslint-import-resolver-typescript:
+        specifier: 4.4.4
+        version: 4.4.4(eslint-plugin-import-x@4.16.1(@typescript-eslint/utils@8.46.3(eslint@9.35.0(jiti@2.6.1))(typescript@5.9.2))(eslint@9.35.0(jiti@2.6.1)))(eslint@9.35.0(jiti@2.6.1))
+      eslint-plugin-import-x:
+        specifier: 4.16.1
+        version: 4.16.1(@typescript-eslint/utils@8.46.3(eslint@9.35.0(jiti@2.6.1))(typescript@5.9.2))(eslint@9.35.0(jiti@2.6.1))
       eslint-plugin-n:
         specifier: 17.23.1
-        version: 17.23.1(eslint@9.35.0(jiti@2.6.1))(typescript@5.7.3)
+        version: 17.23.1(eslint@9.35.0(jiti@2.6.1))(typescript@5.9.2)
+      eslint-plugin-sort-destructure-keys:
+        specifier: 2.0.0
+        version: 2.0.0(eslint@9.35.0(jiti@2.6.1))
+      eslint-plugin-unicorn:
+        specifier: 61.0.2
+        version: 61.0.2(eslint@9.35.0(jiti@2.6.1))
       fast-glob:
         specifier: 3.3.3
         version: 3.3.3
@@ -117,6 +125,9 @@ importers:
       husky:
         specifier: 9.1.7
         version: 9.1.7
+      libnpmexec:
+        specifier: ^10.1.8
+        version: 10.1.8
       libnpmpack:
         specifier: 9.0.9
         version: 9.0.9
@@ -135,15 +146,15 @@ importers:
       npm-package-arg:
         specifier: 13.0.0
         version: 13.0.0
-      npm-run-all2:
-        specifier: 8.0.4
-        version: 8.0.4
       pacote:
         specifier: 21.0.1
         version: 21.0.1
       picomatch:
         specifier: 2.3.1
         version: 2.3.1
+      semver:
+        specifier: 7.7.2
+        version: 7.7.2
       spdx-correct:
         specifier: 3.2.0
         version: 3.2.0
@@ -161,35 +172,37 @@ importers:
         version: 10.0.0
       type-coverage:
         specifier: 2.29.7
-        version: 2.29.7(typescript@5.7.3)
+        version: 2.29.7(typescript@5.9.2)
       typescript:
-        specifier: 5.7.3
-        version: 5.7.3
+        specifier: 5.9.2
+        version: 5.9.2
       typescript-eslint:
-        specifier: 8.44.1
-        version: 8.44.1(eslint@9.35.0(jiti@2.6.1))(typescript@5.7.3)
+        specifier: 8.46.3
+        version: 8.46.3(eslint@9.35.0(jiti@2.6.1))(typescript@5.9.2)
       validate-npm-package-name:
         specifier: 6.0.2
         version: 6.0.2
       vite-tsconfig-paths:
         specifier: 5.1.4
-        version: 5.1.4(typescript@5.7.3)(vite@7.1.11(@types/node@24.6.2)(jiti@2.6.1)(yaml@2.8.1))
+        version: 5.1.4(typescript@5.9.2)(vite@7.1.12(@types/node@24.9.2)(jiti@2.6.1)(yaml@2.8.1))
       vitest:
-        specifier: 3.2.4
-        version: 3.2.4(@types/node@24.6.2)(@vitest/ui@3.2.4)(jiti@2.6.1)(yaml@2.8.1)
+        specifier: 4.0.3
+        version: 4.0.3(@types/node@24.9.2)(@vitest/ui@4.0.3)(jiti@2.6.1)(yaml@2.8.1)
+      which:
+        specifier: 5.0.0
+        version: 5.0.0
       yargs-parser:
         specifier: 22.0.0
         version: 22.0.0
+      yoctocolors-cjs:
+        specifier: 2.1.3
+        version: 2.1.3
       zod:
         specifier: 4.1.12
         version: 4.1.12
 
 packages:
 
-  '@ampproject/remapping@2.3.0':
-    resolution: {integrity: sha512-30iZtAPgz+LTIYoeivqYo853f02jBYSd5uGnGpkFV0M3xOt9aN73erkgYAmZU43x4VfqcnLxW9Kpg3R5LC4YYw==}
-    engines: {node: '>=6.0.0'}
-
   '@antfu/ni@25.0.0':
     resolution: {integrity: sha512-9q/yCljni37pkMr4sPrI3G4jqdIk074+iukc5aFJl7kmDCCsiJrbZ6zKxnES1Gwg+i9RcDZwvktl23puGslmvA==}
     hasBin: true
@@ -321,15 +334,14 @@ packages:
     cpu: [x64]
     os: [win32]
 
-  '@dotenvx/dotenvx@1.49.0':
-    resolution: {integrity: sha512-M1cyP6YstFQCjih54SAxCqHLMMi8QqV8tenpgGE48RTXWD7vfMYJiw/6xcCDpS2h28AcLpTsFCZA863Ge9yxzA==}
-    hasBin: true
+  '@emnapi/core@1.6.0':
+    resolution: {integrity: sha512-zq/ay+9fNIJJtJiZxdTnXS20PllcYMX3OE23ESc4HK/bdYu3cOWYVhsOhVnXALfU/uqJIxn5NBPd9z4v+SfoSg==}
 
-  '@ecies/ciphers@0.2.4':
-    resolution: {integrity: sha512-t+iX+Wf5nRKyNzk8dviW3Ikb/280+aEJAnw9YXvCp2tYGPSkMki+NRY+8aNLmVFv3eNtMdvViPNOPxS8SZNP+w==}
-    engines: {bun: '>=1', deno: '>=2', node: '>=16'}
-    peerDependencies:
-      '@noble/ciphers': ^1.0.0
+  '@emnapi/runtime@1.6.0':
+    resolution: {integrity: sha512-obtUmAHTMjll499P+D9A3axeJFlhdjOWdKUNs/U6QIGT7V5RjcUW1xToAzjvmgTSQhDbYn/NwfTRoJcQ2rNBxA==}
+
+  '@emnapi/wasi-threads@1.1.0':
+    resolution: {integrity: sha512-WI0DdZ8xFSbgMjR1sFsKABJ/C5OnRrjT06JXbZKexJGrDuPTzZdDYfFlsgcCXCyf+suG5QU2e/y1Wo2V/OapLQ==}
 
   '@esbuild/aix-ppc64@0.25.11':
     resolution: {integrity: sha512-Xt1dOL13m8u0WE8iplx9Ibbm+hFAO0GsU2P34UNoDGvZYkY8ifSiy6Zuc1lYxfG7svWE2fzqCUmFp5HCn51gJg==}
@@ -493,10 +505,19 @@ packages:
     peerDependencies:
       eslint: ^6.0.0 || ^7.0.0 || >=8.0.0
 
-  '@eslint-community/regexpp@4.12.1':
-    resolution: {integrity: sha512-CCZCDJuduB9OUkFkY2IgppNZMi2lBQgD2qzwXkEia16cge2pijY/aXi96CJMquDMn3nJdlPV1A5KrJEXwfLNzQ==}
+  '@eslint-community/regexpp@4.12.2':
+    resolution: {integrity: sha512-EriSTlt5OC9/7SXkRSCAhfSxxoSUgBm33OH+IkwbdpgoqsSsUg7y3uh+IICI/Qg4BBWr3U2i39RpmycbxMq4ew==}
     engines: {node: ^12.0.0 || ^14.0.0 || >=16.0.0}
 
+  '@eslint/compat@1.4.0':
+    resolution: {integrity: sha512-DEzm5dKeDBPm3r08Ixli/0cmxr8LkRdwxMRUIJBlSCpAwSrvFEJpVBzV+66JhDxiaqKxnRzCXhtiMiczF7Hglg==}
+    engines: {node: ^18.18.0 || ^20.9.0 || >=21.1.0}
+    peerDependencies:
+      eslint: ^8.40 || 9
+    peerDependenciesMeta:
+      eslint:
+        optional: true
+
   '@eslint/config-array@0.21.1':
     resolution: {integrity: sha512-aw1gNayWpdI/jSYVgzN5pL0cfzU02GT3NBpeT/DXbx1/1x7ZKxFPd9bwrzygx/qiwIQiJ1sw/zD8qY/kRvlGHA==}
     engines: {node: ^18.18.0 || ^20.9.0 || >=21.1.0}
@@ -509,6 +530,10 @@ packages:
     resolution: {integrity: sha512-78Md3/Rrxh83gCxoUc0EiciuOHsIITzLy53m3d9UyiW8y9Dj2D29FeETqyKA+BRK76tnTp6RXWb3pCay8Oyomg==}
     engines: {node: ^18.18.0 || ^20.9.0 || >=21.1.0}
 
+  '@eslint/core@0.16.0':
+    resolution: {integrity: sha512-nmC8/totwobIiFcGkDza3GIKfAw1+hLiYVrh3I1nIomQ8PEr5cxg34jnkmGawul/ep52wGRAcyeDCNtWKSOj4Q==}
+    engines: {node: ^18.18.0 || ^20.9.0 || >=21.1.0}
+
   '@eslint/eslintrc@3.3.1':
     resolution: {integrity: sha512-gtF186CXhIl1p4pJNGZw8Yc6RlshoePRvE0X91oPGb3vZ8pM3qOS9W9NGPat9LziaBV7XrJWGylNQXkGcnM3IQ==}
     engines: {node: ^18.18.0 || ^20.9.0 || >=21.1.0}
@@ -517,6 +542,10 @@ packages:
     resolution: {integrity: sha512-30iXE9whjlILfWobBkNerJo+TXYsgVM5ERQwMcMKCHckHflCmf7wXDAHlARoWnh0s1U72WqlbeyE7iAcCzuCPw==}
     engines: {node: ^18.18.0 || ^20.9.0 || >=21.1.0}
 
+  '@eslint/js@9.38.0':
+    resolution: {integrity: sha512-UZ1VpFvXf9J06YG9xQBdnzU+kthors6KjhMAl6f4gH4usHyh31rUf2DLGInT8RFYIReYXNSydgPY0V2LuWgl7A==}
+    engines: {node: ^18.18.0 || ^20.9.0 || >=21.1.0}
+
   '@eslint/object-schema@2.1.7':
     resolution: {integrity: sha512-VtAOaymWVfZcmZbp6E2mympDIHvyjXs/12LqWYjVw6qjrfF+VK+fyG33kChz3nnK+SU5/NeHOqrTEHS8sXO3OA==}
     engines: {node: ^18.18.0 || ^20.9.0 || >=21.1.0}
@@ -631,10 +660,6 @@ packages:
   '@isaacs/string-locale-compare@1.1.0':
     resolution: {integrity: sha512-SQ7Kzhh9+D+ZW9MA0zkYv3VXhIDNx+LzM6EJ+/65I3QY+enU6Itte7E5XX7EWrqLW2FN4n06GWzBnPoC3th2aQ==}
 
-  '@istanbuljs/schema@0.1.3':
-    resolution: {integrity: sha512-ZXRY4jNvVgSVQ8DL3LTcakaAtXwTVUxE81hslsyD2AtoXW/wVob10HkOJ1X/pAlcI7D+2YoZKg5do8G/w6RYgA==}
-    engines: {node: '>=8'}
-
   '@jridgewell/gen-mapping@0.3.13':
     resolution: {integrity: sha512-2kkt/7niJ6MgEPxF0bYdQ6etZaA+fQvDcLKckhy1yIQOzaoKjBBjSj63/aLVjYE3qhRt5dvM+uUyfCg6UKCBbA==}
 
@@ -651,17 +676,8 @@ packages:
   '@jridgewell/trace-mapping@0.3.31':
     resolution: {integrity: sha512-zzNR+SdQSDJzc8joaeP8QQoCQr8NuYx2dIIytl1QeBEZHJ9uW6hebsrYgbz8hJwUQao3TWCMtmfV8Nu1twOLAw==}
 
-  '@noble/ciphers@1.3.0':
-    resolution: {integrity: sha512-2I0gnIVPtfnMw9ee9h1dJG7tp81+8Ob3OJb3Mv37rx5L40/b0i7djjCVvGOVqc9AEIQyvyu1i6ypKdFw8R8gQw==}
-    engines: {node: ^14.21.3 || >=16}
-
-  '@noble/curves@1.9.7':
-    resolution: {integrity: sha512-gbKGcRUYIjA3/zCCNaWDciTMFI0dCkvou3TL8Zmy5Nc7sJ47a0jtOeZoTaMxkuqRo9cRhjOdZJXegxYE5FN/xw==}
-    engines: {node: ^14.21.3 || >=16}
-
-  '@noble/hashes@1.8.0':
-    resolution: {integrity: sha512-jCs9ldd7NwzpgXDIf6P3+NrHh9/sD6CQdxHyjQI+h/6rDNo88ypBxxz45UDuZHz9r3tNz7N/VInSVoVdtXEI4A==}
-    engines: {node: ^14.21.3 || >=16}
+  '@napi-rs/wasm-runtime@0.2.12':
+    resolution: {integrity: sha512-ZVWUcfwY4E/yPitQJl481FjFo3K22D6qF0DuFH6Y/nbnE11GY5uguDxZMGXPQ8WQ0128MXQD7TnfHyK4oWoIJQ==}
 
   '@nodelib/fs.scandir@2.1.5':
     resolution: {integrity: sha512-vq24Bq3ym5HEQm2NKCr3yXDwjc7vTsEThRDnkp2DK9p1uqLR+DHurm/NOTo0KG7HYHU7eppKZj3MyqYuMBf62g==}
@@ -910,13 +926,25 @@ packages:
     resolution: {integrity: sha512-l3wz0cknjyGlI2iCyZxp50FJhtUFXkdZR6CfUU7OfNxE7I4CRBdsvORLgV+JPwqQQErRO/CZgKsbDHefd3puYA==}
     engines: {node: '>=18'}
 
-  '@socketregistry/packageurl-js@1.3.0':
-    resolution: {integrity: sha512-/zbcSImYVj8tTQOq82uFtBkEaDJ1GBigxnk/1N4Sueg/aeSARWjRYrT8qPfJW6h+PjiYHlkxdDR+btdkSxUUOA==}
+  '@socketregistry/packageurl-js@1.3.5':
+    resolution: {integrity: sha512-Fl4GNUJ/z3IBJBGj4IsJfuRGUBCRMgX0df0mb5x5buaCPDKC+NhMhAFuxpc3viLSHV12CO2rGaNCf4fBYWI0FA==}
     engines: {node: '>=18', pnpm: '>=10.16.0'}
 
-  '@socketregistry/yocto-spinner@1.0.19':
-    resolution: {integrity: sha512-O2AQ1AsltIXuNScFt++WfLwpR47sH5jmaDXDg4N7xudrkl7zdfXccUyQpb/CorTi1Lkp022VJjGABg1m4cagBQ==}
-    engines: {node: '>=18.20.8'}
+  '@socketregistry/yocto-spinner@1.0.25':
+    resolution: {integrity: sha512-f8AqJMH1+BL15G6bHDzb1jyY+wW4gOYQs5JumSxmnE/H/+KgqbIZgaPwDdRwoeciDGojoSVrRHiTZjbe7n7dJA==}
+    engines: {node: '>=18'}
+
+  '@socketsecurity/lib@3.3.0':
+    resolution: {integrity: sha512-6CdV71mCPwNFeWgefsz9u6dGHauNKsW5mP8CWWG9PGWn3qrdX/nm+zZgu4DoKDwwO+D8Fp2hRT+gJfZWEFrBLw==}
+    engines: {node: '>=22'}
+    peerDependencies:
+      typescript: '>=5.0.0'
+    peerDependenciesMeta:
+      typescript:
+        optional: true
+
+  '@standard-schema/spec@1.0.0':
+    resolution: {integrity: sha512-m2bOd0f2RT9k8QJx1JN85cZYyH1RqFBdlwtkSlf4tBDYLCiiZnv1fIIwacK6cqwXavOydf0NPToMQgpKq+dVlA==}
 
   '@stroncium/procfs@1.2.1':
     resolution: {integrity: sha512-X1Iui3FUNZP18EUvysTHxt+Avu2nlVzyf90YM8OYgP6SGzTzzX/0JgObfO1AQQDzuZtNNz29bVh8h5R97JrjxA==}
@@ -934,17 +962,20 @@ packages:
     resolution: {integrity: sha512-h5x5ga/hh82COe+GoD4+gKUeV4T3iaYOxqLt41GRKApinPI7DMidhCmNVTjKfhCWFJIGXaFJee07XczdT4jdZQ==}
     engines: {node: ^20.17.0 || >=22.9.0}
 
+  '@tybys/wasm-util@0.10.1':
+    resolution: {integrity: sha512-9tTaPJLSiejZKx+Bmog4uSubteqTvFrVrURwkmHixBo0G4seD0zUxp98E1DzUBJxLQ3NPwXrGKDiVjwx/DpPsg==}
+
   '@types/cacheable-request@6.0.3':
     resolution: {integrity: sha512-IQ3EbTzGxIigb1I3qPZc1rWJnH0BmSKv5QYTalEwweFvyBDLSAe24zP0le/hyi7ecGfZVlIVAg4BZqb8WBwKqw==}
 
-  '@types/chai@5.2.2':
-    resolution: {integrity: sha512-8kB30R7Hwqf40JPiKhVzodJs2Qc1ZJ5zuT3uzw5Hq/dhNCl3G3l83jfpdI1e20BP348+fV7VIL/+FxaXkqBmWg==}
+  '@types/chai@5.2.3':
+    resolution: {integrity: sha512-Mw558oeA9fFbv65/y4mHtXDs9bPnFMZAL/jxdPFUpOHHIXX91mcgEHbS5Lahr+pwZFR8A7GQleRWeI6cGFC2UA==}
 
   '@types/deep-eql@4.0.2':
     resolution: {integrity: sha512-c9h9dVVMigMPc4bwTvC5dxqtqJZwQPePsWjPlpSOnojbor6pGqdk541lfA7AqFQr5pB1BRdq0juY9db81BwyFw==}
 
-  '@types/emscripten@1.41.4':
-    resolution: {integrity: sha512-ECf0qTibhAi2Z0K6FIY96CvBTVkVIuVunOfbTUgbaAmGmbwsc33dbK9KZPROWsmzHotddy6C5pIqYqOmsBoJEw==}
+  '@types/emscripten@1.41.5':
+    resolution: {integrity: sha512-cMQm7pxu6BxtHyqJ7mQZ2kXWV5SLmugybFdHCBbJ5eHzOo6VhBckEgAT3//rP5FwPHNPeEiq4SmQ5ucBwsOo4Q==}
 
   '@types/estree@1.0.8':
     resolution: {integrity: sha512-dWHzHa2WqEXI/O1E9OjrocMTKJl2mSrEolh1Iomrv6U+JuNwaHXsXx9bLu5gG7BUWFIN0skIQJQ/L1rIex4X6w==}
@@ -958,8 +989,8 @@ packages:
   '@types/keyv@3.1.4':
     resolution: {integrity: sha512-BQ5aZNSCpj7D6K2ksrRCTmKRLEpnPvWDiLPfoGyhZ++8YtiK9d/3DBKPJgry359X/P1PfruyYwvnvwFjuEiEIg==}
 
-  '@types/node@24.6.2':
-    resolution: {integrity: sha512-d2L25Y4j+W3ZlNAeMKcy7yDsK425ibcAOO2t7aPTz6gNMH0z2GThtwENCDc0d/Pw9wgyRqE5Px1wkV7naz8ang==}
+  '@types/node@24.9.2':
+    resolution: {integrity: sha512-uWN8YqxXxqFMX2RqGOrumsKeti4LlmIMIyV0lgut4jx7KQBcBiW6vkDtIBvHnHIquwNfJhk8v2OtmO8zXWHfPA==}
 
   '@types/responselike@1.0.3':
     resolution: {integrity: sha512-H/+L+UkTV33uf49PH5pCAUBVPNj2nDBXTN+qS1dOwyyg24l3CcicicCA7ca+HMvJBZcFgl5r8e+RR6elsb4Lyw==}
@@ -970,63 +1001,67 @@ packages:
   '@types/treeify@1.0.3':
     resolution: {integrity: sha512-hx0o7zWEUU4R2Amn+pjCBQQt23Khy/Dk56gQU5xi5jtPL1h83ACJCeFaB2M/+WO1AntvWrSoVnnCAfI1AQH4Cg==}
 
-  '@typescript-eslint/eslint-plugin@8.44.1':
-    resolution: {integrity: sha512-molgphGqOBT7t4YKCSkbasmu1tb1MgrZ2szGzHbclF7PNmOkSTQVHy+2jXOSnxvR3+Xe1yySHFZoqMpz3TfQsw==}
+  '@typescript-eslint/eslint-plugin@8.46.3':
+    resolution: {integrity: sha512-sbaQ27XBUopBkRiuY/P9sWGOWUW4rl8fDoHIUmLpZd8uldsTyB4/Zg6bWTegPoTLnKj9Hqgn3QD6cjPNB32Odw==}
     engines: {node: ^18.18.0 || ^20.9.0 || >=21.1.0}
     peerDependencies:
-      '@typescript-eslint/parser': ^8.44.1
+      '@typescript-eslint/parser': ^8.46.3
       eslint: ^8.57.0 || ^9.0.0
       typescript: '>=4.8.4 <6.0.0'
 
-  '@typescript-eslint/parser@8.44.1':
-    resolution: {integrity: sha512-EHrrEsyhOhxYt8MTg4zTF+DJMuNBzWwgvvOYNj/zm1vnaD/IC5zCXFehZv94Piqa2cRFfXrTFxIvO95L7Qc/cw==}
+  '@typescript-eslint/parser@8.46.3':
+    resolution: {integrity: sha512-6m1I5RmHBGTnUGS113G04DMu3CpSdxCAU/UvtjNWL4Nuf3MW9tQhiJqRlHzChIkhy6kZSAQmc+I1bcGjE3yNKg==}
     engines: {node: ^18.18.0 || ^20.9.0 || >=21.1.0}
     peerDependencies:
       eslint: ^8.57.0 || ^9.0.0
       typescript: '>=4.8.4 <6.0.0'
 
-  '@typescript-eslint/project-service@8.44.1':
-    resolution: {integrity: sha512-ycSa60eGg8GWAkVsKV4E6Nz33h+HjTXbsDT4FILyL8Obk5/mx4tbvCNsLf9zret3ipSumAOG89UcCs/KRaKYrA==}
+  '@typescript-eslint/project-service@8.46.3':
+    resolution: {integrity: sha512-Fz8yFXsp2wDFeUElO88S9n4w1I4CWDTXDqDr9gYvZgUpwXQqmZBr9+NTTql5R3J7+hrJZPdpiWaB9VNhAKYLuQ==}
     engines: {node: ^18.18.0 || ^20.9.0 || >=21.1.0}
     peerDependencies:
       typescript: '>=4.8.4 <6.0.0'
 
-  '@typescript-eslint/scope-manager@8.44.1':
-    resolution: {integrity: sha512-NdhWHgmynpSvyhchGLXh+w12OMT308Gm25JoRIyTZqEbApiBiQHD/8xgb6LqCWCFcxFtWwaVdFsLPQI3jvhywg==}
+  '@typescript-eslint/scope-manager@8.46.3':
+    resolution: {integrity: sha512-FCi7Y1zgrmxp3DfWfr+3m9ansUUFoy8dkEdeQSgA9gbm8DaHYvZCdkFRQrtKiedFf3Ha6VmoqoAaP68+i+22kg==}
     engines: {node: ^18.18.0 || ^20.9.0 || >=21.1.0}
 
-  '@typescript-eslint/tsconfig-utils@8.44.1':
-    resolution: {integrity: sha512-B5OyACouEjuIvof3o86lRMvyDsFwZm+4fBOqFHccIctYgBjqR3qT39FBYGN87khcgf0ExpdCBeGKpKRhSFTjKQ==}
+  '@typescript-eslint/tsconfig-utils@8.46.3':
+    resolution: {integrity: sha512-GLupljMniHNIROP0zE7nCcybptolcH8QZfXOpCfhQDAdwJ/ZTlcaBOYebSOZotpti/3HrHSw7D3PZm75gYFsOA==}
     engines: {node: ^18.18.0 || ^20.9.0 || >=21.1.0}
     peerDependencies:
       typescript: '>=4.8.4 <6.0.0'
 
-  '@typescript-eslint/type-utils@8.44.1':
-    resolution: {integrity: sha512-KdEerZqHWXsRNKjF9NYswNISnFzXfXNDfPxoTh7tqohU/PRIbwTmsjGK6V9/RTYWau7NZvfo52lgVk+sJh0K3g==}
+  '@typescript-eslint/type-utils@8.46.3':
+    resolution: {integrity: sha512-ZPCADbr+qfz3aiTTYNNkCbUt+cjNwI/5McyANNrFBpVxPt7GqpEYz5ZfdwuFyGUnJ9FdDXbGODUu6iRCI6XRXw==}
     engines: {node: ^18.18.0 || ^20.9.0 || >=21.1.0}
     peerDependencies:
       eslint: ^8.57.0 || ^9.0.0
       typescript: '>=4.8.4 <6.0.0'
 
-  '@typescript-eslint/types@8.44.1':
-    resolution: {integrity: sha512-Lk7uj7y9uQUOEguiDIDLYLJOrYHQa7oBiURYVFqIpGxclAFQ78f6VUOM8lI2XEuNOKNB7XuvM2+2cMXAoq4ALQ==}
+  '@typescript-eslint/types@8.46.2':
+    resolution: {integrity: sha512-lNCWCbq7rpg7qDsQrd3D6NyWYu+gkTENkG5IKYhUIcxSb59SQC/hEQ+MrG4sTgBVghTonNWq42bA/d4yYumldQ==}
+    engines: {node: ^18.18.0 || ^20.9.0 || >=21.1.0}
+
+  '@typescript-eslint/types@8.46.3':
+    resolution: {integrity: sha512-G7Ok9WN/ggW7e/tOf8TQYMaxgID3Iujn231hfi0Pc7ZheztIJVpO44ekY00b7akqc6nZcvregk0Jpah3kep6hA==}
     engines: {node: ^18.18.0 || ^20.9.0 || >=21.1.0}
 
-  '@typescript-eslint/typescript-estree@8.44.1':
-    resolution: {integrity: sha512-qnQJ+mVa7szevdEyvfItbO5Vo+GfZ4/GZWWDRRLjrxYPkhM+6zYB2vRYwCsoJLzqFCdZT4mEqyJoyzkunsZ96A==}
+  '@typescript-eslint/typescript-estree@8.46.3':
+    resolution: {integrity: sha512-f/NvtRjOm80BtNM5OQtlaBdM5BRFUv7gf381j9wygDNL+qOYSNOgtQ/DCndiYi80iIOv76QqaTmp4fa9hwI0OA==}
     engines: {node: ^18.18.0 || ^20.9.0 || >=21.1.0}
     peerDependencies:
       typescript: '>=4.8.4 <6.0.0'
 
-  '@typescript-eslint/utils@8.44.1':
-    resolution: {integrity: sha512-DpX5Fp6edTlocMCwA+mHY8Mra+pPjRZ0TfHkXI8QFelIKcbADQz1LUPNtzOFUriBB2UYqw4Pi9+xV4w9ZczHFg==}
+  '@typescript-eslint/utils@8.46.3':
+    resolution: {integrity: sha512-VXw7qmdkucEx9WkmR3ld/u6VhRyKeiF1uxWwCy/iuNfokjJ7VhsgLSOTjsol8BunSw190zABzpwdNsze2Kpo4g==}
     engines: {node: ^18.18.0 || ^20.9.0 || >=21.1.0}
     peerDependencies:
       eslint: ^8.57.0 || ^9.0.0
       typescript: '>=4.8.4 <6.0.0'
 
-  '@typescript-eslint/visitor-keys@8.44.1':
-    resolution: {integrity: sha512-576+u0QD+Jp3tZzvfRfxon0EA2lzcDt3lhUbsC6Lgzy9x2VR4E+JUiNyGHi5T8vk0TV+fpJ5GLG1JsJuWCaKhw==}
+  '@typescript-eslint/visitor-keys@8.46.3':
+    resolution: {integrity: sha512-uk574k8IU0rOF/AjniX8qbLSGURJVUCeM5e4MIMKBFFi8weeiLrG1fyQejyLXQpRZbU/1BuQasleV/RfHC3hHg==}
     engines: {node: ^18.18.0 || ^20.9.0 || >=21.1.0}
 
   '@typescript/native-preview-darwin-arm64@7.0.0-dev.20250920.1':
@@ -1068,48 +1103,143 @@ packages:
     resolution: {integrity: sha512-iuMeX3RUMysVWGvzXzJrPdMBWDo0LlLDk6FU8PbYgCA1MUlguHePK5wqS/GlOrRLBQ0BjXM1W8q81J37vIW63g==}
     hasBin: true
 
-  '@vitest/coverage-v8@3.2.4':
-    resolution: {integrity: sha512-EyF9SXU6kS5Ku/U82E259WSnvg6c8KTjppUncuNdm5QHpe17mwREHnjDzozC8x9MZ0xfBUFSaLkRv4TMA75ALQ==}
+  '@unrs/resolver-binding-android-arm-eabi@1.11.1':
+    resolution: {integrity: sha512-ppLRUgHVaGRWUx0R0Ut06Mjo9gBaBkg3v/8AxusGLhsIotbBLuRk51rAzqLC8gq6NyyAojEXglNjzf6R948DNw==}
+    cpu: [arm]
+    os: [android]
+
+  '@unrs/resolver-binding-android-arm64@1.11.1':
+    resolution: {integrity: sha512-lCxkVtb4wp1v+EoN+HjIG9cIIzPkX5OtM03pQYkG+U5O/wL53LC4QbIeazgiKqluGeVEeBlZahHalCaBvU1a2g==}
+    cpu: [arm64]
+    os: [android]
+
+  '@unrs/resolver-binding-darwin-arm64@1.11.1':
+    resolution: {integrity: sha512-gPVA1UjRu1Y/IsB/dQEsp2V1pm44Of6+LWvbLc9SDk1c2KhhDRDBUkQCYVWe6f26uJb3fOK8saWMgtX8IrMk3g==}
+    cpu: [arm64]
+    os: [darwin]
+
+  '@unrs/resolver-binding-darwin-x64@1.11.1':
+    resolution: {integrity: sha512-cFzP7rWKd3lZaCsDze07QX1SC24lO8mPty9vdP+YVa3MGdVgPmFc59317b2ioXtgCMKGiCLxJ4HQs62oz6GfRQ==}
+    cpu: [x64]
+    os: [darwin]
+
+  '@unrs/resolver-binding-freebsd-x64@1.11.1':
+    resolution: {integrity: sha512-fqtGgak3zX4DCB6PFpsH5+Kmt/8CIi4Bry4rb1ho6Av2QHTREM+47y282Uqiu3ZRF5IQioJQ5qWRV6jduA+iGw==}
+    cpu: [x64]
+    os: [freebsd]
+
+  '@unrs/resolver-binding-linux-arm-gnueabihf@1.11.1':
+    resolution: {integrity: sha512-u92mvlcYtp9MRKmP+ZvMmtPN34+/3lMHlyMj7wXJDeXxuM0Vgzz0+PPJNsro1m3IZPYChIkn944wW8TYgGKFHw==}
+    cpu: [arm]
+    os: [linux]
+
+  '@unrs/resolver-binding-linux-arm-musleabihf@1.11.1':
+    resolution: {integrity: sha512-cINaoY2z7LVCrfHkIcmvj7osTOtm6VVT16b5oQdS4beibX2SYBwgYLmqhBjA1t51CarSaBuX5YNsWLjsqfW5Cw==}
+    cpu: [arm]
+    os: [linux]
+
+  '@unrs/resolver-binding-linux-arm64-gnu@1.11.1':
+    resolution: {integrity: sha512-34gw7PjDGB9JgePJEmhEqBhWvCiiWCuXsL9hYphDF7crW7UgI05gyBAi6MF58uGcMOiOqSJ2ybEeCvHcq0BCmQ==}
+    cpu: [arm64]
+    os: [linux]
+
+  '@unrs/resolver-binding-linux-arm64-musl@1.11.1':
+    resolution: {integrity: sha512-RyMIx6Uf53hhOtJDIamSbTskA99sPHS96wxVE/bJtePJJtpdKGXO1wY90oRdXuYOGOTuqjT8ACccMc4K6QmT3w==}
+    cpu: [arm64]
+    os: [linux]
+
+  '@unrs/resolver-binding-linux-ppc64-gnu@1.11.1':
+    resolution: {integrity: sha512-D8Vae74A4/a+mZH0FbOkFJL9DSK2R6TFPC9M+jCWYia/q2einCubX10pecpDiTmkJVUH+y8K3BZClycD8nCShA==}
+    cpu: [ppc64]
+    os: [linux]
+
+  '@unrs/resolver-binding-linux-riscv64-gnu@1.11.1':
+    resolution: {integrity: sha512-frxL4OrzOWVVsOc96+V3aqTIQl1O2TjgExV4EKgRY09AJ9leZpEg8Ak9phadbuX0BA4k8U5qtvMSQQGGmaJqcQ==}
+    cpu: [riscv64]
+    os: [linux]
+
+  '@unrs/resolver-binding-linux-riscv64-musl@1.11.1':
+    resolution: {integrity: sha512-mJ5vuDaIZ+l/acv01sHoXfpnyrNKOk/3aDoEdLO/Xtn9HuZlDD6jKxHlkN8ZhWyLJsRBxfv9GYM2utQ1SChKew==}
+    cpu: [riscv64]
+    os: [linux]
+
+  '@unrs/resolver-binding-linux-s390x-gnu@1.11.1':
+    resolution: {integrity: sha512-kELo8ebBVtb9sA7rMe1Cph4QHreByhaZ2QEADd9NzIQsYNQpt9UkM9iqr2lhGr5afh885d/cB5QeTXSbZHTYPg==}
+    cpu: [s390x]
+    os: [linux]
+
+  '@unrs/resolver-binding-linux-x64-gnu@1.11.1':
+    resolution: {integrity: sha512-C3ZAHugKgovV5YvAMsxhq0gtXuwESUKc5MhEtjBpLoHPLYM+iuwSj3lflFwK3DPm68660rZ7G8BMcwSro7hD5w==}
+    cpu: [x64]
+    os: [linux]
+
+  '@unrs/resolver-binding-linux-x64-musl@1.11.1':
+    resolution: {integrity: sha512-rV0YSoyhK2nZ4vEswT/QwqzqQXw5I6CjoaYMOX0TqBlWhojUf8P94mvI7nuJTeaCkkds3QE4+zS8Ko+GdXuZtA==}
+    cpu: [x64]
+    os: [linux]
+
+  '@unrs/resolver-binding-wasm32-wasi@1.11.1':
+    resolution: {integrity: sha512-5u4RkfxJm+Ng7IWgkzi3qrFOvLvQYnPBmjmZQ8+szTK/b31fQCnleNl1GgEt7nIsZRIf5PLhPwT0WM+q45x/UQ==}
+    engines: {node: '>=14.0.0'}
+    cpu: [wasm32]
+
+  '@unrs/resolver-binding-win32-arm64-msvc@1.11.1':
+    resolution: {integrity: sha512-nRcz5Il4ln0kMhfL8S3hLkxI85BXs3o8EYoattsJNdsX4YUU89iOkVn7g0VHSRxFuVMdM4Q1jEpIId1Ihim/Uw==}
+    cpu: [arm64]
+    os: [win32]
+
+  '@unrs/resolver-binding-win32-ia32-msvc@1.11.1':
+    resolution: {integrity: sha512-DCEI6t5i1NmAZp6pFonpD5m7i6aFrpofcp4LA2i8IIq60Jyo28hamKBxNrZcyOwVOZkgsRp9O2sXWBWP8MnvIQ==}
+    cpu: [ia32]
+    os: [win32]
+
+  '@unrs/resolver-binding-win32-x64-msvc@1.11.1':
+    resolution: {integrity: sha512-lrW200hZdbfRtztbygyaq/6jP6AKE8qQN2KvPcJ+x7wiD038YtnYtZ82IMNJ69GJibV7bwL3y9FgK+5w/pYt6g==}
+    cpu: [x64]
+    os: [win32]
+
+  '@vitest/coverage-v8@4.0.3':
+    resolution: {integrity: sha512-I+MlLwyJRBjmJr1kFYSxoseINbIdpxIAeK10jmXgB0FUtIfdYsvM3lGAvBu5yk8WPyhefzdmbCHCc1idFbNRcg==}
     peerDependencies:
-      '@vitest/browser': 3.2.4
-      vitest: 3.2.4
+      '@vitest/browser': 4.0.3
+      vitest: 4.0.3
     peerDependenciesMeta:
       '@vitest/browser':
         optional: true
 
-  '@vitest/expect@3.2.4':
-    resolution: {integrity: sha512-Io0yyORnB6sikFlt8QW5K7slY4OjqNX9jmJQ02QDda8lyM6B5oNgVWoSoKPac8/kgnCUzuHQKrSLtu/uOqqrig==}
+  '@vitest/expect@4.0.3':
+    resolution: {integrity: sha512-v3eSDx/bF25pzar6aEJrrdTXJduEBU3uSGXHslIdGIpJVP8tQQHV6x1ZfzbFQ/bLIomLSbR/2ZCfnaEGkWkiVQ==}
 
-  '@vitest/mocker@3.2.4':
-    resolution: {integrity: sha512-46ryTE9RZO/rfDd7pEqFl7etuyzekzEhUbTW3BvmeO/BcCMEgq59BKhek3dXDWgAj4oMK6OZi+vRr1wPW6qjEQ==}
+  '@vitest/mocker@4.0.3':
+    resolution: {integrity: sha512-evZcRspIPbbiJEe748zI2BRu94ThCBE+RkjCpVF8yoVYuTV7hMe+4wLF/7K86r8GwJHSmAPnPbZhpXWWrg1qbA==}
     peerDependencies:
       msw: ^2.4.9
-      vite: ^5.0.0 || ^6.0.0 || ^7.0.0-0
+      vite: ^6.0.0 || ^7.0.0-0
     peerDependenciesMeta:
       msw:
         optional: true
       vite:
         optional: true
 
-  '@vitest/pretty-format@3.2.4':
-    resolution: {integrity: sha512-IVNZik8IVRJRTr9fxlitMKeJeXFFFN0JaB9PHPGQ8NKQbGpfjlTx9zO4RefN8gp7eqjNy8nyK3NZmBzOPeIxtA==}
+  '@vitest/pretty-format@4.0.3':
+    resolution: {integrity: sha512-N7gly/DRXzxa9w9sbDXwD9QNFYP2hw90LLLGDobPNwiWgyW95GMxsCt29/COIKKh3P7XJICR38PSDePenMBtsw==}
 
-  '@vitest/runner@3.2.4':
-    resolution: {integrity: sha512-oukfKT9Mk41LreEW09vt45f8wx7DordoWUZMYdY/cyAk7w5TWkTRCNZYF7sX7n2wB7jyGAl74OxgwhPgKaqDMQ==}
+  '@vitest/runner@4.0.3':
+    resolution: {integrity: sha512-1/aK6fPM0lYXWyGKwop2Gbvz1plyTps/HDbIIJXYtJtspHjpXIeB3If07eWpVH4HW7Rmd3Rl+IS/+zEAXrRtXA==}
 
-  '@vitest/snapshot@3.2.4':
-    resolution: {integrity: sha512-dEYtS7qQP2CjU27QBC5oUOxLE/v5eLkGqPE0ZKEIDGMs4vKWe7IjgLOeauHsR0D5YuuycGRO5oSRXnwnmA78fQ==}
+  '@vitest/snapshot@4.0.3':
+    resolution: {integrity: sha512-amnYmvZ5MTjNCP1HZmdeczAPLRD6iOm9+2nMRUGxbe/6sQ0Ymur0NnR9LIrWS8JA3wKE71X25D6ya/3LN9YytA==}
 
-  '@vitest/spy@3.2.4':
-    resolution: {integrity: sha512-vAfasCOe6AIK70iP5UD11Ac4siNUNJ9i/9PZ3NKx07sG6sUxeag1LWdNrMWeKKYBLlzuK+Gn65Yd5nyL6ds+nw==}
+  '@vitest/spy@4.0.3':
+    resolution: {integrity: sha512-82vVL8Cqz7rbXaNUl35V2G7xeNMAjBdNOVaHbrzznT9BmiCiPOzhf0FhU3eP41nP1bLDm/5wWKZqkG4nyU95DQ==}
 
-  '@vitest/ui@3.2.4':
-    resolution: {integrity: sha512-hGISOaP18plkzbWEcP/QvtRW1xDXF2+96HbEX6byqQhAUbiS5oH6/9JwW+QsQCIYON2bI6QZBF+2PvOmrRZ9wA==}
+  '@vitest/ui@4.0.3':
+    resolution: {integrity: sha512-HURRrgGVzz2GQ2Imurp55FA+majHXgCXMzcwtojUZeRsAXyHNgEvxGRJf4QQY4kJeVakiugusGYeUqBgZ/xylg==}
     peerDependencies:
-      vitest: 3.2.4
+      vitest: 4.0.3
 
-  '@vitest/utils@3.2.4':
-    resolution: {integrity: sha512-fB2V0JFrQSMsCo9HiSq3Ezpdv4iYaXRG1Sx8edX3MwxfyNn83mKiGzOcH+Fkxt4MHxr3y42fQi1oeAInqgX2QA==}
+  '@vitest/utils@4.0.3':
+    resolution: {integrity: sha512-qV6KJkq8W3piW6MDIbGOmn1xhvcW4DuA07alqaQ+vdx7YA49J85pnwnxigZVQFQw3tWnQNRKWwhz5wbP6iv/GQ==}
 
   '@yarnpkg/core@4.4.4':
     resolution: {integrity: sha512-0bcUFx4wzq0szvInY0PkzqjsAlM69lgzOsEbltbiyE6q/h0hRb1oOHWSBvq7rUGA+Ob5vuyhoDYWyyXY/1W4VQ==}
@@ -1121,8 +1251,8 @@ packages:
     peerDependencies:
       '@yarnpkg/core': ^4.4.2
 
-  '@yarnpkg/fslib@3.1.3':
-    resolution: {integrity: sha512-LqfyD3r/8SJm8rPPfmGVHfp4Ag2xTKscDwihOJt+QNrtOeaLykikqKWoBVRBw1cCIbtU7kjT7l1JcWW26hAKtA==}
+  '@yarnpkg/fslib@3.1.4':
+    resolution: {integrity: sha512-Yyguw5RM+xI1Bv0RFbs1ZF5HwU+9/He4YT7yeT722yAlLfkz9IzZHO6a5yStEshxiliPn9Fdj4H54a785xpK/g==}
     engines: {node: '>=18.12.0'}
 
   '@yarnpkg/libzip@3.2.2':
@@ -1205,8 +1335,8 @@ packages:
   balanced-match@1.0.2:
     resolution: {integrity: sha512-3oSeUO0TMV67hN1AmbXsK4yaqU7tjiHlbxRDZOpH0KW9+CeX4bRAaX0Anxt0tx2MrpRpWwQaPwIlISEJhYU5Pw==}
 
-  baseline-browser-mapping@2.8.18:
-    resolution: {integrity: sha512-UYmTpOBwgPScZpS4A+YbapwWuBwasxvO/2IOHArSsAhL/+ZdmATBXTex3t+l2hXwLVYK382ibr/nKoY9GKe86w==}
+  baseline-browser-mapping@2.8.19:
+    resolution: {integrity: sha512-zoKGUdu6vb2jd3YOq0nnhEDQVbPcHhco3UImJrv5dSkvxTc2pl2WjOPsjZXDwPDSl5eghIMuY3R6J9NDKF3KcQ==}
     hasBin: true
 
   bin-links@5.0.0:
@@ -1223,11 +1353,15 @@ packages:
     resolution: {integrity: sha512-yQbXgO/OSZVD2IsiLlro+7Hf6Q18EJrKSEsdoMzKePKXct3gvD8oLcOQdIzGupr5Fj+EDe8gO/lxc1BzfMpxvA==}
     engines: {node: '>=8'}
 
-  browserslist@4.26.3:
-    resolution: {integrity: sha512-lAUU+02RFBuCKQPj/P6NgjlbCnLBMp4UtgTx7vNHd3XSIJF87s9a5rA3aH2yw3GS9DqZAUbOtZdCCiZeVRqt0w==}
+  browserslist@4.27.0:
+    resolution: {integrity: sha512-AXVQwdhot1eqLihwasPElhX2tAZiBjWdJ9i/Zcj2S6QYIjkx62OKSfnobkriB81C3l4w0rVy3Nt4jaTBltYEpw==}
     engines: {node: ^6 || ^7 || ^8 || ^9 || ^10 || ^11 || ^12 || >=13.7}
     hasBin: true
 
+  builtin-modules@5.0.0:
+    resolution: {integrity: sha512-bkXY9WsVpY7CvMhKSR6pZilZu9Ln5WDrKVBUXf2S443etkmEO4V58heTecXcUIsNsi4Rx8JUO4NfX1IcQl4deg==}
+    engines: {node: '>=18.20'}
+
   cac@6.7.14:
     resolution: {integrity: sha512-b6Ilus+c3RrdDk+JhLKUAQfzzgLEPy6wcXqS7f/xe1EETvsDP6GORG7SFuOs6cID5YkqchW/LXZbX5bc8j7ZcQ==}
     engines: {node: '>=8'}
@@ -1259,8 +1393,8 @@ packages:
   caniuse-lite@1.0.30001751:
     resolution: {integrity: sha512-A0QJhug0Ly64Ii3eIqHu5X51ebln3k4yTUkY1j8drqpWHVreg/VLijN48cZ1bYPiqOQuqpkIKnzr/Ul8V+p6Cw==}
 
-  chai@5.3.3:
-    resolution: {integrity: sha512-4zNhdJD/iOjSH0A05ea+Ke6MU5mmpQcbQsSOkgdaUMJ9zTlDTD/GYlwohmIE2u0gaxHYiVHEn1Fw9mZ/ktJWgw==}
+  chai@6.2.0:
+    resolution: {integrity: sha512-aUTnJc/JipRzJrNADXVvpVqi6CO0dn3nx4EVPxijri+fj3LUUDyZQOgVeW54Ob3Y1Xh9Iz8f+CgaCl8v0mn9bA==}
     engines: {node: '>=18'}
 
   chalk@4.1.2:
@@ -1271,9 +1405,8 @@ packages:
     resolution: {integrity: sha512-dLitG79d+GV1Nb/VYcCDFivJeK1hiukt9QjRNVOsUtTy1rR1YJsmpGGTZ3qJos+uw7WmWF4wUwBd9jxjocFC2w==}
     engines: {node: ^12.17.0 || ^14.13 || >=16.0.0}
 
-  check-error@2.1.1:
-    resolution: {integrity: sha512-OAlb+T7V4Op9OwdkjmguYRqncdlx5JiofwOAUkmTF+jNdHwzTaTs4sRAGpzLF3oOz5xAyDGrPgeIDFQmDOTiJw==}
-    engines: {node: '>= 16'}
+  change-case@5.4.4:
+    resolution: {integrity: sha512-HRQyTk2/YPEkt9TnUPbOpr64Uw3KOicFWPVBb+xiHvd6eBx/qPr9xqfBFDT8P2vWsvvz4jbEkfDe71W3VyNu2w==}
 
   chownr@2.0.0:
     resolution: {integrity: sha512-bIomtDF5KGpdogkLd9VspvFzk9KfpyyGlS8YFVZl7TGPBHL5snIOnxeshwVgPteQ9b4Eydl+pVbIyE1DcvCWgQ==}
@@ -1287,6 +1420,10 @@ packages:
     resolution: {integrity: sha512-Wdy2Igu8OcBpI2pZePZ5oWjPC38tmDVx5WKUXKwlLYkA0ozo85sLsLvkBbBn/sZaSCMFOGZJ14fvW9t5/d7kdA==}
     engines: {node: '>=8'}
 
+  clean-regexp@1.0.0:
+    resolution: {integrity: sha512-GfisEZEJvzKrmGWkvfhgzcz/BllN1USeqD2V6tg14OAOgaCD2Z/PUEuxnAZ/nPvmaHRG7a8y77p1T/IRQ4D1Hw==}
+    engines: {node: '>=4'}
+
   cli-cursor@5.0.0:
     resolution: {integrity: sha512-aCj4O5wKyszjMmDT4tZj93kxyydN/K5zPWSCe6/0AV/AA1pqe5ZBIw0a2ZfPQV7lL5/yb5HsUreJ6UFAF1tEQw==}
     engines: {node: '>=18'}
@@ -1321,14 +1458,14 @@ packages:
   colorette@2.0.20:
     resolution: {integrity: sha512-IfEDxwoWIjkeXL1eXcDiow4UbKjhLdq6/EuSVR9GMN7KVH3r9gQ83e73hsz1Nd1T3ijd5xv1wcWRYO+D6kCI2w==}
 
-  commander@11.1.0:
-    resolution: {integrity: sha512-yPVavfyCcRhmorC7rWlkHn15b4wDVgVmBA7kV4QVBsF7kv/9TKJAbAXVTxvTnwP8HHKjRCJDClKbciiYS7p0DQ==}
-    engines: {node: '>=16'}
-
   commander@12.1.0:
     resolution: {integrity: sha512-Vw8qHK3bZM9y/P10u3Vib8o/DdkvA2OtPtZvD871QKjy74Wj1WSKFILMPRPSdUSx5RFK1arlJzEtA4PkFgnbuA==}
     engines: {node: '>=18'}
 
+  comment-parser@1.4.1:
+    resolution: {integrity: sha512-buhp5kePrmda3vhc5B9t7pUQXAb2Tnd0qgpkIhPhkHXxJpiPJ11H0ZEU0oBpJ2QztSbzG/ZxMj/CHsYJqRHmyg==}
+    engines: {node: '>= 12.0.0'}
+
   common-ancestor-path@1.0.1:
     resolution: {integrity: sha512-L3sHRo1pXXEqX8VU28kfgUY+YGsk09hPqZiZmLacNib6XNTCM8ubYeT7ryXQw8asB1sKgcU5lkB7ONug08aB8w==}
 
@@ -1338,6 +1475,9 @@ packages:
   convert-source-map@2.0.0:
     resolution: {integrity: sha512-Kvp459HrV2FEJ1CAsi1Ku+MY3kasH19TFykTz2xWmMeq6bk2NU3XXvfJ+Q61m0xktWwt+1HSYf3JZsTms3aRJg==}
 
+  core-js-compat@3.46.0:
+    resolution: {integrity: sha512-p9hObIIEENxSV8xIu+V68JjSeARg6UVMG5mR+JEUguG3sI6MsiS1njz2jHmyJDvA+8jX/sytkBHup6kxhM9law==}
+
   cross-spawn@7.0.6:
     resolution: {integrity: sha512-uV2QOWP2nWzsy2aMp8aRibhi9dlzF5Hgh5SHaB9OiTGEyDTiJJyx0uy51QXdyWbtAHNua4XJzUKca3OzKUd3vA==}
     engines: {node: '>= 8'}
@@ -1360,10 +1500,6 @@ packages:
     resolution: {integrity: sha512-aW35yZM6Bb/4oJlZncMH2LCoZtJXTRxES17vE3hoRiowU2kWHaJKFkSBDnDR+cm9J+9QhXmREyIfv0pji9ejCQ==}
     engines: {node: '>=10'}
 
-  deep-eql@5.0.2:
-    resolution: {integrity: sha512-h5k/5U50IJJFpzfL6nO9jaaumfjO/f2NjK/oYB2Djzm4p9L+3T9qWpZqZ2hAbLPuuYq9wrU08WQyBTL5GbPk5Q==}
-    engines: {node: '>=6'}
-
   deep-is@0.1.4:
     resolution: {integrity: sha512-oIPzksmTg4/MriiaYGO+okXDT7ztn/w3Eptv/+gSIdMdKsJo0u4CfYNFJPy+4SKMuCqGw2wxnA+URMg3t8a/bQ==}
 
@@ -1394,19 +1530,11 @@ packages:
     resolution: {integrity: sha512-uBq4egWHTcTt33a72vpSG0z3HnPuIl6NqYcTrKEg2azoEyl2hpW0zqlxysq2pK9HlDIHyHyakeYaYnSAwd8bow==}
     engines: {node: '>=12'}
 
-  dotenv@17.2.3:
-    resolution: {integrity: sha512-JVUnt+DUIzu87TABbhPmNfVdBDt18BLOWjMUFJMSi/Qqg7NTYtabbvSNJGOJ7afbRuv9D/lngizHtP7QyLQ+9w==}
-    engines: {node: '>=12'}
-
   eastasianwidth@0.2.0:
     resolution: {integrity: sha512-I88TYZWc9XiYHRQ4/3c5rjjfgkjhLyW2luGIheGERbNQ6OY7yTybanSpDXZa8y7VUP9YmDcYa+eyq4ca7iLqWA==}
 
-  eciesjs@0.4.16:
-    resolution: {integrity: sha512-dS5cbA9rA2VR4Ybuvhg6jvdmp46ubLn3E+px8cG/35aEDNclrqoCjg6mt0HYZ/M+OoESS3jSkCrqk1kWAEhWAw==}
-    engines: {bun: '>=1', deno: '>=2', node: '>=16'}
-
-  electron-to-chromium@1.5.237:
-    resolution: {integrity: sha512-icUt1NvfhGLar5lSWH3tHNzablaA5js3HVHacQimfP8ViEBOQv+L7DKEuHdbTZ0SKCO1ogTJTIL1Gwk9S6Qvcg==}
+  electron-to-chromium@1.5.239:
+    resolution: {integrity: sha512-1y5w0Zsq39MSPmEjHjbizvhYoTaulVtivpxkp5q5kaPmQtsK6/2nvAzGRxNMS9DoYySp9PkW0MAQDwU1m764mg==}
 
   emoji-regex@10.6.0:
     resolution: {integrity: sha512-toUI84YS5YmxW219erniWD0CIVOo46xGKColeNQRgOzDorgBi1v4D71/OFzgD9GO2UGKIv1C3Sp8DAn0+j5w7A==}
@@ -1441,8 +1569,8 @@ packages:
   es-module-lexer@1.7.0:
     resolution: {integrity: sha512-jEQoCwk8hyb2AZziIOLhDqpm5+2ww5uIE6lkO/6jcOCusfk6LhMHpXXfBLXTZ7Ydyt0j4VoUQv6uGNYbdW+kBA==}
 
-  es-toolkit@1.40.0:
-    resolution: {integrity: sha512-8o6w0KFmU0CiIl0/Q/BCEOabF2IJaELM1T2PWj6e8KqzHv1gdx+7JtFnDwOx1kJH/isJ5NwlDG1nCr1HrRF94Q==}
+  es-toolkit@1.41.0:
+    resolution: {integrity: sha512-bDd3oRmbVgqZCJS6WmeQieOrzpl3URcWBUVDXxOELlUW2FuW+0glPOz1n0KnRie+PdyvUZcXz2sOn00c6pPRIA==}
 
   esbuild@0.25.11:
     resolution: {integrity: sha512-KohQwyzrKTQmhXDW1PjCv3Tyspn9n5GcY2RTDqeORIdIJY8yKIF7sTSopFmn/wpMPW4rdPXI0UE5LJLuq3bx0Q==}
@@ -1453,6 +1581,10 @@ packages:
     resolution: {integrity: sha512-WUj2qlxaQtO4g6Pq5c29GTcWGDyd8itL8zTlipgECz3JesAiiOKotd8JU6otB3PACgG6xkJUyVhboMS+bje/jA==}
     engines: {node: '>=6'}
 
+  escape-string-regexp@1.0.5:
+    resolution: {integrity: sha512-vbRorB5FUQWvla16U8R/qgaFIya2qGzwDrNmCZuYKrbdSUMG6I1ZCGQRefkRVhuOkIGVne7BQ35DSfo1qvJqFg==}
+    engines: {node: '>=0.8.0'}
+
   escape-string-regexp@4.0.0:
     resolution: {integrity: sha512-TtpcNJ3XAzx3Gq8sWRzJaVajRs0uVxA2YAkdb1jm2YkPz4G6egUFAyA3n5vtEIZefPk5Wa4UXbKuS5fKkJWdgA==}
     engines: {node: '>=10'}
@@ -1463,18 +1595,65 @@ packages:
     peerDependencies:
       eslint: '>=6.0.0'
 
+  eslint-import-context@0.1.9:
+    resolution: {integrity: sha512-K9Hb+yRaGAGUbwjhFNHvSmmkZs9+zbuoe3kFQ4V1wYjrepUFYM2dZAfNtjbbj3qsPfUfsA68Bx/ICWQMi+C8Eg==}
+    engines: {node: ^12.20.0 || ^14.18.0 || >=16.0.0}
+    peerDependencies:
+      unrs-resolver: ^1.0.0
+    peerDependenciesMeta:
+      unrs-resolver:
+        optional: true
+
+  eslint-import-resolver-typescript@4.4.4:
+    resolution: {integrity: sha512-1iM2zeBvrYmUNTj2vSC/90JTHDth+dfOfiNKkxApWRsTJYNrc8rOdxxIf5vazX+BiAXTeOT0UvWpGI/7qIWQOw==}
+    engines: {node: ^16.17.0 || >=18.6.0}
+    peerDependencies:
+      eslint: '*'
+      eslint-plugin-import: '*'
+      eslint-plugin-import-x: '*'
+    peerDependenciesMeta:
+      eslint-plugin-import:
+        optional: true
+      eslint-plugin-import-x:
+        optional: true
+
   eslint-plugin-es-x@7.8.0:
     resolution: {integrity: sha512-7Ds8+wAAoV3T+LAKeu39Y5BzXCrGKrcISfgKEqTS4BDN8SFEDQd0S43jiQ8vIa3wUKD07qitZdfzlenSi8/0qQ==}
     engines: {node: ^14.18.0 || >=16.0.0}
     peerDependencies:
       eslint: '>=8'
 
+  eslint-plugin-import-x@4.16.1:
+    resolution: {integrity: sha512-vPZZsiOKaBAIATpFE2uMI4w5IRwdv/FpQ+qZZMR4E+PeOcM4OeoEbqxRMnywdxP19TyB/3h6QBB0EWon7letSQ==}
+    engines: {node: ^18.18.0 || ^20.9.0 || >=21.1.0}
+    peerDependencies:
+      '@typescript-eslint/utils': ^8.0.0
+      eslint: ^8.57.0 || ^9.0.0
+      eslint-import-resolver-node: '*'
+    peerDependenciesMeta:
+      '@typescript-eslint/utils':
+        optional: true
+      eslint-import-resolver-node:
+        optional: true
+
   eslint-plugin-n@17.23.1:
     resolution: {integrity: sha512-68PealUpYoHOBh332JLLD9Sj7OQUDkFpmcfqt8R9sySfFSeuGJjMTJQvCRRB96zO3A/PELRLkPrzsHmzEFQQ5A==}
     engines: {node: ^18.18.0 || ^20.9.0 || >=21.1.0}
     peerDependencies:
       eslint: '>=8.23.0'
 
+  eslint-plugin-sort-destructure-keys@2.0.0:
+    resolution: {integrity: sha512-4w1UQCa3o/YdfWaLr9jY8LfGowwjwjmwClyFLxIsToiyIdZMq3x9Ti44nDn34DtTPP7PWg96tUONKVmATKhYGQ==}
+    engines: {node: '>=12'}
+    peerDependencies:
+      eslint: 5 - 9
+
+  eslint-plugin-unicorn@61.0.2:
+    resolution: {integrity: sha512-zLihukvneYT7f74GNbVJXfWIiNQmkc/a9vYBTE4qPkQZswolWNdu+Wsp9sIXno1JOzdn6OUwLPd19ekXVkahRA==}
+    engines: {node: ^20.10.0 || >=21.0.0}
+    peerDependencies:
+      eslint: '>=9.29.0'
+
   eslint-scope@8.4.0:
     resolution: {integrity: sha512-sNXOfKCn74rt8RICKMvJS7XKV/Xk9kA7DyJr8mJik3S7Cwgy3qlkkmyS2uQB3jiJg6VNdZd/pDBJu0nvG2NlTg==}
     engines: {node: ^18.18.0 || ^20.9.0 || >=21.1.0}
@@ -1532,10 +1711,6 @@ packages:
     resolution: {integrity: sha512-Y/URAVapfbYy2Xp/gb6A0E7iR8xeqOCXsuuaoMn7A5PzrXUK84E1gyiEfq0wQd/GHA6GsoHWwhNq8anb0mleIw==}
     engines: {node: ^8.12.0 || >=9.7.0}
 
-  execa@5.1.1:
-    resolution: {integrity: sha512-8uSpZZocAZRBAPIEINJj3Lo9HyGitllczc27Eh5YYojjMFMn8yHMDMaUHE2Jqfq05D/wucwI4JGURyXt1vchyg==}
-    engines: {node: '>=10'}
-
   execa@8.0.1:
     resolution: {integrity: sha512-VyhnebXciFV2DESc+p6B+y0LjSm0krU4OgJN44qFAhBY0TJ+1V61tYD2+wHusZ6F9n5K+vl8k0sTy7PEfV4qpg==}
     engines: {node: '>=16.17'}
@@ -1637,16 +1812,12 @@ packages:
     resolution: {integrity: sha512-nBF+F1rAZVCu/p7rjzgA+Yb4lfYXrpl7a6VmJrU8wF9I1CKvP/QwPNZHnOlwbTkY6dvtFIzFMSyQXbLoTQPRpA==}
     engines: {node: '>=8'}
 
-  get-stream@6.0.1:
-    resolution: {integrity: sha512-ts6Wi+2j3jQjqi70w5AlN8DFnkSwC+MqmxEzdEALB2qXZYV3X/b1CTfgPLGJNMeAWxdPfU8FO1ms3NUfaHCPYg==}
-    engines: {node: '>=10'}
-
   get-stream@8.0.1:
     resolution: {integrity: sha512-VaUJspBffn/LMCJVoMvSAdmscJyS1auj5Zulnn5UoYcY531UWmdwhRWkcGKnGU93m5HSXP9LP2usOryrBtQowA==}
     engines: {node: '>=16'}
 
-  get-tsconfig@4.12.0:
-    resolution: {integrity: sha512-LScr2aNr2FbjAjZh2C6X6BxRx1/x+aTDExct/xyq2XKbYOiG5c0aK7pMsSuyc0brz3ibr/lbQiHD9jzt4lccJw==}
+  get-tsconfig@4.13.0:
+    resolution: {integrity: sha512-1VKTZJCwBrvbd+Wn3AOgQP/2Av+TfTCOlE4AcRJE72W1ksZXbAx8PPBR9RzgTeSPzlPMHrbANMH3LbltH73wxQ==}
 
   glob-parent@5.1.2:
     resolution: {integrity: sha512-AOIgSQCepiJYwP3ARnGx+5VnTu2HBYdzbGP45eLw1vr3zB3vZLeyed1sC9hnbcOc9/SrMyM5RPQrkGz4aS9Zow==}
@@ -1731,10 +1902,6 @@ packages:
     resolution: {integrity: sha512-vK9P5/iUfdl95AI+JVyUuIcVtd4ofvtrOr3HNtM2yxC9bnMbEdp3x01OhQNnjb8IJYi38VlTE3mBXwcfvywuSw==}
     engines: {node: '>= 14'}
 
-  human-signals@2.1.0:
-    resolution: {integrity: sha512-B4FFZ6q/T2jhhksgkbEW3HBvWIfDW85snkQgawt07S7J5QXTk6BkNV+0yAeZrM5QpMAdYlocGoljn0sJ/WQkFw==}
-    engines: {node: '>=10.17.0'}
-
   human-signals@5.0.0:
     resolution: {integrity: sha512-AXcZb6vzzrFAUE61HnN4mpLqd/cSIwNQjtNWR0euPm6y0iqx3G4gOXaIDdtdDwZmhwe82LA6+zinmW4UBWVePQ==}
     engines: {node: '>=16.17.0'}
@@ -1768,6 +1935,10 @@ packages:
     resolution: {integrity: sha512-JmXMZ6wuvDmLiHEml9ykzqO6lwFbof0GG4IkcGaENdCRDDmMVnny7s5HsIgHCbaq0w2MyPhDqkhTUgS2LU2PHA==}
     engines: {node: '>=0.8.19'}
 
+  indent-string@5.0.0:
+    resolution: {integrity: sha512-m6FAo/spmsW2Ab2fU35JTYwtOKa2yAwXSwgjSv1TJzh4Mh7mC3lzAOVLBprb72XsTrgkEIsl7YrFNAiDiRhIGg==}
+    engines: {node: '>=12'}
+
   ini@5.0.0:
     resolution: {integrity: sha512-+N0ngpO3e7cRUWOJAS7qw0IZIVc6XPrW4MlFBdD066F2L4k1L6ker3hLqSq7iXxU5tgS4WGkIUElWn5vogAEnw==}
     engines: {node: ^18.17.0 || >=20.5.0}
@@ -1776,6 +1947,13 @@ packages:
     resolution: {integrity: sha512-NWv9YLW4PoW2B7xtzaS3NCot75m6nK7Icdv0o3lfMceJVRfSoQwqD4wEH5rLwoKJwUiZ/rfpiVBhnaF0FK4HoA==}
     engines: {node: '>= 12'}
 
+  is-builtin-module@5.0.0:
+    resolution: {integrity: sha512-f4RqJKBUe5rQkJ2eJEJBXSticB3hGbN9j0yxxMQFqIW89Jp9WYFtzfTcRlstDKVUTRzSOTLKRfO9vIztenwtxA==}
+    engines: {node: '>=18.20'}
+
+  is-bun-module@2.0.0:
+    resolution: {integrity: sha512-gNCGbnnnnFAUGKeZ9PdbyeGYJqewpmc2aKHUEMO5nQPWU9lOmv7jcmQIv+qHD8fXW6W7qfuCwX4rY9LNRjXrkQ==}
+
   is-extglob@2.1.1:
     resolution: {integrity: sha512-SbKbANkN603Vi4jEZv49LeVJMn4yGwsbzZworEoyEiutsN3nJYdbO36zfhGJ6QEDpOZIFkDtnq5JRxmvl3jsoQ==}
     engines: {node: '>=0.10.0'}
@@ -1864,6 +2042,11 @@ packages:
     resolution: {integrity: sha512-wpxZs9NoxZaJESJGIZTyDEaYpl0FKSA+FB9aJiyemKhMwkxQg63h4T1KJgUGHpTqPDNRcmmYLugrRjJlBtWvRA==}
     hasBin: true
 
+  jsesc@3.0.2:
+    resolution: {integrity: sha512-xKqzzWXDttJuOcawBt4KnKHHIf5oQ/Cxax+0PWFG+DFDgHNAdi+TXECADI+RYiFUMmx8792xsMbbgXj4CwnP4g==}
+    engines: {node: '>=6'}
+    hasBin: true
+
   jsesc@3.1.0:
     resolution: {integrity: sha512-/sM3dO2FOzXjKQhJuo0Q173wf2KOo8t4I8vHy6lF9poUp7bKT0/NHE8fPX23PwfhnykfqnC2xRxOnVw5XuGIaA==}
     engines: {node: '>=6'}
@@ -1907,6 +2090,10 @@ packages:
     resolution: {integrity: sha512-+bT2uH4E5LGE7h/n3evcS/sQlJXCpIp6ym8OWJ5eV6+67Dsql/LaaT7qJBAt2rzfoa/5QBGBhxDix1dMt2kQKQ==}
     engines: {node: '>= 0.8.0'}
 
+  libnpmexec@10.1.8:
+    resolution: {integrity: sha512-VS4/zL1ZV73tNZbsh/UXyumYP/NMN0vCENigiaWtwq1zJqe/y9bhgaK74QzTb8K50po6jMJQhD8V96F0/yDajg==}
+    engines: {node: ^20.17.0 || >=22.9.0}
+
   libnpmpack@9.0.9:
     resolution: {integrity: sha512-0UNr2ULi2QOo82EbOCIkn/tQJqD+AAa9iY3kd0kJN23HuwFmCQKba2A9Mep377uSc9VpcHIbUBRW8ROvkMkNlw==}
     engines: {node: ^20.17.0 || >=22.9.0}
@@ -1935,9 +2122,6 @@ packages:
     resolution: {integrity: sha512-9ie8ItPR6tjY5uYJh8K/Zrv/RMZ5VOlOWvtZdEHYSTFKZfIBPQa9tOAEeAWhd+AnIneLJ22w5fjOYtoutpWq5w==}
     engines: {node: '>=18'}
 
-  loupe@3.2.1:
-    resolution: {integrity: sha512-CdzqowRJCeLU72bHvWqwRBBlLcMEtIvGrlvef74kMnV2AolS9Y8xUv1I0U/MNAWMhBlKIoyuEgoJ0t/bbwHbLQ==}
-
   lowercase-keys@2.0.0:
     resolution: {integrity: sha512-tqNXrS78oMOE73NMxK4EMLQsQowWf8jKooH9g7xPavRT706R6bkQJ6DY2Te7QukaZsulxa30wQ7bk0pm4XiHmA==}
     engines: {node: '>=8'}
@@ -1955,6 +2139,9 @@ packages:
   magic-string@0.30.17:
     resolution: {integrity: sha512-sNPKHvyjVf7gyjwS4xGTaW/mCnF8wnjtifKBEhxfZ7E/S8tQ0rssrwGNn6q8JH/ohItJfSQp9mBtQYuTlH5QnA==}
 
+  magic-string@0.30.21:
+    resolution: {integrity: sha512-vd2F4YUyEXKGcLHoq+TEyCjxueSeHnFxyyjNp80yg0XV4vUhnDer/lvvlqM/arB5bXQN5K2/3oinyCRyx8T2CQ==}
+
   magicast@0.3.5:
     resolution: {integrity: sha512-L0WhttDl+2BOsybvEOLK7fW3UA0OQ0IQ2d6Zl2x/a6vVRs3bAY0ECOSHHeL5jD+SbOpOCUEi0y1DgHEn9Qn1AQ==}
 
@@ -1970,10 +2157,6 @@ packages:
     resolution: {integrity: sha512-sI1NY4lWlXBAfjmCtVWIIpBypbBdhHtcjnwnv+gtCnsaOffyFil3aidszGC8hgzJe+fT1qix05sWxmD/Bmf/oQ==}
     engines: {node: ^20.17.0 || >=22.9.0}
 
-  memorystream@0.3.1:
-    resolution: {integrity: sha512-S3UwM3yj5mtUSEfP41UZmt/0SCoVYUcU1rkXv+BQ5Ig8ndL4sPoJNBUJERafdPb5jjHJGuMgytgKvKIf58XNBw==}
-    engines: {node: '>= 0.10.0'}
-
   meow@13.2.0:
     resolution: {integrity: sha512-pxQJQzB6djGPXh08dacEloMFopsOqGVRKFPYvPOt9XDZ1HasbgDZA74CJGreSU4G3Ak7EFJGoiH2auq+yXISgA==}
     engines: {node: '>=18'}
@@ -2013,6 +2196,10 @@ packages:
     resolution: {integrity: sha512-IPZ167aShDZZUMdRk66cyQAW3qr0WzbHkPdMYa8bzZhlHhO3jALbKdxcaak7W9FfT2rZNpQuUu4Od7ILEpXSaw==}
     engines: {node: 20 || >=22}
 
+  minimatch@10.1.1:
+    resolution: {integrity: sha512-enIvLvRAFZYXJzkCYG5RKmPfrFArdLv+R+lbQ53BmIMLIry74bjKzX6iHAm8WYamJkhSSEabrWN5D97XnKObjQ==}
+    engines: {node: 20 || >=22}
+
   minimatch@3.1.2:
     resolution: {integrity: sha512-J7p63hRiAjw1NDEww1W7i37+ByIrOWO5XQQAzZ3VOcL0PNybwpfmV/N05zFAzwQ9USyEcX6t3UO+K5aqBQOIHw==}
 
@@ -2092,6 +2279,14 @@ packages:
     engines: {node: ^10 || ^12 || ^13.7 || ^14 || >=15.0.1}
     hasBin: true
 
+  napi-postinstall@0.3.4:
+    resolution: {integrity: sha512-PHI5f1O0EP5xJ9gQmFGMS6IZcrVvTjpXjz7Na41gTE7eE2hK11lg04CECCYEEjdc17EV4DO+fkGEtt7TpTaTiQ==}
+    engines: {node: ^12.20.0 || ^14.18.0 || >=16.0.0}
+    hasBin: true
+
+  natural-compare-lite@1.4.0:
+    resolution: {integrity: sha512-Tj+HTDSJJKaZnfiuw+iaF9skdPpTo2GtEly5JHnWV/hfv2Qj/9RKsGISQtLh2ox3l5EAGw487hnBee0sIJ6v2g==}
+
   natural-compare@1.4.0:
     resolution: {integrity: sha512-OWND8ei3VtNC9h7V60qff3SVobHr996CTwgxubgyQYEpg290h9J0buyECNNJexkFm5sOajh5G116RYA1c8ZMSw==}
 
@@ -2107,8 +2302,8 @@ packages:
     engines: {node: ^18.17.0 || >=20.5.0}
     hasBin: true
 
-  node-releases@2.0.25:
-    resolution: {integrity: sha512-4auku8B/vw5psvTiiN9j1dAOsXvMoGqJuKJcR+dTdqiXEK20mMTk1UEo3HS16LeGQsVG6+qKTPM9u/qQ2LqATA==}
+  node-releases@2.0.26:
+    resolution: {integrity: sha512-S2M9YimhSjBSvYnlr5/+umAnPHE++ODwt5e2Ij6FoX45HA/s4vHdkDx1eax2pAPeAOqu4s9b7ppahsyEFdVqQA==}
 
   nopt@8.1.0:
     resolution: {integrity: sha512-ieGu42u/Qsa4TFktmaKEwM6MQH0pOWnaB3htzh0JRtx84+Mebc0cbZYN5bC+6WTZ4+77xrL9Pn5m7CV6VIkV7A==}
@@ -2163,27 +2358,14 @@ packages:
     resolution: {integrity: sha512-DFxSAemHUwT/POaXAOY4NJmEWBPB0oKbwD6FFDE9hnt1nORkt/FXvgjD4hQjoKoHw9u0Ezws9SPXwV7xE/Gyww==}
     engines: {node: ^20.17.0 || >=22.9.0}
 
-  npm-run-all2@8.0.4:
-    resolution: {integrity: sha512-wdbB5My48XKp2ZfJUlhnLVihzeuA1hgBnqB2J9ahV77wLS+/YAJAlN8I+X3DIFIPZ3m5L7nplmlbhNiFDmXRDA==}
-    engines: {node: ^20.5.0 || >=22.0.0, npm: '>= 10'}
-    hasBin: true
-
   npm-run-path@3.1.0:
     resolution: {integrity: sha512-Dbl4A/VfiVGLgQv29URL9xshU8XDY1GeLy+fsaZ1AA8JDSfjvr5P5+pzRbWqRSBxk6/DW7MIh8lTM/PaGnP2kg==}
     engines: {node: '>=8'}
 
-  npm-run-path@4.0.1:
-    resolution: {integrity: sha512-S48WzZW777zhNIrn7gxOlISNAqi9ZC/uQFnRdbeIHhZhCA6UqpkOT8T1G7BvfdgP4Er8gF4sUbaS0i7QvIfCWw==}
-    engines: {node: '>=8'}
-
   npm-run-path@5.3.0:
     resolution: {integrity: sha512-ppwTtiJZq0O/ai0z7yfudtBpWIoxM8yE6nHi1X47eFR2EWORqfbu6CnPlNsjeN683eT0qG6H/Pyf9fCcvjnnnQ==}
     engines: {node: ^12.20.0 || ^14.13.1 || >=16.0.0}
 
-  object-treeify@1.1.33:
-    resolution: {integrity: sha512-EFVjAYfzWqWsBMRHPMAXLCDIJnpMhdWAqR7xG6M6a2cs6PMFpl/+Z20w9zDW4vkxOFfddegBKq9Rehd0bxWE7A==}
-    engines: {node: '>= 10'}
-
   ofetch@1.4.1:
     resolution: {integrity: sha512-QZj2DfGplQAr2oj9KzceK9Hwz6Whxazmn85yYeVuS3u9XTMOGMRx0kO95MQ+vLsj/S/NwBDMMLU5hpxvI6Tklw==}
 
@@ -2293,10 +2475,6 @@ packages:
   pathe@2.0.3:
     resolution: {integrity: sha512-WUjGcAqP1gQacoQe+OBJsFA7Ld4DyXuUIjZ5cc75cLHvJ7dtNsTugphxIADwspS+AraAUePCKrSVtPLFj/F88w==}
 
-  pathval@2.0.1:
-    resolution: {integrity: sha512-//nshmD55c46FuFw26xV/xFAaB5HF9Xdap7HJBBnrKdAd6/GxDBaNA1870O79+9ueg61cZLSVc+OaFlfmObYVQ==}
-    engines: {node: '>= 14.16'}
-
   picocolors@1.1.1:
     resolution: {integrity: sha512-xceH2snhtb5M9liqDsmEw56le376mTZkEX/jEb/RxNFyegNul7eNslCXP9FDj/Lcu0X8KEyMceP2ntpaHrDEVA==}
 
@@ -2325,6 +2503,10 @@ packages:
     resolution: {integrity: sha512-MnUuEycAemtSaeFSjXKW/aroV7akBbY+Sv+RkyqFjgAe73F+MR0TBWKBRDkmfWq/HiFmdavfZ1G7h4SPZXaCSg==}
     engines: {node: '>=0.10.0'}
 
+  pluralize@8.0.0:
+    resolution: {integrity: sha512-Nc3IT5yHzflTfbjgqWcCPpo7DaKy4FnpB0l/zCAW0Tc7jxAiuqSxHasntB3D7887LSrA93kDJ9IXovxJYxyLCA==}
+    engines: {node: '>=4'}
+
   pnpm-workspace-yaml@1.3.0:
     resolution: {integrity: sha512-Krb5q8Totd5mVuLx7we+EFHq/AfxA75nbfTm25Q1pIf606+RlaKUG+PXH8SDihfe5b5k4H09gE+sL47L1t5lbw==}
 
@@ -2383,10 +2565,18 @@ packages:
     resolution: {integrity: sha512-SEbJV7tohp3DAAILbEMPXavBjAnMN0tVnh4+9G8ihV4Pq3HYF9h8QNez9zkJ1ILkv9G2BjdzwctznGZXgu/HGw==}
     engines: {node: ^18.17.0 || >=20.5.0}
 
-  read-package-json-fast@4.0.0:
-    resolution: {integrity: sha512-qpt8EwugBWDw2cgE2W+/3oxC+KTez2uSVR8JU9Q36TXPAGCaozfQUs59v4j4GFpWTaw0i6hAZSvOmu1J0uOEUg==}
+  read@4.1.0:
+    resolution: {integrity: sha512-uRfX6K+f+R8OOrYScaM3ixPY4erg69f8DN6pgTvMcA9iRc8iDhwrA4m3Yu8YYKsXJgVvum+m8PkRboZwwuLzYA==}
     engines: {node: ^18.17.0 || >=20.5.0}
 
+  regexp-tree@0.1.27:
+    resolution: {integrity: sha512-iETxpjK6YoRWJG5o6hXLwvjYAoW+FEZn9os0PD/b6AP6xQwsa/Y7lCVgIixBbUPMfhu+i2LtdeAqVTgGlQarfA==}
+    hasBin: true
+
+  regjsparser@0.12.0:
+    resolution: {integrity: sha512-cnE+y8bz4NhMjISKbgeVJtqNbtf5QpjZP+Bslo+UqkIt9QPnX9q095eiRRASJG1/tz6dlNr6Z5NsBiWYokp6EQ==}
+    hasBin: true
+
   resolve-alpn@1.2.1:
     resolution: {integrity: sha512-0a1F4l73/ZFZOakJnQ3FvkJ2+gSTQWz/r2KE5OdDY0TxPm5h4GkqkWWfM47T7HsbnOtcJVEF4epCVy6u7Q3K+g==}
 
@@ -2443,10 +2633,6 @@ packages:
     resolution: {integrity: sha512-7++dFhtcx3353uBaq8DDR4NuxBetBzC7ZQOhmTQInHEd6bSrXdiEyzCvG07Z44UYdLShWUyXt5M/yhz8ekcb1A==}
     engines: {node: '>=8'}
 
-  shell-quote@1.8.3:
-    resolution: {integrity: sha512-ObmnIF4hXNg1BqhnHmgbDETF8dLPCggZWBjkQfhZpbszZnYur5DUljTcCHii5LC3J5E0yeO/1LIMyH+UvHQgyw==}
-    engines: {node: '>= 0.4'}
-
   siginfo@2.0.0:
     resolution: {integrity: sha512-ybx0WO1/8bSBLEWXZvEd7gMW3Sn3JFlW3TvX1nREbDLRNQNaeNN8WK0meBwPdAaOI7TtRRRJn/Es1zhrrCHu7g==}
 
@@ -2515,6 +2701,10 @@ packages:
     resolution: {integrity: sha512-S7iGNosepx9RadX82oimUkvr0Ct7IjJbEbs4mJcTxst8um95J3sDYU1RBEOvdu6oL1Wek2ODI5i4MAw+dZ6cAQ==}
     engines: {node: ^18.17.0 || >=20.5.0}
 
+  stable-hash-x@0.2.0:
+    resolution: {integrity: sha512-o3yWv49B/o4QZk5ZcsALc6t0+eCelPc44zZsLtCQnZPDwFpDYSWcDnrv2TtMmMbQ7uKo3J0HTURCqckw23czNQ==}
+    engines: {node: '>=12.0.0'}
+
   stackback@0.0.2:
     resolution: {integrity: sha512-1XMJE5fQo1jGH6Y/7ebnwPOBEkIEnT4QF32d5R1+VXdXveM0IBMJt8zfaxX1P3QhVwrYe+576+jkANtSS2mBbw==}
 
@@ -2557,13 +2747,14 @@ packages:
     resolution: {integrity: sha512-dOESqjYr96iWYylGObzd39EuNTa5VJxyvVAEm5Jnh7KGo75V43Hk1odPQkNDyXNmUR6k+gEiDVXnjB8HJ3crXw==}
     engines: {node: '>=12'}
 
+  strip-indent@4.1.1:
+    resolution: {integrity: sha512-SlyRoSkdh1dYP0PzclLE7r0M9sgbFKKMFXpFRUMNuKhQSbC6VQIGzq3E0qsfvGJaUFJPGv6Ws1NZ/haTAjfbMA==}
+    engines: {node: '>=12'}
+
   strip-json-comments@3.1.1:
     resolution: {integrity: sha512-6fPc+R4ihwqP6N/aIv2f1gMH8lOVtWQHoqC4yK6oSDVVocumAsfCqjkXnqiYMhmMwS/mEHLp7Vehlt3ql6lEig==}
     engines: {node: '>=8'}
 
-  strip-literal@3.1.0:
-    resolution: {integrity: sha512-8r3mkIM/2+PpjHoOtiAW8Rg3jJLHaV7xPwG+YRGrv6FP0wwk/toTpATxWYOW0BKdWwl82VT2tFYi5DlROa0Mxg==}
-
   supports-color@7.2.0:
     resolution: {integrity: sha512-qpCAvRl9stuOHveKsn7HncJRvv501qIacKzQlO/+Lwxc9+0q2wLyv4Dfvt80/DPn2pqOBsJdDiogXGR9+OvwRw==}
     engines: {node: '>=8'}
@@ -2584,10 +2775,6 @@ packages:
     resolution: {integrity: sha512-hQGQH4WVtV9BqsZbrGzOmOP4NdWqie948BnqtH+NPwdVt5mI+qALVRDvgzgdf+neN7bcrVVpV4ToyFkxg0U0xQ==}
     hasBin: true
 
-  test-exclude@7.0.1:
-    resolution: {integrity: sha512-pFYqmTw68LXVjeWJMST4+borgQP2AyMNbg1BpZh9LbyhUeNkeaPF9gzfPGUAnSMV3qPYdWUwDIjjCLiSDOl7vg==}
-    engines: {node: '>=18'}
-
   tinybench@2.9.0:
     resolution: {integrity: sha512-0+DUvqWMValLmha6lr4kD8iAMK1HzV0/aKnCtWb9v9641TnP/MFb7Pc2bxoxQjTXAErryXVgUOfv2YqNllqGeg==}
 
@@ -2604,16 +2791,8 @@ packages:
   tinylogic@2.0.0:
     resolution: {integrity: sha512-dljTkiLLITtsjqBvTA1MRZQK/sGP4kI3UJKc3yA9fMzYbMF2RhcN04SeROVqJBIYYOoJMM8u0WDnhFwMSFQotw==}
 
-  tinypool@1.1.1:
-    resolution: {integrity: sha512-Zba82s87IFq9A9XmjiX5uZA/ARWDrB03OHlq+Vw1fSdt0I+4/Kutwy8BP4Y/y/aORMo61FQ0vIb5j44vSo5Pkg==}
-    engines: {node: ^18.0.0 || >=20.0.0}
-
-  tinyrainbow@2.0.0:
-    resolution: {integrity: sha512-op4nsTR47R6p0vMUUoYl/a+ljLFVtlfaXkLQmqfLR1qHma1h/ysYk4hEXZ880bf2CYgTskvTa/e196Vd5dDQXw==}
-    engines: {node: '>=14.0.0'}
-
-  tinyspy@4.0.4:
-    resolution: {integrity: sha512-azl+t0z7pw/z958Gy9svOTuzqIk6xq+NSheJzn5MMWtWTFywIacg2wUlzKFGtt3cthx0r2SxMK0yzJOR0IES7Q==}
+  tinyrainbow@3.0.3:
+    resolution: {integrity: sha512-PSkbLUoxOFRzJYjjxHJt9xro7D+iilgMX/C9lawzVuYiIdcihh9DXmVibBe8lmcFrRi/VzlPjBxbN7rH24q8/Q==}
     engines: {node: '>=14.0.0'}
 
   to-regex-range@5.0.1:
@@ -2693,15 +2872,15 @@ packages:
     resolution: {integrity: sha512-t0rzBq87m3fVcduHDUFhKmyyX+9eo6WQjZvf51Ea/M0Q7+T374Jp1aUiyUl0GKxp8M/OETVHSDvmkyPgvX+X2w==}
     engines: {node: '>=10'}
 
-  typescript-eslint@8.44.1:
-    resolution: {integrity: sha512-0ws8uWGrUVTjEeN2OM4K1pLKHK/4NiNP/vz6ns+LjT/6sqpaYzIVFajZb1fj/IDwpsrrHb3Jy0Qm5u9CPcKaeg==}
+  typescript-eslint@8.46.3:
+    resolution: {integrity: sha512-bAfgMavTuGo+8n6/QQDVQz4tZ4f7Soqg53RbrlZQEoAltYop/XR4RAts/I0BrO3TTClTSTFJ0wYbla+P8cEWJA==}
     engines: {node: ^18.18.0 || ^20.9.0 || >=21.1.0}
     peerDependencies:
       eslint: ^8.57.0 || ^9.0.0
       typescript: '>=4.8.4 <6.0.0'
 
-  typescript@5.7.3:
-    resolution: {integrity: sha512-84MVSjMEHP+FQRPy3pX9sTVV/INIex71s9TL2Gm5FG/WG1SqXeKyZ0k7/blY/4FdOzI12CBy1vGc4og/eus0fw==}
+  typescript@5.9.2:
+    resolution: {integrity: sha512-CWBzXQrc/qOkhidw1OzBTQuYRbfyxDXJMVJ1XNwUHGROVmuaeiEm3OslpZ1RV96d7SKKjZKrSJu3+t/xlw3R9A==}
     engines: {node: '>=14.17'}
     hasBin: true
 
@@ -2711,8 +2890,8 @@ packages:
   unconfig@7.3.3:
     resolution: {integrity: sha512-QCkQoOnJF8L107gxfHL0uavn7WD9b3dpBcFX6HtfQYmjw2YzWxGuFQ0N0J6tE9oguCBJn9KOvfqYDCMPHIZrBA==}
 
-  undici-types@7.13.0:
-    resolution: {integrity: sha512-Ov2Rr9Sx+fRgagJ5AX0qvItZG/JKKoBRAVITs1zk7IqZGTJUwgUr7qoYBpWwakpWilTZFM98rG/AFRocu10iIQ==}
+  undici-types@7.16.0:
+    resolution: {integrity: sha512-Zz+aZWSj8LE6zoxD+xrjh4VfkIG8Ya6LvYkZqtUQGJPZjYl53ypCaUwWqo7eI0x66KBGeRo+mlBEkMSeSZ38Nw==}
 
   unicorn-magic@0.3.0:
     resolution: {integrity: sha512-+QBBXBCvifc56fsbuxZQ6Sic3wqqc3WWaqxs58gvJrcOuN83HGTCwz3oS5phzU9LthRNE9VrJCFCLUgHeeFnfA==}
@@ -2726,8 +2905,11 @@ packages:
     resolution: {integrity: sha512-9OdaqO5kwqR+1kVgHAhsp5vPNU0hnxRa26rBFNfNgM7M6pNtgzeBn3s/xbyCQL3dcjzOatcef6UUHpB/6MaETg==}
     engines: {node: ^18.17.0 || >=20.5.0}
 
-  update-browserslist-db@1.1.3:
-    resolution: {integrity: sha512-UxhIZQ+QInVdunkDAaiazvvT/+fXL5Osr0JZlJulepYu6Jd7qJtDZjlur0emRlT71EN3ScPoE7gvsuIKKNavKw==}
+  unrs-resolver@1.11.1:
+    resolution: {integrity: sha512-bSjt9pjaEBnNiGgc9rUiHGKv5l4/TGzDmYw3RhnkJGtLhbnnA/5qJj7x3dNDCRx/PJxu774LlH8lCOlB4hEfKg==}
+
+  update-browserslist-db@1.1.4:
+    resolution: {integrity: sha512-q0SPT4xyU84saUX+tomz1WLkxUbuaJnR1xWt17M7fJtEJigJeWUNGUqrauFXsHnqev9y9JTRGwk13tFBuKby4A==}
     hasBin: true
     peerDependencies:
       browserslist: '>= 4.21.0'
@@ -2749,11 +2931,6 @@ packages:
     resolution: {integrity: sha512-IUoow1YUtvoBBC06dXs8bR8B9vuA3aJfmQNKMoaPG/OFsPmoQvw8xh+6Ye25Gx9DQhoEom3Pcu9MKHerm/NpUQ==}
     engines: {node: ^18.17.0 || >=20.5.0}
 
-  vite-node@3.2.4:
-    resolution: {integrity: sha512-EbKSKh+bh1E1IFxeO0pg1n4dvoOTt0UDiXMd/qn++r98+jPO1xtJilvXldeuQ8giIB5IkpjCgMleHMNEsGH6pg==}
-    engines: {node: ^18.0.0 || ^20.0.0 || >=22.0.0}
-    hasBin: true
-
   vite-tsconfig-paths@5.1.4:
     resolution: {integrity: sha512-cYj0LRuLV2c2sMqhqhGpaO3LretdtMn/BVX4cPLanIZuwwrkVl+lK84E/miEXkCHWXuq65rhNN4rXsBcOB3S4w==}
     peerDependencies:
@@ -2762,8 +2939,8 @@ packages:
       vite:
         optional: true
 
-  vite@7.1.11:
-    resolution: {integrity: sha512-uzcxnSDVjAopEUjljkWh8EIrg6tlzrjFUfMcR1EVsRDGwf/ccef0qQPRyOrROwhrTDaApueq+ja+KLPlzR/zdg==}
+  vite@7.1.12:
+    resolution: {integrity: sha512-ZWyE8YXEXqJrrSLvYgrRP7p62OziLW7xI5HYGWFzOvupfAlrLvURSzv/FyGyy0eidogEM3ujU+kUG1zuHgb6Ug==}
     engines: {node: ^20.19.0 || >=22.12.0}
     hasBin: true
     peerDependencies:
@@ -2802,16 +2979,18 @@ packages:
       yaml:
         optional: true
 
-  vitest@3.2.4:
-    resolution: {integrity: sha512-LUCP5ev3GURDysTWiP47wRRUpLKMOfPh+yKTx3kVIEiu5KOMeqzpnYNsKyOoVrULivR8tLcks4+lga33Whn90A==}
-    engines: {node: ^18.0.0 || ^20.0.0 || >=22.0.0}
+  vitest@4.0.3:
+    resolution: {integrity: sha512-IUSop8jgaT7w0g1yOM/35qVtKjr/8Va4PrjzH1OUb0YH4c3OXB2lCZDkMAB6glA8T5w8S164oJGsbcmAecr4sA==}
+    engines: {node: ^20.0.0 || ^22.0.0 || >=24.0.0}
     hasBin: true
     peerDependencies:
       '@edge-runtime/vm': '*'
       '@types/debug': ^4.1.12
-      '@types/node': ^18.0.0 || ^20.0.0 || >=22.0.0
-      '@vitest/browser': 3.2.4
-      '@vitest/ui': 3.2.4
+      '@types/node': ^20.0.0 || ^22.0.0 || >=24.0.0
+      '@vitest/browser-playwright': 4.0.3
+      '@vitest/browser-preview': 4.0.3
+      '@vitest/browser-webdriverio': 4.0.3
+      '@vitest/ui': 4.0.3
       happy-dom: '*'
       jsdom: '*'
     peerDependenciesMeta:
@@ -2821,7 +3000,11 @@ packages:
         optional: true
       '@types/node':
         optional: true
-      '@vitest/browser':
+      '@vitest/browser-playwright':
+        optional: true
+      '@vitest/browser-preview':
+        optional: true
+      '@vitest/browser-webdriverio':
         optional: true
       '@vitest/ui':
         optional: true
@@ -2839,11 +3022,6 @@ packages:
     engines: {node: '>= 8'}
     hasBin: true
 
-  which@4.0.0:
-    resolution: {integrity: sha512-GlaYyEb07DPxYCKhKzplCWBJtvxZcZMrL+4UkrTSJHHPyZU4mYYTv3qaOe77H7EODLSSopAUFAc6W8U4yqvscg==}
-    engines: {node: ^16.13.0 || >=18.0.0}
-    hasBin: true
-
   which@5.0.0:
     resolution: {integrity: sha512-JEdGzHwwkrbWoGOlIHqQ5gtprKGOenpDHpxE9zVR1bWbOtYRyPPHMe9FaP6x61CmNaTThSkb0DAJte5jD+DmzQ==}
     engines: {node: ^18.17.0 || >=20.5.0}
@@ -2926,11 +3104,6 @@ packages:
 
 snapshots:
 
-  '@ampproject/remapping@2.3.0':
-    dependencies:
-      '@jridgewell/gen-mapping': 0.3.13
-      '@jridgewell/trace-mapping': 0.3.31
-
   '@antfu/ni@25.0.0':
     dependencies:
       ansis: 4.2.0
@@ -2982,7 +3155,7 @@ snapshots:
     dependencies:
       '@babel/compat-data': 7.28.4
       '@babel/helper-validator-option': 7.27.1
-      browserslist: 4.26.3
+      browserslist: 4.27.0
       lru-cache: 5.1.1
       semver: 6.3.1
 
@@ -3079,21 +3252,21 @@ snapshots:
   '@biomejs/cli-win32-x64@2.2.4':
     optional: true
 
-  '@dotenvx/dotenvx@1.49.0':
+  '@emnapi/core@1.6.0':
     dependencies:
-      commander: 11.1.0
-      dotenv: 17.2.3
-      eciesjs: 0.4.16
-      execa: 5.1.1
-      fdir: 6.5.0(picomatch@4.0.3)
-      ignore: 5.3.2
-      object-treeify: 1.1.33
-      picomatch: 4.0.3
-      which: 4.0.0
+      '@emnapi/wasi-threads': 1.1.0
+      tslib: 2.8.1
+    optional: true
 
-  '@ecies/ciphers@0.2.4(@noble/ciphers@1.3.0)':
+  '@emnapi/runtime@1.6.0':
     dependencies:
-      '@noble/ciphers': 1.3.0
+      tslib: 2.8.1
+    optional: true
+
+  '@emnapi/wasi-threads@1.1.0':
+    dependencies:
+      tslib: 2.8.1
+    optional: true
 
   '@esbuild/aix-ppc64@0.25.11':
     optional: true
@@ -3178,7 +3351,13 @@ snapshots:
       eslint: 9.35.0(jiti@2.6.1)
       eslint-visitor-keys: 3.4.3
 
-  '@eslint-community/regexpp@4.12.1': {}
+  '@eslint-community/regexpp@4.12.2': {}
+
+  '@eslint/compat@1.4.0(eslint@9.35.0(jiti@2.6.1))':
+    dependencies:
+      '@eslint/core': 0.16.0
+    optionalDependencies:
+      eslint: 9.35.0(jiti@2.6.1)
 
   '@eslint/config-array@0.21.1':
     dependencies:
@@ -3194,6 +3373,10 @@ snapshots:
     dependencies:
       '@types/json-schema': 7.0.15
 
+  '@eslint/core@0.16.0':
+    dependencies:
+      '@types/json-schema': 7.0.15
+
   '@eslint/eslintrc@3.3.1':
     dependencies:
       ajv: 6.12.6
@@ -3210,6 +3393,8 @@ snapshots:
 
   '@eslint/js@9.35.0': {}
 
+  '@eslint/js@9.38.0': {}
+
   '@eslint/object-schema@2.1.7': {}
 
   '@eslint/plugin-kit@0.3.5':
@@ -3230,65 +3415,65 @@ snapshots:
 
   '@inquirer/ansi@1.0.1': {}
 
-  '@inquirer/confirm@5.1.16(@types/node@24.6.2)':
+  '@inquirer/confirm@5.1.16(@types/node@24.9.2)':
     dependencies:
-      '@inquirer/core': 10.3.0(@types/node@24.6.2)
-      '@inquirer/type': 3.0.9(@types/node@24.6.2)
+      '@inquirer/core': 10.3.0(@types/node@24.9.2)
+      '@inquirer/type': 3.0.9(@types/node@24.9.2)
     optionalDependencies:
-      '@types/node': 24.6.2
+      '@types/node': 24.9.2
 
-  '@inquirer/core@10.3.0(@types/node@24.6.2)':
+  '@inquirer/core@10.3.0(@types/node@24.9.2)':
     dependencies:
       '@inquirer/ansi': 1.0.1
       '@inquirer/figures': 1.0.14
-      '@inquirer/type': 3.0.9(@types/node@24.6.2)
+      '@inquirer/type': 3.0.9(@types/node@24.9.2)
       cli-width: 4.1.0
       mute-stream: 2.0.0
       signal-exit: 4.1.0
       wrap-ansi: 6.2.0
       yoctocolors-cjs: 2.1.3
     optionalDependencies:
-      '@types/node': 24.6.2
+      '@types/node': 24.9.2
 
   '@inquirer/figures@1.0.14': {}
 
-  '@inquirer/input@4.2.2(@types/node@24.6.2)':
+  '@inquirer/input@4.2.2(@types/node@24.9.2)':
     dependencies:
-      '@inquirer/core': 10.3.0(@types/node@24.6.2)
-      '@inquirer/type': 3.0.9(@types/node@24.6.2)
+      '@inquirer/core': 10.3.0(@types/node@24.9.2)
+      '@inquirer/type': 3.0.9(@types/node@24.9.2)
     optionalDependencies:
-      '@types/node': 24.6.2
+      '@types/node': 24.9.2
 
-  '@inquirer/password@4.0.18(@types/node@24.6.2)':
+  '@inquirer/password@4.0.18(@types/node@24.9.2)':
     dependencies:
-      '@inquirer/core': 10.3.0(@types/node@24.6.2)
-      '@inquirer/type': 3.0.9(@types/node@24.6.2)
+      '@inquirer/core': 10.3.0(@types/node@24.9.2)
+      '@inquirer/type': 3.0.9(@types/node@24.9.2)
       ansi-escapes: 4.3.2
     optionalDependencies:
-      '@types/node': 24.6.2
+      '@types/node': 24.9.2
 
-  '@inquirer/search@3.1.1(@types/node@24.6.2)':
+  '@inquirer/search@3.1.1(@types/node@24.9.2)':
     dependencies:
-      '@inquirer/core': 10.3.0(@types/node@24.6.2)
+      '@inquirer/core': 10.3.0(@types/node@24.9.2)
       '@inquirer/figures': 1.0.14
-      '@inquirer/type': 3.0.9(@types/node@24.6.2)
+      '@inquirer/type': 3.0.9(@types/node@24.9.2)
       yoctocolors-cjs: 2.1.3
     optionalDependencies:
-      '@types/node': 24.6.2
+      '@types/node': 24.9.2
 
-  '@inquirer/select@4.3.2(@types/node@24.6.2)':
+  '@inquirer/select@4.3.2(@types/node@24.9.2)':
     dependencies:
-      '@inquirer/core': 10.3.0(@types/node@24.6.2)
+      '@inquirer/core': 10.3.0(@types/node@24.9.2)
       '@inquirer/figures': 1.0.14
-      '@inquirer/type': 3.0.9(@types/node@24.6.2)
+      '@inquirer/type': 3.0.9(@types/node@24.9.2)
       ansi-escapes: 4.3.2
       yoctocolors-cjs: 2.1.3
     optionalDependencies:
-      '@types/node': 24.6.2
+      '@types/node': 24.9.2
 
-  '@inquirer/type@3.0.9(@types/node@24.6.2)':
+  '@inquirer/type@3.0.9(@types/node@24.9.2)':
     optionalDependencies:
-      '@types/node': 24.6.2
+      '@types/node': 24.9.2
 
   '@isaacs/balanced-match@4.0.1': {}
 
@@ -3311,8 +3496,6 @@ snapshots:
 
   '@isaacs/string-locale-compare@1.1.0': {}
 
-  '@istanbuljs/schema@0.1.3': {}
-
   '@jridgewell/gen-mapping@0.3.13':
     dependencies:
       '@jridgewell/sourcemap-codec': 1.5.5
@@ -3332,13 +3515,12 @@ snapshots:
       '@jridgewell/resolve-uri': 3.1.2
       '@jridgewell/sourcemap-codec': 1.5.5
 
-  '@noble/ciphers@1.3.0': {}
-
-  '@noble/curves@1.9.7':
+  '@napi-rs/wasm-runtime@0.2.12':
     dependencies:
-      '@noble/hashes': 1.8.0
-
-  '@noble/hashes@1.8.0': {}
+      '@emnapi/core': 1.6.0
+      '@emnapi/runtime': 1.6.0
+      '@tybys/wasm-util': 0.10.1
+    optional: true
 
   '@nodelib/fs.scandir@2.1.5':
     dependencies:
@@ -3452,7 +3634,7 @@ snapshots:
     dependencies:
       cacache: 20.0.1
       json-parse-even-better-errors: 4.0.0
-      pacote: 21.0.1
+      pacote: 21.0.3
       proc-log: 5.0.0
       semver: 7.7.2
     transitivePeerDependencies:
@@ -3614,12 +3796,18 @@ snapshots:
 
   '@socketregistry/is-unicode-supported@1.0.5': {}
 
-  '@socketregistry/packageurl-js@1.3.0': {}
+  '@socketregistry/packageurl-js@1.3.5': {}
 
-  '@socketregistry/yocto-spinner@1.0.19':
+  '@socketregistry/yocto-spinner@1.0.25':
     dependencies:
       yoctocolors-cjs: 2.1.3
 
+  '@socketsecurity/lib@3.3.0(typescript@5.9.2)':
+    optionalDependencies:
+      typescript: 5.9.2
+
+  '@standard-schema/spec@1.0.0': {}
+
   '@stroncium/procfs@1.2.1': {}
 
   '@szmarczak/http-timer@4.0.6':
@@ -3633,20 +3821,26 @@ snapshots:
       '@tufjs/canonical-json': 2.0.0
       minimatch: 9.0.5
 
+  '@tybys/wasm-util@0.10.1':
+    dependencies:
+      tslib: 2.8.1
+    optional: true
+
   '@types/cacheable-request@6.0.3':
     dependencies:
       '@types/http-cache-semantics': 4.0.4
       '@types/keyv': 3.1.4
-      '@types/node': 24.6.2
+      '@types/node': 24.9.2
       '@types/responselike': 1.0.3
 
-  '@types/chai@5.2.2':
+  '@types/chai@5.2.3':
     dependencies:
       '@types/deep-eql': 4.0.2
+      assertion-error: 2.0.1
 
   '@types/deep-eql@4.0.2': {}
 
-  '@types/emscripten@1.41.4': {}
+  '@types/emscripten@1.41.5': {}
 
   '@types/estree@1.0.8': {}
 
@@ -3656,111 +3850,113 @@ snapshots:
 
   '@types/keyv@3.1.4':
     dependencies:
-      '@types/node': 24.6.2
+      '@types/node': 24.9.2
 
-  '@types/node@24.6.2':
+  '@types/node@24.9.2':
     dependencies:
-      undici-types: 7.13.0
+      undici-types: 7.16.0
 
   '@types/responselike@1.0.3':
     dependencies:
-      '@types/node': 24.6.2
+      '@types/node': 24.9.2
 
   '@types/semver@7.7.1': {}
 
   '@types/treeify@1.0.3': {}
 
-  '@typescript-eslint/eslint-plugin@8.44.1(@typescript-eslint/parser@8.44.1(eslint@9.35.0(jiti@2.6.1))(typescript@5.7.3))(eslint@9.35.0(jiti@2.6.1))(typescript@5.7.3)':
+  '@typescript-eslint/eslint-plugin@8.46.3(@typescript-eslint/parser@8.46.3(eslint@9.35.0(jiti@2.6.1))(typescript@5.9.2))(eslint@9.35.0(jiti@2.6.1))(typescript@5.9.2)':
     dependencies:
-      '@eslint-community/regexpp': 4.12.1
-      '@typescript-eslint/parser': 8.44.1(eslint@9.35.0(jiti@2.6.1))(typescript@5.7.3)
-      '@typescript-eslint/scope-manager': 8.44.1
-      '@typescript-eslint/type-utils': 8.44.1(eslint@9.35.0(jiti@2.6.1))(typescript@5.7.3)
-      '@typescript-eslint/utils': 8.44.1(eslint@9.35.0(jiti@2.6.1))(typescript@5.7.3)
-      '@typescript-eslint/visitor-keys': 8.44.1
+      '@eslint-community/regexpp': 4.12.2
+      '@typescript-eslint/parser': 8.46.3(eslint@9.35.0(jiti@2.6.1))(typescript@5.9.2)
+      '@typescript-eslint/scope-manager': 8.46.3
+      '@typescript-eslint/type-utils': 8.46.3(eslint@9.35.0(jiti@2.6.1))(typescript@5.9.2)
+      '@typescript-eslint/utils': 8.46.3(eslint@9.35.0(jiti@2.6.1))(typescript@5.9.2)
+      '@typescript-eslint/visitor-keys': 8.46.3
       eslint: 9.35.0(jiti@2.6.1)
       graphemer: 1.4.0
       ignore: 7.0.5
       natural-compare: 1.4.0
-      ts-api-utils: 2.1.0(typescript@5.7.3)
-      typescript: 5.7.3
+      ts-api-utils: 2.1.0(typescript@5.9.2)
+      typescript: 5.9.2
     transitivePeerDependencies:
       - supports-color
 
-  '@typescript-eslint/parser@8.44.1(eslint@9.35.0(jiti@2.6.1))(typescript@5.7.3)':
+  '@typescript-eslint/parser@8.46.3(eslint@9.35.0(jiti@2.6.1))(typescript@5.9.2)':
     dependencies:
-      '@typescript-eslint/scope-manager': 8.44.1
-      '@typescript-eslint/types': 8.44.1
-      '@typescript-eslint/typescript-estree': 8.44.1(typescript@5.7.3)
-      '@typescript-eslint/visitor-keys': 8.44.1
+      '@typescript-eslint/scope-manager': 8.46.3
+      '@typescript-eslint/types': 8.46.3
+      '@typescript-eslint/typescript-estree': 8.46.3(typescript@5.9.2)
+      '@typescript-eslint/visitor-keys': 8.46.3
       debug: 4.4.3
       eslint: 9.35.0(jiti@2.6.1)
-      typescript: 5.7.3
+      typescript: 5.9.2
     transitivePeerDependencies:
       - supports-color
 
-  '@typescript-eslint/project-service@8.44.1(typescript@5.7.3)':
+  '@typescript-eslint/project-service@8.46.3(typescript@5.9.2)':
     dependencies:
-      '@typescript-eslint/tsconfig-utils': 8.44.1(typescript@5.7.3)
-      '@typescript-eslint/types': 8.44.1
+      '@typescript-eslint/tsconfig-utils': 8.46.3(typescript@5.9.2)
+      '@typescript-eslint/types': 8.46.3
       debug: 4.4.3
-      typescript: 5.7.3
+      typescript: 5.9.2
     transitivePeerDependencies:
       - supports-color
 
-  '@typescript-eslint/scope-manager@8.44.1':
+  '@typescript-eslint/scope-manager@8.46.3':
     dependencies:
-      '@typescript-eslint/types': 8.44.1
-      '@typescript-eslint/visitor-keys': 8.44.1
+      '@typescript-eslint/types': 8.46.3
+      '@typescript-eslint/visitor-keys': 8.46.3
 
-  '@typescript-eslint/tsconfig-utils@8.44.1(typescript@5.7.3)':
+  '@typescript-eslint/tsconfig-utils@8.46.3(typescript@5.9.2)':
     dependencies:
-      typescript: 5.7.3
+      typescript: 5.9.2
 
-  '@typescript-eslint/type-utils@8.44.1(eslint@9.35.0(jiti@2.6.1))(typescript@5.7.3)':
+  '@typescript-eslint/type-utils@8.46.3(eslint@9.35.0(jiti@2.6.1))(typescript@5.9.2)':
     dependencies:
-      '@typescript-eslint/types': 8.44.1
-      '@typescript-eslint/typescript-estree': 8.44.1(typescript@5.7.3)
-      '@typescript-eslint/utils': 8.44.1(eslint@9.35.0(jiti@2.6.1))(typescript@5.7.3)
+      '@typescript-eslint/types': 8.46.3
+      '@typescript-eslint/typescript-estree': 8.46.3(typescript@5.9.2)
+      '@typescript-eslint/utils': 8.46.3(eslint@9.35.0(jiti@2.6.1))(typescript@5.9.2)
       debug: 4.4.3
       eslint: 9.35.0(jiti@2.6.1)
-      ts-api-utils: 2.1.0(typescript@5.7.3)
-      typescript: 5.7.3
+      ts-api-utils: 2.1.0(typescript@5.9.2)
+      typescript: 5.9.2
     transitivePeerDependencies:
       - supports-color
 
-  '@typescript-eslint/types@8.44.1': {}
+  '@typescript-eslint/types@8.46.2': {}
 
-  '@typescript-eslint/typescript-estree@8.44.1(typescript@5.7.3)':
+  '@typescript-eslint/types@8.46.3': {}
+
+  '@typescript-eslint/typescript-estree@8.46.3(typescript@5.9.2)':
     dependencies:
-      '@typescript-eslint/project-service': 8.44.1(typescript@5.7.3)
-      '@typescript-eslint/tsconfig-utils': 8.44.1(typescript@5.7.3)
-      '@typescript-eslint/types': 8.44.1
-      '@typescript-eslint/visitor-keys': 8.44.1
+      '@typescript-eslint/project-service': 8.46.3(typescript@5.9.2)
+      '@typescript-eslint/tsconfig-utils': 8.46.3(typescript@5.9.2)
+      '@typescript-eslint/types': 8.46.3
+      '@typescript-eslint/visitor-keys': 8.46.3
       debug: 4.4.3
       fast-glob: 3.3.3
       is-glob: 4.0.3
       minimatch: 9.0.5
       semver: 7.7.2
-      ts-api-utils: 2.1.0(typescript@5.7.3)
-      typescript: 5.7.3
+      ts-api-utils: 2.1.0(typescript@5.9.2)
+      typescript: 5.9.2
     transitivePeerDependencies:
       - supports-color
 
-  '@typescript-eslint/utils@8.44.1(eslint@9.35.0(jiti@2.6.1))(typescript@5.7.3)':
+  '@typescript-eslint/utils@8.46.3(eslint@9.35.0(jiti@2.6.1))(typescript@5.9.2)':
     dependencies:
       '@eslint-community/eslint-utils': 4.9.0(eslint@9.35.0(jiti@2.6.1))
-      '@typescript-eslint/scope-manager': 8.44.1
-      '@typescript-eslint/types': 8.44.1
-      '@typescript-eslint/typescript-estree': 8.44.1(typescript@5.7.3)
+      '@typescript-eslint/scope-manager': 8.46.3
+      '@typescript-eslint/types': 8.46.3
+      '@typescript-eslint/typescript-estree': 8.46.3(typescript@5.9.2)
       eslint: 9.35.0(jiti@2.6.1)
-      typescript: 5.7.3
+      typescript: 5.9.2
     transitivePeerDependencies:
       - supports-color
 
-  '@typescript-eslint/visitor-keys@8.44.1':
+  '@typescript-eslint/visitor-keys@8.46.3':
     dependencies:
-      '@typescript-eslint/types': 8.44.1
+      '@typescript-eslint/types': 8.46.3
       eslint-visitor-keys: 4.2.1
 
   '@typescript/native-preview-darwin-arm64@7.0.0-dev.20250920.1':
@@ -3794,85 +3990,139 @@ snapshots:
       '@typescript/native-preview-win32-arm64': 7.0.0-dev.20250920.1
       '@typescript/native-preview-win32-x64': 7.0.0-dev.20250920.1
 
-  '@vitest/coverage-v8@3.2.4(vitest@3.2.4)':
+  '@unrs/resolver-binding-android-arm-eabi@1.11.1':
+    optional: true
+
+  '@unrs/resolver-binding-android-arm64@1.11.1':
+    optional: true
+
+  '@unrs/resolver-binding-darwin-arm64@1.11.1':
+    optional: true
+
+  '@unrs/resolver-binding-darwin-x64@1.11.1':
+    optional: true
+
+  '@unrs/resolver-binding-freebsd-x64@1.11.1':
+    optional: true
+
+  '@unrs/resolver-binding-linux-arm-gnueabihf@1.11.1':
+    optional: true
+
+  '@unrs/resolver-binding-linux-arm-musleabihf@1.11.1':
+    optional: true
+
+  '@unrs/resolver-binding-linux-arm64-gnu@1.11.1':
+    optional: true
+
+  '@unrs/resolver-binding-linux-arm64-musl@1.11.1':
+    optional: true
+
+  '@unrs/resolver-binding-linux-ppc64-gnu@1.11.1':
+    optional: true
+
+  '@unrs/resolver-binding-linux-riscv64-gnu@1.11.1':
+    optional: true
+
+  '@unrs/resolver-binding-linux-riscv64-musl@1.11.1':
+    optional: true
+
+  '@unrs/resolver-binding-linux-s390x-gnu@1.11.1':
+    optional: true
+
+  '@unrs/resolver-binding-linux-x64-gnu@1.11.1':
+    optional: true
+
+  '@unrs/resolver-binding-linux-x64-musl@1.11.1':
+    optional: true
+
+  '@unrs/resolver-binding-wasm32-wasi@1.11.1':
+    dependencies:
+      '@napi-rs/wasm-runtime': 0.2.12
+    optional: true
+
+  '@unrs/resolver-binding-win32-arm64-msvc@1.11.1':
+    optional: true
+
+  '@unrs/resolver-binding-win32-ia32-msvc@1.11.1':
+    optional: true
+
+  '@unrs/resolver-binding-win32-x64-msvc@1.11.1':
+    optional: true
+
+  '@vitest/coverage-v8@4.0.3(vitest@4.0.3)':
     dependencies:
-      '@ampproject/remapping': 2.3.0
       '@bcoe/v8-coverage': 1.0.2
+      '@vitest/utils': 4.0.3
       ast-v8-to-istanbul: 0.3.7
       debug: 4.4.3
       istanbul-lib-coverage: 3.2.2
       istanbul-lib-report: 3.0.1
       istanbul-lib-source-maps: 5.0.6
       istanbul-reports: 3.2.0
-      magic-string: 0.30.17
       magicast: 0.3.5
       std-env: 3.10.0
-      test-exclude: 7.0.1
-      tinyrainbow: 2.0.0
-      vitest: 3.2.4(@types/node@24.6.2)(@vitest/ui@3.2.4)(jiti@2.6.1)(yaml@2.8.1)
+      tinyrainbow: 3.0.3
+      vitest: 4.0.3(@types/node@24.9.2)(@vitest/ui@4.0.3)(jiti@2.6.1)(yaml@2.8.1)
     transitivePeerDependencies:
       - supports-color
 
-  '@vitest/expect@3.2.4':
+  '@vitest/expect@4.0.3':
     dependencies:
-      '@types/chai': 5.2.2
-      '@vitest/spy': 3.2.4
-      '@vitest/utils': 3.2.4
-      chai: 5.3.3
-      tinyrainbow: 2.0.0
+      '@standard-schema/spec': 1.0.0
+      '@types/chai': 5.2.3
+      '@vitest/spy': 4.0.3
+      '@vitest/utils': 4.0.3
+      chai: 6.2.0
+      tinyrainbow: 3.0.3
 
-  '@vitest/mocker@3.2.4(vite@7.1.11(@types/node@24.6.2)(jiti@2.6.1)(yaml@2.8.1))':
+  '@vitest/mocker@4.0.3(vite@7.1.12(@types/node@24.9.2)(jiti@2.6.1)(yaml@2.8.1))':
     dependencies:
-      '@vitest/spy': 3.2.4
+      '@vitest/spy': 4.0.3
       estree-walker: 3.0.3
-      magic-string: 0.30.17
+      magic-string: 0.30.21
     optionalDependencies:
-      vite: 7.1.11(@types/node@24.6.2)(jiti@2.6.1)(yaml@2.8.1)
+      vite: 7.1.12(@types/node@24.9.2)(jiti@2.6.1)(yaml@2.8.1)
 
-  '@vitest/pretty-format@3.2.4':
+  '@vitest/pretty-format@4.0.3':
     dependencies:
-      tinyrainbow: 2.0.0
+      tinyrainbow: 3.0.3
 
-  '@vitest/runner@3.2.4':
+  '@vitest/runner@4.0.3':
     dependencies:
-      '@vitest/utils': 3.2.4
+      '@vitest/utils': 4.0.3
       pathe: 2.0.3
-      strip-literal: 3.1.0
 
-  '@vitest/snapshot@3.2.4':
+  '@vitest/snapshot@4.0.3':
     dependencies:
-      '@vitest/pretty-format': 3.2.4
-      magic-string: 0.30.17
+      '@vitest/pretty-format': 4.0.3
+      magic-string: 0.30.21
       pathe: 2.0.3
 
-  '@vitest/spy@3.2.4':
-    dependencies:
-      tinyspy: 4.0.4
+  '@vitest/spy@4.0.3': {}
 
-  '@vitest/ui@3.2.4(vitest@3.2.4)':
+  '@vitest/ui@4.0.3(vitest@4.0.3)':
     dependencies:
-      '@vitest/utils': 3.2.4
+      '@vitest/utils': 4.0.3
       fflate: 0.8.2
       flatted: 3.3.3
       pathe: 2.0.3
       sirv: 3.0.2
       tinyglobby: 0.2.15
-      tinyrainbow: 2.0.0
-      vitest: 3.2.4(@types/node@24.6.2)(@vitest/ui@3.2.4)(jiti@2.6.1)(yaml@2.8.1)
+      tinyrainbow: 3.0.3
+      vitest: 4.0.3(@types/node@24.9.2)(@vitest/ui@4.0.3)(jiti@2.6.1)(yaml@2.8.1)
 
-  '@vitest/utils@3.2.4':
+  '@vitest/utils@4.0.3':
     dependencies:
-      '@vitest/pretty-format': 3.2.4
-      loupe: 3.2.1
-      tinyrainbow: 2.0.0
+      '@vitest/pretty-format': 4.0.3
+      tinyrainbow: 3.0.3
 
   '@yarnpkg/core@4.4.4(typanion@3.14.0)':
     dependencies:
       '@arcanis/slice-ansi': 1.1.1
       '@types/semver': 7.7.1
       '@types/treeify': 1.0.3
-      '@yarnpkg/fslib': 3.1.3
-      '@yarnpkg/libzip': 3.2.2(@yarnpkg/fslib@3.1.3)
+      '@yarnpkg/fslib': 3.1.4
+      '@yarnpkg/libzip': 3.2.2(@yarnpkg/fslib@3.1.4)
       '@yarnpkg/parsers': 3.0.3
       '@yarnpkg/shell': 4.1.3(typanion@3.14.0)
       camelcase: 5.3.1
@@ -3882,7 +4132,7 @@ snapshots:
       cross-spawn: 7.0.6
       diff: 5.2.0
       dotenv: 16.6.1
-      es-toolkit: 1.40.0
+      es-toolkit: 1.41.0
       fast-glob: 3.3.3
       got: 11.8.6
       hpagent: 1.2.0
@@ -3901,14 +4151,14 @@ snapshots:
     dependencies:
       '@yarnpkg/core': 4.4.4(typanion@3.14.0)
 
-  '@yarnpkg/fslib@3.1.3':
+  '@yarnpkg/fslib@3.1.4':
     dependencies:
       tslib: 2.8.1
 
-  '@yarnpkg/libzip@3.2.2(@yarnpkg/fslib@3.1.3)':
+  '@yarnpkg/libzip@3.2.2(@yarnpkg/fslib@3.1.4)':
     dependencies:
-      '@types/emscripten': 1.41.4
-      '@yarnpkg/fslib': 3.1.3
+      '@types/emscripten': 1.41.5
+      '@yarnpkg/fslib': 3.1.4
       tslib: 2.8.1
 
   '@yarnpkg/parsers@3.0.3':
@@ -3918,7 +4168,7 @@ snapshots:
 
   '@yarnpkg/shell@4.1.3(typanion@3.14.0)':
     dependencies:
-      '@yarnpkg/fslib': 3.1.3
+      '@yarnpkg/fslib': 3.1.4
       '@yarnpkg/parsers': 3.0.3
       chalk: 4.1.2
       clipanion: 4.0.0-rc.4(typanion@3.14.0)
@@ -3982,7 +4232,7 @@ snapshots:
 
   balanced-match@1.0.2: {}
 
-  baseline-browser-mapping@2.8.18: {}
+  baseline-browser-mapping@2.8.19: {}
 
   bin-links@5.0.0:
     dependencies:
@@ -4005,13 +4255,15 @@ snapshots:
     dependencies:
       fill-range: 7.1.1
 
-  browserslist@4.26.3:
+  browserslist@4.27.0:
     dependencies:
-      baseline-browser-mapping: 2.8.18
+      baseline-browser-mapping: 2.8.19
       caniuse-lite: 1.0.30001751
-      electron-to-chromium: 1.5.237
-      node-releases: 2.0.25
-      update-browserslist-db: 1.1.3(browserslist@4.26.3)
+      electron-to-chromium: 1.5.239
+      node-releases: 2.0.26
+      update-browserslist-db: 1.1.4(browserslist@4.27.0)
+
+  builtin-modules@5.0.0: {}
 
   cac@6.7.14: {}
 
@@ -4062,13 +4314,7 @@ snapshots:
 
   caniuse-lite@1.0.30001751: {}
 
-  chai@5.3.3:
-    dependencies:
-      assertion-error: 2.0.1
-      check-error: 2.1.1
-      deep-eql: 5.0.2
-      loupe: 3.2.1
-      pathval: 2.0.1
+  chai@6.2.0: {}
 
   chalk@4.1.2:
     dependencies:
@@ -4077,7 +4323,7 @@ snapshots:
 
   chalk@5.3.0: {}
 
-  check-error@2.1.1: {}
+  change-case@5.4.4: {}
 
   chownr@2.0.0: {}
 
@@ -4085,6 +4331,10 @@ snapshots:
 
   ci-info@4.3.1: {}
 
+  clean-regexp@1.0.0:
+    dependencies:
+      escape-string-regexp: 1.0.5
+
   cli-cursor@5.0.0:
     dependencies:
       restore-cursor: 5.1.0
@@ -4114,16 +4364,20 @@ snapshots:
 
   colorette@2.0.20: {}
 
-  commander@11.1.0: {}
-
   commander@12.1.0: {}
 
+  comment-parser@1.4.1: {}
+
   common-ancestor-path@1.0.1: {}
 
   concat-map@0.0.1: {}
 
   convert-source-map@2.0.0: {}
 
+  core-js-compat@3.46.0:
+    dependencies:
+      browserslist: 4.27.0
+
   cross-spawn@7.0.6:
     dependencies:
       path-key: 3.1.1
@@ -4140,8 +4394,6 @@ snapshots:
     dependencies:
       mimic-response: 3.1.0
 
-  deep-eql@5.0.2: {}
-
   deep-is@0.1.4: {}
 
   defer-to-connect@2.0.1: {}
@@ -4169,18 +4421,9 @@ snapshots:
 
   dotenv@16.6.1: {}
 
-  dotenv@17.2.3: {}
-
   eastasianwidth@0.2.0: {}
 
-  eciesjs@0.4.16:
-    dependencies:
-      '@ecies/ciphers': 0.2.4(@noble/ciphers@1.3.0)
-      '@noble/ciphers': 1.3.0
-      '@noble/curves': 1.9.7
-      '@noble/hashes': 1.8.0
-
-  electron-to-chromium@1.5.237: {}
+  electron-to-chromium@1.5.239: {}
 
   emoji-regex@10.6.0: {}
 
@@ -4210,7 +4453,7 @@ snapshots:
 
   es-module-lexer@1.7.0: {}
 
-  es-toolkit@1.40.0: {}
+  es-toolkit@1.41.0: {}
 
   esbuild@0.25.11:
     optionalDependencies:
@@ -4243,6 +4486,8 @@ snapshots:
 
   escalade@3.2.0: {}
 
+  escape-string-regexp@1.0.5: {}
+
   escape-string-regexp@4.0.0: {}
 
   eslint-compat-utils@0.5.1(eslint@9.35.0(jiti@2.6.1)):
@@ -4250,28 +4495,94 @@ snapshots:
       eslint: 9.35.0(jiti@2.6.1)
       semver: 7.7.2
 
+  eslint-import-context@0.1.9(unrs-resolver@1.11.1):
+    dependencies:
+      get-tsconfig: 4.13.0
+      stable-hash-x: 0.2.0
+    optionalDependencies:
+      unrs-resolver: 1.11.1
+
+  eslint-import-resolver-typescript@4.4.4(eslint-plugin-import-x@4.16.1(@typescript-eslint/utils@8.46.3(eslint@9.35.0(jiti@2.6.1))(typescript@5.9.2))(eslint@9.35.0(jiti@2.6.1)))(eslint@9.35.0(jiti@2.6.1)):
+    dependencies:
+      debug: 4.4.3
+      eslint: 9.35.0(jiti@2.6.1)
+      eslint-import-context: 0.1.9(unrs-resolver@1.11.1)
+      get-tsconfig: 4.13.0
+      is-bun-module: 2.0.0
+      stable-hash-x: 0.2.0
+      tinyglobby: 0.2.15
+      unrs-resolver: 1.11.1
+    optionalDependencies:
+      eslint-plugin-import-x: 4.16.1(@typescript-eslint/utils@8.46.3(eslint@9.35.0(jiti@2.6.1))(typescript@5.9.2))(eslint@9.35.0(jiti@2.6.1))
+    transitivePeerDependencies:
+      - supports-color
+
   eslint-plugin-es-x@7.8.0(eslint@9.35.0(jiti@2.6.1)):
     dependencies:
       '@eslint-community/eslint-utils': 4.9.0(eslint@9.35.0(jiti@2.6.1))
-      '@eslint-community/regexpp': 4.12.1
+      '@eslint-community/regexpp': 4.12.2
       eslint: 9.35.0(jiti@2.6.1)
       eslint-compat-utils: 0.5.1(eslint@9.35.0(jiti@2.6.1))
 
-  eslint-plugin-n@17.23.1(eslint@9.35.0(jiti@2.6.1))(typescript@5.7.3):
+  eslint-plugin-import-x@4.16.1(@typescript-eslint/utils@8.46.3(eslint@9.35.0(jiti@2.6.1))(typescript@5.9.2))(eslint@9.35.0(jiti@2.6.1)):
+    dependencies:
+      '@typescript-eslint/types': 8.46.2
+      comment-parser: 1.4.1
+      debug: 4.4.3
+      eslint: 9.35.0(jiti@2.6.1)
+      eslint-import-context: 0.1.9(unrs-resolver@1.11.1)
+      is-glob: 4.0.3
+      minimatch: 10.0.3
+      semver: 7.7.2
+      stable-hash-x: 0.2.0
+      unrs-resolver: 1.11.1
+    optionalDependencies:
+      '@typescript-eslint/utils': 8.46.3(eslint@9.35.0(jiti@2.6.1))(typescript@5.9.2)
+    transitivePeerDependencies:
+      - supports-color
+
+  eslint-plugin-n@17.23.1(eslint@9.35.0(jiti@2.6.1))(typescript@5.9.2):
     dependencies:
       '@eslint-community/eslint-utils': 4.9.0(eslint@9.35.0(jiti@2.6.1))
       enhanced-resolve: 5.18.3
       eslint: 9.35.0(jiti@2.6.1)
       eslint-plugin-es-x: 7.8.0(eslint@9.35.0(jiti@2.6.1))
-      get-tsconfig: 4.12.0
+      get-tsconfig: 4.13.0
       globals: 15.15.0
       globrex: 0.1.2
       ignore: 5.3.2
       semver: 7.7.2
-      ts-declaration-location: 1.0.7(typescript@5.7.3)
+      ts-declaration-location: 1.0.7(typescript@5.9.2)
     transitivePeerDependencies:
       - typescript
 
+  eslint-plugin-sort-destructure-keys@2.0.0(eslint@9.35.0(jiti@2.6.1)):
+    dependencies:
+      eslint: 9.35.0(jiti@2.6.1)
+      natural-compare-lite: 1.4.0
+
+  eslint-plugin-unicorn@61.0.2(eslint@9.35.0(jiti@2.6.1)):
+    dependencies:
+      '@babel/helper-validator-identifier': 7.27.1
+      '@eslint-community/eslint-utils': 4.9.0(eslint@9.35.0(jiti@2.6.1))
+      '@eslint/plugin-kit': 0.3.5
+      change-case: 5.4.4
+      ci-info: 4.3.1
+      clean-regexp: 1.0.0
+      core-js-compat: 3.46.0
+      eslint: 9.35.0(jiti@2.6.1)
+      esquery: 1.6.0
+      find-up-simple: 1.0.1
+      globals: 16.4.0
+      indent-string: 5.0.0
+      is-builtin-module: 5.0.0
+      jsesc: 3.1.0
+      pluralize: 8.0.0
+      regexp-tree: 0.1.27
+      regjsparser: 0.12.0
+      semver: 7.7.2
+      strip-indent: 4.1.1
+
   eslint-scope@8.4.0:
     dependencies:
       esrecurse: 4.3.0
@@ -4284,7 +4595,7 @@ snapshots:
   eslint@9.35.0(jiti@2.6.1):
     dependencies:
       '@eslint-community/eslint-utils': 4.9.0(eslint@9.35.0(jiti@2.6.1))
-      '@eslint-community/regexpp': 4.12.1
+      '@eslint-community/regexpp': 4.12.2
       '@eslint/config-array': 0.21.1
       '@eslint/config-helpers': 0.3.1
       '@eslint/core': 0.15.2
@@ -4361,18 +4672,6 @@ snapshots:
       signal-exit: 3.0.7
       strip-final-newline: 2.0.0
 
-  execa@5.1.1:
-    dependencies:
-      cross-spawn: 7.0.6
-      get-stream: 6.0.1
-      human-signals: 2.1.0
-      is-stream: 2.0.1
-      merge-stream: 2.0.0
-      npm-run-path: 4.0.1
-      onetime: 5.1.2
-      signal-exit: 3.0.7
-      strip-final-newline: 2.0.0
-
   execa@8.0.1:
     dependencies:
       cross-spawn: 7.0.6
@@ -4465,11 +4764,9 @@ snapshots:
     dependencies:
       pump: 3.0.3
 
-  get-stream@6.0.1: {}
-
   get-stream@8.0.1: {}
 
-  get-tsconfig@4.12.0:
+  get-tsconfig@4.13.0:
     dependencies:
       resolve-pkg-maps: 1.0.0
 
@@ -4571,8 +4868,6 @@ snapshots:
     transitivePeerDependencies:
       - supports-color
 
-  human-signals@2.1.0: {}
-
   human-signals@5.0.0: {}
 
   husky@9.1.7: {}
@@ -4584,7 +4879,7 @@ snapshots:
 
   ignore-walk@8.0.0:
     dependencies:
-      minimatch: 10.0.3
+      minimatch: 10.1.1
 
   ignore@5.3.2: {}
 
@@ -4597,10 +4892,20 @@ snapshots:
 
   imurmurhash@0.1.4: {}
 
+  indent-string@5.0.0: {}
+
   ini@5.0.0: {}
 
   ip-address@10.0.1: {}
 
+  is-builtin-module@5.0.0:
+    dependencies:
+      builtin-modules: 5.0.0
+
+  is-bun-module@2.0.0:
+    dependencies:
+      semver: 7.7.2
+
   is-extglob@2.1.1: {}
 
   is-fullwidth-code-point@3.0.0: {}
@@ -4675,6 +4980,8 @@ snapshots:
     dependencies:
       argparse: 2.0.1
 
+  jsesc@3.0.2: {}
+
   jsesc@3.1.0: {}
 
   json-buffer@3.0.1: {}
@@ -4704,6 +5011,23 @@ snapshots:
       prelude-ls: 1.2.1
       type-check: 0.4.0
 
+  libnpmexec@10.1.8:
+    dependencies:
+      '@npmcli/arborist': 9.1.6
+      '@npmcli/package-json': 7.0.0
+      '@npmcli/run-script': 10.0.0
+      ci-info: 4.3.1
+      npm-package-arg: 13.0.0
+      pacote: 21.0.3
+      proc-log: 5.0.0
+      promise-retry: 2.0.1
+      read: 4.1.0
+      semver: 7.7.2
+      signal-exit: 4.1.0
+      walk-up-path: 4.0.0
+    transitivePeerDependencies:
+      - supports-color
+
   libnpmpack@9.0.9:
     dependencies:
       '@npmcli/arborist': 9.1.6
@@ -4753,8 +5077,6 @@ snapshots:
       strip-ansi: 7.1.2
       wrap-ansi: 9.0.2
 
-  loupe@3.2.1: {}
-
   lowercase-keys@2.0.0: {}
 
   lru-cache@10.4.3: {}
@@ -4769,6 +5091,10 @@ snapshots:
     dependencies:
       '@jridgewell/sourcemap-codec': 1.5.5
 
+  magic-string@0.30.21:
+    dependencies:
+      '@jridgewell/sourcemap-codec': 1.5.5
+
   magicast@0.3.5:
     dependencies:
       '@babel/parser': 7.28.4
@@ -4811,8 +5137,6 @@ snapshots:
     transitivePeerDependencies:
       - supports-color
 
-  memorystream@0.3.1: {}
-
   meow@13.2.0: {}
 
   merge-stream@2.0.0: {}
@@ -4838,6 +5162,10 @@ snapshots:
     dependencies:
       '@isaacs/brace-expansion': 5.0.0
 
+  minimatch@10.1.1:
+    dependencies:
+      '@isaacs/brace-expansion': 5.0.0
+
   minimatch@3.1.2:
     dependencies:
       brace-expansion: 1.1.12
@@ -4909,6 +5237,10 @@ snapshots:
 
   nanoid@3.3.11: {}
 
+  napi-postinstall@0.3.4: {}
+
+  natural-compare-lite@1.4.0: {}
+
   natural-compare@1.4.0: {}
 
   negotiator@1.0.0: {}
@@ -4930,7 +5262,7 @@ snapshots:
     transitivePeerDependencies:
       - supports-color
 
-  node-releases@2.0.25: {}
+  node-releases@2.0.26: {}
 
   nopt@8.1.0:
     dependencies:
@@ -5002,31 +5334,14 @@ snapshots:
     transitivePeerDependencies:
       - supports-color
 
-  npm-run-all2@8.0.4:
-    dependencies:
-      ansi-styles: 6.2.3
-      cross-spawn: 7.0.6
-      memorystream: 0.3.1
-      picomatch: 4.0.3
-      pidtree: 0.6.0
-      read-package-json-fast: 4.0.0
-      shell-quote: 1.8.3
-      which: 5.0.0
-
   npm-run-path@3.1.0:
     dependencies:
       path-key: 3.1.1
 
-  npm-run-path@4.0.1:
-    dependencies:
-      path-key: 3.1.1
-
   npm-run-path@5.3.0:
     dependencies:
       path-key: 4.0.0
 
-  object-treeify@1.1.33: {}
-
   ofetch@1.4.1:
     dependencies:
       destr: 2.0.5
@@ -5160,8 +5475,6 @@ snapshots:
 
   pathe@2.0.3: {}
 
-  pathval@2.0.1: {}
-
   picocolors@1.1.1: {}
 
   picomatch@2.3.1: {}
@@ -5178,6 +5491,8 @@ snapshots:
 
   pinkie@2.0.4: {}
 
+  pluralize@8.0.0: {}
+
   pnpm-workspace-yaml@1.3.0:
     dependencies:
       yaml: 2.8.1
@@ -5225,10 +5540,15 @@ snapshots:
 
   read-cmd-shim@5.0.0: {}
 
-  read-package-json-fast@4.0.0:
+  read@4.1.0:
     dependencies:
-      json-parse-even-better-errors: 4.0.0
-      npm-normalize-package-bin: 4.0.0
+      mute-stream: 2.0.0
+
+  regexp-tree@0.1.27: {}
+
+  regjsparser@0.12.0:
+    dependencies:
+      jsesc: 3.0.2
 
   resolve-alpn@1.2.1: {}
 
@@ -5296,8 +5616,6 @@ snapshots:
 
   shebang-regex@3.0.0: {}
 
-  shell-quote@1.8.3: {}
-
   siginfo@2.0.0: {}
 
   signal-exit@3.0.7: {}
@@ -5375,6 +5693,8 @@ snapshots:
     dependencies:
       minipass: 7.1.2
 
+  stable-hash-x@0.2.0: {}
+
   stackback@0.0.2: {}
 
   std-env@3.10.0: {}
@@ -5413,11 +5733,9 @@ snapshots:
 
   strip-final-newline@3.0.0: {}
 
-  strip-json-comments@3.1.1: {}
+  strip-indent@4.1.1: {}
 
-  strip-literal@3.1.0:
-    dependencies:
-      js-tokens: 9.0.1
+  strip-json-comments@3.1.1: {}
 
   supports-color@7.2.0:
     dependencies:
@@ -5457,12 +5775,6 @@ snapshots:
       unconfig: 7.3.3
       yaml: 2.8.1
 
-  test-exclude@7.0.1:
-    dependencies:
-      '@istanbuljs/schema': 0.1.3
-      glob: 10.4.5
-      minimatch: 9.0.5
-
   tinybench@2.9.0: {}
 
   tinyexec@0.3.2: {}
@@ -5476,11 +5788,7 @@ snapshots:
 
   tinylogic@2.0.0: {}
 
-  tinypool@1.1.1: {}
-
-  tinyrainbow@2.0.0: {}
-
-  tinyspy@4.0.4: {}
+  tinyrainbow@3.0.3: {}
 
   to-regex-range@5.0.1:
     dependencies:
@@ -5502,27 +5810,27 @@ snapshots:
 
   treeverse@3.0.0: {}
 
-  ts-api-utils@2.1.0(typescript@5.7.3):
+  ts-api-utils@2.1.0(typescript@5.9.2):
     dependencies:
-      typescript: 5.7.3
+      typescript: 5.9.2
 
-  ts-declaration-location@1.0.7(typescript@5.7.3):
+  ts-declaration-location@1.0.7(typescript@5.9.2):
     dependencies:
       picomatch: 4.0.3
-      typescript: 5.7.3
+      typescript: 5.9.2
 
-  tsconfck@3.1.6(typescript@5.7.3):
+  tsconfck@3.1.6(typescript@5.9.2):
     optionalDependencies:
-      typescript: 5.7.3
+      typescript: 5.9.2
 
   tslib@1.14.1: {}
 
   tslib@2.8.1: {}
 
-  tsutils@3.21.0(typescript@5.7.3):
+  tsutils@3.21.0(typescript@5.9.2):
     dependencies:
       tslib: 1.14.1
-      typescript: 5.7.3
+      typescript: 5.9.2
 
   tuf-js@4.0.0:
     dependencies:
@@ -5538,37 +5846,37 @@ snapshots:
     dependencies:
       prelude-ls: 1.2.1
 
-  type-coverage-core@2.29.7(typescript@5.7.3):
+  type-coverage-core@2.29.7(typescript@5.9.2):
     dependencies:
       fast-glob: 3.3.3
       minimatch: 10.0.3
       normalize-path: 3.0.0
       tslib: 2.8.1
-      tsutils: 3.21.0(typescript@5.7.3)
-      typescript: 5.7.3
+      tsutils: 3.21.0(typescript@5.9.2)
+      typescript: 5.9.2
 
-  type-coverage@2.29.7(typescript@5.7.3):
+  type-coverage@2.29.7(typescript@5.9.2):
     dependencies:
       chalk: 4.1.2
       minimist: 1.2.8
-      type-coverage-core: 2.29.7(typescript@5.7.3)
+      type-coverage-core: 2.29.7(typescript@5.9.2)
     transitivePeerDependencies:
       - typescript
 
   type-fest@0.21.3: {}
 
-  typescript-eslint@8.44.1(eslint@9.35.0(jiti@2.6.1))(typescript@5.7.3):
+  typescript-eslint@8.46.3(eslint@9.35.0(jiti@2.6.1))(typescript@5.9.2):
     dependencies:
-      '@typescript-eslint/eslint-plugin': 8.44.1(@typescript-eslint/parser@8.44.1(eslint@9.35.0(jiti@2.6.1))(typescript@5.7.3))(eslint@9.35.0(jiti@2.6.1))(typescript@5.7.3)
-      '@typescript-eslint/parser': 8.44.1(eslint@9.35.0(jiti@2.6.1))(typescript@5.7.3)
-      '@typescript-eslint/typescript-estree': 8.44.1(typescript@5.7.3)
-      '@typescript-eslint/utils': 8.44.1(eslint@9.35.0(jiti@2.6.1))(typescript@5.7.3)
+      '@typescript-eslint/eslint-plugin': 8.46.3(@typescript-eslint/parser@8.46.3(eslint@9.35.0(jiti@2.6.1))(typescript@5.9.2))(eslint@9.35.0(jiti@2.6.1))(typescript@5.9.2)
+      '@typescript-eslint/parser': 8.46.3(eslint@9.35.0(jiti@2.6.1))(typescript@5.9.2)
+      '@typescript-eslint/typescript-estree': 8.46.3(typescript@5.9.2)
+      '@typescript-eslint/utils': 8.46.3(eslint@9.35.0(jiti@2.6.1))(typescript@5.9.2)
       eslint: 9.35.0(jiti@2.6.1)
-      typescript: 5.7.3
+      typescript: 5.9.2
     transitivePeerDependencies:
       - supports-color
 
-  typescript@5.7.3: {}
+  typescript@5.9.2: {}
 
   ufo@1.6.1: {}
 
@@ -5579,7 +5887,7 @@ snapshots:
       jiti: 2.6.1
       quansync: 0.2.11
 
-  undici-types@7.13.0: {}
+  undici-types@7.16.0: {}
 
   unicorn-magic@0.3.0: {}
 
@@ -5591,9 +5899,33 @@ snapshots:
     dependencies:
       imurmurhash: 0.1.4
 
-  update-browserslist-db@1.1.3(browserslist@4.26.3):
+  unrs-resolver@1.11.1:
     dependencies:
-      browserslist: 4.26.3
+      napi-postinstall: 0.3.4
+    optionalDependencies:
+      '@unrs/resolver-binding-android-arm-eabi': 1.11.1
+      '@unrs/resolver-binding-android-arm64': 1.11.1
+      '@unrs/resolver-binding-darwin-arm64': 1.11.1
+      '@unrs/resolver-binding-darwin-x64': 1.11.1
+      '@unrs/resolver-binding-freebsd-x64': 1.11.1
+      '@unrs/resolver-binding-linux-arm-gnueabihf': 1.11.1
+      '@unrs/resolver-binding-linux-arm-musleabihf': 1.11.1
+      '@unrs/resolver-binding-linux-arm64-gnu': 1.11.1
+      '@unrs/resolver-binding-linux-arm64-musl': 1.11.1
+      '@unrs/resolver-binding-linux-ppc64-gnu': 1.11.1
+      '@unrs/resolver-binding-linux-riscv64-gnu': 1.11.1
+      '@unrs/resolver-binding-linux-riscv64-musl': 1.11.1
+      '@unrs/resolver-binding-linux-s390x-gnu': 1.11.1
+      '@unrs/resolver-binding-linux-x64-gnu': 1.11.1
+      '@unrs/resolver-binding-linux-x64-musl': 1.11.1
+      '@unrs/resolver-binding-wasm32-wasi': 1.11.1
+      '@unrs/resolver-binding-win32-arm64-msvc': 1.11.1
+      '@unrs/resolver-binding-win32-ia32-msvc': 1.11.1
+      '@unrs/resolver-binding-win32-x64-msvc': 1.11.1
+
+  update-browserslist-db@1.1.4(browserslist@4.27.0):
+    dependencies:
+      browserslist: 4.27.0
       escalade: 3.2.0
       picocolors: 1.1.1
 
@@ -5614,39 +5946,18 @@ snapshots:
 
   validate-npm-package-name@6.0.2: {}
 
-  vite-node@3.2.4(@types/node@24.6.2)(jiti@2.6.1)(yaml@2.8.1):
-    dependencies:
-      cac: 6.7.14
-      debug: 4.4.3
-      es-module-lexer: 1.7.0
-      pathe: 2.0.3
-      vite: 7.1.11(@types/node@24.6.2)(jiti@2.6.1)(yaml@2.8.1)
-    transitivePeerDependencies:
-      - '@types/node'
-      - jiti
-      - less
-      - lightningcss
-      - sass
-      - sass-embedded
-      - stylus
-      - sugarss
-      - supports-color
-      - terser
-      - tsx
-      - yaml
-
-  vite-tsconfig-paths@5.1.4(typescript@5.7.3)(vite@7.1.11(@types/node@24.6.2)(jiti@2.6.1)(yaml@2.8.1)):
+  vite-tsconfig-paths@5.1.4(typescript@5.9.2)(vite@7.1.12(@types/node@24.9.2)(jiti@2.6.1)(yaml@2.8.1)):
     dependencies:
       debug: 4.4.3
       globrex: 0.1.2
-      tsconfck: 3.1.6(typescript@5.7.3)
+      tsconfck: 3.1.6(typescript@5.9.2)
     optionalDependencies:
-      vite: 7.1.11(@types/node@24.6.2)(jiti@2.6.1)(yaml@2.8.1)
+      vite: 7.1.12(@types/node@24.9.2)(jiti@2.6.1)(yaml@2.8.1)
     transitivePeerDependencies:
       - supports-color
       - typescript
 
-  vite@7.1.11(@types/node@24.6.2)(jiti@2.6.1)(yaml@2.8.1):
+  vite@7.1.12(@types/node@24.9.2)(jiti@2.6.1)(yaml@2.8.1):
     dependencies:
       esbuild: 0.25.11
       fdir: 6.5.0(picomatch@4.0.3)
@@ -5655,39 +5966,36 @@ snapshots:
       rollup: 4.52.5
       tinyglobby: 0.2.15
     optionalDependencies:
-      '@types/node': 24.6.2
+      '@types/node': 24.9.2
       fsevents: 2.3.3
       jiti: 2.6.1
       yaml: 2.8.1
 
-  vitest@3.2.4(@types/node@24.6.2)(@vitest/ui@3.2.4)(jiti@2.6.1)(yaml@2.8.1):
-    dependencies:
-      '@types/chai': 5.2.2
-      '@vitest/expect': 3.2.4
-      '@vitest/mocker': 3.2.4(vite@7.1.11(@types/node@24.6.2)(jiti@2.6.1)(yaml@2.8.1))
-      '@vitest/pretty-format': 3.2.4
-      '@vitest/runner': 3.2.4
-      '@vitest/snapshot': 3.2.4
-      '@vitest/spy': 3.2.4
-      '@vitest/utils': 3.2.4
-      chai: 5.3.3
+  vitest@4.0.3(@types/node@24.9.2)(@vitest/ui@4.0.3)(jiti@2.6.1)(yaml@2.8.1):
+    dependencies:
+      '@vitest/expect': 4.0.3
+      '@vitest/mocker': 4.0.3(vite@7.1.12(@types/node@24.9.2)(jiti@2.6.1)(yaml@2.8.1))
+      '@vitest/pretty-format': 4.0.3
+      '@vitest/runner': 4.0.3
+      '@vitest/snapshot': 4.0.3
+      '@vitest/spy': 4.0.3
+      '@vitest/utils': 4.0.3
       debug: 4.4.3
+      es-module-lexer: 1.7.0
       expect-type: 1.2.2
-      magic-string: 0.30.17
+      magic-string: 0.30.21
       pathe: 2.0.3
       picomatch: 4.0.3
       std-env: 3.10.0
       tinybench: 2.9.0
       tinyexec: 0.3.2
       tinyglobby: 0.2.15
-      tinypool: 1.1.1
-      tinyrainbow: 2.0.0
-      vite: 7.1.11(@types/node@24.6.2)(jiti@2.6.1)(yaml@2.8.1)
-      vite-node: 3.2.4(@types/node@24.6.2)(jiti@2.6.1)(yaml@2.8.1)
+      tinyrainbow: 3.0.3
+      vite: 7.1.12(@types/node@24.9.2)(jiti@2.6.1)(yaml@2.8.1)
       why-is-node-running: 2.3.0
     optionalDependencies:
-      '@types/node': 24.6.2
-      '@vitest/ui': 3.2.4(vitest@3.2.4)
+      '@types/node': 24.9.2
+      '@vitest/ui': 4.0.3(vitest@4.0.3)
     transitivePeerDependencies:
       - jiti
       - less
@@ -5708,10 +6016,6 @@ snapshots:
     dependencies:
       isexe: 2.0.0
 
-  which@4.0.0:
-    dependencies:
-      isexe: 3.1.1
-
   which@5.0.0:
     dependencies:
       isexe: 3.1.1
diff --git a/scripts/.cache/v24.8.0-arm64-ef5a0af0-501/712488c2 b/scripts/.cache/v24.8.0-arm64-ef5a0af0-501/712488c2
deleted file mode 100644
index 327972b..0000000
Binary files a/scripts/.cache/v24.8.0-arm64-ef5a0af0-501/712488c2 and /dev/null differ
diff --git a/scripts/.cache/v24.8.0-arm64-ef5a0af0-501/8e9c99c2 b/scripts/.cache/v24.8.0-arm64-ef5a0af0-501/8e9c99c2
deleted file mode 100644
index cca14ce..0000000
Binary files a/scripts/.cache/v24.8.0-arm64-ef5a0af0-501/8e9c99c2 and /dev/null differ
diff --git a/scripts/add-missing-exports.mjs b/scripts/add-missing-exports.mjs
deleted file mode 100644
index eae5eb5..0000000
--- a/scripts/add-missing-exports.mjs
+++ /dev/null
@@ -1,89 +0,0 @@
-/**
- * Add all missing exports to package.json
- */
-
-import { readFileSync, writeFileSync } from 'node:fs'
-import { dirname, join } from 'node:path'
-import { fileURLToPath } from 'node:url'
-
-const __dirname = dirname(fileURLToPath(import.meta.url))
-const pkgPath = join(__dirname, '..', 'package.json')
-
-const pkg = JSON.parse(readFileSync(pkgPath, 'utf8'))
-
-// All the exports that need to be added
-const additionalExports = {
-  './lib/arrays': {
-    types: './dist/lib/arrays.d.ts',
-    import: './dist/lib/arrays.js',
-  },
-  './lib/debug': {
-    types: './dist/lib/debug.d.ts',
-    import: './dist/lib/debug.js',
-  },
-  './lib/fs': {
-    types: './dist/lib/fs.d.ts',
-    import: './dist/lib/fs.js',
-  },
-  './lib/promises': {
-    types: './dist/lib/promises.d.ts',
-    import: './dist/lib/promises.js',
-  },
-  './lib/prompts': {
-    types: './dist/lib/prompts.d.ts',
-    import: './dist/lib/prompts.js',
-  },
-  './lib/regexps': {
-    types: './dist/lib/regexps.d.ts',
-    import: './dist/lib/regexps.js',
-  },
-  './lib/words': {
-    types: './dist/lib/words.d.ts',
-    import: './dist/lib/words.js',
-  },
-  './lib/constants/env': {
-    types: './dist/lib/constants/env.d.ts',
-    import: './dist/lib/constants/env.js',
-  },
-  './lib/constants/attributes': {
-    types: './dist/lib/constants/attributes.d.ts',
-    import: './dist/lib/constants/attributes.js',
-  },
-}
-
-// Add all missing exports
-for (const [key, value] of Object.entries(additionalExports)) {
-  if (!pkg.exports[key]) {
-    pkg.exports[key] = value
-    console.log(`Added export: ${key}`)
-  }
-}
-
-// Sort exports alphabetically (but keep special ones at the end)
-const specialExports = new Set(['./package.json'])
-const regularExports = {}
-const special = {}
-
-for (const [key, value] of Object.entries(pkg.exports)) {
-  if (specialExports.has(key)) {
-    special[key] = value
-  } else {
-    regularExports[key] = value
-  }
-}
-
-// Sort regular exports
-const sortedExports = Object.keys(regularExports)
-  .sort()
-  .reduce((acc, key) => {
-    acc[key] = regularExports[key]
-    return acc
-  }, {})
-
-// Combine sorted regular with special at end
-pkg.exports = { ...sortedExports, ...special }
-
-// Write back
-writeFileSync(pkgPath, `${JSON.stringify(pkg, null, 2)}\n`)
-
-console.log('✓ Package.json exports updated')
diff --git a/scripts/analyze-bundle.mjs b/scripts/analyze-bundle.mjs
deleted file mode 100644
index 93a73aa..0000000
--- a/scripts/analyze-bundle.mjs
+++ /dev/null
@@ -1,204 +0,0 @@
-/**
- * @fileoverview Analyze bundle contents to identify optimization opportunities.
- */
-
-import { promises as fs } from 'node:fs'
-import path from 'node:path'
-import { fileURLToPath } from 'node:url'
-
-const __dirname = path.dirname(fileURLToPath(import.meta.url))
-
-async function analyzeBundle(filePath) {
-  const content = await fs.readFile(filePath, 'utf8')
-  const fileName = path.basename(filePath)
-
-  const analysis = {
-    fileName,
-    totalSize: content.length,
-    lines: content.split('\n').length,
-
-    // Identify wasteful patterns.
-    patterns: {
-      // Long error messages that could be shortened.
-      longErrorMessages: (
-        content.match(/Error\(['"`][^'"`]{200,}['"`]\)/g) || []
-      ).map(m => m.length),
-
-      // Embedded JSON data.
-      embeddedJson: (
-        content.match(/JSON\.parse\(['"`][\s\S]{500,}?['"`]\)/g) || []
-      ).map(m => m.length),
-
-      // Base64 encoded data.
-      base64Data: (
-        content.match(/['"`][A-Za-z0-9+/]{100,}={0,2}['"`]/g) || []
-      ).map(m => m.length),
-
-      // License headers and comments.
-      licenseBlocks: (
-        content.match(
-          /\/\*[\s\S]*?(MIT|Apache|BSD|GPL|License)[\s\S]*?\*\//gi,
-        ) || []
-      ).map(m => m.length),
-
-      // URLs in strings (docs, repos, etc).
-      embeddedUrls: (content.match(/['"`]https?:\/\/[^'"`]+['"`]/g) || [])
-        .length,
-
-      // Debug/development code that might remain.
-      debugCode: (content.match(/console\.(log|debug|trace|time)/g) || [])
-        .length,
-      assertCalls: (content.match(/assert[.(]/g) || []).length,
-
-      // Template literals that might have large content.
-      largeTemplates: (content.match(/`[^`]{500,}`/g) || []).map(m => m.length),
-
-      // Repeated code patterns (potential for deduplication).
-      duplicateRequires: {},
-
-      // Package detection.
-      packages: new Set(),
-    },
-
-    // Calculate waste.
-    waste: {
-      errorMessages: 0,
-      embeddedData: 0,
-      licensing: 0,
-      debugging: 0,
-    },
-  }
-
-  // Find duplicate requires.
-  const requires = content.matchAll(/require\(['"`]([^'"`]+)['"`]\)/g)
-  for (const match of requires) {
-    const pkg = match[1]
-    analysis.patterns.duplicateRequires[pkg] =
-      (analysis.patterns.duplicateRequires[pkg] || 0) + 1
-    if (!pkg.startsWith('.')) {
-      analysis.patterns.packages.add(pkg)
-    }
-  }
-
-  // Calculate wasted bytes.
-  analysis.waste.errorMessages = analysis.patterns.longErrorMessages.reduce(
-    (a, b) => a + b,
-    0,
-  )
-  analysis.waste.embeddedData =
-    analysis.patterns.embeddedJson.reduce((a, b) => a + b, 0) +
-    analysis.patterns.base64Data.reduce((a, b) => a + b, 0) +
-    analysis.patterns.largeTemplates.reduce((a, b) => a + b, 0)
-  analysis.waste.licensing = analysis.patterns.licenseBlocks.reduce(
-    (a, b) => a + b,
-    0,
-  )
-  // Estimate 50 bytes per debug statement.
-  analysis.waste.debugging =
-    (analysis.patterns.debugCode + analysis.patterns.assertCalls) * 50
-
-  analysis.totalWaste = Object.values(analysis.waste).reduce((a, b) => a + b, 0)
-  analysis.potentialSavings = `${Math.round(analysis.totalWaste / 1024)}KB`
-  analysis.savingsPercent = `${((analysis.totalWaste / analysis.totalSize) * 100).toFixed(1)}%`
-
-  return analysis
-}
-
-async function main() {
-  const distDir = path.join(__dirname, '..', 'dist', 'external')
-  const files = await fs.readdir(distDir)
-
-  // Get file sizes first, then sort
-  const filesWithSizes = await Promise.all(
-    files
-      .filter(f => f.endsWith('.js'))
-      .map(async f => ({
-        name: f,
-        size: (await fs.stat(path.join(distDir, f))).size,
-      })),
-  )
-
-  const jsFiles = filesWithSizes
-    .sort((a, b) => b.size - a.size)
-    .map(f => f.name)
-
-  console.log('🔍 Bundle Analysis Report\n')
-  console.log('='.repeat(80))
-
-  let totalOriginal = 0
-  let totalWaste = 0
-
-  // Analyze top 10 largest bundles.
-  for (const file of jsFiles.slice(0, 10)) {
-    const filePath = path.join(distDir, file)
-    const analysis = await analyzeBundle(filePath)
-
-    totalOriginal += analysis.totalSize
-    totalWaste += analysis.totalWaste
-
-    console.log(
-      `\n📦 ${analysis.fileName} (${Math.round(analysis.totalSize / 1024)}KB)`,
-    )
-    console.log(
-      '  Potential savings: ' +
-        analysis.potentialSavings +
-        ' (' +
-        analysis.savingsPercent +
-        ')',
-    )
-
-    if (analysis.patterns.longErrorMessages.length) {
-      console.log(
-        `  • Long error messages: ${analysis.patterns.longErrorMessages.length} occurrences`,
-      )
-    }
-    if (analysis.patterns.embeddedJson.length) {
-      console.log(
-        `  • Embedded JSON: ${analysis.patterns.embeddedJson.length} blocks`,
-      )
-    }
-    if (analysis.patterns.base64Data.length) {
-      console.log(
-        `  • Base64 data: ${analysis.patterns.base64Data.length} strings`,
-      )
-    }
-    if (analysis.patterns.debugCode) {
-      console.log(`  • Debug code: ${analysis.patterns.debugCode} statements`)
-    }
-    if (analysis.patterns.embeddedUrls) {
-      console.log(
-        `  • Embedded URLs: ${analysis.patterns.embeddedUrls} references`,
-      )
-    }
-
-    // Show top duplicate requires.
-    const duplicates = Object.entries(analysis.patterns.duplicateRequires)
-      .filter(([_, count]) => count > 2)
-      .sort((a, b) => b[1] - a[1])
-      .slice(0, 3)
-
-    if (duplicates.length) {
-      console.log('  • Top duplicate requires:')
-      duplicates.forEach(([pkg, count]) => {
-        console.log(`    - ${pkg}: ${count} times`)
-      })
-    }
-  }
-
-  console.log(`\n${'='.repeat(80)}`)
-  console.log('📊 Summary:')
-  console.log(`  Total size: ${Math.round(totalOriginal / 1024)}KB`)
-  console.log(`  Total waste identified: ${Math.round(totalWaste / 1024)}KB`)
-  console.log(
-    `  Potential reduction: ${((totalWaste / totalOriginal) * 100).toFixed(1)}%`,
-  )
-
-  console.log('\n💡 Recommendations:')
-  console.log('  1. Strip verbose error messages (keep error codes only)')
-  console.log('  2. Externalize embedded JSON/base64 data')
-  console.log('  3. Remove debug/assert statements')
-  console.log('  4. Deduplicate common requires')
-  console.log('  5. Use custom esbuild plugins for advanced stripping')
-}
-
-main().catch(console.error)
diff --git a/scripts/babel/README.md b/scripts/babel/README.md
deleted file mode 100644
index e33e89b..0000000
--- a/scripts/babel/README.md
+++ /dev/null
@@ -1,298 +0,0 @@
-# Babel AST Transforms
-
-Source code transformations using Babel AST walkers + magic-string.
-
-## Pattern: Babel AST + magic-string
-
-**All transforms in this directory follow this pattern:**
-
-1. **Parse with Babel** - Get AST for analysis
-2. **Walk with Babel traverse** - Find nodes to transform
-3. **Edit with magic-string** - Surgical source modifications
-4. **Preserve source maps** - magic-string maintains mappings
-
-**Rationale:**
-
-- Babel AST for parsing and semantic analysis
-- magic-string for precise edits without re-printing
-- Combines AST analysis with source-level modifications
-
-## Example Transform
-
-```javascript
-import MagicString from 'magic-string'
-const { parse } = await import('@babel/parser')
-const traverse = (await import('@babel/traverse')).default
-const t = await import('@babel/types')
-
-async function transform(filePath) {
-  const content = await fs.readFile(filePath, 'utf8')
-  const magicString = new MagicString(content)
-
-  // 1. Parse
-  const ast = parse(content, { sourceType: 'module' })
-
-  // 2. Walk
-  traverse(ast, {
-    Identifier(path) {
-      if (path.node.name === 'oldName') {
-        // 3. Edit with magic-string (not Babel transform)
-        magicString.overwrite(
-          path.node.start,
-          path.node.end,
-          'newName'
-        )
-      }
-    }
-  })
-
-  // 4. Write
-  await fs.writeFile(filePath, magicString.toString(), 'utf8')
-}
-```
-
-## Required Dependencies (Pinned)
-
-```json
-{
-  "@babel/parser": "7.28.4",
-  "@babel/traverse": "7.28.4",
-  "@babel/types": "7.28.4",
-  "magic-string": "0.30.19"
-}
-```
-
-**Always pin versions for source transforms** to ensure consistent behavior across builds.
-
-## Available Transforms
-
-### `transform-commonjs-exports.mjs`
-
-Fixes TypeScript-compiled CommonJS exports for better compatibility.
-
-**Transforms:**
-- `exports.default = value` → `module.exports = value`
-- Removes `__esModule` markers
-- Fixes `.default` accessor in imports
-
-**Usage:**
-
-```javascript
-import { transformFile, fixImports } from './transform-commonjs-exports.mjs'
-
-// Transform exports
-const result = await transformFile('dist/lib/constants/WIN32.js')
-
-// Fix imports
-await fixImports('dist/lib/path.js', fixedModules)
-```
-
-**Why needed:**
-
-TypeScript compiles `export default X` to `exports.default = X`, requiring `.default` accessor in CommonJS. This transform makes it work without `.default`:
-
-```javascript
-// Before: require('./WIN32').default
-// After:  require('./WIN32')
-```
-
-## Creating New Transforms
-
-1. **Create `transform-<name>.mjs`** in this directory
-2. **Follow the pattern**: Babel AST + magic-string
-3. **Export functions**: `transformFile()`, etc.
-4. **Document**: Add section to this README
-5. **Pin versions**: Use exact dependency versions
-
-### Transform Template
-
-```javascript
-/**
- * @fileoverview Transform description.
- * Uses Babel AST walkers + magic-string for surgical transformations.
- */
-
-import { promises as fs } from 'node:fs'
-import MagicString from 'magic-string'
-
-// Pinned versions required:
-// - @babel/parser@7.28.4
-// - @babel/traverse@7.28.4
-// - @babel/types@7.28.4
-// - magic-string@0.30.19
-
-const { parse } = await import('@babel/parser')
-const traverse = (await import('@babel/traverse')).default
-const t = await import('@babel/types')
-
-function parseCode(code) {
-  return parse(code, {
-    sourceType: 'module',
-    // Add parser plugins as needed
-  })
-}
-
-export async function transformFile(filePath, options = {}) {
-  const content = await fs.readFile(filePath, 'utf8')
-  const magicString = new MagicString(content)
-  let modified = false
-
-  try {
-    const ast = parseCode(content)
-
-    traverse(ast, {
-      // Add visitors
-      Identifier(path) {
-        // Check conditions
-        if (shouldTransform(path.node)) {
-          // Use magic-string for edits
-          magicString.overwrite(
-            path.node.start,
-            path.node.end,
-            'newValue'
-          )
-          modified = true
-        }
-      }
-    })
-
-    if (modified) {
-      await fs.writeFile(filePath, magicString.toString(), 'utf8')
-      return { modified: true }
-    }
-  } catch (e) {
-    // Handle parse errors
-  }
-
-  return { modified: false }
-}
-```
-
-## Babel Plugins vs Transforms
-
-**Babel Plugins** (`registry/plugins/`):
-- Run **during** Babel's transformation pipeline
-- Use Babel's transformation API
-- Return AST nodes
-- Example: `babel-plugin-inline-require-calls.mjs`
-
-**Standalone Transforms** (`scripts/babel/`):
-- Run **after** compilation as post-processing
-- Use Babel AST for analysis only
-- Use magic-string for source edits
-- Example: `transform-commonjs-exports.mjs`
-
-**When to use each:**
-
-| Use Case | Tool |
-|----------|------|
-| Babel pipeline | Babel Plugin |
-| Post-build fixes | Standalone Transform |
-| Rollup integration | Babel Plugin |
-| Script automation | Standalone Transform |
-
-## Integration with Build
-
-### Rollup `writeBundle` Hook (Recommended)
-
-Integrate transforms directly into Rollup's build pipeline using the `writeBundle` hook:
-
-```javascript
-// .config/rollup.dist.config.mjs
-import fastGlob from 'fast-glob'
-import {
-  fixImports,
-  transformFile,
-} from '../scripts/babel/transform-commonjs-exports.mjs'
-
-export default {
-  // ... other config
-  plugins: [
-    // ... other plugins
-    {
-      name: 'transform-commonjs-exports',
-      async writeBundle() {
-        const files = await fastGlob('**/*.js', {
-          absolute: true,
-          cwd: distPath,
-        })
-
-        const fixedModules = new Set()
-
-        // First pass: transform exports.default to module.exports
-        for (const file of files) {
-          const result = await transformFile(file)
-          if (result.modified && result.moduleName) {
-            fixedModules.add(result.moduleName)
-          }
-        }
-
-        // Second pass: fix .default accessors in imports
-        for (const file of files) {
-          await fixImports(file, fixedModules)
-        }
-      },
-    },
-  ],
-}
-```
-
-### Standalone Script (Alternative)
-
-For projects not using Rollup, run as a standalone script:
-
-```javascript
-// scripts/fix-commonjs-exports.mjs
-import { transformFile, fixImports } from './babel/transform-commonjs-exports.mjs'
-import fastGlob from 'fast-glob'
-
-const files = await fastGlob('dist/**/*.js')
-const fixedModules = new Set()
-
-// First pass: transform exports
-for (const file of files) {
-  const result = await transformFile(file)
-  if (result.modified) {
-    fixedModules.add(result.moduleName)
-  }
-}
-
-// Second pass: fix imports
-for (const file of files) {
-  await fixImports(file, fixedModules)
-}
-```
-
-```json
-// package.json
-{
-  "scripts": {
-    "build": "tsgo && node scripts/fix-commonjs-exports.mjs"
-  }
-}
-```
-
-## Best Practices
-
-1. **Always use magic-string** - Don't use Babel's code generator for transforms
-2. **Pin dependency versions** - Source transforms need stability
-3. **Parse once** - Cache AST if walking multiple times
-4. **Handle errors gracefully** - Skip unparseable files
-5. **Test thoroughly** - Verify source maps still work
-6. **Document transformations** - Explain why each transform is needed
-
-## Performance
-
-- Babel parsing (optimized C++ parser)
-- AST analysis (JavaScript object traversal)
-- magic-string edits (string slicing, no re-parsing)
-- No code generation (skips Babel's printer)
-
-< 10ms per file for most transforms.
-
-## References
-
-- [Babel Parser](https://babeljs.io/docs/babel-parser)
-- [Babel Traverse](https://babeljs.io/docs/babel-traverse)
-- [Babel Types](https://babeljs.io/docs/babel-types)
-- [magic-string](https://github.com/rich-harris/magic-string)
diff --git a/scripts/babel/transform-set-proto-plugin.mjs b/scripts/babel/transform-set-proto-plugin.mjs
index 864ac03..739d0e2 100644
--- a/scripts/babel/transform-set-proto-plugin.mjs
+++ b/scripts/babel/transform-set-proto-plugin.mjs
@@ -17,7 +17,7 @@ function unwrapProto(node, t) {
   }
 }
 
-export default function ({ types: t }) {
+export function transformSetProto({ types: t }) {
   return {
     name: 'transform-set-proto',
     visitor: {
diff --git a/scripts/babel/transform-url-parse-plugin.mjs b/scripts/babel/transform-url-parse-plugin.mjs
index 4734147..b03fa86 100644
--- a/scripts/babel/transform-url-parse-plugin.mjs
+++ b/scripts/babel/transform-url-parse-plugin.mjs
@@ -1,4 +1,4 @@
-export default function ({ types: t }) {
+export function transformUrlParse({ types: t }) {
   return {
     name: 'transform-url-parse',
     visitor: {
diff --git a/scripts/build-externals.mjs b/scripts/build-externals.mjs
deleted file mode 100644
index 99557a0..0000000
--- a/scripts/build-externals.mjs
+++ /dev/null
@@ -1,590 +0,0 @@
-/**
- * @fileoverview Bundle external dependencies into standalone zero-dependency modules.
- * This bundles packages like cacache, pacote, make-fetch-happen into dist/external.
- */
-
-import { promises as fs } from 'node:fs'
-import { createRequire } from 'node:module'
-import path from 'node:path'
-import { fileURLToPath } from 'node:url'
-
-const require = createRequire(import.meta.url)
-
-// Use esbuild from node_modules.
-import esbuild from 'esbuild'
-import { createCherryPickEntry } from './cherry-pick-entries.mjs'
-import { createNonBarrelEntry } from './non-barrel-imports.mjs'
-import {
-  printError,
-  printFooter,
-  printHeader,
-  printSuccess,
-} from './utils/helpers.mjs'
-
-const __dirname = path.dirname(fileURLToPath(import.meta.url))
-const rootDir = path.resolve(__dirname, '..')
-const srcExternalDir = path.join(rootDir, 'src', 'external')
-const distExternalDir = path.join(rootDir, 'dist', 'external')
-
-// Check if local workspace or sibling project versions exist.
-// Used for development to use local changes instead of published packages.
-async function getLocalPackagePath(packageName) {
-  const checks = []
-
-  // Check workspace packages (e.g. @socketregistry/yocto-spinner).
-  if (packageName.startsWith('@socketregistry/')) {
-    const pkgName = packageName.replace('@socketregistry/', '')
-    const workspacePath = path.resolve(
-      rootDir,
-      '..',
-      'packages',
-      'npm',
-      pkgName,
-    )
-    checks.push(workspacePath)
-  }
-
-  // Check sibling projects (e.g. socket-packageurl-js).
-  if (packageName === '@socketregistry/packageurl-js') {
-    const siblingPath = path.resolve(
-      rootDir,
-      '..',
-      '..',
-      'socket-packageurl-js',
-    )
-    checks.push(siblingPath)
-  }
-
-  // Return first existing path.
-  for (const checkPath of checks) {
-    try {
-      await fs.access(path.join(checkPath, 'package.json'))
-      return checkPath
-    } catch {
-      // Path doesn't exist, continue.
-    }
-  }
-
-  return null
-}
-
-// Define which packages need bundling (ones that are actual npm packages).
-// Skip ones that are just local re-exports.
-const externalPackages = [
-  // NPM internals
-  { name: 'cacache', bundle: true },
-  { name: 'pacote', bundle: true },
-  { name: 'make-fetch-happen', bundle: true },
-  { name: 'libnpmpack', bundle: true },
-  { name: 'npm-package-arg', bundle: true },
-  { name: 'normalize-package-data', bundle: true },
-  // Utilities
-  // { name: 'browserslist', bundle: true }, // UNUSED - no imports found
-  { name: 'debug', bundle: true },
-  { name: 'del', bundle: true },
-  { name: 'fast-glob', bundle: true },
-  { name: 'fast-sort', bundle: true },
-  { name: 'get-east-asian-width', bundle: true },
-  { name: 'picomatch', bundle: true },
-  { name: 'semver', bundle: true },
-  { name: 'spdx-correct', bundle: true },
-  { name: 'spdx-expression-parse', bundle: true },
-  { name: 'streaming-iterables', bundle: true },
-  { name: 'validate-npm-package-name', bundle: true },
-  { name: 'which', bundle: true },
-  { name: 'yargs-parser', bundle: true },
-  { name: 'yoctocolors-cjs', bundle: true },
-  // Used by socket-cli (dist/cli.js has minified zod).
-  { name: 'zod', bundle: true },
-]
-
-// Scoped packages need special handling.
-const scopedPackages = [
-  { scope: '@npmcli', name: 'promise-spawn', bundle: true },
-  {
-    scope: '@inquirer',
-    packages: ['checkbox', 'confirm', 'core', 'prompts', 'select'],
-    optional: true,
-  },
-  {
-    scope: '@socketregistry',
-    packages: ['packageurl-js', 'is-unicode-supported', 'yocto-spinner'],
-    optional: true,
-  },
-  { scope: '@yarnpkg', name: 'extensions', bundle: true },
-]
-
-async function ensureDir(dir) {
-  await fs.mkdir(dir, { recursive: true })
-}
-
-// Package-specific optimizations.
-function getPackageSpecificOptions(packageName) {
-  const opts = {}
-
-  // Optimize specific packages.
-  if (packageName === 'browserslist') {
-    // Browserslist's data updates frequently - we can exclude some update checking.
-    opts.define = {
-      'process.versions.node': '"18.0.0"',
-    }
-  } else if (packageName === 'zod') {
-    // Zod has localization files we don't need.
-    opts.external = [...(opts.external || []), './locales/*']
-  } else if (packageName.startsWith('@inquirer/')) {
-    // Inquirer packages have heavy dependencies we might not need.
-    opts.external = [...(opts.external || []), 'rxjs/operators']
-  } else if (packageName === 'yargs-parser') {
-    // yargs-parser uses import.meta.url which isn't available in CommonJS.
-    // Replace import.meta.url with __filename wrapped in pathToFileURL.
-    opts.define = {
-      ...opts.define,
-      'import.meta.url': '__filename',
-    }
-  }
-
-  return opts
-}
-
-async function bundlePackage(packageName, outputPath) {
-  console.log(`  Bundling ${packageName}...`)
-
-  let cherryPickedEntry
-
-  try {
-    // Check if package is installed.
-    let packagePath
-
-    // First, check for local workspace/sibling versions (dev mode).
-    const localPath = await getLocalPackagePath(packageName)
-    if (localPath) {
-      console.log(
-        `  Using local version from ${path.relative(rootDir, localPath)}`,
-      )
-      // Use the package's entry point.
-      const localPkgJson = JSON.parse(
-        await fs.readFile(path.join(localPath, 'package.json'), 'utf8'),
-      )
-      // Resolve the main export - handle nested exports structure.
-      let mainExport = localPkgJson.main || 'index.js'
-      const exportsField = localPkgJson.exports?.['.']
-      if (exportsField) {
-        if (typeof exportsField === 'string') {
-          mainExport = exportsField
-        } else if (typeof exportsField === 'object') {
-          // Try to find default export in nested structure.
-          mainExport =
-            exportsField.node?.default?.default ||
-            exportsField.node?.default ||
-            exportsField.default?.default ||
-            exportsField.default ||
-            mainExport
-        }
-      }
-      packagePath = path.join(localPath, mainExport)
-    } else {
-      // Fall back to installed version.
-      try {
-        packagePath = require.resolve(packageName)
-      } catch {
-        // Package must be installed for bundling - no fallbacks.
-        throw new Error(
-          `Package "${packageName}" is not installed. Please install it with: pnpm add -D ${packageName}`,
-        )
-      }
-    }
-
-    // Check if we have a cherry-pick optimization for this package first.
-    const cherryPickEntry = await createCherryPickEntry(packageName, null)
-    if (cherryPickEntry) {
-      console.log(`  Using cherry-picked imports for ${packageName}`)
-      packagePath = cherryPickEntry
-      // For cleanup tracking.
-      cherryPickedEntry = cherryPickEntry
-    } else {
-      // Fall back to non-barrel import optimization.
-      const nonBarrelEntry = await createNonBarrelEntry(packageName, null)
-      if (nonBarrelEntry) {
-        console.log(`  Using non-barrel imports for ${packageName}`)
-        packagePath = nonBarrelEntry
-        // For cleanup tracking.
-        cherryPickedEntry = nonBarrelEntry
-      }
-    }
-
-    // Get package-specific optimizations.
-    const packageOpts = getPackageSpecificOptions(packageName)
-
-    // Bundle the package with esbuild.
-    await esbuild.build({
-      entryPoints: [packagePath],
-      bundle: true,
-      platform: 'node',
-      target: 'node18',
-      format: 'cjs',
-      outfile: outputPath,
-      external: [
-        'node:*',
-        'fs',
-        'path',
-        'os',
-        'crypto',
-        'stream',
-        'util',
-        'events',
-        'child_process',
-        'http',
-        'https',
-        'net',
-        'url',
-        'zlib',
-        'buffer',
-        'querystring',
-        'string_decoder',
-        'tty',
-        'assert',
-        'perf_hooks',
-        'worker_threads',
-        'v8',
-        'vm',
-        '@socketsecurity/registry',
-        ...(packageOpts.external || []),
-      ],
-      plugins: [
-        {
-          name: 'stub-encoding',
-          setup(build) {
-            // Stub out encoding and iconv-lite packages.
-            build.onResolve({ filter: /^(encoding|iconv-lite)$/ }, args => ({
-              path: args.path,
-              namespace: 'stub-encoding',
-            }))
-
-            build.onLoad({ filter: /.*/, namespace: 'stub-encoding' }, () => ({
-              contents: 'module.exports = {};',
-              loader: 'js',
-            }))
-          },
-        },
-      ],
-      minify: true,
-      sourcemap: false,
-      metafile: true,
-      logLevel: 'error',
-      treeShaking: true,
-      // Keep function names for better error messages.
-      keepNames: true,
-      // Additional optimizations:
-      // Mark functions as side-effect free for better tree shaking.
-      pure: ['console.log', 'console.debug', 'console.warn'],
-      // Drop debugger statements and console logs in production.
-      drop: ['debugger', 'console'],
-      // Ignore specific patterns (e.g., test files, examples, locales).
-      ignoreAnnotations: false,
-      // More aggressive mangling for smaller output.
-      minifyWhitespace: true,
-      minifyIdentifiers: true,
-      minifySyntax: true,
-      // Define compile-time constants for dead code elimination.
-      // These allow bundlers to completely remove code paths that will never execute.
-      define: {
-        // NODE_ENV: The most common optimization flag in the Node.js ecosystem.
-        // Many packages use this pattern:
-        //   if (process.env.NODE_ENV !== 'production') {
-        //     validateProps(props)  // Dev-only validation
-        //     checkInvariants()     // Expensive checks
-        //     console.warn('...')   // Dev warnings
-        //   }
-        // When we define NODE_ENV as "production", esbuild:
-        // 1. Evaluates the condition: 'production' !== 'production' = false
-        // 2. Recognizes the entire if-block will never execute
-        // 3. Completely removes all development code
-        // This can eliminate 20-40% of React/Vue/Express code!
-        'process.env.NODE_ENV': '"production"',
-
-        // __DEV__: Used by React, Vue, and many modern frameworks.
-        // Pattern in packages:
-        //   if (__DEV__) {
-        //     PropTypes.checkPropTypes()  // React prop validation
-        //     devtools.init()             // Dev tools initialization
-        //     enableHotReload()           // HMR code
-        //   }
-        // Setting to false removes ALL development-only code paths.
-        // React alone can shrink by ~30KB when __DEV__ is false.
-        __DEV__: 'false',
-
-        // global.GENTLY: Test mocking library flag from early Node.js era (2010-2015).
-        // Used by packages like formidable, multiparty, and other form parsers:
-        //   if (global.GENTLY) {
-        //     require('gently')  // Test mocking library (~15KB)
-        //     GENTLY.hijack(...)  // Mock setup code
-        //   }
-        // When false, removes ALL mocking infrastructure.
-        // See: https://github.com/felixge/node-gently
-        'global.GENTLY': 'false',
-
-        // process.env.DEBUG: Controls the popular 'debug' package output.
-        // The debug package (used by Express, Socket.io, Mocha) does:
-        //   if (process.env.DEBUG) {
-        //     const namespaces = process.env.DEBUG.split(',')
-        //     enabledNamespaces.push(...namespaces)
-        //     loadFormatters()  // Color formatting code
-        //     setupTimers()     // Performance timing
-        //   }
-        // When undefined/false:
-        // 1. No namespace parsing logic
-        // 2. No formatters loaded (chalk, colors, etc.)
-        // 3. No timing calculations
-        // 4. All debug() calls become no-ops
-        // Can save 5-10KB per package using debug!
-        'process.env.DEBUG': 'undefined',
-
-        // process.browser: Used by isomorphic packages to detect browser environment.
-        // Common in packages like 'util', 'events', 'stream', 'buffer':
-        //   if (process.browser) {
-        //     module.exports = require('./browser-implementation')  // Browser polyfills
-        //     setupDOMListeners()     // DOM event handlers
-        //     loadWebAPIs()           // fetch, WebSocket, etc.
-        //   } else {
-        //     module.exports = require('./node-implementation')     // Node native code
-        //   }
-        // Setting to false ensures ONLY Node.js code paths are included.
-        // Can eliminate entire browser polyfill bundles (often 50+ KB)!
-        'process.browser': 'false',
-
-        // process.env.VERBOSE: Controls verbose logging in many CLI tools.
-        // Used by npm, webpack, jest, and other tools:
-        //   if (process.env.VERBOSE) {
-        //     logger.setLevel('trace')
-        //     enableStackTraces()
-        //     showProgressBars()
-        //     printDetailedErrors()
-        //   }
-        // When false, removes:
-        // - Detailed error messages with stack traces
-        // - Progress indicators and spinners
-        // - Verbose log formatting code
-        // - Performance profiling output
-        'process.env.VERBOSE': 'false',
-
-        // typeof window: The most reliable browser detection pattern.
-        // Used by virtually every isomorphic package:
-        //   if (typeof window !== 'undefined') {
-        //     // Browser-specific code
-        //     window.addEventListener()    // DOM events
-        //     document.querySelector()      // DOM queries
-        //     localStorage.setItem()        // Browser storage
-        //     fetch()                       // Browser fetch API
-        //   }
-        // When defined as "undefined":
-        // 1. All browser-only code branches are eliminated
-        // 2. DOM manipulation libraries are stripped
-        // 3. Browser API polyfills are removed
-        // 4. Web Worker code is eliminated
-        // This is the MOST effective optimization for Node.js bundles!
-        // Note: esbuild doesn't support 'typeof X' as a define key directly,
-        // but we can define the globals themselves as undefined.
-        window: 'undefined',
-        document: 'undefined',
-        navigator: 'undefined',
-        HTMLElement: 'undefined',
-        localStorage: 'undefined',
-        sessionStorage: 'undefined',
-        XMLHttpRequest: 'undefined',
-        WebSocket: 'undefined',
-
-        // __TEST__: Used by testing frameworks and test utilities.
-        // Common in packages with built-in test helpers:
-        //   if (__TEST__) {
-        //     exports.mockImplementation = ...  // Test mocks
-        //     exports.testHelpers = ...         // Test utilities
-        //     setupTestEnvironment()            // Test setup
-        //     enableSnapshotting()              // Jest snapshots
-        //   }
-        // When false, removes ALL testing infrastructure:
-        // - Mock implementations
-        // - Test fixtures and helpers
-        // - Assertion libraries
-        // - Snapshot serializers
-        __TEST__: 'false',
-
-        // process.env.CI: Continuous Integration environment flag.
-        // Many packages alter behavior in CI:
-        //   if (process.env.CI) {
-        //     disableAnimations()      // No progress bars
-        //     enableJUnitReporting()   // XML test output
-        //     uploadCoverageReports()  // Coverage reporting
-        //     runInHeadlessMode()      // No interactive prompts
-        //   }
-        // Setting to false removes CI-specific code paths.
-        'process.env.CI': 'false',
-
-        // Additional test-related flags:
-        // Jest test runner detection.
-        __JEST__: 'false',
-        // Mocha test runner detection.
-        __MOCHA__: 'false',
-        // Jest worker threads.
-        'process.env.JEST_WORKER_ID': 'undefined',
-        // Node.js test runner.
-        'process.env.NODE_TEST': 'undefined',
-
-        ...packageOpts.define,
-      },
-      // Use more efficient charset.
-      charset: 'utf8',
-    })
-
-    // Add a header comment to the bundled file.
-    const bundleContent = await fs.readFile(outputPath, 'utf8')
-
-    const finalContent = `/**
- * Bundled from ${packageName}
- * This is a zero-dependency bundle created by esbuild.
- */
-${bundleContent}`
-    await fs.writeFile(outputPath, finalContent)
-
-    // Get file size for logging.
-    const stats = await fs.stat(outputPath)
-    const sizeKB = Math.round(stats.size / 1024)
-    console.log(`    ✓ Bundled ${packageName} (${sizeKB}KB)`)
-
-    // Clean up temp directory if we created one.
-    if (cherryPickedEntry) {
-      const tmpDir = path.join(process.cwd(), '.tmp-build')
-      await fs.rm(tmpDir, { recursive: true, force: true })
-    }
-  } catch (error) {
-    console.error(`    ✗ Failed to bundle ${packageName}:`, error.message)
-    // Create error stub.
-    const stubContent = `'use strict'
-
-// Failed to bundle ${packageName}: ${error.message}
-throw new Error('Failed to bundle ${packageName}')
-`
-    await fs.writeFile(outputPath, stubContent)
-  } finally {
-    // Always clean up temp directory if we created one.
-    if (cherryPickedEntry) {
-      const tmpDir = path.join(process.cwd(), '.tmp-build')
-      await fs.rm(tmpDir, { recursive: true, force: true }).catch(() => {})
-    }
-  }
-}
-
-async function copyLocalFiles() {
-  // Copy TypeScript declaration files.
-  const dtsFiles = await fs.readdir(srcExternalDir)
-  for (const file of dtsFiles) {
-    if (file.endsWith('.d.ts')) {
-      await fs.copyFile(
-        path.join(srcExternalDir, file),
-        path.join(distExternalDir, file),
-      )
-      console.log(`  Copied ${file}`)
-    }
-  }
-}
-
-// Helper to recursively copy a directory
-async function copyRecursive(srcPath, destPath, relativePath = '') {
-  await ensureDir(destPath)
-  const entries = await fs.readdir(srcPath, { withFileTypes: true })
-
-  for (const entry of entries) {
-    const srcEntry = path.join(srcPath, entry.name)
-    const destEntry = path.join(destPath, entry.name)
-    const relPath = path.join(relativePath, entry.name)
-
-    if (entry.isDirectory()) {
-      // Recursively copy directory
-      await copyRecursive(srcEntry, destEntry, relPath)
-    } else {
-      // Only copy if the file doesn't already exist (i.e., wasn't bundled).
-      try {
-        await fs.access(destEntry)
-        // File exists (was bundled), skip copying.
-      } catch {
-        // File doesn't exist, copy it.
-        await fs.copyFile(srcEntry, destEntry)
-        console.log(`  Copied ${relPath}`)
-      }
-    }
-  }
-}
-
-async function copyScopedFiles() {
-  // Copy scoped package directories.
-  for (const { scope } of scopedPackages) {
-    const scopeSrcDir = path.join(srcExternalDir, scope)
-    const scopeDistDir = path.join(distExternalDir, scope)
-
-    try {
-      await copyRecursive(scopeSrcDir, scopeDistDir, scope)
-    } catch {
-      // Scope directory doesn't exist.
-    }
-  }
-}
-
-async function main() {
-  printHeader('External Bundles')
-
-  // Ensure dist/external directory exists.
-  await ensureDir(distExternalDir)
-
-  // Bundle each external package.
-  for (const { bundle, name } of externalPackages) {
-    if (bundle) {
-      const outputPath = path.join(distExternalDir, `${name}.js`)
-      await bundlePackage(name, outputPath)
-    }
-  }
-
-  // Bundle scoped packages.
-  for (const { name, optional, packages, scope } of scopedPackages) {
-    const scopeDir = path.join(distExternalDir, scope)
-    await ensureDir(scopeDir)
-
-    if (name) {
-      // Single package in scope.
-      const outputPath = path.join(scopeDir, `${name}.js`)
-      if (optional) {
-        try {
-          await bundlePackage(`${scope}/${name}`, outputPath)
-        } catch {
-          console.log(`  Skipping optional package ${scope}/${name}`)
-        }
-      } else {
-        await bundlePackage(`${scope}/${name}`, outputPath)
-      }
-    } else if (packages) {
-      // Multiple packages in scope.
-      for (const pkg of packages) {
-        const outputPath = path.join(scopeDir, `${pkg}.js`)
-        if (optional) {
-          try {
-            await bundlePackage(`${scope}/${pkg}`, outputPath)
-          } catch {
-            console.log(`  Skipping optional package ${scope}/${pkg}`)
-          }
-        } else {
-          await bundlePackage(`${scope}/${pkg}`, outputPath)
-        }
-      }
-    }
-  }
-
-  console.log('\nCopying declaration files...')
-  await copyLocalFiles()
-  await copyScopedFiles()
-
-  printSuccess('External bundles built successfully')
-  printFooter()
-}
-
-main().catch(error => {
-  printError(`Build failed: ${error.message || error}`)
-  process.exitCode = 1
-})
diff --git a/scripts/build-externals/bundler.mjs b/scripts/build-externals/bundler.mjs
new file mode 100644
index 0000000..b8aafe0
--- /dev/null
+++ b/scripts/build-externals/bundler.mjs
@@ -0,0 +1,121 @@
+/**
+ * @fileoverview Package bundling logic using esbuild.
+ */
+
+import { promises as fs } from 'node:fs'
+import { createRequire } from 'node:module'
+import path from 'node:path'
+
+import esbuild from 'esbuild'
+import {
+  getEsbuildConfig,
+  getPackageSpecificOptions,
+} from './esbuild-config.mjs'
+import {
+  getLocalPackagePath,
+  resolveLocalEntryPoint,
+} from './local-packages.mjs'
+
+const require = createRequire(import.meta.url)
+
+/**
+ * Bundle a single package with esbuild.
+ *
+ * @param {string} packageName - Name of the package to bundle
+ * @param {string} outputPath - Output file path
+ * @param {object} options - Bundling options
+ * @param {boolean} options.quiet - Suppress output
+ * @param {string} options.rootDir - Root directory
+ * @returns {Promise<number|undefined>} Size in KB or undefined on error
+ */
+export async function bundlePackage(packageName, outputPath, options = {}) {
+  const { quiet = false, rootDir } = options
+
+  if (!quiet) {
+    console.log(`  Bundling ${packageName}...`)
+  }
+
+  try {
+    // Check if package is installed.
+    let packagePath
+
+    // First, check if src/external/{packageName}.js exists - use as entry point.
+    // Preserve scope for scoped packages like @socketregistry/yocto-spinner
+    const srcExternalPath = path.join(
+      rootDir,
+      'src',
+      'external',
+      `${packageName}.js`,
+    )
+    try {
+      await fs.access(srcExternalPath)
+      packagePath = srcExternalPath
+      if (!quiet) {
+        console.log(
+          `  Using entry point ${path.relative(rootDir, srcExternalPath)}`,
+        )
+      }
+    } catch {
+      // No src/external file, check for local workspace/sibling versions (dev mode).
+      const localPath = await getLocalPackagePath(packageName, rootDir)
+      if (localPath) {
+        if (!quiet) {
+          console.log(
+            `  Using local version from ${path.relative(rootDir, localPath)}`,
+          )
+        }
+        packagePath = await resolveLocalEntryPoint(localPath)
+      } else {
+        // Fall back to installed version.
+        try {
+          packagePath = require.resolve(packageName)
+        } catch {
+          // Package must be installed for bundling - no fallbacks.
+          throw new Error(
+            `Package "${packageName}" is not installed. Please install it with: pnpm add -D ${packageName}`,
+          )
+        }
+      }
+    }
+
+    // Get package-specific optimizations.
+    const packageOpts = getPackageSpecificOptions(packageName)
+
+    // Get esbuild configuration.
+    const config = getEsbuildConfig(packagePath, outputPath, packageOpts)
+
+    // Bundle the package with esbuild.
+    await esbuild.build(config)
+
+    // Add a header comment to the bundled file.
+    const bundleContent = await fs.readFile(outputPath, 'utf8')
+    // Strip 'use strict' from bundle content if present (will be re-added at top)
+    const contentWithoutStrict = bundleContent.replace(/^"use strict";\n/, '')
+    const finalContent = `"use strict";
+/**
+ * Bundled from ${packageName}
+ * This is a zero-dependency bundle created by esbuild.
+ */
+${contentWithoutStrict}`
+    await fs.writeFile(outputPath, finalContent)
+
+    // Get file size for logging.
+    const stats = await fs.stat(outputPath)
+    const sizeKB = Math.round(stats.size / 1024)
+    if (!quiet) {
+      console.log(`    ✓ Bundled ${packageName} (${sizeKB}KB)`)
+    }
+    return sizeKB
+  } catch (error) {
+    if (!quiet) {
+      console.error(`    ✗ Failed to bundle ${packageName}:`, error.message)
+    }
+    // Create error stub.
+    const stubContent = `'use strict'
+
+// Failed to bundle ${packageName}: ${error.message}
+throw new Error('Failed to bundle ${packageName}')
+`
+    await fs.writeFile(outputPath, stubContent)
+  }
+}
diff --git a/scripts/build-externals/config.mjs b/scripts/build-externals/config.mjs
new file mode 100644
index 0000000..ffff966
--- /dev/null
+++ b/scripts/build-externals/config.mjs
@@ -0,0 +1,63 @@
+/**
+ * @fileoverview External package configuration.
+ * Defines which packages need bundling and their scopes.
+ */
+
+// Define which packages need bundling (ones that are actual npm packages).
+export const externalPackages = [
+  // NPM internals
+  { name: 'cacache', bundle: true },
+  { name: 'pacote', bundle: true },
+  { name: 'make-fetch-happen', bundle: true },
+  { name: 'libnpmexec', bundle: true },
+  { name: 'libnpmpack', bundle: true },
+  { name: 'npm-package-arg', bundle: true },
+  { name: 'normalize-package-data', bundle: true },
+  // Utilities
+  { name: 'debug', bundle: true },
+  { name: 'del', bundle: true },
+  { name: 'fast-glob', bundle: true },
+  { name: 'fast-sort', bundle: true },
+  { name: 'get-east-asian-width', bundle: true },
+  { name: 'picomatch', bundle: true },
+  { name: 'semver', bundle: true },
+  { name: 'spdx-correct', bundle: true },
+  { name: 'spdx-expression-parse', bundle: true },
+  { name: 'streaming-iterables', bundle: true },
+  { name: 'validate-npm-package-name', bundle: true },
+  { name: 'which', bundle: true },
+  { name: 'yargs-parser', bundle: true },
+  { name: 'yoctocolors-cjs', bundle: true },
+  // Used by socket-cli (dist/cli.js has minified zod).
+  { name: 'zod', bundle: true },
+]
+
+// Scoped packages need special handling.
+export const scopedPackages = [
+  {
+    scope: '@npmcli',
+    packages: ['package-json', 'promise-spawn'],
+    bundle: true,
+    subpaths: ['package-json/lib/read-package.js', 'package-json/lib/sort.js'],
+  },
+  {
+    scope: '@inquirer',
+    packages: [
+      'checkbox',
+      'confirm',
+      'core',
+      'input',
+      'password',
+      'prompts',
+      'search',
+      'select',
+    ],
+    optional: true,
+  },
+  {
+    scope: '@socketregistry',
+    packages: ['packageurl-js', 'is-unicode-supported', 'yocto-spinner'],
+    optional: true,
+  },
+  { scope: '@yarnpkg', name: 'extensions', bundle: true },
+]
diff --git a/scripts/build-externals/copy-files.mjs b/scripts/build-externals/copy-files.mjs
new file mode 100644
index 0000000..00f5309
--- /dev/null
+++ b/scripts/build-externals/copy-files.mjs
@@ -0,0 +1,124 @@
+/**
+ * @fileoverview File copying utilities for external dependencies.
+ */
+
+import { promises as fs } from 'node:fs'
+import path from 'node:path'
+
+/**
+ * Ensure directory exists.
+ *
+ * @param {string} dir - Directory path
+ * @returns {Promise<void>}
+ */
+export async function ensureDir(dir) {
+  await fs.mkdir(dir, { recursive: true })
+}
+
+/**
+ * Copy local TypeScript declaration files only.
+ * JavaScript files are either bundled by esbuild or manually vendored (handled separately).
+ *
+ * @param {string} srcDir - Source directory
+ * @param {string} destDir - Destination directory
+ * @param {boolean} quiet - Suppress output
+ * @returns {Promise<number>} Number of files copied
+ */
+export async function copyLocalFiles(srcDir, destDir, quiet = false) {
+  const files = await fs.readdir(srcDir)
+  let count = 0
+
+  for (const file of files) {
+    // Only copy .d.ts files (hand-written type definitions)
+    // .js files are either bundled by esbuild or don't need to be in dist
+    if (file.endsWith('.d.ts')) {
+      const srcPath = path.join(srcDir, file)
+      const destPath = path.join(destDir, file)
+
+      await fs.copyFile(srcPath, destPath)
+      if (!quiet) {
+        console.log(`  Copied ${file}`)
+      }
+      count++
+    }
+  }
+
+  return count
+}
+
+/**
+ * Recursively copy a directory.
+ *
+ * @param {string} srcPath - Source path
+ * @param {string} destPath - Destination path
+ * @param {string} relativePath - Relative path for logging
+ * @param {boolean} quiet - Suppress output
+ * @returns {Promise<number>} Number of files copied
+ */
+export async function copyRecursive(
+  srcPath,
+  destPath,
+  relativePath = '',
+  quiet = false,
+) {
+  await ensureDir(destPath)
+  const entries = await fs.readdir(srcPath, { withFileTypes: true })
+  let count = 0
+
+  for (const entry of entries) {
+    const srcEntry = path.join(srcPath, entry.name)
+    const destEntry = path.join(destPath, entry.name)
+    const relPath = path.join(relativePath, entry.name)
+
+    if (entry.isDirectory()) {
+      // Recursively copy directory
+      count += await copyRecursive(srcEntry, destEntry, relPath, quiet)
+    } else {
+      // Only copy if the file doesn't already exist (i.e., wasn't bundled).
+      try {
+        await fs.access(destEntry)
+        // File exists (was bundled), skip copying.
+      } catch {
+        // File doesn't exist, copy it.
+        await fs.copyFile(srcEntry, destEntry)
+        if (!quiet) {
+          console.log(`  Copied ${relPath}`)
+        }
+        count++
+      }
+    }
+  }
+
+  return count
+}
+
+/**
+ * Copy scoped package directories.
+ *
+ * @param {string} srcDir - Source directory
+ * @param {string} destDir - Destination directory
+ * @param {Array} scopedPackages - List of scoped packages
+ * @param {boolean} quiet - Suppress output
+ * @returns {Promise<number>} Number of files copied
+ */
+export async function copyScopedFiles(
+  srcDir,
+  destDir,
+  scopedPackages,
+  quiet = false,
+) {
+  let count = 0
+
+  for (const { scope } of scopedPackages) {
+    const scopeSrcDir = path.join(srcDir, scope)
+    const scopeDistDir = path.join(destDir, scope)
+
+    try {
+      count += await copyRecursive(scopeSrcDir, scopeDistDir, scope, quiet)
+    } catch {
+      // Scope directory doesn't exist.
+    }
+  }
+
+  return count
+}
diff --git a/scripts/build-externals/esbuild-config.mjs b/scripts/build-externals/esbuild-config.mjs
new file mode 100644
index 0000000..fbea0a6
--- /dev/null
+++ b/scripts/build-externals/esbuild-config.mjs
@@ -0,0 +1,275 @@
+/**
+ * @fileoverview esbuild configuration for external package bundling.
+ */
+
+import { readFileSync } from 'node:fs'
+import path from 'node:path'
+import { fileURLToPath } from 'node:url'
+
+const __dirname = path.dirname(fileURLToPath(import.meta.url))
+const stubsDir = path.join(__dirname, 'stubs')
+
+/**
+ * Stub configuration - maps module patterns to stub files.
+ * Only includes conservative stubs that are safe to use.
+ */
+const STUB_MAP = {
+  // Character encoding - we only use UTF-8
+  '^(encoding|iconv-lite)$': 'encoding.cjs',
+
+  // Debug logging - already disabled via process.env.DEBUG = undefined
+  '^debug$': 'debug.cjs',
+}
+
+// Import createRequire at top level
+import { createRequire } from 'node:module'
+
+const requireResolve = createRequire(import.meta.url)
+
+/**
+ * Create esbuild plugin to force npm packages to resolve from node_modules.
+ * This prevents tsconfig.json path mappings from creating circular dependencies.
+ *
+ * @returns {import('esbuild').Plugin}
+ */
+function createForceNodeModulesPlugin() {
+  /**
+   * Packages that must be resolved from node_modules to prevent circular dependencies.
+   *
+   * THE PROBLEM:
+   * ────────────
+   * Some packages have tsconfig.json path mappings like:
+   *   "cacache": ["./src/external/cacache"]
+   *
+   * This creates a circular dependency during bundling:
+   *
+   *   ┌─────────────────────────────────────────────────┐
+   *   │                                                 │
+   *   │  esbuild bundles: src/external/cacache.js      │
+   *   │       ↓                                         │
+   *   │  File contains: require('cacache')             │
+   *   │       ↓                                         │
+   *   │  tsconfig redirects: 'cacache' → src/external/ │ ← LOOP!
+   *   │       ↓                                         │
+   *   │  esbuild tries to bundle: src/external/cacache │
+   *   │       ↓                                         │
+   *   │  Circular reference! ⚠️                         │
+   *   └─────────────────────────────────────────────────┘
+   *
+   * THE SOLUTION:
+   * ─────────────
+   * This plugin intercepts resolution and forces these packages to resolve
+   * from node_modules, bypassing the tsconfig path mappings:
+   *
+   *   src/external/cacache.js
+   *       ↓
+   *   require('cacache')
+   *       ↓
+   *   Plugin intercepts → node_modules/cacache ✓
+   *
+   * PACKAGES WITH ACTUAL TSCONFIG MAPPINGS (as of now):
+   * ────────────────────────────────────────────────────
+   * ✓ cacache              - line 37 in tsconfig.json
+   * ✓ make-fetch-happen    - line 38 in tsconfig.json
+   * ✓ fast-sort            - line 39 in tsconfig.json
+   * ✓ pacote               - line 40 in tsconfig.json
+   *
+   * ADDITIONAL PACKAGES (defensive):
+   * ────────────────────────────────
+   * · libnpmexec           - Related to pacote, included for consistency
+   * · libnpmpack           - Related to pacote, included for consistency
+   * · npm-package-arg      - Related to pacote, included for consistency
+   * · normalize-package-data - Related to npm packages, included for consistency
+   *
+   * NOTE: Other external packages (debug, del, semver, etc.) don't have
+   * tsconfig mappings, so they naturally resolve from node_modules without
+   * needing to be listed here.
+   */
+  const packagesWithPathMappings = [
+    'cacache',
+    'make-fetch-happen',
+    'fast-sort',
+    'pacote',
+    'libnpmexec',
+    'libnpmpack',
+    'npm-package-arg',
+    'normalize-package-data',
+  ]
+
+  return {
+    name: 'force-node-modules',
+    setup(build) {
+      for (const pkg of packagesWithPathMappings) {
+        build.onResolve({ filter: new RegExp(`^${pkg}$`) }, args => {
+          // Only intercept if not already in node_modules
+          if (!args.importer.includes('node_modules')) {
+            try {
+              return { path: requireResolve.resolve(pkg), external: false }
+            } catch {
+              // Package not found, let esbuild handle the error
+              return null
+            }
+          }
+          return null
+        })
+      }
+    },
+  }
+}
+
+/**
+ * Create esbuild plugin to stub modules using files from stubs/ directory.
+ *
+ * @param {Record<string, string>} stubMap - Map of regex patterns to stub filenames
+ * @returns {import('esbuild').Plugin}
+ */
+function createStubPlugin(stubMap = STUB_MAP) {
+  // Pre-compile regex patterns and load stub contents
+  const stubs = Object.entries(stubMap).map(([pattern, filename]) => ({
+    filter: new RegExp(pattern),
+    contents: readFileSync(path.join(stubsDir, filename), 'utf8'),
+    stubFile: filename,
+  }))
+
+  return {
+    name: 'stub-modules',
+    setup(build) {
+      for (const { contents, filter, stubFile } of stubs) {
+        // Resolve: mark modules as stubbed
+        build.onResolve({ filter }, args => ({
+          path: args.path,
+          namespace: `stub:${stubFile}`,
+        }))
+
+        // Load: return stub file contents
+        build.onLoad({ filter: /.*/, namespace: `stub:${stubFile}` }, () => ({
+          contents,
+          loader: 'js',
+        }))
+      }
+    },
+  }
+}
+
+/**
+ * Get package-specific esbuild options.
+ *
+ * @param {string} packageName - The package name
+ * @returns {object} Package-specific esbuild options
+ */
+export function getPackageSpecificOptions(packageName) {
+  const opts = {}
+
+  if (packageName === 'browserslist') {
+    // Browserslist's data updates frequently - we can exclude some update checking.
+    opts.define = {
+      'process.versions.node': '"18.0.0"',
+    }
+  } else if (packageName === 'zod') {
+    // Zod has localization files we don't need.
+    opts.external = [...(opts.external || []), './locales/*']
+  } else if (packageName.startsWith('@inquirer/')) {
+    // Inquirer packages have heavy dependencies we might not need.
+    opts.external = [...(opts.external || []), 'rxjs/operators']
+  } else if (packageName === '@socketregistry/packageurl-js') {
+    // packageurl-js imports from socket-lib, creating a circular dependency.
+    // Mark socket-lib imports as external to avoid bundling issues.
+    opts.external = [...(opts.external || []), '@socketsecurity/lib/*']
+  } else if (packageName === 'yargs-parser') {
+    // yargs-parser uses import.meta.url which isn't available in CommonJS.
+    // Replace import.meta.url with __filename wrapped in pathToFileURL.
+    opts.define = {
+      ...opts.define,
+      'import.meta.url': '__filename',
+    }
+  }
+
+  return opts
+}
+
+/**
+ * Get base esbuild configuration for bundling.
+ *
+ * @param {string} entryPoint - Entry point path
+ * @param {string} outfile - Output file path
+ * @param {object} packageOpts - Package-specific options
+ * @returns {object} esbuild configuration
+ */
+export function getEsbuildConfig(entryPoint, outfile, packageOpts = {}) {
+  return {
+    entryPoints: [entryPoint],
+    bundle: true,
+    platform: 'node',
+    target: 'node18',
+    format: 'cjs',
+    outfile,
+    external: [
+      'node:*',
+      'fs',
+      'path',
+      'os',
+      'crypto',
+      'stream',
+      'util',
+      'events',
+      'child_process',
+      'http',
+      'https',
+      'net',
+      'url',
+      'zlib',
+      'buffer',
+      'querystring',
+      'string_decoder',
+      'tty',
+      'assert',
+      'perf_hooks',
+      'worker_threads',
+      'v8',
+      'vm',
+      '@socketsecurity/registry',
+      ...(packageOpts.external || []),
+    ],
+    plugins: [createForceNodeModulesPlugin(), createStubPlugin()],
+    minify: false,
+    sourcemap: false,
+    metafile: true,
+    logLevel: 'error',
+    treeShaking: true,
+    // Keep function names for better error messages.
+    keepNames: true,
+    // Additional optimizations:
+    pure: ['console.log', 'console.debug', 'console.warn'],
+    drop: ['debugger', 'console'],
+    ignoreAnnotations: false,
+    // Define compile-time constants for dead code elimination.
+    define: {
+      'process.env.NODE_ENV': '"production"',
+      __DEV__: 'false',
+      'global.GENTLY': 'false',
+      'process.env.DEBUG': 'undefined',
+      'process.browser': 'false',
+      'process.env.VERBOSE': 'false',
+      window: 'undefined',
+      document: 'undefined',
+      navigator: 'undefined',
+      HTMLElement: 'undefined',
+      localStorage: 'undefined',
+      sessionStorage: 'undefined',
+      XMLHttpRequest: 'undefined',
+      WebSocket: 'undefined',
+      __TEST__: 'false',
+      'process.env.CI': 'false',
+      __JEST__: 'false',
+      __MOCHA__: 'false',
+      'process.env.JEST_WORKER_ID': 'undefined',
+      'process.env.NODE_TEST': 'undefined',
+      ...packageOpts.define,
+    },
+    charset: 'utf8',
+    // Banner for generated code
+    banner: {
+      js: '"use strict";',
+    },
+  }
+}
diff --git a/scripts/build-externals/local-packages.mjs b/scripts/build-externals/local-packages.mjs
new file mode 100644
index 0000000..363db6d
--- /dev/null
+++ b/scripts/build-externals/local-packages.mjs
@@ -0,0 +1,87 @@
+/**
+ * @fileoverview Local package resolution for development.
+ * Checks for local workspace or sibling project versions.
+ */
+
+import { promises as fs } from 'node:fs'
+import path from 'node:path'
+
+/**
+ * Check if local workspace or sibling project versions exist.
+ * Used for development to use local changes instead of published packages.
+ *
+ * @param {string} packageName - The package name to search for
+ * @param {string} rootDir - The root directory of the project
+ * @returns {Promise<string|null>} Path to local package or null
+ */
+export async function getLocalPackagePath(packageName, rootDir) {
+  const checks = []
+
+  // Check workspace packages (e.g. @socketregistry/yocto-spinner).
+  if (packageName.startsWith('@socketregistry/')) {
+    const pkgName = packageName.replace('@socketregistry/', '')
+    const workspacePath = path.resolve(
+      rootDir,
+      '..',
+      'packages',
+      'npm',
+      pkgName,
+    )
+    checks.push(workspacePath)
+  }
+
+  // Check sibling projects (e.g. socket-packageurl-js).
+  if (packageName === '@socketregistry/packageurl-js') {
+    const siblingPath = path.resolve(
+      rootDir,
+      '..',
+      '..',
+      'socket-packageurl-js',
+    )
+    checks.push(siblingPath)
+  }
+
+  // Return first existing path.
+  for (const checkPath of checks) {
+    try {
+      await fs.access(path.join(checkPath, 'package.json'))
+      return checkPath
+    } catch {
+      // Path doesn't exist, continue.
+    }
+  }
+
+  return null
+}
+
+/**
+ * Resolve the entry point for a local package.
+ *
+ * @param {string} localPath - Path to the local package
+ * @returns {Promise<string>} Entry point path
+ */
+export async function resolveLocalEntryPoint(localPath) {
+  const localPkgJson = JSON.parse(
+    await fs.readFile(path.join(localPath, 'package.json'), 'utf8'),
+  )
+
+  // Resolve the main export - handle nested exports structure.
+  let mainExport = localPkgJson.main || 'index.js'
+  const exportsField = localPkgJson.exports?.['.']
+
+  if (exportsField) {
+    if (typeof exportsField === 'string') {
+      mainExport = exportsField
+    } else if (typeof exportsField === 'object') {
+      // Try to find default export in nested structure.
+      mainExport =
+        exportsField.node?.default?.default ||
+        exportsField.node?.default ||
+        exportsField.default?.default ||
+        exportsField.default ||
+        mainExport
+    }
+  }
+
+  return path.join(localPath, mainExport)
+}
diff --git a/scripts/build-externals/orchestrator.mjs b/scripts/build-externals/orchestrator.mjs
new file mode 100644
index 0000000..24f8bc4
--- /dev/null
+++ b/scripts/build-externals/orchestrator.mjs
@@ -0,0 +1,156 @@
+/**
+ * @fileoverview Main entry point for bundling external dependencies.
+ * Orchestrates bundling and reporting.
+ */
+
+import path from 'node:path'
+import { fileURLToPath } from 'node:url'
+
+import { bundlePackage } from './bundler.mjs'
+import { externalPackages, scopedPackages } from './config.mjs'
+import { ensureDir } from './copy-files.mjs'
+
+const __dirname = path.dirname(fileURLToPath(import.meta.url))
+const rootDir = path.resolve(__dirname, '..', '..')
+const distExternalDir = path.join(rootDir, 'dist', 'external')
+
+/**
+ * Bundle all external packages.
+ *
+ * @param {object} options - Options
+ * @param {boolean} options.quiet - Suppress individual package output
+ * @returns {Promise<{bundledCount: number, totalSize: number}>}
+ */
+async function bundleAllPackages(options = {}) {
+  const { quiet = false } = options
+  let bundledCount = 0
+  let totalSize = 0
+
+  // Bundle each external package.
+  for (const { bundle, name } of externalPackages) {
+    if (bundle) {
+      const outputPath = path.join(distExternalDir, `${name}.js`)
+      const size = await bundlePackage(name, outputPath, {
+        quiet,
+        rootDir,
+      })
+      if (size) {
+        bundledCount++
+        totalSize += size
+      }
+    }
+  }
+
+  // Bundle scoped packages.
+  for (const { name, optional, packages, scope, subpaths } of scopedPackages) {
+    const scopeDir = path.join(distExternalDir, scope)
+    await ensureDir(scopeDir)
+
+    if (name) {
+      // Single package in scope.
+      const outputPath = path.join(scopeDir, `${name}.js`)
+      if (optional) {
+        try {
+          const size = await bundlePackage(`${scope}/${name}`, outputPath, {
+            quiet,
+            rootDir,
+          })
+          if (size) {
+            bundledCount++
+            totalSize += size
+          }
+        } catch {
+          if (!quiet) {
+            console.log(`  Skipping optional package ${scope}/${name}`)
+          }
+        }
+      } else {
+        const size = await bundlePackage(`${scope}/${name}`, outputPath, {
+          quiet,
+          rootDir,
+        })
+        if (size) {
+          bundledCount++
+          totalSize += size
+        }
+      }
+    } else if (packages) {
+      // Multiple packages in scope.
+      for (const pkg of packages) {
+        const outputPath = path.join(scopeDir, `${pkg}.js`)
+        if (optional) {
+          try {
+            const size = await bundlePackage(`${scope}/${pkg}`, outputPath, {
+              quiet,
+              rootDir,
+            })
+            if (size) {
+              bundledCount++
+              totalSize += size
+            }
+          } catch {
+            if (!quiet) {
+              console.log(`  Skipping optional package ${scope}/${pkg}`)
+            }
+          }
+        } else {
+          const size = await bundlePackage(`${scope}/${pkg}`, outputPath, {
+            quiet,
+            rootDir,
+          })
+          if (size) {
+            bundledCount++
+            totalSize += size
+          }
+        }
+      }
+    }
+
+    // Bundle subpath exports (e.g., @npmcli/package-json/lib/read-package)
+    if (subpaths) {
+      for (const subpath of subpaths) {
+        const outputPath = path.join(distExternalDir, scope, subpath)
+        const packageName = `${scope}/${subpath}`
+        // Ensure parent directory exists
+        await ensureDir(path.dirname(outputPath))
+        const size = await bundlePackage(packageName, outputPath, {
+          quiet,
+          rootDir,
+        })
+        if (size) {
+          bundledCount++
+          totalSize += size
+        }
+      }
+    }
+  }
+
+  return { bundledCount, totalSize }
+}
+
+/**
+ * Main build function.
+ *
+ * @param {object} options - Build options
+ * @param {boolean} options.verbose - Show detailed output
+ * @param {boolean} options.quiet - Suppress all output
+ * @returns {Promise<void>}
+ */
+export async function buildExternals(options = {}) {
+  const { quiet = false, verbose = false } = options
+
+  // Default behavior: show header but not individual packages (concise)
+  // --verbose: show all package details
+  // --quiet: show nothing
+  const showDetails = verbose && !quiet
+
+  // Ensure dist/external directory exists.
+  await ensureDir(distExternalDir)
+
+  // Bundle all packages
+  const { bundledCount, totalSize } = await bundleAllPackages({
+    quiet: quiet || !showDetails,
+  })
+
+  return { bundledCount, totalSize }
+}
diff --git a/scripts/build-externals/stubs/README.md b/scripts/build-externals/stubs/README.md
new file mode 100644
index 0000000..6d98fbf
--- /dev/null
+++ b/scripts/build-externals/stubs/README.md
@@ -0,0 +1,72 @@
+# External Dependency Stubs
+
+This directory contains stub modules used during the external package bundling process to replace unused dependencies and reduce bundle size.
+
+**Philosophy:** Be conservative. Only stub dependencies that are provably unused or already disabled.
+
+## How It Works
+
+The build-externals system bundles external npm dependencies (like pacote, cacache, make-fetch-happen) into standalone modules in `dist/external/`. During bundling, esbuild uses the stubs in this directory to replace dependencies we don't need.
+
+The stub configuration lives in `../esbuild-config.mjs`, which maps module patterns to stub files:
+
+```javascript
+const STUB_MAP = {
+  '^(encoding|iconv-lite)$': 'encoding.cjs',
+  '^debug$': 'debug.cjs',
+}
+```
+
+When esbuild encounters `require('encoding')` during bundling, it replaces it with the contents of `encoding.cjs` instead of bundling the entire encoding package.
+
+## Stub Types
+
+This directory provides both active stubs (currently in use) and utility stubs (available for future use):
+
+### Utility Stubs (Available for Use)
+
+**`empty.cjs`** - Empty object for unused modules
+- Exports: `{}`
+- Use case: Dependencies referenced but never executed
+
+**`noop.cjs`** - No-op function for optional features
+- Exports: Function that does nothing
+- Use case: Logging, debugging, optional callbacks
+
+**`throw.cjs`** - Error-throwing for unexpected usage
+- Exports: Function that throws descriptive error
+- Use case: Code paths that should never execute
+
+### Active Stubs (Currently in Use)
+
+**`encoding.cjs`** - Character encoding stub
+- Replaces: `encoding`, `iconv-lite`
+- Reason: We only use UTF-8, don't need legacy encoding support
+- Size impact: ~9KB saved (pacote, make-fetch-happen)
+
+**`debug.cjs`** - Debug logging stub
+- Replaces: `debug` module
+- Reason: Already compiled out via `process.env.DEBUG = undefined`
+- Size impact: ~9KB saved
+
+## Adding New Stubs
+
+**Before adding a stub:**
+1. Verify the dependency is truly unused via code analysis
+2. Check if it's already disabled via esbuild `define` constants
+3. Consider the risk - conservative only!
+
+**To add a stub:**
+1. Create stub file in this directory
+2. Document what it replaces and why it's safe
+3. Add entry to `STUB_MAP` in `../esbuild-config.mjs`
+4. Test: `pnpm build && pnpm test`
+5. Verify size savings: `du -sh dist/external`
+
+## Testing Stubs
+
+After adding stubs, verify:
+1. Build succeeds: `pnpm build`
+2. Tests pass: `pnpm test`
+3. No runtime errors in dependent packages
+4. Bundle size decreased as expected
diff --git a/scripts/build-externals/stubs/debug.cjs b/scripts/build-externals/stubs/debug.cjs
new file mode 100644
index 0000000..687303f
--- /dev/null
+++ b/scripts/build-externals/stubs/debug.cjs
@@ -0,0 +1,24 @@
+/**
+ * Debug stub - stubs out debug logging.
+ *
+ * Many npm packages include debug() calls for verbose logging.
+ * In production, these are disabled via process.env.DEBUG.
+ * This stub removes the debug module entirely.
+ *
+ * Used by: Various npm packages
+ * Savings: ~9KB + removes debug dependency checks
+ */
+'use strict'
+
+// Return a no-op function that accepts any arguments
+function debug() {
+  return function noop() {}
+}
+
+// Common debug properties
+debug.enabled = false
+debug.names = []
+debug.skips = []
+debug.formatters = {}
+
+module.exports = debug
diff --git a/scripts/build-externals/stubs/empty.cjs b/scripts/build-externals/stubs/empty.cjs
new file mode 100644
index 0000000..cb0c90c
--- /dev/null
+++ b/scripts/build-externals/stubs/empty.cjs
@@ -0,0 +1,7 @@
+/**
+ * Empty stub - provides no functionality.
+ * Used for dependencies that are never actually called in our code paths.
+ */
+'use strict'
+
+module.exports = {}
diff --git a/scripts/build-externals/stubs/encoding.cjs b/scripts/build-externals/stubs/encoding.cjs
new file mode 100644
index 0000000..0bc4de6
--- /dev/null
+++ b/scripts/build-externals/stubs/encoding.cjs
@@ -0,0 +1,11 @@
+/**
+ * Encoding/iconv-lite stub.
+ *
+ * These packages provide character encoding conversion (e.g., UTF-8 to Latin1).
+ * We only work with UTF-8, so we stub them out to save ~100KB.
+ *
+ * Used by: make-fetch-happen, pacote (for legacy content-encoding)
+ */
+'use strict'
+
+module.exports = {}
diff --git a/scripts/build-externals/stubs/noop.cjs b/scripts/build-externals/stubs/noop.cjs
new file mode 100644
index 0000000..47a07ad
--- /dev/null
+++ b/scripts/build-externals/stubs/noop.cjs
@@ -0,0 +1,10 @@
+/**
+ * No-op stub - provides functions that do nothing.
+ * Used for optional features we don't need (logging, debugging, etc).
+ */
+'use strict'
+
+const noop = () => {}
+
+module.exports = noop
+module.exports.default = noop
diff --git a/scripts/build-externals/stubs/throw.cjs b/scripts/build-externals/stubs/throw.cjs
new file mode 100644
index 0000000..93d6a42
--- /dev/null
+++ b/scripts/build-externals/stubs/throw.cjs
@@ -0,0 +1,15 @@
+/**
+ * Throw stub - errors if called.
+ * Used for dependencies that should never be reached in production.
+ * Helps catch bugs if accidentally called.
+ */
+'use strict'
+
+function throwStub(moduleName) {
+  throw new Error(
+    `Module '${moduleName}' is stubbed and should not be called. ` +
+      'This is likely a bundling error or unexpected code path.',
+  )
+}
+
+module.exports = throwStub
diff --git a/scripts/build-js.mjs b/scripts/build-js.mjs
deleted file mode 100644
index b93eba1..0000000
--- a/scripts/build-js.mjs
+++ /dev/null
@@ -1,130 +0,0 @@
-/**
- * @fileoverview JavaScript compilation using esbuild (10x faster than tsgo)
- * This replaces tsgo for JS compilation while keeping tsgo for declarations
- */
-// eslint-disable-next-line n/no-extraneous-import
-import { build, context } from 'esbuild'
-import {
-  analyzeMetafile,
-  buildConfig,
-  watchConfig,
-} from '../.config/esbuild.config.mjs'
-import { printError, printSuccess } from './utils/helpers.mjs'
-
-const isQuiet = process.argv.includes('--quiet')
-const isVerbose = process.argv.includes('--verbose')
-const isWatch = process.argv.includes('--watch')
-
-/**
- * Standard build for production
- */
-async function buildJS() {
-  try {
-    if (!isQuiet) {
-      console.log('→ Building JavaScript with esbuild')
-    }
-
-    const startTime = Date.now()
-    const result = await build({
-      ...buildConfig,
-      logLevel: isQuiet ? 'silent' : isVerbose ? 'debug' : 'info',
-    })
-
-    const buildTime = Date.now() - startTime
-
-    if (!isQuiet) {
-      console.log(`  JavaScript built in ${buildTime}ms`)
-
-      if (result?.metafile && isVerbose) {
-        const analysis = analyzeMetafile(result.metafile)
-        console.log(`  Total size: ${analysis.totalSize}`)
-      }
-    }
-
-    return 0
-  } catch (error) {
-    if (!isQuiet) {
-      printError('JavaScript build failed')
-      console.error(error)
-    }
-    return 1
-  }
-}
-
-/**
- * Watch mode with incremental builds (68% faster rebuilds)
- */
-async function watchJS() {
-  try {
-    if (!isQuiet) {
-      console.log('→ Starting watch mode with incremental builds')
-      console.log('  Watching for file changes...')
-    }
-
-    const ctx = await context({
-      ...watchConfig,
-      logLevel: isQuiet ? 'silent' : isVerbose ? 'debug' : 'warning',
-      plugins: [
-        ...(watchConfig.plugins || []),
-        {
-          name: 'rebuild-logger',
-          setup(build) {
-            build.onEnd(result => {
-              if (result.errors.length > 0) {
-                if (!isQuiet) {
-                  printError('Rebuild failed')
-                }
-              } else {
-                if (!isQuiet) {
-                  printSuccess('Rebuild succeeded')
-
-                  if (result?.metafile && isVerbose) {
-                    const analysis = analyzeMetafile(result.metafile)
-                    console.log(`  Total size: ${analysis.totalSize}`)
-                  }
-                }
-              }
-            })
-          },
-        },
-      ],
-    })
-
-    await ctx.watch()
-
-    // Keep process alive
-    process.on('SIGINT', async () => {
-      if (!isQuiet) {
-        console.log('\nStopping watch mode...')
-      }
-      await ctx.dispose()
-      process.exit(0)
-    })
-
-    // Wait indefinitely
-    await new Promise(() => {})
-  } catch (error) {
-    if (!isQuiet) {
-      printError('Watch mode failed')
-      console.error(error)
-    }
-    return 1
-  }
-}
-
-// Main
-if (isWatch) {
-  watchJS().catch(error => {
-    console.error(error)
-    process.exit(1)
-  })
-} else {
-  buildJS()
-    .then(code => {
-      process.exitCode = code
-    })
-    .catch(error => {
-      console.error(error)
-      process.exitCode = 1
-    })
-}
diff --git a/scripts/build.mjs b/scripts/build.mjs
deleted file mode 100644
index 9724262..0000000
--- a/scripts/build.mjs
+++ /dev/null
@@ -1,401 +0,0 @@
-/**
- * @fileoverview Fast build runner using esbuild for smaller bundles and faster builds.
- */
-
-import { existsSync } from 'node:fs'
-import path from 'node:path'
-import { fileURLToPath } from 'node:url'
-
-import { build, context } from 'esbuild'
-import colors from 'yoctocolors-cjs'
-
-import { isQuiet } from '@socketsecurity/lib/argv/flags'
-import { parseArgs } from '@socketsecurity/lib/argv/parse'
-import { logger } from '@socketsecurity/lib/logger'
-import { printFooter, printHeader } from '@socketsecurity/lib/stdio/header'
-
-import {
-  analyzeMetafile,
-  buildConfig,
-  watchConfig,
-} from '../.config/esbuild.config.mjs'
-import { runSequence } from './utils/run-command.mjs'
-
-const rootPath = path.resolve(
-  path.dirname(fileURLToPath(import.meta.url)),
-  '..',
-)
-
-/**
- * Build source code with esbuild.
- * Returns { exitCode, buildTime, result } for external logging.
- */
-async function buildSource(options = {}) {
-  const { quiet = false, skipClean = false, verbose = false } = options
-
-  if (!quiet) {
-    logger.substep('Building source code')
-  }
-
-  // Clean dist directory if needed
-  if (!skipClean) {
-    const exitCode = await runSequence([
-      {
-        args: ['scripts/load.cjs', 'clean', '--dist', '--quiet'],
-        command: 'node',
-      },
-    ])
-    if (exitCode !== 0) {
-      if (!quiet) {
-        logger.error('Clean failed')
-      }
-      return { exitCode, buildTime: 0, result: null }
-    }
-  }
-
-  try {
-    const startTime = Date.now()
-    // Determine log level based on verbosity
-    const logLevel = quiet ? 'silent' : verbose ? 'info' : 'warning'
-    const result = await build({
-      ...buildConfig,
-      logLevel,
-    })
-    const buildTime = Date.now() - startTime
-
-    return { exitCode: 0, buildTime, result }
-  } catch (error) {
-    if (!quiet) {
-      logger.error('Source build failed')
-      console.error(error)
-    }
-    return { exitCode: 1, buildTime: 0, result: null }
-  }
-}
-
-/**
- * Build TypeScript declarations.
- * Returns exitCode for external logging.
- */
-async function buildTypes(options = {}) {
-  const {
-    quiet = false,
-    skipClean = false,
-    verbose: _verbose = false,
-  } = options
-
-  if (!quiet) {
-    logger.substep('Building TypeScript declarations')
-  }
-
-  const commands = []
-
-  if (!skipClean) {
-    commands.push({
-      args: ['scripts/load.cjs', 'clean', '--types', '--quiet'],
-      command: 'node',
-    })
-  }
-
-  commands.push({
-    args: ['exec', 'tsgo', '--project', '.config/tsconfig.dts.json'],
-    command: 'pnpm',
-  })
-
-  const exitCode = await runSequence(commands)
-
-  if (exitCode !== 0) {
-    if (!quiet) {
-      logger.error('Type declarations build failed')
-    }
-  }
-
-  return exitCode
-}
-
-/**
- * Watch mode for development with incremental builds (68% faster rebuilds).
- */
-async function watchBuild(options = {}) {
-  const { quiet = false, verbose = false } = options
-
-  if (!quiet) {
-    logger.step('Starting watch mode with incremental builds')
-    logger.substep('Watching for file changes...')
-  }
-
-  try {
-    // Determine log level based on verbosity
-    const logLevel = quiet ? 'silent' : verbose ? 'debug' : 'warning'
-
-    // Use context API for incremental builds (68% faster rebuilds)
-    // Extract watch option from watchConfig as it's not valid for context()
-    const { watch: _watchOpts, ...contextConfig } = watchConfig
-    const ctx = await context({
-      ...contextConfig,
-      logLevel,
-      plugins: [
-        ...(contextConfig.plugins || []),
-        {
-          name: 'rebuild-logger',
-          setup(build) {
-            build.onEnd(result => {
-              if (result.errors.length > 0) {
-                if (!quiet) {
-                  logger.error('Rebuild failed')
-                }
-              } else {
-                if (!quiet) {
-                  logger.success('Rebuild succeeded')
-                  if (result?.metafile && verbose) {
-                    const analysis = analyzeMetafile(result.metafile)
-                    logger.info(`Bundle size: ${analysis.totalSize}`)
-                  }
-                }
-              }
-            })
-          },
-        },
-      ],
-    })
-
-    // Enable watch mode
-    await ctx.watch()
-
-    // Keep the process alive
-    process.on('SIGINT', async () => {
-      await ctx.dispose()
-      process.exitCode = 0
-      throw new Error('Watch mode interrupted')
-    })
-
-    // Wait indefinitely
-    await new Promise(() => {})
-  } catch (error) {
-    if (!quiet) {
-      logger.error('Watch mode failed:', error)
-    }
-    return 1
-  }
-}
-
-/**
- * Check if build is needed.
- */
-function isBuildNeeded() {
-  const distPath = path.join(rootPath, 'dist', 'index.js')
-  const distTypesPath = path.join(rootPath, 'dist', 'types', 'index.d.ts')
-
-  return !existsSync(distPath) || !existsSync(distTypesPath)
-}
-
-async function main() {
-  try {
-    // Parse arguments
-    const { values } = parseArgs({
-      options: {
-        help: {
-          type: 'boolean',
-          default: false,
-        },
-        src: {
-          type: 'boolean',
-          default: false,
-        },
-        types: {
-          type: 'boolean',
-          default: false,
-        },
-        watch: {
-          type: 'boolean',
-          default: false,
-        },
-        needed: {
-          type: 'boolean',
-          default: false,
-        },
-        analyze: {
-          type: 'boolean',
-          default: false,
-        },
-        silent: {
-          type: 'boolean',
-          default: false,
-        },
-        quiet: {
-          type: 'boolean',
-          default: false,
-        },
-        verbose: {
-          type: 'boolean',
-          default: false,
-        },
-      },
-      allowPositionals: false,
-      strict: false,
-    })
-
-    // Show help if requested
-    if (values.help) {
-      console.log('Build Runner')
-      console.log('\nUsage: pnpm build [options]')
-      console.log('\nOptions:')
-      console.log('  --help       Show this help message')
-      console.log('  --src        Build source code only')
-      console.log('  --types      Build TypeScript declarations only')
-      console.log(
-        '  --watch      Watch mode with incremental builds (68% faster rebuilds)',
-      )
-      console.log('  --needed     Only build if dist files are missing')
-      console.log('  --analyze    Show bundle size analysis')
-      console.log('  --quiet, --silent  Suppress progress messages')
-      console.log('  --verbose    Show detailed build output')
-      console.log('\nExamples:')
-      console.log('  pnpm build              # Full build (source + types)')
-      console.log('  pnpm build --src        # Build source only')
-      console.log('  pnpm build --types      # Build types only')
-      console.log(
-        '  pnpm build --watch      # Watch mode with incremental builds',
-      )
-      console.log('  pnpm build --analyze    # Build with size analysis')
-      console.log(
-        '\nNote: Watch mode uses esbuild context API for 68% faster rebuilds',
-      )
-      process.exitCode = 0
-      return
-    }
-
-    const quiet = isQuiet(values)
-    const verbose = values.verbose
-
-    // Check if build is needed
-    if (values.needed && !isBuildNeeded()) {
-      if (!quiet) {
-        logger.info('Build artifacts exist, skipping build')
-      }
-      process.exitCode = 0
-      return
-    }
-
-    if (!quiet) {
-      printHeader('Build Runner')
-    }
-
-    let exitCode = 0
-
-    // Handle watch mode
-    if (values.watch) {
-      exitCode = await watchBuild({ quiet, verbose })
-    }
-    // Build types only
-    else if (values.types && !values.src) {
-      if (!quiet) {
-        logger.step('Building TypeScript declarations only')
-      }
-      exitCode = await buildTypes({ quiet, verbose })
-      if (exitCode === 0 && !quiet) {
-        logger.substep('Type declarations built')
-      }
-    }
-    // Build source only
-    else if (values.src && !values.types) {
-      if (!quiet) {
-        logger.step('Building source only')
-      }
-      const {
-        buildTime,
-        exitCode: srcExitCode,
-        result,
-      } = await buildSource({ quiet, verbose, analyze: values.analyze })
-      exitCode = srcExitCode
-      if (exitCode === 0 && !quiet) {
-        logger.substep(`Source build complete in ${buildTime}ms`)
-
-        if (values.analyze && result?.metafile) {
-          const analysis = analyzeMetafile(result.metafile)
-          logger.info('Build output:')
-          for (const file of analysis.files) {
-            logger.substep(`${file.name}: ${file.size}`)
-          }
-          logger.step(`Total bundle size: ${analysis.totalSize}`)
-        }
-      }
-    }
-    // Build everything (default)
-    else {
-      if (!quiet) {
-        logger.step('Building package (source + types)')
-      }
-
-      // Clean all directories first (once)
-      if (!quiet) {
-        logger.substep('Cleaning build directories')
-      }
-      exitCode = await runSequence([
-        {
-          args: ['scripts/load.cjs', 'clean', '--dist', '--types', '--quiet'],
-          command: 'node',
-        },
-      ])
-      if (exitCode !== 0) {
-        if (!quiet) {
-          logger.error('Clean failed')
-        }
-        process.exitCode = exitCode
-        return
-      }
-
-      // Run source and types builds in parallel
-      const [srcResult, typesExitCode] = await Promise.all([
-        buildSource({
-          quiet,
-          verbose,
-          skipClean: true,
-          analyze: values.analyze,
-        }),
-        buildTypes({ quiet, verbose, skipClean: true }),
-      ])
-
-      // Log completion messages in order
-      if (!quiet) {
-        if (srcResult.exitCode === 0) {
-          logger.substep(`Source build complete in ${srcResult.buildTime}ms`)
-
-          if (values.analyze && srcResult.result?.metafile) {
-            const analysis = analyzeMetafile(srcResult.result.metafile)
-            logger.info('Build output:')
-            for (const file of analysis.files) {
-              logger.substep(`${file.name}: ${file.size}`)
-            }
-            logger.step(`Total bundle size: ${analysis.totalSize}`)
-          }
-        }
-
-        if (typesExitCode === 0) {
-          logger.substep('Type declarations built')
-        }
-      }
-
-      exitCode = srcResult.exitCode !== 0 ? srcResult.exitCode : typesExitCode
-    }
-
-    // Print final status and footer
-    if (!quiet) {
-      if (exitCode === 0) {
-        console.log(colors.green('✓ Build completed successfully!'))
-      } else {
-        console.error(colors.red('✗ Build failed'))
-      }
-      printFooter()
-    }
-
-    if (exitCode !== 0) {
-      process.exitCode = exitCode
-    }
-  } catch (error) {
-    logger.error(`Build runner failed: ${error.message}`)
-    process.exitCode = 1
-  }
-}
-
-main().catch(console.error)
diff --git a/scripts/clean.mjs b/scripts/build/clean.mjs
similarity index 93%
rename from scripts/clean.mjs
rename to scripts/build/clean.mjs
index 913b605..4cc05e0 100644
--- a/scripts/clean.mjs
+++ b/scripts/build/clean.mjs
@@ -9,14 +9,18 @@ import { fileURLToPath } from 'node:url'
 import { deleteAsync } from 'del'
 import fastGlob from 'fast-glob'
 
-import { isQuiet } from '@socketsecurity/lib/argv/flags'
-import { parseArgs } from '@socketsecurity/lib/argv/parse'
-import { logger } from '@socketsecurity/lib/logger'
-import { createSectionHeader } from '@socketsecurity/lib/stdio/header'
+import { isQuiet } from '#socketsecurity/lib/argv/flags'
+import { getDefaultLogger } from '#socketsecurity/lib/logger'
+import { printHeader } from '#socketsecurity/lib/stdio/header'
+
+import { parseArgs } from '../utils/parse-args.mjs'
+
+const logger = getDefaultLogger()
 
 const rootPath = path.resolve(
   path.dirname(fileURLToPath(import.meta.url)),
   '..',
+  '..',
 )
 
 /**
@@ -184,9 +188,7 @@ async function main() {
     }
 
     if (!quiet) {
-      console.log(
-        createSectionHeader('Clean Runner', { width: 56, borderChar: '=' }),
-      )
+      printHeader('Clean Runner')
       logger.step('Cleaning project directories')
     }
 
diff --git a/scripts/build/externals.mjs b/scripts/build/externals.mjs
new file mode 100644
index 0000000..fb2f6d7
--- /dev/null
+++ b/scripts/build/externals.mjs
@@ -0,0 +1,43 @@
+/**
+ * @fileoverview Bundle external dependencies into standalone zero-dependency modules.
+ * This bundles packages like cacache, pacote, make-fetch-happen into dist/external.
+ *
+ * Entry point that wraps the modular build-externals system.
+ */
+
+import colors from 'yoctocolors-cjs'
+
+import { isQuiet } from '#socketsecurity/lib/argv/flags'
+import { getDefaultLogger } from '#socketsecurity/lib/logger'
+import { pluralize } from '#socketsecurity/lib/words'
+
+import { buildExternals } from '../build-externals/orchestrator.mjs'
+
+const logger = getDefaultLogger()
+const printCompletedHeader = title => console.log(colors.green(`✓ ${title}`))
+
+async function main() {
+  // Check for verbose mode via isVerbose or manual check
+  const verbose = process.argv.includes('--verbose')
+  const quiet = isQuiet()
+
+  try {
+    const { bundledCount } = await buildExternals({ verbose, quiet })
+
+    if (!quiet) {
+      const title =
+        bundledCount > 0
+          ? `External Bundles (${bundledCount} ${pluralize('package', { count: bundledCount })})`
+          : 'External Bundles (no packages)'
+      printCompletedHeader(title)
+    }
+  } catch (error) {
+    logger.error(`Build failed: ${error.message || error}`)
+    process.exitCode = 1
+  }
+}
+
+main().catch(error => {
+  logger.error(`Build failed: ${error.message || error}`)
+  process.exitCode = 1
+})
diff --git a/scripts/build/js.mjs b/scripts/build/js.mjs
new file mode 100644
index 0000000..9d92066
--- /dev/null
+++ b/scripts/build/js.mjs
@@ -0,0 +1,133 @@
+/**
+ * @fileoverview JavaScript compilation using esbuild (10x faster than tsgo)
+ * This replaces tsgo for JS compilation while keeping tsgo for declarations
+ */
+
+import { build, context } from 'esbuild'
+
+import {
+  analyzeMetafile,
+  buildConfig,
+  watchConfig,
+} from '../../.config/esbuild.config.mjs'
+import { getDefaultLogger } from '#socketsecurity/lib/logger'
+
+const logger = getDefaultLogger()
+
+const isQuiet = process.argv.includes('--quiet')
+const isVerbose = process.argv.includes('--verbose')
+const isWatch = process.argv.includes('--watch')
+
+/**
+ * Standard build for production
+ */
+async function buildJS() {
+  try {
+    if (!isQuiet) {
+      console.log('→ Building JavaScript with esbuild')
+    }
+
+    const startTime = Date.now()
+    const result = await build({
+      ...buildConfig,
+      logLevel: isQuiet ? 'silent' : isVerbose ? 'debug' : 'info',
+    })
+
+    const buildTime = Date.now() - startTime
+
+    if (!isQuiet) {
+      console.log(`  JavaScript built in ${buildTime}ms`)
+
+      if (result?.metafile && isVerbose) {
+        const analysis = analyzeMetafile(result.metafile)
+        console.log(`  Total size: ${analysis.totalSize}`)
+      }
+    }
+
+    return 0
+  } catch (error) {
+    if (!isQuiet) {
+      logger.error('JavaScript build failed')
+      console.error(error)
+    }
+    return 1
+  }
+}
+
+/**
+ * Watch mode with incremental builds (68% faster rebuilds)
+ */
+async function watchJS() {
+  try {
+    if (!isQuiet) {
+      console.log('→ Starting watch mode with incremental builds')
+      console.log('  Watching for file changes...')
+    }
+
+    const ctx = await context({
+      ...watchConfig,
+      logLevel: isQuiet ? 'silent' : isVerbose ? 'debug' : 'warning',
+      plugins: [
+        ...(watchConfig.plugins || []),
+        {
+          name: 'rebuild-logger',
+          setup(build) {
+            build.onEnd(result => {
+              if (result.errors.length > 0) {
+                if (!isQuiet) {
+                  logger.error('Rebuild failed')
+                }
+              } else {
+                if (!isQuiet) {
+                  logger.success('Rebuild succeeded')
+
+                  if (result?.metafile && isVerbose) {
+                    const analysis = analyzeMetafile(result.metafile)
+                    console.log(`  Total size: ${analysis.totalSize}`)
+                  }
+                }
+              }
+            })
+          },
+        },
+      ],
+    })
+
+    await ctx.watch()
+
+    // Keep process alive
+    process.on('SIGINT', async () => {
+      if (!isQuiet) {
+        console.log('\nStopping watch mode...')
+      }
+      await ctx.dispose()
+      process.exit(0)
+    })
+
+    // Wait indefinitely
+    await new Promise(() => {})
+  } catch (error) {
+    if (!isQuiet) {
+      logger.error('Watch mode failed')
+      console.error(error)
+    }
+    return 1
+  }
+}
+
+// Main
+if (isWatch) {
+  watchJS().catch(error => {
+    console.error(error)
+    process.exit(1)
+  })
+} else {
+  buildJS()
+    .then(code => {
+      process.exitCode = code
+    })
+    .catch(error => {
+      console.error(error)
+      process.exitCode = 1
+    })
+}
diff --git a/scripts/build/main.mjs b/scripts/build/main.mjs
new file mode 100644
index 0000000..b288d45
--- /dev/null
+++ b/scripts/build/main.mjs
@@ -0,0 +1,466 @@
+/**
+ * @fileoverview Fast build runner using esbuild for smaller bundles and faster builds.
+ */
+
+import { existsSync } from 'node:fs'
+import path from 'node:path'
+import { fileURLToPath } from 'node:url'
+
+import { build, context } from 'esbuild'
+import colors from 'yoctocolors-cjs'
+
+import {
+  analyzeMetafile,
+  buildConfig,
+  watchConfig,
+} from '../../.config/esbuild.config.mjs'
+import { isQuiet } from '#socketsecurity/lib/argv/flags'
+import { getDefaultLogger } from '#socketsecurity/lib/logger'
+import { printFooter, printHeader } from '#socketsecurity/lib/stdio/header'
+
+import { parseArgs } from '../utils/parse-args.mjs'
+import { runSequence } from '../utils/run-command.mjs'
+
+const logger = getDefaultLogger()
+
+// Helper for completed headers (simple wrapper)
+const printCompletedHeader = title => console.log(colors.green(`✓ ${title}`))
+
+const rootPath = path.resolve(
+  path.dirname(fileURLToPath(import.meta.url)),
+  '..',
+  '..',
+)
+
+/**
+ * Build source code with esbuild.
+ * Returns { exitCode, buildTime, result } for external logging.
+ */
+async function buildSource(options = {}) {
+  const { quiet = false, skipClean = false, verbose = false } = options
+
+  // Clean dist directory if needed
+  if (!skipClean) {
+    const exitCode = await runSequence([
+      {
+        args: ['scripts/build/clean.mjs', '--dist', '--quiet'],
+        command: 'node',
+      },
+    ])
+    if (exitCode !== 0) {
+      if (!quiet) {
+        logger.error('Clean failed')
+      }
+      return { exitCode, buildTime: 0, result: null }
+    }
+  }
+
+  try {
+    const startTime = Date.now()
+    // Determine log level based on verbosity
+    const logLevel = quiet ? 'silent' : verbose ? 'info' : 'warning'
+    const result = await build({
+      ...buildConfig,
+      logLevel,
+    })
+    const buildTime = Date.now() - startTime
+
+    return { exitCode: 0, buildTime, result }
+  } catch (error) {
+    if (!quiet) {
+      logger.error('Source build failed')
+      console.error(error)
+    }
+    return { exitCode: 1, buildTime: 0, result: null }
+  }
+}
+
+/**
+ * Build TypeScript declarations.
+ * Returns exitCode for external logging.
+ */
+async function buildTypes(options = {}) {
+  const {
+    quiet = false,
+    skipClean = false,
+    verbose: _verbose = false,
+  } = options
+
+  const commands = []
+
+  if (!skipClean) {
+    commands.push({
+      args: ['scripts/build/clean.mjs', '--types', '--quiet'],
+      command: 'node',
+    })
+  }
+
+  commands.push({
+    args: ['exec', 'tsgo', '--project', 'tsconfig.dts.json'],
+    command: 'pnpm',
+    options: {
+      ...(process.platform === 'win32' && { shell: true }),
+    },
+  })
+
+  const exitCode = await runSequence(commands)
+
+  if (exitCode !== 0) {
+    if (!quiet) {
+      logger.error('Type declarations build failed')
+    }
+  }
+
+  return exitCode
+}
+
+/**
+ * Build external dependencies.
+ * Returns exitCode for external logging.
+ */
+async function buildExternals(options = {}) {
+  const { quiet = false, verbose = false } = options
+
+  const args = ['scripts/build/externals.mjs']
+  if (quiet) {
+    args.push('--quiet')
+  }
+  if (verbose) {
+    args.push('--verbose')
+  }
+
+  const exitCode = await runSequence([
+    {
+      args,
+      command: 'node',
+    },
+  ])
+
+  if (exitCode !== 0) {
+    if (!quiet) {
+      logger.error('External dependencies build failed')
+    }
+  }
+
+  return exitCode
+}
+
+/**
+ * Fix exports after build.
+ * Returns exitCode for external logging.
+ */
+async function fixExports(options = {}) {
+  const { quiet = false, verbose = false } = options
+
+  const fixArgs = ['scripts/fix/main.mjs']
+  if (quiet) {
+    fixArgs.push('--quiet')
+  }
+  if (verbose) {
+    fixArgs.push('--verbose')
+  }
+
+  const exitCode = await runSequence([
+    {
+      args: fixArgs,
+      command: 'node',
+    },
+  ])
+
+  if (exitCode !== 0) {
+    if (!quiet) {
+      logger.error('Build fixing failed')
+    }
+  }
+
+  return exitCode
+}
+
+/**
+ * Watch mode for development with incremental builds (68% faster rebuilds).
+ */
+async function watchBuild(options = {}) {
+  const { quiet = false, verbose = false } = options
+
+  if (!quiet) {
+    logger.step('Starting watch mode with incremental builds')
+    logger.substep('Watching for file changes...')
+  }
+
+  try {
+    // Determine log level based on verbosity
+    const logLevel = quiet ? 'silent' : verbose ? 'debug' : 'warning'
+
+    // Use context API for incremental builds (68% faster rebuilds)
+    // Extract watch option from watchConfig as it's not valid for context()
+    const { watch: _watchOpts, ...contextConfig } = watchConfig
+    const ctx = await context({
+      ...contextConfig,
+      logLevel,
+      plugins: [
+        ...(contextConfig.plugins || []),
+        {
+          name: 'rebuild-logger',
+          setup(build) {
+            build.onEnd(result => {
+              if (result.errors.length > 0) {
+                if (!quiet) {
+                  logger.error('Rebuild failed')
+                }
+              } else {
+                if (!quiet) {
+                  logger.success('Rebuild succeeded')
+                  if (result?.metafile && verbose) {
+                    const analysis = analyzeMetafile(result.metafile)
+                    logger.info(`Bundle size: ${analysis.totalSize}`)
+                  }
+                }
+              }
+            })
+          },
+        },
+      ],
+    })
+
+    // Enable watch mode
+    await ctx.watch()
+
+    // Keep the process alive
+    process.on('SIGINT', async () => {
+      await ctx.dispose()
+      process.exitCode = 0
+      throw new Error('Watch mode interrupted')
+    })
+
+    // Wait indefinitely
+    await new Promise(() => {})
+  } catch (error) {
+    if (!quiet) {
+      logger.error('Watch mode failed:', error)
+    }
+    return 1
+  }
+}
+
+/**
+ * Check if build is needed.
+ */
+function isBuildNeeded() {
+  const distPath = path.join(rootPath, 'dist', 'index.js')
+  const distTypesPath = path.join(rootPath, 'dist', 'types', 'index.d.ts')
+
+  return !existsSync(distPath) || !existsSync(distTypesPath)
+}
+
+async function main() {
+  try {
+    // Parse arguments
+    const { values } = parseArgs({
+      options: {
+        help: {
+          type: 'boolean',
+          default: false,
+        },
+        src: {
+          type: 'boolean',
+          default: false,
+        },
+        types: {
+          type: 'boolean',
+          default: false,
+        },
+        watch: {
+          type: 'boolean',
+          default: false,
+        },
+        needed: {
+          type: 'boolean',
+          default: false,
+        },
+        analyze: {
+          type: 'boolean',
+          default: false,
+        },
+        silent: {
+          type: 'boolean',
+          default: false,
+        },
+        quiet: {
+          type: 'boolean',
+          default: false,
+        },
+        verbose: {
+          type: 'boolean',
+          default: false,
+        },
+      },
+      allowPositionals: false,
+      strict: false,
+    })
+
+    // Show help if requested
+    if (values.help) {
+      console.log('Build Runner')
+      console.log('\nUsage: pnpm build [options]')
+      console.log('\nOptions:')
+      console.log('  --help       Show this help message')
+      console.log('  --src        Build source code only')
+      console.log('  --types      Build TypeScript declarations only')
+      console.log(
+        '  --watch      Watch mode with incremental builds (68% faster rebuilds)',
+      )
+      console.log('  --needed     Only build if dist files are missing')
+      console.log('  --analyze    Show bundle size analysis')
+      console.log('  --quiet, --silent  Suppress progress messages')
+      console.log('  --verbose    Show detailed build output')
+      console.log('\nExamples:')
+      console.log('  pnpm build              # Full build (source + types)')
+      console.log('  pnpm build --src        # Build source only')
+      console.log('  pnpm build --types      # Build types only')
+      console.log(
+        '  pnpm build --watch      # Watch mode with incremental builds',
+      )
+      console.log('  pnpm build --analyze    # Build with size analysis')
+      console.log(
+        '\nNote: Watch mode uses esbuild context API for 68% faster rebuilds',
+      )
+      process.exitCode = 0
+      return
+    }
+
+    const quiet = isQuiet(values)
+    const verbose = values.verbose
+
+    // Check if build is needed
+    if (values.needed && !isBuildNeeded()) {
+      if (!quiet) {
+        logger.info('Build artifacts exist, skipping build')
+      }
+      process.exitCode = 0
+      return
+    }
+
+    let exitCode = 0
+
+    // Handle watch mode
+    if (values.watch) {
+      if (!quiet) {
+        printHeader('Build Runner (Watch Mode)')
+      }
+      exitCode = await watchBuild({ quiet, verbose })
+    }
+    // Build types only
+    else if (values.types && !values.src) {
+      if (!quiet) {
+        printHeader('Building TypeScript Declarations')
+      }
+      exitCode = await buildTypes({ quiet, verbose })
+      if (exitCode === 0 && !quiet) {
+        logger.substep('Type declarations built')
+      }
+    }
+    // Build source only
+    else if (values.src && !values.types) {
+      if (!quiet) {
+        printHeader('Building Source')
+      }
+      const {
+        buildTime,
+        exitCode: srcExitCode,
+        result,
+      } = await buildSource({ quiet, verbose, analyze: values.analyze })
+      exitCode = srcExitCode
+      if (exitCode === 0 && !quiet) {
+        logger.substep(`Source build complete in ${buildTime}ms`)
+
+        if (values.analyze && result?.metafile) {
+          const analysis = analyzeMetafile(result.metafile)
+          logger.info('Build output:')
+          for (const file of analysis.files) {
+            logger.substep(`${file.name}: ${file.size}`)
+          }
+          logger.step(`Total bundle size: ${analysis.totalSize}`)
+        }
+      }
+    }
+    // Build everything (default)
+    else {
+      if (!quiet) {
+        printHeader('Building Package')
+      }
+
+      exitCode = await runSequence([
+        {
+          args: ['scripts/build/clean.mjs', '--dist', '--types', '--quiet'],
+          command: 'node',
+        },
+      ])
+      if (exitCode !== 0) {
+        if (!quiet) {
+          logger.error('Clean failed')
+        }
+        process.exitCode = exitCode
+        return
+      }
+
+      if (!quiet) {
+        printCompletedHeader('Build Cleaned')
+      }
+
+      // Run source, externals, and types builds in parallel
+      const [srcResult, externalsExitCode, typesExitCode] = await Promise.all([
+        buildSource({
+          quiet,
+          verbose,
+          skipClean: true,
+          analyze: values.analyze,
+        }),
+        buildExternals({ quiet, verbose }),
+        buildTypes({ quiet, verbose, skipClean: true }),
+      ])
+
+      // Log completion messages if analyze flag is set
+      if (!quiet && values.analyze && srcResult.result?.metafile) {
+        const analysis = analyzeMetafile(srcResult.result.metafile)
+        logger.info('Build output:')
+        for (const file of analysis.files) {
+          logger.substep(`${file.name}: ${file.size}`)
+        }
+        logger.step(`Total bundle size: ${analysis.totalSize}`)
+      }
+
+      // Check if any of the parallel builds failed
+      exitCode =
+        srcResult.exitCode !== 0
+          ? srcResult.exitCode
+          : externalsExitCode !== 0
+            ? externalsExitCode
+            : typesExitCode
+
+      // If all parallel builds succeeded, fix exports
+      if (exitCode === 0) {
+        const fixExitCode = await fixExports({ quiet, verbose })
+        exitCode = fixExitCode
+      }
+    }
+
+    // Print final status and footer
+    if (!quiet) {
+      if (exitCode === 0) {
+        console.log(colors.green('✓ Build completed successfully!'))
+      } else {
+        console.error(colors.red('✗ Build failed'))
+      }
+      printFooter()
+    }
+
+    if (exitCode !== 0) {
+      process.exitCode = exitCode
+    }
+  } catch (error) {
+    logger.error(`Build runner failed: ${error.message}`)
+    process.exitCode = 1
+  }
+}
+
+main().catch(console.error)
diff --git a/scripts/check.mjs b/scripts/check.mjs
index e6f543a..ab2c876 100644
--- a/scripts/check.mjs
+++ b/scripts/check.mjs
@@ -8,14 +8,13 @@
  *   node scripts/check.mjs
  */
 
-import {
-  printError,
-  printFooter,
-  printHeader,
-  printSuccess,
-} from './utils/cli-helpers.mjs'
+import { getDefaultLogger } from '#socketsecurity/lib/logger'
+import { printFooter, printHeader } from '#socketsecurity/lib/stdio/header'
+
 import { runParallel } from './utils/run-command.mjs'
 
+const logger = getDefaultLogger()
+
 async function main() {
   try {
     printHeader('Code Checks')
@@ -24,10 +23,65 @@ async function main() {
       {
         args: ['exec', 'biome', 'check', '.'],
         command: 'pnpm',
+        options: {
+          ...(process.platform === 'win32' && { shell: true }),
+        },
       },
       {
         args: ['exec', 'tsgo', '--noEmit'],
         command: 'pnpm',
+        options: {
+          ...(process.platform === 'win32' && { shell: true }),
+        },
+      },
+      {
+        args: ['scripts/validate/no-link-deps.mjs'],
+        command: 'node',
+        options: {
+          ...(process.platform === 'win32' && { shell: true }),
+        },
+      },
+      {
+        args: ['scripts/validate/no-extraneous-dependencies.mjs'],
+        command: 'node',
+        options: {
+          ...(process.platform === 'win32' && { shell: true }),
+        },
+      },
+      {
+        args: ['scripts/validate/esbuild-minify.mjs'],
+        command: 'node',
+        options: {
+          ...(process.platform === 'win32' && { shell: true }),
+        },
+      },
+      {
+        args: ['scripts/validate/no-cdn-refs.mjs'],
+        command: 'node',
+        options: {
+          ...(process.platform === 'win32' && { shell: true }),
+        },
+      },
+      {
+        args: ['scripts/validate/markdown-filenames.mjs'],
+        command: 'node',
+        options: {
+          ...(process.platform === 'win32' && { shell: true }),
+        },
+      },
+      {
+        args: ['scripts/validate/file-size.mjs'],
+        command: 'node',
+        options: {
+          ...(process.platform === 'win32' && { shell: true }),
+        },
+      },
+      {
+        args: ['scripts/validate/file-count.mjs'],
+        command: 'node',
+        options: {
+          ...(process.platform === 'win32' && { shell: true }),
+        },
       },
     ]
 
@@ -35,16 +89,19 @@ async function main() {
     const failed = exitCodes.some(code => code !== 0)
 
     if (failed) {
-      printError('Some checks failed')
+      logger.error('Some checks failed')
       process.exitCode = 1
     } else {
-      printSuccess('All checks passed')
+      logger.success('All checks passed')
       printFooter()
     }
   } catch (error) {
-    printError(`Check failed: ${error.message}`)
+    logger.error(`Check failed: ${error.message}`)
     process.exitCode = 1
   }
 }
 
-main().catch(console.error)
+main().catch(e => {
+  logger.error(e)
+  process.exitCode = 1
+})
diff --git a/scripts/cherry-pick-entries.mjs b/scripts/cherry-pick-entries.mjs
deleted file mode 100644
index a359b83..0000000
--- a/scripts/cherry-pick-entries.mjs
+++ /dev/null
@@ -1,349 +0,0 @@
-/**
- * @fileoverview Cherry-picked entry points for external packages.
- * Only imports what we actually use from each package, dramatically reducing bundle size.
- */
-
-export const cherryPickEntries = {
-  // Cherry-picking for a FEATURE-RICH CLI application.
-  // We keep all user-facing features and only optimize internals.
-
-  // For packages where we can cherry-pick specific exports.
-  // NOTE: These require more complex handling and are disabled for now.
-  // They could save significant space but need proper module resolution.
-
-  zod: {
-    // Zod is 311KB. We only use basic validators in ipc.ts (object, string, number, literal, extend).
-    // Cherry-pick just what we need to significantly reduce bundle size.
-    customEntry: `
-      const z = require('zod');
-
-      // Export only the validators we actually use in ipc.ts.
-      module.exports = {
-        // Core types used in IpcMessageSchema and IpcHandshakeSchema.
-        object: z.object,
-        string: z.string,
-        number: z.number,
-        literal: z.literal,
-        unknown: z.unknown,
-
-        // Utility for default export compatibility.
-        default: z,
-      };
-
-      // This removes unused features:
-      // - Array/tuple validators
-      // - Union/intersection types
-      // - Transformers and effects
-      // - Branded types
-      // - Lazy evaluation
-      // - Error maps and i18n
-      // - Coercion helpers
-      // Estimated savings: ~150-200KB
-    `,
-  },
-
-  /*
-  'semver': {
-    // Instead of bundling ALL of semver, just get what we use.
-    customEntry: `
-      const semver = require('semver/functions/parse');
-      const compare = require('semver/functions/compare');
-      const satisfies = require('semver/functions/satisfies');
-      const coerce = require('semver/functions/coerce');
-      const valid = require('semver/functions/valid');
-      const clean = require('semver/functions/clean');
-      const inc = require('semver/functions/inc');
-      const diff = require('semver/functions/diff');
-      const major = require('semver/functions/major');
-      const minor = require('semver/functions/minor');
-      const patch = require('semver/functions/patch');
-      const prerelease = require('semver/functions/prerelease');
-      const eq = require('semver/functions/eq');
-      const neq = require('semver/functions/neq');
-      const gt = require('semver/functions/gt');
-      const gte = require('semver/functions/gte');
-      const lt = require('semver/functions/lt');
-      const lte = require('semver/functions/lte');
-      const rcompare = require('semver/functions/rcompare');
-      const sort = require('semver/functions/sort');
-      const rsort = require('semver/functions/rsort');
-
-      module.exports = {
-        parse: semver,
-        compare,
-        satisfies,
-        coerce,
-        valid,
-        clean,
-        inc,
-        diff,
-        major,
-        minor,
-        patch,
-        prerelease,
-        eq,
-        neq,
-        gt,
-        gte,
-        lt,
-        lte,
-        rcompare,
-        sort,
-        rsort,
-        // Add commonly used as direct exports.
-        default: { parse: semver, compare, satisfies, coerce, valid, clean, inc, eq, gt, gte, lt, lte }
-      };
-    `,
-    // Functions we know we don't use and can skip.
-    skipFunctions: [
-      'minVersion',
-      'minSatisfying',
-      'maxSatisfying',
-      'toComparators',
-      'simplifyRange',
-      'subset',
-      'validRange',
-      // All the Range class methods we don't use.
-      'Range',
-      'SemVer',
-      'Comparator',
-    ],
-  },
-
-  'yargs-parser': {
-    // Yargs-parser has a lot of features we don't need.
-    customEntry: `
-      const parser = require('yargs-parser');
-
-      // Create a minimal wrapper that only exposes what we use.
-      module.exports = function parse(args, opts) {
-        // We only use basic parsing, not the advanced features.
-        const minimalOpts = {
-          boolean: opts?.boolean || [],
-          string: opts?.string || [],
-          alias: opts?.alias || {},
-          default: opts?.default || {},
-          // Skip features we don't use.
-          configuration: {
-            'camel-case-expansion': false,
-            'dot-notation': false,
-            'parse-numbers': false,
-            'boolean-negation': false,
-            'combine-arrays': false,
-            'duplicate-arguments-array': false,
-            'flatten-duplicate-arrays': false,
-            'negation-prefix': 'no-',
-            'populate--': false,
-            'set-placeholder-key': false,
-            'strip-aliased': false,
-            'strip-dashed': false,
-            'unknown-options-as-args': false,
-          }
-        };
-
-        return parser(args, minimalOpts);
-      };
-
-      module.exports.default = module.exports;
-    `,
-  },
-
-  'debug': {
-    // Debug package - in production we can use a minimal stub.
-    customEntry: `
-      // Minimal debug implementation for production.
-      // Since process.env.DEBUG is undefined, all debug calls are no-ops.
-      function createDebug() {
-        const noop = () => {};
-        noop.enabled = false;
-        noop.color = '';
-        noop.diff = 0;
-        noop.namespace = '';
-        noop.destroy = () => {};
-        noop.extend = () => createDebug();
-        return noop;
-      }
-
-      createDebug.enable = () => {};
-      createDebug.disable = () => {};
-      createDebug.enabled = () => false;
-      createDebug.names = [];
-      createDebug.skips = [];
-      createDebug.formatters = {};
-      createDebug.selectColor = () => '';
-      createDebug.humanize = () => '';
-
-      module.exports = createDebug;
-      module.exports.default = createDebug;
-    `,
-  },
-
-  'picomatch': {
-    // Picomatch - we mainly use the main function, not all the utilities.
-    customEntry: `
-      const picomatch = require('picomatch/lib/picomatch');
-
-      // Only export what we actually use.
-      module.exports = picomatch;
-      module.exports.default = picomatch;
-
-      // Common methods we might use.
-      module.exports.isMatch = picomatch.isMatch || ((str, pattern, options) => {
-        const isMatch = picomatch(pattern, options);
-        return isMatch(str);
-      });
-
-      module.exports.parse = picomatch.parse || (() => ({}));
-      module.exports.compile = picomatch.compile || ((ast) => picomatch(ast));
-    `,
-  },
-
-  'fast-glob': {
-    // Fast-glob - we use sync and async, but not stream.
-    customEntry: `
-      const fg = require('fast-glob');
-
-      // Only export the methods we use.
-      module.exports = fg.glob || fg;
-      module.exports.default = module.exports;
-      module.exports.glob = fg.glob || fg;
-      module.exports.sync = fg.sync || fg.globSync;
-      module.exports.async = fg.async || fg;
-
-      // We don't use stream or generateTasks.
-      // This allows tree-shaking to remove those code paths.
-    `,
-  },
-
-  'del': {
-    // Del - we only need the main delete function.
-    customEntry: `
-      const {deleteAsync} = require('del');
-
-      // Only export what we use.
-      module.exports = deleteAsync;
-      module.exports.default = deleteAsync;
-      module.exports.deleteAsync = deleteAsync;
-
-      // We don't use deleteSync or the legacy patterns.
-    `,
-  },
-
-  */
-
-  // For validation packages, we can use simpler validators in production.
-  'validate-npm-package-name': {
-    // Simplified package name validation.
-    customEntry: `
-      // Minimal npm package name validator.
-      // Based on npm's actual rules but without all the detailed error messages.
-      module.exports = function validate(name) {
-        const errors = [];
-        const warnings = [];
-
-        if (!name) {
-          errors.push('name cannot be empty');
-          return {validForNewPackages: false, validForOldPackages: false, errors, warnings};
-        }
-
-        if (name.length > 214) {
-          errors.push('name too long');
-          return {validForNewPackages: false, validForOldPackages: false, errors, warnings};
-        }
-
-        if (name[0] === '.' || name[0] === '_') {
-          errors.push('name cannot start with . or _');
-          return {validForNewPackages: false, validForOldPackages: false, errors, warnings};
-        }
-
-        if (!/^[a-z0-9._-]+$/.test(name.split('/').pop())) {
-          errors.push('name can only contain lowercase letters, numbers, dots, dashes, underscores');
-          return {validForNewPackages: false, validForOldPackages: false, errors, warnings};
-        }
-
-        // Scoped package check.
-        if (name[0] === '@') {
-          if (!name.includes('/')) {
-            errors.push('scoped package must have a slash');
-            return {validForNewPackages: false, validForOldPackages: false, errors, warnings};
-          }
-          const parts = name.split('/');
-          if (parts.length !== 2 || !parts[0] || !parts[1]) {
-            errors.push('invalid scoped package name');
-            return {validForNewPackages: false, validForOldPackages: false, errors, warnings};
-          }
-        }
-
-        return {
-          validForNewPackages: errors.length === 0,
-          validForOldPackages: errors.length === 0,
-          errors,
-          warnings
-        };
-      };
-
-      module.exports.default = module.exports;
-    `,
-  },
-
-  libnpmpack: {
-    // libnpmpack is a large package (1.1MB) that wraps pacote + tar + validation.
-    // We only use it to create tarballs from package specs.
-    // Cherry-picking won't help much here since the core functionality requires
-    // most of the package. The bundle size is acceptable for its critical role.
-    // NOTE: Disabled for now - full bundle provides better compatibility.
-    customEntry: null,
-  },
-
-  // For logging, we can use stubs in production.
-  'yoctocolors-cjs': {
-    // No colors in production bundles.
-    customEntry: `
-      // No-op color functions for production.
-      const identity = str => str;
-      module.exports = {
-        red: identity,
-        green: identity,
-        yellow: identity,
-        blue: identity,
-        magenta: identity,
-        cyan: identity,
-        white: identity,
-        gray: identity,
-        black: identity,
-        bold: identity,
-        dim: identity,
-        italic: identity,
-        underline: identity,
-        strikethrough: identity,
-        reset: identity,
-        default: identity
-      };
-    `,
-  },
-}
-
-// Generate a temporary entry file for cherry-picked imports.
-export async function createCherryPickEntry(packageName, _tempDir) {
-  const fs = await import('node:fs').then(m => m.promises)
-  const path = await import('node:path')
-
-  const config = cherryPickEntries[packageName]
-  if (!config?.customEntry) {
-    // Use default entry.
-    return null
-  }
-
-  // Create temp entry file in project root where node_modules is accessible.
-  // Use a .tmp directory that's gitignored.
-  const tmpDir = path.join(process.cwd(), '.tmp-build')
-  await fs.mkdir(tmpDir, { recursive: true })
-
-  const tempFile = path.join(
-    tmpDir,
-    `${packageName.replace(/[/@]/g, '-')}-entry.js`,
-  )
-  await fs.writeFile(tempFile, config.customEntry.trim())
-
-  return tempFile
-}
diff --git a/scripts/claude.mjs b/scripts/claude.mjs
index 3144d54..c3efbd6 100644
--- a/scripts/claude.mjs
+++ b/scripts/claude.mjs
@@ -6,7 +6,12 @@
 
 import { spawn } from 'node:child_process'
 import crypto from 'node:crypto'
-import { existsSync, promises as fs } from 'node:fs'
+import {
+  existsSync,
+  readFileSync,
+  writeFileSync,
+  promises as fs,
+} from 'node:fs'
 import os from 'node:os'
 import path from 'node:path'
 import { fileURLToPath } from 'node:url'
@@ -14,7 +19,7 @@ import { fileURLToPath } from 'node:url'
 import { deleteAsync as del } from 'del'
 import colors from 'yoctocolors-cjs'
 
-import { parseArgs } from '@socketsecurity/lib/argv/parse'
+import { parseArgs } from './utils/parse-args.mjs'
 
 const __dirname = path.dirname(fileURLToPath(import.meta.url))
 const rootPath = path.join(__dirname, '..')
@@ -188,7 +193,7 @@ class CostTracker {
   loadMonthlyStats() {
     try {
       if (existsSync(STORAGE_PATHS.stats)) {
-        const data = JSON.parse(fs.readFileSync(STORAGE_PATHS.stats, 'utf8'))
+        const data = JSON.parse(readFileSync(STORAGE_PATHS.stats, 'utf8'))
         // YYYY-MM
         const currentMonth = new Date().toISOString().slice(0, 7)
         if (data.month === currentMonth) {
@@ -208,10 +213,7 @@ class CostTracker {
 
   saveMonthlyStats() {
     try {
-      fs.writeFileSync(
-        STORAGE_PATHS.stats,
-        JSON.stringify(this.monthly, null, 2),
-      )
+      writeFileSync(STORAGE_PATHS.stats, JSON.stringify(this.monthly, null, 2))
     } catch {
       // Ignore errors.
     }
@@ -296,7 +298,7 @@ class ProgressTracker {
   loadHistory() {
     try {
       if (existsSync(STORAGE_PATHS.history)) {
-        const data = JSON.parse(fs.readFileSync(STORAGE_PATHS.history, 'utf8'))
+        const data = JSON.parse(readFileSync(STORAGE_PATHS.history, 'utf8'))
         // Keep only last 50 sessions.
         return data.sessions.slice(-50)
       }
@@ -318,7 +320,7 @@ class ProgressTracker {
       if (data.sessions.length > 50) {
         data.sessions = data.sessions.slice(-50)
       }
-      fs.writeFileSync(STORAGE_PATHS.history, JSON.stringify(data, null, 2))
+      writeFileSync(STORAGE_PATHS.history, JSON.stringify(data, null, 2))
     } catch {
       // Ignore errors.
     }
diff --git a/scripts/clean-dist.mjs b/scripts/clean-dist.mjs
deleted file mode 100644
index 3170bef..0000000
--- a/scripts/clean-dist.mjs
+++ /dev/null
@@ -1,36 +0,0 @@
-/**
- * @fileoverview Clean dist directory before build.
- * Ensures complete removal of dist directory on all platforms.
- */
-
-import { existsSync } from 'node:fs'
-import { rm } from 'node:fs/promises'
-import { resolve } from 'node:path'
-import { fileURLToPath } from 'node:url'
-
-const __dirname = fileURLToPath(new URL('.', import.meta.url))
-const REGISTRY_ROOT = resolve(__dirname, '..')
-const DIST_DIR = resolve(REGISTRY_ROOT, 'dist')
-
-async function cleanDist() {
-  try {
-    if (existsSync(DIST_DIR)) {
-      console.log('Cleaning dist directory...')
-      await rm(DIST_DIR, {
-        force: true,
-        maxRetries: 3,
-        recursive: true,
-        retryDelay: 100,
-      })
-      console.log('✅ Dist directory cleaned')
-    }
-  } catch (e) {
-    console.error('Failed to clean dist directory:', e.message)
-    process.exitCode = 1
-  }
-}
-
-cleanDist().catch(e => {
-  console.error(e)
-  process.exitCode = 1
-})
diff --git a/scripts/cover.mjs b/scripts/cover.mjs
deleted file mode 100644
index 03473cf..0000000
--- a/scripts/cover.mjs
+++ /dev/null
@@ -1,210 +0,0 @@
-/**
- * @fileoverview Coverage script that runs tests with coverage reporting.
- * Masks test output and shows only the coverage summary.
- */
-
-import path from 'node:path'
-import { fileURLToPath } from 'node:url'
-import { parseArgs } from 'node:util'
-
-import { printError, printHeader, printSuccess } from './utils/cli-helpers.mjs'
-import { runCommandQuiet } from './utils/run-command.mjs'
-
-const __dirname = path.dirname(fileURLToPath(import.meta.url))
-const rootPath = path.join(__dirname, '..')
-
-// Parse custom flags
-const { values } = parseArgs({
-  options: {
-    'code-only': { type: 'boolean', default: false },
-    'type-only': { type: 'boolean', default: false },
-    summary: { type: 'boolean', default: false },
-  },
-  strict: false,
-})
-
-printHeader('Test Coverage')
-console.log('')
-
-// Run vitest with coverage enabled, capturing output
-// Filter out custom flags that vitest doesn't understand
-const customFlags = ['--code-only', '--type-only', '--summary']
-const vitestArgs = [
-  'exec',
-  'vitest',
-  'run',
-  '--coverage',
-  ...process.argv.slice(2).filter(arg => !customFlags.includes(arg)),
-]
-const typeCoverageArgs = ['exec', 'type-coverage']
-
-try {
-  let exitCode = 0
-  let codeCoverageResult
-  let typeCoverageResult
-
-  // Handle --type-only flag
-  if (values['type-only']) {
-    typeCoverageResult = await runCommandQuiet('pnpm', typeCoverageArgs, {
-      cwd: rootPath,
-    })
-    exitCode = typeCoverageResult.exitCode
-
-    // Display type coverage only
-    const typeCoverageOutput = (
-      typeCoverageResult.stdout + typeCoverageResult.stderr
-    ).trim()
-    const typeCoverageMatch = typeCoverageOutput.match(
-      /\([\d\s/]+\)\s+([\d.]+)%/,
-    )
-
-    if (typeCoverageMatch) {
-      const typeCoveragePercent = Number.parseFloat(typeCoverageMatch[1])
-      console.log()
-      console.log(' Coverage Summary')
-      console.log(' ───────────────────────────────')
-      console.log(` Type Coverage: ${typeCoveragePercent.toFixed(2)}%`)
-      console.log()
-    }
-  }
-  // Handle --code-only flag
-  else if (values['code-only']) {
-    codeCoverageResult = await runCommandQuiet('pnpm', vitestArgs, {
-      cwd: rootPath,
-    })
-    exitCode = codeCoverageResult.exitCode
-
-    // Process code coverage output only
-    const ansiRegex = new RegExp(`${String.fromCharCode(27)}\\[[0-9;]*m`, 'g')
-    const output = (codeCoverageResult.stdout + codeCoverageResult.stderr)
-      .replace(ansiRegex, '')
-      .replace(/(?:✧|︎|⚡)\s*/g, '')
-      .trim()
-
-    // Extract and display test summary
-    const testSummaryMatch = output.match(
-      /Test Files\s+\d+[^\n]*\n[\s\S]*?Duration\s+[\d.]+m?s[^\n]*/,
-    )
-    if (!values.summary && testSummaryMatch) {
-      console.log()
-      console.log(testSummaryMatch[0])
-      console.log()
-    }
-
-    // Extract and display coverage summary
-    const coverageHeaderMatch = output.match(
-      / % Coverage report from v8\n([-|]+)\n([^\n]+)\n\1/,
-    )
-    const allFilesMatch = output.match(/All files\s+\|\s+([\d.]+)\s+\|[^\n]*/)
-
-    if (coverageHeaderMatch && allFilesMatch) {
-      if (!values.summary) {
-        console.log(' % Coverage report from v8')
-        console.log(coverageHeaderMatch[1])
-        console.log(coverageHeaderMatch[2])
-        console.log(coverageHeaderMatch[1])
-        console.log(allFilesMatch[0])
-        console.log(coverageHeaderMatch[1])
-        console.log()
-      }
-
-      const codeCoveragePercent = Number.parseFloat(allFilesMatch[1])
-      console.log(' Coverage Summary')
-      console.log(' ───────────────────────────────')
-      console.log(` Code Coverage: ${codeCoveragePercent.toFixed(2)}%`)
-      console.log()
-    } else if (exitCode !== 0) {
-      console.log('\n--- Output ---')
-      console.log(output)
-    }
-  }
-  // Default: run both code and type coverage
-  else {
-    codeCoverageResult = await runCommandQuiet('pnpm', vitestArgs, {
-      cwd: rootPath,
-    })
-    exitCode = codeCoverageResult.exitCode
-
-    // Run type coverage
-    typeCoverageResult = await runCommandQuiet('pnpm', typeCoverageArgs, {
-      cwd: rootPath,
-    })
-
-    // Combine and clean output
-    const ansiRegex = new RegExp(`${String.fromCharCode(27)}\\[[0-9;]*m`, 'g')
-    const output = (codeCoverageResult.stdout + codeCoverageResult.stderr)
-      .replace(ansiRegex, '')
-      .replace(/(?:✧|︎|⚡)\s*/g, '')
-      .trim()
-
-    // Extract test summary
-    const testSummaryMatch = output.match(
-      /Test Files\s+\d+[^\n]*\n[\s\S]*?Duration\s+[\d.]+m?s[^\n]*/,
-    )
-
-    // Extract coverage summary
-    const coverageHeaderMatch = output.match(
-      / % Coverage report from v8\n([-|]+)\n([^\n]+)\n\1/,
-    )
-    const allFilesMatch = output.match(/All files\s+\|\s+([\d.]+)\s+\|[^\n]*/)
-
-    // Extract type coverage
-    const typeCoverageOutput = (
-      typeCoverageResult.stdout + typeCoverageResult.stderr
-    ).trim()
-    const typeCoverageMatch = typeCoverageOutput.match(
-      /\([\d\s/]+\)\s+([\d.]+)%/,
-    )
-
-    // Display output
-    if (!values.summary && testSummaryMatch) {
-      console.log()
-      console.log(testSummaryMatch[0])
-      console.log()
-    }
-
-    if (coverageHeaderMatch && allFilesMatch) {
-      if (!values.summary) {
-        console.log(' % Coverage report from v8')
-        console.log(coverageHeaderMatch[1])
-        console.log(coverageHeaderMatch[2])
-        console.log(coverageHeaderMatch[1])
-        console.log(allFilesMatch[0])
-        console.log(coverageHeaderMatch[1])
-        console.log()
-      }
-
-      // Display cumulative summary
-      if (typeCoverageMatch) {
-        const codeCoveragePercent = Number.parseFloat(allFilesMatch[1])
-        const typeCoveragePercent = Number.parseFloat(typeCoverageMatch[1])
-        const cumulativePercent = (
-          (codeCoveragePercent + typeCoveragePercent) /
-          2
-        ).toFixed(2)
-
-        console.log(' Coverage Summary')
-        console.log(' ───────────────────────────────')
-        console.log(` Type Coverage: ${typeCoveragePercent.toFixed(2)}%`)
-        console.log(` Code Coverage: ${codeCoveragePercent.toFixed(2)}%`)
-        console.log(' ───────────────────────────────')
-        console.log(` Cumulative:    ${cumulativePercent}%`)
-        console.log()
-      }
-    } else if (exitCode !== 0) {
-      console.log('\n--- Output ---')
-      console.log(output)
-    }
-  }
-
-  if (exitCode === 0) {
-    printSuccess('Coverage completed successfully')
-  } else {
-    printError('Coverage failed')
-  }
-
-  process.exitCode = exitCode
-} catch (error) {
-  printError(`Coverage script failed: ${error.message}`)
-  process.exitCode = 1
-}
diff --git a/scripts/esbuild-optimize-plugin.mjs b/scripts/esbuild-optimize-plugin.mjs
deleted file mode 100644
index de004f0..0000000
--- a/scripts/esbuild-optimize-plugin.mjs
+++ /dev/null
@@ -1,115 +0,0 @@
-/**
- * @fileoverview Custom esbuild plugin for aggressive optimizations.
- */
-
-export const optimizePlugin = {
-  name: 'optimize',
-  setup(build) {
-    // Transform JavaScript files.
-    build.onLoad({ filter: /\.(js|mjs|cjs)$/ }, async args => {
-      const fs = require('node:fs').promises
-      let contents = await fs.readFile(args.path, 'utf8')
-
-      // 1. Strip verbose error messages (keep error codes only).
-      contents = contents.replace(
-        /throw\s+new\s+Error\(['"`]([^'"`]{100,})['"`]\)/g,
-        (_match, msg) => {
-          const code = msg.match(/\b[A-Z][A-Z0-9_]+\b/) || ['ERR_UNKNOWN']
-          return `throw new Error('${code[0]}')`
-        },
-      )
-
-      // 2. Strip documentation URLs from error messages.
-      contents = contents.replace(/https?:\/\/[^\s"')]+docs[^\s"')]*/g, '')
-
-      // 3. Remove package.json metadata readers (version checks, etc).
-      contents = contents.replace(
-        /JSON\.parse\([^)]*readFileSync\([^)]*package\.json[^)]*\)[^)]*\)/g,
-        '{}',
-      )
-
-      // 4. Strip stack trace enhancements.
-      contents = contents.replace(/Error\.captureStackTrace\([^)]+\);?/g, '')
-
-      // 5. Remove deprecation warnings.
-      contents = contents.replace(
-        /console\.(warn|error)\([^)]*deprecat[^)]*\);?/gi,
-        '',
-      )
-
-      // 6. Strip assertion messages (keep just the check).
-      contents = contents.replace(
-        /assert\([^,]+,\s*['"`][^'"`]+['"`]\)/g,
-        match => {
-          const condition = match.match(/assert\(([^,]+),/)[1]
-          return `assert(${condition})`
-        },
-      )
-
-      // 7. Remove CLI help text and usage strings.
-      contents = contents.replace(/['"`]Usage:[\s\S]{50,}?['"`]/g, '""')
-
-      // 8. Strip ANSI color codes and formatting.
-      contents = contents.replace(/\\x1b\[[0-9;]*m/g, '')
-
-      return { contents }
-    })
-  },
-}
-
-export const dedupePlugin = {
-  name: 'dedupe',
-  setup(build) {
-    // Track common modules to dedupe them.
-    const commonModules = new Map()
-
-    build.onResolve({ filter: /.*/ }, args => {
-      // Dedupe common heavy dependencies.
-      const dedupeTargets = [
-        'readable-stream',
-        'safe-buffer',
-        'string_decoder',
-        'inherits',
-        'util-deprecate',
-        'process-nextick-args',
-      ]
-
-      for (const target of dedupeTargets) {
-        if (args.path.includes(target)) {
-          if (!commonModules.has(target)) {
-            commonModules.set(target, args.path)
-          }
-          return { path: commonModules.get(target) }
-        }
-      }
-    })
-  },
-}
-
-export const dataExtractionPlugin = {
-  name: 'extract-data',
-  setup(build) {
-    build.onLoad({ filter: /\.(json)$/ }, async args => {
-      const fs = require('node:fs').promises
-      const contents = await fs.readFile(args.path, 'utf8')
-      const data = JSON.parse(contents)
-
-      // For large JSON data files, only keep essential fields.
-      if (contents.length > 10_000) {
-        // Example: package.json files often have huge 'readme' fields.
-        delete data.readme
-        delete data.readmeFilename
-        delete data.changelog
-        delete data._id
-        delete data._from
-        delete data._resolved
-        delete data._integrity
-        delete data._shasum
-
-        return { contents: JSON.stringify(data) }
-      }
-
-      return { contents }
-    })
-  },
-}
diff --git a/scripts/fix-commonjs-exports.mjs b/scripts/fix-commonjs-exports.mjs
deleted file mode 100644
index 07b61a0..0000000
--- a/scripts/fix-commonjs-exports.mjs
+++ /dev/null
@@ -1,109 +0,0 @@
-/**
- * @fileoverview Fix CommonJS exports for constants to be directly exported values.
- * Transforms `exports.default = value` to `module.exports = value` for single-export constant files.
- */
-
-import { promises as fs } from 'node:fs'
-import path from 'node:path'
-import { fileURLToPath } from 'node:url'
-
-import {
-  printError,
-  printFooter,
-  printHeader,
-  printSuccess,
-} from './utils/helpers.mjs'
-
-const __dirname = path.dirname(fileURLToPath(import.meta.url))
-const distDir = path.resolve(__dirname, '..', 'dist')
-
-/**
- * Process files in a directory and fix CommonJS exports.
- */
-async function processDirectory(dir) {
-  let fixedCount = 0
-
-  try {
-    const entries = await fs.readdir(dir, { withFileTypes: true })
-
-    for (const entry of entries) {
-      const fullPath = path.join(dir, entry.name)
-
-      if (entry.isDirectory()) {
-        fixedCount += await processDirectory(fullPath)
-      } else if (entry.isFile() && entry.name.endsWith('.js')) {
-        let content = await fs.readFile(fullPath, 'utf8')
-        let modified = false
-
-        // Check if this is a single default export.
-        if (content.includes('exports.default =')) {
-          // Transform exports.default = value to module.exports = value.
-          content = content.replace(/exports\.default = /g, 'module.exports = ')
-
-          // Remove the __esModule marker since we're now using direct CommonJS export.
-          content = content.replace(
-            /Object\.defineProperty\(exports, "__esModule", \{ value: true \}\);\n?/g,
-            '',
-          )
-          modified = true
-        }
-
-        // Fix relative paths ONLY for files in the root dist directory.
-        // Files in subdirectories (e.g., dist/effects/) need to keep ../ to reference parent modules.
-        const isRootFile = path.dirname(fullPath) === distDir
-        if (
-          isRootFile &&
-          (content.includes('require("../') || content.includes("require('../"))
-        ) {
-          // After compilation, external/ and constants/ subdirectories are in dist/,
-          // so root-level files should use ./ instead of ../.
-          if (content.includes('require("../')) {
-            content = content.replace(/require\("\.\.\//g, 'require("./')
-            modified = true
-          }
-          if (content.includes("require('../")) {
-            content = content.replace(/require\('\.\.\//g, "require('./")
-            modified = true
-          }
-        }
-
-        if (modified) {
-          await fs.writeFile(fullPath, content)
-          const relativePath = path.relative(distDir, fullPath)
-          console.log(`    Fixed ${relativePath}`)
-          fixedCount += 1
-        }
-      }
-    }
-  } catch (error) {
-    // Skip directories that don't exist.
-    if (error.code !== 'ENOENT') {
-      throw error
-    }
-  }
-
-  return fixedCount
-}
-
-async function fixConstantExports() {
-  printHeader('CommonJS Exports')
-
-  try {
-    const fixedCount = await processDirectory(distDir)
-
-    if (fixedCount > 0) {
-      printSuccess(`Fixed ${fixedCount} file${fixedCount === 1 ? '' : 's'}`)
-    } else {
-      printSuccess('No files needed fixing')
-    }
-    printFooter()
-  } catch (error) {
-    printError(`Failed to fix CommonJS exports: ${error.message}`)
-    process.exitCode = 1
-  }
-}
-
-fixConstantExports().catch(error => {
-  printError(`Build failed: ${error.message || error}`)
-  process.exitCode = 1
-})
diff --git a/scripts/fix-default-imports.mjs b/scripts/fix-default-imports.mjs
deleted file mode 100644
index 8205445..0000000
--- a/scripts/fix-default-imports.mjs
+++ /dev/null
@@ -1,218 +0,0 @@
-/**
- * @fileoverview Fix .default references to constants that were changed to direct module.exports.
- */
-
-import { promises as fs } from 'node:fs'
-import path from 'node:path'
-import { fileURLToPath } from 'node:url'
-
-import colors from 'yoctocolors-cjs'
-
-import { printError, printHeader, replaceHeader } from './utils/cli-helpers.mjs'
-
-const __dirname = path.dirname(fileURLToPath(import.meta.url))
-const distDir = path.resolve(__dirname, '..', 'dist')
-
-async function fixDefaultReferences() {
-  printHeader('Default References')
-
-  const constantNames = [
-    'AT_LATEST',
-    'BUN',
-    'BUN_LOCK',
-    'BUN_LOCKB',
-    'CACHE_DIR',
-    'CACHE_GITHUB_DIR',
-    'CACHE_SOCKET_API_DIR',
-    'CACHE_TTL_DIR',
-    'CHANGELOG_MD',
-    'CI',
-    'COLUMN_LIMIT',
-    'DARWIN',
-    'DLX_BINARY_CACHE_TTL',
-    'DOT_GITHUB',
-    'DOT_GIT_DIR',
-    'DOT_PACKAGE_LOCK_JSON',
-    'DOT_SOCKET_DIR',
-    'EMPTY_FILE',
-    'EMPTY_VALUE',
-    'ENV',
-    'ESLINT_CONFIG_JS',
-    'ESNEXT',
-    'EXTENSIONS',
-    'EXTENSIONS_JSON',
-    'EXT_CJS',
-    'EXT_CMD',
-    'EXT_CTS',
-    'EXT_DTS',
-    'EXT_JS',
-    'EXT_JSON',
-    'EXT_LOCK',
-    'EXT_LOCKB',
-    'EXT_MD',
-    'EXT_MJS',
-    'EXT_MTS',
-    'EXT_PS1',
-    'EXT_YAML',
-    'EXT_YML',
-    'GITHUB_API_BASE_URL',
-    'GITIGNORE',
-    'LATEST',
-    'LICENSE',
-    'LICENSE_GLOB',
-    'LICENSE_GLOB_RECURSIVE',
-    'LICENSE_ORIGINAL',
-    'LICENSE_ORIGINAL_GLOB',
-    'LICENSE_ORIGINAL_GLOB_RECURSIVE',
-    'LOOP_SENTINEL',
-    'MANIFEST_JSON',
-    'MIT',
-    'NODE_AUTH_TOKEN',
-    'NODE_ENV',
-    'NODE_HARDEN_FLAGS',
-    'NODE_MODULES',
-    'NODE_MODULES_GLOB_RECURSIVE',
-    'NODE_NO_WARNINGS_FLAGS',
-    'NODE_SEA_FUSE',
-    'NPM',
-    'NPM_REAL_EXEC_PATH',
-    'NPM_REGISTRY_URL',
-    'NPM_SHRINKWRAP_JSON',
-    'NPX',
-    'OVERRIDES',
-    'PACKAGE_DEFAULT_VERSION',
-    'PACKAGE_JSON',
-    'PACKAGE_LOCK_JSON',
-    'PNPM',
-    'PNPM_LOCK_YAML',
-    'PRE_COMMIT',
-    'README_GLOB',
-    'README_GLOB_RECURSIVE',
-    'README_MD',
-    'REGISTRY',
-    'REGISTRY_SCOPE_DELIMITER',
-    'RESOLUTIONS',
-    'SOCKET_API_BASE_URL',
-    'SOCKET_APP_PREFIX',
-    'SOCKET_CLI_APP_NAME',
-    'SOCKET_DLX_APP_NAME',
-    'SOCKET_FIREWALL_APP_NAME',
-    'SOCKET_GITHUB_ORG',
-    'SOCKET_IPC_HANDSHAKE',
-    'SOCKET_OVERRIDE_SCOPE',
-    'SOCKET_PUBLIC_API_TOKEN',
-    'SOCKET_REGISTRY_APP_NAME',
-    'SOCKET_REGISTRY_NPM_ORG',
-    'SOCKET_REGISTRY_PACKAGE_NAME',
-    'SOCKET_REGISTRY_REPO_NAME',
-    'SOCKET_REGISTRY_SCOPE',
-    'SOCKET_SECURITY_SCOPE',
-    'SUPPORTS_NODE_COMPILE_CACHE_API',
-    'SUPPORTS_NODE_COMPILE_CACHE_ENV_VAR',
-    'SUPPORTS_NODE_DISABLE_WARNING_FLAG',
-    'SUPPORTS_NODE_PERMISSION_FLAG',
-    'SUPPORTS_NODE_REQUIRE_MODULE',
-    'SUPPORTS_NODE_RUN',
-    'SUPPORTS_PROCESS_SEND',
-    'TSCONFIG_JSON',
-    'UNDEFINED_TOKEN',
-    'UNKNOWN_ERROR',
-    'UNKNOWN_VALUE',
-    'UNLICENCED',
-    'UNLICENSED',
-    'UTF8',
-    'VITEST',
-    'VLT',
-    'VLT_LOCK_JSON',
-    'WIN32',
-    'YARN',
-    'YARN_BERRY',
-    'YARN_LOCK',
-    // Complex constants
-    'abort-controller',
-    'abort-signal',
-    'bun-cache-path',
-    'copy-left-licenses',
-    'exec-path',
-    'get-ipc',
-    'ipc-handler',
-    'ipc-object',
-    'ipc-promise',
-    'ipc-target',
-    'k-internals-symbol',
-    'lifecycle-script-names',
-    'logger',
-    'maintained-node-versions',
-    'node-debug-flags',
-    'node-version',
-    'npm-exec-path',
-    'npm-lifecycle-event',
-    'package-default-node-range',
-    'package-default-socket-categories',
-    'package-extensions',
-    'package-manager-cache-names',
-    'packument-cache',
-    'pacote-cache-path',
-    'pnpm-exec-path',
-    'pnpm-store-path',
-    'spinner',
-    'ts-libs-available',
-    'ts-types-available',
-    'vlt-cache-path',
-    'yarn-cache-path',
-    'yarn-classic',
-    'yarn-exec-path',
-  ]
-
-  // Create a map of import names to fix.
-  const importNameMap = {}
-  for (const name of constantNames) {
-    // Convert kebab-case to underscore format (e.g., 'abort-controller' -> 'abort_controller')
-    const varName = name.replace(/-/g, '_')
-    importNameMap[`${varName}_1`] = true
-    importNameMap[`${name.toUpperCase()}_1`] = true
-    importNameMap[`${name.replace(/-/g, '_').toUpperCase()}_1`] = true
-  }
-
-  async function processDirectory(dir) {
-    const entries = await fs.readdir(dir, { withFileTypes: true })
-
-    for (const entry of entries) {
-      const fullPath = path.join(dir, entry.name)
-
-      if (entry.isDirectory()) {
-        await processDirectory(fullPath)
-      } else if (entry.isFile() && entry.name.endsWith('.js')) {
-        let content = await fs.readFile(fullPath, 'utf8')
-        let modified = false
-
-        // Replace patterns like `CONSTANT_NAME_1.default` with `CONSTANT_NAME_1`
-        for (const importName in importNameMap) {
-          const regex = new RegExp(`\\b${importName}\\.default\\b`, 'g')
-          if (regex.test(content)) {
-            content = content.replace(regex, importName)
-            modified = true
-          }
-        }
-
-        if (modified) {
-          await fs.writeFile(fullPath, content)
-          console.log(`    Fixed ${path.relative(distDir, fullPath)}`)
-        }
-      }
-    }
-  }
-
-  try {
-    await processDirectory(distDir)
-    replaceHeader(colors.green('✓ Default references fixed'))
-  } catch (error) {
-    printError(`Failed to fix default references: ${error.message}`)
-    process.exitCode = 1
-  }
-}
-
-fixDefaultReferences().catch(error => {
-  printError(`Script failed: ${error.message || error}`)
-  process.exitCode = 1
-})
diff --git a/scripts/fix-external.mjs b/scripts/fix-external.mjs
deleted file mode 100644
index 793d4b0..0000000
--- a/scripts/fix-external.mjs
+++ /dev/null
@@ -1,80 +0,0 @@
-/**
- * @fileoverview Fix script for external dependencies in the registry.
- * Runs biome and eslint with auto-fix enabled on dist/external.
- *
- * Usage:
- *   node scripts/fix-external.mjs
- */
-
-import { runCommandQuiet } from '../../scripts/utils/run-command.mjs'
-import { logger } from './utils/helpers.mjs'
-
-async function main() {
-  try {
-    logger.info('Running linters on external dependencies with auto-fix...')
-
-    const linters = [
-      {
-        args: [
-          'biome',
-          'format',
-          '--log-level=none',
-          '--fix',
-          './dist/external',
-        ],
-        name: 'biome',
-      },
-      {
-        args: [
-          'eslint',
-          '--config',
-          '../.config/eslint.config.mjs',
-          '--report-unused-disable-directives',
-          '--fix',
-          './dist/external',
-        ],
-        name: 'eslint',
-      },
-    ]
-
-    let hadError = false
-
-    // Run linters in parallel for faster execution.
-    const results = await Promise.all(
-      linters.map(async ({ args, name }) => {
-        logger.log(`  - Running ${name}...`)
-        const result = await runCommandQuiet(args[0], args.slice(1), {
-          env: {
-            ...process.env,
-            LINT_EXTERNAL: '1',
-          },
-        })
-        return { name, result }
-      }),
-    )
-
-    // Check results.
-    for (const { name, result } of results) {
-      // These linters can exit with non-zero when they make fixes.
-      // So we don't treat that as an error.
-      if (result.exitCode !== 0) {
-        // Log stderr only if there's actual error content.
-        if (result.stderr && result.stderr.trim().length > 0) {
-          logger.error(`${name} errors:`, result.stderr)
-          hadError = true
-        }
-      }
-    }
-
-    if (hadError) {
-      process.exitCode = 1
-    } else {
-      logger.log('External dependency lint fixes complete')
-    }
-  } catch (error) {
-    logger.error('Fix external failed:', error.message)
-    process.exitCode = 1
-  }
-}
-
-main().catch(console.error)
diff --git a/scripts/fix.mjs b/scripts/fix.mjs
deleted file mode 100644
index f554cfe..0000000
--- a/scripts/fix.mjs
+++ /dev/null
@@ -1,134 +0,0 @@
-/**
- * @fileoverview Fix script that runs package export generation and Biome with auto-fix enabled.
- */
-
-import { spawn } from 'node:child_process'
-import { existsSync } from 'node:fs'
-import path from 'node:path'
-import { fileURLToPath } from 'node:url'
-
-import colors from 'yoctocolors-cjs'
-
-import { printError, printHeader, replaceHeader } from './utils/cli-helpers.mjs'
-
-const __dirname = path.dirname(fileURLToPath(import.meta.url))
-const rootPath = path.join(__dirname, '..')
-
-/**
- * Run a command and return a promise that resolves when it completes.
- */
-function _runCommand(command, args, label) {
-  return new Promise((resolve, reject) => {
-    printHeader(label)
-    const child = spawn(command, args, {
-      stdio: 'inherit',
-      cwd: rootPath,
-      ...(process.platform === 'win32' && { shell: true }),
-    })
-
-    child.on('exit', code => {
-      if (code === 0) {
-        resolve()
-      } else {
-        reject(new Error(`${label} exited with code ${code}`))
-      }
-    })
-
-    child.on('error', error => {
-      printError(`${label} failed: ${error.message}`)
-      reject(error)
-    })
-  })
-}
-
-// Run tasks sequentially
-async function main() {
-  try {
-    // Step 1: Generate package exports (only if dist/ exists)
-    const distPath = path.join(rootPath, 'dist')
-    if (existsSync(distPath)) {
-      printHeader('Package Exports')
-      const exportChild = spawn(
-        'node',
-        [path.join(__dirname, 'generate-package-exports.mjs')],
-        {
-          stdio: 'pipe',
-          cwd: rootPath,
-          ...(process.platform === 'win32' && { shell: true }),
-        },
-      )
-      await new Promise((resolve, reject) => {
-        exportChild.on('exit', code => {
-          if (code === 0) {
-            replaceHeader(colors.green('✓ Package exports generated'))
-            resolve()
-          } else {
-            reject(new Error(`Package exports exited with code ${code}`))
-          }
-        })
-        exportChild.on('error', reject)
-      })
-    } else {
-      printHeader('Skipping Package Exports (dist/ not found)')
-    }
-
-    // Step 2: Fix default imports (prints its own header and success)
-    const child = spawn(
-      'node',
-      [path.join(__dirname, 'fix-default-imports.mjs')],
-      {
-        stdio: 'inherit',
-        cwd: rootPath,
-        ...(process.platform === 'win32' && { shell: true }),
-      },
-    )
-    await new Promise((resolve, reject) => {
-      child.on('exit', code => {
-        if (code === 0) {
-          resolve()
-        } else {
-          reject(new Error(`Fix default imports exited with code ${code}`))
-        }
-      })
-      child.on('error', reject)
-    })
-
-    // Step 3: Run Biome auto-fix
-    printHeader('Biome Auto-fix')
-    const biomeChild = spawn(
-      'pnpm',
-      [
-        'exec',
-        'biome',
-        'check',
-        '--write',
-        '--unsafe',
-        '.',
-        ...process.argv.slice(2),
-      ],
-      {
-        stdio: 'inherit',
-        cwd: rootPath,
-        ...(process.platform === 'win32' && { shell: true }),
-      },
-    )
-    await new Promise((resolve, reject) => {
-      biomeChild.on('exit', code => {
-        if (code === 0) {
-          replaceHeader(colors.green('✓ Biome auto-fix complete'), 1)
-          resolve()
-        } else {
-          reject(new Error(`Biome auto-fix exited with code ${code}`))
-        }
-      })
-      biomeChild.on('error', reject)
-    })
-
-    process.exitCode = 0
-  } catch (error) {
-    printError(`Fix script failed: ${error.message}`)
-    process.exitCode = 1
-  }
-}
-
-main()
diff --git a/scripts/fix/commonjs-exports.mjs b/scripts/fix/commonjs-exports.mjs
new file mode 100644
index 0000000..4b812c5
--- /dev/null
+++ b/scripts/fix/commonjs-exports.mjs
@@ -0,0 +1,247 @@
+/**
+ * @fileoverview Fix CommonJS exports for Node.js ESM compatibility.
+ * Transforms esbuild's minified exports to clear module.exports = { ... } format.
+ */
+
+import { parse } from '@babel/parser'
+import { promises as fs } from 'node:fs'
+import path from 'node:path'
+import { fileURLToPath } from 'node:url'
+
+import MagicString from 'magic-string'
+import colors from 'yoctocolors-cjs'
+
+import { isQuiet } from '#socketsecurity/lib/argv/flags'
+import { getDefaultLogger } from '#socketsecurity/lib/logger'
+
+const logger = getDefaultLogger()
+const printCompletedHeader = title => console.log(colors.green(`✓ ${title}`))
+
+const __dirname = path.dirname(fileURLToPath(import.meta.url))
+const distDir = path.resolve(__dirname, '..', 'dist')
+
+/**
+ * Process files in a directory and fix CommonJS exports.
+ * Handles files with `export default` by transforming __toCommonJS patterns.
+ *
+ * @param {string} dir - Directory to process
+ * @param {boolean} verbose - Show individual file fixes
+ * @returns {Promise<number>} Number of files fixed
+ */
+async function processDirectory(dir, verbose = false) {
+  let fixedCount = 0
+
+  try {
+    const entries = await fs.readdir(dir, { withFileTypes: true })
+
+    for (const entry of entries) {
+      const fullPath = path.join(dir, entry.name)
+
+      if (entry.isDirectory()) {
+        fixedCount += await processDirectory(fullPath, verbose)
+      } else if (entry.isFile() && entry.name.endsWith('.js')) {
+        const content = await fs.readFile(fullPath, 'utf8')
+        const s = new MagicString(content)
+        let modified = false
+
+        // Check if this is a single default export with __toCommonJS pattern
+        if (
+          content.includes('module.exports = __toCommonJS(') &&
+          content.includes('default: () => ')
+        ) {
+          // Parse AST to find the export pattern and value identifier
+          try {
+            const ast = parse(content, {
+              sourceType: 'module',
+              plugins: [],
+            })
+
+            let valueIdentifier = null
+            let exportCallStart = null
+            let exportCallEnd = null
+            let toCommonJSStart = null
+            let toCommonJSEnd = null
+
+            // Find __export call with default export
+            const walk = node => {
+              if (!node || typeof node !== 'object') {
+                return
+              }
+
+              // Look for: __export(name, { default: () => value_identifier })
+              if (
+                node.type === 'CallExpression' &&
+                node.callee?.type === 'Identifier' &&
+                node.callee.name === '__export' &&
+                node.arguments?.length === 2 &&
+                node.arguments[1].type === 'ObjectExpression'
+              ) {
+                const defaultProp = node.arguments[1].properties?.find(
+                  p =>
+                    p.type === 'ObjectProperty' &&
+                    p.key?.name === 'default' &&
+                    p.value?.type === 'ArrowFunctionExpression',
+                )
+                if (defaultProp?.value.body?.name) {
+                  valueIdentifier = defaultProp.value.body.name
+                  exportCallStart = node.start
+                  exportCallEnd = node.end
+                }
+              }
+
+              // Look for: module.exports = __toCommonJS(name)
+              if (
+                node.type === 'AssignmentExpression' &&
+                node.left?.type === 'MemberExpression' &&
+                node.left.object?.name === 'module' &&
+                node.left.property?.name === 'exports' &&
+                node.right?.type === 'CallExpression' &&
+                node.right.callee?.name === '__toCommonJS'
+              ) {
+                toCommonJSStart = node.start
+                toCommonJSEnd = node.end
+              }
+
+              // Recursively walk
+              for (const key of Object.keys(node)) {
+                if (key === 'start' || key === 'end' || key === 'loc') {
+                  continue
+                }
+                const value = node[key]
+                if (Array.isArray(value)) {
+                  for (const item of value) {
+                    walk(item)
+                  }
+                } else {
+                  walk(value)
+                }
+              }
+            }
+
+            walk(ast.program)
+
+            if (
+              valueIdentifier &&
+              exportCallStart !== null &&
+              toCommonJSStart !== null
+            ) {
+              // Remove the __export call and surrounding statement
+              // Find the semicolon and newline after the call
+              let removeEnd = exportCallEnd
+              while (
+                removeEnd < content.length &&
+                (content[removeEnd] === ';' || content[removeEnd] === '\n')
+              ) {
+                removeEnd++
+              }
+              s.remove(exportCallStart, removeEnd)
+
+              // Replace the entire statement: module.exports = __toCommonJS(name);
+              // Find and include the semicolon
+              let statementEnd = toCommonJSEnd
+              while (
+                statementEnd < content.length &&
+                (content[statementEnd] === ';' ||
+                  content[statementEnd] === ' ' ||
+                  content[statementEnd] === '\n')
+              ) {
+                if (content[statementEnd] === ';') {
+                  statementEnd++
+                  break
+                }
+                statementEnd++
+              }
+              // Replace the entire statement with a comment
+              s.overwrite(
+                toCommonJSStart,
+                statementEnd,
+                '/* module.exports will be set at end of file */',
+              )
+
+              // Add module.exports at the end of the file
+              s.append(`\nmodule.exports = ${valueIdentifier};\n`)
+
+              modified = true
+            }
+          } catch {
+            // If parsing fails, skip this optimization
+          }
+        }
+
+        // SIMPLIFIED APPROACH: External packages use standard CommonJS exports.
+        // esbuild bundles them with `minify: false` producing clean `module.exports` patterns.
+        // All external packages work directly: require('./external/packagename')
+        // NO .default references needed - internal code uses them as-is.
+
+        // Fix relative paths ONLY for files in the root dist directory
+        const isRootFile = path.dirname(fullPath) === distDir
+        if (
+          isRootFile &&
+          (content.includes('require("../') || content.includes("require('../"))
+        ) {
+          let pos = 0
+          while ((pos = content.indexOf('require("../', pos)) !== -1) {
+            s.overwrite(
+              pos + 'require("'.length,
+              pos + 'require("../'.length,
+              './',
+            )
+            pos += 1
+            modified = true
+          }
+          pos = 0
+          while ((pos = content.indexOf("require('../", pos)) !== -1) {
+            s.overwrite(
+              pos + "require('".length,
+              pos + "require('../".length,
+              './',
+            )
+            pos += 1
+            modified = true
+          }
+        }
+
+        if (modified) {
+          await fs.writeFile(fullPath, s.toString())
+          if (verbose) {
+            const relativePath = path.relative(distDir, fullPath)
+            console.log(`    Fixed ${relativePath}`)
+          }
+          fixedCount += 1
+        }
+      }
+    }
+  } catch (error) {
+    // Skip directories that don't exist
+    if (error.code !== 'ENOENT') {
+      throw error
+    }
+  }
+
+  return fixedCount
+}
+
+async function fixConstantExports() {
+  const verbose = process.argv.includes('--verbose')
+  const quiet = isQuiet()
+
+  try {
+    const fixedCount = await processDirectory(distDir, verbose)
+
+    if (!quiet) {
+      const title =
+        fixedCount > 0
+          ? `CommonJS Exports (${fixedCount} file${fixedCount === 1 ? '' : 's'})`
+          : 'CommonJS Exports (no changes)'
+      printCompletedHeader(title)
+    }
+  } catch (error) {
+    logger.error(`Failed to fix CommonJS exports: ${error.message}`)
+    process.exitCode = 1
+  }
+}
+
+fixConstantExports().catch(error => {
+  logger.error(`Build failed: ${error.message || error}`)
+  process.exitCode = 1
+})
diff --git a/scripts/fix/external-imports.mjs b/scripts/fix/external-imports.mjs
new file mode 100644
index 0000000..bbf8b9a
--- /dev/null
+++ b/scripts/fix/external-imports.mjs
@@ -0,0 +1,158 @@
+/**
+ * @fileoverview Fix external package imports to point to dist/external.
+ * Rewrites require('package') to require('./external/package') for bundled externals.
+ */
+
+import { promises as fs } from 'node:fs'
+import path from 'node:path'
+import { fileURLToPath } from 'node:url'
+
+import colors from 'yoctocolors-cjs'
+
+import { isQuiet } from '#socketsecurity/lib/argv/flags'
+import { getDefaultLogger } from '#socketsecurity/lib/logger'
+
+import { externalPackages, scopedPackages } from '../build-externals/config.mjs'
+
+const logger = getDefaultLogger()
+const printCompletedHeader = title => console.log(colors.green(`✓ ${title}`))
+
+const __dirname = path.dirname(fileURLToPath(import.meta.url))
+const distDir = path.resolve(__dirname, '..', 'dist')
+const distExternalDir = path.join(distDir, 'external')
+
+// Build list of all external packages to rewrite
+const allExternalPackages = [
+  ...externalPackages.map(p => p.name),
+  ...scopedPackages.flatMap(s => {
+    if (s.name) {
+      return [`${s.scope}/${s.name}`]
+    }
+    if (s.packages) {
+      return s.packages.map(name => `${s.scope}/${name}`)
+    }
+    return []
+  }),
+]
+
+/**
+ * Calculate the relative path from a file to the external directory.
+ *
+ * @param {string} filePath - The path to the file being processed
+ * @returns {string} The relative path prefix (e.g., './' or '../')
+ */
+function getExternalPathPrefix(filePath) {
+  const dir = path.dirname(filePath)
+  const relativePath = path.relative(dir, distExternalDir)
+  // Normalize to forward slashes and ensure it starts with ./ or ../
+  const normalized = relativePath.replace(/\\/g, '/')
+  return normalized.startsWith('.') ? normalized : `./${normalized}`
+}
+
+/**
+ * Rewrite external package imports in a file.
+ *
+ * @param {string} filePath - Path to the file to process
+ * @param {boolean} verbose - Show individual file fixes
+ * @returns {Promise<boolean>} True if file was modified
+ */
+async function fixFileImports(filePath, verbose = false) {
+  let content = await fs.readFile(filePath, 'utf8')
+  let modified = false
+
+  const externalPrefix = getExternalPathPrefix(filePath)
+
+  for (const pkg of allExternalPackages) {
+    // Escape special regex characters in package name
+    const escapedPkg = pkg.replace(/[.*+?^${}()|[\]\\]/g, '\\$&')
+
+    // Match require('pkg') or require("pkg")
+    // Don't match if it's already pointing to ./external/ or ../external/
+    const requirePattern = new RegExp(
+      `require\\((['"])(?!\\.\\.?\\/external\\/)${escapedPkg}\\1\\)`,
+      'g',
+    )
+
+    if (requirePattern.test(content)) {
+      // Replace with require('./external/pkg') or require('../external/pkg')
+      const replacement = `require('${externalPrefix}/${pkg}')`
+      content = content.replace(requirePattern, replacement)
+      modified = true
+    }
+  }
+
+  if (modified) {
+    await fs.writeFile(filePath, content)
+    if (verbose) {
+      const relativePath = path.relative(distDir, filePath)
+      console.log(`    Fixed ${relativePath}`)
+    }
+  }
+
+  return modified
+}
+
+/**
+ * Process files in a directory and fix external imports.
+ *
+ * @param {string} dir - Directory to process
+ * @param {boolean} verbose - Show individual file fixes
+ * @returns {Promise<number>} Number of files fixed
+ */
+async function processDirectory(dir, verbose = false) {
+  let fixedCount = 0
+
+  try {
+    const entries = await fs.readdir(dir, { withFileTypes: true })
+
+    for (const entry of entries) {
+      const fullPath = path.join(dir, entry.name)
+
+      // Skip the external directory itself
+      if (entry.isDirectory() && fullPath === distExternalDir) {
+        continue
+      }
+
+      if (entry.isDirectory()) {
+        fixedCount += await processDirectory(fullPath, verbose)
+      } else if (entry.isFile() && entry.name.endsWith('.js')) {
+        const wasFixed = await fixFileImports(fullPath, verbose)
+        if (wasFixed) {
+          fixedCount += 1
+        }
+      }
+    }
+  } catch (error) {
+    // Skip directories that don't exist
+    if (error.code !== 'ENOENT') {
+      throw error
+    }
+  }
+
+  return fixedCount
+}
+
+async function fixExternalImports() {
+  const verbose = process.argv.includes('--verbose')
+  const quiet = isQuiet()
+
+  try {
+    const fixedCount = await processDirectory(distDir, verbose)
+
+    if (!quiet) {
+      const title =
+        fixedCount > 0
+          ? `External Imports (${fixedCount} file${fixedCount === 1 ? '' : 's'})`
+          : 'External Imports (no changes)'
+      printCompletedHeader(title)
+    }
+  } catch (error) {
+    logger.error(`Failed to fix external imports: ${error.message}`)
+    process.exitCode = 1
+  }
+}
+
+fixExternalImports().catch(error => {
+  logger.error(`Build failed: ${error.message || error}`)
+  process.exitCode = 1
+})
diff --git a/scripts/generate-package-exports.mjs b/scripts/fix/generate-package-exports.mjs
similarity index 94%
rename from scripts/generate-package-exports.mjs
rename to scripts/fix/generate-package-exports.mjs
index c75a85f..92271a2 100644
--- a/scripts/generate-package-exports.mjs
+++ b/scripts/fix/generate-package-exports.mjs
@@ -1,5 +1,6 @@
 /** @fileoverview Update registry package.json with exports, browser fields, and Node.js engine range. */
 
+import { promises as fs } from 'node:fs'
 import path from 'node:path'
 import { fileURLToPath } from 'node:url'
 
@@ -8,7 +9,14 @@ import builtinNames from '@socketregistry/packageurl-js/data/npm/builtin-names.j
 }
 import fastGlob from 'fast-glob'
 
-import { readPackageJson, toSortedObject } from './utils/helpers.mjs'
+import { toSortedObject } from '#socketsecurity/lib/objects'
+import { readPackageJson } from '#socketsecurity/lib/packages'
+
+// Helper to write package.json with proper formatting
+async function writePackageJson(filePath, data) {
+  const content = `${JSON.stringify(data, null, 2)}\n`
+  await fs.writeFile(filePath, content, 'utf8')
+}
 
 const __dirname = path.dirname(fileURLToPath(import.meta.url))
 
@@ -16,7 +24,7 @@ const __dirname = path.dirname(fileURLToPath(import.meta.url))
 const constants = {
   EXT_DTS: '.d.ts',
   EXT_JSON: '.json',
-  registryPkgPath: path.join(__dirname, '..'),
+  registryPkgPath: path.join(__dirname, '..', '..'),
   ignoreGlobs: [
     '**/node_modules/**',
     '**/.git/**',
@@ -44,7 +52,6 @@ async function main() {
   const registryEditablePkgJson = {
     content: registryPkgJsonData,
     save: async function () {
-      const { writePackageJson } = await import('./utils/helpers.mjs')
       await writePackageJson(registryPkgJsonPath, this.content)
     },
     update: function (updates) {
diff --git a/scripts/fix/main.mjs b/scripts/fix/main.mjs
new file mode 100644
index 0000000..d708bd5
--- /dev/null
+++ b/scripts/fix/main.mjs
@@ -0,0 +1,70 @@
+/**
+ * @fileoverview Orchestrates all post-build fix scripts.
+ * Runs generate-package-exports and fix-external-imports in sequence.
+ */
+
+import { isQuiet } from '#socketsecurity/lib/argv/flags'
+import { getDefaultLogger } from '#socketsecurity/lib/logger'
+import { printFooter, printHeader } from '#socketsecurity/lib/stdio/header'
+
+import { runSequence } from '../utils/run-command.mjs'
+
+const logger = getDefaultLogger()
+
+async function main() {
+  const verbose = process.argv.includes('--verbose')
+  const quiet = isQuiet()
+
+  if (!quiet) {
+    printHeader('Fixing Build Output')
+  }
+
+  const fixArgs = []
+  if (quiet) {
+    fixArgs.push('--quiet')
+  }
+  if (verbose) {
+    fixArgs.push('--verbose')
+  }
+
+  const exitCode = await runSequence([
+    {
+      args: ['scripts/fix/generate-package-exports.mjs', ...fixArgs],
+      command: 'node',
+    },
+    {
+      args: ['scripts/fix/path-aliases.mjs', ...fixArgs],
+      command: 'node',
+    },
+    {
+      args: ['scripts/fix/external-imports.mjs', ...fixArgs],
+      command: 'node',
+    },
+    {
+      args: ['scripts/fix/commonjs-exports.mjs', ...fixArgs],
+      command: 'node',
+    },
+    {
+      args: ['scripts/validate/esm-named-exports.mjs', ...fixArgs],
+      command: 'node',
+    },
+    {
+      args: ['scripts/validate/dist-exports.mjs', ...fixArgs],
+      command: 'node',
+    },
+  ])
+
+  if (!quiet) {
+    printFooter()
+  }
+
+  if (exitCode !== 0) {
+    logger.error('Build fixing failed')
+    process.exitCode = exitCode
+  }
+}
+
+main().catch(error => {
+  logger.error(`Build fixing failed: ${error.message || error}`)
+  process.exitCode = 1
+})
diff --git a/scripts/fix/path-aliases.mjs b/scripts/fix/path-aliases.mjs
new file mode 100644
index 0000000..1ca75e8
--- /dev/null
+++ b/scripts/fix/path-aliases.mjs
@@ -0,0 +1,170 @@
+/**
+ * @fileoverview Fix internal path aliases (#lib/*, #constants/*, etc.) to relative paths.
+ * Rewrites require('#lib/foo') to require('../foo') based on file location.
+ */
+
+import { promises as fs } from 'node:fs'
+import path from 'node:path'
+import { fileURLToPath } from 'node:url'
+
+import colors from 'yoctocolors-cjs'
+
+import { isQuiet } from '#socketsecurity/lib/argv/flags'
+import { getDefaultLogger } from '#socketsecurity/lib/logger'
+
+const logger = getDefaultLogger()
+const printCompletedHeader = title => console.log(colors.green(`✓ ${title}`))
+
+const __dirname = path.dirname(fileURLToPath(import.meta.url))
+const distDir = path.resolve(__dirname, '..', 'dist')
+const _srcDir = path.resolve(__dirname, '..', 'src')
+
+// Map of path aliases to their actual directories
+const pathAliases = {
+  '#lib/': distDir,
+  '#constants/': path.join(distDir, 'constants'),
+  '#env/': path.join(distDir, 'env'),
+  '#packages/': path.join(distDir, 'packages'),
+  '#utils/': path.join(distDir, 'utils'),
+  '#types': path.join(distDir, 'types'),
+}
+
+/**
+ * Calculate the relative path from a file to the target.
+ *
+ * @param {string} filePath - The path to the file being processed
+ * @param {string} targetPath - The path to the target file/directory
+ * @returns {string} The relative path (e.g., './foo' or '../bar')
+ */
+function getRelativePath(filePath, targetPath) {
+  const dir = path.dirname(filePath)
+  let relativePath = path.relative(dir, targetPath)
+
+  // Normalize to forward slashes
+  relativePath = relativePath.replace(/\\/g, '/')
+
+  // Ensure it starts with ./ or ../
+  if (!relativePath.startsWith('.')) {
+    relativePath = `./${relativePath}`
+  }
+
+  return relativePath
+}
+
+/**
+ * Rewrite path alias imports in a file.
+ *
+ * @param {string} filePath - Path to the file to process
+ * @param {boolean} verbose - Show individual file fixes
+ * @returns {Promise<boolean>} True if file was modified
+ */
+async function fixFileAliases(filePath, verbose = false) {
+  let content = await fs.readFile(filePath, 'utf8')
+  let modified = false
+
+  for (const [alias, basePath] of Object.entries(pathAliases)) {
+    const isExact = !alias.endsWith('/')
+
+    // Escape special regex characters
+    const escapedAlias = alias.replace(/[.*+?^${}()|[\]\\]/g, '\\$&')
+
+    // Match require('#lib/foo') or require("#lib/foo") or require('#types')
+    // Capture the quote style and the subpath
+    const requirePattern = new RegExp(
+      `require\\((['"])${escapedAlias}([^'"]*?)\\1\\)`,
+      'g',
+    )
+
+    const matches = [...content.matchAll(requirePattern)]
+
+    for (const match of matches) {
+      const [fullMatch, quote, subpath] = match
+
+      // Calculate target path
+      const targetPath = isExact ? basePath : path.join(basePath, subpath || '')
+
+      // Calculate relative path from this file
+      const relativePath = getRelativePath(filePath, targetPath)
+
+      // Replace with require('./relative/path')
+      const replacement = `require(${quote}${relativePath}${quote})`
+      content = content.replace(fullMatch, replacement)
+      modified = true
+    }
+  }
+
+  if (modified) {
+    await fs.writeFile(filePath, content)
+    if (verbose) {
+      const relativePath = path.relative(distDir, filePath)
+      console.log(`    Fixed ${relativePath}`)
+    }
+  }
+
+  return modified
+}
+
+/**
+ * Process files in a directory and fix path aliases.
+ *
+ * @param {string} dir - Directory to process
+ * @param {boolean} verbose - Show individual file fixes
+ * @returns {Promise<number>} Number of files fixed
+ */
+async function processDirectory(dir, verbose = false) {
+  let fixedCount = 0
+
+  try {
+    const entries = await fs.readdir(dir, { withFileTypes: true })
+
+    for (const entry of entries) {
+      const fullPath = path.join(dir, entry.name)
+
+      // Skip the external directory
+      if (entry.isDirectory() && entry.name === 'external') {
+        continue
+      }
+
+      if (entry.isDirectory()) {
+        fixedCount += await processDirectory(fullPath, verbose)
+      } else if (entry.isFile() && entry.name.endsWith('.js')) {
+        const wasFixed = await fixFileAliases(fullPath, verbose)
+        if (wasFixed) {
+          fixedCount += 1
+        }
+      }
+    }
+  } catch (error) {
+    // Skip directories that don't exist
+    if (error.code !== 'ENOENT') {
+      throw error
+    }
+  }
+
+  return fixedCount
+}
+
+async function fixPathAliases() {
+  const verbose = process.argv.includes('--verbose')
+  const quiet = isQuiet()
+
+  try {
+    const fixedCount = await processDirectory(distDir, verbose)
+
+    if (!quiet) {
+      const title =
+        fixedCount > 0
+          ? `Path Aliases (${fixedCount} file${fixedCount === 1 ? '' : 's'})`
+          : 'Path Aliases (no changes)'
+      printCompletedHeader(title)
+    }
+  } catch (error) {
+    logger.error(`Failed to fix path aliases: ${error.message}`)
+    process.exitCode = 1
+  }
+}
+
+fixPathAliases().catch(error => {
+  logger.error(`Build failed: ${error.message || error}`)
+  process.exitCode = 1
+})
diff --git a/scripts/lint-external.mjs b/scripts/lint-external.mjs
deleted file mode 100644
index 36eab6d..0000000
--- a/scripts/lint-external.mjs
+++ /dev/null
@@ -1,44 +0,0 @@
-/**
- * @fileoverview Lint script for external dependencies in the registry.
- * Runs eslint on dist/external without auto-fix.
- *
- * Usage:
- *   node scripts/lint-external.mjs
- */
-
-import { runCommand } from '../../scripts/utils/run-command.mjs'
-import { logger } from './utils/helpers.mjs'
-
-async function main() {
-  try {
-    logger.info('Linting external dependencies...')
-
-    const exitCode = await runCommand(
-      'eslint',
-      [
-        '--config',
-        '../.config/eslint.config.mjs',
-        '--report-unused-disable-directives',
-        './dist/external',
-      ],
-      {
-        env: {
-          ...process.env,
-          LINT_EXTERNAL: '1',
-        },
-      },
-    )
-
-    if (exitCode !== 0) {
-      logger.error('External dependency linting failed')
-      process.exitCode = exitCode
-    } else {
-      logger.log('External dependency linting complete')
-    }
-  } catch (error) {
-    logger.error('Lint external failed:', error.message)
-    process.exitCode = 1
-  }
-}
-
-main().catch(console.error)
diff --git a/scripts/lint.mjs b/scripts/lint.mjs
index f35e945..6881c34 100644
--- a/scripts/lint.mjs
+++ b/scripts/lint.mjs
@@ -3,17 +3,23 @@
  * Provides smart linting that can target affected files or lint everything.
  */
 
-import { existsSync } from 'node:fs'
+import { existsSync, readFileSync } from 'node:fs'
 import path from 'node:path'
 
-import { isQuiet } from '@socketsecurity/lib/argv/flags'
-import { parseArgs } from '@socketsecurity/lib/argv/parse'
-import { getChangedFiles, getStagedFiles } from '@socketsecurity/lib/git'
-import { logger } from '@socketsecurity/lib/logger'
-import { printHeader } from '@socketsecurity/lib/stdio/header'
+import {
+  getChangedFilesSync,
+  getStagedFilesSync,
+} from '#socketsecurity/lib/git'
 
+import { isQuiet } from '#socketsecurity/lib/argv/flags'
+import { getDefaultLogger } from '#socketsecurity/lib/logger'
+import { printHeader } from '#socketsecurity/lib/stdio/header'
+
+import { parseArgs } from './utils/parse-args.mjs'
 import { runCommandQuiet } from './utils/run-command.mjs'
 
+const logger = getDefaultLogger()
+
 // Files that trigger a full lint when changed
 const CORE_FILES = new Set([
   'src/constants.ts',
@@ -35,6 +41,57 @@ const CONFIG_PATTERNS = [
   'eslint.config.*',
 ]
 
+/**
+ * Get Biome exclude patterns from biome.json.
+ */
+function getBiomeExcludePatterns() {
+  try {
+    const biomeConfigPath = path.join(process.cwd(), 'biome.json')
+    if (!existsSync(biomeConfigPath)) {
+      return []
+    }
+
+    const biomeConfig = JSON.parse(readFileSync(biomeConfigPath, 'utf8'))
+    const includes = biomeConfig['files']?.['includes'] ?? []
+
+    // Extract patterns that start with '!' (exclude patterns)
+    return (
+      includes
+        .filter(
+          pattern => typeof pattern === 'string' && pattern.startsWith('!'),
+        )
+        // Remove the '!' prefix
+        .map(pattern => pattern.slice(1))
+    )
+  } catch {
+    // If we can't read biome.json, return empty array
+    return []
+  }
+}
+
+/**
+ * Check if a file matches any of the exclude patterns.
+ */
+function isExcludedByBiome(file, excludePatterns) {
+  for (const pattern of excludePatterns) {
+    // Convert glob pattern to regex-like matching
+    // Support **/ for directory wildcards and * for filename wildcards
+    const regexPattern = pattern
+      // **/ matches any directory
+      .replace(/\*\*\//g, '.*')
+      // * matches any characters except /
+      .replace(/\*/g, '[^/]*')
+      // Escape dots
+      .replace(/\./g, '\\.')
+
+    const regex = new RegExp(`^${regexPattern}$`)
+    if (regex.test(file)) {
+      return true
+    }
+  }
+  return false
+}
+
 /**
  * Check if we should run all linters based on changed files.
  */
@@ -74,10 +131,21 @@ function filterLintableFiles(files) {
     '.yaml',
   ])
 
+  const biomeExcludePatterns = getBiomeExcludePatterns()
+
   return files.filter(file => {
     const ext = path.extname(file)
     // Only lint files that have lintable extensions AND still exist.
-    return lintableExtensions.has(ext) && existsSync(file)
+    if (!lintableExtensions.has(ext) || !existsSync(file)) {
+      return false
+    }
+
+    // Filter out files excluded by biome.json
+    if (isExcludedByBiome(file, biomeExcludePatterns)) {
+      return false
+    }
+
+    return true
   })
 }
 
@@ -133,6 +201,16 @@ async function runLintOnFiles(files, options = {}) {
     const result = await runCommandQuiet('pnpm', args)
 
     if (result.exitCode !== 0) {
+      // Check if Biome simply had no files to process (not an error)
+      const isBiomeNoFilesError = result.stderr?.includes(
+        'No files were processed in the specified paths',
+      )
+
+      if (isBiomeNoFilesError) {
+        // Biome had nothing to do - this is fine, continue to next linter
+        continue
+      }
+
       // When fixing, non-zero exit codes are normal if fixes were applied.
       if (!fix || (result.stderr && result.stderr.trim().length > 0)) {
         if (!quiet) {
@@ -151,8 +229,8 @@ async function runLintOnFiles(files, options = {}) {
 
   if (!quiet) {
     logger.clearLine().done('Linting passed')
-    // Add newline after message (use error to write to same stream)
-    logger.error('')
+    // Add newline after message
+    console.log('')
   }
 
   return 0
@@ -197,6 +275,16 @@ async function runLintOnAll(options = {}) {
     const result = await runCommandQuiet('pnpm', args)
 
     if (result.exitCode !== 0) {
+      // Check if Biome simply had no files to process (not an error)
+      const isBiomeNoFilesError = result.stderr?.includes(
+        'No files were processed in the specified paths',
+      )
+
+      if (isBiomeNoFilesError) {
+        // Biome had nothing to do - this is fine, continue to next linter
+        continue
+      }
+
       // When fixing, non-zero exit codes are normal if fixes were applied.
       if (!fix || (result.stderr && result.stderr.trim().length > 0)) {
         if (!quiet) {
@@ -215,8 +303,8 @@ async function runLintOnAll(options = {}) {
 
   if (!quiet) {
     logger.clearLine().done('Linting passed')
-    // Add newline after message (use error to write to same stream)
-    logger.error('')
+    // Add newline after message
+    console.log('')
   }
 
   return 0
@@ -240,20 +328,20 @@ async function getFilesToLint(options) {
 
   if (staged) {
     mode = 'staged'
-    changedFiles = await getStagedFiles({ absolute: false })
+    changedFiles = getStagedFilesSync({ absolute: false })
     if (!changedFiles.length) {
       return { files: null, reason: 'no staged files', mode }
     }
   } else if (changed) {
     mode = 'changed'
-    changedFiles = await getChangedFiles({ absolute: false })
+    changedFiles = getChangedFilesSync({ absolute: false })
     if (!changedFiles.length) {
       return { files: null, reason: 'no changed files', mode }
     }
   } else {
     // Default to changed files if no specific flag
     mode = 'changed'
-    changedFiles = await getChangedFiles({ absolute: false })
+    changedFiles = getChangedFilesSync({ absolute: false })
     if (!changedFiles.length) {
       return { files: null, reason: 'no changed files', mode }
     }
diff --git a/scripts/non-barrel-imports.mjs b/scripts/non-barrel-imports.mjs
deleted file mode 100644
index 1a2acea..0000000
--- a/scripts/non-barrel-imports.mjs
+++ /dev/null
@@ -1,264 +0,0 @@
-/**
- * @fileoverview Non-barrel imports to avoid bundling unnecessary code.
- * Instead of importing entire packages, import only specific functions/modules we use.
- */
-
-export const nonBarrelImports = {
-  // Semver package has individual function exports we can use.
-  // DISABLED: The non-barrel approach doesn't work well because we need many
-  // range functions that aren't in the functions/ directory.
-  'semver-disabled': {
-    // Instead of: const semver = require('semver')
-    // We can import individual functions from semver/functions/*
-    customEntry: `
-      // Import ONLY the semver functions we actually use.
-      // Each is a separate module, avoiding the barrel file overhead.
-      module.exports = {
-        parse: require('semver/functions/parse'),
-        valid: require('semver/functions/valid'),
-        clean: require('semver/functions/clean'),
-        compare: require('semver/functions/compare'),
-        rcompare: require('semver/functions/rcompare'),
-        compareLoose: require('semver/functions/compare-loose'),
-        compareBuild: require('semver/functions/compare-build'),
-        sort: require('semver/functions/sort'),
-        rsort: require('semver/functions/rsort'),
-
-        gt: require('semver/functions/gt'),
-        lt: require('semver/functions/lt'),
-        eq: require('semver/functions/eq'),
-        neq: require('semver/functions/neq'),
-        gte: require('semver/functions/gte'),
-        lte: require('semver/functions/lte'),
-
-        inc: require('semver/functions/inc'),
-        diff: require('semver/functions/diff'),
-        major: require('semver/functions/major'),
-        minor: require('semver/functions/minor'),
-        patch: require('semver/functions/patch'),
-        prerelease: require('semver/functions/prerelease'),
-
-        satisfies: require('semver/functions/satisfies'),
-        coerce: require('semver/functions/coerce'),
-
-        // Re-export as default for compatibility.
-        default: require('semver/functions/satisfies')
-      };
-
-      // This avoids importing the SemVer class, Range class, and other
-      // heavy components we don't use, saving ~30-40% of semver's size.
-    `,
-  },
-
-  chalk: {
-    // If we were using chalk, we could import specific modules.
-    customEntry: `
-      // Import only the chalk modules we need.
-      const { Chalk } = require('chalk/source/index.js');
-      const chalk = new Chalk({ level: 2 }); // Force color level
-
-      module.exports = chalk;
-      module.exports.default = chalk;
-    `,
-  },
-
-  lodash: {
-    // Lodash has individual function modules.
-    customEntry: `
-      // Import specific lodash functions instead of the entire library.
-      module.exports = {
-        get: require('lodash/get'),
-        set: require('lodash/set'),
-        merge: require('lodash/merge'),
-        cloneDeep: require('lodash/cloneDeep'),
-        debounce: require('lodash/debounce'),
-        throttle: require('lodash/throttle'),
-        isEqual: require('lodash/isEqual'),
-        isEmpty: require('lodash/isEmpty'),
-        omit: require('lodash/omit'),
-        pick: require('lodash/pick'),
-        // Add only functions we actually use.
-      };
-    `,
-  },
-
-  rxjs: {
-    // RxJS has deep imports for operators.
-    customEntry: `
-      // Import only the RxJS components we use.
-      module.exports = {
-        Observable: require('rxjs/internal/Observable').Observable,
-        Subject: require('rxjs/internal/Subject').Subject,
-        from: require('rxjs/internal/observable/from').from,
-        of: require('rxjs/internal/observable/of').of,
-        map: require('rxjs/internal/operators/map').map,
-        filter: require('rxjs/internal/operators/filter').filter,
-        tap: require('rxjs/internal/operators/tap').tap,
-        catchError: require('rxjs/internal/operators/catchError').catchError,
-        // Avoid importing all operators through the barrel.
-      };
-    `,
-  },
-
-  'date-fns': {
-    // date-fns has individual function exports.
-    customEntry: `
-      // Import only the date functions we use.
-      module.exports = {
-        format: require('date-fns/format'),
-        parseISO: require('date-fns/parseISO'),
-        isValid: require('date-fns/isValid'),
-        addDays: require('date-fns/addDays'),
-        subDays: require('date-fns/subDays'),
-        differenceInDays: require('date-fns/differenceInDays'),
-        // Each function is ~2-5KB, vs 200KB+ for the entire library.
-      };
-    `,
-  },
-
-  '@sindresorhus/is': {
-    // This package has a barrel file that exports everything.
-    customEntry: `
-      // Import only the type checks we use.
-      const is = require('@sindresorhus/is/dist/source/index.js');
-
-      // Re-export only what we need.
-      module.exports = {
-        string: is.string,
-        number: is.number,
-        boolean: is.boolean,
-        object: is.object,
-        array: is.array,
-        function: is.function_,
-        undefined: is.undefined_,
-        null: is.null_,
-        // Skip exotic type checks we don't use.
-      };
-    `,
-  },
-
-  globby: {
-    // Globby wraps fast-glob with additional features.
-    customEntry: `
-      // Import only the globby functions we use.
-      const {globby, globbySync} = require('globby');
-
-      module.exports = globby;
-      module.exports.sync = globbySync;
-      module.exports.default = globby;
-
-      // Skip gitignore, generateGlobTasks, isDynamicPattern, etc.
-    `,
-  },
-}
-
-/**
- * Analyze which functions from a package are actually used.
- * This helps identify opportunities for non-barrel imports.
- */
-export async function analyzePackageUsage(packageName, sourceDir) {
-  const fs = await import('node:fs').then(m => m.promises)
-  const path = await import('node:path')
-  const fastGlob = await import('fast-glob')
-
-  // Find all JS/TS files in the source directory.
-  const files = await fastGlob.glob(['**/*.{js,mjs,cjs,ts,mts,cts}'], {
-    cwd: sourceDir,
-    ignore: ['**/node_modules/**', '**/dist/**', '**/test/**'],
-  })
-
-  const usage = new Set()
-  const importPatterns = [
-    // CommonJS: const {fn} = require('package')
-    new RegExp(
-      `const\\s*{([^}]+)}\\s*=\\s*require\\(['"\`]${packageName}['"\`]\\)`,
-      'g',
-    ),
-    // CommonJS: const pkg = require('package'); pkg.fn()
-    new RegExp(
-      `const\\s+(\\w+)\\s*=\\s*require\\(['"\`]${packageName}['"\`]\\)[;\\s]+(\\1\\.(\\w+))`,
-      'g',
-    ),
-    // ES modules: import {fn} from 'package'
-    new RegExp(
-      `import\\s*{([^}]+)}\\s*from\\s*['"\`]${packageName}['"\`]`,
-      'g',
-    ),
-    // ES modules: import * as pkg from 'package'; pkg.fn()
-    new RegExp(
-      `import\\s*\\*\\s*as\\s+(\\w+)\\s*from\\s*['"\`]${packageName}['"\`][;\\s]+(\\1\\.(\\w+))`,
-      'g',
-    ),
-  ]
-
-  for (const file of files) {
-    const content = await fs.readFile(path.join(sourceDir, file), 'utf8')
-
-    for (const pattern of importPatterns) {
-      let match = pattern.exec(content)
-      while (match !== null) {
-        // Extract function names from destructuring or property access.
-        const functions = match[1] || match[3]
-        if (functions) {
-          functions.split(',').forEach(fn => {
-            usage.add(fn.trim().replace(/\s+as\s+\w+/, ''))
-          })
-        }
-        match = pattern.exec(content)
-      }
-    }
-  }
-
-  return Array.from(usage)
-}
-
-/**
- * Generate a custom entry file using non-barrel imports.
- */
-export async function createNonBarrelEntry(packageName, _tempDir) {
-  const fs = await import('node:fs').then(m => m.promises)
-  const path = await import('node:path')
-  const { createRequire } = await import('node:module')
-
-  const config = nonBarrelImports[packageName]
-  if (!config?.customEntry) {
-    // Use default entry.
-    return null
-  }
-
-  // Create temp entry file in project root where node_modules is accessible.
-  // Use a .tmp directory that's gitignored.
-  const tmpDir = path.join(process.cwd(), '.tmp-build')
-  await fs.mkdir(tmpDir, { recursive: true })
-
-  const tempFile = path.join(
-    tmpDir,
-    `${packageName.replace(/[/@]/g, '-')}-entry.js`,
-  )
-
-  // Write the custom entry with adjusted require paths if needed.
-  const entryContent = config.customEntry.trim()
-
-  // For semver, we need to ensure the paths resolve correctly.
-  if (packageName === 'semver') {
-    // Create a require function from the temp file location.
-    const req = createRequire(tempFile)
-
-    // Verify that the paths exist before writing.
-    try {
-      req.resolve('semver/functions/parse')
-      // Paths are valid, use the original entry.
-    } catch {
-      // Paths don't resolve, fall back to regular import.
-      console.log(
-        `  Note: Non-barrel imports not available for ${packageName}, using default entry`,
-      )
-      await fs.rm(tmpDir, { recursive: true, force: true })
-      return null
-    }
-  }
-
-  await fs.writeFile(tempFile, entryContent)
-
-  return tempFile
-}
diff --git a/scripts/optimization-config.mjs b/scripts/optimization-config.mjs
deleted file mode 100644
index f53469e..0000000
--- a/scripts/optimization-config.mjs
+++ /dev/null
@@ -1,185 +0,0 @@
-/**
- * @fileoverview Comprehensive optimization configurations for external bundles.
- */
-
-export const optimizationStrategies = {
-  // 1. MODULE REPLACEMENT - Use lighter alternatives.
-  moduleReplacements: {
-    // Replace heavy modules with lighter/native alternatives.
-    // Node has native recursive mkdir.
-    mkdirp: 'fs.promises.mkdir',
-    // Node has native recursive rm.
-    rimraf: 'fs.promises.rm',
-    // We already use fast-glob.
-    glob: 'fast-glob',
-    // Tree-shakeable version.
-    lodash: 'lodash-es',
-    // Native in Node 14.17+.
-    'uuid/v4': 'crypto.randomUUID',
-    // Built into Node 18+.
-    'node-fetch': 'undici',
-  },
-
-  // 2. SELECTIVE IMPORTS - Cherry-pick only what we need.
-  selectiveImports: {
-    lodash: ['get', 'set', 'merge', 'cloneDeep'],
-    rxjs: ['Observable', 'Subject', 'from', 'of'],
-    'date-fns': ['format', 'parseISO', 'isValid'],
-  },
-
-  // 3. LOCALE/DATA STRIPPING - Remove unnecessary data files.
-  stripPatterns: [
-    // Moment.js locales (if any package uses it).
-    /moment\/locale\/[^/]+$/,
-    // Timezone data we don't need.
-    /timezone\/[^/]+\.json$/,
-    // Test fixtures and examples.
-    /\/(test|tests|spec|specs|__tests__|examples?|demo|docs?)\//,
-    // Source maps.
-    /\.map$/,
-    // TypeScript source files.
-    /\.ts$/,
-    // README/LICENSE/CHANGELOG in dependencies.
-    /node_modules\/[^/]+\/(README|LICENSE|CHANGELOG|HISTORY)/i,
-  ],
-
-  // 4. COMPILE-TIME CONSTANTS - More aggressive dead code elimination.
-  defineConstants: {
-    // Development/debugging flags.
-    'process.env.NODE_ENV': '"production"',
-    'process.env.DEBUG': 'undefined',
-    __DEV__: 'false',
-    __TEST__: 'false',
-    __DEBUG__: 'false',
-
-    // Browser/Node detection.
-    'process.browser': 'false',
-    'typeof window': '"undefined"',
-    'typeof document': '"undefined"',
-    'typeof navigator': '"undefined"',
-
-    // Feature flags.
-    'process.env.VERBOSE': 'false',
-    'process.env.CI': 'false',
-    'process.env.SILENT': 'true',
-
-    // Package-specific flags.
-    'global.GENTLY': 'false',
-    'process.env.SUPPRESS_NO_CONFIG_WARNING': 'true',
-    'process.env.NODE_NO_WARNINGS': '1',
-  },
-
-  // 5. BUNDLER HINTS - Mark side-effect free packages.
-  sideEffectsFreePackages: [
-    'semver',
-    'yargs-parser',
-    'picomatch',
-    'fast-glob',
-    'debug',
-    'which',
-  ],
-
-  // 6. HEAVY DEPENDENCY ALTERNATIVES.
-  alternativePackages: {
-    pacote: {
-      // Instead of full pacote, we could use targeted npm APIs.
-      alternative: '@npmcli/arborist',
-      reason: 'Lighter weight for specific operations',
-    },
-    'make-fetch-happen': {
-      // Native fetch with retries.
-      alternative: 'p-retry + native fetch',
-      reason: 'Node 18+ has native fetch',
-    },
-    cacache: {
-      // Simple file-based cache.
-      alternative: 'flat-cache',
-      reason: 'Simpler caching for our use case',
-    },
-  },
-
-  // 7. CODE SPLITTING - Split rarely used code.
-  codeSplitPoints: {
-    // Error handling could be lazy-loaded.
-    errors: /throw\s+new\s+[A-Z]\w+Error/,
-    // CLI-specific code could be separate.
-    cli: /yargs|commander|minimist/,
-    // Validation could be lazy.
-    validation: /ajv|joi|yup|zod/,
-  },
-
-  // 8. BINARY DATA OPTIMIZATION.
-  binaryOptimization: {
-    // Convert base64 to external files.
-    extractBase64: true,
-    // Compress large string literals.
-    compressStrings: true,
-    // External data files.
-    externalizeData: ['*.json', '*.xml', '*.yaml'],
-  },
-
-  // 9. AGGRESSIVE MINIFICATION.
-  minificationOptions: {
-    // Remove all comments including licenses.
-    legalComments: 'none',
-    // Short variable names.
-    identifierBase: 36,
-    // Inline simple functions.
-    inlineLimit: 10,
-    // Fold constant expressions.
-    constantFolding: true,
-  },
-
-  // 10. NPM-SPECIFIC OPTIMIZATIONS.
-  npmOptimizations: {
-    // Skip package validation in production.
-    skipValidation: true,
-    // Don't load package scripts.
-    ignoreScripts: true,
-    // Skip optional dependencies.
-    skipOptional: true,
-    // Use minimal manifest.
-    minimalManifest: true,
-  },
-}
-
-// Generate package-specific optimization config.
-export function getPackageOptimizations(packageName) {
-  const opts = {
-    external: [],
-    define: { ...optimizationStrategies.defineConstants },
-    pure: [],
-  }
-
-  // Package-specific optimizations.
-  switch (packageName) {
-    case 'pacote':
-      // Pacote includes git support we might not need.
-      opts.external.push('isomorphic-git', 'dugite')
-      opts.define['process.env.PACOTE_NO_GIT'] = 'true'
-      break
-
-    case 'libnpmpack':
-      // Includes tar creation we might handle differently.
-      opts.pure.push('console.time', 'console.timeEnd')
-      break
-
-    case 'make-fetch-happen':
-      // Has extensive caching we might not use.
-      opts.define['process.env.NO_PROXY_CACHE'] = 'true'
-      break
-
-    case 'browserslist':
-      // Has update checking we don't need.
-      opts.define['process.env.BROWSERSLIST_DISABLE_CACHE'] = 'true'
-      break
-
-    case 'zod':
-      // Remove error map translations.
-      opts.external.push('./locales/*')
-      opts.define['process.env.ZOD_NO_ERRORS'] = 'false'
-      break
-  }
-
-  return opts
-}
diff --git a/scripts/test.mjs b/scripts/test.mjs
deleted file mode 100644
index 8c485d1..0000000
--- a/scripts/test.mjs
+++ /dev/null
@@ -1,452 +0,0 @@
-/**
- * @fileoverview Unified test runner that provides a smooth, single-script experience.
- * Combines check, build, and test steps with clean, consistent output.
- */
-
-import { spawn } from 'node:child_process'
-import { existsSync } from 'node:fs'
-import path from 'node:path'
-import { fileURLToPath } from 'node:url'
-
-import { parseArgs } from '@socketsecurity/lib/argv/parse'
-import { logger } from '@socketsecurity/lib/logger'
-import { onExit } from '@socketsecurity/lib/signal-exit'
-import { spinner } from '@socketsecurity/lib/spinner'
-import { printHeader } from '@socketsecurity/lib/stdio/header'
-
-import { getTestsToRun } from './utils/changed-test-mapper.mjs'
-
-const WIN32 = process.platform === 'win32'
-
-// Suppress non-fatal worker termination unhandled rejections
-process.on('unhandledRejection', (reason, _promise) => {
-  const errorMessage = String(reason?.message || reason || '')
-  // Filter out known non-fatal worker termination errors
-  if (
-    errorMessage.includes('Terminating worker thread') ||
-    errorMessage.includes('ThreadTermination')
-  ) {
-    // Ignore these - they're cleanup messages from vitest worker threads
-    return
-  }
-  // Re-throw other unhandled rejections
-  throw reason
-})
-
-const __dirname = path.dirname(fileURLToPath(import.meta.url))
-const rootPath = path.resolve(__dirname, '..')
-const nodeModulesBinPath = path.join(rootPath, 'node_modules', '.bin')
-
-// Track running processes for cleanup
-const runningProcesses = new Set()
-
-// Setup exit handler
-const removeExitHandler = onExit((_code, signal) => {
-  // Stop spinner first
-  try {
-    spinner.stop()
-  } catch {}
-
-  // Kill all running processes
-  for (const child of runningProcesses) {
-    try {
-      child.kill('SIGTERM')
-    } catch {}
-  }
-
-  if (signal) {
-    console.log(`\nReceived ${signal}, cleaning up...`)
-    // Let onExit handle the exit with proper code
-    process.exitCode = 128 + (signal === 'SIGINT' ? 2 : 15)
-  }
-})
-
-async function runCommand(command, args = [], options = {}) {
-  return new Promise((resolve, reject) => {
-    const child = spawn(command, args, {
-      stdio: 'inherit',
-      ...(process.platform === 'win32' && { shell: true }),
-      ...options,
-    })
-
-    runningProcesses.add(child)
-
-    child.on('exit', code => {
-      runningProcesses.delete(child)
-      resolve(code || 0)
-    })
-
-    child.on('error', error => {
-      runningProcesses.delete(child)
-      reject(error)
-    })
-  })
-}
-
-async function runCommandWithOutput(command, args = [], options = {}) {
-  return new Promise((resolve, reject) => {
-    let stdout = ''
-    let stderr = ''
-
-    const child = spawn(command, args, {
-      ...(process.platform === 'win32' && { shell: true }),
-      ...options,
-    })
-
-    runningProcesses.add(child)
-
-    if (child.stdout) {
-      child.stdout.on('data', data => {
-        stdout += data.toString()
-      })
-    }
-
-    if (child.stderr) {
-      child.stderr.on('data', data => {
-        stderr += data.toString()
-      })
-    }
-
-    child.on('exit', code => {
-      runningProcesses.delete(child)
-      resolve({ code: code || 0, stdout, stderr })
-    })
-
-    child.on('error', error => {
-      runningProcesses.delete(child)
-      reject(error)
-    })
-  })
-}
-
-async function runCheck() {
-  logger.step('Running checks')
-
-  // Run fix (auto-format) quietly since it has its own output
-  spinner.start('Formatting code...')
-  let exitCode = await runCommand('pnpm', ['run', 'fix'], {
-    stdio: 'pipe',
-  })
-  if (exitCode !== 0) {
-    spinner.stop()
-    logger.error('Formatting failed')
-    // Re-run with output to show errors
-    await runCommand('pnpm', ['run', 'fix'])
-    return exitCode
-  }
-  spinner.stop()
-  logger.success('Code formatted')
-
-  // Run ESLint to check for remaining issues
-  spinner.start('Running ESLint...')
-  exitCode = await runCommand(
-    'eslint',
-    [
-      '--config',
-      '.config/eslint.config.mjs',
-      '--report-unused-disable-directives',
-      '.',
-    ],
-    {
-      stdio: 'pipe',
-    },
-  )
-  if (exitCode !== 0) {
-    spinner.stop()
-    logger.error('ESLint failed')
-    // Re-run with output to show errors
-    await runCommand('eslint', [
-      '--config',
-      '.config/eslint.config.mjs',
-      '--report-unused-disable-directives',
-      '.',
-    ])
-    return exitCode
-  }
-  spinner.stop()
-  logger.success('ESLint passed')
-
-  // Run TypeScript check
-  spinner.start('Checking TypeScript...')
-  exitCode = await runCommand(
-    'tsgo',
-    ['--noEmit', '-p', '.config/tsconfig.check.json'],
-    {
-      stdio: 'pipe',
-    },
-  )
-  if (exitCode !== 0) {
-    spinner.stop()
-    logger.error('TypeScript check failed')
-    // Re-run with output to show errors
-    await runCommand('tsgo', ['--noEmit', '-p', '.config/tsconfig.check.json'])
-    return exitCode
-  }
-  spinner.stop()
-  logger.success('TypeScript check passed')
-
-  return exitCode
-}
-
-async function runBuild() {
-  const distIndexPath = path.join(rootPath, 'dist', 'index.js')
-  if (!existsSync(distIndexPath)) {
-    logger.step('Building project')
-    return runCommand('pnpm', ['run', 'build'])
-  }
-  return 0
-}
-
-async function runTests(options, positionals = []) {
-  const { all, coverage, force, staged, update } = options
-  const runAll = all || force
-
-  // Get tests to run
-  const testInfo = getTestsToRun({ staged, all: runAll })
-  const { mode, reason, tests: testsToRun } = testInfo
-
-  // No tests needed
-  if (testsToRun === null) {
-    logger.substep('No relevant changes detected, skipping tests')
-    return 0
-  }
-
-  // Prepare vitest command
-  const vitestCmd = WIN32 ? 'vitest.cmd' : 'vitest'
-  const vitestPath = path.join(nodeModulesBinPath, vitestCmd)
-
-  const vitestArgs = ['--config', '.config/vitest.config.mts', 'run']
-
-  // Add coverage if requested
-  if (coverage) {
-    vitestArgs.push('--coverage')
-  }
-
-  // Add update if requested
-  if (update) {
-    vitestArgs.push('--update')
-  }
-
-  // Add test patterns if not running all
-  if (testsToRun === 'all') {
-    logger.step(`Running all tests (${reason})`)
-  } else {
-    const modeText = mode === 'staged' ? 'staged' : 'changed'
-    logger.step(`Running tests for ${modeText} files:`)
-    testsToRun.forEach(test => logger.substep(test))
-    vitestArgs.push(...testsToRun)
-  }
-
-  // Add any additional positional arguments
-  if (positionals.length > 0) {
-    vitestArgs.push(...positionals)
-  }
-
-  const spawnOptions = {
-    cwd: rootPath,
-    env: {
-      ...process.env,
-      NODE_OPTIONS:
-        `${process.env.NODE_OPTIONS || ''} --max-old-space-size=${process.env.CI ? 8192 : 4096} --unhandled-rejections=warn`.trim(),
-    },
-    stdio: 'inherit',
-  }
-
-  // Use dotenvx to load test environment
-  const dotenvxCmd = WIN32 ? 'dotenvx.cmd' : 'dotenvx'
-  const dotenvxPath = path.join(nodeModulesBinPath, dotenvxCmd)
-
-  // Use interactive runner for interactive Ctrl+O experience when appropriate
-  if (process.stdout.isTTY) {
-    const { runTests } = await import('./utils/interactive-runner.mjs')
-    return runTests(
-      dotenvxPath,
-      ['-q', 'run', '-f', '.env.test', '--', vitestPath, ...vitestArgs],
-      {
-        env: spawnOptions.env,
-        cwd: spawnOptions.cwd,
-        verbose: false,
-      },
-    )
-  }
-
-  // Fallback to execution with output capture to handle worker termination errors
-  const result = await runCommandWithOutput(
-    dotenvxPath,
-    ['-q', 'run', '-f', '.env.test', '--', vitestPath, ...vitestArgs],
-    {
-      ...spawnOptions,
-      stdio: ['inherit', 'pipe', 'pipe'],
-    },
-  )
-
-  // Print output
-  if (result.stdout) {
-    process.stdout.write(result.stdout)
-  }
-  if (result.stderr) {
-    process.stderr.write(result.stderr)
-  }
-
-  // Check if we have worker termination error but no test failures
-  const hasWorkerTerminationError =
-    (result.stdout + result.stderr).includes('Terminating worker thread') ||
-    (result.stdout + result.stderr).includes('ThreadTermination')
-
-  const output = result.stdout + result.stderr
-  const hasTestFailures =
-    output.includes('FAIL') ||
-    (output.includes('Test Files') && output.match(/(\d+) failed/) !== null) ||
-    (output.includes('Tests') && output.match(/Tests\s+\d+ failed/) !== null)
-
-  // Override exit code if we only have worker termination errors
-  if (result.code !== 0 && hasWorkerTerminationError && !hasTestFailures) {
-    return 0
-  }
-
-  return result.code
-}
-
-async function main() {
-  try {
-    // Parse arguments
-    const { positionals, values } = parseArgs({
-      options: {
-        help: {
-          type: 'boolean',
-          default: false,
-        },
-        fast: {
-          type: 'boolean',
-          default: false,
-        },
-        quick: {
-          type: 'boolean',
-          default: false,
-        },
-        'skip-build': {
-          type: 'boolean',
-          default: false,
-        },
-        staged: {
-          type: 'boolean',
-          default: false,
-        },
-        all: {
-          type: 'boolean',
-          default: false,
-        },
-        force: {
-          type: 'boolean',
-          default: false,
-        },
-        cover: {
-          type: 'boolean',
-          default: false,
-        },
-        coverage: {
-          type: 'boolean',
-          default: false,
-        },
-        update: {
-          type: 'boolean',
-          default: false,
-        },
-      },
-      allowPositionals: true,
-      strict: false,
-    })
-
-    // Show help if requested
-    if (values.help) {
-      console.log('Test Runner')
-      console.log('\nUsage: pnpm test [options] [-- vitest-args...]')
-      console.log('\nOptions:')
-      console.log('  --help              Show this help message')
-      console.log(
-        '  --fast, --quick     Skip lint/type checks for faster execution',
-      )
-      console.log('  --cover, --coverage Run tests with code coverage')
-      console.log('  --update            Update test snapshots')
-      console.log('  --all, --force      Run all tests regardless of changes')
-      console.log('  --staged            Run tests affected by staged changes')
-      console.log('  --skip-build        Skip the build step')
-      console.log('\nExamples:')
-      console.log(
-        '  pnpm test                  # Run checks, build, and tests for changed files',
-      )
-      console.log('  pnpm test --all            # Run all tests')
-      console.log(
-        '  pnpm test --fast           # Skip checks for quick testing',
-      )
-      console.log('  pnpm test --cover          # Run with coverage report')
-      console.log('  pnpm test --fast --cover   # Quick test with coverage')
-      console.log('  pnpm test --update         # Update test snapshots')
-      console.log('  pnpm test -- --reporter=dot # Pass args to vitest')
-      process.exitCode = 0
-      return
-    }
-
-    printHeader('Test Runner')
-
-    // Handle aliases
-    const skipChecks = values.fast || values.quick
-    const withCoverage = values.cover || values.coverage
-
-    let exitCode = 0
-
-    // Run checks unless skipped
-    if (!skipChecks) {
-      exitCode = await runCheck()
-      if (exitCode !== 0) {
-        logger.error('Checks failed')
-        process.exitCode = exitCode
-        return
-      }
-      logger.success('All checks passed')
-    }
-
-    // Run build unless skipped
-    if (!values['skip-build']) {
-      exitCode = await runBuild()
-      if (exitCode !== 0) {
-        logger.error('Build failed')
-        process.exitCode = exitCode
-        return
-      }
-    }
-
-    // Run tests
-    exitCode = await runTests(
-      { ...values, coverage: withCoverage },
-      positionals,
-    )
-
-    if (exitCode !== 0) {
-      logger.error('Tests failed')
-      process.exitCode = exitCode
-    } else {
-      logger.success('All tests passed!')
-    }
-  } catch (error) {
-    // Ensure spinner is stopped
-    try {
-      spinner.stop()
-    } catch {}
-    logger.error(`Test runner failed: ${error.message}`)
-    process.exitCode = 1
-  } finally {
-    // Ensure spinner is stopped
-    try {
-      spinner.stop()
-    } catch {}
-    removeExitHandler()
-    // Explicitly exit to prevent hanging
-    process.exit(process.exitCode || 0)
-  }
-}
-
-main().catch(error => {
-  console.error(error)
-  process.exit(1)
-})
diff --git a/scripts/test/cover.mjs b/scripts/test/cover.mjs
new file mode 100644
index 0000000..cdb229b
--- /dev/null
+++ b/scripts/test/cover.mjs
@@ -0,0 +1,250 @@
+/**
+ * @fileoverview Coverage script that runs tests with coverage reporting.
+ * Masks test output and shows only the coverage summary.
+ */
+
+import path from 'node:path'
+import { fileURLToPath } from 'node:url'
+import { parseArgs } from 'node:util'
+
+import { getDefaultLogger } from '#socketsecurity/lib/logger'
+import { spawn } from '#socketsecurity/lib/spawn'
+import { printHeader } from '#socketsecurity/lib/stdio/header'
+
+import { runCommandQuiet } from '../utils/run-command.mjs'
+
+const logger = getDefaultLogger()
+
+const __dirname = path.dirname(fileURLToPath(import.meta.url))
+const rootPath = path.join(__dirname, '..', '..')
+
+// Parse custom flags
+const { values } = parseArgs({
+  options: {
+    'code-only': { type: 'boolean', default: false },
+    'type-only': { type: 'boolean', default: false },
+    summary: { type: 'boolean', default: false },
+  },
+  strict: false,
+})
+
+printHeader('Test Coverage')
+console.log('')
+
+// Rebuild with source maps enabled for coverage
+logger.info('Building with source maps for coverage...')
+const buildResult = await spawn('node', ['scripts/build/main.mjs'], {
+  cwd: rootPath,
+  stdio: 'inherit',
+  env: {
+    ...process.env,
+    COVERAGE: 'true',
+  },
+})
+if (buildResult.code !== 0) {
+  logger.error('Build with source maps failed')
+  process.exitCode = 1
+  process.exit(1)
+}
+
+// Run vitest with coverage enabled, capturing output
+// Filter out custom flags that vitest doesn't understand
+const customFlags = ['--code-only', '--type-only', '--summary']
+const vitestArgs = [
+  'exec',
+  'vitest',
+  'run',
+  '--coverage',
+  ...process.argv.slice(2).filter(arg => !customFlags.includes(arg)),
+]
+const typeCoverageArgs = ['exec', 'type-coverage']
+
+try {
+  let exitCode = 0
+  let codeCoverageResult
+  let typeCoverageResult
+
+  // Handle --type-only flag
+  if (values['type-only']) {
+    typeCoverageResult = await runCommandQuiet('pnpm', typeCoverageArgs, {
+      cwd: rootPath,
+    })
+    exitCode = typeCoverageResult.exitCode
+
+    // Display type coverage only
+    const typeCoverageOutput = (
+      typeCoverageResult.stdout + typeCoverageResult.stderr
+    ).trim()
+    const typeCoverageMatch = typeCoverageOutput.match(
+      /\([\d\s/]+\)\s+([\d.]+)%/,
+    )
+
+    if (typeCoverageMatch) {
+      const typeCoveragePercent = Number.parseFloat(typeCoverageMatch[1])
+      console.log()
+      console.log(' Coverage Summary')
+      console.log(' ───────────────────────────────')
+      console.log(` Type Coverage: ${typeCoveragePercent.toFixed(2)}%`)
+      console.log()
+    }
+  }
+  // Handle --code-only flag
+  else if (values['code-only']) {
+    codeCoverageResult = await runCommandQuiet('pnpm', vitestArgs, {
+      cwd: rootPath,
+    })
+    exitCode = codeCoverageResult.exitCode
+
+    // Process code coverage output only
+    const ansiRegex = new RegExp(`${String.fromCharCode(27)}\\[[0-9;]*m`, 'g')
+    const output = (codeCoverageResult.stdout + codeCoverageResult.stderr)
+      .replace(ansiRegex, '')
+      .replace(/(?:✧|︎|⚡)\s*/g, '')
+      .trim()
+
+    // Extract and display test summary
+    const testSummaryMatch = output.match(
+      /Test Files\s+\d+[^\n]*\n[\s\S]*?Duration\s+[\d.]+m?s[^\n]*/,
+    )
+    if (!values.summary && testSummaryMatch) {
+      console.log()
+      console.log(testSummaryMatch[0])
+      console.log()
+    }
+
+    // Extract and display coverage summary
+    const coverageHeaderMatch = output.match(
+      / % Coverage report from v8\n([-|]+)\n([^\n]+)\n\1/,
+    )
+    // Use src/ directory coverage instead of "All files" to exclude dist/external
+    const srcCoverageMatch = output.match(/ src\s+\|\s+([\d.]+)\s+\|[^\n]*/)
+    const _allFilesMatch = output.match(/All files\s+\|\s+([\d.]+)\s+\|[^\n]*/)
+
+    if (coverageHeaderMatch && srcCoverageMatch) {
+      if (!values.summary) {
+        console.log(' % Coverage report from v8')
+        console.log(coverageHeaderMatch[1])
+        console.log(coverageHeaderMatch[2])
+        console.log(coverageHeaderMatch[1])
+        console.log(srcCoverageMatch[0])
+        console.log(coverageHeaderMatch[1])
+        console.log()
+      }
+
+      const codeCoveragePercent = Number.parseFloat(srcCoverageMatch[1])
+      console.log(' Coverage Summary')
+      console.log(' ───────────────────────────────')
+      console.log(` Code Coverage: ${codeCoveragePercent.toFixed(2)}%`)
+      console.log()
+    } else if (exitCode !== 0) {
+      console.log('\n--- Output ---')
+      console.log(output)
+    }
+  }
+  // Default: run both code and type coverage
+  else {
+    codeCoverageResult = await runCommandQuiet('pnpm', vitestArgs, {
+      cwd: rootPath,
+    })
+    exitCode = codeCoverageResult.exitCode
+
+    // Run type coverage
+    typeCoverageResult = await runCommandQuiet('pnpm', typeCoverageArgs, {
+      cwd: rootPath,
+    })
+
+    // Combine and clean output
+    const ansiRegex = new RegExp(`${String.fromCharCode(27)}\\[[0-9;]*m`, 'g')
+    const output = (codeCoverageResult.stdout + codeCoverageResult.stderr)
+      .replace(ansiRegex, '')
+      .replace(/(?:✧|︎|⚡)\s*/g, '')
+      .trim()
+
+    // Extract test summary
+    const testSummaryMatch = output.match(
+      /Test Files\s+\d+[^\n]*\n[\s\S]*?Duration\s+[\d.]+m?s[^\n]*/,
+    )
+
+    // Extract coverage summary - use src/ directory coverage instead of "All files"
+    const coverageHeaderMatch = output.match(
+      / % Coverage report from v8\n([-|]+)\n([^\n]+)\n\1/,
+    )
+    const srcCoverageMatch = output.match(/ src\s+\|\s+([\d.]+)\s+\|[^\n]*/)
+    const _allFilesMatch = output.match(/All files\s+\|\s+([\d.]+)\s+\|[^\n]*/)
+
+    // Extract type coverage
+    const typeCoverageOutput = (
+      typeCoverageResult.stdout + typeCoverageResult.stderr
+    ).trim()
+    const typeCoverageMatch = typeCoverageOutput.match(
+      /\([\d\s/]+\)\s+([\d.]+)%/,
+    )
+
+    // Display output
+    if (!values.summary && testSummaryMatch) {
+      console.log()
+      console.log(testSummaryMatch[0])
+      console.log()
+    }
+
+    if (coverageHeaderMatch && srcCoverageMatch) {
+      if (!values.summary) {
+        console.log(' % Coverage report from v8')
+        console.log(coverageHeaderMatch[1])
+        console.log(coverageHeaderMatch[2])
+        console.log(coverageHeaderMatch[1])
+        console.log(srcCoverageMatch[0])
+        console.log(coverageHeaderMatch[1])
+        console.log()
+      }
+
+      // Display cumulative summary
+      if (typeCoverageMatch) {
+        const codeCoveragePercent = Number.parseFloat(srcCoverageMatch[1])
+        const typeCoveragePercent = Number.parseFloat(typeCoverageMatch[1])
+        const cumulativePercent = (
+          (codeCoveragePercent + typeCoveragePercent) /
+          2
+        ).toFixed(2)
+
+        console.log(' Coverage Summary')
+        console.log(' ───────────────────────────────')
+        console.log(` Type Coverage: ${typeCoveragePercent.toFixed(2)}%`)
+        console.log(` Code Coverage: ${codeCoveragePercent.toFixed(2)}%`)
+        console.log(' ───────────────────────────────')
+        console.log(` Cumulative:    ${cumulativePercent}%`)
+        console.log()
+      }
+    } else if (exitCode !== 0) {
+      console.log('\n--- Output ---')
+      console.log(output)
+    }
+  }
+
+  // Filter coverage data to exclude dist/ and external files
+  if (exitCode === 0) {
+    logger.info('Filtering coverage data to src/ files only...')
+    try {
+      const filterResult = await spawn('node', ['scripts/test/filter.mjs'], {
+        cwd: rootPath,
+        stdio: 'inherit',
+      })
+      if (filterResult.code !== 0) {
+        logger.warn('Coverage filtering had issues but continuing...')
+      }
+    } catch (filterError) {
+      logger.warn(`Coverage filtering failed: ${filterError.message}`)
+    }
+  }
+
+  if (exitCode === 0) {
+    logger.success('Coverage completed successfully')
+  } else {
+    logger.error('Coverage failed')
+  }
+
+  process.exitCode = exitCode
+} catch (error) {
+  logger.error(`Coverage script failed: ${error.message}`)
+  process.exitCode = 1
+}
diff --git a/scripts/test/filter.mjs b/scripts/test/filter.mjs
new file mode 100644
index 0000000..042a164
--- /dev/null
+++ b/scripts/test/filter.mjs
@@ -0,0 +1,111 @@
+/**
+ * @fileoverview Filter coverage data to exclude dist/ and external files
+ *
+ * This script post-processes V8 coverage data to remove:
+ * - dist/ compiled JavaScript files
+ * - external bundled dependencies
+ * - test files
+ * Ensuring coverage reports only show src/ TypeScript files (excluding src/external).
+ */
+
+import fs from 'node:fs'
+import path from 'node:path'
+import { fileURLToPath } from 'node:url'
+import { getDefaultLogger } from '#socketsecurity/lib/logger'
+
+const logger = getDefaultLogger()
+const __dirname = path.dirname(fileURLToPath(import.meta.url))
+const projectRoot = path.resolve(__dirname, '..')
+
+// Find all coverage JSON files
+const coverageDir = path.join(projectRoot, 'coverage')
+if (!fs.existsSync(coverageDir)) {
+  logger.error('Coverage directory not found:', coverageDir)
+  process.exit(1)
+}
+
+const coverageFinalPath = path.join(coverageDir, 'coverage-final.json')
+const coverageSummaryPath = path.join(coverageDir, 'coverage-summary.json')
+
+function filterCoverageFile(filePath) {
+  if (!fs.existsSync(filePath)) {
+    logger.info(`Skipping ${path.basename(filePath)} - not found`)
+    return { filtered: 0, kept: 0, total: 0, details: {} }
+  }
+
+  const coverage = JSON.parse(fs.readFileSync(filePath, 'utf-8'))
+  const filtered = {}
+  let distCount = 0
+  let externalCount = 0
+  let testCount = 0
+  let srcCount = 0
+
+  for (const [file, data] of Object.entries(coverage)) {
+    // Exclude dist/ compiled files
+    if (file.includes('/dist/') || file.includes('\\dist\\')) {
+      distCount++
+      continue
+    }
+
+    // Exclude external bundled dependencies
+    if (
+      file.includes('/external/') ||
+      file.includes('\\external\\') ||
+      file.includes('src/external')
+    ) {
+      externalCount++
+      continue
+    }
+
+    // Exclude test files
+    if (file.includes('/test/') || file.includes('\\test\\')) {
+      testCount++
+      continue
+    }
+
+    // Keep src/ TypeScript files
+    if (file.includes('/src/') || file.includes('\\src\\')) {
+      filtered[file] = data
+      srcCount++
+    }
+  }
+
+  fs.writeFileSync(filePath, JSON.stringify(filtered, null, 2))
+
+  return {
+    filtered: distCount + externalCount + testCount,
+    kept: srcCount,
+    total: Object.keys(coverage).length,
+    details: { distCount, externalCount, testCount, srcCount },
+  }
+}
+
+logger.info('Filtering coverage data...\n')
+
+const finalStats = filterCoverageFile(coverageFinalPath)
+logger.info('coverage-final.json:')
+logger.success(`  Kept ${finalStats.kept} src/ TypeScript files`)
+if (finalStats.filtered > 0) {
+  logger.info(`  Filtered ${finalStats.filtered} files:`)
+  if (finalStats.details.distCount) {
+    logger.info(`    - ${finalStats.details.distCount} dist/ compiled files`)
+  }
+  if (finalStats.details.externalCount) {
+    logger.info(
+      `    - ${finalStats.details.externalCount} external dependencies`,
+    )
+  }
+  if (finalStats.details.testCount) {
+    logger.info(`    - ${finalStats.details.testCount} test files`)
+  }
+}
+logger.info(`  Total: ${finalStats.total} files\n`)
+
+const summaryStats = filterCoverageFile(coverageSummaryPath)
+logger.info('coverage-summary.json:')
+logger.success(`  Kept ${summaryStats.kept} src/ files`)
+if (summaryStats.filtered > 0) {
+  logger.info(`  Filtered ${summaryStats.filtered} files`)
+}
+
+logger.success('\n✓ Coverage data filtered successfully!')
diff --git a/scripts/test/main.mjs b/scripts/test/main.mjs
new file mode 100644
index 0000000..423058c
--- /dev/null
+++ b/scripts/test/main.mjs
@@ -0,0 +1,501 @@
+/**
+ * @fileoverview Unified test runner that provides a smooth, single-script experience.
+ * Combines check, build, and test steps with clean, consistent output.
+ */
+
+import { spawn } from 'node:child_process'
+import { existsSync } from 'node:fs'
+import path from 'node:path'
+import { fileURLToPath } from 'node:url'
+
+import { getDefaultLogger } from '#socketsecurity/lib/logger'
+import { getDefaultSpinner } from '#socketsecurity/lib/spinner'
+import { printHeader } from '#socketsecurity/lib/stdio/header'
+
+import { getTestsToRun } from '../utils/changed-test-mapper.mjs'
+import { parseArgs } from '../utils/parse-args.mjs'
+import { onExit } from '../utils/signal-exit.mjs'
+
+const logger = getDefaultLogger()
+const spinner = getDefaultSpinner()
+
+const WIN32 = process.platform === 'win32'
+
+// Suppress non-fatal worker termination unhandled rejections
+process.on('unhandledRejection', (reason, _promise) => {
+  const errorMessage = String(reason?.message || reason || '')
+  // Filter out known non-fatal worker termination errors
+  if (
+    errorMessage.includes('Terminating worker thread') ||
+    errorMessage.includes('ThreadTermination')
+  ) {
+    // Ignore these - they're cleanup messages from vitest worker threads
+    return
+  }
+  // Re-throw other unhandled rejections
+  throw reason
+})
+
+const __dirname = path.dirname(fileURLToPath(import.meta.url))
+const rootPath = path.resolve(__dirname, '..')
+const nodeModulesBinPath = path.join(rootPath, 'node_modules', '.bin')
+
+const tsconfigPath = '.config/tsconfig.check.json'
+
+// Track running processes for cleanup
+const runningProcesses = new Set()
+
+// Setup exit handler
+const removeExitHandler = onExit((_code, signal) => {
+  // Stop spinner first
+  try {
+    spinner.stop()
+  } catch {}
+
+  // Kill all running processes
+  for (const child of runningProcesses) {
+    try {
+      child.kill('SIGTERM')
+    } catch {}
+  }
+
+  if (signal) {
+    console.log(`\nReceived ${signal}, cleaning up...`)
+    // Let onExit handle the exit with proper code
+    process.exitCode = 128 + (signal === 'SIGINT' ? 2 : 15)
+  }
+})
+
+async function runCommand(command, args = [], options = {}) {
+  return new Promise((resolve, reject) => {
+    const child = spawn(command, args, {
+      stdio: 'inherit',
+      ...(process.platform === 'win32' && { shell: true }),
+      ...options,
+    })
+
+    runningProcesses.add(child)
+
+    child.on('exit', code => {
+      runningProcesses.delete(child)
+      resolve(code || 0)
+    })
+
+    child.on('error', error => {
+      runningProcesses.delete(child)
+      reject(error)
+    })
+  })
+}
+
+async function runCommandWithOutput(command, args = [], options = {}) {
+  return new Promise((resolve, reject) => {
+    let stdout = ''
+    let stderr = ''
+
+    const child = spawn(command, args, {
+      ...(process.platform === 'win32' && { shell: true }),
+      ...options,
+    })
+
+    runningProcesses.add(child)
+
+    if (child.stdout) {
+      child.stdout.on('data', data => {
+        stdout += data.toString()
+      })
+    }
+
+    if (child.stderr) {
+      child.stderr.on('data', data => {
+        stderr += data.toString()
+      })
+    }
+
+    child.on('exit', code => {
+      runningProcesses.delete(child)
+      resolve({ code: code || 0, stdout, stderr })
+    })
+
+    child.on('error', error => {
+      runningProcesses.delete(child)
+      reject(error)
+    })
+  })
+}
+
+async function runCheck() {
+  logger.step('Running checks')
+
+  // Run fix (auto-format) quietly since it has its own output
+  spinner.start('Formatting code...')
+  let exitCode = await runCommand('pnpm', ['run', 'fix'], {
+    stdio: 'pipe',
+  })
+  if (exitCode !== 0) {
+    spinner.stop()
+    logger.error('Formatting failed')
+    // Re-run with output to show errors
+    await runCommand('pnpm', ['run', 'fix'])
+    return exitCode
+  }
+  spinner.stop()
+  logger.success('Code formatted')
+
+  // Run ESLint to check for remaining issues
+  spinner.start('Running ESLint...')
+  exitCode = await runCommand(
+    'eslint',
+    [
+      '--config',
+      '.config/eslint.config.mjs',
+      '--report-unused-disable-directives',
+      '.',
+    ],
+    {
+      stdio: 'pipe',
+    },
+  )
+  if (exitCode !== 0) {
+    spinner.stop()
+    logger.error('ESLint failed')
+    // Re-run with output to show errors
+    await runCommand('eslint', [
+      '--config',
+      '.config/eslint.config.mjs',
+      '--report-unused-disable-directives',
+      '.',
+    ])
+    return exitCode
+  }
+  spinner.stop()
+  logger.success('ESLint passed')
+
+  // Run TypeScript check
+  spinner.start('Checking TypeScript...')
+  exitCode = await runCommand('tsgo', ['--noEmit', '-p', tsconfigPath], {
+    stdio: 'pipe',
+  })
+  if (exitCode !== 0) {
+    spinner.stop()
+    logger.error('TypeScript check failed')
+    // Re-run with output to show errors
+    await runCommand('tsgo', ['--noEmit', '-p', tsconfigPath])
+    return exitCode
+  }
+  spinner.stop()
+  logger.success('TypeScript check passed')
+
+  return exitCode
+}
+
+async function runBuild() {
+  const distIndexPath = path.join(rootPath, 'dist', 'index.js')
+  if (!existsSync(distIndexPath)) {
+    logger.step('Building project')
+    return runCommand('pnpm', ['run', 'build'])
+  }
+  return 0
+}
+
+async function runTests(
+  options,
+  positionals = [],
+  configPath = '.config/vitest.config.mts',
+) {
+  const { all, coverage, force, staged, update } = options
+  const runAll = all || force
+
+  // Get tests to run
+  const testInfo = getTestsToRun({ staged, all: runAll })
+  const { mode, reason, tests: testsToRun } = testInfo
+
+  // No tests needed
+  if (testsToRun === null) {
+    logger.substep('No relevant changes detected, skipping tests')
+    return 0
+  }
+
+  // Prepare vitest command
+  const vitestCmd = WIN32 ? 'vitest.cmd' : 'vitest'
+  const vitestPath = path.join(nodeModulesBinPath, vitestCmd)
+
+  const vitestArgs = ['--config', configPath, 'run']
+
+  // Add coverage if requested
+  if (coverage) {
+    vitestArgs.push('--coverage')
+  }
+
+  // Add update if requested
+  if (update) {
+    vitestArgs.push('--update')
+  }
+
+  // Add test patterns if not running all
+  if (testsToRun === 'all') {
+    logger.step(`Running all tests (${reason})`)
+  } else {
+    const modeText = mode === 'staged' ? 'staged' : 'changed'
+    logger.step(`Running tests for ${modeText} files:`)
+    testsToRun.forEach(test => {
+      logger.substep(test)
+    })
+    vitestArgs.push(...testsToRun)
+  }
+
+  // Add any additional positional arguments
+  if (positionals.length > 0) {
+    vitestArgs.push(...positionals)
+  }
+
+  const spawnOptions = {
+    cwd: rootPath,
+    env: {
+      ...process.env,
+      NODE_OPTIONS:
+        `${process.env.NODE_OPTIONS || ''} --max-old-space-size=${process.env.CI ? 8192 : 4096} --unhandled-rejections=warn`.trim(),
+      VITEST: '1',
+    },
+    stdio: 'inherit',
+  }
+
+  // Use interactive runner for interactive Ctrl+O experience when appropriate
+  if (process.stdout.isTTY) {
+    const { runTests } = await import('../utils/interactive-runner.mjs')
+    return runTests(vitestPath, vitestArgs, {
+      env: spawnOptions.env,
+      cwd: spawnOptions.cwd,
+      verbose: false,
+    })
+  }
+
+  // Fallback to execution with output capture to handle worker termination errors
+  const result = await runCommandWithOutput(vitestPath, vitestArgs, {
+    ...spawnOptions,
+    stdio: ['inherit', 'pipe', 'pipe'],
+  })
+
+  // Print output
+  if (result.stdout) {
+    process.stdout.write(result.stdout)
+  }
+  if (result.stderr) {
+    process.stderr.write(result.stderr)
+  }
+
+  // Check if we have worker termination error but no test failures
+  const hasWorkerTerminationError =
+    (result.stdout + result.stderr).includes('Terminating worker thread') ||
+    (result.stdout + result.stderr).includes('ThreadTermination')
+
+  const output = result.stdout + result.stderr
+  const hasTestFailures =
+    output.includes('FAIL') ||
+    (output.includes('Test Files') && output.match(/(\d+) failed/) !== null) ||
+    (output.includes('Tests') && output.match(/Tests\s+\d+ failed/) !== null)
+
+  // Override exit code if we only have worker termination errors
+  if (result.code !== 0 && hasWorkerTerminationError && !hasTestFailures) {
+    return 0
+  }
+
+  return result.code
+}
+
+async function runIsolatedTests(options) {
+  const { coverage } = options
+
+  logger.step('Running isolated tests')
+
+  // Prepare vitest command
+  const vitestCmd = WIN32 ? 'vitest.cmd' : 'vitest'
+  const vitestPath = path.join(nodeModulesBinPath, vitestCmd)
+
+  const vitestArgs = ['--config', '.config/vitest.config.isolated.mts', 'run']
+
+  // Add coverage if requested
+  if (coverage) {
+    vitestArgs.push('--coverage')
+  }
+
+  const spawnOptions = {
+    cwd: rootPath,
+    env: {
+      ...process.env,
+      NODE_OPTIONS:
+        `${process.env.NODE_OPTIONS || ''} --max-old-space-size=${process.env.CI ? 8192 : 4096} --unhandled-rejections=warn`.trim(),
+      VITEST: '1',
+    },
+    stdio: 'inherit',
+  }
+
+  // Always use direct execution for isolated tests (simpler, more predictable)
+  const result = await runCommandWithOutput(vitestPath, vitestArgs, {
+    ...spawnOptions,
+    stdio: ['inherit', 'pipe', 'pipe'],
+  })
+
+  // Print output
+  if (result.stdout) {
+    process.stdout.write(result.stdout)
+  }
+  if (result.stderr) {
+    process.stderr.write(result.stderr)
+  }
+
+  return result.code
+}
+
+async function main() {
+  try {
+    // Parse arguments
+    const { positionals, values } = parseArgs({
+      options: {
+        help: {
+          type: 'boolean',
+          default: false,
+        },
+        fast: {
+          type: 'boolean',
+          default: false,
+        },
+        quick: {
+          type: 'boolean',
+          default: false,
+        },
+        'skip-build': {
+          type: 'boolean',
+          default: false,
+        },
+        staged: {
+          type: 'boolean',
+          default: false,
+        },
+        all: {
+          type: 'boolean',
+          default: false,
+        },
+        force: {
+          type: 'boolean',
+          default: false,
+        },
+        cover: {
+          type: 'boolean',
+          default: false,
+        },
+        coverage: {
+          type: 'boolean',
+          default: false,
+        },
+        update: {
+          type: 'boolean',
+          default: false,
+        },
+      },
+      allowPositionals: true,
+      strict: false,
+    })
+
+    // Show help if requested
+    if (values.help) {
+      console.log('Test Runner')
+      console.log('\nUsage: pnpm test [options] [-- vitest-args...]')
+      console.log('\nOptions:')
+      console.log('  --help              Show this help message')
+      console.log(
+        '  --fast, --quick     Skip lint/type checks for faster execution',
+      )
+      console.log('  --cover, --coverage Run tests with code coverage')
+      console.log('  --update            Update test snapshots')
+      console.log('  --all, --force      Run all tests regardless of changes')
+      console.log('  --staged            Run tests affected by staged changes')
+      console.log('  --skip-build        Skip the build step')
+      console.log('\nExamples:')
+      console.log(
+        '  pnpm test                  # Run checks, build, and tests for changed files',
+      )
+      console.log('  pnpm test --all            # Run all tests')
+      console.log(
+        '  pnpm test --fast           # Skip checks for quick testing',
+      )
+      console.log('  pnpm test --cover          # Run with coverage report')
+      console.log('  pnpm test --fast --cover   # Quick test with coverage')
+      console.log('  pnpm test --update         # Update test snapshots')
+      console.log('  pnpm test -- --reporter=dot # Pass args to vitest')
+      process.exitCode = 0
+      return
+    }
+
+    printHeader('Test Runner')
+
+    // Handle aliases
+    const skipChecks = values.fast || values.quick
+    const withCoverage = values.cover || values.coverage
+
+    let exitCode = 0
+
+    // Run checks unless skipped
+    if (!skipChecks) {
+      exitCode = await runCheck()
+      if (exitCode !== 0) {
+        logger.error('Checks failed')
+        process.exitCode = exitCode
+        return
+      }
+      logger.success('All checks passed')
+    }
+
+    // Run build unless skipped
+    if (!values['skip-build']) {
+      exitCode = await runBuild()
+      if (exitCode !== 0) {
+        logger.error('Build failed')
+        process.exitCode = exitCode
+        return
+      }
+    }
+
+    // Run main tests
+    exitCode = await runTests(
+      { ...values, coverage: withCoverage },
+      positionals,
+    )
+
+    if (exitCode !== 0) {
+      logger.error('Main tests failed')
+      process.exitCode = exitCode
+      return
+    }
+
+    // Run isolated tests
+    exitCode = await runIsolatedTests({ coverage: withCoverage })
+
+    if (exitCode !== 0) {
+      logger.error('Isolated tests failed')
+      process.exitCode = exitCode
+    } else {
+      logger.success('All tests passed!')
+    }
+  } catch (error) {
+    // Ensure spinner is stopped
+    try {
+      spinner.stop()
+    } catch {}
+    logger.error(`Test runner failed: ${error.message}`)
+    process.exitCode = 1
+  } finally {
+    // Ensure spinner is stopped
+    try {
+      spinner.stop()
+    } catch {}
+    removeExitHandler()
+    // Explicitly exit to prevent hanging
+    process.exit(process.exitCode || 0)
+  }
+}
+
+main().catch(error => {
+  console.error(error)
+  process.exit(1)
+})
diff --git a/scripts/update.mjs b/scripts/update.mjs
new file mode 100644
index 0000000..6f303cd
--- /dev/null
+++ b/scripts/update.mjs
@@ -0,0 +1,118 @@
+/**
+ * @fileoverview Monorepo-aware dependency update script - checks and updates dependencies.
+ * Uses taze to check for updates across all packages in the monorepo.
+ *
+ * Usage:
+ *   node scripts/update.mjs [options]
+ *
+ * Options:
+ *   --quiet    Suppress progress output
+ *   --verbose  Show detailed output
+ *   --apply    Apply updates (default is check-only)
+ */
+
+import { isQuiet, isVerbose } from '#socketsecurity/lib/argv/flags'
+import { getDefaultLogger } from '#socketsecurity/lib/logger'
+import { WIN32 } from '#socketsecurity/lib/constants/platform'
+import { spawn } from '#socketsecurity/lib/spawn'
+
+async function main() {
+  const quiet = isQuiet()
+  const verbose = isVerbose()
+  const apply = process.argv.includes('--apply')
+  const logger = getDefaultLogger()
+
+  try {
+    if (!quiet) {
+      logger.log('\n🔨 Monorepo Dependency Update\n')
+    }
+
+    // Build taze command with appropriate flags for monorepo.
+    const tazeArgs = ['exec', 'taze', '-r']
+
+    if (apply) {
+      tazeArgs.push('-w')
+      if (!quiet) {
+        logger.progress('Updating dependencies across monorepo...')
+      }
+    } else {
+      if (!quiet) {
+        logger.progress('Checking for updates across monorepo...')
+      }
+    }
+
+    // Run taze at root level (recursive flag will check all packages).
+    const result = await spawn('pnpm', tazeArgs, {
+      shell: WIN32,
+      stdio: quiet ? 'pipe' : 'inherit',
+    })
+
+    // Clear progress line.
+    if (!quiet) {
+      process.stdout.write('\r\x1b[K')
+    }
+
+    // If applying updates, also update Socket packages.
+    if (apply && result.code === 0) {
+      if (!quiet) {
+        logger.progress('Updating Socket packages...')
+      }
+
+      const socketResult = await spawn(
+        'pnpm',
+        ['update', '@socketsecurity/*', '@socketregistry/*', '--latest', '-r'],
+        {
+          shell: WIN32,
+          stdio: quiet ? 'pipe' : 'inherit',
+        },
+      )
+
+      // Clear progress line.
+      if (!quiet) {
+        process.stdout.write('\r\x1b[K')
+      }
+
+      if (socketResult.code !== 0) {
+        if (!quiet) {
+          logger.fail('Failed to update Socket packages')
+        }
+        process.exitCode = 1
+        return
+      }
+    }
+
+    if (result.code !== 0) {
+      if (!quiet) {
+        if (apply) {
+          logger.fail('Failed to update dependencies')
+        } else {
+          logger.info('Updates available. Run with --apply to update')
+        }
+      }
+      process.exitCode = apply ? 1 : 0
+    } else {
+      if (!quiet) {
+        if (apply) {
+          logger.success('Dependencies updated across all packages')
+        } else {
+          logger.success('All packages up to date')
+        }
+        logger.log('')
+      }
+    }
+  } catch (error) {
+    if (!quiet) {
+      logger.fail(`Update failed: ${error.message}`)
+    }
+    if (verbose) {
+      logger.error(error)
+    }
+    process.exitCode = 1
+  }
+}
+
+main().catch(e => {
+  const logger = getDefaultLogger()
+  logger.error(e)
+  process.exitCode = 1
+})
diff --git a/scripts/utils/alias-loader.mjs b/scripts/utils/alias-loader.mjs
deleted file mode 100644
index 58cc1cb..0000000
--- a/scripts/utils/alias-loader.mjs
+++ /dev/null
@@ -1,54 +0,0 @@
-/**
- * @fileoverview Canonical Node.js ESM loader to alias local Socket packages.
- * Used across all socket-* repositories for consistent local development.
- *
- * This file should be copied or imported from socket-registry to other repos.
- *
- * Usage:
- *   node --loader=./scripts/utils/alias-loader.mjs script.mjs
- */
-
-import { existsSync } from 'node:fs'
-import path from 'node:path'
-import { fileURLToPath, pathToFileURL } from 'node:url'
-
-import { getLocalPackageAliases } from './get-local-package-aliases.mjs'
-
-// Infer root directory from this loader's location.
-const __dirname = path.dirname(fileURLToPath(import.meta.url))
-const rootPath = path.resolve(__dirname, '..', '..')
-
-// Get aliases from shared utility.
-const aliases = getLocalPackageAliases(rootPath)
-
-export function resolve(specifier, context, nextResolve) {
-  // Check if specifier starts with an aliased package.
-  for (const [pkg, localPath] of Object.entries(aliases)) {
-    if (specifier === pkg || specifier.startsWith(`${pkg}/`)) {
-      // Replace package name with local path.
-      const subpath = specifier === pkg ? '' : specifier.slice(pkg.length)
-
-      // Try multiple resolution strategies.
-      const candidates = [
-        path.join(localPath, subpath),
-        path.join(localPath, `${subpath}.mjs`),
-        path.join(localPath, `${subpath}.js`),
-        path.join(localPath, 'dist', subpath),
-        path.join(localPath, 'dist', `${subpath}.mjs`),
-        path.join(localPath, 'dist', `${subpath}.js`),
-      ]
-
-      for (const candidate of candidates) {
-        if (existsSync(candidate)) {
-          return nextResolve(pathToFileURL(candidate).href, context)
-        }
-      }
-
-      // If nothing found, try the first candidate anyway.
-      return nextResolve(pathToFileURL(candidates[0]).href, context)
-    }
-  }
-
-  // Pass through to default resolver.
-  return nextResolve(specifier, context)
-}
diff --git a/scripts/utils/changed-test-mapper.mjs b/scripts/utils/changed-test-mapper.mjs
index f0486da..ba89f90 100644
--- a/scripts/utils/changed-test-mapper.mjs
+++ b/scripts/utils/changed-test-mapper.mjs
@@ -9,8 +9,8 @@ import path from 'node:path'
 import {
   getChangedFilesSync,
   getStagedFilesSync,
-} from '@socketsecurity/lib/git'
-import { normalizePath } from '@socketsecurity/lib/path'
+} from '#socketsecurity/lib/git'
+import { normalizePath } from '#socketsecurity/lib/path'
 
 const rootPath = path.resolve(process.cwd())
 
@@ -52,7 +52,7 @@ function mapSourceToTests(filepath) {
 
   // Map specific files to their test files
   const basename = path.basename(normalized, path.extname(normalized))
-  const testFile = `test/${basename}.test.mts`
+  const testFile = `test/${basename}.test.ts`
 
   // Check if corresponding test exists
   if (existsSync(path.join(rootPath, testFile))) {
@@ -61,16 +61,16 @@ function mapSourceToTests(filepath) {
 
   // Special mappings
   if (normalized.includes('src/package-url.ts')) {
-    return ['test/package-url.test.mts', 'test/integration.test.mts']
+    return ['test/package-url.test.ts', 'test/integration.test.ts']
   }
   if (normalized.includes('src/package-url-builder.ts')) {
-    return ['test/package-url-builder.test.mts', 'test/integration.test.mts']
+    return ['test/package-url-builder.test.ts', 'test/integration.test.ts']
   }
   if (normalized.includes('src/url-converter.ts')) {
-    return ['test/url-converter.test.mts']
+    return ['test/url-converter.test.ts']
   }
   if (normalized.includes('src/result.ts')) {
-    return ['test/result.test.mts']
+    return ['test/result.test.ts']
   }
 
   // If no specific mapping, run all tests to be safe
@@ -155,11 +155,11 @@ export function getTestsToRun(options = {}) {
     // Data changes run integration tests
     if (normalized.startsWith('data/')) {
       // Skip deleted files.
-      if (existsSync(path.join(rootPath, 'test/integration.test.mts'))) {
-        testFiles.add('test/integration.test.mts')
+      if (existsSync(path.join(rootPath, 'test/integration.test.ts'))) {
+        testFiles.add('test/integration.test.ts')
       }
-      if (existsSync(path.join(rootPath, 'test/purl-types.test.mts'))) {
-        testFiles.add('test/purl-types.test.mts')
+      if (existsSync(path.join(rootPath, 'test/purl-types.test.ts'))) {
+        testFiles.add('test/purl-types.test.ts')
       }
     }
   }
diff --git a/scripts/utils/cli-helpers.mjs b/scripts/utils/cli-helpers.mjs
deleted file mode 100644
index c02177f..0000000
--- a/scripts/utils/cli-helpers.mjs
+++ /dev/null
@@ -1,102 +0,0 @@
-/**
- * @fileoverview Common utilities shared across all scripts.
- */
-
-import path from 'node:path'
-import { fileURLToPath } from 'node:url'
-
-import colors from 'yoctocolors-cjs'
-
-// Get root path.
-export const getRootPath = importMetaUrl => {
-  const __dirname = path.dirname(fileURLToPath(importMetaUrl))
-  return path.join(__dirname, '..')
-}
-
-// Simple print utilities for scripts - avoid re-exporting from lib.
-
-export const printDivider = (char = '═') => console.log(char.repeat(55))
-export const printHeader = title => {
-  printDivider()
-  console.log(`  ${title}`)
-  printDivider()
-}
-export const replaceHeader = (title, extraLines = 0) => {
-  // Move cursor up to rewrite the header (3 lines for header + any extra output lines)
-  const linesToMove = 3 + extraLines
-  process.stdout.write(`\x1b[${linesToMove}A`) // Move up N lines
-  process.stdout.write('\x1b[K') // Clear top divider line
-  printDivider()
-  process.stdout.write('\x1b[K') // Clear title line
-  console.log(`  ${title}`)
-  process.stdout.write('\x1b[K') // Clear old bottom divider
-  // Clear any extra lines from previous output
-  for (let i = 0; i < extraLines; i++) {
-    process.stdout.write('\x1b[K\n') // Clear line and move to next
-  }
-  // Move cursor back up to position after the new header
-  if (extraLines > 0) {
-    process.stdout.write(`\x1b[${extraLines}A`)
-  }
-}
-export const printFooterLine = () => console.log('─'.repeat(55))
-export const printDottedLine = () => console.log('·'.repeat(55))
-export const printDiamondLine = () => console.log('◆'.repeat(55))
-export const printFooter = msg => {
-  printFooterLine()
-  if (msg) {
-    console.log(colors.green(msg))
-  }
-}
-export const printHelpHeader = name => console.log(`Socket Lib ${name}`)
-export const printSuccess = msg => console.log(colors.green(`✓ ${msg}`))
-export const printError = msg => console.error(colors.red(`✗ ${msg}`))
-export const printWarning = msg => console.warn(colors.yellow(`⚠ ${msg}`))
-export const printInfo = msg => console.log(colors.blue(`ℹ ${msg}`))
-export const printIndented = (msg, indent = 2) =>
-  console.log(' '.repeat(indent) + msg)
-
-// Console logging utilities with special formatting.
-// These have different behavior than the print utilities above.
-export const log = {
-  info: msg => console.log(msg),
-  error: msg => printError(msg),
-  success: msg => printSuccess(msg),
-  warn: msg => printWarning(msg),
-  step: msg => console.log(`\n${msg}`),
-  substep: msg => console.log(`  ${msg}`),
-  progress: msg => {
-    process.stdout.write(`  ∴ ${msg}`)
-  },
-  done: msg => {
-    process.stdout.write('\r\x1b[K')
-    console.log(`  ${colors.green('✓')} ${msg}`)
-  },
-  failed: msg => {
-    process.stdout.write('\r\x1b[K')
-    console.log(`  ${colors.red('✗')} ${msg}`)
-  },
-}
-
-// Local argv utilities for scripts - avoid dependency on dist.
-const argv = process.argv.slice(2)
-export const isQuiet = () => argv.includes('--quiet') || argv.includes('-q')
-export const isVerbose = () => argv.includes('--verbose') || argv.includes('-v')
-export const isForced = () => argv.includes('--force') || argv.includes('-f')
-export const isDryRun = () => argv.includes('--dry-run')
-export const COMMON_SCRIPT_FLAGS = [
-  '--quiet',
-  '--verbose',
-  '--force',
-  '--dry-run',
-]
-export const getCommonScriptFlags = () =>
-  argv.filter(arg => COMMON_SCRIPT_FLAGS.includes(arg))
-
-// Exit with code.
-export function exit(code = 0) {
-  process.exitCode = code
-  if (code !== 0) {
-    throw new Error('Script failed')
-  }
-}
diff --git a/scripts/utils/common.mjs b/scripts/utils/common.mjs
deleted file mode 100644
index 1c17b4b..0000000
--- a/scripts/utils/common.mjs
+++ /dev/null
@@ -1,91 +0,0 @@
-/**
- * @fileoverview Common utilities shared across all scripts.
- * Provides consistent helpers for running commands and logging.
- */
-
-import { parseArgs as nodeParseArgs } from 'node:util'
-import path from 'node:path'
-import { fileURLToPath } from 'node:url'
-
-// Platform detection
-export const WIN32 = process.platform === 'win32'
-export const MACOS = process.platform === 'darwin'
-export const LINUX = process.platform === 'linux'
-
-// Get the directory name from an import.meta.url
-export function getDirname(importMetaUrl) {
-  return path.dirname(fileURLToPath(importMetaUrl))
-}
-
-/**
- * Get the root path of the project from a script location
- */
-export function getRootPath(importMetaUrl, levelsUp = 2) {
-  const dirname = getDirname(importMetaUrl)
-  const segments = ['..'.repeat(levelsUp).split('').filter(Boolean)]
-  return path.join(dirname, ...segments)
-}
-
-/**
- * Check if running in CI environment
- */
-export function isCI() {
-  return !!(
-    process.env.CI ||
-    process.env.GITHUB_ACTIONS ||
-    process.env.GITLAB_CI ||
-    process.env.CIRCLECI ||
-    process.env.TRAVIS
-  )
-}
-
-/**
- * Check if running in debug mode
- */
-export function isDebug() {
-  return !!(process.env.DEBUG || process.env.NODE_ENV === 'development')
-}
-
-/**
- * Get command for checking if a binary exists
- */
-export function getWhichCommand() {
-  return WIN32 ? 'where' : 'which'
-}
-
-/**
- * Parse script arguments with common defaults
- */
-export function parseScriptArgs(options = {}) {
-  const defaultOptions = {
-    help: {
-      type: 'boolean',
-      short: 'h',
-      default: false,
-    },
-    quiet: {
-      type: 'boolean',
-      short: 'q',
-      default: false,
-    },
-    verbose: {
-      type: 'boolean',
-      short: 'v',
-      default: false,
-    },
-    ...options,
-  }
-
-  return nodeParseArgs({
-    options: defaultOptions,
-    allowPositionals: true,
-  })
-}
-
-/**
- * Exit with error message
- */
-export function exitWithError(message, code = 1) {
-  console.error(message)
-  process.exitCode = code
-}
diff --git a/scripts/utils/get-local-package-aliases.mjs b/scripts/utils/get-local-package-aliases.mjs
deleted file mode 100644
index 5809525..0000000
--- a/scripts/utils/get-local-package-aliases.mjs
+++ /dev/null
@@ -1,60 +0,0 @@
-/**
- * @fileoverview Canonical helper for resolving local Socket package aliases.
- * Used across all socket-* repositories for consistent local development.
- *
- * This file should be copied or imported from socket-registry to other repos.
- */
-
-import { existsSync } from 'node:fs'
-import path from 'node:path'
-
-/**
- * Get aliases for local Socket packages when available.
- * Falls back to published versions in CI or when packages don't exist.
- *
- * @param {string} [rootDir] - The root directory of the current project. Defaults to inferring from caller location.
- * @returns {Record<string, string>} Package aliases mapping (to dist folders for build tools).
- */
-export function getLocalPackageAliases(rootDir) {
-  const aliases = {}
-
-  // If no rootDir provided, try to infer from stack trace or use process.cwd().
-  const baseDir = rootDir || process.cwd()
-
-  // Check for ../socket-lib/dist for @socketsecurity/lib.
-  const libPath = path.join(baseDir, '..', 'socket-lib', 'dist')
-  if (existsSync(path.join(libPath, '../package.json'))) {
-    aliases['@socketsecurity/lib'] = libPath
-  }
-
-  // Check for ../socket-packageurl-js/dist.
-  const packageurlPath = path.join(
-    baseDir,
-    '..',
-    'socket-packageurl-js',
-    'dist',
-  )
-  if (existsSync(path.join(packageurlPath, '../package.json'))) {
-    aliases['@socketregistry/packageurl-js'] = packageurlPath
-  }
-
-  // Check for ../socket-registry/registry/dist for @socketsecurity/registry.
-  const registryPath = path.join(
-    baseDir,
-    '..',
-    'socket-registry',
-    'registry',
-    'dist',
-  )
-  if (existsSync(path.join(registryPath, '../package.json'))) {
-    aliases['@socketsecurity/registry'] = registryPath
-  }
-
-  // Check for ../socket-sdk-js/dist.
-  const sdkPath = path.join(baseDir, '..', 'socket-sdk-js', 'dist')
-  if (existsSync(path.join(sdkPath, '../package.json'))) {
-    aliases['@socketsecurity/sdk'] = sdkPath
-  }
-
-  return aliases
-}
diff --git a/scripts/utils/helpers.mjs b/scripts/utils/helpers.mjs
deleted file mode 100644
index b9f186d..0000000
--- a/scripts/utils/helpers.mjs
+++ /dev/null
@@ -1,55 +0,0 @@
-/**
- * @fileoverview Simplified helpers for socket-lib scripts.
- * These are local utilities that don't depend on dist/lib.
- */
-
-import { promises as fs } from 'node:fs'
-
-// Re-export unified print functions from cli-helpers.
-export {
-  printDivider,
-  printError,
-  printFooter,
-  printHeader,
-  printInfo,
-  printSuccess,
-  printWarning,
-} from './cli-helpers.mjs'
-
-// Simple logger without any dependencies on dist.
-export const logger = {
-  info: msg => console.log(msg),
-  error: msg => console.error(`✗ ${msg}`),
-  warn: msg => console.warn(`⚠ ${msg}`),
-  success: msg => console.log(`✓ ${msg}`),
-  // Customizable indent.
-  indent: (msg, spaces = 2) => console.log(`${' '.repeat(spaces)}${msg}`),
-}
-
-// Sort object keys alphabetically.
-export function toSortedObject(obj) {
-  if (!obj || typeof obj !== 'object' || Array.isArray(obj)) {
-    return obj
-  }
-
-  const sorted = Object.create(null)
-  const keys = Object.keys(obj).sort()
-
-  for (const key of keys) {
-    sorted[key] = obj[key]
-  }
-
-  return sorted
-}
-
-// Read and parse package.json.
-export async function readPackageJson(filePath) {
-  const content = await fs.readFile(filePath, 'utf8')
-  return JSON.parse(content)
-}
-
-// Write package.json with proper formatting.
-export async function writePackageJson(filePath, data) {
-  const content = `${JSON.stringify(data, null, 2)}\n`
-  await fs.writeFile(filePath, content, 'utf8')
-}
diff --git a/scripts/utils/interactive-runner.mjs b/scripts/utils/interactive-runner.mjs
index 7df11e3..b1f5395 100644
--- a/scripts/utils/interactive-runner.mjs
+++ b/scripts/utils/interactive-runner.mjs
@@ -3,13 +3,7 @@
  * Standardized across all socket-* repositories.
  */
 
-import { spawn } from 'node:child_process'
-import readline from 'node:readline'
-
-import { spinner } from '@socketsecurity/lib/spinner'
-
-// Will import from registry once built:
-// import { attachOutputMask, clearLine, writeOutput } from '@socketsecurity/lib/stdio/mask'
+import { runWithMask } from '#socketsecurity/lib/stdio/mask'
 
 /**
  * Run a command with interactive output control.
@@ -29,213 +23,16 @@ export async function runWithOutput(command, args = [], options = {}) {
     cwd = process.cwd(),
     env = process.env,
     message = 'Running',
-    showOnError = true,
     toggleText = 'to see output',
     verbose = false,
   } = options
 
-  return new Promise((resolve, reject) => {
-    let isSpinning = false
-    let outputBuffer = []
-    let showOutput = verbose
-    let hasTestFailures = false
-    let hasWorkerTerminationError = false
-
-    // Start spinner if not verbose and TTY
-    if (!showOutput && process.stdout.isTTY) {
-      spinner.start(`${message} (ctrl+o ${toggleText})`)
-      isSpinning = true
-    }
-
-    const child = spawn(command, args, {
-      cwd,
-      env,
-      stdio: ['inherit', 'pipe', 'pipe'],
-    })
-
-    // Setup keyboard handling for TTY
-    if (process.stdin.isTTY && !verbose) {
-      readline.emitKeypressEvents(process.stdin)
-      process.stdin.setRawMode(true)
-
-      const keypressHandler = (_str, key) => {
-        // ctrl+o toggles output
-        if (key?.ctrl && key.name === 'o') {
-          showOutput = !showOutput
-
-          if (showOutput) {
-            // Stop spinner and show buffered output
-            if (isSpinning) {
-              spinner.stop()
-              isSpinning = false
-            }
-
-            // Clear line and show buffer
-            process.stdout.write('\r\x1b[K')
-            if (outputBuffer.length > 0) {
-              console.log('--- Showing output ---')
-              outputBuffer.forEach(line => process.stdout.write(line))
-              outputBuffer = []
-            }
-          } else {
-            // Hide output and restart spinner
-            process.stdout.write('\r\x1b[K')
-            if (!isSpinning) {
-              spinner.start(`${message} (ctrl+o ${toggleText})`)
-              isSpinning = true
-            }
-          }
-        }
-        // ctrl+c to cancel
-        else if (key?.ctrl && key.name === 'c') {
-          child.kill('SIGTERM')
-          if (process.stdin.isTTY) {
-            process.stdin.setRawMode(false)
-          }
-          process.exit(130)
-        }
-      }
-
-      process.stdin.on('keypress', keypressHandler)
-
-      // Cleanup on exit
-      child.on('exit', () => {
-        if (process.stdin.isTTY) {
-          process.stdin.setRawMode(false)
-          process.stdin.removeListener('keypress', keypressHandler)
-        }
-      })
-    }
-
-    // Handle stdout
-    if (child.stdout) {
-      child.stdout.on('data', data => {
-        const text = data.toString()
-
-        // Filter out known non-fatal warnings (can appear in stdout too)
-        const isFilteredWarning =
-          text.includes('Terminating worker thread') ||
-          text.includes('Unhandled Rejection') ||
-          text.includes('Object.ThreadTermination') ||
-          text.includes('tinypool@')
-
-        if (isFilteredWarning) {
-          hasWorkerTerminationError = true
-          // Skip these warnings - they're non-fatal cleanup messages
-          // But continue to check for test failures in the same output
-        }
-
-        // Check for test failures in vitest output
-        if (
-          text.includes('FAIL') ||
-          text.match(/Test Files.*\d+ failed/) ||
-          text.match(/Tests\s+\d+ failed/)
-        ) {
-          hasTestFailures = true
-        }
-
-        // Don't write filtered warnings to output
-        if (isFilteredWarning) {
-          return
-        }
-
-        if (showOutput) {
-          process.stdout.write(text)
-        } else {
-          outputBuffer.push(text)
-          // Keep buffer reasonable (last 1000 lines)
-          const lines = outputBuffer.join('').split('\n')
-          if (lines.length > 1000) {
-            outputBuffer = [lines.slice(-1000).join('\n')]
-          }
-        }
-      })
-    }
-
-    // Handle stderr
-    if (child.stderr) {
-      child.stderr.on('data', data => {
-        const text = data.toString()
-        // Filter out known non-fatal warnings
-        const isFilteredWarning =
-          text.includes('Terminating worker thread') ||
-          text.includes('Unhandled Rejection') ||
-          text.includes('Object.ThreadTermination') ||
-          text.includes('tinypool@')
-
-        if (isFilteredWarning) {
-          hasWorkerTerminationError = true
-          // Skip these warnings - they're non-fatal cleanup messages
-          return
-        }
-
-        // Check for test failures
-        if (
-          text.includes('FAIL') ||
-          text.match(/Test Files.*\d+ failed/) ||
-          text.match(/Tests\s+\d+ failed/)
-        ) {
-          hasTestFailures = true
-        }
-
-        if (showOutput) {
-          process.stderr.write(text)
-        } else {
-          outputBuffer.push(text)
-        }
-      })
-    }
-
-    child.on('exit', code => {
-      // Cleanup keyboard if needed
-      if (process.stdin.isTTY && !verbose) {
-        process.stdin.setRawMode(false)
-      }
-
-      // Override exit code if we only have worker termination errors
-      // and no actual test failures
-      let finalCode = code || 0
-      if (code !== 0 && hasWorkerTerminationError && !hasTestFailures) {
-        // This is the known non-fatal worker thread cleanup issue
-        // All tests passed, so return success
-        finalCode = 0
-      }
-
-      if (isSpinning) {
-        if (finalCode === 0) {
-          spinner.stop()
-          spinner.success(`${message} completed`)
-          // Ensure spinner is fully cleared and we're on a fresh line
-          process.stdout.write('\r\x1b[K')
-        } else {
-          spinner.stop()
-          spinner.fail(`${message} failed`)
-          // Ensure spinner is fully cleared and we're on a fresh line
-          process.stdout.write('\r\x1b[K')
-          // Show output on error if configured
-          if (showOnError && outputBuffer.length > 0) {
-            console.log('\n--- Output ---')
-            outputBuffer.forEach(line => process.stdout.write(line))
-          }
-        }
-      }
-
-      resolve(finalCode)
-    })
-
-    child.on('error', error => {
-      if (process.stdin.isTTY && !verbose) {
-        process.stdin.setRawMode(false)
-      }
-
-      if (isSpinning) {
-        spinner.stop()
-        spinner.fail(`${message} error: ${error.message}`)
-        // Ensure spinner is fully cleared and we're on a fresh line
-        process.stdout.write('\r\x1b[K')
-      }
-      reject(error)
-    })
+  return runWithMask(command, args, {
+    cwd,
+    env,
+    message,
+    showOutput: verbose,
+    toggleText,
   })
 }
 
diff --git a/scripts/utils/logger.mjs b/scripts/utils/logger.mjs
deleted file mode 100644
index 136a8ad..0000000
--- a/scripts/utils/logger.mjs
+++ /dev/null
@@ -1,41 +0,0 @@
-/**
- * @fileoverview Minimal logger for build scripts that mimics the main logger API.
- * This is used during build when the full logger with external dependencies isn't available yet.
- */
-
-const isDebug = () => !!process.env.DEBUG
-
-// Simple logger that mimics the main logger API but uses console directly.
-export const logger = {
-  log(...args) {
-    console.log(...args)
-    return this
-  },
-
-  error(...args) {
-    console.error(...args)
-    return this
-  },
-
-  warn(...args) {
-    console.warn('\u26a0\ufe0f', ...args)
-    return this
-  },
-
-  success(...args) {
-    console.log('\u2705', ...args)
-    return this
-  },
-
-  info(...args) {
-    console.log('\u2139\ufe0f', ...args)
-    return this
-  },
-
-  debug(...args) {
-    if (isDebug()) {
-      console.log(...args)
-    }
-    return this
-  },
-}
diff --git a/scripts/utils/parse-args.mjs b/scripts/utils/parse-args.mjs
new file mode 100644
index 0000000..cb40849
--- /dev/null
+++ b/scripts/utils/parse-args.mjs
@@ -0,0 +1,84 @@
+/**
+ * @fileoverview Simplified argument parsing for build scripts.
+ * Uses Node.js built-in util.parseArgs (available in Node 22+).
+ *
+ * This is intentionally separate from src/argv/parse.ts to avoid circular
+ * dependencies where build scripts depend on the built dist output.
+ */
+
+import { parseArgs as nodeParseArgs } from 'node:util'
+
+/**
+ * Parse command-line arguments using Node.js built-in parseArgs.
+ * Simplified version for build scripts that don't need yargs-parser features.
+ *
+ * @param {object} config - Parse configuration
+ * @param {string[]} [config.args] - Arguments to parse (defaults to process.argv.slice(2))
+ * @param {object} [config.options] - Options configuration
+ * @param {boolean} [config.strict] - Whether to throw on unknown options (default: false)
+ * @param {boolean} [config.allowPositionals] - Whether to allow positionals (default: true)
+ * @returns {{ values: object, positionals: string[] }}
+ */
+export function parseArgs(config = {}) {
+  const {
+    allowPositionals = true,
+    args = process.argv.slice(2),
+    options = {},
+    strict = false,
+  } = config
+
+  try {
+    const result = nodeParseArgs({
+      args,
+      options,
+      strict,
+      allowPositionals,
+    })
+
+    return {
+      values: result.values,
+      positionals: result.positionals || [],
+    }
+  } catch (error) {
+    // If parsing fails in non-strict mode, return empty values
+    if (!strict) {
+      return {
+        values: {},
+        positionals: args.filter(arg => !arg.startsWith('-')),
+      }
+    }
+    throw error
+  }
+}
+
+/**
+ * Extract positional arguments from process.argv.
+ *
+ * @param {number} [startIndex=2] - Index to start from
+ * @returns {string[]}
+ */
+export function getPositionalArgs(startIndex = 2) {
+  const args = process.argv.slice(startIndex)
+  const positionals = []
+
+  for (const arg of args) {
+    // Stop at first flag
+    if (arg.startsWith('-')) {
+      break
+    }
+    positionals.push(arg)
+  }
+
+  return positionals
+}
+
+/**
+ * Check if a specific flag is present in argv.
+ *
+ * @param {string} flag - Flag name (without dashes)
+ * @param {string[]} [argv=process.argv] - Arguments array
+ * @returns {boolean}
+ */
+export function hasFlag(flag, argv = process.argv) {
+  return argv.includes(`--${flag}`) || argv.includes(`-${flag.charAt(0)}`)
+}
diff --git a/scripts/utils/path-helpers.mjs b/scripts/utils/path-helpers.mjs
deleted file mode 100644
index c278d39..0000000
--- a/scripts/utils/path-helpers.mjs
+++ /dev/null
@@ -1,17 +0,0 @@
-/** @fileoverview Path utility helpers for script operations. */
-import path from 'node:path'
-import { fileURLToPath } from 'node:url'
-
-/**
- * Get directory name from import.meta.url.
- */
-export function getDirname(importMetaUrl) {
-  return path.dirname(fileURLToPath(importMetaUrl))
-}
-
-/**
- * Get root directory path from current script location.
- */
-export function getRootPath(importMetaUrl) {
-  return path.join(getDirname(importMetaUrl), '..')
-}
diff --git a/scripts/utils/run-command.mjs b/scripts/utils/run-command.mjs
index ad1c2e5..1a95592 100644
--- a/scripts/utils/run-command.mjs
+++ b/scripts/utils/run-command.mjs
@@ -1,8 +1,9 @@
 /** @fileoverview Utility for running shell commands with proper error handling. */
 
-import { spawn, spawnSync } from 'node:child_process'
+import { getDefaultLogger } from '#socketsecurity/lib/logger'
+import { spawn, spawnSync } from '#socketsecurity/lib/spawn'
 
-import { logger } from '@socketsecurity/lib/logger'
+const logger = getDefaultLogger()
 
 /**
  * Run a command and return a promise that resolves with the exit code.
@@ -11,22 +12,22 @@ import { logger } from '@socketsecurity/lib/logger'
  * @param {object} options - Spawn options
  * @returns {Promise<number>} Exit code
  */
-export function runCommand(command, args = [], options = {}) {
-  return new Promise((resolve, reject) => {
-    const child = spawn(command, args, {
+export async function runCommand(command, args = [], options = {}) {
+  try {
+    const result = await spawn(command, args, {
       stdio: 'inherit',
       ...(process.platform === 'win32' && { shell: true }),
       ...options,
     })
-
-    child.on('exit', code => {
-      resolve(code || 0)
-    })
-
-    child.on('error', error => {
-      reject(error)
-    })
-  })
+    return result.code
+  } catch (error) {
+    // spawn() from @socketsecurity/lib throws on non-zero exit
+    // Return the exit code from the error
+    if (error && typeof error === 'object' && 'code' in error) {
+      return error.code
+    }
+    throw error
+  }
 }
 
 /**
@@ -81,7 +82,8 @@ export async function runParallel(commands) {
   const promises = commands.map(({ args = [], command, options = {} }) =>
     runCommand(command, args, options),
   )
-  return Promise.all(promises)
+  const results = await Promise.allSettled(promises)
+  return results.map(r => (r.status === 'fulfilled' ? r.value : 1))
 }
 
 /**
@@ -91,37 +93,38 @@ export async function runParallel(commands) {
  * @param {object} options - Spawn options
  * @returns {Promise<{exitCode: number, stdout: string, stderr: string}>}
  */
-export function runCommandQuiet(command, args = [], options = {}) {
-  return new Promise((resolve, reject) => {
-    let stdout = ''
-    let stderr = ''
-
-    const child = spawn(command, args, {
+export async function runCommandQuiet(command, args = [], options = {}) {
+  try {
+    const result = await spawn(command, args, {
       ...options,
       ...(process.platform === 'win32' && { shell: true }),
-      stdio: ['inherit', 'pipe', 'pipe'],
-    })
-
-    child.stdout?.on('data', data => {
-      stdout += data.toString()
+      stdio: 'pipe',
+      stdioString: true,
     })
 
-    child.stderr?.on('data', data => {
-      stderr += data.toString()
-    })
-
-    child.on('exit', code => {
-      resolve({
-        exitCode: code || 0,
-        stderr,
-        stdout,
-      })
-    })
-
-    child.on('error', error => {
-      reject(error)
-    })
-  })
+    return {
+      exitCode: result.code,
+      stderr: result.stderr,
+      stdout: result.stdout,
+    }
+  } catch (error) {
+    // spawn() from @socketsecurity/lib throws on non-zero exit
+    // Return the exit code and output from the error
+    if (
+      error &&
+      typeof error === 'object' &&
+      'code' in error &&
+      'stdout' in error &&
+      'stderr' in error
+    ) {
+      return {
+        exitCode: error.code,
+        stderr: error.stderr,
+        stdout: error.stdout,
+      }
+    }
+    throw error
+  }
 }
 
 /**
diff --git a/scripts/utils/signal-exit.mjs b/scripts/utils/signal-exit.mjs
new file mode 100644
index 0000000..96447d1
--- /dev/null
+++ b/scripts/utils/signal-exit.mjs
@@ -0,0 +1,38 @@
+/**
+ * @fileoverview Simplified signal exit handler for build scripts.
+ *
+ * This is intentionally separate from src/lib/signal-exit.ts to avoid circular
+ * dependencies where build scripts depend on the built dist output.
+ */
+
+/**
+ * Register a callback to run when process exits
+ *
+ * @param {(code: number, signal: string | null) => void} callback
+ * @returns {() => void} Cleanup function
+ */
+export function onExit(callback) {
+  const signals = ['SIGINT', 'SIGTERM', 'SIGHUP']
+
+  const handler = signal => {
+    callback(process.exitCode || 0, signal)
+  }
+
+  const exitHandler = () => {
+    callback(process.exitCode || 0, null)
+  }
+
+  signals.forEach(signal => {
+    process.on(signal, handler)
+  })
+
+  process.on('exit', exitHandler)
+
+  // Return cleanup function
+  return () => {
+    signals.forEach(signal => {
+      process.off(signal, handler)
+    })
+    process.off('exit', exitHandler)
+  }
+}
diff --git a/scripts/utils/suppress-warnings.mjs b/scripts/utils/suppress-warnings.mjs
deleted file mode 100644
index 8881d0e..0000000
--- a/scripts/utils/suppress-warnings.mjs
+++ /dev/null
@@ -1,115 +0,0 @@
-/** @fileoverview Utility to suppress specific process warnings. */
-
-const { apply: ReflectApply } = Reflect
-
-// Store the original emitWarning function to avoid repeat wrapping.
-let originalEmitWarning
-
-// Track which warning types are currently suppressed.
-const suppressedWarnings = new Set()
-
-/**
- * Internal function to set up warning suppression.
- * Only wraps process.emitWarning once, regardless of how many times it's called.
- */
-function setupSuppression() {
-  // Only wrap once - store the original on first call.
-  if (!originalEmitWarning) {
-    originalEmitWarning = process.emitWarning
-    process.emitWarning = (warning, ...args) => {
-      // Check both string warnings and warning objects.
-      if (typeof warning === 'string') {
-        // Check if any suppressed warning type matches.
-        for (const suppressedType of suppressedWarnings) {
-          if (warning.includes(suppressedType)) {
-            return
-          }
-        }
-      } else if (warning && typeof warning === 'object') {
-        const warningName = warning.name
-        if (warningName && suppressedWarnings.has(warningName)) {
-          return
-        }
-      }
-      // Not suppressed - call the original function.
-      return ReflectApply(originalEmitWarning, process, [warning, ...args])
-    }
-  }
-}
-
-/**
- * Suppress MaxListenersExceededWarning messages.
- * This is useful in tests or scripts where multiple listeners are expected.
- */
-export function suppressMaxListenersWarning() {
-  suppressedWarnings.add('MaxListenersExceededWarning')
-  setupSuppression()
-}
-
-/**
- * Suppress all process warnings of a specific type.
- *
- * @param {string} warningType - The warning type to suppress (e.g., 'DeprecationWarning', 'ExperimentalWarning')
- */
-export function suppressWarningType(warningType) {
-  suppressedWarnings.add(warningType)
-  setupSuppression()
-}
-
-/**
- * Set max listeners on an EventTarget (like AbortSignal) to avoid TypeError.
- *
- * By manually setting `kMaxEventTargetListeners` on the target we avoid:
- *   TypeError [ERR_INVALID_ARG_TYPE]: The "emitter" argument must be an
- *   instance of EventEmitter or EventTarget. Received an instance of
- *   AbortSignal
- *
- * in some patch releases of Node 18-23 when calling events.getMaxListeners().
- * See https://github.com/nodejs/node/pull/56807.
- *
- * Instead of calling events.setMaxListeners(n, target) we set the symbol
- * property directly to avoid depending on 'node:events' module.
- *
- * @param {EventTarget | AbortSignal} target - The EventTarget or AbortSignal to configure
- * @param {number} [maxListeners=10] - Maximum number of listeners (defaults to 10, the Node.js default)
- */
-export function setMaxEventTargetListeners(target, maxListeners = 10) {
-  const symbols = Object.getOwnPropertySymbols(target)
-  const kMaxEventTargetListeners = symbols.find(
-    s => s.description === 'events.maxEventTargetListeners',
-  )
-  if (kMaxEventTargetListeners) {
-    // The default events.defaultMaxListeners value is 10.
-    // https://nodejs.org/api/events.html#eventsdefaultmaxlisteners
-    target[kMaxEventTargetListeners] = maxListeners
-  }
-}
-
-/**
- * Restore the original process.emitWarning function.
- * Call this to re-enable all warnings after suppressing them.
- */
-export function restoreWarnings() {
-  if (originalEmitWarning) {
-    process.emitWarning = originalEmitWarning
-    originalEmitWarning = undefined
-    suppressedWarnings.clear()
-  }
-}
-
-/**
- * Suppress warnings temporarily within a callback.
- *
- * @param {string} warningType - The warning type to suppress
- * @param {Function} callback - Function to execute with warnings suppressed
- * @returns {Promise<*>} The result of the callback
- */
-export async function withSuppressedWarnings(warningType, callback) {
-  const original = process.emitWarning
-  suppressWarningType(warningType)
-  try {
-    return await callback()
-  } finally {
-    process.emitWarning = original
-  }
-}
diff --git a/scripts/validate-external.mjs b/scripts/validate-external.mjs
deleted file mode 100644
index bf14917..0000000
--- a/scripts/validate-external.mjs
+++ /dev/null
@@ -1,102 +0,0 @@
-/**
- * @fileoverview Validate that external dependencies don't reference npm packages.
- * External files must be bundled/vendored code, not re-exports from npm.
- *
- * Usage:
- *   node scripts/validate-external.mjs
- */
-
-import { promises as fs } from 'node:fs'
-import path from 'node:path'
-import { fileURLToPath } from 'node:url'
-
-import fastGlob from 'fast-glob'
-
-const __filename = fileURLToPath(import.meta.url)
-const __dirname = path.dirname(__filename)
-
-const scriptsPath = __dirname
-const rootPath = path.join(scriptsPath, '..')
-const srcPath = path.join(rootPath, 'src')
-const srcExternalPath = path.join(srcPath, 'external')
-
-// Packages that are allowed to be re-exported (must be in dependencies)
-// Separate package that depends on registry
-const ALLOWED_EXTERNAL_PACKAGES = new Set(['@socketregistry/packageurl-js'])
-
-const FORBIDDEN_PATTERNS = [
-  // Match @socketregistry/* imports (except allowed ones)
-  {
-    isAllowed: match => ALLOWED_EXTERNAL_PACKAGES.has(match),
-    message: '@socketregistry/* packages',
-    pattern: /@socketregistry\/[\w-]+/g,
-  },
-  // Match @socketsecurity/* imports - never allowed
-  {
-    isAllowed: () => false,
-    message: '@socketsecurity/* packages',
-    pattern: /@socketsecurity\/[\w-]+/g,
-  },
-]
-
-async function main() {
-  try {
-    const filepaths = await fastGlob.glob(['**/*.{js,ts}'], {
-      absolute: true,
-      cwd: srcExternalPath,
-    })
-
-    const errors = []
-
-    await Promise.all(
-      filepaths.map(async filepath => {
-        const content = await fs.readFile(filepath, 'utf8')
-        const relPath = path.relative(srcExternalPath, filepath)
-
-        for (const {
-          isAllowed,
-          message: patternMsg,
-          pattern,
-        } of FORBIDDEN_PATTERNS) {
-          const matches = content.match(pattern)
-          if (matches) {
-            for (const match of matches) {
-              if (!isAllowed(match)) {
-                errors.push({
-                  file: relPath,
-                  match,
-                  message: `External file references ${patternMsg} '${match}' - external files must be bundled/vendored code, not re-exports`,
-                })
-              }
-            }
-          }
-        }
-      }),
-    )
-
-    if (errors.length > 0) {
-      console.error('\n❌ External validation failed:\n')
-      for (const error of errors) {
-        console.error(`  ${error.file}`)
-        console.error(`    ${error.message}`)
-      }
-      console.error(
-        '\n💡 Fix: External files should contain bundled/vendored source code.',
-      )
-      console.error(
-        '    They must NOT re-export from @socketregistry/* or @socketsecurity/* packages.',
-      )
-      console.error(
-        '    Either inline the code or properly bundle these dependencies.\n',
-      )
-      process.exitCode = 1
-    } else {
-      console.log('✅ External validation passed')
-    }
-  } catch (error) {
-    console.error('Validate external failed:', error.message)
-    process.exitCode = 1
-  }
-}
-
-main().catch(console.error)
diff --git a/scripts/validate/dist-exports.mjs b/scripts/validate/dist-exports.mjs
new file mode 100644
index 0000000..fcfcdfd
--- /dev/null
+++ b/scripts/validate/dist-exports.mjs
@@ -0,0 +1,130 @@
+/**
+ * @fileoverview Validate that all dist/* exports work correctly without .default
+ * Ensures require('./dist/foo') returns the actual value, not wrapped in { default: value }
+ */
+
+import { createRequire } from 'node:module'
+import { readdirSync } from 'node:fs'
+import path from 'node:path'
+import { fileURLToPath } from 'node:url'
+
+import colors from 'yoctocolors-cjs'
+
+const __dirname = path.dirname(fileURLToPath(import.meta.url))
+const distDir = path.resolve(__dirname, '..', '..', 'dist')
+const require = createRequire(import.meta.url)
+
+// Normalize path for cross-platform (converts backslashes to forward slashes)
+const normalizePath = p => p.split(path.sep).join('/')
+
+// Import CommonJS modules using require
+const { isQuiet } = require('#socketsecurity/lib/argv/flags')
+const { pluralize } = require('#socketsecurity/lib/words')
+
+/**
+ * Get all .js files in a directory recursively.
+ */
+function getJsFiles(dir, files = []) {
+  const entries = readdirSync(dir, { withFileTypes: true })
+
+  for (const entry of entries) {
+    const fullPath = path.join(dir, entry.name)
+
+    if (entry.isDirectory()) {
+      getJsFiles(fullPath, files)
+    } else if (entry.isFile() && entry.name.endsWith('.js')) {
+      files.push(fullPath)
+    }
+  }
+
+  return files
+}
+
+/**
+ * Check if a module export needs .default or works directly.
+ */
+function checkExport(filePath) {
+  // Skip external packages - they are internal implementation details
+  // used by public dist/* modules. We only validate public exports.
+  const relativePath = path.relative(distDir, filePath)
+  // Normalize path for cross-platform compatibility (Windows uses backslashes)
+  const normalizedPath = normalizePath(relativePath)
+  if (normalizedPath.startsWith('external/')) {
+    return { path: filePath, ok: true, skipped: true }
+  }
+
+  try {
+    const mod = require(filePath)
+
+    // Handle primitive exports (strings, numbers, etc.)
+    if (typeof mod !== 'object' || mod === null) {
+      return { path: filePath, ok: true }
+    }
+
+    const hasDefault = 'default' in mod && mod.default !== undefined
+
+    // If module has .default and the direct export is empty/different,
+    // it's likely incorrectly exported
+    if (hasDefault) {
+      const directKeys = Object.keys(mod).filter(k => k !== 'default')
+      // If only key is 'default', the export is wrapped incorrectly
+      if (directKeys.length === 0) {
+        return {
+          path: filePath,
+          ok: false,
+          reason: 'Export wrapped in { default: value } - needs .default',
+        }
+      }
+    }
+
+    return { path: filePath, ok: true }
+  } catch (error) {
+    return {
+      path: filePath,
+      ok: false,
+      reason: `Failed to require: ${error.message}`,
+    }
+  }
+}
+
+async function main() {
+  const quiet = isQuiet()
+  const verbose = process.argv.includes('--verbose')
+
+  if (!quiet && verbose) {
+    console.log(`${colors.cyan('→')} Validating dist exports`)
+  }
+
+  const files = getJsFiles(distDir)
+  const results = files.map(checkExport)
+  const failures = results.filter(r => !r.ok)
+
+  const checked = results.filter(r => !r.skipped)
+
+  if (failures.length > 0) {
+    if (!quiet) {
+      console.error(
+        colors.red('✗') +
+          ` Found ${failures.length} public ${pluralize('export', { count: failures.length })} with incorrect exports:`,
+      )
+      for (const failure of failures) {
+        const relativePath = path.relative(distDir, failure.path)
+        console.error(`  ${colors.red('✗')} ${relativePath}`)
+        console.error(`    ${failure.reason}`)
+      }
+    }
+    process.exitCode = 1
+  } else {
+    if (!quiet) {
+      console.log(
+        colors.green('✓') +
+          ` Validated ${checked.length} public ${pluralize('export', { count: checked.length })} - all work without .default`,
+      )
+    }
+  }
+}
+
+main().catch(error => {
+  console.error(`${colors.red('✗')} Validation failed:`, error.message)
+  process.exitCode = 1
+})
diff --git a/scripts/validate/esbuild-minify.mjs b/scripts/validate/esbuild-minify.mjs
new file mode 100644
index 0000000..b21500d
--- /dev/null
+++ b/scripts/validate/esbuild-minify.mjs
@@ -0,0 +1,86 @@
+/**
+ * @fileoverview Validates that esbuild configuration has minify: false.
+ * Minification breaks ESM/CJS interop and makes debugging harder.
+ */
+
+import path from 'node:path'
+import { fileURLToPath } from 'node:url'
+
+const __dirname = path.dirname(fileURLToPath(import.meta.url))
+const rootPath = path.join(__dirname, '..', '..')
+
+/**
+ * Validate esbuild configuration has minify: false.
+ */
+async function validateEsbuildMinify() {
+  const configPath = path.join(rootPath, '.config/esbuild.config.mjs')
+
+  try {
+    // Dynamic import of the esbuild config
+    const config = await import(configPath)
+
+    const violations = []
+
+    // Check buildConfig
+    if (config.buildConfig) {
+      if (config.buildConfig.minify !== false) {
+        violations.push({
+          config: 'buildConfig',
+          value: config.buildConfig.minify,
+          message: 'buildConfig.minify must be false',
+          location: `${configPath}:242`,
+        })
+      }
+    }
+
+    // Check watchConfig
+    if (config.watchConfig) {
+      if (config.watchConfig.minify !== false) {
+        violations.push({
+          config: 'watchConfig',
+          value: config.watchConfig.minify,
+          message: 'watchConfig.minify must be false',
+          location: `${configPath}:270`,
+        })
+      }
+    }
+
+    return violations
+  } catch (error) {
+    console.error(`Failed to load esbuild config: ${error.message}`)
+    process.exitCode = 1
+    return []
+  }
+}
+
+async function main() {
+  const violations = await validateEsbuildMinify()
+
+  if (violations.length === 0) {
+    console.log('✓ esbuild minify validation passed')
+    process.exitCode = 0
+    return
+  }
+
+  console.error('❌ esbuild minify validation failed\n')
+
+  for (const violation of violations) {
+    console.error(`  ${violation.message}`)
+    console.error(`  Found: minify: ${violation.value}`)
+    console.error('  Expected: minify: false')
+    console.error(`  Location: ${violation.location}`)
+    console.error('')
+  }
+
+  console.error(
+    'Minification breaks ESM/CJS interop and makes debugging harder.',
+  )
+  console.error('')
+
+  process.exitCode = 1
+}
+
+main().catch(error => {
+  console.error('Validation failed:', error)
+  process.exitCode = 1
+})
diff --git a/scripts/validate/esm-named-exports.mjs b/scripts/validate/esm-named-exports.mjs
new file mode 100644
index 0000000..2f2dc3b
--- /dev/null
+++ b/scripts/validate/esm-named-exports.mjs
@@ -0,0 +1,188 @@
+/**
+ * @fileoverview Validate that dist/* files export named exports compatible with ESM imports
+ * Ensures that module.exports = { foo, bar } pattern is used (not module.exports.default)
+ * so that ESM code can do: import { foo, bar } from '#socketsecurity/lib/module'
+ */
+
+import { createRequire } from 'node:module'
+import { readFileSync, readdirSync } from 'node:fs'
+import path from 'node:path'
+import { fileURLToPath } from 'node:url'
+
+import colors from 'yoctocolors-cjs'
+
+const __dirname = path.dirname(fileURLToPath(import.meta.url))
+const distDir = path.resolve(__dirname, '..', '..', 'dist')
+const require = createRequire(import.meta.url)
+
+// Normalize path for cross-platform (converts backslashes to forward slashes)
+const normalizePath = p => p.split(path.sep).join('/')
+
+// Import CommonJS modules using require
+const { isQuiet } = require('#socketsecurity/lib/argv/flags')
+const { pluralize } = require('#socketsecurity/lib/words')
+
+/**
+ * Get all .js files in a directory recursively.
+ */
+function getJsFiles(dir, files = []) {
+  const entries = readdirSync(dir, { withFileTypes: true })
+
+  for (const entry of entries) {
+    const fullPath = path.join(dir, entry.name)
+
+    if (entry.isDirectory()) {
+      getJsFiles(fullPath, files)
+    } else if (entry.isFile() && entry.name.endsWith('.js')) {
+      files.push(fullPath)
+    }
+  }
+
+  return files
+}
+
+/**
+ * Check if a module exports named exports in an ESM-compatible way.
+ * Good: module.exports = { foo, bar, baz }
+ * Bad: module.exports = value or module.exports.default = value
+ */
+function checkEsmNamedExports(filePath) {
+  // Skip external packages - they are bundled dependencies
+  const relativePath = path.relative(distDir, filePath)
+  const normalizedPath = normalizePath(relativePath)
+  if (normalizedPath.startsWith('external/')) {
+    return { path: filePath, ok: true, skipped: true }
+  }
+
+  try {
+    // Read the file source to check export pattern
+    const source = readFileSync(filePath, 'utf-8')
+
+    // Check for problematic patterns
+    const hasDefaultExport =
+      /module\.exports\s*=\s*\w+\s*;?\s*$/.test(source) ||
+      /module\.exports\.default\s*=/.test(source)
+
+    // Check for proper named exports pattern
+    const hasNamedExportsObject = /module\.exports\s*=\s*{/.test(source)
+
+    // Also check by actually requiring the module
+    let mod
+    try {
+      mod = require(filePath)
+    } catch (requireError) {
+      return {
+        path: filePath,
+        ok: false,
+        reason: `Failed to require: ${requireError.message}`,
+      }
+    }
+
+    // If it's a primitive, it can't have named exports
+    if (typeof mod !== 'object' || mod === null) {
+      return {
+        path: filePath,
+        ok: false,
+        reason:
+          'Module exports a primitive value instead of an object with named exports',
+      }
+    }
+
+    // If module only has 'default' key, it's not ESM-compatible
+    const keys = Object.keys(mod)
+    if (keys.length === 1 && keys[0] === 'default') {
+      return {
+        path: filePath,
+        ok: false,
+        reason:
+          'Module only exports { default: value } - should export named exports directly',
+      }
+    }
+
+    // If we have suspicious patterns and no proper object exports
+    if (hasDefaultExport && !hasNamedExportsObject) {
+      // But let's be lenient if the module does have named exports when required
+      if (keys.length > 0 && !keys.includes('default')) {
+        // It's fine - esbuild generated proper interop
+        return { path: filePath, ok: true }
+      }
+
+      return {
+        path: filePath,
+        ok: false,
+        reason:
+          'Module uses default export pattern instead of named exports object',
+      }
+    }
+
+    // If we have an empty object, check if it's a type-only file
+    if (keys.length === 0) {
+      // Type-only files (e.g., cover/types.js, effects/types.js) have no runtime exports
+      // These are expected and OK
+      const isTypeOnlyFile = normalizedPath.endsWith('/types.js')
+      if (isTypeOnlyFile) {
+        return { path: filePath, ok: true }
+      }
+      return {
+        path: filePath,
+        ok: false,
+        reason: 'Module exports an empty object with no named exports',
+      }
+    }
+
+    return { path: filePath, ok: true }
+  } catch (error) {
+    return {
+      path: filePath,
+      ok: false,
+      reason: `Failed to analyze: ${error.message}`,
+    }
+  }
+}
+
+async function main() {
+  const quiet = isQuiet()
+  const verbose = process.argv.includes('--verbose')
+
+  if (!quiet && verbose) {
+    console.log(`${colors.cyan('→')} Validating ESM-compatible named exports`)
+  }
+
+  const files = getJsFiles(distDir)
+  const results = files.map(checkEsmNamedExports)
+  const failures = results.filter(r => !r.ok)
+
+  const checked = results.filter(r => !r.skipped)
+
+  if (failures.length > 0) {
+    if (!quiet) {
+      console.error(
+        colors.red('✗') +
+          ` Found ${failures.length} ${pluralize('file', { count: failures.length })} without ESM-compatible named exports:`,
+      )
+      for (const failure of failures) {
+        const relativePath = path.relative(distDir, failure.path)
+        console.error(`  ${colors.red('✗')} ${relativePath}`)
+        console.error(`    ${failure.reason}`)
+      }
+      console.error(
+        '\n' +
+          colors.yellow('Hint:') +
+          ' Use module.exports = { foo, bar } pattern for ESM compatibility',
+      )
+    }
+    process.exitCode = 1
+  } else {
+    if (!quiet) {
+      console.log(
+        colors.green('✓') +
+          ` Validated ${checked.length} ${pluralize('file', { count: checked.length })} - all have ESM-compatible named exports`,
+      )
+    }
+  }
+}
+
+main().catch(error => {
+  console.error(`${colors.red('✗')} Validation failed:`, error.message)
+  process.exitCode = 1
+})
diff --git a/scripts/validate/file-count.mjs b/scripts/validate/file-count.mjs
new file mode 100644
index 0000000..28072ba
--- /dev/null
+++ b/scripts/validate/file-count.mjs
@@ -0,0 +1,113 @@
+/**
+ * @fileoverview Validates that commits don't contain too many files.
+ *
+ * Rules:
+ * - No single commit should contain 50+ files
+ * - Helps catch accidentally staging too many files or generated content
+ * - Prevents overly large commits that are hard to review
+ */
+
+import { exec } from 'node:child_process'
+import path from 'node:path'
+import { promisify } from 'node:util'
+import { fileURLToPath } from 'node:url'
+import { getDefaultLogger } from '#socketsecurity/lib/logger'
+
+const logger = getDefaultLogger()
+
+const execAsync = promisify(exec)
+
+const __dirname = path.dirname(fileURLToPath(import.meta.url))
+const rootPath = path.join(__dirname, '..', '..')
+
+// Maximum number of files in a single commit
+const MAX_FILES_PER_COMMIT = 50
+
+/**
+ * Check if too many files are staged for commit.
+ */
+async function validateStagedFileCount() {
+  try {
+    // Check if we're in a git repository
+    const { stdout: gitRoot } = await execAsync(
+      'git rev-parse --show-toplevel',
+      {
+        cwd: rootPath,
+      },
+    )
+
+    // Not a git repository
+    if (!gitRoot.trim()) {
+      return null
+    }
+
+    // Get list of staged files
+    const { stdout } = await execAsync('git diff --cached --name-only', {
+      cwd: rootPath,
+    })
+
+    const stagedFiles = stdout
+      .trim()
+      .split('\n')
+      .filter(line => line.length > 0)
+
+    if (stagedFiles.length >= MAX_FILES_PER_COMMIT) {
+      return {
+        count: stagedFiles.length,
+        files: stagedFiles,
+        limit: MAX_FILES_PER_COMMIT,
+      }
+    }
+
+    return null
+  } catch {
+    // Not a git repo or git not available
+    return null
+  }
+}
+
+async function main() {
+  try {
+    const violation = await validateStagedFileCount()
+
+    if (!violation) {
+      logger.success('Commit size is acceptable')
+      process.exitCode = 0
+      return
+    }
+
+    logger.error('Too many files staged for commit')
+    logger.log('')
+    logger.log(`Staged files: ${violation.count}`)
+    logger.log(`Maximum allowed: ${violation.limit}`)
+    logger.log('')
+    logger.log('Staged files:')
+    logger.log('')
+
+    // Show first 20 files, then summary if more
+    const filesToShow = violation.files.slice(0, 20)
+    for (const file of filesToShow) {
+      logger.log(`  ${file}`)
+    }
+
+    if (violation.files.length > 20) {
+      logger.log(`  ... and ${violation.files.length - 20} more files`)
+    }
+
+    logger.log('')
+    logger.log(
+      'Split into smaller commits, check for accidentally staged files, or exclude generated files.',
+    )
+    logger.log('')
+
+    process.exitCode = 1
+  } catch (error) {
+    logger.error(`Validation failed: ${error.message}`)
+    process.exitCode = 1
+  }
+}
+
+main().catch(error => {
+  logger.error(`Validation failed: ${error}`)
+  process.exitCode = 1
+})
diff --git a/scripts/validate/file-size.mjs b/scripts/validate/file-size.mjs
new file mode 100644
index 0000000..bb4927a
--- /dev/null
+++ b/scripts/validate/file-size.mjs
@@ -0,0 +1,151 @@
+/**
+ * @fileoverview Validates that no individual files exceed size threshold.
+ *
+ * Rules:
+ * - No single file should exceed 2MB (2,097,152 bytes)
+ * - Helps prevent accidental commits of large binaries, data files, or artifacts
+ * - Excludes: node_modules, .git, dist, build, coverage directories
+ */
+
+import { promises as fs } from 'node:fs'
+import path from 'node:path'
+import { fileURLToPath } from 'node:url'
+import { getDefaultLogger } from '#socketsecurity/lib/logger'
+
+const logger = getDefaultLogger()
+
+const __dirname = path.dirname(fileURLToPath(import.meta.url))
+const rootPath = path.join(__dirname, '..', '..')
+
+// Maximum file size: 2MB (2,097,152 bytes)
+const MAX_FILE_SIZE = 2 * 1024 * 1024
+
+// Directories to skip
+const SKIP_DIRS = new Set([
+  'node_modules',
+  '.git',
+  'dist',
+  'build',
+  '.cache',
+  'coverage',
+  '.next',
+  '.nuxt',
+  '.output',
+  '.turbo',
+  '.vercel',
+  '.vscode',
+  'tmp',
+])
+
+/**
+ * Format bytes to human-readable size.
+ */
+function formatBytes(bytes) {
+  if (bytes === 0) {
+    return '0 B'
+  }
+  const k = 1024
+  const sizes = ['B', 'KB', 'MB', 'GB']
+  const i = Math.floor(Math.log(bytes) / Math.log(k))
+  return `${(bytes / k ** i).toFixed(2)} ${sizes[i]}`
+}
+
+/**
+ * Recursively scan directory for files exceeding size limit.
+ */
+async function scanDirectory(dir, violations = []) {
+  try {
+    const entries = await fs.readdir(dir, { withFileTypes: true })
+
+    for (const entry of entries) {
+      const fullPath = path.join(dir, entry.name)
+
+      if (entry.isDirectory()) {
+        // Skip excluded directories and hidden directories (except .claude, .config, .github)
+        if (
+          !SKIP_DIRS.has(entry.name) &&
+          (!entry.name.startsWith('.') ||
+            entry.name === '.claude' ||
+            entry.name === '.config' ||
+            entry.name === '.github')
+        ) {
+          await scanDirectory(fullPath, violations)
+        }
+      } else if (entry.isFile()) {
+        try {
+          const stats = await fs.stat(fullPath)
+          if (stats.size > MAX_FILE_SIZE) {
+            const relativePath = path.relative(rootPath, fullPath)
+            violations.push({
+              file: relativePath,
+              size: stats.size,
+              formattedSize: formatBytes(stats.size),
+              maxSize: formatBytes(MAX_FILE_SIZE),
+            })
+          }
+        } catch {
+          // Skip files we can't stat
+        }
+      }
+    }
+  } catch {
+    // Skip directories we can't read
+  }
+
+  return violations
+}
+
+/**
+ * Validate file sizes in repository.
+ */
+async function validateFileSizes() {
+  const violations = await scanDirectory(rootPath)
+
+  // Sort by size descending (largest first)
+  violations.sort((a, b) => b.size - a.size)
+
+  return violations
+}
+
+async function main() {
+  try {
+    const violations = await validateFileSizes()
+
+    if (violations.length === 0) {
+      logger.success('All files are within size limits')
+      process.exitCode = 0
+      return
+    }
+
+    logger.error('File size violations found')
+    logger.log('')
+    logger.log(`Maximum allowed file size: ${formatBytes(MAX_FILE_SIZE)}`)
+    logger.log('')
+    logger.log('Files exceeding limit:')
+    logger.log('')
+
+    for (const violation of violations) {
+      logger.log(`  ${violation.file}`)
+      logger.log(`    Size: ${violation.formattedSize}`)
+      logger.log(
+        `    Exceeds limit by: ${formatBytes(violation.size - MAX_FILE_SIZE)}`,
+      )
+      logger.log('')
+    }
+
+    logger.log(
+      'Reduce file sizes, move large files to external storage, or exclude from repository.',
+    )
+    logger.log('')
+
+    process.exitCode = 1
+  } catch (error) {
+    logger.error(`Validation failed: ${error.message}`)
+    process.exitCode = 1
+  }
+}
+
+main().catch(error => {
+  logger.error(`Validation failed: ${error}`)
+  process.exitCode = 1
+})
diff --git a/scripts/validate/markdown-filenames.mjs b/scripts/validate/markdown-filenames.mjs
new file mode 100644
index 0000000..42a2848
--- /dev/null
+++ b/scripts/validate/markdown-filenames.mjs
@@ -0,0 +1,304 @@
+/**
+ * @fileoverview Validates that markdown files follow naming conventions.
+ *
+ * Special files (allowed anywhere):
+ * - README.md, LICENSE
+ *
+ * Allowed SCREAMING_CASE (all caps) files (root, docs/, or .claude/ only):
+ * - AUTHORS.md, CHANGELOG.md, CITATION.md, CLAUDE.md
+ * - CODE_OF_CONDUCT.md, CONTRIBUTORS.md, CONTRIBUTING.md
+ * - COPYING, CREDITS.md, GOVERNANCE.md, MAINTAINERS.md
+ * - NOTICE.md, SECURITY.md, SUPPORT.md, TRADEMARK.md
+ *
+ * All other .md files must:
+ * - Be lowercase-with-hyphens
+ * - Be located within docs/ or .claude/ directories (any depth)
+ * - NOT be at root level
+ */
+
+import { promises as fs } from 'node:fs'
+import path from 'node:path'
+import { fileURLToPath } from 'node:url'
+import { getDefaultLogger } from '#socketsecurity/lib/logger'
+
+const logger = getDefaultLogger()
+
+const __dirname = path.dirname(fileURLToPath(import.meta.url))
+const rootPath = path.join(__dirname, '..', '..')
+
+// Allowed SCREAMING_CASE markdown files (without .md extension for comparison)
+const ALLOWED_SCREAMING_CASE = new Set([
+  'AUTHORS',
+  'CHANGELOG',
+  'CITATION',
+  'CLAUDE',
+  'CODE_OF_CONDUCT',
+  'CONTRIBUTORS',
+  'CONTRIBUTING',
+  'COPYING',
+  'CREDITS',
+  'GOVERNANCE',
+  'LICENSE',
+  'MAINTAINERS',
+  'NOTICE',
+  'README',
+  'SECURITY',
+  'SUPPORT',
+  'TRADEMARK',
+])
+
+// Directories to skip
+const SKIP_DIRS = new Set([
+  'node_modules',
+  '.git',
+  'dist',
+  'build',
+  '.cache',
+  'coverage',
+  '.next',
+  '.nuxt',
+  '.output',
+])
+
+/**
+ * Check if a filename is in SCREAMING_CASE (all uppercase with optional underscores).
+ */
+function isScreamingCase(filename) {
+  // Remove extension for checking
+  const nameWithoutExt = filename.replace(/\.(md|MD)$/, '')
+
+  // Check if it contains any lowercase letters
+  return /^[A-Z0-9_]+$/.test(nameWithoutExt) && /[A-Z]/.test(nameWithoutExt)
+}
+
+/**
+ * Check if a filename is lowercase-with-hyphens.
+ */
+function isLowercaseHyphenated(filename) {
+  // Remove extension for checking
+  const nameWithoutExt = filename.replace(/\.md$/, '')
+
+  // Must be lowercase letters, numbers, and hyphens only
+  return /^[a-z0-9]+(-[a-z0-9]+)*$/.test(nameWithoutExt)
+}
+
+/**
+ * Recursively find all markdown files.
+ */
+async function findMarkdownFiles(dir, files = []) {
+  try {
+    const entries = await fs.readdir(dir, { withFileTypes: true })
+
+    for (const entry of entries) {
+      const fullPath = path.join(dir, entry.name)
+
+      if (entry.isDirectory()) {
+        if (!SKIP_DIRS.has(entry.name) && !entry.name.startsWith('.')) {
+          await findMarkdownFiles(fullPath, files)
+        }
+      } else if (entry.isFile()) {
+        // Check for .md files or LICENSE (no extension)
+        if (entry.name.endsWith('.md') || entry.name === 'LICENSE') {
+          files.push(fullPath)
+        }
+      }
+    }
+  } catch {
+    // Skip directories we can't read
+  }
+
+  return files
+}
+
+/**
+ * Check if file is in an allowed location for SCREAMING_CASE files.
+ * SCREAMING_CASE files can only be at: root, docs/, or .claude/ (top level only).
+ */
+function isInAllowedLocationForScreamingCase(filePath) {
+  const relativePath = path.relative(rootPath, filePath)
+  const dir = path.dirname(relativePath)
+
+  // Allow at root level
+  if (dir === '.') {
+    return true
+  }
+
+  // Allow in docs/ folder (but not subdirectories)
+  if (dir === 'docs') {
+    return true
+  }
+
+  // Allow in .claude/ folder (but not subdirectories)
+  if (dir === '.claude') {
+    return true
+  }
+
+  return false
+}
+
+/**
+ * Check if file is in an allowed location for regular markdown files.
+ * Regular .md files must be within docs/ or .claude/ directories.
+ */
+function isInAllowedLocationForRegularMd(filePath) {
+  const relativePath = path.relative(rootPath, filePath)
+  const dir = path.dirname(relativePath)
+
+  // Must be within docs/ (any depth)
+  if (dir === 'docs' || dir.startsWith('docs/')) {
+    return true
+  }
+
+  // Must be within .claude/ (any depth)
+  if (dir === '.claude' || dir.startsWith('.claude/')) {
+    return true
+  }
+
+  return false
+}
+
+/**
+ * Validate a markdown filename.
+ */
+function validateFilename(filePath) {
+  const filename = path.basename(filePath)
+  const nameWithoutExt = filename.replace(/\.(md|MD)$/, '')
+  const relativePath = path.relative(rootPath, filePath)
+
+  // README.md and LICENSE are special - allowed anywhere
+  // Valid - allowed in any location
+  if (nameWithoutExt === 'README' || nameWithoutExt === 'LICENSE') {
+    return null
+  }
+
+  // Check if it's an allowed SCREAMING_CASE file
+  if (ALLOWED_SCREAMING_CASE.has(nameWithoutExt)) {
+    // Must be in an allowed location (root, docs/, or .claude/)
+    if (!isInAllowedLocationForScreamingCase(filePath)) {
+      return {
+        file: relativePath,
+        filename,
+        issue: 'SCREAMING_CASE files only allowed at root, docs/, or .claude/',
+        suggestion: `Move to root, docs/, or .claude/, or rename to ${filename.toLowerCase().replace(/_/g, '-')}`,
+      }
+    }
+    // Valid
+    return null
+  }
+
+  // Check if it's in SCREAMING_CASE but not allowed
+  if (isScreamingCase(filename)) {
+    return {
+      file: relativePath,
+      filename,
+      issue: 'SCREAMING_CASE not allowed',
+      suggestion: filename.toLowerCase().replace(/_/g, '-'),
+    }
+  }
+
+  // Check if it has .MD extension (should be .md)
+  if (filename.endsWith('.MD')) {
+    return {
+      file: path.relative(rootPath, filePath),
+      filename,
+      issue: 'Extension should be lowercase .md',
+      suggestion: filename.replace(/\.MD$/, '.md'),
+    }
+  }
+
+  // Check if it's properly lowercase-hyphenated
+  if (!isLowercaseHyphenated(filename)) {
+    // Try to suggest a corrected version
+    const nameOnly = filename.replace(/\.md$/, '')
+    const suggested = nameOnly
+      .toLowerCase()
+      .replace(/[_\s]+/g, '-')
+      .replace(/[^a-z0-9-]/g, '')
+
+    return {
+      file: relativePath,
+      filename,
+      issue: 'Must be lowercase-with-hyphens',
+      suggestion: `${suggested}.md`,
+    }
+  }
+
+  // Regular markdown files must be in docs/ or .claude/
+  if (!isInAllowedLocationForRegularMd(filePath)) {
+    return {
+      file: relativePath,
+      filename,
+      issue: 'Markdown files must be in docs/ or .claude/ directories',
+      suggestion: `Move to docs/${filename} or .claude/${filename}`,
+    }
+  }
+
+  // Valid
+  return null
+}
+
+/**
+ * Validate all markdown filenames.
+ */
+async function validateMarkdownFilenames() {
+  const files = await findMarkdownFiles(rootPath)
+  const violations = []
+
+  for (const file of files) {
+    const violation = validateFilename(file)
+    if (violation) {
+      violations.push(violation)
+    }
+  }
+
+  return violations
+}
+
+async function main() {
+  try {
+    const violations = await validateMarkdownFilenames()
+
+    if (violations.length === 0) {
+      logger.success('All markdown filenames follow conventions')
+      process.exitCode = 0
+      return
+    }
+
+    logger.error('Markdown filename violations found')
+    logger.log('')
+    logger.log('Special files (allowed anywhere):')
+    logger.log('  README.md, LICENSE')
+    logger.log('')
+    logger.log('Allowed SCREAMING_CASE files (root, docs/, or .claude/ only):')
+    logger.log('  AUTHORS.md, CHANGELOG.md, CITATION.md, CLAUDE.md,')
+    logger.log('  CODE_OF_CONDUCT.md, CONTRIBUTORS.md, CONTRIBUTING.md,')
+    logger.log('  COPYING, CREDITS.md, GOVERNANCE.md, MAINTAINERS.md,')
+    logger.log('  NOTICE.md, SECURITY.md, SUPPORT.md, TRADEMARK.md')
+    logger.log('')
+    logger.log('All other .md files must:')
+    logger.log('  - Be lowercase-with-hyphens')
+    logger.log('  - Be in docs/ or .claude/ directories (any depth)')
+    logger.log('')
+
+    for (const violation of violations) {
+      logger.log(`  ${violation.file}`)
+      logger.log(`    Issue: ${violation.issue}`)
+      logger.log(`    Current: ${violation.filename}`)
+      logger.log(`    Suggested: ${violation.suggestion}`)
+      logger.log('')
+    }
+
+    logger.log('Rename files to follow conventions.')
+    logger.log('')
+
+    process.exitCode = 1
+  } catch (error) {
+    logger.error(`Validation failed: ${error.message}`)
+    process.exitCode = 1
+  }
+}
+
+main().catch(error => {
+  logger.error(`Validation failed: ${error}`)
+  process.exitCode = 1
+})
diff --git a/scripts/validate/no-cdn-refs.mjs b/scripts/validate/no-cdn-refs.mjs
new file mode 100644
index 0000000..49fdc9f
--- /dev/null
+++ b/scripts/validate/no-cdn-refs.mjs
@@ -0,0 +1,216 @@
+/**
+ * @fileoverview Validates that there are no CDN references in the codebase.
+ *
+ * This is a preventative check to ensure no hardcoded CDN URLs are introduced.
+ * The project deliberately avoids CDN dependencies for security and reliability.
+ *
+ * Blocked CDN domains:
+ * - unpkg.com
+ * - cdn.jsdelivr.net
+ * - esm.sh
+ * - cdn.skypack.dev
+ * - ga.jspm.io
+ */
+
+import { promises as fs } from 'node:fs'
+import path from 'node:path'
+import { fileURLToPath } from 'node:url'
+import { getDefaultLogger } from '#socketsecurity/lib/logger'
+
+const logger = getDefaultLogger()
+
+const __dirname = path.dirname(fileURLToPath(import.meta.url))
+const rootPath = path.join(__dirname, '..', '..')
+
+// CDN domains to block
+const CDN_PATTERNS = [
+  /unpkg\.com/i,
+  /cdn\.jsdelivr\.net/i,
+  /esm\.sh/i,
+  /cdn\.skypack\.dev/i,
+  /ga\.jspm\.io/i,
+]
+
+// Directories to skip
+const SKIP_DIRS = new Set([
+  'node_modules',
+  '.git',
+  'dist',
+  'build',
+  '.cache',
+  'coverage',
+  '.next',
+  '.nuxt',
+  '.output',
+  '.turbo',
+  '.type-coverage',
+  '.yarn',
+])
+
+// File extensions to check
+const TEXT_EXTENSIONS = new Set([
+  '.js',
+  '.mjs',
+  '.cjs',
+  '.ts',
+  '.mts',
+  '.cts',
+  '.jsx',
+  '.tsx',
+  '.json',
+  '.md',
+  '.html',
+  '.htm',
+  '.css',
+  '.yml',
+  '.yaml',
+  '.xml',
+  '.svg',
+  '.txt',
+  '.sh',
+  '.bash',
+])
+
+/**
+ * Check if file should be scanned.
+ */
+function shouldScanFile(filename) {
+  const ext = path.extname(filename).toLowerCase()
+  return TEXT_EXTENSIONS.has(ext)
+}
+
+/**
+ * Recursively find all text files to scan.
+ */
+async function findTextFiles(dir, files = []) {
+  try {
+    const entries = await fs.readdir(dir, { withFileTypes: true })
+
+    for (const entry of entries) {
+      const fullPath = path.join(dir, entry.name)
+
+      if (entry.isDirectory()) {
+        // Skip certain directories and hidden directories (except .github)
+        if (
+          !SKIP_DIRS.has(entry.name) &&
+          (!entry.name.startsWith('.') || entry.name === '.github')
+        ) {
+          await findTextFiles(fullPath, files)
+        }
+      } else if (entry.isFile() && shouldScanFile(entry.name)) {
+        files.push(fullPath)
+      }
+    }
+  } catch {
+    // Skip directories we can't read
+  }
+
+  return files
+}
+
+/**
+ * Check file contents for CDN references.
+ */
+async function checkFileForCdnRefs(filePath) {
+  // Skip this validator script itself (it mentions CDN domains by necessity)
+  if (
+    filePath.endsWith('no-cdn-refs.mjs') ||
+    filePath.endsWith('validate-no-cdn-refs.mjs')
+  ) {
+    return []
+  }
+
+  try {
+    const content = await fs.readFile(filePath, 'utf8')
+    const lines = content.split('\n')
+    const violations = []
+
+    for (let i = 0; i < lines.length; i++) {
+      const line = lines[i]
+      const lineNumber = i + 1
+
+      for (const pattern of CDN_PATTERNS) {
+        if (pattern.test(line)) {
+          const match = line.match(pattern)
+          violations.push({
+            file: path.relative(rootPath, filePath),
+            line: lineNumber,
+            content: line.trim(),
+            cdnDomain: match[0],
+          })
+        }
+      }
+    }
+
+    return violations
+  } catch (error) {
+    // Skip files we can't read (likely binary despite extension)
+    if (error.code === 'EISDIR' || error.message.includes('ENOENT')) {
+      return []
+    }
+    // For other errors, try to continue
+    return []
+  }
+}
+
+/**
+ * Validate all files for CDN references.
+ */
+async function validateNoCdnRefs() {
+  const files = await findTextFiles(rootPath)
+  const allViolations = []
+
+  for (const file of files) {
+    const violations = await checkFileForCdnRefs(file)
+    allViolations.push(...violations)
+  }
+
+  return allViolations
+}
+
+async function main() {
+  try {
+    const violations = await validateNoCdnRefs()
+
+    if (violations.length === 0) {
+      logger.success('No CDN references found')
+      process.exitCode = 0
+      return
+    }
+
+    logger.fail(`Found ${violations.length} CDN reference(s)`)
+    logger.log('')
+    logger.log('CDN URLs are not allowed in this codebase for security and')
+    logger.log('reliability reasons. Please use npm packages instead.')
+    logger.log('')
+    logger.log('Blocked CDN domains:')
+    logger.log('  - unpkg.com')
+    logger.log('  - cdn.jsdelivr.net')
+    logger.log('  - esm.sh')
+    logger.log('  - cdn.skypack.dev')
+    logger.log('  - ga.jspm.io')
+    logger.log('')
+    logger.log('Violations:')
+    logger.log('')
+
+    for (const violation of violations) {
+      logger.log(`  ${violation.file}:${violation.line}`)
+      logger.log(`    Domain: ${violation.cdnDomain}`)
+      logger.log(`    Content: ${violation.content}`)
+      logger.log('')
+    }
+
+    logger.log('Remove CDN references and use npm dependencies instead.')
+    logger.log('')
+
+    process.exitCode = 1
+  } catch (error) {
+    logger.fail(`Validation failed: ${error.message}`)
+    process.exitCode = 1
+  }
+}
+
+main().catch(error => {
+  logger.fail(`Unexpected error: ${error.message}`)
+  process.exitCode = 1
+})
diff --git a/scripts/validate/no-extraneous-dependencies.mjs b/scripts/validate/no-extraneous-dependencies.mjs
new file mode 100644
index 0000000..5cfa6cf
--- /dev/null
+++ b/scripts/validate/no-extraneous-dependencies.mjs
@@ -0,0 +1,325 @@
+/**
+ * @fileoverview Validates that all require() calls in dist/ resolve to valid dependencies or files.
+ *
+ * Uses @babel/parser to accurately detect require() specifiers and validates:
+ * - Bare specifiers (package names) must be Node.js built-ins or in dependencies/peerDependencies
+ * - Relative specifiers (./file or ../file) must point to existing files
+ *
+ * Rules:
+ * - External packages (require() calls in dist/) must be in dependencies or peerDependencies
+ * - Bundled packages should NOT appear as require() calls (code is bundled/inlined)
+ * - devDependencies should NOT be required from dist/ (not installed by consumers)
+ * - Relative imports must resolve to existing files in dist/
+ *
+ * This ensures consumers can run the published package.
+ */
+
+import { existsSync, promises as fs } from 'node:fs'
+import { builtinModules } from 'node:module'
+import path from 'node:path'
+import { fileURLToPath } from 'node:url'
+
+import { parse } from '@babel/parser'
+import traverseModule from '@babel/traverse'
+import * as t from '@babel/types'
+
+const traverse = traverseModule.default
+
+const __dirname = path.dirname(fileURLToPath(import.meta.url))
+const rootPath = path.join(__dirname, '..', '..')
+
+// Node.js builtins to recognize (including node: prefix variants)
+const BUILTIN_MODULES = new Set([
+  ...builtinModules,
+  ...builtinModules.map(m => `node:${m}`),
+])
+
+/**
+ * Parse JavaScript code into AST
+ */
+function parseCode(code, filePath) {
+  try {
+    return parse(code, {
+      allowImportExportEverywhere: true,
+      allowReturnOutsideFunction: true,
+      sourceType: 'unambiguous',
+    })
+  } catch (error) {
+    throw new Error(`Failed to parse ${filePath}: ${error.message}`)
+  }
+}
+
+/**
+ * Extract all require() specifiers from a file using Babel AST
+ */
+async function extractRequireSpecifiers(filePath) {
+  const content = await fs.readFile(filePath, 'utf8')
+  const ast = parseCode(content, filePath)
+  const specifiers = []
+
+  traverse(ast, {
+    CallExpression(astPath) {
+      const { node } = astPath
+
+      // Check if this is a require() call
+      if (
+        t.isIdentifier(node.callee, { name: 'require' }) &&
+        node.arguments.length > 0 &&
+        t.isStringLiteral(node.arguments[0])
+      ) {
+        const specifier = node.arguments[0].value
+        const { column, line } = node.loc.start
+        specifiers.push({
+          specifier,
+          line,
+          column,
+        })
+      }
+    },
+  })
+
+  return specifiers
+}
+
+/**
+ * Check if a specifier is a bare specifier (package name, not relative path)
+ */
+function isBareSpecifier(specifier) {
+  return !specifier.startsWith('.') && !specifier.startsWith('/')
+}
+
+/**
+ * Get package name from a bare specifier (strip subpaths)
+ */
+function getPackageName(specifier) {
+  // Scoped package: @scope/package or @scope/package/subpath
+  if (specifier.startsWith('@')) {
+    const parts = specifier.split('/')
+    if (parts.length >= 2) {
+      return `${parts[0]}/${parts[1]}`
+    }
+    return specifier
+  }
+
+  // Regular package: package or package/subpath
+  const parts = specifier.split('/')
+  return parts[0]
+}
+
+/**
+ * Check if a relative require path resolves to an existing file
+ */
+function checkFileExists(specifier, fromFile) {
+  const fromDir = path.dirname(fromFile)
+  const extensions = ['', '.js', '.mjs', '.cjs', '.json', '.node']
+
+  // Try with different extensions
+  for (const ext of extensions) {
+    const fullPath = path.resolve(fromDir, specifier + ext)
+    if (existsSync(fullPath)) {
+      return { exists: true, resolvedPath: fullPath }
+    }
+  }
+
+  // Try as directory with index file
+  const dirPath = path.resolve(fromDir, specifier)
+  for (const indexFile of [
+    'index.js',
+    'index.mjs',
+    'index.cjs',
+    'index.json',
+  ]) {
+    const indexPath = path.join(dirPath, indexFile)
+    if (existsSync(indexPath)) {
+      return { exists: true, resolvedPath: indexPath }
+    }
+  }
+
+  return { exists: false, resolvedPath: null }
+}
+
+/**
+ * Find all JavaScript files in dist directory recursively
+ */
+async function findDistFiles(distPath) {
+  const files = []
+
+  try {
+    const entries = await fs.readdir(distPath, { withFileTypes: true })
+
+    for (const entry of entries) {
+      const fullPath = path.join(distPath, entry.name)
+
+      if (entry.isDirectory()) {
+        // Check ALL directories including dist/external/
+        files.push(...(await findDistFiles(fullPath)))
+      } else if (
+        entry.name.endsWith('.js') ||
+        entry.name.endsWith('.mjs') ||
+        entry.name.endsWith('.cjs')
+      ) {
+        files.push(fullPath)
+      }
+    }
+  } catch {
+    // Directory doesn't exist or can't be read
+    return []
+  }
+
+  return files
+}
+
+/**
+ * Read and parse package.json
+ */
+async function readPackageJson() {
+  const packageJsonPath = path.join(rootPath, 'package.json')
+  const content = await fs.readFile(packageJsonPath, 'utf8')
+  return JSON.parse(content)
+}
+
+/**
+ * Validate require() calls in dist/ files
+ */
+async function validateNoExtraneousDependencies() {
+  const pkg = await readPackageJson()
+
+  const dependencies = new Set(Object.keys(pkg.dependencies || {}))
+  const devDependencies = new Set(Object.keys(pkg.devDependencies || {}))
+  const peerDependencies = new Set(Object.keys(pkg.peerDependencies || {}))
+
+  // Find all JS files in dist/
+  const distPath = path.join(rootPath, 'dist')
+  const allFiles = await findDistFiles(distPath)
+
+  if (allFiles.length === 0) {
+    console.log('ℹ No dist files found - run build first')
+    return { errors: [] }
+  }
+
+  const errors = []
+
+  for (const file of allFiles) {
+    try {
+      const specifiers = await extractRequireSpecifiers(file)
+      const relativePath = path.relative(rootPath, file)
+
+      for (const { column, line, specifier } of specifiers) {
+        // Skip subpath imports (# prefixed imports)
+        if (specifier.startsWith('#')) {
+          continue
+        }
+
+        // Skip internal src/external/ wrapper paths (used by socket-lib pattern)
+        if (specifier.includes('/external/')) {
+          continue
+        }
+
+        if (isBareSpecifier(specifier)) {
+          // Check if it's a Node.js built-in
+          const packageName = getPackageName(specifier)
+
+          if (
+            specifier.startsWith('node:') ||
+            BUILTIN_MODULES.has(specifier) ||
+            BUILTIN_MODULES.has(packageName)
+          ) {
+            // Built-in module, all good
+            continue
+          }
+
+          // Check if package is in dependencies or peerDependencies
+          // NOTE: devDependencies are NOT acceptable in dist/ - they don't get installed by consumers
+          if (
+            !dependencies.has(packageName) &&
+            !peerDependencies.has(packageName)
+          ) {
+            const inDevDeps = devDependencies.has(packageName)
+            errors.push({
+              file: relativePath,
+              line,
+              column,
+              specifier,
+              packageName,
+              type: 'missing-dependency',
+              message: inDevDeps
+                ? `Package "${packageName}" is in devDependencies but required in dist/ (should be in dependencies or bundled)`
+                : `Package "${packageName}" is not declared in dependencies or peerDependencies`,
+            })
+          }
+        } else {
+          // Relative or absolute path - check if file exists
+          const { exists } = checkFileExists(specifier, file)
+
+          if (!exists) {
+            errors.push({
+              file: relativePath,
+              line,
+              column,
+              specifier,
+              type: 'missing-file',
+              message: `File "${specifier}" does not exist`,
+            })
+          }
+        }
+      }
+    } catch (error) {
+      errors.push({
+        file: path.relative(rootPath, file),
+        type: 'parse-error',
+        message: error.message,
+      })
+    }
+  }
+
+  return { errors }
+}
+
+async function main() {
+  try {
+    const { errors } = await validateNoExtraneousDependencies()
+
+    if (errors.length === 0) {
+      console.log('✓ No extraneous dependencies found')
+      process.exitCode = 0
+      return
+    }
+
+    console.error('✗ Found extraneous or missing dependencies:\n')
+
+    for (const error of errors) {
+      if (error.type === 'missing-dependency') {
+        console.error(
+          `  ${error.file}:${error.line}:${error.column} - ${error.message}`,
+        )
+        console.error(`    require('${error.specifier}')`)
+        if (
+          error.message.includes('is in devDependencies but required in dist/')
+        ) {
+          console.error(
+            `    Fix: Move "${error.packageName}" to dependencies OR bundle it (add to esbuild external exclusion)\n`,
+          )
+        } else {
+          console.error(
+            `    Fix: Add "${error.packageName}" to dependencies or peerDependencies\n`,
+          )
+        }
+      } else if (error.type === 'missing-file') {
+        console.error(
+          `  ${error.file}:${error.line}:${error.column} - ${error.message}`,
+        )
+        console.error(`    require('${error.specifier}')`)
+        console.error('    Fix: Create the missing file or fix the path\n')
+      } else if (error.type === 'parse-error') {
+        console.error(`  ${error.file} - ${error.message}\n`)
+      }
+    }
+
+    process.exitCode = 1
+  } catch (error) {
+    console.error('Validation failed:', error.message)
+    process.exitCode = 1
+  }
+}
+
+main()
diff --git a/scripts/validate/no-link-deps.mjs b/scripts/validate/no-link-deps.mjs
new file mode 100755
index 0000000..d2e9a5f
--- /dev/null
+++ b/scripts/validate/no-link-deps.mjs
@@ -0,0 +1,151 @@
+/**
+ * @fileoverview Validates that no package.json files contain link: dependencies.
+ * Link dependencies are prohibited - use workspace: or catalog: instead.
+ */
+
+import { promises as fs } from 'node:fs'
+import path from 'node:path'
+import { fileURLToPath } from 'node:url'
+
+const __dirname = path.dirname(fileURLToPath(import.meta.url))
+const rootPath = path.join(__dirname, '..', '..')
+
+/**
+ * Find all package.json files in the repository.
+ */
+async function findPackageJsonFiles(dir) {
+  const files = []
+  const entries = await fs.readdir(dir, { withFileTypes: true })
+
+  for (const entry of entries) {
+    const fullPath = path.join(dir, entry.name)
+
+    // Skip node_modules, .git, and build directories.
+    if (
+      entry.name === 'node_modules' ||
+      entry.name === '.git' ||
+      entry.name === 'build' ||
+      entry.name === 'dist'
+    ) {
+      continue
+    }
+
+    if (entry.isDirectory()) {
+      files.push(...(await findPackageJsonFiles(fullPath)))
+    } else if (entry.name === 'package.json') {
+      files.push(fullPath)
+    }
+  }
+
+  return files
+}
+
+/**
+ * Check if a package.json contains link: dependencies.
+ */
+async function checkPackageJson(filePath) {
+  const content = await fs.readFile(filePath, 'utf8')
+  const pkg = JSON.parse(content)
+
+  const violations = []
+
+  // Check dependencies.
+  if (pkg.dependencies) {
+    for (const [name, version] of Object.entries(pkg.dependencies)) {
+      if (typeof version === 'string' && version.startsWith('link:')) {
+        violations.push({
+          file: filePath,
+          field: 'dependencies',
+          package: name,
+          value: version,
+        })
+      }
+    }
+  }
+
+  // Check devDependencies.
+  if (pkg.devDependencies) {
+    for (const [name, version] of Object.entries(pkg.devDependencies)) {
+      if (typeof version === 'string' && version.startsWith('link:')) {
+        violations.push({
+          file: filePath,
+          field: 'devDependencies',
+          package: name,
+          value: version,
+        })
+      }
+    }
+  }
+
+  // Check peerDependencies.
+  if (pkg.peerDependencies) {
+    for (const [name, version] of Object.entries(pkg.peerDependencies)) {
+      if (typeof version === 'string' && version.startsWith('link:')) {
+        violations.push({
+          file: filePath,
+          field: 'peerDependencies',
+          package: name,
+          value: version,
+        })
+      }
+    }
+  }
+
+  // Check optionalDependencies.
+  if (pkg.optionalDependencies) {
+    for (const [name, version] of Object.entries(pkg.optionalDependencies)) {
+      if (typeof version === 'string' && version.startsWith('link:')) {
+        violations.push({
+          file: filePath,
+          field: 'optionalDependencies',
+          package: name,
+          value: version,
+        })
+      }
+    }
+  }
+
+  return violations
+}
+
+async function main() {
+  const packageJsonFiles = await findPackageJsonFiles(rootPath)
+  const allViolations = []
+
+  for (const file of packageJsonFiles) {
+    const violations = await checkPackageJson(file)
+    allViolations.push(...violations)
+  }
+
+  if (allViolations.length > 0) {
+    console.error('❌ Found link: dependencies (prohibited)')
+    console.error('')
+    console.error(
+      'Use workspace: protocol for monorepo packages or catalog: for centralized versions.',
+    )
+    console.error('')
+
+    for (const violation of allViolations) {
+      const relativePath = path.relative(rootPath, violation.file)
+      console.error(`  ${relativePath}`)
+      console.error(
+        `    ${violation.field}.${violation.package}: "${violation.value}"`,
+      )
+    }
+
+    console.error('')
+    console.error('Replace link: with:')
+    console.error('  - workspace: for monorepo packages')
+    console.error('  - catalog: for centralized version management')
+    console.error('')
+
+    process.exitCode = 1
+  } else {
+    console.log('✓ No link: dependencies found')
+  }
+}
+
+main().catch(error => {
+  console.error('Validation failed:', error)
+  process.exitCode = 1
+})
diff --git a/src/abort.ts b/src/abort.ts
index b7a08d2..63e7ad1 100644
--- a/src/abort.ts
+++ b/src/abort.ts
@@ -15,7 +15,6 @@ export function createCompositeAbortSignal(
   }
 
   if (validSignals.length === 1) {
-    // biome-ignore lint/style/noNonNullAssertion: Length check ensures array has exactly one element.
     return validSignals[0]!
   }
 
diff --git a/src/agent.ts b/src/agent.ts
index 25968d9..b82919c 100644
--- a/src/agent.ts
+++ b/src/agent.ts
@@ -23,8 +23,9 @@
  * file resolution, because Node.js properly escapes each array element.
  */
 
-import { CI } from '#env/ci'
+import { getCI } from '#env/ci'
 
+import { WIN32 } from '#constants/platform'
 import { execBin } from './bin'
 import { isDebug } from './debug'
 import { findUpSync } from './fs'
@@ -108,7 +109,7 @@ export function execNpm(args: string[], options?: SpawnOptions | undefined) {
   //
   // We also use the npm binary wrapper instead of calling cli.js directly because
   // cli.js exports a function that needs to be invoked with process as an argument.
-  const npmBin = /*@__PURE__*/ require('../constants/agents').NPM_BIN_PATH
+  const npmBin = /*@__PURE__*/ require('#constants/agents').NPM_BIN_PATH
   return spawn(
     npmBin,
     [
@@ -128,6 +129,8 @@ export function execNpm(args: string[], options?: SpawnOptions | undefined) {
     ],
     {
       __proto__: null,
+      // On Windows, npm is a .cmd file that requires shell to execute.
+      shell: WIN32,
       ...options,
     } as SpawnOptions,
   )
@@ -176,7 +179,7 @@ export function execPnpm(args: string[], options?: PnpmOptions | undefined) {
   // we need to explicitly add --no-frozen-lockfile in CI mode if not already present.
   const frozenLockfileArgs = []
   if (
-    CI &&
+    getCI() &&
     allowLockfileUpdate &&
     firstArg &&
     isPnpmInstallCommand(firstArg) &&
@@ -371,7 +374,7 @@ export function execScript(
   }
 
   const useNodeRun =
-    !prepost && /*@__PURE__*/ require('../constants/node').SUPPORTS_NODE_RUN
+    !prepost && /*@__PURE__*/ require('#constants/node').supportsNodeRun()
 
   // Detect package manager based on lockfile by traversing up from current directory.
   const cwd =
@@ -379,7 +382,7 @@ export function execScript(
 
   // Check for pnpm-lock.yaml.
   const pnpmLockPath = findUpSync(
-    /*@__INLINE__*/ require('../constants/agents').PNPM_LOCK_YAML,
+    /*@__INLINE__*/ require('#constants/agents').PNPM_LOCK_YAML,
     { cwd },
   ) as string | undefined
   if (pnpmLockPath) {
@@ -389,7 +392,7 @@ export function execScript(
   // Check for package-lock.json.
   // When in an npm workspace, use npm run to ensure workspace binaries are available.
   const packageLockPath = findUpSync(
-    /*@__INLINE__*/ require('../constants/agents').PACKAGE_LOCK_JSON,
+    /*@__INLINE__*/ require('#constants/agents').PACKAGE_LOCK_JSON,
     { cwd },
   ) as string | undefined
   if (packageLockPath) {
@@ -398,7 +401,7 @@ export function execScript(
 
   // Check for yarn.lock.
   const yarnLockPath = findUpSync(
-    /*@__INLINE__*/ require('../constants/agents').YARN_LOCK,
+    /*@__INLINE__*/ require('#constants/agents').YARN_LOCK,
     { cwd },
   ) as string | undefined
   if (yarnLockPath) {
@@ -406,13 +409,13 @@ export function execScript(
   }
 
   return spawn(
-    /*@__PURE__*/ require('../constants/node').getExecPath(),
+    /*@__PURE__*/ require('#constants/node').getExecPath(),
     [
-      .../*@__PURE__*/ require('../constants/node').getNodeNoWarningsFlags(),
+      .../*@__PURE__*/ require('#constants/node').getNodeNoWarningsFlags(),
       ...(useNodeRun
         ? ['--run']
         : [
-            /*@__PURE__*/ require('../constants/agents').NPM_REAL_EXEC_PATH,
+            /*@__PURE__*/ require('#constants/agents').NPM_REAL_EXEC_PATH,
             'run',
           ]),
       scriptName,
diff --git a/src/argv/parse.ts b/src/argv/parse.ts
index 5835c09..23e484f 100644
--- a/src/argv/parse.ts
+++ b/src/argv/parse.ts
@@ -245,7 +245,6 @@ export function getPositionalArgs(startIndex = 2): string[] {
   let i = 0
 
   while (i < args.length) {
-    // biome-ignore lint/style/noNonNullAssertion: Loop condition ensures index is within bounds.
     const arg = args[i]!
     // Stop at first flag
     if (arg.startsWith('-')) {
diff --git a/src/arrays.ts b/src/arrays.ts
index 84c12ad..809c7fa 100644
--- a/src/arrays.ts
+++ b/src/arrays.ts
@@ -6,6 +6,19 @@
 let _conjunctionFormatter: Intl.ListFormat | undefined
 /**
  * Get a cached Intl.ListFormat instance for conjunction (and) formatting.
+ *
+ * Creates a singleton formatter for English "and" lists using the long style.
+ * The formatter is lazily initialized on first use and reused for performance.
+ *
+ * @returns Cached Intl.ListFormat instance configured for conjunction formatting
+ *
+ * @example
+ * ```ts
+ * const formatter = getConjunctionFormatter()
+ * formatter.format(['apple', 'banana', 'cherry'])
+ * // Returns: "apple, banana, and cherry"
+ * ```
+ *
  * @private
  */
 /*@__NO_SIDE_EFFECTS__*/
@@ -23,6 +36,19 @@ function getConjunctionFormatter() {
 let _disjunctionFormatter: Intl.ListFormat | undefined
 /**
  * Get a cached Intl.ListFormat instance for disjunction (or) formatting.
+ *
+ * Creates a singleton formatter for English "or" lists using the long style.
+ * The formatter is lazily initialized on first use and reused for performance.
+ *
+ * @returns Cached Intl.ListFormat instance configured for disjunction formatting
+ *
+ * @example
+ * ```ts
+ * const formatter = getDisjunctionFormatter()
+ * formatter.format(['red', 'blue', 'green'])
+ * // Returns: "red, blue, or green"
+ * ```
+ *
  * @private
  */
 /*@__NO_SIDE_EFFECTS__*/
@@ -39,6 +65,32 @@ function getDisjunctionFormatter() {
 
 /**
  * Split an array into chunks of a specified size.
+ *
+ * Divides an array into smaller arrays of the specified chunk size.
+ * The last chunk may contain fewer elements if the array length is not
+ * evenly divisible by the chunk size.
+ *
+ * @param arr - The array to split into chunks (can be readonly)
+ * @param size - Size of each chunk. Must be greater than 0.
+ * @default 2
+ * @returns Array of chunks, where each chunk is an array of elements
+ * @throws {Error} If chunk size is less than or equal to 0
+ *
+ * @example
+ * ```ts
+ * // Split into pairs (default)
+ * arrayChunk([1, 2, 3, 4, 5])
+ * // Returns: [[1, 2], [3, 4], [5]]
+ *
+ * // Split into groups of 3
+ * arrayChunk(['a', 'b', 'c', 'd', 'e', 'f', 'g'], 3)
+ * // Returns: [['a', 'b', 'c'], ['d', 'e', 'f'], ['g']]
+ *
+ * // Works with readonly arrays
+ * const readonlyArr = [1, 2, 3] as const
+ * arrayChunk(readonlyArr)
+ * // Returns: [[1, 2], [3]]
+ * ```
  */
 /*@__NO_SIDE_EFFECTS__*/
 export function arrayChunk<T>(
@@ -60,6 +112,33 @@ export function arrayChunk<T>(
 
 /**
  * Get unique values from an array.
+ *
+ * Returns a new array containing only the unique values from the input array.
+ * Uses `Set` internally for efficient deduplication. Order of first occurrence
+ * is preserved.
+ *
+ * @param arr - The array to deduplicate (can be readonly)
+ * @returns New array with duplicate values removed
+ *
+ * @example
+ * ```ts
+ * // Remove duplicate numbers
+ * arrayUnique([1, 2, 2, 3, 1, 4])
+ * // Returns: [1, 2, 3, 4]
+ *
+ * // Remove duplicate strings
+ * arrayUnique(['apple', 'banana', 'apple', 'cherry'])
+ * // Returns: ['apple', 'banana', 'cherry']
+ *
+ * // Works with readonly arrays
+ * const readonlyArr = [1, 1, 2] as const
+ * arrayUnique(readonlyArr)
+ * // Returns: [1, 2]
+ *
+ * // Empty arrays return empty
+ * arrayUnique([])
+ * // Returns: []
+ * ```
  */
 /*@__NO_SIDE_EFFECTS__*/
 export function arrayUnique<T>(arr: T[] | readonly T[]): T[] {
@@ -74,11 +153,70 @@ export function arrayUnique<T>(arr: T[] | readonly T[]): T[] {
 /**
  * Alias for native Array.isArray.
  * Determines whether the passed value is an array.
+ *
+ * This is a direct reference to the native `Array.isArray` method,
+ * providing a type guard that narrows the type to an array type.
+ * Exported for consistency with other array utilities in this module.
+ *
+ * @param value - The value to check
+ * @returns `true` if the value is an array, `false` otherwise
+ *
+ * @example
+ * ```ts
+ * // Check if value is an array
+ * isArray([1, 2, 3])
+ * // Returns: true
+ *
+ * isArray('not an array')
+ * // Returns: false
+ *
+ * isArray(null)
+ * // Returns: false
+ *
+ * // Type guard usage
+ * function processValue(value: unknown) {
+ *   if (isArray(value)) {
+ *     // TypeScript knows value is an array here
+ *     console.log(value.length)
+ *   }
+ * }
+ * ```
  */
 export const isArray = Array.isArray
 
 /**
  * Join array elements with proper "and" conjunction formatting.
+ *
+ * Formats an array of strings into a grammatically correct list using
+ * "and" as the conjunction. Uses `Intl.ListFormat` for proper English
+ * formatting with Oxford comma support.
+ *
+ * @param arr - Array of strings to join (can be readonly)
+ * @returns Formatted string with proper "and" conjunction
+ *
+ * @example
+ * ```ts
+ * // Two items
+ * joinAnd(['apples', 'oranges'])
+ * // Returns: "apples and oranges"
+ *
+ * // Three or more items (Oxford comma)
+ * joinAnd(['apples', 'oranges', 'bananas'])
+ * // Returns: "apples, oranges, and bananas"
+ *
+ * // Single item
+ * joinAnd(['apples'])
+ * // Returns: "apples"
+ *
+ * // Empty array
+ * joinAnd([])
+ * // Returns: ""
+ *
+ * // Usage in messages
+ * const items = ['React', 'Vue', 'Angular']
+ * console.log(`You can choose ${joinAnd(items)}`)
+ * // Outputs: "You can choose React, Vue, and Angular"
+ * ```
  */
 /*@__NO_SIDE_EFFECTS__*/
 export function joinAnd(arr: string[] | readonly string[]): string {
@@ -87,6 +225,37 @@ export function joinAnd(arr: string[] | readonly string[]): string {
 
 /**
  * Join array elements with proper "or" disjunction formatting.
+ *
+ * Formats an array of strings into a grammatically correct list using
+ * "or" as the disjunction. Uses `Intl.ListFormat` for proper English
+ * formatting with Oxford comma support.
+ *
+ * @param arr - Array of strings to join (can be readonly)
+ * @returns Formatted string with proper "or" disjunction
+ *
+ * @example
+ * ```ts
+ * // Two items
+ * joinOr(['yes', 'no'])
+ * // Returns: "yes or no"
+ *
+ * // Three or more items (Oxford comma)
+ * joinOr(['red', 'green', 'blue'])
+ * // Returns: "red, green, or blue"
+ *
+ * // Single item
+ * joinOr(['maybe'])
+ * // Returns: "maybe"
+ *
+ * // Empty array
+ * joinOr([])
+ * // Returns: ""
+ *
+ * // Usage in prompts
+ * const options = ['npm', 'yarn', 'pnpm']
+ * console.log(`Choose a package manager: ${joinOr(options)}`)
+ * // Outputs: "Choose a package manager: npm, yarn, or pnpm"
+ * ```
  */
 /*@__NO_SIDE_EFFECTS__*/
 export function joinOr(arr: string[] | readonly string[]): string {
diff --git a/src/bin.ts b/src/bin.ts
index c54a106..4a75e23 100644
--- a/src/bin.ts
+++ b/src/bin.ts
@@ -3,13 +3,12 @@
  * Provides cross-platform bin path lookup, command execution, and path normalization.
  */
 
-import { APPDATA } from '#env/appdata'
-import { HOME } from '#env/home'
-import { LOCALAPPDATA } from '#env/localappdata'
-import { XDG_DATA_HOME } from '#env/xdg-data-home'
+import { getHome } from '#env/home'
+import { getAppdata, getLocalappdata } from '#env/windows'
+import { getXdgDataHome } from '#env/xdg'
 
+import { WIN32 } from '#constants/platform'
 import { readJsonSync } from './fs'
-import { getOwn } from './objects'
 import { isPath, normalizePath } from './path'
 import { spawn } from './spawn'
 
@@ -24,7 +23,6 @@ function getFs() {
 
     _fs = /*@__PURE__*/ require('node:fs')
   }
-  // biome-ignore lint/style/noNonNullAssertion: Initialized above.
   return _fs!
 }
 
@@ -39,7 +37,6 @@ function getPath() {
 
     _path = /*@__PURE__*/ require('node:path')
   }
-  // biome-ignore lint/style/noNonNullAssertion: Initialized above.
   return _path!
 }
 
@@ -50,9 +47,8 @@ let _which: typeof import('which') | undefined
 /*@__NO_SIDE_EFFECTS__*/
 function getWhich() {
   if (_which === undefined) {
-    _which = /*@__PURE__*/ require('../external/which')
+    _which = /*@__PURE__*/ require('./external/which')
   }
-  // biome-ignore lint/style/noNonNullAssertion: Initialized above.
   return _which!
 }
 
@@ -71,7 +67,17 @@ export async function execBin(
     : await whichBin(binPath)
 
   if (!resolvedPath) {
-    const error = new Error(`Binary not found: ${binPath}`) as Error & {
+    const error = new Error(
+      `Binary not found: ${binPath}\n` +
+        'Possible causes:\n' +
+        `  - Binary "${binPath}" is not installed or not in PATH\n` +
+        '  - Binary name is incorrect or misspelled\n' +
+        '  - Installation directory is not in system PATH\n' +
+        'To resolve:\n' +
+        `  1. Verify "${binPath}" is installed: which ${binPath} (Unix) or where ${binPath} (Windows)\n` +
+        `  2. Install the binary if missing, ex: npm install -g ${binPath}\n` +
+        '  3. Check PATH environment variable includes the binary location',
+    ) as Error & {
       code: string
     }
     error.code = 'ENOENT'
@@ -80,30 +86,74 @@ export async function execBin(
 
   // Execute the binary directly.
   const binCommand = Array.isArray(resolvedPath)
-    ? // biome-ignore lint/style/noNonNullAssertion: which always returns non-empty array.
-      resolvedPath[0]!
+    ? resolvedPath[0]!
     : resolvedPath
-  return await spawn(binCommand, args ?? [], options)
+  // On Windows, binaries are often .cmd files that require shell to execute.
+  return await spawn(binCommand, args ?? [], {
+    shell: WIN32,
+    ...options,
+  })
 }
 
+/**
+ * Options for the which function.
+ */
+export interface WhichOptions {
+  /** If true, return all matches instead of just the first one. */
+  all?: boolean | undefined
+  /** If true, return null instead of throwing when no match is found. */
+  nothrow?: boolean | undefined
+  /** Path to search in. */
+  path?: string | undefined
+  /** Path separator character. */
+  pathExt?: string | undefined
+  /** Environment variables to use. */
+  env?: Record<string, string | undefined> | undefined
+}
+
+/**
+ * Find an executable in the system PATH asynchronously.
+ * Wrapper around the which package for lazy loading.
+ */
+/* c8 ignore start */
+export async function which(
+  binName: string,
+  options?: WhichOptions,
+): Promise<string | string[] | undefined> {
+  return await getWhich()(binName, options)
+}
+/* c8 ignore stop */
+
+/**
+ * Find an executable in the system PATH synchronously.
+ * Wrapper around the which package for lazy loading.
+ */
+/* c8 ignore start */
+export function whichSync(
+  binName: string,
+  options?: WhichOptions,
+): string | string[] | undefined {
+  return getWhich().sync(binName, options)
+}
+/* c8 ignore stop */
+
 /**
  * Find and resolve a binary in the system PATH asynchronously.
- * @template {import('which').Options} T
  * @throws {Error} If the binary is not found and nothrow is false.
  */
 export async function whichBin(
   binName: string,
-  options?: import('which').Options,
+  options?: WhichOptions,
 ): Promise<string | string[] | undefined> {
   const which = getWhich()
   // Default to nothrow: true if not specified to return undefined instead of throwing
   const opts = { nothrow: true, ...options }
   // Depending on options `which` may throw if `binName` is not found.
   // With nothrow: true, it returns null when `binName` is not found.
-  const result = await which?.(binName, opts)
+  const result = await which(binName, opts)
 
   // When 'all: true' is specified, ensure we always return an array.
-  if (options?.all) {
+  if (opts?.all) {
     const paths = Array.isArray(result)
       ? result
       : typeof result === 'string'
@@ -123,21 +173,20 @@ export async function whichBin(
 
 /**
  * Find and resolve a binary in the system PATH synchronously.
- * @template {import('which').Options} T
  * @throws {Error} If the binary is not found and nothrow is false.
  */
 export function whichBinSync(
   binName: string,
-  options?: import('which').Options,
+  options?: WhichOptions,
 ): string | string[] | undefined {
   // Default to nothrow: true if not specified to return undefined instead of throwing
   const opts = { nothrow: true, ...options }
   // Depending on options `which` may throw if `binName` is not found.
   // With nothrow: true, it returns null when `binName` is not found.
-  const result = getWhich()?.sync(binName, opts)
+  const result = whichSync(binName, opts)
 
   // When 'all: true' is specified, ensure we always return an array.
-  if (getOwn(options, 'all')) {
+  if (opts.all) {
     const paths = Array.isArray(result)
       ? result
       : typeof result === 'string'
@@ -152,7 +201,7 @@ export function whichBinSync(
     return undefined
   }
 
-  return resolveBinPathSync(result)
+  return resolveBinPathSync(result as string)
 }
 
 /**
@@ -252,17 +301,16 @@ export function findRealNpm(): string {
  * Find the real pnpm executable, bypassing any aliases and shadow bins.
  */
 export function findRealPnpm(): string {
-  const WIN32 = require('../constants/platform').WIN32
   const path = getPath()
 
   // Try common pnpm locations.
   const commonPaths = WIN32
     ? [
         // Windows common paths.
-        path?.join(APPDATA as string, 'npm', 'pnpm.cmd'),
-        path?.join(APPDATA as string, 'npm', 'pnpm'),
-        path?.join(LOCALAPPDATA as string, 'pnpm', 'pnpm.cmd'),
-        path?.join(LOCALAPPDATA as string, 'pnpm', 'pnpm'),
+        path?.join(getAppdata() as string, 'npm', 'pnpm.cmd'),
+        path?.join(getAppdata() as string, 'npm', 'pnpm'),
+        path?.join(getLocalappdata() as string, 'pnpm', 'pnpm.cmd'),
+        path?.join(getLocalappdata() as string, 'pnpm', 'pnpm'),
         'C:\\Program Files\\nodejs\\pnpm.cmd',
         'C:\\Program Files\\nodejs\\pnpm',
       ].filter(Boolean)
@@ -271,10 +319,10 @@ export function findRealPnpm(): string {
         '/usr/local/bin/pnpm',
         '/usr/bin/pnpm',
         path?.join(
-          (XDG_DATA_HOME as string) || `${HOME as string}/.local/share`,
+          (getXdgDataHome() as string) || `${getHome() as string}/.local/share`,
           'pnpm/pnpm',
         ),
-        path?.join(HOME as string, '.pnpm/pnpm'),
+        path?.join(getHome() as string, '.pnpm/pnpm'),
       ].filter(Boolean)
 
   return findRealBin('pnpm', commonPaths) ?? ''
@@ -290,8 +338,11 @@ export function findRealYarn(): string {
   const commonPaths = [
     '/usr/local/bin/yarn',
     '/usr/bin/yarn',
-    path?.join(HOME as string, '.yarn/bin/yarn'),
-    path?.join(HOME as string, '.config/yarn/global/node_modules/.bin/yarn'),
+    path?.join(getHome() as string, '.yarn/bin/yarn'),
+    path?.join(
+      getHome() as string,
+      '.config/yarn/global/node_modules/.bin/yarn',
+    ),
   ].filter(Boolean)
 
   return findRealBin('yarn', commonPaths) ?? ''
@@ -311,14 +362,12 @@ export function resolveBinPathSync(binPath: string): string {
     try {
       const resolved = whichBinSync(binPath)
       if (resolved) {
-        // biome-ignore lint/style/noParameterAssign: Reassigning for normalization.
         binPath = resolved as string
       }
     } catch {}
   }
 
   // Normalize the path once for consistent pattern matching.
-  // biome-ignore lint/style/noParameterAssign: Normalizing path for consistent handling.
   binPath = normalizePath(binPath)
 
   // Handle empty string that normalized to '.' (current directory)
@@ -339,9 +388,7 @@ export function resolveBinPathSync(binPath: string): string {
     const voltaPlatform = readJsonSync(
       path?.join(voltaUserPath, 'platform.json'),
       { throws: false },
-    ) as
-      // biome-ignore lint/suspicious/noExplicitAny: Volta platform config structure is dynamic.
-      any
+    ) as any
     const voltaNodeVersion = voltaPlatform?.node?.runtime
     const voltaNpmVersion = voltaPlatform?.node?.npm
     let voltaBinPath = ''
@@ -367,9 +414,7 @@ export function resolveBinPathSync(binPath: string): string {
       const binInfo = readJsonSync(
         path?.join(voltaUserBinPath, `${basename}.json`),
         { throws: false },
-      ) as
-        // biome-ignore lint/suspicious/noExplicitAny: Volta bin info structure is dynamic.
-        any
+      ) as any
       const binPackage = binInfo?.package
       if (binPackage) {
         voltaBinPath = path?.join(
@@ -391,7 +436,6 @@ export function resolveBinPathSync(binPath: string): string {
       return voltaBinPath
     }
   }
-  const WIN32 = require('../constants/platform').WIN32
   if (WIN32) {
     const hasKnownExt =
       extLowered === '' ||
@@ -581,7 +625,6 @@ export function resolveBinPathSync(binPath: string): string {
         relPath = /(?<="\$basedir\/).*(?=" $args\n)/.exec(source)?.[0] || ''
       }
       if (relPath) {
-        // biome-ignore lint/style/noParameterAssign: Resolving wrapper script target.
         binPath = normalizePath(path?.resolve(path?.dirname(binPath), relPath))
       }
     }
@@ -593,7 +636,7 @@ export function resolveBinPathSync(binPath: string): string {
 
     // Handle special case where pnpm path in CI has extra segments.
     // In setup-pnpm GitHub Action, the path might be malformed like:
-    // /home/runner/setup-pnpm/node_modules/.bin/pnpm/bin/pnpm.cjs
+    // /home/user/setup-pnpm/node_modules/.bin/pnpm/bin/pnpm.cjs
     // This happens when the shell script contains a relative path that
     // when resolved, creates an invalid nested structure.
     if (isPnpmOrYarn && binPath.includes('/.bin/pnpm/bin/')) {
@@ -607,7 +650,6 @@ export function resolveBinPathSync(binPath: string): string {
           const stats = fs?.statSync(baseBinPath)
           // Only use this path if it's a file (the shell script).
           if (stats.isFile()) {
-            // biome-ignore lint/style/noParameterAssign: Fixing pnpm nested bin structure.
             binPath = normalizePath(baseBinPath)
             // Recompute hasNoExt since we changed the path.
             hasNoExt = !path?.extname(binPath)
@@ -670,7 +712,6 @@ export function resolveBinPathSync(binPath: string): string {
 
       if (relPath) {
         // Resolve the relative path to handle .. segments properly.
-        // biome-ignore lint/style/noParameterAssign: Resolving shell script target.
         binPath = normalizePath(path?.resolve(path?.dirname(binPath), relPath))
       }
     }
diff --git a/src/cacache.ts b/src/cacache.ts
index 1e3690d..79c7bbe 100644
--- a/src/cacache.ts
+++ b/src/cacache.ts
@@ -11,7 +11,6 @@ export interface GetOptions {
 export interface PutOptions {
   integrity?: string | undefined
   size?: number | undefined
-  // biome-ignore lint/suspicious/noExplicitAny: User-provided arbitrary metadata.
   metadata?: any | undefined
   memoize?: boolean | undefined
 }
@@ -20,7 +19,6 @@ export interface CacheEntry {
   data: Buffer
   integrity: string
   key: string
-  // biome-ignore lint/suspicious/noExplicitAny: User-provided arbitrary metadata.
   metadata?: any | undefined
   path: string
   size: number
@@ -43,8 +41,8 @@ export interface RemoveOptions {
 /**
  * Get the cacache module for cache operations.
  */
-function getCacache() {
-  return /*@__PURE__*/ require('../external/cacache')
+export function getCacache() {
+  return /*@__PURE__*/ require('./external/cacache')
 }
 
 /**
@@ -172,7 +170,6 @@ export async function get(
       'Cache key cannot contain wildcards (*). Wildcards are only supported in clear({ prefix: "pattern*" }).',
     )
   }
-  // biome-ignore lint/suspicious/noExplicitAny: cacache types are incomplete.
   const cacache = getCacache() as any
   return await cacache.get(getSocketCacacheDir(), key, options)
 }
@@ -207,7 +204,6 @@ export async function remove(key: string): Promise<unknown> {
       'Cache key cannot contain wildcards (*). Use clear({ prefix: "pattern*" }) to remove multiple entries.',
     )
   }
-  // biome-ignore lint/suspicious/noExplicitAny: cacache types are incomplete.
   const cacache = getCacache() as any
   return await cacache.rm.entry(getSocketCacacheDir(), key)
 }
@@ -238,7 +234,6 @@ export async function withTmp<T>(
   return (await cacache.tmp.withTmp(
     getSocketCacacheDir(),
     {},
-    // biome-ignore lint/suspicious/noExplicitAny: cacache types are incomplete.
     callback as any,
   )) as T
 }
diff --git a/src/cache-with-ttl.ts b/src/cache-with-ttl.ts
index 538018d..fc59a06 100644
--- a/src/cache-with-ttl.ts
+++ b/src/cache-with-ttl.ts
@@ -176,7 +176,6 @@ export function createTtlCache(options?: TtlCacheOptions): TtlCache {
   }
 
   // In-memory cache for hot data
-  // biome-ignore lint/suspicious/noExplicitAny: Generic cache for any value type.
   const memoCache = new Map<string, TtlCacheEntry<any>>()
 
   // Ensure ttl is defined
@@ -192,10 +191,7 @@ export function createTtlCache(options?: TtlCacheOptions): TtlCache {
   /**
    * Check if entry is expired.
    */
-  function isExpired(
-    // biome-ignore lint/suspicious/noExplicitAny: Generic check for any entry type.
-    entry: TtlCacheEntry<any>,
-  ): boolean {
+  function isExpired(entry: TtlCacheEntry<any>): boolean {
     return Date.now() > entry.expiresAt
   }
 
@@ -294,7 +290,6 @@ export function createTtlCache(options?: TtlCacheOptions): TtlCache {
 
     // Check persistent cache for entries not in memory.
     const cacheDir = (await import('./paths')).getSocketCacacheDir()
-    // biome-ignore lint/suspicious/noExplicitAny: cacache types are incomplete.
     const cacacheModule = (await import('./cacache')) as any
     const stream = cacacheModule.getCacache().ls.stream(cacheDir)
 
@@ -365,15 +360,21 @@ export function createTtlCache(options?: TtlCacheOptions): TtlCache {
       expiresAt: Date.now() + ttl,
     }
 
-    // Update in-memory cache.
+    // Update in-memory cache first (synchronous and fast).
     if (opts.memoize) {
       memoCache.set(fullKey, entry)
     }
 
-    // Update persistent cache.
-    await cacache.put(fullKey, JSON.stringify(entry), {
-      metadata: { expiresAt: entry.expiresAt },
-    })
+    // Update persistent cache (don't fail if this errors).
+    // In-memory cache is already updated, so immediate reads will succeed.
+    try {
+      await cacache.put(fullKey, JSON.stringify(entry), {
+        metadata: { expiresAt: entry.expiresAt },
+      })
+    } catch {
+      // Ignore persistent cache errors - in-memory cache is the source of truth.
+      // This can happen during test setup or if the cache directory is not accessible.
+    }
   }
 
   /**
diff --git a/src/colors.ts b/src/colors.ts
new file mode 100644
index 0000000..a70fd37
--- /dev/null
+++ b/src/colors.ts
@@ -0,0 +1,87 @@
+/**
+ * @fileoverview Color utilities for RGB color conversion and manipulation.
+ * Provides type-safe color handling with named colors and RGB tuples.
+ */
+
+/**
+ * Named color values supported by the library.
+ * Maps to standard terminal colors with bright variants.
+ */
+export type ColorName =
+  | 'black'
+  | 'blue'
+  | 'blueBright'
+  | 'cyan'
+  | 'cyanBright'
+  | 'gray'
+  | 'green'
+  | 'greenBright'
+  | 'magenta'
+  | 'magentaBright'
+  | 'red'
+  | 'redBright'
+  | 'white'
+  | 'whiteBright'
+  | 'yellow'
+  | 'yellowBright'
+
+/**
+ * Special 'inherit' color value that uses the current color context.
+ * Used with effects like shimmer to dynamically inherit color.
+ */
+export type ColorInherit = 'inherit'
+
+/**
+ * RGB color tuple with values 0-255 for red, green, and blue channels.
+ * @example [140, 82, 255] // Socket purple
+ * @example [255, 0, 0]    // Red
+ */
+export type ColorRgb = readonly [number, number, number]
+
+/**
+ * Union of all supported color types: named colors or RGB tuples.
+ */
+export type ColorValue = ColorName | ColorRgb
+
+// Map color names to RGB values.
+const colorToRgb: Record<ColorName, ColorRgb> = {
+  __proto__: null,
+  black: [0, 0, 0],
+  blue: [0, 0, 255],
+  blueBright: [100, 149, 237],
+  cyan: [0, 255, 255],
+  cyanBright: [0, 255, 255],
+  gray: [128, 128, 128],
+  green: [0, 128, 0],
+  greenBright: [0, 255, 0],
+  magenta: [255, 0, 255],
+  magentaBright: [255, 105, 180],
+  red: [255, 0, 0],
+  redBright: [255, 69, 0],
+  white: [255, 255, 255],
+  whiteBright: [255, 255, 255],
+  yellow: [255, 255, 0],
+  yellowBright: [255, 255, 153],
+} as Record<ColorName, ColorRgb>
+
+/**
+ * Type guard to check if a color value is an RGB tuple.
+ * @param value - Color value to check
+ * @returns `true` if value is an RGB tuple, `false` if it's a color name
+ */
+export function isRgbTuple(value: ColorValue): value is ColorRgb {
+  return Array.isArray(value)
+}
+
+/**
+ * Convert a color value to RGB tuple format.
+ * Named colors are looked up in the `colorToRgb` map, RGB tuples are returned as-is.
+ * @param color - Color name or RGB tuple
+ * @returns RGB tuple with values 0-255
+ */
+export function toRgb(color: ColorValue): ColorRgb {
+  if (isRgbTuple(color)) {
+    return color
+  }
+  return colorToRgb[color]
+}
diff --git a/src/constants/agents.ts b/src/constants/agents.ts
index 208baf2..b9c8a51 100644
--- a/src/constants/agents.ts
+++ b/src/constants/agents.ts
@@ -14,7 +14,7 @@ export const NPX = 'npx'
 // NPM binary path - resolved at runtime using which.
 export const NPM_BIN_PATH = /*@__PURE__*/ (() => {
   try {
-    const which = /*@__PURE__*/ require('which')
+    const which = /*@__PURE__*/ require('../external/which')
     return which.sync('npm', { nothrow: true }) || 'npm'
   } catch {
     return 'npm'
@@ -28,7 +28,7 @@ export const NPM_REAL_EXEC_PATH = /*@__PURE__*/ (() => {
   try {
     const { existsSync } = /*@__PURE__*/ require('node:fs')
     const path = /*@__PURE__*/ require('node:path')
-    const which = /*@__PURE__*/ require('which')
+    const which = /*@__PURE__*/ require('../external/which')
     // Find npm binary using which.
     const npmBin = which.sync('npm', { nothrow: true })
     if (!npmBin) {
diff --git a/src/constants/core.ts b/src/constants/core.ts
index 134afa5..84d187d 100644
--- a/src/constants/core.ts
+++ b/src/constants/core.ts
@@ -18,7 +18,7 @@ export const EMPTY_FILE = '/* empty */\n'
 export const EMPTY_VALUE = '<value>'
 
 // Undefined token.
-export const UNDEFINED_TOKEN = undefined
+export const UNDEFINED_TOKEN: undefined = undefined
 
 // Miscellaneous.
 export const V = 'v'
diff --git a/src/constants/node.ts b/src/constants/node.ts
index 413fb4f..2666c9e 100644
--- a/src/constants/node.ts
+++ b/src/constants/node.ts
@@ -2,13 +2,15 @@
  * Node.js runtime: versions, features, flags, and capabilities.
  */
 
+const NODE_VERSION = process.version
+
 // Version detection.
 export function getNodeVersion(): string {
-  return process.version
+  return NODE_VERSION
 }
 
 export function getNodeMajorVersion(): number {
-  return Number.parseInt(process.version.slice(1).split('.')[0] || '0', 10)
+  return Number.parseInt(NODE_VERSION.slice(1).split('.')[0] || '0', 10)
 }
 
 // Maintained Node.js versions.
@@ -22,18 +24,8 @@ let _maintainedNodeVersions:
   | undefined
 export function getMaintainedNodeVersions() {
   if (_maintainedNodeVersions === undefined) {
-    try {
-      _maintainedNodeVersions = require('../lib/maintained-node-versions')
-    } catch {
-      _maintainedNodeVersions = Object.freeze(
-        Object.assign([], {
-          current: '',
-          last: '',
-          next: '',
-          previous: '',
-        }),
-      ) as typeof _maintainedNodeVersions
-    }
+    _maintainedNodeVersions =
+      require('#lib/maintained-node-versions').maintainedNodeVersions
   }
   return _maintainedNodeVersions
 }
@@ -64,7 +56,7 @@ export function supportsNodeRequireModule(): boolean {
   return (
     major >= 23 ||
     (major === 22 &&
-      Number.parseInt(process.version.split('.')[1] || '0', 10) >= 12)
+      Number.parseInt(NODE_VERSION.split('.')[1] || '0', 10) >= 12)
   )
 }
 
@@ -73,28 +65,52 @@ export function supportsNodeRun(): boolean {
   return (
     major >= 23 ||
     (major === 22 &&
-      Number.parseInt(process.version.split('.')[1] || '0', 10) >= 11)
+      Number.parseInt(NODE_VERSION.split('.')[1] || '0', 10) >= 11)
   )
 }
 
-export function supportsProcessSend(): boolean {
-  return typeof process.send === 'function'
+export function supportsNodeDisableSigusr1Flag(): boolean {
+  const major = getNodeMajorVersion()
+  // --disable-sigusr1 added in v22.14.0, v23.7.0.
+  // Stabilized in v22.20.0, v24.8.0.
+  if (major >= 24) {
+    const minor = Number.parseInt(NODE_VERSION.split('.')[1] || '0', 10)
+    return minor >= 8
+  }
+  if (major === 23) {
+    const minor = Number.parseInt(NODE_VERSION.split('.')[1] || '0', 10)
+    return minor >= 7
+  }
+  if (major === 22) {
+    const minor = Number.parseInt(NODE_VERSION.split('.')[1] || '0', 10)
+    return minor >= 14
+  }
+  return false
 }
 
-// Node.js flags.
-let _nodeDebugFlags: string[]
-export function getNodeDebugFlags(): string[] {
-  if (_nodeDebugFlags === undefined) {
-    _nodeDebugFlags = [
-      '--inspect',
-      '--inspect-brk',
-      '--inspect-port',
-      '--inspect-publish-uid',
-    ]
+let _nodeDisableSigusr1Flags: string[]
+export function getNodeDisableSigusr1Flags(): string[] {
+  if (_nodeDisableSigusr1Flags === undefined) {
+    // SIGUSR1 is reserved by Node.js for starting the debugger/inspector.
+    // In production CLI environments, we want to prevent debugger attachment.
+    //
+    // --disable-sigusr1: Prevents Signal I/O Thread from listening to SIGUSR1 (v22.14.0+).
+    // --no-inspect: Disables inspector on older Node versions that don't support --disable-sigusr1.
+    //
+    // Note: --disable-sigusr1 is the correct solution (prevents thread creation entirely).
+    // --no-inspect is a fallback that still creates the signal handler thread but blocks later.
+    _nodeDisableSigusr1Flags = supportsNodeDisableSigusr1Flag()
+      ? ['--disable-sigusr1']
+      : ['--no-inspect']
   }
-  return _nodeDebugFlags
+  return _nodeDisableSigusr1Flags
 }
 
+export function supportsProcessSend(): boolean {
+  return typeof process.send === 'function'
+}
+
+// Node.js flags.
 let _nodeHardenFlags: string[]
 export function getNodeHardenFlags(): string[] {
   if (_nodeHardenFlags === undefined) {
diff --git a/src/constants/packages.ts b/src/constants/packages.ts
index d2f81ab..92c6415 100644
--- a/src/constants/packages.ts
+++ b/src/constants/packages.ts
@@ -2,7 +2,7 @@
  * Package metadata, defaults, extensions, and lifecycle scripts.
  */
 
-import { npm_lifecycle_event } from '#env/npm-lifecycle-event'
+import { getNpmLifecycleEvent as getNpmLifecycleEventEnv } from '#env/npm'
 
 let _lifecycleScriptNames: string[]
 let _packageDefaultNodeRange: string | undefined
@@ -20,11 +20,8 @@ export const PACKAGE_DEFAULT_VERSION = '1.0.0'
 // Package default Node range.
 export function getPackageDefaultNodeRange(): string | undefined {
   if (_packageDefaultNodeRange === undefined) {
-    try {
-      _packageDefaultNodeRange = require('../lib/package-default-node-range')
-    } catch {
-      _packageDefaultNodeRange = '>=18'
-    }
+    _packageDefaultNodeRange =
+      require('#lib/package-default-node-range').packageDefaultNodeRange
   }
   return _packageDefaultNodeRange
 }
@@ -32,11 +29,8 @@ export function getPackageDefaultNodeRange(): string | undefined {
 // Package default Socket categories.
 export function getPackageDefaultSocketCategories() {
   if (_packageDefaultSocketCategories === undefined) {
-    try {
-      _packageDefaultSocketCategories = require('../lib/package-default-socket-categories')
-    } catch {
-      _packageDefaultSocketCategories = []
-    }
+    _packageDefaultSocketCategories =
+      require('#lib/package-default-socket-categories').packageDefaultSocketCategories
   }
   return _packageDefaultSocketCategories
 }
@@ -44,29 +38,22 @@ export function getPackageDefaultSocketCategories() {
 // Package extensions.
 export function getPackageExtensions(): Iterable<[string, unknown]> {
   if (_packageExtensions === undefined) {
-    try {
-      const exts = require('../lib/package-extensions')
-      _packageExtensions = Object.entries(exts)
-    } catch {
-      _packageExtensions = []
-    }
+    const { packageExtensions } = require('#lib/package-extensions')
+    _packageExtensions = Object.entries(packageExtensions)
   }
   return _packageExtensions
 }
 
 // NPM lifecycle event.
 export function getNpmLifecycleEvent(): string | undefined {
-  return npm_lifecycle_event
+  return getNpmLifecycleEventEnv()
 }
 
 // Lifecycle script names.
 export function getLifecycleScriptNames(): string[] {
   if (_lifecycleScriptNames === undefined) {
-    try {
-      _lifecycleScriptNames = require('../lib/lifecycle-script-names')
-    } catch {
-      _lifecycleScriptNames = []
-    }
+    const { lifecycleScriptNames } = require('#lib/lifecycle-script-names')
+    _lifecycleScriptNames = Array.from(lifecycleScriptNames)
   }
   return _lifecycleScriptNames
 }
@@ -84,7 +71,7 @@ export function getPacoteCachePath(): string {
   if (_pacoteCachePath === undefined) {
     try {
       const pacote = require('../external/pacote')
-      const { normalizePath } = require('../lib/path')
+      const { normalizePath } = require('#lib/path')
       const proto = Reflect.getPrototypeOf(
         (pacote as { RegistryFetcher: { prototype: object } }).RegistryFetcher
           .prototype,
diff --git a/src/constants/platform.ts b/src/constants/platform.ts
index b1506d5..247aecd 100644
--- a/src/constants/platform.ts
+++ b/src/constants/platform.ts
@@ -2,7 +2,7 @@
  * Platform detection and OS-specific constants.
  */
 
-import { platform } from 'node:os'
+import { platform } from 'os'
 
 // Platform detection.
 const _platform = platform()
diff --git a/src/constants/process.ts b/src/constants/process.ts
index c5f8a47..0191725 100644
--- a/src/constants/process.ts
+++ b/src/constants/process.ts
@@ -21,12 +21,8 @@ export function getAbortSignal(): AbortSignal {
 let _spinner: Spinner | null | undefined
 export function getSpinner(): Spinner | null {
   if (_spinner === undefined) {
-    try {
-      const { Spinner: SpinnerFn } = require('../lib/spinner')
-      _spinner = SpinnerFn() ?? null
-    } catch {
-      _spinner = null
-    }
+    const { Spinner: SpinnerFn } = require('#lib/spinner')
+    _spinner = SpinnerFn() ?? null
   }
   return _spinner ?? null
 }
diff --git a/src/constants/socket.ts b/src/constants/socket.ts
index 622c4a4..7cb2eba 100644
--- a/src/constants/socket.ts
+++ b/src/constants/socket.ts
@@ -9,6 +9,16 @@ export const SOCKET_PUBLIC_API_KEY =
 // Alias for backward compatibility.
 export const SOCKET_PUBLIC_API_TOKEN = SOCKET_PUBLIC_API_KEY
 
+// Socket.dev URLs.
+export const SOCKET_WEBSITE_URL = 'https://socket.dev'
+export const SOCKET_CONTACT_URL = 'https://socket.dev/contact'
+export const SOCKET_DASHBOARD_URL = 'https://socket.dev/dashboard'
+export const SOCKET_API_TOKENS_URL =
+  'https://socket.dev/dashboard/settings/api-tokens'
+export const SOCKET_PRICING_URL = 'https://socket.dev/pricing'
+export const SOCKET_STATUS_URL = 'https://status.socket.dev'
+export const SOCKET_DOCS_URL = 'https://docs.socket.dev'
+
 // Socket.dev scopes.
 export const SOCKET_REGISTRY_SCOPE = '@socketregistry'
 export const SOCKET_SECURITY_SCOPE = '@socketsecurity'
diff --git a/src/cover/code.ts b/src/cover/code.ts
index 954d113..643b7be 100644
--- a/src/cover/code.ts
+++ b/src/cover/code.ts
@@ -2,7 +2,7 @@
  * @fileoverview Code coverage utilities for parsing v8 coverage data.
  */
 
-import { promises as fs } from 'node:fs'
+import { promises as fs } from 'fs'
 
 import { readJson } from '../fs'
 import { isObjectObject } from '../objects'
diff --git a/src/debug.ts b/src/debug.ts
index 8340fd1..6f70cab 100644
--- a/src/debug.ts
+++ b/src/debug.ts
@@ -4,15 +4,17 @@
  */
 
 import { getSpinner } from '#constants/process'
-import { DEBUG } from '#env/debug'
-import { SOCKET_DEBUG } from '#env/socket-debug'
+import { getDebug } from '#env/debug'
+import { getSocketDebug } from '#env/socket'
 import isUnicodeSupported from './external/@socketregistry/is-unicode-supported'
 import debugJs from './external/debug'
 
-import { logger } from './logger'
+import { getDefaultLogger } from './logger'
 import { hasOwn } from './objects'
 import { applyLinePrefix } from './strings'
 
+const logger = getDefaultLogger()
+
 // IMPORTANT: Do not use destructuring here - use direct assignment instead.
 // tsgo has a bug that incorrectly transpiles destructured exports, resulting in
 // `exports.SomeName = void 0;` which causes runtime errors.
@@ -48,8 +50,8 @@ function getDebugJsInstance(namespace: string) {
     return inst
   }
   if (
-    !DEBUG &&
-    SOCKET_DEBUG &&
+    !getDebug() &&
+    getSocketDebug() &&
     (namespace === 'error' || namespace === 'notice')
   ) {
     debugJs.enable(namespace)
@@ -166,7 +168,7 @@ function extractOptions(namespaces: NamespacesOrOptions): DebugOptions {
 /*@__NO_SIDE_EFFECTS__*/
 function isEnabled(namespaces: string | undefined) {
   // Check if debugging is enabled at all
-  if (!SOCKET_DEBUG) {
+  if (!getSocketDebug()) {
     return false
   }
   if (typeof namespaces !== 'string' || !namespaces || namespaces === '*') {
@@ -197,7 +199,6 @@ function isEnabled(namespaces: string | undefined) {
 /**
  * Debug output for object inspection with caller info.
  */
-/*@__NO_SIDE_EFFECTS__*/
 function debugDirNs(
   namespacesOrOpts: NamespacesOrOptions,
   obj: unknown,
@@ -245,7 +246,6 @@ let pointingTriangle: string | undefined
 /**
  * Debug output with caller info.
  */
-/*@__NO_SIDE_EFFECTS__*/
 function debugNs(namespacesOrOpts: NamespacesOrOptions, ...args: unknown[]) {
   const options = extractOptions(namespacesOrOpts)
   const { namespaces } = options
@@ -281,7 +281,6 @@ function debugNs(namespacesOrOpts: NamespacesOrOptions, ...args: unknown[]) {
 /**
  * Debug logging function with caller info.
  */
-/*@__NO_SIDE_EFFECTS__*/
 function debugLogNs(namespacesOrOpts: NamespacesOrOptions, ...args: unknown[]) {
   const options = extractOptions(namespacesOrOpts)
   const { namespaces } = options
@@ -323,7 +322,6 @@ function debugLogNs(namespacesOrOpts: NamespacesOrOptions, ...args: unknown[]) {
  * Second argument is the cache key or message.
  * Optional third argument is metadata object.
  */
-/*@__NO_SIDE_EFFECTS__*/
 function debugCacheNs(
   namespacesOrOpts: NamespacesOrOptions,
   operation: string,
@@ -364,7 +362,7 @@ export function debugCache(
   key: string,
   meta?: unknown | undefined,
 ): void {
-  if (!SOCKET_DEBUG) {
+  if (!getSocketDebug()) {
     return
   }
   // Get caller info with stack offset of 3 (caller -> debugCache -> getCallerInfo).
@@ -385,13 +383,12 @@ export function debugCache(
  */
 /*@__NO_SIDE_EFFECTS__*/
 function isDebugNs(namespaces: string | undefined): boolean {
-  return !!SOCKET_DEBUG && isEnabled(namespaces)
+  return !!getSocketDebug() && isEnabled(namespaces)
 }
 
 /**
  * Debug output with caller info (wrapper for debugNs with default namespace).
  */
-/*@__NO_SIDE_EFFECTS__*/
 function debug(...args: unknown[]): void {
   debugNs('*', ...args)
 }
@@ -399,7 +396,6 @@ function debug(...args: unknown[]): void {
 /**
  * Debug output for object inspection (wrapper for debugDirNs with default namespace).
  */
-/*@__NO_SIDE_EFFECTS__*/
 function debugDir(
   obj: unknown,
   inspectOpts?: InspectOptions | undefined,
@@ -410,7 +406,6 @@ function debugDir(
 /**
  * Debug logging function (wrapper for debugLogNs with default namespace).
  */
-/*@__NO_SIDE_EFFECTS__*/
 function debugLog(...args: unknown[]): void {
   debugLogNs('*', ...args)
 }
@@ -420,7 +415,7 @@ function debugLog(...args: unknown[]): void {
  */
 /*@__NO_SIDE_EFFECTS__*/
 function isDebug(): boolean {
-  return !!SOCKET_DEBUG
+  return !!getSocketDebug()
 }
 
 /**
diff --git a/src/dlx-binary.ts b/src/dlx-binary.ts
index c98f7a2..6e036f9 100644
--- a/src/dlx-binary.ts
+++ b/src/dlx-binary.ts
@@ -1,32 +1,84 @@
 /** @fileoverview DLX binary execution utilities for Socket ecosystem. */
 
-import { createHash } from 'node:crypto'
-import { existsSync, promises as fs } from 'node:fs'
-import os from 'node:os'
-import path from 'node:path'
+import { createHash } from 'crypto'
+
+import os from 'os'
+
+import path from 'path'
 
 import { WIN32 } from '#constants/platform'
 
-import { isDir, readJson, safeDelete } from './fs'
-import { httpRequest } from './http-request'
+import { generateCacheKey } from './dlx'
+import { dlxManifest } from './dlx-manifest'
+import { httpDownload } from './http-request'
+import { isDir, readJson, safeDelete, safeMkdir } from './fs'
 import { isObjectObject } from './objects'
 import { normalizePath } from './path'
-import { getSocketHomePath } from './paths'
+import { getSocketDlxDir } from './paths'
+import { processLock } from './process-lock'
 import type { SpawnExtra, SpawnOptions } from './spawn'
 import { spawn } from './spawn'
 
+let _fs: typeof import('fs') | undefined
+/**
+ * Lazily load the fs module to avoid Webpack errors.
+ * Uses non-'node:' prefixed require to prevent Webpack bundling issues.
+ *
+ * @returns The Node.js fs module
+ * @private
+ */
+/*@__NO_SIDE_EFFECTS__*/
+function getFs() {
+  if (_fs === undefined) {
+    // Use non-'node:' prefixed require to avoid Webpack errors.
+
+    _fs = /*@__PURE__*/ require('node:fs')
+  }
+  return _fs as typeof import('fs')
+}
+
 export interface DlxBinaryOptions {
-  /** URL to download the binary from. */
+  /**
+   * URL to download the binary from.
+   */
   url: string
-  /** Optional name for the cached binary (defaults to URL hash). */
+
+  /**
+   * Optional name for the cached binary (defaults to URL hash).
+   */
   name?: string | undefined
-  /** Expected checksum (sha256) for verification. */
+
+  /**
+   * Expected checksum (sha256) for verification.
+   */
   checksum?: string | undefined
-  /** Cache TTL in milliseconds (default: 7 days). */
+
+  /**
+   * Cache TTL in milliseconds (default: 7 days).
+   */
   cacheTtl?: number | undefined
-  /** Force re-download even if cached. */
+
+  /**
+   * Force re-download even if cached.
+   * Aligns with npm/npx --force flag.
+   */
   force?: boolean | undefined
-  /** Additional spawn options. */
+
+  /**
+   * Skip confirmation prompts (auto-approve).
+   * Aligns with npx --yes/-y flag.
+   */
+  yes?: boolean | undefined
+
+  /**
+   * Suppress output (quiet mode).
+   * Aligns with npx --quiet/-q and pnpm --silent/-s flags.
+   */
+  quiet?: boolean | undefined
+
+  /**
+   * Additional spawn options.
+   */
   spawnOptions?: SpawnOptions | undefined
 }
 
@@ -40,11 +92,87 @@ export interface DlxBinaryResult {
 }
 
 /**
- * Generate a cache directory name from URL, similar to pnpm/npx.
- * Uses SHA256 hash to create content-addressed storage.
+ * Metadata structure for cached binaries (.dlx-metadata.json).
+ * Unified schema shared across TypeScript (dlxBinary) and C++ (socket_macho_decompress).
+ *
+ * Core Fields (present in all implementations):
+ * - version: Schema version (currently "1.0.0")
+ * - cache_key: First 16 chars of SHA-512 hash (matches directory name)
+ * - timestamp: Unix timestamp in milliseconds
+ * - checksum: Full hash of cached binary (SHA-512 for C++, SHA-256 for TypeScript)
+ * - checksum_algorithm: "sha512" or "sha256"
+ * - platform: "darwin" | "linux" | "win32"
+ * - arch: "x64" | "arm64"
+ * - size: Size of cached binary in bytes
+ * - source: Origin information
+ *   - type: "download" (from URL) or "decompression" (from embedded binary)
+ *   - url: Download URL (if type is "download")
+ *   - path: Source binary path (if type is "decompression")
+ *
+ * Extra Fields (implementation-specific):
+ * - For C++ decompression:
+ *   - compressed_size: Size of compressed data in bytes
+ *   - compression_algorithm: Brotli level (numeric)
+ *   - compression_ratio: original_size / compressed_size
+ *
+ * Example (TypeScript download):
+ * ```json
+ * {
+ *   "version": "1.0.0",
+ *   "cache_key": "a1b2c3d4e5f67890",
+ *   "timestamp": 1730332800000,
+ *   "checksum": "sha256-abc123...",
+ *   "checksum_algorithm": "sha256",
+ *   "platform": "darwin",
+ *   "arch": "arm64",
+ *   "size": 15000000,
+ *   "source": {
+ *     "type": "download",
+ *     "url": "https://example.com/binary"
+ *   }
+ * }
+ * ```
+ *
+ * Example (C++ decompression):
+ * ```json
+ * {
+ *   "version": "1.0.0",
+ *   "cache_key": "0123456789abcdef",
+ *   "timestamp": 1730332800000,
+ *   "checksum": "sha512-def456...",
+ *   "checksum_algorithm": "sha512",
+ *   "platform": "darwin",
+ *   "arch": "arm64",
+ *   "size": 13000000,
+ *   "source": {
+ *     "type": "decompression",
+ *     "path": "/usr/local/bin/socket"
+ *   },
+ *   "extra": {
+ *     "compressed_size": 1700000,
+ *     "compression_algorithm": 3,
+ *     "compression_ratio": 7.647
+ *   }
+ * }
+ * ```
+ *
+ * @internal This interface documents the metadata file format.
  */
-function generateCacheKey(url: string): string {
-  return createHash('sha256').update(url).digest('hex')
+export interface DlxMetadata {
+  version: string
+  cache_key: string
+  timestamp: number
+  checksum: string
+  checksum_algorithm: string
+  platform: string
+  arch: string
+  size: number
+  source?: {
+    type: 'download' | 'decompression'
+    url?: string
+    path?: string
+  }
+  extra?: Record<string, unknown>
 }
 
 /**
@@ -61,9 +189,10 @@ async function isCacheValid(
   cacheEntryPath: string,
   cacheTtl: number,
 ): Promise<boolean> {
+  const fs = getFs()
   try {
     const metaPath = getMetadataPath(cacheEntryPath)
-    if (!existsSync(metaPath)) {
+    if (!fs.existsSync(metaPath)) {
       return false
     }
 
@@ -72,9 +201,12 @@ async function isCacheValid(
       return false
     }
     const now = Date.now()
-    const age =
-      now -
-      (((metadata as Record<string, unknown>)['timestamp'] as number) || 0)
+    const timestamp = (metadata as Record<string, unknown>)['timestamp']
+    // If timestamp is missing or invalid, cache is invalid
+    if (typeof timestamp !== 'number' || timestamp <= 0) {
+      return false
+    }
+    const age = now - timestamp
 
     return age < cacheTtl
   } catch {
@@ -83,100 +215,150 @@ async function isCacheValid(
 }
 
 /**
- * Download a file from a URL with integrity checking.
+ * Download a file from a URL with integrity checking and concurrent download protection.
+ * Uses processLock to prevent multiple processes from downloading the same binary simultaneously.
+ * Internal helper function for downloading binary files.
  */
-async function downloadBinary(
+async function downloadBinaryFile(
   url: string,
   destPath: string,
   checksum?: string | undefined,
 ): Promise<string> {
-  const response = await httpRequest(url)
-  if (!response.ok) {
-    throw new Error(
-      `Failed to download binary: ${response.status} ${response.statusText}`,
-    )
-  }
-
-  // Create a temporary file first.
-  const tempPath = `${destPath}.download`
-  const hasher = createHash('sha256')
-
-  try {
-    // Ensure directory exists.
-    await fs.mkdir(path.dirname(destPath), { recursive: true })
-
-    // Get the response as a buffer and compute hash.
-    const buffer = response.body
-
-    // Compute hash.
-    hasher.update(buffer)
-    const actualChecksum = hasher.digest('hex')
-
-    // Verify checksum if provided.
-    if (checksum && actualChecksum !== checksum) {
-      throw new Error(
-        `Checksum mismatch: expected ${checksum}, got ${actualChecksum}`,
-      )
-    }
+  // Use process lock to prevent concurrent downloads.
+  // Lock is placed in the cache entry directory as 'concurrency.lock'.
+  const cacheEntryDir = path.dirname(destPath)
+  const lockPath = path.join(cacheEntryDir, 'concurrency.lock')
+
+  return await processLock.withLock(
+    lockPath,
+    async () => {
+      const fs = getFs()
+      // Check if file was downloaded while waiting for lock.
+      if (fs.existsSync(destPath)) {
+        const stats = await fs.promises.stat(destPath)
+        if (stats.size > 0) {
+          // File exists, compute and return checksum.
+          const fileBuffer = await fs.promises.readFile(destPath)
+          const hasher = createHash('sha256')
+          hasher.update(fileBuffer)
+          return hasher.digest('hex')
+        }
+      }
 
-    // Write to temp file.
-    await fs.writeFile(tempPath, buffer)
+      // Download the file.
+      try {
+        await httpDownload(url, destPath)
+      } catch (e) {
+        throw new Error(
+          `Failed to download binary from ${url}\n` +
+            `Destination: ${destPath}\n` +
+            'Check your internet connection or verify the URL is accessible.',
+          { cause: e },
+        )
+      }
 
-    // Make executable on POSIX systems.
-    if (!WIN32) {
-      await fs.chmod(tempPath, 0o755)
-    }
+      // Compute checksum of downloaded file.
+      const fileBuffer = await fs.promises.readFile(destPath)
+      const hasher = createHash('sha256')
+      hasher.update(fileBuffer)
+      const actualChecksum = hasher.digest('hex')
+
+      // Verify checksum if provided.
+      if (checksum && actualChecksum !== checksum) {
+        // Clean up invalid file.
+        await safeDelete(destPath)
+        throw new Error(
+          `Checksum mismatch: expected ${checksum}, got ${actualChecksum}`,
+        )
+      }
 
-    // Move temp file to final location.
-    await fs.rename(tempPath, destPath)
+      // Make executable on POSIX systems.
+      if (!WIN32) {
+        await fs.promises.chmod(destPath, 0o755)
+      }
 
-    return actualChecksum
-  } catch (e) {
-    // Clean up temp file on error.
-    try {
-      await safeDelete(tempPath)
-    } catch {
-      // Ignore cleanup errors.
-    }
-    throw e
-  }
+      return actualChecksum
+    },
+    {
+      // Align with npm npx locking strategy.
+      staleMs: 5000,
+      touchIntervalMs: 2000,
+    },
+  )
 }
 
 /**
  * Write metadata for a cached binary.
+ * Writes to both per-directory metadata file (for backward compatibility)
+ * and global manifest (~/.socket/_dlx/.dlx-manifest.json).
+ * Uses unified schema shared with C++ decompressor and CLI dlxBinary.
+ * Schema documentation: See DlxMetadata interface in this file (exported).
+ * Core fields: version, cache_key, timestamp, checksum, checksum_algorithm, platform, arch, size, source
+ * Note: This implementation uses SHA-256 checksums instead of SHA-512.
  */
 async function writeMetadata(
   cacheEntryPath: string,
+  cacheKey: string,
   url: string,
+  binaryName: string,
   checksum: string,
+  size: number,
 ): Promise<void> {
+  // Write per-directory metadata file for backward compatibility.
   const metaPath = getMetadataPath(cacheEntryPath)
   const metadata = {
-    arch: os.arch(),
+    version: '1.0.0',
+    cache_key: cacheKey,
+    timestamp: Date.now(),
     checksum,
+    checksum_algorithm: 'sha256',
     platform: os.platform(),
-    timestamp: Date.now(),
-    url,
-    version: '1.0.0',
+    arch: os.arch(),
+    size,
+    source: {
+      type: 'download',
+      url,
+    },
+  }
+  const fs = getFs()
+  await fs.promises.writeFile(metaPath, JSON.stringify(metadata, null, 2))
+
+  // Write to global manifest.
+  try {
+    const spec = `${url}:${binaryName}`
+    await dlxManifest.setBinaryEntry(spec, cacheKey, {
+      checksum,
+      checksum_algorithm: 'sha256',
+      platform: os.platform(),
+      arch: os.arch(),
+      size,
+      source: {
+        type: 'download',
+        url,
+      },
+    })
+  } catch {
+    // Silently ignore manifest write errors - not critical.
+    // The per-directory metadata is the source of truth for now.
   }
-  await fs.writeFile(metaPath, JSON.stringify(metadata, null, 2))
 }
 
 /**
  * Clean expired entries from the DLX cache.
  */
 export async function cleanDlxCache(
-  maxAge: number = /*@__INLINE__*/ require('../constants/time').DLX_BINARY_CACHE_TTL,
+  maxAge: number = /*@__INLINE__*/ require('#constants/time').DLX_BINARY_CACHE_TTL,
 ): Promise<number> {
   const cacheDir = getDlxCachePath()
+  const fs = getFs()
 
-  if (!existsSync(cacheDir)) {
+  if (!fs.existsSync(cacheDir)) {
     return 0
   }
 
   let cleaned = 0
   const now = Date.now()
-  const entries = await fs.readdir(cacheDir)
+  const entries = await fs.promises.readdir(cacheDir)
 
   for (const entry of entries) {
     const entryPath = path.join(cacheDir, entry)
@@ -197,9 +379,12 @@ export async function cleanDlxCache(
       ) {
         continue
       }
+      const timestamp = (metadata as Record<string, unknown>)['timestamp']
+      // If timestamp is missing or invalid, treat as expired (age = infinity)
       const age =
-        now -
-        (((metadata as Record<string, unknown>)['timestamp'] as number) || 0)
+        typeof timestamp === 'number' && timestamp > 0
+          ? now - timestamp
+          : Number.POSITIVE_INFINITY
 
       if (age > maxAge) {
         // Remove entire cache entry directory.
@@ -211,7 +396,7 @@ export async function cleanDlxCache(
       // If we can't read metadata, check if directory is empty or corrupted.
       try {
         // eslint-disable-next-line no-await-in-loop
-        const contents = await fs.readdir(entryPath)
+        const contents = await fs.promises.readdir(entryPath)
         if (!contents.length) {
           // Remove empty directory.
           // eslint-disable-next-line no-await-in-loop
@@ -234,20 +419,27 @@ export async function dlxBinary(
   spawnExtra?: SpawnExtra | undefined,
 ): Promise<DlxBinaryResult> {
   const {
-    cacheTtl = /*@__INLINE__*/ require('../constants/time').DLX_BINARY_CACHE_TTL,
+    cacheTtl = /*@__INLINE__*/ require('#constants/time').DLX_BINARY_CACHE_TTL,
     checksum,
-    force = false,
+    force: userForce = false,
     name,
     spawnOptions,
     url,
+    yes,
   } = { __proto__: null, ...options } as DlxBinaryOptions
 
+  // Map --yes flag to force behavior (auto-approve/skip prompts)
+  const force = yes === true ? true : userForce
+
   // Generate cache paths similar to pnpm/npx structure.
   const cacheDir = getDlxCachePath()
-  const cacheKey = generateCacheKey(url)
-  const cacheEntryDir = path.join(cacheDir, cacheKey)
   const binaryName = name || `binary-${process.platform}-${os.arch()}`
+  // Create spec from URL and binary name for unique cache identity.
+  const spec = `${url}:${binaryName}`
+  const cacheKey = generateCacheKey(spec)
+  const cacheEntryDir = path.join(cacheDir, cacheKey)
   const binaryPath = normalizePath(path.join(cacheEntryDir, binaryName))
+  const fs = getFs()
 
   let downloaded = false
   let computedChecksum = checksum
@@ -255,7 +447,7 @@ export async function dlxBinary(
   // Check if we need to download.
   if (
     !force &&
-    existsSync(cacheEntryDir) &&
+    fs.existsSync(cacheEntryDir) &&
     (await isCacheValid(cacheEntryDir, cacheTtl))
   ) {
     // Binary is cached and valid, read the checksum from metadata.
@@ -284,12 +476,44 @@ export async function dlxBinary(
   }
 
   if (downloaded) {
-    // Ensure cache directory exists.
-    await fs.mkdir(cacheEntryDir, { recursive: true })
+    // Ensure cache directory exists before downloading.
+    try {
+      await safeMkdir(cacheEntryDir)
+    } catch (e) {
+      const code = (e as NodeJS.ErrnoException).code
+      if (code === 'EACCES' || code === 'EPERM') {
+        throw new Error(
+          `Permission denied creating binary cache directory: ${cacheEntryDir}\n` +
+            'Please check directory permissions or run with appropriate access.',
+          { cause: e },
+        )
+      }
+      if (code === 'EROFS') {
+        throw new Error(
+          `Cannot create binary cache directory on read-only filesystem: ${cacheEntryDir}\n` +
+            'Ensure the filesystem is writable or set SOCKET_DLX_DIR to a writable location.',
+          { cause: e },
+        )
+      }
+      throw new Error(
+        `Failed to create binary cache directory: ${cacheEntryDir}`,
+        { cause: e },
+      )
+    }
 
     // Download the binary.
-    computedChecksum = await downloadBinary(url, binaryPath, checksum)
-    await writeMetadata(cacheEntryDir, url, computedChecksum || '')
+    computedChecksum = await downloadBinaryFile(url, binaryPath, checksum)
+
+    // Get file size for metadata.
+    const stats = await fs.promises.stat(binaryPath)
+    await writeMetadata(
+      cacheEntryDir,
+      cacheKey,
+      url,
+      binaryName,
+      computedChecksum || '',
+      stats.size,
+    )
   }
 
   // Execute the binary.
@@ -331,12 +555,142 @@ export async function dlxBinary(
   }
 }
 
+/**
+ * Download a binary from a URL with caching (without execution).
+ * Similar to downloadPackage from dlx-package.
+ *
+ * @returns Object containing the path to the cached binary and whether it was downloaded
+ */
+export async function downloadBinary(
+  options: Omit<DlxBinaryOptions, 'spawnOptions'>,
+): Promise<{ binaryPath: string; downloaded: boolean }> {
+  const {
+    cacheTtl = /*@__INLINE__*/ require('#constants/time').DLX_BINARY_CACHE_TTL,
+    checksum,
+    force = false,
+    name,
+    url,
+  } = { __proto__: null, ...options } as DlxBinaryOptions
+
+  // Generate cache paths similar to pnpm/npx structure.
+  const cacheDir = getDlxCachePath()
+  const binaryName = name || `binary-${process.platform}-${os.arch()}`
+  // Create spec from URL and binary name for unique cache identity.
+  const spec = `${url}:${binaryName}`
+  const cacheKey = generateCacheKey(spec)
+  const cacheEntryDir = path.join(cacheDir, cacheKey)
+  const binaryPath = normalizePath(path.join(cacheEntryDir, binaryName))
+  const fs = getFs()
+
+  let downloaded = false
+
+  // Check if we need to download.
+  if (
+    !force &&
+    fs.existsSync(cacheEntryDir) &&
+    (await isCacheValid(cacheEntryDir, cacheTtl))
+  ) {
+    // Binary is cached and valid.
+    downloaded = false
+  } else {
+    // Ensure cache directory exists before downloading.
+    try {
+      await safeMkdir(cacheEntryDir)
+    } catch (e) {
+      const code = (e as NodeJS.ErrnoException).code
+      if (code === 'EACCES' || code === 'EPERM') {
+        throw new Error(
+          `Permission denied creating binary cache directory: ${cacheEntryDir}\n` +
+            'Please check directory permissions or run with appropriate access.',
+          { cause: e },
+        )
+      }
+      if (code === 'EROFS') {
+        throw new Error(
+          `Cannot create binary cache directory on read-only filesystem: ${cacheEntryDir}\n` +
+            'Ensure the filesystem is writable or set SOCKET_DLX_DIR to a writable location.',
+          { cause: e },
+        )
+      }
+      throw new Error(
+        `Failed to create binary cache directory: ${cacheEntryDir}`,
+        { cause: e },
+      )
+    }
+
+    // Download the binary.
+    const computedChecksum = await downloadBinaryFile(url, binaryPath, checksum)
+
+    // Get file size for metadata.
+    const stats = await fs.promises.stat(binaryPath)
+    await writeMetadata(
+      cacheEntryDir,
+      cacheKey,
+      url,
+      binaryName,
+      computedChecksum || '',
+      stats.size,
+    )
+    downloaded = true
+  }
+
+  return {
+    binaryPath,
+    downloaded,
+  }
+}
+
+/**
+ * Execute a cached binary without re-downloading.
+ * Similar to executePackage from dlx-package.
+ * Binary must have been previously downloaded via downloadBinary or dlxBinary.
+ *
+ * @param binaryPath Path to the cached binary (from downloadBinary result)
+ * @param args Arguments to pass to the binary
+ * @param spawnOptions Spawn options for execution
+ * @param spawnExtra Extra spawn configuration
+ * @returns The spawn promise for the running process
+ */
+export function executeBinary(
+  binaryPath: string,
+  args: readonly string[] | string[],
+  spawnOptions?: SpawnOptions | undefined,
+  spawnExtra?: SpawnExtra | undefined,
+): ReturnType<typeof spawn> {
+  // On Windows, script files (.bat, .cmd, .ps1) require shell: true because
+  // they are not executable on their own and must be run through cmd.exe.
+  // Note: .exe files are actual binaries and don't need shell mode.
+  const needsShell = WIN32 && /\.(?:bat|cmd|ps1)$/i.test(binaryPath)
+
+  // Windows cmd.exe PATH resolution behavior:
+  // When shell: true on Windows with .cmd/.bat/.ps1 files, spawn will automatically
+  // strip the full path down to just the basename without extension. Windows cmd.exe
+  // then searches for the binary in directories listed in PATH.
+  //
+  // Since our binaries are downloaded to a custom cache directory that's not in PATH,
+  // we must prepend the cache directory to PATH so cmd.exe can locate the binary.
+  const cacheEntryDir = path.dirname(binaryPath)
+  const finalSpawnOptions = needsShell
+    ? {
+        ...spawnOptions,
+        env: {
+          ...spawnOptions?.env,
+          PATH: `${cacheEntryDir}${path.delimiter}${process.env['PATH'] || ''}`,
+        },
+        shell: true,
+      }
+    : spawnOptions
+
+  return spawn(binaryPath, args, finalSpawnOptions, spawnExtra)
+}
+
 /**
  * Get the DLX binary cache directory path.
  * Returns normalized path for cross-platform compatibility.
+ * Uses same directory as dlx-package for unified DLX storage.
  */
 export function getDlxCachePath(): string {
-  return normalizePath(path.join(getSocketHomePath(), 'cache', 'dlx'))
+  return getSocketDlxDir()
 }
 
 /**
@@ -354,14 +708,15 @@ export async function listDlxCache(): Promise<
   }>
 > {
   const cacheDir = getDlxCachePath()
+  const fs = getFs()
 
-  if (!existsSync(cacheDir)) {
+  if (!fs.existsSync(cacheDir)) {
     return []
   }
 
   const results = []
   const now = Date.now()
-  const entries = await fs.readdir(cacheDir)
+  const entries = await fs.promises.readdir(cacheDir)
 
   for (const entry of entries) {
     const entryPath = path.join(cacheDir, entry)
@@ -382,17 +737,24 @@ export async function listDlxCache(): Promise<
         continue
       }
 
+      const metaObj = metadata as Record<string, unknown>
+
+      // Get URL from unified schema (source.url) or legacy schema (url).
+      // Allow empty URL for backward compatibility with partial metadata.
+      const source = metaObj['source'] as Record<string, unknown> | undefined
+      const url =
+        (source?.['url'] as string) || (metaObj['url'] as string) || ''
+
       // Find the binary file in the directory.
       // eslint-disable-next-line no-await-in-loop
-      const files = await fs.readdir(entryPath)
+      const files = await fs.promises.readdir(entryPath)
       const binaryFile = files.find(f => !f.startsWith('.'))
 
       if (binaryFile) {
         const binaryPath = path.join(entryPath, binaryFile)
         // eslint-disable-next-line no-await-in-loop
-        const binaryStats = await fs.stat(binaryPath)
+        const binaryStats = await fs.promises.stat(binaryPath)
 
-        const metaObj = metadata as Record<string, unknown>
         results.push({
           age: now - ((metaObj['timestamp'] as number) || 0),
           arch: (metaObj['arch'] as string) || 'unknown',
@@ -400,7 +762,7 @@ export async function listDlxCache(): Promise<
           name: binaryFile,
           platform: (metaObj['platform'] as string) || 'unknown',
           size: binaryStats.size,
-          url: (metaObj['url'] as string) || '',
+          url,
         })
       }
     } catch {}
diff --git a/src/dlx-manifest.ts b/src/dlx-manifest.ts
new file mode 100644
index 0000000..db34da1
--- /dev/null
+++ b/src/dlx-manifest.ts
@@ -0,0 +1,432 @@
+/**
+ * @fileoverview DLX manifest storage utilities.
+ * Manages persistent caching of DLX package and binary metadata with TTL support
+ * and atomic file operations.
+ *
+ * Key Functions:
+ * - getManifestEntry: Retrieve manifest entry by spec
+ * - setPackageEntry: Store npm package metadata
+ * - setBinaryEntry: Store binary download metadata
+ *
+ * Features:
+ * - TTL-based cache expiration
+ * - Atomic file operations with locking
+ * - JSON-based persistent storage
+ * - Error-resistant implementation
+ *
+ * Storage Format:
+ * - Stores in ~/.socket/_dlx/.dlx-manifest.json
+ * - Per-spec manifest entries with timestamps
+ * - Thread-safe operations using process lock utility
+ *
+ * Usage:
+ * - Update check caching
+ * - Binary metadata tracking
+ * - Rate limiting registry requests
+ */
+
+import { existsSync, readFileSync, unlinkSync, writeFileSync } from 'fs'
+import path from 'path'
+
+import { readFileUtf8Sync, safeMkdirSync } from './fs'
+import { getDefaultLogger } from './logger'
+import { getSocketDlxDir } from './paths'
+import { processLock } from './process-lock'
+
+const logger = getDefaultLogger()
+
+/**
+ * Manifest file name.
+ */
+const MANIFEST_FILE_NAME = '.dlx-manifest.json'
+
+/**
+ * Details for npm package entries.
+ */
+export interface PackageDetails {
+  installed_version: string
+  size?: number
+  update_check?: {
+    last_check: number
+    last_notification: number
+    latest_known: string
+  }
+}
+
+/**
+ * Details for binary download entries.
+ */
+export interface BinaryDetails {
+  checksum: string
+  checksum_algorithm: 'sha256' | 'sha512'
+  platform: string
+  arch: string
+  size: number
+  source: {
+    type: 'download'
+    url: string
+  }
+}
+
+/**
+ * Unified manifest entry for all cached items (packages and binaries).
+ * Shared fields at root, type-specific fields in details.
+ */
+export interface ManifestEntry {
+  type: 'package' | 'binary'
+  cache_key: string
+  timestamp: number
+  details: PackageDetails | BinaryDetails
+}
+
+/**
+ * Type guard for package entries.
+ */
+export function isPackageEntry(
+  entry: ManifestEntry,
+): entry is ManifestEntry & { details: PackageDetails } {
+  return entry.type === 'package'
+}
+
+/**
+ * Type guard for binary entries.
+ */
+export function isBinaryEntry(
+  entry: ManifestEntry,
+): entry is ManifestEntry & { details: BinaryDetails } {
+  return entry.type === 'binary'
+}
+
+/**
+ * Legacy store record format (deprecated, for migration).
+ */
+export interface StoreRecord {
+  timestampFetch: number
+  timestampNotification: number
+  version: string
+}
+
+export interface DlxManifestOptions {
+  /**
+   * Custom manifest file path (defaults to ~/.socket/_dlx/.dlx-manifest.json).
+   */
+  manifestPath?: string
+}
+
+/**
+ * DLX manifest storage manager with atomic operations.
+ * Supports both legacy format (package name keys) and new unified manifest format (spec keys).
+ */
+export class DlxManifest {
+  private readonly manifestPath: string
+  private readonly lockPath: string
+
+  constructor(options: DlxManifestOptions = {}) {
+    this.manifestPath =
+      options.manifestPath ?? path.join(getSocketDlxDir(), MANIFEST_FILE_NAME)
+    this.lockPath = `${this.manifestPath}.lock`
+  }
+
+  /**
+   * Read the entire manifest file.
+   */
+  private readManifest(): Record<string, ManifestEntry | StoreRecord> {
+    try {
+      if (!existsSync(this.manifestPath)) {
+        return Object.create(null)
+      }
+
+      const rawContent = readFileUtf8Sync(this.manifestPath)
+      const content = (
+        typeof rawContent === 'string'
+          ? rawContent
+          : rawContent.toString('utf8')
+      ).trim()
+
+      if (!content) {
+        return Object.create(null)
+      }
+
+      return JSON.parse(content) as Record<string, ManifestEntry | StoreRecord>
+    } catch (error) {
+      logger.warn(
+        `Failed to read manifest: ${error instanceof Error ? error.message : String(error)}`,
+      )
+      return Object.create(null)
+    }
+  }
+
+  /**
+   * Get a manifest entry by spec (e.g., "@socketsecurity/cli@^2.0.11").
+   */
+  getManifestEntry(spec: string): ManifestEntry | undefined {
+    const data = this.readManifest()
+    const entry = data[spec]
+
+    // Check if it's a new-format entry (has 'type' field).
+    if (entry && 'type' in entry) {
+      return entry as ManifestEntry
+    }
+
+    return undefined
+  }
+
+  /**
+   * Get cached update information for a package (legacy format).
+   * @deprecated Use getManifestEntry() for new code.
+   */
+  get(name: string): StoreRecord | undefined {
+    const data = this.readManifest()
+    const entry = data[name]
+
+    // Return legacy format entries only.
+    if (entry && !('type' in entry)) {
+      return entry as StoreRecord
+    }
+
+    return undefined
+  }
+
+  /**
+   * Set a package manifest entry.
+   */
+  async setPackageEntry(
+    spec: string,
+    cacheKey: string,
+    details: PackageDetails,
+  ): Promise<void> {
+    await processLock.withLock(this.lockPath, async () => {
+      const data = this.readManifest()
+
+      data[spec] = {
+        type: 'package',
+        cache_key: cacheKey,
+        timestamp: Date.now(),
+        details,
+      }
+
+      await this.writeManifest(data)
+    })
+  }
+
+  /**
+   * Set a binary manifest entry.
+   */
+  async setBinaryEntry(
+    spec: string,
+    cacheKey: string,
+    details: BinaryDetails,
+  ): Promise<void> {
+    await processLock.withLock(this.lockPath, async () => {
+      const data = this.readManifest()
+
+      data[spec] = {
+        type: 'binary',
+        cache_key: cacheKey,
+        timestamp: Date.now(),
+        details,
+      }
+
+      await this.writeManifest(data)
+    })
+  }
+
+  /**
+   * Write the manifest file atomically.
+   */
+  private async writeManifest(
+    data: Record<string, ManifestEntry | StoreRecord>,
+  ): Promise<void> {
+    // Ensure directory exists.
+    const manifestDir = path.dirname(this.manifestPath)
+    try {
+      safeMkdirSync(manifestDir, { recursive: true })
+    } catch (error) {
+      logger.warn(
+        `Failed to create manifest directory: ${error instanceof Error ? error.message : String(error)}`,
+      )
+    }
+
+    // Write atomically.
+    const content = JSON.stringify(data, null, 2)
+    const tempPath = `${this.manifestPath}.tmp`
+
+    try {
+      writeFileSync(tempPath, content, 'utf8')
+      writeFileSync(this.manifestPath, content, 'utf8')
+
+      // Clean up temp file.
+      try {
+        if (existsSync(tempPath)) {
+          unlinkSync(tempPath)
+        }
+      } catch {
+        // Cleanup failed, not critical.
+      }
+    } catch (error) {
+      // Clean up temp file on error.
+      try {
+        if (existsSync(tempPath)) {
+          unlinkSync(tempPath)
+        }
+      } catch {
+        // Best effort cleanup.
+      }
+      throw error
+    }
+  }
+
+  /**
+   * Store update information for a package (legacy format).
+   * @deprecated Use setPackageEntry() for new code.
+   */
+  async set(name: string, record: StoreRecord): Promise<void> {
+    await processLock.withLock(this.lockPath, async () => {
+      let data: Record<string, StoreRecord> = Object.create(null)
+
+      // Read existing data.
+      try {
+        if (existsSync(this.manifestPath)) {
+          const content = readFileSync(this.manifestPath, 'utf8')
+          if (content.trim()) {
+            data = JSON.parse(content) as Record<string, StoreRecord>
+          }
+        }
+      } catch (error) {
+        logger.warn(
+          `Failed to read existing manifest: ${error instanceof Error ? error.message : String(error)}`,
+        )
+      }
+
+      // Update record.
+      data[name] = record
+
+      // Ensure directory exists.
+      const manifestDir = path.dirname(this.manifestPath)
+      try {
+        safeMkdirSync(manifestDir, { recursive: true })
+      } catch (error) {
+        logger.warn(
+          `Failed to create manifest directory: ${error instanceof Error ? error.message : String(error)}`,
+        )
+      }
+
+      // Write atomically.
+      const content = JSON.stringify(data, null, 2)
+      const tempPath = `${this.manifestPath}.tmp`
+
+      try {
+        writeFileSync(tempPath, content, 'utf8')
+        writeFileSync(this.manifestPath, content, 'utf8')
+
+        // Clean up temp file.
+        try {
+          if (existsSync(tempPath)) {
+            unlinkSync(tempPath)
+          }
+        } catch {
+          // Cleanup failed, not critical.
+        }
+      } catch (error) {
+        // Clean up temp file on error.
+        try {
+          if (existsSync(tempPath)) {
+            unlinkSync(tempPath)
+          }
+        } catch {
+          // Best effort cleanup.
+        }
+        throw error
+      }
+    })
+  }
+
+  /**
+   * Clear cached data for a specific entry.
+   */
+  async clear(name: string): Promise<void> {
+    await processLock.withLock(this.lockPath, async () => {
+      try {
+        if (!existsSync(this.manifestPath)) {
+          return
+        }
+
+        const content = readFileSync(this.manifestPath, 'utf8')
+        if (!content.trim()) {
+          return
+        }
+
+        const data = JSON.parse(content) as Record<string, StoreRecord>
+        delete data[name]
+
+        const updatedContent = JSON.stringify(data, null, 2)
+        writeFileSync(this.manifestPath, updatedContent, 'utf8')
+      } catch (error) {
+        logger.warn(
+          `Failed to clear cache for ${name}: ${error instanceof Error ? error.message : String(error)}`,
+        )
+      }
+    })
+  }
+
+  /**
+   * Clear all cached data.
+   */
+  async clearAll(): Promise<void> {
+    await processLock.withLock(this.lockPath, async () => {
+      try {
+        if (existsSync(this.manifestPath)) {
+          unlinkSync(this.manifestPath)
+        }
+      } catch (error) {
+        logger.warn(
+          `Failed to clear all cache: ${error instanceof Error ? error.message : String(error)}`,
+        )
+      }
+    })
+  }
+
+  /**
+   * Check if cached data is fresh based on TTL.
+   */
+  isFresh(record: StoreRecord | undefined, ttlMs: number): boolean {
+    if (!record) {
+      return false
+    }
+
+    const age = Date.now() - record.timestampFetch
+    return age < ttlMs
+  }
+
+  /**
+   * Get all cached package names.
+   */
+  getAllPackages(): string[] {
+    try {
+      if (!existsSync(this.manifestPath)) {
+        return []
+      }
+
+      const rawContent = readFileUtf8Sync(this.manifestPath)
+      const content = (
+        typeof rawContent === 'string'
+          ? rawContent
+          : rawContent.toString('utf8')
+      ).trim()
+      if (!content) {
+        return []
+      }
+
+      const data = JSON.parse(content) as Record<string, StoreRecord>
+      return Object.keys(data)
+    } catch (error) {
+      logger.warn(
+        `Failed to get package list: ${error instanceof Error ? error.message : String(error)}`,
+      )
+      return []
+    }
+  }
+}
+
+// Export singleton instance using default manifest location.
+export const dlxManifest = new DlxManifest()
diff --git a/src/dlx-package.ts b/src/dlx-package.ts
new file mode 100644
index 0000000..86dbd5d
--- /dev/null
+++ b/src/dlx-package.ts
@@ -0,0 +1,643 @@
+/**
+ * @fileoverview DLX package execution - Install and execute npm packages.
+ *
+ * This module provides functionality to install and execute npm packages
+ * in the ~/.socket/_dlx directory, similar to npx but with Socket's own cache.
+ *
+ * Uses content-addressed storage like npm's _npx:
+ * - Hash is generated from package spec (name@version)
+ * - Each unique spec gets its own directory: ~/.socket/_dlx/<hash>/
+ * - Allows caching multiple versions of the same package
+ *
+ * Concurrency protection:
+ * - Uses process-lock to prevent concurrent installation corruption
+ * - Lock file created at ~/.socket/_dlx/<hash>/concurrency.lock
+ * - Uses npm npx's concurrency.lock naming convention (5s stale, 2s touching)
+ * - Prevents multiple processes from corrupting the same package installation
+ *
+ * Version range handling:
+ * - Exact versions (1.0.0) use cache if available
+ * - Range versions (^1.0.0, ~1.0.0) auto-force to get latest within range
+ * - User can override with explicit force: false
+ *
+ * Key difference from dlx-binary.ts:
+ * - dlx-binary.ts: Downloads standalone binaries from URLs
+ * - dlx-package.ts: Installs npm packages from registries
+ *
+ * Implementation:
+ * - Uses pacote for package installation (no npm CLI required)
+ * - Split into downloadPackage() and executePackage() for flexibility
+ * - dlxPackage() combines both for convenience
+ */
+
+import path from 'path'
+
+import { WIN32 } from './constants/platform'
+import { getPacoteCachePath } from './constants/packages'
+import { generateCacheKey } from './dlx'
+import { readJsonSync, safeMkdir } from './fs'
+import { normalizePath } from './path'
+import { getSocketDlxDir } from './paths'
+import { processLock } from './process-lock'
+import type { SpawnExtra, SpawnOptions } from './spawn'
+import { spawn } from './spawn'
+
+let _fs: typeof import('fs') | undefined
+/**
+ * Lazily load the fs module to avoid Webpack errors.
+ * Uses non-'node:' prefixed require to prevent Webpack bundling issues.
+ *
+ * @returns The Node.js fs module
+ * @private
+ */
+/*@__NO_SIDE_EFFECTS__*/
+function getFs() {
+  if (_fs === undefined) {
+    // Use non-'node:' prefixed require to avoid Webpack errors.
+
+    _fs = /*@__PURE__*/ require('node:fs')
+  }
+  return _fs as typeof import('fs')
+}
+
+let _npmPackageArg: typeof import('npm-package-arg') | undefined
+/*@__NO_SIDE_EFFECTS__*/
+function getNpmPackageArg() {
+  if (_npmPackageArg === undefined) {
+    _npmPackageArg = /*@__PURE__*/ require('./external/npm-package-arg')
+  }
+  return _npmPackageArg as typeof import('npm-package-arg')
+}
+
+let _libnpmexec: typeof import('./external/libnpmexec') | undefined
+/*@__NO_SIDE_EFFECTS__*/
+function getLibnpmexec() {
+  if (_libnpmexec === undefined) {
+    _libnpmexec = /*@__PURE__*/ require('./external/libnpmexec')
+  }
+  return _libnpmexec!
+}
+
+let _pacote: typeof import('pacote') | undefined
+/*@__NO_SIDE_EFFECTS__*/
+function getPacote() {
+  if (_pacote === undefined) {
+    _pacote = /*@__PURE__*/ require('./external/pacote')
+  }
+  return _pacote as typeof import('pacote')
+}
+
+/**
+ * Regex to check if a version string contains range operators.
+ * Matches any version with range operators: ~, ^, >, <, =, x, X, *, spaces, or ||.
+ */
+const rangeOperatorsRegExp = /[~^><=xX* ]|\|\|/
+
+export interface DownloadPackageResult {
+  /** Path to the installed package directory. */
+  packageDir: string
+  /** Path to the binary. */
+  binaryPath: string
+  /** Whether the package was newly installed. */
+  installed: boolean
+}
+
+export interface DlxPackageOptions {
+  /**
+   * Package to install (e.g., '@cyclonedx/cdxgen@10.0.0').
+   * Aligns with npx --package flag.
+   */
+  package: string
+
+  /**
+   * Binary name to execute (optional - auto-detected in most cases).
+   *
+   * Auto-detection logic:
+   * 1. If package has only one binary, uses it automatically
+   * 2. Tries user-provided binaryName
+   * 3. Tries last segment of package name (e.g., 'cli' from '@socketsecurity/cli')
+   * 4. Falls back to first binary
+   *
+   * Only needed when package has multiple binaries and auto-detection fails.
+   *
+   * @example
+   * // Auto-detected (single binary)
+   * { package: '@socketsecurity/cli' }  // Finds 'socket' binary automatically
+   *
+   * // Explicit (multiple binaries)
+   * { package: 'some-tool', binaryName: 'specific-tool' }
+   */
+  binaryName?: string | undefined
+
+  /**
+   * Force reinstallation even if package exists.
+   * Aligns with npx --yes/-y flag behavior.
+   */
+  force?: boolean | undefined
+
+  /**
+   * Skip confirmation prompts (auto-approve).
+   * Aligns with npx --yes/-y flag.
+   */
+  yes?: boolean | undefined
+
+  /**
+   * Suppress output (quiet mode).
+   * Aligns with npx --quiet/-q and pnpm --silent/-s flags.
+   */
+  quiet?: boolean | undefined
+
+  /**
+   * Additional spawn options for the execution.
+   */
+  spawnOptions?: SpawnOptions | undefined
+}
+
+export interface DlxPackageResult {
+  /** Path to the installed package directory. */
+  packageDir: string
+  /** Path to the binary that was executed. */
+  binaryPath: string
+  /** Whether the package was newly installed. */
+  installed: boolean
+  /** The spawn promise for the running process. */
+  spawnPromise: ReturnType<typeof spawn>
+}
+
+/**
+ * Parse package spec into name and version using npm-package-arg.
+ * Examples:
+ * - 'lodash@4.17.21' → { name: 'lodash', version: '4.17.21' }
+ * - '@scope/pkg@1.0.0' → { name: '@scope/pkg', version: '1.0.0' }
+ * - 'lodash' → { name: 'lodash', version: undefined }
+ */
+function parsePackageSpec(spec: string): {
+  name: string
+  version: string | undefined
+} {
+  try {
+    const npa = getNpmPackageArg()
+    const parsed = npa(spec)
+
+    // Extract version from different types of specs.
+    // For registry specs, use fetchSpec (the version/range).
+    // For git/file/etc, version will be undefined.
+    const version =
+      parsed.type === 'tag'
+        ? parsed.fetchSpec
+        : parsed.type === 'version' || parsed.type === 'range'
+          ? parsed.fetchSpec
+          : undefined
+
+    return {
+      name: parsed.name || spec,
+      version,
+    }
+  } catch {
+    // Fallback to simple parsing if npm-package-arg fails.
+    const atIndex = spec.lastIndexOf('@')
+    if (atIndex === -1 || spec.startsWith('@')) {
+      // No version or scoped package without version.
+      return { name: spec, version: undefined }
+    }
+    return {
+      name: spec.slice(0, atIndex),
+      version: spec.slice(atIndex + 1),
+    }
+  }
+}
+
+/**
+ * Install package to ~/.socket/_dlx/<hash>/ if not already installed.
+ * Uses pacote for installation (no npm CLI required).
+ * Protected by process lock to prevent concurrent installation corruption.
+ */
+async function ensurePackageInstalled(
+  packageName: string,
+  packageSpec: string,
+  force: boolean,
+): Promise<{ installed: boolean; packageDir: string }> {
+  const cacheKey = generateCacheKey(packageSpec)
+  const packageDir = normalizePath(path.join(getSocketDlxDir(), cacheKey))
+  const installedDir = normalizePath(
+    path.join(packageDir, 'node_modules', packageName),
+  )
+
+  // Ensure package directory exists before creating lock.
+  // The lock directory will be created inside this directory.
+  try {
+    await safeMkdir(packageDir)
+  } catch (e) {
+    const code = (e as NodeJS.ErrnoException).code
+    if (code === 'EACCES' || code === 'EPERM') {
+      throw new Error(
+        `Permission denied creating package directory: ${packageDir}\n` +
+          'Please check directory permissions or run with appropriate access.',
+        { cause: e },
+      )
+    }
+    if (code === 'EROFS') {
+      throw new Error(
+        `Cannot create package directory on read-only filesystem: ${packageDir}\n` +
+          'Ensure the filesystem is writable or set SOCKET_DLX_DIR to a writable location.',
+        { cause: e },
+      )
+    }
+    throw new Error(`Failed to create package directory: ${packageDir}`, {
+      cause: e,
+    })
+  }
+
+  // Use process lock to prevent concurrent installations.
+  // Uses npm npx's concurrency.lock naming convention.
+  const lockPath = path.join(packageDir, 'concurrency.lock')
+
+  return await processLock.withLock(
+    lockPath,
+    async () => {
+      const fs = getFs()
+      // Double-check if already installed (unless force).
+      // Another process may have installed while waiting for lock.
+      if (!force && fs.existsSync(installedDir)) {
+        // Verify package.json exists.
+        const pkgJsonPath = path.join(installedDir, 'package.json')
+        if (fs.existsSync(pkgJsonPath)) {
+          return { installed: false, packageDir }
+        }
+      }
+
+      // Use pacote to extract the package.
+      // Pacote leverages npm cache when available but doesn't require npm CLI.
+      const pacoteCachePath = getPacoteCachePath()
+      try {
+        await getPacote().extract(packageSpec, installedDir, {
+          // Use consistent pacote cache path (respects npm cache locations when available).
+          cache: pacoteCachePath || path.join(packageDir, '.cache'),
+        })
+      } catch (e) {
+        const code = (e as any).code
+        if (code === 'E404' || code === 'ETARGET') {
+          throw new Error(
+            `Package not found: ${packageSpec}\n` +
+              'Verify the package exists on npm registry and check the version.\n' +
+              `Visit https://www.npmjs.com/package/${packageName} to see available versions.`,
+            { cause: e },
+          )
+        }
+        if (
+          code === 'ENOTFOUND' ||
+          code === 'ETIMEDOUT' ||
+          code === 'EAI_AGAIN'
+        ) {
+          throw new Error(
+            `Network error installing ${packageSpec}\n` +
+              'Check your internet connection and try again.',
+            { cause: e },
+          )
+        }
+        throw new Error(
+          `Failed to install package: ${packageSpec}\n` +
+            `Destination: ${installedDir}\n` +
+            'Check npm registry connectivity or package name.',
+          { cause: e },
+        )
+      }
+
+      return { installed: true, packageDir }
+    },
+    {
+      // Align with npm npx locking strategy.
+      staleMs: 5000,
+      touchIntervalMs: 2000,
+    },
+  )
+}
+
+/**
+ * Resolve binary path with cross-platform wrapper support.
+ * On Windows, checks for .cmd, .bat, .ps1, .exe wrappers in order.
+ * On Unix, uses path directly.
+ *
+ * Aligns with npm/npx binary resolution strategy.
+ */
+function resolveBinaryPath(basePath: string): string {
+  const fs = getFs()
+
+  if (!WIN32) {
+    // Unix: use path directly
+    return basePath
+  }
+
+  // Windows: check for wrappers in priority order
+  // Order matches npm bin-links creation: .cmd, .ps1, .exe, then bare
+  const extensions = ['.cmd', '.bat', '.ps1', '.exe', '']
+
+  for (const ext of extensions) {
+    const testPath = basePath + ext
+    if (fs.existsSync(testPath)) {
+      return testPath
+    }
+  }
+
+  // Fallback to original path if no wrapper found
+  return basePath
+}
+
+/**
+ * Find the binary path for an installed package.
+ * Uses npm's bin resolution strategy with user-friendly fallbacks.
+ * Resolves platform-specific wrappers (.cmd, .ps1, etc.) on Windows.
+ *
+ * Resolution strategy (cherry-picked from libnpmexec):
+ * 1. Use npm's getBinFromManifest (handles aliases and standard cases)
+ * 2. Fall back to user-provided binaryName if npm's strategy fails
+ * 3. Try last segment of package name as final fallback
+ * 4. Use first binary as last resort
+ */
+function findBinaryPath(
+  packageDir: string,
+  packageName: string,
+  binaryName?: string,
+): string {
+  const installedDir = normalizePath(
+    path.join(packageDir, 'node_modules', packageName),
+  )
+  const pkgJsonPath = path.join(installedDir, 'package.json')
+
+  // Read package.json to find bin entry.
+  const pkgJson = readJsonSync(pkgJsonPath) as Record<string, unknown>
+  const bin = pkgJson['bin']
+
+  let binName: string | undefined
+  let binPath: string | undefined
+
+  if (typeof bin === 'string') {
+    // Single binary - use it directly.
+    binPath = bin
+  } else if (typeof bin === 'object' && bin !== null) {
+    const binObj = bin as Record<string, string>
+    const binKeys = Object.keys(binObj)
+
+    // If only one binary, use it regardless of name.
+    if (binKeys.length === 1) {
+      binName = binKeys[0]!
+      binPath = binObj[binName]
+    } else {
+      // Multiple binaries - use npm's battle-tested resolution strategy first.
+      try {
+        const { getBinFromManifest } = getLibnpmexec()
+        binName = getBinFromManifest({
+          name: packageName,
+          bin: binObj,
+          _id: `${packageName}@${(pkgJson as any).version || 'unknown'}`,
+        })
+        binPath = binObj[binName]
+      } catch {
+        // npm's strategy failed - fall back to user-friendly resolution:
+        // 1. User-provided binaryName
+        // 2. Last segment of package name (e.g., 'cli' from '@socketsecurity/cli')
+        // 3. First binary as fallback
+        const lastSegment = packageName.split('/').pop()
+        const candidates = [
+          binaryName,
+          lastSegment,
+          packageName.replace(/^@[^/]+\//, ''),
+        ].filter(Boolean)
+
+        for (const candidate of candidates) {
+          if (candidate && binObj[candidate]) {
+            binName = candidate
+            binPath = binObj[candidate]
+            break
+          }
+        }
+
+        // Fallback to first binary if nothing matched.
+        if (!binPath && binKeys.length > 0) {
+          binName = binKeys[0]!
+          binPath = binObj[binName]
+        }
+      }
+    }
+  }
+
+  if (!binPath) {
+    throw new Error(`No binary found for package "${packageName}"`)
+  }
+
+  const rawPath = normalizePath(path.join(installedDir, binPath))
+
+  // Resolve platform-specific wrapper (Windows .cmd/.ps1/etc.)
+  return resolveBinaryPath(rawPath)
+}
+
+/**
+ * Execute a package via DLX - install if needed and run its binary.
+ *
+ * This is the Socket equivalent of npx/pnpm dlx/yarn dlx, but using
+ * our own cache directory (~/.socket/_dlx) and installation logic.
+ *
+ * Auto-forces reinstall for version ranges to get latest within range.
+ *
+ * @example
+ * ```typescript
+ * // Download and execute cdxgen
+ * const result = await dlxPackage(
+ *   ['--version'],
+ *   { package: '@cyclonedx/cdxgen@10.0.0' }
+ * )
+ * await result.spawnPromise
+ * ```
+ */
+export async function dlxPackage(
+  args: readonly string[] | string[],
+  options?: DlxPackageOptions | undefined,
+  spawnExtra?: SpawnExtra | undefined,
+): Promise<DlxPackageResult> {
+  // Download the package.
+  const downloadResult = await downloadPackage(options!)
+
+  // Execute the binary.
+  const spawnPromise = executePackage(
+    downloadResult.binaryPath,
+    args,
+    options?.spawnOptions,
+    spawnExtra,
+  )
+
+  return {
+    ...downloadResult,
+    spawnPromise,
+  }
+}
+
+/**
+ * Make all binaries in an installed package executable.
+ * Reads the package.json bin field and makes all binaries executable (chmod 0o755).
+ * Handles both single binary (string) and multiple binaries (object) formats.
+ *
+ * Aligns with npm's approach:
+ * - Uses 0o755 permission (matches npm's cmd-shim)
+ * - Reads bin field from package.json (matches npm's bin-links and libnpmexec)
+ * - Handles both string and object bin formats
+ *
+ * References:
+ * - npm cmd-shim: https://github.com/npm/cmd-shim/blob/main/lib/index.js
+ * - npm getBinFromManifest: https://github.com/npm/libnpmexec/blob/main/lib/get-bin-from-manifest.js
+ */
+function makePackageBinsExecutable(
+  packageDir: string,
+  packageName: string,
+): void {
+  if (WIN32) {
+    // Windows doesn't need chmod
+    return
+  }
+
+  const fs = getFs()
+  const installedDir = normalizePath(
+    path.join(packageDir, 'node_modules', packageName),
+  )
+  const pkgJsonPath = path.join(installedDir, 'package.json')
+
+  try {
+    const pkgJson = readJsonSync(pkgJsonPath) as Record<string, unknown>
+    const bin = pkgJson['bin']
+
+    if (!bin) {
+      return
+    }
+
+    const binPaths: string[] = []
+
+    if (typeof bin === 'string') {
+      // Single binary
+      binPaths.push(bin)
+    } else if (typeof bin === 'object' && bin !== null) {
+      // Multiple binaries
+      const binObj = bin as Record<string, string>
+      binPaths.push(...Object.values(binObj))
+    }
+
+    // Make all binaries executable
+    for (const binPath of binPaths) {
+      const fullPath = normalizePath(path.join(installedDir, binPath))
+      if (fs.existsSync(fullPath)) {
+        try {
+          fs.chmodSync(fullPath, 0o755)
+        } catch {
+          // Ignore chmod errors on individual binaries
+        }
+      }
+    }
+  } catch {
+    // Ignore errors reading package.json or making binaries executable
+    // This is non-critical functionality
+  }
+}
+
+/**
+ * Download and install a package without executing it.
+ * This is useful for self-update or when you need the package files
+ * but don't want to run the binary immediately.
+ *
+ * @example
+ * ```typescript
+ * // Install @socketsecurity/cli without running it
+ * const result = await downloadPackage({
+ *   package: '@socketsecurity/cli@1.2.0',
+ *   force: true
+ * })
+ * console.log('Installed to:', result.packageDir)
+ * console.log('Binary at:', result.binaryPath)
+ * ```
+ */
+export async function downloadPackage(
+  options: DlxPackageOptions,
+): Promise<DownloadPackageResult> {
+  const {
+    binaryName,
+    force: userForce,
+    package: packageSpec,
+    yes,
+  } = {
+    __proto__: null,
+    ...options,
+  } as DlxPackageOptions
+
+  // Parse package spec.
+  const { name: packageName, version: packageVersion } =
+    parsePackageSpec(packageSpec)
+
+  // Determine force behavior:
+  // 1. Explicit force takes precedence
+  // 2. --yes flag implies force (auto-approve/skip prompts)
+  // 3. Version ranges auto-force to get latest
+  const isVersionRange =
+    packageVersion !== undefined && rangeOperatorsRegExp.test(packageVersion)
+  const force =
+    userForce !== undefined ? userForce : yes === true ? true : isVersionRange
+
+  // Build full package spec for installation.
+  const fullPackageSpec = packageVersion
+    ? `${packageName}@${packageVersion}`
+    : packageName
+
+  // Ensure package is installed.
+  const { installed, packageDir } = await ensurePackageInstalled(
+    packageName,
+    fullPackageSpec,
+    force,
+  )
+
+  // Find binary path.
+  const binaryPath = findBinaryPath(packageDir, packageName, binaryName)
+
+  // Make all binaries in the package executable on Unix systems.
+  makePackageBinsExecutable(packageDir, packageName)
+
+  return {
+    binaryPath,
+    installed,
+    packageDir,
+  }
+}
+
+/**
+ * Execute a package's binary with cross-platform shell handling.
+ * The package must already be installed (use downloadPackage first).
+ *
+ * On Windows, script files (.bat, .cmd, .ps1) require shell: true.
+ * Matches npm/npx execution behavior.
+ *
+ * @example
+ * ```typescript
+ * // Execute an already-installed package
+ * const downloaded = await downloadPackage({ package: 'cowsay@1.5.0' })
+ * const result = await executePackage(
+ *   downloaded.binaryPath,
+ *   ['Hello World'],
+ *   { stdio: 'inherit' }
+ * )
+ * ```
+ */
+export function executePackage(
+  binaryPath: string,
+  args: readonly string[] | string[],
+  spawnOptions?: SpawnOptions | undefined,
+  spawnExtra?: SpawnExtra | undefined,
+): ReturnType<typeof spawn> {
+  // On Windows, script files (.bat, .cmd, .ps1) require shell: true
+  // because they are not executable on their own and must be run through cmd.exe.
+  // .exe files are actual binaries and don't need shell mode.
+  const needsShell = WIN32 && /\.(?:bat|cmd|ps1)$/i.test(binaryPath)
+
+  const finalOptions = needsShell
+    ? {
+        ...spawnOptions,
+        shell: true,
+      }
+    : spawnOptions
+
+  return spawn(binaryPath, args, finalOptions, spawnExtra)
+}
diff --git a/src/dlx.ts b/src/dlx.ts
index 520d90a..f032259 100644
--- a/src/dlx.ts
+++ b/src/dlx.ts
@@ -1,12 +1,58 @@
 /** @fileoverview DLX (execute package) utilities for Socket ecosystem shared installations. */
 
-import { existsSync, promises as fs } from 'node:fs'
+import { createHash } from 'crypto'
 
-import { readDirNamesSync, safeDelete } from './fs'
+import { readDirNamesSync, safeDelete, safeMkdir, safeMkdirSync } from './fs'
 import { normalizePath } from './path'
 import { getSocketDlxDir } from './paths'
 import { pEach } from './promises'
 
+let _fs: typeof import('fs') | undefined
+/**
+ * Lazily load the fs module to avoid Webpack errors.
+ * Uses non-'node:' prefixed require to prevent Webpack bundling issues.
+ *
+ * @returns The Node.js fs module
+ * @private
+ */
+/*@__NO_SIDE_EFFECTS__*/
+function getFs() {
+  if (_fs === undefined) {
+    // Use non-'node:' prefixed require to avoid Webpack errors.
+
+    _fs = /*@__PURE__*/ require('node:fs')
+  }
+  return _fs as typeof import('fs')
+}
+
+/**
+ * Generate a cache directory name using npm/npx approach.
+ * Uses first 16 characters of SHA-512 hash (like npm/npx).
+ *
+ * Rationale for SHA-512 truncated (vs full SHA-256):
+ * - Matches npm/npx ecosystem behavior
+ * - Shorter paths for Windows MAX_PATH compatibility (260 chars)
+ * - 16 hex chars = 64 bits = acceptable collision risk for local cache
+ * - Collision probability ~1 in 18 quintillion with 1000 entries
+ *
+ * Input strategy (aligned with npx):
+ * - npx uses package spec strings (e.g., '@scope/pkg@1.0.0', 'prettier@3.0.0')
+ * - Caller provides complete spec string with version for accurate cache keying
+ * - For package installs: Use PURL-style spec with version
+ *   Examples: 'npm:prettier@3.0.0', 'pypi:requests@2.31.0', 'gem:rails@7.0.0'
+ *   Note: Socket uses shorthand format without 'pkg:' prefix
+ *   (handled by @socketregistry/packageurl-js)
+ * - For binary downloads: Use URL:name for uniqueness
+ *
+ * Reference: npm/cli v11.6.2 libnpmexec/lib/index.js#L233-L244
+ * https://github.com/npm/cli/blob/v11.6.2/workspaces/libnpmexec/lib/index.js#L233-L244
+ * Implementation: packages.map().sort().join('\n') → SHA-512 → slice(0,16)
+ * npx hashes the package spec (name@version), not just name
+ */
+export function generateCacheKey(spec: string): string {
+  return createHash('sha512').update(spec).digest('hex').substring(0, 16)
+}
+
 let _path: typeof import('path') | undefined
 /**
  * Lazily load the path module to avoid Webpack errors.
@@ -19,7 +65,6 @@ function getPath() {
 
     _path = /*@__PURE__*/ require('node:path')
   }
-  // biome-ignore lint/style/noNonNullAssertion: Initialized above.
   return _path!
 }
 
@@ -45,15 +90,17 @@ export function clearDlxSync(): void {
  * Check if the DLX directory exists.
  */
 export function dlxDirExists(): boolean {
-  return existsSync(getSocketDlxDir())
+  const fs = getFs()
+  return fs.existsSync(getSocketDlxDir())
 }
 
 /**
  * Check if the DLX directory exists asynchronously.
  */
 export async function dlxDirExistsAsync(): Promise<boolean> {
+  const fs = getFs()
   try {
-    await fs.access(getSocketDlxDir())
+    await fs.promises.access(getSocketDlxDir())
     return true
   } catch {
     return false
@@ -64,15 +111,14 @@ export async function dlxDirExistsAsync(): Promise<boolean> {
  * Ensure the DLX directory exists, creating it if necessary.
  */
 export async function ensureDlxDir(): Promise<void> {
-  await fs.mkdir(getSocketDlxDir(), { recursive: true })
+  await safeMkdir(getSocketDlxDir())
 }
 
 /**
  * Ensure the DLX directory exists synchronously, creating it if necessary.
  */
 export function ensureDlxDirSync(): void {
-  const { mkdirSync } = require('node:fs')
-  mkdirSync(getSocketDlxDir(), { recursive: true })
+  safeMkdirSync(getSocketDlxDir())
 }
 
 /**
@@ -111,11 +157,40 @@ export function getDlxPackageNodeModulesDir(packageName: string): string {
   return normalizePath(path.join(getDlxPackageDir(packageName), 'node_modules'))
 }
 
+/**
+ * Check if a file path is within the Socket DLX directory.
+ * This is useful for determining if a binary or file is managed by Socket's DLX system.
+ *
+ * @param filePath - Absolute or relative path to check
+ * @returns true if the path is within ~/.socket/_dlx/, false otherwise
+ *
+ * @example
+ * ```typescript
+ * isInSocketDlx('/home/user/.socket/_dlx/abc123/bin/socket') // true
+ * isInSocketDlx('/usr/local/bin/socket') // false
+ * isInSocketDlx(process.argv[0]) // Check if current binary is in DLX
+ * ```
+ */
+export function isInSocketDlx(filePath: string): boolean {
+  if (!filePath) {
+    return false
+  }
+
+  const path = getPath()
+  const dlxDir = getSocketDlxDir()
+  const absolutePath = normalizePath(path.resolve(filePath))
+
+  // Check if the absolute path starts with the DLX directory.
+  // Both paths are normalized to use forward slashes for consistent comparison.
+  return absolutePath.startsWith(`${dlxDir}/`)
+}
+
 /**
  * Check if a package is installed in DLX.
  */
 export function isDlxPackageInstalled(packageName: string): boolean {
-  return existsSync(getDlxInstalledPackageDir(packageName))
+  const fs = getFs()
+  return fs.existsSync(getDlxInstalledPackageDir(packageName))
 }
 
 /**
@@ -124,8 +199,9 @@ export function isDlxPackageInstalled(packageName: string): boolean {
 export async function isDlxPackageInstalledAsync(
   packageName: string,
 ): Promise<boolean> {
+  const fs = getFs()
   try {
-    await fs.access(getDlxInstalledPackageDir(packageName))
+    await fs.promises.access(getDlxInstalledPackageDir(packageName))
     return true
   } catch {
     return false
@@ -147,8 +223,9 @@ export function listDlxPackages(): string[] {
  * List all packages installed in DLX asynchronously.
  */
 export async function listDlxPackagesAsync(): Promise<string[]> {
+  const fs = getFs()
   try {
-    const entries = await fs.readdir(getSocketDlxDir(), {
+    const entries = await fs.promises.readdir(getSocketDlxDir(), {
       withFileTypes: true,
     })
     return entries
@@ -178,13 +255,37 @@ export async function removeDlxPackage(packageName: string): Promise<void> {
  * Remove a DLX package installation synchronously.
  */
 export function removeDlxPackageSync(packageName: string): void {
-  const { rmSync } = require('node:fs')
+  const fs = getFs()
   const packageDir = getDlxPackageDir(packageName)
   try {
-    rmSync(packageDir, { recursive: true, force: true })
+    fs.rmSync(packageDir, { recursive: true, force: true })
   } catch (e) {
-    throw new Error(`Failed to remove DLX package "${packageName}"`, {
-      cause: e,
-    })
+    const code = (e as NodeJS.ErrnoException).code
+    if (code === 'EACCES' || code === 'EPERM') {
+      throw new Error(
+        `Permission denied removing DLX package "${packageName}"\n` +
+          `Directory: ${packageDir}\n` +
+          'To resolve:\n' +
+          '  1. Check file/directory permissions\n' +
+          '  2. Close any programs using files in this directory\n' +
+          '  3. Try running with elevated privileges if necessary\n' +
+          `  4. Manually remove: rm -rf "${packageDir}"`,
+        { cause: e },
+      )
+    }
+    if (code === 'EROFS') {
+      throw new Error(
+        `Cannot remove DLX package "${packageName}" from read-only filesystem\n` +
+          `Directory: ${packageDir}\n` +
+          'The filesystem is mounted read-only.',
+        { cause: e },
+      )
+    }
+    throw new Error(
+      `Failed to remove DLX package "${packageName}"\n` +
+        `Directory: ${packageDir}\n` +
+        'Check permissions and ensure no programs are using this directory.',
+      { cause: e },
+    )
   }
 }
diff --git a/src/download-lock.ts b/src/download-lock.ts
deleted file mode 100644
index 4ac328d..0000000
--- a/src/download-lock.ts
+++ /dev/null
@@ -1,237 +0,0 @@
-/** @fileoverview Download locking utilities to prevent concurrent downloads of the same resource. Uses file-based locking for cross-process synchronization. */
-
-import { existsSync } from 'node:fs'
-import { mkdir, readFile, rm, stat, writeFile } from 'node:fs/promises'
-import { dirname, join } from 'node:path'
-import type { HttpDownloadOptions, HttpDownloadResult } from './http-request'
-import { httpDownload } from './http-request'
-
-export interface DownloadLockInfo {
-  pid: number
-  startTime: number
-  url: string
-}
-
-export interface DownloadWithLockOptions extends HttpDownloadOptions {
-  /**
-   * Maximum time to wait for lock acquisition in milliseconds.
-   * @default 60000 (1 minute)
-   */
-  lockTimeout?: number | undefined
-  /**
-   * Directory where lock files are stored.
-   * @default '<destPath>.locks'
-   */
-  locksDir?: string | undefined
-  /**
-   * Interval for checking stale locks in milliseconds.
-   * @default 1000 (1 second)
-   */
-  pollInterval?: number | undefined
-  /**
-   * Maximum age of a lock before it's considered stale in milliseconds.
-   * @default 300000 (5 minutes)
-   */
-  staleTimeout?: number | undefined
-}
-
-/**
- * Get the path to the lock file for a destination path.
- */
-function getLockFilePath(destPath: string, locksDir?: string): string {
-  const dir = locksDir || `${dirname(destPath)}/.locks`
-  const filename = `${destPath.replace(/[^\w.-]/g, '_')}.lock`
-  return join(dir, filename)
-}
-
-/**
- * Check if a lock is stale (process no longer exists or too old).
- */
-function isLockStale(
-  lockInfo: DownloadLockInfo,
-  staleTimeout: number,
-): boolean {
-  // Check if lock is too old
-  const age = Date.now() - lockInfo.startTime
-  if (age > staleTimeout) {
-    return true
-  }
-
-  // Check if process still exists (Node.js specific)
-  try {
-    // process.kill(pid, 0) doesn't actually kill the process
-    // It just checks if the process exists
-    process.kill(lockInfo.pid, 0)
-    return false
-  } catch {
-    // Process doesn't exist
-    return true
-  }
-}
-
-/**
- * Acquire a lock for downloading to a destination path.
- * @throws {Error} When lock cannot be acquired within timeout.
- */
-async function acquireLock(
-  destPath: string,
-  url: string,
-  options: {
-    lockTimeout: number
-    locksDir?: string | undefined
-    pollInterval: number
-    staleTimeout: number
-  },
-): Promise<string> {
-  const { lockTimeout, locksDir, pollInterval, staleTimeout } = options
-  const lockPath = getLockFilePath(destPath, locksDir)
-  const lockDir = dirname(lockPath)
-
-  // Ensure lock directory exists
-  await mkdir(lockDir, { recursive: true })
-
-  const startTime = Date.now()
-
-  while (true) {
-    try {
-      // Try to read existing lock
-      if (existsSync(lockPath)) {
-        // eslint-disable-next-line no-await-in-loop
-        const lockContent = await readFile(lockPath, 'utf8')
-        const lockInfo: DownloadLockInfo = JSON.parse(lockContent)
-
-        // Check if lock is stale
-        if (isLockStale(lockInfo, staleTimeout)) {
-          // Remove stale lock
-          // eslint-disable-next-line no-await-in-loop
-          await rm(lockPath, { force: true })
-        } else {
-          // Lock is valid, check timeout
-          if (Date.now() - startTime > lockTimeout) {
-            throw new Error(
-              `Lock acquisition timed out after ${lockTimeout}ms (held by PID ${lockInfo.pid})`,
-            )
-          }
-
-          // Wait and retry
-          // eslint-disable-next-line no-await-in-loop
-          await new Promise(resolve => setTimeout(resolve, pollInterval))
-          continue
-        }
-      }
-
-      // Try to create lock file
-      const lockInfo: DownloadLockInfo = {
-        pid: process.pid,
-        startTime: Date.now(),
-        url,
-      }
-
-      // eslint-disable-next-line no-await-in-loop
-      await writeFile(lockPath, JSON.stringify(lockInfo, null, 2), {
-        // Use 'wx' flag to fail if file exists (atomic operation)
-        flag: 'wx',
-      })
-
-      // Successfully acquired lock
-      return lockPath
-    } catch (e) {
-      // If file already exists, another process created it first
-      if ((e as NodeJS.ErrnoException).code === 'EEXIST') {
-        if (Date.now() - startTime > lockTimeout) {
-          throw new Error(`Lock acquisition timed out after ${lockTimeout}ms`)
-        }
-        // eslint-disable-next-line no-await-in-loop
-        await new Promise(resolve => setTimeout(resolve, pollInterval))
-        continue
-      }
-
-      // Other error
-      throw e
-    }
-  }
-}
-
-/**
- * Release a lock by removing the lock file.
- */
-async function releaseLock(lockPath: string): Promise<void> {
-  try {
-    await rm(lockPath, { force: true })
-  } catch {
-    // Ignore errors when releasing lock
-  }
-}
-
-/**
- * Download a file with locking to prevent concurrent downloads of the same resource.
- * If another process is already downloading to the same destination, this will wait
- * for the download to complete (up to lockTimeout) before proceeding.
- *
- * @throws {Error} When download fails or lock cannot be acquired.
- *
- * @example
- * ```typescript
- * const result = await downloadWithLock(
- *   'https://example.com/file.tar.gz',
- *   '/tmp/downloads/file.tar.gz',
- *   {
- *     retries: 3,
- *     lockTimeout: 60000, // Wait up to 1 minute for other downloads
- *   }
- * )
- * ```
- */
-export async function downloadWithLock(
-  url: string,
-  destPath: string,
-  options?: DownloadWithLockOptions | undefined,
-): Promise<HttpDownloadResult> {
-  const {
-    lockTimeout = 60_000,
-    locksDir,
-    pollInterval = 1000,
-    staleTimeout = 300_000,
-    ...downloadOptions
-  } = { __proto__: null, ...options } as DownloadWithLockOptions
-
-  // If file already exists and has content, return immediately
-  if (existsSync(destPath)) {
-    const statResult = await stat(destPath).catch(() => null)
-    if (statResult && statResult.size > 0) {
-      return {
-        path: destPath,
-        size: statResult.size,
-      }
-    }
-  }
-
-  // Acquire lock
-  const lockPath = await acquireLock(destPath, url, {
-    lockTimeout,
-    locksDir,
-    pollInterval,
-    staleTimeout,
-  })
-
-  try {
-    // Check again if file was created while we were waiting for lock
-    if (existsSync(destPath)) {
-      const statResult = await stat(destPath).catch(() => null)
-      if (statResult && statResult.size > 0) {
-        return {
-          path: destPath,
-          size: statResult.size,
-        }
-      }
-    }
-
-    // Perform download
-    const result = await httpDownload(url, destPath, downloadOptions)
-
-    return result
-  } finally {
-    // Always release lock
-    await releaseLock(lockPath)
-  }
-}
diff --git a/src/effects/pulse-frames.ts b/src/effects/pulse-frames.ts
index 6eb588c..bdffae7 100644
--- a/src/effects/pulse-frames.ts
+++ b/src/effects/pulse-frames.ts
@@ -7,6 +7,16 @@
 export type SocketFramesOptions = {
   readonly baseColor?: readonly [number, number, number] | undefined
   readonly interval?: number | undefined
+  /**
+   * Theme to use for pulse colors.
+   * Can be a theme name ('socket', 'sunset', etc.) or a Theme object.
+   * Note: Currently frames only contain brightness modifiers.
+   * Colors are applied by yocto-spinner based on spinner.color.
+   */
+  readonly theme?:
+    | import('../themes/types').Theme
+    | import('../themes/themes').ThemeName
+    | undefined
 }
 
 /**
@@ -40,9 +50,9 @@ export function generateSocketSpinnerFrames(
   // - Yocto-spinner adds 1 space after each frame
   // - Success/fail symbols also get 1 space (consistent)
   const lightning = '⚡\uFE0E'
-  const starFilled = '✦\uFE0E'
-  const starOutline = '✧\uFE0E'
-  const starTiny = '⋆\uFE0E'
+  const starFilled = '✦\uFE0E '
+  const starOutline = '✧\uFE0E '
+  const starTiny = '⋆\uFE0E '
 
   // Pulse frames with brightness modifiers only.
   // Each frame gets colored by yocto-spinner based on current spinner.color.
diff --git a/src/effects/text-shimmer.ts b/src/effects/text-shimmer.ts
index b271edf..67df8f8 100644
--- a/src/effects/text-shimmer.ts
+++ b/src/effects/text-shimmer.ts
@@ -14,6 +14,10 @@
 
 import { ANSI_RESET, stripAnsi } from '../ansi'
 import { isArray } from '../arrays'
+import { getCI } from '#env/ci'
+import { resolveColor } from '../themes/utils'
+import { THEMES } from '../themes/themes'
+import type { ColorValue } from '../colors'
 
 import type {
   ShimmerColorGradient,
@@ -94,6 +98,10 @@ type ShimmerOptions = {
   readonly direction?: ShimmerDirection | undefined
   readonly shimmerWidth?: number | undefined
   readonly styles?: TextStyles | undefined
+  readonly theme?:
+    | import('../themes/types').Theme
+    | import('../themes/themes').ThemeName
+    | undefined
 }
 
 export const COLOR_INHERIT = 'inherit'
@@ -241,8 +249,25 @@ export function applyShimmer(
   const opts = { __proto__: null, ...options } as ShimmerOptions
   const direction = opts.direction ?? DIR_NONE
   const shimmerWidth = opts.shimmerWidth ?? 2.5
-  // Socket purple.
-  const color = opts.color ?? ([140, 82, 255] as const)
+
+  // Resolve color from theme or use provided color or default Socket purple.
+  let color: ShimmerColorRgb | ShimmerColorGradient
+  if (opts.theme) {
+    // Resolve theme to Theme object
+    const theme =
+      typeof opts.theme === 'string' ? THEMES[opts.theme] : opts.theme
+    // Use theme's primary color
+    const themeColor = resolveColor(
+      theme.colors.primary,
+      theme.colors,
+    ) as ColorValue
+    // Convert ColorValue to ShimmerColorRgb
+    // Fallback to Socket purple if color is a string
+    color =
+      typeof themeColor === 'string' ? ([140, 82, 255] as const) : themeColor
+  } else {
+    color = opts.color ?? ([140, 82, 255] as const)
+  }
 
   // Detect text formatting styles from original text.
   const styles = opts.styles ?? detectStyles(text)
@@ -250,8 +275,8 @@ export function applyShimmer(
   // Strip ANSI codes to get plain text.
   const plainText = stripAnsi(text)
 
-  // No shimmer effect.
-  if (!plainText || direction === DIR_NONE) {
+  // No shimmer effect in CI or when direction is 'none'.
+  if (getCI() || !plainText || direction === DIR_NONE) {
     const styleCode = stylesToAnsi(styles)
 
     // Support gradient colors (array of colors, one per character).
diff --git a/src/effects/types.ts b/src/effects/types.ts
index eadc639..2af19d7 100644
--- a/src/effects/types.ts
+++ b/src/effects/types.ts
@@ -26,6 +26,15 @@ export type ShimmerConfig = {
    * Default: 1/3 (~0.33).
    */
   readonly speed?: number | undefined
+  /**
+   * Theme to use for shimmer colors.
+   * Can be a theme name ('socket', 'sunset', etc.) or a Theme object.
+   * If provided, overrides the color option.
+   */
+  readonly theme?:
+    | import('../themes/types').Theme
+    | import('../themes/themes').ThemeName
+    | undefined
 }
 
 /**
diff --git a/src/env.ts b/src/env.ts
index 98459f4..2960785 100644
--- a/src/env.ts
+++ b/src/env.ts
@@ -12,6 +12,167 @@ const NumberIsFinite = Number.isFinite
 const NumberParseInt = Number.parseInt
 const StringCtor = String
 
+// Common environment variables that have case sensitivity issues on Windows.
+// These are checked with case-insensitive matching when exact matches fail.
+const caseInsensitiveKeys = new Set([
+  'APPDATA',
+  'COMSPEC',
+  'HOME',
+  'LOCALAPPDATA',
+  'PATH',
+  'PATHEXT',
+  'PROGRAMFILES',
+  'SYSTEMROOT',
+  'TEMP',
+  'TMP',
+  'USERPROFILE',
+  'WINDIR',
+])
+
+/**
+ * Create a case-insensitive environment variable Proxy for Windows compatibility.
+ * On Windows, environment variables are case-insensitive (PATH vs Path vs path).
+ * This Proxy provides consistent access regardless of case, with priority given
+ * to exact matches, then case-insensitive matches for known vars.
+ *
+ * **Use Cases:**
+ * - Cross-platform test environments needing consistent env var access
+ * - Windows compatibility when passing env to child processes
+ * - Merging environment overrides while preserving case-insensitive lookups
+ *
+ * **Performance Note:**
+ * Proxy operations have runtime overhead. Only use when Windows case-insensitive
+ * access is required. For most use cases, process.env directly is sufficient.
+ *
+ * @param base - Base environment object (usually process.env)
+ * @param overrides - Optional overrides to merge
+ * @returns Proxy that handles case-insensitive env var access
+ *
+ * @example
+ * // Create a Proxy with overrides
+ * const env = createEnvProxy(process.env, { NODE_ENV: 'test' })
+ * console.log(env.PATH)  // Works with any case: PATH, Path, path
+ * console.log(env.NODE_ENV)  // 'test'
+ *
+ * @example
+ * // Pass to child process spawn
+ * import { createEnvProxy } from '@socketsecurity/lib/env'
+ * import { spawn } from '@socketsecurity/lib/spawn'
+ *
+ * spawn('node', ['script.js'], {
+ *   env: createEnvProxy(process.env, { NODE_ENV: 'test' })
+ * })
+ */
+export function createEnvProxy(
+  base: NodeJS.ProcessEnv,
+  overrides?: Record<string, string | undefined>,
+): NodeJS.ProcessEnv {
+  return new Proxy(
+    {},
+    {
+      get(_target, prop) {
+        if (typeof prop !== 'string') {
+          return undefined
+        }
+
+        // Priority 1: Check overrides for exact match.
+        if (overrides && prop in overrides) {
+          return overrides[prop]
+        }
+
+        // Priority 2: Check base for exact match.
+        if (prop in base) {
+          return base[prop]
+        }
+
+        // Priority 3: Case-insensitive lookup for known keys.
+        const upperProp = prop.toUpperCase()
+        if (caseInsensitiveKeys.has(upperProp)) {
+          // Check overrides with case variations.
+          if (overrides) {
+            const key = findCaseInsensitiveEnvKey(overrides, upperProp)
+            if (key !== undefined) {
+              return overrides[key]
+            }
+          }
+          // Check base with case variations.
+          const key = findCaseInsensitiveEnvKey(base, upperProp)
+          if (key !== undefined) {
+            return base[key]
+          }
+        }
+
+        return undefined
+      },
+
+      ownKeys(_target) {
+        const keys = new Set<string>([
+          ...Object.keys(base),
+          ...(overrides ? Object.keys(overrides) : []),
+        ])
+        return [...keys]
+      },
+
+      getOwnPropertyDescriptor(_target, prop) {
+        if (typeof prop !== 'string') {
+          return undefined
+        }
+
+        // Use the same lookup logic as get().
+        const value = this.get?.(_target, prop, _target)
+        return value !== undefined
+          ? {
+              enumerable: true,
+              configurable: true,
+              writable: true,
+              value,
+            }
+          : undefined
+      },
+
+      has(_target, prop) {
+        if (typeof prop !== 'string') {
+          return false
+        }
+
+        // Check overrides.
+        if (overrides && prop in overrides) {
+          return true
+        }
+
+        // Check base.
+        if (prop in base) {
+          return true
+        }
+
+        // Case-insensitive check.
+        const upperProp = prop.toUpperCase()
+        if (caseInsensitiveKeys.has(upperProp)) {
+          if (
+            overrides &&
+            findCaseInsensitiveEnvKey(overrides, upperProp) !== undefined
+          ) {
+            return true
+          }
+          if (findCaseInsensitiveEnvKey(base, upperProp) !== undefined) {
+            return true
+          }
+        }
+
+        return false
+      },
+
+      set(_target, prop, value) {
+        if (typeof prop === 'string' && overrides) {
+          overrides[prop] = value
+          return true
+        }
+        return false
+      },
+    },
+  ) as NodeJS.ProcessEnv
+}
+
 /**
  * Convert an environment variable value to a boolean.
  */
@@ -53,3 +214,52 @@ export function envAsString(value: unknown, defaultValue = ''): string {
   }
   return StringCtor(value).trim()
 }
+
+/**
+ * Find a case-insensitive environment variable key match.
+ * Searches for an environment variable key that matches the given uppercase name,
+ * using optimized fast-path checks to minimize expensive toUpperCase() calls.
+ *
+ * **Use Cases:**
+ * - Finding PATH when env object has "Path" or "path"
+ * - Cross-platform env var access where case may vary
+ * - Custom case-insensitive env lookups
+ *
+ * **Performance:**
+ * - Fast path: Checks length first (O(1)) before toUpperCase (expensive)
+ * - Only converts to uppercase when length matches
+ * - Early exit on first match
+ *
+ * @param env - Environment object or env-like record to search
+ * @param upperEnvVarName - Uppercase environment variable name to find (e.g., 'PATH')
+ * @returns The actual key from env that matches (e.g., 'Path'), or undefined
+ *
+ * @example
+ * // Find PATH regardless of case
+ * const envObj = { Path: 'C:\\Windows', NODE_ENV: 'test' }
+ * const key = findCaseInsensitiveEnvKey(envObj, 'PATH')
+ * console.log(key)  // 'Path'
+ * console.log(envObj[key])  // 'C:\\Windows'
+ *
+ * @example
+ * // Not found returns undefined
+ * const key = findCaseInsensitiveEnvKey({}, 'MISSING')
+ * console.log(key)  // undefined
+ */
+export function findCaseInsensitiveEnvKey(
+  env: Record<string, string | undefined>,
+  upperEnvVarName: string,
+): string | undefined {
+  const targetLength = upperEnvVarName.length
+  for (const key of Object.keys(env)) {
+    // Fast path: bail early if lengths don't match.
+    if (key.length !== targetLength) {
+      continue
+    }
+    // Only call toUpperCase if length matches.
+    if (key.toUpperCase() === upperEnvVarName) {
+      return key
+    }
+  }
+  return undefined
+}
diff --git a/src/env/appdata.ts b/src/env/appdata.ts
deleted file mode 100644
index 5393f8b..0000000
--- a/src/env/appdata.ts
+++ /dev/null
@@ -1,8 +0,0 @@
-/**
- * APPDATA environment variable snapshot.
- * Points to the Application Data directory on Windows.
- */
-
-import { env } from 'node:process'
-
-export const APPDATA = env['APPDATA']
diff --git a/src/env/ci.ts b/src/env/ci.ts
index 39daf51..370a458 100644
--- a/src/env/ci.ts
+++ b/src/env/ci.ts
@@ -1,10 +1,11 @@
 /**
- * CI environment variable snapshot.
+ * CI environment variable getter.
  * Determines if code is running in a Continuous Integration environment.
  */
 
-import { env } from 'node:process'
-
 import { envAsBoolean } from '#env/helpers'
+import { getEnvValue } from '#env/rewire'
 
-export const CI = envAsBoolean(env['CI'])
+export function getCI(): boolean {
+  return envAsBoolean(getEnvValue('CI'))
+}
diff --git a/src/env/comspec.ts b/src/env/comspec.ts
deleted file mode 100644
index 0936242..0000000
--- a/src/env/comspec.ts
+++ /dev/null
@@ -1,8 +0,0 @@
-/**
- * COMSPEC environment variable snapshot.
- * Windows command interpreter path.
- */
-
-import { env } from 'node:process'
-
-export const COMSPEC = env['COMSPEC']
diff --git a/src/env/debug.ts b/src/env/debug.ts
index ec8cb28..f92d5f7 100644
--- a/src/env/debug.ts
+++ b/src/env/debug.ts
@@ -1,8 +1,10 @@
 /**
- * DEBUG environment variable snapshot.
+ * DEBUG environment variable getter.
  * Controls debug output for the debug package.
  */
 
-import { env } from 'node:process'
+import { getEnvValue } from '#env/rewire'
 
-export const DEBUG = env['DEBUG']
+export function getDebug(): string | undefined {
+  return getEnvValue('DEBUG')
+}
diff --git a/src/env/getters.ts b/src/env/getters.ts
deleted file mode 100644
index 9ecc316..0000000
--- a/src/env/getters.ts
+++ /dev/null
@@ -1,222 +0,0 @@
-/**
- * @fileoverview Environment variable getter functions.
- * Provides convenient getter functions that wrap env module constants.
- */
-
-import { CI } from '#env/ci'
-import { DEBUG } from '#env/debug'
-import { GITHUB_API_URL } from '#env/github-api-url'
-import { GITHUB_BASE_REF } from '#env/github-base-ref'
-import { GITHUB_REF_NAME } from '#env/github-ref-name'
-import { GITHUB_REF_TYPE } from '#env/github-ref-type'
-import { GITHUB_REPOSITORY } from '#env/github-repository'
-import { GITHUB_SERVER_URL } from '#env/github-server-url'
-import { GITHUB_TOKEN } from '#env/github-token'
-import { envAsString } from '#env/helpers'
-import { HOME } from '#env/home'
-import { JEST_WORKER_ID } from '#env/jest-worker-id'
-import { LANG } from '#env/lang'
-import { LC_ALL } from '#env/lc-all'
-import { LC_MESSAGES } from '#env/lc-messages'
-import { NODE_AUTH_TOKEN } from '#env/node-auth-token'
-import { NODE_ENV } from '#env/node-env'
-import { npm_config_registry } from '#env/npm-config-registry'
-import { npm_config_user_agent } from '#env/npm-config-user-agent'
-import { npm_lifecycle_event } from '#env/npm-lifecycle-event'
-import { NPM_REGISTRY } from '#env/npm-registry'
-import { NPM_TOKEN } from '#env/npm-token'
-import { PATH } from '#env/path'
-import { PRE_COMMIT } from '#env/pre-commit'
-import { SHELL } from '#env/shell'
-import { SOCKET_ACCEPT_RISKS } from '#env/socket-accept-risks'
-import { SOCKET_API_BASE_URL } from '#env/socket-api-base-url'
-import { SOCKET_API_PROXY } from '#env/socket-api-proxy'
-import { SOCKET_API_TIMEOUT } from '#env/socket-api-timeout'
-import { SOCKET_API_TOKEN } from '#env/socket-api-token'
-import { SOCKET_CLI_ACCEPT_RISKS } from '#env/socket-cli-accept-risks'
-import { SOCKET_CLI_API_BASE_URL } from '#env/socket-cli-api-base-url'
-import { SOCKET_CLI_API_PROXY } from '#env/socket-cli-api-proxy'
-import { SOCKET_CLI_API_TIMEOUT } from '#env/socket-cli-api-timeout'
-import { SOCKET_CLI_API_TOKEN } from '#env/socket-cli-api-token'
-import { SOCKET_CLI_CONFIG } from '#env/socket-cli-config'
-import { SOCKET_CLI_NO_API_TOKEN } from '#env/socket-cli-no-api-token'
-import { SOCKET_CLI_ORG_SLUG } from '#env/socket-cli-org-slug'
-import { SOCKET_CLI_VIEW_ALL_RISKS } from '#env/socket-cli-view-all-risks'
-import { SOCKET_CONFIG } from '#env/socket-config'
-import { SOCKET_DEBUG } from '#env/socket-debug'
-import { SOCKET_HOME } from '#env/socket-home'
-import { SOCKET_NO_API_TOKEN } from '#env/socket-no-api-token'
-import { SOCKET_NPM_REGISTRY } from '#env/socket-npm-registry'
-import { SOCKET_ORG_SLUG } from '#env/socket-org-slug'
-import { SOCKET_REGISTRY_URL } from '#env/socket-registry-url'
-import { SOCKET_VIEW_ALL_RISKS } from '#env/socket-view-all-risks'
-import { TEMP } from '#env/temp'
-import { TERM } from '#env/term'
-import { TMP } from '#env/tmp'
-import { TMPDIR } from '#env/tmpdir'
-import { USERPROFILE } from '#env/userprofile'
-import { VITEST } from '#env/vitest'
-import { XDG_CACHE_HOME } from '#env/xdg-cache-home'
-import { XDG_CONFIG_HOME } from '#env/xdg-config-home'
-import { XDG_DATA_HOME } from '#env/xdg-data-home'
-
-export function getNodeEnv(): string {
-  return envAsString(NODE_ENV) || 'production'
-}
-
-export function isProduction(): boolean {
-  return getNodeEnv() === 'production'
-}
-
-export function isDevelopment(): boolean {
-  return getNodeEnv() === 'development'
-}
-
-export function isTest(): boolean {
-  const nodeEnv = getNodeEnv()
-  return nodeEnv === 'test' || !!VITEST || !!JEST_WORKER_ID
-}
-
-export function isCI(): boolean {
-  return CI
-}
-
-export function getNodeAuthToken(): string | undefined {
-  return NODE_AUTH_TOKEN
-}
-
-export function getNpmToken(): string | undefined {
-  return NPM_TOKEN
-}
-
-export function getNpmConfigUserAgent(): string | undefined {
-  return npm_config_user_agent
-}
-
-export function getNpmRegistry(): string | undefined {
-  return NPM_REGISTRY || npm_config_registry
-}
-
-export function getPath(): string {
-  return envAsString(PATH)
-}
-
-export function getHome(): string | undefined {
-  return HOME || USERPROFILE
-}
-
-export function getTemp(): string | undefined {
-  return TMPDIR || TEMP || TMP
-}
-
-export function getShell(): string | undefined {
-  return SHELL
-}
-
-export function getTerm(): string | undefined {
-  return TERM
-}
-
-export function getLocale(): string {
-  return LANG || LC_ALL || LC_MESSAGES || 'en_US.UTF-8'
-}
-
-export function getGithubToken(): string | undefined {
-  return GITHUB_TOKEN
-}
-
-export function getGithubServerUrl(): string {
-  return envAsString(GITHUB_SERVER_URL) || 'https://github.com'
-}
-
-export function getGithubApiUrl(): string {
-  return envAsString(GITHUB_API_URL) || 'https://api.github.com'
-}
-
-export function getGithubRepository(): string | undefined {
-  return GITHUB_REPOSITORY
-}
-
-export function getGithubRefName(): string | undefined {
-  return GITHUB_REF_NAME
-}
-
-export function getGithubRefType(): string | undefined {
-  return GITHUB_REF_TYPE
-}
-
-export function getGithubBaseRef(): string | undefined {
-  return GITHUB_BASE_REF
-}
-
-export function getSocketApiToken(): string | undefined {
-  return SOCKET_API_TOKEN || SOCKET_CLI_API_TOKEN
-}
-
-export function getSocketApiBaseUrl(): string | undefined {
-  return SOCKET_API_BASE_URL || SOCKET_CLI_API_BASE_URL
-}
-
-export function getSocketApiProxy(): string | undefined {
-  return SOCKET_API_PROXY || SOCKET_CLI_API_PROXY
-}
-
-export function getSocketApiTimeout(): number {
-  return SOCKET_API_TIMEOUT || SOCKET_CLI_API_TIMEOUT
-}
-
-export function getSocketOrgSlug(): string | undefined {
-  return SOCKET_ORG_SLUG || SOCKET_CLI_ORG_SLUG
-}
-
-export function getSocketHome(): string | undefined {
-  return SOCKET_HOME
-}
-
-export function getSocketRegistryUrl(): string | undefined {
-  return SOCKET_REGISTRY_URL || SOCKET_NPM_REGISTRY
-}
-
-export function getSocketConfig(): string | undefined {
-  return SOCKET_CONFIG || SOCKET_CLI_CONFIG
-}
-
-export function getSocketAcceptRisks(): boolean {
-  return SOCKET_ACCEPT_RISKS || SOCKET_CLI_ACCEPT_RISKS
-}
-
-export function getSocketViewAllRisks(): boolean {
-  return SOCKET_VIEW_ALL_RISKS || SOCKET_CLI_VIEW_ALL_RISKS
-}
-
-export function getSocketNoApiToken(): boolean {
-  return SOCKET_NO_API_TOKEN || SOCKET_CLI_NO_API_TOKEN
-}
-
-export function isPreCommit(): boolean {
-  return PRE_COMMIT
-}
-
-export function getXdgDataHome(): string | undefined {
-  return XDG_DATA_HOME
-}
-
-export function getXdgConfigHome(): string | undefined {
-  return XDG_CONFIG_HOME
-}
-
-export function getXdgCacheHome(): string | undefined {
-  return XDG_CACHE_HOME
-}
-
-export function getNpmLifecycleEvent(): string | undefined {
-  return npm_lifecycle_event
-}
-
-export function getDebug(): string | undefined {
-  return DEBUG
-}
-
-export function getSocketDebug(): string | undefined {
-  return SOCKET_DEBUG
-}
diff --git a/src/env/github-api-url.ts b/src/env/github-api-url.ts
deleted file mode 100644
index 8374e51..0000000
--- a/src/env/github-api-url.ts
+++ /dev/null
@@ -1,8 +0,0 @@
-/**
- * GITHUB_API_URL environment variable snapshot.
- * GitHub API URL (e.g., https://api.github.com).
- */
-
-import { env } from 'node:process'
-
-export const GITHUB_API_URL = env['GITHUB_API_URL']
diff --git a/src/env/github-base-ref.ts b/src/env/github-base-ref.ts
deleted file mode 100644
index 5794ab6..0000000
--- a/src/env/github-base-ref.ts
+++ /dev/null
@@ -1,8 +0,0 @@
-/**
- * GITHUB_BASE_REF environment variable snapshot.
- * GitHub pull request base branch.
- */
-
-import { env } from 'node:process'
-
-export const GITHUB_BASE_REF = env['GITHUB_BASE_REF']
diff --git a/src/env/github-ref-name.ts b/src/env/github-ref-name.ts
deleted file mode 100644
index 3374176..0000000
--- a/src/env/github-ref-name.ts
+++ /dev/null
@@ -1,8 +0,0 @@
-/**
- * GITHUB_REF_NAME environment variable snapshot.
- * GitHub branch or tag name.
- */
-
-import { env } from 'node:process'
-
-export const GITHUB_REF_NAME = env['GITHUB_REF_NAME']
diff --git a/src/env/github-ref-type.ts b/src/env/github-ref-type.ts
deleted file mode 100644
index d37007c..0000000
--- a/src/env/github-ref-type.ts
+++ /dev/null
@@ -1,8 +0,0 @@
-/**
- * GITHUB_REF_TYPE environment variable snapshot.
- * GitHub ref type (branch or tag).
- */
-
-import { env } from 'node:process'
-
-export const GITHUB_REF_TYPE = env['GITHUB_REF_TYPE']
diff --git a/src/env/github-repository.ts b/src/env/github-repository.ts
deleted file mode 100644
index 18bef71..0000000
--- a/src/env/github-repository.ts
+++ /dev/null
@@ -1,8 +0,0 @@
-/**
- * GITHUB_REPOSITORY environment variable snapshot.
- * GitHub repository name in owner/repo format.
- */
-
-import { env } from 'node:process'
-
-export const GITHUB_REPOSITORY = env['GITHUB_REPOSITORY']
diff --git a/src/env/github-server-url.ts b/src/env/github-server-url.ts
deleted file mode 100644
index 8cccbfd..0000000
--- a/src/env/github-server-url.ts
+++ /dev/null
@@ -1,8 +0,0 @@
-/**
- * GITHUB_SERVER_URL environment variable snapshot.
- * GitHub server URL (e.g., https://github.com).
- */
-
-import { env } from 'node:process'
-
-export const GITHUB_SERVER_URL = env['GITHUB_SERVER_URL']
diff --git a/src/env/github-token.ts b/src/env/github-token.ts
deleted file mode 100644
index eb7881d..0000000
--- a/src/env/github-token.ts
+++ /dev/null
@@ -1,8 +0,0 @@
-/**
- * GITHUB_TOKEN environment variable snapshot.
- * GitHub authentication token for API access.
- */
-
-import { env } from 'node:process'
-
-export const GITHUB_TOKEN = env['GITHUB_TOKEN']
diff --git a/src/env/github.ts b/src/env/github.ts
new file mode 100644
index 0000000..dfd6100
--- /dev/null
+++ b/src/env/github.ts
@@ -0,0 +1,70 @@
+/**
+ * @fileoverview GitHub Actions environment variable getters.
+ * Provides access to GitHub Actions CI/CD environment variables.
+ */
+
+import { getEnvValue } from '#env/rewire'
+
+/**
+ * GITHUB_API_URL environment variable.
+ * GitHub API URL (e.g., https://api.github.com).
+ */
+export function getGithubApiUrl(): string | undefined {
+  return getEnvValue('GITHUB_API_URL')
+}
+
+/**
+ * GITHUB_BASE_REF environment variable.
+ * GitHub pull request base branch.
+ */
+export function getGithubBaseRef(): string | undefined {
+  return getEnvValue('GITHUB_BASE_REF')
+}
+
+/**
+ * GITHUB_REF_NAME environment variable.
+ * GitHub branch or tag name.
+ */
+export function getGithubRefName(): string | undefined {
+  return getEnvValue('GITHUB_REF_NAME')
+}
+
+/**
+ * GITHUB_REF_TYPE environment variable.
+ * GitHub ref type (branch or tag).
+ */
+export function getGithubRefType(): string | undefined {
+  return getEnvValue('GITHUB_REF_TYPE')
+}
+
+/**
+ * GITHUB_REPOSITORY environment variable.
+ * GitHub repository name in owner/repo format.
+ */
+export function getGithubRepository(): string | undefined {
+  return getEnvValue('GITHUB_REPOSITORY')
+}
+
+/**
+ * GITHUB_SERVER_URL environment variable.
+ * GitHub server URL (e.g., https://github.com).
+ */
+export function getGithubServerUrl(): string | undefined {
+  return getEnvValue('GITHUB_SERVER_URL')
+}
+
+/**
+ * GITHUB_TOKEN environment variable.
+ * GitHub authentication token for API access.
+ */
+export function getGithubToken(): string | undefined {
+  return getEnvValue('GITHUB_TOKEN')
+}
+
+/**
+ * GH_TOKEN environment variable.
+ * Alternative GitHub authentication token for API access (used by GitHub CLI).
+ */
+export function getGhToken(): string | undefined {
+  return getEnvValue('GH_TOKEN')
+}
diff --git a/src/env/home.ts b/src/env/home.ts
index 3120251..0eb0b30 100644
--- a/src/env/home.ts
+++ b/src/env/home.ts
@@ -1,8 +1,10 @@
 /**
- * HOME environment variable snapshot.
+ * HOME environment variable getter.
  * Points to the user's home directory.
  */
 
-import { env } from 'node:process'
+import { getEnvValue } from '#env/rewire'
 
-export const HOME = env['HOME']
+export function getHome(): string | undefined {
+  return getEnvValue('HOME')
+}
diff --git a/src/env/jest-worker-id.ts b/src/env/jest-worker-id.ts
deleted file mode 100644
index be0db0c..0000000
--- a/src/env/jest-worker-id.ts
+++ /dev/null
@@ -1,8 +0,0 @@
-/**
- * JEST_WORKER_ID environment variable snapshot.
- * Set when running tests with Jest.
- */
-
-import { env } from 'node:process'
-
-export const JEST_WORKER_ID = env['JEST_WORKER_ID']
diff --git a/src/env/lang.ts b/src/env/lang.ts
deleted file mode 100644
index 79b060f..0000000
--- a/src/env/lang.ts
+++ /dev/null
@@ -1,8 +0,0 @@
-/**
- * LANG environment variable snapshot.
- * System locale and language settings.
- */
-
-import { env } from 'node:process'
-
-export const LANG = env['LANG']
diff --git a/src/env/lc-all.ts b/src/env/lc-all.ts
deleted file mode 100644
index 4b5467c..0000000
--- a/src/env/lc-all.ts
+++ /dev/null
@@ -1,8 +0,0 @@
-/**
- * LC_ALL environment variable snapshot.
- * Override for all locale settings.
- */
-
-import { env } from 'node:process'
-
-export const LC_ALL = env['LC_ALL']
diff --git a/src/env/lc-messages.ts b/src/env/lc-messages.ts
deleted file mode 100644
index f160ffb..0000000
--- a/src/env/lc-messages.ts
+++ /dev/null
@@ -1,8 +0,0 @@
-/**
- * LC_MESSAGES environment variable snapshot.
- * Locale setting for message translations.
- */
-
-import { env } from 'node:process'
-
-export const LC_MESSAGES = env['LC_MESSAGES']
diff --git a/src/env/localappdata.ts b/src/env/localappdata.ts
deleted file mode 100644
index b403d91..0000000
--- a/src/env/localappdata.ts
+++ /dev/null
@@ -1,8 +0,0 @@
-/**
- * LOCALAPPDATA environment variable snapshot.
- * Points to the Local Application Data directory on Windows.
- */
-
-import { env } from 'node:process'
-
-export const LOCALAPPDATA = env['LOCALAPPDATA']
diff --git a/src/env/locale.ts b/src/env/locale.ts
new file mode 100644
index 0000000..ec62fdb
--- /dev/null
+++ b/src/env/locale.ts
@@ -0,0 +1,30 @@
+/**
+ * @fileoverview Locale and language environment variable getters.
+ * Provides access to system locale settings.
+ */
+
+import { getEnvValue } from '#env/rewire'
+
+/**
+ * LANG environment variable.
+ * System locale and language settings.
+ */
+export function getLang(): string | undefined {
+  return getEnvValue('LANG')
+}
+
+/**
+ * LC_ALL environment variable.
+ * Override for all locale settings.
+ */
+export function getLcAll(): string | undefined {
+  return getEnvValue('LC_ALL')
+}
+
+/**
+ * LC_MESSAGES environment variable.
+ * Locale setting for message translations.
+ */
+export function getLcMessages(): string | undefined {
+  return getEnvValue('LC_MESSAGES')
+}
diff --git a/src/env/node-auth-token.ts b/src/env/node-auth-token.ts
index 7634ce4..0175291 100644
--- a/src/env/node-auth-token.ts
+++ b/src/env/node-auth-token.ts
@@ -1,8 +1,10 @@
 /**
- * NODE_AUTH_TOKEN environment variable snapshot.
+ * NODE_AUTH_TOKEN environment variable getter.
  * Authentication token for Node.js package registry access.
  */
 
-import { env } from 'node:process'
+import { getEnvValue } from '#env/rewire'
 
-export const NODE_AUTH_TOKEN = env['NODE_AUTH_TOKEN']
+export function getNodeAuthToken(): string | undefined {
+  return getEnvValue('NODE_AUTH_TOKEN')
+}
diff --git a/src/env/node-env.ts b/src/env/node-env.ts
index 3d06664..371234f 100644
--- a/src/env/node-env.ts
+++ b/src/env/node-env.ts
@@ -1,8 +1,10 @@
 /**
- * NODE_ENV environment variable snapshot.
+ * NODE_ENV environment variable getter.
  * Indicates the Node.js environment mode (production, development, test).
  */
 
-import { env } from 'node:process'
+import { getEnvValue } from '#env/rewire'
 
-export const NODE_ENV = env['NODE_ENV']
+export function getNodeEnv(): string | undefined {
+  return getEnvValue('NODE_ENV')
+}
diff --git a/src/env/npm-config-registry.ts b/src/env/npm-config-registry.ts
deleted file mode 100644
index 8e726c5..0000000
--- a/src/env/npm-config-registry.ts
+++ /dev/null
@@ -1,8 +0,0 @@
-/**
- * npm_config_registry environment variable snapshot.
- * NPM registry URL configured by package managers.
- */
-
-import { env } from 'node:process'
-
-export const npm_config_registry = env['npm_config_registry']
diff --git a/src/env/npm-config-user-agent.ts b/src/env/npm-config-user-agent.ts
deleted file mode 100644
index 731cac8..0000000
--- a/src/env/npm-config-user-agent.ts
+++ /dev/null
@@ -1,8 +0,0 @@
-/**
- * npm_config_user_agent environment variable snapshot.
- * User agent string set by npm/pnpm/yarn package managers.
- */
-
-import { env } from 'node:process'
-
-export const npm_config_user_agent = env['npm_config_user_agent']
diff --git a/src/env/npm-lifecycle-event.ts b/src/env/npm-lifecycle-event.ts
deleted file mode 100644
index 0b076fa..0000000
--- a/src/env/npm-lifecycle-event.ts
+++ /dev/null
@@ -1,8 +0,0 @@
-/**
- * npm_lifecycle_event environment variable snapshot.
- * The name of the npm lifecycle event that's currently running.
- */
-
-import { env } from 'node:process'
-
-export const npm_lifecycle_event = env['npm_lifecycle_event']
diff --git a/src/env/npm-registry.ts b/src/env/npm-registry.ts
deleted file mode 100644
index fcd0708..0000000
--- a/src/env/npm-registry.ts
+++ /dev/null
@@ -1,8 +0,0 @@
-/**
- * NPM_REGISTRY environment variable snapshot.
- * NPM registry URL override.
- */
-
-import { env } from 'node:process'
-
-export const NPM_REGISTRY = env['NPM_REGISTRY']
diff --git a/src/env/npm-token.ts b/src/env/npm-token.ts
deleted file mode 100644
index ba391ff..0000000
--- a/src/env/npm-token.ts
+++ /dev/null
@@ -1,8 +0,0 @@
-/**
- * NPM_TOKEN environment variable snapshot.
- * Authentication token for NPM registry access.
- */
-
-import { env } from 'node:process'
-
-export const NPM_TOKEN = env['NPM_TOKEN']
diff --git a/src/env/npm.ts b/src/env/npm.ts
new file mode 100644
index 0000000..d411986
--- /dev/null
+++ b/src/env/npm.ts
@@ -0,0 +1,46 @@
+/**
+ * @fileoverview NPM environment variable getters.
+ * Provides access to NPM and package manager environment variables.
+ */
+
+import { getEnvValue } from '#env/rewire'
+
+/**
+ * npm_config_registry environment variable.
+ * NPM registry URL configured by package managers.
+ */
+export function getNpmConfigRegistry(): string | undefined {
+  return getEnvValue('npm_config_registry')
+}
+
+/**
+ * npm_config_user_agent environment variable.
+ * User agent string set by npm/pnpm/yarn package managers.
+ */
+export function getNpmConfigUserAgent(): string | undefined {
+  return getEnvValue('npm_config_user_agent')
+}
+
+/**
+ * npm_lifecycle_event environment variable.
+ * The name of the npm lifecycle event that's currently running.
+ */
+export function getNpmLifecycleEvent(): string | undefined {
+  return getEnvValue('npm_lifecycle_event')
+}
+
+/**
+ * NPM_REGISTRY environment variable.
+ * NPM registry URL override.
+ */
+export function getNpmRegistry(): string | undefined {
+  return getEnvValue('NPM_REGISTRY')
+}
+
+/**
+ * NPM_TOKEN environment variable.
+ * Authentication token for NPM registry access.
+ */
+export function getNpmToken(): string | undefined {
+  return getEnvValue('NPM_TOKEN')
+}
diff --git a/src/env/package-manager.ts b/src/env/package-manager.ts
new file mode 100644
index 0000000..4424879
--- /dev/null
+++ b/src/env/package-manager.ts
@@ -0,0 +1,125 @@
+/**
+ * @fileoverview Package manager environment detection.
+ * Provides utilities to detect which package manager (npm/pnpm/yarn/bun) is running.
+ */
+
+import { getEnvValue } from '#env/rewire'
+
+/**
+ * Package manager type detected from environment.
+ */
+export type PackageManagerType = 'npm' | 'pnpm' | 'yarn' | 'bun' | null
+
+/**
+ * Detect which package manager is currently running based on environment variables.
+ * Checks npm_config_user_agent which all package managers set.
+ *
+ * Detection priority:
+ * 1. npm_config_user_agent (most reliable, set by all package managers)
+ * 2. Binary path analysis (fallback for non-standard environments)
+ *
+ * @returns The detected package manager or null if unable to determine
+ *
+ * @example
+ * ```typescript
+ * // During: npm install
+ * detectPackageManager() // 'npm'
+ *
+ * // During: pnpm install
+ * detectPackageManager() // 'pnpm'
+ *
+ * // During: yarn install
+ * detectPackageManager() // 'yarn'
+ *
+ * // Outside package manager context
+ * detectPackageManager() // null
+ * ```
+ */
+export function detectPackageManager(): PackageManagerType {
+  const userAgent = getPackageManagerUserAgent()
+
+  if (userAgent) {
+    // User agent format: "pnpm/8.15.1 npm/? node/v20.11.0 darwin arm64"
+    // Extract the first part before the slash.
+    const match = userAgent.match(/^(npm|pnpm|yarn|bun)\//)
+    if (match) {
+      return match[1] as PackageManagerType
+    }
+  }
+
+  // Fallback: Check binary path patterns.
+  const argv0 = process.argv[0]
+  if (argv0) {
+    if (argv0.includes('/pnpm/') || argv0.includes('\\pnpm\\')) {
+      return 'pnpm'
+    }
+    if (
+      argv0.includes('/yarn/') ||
+      argv0.includes('\\yarn\\') ||
+      argv0.includes('/.yarn/') ||
+      argv0.includes('\\.yarn\\')
+    ) {
+      return 'yarn'
+    }
+    if (argv0.includes('/bun/') || argv0.includes('\\bun\\')) {
+      return 'bun'
+    }
+    // If in node_modules but no other match, assume npm.
+    if (
+      argv0.includes('/node_modules/') ||
+      argv0.includes('\\node_modules\\')
+    ) {
+      return 'npm'
+    }
+  }
+
+  return null
+}
+
+/**
+ * Get the package manager name and version from user agent.
+ *
+ * @returns Object with name and version, or null if not available
+ * @example
+ * ```typescript
+ * getPackageManagerInfo()
+ * // { name: 'pnpm', version: '8.15.1' }
+ * ```
+ */
+export function getPackageManagerInfo(): {
+  name: string
+  version: string
+} | null {
+  const userAgent = getPackageManagerUserAgent()
+  if (!userAgent) {
+    return null
+  }
+
+  // Parse "pnpm/8.15.1 npm/? node/v20.11.0 darwin arm64".
+  const match = userAgent.match(/^([^/]+)\/([^\s]+)/)
+  if (match) {
+    return {
+      name: match[1],
+      version: match[2],
+    }
+  }
+
+  return null
+}
+
+/**
+ * Get the package manager user agent from environment.
+ * Package managers set npm_config_user_agent with format: "npm/8.19.2 node/v18.12.0 darwin arm64"
+ *
+ * @returns The user agent string or undefined
+ * @example
+ * ```typescript
+ * getPackageManagerUserAgent()
+ * // npm: "npm/10.2.4 node/v20.11.0 darwin arm64 workspaces/false"
+ * // pnpm: "pnpm/8.15.1 npm/? node/v20.11.0 darwin arm64"
+ * // yarn: "yarn/1.22.19 npm/? node/v20.11.0 darwin arm64"
+ * ```
+ */
+export function getPackageManagerUserAgent(): string | undefined {
+  return getEnvValue('npm_config_user_agent')
+}
diff --git a/src/env/path.ts b/src/env/path.ts
index eda363b..7965a57 100644
--- a/src/env/path.ts
+++ b/src/env/path.ts
@@ -1,8 +1,10 @@
 /**
- * PATH environment variable snapshot.
+ * PATH environment variable getter.
  * System executable search paths.
  */
 
-import { env } from 'node:process'
+import { getEnvValue } from '#env/rewire'
 
-export const PATH = env['PATH']
+export function getPath(): string | undefined {
+  return getEnvValue('PATH')
+}
diff --git a/src/env/pre-commit.ts b/src/env/pre-commit.ts
index a4057ec..b210038 100644
--- a/src/env/pre-commit.ts
+++ b/src/env/pre-commit.ts
@@ -1,10 +1,11 @@
 /**
- * PRE_COMMIT environment variable snapshot.
+ * PRE_COMMIT environment variable getter.
  * Whether running in a pre-commit hook context.
  */
 
-import { env } from 'node:process'
-
 import { envAsBoolean } from '#env/helpers'
+import { getEnvValue } from '#env/rewire'
 
-export const PRE_COMMIT = envAsBoolean(env['PRE_COMMIT'])
+export function getPreCommit(): boolean {
+  return envAsBoolean(getEnvValue('PRE_COMMIT'))
+}
diff --git a/src/env/rewire.ts b/src/env/rewire.ts
new file mode 100644
index 0000000..98247b5
--- /dev/null
+++ b/src/env/rewire.ts
@@ -0,0 +1,184 @@
+/**
+ * @fileoverview Environment variable rewiring utilities for testing.
+ * Uses AsyncLocalStorage for context-isolated overrides that work with concurrent tests.
+ *
+ * Features:
+ * - Context-isolated overrides via withEnv() for advanced use cases
+ * - Test-friendly setEnv/clearEnv/resetEnv that work in beforeEach/afterEach
+ * - Compatible with vi.stubEnv() - reads from process.env as final fallback
+ * - Thread-safe for concurrent test execution
+ */
+
+import { AsyncLocalStorage } from 'async_hooks'
+
+import { envAsBoolean } from '#env/helpers'
+
+type EnvOverrides = Map<string, string | undefined>
+
+// Isolated execution context storage for nested overrides (withEnv/withEnvSync)
+// AsyncLocalStorage creates isolated contexts that don't leak between concurrent code
+const isolatedOverridesStorage = new AsyncLocalStorage<EnvOverrides>()
+
+// Shared test hook overrides (setEnv/clearEnv/resetEnv in beforeEach/afterEach)
+// IMPORTANT: Use globalThis to ensure singleton across duplicate module instances
+// In coverage mode, both src and dist versions of this module may be loaded,
+// but they must share the same Map for rewiring to work.
+// Only initialize in test environment to avoid polluting production runtime
+// Vitest automatically sets VITEST=true when running tests
+const sharedOverridesSymbol = Symbol.for(
+  '@socketsecurity/lib/env/rewire/test-overrides',
+)
+const isVitestEnv = envAsBoolean(process.env.VITEST)
+if (isVitestEnv && !globalThis[sharedOverridesSymbol]) {
+  globalThis[sharedOverridesSymbol] = new Map<string, string | undefined>()
+}
+const sharedOverrides: Map<string, string | undefined> | undefined =
+  globalThis[sharedOverridesSymbol]
+
+/**
+ * Get an environment variable value, checking overrides first.
+ *
+ * Resolution order:
+ * 1. Isolated overrides (temporary - set via withEnv/withEnvSync)
+ * 2. Shared overrides (persistent - set via setEnv in beforeEach)
+ * 3. process.env (including vi.stubEnv modifications)
+ *
+ * @internal Used by env getters to support test rewiring
+ */
+export function getEnvValue(key: string): string | undefined {
+  // Check isolated overrides first (highest priority - temporary via withEnv)
+  const isolatedOverrides = isolatedOverridesStorage.getStore()
+  if (isolatedOverrides?.has(key)) {
+    return isolatedOverrides.get(key)
+  }
+
+  // Check shared overrides (persistent via setEnv in beforeEach)
+  if (sharedOverrides?.has(key)) {
+    return sharedOverrides.get(key)
+  }
+
+  // Fall back to process.env (works with vi.stubEnv)
+  return process.env[key]
+}
+
+/**
+ * Set an environment variable override for testing.
+ * This does not modify process.env, only affects env getters.
+ *
+ * Works in test hooks (beforeEach) without needing AsyncLocalStorage context.
+ * Vitest's module isolation ensures each test file has independent overrides.
+ *
+ * @example
+ * ```typescript
+ * import { setEnv, resetEnv } from '#env/rewire'
+ * import { getCI } from '#env/ci'
+ *
+ * beforeEach(() => {
+ *   setEnv('CI', '1')
+ * })
+ *
+ * afterEach(() => {
+ *   resetEnv()
+ * })
+ *
+ * it('should detect CI environment', () => {
+ *   expect(getCI()).toBe(true)
+ * })
+ * ```
+ */
+export function setEnv(key: string, value: string | undefined): void {
+  sharedOverrides?.set(key, value)
+}
+
+/**
+ * Clear a specific environment variable override.
+ */
+export function clearEnv(key: string): void {
+  sharedOverrides?.delete(key)
+}
+
+/**
+ * Clear all environment variable overrides.
+ * Useful in afterEach hooks to ensure clean test state.
+ *
+ * @example
+ * ```typescript
+ * import { resetEnv } from '#env/rewire'
+ *
+ * afterEach(() => {
+ *   resetEnv()
+ * })
+ * ```
+ */
+export function resetEnv(): void {
+  sharedOverrides?.clear()
+}
+
+/**
+ * Check if an environment variable has been overridden.
+ */
+export function hasOverride(key: string): boolean {
+  const isolatedOverrides = isolatedOverridesStorage.getStore()
+  return !!(isolatedOverrides?.has(key) || sharedOverrides?.has(key))
+}
+
+/**
+ * Run code with environment overrides in an isolated AsyncLocalStorage context.
+ * Creates true context isolation - overrides don't leak to concurrent code.
+ *
+ * Useful for tests that need temporary overrides without affecting other tests
+ * or for nested override scenarios.
+ *
+ * @example
+ * ```typescript
+ * import { withEnv } from '#env/rewire'
+ * import { getCI } from '#env/ci'
+ *
+ * // Temporary override in isolated context
+ * await withEnv({ CI: '1' }, async () => {
+ *   expect(getCI()).toBe(true)
+ * })
+ * expect(getCI()).toBe(false) // Override is gone
+ * ```
+ *
+ * @example
+ * ```typescript
+ * // Nested overrides work correctly
+ * setEnv('CI', '1') // Shared override (persistent)
+ *
+ * await withEnv({ CI: '0' }, async () => {
+ *   expect(getCI()).toBe(false) // Isolated override takes precedence
+ * })
+ *
+ * expect(getCI()).toBe(true) // Back to shared override
+ * ```
+ */
+export async function withEnv<T>(
+  overrides: Record<string, string | undefined>,
+  fn: () => T | Promise<T>,
+): Promise<T> {
+  const map = new Map(Object.entries(overrides))
+  return await isolatedOverridesStorage.run(map, fn)
+}
+
+/**
+ * Synchronous version of withEnv for non-async code.
+ *
+ * @example
+ * ```typescript
+ * import { withEnvSync } from '#env/rewire'
+ * import { getCI } from '#env/ci'
+ *
+ * const result = withEnvSync({ CI: '1' }, () => {
+ *   return getCI()
+ * })
+ * expect(result).toBe(true)
+ * ```
+ */
+export function withEnvSync<T>(
+  overrides: Record<string, string | undefined>,
+  fn: () => T,
+): T {
+  const map = new Map(Object.entries(overrides))
+  return isolatedOverridesStorage.run(map, fn)
+}
diff --git a/src/env/shell.ts b/src/env/shell.ts
index 59da0b7..2b1552c 100644
--- a/src/env/shell.ts
+++ b/src/env/shell.ts
@@ -1,8 +1,10 @@
 /**
- * SHELL environment variable snapshot.
+ * SHELL environment variable getter.
  * Unix/macOS default shell path.
  */
 
-import { env } from 'node:process'
+import { getEnvValue } from '#env/rewire'
 
-export const SHELL = env['SHELL']
+export function getShell(): string | undefined {
+  return getEnvValue('SHELL')
+}
diff --git a/src/env/socket-accept-risks.ts b/src/env/socket-accept-risks.ts
deleted file mode 100644
index b56ef30..0000000
--- a/src/env/socket-accept-risks.ts
+++ /dev/null
@@ -1,10 +0,0 @@
-/**
- * SOCKET_ACCEPT_RISKS environment variable snapshot.
- * Whether to accept all Socket Security risks.
- */
-
-import { env } from 'node:process'
-
-import { envAsBoolean } from '#env/helpers'
-
-export const SOCKET_ACCEPT_RISKS = envAsBoolean(env['SOCKET_ACCEPT_RISKS'])
diff --git a/src/env/socket-api-base-url.ts b/src/env/socket-api-base-url.ts
deleted file mode 100644
index ee64a8e..0000000
--- a/src/env/socket-api-base-url.ts
+++ /dev/null
@@ -1,8 +0,0 @@
-/**
- * SOCKET_API_BASE_URL environment variable snapshot.
- * Socket Security API base URL.
- */
-
-import { env } from 'node:process'
-
-export const SOCKET_API_BASE_URL = env['SOCKET_API_BASE_URL']
diff --git a/src/env/socket-api-proxy.ts b/src/env/socket-api-proxy.ts
deleted file mode 100644
index 88c8d03..0000000
--- a/src/env/socket-api-proxy.ts
+++ /dev/null
@@ -1,8 +0,0 @@
-/**
- * SOCKET_API_PROXY environment variable snapshot.
- * Proxy URL for Socket Security API requests.
- */
-
-import { env } from 'node:process'
-
-export const SOCKET_API_PROXY = env['SOCKET_API_PROXY']
diff --git a/src/env/socket-api-timeout.ts b/src/env/socket-api-timeout.ts
deleted file mode 100644
index 3c4b099..0000000
--- a/src/env/socket-api-timeout.ts
+++ /dev/null
@@ -1,10 +0,0 @@
-/**
- * SOCKET_API_TIMEOUT environment variable snapshot.
- * Timeout in milliseconds for Socket Security API requests.
- */
-
-import { env } from 'node:process'
-
-import { envAsNumber } from '#env/helpers'
-
-export const SOCKET_API_TIMEOUT = envAsNumber(env['SOCKET_API_TIMEOUT'])
diff --git a/src/env/socket-api-token.ts b/src/env/socket-api-token.ts
deleted file mode 100644
index 6141240..0000000
--- a/src/env/socket-api-token.ts
+++ /dev/null
@@ -1,8 +0,0 @@
-/**
- * SOCKET_API_TOKEN environment variable snapshot.
- * Socket Security API authentication token.
- */
-
-import { env } from 'node:process'
-
-export const SOCKET_API_TOKEN = env['SOCKET_API_TOKEN']
diff --git a/src/env/socket-cacache-dir.ts b/src/env/socket-cacache-dir.ts
deleted file mode 100644
index 7a0a93c..0000000
--- a/src/env/socket-cacache-dir.ts
+++ /dev/null
@@ -1,8 +0,0 @@
-/**
- * SOCKET_CACACHE_DIR environment variable snapshot.
- * Overrides the default Socket cacache directory location.
- */
-
-import { env } from 'node:process'
-
-export const SOCKET_CACACHE_DIR = env['SOCKET_CACACHE_DIR']
diff --git a/src/env/socket-cli-accept-risks.ts b/src/env/socket-cli-accept-risks.ts
deleted file mode 100644
index 4b5170d..0000000
--- a/src/env/socket-cli-accept-risks.ts
+++ /dev/null
@@ -1,12 +0,0 @@
-/**
- * SOCKET_CLI_ACCEPT_RISKS environment variable snapshot.
- * Whether to accept all Socket CLI risks (alternative name).
- */
-
-import { env } from 'node:process'
-
-import { envAsBoolean } from '#env/helpers'
-
-export const SOCKET_CLI_ACCEPT_RISKS = envAsBoolean(
-  env['SOCKET_CLI_ACCEPT_RISKS'],
-)
diff --git a/src/env/socket-cli-api-base-url.ts b/src/env/socket-cli-api-base-url.ts
deleted file mode 100644
index c3b12ae..0000000
--- a/src/env/socket-cli-api-base-url.ts
+++ /dev/null
@@ -1,8 +0,0 @@
-/**
- * SOCKET_CLI_API_BASE_URL environment variable snapshot.
- * Socket CLI API base URL (alternative name).
- */
-
-import { env } from 'node:process'
-
-export const SOCKET_CLI_API_BASE_URL = env['SOCKET_CLI_API_BASE_URL']
diff --git a/src/env/socket-cli-api-proxy.ts b/src/env/socket-cli-api-proxy.ts
deleted file mode 100644
index 49a6ceb..0000000
--- a/src/env/socket-cli-api-proxy.ts
+++ /dev/null
@@ -1,8 +0,0 @@
-/**
- * SOCKET_CLI_API_PROXY environment variable snapshot.
- * Proxy URL for Socket CLI API requests (alternative name).
- */
-
-import { env } from 'node:process'
-
-export const SOCKET_CLI_API_PROXY = env['SOCKET_CLI_API_PROXY']
diff --git a/src/env/socket-cli-api-timeout.ts b/src/env/socket-cli-api-timeout.ts
deleted file mode 100644
index e8568b6..0000000
--- a/src/env/socket-cli-api-timeout.ts
+++ /dev/null
@@ -1,10 +0,0 @@
-/**
- * SOCKET_CLI_API_TIMEOUT environment variable snapshot.
- * Timeout in milliseconds for Socket CLI API requests (alternative name).
- */
-
-import { env } from 'node:process'
-
-import { envAsNumber } from '#env/helpers'
-
-export const SOCKET_CLI_API_TIMEOUT = envAsNumber(env['SOCKET_CLI_API_TIMEOUT'])
diff --git a/src/env/socket-cli-api-token.ts b/src/env/socket-cli-api-token.ts
deleted file mode 100644
index 3e51391..0000000
--- a/src/env/socket-cli-api-token.ts
+++ /dev/null
@@ -1,8 +0,0 @@
-/**
- * SOCKET_CLI_API_TOKEN environment variable snapshot.
- * Socket CLI API authentication token (alternative name).
- */
-
-import { env } from 'node:process'
-
-export const SOCKET_CLI_API_TOKEN = env['SOCKET_CLI_API_TOKEN']
diff --git a/src/env/socket-cli-config.ts b/src/env/socket-cli-config.ts
deleted file mode 100644
index 19117a3..0000000
--- a/src/env/socket-cli-config.ts
+++ /dev/null
@@ -1,8 +0,0 @@
-/**
- * SOCKET_CLI_CONFIG environment variable snapshot.
- * Socket CLI configuration file path (alternative name).
- */
-
-import { env } from 'node:process'
-
-export const SOCKET_CLI_CONFIG = env['SOCKET_CLI_CONFIG']
diff --git a/src/env/socket-cli-fix.ts b/src/env/socket-cli-fix.ts
deleted file mode 100644
index 6984e9c..0000000
--- a/src/env/socket-cli-fix.ts
+++ /dev/null
@@ -1,8 +0,0 @@
-/**
- * SOCKET_CLI_FIX environment variable snapshot.
- * Controls Socket CLI fix mode.
- */
-
-import { env } from 'node:process'
-
-export const SOCKET_CLI_FIX = env['SOCKET_CLI_FIX']
diff --git a/src/env/socket-cli-no-api-token.ts b/src/env/socket-cli-no-api-token.ts
deleted file mode 100644
index 884e701..0000000
--- a/src/env/socket-cli-no-api-token.ts
+++ /dev/null
@@ -1,12 +0,0 @@
-/**
- * SOCKET_CLI_NO_API_TOKEN environment variable snapshot.
- * Whether to skip Socket CLI API token requirement (alternative name).
- */
-
-import { env } from 'node:process'
-
-import { envAsBoolean } from '#env/helpers'
-
-export const SOCKET_CLI_NO_API_TOKEN = envAsBoolean(
-  env['SOCKET_CLI_NO_API_TOKEN'],
-)
diff --git a/src/env/socket-cli-optimize.ts b/src/env/socket-cli-optimize.ts
deleted file mode 100644
index 8691d55..0000000
--- a/src/env/socket-cli-optimize.ts
+++ /dev/null
@@ -1,10 +0,0 @@
-/**
- * SOCKET_CLI_OPTIMIZE environment variable snapshot.
- * Controls Socket CLI optimization mode.
- */
-
-import { env } from 'node:process'
-
-import { envAsBoolean } from '#env/helpers'
-
-export const SOCKET_CLI_OPTIMIZE = envAsBoolean(env['SOCKET_CLI_OPTIMIZE'])
diff --git a/src/env/socket-cli-org-slug.ts b/src/env/socket-cli-org-slug.ts
deleted file mode 100644
index daa490c..0000000
--- a/src/env/socket-cli-org-slug.ts
+++ /dev/null
@@ -1,8 +0,0 @@
-/**
- * SOCKET_CLI_ORG_SLUG environment variable snapshot.
- * Socket CLI organization slug identifier (alternative name).
- */
-
-import { env } from 'node:process'
-
-export const SOCKET_CLI_ORG_SLUG = env['SOCKET_CLI_ORG_SLUG']
diff --git a/src/env/socket-cli-shadow-accept-risks.ts b/src/env/socket-cli-shadow-accept-risks.ts
deleted file mode 100644
index 6be8da0..0000000
--- a/src/env/socket-cli-shadow-accept-risks.ts
+++ /dev/null
@@ -1,12 +0,0 @@
-/**
- * SOCKET_CLI_SHADOW_ACCEPT_RISKS environment variable snapshot.
- * Controls Socket CLI shadow mode risk acceptance.
- */
-
-import { env } from 'node:process'
-
-import { envAsBoolean } from '#env/helpers'
-
-export const SOCKET_CLI_SHADOW_ACCEPT_RISKS = envAsBoolean(
-  env['SOCKET_CLI_SHADOW_ACCEPT_RISKS'],
-)
diff --git a/src/env/socket-cli-shadow-api-token.ts b/src/env/socket-cli-shadow-api-token.ts
deleted file mode 100644
index 6f68b4f..0000000
--- a/src/env/socket-cli-shadow-api-token.ts
+++ /dev/null
@@ -1,8 +0,0 @@
-/**
- * SOCKET_CLI_SHADOW_API_TOKEN environment variable snapshot.
- * API token for Socket CLI shadow mode.
- */
-
-import { env } from 'node:process'
-
-export const SOCKET_CLI_SHADOW_API_TOKEN = env['SOCKET_CLI_SHADOW_API_TOKEN']
diff --git a/src/env/socket-cli-shadow-bin.ts b/src/env/socket-cli-shadow-bin.ts
deleted file mode 100644
index 739b879..0000000
--- a/src/env/socket-cli-shadow-bin.ts
+++ /dev/null
@@ -1,8 +0,0 @@
-/**
- * SOCKET_CLI_SHADOW_BIN environment variable snapshot.
- * Binary path for Socket CLI shadow mode.
- */
-
-import { env } from 'node:process'
-
-export const SOCKET_CLI_SHADOW_BIN = env['SOCKET_CLI_SHADOW_BIN']
diff --git a/src/env/socket-cli-shadow-progress.ts b/src/env/socket-cli-shadow-progress.ts
deleted file mode 100644
index 40cf982..0000000
--- a/src/env/socket-cli-shadow-progress.ts
+++ /dev/null
@@ -1,12 +0,0 @@
-/**
- * SOCKET_CLI_SHADOW_PROGRESS environment variable snapshot.
- * Controls Socket CLI shadow mode progress display.
- */
-
-import { env } from 'node:process'
-
-import { envAsBoolean } from '#env/helpers'
-
-export const SOCKET_CLI_SHADOW_PROGRESS = envAsBoolean(
-  env['SOCKET_CLI_SHADOW_PROGRESS'],
-)
diff --git a/src/env/socket-cli-shadow-silent.ts b/src/env/socket-cli-shadow-silent.ts
deleted file mode 100644
index 59c5351..0000000
--- a/src/env/socket-cli-shadow-silent.ts
+++ /dev/null
@@ -1,12 +0,0 @@
-/**
- * SOCKET_CLI_SHADOW_SILENT environment variable snapshot.
- * Controls Socket CLI shadow mode silent operation.
- */
-
-import { env } from 'node:process'
-
-import { envAsBoolean } from '#env/helpers'
-
-export const SOCKET_CLI_SHADOW_SILENT = envAsBoolean(
-  env['SOCKET_CLI_SHADOW_SILENT'],
-)
diff --git a/src/env/socket-cli-shadow.ts b/src/env/socket-cli-shadow.ts
new file mode 100644
index 0000000..3ccf679
--- /dev/null
+++ b/src/env/socket-cli-shadow.ts
@@ -0,0 +1,52 @@
+/**
+ * @fileoverview Socket CLI shadow mode environment variables.
+ * Provides typed getters for SOCKET_CLI_SHADOW_* environment variables.
+ */
+
+import { envAsBoolean } from '#env/helpers'
+import { getEnvValue } from '#env/rewire'
+
+/**
+ * Controls Socket CLI shadow mode risk acceptance.
+ *
+ * @returns Whether to accept all risks in shadow mode
+ */
+export function getSocketCliShadowAcceptRisks(): boolean {
+  return envAsBoolean(getEnvValue('SOCKET_CLI_SHADOW_ACCEPT_RISKS'))
+}
+
+/**
+ * API token for Socket CLI shadow mode.
+ *
+ * @returns Shadow mode API token or undefined
+ */
+export function getSocketCliShadowApiToken(): string | undefined {
+  return getEnvValue('SOCKET_CLI_SHADOW_API_TOKEN')
+}
+
+/**
+ * Binary path for Socket CLI shadow mode.
+ *
+ * @returns Shadow mode binary path or undefined
+ */
+export function getSocketCliShadowBin(): string | undefined {
+  return getEnvValue('SOCKET_CLI_SHADOW_BIN')
+}
+
+/**
+ * Controls Socket CLI shadow mode progress display.
+ *
+ * @returns Whether to show progress in shadow mode
+ */
+export function getSocketCliShadowProgress(): boolean {
+  return envAsBoolean(getEnvValue('SOCKET_CLI_SHADOW_PROGRESS'))
+}
+
+/**
+ * Controls Socket CLI shadow mode silent operation.
+ *
+ * @returns Whether shadow mode should operate silently
+ */
+export function getSocketCliShadowSilent(): boolean {
+  return envAsBoolean(getEnvValue('SOCKET_CLI_SHADOW_SILENT'))
+}
diff --git a/src/env/socket-cli-view-all-risks.ts b/src/env/socket-cli-view-all-risks.ts
deleted file mode 100644
index 81fb185..0000000
--- a/src/env/socket-cli-view-all-risks.ts
+++ /dev/null
@@ -1,12 +0,0 @@
-/**
- * SOCKET_CLI_VIEW_ALL_RISKS environment variable snapshot.
- * Whether to view all Socket CLI risks (alternative name).
- */
-
-import { env } from 'node:process'
-
-import { envAsBoolean } from '#env/helpers'
-
-export const SOCKET_CLI_VIEW_ALL_RISKS = envAsBoolean(
-  env['SOCKET_CLI_VIEW_ALL_RISKS'],
-)
diff --git a/src/env/socket-cli.ts b/src/env/socket-cli.ts
new file mode 100644
index 0000000..0af405a
--- /dev/null
+++ b/src/env/socket-cli.ts
@@ -0,0 +1,161 @@
+/**
+ * @fileoverview Socket CLI environment variables.
+ * Provides typed getters for SOCKET_CLI_* environment variables (excluding shadow).
+ */
+
+import { envAsBoolean, envAsNumber } from '#env/helpers'
+import { getEnvValue } from '#env/rewire'
+
+/**
+ * Whether to accept all Socket CLI risks (alternative name).
+ *
+ * @returns Whether to accept all risks
+ */
+export function getSocketCliAcceptRisks(): boolean {
+  return envAsBoolean(getEnvValue('SOCKET_CLI_ACCEPT_RISKS'))
+}
+
+/**
+ * Socket CLI API base URL (alternative name).
+ * Checks SOCKET_CLI_API_BASE_URL first, then falls back to legacy SOCKET_SECURITY_API_BASE_URL.
+ *
+ * @returns API base URL or undefined
+ */
+export function getSocketCliApiBaseUrl(): string | undefined {
+  return (
+    getEnvValue('SOCKET_CLI_API_BASE_URL') ||
+    getEnvValue('SOCKET_SECURITY_API_BASE_URL')
+  )
+}
+
+/**
+ * Proxy URL for Socket CLI API requests (alternative name).
+ * Checks SOCKET_CLI_API_PROXY, SOCKET_SECURITY_API_PROXY, then standard proxy env vars.
+ * Follows the same precedence as v1.x: HTTPS_PROXY → https_proxy → HTTP_PROXY → http_proxy.
+ *
+ * @returns API proxy URL or undefined
+ */
+export function getSocketCliApiProxy(): string | undefined {
+  return (
+    getEnvValue('SOCKET_CLI_API_PROXY') ||
+    getEnvValue('SOCKET_SECURITY_API_PROXY') ||
+    getEnvValue('HTTPS_PROXY') ||
+    getEnvValue('https_proxy') ||
+    getEnvValue('HTTP_PROXY') ||
+    getEnvValue('http_proxy')
+  )
+}
+
+/**
+ * Timeout in milliseconds for Socket CLI API requests (alternative name).
+ *
+ * @returns API timeout in milliseconds
+ */
+export function getSocketCliApiTimeout(): number {
+  return envAsNumber(getEnvValue('SOCKET_CLI_API_TIMEOUT'))
+}
+
+/**
+ * Socket CLI API authentication token (alternative name).
+ * Checks SOCKET_CLI_API_TOKEN, SOCKET_CLI_API_KEY, SOCKET_SECURITY_API_TOKEN, SOCKET_SECURITY_API_KEY.
+ * Maintains full v1.x backward compatibility.
+ *
+ * @returns API token or undefined
+ */
+export function getSocketCliApiToken(): string | undefined {
+  return (
+    getEnvValue('SOCKET_CLI_API_TOKEN') ||
+    getEnvValue('SOCKET_CLI_API_KEY') ||
+    getEnvValue('SOCKET_SECURITY_API_TOKEN') ||
+    getEnvValue('SOCKET_SECURITY_API_KEY')
+  )
+}
+
+/**
+ * Socket CLI configuration file path (alternative name).
+ *
+ * @returns Config file path or undefined
+ */
+export function getSocketCliConfig(): string | undefined {
+  return getEnvValue('SOCKET_CLI_CONFIG')
+}
+
+/**
+ * Controls Socket CLI fix mode.
+ *
+ * @returns Fix mode value or undefined
+ */
+export function getSocketCliFix(): string | undefined {
+  return getEnvValue('SOCKET_CLI_FIX')
+}
+
+/**
+ * Whether to skip Socket CLI API token requirement (alternative name).
+ *
+ * @returns Whether to skip API token requirement
+ */
+export function getSocketCliNoApiToken(): boolean {
+  return envAsBoolean(getEnvValue('SOCKET_CLI_NO_API_TOKEN'))
+}
+
+/**
+ * Controls Socket CLI optimization mode.
+ *
+ * @returns Whether optimization mode is enabled
+ */
+export function getSocketCliOptimize(): boolean {
+  return envAsBoolean(getEnvValue('SOCKET_CLI_OPTIMIZE'))
+}
+
+/**
+ * Socket CLI organization slug identifier (alternative name).
+ * Checks SOCKET_CLI_ORG_SLUG first, then falls back to SOCKET_ORG_SLUG.
+ *
+ * @returns Organization slug or undefined
+ */
+export function getSocketCliOrgSlug(): string | undefined {
+  return getEnvValue('SOCKET_CLI_ORG_SLUG') || getEnvValue('SOCKET_ORG_SLUG')
+}
+
+/**
+ * Whether to view all Socket CLI risks (alternative name).
+ *
+ * @returns Whether to view all risks
+ */
+export function getSocketCliViewAllRisks(): boolean {
+  return envAsBoolean(getEnvValue('SOCKET_CLI_VIEW_ALL_RISKS'))
+}
+
+/**
+ * Socket CLI GitHub authentication token.
+ * Checks SOCKET_CLI_GITHUB_TOKEN, SOCKET_SECURITY_GITHUB_PAT, then falls back to GITHUB_TOKEN.
+ *
+ * @returns GitHub token or undefined
+ */
+export function getSocketCliGithubToken(): string | undefined {
+  return (
+    getEnvValue('SOCKET_CLI_GITHUB_TOKEN') ||
+    getEnvValue('SOCKET_SECURITY_GITHUB_PAT') ||
+    getEnvValue('GITHUB_TOKEN')
+  )
+}
+
+/**
+ * Bootstrap package spec (e.g., @socketsecurity/cli@^2.0.11).
+ * Set by bootstrap wrappers (SEA/smol/npm) to pass package spec to CLI.
+ *
+ * @returns Bootstrap package spec or undefined
+ */
+export function getSocketCliBootstrapSpec(): string | undefined {
+  return getEnvValue('SOCKET_CLI_BOOTSTRAP_SPEC')
+}
+
+/**
+ * Bootstrap cache directory path.
+ * Set by bootstrap wrappers to pass dlx cache location to CLI.
+ *
+ * @returns Bootstrap cache directory or undefined
+ */
+export function getSocketCliBootstrapCacheDir(): string | undefined {
+  return getEnvValue('SOCKET_CLI_BOOTSTRAP_CACHE_DIR')
+}
diff --git a/src/env/socket-config.ts b/src/env/socket-config.ts
deleted file mode 100644
index 67d1c84..0000000
--- a/src/env/socket-config.ts
+++ /dev/null
@@ -1,8 +0,0 @@
-/**
- * SOCKET_CONFIG environment variable snapshot.
- * Socket Security configuration file path.
- */
-
-import { env } from 'node:process'
-
-export const SOCKET_CONFIG = env['SOCKET_CONFIG']
diff --git a/src/env/socket-debug.ts b/src/env/socket-debug.ts
deleted file mode 100644
index d9b75e7..0000000
--- a/src/env/socket-debug.ts
+++ /dev/null
@@ -1,8 +0,0 @@
-/**
- * SOCKET_DEBUG environment variable snapshot.
- * Controls Socket-specific debug output.
- */
-
-import { env } from 'node:process'
-
-export const SOCKET_DEBUG = env['SOCKET_DEBUG']
diff --git a/src/env/socket-home.ts b/src/env/socket-home.ts
deleted file mode 100644
index d6b0c1a..0000000
--- a/src/env/socket-home.ts
+++ /dev/null
@@ -1,8 +0,0 @@
-/**
- * SOCKET_HOME environment variable snapshot.
- * Socket Security home directory path.
- */
-
-import { env } from 'node:process'
-
-export const SOCKET_HOME = env['SOCKET_HOME']
diff --git a/src/env/socket-no-api-token.ts b/src/env/socket-no-api-token.ts
deleted file mode 100644
index 3d7badc..0000000
--- a/src/env/socket-no-api-token.ts
+++ /dev/null
@@ -1,10 +0,0 @@
-/**
- * SOCKET_NO_API_TOKEN environment variable snapshot.
- * Whether to skip Socket Security API token requirement.
- */
-
-import { env } from 'node:process'
-
-import { envAsBoolean } from '#env/helpers'
-
-export const SOCKET_NO_API_TOKEN = envAsBoolean(env['SOCKET_NO_API_TOKEN'])
diff --git a/src/env/socket-npm-registry.ts b/src/env/socket-npm-registry.ts
deleted file mode 100644
index 9cf3501..0000000
--- a/src/env/socket-npm-registry.ts
+++ /dev/null
@@ -1,8 +0,0 @@
-/**
- * SOCKET_NPM_REGISTRY environment variable snapshot.
- * Socket NPM registry URL (alternative name).
- */
-
-import { env } from 'node:process'
-
-export const SOCKET_NPM_REGISTRY = env['SOCKET_NPM_REGISTRY']
diff --git a/src/env/socket-org-slug.ts b/src/env/socket-org-slug.ts
deleted file mode 100644
index f7e3ac1..0000000
--- a/src/env/socket-org-slug.ts
+++ /dev/null
@@ -1,8 +0,0 @@
-/**
- * SOCKET_ORG_SLUG environment variable snapshot.
- * Socket Security organization slug identifier.
- */
-
-import { env } from 'node:process'
-
-export const SOCKET_ORG_SLUG = env['SOCKET_ORG_SLUG']
diff --git a/src/env/socket-registry-url.ts b/src/env/socket-registry-url.ts
deleted file mode 100644
index c3072e7..0000000
--- a/src/env/socket-registry-url.ts
+++ /dev/null
@@ -1,8 +0,0 @@
-/**
- * SOCKET_REGISTRY_URL environment variable snapshot.
- * Socket Registry URL for package installation.
- */
-
-import { env } from 'node:process'
-
-export const SOCKET_REGISTRY_URL = env['SOCKET_REGISTRY_URL']
diff --git a/src/env/socket-view-all-risks.ts b/src/env/socket-view-all-risks.ts
deleted file mode 100644
index 0e7505f..0000000
--- a/src/env/socket-view-all-risks.ts
+++ /dev/null
@@ -1,10 +0,0 @@
-/**
- * SOCKET_VIEW_ALL_RISKS environment variable snapshot.
- * Whether to view all Socket Security risks.
- */
-
-import { env } from 'node:process'
-
-import { envAsBoolean } from '#env/helpers'
-
-export const SOCKET_VIEW_ALL_RISKS = envAsBoolean(env['SOCKET_VIEW_ALL_RISKS'])
diff --git a/src/env/socket.ts b/src/env/socket.ts
new file mode 100644
index 0000000..d116fd3
--- /dev/null
+++ b/src/env/socket.ts
@@ -0,0 +1,126 @@
+/**
+ * @fileoverview Socket Security environment variable getters.
+ */
+
+import { envAsBoolean, envAsNumber } from '#env/helpers'
+import { getEnvValue } from '#env/rewire'
+
+/**
+ * SOCKET_ACCEPT_RISKS environment variable getter.
+ * Whether to accept all Socket Security risks.
+ */
+export function getSocketAcceptRisks(): boolean {
+  return envAsBoolean(getEnvValue('SOCKET_ACCEPT_RISKS'))
+}
+
+/**
+ * SOCKET_API_BASE_URL environment variable getter.
+ * Socket Security API base URL.
+ */
+export function getSocketApiBaseUrl(): string | undefined {
+  return getEnvValue('SOCKET_API_BASE_URL')
+}
+
+/**
+ * SOCKET_API_PROXY environment variable getter.
+ * Proxy URL for Socket Security API requests.
+ */
+export function getSocketApiProxy(): string | undefined {
+  return getEnvValue('SOCKET_API_PROXY')
+}
+
+/**
+ * SOCKET_API_TIMEOUT environment variable getter.
+ * Timeout in milliseconds for Socket Security API requests.
+ */
+export function getSocketApiTimeout(): number {
+  return envAsNumber(getEnvValue('SOCKET_API_TIMEOUT'))
+}
+
+/**
+ * SOCKET_API_TOKEN environment variable getter.
+ * Socket Security API authentication token.
+ */
+export function getSocketApiToken(): string | undefined {
+  return getEnvValue('SOCKET_API_TOKEN')
+}
+
+/**
+ * SOCKET_CACACHE_DIR environment variable getter.
+ * Overrides the default Socket cacache directory location.
+ */
+export function getSocketCacacheDir(): string | undefined {
+  return getEnvValue('SOCKET_CACACHE_DIR')
+}
+
+/**
+ * SOCKET_CONFIG environment variable getter.
+ * Socket Security configuration file path.
+ */
+export function getSocketConfig(): string | undefined {
+  return getEnvValue('SOCKET_CONFIG')
+}
+
+/**
+ * SOCKET_DEBUG environment variable getter.
+ * Controls Socket-specific debug output.
+ */
+export function getSocketDebug(): string | undefined {
+  return getEnvValue('SOCKET_DEBUG')
+}
+
+/**
+ * SOCKET_DLX_DIR environment variable getter.
+ * Overrides the default Socket DLX directory location.
+ */
+export function getSocketDlxDirEnv(): string | undefined {
+  return getEnvValue('SOCKET_DLX_DIR')
+}
+
+/**
+ * SOCKET_HOME environment variable getter.
+ * Socket Security home directory path.
+ */
+export function getSocketHome(): string | undefined {
+  return getEnvValue('SOCKET_HOME')
+}
+
+/**
+ * SOCKET_NO_API_TOKEN environment variable getter.
+ * Whether to skip Socket Security API token requirement.
+ */
+export function getSocketNoApiToken(): boolean {
+  return envAsBoolean(getEnvValue('SOCKET_NO_API_TOKEN'))
+}
+
+/**
+ * SOCKET_NPM_REGISTRY environment variable getter.
+ * Socket NPM registry URL (alternative name).
+ */
+export function getSocketNpmRegistry(): string | undefined {
+  return getEnvValue('SOCKET_NPM_REGISTRY')
+}
+
+/**
+ * SOCKET_ORG_SLUG environment variable getter.
+ * Socket Security organization slug identifier.
+ */
+export function getSocketOrgSlug(): string | undefined {
+  return getEnvValue('SOCKET_ORG_SLUG')
+}
+
+/**
+ * SOCKET_REGISTRY_URL environment variable getter.
+ * Socket Registry URL for package installation.
+ */
+export function getSocketRegistryUrl(): string | undefined {
+  return getEnvValue('SOCKET_REGISTRY_URL')
+}
+
+/**
+ * SOCKET_VIEW_ALL_RISKS environment variable getter.
+ * Whether to view all Socket Security risks.
+ */
+export function getSocketViewAllRisks(): boolean {
+  return envAsBoolean(getEnvValue('SOCKET_VIEW_ALL_RISKS'))
+}
diff --git a/src/env/temp-dir.ts b/src/env/temp-dir.ts
new file mode 100644
index 0000000..07fdc62
--- /dev/null
+++ b/src/env/temp-dir.ts
@@ -0,0 +1,30 @@
+/**
+ * @fileoverview Temporary directory environment variable getters.
+ * Different platforms use different environment variables for temp directories.
+ */
+
+import { getEnvValue } from '#env/rewire'
+
+/**
+ * TMPDIR environment variable.
+ * Unix/macOS temporary directory path.
+ */
+export function getTmpdir(): string | undefined {
+  return getEnvValue('TMPDIR')
+}
+
+/**
+ * TEMP environment variable.
+ * Windows temporary directory path.
+ */
+export function getTemp(): string | undefined {
+  return getEnvValue('TEMP')
+}
+
+/**
+ * TMP environment variable.
+ * Alternative temporary directory path.
+ */
+export function getTmp(): string | undefined {
+  return getEnvValue('TMP')
+}
diff --git a/src/env/temp.ts b/src/env/temp.ts
deleted file mode 100644
index 7a8061b..0000000
--- a/src/env/temp.ts
+++ /dev/null
@@ -1,8 +0,0 @@
-/**
- * TEMP environment variable snapshot.
- * Windows temporary directory path.
- */
-
-import { env } from 'node:process'
-
-export const TEMP = env['TEMP']
diff --git a/src/env/term.ts b/src/env/term.ts
index 3a93776..704625c 100644
--- a/src/env/term.ts
+++ b/src/env/term.ts
@@ -1,8 +1,10 @@
 /**
- * TERM environment variable snapshot.
+ * TERM environment variable getter.
  * Terminal type identifier.
  */
 
-import { env } from 'node:process'
+import { getEnvValue } from '#env/rewire'
 
-export const TERM = env['TERM']
+export function getTerm(): string | undefined {
+  return getEnvValue('TERM')
+}
diff --git a/src/env/test.ts b/src/env/test.ts
new file mode 100644
index 0000000..d854734
--- /dev/null
+++ b/src/env/test.ts
@@ -0,0 +1,33 @@
+/**
+ * @fileoverview Test environment variable getters and detection.
+ * Provides access to test framework environment variables and utilities.
+ */
+
+import { envAsBoolean, envAsString } from '#env/helpers'
+import { getNodeEnv } from '#env/node-env'
+import { getEnvValue } from '#env/rewire'
+
+/**
+ * JEST_WORKER_ID environment variable.
+ * Set when running tests with Jest.
+ */
+export function getJestWorkerId(): string {
+  return envAsString(getEnvValue('JEST_WORKER_ID'))
+}
+
+/**
+ * VITEST environment variable.
+ * Set when running tests with Vitest.
+ */
+export function getVitest(): boolean {
+  return envAsBoolean(getEnvValue('VITEST'))
+}
+
+/**
+ * Check if code is running in a test environment.
+ * Checks NODE_ENV, VITEST, and JEST_WORKER_ID.
+ */
+export function isTest(): boolean {
+  const nodeEnv = envAsString(getNodeEnv())
+  return nodeEnv === 'test' || getVitest() || !!getJestWorkerId()
+}
diff --git a/src/env/tmp.ts b/src/env/tmp.ts
deleted file mode 100644
index 4475aa0..0000000
--- a/src/env/tmp.ts
+++ /dev/null
@@ -1,8 +0,0 @@
-/**
- * TMP environment variable snapshot.
- * Alternative temporary directory path.
- */
-
-import { env } from 'node:process'
-
-export const TMP = env['TMP']
diff --git a/src/env/tmpdir.ts b/src/env/tmpdir.ts
deleted file mode 100644
index eb3f011..0000000
--- a/src/env/tmpdir.ts
+++ /dev/null
@@ -1,8 +0,0 @@
-/**
- * TMPDIR environment variable snapshot.
- * Unix/macOS temporary directory path.
- */
-
-import { env } from 'node:process'
-
-export const TMPDIR = env['TMPDIR']
diff --git a/src/env/userprofile.ts b/src/env/userprofile.ts
deleted file mode 100644
index 36c4d12..0000000
--- a/src/env/userprofile.ts
+++ /dev/null
@@ -1,8 +0,0 @@
-/**
- * USERPROFILE environment variable snapshot.
- * Windows user home directory path.
- */
-
-import { env } from 'node:process'
-
-export const USERPROFILE = env['USERPROFILE']
diff --git a/src/env/vitest.ts b/src/env/vitest.ts
deleted file mode 100644
index 672b8f3..0000000
--- a/src/env/vitest.ts
+++ /dev/null
@@ -1,10 +0,0 @@
-/**
- * VITEST environment variable snapshot.
- * Set when running tests with Vitest.
- */
-
-import { env } from 'node:process'
-
-import { envAsBoolean } from '#env/helpers'
-
-export const VITEST = envAsBoolean(env['VITEST'])
diff --git a/src/env/windows.ts b/src/env/windows.ts
new file mode 100644
index 0000000..8ccb5ec
--- /dev/null
+++ b/src/env/windows.ts
@@ -0,0 +1,38 @@
+/**
+ * @fileoverview Windows environment variable getters.
+ * Provides access to Windows-specific user directory paths.
+ */
+
+import { getEnvValue } from '#env/rewire'
+
+/**
+ * APPDATA environment variable.
+ * Points to the Application Data directory on Windows.
+ */
+export function getAppdata(): string | undefined {
+  return getEnvValue('APPDATA')
+}
+
+/**
+ * LOCALAPPDATA environment variable.
+ * Points to the Local Application Data directory on Windows.
+ */
+export function getLocalappdata(): string | undefined {
+  return getEnvValue('LOCALAPPDATA')
+}
+
+/**
+ * USERPROFILE environment variable.
+ * Windows user home directory path.
+ */
+export function getUserprofile(): string | undefined {
+  return getEnvValue('USERPROFILE')
+}
+
+/**
+ * COMSPEC environment variable.
+ * Points to the Windows command processor (typically cmd.exe).
+ */
+export function getComspec(): string | undefined {
+  return getEnvValue('COMSPEC')
+}
diff --git a/src/env/xdg-cache-home.ts b/src/env/xdg-cache-home.ts
deleted file mode 100644
index 6d413a5..0000000
--- a/src/env/xdg-cache-home.ts
+++ /dev/null
@@ -1,8 +0,0 @@
-/**
- * XDG_CACHE_HOME environment variable snapshot.
- * XDG Base Directory specification cache directory.
- */
-
-import { env } from 'node:process'
-
-export const XDG_CACHE_HOME = env['XDG_CACHE_HOME']
diff --git a/src/env/xdg-config-home.ts b/src/env/xdg-config-home.ts
deleted file mode 100644
index b5b08e8..0000000
--- a/src/env/xdg-config-home.ts
+++ /dev/null
@@ -1,8 +0,0 @@
-/**
- * XDG_CONFIG_HOME environment variable snapshot.
- * XDG Base Directory specification config directory.
- */
-
-import { env } from 'node:process'
-
-export const XDG_CONFIG_HOME = env['XDG_CONFIG_HOME']
diff --git a/src/env/xdg-data-home.ts b/src/env/xdg-data-home.ts
deleted file mode 100644
index 58f21dd..0000000
--- a/src/env/xdg-data-home.ts
+++ /dev/null
@@ -1,8 +0,0 @@
-/**
- * XDG_DATA_HOME environment variable snapshot.
- * Points to the user's data directory on Unix systems (XDG Base Directory specification).
- */
-
-import { env } from 'node:process'
-
-export const XDG_DATA_HOME = env['XDG_DATA_HOME']
diff --git a/src/env/xdg.ts b/src/env/xdg.ts
new file mode 100644
index 0000000..0d6b19f
--- /dev/null
+++ b/src/env/xdg.ts
@@ -0,0 +1,30 @@
+/**
+ * @fileoverview XDG Base Directory Specification environment variable getters.
+ * Provides access to XDG user directories on Unix systems.
+ */
+
+import { getEnvValue } from '#env/rewire'
+
+/**
+ * XDG_CACHE_HOME environment variable.
+ * XDG Base Directory specification cache directory.
+ */
+export function getXdgCacheHome(): string | undefined {
+  return getEnvValue('XDG_CACHE_HOME')
+}
+
+/**
+ * XDG_CONFIG_HOME environment variable.
+ * XDG Base Directory specification config directory.
+ */
+export function getXdgConfigHome(): string | undefined {
+  return getEnvValue('XDG_CONFIG_HOME')
+}
+
+/**
+ * XDG_DATA_HOME environment variable.
+ * Points to the user's data directory on Unix systems.
+ */
+export function getXdgDataHome(): string | undefined {
+  return getEnvValue('XDG_DATA_HOME')
+}
diff --git a/src/external/@inquirer/confirm.js b/src/external/@inquirer/confirm.js
index 36dc331..b860826 100644
--- a/src/external/@inquirer/confirm.js
+++ b/src/external/@inquirer/confirm.js
@@ -1 +1,3 @@
+'use strict'
+
 module.exports = require('@inquirer/confirm')
diff --git a/src/external/@inquirer/input.js b/src/external/@inquirer/input.js
index 63370f4..132847d 100644
--- a/src/external/@inquirer/input.js
+++ b/src/external/@inquirer/input.js
@@ -1 +1,3 @@
+'use strict'
+
 module.exports = require('@inquirer/input')
diff --git a/src/external/@inquirer/password.js b/src/external/@inquirer/password.js
index 5f24f56..572d069 100644
--- a/src/external/@inquirer/password.js
+++ b/src/external/@inquirer/password.js
@@ -1 +1,3 @@
+'use strict'
+
 module.exports = require('@inquirer/password')
diff --git a/src/external/@inquirer/search.js b/src/external/@inquirer/search.js
index a9de2e1..c24e762 100644
--- a/src/external/@inquirer/search.js
+++ b/src/external/@inquirer/search.js
@@ -1 +1,3 @@
+'use strict'
+
 module.exports = require('@inquirer/search')
diff --git a/src/external/@inquirer/select.js b/src/external/@inquirer/select.js
index 973a6a2..826538c 100644
--- a/src/external/@inquirer/select.js
+++ b/src/external/@inquirer/select.js
@@ -1 +1,3 @@
+'use strict'
+
 module.exports = require('@inquirer/select')
diff --git a/src/external/@npmcli/package-json.js b/src/external/@npmcli/package-json.js
new file mode 100644
index 0000000..31b8c37
--- /dev/null
+++ b/src/external/@npmcli/package-json.js
@@ -0,0 +1,3 @@
+'use strict'
+
+module.exports = require('@npmcli/package-json')
diff --git a/src/external/@npmcli/package-json/index.js b/src/external/@npmcli/package-json/index.js
index c1f5900..31b8c37 100644
--- a/src/external/@npmcli/package-json/index.js
+++ b/src/external/@npmcli/package-json/index.js
@@ -1 +1,3 @@
+'use strict'
+
 module.exports = require('@npmcli/package-json')
diff --git a/src/external/@npmcli/package-json/lib/read-package.js b/src/external/@npmcli/package-json/lib/read-package.js
index e358143..809588c 100644
--- a/src/external/@npmcli/package-json/lib/read-package.js
+++ b/src/external/@npmcli/package-json/lib/read-package.js
@@ -1 +1,4 @@
+'use strict'
+
+// Entry point for bundling @npmcli/package-json/lib/read-package
 module.exports = require('@npmcli/package-json/lib/read-package.js')
diff --git a/src/external/@npmcli/package-json/lib/sort.js b/src/external/@npmcli/package-json/lib/sort.js
index eb9f405..e678160 100644
--- a/src/external/@npmcli/package-json/lib/sort.js
+++ b/src/external/@npmcli/package-json/lib/sort.js
@@ -1 +1,4 @@
+'use strict'
+
+// Entry point for bundling @npmcli/package-json/lib/sort
 module.exports = require('@npmcli/package-json/lib/sort.js')
diff --git a/src/external/@npmcli/promise-spawn.js b/src/external/@npmcli/promise-spawn.js
index 80b4fb6..d76889e 100644
--- a/src/external/@npmcli/promise-spawn.js
+++ b/src/external/@npmcli/promise-spawn.js
@@ -1 +1,3 @@
+'use strict'
+
 module.exports = require('@npmcli/promise-spawn')
diff --git a/src/external/@socketregistry/is-unicode-supported.js b/src/external/@socketregistry/is-unicode-supported.js
index add30e9..da51e94 100644
--- a/src/external/@socketregistry/is-unicode-supported.js
+++ b/src/external/@socketregistry/is-unicode-supported.js
@@ -1 +1,3 @@
+'use strict'
+
 module.exports = require('@socketregistry/is-unicode-supported/index.cjs')
diff --git a/src/external/@socketregistry/packageurl-js.js b/src/external/@socketregistry/packageurl-js.js
index 758b292..52dfd40 100644
--- a/src/external/@socketregistry/packageurl-js.js
+++ b/src/external/@socketregistry/packageurl-js.js
@@ -1 +1,3 @@
+'use strict'
+
 module.exports = require('@socketregistry/packageurl-js')
diff --git a/src/external/@socketregistry/yocto-spinner.js b/src/external/@socketregistry/yocto-spinner.js
index 5bcdce8..08417ab 100644
--- a/src/external/@socketregistry/yocto-spinner.js
+++ b/src/external/@socketregistry/yocto-spinner.js
@@ -1,3 +1,5 @@
+'use strict'
+
 // Re-export the yocto-spinner constructor
 const YoctoSpinner = require('@socketregistry/yocto-spinner')
 module.exports = YoctoSpinner
diff --git a/src/external/@yarnpkg/extensions.d.ts b/src/external/@yarnpkg/extensions.d.ts
index cecb103..fd176a2 100644
--- a/src/external/@yarnpkg/extensions.d.ts
+++ b/src/external/@yarnpkg/extensions.d.ts
@@ -1,5 +1,4 @@
 declare const extensions: {
-  // biome-ignore lint/suspicious/noExplicitAny: External third-party type definition
   packageExtensions: any[]
 }
 export = extensions
diff --git a/src/external/@yarnpkg/extensions.js b/src/external/@yarnpkg/extensions.js
index 350528d..2163829 100644
--- a/src/external/@yarnpkg/extensions.js
+++ b/src/external/@yarnpkg/extensions.js
@@ -1 +1,3 @@
+'use strict'
+
 module.exports = require('@yarnpkg/extensions')
diff --git a/src/external/cacache.d.ts b/src/external/cacache.d.ts
index 749e998..a8dc5b9 100644
--- a/src/external/cacache.d.ts
+++ b/src/external/cacache.d.ts
@@ -8,7 +8,6 @@ declare namespace Cacache {
   interface PutOptions {
     integrity?: string | undefined
     size?: number | undefined
-    // biome-ignore lint/suspicious/noExplicitAny: External third-party type definition
     metadata?: any | undefined
     memoize?: boolean | undefined
   }
@@ -17,7 +16,6 @@ declare namespace Cacache {
     data: Buffer
     integrity: string
     key: string
-    // biome-ignore lint/suspicious/noExplicitAny: External third-party type definition
     metadata?: any | undefined
     path: string
     size: number
@@ -30,7 +28,6 @@ declare namespace Cacache {
     path: string
     time: number
     size: number
-    // biome-ignore lint/suspicious/noExplicitAny: External third-party type definition
     metadata?: any | undefined
   }
 }
@@ -79,14 +76,10 @@ declare const cacache: {
   tmp: {
     withTmp: (
       cache: string,
-      // biome-ignore lint/suspicious/noExplicitAny: External third-party type definition
       opts: any,
-      // biome-ignore lint/suspicious/noExplicitAny: External third-party type definition
       callback: (tmpDirPath: string) => Promise<any>,
-      // biome-ignore lint/suspicious/noExplicitAny: External third-party type definition
     ) => Promise<any>
   }
-  // biome-ignore lint/suspicious/noExplicitAny: External third-party type definition
   [key: string]: any
 }
 
diff --git a/src/external/cacache.js b/src/external/cacache.js
index a16b028..1fc5659 100644
--- a/src/external/cacache.js
+++ b/src/external/cacache.js
@@ -1 +1,3 @@
+'use strict'
+
 module.exports = require('cacache')
diff --git a/src/external/debug.d.ts b/src/external/debug.d.ts
index 6851509..ba1afc9 100644
--- a/src/external/debug.d.ts
+++ b/src/external/debug.d.ts
@@ -7,16 +7,13 @@ interface Debug {
     showHidden?: boolean | null
     depth?: number | boolean | null
     colors?: boolean
-    // biome-ignore lint/suspicious/noExplicitAny: External third-party type definition
     [key: string]: any
   }
 }
 
 interface DebugInstance {
-  // biome-ignore lint/suspicious/noExplicitAny: External third-party type definition
   (...args: any[]): void
   enabled: boolean
-  // biome-ignore lint/suspicious/noExplicitAny: External third-party type definition
   log: (...args: any[]) => void
   namespace: string
 }
diff --git a/src/external/debug.js b/src/external/debug.js
index c5829c8..2a7ecb6 100644
--- a/src/external/debug.js
+++ b/src/external/debug.js
@@ -1 +1,3 @@
+'use strict'
+
 module.exports = require('debug')
diff --git a/src/external/del.js b/src/external/del.js
index d19f102..54dbe2c 100644
--- a/src/external/del.js
+++ b/src/external/del.js
@@ -1 +1,9 @@
-module.exports = require('del')
+'use strict'
+
+// Export only what we use to reduce bundle size
+const { deleteAsync, deleteSync } = require('del')
+
+module.exports = {
+  deleteAsync,
+  deleteSync,
+}
diff --git a/src/external/fast-glob.js b/src/external/fast-glob.js
index b0c551f..4a28c5c 100644
--- a/src/external/fast-glob.js
+++ b/src/external/fast-glob.js
@@ -1 +1,9 @@
-module.exports = require('fast-glob')
+'use strict'
+
+// Export only what we use to reduce bundle size
+const fastGlob = require('fast-glob')
+
+// Export just globStream - the only method we use
+module.exports = fastGlob.globStream
+  ? { globStream: fastGlob.globStream }
+  : fastGlob
diff --git a/src/external/fast-sort.d.ts b/src/external/fast-sort.d.ts
index 762751b..357ac36 100644
--- a/src/external/fast-sort.d.ts
+++ b/src/external/fast-sort.d.ts
@@ -1,4 +1,3 @@
 declare module 'fast-sort' {
-  // biome-ignore lint/suspicious/noExplicitAny: External third-party type definition
   export function createNewSortInstance(config?: any): any
 }
diff --git a/src/external/fast-sort.js b/src/external/fast-sort.js
index ec81b7a..2a44b37 100644
--- a/src/external/fast-sort.js
+++ b/src/external/fast-sort.js
@@ -1 +1,8 @@
-module.exports = require('fast-sort')
+'use strict'
+
+// Export only what we use to reduce bundle size
+const { createNewSortInstance } = require('fast-sort')
+
+module.exports = {
+  createNewSortInstance,
+}
diff --git a/src/external/get-east-asian-width.js b/src/external/get-east-asian-width.js
index 0e00401..664d1f0 100644
--- a/src/external/get-east-asian-width.js
+++ b/src/external/get-east-asian-width.js
@@ -1 +1,3 @@
+'use strict'
+
 module.exports = require('get-east-asian-width')
diff --git a/src/external/libnpmexec.d.ts b/src/external/libnpmexec.d.ts
new file mode 100644
index 0000000..6f173e8
--- /dev/null
+++ b/src/external/libnpmexec.d.ts
@@ -0,0 +1,33 @@
+/**
+ * Package manifest interface (subset of package.json)
+ */
+export interface PackageManifest {
+  name: string
+  bin?: string | Record<string, string>
+  _id?: string
+}
+
+/**
+ * Get the binary name to execute from a package manifest.
+ * Uses npm's bin resolution strategy:
+ * 1. If all bin values are identical (aliases), use first key
+ * 2. Try unscoped package name (e.g., 'cli' from '@scope/cli')
+ * 3. Throw error if cannot determine
+ *
+ * @param manifest - Package manifest object
+ * @returns Binary name to execute
+ * @throws Error if binary cannot be determined
+ *
+ * @example
+ * ```typescript
+ * const manifest = { name: '@scope/pkg', bin: { 'pkg': './bin/cli.js' } }
+ * getBinFromManifest(manifest) // Returns 'pkg'
+ * ```
+ */
+export function getBinFromManifest(manifest: PackageManifest): string
+
+declare const libnpmexec: {
+  getBinFromManifest: typeof getBinFromManifest
+}
+
+export = libnpmexec
diff --git a/src/external/libnpmexec.js b/src/external/libnpmexec.js
new file mode 100644
index 0000000..e35f4ad
--- /dev/null
+++ b/src/external/libnpmexec.js
@@ -0,0 +1,10 @@
+'use strict'
+
+// Export only what we use from libnpmexec to reduce bundle size
+// libnpmexec provides the npm exec (npx) programmatic API
+
+const getBinFromManifest = require('libnpmexec/lib/get-bin-from-manifest')
+
+module.exports = {
+  getBinFromManifest,
+}
diff --git a/src/external/libnpmpack.d.ts b/src/external/libnpmpack.d.ts
index 54032ef..fd4c770 100644
--- a/src/external/libnpmpack.d.ts
+++ b/src/external/libnpmpack.d.ts
@@ -1,3 +1,2 @@
-// biome-ignore lint/suspicious/noExplicitAny: External third-party type definition
 declare function libnpmpack(spec: string, options?: any): Promise<any>
 export = libnpmpack
diff --git a/src/external/libnpmpack.js b/src/external/libnpmpack.js
index c61a73c..ce7b83f 100644
--- a/src/external/libnpmpack.js
+++ b/src/external/libnpmpack.js
@@ -1 +1,3 @@
+'use strict'
+
 module.exports = require('libnpmpack')
diff --git a/src/external/make-fetch-happen.d.ts b/src/external/make-fetch-happen.d.ts
index 47a0035..2aaf449 100644
--- a/src/external/make-fetch-happen.d.ts
+++ b/src/external/make-fetch-happen.d.ts
@@ -1,7 +1,6 @@
 interface FetchOptions {
   cache?: string
   headers?: Record<string, string>
-  // biome-ignore lint/suspicious/noExplicitAny: External third-party type definition
   [key: string]: any
 }
 
diff --git a/src/external/make-fetch-happen.js b/src/external/make-fetch-happen.js
index 93ee0b8..a5dfd7d 100644
--- a/src/external/make-fetch-happen.js
+++ b/src/external/make-fetch-happen.js
@@ -1 +1,3 @@
+'use strict'
+
 module.exports = require('make-fetch-happen')
diff --git a/src/external/normalize-package-data.js b/src/external/normalize-package-data.js
index e5f0645..a900982 100644
--- a/src/external/normalize-package-data.js
+++ b/src/external/normalize-package-data.js
@@ -1 +1,3 @@
+'use strict'
+
 module.exports = require('normalize-package-data')
diff --git a/src/external/npm-package-arg.js b/src/external/npm-package-arg.js
index f706657..6db5201 100644
--- a/src/external/npm-package-arg.js
+++ b/src/external/npm-package-arg.js
@@ -1 +1,3 @@
+'use strict'
+
 module.exports = require('npm-package-arg')
diff --git a/src/external/pacote.d.ts b/src/external/pacote.d.ts
index 87f5779..2560333 100644
--- a/src/external/pacote.d.ts
+++ b/src/external/pacote.d.ts
@@ -1,18 +1,13 @@
 declare class RegistryFetcher {
-  // biome-ignore lint/suspicious/noExplicitAny: External third-party type definition
   constructor(spec: string, opts?: any)
   cache: string
 }
 
 declare const pacote: {
   RegistryFetcher: typeof RegistryFetcher
-  // biome-ignore lint/suspicious/noExplicitAny: External third-party type definition
   extract(spec: string, dest: string, opts?: any): Promise<any>
-  // biome-ignore lint/suspicious/noExplicitAny: External third-party type definition
   manifest(spec: string, opts?: any): Promise<any>
-  // biome-ignore lint/suspicious/noExplicitAny: External third-party type definition
   packument(spec: string, opts?: any): Promise<any>
-  // biome-ignore lint/suspicious/noExplicitAny: External third-party type definition
   tarball(spec: string, opts?: any): Promise<Buffer>
 }
 
diff --git a/src/external/pacote.js b/src/external/pacote.js
index 1752d63..30ca091 100644
--- a/src/external/pacote.js
+++ b/src/external/pacote.js
@@ -1 +1,3 @@
+'use strict'
+
 module.exports = require('pacote')
diff --git a/src/external/picomatch.js b/src/external/picomatch.js
index 1a94b6c..07d848e 100644
--- a/src/external/picomatch.js
+++ b/src/external/picomatch.js
@@ -1 +1,3 @@
+'use strict'
+
 module.exports = require('picomatch')
diff --git a/src/external/semver.d.ts b/src/external/semver.d.ts
index 13298e8..f8dfe23 100644
--- a/src/external/semver.d.ts
+++ b/src/external/semver.d.ts
@@ -1,3 +1,2 @@
-// biome-ignore lint/suspicious/noExplicitAny: External third-party type definition
 declare const semver: any
 export = semver
diff --git a/src/external/semver.js b/src/external/semver.js
index be55707..11b463e 100644
--- a/src/external/semver.js
+++ b/src/external/semver.js
@@ -1 +1,3 @@
+'use strict'
+
 module.exports = require('semver')
diff --git a/src/external/spdx-correct.js b/src/external/spdx-correct.js
index be8bc3a..a4a123a 100644
--- a/src/external/spdx-correct.js
+++ b/src/external/spdx-correct.js
@@ -1 +1,3 @@
+'use strict'
+
 module.exports = require('spdx-correct')
diff --git a/src/external/spdx-expression-parse.js b/src/external/spdx-expression-parse.js
index f779ee6..2cb495c 100644
--- a/src/external/spdx-expression-parse.js
+++ b/src/external/spdx-expression-parse.js
@@ -1 +1,3 @@
+'use strict'
+
 module.exports = require('spdx-expression-parse')
diff --git a/src/external/streaming-iterables.js b/src/external/streaming-iterables.js
index 963e24c..48a1e45 100644
--- a/src/external/streaming-iterables.js
+++ b/src/external/streaming-iterables.js
@@ -1 +1,9 @@
-module.exports = require('streaming-iterables')
+'use strict'
+
+// Export only what we use to reduce bundle size
+const { parallelMap, transform } = require('streaming-iterables')
+
+module.exports = {
+  parallelMap,
+  transform,
+}
diff --git a/src/external/validate-npm-package-name.js b/src/external/validate-npm-package-name.js
index 68bd89e..f56e18a 100644
--- a/src/external/validate-npm-package-name.js
+++ b/src/external/validate-npm-package-name.js
@@ -1 +1,3 @@
+'use strict'
+
 module.exports = require('validate-npm-package-name')
diff --git a/src/external/which.js b/src/external/which.js
index bc1083d..7869ad5 100644
--- a/src/external/which.js
+++ b/src/external/which.js
@@ -1 +1,3 @@
+'use strict'
+
 module.exports = require('which')
diff --git a/src/external/yargs-parser.d.ts b/src/external/yargs-parser.d.ts
index dedc086..cd560b4 100644
--- a/src/external/yargs-parser.d.ts
+++ b/src/external/yargs-parser.d.ts
@@ -1,3 +1,2 @@
-// biome-ignore lint/suspicious/noExplicitAny: External third-party type definition
 declare const yargsParser: any
 export = yargsParser
diff --git a/src/external/yargs-parser.js b/src/external/yargs-parser.js
index 3be829e..00ffd40 100644
--- a/src/external/yargs-parser.js
+++ b/src/external/yargs-parser.js
@@ -1 +1,3 @@
+'use strict'
+
 module.exports = require('yargs-parser')
diff --git a/src/external/yoctocolors-cjs.d.ts b/src/external/yoctocolors-cjs.d.ts
index e7b163a..b09152d 100644
--- a/src/external/yoctocolors-cjs.d.ts
+++ b/src/external/yoctocolors-cjs.d.ts
@@ -22,6 +22,16 @@ interface YoctoColors {
   gray: (text: string) => string
   grey: (text: string) => string
 
+  // Bright colors
+  blackBright: (text: string) => string
+  redBright: (text: string) => string
+  greenBright: (text: string) => string
+  yellowBright: (text: string) => string
+  blueBright: (text: string) => string
+  magentaBright: (text: string) => string
+  cyanBright: (text: string) => string
+  whiteBright: (text: string) => string
+
   // Background colors
   bgBlack: (text: string) => string
   bgRed: (text: string) => string
@@ -31,6 +41,10 @@ interface YoctoColors {
   bgMagenta: (text: string) => string
   bgCyan: (text: string) => string
   bgWhite: (text: string) => string
+
+  // RGB colors
+  rgb: (r: number, g: number, b: number) => (text: string) => string
+  bgRgb: (r: number, g: number, b: number) => (text: string) => string
 }
 
 declare const yoctocolorsCjs: YoctoColors
diff --git a/src/external/yoctocolors-cjs.js b/src/external/yoctocolors-cjs.js
index 5d498fe..54a8359 100644
--- a/src/external/yoctocolors-cjs.js
+++ b/src/external/yoctocolors-cjs.js
@@ -1,3 +1,5 @@
+'use strict'
+
 const colors = require('yoctocolors-cjs')
 module.exports = colors
 module.exports.default = colors
diff --git a/src/external/zod.js b/src/external/zod.js
index 39de5f3..c18cd36 100644
--- a/src/external/zod.js
+++ b/src/external/zod.js
@@ -1,2 +1,4 @@
+'use strict'
+
 const { z } = require('zod')
 module.exports = { z }
diff --git a/src/fs.ts b/src/fs.ts
index 93017d6..f2f4b6d 100644
--- a/src/fs.ts
+++ b/src/fs.ts
@@ -3,15 +3,17 @@
  * Provides enhanced fs operations, glob matching, and directory traversal functions.
  */
 
-import type { Abortable } from 'node:events'
+import type { Abortable } from 'events'
+
 import type {
   Dirent,
+  MakeDirectoryOptions,
   ObjectEncodingOptions,
   OpenMode,
   PathLike,
   StatSyncOptions,
   WriteFileOptions,
-} from 'node:fs'
+} from 'fs'
 
 import { getAbortSignal } from '#constants/process'
 
@@ -24,9 +26,13 @@ import type { JsonReviver } from './json'
 import { jsonParse } from './json'
 import { objectFreeze, type Remap } from './objects'
 import { normalizePath, pathLikeToString } from './path'
+import { registerCacheInvalidation } from './paths/rewire'
 import { naturalCompare } from './sorts'
 
-// Type definitions
+/**
+ * Supported text encodings for Node.js Buffers.
+ * Includes ASCII, UTF-8/16, base64, binary, and hexadecimal encodings.
+ */
 export type BufferEncoding =
   | 'ascii'
   | 'utf8'
@@ -40,37 +46,116 @@ export type BufferEncoding =
   | 'binary'
   | 'hex'
 
+/**
+ * Represents any valid JSON content type.
+ */
 export type JsonContent = unknown
 
+/**
+ * Options for asynchronous `findUp` operations.
+ */
 export interface FindUpOptions {
-  cwd?: string
-  onlyDirectories?: boolean
-  onlyFiles?: boolean
-  signal?: AbortSignal
+  /**
+   * Starting directory for the search.
+   * @default process.cwd()
+   */
+  cwd?: string | undefined
+  /**
+   * Only match directories, not files.
+   * @default false
+   */
+  onlyDirectories?: boolean | undefined
+  /**
+   * Only match files, not directories.
+   * @default true
+   */
+  onlyFiles?: boolean | undefined
+  /**
+   * Abort signal to cancel the search operation.
+   */
+  signal?: AbortSignal | undefined
 }
 
+/**
+ * Options for synchronous `findUpSync` operations.
+ */
 export interface FindUpSyncOptions {
-  cwd?: string
-  stopAt?: string
-  onlyDirectories?: boolean
-  onlyFiles?: boolean
+  /**
+   * Starting directory for the search.
+   * @default process.cwd()
+   */
+  cwd?: string | undefined
+  /**
+   * Directory to stop searching at (inclusive).
+   * When provided, search will stop at this directory even if the root hasn't been reached.
+   */
+  stopAt?: string | undefined
+  /**
+   * Only match directories, not files.
+   * @default false
+   */
+  onlyDirectories?: boolean | undefined
+  /**
+   * Only match files, not directories.
+   * @default true
+   */
+  onlyFiles?: boolean | undefined
 }
 
+/**
+ * Options for checking if a directory is empty.
+ */
 export interface IsDirEmptyOptions {
+  /**
+   * Glob patterns for files to ignore when checking emptiness.
+   * Files matching these patterns are not counted.
+   * @default defaultIgnore
+   */
   ignore?: string[] | readonly string[] | undefined
 }
 
+/**
+ * Options for read operations with abort support.
+ */
 export interface ReadOptions extends Abortable {
-  encoding?: BufferEncoding | string
-  flag?: string
+  /**
+   * Character encoding to use for reading.
+   * @default 'utf8'
+   */
+  encoding?: BufferEncoding | string | undefined
+  /**
+   * File system flag for reading behavior.
+   * @default 'r'
+   */
+  flag?: string | undefined
 }
 
+/**
+ * Options for reading directories with filtering and sorting.
+ */
 export interface ReadDirOptions {
+  /**
+   * Glob patterns for directories to ignore.
+   * @default undefined
+   */
   ignore?: string[] | readonly string[] | undefined
+  /**
+   * Include empty directories in results.
+   * When `false`, empty directories are filtered out.
+   * @default true
+   */
   includeEmpty?: boolean | undefined
+  /**
+   * Sort directory names alphabetically using natural sort order.
+   * @default true
+   */
   sort?: boolean | undefined
 }
 
+/**
+ * Options for reading files with encoding and abort support.
+ * Can be either an options object, an encoding string, or null.
+ */
 export type ReadFileOptions =
   | Remap<
       ObjectEncodingOptions &
@@ -81,35 +166,125 @@ export type ReadFileOptions =
   | BufferEncoding
   | null
 
+/**
+ * Options for reading and parsing JSON files.
+ */
 export type ReadJsonOptions = Remap<
   ReadFileOptions & {
+    /**
+     * Whether to throw errors on parse failure.
+     * When `false`, returns `undefined` on error instead of throwing.
+     * @default true
+     */
     throws?: boolean | undefined
-    reviver?: Parameters<typeof JSON.parse>[1]
+    /**
+     * JSON reviver function to transform parsed values.
+     * Same as the second parameter to `JSON.parse()`.
+     */
+    reviver?: Parameters<typeof JSON.parse>[1] | undefined
   }
 >
 
+/**
+ * Options for file/directory removal operations.
+ */
 export interface RemoveOptions {
-  force?: boolean
-  maxRetries?: number
-  recursive?: boolean
-  retryDelay?: number
-  signal?: AbortSignal
+  /**
+   * Force deletion even outside normally safe directories.
+   * When `false`, prevents deletion outside temp, cacache, and ~/.socket.
+   * @default true for safe directories, false otherwise
+   */
+  force?: boolean | undefined
+  /**
+   * Maximum number of retry attempts on failure.
+   * @default 3
+   */
+  maxRetries?: number | undefined
+  /**
+   * Recursively delete directories and contents.
+   * @default true
+   */
+  recursive?: boolean | undefined
+  /**
+   * Delay in milliseconds between retry attempts.
+   * @default 200
+   */
+  retryDelay?: number | undefined
+  /**
+   * Abort signal to cancel the operation.
+   */
+  signal?: AbortSignal | undefined
 }
 
+/**
+ * Options for safe read operations that don't throw on errors.
+ */
 export interface SafeReadOptions extends ReadOptions {
-  defaultValue?: unknown
+  /**
+   * Default value to return on read failure.
+   * If not provided, `undefined` is returned on error.
+   */
+  defaultValue?: unknown | undefined
 }
 
+/**
+ * Options for write operations with encoding and mode control.
+ */
 export interface WriteOptions extends Abortable {
-  encoding?: BufferEncoding | string
-  mode?: number
-  flag?: string
+  /**
+   * Character encoding for writing.
+   * @default 'utf8'
+   */
+  encoding?: BufferEncoding | string | undefined
+  /**
+   * File mode (permissions) to set.
+   * Uses standard Unix permission bits (e.g., 0o644).
+   * @default 0o666 (read/write for all, respecting umask)
+   */
+  mode?: number | undefined
+  /**
+   * File system flag for write behavior.
+   * @default 'w' (create or truncate)
+   */
+  flag?: string | undefined
 }
 
+/**
+ * Options for writing JSON files with formatting control.
+ */
 export interface WriteJsonOptions extends WriteOptions {
+  /**
+   * End-of-line sequence to use.
+   * @default '\n'
+   * @example
+   * ```ts
+   * // Windows-style line endings
+   * writeJson('data.json', data, { EOL: '\r\n' })
+   * ```
+   */
   EOL?: string | undefined
+  /**
+   * Whether to add a final newline at end of file.
+   * @default true
+   */
   finalEOL?: boolean | undefined
+  /**
+   * JSON replacer function to transform values during stringification.
+   * Same as the second parameter to `JSON.stringify()`.
+   */
   replacer?: JsonReviver | undefined
+  /**
+   * Number of spaces for indentation, or string to use for indentation.
+   * @default 2
+   * @example
+   * ```ts
+   * // Use tabs instead of spaces
+   * writeJson('data.json', data, { spaces: '\t' })
+   *
+   * // Use 4 spaces for indentation
+   * writeJson('data.json', data, { spaces: 4 })
+   * ```
+   */
   spaces?: number | string | undefined
 }
 
@@ -124,12 +299,15 @@ const defaultRemoveOptions = objectFreeze({
 let _fs: typeof import('fs') | undefined
 /**
  * Lazily load the fs module to avoid Webpack errors.
+ * Uses non-'node:' prefixed require to prevent Webpack bundling issues.
+ *
+ * @returns The Node.js fs module
+ * @private
  */
 /*@__NO_SIDE_EFFECTS__*/
 function getFs() {
   if (_fs === undefined) {
     // Use non-'node:' prefixed require to avoid Webpack errors.
-
     _fs = /*@__PURE__*/ require('node:fs')
   }
   return _fs as typeof import('fs')
@@ -138,6 +316,9 @@ function getFs() {
 let _path: typeof import('path') | undefined
 /**
  * Lazily load the path module to avoid Webpack errors.
+ * Uses non-'node:' prefixed require to prevent Webpack bundling issues.
+ *
+ * @returns The Node.js path module
  * @private
  */
 /*@__NO_SIDE_EFFECTS__*/
@@ -150,23 +331,15 @@ function getPath() {
   return _path as typeof import('path')
 }
 
-let _os: typeof import('os') | undefined
-/**
- * Lazily load the os module to avoid Webpack errors.
- * @private
- */
-/*@__NO_SIDE_EFFECTS__*/
-function getOs() {
-  if (_os === undefined) {
-    // Use non-'node:' prefixed require to avoid Webpack errors.
-
-    _os = /*@__PURE__*/ require('node:os')
-  }
-  return _os as typeof import('os')
-}
-
 /**
  * Process directory entries and filter for directories.
+ * Filters entries to include only directories, optionally excluding empty ones.
+ * Applies ignore patterns and natural sorting.
+ *
+ * @param dirents - Directory entries from readdir
+ * @param dirname - Parent directory path
+ * @param options - Filtering and sorting options
+ * @returns Array of directory names, optionally sorted
  * @private
  */
 /*@__NO_SIDE_EFFECTS__*/
@@ -196,6 +369,14 @@ function innerReadDirNames(
 
 /**
  * Stringify JSON with custom formatting options.
+ * Formats JSON with configurable line endings and indentation.
+ *
+ * @param json - Value to stringify
+ * @param EOL - End-of-line sequence
+ * @param finalEOL - Whether to add final newline
+ * @param replacer - JSON replacer function
+ * @param spaces - Indentation spaces or string
+ * @returns Formatted JSON string
  * @private
  */
 /*@__NO_SIDE_EFFECTS__*/
@@ -213,6 +394,24 @@ function stringify(
 
 /**
  * Find a file or directory by traversing up parent directories.
+ * Searches from the starting directory upward to the filesystem root.
+ * Useful for finding configuration files or project roots.
+ *
+ * @param name - Filename(s) to search for
+ * @param options - Search options including cwd and type filters
+ * @returns Normalized absolute path if found, undefined otherwise
+ *
+ * @example
+ * ```ts
+ * // Find package.json starting from current directory
+ * const pkgPath = await findUp('package.json')
+ *
+ * // Find any of multiple config files
+ * const configPath = await findUp(['.config.js', '.config.json'])
+ *
+ * // Find a directory instead of file
+ * const nodeModules = await findUp('node_modules', { onlyDirectories: true })
+ * ```
  */
 /*@__NO_SIDE_EFFECTS__*/
 export async function findUp(
@@ -262,6 +461,27 @@ export async function findUp(
 
 /**
  * Synchronously find a file or directory by traversing up parent directories.
+ * Searches from the starting directory upward to the filesystem root or `stopAt` directory.
+ * Useful for finding configuration files or project roots in synchronous contexts.
+ *
+ * @param name - Filename(s) to search for
+ * @param options - Search options including cwd, stopAt, and type filters
+ * @returns Normalized absolute path if found, undefined otherwise
+ *
+ * @example
+ * ```ts
+ * // Find package.json starting from current directory
+ * const pkgPath = findUpSync('package.json')
+ *
+ * // Find .git directory but stop at home directory
+ * const gitPath = findUpSync('.git', {
+ *   onlyDirectories: true,
+ *   stopAt: process.env.HOME
+ * })
+ *
+ * // Find any of multiple config files
+ * const configPath = findUpSync(['.eslintrc.js', '.eslintrc.json'])
+ * ```
  */
 /*@__NO_SIDE_EFFECTS__*/
 export function findUpSync(
@@ -325,6 +545,17 @@ export function findUpSync(
 
 /**
  * Check if a path is a directory asynchronously.
+ * Returns `true` for directories, `false` for files or non-existent paths.
+ *
+ * @param filepath - Path to check
+ * @returns `true` if path is a directory, `false` otherwise
+ *
+ * @example
+ * ```ts
+ * if (await isDir('./src')) {
+ *   console.log('src is a directory')
+ * }
+ * ```
  */
 /*@__NO_SIDE_EFFECTS__*/
 export async function isDir(filepath: PathLike) {
@@ -333,6 +564,17 @@ export async function isDir(filepath: PathLike) {
 
 /**
  * Check if a path is a directory synchronously.
+ * Returns `true` for directories, `false` for files or non-existent paths.
+ *
+ * @param filepath - Path to check
+ * @returns `true` if path is a directory, `false` otherwise
+ *
+ * @example
+ * ```ts
+ * if (isDirSync('./src')) {
+ *   console.log('src is a directory')
+ * }
+ * ```
  */
 /*@__NO_SIDE_EFFECTS__*/
 export function isDirSync(filepath: PathLike) {
@@ -341,6 +583,21 @@ export function isDirSync(filepath: PathLike) {
 
 /**
  * Check if a directory is empty synchronously.
+ * A directory is considered empty if it contains no files after applying ignore patterns.
+ * Uses glob patterns to filter ignored files.
+ *
+ * @param dirname - Directory path to check
+ * @param options - Options including ignore patterns
+ * @returns `true` if directory is empty (or doesn't exist), `false` otherwise
+ *
+ * @example
+ * ```ts
+ * // Check if directory is completely empty
+ * isDirEmptySync('./build')
+ *
+ * // Check if directory is empty, ignoring .DS_Store files
+ * isDirEmptySync('./cache', { ignore: ['.DS_Store'] })
+ * ```
  */
 /*@__NO_SIDE_EFFECTS__*/
 export function isDirEmptySync(
@@ -380,6 +637,17 @@ export function isDirEmptySync(
 
 /**
  * Check if a path is a symbolic link synchronously.
+ * Uses `lstat` to check the link itself, not the target.
+ *
+ * @param filepath - Path to check
+ * @returns `true` if path is a symbolic link, `false` otherwise
+ *
+ * @example
+ * ```ts
+ * if (isSymLinkSync('./my-link')) {
+ *   console.log('Path is a symbolic link')
+ * }
+ * ```
  */
 /*@__NO_SIDE_EFFECTS__*/
 export function isSymLinkSync(filepath: PathLike) {
@@ -390,8 +658,94 @@ export function isSymLinkSync(filepath: PathLike) {
   return false
 }
 
+/**
+ * Result of file readability validation.
+ * Contains lists of valid and invalid file paths.
+ */
+export interface ValidateFilesResult {
+  /**
+   * File paths that passed validation and are readable.
+   */
+  validPaths: string[]
+  /**
+   * File paths that failed validation (unreadable, permission denied, or non-existent).
+   * Common with Yarn Berry PnP virtual filesystem, pnpm symlinks, or filesystem race conditions.
+   */
+  invalidPaths: string[]
+}
+
+/**
+ * Validate that file paths are readable before processing.
+ * Filters out files from glob results that cannot be accessed (common with
+ * Yarn Berry PnP virtual filesystem, pnpm content-addressable store symlinks,
+ * or filesystem race conditions in CI/CD environments).
+ *
+ * This defensive pattern prevents ENOENT errors when files exist in glob
+ * results but are not accessible via standard filesystem operations.
+ *
+ * @param filepaths - Array of file paths to validate
+ * @returns Object with `validPaths` (readable) and `invalidPaths` (unreadable)
+ *
+ * @example
+ * ```ts
+ * import { validateFiles } from '@socketsecurity/lib/fs'
+ *
+ * const files = ['package.json', '.pnp.cjs/virtual-file.json']
+ * const { validPaths, invalidPaths } = validateFiles(files)
+ *
+ * console.log(`Valid: ${validPaths.length}`)
+ * console.log(`Invalid: ${invalidPaths.length}`)
+ * ```
+ *
+ * @example
+ * ```ts
+ * // Typical usage in Socket CLI commands
+ * const packagePaths = await getPackageFilesForScan(targets)
+ * const { validPaths } = validateFiles(packagePaths)
+ * await sdk.uploadManifestFiles(orgSlug, validPaths)
+ * ```
+ */
+/*@__NO_SIDE_EFFECTS__*/
+export function validateFiles(
+  filepaths: string[] | readonly string[],
+): ValidateFilesResult {
+  const fs = getFs()
+  const validPaths: string[] = []
+  const invalidPaths: string[] = []
+  const { R_OK } = fs.constants
+
+  for (const filepath of filepaths) {
+    try {
+      fs.accessSync(filepath, R_OK)
+      validPaths.push(filepath)
+    } catch {
+      invalidPaths.push(filepath)
+    }
+  }
+
+  return { __proto__: null, validPaths, invalidPaths } as ValidateFilesResult
+}
+
 /**
  * Read directory names asynchronously with filtering and sorting.
+ * Returns only directory names (not files), with optional filtering for empty directories
+ * and glob-based ignore patterns. Results are naturally sorted by default.
+ *
+ * @param dirname - Directory path to read
+ * @param options - Options for filtering and sorting
+ * @returns Array of directory names, empty array on error
+ *
+ * @example
+ * ```ts
+ * // Get all subdirectories, sorted naturally
+ * const dirs = await readDirNames('./packages')
+ *
+ * // Get non-empty directories only
+ * const nonEmpty = await readDirNames('./cache', { includeEmpty: false })
+ *
+ * // Get directories without sorting
+ * const unsorted = await readDirNames('./src', { sort: false })
+ * ```
  */
 /*@__NO_SIDE_EFFECTS__*/
 export async function readDirNames(
@@ -415,6 +769,24 @@ export async function readDirNames(
 
 /**
  * Read directory names synchronously with filtering and sorting.
+ * Returns only directory names (not files), with optional filtering for empty directories
+ * and glob-based ignore patterns. Results are naturally sorted by default.
+ *
+ * @param dirname - Directory path to read
+ * @param options - Options for filtering and sorting
+ * @returns Array of directory names, empty array on error
+ *
+ * @example
+ * ```ts
+ * // Get all subdirectories, sorted naturally
+ * const dirs = readDirNamesSync('./packages')
+ *
+ * // Get non-empty directories only, ignoring node_modules
+ * const nonEmpty = readDirNamesSync('./src', {
+ *   includeEmpty: false,
+ *   ignore: ['node_modules']
+ * })
+ * ```
  */
 /*@__NO_SIDE_EFFECTS__*/
 export function readDirNamesSync(dirname: PathLike, options?: ReadDirOptions) {
@@ -435,6 +807,21 @@ export function readDirNamesSync(dirname: PathLike, options?: ReadDirOptions) {
 
 /**
  * Read a file as binary data asynchronously.
+ * Returns a Buffer without encoding the contents.
+ * Useful for reading images, archives, or other binary formats.
+ *
+ * @param filepath - Path to file
+ * @param options - Read options (encoding is forced to null for binary)
+ * @returns Promise resolving to Buffer containing file contents
+ *
+ * @example
+ * ```ts
+ * // Read an image file
+ * const imageBuffer = await readFileBinary('./image.png')
+ *
+ * // Read with abort signal
+ * const buffer = await readFileBinary('./data.bin', { signal: abortSignal })
+ * ```
  */
 /*@__NO_SIDE_EFFECTS__*/
 export async function readFileBinary(
@@ -453,6 +840,21 @@ export async function readFileBinary(
 
 /**
  * Read a file as UTF-8 text asynchronously.
+ * Returns a string with the file contents decoded as UTF-8.
+ * This is the most common way to read text files.
+ *
+ * @param filepath - Path to file
+ * @param options - Read options including encoding and abort signal
+ * @returns Promise resolving to string containing file contents
+ *
+ * @example
+ * ```ts
+ * // Read a text file
+ * const content = await readFileUtf8('./README.md')
+ *
+ * // Read with custom encoding
+ * const content = await readFileUtf8('./data.txt', { encoding: 'utf-8' })
+ * ```
  */
 /*@__NO_SIDE_EFFECTS__*/
 export async function readFileUtf8(
@@ -470,6 +872,21 @@ export async function readFileUtf8(
 
 /**
  * Read a file as binary data synchronously.
+ * Returns a Buffer without encoding the contents.
+ * Useful for reading images, archives, or other binary formats.
+ *
+ * @param filepath - Path to file
+ * @param options - Read options (encoding is forced to null for binary)
+ * @returns Buffer containing file contents
+ *
+ * @example
+ * ```ts
+ * // Read an image file
+ * const imageBuffer = readFileBinarySync('./logo.png')
+ *
+ * // Read a compressed file
+ * const gzipData = readFileBinarySync('./archive.gz')
+ * ```
  */
 /*@__NO_SIDE_EFFECTS__*/
 export function readFileBinarySync(
@@ -487,6 +904,21 @@ export function readFileBinarySync(
 
 /**
  * Read a file as UTF-8 text synchronously.
+ * Returns a string with the file contents decoded as UTF-8.
+ * This is the most common way to read text files synchronously.
+ *
+ * @param filepath - Path to file
+ * @param options - Read options including encoding
+ * @returns String containing file contents
+ *
+ * @example
+ * ```ts
+ * // Read a configuration file
+ * const config = readFileUtf8Sync('./config.txt')
+ *
+ * // Read with custom options
+ * const data = readFileUtf8Sync('./data.txt', { encoding: 'utf8' })
+ * ```
  */
 /*@__NO_SIDE_EFFECTS__*/
 export function readFileUtf8Sync(
@@ -503,6 +935,32 @@ export function readFileUtf8Sync(
 
 /**
  * Read and parse a JSON file asynchronously.
+ * Reads the file as UTF-8 text and parses it as JSON.
+ * Optionally accepts a reviver function to transform parsed values.
+ *
+ * @param filepath - Path to JSON file
+ * @param options - Read and parse options
+ * @returns Promise resolving to parsed JSON value, or undefined if throws is false and an error occurs
+ *
+ * @example
+ * ```ts
+ * // Read and parse package.json
+ * const pkg = await readJson('./package.json')
+ *
+ * // Read JSON with custom reviver
+ * const data = await readJson('./data.json', {
+ *   reviver: (key, value) => {
+ *     if (key === 'date') return new Date(value)
+ *     return value
+ *   }
+ * })
+ *
+ * // Don't throw on parse errors
+ * const config = await readJson('./config.json', { throws: false })
+ * if (config === undefined) {
+ *   console.log('Failed to parse config')
+ * }
+ * ```
  */
 /*@__NO_SIDE_EFFECTS__*/
 export async function readJson(
@@ -527,6 +985,21 @@ export async function readJson(
     })
   } catch (e) {
     if (shouldThrow) {
+      const code = (e as NodeJS.ErrnoException).code
+      if (code === 'ENOENT') {
+        throw new Error(
+          `JSON file not found: ${filepath}\n` +
+            'Ensure the file exists or create it with the expected structure.',
+          { cause: e },
+        )
+      }
+      if (code === 'EACCES' || code === 'EPERM') {
+        throw new Error(
+          `Permission denied reading JSON file: ${filepath}\n` +
+            'Check file permissions or run with appropriate access.',
+          { cause: e },
+        )
+      }
       throw e
     }
     return undefined
@@ -540,6 +1013,31 @@ export async function readJson(
 
 /**
  * Read and parse a JSON file synchronously.
+ * Reads the file as UTF-8 text and parses it as JSON.
+ * Optionally accepts a reviver function to transform parsed values.
+ *
+ * @param filepath - Path to JSON file
+ * @param options - Read and parse options
+ * @returns Parsed JSON value, or undefined if throws is false and an error occurs
+ *
+ * @example
+ * ```ts
+ * // Read and parse tsconfig.json
+ * const tsconfig = readJsonSync('./tsconfig.json')
+ *
+ * // Read JSON with custom reviver
+ * const data = readJsonSync('./data.json', {
+ *   reviver: (key, value) => {
+ *     if (typeof value === 'string' && /^\d{4}-\d{2}-\d{2}/.test(value)) {
+ *       return new Date(value)
+ *     }
+ *     return value
+ *   }
+ * })
+ *
+ * // Don't throw on parse errors
+ * const config = readJsonSync('./config.json', { throws: false })
+ * ```
  */
 /*@__NO_SIDE_EFFECTS__*/
 export function readJsonSync(
@@ -564,6 +1062,21 @@ export function readJsonSync(
     })
   } catch (e) {
     if (shouldThrow) {
+      const code = (e as NodeJS.ErrnoException).code
+      if (code === 'ENOENT') {
+        throw new Error(
+          `JSON file not found: ${filepath}\n` +
+            'Ensure the file exists or create it with the expected structure.',
+          { cause: e },
+        )
+      }
+      if (code === 'EACCES' || code === 'EPERM') {
+        throw new Error(
+          `Permission denied reading JSON file: ${filepath}\n` +
+            'Check file permissions or run with appropriate access.',
+          { cause: e },
+        )
+      }
       throw e
     }
     return undefined
@@ -575,19 +1088,74 @@ export function readJsonSync(
   })
 }
 
+// Cache for resolved allowed directories
+let _cachedAllowedDirs: string[] | undefined
+
+/**
+ * Get resolved allowed directories for safe deletion with lazy caching.
+ * These directories are resolved once and cached for the process lifetime.
+ */
+function getAllowedDirectories(): string[] {
+  if (_cachedAllowedDirs === undefined) {
+    const path = getPath()
+    const {
+      getOsTmpDir,
+      getSocketCacacheDir,
+      getSocketUserDir,
+    } = /*@__PURE__*/ require('#lib/paths')
+
+    _cachedAllowedDirs = [
+      path.resolve(getOsTmpDir()),
+      path.resolve(getSocketCacacheDir()),
+      path.resolve(getSocketUserDir()),
+    ]
+  }
+  return _cachedAllowedDirs
+}
+
+/**
+ * Invalidate the cached allowed directories.
+ * Called automatically by the paths/rewire module when paths are overridden in tests.
+ *
+ * @internal Used for test rewiring
+ */
+export function invalidatePathCache(): void {
+  _cachedAllowedDirs = undefined
+}
+
+// Register cache invalidation with the rewire module
+registerCacheInvalidation(invalidatePathCache)
+
 /**
  * Safely delete a file or directory asynchronously with built-in protections.
  * Uses `del` for safer deletion that prevents removing cwd and above by default.
  * Automatically uses force: true for temp directory, cacache, and ~/.socket subdirectories.
- * @throws {Error} When attempting to delete protected paths without force option.
+ *
+ * @param filepath - Path or array of paths to delete (supports glob patterns)
+ * @param options - Deletion options including force, retries, and recursion
+ * @throws {Error} When attempting to delete protected paths without force option
+ *
+ * @example
+ * ```ts
+ * // Delete a single file
+ * await safeDelete('./temp-file.txt')
+ *
+ * // Delete a directory recursively
+ * await safeDelete('./build', { recursive: true })
+ *
+ * // Delete multiple paths
+ * await safeDelete(['./dist', './coverage'])
+ *
+ * // Delete with custom retry settings
+ * await safeDelete('./flaky-dir', { maxRetries: 5, retryDelay: 500 })
+ * ```
  */
 /*@__NO_SIDE_EFFECTS__*/
 export async function safeDelete(
   filepath: PathLike | PathLike[],
   options?: RemoveOptions | undefined,
 ) {
-  const del = /*@__PURE__*/ require('../external/del')
-  const { deleteAsync } = del
+  const { deleteAsync } = /*@__PURE__*/ require('./external/del')
   const opts = { __proto__: null, ...options } as RemoveOptions
   const patterns = isArray(filepath)
     ? filepath.map(pathLikeToString)
@@ -596,31 +1164,15 @@ export async function safeDelete(
   // Check if we're deleting within allowed directories.
   let shouldForce = opts.force !== false
   if (!shouldForce && patterns.length > 0) {
-    const os = getOs()
     const path = getPath()
-    const {
-      getSocketCacacheDir,
-      getSocketUserDir,
-    } = /*@__PURE__*/ require('./paths')
-
-    // Get allowed directories
-    const tmpDir = os.tmpdir()
-    const resolvedTmpDir = path.resolve(tmpDir)
-    const cacacheDir = getSocketCacacheDir()
-    const resolvedCacacheDir = path.resolve(cacacheDir)
-    const socketUserDir = getSocketUserDir()
-    const resolvedSocketUserDir = path.resolve(socketUserDir)
+    const allowedDirs = getAllowedDirectories()
 
     // Check if all patterns are within allowed directories.
     const allInAllowedDirs = patterns.every(pattern => {
       const resolvedPath = path.resolve(pattern)
 
       // Check each allowed directory
-      for (const allowedDir of [
-        resolvedTmpDir,
-        resolvedCacacheDir,
-        resolvedSocketUserDir,
-      ]) {
+      for (const allowedDir of allowedDirs) {
         const isInAllowedDir =
           resolvedPath.startsWith(allowedDir + path.sep) ||
           resolvedPath === allowedDir
@@ -652,15 +1204,32 @@ export async function safeDelete(
  * Safely delete a file or directory synchronously with built-in protections.
  * Uses `del` for safer deletion that prevents removing cwd and above by default.
  * Automatically uses force: true for temp directory, cacache, and ~/.socket subdirectories.
- * @throws {Error} When attempting to delete protected paths without force option.
+ *
+ * @param filepath - Path or array of paths to delete (supports glob patterns)
+ * @param options - Deletion options including force, retries, and recursion
+ * @throws {Error} When attempting to delete protected paths without force option
+ *
+ * @example
+ * ```ts
+ * // Delete a single file
+ * safeDeleteSync('./temp-file.txt')
+ *
+ * // Delete a directory recursively
+ * safeDeleteSync('./build', { recursive: true })
+ *
+ * // Delete multiple paths with globs
+ * safeDeleteSync(['./dist/**', './coverage/**'])
+ *
+ * // Force delete a protected path (use with caution)
+ * safeDeleteSync('./important', { force: true })
+ * ```
  */
 /*@__NO_SIDE_EFFECTS__*/
 export function safeDeleteSync(
   filepath: PathLike | PathLike[],
   options?: RemoveOptions | undefined,
 ) {
-  const del = /*@__PURE__*/ require('../external/del')
-  const { deleteSync } = del
+  const { deleteSync } = /*@__PURE__*/ require('./external/del')
   const opts = { __proto__: null, ...options } as RemoveOptions
   const patterns = isArray(filepath)
     ? filepath.map(pathLikeToString)
@@ -669,31 +1238,15 @@ export function safeDeleteSync(
   // Check if we're deleting within allowed directories.
   let shouldForce = opts.force !== false
   if (!shouldForce && patterns.length > 0) {
-    const os = getOs()
     const path = getPath()
-    const {
-      getSocketCacacheDir,
-      getSocketUserDir,
-    } = /*@__PURE__*/ require('./paths')
-
-    // Get allowed directories
-    const tmpDir = os.tmpdir()
-    const resolvedTmpDir = path.resolve(tmpDir)
-    const cacacheDir = getSocketCacacheDir()
-    const resolvedCacacheDir = path.resolve(cacacheDir)
-    const socketUserDir = getSocketUserDir()
-    const resolvedSocketUserDir = path.resolve(socketUserDir)
+    const allowedDirs = getAllowedDirectories()
 
     // Check if all patterns are within allowed directories.
     const allInAllowedDirs = patterns.every(pattern => {
       const resolvedPath = path.resolve(pattern)
 
       // Check each allowed directory
-      for (const allowedDir of [
-        resolvedTmpDir,
-        resolvedCacacheDir,
-        resolvedSocketUserDir,
-      ]) {
+      for (const allowedDir of allowedDirs) {
         const isInAllowedDir =
           resolvedPath.startsWith(allowedDir + path.sep) ||
           resolvedPath === allowedDir
@@ -721,8 +1274,129 @@ export function safeDeleteSync(
   })
 }
 
+/**
+ * Safely create a directory asynchronously, ignoring EEXIST errors.
+ * This function wraps fs.promises.mkdir and handles the race condition where
+ * the directory might already exist, which is common in concurrent code.
+ *
+ * Unlike fs.promises.mkdir with recursive:true, this function:
+ * - Silently ignores EEXIST errors (directory already exists)
+ * - Re-throws all other errors (permissions, invalid path, etc.)
+ * - Works reliably in multi-process/concurrent scenarios
+ * - Defaults to recursive: true for convenient nested directory creation
+ *
+ * @param path - Directory path to create
+ * @param options - Options including recursive (default: true) and mode settings
+ * @returns Promise that resolves when directory is created or already exists
+ *
+ * @example
+ * ```ts
+ * // Create a directory recursively by default, no error if it exists
+ * await safeMkdir('./config')
+ *
+ * // Create nested directories (recursive: true is the default)
+ * await safeMkdir('./data/cache/temp')
+ *
+ * // Create with specific permissions
+ * await safeMkdir('./secure', { mode: 0o700 })
+ *
+ * // Explicitly disable recursive behavior
+ * await safeMkdir('./single-level', { recursive: false })
+ * ```
+ */
+/*@__NO_SIDE_EFFECTS__*/
+export async function safeMkdir(
+  path: PathLike,
+  options?: MakeDirectoryOptions | undefined,
+): Promise<void> {
+  const fs = getFs()
+  const opts = { __proto__: null, recursive: true, ...options }
+  try {
+    await fs.promises.mkdir(path, opts)
+  } catch (e: unknown) {
+    // Ignore EEXIST error - directory already exists.
+    if (
+      typeof e === 'object' &&
+      e !== null &&
+      'code' in e &&
+      e.code !== 'EEXIST'
+    ) {
+      throw e
+    }
+  }
+}
+
+/**
+ * Safely create a directory synchronously, ignoring EEXIST errors.
+ * This function wraps fs.mkdirSync and handles the race condition where
+ * the directory might already exist, which is common in concurrent code.
+ *
+ * Unlike fs.mkdirSync with recursive:true, this function:
+ * - Silently ignores EEXIST errors (directory already exists)
+ * - Re-throws all other errors (permissions, invalid path, etc.)
+ * - Works reliably in multi-process/concurrent scenarios
+ * - Defaults to recursive: true for convenient nested directory creation
+ *
+ * @param path - Directory path to create
+ * @param options - Options including recursive (default: true) and mode settings
+ *
+ * @example
+ * ```ts
+ * // Create a directory recursively by default, no error if it exists
+ * safeMkdirSync('./config')
+ *
+ * // Create nested directories (recursive: true is the default)
+ * safeMkdirSync('./data/cache/temp')
+ *
+ * // Create with specific permissions
+ * safeMkdirSync('./secure', { mode: 0o700 })
+ *
+ * // Explicitly disable recursive behavior
+ * safeMkdirSync('./single-level', { recursive: false })
+ * ```
+ */
+/*@__NO_SIDE_EFFECTS__*/
+export function safeMkdirSync(
+  path: PathLike,
+  options?: MakeDirectoryOptions | undefined,
+): void {
+  const fs = getFs()
+  const opts = { __proto__: null, recursive: true, ...options }
+  try {
+    fs.mkdirSync(path, opts)
+  } catch (e: unknown) {
+    // Ignore EEXIST error - directory already exists.
+    if (
+      typeof e === 'object' &&
+      e !== null &&
+      'code' in e &&
+      e.code !== 'EEXIST'
+    ) {
+      throw e
+    }
+  }
+}
+
 /**
  * Safely read a file asynchronously, returning undefined on error.
+ * Useful when you want to attempt reading a file without handling errors explicitly.
+ * Returns undefined for any error (file not found, permission denied, etc.).
+ *
+ * @param filepath - Path to file
+ * @param options - Read options including encoding and default value
+ * @returns Promise resolving to file contents, or undefined on error
+ *
+ * @example
+ * ```ts
+ * // Try to read a file, get undefined if it doesn't exist
+ * const content = await safeReadFile('./optional-config.txt')
+ * if (content) {
+ *   console.log('Config found:', content)
+ * }
+ *
+ * // Read with specific encoding
+ * const data = await safeReadFile('./data.txt', { encoding: 'utf8' })
+ * ```
  */
 /*@__NO_SIDE_EFFECTS__*/
 export async function safeReadFile(
@@ -741,58 +1415,124 @@ export async function safeReadFile(
 }
 
 /**
- * Safely get file stats asynchronously, returning undefined on error.
+ * Safely read a file synchronously, returning undefined on error.
+ * Useful when you want to attempt reading a file without handling errors explicitly.
+ * Returns undefined for any error (file not found, permission denied, etc.).
+ *
+ * @param filepath - Path to file
+ * @param options - Read options including encoding and default value
+ * @returns File contents, or undefined on error
+ *
+ * @example
+ * ```ts
+ * // Try to read a config file
+ * const config = safeReadFileSync('./config.txt')
+ * if (config) {
+ *   console.log('Config loaded successfully')
+ * }
+ *
+ * // Read binary file safely
+ * const buffer = safeReadFileSync('./image.png', { encoding: null })
+ * ```
  */
 /*@__NO_SIDE_EFFECTS__*/
-export async function safeStats(filepath: PathLike) {
+export function safeReadFileSync(
+  filepath: PathLike,
+  options?: SafeReadOptions | undefined,
+) {
+  const opts = typeof options === 'string' ? { encoding: options } : options
   const fs = getFs()
   try {
-    return await fs.promises.stat(filepath)
+    return fs.readFileSync(filepath, {
+      __proto__: null,
+      ...opts,
+    } as ObjectEncodingOptions)
   } catch {}
   return undefined
 }
 
 /**
- * Safely get file stats synchronously, returning undefined on error.
+ * Safely get file stats asynchronously, returning undefined on error.
+ * Useful for checking file existence and properties without error handling.
+ * Returns undefined for any error (file not found, permission denied, etc.).
+ *
+ * @param filepath - Path to check
+ * @returns Promise resolving to Stats object, or undefined on error
+ *
+ * @example
+ * ```ts
+ * // Check if file exists and get its stats
+ * const stats = await safeStats('./file.txt')
+ * if (stats) {
+ *   console.log('File size:', stats.size)
+ *   console.log('Modified:', stats.mtime)
+ * }
+ * ```
  */
 /*@__NO_SIDE_EFFECTS__*/
-export function safeStatsSync(
-  filepath: PathLike,
-  options?: ReadFileOptions | undefined,
-) {
-  const opts = typeof options === 'string' ? { encoding: options } : options
+export async function safeStats(filepath: PathLike) {
   const fs = getFs()
   try {
-    return fs.statSync(filepath, {
-      __proto__: null,
-      throwIfNoEntry: false,
-      ...opts,
-    } as StatSyncOptions)
+    return await fs.promises.stat(filepath)
   } catch {}
   return undefined
 }
 
 /**
- * Safely read a file synchronously, returning undefined on error.
+ * Safely get file stats synchronously, returning undefined on error.
+ * Useful for checking file existence and properties without error handling.
+ * Returns undefined for any error (file not found, permission denied, etc.).
+ *
+ * @param filepath - Path to check
+ * @param options - Read options (currently unused but kept for API consistency)
+ * @returns Stats object, or undefined on error
+ *
+ * @example
+ * ```ts
+ * // Check if file exists and get its size
+ * const stats = safeStatsSync('./file.txt')
+ * if (stats) {
+ *   console.log('File size:', stats.size)
+ *   console.log('Is directory:', stats.isDirectory())
+ * }
+ * ```
  */
 /*@__NO_SIDE_EFFECTS__*/
-export function safeReadFileSync(
+export function safeStatsSync(
   filepath: PathLike,
-  options?: SafeReadOptions | undefined,
+  options?: ReadFileOptions | undefined,
 ) {
   const opts = typeof options === 'string' ? { encoding: options } : options
   const fs = getFs()
   try {
-    return fs.readFileSync(filepath, {
+    return fs.statSync(filepath, {
       __proto__: null,
+      throwIfNoEntry: false,
       ...opts,
-    } as ObjectEncodingOptions)
+    } as StatSyncOptions)
   } catch {}
   return undefined
 }
 
 /**
  * Generate a unique filepath by adding number suffix if the path exists.
+ * Appends `-1`, `-2`, etc. before the file extension until a non-existent path is found.
+ * Useful for creating files without overwriting existing ones.
+ *
+ * @param filepath - Desired file path
+ * @returns Normalized unique filepath (original if it doesn't exist, or with number suffix)
+ *
+ * @example
+ * ```ts
+ * // If 'report.pdf' exists, returns 'report-1.pdf'
+ * const uniquePath = uniqueSync('./report.pdf')
+ *
+ * // If 'data.json' and 'data-1.json' exist, returns 'data-2.json'
+ * const path = uniqueSync('./data.json')
+ *
+ * // If 'backup' doesn't exist, returns 'backup' unchanged
+ * const backupPath = uniqueSync('./backup')
+ * ```
  */
 /*@__NO_SIDE_EFFECTS__*/
 export function uniqueSync(filepath: PathLike): string {
@@ -821,6 +1561,31 @@ export function uniqueSync(filepath: PathLike): string {
 
 /**
  * Write JSON content to a file asynchronously with formatting.
+ * Stringifies the value with configurable indentation and line endings.
+ * Automatically adds a final newline by default for POSIX compliance.
+ *
+ * @param filepath - Path to write to
+ * @param jsonContent - Value to stringify and write
+ * @param options - Write options including formatting and encoding
+ * @returns Promise that resolves when write completes
+ *
+ * @example
+ * ```ts
+ * // Write formatted JSON with default 2-space indentation
+ * await writeJson('./data.json', { name: 'example', version: '1.0.0' })
+ *
+ * // Write with custom indentation
+ * await writeJson('./config.json', config, { spaces: 4 })
+ *
+ * // Write with tabs instead of spaces
+ * await writeJson('./data.json', data, { spaces: '\t' })
+ *
+ * // Write without final newline
+ * await writeJson('./inline.json', obj, { finalEOL: false })
+ *
+ * // Write with Windows line endings
+ * await writeJson('./win.json', data, { EOL: '\r\n' })
+ * ```
  */
 /*@__NO_SIDE_EFFECTS__*/
 export async function writeJson(
@@ -850,6 +1615,27 @@ export async function writeJson(
 
 /**
  * Write JSON content to a file synchronously with formatting.
+ * Stringifies the value with configurable indentation and line endings.
+ * Automatically adds a final newline by default for POSIX compliance.
+ *
+ * @param filepath - Path to write to
+ * @param jsonContent - Value to stringify and write
+ * @param options - Write options including formatting and encoding
+ *
+ * @example
+ * ```ts
+ * // Write formatted JSON with default 2-space indentation
+ * writeJsonSync('./package.json', pkg)
+ *
+ * // Write with custom indentation
+ * writeJsonSync('./tsconfig.json', tsconfig, { spaces: 4 })
+ *
+ * // Write with tabs for indentation
+ * writeJsonSync('./data.json', data, { spaces: '\t' })
+ *
+ * // Write compacted (no indentation)
+ * writeJsonSync('./compact.json', data, { spaces: 0 })
+ * ```
  */
 /*@__NO_SIDE_EFFECTS__*/
 export function writeJsonSync(
diff --git a/src/git.ts b/src/git.ts
index 0bac47f..5fb99e3 100644
--- a/src/git.ts
+++ b/src/git.ts
@@ -1,5 +1,7 @@
-import path from 'node:path'
+import path from 'path'
 
+import { WIN32 } from '#constants/platform'
+import { debugNs } from './debug'
 import { getGlobMatcher } from './globs'
 import { normalizePath } from './path'
 import { spawn, spawnSync } from './spawn'
@@ -7,22 +9,108 @@ import { stripAnsi } from './strings'
 
 /**
  * Options for git diff operations.
+ *
+ * Controls how git diff results are processed and returned.
+ *
+ * @example
+ * ```typescript
+ * // Get absolute file paths
+ * const files = await getChangedFiles({ absolute: true })
+ * // => ['/path/to/repo/src/file.ts']
+ *
+ * // Get relative paths with caching disabled
+ * const files = await getChangedFiles({ cache: false })
+ * // => ['src/file.ts']
+ *
+ * // Get files from specific directory
+ * const files = await getChangedFiles({ cwd: '/path/to/repo/src' })
+ * ```
  */
 export interface GitDiffOptions {
-  absolute?: boolean
-  cache?: boolean
-  cwd?: string
-  porcelain?: boolean
-  asSet?: boolean
+  /**
+   * Return absolute file paths instead of relative paths.
+   *
+   * @default false
+   */
+  absolute?: boolean | undefined
+  /**
+   * Cache git diff results to avoid repeated git subprocess calls.
+   *
+   * Caching is keyed by the git command and options used, so different
+   * option combinations maintain separate cache entries.
+   *
+   * @default true
+   */
+  cache?: boolean | undefined
+  /**
+   * Working directory for git operations.
+   *
+   * Git operations will be run from this directory, and returned paths
+   * will be relative to the git repository root. Symlinks are resolved
+   * using `fs.realpathSync()`.
+   *
+   * @default process.cwd()
+   */
+  cwd?: string | undefined
+  /**
+   * Parse git porcelain format output (status codes like `M`, `A`, `??`).
+   *
+   * When `true`, strips the two-character status code and space from the
+   * beginning of each line. Automatically enabled for `getChangedFiles()`.
+   *
+   * @default false
+   */
+  porcelain?: boolean | undefined
+  /**
+   * Return results as a `Set` instead of an array.
+   *
+   * @default false
+   */
+  asSet?: boolean | undefined
+  /**
+   * Additional options passed to glob matcher.
+   *
+   * Supports options like `dot`, `ignore`, `nocase` for filtering results.
+   */
   [key: string]: unknown
 }
 
 /**
- * Options for package filtering operations.
+ * Options for filtering packages by git changes.
+ *
+ * Used to determine which packages in a monorepo have changed files.
+ *
+ * @example
+ * ```typescript
+ * // Filter packages with changes
+ * const changed = filterPackagesByChanges(packages)
+ *
+ * // Force include all packages
+ * const all = filterPackagesByChanges(packages, { force: true })
+ *
+ * // Use custom package key
+ * const changed = filterPackagesByChanges(
+ *   packages,
+ *   { packageKey: 'directory' }
+ * )
+ * ```
  */
 export interface FilterPackagesByChangesOptions {
-  force?: boolean
-  packageKey?: string
+  /**
+   * Force include all packages regardless of changes.
+   *
+   * @default false
+   */
+  force?: boolean | undefined
+  /**
+   * Key to access package path in package objects.
+   *
+   * @default 'path'
+   */
+  packageKey?: string | undefined
+  /**
+   * Additional options for filtering.
+   */
   [key: string]: unknown
 }
 
@@ -38,7 +126,18 @@ const gitDiffCache = new Map<string, string[]>()
 
 let _fs: typeof import('fs') | undefined
 /**
- * Lazily load the fs module to avoid Webpack errors.
+ * Lazily load the `fs` module to avoid Webpack errors.
+ *
+ * Uses non-`node:` prefixed require internally to prevent Webpack from
+ * attempting to bundle Node.js built-in modules.
+ *
+ * @returns The Node.js `fs` module.
+ *
+ * @example
+ * ```typescript
+ * const fs = getFs()
+ * const exists = fs.existsSync('/path/to/file')
+ * ```
  */
 /*@__NO_SIDE_EFFECTS__*/
 function getFs() {
@@ -52,7 +151,18 @@ function getFs() {
 
 let _path: typeof import('path') | undefined
 /**
- * Lazily load the path module to avoid Webpack errors.
+ * Lazily load the `path` module to avoid Webpack errors.
+ *
+ * Uses non-`node:` prefixed require internally to prevent Webpack from
+ * attempting to bundle Node.js built-in modules.
+ *
+ * @returns The Node.js `path` module.
+ *
+ * @example
+ * ```typescript
+ * const path = getPath()
+ * const joined = path.join('/foo', 'bar')
+ * ```
  */
 /*@__NO_SIDE_EFFECTS__*/
 function getPath() {
@@ -63,21 +173,59 @@ function getPath() {
 }
 
 /**
- * Get git executable path.
+ * Get the git executable path.
+ *
+ * Currently always returns `'git'`, relying on the system PATH to resolve
+ * the git binary location. This may be extended in the future to support
+ * custom git paths.
+ *
+ * @returns The git executable name or path.
+ *
+ * @example
+ * ```typescript
+ * const git = getGitPath()
+ * // => 'git'
+ * ```
  */
 function getGitPath(): string {
   return 'git'
 }
 
 /**
- * Get current working directory for git operations.
- * Returns the real path to handle symlinks like /tmp -> /private/tmp.
+ * Get the current working directory for git operations.
+ *
+ * Returns the real path to handle symlinks correctly. This is important
+ * because symlinked directories like `/tmp -> /private/tmp` can cause
+ * path mismatches when comparing git output.
+ *
+ * @returns The resolved real path of `process.cwd()`.
+ *
+ * @example
+ * ```typescript
+ * const cwd = getCwd()
+ * // In /tmp (symlink to /private/tmp):
+ * // => '/private/tmp'
+ * ```
  */
 function getCwd(): string {
   return getFs().realpathSync(process.cwd())
 }
 
-function getGitDiffSpawnArgs(cwd?: string): GitDiffSpawnArgs {
+/**
+ * Get spawn arguments for different git diff operations.
+ *
+ * Prepares argument arrays for `spawn()`/`spawnSync()` calls that retrieve:
+ * - `all`: All changed files (staged, unstaged, untracked) via `git status --porcelain`
+ * - `unstaged`: Unstaged modifications via `git diff --name-only`
+ * - `staged`: Staged changes via `git diff --cached --name-only`
+ *
+ * Automatically resolves symlinks in the provided `cwd` and enables shell
+ * mode on Windows for proper command execution.
+ *
+ * @param cwd - Working directory for git operations, defaults to `process.cwd()`.
+ * @returns Object containing spawn arguments for all, unstaged, and staged operations.
+ */
+function getGitDiffSpawnArgs(cwd?: string | undefined): GitDiffSpawnArgs {
   const resolvedCwd = cwd ? getFs().realpathSync(cwd) : getCwd()
   return {
     all: [
@@ -85,7 +233,7 @@ function getGitDiffSpawnArgs(cwd?: string): GitDiffSpawnArgs {
       ['status', '--porcelain'],
       {
         cwd: resolvedCwd,
-        shell: process.platform === 'win32',
+        shell: WIN32,
       },
     ],
     unstaged: [
@@ -100,15 +248,25 @@ function getGitDiffSpawnArgs(cwd?: string): GitDiffSpawnArgs {
       ['diff', '--cached', '--name-only'],
       {
         cwd: resolvedCwd,
-        shell: process.platform === 'win32',
+        shell: WIN32,
       },
     ],
   }
 }
 
+/**
+ * Execute git diff command asynchronously and parse results.
+ *
+ * Internal helper for async git operations. Handles caching, command execution,
+ * and result parsing. Returns empty array on git command failure.
+ *
+ * @param args - Spawn arguments tuple `[command, args, options]`.
+ * @param options - Git diff options for caching and parsing.
+ * @returns Promise resolving to array of file paths.
+ */
 async function innerDiff(
   args: SpawnArgs,
-  options?: GitDiffOptions,
+  options?: GitDiffOptions | undefined,
 ): Promise<string[]> {
   const { cache = true, ...parseOptions } = { __proto__: null, ...options }
   const cacheKey = cache ? JSON.stringify({ args, parseOptions }) : undefined
@@ -132,7 +290,16 @@ async function innerDiff(
     const spawnCwd =
       typeof args[2]['cwd'] === 'string' ? args[2]['cwd'] : undefined
     result = parseGitDiffStdout(stdout, parseOptions, spawnCwd)
-  } catch {
+  } catch (e) {
+    // Git command failed. This is expected if:
+    // - Not in a git repository
+    // - Git is not installed
+    // - Permission issues accessing .git directory
+    // Log warning in debug mode for troubleshooting.
+    debugNs(
+      'git',
+      `Git command failed (${args[0]} ${args[1].join(' ')}): ${(e as Error).message}`,
+    )
     return []
   }
   if (cache && cacheKey) {
@@ -141,7 +308,20 @@ async function innerDiff(
   return result
 }
 
-function innerDiffSync(args: SpawnArgs, options?: GitDiffOptions): string[] {
+/**
+ * Execute git diff command synchronously and parse results.
+ *
+ * Internal helper for sync git operations. Handles caching, command execution,
+ * and result parsing. Returns empty array on git command failure.
+ *
+ * @param args - Spawn arguments tuple `[command, args, options]`.
+ * @param options - Git diff options for caching and parsing.
+ * @returns Array of file paths.
+ */
+function innerDiffSync(
+  args: SpawnArgs,
+  options?: GitDiffOptions | undefined,
+): string[] {
   const { cache = true, ...parseOptions } = { __proto__: null, ...options }
   const cacheKey = cache ? JSON.stringify({ args, parseOptions }) : undefined
   if (cache && cacheKey) {
@@ -164,7 +344,16 @@ function innerDiffSync(args: SpawnArgs, options?: GitDiffOptions): string[] {
     const spawnCwd =
       typeof args[2]['cwd'] === 'string' ? args[2]['cwd'] : undefined
     result = parseGitDiffStdout(stdout, parseOptions, spawnCwd)
-  } catch {
+  } catch (e) {
+    // Git command failed. This is expected if:
+    // - Not in a git repository
+    // - Git is not installed
+    // - Permission issues accessing .git directory
+    // Log warning in debug mode for troubleshooting.
+    debugNs(
+      'git',
+      `Git command failed (${args[0]} ${args[1].join(' ')}): ${(e as Error).message}`,
+    )
     return []
   }
   if (cache && cacheKey) {
@@ -175,8 +364,24 @@ function innerDiffSync(args: SpawnArgs, options?: GitDiffOptions): string[] {
 
 /**
  * Find git repository root by walking up from the given directory.
- * Returns the directory itself if it contains .git, or the original path if no .git found.
- * Exported for testing.
+ *
+ * Searches for a `.git` directory or file by traversing parent directories
+ * upward until found or filesystem root is reached. Returns the original path
+ * if no git repository is found.
+ *
+ * This function is exported primarily for testing purposes.
+ *
+ * @param startPath - Directory path to start searching from.
+ * @returns Git repository root path, or `startPath` if not found.
+ *
+ * @example
+ * ```typescript
+ * const root = findGitRoot('/path/to/repo/src/subdir')
+ * // => '/path/to/repo'
+ *
+ * const notFound = findGitRoot('/not/a/repo')
+ * // => '/not/a/repo'
+ * ```
  */
 export function findGitRoot(startPath: string): string {
   const fs = getFs()
@@ -202,10 +407,29 @@ export function findGitRoot(startPath: string): string {
   }
 }
 
+/**
+ * Parse git diff stdout output into file path array.
+ *
+ * Internal helper that processes raw git command output by:
+ * 1. Finding git repository root from spawn cwd
+ * 2. Stripping ANSI codes and splitting into lines
+ * 3. Parsing porcelain format status codes if requested
+ * 4. Normalizing and optionally making paths absolute
+ * 5. Filtering paths based on cwd and glob options
+ *
+ * Git always returns paths relative to the repository root, regardless of
+ * where the command was executed. This function handles the path resolution
+ * correctly by finding the repo root and adjusting paths accordingly.
+ *
+ * @param stdout - Raw stdout from git command.
+ * @param options - Git diff options for path processing.
+ * @param spawnCwd - Working directory where git command was executed.
+ * @returns Array of processed file paths.
+ */
 function parseGitDiffStdout(
   stdout: string,
-  options?: GitDiffOptions,
-  spawnCwd?: string,
+  options?: GitDiffOptions | undefined,
+  spawnCwd?: string | undefined,
 ): string[] {
   // Find git repo root from spawnCwd. Git always returns paths relative to the repo root,
   // not the cwd where it was run. So we need to find the repo root to correctly parse paths.
@@ -269,13 +493,44 @@ function parseGitDiffStdout(
 
 /**
  * Get all changed files including staged, unstaged, and untracked files.
+ *
  * Uses `git status --porcelain` which returns the full working tree status
- * with status codes (M=modified, A=added, D=deleted, ??=untracked, etc.).
+ * with status codes:
+ * - `M` - Modified
+ * - `A` - Added
+ * - `D` - Deleted
+ * - `??` - Untracked
+ * - `R` - Renamed
+ * - `C` - Copied
+ *
  * This is the most comprehensive check - captures everything that differs
- * from the last commit.
+ * from the last commit, including:
+ * - Files modified and staged with `git add`
+ * - Files modified but not staged
+ * - New files not yet tracked by git
+ *
+ * Status codes are automatically stripped from the output.
+ *
+ * @param options - Options controlling path format and filtering.
+ * @returns Promise resolving to array of changed file paths.
+ *
+ * @example
+ * ```typescript
+ * // Get all changed files as relative paths
+ * const files = await getChangedFiles()
+ * // => ['src/foo.ts', 'src/bar.ts', 'newfile.ts']
+ *
+ * // Get absolute paths
+ * const files = await getChangedFiles({ absolute: true })
+ * // => ['/path/to/repo/src/foo.ts', ...]
+ *
+ * // Get changed files in specific directory
+ * const files = await getChangedFiles({ cwd: '/path/to/repo/src' })
+ * // => ['foo.ts', 'bar.ts']
+ * ```
  */
 export async function getChangedFiles(
-  options?: GitDiffOptions,
+  options?: GitDiffOptions | undefined,
 ): Promise<string[]> {
   const args = getGitDiffSpawnArgs(options?.cwd).all
   return await innerDiff(args, {
@@ -287,12 +542,45 @@ export async function getChangedFiles(
 
 /**
  * Get all changed files including staged, unstaged, and untracked files.
- * Uses `git status --porcelain` which returns the full working tree status
- * with status codes (M=modified, A=added, D=deleted, ??=untracked, etc.).
+ *
+ * Synchronous version of `getChangedFiles()`. Uses `git status --porcelain`
+ * which returns the full working tree status with status codes:
+ * - `M` - Modified
+ * - `A` - Added
+ * - `D` - Deleted
+ * - `??` - Untracked
+ * - `R` - Renamed
+ * - `C` - Copied
+ *
  * This is the most comprehensive check - captures everything that differs
- * from the last commit.
+ * from the last commit, including:
+ * - Files modified and staged with `git add`
+ * - Files modified but not staged
+ * - New files not yet tracked by git
+ *
+ * Status codes are automatically stripped from the output.
+ *
+ * @param options - Options controlling path format and filtering.
+ * @returns Array of changed file paths.
+ *
+ * @example
+ * ```typescript
+ * // Get all changed files as relative paths
+ * const files = getChangedFilesSync()
+ * // => ['src/foo.ts', 'src/bar.ts', 'newfile.ts']
+ *
+ * // Get absolute paths
+ * const files = getChangedFilesSync({ absolute: true })
+ * // => ['/path/to/repo/src/foo.ts', ...]
+ *
+ * // Get changed files in specific directory
+ * const files = getChangedFilesSync({ cwd: '/path/to/repo/src' })
+ * // => ['foo.ts', 'bar.ts']
+ * ```
  */
-export function getChangedFilesSync(options?: GitDiffOptions): string[] {
+export function getChangedFilesSync(
+  options?: GitDiffOptions | undefined,
+): string[] {
   const args = getGitDiffSpawnArgs(options?.cwd).all
   return innerDiffSync(args, {
     __proto__: null,
@@ -303,12 +591,36 @@ export function getChangedFilesSync(options?: GitDiffOptions): string[] {
 
 /**
  * Get unstaged modified files (changes not yet staged for commit).
+ *
  * Uses `git diff --name-only` which returns only unstaged modifications
- * to tracked files. Does not include untracked files or staged changes.
- * This is a focused check for uncommitted changes to existing files.
+ * to tracked files. Does NOT include:
+ * - Untracked files (new files not added to git)
+ * - Staged changes (files added with `git add`)
+ *
+ * This is a focused check for uncommitted changes to existing tracked files.
+ * Useful for detecting work-in-progress modifications before staging.
+ *
+ * @param options - Options controlling path format and filtering.
+ * @returns Promise resolving to array of unstaged file paths.
+ *
+ * @example
+ * ```typescript
+ * // Get unstaged files
+ * const files = await getUnstagedFiles()
+ * // => ['src/foo.ts', 'src/bar.ts']
+ *
+ * // After staging some files
+ * await spawn('git', ['add', 'src/foo.ts'])
+ * const files = await getUnstagedFiles()
+ * // => ['src/bar.ts'] (foo.ts no longer included)
+ *
+ * // Get absolute paths
+ * const files = await getUnstagedFiles({ absolute: true })
+ * // => ['/path/to/repo/src/bar.ts']
+ * ```
  */
 export async function getUnstagedFiles(
-  options?: GitDiffOptions,
+  options?: GitDiffOptions | undefined,
 ): Promise<string[]> {
   const args = getGitDiffSpawnArgs(options?.cwd).unstaged
   return await innerDiff(args, options)
@@ -316,23 +628,73 @@ export async function getUnstagedFiles(
 
 /**
  * Get unstaged modified files (changes not yet staged for commit).
- * Uses `git diff --name-only` which returns only unstaged modifications
- * to tracked files. Does not include untracked files or staged changes.
- * This is a focused check for uncommitted changes to existing files.
+ *
+ * Synchronous version of `getUnstagedFiles()`. Uses `git diff --name-only`
+ * which returns only unstaged modifications to tracked files. Does NOT include:
+ * - Untracked files (new files not added to git)
+ * - Staged changes (files added with `git add`)
+ *
+ * This is a focused check for uncommitted changes to existing tracked files.
+ * Useful for detecting work-in-progress modifications before staging.
+ *
+ * @param options - Options controlling path format and filtering.
+ * @returns Array of unstaged file paths.
+ *
+ * @example
+ * ```typescript
+ * // Get unstaged files
+ * const files = getUnstagedFilesSync()
+ * // => ['src/foo.ts', 'src/bar.ts']
+ *
+ * // After staging some files
+ * spawnSync('git', ['add', 'src/foo.ts'])
+ * const files = getUnstagedFilesSync()
+ * // => ['src/bar.ts'] (foo.ts no longer included)
+ *
+ * // Get absolute paths
+ * const files = getUnstagedFilesSync({ absolute: true })
+ * // => ['/path/to/repo/src/bar.ts']
+ * ```
  */
-export function getUnstagedFilesSync(options?: GitDiffOptions): string[] {
+export function getUnstagedFilesSync(
+  options?: GitDiffOptions | undefined,
+): string[] {
   const args = getGitDiffSpawnArgs(options?.cwd).unstaged
   return innerDiffSync(args, options)
 }
 
 /**
  * Get staged files ready for commit (changes added with `git add`).
+ *
  * Uses `git diff --cached --name-only` which returns only staged changes.
- * Does not include unstaged modifications or untracked files.
+ * Does NOT include:
+ * - Unstaged modifications (changes not added with `git add`)
+ * - Untracked files (new files not added to git)
+ *
  * This is a focused check for what will be included in the next commit.
+ * Useful for validating changes before committing or running pre-commit hooks.
+ *
+ * @param options - Options controlling path format and filtering.
+ * @returns Promise resolving to array of staged file paths.
+ *
+ * @example
+ * ```typescript
+ * // Get currently staged files
+ * const files = await getStagedFiles()
+ * // => ['src/foo.ts']
+ *
+ * // Stage more files
+ * await spawn('git', ['add', 'src/bar.ts'])
+ * const files = await getStagedFiles()
+ * // => ['src/foo.ts', 'src/bar.ts']
+ *
+ * // Get absolute paths
+ * const files = await getStagedFiles({ absolute: true })
+ * // => ['/path/to/repo/src/foo.ts', ...]
+ * ```
  */
 export async function getStagedFiles(
-  options?: GitDiffOptions,
+  options?: GitDiffOptions | undefined,
 ): Promise<string[]> {
   const args = getGitDiffSpawnArgs(options?.cwd).staged
   return await innerDiff(args, options)
@@ -340,21 +702,78 @@ export async function getStagedFiles(
 
 /**
  * Get staged files ready for commit (changes added with `git add`).
- * Uses `git diff --cached --name-only` which returns only staged changes.
- * Does not include unstaged modifications or untracked files.
+ *
+ * Synchronous version of `getStagedFiles()`. Uses `git diff --cached --name-only`
+ * which returns only staged changes. Does NOT include:
+ * - Unstaged modifications (changes not added with `git add`)
+ * - Untracked files (new files not added to git)
+ *
  * This is a focused check for what will be included in the next commit.
+ * Useful for validating changes before committing or running pre-commit hooks.
+ *
+ * @param options - Options controlling path format and filtering.
+ * @returns Array of staged file paths.
+ *
+ * @example
+ * ```typescript
+ * // Get currently staged files
+ * const files = getStagedFilesSync()
+ * // => ['src/foo.ts']
+ *
+ * // Stage more files
+ * spawnSync('git', ['add', 'src/bar.ts'])
+ * const files = getStagedFilesSync()
+ * // => ['src/foo.ts', 'src/bar.ts']
+ *
+ * // Get absolute paths
+ * const files = getStagedFilesSync({ absolute: true })
+ * // => ['/path/to/repo/src/foo.ts', ...]
+ * ```
  */
-export function getStagedFilesSync(options?: GitDiffOptions): string[] {
+export function getStagedFilesSync(
+  options?: GitDiffOptions | undefined,
+): string[] {
   const args = getGitDiffSpawnArgs(options?.cwd).staged
   return innerDiffSync(args, options)
 }
 
 /**
- * Check if pathname has any changes (staged, unstaged, or untracked).
+ * Check if a file or directory has any git changes.
+ *
+ * Checks if the given pathname has any changes including:
+ * - Staged modifications (added with `git add`)
+ * - Unstaged modifications (not yet staged)
+ * - Untracked status (new file/directory not in git)
+ *
+ * For directories, returns `true` if ANY file within the directory has changes.
+ *
+ * Symlinks in the pathname and cwd are automatically resolved using
+ * `fs.realpathSync()` before comparison.
+ *
+ * @param pathname - File or directory path to check.
+ * @param options - Options for the git status check.
+ * @returns Promise resolving to `true` if path has any changes, `false` otherwise.
+ *
+ * @example
+ * ```typescript
+ * // Check if file is changed
+ * const changed = await isChanged('src/foo.ts')
+ * // => true
+ *
+ * // Check if directory has any changes
+ * const changed = await isChanged('src/')
+ * // => true (if any file in src/ is changed)
+ *
+ * // Check from different cwd
+ * const changed = await isChanged(
+ *   '/path/to/repo/src/foo.ts',
+ *   { cwd: '/path/to/repo' }
+ * )
+ * ```
  */
 export async function isChanged(
   pathname: string,
-  options?: GitDiffOptions,
+  options?: GitDiffOptions | undefined,
 ): Promise<boolean> {
   const files = await getChangedFiles({
     __proto__: null,
@@ -369,11 +788,43 @@ export async function isChanged(
 }
 
 /**
- * Check if pathname has any changes (staged, unstaged, or untracked).
+ * Check if a file or directory has any git changes.
+ *
+ * Synchronous version of `isChanged()`. Checks if the given pathname has
+ * any changes including:
+ * - Staged modifications (added with `git add`)
+ * - Unstaged modifications (not yet staged)
+ * - Untracked status (new file/directory not in git)
+ *
+ * For directories, returns `true` if ANY file within the directory has changes.
+ *
+ * Symlinks in the pathname and cwd are automatically resolved using
+ * `fs.realpathSync()` before comparison.
+ *
+ * @param pathname - File or directory path to check.
+ * @param options - Options for the git status check.
+ * @returns `true` if path has any changes, `false` otherwise.
+ *
+ * @example
+ * ```typescript
+ * // Check if file is changed
+ * const changed = isChangedSync('src/foo.ts')
+ * // => true
+ *
+ * // Check if directory has any changes
+ * const changed = isChangedSync('src/')
+ * // => true (if any file in src/ is changed)
+ *
+ * // Check from different cwd
+ * const changed = isChangedSync(
+ *   '/path/to/repo/src/foo.ts',
+ *   { cwd: '/path/to/repo' }
+ * )
+ * ```
  */
 export function isChangedSync(
   pathname: string,
-  options?: GitDiffOptions,
+  options?: GitDiffOptions | undefined,
 ): boolean {
   const files = getChangedFilesSync({
     __proto__: null,
@@ -388,11 +839,42 @@ export function isChangedSync(
 }
 
 /**
- * Check if pathname has unstaged changes (modified but not staged).
+ * Check if a file or directory has unstaged changes.
+ *
+ * Checks if the given pathname has modifications that are not yet staged
+ * for commit (changes not added with `git add`). Does NOT include:
+ * - Staged changes (already added with `git add`)
+ * - Untracked files (new files not in git)
+ *
+ * For directories, returns `true` if ANY file within the directory has
+ * unstaged changes.
+ *
+ * Symlinks in the pathname and cwd are automatically resolved using
+ * `fs.realpathSync()` before comparison.
+ *
+ * @param pathname - File or directory path to check.
+ * @param options - Options for the git diff check.
+ * @returns Promise resolving to `true` if path has unstaged changes, `false` otherwise.
+ *
+ * @example
+ * ```typescript
+ * // Check if file has unstaged changes
+ * const unstaged = await isUnstaged('src/foo.ts')
+ * // => true
+ *
+ * // After staging the file
+ * await spawn('git', ['add', 'src/foo.ts'])
+ * const unstaged = await isUnstaged('src/foo.ts')
+ * // => false
+ *
+ * // Check directory
+ * const unstaged = await isUnstaged('src/')
+ * // => true (if any file in src/ has unstaged changes)
+ * ```
  */
 export async function isUnstaged(
   pathname: string,
-  options?: GitDiffOptions,
+  options?: GitDiffOptions | undefined,
 ): Promise<boolean> {
   const files = await getUnstagedFiles({
     __proto__: null,
@@ -407,11 +889,43 @@ export async function isUnstaged(
 }
 
 /**
- * Check if pathname has unstaged changes (modified but not staged).
+ * Check if a file or directory has unstaged changes.
+ *
+ * Synchronous version of `isUnstaged()`. Checks if the given pathname has
+ * modifications that are not yet staged for commit (changes not added with
+ * `git add`). Does NOT include:
+ * - Staged changes (already added with `git add`)
+ * - Untracked files (new files not in git)
+ *
+ * For directories, returns `true` if ANY file within the directory has
+ * unstaged changes.
+ *
+ * Symlinks in the pathname and cwd are automatically resolved using
+ * `fs.realpathSync()` before comparison.
+ *
+ * @param pathname - File or directory path to check.
+ * @param options - Options for the git diff check.
+ * @returns `true` if path has unstaged changes, `false` otherwise.
+ *
+ * @example
+ * ```typescript
+ * // Check if file has unstaged changes
+ * const unstaged = isUnstagedSync('src/foo.ts')
+ * // => true
+ *
+ * // After staging the file
+ * spawnSync('git', ['add', 'src/foo.ts'])
+ * const unstaged = isUnstagedSync('src/foo.ts')
+ * // => false
+ *
+ * // Check directory
+ * const unstaged = isUnstagedSync('src/')
+ * // => true (if any file in src/ has unstaged changes)
+ * ```
  */
 export function isUnstagedSync(
   pathname: string,
-  options?: GitDiffOptions,
+  options?: GitDiffOptions | undefined,
 ): boolean {
   const files = getUnstagedFilesSync({
     __proto__: null,
@@ -426,11 +940,41 @@ export function isUnstagedSync(
 }
 
 /**
- * Check if pathname is staged for commit.
+ * Check if a file or directory is staged for commit.
+ *
+ * Checks if the given pathname has changes staged with `git add` that will
+ * be included in the next commit. Does NOT include:
+ * - Unstaged modifications (changes not added with `git add`)
+ * - Untracked files (new files not in git)
+ *
+ * For directories, returns `true` if ANY file within the directory is staged.
+ *
+ * Symlinks in the pathname and cwd are automatically resolved using
+ * `fs.realpathSync()` before comparison.
+ *
+ * @param pathname - File or directory path to check.
+ * @param options - Options for the git diff check.
+ * @returns Promise resolving to `true` if path is staged, `false` otherwise.
+ *
+ * @example
+ * ```typescript
+ * // Check if file is staged
+ * const staged = await isStaged('src/foo.ts')
+ * // => false
+ *
+ * // Stage the file
+ * await spawn('git', ['add', 'src/foo.ts'])
+ * const staged = await isStaged('src/foo.ts')
+ * // => true
+ *
+ * // Check directory
+ * const staged = await isStaged('src/')
+ * // => true (if any file in src/ is staged)
+ * ```
  */
 export async function isStaged(
   pathname: string,
-  options?: GitDiffOptions,
+  options?: GitDiffOptions | undefined,
 ): Promise<boolean> {
   const files = await getStagedFiles({
     __proto__: null,
@@ -445,11 +989,42 @@ export async function isStaged(
 }
 
 /**
- * Check if pathname is staged for commit.
+ * Check if a file or directory is staged for commit.
+ *
+ * Synchronous version of `isStaged()`. Checks if the given pathname has
+ * changes staged with `git add` that will be included in the next commit.
+ * Does NOT include:
+ * - Unstaged modifications (changes not added with `git add`)
+ * - Untracked files (new files not in git)
+ *
+ * For directories, returns `true` if ANY file within the directory is staged.
+ *
+ * Symlinks in the pathname and cwd are automatically resolved using
+ * `fs.realpathSync()` before comparison.
+ *
+ * @param pathname - File or directory path to check.
+ * @param options - Options for the git diff check.
+ * @returns `true` if path is staged, `false` otherwise.
+ *
+ * @example
+ * ```typescript
+ * // Check if file is staged
+ * const staged = isStagedSync('src/foo.ts')
+ * // => false
+ *
+ * // Stage the file
+ * spawnSync('git', ['add', 'src/foo.ts'])
+ * const staged = isStagedSync('src/foo.ts')
+ * // => true
+ *
+ * // Check directory
+ * const staged = isStagedSync('src/')
+ * // => true (if any file in src/ is staged)
+ * ```
  */
 export function isStagedSync(
   pathname: string,
-  options?: GitDiffOptions,
+  options?: GitDiffOptions | undefined,
 ): boolean {
   const files = getStagedFilesSync({
     __proto__: null,
diff --git a/src/github.ts b/src/github.ts
index 0b362b6..809f534 100644
--- a/src/github.ts
+++ b/src/github.ts
@@ -23,6 +23,8 @@
 
 import type { TtlCache } from './cache-with-ttl'
 import { createTtlCache } from './cache-with-ttl'
+import { getGhToken, getGithubToken } from '#env/github'
+import { getSocketCliGithubToken } from '#env/socket-cli'
 import { httpRequest } from './http-request'
 import type { SpawnOptions } from './spawn'
 import { spawn } from './spawn'
@@ -39,6 +41,10 @@ let _githubCache: TtlCache | undefined
 
 /**
  * Get or create the GitHub cache instance.
+ * Lazy initializes the cache with default TTL and memoization enabled.
+ * Used internally for caching GitHub API responses.
+ *
+ * @returns The singleton cache instance
  */
 function getGithubCache(): TtlCache {
   if (_githubCache === undefined) {
@@ -51,31 +57,116 @@ function getGithubCache(): TtlCache {
   return _githubCache
 }
 
+/**
+ * Options for GitHub API fetch requests.
+ */
 export interface GitHubFetchOptions {
+  /**
+   * GitHub authentication token.
+   * If not provided, will attempt to use token from environment variables.
+   */
   token?: string | undefined
+  /**
+   * Additional HTTP headers to include in the request.
+   * Will be merged with default headers (Accept, User-Agent, Authorization).
+   */
   headers?: Record<string, string> | undefined
 }
 
+/**
+ * Error thrown when GitHub API rate limit is exceeded.
+ * Extends the standard Error with additional rate limit information.
+ */
 export interface GitHubRateLimitError extends Error {
+  /** HTTP status code (always 403 for rate limit errors) */
   status: number
+  /**
+   * Date when the rate limit will reset.
+   * Undefined if reset time is not available in response headers.
+   */
   resetTime?: Date | undefined
 }
 
 /**
- * Get GitHub token from environment variables.
+ * Get GitHub authentication token from environment variables.
+ * Checks multiple environment variable names in priority order.
+ *
+ * Environment variables checked (in order):
+ * 1. `GITHUB_TOKEN` - Standard GitHub token variable
+ * 2. `GH_TOKEN` - Alternative GitHub CLI token variable
+ * 3. `SOCKET_CLI_GITHUB_TOKEN` - Socket-specific token variable
+ *
+ * @returns The first available GitHub token, or `undefined` if none found
+ *
+ * @example
+ * ```ts
+ * const token = getGitHubToken()
+ * if (!token) {
+ *   console.warn('No GitHub token found')
+ * }
+ * ```
  */
 export function getGitHubToken(): string | undefined {
-  const { env } = process
   return (
-    env['GITHUB_TOKEN'] ||
-    env['GH_TOKEN'] ||
-    env['SOCKET_CLI_GITHUB_TOKEN'] ||
-    undefined
+    getGithubToken() || getGhToken() || getSocketCliGithubToken() || undefined
   )
 }
 
 /**
- * Fetch data from GitHub API with rate limit handling.
+ * Fetch data from GitHub API with automatic authentication and rate limit handling.
+ * Makes authenticated requests to the GitHub REST API with proper error handling.
+ *
+ * Features:
+ * - Automatic token injection from environment if not provided
+ * - Rate limit detection with helpful error messages
+ * - Standard GitHub API headers (Accept, User-Agent)
+ * - JSON response parsing
+ *
+ * @template T - Expected response type (defaults to `unknown`)
+ * @param url - Full GitHub API URL (e.g., 'https://api.github.com/repos/owner/repo')
+ * @param options - Fetch options including token and custom headers
+ * @returns Parsed JSON response of type `T`
+ *
+ * @throws {GitHubRateLimitError} When API rate limit is exceeded (status 403)
+ * @throws {Error} For other API errors with status code and message
+ *
+ * @example
+ * ```ts
+ * // Fetch repository information
+ * interface Repo {
+ *   name: string
+ *   full_name: string
+ *   default_branch: string
+ * }
+ * const repo = await fetchGitHub<Repo>(
+ *   'https://api.github.com/repos/owner/repo'
+ * )
+ * console.log(`Default branch: ${repo.default_branch}`)
+ * ```
+ *
+ * @example
+ * ```ts
+ * // With custom token and headers
+ * const data = await fetchGitHub(
+ *   'https://api.github.com/user',
+ *   {
+ *     token: 'ghp_customtoken',
+ *     headers: { 'X-Custom-Header': 'value' }
+ *   }
+ * )
+ * ```
+ *
+ * @example
+ * ```ts
+ * // Handle rate limit errors
+ * try {
+ *   await fetchGitHub('https://api.github.com/repos/owner/repo')
+ * } catch (error) {
+ *   if (error.status === 403 && error.resetTime) {
+ *     console.error(`Rate limited until ${error.resetTime}`)
+ *   }
+ * }
+ * ```
  */
 export async function fetchGitHub<T = unknown>(
   url: string,
@@ -94,7 +185,9 @@ export async function fetchGitHub<T = unknown>(
     headers['Authorization'] = `Bearer ${token}`
   }
 
+  /* c8 ignore start - External GitHub API call */
   const response = await httpRequest(url, { headers })
+  /* c8 ignore stop */
 
   if (!response.ok) {
     if (response.status === 403) {
@@ -124,53 +217,155 @@ export async function fetchGitHub<T = unknown>(
   return JSON.parse(response.body.toString('utf8')) as T
 }
 
+/**
+ * GitHub ref object returned by the API.
+ * Represents a git reference (tag or branch).
+ */
 export interface GitHubRef {
+  /** The object this ref points to */
   object: {
+    /** SHA of the commit or tag object */
     sha: string
+    /** Type of object ('commit' or 'tag') */
     type: string
+    /** API URL to fetch the full object details */
     url: string
   }
+  /** Full ref path (e.g., 'refs/tags/v1.0.0' or 'refs/heads/main') */
   ref: string
+  /** API URL for this ref */
   url: string
 }
 
+/**
+ * GitHub annotated tag object returned by the API.
+ * Represents a git tag with metadata.
+ */
 export interface GitHubTag {
+  /** Tag annotation message */
   message: string
+  /** The commit this tag points to */
   object: {
+    /** SHA of the commit */
     sha: string
+    /** Type of object (usually 'commit') */
     type: string
+    /** API URL to fetch the commit details */
     url: string
   }
+  /** SHA of this tag object itself */
   sha: string
+  /** Tag name (e.g., 'v1.0.0') */
   tag: string
+  /**
+   * Information about who created the tag.
+   * Undefined for lightweight tags.
+   */
   tagger?: {
+    /** Tag creation date in ISO 8601 format */
     date: string
+    /** Tagger's email address */
     email: string
+    /** Tagger's name */
     name: string
   }
+  /** API URL for this tag object */
   url: string
 }
 
+/**
+ * GitHub commit object returned by the API.
+ * Represents a git commit with metadata.
+ */
 export interface GitHubCommit {
+  /** Full commit SHA */
   sha: string
+  /** API URL for this commit */
   url: string
+  /** Commit details */
   commit: {
+    /** Commit message */
     message: string
+    /** Author information */
     author: {
+      /** Commit author date in ISO 8601 format */
       date: string
+      /** Author's email address */
       email: string
+      /** Author's name */
       name: string
     }
   }
 }
 
+/**
+ * Options for resolving git refs to commit SHAs.
+ */
 export interface ResolveRefOptions {
+  /**
+   * GitHub authentication token.
+   * If not provided, will attempt to use token from environment variables.
+   */
   token?: string | undefined
 }
 
 /**
  * Resolve a git ref (tag, branch, or commit SHA) to its full commit SHA.
+ * Handles tags (annotated and lightweight), branches, and commit SHAs.
  * Results are cached in-memory and on disk (with TTL) to minimize API calls.
+ *
+ * Resolution strategy:
+ * 1. Try as a tag (refs/tags/{ref})
+ * 2. If tag is annotated, dereference to get the commit SHA
+ * 3. If not a tag, try as a branch (refs/heads/{ref})
+ * 4. If not a branch, try as a commit SHA directly
+ *
+ * Caching behavior:
+ * - In-memory cache (Map) for immediate lookups
+ * - Persistent disk cache (cacache) for durability across runs
+ * - Default TTL: 5 minutes
+ * - Disable caching with `DISABLE_GITHUB_CACHE` env var
+ *
+ * @param owner - Repository owner (user or organization name)
+ * @param repo - Repository name
+ * @param ref - Git reference to resolve (tag name, branch name, or commit SHA)
+ * @param options - Resolution options including authentication token
+ * @returns The full commit SHA (40-character hex string)
+ *
+ * @throws {Error} When ref cannot be resolved after trying all strategies
+ * @throws {GitHubRateLimitError} When API rate limit is exceeded
+ *
+ * @example
+ * ```ts
+ * // Resolve a tag to commit SHA
+ * const sha = await resolveRefToSha('owner', 'repo', 'v1.0.0')
+ * console.log(sha) // 'a1b2c3d4e5f6...'
+ * ```
+ *
+ * @example
+ * ```ts
+ * // Resolve a branch to latest commit SHA
+ * const sha = await resolveRefToSha('owner', 'repo', 'main')
+ * console.log(sha) // Latest commit on main branch
+ * ```
+ *
+ * @example
+ * ```ts
+ * // Resolve with custom token
+ * const sha = await resolveRefToSha(
+ *   'owner',
+ *   'repo',
+ *   'develop',
+ *   { token: 'ghp_customtoken' }
+ * )
+ * ```
+ *
+ * @example
+ * ```ts
+ * // Commit SHA passes through unchanged (but validates it exists)
+ * const sha = await resolveRefToSha('owner', 'repo', 'a1b2c3d4')
+ * console.log(sha) // Full 40-char SHA
+ * ```
  */
 export async function resolveRefToSha(
   owner: string,
@@ -199,6 +394,16 @@ export async function resolveRefToSha(
 
 /**
  * Fetch the SHA for a git ref from GitHub API.
+ * Internal helper that implements the multi-strategy ref resolution logic.
+ * Tries tags, branches, and direct commit lookups in sequence.
+ *
+ * @param owner - Repository owner
+ * @param repo - Repository name
+ * @param ref - Git reference to resolve
+ * @param options - Resolution options with authentication token
+ * @returns The full commit SHA
+ *
+ * @throws {Error} When ref cannot be resolved after all strategies fail
  */
 async function fetchRefSha(
   owner: string,
@@ -251,6 +456,21 @@ async function fetchRefSha(
 
 /**
  * Clear the ref resolution cache (in-memory only).
+ * Clears the in-memory memoization cache without affecting the persistent disk cache.
+ * Useful for testing or when you need fresh data from the API.
+ *
+ * Note: This only clears the in-memory cache. The persistent cacache storage
+ * remains intact and will be used to rebuild the in-memory cache on next access.
+ *
+ * @returns Promise that resolves when cache is cleared
+ *
+ * @example
+ * ```ts
+ * // Clear cache to force fresh API calls
+ * await clearRefCache()
+ * const sha = await resolveRefToSha('owner', 'repo', 'main')
+ * // This will hit the persistent cache or API, not in-memory cache
+ * ```
  */
 export async function clearRefCache(): Promise<void> {
   if (_githubCache) {
@@ -259,12 +479,33 @@ export async function clearRefCache(): Promise<void> {
 }
 
 /**
- * Get GitHub token from git config if not in environment.
- * Falls back to checking git config for github.token.
+ * Get GitHub authentication token from git config.
+ * Reads the `github.token` configuration value from git config.
+ * This is a fallback method when environment variables don't contain a token.
+ *
+ * @param options - Spawn options for git command execution
+ * @returns GitHub token from git config, or `undefined` if not configured
+ *
+ * @example
+ * ```ts
+ * const token = await getGitHubTokenFromGitConfig()
+ * if (token) {
+ *   console.log('Found token in git config')
+ * }
+ * ```
+ *
+ * @example
+ * ```ts
+ * // With custom working directory
+ * const token = await getGitHubTokenFromGitConfig({
+ *   cwd: '/path/to/repo'
+ * })
+ * ```
  */
 export async function getGitHubTokenFromGitConfig(
-  options?: SpawnOptions,
+  options?: SpawnOptions | undefined,
 ): Promise<string | undefined> {
+  /* c8 ignore start - External git process call */
   try {
     const result = await spawn('git', ['config', 'github.token'], {
       ...options,
@@ -277,11 +518,27 @@ export async function getGitHubTokenFromGitConfig(
     // Ignore errors - git config may not have token.
   }
   return undefined
+  /* c8 ignore stop */
 }
 
 /**
- * Get GitHub token from all available sources.
- * Checks environment variables first, then git config.
+ * Get GitHub authentication token from all available sources.
+ * Checks environment variables first, then falls back to git config.
+ * This is the recommended way to get a GitHub token with maximum compatibility.
+ *
+ * Priority order:
+ * 1. Environment variables (GITHUB_TOKEN, GH_TOKEN, SOCKET_CLI_GITHUB_TOKEN)
+ * 2. Git config (github.token)
+ *
+ * @returns GitHub token from first available source, or `undefined` if none found
+ *
+ * @example
+ * ```ts
+ * const token = await getGitHubTokenWithFallback()
+ * if (!token) {
+ *   throw new Error('GitHub token required')
+ * }
+ * ```
  */
 export async function getGitHubTokenWithFallback(): Promise<
   string | undefined
@@ -289,50 +546,127 @@ export async function getGitHubTokenWithFallback(): Promise<
   return getGitHubToken() || (await getGitHubTokenFromGitConfig())
 }
 
-// GHSA (GitHub Security Advisory) types and utilities.
+/**
+ * GitHub Security Advisory (GHSA) details.
+ * Represents a complete security advisory from GitHub's database.
+ */
 export interface GhsaDetails {
+  /** GHSA identifier (e.g., 'GHSA-xxxx-yyyy-zzzz') */
   ghsaId: string
+  /** Short summary of the vulnerability */
   summary: string
+  /** Detailed description of the vulnerability */
   details: string
+  /** Severity level ('low', 'moderate', 'high', 'critical') */
   severity: string
+  /** Alternative identifiers (CVE IDs, etc.) */
   aliases: string[]
+  /** ISO 8601 timestamp when advisory was published */
   publishedAt: string
+  /** ISO 8601 timestamp when advisory was last updated */
   updatedAt: string
+  /**
+   * ISO 8601 timestamp when advisory was withdrawn.
+   * `null` if advisory is still active.
+   */
   withdrawnAt: string | null
+  /** External reference URLs for more information */
   references: Array<{ url: string }>
+  /** Affected packages and version ranges */
   vulnerabilities: Array<{
+    /** Package information */
     package: {
+      /** Ecosystem (e.g., 'npm', 'pip', 'maven') */
       ecosystem: string
+      /** Package name */
       name: string
     }
+    /** Version range expression for vulnerable versions */
     vulnerableVersionRange: string
+    /**
+     * First patched version that fixes the vulnerability.
+     * `null` if no patched version exists yet.
+     */
     firstPatchedVersion: { identifier: string } | null
   }>
+  /**
+   * CVSS (Common Vulnerability Scoring System) information.
+   * `null` if CVSS score is not available.
+   */
   cvss: {
+    /** CVSS score (0.0-10.0) */
     score: number
+    /** CVSS vector string describing the vulnerability characteristics */
     vectorString: string
   } | null
+  /** CWE (Common Weakness Enumeration) categories */
   cwes: Array<{
+    /** CWE identifier (e.g., 'CWE-79') */
     cweId: string
+    /** Human-readable CWE name */
     name: string
+    /** Description of the weakness category */
     description: string
   }>
 }
 
 /**
  * Generate GitHub Security Advisory URL from GHSA ID.
+ * Constructs the public advisory URL for a given GHSA identifier.
+ *
+ * @param ghsaId - GHSA identifier (e.g., 'GHSA-xxxx-yyyy-zzzz')
+ * @returns Full URL to the advisory page
+ *
+ * @example
+ * ```ts
+ * const url = getGhsaUrl('GHSA-1234-5678-90ab')
+ * console.log(url) // 'https://github.com/advisories/GHSA-1234-5678-90ab'
+ * ```
  */
 export function getGhsaUrl(ghsaId: string): string {
   return `https://github.com/advisories/${ghsaId}`
 }
 
 /**
- * Fetch GitHub Security Advisory details.
+ * Fetch GitHub Security Advisory details from the API.
+ * Retrieves complete advisory information including severity, affected packages,
+ * CVSS scores, and CWE classifications.
+ *
+ * @param ghsaId - GHSA identifier to fetch (e.g., 'GHSA-xxxx-yyyy-zzzz')
+ * @param options - Fetch options including authentication token
+ * @returns Complete advisory details with normalized field names
+ *
+ * @throws {Error} If advisory cannot be found or API request fails
+ * @throws {GitHubRateLimitError} When API rate limit is exceeded
+ *
+ * @example
+ * ```ts
+ * const advisory = await fetchGhsaDetails('GHSA-1234-5678-90ab')
+ * console.log(`Severity: ${advisory.severity}`)
+ * console.log(`Affects: ${advisory.vulnerabilities.length} packages`)
+ * if (advisory.cvss) {
+ *   console.log(`CVSS Score: ${advisory.cvss.score}`)
+ * }
+ * ```
+ *
+ * @example
+ * ```ts
+ * // Check if vulnerability is patched
+ * const advisory = await fetchGhsaDetails('GHSA-xxxx-yyyy-zzzz')
+ * for (const vuln of advisory.vulnerabilities) {
+ *   if (vuln.firstPatchedVersion) {
+ *     console.log(
+ *       `Patched in ${vuln.package.name}@${vuln.firstPatchedVersion.identifier}`
+ *     )
+ *   }
+ * }
+ * ```
  */
 export async function fetchGhsaDetails(
   ghsaId: string,
-  options?: GitHubFetchOptions,
+  options?: GitHubFetchOptions | undefined,
 ): Promise<GhsaDetails> {
+  /* c8 ignore start - External GitHub API call */
   const url = `https://api.github.com/advisories/${ghsaId}`
   const data = await fetchGitHub<{
     aliases?: string[]
@@ -352,6 +686,7 @@ export async function fetchGhsaDetails(
     }>
     withdrawn_at: string
   }>(url, options)
+  /* c8 ignore stop */
 
   return {
     ghsaId: data.ghsa_id,
@@ -370,11 +705,43 @@ export async function fetchGhsaDetails(
 }
 
 /**
- * Cached fetch for GHSA details.
+ * Fetch GitHub Security Advisory details with caching.
+ * Retrieves advisory information with two-tier caching (in-memory + persistent).
+ * Cached results are stored with the default TTL (5 minutes).
+ *
+ * Caching behavior:
+ * - Checks in-memory cache first for immediate response
+ * - Falls back to persistent disk cache if not in memory
+ * - Fetches from API only if not cached
+ * - Stores result in both cache tiers
+ * - Respects `DISABLE_GITHUB_CACHE` env var
+ *
+ * @param ghsaId - GHSA identifier to fetch
+ * @param options - Fetch options including authentication token
+ * @returns Complete advisory details
+ *
+ * @throws {Error} If advisory cannot be found or API request fails
+ * @throws {GitHubRateLimitError} When API rate limit is exceeded
+ *
+ * @example
+ * ```ts
+ * // First call hits API
+ * const advisory = await cacheFetchGhsa('GHSA-1234-5678-90ab')
+ *
+ * // Second call within 5 minutes returns cached data
+ * const cached = await cacheFetchGhsa('GHSA-1234-5678-90ab')
+ * ```
+ *
+ * @example
+ * ```ts
+ * // Disable caching for fresh data
+ * process.env.DISABLE_GITHUB_CACHE = '1'
+ * const advisory = await cacheFetchGhsa('GHSA-xxxx-yyyy-zzzz')
+ * ```
  */
 export async function cacheFetchGhsa(
   ghsaId: string,
-  options?: GitHubFetchOptions,
+  options?: GitHubFetchOptions | undefined,
 ): Promise<GhsaDetails> {
   const cache = getGithubCache()
   const key = `ghsa:${ghsaId}`
diff --git a/src/globs.ts b/src/globs.ts
index 7dadc4c..cf43c50 100644
--- a/src/globs.ts
+++ b/src/globs.ts
@@ -91,7 +91,7 @@ let _picomatch: typeof import('picomatch') | undefined
 function getPicomatch() {
   if (_picomatch === undefined) {
     // The 'picomatch' package is browser safe.
-    _picomatch = /*@__PURE__*/ require('../external/picomatch')
+    _picomatch = /*@__PURE__*/ require('./external/picomatch')
   }
   return _picomatch as typeof import('picomatch')
 }
@@ -104,8 +104,7 @@ let _fastGlob: typeof import('fast-glob') | undefined
 /*@__NO_SIDE_EFFECTS__*/
 function getFastGlob() {
   if (_fastGlob === undefined) {
-    const globExport = /*@__PURE__*/ require('../external/fast-glob')
-    _fastGlob = globExport.default || globExport
+    _fastGlob = /*@__PURE__*/ require('./external/fast-glob')
   }
   return _fastGlob as typeof import('fast-glob')
 }
@@ -129,18 +128,15 @@ export function globStreamLicenses(
     '**/*.{cjs,cts,js,json,mjs,mts,ts}',
   ]
   if (ignoreOriginals) {
-    ignore.push(
-      /*@__INLINE__*/ require('../constants/paths')
-        .LICENSE_ORIGINAL_GLOB_RECURSIVE,
-    )
+    const { LICENSE_ORIGINAL_GLOB_RECURSIVE } =
+      /*@__INLINE__*/ require('#constants/paths') as typeof import('#constants/paths')
+    ignore.push(LICENSE_ORIGINAL_GLOB_RECURSIVE)
   }
   const fastGlob = getFastGlob()
+  const paths =
+    /*@__INLINE__*/ require('#constants/paths') as typeof import('#constants/paths')
   return fastGlob.globStream(
-    [
-      recursive
-        ? /*@__INLINE__*/ require('../constants/paths').LICENSE_GLOB_RECURSIVE
-        : /*@__INLINE__*/ require('../constants/paths').LICENSE_GLOB,
-    ],
+    [recursive ? paths.LICENSE_GLOB_RECURSIVE : paths.LICENSE_GLOB],
     {
       __proto__: null,
       absolute: true,
@@ -152,7 +148,7 @@ export function globStreamLicenses(
   )
 }
 
-const matcherCache = new Map()
+const matcherCache = new Map<string, (path: string) => boolean>()
 /**
  * Get a cached glob matcher function.
  */
@@ -163,7 +159,7 @@ export function getGlobMatcher(
 ): (path: string) => boolean {
   const patterns = Array.isArray(glob) ? glob : [glob]
   const key = JSON.stringify({ patterns, options })
-  let matcher = matcherCache.get(key)
+  let matcher: ((path: string) => boolean) | undefined = matcherCache.get(key)
   if (matcher) {
     return matcher
   }
@@ -187,7 +183,7 @@ export function getGlobMatcher(
   matcher = picomatch(
     positivePatterns.length > 0 ? positivePatterns : patterns,
     matchOptions,
-  )
+  ) as (path: string) => boolean
 
   matcherCache.set(key, matcher)
   return matcher
diff --git a/src/http-request.ts b/src/http-request.ts
index 07c6961..77f528d 100644
--- a/src/http-request.ts
+++ b/src/http-request.ts
@@ -1,8 +1,22 @@
-/** @fileoverview HTTP/HTTPS request utilities using Node.js built-in modules with retry logic, redirects, and download support. */
+/**
+ * @fileoverview HTTP/HTTPS request utilities using Node.js built-in modules with retry logic, redirects, and download support.
+ *
+ * This module provides a fetch-like API built on top of Node.js native `http` and `https` modules.
+ * It supports automatic retries with exponential backoff, redirect following, streaming downloads,
+ * and provides a familiar fetch-style response interface.
+ *
+ * Key Features:
+ * - Automatic retries with exponential backoff for failed requests.
+ * - Redirect following with configurable max redirects.
+ * - Streaming downloads with progress callbacks.
+ * - Fetch-like response interface (`.json()`, `.text()`, `.arrayBuffer()`).
+ * - Timeout support for all operations.
+ * - Zero dependencies on external HTTP libraries.
+ */
 
-import { createWriteStream } from 'node:fs'
+import { createWriteStream } from 'fs'
 
-import type { IncomingMessage } from 'node:http'
+import type { IncomingMessage } from 'http'
 
 let _http: typeof import('http') | undefined
 let _https: typeof import('https') | undefined
@@ -30,45 +44,402 @@ function getHttps() {
   return _https as typeof import('https')
 }
 
+/**
+ * Configuration options for HTTP/HTTPS requests.
+ */
 export interface HttpRequestOptions {
+  /**
+   * Request body to send.
+   * Can be a string (e.g., JSON) or Buffer (e.g., binary data).
+   *
+   * @example
+   * ```ts
+   * // Send JSON data
+   * await httpRequest('https://api.example.com/data', {
+   *   method: 'POST',
+   *   body: JSON.stringify({ name: 'Alice' }),
+   *   headers: { 'Content-Type': 'application/json' }
+   * })
+   *
+   * // Send binary data
+   * const buffer = Buffer.from([0x00, 0x01, 0x02])
+   * await httpRequest('https://api.example.com/upload', {
+   *   method: 'POST',
+   *   body: buffer
+   * })
+   * ```
+   */
   body?: Buffer | string | undefined
+  /**
+   * Whether to automatically follow HTTP redirects (3xx status codes).
+   *
+   * @default true
+   *
+   * @example
+   * ```ts
+   * // Follow redirects (default)
+   * await httpRequest('https://example.com/redirect')
+   *
+   * // Don't follow redirects
+   * const response = await httpRequest('https://example.com/redirect', {
+   *   followRedirects: false
+   * })
+   * console.log(response.status) // 301 or 302
+   * ```
+   */
   followRedirects?: boolean | undefined
+  /**
+   * HTTP headers to send with the request.
+   * A `User-Agent` header is automatically added if not provided.
+   *
+   * @example
+   * ```ts
+   * await httpRequest('https://api.example.com/data', {
+   *   headers: {
+   *     'Authorization': 'Bearer token123',
+   *     'Content-Type': 'application/json',
+   *     'Accept': 'application/json'
+   *   }
+   * })
+   * ```
+   */
   headers?: Record<string, string> | undefined
+  /**
+   * Maximum number of redirects to follow before throwing an error.
+   * Only relevant when `followRedirects` is `true`.
+   *
+   * @default 5
+   *
+   * @example
+   * ```ts
+   * // Allow up to 10 redirects
+   * await httpRequest('https://example.com/many-redirects', {
+   *   maxRedirects: 10
+   * })
+   * ```
+   */
   maxRedirects?: number | undefined
+  /**
+   * HTTP method to use for the request.
+   *
+   * @default 'GET'
+   *
+   * @example
+   * ```ts
+   * // GET request (default)
+   * await httpRequest('https://api.example.com/data')
+   *
+   * // POST request
+   * await httpRequest('https://api.example.com/data', {
+   *   method: 'POST',
+   *   body: JSON.stringify({ name: 'Alice' })
+   * })
+   *
+   * // DELETE request
+   * await httpRequest('https://api.example.com/data/123', {
+   *   method: 'DELETE'
+   * })
+   * ```
+   */
   method?: string | undefined
+  /**
+   * Number of retry attempts for failed requests.
+   * Uses exponential backoff: delay = `retryDelay` * 2^attempt.
+   *
+   * @default 0
+   *
+   * @example
+   * ```ts
+   * // Retry up to 3 times with exponential backoff
+   * await httpRequest('https://api.example.com/data', {
+   *   retries: 3,
+   *   retryDelay: 1000 // 1s, then 2s, then 4s
+   * })
+   * ```
+   */
   retries?: number | undefined
+  /**
+   * Initial delay in milliseconds before first retry.
+   * Subsequent retries use exponential backoff.
+   *
+   * @default 1000
+   *
+   * @example
+   * ```ts
+   * // Start with 2 second delay, then 4s, 8s, etc.
+   * await httpRequest('https://api.example.com/data', {
+   *   retries: 3,
+   *   retryDelay: 2000
+   * })
+   * ```
+   */
   retryDelay?: number | undefined
+  /**
+   * Request timeout in milliseconds.
+   * If the request takes longer than this, it will be aborted.
+   *
+   * @default 30000
+   *
+   * @example
+   * ```ts
+   * // 60 second timeout
+   * await httpRequest('https://api.example.com/slow-endpoint', {
+   *   timeout: 60000
+   * })
+   * ```
+   */
   timeout?: number | undefined
 }
 
+/**
+ * HTTP response object with fetch-like interface.
+ * Provides multiple ways to access the response body.
+ */
 export interface HttpResponse {
+  /**
+   * Get response body as ArrayBuffer.
+   * Useful for binary data or when you need compatibility with browser APIs.
+   *
+   * @returns The response body as an ArrayBuffer
+   *
+   * @example
+   * ```ts
+   * const response = await httpRequest('https://example.com/image.png')
+   * const arrayBuffer = response.arrayBuffer()
+   * console.log(arrayBuffer.byteLength)
+   * ```
+   */
   arrayBuffer(): ArrayBuffer
+  /**
+   * Raw response body as Buffer.
+   * Direct access to the underlying Node.js Buffer.
+   *
+   * @example
+   * ```ts
+   * const response = await httpRequest('https://example.com/data')
+   * console.log(response.body.length) // Size in bytes
+   * console.log(response.body.toString('hex')) // View as hex
+   * ```
+   */
   body: Buffer
+  /**
+   * HTTP response headers.
+   * Keys are lowercase header names, values can be strings or string arrays.
+   *
+   * @example
+   * ```ts
+   * const response = await httpRequest('https://example.com')
+   * console.log(response.headers['content-type'])
+   * console.log(response.headers['set-cookie']) // May be string[]
+   * ```
+   */
   headers: Record<string, string | string[] | undefined>
+  /**
+   * Parse response body as JSON.
+   * Type parameter `T` allows specifying the expected JSON structure.
+   *
+   * @template T - Expected JSON type (defaults to `unknown`)
+   * @returns Parsed JSON data
+   * @throws {SyntaxError} When response body is not valid JSON
+   *
+   * @example
+   * ```ts
+   * interface User { name: string; id: number }
+   * const response = await httpRequest('https://api.example.com/user')
+   * const user = response.json<User>()
+   * console.log(user.name, user.id)
+   * ```
+   */
   json<T = unknown>(): T
+  /**
+   * Whether the request was successful (status code 200-299).
+   *
+   * @example
+   * ```ts
+   * const response = await httpRequest('https://example.com/data')
+   * if (response.ok) {
+   *   console.log('Success:', response.json())
+   * } else {
+   *   console.error('Failed:', response.status, response.statusText)
+   * }
+   * ```
+   */
   ok: boolean
+  /**
+   * HTTP status code (e.g., 200, 404, 500).
+   *
+   * @example
+   * ```ts
+   * const response = await httpRequest('https://example.com')
+   * console.log(response.status) // 200, 404, etc.
+   * ```
+   */
   status: number
+  /**
+   * HTTP status message (e.g., "OK", "Not Found", "Internal Server Error").
+   *
+   * @example
+   * ```ts
+   * const response = await httpRequest('https://example.com')
+   * console.log(response.statusText) // "OK"
+   * ```
+   */
   statusText: string
+  /**
+   * Get response body as UTF-8 text string.
+   *
+   * @returns The response body as a string
+   *
+   * @example
+   * ```ts
+   * const response = await httpRequest('https://example.com')
+   * const html = response.text()
+   * console.log(html.includes('<html>'))
+   * ```
+   */
   text(): string
 }
 
+/**
+ * Configuration options for file downloads.
+ */
 export interface HttpDownloadOptions {
+  /**
+   * HTTP headers to send with the download request.
+   * A `User-Agent` header is automatically added if not provided.
+   *
+   * @example
+   * ```ts
+   * await httpDownload('https://example.com/file.zip', '/tmp/file.zip', {
+   *   headers: {
+   *     'Authorization': 'Bearer token123'
+   *   }
+   * })
+   * ```
+   */
   headers?: Record<string, string> | undefined
+  /**
+   * Callback for tracking download progress.
+   * Called periodically as data is received.
+   *
+   * @param downloaded - Number of bytes downloaded so far
+   * @param total - Total file size in bytes (from Content-Length header)
+   *
+   * @example
+   * ```ts
+   * await httpDownload('https://example.com/large-file.zip', '/tmp/file.zip', {
+   *   onProgress: (downloaded, total) => {
+   *     const percent = ((downloaded / total) * 100).toFixed(1)
+   *     console.log(`Progress: ${percent}%`)
+   *   }
+   * })
+   * ```
+   */
   onProgress?: ((downloaded: number, total: number) => void) | undefined
+  /**
+   * Number of retry attempts for failed downloads.
+   * Uses exponential backoff: delay = `retryDelay` * 2^attempt.
+   *
+   * @default 0
+   *
+   * @example
+   * ```ts
+   * // Retry up to 3 times for unreliable connections
+   * await httpDownload('https://example.com/file.zip', '/tmp/file.zip', {
+   *   retries: 3,
+   *   retryDelay: 2000
+   * })
+   * ```
+   */
   retries?: number | undefined
+  /**
+   * Initial delay in milliseconds before first retry.
+   * Subsequent retries use exponential backoff.
+   *
+   * @default 1000
+   */
   retryDelay?: number | undefined
+  /**
+   * Download timeout in milliseconds.
+   * If the download takes longer than this, it will be aborted.
+   *
+   * @default 120000
+   *
+   * @example
+   * ```ts
+   * // 5 minute timeout for large files
+   * await httpDownload('https://example.com/huge-file.zip', '/tmp/file.zip', {
+   *   timeout: 300000
+   * })
+   * ```
+   */
   timeout?: number | undefined
 }
 
+/**
+ * Result of a successful file download.
+ */
 export interface HttpDownloadResult {
+  /**
+   * Absolute path where the file was saved.
+   *
+   * @example
+   * ```ts
+   * const result = await httpDownload('https://example.com/file.zip', '/tmp/file.zip')
+   * console.log(`Downloaded to: ${result.path}`)
+   * ```
+   */
   path: string
+  /**
+   * Total size of downloaded file in bytes.
+   *
+   * @example
+   * ```ts
+   * const result = await httpDownload('https://example.com/file.zip', '/tmp/file.zip')
+   * console.log(`Downloaded ${result.size} bytes`)
+   * ```
+   */
   size: number
 }
 
 /**
  * Make an HTTP/HTTPS request with retry logic and redirect support.
  * Provides a fetch-like API using Node.js native http/https modules.
- * @throws {Error} When all retries are exhausted or non-retryable error occurs.
+ *
+ * This is the main entry point for making HTTP requests. It handles retries,
+ * redirects, timeouts, and provides a fetch-compatible response interface.
+ *
+ * @param url - The URL to request (must start with http:// or https://)
+ * @param options - Request configuration options
+ * @returns Promise resolving to response object with `.json()`, `.text()`, etc.
+ * @throws {Error} When all retries are exhausted, timeout occurs, or non-retryable error happens
+ *
+ * @example
+ * ```ts
+ * // Simple GET request
+ * const response = await httpRequest('https://api.example.com/data')
+ * const data = response.json()
+ *
+ * // POST with JSON body
+ * const response = await httpRequest('https://api.example.com/users', {
+ *   method: 'POST',
+ *   headers: { 'Content-Type': 'application/json' },
+ *   body: JSON.stringify({ name: 'Alice', email: 'alice@example.com' })
+ * })
+ *
+ * // With retries and timeout
+ * const response = await httpRequest('https://api.example.com/data', {
+ *   retries: 3,
+ *   retryDelay: 1000,
+ *   timeout: 60000
+ * })
+ *
+ * // Don't follow redirects
+ * const response = await httpRequest('https://example.com/redirect', {
+ *   followRedirects: false
+ * })
+ * console.log(response.status) // 301, 302, etc.
+ * ```
  */
 export async function httpRequest(
   url: string,
@@ -118,6 +489,7 @@ export async function httpRequest(
 
 /**
  * Single HTTP request attempt (used internally by httpRequest with retry logic).
+ * @private
  */
 async function httpRequestAttempt(
   url: string,
@@ -149,6 +521,7 @@ async function httpRequestAttempt(
       timeout,
     }
 
+    /* c8 ignore start - External HTTP/HTTPS request */
     const request = httpModule.request(
       requestOptions,
       (res: IncomingMessage) => {
@@ -229,10 +602,27 @@ async function httpRequestAttempt(
     )
 
     request.on('error', (error: Error) => {
-      const err = new Error(`HTTP request failed: ${error.message}`, {
-        cause: error,
-      })
-      reject(err)
+      const code = (error as NodeJS.ErrnoException).code
+      let message = `HTTP request failed for ${url}: ${error.message}\n`
+
+      if (code === 'ENOTFOUND') {
+        message +=
+          'DNS lookup failed. Check the hostname and your network connection.'
+      } else if (code === 'ECONNREFUSED') {
+        message +=
+          'Connection refused. Verify the server is running and accessible.'
+      } else if (code === 'ETIMEDOUT') {
+        message +=
+          'Request timed out. Check your network or increase the timeout value.'
+      } else if (code === 'ECONNRESET') {
+        message +=
+          'Connection reset. The server may have closed the connection unexpectedly.'
+      } else {
+        message +=
+          'Check your network connection and verify the URL is correct.'
+      }
+
+      reject(new Error(message, { cause: error }))
     })
 
     request.on('timeout', () => {
@@ -246,13 +636,56 @@ async function httpRequestAttempt(
     }
 
     request.end()
+    /* c8 ignore stop */
   })
 }
 
 /**
  * Download a file from a URL to a local path with retry logic and progress callbacks.
  * Uses streaming to avoid loading entire file in memory.
- * @throws {Error} When all retries are exhausted or download fails.
+ *
+ * The download is streamed directly to disk, making it memory-efficient even for
+ * large files. Progress callbacks allow for real-time download status updates.
+ *
+ * @param url - The URL to download from (must start with http:// or https://)
+ * @param destPath - Absolute path where the file should be saved
+ * @param options - Download configuration options
+ * @returns Promise resolving to download result with path and size
+ * @throws {Error} When all retries are exhausted, download fails, or file cannot be written
+ *
+ * @example
+ * ```ts
+ * // Simple download
+ * const result = await httpDownload(
+ *   'https://example.com/file.zip',
+ *   '/tmp/file.zip'
+ * )
+ * console.log(`Downloaded ${result.size} bytes to ${result.path}`)
+ *
+ * // With progress tracking
+ * await httpDownload(
+ *   'https://example.com/large-file.zip',
+ *   '/tmp/file.zip',
+ *   {
+ *     onProgress: (downloaded, total) => {
+ *       const percent = ((downloaded / total) * 100).toFixed(1)
+ *       console.log(`Progress: ${percent}% (${downloaded}/${total} bytes)`)
+ *     }
+ *   }
+ * )
+ *
+ * // With retries and custom timeout
+ * await httpDownload(
+ *   'https://example.com/file.zip',
+ *   '/tmp/file.zip',
+ *   {
+ *     retries: 3,
+ *     retryDelay: 2000,
+ *     timeout: 300000, // 5 minutes
+ *     headers: { 'Authorization': 'Bearer token123' }
+ *   }
+ * )
+ * ```
  */
 export async function httpDownload(
   url: string,
@@ -297,6 +730,7 @@ export async function httpDownload(
 
 /**
  * Single download attempt (used internally by httpDownload with retry logic).
+ * @private
  */
 async function httpDownloadAttempt(
   url: string,
@@ -336,6 +770,7 @@ async function httpDownloadAttempt(
       }
     }
 
+    /* c8 ignore start - External HTTP/HTTPS download request */
     const request = httpModule.request(
       requestOptions,
       (res: IncomingMessage) => {
@@ -396,10 +831,27 @@ async function httpDownloadAttempt(
 
     request.on('error', (error: Error) => {
       closeStream()
-      const err = new Error(`HTTP download failed: ${error.message}`, {
-        cause: error,
-      })
-      reject(err)
+      const code = (error as NodeJS.ErrnoException).code
+      let message = `HTTP download failed for ${url}: ${error.message}\n`
+
+      if (code === 'ENOTFOUND') {
+        message +=
+          'DNS lookup failed. Check the hostname and your network connection.'
+      } else if (code === 'ECONNREFUSED') {
+        message +=
+          'Connection refused. Verify the server is running and accessible.'
+      } else if (code === 'ETIMEDOUT') {
+        message +=
+          'Request timed out. Check your network or increase the timeout value.'
+      } else if (code === 'ECONNRESET') {
+        message +=
+          'Connection reset. The server may have closed the connection unexpectedly.'
+      } else {
+        message +=
+          'Check your network connection and verify the URL is correct.'
+      }
+
+      reject(new Error(message, { cause: error }))
     })
 
     request.on('timeout', () => {
@@ -409,12 +861,45 @@ async function httpDownloadAttempt(
     })
 
     request.end()
+    /* c8 ignore stop */
   })
 }
 
 /**
  * Perform a GET request and parse JSON response.
- * @throws {Error} When request fails or JSON parsing fails.
+ * Convenience wrapper around `httpRequest` for common JSON API calls.
+ *
+ * @template T - Expected JSON response type (defaults to `unknown`)
+ * @param url - The URL to request (must start with http:// or https://)
+ * @param options - Request configuration options
+ * @returns Promise resolving to parsed JSON data
+ * @throws {Error} When request fails, response is not ok (status < 200 or >= 300), or JSON parsing fails
+ *
+ * @example
+ * ```ts
+ * // Simple JSON GET
+ * const data = await httpGetJson('https://api.example.com/data')
+ * console.log(data)
+ *
+ * // With type safety
+ * interface User { id: number; name: string; email: string }
+ * const user = await httpGetJson<User>('https://api.example.com/user/123')
+ * console.log(user.name, user.email)
+ *
+ * // With custom headers
+ * const data = await httpGetJson('https://api.example.com/data', {
+ *   headers: {
+ *     'Authorization': 'Bearer token123',
+ *     'Accept': 'application/json'
+ *   }
+ * })
+ *
+ * // With retries
+ * const data = await httpGetJson('https://api.example.com/data', {
+ *   retries: 3,
+ *   retryDelay: 1000
+ * })
+ * ```
  */
 export async function httpGetJson<T = unknown>(
   url: string,
@@ -435,7 +920,35 @@ export async function httpGetJson<T = unknown>(
 
 /**
  * Perform a GET request and return text response.
- * @throws {Error} When request fails.
+ * Convenience wrapper around `httpRequest` for fetching text content.
+ *
+ * @param url - The URL to request (must start with http:// or https://)
+ * @param options - Request configuration options
+ * @returns Promise resolving to response body as UTF-8 string
+ * @throws {Error} When request fails or response is not ok (status < 200 or >= 300)
+ *
+ * @example
+ * ```ts
+ * // Fetch HTML
+ * const html = await httpGetText('https://example.com')
+ * console.log(html.includes('<!DOCTYPE html>'))
+ *
+ * // Fetch plain text
+ * const text = await httpGetText('https://example.com/file.txt')
+ * console.log(text)
+ *
+ * // With custom headers
+ * const text = await httpGetText('https://example.com/data.txt', {
+ *   headers: {
+ *     'Authorization': 'Bearer token123'
+ *   }
+ * })
+ *
+ * // With timeout
+ * const text = await httpGetText('https://example.com/large-file.txt', {
+ *   timeout: 60000 // 1 minute
+ * })
+ * ```
  */
 export async function httpGetText(
   url: string,
diff --git a/src/index.ts b/src/index.ts
deleted file mode 100644
index 52b3e53..0000000
--- a/src/index.ts
+++ /dev/null
@@ -1,50 +0,0 @@
-/**
- * @fileoverview Main entry point for Socket Registry v2.0.
- * Clean, organized exports for better developer experience.
- */
-
-// Direct exports for commonly used items
-// Alias for backward compatibility with GitHub version
-export {
-  SocketRegistry,
-  SocketRegistry as SocketSecurityRegistry,
-} from './packages/registry'
-// Export types
-export * from './types'
-
-// Manifest data helper function
-export function getManifestData(ecosystem?: string, packageName?: string) {
-  try {
-    const manifestData = require('../manifest.json')
-
-    if (!ecosystem) {
-      return manifestData
-    }
-
-    const ecoData = manifestData[ecosystem]
-    if (!ecoData) {
-      return undefined
-    }
-
-    if (!packageName) {
-      return ecoData
-    }
-
-    // ecoData is an array of [purl, data] entries
-    if (Array.isArray(ecoData)) {
-      const entry = ecoData.find(
-        ([_purl, data]) => data.package === packageName,
-      )
-      return entry ? entry[1] : undefined
-    }
-
-    // Fallback for object-based structure
-    const pkgData = ecoData[packageName]
-    return pkgData ? [packageName, pkgData] : undefined
-  } catch {
-    return undefined
-  }
-}
-
-// Version export
-export const version = '2.0.0'
diff --git a/src/ipc.ts b/src/ipc.ts
index 0d4556f..013a121 100644
--- a/src/ipc.ts
+++ b/src/ipc.ts
@@ -28,11 +28,14 @@
  * @module ipc
  */
 
-import crypto from 'node:crypto'
-import { promises as fs } from 'node:fs'
-import os from 'node:os'
-import path from 'node:path'
+import crypto from 'crypto'
 
+import { promises as fs } from 'fs'
+
+import path from 'path'
+
+import { safeDeleteSync } from './fs'
+import { getOsTmpDir } from './paths'
 import { z } from './zod'
 
 // Define BufferEncoding type for TypeScript compatibility.
@@ -205,7 +208,7 @@ export function createIpcChannelId(prefix = 'socket'): string {
  */
 export function getIpcStubPath(appName: string): string {
   // Get the system's temporary directory - this is platform-specific.
-  const tempDir = os.tmpdir()
+  const tempDir = getOsTmpDir()
 
   // Create a hidden directory structure for Socket IPC files.
   // The dot prefix makes it hidden on Unix-like systems.
@@ -327,8 +330,12 @@ export async function readIpcStub(stubPath: string): Promise<unknown> {
     // 5 minutes.
     const maxAgeMs = 5 * 60 * 1000
     if (ageMs > maxAgeMs) {
-      // Clean up stale file.
-      await fs.unlink(stubPath).catch(() => {})
+      // Clean up stale file. IPC stubs are always in tmpdir, so use force: true.
+      try {
+        safeDeleteSync(stubPath, { force: true })
+      } catch {
+        // Ignore deletion errors
+      }
       return null
     }
     return validated.data
@@ -346,7 +353,7 @@ export async function readIpcStub(stubPath: string): Promise<unknown> {
  * periodically or on application startup.
  *
  * ## Cleanup Rules:
- * - Files older than 5 minutes are removed
+ * - Files older than 5 minutes are removed (checked via both filesystem mtime and JSON timestamp)
  * - Only stub files (stub-*.json) are processed
  * - Errors are silently ignored (best-effort cleanup)
  *
@@ -362,7 +369,7 @@ export async function readIpcStub(stubPath: string): Promise<unknown> {
  * @unused Reserved for future implementation
  */
 export async function cleanupIpcStubs(appName: string): Promise<void> {
-  const tempDir = os.tmpdir()
+  const tempDir = getOsTmpDir()
   const stubDir = path.join(tempDir, '.socket-ipc', appName)
   try {
     const files = await fs.readdir(stubDir)
@@ -370,15 +377,32 @@ export async function cleanupIpcStubs(appName: string): Promise<void> {
     // 5 minutes.
     const maxAgeMs = 5 * 60 * 1000
     // Process each file in parallel for efficiency.
-    await Promise.all(
+    await Promise.allSettled(
       files.map(async file => {
         if (file.startsWith('stub-') && file.endsWith('.json')) {
           const filePath = path.join(stubDir, file)
           try {
+            // Check both filesystem mtime and JSON timestamp for more reliable detection
             const stats = await fs.stat(filePath)
-            const ageMs = now - stats.mtimeMs
-            if (ageMs > maxAgeMs) {
-              await fs.unlink(filePath)
+            const mtimeAge = now - stats.mtimeMs
+            let isStale = mtimeAge > maxAgeMs
+
+            // Always check the timestamp inside the JSON file for accuracy
+            // This is more reliable than filesystem mtime in some environments
+            try {
+              const content = await fs.readFile(filePath, 'utf8')
+              const parsed = JSON.parse(content)
+              const validated = IpcStubSchema.parse(parsed)
+              const contentAge = now - validated.timestamp
+              // File is stale if EITHER check indicates staleness
+              isStale = isStale || contentAge > maxAgeMs
+            } catch {
+              // If we can't read/parse the file, rely on mtime check
+            }
+
+            if (isStale) {
+              // IPC stubs are always in tmpdir, so we can use force: true to skip path checks
+              safeDeleteSync(filePath, { force: true })
             }
           } catch {
             // Ignore errors for individual files.
diff --git a/src/json.ts b/src/json.ts
index 2ac24c3..8964e01 100644
--- a/src/json.ts
+++ b/src/json.ts
@@ -5,22 +5,130 @@
 
 import { stripBom } from './strings'
 
+/**
+ * JSON primitive types: `null`, `boolean`, `number`, or `string`.
+ *
+ * @example
+ * ```ts
+ * const primitives: JsonPrimitive[] = [null, true, 42, 'hello']
+ * ```
+ */
 export type JsonPrimitive = null | boolean | number | string
 
+/**
+ * Any valid JSON value: primitive, object, or array.
+ *
+ * @example
+ * ```ts
+ * const values: JsonValue[] = [
+ *   null,
+ *   true,
+ *   42,
+ *   'hello',
+ *   { key: 'value' },
+ *   [1, 2, 3]
+ * ]
+ * ```
+ */
 export type JsonValue = JsonPrimitive | JsonObject | JsonArray
 
+/**
+ * A JSON object with string keys and JSON values.
+ *
+ * @example
+ * ```ts
+ * const obj: JsonObject = {
+ *   name: 'example',
+ *   count: 42,
+ *   active: true,
+ *   nested: { key: 'value' }
+ * }
+ * ```
+ */
 export interface JsonObject {
   [key: string]: JsonValue
 }
 
+/**
+ * A JSON array containing JSON values.
+ *
+ * @example
+ * ```ts
+ * const arr: JsonArray = [1, 'two', { three: 3 }, [4, 5]]
+ * ```
+ */
 export interface JsonArray extends Array<JsonValue> {}
 
+/**
+ * Reviver function for transforming parsed JSON values.
+ * Called for each key-value pair during parsing.
+ *
+ * @param key - The object key or array index being parsed
+ * @param value - The parsed value
+ * @returns The transformed value (or original if no transform needed)
+ *
+ * @example
+ * ```ts
+ * // Convert date strings to Date objects
+ * const reviver: JsonReviver = (key, value) => {
+ *   if (typeof value === 'string' && /^\d{4}-\d{2}-\d{2}/.test(value)) {
+ *     return new Date(value)
+ *   }
+ *   return value
+ * }
+ * ```
+ */
 export type JsonReviver = (key: string, value: unknown) => unknown
 
+/**
+ * Options for JSON parsing operations.
+ */
 export interface JsonParseOptions {
-  filepath?: string
+  /**
+   * Optional filepath for improved error messages.
+   * When provided, errors will be prefixed with the filepath.
+   *
+   * @example
+   * ```ts
+   * // Error message will be: "config.json: Unexpected token } in JSON"
+   * jsonParse('invalid', { filepath: 'config.json' })
+   * ```
+   */
+  filepath?: string | undefined
+  /**
+   * Optional reviver function to transform parsed values.
+   * Called for each key-value pair during parsing.
+   *
+   * @example
+   * ```ts
+   * // Convert ISO date strings to Date objects
+   * const options = {
+   *   reviver: (key, value) => {
+   *     if (typeof value === 'string' && /^\d{4}-\d{2}-\d{2}/.test(value)) {
+   *       return new Date(value)
+   *     }
+   *     return value
+   *   }
+   * }
+   * ```
+   */
   reviver?: JsonReviver | undefined
-  throws?: boolean
+  /**
+   * Whether to throw on parse errors.
+   * When `false`, returns `undefined` instead of throwing.
+   *
+   * @default true
+   *
+   * @example
+   * ```ts
+   * // Throws error
+   * jsonParse('invalid', { throws: true })
+   *
+   * // Returns undefined
+   * const result = jsonParse('invalid', { throws: false })
+   * ```
+   */
+  throws?: boolean | undefined
 }
 
 // IMPORTANT: Do not use destructuring here - use direct assignment instead.
@@ -31,6 +139,17 @@ const JSONParse = JSON.parse
 
 /**
  * Check if a value is a Buffer instance.
+ * Uses duck-typing to detect Buffer without requiring Node.js Buffer in type system.
+ *
+ * @param x - Value to check
+ * @returns `true` if value is a Buffer, `false` otherwise
+ *
+ * @example
+ * ```ts
+ * isBuffer(Buffer.from('hello')) // => true
+ * isBuffer('hello') // => false
+ * isBuffer({ length: 5 }) // => false
+ * ```
  */
 /*@__NO_SIDE_EFFECTS__*/
 function isBuffer(x: unknown): x is Buffer {
@@ -59,7 +178,22 @@ function isBuffer(x: unknown): x is Buffer {
 }
 
 /**
- * Check if a value is a JSON primitive (null, boolean, number, or string).
+ * Check if a value is a JSON primitive type.
+ * JSON primitives are: `null`, `boolean`, `number`, or `string`.
+ *
+ * @param value - Value to check
+ * @returns `true` if value is a JSON primitive, `false` otherwise
+ *
+ * @example
+ * ```ts
+ * isJsonPrimitive(null) // => true
+ * isJsonPrimitive(true) // => true
+ * isJsonPrimitive(42) // => true
+ * isJsonPrimitive('hello') // => true
+ * isJsonPrimitive({}) // => false
+ * isJsonPrimitive([]) // => false
+ * isJsonPrimitive(undefined) // => false
+ * ```
  */
 /*@__NO_SIDE_EFFECTS__*/
 export function isJsonPrimitive(value: unknown): value is JsonPrimitive {
@@ -72,7 +206,57 @@ export function isJsonPrimitive(value: unknown): value is JsonPrimitive {
 }
 
 /**
- * Parse JSON content with error handling and BOM stripping.
+ * Parse JSON content with automatic Buffer handling and BOM stripping.
+ * Provides safer JSON parsing with helpful error messages and optional error suppression.
+ *
+ * Features:
+ * - Automatic UTF-8 Buffer conversion
+ * - BOM (Byte Order Mark) stripping for cross-platform compatibility
+ * - Enhanced error messages with filepath context
+ * - Optional error suppression (returns `undefined` instead of throwing)
+ * - Optional reviver for transforming parsed values
+ *
+ * @param content - JSON string or Buffer to parse
+ * @param options - Optional parsing configuration
+ * @returns Parsed JSON value, or `undefined` if parsing fails and `throws` is `false`
+ *
+ * @throws {SyntaxError} When JSON is invalid and `throws` is `true` (default)
+ *
+ * @example
+ * ```ts
+ * // Basic usage
+ * const data = jsonParse('{"name":"example"}')
+ * console.log(data.name) // => 'example'
+ *
+ * // Parse Buffer with UTF-8 BOM
+ * const buffer = Buffer.from('\uFEFF{"value":42}')
+ * const data = jsonParse(buffer)
+ * console.log(data.value) // => 42
+ *
+ * // Enhanced error messages with filepath
+ * try {
+ *   jsonParse('invalid', { filepath: 'config.json' })
+ * } catch (err) {
+ *   console.error(err.message)
+ *   // => "config.json: Unexpected token i in JSON at position 0"
+ * }
+ *
+ * // Suppress errors
+ * const result = jsonParse('invalid', { throws: false })
+ * console.log(result) // => undefined
+ *
+ * // Transform values with reviver
+ * const json = '{"created":"2024-01-15T10:30:00Z"}'
+ * const data = jsonParse(json, {
+ *   reviver: (key, value) => {
+ *     if (key === 'created' && typeof value === 'string') {
+ *       return new Date(value)
+ *     }
+ *     return value
+ *   }
+ * })
+ * console.log(data.created instanceof Date) // => true
+ * ```
  */
 /*@__NO_SIDE_EFFECTS__*/
 export function jsonParse(
diff --git a/src/lifecycle-script-names.ts b/src/lifecycle-script-names.ts
new file mode 100644
index 0000000..47b6127
--- /dev/null
+++ b/src/lifecycle-script-names.ts
@@ -0,0 +1,25 @@
+/**
+ * @fileoverview NPM lifecycle script names.
+ *
+ * Standard npm lifecycle hooks that can be defined in package.json scripts.
+ * https://docs.npmjs.com/cli/v10/using-npm/scripts#life-cycle-scripts
+ */
+
+const lifecycleScriptNames = new Set(
+  [
+    'dependencies',
+    'prepublishOnly',
+    ...[
+      'install',
+      'pack',
+      'prepare',
+      'publish',
+      'restart',
+      'start',
+      'stop',
+      'version',
+    ].map(n => [`pre${n}`, n, `post${n}`]),
+  ].flat(),
+)
+
+export { lifecycleScriptNames }
diff --git a/src/links/index.ts b/src/links/index.ts
new file mode 100644
index 0000000..1dc4909
--- /dev/null
+++ b/src/links/index.ts
@@ -0,0 +1,113 @@
+/**
+ * @fileoverview Themed hyperlink utilities for terminal output.
+ * Provides colored hyperlinks using theme configuration.
+ */
+
+import type { ColorName } from '../colors'
+import yoctocolorsCjs from '../external/yoctocolors-cjs'
+import { getTheme } from '../themes/context'
+import { THEMES } from '../themes/themes'
+import { resolveColor } from '../themes/utils'
+import type { Theme } from '../themes/types'
+import type { ThemeName } from '../themes/themes'
+
+/**
+ * Options for creating themed links.
+ */
+export type LinkOptions = {
+  /** Theme to use (overrides global) */
+  theme?: Theme | ThemeName | undefined
+  /** Show URL as fallback if terminal doesn't support links */
+  fallback?: boolean | undefined
+}
+
+/**
+ * Create a themed hyperlink for terminal output.
+ * The link text is colored using the theme's link color.
+ *
+ * Note: Most terminals support ANSI color codes but not clickable links.
+ * This function colors the text but does not create clickable hyperlinks.
+ * For clickable links, use a library like 'terminal-link' separately.
+ *
+ * @param text - Link text to display
+ * @param url - URL (included in fallback mode)
+ * @param options - Link configuration options
+ * @returns Colored link text
+ *
+ * @example
+ * ```ts
+ * import { link } from '@socketsecurity/lib/links'
+ *
+ * // Use current theme
+ * console.log(link('Documentation', 'https://socket.dev'))
+ *
+ * // Override theme
+ * console.log(link('API Docs', 'https://api.socket.dev', {
+ *   theme: 'coana'
+ * }))
+ *
+ * // Show URL as fallback
+ * console.log(link('GitHub', 'https://github.com', {
+ *   fallback: true
+ * }))
+ * // Output: "GitHub (https://github.com)"
+ * ```
+ */
+export function link(text: string, url: string, options?: LinkOptions): string {
+  const opts = { __proto__: null, fallback: false, ...options } as LinkOptions
+
+  // Resolve theme
+  const theme =
+    typeof opts.theme === 'string'
+      ? THEMES[opts.theme]
+      : (opts.theme ?? getTheme())
+
+  // Resolve link color
+  const linkColor = resolveColor(theme.colors.link, theme.colors)
+
+  // Apply color - for now just use cyan as a simple fallback
+  // Note: RGB color support to be added in yoctocolors wrapper
+  const colors = yoctocolorsCjs
+  let colored: string
+  if (typeof linkColor === 'string' && linkColor !== 'inherit') {
+    // Use named color method if available
+    const colorMethod = colors[linkColor as ColorName]
+    colored = colorMethod ? colorMethod(text) : colors.cyan(text)
+  } else if (Array.isArray(linkColor)) {
+    // RGB color - for now fallback to cyan
+    // Note: RGB color support to be implemented
+    colored = colors.cyan(text)
+  } else {
+    colored = colors.cyan(text)
+  }
+
+  // Return with or without URL fallback
+  return opts.fallback ? `${colored} (${url})` : colored
+}
+
+/**
+ * Create multiple themed links from an array of link specifications.
+ *
+ * @param links - Array of [text, url] pairs
+ * @param options - Link configuration options
+ * @returns Array of colored link texts
+ *
+ * @example
+ * ```ts
+ * import { links } from '@socketsecurity/lib/links'
+ *
+ * const formatted = links([
+ *   ['Documentation', 'https://socket.dev'],
+ *   ['API Reference', 'https://api.socket.dev'],
+ *   ['GitHub', 'https://github.com/SocketDev']
+ * ])
+ *
+ * formatted.forEach(link => console.log(link))
+ * ```
+ */
+export function links(
+  linkSpecs: Array<[text: string, url: string]>,
+  options?: LinkOptions,
+): string[] {
+  return linkSpecs.map(([text, url]) => link(text, url, options))
+}
diff --git a/src/logger.ts b/src/logger.ts
index d049e79..e238abf 100644
--- a/src/logger.ts
+++ b/src/logger.ts
@@ -5,27 +5,78 @@
 
 import isUnicodeSupported from './external/@socketregistry/is-unicode-supported'
 import yoctocolorsCjs from './external/yoctocolors-cjs'
-import { objectAssign, objectFreeze } from './objects'
 import { applyLinePrefix, isBlankString } from './strings'
+import type { ColorValue } from './colors'
+import { getTheme, onThemeChange } from './themes/context'
+import { THEMES } from './themes/themes'
 
-// Type definitions
+/**
+ * Log symbols for terminal output with colored indicators.
+ *
+ * Each symbol provides visual feedback for different message types, with
+ * Unicode and ASCII fallback support.
+ *
+ * @example
+ * ```typescript
+ * import { LOG_SYMBOLS } from '@socketsecurity/lib'
+ *
+ * console.log(`${LOG_SYMBOLS.success} Operation completed`)
+ * console.log(`${LOG_SYMBOLS.fail} Operation failed`)
+ * console.log(`${LOG_SYMBOLS.warn} Warning message`)
+ * console.log(`${LOG_SYMBOLS.info} Information message`)
+ * console.log(`${LOG_SYMBOLS.step} Processing step`)
+ * console.log(`${LOG_SYMBOLS.reason} Working through logic`)
+ * ```
+ */
 type LogSymbols = {
+  /** Red colored failure symbol (✖ or × in ASCII) */
   fail: string
+  /** Blue colored information symbol (ℹ or i in ASCII) */
   info: string
+  /** Dimmed yellow reasoning/working symbol (∴ or :. in ASCII) */
+  reason: string
+  /** Cyan colored step symbol (→ or > in ASCII) */
+  step: string
+  /** Green colored success symbol (✔ or √ in ASCII) */
   success: string
+  /** Yellow colored warning symbol (⚠ or ‼ in ASCII) */
   warn: string
 }
 
+/**
+ * Type definition for logger methods that mirror console methods.
+ *
+ * All methods return the logger instance for method chaining.
+ */
 type LoggerMethods = {
   [K in keyof typeof console]: (typeof console)[K] extends (
     ...args: infer A
-    // biome-ignore lint/suspicious/noExplicitAny: Console method return types are dynamic.
   ) => any
     ? (...args: A) => Logger
     : (typeof console)[K]
 }
 
+/**
+ * A task that can be executed with automatic start/complete logging.
+ *
+ * @example
+ * ```typescript
+ * const task = logger.createTask('Database migration')
+ * task.run(() => {
+ *   // Migration logic here
+ * })
+ * // Logs: "Starting task: Database migration"
+ * // Logs: "Completed task: Database migration"
+ * ```
+ */
 interface Task {
+  /**
+   * Executes the task function with automatic logging.
+   *
+   * @template T - The return type of the task function
+   * @param f - The function to execute
+   * @returns The result of the task function
+   */
   run<T>(f: () => T): T
 }
 
@@ -53,7 +104,6 @@ function constructConsole(...args: unknown[]) {
     _Console = nodeConsole.Console
   }
   return ReflectConstruct(
-    // biome-ignore lint/style/noNonNullAssertion: Initialized above.
     _Console! as new (
       ...args: unknown[]
     ) => Console, // eslint-disable-line no-undef
@@ -70,30 +120,109 @@ function getYoctocolors() {
   return yoctocolorsCjs
 }
 
+/**
+ * Apply a color to text using yoctocolors.
+ * Handles both named colors and RGB tuples.
+ * @private
+ */
+/*@__NO_SIDE_EFFECTS__*/
+function applyColor(
+  text: string,
+  color: ColorValue,
+  colors: typeof yoctocolorsCjs,
+): string {
+  if (typeof color === 'string') {
+    // Named color like 'green', 'red', etc.
+    return (colors as any)[color](text)
+  }
+  // RGB tuple [r, g, b] - manually construct ANSI escape codes.
+  // yoctocolors-cjs doesn't have an rgb() method, so we build it ourselves.
+  const { 0: r, 1: g, 2: b } = color
+  return `\u001B[38;2;${r};${g};${b}m${text}\u001B[39m`
+}
+
+/**
+ * Log symbols for terminal output with colored indicators.
+ *
+ * Provides colored Unicode symbols (✖, ℹ, ∴, →, ✔, ⚠) with ASCII fallbacks (×, i, :., >, √, ‼)
+ * for terminals that don't support Unicode. Symbols are colored according to the active
+ * theme's color palette (error, info, reason, step, success, warning).
+ *
+ * The symbols are lazily initialized on first access and automatically update when the
+ * fallback theme changes (via setTheme()). Note that LOG_SYMBOLS reflect the global
+ * fallback theme, not async-local theme contexts from withTheme().
+ *
+ * @example
+ * ```typescript
+ * import { LOG_SYMBOLS } from '@socketsecurity/lib'
+ *
+ * console.log(`${LOG_SYMBOLS.fail} Build failed`)          // Theme error color ✖
+ * console.log(`${LOG_SYMBOLS.info} Starting process`)      // Theme info color ℹ
+ * console.log(`${LOG_SYMBOLS.reason} Analyzing dependencies`) // Dimmed yellow ∴
+ * console.log(`${LOG_SYMBOLS.step} Processing files`)      // Theme step color →
+ * console.log(`${LOG_SYMBOLS.success} Build completed`)    // Theme success color ✔
+ * console.log(`${LOG_SYMBOLS.warn} Deprecated API used`)   // Theme warning color ⚠
+ * ```
+ */
 export const LOG_SYMBOLS = /*@__PURE__*/ (() => {
   const target: Record<string, string> = {
     __proto__: null,
   } as unknown as Record<string, string>
+
+  let initialized = false
+
   // Mutable handler to simulate a frozen target.
   const handler: ProxyHandler<Record<string, string>> = {
     __proto__: null,
   } as unknown as ProxyHandler<Record<string, string>>
-  const init = () => {
+
+  const updateSymbols = () => {
     const supported = isUnicodeSupported()
     const colors = getYoctocolors()
-    objectAssign(target, {
-      fail: colors.red(supported ? '✖' : '×'),
-      info: colors.blue(supported ? 'ℹ' : 'i'),
-      success: colors.green(supported ? '✔' : '√'),
-      warn: colors.yellow(supported ? '⚠' : '‼'),
-    })
-    objectFreeze(target)
+    const theme = getTheme()
+
+    // Get colors from theme
+    const successColor = theme.colors.success
+    const errorColor = theme.colors.error
+    const warningColor = theme.colors.warning
+    const infoColor = theme.colors.info
+    const stepColor = theme.colors.step
+
+    // Update symbol values
+    target.fail = applyColor(supported ? '✖' : '×', errorColor, colors)
+    target.info = applyColor(supported ? 'ℹ' : 'i', infoColor, colors)
+    target.reason = colors.dim(
+      applyColor(supported ? '∴' : ':.', warningColor, colors),
+    )
+    target.step = applyColor(supported ? '→' : '>', stepColor, colors)
+    target.success = applyColor(supported ? '✔' : '√', successColor, colors)
+    target.warn = applyColor(supported ? '⚠' : '‼', warningColor, colors)
+  }
+
+  const init = () => {
+    if (initialized) {
+      return
+    }
+
+    updateSymbols()
+    initialized = true
+
     // The handler of a Proxy is mutable after proxy instantiation.
-    // We delete the traps to defer to native behavior.
+    // We delete the traps to defer to native behavior for better performance.
     for (const trapName in handler) {
       delete handler[trapName as keyof ProxyHandler<Record<string, string>>]
     }
   }
+
+  const reset = () => {
+    if (!initialized) {
+      return
+    }
+
+    // Update symbols with new theme colors
+    updateSymbols()
+  }
+
   for (const trapName of Reflect.ownKeys(Reflect)) {
     const fn = (Reflect as Record<PropertyKey, unknown>)[trapName]
     if (typeof fn === 'function') {
@@ -105,6 +234,12 @@ export const LOG_SYMBOLS = /*@__PURE__*/ (() => {
       }
     }
   }
+
+  // Listen for theme changes and reset symbols
+  onThemeChange(() => {
+    reset()
+  })
+
   return new Proxy(target, handler)
 })()
 
@@ -138,9 +273,7 @@ const boundConsoleEntries = [
   'trace',
   'warn',
 ]
-  // biome-ignore lint/suspicious/noExplicitAny: Dynamic console method access.
   .filter(n => typeof (globalConsole as any)[n] === 'function')
-  // biome-ignore lint/suspicious/noExplicitAny: Dynamic console method access.
   .map(n => [n, (globalConsole as any)[n].bind(globalConsole)])
 
 const consolePropAttributes = {
@@ -150,22 +283,143 @@ const consolePropAttributes = {
   configurable: true,
 }
 const maxIndentation = 1000
+
+/**
+ * WeakMap storing the Console instance for each Logger.
+ *
+ * Console creation is lazy - deferred until first logging method call.
+ * This allows logger to be imported during early Node.js bootstrap before
+ * stdout is ready, avoiding ERR_CONSOLE_WRITABLE_STREAM errors.
+ */
 const privateConsole = new WeakMap()
 
-const consoleSymbols = Object.getOwnPropertySymbols(globalConsole)
+/**
+ * WeakMap storing constructor arguments for lazy Console initialization.
+ *
+ * WeakMap is required instead of a private field (#constructorArgs) because:
+ * 1. Private fields can't be accessed from dynamically created functions
+ * 2. Logger adds console methods dynamically to its prototype (lines 1560+)
+ * 3. These dynamic methods need constructor args for lazy initialization
+ * 4. WeakMap allows both regular methods and dynamic functions to access args
+ *
+ * The args are deleted from the WeakMap after Console is created (memory cleanup).
+ */
+const privateConstructorArgs = new WeakMap()
+
+/**
+ * Lazily get console symbols on first access.
+ *
+ * Deferred to avoid accessing global console during early Node.js bootstrap
+ * before stdout is ready.
+ * @private
+ */
+let _consoleSymbols: symbol[] | undefined
+function getConsoleSymbols(): symbol[] {
+  if (_consoleSymbols === undefined) {
+    _consoleSymbols = Object.getOwnPropertySymbols(globalConsole)
+  }
+  return _consoleSymbols
+}
+
+/**
+ * Symbol for incrementing the internal log call counter.
+ *
+ * This is an internal symbol used to track the number of times logging
+ * methods have been called on a logger instance.
+ */
 export const incLogCallCountSymbol = Symbol.for('logger.logCallCount++')
-const kGroupIndentationWidthSymbol =
-  // biome-ignore lint/suspicious/noExplicitAny: Symbol property access.
-  consoleSymbols.find(s => (s as any).label === 'kGroupIndentWidth') ??
-  Symbol('kGroupIndentWidth')
+
+/**
+ * Lazily get kGroupIndentationWidth symbol on first access.
+ * @private
+ */
+let _kGroupIndentationWidthSymbol: symbol | undefined
+function getKGroupIndentationWidthSymbol(): symbol {
+  if (_kGroupIndentationWidthSymbol === undefined) {
+    _kGroupIndentationWidthSymbol =
+      getConsoleSymbols().find(s => (s as any).label === 'kGroupIndentWidth') ??
+      Symbol('kGroupIndentWidth')
+  }
+  return _kGroupIndentationWidthSymbol
+}
+
+/**
+ * Symbol for tracking whether the last logged line was blank.
+ *
+ * This is used internally to prevent multiple consecutive blank lines
+ * and to determine whether to add spacing before certain messages.
+ */
 export const lastWasBlankSymbol = Symbol.for('logger.lastWasBlank')
 
 /**
- * Custom Logger class that wraps console with additional features.
- * Supports indentation, symbols, and blank line tracking.
+ * Enhanced console logger with indentation, colored symbols, and stream management.
+ *
+ * Provides a fluent API for logging with automatic indentation tracking, colored
+ * status symbols, separate stderr/stdout management, and method chaining. All
+ * methods return `this` for easy chaining.
+ *
+ * Features:
+ * - Automatic line prefixing with indentation
+ * - Colored status symbols (success, fail, warn, info)
+ * - Separate indentation tracking for stderr and stdout
+ * - Stream-bound logger instances via `.stderr` and `.stdout`
+ * - Group/indentation management
+ * - Progress indicators with clearable lines
+ * - Task execution with automatic logging
+ *
+ * @example
+ * ```typescript
+ * import { logger } from '@socketsecurity/lib'
+ *
+ * // Basic logging with symbols
+ * logger.success('Build completed')
+ * logger.fail('Build failed')
+ * logger.warn('Deprecated API')
+ * logger.info('Starting process')
+ *
+ * // Indentation and grouping
+ * logger.log('Processing files:')
+ * logger.indent()
+ * logger.log('file1.js')
+ * logger.log('file2.js')
+ * logger.dedent()
+ *
+ * // Method chaining
+ * logger
+ *   .log('Step 1')
+ *   .indent()
+ *   .log('Substep 1.1')
+ *   .log('Substep 1.2')
+ *   .dedent()
+ *   .log('Step 2')
+ *
+ * // Stream-specific logging
+ * logger.stdout.log('Normal output')
+ * logger.stderr.error('Error message')
+ *
+ * // Progress indicators
+ * logger.progress('Processing...')
+ * // ... do work ...
+ * logger.clearLine()
+ * logger.success('Done')
+ *
+ * // Task execution
+ * const task = logger.createTask('Migration')
+ * task.run(() => {
+ *   // Migration logic
+ * })
+ * ```
  */
 /*@__PURE__*/
 export class Logger {
+  /**
+   * Static reference to log symbols for convenience.
+   *
+   * @example
+   * ```typescript
+   * console.log(`${Logger.LOG_SYMBOLS.success} Done`)
+   * ```
+   */
   static LOG_SYMBOLS = LOG_SYMBOLS
 
   #parent?: Logger
@@ -174,69 +428,148 @@ export class Logger {
   #stdoutLogger?: Logger
   #stderrIndention = ''
   #stdoutIndention = ''
-  #lastWasBlank = false
+  #stderrLastWasBlank = false
+  #stdoutLastWasBlank = false
   #logCallCount = 0
-  #constructorArgs: unknown[]
   #options: Record<string, unknown>
+  #originalStdout?: any
+  #theme?: import('./themes/types').Theme
 
+  /**
+   * Creates a new Logger instance.
+   *
+   * When called without arguments, creates a logger using the default
+   * `process.stdout` and `process.stderr` streams. Can accept custom
+   * console constructor arguments for advanced use cases.
+   *
+   * @param args - Optional console constructor arguments
+   *
+   * @example
+   * ```typescript
+   * // Default logger
+   * const logger = new Logger()
+   *
+   * // Custom streams (advanced)
+   * const customLogger = new Logger({
+   *   stdout: customWritableStream,
+   *   stderr: customErrorStream
+   * })
+   * ```
+   */
   constructor(...args: unknown[]) {
-    // Store constructor args for child loggers
-    this.#constructorArgs = args
+    // Store constructor args for lazy Console initialization.
+    privateConstructorArgs.set(this, args)
 
     // Store options if provided (for future extensibility)
     const options = args['0']
     if (typeof options === 'object' && options !== null) {
       this.#options = { __proto__: null, ...options }
+      // Store reference to original stdout stream to bypass Console formatting
+      this.#originalStdout = (options as any).stdout
+
+      // Handle theme option
+      const themeOption = (options as any).theme
+      if (themeOption) {
+        if (typeof themeOption === 'string') {
+          // Theme name - resolve to Theme object
+          this.#theme = THEMES[themeOption]
+        } else {
+          // Theme object
+          this.#theme = themeOption
+        }
+      }
     } else {
       this.#options = { __proto__: null }
     }
 
-    if (args.length) {
-      privateConsole.set(this, constructConsole(...args))
-    } else {
-      // Create a new console that acts like the builtin one so that it will
-      // work with Node's --frozen-intrinsics flag.
-      const con = constructConsole({
-        stdout: process.stdout,
-        stderr: process.stderr,
-      }) as typeof console & Record<string, unknown>
-      for (const { 0: key, 1: method } of boundConsoleEntries) {
-        con[key] = method
+    // Note: Console initialization is now lazy (happens on first use).
+    // This allows logger to be imported during early bootstrap before
+    // stdout is ready, avoiding ERR_CONSOLE_WRITABLE_STREAM errors.
+  }
+
+  /**
+   * Apply a console method with indentation.
+   * @private
+   */
+  #apply(
+    methodName: string,
+    args: unknown[],
+    stream?: 'stderr' | 'stdout',
+  ): this {
+    const con = this.#getConsole()
+    const text = args.at(0)
+    const hasText = typeof text === 'string'
+    // Determine which stream this method writes to
+    const targetStream = stream || (methodName === 'log' ? 'stdout' : 'stderr')
+    const indent = this.#getIndent(targetStream)
+    const logArgs = hasText
+      ? [applyLinePrefix(text, { prefix: indent }), ...args.slice(1)]
+      : args
+    ReflectApply(
+      con[methodName] as (...args: unknown[]) => unknown,
+      con,
+      logArgs,
+    )
+    this[lastWasBlankSymbol](hasText && isBlankString(logArgs[0]), targetStream)
+    ;(this as any)[incLogCallCountSymbol]()
+    return this
+  }
+
+  /**
+   * Get the Console instance for this logger, creating it lazily on first access.
+   *
+   * This lazy initialization allows the logger to be imported during early
+   * Node.js bootstrap before stdout is ready, avoiding Console initialization
+   * errors (ERR_CONSOLE_WRITABLE_STREAM).
+   *
+   * @private
+   */
+  #getConsole(): typeof console & Record<string, unknown> {
+    // Ensure prototype is initialized before creating Console.
+    ensurePrototypeInitialized()
+
+    let con = privateConsole.get(this)
+    if (!con) {
+      // Lazy initialization - create Console on first use.
+      const ctorArgs = privateConstructorArgs.get(this) ?? []
+      if (ctorArgs.length) {
+        con = constructConsole(...ctorArgs)
+      } else {
+        // Create a new console that acts like the builtin one so that it will
+        // work with Node's --frozen-intrinsics flag.
+        con = constructConsole({
+          stdout: process.stdout,
+          stderr: process.stderr,
+        }) as typeof console & Record<string, unknown>
+        for (const { 0: key, 1: method } of boundConsoleEntries) {
+          con[key] = method
+        }
       }
       privateConsole.set(this, con)
+      // Clean up constructor args - no longer needed after Console creation.
+      privateConstructorArgs.delete(this)
     }
+    return con
   }
 
   /**
-   * Get a logger instance bound to stderr.
-   * All operations on this instance will use stderr.
+   * Get indentation for a specific stream.
+   * @private
    */
-  get stderr(): Logger {
-    if (!this.#stderrLogger) {
-      // Pass parent's constructor args to maintain config
-      const instance = new Logger(...this.#constructorArgs)
-      instance.#parent = this
-      instance.#boundStream = 'stderr'
-      instance.#options = { __proto__: null, ...this.#options }
-      this.#stderrLogger = instance
-    }
-    return this.#stderrLogger
+  #getIndent(stream: 'stderr' | 'stdout'): string {
+    const root = this.#getRoot()
+    return stream === 'stderr' ? root.#stderrIndention : root.#stdoutIndention
   }
 
   /**
-   * Get a logger instance bound to stdout.
-   * All operations on this instance will use stdout.
+   * Get lastWasBlank state for a specific stream.
+   * @private
    */
-  get stdout(): Logger {
-    if (!this.#stdoutLogger) {
-      // Pass parent's constructor args to maintain config
-      const instance = new Logger(...this.#constructorArgs)
-      instance.#parent = this
-      instance.#boundStream = 'stdout'
-      instance.#options = { __proto__: null, ...this.#options }
-      this.#stdoutLogger = instance
-    }
-    return this.#stdoutLogger
+  #getLastWasBlank(stream: 'stderr' | 'stdout'): boolean {
+    const root = this.#getRoot()
+    return stream === 'stderr'
+      ? root.#stderrLastWasBlank
+      : root.#stdoutLastWasBlank
   }
 
   /**
@@ -248,12 +581,42 @@ export class Logger {
   }
 
   /**
-   * Get indentation for a specific stream.
+   * Get logger-specific symbols using the resolved theme.
    * @private
    */
-  #getIndent(stream: 'stderr' | 'stdout'): string {
-    const root = this.#getRoot()
-    return stream === 'stderr' ? root.#stderrIndention : root.#stdoutIndention
+  #getSymbols(): LogSymbols {
+    const theme = this.#getTheme()
+    const supported = isUnicodeSupported()
+    const colors = getYoctocolors()
+
+    return {
+      __proto__: null,
+      fail: applyColor(supported ? '✖' : '×', theme.colors.error, colors),
+      info: applyColor(supported ? 'ℹ' : 'i', theme.colors.info, colors),
+      reason: colors.dim(
+        applyColor(supported ? '∴' : ':.', theme.colors.warning, colors),
+      ),
+      step: applyColor(supported ? '→' : '>', theme.colors.step, colors),
+      success: applyColor(supported ? '✔' : '√', theme.colors.success, colors),
+      warn: applyColor(supported ? '⚠' : '‼', theme.colors.warning, colors),
+    } as LogSymbols
+  }
+
+  /**
+   * Get the target stream for this logger instance.
+   * @private
+   */
+  #getTargetStream(): 'stderr' | 'stdout' {
+    return this.#boundStream || 'stderr'
+  }
+
+  /**
+   * Get the resolved theme for this logger instance.
+   * Returns instance theme if set, otherwise falls back to context theme.
+   * @private
+   */
+  #getTheme(): import('./themes/types').Theme {
+    return this.#theme ?? getTheme()
   }
 
   /**
@@ -270,41 +633,16 @@ export class Logger {
   }
 
   /**
-   * Get the target stream for this logger instance.
-   * @private
-   */
-  #getTargetStream(): 'stderr' | 'stdout' {
-    return this.#boundStream || 'stderr'
-  }
-
-  /**
-   * Apply a console method with indentation.
+   * Set lastWasBlank state for a specific stream.
    * @private
    */
-  #apply(
-    methodName: string,
-    args: unknown[],
-    stream?: 'stderr' | 'stdout',
-  ): this {
-    const con = privateConsole.get(this) as typeof console &
-      Record<string, unknown>
-    const text = args.at(0)
-    const hasText = typeof text === 'string'
-    // Determine which stream this method writes to
-    const targetStream = stream || (methodName === 'log' ? 'stdout' : 'stderr')
-    const indent = this.#getIndent(targetStream)
-    const logArgs = hasText
-      ? [applyLinePrefix(text, { prefix: indent }), ...args.slice(1)]
-      : args
-    ReflectApply(
-      con[methodName] as (...args: unknown[]) => unknown,
-      con,
-      logArgs,
-    )
-    this[lastWasBlankSymbol](hasText && isBlankString(logArgs[0]))
-    // biome-ignore lint/suspicious/noExplicitAny: Symbol method access.
-    ;(this as any)[incLogCallCountSymbol]()
-    return this
+  #setLastWasBlank(stream: 'stderr' | 'stdout', value: boolean): void {
+    const root = this.#getRoot()
+    if (stream === 'stderr') {
+      root.#stderrLastWasBlank = value
+    } else {
+      root.#stdoutLastWasBlank = value
+    }
   }
 
   /**
@@ -313,10 +651,11 @@ export class Logger {
    */
   #stripSymbols(text: string): string {
     // Strip both unicode and emoji forms of log symbols from the start.
-    // Matches: ✖, ✗, ×, ✖️, ⚠, ‼, ⚠️, ✔, ✓, √, ✔️, ✓️, ℹ, ℹ️
+    // Matches Unicode: ✖, ✗, ×, ✖️, ⚠, ‼, ⚠️, ✔, ✓, √, ✔️, ✓️, ℹ, ℹ️, →, ∴
+    // Matches ASCII fallbacks: ×, ‼, √, i, >, :.
     // Also handles variation selectors (U+FE0F) and whitespace after symbol.
-    // Note: We don't strip standalone 'i' to avoid breaking words like 'info'.
-    return text.replace(/^[✖✗×⚠‼✔✓√ℹ]\uFE0F?\s*/u, '')
+    // Note: We don't strip standalone 'i' or '>' to avoid breaking words, but we do strip ':.' as it's unambiguous.
+    return text.replace(/^(?:[✖✗×⚠‼✔✓√ℹ→∴]|:.)[\uFE0F\s]*/u, '')
   }
 
   /**
@@ -324,7 +663,7 @@ export class Logger {
    * @private
    */
   #symbolApply(symbolType: string, args: unknown[]): this {
-    const con = privateConsole.get(this)
+    const con = this.#getConsole()
     let text = args.at(0)
     // biome-ignore lint/suspicious/noImplicitAnyLet: Flexible argument handling.
     let extras
@@ -337,54 +676,238 @@ export class Logger {
     }
     // Note: Meta status messages (info/fail/etc) always go to stderr.
     const indent = this.#getIndent('stderr')
+    const symbols = this.#getSymbols()
     con.error(
-      applyLinePrefix(`${LOG_SYMBOLS[symbolType]} ${text}`, {
+      applyLinePrefix(`${symbols[symbolType]} ${text}`, {
         prefix: indent,
       }),
       ...extras,
     )
-    this.#lastWasBlank = false
-    // biome-ignore lint/suspicious/noExplicitAny: Symbol method access.
+    this[lastWasBlankSymbol](false, 'stderr')
     ;(this as any)[incLogCallCountSymbol]()
     return this
   }
 
   /**
-   * Get the current log call count.
+   * Gets a logger instance bound exclusively to stderr.
+   *
+   * All logging operations on this instance will write to stderr only.
+   * Indentation is tracked separately from stdout. The instance is
+   * cached and reused on subsequent accesses.
+   *
+   * @returns A logger instance bound to stderr
+   *
+   * @example
+   * ```typescript
+   * // Write errors to stderr
+   * logger.stderr.error('Configuration invalid')
+   * logger.stderr.warn('Using fallback settings')
+   *
+   * // Indent only affects stderr
+   * logger.stderr.indent()
+   * logger.stderr.error('Nested error details')
+   * logger.stderr.dedent()
+   * ```
+   */
+  get stderr(): Logger {
+    if (!this.#stderrLogger) {
+      // Pass parent's constructor args to maintain config.
+      const ctorArgs = privateConstructorArgs.get(this) ?? []
+      const instance = new Logger(...ctorArgs)
+      instance.#parent = this
+      instance.#boundStream = 'stderr'
+      instance.#options = { __proto__: null, ...this.#options }
+      instance.#theme = this.#theme
+      this.#stderrLogger = instance
+    }
+    return this.#stderrLogger
+  }
+
+  /**
+   * Gets a logger instance bound exclusively to stdout.
+   *
+   * All logging operations on this instance will write to stdout only.
+   * Indentation is tracked separately from stderr. The instance is
+   * cached and reused on subsequent accesses.
+   *
+   * @returns A logger instance bound to stdout
+   *
+   * @example
+   * ```typescript
+   * // Write normal output to stdout
+   * logger.stdout.log('Processing started')
+   * logger.stdout.log('Items processed: 42')
+   *
+   * // Indent only affects stdout
+   * logger.stdout.indent()
+   * logger.stdout.log('Detailed output')
+   * logger.stdout.dedent()
+   * ```
+   */
+  get stdout(): Logger {
+    if (!this.#stdoutLogger) {
+      // Pass parent's constructor args to maintain config.
+      const ctorArgs = privateConstructorArgs.get(this) ?? []
+      const instance = new Logger(...ctorArgs)
+      instance.#parent = this
+      instance.#boundStream = 'stdout'
+      instance.#options = { __proto__: null, ...this.#options }
+      instance.#theme = this.#theme
+      this.#stdoutLogger = instance
+    }
+    return this.#stdoutLogger
+  }
+
+  /**
+   * Gets the total number of log calls made on this logger instance.
+   *
+   * Tracks all logging method calls including `log()`, `error()`, `warn()`,
+   * `success()`, `fail()`, etc. Useful for testing and monitoring logging activity.
+   *
+   * @returns The number of times logging methods have been called
+   *
+   * @example
+   * ```typescript
+   * logger.log('Message 1')
+   * logger.error('Message 2')
+   * console.log(logger.logCallCount) // 2
+   * ```
    */
   get logCallCount() {
-    return this.#logCallCount
+    const root = this.#getRoot()
+    return root.#logCallCount
   }
 
   /**
-   * Increment the log call count.
+   * Increments the internal log call counter.
+   *
+   * This is called automatically by logging methods and should not
+   * be called directly in normal usage.
+   *
+   * @returns The logger instance for chaining
    */
   [incLogCallCountSymbol]() {
-    this.#logCallCount += 1
+    const root = this.#getRoot()
+    root.#logCallCount += 1
     return this
   }
 
   /**
-   * Set whether the last logged line was blank.
+   * Sets whether the last logged line was blank.
+   *
+   * Used internally to track blank lines and prevent duplicate spacing.
+   * This is called automatically by logging methods.
+   *
+   * @param value - Whether the last line was blank
+   * @param stream - Optional stream to update (defaults to both streams if not bound, or target stream if bound)
+   * @returns The logger instance for chaining
    */
-  [lastWasBlankSymbol](value: unknown): this {
-    this.#lastWasBlank = !!value
+  [lastWasBlankSymbol](value: unknown, stream?: 'stderr' | 'stdout'): this {
+    if (stream) {
+      // Explicit stream specified
+      this.#setLastWasBlank(stream, !!value)
+    } else if (this.#boundStream) {
+      // Stream-bound logger - affect only the bound stream
+      this.#setLastWasBlank(this.#boundStream, !!value)
+    } else {
+      // Root logger with no stream specified - affect both streams
+      this.#setLastWasBlank('stderr', !!value)
+      this.#setLastWasBlank('stdout', !!value)
+    }
     return this
   }
 
   /**
-   * Log an assertion.
+   * Logs an assertion failure message if the value is falsy.
+   *
+   * Works like `console.assert()` but returns the logger for chaining.
+   * If the value is truthy, nothing is logged. If falsy, logs an error
+   * message with an assertion failure.
+   *
+   * @param value - The value to test
+   * @param message - Optional message and additional arguments to log
+   * @returns The logger instance for chaining
+   *
+   * @example
+   * ```typescript
+   * logger.assert(true, 'This will not log')
+   * logger.assert(false, 'Assertion failed: value is false')
+   * logger.assert(items.length > 0, 'No items found')
+   * ```
    */
   assert(value: unknown, ...message: unknown[]): this {
-    const con = privateConsole.get(this)
-    con.assert(value, ...message)
+    const con = this.#getConsole()
+    con.assert(value, message[0] as string, ...message.slice(1))
     this[lastWasBlankSymbol](false)
     return value ? this : this[incLogCallCountSymbol]()
   }
 
   /**
-   * Clear the visible terminal screen.
-   * Only available on the main logger instance.
+   * Clears the current line in the terminal.
+   *
+   * Moves the cursor to the beginning of the line and clears all content.
+   * Works in both TTY and non-TTY environments. Useful for clearing
+   * progress indicators created with `progress()`.
+   *
+   * The stream to clear (stderr or stdout) depends on whether the logger
+   * is stream-bound.
+   *
+   * @returns The logger instance for chaining
+   *
+   * @example
+   * ```typescript
+   * logger.progress('Loading...')
+   * // ... do work ...
+   * logger.clearLine()
+   * logger.success('Loaded')
+   *
+   * // Clear multiple progress updates
+   * for (const file of files) {
+   *   logger.progress(`Processing ${file}`)
+   *   processFile(file)
+   *   logger.clearLine()
+   * }
+   * logger.success('All files processed')
+   * ```
+   */
+  clearLine(): this {
+    const con = this.#getConsole()
+    const stream = this.#getTargetStream()
+    const streamObj = (
+      stream === 'stderr' ? con._stderr : con._stdout
+    ) as NodeJS.WriteStream & {
+      isTTY: boolean
+      cursorTo: (x: number) => void
+      clearLine: (dir: number) => void
+      write: (text: string) => boolean
+    }
+    if (streamObj.isTTY) {
+      streamObj.cursorTo(0)
+      streamObj.clearLine(0)
+    } else {
+      streamObj.write('\r\x1b[K')
+    }
+    return this
+  }
+
+  /**
+   * Clears the visible terminal screen.
+   *
+   * Only available on the main logger instance, not on stream-bound instances
+   * (`.stderr` or `.stdout`). Resets the log call count and blank line tracking
+   * if the output is a TTY.
+   *
+   * @returns The logger instance for chaining
+   * @throws {Error} If called on a stream-bound logger instance
+   *
+   * @example
+   * ```typescript
+   * logger.log('Some output')
+   * logger.clearVisible()  // Screen is now clear
+   *
+   * // Error: Can't call on stream-bound instance
+   * logger.stderr.clearVisible()  // throws
+   * ```
    */
   clearVisible() {
     if (this.#boundStream) {
@@ -392,11 +915,9 @@ export class Logger {
         'clearVisible() is only available on the main logger instance, not on stream-bound instances',
       )
     }
-    const con = privateConsole.get(this)
+    const con = this.#getConsole()
     con.clear()
-    // biome-ignore lint/suspicious/noExplicitAny: Internal console property access.
     if ((con as any)._stdout.isTTY) {
-      // biome-ignore lint/suspicious/noExplicitAny: Symbol method access.
       ;(this as any)[lastWasBlankSymbol](true)
       this.#logCallCount = 0
     }
@@ -404,17 +925,50 @@ export class Logger {
   }
 
   /**
-   * Log a count for the given label.
+   * Increments and logs a counter for the given label.
+   *
+   * Each unique label maintains its own counter. Works like `console.count()`.
+   *
+   * @param label - Optional label for the counter
+   * @default 'default'
+   * @returns The logger instance for chaining
+   *
+   * @example
+   * ```typescript
+   * logger.count('requests')  // requests: 1
+   * logger.count('requests')  // requests: 2
+   * logger.count('errors')    // errors: 1
+   * logger.count()            // default: 1
+   * ```
    */
-  count(label?: string): this {
-    const con = privateConsole.get(this)
+  count(label?: string | undefined): this {
+    const con = this.#getConsole()
     con.count(label)
     this[lastWasBlankSymbol](false)
     return this[incLogCallCountSymbol]()
   }
 
   /**
-   * Create a task with a given name.
+   * Creates a task that logs start and completion messages automatically.
+   *
+   * Returns a task object with a `run()` method that executes the provided
+   * function and logs "Starting task: {name}" before execution and
+   * "Completed task: {name}" after completion.
+   *
+   * @param name - The name of the task
+   * @returns A task object with a `run()` method
+   *
+   * @example
+   * ```typescript
+   * const task = logger.createTask('Database Migration')
+   * const result = task.run(() => {
+   *   // Logs: "Starting task: Database Migration"
+   *   migrateDatabase()
+   *   return 'success'
+   *   // Logs: "Completed task: Database Migration"
+   * })
+   * console.log(result)  // 'success'
+   * ```
    */
   createTask(name: string): Task {
     return {
@@ -428,9 +982,33 @@ export class Logger {
   }
 
   /**
-   * Decrease indentation level.
-   * If called on main logger, affects both streams.
-   * If called on stream-bound logger, affects only that stream.
+   * Decreases the indentation level by removing spaces from the prefix.
+   *
+   * When called on the main logger, affects both stderr and stdout indentation.
+   * When called on a stream-bound logger (`.stderr` or `.stdout`), affects
+   * only that stream's indentation.
+   *
+   * @param spaces - Number of spaces to remove from indentation
+   * @default 2
+   * @returns The logger instance for chaining
+   *
+   * @example
+   * ```typescript
+   * logger.indent()
+   * logger.log('Indented')
+   * logger.dedent()
+   * logger.log('Back to normal')
+   *
+   * // Remove custom amount
+   * logger.indent(4)
+   * logger.log('Four spaces')
+   * logger.dedent(4)
+   *
+   * // Stream-specific dedent
+   * logger.stdout.indent()
+   * logger.stdout.log('Indented stdout')
+   * logger.stdout.dedent()
+   * ```
    */
   dedent(spaces = 2) {
     if (this.#boundStream) {
@@ -448,67 +1026,190 @@ export class Logger {
   }
 
   /**
-   * Display an object's properties.
+   * Displays an object's properties in a formatted way.
+   *
+   * Works like `console.dir()` with customizable options for depth,
+   * colors, etc. Useful for inspecting complex objects.
+   *
+   * @param obj - The object to display
+   * @param options - Optional formatting options (Node.js inspect options)
+   * @returns The logger instance for chaining
+   *
+   * @example
+   * ```typescript
+   * const obj = { a: 1, b: { c: 2, d: { e: 3 } } }
+   * logger.dir(obj)
+   * logger.dir(obj, { depth: 1 })  // Limit nesting depth
+   * logger.dir(obj, { colors: true })  // Enable colors
+   * ```
    */
-  dir(obj: unknown, options?: unknown): this {
-    const con = privateConsole.get(this)
+  dir(obj: unknown, options?: unknown | undefined): this {
+    const con = this.#getConsole()
     con.dir(obj, options)
     this[lastWasBlankSymbol](false)
     return this[incLogCallCountSymbol]()
   }
 
   /**
-   * Display data as XML.
+   * Displays data as XML/HTML in a formatted way.
+   *
+   * Works like `console.dirxml()`. In Node.js, behaves the same as `dir()`.
+   *
+   * @param data - The data to display
+   * @returns The logger instance for chaining
+   *
+   * @example
+   * ```typescript
+   * logger.dirxml(document.body)  // In browser environments
+   * logger.dirxml(xmlObject)       // In Node.js
+   * ```
    */
   dirxml(...data: unknown[]): this {
-    const con = privateConsole.get(this)
+    const con = this.#getConsole()
     con.dirxml(data)
     this[lastWasBlankSymbol](false)
     return this[incLogCallCountSymbol]()
   }
 
   /**
-   * Log an error message.
+   * Logs a completion message with a success symbol (alias for `success()`).
+   *
+   * Provides semantic clarity when marking something as "done". Does NOT
+   * automatically clear the current line - call `clearLine()` first if
+   * needed after using `progress()`.
+   *
+   * @param args - Message and additional arguments to log
+   * @returns The logger instance for chaining
+   *
+   * @example
+   * ```typescript
+   * logger.done('Task completed')
+   *
+   * // After progress indicator
+   * logger.progress('Processing...')
+   * // ... do work ...
+   * logger.clearLine()
+   * logger.done('Processing complete')
+   * ```
+   */
+  done(...args: unknown[]): this {
+    return this.#symbolApply('success', args)
+  }
+
+  /**
+   * Logs an error message to stderr.
+   *
+   * Automatically applies current indentation. All arguments are formatted
+   * and logged like `console.error()`.
+   *
+   * @param args - Message and additional arguments to log
+   * @returns The logger instance for chaining
+   *
+   * @example
+   * ```typescript
+   * logger.error('Build failed')
+   * logger.error('Error code:', 500)
+   * logger.error('Details:', { message: 'Not found' })
+   * ```
    */
   error(...args: unknown[]): this {
     return this.#apply('error', args)
   }
 
   /**
-   * Log a newline to stderr if last line wasn't blank.
+   * Logs a newline to stderr only if the last line wasn't already blank.
+   *
+   * Prevents multiple consecutive blank lines. Useful for adding spacing
+   * between sections without creating excessive whitespace.
+   *
+   * @returns The logger instance for chaining
+   *
+   * @example
+   * ```typescript
+   * logger.error('Error message')
+   * logger.errorNewline()  // Adds blank line
+   * logger.errorNewline()  // Does nothing (already blank)
+   * logger.error('Next section')
+   * ```
    */
   errorNewline() {
-    return this.#lastWasBlank ? this : this.error('')
+    return this.#getLastWasBlank('stderr') ? this : this.error('')
   }
 
   /**
-   * Log a failure message with symbol.
+   * Logs a failure message with a red colored fail symbol.
+   *
+   * Automatically prefixes the message with `LOG_SYMBOLS.fail` (red ✖).
+   * Always outputs to stderr. If the message starts with an existing
+   * symbol, it will be stripped and replaced.
+   *
+   * @param args - Message and additional arguments to log
+   * @returns The logger instance for chaining
+   *
+   * @example
+   * ```typescript
+   * logger.fail('Build failed')
+   * logger.fail('Test suite failed:', { passed: 5, failed: 3 })
+   * ```
    */
   fail(...args: unknown[]): this {
     return this.#symbolApply('fail', args)
   }
 
   /**
-   * Start a new log group.
+   * Starts a new indented log group.
+   *
+   * If a label is provided, it's logged before increasing indentation.
+   * Groups can be nested. Each group increases indentation by the
+   * `kGroupIndentWidth` (default 2 spaces). Call `groupEnd()` to close.
+   *
+   * @param label - Optional label to display before the group
+   * @returns The logger instance for chaining
+   *
+   * @example
+   * ```typescript
+   * logger.group('Processing files:')
+   * logger.log('file1.js')
+   * logger.log('file2.js')
+   * logger.groupEnd()
+   *
+   * // Nested groups
+   * logger.group('Outer')
+   * logger.log('Outer content')
+   * logger.group('Inner')
+   * logger.log('Inner content')
+   * logger.groupEnd()
+   * logger.groupEnd()
+   * ```
    */
   group(...label: unknown[]): this {
     const { length } = label
     if (length) {
       ReflectApply(this.log, this, label)
     }
-    // biome-ignore lint/suspicious/noExplicitAny: Symbol property access.
-    this.indent((this as any)[kGroupIndentationWidthSymbol])
+    this.indent((this as any)[getKGroupIndentationWidthSymbol()])
     if (length) {
-      // biome-ignore lint/suspicious/noExplicitAny: Symbol method access.
       ;(this as any)[lastWasBlankSymbol](false)
-      // biome-ignore lint/suspicious/noExplicitAny: Symbol method access.
       ;(this as any)[incLogCallCountSymbol]()
     }
     return this
   }
 
   /**
-   * Start a new collapsed log group (alias for group).
+   * Starts a new collapsed log group (alias for `group()`).
+   *
+   * In browser consoles, this creates a collapsed group. In Node.js,
+   * it behaves identically to `group()`.
+   *
+   * @param label - Optional label to display before the group
+   * @returns The logger instance for chaining
+   *
+   * @example
+   * ```typescript
+   * logger.groupCollapsed('Details')
+   * logger.log('Hidden by default in browsers')
+   * logger.groupEnd()
+   * ```
    */
   // groupCollapsed is an alias of group.
   // https://nodejs.org/api/console.html#consolegroupcollapsed
@@ -517,18 +1218,55 @@ export class Logger {
   }
 
   /**
-   * End the current log group.
+   * Ends the current log group and decreases indentation.
+   *
+   * Must be called once for each `group()` or `groupCollapsed()` call
+   * to properly close the group and restore indentation.
+   *
+   * @returns The logger instance for chaining
+   *
+   * @example
+   * ```typescript
+   * logger.group('Group 1')
+   * logger.log('Content')
+   * logger.groupEnd()  // Closes 'Group 1'
+   * ```
    */
   groupEnd() {
-    // biome-ignore lint/suspicious/noExplicitAny: Symbol property access.
-    this.dedent((this as any)[kGroupIndentationWidthSymbol])
+    this.dedent((this as any)[getKGroupIndentationWidthSymbol()])
     return this
   }
 
   /**
-   * Increase indentation level.
-   * If called on main logger, affects both streams.
-   * If called on stream-bound logger, affects only that stream.
+   * Increases the indentation level by adding spaces to the prefix.
+   *
+   * When called on the main logger, affects both stderr and stdout indentation.
+   * When called on a stream-bound logger (`.stderr` or `.stdout`), affects
+   * only that stream's indentation. Maximum indentation is 1000 spaces.
+   *
+   * @param spaces - Number of spaces to add to indentation
+   * @default 2
+   * @returns The logger instance for chaining
+   *
+   * @example
+   * ```typescript
+   * logger.log('Level 0')
+   * logger.indent()
+   * logger.log('Level 1')
+   * logger.indent()
+   * logger.log('Level 2')
+   * logger.dedent()
+   * logger.dedent()
+   *
+   * // Custom indent amount
+   * logger.indent(4)
+   * logger.log('Indented 4 spaces')
+   * logger.dedent(4)
+   *
+   * // Stream-specific indent
+   * logger.stdout.indent()
+   * logger.stdout.log('Only stdout is indented')
+   * ```
    */
   indent(spaces = 2) {
     const spacesToAdd = ' '.repeat(Math.min(spaces, maxIndentation))
@@ -547,30 +1285,149 @@ export class Logger {
   }
 
   /**
-   * Log an info message with symbol.
+   * Logs an informational message with a blue colored info symbol.
+   *
+   * Automatically prefixes the message with `LOG_SYMBOLS.info` (blue ℹ).
+   * Always outputs to stderr. If the message starts with an existing
+   * symbol, it will be stripped and replaced.
+   *
+   * @param args - Message and additional arguments to log
+   * @returns The logger instance for chaining
+   *
+   * @example
+   * ```typescript
+   * logger.info('Starting build process')
+   * logger.info('Configuration loaded:', config)
+   * logger.info('Using cache directory:', cacheDir)
+   * ```
    */
   info(...args: unknown[]): this {
     return this.#symbolApply('info', args)
   }
 
   /**
-   * Log a message.
+   * Logs a message to stdout.
+   *
+   * Automatically applies current indentation. All arguments are formatted
+   * and logged like `console.log()`. This is the primary method for
+   * standard output.
+   *
+   * @param args - Message and additional arguments to log
+   * @returns The logger instance for chaining
+   *
+   * @example
+   * ```typescript
+   * logger.log('Processing complete')
+   * logger.log('Items processed:', 42)
+   * logger.log('Results:', { success: true, count: 10 })
+   *
+   * // Method chaining
+   * logger.log('Step 1').log('Step 2').log('Step 3')
+   * ```
    */
   log(...args: unknown[]): this {
     return this.#apply('log', args)
   }
 
   /**
-   * Log a newline to stdout if last line wasn't blank.
+   * Logs a newline to stdout only if the last line wasn't already blank.
+   *
+   * Prevents multiple consecutive blank lines. Useful for adding spacing
+   * between sections without creating excessive whitespace.
+   *
+   * @returns The logger instance for chaining
+   *
+   * @example
+   * ```typescript
+   * logger.log('Section 1')
+   * logger.logNewline()  // Adds blank line
+   * logger.logNewline()  // Does nothing (already blank)
+   * logger.log('Section 2')
+   * ```
    */
   logNewline() {
-    return this.#lastWasBlank ? this : this.log('')
+    return this.#getLastWasBlank('stdout') ? this : this.log('')
+  }
+
+  /**
+   * Shows a progress indicator that can be cleared with `clearLine()`.
+   *
+   * Displays a simple status message with a '∴' prefix. Does not include
+   * animation or spinner. Intended to be cleared once the operation completes.
+   * The output stream (stderr or stdout) depends on whether the logger is
+   * stream-bound.
+   *
+   * @param text - The progress message to display
+   * @returns The logger instance for chaining
+   *
+   * @example
+   * ```typescript
+   * logger.progress('Processing files...')
+   * // ... do work ...
+   * logger.clearLine()
+   * logger.success('Files processed')
+   *
+   * // Stream-specific progress
+   * logger.stdout.progress('Loading...')
+   * // ... do work ...
+   * logger.stdout.clearLine()
+   * logger.stdout.log('Done')
+   * ```
+   */
+  progress(text: string): this {
+    const con = this.#getConsole()
+    const stream = this.#getTargetStream()
+    const streamObj = (
+      stream === 'stderr' ? con._stderr : con._stdout
+    ) as NodeJS.WriteStream & { write: (text: string) => boolean }
+    streamObj.write(`∴ ${text}`)
+    this[lastWasBlankSymbol](false)
+    return this
+  }
+
+  /**
+   * Logs a reasoning/working message with a dimmed yellow therefore symbol.
+   *
+   * Automatically prefixes the message with `LOG_SYMBOLS.reason` (dimmed yellow ∴).
+   * Useful for showing intermediate reasoning, logic steps, or "working" output
+   * that leads to a conclusion. Always outputs to stderr. If the message starts
+   * with an existing symbol, it will be stripped and replaced.
+   *
+   * @param args - Message and additional arguments to log
+   * @returns The logger instance for chaining
+   *
+   * @example
+   * ```typescript
+   * logger.step('Analyzing package security')
+   * logger.reason('Found 3 direct dependencies')
+   * logger.reason('Checking 47 transitive dependencies')
+   * logger.reason('Risk score: 8.5/10')
+   * logger.fail('Package blocked due to high risk')
+   * ```
+   */
+  reason(...args: unknown[]): this {
+    return this.#symbolApply('reason', args)
   }
 
   /**
-   * Reset indentation to zero.
-   * If called on main logger, resets both streams.
-   * If called on stream-bound logger, resets only that stream.
+   * Resets all indentation to zero.
+   *
+   * When called on the main logger, resets both stderr and stdout indentation.
+   * When called on a stream-bound logger (`.stderr` or `.stdout`), resets
+   * only that stream's indentation.
+   *
+   * @returns The logger instance for chaining
+   *
+   * @example
+   * ```typescript
+   * logger.indent().indent().indent()
+   * logger.log('Very indented')
+   * logger.resetIndent()
+   * logger.log('Back to zero indentation')
+   *
+   * // Reset only stdout
+   * logger.stdout.resetIndent()
+   * ```
    */
   resetIndent() {
     if (this.#boundStream) {
@@ -585,20 +1442,78 @@ export class Logger {
   }
 
   /**
-   * Log a main step with blank line before (stateless).
+   * Logs a main step message with a cyan arrow symbol and blank line before it.
+   *
+   * Automatically prefixes the message with `LOG_SYMBOLS.step` (cyan →) and
+   * adds a blank line before the message unless the last line was already blank.
+   * Useful for marking major steps in a process with clear visual separation.
+   * Always outputs to stdout. If the message starts with an existing symbol,
+   * it will be stripped and replaced.
+   *
+   * @param msg - The step message to log
+   * @param extras - Additional arguments to log
+   * @returns The logger instance for chaining
+   *
+   * @example
+   * ```typescript
+   * logger.step('Building project')
+   * logger.log('Compiling TypeScript...')
+   * logger.step('Running tests')
+   * logger.log('Running test suite...')
+   * // Output:
+   * // [blank line]
+   * // → Building project
+   * // Compiling TypeScript...
+   * // [blank line]
+   * // → Running tests
+   * // Running test suite...
+   * ```
    */
   step(msg: string, ...extras: unknown[]): this {
     // Add blank line before the step message.
-    if (!this.#lastWasBlank) {
+    if (!this.#getLastWasBlank('stdout')) {
       // Use this.log() to properly track the blank line.
       this.log('')
     }
-    // Let log() handle all tracking.
-    return this.log(msg, ...extras)
+    // Strip existing symbols from the message.
+    const text = this.#stripSymbols(msg)
+    // Note: Step messages always go to stdout (unlike info/fail/etc which go to stderr).
+    const indent = this.#getIndent('stdout')
+    const symbols = this.#getSymbols()
+    const con = this.#getConsole() as typeof console & Record<string, unknown>
+    con.log(
+      applyLinePrefix(`${symbols.step} ${text}`, {
+        prefix: indent,
+      }),
+      ...extras,
+    )
+    this[lastWasBlankSymbol](false, 'stdout')
+    ;(this as any)[incLogCallCountSymbol]()
+    return this
   }
 
   /**
-   * Log an indented substep (stateless).
+   * Logs an indented substep message (stateless).
+   *
+   * Adds a 2-space indent to the message without affecting the logger's
+   * indentation state. Useful for showing sub-items under a main step.
+   *
+   * @param msg - The substep message to log
+   * @param extras - Additional arguments to log
+   * @returns The logger instance for chaining
+   *
+   * @example
+   * ```typescript
+   * logger.log('Installing dependencies:')
+   * logger.substep('Installing react')
+   * logger.substep('Installing typescript')
+   * logger.substep('Installing eslint')
+   * // Output:
+   * // Installing dependencies:
+   * //   Installing react
+   * //   Installing typescript
+   * //   Installing eslint
+   * ```
    */
   substep(msg: string, ...extras: unknown[]): this {
     // Add 2-space indent to the message.
@@ -608,152 +1523,341 @@ export class Logger {
   }
 
   /**
-   * Log a success message with symbol.
+   * Logs a success message with a green colored success symbol.
+   *
+   * Automatically prefixes the message with `LOG_SYMBOLS.success` (green ✔).
+   * Always outputs to stderr. If the message starts with an existing
+   * symbol, it will be stripped and replaced.
+   *
+   * @param args - Message and additional arguments to log
+   * @returns The logger instance for chaining
+   *
+   * @example
+   * ```typescript
+   * logger.success('Build completed')
+   * logger.success('Tests passed:', { total: 42, passed: 42 })
+   * logger.success('Deployment successful')
+   * ```
    */
   success(...args: unknown[]): this {
     return this.#symbolApply('success', args)
   }
 
   /**
-   * Log a done message (alias for success).
-   * Does NOT auto-clear. Call clearLine() first if needed after progress().
+   * Displays data in a table format.
+   *
+   * Works like `console.table()`. Accepts arrays of objects or
+   * objects with nested objects. Optionally specify which properties
+   * to include in the table.
+   *
+   * @param tabularData - The data to display as a table
+   * @param properties - Optional array of property names to include
+   * @returns The logger instance for chaining
+   *
+   * @example
+   * ```typescript
+   * // Array of objects
+   * logger.table([
+   *   { name: 'Alice', age: 30 },
+   *   { name: 'Bob', age: 25 }
+   * ])
+   *
+   * // Specify properties to show
+   * logger.table(users, ['name', 'email'])
+   *
+   * // Object with nested objects
+   * logger.table({
+   *   user1: { name: 'Alice', age: 30 },
+   *   user2: { name: 'Bob', age: 25 }
+   * })
+   * ```
    */
-  done(...args: unknown[]): this {
-    return this.#symbolApply('success', args)
+  table(
+    tabularData: unknown,
+    properties?: readonly string[] | undefined,
+  ): this {
+    const con = this.#getConsole()
+    con.table(tabularData, properties)
+    this[lastWasBlankSymbol](false)
+    return this[incLogCallCountSymbol]()
   }
 
   /**
-   * Display data in a table format.
+   * Starts a timer for measuring elapsed time.
+   *
+   * Creates a timer with the given label. Use `timeEnd()` with the same
+   * label to stop the timer and log the elapsed time, or use `timeLog()`
+   * to check the time without stopping the timer.
+   *
+   * @param label - Optional label for the timer
+   * @default 'default'
+   * @returns The logger instance for chaining
+   *
+   * @example
+   * ```typescript
+   * logger.time('operation')
+   * // ... do work ...
+   * logger.timeEnd('operation')
+   * // Logs: "operation: 123.456ms"
+   *
+   * logger.time()
+   * // ... do work ...
+   * logger.timeEnd()
+   * // Logs: "default: 123.456ms"
+   * ```
    */
-  table(tabularData: unknown, properties?: readonly string[]): this {
-    const con = privateConsole.get(this)
-    con.table(tabularData, properties)
-    this[lastWasBlankSymbol](false)
-    return this[incLogCallCountSymbol]()
+  time(label?: string | undefined): this {
+    const con = this.#getConsole()
+    con.time(label)
+    return this
   }
 
   /**
-   * End a timer and log the elapsed time.
+   * Ends a timer and logs the elapsed time.
+   *
+   * Logs the duration since `console.time()` or `logger.time()` was called
+   * with the same label. The timer is stopped and removed.
+   *
+   * @param label - Optional label for the timer
+   * @default 'default'
+   * @returns The logger instance for chaining
+   *
+   * @example
+   * ```typescript
+   * logger.time('operation')
+   * // ... do work ...
+   * logger.timeEnd('operation')
+   * // Logs: "operation: 123.456ms"
+   *
+   * logger.time()
+   * // ... do work ...
+   * logger.timeEnd()
+   * // Logs: "default: 123.456ms"
+   * ```
    */
-  timeEnd(label?: string): this {
-    const con = privateConsole.get(this)
+  timeEnd(label?: string | undefined): this {
+    const con = this.#getConsole()
     con.timeEnd(label)
     this[lastWasBlankSymbol](false)
     return this[incLogCallCountSymbol]()
   }
 
   /**
-   * Log the current timer value.
+   * Logs the current value of a timer without stopping it.
+   *
+   * Logs the duration since `console.time()` was called with the same
+   * label, but keeps the timer running. Can include additional data
+   * to log alongside the time.
+   *
+   * @param label - Optional label for the timer
+   * @param data - Additional data to log with the time
+   * @default 'default'
+   * @returns The logger instance for chaining
+   *
+   * @example
+   * ```typescript
+   * console.time('process')
+   * // ... partial work ...
+   * logger.timeLog('process', 'Checkpoint 1')
+   * // Logs: "process: 123.456ms Checkpoint 1"
+   * // ... more work ...
+   * logger.timeLog('process', 'Checkpoint 2')
+   * // Logs: "process: 234.567ms Checkpoint 2"
+   * console.timeEnd('process')
+   * ```
    */
-  timeLog(label?: string, ...data: unknown[]): this {
-    const con = privateConsole.get(this)
+  timeLog(label?: string | undefined, ...data: unknown[]): this {
+    const con = this.#getConsole()
     con.timeLog(label, ...data)
     this[lastWasBlankSymbol](false)
     return this[incLogCallCountSymbol]()
   }
 
   /**
-   * Log a stack trace.
+   * Logs a stack trace to the console.
+   *
+   * Works like `console.trace()`. Shows the call stack leading to
+   * where this method was called. Useful for debugging.
+   *
+   * @param message - Optional message to display with the trace
+   * @param args - Additional arguments to log
+   * @returns The logger instance for chaining
+   *
+   * @example
+   * ```typescript
+   * function debugFunction() {
+   *   logger.trace('Debug point reached')
+   * }
+   *
+   * logger.trace('Trace from here')
+   * logger.trace('Error context:', { userId: 123 })
+   * ```
    */
-  trace(message?: unknown, ...args: unknown[]): this {
-    const con = privateConsole.get(this)
+  trace(message?: unknown | undefined, ...args: unknown[]): this {
+    const con = this.#getConsole()
     con.trace(message, ...args)
     this[lastWasBlankSymbol](false)
     return this[incLogCallCountSymbol]()
   }
 
   /**
-   * Log a warning message with symbol.
+   * Logs a warning message with a yellow colored warning symbol.
+   *
+   * Automatically prefixes the message with `LOG_SYMBOLS.warn` (yellow ⚠).
+   * Always outputs to stderr. If the message starts with an existing
+   * symbol, it will be stripped and replaced.
+   *
+   * @param args - Message and additional arguments to log
+   * @returns The logger instance for chaining
+   *
+   * @example
+   * ```typescript
+   * logger.warn('Deprecated API used')
+   * logger.warn('Low memory:', { available: '100MB' })
+   * logger.warn('Missing optional configuration')
+   * ```
    */
   warn(...args: unknown[]): this {
     return this.#symbolApply('warn', args)
   }
 
   /**
-   * Write to stdout without a newline or indentation.
+   * Writes text directly to stdout without a newline or indentation.
+   *
+   * Useful for progress indicators or custom formatting where you need
+   * low-level control. Does not apply any indentation or formatting.
+   *
+   * @param text - The text to write
+   * @returns The logger instance for chaining
+   *
+   * @example
+   * ```typescript
+   * logger.write('Processing... ')
+   * // ... do work ...
+   * logger.write('done\n')
+   *
+   * // Build a line incrementally
+   * logger.write('Step 1')
+   * logger.write('... Step 2')
+   * logger.write('... Step 3\n')
+   * ```
    */
   write(text: string): this {
-    const con = privateConsole.get(this)
-    con._stdout.write(text)
+    const con = this.#getConsole()
+    // Write directly to the original stdout stream to bypass Console formatting
+    // (e.g., group indentation). Try multiple approaches to get the raw stream:
+    // 1. Use stored reference from constructor options
+    // 2. Try to get from constructor args
+    // 3. Fall back to con._stdout (which applies formatting)
+    const ctorArgs = privateConstructorArgs.get(this) ?? []
+    const stdout =
+      this.#originalStdout || (ctorArgs[0] as any)?.stdout || con._stdout
+    stdout.write(text)
     this[lastWasBlankSymbol](false)
     return this
   }
+}
 
-  /**
-   * Show a progress indicator (can be cleared with clearLine).
-   * Simple status message without spinner animation.
-   */
-  progress(text: string): this {
-    const con = privateConsole.get(this)
-    const stream = this.#getTargetStream()
-    const streamObj = stream === 'stderr' ? con._stderr : con._stdout
-    streamObj.write(`∴ ${text}`)
-    this[lastWasBlankSymbol](false)
-    return this
+/**
+ * Lazily add dynamic console methods to Logger prototype.
+ *
+ * This is deferred until first access to avoid calling Object.entries(globalConsole)
+ * during early Node.js bootstrap before stdout is ready.
+ * @private
+ */
+let _prototypeInitialized = false
+function ensurePrototypeInitialized() {
+  if (_prototypeInitialized) {
+    return
   }
+  _prototypeInitialized = true
 
-  /**
-   * Clear the current line.
-   */
-  clearLine(): this {
-    const con = privateConsole.get(this)
-    const stream = this.#getTargetStream()
-    const streamObj = stream === 'stderr' ? con._stderr : con._stdout
-    if (streamObj.isTTY) {
-      streamObj.cursorTo(0)
-      streamObj.clearLine(0)
-    } else {
-      streamObj.write('\r\x1b[K')
+  const entries: Array<[string | symbol, PropertyDescriptor]> = [
+    [
+      getKGroupIndentationWidthSymbol(),
+      {
+        ...consolePropAttributes,
+        value: 2,
+      },
+    ],
+    [
+      Symbol.toStringTag,
+      {
+        __proto__: null,
+        configurable: true,
+        value: 'logger',
+      } as PropertyDescriptor,
+    ],
+  ]
+  for (const { 0: key, 1: value } of Object.entries(globalConsole)) {
+    if (!(Logger.prototype as any)[key] && typeof value === 'function') {
+      // Dynamically name the log method without using Object.defineProperty.
+      const { [key]: func } = {
+        [key](this: Logger, ...args: unknown[]) {
+          // Access Console via WeakMap directly since private methods can't be
+          // called from dynamically created functions.
+          let con = privateConsole.get(this)
+          if (con === undefined) {
+            // Lazy initialization - this will only happen if someone calls a
+            // dynamically added console method before any core logger method.
+            const ctorArgs = privateConstructorArgs.get(this) ?? []
+            // Clean up constructor args - no longer needed after Console creation.
+            privateConstructorArgs.delete(this)
+            if (ctorArgs.length) {
+              con = constructConsole(...ctorArgs)
+            } else {
+              con = constructConsole({
+                stdout: process.stdout,
+                stderr: process.stderr,
+              }) as typeof console & Record<string, unknown>
+              for (const { 0: k, 1: method } of boundConsoleEntries) {
+                con[k] = method
+              }
+            }
+            privateConsole.set(this, con)
+          }
+          const result = (con as any)[key](...args)
+          return result === undefined || result === con ? this : result
+        },
+      }
+      entries.push([
+        key,
+        {
+          ...consolePropAttributes,
+          value: func,
+        },
+      ])
     }
-    return this
   }
+  Object.defineProperties(Logger.prototype, Object.fromEntries(entries))
 }
 
-Object.defineProperties(
-  Logger.prototype,
-  Object.fromEntries(
-    (() => {
-      const entries: Array<[string | symbol, PropertyDescriptor]> = [
-        [
-          kGroupIndentationWidthSymbol,
-          {
-            ...consolePropAttributes,
-            value: 2,
-          },
-        ],
-        [
-          Symbol.toStringTag,
-          {
-            __proto__: null,
-            configurable: true,
-            value: 'logger',
-          } as PropertyDescriptor,
-        ],
-      ]
-      for (const { 0: key, 1: value } of Object.entries(globalConsole)) {
-        // biome-ignore lint/suspicious/noExplicitAny: Dynamic prototype check.
-        if (!(Logger.prototype as any)[key] && typeof value === 'function') {
-          // Dynamically name the log method without using Object.defineProperty.
-          const { [key]: func } = {
-            [key](...args: unknown[]) {
-              const con = privateConsole.get(this)
-              // biome-ignore lint/suspicious/noExplicitAny: Dynamic console method access.
-              const result = (con as any)[key](...args)
-              return result === undefined || result === con ? this : result
-            },
-          }
-          entries.push([
-            key,
-            {
-              ...consolePropAttributes,
-              value: func,
-            },
-          ])
-        }
-      }
-      return entries
-    })(),
-  ),
-)
+// Private singleton instance
+let _logger: Logger | undefined
+
+/**
+ * Get the default logger instance.
+ * Lazily creates the logger to avoid circular dependencies during module initialization.
+ * Reuses the same instance across calls.
+ *
+ * @returns Shared default logger instance
+ *
+ * @example
+ * ```ts
+ * import { getDefaultLogger } from '@socketsecurity/lib/logger'
+ *
+ * const logger = getDefaultLogger()
+ * logger.log('Application started')
+ * logger.success('Configuration loaded')
+ * ```
+ */
+export function getDefaultLogger(): Logger {
+  if (_logger === undefined) {
+    _logger = new Logger()
+  }
+  return _logger
+}
 
-export const logger = new Logger()
+// REMOVED: Deprecated `logger` export
+// Migration: Use getDefaultLogger() instead
+// See: getDefaultLogger() function above
diff --git a/src/maintained-node-versions.ts b/src/maintained-node-versions.ts
index 7111c8a..10e1461 100644
--- a/src/maintained-node-versions.ts
+++ b/src/maintained-node-versions.ts
@@ -22,7 +22,7 @@ const current = '22.20.0'
 const previous = '20.19.5'
 const last = '18.20.8'
 
-export default ObjectFreeze(
+const maintainedNodeVersions = ObjectFreeze(
   Object.assign([last, previous, current, next], {
     current,
     last,
@@ -35,3 +35,5 @@ export default ObjectFreeze(
   next: string
   previous: string
 }
+
+export { maintainedNodeVersions }
diff --git a/src/memoization.ts b/src/memoization.ts
index 11abfbe..80cf011 100644
--- a/src/memoization.ts
+++ b/src/memoization.ts
@@ -41,7 +41,7 @@ type CacheEntry<T> = {
  * @returns Memoized version of the function
  *
  * @example
- * import { memoize } from '@socketsecurity/registry/lib/memoization'
+ * import { memoize } from '@socketsecurity/lib/memoization'
  *
  * const expensiveOperation = memoize((n: number) => {
  *   // Heavy computation
@@ -130,7 +130,7 @@ export function memoize<Args extends unknown[], Result>(
  * @returns Memoized version of the async function
  *
  * @example
- * import { memoizeAsync } from '@socketsecurity/registry/lib/memoization'
+ * import { memoizeAsync } from '@socketsecurity/lib/memoization'
  *
  * const fetchUser = memoizeAsync(async (id: string) => {
  *   const response = await fetch(`/api/users/${id}`)
@@ -233,7 +233,7 @@ export function memoizeAsync<Args extends unknown[], Result>(
  * @returns Modified descriptor with memoized method
  *
  * @example
- * import { Memoize } from '@socketsecurity/registry/lib/memoization'
+ * import { Memoize } from '@socketsecurity/lib/memoization'
  *
  * class Calculator {
  *   @Memoize()
@@ -279,7 +279,7 @@ export function clearAllMemoizationCaches(): void {
  * @returns Memoized version using WeakMap
  *
  * @example
- * import { memoizeWeak } from '@socketsecurity/registry/lib/memoization'
+ * import { memoizeWeak } from '@socketsecurity/lib/memoization'
  *
  * const processConfig = memoizeWeak((config: Config) => {
  *   return expensiveTransform(config)
@@ -316,7 +316,7 @@ export function memoizeWeak<K extends object, Result>(
  * @returns Memoized version that only executes once
  *
  * @example
- * import { once } from '@socketsecurity/registry/lib/memoization'
+ * import { once } from '@socketsecurity/lib/memoization'
  *
  * const initialize = once(() => {
  *   console.log('Initializing…')
@@ -352,7 +352,7 @@ export function once<Result>(fn: () => Result): () => Result {
  * @returns Debounced memoized function
  *
  * @example
- * import { memoizeDebounced } from '@socketsecurity/registry/lib/memoization'
+ * import { memoizeDebounced } from '@socketsecurity/lib/memoization'
  *
  * const search = memoizeDebounced(
  *   (query: string) => performSearch(query),
diff --git a/src/objects.ts b/src/objects.ts
index bd53b18..938f27d 100644
--- a/src/objects.ts
+++ b/src/objects.ts
@@ -13,28 +13,65 @@ import { isArray } from './arrays'
 import { localeCompare } from './sorts'
 
 // Type definitions
+
+/**
+ * Record of property keys mapped to getter functions.
+ * Used for defining lazy getters on objects.
+ */
 type GetterDefObj = { [key: PropertyKey]: () => unknown }
+
+/**
+ * Statistics tracking for lazy getter initialization.
+ * Keeps track of which lazy getters have been accessed and initialized.
+ */
 type LazyGetterStats = { initialized?: Set<PropertyKey> | undefined }
+
+/**
+ * Configuration options for creating constants objects.
+ */
 type ConstantsObjectOptions = {
+  /**
+   * Lazy getter definitions to attach to the object.
+   * @default undefined
+   */
   getters?: GetterDefObj | undefined
+  /**
+   * Internal properties to store under `kInternalsSymbol`.
+   * @default undefined
+   */
   internals?: object | undefined
+  /**
+   * Properties to mix into the object (lower priority than `props`).
+   * @default undefined
+   */
   mixin?: object | undefined
 }
+
+/**
+ * Type helper that creates a remapped type with fresh property mapping.
+ * Useful for flattening intersection types into a single object type.
+ */
 type Remap<T> = { [K in keyof T]: T[K] } extends infer O
   ? { [K in keyof O]: O[K] }
   : never
 
-// Type for dynamic lazy getter record.
+/**
+ * Type for dynamic lazy getter record.
+ */
 type LazyGetterRecord<T> = {
   [key: PropertyKey]: () => T
 }
 
-// Type for generic property bag.
+/**
+ * Type for generic property bag.
+ */
 type PropertyBag = {
   [key: PropertyKey]: unknown
 }
 
-// Type for generic sorted object entries.
+/**
+ * Type for generic sorted object entries.
+ */
 type SortedObject<T> = {
   [key: PropertyKey]: T
 }
@@ -70,12 +107,34 @@ const ReflectOwnKeys = Reflect.ownKeys
 
 /**
  * Create a lazy getter function that memoizes its result.
+ *
+ * The returned function will only call the getter once, caching the result
+ * for subsequent calls. This is useful for expensive computations or
+ * operations that should only happen when needed.
+ *
+ * @param name - The property key name for the getter (used for debugging and stats)
+ * @param getter - Function that computes the value on first access
+ * @param stats - Optional stats object to track initialization
+ * @returns A memoized getter function
+ *
+ * @example
+ * ```ts
+ * const stats = { initialized: new Set() }
+ * const getLargeData = createLazyGetter('data', () => {
+ *   console.log('Computing expensive data...')
+ *   return { large: 'dataset' }
+ * }, stats)
+ *
+ * getLargeData() // Logs "Computing expensive data..." and returns data
+ * getLargeData() // Returns cached data without logging
+ * console.log(stats.initialized.has('data')) // true
+ * ```
  */
 /*@__NO_SIDE_EFFECTS__*/
 export function createLazyGetter<T>(
   name: PropertyKey,
   getter: () => T,
-  stats?: LazyGetterStats,
+  stats?: LazyGetterStats | undefined,
 ): () => T {
   let lazyValue: T | typeof UNDEFINED_TOKEN = UNDEFINED_TOKEN
   // Dynamically name the getter without using Object.defineProperty.
@@ -93,11 +152,44 @@ export function createLazyGetter<T>(
 
 /**
  * Create a frozen constants object with lazy getters and internal properties.
+ *
+ * This function creates an immutable object with:
+ * - Regular properties from `props`
+ * - Lazy getters that compute values on first access
+ * - Internal properties accessible via `kInternalsSymbol`
+ * - Mixin properties (lower priority, won't override existing)
+ * - Alphabetically sorted keys for consistency
+ *
+ * The resulting object is deeply frozen and cannot be modified.
+ *
+ * @param props - Regular properties to include on the object
+ * @param options_ - Configuration options
+ * @returns A frozen object with all specified properties
+ *
+ * @example
+ * ```ts
+ * const config = createConstantsObject(
+ *   { apiUrl: 'https://api.example.com' },
+ *   {
+ *     getters: {
+ *       client: () => new APIClient(),
+ *       timestamp: () => Date.now()
+ *     },
+ *     internals: {
+ *       version: '1.0.0'
+ *     }
+ *   }
+ * )
+ *
+ * console.log(config.apiUrl) // 'https://api.example.com'
+ * console.log(config.client) // APIClient instance (computed on first access)
+ * console.log(config[kInternalsSymbol].version) // '1.0.0'
+ * ```
  */
 /*@__NO_SIDE_EFFECTS__*/
 export function createConstantsObject(
   props: object,
-  options_?: ConstantsObjectOptions,
+  options_?: ConstantsObjectOptions | undefined,
 ): Readonly<object> {
   const options = { __proto__: null, ...options_ } as ConstantsObjectOptions
   const attributes = ObjectFreeze({
@@ -162,8 +254,24 @@ export function createConstantsObject(
 
 /**
  * Define a getter property on an object.
+ *
+ * The getter is non-enumerable and configurable, meaning it won't show up
+ * in `for...in` loops or `Object.keys()`, but can be redefined later.
+ *
+ * @param object - The object to define the getter on
+ * @param propKey - The property key for the getter
+ * @param getter - Function that computes the property value
+ * @returns The modified object (for chaining)
+ *
+ * @example
+ * ```ts
+ * const obj = {}
+ * defineGetter(obj, 'timestamp', () => Date.now())
+ * console.log(obj.timestamp) // Current timestamp
+ * console.log(obj.timestamp) // Different timestamp (computed each time)
+ * console.log(Object.keys(obj)) // [] (non-enumerable)
+ * ```
  */
-/*@__NO_SIDE_EFFECTS__*/
 export function defineGetter<T>(
   object: object,
   propKey: PropertyKey,
@@ -179,35 +287,73 @@ export function defineGetter<T>(
 
 /**
  * Define a lazy getter property on an object.
+ *
+ * Unlike `defineGetter()`, this version memoizes the result so the getter
+ * function is only called once. Subsequent accesses return the cached value.
+ *
+ * @param object - The object to define the lazy getter on
+ * @param propKey - The property key for the lazy getter
+ * @param getter - Function that computes the value on first access
+ * @param stats - Optional stats object to track initialization
+ * @returns The modified object (for chaining)
+ *
+ * @example
+ * ```ts
+ * const obj = {}
+ * defineLazyGetter(obj, 'data', () => {
+ *   console.log('Loading data...')
+ *   return { expensive: 'computation' }
+ * })
+ * console.log(obj.data) // Logs "Loading data..." and returns data
+ * console.log(obj.data) // Returns same data without logging
+ * ```
  */
-/*@__NO_SIDE_EFFECTS__*/
 export function defineLazyGetter<T>(
   object: object,
   propKey: PropertyKey,
   getter: () => T,
-  stats?: LazyGetterStats,
+  stats?: LazyGetterStats | undefined,
 ): object {
   return defineGetter(object, propKey, createLazyGetter(propKey, getter, stats))
 }
 
 /**
  * Define multiple lazy getter properties on an object.
+ *
+ * Each getter in the provided object will be converted to a lazy getter
+ * and attached to the target object. All getters share the same stats object
+ * for tracking initialization.
+ *
+ * @param object - The object to define lazy getters on
+ * @param getterDefObj - Object mapping property keys to getter functions
+ * @param stats - Optional stats object to track initialization
+ * @returns The modified object (for chaining)
+ *
+ * @example
+ * ```ts
+ * const obj = {}
+ * const stats = { initialized: new Set() }
+ * defineLazyGetters(obj, {
+ *   user: () => fetchUser(),
+ *   config: () => loadConfig(),
+ *   timestamp: () => Date.now()
+ * }, stats)
+ *
+ * console.log(obj.user) // Fetches user on first access
+ * console.log(obj.config) // Loads config on first access
+ * console.log(stats.initialized) // Set(['user', 'config'])
+ * ```
  */
-/*@__NO_SIDE_EFFECTS__*/
 export function defineLazyGetters(
   object: object,
   getterDefObj: GetterDefObj | undefined,
-  stats?: LazyGetterStats,
+  stats?: LazyGetterStats | undefined,
 ): object {
   if (getterDefObj !== null && typeof getterDefObj === 'object') {
     const keys = ReflectOwnKeys(getterDefObj)
     for (let i = 0, { length } = keys; i < length; i += 1) {
       const key = keys[i] as PropertyKey
-      defineLazyGetter(
-        object,
-        key,
-        createLazyGetter(key, getterDefObj[key] as () => unknown, stats),
-      )
+      defineLazyGetter(object, key, getterDefObj[key] as () => unknown, stats)
     }
   }
   return object
@@ -215,6 +361,20 @@ export function defineLazyGetters(
 
 /**
  * Compare two entry arrays by their keys for sorting.
+ *
+ * Used internally for alphabetically sorting object entries.
+ * String keys are compared directly, non-string keys are converted to strings first.
+ *
+ * @param a - First entry tuple [key, value]
+ * @param b - Second entry tuple [key, value]
+ * @returns Negative if a < b, positive if a > b, zero if equal
+ *
+ * @example
+ * ```ts
+ * const entries = [['zebra', 1], ['apple', 2], ['banana', 3]]
+ * entries.sort(entryKeyComparator)
+ * // [['apple', 2], ['banana', 3], ['zebra', 1]]
+ * ```
  */
 /*@__NO_SIDE_EFFECTS__*/
 export function entryKeyComparator(
@@ -230,6 +390,21 @@ export function entryKeyComparator(
 
 /**
  * Get the enumerable own property keys of an object.
+ *
+ * This is a safe wrapper around `Object.keys()` that returns an empty array
+ * for non-object values instead of throwing an error.
+ *
+ * @param obj - The value to get keys from
+ * @returns Array of enumerable string keys, or empty array for non-objects
+ *
+ * @example
+ * ```ts
+ * getKeys({ a: 1, b: 2 }) // ['a', 'b']
+ * getKeys([10, 20, 30]) // ['0', '1', '2']
+ * getKeys(null) // []
+ * getKeys(undefined) // []
+ * getKeys('hello') // []
+ * ```
  */
 /*@__NO_SIDE_EFFECTS__*/
 export function getKeys(obj: unknown): string[] {
@@ -238,6 +413,24 @@ export function getKeys(obj: unknown): string[] {
 
 /**
  * Get an own property value from an object safely.
+ *
+ * Returns `undefined` if the value is null/undefined or if the property
+ * doesn't exist as an own property (not inherited). This avoids prototype
+ * chain lookups and prevents errors on null/undefined values.
+ *
+ * @param obj - The object to get the property from
+ * @param propKey - The property key to look up
+ * @returns The property value, or `undefined` if not found or obj is null/undefined
+ *
+ * @example
+ * ```ts
+ * const obj = { name: 'Alice', age: 30 }
+ * getOwn(obj, 'name') // 'Alice'
+ * getOwn(obj, 'missing') // undefined
+ * getOwn(obj, 'toString') // undefined (inherited, not own property)
+ * getOwn(null, 'name') // undefined
+ * getOwn(undefined, 'name') // undefined
+ * ```
  */
 /*@__NO_SIDE_EFFECTS__*/
 export function getOwn(obj: unknown, propKey: PropertyKey): unknown {
@@ -251,6 +444,20 @@ export function getOwn(obj: unknown, propKey: PropertyKey): unknown {
 
 /**
  * Get all own property values from an object.
+ *
+ * Returns values for all own properties (enumerable and non-enumerable),
+ * but not inherited properties. Returns an empty array for null/undefined.
+ *
+ * @param obj - The object to get values from
+ * @returns Array of all own property values, or empty array for null/undefined
+ *
+ * @example
+ * ```ts
+ * getOwnPropertyValues({ a: 1, b: 2, c: 3 }) // [1, 2, 3]
+ * getOwnPropertyValues([10, 20, 30]) // [10, 20, 30]
+ * getOwnPropertyValues(null) // []
+ * getOwnPropertyValues(undefined) // []
+ * ```
  */
 /*@__NO_SIDE_EFFECTS__*/
 export function getOwnPropertyValues<T>(
@@ -270,6 +477,23 @@ export function getOwnPropertyValues<T>(
 
 /**
  * Check if an object has any enumerable own properties.
+ *
+ * Returns `true` if the object has at least one enumerable own property,
+ * `false` otherwise. Also returns `false` for null/undefined.
+ *
+ * @param obj - The value to check
+ * @returns `true` if obj has enumerable own properties, `false` otherwise
+ *
+ * @example
+ * ```ts
+ * hasKeys({ a: 1 }) // true
+ * hasKeys({}) // false
+ * hasKeys([]) // false
+ * hasKeys([1, 2]) // true
+ * hasKeys(null) // false
+ * hasKeys(undefined) // false
+ * hasKeys(Object.create({ inherited: true })) // false (inherited, not own)
+ * ```
  */
 /*@__NO_SIDE_EFFECTS__*/
 export function hasKeys(obj: unknown): obj is PropertyBag {
@@ -286,6 +510,24 @@ export function hasKeys(obj: unknown): obj is PropertyBag {
 
 /**
  * Check if an object has an own property.
+ *
+ * Type-safe wrapper around `Object.hasOwn()` that returns `false` for
+ * null/undefined instead of throwing. Only checks own properties, not
+ * inherited ones from the prototype chain.
+ *
+ * @param obj - The value to check
+ * @param propKey - The property key to look for
+ * @returns `true` if obj has the property as an own property, `false` otherwise
+ *
+ * @example
+ * ```ts
+ * const obj = { name: 'Alice' }
+ * hasOwn(obj, 'name') // true
+ * hasOwn(obj, 'age') // false
+ * hasOwn(obj, 'toString') // false (inherited from Object.prototype)
+ * hasOwn(null, 'name') // false
+ * hasOwn(undefined, 'name') // false
+ * ```
  */
 /*@__NO_SIDE_EFFECTS__*/
 export function hasOwn(
@@ -300,6 +542,24 @@ export function hasOwn(
 
 /**
  * Check if a value is an object (including arrays).
+ *
+ * Returns `true` for any object type including arrays, functions, dates, etc.
+ * Returns `false` for primitives and `null`.
+ *
+ * @param value - The value to check
+ * @returns `true` if value is an object (including arrays), `false` otherwise
+ *
+ * @example
+ * ```ts
+ * isObject({}) // true
+ * isObject([]) // true
+ * isObject(new Date()) // true
+ * isObject(() => {}) // false (functions are not objects for typeof)
+ * isObject(null) // false
+ * isObject(undefined) // false
+ * isObject(42) // false
+ * isObject('string') // false
+ * ```
  */
 /*@__NO_SIDE_EFFECTS__*/
 export function isObject(
@@ -310,6 +570,23 @@ export function isObject(
 
 /**
  * Check if a value is a plain object (not an array, not a built-in).
+ *
+ * Returns `true` only for plain objects created with `{}` or `Object.create(null)`.
+ * Returns `false` for arrays, built-in objects (Date, RegExp, etc.), and primitives.
+ *
+ * @param value - The value to check
+ * @returns `true` if value is a plain object, `false` otherwise
+ *
+ * @example
+ * ```ts
+ * isObjectObject({}) // true
+ * isObjectObject({ a: 1 }) // true
+ * isObjectObject(Object.create(null)) // true
+ * isObjectObject([]) // false
+ * isObjectObject(new Date()) // false
+ * isObjectObject(null) // false
+ * isObjectObject(42) // false
+ * ```
  */
 /*@__NO_SIDE_EFFECTS__*/
 export function isObjectObject(
@@ -318,7 +595,7 @@ export function isObjectObject(
   if (value === null || typeof value !== 'object' || isArray(value)) {
     return false
   }
-  const proto = ObjectGetPrototypeOf(value)
+  const proto: any = ObjectGetPrototypeOf(value)
   return proto === null || proto === ObjectPrototype
 }
 
@@ -328,13 +605,37 @@ export function isObjectObject(
 // See: https://github.com/SocketDev/socket-packageurl-js/issues/3
 
 /**
- * Alias for native Object.assign.
- * Copies all enumerable own properties from one or more source objects to a target object.
+ * Alias for native `Object.assign`.
+ *
+ * Copies all enumerable own properties from one or more source objects
+ * to a target object and returns the modified target object.
+ *
+ * @example
+ * ```ts
+ * const target = { a: 1 }
+ * const source = { b: 2, c: 3 }
+ * objectAssign(target, source) // { a: 1, b: 2, c: 3 }
+ * ```
  */
 export const objectAssign = Object.assign
 
 /**
  * Get all own property entries (key-value pairs) from an object.
+ *
+ * Unlike `Object.entries()`, this includes non-enumerable properties and
+ * symbol keys. Returns an empty array for null/undefined.
+ *
+ * @param obj - The object to get entries from
+ * @returns Array of [key, value] tuples, or empty array for null/undefined
+ *
+ * @example
+ * ```ts
+ * objectEntries({ a: 1, b: 2 }) // [['a', 1], ['b', 2]]
+ * const sym = Symbol('key')
+ * objectEntries({ [sym]: 'value', x: 10 }) // [[Symbol(key), 'value'], ['x', 10]]
+ * objectEntries(null) // []
+ * objectEntries(undefined) // []
+ * ```
  */
 /*@__NO_SIDE_EFFECTS__*/
 export function objectEntries(obj: unknown): Array<[PropertyKey, unknown]> {
@@ -358,13 +659,52 @@ export function objectEntries(obj: unknown): Array<[PropertyKey, unknown]> {
 // See: https://github.com/SocketDev/socket-packageurl-js/issues/3
 
 /**
- * Alias for native Object.freeze.
- * Freezes an object, preventing new properties from being added and existing properties from being removed or modified.
+ * Alias for native `Object.freeze`.
+ *
+ * Freezes an object, preventing new properties from being added and existing
+ * properties from being removed or modified. Makes the object immutable.
+ *
+ * @example
+ * ```ts
+ * const obj = { a: 1 }
+ * objectFreeze(obj)
+ * obj.a = 2 // Silently fails in non-strict mode, throws in strict mode
+ * obj.b = 3 // Silently fails in non-strict mode, throws in strict mode
+ * ```
  */
 export const objectFreeze = Object.freeze
 
 /**
  * Deep merge source object into target object.
+ *
+ * Recursively merges properties from `source` into `target`. Arrays in source
+ * completely replace arrays in target (no element-wise merging). Objects are
+ * merged recursively. Includes infinite loop detection for safety.
+ *
+ * @param target - The object to merge into (will be modified)
+ * @param source - The object to merge from
+ * @returns The modified target object
+ *
+ * @example
+ * ```ts
+ * const target = { a: { x: 1 }, b: [1, 2] }
+ * const source = { a: { y: 2 }, b: [3, 4, 5], c: 3 }
+ * merge(target, source)
+ * // { a: { x: 1, y: 2 }, b: [3, 4, 5], c: 3 }
+ * ```
+ *
+ * @example
+ * ```ts
+ * // Arrays are replaced, not merged
+ * merge({ arr: [1, 2] }, { arr: [3] }) // { arr: [3] }
+ *
+ * // Deep object merging
+ * merge(
+ *   { config: { api: 'v1', timeout: 1000 } },
+ *   { config: { api: 'v2', retries: 3 } }
+ * )
+ * // { config: { api: 'v2', timeout: 1000, retries: 3 } }
+ * ```
  */
 /*@__NO_SIDE_EFFECTS__*/
 export function merge<T extends object, U extends object>(
@@ -422,6 +762,24 @@ export function merge<T extends object, U extends object>(
 
 /**
  * Convert an object to a new object with sorted keys.
+ *
+ * Creates a new object with the same properties as the input, but with keys
+ * sorted alphabetically. Symbol keys are sorted separately and placed first.
+ * This is useful for consistent key ordering in serialization or comparisons.
+ *
+ * @param obj - The object to sort
+ * @returns A new object with sorted keys
+ *
+ * @example
+ * ```ts
+ * toSortedObject({ z: 1, a: 2, m: 3 })
+ * // { a: 2, m: 3, z: 1 }
+ *
+ * const sym1 = Symbol('first')
+ * const sym2 = Symbol('second')
+ * toSortedObject({ z: 1, [sym2]: 2, a: 3, [sym1]: 4 })
+ * // { [Symbol(first)]: 4, [Symbol(second)]: 2, a: 3, z: 1 }
+ * ```
  */
 /*@__NO_SIDE_EFFECTS__*/
 export function toSortedObject<T extends object>(obj: T): T {
@@ -430,6 +788,23 @@ export function toSortedObject<T extends object>(obj: T): T {
 
 /**
  * Create an object from entries with sorted keys.
+ *
+ * Takes an iterable of [key, value] entries and creates a new object with
+ * keys sorted alphabetically. Symbol keys are sorted separately and placed
+ * first in the resulting object.
+ *
+ * @param entries - Iterable of [key, value] tuples
+ * @returns A new object with sorted keys
+ *
+ * @example
+ * ```ts
+ * toSortedObjectFromEntries([['z', 1], ['a', 2], ['m', 3]])
+ * // { a: 2, m: 3, z: 1 }
+ *
+ * const entries = new Map([['beta', 2], ['alpha', 1], ['gamma', 3]])
+ * toSortedObjectFromEntries(entries)
+ * // { alpha: 1, beta: 2, gamma: 3 }
+ * ```
  */
 /*@__NO_SIDE_EFFECTS__*/
 export function toSortedObjectFromEntries<T = unknown>(
diff --git a/src/package-default-node-range.ts b/src/package-default-node-range.ts
new file mode 100644
index 0000000..826f89c
--- /dev/null
+++ b/src/package-default-node-range.ts
@@ -0,0 +1,10 @@
+/**
+ * @fileoverview Default Node.js version range for packages.
+ */
+
+const { maintainedNodeVersions } = require('#lib/maintained-node-versions')
+const semver = require('./external/semver')
+
+const packageDefaultNodeRange = `>=${semver.parse(maintainedNodeVersions.last).major}`
+
+export { packageDefaultNodeRange }
diff --git a/src/package-default-socket-categories.ts b/src/package-default-socket-categories.ts
new file mode 100644
index 0000000..80739d4
--- /dev/null
+++ b/src/package-default-socket-categories.ts
@@ -0,0 +1,8 @@
+/**
+ * @fileoverview Default Socket security categories for packages.
+ */
+
+// Default category for new packages
+const packageDefaultSocketCategories = Object.freeze(['cleanup'])
+
+export { packageDefaultSocketCategories }
diff --git a/src/package-extensions.ts b/src/package-extensions.ts
new file mode 100644
index 0000000..dfb3577
--- /dev/null
+++ b/src/package-extensions.ts
@@ -0,0 +1,54 @@
+/**
+ * @fileoverview Package extensions for compatibility adjustments.
+ *
+ * Package extensions allow modifying package.json fields of dependencies
+ * to fix compatibility issues, missing peer dependencies, etc.
+ */
+
+const { freeze: ObjectFreeze } = Object
+
+const yarnPkgExtensions = require('./external/@yarnpkg/extensions')
+
+const packageExtensions = ObjectFreeze(
+  [
+    yarnPkgExtensions.packageExtensions,
+    [
+      '@yarnpkg/extensions@>=1.1.0',
+      {
+        // Properties with undefined values are omitted when saved as JSON.
+        peerDependencies: undefined,
+      },
+    ],
+    [
+      'abab@>=2.0.0',
+      {
+        devDependencies: {
+          // Lower the Webpack from v4.x to one supported by abab's peers.
+          webpack: '^3.12.0',
+        },
+      },
+    ],
+    [
+      'is-generator-function@>=1.0.7',
+      {
+        scripts: {
+          // Make the script a silent no-op.
+          'test:uglified': '',
+        },
+      },
+    ],
+  ].sort((a_, b_) => {
+    const a = a_[0].slice(0, a_[0].lastIndexOf('@'))
+    const b = b_[0].slice(0, b_[0].lastIndexOf('@'))
+    // Simulate the default compareFn of String.prototype.sort.
+    if (a < b) {
+      return -1
+    }
+    if (a > b) {
+      return 1
+    }
+    return 0
+  }),
+)
+
+export { packageExtensions }
diff --git a/src/packages/editable.ts b/src/packages/editable.ts
index 8b1cddc..b4d22db 100644
--- a/src/packages/editable.ts
+++ b/src/packages/editable.ts
@@ -165,11 +165,11 @@ function getUtil() {
 export function getEditablePackageJsonClass(): EditablePackageJsonConstructor {
   if (_EditablePackageJsonClass === undefined) {
     const EditablePackageJsonBase =
-      /*@__PURE__*/ require('../../external/@npmcli/package-json')
+      /*@__PURE__*/ require('../external/@npmcli/package-json')
     const { parse, read } =
-      /*@__PURE__*/ require('../../external/@npmcli/package-json/lib/read-package')
+      /*@__PURE__*/ require('../external/@npmcli/package-json/lib/read-package')
     const { packageSort } =
-      /*@__PURE__*/ require('../../external/@npmcli/package-json/lib/sort')
+      /*@__PURE__*/ require('../external/@npmcli/package-json/lib/sort')
     _EditablePackageJsonClass =
       class EditablePackageJson extends (EditablePackageJsonBase as EditablePackageJsonConstructor) {
         static override fixSteps = EditablePackageJsonBase.fixSteps
diff --git a/src/packages/isolation.ts b/src/packages/isolation.ts
index a756297..05d22b8 100644
--- a/src/packages/isolation.ts
+++ b/src/packages/isolation.ts
@@ -3,27 +3,17 @@
  * Provides tools to set up isolated test environments for packages.
  */
 
-import { existsSync, promises as fs } from 'node:fs'
+import { existsSync, promises as fs } from 'fs'
 
 import { WIN32 } from '#constants/platform'
 
 import type { PackageJson } from '../packages'
 import { isAbsolute, isPath, trimLeadingDotSlash } from '../path'
 import { readPackageJson } from './operations'
+import { getOsTmpDir } from '#lib/paths'
 
-let _os: typeof import('node:os') | undefined
 let _path: typeof import('node:path') | undefined
 
-/*@__NO_SIDE_EFFECTS__*/
-function getOs() {
-  if (_os === undefined) {
-    // Use non-'node:' prefixed require to avoid Webpack errors.
-
-    _os = /*@__PURE__*/ require('node:os')
-  }
-  return _os as typeof import('node:os')
-}
-
 /*@__NO_SIDE_EFFECTS__*/
 function getPath() {
   if (_path === undefined) {
@@ -97,7 +87,6 @@ export async function isolatePackage(
   packageSpec: string,
   options?: IsolatePackageOptions | undefined,
 ): Promise<IsolatePackageResult> {
-  const os = getOs()
   const path = getPath()
   const opts = { __proto__: null, ...options } as IsolatePackageOptions
   const { imports, install, onPackageJson, sourcePath: optSourcePath } = opts
@@ -111,7 +100,7 @@ export async function isolatePackage(
     // File system path.
     // Handle edge case on Windows where path.relative() returns an absolute path
     // when paths are on different drives, and the test prepends './' to it.
-    // Example: './C:\Users\...' should be treated as 'C:\Users\...'.
+    // Example: './C:\path\to\file' should be treated as 'C:\path\to\file'.
     const trimmedPath = trimLeadingDotSlash(packageSpec)
     const pathToResolve = isAbsolute(trimmedPath) ? trimmedPath : packageSpec
     sourcePath = path.resolve(pathToResolve)
@@ -128,7 +117,7 @@ export async function isolatePackage(
     packageName = pkgJson.name as string
   } else {
     // Parse as npm package spec.
-    const npa = /*@__PURE__*/ require('../../external/npm-package-arg')
+    const npa = /*@__PURE__*/ require('../external/npm-package-arg')
     const parsed = npa(packageSpec)
 
     packageName = parsed.name
@@ -159,7 +148,7 @@ export async function isolatePackage(
   // Create temp directory for this package.
   const sanitizedName = packageName.replace(/[@/]/g, '-')
   const tempDir = await fs.mkdtemp(
-    path.join(os.tmpdir(), `socket-test-${sanitizedName}-`),
+    path.join(getOsTmpDir(), `socket-test-${sanitizedName}-`),
   )
   const packageTempDir = path.join(tempDir, sanitizedName)
   await fs.mkdir(packageTempDir, { recursive: true })
@@ -187,7 +176,6 @@ export async function isolatePackage(
       await install(packageTempDir)
     } else {
       const { spawn } = /*@__PURE__*/ require('../spawn')
-      const WIN32 = require('../../constants/platform').WIN32
       const packageInstallSpec = spec.startsWith('https://')
         ? spec
         : `${packageName}@${spec}`
@@ -256,7 +244,6 @@ export async function isolatePackage(
     await install(installedPath)
   } else {
     const { spawn } = /*@__PURE__*/ require('../spawn')
-    const WIN32 = require('../../constants/platform').WIN32
     await spawn('pnpm', ['install'], {
       cwd: installedPath,
       shell: WIN32,
diff --git a/src/packages/licenses.ts b/src/packages/licenses.ts
index d4bbdf8..227a471 100644
--- a/src/packages/licenses.ts
+++ b/src/packages/licenses.ts
@@ -36,7 +36,7 @@ let _spdxCorrect: typeof import('spdx-correct') | undefined
 function getSpdxCorrect() {
   if (_spdxCorrect === undefined) {
     // The 'spdx-correct' package is browser safe.
-    _spdxCorrect = /*@__PURE__*/ require('../../external/spdx-correct')
+    _spdxCorrect = /*@__PURE__*/ require('../external/spdx-correct')
   }
   return _spdxCorrect as typeof import('spdx-correct')
 }
@@ -46,7 +46,7 @@ let _spdxExpParse: typeof import('spdx-expression-parse') | undefined
 function getSpdxExpParse() {
   if (_spdxExpParse === undefined) {
     // The 'spdx-expression-parse' package is browser safe.
-    _spdxExpParse = /*@__PURE__*/ require('../../external/spdx-expression-parse')
+    _spdxExpParse = /*@__PURE__*/ require('../external/spdx-expression-parse')
   }
   return _spdxExpParse as typeof import('spdx-expression-parse')
 }
diff --git a/src/packages/manifest.ts b/src/packages/manifest.ts
index b0995f1..4de8b69 100644
--- a/src/packages/manifest.ts
+++ b/src/packages/manifest.ts
@@ -27,7 +27,7 @@ let _npmPackageArg: typeof import('npm-package-arg') | undefined
 /*@__NO_SIDE_EFFECTS__*/
 function getNpmPackageArg() {
   if (_npmPackageArg === undefined) {
-    _npmPackageArg = /*@__PURE__*/ require('../../external/npm-package-arg')
+    _npmPackageArg = /*@__PURE__*/ require('../external/npm-package-arg')
   }
   return _npmPackageArg as typeof import('npm-package-arg')
 }
@@ -36,7 +36,7 @@ let _pacote: typeof import('pacote') | undefined
 /*@__NO_SIDE_EFFECTS__*/
 function getPacote() {
   if (_pacote === undefined) {
-    _pacote = /*@__PURE__*/ require('../../external/pacote')
+    _pacote = /*@__PURE__*/ require('../external/pacote')
   }
   return _pacote as typeof import('pacote')
 }
@@ -46,7 +46,7 @@ let _semver: typeof import('semver') | undefined
 function getSemver() {
   if (_semver === undefined) {
     // The 'semver' package is browser safe.
-    _semver = /*@__PURE__*/ require('../../external/semver')
+    _semver = /*@__PURE__*/ require('../external/semver')
   }
   return _semver as typeof import('semver')
 }
diff --git a/src/packages/normalize.ts b/src/packages/normalize.ts
index d9865da..2ecdd2e 100644
--- a/src/packages/normalize.ts
+++ b/src/packages/normalize.ts
@@ -14,7 +14,7 @@ let _REGISTRY_SCOPE_DELIMITER: string | undefined
 function getRegistryScopeDelimiter(): string {
   if (_REGISTRY_SCOPE_DELIMITER === undefined) {
     _REGISTRY_SCOPE_DELIMITER =
-      /*@__INLINE__*/ require('../../constants/socket').REGISTRY_SCOPE_DELIMITER
+      /*@__INLINE__*/ require('../constants/socket').REGISTRY_SCOPE_DELIMITER
   }
   return _REGISTRY_SCOPE_DELIMITER as string
 }
@@ -23,7 +23,7 @@ let _SOCKET_REGISTRY_SCOPE: string | undefined
 function getSocketRegistryScope(): string {
   if (_SOCKET_REGISTRY_SCOPE === undefined) {
     _SOCKET_REGISTRY_SCOPE =
-      /*@__INLINE__*/ require('../../constants/socket').SOCKET_REGISTRY_SCOPE
+      /*@__INLINE__*/ require('../constants/socket').SOCKET_REGISTRY_SCOPE
   }
   return _SOCKET_REGISTRY_SCOPE as string
 }
@@ -53,11 +53,31 @@ let _normalizePackageData: typeof import('normalize-package-data') | undefined
 function getNormalizePackageData() {
   if (_normalizePackageData === undefined) {
     _normalizePackageData =
-      /*@__PURE__*/ require('../../external/normalize-package-data')
+      /*@__PURE__*/ require('../external/normalize-package-data')
   }
   return _normalizePackageData as typeof import('normalize-package-data')
 }
 
+let _findPackageExtensions:
+  | ((name: string, version: string) => unknown)
+  | undefined
+/**
+ * Get the findPackageExtensions function from operations module.
+ * Lazy loaded to avoid circular dependency.
+ */
+/*@__NO_SIDE_EFFECTS__*/
+function _getFindPackageExtensions() {
+  if (_findPackageExtensions === undefined) {
+    // Dynamically import to avoid circular dependency.
+    // Use path alias for reliable resolution in both test and production environments.
+    const operations: {
+      findPackageExtensions: (name: string, version: string) => unknown
+    } = require('#packages/operations')
+    _findPackageExtensions = operations.findPackageExtensions
+  }
+  return _findPackageExtensions as (name: string, version: string) => unknown
+}
+
 /**
  * Normalize a package.json object with standard npm package normalization.
  */
@@ -86,10 +106,13 @@ export function normalizePackageJson(
   ]
   const normalizePackageData = getNormalizePackageData()
   normalizePackageData(pkgJson)
-  // Import findPackageExtensions from operations to avoid circular dependency.
-  const { findPackageExtensions } = require('./operations')
+  // Apply package extensions if name and version are present.
   if (pkgJson.name && pkgJson.version) {
-    merge(pkgJson, findPackageExtensions(pkgJson.name, pkgJson.version))
+    const findPackageExtensions = _getFindPackageExtensions()
+    const extensions = findPackageExtensions(pkgJson.name, pkgJson.version)
+    if (extensions && typeof extensions === 'object') {
+      merge(pkgJson, extensions)
+    }
   }
   // Revert/remove properties we don't care to have normalized.
   // Properties with undefined values are omitted when saved as JSON.
diff --git a/src/packages/operations.ts b/src/packages/operations.ts
index ebb5376..e4a8329 100644
--- a/src/packages/operations.ts
+++ b/src/packages/operations.ts
@@ -38,7 +38,7 @@ let _cacache: typeof import('cacache') | undefined
 /*@__NO_SIDE_EFFECTS__*/
 function getCacache() {
   if (_cacache === undefined) {
-    _cacache = /*@__PURE__*/ require('../../external/cacache')
+    _cacache = /*@__PURE__*/ require('../external/cacache')
   }
   return _cacache as typeof import('cacache')
 }
@@ -57,7 +57,7 @@ let _fetcher: MakeFetchHappenFetcher | undefined
 function getFetcher() {
   if (_fetcher === undefined) {
     const makeFetchHappen =
-      /*@__PURE__*/ require('../../external/make-fetch-happen')
+      /*@__PURE__*/ require('../external/make-fetch-happen')
     _fetcher = makeFetchHappen.defaults({
       cachePath: pacoteCachePath,
       // Prefer-offline: Staleness checks for cached data will be bypassed, but
@@ -73,7 +73,7 @@ let _npmPackageArg: typeof import('npm-package-arg') | undefined
 /*@__NO_SIDE_EFFECTS__*/
 function getNpmPackageArg() {
   if (_npmPackageArg === undefined) {
-    _npmPackageArg = /*@__PURE__*/ require('../../external/npm-package-arg')
+    _npmPackageArg = /*@__PURE__*/ require('../external/npm-package-arg')
   }
   return _npmPackageArg as typeof import('npm-package-arg')
 }
@@ -95,7 +95,7 @@ function getPackageURL() {
   if (_PackageURL === undefined) {
     // The 'packageurl-js' package is browser safe.
     const packageUrlJs =
-      /*@__PURE__*/ require('../../external/@socketregistry/packageurl-js')
+      /*@__PURE__*/ require('../external/@socketregistry/packageurl-js')
     _PackageURL = packageUrlJs.PackageURL
   }
   return _PackageURL as typeof import('@socketregistry/packageurl-js').PackageURL
@@ -105,7 +105,7 @@ let _pacote: typeof import('pacote') | undefined
 /*@__NO_SIDE_EFFECTS__*/
 function getPacote() {
   if (_pacote === undefined) {
-    _pacote = /*@__PURE__*/ require('../../external/pacote')
+    _pacote = /*@__PURE__*/ require('../external/pacote')
   }
   return _pacote as typeof import('pacote')
 }
@@ -115,11 +115,51 @@ let _semver: typeof import('semver') | undefined
 function getSemver() {
   if (_semver === undefined) {
     // The 'semver' package is browser safe.
-    _semver = /*@__PURE__*/ require('../../external/semver')
+    _semver = /*@__PURE__*/ require('../external/semver')
   }
   return _semver as typeof import('semver')
 }
 
+let _toEditablePackageJson:
+  | ((pkgJson: PackageJson, options?: unknown) => Promise<PackageJson>)
+  | undefined
+/**
+ * Get the toEditablePackageJson function from editable module.
+ * Lazy loaded to avoid circular dependency.
+ */
+/*@__NO_SIDE_EFFECTS__*/
+function _getToEditablePackageJson() {
+  if (_toEditablePackageJson === undefined) {
+    // Use path alias for reliable resolution in both test and production environments.
+    _toEditablePackageJson =
+      /*@__PURE__*/ require('#packages/editable').toEditablePackageJson
+  }
+  return _toEditablePackageJson as (
+    pkgJson: PackageJson,
+    options?: unknown,
+  ) => Promise<PackageJson>
+}
+
+let _toEditablePackageJsonSync:
+  | ((pkgJson: PackageJson, options?: unknown) => PackageJson)
+  | undefined
+/**
+ * Get the toEditablePackageJsonSync function from editable module.
+ * Lazy loaded to avoid circular dependency.
+ */
+/*@__NO_SIDE_EFFECTS__*/
+function _getToEditablePackageJsonSync() {
+  if (_toEditablePackageJsonSync === undefined) {
+    // Use path alias for reliable resolution in both test and production environments.
+    _toEditablePackageJsonSync =
+      /*@__PURE__*/ require('#packages/editable').toEditablePackageJsonSync
+  }
+  return _toEditablePackageJsonSync as (
+    pkgJson: PackageJson,
+    options?: unknown,
+  ) => PackageJson
+}
+
 /**
  * Extract a package to a destination directory.
  */
@@ -145,6 +185,7 @@ export async function extractPackage(
     preferOffline: true,
     ...extractOptions_,
   }
+  /* c8 ignore start - External package registry extraction */
   const pacote = getPacote()
   if (typeof dest === 'string') {
     await pacote.extract(pkgNameOrId, dest, extractOptions)
@@ -166,6 +207,7 @@ export async function extractPackage(
       },
     )
   }
+  /* c8 ignore stop */
 }
 
 /**
@@ -229,6 +271,7 @@ export async function packPackage(
   spec: string,
   options?: PacoteOptions,
 ): Promise<unknown> {
+  /* c8 ignore start - External package registry packing */
   const pack = getPack()
   return await pack(spec, {
     __proto__: null,
@@ -237,6 +280,7 @@ export async function packPackage(
     packumentCache,
     preferOffline: true,
   } as PacoteOptions)
+  /* c8 ignore stop */
 }
 
 /**
@@ -256,8 +300,7 @@ export async function readPackageJson(
   })) as PackageJson | undefined
   if (pkgJson) {
     if (editable) {
-      // Import toEditablePackageJson to avoid circular dependency.
-      const { toEditablePackageJson } = require('./editable')
+      const toEditablePackageJson = _getToEditablePackageJson()
       return await toEditablePackageJson(pkgJson, {
         path: filepath,
         normalize,
@@ -290,8 +333,7 @@ export function readPackageJsonSync(
     | undefined
   if (pkgJson) {
     if (editable) {
-      // Import toEditablePackageJsonSync to avoid circular dependency.
-      const { toEditablePackageJsonSync } = require('./editable')
+      const toEditablePackageJsonSync = _getToEditablePackageJsonSync()
       return toEditablePackageJsonSync(pkgJson, {
         path: filepath,
         normalize,
@@ -334,6 +376,7 @@ export async function resolveGitHubTgzUrl(
     ? parsedSpec.hosted
     : getRepoUrlDetails(repository?.url)) || { project: '', user: '' }
 
+  /* c8 ignore start - External GitHub API calls */
   if (user && project) {
     let apiUrl = ''
     if (isGitHubUrl) {
@@ -361,6 +404,7 @@ export async function resolveGitHubTgzUrl(
       }
     }
   }
+  /* c8 ignore stop */
   return ''
 }
 
diff --git a/src/packages/provenance.ts b/src/packages/provenance.ts
index fbdcf13..6059d5a 100644
--- a/src/packages/provenance.ts
+++ b/src/packages/provenance.ts
@@ -22,10 +22,10 @@ let _fetcher: typeof import('make-fetch-happen') | undefined
 function getFetcher() {
   if (_fetcher === undefined) {
     const makeFetchHappen =
-      /*@__PURE__*/ require('../../external/make-fetch-happen')
+      /*@__PURE__*/ require('../external/make-fetch-happen')
     // Lazy load constants to avoid circular dependencies.
     const { getPacoteCachePath } =
-      /*@__PURE__*/ require('../../constants/packages')
+      /*@__PURE__*/ require('../constants/packages')
     _fetcher = makeFetchHappen.defaults({
       cachePath: getPacoteCachePath(),
       // Prefer-offline: Staleness checks for cached data will be bypassed, but
diff --git a/src/packages/registry.ts b/src/packages/registry.ts
deleted file mode 100644
index fbd1466..0000000
--- a/src/packages/registry.ts
+++ /dev/null
@@ -1,8 +0,0 @@
-/**
- * @fileoverview Socket Registry class implementation.
- */
-
-/**
- * Main Socket Registry class for managing packages.
- */
-export class SocketRegistry {}
diff --git a/src/packages/specs.ts b/src/packages/specs.ts
index 8d91a76..eea9bba 100644
--- a/src/packages/specs.ts
+++ b/src/packages/specs.ts
@@ -12,7 +12,7 @@ let _npmPackageArg: typeof import('npm-package-arg') | undefined
 /*@__NO_SIDE_EFFECTS__*/
 function getNpmPackageArg() {
   if (_npmPackageArg === undefined) {
-    _npmPackageArg = /*@__PURE__*/ require('../../external/npm-package-arg')
+    _npmPackageArg = /*@__PURE__*/ require('../external/npm-package-arg')
   }
   return _npmPackageArg as typeof import('npm-package-arg')
 }
diff --git a/src/packages/validation.ts b/src/packages/validation.ts
index 5bc36bb..e3bb699 100644
--- a/src/packages/validation.ts
+++ b/src/packages/validation.ts
@@ -12,7 +12,7 @@ let _validateNpmPackageName:
 function getValidateNpmPackageName() {
   if (_validateNpmPackageName === undefined) {
     _validateNpmPackageName =
-      /*@__PURE__*/ require('../../external/validate-npm-package-name')
+      /*@__PURE__*/ require('../external/validate-npm-package-name')
   }
   return _validateNpmPackageName as typeof import('validate-npm-package-name')
 }
diff --git a/src/path.ts b/src/path.ts
index a3f11d1..e01f131 100644
--- a/src/path.ts
+++ b/src/path.ts
@@ -29,6 +29,19 @@ const nodeModulesPathRegExp = /(?:^|[/\\])node_modules(?:[/\\]|$)/
 
 /**
  * Check if a character code represents a path separator.
+ *
+ * Determines whether the given character code is either a forward slash (/) or
+ * backslash (\), which are used as path separators across different platforms.
+ *
+ * @param {number} code - The character code to check
+ * @returns {boolean} `true` if the code represents a path separator, `false` otherwise
+ *
+ * @example
+ * ```typescript
+ * isPathSeparator(47)  // true - forward slash '/'
+ * isPathSeparator(92)  // true - backslash '\'
+ * isPathSeparator(65)  // false - letter 'A'
+ * ```
  */
 /*@__NO_SIDE_EFFECTS__*/
 function isPathSeparator(code: number): boolean {
@@ -37,6 +50,21 @@ function isPathSeparator(code: number): boolean {
 
 /**
  * Check if a character code represents a Windows device root letter.
+ *
+ * Tests whether the given character code falls within the valid range for
+ * Windows drive letters (A-Z or a-z). These letters are used at the start
+ * of Windows absolute paths (e.g., `C:\`, `D:\`).
+ *
+ * @param {number} code - The character code to check
+ * @returns {boolean} `true` if the code is a valid drive letter, `false` otherwise
+ *
+ * @example
+ * ```typescript
+ * isWindowsDeviceRoot(67)  // true - letter 'C'
+ * isWindowsDeviceRoot(99)  // true - letter 'c'
+ * isWindowsDeviceRoot(58)  // false - colon ':'
+ * isWindowsDeviceRoot(47)  // false - forward slash '/'
+ * ```
  */
 /*@__NO_SIDE_EFFECTS__*/
 function isWindowsDeviceRoot(code: number): boolean {
@@ -49,7 +77,12 @@ function isWindowsDeviceRoot(code: number): boolean {
 let _buffer: typeof import('node:buffer') | undefined
 /**
  * Lazily load the buffer module.
+ *
+ * Performs on-demand loading of Node.js buffer module to avoid initialization
+ * overhead and potential Webpack bundling errors.
+ *
  * @private
+ * @returns {typeof import('node:buffer')} The buffer module
  */
 /*@__NO_SIDE_EFFECTS__*/
 function getBuffer() {
@@ -64,7 +97,12 @@ function getBuffer() {
 let _url: typeof import('node:url') | undefined
 /**
  * Lazily load the url module.
+ *
+ * Performs on-demand loading of Node.js url module to avoid initialization
+ * overhead and potential Webpack bundling errors.
+ *
  * @private
+ * @returns {typeof import('node:url')} The url module
  */
 /*@__NO_SIDE_EFFECTS__*/
 function getUrl() {
@@ -78,6 +116,24 @@ function getUrl() {
 
 /**
  * Check if a path contains node_modules directory.
+ *
+ * Detects whether a given path includes a `node_modules` directory segment.
+ * This is useful for identifying npm package dependencies and filtering
+ * dependency-related paths.
+ *
+ * The check matches `node_modules` appearing as a complete path segment,
+ * ensuring it is either at the start, end, or surrounded by path separators.
+ *
+ * @param {string | Buffer | URL} pathLike - The path to check
+ * @returns {boolean} `true` if the path contains `node_modules`, `false` otherwise
+ *
+ * @example
+ * ```typescript
+ * isNodeModules('/project/node_modules/package')    // true
+ * isNodeModules('node_modules/package/index.js')    // true
+ * isNodeModules('/src/my_node_modules_backup')      // false
+ * isNodeModules('/project/src/index.js')            // false
+ * ```
  */
 /*@__NO_SIDE_EFFECTS__*/
 export function isNodeModules(pathLike: string | Buffer | URL): boolean {
@@ -110,12 +166,25 @@ export function isNodeModules(pathLike: string | Buffer | URL): boolean {
  *    - Examples: '\Windows', '\\.\device'
  *    - Note: Single backslash paths are relative to current drive
  *
- * Examples:
- * - isAbsolute('/home/user') → true (POSIX)
- * - isAbsolute('C:\\Windows') → true (Windows drive letter)
- * - isAbsolute('\\server\\share') → true (Windows UNC)
- * - isAbsolute('../relative') → false
- * - isAbsolute('relative/path') → false
+ * @param {string | Buffer | URL} pathLike - The path to check
+ * @returns {boolean} `true` if the path is absolute, `false` otherwise
+ *
+ * @example
+ * ```typescript
+ * // POSIX paths
+ * isAbsolute('/home/user')           // true
+ * isAbsolute('/usr/bin/node')        // true
+ *
+ * // Windows paths
+ * isAbsolute('C:\\Windows')          // true
+ * isAbsolute('D:/data')              // true
+ * isAbsolute('\\\\server\\share')    // true
+ *
+ * // Relative paths
+ * isAbsolute('../relative')          // false
+ * isAbsolute('relative/path')        // false
+ * isAbsolute('.')                    // false
+ * ```
  */
 /*@__NO_SIDE_EFFECTS__*/
 export function isAbsolute(pathLike: string | Buffer | URL): boolean {
@@ -166,6 +235,43 @@ export function isAbsolute(pathLike: string | Buffer | URL): boolean {
 
 /**
  * Check if a value is a valid file path (absolute or relative).
+ *
+ * Determines whether a given value represents a valid file system path.
+ * This function distinguishes between file paths and other string formats
+ * like package names, URLs, or bare module specifiers.
+ *
+ * Valid paths include:
+ * - Absolute paths (e.g., `/usr/bin`, `C:\Windows`)
+ * - Relative paths with separators (e.g., `./src`, `../lib`)
+ * - Special relative paths (`.`, `..`)
+ * - Paths starting with `@` that have subpaths (e.g., `@scope/name/file`)
+ *
+ * Not considered paths:
+ * - URLs with protocols (e.g., `http://`, `file://`, `git:`)
+ * - Bare package names (e.g., `lodash`, `react`)
+ * - Scoped package names without subpaths (e.g., `@scope/name`)
+ *
+ * @param {string | Buffer | URL} pathLike - The value to check
+ * @returns {boolean} `true` if the value is a valid file path, `false` otherwise
+ *
+ * @example
+ * ```typescript
+ * // Valid paths
+ * isPath('/absolute/path')           // true
+ * isPath('./relative/path')          // true
+ * isPath('../parent/dir')            // true
+ * isPath('.')                        // true
+ * isPath('..')                       // true
+ * isPath('@scope/name/subpath')      // true
+ * isPath('C:\\Windows')              // true (Windows)
+ *
+ * // Not paths
+ * isPath('lodash')                   // false - bare package name
+ * isPath('@scope/package')           // false - scoped package name
+ * isPath('http://example.com')       // false - URL
+ * isPath('file://path')              // false - file URL
+ * isPath('')                         // false - empty string
+ * ```
  */
 /*@__NO_SIDE_EFFECTS__*/
 export function isPath(pathLike: string | Buffer | URL): boolean {
@@ -213,6 +319,32 @@ export function isPath(pathLike: string | Buffer | URL): boolean {
 
 /**
  * Check if a path is relative.
+ *
+ * Determines whether a given path is relative (i.e., not absolute). A path
+ * is considered relative if it does not specify a location from the root of
+ * the file system.
+ *
+ * Relative paths include:
+ * - Paths starting with `.` or `..` (e.g., `./src`, `../lib`)
+ * - Paths without leading separators (e.g., `src/file.js`)
+ * - Empty strings (treated as relative)
+ *
+ * @param {string | Buffer | URL} pathLike - The path to check
+ * @returns {boolean} `true` if the path is relative, `false` if absolute
+ *
+ * @example
+ * ```typescript
+ * // Relative paths
+ * isRelative('./src/index.js')       // true
+ * isRelative('../lib/util.js')       // true
+ * isRelative('src/file.js')          // true
+ * isRelative('')                     // true
+ *
+ * // Absolute paths
+ * isRelative('/home/user')           // false
+ * isRelative('C:\\Windows')          // false (Windows)
+ * isRelative('\\\\server\\share')    // false (Windows UNC)
+ * ```
  */
 /*@__NO_SIDE_EFFECTS__*/
 export function isRelative(pathLike: string | Buffer | URL): boolean {
@@ -230,6 +362,57 @@ export function isRelative(pathLike: string | Buffer | URL): boolean {
 
 /**
  * Normalize a path by converting backslashes to forward slashes and collapsing segments.
+ *
+ * This function performs several normalization operations:
+ * - Converts all backslashes (`\`) to forward slashes (`/`)
+ * - Collapses repeated slashes into single slashes
+ * - Resolves `.` (current directory) segments
+ * - Resolves `..` (parent directory) segments
+ * - Preserves UNC path prefixes (`//server/share`)
+ * - Preserves Windows namespace prefixes (`//./`, `//?/`)
+ * - Returns `.` for empty or collapsed paths
+ *
+ * Special handling:
+ * - UNC paths: Maintains double leading slashes for `//server/share` format
+ * - Windows namespaces: Preserves `//./` and `//?/` prefixes
+ * - Leading `..` segments: Preserved in relative paths without prefix
+ * - Trailing components: Properly handled when resolving `..`
+ *
+ * @param {string | Buffer | URL} pathLike - The path to normalize
+ * @returns {string} The normalized path with forward slashes and collapsed segments
+ *
+ * @security
+ * **WARNING**: This function resolves `..` patterns as part of normalization, which means
+ * paths like `/../etc/passwd` become `/etc/passwd`. When processing untrusted user input
+ * (HTTP requests, file uploads, URL parameters), you MUST validate for path traversal
+ * attacks BEFORE calling this function. Check for patterns like `..`, `%2e%2e`, `\..`,
+ * and other traversal encodings first.
+ *
+ * @example
+ * ```typescript
+ * // Basic normalization
+ * normalizePath('foo/bar//baz')              // 'foo/bar/baz'
+ * normalizePath('foo/./bar')                 // 'foo/bar'
+ * normalizePath('foo/bar/../baz')            // 'foo/baz'
+ *
+ * // Windows paths
+ * normalizePath('C:\\Users\\username\\file.txt') // 'C:/Users/username/file.txt'
+ * normalizePath('foo\\bar\\baz')                 // 'foo/bar/baz'
+ *
+ * // UNC paths
+ * normalizePath('\\\\server\\share\\file')   // '//server/share/file'
+ *
+ * // Edge cases
+ * normalizePath('')                          // '.'
+ * normalizePath('.')                         // '.'
+ * normalizePath('..')                        // '..'
+ * normalizePath('///foo///bar///')           // '/foo/bar'
+ * normalizePath('foo/../..')                 // '..'
+ *
+ * // Security: Path traversal is resolved (intended behavior for trusted paths)
+ * normalizePath('/../etc/passwd')            // '/etc/passwd' ⚠️
+ * normalizePath('/safe/../../unsafe')        // '/unsafe' ⚠️
+ * ```
  */
 /*@__NO_SIDE_EFFECTS__*/
 export function normalizePath(pathLike: string | Buffer | URL): string {
@@ -456,6 +639,45 @@ export function normalizePath(pathLike: string | Buffer | URL): string {
 
 /**
  * Convert a path-like value to a string.
+ *
+ * Converts various path-like types (string, Buffer, URL) into a normalized
+ * string representation. This function handles different input formats and
+ * provides consistent string output for path operations.
+ *
+ * Supported input types:
+ * - `string`: Returned as-is
+ * - `Buffer`: Decoded as UTF-8 string
+ * - `URL`: Converted using `fileURLToPath()`, with fallback for malformed URLs
+ * - `null` / `undefined`: Returns empty string
+ *
+ * URL handling:
+ * - Valid file URLs are converted via `url.fileURLToPath()`
+ * - Malformed URLs fall back to pathname extraction with decoding
+ * - Windows drive letters in URLs are handled specially
+ * - Percent-encoded characters are decoded (e.g., `%20` becomes space)
+ *
+ * @param {string | Buffer | URL | null | undefined} pathLike - The path-like value to convert
+ * @returns {string} The string representation of the path, or empty string for null/undefined
+ *
+ * @example
+ * ```typescript
+ * // String input
+ * pathLikeToString('/home/user')                        // '/home/user'
+ *
+ * // Buffer input
+ * pathLikeToString(Buffer.from('/tmp/file'))            // '/tmp/file'
+ *
+ * // URL input
+ * pathLikeToString(new URL('file:///home/user'))        // '/home/user'
+ * pathLikeToString(new URL('file:///C:/Windows'))       // 'C:/Windows' (Windows)
+ *
+ * // Null/undefined input
+ * pathLikeToString(null)                                // ''
+ * pathLikeToString(undefined)                           // ''
+ *
+ * // Percent-encoded URLs
+ * pathLikeToString(new URL('file:///path%20with%20spaces'))  // '/path with spaces'
+ * ```
  */
 /*@__NO_SIDE_EFFECTS__*/
 export function pathLikeToString(
@@ -495,7 +717,6 @@ export function pathLikeToString(
       // On Windows, strip the leading slash only for malformed URLs that lack drive letters
       // (e.g., `/path` should be `path`, but `/C:/path` should be `C:/path`).
       // On Unix, keep the leading slash for absolute paths (e.g., `/home/user`).
-      const WIN32 = require('../constants/platform').WIN32
       if (WIN32 && decodedPathname.startsWith('/')) {
         // Check for drive letter pattern following Node.js source: /[a-zA-Z]:/
         // Character at index 1 should be a letter, character at index 2 should be ':'
@@ -523,6 +744,41 @@ export function pathLikeToString(
 
 /**
  * Split a path into an array of segments.
+ *
+ * Divides a path into individual components by splitting on path separators
+ * (both forward slashes and backslashes). This is useful for path traversal,
+ * analysis, and manipulation.
+ *
+ * The function handles:
+ * - Forward slashes (`/`) on all platforms
+ * - Backslashes (`\`) on Windows
+ * - Mixed separators in a single path
+ * - Empty paths (returns empty array)
+ *
+ * Note: The resulting array may contain empty strings if the path has leading,
+ * trailing, or consecutive separators (e.g., `/foo//bar/` becomes `['', 'foo', '', 'bar', '']`).
+ *
+ * @param {string | Buffer | URL} pathLike - The path to split
+ * @returns {string[]} Array of path segments, or empty array for empty paths
+ *
+ * @example
+ * ```typescript
+ * // POSIX paths
+ * splitPath('/home/user/file.txt')      // ['', 'home', 'user', 'file.txt']
+ * splitPath('src/lib/util.js')          // ['src', 'lib', 'util.js']
+ *
+ * // Windows paths
+ * splitPath('C:\\Users\\John')          // ['C:', 'Users', 'John']
+ * splitPath('folder\\file.txt')         // ['folder', 'file.txt']
+ *
+ * // Mixed separators
+ * splitPath('path/to\\file')            // ['path', 'to', 'file']
+ *
+ * // Edge cases
+ * splitPath('')                         // []
+ * splitPath('/')                        // ['', '']
+ * splitPath('/foo//bar/')               // ['', 'foo', '', 'bar', '']
+ * ```
  */
 /*@__NO_SIDE_EFFECTS__*/
 export function splitPath(pathLike: string | Buffer | URL): string[] {
@@ -535,6 +791,31 @@ export function splitPath(pathLike: string | Buffer | URL): string[] {
 
 /**
  * Remove leading ./ or ../ from a path.
+ *
+ * Strips the `./` or `.\` prefix from relative paths. This is useful for
+ * normalizing paths when the current directory reference is implicit or
+ * unwanted.
+ *
+ * Note: This function only removes a single leading `./` or `.\`. It does
+ * not remove `../` prefixes or process the rest of the path.
+ *
+ * @param {string | Buffer | URL} pathLike - The path to process
+ * @returns {string} The path without leading `./` or `.\`, or unchanged if no such prefix
+ *
+ * @example
+ * ```typescript
+ * // Remove ./ prefix
+ * trimLeadingDotSlash('./src/index.js')     // 'src/index.js'
+ * trimLeadingDotSlash('.\\src\\file.txt')   // 'src\\file.txt'
+ *
+ * // Preserve ../ prefix
+ * trimLeadingDotSlash('../lib/util.js')     // '../lib/util.js'
+ *
+ * // No change for other paths
+ * trimLeadingDotSlash('/absolute/path')     // '/absolute/path'
+ * trimLeadingDotSlash('relative/path')      // 'relative/path'
+ * trimLeadingDotSlash('.')                  // '.'
+ * ```
  */
 /*@__NO_SIDE_EFFECTS__*/
 export function trimLeadingDotSlash(pathLike: string | Buffer | URL): string {
@@ -549,17 +830,40 @@ export function trimLeadingDotSlash(pathLike: string | Buffer | URL): string {
 /**
  * Resolve an absolute path from path segments.
  *
- * This function mimics Node.js path.resolve() behavior by:
- * 1. Processing segments from right to left
- * 2. Stopping when an absolute path is found
- * 3. Prepending current working directory if no absolute path found
- * 4. Normalizing the final path
- *
- * Examples:
- * - resolve('foo', 'bar', 'baz') → '/cwd/foo/bar/baz'
- * - resolve('/foo', 'bar', 'baz') → '/foo/bar/baz'
- * - resolve('foo', '/bar', 'baz') → '/bar/baz'
- * - resolve('C:\\foo', 'bar') → 'C:/foo/bar' (Windows)
+ * This function mimics Node.js `path.resolve()` behavior by building an
+ * absolute path from the given segments. It processes segments from right
+ * to left, stopping when an absolute path is encountered. If no absolute
+ * path is found, it prepends the current working directory.
+ *
+ * Algorithm:
+ * 1. Process segments from right to left
+ * 2. Stop when an absolute path is found
+ * 3. Prepend current working directory if no absolute path found
+ * 4. Normalize the final path
+ *
+ * Key behaviors:
+ * - Later segments override earlier ones (e.g., `resolve('/foo', '/bar')` returns `/bar`)
+ * - Empty or non-string segments are skipped
+ * - Result is always an absolute path
+ * - Path separators are normalized to forward slashes
+ *
+ * @param {...string} segments - Path segments to resolve
+ * @returns {string} The resolved absolute path
+ *
+ * @example
+ * ```typescript
+ * // Basic resolution
+ * resolve('foo', 'bar', 'baz')           // '/cwd/foo/bar/baz' (assuming cwd is '/cwd')
+ * resolve('/foo', 'bar', 'baz')          // '/foo/bar/baz'
+ * resolve('foo', '/bar', 'baz')          // '/bar/baz'
+ *
+ * // Windows paths
+ * resolve('C:\\foo', 'bar')              // 'C:/foo/bar'
+ *
+ * // Empty segments
+ * resolve('foo', '', 'bar')              // '/cwd/foo/bar'
+ * resolve()                              // '/cwd' (current directory)
+ * ```
  */
 /*@__NO_SIDE_EFFECTS__*/
 function resolve(...segments: string[]): string {
@@ -601,28 +905,44 @@ function resolve(...segments: string[]): string {
 /**
  * Calculate the relative path from one path to another.
  *
- * This function computes how to get from `from` to `to` using relative path notation.
- * Both paths are first resolved to absolute paths, then compared to find the common
- * base path, and finally a relative path is constructed using '../' for parent
- * directory traversal.
+ * This function computes how to get from the `from` path to the `to` path
+ * using relative path notation. Both paths are first resolved to absolute
+ * paths, then compared to find the common base path, and finally a relative
+ * path is constructed using `../` for parent directory traversal.
  *
  * Algorithm:
  * 1. Resolve both paths to absolute
  * 2. Find the longest common path prefix (up to a separator)
- * 3. For each remaining directory in `from`, add '../' to go up
+ * 3. For each remaining directory in `from`, add `../` to go up
  * 4. Append the remaining path from `to`
  *
  * Windows-specific behavior:
  * - File system paths are case-insensitive on Windows (NTFS, FAT32)
- * - 'C:\Foo' and 'c:\foo' are considered the same path
+ * - `C:\Foo` and `c:\foo` are considered the same path
  * - Reference: https://learn.microsoft.com/en-us/windows/win32/fileio/naming-a-file
  * - Case is preserved but not significant for comparison
  *
- * Examples:
- * - relative('/foo/bar', '/foo/baz') → '../baz'
- * - relative('/foo/bar/baz', '/foo') → '../..'
- * - relative('/foo', '/foo/bar') → 'bar'
- * - relative('C:\\foo\\bar', 'C:\\foo\\baz') → '../baz' (Windows)
+ * @param {string} from - The source path (starting point)
+ * @param {string} to - The destination path (target)
+ * @returns {string} The relative path from `from` to `to`, or empty string if paths are identical
+ *
+ * @example
+ * ```typescript
+ * // Basic relative paths
+ * relative('/foo/bar', '/foo/baz')           // '../baz'
+ * relative('/foo/bar/baz', '/foo')           // '../..'
+ * relative('/foo', '/foo/bar')               // 'bar'
+ *
+ * // Same paths
+ * relative('/foo/bar', '/foo/bar')           // ''
+ *
+ * // Windows case-insensitive
+ * relative('C:\\Foo\\bar', 'C:\\foo\\baz')   // '../baz' (Windows)
+ *
+ * // Root paths
+ * relative('/', '/foo/bar')                  // 'foo/bar'
+ * relative('/foo/bar', '/')                  // '../..'
+ * ```
  */
 /*@__NO_SIDE_EFFECTS__*/
 function relative(from: string, to: string): string {
@@ -641,8 +961,6 @@ function relative(from: string, to: string): string {
     return ''
   }
 
-  const WIN32 = require('../constants/platform').WIN32
-
   // Windows: perform case-insensitive comparison.
   // NTFS and FAT32 preserve case but are case-insensitive for lookups.
   // This means 'C:\Foo\bar.txt' and 'c:\foo\BAR.TXT' refer to the same file.
@@ -673,17 +991,30 @@ function relative(from: string, to: string): string {
   let i = 0
 
   for (; i < length; i += 1) {
-    const fromCode = actualFrom.charCodeAt(fromStart + i)
-    const toCode = actualTo.charCodeAt(toStart + i)
+    let fromCode = actualFrom.charCodeAt(fromStart + i)
+    let toCode = actualTo.charCodeAt(toStart + i)
 
     // Paths diverge at this character.
+    // On Windows, perform case-insensitive comparison.
+    if (WIN32) {
+      // Normalize to lowercase for case-insensitive comparison.
+      // Convert A-Z (65-90) to a-z (97-122).
+      if (fromCode >= CHAR_UPPERCASE_A && fromCode <= CHAR_UPPERCASE_Z) {
+        fromCode += 32
+      }
+      if (toCode >= CHAR_UPPERCASE_A && toCode <= CHAR_UPPERCASE_Z) {
+        toCode += 32
+      }
+    }
+
     if (fromCode !== toCode) {
       break
     }
 
     // Track directory separators (both forward and backslash for Windows compatibility).
     // We need this to ensure we only split at directory boundaries.
-    if (isPathSeparator(fromCode)) {
+    // Use original fromCode from actualFrom (before case normalization).
+    if (isPathSeparator(actualFrom.charCodeAt(fromStart + i))) {
       lastCommonSep = i
     }
   }
@@ -742,6 +1073,37 @@ function relative(from: string, to: string): string {
 
 /**
  * Get the relative path from one path to another.
+ *
+ * Computes the relative path from `from` to `to` and normalizes the result.
+ * This is a convenience wrapper around the `relative()` function that adds
+ * path normalization (converting separators and collapsing segments).
+ *
+ * The function:
+ * 1. Calculates the relative path using `relative()`
+ * 2. Normalizes the result using `normalizePath()`
+ * 3. Preserves empty strings (same path) without converting to `.`
+ *
+ * @param {string} from - The source path (starting point)
+ * @param {string} to - The destination path (target)
+ * @returns {string} The normalized relative path from `from` to `to`, or empty string if paths are identical
+ *
+ * @example
+ * ```typescript
+ * // Basic usage
+ * relativeResolve('/foo/bar', '/foo/baz')         // '../baz'
+ * relativeResolve('/foo/bar/baz', '/foo')         // '../..'
+ * relativeResolve('/foo', '/foo/bar')             // 'bar'
+ *
+ * // Same paths
+ * relativeResolve('/foo/bar', '/foo/bar')         // ''
+ *
+ * // Windows paths (normalized)
+ * relativeResolve('C:\\foo\\bar', 'C:\\foo\\baz') // '../baz'
+ *
+ * // With normalization
+ * relativeResolve('/foo/./bar', '/foo/baz')       // '../baz'
+ * relativeResolve('/foo/bar/../baz', '/foo/qux')  // '../qux'
+ * ```
  */
 /*@__NO_SIDE_EFFECTS__*/
 export function relativeResolve(from: string, to: string): string {
diff --git a/src/paths.ts b/src/paths.ts
index 43f7811..b637f4b 100644
--- a/src/paths.ts
+++ b/src/paths.ts
@@ -4,19 +4,45 @@
  *
  * Directory Structure:
  * ~/.socket/
- * ├── _cacache/           # Content-addressable cache (shared)
- * ├── _dlx/               # DLX tool installations (shared)
+ * ├── _cacache/           # Content-addressable cache for npm packages
+ * ├── _dlx/               # DLX installations (content-addressed by hash)
+ * │   ├── <hash>/         # npm package installs (dlx-package)
+ * │   └── <hash>/         # binary downloads (dlx-binary)
  * ├── _socket/            # Socket CLI app directory
  * ├── _registry/          # Socket Registry app directory
  * └── _sfw/               # Socket Firewall app directory
  */
 
-import * as os from 'node:os'
-import * as path from 'node:path'
+import * as os from 'os'
+import * as path from 'path'
 
-import { SOCKET_CACACHE_DIR } from '#env/socket-cacache-dir'
+import { getHome } from '#env/home'
+import {
+  getSocketCacacheDir as getSocketCacacheDirEnv,
+  getSocketDlxDirEnv,
+} from '#env/socket'
+import { getUserprofile } from '#env/windows'
 
 import { normalizePath } from './path'
+import { getPathValue, registerCacheInvalidation } from './paths/rewire'
+
+/**
+ * Get the OS home directory.
+ * Can be overridden in tests using setPath('homedir', ...) from paths/rewire.
+ */
+export function getOsHomeDir(): string {
+  // Always check for overrides - don't cache when using rewire
+  return getPathValue('homedir', () => os.homedir())
+}
+
+/**
+ * Get the OS temporary directory.
+ * Can be overridden in tests using setPath('tmpdir', ...) from paths/rewire.
+ */
+export function getOsTmpDir(): string {
+  // Always check for overrides - don't cache when using rewire
+  return getPathValue('tmpdir', () => os.tmpdir())
+}
 
 /**
  * Get the Socket home directory (~/.socket).
@@ -26,16 +52,22 @@ export function getSocketHomePath(): string {
   return getSocketUserDir()
 }
 
+let _cachedSocketUserDir: string | undefined
+
 /**
  * Get the Socket user directory (~/.socket).
+ * Result is memoized for performance.
  */
 export function getSocketUserDir(): string {
-  return normalizePath(
-    path.join(
-      os.homedir(),
-      /*@__INLINE__*/ require('./constants/paths').DOT_SOCKET_DIR,
-    ),
-  )
+  if (_cachedSocketUserDir === undefined) {
+    _cachedSocketUserDir = normalizePath(
+      path.join(
+        getUserHomeDir(),
+        /*@__INLINE__*/ require('#constants/paths').DOT_SOCKET_DIR,
+      ),
+    )
+  }
+  return _cachedSocketUserDir
 }
 
 /**
@@ -45,35 +77,48 @@ export function getSocketAppDir(appName: string): string {
   return normalizePath(
     path.join(
       getSocketUserDir(),
-      `${/*@__INLINE__*/ require('./constants/socket').SOCKET_APP_PREFIX}${appName}`,
+      `${/*@__INLINE__*/ require('#constants/socket').SOCKET_APP_PREFIX}${appName}`,
     ),
   )
 }
 
+let _cachedSocketCacacheDir: string | undefined
+
 /**
  * Get the Socket cacache directory (~/.socket/_cacache).
  * Can be overridden with SOCKET_CACACHE_DIR environment variable for testing.
+ * Result is memoized for performance.
  */
 export function getSocketCacacheDir(): string {
-  if (SOCKET_CACACHE_DIR) {
-    return normalizePath(SOCKET_CACACHE_DIR)
+  if (_cachedSocketCacacheDir === undefined) {
+    if (getSocketCacacheDirEnv()) {
+      _cachedSocketCacacheDir = normalizePath(
+        getSocketCacacheDirEnv() as string,
+      )
+    } else {
+      _cachedSocketCacacheDir = normalizePath(
+        path.join(
+          getSocketUserDir(),
+          `${/*@__INLINE__*/ require('#constants/socket').SOCKET_APP_PREFIX}cacache`,
+        ),
+      )
+    }
   }
-  return normalizePath(
-    path.join(
-      getSocketUserDir(),
-      `${/*@__INLINE__*/ require('./constants/socket').SOCKET_APP_PREFIX}cacache`,
-    ),
-  )
+  return _cachedSocketCacacheDir
 }
 
 /**
  * Get the Socket DLX directory (~/.socket/_dlx).
+ * Can be overridden with SOCKET_DLX_DIR environment variable for testing.
  */
 export function getSocketDlxDir(): string {
+  if (getSocketDlxDirEnv()) {
+    return normalizePath(getSocketDlxDirEnv() as string)
+  }
   return normalizePath(
     path.join(
       getSocketUserDir(),
-      `${/*@__INLINE__*/ require('./constants/socket').SOCKET_APP_PREFIX}${/*@__INLINE__*/ require('./constants/socket').SOCKET_DLX_APP_NAME}`,
+      `${/*@__INLINE__*/ require('#constants/socket').SOCKET_APP_PREFIX}${/*@__INLINE__*/ require('#constants/socket').SOCKET_DLX_APP_NAME}`,
     ),
   )
 }
@@ -85,7 +130,7 @@ export function getSocketAppCacheDir(appName: string): string {
   return normalizePath(
     path.join(
       getSocketAppDir(appName),
-      /*@__INLINE__*/ require('./constants/paths').CACHE_DIR,
+      /*@__INLINE__*/ require('#constants/paths').CACHE_DIR,
     ),
   )
 }
@@ -97,7 +142,7 @@ export function getSocketAppCacheTtlDir(appName: string): string {
   return normalizePath(
     path.join(
       getSocketAppCacheDir(appName),
-      /*@__INLINE__*/ require('./constants/paths').CACHE_TTL_DIR,
+      /*@__INLINE__*/ require('#constants/paths').CACHE_TTL_DIR,
     ),
   )
 }
@@ -107,7 +152,7 @@ export function getSocketAppCacheTtlDir(appName: string): string {
  */
 export function getSocketCliDir(): string {
   return getSocketAppDir(
-    /*@__INLINE__*/ require('./constants/socket').SOCKET_CLI_APP_NAME,
+    /*@__INLINE__*/ require('#constants/socket').SOCKET_CLI_APP_NAME,
   )
 }
 
@@ -116,7 +161,7 @@ export function getSocketCliDir(): string {
  */
 export function getSocketRegistryDir(): string {
   return getSocketAppDir(
-    /*@__INLINE__*/ require('./constants/socket').SOCKET_REGISTRY_APP_NAME,
+    /*@__INLINE__*/ require('#constants/socket').SOCKET_REGISTRY_APP_NAME,
   )
 }
 
@@ -127,9 +172,43 @@ export function getSocketRegistryGithubCacheDir(): string {
   return normalizePath(
     path.join(
       getSocketAppCacheTtlDir(
-        /*@__INLINE__*/ require('./constants/socket').SOCKET_REGISTRY_APP_NAME,
+        /*@__INLINE__*/ require('#constants/socket').SOCKET_REGISTRY_APP_NAME,
       ),
-      /*@__INLINE__*/ require('./constants/github').CACHE_GITHUB_DIR,
+      /*@__INLINE__*/ require('#constants/github').CACHE_GITHUB_DIR,
     ),
   )
 }
+
+/**
+ * Get the user's home directory.
+ * Uses environment variables directly to support test mocking.
+ * Falls back to os.homedir() if env vars not set.
+ */
+export function getUserHomeDir(): string {
+  // Try HOME first (Unix)
+  const home = getHome()
+  if (home) {
+    return home
+  }
+  // Try USERPROFILE (Windows)
+  const userProfile = getUserprofile()
+  if (userProfile) {
+    return userProfile
+  }
+  // Fallback to os.homedir()
+  return getOsHomeDir()
+}
+
+/**
+ * Invalidate all cached path values.
+ * Called automatically by the paths/rewire module when setPath/clearPath/resetPaths are used.
+ *
+ * @internal Used for test rewiring
+ */
+export function invalidateCache(): void {
+  _cachedSocketUserDir = undefined
+  _cachedSocketCacacheDir = undefined
+}
+
+// Register cache invalidation with the rewire module
+registerCacheInvalidation(invalidateCache)
diff --git a/src/paths/rewire.ts b/src/paths/rewire.ts
new file mode 100644
index 0000000..d088869
--- /dev/null
+++ b/src/paths/rewire.ts
@@ -0,0 +1,140 @@
+/**
+ * @fileoverview Path rewiring utilities for testing.
+ * Allows tests to override os.tmpdir() and os.homedir() without directly modifying them.
+ *
+ * Features:
+ * - Test-friendly setPath/clearPath/resetPaths that work in beforeEach/afterEach
+ * - Automatic cache invalidation for path-dependent modules
+ * - Thread-safe for concurrent test execution
+ */
+
+// Per-test overrides
+// Each test file gets its own instance due to Vitest's module isolation
+const testOverrides = new Map<string, string | undefined>()
+
+// Cache for computed values (cleared when overrides change)
+const valueCache = new Map<string, string>()
+
+// Cache invalidation callbacks - registered by modules that need to clear their caches
+const cacheInvalidationCallbacks: Array<() => void> = []
+
+/**
+ * Clear a specific path override.
+ */
+export function clearPath(key: string): void {
+  testOverrides.delete(key)
+  // Invalidate all path-related caches
+  invalidateCaches()
+}
+
+/**
+ * Get a path value, checking overrides first.
+ *
+ * Resolution order:
+ * 1. Test overrides (set via setPath in beforeEach)
+ * 2. Cached value (for performance)
+ * 3. Original function call (cached for subsequent calls)
+ *
+ * @internal Used by path getters to support test rewiring
+ */
+export function getPathValue(key: string, originalFn: () => string): string {
+  // Check test overrides first
+  if (testOverrides.has(key)) {
+    return testOverrides.get(key) as string
+  }
+
+  // Check cache
+  if (valueCache.has(key)) {
+    return valueCache.get(key) as string
+  }
+
+  // Compute and cache
+  const value = originalFn()
+  valueCache.set(key, value)
+  return value
+}
+
+/**
+ * Check if a path has been overridden.
+ */
+export function hasOverride(key: string): boolean {
+  return testOverrides.has(key)
+}
+
+/**
+ * Invalidate all cached paths.
+ * Called automatically when setPath/clearPath/resetPaths are used.
+ * Can also be called manually for advanced testing scenarios.
+ *
+ * @internal Primarily for internal use, but exported for advanced testing
+ */
+export function invalidateCaches(): void {
+  // Clear the value cache
+  valueCache.clear()
+
+  // Call registered callbacks
+  for (const callback of cacheInvalidationCallbacks) {
+    try {
+      callback()
+    } catch {
+      // Ignore errors from cache invalidation
+    }
+  }
+}
+
+/**
+ * Register a cache invalidation callback.
+ * Called by modules that need to clear their caches when paths change.
+ *
+ * @internal Used by paths.ts and fs.ts
+ */
+export function registerCacheInvalidation(callback: () => void): void {
+  cacheInvalidationCallbacks.push(callback)
+}
+
+/**
+ * Clear all path overrides and reset caches.
+ * Useful in afterEach hooks to ensure clean test state.
+ *
+ * @example
+ * ```typescript
+ * import { resetPaths } from '#paths/rewire'
+ *
+ * afterEach(() => {
+ *   resetPaths()
+ * })
+ * ```
+ */
+export function resetPaths(): void {
+  testOverrides.clear()
+  // Invalidate all path-related caches
+  invalidateCaches()
+}
+
+/**
+ * Set a path override for testing.
+ * This triggers cache invalidation for path-dependent modules.
+ *
+ * @example
+ * ```typescript
+ * import { setPath, resetPaths } from '#paths/rewire'
+ * import { getOsTmpDir } from '#lib/paths'
+ *
+ * beforeEach(() => {
+ *   setPath('tmpdir', '/custom/tmp')
+ * })
+ *
+ * afterEach(() => {
+ *   resetPaths()
+ * })
+ *
+ * it('should use custom temp directory', () => {
+ *   expect(getOsTmpDir()).toBe('/custom/tmp')
+ * })
+ * ```
+ */
+export function setPath(key: string, value: string | undefined): void {
+  testOverrides.set(key, value)
+  // Invalidate all path-related caches
+  invalidateCaches()
+}
diff --git a/src/performance.ts b/src/performance.ts
index edd383c..545d127 100644
--- a/src/performance.ts
+++ b/src/performance.ts
@@ -36,7 +36,7 @@ function isPerfEnabled(): boolean {
  * @returns Stop function that completes the timing
  *
  * @example
- * import { perfTimer } from '@socketsecurity/registry/lib/performance'
+ * import { perfTimer } from '@socketsecurity/lib/performance'
  *
  * const stop = perfTimer('api-call')
  * await fetchData()
@@ -78,7 +78,7 @@ export function perfTimer(
  * @returns Result of the function and duration
  *
  * @example
- * import { measure } from '@socketsecurity/registry/lib/performance'
+ * import { measure } from '@socketsecurity/lib/performance'
  *
  * const { result, duration } = await measure('fetch-packages', async () => {
  *   return await fetchPackages()
@@ -116,7 +116,7 @@ export async function measure<T>(
  * @returns Result of the function and duration
  *
  * @example
- * import { measureSync } from '@socketsecurity/registry/lib/performance'
+ * import { measureSync } from '@socketsecurity/lib/performance'
  *
  * const { result, duration } = measureSync('parse-json', () => {
  *   return JSON.parse(data)
@@ -151,7 +151,7 @@ export function measureSync<T>(
  * @returns Array of performance metrics
  *
  * @example
- * import { getPerformanceMetrics } from '@socketsecurity/registry/lib/performance'
+ * import { getPerformanceMetrics } from '@socketsecurity/lib/performance'
  *
  * const metrics = getPerformanceMetrics()
  * console.log(metrics)
@@ -164,7 +164,7 @@ export function getPerformanceMetrics(): PerformanceMetrics[] {
  * Clear all collected performance metrics.
  *
  * @example
- * import { clearPerformanceMetrics } from '@socketsecurity/registry/lib/performance'
+ * import { clearPerformanceMetrics } from '@socketsecurity/lib/performance'
  *
  * clearPerformanceMetrics()
  */
@@ -179,7 +179,7 @@ export function clearPerformanceMetrics(): void {
  * @returns Summary of metrics grouped by operation
  *
  * @example
- * import { getPerformanceSummary } from '@socketsecurity/registry/lib/performance'
+ * import { getPerformanceSummary } from '@socketsecurity/lib/performance'
  *
  * const summary = getPerformanceSummary()
  * console.log(summary)
@@ -251,7 +251,7 @@ export function getPerformanceSummary(): Record<
  * Only prints when DEBUG=perf is enabled.
  *
  * @example
- * import { printPerformanceSummary } from '@socketsecurity/registry/lib/performance'
+ * import { printPerformanceSummary } from '@socketsecurity/lib/performance'
  *
  * printPerformanceSummary()
  * // Performance Summary:
@@ -292,7 +292,7 @@ export function printPerformanceSummary(): void {
  * @param metadata - Optional metadata
  *
  * @example
- * import { perfCheckpoint } from '@socketsecurity/registry/lib/performance'
+ * import { perfCheckpoint } from '@socketsecurity/lib/performance'
  *
  * perfCheckpoint('start-scan')
  * // ... do work ...
@@ -328,7 +328,7 @@ export function perfCheckpoint(
  * @returns Memory usage in MB
  *
  * @example
- * import { trackMemory } from '@socketsecurity/registry/lib/performance'
+ * import { trackMemory } from '@socketsecurity/lib/performance'
  *
  * const memBefore = trackMemory('before-operation')
  * await heavyOperation()
@@ -368,7 +368,7 @@ export function trackMemory(label: string): number {
  * @returns Formatted performance report
  *
  * @example
- * import { generatePerformanceReport } from '@socketsecurity/registry/lib/performance'
+ * import { generatePerformanceReport } from '@socketsecurity/lib/performance'
  *
  * console.log(generatePerformanceReport())
  * // ╔═══════════════════════════════════════════════╗
diff --git a/src/process-lock.ts b/src/process-lock.ts
new file mode 100644
index 0000000..1547930
--- /dev/null
+++ b/src/process-lock.ts
@@ -0,0 +1,411 @@
+/**
+ * @fileoverview Process locking utilities with stale detection and exit cleanup.
+ * Provides cross-platform inter-process synchronization using directory-based locks.
+ * Aligned with npm's npx locking strategy (5-second stale timeout, periodic touching).
+ *
+ * ## Why directories instead of files?
+ *
+ * This implementation uses `mkdir()` to create lock directories (not files) because:
+ *
+ * 1. **Atomic guarantee**: `mkdir()` is guaranteed atomic across ALL filesystems,
+ *    including NFS. Only ONE process can successfully create the directory. If it
+ *    exists, `mkdir()` fails with EEXIST instantly with no race conditions.
+ *
+ * 2. **File-based locking issues**:
+ *    - `writeFile()` with `flag: 'wx'` - atomicity can fail on NFS
+ *    - `open()` with `O_EXCL` - not guaranteed atomic on older NFS
+ *    - Traditional lockfiles - can have race conditions on network filesystems
+ *
+ * 3. **Simplicity**: No need to write/read file content, track PIDs, or manage
+ *    file descriptors. Just create/delete directory and check mtime.
+ *
+ * 4. **Historical precedent**: Well-known Unix locking pattern used by package
+ *    managers for decades. Git uses similar approach for `.git/index.lock`.
+ *
+ * ## The mtime trick
+ *
+ * We periodically update the lock directory's mtime (modification time) by
+ * "touching" it to signal "I'm still actively working". This prevents other
+ * processes from treating the lock as stale and removing it.
+ *
+ * **The lock directory remains empty** - it's just a sentinel that signals
+ * "locked". The mtime is the only data needed to track lock freshness.
+ *
+ * ## npm npx compatibility
+ *
+ * This implementation matches npm npx's concurrency.lock approach:
+ * - Lock created via `mkdir(path.join(installDir, 'concurrency.lock'))`
+ * - 5-second stale timeout (if mtime is older than 5s, lock is stale)
+ * - 2-second touching interval (updates mtime every 2s to keep lock fresh)
+ * - Automatic cleanup on process exit
+ */
+
+import { existsSync, mkdirSync, statSync, utimesSync } from 'fs'
+
+import { safeDeleteSync } from './fs'
+import { getDefaultLogger } from './logger'
+import { pRetry } from './promises'
+import { onExit } from './signal-exit'
+
+const logger = getDefaultLogger()
+
+/**
+ * Lock acquisition options.
+ */
+export interface ProcessLockOptions {
+  /**
+   * Maximum number of retry attempts.
+   * @default 3
+   */
+  retries?: number | undefined
+
+  /**
+   * Base delay between retries in milliseconds.
+   * @default 100
+   */
+  baseDelayMs?: number | undefined
+
+  /**
+   * Maximum delay between retries in milliseconds.
+   * @default 1000
+   */
+  maxDelayMs?: number | undefined
+
+  /**
+   * Stale lock timeout in milliseconds.
+   * Locks older than this are considered abandoned and can be reclaimed.
+   * Aligned with npm's npx locking strategy (5 seconds).
+   * @default 5000 (5 seconds)
+   */
+  staleMs?: number | undefined
+
+  /**
+   * Interval for touching lock file to keep it fresh in milliseconds.
+   * Set to 0 to disable periodic touching.
+   * @default 2000 (2 seconds)
+   */
+  touchIntervalMs?: number | undefined
+}
+
+/**
+ * Process lock manager with stale detection and exit cleanup.
+ * Provides cross-platform inter-process synchronization using file-system
+ * based locks.
+ */
+class ProcessLockManager {
+  private activeLocks = new Set<string>()
+  private touchTimers = new Map<string, NodeJS.Timeout>()
+  private exitHandlerRegistered = false
+
+  /**
+   * Ensure process exit handler is registered for cleanup.
+   * Registers a handler that cleans up all active locks when the process exits.
+   */
+  private ensureExitHandler() {
+    if (this.exitHandlerRegistered) {
+      return
+    }
+
+    onExit(() => {
+      // Clear all touch timers.
+      for (const timer of this.touchTimers.values()) {
+        clearInterval(timer)
+      }
+      this.touchTimers.clear()
+
+      // Clean up all active locks.
+      for (const lockPath of this.activeLocks) {
+        try {
+          if (existsSync(lockPath)) {
+            safeDeleteSync(lockPath, { recursive: true })
+          }
+        } catch {
+          // Ignore cleanup errors during exit.
+        }
+      }
+    })
+
+    this.exitHandlerRegistered = true
+  }
+
+  /**
+   * Touch a lock file to update its mtime.
+   * This prevents the lock from being detected as stale during long operations.
+   *
+   * @param lockPath - Path to the lock directory
+   */
+  private touchLock(lockPath: string): void {
+    try {
+      if (existsSync(lockPath)) {
+        const now = new Date()
+        utimesSync(lockPath, now, now)
+      }
+    } catch (error) {
+      logger.warn(
+        `Failed to touch lock ${lockPath}: ${error instanceof Error ? error.message : String(error)}`,
+      )
+    }
+  }
+
+  /**
+   * Start periodic touching of a lock file.
+   * Aligned with npm npx strategy to prevent false stale detection.
+   *
+   * @param lockPath - Path to the lock directory
+   * @param intervalMs - Touch interval in milliseconds
+   */
+  private startTouchTimer(lockPath: string, intervalMs: number): void {
+    if (intervalMs <= 0 || this.touchTimers.has(lockPath)) {
+      return
+    }
+
+    const timer = setInterval(() => {
+      this.touchLock(lockPath)
+    }, intervalMs)
+
+    // Prevent timer from keeping process alive.
+    timer.unref()
+
+    this.touchTimers.set(lockPath, timer)
+  }
+
+  /**
+   * Stop periodic touching of a lock file.
+   *
+   * @param lockPath - Path to the lock directory
+   */
+  private stopTouchTimer(lockPath: string): void {
+    const timer = this.touchTimers.get(lockPath)
+    if (timer) {
+      clearInterval(timer)
+      this.touchTimers.delete(lockPath)
+    }
+  }
+
+  /**
+   * Check if a lock is stale based on mtime.
+   * Uses second-level granularity to avoid APFS floating-point precision issues.
+   * Aligned with npm's npx locking strategy.
+   *
+   * @param lockPath - Path to the lock directory
+   * @param staleMs - Stale timeout in milliseconds
+   * @returns True if lock exists and is stale
+   */
+  private isStale(lockPath: string, staleMs: number): boolean {
+    try {
+      if (!existsSync(lockPath)) {
+        return false
+      }
+
+      const stats = statSync(lockPath)
+      // Use second-level granularity to avoid APFS issues.
+      const ageSeconds = Math.floor((Date.now() - stats.mtime.getTime()) / 1000)
+      const staleSeconds = Math.floor(staleMs / 1000)
+      return ageSeconds > staleSeconds
+    } catch {
+      return false
+    }
+  }
+
+  /**
+   * Acquire a lock using mkdir for atomic operation.
+   * Handles stale locks and includes exit cleanup.
+   *
+   * This method attempts to create a lock directory atomically. If the lock
+   * already exists, it checks if it's stale and removes it before retrying.
+   * Uses exponential backoff with jitter for retry attempts.
+   *
+   * @param lockPath - Path to the lock directory
+   * @param options - Lock acquisition options
+   * @returns Release function to unlock
+   * @throws Error if lock cannot be acquired after all retries
+   *
+   * @example
+   * ```typescript
+   * const release = await processLock.acquire('/tmp/my-lock')
+   * try {
+   *   // Critical section
+   * } finally {
+   *   release()
+   * }
+   * ```
+   */
+  async acquire(
+    lockPath: string,
+    options: ProcessLockOptions = {},
+  ): Promise<() => void> {
+    const {
+      baseDelayMs = 100,
+      maxDelayMs = 1000,
+      retries = 3,
+      staleMs = 5000,
+      touchIntervalMs = 2000,
+    } = options
+
+    // Ensure exit handler is registered before any lock acquisition.
+    this.ensureExitHandler()
+
+    return await pRetry(
+      async () => {
+        try {
+          // Check for stale lock and remove if necessary.
+          if (existsSync(lockPath) && this.isStale(lockPath, staleMs)) {
+            logger.log(`Removing stale lock: ${lockPath}`)
+            try {
+              safeDeleteSync(lockPath, { recursive: true })
+            } catch {
+              // Ignore errors removing stale lock - will retry.
+            }
+          }
+
+          // Check if lock already exists before creating.
+          if (existsSync(lockPath)) {
+            throw new Error(`Lock already exists: ${lockPath}`)
+          }
+
+          // Atomic lock acquisition via mkdir with recursive to create parent dirs.
+          mkdirSync(lockPath, { recursive: true })
+
+          // Track lock for cleanup.
+          this.activeLocks.add(lockPath)
+
+          // Start periodic touching to prevent stale detection.
+          this.startTouchTimer(lockPath, touchIntervalMs)
+
+          // Return release function.
+          return () => this.release(lockPath)
+        } catch (error) {
+          const code = (error as NodeJS.ErrnoException).code
+
+          // Handle lock contention - lock already exists.
+          if (code === 'EEXIST') {
+            if (this.isStale(lockPath, staleMs)) {
+              throw new Error(`Stale lock detected: ${lockPath}`)
+            }
+            throw new Error(`Lock already exists: ${lockPath}`)
+          }
+
+          // Handle permission errors - not retryable.
+          if (code === 'EACCES' || code === 'EPERM') {
+            throw new Error(
+              `Permission denied creating lock: ${lockPath}. ` +
+                'Check directory permissions or run with appropriate access.',
+              { cause: error },
+            )
+          }
+
+          // Handle read-only filesystem - not retryable.
+          if (code === 'EROFS') {
+            throw new Error(
+              `Cannot create lock on read-only filesystem: ${lockPath}`,
+              { cause: error },
+            )
+          }
+
+          // Handle parent path issues - not retryable.
+          if (code === 'ENOTDIR') {
+            const parentDir = lockPath.slice(0, lockPath.lastIndexOf('/'))
+            throw new Error(
+              `Cannot create lock directory: ${lockPath}\n` +
+                'A path component is a file when it should be a directory.\n' +
+                `Parent path: ${parentDir}\n` +
+                'To resolve:\n' +
+                `  1. Check if "${parentDir}" contains a file instead of a directory\n` +
+                '  2. Remove any conflicting files in the path\n' +
+                '  3. Ensure the full parent directory structure exists',
+              { cause: error },
+            )
+          }
+
+          if (code === 'ENOENT') {
+            const parentDir = lockPath.slice(0, lockPath.lastIndexOf('/'))
+            throw new Error(
+              `Cannot create lock directory: ${lockPath}\n` +
+                `Parent directory does not exist: ${parentDir}\n` +
+                'To resolve:\n' +
+                `  1. Ensure the parent directory "${parentDir}" exists\n` +
+                `  2. Create the directory structure: mkdir -p "${parentDir}"\n` +
+                '  3. Check filesystem permissions allow directory creation',
+              { cause: error },
+            )
+          }
+
+          // Re-throw other errors with context.
+          throw new Error(`Failed to acquire lock: ${lockPath}`, {
+            cause: error,
+          })
+        }
+      },
+      {
+        retries,
+        baseDelayMs,
+        maxDelayMs,
+        jitter: true,
+      },
+    )
+  }
+
+  /**
+   * Release a lock and remove from tracking.
+   * Stops periodic touching and removes the lock directory.
+   *
+   * @param lockPath - Path to the lock directory
+   *
+   * @example
+   * ```typescript
+   * processLock.release('/tmp/my-lock')
+   * ```
+   */
+  release(lockPath: string): void {
+    // Stop periodic touching.
+    this.stopTouchTimer(lockPath)
+
+    try {
+      if (existsSync(lockPath)) {
+        safeDeleteSync(lockPath, { recursive: true })
+      }
+      this.activeLocks.delete(lockPath)
+    } catch (error) {
+      logger.warn(
+        `Failed to release lock ${lockPath}: ${error instanceof Error ? error.message : String(error)}`,
+      )
+    }
+  }
+
+  /**
+   * Execute a function with exclusive lock protection.
+   * Automatically handles lock acquisition, execution, and cleanup.
+   *
+   * This is the recommended way to use process locks, as it guarantees
+   * cleanup even if the callback throws an error.
+   *
+   * @param lockPath - Path to the lock directory
+   * @param fn - Function to execute while holding the lock
+   * @param options - Lock acquisition options
+   * @returns Result of the callback function
+   * @throws Error from callback or lock acquisition failure
+   *
+   * @example
+   * ```typescript
+   * const result = await processLock.withLock('/tmp/my-lock', async () => {
+   *   // Critical section
+   *   return someValue
+   * })
+   * ```
+   */
+  async withLock<T>(
+    lockPath: string,
+    fn: () => Promise<T>,
+    options?: ProcessLockOptions,
+  ): Promise<T> {
+    const release = await this.acquire(lockPath, options)
+    try {
+      return await fn()
+    } finally {
+      release()
+    }
+  }
+}
+
+// Export singleton instance.
+export const processLock = new ProcessLockManager()
diff --git a/src/promises.ts b/src/promises.ts
index 862d4ef..7013b89 100644
--- a/src/promises.ts
+++ b/src/promises.ts
@@ -10,36 +10,198 @@ import { arrayChunk } from './arrays'
 
 const abortSignal = getAbortSignal()
 
+/**
+ * Configuration options for retry behavior with exponential backoff.
+ *
+ * Controls how failed operations are retried, including timing, backoff strategy,
+ * and callback hooks for observing or modifying retry behavior.
+ */
 export interface RetryOptions {
-  args?: unknown[]
-  backoffFactor?: number
-  baseDelayMs?: number
-  factor?: number
-  jitter?: boolean
-  maxDelayMs?: number
-  maxTimeout?: number
-  minTimeout?: number
-  onRetry?: (
-    attempt: number,
-    error: unknown,
-    delay: number,
-  ) => boolean | undefined
-  onRetryCancelOnFalse?: boolean
-  onRetryRethrow?: boolean
-  retries?: number
-  signal?: AbortSignal
+  /**
+   * Arguments to pass to the callback function on each attempt.
+   *
+   * @default []
+   */
+  args?: unknown[] | undefined
+
+  /**
+   * Multiplier for exponential backoff (e.g., 2 doubles delay each retry).
+   * Each retry waits `baseDelayMs * (backoffFactor ** attemptNumber)`.
+   *
+   * @default 2
+   * @example
+   * // With backoffFactor: 2, baseDelayMs: 100
+   * // Retry 1: 100ms
+   * // Retry 2: 200ms
+   * // Retry 3: 400ms
+   */
+  backoffFactor?: number | undefined
+
+  /**
+   * Initial delay before the first retry (in milliseconds).
+   * This is the base value for exponential backoff calculations.
+   *
+   * @default 200
+   */
+  baseDelayMs?: number | undefined
+
+  // REMOVED: Deprecated `factor` option
+  // Migration: Use `backoffFactor` instead
+
+  /**
+   * Whether to apply randomness to spread out retries and avoid thundering herd.
+   * When `true`, adds random delay between 0 and current delay value.
+   *
+   * @default true
+   * @example
+   * // With jitter: true, delay: 100ms
+   * // Actual wait: 100ms + random(0-100ms) = 100-200ms
+   */
+  jitter?: boolean | undefined
+
+  /**
+   * Upper limit for any backoff delay (in milliseconds).
+   * Prevents exponential backoff from growing unbounded.
+   *
+   * @default 10000
+   */
+  maxDelayMs?: number | undefined
+
+  // REMOVED: Deprecated `maxTimeout` option
+  // Migration: Use `maxDelayMs` instead
+
+  // REMOVED: Deprecated `minTimeout` option
+  // Migration: Use `baseDelayMs` instead
+
+  /**
+   * Callback invoked on each retry attempt.
+   * Can observe errors, customize delays, or cancel retries.
+   *
+   * @param attempt - The current attempt number (1-based: 1, 2, 3, ...)
+   * @param error - The error that triggered this retry
+   * @param delay - The calculated delay in milliseconds before next retry
+   * @returns `false` to cancel retries (if `onRetryCancelOnFalse` is `true`),
+   *          a number to override the delay, or `undefined` to use calculated delay
+   *
+   * @example
+   * // Log each retry
+   * onRetry: (attempt, error, delay) => {
+   *   console.log(`Retry ${attempt} after ${delay}ms: ${error}`)
+   * }
+   *
+   * @example
+   * // Cancel retries for specific errors
+   * onRetry: (attempt, error) => {
+   *   if (error instanceof ValidationError) return false
+   * }
+   *
+   * @example
+   * // Use custom delay
+   * onRetry: (attempt) => attempt * 1000 // 1s, 2s, 3s, ...
+   */
+  onRetry?:
+    | ((
+        attempt: number,
+        error: unknown,
+        delay: number,
+      ) => boolean | number | undefined)
+    | undefined
+
+  /**
+   * Whether `onRetry` can cancel retries by returning `false`.
+   * When `true`, returning `false` from `onRetry` stops retry attempts.
+   *
+   * @default false
+   */
+  onRetryCancelOnFalse?: boolean | undefined
+
+  /**
+   * Whether errors thrown by `onRetry` should propagate.
+   * When `true`, exceptions in `onRetry` terminate the retry loop.
+   * When `false`, exceptions in `onRetry` are silently caught.
+   *
+   * @default false
+   */
+  onRetryRethrow?: boolean | undefined
+
+  /**
+   * Number of retry attempts (0 = no retries, only initial attempt).
+   * The callback is executed `retries + 1` times total (initial + retries).
+   *
+   * @default 0
+   * @example
+   * // retries: 0 -> 1 total attempt (no retries)
+   * // retries: 3 -> 4 total attempts (1 initial + 3 retries)
+   */
+  retries?: number | undefined
+
+  /**
+   * AbortSignal to support cancellation of retry operations.
+   * When aborted, immediately stops retrying and returns `undefined`.
+   *
+   * @default process abort signal
+   * @example
+   * const controller = new AbortController()
+   * pRetry(fn, { signal: controller.signal })
+   * // Later: controller.abort() to cancel
+   */
+  signal?: AbortSignal | undefined
 }
 
+/**
+ * Configuration options for iteration functions with concurrency control.
+ *
+ * Controls how array operations are parallelized and retried.
+ */
 export interface IterationOptions {
-  concurrency?: number
-  retries?: number | RetryOptions
-  signal?: AbortSignal
+  /**
+   * The number of concurrent executions performed at one time.
+   * Higher values increase parallelism but may overwhelm resources.
+   *
+   * @default 1
+   * @example
+   * // Process 5 items at a time
+   * await pEach(items, processItem, { concurrency: 5 })
+   */
+  concurrency?: number | undefined
+
+  /**
+   * Retry configuration as a number (retry count) or full options object.
+   * Applied to each individual item's callback execution.
+   *
+   * @default 0 (no retries)
+   * @example
+   * // Simple: retry each item up to 3 times
+   * await pEach(items, fetchItem, { retries: 3 })
+   *
+   * @example
+   * // Advanced: custom backoff for each item
+   * await pEach(items, fetchItem, {
+   *   retries: {
+   *     retries: 3,
+   *     baseDelayMs: 1000,
+   *     backoffFactor: 2
+   *   }
+   * })
+   */
+  retries?: number | RetryOptions | undefined
+
+  /**
+   * AbortSignal to support cancellation of the entire iteration.
+   * When aborted, stops processing remaining items.
+   *
+   * @default process abort signal
+   */
+  signal?: AbortSignal | undefined
 }
 
 let _timers: typeof import('node:timers/promises') | undefined
 /**
  * Get the timers/promises module.
+ * Uses lazy loading to avoid Webpack bundling issues.
+ *
  * @private
+ * @returns The Node.js timers/promises module
  */
 /*@__NO_SIDE_EFFECTS__*/
 function getTimers() {
@@ -53,10 +215,26 @@ function getTimers() {
 
 /**
  * Normalize options for iteration functions.
+ *
+ * Converts various option formats into a consistent structure with defaults applied.
+ * Handles number shorthand for concurrency and ensures minimum values.
+ *
+ * @param options - Concurrency as number, or full options object, or undefined
+ * @returns Normalized options with concurrency, retries, and signal
+ *
+ * @example
+ * // Number shorthand for concurrency
+ * normalizeIterationOptions(5)
+ * // => { concurrency: 5, retries: {...}, signal: AbortSignal }
+ *
+ * @example
+ * // Full options
+ * normalizeIterationOptions({ concurrency: 3, retries: 2 })
+ * // => { concurrency: 3, retries: {...}, signal: AbortSignal }
  */
 /*@__NO_SIDE_EFFECTS__*/
 export function normalizeIterationOptions(
-  options?: number | IterationOptions,
+  options?: number | IterationOptions | undefined,
 ): { concurrency: number; retries: RetryOptions; signal: AbortSignal } {
   // Handle number as concurrency shorthand
   const opts = typeof options === 'number' ? { concurrency: options } : options
@@ -83,23 +261,40 @@ export function normalizeIterationOptions(
 
 /**
  * Normalize options for retry functionality.
+ *
+ * Converts various retry option formats into a complete configuration with all defaults.
+ * Handles legacy property names (`factor`, `minTimeout`, `maxTimeout`) and merges them
+ * with modern equivalents.
+ *
+ * @param options - Retry count as number, or full options object, or undefined
+ * @returns Normalized retry options with all properties set
+ *
+ * @example
+ * // Number shorthand
+ * normalizeRetryOptions(3)
+ * // => { retries: 3, baseDelayMs: 200, backoffFactor: 2, ... }
+ *
+ * @example
+ * // Full options with defaults filled in
+ * normalizeRetryOptions({ retries: 5, baseDelayMs: 500 })
+ * // => { retries: 5, baseDelayMs: 500, backoffFactor: 2, jitter: true, ... }
  */
 /*@__NO_SIDE_EFFECTS__*/
 export function normalizeRetryOptions(
-  options?: number | RetryOptions,
+  options?: number | RetryOptions | undefined,
 ): RetryOptions {
   const resolved = resolveRetryOptions(options)
   const {
     // Arguments to pass to the callback function.
     args = [],
     // Multiplier for exponential backoff (e.g., 2 doubles delay each retry).
-    backoffFactor = resolved.factor || 2,
+    backoffFactor = 2,
     // Initial delay before the first retry (in milliseconds).
-    baseDelayMs = resolved.minTimeout || 200,
+    baseDelayMs = 200,
     // Whether to apply randomness to spread out retries.
     jitter = true,
     // Upper limit for any backoff delay (in milliseconds).
-    maxDelayMs = resolved.maxTimeout || 10_000,
+    maxDelayMs = 10_000,
     // Optional callback invoked on each retry attempt:
     // (attempt: number, error: unknown, delay: number) => void
     onRetry,
@@ -108,7 +303,7 @@ export function normalizeRetryOptions(
     // Whether onRetry will rethrow errors.
     onRetryRethrow = false,
     // Number of retry attempts (0 = no retries, only initial attempt).
-    retries = resolved.retries || 0,
+    retries = 0,
     // AbortSignal used to support cancellation.
     signal = abortSignal,
   } = resolved
@@ -118,8 +313,6 @@ export function normalizeRetryOptions(
     baseDelayMs,
     jitter,
     maxDelayMs,
-    minTimeout: baseDelayMs,
-    maxTimeout: maxDelayMs,
     onRetry,
     onRetryCancelOnFalse,
     onRetryRethrow,
@@ -130,17 +323,31 @@ export function normalizeRetryOptions(
 
 /**
  * Resolve retry options from various input formats.
+ *
+ * Converts shorthand and partial options into a base configuration that can be
+ * further normalized. This is an internal helper for option processing.
+ *
+ * @param options - Retry count as number, or partial options object, or undefined
+ * @returns Resolved retry options with defaults for basic properties
+ *
+ * @example
+ * resolveRetryOptions(3)
+ * // => { retries: 3, minTimeout: 200, maxTimeout: 10000, factor: 2 }
+ *
+ * @example
+ * resolveRetryOptions({ retries: 5, maxTimeout: 5000 })
+ * // => { retries: 5, minTimeout: 200, maxTimeout: 5000, factor: 2 }
  */
 /*@__NO_SIDE_EFFECTS__*/
 export function resolveRetryOptions(
-  options?: number | RetryOptions,
+  options?: number | RetryOptions | undefined,
 ): RetryOptions {
   const defaults = {
     __proto__: null,
     retries: 0,
-    minTimeout: 200,
-    maxTimeout: 10_000,
-    factor: 2,
+    baseDelayMs: 200,
+    maxDelayMs: 10_000,
+    backoffFactor: 2,
   }
 
   if (typeof options === 'number') {
@@ -152,12 +359,45 @@ export function resolveRetryOptions(
 
 /**
  * Execute an async function for each array element with concurrency control.
+ *
+ * Processes array items in parallel batches (chunks) with configurable concurrency.
+ * Each item's callback can be retried independently on failure. Similar to
+ * `Promise.all(array.map(fn))` but with controlled parallelism.
+ *
+ * @template T - The type of array elements
+ * @param array - The array to iterate over
+ * @param callbackFn - Async function to execute for each item
+ * @param options - Concurrency as number, or full iteration options, or undefined
+ * @returns Promise that resolves when all items are processed
+ *
+ * @example
+ * // Process items serially (concurrency: 1)
+ * await pEach(urls, async (url) => {
+ *   await fetch(url)
+ * })
+ *
+ * @example
+ * // Process 5 items at a time
+ * await pEach(files, async (file) => {
+ *   await processFile(file)
+ * }, 5)
+ *
+ * @example
+ * // With retries and cancellation
+ * const controller = new AbortController()
+ * await pEach(tasks, async (task) => {
+ *   await executeTask(task)
+ * }, {
+ *   concurrency: 3,
+ *   retries: 2,
+ *   signal: controller.signal
+ * })
  */
 /*@__NO_SIDE_EFFECTS__*/
 export async function pEach<T>(
   array: T[],
   callbackFn: (item: T) => Promise<unknown>,
-  options?: number | IterationOptions,
+  options?: number | IterationOptions | undefined,
 ): Promise<void> {
   const iterOpts = normalizeIterationOptions(options)
   const { concurrency, retries, signal } = iterOpts
@@ -170,7 +410,7 @@ export async function pEach<T>(
     }
     // Process each item in the chunk concurrently.
     // eslint-disable-next-line no-await-in-loop
-    await Promise.all(
+    await Promise.allSettled(
       chunk.map((item: T) =>
         pRetry((...args: unknown[]) => callbackFn(args[0] as T), {
           ...retries,
@@ -184,12 +424,49 @@ export async function pEach<T>(
 
 /**
  * Filter an array asynchronously with concurrency control.
+ *
+ * Tests each element with an async predicate function, processing items in parallel
+ * batches. Returns a new array with only items that pass the test. Similar to
+ * `array.filter()` but for async predicates with controlled concurrency.
+ *
+ * @template T - The type of array elements
+ * @param array - The array to filter
+ * @param callbackFn - Async predicate function returning true to keep item
+ * @param options - Concurrency as number, or full iteration options, or undefined
+ * @returns Promise resolving to filtered array
+ *
+ * @example
+ * // Filter serially
+ * const activeUsers = await pFilter(users, async (user) => {
+ *   return await isUserActive(user.id)
+ * })
+ *
+ * @example
+ * // Filter with concurrency
+ * const validFiles = await pFilter(filePaths, async (path) => {
+ *   try {
+ *     await fs.access(path)
+ *     return true
+ *   } catch {
+ *     return false
+ *   }
+ * }, 10)
+ *
+ * @example
+ * // With retries for flaky checks
+ * const reachable = await pFilter(endpoints, async (url) => {
+ *   const response = await fetch(url)
+ *   return response.ok
+ * }, {
+ *   concurrency: 5,
+ *   retries: 2
+ * })
  */
 /*@__NO_SIDE_EFFECTS__*/
 export async function pFilter<T>(
   array: T[],
   callbackFn: (item: T) => Promise<boolean>,
-  options?: number | IterationOptions,
+  options?: number | IterationOptions | undefined,
 ): Promise<T[]> {
   const iterOpts = normalizeIterationOptions(options)
   return (
@@ -203,12 +480,48 @@ export async function pFilter<T>(
 
 /**
  * Process array in chunks with an async callback.
+ *
+ * Divides the array into fixed-size chunks and processes each chunk sequentially
+ * with the callback. Useful for batch operations like bulk database inserts or
+ * API calls with payload size limits.
+ *
+ * @template T - The type of array elements
+ * @param array - The array to process in chunks
+ * @param callbackFn - Async function to execute for each chunk
+ * @param options - Chunk size and retry options
+ * @returns Promise that resolves when all chunks are processed
+ *
+ * @example
+ * // Insert records in batches of 100
+ * await pEachChunk(records, async (chunk) => {
+ *   await db.batchInsert(chunk)
+ * }, { chunkSize: 100 })
+ *
+ * @example
+ * // Upload files in batches with retries
+ * await pEachChunk(files, async (batch) => {
+ *   await uploadBatch(batch)
+ * }, {
+ *   chunkSize: 50,
+ *   retries: 3,
+ *   baseDelayMs: 1000
+ * })
+ *
+ * @example
+ * // Process with cancellation support
+ * const controller = new AbortController()
+ * await pEachChunk(items, async (chunk) => {
+ *   await processChunk(chunk)
+ * }, {
+ *   chunkSize: 25,
+ *   signal: controller.signal
+ * })
  */
 /*@__NO_SIDE_EFFECTS__*/
 export async function pEachChunk<T>(
   array: T[],
   callbackFn: (chunk: T[]) => Promise<unknown>,
-  options?: RetryOptions & { chunkSize?: number },
+  options?: (RetryOptions & { chunkSize?: number | undefined }) | undefined,
 ): Promise<void> {
   const { chunkSize = 100, ...retryOpts } = options || {}
   const chunks = arrayChunk(array, chunkSize)
@@ -228,12 +541,26 @@ export async function pEachChunk<T>(
 
 /**
  * Filter chunked arrays with an async predicate.
+ *
+ * Internal helper for `pFilter`. Processes pre-chunked arrays, applying the
+ * predicate to each element within each chunk with retry support.
+ *
+ * @template T - The type of array elements
+ * @param chunks - Pre-chunked array (array of arrays)
+ * @param callbackFn - Async predicate function
+ * @param options - Retry count as number, or full retry options, or undefined
+ * @returns Promise resolving to array of filtered chunks
+ *
+ * @example
+ * const chunks = [[1, 2], [3, 4], [5, 6]]
+ * const filtered = await pFilterChunk(chunks, async (n) => n % 2 === 0)
+ * // => [[2], [4], [6]]
  */
 /*@__NO_SIDE_EFFECTS__*/
 export async function pFilterChunk<T>(
   chunks: T[][],
   callbackFn: (value: T) => Promise<boolean>,
-  options?: number | RetryOptions,
+  options?: number | RetryOptions | undefined,
 ): Promise<T[][]> {
   const retryOpts = normalizeRetryOptions(options)
   const { signal } = retryOpts
@@ -246,7 +573,7 @@ export async function pFilterChunk<T>(
     } else {
       const chunk = chunks[i] as T[]
       // eslint-disable-next-line no-await-in-loop
-      const predicateResults = await Promise.all(
+      const settled = await Promise.allSettled(
         chunk.map(value =>
           pRetry((...args: unknown[]) => callbackFn(args[0] as T), {
             ...retryOpts,
@@ -254,6 +581,9 @@ export async function pFilterChunk<T>(
           }),
         ),
       )
+      const predicateResults = settled.map(r =>
+        r.status === 'fulfilled' ? r.value : false,
+      )
       filteredChunks[i] = chunk.filter((_v, i) => predicateResults[i])
     }
   }
@@ -262,12 +592,92 @@ export async function pFilterChunk<T>(
 
 /**
  * Retry an async function with exponential backoff.
- * @throws {Error} The last error if all retries fail.
+ *
+ * Attempts to execute a function multiple times with increasing delays between attempts.
+ * Implements exponential backoff with optional jitter to prevent thundering herd problems.
+ * Supports custom retry logic via `onRetry` callback.
+ *
+ * The delay calculation follows: `min(baseDelayMs * (backoffFactor ** attempt), maxDelayMs)`
+ * With jitter: adds random value between 0 and calculated delay.
+ *
+ * @template T - The return type of the callback function
+ * @param callbackFn - Async function to retry
+ * @param options - Retry count as number, or full retry options, or undefined
+ * @returns Promise resolving to callback result, or `undefined` if aborted
+ *
+ * @throws {Error} The last error if all retry attempts fail
+ *
+ * @example
+ * // Simple retry: 3 attempts with default backoff
+ * const data = await pRetry(async () => {
+ *   return await fetchData()
+ * }, 3)
+ *
+ * @example
+ * // Custom backoff strategy
+ * const result = await pRetry(async () => {
+ *   return await unreliableOperation()
+ * }, {
+ *   retries: 5,
+ *   baseDelayMs: 1000,    // Start at 1 second
+ *   backoffFactor: 2,      // Double each time
+ *   maxDelayMs: 30000,     // Cap at 30 seconds
+ *   jitter: true           // Add randomness
+ * })
+ * // Delays: ~1s, ~2s, ~4s, ~8s, ~16s (each ± random jitter)
+ *
+ * @example
+ * // With custom retry logic
+ * const data = await pRetry(async () => {
+ *   return await apiCall()
+ * }, {
+ *   retries: 3,
+ *   onRetry: (attempt, error, delay) => {
+ *     console.log(`Attempt ${attempt} failed: ${error}`)
+ *     console.log(`Waiting ${delay}ms before retry...`)
+ *
+ *     // Cancel retries for client errors (4xx)
+ *     if (error.statusCode >= 400 && error.statusCode < 500) {
+ *       return false
+ *     }
+ *
+ *     // Use longer delay for rate limit errors
+ *     if (error.statusCode === 429) {
+ *       return 60000 // Wait 1 minute
+ *     }
+ *   },
+ *   onRetryCancelOnFalse: true
+ * })
+ *
+ * @example
+ * // With cancellation support
+ * const controller = new AbortController()
+ * setTimeout(() => controller.abort(), 5000) // Cancel after 5s
+ *
+ * const result = await pRetry(async ({ signal }) => {
+ *   return await longRunningTask(signal)
+ * }, {
+ *   retries: 10,
+ *   signal: controller.signal
+ * })
+ * // Returns undefined if aborted
+ *
+ * @example
+ * // Pass arguments to callback
+ * const result = await pRetry(
+ *   async (url, options) => {
+ *     return await fetch(url, options)
+ *   },
+ *   {
+ *     retries: 3,
+ *     args: ['https://api.example.com', { method: 'POST' }]
+ *   }
+ * )
  */
 /*@__NO_SIDE_EFFECTS__*/
 export async function pRetry<T>(
   callbackFn: (...args: unknown[]) => Promise<T>,
-  options?: number | RetryOptions,
+  options?: number | RetryOptions | undefined,
 ): Promise<T | undefined> {
   const {
     args,
@@ -323,6 +733,10 @@ export async function pRetry<T>(
           if (result === false && onRetryCancelOnFalse) {
             break
           }
+          // If onRetry returns a number, use it as the custom delay.
+          if (typeof result === 'number' && result >= 0) {
+            waitTime = Math.min(result, maxDelayMs as number)
+          }
         } catch (e) {
           if (onRetryRethrow) {
             throw e
diff --git a/src/prompts.ts b/src/prompts.ts
deleted file mode 100644
index 0aa4fa0..0000000
--- a/src/prompts.ts
+++ /dev/null
@@ -1,37 +0,0 @@
-/**
- * @fileoverview Interactive prompt utilities for CLI applications.
- * Re-exports commonly used prompt functions from inquirer packages.
- */
-
-export { default as confirm } from '@inquirer/confirm'
-export { default as input } from '@inquirer/input'
-export { default as password } from '@inquirer/password'
-export { default as search } from '@inquirer/search'
-export { default as select } from '@inquirer/select'
-
-// Export types - Choice is a type interface, not a direct export
-export interface Choice<Value = unknown> {
-  value: Value
-  name?: string
-  description?: string
-  short?: string
-  disabled?: boolean | string
-}
-
-// Create a Separator type that matches the expected interface
-export interface Separator {
-  type: 'separator'
-  separator?: string
-  line?: string
-}
-
-/**
- * Create a separator for select prompts.
- */
-export function createSeparator(text?: string): Separator {
-  return {
-    type: 'separator',
-    separator: text || '───────',
-    line: text || '───────',
-  }
-}
diff --git a/src/signal-exit.ts b/src/signal-exit.ts
index c1c3aaa..deb53c5 100644
--- a/src/signal-exit.ts
+++ b/src/signal-exit.ts
@@ -36,8 +36,7 @@
 const ReflectApply = Reflect.apply
 const globalProcess = globalThis.process as
   | (NodeJS.Process & {
-      // biome-ignore lint/suspicious/noExplicitAny: Signal exit emitter can be any event emitter.
-      __signal_exit_emitter__?: any
+      __signal_exit_emitter__?: import('node:events').EventEmitter
       reallyExit?: (code?: number | undefined) => never
     })
   | undefined
@@ -211,7 +210,6 @@ function processEmit(
   this: NodeJS.Process,
   eventName: string,
   exitCode?: number | undefined,
-  // biome-ignore lint/suspicious/noExplicitAny: Process emit args can be any type.
   ...args: any[]
 ): boolean {
   if (eventName === 'exit') {
diff --git a/src/sorts.ts b/src/sorts.ts
index d354fe0..4b7529b 100644
--- a/src/sorts.ts
+++ b/src/sorts.ts
@@ -56,13 +56,13 @@ export function naturalSorter<T>(
   arrayToSort: T[],
 ): ReturnType<FastSortFunction> {
   if (_naturalSorter === undefined) {
-    const fastSort = /*@__PURE__*/ require('./external/fast-sort')
-    // biome-ignore lint/suspicious/noExplicitAny: Fast-sort API requires dynamic method access.
-    _naturalSorter = (fastSort as any).createNewSortInstance({
+    const fastSort =
+      /*@__PURE__*/ require('./external/fast-sort') as typeof import('fast-sort')
+    _naturalSorter = fastSort.createNewSortInstance({
       comparer: naturalCompare,
-    })
+    }) as FastSortFunction
   }
-  return _naturalSorter?.(arrayToSort)
+  return (_naturalSorter as FastSortFunction)(arrayToSort)
 }
 
 /**
@@ -78,9 +78,10 @@ export function compareStr(a: string, b: string): number {
  */
 /*@__NO_SIDE_EFFECTS__*/
 export function compareSemver(a: string, b: string): number {
-  const semver = /*@__PURE__*/ require('./external/semver')
-  const validA = semver.valid(a)
-  const validB = semver.valid(b)
+  const semver =
+    /*@__PURE__*/ require('./external/semver') as typeof import('semver')
+  const validA: string | null = semver.valid(a)
+  const validB: string | null = semver.valid(b)
 
   if (!validA && !validB) {
     return 0
@@ -91,6 +92,5 @@ export function compareSemver(a: string, b: string): number {
   if (!validB) {
     return 1
   }
-  // biome-ignore lint/suspicious/noExplicitAny: Semver API requires dynamic method access.
-  return (semver as any).compare(a, b)
+  return semver.compare(a, b) as number
 }
diff --git a/src/spawn.ts b/src/spawn.ts
index 46d6372..bc49571 100644
--- a/src/spawn.ts
+++ b/src/spawn.ts
@@ -43,7 +43,13 @@ const windowsScriptExtRegExp = /\.(?:cmd|bat|ps1)$/i
 
 let _child_process: typeof import('node:child_process') | undefined
 /**
- * Lazily load the child_process module.
+ * Lazily load the `child_process` module to avoid Webpack bundling issues.
+ *
+ * @returns The Node.js `child_process` module
+ *
+ * @example
+ * const childProcess = getChildProcess()
+ * childProcess.spawnSync('ls', ['-la'])
  */
 /*@__NO_SIDE_EFFECTS__*/
 function getChildProcess() {
@@ -55,7 +61,19 @@ function getChildProcess() {
   return _child_process as typeof import('node:child_process')
 }
 
-// Type for promise-spawn options.
+/**
+ * Options for spawning a child process with promise-based completion.
+ *
+ * @property {string | undefined} cwd - Current working directory for the process
+ * @property {boolean | undefined} stdioString - Convert stdio output to strings (default: `true`)
+ * @property {StdioType | undefined} stdio - Stdio configuration (`'pipe'`, `'ignore'`, `'inherit'`, or array)
+ * @property {NodeJS.ProcessEnv | undefined} env - Environment variables for the process
+ * @property {boolean | string | undefined} shell - Whether to run command in shell, or path to shell
+ * @property {AbortSignal | undefined} signal - Signal to abort the process
+ * @property {number | undefined} timeout - Maximum time in milliseconds before killing the process
+ * @property {number | undefined} uid - User identity of the process (POSIX only)
+ * @property {number | undefined} gid - Group identity of the process (POSIX only)
+ */
 export type PromiseSpawnOptions = {
   cwd?: string | undefined
   stdioString?: boolean | undefined
@@ -68,7 +86,20 @@ export type PromiseSpawnOptions = {
   gid?: number | undefined
 }
 
-// Type for promise-spawn result.
+/**
+ * Result returned by {@link spawn} when the child process completes.
+ * This is a Promise that resolves with process exit information and output,
+ * with additional properties for accessing the running process and stdin stream.
+ *
+ * @property {ChildProcessType} process - The running child process instance
+ * @property {WritableStreamType | null} stdin - Writable stream for process stdin, or `null` if not piped
+ *
+ * @example
+ * const result = spawn('echo', ['hello'])
+ * result.stdin?.write('additional input\n')
+ * const { code, stdout } = await result
+ * console.log(stdout) // 'hello'
+ */
 export type PromiseSpawnResult = Promise<{
   cmd: string
   args: string[] | readonly string[]
@@ -90,19 +121,31 @@ let _npmCliPromiseSpawn:
     ) => PromiseSpawnResult)
   | undefined
 /**
- * Lazily load the promise-spawn module for async process spawning.
+ * Lazily load the `@npmcli/promise-spawn` module for async process spawning.
+ *
+ * @returns The promise-spawn module that provides Promise-based spawn functionality
+ *
+ * @example
+ * const promiseSpawn = getNpmcliPromiseSpawn()
+ * await promiseSpawn('git', ['status'])
  */
 /*@__NO_SIDE_EFFECTS__*/
 function getNpmcliPromiseSpawn() {
   if (_npmCliPromiseSpawn === undefined) {
-    _npmCliPromiseSpawn = /*@__PURE__*/ require('../external/@npmcli/promise-spawn')
+    _npmCliPromiseSpawn = /*@__PURE__*/ require('./external/@npmcli/promise-spawn')
   }
   return _npmCliPromiseSpawn as unknown as typeof import('@npmcli/promise-spawn')
 }
 
 let _path: typeof import('node:path') | undefined
 /**
- * Lazily load the path module to avoid Webpack errors.
+ * Lazily load the `path` module to avoid Webpack bundling issues.
+ *
+ * @returns The Node.js `path` module
+ *
+ * @example
+ * const path = getPath()
+ * const basename = path.basename('/foo/bar.txt')
  */
 /*@__NO_SIDE_EFFECTS__*/
 function getPath() {
@@ -115,7 +158,29 @@ function getPath() {
 }
 
 /**
- * Check if a value is a spawn error.
+ * Error object thrown when a spawned process fails.
+ * Extends the standard Error with process-specific information including exit code,
+ * signal, command details, and captured output.
+ *
+ * @property {string[]} args - Arguments passed to the command
+ * @property {string} cmd - Command that was executed
+ * @property {number} code - Process exit code
+ * @property {string} name - Error name (typically `'Error'`)
+ * @property {string} message - Error message describing the failure
+ * @property {NodeJS.Signals | null} signal - Signal that terminated the process, if any
+ * @property {string} stack - Stack trace of the error
+ * @property {string | Buffer} stderr - Standard error output from the process
+ * @property {string | Buffer} stdout - Standard output from the process
+ *
+ * @example
+ * try {
+ *   await spawn('exit', ['1'])
+ * } catch (error) {
+ *   if (isSpawnError(error)) {
+ *     console.error(`Command failed with code ${error.code}`)
+ *     console.error(`stderr: ${error.stderr}`)
+ *   }
+ * }
  */
 export type SpawnError = {
   args: string[]
@@ -129,21 +194,72 @@ export type SpawnError = {
   stdout: string | Buffer
 }
 
+/**
+ * Spawn error variant where stdout and stderr are guaranteed to be strings.
+ * This type is used when `stdioString: true` is set in spawn options.
+ *
+ * @property {string} stdout - Standard output as a string
+ * @property {string} stderr - Standard error as a string
+ */
 export type SpawnErrorWithOutputString = SpawnError & {
   stdout: string
   stderr: string
 }
 
+/**
+ * Spawn error variant where stdout and stderr are guaranteed to be Buffers.
+ * This type is used when `stdioString: false` is set in spawn options.
+ *
+ * @property {Buffer} stdout - Standard output as a Buffer
+ * @property {Buffer} stderr - Standard error as a Buffer
+ */
 export type SpawnErrorWithOutputBuffer = SpawnError & {
   stdout: Buffer
   stderr: Buffer
 }
 
+/**
+ * Extra options passed to the underlying promise-spawn implementation.
+ * This is an open-ended object for passing additional metadata or configuration.
+ */
 export type SpawnExtra = Record<string, unknown>
 
+/**
+ * Valid values for individual stdio streams.
+ * - `'pipe'` - Creates a pipe between child and parent (default)
+ * - `'ignore'` - Ignores the stream
+ * - `'inherit'` - Uses parent's stream
+ * - `'overlapped'` - Windows-specific overlapped I/O
+ */
 export type IOType = 'pipe' | 'ignore' | 'inherit' | 'overlapped'
+
+/**
+ * Configuration for process stdio (stdin, stdout, stderr) streams.
+ * Can be a single value applied to all streams, or an array specifying each stream individually.
+ * - `'ipc'` - Creates an IPC channel for communication with the parent
+ *
+ * @example
+ * // All streams piped
+ * stdio: 'pipe'
+ *
+ * @example
+ * // Custom configuration per stream: [stdin, stdout, stderr]
+ * stdio: ['ignore', 'pipe', 'pipe']
+ */
 export type StdioType = IOType | 'ipc' | Array<IOType | 'ipc'>
 
+/**
+ * Result object returned by {@link spawnSync} when the child process completes synchronously.
+ *
+ * @template T - Type of stdout/stderr (string or Buffer)
+ * @property {number} pid - Process ID of the spawned child
+ * @property {Array<T | null>} output - Array containing stdout/stderr values
+ * @property {T} stdout - Standard output from the process
+ * @property {T} stderr - Standard error from the process
+ * @property {number | null} status - Exit code, or `null` if killed by signal
+ * @property {NodeJS.Signals | null} signal - Signal that terminated the process, or `null`
+ * @property {Error | undefined} error - Error object if the spawn failed
+ */
 export interface SpawnSyncReturns<T> {
   pid: number
   output: Array<T | null>
@@ -155,7 +271,20 @@ export interface SpawnSyncReturns<T> {
 }
 
 /**
- * Check if a value is a spawn error with expected properties.
+ * Check if a value is a spawn error with expected error properties.
+ * Tests for common error properties from child process failures.
+ *
+ * @param {unknown} value - Value to check
+ * @returns {boolean} `true` if the value has spawn error properties
+ *
+ * @example
+ * try {
+ *   await spawn('nonexistent-command')
+ * } catch (error) {
+ *   if (isSpawnError(error)) {
+ *     console.error(`Spawn failed: ${error.code}`)
+ *   }
+ * }
  */
 /*@__NO_SIDE_EFFECTS__*/
 export function isSpawnError(value: unknown): value is SpawnError {
@@ -173,6 +302,23 @@ export function isSpawnError(value: unknown): value is SpawnError {
 
 /**
  * Check if stdio configuration matches a specific type.
+ * When called with one argument, validates if it's a valid stdio type.
+ * When called with two arguments, checks if the stdio config matches the specified type.
+ *
+ * @param {string | string[]} stdio - Stdio configuration to check
+ * @param {StdioType | undefined} type - Expected stdio type (optional)
+ * @returns {boolean} `true` if stdio matches the type or is valid
+ *
+ * @example
+ * // Check if valid stdio type
+ * isStdioType('pipe') // true
+ * isStdioType('invalid') // false
+ *
+ * @example
+ * // Check if stdio matches specific type
+ * isStdioType('pipe', 'pipe') // true
+ * isStdioType(['pipe', 'pipe', 'pipe'], 'pipe') // true
+ * isStdioType('ignore', 'pipe') // false
  */
 /*@__NO_SIDE_EFFECTS__*/
 export function isStdioType(
@@ -199,6 +345,10 @@ export function isStdioType(
 
 /**
  * Strip ANSI escape codes from spawn result stdout and stderr.
+ * Modifies the result object in place to remove color codes and formatting.
+ *
+ * @param {unknown} result - Spawn result object with stdout/stderr properties
+ * @returns {unknown} The modified result object
  */
 /*@__NO_SIDE_EFFECTS__*/
 function stripAnsiFromSpawnResult(result: unknown): unknown {
@@ -223,7 +373,6 @@ interface NodeSpawnOptions {
   cwd?: string | URL | undefined
   env?: NodeJS.ProcessEnv | undefined
   argv0?: string | undefined
-  // biome-ignore lint/suspicious/noExplicitAny: Stdio can be complex union of types from Node.js.
   stdio?: any
   detached?: boolean | undefined
   uid?: number | undefined
@@ -243,7 +392,6 @@ interface ChildProcessType {
   stdin: NodeJS.WritableStream | null
   stdout: NodeJS.ReadableStream | null
   stderr: NodeJS.ReadableStream | null
-  // biome-ignore lint/suspicious/noExplicitAny: IPC channel type from Node.js.
   readonly channel?: any
   readonly stdio: [
     NodeJS.WritableStream | null,
@@ -260,21 +408,15 @@ interface ChildProcessType {
   readonly spawnargs: string[]
   readonly spawnfile: string
   kill(signal?: NodeJS.Signals | number): boolean
-  // biome-ignore lint/suspicious/noExplicitAny: IPC message type from Node.js.
   send(message: any, callback?: (error: Error | null) => void): boolean
   send(
-    // biome-ignore lint/suspicious/noExplicitAny: IPC message and handle types from Node.js.
     message: any,
-    // biome-ignore lint/suspicious/noExplicitAny: IPC message and handle types from Node.js.
     sendHandle?: any | undefined,
     callback?: (error: Error | null) => void,
   ): boolean
   send(
-    // biome-ignore lint/suspicious/noExplicitAny: IPC message, handle, and options types from Node.js.
     message: any,
-    // biome-ignore lint/suspicious/noExplicitAny: IPC message, handle, and options types from Node.js.
     sendHandle?: any | undefined,
-    // biome-ignore lint/suspicious/noExplicitAny: IPC message, handle, and options types from Node.js.
     options?: any | undefined,
     callback?: (error: Error | null) => void,
   ): boolean
@@ -294,17 +436,13 @@ interface WritableStreamType {
   writableCorked: number
   destroyed: boolean
   write(
-    // biome-ignore lint/suspicious/noExplicitAny: Stream chunk can be any type.
     chunk: any,
     encoding?: BufferEncoding | undefined,
     callback?: (error?: Error | null) => void,
   ): boolean
-  // biome-ignore lint/suspicious/noExplicitAny: Stream chunk can be any type.
   write(chunk: any, callback?: (error?: Error | null) => void): boolean
   end(cb?: () => void): this
-  // biome-ignore lint/suspicious/noExplicitAny: Stream chunk can be any type.
   end(chunk: any, cb?: () => void): this
-  // biome-ignore lint/suspicious/noExplicitAny: Stream chunk can be any type.
   end(chunk: any, encoding?: BufferEncoding | undefined, cb?: () => void): this
   cork(): void
   uncork(): void
@@ -312,7 +450,20 @@ interface WritableStreamType {
 }
 
 /**
- * Spawn a child process with enhanced error handling and output capture.
+ * Options for spawning a child process with {@link spawn}.
+ * Extends Node.js spawn options with additional Socket-specific functionality.
+ *
+ * @property {import('./spinner').Spinner | undefined} spinner - Spinner instance to pause during execution
+ * @property {boolean | undefined} stdioString - Convert output to strings (default: `true`)
+ * @property {boolean | undefined} stripAnsi - Remove ANSI codes from output (default: `true`)
+ * @property {string | URL | undefined} cwd - Current working directory
+ * @property {NodeJS.ProcessEnv | undefined} env - Environment variables
+ * @property {StdioType | undefined} stdio - Stdio configuration
+ * @property {boolean | string | undefined} shell - Run command in shell
+ * @property {number | undefined} timeout - Timeout in milliseconds
+ * @property {AbortSignal | undefined} signal - Abort signal
+ * @property {number | undefined} uid - User identity (POSIX)
+ * @property {number | undefined} gid - Group identity (POSIX)
  */
 export type SpawnOptions = import('./objects').Remap<
   NodeSpawnOptions & {
@@ -322,6 +473,16 @@ export type SpawnOptions = import('./objects').Remap<
   }
 >
 export type SpawnResult = PromiseSpawnResult
+/**
+ * Result object returned when a spawned process completes.
+ *
+ * @property {string} cmd - Command that was executed
+ * @property {string[] | readonly string[]} args - Arguments passed to the command
+ * @property {number} code - Process exit code
+ * @property {NodeJS.Signals | null} signal - Signal that terminated the process, if any
+ * @property {string | Buffer} stdout - Standard output (string if `stdioString: true`, Buffer otherwise)
+ * @property {string | Buffer} stderr - Standard error (string if `stdioString: true`, Buffer otherwise)
+ */
 export type SpawnStdioResult = {
   cmd: string
   args: string[] | readonly string[]
@@ -333,6 +494,7 @@ export type SpawnStdioResult = {
 
 /**
  * Spawn a child process and return a promise that resolves when it completes.
+ * Provides enhanced error handling, output capture, and cross-platform support.
  *
  * SECURITY: This function uses array-based arguments which prevent command injection.
  * Arguments in the `args` array are passed directly to the OS without shell
@@ -343,20 +505,54 @@ export type SpawnStdioResult = {
  * approach remains secure because Node.js properly escapes each argument before passing
  * to the shell.
  *
- * @param cmd - Command to execute (not user-controlled)
- * @param args - Array of arguments (safe even with user input due to array-based passing)
- * @param options - Spawn options
- * @param extra - Extra options for promise-spawn
+ * @param {string} cmd - Command to execute (not user-controlled)
+ * @param {string[] | readonly string[] | undefined} args - Array of arguments (safe even with user input)
+ * @param {SpawnOptions | undefined} options - Spawn options for process configuration
+ * @param {SpawnExtra | undefined} extra - Extra options for promise-spawn
+ * @returns {SpawnResult} Promise that resolves with process exit information
+ *
+ * @throws {SpawnError} When the process exits with non-zero code or is terminated by signal
+ *
+ * @example
+ * // Basic usage - spawn and wait for completion
+ * const result = await spawn('git', ['status'])
+ * console.log(result.stdout)
+ *
+ * @example
+ * // With options - set working directory and environment
+ * const result = await spawn('npm', ['install'], {
+ *   cwd: '/path/to/project',
+ *   env: { NODE_ENV: 'production' }
+ * })
  *
  * @example
- * // ✔ DO THIS - Array-based arguments
+ * // ✔ DO THIS - Array-based arguments (safe)
  * spawn('git', ['commit', '-m', userMessage])
  * // Each argument is properly escaped, even if userMessage = "foo; rm -rf /"
  *
  * @example
- * // ✖ NEVER DO THIS - String concatenation
+ * // ✖ NEVER DO THIS - String concatenation (vulnerable)
  * spawn(`git commit -m "${userMessage}"`, { shell: true })
  * // Vulnerable to injection if userMessage = '"; rm -rf / #'
+ *
+ * @example
+ * // Access stdin for interactive processes
+ * const result = spawn('cat', [])
+ * result.stdin?.write('Hello\n')
+ * result.stdin?.end()
+ * const { stdout } = await result
+ * console.log(stdout) // 'Hello'
+ *
+ * @example
+ * // Handle errors with exit codes
+ * try {
+ *   await spawn('exit', ['1'])
+ * } catch (error) {
+ *   if (isSpawnError(error)) {
+ *     console.error(`Failed with code ${error.code}`)
+ *     console.error(error.stderr)
+ *   }
+ * }
  */
 export function spawn(
   cmd: string,
@@ -418,14 +614,22 @@ export function spawn(
   // third-party code, Node.js built-ins, or JavaScript built-in methods.
   // https://github.com/npm/promise-spawn
   // https://github.com/nodejs/node/blob/v24.0.1/lib/child_process.js#L674-L678
+  // Preserve Windows process.env Proxy behavior when no custom env is provided.
+  // On Windows, process.env is a Proxy that provides case-insensitive access
+  // (PATH vs Path vs path). Spreading creates a plain object that loses this.
+  // Only spread when we have custom environment variables to merge.
+  const envToUse = env
+    ? ({
+        __proto__: null,
+        ...process.env,
+        ...env,
+      } as unknown as NodeJS.ProcessEnv)
+    : process.env
+
   const promiseSpawnOpts = {
     __proto__: null,
     cwd: typeof spawnOptions.cwd === 'string' ? spawnOptions.cwd : undefined,
-    env: {
-      __proto__: null,
-      ...process.env,
-      ...env,
-    } as unknown as NodeJS.ProcessEnv,
+    env: envToUse,
     signal: abortSignal,
     stdio: spawnOptions.stdio,
     stdioString,
@@ -484,9 +688,52 @@ export function spawn(
 
 /*@__NO_SIDE_EFFECTS__*/
 /**
- * Synchronously spawn a child process.
+ * Options for synchronously spawning a child process with {@link spawnSync}.
+ * Same as {@link SpawnOptions} but excludes the `spinner` property (not applicable for synchronous execution).
  */
 export type SpawnSyncOptions = Omit<SpawnOptions, 'spinner'>
+
+/**
+ * Synchronously spawn a child process and wait for it to complete.
+ * Blocks execution until the process exits, returning all output and exit information.
+ *
+ * WARNING: This function blocks the event loop. Use {@link spawn} for async operations.
+ *
+ * @param {string} cmd - Command to execute
+ * @param {string[] | readonly string[] | undefined} args - Array of arguments
+ * @param {SpawnSyncOptions | undefined} options - Spawn options for process configuration
+ * @returns {SpawnSyncReturns<string | Buffer>} Process result with exit code and captured output
+ *
+ * @example
+ * // Basic synchronous spawn
+ * const result = spawnSync('git', ['status'])
+ * console.log(result.stdout)
+ * console.log(result.status) // exit code
+ *
+ * @example
+ * // With options
+ * const result = spawnSync('npm', ['install'], {
+ *   cwd: '/path/to/project',
+ *   stdioString: true
+ * })
+ * if (result.status !== 0) {
+ *   console.error(result.stderr)
+ * }
+ *
+ * @example
+ * // Get raw buffer output
+ * const result = spawnSync('cat', ['binary-file'], {
+ *   stdioString: false
+ * })
+ * console.log(result.stdout) // Buffer
+ *
+ * @example
+ * // Handle process errors
+ * const result = spawnSync('nonexistent-command')
+ * if (result.error) {
+ *   console.error('Failed to spawn:', result.error)
+ * }
+ */
 export function spawnSync(
   cmd: string,
   args?: string[] | readonly string[],
diff --git a/src/spinner.ts b/src/spinner.ts
index fb992d8..6ab735f 100644
--- a/src/spinner.ts
+++ b/src/spinner.ts
@@ -3,10 +3,12 @@
  * Provides animated progress indicators with CI environment detection.
  */
 
-import type { Writable } from 'node:stream'
+import type { Writable } from 'stream'
 
-// Note: getAbortSignal is imported lazily to avoid circular dependencies.
-import { CI } from '#env/ci'
+import type { ColorInherit, ColorRgb, ColorValue } from './colors'
+import { isRgbTuple, toRgb } from './colors'
+import { getCI } from '#env/ci'
+import { isDebug } from './debug'
 import { generateSocketSpinnerFrames } from './effects/pulse-frames'
 import type {
   ShimmerColorGradient,
@@ -16,151 +18,248 @@ import type {
 } from './effects/text-shimmer'
 import { applyShimmer, COLOR_INHERIT, DIR_LTR } from './effects/text-shimmer'
 import yoctoSpinner from './external/@socketregistry/yocto-spinner'
+import {
+  LOG_SYMBOLS,
+  getDefaultLogger,
+  incLogCallCountSymbol,
+  lastWasBlankSymbol,
+} from './logger'
 import { hasOwn } from './objects'
 import { isBlankString, stringWidth } from './strings'
-
-export type ColorName =
-  | 'black'
-  | 'blue'
-  | 'blueBright'
-  | 'cyan'
-  | 'cyanBright'
-  | 'gray'
-  | 'green'
-  | 'greenBright'
-  | 'magenta'
-  | 'magentaBright'
-  | 'red'
-  | 'redBright'
-  | 'white'
-  | 'whiteBright'
-  | 'yellow'
-  | 'yellowBright'
-
-export type ColorInherit = 'inherit'
-
-export type ColorRgb = readonly [number, number, number]
-
-export type ColorValue = ColorName | ColorRgb
-
-export type SymbolType = 'fail' | 'info' | 'success' | 'warn'
-
-// Map color names to RGB values.
-const colorToRgb: Record<ColorName, ColorRgb> = {
-  __proto__: null,
-  black: [0, 0, 0],
-  blue: [0, 0, 255],
-  blueBright: [100, 149, 237],
-  cyan: [0, 255, 255],
-  cyanBright: [0, 255, 255],
-  gray: [128, 128, 128],
-  green: [0, 128, 0],
-  greenBright: [0, 255, 0],
-  magenta: [255, 0, 255],
-  magentaBright: [255, 105, 180],
-  red: [255, 0, 0],
-  redBright: [255, 69, 0],
-  white: [255, 255, 255],
-  whiteBright: [255, 255, 255],
-  yellow: [255, 255, 0],
-  yellowBright: [255, 255, 153],
-} as Record<ColorName, ColorRgb>
+import { getTheme } from './themes/context'
+import { THEMES } from './themes/themes'
+import { resolveColor } from './themes/utils'
 
 /**
- * Check if value is RGB tuple.
+ * Symbol types for status messages.
+ * Maps to log symbols: fail (✗), info (ℹ), reason (∴), success (✓), warn (⚠).
  */
-function isRgbTuple(value: ColorValue): value is ColorRgb {
-  return Array.isArray(value)
-}
+export type SymbolType = 'fail' | 'info' | 'reason' | 'success' | 'warn'
 
 /**
- * Convert ColorValue to RGB tuple.
+ * Progress tracking information for display in spinner.
+ * Used by `progress()` and `progressStep()` methods to show animated progress bars.
  */
-function toRgb(color: ColorValue): ColorRgb {
-  if (isRgbTuple(color)) {
-    return color
-  }
-  return colorToRgb[color]
-}
-
 export type ProgressInfo = {
+  /** Current progress value */
   current: number
+  /** Total/maximum progress value */
   total: number
+  /** Optional unit label displayed after the progress count (e.g., 'files', 'items') */
   unit?: string | undefined
 }
 
+/**
+ * Internal shimmer state with color configuration.
+ * Extends `ShimmerState` with additional color property that can be inherited from spinner.
+ */
 export type ShimmerInfo = ShimmerState & {
+  /** Color for shimmer effect - can inherit from spinner, use explicit color, or gradient */
   color: ColorInherit | ColorValue | ShimmerColorGradient
 }
 
+/**
+ * Spinner instance for displaying animated loading indicators.
+ * Provides methods for status updates, progress tracking, and text shimmer effects.
+ *
+ * KEY BEHAVIORS:
+ * - Methods WITHOUT "AndStop" keep the spinner running (e.g., `success()`, `fail()`)
+ * - Methods WITH "AndStop" auto-clear the spinner line (e.g., `successAndStop()`, `failAndStop()`)
+ * - Status messages (done, success, fail, info, warn, reason, step, substep) go to stderr
+ * - Data messages (`log()`) go to stdout
+ *
+ * @example
+ * ```ts
+ * import { Spinner } from '@socketsecurity/lib/spinner'
+ *
+ * const spinner = Spinner({ text: 'Loading…' })
+ * spinner.start()
+ *
+ * // Show success while continuing to spin
+ * spinner.success('Step 1 complete')
+ *
+ * // Stop the spinner with success message
+ * spinner.successAndStop('All done!')
+ * ```
+ */
 export type Spinner = {
+  /** Current spinner color as RGB tuple */
   color: ColorRgb
+  /** Current spinner animation style */
   spinner: SpinnerStyle
 
+  /** Whether spinner is currently animating */
   get isSpinning(): boolean
 
+  /** Get current shimmer state (enabled/disabled and configuration) */
+  get shimmerState(): ShimmerInfo | undefined
+
+  /** Clear the current line without stopping the spinner */
   clear(): Spinner
+
+  /** Show debug message without stopping (only if debug mode enabled) */
   debug(text?: string | undefined, ...extras: unknown[]): Spinner
+  /** Show debug message and stop the spinner (only if debug mode enabled) */
   debugAndStop(text?: string | undefined, ...extras: unknown[]): Spinner
+
+  /** Decrease indentation by specified spaces (default: 2) */
+  dedent(spaces?: number | undefined): Spinner
+
+  /** Disable shimmer effect (preserves config for later re-enable) */
+  disableShimmer(): Spinner
+
+  /** Alias for `success()` - show success without stopping */
+  done(text?: string | undefined, ...extras: unknown[]): Spinner
+  /** Alias for `successAndStop()` - show success and stop */
+  doneAndStop(text?: string | undefined, ...extras: unknown[]): Spinner
+
+  /** Enable shimmer effect (restores saved config or uses defaults) */
+  enableShimmer(): Spinner
+
+  /** Alias for `fail()` - show error without stopping */
   error(text?: string | undefined, ...extras: unknown[]): Spinner
+  /** Alias for `failAndStop()` - show error and stop */
   errorAndStop(text?: string | undefined, ...extras: unknown[]): Spinner
+
+  /** Show failure (✗) without stopping the spinner */
   fail(text?: string | undefined, ...extras: unknown[]): Spinner
+  /** Show failure (✗) and stop the spinner, auto-clearing the line */
   failAndStop(text?: string | undefined, ...extras: unknown[]): Spinner
 
-  // text property returns a method via _textMethod override
-  text(value: string): Spinner
-  text(): string
-
+  /** Increase indentation by specified spaces (default: 2) */
   indent(spaces?: number | undefined): Spinner
-  dedent(spaces?: number | undefined): Spinner
 
+  /** Show info (ℹ) message without stopping the spinner */
   info(text?: string | undefined, ...extras: unknown[]): Spinner
+  /** Show info (ℹ) message and stop the spinner, auto-clearing the line */
   infoAndStop(text?: string | undefined, ...extras: unknown[]): Spinner
+
+  /** Log to stdout without stopping the spinner */
   log(text?: string | undefined, ...extras: unknown[]): Spinner
+  /** Log and stop the spinner, auto-clearing the line */
   logAndStop(text?: string | undefined, ...extras: unknown[]): Spinner
 
+  /** Update progress bar with current/total values and optional unit */
+  progress(current: number, total: number, unit?: string | undefined): Spinner
+  /** Increment progress by specified amount (default: 1) */
+  progressStep(amount?: number): Spinner
+
+  /** Show reasoning (∴) message without stopping the spinner */
+  reason(text?: string | undefined, ...extras: unknown[]): Spinner
+  /** Show reasoning (∴) message and stop the spinner, auto-clearing the line */
+  reasonAndStop(text?: string | undefined, ...extras: unknown[]): Spinner
+
+  /** Set complete shimmer configuration */
+  setShimmer(config: ShimmerConfig): Spinner
+
+  /** Start spinning with optional text */
   start(text?: string | undefined): Spinner
+
+  /** Show main step message to stderr without stopping */
+  step(text?: string | undefined, ...extras: unknown[]): Spinner
+
+  /** Stop spinning and clear internal state, auto-clearing the line */
   stop(text?: string | undefined): Spinner
+  /** Stop and show final text without clearing the line */
   stopAndPersist(text?: string | undefined): Spinner
 
-  step(text?: string | undefined, ...extras: unknown[]): Spinner
+  /** Show indented substep message to stderr without stopping */
   substep(text?: string | undefined, ...extras: unknown[]): Spinner
 
+  /** Show success (✓) without stopping the spinner */
   success(text?: string | undefined, ...extras: unknown[]): Spinner
+  /** Show success (✓) and stop the spinner, auto-clearing the line */
   successAndStop(text?: string | undefined, ...extras: unknown[]): Spinner
 
-  done(text?: string | undefined, ...extras: unknown[]): Spinner
-  doneAndStop(text?: string | undefined, ...extras: unknown[]): Spinner
-
-  progress(current: number, total: number, unit?: string | undefined): Spinner
-  progressStep(amount?: number): Spinner
+  /** Get current spinner text (getter) or set new text (setter) */
+  text(value: string): Spinner
+  text(): string
 
-  shimmer(enabled: boolean): Spinner
-  shimmer(config: Partial<ShimmerConfig> | ShimmerDirection): Spinner
+  /** Update partial shimmer configuration */
+  updateShimmer(config: Partial<ShimmerConfig>): Spinner
 
+  /** Show warning (⚠) without stopping the spinner */
   warn(text?: string | undefined, ...extras: unknown[]): Spinner
+  /** Show warning (⚠) and stop the spinner, auto-clearing the line */
   warnAndStop(text?: string | undefined, ...extras: unknown[]): Spinner
 }
 
+/**
+ * Configuration options for creating a spinner instance.
+ */
 export type SpinnerOptions = {
+  /**
+   * Spinner color as RGB tuple or color name.
+   * @default [140, 82, 255] Socket purple
+   */
   readonly color?: ColorValue | undefined
+  /**
+   * Shimmer effect configuration or direction string.
+   * When enabled, text will have an animated shimmer effect.
+   * @default undefined No shimmer effect
+   */
   readonly shimmer?: ShimmerConfig | ShimmerDirection | undefined
+  /**
+   * Animation style with frames and timing.
+   * @default 'socket' Custom Socket animation in CLI, minimal in CI
+   */
   readonly spinner?: SpinnerStyle | undefined
+  /**
+   * Abort signal for cancelling the spinner.
+   * @default getAbortSignal() from process constants
+   */
   readonly signal?: AbortSignal | undefined
+  /**
+   * Output stream for spinner rendering.
+   * @default process.stderr
+   */
   readonly stream?: Writable | undefined
+  /**
+   * Initial text to display with the spinner.
+   * @default undefined No initial text
+   */
   readonly text?: string | undefined
+  /**
+   * Theme to use for spinner colors.
+   * Accepts theme name ('socket', 'sunset', etc.) or Theme object.
+   * @default Current theme from getTheme()
+   */
+  readonly theme?:
+    | import('./themes/types').Theme
+    | import('./themes/themes').ThemeName
+    | undefined
 }
 
+/**
+ * Animation style definition for spinner frames.
+ * Defines the visual appearance and timing of the spinner animation.
+ */
 export type SpinnerStyle = {
+  /** Array of animation frames (strings to display sequentially) */
   readonly frames: string[]
+  /**
+   * Milliseconds between frame changes.
+   * @default 80 Standard frame rate
+   */
   readonly interval?: number | undefined
 }
 
+/**
+ * Minimal spinner style for CI environments.
+ * Uses empty frame and max interval to effectively disable animation in CI.
+ */
 export const ciSpinner: SpinnerStyle = {
   frames: [''],
   interval: 2_147_483_647,
 }
 
+/**
+ * Create a property descriptor for defining non-enumerable properties.
+ * Used for adding aliased methods to the Spinner prototype.
+ * @param value - Value for the property
+ * @returns Property descriptor object
+ * @private
+ */
 function desc(value: unknown) {
   return {
     __proto__: null,
@@ -170,10 +269,24 @@ function desc(value: unknown) {
   }
 }
 
+/**
+ * Normalize text input by trimming leading whitespace.
+ * Non-string values are converted to empty string.
+ * @param value - Text to normalize
+ * @returns Normalized string with leading whitespace removed
+ * @private
+ */
 function normalizeText(value: unknown) {
   return typeof value === 'string' ? value.trimStart() : ''
 }
 
+/**
+ * Format progress information as a visual progress bar with percentage and count.
+ * @param progress - Progress tracking information
+ * @returns Formatted string with colored progress bar, percentage, and count
+ * @private
+ * @example "███████░░░░░░░░░░░░░ 35% (7/20 files)"
+ */
 function formatProgress(progress: ProgressInfo): string {
   const { current, total, unit } = progress
   const percentage = Math.round((current / total) * 100)
@@ -182,12 +295,21 @@ function formatProgress(progress: ProgressInfo): string {
   return `${bar} ${percentage}% (${count})`
 }
 
+/**
+ * Render a progress bar using block characters (█ for filled, ░ for empty).
+ * @param percentage - Progress percentage (0-100)
+ * @param width - Total width of progress bar in characters
+ * @returns Colored progress bar string
+ * @default width=20
+ * @private
+ */
 function renderProgressBar(percentage: number, width: number = 20): string {
   const filled = Math.round((percentage / 100) * width)
   const empty = width - filled
   const bar = '█'.repeat(filled) + '░'.repeat(empty)
   // Use cyan color for the progress bar
-  const colors = /*@__PURE__*/ require('../external/yoctocolors-cjs')
+  const colors =
+    /*@__PURE__*/ require('./external/yoctocolors-cjs') as typeof import('yoctocolors-cjs')
   return colors.cyan(bar)
 }
 
@@ -197,22 +319,32 @@ let _cliSpinners: Record<string, SpinnerStyle> | undefined
  * Get available CLI spinner styles or a specific style by name.
  * Extends the standard cli-spinners collection with Socket custom spinners.
  *
- * @see https://github.com/sindresorhus/cli-spinners/blob/main/spinners.json
- *
  * Custom spinners:
  * - `socket` (default): Socket pulse animation with sparkles and lightning
+ *
+ * @param styleName - Optional name of specific spinner style to retrieve
+ * @returns Specific spinner style if name provided, all styles if omitted, `undefined` if style not found
+ * @see https://github.com/sindresorhus/cli-spinners/blob/main/spinners.json
+ *
+ * @example
+ * ```ts
+ * // Get all available spinner styles
+ * const allSpinners = getCliSpinners()
+ *
+ * // Get specific style
+ * const socketStyle = getCliSpinners('socket')
+ * const dotsStyle = getCliSpinners('dots')
+ * ```
  */
 /*@__NO_SIDE_EFFECTS__*/
 export function getCliSpinners(
   styleName?: string | undefined,
 ): SpinnerStyle | Record<string, SpinnerStyle> | undefined {
   if (_cliSpinners === undefined) {
-    // biome-ignore lint/suspicious/noExplicitAny: Accessing internal yocto-spinner constructor.
-    const YoctoCtor = yoctoSpinner as any
+    const YoctoCtor: any = yoctoSpinner as any
     // Get the YoctoSpinner class to access static properties.
-    const tempInstance = YoctoCtor({})
-    // biome-ignore lint/suspicious/noExplicitAny: Accessing internal yocto-spinner class.
-    const YoctoSpinnerClass = tempInstance.constructor as any
+    const tempInstance: any = YoctoCtor({})
+    const YoctoSpinnerClass: any = tempInstance.constructor as any
     // Extend the standard cli-spinners collection with Socket custom spinners.
     _cliSpinners = {
       __proto__: null,
@@ -233,35 +365,65 @@ let _defaultSpinner: SpinnerStyle | undefined
 
 /**
  * Create a spinner instance for displaying loading indicators.
+ * Provides an animated CLI spinner with status messages, progress tracking, and shimmer effects.
  *
  * AUTO-CLEAR BEHAVIOR:
  * - All *AndStop() methods AUTO-CLEAR the spinner line via yocto-spinner.stop()
- *   Examples: doneAndStop(), successAndStop(), failAndStop(), etc.
+ *   Examples: `doneAndStop()`, `successAndStop()`, `failAndStop()`, etc.
  *
  * - Methods WITHOUT "AndStop" do NOT clear (spinner keeps spinning)
- *   Examples: done(), success(), fail(), etc.
+ *   Examples: `done()`, `success()`, `fail()`, etc.
  *
  * STREAM USAGE:
  * - Spinner animation: stderr (yocto-spinner default)
  * - Status methods (done, success, fail, info, warn, step, substep): stderr
- * - Data methods (log): stdout
+ * - Data methods (`log()`): stdout
  *
  * COMPARISON WITH LOGGER:
- * - logger.done() does NOT auto-clear (requires manual logger.clearLine())
- * - spinner.doneAndStop() DOES auto-clear (built into yocto-spinner.stop())
- * - Pattern: logger.clearLine().done() vs spinner.doneAndStop()
+ * - `logger.done()` does NOT auto-clear (requires manual `logger.clearLine()`)
+ * - `spinner.doneAndStop()` DOES auto-clear (built into yocto-spinner.stop())
+ * - Pattern: `logger.clearLine().done()` vs `spinner.doneAndStop()`
+ *
+ * @param options - Configuration options for the spinner
+ * @returns New spinner instance
+ *
+ * @example
+ * ```ts
+ * import { Spinner } from '@socketsecurity/lib/spinner'
+ *
+ * // Basic usage
+ * const spinner = Spinner({ text: 'Loading data…' })
+ * spinner.start()
+ * await fetchData()
+ * spinner.successAndStop('Data loaded!')
+ *
+ * // With custom color
+ * const spinner = Spinner({
+ *   text: 'Processing…',
+ *   color: [255, 0, 0] // Red
+ * })
+ *
+ * // With shimmer effect
+ * const spinner = Spinner({
+ *   text: 'Building…',
+ *   shimmer: { dir: 'ltr', speed: 0.5 }
+ * })
+ *
+ * // Show progress
+ * spinner.progress(5, 10, 'files')
+ * spinner.progressStep() // Increment by 1
+ * ```
  */
 /*@__NO_SIDE_EFFECTS__*/
 export function Spinner(options?: SpinnerOptions | undefined): Spinner {
   if (_Spinner === undefined) {
-    // biome-ignore lint/suspicious/noExplicitAny: Accessing internal yocto-spinner constructor.
     const YoctoCtor = yoctoSpinner as any
     // Get the actual YoctoSpinner class from an instance
     const tempInstance = YoctoCtor({})
     const YoctoSpinnerClass = tempInstance.constructor
+    const logger = getDefaultLogger()
 
     /*@__PURE__*/
-    // biome-ignore lint/suspicious/noExplicitAny: Extending yocto-spinner class.
     _Spinner = class SpinnerClass extends (YoctoSpinnerClass as any) {
       declare isSpinning: boolean
       #baseText: string = ''
@@ -273,8 +435,35 @@ export function Spinner(options?: SpinnerOptions | undefined): Spinner {
       constructor(options?: SpinnerOptions | undefined) {
         const opts = { __proto__: null, ...options } as SpinnerOptions
 
-        // Convert color option to RGB (default to Socket purple).
-        const spinnerColor = opts.color ?? ([140, 82, 255] as const)
+        // Get theme from options or current theme
+        let theme = getTheme()
+        if (opts.theme) {
+          // Resolve theme name or use Theme object directly
+          if (typeof opts.theme === 'string') {
+            theme = THEMES[opts.theme]
+          } else {
+            theme = opts.theme
+          }
+        }
+
+        // Get default color from theme if not specified
+        let defaultColor: ColorValue = theme.colors.primary
+        if (theme.effects?.spinner?.color) {
+          const resolved = resolveColor(
+            theme.effects.spinner.color,
+            theme.colors,
+          )
+          // resolveColor can return 'inherit' or gradients which aren't valid for spinner
+          // Fall back to primary for these cases
+          if (resolved === 'inherit' || Array.isArray(resolved[0])) {
+            defaultColor = theme.colors.primary
+          } else {
+            defaultColor = resolved as ColorValue
+          }
+        }
+
+        // Convert color option to RGB (default from theme).
+        const spinnerColor = opts.color ?? defaultColor
 
         // Validate RGB tuple if provided.
         if (
@@ -378,6 +567,20 @@ export function Spinner(options?: SpinnerOptions | undefined): Spinner {
         super.color = isRgbTuple(value) ? value : toRgb(value)
       }
 
+      // Getter to expose current shimmer state.
+      get shimmerState(): ShimmerInfo | undefined {
+        if (!this.#shimmer) {
+          return undefined
+        }
+        return {
+          color: this.#shimmer.color,
+          currentDir: this.#shimmer.currentDir,
+          mode: this.#shimmer.mode,
+          speed: this.#shimmer.speed,
+          step: this.#shimmer.step,
+        } as ShimmerInfo
+      }
+
       /**
        * Apply a yocto-spinner method and update logger state.
        * Handles text normalization, extra arguments, and logger tracking.
@@ -394,12 +597,11 @@ export function Spinner(options?: SpinnerOptions | undefined): Spinner {
         }
         const wasSpinning = this.isSpinning
         const normalized = normalizeText(text)
-        super[methodName](normalized)
-        const {
-          incLogCallCountSymbol,
-          lastWasBlankSymbol,
-          logger,
-        } = /*@__PURE__*/ require('./logger.js')
+        if (methodName === 'stop' && !normalized) {
+          super[methodName]()
+        } else {
+          super[methodName](normalized)
+        }
         if (methodName === 'stop') {
           if (wasSpinning && normalized) {
             logger[lastWasBlankSymbol](isBlankString(normalized))
@@ -463,6 +665,7 @@ export function Spinner(options?: SpinnerOptions | undefined): Spinner {
       /**
        * Show a status message without stopping the spinner.
        * Outputs the symbol and message to stderr, then continues spinning.
+       * @private
        */
       #showStatusAndKeepSpinning(symbolType: SymbolType, args: unknown[]) {
         let text = args.at(0)
@@ -474,7 +677,6 @@ export function Spinner(options?: SpinnerOptions | undefined): Spinner {
           text = ''
         }
 
-        const { LOG_SYMBOLS, logger } = /*@__PURE__*/ require('./logger.js')
         // Note: Status messages always go to stderr.
         logger.error(`${LOG_SYMBOLS[symbolType]} ${text}`, ...extras)
         return this
@@ -491,35 +693,53 @@ export function Spinner(options?: SpinnerOptions | undefined): Spinner {
       }
 
       /**
-       * Show a debug message without stopping the spinner (only if debug mode enabled).
+       * Show a debug message (ℹ) without stopping the spinner.
+       * Only displays if debug mode is enabled via environment variable.
        * Outputs to stderr and continues spinning.
+       *
+       * @param text - Debug message to display
+       * @param extras - Additional values to log
+       * @returns This spinner for chaining
        */
-      debug(...args: unknown[]) {
-        const { isDebug } = /*@__PURE__*/ require('./debug.js')
+      debug(text?: string | undefined, ...extras: unknown[]) {
         if (isDebug()) {
-          return this.#showStatusAndKeepSpinning('info', args)
+          return this.#showStatusAndKeepSpinning('info', [text, ...extras])
         }
         return this
       }
 
       /**
-       * Show a debug message and stop the spinner (only if debug mode enabled).
+       * Show a debug message (ℹ) and stop the spinner.
+       * Only displays if debug mode is enabled via environment variable.
        * Auto-clears the spinner line before displaying the message.
+       *
+       * @param text - Debug message to display
+       * @param extras - Additional values to log
+       * @returns This spinner for chaining
        */
-      debugAndStop(...args: unknown[]) {
-        const { isDebug } = /*@__PURE__*/ require('./debug.js')
+      debugAndStop(text?: string | undefined, ...extras: unknown[]) {
         if (isDebug()) {
-          return this.#apply('info', args)
+          return this.#apply('info', [text, ...extras])
         }
         return this
       }
 
       /**
-       * Decrease indentation level.
-       * Pass 0 to reset indentation to zero.
-       * @param spaces - Number of spaces to remove (default: 2)
+       * Decrease indentation level by removing spaces from the left.
+       * Pass 0 to reset indentation to zero completely.
+       *
+       * @param spaces - Number of spaces to remove
+       * @returns This spinner for chaining
+       * @default spaces=2
+       *
+       * @example
+       * ```ts
+       * spinner.dedent()    // Remove 2 spaces
+       * spinner.dedent(4)   // Remove 4 spaces
+       * spinner.dedent(0)   // Reset to zero indentation
+       * ```
        */
-      dedent(spaces?: number) {
+      dedent(spaces?: number | undefined) {
         // Pass 0 to reset indentation
         if (spaces === 0) {
           this.#indentation = ''
@@ -533,46 +753,119 @@ export function Spinner(options?: SpinnerOptions | undefined): Spinner {
       }
 
       /**
-       * Alias for success() (shorter name).
-       * DESIGN DECISION: Unlike yocto-spinner, our done() does NOT stop the spinner.
-       * Use doneAndStop() if you want to stop the spinner.
+       * Disable shimmer effect.
+       * Preserves config for later re-enable via enableShimmer().
+       *
+       * @returns This spinner for chaining
+       *
+       * @example
+       * spinner.disableShimmer()
        */
-      done(...args: unknown[]) {
-        return this.#showStatusAndKeepSpinning('success', args)
+      disableShimmer(): Spinner {
+        // Disable shimmer but preserve config.
+        this.#shimmer = undefined
+        this.#updateSpinnerText()
+        return this as unknown as Spinner
       }
 
       /**
-       * Show a done message and stop the spinner.
+       * Show a done/success message (✓) without stopping the spinner.
+       * Alias for `success()` with a shorter name.
+       *
+       * DESIGN DECISION: Unlike yocto-spinner, our `done()` does NOT stop the spinner.
+       * Use `doneAndStop()` if you want to stop the spinner.
+       *
+       * @param text - Message to display
+       * @param extras - Additional values to log
+       * @returns This spinner for chaining
+       */
+      done(text?: string | undefined, ...extras: unknown[]) {
+        return this.#showStatusAndKeepSpinning('success', [text, ...extras])
+      }
+
+      /**
+       * Show a done/success message (✓) and stop the spinner.
        * Auto-clears the spinner line before displaying the success message.
+       *
+       * @param text - Message to display
+       * @param extras - Additional values to log
+       * @returns This spinner for chaining
        */
-      doneAndStop(...args: unknown[]) {
-        return this.#apply('success', args)
+      doneAndStop(text?: string | undefined, ...extras: unknown[]) {
+        return this.#apply('success', [text, ...extras])
       }
 
       /**
-       * Show a failure message without stopping the spinner.
-       * DESIGN DECISION: Unlike yocto-spinner, our fail() does NOT stop the spinner.
+       * Enable shimmer effect.
+       * Restores saved config or uses defaults if no saved config exists.
+       *
+       * @returns This spinner for chaining
+       *
+       * @example
+       * spinner.enableShimmer()
+       */
+      enableShimmer(): Spinner {
+        if (this.#shimmerSavedConfig) {
+          // Restore saved config.
+          this.#shimmer = { ...this.#shimmerSavedConfig }
+        } else {
+          // Create default config.
+          this.#shimmer = {
+            color: COLOR_INHERIT,
+            currentDir: DIR_LTR,
+            mode: DIR_LTR,
+            speed: 1 / 3,
+            step: 0,
+          } as ShimmerInfo
+          this.#shimmerSavedConfig = this.#shimmer
+        }
+
+        this.#updateSpinnerText()
+        return this as unknown as Spinner
+      }
+
+      /**
+       * Show a failure message (✗) without stopping the spinner.
+       * DESIGN DECISION: Unlike yocto-spinner, our `fail()` does NOT stop the spinner.
        * This allows displaying errors while continuing to spin.
-       * Use failAndStop() if you want to stop the spinner.
+       * Use `failAndStop()` if you want to stop the spinner.
+       *
+       * @param text - Error message to display
+       * @param extras - Additional values to log
+       * @returns This spinner for chaining
        */
-      fail(...args: unknown[]) {
-        return this.#showStatusAndKeepSpinning('fail', args)
+      fail(text?: string | undefined, ...extras: unknown[]) {
+        return this.#showStatusAndKeepSpinning('fail', [text, ...extras])
       }
 
       /**
-       * Show a failure message and stop the spinner.
+       * Show a failure message (✗) and stop the spinner.
        * Auto-clears the spinner line before displaying the error message.
+       *
+       * @param text - Error message to display
+       * @param extras - Additional values to log
+       * @returns This spinner for chaining
        */
-      failAndStop(...args: unknown[]) {
-        return this.#apply('error', args)
+      failAndStop(text?: string | undefined, ...extras: unknown[]) {
+        return this.#apply('error', [text, ...extras])
       }
 
       /**
-       * Increase indentation level.
-       * Pass 0 to reset indentation to zero.
-       * @param spaces - Number of spaces to add (default: 2)
+       * Increase indentation level by adding spaces to the left.
+       * Pass 0 to reset indentation to zero completely.
+       *
+       * @param spaces - Number of spaces to add
+       * @returns This spinner for chaining
+       * @default spaces=2
+       *
+       * @example
+       * ```ts
+       * spinner.indent()    // Add 2 spaces
+       * spinner.indent(4)   // Add 4 spaces
+       * spinner.indent(0)   // Reset to zero indentation
+       * ```
        */
-      indent(spaces?: number) {
+      indent(spaces?: number | undefined) {
         // Pass 0 to reset indentation
         if (spaces === 0) {
           this.#indentation = ''
@@ -585,45 +878,67 @@ export function Spinner(options?: SpinnerOptions | undefined): Spinner {
       }
 
       /**
-       * Show an info message without stopping the spinner.
+       * Show an info message (ℹ) without stopping the spinner.
        * Outputs to stderr and continues spinning.
+       *
+       * @param text - Info message to display
+       * @param extras - Additional values to log
+       * @returns This spinner for chaining
        */
-      info(...args: unknown[]) {
-        return this.#showStatusAndKeepSpinning('info', args)
+      info(text?: string | undefined, ...extras: unknown[]) {
+        return this.#showStatusAndKeepSpinning('info', [text, ...extras])
       }
 
       /**
-       * Show an info message and stop the spinner.
+       * Show an info message (ℹ) and stop the spinner.
        * Auto-clears the spinner line before displaying the message.
+       *
+       * @param text - Info message to display
+       * @param extras - Additional values to log
+       * @returns This spinner for chaining
        */
-      infoAndStop(...args: unknown[]) {
-        return this.#apply('info', args)
+      infoAndStop(text?: string | undefined, ...extras: unknown[]) {
+        return this.#apply('info', [text, ...extras])
       }
 
       /**
        * Log a message to stdout without stopping the spinner.
-       * Unlike other methods, this outputs to stdout for data logging.
+       * Unlike other status methods, this outputs to stdout for data logging.
+       *
+       * @param args - Values to log to stdout
+       * @returns This spinner for chaining
        */
       log(...args: unknown[]) {
-        const { logger } = /*@__PURE__*/ require('./logger.js')
         logger.log(...args)
         return this
       }
 
       /**
-       * Log a message and stop the spinner.
+       * Log a message to stdout and stop the spinner.
        * Auto-clears the spinner line before displaying the message.
+       *
+       * @param text - Message to display
+       * @param extras - Additional values to log
+       * @returns This spinner for chaining
        */
-      logAndStop(...args: unknown[]) {
-        return this.#apply('stop', args)
+      logAndStop(text?: string | undefined, ...extras: unknown[]) {
+        return this.#apply('stop', [text, ...extras])
       }
 
       /**
        * Update progress information displayed with the spinner.
        * Shows a progress bar with percentage and optional unit label.
+       *
        * @param current - Current progress value
-       * @param total - Total progress value
+       * @param total - Total/maximum progress value
        * @param unit - Optional unit label (e.g., 'files', 'items')
+       * @returns This spinner for chaining
+       *
+       * @example
+       * ```ts
+       * spinner.progress(5, 10)            // "███████░░░░░░░░░░░░░ 50% (5/10)"
+       * spinner.progress(7, 20, 'files')   // "███████░░░░░░░░░░░░░ 35% (7/20 files)"
+       * ```
        */
       progress = (
         current: number,
@@ -643,7 +958,18 @@ export function Spinner(options?: SpinnerOptions | undefined): Spinner {
       /**
        * Increment progress by a specified amount.
        * Updates the progress bar displayed with the spinner.
-       * @param amount - Amount to increment (default: 1)
+       * Clamps the result between 0 and the total value.
+       *
+       * @param amount - Amount to increment by
+       * @returns This spinner for chaining
+       * @default amount=1
+       *
+       * @example
+       * ```ts
+       * spinner.progress(0, 10, 'files')
+       * spinner.progressStep()    // Progress: 1/10
+       * spinner.progressStep(3)   // Progress: 4/10
+       * ```
        */
       progressStep(amount: number = 1) {
         if (this.#progress) {
@@ -659,10 +985,86 @@ export function Spinner(options?: SpinnerOptions | undefined): Spinner {
         return this
       }
 
+      /**
+       * Show a reasoning/working message (∴) without stopping the spinner.
+       * Outputs to stderr and continues spinning.
+       *
+       * @param text - Reasoning message to display
+       * @param extras - Additional values to log
+       * @returns This spinner for chaining
+       */
+      reason(text?: string | undefined, ...extras: unknown[]) {
+        return this.#showStatusAndKeepSpinning('reason', [text, ...extras])
+      }
+
+      /**
+       * Show a reasoning/working message (∴) and stop the spinner.
+       * Auto-clears the spinner line before displaying the message.
+       *
+       * Implementation note: Unlike other *AndStop methods (successAndStop, failAndStop, etc.),
+       * this method cannot use #apply() with a 'reason' method name because yocto-spinner
+       * doesn't have a built-in 'reason' method. Instead, we manually stop the spinner then
+       * log the message with the reason symbol. This matches the pattern used by methods
+       * like debugAndStop() and maintains consistency with normalizeText() usage and empty
+       * string handling (see #apply's stop method handling for the pattern).
+       *
+       * @param text - Reasoning message to display
+       * @param extras - Additional values to log
+       * @returns This spinner for chaining
+       */
+      reasonAndStop(text?: string | undefined, ...extras: unknown[]) {
+        // Stop spinner first (can't use #apply('reason') since yocto-spinner has no 'reason' method)
+        this.#apply('stop', [])
+        // Normalize text (trim leading whitespace) like other methods
+        const normalized = normalizeText(text)
+        // Only log if we have actual content (consistent with #apply's stop method handling)
+        if (normalized) {
+          logger.error(`${LOG_SYMBOLS.reason} ${normalized}`, ...extras)
+        }
+        return this
+      }
+
+      /**
+       * Set complete shimmer configuration.
+       * Replaces any existing shimmer config with the provided values.
+       * Undefined properties will use default values.
+       *
+       * @param config - Complete shimmer configuration
+       * @returns This spinner for chaining
+       *
+       * @example
+       * spinner.setShimmer({
+       *   color: [255, 0, 0],
+       *   dir: 'rtl',
+       *   speed: 0.5
+       * })
+       */
+      setShimmer(config: ShimmerConfig): Spinner {
+        this.#shimmer = {
+          color: config.color ?? COLOR_INHERIT,
+          currentDir: DIR_LTR,
+          mode: config.dir ?? DIR_LTR,
+          speed: config.speed ?? 1 / 3,
+          step: 0,
+        } as ShimmerInfo
+        this.#shimmerSavedConfig = this.#shimmer
+        this.#updateSpinnerText()
+        return this as unknown as Spinner
+      }
+
       /**
        * Start the spinner animation with optional text.
-       * Begins displaying the animated spinner.
+       * Begins displaying the animated spinner on stderr.
+       *
        * @param text - Optional text to display with the spinner
+       * @returns This spinner for chaining
+       *
+       * @example
+       * ```ts
+       * spinner.start('Loading…')
+       * // Later:
+       * spinner.successAndStop('Done!')
+       * ```
        */
       start(...args: unknown[]) {
         if (args.length) {
@@ -679,38 +1081,33 @@ export function Spinner(options?: SpinnerOptions | undefined): Spinner {
         }
 
         this.#updateSpinnerText()
-        return this.#apply('start', args)
+        // Don't pass text to yocto-spinner.start() since we already set it via #updateSpinnerText().
+        // Passing args would cause duplicate message output.
+        return this.#apply('start', [])
       }
 
       /**
        * Log a main step message to stderr without stopping the spinner.
        * Adds a blank line before the message for visual separation.
-       * Aligns with logger.step() to use stderr for status messages.
+       * Aligns with `logger.step()` to use stderr for status messages.
+       *
+       * @param text - Step message to display
+       * @param extras - Additional values to log
+       * @returns This spinner for chaining
+       *
+       * @example
+       * ```ts
+       * spinner.step('Building application')
+       * spinner.substep('Compiling TypeScript')
+       * spinner.substep('Bundling assets')
+       * ```
        */
-      step(...args: unknown[]) {
-        const text = args[0]
-        const { logger } = /*@__PURE__*/ require('./logger.js')
+      step(text?: string | undefined, ...extras: unknown[]) {
         if (typeof text === 'string') {
           // Add blank line before step for visual separation.
           logger.error('')
           // Use error (stderr) to align with logger.step() default stream.
-          logger.error(text, ...args.slice(1))
-        }
-        return this
-      }
-
-      /**
-       * Log an indented substep message to stderr without stopping the spinner.
-       * Adds 2-space indentation to the message.
-       * Aligns with logger.substep() to use stderr for status messages.
-       */
-      substep(...args: unknown[]) {
-        const text = args[0]
-        if (typeof text === 'string') {
-          // Add 2-space indent for substep.
-          const { logger } = /*@__PURE__*/ require('./logger.js')
-          // Use error (stderr) to align with logger.substep() default stream.
-          logger.error(`  ${text}`, ...args.slice(1))
+          logger.error(text, ...extras)
         }
         return this
       }
@@ -719,9 +1116,26 @@ export function Spinner(options?: SpinnerOptions | undefined): Spinner {
        * Stop the spinner animation and clear internal state.
        * Auto-clears the spinner line via yocto-spinner.stop().
        * Resets progress, shimmer, and text state.
+       *
        * @param text - Optional final text to display after stopping
+       * @returns This spinner for chaining
+       *
+       * @example
+       * ```ts
+       * spinner.start('Processing…')
+       * // Do work
+       * spinner.stop() // Just stop, no message
+       * // or
+       * spinner.stop('Finished processing')
+       * ```
        */
       stop(...args: unknown[]) {
+        // Clear the spinner text BEFORE stopping to prevent ghost frames.
+        // This ensures the terminal line is fully cleared before we stop the animation.
+        if (!args.length || !args[0]) {
+          super.text = ''
+        }
+
         // Clear internal state.
         this.#baseText = ''
         this.#progress = undefined
@@ -730,38 +1144,82 @@ export function Spinner(options?: SpinnerOptions | undefined): Spinner {
           this.#shimmer.currentDir = DIR_LTR
           this.#shimmer.step = 0
         }
-        // Call parent stop first (clears screen, sets isSpinning = false).
+        // Call parent stop (clears screen, sets isSpinning = false).
         const result = this.#apply('stop', args)
-        // Then clear text to avoid blank frame render.
-        // This is safe now because isSpinning is false.
+        // Ensure text is cleared after stop completes.
         super.text = ''
         return result
       }
 
       /**
-       * Show a success message without stopping the spinner.
-       * DESIGN DECISION: Unlike yocto-spinner, our success() does NOT stop the spinner.
+       * Log an indented substep message to stderr without stopping the spinner.
+       * Adds 2-space indentation to the message.
+       * Aligns with `logger.substep()` to use stderr for status messages.
+       *
+       * @param text - Substep message to display
+       * @param extras - Additional values to log
+       * @returns This spinner for chaining
+       *
+       * @example
+       * ```ts
+       * spinner.step('Building application')
+       * spinner.substep('Compiling TypeScript')
+       * spinner.substep('Bundling assets')
+       * ```
+       */
+      substep(text?: string | undefined, ...extras: unknown[]) {
+        if (typeof text === 'string') {
+          // Add 2-space indent for substep.
+          // Use error (stderr) to align with logger.substep() default stream.
+          logger.error(`  ${text}`, ...extras)
+        }
+        return this
+      }
+
+      /**
+       * Show a success message (✓) without stopping the spinner.
+       * DESIGN DECISION: Unlike yocto-spinner, our `success()` does NOT stop the spinner.
        * This allows displaying success messages while continuing to spin for multi-step operations.
-       * Use successAndStop() if you want to stop the spinner.
+       * Use `successAndStop()` if you want to stop the spinner.
+       *
+       * @param text - Success message to display
+       * @param extras - Additional values to log
+       * @returns This spinner for chaining
        */
-      success(...args: unknown[]) {
-        return this.#showStatusAndKeepSpinning('success', args)
+      success(text?: string | undefined, ...extras: unknown[]) {
+        return this.#showStatusAndKeepSpinning('success', [text, ...extras])
       }
 
       /**
-       * Show a success message and stop the spinner.
+       * Show a success message (✓) and stop the spinner.
        * Auto-clears the spinner line before displaying the success message.
+       *
+       * @param text - Success message to display
+       * @param extras - Additional values to log
+       * @returns This spinner for chaining
        */
-      successAndStop(...args: unknown[]) {
-        return this.#apply('success', args)
+      successAndStop(text?: string | undefined, ...extras: unknown[]) {
+        return this.#apply('success', [text, ...extras])
       }
 
       /**
        * Get or set the spinner text.
-       * When called with no arguments, returns the current text.
-       * When called with text, updates the display and returns the spinner.
+       * When called with no arguments, returns the current base text.
+       * When called with text, updates the display and returns the spinner for chaining.
+       *
        * @param value - Text to display (omit to get current text)
        * @returns Current text (getter) or this spinner (setter)
+       *
+       * @example
+       * ```ts
+       * // Setter
+       * spinner.text('Loading data…')
+       * spinner.text('Processing…')
+       *
+       * // Getter
+       * const current = spinner.text()
+       * console.log(current) // "Processing…"
+       * ```
        */
       text(): string
       text(value: string): Spinner
@@ -778,149 +1236,97 @@ export function Spinner(options?: SpinnerOptions | undefined): Spinner {
       }
 
       /**
-       * Show a warning message without stopping the spinner.
-       * Outputs to stderr and continues spinning.
-       */
-      warn(...args: unknown[]) {
-        return this.#showStatusAndKeepSpinning('warn', args)
-      }
-
-      /**
-       * Show a warning message and stop the spinner.
-       * Auto-clears the spinner line before displaying the warning message.
-       */
-      warnAndStop(...args: unknown[]) {
-        return this.#apply('warning', args)
-      }
-
-      /**
-       * Toggle shimmer effect or update shimmer configuration.
-       * Preserves shimmer config when toggling off, allowing easy re-enable.
-       * Supports partial config updates to tweak specific properties.
+       * Update partial shimmer configuration.
+       * Merges with existing config, enabling shimmer if currently disabled.
        *
-       * @param enabledOrConfig - Boolean to toggle, partial config to update, or direction string
+       * @param config - Partial shimmer configuration to merge
        * @returns This spinner for chaining
        *
        * @example
-       * // Toggle off (preserves config for later re-enable)
-       * spinner.shimmer(false)
-       *
-       * // Toggle on (restores saved config or uses defaults)
-       * spinner.shimmer(true)
+       * // Update just the speed
+       * spinner.updateShimmer({ speed: 0.5 })
        *
-       * // Update specific properties
-       * spinner.shimmer({ speed: 0.5 })
-       * spinner.shimmer({ color: [255, 0, 0] })
+       * // Update direction
+       * spinner.updateShimmer({ dir: 'rtl' })
        *
-       * // Set direction
-       * spinner.shimmer('rtl')
+       * // Update multiple properties
+       * spinner.updateShimmer({ color: [255, 0, 0], speed: 0.8 })
        */
-      shimmer(
-        enabledOrConfig:
-          | boolean
-          | Partial<ShimmerConfig>
-          | ShimmerDirection
-          | undefined,
-      ): Spinner {
-        if (enabledOrConfig === false) {
-          // Disable shimmer but preserve config.
-          this.#shimmer = undefined
-        } else if (enabledOrConfig === true) {
-          // Re-enable with saved config or defaults.
-          if (this.#shimmerSavedConfig) {
-            // Restore saved config.
-            this.#shimmer = { ...this.#shimmerSavedConfig }
-          } else {
-            // Create default config.
-            this.#shimmer = {
-              color: COLOR_INHERIT,
-              currentDir: DIR_LTR,
-              mode: DIR_LTR,
-              speed: 1 / 3,
-              step: 0,
-            } as ShimmerInfo
-            this.#shimmerSavedConfig = this.#shimmer
-          }
-        } else if (typeof enabledOrConfig === 'string') {
-          // Direction string - update existing or create new.
-          if (this.#shimmer) {
-            // Update existing shimmer direction.
-            this.#shimmer = {
-              ...this.#shimmer,
-              mode: enabledOrConfig,
-            }
-            this.#shimmerSavedConfig = this.#shimmer
-          } else if (this.#shimmerSavedConfig) {
-            // Restore and update.
-            this.#shimmer = {
-              ...this.#shimmerSavedConfig,
-              mode: enabledOrConfig,
-            }
-            this.#shimmerSavedConfig = this.#shimmer
-          } else {
-            // Create new with direction.
-            this.#shimmer = {
-              color: COLOR_INHERIT,
-              currentDir: DIR_LTR,
-              mode: enabledOrConfig,
-              speed: 1 / 3,
-              step: 0,
-            } as ShimmerInfo
-            this.#shimmerSavedConfig = this.#shimmer
-          }
-        } else if (enabledOrConfig && typeof enabledOrConfig === 'object') {
-          // Partial config update - merge with existing or saved config.
-          const partialConfig = {
-            __proto__: null,
-            ...enabledOrConfig,
-          } as Partial<ShimmerConfig>
-
-          if (this.#shimmer) {
-            // Update existing shimmer.
-            this.#shimmer = {
-              ...this.#shimmer,
-              ...(partialConfig.color !== undefined
-                ? { color: partialConfig.color }
-                : {}),
-              ...(partialConfig.dir !== undefined
-                ? { mode: partialConfig.dir }
-                : {}),
-              ...(partialConfig.speed !== undefined
-                ? { speed: partialConfig.speed }
-                : {}),
-            } as ShimmerInfo
-            this.#shimmerSavedConfig = this.#shimmer
-          } else if (this.#shimmerSavedConfig) {
-            // Restore and update.
-            this.#shimmer = {
-              ...this.#shimmerSavedConfig,
-              ...(partialConfig.color !== undefined
-                ? { color: partialConfig.color }
-                : {}),
-              ...(partialConfig.dir !== undefined
-                ? { mode: partialConfig.dir }
-                : {}),
-              ...(partialConfig.speed !== undefined
-                ? { speed: partialConfig.speed }
-                : {}),
-            } as ShimmerInfo
-            this.#shimmerSavedConfig = this.#shimmer
-          } else {
-            // Create new with partial config.
-            this.#shimmer = {
-              color: partialConfig.color ?? COLOR_INHERIT,
-              currentDir: DIR_LTR,
-              mode: partialConfig.dir ?? DIR_LTR,
-              speed: partialConfig.speed ?? 1 / 3,
-              step: 0,
-            } as ShimmerInfo
-            this.#shimmerSavedConfig = this.#shimmer
-          }
+      updateShimmer(config: Partial<ShimmerConfig>): Spinner {
+        const partialConfig = {
+          __proto__: null,
+          ...config,
+        } as Partial<ShimmerConfig>
+
+        if (this.#shimmer) {
+          // Update existing shimmer.
+          this.#shimmer = {
+            ...this.#shimmer,
+            ...(partialConfig.color !== undefined
+              ? { color: partialConfig.color }
+              : {}),
+            ...(partialConfig.dir !== undefined
+              ? { mode: partialConfig.dir }
+              : {}),
+            ...(partialConfig.speed !== undefined
+              ? { speed: partialConfig.speed }
+              : {}),
+          } as ShimmerInfo
+          this.#shimmerSavedConfig = this.#shimmer
+        } else if (this.#shimmerSavedConfig) {
+          // Restore and update.
+          this.#shimmer = {
+            ...this.#shimmerSavedConfig,
+            ...(partialConfig.color !== undefined
+              ? { color: partialConfig.color }
+              : {}),
+            ...(partialConfig.dir !== undefined
+              ? { mode: partialConfig.dir }
+              : {}),
+            ...(partialConfig.speed !== undefined
+              ? { speed: partialConfig.speed }
+              : {}),
+          } as ShimmerInfo
+          this.#shimmerSavedConfig = this.#shimmer
+        } else {
+          // Create new with partial config.
+          this.#shimmer = {
+            color: partialConfig.color ?? COLOR_INHERIT,
+            currentDir: DIR_LTR,
+            mode: partialConfig.dir ?? DIR_LTR,
+            speed: partialConfig.speed ?? 1 / 3,
+            step: 0,
+          } as ShimmerInfo
+          this.#shimmerSavedConfig = this.#shimmer
         }
 
         this.#updateSpinnerText()
         return this as unknown as Spinner
       }
+
+      /**
+       * Show a warning message (⚠) without stopping the spinner.
+       * Outputs to stderr and continues spinning.
+       *
+       * @param text - Warning message to display
+       * @param extras - Additional values to log
+       * @returns This spinner for chaining
+       */
+      warn(text?: string | undefined, ...extras: unknown[]) {
+        return this.#showStatusAndKeepSpinning('warn', [text, ...extras])
+      }
+
+      /**
+       * Show a warning message (⚠) and stop the spinner.
+       * Auto-clears the spinner line before displaying the warning message.
+       *
+       * @param text - Warning message to display
+       * @param extras - Additional values to log
+       * @returns This spinner for chaining
+       */
+      warnAndStop(text?: string | undefined, ...extras: unknown[]) {
+        return this.#apply('warning', [text, ...extras])
+      }
     } as unknown as {
       new (options?: SpinnerOptions | undefined): Spinner
     }
@@ -931,7 +1337,7 @@ export function Spinner(options?: SpinnerOptions | undefined): Spinner {
       warning: desc(_Spinner.prototype.warn),
       warningAndStop: desc(_Spinner.prototype.warnAndStop),
     })
-    _defaultSpinner = CI
+    _defaultSpinner = getCI()
       ? ciSpinner
       : (getCliSpinners('socket') as SpinnerStyle)
   }
@@ -942,9 +1348,21 @@ export function Spinner(options?: SpinnerOptions | undefined): Spinner {
 }
 
 let _spinner: ReturnType<typeof Spinner> | undefined
+
 /**
  * Get the default spinner instance.
  * Lazily creates the spinner to avoid circular dependencies during module initialization.
+ * Reuses the same instance across calls.
+ *
+ * @returns Shared default spinner instance
+ *
+ * @example
+ * ```ts
+ * import { getDefaultSpinner } from '@socketsecurity/lib/spinner'
+ *
+ * const spinner = getDefaultSpinner()
+ * spinner.start('Loading…')
+ * ```
  */
 export function getDefaultSpinner(): ReturnType<typeof Spinner> {
   if (_spinner === undefined) {
@@ -953,33 +1371,38 @@ export function getDefaultSpinner(): ReturnType<typeof Spinner> {
   return _spinner
 }
 
+// REMOVED: Deprecated `spinner` export
+// Migration: Use getDefaultSpinner() instead
+// See: getDefaultSpinner() function above
+
 /**
- * @deprecated Use `getDefaultSpinner()` function instead for better tree-shaking and to avoid circular dependencies.
+ * Configuration options for `withSpinner()` helper.
+ * @template T - Return type of the async operation
  */
-export const spinner = /* @__PURE__ */ (() => {
-  // Lazy initialization to prevent circular dependency issues during module loading.
-  let _lazySpinner: ReturnType<typeof Spinner> | undefined
-  return new Proxy({} as ReturnType<typeof Spinner>, {
-    get(_target, prop) {
-      if (_lazySpinner === undefined) {
-        _lazySpinner = Spinner()
-      }
-      const value = _lazySpinner[prop as keyof ReturnType<typeof Spinner>]
-      return typeof value === 'function' ? value.bind(_lazySpinner) : value
-    },
-  })
-})()
-
 export type WithSpinnerOptions<T> = {
+  /** Message to display while the spinner is running */
   message: string
+  /** Async function to execute while spinner is active */
   operation: () => Promise<T>
+  /**
+   * Optional spinner instance to use.
+   * If not provided, operation runs without spinner.
+   */
   spinner?: Spinner | undefined
+  /**
+   * Optional spinner options to apply during the operation.
+   * These options will be pushed when the operation starts and popped when it completes.
+   * Supports color and shimmer configuration.
+   */
+  withOptions?: Partial<Pick<SpinnerOptions, 'color' | 'shimmer'>> | undefined
 }
 
 /**
  * Execute an async operation with spinner lifecycle management.
- * Ensures spinner.stop() is always called via try/finally, even if the operation throws.
+ * Ensures `spinner.stop()` is always called via try/finally, even if the operation throws.
+ * Provides safe cleanup and consistent spinner behavior.
  *
+ * @template T - Return type of the operation
  * @param options - Configuration object
  * @param options.message - Message to display while spinner is running
  * @param options.operation - Async function to execute
@@ -988,10 +1411,13 @@ export type WithSpinnerOptions<T> = {
  * @throws Re-throws any error from operation after stopping spinner
  *
  * @example
- * import { spinner, withSpinner } from '@socketsecurity/registry/lib/spinner'
+ * ```ts
+ * import { Spinner, withSpinner } from '@socketsecurity/lib/spinner'
+ *
+ * const spinner = Spinner()
  *
  * // With spinner instance
- * await withSpinner({
+ * const result = await withSpinner({
  *   message: 'Processing…',
  *   operation: async () => {
  *     return await processData()
@@ -999,18 +1425,19 @@ export type WithSpinnerOptions<T> = {
  *   spinner
  * })
  *
- * // Without spinner instance (no-op)
- * await withSpinner({
+ * // Without spinner instance (no-op, just runs operation)
+ * const result = await withSpinner({
  *   message: 'Processing…',
  *   operation: async () => {
  *     return await processData()
  *   }
  * })
+ * ```
  */
 export async function withSpinner<T>(
   options: WithSpinnerOptions<T>,
 ): Promise<T> {
-  const { message, operation, spinner } = {
+  const { message, operation, spinner, withOptions } = {
     __proto__: null,
     ...options,
   } as WithSpinnerOptions<T>
@@ -1019,35 +1446,78 @@ export async function withSpinner<T>(
     return await operation()
   }
 
+  // Save current options if we're going to change them
+  const savedColor =
+    withOptions?.color !== undefined ? spinner.color : undefined
+  const savedShimmerState =
+    withOptions?.shimmer !== undefined ? spinner.shimmerState : undefined
+
+  // Apply temporary options
+  if (withOptions?.color !== undefined) {
+    spinner.color = toRgb(withOptions.color)
+  }
+  if (withOptions?.shimmer !== undefined) {
+    if (typeof withOptions.shimmer === 'string') {
+      spinner.updateShimmer({ dir: withOptions.shimmer })
+    } else {
+      spinner.setShimmer(withOptions.shimmer)
+    }
+  }
+
   spinner.start(message)
   try {
     return await operation()
   } finally {
     spinner.stop()
+    // Restore previous options
+    if (savedColor !== undefined) {
+      spinner.color = savedColor
+    }
+    if (withOptions?.shimmer !== undefined) {
+      if (savedShimmerState) {
+        spinner.setShimmer({
+          color: savedShimmerState.color as any,
+          dir: savedShimmerState.mode,
+          speed: savedShimmerState.speed,
+        })
+      } else {
+        spinner.disableShimmer()
+      }
+    }
   }
 }
 
+/**
+ * Configuration options for `withSpinnerRestore()` helper.
+ * @template T - Return type of the async operation
+ */
 export type WithSpinnerRestoreOptions<T> = {
+  /** Async function to execute while spinner is stopped */
   operation: () => Promise<T>
+  /** Optional spinner instance to restore after operation */
   spinner?: Spinner | undefined
+  /** Whether spinner was spinning before the operation (used to conditionally restart) */
   wasSpinning: boolean
 }
 
 /**
  * Execute an async operation with conditional spinner restart.
  * Useful when you need to temporarily stop a spinner for an operation,
- * then restore it to its previous state.
+ * then restore it to its previous state (if it was spinning).
  *
+ * @template T - Return type of the operation
  * @param options - Configuration object
  * @param options.operation - Async function to execute
  * @param options.spinner - Optional spinner instance to manage
- * @param options.wasSpinning - Whether spinner was spinning before
+ * @param options.wasSpinning - Whether spinner was spinning before the operation
  * @returns Result of the operation
  * @throws Re-throws any error from operation after restoring spinner state
  *
  * @example
- * import { spinner, withSpinnerRestore } from '@socketsecurity/registry/lib/spinner'
+ * ```ts
+ * import { getDefaultSpinner, withSpinnerRestore } from '@socketsecurity/lib/spinner'
  *
+ * const spinner = getDefaultSpinner()
  * const wasSpinning = spinner.isSpinning
  * spinner.stop()
  *
@@ -1059,6 +1529,8 @@ export type WithSpinnerRestoreOptions<T> = {
  *   spinner,
  *   wasSpinning
  * })
+ * // Spinner is automatically restarted if wasSpinning was true
+ * ```
  */
 export async function withSpinnerRestore<T>(
   options: WithSpinnerRestoreOptions<T>,
@@ -1077,25 +1549,46 @@ export async function withSpinnerRestore<T>(
   }
 }
 
+/**
+ * Configuration options for `withSpinnerSync()` helper.
+ * @template T - Return type of the sync operation
+ */
 export type WithSpinnerSyncOptions<T> = {
+  /** Message to display while the spinner is running */
   message: string
+  /** Synchronous function to execute while spinner is active */
   operation: () => T
+  /**
+   * Optional spinner instance to use.
+   * If not provided, operation runs without spinner.
+   */
   spinner?: Spinner | undefined
+  /**
+   * Optional spinner options to apply during the operation.
+   * These options will be pushed when the operation starts and popped when it completes.
+   * Supports color and shimmer configuration.
+   */
+  withOptions?: Partial<Pick<SpinnerOptions, 'color' | 'shimmer'>> | undefined
 }
 
 /**
  * Execute a synchronous operation with spinner lifecycle management.
- * Ensures spinner.stop() is always called via try/finally, even if the operation throws.
+ * Ensures `spinner.stop()` is always called via try/finally, even if the operation throws.
+ * Provides safe cleanup and consistent spinner behavior for sync operations.
  *
+ * @template T - Return type of the operation
  * @param options - Configuration object
  * @param options.message - Message to display while spinner is running
- * @param options.operation - Function to execute
+ * @param options.operation - Synchronous function to execute
  * @param options.spinner - Optional spinner instance (if not provided, no spinner is used)
  * @returns Result of the operation
  * @throws Re-throws any error from operation after stopping spinner
  *
  * @example
- * import { spinner, withSpinnerSync} from '@socketsecurity/registry/lib/spinner'
+ * ```ts
+ * import { Spinner, withSpinnerSync } from '@socketsecurity/lib/spinner'
+ *
+ * const spinner = Spinner()
  *
  * const result = withSpinnerSync({
  *   message: 'Processing…',
@@ -1104,9 +1597,10 @@ export type WithSpinnerSyncOptions<T> = {
  *   },
  *   spinner
  * })
+ * ```
  */
 export function withSpinnerSync<T>(options: WithSpinnerSyncOptions<T>): T {
-  const { message, operation, spinner } = {
+  const { message, operation, spinner, withOptions } = {
     __proto__: null,
     ...options,
   } as WithSpinnerSyncOptions<T>
@@ -1115,10 +1609,43 @@ export function withSpinnerSync<T>(options: WithSpinnerSyncOptions<T>): T {
     return operation()
   }
 
+  // Save current options if we're going to change them
+  const savedColor =
+    withOptions?.color !== undefined ? spinner.color : undefined
+  const savedShimmerState =
+    withOptions?.shimmer !== undefined ? spinner.shimmerState : undefined
+
+  // Apply temporary options
+  if (withOptions?.color !== undefined) {
+    spinner.color = toRgb(withOptions.color)
+  }
+  if (withOptions?.shimmer !== undefined) {
+    if (typeof withOptions.shimmer === 'string') {
+      spinner.updateShimmer({ dir: withOptions.shimmer })
+    } else {
+      spinner.setShimmer(withOptions.shimmer)
+    }
+  }
+
   spinner.start(message)
   try {
     return operation()
   } finally {
     spinner.stop()
+    // Restore previous options
+    if (savedColor !== undefined) {
+      spinner.color = savedColor
+    }
+    if (withOptions?.shimmer !== undefined) {
+      if (savedShimmerState) {
+        spinner.setShimmer({
+          color: savedShimmerState.color as any,
+          dir: savedShimmerState.mode,
+          speed: savedShimmerState.speed,
+        })
+      } else {
+        spinner.disableShimmer()
+      }
+    }
   }
 }
diff --git a/src/stdio/clear.ts b/src/stdio/clear.ts
index d65c514..96294fc 100644
--- a/src/stdio/clear.ts
+++ b/src/stdio/clear.ts
@@ -4,7 +4,21 @@
  */
 
 /**
- * Clear the current line.
+ * Clear the current line in the terminal.
+ * Uses native TTY methods when available, falls back to ANSI escape codes.
+ *
+ * ANSI Sequences:
+ * - `\r`: Carriage return (move to line start)
+ * - `\x1b[K`: Clear from cursor to end of line
+ *
+ * @param stream - Output stream to clear
+ * @default stream process.stdout
+ *
+ * @example
+ * ```ts
+ * clearLine() // Clear current line on stdout
+ * clearLine(process.stderr) // Clear on stderr
+ * ```
  */
 export function clearLine(stream: NodeJS.WriteStream = process.stdout): void {
   if (stream.isTTY) {
@@ -18,7 +32,24 @@ export function clearLine(stream: NodeJS.WriteStream = process.stdout): void {
 }
 
 /**
- * Clear lines above the current position.
+ * Clear multiple lines above the current cursor position.
+ * Useful for clearing multi-line output like progress bars or status messages.
+ *
+ * ANSI Sequences:
+ * - `\x1b[1A`: Move cursor up one line
+ * - `\x1b[2K`: Erase entire line
+ *
+ * @param count - Number of lines to clear
+ * @param stream - Output stream to clear
+ * @default stream process.stdout
+ *
+ * @example
+ * ```ts
+ * console.log('Line 1')
+ * console.log('Line 2')
+ * console.log('Line 3')
+ * clearLines(2) // Clears lines 2 and 3
+ * ```
  */
 export function clearLines(
   count: number,
@@ -31,7 +62,19 @@ export function clearLines(
 }
 
 /**
- * Clear the entire screen.
+ * Clear the entire screen and reset cursor to top-left.
+ * Only works in TTY environments.
+ *
+ * ANSI Sequence:
+ * - `\x1bc`: Full reset (clear screen and move cursor home)
+ *
+ * @param stream - Output stream to clear
+ * @default stream process.stdout
+ *
+ * @example
+ * ```ts
+ * clearScreen() // Clear entire terminal
+ * ```
  */
 export function clearScreen(stream: NodeJS.WriteStream = process.stdout): void {
   if (stream.isTTY) {
@@ -41,7 +84,16 @@ export function clearScreen(stream: NodeJS.WriteStream = process.stdout): void {
 }
 
 /**
- * Clear the visible terminal screen (alias for clearScreen).
+ * Clear the visible terminal screen.
+ * Alias for `clearScreen()`.
+ *
+ * @param stream - Output stream to clear
+ * @default stream process.stdout
+ *
+ * @example
+ * ```ts
+ * clearVisible() // Same as clearScreen()
+ * ```
  */
 export function clearVisible(
   stream: NodeJS.WriteStream = process.stdout,
@@ -50,7 +102,18 @@ export function clearVisible(
 }
 
 /**
- * Move cursor to beginning of line.
+ * Move cursor to the beginning of the current line.
+ * Uses native TTY methods when available, falls back to carriage return.
+ *
+ * @param stream - Output stream to manipulate
+ * @default stream process.stdout
+ *
+ * @example
+ * ```ts
+ * process.stdout.write('Some text...')
+ * cursorToStart()
+ * process.stdout.write('New text') // Overwrites from start
+ * ```
  */
 export function cursorToStart(
   stream: NodeJS.WriteStream = process.stdout,
@@ -63,28 +126,86 @@ export function cursorToStart(
 }
 
 /**
- * Hide the cursor.
+ * Hide the terminal cursor.
+ * Useful for cleaner output during animations or progress indicators.
+ *
+ * ANSI Sequence:
+ * - `\x1b[?25l`: DECTCEM hide cursor
+ *
+ * @param stream - Output stream to manipulate
+ * @default stream process.stdout
+ *
+ * @example
+ * ```ts
+ * hideCursor()
+ * // ... show animation
+ * showCursor()
+ * ```
  */
 export function hideCursor(stream: NodeJS.WriteStream = process.stdout): void {
   stream.write('\x1b[?25l')
 }
 
 /**
- * Show the cursor.
+ * Show the terminal cursor.
+ * Should be called after `hideCursor()` to restore normal cursor visibility.
+ *
+ * ANSI Sequence:
+ * - `\x1b[?25h`: DECTCEM show cursor
+ *
+ * @param stream - Output stream to manipulate
+ * @default stream process.stdout
+ *
+ * @example
+ * ```ts
+ * hideCursor()
+ * // ... show animation
+ * showCursor()
+ * ```
  */
 export function showCursor(stream: NodeJS.WriteStream = process.stdout): void {
   stream.write('\x1b[?25h')
 }
 
 /**
- * Save cursor position.
+ * Save the current cursor position.
+ * Can be restored later with `restoreCursor()`.
+ *
+ * ANSI Sequence:
+ * - `\x1b7`: DECSC save cursor
+ *
+ * @param stream - Output stream to manipulate
+ * @default stream process.stdout
+ *
+ * @example
+ * ```ts
+ * saveCursor()
+ * console.log('Temporary text')
+ * restoreCursor()
+ * console.log('Back at saved position')
+ * ```
  */
 export function saveCursor(stream: NodeJS.WriteStream = process.stdout): void {
   stream.write('\x1b7')
 }
 
 /**
- * Restore cursor position.
+ * Restore cursor to previously saved position.
+ * Must be called after `saveCursor()`.
+ *
+ * ANSI Sequence:
+ * - `\x1b8`: DECRC restore cursor
+ *
+ * @param stream - Output stream to manipulate
+ * @default stream process.stdout
+ *
+ * @example
+ * ```ts
+ * saveCursor()
+ * console.log('Temporary text')
+ * restoreCursor()
+ * console.log('Back at saved position')
+ * ```
  */
 export function restoreCursor(
   stream: NodeJS.WriteStream = process.stdout,
diff --git a/src/stdio/divider.ts b/src/stdio/divider.ts
index 3ebb49a..2f10d83 100644
--- a/src/stdio/divider.ts
+++ b/src/stdio/divider.ts
@@ -6,13 +6,36 @@
 import { repeatString } from '../strings'
 
 export interface DividerOptions {
-  width?: number
-  char?: string
-  color?: (text: string) => string
+  /**
+   * Width of the divider line in characters.
+   * @default 55
+   */
+  width?: number | undefined
+  /**
+   * Character to repeat for the divider line.
+   * @default '═'
+   */
+  char?: string | undefined
+  /**
+   * Optional color function to apply to the divider.
+   * Accepts a function from `yoctocolors` or similar.
+   */
+  color?: ((text: string) => string) | undefined
 }
 
 /**
  * Create a divider line with custom character and width.
+ * Returns a string of repeated characters for visual separation.
+ *
+ * @param options - Divider formatting options
+ * @returns Divider string
+ *
+ * @example
+ * ```ts
+ * console.log(divider()) // Default: 55 '═' characters
+ * console.log(divider({ char: '-', width: 40 }))
+ * console.log(divider({ char: '·', width: 30 }))
+ * ```
  */
 export function divider(options?: DividerOptions): string {
   const opts = { __proto__: null, ...options } as DividerOptions
@@ -21,51 +44,115 @@ export function divider(options?: DividerOptions): string {
 }
 
 /**
- * Print a divider line to console.
+ * Print a divider line directly to console.
+ *
+ * @param options - Divider formatting options
+ *
+ * @example
+ * ```ts
+ * printDivider() // Prints default divider
+ * printDivider({ char: '─', width: 60 })
+ * ```
  */
 export function printDivider(options?: DividerOptions): void {
   console.log(divider(options))
 }
 
 /**
- * Common divider presets.
+ * Common divider style presets.
+ * Provides quick access to popular divider styles.
+ *
+ * @example
+ * ```ts
+ * console.log(dividers.thick()) // ═══════...
+ * console.log(dividers.thin())  // ───────...
+ * console.log(dividers.dotted()) // ·······...
+ * ```
  */
 export const dividers = {
+  /** Thick double-line divider using `═` */
   thick: () => divider({ char: '═' }),
+  /** Thin single-line divider using `─` */
   thin: () => divider({ char: '─' }),
+  /** Double-line divider (alias for thick) */
   double: () => divider({ char: '═' }),
+  /** Simple single dash divider using `-` */
   single: () => divider({ char: '-' }),
+  /** Dotted divider using `·` */
   dotted: () => divider({ char: '·' }),
+  /** Dashed divider using `╌` */
   dashed: () => divider({ char: '╌' }),
+  /** Wave divider using `~` */
   wave: () => divider({ char: '~' }),
+  /** Star divider using `*` */
   star: () => divider({ char: '*' }),
+  /** Diamond divider using `◆` */
   diamond: () => divider({ char: '◆' }),
+  /** Arrow divider using `→` */
   arrow: () => divider({ char: '→' }),
 } as const
 
 /**
- * Print a thick divider (default).
+ * Print a thick divider line (default style).
+ * Convenience function using `═` character.
+ *
+ * @example
+ * ```ts
+ * printThickDivider()
+ * // ═══════════════════════════════════════════════════
+ * ```
  */
 export function printThickDivider(): void {
   printDivider({ char: '═' })
 }
 
 /**
- * Print a thin divider.
+ * Print a thin divider line.
+ * Convenience function using `─` character.
+ *
+ * @example
+ * ```ts
+ * printThinDivider()
+ * // ───────────────────────────────────────────────────
+ * ```
  */
 export function printThinDivider(): void {
   printDivider({ char: '─' })
 }
 
 /**
- * Print a dotted line divider.
+ * Print a dotted divider line.
+ * Convenience function using `·` character.
+ *
+ * @example
+ * ```ts
+ * printDottedDivider()
+ * // ·······················································
+ * ```
  */
 export function printDottedDivider(): void {
   printDivider({ char: '·' })
 }
 
 /**
- * Create a section break with spacing.
+ * Create a section break with blank lines before and after the divider.
+ * Useful for creating visual separation between major sections.
+ *
+ * @param options - Divider formatting options
+ * @returns Section break string with newlines
+ *
+ * @example
+ * ```ts
+ * console.log('Previous section')
+ * console.log(sectionBreak())
+ * console.log('Next section')
+ * // Output:
+ * // Previous section
+ * //
+ * // ═══════════════════════════════════════════════════
+ * //
+ * // Next section
+ * ```
  */
 export function sectionBreak(options?: DividerOptions): string {
   const div = divider(options)
@@ -73,7 +160,16 @@ export function sectionBreak(options?: DividerOptions): string {
 }
 
 /**
- * Print a section break with spacing.
+ * Print a section break with spacing directly to console.
+ *
+ * @param options - Divider formatting options
+ *
+ * @example
+ * ```ts
+ * console.log('Previous section')
+ * printSectionBreak()
+ * console.log('Next section')
+ * ```
  */
 export function printSectionBreak(options?: DividerOptions): void {
   console.log(sectionBreak(options))
diff --git a/src/stdio/footer.ts b/src/stdio/footer.ts
index 99c1887..e24ef5f 100644
--- a/src/stdio/footer.ts
+++ b/src/stdio/footer.ts
@@ -1,5 +1,5 @@
 /**
- * Console footer/summary formatting utilities.
+ * @fileoverview Console footer/summary formatting utilities.
  * Provides consistent footer and summary formatting for CLI applications.
  */
 
@@ -7,11 +7,35 @@ import colors from '../external/yoctocolors-cjs'
 import { repeatString } from '../strings'
 
 export interface FooterOptions {
+  /**
+   * Width of the footer border in characters.
+   * @default 80
+   */
   width?: number | undefined
+  /**
+   * Character to use for the border line.
+   * @default '='
+   */
   borderChar?: string | undefined
+  /**
+   * Include ISO timestamp in footer.
+   * @default false
+   */
   showTimestamp?: boolean | undefined
+  /**
+   * Show duration since start time.
+   * @default false
+   */
   showDuration?: boolean | undefined
+  /**
+   * Start time in milliseconds (from Date.now()).
+   * Required when `showDuration` is true.
+   */
   startTime?: number | undefined
+  /**
+   * Color to apply to the footer message.
+   * @default 'gray'
+   */
   color?:
     | 'cyan'
     | 'green'
@@ -24,20 +48,44 @@ export interface FooterOptions {
 }
 
 export interface SummaryStats {
+  /** Total number of items processed */
   total?: number | undefined
+  /** Number of successful items */
   success?: number | undefined
+  /** Number of failed items */
   failed?: number | undefined
+  /** Number of skipped items */
   skipped?: number | undefined
+  /** Number of warnings */
   warnings?: number | undefined
+  /** Number of errors */
   errors?: number | undefined
+  /** Duration in milliseconds (timestamp value, not elapsed time) */
   duration?: number | undefined
 }
 
 /**
- * Create a formatted footer.
+ * Create a formatted footer with optional message, timestamp, and duration.
+ * Useful for marking the end of CLI output or showing completion status.
+ *
+ * @param message - Optional message to display in footer
+ * @param options - Footer formatting options
+ * @returns Formatted footer string with border and optional info
+ *
+ * @example
+ * ```ts
+ * const startTime = Date.now()
+ * // ... do work
+ * console.log(createFooter('Build complete', {
+ *   width: 60,
+ *   color: 'green',
+ *   showDuration: true,
+ *   startTime
+ * }))
+ * ```
  */
 export function createFooter(
-  message?: string,
+  message?: string | undefined,
   options?: FooterOptions,
 ): string {
   const {
@@ -73,7 +121,26 @@ export function createFooter(
 }
 
 /**
- * Create a summary footer with statistics.
+ * Create a summary footer with statistics and colored status indicators.
+ * Automatically formats success/failure/warning counts with appropriate colors.
+ * Useful for test results, build summaries, or batch operation reports.
+ *
+ * @param stats - Statistics to display in the summary
+ * @param options - Footer formatting options
+ * @returns Formatted summary footer string with colored indicators
+ *
+ * @example
+ * ```ts
+ * console.log(createSummaryFooter({
+ *   total: 150,
+ *   success: 145,
+ *   failed: 3,
+ *   skipped: 2,
+ *   warnings: 5
+ * }))
+ * // Output: Total: 150 | ✓ 145 passed | ✗ 3 failed | ○ 2 skipped | ⚠ 5 warnings
+ * // ========================================
+ * ```
  */
 export function createSummaryFooter(
   stats: SummaryStats,
diff --git a/src/stdio/header.ts b/src/stdio/header.ts
index f23c260..6035392 100644
--- a/src/stdio/header.ts
+++ b/src/stdio/header.ts
@@ -1,5 +1,5 @@
 /**
- * Console header/banner formatting utilities.
+ * @fileoverview Console header/banner formatting utilities.
  * Provides consistent header formatting for CLI applications.
  */
 
@@ -7,15 +7,64 @@ import colors from '../external/yoctocolors-cjs'
 import { centerText, repeatString } from '../strings'
 
 export interface HeaderOptions {
-  width?: number
-  borderChar?: string
-  padding?: number
-  color?: 'cyan' | 'green' | 'yellow' | 'blue' | 'magenta' | 'red' | 'gray'
-  bold?: boolean
+  /**
+   * Width of the header in characters.
+   * @default 80
+   */
+  width?: number | undefined
+  /**
+   * Character to use for border lines.
+   * @default '='
+   */
+  borderChar?: string | undefined
+  /**
+   * Number of blank lines above and below title.
+   * @default 1
+   */
+  padding?: number | undefined
+  /**
+   * Color to apply to the title text.
+   * @default 'cyan'
+   */
+  color?:
+    | 'cyan'
+    | 'green'
+    | 'yellow'
+    | 'blue'
+    | 'magenta'
+    | 'red'
+    | 'gray'
+    | undefined
+  /**
+   * Apply bold styling to title.
+   * @default true
+   */
+  bold?: boolean | undefined
 }
 
 /**
- * Create a formatted header/banner.
+ * Create a formatted header/banner with borders and centered title.
+ * Useful for marking the start of CLI output or creating visual sections.
+ *
+ * @param title - Title text to display in header
+ * @param options - Header formatting options
+ * @returns Formatted header string with borders and centered title
+ *
+ * @example
+ * ```ts
+ * console.log(createHeader('Socket Security Analysis', {
+ *   width: 70,
+ *   color: 'cyan',
+ *   bold: true,
+ *   padding: 2
+ * }))
+ * // Output:
+ * // ======================================================================
+ * //
+ * //                    Socket Security Analysis
+ * //
+ * // ======================================================================
+ * ```
  */
 export function createHeader(title: string, options?: HeaderOptions): string {
   const {
@@ -58,7 +107,24 @@ export function createHeader(title: string, options?: HeaderOptions): string {
 }
 
 /**
- * Create a simple section header.
+ * Create a simple section header without padding.
+ * A lighter-weight alternative to `createHeader()` for subsections.
+ *
+ * @param title - Title text to display in header
+ * @param options - Header formatting options
+ * @returns Formatted section header string
+ *
+ * @example
+ * ```ts
+ * console.log(createSectionHeader('Dependencies', {
+ *   width: 50,
+ *   color: 'blue'
+ * }))
+ * // Output:
+ * // --------------------------------------------------
+ * //                   Dependencies
+ * // --------------------------------------------------
+ * ```
  */
 export function createSectionHeader(
   title: string,
@@ -80,8 +146,20 @@ export function createSectionHeader(
 }
 
 /**
- * Print a header directly to stdout.
- * Standard formatting: 55 chars wide with ═ borders.
+ * Print a header directly to stdout with standard formatting.
+ * Uses fixed width of 55 characters with `═` borders.
+ * Simpler alternative to `createHeader()` for quick headers.
+ *
+ * @param title - Title text to display
+ *
+ * @example
+ * ```ts
+ * printHeader('Package Analysis')
+ * // Output:
+ * // ═══════════════════════════════════════════════════
+ * //   Package Analysis
+ * // ═══════════════════════════════════════════════════
+ * ```
  */
 export function printHeader(title: string): void {
   const border = repeatString('═', 55)
@@ -91,10 +169,21 @@ export function printHeader(title: string): void {
 }
 
 /**
- * Print a footer with optional message.
- * Uses ─ as the border character.
+ * Print a footer with optional success message.
+ * Uses `─` border character for a lighter appearance.
+ * Fixed width of 55 characters to match `printHeader()`.
+ *
+ * @param message - Optional message to display (shown in green)
+ *
+ * @example
+ * ```ts
+ * printFooter('Analysis complete')
+ * // Output:
+ * // ───────────────────────────────────────────────────
+ * // Analysis complete (in green)
+ * ```
  */
-export function printFooter(message?: string): void {
+export function printFooter(message?: string | undefined): void {
   const border = repeatString('─', 55)
   console.log(border)
   if (message) {
diff --git a/src/stdio/mask.ts b/src/stdio/mask.ts
index 76a0c27..f842155 100644
--- a/src/stdio/mask.ts
+++ b/src/stdio/mask.ts
@@ -18,33 +18,107 @@
  * - Visual feedback: Uses spinner to indicate process is running when output is masked.
  */
 
-import type { ChildProcess, SpawnOptions } from 'node:child_process'
-import { spawn } from 'node:child_process'
-import readline from 'node:readline'
-import { spinner } from '../spinner.js'
+import type { ChildProcess, SpawnOptions } from 'child_process'
+import { spawn } from 'child_process'
+import readline from 'readline'
+import { getDefaultSpinner } from '../spinner.js'
 import { clearLine } from './clear.js'
 import { write } from './stdout.js'
 
+const spinner = getDefaultSpinner()
+
 export interface OutputMaskOptions {
-  /** Current working directory */
-  cwd?: string
-  /** Environment variables */
-  env?: NodeJS.ProcessEnv
-  /** Progress message to display */
-  message?: string
-  /** Show output by default instead of masking it */
-  showOutput?: boolean
-  /** Text to show after "ctrl+o" in spinner */
-  toggleText?: string
+  /**
+   * Current working directory for spawned process.
+   * @default process.cwd()
+   */
+  cwd?: string | undefined
+  /**
+   * Environment variables for spawned process.
+   * @default process.env
+   */
+  env?: NodeJS.ProcessEnv | undefined
+  /**
+   * Filter output before displaying or buffering.
+   * Return `false` to skip the line, `true` to include it.
+   *
+   * Useful for filtering non-fatal warnings or noise from test runners.
+   * The filter runs on every chunk of output before display/buffering.
+   *
+   * @param text - The output text chunk (may include ANSI codes)
+   * @param stream - Whether this came from 'stdout' or 'stderr'
+   * @returns `true` to include this output, `false` to skip it
+   *
+   * @example
+   * ```ts
+   * filterOutput: (text, stream) => {
+   *   // Skip vitest worker termination errors
+   *   if (text.includes('Terminating worker thread')) return false
+   *   return true
+   * }
+   * ```
+   */
+  filterOutput?:
+    | ((text: string, stream: 'stdout' | 'stderr') => boolean)
+    | undefined
+  /**
+   * Progress message to display in spinner.
+   * @default 'Running…'
+   */
+  message?: string | undefined
+  /**
+   * Override the exit code based on captured output.
+   *
+   * Useful for handling non-fatal errors that shouldn't fail the build.
+   * Called after the process exits with the original code and all captured output.
+   * Return a number to override the exit code, or `undefined` to keep original.
+   *
+   * @param code - Original exit code from the process
+   * @param stdout - All captured stdout (even filtered lines are captured)
+   * @param stderr - All captured stderr (even filtered lines are captured)
+   * @returns New exit code, or `undefined` to keep original
+   *
+   * @example
+   * ```ts
+   * overrideExitCode: (code, stdout, stderr) => {
+   *   // If only worker termination errors, treat as success
+   *   const output = stdout + stderr
+   *   const hasWorkerError = output.includes('Terminating worker thread')
+   *   const hasRealFailure = output.includes('FAIL')
+   *   if (code !== 0 && hasWorkerError && !hasRealFailure) {
+   *     return 0 // Override to success
+   *   }
+   *   return undefined // Keep original
+   * }
+   * ```
+   */
+  overrideExitCode?:
+    | ((code: number, stdout: string, stderr: string) => number | undefined)
+    | undefined
+  /**
+   * Start with output visible instead of masked.
+   * When `true`, output shows immediately without needing ctrl+o.
+   * @default false
+   */
+  showOutput?: boolean | undefined
+  /**
+   * Text to show after "ctrl+o" in spinner message.
+   * @default 'to see full output'
+   */
+  toggleText?: string | undefined
 }
 
 export interface OutputMask {
-  /** Whether output is currently visible */
-  verbose: boolean
-  /** Buffered output lines */
-  outputBuffer: string[]
   /** Whether spinner is currently active */
   isSpinning: boolean
+  /** Buffered output lines */
+  outputBuffer: string[]
+  /** All stderr captured (for exit code override) */
+  stderrCapture: string
+  /** All stdout captured (for exit code override) */
+  stdoutCapture: string
+  /** Whether output is currently visible */
+  verbose: boolean
 }
 
 /**
@@ -56,9 +130,11 @@ export function createOutputMask(options: OutputMaskOptions = {}): OutputMask {
   const { showOutput = false } = options
 
   return {
-    verbose: showOutput,
-    outputBuffer: [],
     isSpinning: !showOutput,
+    outputBuffer: [],
+    stderrCapture: '',
+    stdoutCapture: '',
+    verbose: showOutput,
   }
 }
 
@@ -181,6 +257,16 @@ export function attachOutputMask(
     if (child.stdout) {
       child.stdout.on('data', data => {
         const text = data.toString()
+
+        // Always capture for exit code override.
+        mask.stdoutCapture += text
+
+        // Apply filter if provided.
+        if (options.filterOutput && !options.filterOutput(text, 'stdout')) {
+          // Skip this output.
+          return undefined
+        }
+
         if (mask.verbose) {
           write(text)
         } else {
@@ -202,6 +288,16 @@ export function attachOutputMask(
     if (child.stderr) {
       child.stderr.on('data', data => {
         const text = data.toString()
+
+        // Always capture for exit code override.
+        mask.stderrCapture += text
+
+        // Apply filter if provided.
+        if (options.filterOutput && !options.filterOutput(text, 'stderr')) {
+          // Skip this output.
+          return undefined
+        }
+
         if (mask.verbose) {
           process.stderr.write(text)
         } else {
@@ -217,8 +313,21 @@ export function attachOutputMask(
         process.stdin.setRawMode(false)
       }
 
+      // Allow caller to override exit code based on output.
+      let finalCode = code || 0
+      if (options.overrideExitCode) {
+        const overridden = options.overrideExitCode(
+          finalCode,
+          mask.stdoutCapture,
+          mask.stderrCapture,
+        )
+        if (overridden !== undefined) {
+          finalCode = overridden
+        }
+      }
+
       if (mask.isSpinning) {
-        if (code === 0) {
+        if (finalCode === 0) {
           spinner.successAndStop(`${message} completed`)
         } else {
           spinner.failAndStop(`${message} failed`)
@@ -232,7 +341,7 @@ export function attachOutputMask(
         }
       }
 
-      resolve(code || 0)
+      resolve(finalCode)
     })
 
     child.on('error', error => {
diff --git a/src/stdio/progress.ts b/src/stdio/progress.ts
index a048456..fac4ff3 100644
--- a/src/stdio/progress.ts
+++ b/src/stdio/progress.ts
@@ -1,5 +1,5 @@
 /**
- * Progress bar utilities for CLI applications.
+ * @fileoverview Progress bar utilities for CLI applications.
  * Provides various progress indicators including bars, percentages, and spinners.
  */
 
@@ -7,16 +7,58 @@ import colors from '../external/yoctocolors-cjs'
 import { repeatString, stripAnsi } from '../strings'
 
 export interface ProgressBarOptions {
-  width?: number
-  // Template: ':bar :percent :current/:total :eta'.
-  format?: string
-  complete?: string
-  incomplete?: string
-  head?: string
-  clear?: boolean
-  renderThrottle?: number
-  stream?: NodeJS.WriteStream
-  color?: 'cyan' | 'green' | 'yellow' | 'blue' | 'magenta'
+  /**
+   * Width of the progress bar in characters.
+   * @default 40
+   */
+  width?: number | undefined
+  /**
+   * Format template for progress bar display.
+   * Available tokens: `:bar`, `:percent`, `:current`, `:total`, `:elapsed`, `:eta`.
+   * Custom tokens can be passed via the `tokens` parameter in `update()` or `tick()`.
+   * @default ':bar :percent :current/:total'
+   * @example
+   * ```ts
+   * format: ':bar :percent :current/:total :eta'
+   * ```
+   */
+  format?: string | undefined
+  /**
+   * Character(s) to use for completed portion of bar.
+   * @default '█'
+   */
+  complete?: string | undefined
+  /**
+   * Character(s) to use for incomplete portion of bar.
+   * @default '░'
+   */
+  incomplete?: string | undefined
+  /**
+   * Character(s) to use for the head of the progress bar.
+   * @default ''
+   */
+  head?: string | undefined
+  /**
+   * Clear the progress bar when complete.
+   * @default false
+   */
+  clear?: boolean | undefined
+  /**
+   * Minimum time between renders in milliseconds.
+   * ~60fps = 16ms throttle.
+   * @default 16
+   */
+  renderThrottle?: number | undefined
+  /**
+   * Stream to write progress bar output to.
+   * @default process.stderr
+   */
+  stream?: NodeJS.WriteStream | undefined
+  /**
+   * Color to apply to the completed portion of the bar.
+   * @default 'cyan'
+   */
+  color?: 'cyan' | 'green' | 'yellow' | 'blue' | 'magenta' | undefined
 }
 
 export class ProgressBar {
@@ -29,6 +71,21 @@ export class ProgressBar {
   private terminated: boolean = false
   private lastDrawnWidth: number = 0
 
+  /**
+   * Create a new progress bar instance.
+   *
+   * @param total - Total number of units for the progress bar
+   * @param options - Configuration options for the progress bar
+   *
+   * @example
+   * ```ts
+   * const bar = new ProgressBar(100, {
+   *   width: 50,
+   *   format: ':bar :percent :current/:total :eta',
+   *   color: 'green'
+   * })
+   * ```
+   */
   constructor(total: number, options?: ProgressBarOptions) {
     this.total = total
     this.startTime = Date.now()
@@ -49,7 +106,17 @@ export class ProgressBar {
   }
 
   /**
-   * Update progress and redraw bar.
+   * Update progress to a specific value and redraw the bar.
+   * Updates are throttled to prevent excessive rendering (default ~60fps).
+   *
+   * @param current - Current progress value (will be clamped to total)
+   * @param tokens - Optional custom tokens to replace in format string
+   *
+   * @example
+   * ```ts
+   * bar.update(50)
+   * bar.update(75, { status: 'Processing...' })
+   * ```
    */
   update(current: number, tokens?: Record<string, unknown>): void {
     if (this.terminated) {
@@ -76,7 +143,19 @@ export class ProgressBar {
   }
 
   /**
-   * Increment progress by amount.
+   * Increment progress by a specified amount.
+   * Convenience method for `update(current + amount)`.
+   *
+   * @param amount - Amount to increment by
+   * @param tokens - Optional custom tokens to replace in format string
+   * @default amount 1
+   *
+   * @example
+   * ```ts
+   * bar.tick() // Increment by 1
+   * bar.tick(5) // Increment by 5
+   * bar.tick(1, { file: 'data.json' })
+   * ```
    */
   tick(amount: number = 1, tokens?: Record<string, unknown>): void {
     this.update(this.current + amount, tokens)
@@ -153,7 +232,10 @@ export class ProgressBar {
   }
 
   /**
-   * Terminate the progress bar.
+   * Terminate the progress bar and optionally clear it.
+   * Called automatically when progress reaches 100%.
+   * If `clear` option is true, removes the bar from terminal.
+   * Otherwise, moves to next line to preserve the final state.
    */
   terminate(): void {
     if (this.terminated) {
@@ -170,12 +252,27 @@ export class ProgressBar {
 }
 
 /**
- * Create a simple progress indicator without a bar.
+ * Create a simple progress indicator without a graphical bar.
+ * Returns a formatted string showing progress as percentage and fraction.
+ *
+ * @param current - Current progress value
+ * @param total - Total progress value
+ * @param label - Optional label prefix
+ * @returns Formatted progress indicator string
+ *
+ * @example
+ * ```ts
+ * createProgressIndicator(50, 100)
+ * // Returns: '[50%] 50/100'
+ *
+ * createProgressIndicator(3, 10, 'Files')
+ * // Returns: 'Files: [30%] 3/10'
+ * ```
  */
 export function createProgressIndicator(
   current: number,
   total: number,
-  label?: string,
+  label?: string | undefined,
 ): string {
   const percent = Math.floor((current / total) * 100)
   const progress = `${current}/${total}`
diff --git a/src/stdio/prompts.ts b/src/stdio/prompts.ts
index 0d6bf61..1b59967 100644
--- a/src/stdio/prompts.ts
+++ b/src/stdio/prompts.ts
@@ -1,41 +1,97 @@
 /**
  * @fileoverview User prompt utilities for interactive scripts.
- * Provides inquirer.js integration with spinner support and context handling.
+ * Provides inquirer.js integration with spinner support, context handling, and theming.
  */
 
 import { getAbortSignal, getSpinner } from '#constants/process'
+import type { ColorValue } from '../colors'
+import { getTheme } from '../themes/context'
+import { THEMES, type ThemeName } from '../themes/themes'
+import type { Theme } from '../themes/types'
+import { resolveColor } from '../themes/utils'
+import yoctocolorsCjs from '../external/yoctocolors-cjs'
 
 const abortSignal = getAbortSignal()
 const spinner = getSpinner()
 
+/**
+ * Apply a color to text using yoctocolors.
+ * Handles both named colors and RGB tuples.
+ * @private
+ */
+function applyColor(text: string, color: ColorValue): string {
+  if (typeof color === 'string') {
+    // Named color like 'green', 'red', etc.
+    return (yoctocolorsCjs as any)[color](text)
+  }
+  // RGB tuple [r, g, b] - manually construct ANSI escape codes.
+  // yoctocolors-cjs doesn't have an rgb() method, so we build it ourselves.
+  const { 0: r, 1: g, 2: b } = color
+  return `\u001B[38;2;${r};${g};${b}m${text}\u001B[39m`
+}
+
 // Type definitions
 
+/**
+ * Choice option for select and search prompts.
+ *
+ * @template Value - Type of the choice value
+ */
 export interface Choice<Value = unknown> {
+  /** The value returned when this choice is selected */
   value: Value
-  disabled?: boolean | string | undefined
-  description?: string | undefined
+  /** Display name for the choice (defaults to value.toString()) */
   name?: string | undefined
+  /** Additional description text shown below the choice */
+  description?: string | undefined
+  /** Short text shown after selection (defaults to name) */
   short?: string | undefined
+  /** Whether this choice is disabled, or a reason string */
+  disabled?: boolean | string | undefined
 }
 
-// Duplicated from @inquirer/type - InquirerContext
-// This is the minimal context interface used by Inquirer prompts
+/**
+ * Context for inquirer prompts.
+ * Minimal context interface used by Inquirer prompts.
+ * Duplicated from `@inquirer/type` - InquirerContext.
+ */
 interface InquirerContext {
+  /** Abort signal for cancelling the prompt */
   signal?: AbortSignal | undefined
+  /** Input stream (defaults to process.stdin) */
   input?: NodeJS.ReadableStream | undefined
+  /** Output stream (defaults to process.stdout) */
   output?: NodeJS.WritableStream | undefined
+  /** Clear the prompt from terminal when done */
   clearPromptOnDone?: boolean | undefined
 }
 
+/**
+ * Extended context with spinner support.
+ * Allows passing a spinner instance to be managed during prompts.
+ */
 export type Context = import('../objects').Remap<
   InquirerContext & {
+    /** Optional spinner to stop/start during prompt display */
     spinner?: import('../spinner').Spinner | undefined
   }
 >
 
-// Duplicated from @inquirer/select - Separator
-// A separator object used in select/checkbox prompts to create visual separators
-// This type definition ensures the Separator type is available in published packages
+/**
+ * Separator for visual grouping in select/checkbox prompts.
+ * Creates a non-selectable visual separator line.
+ * Duplicated from `@inquirer/select` - Separator.
+ * This type definition ensures the Separator type is available in published packages.
+ *
+ * @example
+ * import { Separator } from './prompts'
+ *
+ * const choices = [
+ *   { name: 'Option 1', value: 1 },
+ *   new Separator(),
+ *   { name: 'Option 2', value: 2 }
+ * ]
+ */
 declare class SeparatorType {
   readonly separator: string
   readonly type: 'separator'
@@ -45,7 +101,108 @@ declare class SeparatorType {
 export type Separator = SeparatorType
 
 /**
- * Wrap an inquirer prompt with spinner handling and signal injection.
+ * Resolve theme name or object to Theme.
+ * @param theme - Theme name or object
+ * @returns Resolved Theme
+ */
+function resolveTheme(theme: Theme | ThemeName): Theme {
+  return typeof theme === 'string' ? THEMES[theme] : theme
+}
+
+/**
+ * Check if value is a Socket Theme object.
+ * @param value - Value to check
+ * @returns True if value is a Socket Theme
+ */
+function isSocketTheme(value: unknown): value is Theme {
+  return (
+    typeof value === 'object' &&
+    value !== null &&
+    'name' in value &&
+    'colors' in value
+  )
+}
+
+/**
+ * Convert Socket theme to @inquirer theme format.
+ * Maps our theme colors to inquirer's style functions.
+ * Handles theme names, Theme objects, and passes through @inquirer themes.
+ *
+ * @param theme - Socket theme name, Theme object, or @inquirer theme
+ * @returns @inquirer theme object
+ *
+ * @example
+ * ```ts
+ * // Socket theme name
+ * createInquirerTheme('sunset')
+ *
+ * // Socket Theme object
+ * createInquirerTheme(SUNSET_THEME)
+ *
+ * // @inquirer theme (passes through)
+ * createInquirerTheme({ style: {...}, icon: {...} })
+ * ```
+ */
+export function createInquirerTheme(
+  theme: Theme | ThemeName | unknown,
+): Record<string, unknown> {
+  // If it's a string (theme name) or Socket Theme object, convert it
+  if (typeof theme === 'string' || isSocketTheme(theme)) {
+    const socketTheme = resolveTheme(theme as Theme | ThemeName)
+    const promptColor = resolveColor(
+      socketTheme.colors.prompt,
+      socketTheme.colors,
+    ) as ColorValue
+    const textDimColor = resolveColor(
+      socketTheme.colors.textDim,
+      socketTheme.colors,
+    ) as ColorValue
+    const errorColor = socketTheme.colors.error
+    const successColor = socketTheme.colors.success
+    const primaryColor = socketTheme.colors.primary
+
+    return {
+      style: {
+        // Message text (uses colors.prompt)
+        message: (text: string) => applyColor(text, promptColor),
+        // Answer text (uses primary color)
+        answer: (text: string) => applyColor(text, primaryColor),
+        // Help text / descriptions (uses textDim)
+        help: (text: string) => applyColor(text, textDimColor),
+        description: (text: string) => applyColor(text, textDimColor),
+        // Disabled items (uses textDim)
+        disabled: (text: string) => applyColor(text, textDimColor),
+        // Error messages (uses error color)
+        error: (text: string) => applyColor(text, errorColor),
+        // Highlight/active (uses primary color)
+        highlight: (text: string) => applyColor(text, primaryColor),
+      },
+      icon: {
+        // Use success color for confirmed items
+        checked: applyColor('✓', successColor),
+        unchecked: ' ',
+        // Cursor uses primary color
+        cursor: applyColor('❯', primaryColor),
+      },
+    }
+  }
+
+  // Otherwise it's already an @inquirer theme, return as-is
+  return theme as Record<string, unknown>
+}
+
+/**
+ * Wrap an inquirer prompt with spinner handling, theme injection, and signal injection.
+ * Automatically stops/starts spinners during prompt display, injects the current theme,
+ * and injects abort signals. Trims string results and handles cancellation gracefully.
+ *
+ * @template T - Type of the prompt result
+ * @param inquirerPrompt - The inquirer prompt function to wrap
+ * @returns Wrapped prompt function with spinner, theme, and signal handling
+ *
+ * @example
+ * const myPrompt = wrapPrompt(rawInquirerPrompt)
+ * const result = await myPrompt({ message: 'Enter name:' })
  */
 /*@__NO_SIDE_EFFECTS__*/
 export function wrapPrompt<T = unknown>(
@@ -60,6 +217,20 @@ export function wrapPrompt<T = unknown>(
     const spinnerInstance =
       contextSpinner !== undefined ? contextSpinner : spinner
     const signal = abortSignal
+
+    // Inject theme into config (args[0])
+    const config = args[0] as Record<string, unknown>
+    if (config && typeof config === 'object') {
+      if (!config.theme) {
+        // No theme provided, use current theme
+        config.theme = createInquirerTheme(getTheme())
+      } else {
+        // Theme provided - let createInquirerTheme handle detection
+        config.theme = createInquirerTheme(config.theme)
+      }
+    }
+
+    // Inject signal into context (args[1])
     if (origContext) {
       args[1] = {
         signal,
@@ -68,6 +239,7 @@ export function wrapPrompt<T = unknown>(
     } else {
       args[1] = { signal }
     }
+
     const wasSpinning = !!spinnerInstance?.isSpinning
     spinnerInstance?.stop()
     let result: unknown
@@ -88,11 +260,11 @@ export function wrapPrompt<T = unknown>(
 }
 
 // c8 ignore start - Third-party inquirer library requires and exports not testable in isolation.
-const confirmExport = /*@__PURE__*/ require('../../external/@inquirer/confirm')
-const inputExport = /*@__PURE__*/ require('../../external/@inquirer/input')
-const passwordExport = /*@__PURE__*/ require('../../external/@inquirer/password')
-const searchExport = /*@__PURE__*/ require('../../external/@inquirer/search')
-const selectExport = /*@__PURE__*/ require('../../external/@inquirer/select')
+const confirmExport = /*@__PURE__*/ require('../external/@inquirer/confirm')
+const inputExport = /*@__PURE__*/ require('../external/@inquirer/input')
+const passwordExport = /*@__PURE__*/ require('../external/@inquirer/password')
+const searchExport = /*@__PURE__*/ require('../external/@inquirer/search')
+const selectExport = /*@__PURE__*/ require('../external/@inquirer/select')
 const confirmRaw = confirmExport.default ?? confirmExport
 const inputRaw = inputExport.default ?? inputExport
 const passwordRaw = passwordExport.default ?? passwordExport
@@ -101,9 +273,85 @@ const selectRaw = selectExport.default ?? selectExport
 const ActualSeparator = selectExport.Separator
 // c8 ignore stop
 
+/**
+ * Prompt for a yes/no confirmation.
+ * Wrapped with spinner handling and abort signal support.
+ *
+ * @example
+ * const answer = await confirm({ message: 'Continue?' })
+ * if (answer) { // user confirmed }
+ */
 export const confirm: typeof confirmRaw = wrapPrompt(confirmRaw)
+
+/**
+ * Prompt for text input.
+ * Wrapped with spinner handling and abort signal support.
+ * Result is automatically trimmed.
+ *
+ * @example
+ * const name = await input({ message: 'Enter your name:' })
+ */
 export const input: typeof inputRaw = wrapPrompt(inputRaw)
+
+/**
+ * Prompt for password input (hidden characters).
+ * Wrapped with spinner handling and abort signal support.
+ *
+ * @example
+ * const token = await password({ message: 'Enter API token:' })
+ */
 export const password: typeof passwordRaw = wrapPrompt(passwordRaw)
+
+/**
+ * Prompt with searchable/filterable choices.
+ * Wrapped with spinner handling and abort signal support.
+ *
+ * @example
+ * const result = await search({
+ *   message: 'Select a package:',
+ *   source: async (input) => fetchPackages(input)
+ * })
+ */
 export const search: typeof searchRaw = wrapPrompt(searchRaw)
+
+/**
+ * Prompt to select from a list of choices.
+ * Wrapped with spinner handling and abort signal support.
+ *
+ * @example
+ * const choice = await select({
+ *   message: 'Choose an option:',
+ *   choices: [
+ *     { name: 'Option 1', value: 'opt1' },
+ *     { name: 'Option 2', value: 'opt2' }
+ *   ]
+ * })
+ */
 export const select: typeof selectRaw = wrapPrompt(selectRaw)
+
 export { ActualSeparator as Separator }
+
+/**
+ * Create a separator for select prompts.
+ * Creates a visual separator line in choice lists.
+ *
+ * @param text - Optional separator text (defaults to '───────')
+ * @returns Separator instance
+ *
+ * @example
+ * import { select, createSeparator } from '@socketsecurity/lib/stdio/prompts'
+ *
+ * const choice = await select({
+ *   message: 'Choose an option:',
+ *   choices: [
+ *     { name: 'Option 1', value: 1 },
+ *     createSeparator(),
+ *     { name: 'Option 2', value: 2 }
+ *   ]
+ * })
+ */
+export function createSeparator(
+  text?: string,
+): InstanceType<typeof ActualSeparator> {
+  return new ActualSeparator(text)
+}
diff --git a/src/stdio/stderr.ts b/src/stdio/stderr.ts
index 6d9d384..92a1080 100644
--- a/src/stdio/stderr.ts
+++ b/src/stdio/stderr.ts
@@ -1,5 +1,5 @@
 /**
- * Standard error stream utilities.
+ * @fileoverview Standard error stream utilities.
  * Provides utilities for writing to stderr with formatting and control.
  */
 
@@ -7,14 +7,32 @@
 const stderr: NodeJS.WriteStream = process.stderr
 
 /**
- * Write an error line to stderr.
+ * Write a line to stderr with trailing newline.
+ * Used for error messages, warnings, and diagnostic output.
+ *
+ * @param text - Text to write
+ * @default text ''
+ *
+ * @example
+ * ```ts
+ * writeErrorLine('Error: File not found')
+ * writeErrorLine() // Write empty line
+ * ```
  */
 export function writeErrorLine(text: string = ''): void {
   stderr.write(`${text}\n`)
 }
 
 /**
- * Write error text to stderr without newline.
+ * Write text to stderr without adding a newline.
+ *
+ * @param text - Text to write
+ *
+ * @example
+ * ```ts
+ * writeError('Downloading...')
+ * // Later update progress
+ * ```
  */
 export function writeError(text: string): void {
   stderr.write(text)
@@ -22,6 +40,14 @@ export function writeError(text: string): void {
 
 /**
  * Clear the current line on stderr.
+ * Only works in TTY environments.
+ *
+ * @example
+ * ```ts
+ * writeError('Processing...')
+ * clearLine()
+ * writeError('Done!')
+ * ```
  */
 export function clearLine(): void {
   if (stderr.isTTY) {
@@ -31,37 +57,89 @@ export function clearLine(): void {
 }
 
 /**
- * Move cursor to position on stderr.
+ * Move cursor to specific position on stderr.
+ * Only works in TTY environments.
+ *
+ * @param x - Column position (0-based)
+ * @param y - Row position (0-based, optional)
+ *
+ * @example
+ * ```ts
+ * cursorTo(0) // Move to start of line
+ * cursorTo(10, 5) // Move to column 10, row 5
+ * ```
  */
-export function cursorTo(x: number, y?: number): void {
+export function cursorTo(x: number, y?: number | undefined): void {
   if (stderr.isTTY) {
     stderr.cursorTo(x, y)
   }
 }
 
 /**
- * Check if stderr is a TTY.
+ * Check if stderr is connected to a TTY (terminal).
+ *
+ * @returns `true` if stderr is a TTY, `false` if piped/redirected
+ *
+ * @example
+ * ```ts
+ * if (isTTY()) {
+ *   // Show colored error messages
+ * } else {
+ *   // Use plain text
+ * }
+ * ```
  */
 export function isTTY(): boolean {
   return stderr.isTTY || false
 }
 
 /**
- * Get terminal columns for stderr.
+ * Get the number of columns (width) in the terminal.
+ *
+ * @returns Terminal width in characters
+ * @default 80
+ *
+ * @example
+ * ```ts
+ * const width = getColumns()
+ * console.error(`Terminal is ${width} characters wide`)
+ * ```
  */
 export function getColumns(): number {
   return stderr.columns || 80
 }
 
 /**
- * Get terminal rows for stderr.
+ * Get the number of rows (height) in the terminal.
+ *
+ * @returns Terminal height in lines
+ * @default 24
+ *
+ * @example
+ * ```ts
+ * const height = getRows()
+ * console.error(`Terminal is ${height} lines tall`)
+ * ```
  */
 export function getRows(): number {
   return stderr.rows || 24
 }
 
 /**
- * Write a warning to stderr with formatting.
+ * Write a formatted warning message to stderr.
+ *
+ * @param message - Warning message text
+ * @param prefix - Prefix label for the warning
+ * @default prefix 'Warning'
+ *
+ * @example
+ * ```ts
+ * writeWarning('Deprecated API usage')
+ * // Output: 'Warning: Deprecated API usage'
+ *
+ * writeWarning('Invalid config', 'Config')
+ * // Output: 'Config: Invalid config'
+ * ```
  */
 export function writeWarning(
   message: string,
@@ -72,7 +150,20 @@ export function writeWarning(
 }
 
 /**
- * Write an error to stderr with formatting.
+ * Write a formatted error message to stderr.
+ *
+ * @param message - Error message text
+ * @param prefix - Prefix label for the error
+ * @default prefix 'Error'
+ *
+ * @example
+ * ```ts
+ * writeErrorFormatted('File not found')
+ * // Output: 'Error: File not found'
+ *
+ * writeErrorFormatted('Connection failed', 'Network')
+ * // Output: 'Network: Connection failed'
+ * ```
  */
 export function writeErrorFormatted(
   message: string,
@@ -83,7 +174,19 @@ export function writeErrorFormatted(
 }
 
 /**
- * Write stack trace to stderr.
+ * Write an error's stack trace to stderr.
+ * Falls back to formatted error message if no stack is available.
+ *
+ * @param error - Error object to write
+ *
+ * @example
+ * ```ts
+ * try {
+ *   throw new Error('Something went wrong')
+ * } catch (err) {
+ *   writeStackTrace(err as Error)
+ * }
+ * ```
  */
 export function writeStackTrace(error: Error): void {
   if (error.stack) {
diff --git a/src/stdio/stdout.ts b/src/stdio/stdout.ts
index 45f4606..fae8a1b 100644
--- a/src/stdio/stdout.ts
+++ b/src/stdio/stdout.ts
@@ -1,22 +1,39 @@
 /**
- * Standard output stream utilities.
+ * @fileoverview Standard output stream utilities.
  * Provides utilities for writing to stdout with formatting and control.
  */
 
-import { WriteStream } from 'node:tty'
+import { WriteStream } from 'tty'
 
 // Get the actual stdout stream
 const stdout: NodeJS.WriteStream = process.stdout
 
 /**
- * Write a line to stdout.
+ * Write a line to stdout with trailing newline.
+ *
+ * @param text - Text to write
+ * @default text ''
+ *
+ * @example
+ * ```ts
+ * writeLine('Hello, world!')
+ * writeLine() // Write empty line
+ * ```
  */
 export function writeLine(text: string = ''): void {
   stdout.write(`${text}\n`)
 }
 
 /**
- * Write text to stdout without newline.
+ * Write text to stdout without adding a newline.
+ *
+ * @param text - Text to write
+ *
+ * @example
+ * ```ts
+ * write('Loading...')
+ * // Later: clear and update
+ * ```
  */
 export function write(text: string): void {
   stdout.write(text)
@@ -24,6 +41,14 @@ export function write(text: string): void {
 
 /**
  * Clear the current line on stdout.
+ * Only works in TTY environments.
+ *
+ * @example
+ * ```ts
+ * write('Processing...')
+ * clearLine()
+ * write('Done!')
+ * ```
  */
 export function clearLine(): void {
   if (stdout.isTTY) {
@@ -33,16 +58,33 @@ export function clearLine(): void {
 }
 
 /**
- * Move cursor to position on stdout.
+ * Move cursor to specific position on stdout.
+ * Only works in TTY environments.
+ *
+ * @param x - Column position (0-based)
+ * @param y - Row position (0-based, optional)
+ *
+ * @example
+ * ```ts
+ * cursorTo(0) // Move to start of line
+ * cursorTo(10, 5) // Move to column 10, row 5
+ * ```
  */
-export function cursorTo(x: number, y?: number): void {
+export function cursorTo(x: number, y?: number | undefined): void {
   if (stdout.isTTY) {
     stdout.cursorTo(x, y)
   }
 }
 
 /**
- * Clear screen from cursor down.
+ * Clear screen from cursor position down to bottom.
+ * Only works in TTY environments.
+ *
+ * @example
+ * ```ts
+ * cursorTo(0, 5)
+ * clearScreenDown() // Clear from row 5 to bottom
+ * ```
  */
 export function clearScreenDown(): void {
   if (stdout.isTTY) {
@@ -51,28 +93,65 @@ export function clearScreenDown(): void {
 }
 
 /**
- * Check if stdout is a TTY.
+ * Check if stdout is connected to a TTY (terminal).
+ *
+ * @returns `true` if stdout is a TTY, `false` if piped/redirected
+ *
+ * @example
+ * ```ts
+ * if (isTTY()) {
+ *   // Show interactive UI
+ * } else {
+ *   // Use simple text output
+ * }
+ * ```
  */
 export function isTTY(): boolean {
   return stdout.isTTY || false
 }
 
 /**
- * Get terminal columns for stdout.
+ * Get the number of columns (width) in the terminal.
+ *
+ * @returns Terminal width in characters
+ * @default 80
+ *
+ * @example
+ * ```ts
+ * const width = getColumns()
+ * console.log(`Terminal is ${width} characters wide`)
+ * ```
  */
 export function getColumns(): number {
   return stdout.columns || 80
 }
 
 /**
- * Get terminal rows for stdout.
+ * Get the number of rows (height) in the terminal.
+ *
+ * @returns Terminal height in lines
+ * @default 24
+ *
+ * @example
+ * ```ts
+ * const height = getRows()
+ * console.log(`Terminal is ${height} lines tall`)
+ * ```
  */
 export function getRows(): number {
   return stdout.rows || 24
 }
 
 /**
- * Hide cursor on stdout.
+ * Hide the cursor on stdout.
+ * Useful for cleaner output during animations.
+ *
+ * @example
+ * ```ts
+ * hideCursor()
+ * // Show animation
+ * showCursor()
+ * ```
  */
 export function hideCursor(): void {
   if (stdout.isTTY && stdout instanceof WriteStream) {
@@ -81,7 +160,15 @@ export function hideCursor(): void {
 }
 
 /**
- * Show cursor on stdout.
+ * Show the cursor on stdout.
+ * Should be called after `hideCursor()`.
+ *
+ * @example
+ * ```ts
+ * hideCursor()
+ * // Show animation
+ * showCursor()
+ * ```
  */
 export function showCursor(): void {
   if (stdout.isTTY && stdout instanceof WriteStream) {
@@ -90,7 +177,16 @@ export function showCursor(): void {
 }
 
 /**
- * Ensure cursor is shown on exit.
+ * Register handlers to ensure cursor is shown on process exit.
+ * Prevents hidden cursor after abnormal termination.
+ * Handles SIGINT (Ctrl+C) and SIGTERM signals.
+ *
+ * @example
+ * ```ts
+ * ensureCursorOnExit()
+ * hideCursor()
+ * // Even if process crashes, cursor will be restored
+ * ```
  */
 export function ensureCursorOnExit(): void {
   process.on('exit', showCursor)
diff --git a/src/streams.ts b/src/streams.ts
index 2d3bff4..0b9abcb 100644
--- a/src/streams.ts
+++ b/src/streams.ts
@@ -27,7 +27,7 @@ let _streamingIterables:
 /*@__NO_SIDE_EFFECTS__*/
 function getStreamingIterables() {
   if (_streamingIterables === undefined) {
-    _streamingIterables = /*@__PURE__*/ require('../external/streaming-iterables')
+    _streamingIterables = /*@__PURE__*/ require('./external/streaming-iterables')
   }
   return _streamingIterables
 }
diff --git a/src/strings.ts b/src/strings.ts
index 7dac175..75b8375 100644
--- a/src/strings.ts
+++ b/src/strings.ts
@@ -25,11 +25,35 @@ export type EmptyString = string & { [EmptyStringBrand]: true }
 export const fromCharCode = String.fromCharCode
 
 export interface ApplyLinePrefixOptions {
-  prefix?: string
+  /**
+   * The prefix to add to each line.
+   * @default ''
+   */
+  prefix?: string | undefined
 }
 
 /**
  * Apply a prefix to each line of a string.
+ *
+ * Prepends the specified prefix to the beginning of each line in the input string.
+ * If the string contains newlines, the prefix is added after each newline as well.
+ * When no prefix is provided or prefix is empty, returns the original string unchanged.
+ *
+ * @param str - The string to add prefixes to
+ * @param options - Configuration options
+ * @returns The string with prefix applied to each line
+ *
+ * @example
+ * ```ts
+ * applyLinePrefix('hello\nworld', { prefix: '> ' })
+ * // Returns: '> hello\n> world'
+ *
+ * applyLinePrefix('single line', { prefix: '  ' })
+ * // Returns: '  single line'
+ *
+ * applyLinePrefix('no prefix')
+ * // Returns: 'no prefix'
+ * ```
  */
 /*@__NO_SIDE_EFFECTS__*/
 export function applyLinePrefix(
@@ -47,6 +71,32 @@ export function applyLinePrefix(
 
 /**
  * Convert a camelCase string to kebab-case.
+ *
+ * Transforms camelCase strings by converting uppercase letters to lowercase
+ * and inserting hyphens before uppercase sequences. Handles consecutive
+ * uppercase letters (like "XMLHttpRequest") by treating them as a single word.
+ * Returns empty string for empty input.
+ *
+ * Note: This function only handles camelCase. For mixed formats including
+ * snake_case, use `toKebabCase()` instead.
+ *
+ * @param str - The camelCase string to convert
+ * @returns The kebab-case string
+ *
+ * @example
+ * ```ts
+ * camelToKebab('helloWorld')
+ * // Returns: 'hello-world'
+ *
+ * camelToKebab('XMLHttpRequest')
+ * // Returns: 'xmlhttprequest'
+ *
+ * camelToKebab('iOS')
+ * // Returns: 'ios'
+ *
+ * camelToKebab('')
+ * // Returns: ''
+ * ```
  */
 /*@__NO_SIDE_EFFECTS__*/
 export function camelToKebab(str: string): string {
@@ -98,11 +148,35 @@ export function camelToKebab(str: string): string {
 }
 
 export interface IndentStringOptions {
-  count?: number
+  /**
+   * Number of spaces to indent each line.
+   * @default 1
+   */
+  count?: number | undefined
 }
 
 /**
  * Indent each line of a string with spaces.
+ *
+ * Adds the specified number of spaces to the beginning of each non-empty line
+ * in the input string. Empty lines (containing only whitespace) are not indented.
+ * Uses a regular expression to efficiently handle multi-line strings.
+ *
+ * @param str - The string to indent
+ * @param options - Configuration options
+ * @returns The indented string
+ *
+ * @example
+ * ```ts
+ * indentString('hello\nworld', { count: 2 })
+ * // Returns: '  hello\n  world'
+ *
+ * indentString('line1\n\nline3', { count: 4 })
+ * // Returns: '    line1\n\n    line3'
+ *
+ * indentString('single line')
+ * // Returns: ' single line' (default: 1 space)
+ * ```
  */
 /*@__NO_SIDE_EFFECTS__*/
 export function indentString(
@@ -115,6 +189,34 @@ export function indentString(
 
 /**
  * Check if a value is a blank string (empty or only whitespace).
+ *
+ * A blank string is defined as a string that is either:
+ * - Completely empty (length 0)
+ * - Contains only whitespace characters (spaces, tabs, newlines, etc.)
+ *
+ * This is useful for validation when you need to ensure user input
+ * contains actual content, not just whitespace.
+ *
+ * @param value - The value to check
+ * @returns `true` if the value is a blank string, `false` otherwise
+ *
+ * @example
+ * ```ts
+ * isBlankString('')
+ * // Returns: true
+ *
+ * isBlankString('   ')
+ * // Returns: true
+ *
+ * isBlankString('\n\t  ')
+ * // Returns: true
+ *
+ * isBlankString('hello')
+ * // Returns: false
+ *
+ * isBlankString(null)
+ * // Returns: false
+ * ```
  */
 /*@__NO_SIDE_EFFECTS__*/
 export function isBlankString(value: unknown): value is BlankString {
@@ -123,6 +225,32 @@ export function isBlankString(value: unknown): value is BlankString {
 
 /**
  * Check if a value is a non-empty string.
+ *
+ * Returns `true` only if the value is a string with at least one character.
+ * This includes strings containing only whitespace (use `isBlankString()` if
+ * you want to exclude those). Type guard ensures TypeScript knows the value
+ * is a string after this check.
+ *
+ * @param value - The value to check
+ * @returns `true` if the value is a non-empty string, `false` otherwise
+ *
+ * @example
+ * ```ts
+ * isNonEmptyString('hello')
+ * // Returns: true
+ *
+ * isNonEmptyString('   ')
+ * // Returns: true (contains whitespace)
+ *
+ * isNonEmptyString('')
+ * // Returns: false
+ *
+ * isNonEmptyString(null)
+ * // Returns: false
+ *
+ * isNonEmptyString(123)
+ * // Returns: false
+ * ```
  */
 /*@__NO_SIDE_EFFECTS__*/
 export function isNonEmptyString(
@@ -132,11 +260,45 @@ export function isNonEmptyString(
 }
 
 export interface SearchOptions {
-  fromIndex?: number
+  /**
+   * The position in the string to begin searching from.
+   * Negative values count back from the end of the string.
+   * @default 0
+   */
+  fromIndex?: number | undefined
 }
 
 /**
  * Search for a regular expression in a string starting from an index.
+ *
+ * Similar to `String.prototype.search()` but allows specifying a starting
+ * position. Returns the index of the first match at or after `fromIndex`,
+ * or -1 if no match is found. Negative `fromIndex` values count back from
+ * the end of the string.
+ *
+ * This is more efficient than using `str.slice(fromIndex).search()` when
+ * you need the absolute position in the original string, as it handles
+ * the offset calculation for you.
+ *
+ * @param str - The string to search in
+ * @param regexp - The regular expression to search for
+ * @param options - Configuration options
+ * @returns The index of the first match, or -1 if not found
+ *
+ * @example
+ * ```ts
+ * search('hello world hello', /hello/, { fromIndex: 0 })
+ * // Returns: 0 (first 'hello')
+ *
+ * search('hello world hello', /hello/, { fromIndex: 6 })
+ * // Returns: 12 (second 'hello')
+ *
+ * search('hello world', /goodbye/, { fromIndex: 0 })
+ * // Returns: -1 (not found)
+ *
+ * search('hello world', /hello/, { fromIndex: -5 })
+ * // Returns: -1 (starts searching from 'world', no match)
+ * ```
  */
 /*@__NO_SIDE_EFFECTS__*/
 export function search(
@@ -159,6 +321,30 @@ export function search(
 
 /**
  * Strip the Byte Order Mark (BOM) from the beginning of a string.
+ *
+ * The BOM (U+FEFF) is a Unicode character that can appear at the start of
+ * a text file to indicate byte order and encoding. In UTF-16 (JavaScript's
+ * internal string representation), it appears as 0xFEFF. This function
+ * removes it if present, leaving the rest of the string unchanged.
+ *
+ * Most text processing doesn't need to handle the BOM explicitly, but it
+ * can cause issues when parsing JSON, CSV, or other structured data formats
+ * that don't expect a leading invisible character.
+ *
+ * @param str - The string to strip BOM from
+ * @returns The string without BOM
+ *
+ * @example
+ * ```ts
+ * stripBom('\uFEFFhello world')
+ * // Returns: 'hello world'
+ *
+ * stripBom('hello world')
+ * // Returns: 'hello world' (no BOM to strip)
+ *
+ * stripBom('')
+ * // Returns: ''
+ * ```
  */
 /*@__NO_SIDE_EFFECTS__*/
 export function stripBom(str: string): string {
@@ -277,52 +463,83 @@ try {
 
 /**
  * Get the visual width of a string in terminal columns.
- * Strips ANSI escape codes and accounts for wide characters.
  *
- * Based on string-width:
+ * Calculates how many columns a string will occupy when displayed in a terminal,
+ * accounting for:
+ * - ANSI escape codes (stripped before calculation)
+ * - Wide characters (CJK ideographs, fullwidth forms) that take 2 columns
+ * - Emoji (including complex sequences) that take 2 columns
+ * - Combining marks and zero-width characters (take 0 columns)
+ * - East Asian Width properties (Fullwidth, Wide, Halfwidth, Narrow, etc.)
+ *
+ * Based on string-width by Sindre Sorhus:
  * https://socket.dev/npm/package/string-width/overview/7.2.0
  * MIT License
  * Copyright (c) Sindre Sorhus <sindresorhus@gmail.com> (https://sindresorhus.com)
  *
  * Terminal emulators display characters in a grid of cells (columns).
  * Most ASCII characters take 1 column, but some characters (especially
- * emoji and CJK characters) take 2 columns.
- *
- * This function calculates how many columns a string will occupy when
- * displayed in a terminal, which is crucial for:
- * - Aligning text properly
+ * emoji and CJK characters) take 2 columns. This function calculates
+ * the actual visual width, which is crucial for:
+ * - Aligning text properly in tables or columns
  * - Preventing text from jumping when characters change
- * - Calculating padding/spacing
+ * - Calculating padding/spacing for spinners and progress bars
+ * - Wrapping text at the correct column width
  *
- * Logic:
- * - Segment graphemes to match how terminals render clusters.
- * - Width rules:
- *   1. Skip non-printing clusters (Default_Ignorable, Control, pure Mark, lone Surrogates).
- *   2. RGI emoji clusters (\p{RGI_Emoji}) are double-width.
- *   3. Otherwise use East Asian Width of the cluster's first visible code point.
- *   4. Add widths for trailing Halfwidth/Fullwidth Forms within the same cluster.
+ * Algorithm Overview:
+ * 1. Strip ANSI escape codes (invisible in terminal)
+ * 2. Segment into grapheme clusters (user-perceived characters)
+ * 3. For each cluster:
+ *    - Skip zero-width/non-printing clusters (width = 0)
+ *    - RGI emoji clusters are double-width (width = 2)
+ *    - Otherwise use East Asian Width of first visible code point
+ *    - Add width for trailing Halfwidth/Fullwidth Forms
  *
- * East Asian Width categories (Unicode Standard Annex #11):
+ * East Asian Width Categories (Unicode Standard Annex #11):
  * - F (Fullwidth): 2 columns - e.g., fullwidth Latin letters (Ａ, Ｂ)
  * - W (Wide): 2 columns - e.g., CJK ideographs (漢字), emoji (⚡, 😀)
  * - H (Halfwidth): 1 column - e.g., halfwidth Katakana (ｱ, ｲ)
  * - Na (Narrow): 1 column - e.g., ASCII (a-z, 0-9)
- * - A (Ambiguous): Context-dependent, we treat as 1 column
+ * - A (Ambiguous): Context-dependent, treated as 1 column by default
  * - N (Neutral): 1 column - e.g., most symbols (✦, ✧, ⋆)
  *
- * Why this matters for Socket spinners:
+ * Why This Matters for Socket:
  * - Lightning bolt (⚡) takes 2 columns
  * - Stars (✦, ✧, ⋆) take 1 column
- * - Without compensation, text jumps when frames change
- * - We use this to calculate padding for consistent alignment
+ * - Without proper width calculation, spinner text jumps between frames
+ * - This function enables consistent alignment by calculating padding
+ *
+ * @param text - The string to measure
+ * @returns The visual width in terminal columns
  *
  * @example
- * stringWidth('hello') // => 5 (5 ASCII chars = 5 columns)
- * stringWidth('⚡') // => 2 (lightning bolt is wide)
- * stringWidth('✦') // => 1 (star is narrow)
- * stringWidth('\x1b[31mred\x1b[0m') // => 3 (ANSI codes stripped, 'red' = 3)
+ * ```ts
+ * stringWidth('hello')
+ * // Returns: 5 (5 ASCII chars = 5 columns)
+ *
+ * stringWidth('⚡')
+ * // Returns: 2 (lightning bolt is wide)
+ *
+ * stringWidth('✦')
+ * // Returns: 1 (star is narrow)
+ *
+ * stringWidth('漢字')
+ * // Returns: 4 (2 CJK characters × 2 columns each)
+ *
+ * stringWidth('\x1b[31mred\x1b[0m')
+ * // Returns: 3 (ANSI codes stripped, 'red' = 3)
+ *
+ * stringWidth('👍🏽')
+ * // Returns: 2 (emoji with skin tone = 1 grapheme cluster = 2 columns)
  *
- * @throws {TypeError} When input is not a string.
+ * stringWidth('é')
+ * // Returns: 1 (combining accent doesn't add width)
+ *
+ * stringWidth('')
+ * // Returns: 0
+ * ```
+ *
+ * @throws {TypeError} When input is not a string
  */
 /*@__NO_SIDE_EFFECTS__*/
 export function stringWidth(text: string): number {
@@ -479,6 +696,35 @@ export function stringWidth(text: string): number {
 
 /**
  * Convert a string to kebab-case (handles camelCase and snake_case).
+ *
+ * Transforms strings from camelCase or snake_case to kebab-case by:
+ * - Converting uppercase letters to lowercase
+ * - Inserting hyphens before uppercase letters (for camelCase)
+ * - Replacing underscores with hyphens (for snake_case)
+ *
+ * This is more comprehensive than `camelToKebab()` as it handles mixed
+ * formats including snake_case. Returns empty string for empty input.
+ *
+ * @param str - The string to convert
+ * @returns The kebab-case string
+ *
+ * @example
+ * ```ts
+ * toKebabCase('helloWorld')
+ * // Returns: 'hello-world'
+ *
+ * toKebabCase('hello_world')
+ * // Returns: 'hello-world'
+ *
+ * toKebabCase('XMLHttpRequest')
+ * // Returns: 'xmlhttp-request'
+ *
+ * toKebabCase('iOS_Version')
+ * // Returns: 'io-s-version'
+ *
+ * toKebabCase('')
+ * // Returns: ''
+ * ```
  */
 /*@__NO_SIDE_EFFECTS__*/
 export function toKebabCase(str: string): string {
@@ -497,6 +743,36 @@ export function toKebabCase(str: string): string {
 
 /**
  * Trim newlines from the beginning and end of a string.
+ *
+ * Removes all leading and trailing newline characters (both `\n` and `\r`)
+ * from a string, while preserving any newlines in the middle. This is similar
+ * to `String.prototype.trim()` but specifically targets newlines instead of
+ * all whitespace.
+ *
+ * Optimized for performance by checking the first and last characters before
+ * doing any string manipulation. Returns the original string unchanged if no
+ * newlines are found at the edges.
+ *
+ * @param str - The string to trim
+ * @returns The string with leading and trailing newlines removed
+ *
+ * @example
+ * ```ts
+ * trimNewlines('\n\nhello\n\n')
+ * // Returns: 'hello'
+ *
+ * trimNewlines('\r\nworld\r\n')
+ * // Returns: 'world'
+ *
+ * trimNewlines('hello\nworld')
+ * // Returns: 'hello\nworld' (middle newline preserved)
+ *
+ * trimNewlines('  hello  ')
+ * // Returns: '  hello  ' (spaces not trimmed, only newlines)
+ *
+ * trimNewlines('hello')
+ * // Returns: 'hello'
+ * ```
  */
 /*@__NO_SIDE_EFFECTS__*/
 export function trimNewlines(str: string): string {
@@ -535,6 +811,29 @@ export function trimNewlines(str: string): string {
 
 /**
  * Repeat a string n times.
+ *
+ * Creates a new string by repeating the input string the specified number of times.
+ * Returns an empty string if count is zero or negative. This is a simple wrapper
+ * around `String.prototype.repeat()` with guard for non-positive counts.
+ *
+ * @param str - The string to repeat
+ * @param count - The number of times to repeat the string
+ * @returns The repeated string, or empty string if count <= 0
+ *
+ * @example
+ * ```ts
+ * repeatString('hello', 3)
+ * // Returns: 'hellohellohello'
+ *
+ * repeatString('x', 5)
+ * // Returns: 'xxxxx'
+ *
+ * repeatString('hello', 0)
+ * // Returns: ''
+ *
+ * repeatString('hello', -1)
+ * // Returns: ''
+ * ```
  */
 /*@__NO_SIDE_EFFECTS__*/
 export function repeatString(str: string, count: number): string {
@@ -546,6 +845,36 @@ export function repeatString(str: string, count: number): string {
 
 /**
  * Center text within a given width.
+ *
+ * Adds spaces before and after the text to center it within the specified width.
+ * Distributes padding evenly on both sides. When the padding is odd, the extra
+ * space is added to the right side. Strips ANSI codes before calculating text
+ * length to ensure accurate centering of colored text.
+ *
+ * If the text is already wider than or equal to the target width, returns the
+ * original text unchanged (no truncation occurs).
+ *
+ * @param text - The text to center (may include ANSI codes)
+ * @param width - The target width in columns
+ * @returns The centered text with padding
+ *
+ * @example
+ * ```ts
+ * centerText('hello', 11)
+ * // Returns: '   hello   ' (3 spaces on each side)
+ *
+ * centerText('hi', 10)
+ * // Returns: '    hi    ' (4 spaces on each side)
+ *
+ * centerText('odd', 8)
+ * // Returns: '  odd   ' (2 left, 3 right)
+ *
+ * centerText('\x1b[31mred\x1b[0m', 7)
+ * // Returns: '  \x1b[31mred\x1b[0m  ' (ANSI codes preserved, 'red' centered)
+ *
+ * centerText('too long text', 5)
+ * // Returns: 'too long text' (no truncation, returned as-is)
+ * ```
  */
 /*@__NO_SIDE_EFFECTS__*/
 export function centerText(text: string, width: number): string {
diff --git a/src/suppress-warnings.ts b/src/suppress-warnings.ts
index e381288..9ba0b19 100644
--- a/src/suppress-warnings.ts
+++ b/src/suppress-warnings.ts
@@ -18,7 +18,6 @@ function setupSuppression(): void {
   // Only wrap once - store the original on first call.
   if (!originalEmitWarning) {
     originalEmitWarning = process.emitWarning
-    // biome-ignore lint/suspicious/noExplicitAny: Process emitWarning accepts variable args.
     process.emitWarning = (warning: string | Error, ...args: any[]) => {
       // Check both string warnings and warning objects.
       if (typeof warning === 'string') {
@@ -49,7 +48,7 @@ function setupSuppression(): void {
  * This is useful in tests or scripts where multiple listeners are expected.
  *
  * @example
- * import { suppressMaxListenersWarning } from '@socketsecurity/registry/lib/suppress-warnings'
+ * import { suppressMaxListenersWarning } from '@socketsecurity/lib/suppress-warnings'
  *
  * suppressMaxListenersWarning()
  */
@@ -64,7 +63,7 @@ export function suppressMaxListenersWarning(): void {
  * @param warningType - The warning type to suppress (e.g., 'DeprecationWarning', 'ExperimentalWarning')
  *
  * @example
- * import { suppressWarningType } from '@socketsecurity/registry/lib/suppress-warnings'
+ * import { suppressWarningType } from '@socketsecurity/lib/suppress-warnings'
  *
  * suppressWarningType('ExperimentalWarning')
  */
@@ -91,7 +90,7 @@ export function suppressWarningType(warningType: string): void {
  * @param maxListeners - Maximum number of listeners (defaults to 10, the Node.js default)
  *
  * @example
- * import { setMaxEventTargetListeners } from '@socketsecurity/registry/lib/suppress-warnings'
+ * import { setMaxEventTargetListeners } from '@socketsecurity/lib/suppress-warnings'
  *
  * const controller = new AbortController()
  * setMaxEventTargetListeners(controller.signal)
@@ -110,7 +109,6 @@ export function setMaxEventTargetListeners(
   if (kMaxEventTargetListeners) {
     // The default events.defaultMaxListeners value is 10.
     // https://nodejs.org/api/events.html#eventsdefaultmaxlisteners
-    // biome-ignore lint/suspicious/noExplicitAny: Setting Node.js internal symbol property.
     ;(target as any)[kMaxEventTargetListeners] = maxListeners
   }
 }
@@ -135,7 +133,7 @@ export function restoreWarnings(): void {
  * @returns The result of the callback
  *
  * @example
- * import { withSuppressedWarnings } from '@socketsecurity/registry/lib/suppress-warnings'
+ * import { withSuppressedWarnings } from '@socketsecurity/lib/suppress-warnings'
  *
  * const result = await withSuppressedWarnings('ExperimentalWarning', async () => {
  *   // Code that triggers experimental warnings
diff --git a/src/tables.ts b/src/tables.ts
index 53c056c..1d3e084 100644
--- a/src/tables.ts
+++ b/src/tables.ts
@@ -59,7 +59,7 @@ function padText(
  * @returns Formatted table string
  *
  * @example
- * import { formatTable } from '@socketsecurity/registry/lib/tables'
+ * import { formatTable } from '@socketsecurity/lib/tables'
  * import colors from 'yoctocolors-cjs'
  *
  * const data = [
@@ -146,7 +146,7 @@ export function formatTable(
  * @returns Formatted table string
  *
  * @example
- * import { formatSimpleTable } from '@socketsecurity/registry/lib/tables'
+ * import { formatSimpleTable } from '@socketsecurity/lib/tables'
  * import colors from 'yoctocolors-cjs'
  *
  * const data = [
diff --git a/src/temporary-executor.ts b/src/temporary-executor.ts
index e1e805e..3e3592c 100644
--- a/src/temporary-executor.ts
+++ b/src/temporary-executor.ts
@@ -3,6 +3,7 @@
  * Identifies and handles temporary execution contexts such as npx, pnpm dlx, and yarn dlx.
  */
 
+import { WIN32 } from '#constants/platform'
 import { normalizePath } from './path'
 
 /**
@@ -46,7 +47,7 @@ export function isRunningInTemporaryExecutor(cwd = process.cwd()): boolean {
   ]
 
   // Yarn on Windows uses AppData/Local/Temp/xfs- pattern.
-  if (process.platform === 'win32') {
+  if (WIN32) {
     tempPatterns.push('AppData/Local/Temp/xfs-')
   }
 
diff --git a/src/themes/context.ts b/src/themes/context.ts
new file mode 100644
index 0000000..9b2d318
--- /dev/null
+++ b/src/themes/context.ts
@@ -0,0 +1,143 @@
+/**
+ * @fileoverview Elegant theme context management.
+ * Async-aware theming with automatic context isolation via AsyncLocalStorage.
+ */
+
+import { AsyncLocalStorage } from 'node:async_hooks'
+
+import type { Theme } from './types'
+import { SOCKET_THEME, THEMES, type ThemeName } from './themes'
+
+/**
+ * Theme change event listener signature.
+ */
+export type ThemeChangeListener = (theme: Theme) => void
+
+/**
+ * AsyncLocalStorage for theme context isolation.
+ */
+const themeStorage = new AsyncLocalStorage<Theme>()
+
+/**
+ * Fallback theme for global context.
+ */
+let fallbackTheme: Theme = SOCKET_THEME
+
+/**
+ * Registered theme change listeners.
+ */
+const listeners: Set<ThemeChangeListener> = new Set()
+
+/**
+ * Set the global fallback theme.
+ *
+ * @param theme - Theme name or object
+ *
+ * @example
+ * ```ts
+ * setTheme('socket-firewall')
+ * ```
+ */
+export function setTheme(theme: Theme | ThemeName): void {
+  fallbackTheme = typeof theme === 'string' ? THEMES[theme] : theme
+  emitThemeChange(fallbackTheme)
+}
+
+/**
+ * Get the active theme from context.
+ *
+ * @returns Current theme
+ *
+ * @example
+ * ```ts
+ * const theme = getTheme()
+ * console.log(theme.displayName)
+ * ```
+ */
+export function getTheme(): Theme {
+  return themeStorage.getStore() ?? fallbackTheme
+}
+
+/**
+ * Execute async operation with scoped theme.
+ * Theme automatically restored on completion.
+ *
+ * @template T - Return type
+ * @param theme - Scoped theme
+ * @param fn - Async operation
+ * @returns Operation result
+ *
+ * @example
+ * ```ts
+ * await withTheme('ultra', async () => {
+ *   // Operations use Ultra theme
+ * })
+ * ```
+ */
+export async function withTheme<T>(
+  theme: Theme | ThemeName,
+  fn: () => Promise<T>,
+): Promise<T> {
+  const resolvedTheme: Theme = typeof theme === 'string' ? THEMES[theme] : theme
+  return await themeStorage.run(resolvedTheme, async () => {
+    emitThemeChange(resolvedTheme)
+    return await fn()
+  })
+}
+
+/**
+ * Execute sync operation with scoped theme.
+ * Theme automatically restored on completion.
+ *
+ * @template T - Return type
+ * @param theme - Scoped theme
+ * @param fn - Sync operation
+ * @returns Operation result
+ *
+ * @example
+ * ```ts
+ * const result = withThemeSync('coana', () => {
+ *   return processData()
+ * })
+ * ```
+ */
+export function withThemeSync<T>(theme: Theme | ThemeName, fn: () => T): T {
+  const resolvedTheme: Theme = typeof theme === 'string' ? THEMES[theme] : theme
+  return themeStorage.run(resolvedTheme, () => {
+    emitThemeChange(resolvedTheme)
+    return fn()
+  })
+}
+
+/**
+ * Subscribe to theme change events.
+ *
+ * @param listener - Change handler
+ * @returns Unsubscribe function
+ *
+ * @example
+ * ```ts
+ * const unsubscribe = onThemeChange((theme) => {
+ *   console.log('Theme:', theme.displayName)
+ * })
+ *
+ * // Cleanup
+ * unsubscribe()
+ * ```
+ */
+export function onThemeChange(listener: ThemeChangeListener): () => void {
+  listeners.add(listener)
+  return () => {
+    listeners.delete(listener)
+  }
+}
+
+/**
+ * Emit theme change event to listeners.
+ * @private
+ */
+function emitThemeChange(theme: Theme): void {
+  for (const listener of listeners) {
+    listener(theme)
+  }
+}
diff --git a/src/themes/index.ts b/src/themes/index.ts
new file mode 100644
index 0000000..8c14319
--- /dev/null
+++ b/src/themes/index.ts
@@ -0,0 +1,83 @@
+/**
+ * @fileoverview Elegant theming system for Socket libraries.
+ * Unified visual language across spinners, loggers, prompts, and links.
+ *
+ * @example
+ * ```ts
+ * import { setTheme, THEMES } from '@socketsecurity/lib/themes'
+ *
+ * // Set global theme
+ * setTheme('terracotta')
+ * ```
+ *
+ * @example
+ * ```ts
+ * import { withTheme } from '@socketsecurity/lib/themes'
+ *
+ * // Scoped theme context
+ * await withTheme('ultra', async () => {
+ *   // All operations inherit Ultra theme
+ * })
+ * ```
+ *
+ * @example
+ * ```ts
+ * import { createTheme } from '@socketsecurity/lib/themes'
+ *
+ * // Custom theme creation
+ * const myTheme = createTheme({
+ *   name: 'custom',
+ *   displayName: 'Custom Theme',
+ *   colors: {
+ *     primary: [255, 100, 200],
+ *     success: 'greenBright',
+ *     error: 'redBright',
+ *     warning: 'yellowBright',
+ *     info: 'blueBright',
+ *     step: 'cyanBright',
+ *     text: 'white',
+ *     textDim: 'gray',
+ *     link: 'cyanBright',
+ *     prompt: 'primary'
+ *   }
+ * })
+ * ```
+ */
+
+// Type system
+export type {
+  ColorReference,
+  Theme,
+  ThemeColors,
+  ThemeEffects,
+  ThemeMeta,
+} from './types'
+
+// Curated themes
+export {
+  LUSH_THEME,
+  SOCKET_THEME,
+  SUNSET_THEME,
+  TERRACOTTA_THEME,
+  THEMES,
+  ULTRA_THEME,
+  type ThemeName,
+} from './themes'
+
+// Context management
+export {
+  getTheme,
+  onThemeChange,
+  setTheme,
+  withTheme,
+  withThemeSync,
+  type ThemeChangeListener,
+} from './context'
+
+// Composition utilities
+export {
+  createTheme,
+  extendTheme,
+  resolveColor,
+  resolveShimmerColor,
+} from './utils'
diff --git a/src/themes/themes.ts b/src/themes/themes.ts
new file mode 100644
index 0000000..d46409c
--- /dev/null
+++ b/src/themes/themes.ts
@@ -0,0 +1,212 @@
+/**
+ * @fileoverview Elegant theme definitions for Socket libraries.
+ * Sophisticated color palettes crafted for clarity and visual harmony.
+ *
+ * Philosophy: Every color choice serves a purpose. Bright variants ensure
+ * terminal legibility without compromising sophistication. Minimal emoji use,
+ * refined symbols with color—elegance in restraint.
+ */
+
+import type { Theme } from './types'
+
+/**
+ * Socket Security — The signature theme.
+ * Refined violet with subtle shimmer, designed for focus and elegance.
+ */
+export const SOCKET_THEME: Theme = {
+  name: 'socket',
+  displayName: 'Socket Security',
+  colors: {
+    primary: [140, 82, 255],
+    success: 'greenBright',
+    error: 'redBright',
+    warning: 'yellowBright',
+    info: 'blueBright',
+    step: 'cyanBright',
+    text: 'white',
+    textDim: 'gray',
+    link: 'cyanBright',
+    prompt: 'primary',
+  },
+  effects: {
+    spinner: {
+      color: 'primary',
+      style: 'socket',
+    },
+    shimmer: {
+      enabled: true,
+      color: 'inherit',
+      direction: 'ltr',
+      speed: 0.33,
+    },
+  },
+  meta: {
+    description: 'Signature theme with refined violet and subtle shimmer',
+    version: '1.0.0',
+  },
+}
+
+/**
+ * Sunset — Vibrant twilight gradient.
+ * Warm sunset palette with orange and purple/pink tones.
+ */
+export const SUNSET_THEME: Theme = {
+  name: 'sunset',
+  displayName: 'Sunset',
+  colors: {
+    primary: [255, 140, 100],
+    secondary: [200, 100, 180],
+    success: 'greenBright',
+    error: 'redBright',
+    warning: 'yellowBright',
+    info: 'magentaBright',
+    step: 'magentaBright',
+    text: 'white',
+    textDim: 'gray',
+    link: 'primary',
+    prompt: 'primary',
+  },
+  effects: {
+    spinner: {
+      color: 'primary',
+      style: 'dots',
+    },
+    shimmer: {
+      enabled: true,
+      color: [
+        [200, 100, 180],
+        [255, 140, 100],
+      ],
+      direction: 'ltr',
+      speed: 0.4,
+    },
+  },
+  meta: {
+    description: 'Warm sunset theme with purple-to-orange gradient',
+    version: '2.0.0',
+  },
+}
+
+/**
+ * Terracotta — Solid warmth.
+ * Rich terracotta and ember tones for grounded confidence.
+ */
+export const TERRACOTTA_THEME: Theme = {
+  name: 'terracotta',
+  displayName: 'Terracotta',
+  colors: {
+    primary: [255, 100, 50],
+    secondary: [255, 150, 100],
+    success: 'greenBright',
+    error: 'redBright',
+    warning: 'yellowBright',
+    info: 'blueBright',
+    step: 'cyanBright',
+    text: 'white',
+    textDim: 'gray',
+    link: 'secondary',
+    prompt: 'primary',
+  },
+  effects: {
+    spinner: {
+      color: 'primary',
+      style: 'socket',
+    },
+    shimmer: {
+      enabled: true,
+      color: 'inherit',
+      direction: 'ltr',
+      speed: 0.5,
+    },
+  },
+  meta: {
+    description: 'Solid theme with rich terracotta and ember warmth',
+    version: '1.0.0',
+  },
+}
+
+/**
+ * Lush — Steel elegance.
+ * Python-inspired steel blue with golden accents.
+ */
+export const LUSH_THEME: Theme = {
+  name: 'lush',
+  displayName: 'Lush',
+  colors: {
+    primary: [70, 130, 180],
+    secondary: [255, 215, 0],
+    success: 'greenBright',
+    error: 'redBright',
+    warning: 'yellowBright',
+    info: 'blueBright',
+    step: 'cyanBright',
+    text: 'white',
+    textDim: 'gray',
+    link: 'cyanBright',
+    prompt: 'primary',
+  },
+  effects: {
+    spinner: {
+      color: 'primary',
+      style: 'dots',
+    },
+  },
+  meta: {
+    description: 'Elegant theme with steel blue and golden harmony',
+    version: '1.0.0',
+  },
+}
+
+/**
+ * Ultra — Premium intensity.
+ * Prismatic shimmer for deep analysis, where complexity meets elegance.
+ */
+export const ULTRA_THEME: Theme = {
+  name: 'ultra',
+  displayName: 'Ultra',
+  colors: {
+    primary: [140, 82, 255],
+    success: 'greenBright',
+    error: 'redBright',
+    warning: 'yellowBright',
+    info: 'cyanBright',
+    step: 'magentaBright',
+    text: 'whiteBright',
+    textDim: 'gray',
+    link: 'cyanBright',
+    prompt: 'primary',
+  },
+  effects: {
+    spinner: {
+      color: 'inherit',
+      style: 'socket',
+    },
+    shimmer: {
+      enabled: true,
+      color: 'rainbow',
+      direction: 'bi',
+      speed: 0.5,
+    },
+  },
+  meta: {
+    description: 'Premium theme with prismatic shimmer for deep analysis',
+    version: '1.0.0',
+  },
+}
+
+/**
+ * Theme registry — Curated palette collection.
+ */
+export const THEMES = {
+  __proto__: null,
+  socket: SOCKET_THEME,
+  sunset: SUNSET_THEME,
+  terracotta: TERRACOTTA_THEME,
+  lush: LUSH_THEME,
+  ultra: ULTRA_THEME,
+} as const
+
+/**
+ * Available theme identifiers.
+ */
+export type ThemeName = keyof typeof THEMES
diff --git a/src/themes/types.ts b/src/themes/types.ts
new file mode 100644
index 0000000..4b41913
--- /dev/null
+++ b/src/themes/types.ts
@@ -0,0 +1,111 @@
+/**
+ * @fileoverview Elegant theme type system.
+ * Type-safe theming for spinners, loggers, prompts, and links.
+ */
+
+import type { ColorValue } from '../colors'
+import type { SpinnerStyle } from '../spinner'
+import type { ShimmerDirection } from '../effects/text-shimmer'
+
+/**
+ * Color reference — direct value or semantic keyword.
+ * Keywords: 'primary', 'secondary', 'inherit', 'rainbow'
+ */
+export type ColorReference =
+  | ColorValue
+  | 'primary'
+  | 'secondary'
+  | 'inherit'
+  | 'rainbow'
+
+/**
+ * Theme color palette — semantic colors for visual harmony.
+ */
+export type ThemeColors = {
+  /** Primary brand identity */
+  primary: ColorValue
+  /** Secondary accent (optional) */
+  secondary?: ColorValue | undefined
+
+  /** Success indicator ✓ */
+  success: ColorValue
+  /** Error indicator ✗ */
+  error: ColorValue
+  /** Warning indicator ⚠ */
+  warning: ColorValue
+  /** Information indicator ℹ */
+  info: ColorValue
+  /** Progress indicator → */
+  step: ColorValue
+
+  /** Primary text */
+  text: ColorValue
+  /** Dimmed text */
+  textDim: ColorValue
+  /** Hyperlinks */
+  link: ColorReference
+  /** Interactive prompts */
+  prompt: ColorReference
+}
+
+/**
+ * Theme effects — animations and visual enhancements.
+ */
+export type ThemeEffects = {
+  /** Spinner configuration */
+  spinner?: {
+    /** Color (supports theme references) */
+    color?: ColorReference | undefined
+    /** Animation style */
+    style?: SpinnerStyle | string | undefined
+  }
+
+  /** Shimmer configuration */
+  shimmer?: {
+    /** Enable shimmer */
+    enabled?: boolean | undefined
+    /** Color (single, gradient, or keyword) */
+    color?: ColorReference | ColorValue[] | undefined
+    /** Direction */
+    direction?: ShimmerDirection | undefined
+    /** Speed (steps per frame) */
+    speed?: number | undefined
+  }
+
+  /** Pulse configuration */
+  pulse?: {
+    /** Speed (milliseconds) */
+    speed?: number | undefined
+  }
+}
+
+/**
+ * Theme metadata — descriptive information.
+ */
+export type ThemeMeta = {
+  /** Description */
+  description?: string | undefined
+  /** Author */
+  author?: string | undefined
+  /** Version */
+  version?: string | undefined
+}
+
+/**
+ * Theme definition — complete visual identity.
+ */
+export type Theme = {
+  /** Unique identifier (kebab-case) */
+  name: string
+  /** Display name */
+  displayName: string
+
+  /** Color palette */
+  colors: ThemeColors
+
+  /** Visual effects (optional) */
+  effects?: ThemeEffects | undefined
+
+  /** Metadata (optional) */
+  meta?: ThemeMeta | undefined
+}
diff --git a/src/themes/utils.ts b/src/themes/utils.ts
new file mode 100644
index 0000000..64c3adf
--- /dev/null
+++ b/src/themes/utils.ts
@@ -0,0 +1,195 @@
+/**
+ * @fileoverview Theme utilities — color resolution and composition.
+ */
+
+import { RAINBOW_GRADIENT } from '../effects/ultra'
+import type { ColorValue } from '../colors'
+import type { ShimmerColorGradient } from '../effects/text-shimmer'
+import type { Theme, ThemeColors, ColorReference } from './types'
+
+/**
+ * Resolve color reference to concrete value.
+ * Handles semantic keywords: 'primary', 'secondary', 'rainbow', 'inherit'
+ *
+ * @param value - Color reference
+ * @param colors - Theme palette
+ * @returns Resolved color
+ *
+ * @example
+ * ```ts
+ * resolveColor('primary', theme.colors)
+ * resolveColor([255, 0, 0], theme.colors)
+ * ```
+ */
+export function resolveColor(
+  value: ColorReference | ColorValue,
+  colors: ThemeColors,
+): ColorValue | 'inherit' | ShimmerColorGradient {
+  if (typeof value === 'string') {
+    if (value === 'primary') {
+      return colors.primary
+    }
+    if (value === 'secondary') {
+      return colors.secondary ?? colors.primary
+    }
+    if (value === 'inherit') {
+      return 'inherit'
+    }
+    if (value === 'rainbow') {
+      return RAINBOW_GRADIENT
+    }
+    return value as ColorValue
+  }
+  return value as ColorValue
+}
+
+/**
+ * Resolve shimmer color with gradient support.
+ *
+ * @param value - Shimmer color
+ * @param theme - Theme context
+ * @returns Resolved color
+ *
+ * @example
+ * ```ts
+ * resolveShimmerColor('rainbow', theme)
+ * resolveShimmerColor('primary', theme)
+ * ```
+ */
+export function resolveShimmerColor(
+  value: ColorReference | ColorValue[] | undefined,
+  theme: Theme,
+): ColorValue | ShimmerColorGradient | 'inherit' {
+  if (!value) {
+    return 'inherit'
+  }
+  if (value === 'rainbow') {
+    return RAINBOW_GRADIENT
+  }
+  if (value === 'inherit') {
+    return 'inherit'
+  }
+  if (Array.isArray(value)) {
+    if (value.length > 0 && Array.isArray(value[0])) {
+      // Gradient
+      return value as ShimmerColorGradient
+    }
+    // Single RGB
+    return value as unknown as ColorValue
+  }
+  return resolveColor(value as ColorReference, theme.colors)
+}
+
+/**
+ * Extend existing theme with custom overrides.
+ * Deep merge of colors and effects.
+ *
+ * @param base - Base theme
+ * @param overrides - Custom overrides
+ * @returns Extended theme
+ *
+ * @example
+ * ```ts
+ * const custom = extendTheme(SOCKET_THEME, {
+ *   name: 'custom',
+ *   colors: { primary: [255, 100, 200] }
+ * })
+ * ```
+ */
+export function extendTheme(
+  base: Theme,
+  overrides: Partial<Omit<Theme, 'colors'>> & {
+    colors?: Partial<ThemeColors> | undefined
+  },
+): Theme {
+  return {
+    __proto__: null,
+    ...base,
+    ...overrides,
+    colors: {
+      __proto__: null,
+      ...base.colors,
+      ...overrides.colors,
+    } as ThemeColors,
+    effects: overrides.effects
+      ? {
+          __proto__: null,
+          ...base.effects,
+          ...overrides.effects,
+          spinner:
+            overrides.effects.spinner !== undefined
+              ? {
+                  __proto__: null,
+                  ...base.effects?.spinner,
+                  ...overrides.effects.spinner,
+                }
+              : base.effects?.spinner,
+          shimmer:
+            overrides.effects.shimmer !== undefined
+              ? {
+                  __proto__: null,
+                  ...base.effects?.shimmer,
+                  ...overrides.effects.shimmer,
+                }
+              : base.effects?.shimmer,
+          pulse:
+            overrides.effects.pulse !== undefined
+              ? {
+                  __proto__: null,
+                  ...base.effects?.pulse,
+                  ...overrides.effects.pulse,
+                }
+              : base.effects?.pulse,
+        }
+      : base.effects,
+    meta: overrides.meta
+      ? {
+          __proto__: null,
+          ...base.meta,
+          ...overrides.meta,
+        }
+      : base.meta,
+  } as Theme
+}
+
+/**
+ * Create new theme from complete specification.
+ *
+ * @param config - Theme configuration
+ * @returns Theme object
+ *
+ * @example
+ * ```ts
+ * const theme = createTheme({
+ *   name: 'custom',
+ *   displayName: 'Custom',
+ *   colors: {
+ *     primary: [255, 100, 200],
+ *     success: 'greenBright',
+ *     error: 'redBright',
+ *     warning: 'yellowBright',
+ *     info: 'blueBright',
+ *     step: 'cyanBright',
+ *     text: 'white',
+ *     textDim: 'gray',
+ *     link: 'cyanBright',
+ *     prompt: 'primary'
+ *   }
+ * })
+ * ```
+ */
+export function createTheme(
+  config: Pick<Theme, 'name' | 'displayName' | 'colors'> &
+    Partial<Omit<Theme, 'name' | 'displayName' | 'colors'>>,
+): Theme {
+  return {
+    __proto__: null,
+    name: config.name,
+    displayName: config.displayName,
+    colors: { __proto__: null, ...config.colors } as ThemeColors,
+    effects: config.effects
+      ? { __proto__: null, ...config.effects }
+      : undefined,
+    meta: config.meta ? { __proto__: null, ...config.meta } : undefined,
+  } as Theme
+}
diff --git a/src/types/external-modules.d.ts b/src/types/external-modules.d.ts
index 9023024..4012249 100644
--- a/src/types/external-modules.d.ts
+++ b/src/types/external-modules.d.ts
@@ -4,15 +4,12 @@ declare module 'cacache' {
   export function get(
     cachePath: string,
     key: string,
-    // biome-ignore lint/suspicious/noExplicitAny: External module type definitions.
     options?: any,
   ): Promise<{ data: Buffer }>
   export function put(
     cachePath: string,
     key: string,
-    // biome-ignore lint/suspicious/noExplicitAny: External module type definitions.
     data: any,
-    // biome-ignore lint/suspicious/noExplicitAny: External module type definitions.
     options?: any,
   ): Promise<void>
   export const rm: {
@@ -20,13 +17,11 @@ declare module 'cacache' {
     all(cachePath: string): Promise<void>
     entry(cachePath: string, key: string): Promise<void>
   }
-  // biome-ignore lint/suspicious/noExplicitAny: External module type definitions.
   export function ls(cachePath: string): Promise<Record<string, any>>
   export function verify(cachePath: string): Promise<void>
   export const tmp: {
     withTmp<T>(
       cachePath: string,
-      // biome-ignore lint/suspicious/noExplicitAny: External module type definitions.
       opts: any,
       callback: (tmpDirPath: string) => Promise<T>,
     ): Promise<T>
@@ -35,17 +30,12 @@ declare module 'cacache' {
 
 declare module 'pacote' {
   export class RegistryFetcher {
-    // biome-ignore lint/suspicious/noExplicitAny: External module type definitions.
     constructor(spec: string, opts?: any)
     cache: string
   }
-  // biome-ignore lint/suspicious/noExplicitAny: External module type definitions.
   export function extract(spec: string, dest: string, opts?: any): Promise<any>
-  // biome-ignore lint/suspicious/noExplicitAny: External module type definitions.
   export function manifest(spec: string, opts?: any): Promise<any>
-  // biome-ignore lint/suspicious/noExplicitAny: External module type definitions.
   export function packument(spec: string, opts?: any): Promise<any>
-  // biome-ignore lint/suspicious/noExplicitAny: External module type definitions.
   export function tarball(spec: string, opts?: any): Promise<Buffer>
 }
 
@@ -53,7 +43,6 @@ declare module 'make-fetch-happen' {
   interface FetchOptions {
     cache?: string
     headers?: Record<string, string>
-    // biome-ignore lint/suspicious/noExplicitAny: External module type definitions.
     [key: string]: any
   }
 
diff --git a/src/utils/get-ipc.ts b/src/utils/get-ipc.ts
index 29c66e9..6f76636 100644
--- a/src/utils/get-ipc.ts
+++ b/src/utils/get-ipc.ts
@@ -70,5 +70,3 @@ export async function getIpc(
 
   return key ? _ipcObject[key] : _ipcObject
 }
-
-export default getIpc
diff --git a/src/validation/json-parser.ts b/src/validation/json-parser.ts
index 8bcc731..6fe1720 100644
--- a/src/validation/json-parser.ts
+++ b/src/validation/json-parser.ts
@@ -1,14 +1,64 @@
 /**
- * @fileoverview Safe JSON parsing with validation.
+ * @fileoverview Safe JSON parsing with validation and security controls.
+ * Provides protection against prototype pollution, size limits, and schema validation.
+ *
+ * Key Features:
+ * - Prototype pollution protection: Blocks `__proto__`, `constructor`, and `prototype` keys
+ * - Size limits: Configurable maximum JSON string size (default 10MB)
+ * - Schema validation: Optional Zod-compatible schema validation
+ * - NDJSON support: Parse newline-delimited JSON streams
+ * - Memory safety: Prevents memory exhaustion attacks
  */
 
 import type { JsonParseOptions, JsonParseResult, Schema } from './types'
 
 const { hasOwn: ObjectHasOwn } = Object
 
+/**
+ * Safely parse JSON with optional schema validation and security controls.
+ * Throws errors on parse failures, validation failures, or security violations.
+ *
+ * This is the recommended method for parsing untrusted JSON input as it provides
+ * multiple layers of security including prototype pollution protection and size limits.
+ *
+ * @template T - The expected type of the parsed data
+ * @param jsonString - The JSON string to parse
+ * @param schema - Optional Zod-compatible schema for validation
+ * @param options - Parsing options for security and behavior control
+ * @returns The parsed and validated data
+ *
+ * @throws {Error} When JSON string exceeds `maxSize`
+ * @throws {Error} When JSON parsing fails
+ * @throws {Error} When prototype pollution keys are detected (unless `allowPrototype` is `true`)
+ * @throws {Error} When schema validation fails
+ *
+ * @example
+ * ```ts
+ * // Basic parsing with type inference
+ * const data = safeJsonParse<User>('{"name":"Alice","age":30}')
+ *
+ * // With schema validation
+ * import { z } from 'zod'
+ * const userSchema = z.object({
+ *   name: z.string(),
+ *   age: z.number()
+ * })
+ * const user = safeJsonParse('{"name":"Alice","age":30}', userSchema)
+ *
+ * // With size limit
+ * const data = safeJsonParse(jsonString, undefined, {
+ *   maxSize: 1024 * 1024 // 1MB
+ * })
+ *
+ * // Allow prototype keys (dangerous - only for trusted sources)
+ * const data = safeJsonParse(jsonString, undefined, {
+ *   allowPrototype: true
+ * })
+ * ```
+ */
 export function safeJsonParse<T = unknown>(
   jsonString: string,
-  schema?: Schema<T>,
+  schema?: Schema<T> | undefined,
   options: JsonParseOptions = {},
 ): T {
   const { allowPrototype = false, maxSize = 10 * 1024 * 1024 } = options
@@ -64,10 +114,39 @@ export function safeJsonParse<T = unknown>(
   return parsed as T
 }
 
+/**
+ * Attempt to parse JSON, returning `undefined` on any error.
+ * This is a non-throwing wrapper around `safeJsonParse` for cases where
+ * you want to gracefully handle parse failures without try-catch blocks.
+ *
+ * Use this when parsing is optional or you have a fallback strategy.
+ * For critical parsing where you need error details, use `safeJsonParse` or `parseJsonWithResult`.
+ *
+ * @template T - The expected type of the parsed data
+ * @param jsonString - The JSON string to parse
+ * @param schema - Optional Zod-compatible schema for validation
+ * @param options - Parsing options for security and behavior control
+ * @returns The parsed data on success, or `undefined` on any error
+ *
+ * @example
+ * ```ts
+ * // Graceful fallback to default
+ * const config = tryJsonParse<Config>(jsonString) ?? defaultConfig
+ *
+ * // Optional parsing
+ * const data = tryJsonParse(possiblyInvalidJson)
+ * if (data) {
+ *   console.log('Parsed successfully:', data)
+ * }
+ *
+ * // With schema validation
+ * const user = tryJsonParse(jsonString, userSchema)
+ * ```
+ */
 export function tryJsonParse<T = unknown>(
   jsonString: string,
-  schema?: Schema<T>,
-  options?: JsonParseOptions,
+  schema?: Schema<T> | undefined,
+  options?: JsonParseOptions | undefined,
 ): T | undefined {
   try {
     return safeJsonParse(jsonString, schema, options)
@@ -76,10 +155,45 @@ export function tryJsonParse<T = unknown>(
   }
 }
 
+/**
+ * Parse JSON and return a discriminated union result.
+ * Never throws - always returns a result object with success/failure information.
+ *
+ * This is ideal when you need detailed error messages and type-safe result handling.
+ * The discriminated union allows TypeScript to narrow types based on the `success` flag.
+ *
+ * @template T - The expected type of the parsed data
+ * @param jsonString - The JSON string to parse
+ * @param schema - Optional Zod-compatible schema for validation
+ * @param options - Parsing options for security and behavior control
+ * @returns Result object with either `{success: true, data}` or `{success: false, error}`
+ *
+ * @example
+ * ```ts
+ * // Type-safe error handling
+ * const result = parseJsonWithResult<User>(jsonString, userSchema)
+ *
+ * if (result.success) {
+ *   // TypeScript knows result.data is available
+ *   console.log(`User: ${result.data.name}`)
+ * } else {
+ *   // TypeScript knows result.error is available
+ *   console.error(`Parse failed: ${result.error}`)
+ * }
+ *
+ * // Early return pattern
+ * const result = parseJsonWithResult(jsonString)
+ * if (!result.success) {
+ *   logger.error(result.error)
+ *   return
+ * }
+ * processData(result.data)
+ * ```
+ */
 export function parseJsonWithResult<T = unknown>(
   jsonString: string,
-  schema?: Schema<T>,
-  options?: JsonParseOptions,
+  schema?: Schema<T> | undefined,
+  options?: JsonParseOptions | undefined,
 ): JsonParseResult<T> {
   try {
     const data = safeJsonParse(jsonString, schema, options)
@@ -90,19 +204,85 @@ export function parseJsonWithResult<T = unknown>(
   }
 }
 
+/**
+ * Create a reusable JSON parser with pre-configured schema and options.
+ * Useful for parsing multiple JSON strings with the same validation rules.
+ *
+ * The returned parser function can accept per-call options that override the defaults.
+ * This factory pattern reduces repetition when parsing many similar JSON payloads.
+ *
+ * @template T - The expected type of the parsed data
+ * @param schema - Optional Zod-compatible schema for validation
+ * @param defaultOptions - Default parsing options applied to all parse calls
+ * @returns A parser function that accepts a JSON string and optional per-call options
+ *
+ * @example
+ * ```ts
+ * // Create a parser for API responses
+ * import { z } from 'zod'
+ * const apiResponseSchema = z.object({
+ *   status: z.string(),
+ *   data: z.unknown()
+ * })
+ *
+ * const parseApiResponse = createJsonParser(apiResponseSchema, {
+ *   maxSize: 5 * 1024 * 1024 // 5MB limit for API responses
+ * })
+ *
+ * // Use the parser multiple times
+ * const response1 = parseApiResponse(json1)
+ * const response2 = parseApiResponse(json2)
+ *
+ * // Override options for specific calls
+ * const response3 = parseApiResponse(json3, { maxSize: 10 * 1024 * 1024 })
+ * ```
+ */
 export function createJsonParser<T = unknown>(
-  schema?: Schema<T>,
-  defaultOptions?: JsonParseOptions,
+  schema?: Schema<T> | undefined,
+  defaultOptions?: JsonParseOptions | undefined,
 ) {
-  return (jsonString: string, options?: JsonParseOptions): T => {
+  return (jsonString: string, options?: JsonParseOptions | undefined): T => {
     return safeJsonParse(jsonString, schema, { ...defaultOptions, ...options })
   }
 }
 
+/**
+ * Parse newline-delimited JSON (NDJSON) into an array.
+ * Each line is treated as a separate JSON object. Empty lines are skipped.
+ *
+ * NDJSON format is commonly used for streaming logs, bulk data transfers,
+ * and event streams where each line represents a complete JSON document.
+ *
+ * @template T - The expected type of each parsed JSON object
+ * @param ndjson - Newline-delimited JSON string (supports both `\n` and `\r\n`)
+ * @param schema - Optional Zod-compatible schema for validation of each line
+ * @param options - Parsing options applied to each line
+ * @returns Array of parsed objects, one per non-empty line
+ *
+ * @throws {Error} When any line fails to parse (includes line number in error message)
+ *
+ * @example
+ * ```ts
+ * // Parse NDJSON logs
+ * const ndjsonString = `
+ * {"level":"info","message":"Server started"}
+ * {"level":"error","message":"Connection failed"}
+ * {"level":"info","message":"Retrying..."}
+ * `
+ * const logs = parseNdjson<LogEntry>(ndjsonString, logSchema)
+ * console.log(logs.length) // 3
+ *
+ * // Parse with size limits per line
+ * const entries = parseNdjson(ndjson, undefined, { maxSize: 1024 })
+ *
+ * // Empty lines are automatically skipped
+ * const data = parseNdjson('{"a":1}\n\n{"b":2}\n') // 2 objects
+ * ```
+ */
 export function parseNdjson<T = unknown>(
   ndjson: string,
-  schema?: Schema<T>,
-  options?: JsonParseOptions,
+  schema?: Schema<T> | undefined,
+  options?: JsonParseOptions | undefined,
 ): T[] {
   const results: T[] = []
   const lines = ndjson.split(/\r?\n/)
@@ -125,10 +305,49 @@ export function parseNdjson<T = unknown>(
   return results
 }
 
+/**
+ * Stream-parse newline-delimited JSON (NDJSON) using a generator.
+ * Yields one parsed object at a time, enabling memory-efficient processing of large NDJSON files.
+ *
+ * Unlike `parseNdjson` which loads all results into memory, this generator allows
+ * processing each line individually, making it ideal for large datasets or streaming scenarios.
+ *
+ * @template T - The expected type of each parsed JSON object
+ * @param ndjson - Newline-delimited JSON string (supports both `\n` and `\r\n`)
+ * @param schema - Optional Zod-compatible schema for validation of each line
+ * @param options - Parsing options applied to each line
+ * @yields Parsed objects one at a time as the generator iterates
+ *
+ * @throws {Error} When any line fails to parse (includes line number in error message)
+ *
+ * @example
+ * ```ts
+ * // Memory-efficient processing of large NDJSON files
+ * const ndjsonString = readLargeFile('logs.ndjson')
+ *
+ * for (const log of streamNdjson<LogEntry>(ndjsonString, logSchema)) {
+ *   if (log.level === 'error') {
+ *     console.error('Error found:', log.message)
+ *   }
+ * }
+ *
+ * // Collect filtered results without loading everything
+ * const errors = [...streamNdjson(ndjson)]
+ *   .filter(log => log.level === 'error')
+ *
+ * // Early termination when condition is met
+ * for (const entry of streamNdjson(ndjson)) {
+ *   if (entry.id === targetId) {
+ *     processEntry(entry)
+ *     break // Stop processing remaining lines
+ *   }
+ * }
+ * ```
+ */
 export function* streamNdjson<T = unknown>(
   ndjson: string,
-  schema?: Schema<T>,
-  options?: JsonParseOptions,
+  schema?: Schema<T> | undefined,
+  options?: JsonParseOptions | undefined,
 ): Generator<T, void, unknown> {
   const lines = ndjson.split(/\r?\n/)
 
diff --git a/src/validation/types.ts b/src/validation/types.ts
index 2956540..548c2f0 100644
--- a/src/validation/types.ts
+++ b/src/validation/types.ts
@@ -1,39 +1,144 @@
 /**
  * @fileoverview Validation type definitions.
+ * Provides core types for schema validation and JSON parsing with security features.
  */
 
 /**
- * Schema parse result.
+ * Result of a schema validation operation.
+ * Contains either successful parsed data or error information.
+ *
+ * @template T - The expected type of the parsed data
+ *
+ * @example
+ * ```ts
+ * const result: ParseResult<User> = schema.safeParse(data)
+ * if (result.success) {
+ *   console.log(result.data) // User object
+ * } else {
+ *   console.error(result.error) // Error details
+ * }
+ * ```
  */
 export interface ParseResult<T> {
+  /** Indicates whether parsing was successful */
   success: boolean
-  data?: T
-  // biome-ignore lint/suspicious/noExplicitAny: Error can be any schema validation error.
+  /** Parsed and validated data (only present when `success` is `true`) */
+  data?: T | undefined
+  /** Error information (only present when `success` is `false`) */
   error?: any
 }
 
 /**
- * Base schema interface.
+ * Base schema interface compatible with Zod and similar validation libraries.
+ * Provides both safe and throwing parsing methods.
+ *
+ * @template T - The expected output type after validation
+ *
+ * @example
+ * ```ts
+ * import { z } from 'zod'
+ *
+ * const userSchema = z.object({
+ *   name: z.string(),
+ *   age: z.number()
+ * })
+ *
+ * // Schema satisfies this interface
+ * const schema: Schema<User> = userSchema
+ * const result = schema.safeParse({ name: 'Alice', age: 30 })
+ * ```
  */
-// biome-ignore lint/suspicious/noExplicitAny: Schema interface accepts any input data for validation.
 export interface Schema<T = any> {
-  // biome-ignore lint/suspicious/noExplicitAny: Validation accepts any input data.
+  /**
+   * Safely parse data without throwing errors.
+   * Returns a result object indicating success or failure.
+   *
+   * @param data - The data to validate
+   * @returns Parse result with success flag and data or error
+   */
   safeParse(data: any): ParseResult<T>
-  // biome-ignore lint/suspicious/noExplicitAny: Validation accepts any input data.
+
+  /**
+   * Parse data and throw an error if validation fails.
+   * Use this when you want to fail fast on invalid data.
+   *
+   * @param data - The data to validate
+   * @returns The validated and parsed data
+   * @throws {Error} When validation fails
+   */
   parse(data: any): T
-  _name?: string
+
+  /**
+   * Optional schema name for debugging and error messages.
+   * Useful for identifying which schema failed in complex validation chains.
+   */
+  _name?: string | undefined
 }
 
 /**
- * JSON parse options.
+ * Options for configuring JSON parsing behavior with security controls.
+ *
+ * @example
+ * ```ts
+ * const options: JsonParseOptions = {
+ *   maxSize: 1024 * 1024, // 1MB limit
+ *   allowPrototype: false // Block prototype pollution
+ * }
+ * ```
  */
 export interface JsonParseOptions {
-  maxSize?: number
-  allowPrototype?: boolean
+  /**
+   * Allow dangerous prototype pollution keys (`__proto__`, `constructor`, `prototype`).
+   * Set to `true` only if you trust the JSON source completely.
+   *
+   * @default false
+   *
+   * @example
+   * ```ts
+   * // Will throw error by default
+   * safeJsonParse('{"__proto__": {"polluted": true}}')
+   *
+   * // Allows the parse (dangerous!)
+   * safeJsonParse('{"__proto__": {"polluted": true}}', undefined, {
+   *   allowPrototype: true
+   * })
+   * ```
+   */
+  allowPrototype?: boolean | undefined
+
+  /**
+   * Maximum allowed size of JSON string in bytes.
+   * Prevents memory exhaustion from extremely large payloads.
+   *
+   * @default 10_485_760 (10 MB)
+   *
+   * @example
+   * ```ts
+   * // Limit to 1KB
+   * safeJsonParse(jsonString, undefined, { maxSize: 1024 })
+   * ```
+   */
+  maxSize?: number | undefined
 }
 
 /**
- * JSON parse result.
+ * Discriminated union type for JSON parsing results.
+ * Enables type-safe handling of success and failure cases.
+ *
+ * @template T - The expected type of the parsed data
+ *
+ * @example
+ * ```ts
+ * const result: JsonParseResult<User> = parseJsonWithResult(jsonString)
+ *
+ * if (result.success) {
+ *   // TypeScript knows result.data is available
+ *   console.log(result.data.name)
+ * } else {
+ *   // TypeScript knows result.error is available
+ *   console.error(result.error)
+ * }
+ * ```
  */
 export type JsonParseResult<T> =
   | { success: true; data: T }
diff --git a/src/versions.ts b/src/versions.ts
index 8cd2dff..3f3cc4b 100644
--- a/src/versions.ts
+++ b/src/versions.ts
@@ -1,12 +1,20 @@
 /** @fileoverview Version comparison and validation utilities for Socket ecosystem. */
 
-import semver from './external/semver'
+let _semver: typeof import('semver') | undefined
+/*@__NO_SIDE_EFFECTS__*/
+function getSemver() {
+  if (_semver === undefined) {
+    // The 'semver' package is browser safe.
+    _semver = /*@__PURE__*/ require('./external/semver')
+  }
+  return _semver as typeof import('semver')
+}
 
 /**
  * Coerce a version string to valid semver format.
  */
 export function coerceVersion(version: string): string | undefined {
-  const coerced = semver.coerce(version)
+  const coerced = getSemver().coerce(version)
   return coerced?.version
 }
 
@@ -19,7 +27,7 @@ export function compareVersions(
   v2: string,
 ): -1 | 0 | 1 | undefined {
   try {
-    return semver.compare(v1, v2)
+    return getSemver().compare(v1, v2)
   } catch {
     return undefined
   }
@@ -29,14 +37,14 @@ export function compareVersions(
  * Get all versions from an array that satisfy a semver range.
  */
 export function filterVersions(versions: string[], range: string): string[] {
-  return versions.filter(v => semver.satisfies(v, range))
+  return versions.filter(v => getSemver().satisfies(v, range))
 }
 
 /**
  * Get the major version number from a version string.
  */
 export function getMajorVersion(version: string): number | undefined {
-  const parsed = semver.parse(version)
+  const parsed = getSemver().parse(version)
   return parsed?.major
 }
 
@@ -44,7 +52,7 @@ export function getMajorVersion(version: string): number | undefined {
  * Get the minor version number from a version string.
  */
 export function getMinorVersion(version: string): number | undefined {
-  const parsed = semver.parse(version)
+  const parsed = getSemver().parse(version)
   return parsed?.minor
 }
 
@@ -52,7 +60,7 @@ export function getMinorVersion(version: string): number | undefined {
  * Get the patch version number from a version string.
  */
 export function getPatchVersion(version: string): number | undefined {
-  const parsed = semver.parse(version)
+  const parsed = getSemver().parse(version)
   return parsed?.patch
 }
 
@@ -71,21 +79,21 @@ export function incrementVersion(
     | 'prerelease',
   identifier?: string | undefined,
 ): string | undefined {
-  return semver.inc(version, release, identifier) || undefined
+  return getSemver().inc(version, release, identifier) || undefined
 }
 
 /**
  * Check if version1 equals version2.
  */
 export function isEqual(version1: string, version2: string): boolean {
-  return semver.eq(version1, version2)
+  return getSemver().eq(version1, version2)
 }
 
 /**
  * Check if version1 is greater than version2.
  */
 export function isGreaterThan(version1: string, version2: string): boolean {
-  return semver.gt(version1, version2)
+  return getSemver().gt(version1, version2)
 }
 
 /**
@@ -95,42 +103,42 @@ export function isGreaterThanOrEqual(
   version1: string,
   version2: string,
 ): boolean {
-  return semver.gte(version1, version2)
+  return getSemver().gte(version1, version2)
 }
 
 /**
  * Check if version1 is less than version2.
  */
 export function isLessThan(version1: string, version2: string): boolean {
-  return semver.lt(version1, version2)
+  return getSemver().lt(version1, version2)
 }
 
 /**
  * Check if version1 is less than or equal to version2.
  */
 export function isLessThanOrEqual(version1: string, version2: string): boolean {
-  return semver.lte(version1, version2)
+  return getSemver().lte(version1, version2)
 }
 
 /**
  * Validate if a string is a valid semantic version.
  */
 export function isValidVersion(version: string): boolean {
-  return semver.valid(version) !== null
+  return getSemver().valid(version) !== null
 }
 
 /**
  * Get the highest version from an array of versions.
  */
 export function maxVersion(versions: string[]): string | undefined {
-  return semver.maxSatisfying(versions, '*') || undefined
+  return getSemver().maxSatisfying(versions, '*') || undefined
 }
 
 /**
  * Get the lowest version from an array of versions.
  */
 export function minVersion(versions: string[]): string | undefined {
-  return semver.minSatisfying(versions, '*') || undefined
+  return getSemver().minSatisfying(versions, '*') || undefined
 }
 
 /**
@@ -145,7 +153,7 @@ export function parseVersion(version: string):
       build: readonly string[]
     }
   | undefined {
-  const parsed = semver.parse(version)
+  const parsed = getSemver().parse(version)
   if (!parsed) {
     return undefined
   }
@@ -162,21 +170,21 @@ export function parseVersion(version: string):
  * Check if a version satisfies a semver range.
  */
 export function satisfiesVersion(version: string, range: string): boolean {
-  return semver.satisfies(version, range)
+  return getSemver().satisfies(version, range)
 }
 
 /**
  * Sort versions in ascending order.
  */
 export function sortVersions(versions: string[]): string[] {
-  return semver.sort([...versions])
+  return getSemver().sort([...versions])
 }
 
 /**
  * Sort versions in descending order.
  */
 export function sortVersionsDesc(versions: string[]): string[] {
-  return semver.rsort([...versions])
+  return getSemver().rsort([...versions])
 }
 
 /**
@@ -193,6 +201,11 @@ export function versionDiff(
   | 'patch'
   | 'prepatch'
   | 'prerelease'
+  | 'release'
   | undefined {
-  return semver.diff(version1, version2) || undefined
+  try {
+    return getSemver().diff(version1, version2) || undefined
+  } catch {
+    return undefined
+  }
 }
diff --git a/src/zod.ts b/src/zod.ts
index a8f4b12..943082e 100644
--- a/src/zod.ts
+++ b/src/zod.ts
@@ -3,4 +3,4 @@
  * Provides access to zod's schema builder through the z object.
  */
 
-export { z } from 'zod'
+export { z } from './external/zod'
diff --git a/taze.config.json b/taze.config.json
deleted file mode 100644
index 4458e59..0000000
--- a/taze.config.json
+++ /dev/null
@@ -1,5 +0,0 @@
-{
-  "$schema": "https://unpkg.com/taze@latest/schema.json",
-  "ignorePaths": [],
-  "exclude": ["vitest", "@vitest/coverage-v8", "@vitest/ui"]
-}
diff --git a/test/integration/fs.test.ts b/test/integration/fs.test.ts
new file mode 100644
index 0000000..5840fb6
--- /dev/null
+++ b/test/integration/fs.test.ts
@@ -0,0 +1,152 @@
+/**
+ * @fileoverview Integration tests for filesystem utilities.
+ *
+ * Tests real filesystem operations:
+ * - readJsonFile() / writeJsonFile() for JSON persistence
+ * - copyFile() / moveFile() for file operations
+ * - ensureDir() for directory creation
+ * - File existence checks and permissions
+ * Used by Socket CLI for config files, package.json manipulation, and cache.
+ */
+
+import fs from 'node:fs/promises'
+import os from 'node:os'
+import path from 'node:path'
+
+import {
+  readJson,
+  safeMkdir,
+  safeStats,
+  writeJson,
+} from '@socketsecurity/lib/fs'
+import { describe, expect, it } from 'vitest'
+import { runWithTempDir } from '../unit/utils/temp-file-helper.mjs'
+
+describe('fs integration', () => {
+  describe('JSON file operations', () => {
+    it('should write and read JSON file', async () => {
+      await runWithTempDir(async tmpDir => {
+        const filePath = path.join(tmpDir, 'test.json')
+        const data = { name: 'test', value: 42, nested: { foo: 'bar' } }
+
+        await writeJson(filePath, data)
+
+        const readData = await readJson(filePath)
+        expect(readData).toEqual(data)
+      }, 'fs-json-test-')
+    })
+
+    it('should handle writing complex JSON structures', async () => {
+      await runWithTempDir(async tmpDir => {
+        const filePath = path.join(tmpDir, 'complex.json')
+        const data = {
+          array: [1, 2, 3],
+          nested: {
+            deep: {
+              value: 'test',
+            },
+          },
+          nullValue: null,
+          boolValue: true,
+        }
+
+        await writeJson(filePath, data)
+        const readData = await readJson(filePath)
+        expect(readData).toEqual(data)
+      }, 'fs-complex-json-')
+    })
+
+    it('should create parent directories when writing JSON', async () => {
+      await runWithTempDir(async tmpDir => {
+        // Create parent directory first
+        const deepDir = path.join(tmpDir, 'deep', 'nested')
+        await safeMkdir(deepDir)
+
+        const filePath = path.join(deepDir, 'test.json')
+        const data = { test: 'value' }
+
+        await writeJson(filePath, data)
+
+        const readData = await readJson(filePath)
+        expect(readData).toEqual(data)
+
+        const dirStats = await safeStats(deepDir)
+        expect(dirStats).toBeDefined()
+        expect(dirStats?.isDirectory()).toBe(true)
+      }, 'fs-deep-json-')
+    })
+  })
+
+  describe('file operations', () => {
+    it('should copy file to new location', async () => {
+      await runWithTempDir(async tmpDir => {
+        const srcPath = path.join(tmpDir, 'source.txt')
+        const destPath = path.join(tmpDir, 'dest.txt')
+
+        await fs.writeFile(srcPath, 'test content', 'utf8')
+        await fs.copyFile(srcPath, destPath)
+
+        const content = await fs.readFile(destPath, 'utf8')
+        expect(content).toBe('test content')
+
+        // Source should still exist
+        const srcStats = await safeStats(srcPath)
+        expect(srcStats).toBeDefined()
+      }, 'fs-copy-test-')
+    })
+
+    it('should check file existence with safeStats', async () => {
+      await runWithTempDir(async tmpDir => {
+        const filePath = path.join(tmpDir, 'exists.txt')
+
+        let stats = await safeStats(filePath)
+        expect(stats).toBeUndefined()
+
+        await fs.writeFile(filePath, 'content', 'utf8')
+
+        stats = await safeStats(filePath)
+        expect(stats).toBeDefined()
+        expect(stats?.isFile()).toBe(true)
+      }, 'fs-exists-test-')
+    })
+  })
+
+  describe('directory operations', () => {
+    it('should create directory recursively', async () => {
+      await runWithTempDir(async tmpDir => {
+        const deepPath = path.join(tmpDir, 'level1', 'level2', 'level3')
+
+        await safeMkdir(deepPath)
+
+        const stats = await fs.stat(deepPath)
+        expect(stats.isDirectory()).toBe(true)
+      }, 'fs-ensuredir-test-')
+    })
+
+    it('should not fail when directory already exists', async () => {
+      await runWithTempDir(async tmpDir => {
+        const dirPath = path.join(tmpDir, 'existing')
+
+        await fs.mkdir(dirPath)
+        await safeMkdir(dirPath)
+
+        const stats = await fs.stat(dirPath)
+        expect(stats.isDirectory()).toBe(true)
+      }, 'fs-existing-dir-')
+    })
+
+    it('should handle temp directory operations', async () => {
+      const tmpDir = os.tmpdir()
+      const testDir = path.join(tmpDir, 'socket-test-integration')
+
+      await safeMkdir(testDir)
+
+      const stats = await safeStats(testDir)
+      expect(stats).toBeDefined()
+      expect(stats?.isDirectory()).toBe(true)
+
+      // Cleanup
+      await fs.rm(testDir, { recursive: true, force: true })
+    })
+  })
+})
diff --git a/test/integration/git.test.ts b/test/integration/git.test.ts
new file mode 100644
index 0000000..18718ea
--- /dev/null
+++ b/test/integration/git.test.ts
@@ -0,0 +1,109 @@
+/**
+ * @fileoverview Integration tests for git utilities.
+ *
+ * Tests real git operations in temporary repositories:
+ * - getGitRoot() finds repository root
+ * - isGitRepo() checks if directory is a git repo
+ * - getCurrentBranch() gets active branch name
+ * - getGitRemoteUrl() retrieves remote URL
+ * Used by Socket CLI for repository detection and git operations.
+ */
+
+import fs from 'node:fs/promises'
+import path from 'node:path'
+
+import { findGitRoot } from '@socketsecurity/lib/git'
+import { spawn } from '@socketsecurity/lib/spawn'
+import { describe, expect, it } from 'vitest'
+import { runWithTempDir } from '../unit/utils/temp-file-helper.mjs'
+
+describe('git integration', () => {
+  describe('repository detection', () => {
+    it('should find git root from current directory', () => {
+      // This test runs in socket-lib which is a git repo
+      const gitRoot = findGitRoot(process.cwd())
+      expect(gitRoot).toBeDefined()
+      expect(gitRoot).toContain('socket-lib')
+    })
+
+    it('should return original path for non-git directory', async () => {
+      await runWithTempDir(async tmpDir => {
+        // findGitRoot returns the original path if no .git found
+        const result = findGitRoot(tmpDir)
+        expect(result).toBe(tmpDir)
+      }, 'git-non-repo-')
+    })
+  })
+
+  describe('git repository operations', () => {
+    it('should initialize git repo and find root', async () => {
+      await runWithTempDir(async tmpDir => {
+        // Initialize git repo
+        await spawn('git', ['init'], { cwd: tmpDir })
+
+        const gitRoot = findGitRoot(tmpDir)
+        expect(gitRoot).toBe(tmpDir)
+      }, 'git-init-test-')
+    })
+
+    it('should get current branch name via spawn', async () => {
+      await runWithTempDir(async tmpDir => {
+        // Initialize git repo and create initial commit
+        await spawn('git', ['init'], { cwd: tmpDir })
+        await spawn('git', ['config', 'user.email', 'test@example.com'], {
+          cwd: tmpDir,
+        })
+        await spawn('git', ['config', 'user.name', 'Test User'], {
+          cwd: tmpDir,
+        })
+
+        // Create a file and commit
+        await fs.writeFile(path.join(tmpDir, 'test.txt'), 'content', 'utf8')
+        await spawn('git', ['add', '.'], { cwd: tmpDir })
+        await spawn('git', ['commit', '-m', 'Initial commit'], { cwd: tmpDir })
+
+        const result = await spawn('git', ['branch', '--show-current'], {
+          cwd: tmpDir,
+        })
+        expect(result.stdout.toString().trim()).toMatch(/^(main|master)$/)
+      }, 'git-branch-test-')
+    })
+
+    it('should get git remote URL via spawn', async () => {
+      await runWithTempDir(async tmpDir => {
+        // Initialize git repo
+        await spawn('git', ['init'], { cwd: tmpDir })
+
+        // Add remote
+        await spawn(
+          'git',
+          ['remote', 'add', 'origin', 'https://github.com/test/repo.git'],
+          { cwd: tmpDir },
+        )
+
+        const result = await spawn('git', ['remote', 'get-url', 'origin'], {
+          cwd: tmpDir,
+        })
+        expect(result.stdout.toString().trim()).toBe(
+          'https://github.com/test/repo.git',
+        )
+      }, 'git-remote-test-')
+    })
+  })
+
+  describe('nested repository detection', () => {
+    it('should find git root from nested directory', async () => {
+      await runWithTempDir(async tmpDir => {
+        // Initialize git repo
+        await spawn('git', ['init'], { cwd: tmpDir })
+
+        // Create nested directory
+        const nestedDir = path.join(tmpDir, 'nested', 'deep', 'directory')
+        await fs.mkdir(nestedDir, { recursive: true })
+
+        const gitRoot = findGitRoot(nestedDir)
+        expect(gitRoot).toBe(tmpDir)
+      }, 'git-nested-test-')
+    })
+  })
+})
diff --git a/test/integration/spawn.test.ts b/test/integration/spawn.test.ts
new file mode 100644
index 0000000..abed0bf
--- /dev/null
+++ b/test/integration/spawn.test.ts
@@ -0,0 +1,104 @@
+/**
+ * @fileoverview Integration tests for spawn process utilities.
+ *
+ * Tests real process spawning with actual commands:
+ * - spawn() executes commands and captures output
+ * - spawnSync() executes commands synchronously
+ * - Process exit codes, stdout, stderr handling
+ * - Environment variable passing
+ * - Working directory changes
+ * Used by Socket CLI for running npm, git, and other external commands.
+ */
+
+import { spawn, spawnSync } from '@socketsecurity/lib/spawn'
+import { describe, expect, it } from 'vitest'
+
+describe('spawn integration', () => {
+  describe('spawn', () => {
+    it('should execute echo command and capture output', async () => {
+      const result = await spawn('echo', ['hello world'])
+      expect(result.code).toBe(0)
+      expect(result.stdout.toString().trim()).toBe('hello world')
+      expect(result.stderr.toString()).toBe('')
+    })
+
+    it('should execute node command and capture output', async () => {
+      const result = await spawn('node', ['--version'])
+      expect(result.code).toBe(0)
+      expect(result.stdout.toString()).toMatch(/^v\d+\.\d+\.\d+/)
+      expect(result.stderr.toString()).toBe('')
+    })
+
+    it('should handle command failure with non-zero exit code', async () => {
+      // spawn throws on non-zero exit by default
+      try {
+        await spawn('node', ['--invalid-flag'])
+        expect.fail('Should have thrown')
+      } catch (error: any) {
+        expect(error.message).toContain('command failed')
+      }
+    })
+
+    it('should pass environment variables to spawned process', async () => {
+      const result = await spawn('node', ['-p', 'process.env.TEST_VAR'], {
+        env: {
+          ...process.env,
+          TEST_VAR: 'test-value',
+        },
+      })
+      expect(result.code).toBe(0)
+      expect(result.stdout.toString().trim()).toBe('test-value')
+    })
+
+    it('should execute command in specified working directory', async () => {
+      const result = await spawn('pwd', [], {
+        cwd: '/tmp',
+      })
+      expect(result.code).toBe(0)
+      // macOS uses /private/tmp symlink, Windows Git Bash uses /d/tmp or similar
+      expect(result.stdout.toString().trim()).toMatch(
+        /^(\/tmp|\/private\/tmp|\/[a-z]\/tmp)$/,
+      )
+    })
+
+    it('should handle command not found error', async () => {
+      try {
+        await spawn('nonexistent-command-xyz', [])
+      } catch (error) {
+        expect(error).toBeDefined()
+      }
+    })
+  })
+
+  describe('spawnSync', () => {
+    it('should execute echo command synchronously', () => {
+      const result = spawnSync('echo', ['hello sync'])
+      expect(result.status).toBe(0)
+      expect(result.stdout.toString().trim()).toBe('hello sync')
+      expect(result.stderr.toString()).toBe('')
+    })
+
+    it('should execute node command synchronously', () => {
+      const result = spawnSync('node', ['--version'])
+      expect(result.status).toBe(0)
+      expect(result.stdout.toString()).toMatch(/^v\d+\.\d+\.\d+/)
+    })
+
+    it('should handle sync command failure', () => {
+      const result = spawnSync('node', ['--invalid-flag'])
+      expect(result.status).not.toBe(0)
+      expect(result.stderr.toString()).toContain('invalid')
+    })
+
+    it('should pass environment to sync spawned process', () => {
+      const result = spawnSync('node', ['-p', 'process.env.SYNC_VAR'], {
+        env: {
+          ...process.env,
+          SYNC_VAR: 'sync-value',
+        },
+      })
+      expect(result.status).toBe(0)
+      expect(result.stdout.toString().trim()).toBe('sync-value')
+    })
+  })
+})
diff --git a/test/integration/spinner.test.ts b/test/integration/spinner.test.ts
new file mode 100644
index 0000000..fd857a3
--- /dev/null
+++ b/test/integration/spinner.test.ts
@@ -0,0 +1,206 @@
+/**
+ * @fileoverview Integration tests for spinner in real terminal environments.
+ *
+ * Tests spinner behavior with actual terminal output:
+ * - Spinner starts and stops correctly
+ * - Progress updates display properly
+ * - withSpinner() wraps async operations
+ * - CI environment detection disables spinners
+ * Used by Socket CLI for user-facing progress indicators.
+ */
+
+import { Spinner, withSpinner } from '@socketsecurity/lib/spinner'
+import { beforeEach, describe, expect, it, vi } from 'vitest'
+
+describe('spinner integration', () => {
+  // Mock stdout/stderr to prevent actual spinner output during tests
+  beforeEach(() => {
+    vi.spyOn(process.stdout, 'write').mockImplementation(() => true)
+    vi.spyOn(process.stderr, 'write').mockImplementation(() => true)
+  })
+
+  describe('real-world spinner workflows', () => {
+    it('should handle complete operation lifecycle', async () => {
+      const spinner = Spinner({ text: 'Starting operation...' })
+
+      spinner.start()
+      expect(spinner.isSpinning).toBe(true)
+
+      // Simulate multi-step operation
+      spinner.text('Step 1: Initializing')
+      await new Promise(resolve => setTimeout(resolve, 10))
+
+      spinner.text('Step 2: Processing')
+      await new Promise(resolve => setTimeout(resolve, 10))
+
+      spinner.text('Step 3: Finalizing')
+      await new Promise(resolve => setTimeout(resolve, 10))
+
+      spinner.successAndStop('Operation completed!')
+      expect(spinner.isSpinning).toBe(false)
+    })
+
+    it('should show progress updates during operation', async () => {
+      const spinner = Spinner()
+      spinner.start('Processing files...')
+
+      const totalFiles = 10
+      for (let i = 0; i <= totalFiles; i++) {
+        spinner.progress(i, totalFiles, 'files')
+        await new Promise(resolve => setTimeout(resolve, 5))
+      }
+
+      spinner.doneAndStop('All files processed')
+      expect(spinner.isSpinning).toBe(false)
+    })
+
+    it('should handle nested status updates', async () => {
+      const spinner = Spinner()
+      spinner.start('Main operation')
+
+      spinner.step('Step 1')
+      spinner.substep('Substep 1.1')
+      await new Promise(resolve => setTimeout(resolve, 10))
+
+      spinner.substep('Substep 1.2')
+      await new Promise(resolve => setTimeout(resolve, 10))
+
+      spinner.step('Step 2')
+      spinner.substep('Substep 2.1')
+      await new Promise(resolve => setTimeout(resolve, 10))
+
+      spinner.successAndStop('Operation complete')
+      expect(spinner.isSpinning).toBe(false)
+    })
+  })
+
+  describe('withSpinner integration', () => {
+    it('should wrap async file operation', async () => {
+      let operationCompleted = false
+
+      const result = await withSpinner({
+        message: 'Reading file...',
+        operation: async () => {
+          await new Promise(resolve => setTimeout(resolve, 20))
+          operationCompleted = true
+          return 'file-content'
+        },
+      })
+
+      expect(operationCompleted).toBe(true)
+      expect(result).toBe('file-content')
+    })
+
+    it('should wrap async network operation', async () => {
+      const result = await withSpinner({
+        message: 'Fetching data...',
+        operation: async () => {
+          await new Promise(resolve => setTimeout(resolve, 20))
+          return { status: 'success', data: [1, 2, 3] }
+        },
+      })
+
+      expect(result).toEqual({ status: 'success', data: [1, 2, 3] })
+    })
+
+    it('should handle operation errors gracefully', async () => {
+      await expect(
+        withSpinner({
+          message: 'Running operation...',
+          operation: async () => {
+            await new Promise(resolve => setTimeout(resolve, 10))
+            throw new Error('Operation failed')
+          },
+        }),
+      ).rejects.toThrow('Operation failed')
+    })
+
+    it('should work with shimmer effects', async () => {
+      const result = await withSpinner({
+        message: 'Processing with shimmer...',
+        operation: async () => {
+          await new Promise(resolve => setTimeout(resolve, 20))
+          return 'done'
+        },
+        withOptions: {
+          shimmer: { dir: 'ltr', speed: 1 },
+        },
+      })
+
+      expect(result).toBe('done')
+    })
+
+    it('should work with color changes', async () => {
+      const result = await withSpinner({
+        message: 'Processing with color...',
+        operation: async () => {
+          await new Promise(resolve => setTimeout(resolve, 20))
+          return 'complete'
+        },
+        withOptions: {
+          color: [255, 165, 0], // Orange
+        },
+      })
+
+      expect(result).toBe('complete')
+    })
+  })
+
+  describe('error handling workflows', () => {
+    it('should show error and continue on non-fatal error', async () => {
+      const spinner = Spinner()
+      spinner.start('Running checks...')
+
+      try {
+        // Simulate operation that can fail
+        throw new Error('Check failed')
+      } catch (error) {
+        spinner.error(`Error: ${(error as Error).message}`)
+        // Continue with other operations
+      }
+
+      spinner.text('Continuing with other checks...')
+      await new Promise(resolve => setTimeout(resolve, 10))
+
+      spinner.successAndStop('Checks completed with warnings')
+      expect(spinner.isSpinning).toBe(false)
+    })
+
+    it('should stop spinner on fatal error', async () => {
+      const spinner = Spinner()
+      spinner.start('Critical operation...')
+
+      await new Promise(resolve => setTimeout(resolve, 10))
+
+      spinner.failAndStop('Critical failure - operation aborted')
+      expect(spinner.isSpinning).toBe(false)
+    })
+  })
+
+  describe('indentation workflows', () => {
+    it('should handle hierarchical output', async () => {
+      const spinner = Spinner()
+      spinner.start('Root operation')
+
+      spinner.step('Level 1 task')
+      spinner.indent()
+
+      spinner.step('Level 2 task')
+      spinner.indent()
+
+      spinner.step('Level 3 task')
+      await new Promise(resolve => setTimeout(resolve, 10))
+
+      spinner.dedent()
+      spinner.step('Back to level 2')
+
+      spinner.dedent()
+      spinner.step('Back to level 1')
+
+      spinner.dedent()
+      spinner.successAndStop('All levels completed')
+
+      expect(spinner.isSpinning).toBe(false)
+    })
+  })
+})
diff --git a/test/integration/stdio/mask.test.ts b/test/integration/stdio/mask.test.ts
new file mode 100644
index 0000000..ed826d0
--- /dev/null
+++ b/test/integration/stdio/mask.test.ts
@@ -0,0 +1,582 @@
+/**
+ * @fileoverview Unit tests for stdio output masking utilities.
+ *
+ * Tests CLI output masking for hiding/showing command output during execution:
+ * - createOutputMask() creates mask objects with spinner and buffer control
+ * - isSpinning flag indicates whether output should be masked (spinner active)
+ * - verbose/showOutput modes to control visibility of underlying command output
+ * - outputBuffer stores captured output for later replay
+ * - stdoutCapture/stderrCapture track stream data during masking
+ * Used by CLI tools to show spinners during long operations then replay output on errors.
+ * NOT related to password masking - this is for CLI output visibility control.
+ */
+
+import {
+  createOutputMask,
+  type OutputMaskOptions,
+  type OutputMask,
+} from '@socketsecurity/lib/stdio/mask'
+import { describe, expect, it } from 'vitest'
+
+describe('stdio/mask', () => {
+  describe('createOutputMask', () => {
+    it('should create mask with default options', () => {
+      const mask = createOutputMask()
+      expect(mask).toBeDefined()
+      expect(mask.isSpinning).toBe(true)
+      expect(mask.outputBuffer).toEqual([])
+      expect(mask.verbose).toBe(false)
+      expect(mask.stdoutCapture).toBe('')
+      expect(mask.stderrCapture).toBe('')
+    })
+
+    it('should create mask with showOutput true', () => {
+      const mask = createOutputMask({ showOutput: true })
+      expect(mask.isSpinning).toBe(false)
+      expect(mask.verbose).toBe(true)
+      expect(mask.outputBuffer).toEqual([])
+    })
+
+    it('should create mask with showOutput false', () => {
+      const mask = createOutputMask({ showOutput: false })
+      expect(mask.isSpinning).toBe(true)
+      expect(mask.verbose).toBe(false)
+    })
+
+    it('should initialize empty output buffer', () => {
+      const mask = createOutputMask()
+      expect(Array.isArray(mask.outputBuffer)).toBe(true)
+      expect(mask.outputBuffer.length).toBe(0)
+    })
+
+    it('should initialize empty capture strings', () => {
+      const mask = createOutputMask()
+      expect(mask.stdoutCapture).toBe('')
+      expect(mask.stderrCapture).toBe('')
+    })
+
+    it('should handle empty options object', () => {
+      const mask = createOutputMask({})
+      expect(mask).toBeDefined()
+      expect(mask.verbose).toBe(false)
+    })
+
+    it('should handle options with custom message', () => {
+      const options: OutputMaskOptions = {
+        message: 'Custom progress message',
+        showOutput: false,
+      }
+      const mask = createOutputMask(options)
+      expect(mask).toBeDefined()
+      expect(mask.isSpinning).toBe(true)
+    })
+
+    it('should handle options with toggle text', () => {
+      const options: OutputMaskOptions = {
+        toggleText: 'custom toggle text',
+      }
+      const mask = createOutputMask(options)
+      expect(mask).toBeDefined()
+    })
+
+    it('should handle options with filter function', () => {
+      const filterFn = (text: string, _stream: 'stdout' | 'stderr') => {
+        return !text.includes('ignore')
+      }
+      const options: OutputMaskOptions = {
+        filterOutput: filterFn,
+      }
+      const mask = createOutputMask(options)
+      expect(mask).toBeDefined()
+    })
+
+    it('should handle options with override exit code function', () => {
+      const overrideFn = (code: number, _stdout: string, stderr: string) => {
+        if (code !== 0 && stderr.includes('non-fatal')) {
+          return 0
+        }
+        return undefined
+      }
+      const options: OutputMaskOptions = {
+        overrideExitCode: overrideFn,
+      }
+      const mask = createOutputMask(options)
+      expect(mask).toBeDefined()
+    })
+
+    it('should handle options with cwd', () => {
+      const options: OutputMaskOptions = {
+        cwd: '/custom/path',
+      }
+      const mask = createOutputMask(options)
+      expect(mask).toBeDefined()
+    })
+
+    it('should handle options with env', () => {
+      const options: OutputMaskOptions = {
+        env: { NODE_ENV: 'test', CUSTOM: 'value' },
+      }
+      const mask = createOutputMask(options)
+      expect(mask).toBeDefined()
+    })
+
+    it('should handle all options combined', () => {
+      const options: OutputMaskOptions = {
+        cwd: '/test',
+        env: { TEST: '1' },
+        filterOutput: text => !text.includes('skip'),
+        message: 'Testing...',
+        overrideExitCode: code => (code === 1 ? 0 : undefined),
+        showOutput: true,
+        toggleText: 'to toggle',
+      }
+      const mask = createOutputMask(options)
+      expect(mask).toBeDefined()
+      expect(mask.verbose).toBe(true)
+      expect(mask.isSpinning).toBe(false)
+    })
+  })
+
+  describe('OutputMask type', () => {
+    it('should create valid OutputMask object', () => {
+      const mask: OutputMask = {
+        isSpinning: false,
+        outputBuffer: ['line1', 'line2'],
+        stderrCapture: 'stderr content',
+        stdoutCapture: 'stdout content',
+        verbose: true,
+      }
+      expect(mask.isSpinning).toBe(false)
+      expect(mask.outputBuffer).toHaveLength(2)
+      expect(mask.stderrCapture).toBe('stderr content')
+      expect(mask.stdoutCapture).toBe('stdout content')
+      expect(mask.verbose).toBe(true)
+    })
+
+    it('should allow empty output buffer', () => {
+      const mask: OutputMask = {
+        isSpinning: true,
+        outputBuffer: [],
+        stderrCapture: '',
+        stdoutCapture: '',
+        verbose: false,
+      }
+      expect(mask.outputBuffer).toEqual([])
+    })
+
+    it('should allow large output buffer', () => {
+      const largeBuffer = Array.from({ length: 1000 }, (_, i) => `line ${i}`)
+      const mask: OutputMask = {
+        isSpinning: false,
+        outputBuffer: largeBuffer,
+        stderrCapture: '',
+        stdoutCapture: '',
+        verbose: true,
+      }
+      expect(mask.outputBuffer).toHaveLength(1000)
+    })
+  })
+
+  describe('OutputMaskOptions type', () => {
+    it('should accept minimal options', () => {
+      const options: OutputMaskOptions = {}
+      expect(options).toBeDefined()
+    })
+
+    it('should accept filter function with correct signature', () => {
+      const options: OutputMaskOptions = {
+        filterOutput: (text: string, stream: 'stdout' | 'stderr'): boolean => {
+          return text.length > 0 && stream === 'stdout'
+        },
+      }
+      expect(options.filterOutput).toBeDefined()
+      if (options.filterOutput) {
+        expect(options.filterOutput('test', 'stdout')).toBe(true)
+        expect(options.filterOutput('test', 'stderr')).toBe(false)
+      }
+    })
+
+    it('should accept override exit code function', () => {
+      const options: OutputMaskOptions = {
+        overrideExitCode: (
+          code: number,
+          _stdout: string,
+          stderr: string,
+        ): number | undefined => {
+          if (code === 1 && stderr.includes('warning')) {
+            return 0
+          }
+          return undefined
+        },
+      }
+      expect(options.overrideExitCode).toBeDefined()
+      if (options.overrideExitCode) {
+        expect(options.overrideExitCode(1, '', 'warning: test')).toBe(0)
+        expect(options.overrideExitCode(1, '', 'error')).toBeUndefined()
+      }
+    })
+  })
+
+  describe('edge cases', () => {
+    it('should handle undefined options', () => {
+      const mask = createOutputMask(undefined)
+      expect(mask).toBeDefined()
+      expect(mask.verbose).toBe(false)
+    })
+
+    it('should handle partial options', () => {
+      const mask = createOutputMask({ message: 'Loading...' })
+      expect(mask).toBeDefined()
+      expect(mask.isSpinning).toBe(true)
+    })
+  })
+
+  describe('output buffer behavior', () => {
+    it('should start with empty output buffer', () => {
+      const mask = createOutputMask()
+      expect(mask.outputBuffer).toEqual([])
+    })
+
+    it('should allow modification of output buffer', () => {
+      const mask = createOutputMask()
+      mask.outputBuffer.push('line 1')
+      mask.outputBuffer.push('line 2')
+      expect(mask.outputBuffer).toHaveLength(2)
+      expect(mask.outputBuffer[0]).toBe('line 1')
+      expect(mask.outputBuffer[1]).toBe('line 2')
+    })
+
+    it('should allow clearing output buffer', () => {
+      const mask = createOutputMask()
+      mask.outputBuffer.push('test')
+      expect(mask.outputBuffer).toHaveLength(1)
+      mask.outputBuffer = []
+      expect(mask.outputBuffer).toEqual([])
+    })
+  })
+
+  describe('capture fields', () => {
+    it('should start with empty captures', () => {
+      const mask = createOutputMask()
+      expect(mask.stdoutCapture).toBe('')
+      expect(mask.stderrCapture).toBe('')
+    })
+
+    it('should allow appending to stdout capture', () => {
+      const mask = createOutputMask()
+      mask.stdoutCapture += 'stdout line 1\n'
+      mask.stdoutCapture += 'stdout line 2\n'
+      expect(mask.stdoutCapture).toContain('stdout line 1')
+      expect(mask.stdoutCapture).toContain('stdout line 2')
+    })
+
+    it('should allow appending to stderr capture', () => {
+      const mask = createOutputMask()
+      mask.stderrCapture += 'stderr line 1\n'
+      mask.stderrCapture += 'stderr line 2\n'
+      expect(mask.stderrCapture).toContain('stderr line 1')
+      expect(mask.stderrCapture).toContain('stderr line 2')
+    })
+
+    it('should handle large captures', () => {
+      const mask = createOutputMask()
+      const largeString = 'x'.repeat(10_000)
+      mask.stdoutCapture = largeString
+      expect(mask.stdoutCapture.length).toBe(10_000)
+    })
+
+    it('should handle unicode in captures', () => {
+      const mask = createOutputMask()
+      mask.stdoutCapture = '你好世界 🎉'
+      mask.stderrCapture = 'Hëllø Wörld'
+      expect(mask.stdoutCapture).toContain('你好世界')
+      expect(mask.stdoutCapture).toContain('🎉')
+      expect(mask.stderrCapture).toContain('Hëllø')
+    })
+  })
+
+  describe('spinner state', () => {
+    it('should start with isSpinning true by default', () => {
+      const mask = createOutputMask()
+      expect(mask.isSpinning).toBe(true)
+    })
+
+    it('should start with isSpinning false when showOutput is true', () => {
+      const mask = createOutputMask({ showOutput: true })
+      expect(mask.isSpinning).toBe(false)
+    })
+
+    it('should allow toggling isSpinning', () => {
+      const mask = createOutputMask()
+      expect(mask.isSpinning).toBe(true)
+      mask.isSpinning = false
+      expect(mask.isSpinning).toBe(false)
+      mask.isSpinning = true
+      expect(mask.isSpinning).toBe(true)
+    })
+  })
+
+  describe('verbose mode', () => {
+    it('should start with verbose false by default', () => {
+      const mask = createOutputMask()
+      expect(mask.verbose).toBe(false)
+    })
+
+    it('should start with verbose true when showOutput is true', () => {
+      const mask = createOutputMask({ showOutput: true })
+      expect(mask.verbose).toBe(true)
+    })
+
+    it('should allow toggling verbose', () => {
+      const mask = createOutputMask()
+      expect(mask.verbose).toBe(false)
+      mask.verbose = true
+      expect(mask.verbose).toBe(true)
+      mask.verbose = false
+      expect(mask.verbose).toBe(false)
+    })
+
+    it('should sync isSpinning and verbose states', () => {
+      const mask = createOutputMask({ showOutput: false })
+      expect(mask.isSpinning).toBe(true)
+      expect(mask.verbose).toBe(false)
+
+      const mask2 = createOutputMask({ showOutput: true })
+      expect(mask2.isSpinning).toBe(false)
+      expect(mask2.verbose).toBe(true)
+    })
+  })
+
+  describe('filter function', () => {
+    it('should accept filter that filters stdout', () => {
+      const filter = (text: string, stream: 'stdout' | 'stderr') => {
+        return stream === 'stdout' && !text.includes('skip')
+      }
+      const mask = createOutputMask({ filterOutput: filter })
+      expect(mask).toBeDefined()
+    })
+
+    it('should accept filter that filters stderr', () => {
+      const filter = (text: string, stream: 'stdout' | 'stderr') => {
+        return stream === 'stderr' || !text.includes('ignore')
+      }
+      const mask = createOutputMask({ filterOutput: filter })
+      expect(mask).toBeDefined()
+    })
+
+    it('should accept filter based on content', () => {
+      const filter = (text: string) => {
+        return !text.includes('warning') && !text.includes('deprecated')
+      }
+      const mask = createOutputMask({ filterOutput: filter })
+      expect(mask).toBeDefined()
+    })
+
+    it('should accept filter with complex logic', () => {
+      const filter = (text: string, stream: 'stdout' | 'stderr') => {
+        if (stream === 'stderr' && text.includes('FATAL')) {
+          return true
+        }
+        if (text.includes('debug')) {
+          return false
+        }
+        if (text.length === 0) {
+          return false
+        }
+        return true
+      }
+      const mask = createOutputMask({ filterOutput: filter })
+      expect(mask).toBeDefined()
+    })
+  })
+
+  describe('override exit code function', () => {
+    it('should accept function that returns undefined', () => {
+      const override = () => undefined
+      const mask = createOutputMask({ overrideExitCode: override })
+      expect(mask).toBeDefined()
+    })
+
+    it('should accept function that returns number', () => {
+      const override = (code: number) => {
+        return code === 1 ? 0 : code
+      }
+      const mask = createOutputMask({ overrideExitCode: override })
+      expect(mask).toBeDefined()
+    })
+
+    it('should accept function that checks stdout', () => {
+      const override = (_code: number, stdout: string) => {
+        return stdout.includes('success') ? 0 : undefined
+      }
+      const mask = createOutputMask({ overrideExitCode: override })
+      expect(mask).toBeDefined()
+    })
+
+    it('should accept function that checks stderr', () => {
+      const override = (code: number, _stdout: string, stderr: string) => {
+        if (code !== 0 && stderr.includes('non-fatal')) {
+          return 0
+        }
+        return undefined
+      }
+      const mask = createOutputMask({ overrideExitCode: override })
+      expect(mask).toBeDefined()
+    })
+
+    it('should accept function with complex logic', () => {
+      const override = (code: number, stdout: string, stderr: string) => {
+        const output = stdout + stderr
+        if (code === 1 && output.includes('ECONNREFUSED')) {
+          return 2
+        }
+        if (code === 0 && output.includes('FAIL')) {
+          return 1
+        }
+        return undefined
+      }
+      const mask = createOutputMask({ overrideExitCode: override })
+      expect(mask).toBeDefined()
+    })
+  })
+
+  describe('spawn options', () => {
+    it('should accept cwd option', () => {
+      const mask = createOutputMask({ cwd: '/tmp' })
+      expect(mask).toBeDefined()
+    })
+
+    it('should accept env option with single variable', () => {
+      const mask = createOutputMask({ env: { NODE_ENV: 'test' } })
+      expect(mask).toBeDefined()
+    })
+
+    it('should accept env option with multiple variables', () => {
+      const mask = createOutputMask({
+        env: {
+          NODE_ENV: 'test',
+          DEBUG: '*',
+          PORT: '3000',
+        },
+      })
+      expect(mask).toBeDefined()
+    })
+
+    it('should accept empty env object', () => {
+      const mask = createOutputMask({ env: {} })
+      expect(mask).toBeDefined()
+    })
+
+    it('should accept relative cwd', () => {
+      const mask = createOutputMask({ cwd: './test' })
+      expect(mask).toBeDefined()
+    })
+
+    it('should accept absolute cwd', () => {
+      const mask = createOutputMask({ cwd: '/absolute/path/to/dir' })
+      expect(mask).toBeDefined()
+    })
+  })
+
+  describe('message and toggle text', () => {
+    it('should accept custom message', () => {
+      const mask = createOutputMask({ message: 'Installing packages...' })
+      expect(mask).toBeDefined()
+    })
+
+    it('should accept custom toggle text', () => {
+      const mask = createOutputMask({ toggleText: 'for logs' })
+      expect(mask).toBeDefined()
+    })
+
+    it('should accept both message and toggle text', () => {
+      const mask = createOutputMask({
+        message: 'Building project',
+        toggleText: 'to see compilation output',
+      })
+      expect(mask).toBeDefined()
+    })
+
+    it('should accept empty strings', () => {
+      const mask = createOutputMask({
+        message: '',
+        toggleText: '',
+      })
+      expect(mask).toBeDefined()
+    })
+
+    it('should accept long strings', () => {
+      const longMessage = 'x'.repeat(200)
+      const mask = createOutputMask({ message: longMessage })
+      expect(mask).toBeDefined()
+    })
+  })
+
+  describe('type validation', () => {
+    it('should create mask with all properties defined', () => {
+      const mask = createOutputMask()
+      expect(mask).toHaveProperty('isSpinning')
+      expect(mask).toHaveProperty('outputBuffer')
+      expect(mask).toHaveProperty('verbose')
+      expect(mask).toHaveProperty('stdoutCapture')
+      expect(mask).toHaveProperty('stderrCapture')
+    })
+
+    it('should have correct property types', () => {
+      const mask = createOutputMask()
+      expect(typeof mask.isSpinning).toBe('boolean')
+      expect(Array.isArray(mask.outputBuffer)).toBe(true)
+      expect(typeof mask.verbose).toBe('boolean')
+      expect(typeof mask.stdoutCapture).toBe('string')
+      expect(typeof mask.stderrCapture).toBe('string')
+    })
+
+    it('should not have extra properties', () => {
+      const mask = createOutputMask()
+      const keys = Object.keys(mask)
+      expect(keys).toHaveLength(5)
+      expect(keys).toContain('isSpinning')
+      expect(keys).toContain('outputBuffer')
+      expect(keys).toContain('verbose')
+      expect(keys).toContain('stdoutCapture')
+      expect(keys).toContain('stderrCapture')
+    })
+  })
+
+  describe('option combinations', () => {
+    it('should handle message with showOutput', () => {
+      const mask = createOutputMask({
+        message: 'Test message',
+        showOutput: true,
+      })
+      expect(mask.verbose).toBe(true)
+      expect(mask.isSpinning).toBe(false)
+    })
+
+    it('should handle filter with showOutput', () => {
+      const mask = createOutputMask({
+        filterOutput: text => !text.includes('skip'),
+        showOutput: false,
+      })
+      expect(mask.isSpinning).toBe(true)
+    })
+
+    it('should handle override with env', () => {
+      const mask = createOutputMask({
+        overrideExitCode: code => (code === 1 ? 0 : undefined),
+        env: { TEST: '1' },
+      })
+      expect(mask).toBeDefined()
+    })
+
+    it('should handle all boolean combinations', () => {
+      const mask1 = createOutputMask({ showOutput: false })
+      expect(mask1.isSpinning).toBe(true)
+      expect(mask1.verbose).toBe(false)
+
+      const mask2 = createOutputMask({ showOutput: true })
+      expect(mask2.isSpinning).toBe(false)
+      expect(mask2.verbose).toBe(true)
+    })
+  })
+})
diff --git a/test/isolated/logger.test.ts b/test/isolated/logger.test.ts
new file mode 100644
index 0000000..e44fe03
--- /dev/null
+++ b/test/isolated/logger.test.ts
@@ -0,0 +1,1185 @@
+/**
+ * @fileoverview Comprehensive isolated tests for logger module with 99%+ coverage.
+ *
+ * Tests Logger class in isolation with full coverage:
+ * - All logging levels (log, info, warn, error, debug, success, fail)
+ * - LOG_SYMBOLS constants and lazy initialization
+ * - Stream handling (stdout/stderr), indentation, method chaining
+ * - Task management, assertions, object inspection
+ * - Theme integration and color support
+ * - Internal state tracking (logCallCount, lastWasBlank)
+ * Uses custom Writable streams to capture output without console pollution.
+ */
+import { Writable } from 'node:stream'
+import { afterEach, beforeEach, describe, expect, it, vi } from 'vitest'
+import {
+  LOG_SYMBOLS,
+  Logger,
+  incLogCallCountSymbol,
+  lastWasBlankSymbol,
+} from '@socketsecurity/lib/logger'
+import { setTheme, THEMES } from '@socketsecurity/lib/themes'
+
+describe('LOG_SYMBOLS', () => {
+  it('should lazily initialize symbols', () => {
+    expect(LOG_SYMBOLS).toBeDefined()
+    expect(LOG_SYMBOLS.success).toContain('')
+    expect(LOG_SYMBOLS.fail).toContain('')
+    expect(LOG_SYMBOLS.warn).toContain('')
+    expect(LOG_SYMBOLS.info).toContain('')
+    expect(LOG_SYMBOLS.step).toContain('')
+  })
+
+  it('should provide colored symbols', () => {
+    // Access all symbols to ensure lazy initialization
+    const { fail, info, step, success, warn } = LOG_SYMBOLS
+    expect(success).toBeTruthy()
+    expect(fail).toBeTruthy()
+    expect(warn).toBeTruthy()
+    expect(info).toBeTruthy()
+    expect(step).toBeTruthy()
+  })
+
+  it('should update symbols when theme changes', () => {
+    // Initialize symbols with default theme
+    const initialSuccess = LOG_SYMBOLS.success
+    expect(initialSuccess).toBeTruthy()
+
+    // Change theme
+    setTheme(THEMES.sunset)
+
+    // Symbols should update
+    const updatedSuccess = LOG_SYMBOLS.success
+    expect(updatedSuccess).toBeTruthy()
+
+    // Reset to default theme for other tests
+    setTheme(THEMES.socket)
+  })
+
+  it('should be accessible via Logger.LOG_SYMBOLS', () => {
+    expect(Logger.LOG_SYMBOLS).toBe(LOG_SYMBOLS)
+  })
+})
+
+describe('Logger', () => {
+  let testLogger: Logger
+  let stdoutChunks: string[]
+  let stderrChunks: string[]
+  let mockStdout: Writable
+  let mockStderr: Writable
+
+  beforeEach(() => {
+    stdoutChunks = []
+    stderrChunks = []
+
+    mockStdout = new Writable({
+      write(chunk: any, _encoding: any, callback: any) {
+        stdoutChunks.push(chunk.toString())
+        callback()
+      },
+    })
+    ;(mockStdout as any).isTTY = false
+
+    mockStderr = new Writable({
+      write(chunk: any, _encoding: any, callback: any) {
+        stderrChunks.push(chunk.toString())
+        callback()
+      },
+    })
+    ;(mockStderr as any).isTTY = false
+
+    testLogger = new Logger({ stdout: mockStdout, stderr: mockStderr })
+  })
+
+  afterEach(() => {
+    stdoutChunks = []
+    stderrChunks = []
+  })
+
+  describe('constructor', () => {
+    it('should create a logger with default streams when no args provided', () => {
+      const defaultLogger = new Logger()
+      expect(defaultLogger).toBeInstanceOf(Logger)
+    })
+
+    it('should create a logger with custom streams', () => {
+      expect(testLogger).toBeInstanceOf(Logger)
+    })
+
+    it('should store options from constructor', () => {
+      const customOptions = { stdout: mockStdout, stderr: mockStderr }
+      const customLogger = new Logger(customOptions)
+      expect(customLogger).toBeInstanceOf(Logger)
+    })
+  })
+
+  describe('log() method', () => {
+    it('should log a message to stdout', () => {
+      testLogger.log('test message')
+      expect(stdoutChunks.join('')).toContain('test message')
+    })
+
+    it('should support multiple arguments', () => {
+      testLogger.log('message', 123, { key: 'value' })
+      const output = stdoutChunks.join('')
+      expect(output).toContain('message')
+    })
+
+    it('should return logger instance for chaining', () => {
+      const result = testLogger.log('test')
+      expect(result).toBe(testLogger)
+    })
+
+    it('should track log call count', () => {
+      const initialCount = testLogger.logCallCount
+      testLogger.log('test')
+      expect(testLogger.logCallCount).toBe(initialCount + 1)
+    })
+
+    it('should handle non-string arguments', () => {
+      testLogger.log(123)
+      testLogger.log({ key: 'value' })
+      testLogger.log(null)
+      testLogger.log(undefined)
+      expect(stdoutChunks.length).toBeGreaterThan(0)
+    })
+  })
+
+  describe('error() method', () => {
+    it('should log error to stderr', () => {
+      testLogger.error('error message')
+      expect(stderrChunks.join('')).toContain('error message')
+    })
+
+    it('should support multiple arguments', () => {
+      testLogger.error('error', 500, { code: 'ERR' })
+      const output = stderrChunks.join('')
+      expect(output).toContain('error')
+    })
+
+    it('should return logger instance for chaining', () => {
+      const result = testLogger.error('error')
+      expect(result).toBe(testLogger)
+    })
+  })
+
+  describe('success() method', () => {
+    it('should log success message with symbol', () => {
+      testLogger.success('operation succeeded')
+      const output = stderrChunks.join('')
+      expect(output).toContain('operation succeeded')
+    })
+
+    it('should strip existing symbols from message', () => {
+      testLogger.success('✔ already has symbol')
+      const output = stderrChunks.join('')
+      expect(output).toContain('already has symbol')
+    })
+
+    it('should handle non-string arguments', () => {
+      testLogger.success()
+      testLogger.success(123)
+      expect(stderrChunks.length).toBeGreaterThan(0)
+    })
+
+    it('should return logger instance for chaining', () => {
+      const result = testLogger.success('done')
+      expect(result).toBe(testLogger)
+    })
+  })
+
+  describe('fail() method', () => {
+    it('should log fail message with symbol', () => {
+      testLogger.fail('operation failed')
+      const output = stderrChunks.join('')
+      expect(output).toContain('operation failed')
+    })
+
+    it('should strip existing symbols', () => {
+      testLogger.fail('✖ has fail symbol')
+      const output = stderrChunks.join('')
+      expect(output).toContain('has fail symbol')
+    })
+
+    it('should return logger instance for chaining', () => {
+      const result = testLogger.fail('error')
+      expect(result).toBe(testLogger)
+    })
+  })
+
+  describe('warn() method', () => {
+    it('should log warning message with symbol', () => {
+      testLogger.warn('warning message')
+      const output = stderrChunks.join('')
+      expect(output).toContain('warning message')
+    })
+
+    it('should strip existing warning symbols', () => {
+      testLogger.warn('⚠ existing warning')
+      const output = stderrChunks.join('')
+      expect(output).toContain('existing warning')
+    })
+
+    it('should return logger instance for chaining', () => {
+      const result = testLogger.warn('warning')
+      expect(result).toBe(testLogger)
+    })
+  })
+
+  describe('info() method', () => {
+    it('should log info message with symbol', () => {
+      testLogger.info('info message')
+      const output = stderrChunks.join('')
+      expect(output).toContain('info message')
+    })
+
+    it('should strip existing info symbols', () => {
+      testLogger.info('ℹ existing info')
+      const output = stderrChunks.join('')
+      expect(output).toContain('existing info')
+    })
+
+    it('should return logger instance for chaining', () => {
+      const result = testLogger.info('info')
+      expect(result).toBe(testLogger)
+    })
+  })
+
+  describe('done() method', () => {
+    it('should be an alias for success()', () => {
+      testLogger.done('completed')
+      const output = stderrChunks.join('')
+      expect(output).toContain('completed')
+    })
+
+    it('should return logger instance for chaining', () => {
+      const result = testLogger.done('done')
+      expect(result).toBe(testLogger)
+    })
+  })
+
+  describe('indent() and dedent() methods', () => {
+    it('should indent messages by default 2 spaces', () => {
+      testLogger.indent()
+      testLogger.log('indented')
+      const output = stdoutChunks.join('')
+      expect(output).toContain('  indented')
+    })
+
+    it('should support custom indentation amounts', () => {
+      testLogger.indent(4)
+      testLogger.log('four spaces')
+      const output = stdoutChunks.join('')
+      expect(output).toContain('    four spaces')
+    })
+
+    it('should dedent by default 2 spaces', () => {
+      testLogger.indent().indent()
+      testLogger.log('4 spaces')
+      testLogger.dedent()
+      testLogger.log('2 spaces')
+      const outputs = stdoutChunks.join('')
+      expect(outputs).toContain('    4 spaces')
+      expect(outputs).toContain('  2 spaces')
+    })
+
+    it('should support custom dedent amounts', () => {
+      testLogger.indent(4)
+      testLogger.log('indented')
+      testLogger.dedent(4)
+      testLogger.log('no indent')
+      const outputs = stdoutChunks.join('')
+      expect(outputs).toContain('    indented')
+      expect(outputs).toContain('no indent')
+    })
+
+    it('should cap indentation at max (1000 spaces)', () => {
+      testLogger.indent(2000)
+      testLogger.log('max indent')
+      const output = stdoutChunks.join('')
+      const leadingSpaces = output.match(/^\s+/)?.[0].length || 0
+      expect(leadingSpaces).toBeLessThanOrEqual(1000)
+    })
+
+    it('should return logger instance for chaining', () => {
+      const result = testLogger.indent().dedent()
+      expect(result).toBe(testLogger)
+    })
+  })
+
+  describe('resetIndent() method', () => {
+    it('should reset all indentation to zero', () => {
+      testLogger.indent().indent().indent()
+      testLogger.resetIndent()
+      testLogger.log('no indent')
+      const output = stdoutChunks.join('')
+      expect(output.trim()).toContain('no indent')
+    })
+
+    it('should return logger instance for chaining', () => {
+      const result = testLogger.resetIndent()
+      expect(result).toBe(testLogger)
+    })
+  })
+
+  describe('group() and groupEnd() methods', () => {
+    it('should create a group with label', () => {
+      testLogger.group('Group Label')
+      testLogger.log('inside group')
+      testLogger.groupEnd()
+      const output = stdoutChunks.join('')
+      expect(output).toContain('Group Label')
+      expect(output).toContain('inside group')
+    })
+
+    it('should indent content inside group', () => {
+      testLogger.group('Group')
+      testLogger.log('indented content')
+      testLogger.groupEnd()
+      testLogger.log('not indented')
+      const output = stdoutChunks.join('')
+      expect(output).toContain('  indented content')
+    })
+
+    it('should support nested groups', () => {
+      testLogger.group('Outer')
+      testLogger.log('outer content')
+      testLogger.group('Inner')
+      testLogger.log('inner content')
+      testLogger.groupEnd()
+      testLogger.groupEnd()
+      const output = stdoutChunks.join('')
+      expect(output).toContain('  outer content')
+      expect(output).toContain('    inner content')
+    })
+
+    it('should work without label', () => {
+      testLogger.group()
+      testLogger.log('content')
+      testLogger.groupEnd()
+      const output = stdoutChunks.join('')
+      expect(output).toContain('  content')
+    })
+
+    it('should return logger instance for chaining', () => {
+      const result = testLogger.group().groupEnd()
+      expect(result).toBe(testLogger)
+    })
+  })
+
+  describe('groupCollapsed() method', () => {
+    it('should work like group()', () => {
+      testLogger.groupCollapsed('Collapsed')
+      testLogger.log('content')
+      testLogger.groupEnd()
+      const output = stdoutChunks.join('')
+      expect(output).toContain('Collapsed')
+      expect(output).toContain('  content')
+    })
+
+    it('should return logger instance for chaining', () => {
+      const result = testLogger.groupCollapsed('test')
+      expect(result).toBe(testLogger)
+    })
+  })
+
+  describe('step() method', () => {
+    it('should add blank line before step', () => {
+      testLogger.log('previous')
+      testLogger.step('Step 1')
+      const outputs = stdoutChunks
+      expect(outputs.length).toBeGreaterThan(2)
+    })
+
+    it('should not add blank line if already blank', () => {
+      testLogger.log('')
+      const beforeCount = stdoutChunks.length
+      testLogger.step('Step')
+      // Should not add another blank line
+      expect(stdoutChunks.length).toBe(beforeCount + 1)
+    })
+
+    it('should include arrow symbol in step message', () => {
+      testLogger.step('Step 1')
+      const output = stdoutChunks.join('')
+      // Check for either Unicode → or ASCII > fallback
+      expect(output).toMatch(/[→>]/)
+      expect(output).toContain('Step 1')
+    })
+
+    it('should strip existing symbols from step message', () => {
+      testLogger.step('→ Step 1')
+      // Get the last chunk (the actual step line, not the blank line)
+      const stepLine = stdoutChunks[stdoutChunks.length - 1]
+      // Strip ANSI color codes for easier testing
+      // biome-ignore lint/suspicious/noControlCharactersInRegex: ANSI escape sequence needed for stripping color codes
+      const stripped = stepLine.replace(/\x1b\[\d+m/g, '')
+      // Should have exactly one arrow symbol and the message text
+      expect(stripped).toMatch(/^[→>] Step 1\n$/)
+      // Verify the arrow appears exactly once at the start
+      const arrowCount = (stripped.match(/[→>]/g) || []).length
+      expect(arrowCount).toBe(1)
+    })
+
+    it('should return logger instance for chaining', () => {
+      const result = testLogger.step('step')
+      expect(result).toBe(testLogger)
+    })
+  })
+
+  describe('substep() method', () => {
+    it('should indent message by 2 spaces', () => {
+      testLogger.substep('Substep')
+      const output = stdoutChunks.join('')
+      expect(output).toContain('  Substep')
+    })
+
+    it('should return logger instance for chaining', () => {
+      const result = testLogger.substep('substep')
+      expect(result).toBe(testLogger)
+    })
+  })
+
+  describe('logNewline() method', () => {
+    it('should add blank line if last was not blank', () => {
+      testLogger.log('text')
+      const beforeCount = stdoutChunks.length
+      testLogger.logNewline()
+      expect(stdoutChunks.length).toBe(beforeCount + 1)
+    })
+
+    it('should not add blank line if last was already blank', () => {
+      testLogger.log('')
+      const beforeCount = stdoutChunks.length
+      testLogger.logNewline()
+      expect(stdoutChunks.length).toBe(beforeCount)
+    })
+
+    it('should return logger instance for chaining', () => {
+      const result = testLogger.logNewline()
+      expect(result).toBe(testLogger)
+    })
+  })
+
+  describe('errorNewline() method', () => {
+    it('should add blank line to stderr if last was not blank', () => {
+      testLogger.error('error')
+      const beforeCount = stderrChunks.length
+      testLogger.errorNewline()
+      expect(stderrChunks.length).toBe(beforeCount + 1)
+    })
+
+    it('should not add blank line if last was already blank', () => {
+      testLogger.error('')
+      const beforeCount = stderrChunks.length
+      testLogger.errorNewline()
+      expect(stderrChunks.length).toBe(beforeCount)
+    })
+
+    it('should return logger instance for chaining', () => {
+      const result = testLogger.errorNewline()
+      expect(result).toBe(testLogger)
+    })
+  })
+
+  describe('assert() method', () => {
+    it('should not log when assertion is truthy', () => {
+      const beforeLogCount = testLogger.logCallCount
+      testLogger.assert(true, 'should not appear')
+      // assert() doesn't increment log count for successful assertions
+      expect(testLogger.logCallCount).toBe(beforeLogCount)
+    })
+
+    it('should log when assertion is falsy', () => {
+      const beforeLogCount = testLogger.logCallCount
+      testLogger.assert(false, 'assertion failed')
+      // assert() increments log count for failed assertions
+      expect(testLogger.logCallCount).toBe(beforeLogCount + 1)
+    })
+
+    it('should increment log count only on failure', () => {
+      const beforeCount = testLogger.logCallCount
+      testLogger.assert(true, 'pass')
+      expect(testLogger.logCallCount).toBe(beforeCount)
+      testLogger.assert(false, 'fail')
+      expect(testLogger.logCallCount).toBe(beforeCount + 1)
+    })
+
+    it('should return logger instance for chaining', () => {
+      const result = testLogger.assert(true, 'test')
+      expect(result).toBe(testLogger)
+    })
+  })
+
+  describe('createTask() method', () => {
+    it('should create a task that logs start and completion', () => {
+      const task = testLogger.createTask('TestTask')
+      const result = task.run(() => 'result')
+      const output = stdoutChunks.join('')
+      expect(output).toContain('Starting task: TestTask')
+      expect(output).toContain('Completed task: TestTask')
+      expect(result).toBe('result')
+    })
+
+    it('should execute task function and return result', () => {
+      const task = testLogger.createTask('Task')
+      const result = task.run(() => 42)
+      expect(result).toBe(42)
+    })
+
+    it('should work with void functions', () => {
+      const task = testLogger.createTask('VoidTask')
+      const spy = vi.fn()
+      task.run(spy)
+      expect(spy).toHaveBeenCalled()
+    })
+  })
+
+  describe('count() method', () => {
+    it('should increment and log counter', () => {
+      const beforeCount = testLogger.logCallCount
+      testLogger.count('test')
+      testLogger.count('test')
+      // count() should increment log count twice
+      expect(testLogger.logCallCount).toBe(beforeCount + 2)
+    })
+
+    it('should use default label when none provided', () => {
+      const beforeCount = testLogger.logCallCount
+      testLogger.count()
+      expect(testLogger.logCallCount).toBe(beforeCount + 1)
+    })
+
+    it('should return logger instance for chaining', () => {
+      const result = testLogger.count('label')
+      expect(result).toBe(testLogger)
+    })
+  })
+
+  describe('dir() method', () => {
+    it('should display object properties', () => {
+      const beforeCount = testLogger.logCallCount
+      testLogger.dir({ key: 'value' })
+      expect(testLogger.logCallCount).toBe(beforeCount + 1)
+    })
+
+    it('should support options', () => {
+      const beforeCount = testLogger.logCallCount
+      testLogger.dir({ nested: { deep: 'value' } }, { depth: 2 })
+      expect(testLogger.logCallCount).toBe(beforeCount + 1)
+    })
+
+    it('should return logger instance for chaining', () => {
+      const result = testLogger.dir({})
+      expect(result).toBe(testLogger)
+    })
+  })
+
+  describe('dirxml() method', () => {
+    it('should display XML/HTML data', () => {
+      const beforeCount = testLogger.logCallCount
+      testLogger.dirxml({ xml: 'data' })
+      expect(testLogger.logCallCount).toBe(beforeCount + 1)
+    })
+
+    it('should return logger instance for chaining', () => {
+      const result = testLogger.dirxml('data')
+      expect(result).toBe(testLogger)
+    })
+  })
+
+  describe('table() method', () => {
+    it('should display data as table', () => {
+      const beforeCount = testLogger.logCallCount
+      testLogger.table([
+        { name: 'Alice', age: 30 },
+        { name: 'Bob', age: 25 },
+      ])
+      expect(testLogger.logCallCount).toBe(beforeCount + 1)
+    })
+
+    it('should support property filter', () => {
+      const beforeCount = testLogger.logCallCount
+      testLogger.table(
+        [
+          { name: 'Alice', age: 30, city: 'NYC' },
+          { name: 'Bob', age: 25, city: 'LA' },
+        ],
+        ['name', 'age'],
+      )
+      expect(testLogger.logCallCount).toBe(beforeCount + 1)
+    })
+
+    it('should return logger instance for chaining', () => {
+      const result = testLogger.table([])
+      expect(result).toBe(testLogger)
+    })
+  })
+
+  describe('timeEnd() method', () => {
+    it('should end timer and log duration', () => {
+      testLogger.time('timer-test-1')
+      const beforeCount = testLogger.logCallCount
+      testLogger.timeEnd('timer-test-1')
+      expect(testLogger.logCallCount).toBe(beforeCount + 1)
+    })
+
+    it('should work with non-existent timer', () => {
+      testLogger.time('existing-timer')
+      const beforeCount = testLogger.logCallCount
+      testLogger.timeEnd('existing-timer')
+      expect(testLogger.logCallCount).toBe(beforeCount + 1)
+    })
+
+    it('should return logger instance for chaining', () => {
+      testLogger.time('some-label')
+      const result = testLogger.timeEnd('some-label')
+      expect(result).toBe(testLogger)
+    })
+  })
+
+  describe('timeLog() method', () => {
+    it('should log current timer value without stopping', () => {
+      testLogger.time('timer-test-2')
+      const beforeCount = testLogger.logCallCount
+      testLogger.timeLog('timer-test-2', 'checkpoint')
+      expect(testLogger.logCallCount).toBe(beforeCount + 1)
+      testLogger.timeEnd('timer-test-2')
+    })
+
+    it('should support additional data', () => {
+      testLogger.time('timer-test-3')
+      const beforeCount = testLogger.logCallCount
+      testLogger.timeLog('timer-test-3', 'data1', 'data2')
+      expect(testLogger.logCallCount).toBe(beforeCount + 1)
+      testLogger.timeEnd('timer-test-3')
+    })
+
+    it('should return logger instance for chaining', () => {
+      testLogger.time('some-timer')
+      const result = testLogger.timeLog('some-timer')
+      expect(result).toBe(testLogger)
+      testLogger.timeEnd('some-timer')
+    })
+  })
+
+  describe('trace() method', () => {
+    it('should log stack trace', () => {
+      const beforeCount = testLogger.logCallCount
+      testLogger.trace('trace point')
+      expect(testLogger.logCallCount).toBe(beforeCount + 1)
+    })
+
+    it('should work without message', () => {
+      const beforeCount = testLogger.logCallCount
+      testLogger.trace()
+      expect(testLogger.logCallCount).toBe(beforeCount + 1)
+    })
+
+    it('should return logger instance for chaining', () => {
+      const result = testLogger.trace('trace')
+      expect(result).toBe(testLogger)
+    })
+  })
+
+  describe('write() method', () => {
+    it('should write text to stdout without newline', () => {
+      // Explicitly clear chunks before test (defensive against CI isolation issues)
+      stdoutChunks.length = 0
+      testLogger.write('raw text')
+      const output = stdoutChunks.join('')
+      expect(output).toBe('raw text')
+    })
+
+    it('should not apply indentation', () => {
+      // Explicitly clear chunks before test (defensive against CI isolation issues)
+      stdoutChunks.length = 0
+      testLogger.indent()
+      testLogger.write('no indent')
+      const output = stdoutChunks.join('')
+      expect(output).toBe('no indent')
+    })
+
+    it('should return logger instance for chaining', () => {
+      // Explicitly clear chunks before test (defensive against CI isolation issues)
+      stdoutChunks.length = 0
+      const result = testLogger.write('text')
+      expect(result).toBe(testLogger)
+    })
+  })
+
+  describe('progress() method', () => {
+    it('should show progress indicator', () => {
+      // progress() writes directly to stream, not through standard logging
+      // so it doesn't go through our mock in the same way
+      expect(() => testLogger.progress('Loading...')).not.toThrow()
+    })
+
+    it('should write to stderr when on stderr stream', () => {
+      expect(() => testLogger.stderr.progress('Error progress')).not.toThrow()
+    })
+
+    it('should return logger instance for chaining', () => {
+      const result = testLogger.progress('test')
+      expect(result).toBe(testLogger)
+    })
+  })
+
+  describe('clearLine() method', () => {
+    it('should clear line in non-TTY mode', () => {
+      // clearLine() writes directly to stream
+      expect(() => testLogger.clearLine()).not.toThrow()
+    })
+
+    it('should clear line on stderr when stream-bound', () => {
+      expect(() => testLogger.stderr.clearLine()).not.toThrow()
+    })
+
+    it('should handle TTY mode', () => {
+      // Create TTY mock with cursorTo and clearLine methods
+      const cursorToSpy = vi.fn()
+      const clearLineSpy = vi.fn()
+
+      const ttyStdout = new Writable({
+        write(chunk: any, _encoding: any, callback: any) {
+          stdoutChunks.push(chunk.toString())
+          callback()
+        },
+      })
+      ;(ttyStdout as any).isTTY = true
+      ;(ttyStdout as any).cursorTo = cursorToSpy
+      ;(ttyStdout as any).clearLine = clearLineSpy
+
+      const ttyLogger = new Logger({ stdout: ttyStdout, stderr: mockStderr })
+      // clearLine should work without throwing
+      expect(() => ttyLogger.clearLine()).not.toThrow()
+      // Note: The console's internal _stdout stream is what gets called,
+      // which we can't easily mock. We verify it doesn't throw as a basic test.
+    })
+
+    it('should return logger instance for chaining', () => {
+      const result = testLogger.clearLine()
+      expect(result).toBe(testLogger)
+    })
+  })
+
+  describe('clearVisible() method', () => {
+    it('should clear screen on main logger', () => {
+      testLogger.clearVisible()
+      // Should not throw
+      expect(testLogger).toBeDefined()
+    })
+
+    it('should throw on stream-bound logger', () => {
+      expect(() => {
+        testLogger.stderr.clearVisible()
+      }).toThrow(/only available on the main logger/)
+    })
+
+    it('should reset log count in TTY mode', () => {
+      const ttyStdout = new Writable({
+        write(_chunk: any, _encoding: any, callback: any) {
+          callback()
+        },
+      })
+      ;(ttyStdout as any).isTTY = true
+
+      const ttyLogger = new Logger({ stdout: ttyStdout, stderr: mockStderr })
+      ttyLogger.log('test')
+      ttyLogger.clearVisible()
+      expect(ttyLogger.logCallCount).toBe(0)
+    })
+
+    it('should return logger instance for chaining', () => {
+      const result = testLogger.clearVisible()
+      expect(result).toBe(testLogger)
+    })
+  })
+
+  describe('stderr and stdout getters', () => {
+    it('should return stderr-bound logger', () => {
+      const stderrLogger = testLogger.stderr
+      expect(stderrLogger).toBeInstanceOf(Logger)
+      expect(stderrLogger).not.toBe(testLogger)
+    })
+
+    it('should cache stderr logger instance', () => {
+      const first = testLogger.stderr
+      const second = testLogger.stderr
+      expect(first).toBe(second)
+    })
+
+    it('should return stdout-bound logger', () => {
+      const stdoutLogger = testLogger.stdout
+      expect(stdoutLogger).toBeInstanceOf(Logger)
+      expect(stdoutLogger).not.toBe(testLogger)
+    })
+
+    it('should cache stdout logger instance', () => {
+      const first = testLogger.stdout
+      const second = testLogger.stdout
+      expect(first).toBe(second)
+    })
+
+    it('should maintain separate indentation for stderr', () => {
+      testLogger.stderr.indent()
+      testLogger.stderr.error('indented error')
+      testLogger.log('not indented')
+      const errOutput = stderrChunks.join('')
+      const outOutput = stdoutChunks.join('')
+      expect(errOutput).toContain('  indented error')
+      expect(outOutput.trim()).toBe('not indented')
+    })
+
+    it('should maintain separate indentation for stdout', () => {
+      testLogger.stdout.indent()
+      testLogger.stdout.log('indented log')
+      testLogger.error('not indented error')
+      const outOutput = stdoutChunks.join('')
+      const errOutput = stderrChunks.join('')
+      expect(outOutput).toContain('  indented log')
+      expect(errOutput.trim()).toContain('not indented error')
+    })
+  })
+
+  describe.sequential('indentation with stream-bound loggers', () => {
+    it('should only affect stderr when dedenting stderr logger', () => {
+      testLogger.indent()
+      testLogger.indent()
+      testLogger.stderr.dedent()
+      testLogger.stderr.error('stderr 1 indent')
+      testLogger.log('stdout 2 indents')
+      const errOutput = stderrChunks.join('')
+      const outOutput = stdoutChunks.join('')
+      expect(errOutput).toContain('  stderr 1 indent')
+      expect(outOutput).toContain('    stdout 2 indents')
+    })
+
+    it('should only affect stdout when dedenting stdout logger', () => {
+      testLogger.indent()
+      testLogger.indent()
+      testLogger.stdout.dedent()
+      testLogger.log('stdout 1 indent')
+      testLogger.error('stderr 2 indents')
+      const outOutput = stdoutChunks.join('')
+      const errOutput = stderrChunks.join('')
+      expect(outOutput).toContain('  stdout 1 indent')
+      expect(errOutput).toContain('    stderr 2 indents')
+    })
+
+    it('should only reset stderr when calling resetIndent on stderr', () => {
+      testLogger.indent()
+      testLogger.stderr.resetIndent()
+      testLogger.stderr.error('no indent')
+      testLogger.log('has indent')
+      const errOutput = stderrChunks.join('')
+      const outOutput = stdoutChunks.join('')
+      expect(errOutput.trim()).toContain('no indent')
+      expect(outOutput).toContain('  has indent')
+    })
+
+    it('should only reset stdout when calling resetIndent on stdout', () => {
+      testLogger.indent()
+      testLogger.stdout.resetIndent()
+      testLogger.log('no indent')
+      testLogger.error('has indent')
+      const outOutput = stdoutChunks.join('')
+      const errOutput = stderrChunks.join('')
+      expect(outOutput.trim()).toBe('no indent')
+      expect(errOutput).toContain('  has indent')
+    })
+  })
+
+  describe.sequential('logCallCount', () => {
+    it('should start at 0', () => {
+      expect(testLogger.logCallCount).toBe(0)
+    })
+
+    it('should increment on each log call', () => {
+      testLogger.log('test')
+      expect(testLogger.logCallCount).toBe(1)
+      testLogger.error('error')
+      expect(testLogger.logCallCount).toBe(2)
+      testLogger.success('success')
+      expect(testLogger.logCallCount).toBe(3)
+    })
+
+    it('should be accessible via getter', () => {
+      testLogger.log('test')
+      const count = testLogger.logCallCount
+      expect(count).toBeGreaterThan(0)
+    })
+  })
+
+  describe('symbols', () => {
+    it('should expose incLogCallCountSymbol', () => {
+      expect(incLogCallCountSymbol).toBeDefined()
+      expect(typeof incLogCallCountSymbol).toBe('symbol')
+    })
+
+    it('should expose lastWasBlankSymbol', () => {
+      expect(lastWasBlankSymbol).toBeDefined()
+      expect(typeof lastWasBlankSymbol).toBe('symbol')
+    })
+
+    it('should allow incrementing log count via symbol', () => {
+      const before = testLogger.logCallCount
+      ;(testLogger as any)[incLogCallCountSymbol]()
+      expect(testLogger.logCallCount).toBe(before + 1)
+    })
+
+    it('should allow setting lastWasBlank via symbol', () => {
+      ;(testLogger as any)[lastWasBlankSymbol](true)
+      // Verify by checking logNewline behavior
+      const before = stdoutChunks.length
+      testLogger.logNewline()
+      expect(stdoutChunks.length).toBe(before) // Should not add line
+    })
+  })
+
+  describe('method chaining', () => {
+    it('should support chaining multiple operations', () => {
+      const result = testLogger
+        .log('step 1')
+        .indent()
+        .log('step 2')
+        .success('done')
+        .dedent()
+        .log('step 3')
+
+      expect(result).toBe(testLogger)
+      const stdout = stdoutChunks.join('')
+      const stderr = stderrChunks.join('')
+      expect(stdout).toContain('step 1')
+      expect(stdout).toContain('  step 2')
+      expect(stderr).toContain('done')
+      expect(stdout).toContain('step 3')
+    })
+  })
+
+  describe('symbol stripping', () => {
+    it('should strip unicode checkmark symbols', () => {
+      testLogger.success('✔ message')
+      testLogger.success('✓ message')
+      testLogger.success('√ message')
+      const output = stderrChunks.join('')
+      expect(output).toContain('message')
+    })
+
+    it('should strip unicode fail symbols', () => {
+      testLogger.fail('✖ message')
+      testLogger.fail('✗ message')
+      testLogger.fail('× message')
+      const output = stderrChunks.join('')
+      expect(output).toContain('message')
+    })
+
+    it('should strip unicode warn symbols', () => {
+      testLogger.warn('⚠ message')
+      testLogger.warn('‼ message')
+      const output = stderrChunks.join('')
+      expect(output).toContain('message')
+    })
+
+    it('should strip unicode info symbols', () => {
+      testLogger.info('ℹ message')
+      const output = stderrChunks.join('')
+      expect(output).toContain('message')
+    })
+
+    it('should strip variation selectors', () => {
+      testLogger.success('✔\uFE0F message')
+      const output = stderrChunks.join('')
+      expect(output).toContain('message')
+    })
+
+    it('should strip symbols with whitespace', () => {
+      testLogger.success('✔  message with spaces')
+      const output = stderrChunks.join('')
+      expect(output).toContain('message with spaces')
+    })
+  })
+
+  describe.sequential('blank line tracking', () => {
+    it('should track when last line was blank', () => {
+      testLogger.log('')
+      testLogger.logNewline()
+      // Should not add duplicate blank line
+      expect(stdoutChunks.length).toBe(1)
+    })
+
+    it('should track blank lines for stderr', () => {
+      testLogger.error('')
+      testLogger.errorNewline()
+      // Should not add duplicate blank line
+      expect(stderrChunks.length).toBe(1)
+    })
+
+    it('should reset blank tracking after non-blank log', () => {
+      testLogger.log('')
+      testLogger.log('text')
+      testLogger.logNewline()
+      // Should add blank line after non-blank
+      expect(stdoutChunks.length).toBe(3)
+    })
+  })
+
+  describe.sequential('edge cases', () => {
+    it('should handle empty strings', () => {
+      testLogger.log('')
+      testLogger.error('')
+      expect(stdoutChunks.length).toBe(1)
+      expect(stderrChunks.length).toBe(1)
+    })
+
+    it('should handle special characters', () => {
+      testLogger.log('Tab\there')
+      testLogger.log('Newline\nhere')
+      testLogger.log('Unicode: 🚀')
+      expect(stdoutChunks.length).toBe(3)
+    })
+
+    it('should handle very long strings', () => {
+      const longString = 'x'.repeat(10_000)
+      testLogger.log(longString)
+      expect(stdoutChunks.join('')).toContain(longString)
+    })
+
+    it('should handle null and undefined', () => {
+      testLogger.log(null)
+      testLogger.log(undefined)
+      expect(stdoutChunks.length).toBe(2)
+    })
+
+    it('should handle objects with circular references', () => {
+      const obj: any = { name: 'test' }
+      obj.self = obj
+      expect(() => {
+        testLogger.dir(obj)
+      }).not.toThrow()
+    })
+
+    it('should handle nested indentation', () => {
+      testLogger.indent()
+      testLogger.log('level 1')
+      testLogger.indent()
+      testLogger.log('level 2')
+      testLogger.indent()
+      testLogger.log('level 3')
+      testLogger.dedent()
+      testLogger.dedent()
+      testLogger.dedent()
+      testLogger.log('level 0')
+      const output = stdoutChunks.join('')
+      expect(output).toContain('  level 1')
+      expect(output).toContain('    level 2')
+      expect(output).toContain('      level 3')
+    })
+  })
+
+  describe('reason() method', () => {
+    it('should log reason message with symbol', () => {
+      testLogger.reason('processing dependencies')
+      const output = stderrChunks.join('')
+      expect(output).toContain('processing dependencies')
+    })
+
+    it('should support multiple arguments', () => {
+      testLogger.reason('Found', 3, 'issues')
+      const output = stderrChunks.join('')
+      expect(output).toContain('Found')
+    })
+
+    it('should return logger instance for chaining', () => {
+      const result = testLogger.reason('analyzing...')
+      expect(result).toBe(testLogger)
+    })
+
+    it('should handle empty reason', () => {
+      testLogger.reason()
+      expect(stderrChunks.length).toBeGreaterThan(0)
+    })
+
+    it('should strip existing symbols', () => {
+      testLogger.reason('∴ already has symbol')
+      const output = stderrChunks.join('')
+      expect(output).toContain('already has symbol')
+    })
+  })
+
+  describe('time() method', () => {
+    it('should start a timer with a label', () => {
+      expect(() => {
+        testLogger.time('test-timer')
+      }).not.toThrow()
+    })
+
+    it('should return logger instance for chaining', () => {
+      const result = testLogger.time('chain-timer')
+      expect(result).toBe(testLogger)
+    })
+
+    it('should handle timer without label', () => {
+      expect(() => {
+        testLogger.time()
+      }).not.toThrow()
+    })
+
+    it('should work with timeEnd', () => {
+      testLogger.time('duration-timer')
+      expect(() => {
+        testLogger.timeEnd('duration-timer')
+      }).not.toThrow()
+      const output = stdoutChunks.join('')
+      expect(output).toContain('duration-timer')
+    })
+
+    it('should work with timeLog', () => {
+      testLogger.time('log-timer')
+      expect(() => {
+        testLogger.timeLog('log-timer', 'checkpoint')
+      }).not.toThrow()
+      const output = stdoutChunks.join('')
+      expect(output).toContain('log-timer')
+    })
+
+    it('should handle multiple concurrent timers', () => {
+      testLogger.time('timer-1')
+      testLogger.time('timer-2')
+      testLogger.time('timer-3')
+      expect(() => {
+        testLogger.timeEnd('timer-1')
+        testLogger.timeEnd('timer-2')
+        testLogger.timeEnd('timer-3')
+      }).not.toThrow()
+    })
+  })
+
+  describe('console methods proxy', () => {
+    it('should have Symbol.toStringTag', () => {
+      expect(Object.prototype.toString.call(testLogger)).toBe('[object logger]')
+    })
+
+    it('should support timeEnd without errors', () => {
+      testLogger.time('any-timer')
+      expect(() => {
+        testLogger.timeEnd('any-timer')
+      }).not.toThrow()
+    })
+  })
+
+  describe('constructor with different argument types', () => {
+    it('should handle object constructor args', () => {
+      const customLogger = new Logger({
+        stdout: mockStdout,
+        stderr: mockStderr,
+      })
+      expect(customLogger).toBeInstanceOf(Logger)
+    })
+
+    it('should create logger without args', () => {
+      const defaultLogger = new Logger()
+      expect(defaultLogger).toBeInstanceOf(Logger)
+    })
+  })
+})
diff --git a/test/isolated/themes.test.ts b/test/isolated/themes.test.ts
new file mode 100644
index 0000000..b00ae4e
--- /dev/null
+++ b/test/isolated/themes.test.ts
@@ -0,0 +1,213 @@
+/**
+ * @fileoverview Isolated tests for color theme system.
+ *
+ * Tests theme management system for CLI color schemes:
+ * - THEMES constant with predefined themes (socket, claude, etc.)
+ * - SOCKET_THEME default theme configuration
+ * - createTheme(), extendTheme() theme builders
+ * - setTheme(), getTheme() global theme management
+ * - withTheme(), withThemeSync() scoped theme execution
+ * - resolveColor() color name resolution
+ * Used by Socket CLI for customizable terminal color output.
+ */
+
+import {
+  SOCKET_THEME,
+  THEMES,
+  createTheme,
+  extendTheme,
+  getTheme,
+  resolveColor,
+  setTheme,
+  withTheme,
+  withThemeSync,
+} from '@socketsecurity/lib/themes'
+import { afterEach, beforeEach, describe, expect, it } from 'vitest'
+
+describe('themes', () => {
+  // Reset theme to default before and after each test to ensure isolation
+  beforeEach(() => {
+    setTheme('socket')
+  })
+
+  afterEach(() => {
+    setTheme('socket')
+  })
+
+  describe('THEMES', () => {
+    it('should have all default themes', () => {
+      expect(THEMES).toHaveProperty('socket')
+      expect(THEMES).toHaveProperty('sunset')
+      expect(THEMES).toHaveProperty('terracotta')
+      expect(THEMES).toHaveProperty('lush')
+      expect(THEMES).toHaveProperty('ultra')
+    })
+
+    it('should have valid theme structures', () => {
+      for (const theme of Object.values(THEMES)) {
+        expect(theme).toHaveProperty('name')
+        expect(theme).toHaveProperty('displayName')
+        expect(theme).toHaveProperty('colors')
+        expect(theme.colors).toHaveProperty('primary')
+        expect(theme.colors).toHaveProperty('success')
+        expect(theme.colors).toHaveProperty('error')
+      }
+    })
+  })
+
+  describe('setTheme / getTheme', () => {
+    it('should set and get theme', () => {
+      setTheme('sunset')
+      expect(getTheme().name).toBe('sunset')
+    })
+
+    it('should set theme by object', () => {
+      setTheme(THEMES['terracotta'])
+      expect(getTheme().name).toBe('terracotta')
+    })
+
+    it('should default to socket theme', () => {
+      expect(getTheme().name).toBe('socket')
+    })
+  })
+
+  describe('withTheme', () => {
+    it('should apply theme for async operation', async () => {
+      const result = await withTheme('sunset', async () => {
+        expect(getTheme().name).toBe('sunset')
+        return 42
+      })
+
+      expect(result).toBe(42)
+      // Theme is automatically restored via AsyncLocalStorage
+      expect(getTheme().name).toBe('socket') // Falls back to default
+    })
+
+    it('should restore theme even if operation throws', async () => {
+      await expect(
+        withTheme('sunset', async () => {
+          throw new Error('test error')
+        }),
+      ).rejects.toThrow('test error')
+
+      expect(getTheme().name).toBe('socket') // Falls back to default
+    })
+
+    it('should isolate themes in nested async contexts', async () => {
+      await withTheme('sunset', async () => {
+        expect(getTheme().name).toBe('sunset')
+
+        await withTheme('ultra', async () => {
+          expect(getTheme().name).toBe('ultra')
+        })
+
+        // Theme automatically restored by AsyncLocalStorage
+        expect(getTheme().name).toBe('sunset')
+      })
+    })
+  })
+
+  describe('withThemeSync', () => {
+    it('should apply theme for sync operation', () => {
+      const result = withThemeSync('sunset', () => {
+        expect(getTheme().name).toBe('sunset')
+        return 42
+      })
+
+      expect(result).toBe(42)
+      // Theme is automatically restored via AsyncLocalStorage
+      expect(getTheme().name).toBe('socket') // Falls back to default
+    })
+
+    it('should restore theme even if operation throws', () => {
+      expect(() => {
+        withThemeSync('sunset', () => {
+          throw new Error('test error')
+        })
+      }).toThrow('test error')
+
+      expect(getTheme().name).toBe('socket') // Falls back to default
+    })
+  })
+
+  describe('resolveColor', () => {
+    it('should resolve primary color reference', () => {
+      const resolved = resolveColor('primary', SOCKET_THEME.colors)
+      expect(resolved).toEqual([140, 82, 255])
+    })
+
+    it('should resolve secondary color reference', () => {
+      const resolved = resolveColor('secondary', THEMES.sunset.colors)
+      expect(resolved).toEqual([200, 100, 180])
+    })
+
+    it('should resolve secondary to primary if not defined', () => {
+      const resolved = resolveColor('secondary', SOCKET_THEME.colors)
+      expect(resolved).toEqual([140, 82, 255])
+    })
+
+    it('should pass through named colors', () => {
+      const resolved = resolveColor('red', SOCKET_THEME.colors)
+      expect(resolved).toBe('red')
+    })
+
+    it('should pass through RGB colors', () => {
+      const rgb = [255, 0, 0] as const
+      const resolved = resolveColor(rgb, SOCKET_THEME.colors)
+      expect(resolved).toEqual(rgb)
+    })
+
+    it('should handle inherit', () => {
+      const resolved = resolveColor('inherit', SOCKET_THEME.colors)
+      expect(resolved).toBe('inherit')
+    })
+  })
+
+  describe('extendTheme', () => {
+    it('should extend theme with new colors', () => {
+      const extended = extendTheme(SOCKET_THEME, {
+        colors: {
+          primary: [255, 100, 200],
+        },
+      })
+
+      expect(extended.colors.primary).toEqual([255, 100, 200])
+      expect(extended.colors.success).toBe('greenBright') // Preserved
+    })
+
+    it('should extend theme with new name', () => {
+      const extended = extendTheme(SOCKET_THEME, {
+        name: 'my-theme',
+        displayName: 'My Theme',
+      })
+
+      expect(extended.name).toBe('my-theme')
+      expect(extended.displayName).toBe('My Theme')
+    })
+  })
+
+  describe('createTheme', () => {
+    it('should create new theme', () => {
+      const theme = createTheme({
+        name: 'test',
+        displayName: 'Test Theme',
+        colors: {
+          primary: [255, 0, 0],
+          success: 'green',
+          error: 'red',
+          warning: 'yellow',
+          info: 'blue',
+          step: 'cyan',
+          text: 'white',
+          textDim: 'gray',
+          link: 'cyan',
+          prompt: 'primary',
+        },
+      })
+
+      expect(theme.name).toBe('test')
+      expect(theme.displayName).toBe('Test Theme')
+      expect(theme.colors.primary).toEqual([255, 0, 0])
+    })
+  })
+})
diff --git a/test/registry/arrays.test.ts b/test/registry/arrays.test.ts
deleted file mode 100644
index 786a401..0000000
--- a/test/registry/arrays.test.ts
+++ /dev/null
@@ -1,204 +0,0 @@
-/**
- * @fileoverview Unit tests for array utility functions.
- */
-
-import {
-  arrayChunk,
-  arrayUnique,
-  isArray,
-  joinAnd,
-  joinOr,
-} from '@socketsecurity/lib/arrays'
-import { describe, expect, it } from 'vitest'
-
-describe('arrays', () => {
-  describe('arrayChunk', () => {
-    it('should split array into chunks of specified size', () => {
-      const arr = [1, 2, 3, 4, 5, 6]
-      const result = arrayChunk(arr, 2)
-      expect(result).toEqual([
-        [1, 2],
-        [3, 4],
-        [5, 6],
-      ])
-    })
-
-    it('should handle uneven chunks', () => {
-      const arr = [1, 2, 3, 4, 5]
-      const result = arrayChunk(arr, 2)
-      expect(result).toEqual([[1, 2], [3, 4], [5]])
-    })
-
-    it('should default to chunk size of 2', () => {
-      const arr = [1, 2, 3, 4]
-      const result = arrayChunk(arr)
-      expect(result).toEqual([
-        [1, 2],
-        [3, 4],
-      ])
-    })
-
-    it('should handle single element arrays', () => {
-      const arr = [1]
-      const result = arrayChunk(arr, 3)
-      expect(result).toEqual([[1]])
-    })
-
-    it('should handle empty arrays', () => {
-      const arr: number[] = []
-      const result = arrayChunk(arr, 2)
-      expect(result).toEqual([])
-    })
-
-    it('should throw error for chunk size <= 0', () => {
-      const arr = [1, 2, 3]
-      expect(() => arrayChunk(arr, 0)).toThrow(
-        'Chunk size must be greater than 0',
-      )
-      expect(() => arrayChunk(arr, -1)).toThrow(
-        'Chunk size must be greater than 0',
-      )
-    })
-
-    it('should handle chunk size larger than array', () => {
-      const arr = [1, 2, 3]
-      const result = arrayChunk(arr, 10)
-      expect(result).toEqual([[1, 2, 3]])
-    })
-
-    it('should work with readonly arrays', () => {
-      const arr: readonly number[] = [1, 2, 3, 4]
-      const result = arrayChunk(arr, 2)
-      expect(result).toEqual([
-        [1, 2],
-        [3, 4],
-      ])
-    })
-  })
-
-  describe('arrayUnique', () => {
-    it('should remove duplicate primitive values', () => {
-      const arr = [1, 2, 2, 3, 3, 3, 4]
-      const result = arrayUnique(arr)
-      expect(result).toEqual([1, 2, 3, 4])
-    })
-
-    it('should remove duplicate strings', () => {
-      const arr = ['a', 'b', 'b', 'c', 'a']
-      const result = arrayUnique(arr)
-      expect(result).toEqual(['a', 'b', 'c'])
-    })
-
-    it('should handle empty arrays', () => {
-      const arr: number[] = []
-      const result = arrayUnique(arr)
-      expect(result).toEqual([])
-    })
-
-    it('should handle arrays with no duplicates', () => {
-      const arr = [1, 2, 3, 4]
-      const result = arrayUnique(arr)
-      expect(result).toEqual([1, 2, 3, 4])
-    })
-
-    it('should work with readonly arrays', () => {
-      const arr: readonly string[] = ['x', 'y', 'x', 'z']
-      const result = arrayUnique(arr)
-      expect(result).toEqual(['x', 'y', 'z'])
-    })
-
-    it('should handle mixed types', () => {
-      const arr = [1, '1', 2, '2', 1, '1']
-      const result = arrayUnique(arr)
-      expect(result).toEqual([1, '1', 2, '2'])
-    })
-  })
-
-  describe('isArray', () => {
-    it('should return true for arrays', () => {
-      expect(isArray([])).toBe(true)
-      expect(isArray([1, 2, 3])).toBe(true)
-      expect(isArray(new Array(5))).toBe(true)
-    })
-
-    it('should return false for non-arrays', () => {
-      expect(isArray(null)).toBe(false)
-      expect(isArray(undefined)).toBe(false)
-      expect(isArray({})).toBe(false)
-      expect(isArray('array')).toBe(false)
-      expect(isArray(123)).toBe(false)
-      expect(isArray({ length: 0 })).toBe(false)
-    })
-
-    it('should return true for array-like typed arrays', () => {
-      expect(isArray(new Uint8Array(0))).toBe(false)
-      expect(isArray(new Int32Array(0))).toBe(false)
-    })
-  })
-
-  describe('joinAnd', () => {
-    it('should join two items with "and"', () => {
-      const result = joinAnd(['apple', 'banana'])
-      expect(result).toBe('apple and banana')
-    })
-
-    it('should join three items with commas and "and"', () => {
-      const result = joinAnd(['apple', 'banana', 'cherry'])
-      expect(result).toBe('apple, banana, and cherry')
-    })
-
-    it('should handle single item', () => {
-      const result = joinAnd(['apple'])
-      expect(result).toBe('apple')
-    })
-
-    it('should handle empty array', () => {
-      const result = joinAnd([])
-      expect(result).toBe('')
-    })
-
-    it('should work with readonly arrays', () => {
-      const arr: readonly string[] = ['red', 'green', 'blue']
-      const result = joinAnd(arr)
-      expect(result).toBe('red, green, and blue')
-    })
-
-    it('should handle many items', () => {
-      const result = joinAnd(['one', 'two', 'three', 'four', 'five'])
-      expect(result).toBe('one, two, three, four, and five')
-    })
-  })
-
-  describe('joinOr', () => {
-    it('should join two items with "or"', () => {
-      const result = joinOr(['apple', 'banana'])
-      expect(result).toBe('apple or banana')
-    })
-
-    it('should join three items with commas and "or"', () => {
-      const result = joinOr(['apple', 'banana', 'cherry'])
-      expect(result).toBe('apple, banana, or cherry')
-    })
-
-    it('should handle single item', () => {
-      const result = joinOr(['apple'])
-      expect(result).toBe('apple')
-    })
-
-    it('should handle empty array', () => {
-      const result = joinOr([])
-      expect(result).toBe('')
-    })
-
-    it('should work with readonly arrays', () => {
-      const arr: readonly string[] = ['red', 'green', 'blue']
-      const result = joinOr(arr)
-      expect(result).toBe('red, green, or blue')
-    })
-
-    it('should handle many items', () => {
-      const result = joinOr(['one', 'two', 'three', 'four', 'five'])
-      expect(result).toBe('one, two, three, four, or five')
-    })
-  })
-})
diff --git a/test/registry/fs.test.ts b/test/registry/fs.test.ts
deleted file mode 100644
index 077cc19..0000000
--- a/test/registry/fs.test.ts
+++ /dev/null
@@ -1,1194 +0,0 @@
-/**
- * @fileoverview Unit tests for file system utility functions.
- */
-
-import { promises as fs } from 'node:fs'
-import path from 'node:path'
-import {
-  findUp,
-  findUpSync,
-  isDir,
-  isDirEmptySync,
-  isDirSync,
-  isSymLinkSync,
-  readDirNames,
-  readDirNamesSync,
-  readFileBinary,
-  readFileBinarySync,
-  readFileUtf8,
-  readFileUtf8Sync,
-  readJson,
-  readJsonSync,
-  safeReadFile,
-  safeReadFileSync,
-  safeStats,
-  safeStatsSync,
-  uniqueSync,
-  writeJson,
-  writeJsonSync,
-} from '@socketsecurity/lib/fs'
-import { describe, expect, it } from 'vitest'
-import { runWithTempDir } from '../utils/temp-file-helper'
-
-describe('fs', () => {
-  describe('findUp', () => {
-    it('should find file in current directory', async () => {
-      await runWithTempDir(async tmpDir => {
-        const testFile = path.join(tmpDir, 'package.json')
-        await fs.writeFile(testFile, '{}', 'utf8')
-
-        const result = await findUp('package.json', { cwd: tmpDir })
-        expect(result).toBeDefined()
-        expect(result).toContain('package.json')
-      }, 'findUp-current-')
-    })
-
-    it('should find file in parent directory', async () => {
-      await runWithTempDir(async tmpDir => {
-        const testFile = path.join(tmpDir, 'config.json')
-        await fs.writeFile(testFile, '{}', 'utf8')
-
-        const subDir = path.join(tmpDir, 'sub', 'nested')
-        await fs.mkdir(subDir, { recursive: true })
-
-        const result = await findUp('config.json', { cwd: subDir })
-        expect(result).toBeDefined()
-        expect(result).toContain('config.json')
-      }, 'findUp-parent-')
-    })
-
-    it('should find directory when onlyDirectories is true', async () => {
-      await runWithTempDir(async tmpDir => {
-        const testDir = path.join(tmpDir, 'node_modules')
-        await fs.mkdir(testDir, { recursive: true })
-
-        const result = await findUp('node_modules', {
-          cwd: tmpDir,
-          onlyDirectories: true,
-        })
-        expect(result).toBeDefined()
-        expect(result).toContain('node_modules')
-      }, 'findUp-dir-')
-    })
-
-    it('should return undefined when file not found', async () => {
-      await runWithTempDir(async tmpDir => {
-        const result = await findUp('nonexistent.txt', { cwd: tmpDir })
-        expect(result).toBeUndefined()
-      }, 'findUp-notfound-')
-    })
-
-    it('should find first match when given array of names', async () => {
-      await runWithTempDir(async tmpDir => {
-        const testFile = path.join(tmpDir, 'config.yaml')
-        await fs.writeFile(testFile, '', 'utf8')
-
-        const result = await findUp(
-          ['config.json', 'config.yaml', 'config.yml'],
-          {
-            cwd: tmpDir,
-          },
-        )
-        expect(result).toBeDefined()
-        expect(result).toContain('config.yaml')
-      }, 'findUp-array-')
-    })
-
-    it('should respect abort signal', async () => {
-      const controller = new AbortController()
-      controller.abort()
-
-      const result = await findUp('package.json', {
-        cwd: process.cwd(),
-        signal: controller.signal,
-      })
-      expect(result).toBeUndefined()
-    })
-
-    it('should not find files when onlyDirectories is true', async () => {
-      await runWithTempDir(async tmpDir => {
-        const testFile = path.join(tmpDir, 'file.txt')
-        await fs.writeFile(testFile, '', 'utf8')
-
-        const result = await findUp('file.txt', {
-          cwd: tmpDir,
-          onlyDirectories: true,
-        })
-        expect(result).toBeUndefined()
-      }, 'findUp-only-dirs-')
-    })
-  })
-
-  describe('findUpSync', () => {
-    it('should find file in current directory', async () => {
-      await runWithTempDir(async tmpDir => {
-        const testFile = path.join(tmpDir, 'package.json')
-        await fs.writeFile(testFile, '{}', 'utf8')
-
-        const result = findUpSync('package.json', { cwd: tmpDir })
-        expect(result).toBeDefined()
-        expect(result).toContain('package.json')
-      }, 'findUpSync-current-')
-    })
-
-    it('should find file in parent directory', async () => {
-      await runWithTempDir(async tmpDir => {
-        const testFile = path.join(tmpDir, 'config.json')
-        await fs.writeFile(testFile, '{}', 'utf8')
-
-        const subDir = path.join(tmpDir, 'sub', 'nested')
-        await fs.mkdir(subDir, { recursive: true })
-
-        const result = findUpSync('config.json', { cwd: subDir })
-        expect(result).toBeDefined()
-        expect(result).toContain('config.json')
-      }, 'findUpSync-parent-')
-    })
-
-    it('should find directory when onlyDirectories is true', async () => {
-      await runWithTempDir(async tmpDir => {
-        const testDir = path.join(tmpDir, 'node_modules')
-        await fs.mkdir(testDir, { recursive: true })
-
-        const result = findUpSync('node_modules', {
-          cwd: tmpDir,
-          onlyDirectories: true,
-        })
-        expect(result).toBeDefined()
-        expect(result).toContain('node_modules')
-      }, 'findUpSync-dir-')
-    })
-
-    it('should return undefined when file not found', async () => {
-      await runWithTempDir(async tmpDir => {
-        const result = findUpSync('nonexistent.txt', { cwd: tmpDir })
-        expect(result).toBeUndefined()
-      }, 'findUpSync-notfound-')
-    })
-
-    it('should find first match when given array of names', async () => {
-      await runWithTempDir(async tmpDir => {
-        const testFile = path.join(tmpDir, 'config.yaml')
-        await fs.writeFile(testFile, '', 'utf8')
-
-        const result = findUpSync(
-          ['config.json', 'config.yaml', 'config.yml'],
-          {
-            cwd: tmpDir,
-          },
-        )
-        expect(result).toBeDefined()
-        expect(result).toContain('config.yaml')
-      }, 'findUpSync-array-')
-    })
-
-    it('should stop at stopAt directory', async () => {
-      await runWithTempDir(async tmpDir => {
-        const configFile = path.join(tmpDir, 'config.json')
-        await fs.writeFile(configFile, '{}', 'utf8')
-
-        const subDir = path.join(tmpDir, 'sub', 'nested')
-        await fs.mkdir(subDir, { recursive: true })
-
-        const midDir = path.join(tmpDir, 'sub')
-        const result = findUpSync('config.json', {
-          cwd: subDir,
-          stopAt: midDir,
-        })
-        expect(result).toBeUndefined()
-      }, 'findUpSync-stopAt-')
-    })
-
-    it('should check stopAt directory itself', async () => {
-      await runWithTempDir(async tmpDir => {
-        const subDir = path.join(tmpDir, 'sub')
-        await fs.mkdir(subDir, { recursive: true })
-
-        const configFile = path.join(subDir, 'config.json')
-        await fs.writeFile(configFile, '{}', 'utf8')
-
-        const nestedDir = path.join(subDir, 'nested')
-        await fs.mkdir(nestedDir, { recursive: true })
-
-        const result = findUpSync('config.json', {
-          cwd: nestedDir,
-          stopAt: subDir,
-        })
-        expect(result).toBeDefined()
-        expect(result).toContain('config.json')
-      }, 'findUpSync-stopAt-check-')
-    })
-  })
-
-  describe('isDir', () => {
-    it('should return true for directories', async () => {
-      await runWithTempDir(async tmpDir => {
-        const result = await isDir(tmpDir)
-        expect(result).toBe(true)
-      }, 'isDir-true-')
-    })
-
-    it('should return false for files', async () => {
-      await runWithTempDir(async tmpDir => {
-        const testFile = path.join(tmpDir, 'file.txt')
-        await fs.writeFile(testFile, '', 'utf8')
-
-        const result = await isDir(testFile)
-        expect(result).toBe(false)
-      }, 'isDir-false-file-')
-    })
-
-    it('should return false for non-existent paths', async () => {
-      const result = await isDir('/nonexistent/path')
-      expect(result).toBe(false)
-    })
-  })
-
-  describe('isDirSync', () => {
-    it('should return true for directories', async () => {
-      await runWithTempDir(async tmpDir => {
-        const result = isDirSync(tmpDir)
-        expect(result).toBe(true)
-      }, 'isDirSync-true-')
-    })
-
-    it('should return false for files', async () => {
-      await runWithTempDir(async tmpDir => {
-        const testFile = path.join(tmpDir, 'file.txt')
-        await fs.writeFile(testFile, '', 'utf8')
-
-        const result = isDirSync(testFile)
-        expect(result).toBe(false)
-      }, 'isDirSync-false-file-')
-    })
-
-    it('should return false for non-existent paths', () => {
-      const result = isDirSync('/nonexistent/path')
-      expect(result).toBe(false)
-    })
-  })
-
-  describe('isDirEmptySync', () => {
-    it('should return true for empty directories', async () => {
-      await runWithTempDir(async tmpDir => {
-        const emptyDir = path.join(tmpDir, 'empty')
-        await fs.mkdir(emptyDir)
-
-        const result = isDirEmptySync(emptyDir)
-        expect(result).toBe(true)
-      }, 'isDirEmpty-true-')
-    })
-
-    it('should return false for directories with files', async () => {
-      await runWithTempDir(async tmpDir => {
-        const testFile = path.join(tmpDir, 'file.txt')
-        await fs.writeFile(testFile, '', 'utf8')
-
-        const result = isDirEmptySync(tmpDir)
-        expect(result).toBe(false)
-      }, 'isDirEmpty-false-')
-    })
-
-    it('should return false for non-existent directories', () => {
-      const result = isDirEmptySync('/nonexistent/path')
-      expect(result).toBe(false)
-    })
-
-    it.skip('should ignore files matching ignore patterns', async () => {
-      // Note: This test is skipped due to glob matcher pattern complexity.
-      // The ignore patterns work but require specific glob patterns that
-      // are tested indirectly through other functions.
-      await runWithTempDir(async tmpDir => {
-        const gitDir = path.join(tmpDir, '.git')
-        await fs.mkdir(gitDir)
-        const gitSubDir = path.join(gitDir, 'objects')
-        await fs.mkdir(gitSubDir)
-
-        const result = isDirEmptySync(tmpDir, {
-          ignore: ['.git'],
-        })
-        expect(result).toBe(true)
-      }, 'isDirEmpty-ignore-')
-    })
-
-    it('should return false when non-ignored files exist', async () => {
-      await runWithTempDir(async tmpDir => {
-        const gitDir = path.join(tmpDir, '.git')
-        await fs.mkdir(gitDir)
-        const gitSubDir = path.join(gitDir, 'objects')
-        await fs.mkdir(gitSubDir)
-
-        const readmeFile = path.join(tmpDir, 'README.md')
-        await fs.writeFile(readmeFile, '', 'utf8')
-
-        const result = isDirEmptySync(tmpDir, {
-          ignore: ['.git'],
-        })
-        expect(result).toBe(false)
-      }, 'isDirEmpty-ignore-mixed-')
-    })
-  })
-
-  describe('isSymLinkSync', () => {
-    it('should return true for symlinks', async () => {
-      await runWithTempDir(async tmpDir => {
-        const targetFile = path.join(tmpDir, 'target.txt')
-        await fs.writeFile(targetFile, '', 'utf8')
-
-        const linkPath = path.join(tmpDir, 'link.txt')
-        await fs.symlink(targetFile, linkPath)
-
-        const result = isSymLinkSync(linkPath)
-        expect(result).toBe(true)
-      }, 'isSymLink-true-')
-    })
-
-    it('should return false for regular files', async () => {
-      await runWithTempDir(async tmpDir => {
-        const testFile = path.join(tmpDir, 'file.txt')
-        await fs.writeFile(testFile, '', 'utf8')
-
-        const result = isSymLinkSync(testFile)
-        expect(result).toBe(false)
-      }, 'isSymLink-false-')
-    })
-
-    it('should return false for non-existent paths', () => {
-      const result = isSymLinkSync('/nonexistent/path')
-      expect(result).toBe(false)
-    })
-  })
-
-  describe('readDirNames', () => {
-    it('should read directory names', async () => {
-      await runWithTempDir(async tmpDir => {
-        const dir1 = path.join(tmpDir, 'dir1')
-        const dir2 = path.join(tmpDir, 'dir2')
-        await fs.mkdir(dir1)
-        await fs.mkdir(dir2)
-
-        const result = await readDirNames(tmpDir)
-        expect(result).toEqual(['dir1', 'dir2'])
-      }, 'readDirNames-basic-')
-    })
-
-    it('should sort directory names by default', async () => {
-      await runWithTempDir(async tmpDir => {
-        const dirZ = path.join(tmpDir, 'z-dir')
-        const dirA = path.join(tmpDir, 'a-dir')
-        const dirM = path.join(tmpDir, 'm-dir')
-        await fs.mkdir(dirZ)
-        await fs.mkdir(dirA)
-        await fs.mkdir(dirM)
-
-        const result = await readDirNames(tmpDir)
-        expect(result).toEqual(['a-dir', 'm-dir', 'z-dir'])
-      }, 'readDirNames-sorted-')
-    })
-
-    it('should not sort when sort option is false', async () => {
-      await runWithTempDir(async tmpDir => {
-        const dirZ = path.join(tmpDir, 'z-dir')
-        const dirA = path.join(tmpDir, 'a-dir')
-        await fs.mkdir(dirZ)
-        await fs.mkdir(dirA)
-
-        const result = await readDirNames(tmpDir, { sort: false })
-        expect(result.length).toBe(2)
-        expect(result).toContain('z-dir')
-        expect(result).toContain('a-dir')
-      }, 'readDirNames-unsorted-')
-    })
-
-    it('should exclude files, only return directories', async () => {
-      await runWithTempDir(async tmpDir => {
-        const dir1 = path.join(tmpDir, 'dir1')
-        await fs.mkdir(dir1)
-
-        const file1 = path.join(tmpDir, 'file1.txt')
-        await fs.writeFile(file1, '', 'utf8')
-
-        const result = await readDirNames(tmpDir)
-        expect(result).toEqual(['dir1'])
-      }, 'readDirNames-dirs-only-')
-    })
-
-    it('should exclude empty directories when includeEmpty is false', async () => {
-      await runWithTempDir(async tmpDir => {
-        const emptyDir = path.join(tmpDir, 'empty')
-        await fs.mkdir(emptyDir)
-
-        const nonEmptyDir = path.join(tmpDir, 'non-empty')
-        await fs.mkdir(nonEmptyDir)
-        await fs.writeFile(path.join(nonEmptyDir, 'file.txt'), '', 'utf8')
-
-        const result = await readDirNames(tmpDir, { includeEmpty: false })
-        expect(result).toEqual(['non-empty'])
-      }, 'readDirNames-no-empty-')
-    })
-
-    it('should return empty array for non-existent directory', async () => {
-      const result = await readDirNames('/nonexistent/path')
-      expect(result).toEqual([])
-    })
-
-    it('should use ignore patterns with includeEmpty false', async () => {
-      await runWithTempDir(async tmpDir => {
-        const emptyDir = path.join(tmpDir, 'empty-dir')
-        await fs.mkdir(emptyDir)
-
-        const gitDir = path.join(emptyDir, '.git')
-        await fs.mkdir(gitDir)
-
-        const nonEmptyDir = path.join(tmpDir, 'non-empty-dir')
-        await fs.mkdir(nonEmptyDir)
-        await fs.writeFile(path.join(nonEmptyDir, 'file.txt'), '', 'utf8')
-
-        // With ignore patterns and includeEmpty: false, directories containing only ignored files are excluded
-        const result = await readDirNames(tmpDir, {
-          ignore: ['.git'],
-          includeEmpty: false,
-        })
-        expect(result).toContain('non-empty-dir')
-        expect(result).not.toContain('empty-dir')
-      }, 'readDirNames-ignore-')
-    })
-  })
-
-  describe('readDirNamesSync', () => {
-    it('should read directory names', async () => {
-      await runWithTempDir(async tmpDir => {
-        const dir1 = path.join(tmpDir, 'dir1')
-        const dir2 = path.join(tmpDir, 'dir2')
-        await fs.mkdir(dir1)
-        await fs.mkdir(dir2)
-
-        const result = readDirNamesSync(tmpDir)
-        expect(result).toEqual(['dir1', 'dir2'])
-      }, 'readDirNamesSync-basic-')
-    })
-
-    it('should sort directory names by default', async () => {
-      await runWithTempDir(async tmpDir => {
-        const dirZ = path.join(tmpDir, 'z-dir')
-        const dirA = path.join(tmpDir, 'a-dir')
-        const dirM = path.join(tmpDir, 'm-dir')
-        await fs.mkdir(dirZ)
-        await fs.mkdir(dirA)
-        await fs.mkdir(dirM)
-
-        const result = readDirNamesSync(tmpDir)
-        expect(result).toEqual(['a-dir', 'm-dir', 'z-dir'])
-      }, 'readDirNamesSync-sorted-')
-    })
-
-    it('should exclude files, only return directories', async () => {
-      await runWithTempDir(async tmpDir => {
-        const dir1 = path.join(tmpDir, 'dir1')
-        await fs.mkdir(dir1)
-
-        const file1 = path.join(tmpDir, 'file1.txt')
-        await fs.writeFile(file1, '', 'utf8')
-
-        const result = readDirNamesSync(tmpDir)
-        expect(result).toEqual(['dir1'])
-      }, 'readDirNamesSync-dirs-only-')
-    })
-
-    it('should return empty array for non-existent directory', () => {
-      const result = readDirNamesSync('/nonexistent/path')
-      expect(result).toEqual([])
-    })
-  })
-
-  describe('readFileBinary', () => {
-    it('should read file as binary buffer', async () => {
-      await runWithTempDir(async tmpDir => {
-        const testFile = path.join(tmpDir, 'binary.dat')
-        const testData = Buffer.from([0x00, 0x01, 0x02, 0x03])
-        await fs.writeFile(testFile, testData)
-
-        const result = await readFileBinary(testFile)
-        expect(Buffer.isBuffer(result)).toBe(true)
-        expect(result).toEqual(testData)
-      }, 'readFileBinary-basic-')
-    })
-
-    it('should throw for non-existent files', async () => {
-      await expect(readFileBinary('/nonexistent/file.dat')).rejects.toThrow()
-    })
-  })
-
-  describe('readFileBinarySync', () => {
-    it('should read file as binary buffer', async () => {
-      await runWithTempDir(async tmpDir => {
-        const testFile = path.join(tmpDir, 'binary.dat')
-        const testData = Buffer.from([0x00, 0x01, 0x02, 0x03])
-        await fs.writeFile(testFile, testData)
-
-        const result = readFileBinarySync(testFile)
-        expect(Buffer.isBuffer(result)).toBe(true)
-        expect(result).toEqual(testData)
-      }, 'readFileBinarySync-basic-')
-    })
-
-    it('should throw for non-existent files', () => {
-      expect(() => readFileBinarySync('/nonexistent/file.dat')).toThrow()
-    })
-  })
-
-  describe('readFileUtf8', () => {
-    it('should read file as UTF-8 string', async () => {
-      await runWithTempDir(async tmpDir => {
-        const testFile = path.join(tmpDir, 'text.txt')
-        const testContent = 'Hello, World!'
-        await fs.writeFile(testFile, testContent, 'utf8')
-
-        const result = await readFileUtf8(testFile)
-        expect(result).toBe(testContent)
-      }, 'readFileUtf8-basic-')
-    })
-
-    it('should handle unicode content', async () => {
-      await runWithTempDir(async tmpDir => {
-        const testFile = path.join(tmpDir, 'unicode.txt')
-        const testContent = 'Hello, 世界! 🌍'
-        await fs.writeFile(testFile, testContent, 'utf8')
-
-        const result = await readFileUtf8(testFile)
-        expect(result).toBe(testContent)
-      }, 'readFileUtf8-unicode-')
-    })
-
-    it('should throw for non-existent files', async () => {
-      await expect(readFileUtf8('/nonexistent/file.txt')).rejects.toThrow()
-    })
-  })
-
-  describe('readFileUtf8Sync', () => {
-    it('should read file as UTF-8 string', async () => {
-      await runWithTempDir(async tmpDir => {
-        const testFile = path.join(tmpDir, 'text.txt')
-        const testContent = 'Hello, World!'
-        await fs.writeFile(testFile, testContent, 'utf8')
-
-        const result = readFileUtf8Sync(testFile)
-        expect(result).toBe(testContent)
-      }, 'readFileUtf8Sync-basic-')
-    })
-
-    it('should handle unicode content', async () => {
-      await runWithTempDir(async tmpDir => {
-        const testFile = path.join(tmpDir, 'unicode.txt')
-        const testContent = 'Hello, 世界! 🌍'
-        await fs.writeFile(testFile, testContent, 'utf8')
-
-        const result = readFileUtf8Sync(testFile)
-        expect(result).toBe(testContent)
-      }, 'readFileUtf8Sync-unicode-')
-    })
-
-    it('should throw for non-existent files', () => {
-      expect(() => readFileUtf8Sync('/nonexistent/file.txt')).toThrow()
-    })
-  })
-
-  describe('readJson', () => {
-    it('should read and parse JSON file', async () => {
-      await runWithTempDir(async tmpDir => {
-        const testFile = path.join(tmpDir, 'data.json')
-        const testData = { foo: 'bar', count: 42 }
-        await fs.writeFile(testFile, JSON.stringify(testData), 'utf8')
-
-        const result = await readJson(testFile)
-        expect(result).toEqual(testData)
-      }, 'readJson-basic-')
-    })
-
-    it('should handle nested JSON objects', async () => {
-      await runWithTempDir(async tmpDir => {
-        const testFile = path.join(tmpDir, 'nested.json')
-        const testData = {
-          level1: {
-            level2: {
-              level3: 'deep',
-            },
-          },
-        }
-        await fs.writeFile(testFile, JSON.stringify(testData), 'utf8')
-
-        const result = await readJson(testFile)
-        expect(result).toEqual(testData)
-      }, 'readJson-nested-')
-    })
-
-    it('should throw by default for non-existent files', async () => {
-      await expect(readJson('/nonexistent/file.json')).rejects.toThrow()
-    })
-
-    it('should return undefined when throws is false and file does not exist', async () => {
-      const result = await readJson('/nonexistent/file.json', { throws: false })
-      expect(result).toBeUndefined()
-    })
-
-    it('should throw by default for invalid JSON', async () => {
-      await runWithTempDir(async tmpDir => {
-        const testFile = path.join(tmpDir, 'invalid.json')
-        await fs.writeFile(testFile, 'not valid json', 'utf8')
-
-        await expect(readJson(testFile)).rejects.toThrow()
-      }, 'readJson-invalid-')
-    })
-
-    it('should return undefined when throws is false and JSON is invalid', async () => {
-      await runWithTempDir(async tmpDir => {
-        const testFile = path.join(tmpDir, 'invalid.json')
-        await fs.writeFile(testFile, 'not valid json', 'utf8')
-
-        const result = await readJson(testFile, { throws: false })
-        expect(result).toBeUndefined()
-      }, 'readJson-invalid-no-throw-')
-    })
-
-    it('should use custom reviver function', async () => {
-      await runWithTempDir(async tmpDir => {
-        const testFile = path.join(tmpDir, 'data.json')
-        const testData = { date: '2024-01-01T00:00:00.000Z' }
-        await fs.writeFile(testFile, JSON.stringify(testData), 'utf8')
-
-        const result = await readJson(testFile, {
-          reviver: (key, value) => {
-            if (key === 'date' && typeof value === 'string') {
-              return new Date(value)
-            }
-            return value
-          },
-        })
-
-        expect(result.date).toBeInstanceOf(Date)
-      }, 'readJson-reviver-')
-    })
-  })
-
-  describe('readJsonSync', () => {
-    it('should read and parse JSON file', async () => {
-      await runWithTempDir(async tmpDir => {
-        const testFile = path.join(tmpDir, 'data.json')
-        const testData = { foo: 'bar', count: 42 }
-        await fs.writeFile(testFile, JSON.stringify(testData), 'utf8')
-
-        const result = readJsonSync(testFile)
-        expect(result).toEqual(testData)
-      }, 'readJsonSync-basic-')
-    })
-
-    it('should handle nested JSON objects', async () => {
-      await runWithTempDir(async tmpDir => {
-        const testFile = path.join(tmpDir, 'nested.json')
-        const testData = {
-          level1: {
-            level2: {
-              level3: 'deep',
-            },
-          },
-        }
-        await fs.writeFile(testFile, JSON.stringify(testData), 'utf8')
-
-        const result = readJsonSync(testFile)
-        expect(result).toEqual(testData)
-      }, 'readJsonSync-nested-')
-    })
-
-    it('should throw by default for non-existent files', () => {
-      expect(() => readJsonSync('/nonexistent/file.json')).toThrow()
-    })
-
-    it('should return undefined when throws is false and file does not exist', () => {
-      const result = readJsonSync('/nonexistent/file.json', { throws: false })
-      expect(result).toBeUndefined()
-    })
-
-    it('should throw by default for invalid JSON', async () => {
-      await runWithTempDir(async tmpDir => {
-        const testFile = path.join(tmpDir, 'invalid.json')
-        await fs.writeFile(testFile, 'not valid json', 'utf8')
-
-        expect(() => readJsonSync(testFile)).toThrow()
-      }, 'readJsonSync-invalid-')
-    })
-
-    it('should return undefined when throws is false and JSON is invalid', async () => {
-      await runWithTempDir(async tmpDir => {
-        const testFile = path.join(tmpDir, 'invalid.json')
-        await fs.writeFile(testFile, 'not valid json', 'utf8')
-
-        const result = readJsonSync(testFile, { throws: false })
-        expect(result).toBeUndefined()
-      }, 'readJsonSync-invalid-no-throw-')
-    })
-  })
-
-  describe.skip('safeDelete', () => {
-    // Note: These tests are skipped because they require the external 'del' module
-    // which has module resolution issues in the test environment.
-    // The functionality is covered by integration tests elsewhere.
-
-    it('should delete files in temp directory', async () => {
-      await runWithTempDir(async tmpDir => {
-        const testFile = path.join(tmpDir, 'delete-me.txt')
-        await fs.writeFile(testFile, '', 'utf8')
-
-        await safeDelete(testFile)
-
-        const exists = await fs
-          .access(testFile)
-          .then(() => true)
-          .catch(() => false)
-        expect(exists).toBe(false)
-      }, 'safeDelete-file-')
-    })
-
-    it('should delete directories recursively in temp directory', async () => {
-      await runWithTempDir(async tmpDir => {
-        const testDir = path.join(tmpDir, 'delete-dir')
-        await fs.mkdir(testDir, { recursive: true })
-        await fs.writeFile(path.join(testDir, 'file.txt'), '', 'utf8')
-
-        await safeDelete(testDir)
-
-        const exists = await fs
-          .access(testDir)
-          .then(() => true)
-          .catch(() => false)
-        expect(exists).toBe(false)
-      }, 'safeDelete-dir-')
-    })
-
-    it('should delete multiple files', async () => {
-      await runWithTempDir(async tmpDir => {
-        const file1 = path.join(tmpDir, 'file1.txt')
-        const file2 = path.join(tmpDir, 'file2.txt')
-        await fs.writeFile(file1, '', 'utf8')
-        await fs.writeFile(file2, '', 'utf8')
-
-        await safeDelete([file1, file2])
-
-        const exists1 = await fs
-          .access(file1)
-          .then(() => true)
-          .catch(() => false)
-        const exists2 = await fs
-          .access(file2)
-          .then(() => true)
-          .catch(() => false)
-        expect(exists1).toBe(false)
-        expect(exists2).toBe(false)
-      }, 'safeDelete-multiple-')
-    })
-
-    it('should not throw for non-existent files', async () => {
-      await expect(safeDelete('/nonexistent/file.txt')).resolves.toBeUndefined()
-    })
-
-    it('should respect force option', async () => {
-      await runWithTempDir(async tmpDir => {
-        const testFile = path.join(tmpDir, 'file.txt')
-        await fs.writeFile(testFile, '', 'utf8')
-
-        await safeDelete(testFile, { force: true })
-
-        const exists = await fs
-          .access(testFile)
-          .then(() => true)
-          .catch(() => false)
-        expect(exists).toBe(false)
-      }, 'safeDelete-force-')
-    })
-  })
-
-  describe.skip('safeDeleteSync', () => {
-    // Note: These tests are skipped because they require the external 'del' module
-    // which has module resolution issues in the test environment.
-    // The functionality is covered by integration tests elsewhere.
-
-    it('should delete files in temp directory', async () => {
-      await runWithTempDir(async tmpDir => {
-        const testFile = path.join(tmpDir, 'delete-me.txt')
-        await fs.writeFile(testFile, '', 'utf8')
-
-        safeDeleteSync(testFile)
-
-        const exists = await fs
-          .access(testFile)
-          .then(() => true)
-          .catch(() => false)
-        expect(exists).toBe(false)
-      }, 'safeDeleteSync-file-')
-    })
-
-    it('should delete directories recursively in temp directory', async () => {
-      await runWithTempDir(async tmpDir => {
-        const testDir = path.join(tmpDir, 'delete-dir')
-        await fs.mkdir(testDir, { recursive: true })
-        await fs.writeFile(path.join(testDir, 'file.txt'), '', 'utf8')
-
-        safeDeleteSync(testDir)
-
-        const exists = await fs
-          .access(testDir)
-          .then(() => true)
-          .catch(() => false)
-        expect(exists).toBe(false)
-      }, 'safeDeleteSync-dir-')
-    })
-
-    it('should delete multiple files', async () => {
-      await runWithTempDir(async tmpDir => {
-        const file1 = path.join(tmpDir, 'file1.txt')
-        const file2 = path.join(tmpDir, 'file2.txt')
-        await fs.writeFile(file1, '', 'utf8')
-        await fs.writeFile(file2, '', 'utf8')
-
-        safeDeleteSync([file1, file2])
-
-        const exists1 = await fs
-          .access(file1)
-          .then(() => true)
-          .catch(() => false)
-        const exists2 = await fs
-          .access(file2)
-          .then(() => true)
-          .catch(() => false)
-        expect(exists1).toBe(false)
-        expect(exists2).toBe(false)
-      }, 'safeDeleteSync-multiple-')
-    })
-
-    it('should not throw for non-existent files', () => {
-      expect(() => safeDeleteSync('/nonexistent/file.txt')).not.toThrow()
-    })
-  })
-
-  describe('safeReadFile', () => {
-    it('should read existing file', async () => {
-      await runWithTempDir(async tmpDir => {
-        const testFile = path.join(tmpDir, 'test.txt')
-        const testContent = 'test content'
-        await fs.writeFile(testFile, testContent, 'utf8')
-
-        const result = await safeReadFile(testFile, { encoding: 'utf8' })
-        expect(result).toBe(testContent)
-      }, 'safeReadFile-exists-')
-    })
-
-    it('should return undefined for non-existent files', async () => {
-      const result = await safeReadFile('/nonexistent/file.txt')
-      expect(result).toBeUndefined()
-    })
-
-    it('should read as buffer when no encoding specified', async () => {
-      await runWithTempDir(async tmpDir => {
-        const testFile = path.join(tmpDir, 'binary.dat')
-        const testData = Buffer.from([0x01, 0x02, 0x03])
-        await fs.writeFile(testFile, testData)
-
-        const result = await safeReadFile(testFile)
-        expect(Buffer.isBuffer(result)).toBe(true)
-      }, 'safeReadFile-buffer-')
-    })
-  })
-
-  describe('safeReadFileSync', () => {
-    it('should read existing file', async () => {
-      await runWithTempDir(async tmpDir => {
-        const testFile = path.join(tmpDir, 'test.txt')
-        const testContent = 'test content'
-        await fs.writeFile(testFile, testContent, 'utf8')
-
-        const result = safeReadFileSync(testFile, { encoding: 'utf8' })
-        expect(result).toBe(testContent)
-      }, 'safeReadFileSync-exists-')
-    })
-
-    it('should return undefined for non-existent files', () => {
-      const result = safeReadFileSync('/nonexistent/file.txt')
-      expect(result).toBeUndefined()
-    })
-
-    it('should read as buffer when no encoding specified', async () => {
-      await runWithTempDir(async tmpDir => {
-        const testFile = path.join(tmpDir, 'binary.dat')
-        const testData = Buffer.from([0x01, 0x02, 0x03])
-        await fs.writeFile(testFile, testData)
-
-        const result = safeReadFileSync(testFile)
-        expect(Buffer.isBuffer(result)).toBe(true)
-      }, 'safeReadFileSync-buffer-')
-    })
-  })
-
-  describe('safeStats', () => {
-    it('should return stats for existing files', async () => {
-      await runWithTempDir(async tmpDir => {
-        const testFile = path.join(tmpDir, 'test.txt')
-        await fs.writeFile(testFile, '', 'utf8')
-
-        const result = await safeStats(testFile)
-        expect(result).toBeDefined()
-        expect(result?.isFile()).toBe(true)
-      }, 'safeStats-file-')
-    })
-
-    it('should return stats for directories', async () => {
-      await runWithTempDir(async tmpDir => {
-        const result = await safeStats(tmpDir)
-        expect(result).toBeDefined()
-        expect(result?.isDirectory()).toBe(true)
-      }, 'safeStats-dir-')
-    })
-
-    it('should return undefined for non-existent paths', async () => {
-      const result = await safeStats('/nonexistent/path')
-      expect(result).toBeUndefined()
-    })
-  })
-
-  describe('safeStatsSync', () => {
-    it('should return stats for existing files', async () => {
-      await runWithTempDir(async tmpDir => {
-        const testFile = path.join(tmpDir, 'test.txt')
-        await fs.writeFile(testFile, '', 'utf8')
-
-        const result = safeStatsSync(testFile)
-        expect(result).toBeDefined()
-        expect(result?.isFile()).toBe(true)
-      }, 'safeStatsSync-file-')
-    })
-
-    it('should return stats for directories', async () => {
-      await runWithTempDir(async tmpDir => {
-        const result = safeStatsSync(tmpDir)
-        expect(result).toBeDefined()
-        expect(result?.isDirectory()).toBe(true)
-      }, 'safeStatsSync-dir-')
-    })
-
-    it('should return undefined for non-existent paths', () => {
-      const result = safeStatsSync('/nonexistent/path')
-      expect(result).toBeUndefined()
-    })
-  })
-
-  describe('uniqueSync', () => {
-    it('should return same path if file does not exist', async () => {
-      await runWithTempDir(async tmpDir => {
-        const testFile = path.join(tmpDir, 'unique.txt')
-
-        const result = uniqueSync(testFile)
-        expect(result).toContain('unique.txt')
-      }, 'uniqueSync-new-')
-    })
-
-    it('should add number suffix if file exists', async () => {
-      await runWithTempDir(async tmpDir => {
-        const testFile = path.join(tmpDir, 'exists.txt')
-        await fs.writeFile(testFile, '', 'utf8')
-
-        const result = uniqueSync(testFile)
-        expect(result).toContain('exists-1.txt')
-      }, 'uniqueSync-exists-')
-    })
-
-    it('should increment counter for multiple existing files', async () => {
-      await runWithTempDir(async tmpDir => {
-        const testFile = path.join(tmpDir, 'file.txt')
-        await fs.writeFile(testFile, '', 'utf8')
-
-        const file1 = path.join(tmpDir, 'file-1.txt')
-        await fs.writeFile(file1, '', 'utf8')
-
-        const result = uniqueSync(testFile)
-        expect(result).toContain('file-2.txt')
-      }, 'uniqueSync-increment-')
-    })
-
-    it('should preserve file extension', async () => {
-      await runWithTempDir(async tmpDir => {
-        const testFile = path.join(tmpDir, 'data.json')
-        await fs.writeFile(testFile, '', 'utf8')
-
-        const result = uniqueSync(testFile)
-        expect(result).toContain('data-1.json')
-      }, 'uniqueSync-extension-')
-    })
-
-    it('should handle files without extension', async () => {
-      await runWithTempDir(async tmpDir => {
-        const testFile = path.join(tmpDir, 'README')
-        await fs.writeFile(testFile, '', 'utf8')
-
-        const result = uniqueSync(testFile)
-        expect(result).toContain('README-1')
-      }, 'uniqueSync-no-ext-')
-    })
-  })
-
-  describe('writeJson', () => {
-    it('should write JSON to file', async () => {
-      await runWithTempDir(async tmpDir => {
-        const testFile = path.join(tmpDir, 'output.json')
-        const testData = { foo: 'bar', count: 42 }
-
-        await writeJson(testFile, testData)
-
-        const content = await fs.readFile(testFile, 'utf8')
-        const parsed = JSON.parse(content)
-        expect(parsed).toEqual(testData)
-      }, 'writeJson-basic-')
-    })
-
-    it('should format JSON with default spacing', async () => {
-      await runWithTempDir(async tmpDir => {
-        const testFile = path.join(tmpDir, 'formatted.json')
-        const testData = { foo: 'bar' }
-
-        await writeJson(testFile, testData)
-
-        const content = await fs.readFile(testFile, 'utf8')
-        expect(content).toContain('  ')
-        expect(content).toContain('\n')
-      }, 'writeJson-formatted-')
-    })
-
-    it('should use custom spacing', async () => {
-      await runWithTempDir(async tmpDir => {
-        const testFile = path.join(tmpDir, 'custom-spacing.json')
-        const testData = { foo: 'bar' }
-
-        await writeJson(testFile, testData, { spaces: 4 })
-
-        const content = await fs.readFile(testFile, 'utf8')
-        expect(content).toContain('    ')
-      }, 'writeJson-custom-spacing-')
-    })
-
-    it('should use custom EOL', async () => {
-      await runWithTempDir(async tmpDir => {
-        const testFile = path.join(tmpDir, 'custom-eol.json')
-        const testData = { foo: 'bar' }
-
-        await writeJson(testFile, testData, { EOL: '\r\n' })
-
-        const content = await fs.readFile(testFile, 'utf8')
-        expect(content).toContain('\r\n')
-      }, 'writeJson-eol-')
-    })
-
-    it('should add final EOL by default', async () => {
-      await runWithTempDir(async tmpDir => {
-        const testFile = path.join(tmpDir, 'final-eol.json')
-        const testData = { foo: 'bar' }
-
-        await writeJson(testFile, testData)
-
-        const content = await fs.readFile(testFile, 'utf8')
-        expect(content.endsWith('\n')).toBe(true)
-      }, 'writeJson-final-eol-')
-    })
-
-    it('should omit final EOL when finalEOL is false', async () => {
-      await runWithTempDir(async tmpDir => {
-        const testFile = path.join(tmpDir, 'no-final-eol.json')
-        const testData = { foo: 'bar' }
-
-        await writeJson(testFile, testData, { finalEOL: false })
-
-        const content = await fs.readFile(testFile, 'utf8')
-        expect(content.endsWith('\n')).toBe(false)
-      }, 'writeJson-no-final-eol-')
-    })
-
-    it('should use custom replacer function', async () => {
-      await runWithTempDir(async tmpDir => {
-        const testFile = path.join(tmpDir, 'replacer.json')
-        const testData = { foo: 'bar', secret: 'hidden' }
-
-        await writeJson(testFile, testData, {
-          replacer: (key, value) => {
-            if (key === 'secret') return undefined
-            return value
-          },
-        })
-
-        const content = await fs.readFile(testFile, 'utf8')
-        const parsed = JSON.parse(content)
-        expect(parsed.secret).toBeUndefined()
-        expect(parsed.foo).toBe('bar')
-      }, 'writeJson-replacer-')
-    })
-  })
-
-  describe('writeJsonSync', () => {
-    it('should write JSON to file', async () => {
-      await runWithTempDir(async tmpDir => {
-        const testFile = path.join(tmpDir, 'output.json')
-        const testData = { foo: 'bar', count: 42 }
-
-        writeJsonSync(testFile, testData)
-
-        const content = await fs.readFile(testFile, 'utf8')
-        const parsed = JSON.parse(content)
-        expect(parsed).toEqual(testData)
-      }, 'writeJsonSync-basic-')
-    })
-
-    it('should format JSON with default spacing', async () => {
-      await runWithTempDir(async tmpDir => {
-        const testFile = path.join(tmpDir, 'formatted.json')
-        const testData = { foo: 'bar' }
-
-        writeJsonSync(testFile, testData)
-
-        const content = await fs.readFile(testFile, 'utf8')
-        expect(content).toContain('  ')
-        expect(content).toContain('\n')
-      }, 'writeJsonSync-formatted-')
-    })
-
-    it('should use custom spacing', async () => {
-      await runWithTempDir(async tmpDir => {
-        const testFile = path.join(tmpDir, 'custom-spacing.json')
-        const testData = { foo: 'bar' }
-
-        writeJsonSync(testFile, testData, { spaces: 4 })
-
-        const content = await fs.readFile(testFile, 'utf8')
-        expect(content).toContain('    ')
-      }, 'writeJsonSync-custom-spacing-')
-    })
-
-    it('should add final EOL by default', async () => {
-      await runWithTempDir(async tmpDir => {
-        const testFile = path.join(tmpDir, 'final-eol.json')
-        const testData = { foo: 'bar' }
-
-        writeJsonSync(testFile, testData)
-
-        const content = await fs.readFile(testFile, 'utf8')
-        expect(content.endsWith('\n')).toBe(true)
-      }, 'writeJsonSync-final-eol-')
-    })
-
-    it('should omit final EOL when finalEOL is false', async () => {
-      await runWithTempDir(async tmpDir => {
-        const testFile = path.join(tmpDir, 'no-final-eol.json')
-        const testData = { foo: 'bar' }
-
-        writeJsonSync(testFile, testData, { finalEOL: false })
-
-        const content = await fs.readFile(testFile, 'utf8')
-        expect(content.endsWith('\n')).toBe(false)
-      }, 'writeJsonSync-no-final-eol-')
-    })
-  })
-})
diff --git a/test/registry/git.test.ts b/test/registry/git.test.ts
deleted file mode 100644
index 552e7e5..0000000
--- a/test/registry/git.test.ts
+++ /dev/null
@@ -1,337 +0,0 @@
-/**
- * @fileoverview Integration tests for git utility functions.
- * These tests work with the actual git repository state.
- */
-
-import { promises as fs } from 'node:fs'
-import path from 'node:path'
-import {
-  findGitRoot,
-  getChangedFiles,
-  getChangedFilesSync,
-  getStagedFiles,
-  getStagedFilesSync,
-  getUnstagedFiles,
-  getUnstagedFilesSync,
-  isChanged,
-  isChangedSync,
-  isStaged,
-  isStagedSync,
-  isUnstaged,
-  isUnstagedSync,
-} from '@socketsecurity/lib/git'
-import { describe, expect, it } from 'vitest'
-
-describe('git', () => {
-  const projectRoot = process.cwd()
-
-  describe('findGitRoot', () => {
-    it('should find git root from current directory', () => {
-      const result = findGitRoot(projectRoot)
-      expect(result).toBe(projectRoot)
-      expect(result).toContain('socket-lib')
-    })
-
-    it('should find git root from subdirectory', () => {
-      const testDir = path.join(projectRoot, 'test', 'registry')
-      const result = findGitRoot(testDir)
-      expect(result).toBe(projectRoot)
-    })
-
-    it('should find git root from deeply nested directory', () => {
-      const srcDir = path.join(projectRoot, 'src', 'constants')
-      const result = findGitRoot(srcDir)
-      expect(result).toBe(projectRoot)
-    })
-
-    it('should handle root directory gracefully', () => {
-      // On systems where root is not a git repo, should return root
-      const result = findGitRoot('/')
-      expect(result).toBeTruthy()
-      expect(typeof result).toBe('string')
-    })
-  })
-
-  describe('getChangedFiles', () => {
-    it('should return an array', async () => {
-      const result = await getChangedFiles({ cwd: projectRoot })
-      expect(Array.isArray(result)).toBe(true)
-    })
-
-    it('should return file paths as strings', async () => {
-      const result = await getChangedFiles({ cwd: projectRoot })
-      for (const file of result) {
-        expect(typeof file).toBe('string')
-      }
-    })
-
-    it('should respect cwd option', async () => {
-      const result = await getChangedFiles({ cwd: projectRoot })
-      expect(Array.isArray(result)).toBe(true)
-    })
-
-    it('should return absolute paths when absolute option is true', async () => {
-      const result = await getChangedFiles({
-        absolute: true,
-        cwd: projectRoot,
-      })
-      for (const file of result) {
-        if (file) {
-          expect(path.isAbsolute(file)).toBe(true)
-        }
-      }
-    })
-
-    it('should handle empty repository state', async () => {
-      // In a clean repo, should return empty array or files
-      const result = await getChangedFiles({ cwd: projectRoot })
-      expect(Array.isArray(result)).toBe(true)
-    })
-  })
-
-  describe('getChangedFilesSync', () => {
-    it('should return an array', () => {
-      const result = getChangedFilesSync({ cwd: projectRoot })
-      expect(Array.isArray(result)).toBe(true)
-    })
-
-    it('should return file paths as strings', () => {
-      const result = getChangedFilesSync({ cwd: projectRoot })
-      for (const file of result) {
-        expect(typeof file).toBe('string')
-      }
-    })
-
-    it('should match async version', async () => {
-      const syncResult = getChangedFilesSync({ cwd: projectRoot })
-      const asyncResult = await getChangedFiles({ cwd: projectRoot })
-      expect(syncResult).toEqual(asyncResult)
-    })
-  })
-
-  describe('getStagedFiles', () => {
-    it('should return an array', async () => {
-      const result = await getStagedFiles({ cwd: projectRoot })
-      expect(Array.isArray(result)).toBe(true)
-    })
-
-    it('should return file paths as strings', async () => {
-      const result = await getStagedFiles({ cwd: projectRoot })
-      for (const file of result) {
-        expect(typeof file).toBe('string')
-      }
-    })
-
-    it('should return absolute paths when absolute option is true', async () => {
-      const result = await getStagedFiles({
-        absolute: true,
-        cwd: projectRoot,
-      })
-      for (const file of result) {
-        if (file) {
-          expect(path.isAbsolute(file)).toBe(true)
-        }
-      }
-    })
-  })
-
-  describe('getStagedFilesSync', () => {
-    it('should return an array', () => {
-      const result = getStagedFilesSync({ cwd: projectRoot })
-      expect(Array.isArray(result)).toBe(true)
-    })
-
-    it('should match async version', async () => {
-      const syncResult = getStagedFilesSync({ cwd: projectRoot })
-      const asyncResult = await getStagedFiles({ cwd: projectRoot })
-      expect(syncResult).toEqual(asyncResult)
-    })
-  })
-
-  describe('getUnstagedFiles', () => {
-    it('should return an array', async () => {
-      const result = await getUnstagedFiles({ cwd: projectRoot })
-      expect(Array.isArray(result)).toBe(true)
-    })
-
-    it('should return file paths as strings', async () => {
-      const result = await getUnstagedFiles({ cwd: projectRoot })
-      for (const file of result) {
-        expect(typeof file).toBe('string')
-      }
-    })
-
-    it('should return absolute paths when absolute option is true', async () => {
-      const result = await getUnstagedFiles({
-        absolute: true,
-        cwd: projectRoot,
-      })
-      for (const file of result) {
-        if (file) {
-          expect(path.isAbsolute(file)).toBe(true)
-        }
-      }
-    })
-  })
-
-  describe('getUnstagedFilesSync', () => {
-    it('should return an array', () => {
-      const result = getUnstagedFilesSync({ cwd: projectRoot })
-      expect(Array.isArray(result)).toBe(true)
-    })
-
-    it('should match async version', async () => {
-      const syncResult = getUnstagedFilesSync({ cwd: projectRoot })
-      const asyncResult = await getUnstagedFiles({ cwd: projectRoot })
-      expect(syncResult).toEqual(asyncResult)
-    })
-  })
-
-  describe('isChanged', () => {
-    it('should return boolean for existing file', async () => {
-      const testFile = path.join(projectRoot, 'package.json')
-      const result = await isChanged(testFile, { cwd: projectRoot })
-      expect(typeof result).toBe('boolean')
-    })
-
-    it('should return false for committed file in clean repo', async () => {
-      // README.md should exist and be committed
-      const testFile = path.join(projectRoot, 'README.md')
-      const fileExists = await fs
-        .access(testFile)
-        .then(() => true)
-        .catch(() => false)
-      if (fileExists) {
-        const result = await isChanged(testFile, { cwd: projectRoot })
-        // In a clean repo, committed files should not be changed
-        expect(typeof result).toBe('boolean')
-      }
-    })
-
-    it('should work with relative paths', async () => {
-      const result = await isChanged('package.json', { cwd: projectRoot })
-      expect(typeof result).toBe('boolean')
-    })
-
-    it('should throw for non-existent files', async () => {
-      // Non-existent files cause fs.lstat to throw ENOENT
-      await expect(
-        isChanged('nonexistent-file.ts', { cwd: projectRoot }),
-      ).rejects.toThrow(/ENOENT|no such file/)
-    })
-  })
-
-  describe('isChangedSync', () => {
-    it('should return boolean for existing file', () => {
-      const testFile = path.join(projectRoot, 'package.json')
-      const result = isChangedSync(testFile, { cwd: projectRoot })
-      expect(typeof result).toBe('boolean')
-    })
-
-    it('should match async version', async () => {
-      const testFile = 'package.json'
-      const syncResult = isChangedSync(testFile, { cwd: projectRoot })
-      const asyncResult = await isChanged(testFile, { cwd: projectRoot })
-      expect(syncResult).toBe(asyncResult)
-    })
-  })
-
-  describe('isStaged', () => {
-    it('should return boolean for existing file', async () => {
-      const testFile = path.join(projectRoot, 'package.json')
-      const result = await isStaged(testFile, { cwd: projectRoot })
-      expect(typeof result).toBe('boolean')
-    })
-
-    it('should work with relative paths', async () => {
-      const result = await isStaged('package.json', { cwd: projectRoot })
-      expect(typeof result).toBe('boolean')
-    })
-
-    it('should throw for non-existent files', async () => {
-      // Non-existent files cause fs.lstat to throw ENOENT
-      await expect(
-        isStaged('nonexistent-file.ts', { cwd: projectRoot }),
-      ).rejects.toThrow(/ENOENT|no such file/)
-    })
-  })
-
-  describe('isStagedSync', () => {
-    it('should return boolean for existing file', () => {
-      const testFile = path.join(projectRoot, 'package.json')
-      const result = isStagedSync(testFile, { cwd: projectRoot })
-      expect(typeof result).toBe('boolean')
-    })
-
-    it('should match async version', async () => {
-      const testFile = 'package.json'
-      const syncResult = isStagedSync(testFile, { cwd: projectRoot })
-      const asyncResult = await isStaged(testFile, { cwd: projectRoot })
-      expect(syncResult).toBe(asyncResult)
-    })
-  })
-
-  describe('isUnstaged', () => {
-    it('should return boolean for existing file', async () => {
-      const testFile = path.join(projectRoot, 'package.json')
-      const result = await isUnstaged(testFile, { cwd: projectRoot })
-      expect(typeof result).toBe('boolean')
-    })
-
-    it('should work with relative paths', async () => {
-      const result = await isUnstaged('package.json', { cwd: projectRoot })
-      expect(typeof result).toBe('boolean')
-    })
-
-    it('should throw for non-existent files', async () => {
-      // Non-existent files cause fs.lstat to throw ENOENT
-      await expect(
-        isUnstaged('nonexistent-file.ts', { cwd: projectRoot }),
-      ).rejects.toThrow(/ENOENT|no such file/)
-    })
-  })
-
-  describe('isUnstagedSync', () => {
-    it('should return boolean for existing file', () => {
-      const testFile = path.join(projectRoot, 'package.json')
-      const result = isUnstagedSync(testFile, { cwd: projectRoot })
-      expect(typeof result).toBe('boolean')
-    })
-
-    it('should match async version', async () => {
-      const testFile = 'package.json'
-      const syncResult = isUnstagedSync(testFile, { cwd: projectRoot })
-      const asyncResult = await isUnstaged(testFile, { cwd: projectRoot })
-      expect(syncResult).toBe(asyncResult)
-    })
-  })
-
-  describe('edge cases', () => {
-    it('should handle concurrent calls', async () => {
-      const promises = [
-        getChangedFiles({ cwd: projectRoot }),
-        getStagedFiles({ cwd: projectRoot }),
-        getUnstagedFiles({ cwd: projectRoot }),
-      ]
-      const results = await Promise.all(promises)
-      for (const result of results) {
-        expect(Array.isArray(result)).toBe(true)
-      }
-    })
-
-    it('should handle multiple file checks', async () => {
-      const files = ['package.json', 'tsconfig.json', 'README.md']
-      const results = await Promise.all(
-        files.map(file => isChanged(file, { cwd: projectRoot })),
-      )
-      for (const result of results) {
-        expect(typeof result).toBe('boolean')
-      }
-    })
-
-    it('should handle files in subdirectories', async () => {
-      const result = await isChanged('src/index.ts', { cwd: projectRoot })
-      expect(typeof result).toBe('boolean')
-    })
-  })
-})
diff --git a/test/registry/github.test.ts b/test/registry/github.test.ts
deleted file mode 100644
index 64d1ead..0000000
--- a/test/registry/github.test.ts
+++ /dev/null
@@ -1,134 +0,0 @@
-/**
- * @fileoverview Tests for GitHub utilities.
- *
- * Note: HTTP-dependent tests are limited because httpRequest cannot be easily
- * mocked due to how modules are resolved when importing from src/. These tests
- * focus on environment variable handling, URL generation, and caching logic.
- */
-
-import {
-  clearRefCache,
-  getGhsaUrl,
-  getGitHubToken,
-  getGitHubTokenFromGitConfig,
-  getGitHubTokenWithFallback,
-} from '@socketsecurity/lib/github'
-import { beforeEach, describe, expect, it } from 'vitest'
-
-describe('github', () => {
-  beforeEach(() => {
-    // Clear environment variables
-    delete process.env.GITHUB_TOKEN
-    delete process.env.GH_TOKEN
-    delete process.env.SOCKET_CLI_GITHUB_TOKEN
-    clearRefCache()
-  })
-
-  describe('getGitHubToken', () => {
-    it('should return GITHUB_TOKEN from environment', () => {
-      process.env.GITHUB_TOKEN = 'test-token'
-      const token = getGitHubToken()
-      expect(token).toBe('test-token')
-    })
-
-    it('should return GH_TOKEN from environment', () => {
-      process.env.GH_TOKEN = 'gh-test-token'
-      const token = getGitHubToken()
-      expect(token).toBe('gh-test-token')
-    })
-
-    it('should return SOCKET_CLI_GITHUB_TOKEN from environment', () => {
-      process.env.SOCKET_CLI_GITHUB_TOKEN = 'cli-token'
-      const token = getGitHubToken()
-      expect(token).toBe('cli-token')
-    })
-
-    it('should prefer GITHUB_TOKEN over GH_TOKEN', () => {
-      process.env.GITHUB_TOKEN = 'github-token'
-      process.env.GH_TOKEN = 'gh-token'
-      const token = getGitHubToken()
-      expect(token).toBe('github-token')
-    })
-
-    it('should prefer GITHUB_TOKEN over SOCKET_CLI_GITHUB_TOKEN', () => {
-      process.env.GITHUB_TOKEN = 'github-token'
-      process.env.SOCKET_CLI_GITHUB_TOKEN = 'cli-token'
-      const token = getGitHubToken()
-      expect(token).toBe('github-token')
-    })
-
-    it('should return undefined when no token is set', () => {
-      const token = getGitHubToken()
-      expect(token).toBeUndefined()
-    })
-  })
-
-  describe('clearRefCache', () => {
-    it('should not throw when called', () => {
-      expect(() => clearRefCache()).not.toThrow()
-    })
-
-    it('should be callable multiple times', () => {
-      clearRefCache()
-      clearRefCache()
-      clearRefCache()
-      expect(true).toBe(true)
-    })
-  })
-
-  describe('getGitHubTokenFromGitConfig', () => {
-    it('should return string or undefined (integration test)', async () => {
-      const token = await getGitHubTokenFromGitConfig()
-      expect(typeof token === 'string' || token === undefined).toBe(true)
-    })
-
-    it('should return undefined when git config throws', async () => {
-      const token = await getGitHubTokenFromGitConfig({
-        cwd: '/nonexistent/directory/that/does/not/exist',
-      })
-      expect(token).toBeUndefined()
-    })
-
-    it('should accept spawn options', async () => {
-      const token = await getGitHubTokenFromGitConfig({ cwd: process.cwd() })
-      expect(typeof token === 'string' || token === undefined).toBe(true)
-    })
-  })
-
-  describe('getGitHubTokenWithFallback', () => {
-    it('should return token from GITHUB_TOKEN environment first', async () => {
-      process.env.GITHUB_TOKEN = 'env-token'
-      const token = await getGitHubTokenWithFallback()
-      expect(token).toBe('env-token')
-    })
-
-    it('should return token from GH_TOKEN when GITHUB_TOKEN is not set', async () => {
-      process.env.GH_TOKEN = 'gh-token'
-      const token = await getGitHubTokenWithFallback()
-      expect(token).toBe('gh-token')
-    })
-
-    it('should fallback to git config (integration test)', async () => {
-      // Integration test - git config may or may not have token
-      const token = await getGitHubTokenWithFallback()
-      expect(typeof token === 'string' || token === undefined).toBe(true)
-    })
-  })
-
-  describe('getGhsaUrl', () => {
-    it('should generate correct GHSA URL', () => {
-      const url = getGhsaUrl('GHSA-xxxx-xxxx-xxxx')
-      expect(url).toBe('https://github.com/advisories/GHSA-xxxx-xxxx-xxxx')
-    })
-
-    it('should handle different GHSA IDs', () => {
-      const url = getGhsaUrl('GHSA-1234-5678-9abc')
-      expect(url).toBe('https://github.com/advisories/GHSA-1234-5678-9abc')
-    })
-
-    it('should handle GHSA IDs with special characters', () => {
-      const url = getGhsaUrl('GHSA-abcd-efgh-ijkl')
-      expect(url).toBe('https://github.com/advisories/GHSA-abcd-efgh-ijkl')
-    })
-  })
-})
diff --git a/test/registry/json.test.ts b/test/registry/json.test.ts
deleted file mode 100644
index 355a67a..0000000
--- a/test/registry/json.test.ts
+++ /dev/null
@@ -1,424 +0,0 @@
-/**
- * @fileoverview Unit tests for JSON parsing utilities.
- */
-
-import { isJsonPrimitive, jsonParse } from '@socketsecurity/lib/json'
-import { describe, expect, it } from 'vitest'
-
-describe('json', () => {
-  describe('isJsonPrimitive', () => {
-    it('should return true for null', () => {
-      expect(isJsonPrimitive(null)).toBe(true)
-    })
-
-    it('should return true for boolean values', () => {
-      expect(isJsonPrimitive(true)).toBe(true)
-      expect(isJsonPrimitive(false)).toBe(true)
-    })
-
-    it('should return true for numbers', () => {
-      expect(isJsonPrimitive(0)).toBe(true)
-      expect(isJsonPrimitive(42)).toBe(true)
-      expect(isJsonPrimitive(-1)).toBe(true)
-      expect(isJsonPrimitive(3.14)).toBe(true)
-      expect(isJsonPrimitive(Number.NaN)).toBe(true)
-      expect(isJsonPrimitive(Number.POSITIVE_INFINITY)).toBe(true)
-      expect(isJsonPrimitive(Number.NEGATIVE_INFINITY)).toBe(true)
-    })
-
-    it('should return true for strings', () => {
-      expect(isJsonPrimitive('')).toBe(true)
-      expect(isJsonPrimitive('hello')).toBe(true)
-      expect(isJsonPrimitive('123')).toBe(true)
-    })
-
-    it('should return false for undefined', () => {
-      expect(isJsonPrimitive(undefined)).toBe(false)
-    })
-
-    it('should return false for objects', () => {
-      expect(isJsonPrimitive({})).toBe(false)
-      expect(isJsonPrimitive({ key: 'value' })).toBe(false)
-    })
-
-    it('should return false for arrays', () => {
-      expect(isJsonPrimitive([])).toBe(false)
-      expect(isJsonPrimitive([1, 2, 3])).toBe(false)
-    })
-
-    it('should return false for functions', () => {
-      expect(isJsonPrimitive(() => {})).toBe(false)
-    })
-
-    it('should return false for symbols', () => {
-      expect(isJsonPrimitive(Symbol('test'))).toBe(false)
-    })
-
-    it('should return false for BigInt', () => {
-      expect(isJsonPrimitive(BigInt(123))).toBe(false)
-    })
-  })
-
-  describe('jsonParse', () => {
-    describe('valid JSON parsing', () => {
-      it('should parse valid JSON string', () => {
-        const result = jsonParse('{"key":"value"}')
-        expect(result).toEqual({ key: 'value' })
-      })
-
-      it('should parse JSON array', () => {
-        const result = jsonParse('[1,2,3]')
-        expect(result).toEqual([1, 2, 3])
-      })
-
-      it('should parse JSON primitives', () => {
-        expect(jsonParse('null')).toBe(null)
-        expect(jsonParse('true')).toBe(true)
-        expect(jsonParse('false')).toBe(false)
-        expect(jsonParse('42')).toBe(42)
-        expect(jsonParse('"string"')).toBe('string')
-      })
-
-      it('should parse nested JSON objects', () => {
-        const json = '{"nested":{"key":"value"},"array":[1,2,3]}'
-        const result = jsonParse(json)
-        expect(result).toEqual({
-          nested: { key: 'value' },
-          array: [1, 2, 3],
-        })
-      })
-
-      it('should parse empty object', () => {
-        expect(jsonParse('{}')).toEqual({})
-      })
-
-      it('should parse empty array', () => {
-        expect(jsonParse('[]')).toEqual([])
-      })
-
-      it('should parse JSON with whitespace', () => {
-        const result = jsonParse('  { "key" : "value" }  ')
-        expect(result).toEqual({ key: 'value' })
-      })
-
-      it('should parse JSON with newlines', () => {
-        const json = `{
-          "key": "value",
-          "number": 42
-        }`
-        const result = jsonParse(json)
-        expect(result).toEqual({ key: 'value', number: 42 })
-      })
-    })
-
-    describe('Buffer support', () => {
-      it('should parse JSON from Buffer', () => {
-        const buffer = Buffer.from('{"key":"value"}', 'utf8')
-        const result = jsonParse(buffer)
-        expect(result).toEqual({ key: 'value' })
-      })
-
-      it('should parse JSON from Buffer with UTF-8 encoding', () => {
-        const buffer = Buffer.from('[1,2,3]', 'utf8')
-        const result = jsonParse(buffer)
-        expect(result).toEqual([1, 2, 3])
-      })
-
-      it('should handle Buffer with BOM', () => {
-        const buffer = Buffer.from('\uFEFF{"key":"value"}', 'utf8')
-        const result = jsonParse(buffer)
-        expect(result).toEqual({ key: 'value' })
-      })
-
-      it('should parse empty Buffer', () => {
-        const buffer = Buffer.from('null', 'utf8')
-        const result = jsonParse(buffer)
-        expect(result).toBe(null)
-      })
-    })
-
-    describe('BOM stripping', () => {
-      it('should strip BOM from beginning of string', () => {
-        const result = jsonParse('\uFEFF{"key":"value"}')
-        expect(result).toEqual({ key: 'value' })
-      })
-
-      it('should strip BOM from array', () => {
-        const result = jsonParse('\uFEFF[1,2,3]')
-        expect(result).toEqual([1, 2, 3])
-      })
-
-      it('should handle string without BOM', () => {
-        const result = jsonParse('{"key":"value"}')
-        expect(result).toEqual({ key: 'value' })
-      })
-    })
-
-    describe('reviver function', () => {
-      it('should use reviver function to transform values', () => {
-        const reviver = (_key: string, value: unknown) => {
-          if (typeof value === 'number') {
-            return value * 2
-          }
-          return value
-        }
-        const result = jsonParse('{"a":1,"b":2}', { reviver })
-        expect(result).toEqual({ a: 2, b: 4 })
-      })
-
-      it('should pass key to reviver', () => {
-        const keys: string[] = []
-        const reviver = (key: string, value: unknown) => {
-          keys.push(key)
-          return value
-        }
-        jsonParse('{"a":1}', { reviver })
-        expect(keys).toContain('a')
-        expect(keys).toContain('')
-      })
-
-      it('should allow reviver to filter values', () => {
-        const reviver = (key: string, value: unknown) => {
-          if (key === 'filter') {
-            return undefined
-          }
-          return value
-        }
-        const result = jsonParse('{"keep":"yes","filter":"no"}', { reviver })
-        expect(result).toEqual({ keep: 'yes' })
-      })
-
-      it('should handle reviver with nested objects', () => {
-        const reviver = (key: string, value: unknown) => {
-          if (key === 'nested' && typeof value === 'object') {
-            return 'replaced'
-          }
-          return value
-        }
-        const result = jsonParse('{"nested":{"key":"value"}}', { reviver })
-        expect(result).toEqual({ nested: 'replaced' })
-      })
-    })
-
-    describe('error handling with throws option', () => {
-      it('should throw error for invalid JSON by default', () => {
-        expect(() => jsonParse('invalid json')).toThrow()
-      })
-
-      it('should throw error when throws is true', () => {
-        expect(() => jsonParse('invalid json', { throws: true })).toThrow()
-      })
-
-      it('should throw error when throws is explicitly undefined', () => {
-        expect(() => jsonParse('invalid json', { throws: undefined })).toThrow()
-      })
-
-      it('should return undefined when throws is false', () => {
-        const result = jsonParse('invalid json', { throws: false })
-        expect(result).toBe(undefined)
-      })
-
-      it('should throw for malformed JSON object', () => {
-        expect(() => jsonParse('{invalid}')).toThrow()
-      })
-
-      it('should throw for unclosed JSON object', () => {
-        expect(() => jsonParse('{"key":"value"')).toThrow()
-      })
-
-      it('should throw for unclosed JSON array', () => {
-        expect(() => jsonParse('[1,2,3')).toThrow()
-      })
-
-      it('should throw for trailing comma', () => {
-        expect(() => jsonParse('{"key":"value",}')).toThrow()
-      })
-
-      it('should throw for single quotes', () => {
-        expect(() => jsonParse("{'key':'value'}")).toThrow()
-      })
-
-      it('should return undefined for empty string with throws false', () => {
-        const result = jsonParse('', { throws: false })
-        expect(result).toBe(undefined)
-      })
-
-      it('should throw for empty string by default', () => {
-        expect(() => jsonParse('')).toThrow()
-      })
-    })
-
-    describe('error handling with filepath option', () => {
-      it('should include filepath in error message', () => {
-        const filepath = '/path/to/file.json'
-        try {
-          jsonParse('invalid json', { filepath })
-          expect.fail('Should have thrown')
-        } catch (e) {
-          expect((e as Error).message).toContain(filepath)
-        }
-      })
-
-      it('should prepend filepath to error message', () => {
-        const filepath = '/test/file.json'
-        try {
-          jsonParse('{invalid}', { filepath })
-          expect.fail('Should have thrown')
-        } catch (e) {
-          expect((e as Error).message).toMatch(/^\/test\/file\.json:/)
-        }
-      })
-
-      it('should work with Buffer and filepath', () => {
-        const buffer = Buffer.from('invalid json', 'utf8')
-        const filepath = '/path/to/buffer.json'
-        try {
-          jsonParse(buffer, { filepath })
-          expect.fail('Should have thrown')
-        } catch (e) {
-          expect((e as Error).message).toContain(filepath)
-        }
-      })
-
-      it('should not modify error when throws is false', () => {
-        const result = jsonParse('invalid', {
-          filepath: '/test.json',
-          throws: false,
-        })
-        expect(result).toBe(undefined)
-      })
-
-      it('should handle empty filepath', () => {
-        try {
-          jsonParse('invalid', { filepath: '' })
-          expect.fail('Should have thrown')
-        } catch (e) {
-          expect(e).toBeInstanceOf(Error)
-        }
-      })
-    })
-
-    describe('combined options', () => {
-      it('should use reviver with filepath', () => {
-        const reviver = (_key: string, value: unknown) => value
-        const result = jsonParse('{"key":"value"}', {
-          filepath: '/test.json',
-          reviver,
-        })
-        expect(result).toEqual({ key: 'value' })
-      })
-
-      it('should use reviver with throws false', () => {
-        const reviver = (_key: string, value: unknown) => value
-        const result = jsonParse('{"key":"value"}', {
-          throws: false,
-          reviver,
-        })
-        expect(result).toEqual({ key: 'value' })
-      })
-
-      it('should use all options together', () => {
-        const reviver = (_key: string, value: unknown) => value
-        const result = jsonParse('{"key":"value"}', {
-          filepath: '/test.json',
-          throws: true,
-          reviver,
-        })
-        expect(result).toEqual({ key: 'value' })
-      })
-
-      it('should handle error with all options', () => {
-        const reviver = (_key: string, value: unknown) => value
-        const result = jsonParse('invalid', {
-          filepath: '/test.json',
-          throws: false,
-          reviver,
-        })
-        expect(result).toBe(undefined)
-      })
-    })
-
-    describe('edge cases', () => {
-      it('should parse JSON with special characters', () => {
-        const json = '{"special":"\\n\\t\\r\\b\\f\\"\\\\/"}'
-        const result = jsonParse(json)
-        expect(result).toEqual({ special: '\n\t\r\b\f"\\/' })
-      })
-
-      it('should parse JSON with unicode escapes', () => {
-        const json = '{"unicode":"\\u0048\\u0065\\u006c\\u006c\\u006f"}'
-        const result = jsonParse(json)
-        expect(result).toEqual({ unicode: 'Hello' })
-      })
-
-      it('should parse JSON with negative numbers', () => {
-        const result = jsonParse('{"negative":-42}')
-        expect(result).toEqual({ negative: -42 })
-      })
-
-      it('should parse JSON with scientific notation', () => {
-        const result = jsonParse('{"scientific":1.23e10}')
-        expect(result).toEqual({ scientific: 1.23e10 })
-      })
-
-      it('should parse JSON with very nested structure', () => {
-        const json = '{"a":{"b":{"c":{"d":{"e":"deep"}}}}}'
-        const result = jsonParse(json)
-        expect(result).toEqual({ a: { b: { c: { d: { e: 'deep' } } } } })
-      })
-
-      it('should parse large array', () => {
-        const array = Array.from({ length: 1000 }, (_, i) => i)
-        const json = JSON.stringify(array)
-        const result = jsonParse(json)
-        expect(result).toEqual(array)
-      })
-
-      it('should handle JSON with null values', () => {
-        const result = jsonParse('{"key":null}')
-        expect(result).toEqual({ key: null })
-      })
-
-      it('should handle mixed types in array', () => {
-        const result = jsonParse(
-          '[null,true,42,"string",{"key":"value"},[1,2]]',
-        )
-        expect(result).toEqual([
-          null,
-          true,
-          42,
-          'string',
-          { key: 'value' },
-          [1, 2],
-        ])
-      })
-
-      it('should handle zero', () => {
-        expect(jsonParse('0')).toBe(0)
-        expect(jsonParse('-0')).toBe(-0)
-      })
-
-      it('should handle empty string value', () => {
-        const result = jsonParse('{"empty":""}')
-        expect(result).toEqual({ empty: '' })
-      })
-    })
-
-    describe('options object behavior', () => {
-      it('should work with empty options object', () => {
-        const result = jsonParse('{"key":"value"}', {})
-        expect(result).toEqual({ key: 'value' })
-      })
-
-      it('should work without options', () => {
-        const result = jsonParse('{"key":"value"}')
-        expect(result).toEqual({ key: 'value' })
-      })
-
-      it('should work with undefined options', () => {
-        const result = jsonParse('{"key":"value"}', undefined)
-        expect(result).toEqual({ key: 'value' })
-      })
-    })
-  })
-})
diff --git a/test/registry/objects.test.ts b/test/registry/objects.test.ts
deleted file mode 100644
index 8e5088e..0000000
--- a/test/registry/objects.test.ts
+++ /dev/null
@@ -1,394 +0,0 @@
-/**
- * @fileoverview Unit tests for object manipulation utilities.
- */
-
-import {
-  createLazyGetter,
-  defineGetter,
-  defineLazyGetter,
-  entryKeyComparator,
-  getKeys,
-  getOwn,
-  getOwnPropertyValues,
-  hasKeys,
-  hasOwn,
-  isObject,
-  isObjectObject,
-  merge,
-  objectAssign,
-  objectEntries,
-  objectFreeze,
-  toSortedObject,
-  toSortedObjectFromEntries,
-} from '@socketsecurity/lib/objects'
-import { describe, expect, it } from 'vitest'
-
-describe('objects', () => {
-  describe('createLazyGetter', () => {
-    it('should create a lazy getter that memoizes result', () => {
-      let callCount = 0
-      const getter = createLazyGetter('test', () => {
-        callCount += 1
-        return 'computed'
-      })
-
-      expect(callCount).toBe(0)
-      expect(getter()).toBe('computed')
-      expect(callCount).toBe(1)
-      expect(getter()).toBe('computed')
-      expect(callCount).toBe(1) // Should not call again
-    })
-
-    it('should track initialization in stats', () => {
-      const stats = { initialized: new Set<PropertyKey>() }
-      const getter = createLazyGetter('myProp', () => 'value', stats)
-
-      expect(stats.initialized.has('myProp')).toBe(false)
-      getter()
-      expect(stats.initialized.has('myProp')).toBe(true)
-    })
-  })
-
-  describe('defineGetter', () => {
-    it('should define a getter property', () => {
-      const obj = {}
-      defineGetter(obj, 'test', () => 'value')
-
-      expect((obj as { test: string }).test).toBe('value')
-    })
-
-    it('should return the object', () => {
-      const obj = {}
-      const result = defineGetter(obj, 'test', () => 'value')
-      expect(result).toBe(obj)
-    })
-  })
-
-  describe('defineLazyGetter', () => {
-    it('should define a lazy getter property', () => {
-      const obj = {}
-      let callCount = 0
-      defineLazyGetter(obj, 'test', () => {
-        callCount += 1
-        return 'value'
-      })
-
-      expect(callCount).toBe(0)
-      expect((obj as { test: string }).test).toBe('value')
-      expect(callCount).toBe(1)
-      expect((obj as { test: string }).test).toBe('value')
-      expect(callCount).toBe(1)
-    })
-  })
-
-  describe('entryKeyComparator', () => {
-    it('should compare entry keys alphabetically', () => {
-      expect(entryKeyComparator(['a', 1], ['b', 2])).toBeLessThan(0)
-      expect(entryKeyComparator(['b', 1], ['a', 2])).toBeGreaterThan(0)
-      expect(entryKeyComparator(['a', 1], ['a', 2])).toBe(0)
-    })
-
-    it('should handle symbol keys', () => {
-      const sym1 = Symbol('a')
-      const sym2 = Symbol('b')
-      const result = entryKeyComparator([sym1, 1], [sym2, 2])
-      expect(typeof result).toBe('number')
-    })
-
-    it('should handle number keys', () => {
-      expect(entryKeyComparator([1, 'a'], [2, 'b'])).toBeLessThan(0)
-      expect(entryKeyComparator([2, 'a'], [1, 'b'])).toBeGreaterThan(0)
-    })
-  })
-
-  describe('getKeys', () => {
-    it('should return enumerable own keys', () => {
-      const obj = { a: 1, b: 2, c: 3 }
-      const keys = getKeys(obj)
-      expect(keys).toEqual(['a', 'b', 'c'])
-    })
-
-    it('should return empty array for non-objects', () => {
-      expect(getKeys(null)).toEqual([])
-      expect(getKeys(undefined)).toEqual([])
-      expect(getKeys(123)).toEqual([])
-      expect(getKeys('string')).toEqual([])
-    })
-
-    it('should return empty array for objects without keys', () => {
-      expect(getKeys({})).toEqual([])
-    })
-  })
-
-  describe('getOwn', () => {
-    it('should get own property value', () => {
-      const obj = { a: 1, b: 2 }
-      expect(getOwn(obj, 'a')).toBe(1)
-      expect(getOwn(obj, 'b')).toBe(2)
-    })
-
-    it('should return undefined for non-existent properties', () => {
-      const obj = { a: 1 }
-      expect(getOwn(obj, 'b')).toBeUndefined()
-    })
-
-    it('should return undefined for null/undefined', () => {
-      expect(getOwn(null, 'a')).toBeUndefined()
-      expect(getOwn(undefined, 'a')).toBeUndefined()
-    })
-
-    it('should not access prototype properties', () => {
-      const proto = { inherited: 'value' }
-      const obj = Object.create(proto)
-      obj.own = 'owned'
-      expect(getOwn(obj, 'own')).toBe('owned')
-      expect(getOwn(obj, 'inherited')).toBeUndefined()
-    })
-  })
-
-  describe('getOwnPropertyValues', () => {
-    it('should return all own property values', () => {
-      const obj = { a: 1, b: 2, c: 3 }
-      const values = getOwnPropertyValues(obj)
-      expect(values).toContain(1)
-      expect(values).toContain(2)
-      expect(values).toContain(3)
-      expect(values).toHaveLength(3)
-    })
-
-    it('should return empty array for null/undefined', () => {
-      expect(getOwnPropertyValues(null)).toEqual([])
-      expect(getOwnPropertyValues(undefined)).toEqual([])
-    })
-
-    it('should return empty array for objects without properties', () => {
-      expect(getOwnPropertyValues({})).toEqual([])
-    })
-  })
-
-  describe('hasKeys', () => {
-    it('should return true for objects with keys', () => {
-      expect(hasKeys({ a: 1 })).toBe(true)
-      expect(hasKeys({ a: 1, b: 2 })).toBe(true)
-    })
-
-    it('should return false for empty objects', () => {
-      expect(hasKeys({})).toBe(false)
-    })
-
-    it('should return false for null/undefined', () => {
-      expect(hasKeys(null)).toBe(false)
-      expect(hasKeys(undefined)).toBe(false)
-    })
-
-    it('should only check enumerable own properties', () => {
-      const obj = Object.create({ inherited: 1 })
-      expect(hasKeys(obj)).toBe(false)
-      obj.own = 1
-      expect(hasKeys(obj)).toBe(true)
-    })
-  })
-
-  describe('hasOwn', () => {
-    it('should return true for own properties', () => {
-      const obj = { a: 1, b: 2 }
-      expect(hasOwn(obj, 'a')).toBe(true)
-      expect(hasOwn(obj, 'b')).toBe(true)
-    })
-
-    it('should return false for non-existent properties', () => {
-      const obj = { a: 1 }
-      expect(hasOwn(obj, 'b')).toBe(false)
-    })
-
-    it('should return false for null/undefined', () => {
-      expect(hasOwn(null, 'a')).toBe(false)
-      expect(hasOwn(undefined, 'a')).toBe(false)
-    })
-
-    it('should not detect inherited properties', () => {
-      const proto = { inherited: 1 }
-      const obj = Object.create(proto)
-      expect(hasOwn(obj, 'inherited')).toBe(false)
-    })
-  })
-
-  describe('isObject', () => {
-    it('should return true for objects', () => {
-      expect(isObject({})).toBe(true)
-      expect(isObject({ a: 1 })).toBe(true)
-      expect(isObject([])).toBe(true)
-      expect(isObject(new Date())).toBe(true)
-    })
-
-    it('should return false for primitives', () => {
-      expect(isObject(null)).toBe(false)
-      expect(isObject(undefined)).toBe(false)
-      expect(isObject(123)).toBe(false)
-      expect(isObject('string')).toBe(false)
-      expect(isObject(true)).toBe(false)
-    })
-  })
-
-  describe('isObjectObject', () => {
-    it('should return true for plain objects', () => {
-      expect(isObjectObject({})).toBe(true)
-      expect(isObjectObject({ a: 1 })).toBe(true)
-      expect(isObjectObject(Object.create(null))).toBe(true)
-    })
-
-    it('should return false for arrays', () => {
-      expect(isObjectObject([])).toBe(false)
-      expect(isObjectObject([1, 2, 3])).toBe(false)
-    })
-
-    it('should return false for other objects', () => {
-      expect(isObjectObject(new Date())).toBe(false)
-      expect(isObjectObject(new Map())).toBe(false)
-      expect(isObjectObject(new Set())).toBe(false)
-    })
-
-    it('should return false for primitives', () => {
-      expect(isObjectObject(null)).toBe(false)
-      expect(isObjectObject(undefined)).toBe(false)
-      expect(isObjectObject(123)).toBe(false)
-    })
-  })
-
-  describe('objectAssign', () => {
-    it('should copy properties from source to target', () => {
-      const target = { a: 1 }
-      const source = { b: 2, c: 3 }
-      const result = objectAssign(target, source)
-      expect(result).toBe(target)
-      expect(result).toEqual({ a: 1, b: 2, c: 3 })
-    })
-
-    it('should handle multiple sources', () => {
-      const result = objectAssign({}, { a: 1 }, { b: 2 }, { c: 3 })
-      expect(result).toEqual({ a: 1, b: 2, c: 3 })
-    })
-
-    it('should overwrite existing properties', () => {
-      const result = objectAssign({ a: 1 }, { a: 2 })
-      expect(result).toEqual({ a: 2 })
-    })
-  })
-
-  describe('objectEntries', () => {
-    it('should return entries for objects', () => {
-      const obj = { a: 1, b: 2 }
-      const entries = objectEntries(obj)
-      expect(entries).toContainEqual(['a', 1])
-      expect(entries).toContainEqual(['b', 2])
-    })
-
-    it('should return empty array for null/undefined', () => {
-      expect(objectEntries(null)).toEqual([])
-      expect(objectEntries(undefined)).toEqual([])
-    })
-
-    it('should include symbol keys', () => {
-      const sym = Symbol('test')
-      const obj = { [sym]: 'value', a: 1 }
-      const entries = objectEntries(obj)
-      expect(entries).toContainEqual([sym, 'value'])
-      expect(entries).toContainEqual(['a', 1])
-    })
-  })
-
-  describe('objectFreeze', () => {
-    it('should freeze an object', () => {
-      const obj = { a: 1 }
-      const frozen = objectFreeze(obj)
-      expect(Object.isFrozen(frozen)).toBe(true)
-    })
-
-    it('should prevent modifications', () => {
-      const obj = { a: 1 }
-      const frozen = objectFreeze(obj)
-      expect(() => {
-        ;(frozen as { a: number; b?: number }).b = 2
-      }).toThrow()
-    })
-  })
-
-  describe('merge', () => {
-    it('should deep merge objects', () => {
-      const target = { a: 1, b: { c: 2 } }
-      const source = { b: { d: 3 }, e: 4 }
-      const result = merge(target, source)
-      expect(result).toEqual({ a: 1, b: { c: 2, d: 3 }, e: 4 })
-    })
-
-    it('should replace arrays instead of merging', () => {
-      const target = { a: [1, 2] }
-      const source = { a: [3, 4] }
-      const result = merge(target, source)
-      expect(result).toEqual({ a: [3, 4] })
-    })
-
-    it('should handle nested objects', () => {
-      const target = { a: { b: { c: 1 } } }
-      const source = { a: { b: { d: 2 } } }
-      const result = merge(target, source)
-      expect(result).toEqual({ a: { b: { c: 1, d: 2 } } })
-    })
-
-    it('should handle non-object inputs', () => {
-      expect(merge(null as unknown as object, { a: 1 })).toBeNull()
-      expect(merge({ a: 1 }, null as unknown as object)).toEqual({ a: 1 })
-    })
-  })
-
-  describe('toSortedObject', () => {
-    it('should sort object keys alphabetically', () => {
-      const obj = { c: 3, a: 1, b: 2 }
-      const sorted = toSortedObject(obj)
-      expect(Object.keys(sorted)).toEqual(['a', 'b', 'c'])
-    })
-
-    it('should preserve values', () => {
-      const obj = { c: 3, a: 1, b: 2 }
-      const sorted = toSortedObject(obj)
-      expect(sorted).toEqual({ a: 1, b: 2, c: 3 })
-    })
-
-    it('should handle empty objects', () => {
-      const sorted = toSortedObject({})
-      expect(sorted).toEqual({})
-    })
-  })
-
-  describe('toSortedObjectFromEntries', () => {
-    it('should create sorted object from entries', () => {
-      const entries: Array<[PropertyKey, number]> = [
-        ['c', 3],
-        ['a', 1],
-        ['b', 2],
-      ]
-      const sorted = toSortedObjectFromEntries(entries)
-      expect(Object.keys(sorted)).toEqual(['a', 'b', 'c'])
-      expect(sorted).toEqual({ a: 1, b: 2, c: 3 })
-    })
-
-    it('should handle symbol keys', () => {
-      const sym1 = Symbol('a')
-      const sym2 = Symbol('b')
-      const entries: Array<[PropertyKey, number]> = [
-        [sym2, 2],
-        ['a', 1],
-        [sym1, 3],
-      ]
-      const sorted = toSortedObjectFromEntries(entries)
-      expect(sorted).toHaveProperty('a')
-      expect(sorted[sym1]).toBe(3)
-      expect(sorted[sym2]).toBe(2)
-    })
-
-    it('should handle empty entries', () => {
-      const sorted = toSortedObjectFromEntries([])
-      expect(sorted).toEqual({})
-    })
-  })
-})
diff --git a/test/registry/paths.test.ts b/test/registry/paths.test.ts
deleted file mode 100644
index eaf2c10..0000000
--- a/test/registry/paths.test.ts
+++ /dev/null
@@ -1,458 +0,0 @@
-/**
- * @fileoverview Unit tests for Socket ecosystem path utilities.
- */
-
-import {
-  getSocketAppCacheDir,
-  getSocketAppCacheTtlDir,
-  getSocketAppDir,
-  getSocketCacacheDir,
-  getSocketCliDir,
-  getSocketDlxDir,
-  getSocketHomePath,
-  getSocketRegistryDir,
-  getSocketRegistryGithubCacheDir,
-  getSocketUserDir,
-} from '@socketsecurity/lib/paths'
-import { describe, expect, it } from 'vitest'
-
-describe('paths', () => {
-  describe('getSocketHomePath', () => {
-    it('should return the Socket home directory', () => {
-      const result = getSocketHomePath()
-      expect(result).toBeTruthy()
-      expect(result).toContain('.socket')
-      expect(typeof result).toBe('string')
-    })
-
-    it('should be an alias for getSocketUserDir', () => {
-      const homePath = getSocketHomePath()
-      const userDir = getSocketUserDir()
-      expect(homePath).toBe(userDir)
-    })
-
-    it('should return normalized path', () => {
-      const result = getSocketHomePath()
-      expect(result).not.toContain('\\')
-      if (process.platform === 'win32') {
-        expect(result).toMatch(/^[A-Za-z]:\//)
-      } else {
-        expect(result).toMatch(/^\//)
-      }
-    })
-  })
-
-  describe('getSocketUserDir', () => {
-    it('should return the Socket user directory', () => {
-      const result = getSocketUserDir()
-      expect(result).toBeTruthy()
-      expect(result).toContain('.socket')
-      expect(typeof result).toBe('string')
-    })
-
-    it('should end with .socket directory', () => {
-      const result = getSocketUserDir()
-      expect(result).toMatch(/\.socket$/)
-    })
-
-    it('should be absolute path', () => {
-      const result = getSocketUserDir()
-      if (process.platform === 'win32') {
-        expect(result).toMatch(/^[A-Za-z]:\//)
-      } else {
-        expect(result).toMatch(/^\//)
-      }
-    })
-
-    it('should use forward slashes', () => {
-      const result = getSocketUserDir()
-      expect(result).not.toContain('\\')
-    })
-  })
-
-  describe('getSocketAppDir', () => {
-    it('should return app directory with underscore prefix', () => {
-      const result = getSocketAppDir('myapp')
-      expect(result).toContain('.socket/_myapp')
-    })
-
-    it('should work with different app names', () => {
-      const app1 = getSocketAppDir('app1')
-      const app2 = getSocketAppDir('app2')
-      expect(app1).toContain('_app1')
-      expect(app2).toContain('_app2')
-      expect(app1).not.toBe(app2)
-    })
-
-    it('should return normalized path', () => {
-      const result = getSocketAppDir('test')
-      expect(result).not.toContain('\\')
-    })
-
-    it('should handle empty app name', () => {
-      const result = getSocketAppDir('')
-      expect(result).toContain('.socket/_')
-      expect(result).toMatch(/\/_$/)
-    })
-
-    it('should handle app name with special characters', () => {
-      const result = getSocketAppDir('my-app.test')
-      expect(result).toContain('_my-app.test')
-    })
-
-    it('should be under Socket user directory', () => {
-      const userDir = getSocketUserDir()
-      const appDir = getSocketAppDir('test')
-      expect(appDir).toContain(userDir)
-    })
-  })
-
-  describe('getSocketCacacheDir', () => {
-    it('should return cacache directory', () => {
-      const result = getSocketCacacheDir()
-      expect(result).toContain('.socket/_cacache')
-    })
-
-    it('should return normalized path', () => {
-      const result = getSocketCacacheDir()
-      expect(result).not.toContain('\\')
-    })
-
-    it('should be under Socket user directory when env var not set', () => {
-      const userDir = getSocketUserDir()
-      const cacacheDir = getSocketCacacheDir()
-      expect(cacacheDir).toContain(userDir)
-    })
-  })
-
-  describe('getSocketDlxDir', () => {
-    it('should return DLX directory', () => {
-      const result = getSocketDlxDir()
-      expect(result).toContain('.socket/_dlx')
-    })
-
-    it('should return normalized path', () => {
-      const result = getSocketDlxDir()
-      expect(result).not.toContain('\\')
-    })
-
-    it('should be under Socket user directory', () => {
-      const userDir = getSocketUserDir()
-      const dlxDir = getSocketDlxDir()
-      expect(dlxDir).toContain(userDir)
-    })
-  })
-
-  describe('getSocketAppCacheDir', () => {
-    it('should return app cache directory', () => {
-      const result = getSocketAppCacheDir('myapp')
-      expect(result).toContain('.socket/_myapp/cache')
-    })
-
-    it('should be under app directory', () => {
-      const appDir = getSocketAppDir('test')
-      const cacheDir = getSocketAppCacheDir('test')
-      expect(cacheDir).toContain(appDir)
-      expect(cacheDir).toMatch(/cache$/)
-    })
-
-    it('should return normalized path', () => {
-      const result = getSocketAppCacheDir('test')
-      expect(result).not.toContain('\\')
-    })
-
-    it('should work with different app names', () => {
-      const cache1 = getSocketAppCacheDir('app1')
-      const cache2 = getSocketAppCacheDir('app2')
-      expect(cache1).toContain('_app1/cache')
-      expect(cache2).toContain('_app2/cache')
-      expect(cache1).not.toBe(cache2)
-    })
-
-    it('should handle empty app name', () => {
-      const result = getSocketAppCacheDir('')
-      expect(result).toContain('.socket/_/cache')
-    })
-  })
-
-  describe('getSocketAppCacheTtlDir', () => {
-    it('should return app TTL cache directory', () => {
-      const result = getSocketAppCacheTtlDir('myapp')
-      expect(result).toContain('.socket/_myapp/cache/ttl')
-    })
-
-    it('should be under app cache directory', () => {
-      const cacheDir = getSocketAppCacheDir('test')
-      const ttlDir = getSocketAppCacheTtlDir('test')
-      expect(ttlDir).toContain(cacheDir)
-      expect(ttlDir).toMatch(/ttl$/)
-    })
-
-    it('should return normalized path', () => {
-      const result = getSocketAppCacheTtlDir('test')
-      expect(result).not.toContain('\\')
-    })
-
-    it('should work with different app names', () => {
-      const ttl1 = getSocketAppCacheTtlDir('app1')
-      const ttl2 = getSocketAppCacheTtlDir('app2')
-      expect(ttl1).toContain('_app1/cache/ttl')
-      expect(ttl2).toContain('_app2/cache/ttl')
-      expect(ttl1).not.toBe(ttl2)
-    })
-
-    it('should handle empty app name', () => {
-      const result = getSocketAppCacheTtlDir('')
-      expect(result).toContain('.socket/_/cache/ttl')
-    })
-  })
-
-  describe('getSocketCliDir', () => {
-    it('should return Socket CLI directory', () => {
-      const result = getSocketCliDir()
-      expect(result).toContain('.socket/_socket')
-    })
-
-    it('should be an app directory', () => {
-      const cliDir = getSocketCliDir()
-      const appDir = getSocketAppDir('socket')
-      expect(cliDir).toBe(appDir)
-    })
-
-    it('should return normalized path', () => {
-      const result = getSocketCliDir()
-      expect(result).not.toContain('\\')
-    })
-
-    it('should be under Socket user directory', () => {
-      const userDir = getSocketUserDir()
-      const cliDir = getSocketCliDir()
-      expect(cliDir).toContain(userDir)
-    })
-  })
-
-  describe('getSocketRegistryDir', () => {
-    it('should return Socket Registry directory', () => {
-      const result = getSocketRegistryDir()
-      expect(result).toContain('.socket/_registry')
-    })
-
-    it('should be an app directory', () => {
-      const registryDir = getSocketRegistryDir()
-      const appDir = getSocketAppDir('registry')
-      expect(registryDir).toBe(appDir)
-    })
-
-    it('should return normalized path', () => {
-      const result = getSocketRegistryDir()
-      expect(result).not.toContain('\\')
-    })
-
-    it('should be under Socket user directory', () => {
-      const userDir = getSocketUserDir()
-      const registryDir = getSocketRegistryDir()
-      expect(registryDir).toContain(userDir)
-    })
-  })
-
-  describe('getSocketRegistryGithubCacheDir', () => {
-    it('should return Socket Registry GitHub cache directory', () => {
-      const result = getSocketRegistryGithubCacheDir()
-      expect(result).toContain('.socket/_registry/cache/ttl/github')
-    })
-
-    it('should be under Registry TTL cache directory', () => {
-      const ttlDir = getSocketAppCacheTtlDir('registry')
-      const githubDir = getSocketRegistryGithubCacheDir()
-      expect(githubDir).toContain(ttlDir)
-      expect(githubDir).toMatch(/github$/)
-    })
-
-    it('should return normalized path', () => {
-      const result = getSocketRegistryGithubCacheDir()
-      expect(result).not.toContain('\\')
-    })
-
-    it('should be under Socket user directory', () => {
-      const userDir = getSocketUserDir()
-      const githubDir = getSocketRegistryGithubCacheDir()
-      expect(githubDir).toContain(userDir)
-    })
-  })
-
-  describe('path hierarchy', () => {
-    it('should maintain correct directory hierarchy', () => {
-      const userDir = getSocketUserDir()
-      const appDir = getSocketAppDir('test')
-      const cacheDir = getSocketAppCacheDir('test')
-      const ttlDir = getSocketAppCacheTtlDir('test')
-
-      // User dir should be the base
-      expect(appDir).toContain(userDir)
-      expect(cacheDir).toContain(userDir)
-      expect(ttlDir).toContain(userDir)
-
-      // Cache dir should be under app dir
-      expect(cacheDir).toContain(appDir)
-
-      // TTL dir should be under cache dir
-      expect(ttlDir).toContain(cacheDir)
-    })
-
-    it('should have consistent path structure', () => {
-      const paths = [
-        getSocketUserDir(),
-        getSocketAppDir('test'),
-        getSocketCacacheDir(),
-        getSocketDlxDir(),
-        getSocketCliDir(),
-        getSocketRegistryDir(),
-        getSocketAppCacheDir('test'),
-        getSocketAppCacheTtlDir('test'),
-        getSocketRegistryGithubCacheDir(),
-      ]
-
-      // All paths should be non-empty strings
-      paths.forEach(path => {
-        expect(typeof path).toBe('string')
-        expect(path.length).toBeGreaterThan(0)
-      })
-
-      // All paths should use forward slashes (normalized)
-      paths.forEach(path => {
-        expect(path).not.toContain('\\')
-      })
-
-      // All paths should contain .socket
-      paths.forEach(path => {
-        expect(path).toContain('.socket')
-      })
-    })
-
-    it('should generate unique paths for different apps', () => {
-      const app1Dir = getSocketAppDir('app1')
-      const app2Dir = getSocketAppDir('app2')
-      const app1Cache = getSocketAppCacheDir('app1')
-      const app2Cache = getSocketAppCacheDir('app2')
-
-      expect(app1Dir).not.toBe(app2Dir)
-      expect(app1Cache).not.toBe(app2Cache)
-    })
-  })
-
-  describe('cross-platform compatibility', () => {
-    it('should handle home directory correctly on different platforms', () => {
-      const userDir = getSocketUserDir()
-
-      if (process.platform === 'win32') {
-        // Windows paths should have drive letter and forward slashes after normalization
-        expect(userDir).toMatch(/^[A-Za-z]:\//)
-        expect(userDir).not.toContain('\\')
-      } else {
-        // Unix-like paths should start with /
-        expect(userDir).toMatch(/^\//)
-      }
-    })
-
-    it('should return absolute paths on all platforms', () => {
-      const paths = [
-        getSocketUserDir(),
-        getSocketAppDir('test'),
-        getSocketCacacheDir(),
-        getSocketDlxDir(),
-      ]
-
-      paths.forEach(path => {
-        if (process.platform === 'win32') {
-          expect(path).toMatch(/^[A-Za-z]:\//)
-        } else {
-          expect(path).toMatch(/^\//)
-        }
-      })
-    })
-
-    it('should not contain backslashes in normalized paths', () => {
-      const paths = [
-        getSocketUserDir(),
-        getSocketAppDir('test'),
-        getSocketCacacheDir(),
-        getSocketDlxDir(),
-        getSocketAppCacheDir('test'),
-        getSocketAppCacheTtlDir('test'),
-      ]
-
-      paths.forEach(path => {
-        expect(path).not.toContain('\\')
-      })
-    })
-  })
-
-  describe('edge cases', () => {
-    it('should handle app names with various characters', () => {
-      const testCases = [
-        'simple',
-        'with-dash',
-        'with.dot',
-        'with_underscore',
-        'MixedCase',
-        '123numeric',
-      ]
-
-      testCases.forEach(appName => {
-        const result = getSocketAppDir(appName)
-        expect(result).toContain(`_${appName}`)
-        expect(result).toContain('.socket')
-      })
-    })
-
-    it('should handle empty string app name gracefully', () => {
-      const result = getSocketAppDir('')
-      expect(result).toContain('.socket/_')
-      expect(typeof result).toBe('string')
-    })
-
-    it('should return consistent results on multiple calls', () => {
-      const call1 = getSocketUserDir()
-      const call2 = getSocketUserDir()
-      const call3 = getSocketUserDir()
-
-      expect(call1).toBe(call2)
-      expect(call2).toBe(call3)
-    })
-
-    it('should return consistent results for same app name', () => {
-      const call1 = getSocketAppDir('test')
-      const call2 = getSocketAppDir('test')
-      const call3 = getSocketAppDir('test')
-
-      expect(call1).toBe(call2)
-      expect(call2).toBe(call3)
-    })
-  })
-
-  describe('specific app directories', () => {
-    it('should generate correct CLI directory', () => {
-      const cliDir = getSocketCliDir()
-      expect(cliDir).toContain('_socket')
-      expect(cliDir).toMatch(/\/_socket$/)
-    })
-
-    it('should generate correct Registry directory', () => {
-      const registryDir = getSocketRegistryDir()
-      expect(registryDir).toContain('_registry')
-      expect(registryDir).toMatch(/\/_registry$/)
-    })
-
-    it('should generate correct DLX directory', () => {
-      const dlxDir = getSocketDlxDir()
-      expect(dlxDir).toContain('_dlx')
-      expect(dlxDir).toMatch(/\/_dlx$/)
-    })
-
-    it('should generate correct cacache directory', () => {
-      const cacacheDir = getSocketCacacheDir()
-      expect(cacacheDir).toContain('_cacache')
-      expect(cacacheDir).toMatch(/\/_cacache$/)
-    })
-  })
-})
diff --git a/test/registry/promises.test.ts b/test/registry/promises.test.ts
deleted file mode 100644
index 70451da..0000000
--- a/test/registry/promises.test.ts
+++ /dev/null
@@ -1,285 +0,0 @@
-/**
- * @fileoverview Unit tests for promise utilities.
- */
-
-import {
-  normalizeIterationOptions,
-  normalizeRetryOptions,
-  pEach,
-  pFilter,
-  pRetry,
-  resolveRetryOptions,
-} from '@socketsecurity/lib/promises'
-import { describe, expect, it, vi } from 'vitest'
-
-describe('promises', () => {
-  describe('resolveRetryOptions', () => {
-    it('should resolve number to retries option', () => {
-      const options = resolveRetryOptions(3)
-      expect(options.retries).toBe(3)
-      expect(options.minTimeout).toBe(200)
-      expect(options.maxTimeout).toBe(10_000)
-    })
-
-    it('should merge provided options with defaults', () => {
-      const options = resolveRetryOptions({ retries: 5, minTimeout: 100 })
-      expect(options.retries).toBe(5)
-      expect(options.minTimeout).toBe(100)
-      expect(options.maxTimeout).toBe(10_000)
-    })
-
-    it('should return defaults when no options provided', () => {
-      const options = resolveRetryOptions()
-      expect(options.retries).toBe(0)
-      expect(options.minTimeout).toBe(200)
-      expect(options.maxTimeout).toBe(10_000)
-    })
-  })
-
-  describe('normalizeRetryOptions', () => {
-    it('should normalize retry options with defaults', () => {
-      const options = normalizeRetryOptions(3)
-      expect(options.retries).toBe(3)
-      expect(options.backoffFactor).toBe(2)
-      expect(options.baseDelayMs).toBe(200)
-      expect(options.maxDelayMs).toBe(10_000)
-      expect(options.jitter).toBe(true)
-    })
-
-    it('should use custom backoff factor', () => {
-      const options = normalizeRetryOptions({ retries: 3, backoffFactor: 3 })
-      expect(options.backoffFactor).toBe(3)
-    })
-
-    it('should use factor as backoffFactor fallback', () => {
-      const options = normalizeRetryOptions({ retries: 3, factor: 1.5 })
-      expect(options.backoffFactor).toBe(1.5)
-    })
-
-    it('should include all retry options', () => {
-      const onRetry = vi.fn()
-      const options = normalizeRetryOptions({
-        onRetry,
-        onRetryCancelOnFalse: true,
-        onRetryRethrow: true,
-        retries: 3,
-      })
-      expect(options.onRetry).toBe(onRetry)
-      expect(options.onRetryCancelOnFalse).toBe(true)
-      expect(options.onRetryRethrow).toBe(true)
-    })
-  })
-
-  describe('normalizeIterationOptions', () => {
-    it('should normalize number as concurrency', () => {
-      const options = normalizeIterationOptions(5)
-      expect(options.concurrency).toBe(5)
-    })
-
-    it('should normalize object options', () => {
-      const options = normalizeIterationOptions({ concurrency: 3, retries: 2 })
-      expect(options.concurrency).toBe(3)
-      expect(options.retries.retries).toBe(2)
-    })
-
-    it('should default concurrency to 1', () => {
-      const options = normalizeIterationOptions()
-      expect(options.concurrency).toBe(1)
-    })
-
-    it('should ensure minimum concurrency of 1', () => {
-      const options = normalizeIterationOptions({ concurrency: 0 })
-      expect(options.concurrency).toBe(1)
-    })
-  })
-
-  describe('pRetry', () => {
-    it('should return result on success', async () => {
-      const fn = vi.fn().mockResolvedValue('success')
-      const result = await pRetry(fn)
-      expect(result).toBe('success')
-      expect(fn).toHaveBeenCalledTimes(1)
-    })
-
-    it('should retry on failure', async () => {
-      let attempts = 0
-      const fn = vi.fn().mockImplementation(async () => {
-        attempts += 1
-        if (attempts < 3) {
-          throw new Error('fail')
-        }
-        return 'success'
-      })
-
-      const result = await pRetry(fn, { retries: 3, baseDelayMs: 10 })
-      expect(result).toBe('success')
-      expect(fn).toHaveBeenCalledTimes(3)
-    })
-
-    it('should throw error after all retries exhausted', async () => {
-      const fn = vi.fn().mockRejectedValue(new Error('fail'))
-      await expect(pRetry(fn, { retries: 2, baseDelayMs: 10 })).rejects.toThrow(
-        'fail',
-      )
-      expect(fn).toHaveBeenCalledTimes(3) // Initial + 2 retries
-    })
-
-    it('should respect abort signal', async () => {
-      const controller = new AbortController()
-      const fn = vi.fn().mockImplementation(async () => {
-        controller.abort()
-        throw new Error('fail')
-      })
-
-      const result = await pRetry(fn, {
-        retries: 3,
-        signal: controller.signal,
-      })
-      expect(result).toBeUndefined()
-      expect(fn).toHaveBeenCalledTimes(1)
-    })
-
-    it('should call onRetry callback', async () => {
-      let attempts = 0
-      const fn = vi.fn().mockImplementation(async () => {
-        attempts += 1
-        if (attempts < 2) {
-          throw new Error('fail')
-        }
-        return 'success'
-      })
-      const onRetry = vi.fn()
-
-      await pRetry(fn, { retries: 2, baseDelayMs: 10, onRetry })
-      expect(onRetry).toHaveBeenCalledTimes(1)
-      expect(onRetry).toHaveBeenCalledWith(
-        1,
-        expect.any(Error),
-        expect.any(Number),
-      )
-    })
-
-    it('should cancel retry if onRetry returns false', async () => {
-      const fn = vi.fn().mockRejectedValue(new Error('fail'))
-      const onRetry = vi.fn().mockReturnValue(false)
-
-      await expect(
-        pRetry(fn, {
-          onRetry,
-          onRetryCancelOnFalse: true,
-          retries: 3,
-        }),
-      ).rejects.toThrow('fail')
-      expect(fn).toHaveBeenCalledTimes(1)
-      expect(onRetry).toHaveBeenCalledTimes(1)
-    })
-
-    it('should not retry if retries is 0', async () => {
-      const fn = vi.fn().mockResolvedValue('success')
-      const result = await pRetry(fn, { retries: 0 })
-      expect(result).toBe('success')
-      expect(fn).toHaveBeenCalledTimes(1)
-    })
-  })
-
-  describe('pEach', () => {
-    it('should process all items', async () => {
-      const items = [1, 2, 3, 4]
-      const results: number[] = []
-      await pEach(items, async item => {
-        results.push(item)
-      })
-      expect(results).toEqual([1, 2, 3, 4])
-    })
-
-    it('should respect concurrency limit', async () => {
-      const items = [1, 2, 3, 4, 5, 6]
-      const active: number[] = []
-      const maxActive: number[] = []
-
-      await pEach(
-        items,
-        async item => {
-          active.push(item)
-          maxActive.push(active.length)
-          await new Promise(resolve => setTimeout(resolve, 10))
-          active.splice(active.indexOf(item), 1)
-        },
-        { concurrency: 2 },
-      )
-
-      expect(Math.max(...maxActive)).toBeLessThanOrEqual(2)
-    })
-
-    it('should handle empty arrays', async () => {
-      const fn = vi.fn()
-      await pEach([], fn)
-      expect(fn).not.toHaveBeenCalled()
-    })
-
-    it('should respect abort signal', async () => {
-      const controller = new AbortController()
-      const items = [1, 2, 3, 4]
-      const processed: number[] = []
-
-      setTimeout(() => controller.abort(), 20)
-
-      await pEach(
-        items,
-        async item => {
-          await new Promise(resolve => setTimeout(resolve, 15))
-          processed.push(item)
-        },
-        { signal: controller.signal, concurrency: 1 },
-      )
-
-      expect(processed.length).toBeLessThan(items.length)
-    })
-  })
-
-  describe('pFilter', () => {
-    it('should filter items based on predicate', async () => {
-      const items = [1, 2, 3, 4, 5, 6]
-      const result = await pFilter(items, async item => item % 2 === 0)
-      expect(result).toEqual([2, 4, 6])
-    })
-
-    it('should handle empty arrays', async () => {
-      const result = await pFilter([], async () => true)
-      expect(result).toEqual([])
-    })
-
-    it('should respect concurrency limit', async () => {
-      const items = [1, 2, 3, 4, 5, 6]
-      let maxActive = 0
-      let active = 0
-
-      const result = await pFilter(
-        items,
-        async item => {
-          active += 1
-          maxActive = Math.max(maxActive, active)
-          await new Promise(resolve => setTimeout(resolve, 10))
-          active -= 1
-          return item % 2 === 0
-        },
-        { concurrency: 2 },
-      )
-
-      expect(result).toEqual([2, 4, 6])
-      expect(maxActive).toBeLessThanOrEqual(2)
-    })
-
-    it('should return empty array when no items match', async () => {
-      const items = [1, 3, 5, 7]
-      const result = await pFilter(items, async item => item % 2 === 0)
-      expect(result).toEqual([])
-    })
-
-    it('should return all items when all match', async () => {
-      const items = [2, 4, 6, 8]
-      const result = await pFilter(items, async item => item % 2 === 0)
-      expect(result).toEqual([2, 4, 6, 8])
-    })
-  })
-})
diff --git a/test/registry/spinner.test.ts b/test/registry/spinner.test.ts
deleted file mode 100644
index 63b6377..0000000
--- a/test/registry/spinner.test.ts
+++ /dev/null
@@ -1,196 +0,0 @@
-import type { Spinner as SpinnerType } from '@socketsecurity/lib/spinner'
-import { Spinner } from '@socketsecurity/lib/spinner'
-import { beforeEach, describe, expect, it } from 'vitest'
-
-describe('Spinner', () => {
-  let spinner: SpinnerType
-
-  beforeEach(() => {
-    spinner = Spinner({ text: 'Testing' })
-  })
-
-  describe('shimmer() method', () => {
-    describe('toggle on/off', () => {
-      it('should disable shimmer with shimmer(false)', () => {
-        // Start with shimmer enabled.
-        spinner = Spinner({ shimmer: 'ltr', text: 'Test' })
-
-        // Disable shimmer - should not throw.
-        expect(() => spinner.shimmer(false)).not.toThrow()
-
-        // Should still be the same spinner instance.
-        expect(spinner).toBeDefined()
-      })
-
-      it('should re-enable shimmer with shimmer(true) after toggling off', () => {
-        // Start with shimmer enabled with specific config.
-        spinner = Spinner({ shimmer: { dir: 'rtl', speed: 0.5 }, text: 'Test' })
-
-        // Toggle off.
-        spinner.shimmer(false)
-
-        // Toggle back on - should restore saved config without error.
-        expect(() => spinner.shimmer(true)).not.toThrow()
-      })
-
-      it('should use defaults when shimmer(true) with no previous config', () => {
-        // Start without shimmer.
-        spinner = Spinner({ text: 'Test' })
-
-        // Enable shimmer with defaults - should not throw.
-        expect(() => spinner.shimmer(true)).not.toThrow()
-      })
-    })
-
-    describe('partial config updates', () => {
-      it('should update speed without affecting other properties', () => {
-        // Start with shimmer.
-        spinner = Spinner({
-          shimmer: { dir: 'ltr', speed: 1 / 3 },
-          text: 'Test',
-        })
-
-        // Update only speed - should not throw.
-        expect(() => spinner.shimmer({ speed: 0.5 })).not.toThrow()
-      })
-
-      it('should update direction without affecting other properties', () => {
-        // Start with shimmer.
-        spinner = Spinner({
-          shimmer: { dir: 'ltr', speed: 1 / 3 },
-          text: 'Test',
-        })
-
-        // Update only direction - should not throw.
-        expect(() => spinner.shimmer({ dir: 'rtl' })).not.toThrow()
-      })
-
-      it('should update color without affecting other properties', () => {
-        // Start with shimmer.
-        spinner = Spinner({ shimmer: 'ltr', text: 'Test' })
-
-        // Update only color - should not throw.
-        expect(() =>
-          spinner.shimmer({ color: [255, 0, 0] as const }),
-        ).not.toThrow()
-      })
-
-      it('should handle direction string shorthand', () => {
-        // Start without shimmer.
-        spinner = Spinner({ text: 'Test' })
-
-        // Set direction via string - should not throw.
-        expect(() => spinner.shimmer('rtl')).not.toThrow()
-      })
-
-      it('should update existing shimmer direction via string', () => {
-        // Start with shimmer.
-        spinner = Spinner({ shimmer: 'ltr', text: 'Test' })
-
-        // Change direction via string - should not throw.
-        expect(() => spinner.shimmer('rtl')).not.toThrow()
-      })
-    })
-
-    describe('config preservation', () => {
-      it('should preserve full config when toggling off and back on', () => {
-        // Start with custom config.
-        const customConfig = {
-          color: [255, 100, 50] as const,
-          dir: 'rtl' as const,
-          speed: 0.25,
-        }
-        spinner = Spinner({ shimmer: customConfig, text: 'Test' })
-
-        // Toggle off.
-        spinner.shimmer(false)
-
-        // Toggle back on.
-        spinner.shimmer(true)
-
-        // Make a partial update to verify config was preserved - should not throw.
-        expect(() => spinner.shimmer({ speed: 0.3 })).not.toThrow()
-      })
-
-      it('should allow updates while shimmer is disabled', () => {
-        // Start with shimmer.
-        spinner = Spinner({ shimmer: 'ltr', text: 'Test' })
-
-        // Disable shimmer.
-        spinner.shimmer(false)
-
-        // Update config while disabled - should save and re-enable without error.
-        expect(() => spinner.shimmer({ speed: 0.5 })).not.toThrow()
-      })
-
-      it('should handle multiple partial updates in sequence', () => {
-        // Start with shimmer.
-        spinner = Spinner({ shimmer: 'ltr', text: 'Test' })
-
-        // Multiple updates - should not throw.
-        expect(() => {
-          spinner.shimmer({ speed: 0.5 })
-          spinner.shimmer({ dir: 'rtl' })
-          spinner.shimmer({ color: [200, 100, 50] as const })
-        }).not.toThrow()
-      })
-    })
-
-    describe('chaining', () => {
-      it('should support method chaining', () => {
-        spinner = Spinner({ text: 'Test' })
-
-        // Should be chainable and return the same spinner instance.
-        const result = spinner
-          .shimmer(true)
-          .text('Updated')
-          .shimmer({ speed: 0.5 })
-
-        expect(result).toBe(spinner)
-      })
-
-      it('should chain multiple shimmer calls', () => {
-        spinner = Spinner({ shimmer: 'ltr', text: 'Test' })
-
-        // Should chain without errors.
-        expect(() => {
-          spinner
-            .shimmer(false)
-            .shimmer(true)
-            .shimmer({ speed: 0.3 })
-            .shimmer('rtl')
-        }).not.toThrow()
-      })
-    })
-
-    describe('type safety', () => {
-      it('should accept boolean toggle', () => {
-        spinner = Spinner({ text: 'Test' })
-
-        // TypeScript should compile these without errors.
-        spinner.shimmer(true)
-        spinner.shimmer(false)
-      })
-
-      it('should accept direction string', () => {
-        spinner = Spinner({ text: 'Test' })
-
-        // TypeScript should compile these without errors.
-        spinner.shimmer('ltr')
-        spinner.shimmer('rtl')
-        spinner.shimmer('bi')
-        spinner.shimmer('random')
-      })
-
-      it('should accept partial config object', () => {
-        spinner = Spinner({ text: 'Test' })
-
-        // TypeScript should compile these without errors.
-        spinner.shimmer({ speed: 0.5 })
-        spinner.shimmer({ dir: 'rtl' })
-        spinner.shimmer({ color: [255, 0, 0] as const })
-        spinner.shimmer({ dir: 'ltr', speed: 0.25 })
-      })
-    })
-  })
-})
diff --git a/test/registry/strings.test.ts b/test/registry/strings.test.ts
deleted file mode 100644
index 781caee..0000000
--- a/test/registry/strings.test.ts
+++ /dev/null
@@ -1,349 +0,0 @@
-/**
- * @fileoverview Unit tests for string manipulation utilities.
- */
-
-import {
-  ansiRegex,
-  applyLinePrefix,
-  camelToKebab,
-  centerText,
-  indentString,
-  isBlankString,
-  isNonEmptyString,
-  repeatString,
-  search,
-  stringWidth,
-  stripAnsi,
-  stripBom,
-  toKebabCase,
-  trimNewlines,
-} from '@socketsecurity/lib/strings'
-import { describe, expect, it } from 'vitest'
-
-describe('strings', () => {
-  describe('ansiRegex', () => {
-    it('should match ANSI escape codes', () => {
-      expect('\x1b[31mred\x1b[0m'.match(ansiRegex())).toBeTruthy()
-      expect('\x1b[1mbold\x1b[0m'.match(ansiRegex())).toBeTruthy()
-    })
-
-    it('should not match plain text', () => {
-      expect('plain text'.match(ansiRegex())).toBeNull()
-    })
-  })
-
-  describe('stripAnsi', () => {
-    it('should remove ANSI escape codes', () => {
-      expect(stripAnsi('\x1b[31mred\x1b[0m')).toBe('red')
-      expect(stripAnsi('\x1b[1mbold\x1b[22m text')).toBe('bold text')
-    })
-
-    it('should return plain text unchanged', () => {
-      expect(stripAnsi('plain text')).toBe('plain text')
-    })
-
-    it('should handle empty strings', () => {
-      expect(stripAnsi('')).toBe('')
-    })
-  })
-
-  describe('applyLinePrefix', () => {
-    it('should apply prefix to single line', () => {
-      const result = applyLinePrefix('hello', { prefix: '> ' })
-      expect(result).toBe('> hello')
-    })
-
-    it('should apply prefix to multiple lines', () => {
-      const result = applyLinePrefix('line1\nline2\nline3', { prefix: '> ' })
-      expect(result).toBe('> line1\n> line2\n> line3')
-    })
-
-    it('should handle empty prefix', () => {
-      const result = applyLinePrefix('hello', { prefix: '' })
-      expect(result).toBe('hello')
-    })
-
-    it('should handle no options', () => {
-      const result = applyLinePrefix('hello')
-      expect(result).toBe('hello')
-    })
-
-    it('should apply prefix even to empty string', () => {
-      const result = applyLinePrefix('', { prefix: '> ' })
-      expect(result).toBe('> ')
-    })
-  })
-
-  describe('camelToKebab', () => {
-    it('should convert simple camelCase', () => {
-      expect(camelToKebab('camelCase')).toBe('camel-case')
-      expect(camelToKebab('myVariableName')).toBe('my-variable-name')
-    })
-
-    it('should handle consecutive uppercase letters', () => {
-      expect(camelToKebab('HTTPServer')).toBe('httpserver')
-      expect(camelToKebab('XMLParser')).toBe('xmlparser')
-    })
-
-    it('should handle already lowercase', () => {
-      expect(camelToKebab('lowercase')).toBe('lowercase')
-    })
-
-    it('should handle empty string', () => {
-      expect(camelToKebab('')).toBe('')
-    })
-
-    it('should handle single letter', () => {
-      expect(camelToKebab('A')).toBe('a')
-      expect(camelToKebab('a')).toBe('a')
-    })
-
-    it('should handle numbers', () => {
-      expect(camelToKebab('version2')).toBe('version2')
-      expect(camelToKebab('http2Server')).toBe('http2-server')
-    })
-  })
-
-  describe('indentString', () => {
-    it('should indent single line with default count', () => {
-      expect(indentString('hello')).toBe(' hello')
-    })
-
-    it('should indent with custom count', () => {
-      expect(indentString('hello', { count: 4 })).toBe('    hello')
-    })
-
-    it('should indent multiple lines', () => {
-      const result = indentString('line1\nline2\nline3', { count: 2 })
-      expect(result).toBe('  line1\n  line2\n  line3')
-    })
-
-    it('should not indent empty lines', () => {
-      const result = indentString('line1\n\nline3', { count: 2 })
-      expect(result).toBe('  line1\n\n  line3')
-    })
-
-    it('should handle empty string', () => {
-      expect(indentString('')).toBe('')
-    })
-  })
-
-  describe('isBlankString', () => {
-    it('should return true for empty string', () => {
-      expect(isBlankString('')).toBe(true)
-    })
-
-    it('should return true for whitespace-only strings', () => {
-      expect(isBlankString(' ')).toBe(true)
-      expect(isBlankString('  ')).toBe(true)
-      expect(isBlankString('\t')).toBe(true)
-      expect(isBlankString('\n')).toBe(true)
-      expect(isBlankString(' \t\n ')).toBe(true)
-    })
-
-    it('should return false for non-empty strings', () => {
-      expect(isBlankString('hello')).toBe(false)
-      expect(isBlankString(' hello ')).toBe(false)
-    })
-
-    it('should return false for non-strings', () => {
-      expect(isBlankString(null)).toBe(false)
-      expect(isBlankString(undefined)).toBe(false)
-      expect(isBlankString(123)).toBe(false)
-      expect(isBlankString({})).toBe(false)
-    })
-  })
-
-  describe('isNonEmptyString', () => {
-    it('should return true for non-empty strings', () => {
-      expect(isNonEmptyString('hello')).toBe(true)
-      expect(isNonEmptyString(' ')).toBe(true)
-      expect(isNonEmptyString('a')).toBe(true)
-    })
-
-    it('should return false for empty string', () => {
-      expect(isNonEmptyString('')).toBe(false)
-    })
-
-    it('should return false for non-strings', () => {
-      expect(isNonEmptyString(null)).toBe(false)
-      expect(isNonEmptyString(undefined)).toBe(false)
-      expect(isNonEmptyString(123)).toBe(false)
-      expect(isNonEmptyString([])).toBe(false)
-    })
-  })
-
-  describe('search', () => {
-    it('should find pattern from beginning', () => {
-      expect(search('hello world', /world/)).toBe(6)
-    })
-
-    it('should find pattern from custom index', () => {
-      expect(search('hello hello', /hello/, { fromIndex: 1 })).toBe(6)
-    })
-
-    it('should return -1 when pattern not found', () => {
-      expect(search('hello', /goodbye/)).toBe(-1)
-    })
-
-    it('should handle negative fromIndex', () => {
-      expect(search('hello world', /world/, { fromIndex: -5 })).toBe(6)
-    })
-
-    it('should return -1 when fromIndex >= length', () => {
-      expect(search('hello', /hello/, { fromIndex: 10 })).toBe(-1)
-    })
-
-    it('should handle empty string', () => {
-      expect(search('', /test/)).toBe(-1)
-    })
-  })
-
-  describe('stripBom', () => {
-    it('should strip BOM from beginning', () => {
-      expect(stripBom('\uFEFFhello')).toBe('hello')
-    })
-
-    it('should not strip BOM from middle', () => {
-      expect(stripBom('hello\uFEFFworld')).toBe('hello\uFEFFworld')
-    })
-
-    it('should handle strings without BOM', () => {
-      expect(stripBom('hello')).toBe('hello')
-    })
-
-    it('should handle empty string', () => {
-      expect(stripBom('')).toBe('')
-    })
-  })
-
-  describe('stringWidth', () => {
-    it('should calculate width of ASCII characters', () => {
-      expect(stringWidth('hello')).toBe(5)
-      expect(stringWidth('test')).toBe(4)
-    })
-
-    it('should handle empty string', () => {
-      expect(stringWidth('')).toBe(0)
-    })
-
-    it('should strip ANSI codes before measuring', () => {
-      expect(stringWidth('\x1b[31mred\x1b[0m')).toBe(3)
-    })
-
-    it('should handle strings with spaces', () => {
-      expect(stringWidth('hello world')).toBe(11)
-    })
-
-    it('should handle wide characters correctly', () => {
-      // CJK characters are typically wide (2 columns)
-      expect(stringWidth('你好')).toBeGreaterThanOrEqual(4)
-    })
-
-    it('should handle control characters', () => {
-      expect(stringWidth('hello\nworld')).toBe(10)
-    })
-  })
-
-  describe('toKebabCase', () => {
-    it('should convert camelCase to kebab-case', () => {
-      expect(toKebabCase('camelCase')).toBe('camel-case')
-      expect(toKebabCase('myVariableName')).toBe('my-variable-name')
-    })
-
-    it('should convert snake_case to kebab-case', () => {
-      expect(toKebabCase('snake_case')).toBe('snake-case')
-      expect(toKebabCase('my_variable_name')).toBe('my-variable-name')
-    })
-
-    it('should handle already kebab-case', () => {
-      expect(toKebabCase('kebab-case')).toBe('kebab-case')
-    })
-
-    it('should handle mixed formats', () => {
-      expect(toKebabCase('mixedCase_with_Snake')).toBe('mixed-case-with-snake')
-    })
-
-    it('should handle empty string', () => {
-      expect(toKebabCase('')).toBe('')
-    })
-
-    it('should handle numbers', () => {
-      expect(toKebabCase('version2')).toBe('version2')
-    })
-  })
-
-  describe('trimNewlines', () => {
-    it('should trim newlines from both ends', () => {
-      expect(trimNewlines('\nhello\n')).toBe('hello')
-      expect(trimNewlines('\n\nhello\n\n')).toBe('hello')
-    })
-
-    it('should handle carriage returns', () => {
-      expect(trimNewlines('\rhello\r')).toBe('hello')
-      expect(trimNewlines('\r\nhello\r\n')).toBe('hello')
-    })
-
-    it('should not trim newlines from middle', () => {
-      expect(trimNewlines('hello\nworld')).toBe('hello\nworld')
-    })
-
-    it('should handle strings without newlines', () => {
-      expect(trimNewlines('hello')).toBe('hello')
-    })
-
-    it('should handle empty string', () => {
-      expect(trimNewlines('')).toBe('')
-    })
-
-    it('should handle string with only newlines', () => {
-      expect(trimNewlines('\n\n')).toBe('')
-      expect(trimNewlines('\r\n\r\n')).toBe('')
-    })
-  })
-
-  describe('repeatString', () => {
-    it('should repeat string n times', () => {
-      expect(repeatString('x', 3)).toBe('xxx')
-      expect(repeatString('ab', 2)).toBe('abab')
-    })
-
-    it('should return empty string for count <= 0', () => {
-      expect(repeatString('x', 0)).toBe('')
-      expect(repeatString('x', -1)).toBe('')
-    })
-
-    it('should handle empty string', () => {
-      expect(repeatString('', 5)).toBe('')
-    })
-
-    it('should handle single repetition', () => {
-      expect(repeatString('hello', 1)).toBe('hello')
-    })
-  })
-
-  describe('centerText', () => {
-    it('should center text with even padding', () => {
-      expect(centerText('hi', 6)).toBe('  hi  ')
-    })
-
-    it('should center text with odd padding', () => {
-      expect(centerText('hi', 7)).toBe('  hi   ')
-    })
-
-    it('should not pad if text is longer than width', () => {
-      expect(centerText('hello', 3)).toBe('hello')
-    })
-
-    it('should handle text equal to width', () => {
-      expect(centerText('hello', 5)).toBe('hello')
-    })
-
-    it('should strip ANSI codes for width calculation', () => {
-      const text = '\x1b[31mred\x1b[0m'
-      const result = centerText(text, 7)
-      // Should center based on visible width (3), not string length
-      expect(result.length).toBeGreaterThan(text.length)
-    })
-  })
-})
diff --git a/test/unit/abort.test.ts b/test/unit/abort.test.ts
new file mode 100644
index 0000000..2662a62
--- /dev/null
+++ b/test/unit/abort.test.ts
@@ -0,0 +1,402 @@
+/**
+ * @fileoverview Unit tests for abort signal composition utilities.
+ *
+ * Tests AbortSignal composition and timeout utilities:
+ * - createCompositeAbortSignal() combines multiple abort signals into one
+ * - createTimeoutSignal() creates signal that aborts after timeout
+ * - Signal lifecycle: abort propagation, event listeners, cleanup
+ * - Edge cases: null signals, already-aborted signals, single signals
+ * Used by Socket tools for cancellable async operations and timeout management.
+ */
+
+import {
+  createCompositeAbortSignal,
+  createTimeoutSignal,
+} from '@socketsecurity/lib/abort'
+import { describe, expect, it } from 'vitest'
+
+describe('abort', () => {
+  describe('createCompositeAbortSignal', () => {
+    it('should return a new signal when no signals provided', () => {
+      const signal = createCompositeAbortSignal()
+      expect(signal).toBeInstanceOf(AbortSignal)
+      expect(signal.aborted).toBe(false)
+    })
+
+    it('should return a new signal when all signals are null', () => {
+      const signal = createCompositeAbortSignal(null, null, undefined)
+      expect(signal).toBeInstanceOf(AbortSignal)
+      expect(signal.aborted).toBe(false)
+    })
+
+    it('should return the same signal when only one valid signal provided', () => {
+      const controller = new AbortController()
+      const signal = createCompositeAbortSignal(controller.signal)
+      expect(signal).toBe(controller.signal)
+    })
+
+    it('should return the same signal when one valid and others null', () => {
+      const controller = new AbortController()
+      const signal = createCompositeAbortSignal(
+        null,
+        controller.signal,
+        undefined,
+      )
+      expect(signal).toBe(controller.signal)
+    })
+
+    it('should create composite signal from multiple signals', () => {
+      const controller1 = new AbortController()
+      const controller2 = new AbortController()
+      const signal = createCompositeAbortSignal(
+        controller1.signal,
+        controller2.signal,
+      )
+
+      expect(signal).toBeInstanceOf(AbortSignal)
+      expect(signal.aborted).toBe(false)
+    })
+
+    it('should abort composite signal when first signal aborts', async () => {
+      const controller1 = new AbortController()
+      const controller2 = new AbortController()
+      const signal = createCompositeAbortSignal(
+        controller1.signal,
+        controller2.signal,
+      )
+
+      expect(signal.aborted).toBe(false)
+
+      controller1.abort()
+
+      // Wait for event propagation
+      await new Promise(resolve => setTimeout(resolve, 0))
+
+      expect(signal.aborted).toBe(true)
+    })
+
+    it('should abort composite signal when second signal aborts', async () => {
+      const controller1 = new AbortController()
+      const controller2 = new AbortController()
+      const signal = createCompositeAbortSignal(
+        controller1.signal,
+        controller2.signal,
+      )
+
+      expect(signal.aborted).toBe(false)
+
+      controller2.abort()
+
+      // Wait for event propagation
+      await new Promise(resolve => setTimeout(resolve, 0))
+
+      expect(signal.aborted).toBe(true)
+    })
+
+    it('should return aborted signal if any input signal is already aborted', () => {
+      const controller1 = new AbortController()
+      const controller2 = new AbortController()
+
+      controller1.abort()
+
+      const signal = createCompositeAbortSignal(
+        controller1.signal,
+        controller2.signal,
+      )
+
+      expect(signal.aborted).toBe(true)
+    })
+
+    it('should handle mix of aborted and non-aborted signals', () => {
+      const controller1 = new AbortController()
+      const controller2 = new AbortController()
+
+      controller2.abort()
+
+      const signal = createCompositeAbortSignal(
+        controller1.signal,
+        controller2.signal,
+      )
+
+      expect(signal.aborted).toBe(true)
+    })
+
+    it('should handle many signals', async () => {
+      const controllers = Array.from({ length: 5 }, () => new AbortController())
+      const signal = createCompositeAbortSignal(
+        ...controllers.map(c => c.signal),
+      )
+
+      expect(signal.aborted).toBe(false)
+
+      controllers[3].abort()
+
+      await new Promise(resolve => setTimeout(resolve, 0))
+
+      expect(signal.aborted).toBe(true)
+    })
+
+    it('should handle many signals with nulls mixed in', async () => {
+      const controllers = Array.from({ length: 3 }, () => new AbortController())
+      const signal = createCompositeAbortSignal(
+        null,
+        controllers[0].signal,
+        undefined,
+        controllers[1].signal,
+        null,
+        controllers[2].signal,
+      )
+
+      expect(signal.aborted).toBe(false)
+
+      controllers[1].abort()
+
+      await new Promise(resolve => setTimeout(resolve, 0))
+
+      expect(signal.aborted).toBe(true)
+    })
+
+    it('should return the single signal when only one valid signal among nulls', () => {
+      const controller = new AbortController()
+      const signal = createCompositeAbortSignal(
+        null,
+        null,
+        controller.signal,
+        undefined,
+        null,
+      )
+
+      expect(signal).toBe(controller.signal)
+    })
+
+    it('should handle all aborted signals', () => {
+      const controller1 = new AbortController()
+      const controller2 = new AbortController()
+      const controller3 = new AbortController()
+
+      controller1.abort()
+      controller2.abort()
+      controller3.abort()
+
+      const signal = createCompositeAbortSignal(
+        controller1.signal,
+        controller2.signal,
+        controller3.signal,
+      )
+
+      expect(signal.aborted).toBe(true)
+    })
+
+    it('should handle first signal already aborted', () => {
+      const controller1 = new AbortController()
+      const controller2 = new AbortController()
+
+      controller1.abort()
+
+      const signal = createCompositeAbortSignal(
+        controller1.signal,
+        controller2.signal,
+      )
+
+      expect(signal.aborted).toBe(true)
+    })
+
+    it('should handle last signal already aborted', () => {
+      const controller1 = new AbortController()
+      const controller2 = new AbortController()
+      const controller3 = new AbortController()
+
+      controller3.abort()
+
+      const signal = createCompositeAbortSignal(
+        controller1.signal,
+        controller2.signal,
+        controller3.signal,
+      )
+
+      expect(signal.aborted).toBe(true)
+    })
+
+    it('should not abort if no source signals abort', async () => {
+      const controller1 = new AbortController()
+      const controller2 = new AbortController()
+      const signal = createCompositeAbortSignal(
+        controller1.signal,
+        controller2.signal,
+      )
+
+      await new Promise(resolve => setTimeout(resolve, 10))
+
+      expect(signal.aborted).toBe(false)
+    })
+
+    it('should handle signal aborted multiple times', async () => {
+      const controller1 = new AbortController()
+      const controller2 = new AbortController()
+      const signal = createCompositeAbortSignal(
+        controller1.signal,
+        controller2.signal,
+      )
+
+      controller1.abort()
+      await new Promise(resolve => setTimeout(resolve, 0))
+      expect(signal.aborted).toBe(true)
+
+      // Abort again (should be idempotent)
+      controller2.abort()
+      await new Promise(resolve => setTimeout(resolve, 0))
+      expect(signal.aborted).toBe(true)
+    })
+  })
+
+  describe('createTimeoutSignal', () => {
+    it('should create a signal that aborts after timeout', async () => {
+      const signal = createTimeoutSignal(50)
+      expect(signal).toBeInstanceOf(AbortSignal)
+      expect(signal.aborted).toBe(false)
+
+      // Wait for timeout
+      await new Promise(resolve => setTimeout(resolve, 100))
+
+      expect(signal.aborted).toBe(true)
+    })
+
+    it('should not abort before timeout', async () => {
+      const signal = createTimeoutSignal(100)
+      expect(signal.aborted).toBe(false)
+
+      // Wait less than timeout
+      await new Promise(resolve => setTimeout(resolve, 30))
+
+      expect(signal.aborted).toBe(false)
+    })
+
+    it('should throw TypeError for non-number timeout', () => {
+      expect(() => createTimeoutSignal('100' as any)).toThrow(TypeError)
+      expect(() => createTimeoutSignal('100' as any)).toThrow(
+        'timeout must be a number',
+      )
+    })
+
+    it('should throw TypeError for NaN timeout', () => {
+      expect(() => createTimeoutSignal(Number.NaN)).toThrow(TypeError)
+      expect(() => createTimeoutSignal(Number.NaN)).toThrow(
+        'timeout must be a number',
+      )
+    })
+
+    it('should throw TypeError for infinite timeout', () => {
+      expect(() => createTimeoutSignal(Number.POSITIVE_INFINITY)).toThrow(
+        TypeError,
+      )
+      expect(() => createTimeoutSignal(Number.POSITIVE_INFINITY)).toThrow(
+        'timeout must be a finite number',
+      )
+      expect(() => createTimeoutSignal(Number.NEGATIVE_INFINITY)).toThrow(
+        TypeError,
+      )
+    })
+
+    it('should throw TypeError for zero timeout', () => {
+      expect(() => createTimeoutSignal(0)).toThrow(TypeError)
+      expect(() => createTimeoutSignal(0)).toThrow(
+        'timeout must be a positive number',
+      )
+    })
+
+    it('should throw TypeError for negative timeout', () => {
+      expect(() => createTimeoutSignal(-100)).toThrow(TypeError)
+      expect(() => createTimeoutSignal(-100)).toThrow(
+        'timeout must be a positive number',
+      )
+    })
+
+    it('should handle very short timeouts', async () => {
+      const signal = createTimeoutSignal(1)
+      expect(signal.aborted).toBe(false)
+
+      await new Promise(resolve => setTimeout(resolve, 10))
+
+      expect(signal.aborted).toBe(true)
+    })
+
+    it('should handle fractional timeouts', async () => {
+      const signal = createTimeoutSignal(10.5)
+      expect(signal.aborted).toBe(false)
+
+      await new Promise(resolve => setTimeout(resolve, 20))
+
+      expect(signal.aborted).toBe(true)
+    })
+
+    it('should throw TypeError for null timeout', () => {
+      expect(() => createTimeoutSignal(null as any)).toThrow(TypeError)
+      expect(() => createTimeoutSignal(null as any)).toThrow(
+        'timeout must be a number',
+      )
+    })
+
+    it('should throw TypeError for undefined timeout', () => {
+      expect(() => createTimeoutSignal(undefined as any)).toThrow(TypeError)
+      expect(() => createTimeoutSignal(undefined as any)).toThrow(
+        'timeout must be a number',
+      )
+    })
+
+    it('should throw TypeError for object timeout', () => {
+      expect(() => createTimeoutSignal({} as any)).toThrow(TypeError)
+      expect(() => createTimeoutSignal({} as any)).toThrow(
+        'timeout must be a number',
+      )
+    })
+
+    it('should throw TypeError for array timeout', () => {
+      expect(() => createTimeoutSignal([] as any)).toThrow(TypeError)
+      expect(() => createTimeoutSignal([] as any)).toThrow(
+        'timeout must be a number',
+      )
+    })
+
+    it('should throw TypeError for boolean timeout', () => {
+      expect(() => createTimeoutSignal(true as any)).toThrow(TypeError)
+      expect(() => createTimeoutSignal(true as any)).toThrow(
+        'timeout must be a number',
+      )
+    })
+
+    it('should throw TypeError for negative infinity timeout', () => {
+      expect(() => createTimeoutSignal(Number.NEGATIVE_INFINITY)).toThrow(
+        TypeError,
+      )
+      expect(() => createTimeoutSignal(Number.NEGATIVE_INFINITY)).toThrow(
+        'timeout must be a finite number',
+      )
+    })
+
+    it('should handle medium timeouts', async () => {
+      const signal = createTimeoutSignal(50)
+      expect(signal.aborted).toBe(false)
+
+      await new Promise(resolve => setTimeout(resolve, 70))
+
+      expect(signal.aborted).toBe(true)
+    })
+
+    it('should create independent signals', async () => {
+      const signal1 = createTimeoutSignal(50)
+      const signal2 = createTimeoutSignal(150)
+
+      expect(signal1.aborted).toBe(false)
+      expect(signal2.aborted).toBe(false)
+
+      await new Promise(resolve => setTimeout(resolve, 70))
+
+      expect(signal1.aborted).toBe(true)
+      expect(signal2.aborted).toBe(false)
+
+      await new Promise(resolve => setTimeout(resolve, 100))
+
+      expect(signal2.aborted).toBe(true)
+    })
+  })
+})
diff --git a/test/unit/agent.test.ts b/test/unit/agent.test.ts
new file mode 100644
index 0000000..746e737
--- /dev/null
+++ b/test/unit/agent.test.ts
@@ -0,0 +1,625 @@
+/**
+ * @fileoverview Comprehensive tests for package manager agent execution utilities.
+ *
+ * Tests package manager execution wrappers:
+ * - execNpm(), execPnpm(), execYarn() execute package manager commands
+ * - execScript() runs package.json scripts via appropriate PM
+ * - Flag detection: isNpm*Flag() functions for npm-specific flags
+ * - Audit, fund, loglevel, node-options, progress flag helpers
+ * - Cross-platform package manager command execution
+ * Used by Socket CLI for package manager operations with flag filtering.
+ */
+
+import {
+  execNpm,
+  execPnpm,
+  execScript,
+  execYarn,
+  isNpmAuditFlag,
+  isNpmFundFlag,
+  isNpmLoglevelFlag,
+  isNpmNodeOptionsFlag,
+  isNpmProgressFlag,
+  isPnpmFrozenLockfileFlag,
+  isPnpmIgnoreScriptsFlag,
+  isPnpmInstallCommand,
+  isPnpmLoglevelFlag,
+} from '@socketsecurity/lib/agent'
+import { describe, expect, it } from 'vitest'
+
+describe('agent', () => {
+  describe('Flag checking functions', () => {
+    describe('isNpmAuditFlag', () => {
+      it('should return true for --audit', () => {
+        expect(isNpmAuditFlag('--audit')).toBe(true)
+      })
+
+      it('should return true for --no-audit', () => {
+        expect(isNpmAuditFlag('--no-audit')).toBe(true)
+      })
+
+      it('should return true for --audit=false', () => {
+        expect(isNpmAuditFlag('--audit=false')).toBe(true)
+      })
+
+      it('should return true for --audit=true', () => {
+        expect(isNpmAuditFlag('--audit=true')).toBe(true)
+      })
+
+      it('should return true for --no-audit=anything', () => {
+        expect(isNpmAuditFlag('--no-audit=value')).toBe(true)
+      })
+
+      it('should return false for --auditor', () => {
+        expect(isNpmAuditFlag('--auditor')).toBe(false)
+      })
+
+      it('should return false for audit without dashes', () => {
+        expect(isNpmAuditFlag('audit')).toBe(false)
+      })
+
+      it('should return false for empty string', () => {
+        expect(isNpmAuditFlag('')).toBe(false)
+      })
+
+      it('should return false for --audit-log', () => {
+        expect(isNpmAuditFlag('--audit-log')).toBe(false)
+      })
+
+      it('should handle --audit with various values', () => {
+        expect(isNpmAuditFlag('--audit=')).toBe(true)
+        expect(isNpmAuditFlag('--audit=1')).toBe(true)
+        expect(isNpmAuditFlag('--audit=0')).toBe(true)
+        expect(isNpmAuditFlag('--no-audit=false')).toBe(true)
+      })
+
+      it('should not match partial strings', () => {
+        expect(isNpmAuditFlag('--pre-audit')).toBe(false)
+        expect(isNpmAuditFlag('--audit-level')).toBe(false)
+      })
+    })
+
+    describe('isNpmFundFlag', () => {
+      it('should return true for --fund', () => {
+        expect(isNpmFundFlag('--fund')).toBe(true)
+      })
+
+      it('should return true for --no-fund', () => {
+        expect(isNpmFundFlag('--no-fund')).toBe(true)
+      })
+
+      it('should return true for --fund=false', () => {
+        expect(isNpmFundFlag('--fund=false')).toBe(true)
+      })
+
+      it('should return true for --fund=true', () => {
+        expect(isNpmFundFlag('--fund=true')).toBe(true)
+      })
+
+      it('should return true for --no-fund=value', () => {
+        expect(isNpmFundFlag('--no-fund=value')).toBe(true)
+      })
+
+      it('should return false for --funding', () => {
+        expect(isNpmFundFlag('--funding')).toBe(false)
+      })
+
+      it('should return false for fund without dashes', () => {
+        expect(isNpmFundFlag('fund')).toBe(false)
+      })
+
+      it('should return false for empty string', () => {
+        expect(isNpmFundFlag('')).toBe(false)
+      })
+
+      it('should return false for --funded', () => {
+        expect(isNpmFundFlag('--funded')).toBe(false)
+      })
+
+      it('should handle --fund with various values', () => {
+        expect(isNpmFundFlag('--fund=')).toBe(true)
+        expect(isNpmFundFlag('--fund=1')).toBe(true)
+        expect(isNpmFundFlag('--fund=0')).toBe(true)
+        expect(isNpmFundFlag('--no-fund=false')).toBe(true)
+      })
+
+      it('should not match partial strings', () => {
+        expect(isNpmFundFlag('--pre-fund')).toBe(false)
+        expect(isNpmFundFlag('--fund-url')).toBe(false)
+      })
+    })
+
+    describe('isNpmProgressFlag', () => {
+      it('should return true for --progress', () => {
+        expect(isNpmProgressFlag('--progress')).toBe(true)
+      })
+
+      it('should return true for --no-progress', () => {
+        expect(isNpmProgressFlag('--no-progress')).toBe(true)
+      })
+
+      it('should return true for --progress=false', () => {
+        expect(isNpmProgressFlag('--progress=false')).toBe(true)
+      })
+
+      it('should return true for --progress=true', () => {
+        expect(isNpmProgressFlag('--progress=true')).toBe(true)
+      })
+
+      it('should return true for --no-progress=value', () => {
+        expect(isNpmProgressFlag('--no-progress=value')).toBe(true)
+      })
+
+      it('should return false for --progressive', () => {
+        expect(isNpmProgressFlag('--progressive')).toBe(false)
+      })
+
+      it('should return false for progress without dashes', () => {
+        expect(isNpmProgressFlag('progress')).toBe(false)
+      })
+
+      it('should return false for empty string', () => {
+        expect(isNpmProgressFlag('')).toBe(false)
+      })
+
+      it('should return false for --progress-bar', () => {
+        expect(isNpmProgressFlag('--progress-bar')).toBe(false)
+      })
+
+      it('should handle --progress with various values', () => {
+        expect(isNpmProgressFlag('--progress=')).toBe(true)
+        expect(isNpmProgressFlag('--progress=1')).toBe(true)
+        expect(isNpmProgressFlag('--progress=0')).toBe(true)
+        expect(isNpmProgressFlag('--no-progress=false')).toBe(true)
+      })
+
+      it('should not match partial strings', () => {
+        expect(isNpmProgressFlag('--pre-progress')).toBe(false)
+        expect(isNpmProgressFlag('--progress-enabled')).toBe(false)
+      })
+    })
+
+    describe('isNpmLoglevelFlag', () => {
+      it('should return true for --loglevel', () => {
+        expect(isNpmLoglevelFlag('--loglevel')).toBe(true)
+      })
+
+      it('should return true for --loglevel=error', () => {
+        expect(isNpmLoglevelFlag('--loglevel=error')).toBe(true)
+      })
+
+      it('should return true for --loglevel=warn', () => {
+        expect(isNpmLoglevelFlag('--loglevel=warn')).toBe(true)
+      })
+
+      it('should return true for --silent', () => {
+        expect(isNpmLoglevelFlag('--silent')).toBe(true)
+      })
+
+      it('should return true for --verbose', () => {
+        expect(isNpmLoglevelFlag('--verbose')).toBe(true)
+      })
+
+      it('should return true for --info', () => {
+        expect(isNpmLoglevelFlag('--info')).toBe(true)
+      })
+
+      it('should return true for --warn', () => {
+        expect(isNpmLoglevelFlag('--warn')).toBe(true)
+      })
+
+      it('should return true for --error', () => {
+        expect(isNpmLoglevelFlag('--error')).toBe(true)
+      })
+
+      it('should return true for --quiet', () => {
+        expect(isNpmLoglevelFlag('--quiet')).toBe(true)
+      })
+
+      it('should return true for -s', () => {
+        expect(isNpmLoglevelFlag('-s')).toBe(true)
+      })
+
+      it('should return true for -q', () => {
+        expect(isNpmLoglevelFlag('-q')).toBe(true)
+      })
+
+      it('should return true for -d', () => {
+        expect(isNpmLoglevelFlag('-d')).toBe(true)
+      })
+
+      it('should return true for -dd', () => {
+        expect(isNpmLoglevelFlag('-dd')).toBe(true)
+      })
+
+      it('should return true for -ddd', () => {
+        expect(isNpmLoglevelFlag('-ddd')).toBe(true)
+      })
+
+      it('should return true for -v', () => {
+        expect(isNpmLoglevelFlag('-v')).toBe(true)
+      })
+
+      it('should return false for --loglevel-custom', () => {
+        expect(isNpmLoglevelFlag('--loglevel-custom')).toBe(false)
+      })
+
+      it('should return false for -dddd', () => {
+        expect(isNpmLoglevelFlag('-dddd')).toBe(false)
+      })
+
+      it('should return false for empty string', () => {
+        expect(isNpmLoglevelFlag('')).toBe(false)
+      })
+
+      it('should return false for --log', () => {
+        expect(isNpmLoglevelFlag('--log')).toBe(false)
+      })
+
+      it('should return false for -x', () => {
+        expect(isNpmLoglevelFlag('-x')).toBe(false)
+      })
+
+      it('should return false for -vv', () => {
+        expect(isNpmLoglevelFlag('-vv')).toBe(false)
+      })
+
+      it('should handle --loglevel with various values', () => {
+        expect(isNpmLoglevelFlag('--loglevel=')).toBe(true)
+        expect(isNpmLoglevelFlag('--loglevel=silly')).toBe(true)
+        expect(isNpmLoglevelFlag('--loglevel=http')).toBe(true)
+        expect(isNpmLoglevelFlag('--loglevel=timing')).toBe(true)
+      })
+
+      it('should not match invalid short flags', () => {
+        expect(isNpmLoglevelFlag('-a')).toBe(false)
+        expect(isNpmLoglevelFlag('-b')).toBe(false)
+        expect(isNpmLoglevelFlag('-x')).toBe(false)
+      })
+
+      it('should test all npm loglevel flag variations', () => {
+        // Test all documented npm loglevel flags
+        const validFlags = [
+          '--loglevel',
+          '--loglevel=error',
+          '--silent',
+          '--verbose',
+          '--info',
+          '--warn',
+          '--error',
+          '--quiet',
+          '-s',
+          '-q',
+          '-d',
+          '-dd',
+          '-ddd',
+          '-v',
+        ]
+
+        for (const flag of validFlags) {
+          expect(isNpmLoglevelFlag(flag)).toBe(true)
+        }
+      })
+
+      it('should reject invalid npm loglevel flag variations', () => {
+        const invalidFlags = [
+          '--loglevel-error',
+          '--log',
+          '--level',
+          '-dddd',
+          '-sss',
+          '-qq',
+          '-vv',
+          '--silentt',
+          '--verbosee',
+        ]
+
+        for (const flag of invalidFlags) {
+          expect(isNpmLoglevelFlag(flag)).toBe(false)
+        }
+      })
+    })
+
+    describe('isNpmNodeOptionsFlag', () => {
+      it('should return true for --node-options', () => {
+        expect(isNpmNodeOptionsFlag('--node-options')).toBe(true)
+      })
+
+      it('should return true for --node-options=--max-old-space-size=4096', () => {
+        expect(
+          isNpmNodeOptionsFlag('--node-options=--max-old-space-size=4096'),
+        ).toBe(true)
+      })
+
+      it('should return true for --node-options=""', () => {
+        expect(isNpmNodeOptionsFlag('--node-options=""')).toBe(true)
+      })
+
+      it('should return false for --node-option', () => {
+        expect(isNpmNodeOptionsFlag('--node-option')).toBe(false)
+      })
+
+      it('should return false for empty string', () => {
+        expect(isNpmNodeOptionsFlag('')).toBe(false)
+      })
+
+      it('should return false for --node', () => {
+        expect(isNpmNodeOptionsFlag('--node')).toBe(false)
+      })
+
+      it('should handle --node-options with various values', () => {
+        expect(isNpmNodeOptionsFlag('--node-options=')).toBe(true)
+        expect(isNpmNodeOptionsFlag('--node-options=--inspect')).toBe(true)
+        expect(
+          isNpmNodeOptionsFlag('--node-options="--max-old-space-size=8192"'),
+        ).toBe(true)
+      })
+
+      it('should not match partial strings', () => {
+        expect(isNpmNodeOptionsFlag('--node')).toBe(false)
+        expect(isNpmNodeOptionsFlag('--node-option')).toBe(false)
+        expect(isNpmNodeOptionsFlag('--node-opts')).toBe(false)
+      })
+
+      it('should handle flags with spaces in values', () => {
+        expect(isNpmNodeOptionsFlag('--node-options=--flag value')).toBe(true)
+      })
+
+      it('should handle flags with quotes', () => {
+        expect(isNpmNodeOptionsFlag('--node-options="value"')).toBe(true)
+        expect(isNpmNodeOptionsFlag("--node-options='value'")).toBe(true)
+      })
+    })
+
+    describe('isPnpmIgnoreScriptsFlag', () => {
+      it('should return true for --ignore-scripts', () => {
+        expect(isPnpmIgnoreScriptsFlag('--ignore-scripts')).toBe(true)
+      })
+
+      it('should return true for --no-ignore-scripts', () => {
+        expect(isPnpmIgnoreScriptsFlag('--no-ignore-scripts')).toBe(true)
+      })
+
+      it('should return false for --ignore-scripts=true', () => {
+        expect(isPnpmIgnoreScriptsFlag('--ignore-scripts=true')).toBe(false)
+      })
+
+      it('should return false for --ignore-script', () => {
+        expect(isPnpmIgnoreScriptsFlag('--ignore-script')).toBe(false)
+      })
+
+      it('should return false for empty string', () => {
+        expect(isPnpmIgnoreScriptsFlag('')).toBe(false)
+      })
+
+      it('should return false for --ignore', () => {
+        expect(isPnpmIgnoreScriptsFlag('--ignore')).toBe(false)
+      })
+    })
+
+    describe('isPnpmFrozenLockfileFlag', () => {
+      it('should return true for --frozen-lockfile', () => {
+        expect(isPnpmFrozenLockfileFlag('--frozen-lockfile')).toBe(true)
+      })
+
+      it('should return true for --no-frozen-lockfile', () => {
+        expect(isPnpmFrozenLockfileFlag('--no-frozen-lockfile')).toBe(true)
+      })
+
+      it('should return false for --frozen-lockfile=true', () => {
+        expect(isPnpmFrozenLockfileFlag('--frozen-lockfile=true')).toBe(false)
+      })
+
+      it('should return false for --frozen', () => {
+        expect(isPnpmFrozenLockfileFlag('--frozen')).toBe(false)
+      })
+
+      it('should return false for empty string', () => {
+        expect(isPnpmFrozenLockfileFlag('')).toBe(false)
+      })
+
+      it('should return false for --lockfile', () => {
+        expect(isPnpmFrozenLockfileFlag('--lockfile')).toBe(false)
+      })
+    })
+
+    describe('isPnpmInstallCommand', () => {
+      it('should return true for install', () => {
+        expect(isPnpmInstallCommand('install')).toBe(true)
+      })
+
+      it('should return true for i', () => {
+        expect(isPnpmInstallCommand('i')).toBe(true)
+      })
+
+      it('should return false for add', () => {
+        expect(isPnpmInstallCommand('add')).toBe(false)
+      })
+
+      it('should return false for update', () => {
+        expect(isPnpmInstallCommand('update')).toBe(false)
+      })
+
+      it('should return false for empty string', () => {
+        expect(isPnpmInstallCommand('')).toBe(false)
+      })
+
+      it('should return false for Install (capital)', () => {
+        expect(isPnpmInstallCommand('Install')).toBe(false)
+      })
+
+      it('should return false for I (capital)', () => {
+        expect(isPnpmInstallCommand('I')).toBe(false)
+      })
+    })
+
+    describe('isPnpmLoglevelFlag', () => {
+      it('should be an alias for isNpmLoglevelFlag', () => {
+        expect(isPnpmLoglevelFlag).toBe(isNpmLoglevelFlag)
+      })
+
+      it('should return true for --loglevel', () => {
+        expect(isPnpmLoglevelFlag('--loglevel')).toBe(true)
+      })
+
+      it('should return true for --silent', () => {
+        expect(isPnpmLoglevelFlag('--silent')).toBe(true)
+      })
+
+      it('should return true for -d', () => {
+        expect(isPnpmLoglevelFlag('-d')).toBe(true)
+      })
+    })
+  })
+
+  describe('Integration tests (using real spawn)', () => {
+    // These tests verify the actual behavior without mocking
+    // We can't easily test the full execution without running actual commands
+    // so we focus on what we can test: the flag detection integration
+
+    describe('execNpm argument transformation', () => {
+      it('should have a function that returns a promise', () => {
+        const result = execNpm(['--version'])
+        // Catch promise immediately to prevent unhandled rejection on Windows.
+        result.catch(() => {})
+        expect(result).toBeInstanceOf(Promise)
+      })
+
+      it('should be a function', () => {
+        expect(typeof execNpm).toBe('function')
+      })
+    })
+
+    describe('execPnpm argument transformation', () => {
+      it('should have a function that returns a promise', () => {
+        const result = execPnpm(['--version'])
+        // Catch promise immediately to prevent unhandled rejection on Windows.
+        result.catch(() => {})
+        expect(result).toBeInstanceOf(Promise)
+      })
+
+      it('should be a function', () => {
+        expect(typeof execPnpm).toBe('function')
+      })
+    })
+
+    describe('execYarn argument transformation', () => {
+      it('should have a function that returns a promise', () => {
+        const result = execYarn(['--version'])
+        // Catch promise immediately to prevent unhandled rejection on Windows.
+        result.catch(() => {})
+        expect(result).toBeInstanceOf(Promise)
+      })
+
+      it('should be a function', () => {
+        expect(typeof execYarn).toBe('function')
+      })
+    })
+
+    describe('execScript argument transformation', () => {
+      it('should have a function that returns a promise', () => {
+        const result = execScript('test')
+        // Catch promise immediately to prevent unhandled rejection on Windows.
+        result.catch(() => {})
+        expect(result).toBeInstanceOf(Promise)
+      })
+
+      it('should be a function', () => {
+        expect(typeof execScript).toBe('function')
+      })
+
+      it('should handle script name with array args', () => {
+        const result = execScript('test', ['--coverage'])
+        // Catch promise immediately to prevent unhandled rejection on Windows.
+        result.catch(() => {})
+        expect(result).toBeInstanceOf(Promise)
+      })
+
+      it('should handle script name with options object', () => {
+        const result = execScript('test', { cwd: process.cwd() })
+        // Catch promise immediately to prevent unhandled rejection on Windows.
+        result.catch(() => {})
+        expect(result).toBeInstanceOf(Promise)
+      })
+
+      it('should handle script name with args and options', () => {
+        const result = execScript('test', ['--coverage'], {
+          cwd: process.cwd(),
+        })
+        // Catch promise immediately to prevent unhandled rejection on Windows.
+        result.catch(() => {})
+        expect(result).toBeInstanceOf(Promise)
+      })
+    })
+  })
+
+  describe('Edge cases for flag detection', () => {
+    describe('Case sensitivity', () => {
+      it('should be case sensitive for long flags', () => {
+        expect(isNpmAuditFlag('--AUDIT')).toBe(false)
+        expect(isNpmFundFlag('--FUND')).toBe(false)
+        expect(isNpmProgressFlag('--PROGRESS')).toBe(false)
+      })
+
+      it('should be case sensitive for short flags', () => {
+        expect(isNpmLoglevelFlag('-S')).toBe(false)
+        expect(isNpmLoglevelFlag('-Q')).toBe(false)
+        expect(isNpmLoglevelFlag('-D')).toBe(false)
+        expect(isNpmLoglevelFlag('-V')).toBe(false)
+      })
+
+      it('should be case sensitive for commands', () => {
+        expect(isPnpmInstallCommand('INSTALL')).toBe(false)
+        expect(isPnpmInstallCommand('Install')).toBe(false)
+        expect(isPnpmInstallCommand('I')).toBe(false)
+      })
+    })
+
+    describe('Boundary conditions', () => {
+      it('should handle single character inputs', () => {
+        expect(isNpmAuditFlag('-')).toBe(false)
+        expect(isNpmFundFlag('f')).toBe(false)
+        expect(isNpmProgressFlag('p')).toBe(false)
+      })
+
+      it('should handle very long inputs', () => {
+        const longFlag = `--audit=${'a'.repeat(1000)}`
+        expect(isNpmAuditFlag(longFlag)).toBe(true)
+      })
+
+      it('should handle unicode characters', () => {
+        expect(isNpmAuditFlag('--audit=🚀')).toBe(true)
+        expect(isNpmFundFlag('--fund=测试')).toBe(true)
+      })
+    })
+
+    describe('Whitespace handling', () => {
+      it('should not match flags with leading whitespace', () => {
+        expect(isNpmAuditFlag(' --audit')).toBe(false)
+        expect(isNpmFundFlag('  --fund')).toBe(false)
+      })
+
+      it('should not match flags with trailing whitespace', () => {
+        expect(isNpmAuditFlag('--audit ')).toBe(false)
+        expect(isNpmFundFlag('--fund  ')).toBe(false)
+      })
+
+      it('should not match flags with internal whitespace', () => {
+        expect(isNpmAuditFlag('-- audit')).toBe(false)
+        expect(isNpmFundFlag('--no -fund')).toBe(false)
+      })
+    })
+
+    describe('Special characters', () => {
+      it('should handle flags with multiple equals signs', () => {
+        expect(isNpmAuditFlag('--audit=key=value')).toBe(true)
+        expect(isNpmFundFlag('--fund=url=https://example.com')).toBe(true)
+      })
+
+      it('should handle flags with special characters in values', () => {
+        expect(isNpmLoglevelFlag('--loglevel=some value')).toBe(true)
+        expect(isNpmProgressFlag('--progress=@#$%')).toBe(true)
+      })
+    })
+  })
+})
diff --git a/test/unit/ansi.test.ts b/test/unit/ansi.test.ts
new file mode 100644
index 0000000..1558395
--- /dev/null
+++ b/test/unit/ansi.test.ts
@@ -0,0 +1,245 @@
+/**
+ * @fileoverview Unit tests for ANSI escape code utilities.
+ *
+ * Tests ANSI escape code constants and utilities:
+ * - Constants: ANSI_BOLD, ANSI_DIM, ANSI_ITALIC, ANSI_UNDERLINE, ANSI_STRIKETHROUGH, ANSI_RESET
+ * - stripAnsi() removes ANSI escape codes from strings
+ * - ansiRegex() provides regex pattern for matching ANSI codes
+ * - Terminal formatting and color code handling
+ * Used by Socket logger and output utilities for terminal text styling.
+ */
+
+import {
+  ANSI_BOLD,
+  ANSI_DIM,
+  ANSI_ITALIC,
+  ANSI_RESET,
+  ANSI_STRIKETHROUGH,
+  ANSI_UNDERLINE,
+  ansiRegex,
+  stripAnsi,
+} from '@socketsecurity/lib/ansi'
+import { describe, expect, it } from 'vitest'
+
+describe('ansi', () => {
+  describe('ANSI constants', () => {
+    it('should have correct ANSI reset code', () => {
+      expect(ANSI_RESET).toBe('\x1b[0m')
+    })
+
+    it('should have correct ANSI bold code', () => {
+      expect(ANSI_BOLD).toBe('\x1b[1m')
+    })
+
+    it('should have correct ANSI dim code', () => {
+      expect(ANSI_DIM).toBe('\x1b[2m')
+    })
+
+    it('should have correct ANSI italic code', () => {
+      expect(ANSI_ITALIC).toBe('\x1b[3m')
+    })
+
+    it('should have correct ANSI underline code', () => {
+      expect(ANSI_UNDERLINE).toBe('\x1b[4m')
+    })
+
+    it('should have correct ANSI strikethrough code', () => {
+      expect(ANSI_STRIKETHROUGH).toBe('\x1b[9m')
+    })
+  })
+
+  describe('ansiRegex', () => {
+    it('should create regex for ANSI codes', () => {
+      const regex = ansiRegex()
+      expect(regex).toBeInstanceOf(RegExp)
+      expect(regex.global).toBe(true)
+    })
+
+    it('should create regex with onlyFirst option', () => {
+      const regex = ansiRegex({ onlyFirst: true })
+      expect(regex).toBeInstanceOf(RegExp)
+      expect(regex.global).toBe(false)
+    })
+
+    it('should match ANSI reset code', () => {
+      const regex = ansiRegex()
+      const text = '\x1b[0mPlain text'
+      expect(regex.test(text)).toBe(true)
+    })
+
+    it('should match ANSI color codes', () => {
+      const regex = ansiRegex()
+      const text = '\x1b[31mRed text\x1b[0m'
+      expect(regex.test(text)).toBe(true)
+    })
+
+    it('should match multiple ANSI codes', () => {
+      const regex = ansiRegex()
+      const text = '\x1b[1m\x1b[31mBold red\x1b[0m'
+      const matches = text.match(regex)
+      expect(matches).not.toBeNull()
+      expect(matches?.length).toBeGreaterThanOrEqual(2)
+    })
+
+    it('should match CSI sequences', () => {
+      const regex = ansiRegex()
+      const text = '\x1b[2J\x1b[H'
+      expect(regex.test(text)).toBe(true)
+    })
+
+    it('should handle options parameter undefined', () => {
+      const regex = ansiRegex(undefined)
+      expect(regex).toBeInstanceOf(RegExp)
+      expect(regex.global).toBe(true)
+    })
+
+    it('should handle options with onlyFirst false', () => {
+      const regex = ansiRegex({ onlyFirst: false })
+      expect(regex.global).toBe(true)
+    })
+
+    it('should create non-global regex when onlyFirst is true', () => {
+      const regex = ansiRegex({ onlyFirst: true })
+      const text = '\x1b[31mRed\x1b[0m'
+      const match = text.match(regex)
+      expect(match).not.toBeNull()
+      expect(match?.[0]).toBe('\x1b[31m')
+    })
+  })
+
+  describe('stripAnsi', () => {
+    it('should strip ANSI codes from text', () => {
+      const text = '\x1b[31mRed text\x1b[0m'
+      expect(stripAnsi(text)).toBe('Red text')
+    })
+
+    it('should strip bold formatting', () => {
+      const text = '\x1b[1mBold text\x1b[0m'
+      expect(stripAnsi(text)).toBe('Bold text')
+    })
+
+    it('should strip multiple ANSI codes', () => {
+      const text = '\x1b[1m\x1b[31mBold red\x1b[0m'
+      expect(stripAnsi(text)).toBe('Bold red')
+    })
+
+    it('should return plain text unchanged', () => {
+      const text = 'Plain text'
+      expect(stripAnsi(text)).toBe('Plain text')
+    })
+
+    it('should handle empty string', () => {
+      expect(stripAnsi('')).toBe('')
+    })
+
+    it('should strip color codes', () => {
+      const text = '\x1b[31mRed\x1b[32mGreen\x1b[34mBlue\x1b[0m'
+      expect(stripAnsi(text)).toBe('RedGreenBlue')
+    })
+
+    it('should strip underline and italic', () => {
+      const text = '\x1b[3m\x1b[4mUnderlined Italic\x1b[0m'
+      expect(stripAnsi(text)).toBe('Underlined Italic')
+    })
+
+    it('should strip background colors', () => {
+      const text = '\x1b[41mRed background\x1b[0m'
+      expect(stripAnsi(text)).toBe('Red background')
+    })
+
+    it('should strip 256 color codes', () => {
+      const text = '\x1b[38;5;196mBright red\x1b[0m'
+      expect(stripAnsi(text)).toBe('Bright red')
+    })
+
+    it('should strip RGB color codes', () => {
+      const text = '\x1b[38;2;255;0;0mRGB red\x1b[0m'
+      expect(stripAnsi(text)).toBe('RGB red')
+    })
+
+    it('should handle text with only ANSI codes', () => {
+      const text = '\x1b[31m\x1b[1m\x1b[0m'
+      expect(stripAnsi(text)).toBe('')
+    })
+
+    it('should handle mixed content', () => {
+      const text = 'Normal \x1b[1mbold\x1b[0m normal \x1b[31mred\x1b[0m end'
+      expect(stripAnsi(text)).toBe('Normal bold normal red end')
+    })
+
+    it('should handle newlines and special chars', () => {
+      const text = '\x1b[31mLine 1\nLine 2\x1b[0m'
+      expect(stripAnsi(text)).toBe('Line 1\nLine 2')
+    })
+
+    it('should handle unicode characters', () => {
+      const text = '\x1b[31m你好世界\x1b[0m'
+      expect(stripAnsi(text)).toBe('你好世界')
+    })
+
+    it('should handle emojis', () => {
+      const text = '\x1b[32m✓\x1b[0m Success'
+      expect(stripAnsi(text)).toBe('✓ Success')
+    })
+  })
+
+  describe('ANSI constant usage', () => {
+    it('should format text with bold', () => {
+      const formatted = `${ANSI_BOLD}Bold text${ANSI_RESET}`
+      expect(formatted).toBe('\x1b[1mBold text\x1b[0m')
+      expect(stripAnsi(formatted)).toBe('Bold text')
+    })
+
+    it('should format text with italic', () => {
+      const formatted = `${ANSI_ITALIC}Italic text${ANSI_RESET}`
+      expect(formatted).toBe('\x1b[3mItalic text\x1b[0m')
+      expect(stripAnsi(formatted)).toBe('Italic text')
+    })
+
+    it('should format text with underline', () => {
+      const formatted = `${ANSI_UNDERLINE}Underlined text${ANSI_RESET}`
+      expect(formatted).toBe('\x1b[4mUnderlined text\x1b[0m')
+      expect(stripAnsi(formatted)).toBe('Underlined text')
+    })
+
+    it('should format text with dim', () => {
+      const formatted = `${ANSI_DIM}Dim text${ANSI_RESET}`
+      expect(formatted).toBe('\x1b[2mDim text\x1b[0m')
+      expect(stripAnsi(formatted)).toBe('Dim text')
+    })
+
+    it('should format text with strikethrough', () => {
+      const formatted = `${ANSI_STRIKETHROUGH}Struck text${ANSI_RESET}`
+      expect(formatted).toBe('\x1b[9mStruck text\x1b[0m')
+      expect(stripAnsi(formatted)).toBe('Struck text')
+    })
+
+    it('should combine multiple formats', () => {
+      const formatted = `${ANSI_BOLD}${ANSI_ITALIC}Bold Italic${ANSI_RESET}`
+      expect(stripAnsi(formatted)).toBe('Bold Italic')
+    })
+  })
+
+  describe('edge cases', () => {
+    it('should handle malformed ANSI codes', () => {
+      const text = '\x1bIncomplete'
+      expect(stripAnsi(text)).toBe('\x1bIncomplete')
+    })
+
+    it('should handle very long strings', () => {
+      const longText = 'a'.repeat(10_000)
+      const formatted = `\x1b[31m${longText}\x1b[0m`
+      expect(stripAnsi(formatted)).toBe(longText)
+    })
+
+    it('should handle nested ANSI codes', () => {
+      const text = '\x1b[31m\x1b[1mNested\x1b[0m\x1b[0m'
+      expect(stripAnsi(text)).toBe('Nested')
+    })
+
+    it('should handle repeated reset codes', () => {
+      const text = '\x1b[31mRed\x1b[0m\x1b[0m\x1b[0m'
+      expect(stripAnsi(text)).toBe('Red')
+    })
+  })
+})
diff --git a/test/unit/argv-flags.test.ts b/test/unit/argv-flags.test.ts
new file mode 100644
index 0000000..832601c
--- /dev/null
+++ b/test/unit/argv-flags.test.ts
@@ -0,0 +1,482 @@
+/**
+ * @fileoverview Unit tests for CLI flag detection utilities.
+ *
+ * Tests command-line flag checker functions:
+ * - COMMON_FLAGS constant with standard CLI flags
+ * - Flag detectors: isHelp(), isVerbose(), isQuiet(), isDebug(), isForce()
+ * - Mode flags: isDryRun(), isFix(), isUpdate(), isCoverage(), isJson()
+ * - Context flags: isAll(), isChanged(), isStaged()
+ * - getLogLevel() extracts log level from parsed args
+ * Used by Socket CLI for command-line argument interpretation.
+ */
+
+import {
+  COMMON_FLAGS,
+  getLogLevel,
+  isAll,
+  isChanged,
+  isCoverage,
+  isDebug,
+  isDryRun,
+  isFix,
+  isForce,
+  isHelp,
+  isJson,
+  isQuiet,
+  isStaged,
+  isUpdate,
+  isVerbose,
+  isWatch,
+  type FlagValues,
+} from '@socketsecurity/lib/argv/flags'
+import { describe, expect, it } from 'vitest'
+
+describe('argv/flags', () => {
+  describe('getLogLevel', () => {
+    it('should return silent for quiet flags', () => {
+      expect(getLogLevel({ quiet: true })).toBe('silent')
+      expect(getLogLevel({ silent: true })).toBe('silent')
+    })
+
+    it('should return debug for debug flag', () => {
+      expect(getLogLevel({ debug: true })).toBe('debug')
+    })
+
+    it('should return verbose for verbose flag', () => {
+      expect(getLogLevel({ verbose: true })).toBe('verbose')
+    })
+
+    it('should return info as default', () => {
+      expect(getLogLevel({})).toBe('info')
+      expect(getLogLevel()).toBe('info')
+    })
+
+    it('should prioritize quiet over debug', () => {
+      expect(getLogLevel({ quiet: true, debug: true })).toBe('silent')
+    })
+
+    it('should prioritize debug over verbose', () => {
+      expect(getLogLevel({ debug: true, verbose: true })).toBe('debug')
+    })
+
+    it('should handle array input', () => {
+      expect(getLogLevel(['--quiet'])).toBe('silent')
+      expect(getLogLevel(['--debug'])).toBe('debug')
+      expect(getLogLevel(['--verbose'])).toBe('verbose')
+    })
+  })
+
+  describe('isAll', () => {
+    it('should return true for all flag in object', () => {
+      expect(isAll({ all: true })).toBe(true)
+    })
+
+    it('should return false when all flag not set', () => {
+      expect(isAll({})).toBe(false)
+      expect(isAll({ all: false })).toBe(false)
+    })
+
+    it('should handle array input', () => {
+      expect(isAll(['--all'])).toBe(true)
+      expect(isAll([])).toBe(false)
+    })
+
+    it('should handle undefined input', () => {
+      const result = isAll(undefined)
+      expect(typeof result).toBe('boolean')
+    })
+  })
+
+  describe('isChanged', () => {
+    it('should return true for changed flag', () => {
+      expect(isChanged({ changed: true })).toBe(true)
+    })
+
+    it('should return false when not set', () => {
+      expect(isChanged({})).toBe(false)
+    })
+
+    it('should handle array input', () => {
+      expect(isChanged(['--changed'])).toBe(true)
+      expect(isChanged([])).toBe(false)
+    })
+  })
+
+  describe('isCoverage', () => {
+    it('should return true for coverage flag', () => {
+      expect(isCoverage({ coverage: true })).toBe(true)
+    })
+
+    it('should return true for cover flag', () => {
+      expect(isCoverage({ cover: true })).toBe(true)
+    })
+
+    it('should return false when not set', () => {
+      expect(isCoverage({})).toBe(false)
+    })
+
+    it('should handle array input with coverage', () => {
+      expect(isCoverage(['--coverage'])).toBe(true)
+    })
+
+    it('should handle array input with cover', () => {
+      expect(isCoverage(['--cover'])).toBe(true)
+    })
+
+    it('should return false for empty array', () => {
+      expect(isCoverage([])).toBe(false)
+    })
+  })
+
+  describe('isDebug', () => {
+    it('should return true for debug flag', () => {
+      expect(isDebug({ debug: true })).toBe(true)
+    })
+
+    it('should return false when not set', () => {
+      expect(isDebug({})).toBe(false)
+    })
+
+    it('should handle array input', () => {
+      expect(isDebug(['--debug'])).toBe(true)
+      expect(isDebug([])).toBe(false)
+    })
+  })
+
+  describe('isDryRun', () => {
+    it('should return true for dry-run flag', () => {
+      expect(isDryRun({ 'dry-run': true })).toBe(true)
+    })
+
+    it('should return false when not set', () => {
+      expect(isDryRun({})).toBe(false)
+    })
+
+    it('should handle array input', () => {
+      expect(isDryRun(['--dry-run'])).toBe(true)
+      expect(isDryRun([])).toBe(false)
+    })
+  })
+
+  describe('isFix', () => {
+    it('should return true for fix flag', () => {
+      expect(isFix({ fix: true })).toBe(true)
+    })
+
+    it('should return false when not set', () => {
+      expect(isFix({})).toBe(false)
+    })
+
+    it('should handle array input', () => {
+      expect(isFix(['--fix'])).toBe(true)
+      expect(isFix([])).toBe(false)
+    })
+  })
+
+  describe('isForce', () => {
+    it('should return true for force flag', () => {
+      expect(isForce({ force: true })).toBe(true)
+    })
+
+    it('should return false when not set', () => {
+      expect(isForce({})).toBe(false)
+    })
+
+    it('should handle array input', () => {
+      expect(isForce(['--force'])).toBe(true)
+      expect(isForce([])).toBe(false)
+    })
+  })
+
+  describe('isHelp', () => {
+    it('should return true for help flag', () => {
+      expect(isHelp({ help: true })).toBe(true)
+    })
+
+    it('should return false when not set', () => {
+      expect(isHelp({})).toBe(false)
+    })
+
+    it('should handle --help in array', () => {
+      expect(isHelp(['--help'])).toBe(true)
+    })
+
+    it('should handle -h short flag in array', () => {
+      expect(isHelp(['-h'])).toBe(true)
+    })
+
+    it('should return false for empty array', () => {
+      expect(isHelp([])).toBe(false)
+    })
+  })
+
+  describe('isJson', () => {
+    it('should return true for json flag', () => {
+      expect(isJson({ json: true })).toBe(true)
+    })
+
+    it('should return false when not set', () => {
+      expect(isJson({})).toBe(false)
+    })
+
+    it('should handle array input', () => {
+      expect(isJson(['--json'])).toBe(true)
+      expect(isJson([])).toBe(false)
+    })
+  })
+
+  describe('isQuiet', () => {
+    it('should return true for quiet flag', () => {
+      expect(isQuiet({ quiet: true })).toBe(true)
+    })
+
+    it('should return true for silent flag', () => {
+      expect(isQuiet({ silent: true })).toBe(true)
+    })
+
+    it('should return false when not set', () => {
+      expect(isQuiet({})).toBe(false)
+    })
+
+    it('should handle --quiet in array', () => {
+      expect(isQuiet(['--quiet'])).toBe(true)
+    })
+
+    it('should handle --silent in array', () => {
+      expect(isQuiet(['--silent'])).toBe(true)
+    })
+
+    it('should return false for empty array', () => {
+      expect(isQuiet([])).toBe(false)
+    })
+  })
+
+  describe('isStaged', () => {
+    it('should return true for staged flag', () => {
+      expect(isStaged({ staged: true })).toBe(true)
+    })
+
+    it('should return false when not set', () => {
+      expect(isStaged({})).toBe(false)
+    })
+
+    it('should handle array input', () => {
+      expect(isStaged(['--staged'])).toBe(true)
+      expect(isStaged([])).toBe(false)
+    })
+  })
+
+  describe('isUpdate', () => {
+    it('should return true for update flag', () => {
+      expect(isUpdate({ update: true })).toBe(true)
+    })
+
+    it('should return false when not set', () => {
+      expect(isUpdate({})).toBe(false)
+    })
+
+    it('should handle --update in array', () => {
+      expect(isUpdate(['--update'])).toBe(true)
+    })
+
+    it('should handle -u short flag in array', () => {
+      expect(isUpdate(['-u'])).toBe(true)
+    })
+
+    it('should return false for empty array', () => {
+      expect(isUpdate([])).toBe(false)
+    })
+  })
+
+  describe('isVerbose', () => {
+    it('should return true for verbose flag', () => {
+      expect(isVerbose({ verbose: true })).toBe(true)
+    })
+
+    it('should return false when not set', () => {
+      expect(isVerbose({})).toBe(false)
+    })
+
+    it('should handle array input', () => {
+      expect(isVerbose(['--verbose'])).toBe(true)
+      expect(isVerbose([])).toBe(false)
+    })
+  })
+
+  describe('isWatch', () => {
+    it('should return true for watch flag', () => {
+      expect(isWatch({ watch: true })).toBe(true)
+    })
+
+    it('should return false when not set', () => {
+      expect(isWatch({})).toBe(false)
+    })
+
+    it('should handle --watch in array', () => {
+      expect(isWatch(['--watch'])).toBe(true)
+    })
+
+    it('should handle -w short flag in array', () => {
+      expect(isWatch(['-w'])).toBe(true)
+    })
+
+    it('should return false for empty array', () => {
+      expect(isWatch([])).toBe(false)
+    })
+  })
+
+  describe('COMMON_FLAGS', () => {
+    it('should be defined', () => {
+      expect(COMMON_FLAGS).toBeDefined()
+      expect(typeof COMMON_FLAGS).toBe('object')
+    })
+
+    it('should have all flag defined', () => {
+      expect(COMMON_FLAGS.all).toBeDefined()
+      expect(COMMON_FLAGS.all.type).toBe('boolean')
+      expect(COMMON_FLAGS.all.default).toBe(false)
+    })
+
+    it('should have changed flag defined', () => {
+      expect(COMMON_FLAGS.changed).toBeDefined()
+      expect(COMMON_FLAGS.changed.type).toBe('boolean')
+    })
+
+    it('should have coverage flag defined', () => {
+      expect(COMMON_FLAGS.coverage).toBeDefined()
+      expect(COMMON_FLAGS.coverage.type).toBe('boolean')
+    })
+
+    it('should have debug flag defined', () => {
+      expect(COMMON_FLAGS.debug).toBeDefined()
+      expect(COMMON_FLAGS.debug.type).toBe('boolean')
+    })
+
+    it('should have dry-run flag defined', () => {
+      expect(COMMON_FLAGS['dry-run']).toBeDefined()
+      expect(COMMON_FLAGS['dry-run'].type).toBe('boolean')
+    })
+
+    it('should have fix flag defined', () => {
+      expect(COMMON_FLAGS.fix).toBeDefined()
+      expect(COMMON_FLAGS.fix.type).toBe('boolean')
+    })
+
+    it('should have force flag defined', () => {
+      expect(COMMON_FLAGS.force).toBeDefined()
+      expect(COMMON_FLAGS.force.type).toBe('boolean')
+    })
+
+    it('should have help flag with short alias', () => {
+      expect(COMMON_FLAGS.help).toBeDefined()
+      expect(COMMON_FLAGS.help.type).toBe('boolean')
+      expect(COMMON_FLAGS.help.short).toBe('h')
+    })
+
+    it('should have json flag defined', () => {
+      expect(COMMON_FLAGS.json).toBeDefined()
+      expect(COMMON_FLAGS.json.type).toBe('boolean')
+    })
+
+    it('should have quiet flag with short alias', () => {
+      expect(COMMON_FLAGS.quiet).toBeDefined()
+      expect(COMMON_FLAGS.quiet.type).toBe('boolean')
+      expect(COMMON_FLAGS.quiet.short).toBe('q')
+    })
+
+    it('should have silent flag defined', () => {
+      expect(COMMON_FLAGS.silent).toBeDefined()
+      expect(COMMON_FLAGS.silent.type).toBe('boolean')
+    })
+
+    it('should have staged flag defined', () => {
+      expect(COMMON_FLAGS.staged).toBeDefined()
+      expect(COMMON_FLAGS.staged.type).toBe('boolean')
+    })
+
+    it('should have update flag with short alias', () => {
+      expect(COMMON_FLAGS.update).toBeDefined()
+      expect(COMMON_FLAGS.update.type).toBe('boolean')
+      expect(COMMON_FLAGS.update.short).toBe('u')
+    })
+
+    it('should have verbose flag with short alias', () => {
+      expect(COMMON_FLAGS.verbose).toBeDefined()
+      expect(COMMON_FLAGS.verbose.type).toBe('boolean')
+      expect(COMMON_FLAGS.verbose.short).toBe('v')
+    })
+
+    it('should have watch flag with short alias', () => {
+      expect(COMMON_FLAGS.watch).toBeDefined()
+      expect(COMMON_FLAGS.watch.type).toBe('boolean')
+      expect(COMMON_FLAGS.watch.short).toBe('w')
+    })
+
+    it('should have descriptions for all flags', () => {
+      for (const { 1: config } of Object.entries(COMMON_FLAGS)) {
+        expect(config.description).toBeDefined()
+        expect(typeof config.description).toBe('string')
+        expect(config.description.length).toBeGreaterThan(0)
+      }
+    })
+  })
+
+  describe('edge cases', () => {
+    it('should handle truthy values as boolean true', () => {
+      // @ts-expect-error - Testing runtime coercion of non-boolean values
+      expect(isDebug({ debug: 1 } as FlagValues)).toBe(true)
+      // @ts-expect-error - Testing runtime coercion of non-boolean values
+      expect(isVerbose({ verbose: 'yes' } as FlagValues)).toBe(true)
+    })
+
+    it('should handle falsy values as boolean false', () => {
+      // @ts-expect-error - Testing runtime coercion of non-boolean values
+      expect(isDebug({ debug: 0 } as FlagValues)).toBe(false)
+      // @ts-expect-error - Testing runtime coercion of non-boolean values
+      expect(isDebug({ debug: '' } as FlagValues)).toBe(false)
+    })
+
+    it('should handle multiple flags in array', () => {
+      expect(isDebug(['--verbose', '--debug', '--quiet'])).toBe(true)
+      expect(isVerbose(['--verbose', '--debug'])).toBe(true)
+    })
+
+    it('should handle flags with values in array', () => {
+      expect(isJson(['--json', 'output.json'])).toBe(true)
+      expect(isForce(['--force', 'true'])).toBe(true)
+    })
+  })
+
+  describe('integration', () => {
+    it('should work with combined flags object', () => {
+      const flags: FlagValues = {
+        debug: true,
+        verbose: true,
+        json: true,
+        force: true,
+      }
+
+      expect(isDebug(flags)).toBe(true)
+      expect(isVerbose(flags)).toBe(true)
+      expect(isJson(flags)).toBe(true)
+      expect(isForce(flags)).toBe(true)
+      expect(isQuiet(flags)).toBe(false)
+    })
+
+    it('should work with combined flags array', () => {
+      const argv = ['--debug', '--verbose', '--json']
+
+      expect(isDebug(argv)).toBe(true)
+      expect(isVerbose(argv)).toBe(true)
+      expect(isJson(argv)).toBe(true)
+      expect(isQuiet(argv)).toBe(false)
+    })
+
+    it('should provide correct log level for various combinations', () => {
+      expect(getLogLevel({ quiet: true, debug: true })).toBe('silent')
+      expect(getLogLevel({ debug: true, verbose: false })).toBe('debug')
+      expect(getLogLevel({ verbose: true, debug: false })).toBe('verbose')
+      expect(getLogLevel({ verbose: false, debug: false })).toBe('info')
+    })
+  })
+})
diff --git a/test/unit/argv-parse.test.ts b/test/unit/argv-parse.test.ts
new file mode 100644
index 0000000..4e7eecf
--- /dev/null
+++ b/test/unit/argv-parse.test.ts
@@ -0,0 +1,529 @@
+/**
+ * @fileoverview Unit tests for command-line argument parsing utilities.
+ *
+ * Tests argv parsing utilities built on Node.js util.parseArgs():
+ * - parseArgs() wrapper for util.parseArgs with type safety
+ * - parseArgsWithDefaults() applies default values to parsed args
+ * - commonParseArgsConfig() shared configuration for common flags
+ * - getPositionalArgs() extracts positional arguments
+ * - hasFlag() checks for boolean flag presence
+ * Used by Socket CLI for command-line argument processing.
+ */
+
+import {
+  commonParseArgsConfig,
+  getPositionalArgs,
+  hasFlag,
+  parseArgs,
+  parseArgsWithDefaults,
+} from '@socketsecurity/lib/argv/parse'
+import { describe, expect, it } from 'vitest'
+
+describe('argv/parse', () => {
+  describe('parseArgs', () => {
+    it('should parse empty arguments', () => {
+      const result = parseArgs({ args: [] })
+      expect(result.values).toEqual({})
+      expect(result.positionals).toEqual([])
+    })
+
+    it('should parse boolean option', () => {
+      const result = parseArgs({
+        args: ['--verbose'],
+        options: {
+          verbose: { type: 'boolean' },
+        },
+      })
+      expect(result.values.verbose).toBe(true)
+    })
+
+    it('should parse string option', () => {
+      const result = parseArgs({
+        args: ['--name', 'test'],
+        options: {
+          name: { type: 'string' },
+        },
+      })
+      expect(result.values.name).toBe('test')
+    })
+
+    it('should parse positional arguments', () => {
+      const result = parseArgs({
+        args: ['file1.js', 'file2.js'],
+        options: {},
+      })
+      expect(result.positionals).toEqual(['file1.js', 'file2.js'])
+    })
+
+    it('should handle short aliases', () => {
+      const result = parseArgs({
+        args: ['-v'],
+        options: {
+          verbose: { type: 'boolean', short: 'v' },
+        },
+      })
+      expect(result.values.verbose).toBe(true)
+    })
+
+    it('should handle default values', () => {
+      const result = parseArgs({
+        args: [],
+        options: {
+          port: { type: 'string', default: '3000' },
+        },
+      })
+      expect(result.values.port).toBe('3000')
+    })
+
+    it('should handle multiple values with array option', () => {
+      const result = parseArgs({
+        args: ['--file', 'a.js', '--file', 'b.js'],
+        options: {
+          file: { type: 'string', multiple: true },
+        },
+      })
+      expect(result.values.file).toEqual(['a.js', 'b.js'])
+    })
+
+    it('should handle coerce function', () => {
+      const result = parseArgs({
+        args: ['--port', '3000'],
+        options: {
+          port: {
+            type: 'string',
+            coerce: value => Number.parseInt(value as string, 10),
+          },
+        },
+      })
+      expect(result.values.port).toBe(3000)
+    })
+
+    it('should handle kebab-case to camelCase conversion', () => {
+      const result = parseArgs({
+        args: ['--temp-dir', '/tmp'],
+        options: {
+          'temp-dir': { type: 'string' },
+        },
+      })
+      expect(result.values.tempDir).toBe('/tmp')
+    })
+
+    it('should handle strict mode with unknown options', () => {
+      const result = parseArgs({
+        args: ['--unknown', 'value'],
+        options: {},
+        strict: false,
+      })
+      expect(result.values.unknown).toBe('value')
+    })
+
+    it('should handle allowPositionals option', () => {
+      const result = parseArgs({
+        args: ['--flag', 'file.js'],
+        options: {
+          flag: { type: 'boolean' },
+        },
+        allowPositionals: true,
+      })
+      expect(result.positionals).toEqual(['file.js'])
+    })
+
+    it('should handle -- separator', () => {
+      const result = parseArgs({
+        args: ['--flag', '--', '--not-a-flag'],
+        options: {
+          flag: { type: 'boolean' },
+        },
+      })
+      expect(result.values.flag).toBe(true)
+      // Args after -- are in the raw['--'] array
+      expect(result.raw['--']).toEqual(['--not-a-flag'])
+    })
+
+    it('should handle boolean negation with --no prefix', () => {
+      const result = parseArgs({
+        args: ['--no-color'],
+        options: {
+          color: { type: 'boolean', default: true },
+        },
+        allowNegative: false,
+      })
+      expect(result.values.color).toBe(false)
+    })
+
+    it('should return raw yargs output', () => {
+      const result = parseArgs({
+        args: ['--verbose', 'file.js'],
+        options: {
+          verbose: { type: 'boolean' },
+        },
+      })
+      expect(result.raw).toBeDefined()
+      expect(result.raw._).toEqual(['file.js'])
+    })
+
+    it('should handle multiple boolean flags', () => {
+      const result = parseArgs({
+        args: ['--verbose', '--debug', '--quiet'],
+        options: {
+          verbose: { type: 'boolean' },
+          debug: { type: 'boolean' },
+          quiet: { type: 'boolean' },
+        },
+      })
+      expect(result.values.verbose).toBe(true)
+      expect(result.values.debug).toBe(true)
+      expect(result.values.quiet).toBe(true)
+    })
+
+    it('should handle mixed options and positionals', () => {
+      const result = parseArgs({
+        args: ['file1.js', '--verbose', 'file2.js', '--debug'],
+        options: {
+          verbose: { type: 'boolean' },
+          debug: { type: 'boolean' },
+        },
+      })
+      expect(result.values.verbose).toBe(true)
+      expect(result.values.debug).toBe(true)
+      expect(result.positionals).toEqual(['file1.js', 'file2.js'])
+    })
+
+    it('should handle short option groups', () => {
+      const result = parseArgs({
+        args: ['-vd'],
+        options: {
+          verbose: { type: 'boolean', short: 'v' },
+          debug: { type: 'boolean', short: 'd' },
+        },
+      })
+      expect(result.values.verbose).toBe(true)
+      expect(result.values.debug).toBe(true)
+    })
+
+    it('should handle equals syntax', () => {
+      const result = parseArgs({
+        args: ['--name=test', '--port=3000'],
+        options: {
+          name: { type: 'string' },
+          port: { type: 'string' },
+        },
+      })
+      expect(result.values.name).toBe('test')
+      expect(result.values.port).toBe('3000')
+    })
+
+    it('should preserve both kebab and camel case', () => {
+      const result = parseArgs({
+        args: ['--temp-dir', '/tmp'],
+        options: {
+          'temp-dir': { type: 'string' },
+        },
+      })
+      expect(result.values.tempDir).toBe('/tmp')
+      expect(result.values['temp-dir']).toBe('/tmp')
+    })
+
+    it('should handle configuration options', () => {
+      const result = parseArgs({
+        args: ['--option', 'value'],
+        options: {
+          option: { type: 'string' },
+        },
+        configuration: {
+          'strip-dashed': true,
+        },
+      })
+      expect(result.values.option).toBe('value')
+    })
+  })
+
+  describe('parseArgsWithDefaults', () => {
+    it('should use non-strict mode by default', () => {
+      const result = parseArgsWithDefaults({
+        args: ['--unknown', 'value'],
+        options: {},
+      })
+      expect(result.values.unknown).toBe('value')
+    })
+
+    it('should allow positionals by default', () => {
+      const result = parseArgsWithDefaults({
+        args: ['file1.js', '--flag', 'file2.js'],
+        options: {
+          flag: { type: 'boolean' },
+        },
+      })
+      expect(result.positionals).toEqual(['file1.js', 'file2.js'])
+    })
+
+    it('should override defaults with config', () => {
+      const result = parseArgsWithDefaults({
+        args: ['--unknown'],
+        options: {},
+        strict: true,
+      })
+      // In strict mode, unknown options may not be parsed
+      expect(result).toBeDefined()
+    })
+
+    it('should parse common Socket CLI patterns', () => {
+      const result = parseArgsWithDefaults({
+        args: ['--quiet', '--force', 'package.json'],
+        options: {
+          quiet: { type: 'boolean' },
+          force: { type: 'boolean' },
+        },
+      })
+      expect(result.values.quiet).toBe(true)
+      expect(result.values.force).toBe(true)
+      expect(result.positionals).toEqual(['package.json'])
+    })
+  })
+
+  describe('commonParseArgsConfig', () => {
+    it('should have force option', () => {
+      expect(commonParseArgsConfig.options?.force).toBeDefined()
+      expect(commonParseArgsConfig.options?.force.type).toBe('boolean')
+      expect(commonParseArgsConfig.options?.force.short).toBe('f')
+      expect(commonParseArgsConfig.options?.force.default).toBe(false)
+    })
+
+    it('should have quiet option', () => {
+      expect(commonParseArgsConfig.options?.quiet).toBeDefined()
+      expect(commonParseArgsConfig.options?.quiet.type).toBe('boolean')
+      expect(commonParseArgsConfig.options?.quiet.short).toBe('q')
+      expect(commonParseArgsConfig.options?.quiet.default).toBe(false)
+    })
+
+    it('should use non-strict mode', () => {
+      expect(commonParseArgsConfig.strict).toBe(false)
+    })
+
+    it('should be usable with parseArgs', () => {
+      const result = parseArgs({
+        ...commonParseArgsConfig,
+        args: ['-f', '-q', 'file.js'],
+      })
+      expect(result.values.force).toBe(true)
+      expect(result.values.quiet).toBe(true)
+      expect(result.positionals).toEqual(['file.js'])
+    })
+  })
+
+  describe('getPositionalArgs', () => {
+    it('should extract positional args from start', () => {
+      // Simulate process.argv = ['node', 'script.js', 'file1.js', 'file2.js']
+      const originalArgv = process.argv
+      try {
+        process.argv = ['node', 'script.js', 'file1.js', 'file2.js']
+        const result = getPositionalArgs()
+        expect(result).toEqual(['file1.js', 'file2.js'])
+      } finally {
+        process.argv = originalArgv
+      }
+    })
+
+    it('should stop at first flag', () => {
+      const originalArgv = process.argv
+      try {
+        process.argv = [
+          'node',
+          'script.js',
+          'file1.js',
+          '--verbose',
+          'file2.js',
+        ]
+        const result = getPositionalArgs()
+        expect(result).toEqual(['file1.js'])
+      } finally {
+        process.argv = originalArgv
+      }
+    })
+
+    it('should handle custom start index', () => {
+      const originalArgv = process.argv
+      try {
+        process.argv = [
+          'node',
+          'script.js',
+          'subcommand',
+          'file1.js',
+          'file2.js',
+        ]
+        const result = getPositionalArgs(3)
+        expect(result).toEqual(['file1.js', 'file2.js'])
+      } finally {
+        process.argv = originalArgv
+      }
+    })
+
+    it('should return empty array when no positionals', () => {
+      const originalArgv = process.argv
+      try {
+        process.argv = ['node', 'script.js', '--flag']
+        const result = getPositionalArgs()
+        expect(result).toEqual([])
+      } finally {
+        process.argv = originalArgv
+      }
+    })
+
+    it('should return empty array when all flags', () => {
+      const originalArgv = process.argv
+      try {
+        process.argv = ['node', 'script.js', '--verbose', '--debug']
+        const result = getPositionalArgs()
+        expect(result).toEqual([])
+      } finally {
+        process.argv = originalArgv
+      }
+    })
+  })
+
+  describe('hasFlag', () => {
+    it('should detect long flag', () => {
+      const argv = ['node', 'script.js', '--verbose']
+      expect(hasFlag('verbose', argv)).toBe(true)
+    })
+
+    it('should detect short flag', () => {
+      const argv = ['node', 'script.js', '-v']
+      expect(hasFlag('verbose', argv)).toBe(true)
+    })
+
+    it('should return false for missing flag', () => {
+      const argv = ['node', 'script.js']
+      expect(hasFlag('verbose', argv)).toBe(false)
+    })
+
+    it('should use process.argv by default', () => {
+      const originalArgv = process.argv
+      try {
+        process.argv = ['node', 'script.js', '--verbose']
+        expect(hasFlag('verbose')).toBe(true)
+      } finally {
+        process.argv = originalArgv
+      }
+    })
+
+    it('should handle flags with values', () => {
+      const argv = ['node', 'script.js', '--name', 'test']
+      expect(hasFlag('name', argv)).toBe(true)
+    })
+
+    it('should handle multiple flags', () => {
+      const argv = ['node', 'script.js', '--verbose', '--debug', '--quiet']
+      expect(hasFlag('verbose', argv)).toBe(true)
+      expect(hasFlag('debug', argv)).toBe(true)
+      expect(hasFlag('quiet', argv)).toBe(true)
+    })
+
+    it('should not match partial flags', () => {
+      const argv = ['node', 'script.js', '--verbosity']
+      expect(hasFlag('verbose', argv)).toBe(false)
+    })
+
+    it('should handle single letter flags', () => {
+      const argv = ['node', 'script.js', '-h']
+      expect(hasFlag('h', argv)).toBe(true)
+    })
+  })
+
+  describe('edge cases', () => {
+    it('should handle empty options object', () => {
+      const result = parseArgs({
+        args: ['--flag', 'value'],
+        options: {},
+        strict: false,
+      })
+      expect(result.values.flag).toBe('value')
+    })
+
+    it('should handle duplicate flags with array option', () => {
+      const result = parseArgs({
+        args: ['--tag', 'v1', '--tag', 'v2', '--tag', 'v3'],
+        options: {
+          tag: { type: 'string', multiple: true },
+        },
+      })
+      expect(result.values.tag).toEqual(['v1', 'v2', 'v3'])
+    })
+
+    it('should handle boolean with explicit value', () => {
+      const result = parseArgs({
+        args: ['--verbose=true'],
+        options: {
+          verbose: { type: 'boolean' },
+        },
+      })
+      expect(result.values.verbose).toBe(true)
+    })
+
+    it('should handle empty string values', () => {
+      const result = parseArgs({
+        args: ['--name', ''],
+        options: {
+          name: { type: 'string' },
+        },
+      })
+      expect(result.values.name).toBe('')
+    })
+
+    it('should handle numeric strings', () => {
+      const result = parseArgs({
+        args: ['--port', '3000'],
+        options: {
+          port: { type: 'string' },
+        },
+      })
+      expect(result.values.port).toBe('3000')
+      expect(typeof result.values.port).toBe('string')
+    })
+  })
+
+  describe('integration', () => {
+    it('should handle complex real-world CLI patterns', () => {
+      const result = parseArgs({
+        args: [
+          '--quiet',
+          '-f',
+          '--temp-dir',
+          '/tmp/test',
+          'src/**/*.js',
+          '--exclude',
+          'node_modules',
+          '--exclude',
+          'dist',
+          '--',
+          '--literal-arg',
+        ],
+        options: {
+          quiet: { type: 'boolean', short: 'q' },
+          force: { type: 'boolean', short: 'f' },
+          'temp-dir': { type: 'string' },
+          exclude: { type: 'string', multiple: true },
+        },
+      })
+
+      expect(result.values.quiet).toBe(true)
+      expect(result.values.force).toBe(true)
+      expect(result.values.tempDir).toBe('/tmp/test')
+      expect(result.values.exclude).toEqual(['node_modules', 'dist'])
+      expect(result.positionals).toEqual(['src/**/*.js'])
+      // Args after -- are in the raw['--'] array
+      expect(result.raw['--']).toEqual(['--literal-arg'])
+    })
+
+    it('should work with Socket CLI common patterns', () => {
+      const result = parseArgs({
+        ...commonParseArgsConfig,
+        args: ['-f', '-q', 'package.json', 'tsconfig.json'],
+      })
+
+      expect(result.values.force).toBe(true)
+      expect(result.values.quiet).toBe(true)
+      expect(result.positionals).toEqual(['package.json', 'tsconfig.json'])
+    })
+  })
+})
diff --git a/test/unit/argv/flags.test.ts b/test/unit/argv/flags.test.ts
new file mode 100644
index 0000000..a41c86e
--- /dev/null
+++ b/test/unit/argv/flags.test.ts
@@ -0,0 +1,355 @@
+/**
+ * @fileoverview Unit tests for CLI flag utilities.
+ *
+ * Tests boolean flag checking functions for common CLI options:
+ * - getLogLevel() determines logging verbosity (silent/info/debug) with priority handling
+ * - Flag checkers: isDebug, isVerbose, isQuiet, isHelp, isJson, isForce, isDryRun
+ * - Additional flags: isAll, isChanged, isCoverage, isFix, isStaged, isUpdate, isWatch
+ * - Handles arrays of strings (process.argv) and FlagValues objects
+ * - Tests flag priority (quiet > debug > verbose) and default values
+ * - Validates both long-form flags (--verbose) and flag objects ({ verbose: true })
+ */
+
+import {
+  getLogLevel,
+  isAll,
+  isChanged,
+  isCoverage,
+  isDebug,
+  isDryRun,
+  isFix,
+  isForce,
+  isHelp,
+  isJson,
+  isQuiet,
+  isStaged,
+  isUpdate,
+  isVerbose,
+  isWatch,
+  type FlagValues,
+} from '@socketsecurity/lib/argv/flags'
+import { describe, expect, it } from 'vitest'
+
+describe('argv/flags', () => {
+  describe('getLogLevel', () => {
+    it('should return silent for quiet flag', () => {
+      expect(getLogLevel({ quiet: true })).toBe('silent')
+    })
+
+    it('should return debug for debug flag', () => {
+      expect(getLogLevel({ debug: true })).toBe('debug')
+    })
+
+    it('should return verbose for verbose flag', () => {
+      expect(getLogLevel({ verbose: true })).toBe('verbose')
+    })
+
+    it('should return info by default', () => {
+      expect(getLogLevel({})).toBe('info')
+    })
+
+    it('should prioritize quiet over debug', () => {
+      expect(getLogLevel({ quiet: true, debug: true })).toBe('silent')
+    })
+
+    it('should prioritize quiet over verbose', () => {
+      expect(getLogLevel({ quiet: true, verbose: true })).toBe('silent')
+    })
+
+    it('should prioritize debug over verbose', () => {
+      expect(getLogLevel({ debug: true, verbose: true })).toBe('debug')
+    })
+
+    it('should work with argv array', () => {
+      expect(getLogLevel(['--debug'])).toBe('debug')
+      expect(getLogLevel(['--verbose'])).toBe('verbose')
+      expect(getLogLevel(['--quiet'])).toBe('silent')
+    })
+  })
+
+  describe('isAll', () => {
+    it('should return true when all flag is set', () => {
+      expect(isAll({ all: true })).toBe(true)
+    })
+
+    it('should return false when all flag is not set', () => {
+      expect(isAll({ all: false })).toBe(false)
+      expect(isAll({})).toBe(false)
+    })
+
+    it('should work with argv array', () => {
+      expect(isAll(['--all'])).toBe(true)
+      expect(isAll(['--other'])).toBe(false)
+    })
+  })
+
+  describe('isChanged', () => {
+    it('should return true when changed flag is set', () => {
+      expect(isChanged({ changed: true })).toBe(true)
+    })
+
+    it('should return false when changed flag is not set', () => {
+      expect(isChanged({ changed: false })).toBe(false)
+      expect(isChanged({})).toBe(false)
+    })
+
+    it('should work with argv array', () => {
+      expect(isChanged(['--changed'])).toBe(true)
+      expect(isChanged([])).toBe(false)
+    })
+  })
+
+  describe('isCoverage', () => {
+    it('should return true for coverage flag', () => {
+      expect(isCoverage({ coverage: true })).toBe(true)
+    })
+
+    it('should return true for cover flag', () => {
+      expect(isCoverage({ cover: true })).toBe(true)
+    })
+
+    it('should return false when neither flag is set', () => {
+      expect(isCoverage({})).toBe(false)
+    })
+
+    it('should work with argv array', () => {
+      expect(isCoverage(['--coverage'])).toBe(true)
+      expect(isCoverage(['--cover'])).toBe(true)
+      expect(isCoverage([])).toBe(false)
+    })
+  })
+
+  describe('isDebug', () => {
+    it('should return true when debug flag is set', () => {
+      expect(isDebug({ debug: true })).toBe(true)
+    })
+
+    it('should return false when debug flag is not set', () => {
+      expect(isDebug({ debug: false })).toBe(false)
+      expect(isDebug({})).toBe(false)
+    })
+
+    it('should work with argv array', () => {
+      expect(isDebug(['--debug'])).toBe(true)
+      expect(isDebug([])).toBe(false)
+    })
+  })
+
+  describe('isDryRun', () => {
+    it('should return true when dry-run flag is set', () => {
+      expect(isDryRun({ 'dry-run': true })).toBe(true)
+    })
+
+    it('should return false when dry-run flag is not set', () => {
+      expect(isDryRun({ 'dry-run': false })).toBe(false)
+      expect(isDryRun({})).toBe(false)
+    })
+
+    it('should work with argv array', () => {
+      expect(isDryRun(['--dry-run'])).toBe(true)
+      expect(isDryRun([])).toBe(false)
+    })
+  })
+
+  describe('isFix', () => {
+    it('should return true when fix flag is set', () => {
+      expect(isFix({ fix: true })).toBe(true)
+    })
+
+    it('should return false when fix flag is not set', () => {
+      expect(isFix({ fix: false })).toBe(false)
+      expect(isFix({})).toBe(false)
+    })
+
+    it('should work with argv array', () => {
+      expect(isFix(['--fix'])).toBe(true)
+      expect(isFix([])).toBe(false)
+    })
+  })
+
+  describe('isForce', () => {
+    it('should return true when force flag is set', () => {
+      expect(isForce({ force: true })).toBe(true)
+    })
+
+    it('should return false when force flag is not set', () => {
+      expect(isForce({ force: false })).toBe(false)
+      expect(isForce({})).toBe(false)
+    })
+
+    it('should work with argv array', () => {
+      expect(isForce(['--force'])).toBe(true)
+      expect(isForce([])).toBe(false)
+    })
+  })
+
+  describe('isHelp', () => {
+    it('should return true when help flag is set', () => {
+      expect(isHelp({ help: true })).toBe(true)
+    })
+
+    it('should return false when help flag is not set', () => {
+      expect(isHelp({ help: false })).toBe(false)
+      expect(isHelp({})).toBe(false)
+    })
+
+    it('should work with argv array', () => {
+      expect(isHelp(['--help'])).toBe(true)
+      expect(isHelp([])).toBe(false)
+    })
+  })
+
+  describe('isJson', () => {
+    it('should return true when json flag is set', () => {
+      expect(isJson({ json: true })).toBe(true)
+    })
+
+    it('should return false when json flag is not set', () => {
+      expect(isJson({ json: false })).toBe(false)
+      expect(isJson({})).toBe(false)
+    })
+
+    it('should work with argv array', () => {
+      expect(isJson(['--json'])).toBe(true)
+      expect(isJson([])).toBe(false)
+    })
+  })
+
+  describe('isQuiet', () => {
+    it('should return true when quiet flag is set', () => {
+      expect(isQuiet({ quiet: true })).toBe(true)
+    })
+
+    it('should return false when quiet flag is not set', () => {
+      expect(isQuiet({ quiet: false })).toBe(false)
+      expect(isQuiet({})).toBe(false)
+    })
+
+    it('should work with argv array', () => {
+      expect(isQuiet(['--quiet'])).toBe(true)
+      expect(isQuiet([])).toBe(false)
+    })
+  })
+
+  describe('isQuiet (silent behavior)', () => {
+    it('should treat quiet as silent', () => {
+      // isQuiet provides the silent behavior
+      expect(isQuiet({ quiet: true })).toBe(true)
+    })
+  })
+
+  describe('isStaged', () => {
+    it('should return true when staged flag is set', () => {
+      expect(isStaged({ staged: true })).toBe(true)
+    })
+
+    it('should return false when staged flag is not set', () => {
+      expect(isStaged({ staged: false })).toBe(false)
+      expect(isStaged({})).toBe(false)
+    })
+
+    it('should work with argv array', () => {
+      expect(isStaged(['--staged'])).toBe(true)
+      expect(isStaged([])).toBe(false)
+    })
+  })
+
+  describe('isUpdate', () => {
+    it('should return true when update flag is set', () => {
+      expect(isUpdate({ update: true })).toBe(true)
+    })
+
+    it('should return false when update flag is not set', () => {
+      expect(isUpdate({ update: false })).toBe(false)
+      expect(isUpdate({})).toBe(false)
+    })
+
+    it('should work with argv array', () => {
+      expect(isUpdate(['--update'])).toBe(true)
+      expect(isUpdate([])).toBe(false)
+    })
+  })
+
+  describe('isVerbose', () => {
+    it('should return true when verbose flag is set', () => {
+      expect(isVerbose({ verbose: true })).toBe(true)
+    })
+
+    it('should return false when verbose flag is not set', () => {
+      expect(isVerbose({ verbose: false })).toBe(false)
+      expect(isVerbose({})).toBe(false)
+    })
+
+    it('should work with argv array', () => {
+      expect(isVerbose(['--verbose'])).toBe(true)
+      expect(isVerbose([])).toBe(false)
+    })
+  })
+
+  describe('isWatch', () => {
+    it('should return true when watch flag is set', () => {
+      expect(isWatch({ watch: true })).toBe(true)
+    })
+
+    it('should return false when watch flag is not set', () => {
+      expect(isWatch({ watch: false })).toBe(false)
+      expect(isWatch({})).toBe(false)
+    })
+
+    it('should work with argv array', () => {
+      expect(isWatch(['--watch'])).toBe(true)
+      expect(isWatch([])).toBe(false)
+    })
+  })
+
+  describe('FlagValues type', () => {
+    it('should accept all standard flags', () => {
+      const flags: FlagValues = {
+        quiet: true,
+        silent: false,
+        verbose: true,
+        help: false,
+        all: true,
+        fix: false,
+        force: true,
+        'dry-run': false,
+        json: true,
+        debug: false,
+        watch: true,
+        coverage: false,
+        cover: true,
+        update: false,
+        staged: true,
+        changed: false,
+      }
+      expect(flags.quiet).toBe(true)
+      expect(flags.verbose).toBe(true)
+    })
+
+    it('should accept custom flags', () => {
+      const flags: FlagValues = {
+        customFlag: 'custom-value',
+        anotherFlag: 123,
+      }
+      expect(flags.customFlag).toBe('custom-value')
+      expect(flags.anotherFlag).toBe(123)
+    })
+  })
+
+  describe('edge cases', () => {
+    it('should handle empty FlagValues', () => {
+      const flags: FlagValues = {}
+      expect(isDebug(flags)).toBe(false)
+      expect(isVerbose(flags)).toBe(false)
+    })
+
+    it('should handle mixed flag types', () => {
+      expect(isDebug(['--debug', '--other', 'arg'])).toBe(true)
+    })
+
+    it('should handle readonly arrays', () => {
+      const args = ['--debug'] as const
+      expect(isDebug(args)).toBe(true)
+    })
+  })
+})
diff --git a/test/unit/argv/parse.test.ts b/test/unit/argv/parse.test.ts
new file mode 100644
index 0000000..dce6ceb
--- /dev/null
+++ b/test/unit/argv/parse.test.ts
@@ -0,0 +1,401 @@
+/**
+ * @fileoverview Unit tests for argument parsing utilities.
+ *
+ * Tests Node.js-compatible argument parsing (util.parseArgs-like API):
+ * - parseArgs() parses process.argv-style arrays into structured options and positionals
+ * - Boolean options (--verbose), string options (--name value), short aliases (-v, -n)
+ * - Default values, multiple values (arrays), kebab-case to camelCase conversion
+ * - Coerce functions for type transformations (string → number, etc.)
+ * - Handles -- separator for terminating option parsing
+ * - Boolean negation (--no-color), equals syntax (--name=value), option groups (-abc)
+ * - strict/allowPositionals/allowNegative modes for controlling parsing behavior
+ * - Returns { values, positionals, raw } matching Node.js util.parseArgs structure
+ */
+
+import { parseArgs, type ParseArgsConfig } from '@socketsecurity/lib/argv/parse'
+import { describe, expect, it } from 'vitest'
+
+describe('argv/parse', () => {
+  describe('parseArgs', () => {
+    it('should parse empty arguments', () => {
+      const result = parseArgs({ args: [] })
+      expect(result.values).toEqual({})
+      expect(result.positionals).toEqual([])
+    })
+
+    it('should parse boolean options', () => {
+      const result = parseArgs({
+        args: ['--verbose'],
+        options: {
+          verbose: { type: 'boolean' },
+        },
+      })
+      expect(result.values.verbose).toBe(true)
+    })
+
+    it('should parse string options', () => {
+      const result = parseArgs({
+        args: ['--name', 'test'],
+        options: {
+          name: { type: 'string' },
+        },
+      })
+      expect(result.values.name).toBe('test')
+    })
+
+    it('should parse multiple options', () => {
+      const result = parseArgs({
+        args: ['--verbose', '--name', 'test', '--count', '42'],
+        options: {
+          verbose: { type: 'boolean' },
+          name: { type: 'string' },
+          count: { type: 'string' },
+        },
+      })
+      expect(result.values.verbose).toBe(true)
+      expect(result.values.name).toBe('test')
+      expect(result.values.count).toBe('42')
+    })
+
+    it('should handle short aliases', () => {
+      const result = parseArgs({
+        args: ['-v'],
+        options: {
+          verbose: { type: 'boolean', short: 'v' },
+        },
+      })
+      expect(result.values.verbose).toBe(true)
+    })
+
+    it('should handle multiple short aliases', () => {
+      const result = parseArgs({
+        args: ['-v', '-n', 'test'],
+        options: {
+          verbose: { type: 'boolean', short: 'v' },
+          name: { type: 'string', short: 'n' },
+        },
+      })
+      expect(result.values.verbose).toBe(true)
+      expect(result.values.name).toBe('test')
+    })
+
+    it('should parse positional arguments', () => {
+      const result = parseArgs({
+        args: ['file1.txt', 'file2.txt'],
+        options: {},
+      })
+      expect(result.positionals).toEqual(['file1.txt', 'file2.txt'])
+    })
+
+    it('should mix options and positionals', () => {
+      const result = parseArgs({
+        args: ['--verbose', 'file.txt', '--name', 'test'],
+        options: {
+          verbose: { type: 'boolean' },
+          name: { type: 'string' },
+        },
+      })
+      expect(result.values.verbose).toBe(true)
+      expect(result.values.name).toBe('test')
+      expect(result.positionals).toEqual(['file.txt'])
+    })
+
+    it('should handle default values', () => {
+      const result = parseArgs({
+        args: [],
+        options: {
+          port: { type: 'string', default: '3000' },
+          verbose: { type: 'boolean', default: false },
+        },
+      })
+      expect(result.values.port).toBe('3000')
+      expect(result.values.verbose).toBe(false)
+    })
+
+    it('should override defaults with provided values', () => {
+      const result = parseArgs({
+        args: ['--port', '8080', '--verbose'],
+        options: {
+          port: { type: 'string', default: '3000' },
+          verbose: { type: 'boolean', default: false },
+        },
+      })
+      expect(result.values.port).toBe('8080')
+      expect(result.values.verbose).toBe(true)
+    })
+
+    it('should handle kebab-case to camelCase conversion', () => {
+      const result = parseArgs({
+        args: ['--temp-dir', '/tmp'],
+        options: {
+          tempDir: { type: 'string' },
+        },
+      })
+      expect(result.values.tempDir).toBe('/tmp')
+    })
+
+    it('should handle multiple values (arrays)', () => {
+      const result = parseArgs({
+        args: ['--tag', 'v1', '--tag', 'v2', '--tag', 'v3'],
+        options: {
+          tag: { type: 'string', multiple: true },
+        },
+      })
+      expect(result.values.tag).toEqual(['v1', 'v2', 'v3'])
+    })
+
+    it('should handle -- separator', () => {
+      const result = parseArgs({
+        args: ['--verbose', '--', '--not-a-flag'],
+        options: {
+          verbose: { type: 'boolean' },
+        },
+      })
+      expect(result.values.verbose).toBe(true)
+      // Arguments after -- may be in positionals or in the raw['--'] array
+      const hasFlag =
+        result.positionals.includes('--not-a-flag') ||
+        Boolean(
+          (result.raw['--'] as string[] | undefined)?.includes('--not-a-flag'),
+        )
+      expect(hasFlag).toBe(true)
+    })
+
+    it('should support coerce functions', () => {
+      const result = parseArgs({
+        args: ['--port', '8080'],
+        options: {
+          port: {
+            type: 'string',
+            coerce: val => Number(val),
+          },
+        },
+      })
+      expect(result.values.port).toBe(8080)
+      expect(typeof result.values.port).toBe('number')
+    })
+
+    it('should handle boolean negation', () => {
+      const result = parseArgs({
+        args: ['--no-color'],
+        options: {
+          color: { type: 'boolean', default: true },
+        },
+      })
+      expect(result.values.color).toBe(false)
+    })
+
+    it('should handle empty string values', () => {
+      const result = parseArgs({
+        args: ['--name', ''],
+        options: {
+          name: { type: 'string' },
+        },
+      })
+      expect(result.values.name).toBe('')
+    })
+
+    it('should handle allowPositionals option', () => {
+      const result = parseArgs({
+        args: ['--verbose', 'positional'],
+        options: {
+          verbose: { type: 'boolean' },
+        },
+        allowPositionals: true,
+      })
+      expect(result.positionals).toContain('positional')
+    })
+
+    it('should handle strict mode', () => {
+      const result = parseArgs({
+        args: ['--verbose', '--unknown'],
+        options: {
+          verbose: { type: 'boolean' },
+        },
+        strict: false,
+      })
+      expect(result.values.verbose).toBe(true)
+    })
+
+    it('should provide raw parsed arguments', () => {
+      const result = parseArgs({
+        args: ['--verbose', 'file.txt'],
+        options: {
+          verbose: { type: 'boolean' },
+        },
+      })
+      expect(result.raw).toBeDefined()
+      expect(result.raw._).toBeDefined()
+    })
+
+    it('should handle complex scenarios', () => {
+      const result = parseArgs({
+        args: [
+          '--verbose',
+          '-n',
+          'myapp',
+          '--tag',
+          'v1',
+          '--tag',
+          'v2',
+          'input.txt',
+          'output.txt',
+        ],
+        options: {
+          verbose: { type: 'boolean', short: 'v' },
+          name: { type: 'string', short: 'n' },
+          tag: { type: 'string', multiple: true },
+        },
+        allowPositionals: true,
+      })
+      expect(result.values.verbose).toBe(true)
+      expect(result.values.name).toBe('myapp')
+      expect(Array.isArray(result.values.tag)).toBe(true)
+      // Positionals handling varies by implementation, just verify options work
+      expect(result.positionals).toBeDefined()
+    })
+
+    it('should handle configuration options', () => {
+      const result = parseArgs({
+        args: ['--verbose'],
+        options: {
+          verbose: { type: 'boolean' },
+        },
+        configuration: {
+          'camel-case-expansion': false,
+        },
+      })
+      expect(result.values.verbose).toBe(true)
+    })
+  })
+
+  describe('ParseArgsConfig type', () => {
+    it('should accept minimal config', () => {
+      const config: ParseArgsConfig = {}
+      const result = parseArgs(config)
+      expect(result).toBeDefined()
+    })
+
+    it('should accept full config', () => {
+      const config: ParseArgsConfig = {
+        args: ['--test'],
+        options: {
+          test: { type: 'boolean', short: 't', default: false },
+        },
+        strict: true,
+        allowPositionals: true,
+        allowNegative: false,
+      }
+      const result = parseArgs(config)
+      expect(result.values.test).toBe(true)
+    })
+  })
+
+  describe('edge cases', () => {
+    it('should handle undefined args', () => {
+      const result = parseArgs({
+        args: undefined,
+        options: {},
+      })
+      expect(result).toBeDefined()
+    })
+
+    it('should handle null-like values', () => {
+      const result = parseArgs({
+        args: ['--flag'],
+        options: {
+          flag: { type: 'boolean' },
+        },
+      })
+      expect(result.values.flag).toBe(true)
+    })
+
+    it('should handle numeric strings without conversion', () => {
+      const result = parseArgs({
+        args: ['--value', '42'],
+        options: {
+          value: { type: 'string' },
+        },
+      })
+      expect(result.values.value).toBe('42')
+      expect(typeof result.values.value).toBe('string')
+    })
+
+    it('should handle equals syntax', () => {
+      const result = parseArgs({
+        args: ['--name=test', '--count=42'],
+        options: {
+          name: { type: 'string' },
+          count: { type: 'string' },
+        },
+      })
+      expect(result.values.name).toBe('test')
+      expect(result.values.count).toBe('42')
+    })
+
+    it('should handle short option groups', () => {
+      const result = parseArgs({
+        args: ['-abc'],
+        options: {
+          a: { type: 'boolean', short: 'a' },
+          b: { type: 'boolean', short: 'b' },
+          c: { type: 'boolean', short: 'c' },
+        },
+      })
+      expect(result.values.a).toBe(true)
+      expect(result.values.b).toBe(true)
+      expect(result.values.c).toBe(true)
+    })
+
+    it('should handle repeated boolean flags', () => {
+      const result = parseArgs({
+        args: ['--verbose', '--verbose'],
+        options: {
+          verbose: { type: 'boolean' },
+        },
+      })
+      expect(result.values.verbose).toBe(true)
+    })
+  })
+
+  describe('coerce transformations', () => {
+    it('should coerce to number', () => {
+      const result = parseArgs({
+        args: ['--port', '3000'],
+        options: {
+          port: {
+            type: 'string',
+            coerce: val => Number.parseInt(val as string, 10),
+          },
+        },
+      })
+      expect(result.values.port).toBe(3000)
+    })
+
+    it('should coerce to uppercase', () => {
+      const result = parseArgs({
+        args: ['--env', 'production'],
+        options: {
+          env: {
+            type: 'string',
+            coerce: val => (val as string).toUpperCase(),
+          },
+        },
+      })
+      expect(result.values.env).toBe('PRODUCTION')
+    })
+
+    it('should coerce arrays', () => {
+      const result = parseArgs({
+        args: ['--tags', 'a,b,c'],
+        options: {
+          tags: {
+            type: 'string',
+            coerce: val => (val as string).split(','),
+          },
+        },
+      })
+      expect(result.values.tags).toEqual(['a', 'b', 'c'])
+    })
+  })
+})
diff --git a/test/unit/arrays.test.ts b/test/unit/arrays.test.ts
new file mode 100644
index 0000000..f9c0bbc
--- /dev/null
+++ b/test/unit/arrays.test.ts
@@ -0,0 +1,317 @@
+/**
+ * @fileoverview Unit tests for array utility functions.
+ *
+ * Tests array manipulation and formatting utilities:
+ * - arrayChunk() splits arrays into fixed-size chunks with proper remainder handling
+ * - arrayUnique() removes duplicates using Set (preserves first occurrence order)
+ * - isArray() alias for Array.isArray with type guard support
+ * - joinAnd() formats arrays as grammatical lists with "and" (uses Intl.ListFormat)
+ * - joinOr() formats arrays as grammatical lists with "or" (uses Intl.ListFormat)
+ * Tests cover edge cases: empty arrays, single elements, readonly arrays, large arrays,
+ * error conditions (negative chunk sizes), and formatter caching behavior.
+ */
+
+import {
+  arrayChunk,
+  arrayUnique,
+  isArray,
+  joinAnd,
+  joinOr,
+} from '@socketsecurity/lib/arrays'
+import { describe, expect, it } from 'vitest'
+
+describe('arrays', () => {
+  describe('arrayChunk', () => {
+    it('should split array into chunks of specified size', () => {
+      const arr = [1, 2, 3, 4, 5, 6]
+      const result = arrayChunk(arr, 2)
+      expect(result).toEqual([
+        [1, 2],
+        [3, 4],
+        [5, 6],
+      ])
+    })
+
+    it('should handle uneven chunks', () => {
+      const arr = [1, 2, 3, 4, 5]
+      const result = arrayChunk(arr, 2)
+      expect(result).toEqual([[1, 2], [3, 4], [5]])
+    })
+
+    it('should default to chunk size of 2', () => {
+      const arr = [1, 2, 3, 4]
+      const result = arrayChunk(arr)
+      expect(result).toEqual([
+        [1, 2],
+        [3, 4],
+      ])
+    })
+
+    it('should handle single element arrays', () => {
+      const arr = [1]
+      const result = arrayChunk(arr, 3)
+      expect(result).toEqual([[1]])
+    })
+
+    it('should handle empty arrays', () => {
+      const arr: number[] = []
+      const result = arrayChunk(arr, 2)
+      expect(result).toEqual([])
+    })
+
+    it('should throw error for chunk size <= 0', () => {
+      const arr = [1, 2, 3]
+      expect(() => arrayChunk(arr, 0)).toThrow(
+        'Chunk size must be greater than 0',
+      )
+      expect(() => arrayChunk(arr, -1)).toThrow(
+        'Chunk size must be greater than 0',
+      )
+    })
+
+    it('should handle chunk size larger than array', () => {
+      const arr = [1, 2, 3]
+      const result = arrayChunk(arr, 10)
+      expect(result).toEqual([[1, 2, 3]])
+    })
+
+    it('should work with readonly arrays', () => {
+      const arr: readonly number[] = [1, 2, 3, 4]
+      const result = arrayChunk(arr, 2)
+      expect(result).toEqual([
+        [1, 2],
+        [3, 4],
+      ])
+    })
+  })
+
+  describe('arrayUnique', () => {
+    it('should remove duplicate primitive values', () => {
+      const arr = [1, 2, 2, 3, 3, 3, 4]
+      const result = arrayUnique(arr)
+      expect(result).toEqual([1, 2, 3, 4])
+    })
+
+    it('should remove duplicate strings', () => {
+      const arr = ['a', 'b', 'b', 'c', 'a']
+      const result = arrayUnique(arr)
+      expect(result).toEqual(['a', 'b', 'c'])
+    })
+
+    it('should handle empty arrays', () => {
+      const arr: number[] = []
+      const result = arrayUnique(arr)
+      expect(result).toEqual([])
+    })
+
+    it('should handle arrays with no duplicates', () => {
+      const arr = [1, 2, 3, 4]
+      const result = arrayUnique(arr)
+      expect(result).toEqual([1, 2, 3, 4])
+    })
+
+    it('should work with readonly arrays', () => {
+      const arr: readonly string[] = ['x', 'y', 'x', 'z']
+      const result = arrayUnique(arr)
+      expect(result).toEqual(['x', 'y', 'z'])
+    })
+
+    it('should handle mixed types', () => {
+      const arr = [1, '1', 2, '2', 1, '1']
+      const result = arrayUnique(arr)
+      expect(result).toEqual([1, '1', 2, '2'])
+    })
+  })
+
+  describe('isArray', () => {
+    it('should return true for arrays', () => {
+      expect(isArray([])).toBe(true)
+      expect(isArray([1, 2, 3])).toBe(true)
+      expect(isArray(new Array(5))).toBe(true)
+    })
+
+    it('should return false for non-arrays', () => {
+      expect(isArray(null)).toBe(false)
+      expect(isArray(undefined)).toBe(false)
+      expect(isArray({})).toBe(false)
+      expect(isArray('array')).toBe(false)
+      expect(isArray(123)).toBe(false)
+      expect(isArray({ length: 0 })).toBe(false)
+    })
+
+    it('should return true for array-like typed arrays', () => {
+      expect(isArray(new Uint8Array(0))).toBe(false)
+      expect(isArray(new Int32Array(0))).toBe(false)
+    })
+  })
+
+  describe('joinAnd', () => {
+    it('should join two items with "and"', () => {
+      const result = joinAnd(['apple', 'banana'])
+      expect(result).toBe('apple and banana')
+    })
+
+    it('should join three items with commas and "and"', () => {
+      const result = joinAnd(['apple', 'banana', 'cherry'])
+      expect(result).toBe('apple, banana, and cherry')
+    })
+
+    it('should handle single item', () => {
+      const result = joinAnd(['apple'])
+      expect(result).toBe('apple')
+    })
+
+    it('should handle empty array', () => {
+      const result = joinAnd([])
+      expect(result).toBe('')
+    })
+
+    it('should work with readonly arrays', () => {
+      const arr: readonly string[] = ['red', 'green', 'blue']
+      const result = joinAnd(arr)
+      expect(result).toBe('red, green, and blue')
+    })
+
+    it('should handle many items', () => {
+      const result = joinAnd(['one', 'two', 'three', 'four', 'five'])
+      expect(result).toBe('one, two, three, four, and five')
+    })
+  })
+
+  describe('joinOr', () => {
+    it('should join two items with "or"', () => {
+      const result = joinOr(['apple', 'banana'])
+      expect(result).toBe('apple or banana')
+    })
+
+    it('should join three items with commas and "or"', () => {
+      const result = joinOr(['apple', 'banana', 'cherry'])
+      expect(result).toBe('apple, banana, or cherry')
+    })
+
+    it('should handle single item', () => {
+      const result = joinOr(['apple'])
+      expect(result).toBe('apple')
+    })
+
+    it('should handle empty array', () => {
+      const result = joinOr([])
+      expect(result).toBe('')
+    })
+
+    it('should work with readonly arrays', () => {
+      const arr: readonly string[] = ['red', 'green', 'blue']
+      const result = joinOr(arr)
+      expect(result).toBe('red, green, or blue')
+    })
+
+    it('should handle many items', () => {
+      const result = joinOr(['one', 'two', 'three', 'four', 'five'])
+      expect(result).toBe('one, two, three, four, or five')
+    })
+  })
+
+  describe('formatter caching', () => {
+    it('should reuse conjunction formatter across calls', () => {
+      // First call initializes formatter
+      const result1 = joinAnd(['a', 'b'])
+      // Second call reuses cached formatter
+      const result2 = joinAnd(['c', 'd'])
+      expect(result1).toBe('a and b')
+      expect(result2).toBe('c and d')
+    })
+
+    it('should reuse disjunction formatter across calls', () => {
+      // First call initializes formatter
+      const result1 = joinOr(['a', 'b'])
+      // Second call reuses cached formatter
+      const result2 = joinOr(['c', 'd'])
+      expect(result1).toBe('a or b')
+      expect(result2).toBe('c or d')
+    })
+  })
+
+  describe('edge cases and special characters', () => {
+    it('arrayChunk should handle strings', () => {
+      const arr = ['a', 'b', 'c', 'd', 'e']
+      const result = arrayChunk(arr, 3)
+      expect(result).toEqual([
+        ['a', 'b', 'c'],
+        ['d', 'e'],
+      ])
+    })
+
+    it('arrayUnique should preserve first occurrence order', () => {
+      const arr = [3, 1, 2, 1, 3, 2]
+      const result = arrayUnique(arr)
+      expect(result).toEqual([3, 1, 2])
+    })
+
+    it('joinAnd should handle special characters', () => {
+      const result = joinAnd(['🍎', '🍌', '🍒'])
+      expect(result).toBe('🍎, 🍌, and 🍒')
+    })
+
+    it('joinOr should handle special characters', () => {
+      const result = joinOr(['#ff0000', '#00ff00', '#0000ff'])
+      expect(result).toBe('#ff0000, #00ff00, or #0000ff')
+    })
+
+    it('joinAnd should handle numbers as strings', () => {
+      const result = joinAnd(['1', '2', '3'])
+      expect(result).toBe('1, 2, and 3')
+    })
+
+    it('joinOr should handle numbers as strings', () => {
+      const result = joinOr(['100', '200', '300'])
+      expect(result).toBe('100, 200, or 300')
+    })
+  })
+
+  describe('array type compatibility', () => {
+    it('arrayChunk should work with const assertions', () => {
+      const arr = [1, 2, 3, 4] as const
+      const result = arrayChunk(arr, 2)
+      expect(result).toEqual([
+        [1, 2],
+        [3, 4],
+      ])
+    })
+
+    it('arrayUnique should work with const assertions', () => {
+      const arr = [1, 2, 2, 3] as const
+      const result = arrayUnique(arr)
+      expect(result).toEqual([1, 2, 3])
+    })
+
+    it('joinAnd should work with const assertions', () => {
+      const arr = ['a', 'b', 'c'] as const
+      const result = joinAnd(arr)
+      expect(result).toBe('a, b, and c')
+    })
+
+    it('joinOr should work with const assertions', () => {
+      const arr = ['x', 'y', 'z'] as const
+      const result = joinOr(arr)
+      expect(result).toBe('x, y, or z')
+    })
+  })
+
+  describe('performance and large arrays', () => {
+    it('arrayChunk should handle large arrays efficiently', () => {
+      const largeArr = Array.from({ length: 1000 }, (_, i) => i)
+      const result = arrayChunk(largeArr, 10)
+      expect(result.length).toBe(100)
+      expect(result[0]).toEqual([0, 1, 2, 3, 4, 5, 6, 7, 8, 9])
+      expect(result[99]).toEqual([
+        990, 991, 992, 993, 994, 995, 996, 997, 998, 999,
+      ])
+    })
+
+    it('arrayUnique should handle large arrays with duplicates', () => {
+      const largeArr = Array.from({ length: 1000 }, (_, i) => i % 100)
+      const result = arrayUnique(largeArr)
+      expect(result.length).toBe(100)
+    })
+  })
+})
diff --git a/test/unit/bin.test.ts b/test/unit/bin.test.ts
new file mode 100644
index 0000000..9535e62
--- /dev/null
+++ b/test/unit/bin.test.ts
@@ -0,0 +1,1219 @@
+/**
+ * @fileoverview Unit tests for binary path resolution and execution utilities.
+ *
+ * Tests binary discovery and execution helpers:
+ * - whichBin(), whichBinSync() find binaries in PATH
+ * - resolveBinPathSync() resolves package bin paths
+ * - findRealNpm(), findRealPnpm(), findRealYarn() locate real package manager binaries
+ * - findRealBin() generic real binary locator (bypasses shadow bins)
+ * - execBin() executes binaries with options
+ * - isShadowBinPath() detects Socket shadow binary paths
+ * Used by Socket CLI for package manager operations and binary interception.
+ */
+
+import { promises as fs } from 'node:fs'
+import path from 'node:path'
+import {
+  execBin,
+  findRealBin,
+  findRealNpm,
+  findRealPnpm,
+  findRealYarn,
+  isShadowBinPath,
+  resolveBinPathSync,
+  whichBin,
+  whichBinSync,
+} from '@socketsecurity/lib/bin'
+import { describe, expect, it } from 'vitest'
+import { runWithTempDir } from './utils/temp-file-helper.mjs'
+
+describe('bin', () => {
+  describe('isShadowBinPath', () => {
+    it('should return false for undefined', () => {
+      const result = isShadowBinPath(undefined)
+      expect(result).toBe(false)
+    })
+
+    it('should return false for empty string', () => {
+      const result = isShadowBinPath('')
+      expect(result).toBe(false)
+    })
+
+    it('should return true for Unix node_modules/.bin path', () => {
+      const result = isShadowBinPath('/path/to/node_modules/.bin')
+      expect(result).toBe(true)
+    })
+
+    it('should return true for Windows node_modules/.bin path', () => {
+      const result = isShadowBinPath('C:\\path\\to\\node_modules\\.bin')
+      expect(result).toBe(true)
+    })
+
+    it('should return true for nested node_modules/.bin path', () => {
+      const result = isShadowBinPath(
+        '/home/user/project/node_modules/.bin/pnpm',
+      )
+      expect(result).toBe(true)
+    })
+
+    it('should return false for regular bin path', () => {
+      const result = isShadowBinPath('/usr/local/bin')
+      expect(result).toBe(false)
+    })
+
+    it('should return false for path without node_modules', () => {
+      const result = isShadowBinPath('/usr/bin/npm')
+      expect(result).toBe(false)
+    })
+
+    it('should handle mixed slashes', () => {
+      const result = isShadowBinPath('C:/path/to/node_modules/.bin')
+      expect(result).toBe(true)
+    })
+
+    it('should return false for node_modules without .bin', () => {
+      const result = isShadowBinPath('/path/to/node_modules')
+      expect(result).toBe(false)
+    })
+  })
+
+  describe('whichBinSync', () => {
+    it('should find node executable', () => {
+      const result = whichBinSync('node')
+      expect(result).toBeDefined()
+      expect(typeof result).toBe('string')
+      if (typeof result === 'string') {
+        expect(result).toContain('node')
+      }
+    })
+
+    it('should return undefined for non-existent binary', () => {
+      const result = whichBinSync('totally-nonexistent-binary-12345')
+      expect(result).toBeUndefined()
+    })
+
+    it('should return undefined by default when binary not found', () => {
+      const result = whichBinSync('nonexistent-bin')
+      expect(result).toBeUndefined()
+    })
+
+    it('should respect nothrow option set to false', () => {
+      try {
+        const result = whichBinSync('nonexistent-bin-xyz', { nothrow: false })
+        // If it doesn't throw, expect undefined
+        expect(result).toBeUndefined()
+      } catch (error) {
+        // If it throws, that's also acceptable behavior
+        expect(error).toBeDefined()
+      }
+    })
+
+    it('should return array when all option is true', () => {
+      const result = whichBinSync('node', { all: true })
+      expect(Array.isArray(result)).toBe(true)
+      if (Array.isArray(result) && result.length > 0) {
+        expect(result[0]).toContain('node')
+      }
+    })
+
+    it('should return undefined array when all is true and binary not found', () => {
+      const result = whichBinSync('nonexistent-binary-12345', { all: true })
+      expect(result).toBeUndefined()
+    })
+
+    it('should resolve path when all is false', () => {
+      const result = whichBinSync('node', { all: false })
+      if (result) {
+        expect(typeof result).toBe('string')
+        expect(result).not.toContain('\\')
+      }
+    })
+
+    it('should handle empty binary name', () => {
+      const result = whichBinSync('')
+      expect(result).toBeUndefined()
+    })
+  })
+
+  describe('whichBin', () => {
+    it('should find node executable', async () => {
+      const result = await whichBin('node')
+      expect(result).toBeDefined()
+      expect(typeof result).toBe('string')
+      if (typeof result === 'string') {
+        expect(result).toContain('node')
+      }
+    })
+
+    it('should return undefined for non-existent binary', async () => {
+      const result = await whichBin('totally-nonexistent-binary-12345')
+      expect(result).toBeUndefined()
+    })
+
+    it('should return array when all option is true', async () => {
+      const result = await whichBin('node', { all: true })
+      expect(Array.isArray(result)).toBe(true)
+      if (Array.isArray(result) && result.length > 0) {
+        expect(result[0]).toContain('node')
+      }
+    })
+
+    it('should return undefined array when all is true and binary not found', async () => {
+      const result = await whichBin('nonexistent-binary-12345', { all: true })
+      expect(result).toBeUndefined()
+    })
+
+    it('should resolve paths when all is true', async () => {
+      const result = await whichBin('node', { all: true })
+      if (Array.isArray(result) && result.length > 0) {
+        result.forEach(p => {
+          expect(typeof p).toBe('string')
+          expect(p).not.toContain('\\')
+        })
+      }
+    })
+
+    it('should handle nothrow option', async () => {
+      const result = await whichBin('nonexistent-bin', { nothrow: true })
+      expect(result).toBeUndefined()
+    })
+
+    it('should return single path when all is false', async () => {
+      const result = await whichBin('node', { all: false })
+      if (result) {
+        expect(typeof result).toBe('string')
+      }
+    })
+
+    it('should handle empty binary name', async () => {
+      const result = await whichBin('')
+      expect(result).toBeUndefined()
+    })
+  })
+
+  describe('resolveBinPathSync', () => {
+    it('should normalize path with forward slashes', () => {
+      const result = resolveBinPathSync('/usr/bin/node')
+      expect(result).not.toContain('\\')
+    })
+
+    it('should return "." for empty string', () => {
+      const result = resolveBinPathSync('')
+      expect(result).toBe('.')
+    })
+
+    it('should handle relative path', async () => {
+      await runWithTempDir(async tmpDir => {
+        const binFile = path.join(tmpDir, 'test-bin')
+        await fs.writeFile(binFile, '#!/bin/sh\necho "test"', 'utf8')
+        await fs.chmod(binFile, 0o755)
+
+        const result = resolveBinPathSync(binFile)
+        expect(result).toBeTruthy()
+        expect(result).not.toContain('\\')
+      }, 'resolveBin-relative-')
+    })
+
+    it('should resolve symlinks when possible', async () => {
+      await runWithTempDir(async tmpDir => {
+        const targetFile = path.join(tmpDir, 'target')
+        await fs.writeFile(targetFile, '#!/bin/sh\necho "test"', 'utf8')
+
+        const linkFile = path.join(tmpDir, 'link')
+        try {
+          await fs.symlink(targetFile, linkFile)
+
+          const result = resolveBinPathSync(linkFile)
+          expect(result).toBeTruthy()
+          // Should resolve to real path
+          expect(result).toContain('target')
+        } catch (error) {
+          // Skip if symlinks are not supported on this platform
+          if (
+            error instanceof Error &&
+            (error.message.includes('EPERM') ||
+              error.message.includes('operation not permitted'))
+          ) {
+            console.log('Skipping symlink test - not supported')
+          } else {
+            throw error
+          }
+        }
+      }, 'resolveBin-symlink-')
+    })
+
+    it('should handle non-absolute paths', () => {
+      const result = resolveBinPathSync('node')
+      expect(result).toBeTruthy()
+    })
+
+    it('should normalize Windows-style paths', () => {
+      const result = resolveBinPathSync('C:\\Program Files\\nodejs\\node.exe')
+      expect(result).not.toContain('\\')
+    })
+
+    it('should handle paths with spaces', () => {
+      const result = resolveBinPathSync('/usr/local/bin/my binary')
+      expect(result).toBeTruthy()
+    })
+
+    it('should return normalized path when realpath fails', async () => {
+      const result = resolveBinPathSync('/nonexistent/path/to/binary')
+      expect(result).toBeTruthy()
+      expect(result).not.toContain('\\')
+    })
+  })
+
+  describe('resolveBinPathSync - Windows scenarios', () => {
+    it('should handle extensionless npm on Windows', async () => {
+      await runWithTempDir(async tmpDir => {
+        const npmBin = path.join(tmpDir, 'npm')
+        const npmCliJs = path.join(tmpDir, 'node_modules/npm/bin/npm-cli.js')
+
+        // Create directory structure
+        await fs.mkdir(path.join(tmpDir, 'node_modules/npm/bin'), {
+          recursive: true,
+        })
+        await fs.writeFile(npmCliJs, 'console.log("npm")', 'utf8')
+
+        // Create extensionless npm wrapper (Unix-style)
+        const npmScript = `#!/bin/sh
+basedir=$(dirname "$(echo "$0" | sed -e 's,\\\\,/,g')")
+NPM_CLI_JS="$basedir/node_modules/npm/bin/npm-cli.js"
+exec node "$NPM_CLI_JS" "$@"
+`
+        await fs.writeFile(npmBin, npmScript, 'utf8')
+
+        const result = resolveBinPathSync(npmBin)
+        expect(result).toBeTruthy()
+      }, 'resolveBin-npm-ext-')
+    })
+
+    it('should handle extensionless npx on Windows', async () => {
+      await runWithTempDir(async tmpDir => {
+        const npxBin = path.join(tmpDir, 'npx')
+        const npxCliJs = path.join(tmpDir, 'node_modules/npm/bin/npx-cli.js')
+
+        await fs.mkdir(path.join(tmpDir, 'node_modules/npm/bin'), {
+          recursive: true,
+        })
+        await fs.writeFile(npxCliJs, 'console.log("npx")', 'utf8')
+
+        const npxScript = `#!/bin/sh
+basedir=$(dirname "$(echo "$0" | sed -e 's,\\\\,/,g')")
+NPX_CLI_JS="$basedir/node_modules/npm/bin/npx-cli.js"
+exec node "$NPX_CLI_JS" "$@"
+`
+        await fs.writeFile(npxBin, npxScript, 'utf8')
+
+        const result = resolveBinPathSync(npxBin)
+        expect(result).toBeTruthy()
+      }, 'resolveBin-npx-ext-')
+    })
+
+    it('should handle cmd-shim .cmd files', async () => {
+      await runWithTempDir(async tmpDir => {
+        const binCmd = path.join(tmpDir, 'test.cmd')
+        const targetJs = path.join(tmpDir, 'lib/test.js')
+
+        await fs.mkdir(path.join(tmpDir, 'lib'), { recursive: true })
+        await fs.writeFile(targetJs, 'console.log("test")', 'utf8')
+
+        // Create cmd-shim style .cmd file
+        const cmdScript = `@ECHO off
+GOTO start
+:find_dp0
+SET dp0=%~dp0
+EXIT /b
+:start
+SETLOCAL
+CALL :find_dp0
+"%dp0%\\lib\\test.js" %*\r
+`
+        await fs.writeFile(binCmd, cmdScript, 'utf8')
+
+        const result = resolveBinPathSync(binCmd)
+        expect(result).toBeTruthy()
+      }, 'resolveBin-cmd-')
+    })
+
+    it('should handle PowerShell .ps1 files', async () => {
+      await runWithTempDir(async tmpDir => {
+        const binPs1 = path.join(tmpDir, 'test.ps1')
+        const targetJs = path.join(tmpDir, 'lib/test.js')
+
+        await fs.mkdir(path.join(tmpDir, 'lib'), { recursive: true })
+        await fs.writeFile(targetJs, 'console.log("test")', 'utf8')
+
+        const ps1Script = `#!/usr/bin/env pwsh
+$basedir=Split-Path $MyInvocation.MyCommand.Definition -Parent
+& "$basedir/lib/test.js" $args
+`
+        await fs.writeFile(binPs1, ps1Script, 'utf8')
+
+        const result = resolveBinPathSync(binPs1)
+        expect(result).toBeTruthy()
+      }, 'resolveBin-ps1-')
+    })
+  })
+
+  describe('resolveBinPathSync - Unix scenarios', () => {
+    it('should handle extensionless pnpm shell script', async () => {
+      await runWithTempDir(async tmpDir => {
+        const pnpmBin = path.join(tmpDir, 'pnpm')
+
+        await fs.mkdir(path.join(tmpDir, '../pnpm/bin'), { recursive: true })
+        await fs.writeFile(
+          path.join(tmpDir, '../pnpm/bin/pnpm.cjs'),
+          'console.log("pnpm")',
+          'utf8',
+        )
+
+        const pnpmScript = `#!/bin/sh
+basedir=$(dirname "$(echo "$0" | sed -e 's,\\\\,/,g')")
+exec node "$basedir/../pnpm/bin/pnpm.cjs" "$@"
+`
+        await fs.writeFile(pnpmBin, pnpmScript, 'utf8')
+
+        const result = resolveBinPathSync(pnpmBin)
+        expect(result).toBeTruthy()
+      }, 'resolveBin-pnpm-unix-')
+    })
+
+    it('should handle extensionless yarn shell script', async () => {
+      await runWithTempDir(async tmpDir => {
+        const yarnBin = path.join(tmpDir, 'yarn')
+
+        await fs.mkdir(path.join(tmpDir, '../yarn/bin'), { recursive: true })
+        await fs.writeFile(
+          path.join(tmpDir, '../yarn/bin/yarn.js'),
+          'console.log("yarn")',
+          'utf8',
+        )
+
+        const yarnScript = `#!/bin/sh
+basedir=$(dirname "$(echo "$0" | sed -e 's,\\\\,/,g')")
+exec node "$basedir/../yarn/bin/yarn.js" "$@"
+`
+        await fs.writeFile(yarnBin, yarnScript, 'utf8')
+
+        const result = resolveBinPathSync(yarnBin)
+        expect(result).toBeTruthy()
+      }, 'resolveBin-yarn-unix-')
+    })
+
+    it('should handle pnpm with .tools directory', async () => {
+      await runWithTempDir(async tmpDir => {
+        const pnpmBin = path.join(tmpDir, 'pnpm')
+        const pnpmCjs = path.join(tmpDir, '.tools/pnpm/1.0.0/bin/pnpm.cjs')
+
+        await fs.mkdir(path.join(tmpDir, '.tools/pnpm/1.0.0/bin'), {
+          recursive: true,
+        })
+        await fs.writeFile(pnpmCjs, 'console.log("pnpm")', 'utf8')
+
+        const pnpmScript = `#!/bin/sh
+basedir=$(dirname "$(echo "$0" | sed -e 's,\\\\,/,g')")
+exec "$basedir/node" "$basedir/.tools/pnpm/1.0.0/bin/pnpm.cjs" "$@"
+`
+        await fs.writeFile(pnpmBin, pnpmScript, 'utf8')
+
+        const result = resolveBinPathSync(pnpmBin)
+        expect(result).toBeTruthy()
+      }, 'resolveBin-pnpm-tools-')
+    })
+
+    it('should handle malformed pnpm path in CI', async () => {
+      await runWithTempDir(async tmpDir => {
+        // Create the correct shell script location
+        const correctPnpmBin = path.join(
+          tmpDir,
+          'setup-pnpm/node_modules/.bin/pnpm',
+        )
+        await fs.mkdir(path.dirname(correctPnpmBin), { recursive: true })
+
+        const pnpmScript = `#!/bin/sh
+basedir=$(dirname "$(echo "$0" | sed -e 's,\\\\,/,g')")
+exec node "$basedir/pnpm/bin/pnpm.cjs" "$@"
+`
+        await fs.writeFile(correctPnpmBin, pnpmScript, 'utf8')
+
+        const result = resolveBinPathSync(correctPnpmBin)
+        expect(result).toBeTruthy()
+      }, 'resolveBin-pnpm-ci-')
+    })
+  })
+
+  describe('resolveBinPathSync - Volta scenarios', () => {
+    it('should handle Volta-managed npm', async () => {
+      await runWithTempDir(async tmpDir => {
+        // Create Volta directory structure
+        const voltaDir = path.join(tmpDir, '.volta')
+        const voltaToolsPath = path.join(voltaDir, 'tools')
+        const voltaImagePath = path.join(voltaToolsPath, 'image')
+        const voltaUserPath = path.join(voltaToolsPath, 'user')
+        const voltaBinPath = path.join(voltaUserPath, 'bin')
+
+        await fs.mkdir(voltaBinPath, { recursive: true })
+        await fs.mkdir(voltaImagePath, { recursive: true })
+
+        // Create platform.json
+        const platformJson = {
+          node: {
+            runtime: '18.0.0',
+            npm: '9.0.0',
+          },
+        }
+        await fs.writeFile(
+          path.join(voltaUserPath, 'platform.json'),
+          JSON.stringify(platformJson),
+          'utf8',
+        )
+
+        // Create npm binary location
+        const npmCliPath = path.join(voltaImagePath, 'npm/9.0.0/bin/npm-cli.js')
+        await fs.mkdir(path.dirname(npmCliPath), { recursive: true })
+        await fs.writeFile(npmCliPath, 'console.log("npm")', 'utf8')
+
+        // Create Volta shim
+        const npmShim = path.join(voltaBinPath, 'npm')
+        await fs.writeFile(npmShim, '#!/bin/sh\necho "volta shim"', 'utf8')
+
+        const voltaNpmPath = path.join(voltaDir, 'bin/npm')
+        await fs.mkdir(path.dirname(voltaNpmPath), { recursive: true })
+        await fs.writeFile(voltaNpmPath, '#!/bin/sh\necho "npm"', 'utf8')
+
+        const result = resolveBinPathSync(voltaNpmPath)
+        expect(result).toBeTruthy()
+      }, 'resolveBin-volta-npm-')
+    })
+
+    it('should handle Volta-managed npx', async () => {
+      await runWithTempDir(async tmpDir => {
+        const voltaDir = path.join(tmpDir, '.volta')
+        const voltaToolsPath = path.join(voltaDir, 'tools')
+        const voltaImagePath = path.join(voltaToolsPath, 'image')
+        const voltaUserPath = path.join(voltaToolsPath, 'user')
+
+        await fs.mkdir(voltaImagePath, { recursive: true })
+        await fs.mkdir(voltaUserPath, { recursive: true })
+
+        const platformJson = {
+          node: {
+            runtime: '18.0.0',
+            npm: '9.0.0',
+          },
+        }
+        await fs.writeFile(
+          path.join(voltaUserPath, 'platform.json'),
+          JSON.stringify(platformJson),
+          'utf8',
+        )
+
+        const npxCliPath = path.join(voltaImagePath, 'npm/9.0.0/bin/npx-cli.js')
+        await fs.mkdir(path.dirname(npxCliPath), { recursive: true })
+        await fs.writeFile(npxCliPath, 'console.log("npx")', 'utf8')
+
+        const voltaNpxPath = path.join(voltaDir, 'bin/npx')
+        await fs.mkdir(path.dirname(voltaNpxPath), { recursive: true })
+        await fs.writeFile(voltaNpxPath, '#!/bin/sh\necho "npx"', 'utf8')
+
+        const result = resolveBinPathSync(voltaNpxPath)
+        expect(result).toBeTruthy()
+      }, 'resolveBin-volta-npx-')
+    })
+
+    it('should handle Volta-managed custom package binary', async () => {
+      await runWithTempDir(async tmpDir => {
+        const voltaDir = path.join(tmpDir, '.volta')
+        const voltaToolsPath = path.join(voltaDir, 'tools')
+        const voltaImagePath = path.join(voltaToolsPath, 'image')
+        const voltaUserPath = path.join(voltaToolsPath, 'user')
+        const voltaBinPath = path.join(voltaUserPath, 'bin')
+
+        await fs.mkdir(voltaBinPath, { recursive: true })
+        await fs.mkdir(voltaImagePath, { recursive: true })
+
+        // Create binary info file
+        const binInfo = {
+          package: 'typescript@5.0.0',
+        }
+        await fs.writeFile(
+          path.join(voltaBinPath, 'tsc.json'),
+          JSON.stringify(binInfo),
+          'utf8',
+        )
+
+        // Create package binary
+        const tscPath = path.join(
+          voltaImagePath,
+          'packages/typescript@5.0.0/bin/tsc',
+        )
+        await fs.mkdir(path.dirname(tscPath), { recursive: true })
+        await fs.writeFile(tscPath, '#!/bin/sh\necho "tsc"', 'utf8')
+
+        const voltaTscPath = path.join(voltaDir, 'bin/tsc')
+        await fs.mkdir(path.dirname(voltaTscPath), { recursive: true })
+        await fs.writeFile(voltaTscPath, '#!/bin/sh\necho "tsc"', 'utf8')
+
+        const result = resolveBinPathSync(voltaTscPath)
+        expect(result).toBeTruthy()
+      }, 'resolveBin-volta-package-')
+    })
+
+    it('should skip Volta resolution for node binary', () => {
+      // Node binary should not go through Volta resolution
+      const result = resolveBinPathSync('/path/to/.volta/bin/node')
+      expect(result).toBeTruthy()
+      expect(result).not.toContain('\\')
+    })
+  })
+
+  describe('findRealBin', () => {
+    it('should find node binary', () => {
+      const result = findRealBin('node')
+      expect(result).toBeDefined()
+      if (result) {
+        expect(result).toContain('node')
+      }
+    })
+
+    it('should return undefined for non-existent binary', () => {
+      const result = findRealBin('totally-nonexistent-binary-xyz-12345')
+      expect(result).toBeUndefined()
+    })
+
+    it('should check common paths first', async () => {
+      await runWithTempDir(async tmpDir => {
+        const binPath = path.join(tmpDir, 'custom-bin')
+        await fs.writeFile(binPath, '#!/bin/sh\necho "test"', 'utf8')
+
+        const result = findRealBin('test-binary', [binPath])
+        expect(result).toBe(binPath)
+      }, 'findRealBin-common-')
+    })
+
+    it('should skip shadow bins', async () => {
+      await runWithTempDir(async _tmpDir => {
+        // This test verifies the behavior but may not find an actual shadow bin
+        const result = findRealBin('node', [])
+        if (result) {
+          expect(isShadowBinPath(path.dirname(result))).toBe(false)
+        }
+      }, 'findRealBin-shadow-')
+    })
+
+    it('should handle empty common paths array', () => {
+      const result = findRealBin('node', [])
+      expect(result).toBeDefined()
+    })
+
+    it('should return first existing common path', async () => {
+      await runWithTempDir(async tmpDir => {
+        const bin1 = path.join(tmpDir, 'bin1')
+        const bin2 = path.join(tmpDir, 'bin2')
+
+        await fs.writeFile(bin2, '#!/bin/sh\necho "test"', 'utf8')
+
+        const result = findRealBin('test', [bin1, bin2])
+        expect(result).toBe(bin2)
+      }, 'findRealBin-first-')
+    })
+  })
+
+  describe('findRealNpm', () => {
+    it('should find npm binary', () => {
+      const result = findRealNpm()
+      expect(result).toBeTruthy()
+      expect(typeof result).toBe('string')
+    })
+
+    it('should return a valid path or fallback to "npm"', () => {
+      const result = findRealNpm()
+      expect(result.length).toBeGreaterThan(0)
+      // Should either be a full path or the string "npm"
+      if (result !== 'npm') {
+        expect(result).toContain('npm')
+      }
+    })
+
+    it('should not return a shadow bin path when possible', () => {
+      const result = findRealNpm()
+      // If we found a real path (not just "npm"), it shouldn't be a shadow bin
+      if (result !== 'npm' && result.includes('/')) {
+        const dir = path.dirname(result)
+        // We prefer non-shadow paths, but don't strictly require it
+        // since the system might only have shadow bins available
+        expect(typeof isShadowBinPath(dir)).toBe('boolean')
+      }
+    })
+  })
+
+  describe('findRealPnpm', () => {
+    it('should return a string', () => {
+      const result = findRealPnpm()
+      expect(typeof result).toBe('string')
+    })
+
+    it('should return empty string if pnpm not found', () => {
+      // This test documents current behavior - returns empty string when not found
+      const result = findRealPnpm()
+      expect(typeof result).toBe('string')
+    })
+
+    it('should return path containing pnpm if found', () => {
+      const result = findRealPnpm()
+      if (result) {
+        expect(result).toContain('pnpm')
+      }
+    })
+  })
+
+  describe('findRealYarn', () => {
+    it('should return a string', () => {
+      const result = findRealYarn()
+      expect(typeof result).toBe('string')
+    })
+
+    it('should return empty string if yarn not found', () => {
+      // This test documents current behavior - returns empty string when not found
+      const result = findRealYarn()
+      expect(typeof result).toBe('string')
+    })
+
+    it('should return path containing yarn if found', () => {
+      const result = findRealYarn()
+      if (result) {
+        expect(result).toContain('yarn')
+      }
+    })
+  })
+
+  describe('execBin', () => {
+    it('should execute a binary by path', async () => {
+      const result = await execBin('node', ['--version'])
+      expect(result.code).toBe(0)
+      expect(result.stdout).toBeTruthy()
+    })
+
+    it('should execute a binary by name', async () => {
+      const result = await execBin('node', ['--version'])
+      expect(result.code).toBe(0)
+      expect(result.stdout).toBeTruthy()
+    })
+
+    it('should throw ENOENT error when binary not found', async () => {
+      await expect(
+        execBin('totally-nonexistent-binary-xyz-12345', []),
+      ).rejects.toThrow('Binary not found')
+    })
+
+    it('should throw error with ENOENT code', async () => {
+      try {
+        await execBin('nonexistent-bin-12345')
+      } catch (error) {
+        expect(error).toBeInstanceOf(Error)
+        if (error instanceof Error) {
+          expect((error as any).code).toBe('ENOENT')
+        }
+      }
+    })
+
+    it('should handle binary with arguments', async () => {
+      const result = await execBin('node', ['-e', 'console.log("hello")'])
+      expect(result.code).toBe(0)
+      expect(result.stdout).toContain('hello')
+    })
+
+    it('should handle binary without arguments', async () => {
+      const result = await execBin('node', ['--version'])
+      expect(result.code).toBe(0)
+    })
+
+    it('should pass options to spawn', async () => {
+      const result = await execBin('node', ['--version'], {
+        cwd: process.cwd(),
+      })
+      expect(result.code).toBe(0)
+    })
+
+    it('should handle absolute path to binary', async () => {
+      const nodePath = process.execPath
+      const result = await execBin(nodePath, ['--version'])
+      expect(result.code).toBe(0)
+    })
+
+    it('should handle relative path to binary', async () => {
+      await runWithTempDir(async tmpDir => {
+        const scriptPath = path.join(tmpDir, 'test.js')
+        await fs.writeFile(scriptPath, 'console.log("test output")', 'utf8')
+
+        const result = await execBin('node', [scriptPath])
+        expect(result.code).toBe(0)
+        expect(result.stdout).toContain('test output')
+      }, 'execBin-script-')
+    })
+  })
+
+  describe('resolveBinPathSync - edge cases', () => {
+    it('should handle paths with special characters', () => {
+      const result = resolveBinPathSync('/usr/bin/test-binary-name')
+      expect(result).toBeTruthy()
+      expect(result).not.toContain('\\')
+    })
+
+    it('should handle Windows drive letters', () => {
+      const result = resolveBinPathSync('C:/Windows/System32/cmd.exe')
+      expect(result).toBeTruthy()
+      expect(result).not.toContain('\\')
+    })
+
+    it('should handle UNC paths', () => {
+      const result = resolveBinPathSync('//server/share/bin/executable')
+      expect(result).toBeTruthy()
+    })
+
+    it('should handle current directory reference', () => {
+      const result = resolveBinPathSync('./node')
+      expect(result).toBeTruthy()
+    })
+
+    it('should handle parent directory reference', () => {
+      const result = resolveBinPathSync('../bin/node')
+      expect(result).toBeTruthy()
+    })
+
+    it('should handle multiple path separators', () => {
+      const result = resolveBinPathSync('/usr//local//bin///node')
+      expect(result).toBeTruthy()
+      expect(result).not.toMatch(/\/\//)
+    })
+
+    it('should handle trailing slash', () => {
+      const result = resolveBinPathSync('/usr/bin/node/')
+      expect(result).toBeTruthy()
+    })
+  })
+
+  describe('resolveBinPathSync - pnpm edge cases', () => {
+    it('should handle pnpm with missing pnpm/ prefix in path', async () => {
+      await runWithTempDir(async tmpDir => {
+        const pnpmBin = path.join(tmpDir, 'pnpm')
+        const pnpmCjs = path.join(tmpDir, '../pnpm/bin/pnpm.cjs')
+
+        await fs.mkdir(path.dirname(pnpmCjs), { recursive: true })
+        await fs.writeFile(pnpmCjs, 'console.log("pnpm")', 'utf8')
+
+        // Script with missing ../ prefix (malformed)
+        const pnpmScript = `#!/bin/sh
+basedir=$(dirname "$(echo "$0" | sed -e 's,\\\\,/,g')")
+exec node "$basedir/pnpm/bin/pnpm.cjs" "$@"
+`
+        await fs.writeFile(pnpmBin, pnpmScript, 'utf8')
+
+        const result = resolveBinPathSync(pnpmBin)
+        expect(result).toBeTruthy()
+      }, 'resolveBin-pnpm-malformed-')
+    })
+
+    it('should handle pnpm.cmd with node.exe reference', async () => {
+      await runWithTempDir(async tmpDir => {
+        const pnpmCmd = path.join(tmpDir, 'pnpm.cmd')
+        const pnpmCjs = path.join(tmpDir, '../pnpm/bin/pnpm.cjs')
+
+        await fs.mkdir(path.dirname(pnpmCjs), { recursive: true })
+        await fs.writeFile(pnpmCjs, 'console.log("pnpm")', 'utf8')
+
+        const cmdScript = `@ECHO off
+"%~dp0\\node.exe" "%~dp0\\..\\pnpm\\bin\\pnpm.cjs" %*\r
+`
+        await fs.writeFile(pnpmCmd, cmdScript, 'utf8')
+
+        const result = resolveBinPathSync(pnpmCmd)
+        expect(result).toBeTruthy()
+      }, 'resolveBin-pnpm-cmd-node-')
+    })
+
+    it('should handle yarn.cmd with node.exe reference', async () => {
+      await runWithTempDir(async tmpDir => {
+        const yarnCmd = path.join(tmpDir, 'yarn.cmd')
+        const yarnJs = path.join(tmpDir, '../yarn/bin/yarn.js')
+
+        await fs.mkdir(path.dirname(yarnJs), { recursive: true })
+        await fs.writeFile(yarnJs, 'console.log("yarn")', 'utf8')
+
+        const cmdScript = `@ECHO off
+"%~dp0\\node.exe" "%~dp0\\..\\yarn\\bin\\yarn.js" %*\r
+`
+        await fs.writeFile(yarnCmd, cmdScript, 'utf8')
+
+        const result = resolveBinPathSync(yarnCmd)
+        expect(result).toBeTruthy()
+      }, 'resolveBin-yarn-cmd-node-')
+    })
+
+    it('should handle pnpm with exec node format', async () => {
+      await runWithTempDir(async tmpDir => {
+        const pnpmBin = path.join(tmpDir, 'pnpm')
+        const pnpmCjs = path.join(tmpDir, '.tools/pnpm/8.0.0/bin/pnpm.cjs')
+
+        await fs.mkdir(path.dirname(pnpmCjs), { recursive: true })
+        await fs.writeFile(pnpmCjs, 'console.log("pnpm")', 'utf8')
+
+        const pnpmScript = `#!/bin/sh
+basedir=$(dirname "$(echo "$0" | sed -e 's,\\\\,/,g')")
+exec node  "$basedir/.tools/pnpm/8.0.0/bin/pnpm.cjs" "$@"
+`
+        await fs.writeFile(pnpmBin, pnpmScript, 'utf8')
+
+        const result = resolveBinPathSync(pnpmBin)
+        expect(result).toBeTruthy()
+      }, 'resolveBin-pnpm-exec-')
+    })
+
+    it('should handle npm.ps1 format', async () => {
+      await runWithTempDir(async tmpDir => {
+        const npmPs1 = path.join(tmpDir, 'npm.ps1')
+        const npmCliJs = path.join(tmpDir, 'node_modules/npm/bin/npm-cli.js')
+
+        await fs.mkdir(path.dirname(npmCliJs), { recursive: true })
+        await fs.writeFile(npmCliJs, 'console.log("npm")', 'utf8')
+
+        const ps1Script = `#!/usr/bin/env pwsh
+$basedir=Split-Path $MyInvocation.MyCommand.Definition -Parent
+$NPM_CLI_JS="$PSScriptRoot/node_modules/npm/bin/npm-cli.js"
+& node $NPM_CLI_JS $args
+`
+        await fs.writeFile(npmPs1, ps1Script, 'utf8')
+
+        const result = resolveBinPathSync(npmPs1)
+        expect(result).toBeTruthy()
+      }, 'resolveBin-npm-ps1-')
+    })
+
+    it('should handle npx.ps1 format', async () => {
+      await runWithTempDir(async tmpDir => {
+        const npxPs1 = path.join(tmpDir, 'npx.ps1')
+        const npxCliJs = path.join(tmpDir, 'node_modules/npm/bin/npx-cli.js')
+
+        await fs.mkdir(path.dirname(npxCliJs), { recursive: true })
+        await fs.writeFile(npxCliJs, 'console.log("npx")', 'utf8')
+
+        const ps1Script = `#!/usr/bin/env pwsh
+$basedir=Split-Path $MyInvocation.MyCommand.Definition -Parent
+$NPX_CLI_JS="$PSScriptRoot/node_modules/npm/bin/npx-cli.js"
+& node $NPX_CLI_JS $args
+`
+        await fs.writeFile(npxPs1, ps1Script, 'utf8')
+
+        const result = resolveBinPathSync(npxPs1)
+        expect(result).toBeTruthy()
+      }, 'resolveBin-npx-ps1-')
+    })
+
+    it('should handle pnpm.ps1 format', async () => {
+      await runWithTempDir(async tmpDir => {
+        const pnpmPs1 = path.join(tmpDir, 'pnpm.ps1')
+        const pnpmCjs = path.join(tmpDir, '../pnpm/bin/pnpm.cjs')
+
+        await fs.mkdir(path.dirname(pnpmCjs), { recursive: true })
+        await fs.writeFile(pnpmCjs, 'console.log("pnpm")', 'utf8')
+
+        const ps1Script = `#!/usr/bin/env pwsh
+$basedir=Split-Path $MyInvocation.MyCommand.Definition -Parent
+& node "$basedir/../pnpm/bin/pnpm.cjs" $args
+`
+        await fs.writeFile(pnpmPs1, ps1Script, 'utf8')
+
+        const result = resolveBinPathSync(pnpmPs1)
+        expect(result).toBeTruthy()
+      }, 'resolveBin-pnpm-ps1-')
+    })
+
+    it('should handle yarn.ps1 format', async () => {
+      await runWithTempDir(async tmpDir => {
+        const yarnPs1 = path.join(tmpDir, 'yarn.ps1')
+        const yarnJs = path.join(tmpDir, '../yarn/bin/yarn.js')
+
+        await fs.mkdir(path.dirname(yarnJs), { recursive: true })
+        await fs.writeFile(yarnJs, 'console.log("yarn")', 'utf8')
+
+        const ps1Script = `#!/usr/bin/env pwsh
+$basedir=Split-Path $MyInvocation.MyCommand.Definition -Parent
+& node "$basedir/../yarn/bin/yarn.js" $args
+`
+        await fs.writeFile(yarnPs1, ps1Script, 'utf8')
+
+        const result = resolveBinPathSync(yarnPs1)
+        expect(result).toBeTruthy()
+      }, 'resolveBin-yarn-ps1-')
+    })
+  })
+
+  describe('resolveBinPathSync - npm CMD variations', () => {
+    it('should handle npm.cmd with quick path', async () => {
+      await runWithTempDir(async tmpDir => {
+        const npmCmd = path.join(tmpDir, 'npm.cmd')
+        const npmCliJs = path.join(tmpDir, 'node_modules/npm/bin/npm-cli.js')
+
+        await fs.mkdir(path.dirname(npmCliJs), { recursive: true })
+        await fs.writeFile(npmCliJs, 'console.log("npm")', 'utf8')
+
+        const cmdScript = `@ECHO off
+SET "NPM_CLI_JS=%~dp0\\node_modules\\npm\\bin\\npm-cli.js"
+node "%NPM_CLI_JS%" %*\r
+`
+        await fs.writeFile(npmCmd, cmdScript, 'utf8')
+
+        const result = resolveBinPathSync(npmCmd)
+        expect(result).toBeTruthy()
+      }, 'resolveBin-npm-cmd-quick-')
+    })
+
+    it('should handle npx.cmd with NPX_CLI_JS variable', async () => {
+      await runWithTempDir(async tmpDir => {
+        const npxCmd = path.join(tmpDir, 'npx.cmd')
+        const npxCliJs = path.join(tmpDir, 'node_modules/npm/bin/npx-cli.js')
+
+        await fs.mkdir(path.dirname(npxCliJs), { recursive: true })
+        await fs.writeFile(npxCliJs, 'console.log("npx")', 'utf8')
+
+        const cmdScript = `@ECHO off
+SET "NPX_CLI_JS=%~dp0\\node_modules\\npm\\bin\\npx-cli.js"
+node "%NPX_CLI_JS%" %*\r
+`
+        await fs.writeFile(npxCmd, cmdScript, 'utf8')
+
+        const result = resolveBinPathSync(npxCmd)
+        expect(result).toBeTruthy()
+      }, 'resolveBin-npx-cmd-')
+    })
+  })
+
+  describe('resolveBinPathSync - Volta fallback paths', () => {
+    it('should fallback to node_modules for Volta npm when primary path missing', async () => {
+      await runWithTempDir(async tmpDir => {
+        const voltaDir = path.join(tmpDir, '.volta')
+        const voltaToolsPath = path.join(voltaDir, 'tools')
+        const voltaImagePath = path.join(voltaToolsPath, 'image')
+        const voltaUserPath = path.join(voltaToolsPath, 'user')
+
+        await fs.mkdir(voltaImagePath, { recursive: true })
+        await fs.mkdir(voltaUserPath, { recursive: true })
+
+        const platformJson = {
+          node: {
+            runtime: '18.0.0',
+            npm: '9.0.0',
+          },
+        }
+        await fs.writeFile(
+          path.join(voltaUserPath, 'platform.json'),
+          JSON.stringify(platformJson),
+          'utf8',
+        )
+
+        // Only create the node_modules fallback path
+        const npmCliPath = path.join(
+          voltaImagePath,
+          'node/18.0.0/lib/node_modules/npm/bin/npm-cli.js',
+        )
+        await fs.mkdir(path.dirname(npmCliPath), { recursive: true })
+        await fs.writeFile(npmCliPath, 'console.log("npm")', 'utf8')
+
+        const voltaNpmPath = path.join(voltaDir, 'bin/npm')
+        await fs.mkdir(path.dirname(voltaNpmPath), { recursive: true })
+        await fs.writeFile(voltaNpmPath, '#!/bin/sh\necho "npm"', 'utf8')
+
+        const result = resolveBinPathSync(voltaNpmPath)
+        expect(result).toBeTruthy()
+      }, 'resolveBin-volta-npm-fallback-')
+    })
+
+    it('should handle Volta package binary with .cmd extension', async () => {
+      await runWithTempDir(async tmpDir => {
+        const voltaDir = path.join(tmpDir, '.volta')
+        const voltaToolsPath = path.join(voltaDir, 'tools')
+        const voltaImagePath = path.join(voltaToolsPath, 'image')
+        const voltaUserPath = path.join(voltaToolsPath, 'user')
+        const voltaBinPath = path.join(voltaUserPath, 'bin')
+
+        await fs.mkdir(voltaBinPath, { recursive: true })
+        await fs.mkdir(voltaImagePath, { recursive: true })
+
+        const binInfo = {
+          package: 'some-package@1.0.0',
+        }
+        await fs.writeFile(
+          path.join(voltaBinPath, 'somecmd.json'),
+          JSON.stringify(binInfo),
+          'utf8',
+        )
+
+        // Create .cmd version of binary
+        const cmdPath = path.join(
+          voltaImagePath,
+          'packages/some-package@1.0.0/bin/somecmd.cmd',
+        )
+        await fs.mkdir(path.dirname(cmdPath), { recursive: true })
+        await fs.writeFile(cmdPath, '@ECHO off\necho "somecmd"', 'utf8')
+
+        const voltaCmdPath = path.join(voltaDir, 'bin/somecmd')
+        await fs.mkdir(path.dirname(voltaCmdPath), { recursive: true })
+        await fs.writeFile(voltaCmdPath, '#!/bin/sh\necho "somecmd"', 'utf8')
+
+        const result = resolveBinPathSync(voltaCmdPath)
+        expect(result).toBeTruthy()
+      }, 'resolveBin-volta-cmd-')
+    })
+  })
+
+  describe('resolveBinPathSync - non-existent file scenarios', () => {
+    it('should handle non-existent .cmd file', () => {
+      const result = resolveBinPathSync('/nonexistent/path/test.cmd')
+      expect(result).toBeTruthy()
+      expect(result).not.toContain('\\')
+    })
+
+    it('should handle non-existent .ps1 file', () => {
+      const result = resolveBinPathSync('/nonexistent/path/test.ps1')
+      expect(result).toBeTruthy()
+      expect(result).not.toContain('\\')
+    })
+
+    it('should handle non-existent extensionless file', () => {
+      const result = resolveBinPathSync('/nonexistent/path/test')
+      expect(result).toBeTruthy()
+      expect(result).not.toContain('\\')
+    })
+
+    it('should handle non-existent .exe file', () => {
+      const result = resolveBinPathSync('/nonexistent/path/test.exe')
+      expect(result).toBeTruthy()
+      expect(result).not.toContain('\\')
+    })
+  })
+
+  describe('whichBinSync and whichBin - options coverage', () => {
+    it('should handle options with all explicitly set to undefined', () => {
+      const result = whichBinSync('node', { all: undefined as any })
+      expect(result).toBeDefined()
+    })
+
+    it('should handle async version with all explicitly set to undefined', async () => {
+      const result = await whichBin('node', { all: undefined as any })
+      expect(result).toBeDefined()
+    })
+
+    it('should handle multiple paths when all is true', () => {
+      const result = whichBinSync('node', { all: true, nothrow: true })
+      if (result && Array.isArray(result)) {
+        expect(result.length).toBeGreaterThan(0)
+      }
+    })
+
+    it('should handle async multiple paths when all is true', async () => {
+      const result = await whichBin('node', { all: true, nothrow: true })
+      if (result && Array.isArray(result)) {
+        expect(result.length).toBeGreaterThan(0)
+      }
+    })
+  })
+
+  describe('findRealBin - shadow bin detection', () => {
+    it('should prefer non-shadow bin paths', async () => {
+      // This test verifies that if we have multiple binaries,
+      // we prefer the one that's not in node_modules/.bin
+      const result = findRealBin('node', [])
+      if (result) {
+        const dirName = path.dirname(result)
+        // If we found a bin, it should preferably not be a shadow bin
+        // However, we can't guarantee this on all systems
+        expect(typeof isShadowBinPath(dirName)).toBe('boolean')
+      }
+    })
+
+    it('should handle when all paths are shadow bins', () => {
+      // In some environments, all available paths might be shadow bins
+      const result = findRealBin('node', [])
+      expect(result === undefined || typeof result === 'string').toBe(true)
+    })
+  })
+
+  describe('execBin - path handling', () => {
+    it('should handle binary name that needs path resolution', async () => {
+      const result = await execBin('node', ['-p', 'process.version'])
+      expect(result.code).toBe(0)
+      expect(result.stdout).toMatch(/^v\d+\.\d+\.\d+/)
+    })
+
+    it('should handle binary with absolute path', async () => {
+      const nodePath = process.execPath
+      const result = await execBin(nodePath, ['-p', '1+1'])
+      expect(result.code).toBe(0)
+      expect(result.stdout).toContain('2')
+    })
+
+    it('should throw for path that resolves to undefined', async () => {
+      await expect(
+        execBin('/absolutely/nonexistent/path/to/binary'),
+      ).rejects.toThrow()
+    })
+  })
+
+  describe('resolveBinPathSync - comprehensive format coverage', () => {
+    it('should handle empty relPath in cmd file', async () => {
+      await runWithTempDir(async tmpDir => {
+        const testCmd = path.join(tmpDir, 'test.cmd')
+        // CMD file that doesn't match any patterns
+        const cmdScript = `@ECHO off
+echo "test"
+`
+        await fs.writeFile(testCmd, cmdScript, 'utf8')
+
+        const result = resolveBinPathSync(testCmd)
+        expect(result).toBeTruthy()
+      }, 'resolveBin-empty-relpath-')
+    })
+
+    it('should handle npm.cmd with standard format', async () => {
+      await runWithTempDir(async tmpDir => {
+        const npmCmd = path.join(tmpDir, 'npm.cmd')
+        const npmCliJs = path.join(tmpDir, 'lib/npm-cli.js')
+
+        await fs.mkdir(path.dirname(npmCliJs), { recursive: true })
+        await fs.writeFile(npmCliJs, 'console.log("npm")', 'utf8')
+
+        const cmdScript = `@ECHO off
+GOTO start
+:find_dp0
+SET dp0=%~dp0
+EXIT /b
+:start
+SETLOCAL
+CALL :find_dp0
+SET "_prog=node"
+endLocal & goto #_undefined_# 2>NUL || title %COMSPEC% & "%_prog%" "%dp0%\\lib\\npm-cli.js" %*\r
+`
+        await fs.writeFile(npmCmd, cmdScript, 'utf8')
+
+        const result = resolveBinPathSync(npmCmd)
+        expect(result).toBeTruthy()
+      }, 'resolveBin-npm-standard-')
+    })
+
+    it('should handle extensionless binary with no relPath extracted', async () => {
+      await runWithTempDir(async tmpDir => {
+        const testBin = path.join(tmpDir, 'test')
+        // Shell script that doesn't match any patterns
+        const script = `#!/bin/sh
+echo "test"
+`
+        await fs.writeFile(testBin, script, 'utf8')
+
+        const result = resolveBinPathSync(testBin)
+        expect(result).toBeTruthy()
+      }, 'resolveBin-no-relpath-')
+    })
+  })
+})
diff --git a/test/unit/build-externals.test.ts b/test/unit/build-externals.test.ts
new file mode 100644
index 0000000..35b47d7
--- /dev/null
+++ b/test/unit/build-externals.test.ts
@@ -0,0 +1,289 @@
+/**
+ * @fileoverview Build validation tests for external dependency bundling.
+ *
+ * Tests build integrity for vendored external dependencies:
+ * - Validates dist/external/ contains real bundled code (not stubs)
+ * - Ensures external packages are only imported from dist/external/
+ * - Prevents accidental stub re-exports in distribution
+ * - Verifies devDependencies aren't leaked into production build
+ * Critical for ensuring proper dependency bundling and tree-shaking.
+ */
+
+import { promises as fs } from 'node:fs'
+import path from 'node:path'
+import { describe, expect, it } from 'vitest'
+
+const rootDir = process.cwd()
+const distDir = path.join(rootDir, 'dist')
+const distExternalDir = path.join(rootDir, 'dist', 'external')
+
+/**
+ * Read devDependencies from package.json
+ */
+async function getDevDependencies(): Promise<string[]> {
+  const packageJsonPath = path.join(rootDir, 'package.json')
+  const packageJsonContent = await fs.readFile(packageJsonPath, 'utf8')
+  const packageJson = JSON.parse(packageJsonContent)
+  return Object.keys(packageJson.devDependencies || {})
+}
+
+// Stub re-export patterns that indicate incomplete bundling
+const STUB_PATTERNS = [
+  /^\s*module\.exports\s*=\s*require\s*\(/,
+  /^\s*export\s+\{\s*\}\s*from\s+/,
+  /^\s*export\s+\*\s+from\s+/,
+]
+
+/**
+ * Check if a file content is a stub re-export
+ */
+function isStubReexport(content: string): boolean {
+  return STUB_PATTERNS.some(pattern => pattern.test(content.trim()))
+}
+
+/**
+ * Get all .js files in a directory recursively
+ */
+async function getAllJsFiles(dir: string): Promise<string[]> {
+  async function walk(currentDir: string): Promise<string[]> {
+    const entries = await fs.readdir(currentDir, { withFileTypes: true })
+    const filePromises: Array<Promise<string[]>> = []
+
+    for (const entry of entries) {
+      const fullPath = path.join(currentDir, entry.name)
+
+      if (entry.isDirectory()) {
+        filePromises.push(walk(fullPath))
+      } else if (entry.isFile() && entry.name.endsWith('.js')) {
+        filePromises.push(Promise.resolve([fullPath]))
+      }
+    }
+
+    const results = await Promise.all(filePromises)
+    return results.flat()
+  }
+
+  return await walk(dir)
+}
+
+describe('build-externals', () => {
+  it('should have empty dependencies in package.json', async () => {
+    const devDependencies = await getDevDependencies()
+    const packageJsonPath = path.join(rootDir, 'package.json')
+    const packageJsonContent = await fs.readFile(packageJsonPath, 'utf8')
+    const packageJson = JSON.parse(packageJsonContent)
+
+    // Dependencies must be undefined or an empty object
+    const dependencies = packageJson.dependencies
+
+    // Check that dependencies is either undefined or an empty object
+    const isUndefined = dependencies === undefined
+    const isEmptyObject =
+      dependencies !== null &&
+      typeof dependencies === 'object' &&
+      Object.keys(dependencies).length === 0
+
+    if (!isUndefined && !isEmptyObject) {
+      const dependencyList = dependencies
+        ? Object.keys(dependencies).join(', ')
+        : 'invalid value'
+      expect.fail(
+        [
+          'package.json dependencies must be undefined or an empty object.',
+          `Found dependencies: ${dependencyList}`,
+          '',
+          'All dependencies should be either:',
+          '  - Bundled in dist/external (add to devDependencies)',
+          '  - Peer dependencies (add to peerDependencies)',
+          '',
+          'This prevents unnecessary package installations for library consumers.',
+        ].join('\n'),
+      )
+    }
+
+    // Ensure we have devDependencies to validate the test is working
+    expect(devDependencies.length).toBeGreaterThan(0)
+  })
+
+  it('should have bundled dist/external directory', async () => {
+    try {
+      await fs.access(distExternalDir)
+    } catch {
+      expect.fail(
+        `dist/external directory does not exist at ${distExternalDir}`,
+      )
+    }
+  })
+
+  it('should not have stub re-exports in bundled files', async () => {
+    const jsFiles = await getAllJsFiles(distExternalDir)
+
+    // Should have external files
+    expect(jsFiles.length).toBeGreaterThan(0)
+
+    // Intentional stubs that are copied from src/external as-is (not bundled)
+    // These are too complex or optional to bundle
+    const intentionalStubs = [
+      '@npmcli/package-json/index.js',
+      '@npmcli/package-json/lib/read-package.js',
+      '@npmcli/package-json/lib/sort.js',
+    ]
+
+    const checkPromises = jsFiles.map(async file => {
+      const [content, stat] = await Promise.all([
+        fs.readFile(file, 'utf8'),
+        fs.stat(file),
+      ])
+      const relativePath = path.relative(distExternalDir, file)
+      // Normalize path separators to forward slashes for cross-platform comparison
+      const normalizedPath = relativePath.replace(/\\/g, '/')
+      const issues: Array<{ file: string; reason: string }> = []
+
+      // Skip intentional stub files
+      if (intentionalStubs.some(stub => normalizedPath.endsWith(stub))) {
+        return issues
+      }
+
+      // Check for stub re-export patterns
+      if (isStubReexport(content)) {
+        issues.push({
+          file: normalizedPath,
+          reason: 'Contains stub re-export pattern',
+        })
+      }
+
+      // Check for very small files that are likely stubs (< 100 bytes of actual code)
+      // Exclude files that are intentionally small (like 1-2KB minified)
+      if (stat.size < 50 && isStubReexport(content)) {
+        issues.push({
+          file: normalizedPath,
+          reason: `Very small file (${stat.size} bytes) that appears to be a stub`,
+        })
+      }
+
+      return issues
+    })
+
+    const allIssues = (await Promise.all(checkPromises)).flat()
+
+    if (allIssues.length > 0) {
+      const errorMessage = [
+        'Found unexpected stub re-exports in dist/external:',
+        ...allIssues.map(f => `  - ${f.file}: ${f.reason}`),
+        '',
+        'Make sure these packages are added to the bundling configuration in scripts/build-externals.mjs',
+        'or add them to the intentionalStubs list if they should remain as stubs.',
+      ].join('\n')
+
+      expect.fail(errorMessage)
+    }
+  })
+
+  it('should have @inquirer modules properly bundled', async () => {
+    const requiredInquirerModules = [
+      'input',
+      'password',
+      'search',
+      'confirm',
+      'select',
+    ]
+    const inquirerDir = path.join(distExternalDir, '@inquirer')
+
+    try {
+      await fs.access(inquirerDir)
+    } catch {
+      expect.fail(`@inquirer directory not found at ${inquirerDir}`)
+    }
+
+    const checkPromises = requiredInquirerModules.map(async module => {
+      const modulePath = path.join(inquirerDir, `${module}.js`)
+
+      try {
+        const [stat, content] = await Promise.all([
+          fs.stat(modulePath),
+          fs.readFile(modulePath, 'utf8'),
+        ])
+
+        if (stat.size <= 1000) {
+          expect.fail(
+            `@inquirer/${module} should be properly bundled (> 1KB), got ${stat.size} bytes`,
+          )
+        }
+
+        if (isStubReexport(content)) {
+          expect.fail(`@inquirer/${module} should not be a stub re-export`)
+        }
+      } catch (error) {
+        expect.fail(
+          `@inquirer/${module} not found or not properly bundled at ${modulePath}: ${error instanceof Error ? error.message : String(error)}`,
+        )
+      }
+    })
+
+    await Promise.all(checkPromises)
+  })
+
+  it('should not import external packages outside dist/external', async () => {
+    const [allDistFiles, devDependencies] = await Promise.all([
+      getAllJsFiles(distDir),
+      getDevDependencies(),
+    ])
+
+    // Filter to files outside dist/external
+    const nonExternalFiles = allDistFiles.filter(
+      file => !file.startsWith(distExternalDir),
+    )
+
+    // Should have files to check
+    expect(nonExternalFiles.length).toBeGreaterThan(0)
+    expect(devDependencies.length).toBeGreaterThan(0)
+
+    const violations: Array<{ file: string; packages: string[] }> = []
+
+    const checkPromises = nonExternalFiles.map(async file => {
+      const content = await fs.readFile(file, 'utf8')
+      const relativePath = path.relative(distDir, file)
+      const foundPackages: string[] = []
+
+      // Check for require() or import statements of devDependencies
+      for (const pkg of devDependencies) {
+        // Escape special regex characters in package name
+        const escapedPkg = pkg.replace(/[.*+?^${}()|[\]\\]/g, '\\$&')
+
+        // Match require('pkg') or require("pkg") or from 'pkg' or from "pkg"
+        const requirePattern = new RegExp(
+          `(?:require\\s*\\(\\s*['"]${escapedPkg}['"]\\s*\\)|from\\s+['"]${escapedPkg}['"])`,
+          'g',
+        )
+
+        if (requirePattern.test(content)) {
+          foundPackages.push(pkg)
+        }
+      }
+
+      if (foundPackages.length > 0) {
+        violations.push({
+          file: relativePath,
+          packages: foundPackages,
+        })
+      }
+    })
+
+    await Promise.all(checkPromises)
+
+    if (violations.length > 0) {
+      const errorMessage = [
+        'Found devDependency imports outside dist/external:',
+        ...violations.map(
+          v =>
+            `  - ${v.file}:\n    ${v.packages.map(p => `require('${p}')`).join(', ')}`,
+        ),
+        '',
+        'devDependencies should only be bundled in dist/external.',
+        'These files should import from dist/external or have the imports rewritten during build.',
+      ].join('\n')
+
+      expect.fail(errorMessage)
+    }
+  })
+})
diff --git a/test/unit/cacache.test.ts b/test/unit/cacache.test.ts
new file mode 100644
index 0000000..e1e3840
--- /dev/null
+++ b/test/unit/cacache.test.ts
@@ -0,0 +1,596 @@
+/**
+ * @fileoverview Unit tests for content-addressable cache (cacache) wrapper utilities.
+ *
+ * Tests cacache wrapper functions for content-addressable caching:
+ * - getCacache() lazy-loads cacache library
+ * - get(), safeGet() retrieve cached content by key
+ * - put() stores content with integrity hash
+ * - remove() deletes cached entries
+ * - clear() purges entire cache
+ * - withTmp() provides temporary cache directory
+ * Used by Socket tools for package tarball caching and content storage.
+ */
+
+import { describe, expect, it, vi } from 'vitest'
+
+import {
+  clear,
+  get,
+  getCacache,
+  put,
+  remove,
+  safeGet,
+  withTmp,
+} from '@socketsecurity/lib/cacache'
+import type {
+  CacheEntry,
+  GetOptions,
+  PutOptions,
+  RemoveOptions,
+} from '@socketsecurity/lib/cacache'
+
+describe('cacache', () => {
+  describe('getCacache', () => {
+    it('should export getCacache function', () => {
+      expect(typeof getCacache).toBe('function')
+    })
+
+    it('should return cacache module', () => {
+      const cacache = getCacache()
+      expect(cacache).toBeDefined()
+      expect(typeof cacache).toBe('object')
+    })
+
+    it('should have expected cacache methods', () => {
+      const cacache = getCacache()
+      expect(typeof cacache.get).toBe('function')
+      expect(typeof cacache.put).toBe('function')
+      // rm and ls are namespaces with methods like rm.entry, rm.all, ls.stream
+      expect(cacache.rm).toBeDefined()
+      expect(cacache.ls).toBeDefined()
+      expect(typeof cacache.rm.entry).toBe('function')
+      expect(typeof cacache.ls.stream).toBe('function')
+    })
+  })
+
+  describe('type exports', () => {
+    it('should support GetOptions type', () => {
+      const opts: GetOptions = {
+        integrity: 'sha512-abc',
+        size: 1024,
+        memoize: true,
+      }
+      expect(opts).toBeDefined()
+    })
+
+    it('should support PutOptions type', () => {
+      const opts: PutOptions = {
+        integrity: 'sha512-abc',
+        size: 1024,
+        metadata: { foo: 'bar' },
+        memoize: true,
+      }
+      expect(opts).toBeDefined()
+    })
+
+    it('should support CacheEntry type', () => {
+      const entry: CacheEntry = {
+        data: Buffer.from('test'),
+        integrity: 'sha512-abc',
+        key: 'test-key',
+        metadata: { foo: 'bar' },
+        path: '/path/to/cache',
+        size: 4,
+        time: Date.now(),
+      }
+      expect(entry).toBeDefined()
+    })
+
+    it('should support RemoveOptions type', () => {
+      const opts: RemoveOptions = {
+        prefix: 'socket-sdk',
+      }
+      expect(opts).toBeDefined()
+    })
+
+    it('should support RemoveOptions with wildcard', () => {
+      const opts: RemoveOptions = {
+        prefix: 'socket-sdk:scans:abc*',
+      }
+      expect(opts).toBeDefined()
+    })
+  })
+
+  describe('put', () => {
+    it('should export put function', () => {
+      expect(typeof put).toBe('function')
+    })
+
+    it('should reject keys with wildcards', async () => {
+      await expect(put('test*key', 'data')).rejects.toThrow(TypeError)
+      await expect(put('test*key', 'data')).rejects.toThrow(
+        'Cache key cannot contain wildcards (*)',
+      )
+    })
+
+    it('should reject keys with wildcards in middle', async () => {
+      await expect(put('socket:*:key', 'data')).rejects.toThrow(TypeError)
+    })
+
+    it('should reject keys with wildcards at end', async () => {
+      await expect(put('socket:key*', 'data')).rejects.toThrow(TypeError)
+    })
+
+    it('should accept keys without wildcards', async () => {
+      // This will fail because it actually tries to write to cache,
+      // but it proves the wildcard check passed
+      const key = `test-key-${Date.now()}`
+      try {
+        await put(key, 'test data')
+        // If it succeeds, clean up
+        await remove(key)
+      } catch (e) {
+        // Expected - cache dir may not exist in test env
+        expect(e).toBeDefined()
+      }
+    })
+  })
+
+  describe('get', () => {
+    it('should export get function', () => {
+      expect(typeof get).toBe('function')
+    })
+
+    it('should reject keys with wildcards', async () => {
+      await expect(get('test*key')).rejects.toThrow(TypeError)
+      await expect(get('test*key')).rejects.toThrow(
+        'Cache key cannot contain wildcards (*)',
+      )
+    })
+
+    it('should reject keys with wildcards in middle', async () => {
+      await expect(get('socket:*:key')).rejects.toThrow(TypeError)
+    })
+
+    it('should reject keys with wildcards at end', async () => {
+      await expect(get('socket:key*')).rejects.toThrow(TypeError)
+    })
+
+    it('should accept keys without wildcards', async () => {
+      // This will fail because key doesn't exist, but proves wildcard check passed
+      await expect(get('nonexistent-key')).rejects.toThrow()
+    })
+
+    it('should accept GetOptions', async () => {
+      const opts: GetOptions = {
+        integrity: 'sha512-abc',
+        memoize: false,
+      }
+      await expect(get('nonexistent-key', opts)).rejects.toThrow()
+    })
+  })
+
+  describe('remove', () => {
+    it('should export remove function', () => {
+      expect(typeof remove).toBe('function')
+    })
+
+    it('should reject keys with wildcards', async () => {
+      await expect(remove('test*key')).rejects.toThrow(TypeError)
+      await expect(remove('test*key')).rejects.toThrow(
+        'Cache key cannot contain wildcards (*)',
+      )
+    })
+
+    it('should reject keys with wildcards in middle', async () => {
+      await expect(remove('socket:*:key')).rejects.toThrow(TypeError)
+    })
+
+    it('should reject keys with wildcards at end', async () => {
+      await expect(remove('socket:key*')).rejects.toThrow(TypeError)
+    })
+
+    it('should suggest using clear for wildcards', async () => {
+      await expect(remove('test*')).rejects.toThrow(
+        'Use clear({ prefix: "pattern*" })',
+      )
+    })
+
+    it('should accept keys without wildcards', async () => {
+      // This may succeed (if key doesn't exist) or fail (cache issues)
+      // Either way, it proves the wildcard check passed
+      try {
+        await remove('nonexistent-key')
+      } catch (e) {
+        expect(e).toBeDefined()
+      }
+    })
+  })
+
+  describe('safeGet', () => {
+    it('should export safeGet function', () => {
+      expect(typeof safeGet).toBe('function')
+    })
+
+    it('should return undefined for nonexistent keys', async () => {
+      const result = await safeGet('nonexistent-key')
+      expect(result).toBeUndefined()
+    })
+
+    it('should return undefined on wildcard errors', async () => {
+      const result = await safeGet('test*key')
+      expect(result).toBeUndefined()
+    })
+
+    it('should accept GetOptions', async () => {
+      const opts: GetOptions = {
+        integrity: 'sha512-abc',
+        memoize: false,
+      }
+      const result = await safeGet('nonexistent-key', opts)
+      expect(result).toBeUndefined()
+    })
+
+    it('should not throw on errors', async () => {
+      await expect(safeGet('any-key')).resolves.toBeUndefined()
+      await expect(safeGet('test*key')).resolves.toBeUndefined()
+    })
+  })
+
+  describe('clear', () => {
+    it('should export clear function', () => {
+      expect(typeof clear).toBe('function')
+    })
+
+    it('should accept RemoveOptions with prefix', async () => {
+      const opts: RemoveOptions = { prefix: 'test-prefix' }
+      // This may succeed or fail depending on cache state
+      try {
+        const result = await clear(opts)
+        expect(typeof result).toBe('number')
+      } catch (e) {
+        expect(e).toBeDefined()
+      }
+    })
+
+    it('should accept RemoveOptions with wildcard', async () => {
+      const opts: RemoveOptions = { prefix: 'test-prefix*' }
+      try {
+        const result = await clear(opts)
+        expect(typeof result).toBe('number')
+      } catch (e) {
+        expect(e).toBeDefined()
+      }
+    })
+
+    it('should accept no options', async () => {
+      try {
+        const result = await clear()
+        expect(result).toBeUndefined()
+      } catch (e) {
+        // Ignore ENOTEMPTY errors per implementation
+        if ((e as any)?.code !== 'ENOTEMPTY') {
+          expect(e).toBeDefined()
+        }
+      }
+    })
+
+    it('should accept undefined options', async () => {
+      try {
+        const result = await clear(undefined)
+        expect(result).toBeUndefined()
+      } catch (e) {
+        if ((e as any)?.code !== 'ENOTEMPTY') {
+          expect(e).toBeDefined()
+        }
+      }
+    })
+
+    it('should accept empty options object', async () => {
+      try {
+        const result = await clear({})
+        expect(result).toBeUndefined()
+      } catch (e) {
+        if ((e as any)?.code !== 'ENOTEMPTY') {
+          expect(e).toBeDefined()
+        }
+      }
+    })
+
+    it('should handle ENOTEMPTY errors gracefully', async () => {
+      // Test that ENOTEMPTY errors are silently ignored
+      const cacache = getCacache()
+      const originalRmAll = cacache.rm.all
+
+      try {
+        cacache.rm.all = vi.fn().mockRejectedValue(
+          Object.assign(new Error('ENOTEMPTY'), {
+            code: 'ENOTEMPTY',
+          }),
+        )
+
+        // Should not throw
+        await expect(clear()).resolves.toBeUndefined()
+      } finally {
+        cacache.rm.all = originalRmAll
+      }
+    })
+
+    it('should throw non-ENOTEMPTY errors', async () => {
+      const cacache = getCacache()
+      const originalRmAll = cacache.rm.all
+
+      try {
+        cacache.rm.all = vi.fn().mockRejectedValue(
+          Object.assign(new Error('EACCES'), {
+            code: 'EACCES',
+          }),
+        )
+
+        await expect(clear()).rejects.toThrow('EACCES')
+      } finally {
+        cacache.rm.all = originalRmAll
+      }
+    })
+  })
+
+  describe('withTmp', () => {
+    it('should export withTmp function', () => {
+      expect(typeof withTmp).toBe('function')
+    })
+
+    it('should call callback with temp directory path', async () => {
+      const callback = vi.fn(async (tmpDir: string) => {
+        expect(typeof tmpDir).toBe('string')
+        expect(tmpDir.length).toBeGreaterThan(0)
+        return 'result'
+      })
+
+      try {
+        const result = await withTmp(callback)
+        expect(callback).toHaveBeenCalled()
+        expect(result).toBe('result')
+      } catch (e) {
+        // Cache dir may not exist in test env
+        expect(e).toBeDefined()
+      }
+    })
+
+    it('should return callback result', async () => {
+      try {
+        const result = await withTmp(async () => {
+          return 42
+        })
+        expect(result).toBe(42)
+      } catch (e) {
+        expect(e).toBeDefined()
+      }
+    })
+
+    it('should support async callbacks', async () => {
+      try {
+        const result = await withTmp(async tmpDir => {
+          await new Promise(resolve => setTimeout(resolve, 1))
+          return tmpDir.length
+        })
+        expect(typeof result).toBe('number')
+      } catch (e) {
+        expect(e).toBeDefined()
+      }
+    })
+
+    it('should propagate callback errors', async () => {
+      try {
+        await withTmp(async () => {
+          throw new Error('callback error')
+        })
+        // If we reach here, cache dir doesn't exist
+      } catch (e) {
+        // Either cache dir error or callback error
+        expect(e).toBeDefined()
+      }
+    })
+  })
+
+  describe('integration', () => {
+    it('should support put -> get -> remove workflow', async () => {
+      const key = `test-integration-${Date.now()}`
+      const data = 'test data'
+
+      try {
+        // Put data
+        await put(key, data)
+
+        // Get data
+        const entry = await get(key)
+        expect(entry).toBeDefined()
+        expect(entry.key).toBe(key)
+        expect(entry.data.toString()).toBe(data)
+
+        // Remove data
+        await remove(key)
+
+        // Verify removed
+        await expect(get(key)).rejects.toThrow()
+      } catch (e) {
+        // Cache dir may not exist in test env - that's ok
+        expect(e).toBeDefined()
+      }
+    })
+
+    it('should support put -> safeGet workflow', async () => {
+      const key = `test-safe-${Date.now()}`
+      const data = 'test data'
+
+      try {
+        await put(key, data)
+
+        const entry = await safeGet(key)
+        expect(entry).toBeDefined()
+        expect(entry?.key).toBe(key)
+
+        await remove(key)
+
+        const missing = await safeGet(key)
+        expect(missing).toBeUndefined()
+      } catch (e) {
+        expect(e).toBeDefined()
+      }
+    })
+
+    it('should support clear with prefix workflow', async () => {
+      const prefix = `test-clear-${Date.now()}`
+      const keys = [`${prefix}:1`, `${prefix}:2`, `${prefix}:3`]
+
+      try {
+        // Put multiple entries
+        await Promise.all(keys.map(key => put(key, `data-${key}`)))
+
+        // Clear with prefix
+        const removed = await clear({ prefix })
+        expect(typeof removed).toBe('number')
+        expect(removed).toBeGreaterThanOrEqual(0)
+
+        // Verify cleared
+        // @ts-expect-error - safeGet signature doesn't match map callback but works at runtime
+        const results = await Promise.all(keys.map(safeGet))
+        results.forEach(result => expect(result).toBeUndefined())
+      } catch (e) {
+        expect(e).toBeDefined()
+      }
+    })
+
+    it('should support clear with wildcard workflow', async () => {
+      const prefix = `test-wildcard-${Date.now()}`
+      const keys = [`${prefix}:abc:1`, `${prefix}:abc:2`, `${prefix}:xyz:1`]
+
+      try {
+        await Promise.all(keys.map(key => put(key, `data-${key}`)))
+
+        // Clear with wildcard - only abc entries
+        const removed = await clear({ prefix: `${prefix}:abc*` })
+        expect(typeof removed).toBe('number')
+        expect(removed).toBeGreaterThanOrEqual(0)
+
+        // Verify abc entries cleared
+        expect(await safeGet(keys[0])).toBeUndefined()
+        expect(await safeGet(keys[1])).toBeUndefined()
+
+        // Verify xyz entry remains (if cache works)
+        // This may be undefined if cache doesn't work in test env
+        await safeGet(keys[2])
+
+        // Clean up remaining
+        await clear({ prefix })
+      } catch (e) {
+        expect(e).toBeDefined()
+      }
+    })
+  })
+
+  describe('edge cases', () => {
+    it('should handle empty string keys', async () => {
+      // Empty string keys are actually allowed by cacache
+      const key = ''
+      try {
+        await put(key, 'data')
+        await remove(key)
+      } catch (e) {
+        // Cache may not work in test env - that's ok
+        expect(e).toBeDefined()
+      }
+    })
+
+    it('should handle very long keys', async () => {
+      const longKey = 'x'.repeat(1000)
+      try {
+        await put(longKey, 'data')
+        await remove(longKey)
+      } catch (e) {
+        expect(e).toBeDefined()
+      }
+    })
+
+    it('should handle keys with special characters', async () => {
+      const key = `test:key/${Date.now()}@special`
+      try {
+        await put(key, 'data')
+        await remove(key)
+      } catch (e) {
+        expect(e).toBeDefined()
+      }
+    })
+
+    it('should handle Buffer data', async () => {
+      const key = `test-buffer-${Date.now()}`
+      const data = Buffer.from('test buffer data')
+      try {
+        await put(key, data)
+        const entry = await get(key)
+        expect(Buffer.isBuffer(entry.data)).toBe(true)
+        await remove(key)
+      } catch (e) {
+        expect(e).toBeDefined()
+      }
+    })
+
+    it('should handle empty data', async () => {
+      const key = `test-empty-${Date.now()}`
+      try {
+        await put(key, '')
+        const entry = await get(key)
+        expect(entry.data.toString()).toBe('')
+        await remove(key)
+      } catch (e) {
+        expect(e).toBeDefined()
+      }
+    })
+
+    it('should handle options with all fields', async () => {
+      const key = `test-options-${Date.now()}`
+      const putOpts: PutOptions = {
+        integrity: 'sha512-test',
+        size: 100,
+        metadata: { foo: 'bar', nested: { baz: 42 } },
+        memoize: true,
+      }
+      try {
+        await put(key, 'data', putOpts)
+        const getOpts: GetOptions = {
+          memoize: false,
+        }
+        const entry = await get(key, getOpts)
+        expect(entry).toBeDefined()
+        await remove(key)
+      } catch (e) {
+        expect(e).toBeDefined()
+      }
+    })
+
+    it('should handle concurrent operations', async () => {
+      const keys = Array.from(
+        { length: 10 },
+        (_, i) => `concurrent-${Date.now()}-${i}`,
+      )
+
+      try {
+        // Concurrent puts
+        await Promise.all(keys.map(key => put(key, `data-${key}`)))
+
+        // Concurrent gets
+        // @ts-expect-error - safeGet signature doesn't match map callback but works at runtime
+        const entries = await Promise.all(keys.map(safeGet))
+        entries.forEach(entry => {
+          if (entry) {
+            expect(entry).toBeDefined()
+          }
+        })
+
+        // Concurrent removes
+        await Promise.all(keys.map(remove))
+      } catch (e) {
+        expect(e).toBeDefined()
+      }
+    })
+  })
+})
diff --git a/test/unit/cache-with-ttl.test.ts b/test/unit/cache-with-ttl.test.ts
new file mode 100644
index 0000000..3c35ce0
--- /dev/null
+++ b/test/unit/cache-with-ttl.test.ts
@@ -0,0 +1,595 @@
+/**
+ * @fileoverview Unit tests for time-to-live (TTL) cache utilities.
+ *
+ * Tests TTL-based file caching system:
+ * - createTtlCache() creates cache instance with configurable TTL
+ * - get() retrieves cached values if not expired
+ * - set() stores values with automatic expiration
+ * - has() checks cache key existence without extending TTL
+ * - delete() removes cached entries
+ * - clear() purges all cache entries
+ * - Automatic expiration based on TTL (time-to-live)
+ * Used by Socket tools for temporary data caching with expiration (API responses, metadata).
+ */
+
+import { tmpdir } from 'node:os'
+import * as path from 'node:path'
+
+import { createTtlCache } from '@socketsecurity/lib/cache-with-ttl'
+import { resetEnv, setEnv } from '@socketsecurity/lib/env/rewire'
+import { afterEach, beforeEach, describe, expect, it, vi } from 'vitest'
+
+describe.sequential('cache-with-ttl', () => {
+  let cache: ReturnType<typeof createTtlCache>
+  let testCacheDir: string
+
+  beforeEach(() => {
+    // Create a unique cache directory for each test to ensure isolation
+    testCacheDir = path.join(
+      tmpdir(),
+      `socket-test-cache-${Date.now()}-${Math.random().toString(36).slice(2)}`,
+    )
+    setEnv('SOCKET_CACACHE_DIR', testCacheDir)
+
+    // Create a fresh cache instance for each test
+    cache = createTtlCache({
+      ttl: 1000, // 1 second for tests
+      prefix: 'test-cache',
+      memoize: true,
+    })
+  })
+
+  afterEach(async () => {
+    // Clean up after each test
+    await cache.clear()
+    // Reset environment overrides
+    resetEnv()
+  })
+
+  describe('createTtlCache', () => {
+    it('should create cache with default options', () => {
+      const defaultCache = createTtlCache()
+      expect(defaultCache).toBeTruthy()
+      expect(typeof defaultCache.get).toBe('function')
+      expect(typeof defaultCache.set).toBe('function')
+    })
+
+    it('should create cache with custom TTL', () => {
+      const customCache = createTtlCache({ ttl: 5000 })
+      expect(customCache).toBeTruthy()
+    })
+
+    it('should create cache with custom prefix', () => {
+      const customCache = createTtlCache({ prefix: 'custom-prefix' })
+      expect(customCache).toBeTruthy()
+    })
+
+    it('should create cache with memoize disabled', () => {
+      const noMemoCache = createTtlCache({ memoize: false })
+      expect(noMemoCache).toBeTruthy()
+    })
+
+    it('should throw TypeError for prefix with wildcards', () => {
+      expect(() => createTtlCache({ prefix: 'test-*' })).toThrow(TypeError)
+      expect(() => createTtlCache({ prefix: '*-cache' })).toThrow(TypeError)
+      expect(() => createTtlCache({ prefix: 'test-*-cache' })).toThrow(
+        TypeError,
+      )
+    })
+
+    it('should accept prefix without wildcards', () => {
+      expect(() => createTtlCache({ prefix: 'test-cache' })).not.toThrow()
+      expect(() => createTtlCache({ prefix: 'my:app:cache' })).not.toThrow()
+    })
+  })
+
+  describe('set and get', () => {
+    it('should set and get a value', async () => {
+      await cache.set('key1', 'value1')
+      const value = await cache.get<string>('key1')
+      expect(value).toBe('value1')
+    })
+
+    it('should set and get different types', async () => {
+      // Set values sequentially to avoid any potential race conditions.
+      await cache.set('string', 'hello')
+      await cache.set('number', 42)
+      await cache.set('boolean', true)
+      await cache.set('object', { foo: 'bar' })
+      await cache.set('array', [1, 2, 3])
+
+      // Verify each value independently to isolate any failures.
+      expect(await cache.get<string>('string')).toBe('hello')
+      expect(await cache.get<number>('number')).toBe(42)
+      expect(await cache.get<boolean>('boolean')).toBe(true)
+      expect(await cache.get<{ foo: string }>('object')).toEqual({ foo: 'bar' })
+      expect(await cache.get<number[]>('array')).toEqual([1, 2, 3])
+    })
+
+    it('should return undefined for non-existent key', async () => {
+      const value = await cache.get('nonexistent')
+      expect(value).toBeUndefined()
+    })
+
+    it('should overwrite existing value', async () => {
+      await cache.set('key', 'value1')
+      // Ensure first write completes before second write.
+      const firstValue = await cache.get<string>('key')
+      expect(firstValue).toBe('value1')
+
+      await cache.set('key', 'value2')
+      const value = await cache.get<string>('key')
+      expect(value).toBe('value2')
+    })
+
+    it('should handle null values', async () => {
+      await cache.set('null-key', null)
+      const value = await cache.get('null-key')
+      expect(value).toBe(null)
+    })
+
+    it('should handle undefined values', async () => {
+      await cache.set('undefined-key', undefined)
+      const value = await cache.get('undefined-key')
+      expect(value).toBe(undefined)
+    })
+
+    it('should handle empty string keys', async () => {
+      await cache.set('', 'empty-key-value')
+      const value = await cache.get<string>('')
+      expect(value).toBe('empty-key-value')
+    })
+
+    it('should handle keys with special characters', async () => {
+      await cache.set('key:with:colons', 'value')
+      await cache.set('key/with/slashes', 'value')
+      await cache.set('key-with-dashes', 'value')
+
+      expect(await cache.get('key:with:colons')).toBe('value')
+      expect(await cache.get('key/with/slashes')).toBe('value')
+      expect(await cache.get('key-with-dashes')).toBe('value')
+    })
+
+    it('should throw TypeError for keys with wildcards', async () => {
+      await expect(cache.get('key*')).rejects.toThrow(TypeError)
+      await expect(cache.set('key*', 'value')).rejects.toThrow(TypeError)
+    })
+  })
+
+  describe('getOrFetch', () => {
+    it('should fetch value when not cached', async () => {
+      const fetcher = vi.fn(async () => 'fetched-value')
+      const value = await cache.getOrFetch('key', fetcher)
+      expect(value).toBe('fetched-value')
+      expect(fetcher).toHaveBeenCalledTimes(1)
+    })
+
+    it('should return cached value without fetching', async () => {
+      await cache.set('key', 'cached-value')
+      const fetcher = vi.fn(async () => 'fetched-value')
+      const value = await cache.getOrFetch('key', fetcher)
+      expect(value).toBe('cached-value')
+      expect(fetcher).not.toHaveBeenCalled()
+    })
+
+    it('should cache fetched value', async () => {
+      const fetcher = vi.fn(async () => 'fetched-value')
+      await cache.getOrFetch('key', fetcher)
+      const value = await cache.get<string>('key')
+      expect(value).toBe('fetched-value')
+    })
+
+    it('should fetch again after cache expires', async () => {
+      const shortCache = createTtlCache({
+        ttl: 50,
+        prefix: 'short-cache',
+      })
+      const fetcher = vi.fn(async () => 'value')
+      await shortCache.getOrFetch('key', fetcher)
+      expect(fetcher).toHaveBeenCalledTimes(1)
+
+      // Wait for TTL to expire
+      await new Promise(resolve => setTimeout(resolve, 100))
+
+      await shortCache.getOrFetch('key', fetcher)
+      expect(fetcher).toHaveBeenCalledTimes(2)
+
+      await shortCache.clear()
+    })
+
+    it('should handle async fetcher errors', async () => {
+      const fetcher = async () => {
+        throw new Error('Fetch failed')
+      }
+      await expect(cache.getOrFetch('key', fetcher)).rejects.toThrow(
+        'Fetch failed',
+      )
+    })
+  })
+
+  describe('delete', () => {
+    it('should delete existing key', async () => {
+      await cache.set('key', 'value')
+      await cache.delete('key')
+      const value = await cache.get('key')
+      expect(value).toBeUndefined()
+    })
+
+    it('should not throw for non-existent key', async () => {
+      await expect(cache.delete('nonexistent')).resolves.not.toThrow()
+    })
+
+    it('should throw TypeError for keys with wildcards', async () => {
+      await expect(cache.delete('key*')).rejects.toThrow(TypeError)
+    })
+  })
+
+  describe('deleteAll', () => {
+    it('should delete all entries without pattern', async () => {
+      await cache.set('key1', 'value1')
+      await cache.set('key2', 'value2')
+      await cache.set('key3', 'value3')
+
+      const count = await cache.deleteAll()
+      expect(count).toBeGreaterThanOrEqual(0)
+
+      expect(await cache.get('key1')).toBeUndefined()
+      expect(await cache.get('key2')).toBeUndefined()
+      expect(await cache.get('key3')).toBeUndefined()
+    })
+
+    it('should delete entries matching prefix pattern', async () => {
+      await cache.set('user:1', 'alice')
+      await cache.set('user:2', 'bob')
+      await cache.set('post:1', 'hello')
+
+      await cache.deleteAll('user:*')
+
+      expect(await cache.get('user:1')).toBeUndefined()
+      expect(await cache.get('user:2')).toBeUndefined()
+      expect(await cache.get('post:1')).toBe('hello')
+    })
+
+    it('should delete entries matching exact prefix', async () => {
+      await cache.set('users:1', 'alice')
+      await cache.set('users:2', 'bob')
+      await cache.set('posts:1', 'hello')
+
+      await cache.deleteAll('users')
+
+      expect(await cache.get('users:1')).toBeUndefined()
+      expect(await cache.get('users:2')).toBeUndefined()
+      expect(await cache.get('posts:1')).toBe('hello')
+    })
+
+    it('should handle wildcard patterns', { retry: 3 }, async () => {
+      await cache.set('npm/lodash/1.0.0', 'data1')
+      await cache.set('npm/lodash/2.0.0', 'data2')
+      await cache.set('npm/react/1.0.0', 'data3')
+
+      await cache.deleteAll('npm/lodash/*')
+
+      expect(await cache.get('npm/lodash/1.0.0')).toBeUndefined()
+      expect(await cache.get('npm/lodash/2.0.0')).toBeUndefined()
+      expect(await cache.get('npm/react/1.0.0')).toBe('data3')
+    })
+
+    it('should return count of deleted entries', async () => {
+      await cache.set('key1', 'value1')
+      await cache.set('key2', 'value2')
+
+      const count = await cache.deleteAll()
+      expect(typeof count).toBe('number')
+      expect(count).toBeGreaterThanOrEqual(0)
+    })
+  })
+
+  describe('getAll', () => {
+    it('should support getAll method', () => {
+      expect(typeof cache.getAll).toBe('function')
+    })
+
+    it('should return all entries with wildcard pattern', async () => {
+      await cache.set('user:1', { name: 'Alice' })
+      await cache.set('user:2', { name: 'Bob' })
+      await cache.set('post:1', { title: 'Hello' })
+
+      const users = await cache.getAll<{ name: string }>('user:*')
+      expect(users.size).toBe(2)
+      expect(users.get('user:1')).toEqual({ name: 'Alice' })
+      expect(users.get('user:2')).toEqual({ name: 'Bob' })
+      expect(users.has('post:1')).toBe(false)
+    })
+
+    it('should return all entries with star pattern', async () => {
+      await cache.set('key1', 'value1')
+      await cache.set('key2', 'value2')
+      await cache.set('key3', 'value3')
+
+      const all = await cache.getAll<string>('*')
+      expect(all.size).toBeGreaterThanOrEqual(3)
+      expect(all.get('key1')).toBe('value1')
+      expect(all.get('key2')).toBe('value2')
+      expect(all.get('key3')).toBe('value3')
+    })
+
+    it('should return empty map when no entries match', async () => {
+      await cache.set('user:1', 'data')
+
+      const posts = await cache.getAll('post:*')
+      expect(posts.size).toBe(0)
+    })
+
+    it('should skip expired entries in getAll', async () => {
+      const shortCache = createTtlCache({
+        ttl: 50,
+        prefix: 'expiry-getall-test',
+      })
+
+      await shortCache.set('key1', 'value1')
+      await shortCache.set('key2', 'value2')
+
+      // Wait for TTL to expire
+      await new Promise(resolve => setTimeout(resolve, 100))
+
+      const all = await shortCache.getAll<string>('*')
+      expect(all.size).toBe(0)
+
+      await shortCache.clear()
+    })
+
+    it('should handle complex wildcard patterns', async () => {
+      await cache.set('npm/lodash/1.0.0', 'data1')
+      await cache.set('npm/lodash/2.0.0', 'data2')
+      await cache.set('npm/react/1.0.0', 'data3')
+
+      const lodash = await cache.getAll<string>('npm/lodash/*')
+      expect(lodash.size).toBe(2)
+      expect(lodash.get('npm/lodash/1.0.0')).toBe('data1')
+      expect(lodash.get('npm/lodash/2.0.0')).toBe('data2')
+    })
+
+    it('should return entries from both memory and persistent cache', async () => {
+      // Set some entries
+      await cache.set('mem1', 'value1')
+      await cache.set('mem2', 'value2')
+      await cache.set('mem3', 'value3')
+
+      // getAll should return all entries
+      const all = await cache.getAll<string>('*')
+      expect(all.size).toBeGreaterThanOrEqual(3)
+      expect(all.get('mem1')).toBe('value1')
+      expect(all.get('mem2')).toBe('value2')
+      expect(all.get('mem3')).toBe('value3')
+    })
+
+    it('should handle non-wildcard patterns as prefix match', async () => {
+      await cache.set('users:1', 'alice')
+      await cache.set('users:2', 'bob')
+      await cache.set('posts:1', 'hello')
+
+      const users = await cache.getAll<string>('users')
+      expect(users.size).toBe(2)
+      expect(users.get('users:1')).toBe('alice')
+      expect(users.get('users:2')).toBe('bob')
+    })
+  })
+
+  describe('clear', () => {
+    it('should clear all cache entries', async () => {
+      await cache.set('key1', 'value1')
+      await cache.set('key2', 'value2')
+
+      await cache.clear()
+
+      expect(await cache.get('key1')).toBeUndefined()
+      expect(await cache.get('key2')).toBeUndefined()
+    })
+
+    it('should clear only in-memory cache with memoOnly option', async () => {
+      await cache.set('key', 'value')
+
+      await cache.clear({ memoOnly: true })
+
+      // After clearing memo only, value should still be in persistent cache
+      // but might not be immediately accessible depending on implementation
+      expect(true).toBe(true) // Test passes if no error
+    })
+
+    it('should handle clearing empty cache', async () => {
+      await expect(cache.clear()).resolves.not.toThrow()
+    })
+
+    it('should handle clearing twice', async () => {
+      await cache.set('key', 'value')
+      await cache.clear()
+      await expect(cache.clear()).resolves.not.toThrow()
+    })
+  })
+
+  describe('TTL expiration', () => {
+    it('should expire entries after TTL', async () => {
+      const shortCache = createTtlCache({
+        ttl: 50,
+        prefix: 'expiry-test',
+      })
+
+      await shortCache.set('key', 'value')
+      expect(await shortCache.get<string>('key')).toBe('value')
+
+      // Wait for TTL to expire
+      await new Promise(resolve => setTimeout(resolve, 100))
+
+      expect(await shortCache.get('key')).toBeUndefined()
+
+      await shortCache.clear()
+    })
+
+    it('should not expire entries before TTL', async () => {
+      const longCache = createTtlCache({
+        ttl: 10_000,
+        prefix: 'long-cache',
+      })
+
+      await longCache.set('key', 'value')
+      expect(await longCache.get<string>('key')).toBe('value')
+
+      // Wait a bit but not long enough to expire
+      await new Promise(resolve => setTimeout(resolve, 50))
+
+      expect(await longCache.get<string>('key')).toBe('value')
+
+      await longCache.clear()
+    })
+
+    it('should refresh TTL on set', async () => {
+      const refreshCache = createTtlCache({
+        ttl: 300,
+        prefix: 'refresh-cache',
+      })
+
+      await refreshCache.set('key', 'value1')
+      await new Promise(resolve => setTimeout(resolve, 100))
+      await refreshCache.set('key', 'value2') // Refresh TTL
+
+      await new Promise(resolve => setTimeout(resolve, 100))
+      // Should still be cached (100 + 100 = 200ms, but TTL refreshed at 100ms to 300ms)
+      expect(await refreshCache.get<string>('key')).toBe('value2')
+
+      await refreshCache.clear()
+    })
+  })
+
+  describe('memoization', () => {
+    it('should use in-memory cache when memoize is true', async () => {
+      const memoCache = createTtlCache({
+        ttl: 1000,
+        prefix: 'memo-cache',
+        memoize: true,
+      })
+
+      await memoCache.set('key', 'value')
+      const value = await memoCache.get<string>('key')
+      expect(value).toBe('value')
+
+      await memoCache.clear()
+    })
+
+    it('should not use in-memory cache when memoize is false', async () => {
+      const noMemoCache = createTtlCache({
+        ttl: 1000,
+        prefix: 'no-memo-cache',
+        memoize: false,
+      })
+
+      await noMemoCache.set('key', 'value')
+      const value = await noMemoCache.get<string>('key')
+      expect(value).toBe('value')
+
+      await noMemoCache.clear()
+    })
+  })
+
+  describe('concurrent operations', () => {
+    it('should handle concurrent sets', async () => {
+      await Promise.all([
+        cache.set('key1', 'value1'),
+        cache.set('key2', 'value2'),
+        cache.set('key3', 'value3'),
+      ])
+
+      expect(await cache.get<string>('key1')).toBe('value1')
+      expect(await cache.get<string>('key2')).toBe('value2')
+      expect(await cache.get<string>('key3')).toBe('value3')
+    })
+
+    it('should handle concurrent gets', async () => {
+      await cache.set('key', 'value')
+
+      const results = await Promise.all([
+        cache.get<string>('key'),
+        cache.get<string>('key'),
+        cache.get<string>('key'),
+      ])
+
+      expect(results).toEqual(['value', 'value', 'value'])
+    })
+
+    it('should handle concurrent getOrFetch', async () => {
+      let fetchCount = 0
+      const fetcher = async () => {
+        fetchCount++
+        return 'value'
+      }
+
+      const results = await Promise.all([
+        cache.getOrFetch('key', fetcher),
+        cache.getOrFetch('key', fetcher),
+        cache.getOrFetch('key', fetcher),
+      ])
+
+      // All should return the value
+      expect(results).toEqual(['value', 'value', 'value'])
+      // But fetcher might be called multiple times due to race conditions
+      expect(fetchCount).toBeGreaterThan(0)
+    })
+  })
+
+  describe('edge cases', () => {
+    it('should handle very long keys', async () => {
+      const longKey = 'k'.repeat(1000)
+      await cache.set(longKey, 'value')
+      expect(await cache.get<string>(longKey)).toBe('value')
+    })
+
+    it('should handle very large values', async () => {
+      const largeValue = { data: 'x'.repeat(10_000) }
+      await cache.set('key', largeValue)
+      const retrieved = await cache.get<{ data: string }>('key')
+      expect(retrieved).toEqual(largeValue)
+    })
+
+    it('should handle unicode keys', async () => {
+      await cache.set('你好', 'hello')
+      await cache.set('🔑', 'key')
+      expect(await cache.get<string>('你好')).toBe('hello')
+      expect(await cache.get<string>('🔑')).toBe('key')
+    })
+
+    it('should handle numeric-like string keys', async () => {
+      await cache.set('123', 'numeric')
+      await cache.set('0', 'zero')
+      expect(await cache.get<string>('123')).toBe('numeric')
+      expect(await cache.get<string>('0')).toBe('zero')
+    })
+  })
+
+  describe('type safety', () => {
+    it('should handle typed get operations', async () => {
+      interface User {
+        name: string
+        age: number
+      }
+
+      await cache.set<User>('user', { name: 'Alice', age: 30 })
+      const user = await cache.get<User>('user')
+      expect(user?.name).toBe('Alice')
+      expect(user?.age).toBe(30)
+    })
+
+    it('should handle typed getOrFetch operations', async () => {
+      interface Data {
+        id: number
+        value: string
+      }
+
+      const data = await cache.getOrFetch<Data>('data', async () => ({
+        id: 1,
+        value: 'test',
+      }))
+
+      expect(data.id).toBe(1)
+      expect(data.value).toBe('test')
+    })
+  })
+})
diff --git a/test/unit/colors.test.ts b/test/unit/colors.test.ts
new file mode 100644
index 0000000..ab87709
--- /dev/null
+++ b/test/unit/colors.test.ts
@@ -0,0 +1,260 @@
+/**
+ * @fileoverview Unit tests for color utilities.
+ *
+ * Tests color conversion and type guard functions:
+ * - isRgbTuple() type guard for RGB vs named colors
+ * - toRgb() conversion from named colors to RGB tuples
+ * - All ColorName mappings to RGB values
+ * - RGB tuple passthrough behavior
+ * Used throughout Socket CLI for consistent color handling in spinners, loggers, and UI.
+ */
+
+import {
+  type ColorName,
+  type ColorRgb,
+  type ColorValue,
+  isRgbTuple,
+  toRgb,
+} from '@socketsecurity/lib/colors'
+import { describe, expect, it } from 'vitest'
+
+describe('colors', () => {
+  describe('isRgbTuple', () => {
+    it('should return true for RGB tuple', () => {
+      const color: ColorValue = [255, 0, 0]
+      expect(isRgbTuple(color)).toBe(true)
+    })
+
+    it('should return false for color name string', () => {
+      const color: ColorValue = 'red'
+      expect(isRgbTuple(color)).toBe(false)
+    })
+
+    it('should work as type guard', () => {
+      const color: ColorValue = [140, 82, 255]
+      if (isRgbTuple(color)) {
+        // TypeScript should narrow type to ColorRgb here
+        const [r, g, b] = color
+        expect(r).toBe(140)
+        expect(g).toBe(82)
+        expect(b).toBe(255)
+      } else {
+        throw new Error('Should have been RGB tuple')
+      }
+    })
+
+    it('should handle zero values in RGB tuple', () => {
+      const color: ColorValue = [0, 0, 0]
+      expect(isRgbTuple(color)).toBe(true)
+    })
+
+    it('should handle max values in RGB tuple', () => {
+      const color: ColorValue = [255, 255, 255]
+      expect(isRgbTuple(color)).toBe(true)
+    })
+  })
+
+  describe('toRgb', () => {
+    describe('RGB tuple passthrough', () => {
+      it('should return RGB tuple as-is', () => {
+        const color: ColorRgb = [140, 82, 255]
+        const result = toRgb(color)
+        expect(result).toBe(color)
+        expect(result).toEqual([140, 82, 255])
+      })
+
+      it('should handle black RGB tuple', () => {
+        const color: ColorRgb = [0, 0, 0]
+        expect(toRgb(color)).toBe(color)
+      })
+
+      it('should handle white RGB tuple', () => {
+        const color: ColorRgb = [255, 255, 255]
+        expect(toRgb(color)).toBe(color)
+      })
+
+      it('should preserve tuple reference', () => {
+        const color: ColorRgb = [100, 150, 200]
+        const result = toRgb(color)
+        expect(result).toBe(color) // Same reference
+      })
+    })
+
+    describe('named color conversion', () => {
+      it('should convert "black" to RGB', () => {
+        expect(toRgb('black')).toEqual([0, 0, 0])
+      })
+
+      it('should convert "blue" to RGB', () => {
+        expect(toRgb('blue')).toEqual([0, 0, 255])
+      })
+
+      it('should convert "blueBright" to RGB', () => {
+        expect(toRgb('blueBright')).toEqual([100, 149, 237])
+      })
+
+      it('should convert "cyan" to RGB', () => {
+        expect(toRgb('cyan')).toEqual([0, 255, 255])
+      })
+
+      it('should convert "cyanBright" to RGB', () => {
+        expect(toRgb('cyanBright')).toEqual([0, 255, 255])
+      })
+
+      it('should convert "gray" to RGB', () => {
+        expect(toRgb('gray')).toEqual([128, 128, 128])
+      })
+
+      it('should convert "green" to RGB', () => {
+        expect(toRgb('green')).toEqual([0, 128, 0])
+      })
+
+      it('should convert "greenBright" to RGB', () => {
+        expect(toRgb('greenBright')).toEqual([0, 255, 0])
+      })
+
+      it('should convert "magenta" to RGB', () => {
+        expect(toRgb('magenta')).toEqual([255, 0, 255])
+      })
+
+      it('should convert "magentaBright" to RGB', () => {
+        expect(toRgb('magentaBright')).toEqual([255, 105, 180])
+      })
+
+      it('should convert "red" to RGB', () => {
+        expect(toRgb('red')).toEqual([255, 0, 0])
+      })
+
+      it('should convert "redBright" to RGB', () => {
+        expect(toRgb('redBright')).toEqual([255, 69, 0])
+      })
+
+      it('should convert "white" to RGB', () => {
+        expect(toRgb('white')).toEqual([255, 255, 255])
+      })
+
+      it('should convert "whiteBright" to RGB', () => {
+        expect(toRgb('whiteBright')).toEqual([255, 255, 255])
+      })
+
+      it('should convert "yellow" to RGB', () => {
+        expect(toRgb('yellow')).toEqual([255, 255, 0])
+      })
+
+      it('should convert "yellowBright" to RGB', () => {
+        expect(toRgb('yellowBright')).toEqual([255, 255, 153])
+      })
+    })
+
+    describe('all ColorName mappings', () => {
+      const colorNames: ColorName[] = [
+        'black',
+        'blue',
+        'blueBright',
+        'cyan',
+        'cyanBright',
+        'gray',
+        'green',
+        'greenBright',
+        'magenta',
+        'magentaBright',
+        'red',
+        'redBright',
+        'white',
+        'whiteBright',
+        'yellow',
+        'yellowBright',
+      ]
+
+      it.each(colorNames)(
+        'should convert "%s" to valid RGB tuple',
+        colorName => {
+          const rgb = toRgb(colorName)
+          expect(Array.isArray(rgb)).toBe(true)
+          expect(rgb).toHaveLength(3)
+
+          // Verify all RGB values are in valid range [0, 255]
+          const [r, g, b] = rgb
+          expect(r).toBeGreaterThanOrEqual(0)
+          expect(r).toBeLessThanOrEqual(255)
+          expect(g).toBeGreaterThanOrEqual(0)
+          expect(g).toBeLessThanOrEqual(255)
+          expect(b).toBeGreaterThanOrEqual(0)
+          expect(b).toBeLessThanOrEqual(255)
+        },
+      )
+
+      it('should return consistent RGB values for same color name', () => {
+        const color: ColorName = 'cyan'
+        const result1 = toRgb(color)
+        const result2 = toRgb(color)
+        expect(result1).toEqual(result2)
+      })
+    })
+
+    describe('type safety', () => {
+      it('should handle ColorValue union type', () => {
+        const namedColor: ColorValue = 'red'
+        const rgbColor: ColorValue = [255, 0, 0]
+
+        expect(toRgb(namedColor)).toEqual([255, 0, 0])
+        expect(toRgb(rgbColor)).toEqual([255, 0, 0])
+      })
+
+      it('should work with readonly RGB tuples', () => {
+        const color: ColorRgb = [100, 150, 200] as const
+        const result = toRgb(color)
+        expect(result).toBe(color)
+      })
+    })
+  })
+
+  describe('color mapping correctness', () => {
+    it('should have distinct RGB values for different color names', () => {
+      const colorNames: ColorName[] = [
+        'black',
+        'blue',
+        'blueBright',
+        'gray',
+        'green',
+        'greenBright',
+        'magenta',
+        'magentaBright',
+        'red',
+        'redBright',
+        'yellow',
+        'yellowBright',
+      ]
+
+      const rgbValues = new Set<string>()
+
+      for (const colorName of colorNames) {
+        const rgb = toRgb(colorName)
+        const key = rgb.join(',')
+
+        // Note: cyan and cyanBright map to same RGB intentionally
+        // white and whiteBright map to same RGB intentionally
+        if (
+          !['cyan', 'cyanBright', 'white', 'whiteBright'].includes(colorName)
+        ) {
+          expect(rgbValues.has(key)).toBe(false)
+        }
+
+        rgbValues.add(key)
+      }
+    })
+
+    it('should have expected RGB values for common colors', () => {
+      // Verify key colors have expected values
+      expect(toRgb('black')).toEqual([0, 0, 0])
+      expect(toRgb('white')).toEqual([255, 255, 255])
+      expect(toRgb('red')).toEqual([255, 0, 0])
+      expect(toRgb('green')).toEqual([0, 128, 0])
+      expect(toRgb('blue')).toEqual([0, 0, 255])
+      expect(toRgb('yellow')).toEqual([255, 255, 0])
+      expect(toRgb('cyan')).toEqual([0, 255, 255])
+      expect(toRgb('magenta')).toEqual([255, 0, 255])
+      expect(toRgb('gray')).toEqual([128, 128, 128])
+    })
+  })
+})
diff --git a/test/unit/constants/agents.test.ts b/test/unit/constants/agents.test.ts
new file mode 100644
index 0000000..172a7fd
--- /dev/null
+++ b/test/unit/constants/agents.test.ts
@@ -0,0 +1,401 @@
+/**
+ * @fileoverview Unit tests for package manager agent constants.
+ *
+ * Tests package manager detection and user agent constants:
+ * - Agent names: npm, pnpm, yarn, bun detection
+ * - USER_AGENT strings for HTTP requests
+ * - Package manager version detection
+ * Frozen constants for identifying package manager context and HTTP client identification.
+ */
+
+import { describe, expect, it } from 'vitest'
+
+import {
+  BUN,
+  BUN_LOCK,
+  BUN_LOCKB,
+  NPM,
+  NPM_BIN_PATH,
+  NPM_REAL_EXEC_PATH,
+  NPM_REGISTRY_URL,
+  NPM_SHRINKWRAP_JSON,
+  NPX,
+  OVERRIDES,
+  PACKAGE_LOCK,
+  PACKAGE_LOCK_JSON,
+  PNPM,
+  PNPM_LOCK,
+  PNPM_LOCK_YAML,
+  PNPM_WORKSPACE_YAML,
+  RESOLUTIONS,
+  VLT,
+  VLT_LOCK_JSON,
+  YARN,
+  YARN_BERRY,
+  YARN_CLASSIC,
+  YARN_LOCK,
+} from '@socketsecurity/lib/constants/agents'
+
+describe('constants/agents', () => {
+  describe('agent names', () => {
+    it('should export NPM constant', () => {
+      expect(NPM).toBe('npm')
+    })
+
+    it('should export PNPM constant', () => {
+      expect(PNPM).toBe('pnpm')
+    })
+
+    it('should export YARN constant', () => {
+      expect(YARN).toBe('yarn')
+    })
+
+    it('should export BUN constant', () => {
+      expect(BUN).toBe('bun')
+    })
+
+    it('should export VLT constant', () => {
+      expect(VLT).toBe('vlt')
+    })
+
+    it('should export NPX constant', () => {
+      expect(NPX).toBe('npx')
+    })
+
+    it('should be strings', () => {
+      expect(typeof NPM).toBe('string')
+      expect(typeof PNPM).toBe('string')
+      expect(typeof YARN).toBe('string')
+      expect(typeof BUN).toBe('string')
+      expect(typeof VLT).toBe('string')
+      expect(typeof NPX).toBe('string')
+    })
+
+    it('should be lowercase', () => {
+      expect(NPM).toBe(NPM.toLowerCase())
+      expect(PNPM).toBe(PNPM.toLowerCase())
+      expect(YARN).toBe(YARN.toLowerCase())
+      expect(BUN).toBe(BUN.toLowerCase())
+      expect(VLT).toBe(VLT.toLowerCase())
+      expect(NPX).toBe(NPX.toLowerCase())
+    })
+
+    it('should have unique values', () => {
+      const agents = [NPM, PNPM, YARN, BUN, VLT, NPX]
+      const uniqueAgents = [...new Set(agents)]
+      expect(uniqueAgents.length).toBe(agents.length)
+    })
+  })
+
+  describe('agent variants', () => {
+    it('should export YARN_BERRY constant', () => {
+      expect(YARN_BERRY).toBe('yarn/berry')
+    })
+
+    it('should export YARN_CLASSIC constant', () => {
+      expect(YARN_CLASSIC).toBe('yarn/classic')
+    })
+
+    it('should contain yarn prefix', () => {
+      expect(YARN_BERRY.startsWith('yarn/')).toBe(true)
+      expect(YARN_CLASSIC.startsWith('yarn/')).toBe(true)
+    })
+
+    it('should be different variants', () => {
+      expect(YARN_BERRY).not.toBe(YARN_CLASSIC)
+    })
+
+    it('should use slash separator', () => {
+      expect(YARN_BERRY).toContain('/')
+      expect(YARN_CLASSIC).toContain('/')
+    })
+  })
+
+  describe('NPM binary paths', () => {
+    it('should export NPM_BIN_PATH', () => {
+      expect(NPM_BIN_PATH).toBeDefined()
+    })
+
+    it('should be a string', () => {
+      expect(typeof NPM_BIN_PATH).toBe('string')
+    })
+
+    it('should contain npm in path', () => {
+      expect(NPM_BIN_PATH.toLowerCase()).toContain('npm')
+    })
+
+    it('should handle NPM_REAL_EXEC_PATH', () => {
+      // May be undefined if npm is not installed
+      if (NPM_REAL_EXEC_PATH !== undefined) {
+        expect(typeof NPM_REAL_EXEC_PATH).toBe('string')
+      } else {
+        expect(NPM_REAL_EXEC_PATH).toBeUndefined()
+      }
+    })
+
+    it('should point to cli.js when NPM_REAL_EXEC_PATH is defined', () => {
+      if (NPM_REAL_EXEC_PATH) {
+        expect(NPM_REAL_EXEC_PATH).toContain('cli.js')
+      }
+    })
+
+    it('should have path structure when NPM_REAL_EXEC_PATH is defined', () => {
+      if (NPM_REAL_EXEC_PATH) {
+        expect(NPM_REAL_EXEC_PATH).toMatch(/node_modules.*npm.*lib.*cli\.js/)
+      }
+    })
+  })
+
+  describe('NPM registry', () => {
+    it('should export NPM_REGISTRY_URL', () => {
+      expect(NPM_REGISTRY_URL).toBe('https://registry.npmjs.org')
+    })
+
+    it('should be a valid HTTPS URL', () => {
+      expect(NPM_REGISTRY_URL).toMatch(/^https:\/\//)
+    })
+
+    it('should point to registry.npmjs.org', () => {
+      expect(NPM_REGISTRY_URL).toContain('registry.npmjs.org')
+    })
+
+    it('should not have trailing slash', () => {
+      expect(NPM_REGISTRY_URL.endsWith('/')).toBe(false)
+    })
+
+    it('should be a valid URL', () => {
+      expect(() => new URL(NPM_REGISTRY_URL)).not.toThrow()
+    })
+  })
+
+  describe('lockfile names', () => {
+    it('should export PACKAGE_LOCK constant', () => {
+      expect(PACKAGE_LOCK).toBe('package-lock')
+    })
+
+    it('should export PACKAGE_LOCK_JSON constant', () => {
+      expect(PACKAGE_LOCK_JSON).toBe('package-lock.json')
+    })
+
+    it('should export NPM_SHRINKWRAP_JSON constant', () => {
+      expect(NPM_SHRINKWRAP_JSON).toBe('npm-shrinkwrap.json')
+    })
+
+    it('should export PNPM_LOCK constant', () => {
+      expect(PNPM_LOCK).toBe('pnpm-lock')
+    })
+
+    it('should export PNPM_LOCK_YAML constant', () => {
+      expect(PNPM_LOCK_YAML).toBe('pnpm-lock.yaml')
+    })
+
+    it('should export YARN_LOCK constant', () => {
+      expect(YARN_LOCK).toBe('yarn.lock')
+    })
+
+    it('should export BUN_LOCK constant', () => {
+      expect(BUN_LOCK).toBe('bun.lock')
+    })
+
+    it('should export BUN_LOCKB constant', () => {
+      expect(BUN_LOCKB).toBe('bun.lockb')
+    })
+
+    it('should export VLT_LOCK_JSON constant', () => {
+      expect(VLT_LOCK_JSON).toBe('vlt-lock.json')
+    })
+
+    it('should use correct file extensions', () => {
+      expect(PACKAGE_LOCK_JSON.endsWith('.json')).toBe(true)
+      expect(NPM_SHRINKWRAP_JSON.endsWith('.json')).toBe(true)
+      expect(PNPM_LOCK_YAML.endsWith('.yaml')).toBe(true)
+      expect(YARN_LOCK.endsWith('.lock')).toBe(true)
+      expect(BUN_LOCK.endsWith('.lock')).toBe(true)
+      expect(BUN_LOCKB.endsWith('.lockb')).toBe(true)
+      expect(VLT_LOCK_JSON.endsWith('.json')).toBe(true)
+    })
+
+    it('should have unique lockfile names', () => {
+      const lockfiles = [
+        PACKAGE_LOCK_JSON,
+        NPM_SHRINKWRAP_JSON,
+        PNPM_LOCK_YAML,
+        YARN_LOCK,
+        BUN_LOCK,
+        BUN_LOCKB,
+        VLT_LOCK_JSON,
+      ]
+      const uniqueLockfiles = [...new Set(lockfiles)]
+      expect(uniqueLockfiles.length).toBe(lockfiles.length)
+    })
+
+    it('should use kebab-case for lock names', () => {
+      expect(PACKAGE_LOCK).toMatch(/^[a-z-]+$/)
+      expect(PNPM_LOCK).toMatch(/^[a-z-]+$/)
+    })
+  })
+
+  describe('workspace configuration', () => {
+    it('should export PNPM_WORKSPACE_YAML', () => {
+      expect(PNPM_WORKSPACE_YAML).toBe('pnpm-workspace.yaml')
+    })
+
+    it('should be a YAML file', () => {
+      expect(PNPM_WORKSPACE_YAML.endsWith('.yaml')).toBe(true)
+    })
+
+    it('should contain workspace in name', () => {
+      expect(PNPM_WORKSPACE_YAML).toContain('workspace')
+    })
+  })
+
+  describe('package.json override fields', () => {
+    it('should export OVERRIDES constant', () => {
+      expect(OVERRIDES).toBe('overrides')
+    })
+
+    it('should export RESOLUTIONS constant', () => {
+      expect(RESOLUTIONS).toBe('resolutions')
+    })
+
+    it('should be lowercase', () => {
+      expect(OVERRIDES).toBe(OVERRIDES.toLowerCase())
+      expect(RESOLUTIONS).toBe(RESOLUTIONS.toLowerCase())
+    })
+
+    it('should be different field names', () => {
+      expect(OVERRIDES).not.toBe(RESOLUTIONS)
+    })
+  })
+
+  describe('constant relationships', () => {
+    it('should have matching PACKAGE_LOCK and PACKAGE_LOCK_JSON', () => {
+      expect(PACKAGE_LOCK_JSON).toContain(PACKAGE_LOCK)
+    })
+
+    it('should have matching PNPM_LOCK and PNPM_LOCK_YAML', () => {
+      expect(PNPM_LOCK_YAML).toContain(PNPM_LOCK)
+    })
+
+    it('should have matching BUN_LOCK and BUN_LOCKB', () => {
+      expect(BUN_LOCKB).toContain('bun')
+      expect(BUN_LOCK).toContain('bun')
+    })
+
+    it('should have YARN_BERRY and YARN_CLASSIC share YARN prefix', () => {
+      expect(YARN_BERRY.split('/')[0]).toBe(YARN)
+      expect(YARN_CLASSIC.split('/')[0]).toBe(YARN)
+    })
+  })
+
+  describe('package manager detection patterns', () => {
+    it('should support npm detection via NPM_BIN_PATH', () => {
+      expect(NPM_BIN_PATH).toBeTruthy()
+    })
+
+    it('should support lockfile-based detection', () => {
+      const lockfiles = {
+        [PACKAGE_LOCK_JSON]: NPM,
+        [NPM_SHRINKWRAP_JSON]: NPM,
+        [PNPM_LOCK_YAML]: PNPM,
+        [YARN_LOCK]: YARN,
+        [BUN_LOCK]: BUN,
+        [BUN_LOCKB]: BUN,
+        [VLT_LOCK_JSON]: VLT,
+      }
+
+      Object.entries(lockfiles).forEach(([lockfile, agent]) => {
+        expect(typeof lockfile).toBe('string')
+        expect(typeof agent).toBe('string')
+      })
+    })
+  })
+
+  describe('file name patterns', () => {
+    it('should use hyphens for npm lockfiles', () => {
+      expect(PACKAGE_LOCK_JSON).toContain('-')
+      expect(NPM_SHRINKWRAP_JSON).toContain('-')
+    })
+
+    it('should use hyphens for pnpm files', () => {
+      expect(PNPM_LOCK_YAML).toContain('-')
+      expect(PNPM_WORKSPACE_YAML).toContain('-')
+    })
+
+    it('should use dots for extensions', () => {
+      expect(YARN_LOCK.split('.').length).toBe(2)
+      expect(BUN_LOCK.split('.').length).toBe(2)
+      expect(BUN_LOCKB.split('.').length).toBe(2)
+    })
+  })
+
+  describe('registry configuration', () => {
+    it('should have HTTPS registry URL', () => {
+      expect(NPM_REGISTRY_URL.startsWith('https://')).toBe(true)
+    })
+
+    it('should use official npm registry', () => {
+      expect(NPM_REGISTRY_URL).toBe('https://registry.npmjs.org')
+    })
+  })
+
+  describe('override field compatibility', () => {
+    it('should support npm overrides field', () => {
+      expect(OVERRIDES).toBe('overrides')
+    })
+
+    it('should support yarn resolutions field', () => {
+      expect(RESOLUTIONS).toBe('resolutions')
+    })
+
+    it('should be valid package.json field names', () => {
+      expect(OVERRIDES).toMatch(/^[a-z]+$/)
+      expect(RESOLUTIONS).toMatch(/^[a-z]+$/)
+    })
+  })
+
+  describe('constant immutability', () => {
+    it('should not allow reassignment of agent constants', () => {
+      expect(() => {
+        // @ts-expect-error - testing immutability
+        NPM = 'something else'
+      }).toThrow()
+    })
+
+    it('should not allow reassignment of lockfile constants', () => {
+      expect(() => {
+        // @ts-expect-error - testing immutability
+        PACKAGE_LOCK_JSON = 'something.json'
+      }).toThrow()
+    })
+
+    it('should not allow reassignment of URL constants', () => {
+      expect(() => {
+        // @ts-expect-error - testing immutability
+        NPM_REGISTRY_URL = 'https://other-registry.com'
+      }).toThrow()
+    })
+  })
+
+  describe('real-world usage', () => {
+    it('should support lockfile matching', () => {
+      const filename = 'package-lock.json'
+      expect(filename).toBe(PACKAGE_LOCK_JSON)
+    })
+
+    it('should support agent type checking', () => {
+      const agent = 'npm'
+      expect(agent).toBe(NPM)
+    })
+
+    it('should support registry URL construction', () => {
+      const packageUrl = `${NPM_REGISTRY_URL}/package-name`
+      expect(packageUrl).toMatch(/^https:\/\/registry\.npmjs\.org\//)
+    })
+
+    it('should support yarn variant detection', () => {
+      expect(YARN_BERRY).toContain(YARN)
+      expect(YARN_CLASSIC).toContain(YARN)
+    })
+  })
+})
diff --git a/test/unit/constants/core.test.ts b/test/unit/constants/core.test.ts
new file mode 100644
index 0000000..d7a7395
--- /dev/null
+++ b/test/unit/constants/core.test.ts
@@ -0,0 +1,206 @@
+/**
+ * @fileoverview Unit tests for core primitives and fundamental constants.
+ *
+ * Tests fundamental constants and symbols:
+ * - Symbols: kInternalsSymbol for internal state access
+ * - Sentinel values: EMPTY_VALUE, UNKNOWN_VALUE, UNDEFINED_TOKEN, LOOP_SENTINEL
+ * - Limits: COLUMN_LIMIT for terminal formatting
+ * - Tokens: NODE_AUTH_TOKEN, NODE_ENV keys, UNKNOWN_ERROR
+ * - Version markers: V (void 0)
+ * All frozen to prevent modification. Foundation for type-safe constant usage.
+ */
+
+import { describe, expect, it } from 'vitest'
+
+import {
+  COLUMN_LIMIT,
+  EMPTY_FILE,
+  EMPTY_VALUE,
+  kInternalsSymbol,
+  LOOP_SENTINEL,
+  NODE_AUTH_TOKEN,
+  NODE_ENV,
+  UNDEFINED_TOKEN,
+  UNKNOWN_ERROR,
+  UNKNOWN_VALUE,
+  V,
+} from '@socketsecurity/lib/constants/core'
+
+describe('constants/core', () => {
+  describe('symbols', () => {
+    it('should export kInternalsSymbol as a symbol', () => {
+      expect(typeof kInternalsSymbol).toBe('symbol')
+    })
+
+    it('should have correct description for kInternalsSymbol', () => {
+      expect(kInternalsSymbol.toString()).toBe(
+        'Symbol(@socketregistry.constants.internals)',
+      )
+    })
+
+    it('should be unique symbol instance', () => {
+      const anotherSymbol = Symbol('@socketregistry.constants.internals')
+      expect(kInternalsSymbol).not.toBe(anotherSymbol)
+    })
+  })
+
+  describe('sentinel values', () => {
+    it('should export LOOP_SENTINEL as 1000000', () => {
+      expect(LOOP_SENTINEL).toBe(1_000_000)
+    })
+
+    it('should be a number', () => {
+      expect(typeof LOOP_SENTINEL).toBe('number')
+    })
+
+    it('should be positive integer', () => {
+      expect(LOOP_SENTINEL).toBeGreaterThan(0)
+      expect(Number.isInteger(LOOP_SENTINEL)).toBe(true)
+    })
+  })
+
+  describe('error and unknown values', () => {
+    it('should export UNKNOWN_ERROR constant', () => {
+      expect(UNKNOWN_ERROR).toBe('Unknown error')
+    })
+
+    it('should export UNKNOWN_VALUE constant', () => {
+      expect(UNKNOWN_VALUE).toBe('<unknown>')
+    })
+
+    it('should be strings', () => {
+      expect(typeof UNKNOWN_ERROR).toBe('string')
+      expect(typeof UNKNOWN_VALUE).toBe('string')
+    })
+  })
+
+  describe('empty values', () => {
+    it('should export EMPTY_FILE constant', () => {
+      expect(EMPTY_FILE).toBe('/* empty */\n')
+    })
+
+    it('should export EMPTY_VALUE constant', () => {
+      expect(EMPTY_VALUE).toBe('<value>')
+    })
+
+    it('should be strings', () => {
+      expect(typeof EMPTY_FILE).toBe('string')
+      expect(typeof EMPTY_VALUE).toBe('string')
+    })
+
+    it('should have newline in EMPTY_FILE', () => {
+      expect(EMPTY_FILE).toContain('\n')
+      expect(EMPTY_FILE.endsWith('\n')).toBe(true)
+    })
+
+    it('should be valid JavaScript comment', () => {
+      expect(EMPTY_FILE).toMatch(/^\/\*.*\*\//)
+    })
+  })
+
+  describe('undefined token', () => {
+    it('should export UNDEFINED_TOKEN as undefined', () => {
+      expect(UNDEFINED_TOKEN).toBeUndefined()
+    })
+
+    it('should strictly equal undefined', () => {
+      expect(UNDEFINED_TOKEN === undefined).toBe(true)
+    })
+
+    it('should have type undefined', () => {
+      expect(typeof UNDEFINED_TOKEN).toBe('undefined')
+    })
+  })
+
+  describe('miscellaneous constants', () => {
+    it('should export V constant', () => {
+      expect(V).toBe('v')
+    })
+
+    it('should export COLUMN_LIMIT constant', () => {
+      expect(COLUMN_LIMIT).toBe(80)
+    })
+
+    it('should be correct types', () => {
+      expect(typeof V).toBe('string')
+      expect(typeof COLUMN_LIMIT).toBe('number')
+    })
+
+    it('should have reasonable COLUMN_LIMIT value', () => {
+      expect(COLUMN_LIMIT).toBeGreaterThan(0)
+      expect(COLUMN_LIMIT).toBeLessThanOrEqual(200)
+    })
+  })
+
+  describe('environment variable name constants', () => {
+    it('should export NODE_AUTH_TOKEN constant', () => {
+      expect(NODE_AUTH_TOKEN).toBe('NODE_AUTH_TOKEN')
+    })
+
+    it('should export NODE_ENV constant', () => {
+      expect(NODE_ENV).toBe('NODE_ENV')
+    })
+
+    it('should be strings', () => {
+      expect(typeof NODE_AUTH_TOKEN).toBe('string')
+      expect(typeof NODE_ENV).toBe('string')
+    })
+
+    it('should be uppercase with underscores', () => {
+      expect(NODE_AUTH_TOKEN).toMatch(/^[A-Z_]+$/)
+      expect(NODE_ENV).toMatch(/^[A-Z_]+$/)
+    })
+  })
+
+  describe('constant immutability', () => {
+    it('should not allow reassignment of LOOP_SENTINEL', () => {
+      expect(() => {
+        // @ts-expect-error - testing immutability
+        LOOP_SENTINEL = 999
+      }).toThrow()
+    })
+
+    it('should not allow reassignment of string constants', () => {
+      expect(() => {
+        // @ts-expect-error - testing immutability
+        UNKNOWN_ERROR = 'Different error'
+      }).toThrow()
+    })
+  })
+
+  describe('constant usage patterns', () => {
+    it('should use EMPTY_FILE for empty source files', () => {
+      const emptyFileContent = EMPTY_FILE
+      expect(emptyFileContent).toMatch(/\/\*.*\*\//)
+    })
+
+    it('should use UNKNOWN_VALUE for placeholder text', () => {
+      const placeholder = UNKNOWN_VALUE
+      expect(placeholder).toMatch(/^<.*>$/)
+    })
+
+    it('should use LOOP_SENTINEL for iteration limits', () => {
+      const maxIterations = LOOP_SENTINEL
+      expect(maxIterations).toBeGreaterThan(1000)
+    })
+
+    it('should use V as version prefix', () => {
+      const version = `${V}1.0.0`
+      expect(version).toBe('v1.0.0')
+    })
+  })
+
+  describe('constant value formats', () => {
+    it('should have angle brackets for placeholder values', () => {
+      expect(UNKNOWN_VALUE.startsWith('<')).toBe(true)
+      expect(UNKNOWN_VALUE.endsWith('>')).toBe(true)
+      expect(EMPTY_VALUE.startsWith('<')).toBe(true)
+      expect(EMPTY_VALUE.endsWith('>')).toBe(true)
+    })
+
+    it('should have consistent naming pattern for env vars', () => {
+      expect(NODE_AUTH_TOKEN.startsWith('NODE_')).toBe(true)
+      expect(NODE_ENV.startsWith('NODE_')).toBe(true)
+    })
+  })
+})
diff --git a/test/unit/constants/encoding.test.ts b/test/unit/constants/encoding.test.ts
new file mode 100644
index 0000000..f148917
--- /dev/null
+++ b/test/unit/constants/encoding.test.ts
@@ -0,0 +1,224 @@
+/**
+ * @fileoverview Unit tests for encoding and character code constants.
+ *
+ * Tests character encoding and code point constants:
+ * - DEFAULT_ENCODING ("utf8" for Node.js)
+ * - Character codes: BOM (U+FEFF), null bytes, line endings
+ * - Buffer encoding validation
+ * Frozen constants for consistent text encoding across Socket tools.
+ */
+
+import { describe, expect, it } from 'vitest'
+
+import {
+  CHAR_BACKWARD_SLASH,
+  CHAR_COLON,
+  CHAR_FORWARD_SLASH,
+  CHAR_LOWERCASE_A,
+  CHAR_LOWERCASE_Z,
+  CHAR_UPPERCASE_A,
+  CHAR_UPPERCASE_Z,
+  UTF8,
+} from '@socketsecurity/lib/constants/encoding'
+
+describe('constants/encoding', () => {
+  describe('encoding', () => {
+    it('should export UTF8', () => {
+      expect(UTF8).toBe('utf8')
+    })
+
+    it('should be a string', () => {
+      expect(typeof UTF8).toBe('string')
+    })
+
+    it('should be lowercase', () => {
+      expect(UTF8).toBe(UTF8.toLowerCase())
+    })
+  })
+
+  describe('character codes', () => {
+    it('should export CHAR_BACKWARD_SLASH', () => {
+      expect(CHAR_BACKWARD_SLASH).toBe(92)
+    })
+
+    it('should export CHAR_COLON', () => {
+      expect(CHAR_COLON).toBe(58)
+    })
+
+    it('should export CHAR_FORWARD_SLASH', () => {
+      expect(CHAR_FORWARD_SLASH).toBe(47)
+    })
+
+    it('should export CHAR_LOWERCASE_A', () => {
+      expect(CHAR_LOWERCASE_A).toBe(97)
+    })
+
+    it('should export CHAR_LOWERCASE_Z', () => {
+      expect(CHAR_LOWERCASE_Z).toBe(122)
+    })
+
+    it('should export CHAR_UPPERCASE_A', () => {
+      expect(CHAR_UPPERCASE_A).toBe(65)
+    })
+
+    it('should export CHAR_UPPERCASE_Z', () => {
+      expect(CHAR_UPPERCASE_Z).toBe(90)
+    })
+
+    it('should all be numbers', () => {
+      expect(typeof CHAR_BACKWARD_SLASH).toBe('number')
+      expect(typeof CHAR_COLON).toBe('number')
+      expect(typeof CHAR_FORWARD_SLASH).toBe('number')
+      expect(typeof CHAR_LOWERCASE_A).toBe('number')
+      expect(typeof CHAR_LOWERCASE_Z).toBe('number')
+      expect(typeof CHAR_UPPERCASE_A).toBe('number')
+      expect(typeof CHAR_UPPERCASE_Z).toBe('number')
+    })
+
+    it('should all be positive integers', () => {
+      expect(CHAR_BACKWARD_SLASH).toBeGreaterThan(0)
+      expect(CHAR_COLON).toBeGreaterThan(0)
+      expect(CHAR_FORWARD_SLASH).toBeGreaterThan(0)
+      expect(CHAR_LOWERCASE_A).toBeGreaterThan(0)
+      expect(CHAR_LOWERCASE_Z).toBeGreaterThan(0)
+      expect(CHAR_UPPERCASE_A).toBeGreaterThan(0)
+      expect(CHAR_UPPERCASE_Z).toBeGreaterThan(0)
+    })
+
+    it('should match character codes', () => {
+      expect('\\'.charCodeAt(0)).toBe(CHAR_BACKWARD_SLASH)
+      expect(':'.charCodeAt(0)).toBe(CHAR_COLON)
+      expect('/'.charCodeAt(0)).toBe(CHAR_FORWARD_SLASH)
+      expect('a'.charCodeAt(0)).toBe(CHAR_LOWERCASE_A)
+      expect('z'.charCodeAt(0)).toBe(CHAR_LOWERCASE_Z)
+      expect('A'.charCodeAt(0)).toBe(CHAR_UPPERCASE_A)
+      expect('Z'.charCodeAt(0)).toBe(CHAR_UPPERCASE_Z)
+    })
+
+    it('should have lowercase before uppercase in ASCII', () => {
+      expect(CHAR_UPPERCASE_A).toBeLessThan(CHAR_LOWERCASE_A)
+      expect(CHAR_UPPERCASE_Z).toBeLessThan(CHAR_LOWERCASE_Z)
+    })
+
+    it('should have A before Z in each case', () => {
+      expect(CHAR_UPPERCASE_A).toBeLessThan(CHAR_UPPERCASE_Z)
+      expect(CHAR_LOWERCASE_A).toBeLessThan(CHAR_LOWERCASE_Z)
+    })
+
+    it('should have forward slash before colon before backward slash', () => {
+      expect(CHAR_FORWARD_SLASH).toBeLessThan(CHAR_COLON)
+      expect(CHAR_COLON).toBeLessThan(CHAR_BACKWARD_SLASH)
+    })
+  })
+
+  describe('character ranges', () => {
+    it('should define complete uppercase range', () => {
+      const rangeSize = CHAR_UPPERCASE_Z - CHAR_UPPERCASE_A + 1
+      expect(rangeSize).toBe(26)
+    })
+
+    it('should define complete lowercase range', () => {
+      const rangeSize = CHAR_LOWERCASE_Z - CHAR_LOWERCASE_A + 1
+      expect(rangeSize).toBe(26)
+    })
+
+    it('should cover all uppercase letters', () => {
+      for (let code = CHAR_UPPERCASE_A; code <= CHAR_UPPERCASE_Z; code++) {
+        const char = String.fromCharCode(code)
+        expect(char).toMatch(/[A-Z]/)
+      }
+    })
+
+    it('should cover all lowercase letters', () => {
+      for (let code = CHAR_LOWERCASE_A; code <= CHAR_LOWERCASE_Z; code++) {
+        const char = String.fromCharCode(code)
+        expect(char).toMatch(/[a-z]/)
+      }
+    })
+  })
+
+  describe('real-world usage', () => {
+    it('should support case-insensitive comparisons', () => {
+      const aCode = 'A'.charCodeAt(0)
+      const isUppercase = aCode >= CHAR_UPPERCASE_A && aCode <= CHAR_UPPERCASE_Z
+      expect(isUppercase).toBe(true)
+    })
+
+    it('should support lowercase detection', () => {
+      const zCode = 'z'.charCodeAt(0)
+      const isLowercase = zCode >= CHAR_LOWERCASE_A && zCode <= CHAR_LOWERCASE_Z
+      expect(isLowercase).toBe(true)
+    })
+
+    it('should support path character detection', () => {
+      const pathStr = '/usr/local/bin'
+      expect(pathStr.charCodeAt(0)).toBe(CHAR_FORWARD_SLASH)
+    })
+
+    it('should support Windows path detection', () => {
+      const winPath = 'C:\\Windows\\System32'
+      expect(winPath.charCodeAt(2)).toBe(CHAR_BACKWARD_SLASH)
+      expect(winPath.charCodeAt(1)).toBe(CHAR_COLON)
+    })
+
+    it('should support encoding specification', () => {
+      const buffer = Buffer.from('test', UTF8)
+      expect(buffer.toString(UTF8)).toBe('test')
+    })
+
+    it('should support case conversion logic', () => {
+      const offset = CHAR_LOWERCASE_A - CHAR_UPPERCASE_A
+      const aUpper = 'A'.charCodeAt(0)
+      const aLower = aUpper + offset
+      expect(aLower).toBe(CHAR_LOWERCASE_A)
+    })
+
+    it('should detect drive letters', () => {
+      const cCode = 'C'.charCodeAt(0)
+      const isDriveLetter =
+        cCode >= CHAR_UPPERCASE_A && cCode <= CHAR_UPPERCASE_Z
+      expect(isDriveLetter).toBe(true)
+    })
+
+    it('should detect URL protocols', () => {
+      const url = 'http://example.com'
+      const colonIndex = url.indexOf(':')
+      expect(url.charCodeAt(colonIndex)).toBe(CHAR_COLON)
+      expect(url.charCodeAt(colonIndex + 1)).toBe(CHAR_FORWARD_SLASH)
+      expect(url.charCodeAt(colonIndex + 2)).toBe(CHAR_FORWARD_SLASH)
+    })
+  })
+
+  describe('edge cases', () => {
+    it('should handle character before A', () => {
+      const atSignCode = '@'.charCodeAt(0)
+      expect(atSignCode).toBe(CHAR_UPPERCASE_A - 1)
+    })
+
+    it('should handle character after Z', () => {
+      const bracketCode = '['.charCodeAt(0)
+      expect(bracketCode).toBe(CHAR_UPPERCASE_Z + 1)
+    })
+
+    it('should handle character before a', () => {
+      const backtickCode = '`'.charCodeAt(0)
+      expect(backtickCode).toBe(CHAR_LOWERCASE_A - 1)
+    })
+
+    it('should handle character after z', () => {
+      const braceCode = '{'.charCodeAt(0)
+      expect(braceCode).toBe(CHAR_LOWERCASE_Z + 1)
+    })
+
+    it('should validate slash types are different', () => {
+      expect(CHAR_FORWARD_SLASH).not.toBe(CHAR_BACKWARD_SLASH)
+      expect('/').not.toBe('\\')
+    })
+
+    it('should validate colon position in ASCII table', () => {
+      // Colon is after digits (48-57) and before uppercase letters (65-90)
+      expect(CHAR_COLON).toBeGreaterThan(57)
+      expect(CHAR_COLON).toBeLessThan(CHAR_UPPERCASE_A)
+    })
+  })
+})
diff --git a/test/unit/constants/github.test.ts b/test/unit/constants/github.test.ts
new file mode 100644
index 0000000..27402d1
--- /dev/null
+++ b/test/unit/constants/github.test.ts
@@ -0,0 +1,196 @@
+/**
+ * @fileoverview Unit tests for GitHub API and cache configuration constants.
+ *
+ * Tests GitHub integration constants:
+ * - API URLs: GITHUB_API_BASE_URL, GITHUB_BASE_URL
+ * - Cache configuration: TTL, paths, headers
+ * - Default refs and branch names
+ * Frozen constants for GitHub API access and response caching.
+ */
+
+import { describe, expect, it } from 'vitest'
+
+import {
+  CACHE_GITHUB_DIR,
+  GITHUB_API_BASE_URL,
+} from '@socketsecurity/lib/constants/github'
+
+describe('constants/github', () => {
+  describe('GITHUB_API_BASE_URL', () => {
+    it('should export GitHub API base URL', () => {
+      expect(GITHUB_API_BASE_URL).toBe('https://api.github.com')
+    })
+
+    it('should be a valid HTTPS URL', () => {
+      expect(GITHUB_API_BASE_URL).toMatch(/^https:\/\//)
+    })
+
+    it('should point to api.github.com', () => {
+      expect(GITHUB_API_BASE_URL).toContain('api.github.com')
+    })
+
+    it('should not have trailing slash', () => {
+      expect(GITHUB_API_BASE_URL.endsWith('/')).toBe(false)
+    })
+
+    it('should be a valid URL', () => {
+      expect(() => new URL(GITHUB_API_BASE_URL)).not.toThrow()
+    })
+
+    it('should use HTTPS protocol', () => {
+      const url = new URL(GITHUB_API_BASE_URL)
+      expect(url.protocol).toBe('https:')
+    })
+
+    it('should have correct hostname', () => {
+      const url = new URL(GITHUB_API_BASE_URL)
+      expect(url.hostname).toBe('api.github.com')
+    })
+
+    it('should not have path', () => {
+      const url = new URL(GITHUB_API_BASE_URL)
+      expect(url.pathname).toBe('/')
+    })
+
+    it('should be usable for API endpoint construction', () => {
+      const endpoint = `${GITHUB_API_BASE_URL}/repos/owner/repo`
+      expect(endpoint).toBe('https://api.github.com/repos/owner/repo')
+    })
+
+    it('should support path joining', () => {
+      const usersEndpoint = `${GITHUB_API_BASE_URL}/users/username`
+      expect(usersEndpoint).toContain('/users/username')
+    })
+  })
+
+  describe('CACHE_GITHUB_DIR', () => {
+    it('should export GitHub cache directory name', () => {
+      expect(CACHE_GITHUB_DIR).toBe('github')
+    })
+
+    it('should be a string', () => {
+      expect(typeof CACHE_GITHUB_DIR).toBe('string')
+    })
+
+    it('should be lowercase', () => {
+      expect(CACHE_GITHUB_DIR).toBe(CACHE_GITHUB_DIR.toLowerCase())
+    })
+
+    it('should not contain path separators', () => {
+      expect(CACHE_GITHUB_DIR).not.toContain('/')
+      expect(CACHE_GITHUB_DIR).not.toContain('\\')
+    })
+
+    it('should not be empty', () => {
+      expect(CACHE_GITHUB_DIR.length).toBeGreaterThan(0)
+    })
+
+    it('should be a valid directory name', () => {
+      // Should not contain invalid filename characters
+      expect(CACHE_GITHUB_DIR).toMatch(/^[a-z0-9-_]+$/)
+    })
+
+    it('should be usable in path construction', () => {
+      const cachePath = `/tmp/${CACHE_GITHUB_DIR}/data`
+      expect(cachePath).toBe('/tmp/github/data')
+    })
+  })
+
+  describe('constant relationships', () => {
+    it('should have GitHub in both constants conceptually', () => {
+      expect(GITHUB_API_BASE_URL.toLowerCase()).toContain('github')
+      expect(CACHE_GITHUB_DIR.toLowerCase()).toContain('github')
+    })
+
+    it('should be independently configurable', () => {
+      // Base URL is full URL, cache dir is just directory name
+      expect(GITHUB_API_BASE_URL).toContain('https://')
+      expect(CACHE_GITHUB_DIR).not.toContain('https://')
+    })
+  })
+
+  describe('API usage patterns', () => {
+    it('should support repos API endpoint', () => {
+      const reposUrl = `${GITHUB_API_BASE_URL}/repos/socketdev/socket`
+      expect(reposUrl).toBe('https://api.github.com/repos/socketdev/socket')
+    })
+
+    it('should support users API endpoint', () => {
+      const usersUrl = `${GITHUB_API_BASE_URL}/users/socketdev`
+      expect(usersUrl).toBe('https://api.github.com/users/socketdev')
+    })
+
+    it('should support search API endpoint', () => {
+      const searchUrl = `${GITHUB_API_BASE_URL}/search/repositories`
+      expect(searchUrl).toBe('https://api.github.com/search/repositories')
+    })
+
+    it('should support gists API endpoint', () => {
+      const gistsUrl = `${GITHUB_API_BASE_URL}/gists`
+      expect(gistsUrl).toBe('https://api.github.com/gists')
+    })
+  })
+
+  describe('cache directory patterns', () => {
+    it('should work with Unix-style paths', () => {
+      const unixPath = `/var/cache/${CACHE_GITHUB_DIR}`
+      expect(unixPath).toBe('/var/cache/github')
+    })
+
+    it('should work with Windows-style paths', () => {
+      const windowsPath = `C:\\cache\\${CACHE_GITHUB_DIR}`
+      expect(windowsPath).toBe('C:\\cache\\github')
+    })
+
+    it('should work with relative paths', () => {
+      const relativePath = `./${CACHE_GITHUB_DIR}/data`
+      expect(relativePath).toBe('./github/data')
+    })
+  })
+
+  describe('constant immutability', () => {
+    it('should not allow reassignment of GITHUB_API_BASE_URL', () => {
+      expect(() => {
+        // @ts-expect-error - testing immutability
+        GITHUB_API_BASE_URL = 'https://other-api.com'
+      }).toThrow()
+    })
+
+    it('should not allow reassignment of CACHE_GITHUB_DIR', () => {
+      expect(() => {
+        // @ts-expect-error - testing immutability
+        CACHE_GITHUB_DIR = 'other-dir'
+      }).toThrow()
+    })
+  })
+
+  describe('real-world usage', () => {
+    it('should construct package repository URL', () => {
+      const owner = 'socketdev'
+      const repo = 'socket-cli'
+      const url = `${GITHUB_API_BASE_URL}/repos/${owner}/${repo}`
+      expect(url).toBe('https://api.github.com/repos/socketdev/socket-cli')
+    })
+
+    it('should construct release API URL', () => {
+      const owner = 'socketdev'
+      const repo = 'socket'
+      const url = `${GITHUB_API_BASE_URL}/repos/${owner}/${repo}/releases/latest`
+      expect(url).toBe(
+        'https://api.github.com/repos/socketdev/socket/releases/latest',
+      )
+    })
+
+    it('should construct cache file path', () => {
+      const cacheRoot = '/tmp/cache'
+      const fileName = 'repo-data.json'
+      const fullPath = `${cacheRoot}/${CACHE_GITHUB_DIR}/${fileName}`
+      expect(fullPath).toBe('/tmp/cache/github/repo-data.json')
+    })
+
+    it('should handle query parameters in API URLs', () => {
+      const url = `${GITHUB_API_BASE_URL}/search/repositories?q=socket&sort=stars`
+      expect(url).toContain('?q=socket&sort=stars')
+    })
+  })
+})
diff --git a/test/unit/constants/licenses.test.ts b/test/unit/constants/licenses.test.ts
new file mode 100644
index 0000000..336a9c1
--- /dev/null
+++ b/test/unit/constants/licenses.test.ts
@@ -0,0 +1,251 @@
+/**
+ * @fileoverview Unit tests for license identifier constants and copy-left license detection.
+ *
+ * Tests SPDX license constants:
+ * - COPYLEFT_LICENSES set (GPL, LGPL, AGPL, MPL, etc.)
+ * - PERMISSIVE_LICENSES set (MIT, Apache-2.0, BSD, ISC)
+ * - License compatibility rules
+ * Frozen constants for license validation and risk assessment.
+ */
+
+import { describe, expect, it } from 'vitest'
+
+import {
+  getCopyLeftLicenses,
+  MIT,
+  UNLICENCED,
+  UNLICENSED,
+} from '@socketsecurity/lib/constants/licenses'
+
+describe('constants/licenses', () => {
+  describe('license identifier constants', () => {
+    it('should export MIT constant', () => {
+      expect(MIT).toBe('MIT')
+    })
+
+    it('should export UNLICENCED constant', () => {
+      expect(UNLICENCED).toBe('UNLICENCED')
+    })
+
+    it('should export UNLICENSED constant', () => {
+      expect(UNLICENSED).toBe('UNLICENSED')
+    })
+
+    it('should be uppercase strings', () => {
+      expect(MIT).toBe(MIT.toUpperCase())
+      expect(UNLICENCED).toBe(UNLICENCED.toUpperCase())
+      expect(UNLICENSED).toBe(UNLICENSED.toUpperCase())
+    })
+
+    it('should have different spellings for unlicensed', () => {
+      expect(UNLICENCED).not.toBe(UNLICENSED)
+      // British vs American spelling
+      expect(UNLICENCED).toContain('UNLICENC')
+      expect(UNLICENSED).toContain('UNLICENS')
+    })
+  })
+
+  describe('getCopyLeftLicenses', () => {
+    it('should return a Set', () => {
+      const licenses = getCopyLeftLicenses()
+      expect(licenses).toBeInstanceOf(Set)
+    })
+
+    it('should contain AGPL licenses', () => {
+      const licenses = getCopyLeftLicenses()
+      expect(licenses.has('AGPL-1.0')).toBe(true)
+      expect(licenses.has('AGPL-1.0-only')).toBe(true)
+      expect(licenses.has('AGPL-1.0-or-later')).toBe(true)
+      expect(licenses.has('AGPL-3.0')).toBe(true)
+      expect(licenses.has('AGPL-3.0-only')).toBe(true)
+      expect(licenses.has('AGPL-3.0-or-later')).toBe(true)
+    })
+
+    it('should contain GPL licenses', () => {
+      const licenses = getCopyLeftLicenses()
+      expect(licenses.has('GPL-1.0')).toBe(true)
+      expect(licenses.has('GPL-1.0-only')).toBe(true)
+      expect(licenses.has('GPL-1.0-or-later')).toBe(true)
+      expect(licenses.has('GPL-2.0')).toBe(true)
+      expect(licenses.has('GPL-2.0-only')).toBe(true)
+      expect(licenses.has('GPL-2.0-or-later')).toBe(true)
+      expect(licenses.has('GPL-3.0')).toBe(true)
+      expect(licenses.has('GPL-3.0-only')).toBe(true)
+      expect(licenses.has('GPL-3.0-or-later')).toBe(true)
+    })
+
+    it('should contain Creative Commons ShareAlike licenses', () => {
+      const licenses = getCopyLeftLicenses()
+      expect(licenses.has('CC-BY-SA-1.0')).toBe(true)
+      expect(licenses.has('CC-BY-SA-2.0')).toBe(true)
+      expect(licenses.has('CC-BY-SA-3.0')).toBe(true)
+      expect(licenses.has('CC-BY-SA-4.0')).toBe(true)
+    })
+
+    it('should contain EPL licenses', () => {
+      const licenses = getCopyLeftLicenses()
+      expect(licenses.has('EPL-1.0')).toBe(true)
+      expect(licenses.has('EPL-2.0')).toBe(true)
+    })
+
+    it('should contain EUPL licenses', () => {
+      const licenses = getCopyLeftLicenses()
+      expect(licenses.has('EUPL-1.1')).toBe(true)
+      expect(licenses.has('EUPL-1.2')).toBe(true)
+    })
+
+    it('should not contain permissive licenses', () => {
+      const licenses = getCopyLeftLicenses()
+      expect(licenses.has('MIT')).toBe(false)
+      expect(licenses.has('Apache-2.0')).toBe(false)
+      expect(licenses.has('BSD-3-Clause')).toBe(false)
+      expect(licenses.has('ISC')).toBe(false)
+    })
+
+    it('should return same Set instance on multiple calls (cached)', () => {
+      const first = getCopyLeftLicenses()
+      const second = getCopyLeftLicenses()
+      expect(first).toBe(second)
+    })
+
+    it('should have consistent size', () => {
+      const licenses = getCopyLeftLicenses()
+      expect(licenses.size).toBeGreaterThan(0)
+      const size1 = licenses.size
+      const size2 = getCopyLeftLicenses().size
+      expect(size1).toBe(size2)
+    })
+
+    it('should contain expected number of licenses', () => {
+      const licenses = getCopyLeftLicenses()
+      // 6 AGPL + 4 CC-BY-SA + 2 EPL + 2 EUPL + 9 GPL = 23 licenses
+      expect(licenses.size).toBe(23)
+    })
+
+    it('should only contain strings', () => {
+      const licenses = getCopyLeftLicenses()
+      for (const license of licenses) {
+        expect(typeof license).toBe('string')
+      }
+    })
+
+    it('should contain only SPDX-style identifiers', () => {
+      const licenses = getCopyLeftLicenses()
+      for (const license of licenses) {
+        // SPDX identifiers use letters, digits, hyphens, and dots
+        expect(license).toMatch(/^[A-Za-z0-9.-]+$/)
+      }
+    })
+
+    it('should support checking if license is copy-left', () => {
+      const licenses = getCopyLeftLicenses()
+      const isGPL = licenses.has('GPL-3.0')
+      expect(isGPL).toBe(true)
+    })
+
+    it('should support iteration', () => {
+      const licenses = getCopyLeftLicenses()
+      const array = Array.from(licenses)
+      expect(array.length).toBe(licenses.size)
+    })
+
+    it('should handle case-sensitive checks', () => {
+      const licenses = getCopyLeftLicenses()
+      expect(licenses.has('gpl-3.0')).toBe(false)
+      expect(licenses.has('GPL-3.0')).toBe(true)
+    })
+  })
+
+  describe('copy-left license categories', () => {
+    it('should have all AGPL variants', () => {
+      const licenses = getCopyLeftLicenses()
+      const agplLicenses = Array.from(licenses).filter(l =>
+        l.startsWith('AGPL'),
+      )
+      expect(agplLicenses.length).toBe(6)
+    })
+
+    it('should have all GPL variants', () => {
+      const licenses = getCopyLeftLicenses()
+      const gplLicenses = Array.from(licenses).filter(l => l.startsWith('GPL-'))
+      expect(gplLicenses.length).toBe(9)
+    })
+
+    it('should have all CC-BY-SA variants', () => {
+      const licenses = getCopyLeftLicenses()
+      const ccLicenses = Array.from(licenses).filter(l =>
+        l.startsWith('CC-BY-SA'),
+      )
+      expect(ccLicenses.length).toBe(4)
+    })
+
+    it('should have all EPL variants', () => {
+      const licenses = getCopyLeftLicenses()
+      const eplLicenses = Array.from(licenses).filter(l => l.startsWith('EPL'))
+      expect(eplLicenses.length).toBe(2)
+    })
+
+    it('should have all EUPL variants', () => {
+      const licenses = getCopyLeftLicenses()
+      const euplLicenses = Array.from(licenses).filter(l =>
+        l.startsWith('EUPL'),
+      )
+      expect(euplLicenses.length).toBe(2)
+    })
+  })
+
+  describe('license version patterns', () => {
+    it('should include -only variants', () => {
+      const licenses = getCopyLeftLicenses()
+      const onlyVariants = Array.from(licenses).filter(l => l.includes('-only'))
+      expect(onlyVariants.length).toBeGreaterThan(0)
+    })
+
+    it('should include -or-later variants', () => {
+      const licenses = getCopyLeftLicenses()
+      const orLaterVariants = Array.from(licenses).filter(l =>
+        l.includes('-or-later'),
+      )
+      expect(orLaterVariants.length).toBeGreaterThan(0)
+    })
+
+    it('should have consistent version naming', () => {
+      const licenses = getCopyLeftLicenses()
+      for (const license of licenses) {
+        if (license.includes('-only') || license.includes('-or-later')) {
+          // Should have version number before modifier
+          expect(license).toMatch(/\d+\.\d+(-only|-or-later)/)
+        }
+      }
+    })
+  })
+
+  describe('real-world usage', () => {
+    it('should identify GPL-3.0 as copy-left', () => {
+      const licenses = getCopyLeftLicenses()
+      expect(licenses.has('GPL-3.0')).toBe(true)
+    })
+
+    it('should identify AGPL-3.0 as copy-left', () => {
+      const licenses = getCopyLeftLicenses()
+      expect(licenses.has('AGPL-3.0')).toBe(true)
+    })
+
+    it('should support filtering packages by copy-left licenses', () => {
+      const licenses = getCopyLeftLicenses()
+      const packageLicense = 'GPL-2.0'
+      const isCopyLeft = licenses.has(packageLicense)
+      expect(isCopyLeft).toBe(true)
+    })
+
+    it('should handle modern SPDX identifiers with -only suffix', () => {
+      const licenses = getCopyLeftLicenses()
+      expect(licenses.has('GPL-3.0-only')).toBe(true)
+    })
+
+    it('should handle SPDX identifiers with -or-later suffix', () => {
+      const licenses = getCopyLeftLicenses()
+      expect(licenses.has('GPL-3.0-or-later')).toBe(true)
+    })
+  })
+})
diff --git a/test/unit/constants/node.test.ts b/test/unit/constants/node.test.ts
new file mode 100644
index 0000000..2644cd5
--- /dev/null
+++ b/test/unit/constants/node.test.ts
@@ -0,0 +1,512 @@
+/**
+ * @fileoverview Unit tests for Node.js constants and feature detection.
+ *
+ * Tests Node.js version detection and feature support:
+ * - Version getters: getNodeVersion(), getNodeMajorVersion(), getMaintainedNodeVersions()
+ * - Feature detection: supportsNodeRun(), supportsNodePermissionFlag(), supportsNodeCompileCacheApi()
+ * - Flag builders: getNodeHardenFlags(), getNodePermissionFlags(), getNodeNoWarningsFlags()
+ * - Runtime detection: NODE_SEA_FUSE, ESNEXT, getExecPath(), supportsProcessSend()
+ * Critical for Node.js version-specific behavior and compatibility.
+ */
+
+import {
+  ESNEXT,
+  NODE_SEA_FUSE,
+  getExecPath,
+  getMaintainedNodeVersions,
+  getNodeDisableSigusr1Flags,
+  getNodeHardenFlags,
+  getNodeMajorVersion,
+  getNodeNoWarningsFlags,
+  getNodePermissionFlags,
+  getNodeVersion,
+  supportsNodeCompileCacheApi,
+  supportsNodeCompileCacheEnvVar,
+  supportsNodeDisableSigusr1Flag,
+  supportsNodeDisableWarningFlag,
+  supportsNodePermissionFlag,
+  supportsNodeRequireModule,
+  supportsNodeRun,
+  supportsProcessSend,
+} from '@socketsecurity/lib/constants/node'
+import { describe, expect, it } from 'vitest'
+
+describe('node constants', () => {
+  describe('getNodeVersion', () => {
+    it('should return current Node.js version', () => {
+      const version = getNodeVersion()
+      expect(version).toMatch(/^v\d+\.\d+\.\d+/)
+      expect(version).toBe(process.version)
+    })
+  })
+
+  describe('getNodeMajorVersion', () => {
+    it('should return major version number', () => {
+      const major = getNodeMajorVersion()
+      expect(typeof major).toBe('number')
+      expect(major).toBeGreaterThan(0)
+      // Current Node.js major version should be at least 18 (minimum LTS)
+      expect(major).toBeGreaterThanOrEqual(18)
+    })
+
+    it('should match process.version major', () => {
+      const expected = Number.parseInt(
+        process.version.slice(1).split('.')[0] || '0',
+        10,
+      )
+      expect(getNodeMajorVersion()).toBe(expected)
+    })
+  })
+
+  describe('getMaintainedNodeVersions', () => {
+    it('should return maintained versions object', () => {
+      const versions = getMaintainedNodeVersions()
+      expect(versions).toBeDefined()
+      expect(Array.isArray(versions)).toBe(true)
+    })
+
+    it('should have current, last, next, previous properties', () => {
+      const versions = getMaintainedNodeVersions()
+      expect(versions).toHaveProperty('current')
+      expect(versions).toHaveProperty('last')
+      expect(versions).toHaveProperty('next')
+      expect(versions).toHaveProperty('previous')
+    })
+
+    it('should return same instance on multiple calls', () => {
+      const first = getMaintainedNodeVersions()
+      const second = getMaintainedNodeVersions()
+      expect(first).toBe(second)
+    })
+  })
+
+  describe('supportsNodeCompileCacheApi', () => {
+    it('should return boolean', () => {
+      const result = supportsNodeCompileCacheApi()
+      expect(typeof result).toBe('boolean')
+    })
+
+    it('should return true for Node.js 24+', () => {
+      const major = getNodeMajorVersion()
+      const result = supportsNodeCompileCacheApi()
+      if (major >= 24) {
+        expect(result).toBe(true)
+      } else {
+        expect(result).toBe(false)
+      }
+    })
+  })
+
+  describe('supportsNodeCompileCacheEnvVar', () => {
+    it('should return boolean', () => {
+      const result = supportsNodeCompileCacheEnvVar()
+      expect(typeof result).toBe('boolean')
+    })
+
+    it('should return true for Node.js 22+', () => {
+      const major = getNodeMajorVersion()
+      const result = supportsNodeCompileCacheEnvVar()
+      if (major >= 22) {
+        expect(result).toBe(true)
+      } else {
+        expect(result).toBe(false)
+      }
+    })
+  })
+
+  describe('supportsNodeDisableWarningFlag', () => {
+    it('should return boolean', () => {
+      const result = supportsNodeDisableWarningFlag()
+      expect(typeof result).toBe('boolean')
+    })
+
+    it('should return true for Node.js 21+', () => {
+      const major = getNodeMajorVersion()
+      const result = supportsNodeDisableWarningFlag()
+      if (major >= 21) {
+        expect(result).toBe(true)
+      } else {
+        expect(result).toBe(false)
+      }
+    })
+  })
+
+  describe('supportsNodePermissionFlag', () => {
+    it('should return boolean', () => {
+      const result = supportsNodePermissionFlag()
+      expect(typeof result).toBe('boolean')
+    })
+
+    it('should return true for Node.js 20+', () => {
+      const major = getNodeMajorVersion()
+      const result = supportsNodePermissionFlag()
+      if (major >= 20) {
+        expect(result).toBe(true)
+      } else {
+        expect(result).toBe(false)
+      }
+    })
+  })
+
+  describe('supportsNodeRequireModule', () => {
+    it('should return boolean', () => {
+      const result = supportsNodeRequireModule()
+      expect(typeof result).toBe('boolean')
+    })
+
+    it('should return true for Node.js 23+', () => {
+      const major = getNodeMajorVersion()
+      const result = supportsNodeRequireModule()
+      if (major >= 23) {
+        expect(result).toBe(true)
+      }
+    })
+
+    it('should check minor version for Node.js 22', () => {
+      const major = getNodeMajorVersion()
+      if (major === 22) {
+        const minor = Number.parseInt(process.version.split('.')[1] || '0', 10)
+        const result = supportsNodeRequireModule()
+        if (minor >= 12) {
+          expect(result).toBe(true)
+        } else {
+          expect(result).toBe(false)
+        }
+      }
+    })
+  })
+
+  describe('supportsNodeRun', () => {
+    it('should return boolean', () => {
+      const result = supportsNodeRun()
+      expect(typeof result).toBe('boolean')
+    })
+
+    it('should return true for Node.js 23+', () => {
+      const major = getNodeMajorVersion()
+      const result = supportsNodeRun()
+      if (major >= 23) {
+        expect(result).toBe(true)
+      }
+    })
+
+    it('should check minor version for Node.js 22', () => {
+      const major = getNodeMajorVersion()
+      if (major === 22) {
+        const minor = Number.parseInt(process.version.split('.')[1] || '0', 10)
+        const result = supportsNodeRun()
+        if (minor >= 11) {
+          expect(result).toBe(true)
+        } else {
+          expect(result).toBe(false)
+        }
+      }
+    })
+  })
+
+  describe('supportsNodeDisableSigusr1Flag', () => {
+    it('should return boolean', () => {
+      const result = supportsNodeDisableSigusr1Flag()
+      expect(typeof result).toBe('boolean')
+    })
+
+    it('should check version-specific support', () => {
+      const major = getNodeMajorVersion()
+      const minor = Number.parseInt(process.version.split('.')[1] || '0', 10)
+      const result = supportsNodeDisableSigusr1Flag()
+
+      if (major >= 24) {
+        if (minor >= 8) {
+          expect(result).toBe(true)
+        } else {
+          expect(result).toBe(false)
+        }
+      } else if (major === 23) {
+        if (minor >= 7) {
+          expect(result).toBe(true)
+        } else {
+          expect(result).toBe(false)
+        }
+      } else if (major === 22) {
+        if (minor >= 14) {
+          expect(result).toBe(true)
+        } else {
+          expect(result).toBe(false)
+        }
+      } else {
+        expect(result).toBe(false)
+      }
+    })
+  })
+
+  describe('supportsProcessSend', () => {
+    it('should return boolean', () => {
+      const result = supportsProcessSend()
+      expect(typeof result).toBe('boolean')
+    })
+
+    it('should check if process.send exists', () => {
+      const hasSend = typeof process.send === 'function'
+      expect(supportsProcessSend()).toBe(hasSend)
+    })
+  })
+
+  describe('getNodeHardenFlags', () => {
+    it('should return array of hardening flags', () => {
+      const flags = getNodeHardenFlags()
+      expect(Array.isArray(flags)).toBe(true)
+      expect(flags.length).toBeGreaterThan(0)
+    })
+
+    it('should include disable-proto flag', () => {
+      const flags = getNodeHardenFlags()
+      expect(flags).toContain('--disable-proto=delete')
+    })
+
+    it('should include force-node-api flag', () => {
+      const flags = getNodeHardenFlags()
+      expect(flags).toContain('--force-node-api-uncaught-exceptions-policy')
+    })
+
+    it('should use --permission for Node.js 24+', () => {
+      const major = getNodeMajorVersion()
+      const flags = getNodeHardenFlags()
+      if (major >= 24) {
+        expect(flags).toContain('--permission')
+        expect(flags).not.toContain('--experimental-permission')
+        expect(flags).not.toContain('--experimental-policy')
+      }
+    })
+
+    it('should use --experimental-permission for Node.js < 24', () => {
+      const major = getNodeMajorVersion()
+      const flags = getNodeHardenFlags()
+      if (major < 24) {
+        expect(flags).toContain('--experimental-permission')
+        expect(flags).toContain('--experimental-policy')
+        expect(flags).not.toContain('--permission')
+      }
+    })
+
+    it('should return same instance on multiple calls', () => {
+      const first = getNodeHardenFlags()
+      const second = getNodeHardenFlags()
+      expect(first).toBe(second)
+    })
+  })
+
+  describe('getNodePermissionFlags', () => {
+    it('should return array of permission flags', () => {
+      const flags = getNodePermissionFlags()
+      expect(Array.isArray(flags)).toBe(true)
+    })
+
+    it('should return filesystem and process permissions for Node.js 24+', () => {
+      const major = getNodeMajorVersion()
+      const flags = getNodePermissionFlags()
+      if (major >= 24) {
+        expect(flags).toContain('--allow-fs-read=*')
+        expect(flags).toContain('--allow-fs-write=*')
+        expect(flags).toContain('--allow-child-process')
+        expect(flags.length).toBe(3)
+      }
+    })
+
+    it('should return empty array for Node.js < 24', () => {
+      const major = getNodeMajorVersion()
+      const flags = getNodePermissionFlags()
+      if (major < 24) {
+        expect(flags.length).toBe(0)
+      }
+    })
+
+    it('should return same instance on multiple calls', () => {
+      const first = getNodePermissionFlags()
+      const second = getNodePermissionFlags()
+      expect(first).toBe(second)
+    })
+  })
+
+  describe('getNodeNoWarningsFlags', () => {
+    it('should return array of no-warnings flags', () => {
+      const flags = getNodeNoWarningsFlags()
+      expect(Array.isArray(flags)).toBe(true)
+      expect(flags.length).toBeGreaterThan(0)
+    })
+
+    it('should include no-warnings and no-deprecation flags', () => {
+      const flags = getNodeNoWarningsFlags()
+      expect(flags).toContain('--no-warnings')
+      expect(flags).toContain('--no-deprecation')
+    })
+
+    it('should return same instance on multiple calls', () => {
+      const first = getNodeNoWarningsFlags()
+      const second = getNodeNoWarningsFlags()
+      expect(first).toBe(second)
+    })
+  })
+
+  describe('getNodeDisableSigusr1Flags', () => {
+    it('should return array of SIGUSR1 disable flags', () => {
+      const flags = getNodeDisableSigusr1Flags()
+      expect(Array.isArray(flags)).toBe(true)
+      expect(flags.length).toBeGreaterThan(0)
+    })
+
+    it('should return --disable-sigusr1 for supported versions', () => {
+      const flags = getNodeDisableSigusr1Flags()
+      const supportsFlag = supportsNodeDisableSigusr1Flag()
+      if (supportsFlag) {
+        expect(flags).toContain('--disable-sigusr1')
+        expect(flags).not.toContain('--no-inspect')
+      } else {
+        expect(flags).toContain('--no-inspect')
+        expect(flags).not.toContain('--disable-sigusr1')
+      }
+    })
+
+    it('should return same instance on multiple calls', () => {
+      const first = getNodeDisableSigusr1Flags()
+      const second = getNodeDisableSigusr1Flags()
+      expect(first).toBe(second)
+    })
+  })
+
+  describe('getExecPath', () => {
+    it('should return string path', () => {
+      const path = getExecPath()
+      expect(typeof path).toBe('string')
+      expect(path.length).toBeGreaterThan(0)
+    })
+
+    it('should match process.execPath', () => {
+      expect(getExecPath()).toBe(process.execPath)
+    })
+
+    it('should include node executable', () => {
+      const path = getExecPath()
+      expect(path).toMatch(/node/)
+    })
+  })
+
+  describe('NODE_SEA_FUSE constant', () => {
+    it('should be defined as string', () => {
+      expect(typeof NODE_SEA_FUSE).toBe('string')
+    })
+
+    it('should have correct fuse value', () => {
+      expect(NODE_SEA_FUSE).toBe(
+        'NODE_SEA_FUSE_fce680ab2cc467b6e072b8b5df1996b2',
+      )
+    })
+
+    it('should start with NODE_SEA_FUSE prefix', () => {
+      expect(NODE_SEA_FUSE).toMatch(/^NODE_SEA_FUSE_/)
+    })
+  })
+
+  describe('ESNEXT constant', () => {
+    it('should be defined as string', () => {
+      expect(typeof ESNEXT).toBe('string')
+    })
+
+    it('should equal esnext', () => {
+      expect(ESNEXT).toBe('esnext')
+    })
+  })
+
+  describe('edge cases and comprehensive coverage', () => {
+    it('should handle all flag getters being called multiple times', () => {
+      // Call each getter multiple times to ensure caching works
+      for (let i = 0; i < 3; i++) {
+        getNodeHardenFlags()
+        getNodePermissionFlags()
+        getNodeNoWarningsFlags()
+        getNodeDisableSigusr1Flags()
+      }
+    })
+
+    it('should verify all flag arrays are non-empty or conditionally empty', () => {
+      const hardenFlags = getNodeHardenFlags()
+      const noWarningsFlags = getNodeNoWarningsFlags()
+      const sigusr1Flags = getNodeDisableSigusr1Flags()
+
+      expect(hardenFlags.length).toBeGreaterThan(0)
+      expect(noWarningsFlags.length).toBeGreaterThan(0)
+      expect(sigusr1Flags.length).toBeGreaterThan(0)
+
+      // Permission flags are conditionally empty for Node < 24
+      const permissionFlags = getNodePermissionFlags()
+      const major = getNodeMajorVersion()
+      if (major >= 24) {
+        expect(permissionFlags.length).toBeGreaterThan(0)
+      } else {
+        expect(permissionFlags.length).toBe(0)
+      }
+    })
+
+    it('should verify maintained versions caching', () => {
+      const v1 = getMaintainedNodeVersions()
+      const v2 = getMaintainedNodeVersions()
+      const v3 = getMaintainedNodeVersions()
+      expect(v1).toBe(v2)
+      expect(v2).toBe(v3)
+    })
+
+    it('should verify all support functions return boolean', () => {
+      expect(typeof supportsNodeCompileCacheApi()).toBe('boolean')
+      expect(typeof supportsNodeCompileCacheEnvVar()).toBe('boolean')
+      expect(typeof supportsNodeDisableWarningFlag()).toBe('boolean')
+      expect(typeof supportsNodePermissionFlag()).toBe('boolean')
+      expect(typeof supportsNodeRequireModule()).toBe('boolean')
+      expect(typeof supportsNodeRun()).toBe('boolean')
+      expect(typeof supportsNodeDisableSigusr1Flag()).toBe('boolean')
+      expect(typeof supportsProcessSend()).toBe('boolean')
+    })
+
+    it('should verify version string format', () => {
+      const version = getNodeVersion()
+      expect(version).toMatch(/^v\d+\.\d+\.\d+/)
+      expect(version.startsWith('v')).toBe(true)
+    })
+
+    it('should verify major version is positive integer', () => {
+      const major = getNodeMajorVersion()
+      expect(Number.isInteger(major)).toBe(true)
+      expect(major).toBeGreaterThan(0)
+    })
+
+    it('should verify execPath is absolute path', () => {
+      const execPath = getExecPath()
+      expect(execPath).toBeTruthy()
+      expect(typeof execPath).toBe('string')
+      expect(execPath.length).toBeGreaterThan(0)
+    })
+
+    it('should verify flag contents are strings starting with --', () => {
+      const allFlags = [
+        ...getNodeHardenFlags(),
+        ...getNodePermissionFlags(),
+        ...getNodeNoWarningsFlags(),
+        ...getNodeDisableSigusr1Flags(),
+      ]
+
+      allFlags.forEach(flag => {
+        expect(typeof flag).toBe('string')
+        expect(flag.startsWith('--')).toBe(true)
+      })
+    })
+
+    it('should verify constants are exportable and accessible', () => {
+      // Verify constants can be destructured and used
+      const seaFuse = NODE_SEA_FUSE
+      const esnext = ESNEXT
+
+      expect(seaFuse).toBeDefined()
+      expect(esnext).toBeDefined()
+      expect(typeof seaFuse).toBe('string')
+      expect(typeof esnext).toBe('string')
+    })
+  })
+})
diff --git a/test/unit/constants/packages.test.ts b/test/unit/constants/packages.test.ts
new file mode 100644
index 0000000..693601e
--- /dev/null
+++ b/test/unit/constants/packages.test.ts
@@ -0,0 +1,306 @@
+/**
+ * @fileoverview Unit tests for package constants and utilities.
+ *
+ * Tests npm/package-related constants:
+ * - NPM_REGISTRY_URL, NPM_PUBLIC_REGISTRY (registry endpoints)
+ * - Package.json field names (dependencies, devDependencies, scripts)
+ * - Package manager identifiers (npm, yarn, pnpm, bun)
+ * Frozen constants for consistent package operations.
+ */
+
+import {
+  AT_LATEST,
+  LATEST,
+  PACKAGE,
+  PACKAGE_DEFAULT_VERSION,
+  getLifecycleScriptNames,
+  getNpmLifecycleEvent,
+  getPackageDefaultNodeRange,
+  getPackageDefaultSocketCategories,
+  getPackageExtensions,
+  getPackumentCache,
+  getPacoteCachePath,
+} from '@socketsecurity/lib/constants/packages'
+import { describe, expect, it } from 'vitest'
+
+describe('constants/packages', () => {
+  describe('package constants', () => {
+    it('PACKAGE should be defined', () => {
+      expect(PACKAGE).toBe('package')
+    })
+
+    it('AT_LATEST should be defined', () => {
+      expect(AT_LATEST).toBe('@latest')
+    })
+
+    it('LATEST should be defined', () => {
+      expect(LATEST).toBe('latest')
+    })
+
+    it('PACKAGE_DEFAULT_VERSION should be defined', () => {
+      expect(PACKAGE_DEFAULT_VERSION).toBe('1.0.0')
+    })
+
+    it('all constants should be strings', () => {
+      expect(typeof PACKAGE).toBe('string')
+      expect(typeof AT_LATEST).toBe('string')
+      expect(typeof LATEST).toBe('string')
+      expect(typeof PACKAGE_DEFAULT_VERSION).toBe('string')
+    })
+  })
+
+  describe('getPackageDefaultNodeRange', () => {
+    it('should return string or undefined', () => {
+      const range = getPackageDefaultNodeRange()
+      const type = typeof range
+      expect(type === 'string' || type === 'undefined').toBe(true)
+    })
+
+    it('should return consistent value on multiple calls', () => {
+      const first = getPackageDefaultNodeRange()
+      const second = getPackageDefaultNodeRange()
+      expect(first).toBe(second)
+    })
+
+    it('should return fallback if file missing', () => {
+      const range = getPackageDefaultNodeRange()
+      // Either loads from file or uses fallback '>=18'
+      expect(range).toBeDefined()
+      expect(typeof range).toBe('string')
+    })
+  })
+
+  describe('getPackageDefaultSocketCategories', () => {
+    it('should return array', () => {
+      const categories = getPackageDefaultSocketCategories()
+      expect(Array.isArray(categories)).toBe(true)
+    })
+
+    it('should return consistent value on multiple calls', () => {
+      const first = getPackageDefaultSocketCategories()
+      const second = getPackageDefaultSocketCategories()
+      expect(first).toBe(second)
+    })
+
+    it('should be readonly array', () => {
+      const categories = getPackageDefaultSocketCategories()
+      expect(Object.isFrozen(categories) || categories.length === 0).toBe(true)
+    })
+  })
+
+  describe('getPackageExtensions', () => {
+    it('should return iterable', () => {
+      const extensions = getPackageExtensions()
+      expect(extensions).toBeDefined()
+      expect(typeof extensions[Symbol.iterator]).toBe('function')
+    })
+
+    it('should return consistent value on multiple calls', () => {
+      const first = getPackageExtensions()
+      const second = getPackageExtensions()
+      expect(first).toBe(second)
+    })
+
+    it('should be iterable with for-of', () => {
+      const extensions = getPackageExtensions()
+      let count = 0
+      for (const [key, _value] of extensions) {
+        expect(typeof key).toBe('string')
+        count++
+      }
+      // Either has extensions or is empty array
+      expect(count).toBeGreaterThanOrEqual(0)
+    })
+
+    it('should have tuple entries when not empty', () => {
+      const extensions = getPackageExtensions()
+      const array = Array.from(extensions)
+      for (const entry of array) {
+        expect(Array.isArray(entry)).toBe(true)
+        expect(entry.length).toBe(2)
+        expect(typeof entry[0]).toBe('string')
+      }
+    })
+  })
+
+  describe('getNpmLifecycleEvent', () => {
+    it('should return string or undefined', () => {
+      const event = getNpmLifecycleEvent()
+      const type = typeof event
+      expect(type === 'string' || type === 'undefined').toBe(true)
+    })
+
+    it('should match npm_lifecycle_event env var', () => {
+      const event = getNpmLifecycleEvent()
+      const envValue = process.env.npm_lifecycle_event
+      expect(event).toBe(envValue)
+    })
+  })
+
+  describe('getLifecycleScriptNames', () => {
+    it('should return array', () => {
+      const scripts = getLifecycleScriptNames()
+      expect(Array.isArray(scripts)).toBe(true)
+    })
+
+    it('should return consistent value on multiple calls', () => {
+      const first = getLifecycleScriptNames()
+      const second = getLifecycleScriptNames()
+      expect(first).toBe(second)
+    })
+
+    it('should contain only strings', () => {
+      const scripts = getLifecycleScriptNames()
+      for (const script of scripts) {
+        expect(typeof script).toBe('string')
+        expect(script.length).toBeGreaterThan(0)
+      }
+    })
+
+    it('should work with array methods', () => {
+      const scripts = getLifecycleScriptNames()
+      const filtered = scripts.filter(s => s.startsWith('pre'))
+      expect(Array.isArray(filtered)).toBe(true)
+    })
+  })
+
+  describe('getPackumentCache', () => {
+    it('should return Map instance', () => {
+      const cache = getPackumentCache()
+      expect(cache instanceof Map).toBe(true)
+    })
+
+    it('should return consistent value on multiple calls', () => {
+      const first = getPackumentCache()
+      const second = getPackumentCache()
+      expect(first).toBe(second)
+    })
+
+    it('should be mutable Map', () => {
+      const cache = getPackumentCache()
+      const key = `test-key-${Date.now()}`
+      const value = { test: true }
+
+      cache.set(key, value)
+      expect(cache.get(key)).toBe(value)
+      expect(cache.has(key)).toBe(true)
+
+      cache.delete(key)
+      expect(cache.has(key)).toBe(false)
+    })
+
+    it('should support Map operations', () => {
+      const cache = getPackumentCache()
+      const initialSize = cache.size
+
+      const testKey = `test-${Date.now()}`
+      cache.set(testKey, { data: 'test' })
+      expect(cache.size).toBe(initialSize + 1)
+
+      cache.clear()
+      expect(cache.size).toBe(0)
+    })
+  })
+
+  describe('getPacoteCachePath', () => {
+    it('should return string', () => {
+      const path = getPacoteCachePath()
+      expect(typeof path).toBe('string')
+    })
+
+    it('should return consistent value on multiple calls', () => {
+      const first = getPacoteCachePath()
+      const second = getPacoteCachePath()
+      expect(first).toBe(second)
+    })
+
+    it('should return normalized path or empty string', () => {
+      const path = getPacoteCachePath()
+      // Either a valid path or empty string fallback
+      expect(typeof path).toBe('string')
+      if (path.length > 0) {
+        // If path exists, should not have backslashes (normalized)
+        expect(path).not.toMatch(/\\/)
+      }
+    })
+
+    it('should handle missing pacote gracefully', () => {
+      // Should not throw even if pacote is missing
+      expect(() => getPacoteCachePath()).not.toThrow()
+    })
+  })
+
+  describe('integration', () => {
+    it('all getters should be callable', () => {
+      expect(() => getPackageDefaultNodeRange()).not.toThrow()
+      expect(() => getPackageDefaultSocketCategories()).not.toThrow()
+      expect(() => getPackageExtensions()).not.toThrow()
+      expect(() => getNpmLifecycleEvent()).not.toThrow()
+      expect(() => getLifecycleScriptNames()).not.toThrow()
+      expect(() => getPackumentCache()).not.toThrow()
+      expect(() => getPacoteCachePath()).not.toThrow()
+    })
+
+    it('constants should be immutable', () => {
+      const originalPackage = PACKAGE
+      const originalLatest = LATEST
+      const originalAtLatest = AT_LATEST
+      const originalVersion = PACKAGE_DEFAULT_VERSION
+
+      // Attempt to modify (should fail silently or throw in strict mode)
+      // TypeScript will prevent this, but we can test runtime behavior
+      expect(PACKAGE).toBe(originalPackage)
+      expect(LATEST).toBe(originalLatest)
+      expect(AT_LATEST).toBe(originalAtLatest)
+      expect(PACKAGE_DEFAULT_VERSION).toBe(originalVersion)
+    })
+
+    it('cache should persist between calls', () => {
+      const cache1 = getPackumentCache()
+      const testKey = `persist-test-${Date.now()}`
+      cache1.set(testKey, { persisted: true })
+
+      const cache2 = getPackumentCache()
+      expect(cache2.get(testKey)).toEqual({ persisted: true })
+
+      // Clean up
+      cache2.delete(testKey)
+    })
+  })
+
+  describe('edge cases', () => {
+    it('should handle empty package extensions gracefully', () => {
+      const extensions = getPackageExtensions()
+      const arr = Array.from(extensions)
+      expect(arr.length).toBeGreaterThanOrEqual(0)
+    })
+
+    it('should handle undefined npm lifecycle event', () => {
+      const event = getNpmLifecycleEvent()
+      if (event === undefined) {
+        expect(typeof event).toBe('undefined')
+      } else {
+        expect(typeof event).toBe('string')
+      }
+    })
+
+    it('should handle empty lifecycle script names', () => {
+      const scripts = getLifecycleScriptNames()
+      expect(scripts.length).toBeGreaterThanOrEqual(0)
+    })
+  })
+
+  describe('type checks', () => {
+    it('constants should have correct types', () => {
+      expect(PACKAGE).toMatch(/^[a-z]+$/)
+      expect(LATEST).toMatch(/^[a-z]+$/)
+      expect(AT_LATEST).toMatch(/^@[a-z]+$/)
+      expect(PACKAGE_DEFAULT_VERSION).toMatch(/^\d+\.\d+\.\d+$/)
+    })
+
+    it('getPackumentCache should return Map type', () => {
+      const cache = getPackumentCache()
+      expect(cache.constructor.name).toBe('Map')
+    })
+  })
+})
diff --git a/test/unit/constants/paths.test.ts b/test/unit/constants/paths.test.ts
new file mode 100644
index 0000000..1910f92
--- /dev/null
+++ b/test/unit/constants/paths.test.ts
@@ -0,0 +1,385 @@
+/**
+ * @fileoverview Unit tests for file paths, directory names, extensions, and glob patterns.
+ *
+ * Tests file path constants and patterns:
+ * - Common paths: node_modules, package.json, LICENSE files
+ * - Glob patterns: LICENSE_GLOB, gitignore patterns, recursive globs
+ * - File extensions: .js, .ts, .json, .md
+ * Frozen constants for file discovery and filtering.
+ */
+
+import { describe, expect, it } from 'vitest'
+
+import {
+  CACHE_DIR,
+  CACHE_TTL_DIR,
+  CHANGELOG_MD,
+  DOT_GIT_DIR,
+  DOT_GITHUB,
+  DOT_PACKAGE_LOCK_JSON,
+  DOT_SOCKET_DIR,
+  ESLINT_CONFIG_JS,
+  EXT_CJS,
+  EXT_CMD,
+  EXT_CTS,
+  EXT_DTS,
+  EXT_JS,
+  EXT_JSON,
+  EXT_LOCK,
+  EXT_LOCKB,
+  EXT_MD,
+  EXT_MJS,
+  EXT_MTS,
+  EXT_PS1,
+  EXT_YAML,
+  EXT_YML,
+  EXTENSIONS,
+  EXTENSIONS_JSON,
+  GITIGNORE,
+  LICENSE,
+  LICENSE_GLOB,
+  LICENSE_GLOB_RECURSIVE,
+  LICENSE_MD,
+  LICENSE_ORIGINAL,
+  LICENSE_ORIGINAL_GLOB,
+  LICENSE_ORIGINAL_GLOB_RECURSIVE,
+  MANIFEST_JSON,
+  NODE_MODULES,
+  NODE_MODULES_GLOB_RECURSIVE,
+  PACKAGE_JSON,
+  README_GLOB,
+  README_GLOB_RECURSIVE,
+  README_MD,
+  ROLLUP_EXTERNAL_SUFFIX,
+  SLASH_NODE_MODULES_SLASH,
+  TSCONFIG_JSON,
+} from '@socketsecurity/lib/constants/paths'
+
+describe('constants/paths', () => {
+  describe('file names', () => {
+    it('should export PACKAGE_JSON', () => {
+      expect(PACKAGE_JSON).toBe('package.json')
+    })
+
+    it('should export TSCONFIG_JSON', () => {
+      expect(TSCONFIG_JSON).toBe('tsconfig.json')
+    })
+
+    it('should export LICENSE', () => {
+      expect(LICENSE).toBe('LICENSE')
+    })
+
+    it('should export LICENSE_MD', () => {
+      expect(LICENSE_MD).toBe('LICENSE.md')
+    })
+
+    it('should export LICENSE_ORIGINAL', () => {
+      expect(LICENSE_ORIGINAL).toBe('LICENSE.original')
+    })
+
+    it('should export README_MD', () => {
+      expect(README_MD).toBe('README.md')
+    })
+
+    it('should export CHANGELOG_MD', () => {
+      expect(CHANGELOG_MD).toBe('CHANGELOG.md')
+    })
+
+    it('should export MANIFEST_JSON', () => {
+      expect(MANIFEST_JSON).toBe('manifest.json')
+    })
+
+    it('should export EXTENSIONS_JSON', () => {
+      expect(EXTENSIONS_JSON).toBe('extensions.json')
+    })
+
+    it('should export ESLINT_CONFIG_JS', () => {
+      expect(ESLINT_CONFIG_JS).toBe('eslint.config.js')
+    })
+
+    it('should export GITIGNORE', () => {
+      expect(GITIGNORE).toBe('.gitignore')
+    })
+
+    it('should export DOT_PACKAGE_LOCK_JSON', () => {
+      expect(DOT_PACKAGE_LOCK_JSON).toBe('.package-lock.json')
+    })
+
+    it('should have consistent JSON extension usage', () => {
+      expect(PACKAGE_JSON.endsWith('.json')).toBe(true)
+      expect(TSCONFIG_JSON.endsWith('.json')).toBe(true)
+      expect(MANIFEST_JSON.endsWith('.json')).toBe(true)
+      expect(EXTENSIONS_JSON.endsWith('.json')).toBe(true)
+      expect(DOT_PACKAGE_LOCK_JSON.endsWith('.json')).toBe(true)
+    })
+
+    it('should have consistent markdown extension usage', () => {
+      expect(LICENSE_MD.endsWith('.md')).toBe(true)
+      expect(README_MD.endsWith('.md')).toBe(true)
+      expect(CHANGELOG_MD.endsWith('.md')).toBe(true)
+    })
+  })
+
+  describe('directory names', () => {
+    it('should export NODE_MODULES', () => {
+      expect(NODE_MODULES).toBe('node_modules')
+    })
+
+    it('should export DOT_GIT_DIR', () => {
+      expect(DOT_GIT_DIR).toBe('.git')
+    })
+
+    it('should export DOT_GITHUB', () => {
+      expect(DOT_GITHUB).toBe('.github')
+    })
+
+    it('should export DOT_SOCKET_DIR', () => {
+      expect(DOT_SOCKET_DIR).toBe('.socket')
+    })
+
+    it('should export CACHE_DIR', () => {
+      expect(CACHE_DIR).toBe('cache')
+    })
+
+    it('should export CACHE_TTL_DIR', () => {
+      expect(CACHE_TTL_DIR).toBe('ttl')
+    })
+
+    it('should have dot prefix for hidden directories', () => {
+      expect(DOT_GIT_DIR.startsWith('.')).toBe(true)
+      expect(DOT_GITHUB.startsWith('.')).toBe(true)
+      expect(DOT_SOCKET_DIR.startsWith('.')).toBe(true)
+    })
+  })
+
+  describe('path patterns', () => {
+    it('should export NODE_MODULES_GLOB_RECURSIVE', () => {
+      expect(NODE_MODULES_GLOB_RECURSIVE).toBe('**/node_modules')
+    })
+
+    it('should export SLASH_NODE_MODULES_SLASH', () => {
+      expect(SLASH_NODE_MODULES_SLASH).toBe('/node_modules/')
+    })
+
+    it('should have glob pattern format', () => {
+      expect(NODE_MODULES_GLOB_RECURSIVE.startsWith('**/')).toBe(true)
+    })
+
+    it('should have slash delimiters', () => {
+      expect(SLASH_NODE_MODULES_SLASH.startsWith('/')).toBe(true)
+      expect(SLASH_NODE_MODULES_SLASH.endsWith('/')).toBe(true)
+    })
+  })
+
+  describe('file extensions', () => {
+    it('should export EXT_CJS', () => {
+      expect(EXT_CJS).toBe('.cjs')
+    })
+
+    it('should export EXT_CMD', () => {
+      expect(EXT_CMD).toBe('.cmd')
+    })
+
+    it('should export EXT_CTS', () => {
+      expect(EXT_CTS).toBe('.cts')
+    })
+
+    it('should export EXT_DTS', () => {
+      expect(EXT_DTS).toBe('.d.ts')
+    })
+
+    it('should export EXT_JS', () => {
+      expect(EXT_JS).toBe('.js')
+    })
+
+    it('should export EXT_JSON', () => {
+      expect(EXT_JSON).toBe('.json')
+    })
+
+    it('should export EXT_LOCK', () => {
+      expect(EXT_LOCK).toBe('.lock')
+    })
+
+    it('should export EXT_LOCKB', () => {
+      expect(EXT_LOCKB).toBe('.lockb')
+    })
+
+    it('should export EXT_MD', () => {
+      expect(EXT_MD).toBe('.md')
+    })
+
+    it('should export EXT_MJS', () => {
+      expect(EXT_MJS).toBe('.mjs')
+    })
+
+    it('should export EXT_MTS', () => {
+      expect(EXT_MTS).toBe('.mts')
+    })
+
+    it('should export EXT_PS1', () => {
+      expect(EXT_PS1).toBe('.ps1')
+    })
+
+    it('should export EXT_YAML', () => {
+      expect(EXT_YAML).toBe('.yaml')
+    })
+
+    it('should export EXT_YML', () => {
+      expect(EXT_YML).toBe('.yml')
+    })
+
+    it('should all start with dot', () => {
+      const extensions = [
+        EXT_CJS,
+        EXT_CMD,
+        EXT_CTS,
+        EXT_DTS,
+        EXT_JS,
+        EXT_JSON,
+        EXT_LOCK,
+        EXT_LOCKB,
+        EXT_MD,
+        EXT_MJS,
+        EXT_MTS,
+        EXT_PS1,
+        EXT_YAML,
+        EXT_YML,
+      ]
+      for (const ext of extensions) {
+        expect(ext.startsWith('.')).toBe(true)
+      }
+    })
+
+    it('should have unique values', () => {
+      const extensions = [
+        EXT_CJS,
+        EXT_CMD,
+        EXT_CTS,
+        EXT_DTS,
+        EXT_JS,
+        EXT_JSON,
+        EXT_LOCK,
+        EXT_LOCKB,
+        EXT_MD,
+        EXT_MJS,
+        EXT_MTS,
+        EXT_PS1,
+        EXT_YAML,
+        EXT_YML,
+      ]
+      const unique = [...new Set(extensions)]
+      expect(unique.length).toBe(extensions.length)
+    })
+  })
+
+  describe('glob patterns', () => {
+    it('should export LICENSE_GLOB', () => {
+      expect(LICENSE_GLOB).toBe('LICEN[CS]E{[.-]*,}')
+    })
+
+    it('should export LICENSE_GLOB_RECURSIVE', () => {
+      expect(LICENSE_GLOB_RECURSIVE).toBe('**/LICEN[CS]E{[.-]*,}')
+    })
+
+    it('should export LICENSE_ORIGINAL_GLOB', () => {
+      expect(LICENSE_ORIGINAL_GLOB).toBe('*.original{.*,}')
+    })
+
+    it('should export LICENSE_ORIGINAL_GLOB_RECURSIVE', () => {
+      expect(LICENSE_ORIGINAL_GLOB_RECURSIVE).toBe('**/*.original{.*,}')
+    })
+
+    it('should export README_GLOB', () => {
+      expect(README_GLOB).toBe('README{.*,}')
+    })
+
+    it('should export README_GLOB_RECURSIVE', () => {
+      expect(README_GLOB_RECURSIVE).toBe('**/README{.*,}')
+    })
+
+    it('should have recursive variants', () => {
+      expect(LICENSE_GLOB_RECURSIVE.startsWith('**/')).toBe(true)
+      expect(LICENSE_ORIGINAL_GLOB_RECURSIVE.startsWith('**/')).toBe(true)
+      expect(README_GLOB_RECURSIVE.startsWith('**/')).toBe(true)
+    })
+
+    it('should use glob brace expansion', () => {
+      expect(LICENSE_GLOB).toContain('{')
+      expect(LICENSE_GLOB).toContain('}')
+      expect(LICENSE_ORIGINAL_GLOB).toContain('{')
+      expect(README_GLOB).toContain('{')
+    })
+
+    it('should use glob character classes', () => {
+      expect(LICENSE_GLOB).toContain('[')
+      expect(LICENSE_GLOB).toContain(']')
+    })
+  })
+
+  describe('miscellaneous constants', () => {
+    it('should export EXTENSIONS', () => {
+      expect(EXTENSIONS).toBe('extensions')
+    })
+
+    it('should export ROLLUP_EXTERNAL_SUFFIX', () => {
+      expect(ROLLUP_EXTERNAL_SUFFIX).toBe('__rollup_external')
+    })
+
+    it('should be strings', () => {
+      expect(typeof EXTENSIONS).toBe('string')
+      expect(typeof ROLLUP_EXTERNAL_SUFFIX).toBe('string')
+    })
+  })
+
+  describe('constant relationships', () => {
+    it('should have LICENSE_MD contain LICENSE', () => {
+      expect(LICENSE_MD).toContain(LICENSE)
+    })
+
+    it('should have LICENSE_ORIGINAL contain LICENSE', () => {
+      expect(LICENSE_ORIGINAL).toContain(LICENSE)
+    })
+
+    it('should have EXTENSIONS_JSON contain EXTENSIONS', () => {
+      expect(EXTENSIONS_JSON).toContain(EXTENSIONS)
+    })
+
+    it('should have consistent cache directory naming', () => {
+      expect(typeof CACHE_DIR).toBe('string')
+      expect(typeof CACHE_TTL_DIR).toBe('string')
+    })
+  })
+
+  describe('real-world usage', () => {
+    it('should support file name matching', () => {
+      const filename = 'package.json'
+      expect(filename).toBe(PACKAGE_JSON)
+    })
+
+    it('should support extension detection', () => {
+      const filename = 'example.ts'
+      const hasDTsExt = filename.replace(/\.ts$/, EXT_DTS)
+      expect(hasDTsExt).toBe('example.d.ts')
+    })
+
+    it('should support directory detection', () => {
+      const path = '/project/node_modules/package'
+      expect(path.includes(NODE_MODULES)).toBe(true)
+      expect(path.includes(SLASH_NODE_MODULES_SLASH)).toBe(true)
+    })
+
+    it('should support glob pattern usage', () => {
+      const pattern = LICENSE_GLOB_RECURSIVE
+      expect(pattern.startsWith('**/')).toBe(true)
+    })
+  })
+
+  describe('constant immutability', () => {
+    it('should not allow reassignment', () => {
+      expect(() => {
+        // @ts-expect-error - testing immutability
+        PACKAGE_JSON = 'other.json'
+      }).toThrow()
+    })
+  })
+})
diff --git a/test/unit/constants/platform.test.ts b/test/unit/constants/platform.test.ts
new file mode 100644
index 0000000..85d7254
--- /dev/null
+++ b/test/unit/constants/platform.test.ts
@@ -0,0 +1,264 @@
+/**
+ * @fileoverview Unit tests for platform detection and OS-specific constants.
+ *
+ * Tests platform/OS constants:
+ * - IS_WINDOWS, IS_MAC, IS_LINUX (boolean flags)
+ * - PLATFORM (win32, darwin, linux from process.platform)
+ * - EOL (line ending: \\r\\n on Windows, \\n on Unix)
+ * - Architecture detection (x64, arm64)
+ * Frozen constants for cross-platform compatibility.
+ */
+
+import { describe, expect, it } from 'vitest'
+
+import {
+  DARWIN,
+  S_IXGRP,
+  S_IXOTH,
+  S_IXUSR,
+  WIN32,
+} from '@socketsecurity/lib/constants/platform'
+
+describe('constants/platform', () => {
+  describe('platform detection', () => {
+    it('should export DARWIN boolean', () => {
+      expect(typeof DARWIN).toBe('boolean')
+    })
+
+    it('should export WIN32 boolean', () => {
+      expect(typeof WIN32).toBe('boolean')
+    })
+
+    it('should have mutually exclusive platform flags', () => {
+      // A system cannot be both Darwin and Win32
+      if (DARWIN) {
+        expect(WIN32).toBe(false)
+      }
+      if (WIN32) {
+        expect(DARWIN).toBe(false)
+      }
+    })
+
+    it('should reflect actual platform', () => {
+      const platform = process.platform
+      if (platform === 'darwin') {
+        expect(DARWIN).toBe(true)
+        expect(WIN32).toBe(false)
+      } else if (platform === 'win32') {
+        expect(DARWIN).toBe(false)
+        expect(WIN32).toBe(true)
+      } else {
+        expect(DARWIN).toBe(false)
+        expect(WIN32).toBe(false)
+      }
+    })
+
+    it('should be consistent across multiple reads', () => {
+      const darwin1 = DARWIN
+      const darwin2 = DARWIN
+      expect(darwin1).toBe(darwin2)
+
+      const win321 = WIN32
+      const win322 = WIN32
+      expect(win321).toBe(win322)
+    })
+  })
+
+  describe('file permission modes', () => {
+    it('should export S_IXUSR constant', () => {
+      expect(S_IXUSR).toBe(0o100)
+    })
+
+    it('should export S_IXGRP constant', () => {
+      expect(S_IXGRP).toBe(0o010)
+    })
+
+    it('should export S_IXOTH constant', () => {
+      expect(S_IXOTH).toBe(0o001)
+    })
+
+    it('should be octal numbers', () => {
+      expect(typeof S_IXUSR).toBe('number')
+      expect(typeof S_IXGRP).toBe('number')
+      expect(typeof S_IXOTH).toBe('number')
+    })
+
+    it('should have correct decimal values', () => {
+      expect(S_IXUSR).toBe(64) // 0o100 = 64
+      expect(S_IXGRP).toBe(8) // 0o010 = 8
+      expect(S_IXOTH).toBe(1) // 0o001 = 1
+    })
+
+    it('should have different values', () => {
+      expect(S_IXUSR).not.toBe(S_IXGRP)
+      expect(S_IXUSR).not.toBe(S_IXOTH)
+      expect(S_IXGRP).not.toBe(S_IXOTH)
+    })
+
+    it('should be in descending order', () => {
+      expect(S_IXUSR).toBeGreaterThan(S_IXGRP)
+      expect(S_IXGRP).toBeGreaterThan(S_IXOTH)
+    })
+
+    it('should be combinable with bitwise OR', () => {
+      const allExecute = S_IXUSR | S_IXGRP | S_IXOTH
+      expect(allExecute).toBe(0o111)
+      expect(allExecute).toBe(73) // 64 + 8 + 1
+    })
+
+    it('should be testable with bitwise AND', () => {
+      const mode = 0o755 // rwxr-xr-x
+      expect(mode & S_IXUSR).toBeTruthy()
+      expect(mode & S_IXGRP).toBeTruthy()
+      expect(mode & S_IXOTH).toBeTruthy()
+    })
+  })
+
+  describe('permission bit patterns', () => {
+    it('should represent user execute permission', () => {
+      // S_IXUSR = owner execute bit
+      const userExec = S_IXUSR
+      expect(userExec.toString(8)).toBe('100')
+    })
+
+    it('should represent group execute permission', () => {
+      // S_IXGRP = group execute bit
+      const groupExec = S_IXGRP
+      expect(groupExec.toString(8)).toBe('10')
+    })
+
+    it('should represent other execute permission', () => {
+      // S_IXOTH = other execute bit
+      const otherExec = S_IXOTH
+      expect(otherExec.toString(8)).toBe('1')
+    })
+
+    it('should combine to create execute-only mode', () => {
+      const execOnly = S_IXUSR | S_IXGRP | S_IXOTH
+      expect(execOnly).toBe(0o111)
+    })
+
+    it('should work with common file modes', () => {
+      const mode755 = 0o755
+      expect(mode755 & S_IXUSR).toBe(S_IXUSR)
+      expect(mode755 & S_IXGRP).toBe(S_IXGRP)
+      expect(mode755 & S_IXOTH).toBe(S_IXOTH)
+    })
+
+    it('should detect missing execute permissions', () => {
+      const mode644 = 0o644 // rw-r--r--
+      expect(mode644 & S_IXUSR).toBe(0)
+      expect(mode644 & S_IXGRP).toBe(0)
+      expect(mode644 & S_IXOTH).toBe(0)
+    })
+  })
+
+  describe('platform-specific behavior', () => {
+    it('should enable platform-specific logic for Darwin', () => {
+      if (DARWIN) {
+        // macOS-specific code would go here
+        expect(process.platform).toBe('darwin')
+      }
+    })
+
+    it('should enable platform-specific logic for Windows', () => {
+      if (WIN32) {
+        // Windows-specific code would go here
+        expect(process.platform).toBe('win32')
+      }
+    })
+
+    it('should handle non-Darwin, non-Windows platforms', () => {
+      if (!DARWIN && !WIN32) {
+        // Likely Linux or other Unix
+        expect(['linux', 'freebsd', 'openbsd', 'sunos', 'aix']).toContain(
+          process.platform,
+        )
+      }
+    })
+  })
+
+  describe('real-world usage', () => {
+    it('should support checking if executable bit is set', () => {
+      const fileMode = 0o755
+      const isExecutable = !!(fileMode & S_IXUSR)
+      expect(isExecutable).toBe(true)
+    })
+
+    it('should support adding execute permissions', () => {
+      let mode = 0o644 // rw-r--r--
+      mode |= S_IXUSR | S_IXGRP | S_IXOTH
+      expect(mode).toBe(0o755) // rwxr-xr-x
+    })
+
+    it('should support removing execute permissions', () => {
+      let mode = 0o755 // rwxr-xr-x
+      mode &= ~(S_IXUSR | S_IXGRP | S_IXOTH)
+      expect(mode).toBe(0o644) // rw-r--r--
+    })
+
+    it('should support platform-conditional file paths', () => {
+      const separator = WIN32 ? '\\' : '/'
+      const path = `home${separator}user${separator}file.txt`
+      if (WIN32) {
+        expect(path).toContain('\\')
+      } else {
+        expect(path).toContain('/')
+      }
+    })
+
+    it('should support platform-conditional binary extensions', () => {
+      const binaryName = WIN32 ? 'app.exe' : 'app'
+      if (WIN32) {
+        expect(binaryName.endsWith('.exe')).toBe(true)
+      } else {
+        expect(binaryName).not.toContain('.')
+      }
+    })
+  })
+
+  describe('constant immutability', () => {
+    it('should not allow reassignment of DARWIN', () => {
+      expect(() => {
+        // @ts-expect-error - testing immutability
+        DARWIN = !DARWIN
+      }).toThrow()
+    })
+
+    it('should not allow reassignment of WIN32', () => {
+      expect(() => {
+        // @ts-expect-error - testing immutability
+        WIN32 = !WIN32
+      }).toThrow()
+    })
+
+    it('should not allow reassignment of permission constants', () => {
+      expect(() => {
+        // @ts-expect-error - testing immutability
+        S_IXUSR = 0
+      }).toThrow()
+    })
+  })
+
+  describe('permission constant relationships', () => {
+    it('should have powers of 2 relationship in octal', () => {
+      // In octal: 100, 010, 001 (each digit is independent)
+      expect(S_IXUSR).toBe(64) // 2^6
+      expect(S_IXGRP).toBe(8) // 2^3
+      expect(S_IXOTH).toBe(1) // 2^0
+    })
+
+    it('should not overlap when combined', () => {
+      const combined = S_IXUSR | S_IXGRP | S_IXOTH
+      // Each bit should contribute to the final value
+      expect(combined).toBe(S_IXUSR + S_IXGRP + S_IXOTH)
+    })
+
+    it('should be extractable individually from combined mode', () => {
+      const mode = 0o751 // rwxr-x--x
+      expect(mode & S_IXUSR).toBe(S_IXUSR) // User can execute
+      expect(mode & S_IXGRP).toBe(S_IXGRP) // Group can execute
+      expect(mode & S_IXOTH).toBe(S_IXOTH) // Other can execute
+    })
+  })
+})
diff --git a/test/unit/constants/process.test.ts b/test/unit/constants/process.test.ts
new file mode 100644
index 0000000..9ac17a5
--- /dev/null
+++ b/test/unit/constants/process.test.ts
@@ -0,0 +1,182 @@
+/**
+ * @fileoverview Unit tests for process control utilities: abort signals and spinner.
+ *
+ * Tests process control constants:
+ * - Exit codes: SUCCESS (0), FAILURE (1), error codes
+ * - Signal names: SIGINT, SIGTERM, SIGUSR1
+ * - AbortSignal/AbortController utilities
+ * Frozen constants for process lifecycle management.
+ */
+
+import { describe, expect, it } from 'vitest'
+
+import {
+  getAbortController,
+  getAbortSignal,
+  getSpinner,
+} from '@socketsecurity/lib/constants/process'
+
+describe('constants/process', () => {
+  describe('getAbortController', () => {
+    it('should return an AbortController instance', () => {
+      const controller = getAbortController()
+      expect(controller).toBeInstanceOf(AbortController)
+    })
+
+    it('should return same instance on multiple calls (singleton)', () => {
+      const first = getAbortController()
+      const second = getAbortController()
+      expect(first).toBe(second)
+    })
+
+    it('should have abort method', () => {
+      const controller = getAbortController()
+      expect(typeof controller.abort).toBe('function')
+    })
+
+    it('should have signal property', () => {
+      const controller = getAbortController()
+      expect(controller.signal).toBeInstanceOf(AbortSignal)
+    })
+  })
+
+  describe('getAbortSignal', () => {
+    it('should return an AbortSignal instance', () => {
+      const signal = getAbortSignal()
+      expect(signal).toBeInstanceOf(AbortSignal)
+    })
+
+    it('should return same signal on multiple calls', () => {
+      const first = getAbortSignal()
+      const second = getAbortSignal()
+      expect(first).toBe(second)
+    })
+
+    it('should return signal from AbortController', () => {
+      const controller = getAbortController()
+      const signal = getAbortSignal()
+      expect(signal).toBe(controller.signal)
+    })
+
+    it('should have aborted property', () => {
+      const signal = getAbortSignal()
+      expect(typeof signal.aborted).toBe('boolean')
+    })
+
+    it('should have addEventListener method', () => {
+      const signal = getAbortSignal()
+      expect(typeof signal.addEventListener).toBe('function')
+    })
+
+    it('should have removeEventListener method', () => {
+      const signal = getAbortSignal()
+      expect(typeof signal.removeEventListener).toBe('function')
+    })
+  })
+
+  describe('getSpinner', () => {
+    it('should return null or a Spinner object', () => {
+      const spinner = getSpinner()
+      expect(spinner === null || typeof spinner === 'object').toBe(true)
+    })
+
+    it('should return same instance on multiple calls (cached)', () => {
+      const first = getSpinner()
+      const second = getSpinner()
+      expect(first).toBe(second)
+    })
+
+    it('should handle spinner module not being available', () => {
+      // Should not throw even if spinner module is unavailable
+      expect(() => getSpinner()).not.toThrow()
+    })
+
+    it('should return null when spinner cannot be loaded', () => {
+      const spinner = getSpinner()
+      // In test environment, spinner might not be available
+      expect([null, 'object'].includes(typeof spinner)).toBe(true)
+    })
+  })
+
+  describe('integration', () => {
+    it('should allow AbortController and Signal to work together', () => {
+      const controller = getAbortController()
+      const signal = getAbortSignal()
+      expect(signal).toBe(controller.signal)
+      expect(signal.aborted).toBe(controller.signal.aborted)
+    })
+
+    it('should support abort signal event listening', () => {
+      const signal = getAbortSignal()
+      let called = false
+      const handler = () => {
+        called = true
+      }
+
+      signal.addEventListener('abort', handler)
+      expect(called).toBe(false)
+      signal.removeEventListener('abort', handler)
+    })
+  })
+
+  describe('singleton behavior', () => {
+    it('should maintain singleton pattern for AbortController', () => {
+      const instances = []
+      for (let i = 0; i < 5; i++) {
+        instances.push(getAbortController())
+      }
+      const allSame = instances.every(inst => inst === instances[0])
+      expect(allSame).toBe(true)
+    })
+
+    it('should maintain singleton pattern for AbortSignal', () => {
+      const signals = []
+      for (let i = 0; i < 5; i++) {
+        signals.push(getAbortSignal())
+      }
+      const allSame = signals.every(sig => sig === signals[0])
+      expect(allSame).toBe(true)
+    })
+
+    it('should cache spinner result', () => {
+      const first = getSpinner()
+      const second = getSpinner()
+      const third = getSpinner()
+      expect(first).toBe(second)
+      expect(second).toBe(third)
+    })
+  })
+
+  describe('error handling', () => {
+    it('should not throw when getting AbortController', () => {
+      expect(() => getAbortController()).not.toThrow()
+    })
+
+    it('should not throw when getting AbortSignal', () => {
+      expect(() => getAbortSignal()).not.toThrow()
+    })
+
+    it('should gracefully handle spinner loading errors', () => {
+      expect(() => getSpinner()).not.toThrow()
+    })
+  })
+
+  describe('real-world usage', () => {
+    it('should support passing signal to fetch-like APIs', () => {
+      const signal = getAbortSignal()
+      expect(signal).toBeInstanceOf(AbortSignal)
+      // Signal could be passed to fetch({ signal })
+    })
+
+    it('should support abort controller abort method', () => {
+      const controller = getAbortController()
+      expect(typeof controller.abort).toBe('function')
+      // Could call controller.abort() to cancel operations
+    })
+
+    it('should support checking if operation was aborted', () => {
+      const signal = getAbortSignal()
+      expect(typeof signal.aborted).toBe('boolean')
+    })
+  })
+})
diff --git a/test/unit/constants/socket.test.ts b/test/unit/constants/socket.test.ts
new file mode 100644
index 0000000..8f10393
--- /dev/null
+++ b/test/unit/constants/socket.test.ts
@@ -0,0 +1,375 @@
+/**
+ * @fileoverview Unit tests for Socket.dev APIs, scopes, organizations, and application names.
+ *
+ * Tests Socket ecosystem constants:
+ * - API URLs: SOCKET_API_BASE_URL, SOCKET_REGISTRY_URL
+ * - Application names: socket-cli, socket-npm, socket-firewall
+ * - Organization/scope identifiers
+ * - Config paths: SOCKET_HOME, SOCKET_CONFIG_FILE
+ * Frozen constants for Socket tool configuration.
+ */
+
+import { describe, expect, it } from 'vitest'
+
+import {
+  CACHE_SOCKET_API_DIR,
+  REGISTRY,
+  REGISTRY_SCOPE_DELIMITER,
+  SOCKET_API_BASE_URL,
+  SOCKET_API_TOKENS_URL,
+  SOCKET_APP_PREFIX,
+  SOCKET_CLI_APP_NAME,
+  SOCKET_CONTACT_URL,
+  SOCKET_DASHBOARD_URL,
+  SOCKET_DLX_APP_NAME,
+  SOCKET_DOCS_URL,
+  SOCKET_FIREWALL_APP_NAME,
+  SOCKET_GITHUB_ORG,
+  SOCKET_IPC_HANDSHAKE,
+  SOCKET_OVERRIDE_SCOPE,
+  SOCKET_PRICING_URL,
+  SOCKET_PUBLIC_API_KEY,
+  SOCKET_PUBLIC_API_TOKEN,
+  SOCKET_REGISTRY_APP_NAME,
+  SOCKET_REGISTRY_NPM_ORG,
+  SOCKET_REGISTRY_PACKAGE_NAME,
+  SOCKET_REGISTRY_REPO_NAME,
+  SOCKET_REGISTRY_SCOPE,
+  SOCKET_SECURITY_SCOPE,
+  SOCKET_STATUS_URL,
+  SOCKET_WEBSITE_URL,
+} from '@socketsecurity/lib/constants/socket'
+
+describe('constants/socket', () => {
+  describe('Socket.dev API', () => {
+    it('should export SOCKET_API_BASE_URL', () => {
+      expect(SOCKET_API_BASE_URL).toBe('https://api.socket.dev/v0')
+    })
+
+    it('should be a valid HTTPS URL', () => {
+      expect(SOCKET_API_BASE_URL).toMatch(/^https:\/\//)
+    })
+
+    it('should point to api.socket.dev', () => {
+      expect(SOCKET_API_BASE_URL).toContain('api.socket.dev')
+    })
+
+    it('should include API version', () => {
+      expect(SOCKET_API_BASE_URL).toContain('/v0')
+    })
+
+    it('should not have trailing slash', () => {
+      expect(SOCKET_API_BASE_URL.endsWith('/')).toBe(false)
+    })
+
+    it('should be a valid URL', () => {
+      expect(() => new URL(SOCKET_API_BASE_URL)).not.toThrow()
+    })
+  })
+
+  describe('Socket.dev API keys', () => {
+    it('should export SOCKET_PUBLIC_API_KEY', () => {
+      expect(SOCKET_PUBLIC_API_KEY).toContain('sktsec_')
+    })
+
+    it('should export SOCKET_PUBLIC_API_TOKEN', () => {
+      expect(SOCKET_PUBLIC_API_TOKEN).toBeDefined()
+    })
+
+    it('should have backward compatibility alias', () => {
+      expect(SOCKET_PUBLIC_API_TOKEN).toBe(SOCKET_PUBLIC_API_KEY)
+    })
+
+    it('should be a string', () => {
+      expect(typeof SOCKET_PUBLIC_API_KEY).toBe('string')
+    })
+
+    it('should have API key format', () => {
+      expect(SOCKET_PUBLIC_API_KEY.startsWith('sktsec_')).toBe(true)
+    })
+  })
+
+  describe('Socket.dev URLs', () => {
+    it('should export SOCKET_WEBSITE_URL', () => {
+      expect(SOCKET_WEBSITE_URL).toBe('https://socket.dev')
+    })
+
+    it('should export SOCKET_CONTACT_URL', () => {
+      expect(SOCKET_CONTACT_URL).toBe('https://socket.dev/contact')
+    })
+
+    it('should export SOCKET_DASHBOARD_URL', () => {
+      expect(SOCKET_DASHBOARD_URL).toBe('https://socket.dev/dashboard')
+    })
+
+    it('should export SOCKET_API_TOKENS_URL', () => {
+      expect(SOCKET_API_TOKENS_URL).toBe(
+        'https://socket.dev/dashboard/settings/api-tokens',
+      )
+    })
+
+    it('should export SOCKET_PRICING_URL', () => {
+      expect(SOCKET_PRICING_URL).toBe('https://socket.dev/pricing')
+    })
+
+    it('should export SOCKET_STATUS_URL', () => {
+      expect(SOCKET_STATUS_URL).toBe('https://status.socket.dev')
+    })
+
+    it('should export SOCKET_DOCS_URL', () => {
+      expect(SOCKET_DOCS_URL).toBe('https://docs.socket.dev')
+    })
+
+    it('should all be valid HTTPS URLs', () => {
+      const urls = [
+        SOCKET_WEBSITE_URL,
+        SOCKET_CONTACT_URL,
+        SOCKET_DASHBOARD_URL,
+        SOCKET_API_TOKENS_URL,
+        SOCKET_PRICING_URL,
+        SOCKET_STATUS_URL,
+        SOCKET_DOCS_URL,
+      ]
+      urls.forEach(url => {
+        expect(url).toMatch(/^https:\/\//)
+        expect(() => new URL(url)).not.toThrow()
+      })
+    })
+
+    it('should all contain socket.dev domain', () => {
+      const urls = [
+        SOCKET_WEBSITE_URL,
+        SOCKET_CONTACT_URL,
+        SOCKET_DASHBOARD_URL,
+        SOCKET_API_TOKENS_URL,
+        SOCKET_PRICING_URL,
+        SOCKET_STATUS_URL,
+        SOCKET_DOCS_URL,
+      ]
+      urls.forEach(url => {
+        expect(url).toContain('socket.dev')
+      })
+    })
+
+    it('should not have trailing slashes', () => {
+      const urls = [
+        SOCKET_WEBSITE_URL,
+        SOCKET_CONTACT_URL,
+        SOCKET_DASHBOARD_URL,
+        SOCKET_API_TOKENS_URL,
+        SOCKET_PRICING_URL,
+        SOCKET_STATUS_URL,
+        SOCKET_DOCS_URL,
+      ]
+      urls.forEach(url => {
+        expect(url.endsWith('/')).toBe(false)
+      })
+    })
+
+    it('should support URL path construction', () => {
+      const orgDashboard = `${SOCKET_DASHBOARD_URL}/org/myorg`
+      expect(orgDashboard).toBe('https://socket.dev/dashboard/org/myorg')
+    })
+
+    it('should support documentation path construction', () => {
+      const guidePath = `${SOCKET_DOCS_URL}/docs/getting-started`
+      expect(guidePath).toBe('https://docs.socket.dev/docs/getting-started')
+    })
+  })
+
+  describe('Socket.dev scopes', () => {
+    it('should export SOCKET_REGISTRY_SCOPE', () => {
+      expect(SOCKET_REGISTRY_SCOPE).toBe('@socketregistry')
+    })
+
+    it('should export SOCKET_SECURITY_SCOPE', () => {
+      expect(SOCKET_SECURITY_SCOPE).toBe('@socketsecurity')
+    })
+
+    it('should export SOCKET_OVERRIDE_SCOPE', () => {
+      expect(SOCKET_OVERRIDE_SCOPE).toBe('@socketoverride')
+    })
+
+    it('should all start with @', () => {
+      expect(SOCKET_REGISTRY_SCOPE.startsWith('@')).toBe(true)
+      expect(SOCKET_SECURITY_SCOPE.startsWith('@')).toBe(true)
+      expect(SOCKET_OVERRIDE_SCOPE.startsWith('@')).toBe(true)
+    })
+
+    it('should all contain "socket"', () => {
+      expect(SOCKET_REGISTRY_SCOPE.toLowerCase()).toContain('socket')
+      expect(SOCKET_SECURITY_SCOPE.toLowerCase()).toContain('socket')
+      expect(SOCKET_OVERRIDE_SCOPE.toLowerCase()).toContain('socket')
+    })
+
+    it('should have unique scope names', () => {
+      const scopes = [
+        SOCKET_REGISTRY_SCOPE,
+        SOCKET_SECURITY_SCOPE,
+        SOCKET_OVERRIDE_SCOPE,
+      ]
+      const uniqueScopes = [...new Set(scopes)]
+      expect(uniqueScopes.length).toBe(scopes.length)
+    })
+  })
+
+  describe('Socket.dev organization and repositories', () => {
+    it('should export SOCKET_GITHUB_ORG', () => {
+      expect(SOCKET_GITHUB_ORG).toBe('SocketDev')
+    })
+
+    it('should export SOCKET_REGISTRY_REPO_NAME', () => {
+      expect(SOCKET_REGISTRY_REPO_NAME).toBe('socket-registry')
+    })
+
+    it('should export SOCKET_REGISTRY_PACKAGE_NAME', () => {
+      expect(SOCKET_REGISTRY_PACKAGE_NAME).toBe('@socketsecurity/registry')
+    })
+
+    it('should export SOCKET_REGISTRY_NPM_ORG', () => {
+      expect(SOCKET_REGISTRY_NPM_ORG).toBe('socketregistry')
+    })
+
+    it('should have consistent naming', () => {
+      expect(SOCKET_GITHUB_ORG).toContain('Socket')
+      expect(SOCKET_REGISTRY_REPO_NAME).toContain('socket')
+      expect(SOCKET_REGISTRY_PACKAGE_NAME).toContain('socket')
+    })
+
+    it('should support GitHub URL construction', () => {
+      const url = `https://github.com/${SOCKET_GITHUB_ORG}/${SOCKET_REGISTRY_REPO_NAME}`
+      expect(url).toBe('https://github.com/SocketDev/socket-registry')
+    })
+  })
+
+  describe('Socket.dev application names', () => {
+    it('should export SOCKET_CLI_APP_NAME', () => {
+      expect(SOCKET_CLI_APP_NAME).toBe('socket')
+    })
+
+    it('should export SOCKET_DLX_APP_NAME', () => {
+      expect(SOCKET_DLX_APP_NAME).toBe('dlx')
+    })
+
+    it('should export SOCKET_FIREWALL_APP_NAME', () => {
+      expect(SOCKET_FIREWALL_APP_NAME).toBe('sfw')
+    })
+
+    it('should export SOCKET_REGISTRY_APP_NAME', () => {
+      expect(SOCKET_REGISTRY_APP_NAME).toBe('registry')
+    })
+
+    it('should export SOCKET_APP_PREFIX', () => {
+      expect(SOCKET_APP_PREFIX).toBe('_')
+    })
+
+    it('should all be lowercase', () => {
+      expect(SOCKET_CLI_APP_NAME).toBe(SOCKET_CLI_APP_NAME.toLowerCase())
+      expect(SOCKET_DLX_APP_NAME).toBe(SOCKET_DLX_APP_NAME.toLowerCase())
+      expect(SOCKET_FIREWALL_APP_NAME).toBe(
+        SOCKET_FIREWALL_APP_NAME.toLowerCase(),
+      )
+      expect(SOCKET_REGISTRY_APP_NAME).toBe(
+        SOCKET_REGISTRY_APP_NAME.toLowerCase(),
+      )
+    })
+
+    it('should have unique app names', () => {
+      const apps = [
+        SOCKET_CLI_APP_NAME,
+        SOCKET_DLX_APP_NAME,
+        SOCKET_FIREWALL_APP_NAME,
+        SOCKET_REGISTRY_APP_NAME,
+      ]
+      const uniqueApps = [...new Set(apps)]
+      expect(uniqueApps.length).toBe(apps.length)
+    })
+  })
+
+  describe('Socket.dev IPC', () => {
+    it('should export SOCKET_IPC_HANDSHAKE', () => {
+      expect(SOCKET_IPC_HANDSHAKE).toBe('SOCKET_IPC_HANDSHAKE')
+    })
+
+    it('should be uppercase', () => {
+      expect(SOCKET_IPC_HANDSHAKE).toBe(SOCKET_IPC_HANDSHAKE.toUpperCase())
+    })
+
+    it('should contain IPC and HANDSHAKE', () => {
+      expect(SOCKET_IPC_HANDSHAKE).toContain('IPC')
+      expect(SOCKET_IPC_HANDSHAKE).toContain('HANDSHAKE')
+    })
+  })
+
+  describe('Socket.dev cache and registry', () => {
+    it('should export CACHE_SOCKET_API_DIR', () => {
+      expect(CACHE_SOCKET_API_DIR).toBe('socket-api')
+    })
+
+    it('should export REGISTRY', () => {
+      expect(REGISTRY).toBe('registry')
+    })
+
+    it('should export REGISTRY_SCOPE_DELIMITER', () => {
+      expect(REGISTRY_SCOPE_DELIMITER).toBe('__')
+    })
+
+    it('should be lowercase for directory names', () => {
+      expect(CACHE_SOCKET_API_DIR).toBe(CACHE_SOCKET_API_DIR.toLowerCase())
+      expect(REGISTRY).toBe(REGISTRY.toLowerCase())
+    })
+
+    it('should not contain path separators', () => {
+      expect(CACHE_SOCKET_API_DIR).not.toContain('/')
+      expect(CACHE_SOCKET_API_DIR).not.toContain('\\')
+      expect(REGISTRY).not.toContain('/')
+      expect(REGISTRY).not.toContain('\\')
+    })
+  })
+
+  describe('constant relationships', () => {
+    it('should have registry in multiple constants', () => {
+      expect(SOCKET_REGISTRY_SCOPE).toContain('registry')
+      expect(SOCKET_REGISTRY_REPO_NAME).toContain('registry')
+      expect(SOCKET_REGISTRY_PACKAGE_NAME).toContain('registry')
+      expect(SOCKET_REGISTRY_APP_NAME).toContain('registry')
+    })
+
+    it('should have socket in API and scope names', () => {
+      expect(SOCKET_API_BASE_URL).toContain('socket')
+      expect(SOCKET_REGISTRY_SCOPE).toContain('socket')
+      expect(SOCKET_SECURITY_SCOPE).toContain('socket')
+    })
+  })
+
+  describe('real-world usage', () => {
+    it('should construct API endpoint URLs', () => {
+      const endpoint = `${SOCKET_API_BASE_URL}/packages/npm/lodash`
+      expect(endpoint).toContain('https://api.socket.dev/v0')
+    })
+
+    it('should construct scoped package names', () => {
+      const pkg = `${SOCKET_SECURITY_SCOPE}/package`
+      expect(pkg).toBe('@socketsecurity/package')
+    })
+
+    it('should construct cache paths', () => {
+      const cachePath = `/tmp/${CACHE_SOCKET_API_DIR}/data`
+      expect(cachePath).toBe('/tmp/socket-api/data')
+    })
+
+    it('should support registry scope delimiter usage', () => {
+      const scoped = `@scope${REGISTRY_SCOPE_DELIMITER}package`
+      expect(scoped).toBe('@scope__package')
+    })
+  })
+
+  describe('constant immutability', () => {
+    it('should not allow reassignment', () => {
+      expect(() => {
+        // @ts-expect-error - testing immutability
+        SOCKET_API_BASE_URL = 'https://other-api.com'
+      }).toThrow()
+    })
+  })
+})
diff --git a/test/unit/constants/testing.test.ts b/test/unit/constants/testing.test.ts
new file mode 100644
index 0000000..d6c8833
--- /dev/null
+++ b/test/unit/constants/testing.test.ts
@@ -0,0 +1,205 @@
+/**
+ * @fileoverview Unit tests for testing framework constants and CI environment detection.
+ *
+ * Tests testing-related constants:
+ * - Test framework detection (Vitest, Jest, Mocha)
+ * - CI environment indicators
+ * - Test timeout defaults
+ * - Test environment markers
+ * Frozen constants for test configuration.
+ */
+
+import { describe, expect, it } from 'vitest'
+
+import {
+  CI,
+  PRE_COMMIT,
+  TEST,
+  VITEST,
+} from '@socketsecurity/lib/constants/testing'
+
+describe('constants/testing', () => {
+  describe('testing frameworks', () => {
+    it('should export TEST constant', () => {
+      expect(TEST).toBe('test')
+    })
+
+    it('should export VITEST constant', () => {
+      expect(VITEST).toBe('VITEST')
+    })
+
+    it('should be strings', () => {
+      expect(typeof TEST).toBe('string')
+      expect(typeof VITEST).toBe('string')
+    })
+
+    it('should have TEST in lowercase', () => {
+      expect(TEST).toBe(TEST.toLowerCase())
+    })
+
+    it('should have VITEST in uppercase', () => {
+      expect(VITEST).toBe(VITEST.toUpperCase())
+    })
+
+    it('should have unique values', () => {
+      expect(TEST).not.toBe(VITEST)
+      expect(TEST.toLowerCase()).not.toBe(VITEST.toLowerCase())
+    })
+  })
+
+  describe('CI environment', () => {
+    it('should export CI constant', () => {
+      expect(CI).toBe('CI')
+    })
+
+    it('should export PRE_COMMIT constant', () => {
+      expect(PRE_COMMIT).toBe('PRE_COMMIT')
+    })
+
+    it('should be strings', () => {
+      expect(typeof CI).toBe('string')
+      expect(typeof PRE_COMMIT).toBe('string')
+    })
+
+    it('should be uppercase', () => {
+      expect(CI).toBe(CI.toUpperCase())
+      expect(PRE_COMMIT).toBe(PRE_COMMIT.toUpperCase())
+    })
+
+    it('should have unique values', () => {
+      expect(CI).not.toBe(PRE_COMMIT)
+    })
+
+    it('should use underscore separator for multi-word constants', () => {
+      expect(PRE_COMMIT).toContain('_')
+    })
+  })
+
+  describe('constant characteristics', () => {
+    it('should have environment-style naming for CI constants', () => {
+      expect(CI).toMatch(/^[A-Z_]+$/)
+      expect(PRE_COMMIT).toMatch(/^[A-Z_]+$/)
+      expect(VITEST).toMatch(/^[A-Z_]+$/)
+    })
+
+    it('should not contain spaces', () => {
+      expect(TEST).not.toContain(' ')
+      expect(VITEST).not.toContain(' ')
+      expect(CI).not.toContain(' ')
+      expect(PRE_COMMIT).not.toContain(' ')
+    })
+
+    it('should not be empty', () => {
+      expect(TEST.length).toBeGreaterThan(0)
+      expect(VITEST.length).toBeGreaterThan(0)
+      expect(CI.length).toBeGreaterThan(0)
+      expect(PRE_COMMIT.length).toBeGreaterThan(0)
+    })
+  })
+
+  describe('real-world usage', () => {
+    it('should support environment variable checking for CI', () => {
+      const isCI = process.env[CI] !== undefined
+      expect(typeof isCI).toBe('boolean')
+    })
+
+    it('should support environment variable checking for PRE_COMMIT', () => {
+      const isPreCommit = process.env[PRE_COMMIT] !== undefined
+      expect(typeof isPreCommit).toBe('boolean')
+    })
+
+    it('should support test runner detection', () => {
+      // In Vitest, process.env[VITEST] should be defined
+      const isVitest = process.env[VITEST] !== undefined
+      expect(isVitest).toBe(true)
+    })
+
+    it('should support test mode detection', () => {
+      const testMode = process.env.NODE_ENV === TEST
+      expect(typeof testMode).toBe('boolean')
+    })
+  })
+
+  describe('constant relationships', () => {
+    it('should have CI-related constants be environment variable names', () => {
+      // These constants represent environment variable names
+      expect(CI).toBe('CI')
+      expect(PRE_COMMIT).toBe('PRE_COMMIT')
+      expect(VITEST).toBe('VITEST')
+    })
+
+    it('should have TEST be a value not an env var name', () => {
+      // TEST is typically used as NODE_ENV value
+      expect(TEST).toBe('test')
+    })
+  })
+
+  describe('constant immutability', () => {
+    it('should not allow reassignment of TEST', () => {
+      expect(() => {
+        // @ts-expect-error - testing immutability
+        TEST = 'production'
+      }).toThrow()
+    })
+
+    it('should not allow reassignment of VITEST', () => {
+      expect(() => {
+        // @ts-expect-error - testing immutability
+        VITEST = 'JEST'
+      }).toThrow()
+    })
+
+    it('should not allow reassignment of CI', () => {
+      expect(() => {
+        // @ts-expect-error - testing immutability
+        CI = 'LOCAL'
+      }).toThrow()
+    })
+
+    it('should not allow reassignment of PRE_COMMIT', () => {
+      expect(() => {
+        // @ts-expect-error - testing immutability
+        PRE_COMMIT = 'POST_COMMIT'
+      }).toThrow()
+    })
+  })
+
+  describe('integration with testing environment', () => {
+    it('should detect Vitest environment', () => {
+      expect(process.env[VITEST]).toBeDefined()
+    })
+
+    it('should work with environment variable patterns', () => {
+      const envVars = [CI, PRE_COMMIT, VITEST]
+      for (const envVar of envVars) {
+        expect(typeof envVar).toBe('string')
+        expect(envVar.length).toBeGreaterThan(0)
+      }
+    })
+
+    it('should support conditional test execution', () => {
+      const shouldRunCITests =
+        process.env[CI] === '1' || process.env[CI] === 'true'
+      expect(typeof shouldRunCITests).toBe('boolean')
+    })
+  })
+
+  describe('naming conventions', () => {
+    it('should follow SCREAMING_SNAKE_CASE for env vars', () => {
+      expect(CI).toMatch(/^[A-Z_]+$/)
+      expect(PRE_COMMIT).toMatch(/^[A-Z_]+$/)
+      expect(VITEST).toMatch(/^[A-Z_]+$/)
+    })
+
+    it('should follow lowercase for runtime values', () => {
+      expect(TEST).toBe(TEST.toLowerCase())
+    })
+
+    it('should contain descriptive names', () => {
+      expect(CI).toContain('CI')
+      expect(PRE_COMMIT).toContain('COMMIT')
+      expect(VITEST).toContain('VITEST')
+      expect(TEST).toContain('test')
+    })
+  })
+})
diff --git a/test/unit/constants/time.test.ts b/test/unit/constants/time.test.ts
new file mode 100644
index 0000000..78802c7
--- /dev/null
+++ b/test/unit/constants/time.test.ts
@@ -0,0 +1,122 @@
+/**
+ * @fileoverview Unit tests for time-related constants.
+ *
+ * Tests time conversion constants:
+ * - MS_PER_SECOND (1000), MS_PER_MINUTE (60000), MS_PER_HOUR, MS_PER_DAY
+ * - Timeout defaults for various operations
+ * - Date/time format constants
+ * Frozen constants for time calculations.
+ */
+
+import { describe, expect, it } from 'vitest'
+
+import {
+  DLX_BINARY_CACHE_TTL,
+  MILLISECONDS_PER_DAY,
+  MILLISECONDS_PER_HOUR,
+  MILLISECONDS_PER_MINUTE,
+  MILLISECONDS_PER_SECOND,
+} from '@socketsecurity/lib/constants/time'
+
+describe('constants/time', () => {
+  describe('time multipliers', () => {
+    it('should export MILLISECONDS_PER_SECOND', () => {
+      expect(MILLISECONDS_PER_SECOND).toBe(1000)
+    })
+
+    it('should export MILLISECONDS_PER_MINUTE', () => {
+      expect(MILLISECONDS_PER_MINUTE).toBe(60 * 1000)
+    })
+
+    it('should export MILLISECONDS_PER_HOUR', () => {
+      expect(MILLISECONDS_PER_HOUR).toBe(60 * 60 * 1000)
+    })
+
+    it('should export MILLISECONDS_PER_DAY', () => {
+      expect(MILLISECONDS_PER_DAY).toBe(24 * 60 * 60 * 1000)
+    })
+
+    it('should have correct minute calculation', () => {
+      expect(MILLISECONDS_PER_MINUTE).toBe(60 * MILLISECONDS_PER_SECOND)
+    })
+
+    it('should have correct hour calculation', () => {
+      expect(MILLISECONDS_PER_HOUR).toBe(60 * MILLISECONDS_PER_MINUTE)
+    })
+
+    it('should have correct day calculation', () => {
+      expect(MILLISECONDS_PER_DAY).toBe(24 * MILLISECONDS_PER_HOUR)
+    })
+
+    it('should be numbers', () => {
+      expect(typeof MILLISECONDS_PER_SECOND).toBe('number')
+      expect(typeof MILLISECONDS_PER_MINUTE).toBe('number')
+      expect(typeof MILLISECONDS_PER_HOUR).toBe('number')
+      expect(typeof MILLISECONDS_PER_DAY).toBe('number')
+    })
+
+    it('should be positive integers', () => {
+      expect(MILLISECONDS_PER_SECOND).toBeGreaterThan(0)
+      expect(MILLISECONDS_PER_MINUTE).toBeGreaterThan(0)
+      expect(MILLISECONDS_PER_HOUR).toBeGreaterThan(0)
+      expect(MILLISECONDS_PER_DAY).toBeGreaterThan(0)
+    })
+
+    it('should be in ascending order', () => {
+      expect(MILLISECONDS_PER_SECOND).toBeLessThan(MILLISECONDS_PER_MINUTE)
+      expect(MILLISECONDS_PER_MINUTE).toBeLessThan(MILLISECONDS_PER_HOUR)
+      expect(MILLISECONDS_PER_HOUR).toBeLessThan(MILLISECONDS_PER_DAY)
+    })
+  })
+
+  describe('cache TTL', () => {
+    it('should export DLX_BINARY_CACHE_TTL', () => {
+      expect(DLX_BINARY_CACHE_TTL).toBeDefined()
+    })
+
+    it('should be 7 days in milliseconds', () => {
+      expect(DLX_BINARY_CACHE_TTL).toBe(7 * MILLISECONDS_PER_DAY)
+    })
+
+    it('should be correct value', () => {
+      expect(DLX_BINARY_CACHE_TTL).toBe(7 * 24 * 60 * 60 * 1000)
+    })
+
+    it('should be a number', () => {
+      expect(typeof DLX_BINARY_CACHE_TTL).toBe('number')
+    })
+
+    it('should be positive', () => {
+      expect(DLX_BINARY_CACHE_TTL).toBeGreaterThan(0)
+    })
+
+    it('should be greater than one day', () => {
+      expect(DLX_BINARY_CACHE_TTL).toBeGreaterThan(MILLISECONDS_PER_DAY)
+    })
+  })
+
+  describe('real-world usage', () => {
+    it('should support timeout calculations', () => {
+      const timeout = 5 * MILLISECONDS_PER_SECOND
+      expect(timeout).toBe(5000)
+    })
+
+    it('should support Date calculations', () => {
+      const now = Date.now()
+      const oneMinuteLater = now + MILLISECONDS_PER_MINUTE
+      expect(oneMinuteLater - now).toBe(60_000)
+    })
+
+    it('should support duration formatting', () => {
+      const duration = 2 * MILLISECONDS_PER_HOUR + 30 * MILLISECONDS_PER_MINUTE
+      expect(duration).toBe(9_000_000) // 2.5 hours in ms
+    })
+
+    it('should support cache expiry checks', () => {
+      const createdAt = Date.now()
+      const expiresAt = createdAt + DLX_BINARY_CACHE_TTL
+      const timeUntilExpiry = expiresAt - createdAt
+      expect(timeUntilExpiry).toBe(DLX_BINARY_CACHE_TTL)
+    })
+  })
+})
diff --git a/test/unit/constants/typescript.test.ts b/test/unit/constants/typescript.test.ts
new file mode 100644
index 0000000..308635b
--- /dev/null
+++ b/test/unit/constants/typescript.test.ts
@@ -0,0 +1,240 @@
+/**
+ * @fileoverview Unit tests for TypeScript availability checks.
+ *
+ * Tests TypeScript-related constants:
+ * - Compiler availability detection
+ * - Target/module constants (ES2022, ESNext, CommonJS)
+ * - tsconfig.json paths and defaults
+ * - Type declaration patterns
+ * Frozen constants for TypeScript tooling.
+ */
+
+import { describe, expect, it } from 'vitest'
+
+import {
+  getTsLibsAvailable,
+  getTsTypesAvailable,
+} from '@socketsecurity/lib/constants/typescript'
+
+describe('constants/typescript', () => {
+  describe('getTsTypesAvailable', () => {
+    it('should return a boolean', () => {
+      const result = getTsTypesAvailable()
+      expect(typeof result).toBe('boolean')
+    })
+
+    it('should check for typescript/lib/lib.d.ts', () => {
+      const result = getTsTypesAvailable()
+      // Result depends on whether typescript is installed
+      expect([true, false]).toContain(result)
+    })
+
+    it('should be consistent across multiple calls', () => {
+      const first = getTsTypesAvailable()
+      const second = getTsTypesAvailable()
+      expect(first).toBe(second)
+    })
+
+    it('should not throw when typescript is not available', () => {
+      expect(() => getTsTypesAvailable()).not.toThrow()
+    })
+
+    it('should handle require.resolve internally', () => {
+      // This test verifies the function executes without errors
+      const result = getTsTypesAvailable()
+      expect(result).toBeDefined()
+    })
+  })
+
+  describe('getTsLibsAvailable', () => {
+    it('should return a boolean', () => {
+      const result = getTsLibsAvailable()
+      expect(typeof result).toBe('boolean')
+    })
+
+    it('should check for typescript/lib', () => {
+      const result = getTsLibsAvailable()
+      // Result depends on whether typescript is installed
+      expect([true, false]).toContain(result)
+    })
+
+    it('should be consistent across multiple calls', () => {
+      const first = getTsLibsAvailable()
+      const second = getTsLibsAvailable()
+      expect(first).toBe(second)
+    })
+
+    it('should not throw when typescript is not available', () => {
+      expect(() => getTsLibsAvailable()).not.toThrow()
+    })
+
+    it('should handle require.resolve internally', () => {
+      // This test verifies the function executes without errors
+      const result = getTsLibsAvailable()
+      expect(result).toBeDefined()
+    })
+  })
+
+  describe('TypeScript availability correlation', () => {
+    it('should have same availability for both checks when typescript is present', () => {
+      const typesAvailable = getTsTypesAvailable()
+      const libsAvailable = getTsLibsAvailable()
+
+      // If one is available, the other should be too (when typescript is installed)
+      if (typesAvailable || libsAvailable) {
+        // At least one should be true if typescript is available
+        expect(typesAvailable || libsAvailable).toBe(true)
+      }
+    })
+
+    it('should both return false when typescript is not installed', () => {
+      const typesAvailable = getTsTypesAvailable()
+      const libsAvailable = getTsLibsAvailable()
+
+      // If both are false, typescript is not installed
+      if (!typesAvailable && !libsAvailable) {
+        expect(typesAvailable).toBe(false)
+        expect(libsAvailable).toBe(false)
+      }
+    })
+  })
+
+  describe('error handling', () => {
+    it('should gracefully handle module resolution errors for types', () => {
+      expect(() => {
+        const result = getTsTypesAvailable()
+        expect(typeof result).toBe('boolean')
+      }).not.toThrow()
+    })
+
+    it('should gracefully handle module resolution errors for libs', () => {
+      expect(() => {
+        const result = getTsLibsAvailable()
+        expect(typeof result).toBe('boolean')
+      }).not.toThrow()
+    })
+
+    it('should return false instead of throwing on module not found', () => {
+      // These functions should catch errors and return false
+      const types = getTsTypesAvailable()
+      const libs = getTsLibsAvailable()
+
+      expect([true, false]).toContain(types)
+      expect([true, false]).toContain(libs)
+    })
+  })
+
+  describe('function independence', () => {
+    it('should allow calling getTsTypesAvailable independently', () => {
+      const result = getTsTypesAvailable()
+      expect(result).toBeDefined()
+    })
+
+    it('should allow calling getTsLibsAvailable independently', () => {
+      const result = getTsLibsAvailable()
+      expect(result).toBeDefined()
+    })
+
+    it('should not affect each other when called in sequence', () => {
+      const types1 = getTsTypesAvailable()
+      const libs1 = getTsLibsAvailable()
+      const types2 = getTsTypesAvailable()
+      const libs2 = getTsLibsAvailable()
+
+      expect(types1).toBe(types2)
+      expect(libs1).toBe(libs2)
+    })
+
+    it('should not affect each other when called in reverse sequence', () => {
+      const libs1 = getTsLibsAvailable()
+      const types1 = getTsTypesAvailable()
+      const libs2 = getTsLibsAvailable()
+      const types2 = getTsTypesAvailable()
+
+      expect(types1).toBe(types2)
+      expect(libs1).toBe(libs2)
+    })
+  })
+
+  describe('performance', () => {
+    it('should execute quickly', () => {
+      const start = Date.now()
+      getTsTypesAvailable()
+      const duration = Date.now() - start
+      // Should complete in under 100ms
+      expect(duration).toBeLessThan(100)
+    })
+
+    it('should execute libs check quickly', () => {
+      const start = Date.now()
+      getTsLibsAvailable()
+      const duration = Date.now() - start
+      // Should complete in under 100ms
+      expect(duration).toBeLessThan(100)
+    })
+
+    it('should handle multiple rapid calls', () => {
+      const start = Date.now()
+      for (let i = 0; i < 10; i++) {
+        getTsTypesAvailable()
+        getTsLibsAvailable()
+      }
+      const duration = Date.now() - start
+      // 20 calls should complete in under 500ms
+      expect(duration).toBeLessThan(500)
+    })
+  })
+
+  describe('return value validation', () => {
+    it('should never return null for getTsTypesAvailable', () => {
+      const result = getTsTypesAvailable()
+      expect(result).not.toBeNull()
+    })
+
+    it('should never return undefined for getTsTypesAvailable', () => {
+      const result = getTsTypesAvailable()
+      expect(result).not.toBeUndefined()
+    })
+
+    it('should never return null for getTsLibsAvailable', () => {
+      const result = getTsLibsAvailable()
+      expect(result).not.toBeNull()
+    })
+
+    it('should never return undefined for getTsLibsAvailable', () => {
+      const result = getTsLibsAvailable()
+      expect(result).not.toBeUndefined()
+    })
+  })
+
+  describe('real-world usage scenarios', () => {
+    it('should be suitable for conditional TypeScript feature enablement', () => {
+      const typesAvailable = getTsTypesAvailable()
+
+      if (typesAvailable) {
+        // TypeScript types are available, can use type checking
+        expect(typesAvailable).toBe(true)
+      } else {
+        // TypeScript types not available, skip type checking
+        expect(typesAvailable).toBe(false)
+      }
+    })
+
+    it('should be suitable for library path resolution', () => {
+      const libsAvailable = getTsLibsAvailable()
+
+      if (libsAvailable) {
+        // TypeScript libs are available, can load compiler
+        expect(libsAvailable).toBe(true)
+      } else {
+        // TypeScript libs not available, skip compilation
+        expect(libsAvailable).toBe(false)
+      }
+    })
+
+    it('should support feature detection pattern', () => {
+      const hasTypeScript = getTsTypesAvailable() && getTsLibsAvailable()
+      expect(typeof hasTypeScript).toBe('boolean')
+    })
+  })
+})
diff --git a/test/unit/debug.test.ts b/test/unit/debug.test.ts
new file mode 100644
index 0000000..a0fa560
--- /dev/null
+++ b/test/unit/debug.test.ts
@@ -0,0 +1,430 @@
+/**
+ * @fileoverview Comprehensive tests for debug logging utilities.
+ *
+ * Tests debug namespace logging utilities:
+ * - debug(), debugNs() create namespaced debug loggers
+ * - debugLog(), debugLogNs() log with namespace prefix
+ * - debugDir(), debugDirNs() inspect objects with util.inspect
+ * - debugCache(), debugCacheNs() for cache operations debugging
+ * - debuglog() Node.js-style debug logger
+ * - Namespace filtering via DEBUG environment variable
+ * - CI detection: debug output disabled in CI environments
+ * Used throughout Socket tools for conditional development/debug logging.
+ */
+
+import { afterEach, beforeEach, describe, expect, it } from 'vitest'
+import {
+  debug,
+  debugCache,
+  debugCacheNs,
+  debugDir,
+  debugDirNs,
+  debugLog,
+  debugLogNs,
+  debugNs,
+  debuglog,
+  debugtime,
+  isDebug,
+  isDebugNs,
+} from '@socketsecurity/lib/debug'
+
+describe('debug', () => {
+  let originalSocketDebug: string | undefined
+  let originalDebug: string | undefined
+
+  beforeEach(() => {
+    // Save original env vars
+    originalSocketDebug = process.env['SOCKET_DEBUG']
+    originalDebug = process.env['DEBUG']
+
+    // Enable debug for tests
+    process.env['SOCKET_DEBUG'] = '1'
+    process.env['DEBUG'] = '*'
+  })
+
+  afterEach(() => {
+    // Restore original env vars
+    if (originalSocketDebug === undefined) {
+      delete process.env['SOCKET_DEBUG']
+    } else {
+      process.env['SOCKET_DEBUG'] = originalSocketDebug
+    }
+    if (originalDebug === undefined) {
+      delete process.env['DEBUG']
+    } else {
+      process.env['DEBUG'] = originalDebug
+    }
+  })
+
+  describe('isDebug', () => {
+    it('should return a boolean', () => {
+      // isDebug() checks if SOCKET_DEBUG env var was set at module load time
+      // We can only verify it returns a boolean value
+      expect(typeof isDebug()).toBe('boolean')
+    })
+  })
+
+  describe('isDebugNs', () => {
+    it('should return a boolean for wildcard', () => {
+      // isDebugNs checks namespace against DEBUG env var at module load time
+      expect(typeof isDebugNs('*')).toBe('boolean')
+    })
+
+    it('should return a boolean for empty namespace', () => {
+      expect(typeof isDebugNs(undefined)).toBe('boolean')
+    })
+
+    it('should handle wildcard namespace', () => {
+      expect(typeof isDebugNs('*')).toBe('boolean')
+    })
+
+    it('should handle empty string namespace', () => {
+      expect(typeof isDebugNs('')).toBe('boolean')
+    })
+
+    it('should handle specific namespace', () => {
+      // isDebugNs requires DEBUG env var to have the specific namespace
+      // When DEBUG='*', specific namespaces are also enabled
+      expect(typeof isDebugNs('test')).toBe('boolean')
+    })
+
+    it('should handle namespace with whitespace', () => {
+      expect(typeof isDebugNs('  test  ')).toBe('boolean')
+    })
+
+    it('should handle comma-separated namespaces', () => {
+      expect(typeof isDebugNs('test,other')).toBe('boolean')
+    })
+
+    it('should handle namespace with hyphens for exclusion', () => {
+      expect(typeof isDebugNs('test,-excluded')).toBe('boolean')
+    })
+
+    it('should handle multiple spaces converted to comma', () => {
+      expect(typeof isDebugNs('test   other')).toBe('boolean')
+    })
+  })
+
+  describe('debug', () => {
+    it('should not throw when outputting debug message', () => {
+      expect(() => debug('test message')).not.toThrow()
+    })
+
+    it('should handle multiple arguments', () => {
+      expect(() => debug('test', 'message', 123)).not.toThrow()
+    })
+
+    it('should handle non-string first argument', () => {
+      expect(() => debug({ key: 'value' })).not.toThrow()
+    })
+
+    it('should handle empty arguments', () => {
+      expect(() => debug()).not.toThrow()
+    })
+  })
+
+  describe('debugNs', () => {
+    it('should not throw with namespace and message', () => {
+      expect(() => debugNs('test', 'message')).not.toThrow()
+    })
+
+    it('should handle namespace as object with namespaces property', () => {
+      expect(() => debugNs({ namespaces: 'test' }, 'message')).not.toThrow()
+    })
+
+    it('should handle string first argument', () => {
+      expect(() => debugNs('*', 'test message')).not.toThrow()
+    })
+
+    it('should handle non-string first argument in message', () => {
+      expect(() => debugNs('*', { key: 'value' })).not.toThrow()
+    })
+
+    it('should handle null namespace options', () => {
+      expect(() => debugNs('*', 'message')).not.toThrow()
+    })
+  })
+
+  describe('debugDir', () => {
+    it('should not throw when inspecting object', () => {
+      const obj = { key: 'value', nested: { prop: 123 } }
+      expect(() => debugDir(obj)).not.toThrow()
+    })
+
+    it('should handle inspect options', () => {
+      const obj = { key: 'value' }
+      const opts = { depth: 2, colors: true }
+      expect(() => debugDir(obj, opts)).not.toThrow()
+    })
+
+    it('should handle null object', () => {
+      expect(() => debugDir(null)).not.toThrow()
+    })
+
+    it('should handle undefined object', () => {
+      expect(() => debugDir(undefined)).not.toThrow()
+    })
+
+    it('should handle primitive values', () => {
+      expect(() => debugDir(123)).not.toThrow()
+    })
+  })
+
+  describe('debugDirNs', () => {
+    it('should not throw with namespace and object', () => {
+      const obj = { key: 'value' }
+      expect(() => debugDirNs('test', obj)).not.toThrow()
+    })
+
+    it('should handle namespace as object', () => {
+      const obj = { key: 'value' }
+      expect(() => debugDirNs({ namespaces: 'test' }, obj)).not.toThrow()
+    })
+
+    it('should handle inspect options', () => {
+      const obj = { key: 'value' }
+      const opts = { depth: 3, colors: false }
+      expect(() => debugDirNs('test', obj, opts)).not.toThrow()
+    })
+
+    it('should handle inspect without options', () => {
+      const obj = { key: 'value' }
+      expect(() => debugDirNs('test', obj)).not.toThrow()
+    })
+  })
+
+  describe('debugLog', () => {
+    it('should not throw when outputting log message', () => {
+      expect(() => debugLog('test message')).not.toThrow()
+    })
+
+    it('should handle multiple arguments', () => {
+      expect(() => debugLog('test', 'message', 123)).not.toThrow()
+    })
+
+    it('should handle non-string arguments', () => {
+      expect(() => debugLog({ key: 'value' })).not.toThrow()
+    })
+  })
+
+  describe('debugLogNs', () => {
+    it('should not throw with namespace and message', () => {
+      expect(() => debugLogNs('test', 'message')).not.toThrow()
+    })
+
+    it('should handle namespace as object', () => {
+      expect(() => debugLogNs({ namespaces: 'test' }, 'message')).not.toThrow()
+    })
+
+    it('should handle string first argument', () => {
+      expect(() => debugLogNs('*', 'test message')).not.toThrow()
+    })
+
+    it('should handle non-string arguments', () => {
+      expect(() => debugLogNs('*', { key: 'value' })).not.toThrow()
+    })
+
+    it('should handle multiple arguments', () => {
+      expect(() => debugLogNs('*', 'test', 123, true)).not.toThrow()
+    })
+  })
+
+  describe('debugCache', () => {
+    it('should not throw when outputting cache debug', () => {
+      expect(() => debugCache('get', 'test-key')).not.toThrow()
+    })
+
+    it('should handle with metadata', () => {
+      expect(() => debugCache('set', 'test-key', { value: 123 })).not.toThrow()
+    })
+
+    it('should handle objects as metadata', () => {
+      expect(() =>
+        debugCache('lookup', 'cache-key', { cacheKey: 'test', value: 'data' }),
+      ).not.toThrow()
+    })
+
+    it('should handle without metadata', () => {
+      expect(() => debugCache('delete', 'test-key')).not.toThrow()
+    })
+  })
+
+  describe('debugCacheNs', () => {
+    it('should not throw with namespace and message', () => {
+      expect(() => debugCacheNs('cache', 'get', 'test-key')).not.toThrow()
+    })
+
+    it('should handle namespace as object', () => {
+      expect(() =>
+        debugCacheNs({ namespaces: 'cache' }, 'set', 'test-key'),
+      ).not.toThrow()
+    })
+
+    it('should handle with metadata', () => {
+      expect(() =>
+        debugCacheNs('cache', 'lookup', 'test-key', { value: 123 }),
+      ).not.toThrow()
+    })
+
+    it('should handle objects in metadata', () => {
+      expect(() =>
+        debugCacheNs('cache', 'get', 'cache-key', {
+          cacheKey: 'test',
+          value: 'data',
+        }),
+      ).not.toThrow()
+    })
+  })
+
+  describe('debuglog', () => {
+    it('should return a function', () => {
+      const fn = debuglog('test')
+      expect(typeof fn).toBe('function')
+    })
+
+    it('should not throw when calling returned function', () => {
+      const fn = debuglog('test')
+      expect(() => fn('message')).not.toThrow()
+    })
+
+    it('should handle empty section', () => {
+      const fn = debuglog('')
+      expect(() => fn('message')).not.toThrow()
+    })
+  })
+
+  describe('debugtime', () => {
+    it('should not throw when starting timer', () => {
+      expect(() => debugtime('timer1')).not.toThrow()
+    })
+
+    it('should not throw when ending timer', () => {
+      debugtime('timer2')
+      expect(() => debugtime('timer2')).not.toThrow()
+    })
+
+    it('should handle multiple timers', () => {
+      expect(() => {
+        debugtime('timer3')
+        debugtime('timer4')
+        debugtime('timer3')
+        debugtime('timer4')
+      }).not.toThrow()
+    })
+
+    it('should handle empty label', () => {
+      debugtime('')
+      expect(() => debugtime('')).not.toThrow()
+    })
+
+    it('should handle undefined label', () => {
+      debugtime(undefined as unknown as string)
+      expect(() => debugtime(undefined as unknown as string)).not.toThrow()
+    })
+
+    it('should handle starting and stopping timer with same label', () => {
+      debugtime('test-timer')
+      expect(() => debugtime('test-timer')).not.toThrow()
+    })
+  })
+
+  describe('edge cases', () => {
+    it('should handle various inspect options', () => {
+      const obj = { test: 'value' }
+      expect(() => debugDir(obj, { depth: 0 })).not.toThrow()
+      expect(() => debugDir(obj, { maxArrayLength: 1 })).not.toThrow()
+      expect(() => debugDir(obj, { breakLength: 60 })).not.toThrow()
+      expect(() => debugDir(obj, { compact: false })).not.toThrow()
+    })
+
+    it('should handle deeply nested objects', () => {
+      const deep = {
+        level1: { level2: { level3: { level4: { level5: 'deep' } } } },
+      }
+      expect(() => debugDir(deep, { depth: 10 })).not.toThrow()
+    })
+
+    it('should handle circular references safely', () => {
+      const circular: Record<string, unknown> = { key: 'value' }
+      circular['self'] = circular
+      expect(() => debugDir(circular)).not.toThrow()
+    })
+  })
+
+  describe('Error.captureStackTrace variations', () => {
+    it('should handle async function prefix', () => {
+      expect(() => debug('async test')).not.toThrow()
+    })
+
+    it('should handle bound function prefix', () => {
+      expect(() => debug('bound test')).not.toThrow()
+    })
+
+    it('should handle getter/setter prefix', () => {
+      expect(() => debug('getter test')).not.toThrow()
+    })
+
+    it('should handle constructor prefix', () => {
+      expect(() => debug('constructor test')).not.toThrow()
+    })
+
+    it('should handle anonymous functions', () => {
+      expect(() => debug('anonymous test')).not.toThrow()
+    })
+
+    it('should handle functions with special characters', () => {
+      expect(() => debug('special-char-test')).not.toThrow()
+    })
+
+    it('should handle very long function names', () => {
+      expect(() => debug('veryLongFunctionNameTest'.repeat(10))).not.toThrow()
+    })
+
+    it('should handle functions with numbers', () => {
+      expect(() => debug('test123function')).not.toThrow()
+    })
+
+    it('should handle functions with underscores', () => {
+      expect(() => debug('test_function_name')).not.toThrow()
+    })
+
+    it('should handle functions with dollar signs', () => {
+      expect(() => debug('test$function$name')).not.toThrow()
+    })
+  })
+
+  describe('namespace filtering', () => {
+    it('should handle wildcard matching', () => {
+      // All patterns depend on DEBUG env var configuration at module load time
+      expect(typeof isDebugNs('*')).toBe('boolean')
+      expect(typeof isDebugNs('test*')).toBe('boolean')
+      expect(typeof isDebugNs('*test')).toBe('boolean')
+    })
+
+    it('should handle exclusion patterns', () => {
+      expect(typeof isDebugNs('test,-excluded')).toBe('boolean')
+    })
+
+    it('should handle comma-separated patterns', () => {
+      expect(typeof isDebugNs('test,other,more')).toBe('boolean')
+    })
+
+    it('should handle space-separated patterns', () => {
+      expect(typeof isDebugNs('test other more')).toBe('boolean')
+    })
+  })
+
+  describe('Unicode support', () => {
+    it('should handle Unicode characters in messages', () => {
+      expect(() => debug('Unicode: 你好世界 🌍')).not.toThrow()
+    })
+
+    it('should handle emoji in messages', () => {
+      expect(() => debug('Emoji test: 🎉 🚀 ✨')).not.toThrow()
+    })
+
+    it('should handle special symbols', () => {
+      expect(() => debug('Symbols: ™ © ® €')).not.toThrow()
+    })
+  })
+})
diff --git a/test/unit/dlx-binary.test.ts b/test/unit/dlx-binary.test.ts
new file mode 100644
index 0000000..1749156
--- /dev/null
+++ b/test/unit/dlx-binary.test.ts
@@ -0,0 +1,1335 @@
+/**
+ * @fileoverview Unit tests for DLX binary execution and caching.
+ *
+ * Tests DLX binary execution with HTTP server integration:
+ * - dlxBinary() downloads and executes package binaries
+ * - getDlxCachePath() resolves cache directory paths
+ * - listDlxCache() enumerates cached packages
+ * - cleanDlxCache() removes cached packages
+ * - Cross-platform binary execution
+ * - HTTP download with integrity verification
+ * Used by Socket CLI for secure one-off package execution.
+ */
+
+import { createHash } from 'node:crypto'
+import { promises as fs } from 'node:fs'
+import http from 'node:http'
+import os from 'node:os'
+import path from 'node:path'
+
+import {
+  cleanDlxCache,
+  dlxBinary,
+  getDlxCachePath,
+  listDlxCache,
+} from '@socketsecurity/lib/dlx-binary'
+import { afterAll, beforeAll, describe, expect, it } from 'vitest'
+import { mockHomeDir, runWithTempDir } from './utils/temp-file-helper.mjs'
+
+// Test server setup
+let httpServer: http.Server
+let httpPort: number
+let httpBaseUrl: string
+
+beforeAll(async () => {
+  // Create HTTP test server for binary downloads
+  await new Promise<void>(resolve => {
+    httpServer = http.createServer((req, res) => {
+      const url = req.url || ''
+
+      if (url === '/binary') {
+        res.writeHead(200, { 'Content-Type': 'application/octet-stream' })
+        res.end('#!/bin/bash\necho "test binary"')
+      } else if (url === '/binary-with-checksum') {
+        const content = '#!/bin/bash\necho "verified binary"'
+        const hash = createHash('sha256').update(content).digest('hex')
+        res.writeHead(200, {
+          'Content-Type': 'application/octet-stream',
+          'X-Checksum': hash,
+        })
+        res.end(content)
+      } else if (url === '/binary-invalid-checksum') {
+        res.writeHead(200, { 'Content-Type': 'application/octet-stream' })
+        res.end('#!/bin/bash\necho "wrong content"')
+      } else if (url === '/binary-404') {
+        res.writeHead(404)
+        res.end('Not Found')
+      } else if (url === '/binary-500') {
+        res.writeHead(500)
+        res.end('Internal Server Error')
+      } else if (url === '/binary-windows.cmd') {
+        res.writeHead(200, { 'Content-Type': 'application/octet-stream' })
+        res.end('@echo off\necho "windows script"')
+      } else if (url === '/binary-windows.bat') {
+        res.writeHead(200, { 'Content-Type': 'application/octet-stream' })
+        res.end('@echo off\necho "batch script"')
+      } else if (url === '/binary-windows.ps1') {
+        res.writeHead(200, { 'Content-Type': 'application/octet-stream' })
+        res.end('Write-Host "powershell script"')
+      } else if (url === '/slow-binary') {
+        setTimeout(() => {
+          res.writeHead(200, { 'Content-Type': 'application/octet-stream' })
+          res.end('#!/bin/bash\necho "slow binary"')
+        }, 100)
+      } else {
+        res.writeHead(404)
+        res.end()
+      }
+    })
+
+    httpServer.listen(0, () => {
+      const address = httpServer.address()
+      if (address && typeof address === 'object') {
+        httpPort = address.port
+        httpBaseUrl = `http://localhost:${httpPort}`
+      }
+      resolve()
+    })
+  })
+})
+
+afterAll(async () => {
+  await new Promise<void>(resolve => {
+    httpServer.close(() => resolve())
+  })
+})
+
+describe.sequential('dlx-binary', () => {
+  describe('getDlxCachePath', () => {
+    it('should return normalized cache path', () => {
+      const cachePath = getDlxCachePath()
+
+      expect(cachePath).toBeDefined()
+      expect(cachePath).toContain('.socket')
+      expect(cachePath).toContain('_dlx')
+      // Should not contain backslashes on any platform
+      expect(cachePath.includes('\\')).toBe(false)
+    })
+
+    it('should return consistent path across multiple calls', () => {
+      const path1 = getDlxCachePath()
+      const path2 = getDlxCachePath()
+
+      expect(path1).toBe(path2)
+    })
+  })
+
+  describe('dlxBinary', () => {
+    it('should download and cache binary', async () => {
+      await runWithTempDir(async tmpDir => {
+        const restoreHome = mockHomeDir(tmpDir)
+
+        try {
+          const url = `${httpBaseUrl}/binary`
+          const result = await dlxBinary(['--version'], {
+            name: 'test-binary',
+            url,
+          })
+
+          expect(result.downloaded).toBe(true)
+          expect(result.binaryPath).toBeDefined()
+          expect(result.binaryPath).toContain('test-binary')
+          expect(result.spawnPromise).toBeDefined()
+          await result.spawnPromise.catch(() => {})
+        } finally {
+          restoreHome()
+        }
+      }, 'dlxBinary-download-')
+    })
+
+    it('should use cached binary on second call', async () => {
+      await runWithTempDir(async tmpDir => {
+        const restoreHome = mockHomeDir(tmpDir)
+
+        try {
+          const url = `${httpBaseUrl}/binary`
+
+          // First call - should download
+          const result1 = await dlxBinary(['--version'], {
+            name: 'cached-binary',
+            url,
+          })
+          // Catch spawn promise immediately to prevent unhandled rejection on Windows.
+          result1.spawnPromise.catch(() => {})
+          expect(result1.downloaded).toBe(true)
+
+          // Second call - should use cache
+          const result2 = await dlxBinary(['--version'], {
+            name: 'cached-binary',
+            url,
+          })
+          // Catch spawn promise immediately to prevent unhandled rejection on Windows.
+          result2.spawnPromise.catch(() => {})
+          expect(result2.downloaded).toBe(false)
+          expect(result2.binaryPath).toBe(result1.binaryPath)
+        } finally {
+          restoreHome()
+        }
+      }, 'dlxBinary-cached-')
+    })
+
+    it('should force re-download when force option is true', async () => {
+      await runWithTempDir(async tmpDir => {
+        const restoreHome = mockHomeDir(tmpDir)
+
+        try {
+          const url = `${httpBaseUrl}/binary`
+
+          // First call
+          const result1 = await dlxBinary(['--version'], {
+            name: 'force-binary',
+            url,
+          })
+          await result1.spawnPromise.catch(() => {})
+
+          // Second call with force
+          const result = await dlxBinary(['--version'], {
+            force: true,
+            name: 'force-binary',
+            url,
+          })
+          expect(result.downloaded).toBe(true)
+          await result.spawnPromise.catch(() => {})
+        } finally {
+          restoreHome()
+        }
+      }, 'dlxBinary-force-')
+    })
+
+    it('should force re-download when yes option is true (CLI-style)', async () => {
+      await runWithTempDir(async tmpDir => {
+        const restoreHome = mockHomeDir(tmpDir)
+
+        try {
+          const url = `${httpBaseUrl}/binary`
+
+          // First call
+          const result1 = await dlxBinary(['--version'], {
+            name: 'yes-binary',
+            url,
+          })
+          await result1.spawnPromise.catch(() => {})
+
+          // Second call with yes (should behave like force)
+          const result = await dlxBinary(['--version'], {
+            name: 'yes-binary',
+            url,
+            yes: true,
+          })
+          expect(result.downloaded).toBe(true)
+          await result.spawnPromise.catch(() => {})
+        } finally {
+          restoreHome()
+        }
+      }, 'dlxBinary-yes-')
+    })
+
+    it('should accept quiet option (CLI-style, reserved)', async () => {
+      await runWithTempDir(async tmpDir => {
+        const restoreHome = mockHomeDir(tmpDir)
+
+        try {
+          const url = `${httpBaseUrl}/binary`
+
+          // Call with quiet option - currently reserved for future use
+          const result = await dlxBinary(['--version'], {
+            name: 'quiet-binary',
+            quiet: true,
+            url,
+          })
+          expect(result.downloaded).toBe(true)
+          await result.spawnPromise.catch(() => {})
+        } finally {
+          restoreHome()
+        }
+      }, 'dlxBinary-quiet-')
+    })
+
+    it('should verify checksum when provided', async () => {
+      await runWithTempDir(async tmpDir => {
+        const restoreHome = mockHomeDir(tmpDir)
+
+        try {
+          const content = '#!/bin/bash\necho "verified binary"'
+          const expectedChecksum = createHash('sha256')
+            .update(content)
+            .digest('hex')
+          const url = `${httpBaseUrl}/binary-with-checksum`
+
+          const result = await dlxBinary(['--version'], {
+            checksum: expectedChecksum,
+            name: 'verified-binary',
+            url,
+          })
+
+          expect(result.downloaded).toBe(true)
+          await result.spawnPromise.catch(() => {})
+        } finally {
+          restoreHome()
+        }
+      }, 'dlxBinary-checksum-')
+    })
+
+    it('should throw on checksum mismatch', async () => {
+      await runWithTempDir(async tmpDir => {
+        const restoreHome = mockHomeDir(tmpDir)
+
+        try {
+          const url = `${httpBaseUrl}/binary-invalid-checksum`
+          const wrongChecksum = 'a'.repeat(64)
+
+          await expect(
+            dlxBinary(['--version'], {
+              checksum: wrongChecksum,
+              name: 'invalid-checksum-binary',
+              url,
+            }),
+          ).rejects.toThrow(/Checksum mismatch/)
+        } finally {
+          restoreHome()
+        }
+      }, 'dlxBinary-bad-checksum-')
+    })
+
+    it('should throw on download failure', async () => {
+      await runWithTempDir(async tmpDir => {
+        const restoreHome = mockHomeDir(tmpDir)
+
+        try {
+          const url = `${httpBaseUrl}/binary-404`
+
+          await expect(
+            dlxBinary(['--version'], {
+              name: 'not-found-binary',
+              url,
+            }),
+          ).rejects.toThrow(/Failed to download binary from/)
+        } finally {
+          restoreHome()
+        }
+      }, 'dlxBinary-404-')
+    })
+
+    it('should throw on server error', async () => {
+      await runWithTempDir(async tmpDir => {
+        const restoreHome = mockHomeDir(tmpDir)
+
+        try {
+          const url = `${httpBaseUrl}/binary-500`
+
+          await expect(
+            dlxBinary(['--version'], {
+              name: 'error-binary',
+              url,
+            }),
+          ).rejects.toThrow(/Failed to download binary from/)
+        } finally {
+          restoreHome()
+        }
+      }, 'dlxBinary-500-')
+    })
+
+    it('should use default binary name if not provided', async () => {
+      await runWithTempDir(async tmpDir => {
+        const restoreHome = mockHomeDir(tmpDir)
+
+        try {
+          const url = `${httpBaseUrl}/binary`
+
+          const result = await dlxBinary(['--version'], {
+            url,
+          })
+
+          expect(result.binaryPath).toContain(
+            `binary-${process.platform}-${os.arch()}`,
+          )
+          await result.spawnPromise.catch(() => {})
+        } finally {
+          restoreHome()
+        }
+      }, 'dlxBinary-default-name-')
+    })
+
+    it('should pass spawn options to spawn', async () => {
+      await runWithTempDir(async tmpDir => {
+        const restoreHome = mockHomeDir(tmpDir)
+
+        try {
+          const url = `${httpBaseUrl}/binary`
+
+          const result = await dlxBinary(['--version'], {
+            name: 'spawn-options-binary',
+            spawnOptions: {
+              env: { CUSTOM_VAR: 'test' },
+            },
+            url,
+          })
+
+          expect(result.spawnPromise).toBeDefined()
+          await result.spawnPromise.catch(() => {})
+        } finally {
+          restoreHome()
+        }
+      }, 'dlxBinary-spawn-options-')
+    })
+
+    it('should use custom cacheTtl', async () => {
+      await runWithTempDir(async tmpDir => {
+        const restoreHome = mockHomeDir(tmpDir)
+
+        try {
+          const url = `${httpBaseUrl}/binary`
+
+          // Set very short TTL
+          const result = await dlxBinary(['--version'], {
+            cacheTtl: 100, // 100ms
+            name: 'ttl-binary',
+            url,
+          })
+          // Catch spawn promise immediately to prevent unhandled rejection on Windows.
+          result.spawnPromise.catch(() => {})
+
+          expect(result.downloaded).toBe(true)
+
+          // Wait for cache to expire
+          await new Promise(resolve => setTimeout(resolve, 150))
+
+          // Should re-download due to expired cache
+          const result2 = await dlxBinary(['--version'], {
+            cacheTtl: 100,
+            name: 'ttl-binary',
+            url,
+          })
+          // Catch spawn promise immediately to prevent unhandled rejection on Windows.
+          result2.spawnPromise.catch(() => {})
+
+          expect(result2.downloaded).toBe(true)
+        } finally {
+          restoreHome()
+        }
+      }, 'dlxBinary-ttl-')
+    })
+
+    it('should re-download if metadata is invalid', async () => {
+      await runWithTempDir(async tmpDir => {
+        const restoreHome = mockHomeDir(tmpDir)
+
+        try {
+          const url = `${httpBaseUrl}/binary`
+
+          // First download
+          const result1 = await dlxBinary(['--version'], {
+            name: 'invalid-meta-binary',
+            url,
+          })
+          await result1.spawnPromise.catch(() => {})
+
+          // Corrupt metadata
+          const name = 'invalid-meta-binary'
+          const spec = `${url}:${name}`
+          const cacheKey = createHash('sha512')
+            .update(spec)
+            .digest('hex')
+            .substring(0, 16)
+          const cachePath = getDlxCachePath()
+          const metaPath = path.join(cachePath, cacheKey, '.dlx-metadata.json')
+          await fs.writeFile(metaPath, 'invalid json', 'utf8')
+
+          // Second call should re-download due to invalid metadata
+          const result2 = await dlxBinary(['--version'], {
+            name: 'invalid-meta-binary',
+            url,
+          })
+
+          expect(result2.downloaded).toBe(true)
+          await result2.spawnPromise.catch(() => {})
+        } finally {
+          restoreHome()
+        }
+      }, 'dlxBinary-invalid-meta-')
+    })
+
+    it('should handle missing metadata file', async () => {
+      await runWithTempDir(async tmpDir => {
+        const restoreHome = mockHomeDir(tmpDir)
+
+        try {
+          const url = `${httpBaseUrl}/binary`
+
+          // First download
+          const result1 = await dlxBinary(['--version'], {
+            name: 'missing-meta-binary',
+            url,
+          })
+          await result1.spawnPromise.catch(() => {})
+
+          // Delete metadata
+          const name = 'missing-meta-binary'
+          const spec = `${url}:${name}`
+          const cacheKey = createHash('sha512')
+            .update(spec)
+            .digest('hex')
+            .substring(0, 16)
+          const cachePath = getDlxCachePath()
+          const metaPath = path.join(cachePath, cacheKey, '.dlx-metadata.json')
+          await fs.unlink(metaPath)
+
+          // Second call should re-download due to missing metadata
+          const result = await dlxBinary(['--version'], {
+            name: 'missing-meta-binary',
+            url,
+          })
+
+          expect(result.downloaded).toBe(true)
+          await result.spawnPromise.catch(() => {})
+        } finally {
+          restoreHome()
+        }
+      }, 'dlxBinary-missing-meta-')
+    })
+
+    it('should handle metadata with non-object value', async () => {
+      await runWithTempDir(async tmpDir => {
+        const restoreHome = mockHomeDir(tmpDir)
+
+        try {
+          const url = `${httpBaseUrl}/binary`
+
+          // First download
+          const result1 = await dlxBinary(['--version'], {
+            name: 'array-meta-binary',
+            url,
+          })
+          await result1.spawnPromise.catch(() => {})
+
+          // Write array as metadata (invalid)
+          const name = 'array-meta-binary'
+          const spec = `${url}:${name}`
+          const cacheKey = createHash('sha512')
+            .update(spec)
+            .digest('hex')
+            .substring(0, 16)
+          const cachePath = getDlxCachePath()
+          const metaPath = path.join(cachePath, cacheKey, '.dlx-metadata.json')
+          await fs.writeFile(metaPath, JSON.stringify([]), 'utf8')
+
+          // Second call should re-download
+          const result = await dlxBinary(['--version'], {
+            name: 'array-meta-binary',
+            url,
+          })
+
+          expect(result.downloaded).toBe(true)
+          await result.spawnPromise.catch(() => {})
+        } finally {
+          restoreHome()
+        }
+      }, 'dlxBinary-array-meta-')
+    })
+
+    it('should handle metadata with missing checksum', async () => {
+      await runWithTempDir(async tmpDir => {
+        const restoreHome = mockHomeDir(tmpDir)
+
+        try {
+          const url = `${httpBaseUrl}/binary`
+
+          // First download
+          const result1 = await dlxBinary(['--version'], {
+            name: 'no-checksum-meta-binary',
+            url,
+          })
+          await result1.spawnPromise.catch(() => {})
+
+          // Write metadata without checksum
+          const name = 'no-checksum-meta-binary'
+          const spec = `${url}:${name}`
+          const cacheKey = createHash('sha512')
+            .update(spec)
+            .digest('hex')
+            .substring(0, 16)
+          const cachePath = getDlxCachePath()
+          const metaPath = path.join(cachePath, cacheKey, '.dlx-metadata.json')
+          await fs.writeFile(
+            metaPath,
+            JSON.stringify({ timestamp: Date.now() }),
+            'utf8',
+          )
+
+          // Second call should re-download
+          const result = await dlxBinary(['--version'], {
+            name: 'no-checksum-meta-binary',
+            url,
+          })
+
+          expect(result.downloaded).toBe(true)
+          await result.spawnPromise.catch(() => {})
+        } finally {
+          restoreHome()
+        }
+      }, 'dlxBinary-no-checksum-meta-')
+    })
+
+    it('should pass args to spawn', async () => {
+      await runWithTempDir(async tmpDir => {
+        const restoreHome = mockHomeDir(tmpDir)
+
+        try {
+          const url = `${httpBaseUrl}/binary`
+          const args = ['arg1', 'arg2', '--flag']
+
+          const result = await dlxBinary(args, {
+            name: 'args-binary',
+            url,
+          })
+
+          expect(result.spawnPromise).toBeDefined()
+          await result.spawnPromise.catch(() => {})
+        } finally {
+          restoreHome()
+        }
+      }, 'dlxBinary-args-')
+    })
+  })
+
+  describe('cleanDlxCache', () => {
+    it('should return 0 if cache directory does not exist', async () => {
+      await runWithTempDir(async tmpDir => {
+        const restoreHome = mockHomeDir(tmpDir)
+
+        try {
+          const cleaned = await cleanDlxCache()
+          expect(cleaned).toBe(0)
+        } finally {
+          restoreHome()
+        }
+      }, 'cleanDlxCache-no-dir-')
+    })
+
+    it('should clean expired cache entries', async () => {
+      await runWithTempDir(async tmpDir => {
+        const restoreHome = mockHomeDir(tmpDir)
+
+        try {
+          const url = `${httpBaseUrl}/binary`
+
+          // Download binary with short TTL
+          const result = await dlxBinary(['--version'], {
+            cacheTtl: 100,
+            name: 'clean-binary',
+            url,
+          })
+          await result.spawnPromise.catch(() => {})
+
+          // Wait for cache to expire
+          await new Promise(resolve => setTimeout(resolve, 150))
+
+          // Clean expired entries
+          const cleaned = await cleanDlxCache(100)
+          expect(cleaned).toBeGreaterThan(0)
+        } finally {
+          restoreHome()
+        }
+      }, 'cleanDlxCache-expired-')
+    })
+
+    it('should not clean non-expired entries', async () => {
+      await runWithTempDir(async tmpDir => {
+        const restoreHome = mockHomeDir(tmpDir)
+
+        try {
+          const url = `${httpBaseUrl}/binary`
+
+          // Download binary
+          const result = await dlxBinary(['--version'], {
+            name: 'fresh-binary',
+            url,
+          })
+          await result.spawnPromise.catch(() => {})
+
+          // Try to clean with large maxAge
+          const cleaned = await cleanDlxCache(7 * 24 * 60 * 60 * 1000) // 7 days
+          expect(cleaned).toBe(0)
+        } finally {
+          restoreHome()
+        }
+      }, 'cleanDlxCache-fresh-')
+    })
+
+    it('should skip non-directory entries', async () => {
+      await runWithTempDir(async tmpDir => {
+        const restoreHome = mockHomeDir(tmpDir)
+
+        try {
+          const cachePath = getDlxCachePath()
+          await fs.mkdir(cachePath, { recursive: true })
+
+          // Create a file in cache directory
+          await fs.writeFile(path.join(cachePath, 'file.txt'), '', 'utf8')
+
+          const cleaned = await cleanDlxCache()
+          expect(cleaned).toBe(0)
+        } finally {
+          restoreHome()
+        }
+      }, 'cleanDlxCache-skip-files-')
+    })
+
+    it('should skip entries with invalid metadata', async () => {
+      await runWithTempDir(async tmpDir => {
+        const restoreHome = mockHomeDir(tmpDir)
+
+        try {
+          const cachePath = getDlxCachePath()
+          const entryPath = path.join(cachePath, 'invalid-entry')
+          await fs.mkdir(entryPath, { recursive: true })
+
+          // Write invalid metadata
+          await fs.writeFile(
+            path.join(entryPath, '.dlx-metadata.json'),
+            'invalid',
+            'utf8',
+          )
+
+          const cleaned = await cleanDlxCache(0)
+          expect(cleaned).toBe(0)
+        } finally {
+          restoreHome()
+        }
+      }, 'cleanDlxCache-invalid-meta-')
+    })
+
+    it('should skip entries with array metadata', async () => {
+      await runWithTempDir(async tmpDir => {
+        const restoreHome = mockHomeDir(tmpDir)
+
+        try {
+          const cachePath = getDlxCachePath()
+          const entryPath = path.join(cachePath, 'array-entry')
+          await fs.mkdir(entryPath, { recursive: true })
+
+          // Write array as metadata
+          await fs.writeFile(
+            path.join(entryPath, '.dlx-metadata.json'),
+            JSON.stringify([]),
+            'utf8',
+          )
+
+          const cleaned = await cleanDlxCache(0)
+          expect(cleaned).toBe(0)
+        } finally {
+          restoreHome()
+        }
+      }, 'cleanDlxCache-array-meta-')
+    })
+
+    it('should clean empty directories', async () => {
+      await runWithTempDir(async tmpDir => {
+        const restoreHome = mockHomeDir(tmpDir)
+
+        try {
+          const cachePath = getDlxCachePath()
+          const emptyEntry = path.join(cachePath, 'empty-entry')
+          await fs.mkdir(emptyEntry, { recursive: true })
+
+          const cleaned = await cleanDlxCache(0)
+          expect(cleaned).toBeGreaterThanOrEqual(0)
+        } finally {
+          restoreHome()
+        }
+      }, 'cleanDlxCache-empty-')
+    })
+
+    it('should handle entries without metadata', async () => {
+      await runWithTempDir(async tmpDir => {
+        const restoreHome = mockHomeDir(tmpDir)
+
+        try {
+          const cachePath = getDlxCachePath()
+          const entryPath = path.join(cachePath, 'no-meta-entry')
+          await fs.mkdir(entryPath, { recursive: true })
+
+          // Create a file but no metadata
+          await fs.writeFile(path.join(entryPath, 'binary'), '', 'utf8')
+
+          const cleaned = await cleanDlxCache(0)
+          expect(cleaned).toBeGreaterThanOrEqual(0)
+        } finally {
+          restoreHome()
+        }
+      }, 'cleanDlxCache-no-meta-')
+    })
+
+    it('should handle metadata with missing timestamp', async () => {
+      await runWithTempDir(async tmpDir => {
+        const restoreHome = mockHomeDir(tmpDir)
+
+        try {
+          const cachePath = getDlxCachePath()
+          const entryPath = path.join(cachePath, 'no-timestamp-entry')
+          await fs.mkdir(entryPath, { recursive: true })
+
+          // Write metadata without timestamp
+          await fs.writeFile(
+            path.join(entryPath, '.dlx-metadata.json'),
+            JSON.stringify({ url: 'test' }),
+            'utf8',
+          )
+
+          const cleaned = await cleanDlxCache(0)
+          expect(cleaned).toBeGreaterThan(0)
+        } finally {
+          restoreHome()
+        }
+      }, 'cleanDlxCache-no-timestamp-')
+    })
+
+    it('should use default maxAge', async () => {
+      await runWithTempDir(async tmpDir => {
+        const restoreHome = mockHomeDir(tmpDir)
+
+        try {
+          const url = `${httpBaseUrl}/binary`
+
+          // Download binary
+          const result = await dlxBinary(['--version'], {
+            name: 'default-ttl-binary',
+            url,
+          })
+          await result.spawnPromise.catch(() => {})
+
+          // Clean with default maxAge (7 days)
+          const cleaned = await cleanDlxCache()
+          expect(cleaned).toBe(0)
+        } finally {
+          restoreHome()
+        }
+      }, 'cleanDlxCache-default-')
+    })
+  })
+
+  describe('listDlxCache', () => {
+    it('should return empty array if cache directory does not exist', async () => {
+      await runWithTempDir(async tmpDir => {
+        const restoreHome = mockHomeDir(tmpDir)
+
+        try {
+          const list = await listDlxCache()
+          expect(list).toEqual([])
+        } finally {
+          restoreHome()
+        }
+      }, 'listDlxCache-no-dir-')
+    })
+
+    it('should list cached binaries', async () => {
+      await runWithTempDir(async tmpDir => {
+        const restoreHome = mockHomeDir(tmpDir)
+
+        try {
+          const url = `${httpBaseUrl}/binary`
+
+          // Download binary
+          const result = await dlxBinary(['--version'], {
+            name: 'list-binary',
+            url,
+          })
+          await result.spawnPromise.catch(() => {})
+
+          const list = await listDlxCache()
+          expect(list.length).toBeGreaterThan(0)
+
+          const entry = list[0]
+          expect(entry.name).toBe('list-binary')
+          expect(entry.url).toBe(url)
+          expect(entry.platform).toBe(os.platform())
+          expect(entry.arch).toBe(os.arch())
+          expect(entry.checksum).toBeDefined()
+          expect(entry.size).toBeGreaterThan(0)
+          expect(entry.age).toBeGreaterThanOrEqual(0)
+        } finally {
+          restoreHome()
+        }
+      }, 'listDlxCache-basic-')
+    })
+
+    it('should skip non-directory entries', async () => {
+      await runWithTempDir(async tmpDir => {
+        const restoreHome = mockHomeDir(tmpDir)
+
+        try {
+          const cachePath = getDlxCachePath()
+          await fs.mkdir(cachePath, { recursive: true })
+
+          // Create a file
+          await fs.writeFile(path.join(cachePath, 'file.txt'), '', 'utf8')
+
+          const list = await listDlxCache()
+          expect(list).toEqual([])
+        } finally {
+          restoreHome()
+        }
+      }, 'listDlxCache-skip-files-')
+    })
+
+    it('should skip entries with invalid metadata', async () => {
+      await runWithTempDir(async tmpDir => {
+        const restoreHome = mockHomeDir(tmpDir)
+
+        try {
+          const cachePath = getDlxCachePath()
+          const entryPath = path.join(cachePath, 'invalid-entry')
+          await fs.mkdir(entryPath, { recursive: true })
+
+          // Write invalid metadata
+          await fs.writeFile(
+            path.join(entryPath, '.dlx-metadata.json'),
+            'invalid',
+            'utf8',
+          )
+
+          const list = await listDlxCache()
+          expect(list).toEqual([])
+        } finally {
+          restoreHome()
+        }
+      }, 'listDlxCache-invalid-meta-')
+    })
+
+    it('should skip entries with array metadata', async () => {
+      await runWithTempDir(async tmpDir => {
+        const restoreHome = mockHomeDir(tmpDir)
+
+        try {
+          const cachePath = getDlxCachePath()
+          const entryPath = path.join(cachePath, 'array-entry')
+          await fs.mkdir(entryPath, { recursive: true })
+
+          // Write array as metadata
+          await fs.writeFile(
+            path.join(entryPath, '.dlx-metadata.json'),
+            JSON.stringify([]),
+            'utf8',
+          )
+
+          const list = await listDlxCache()
+          expect(list).toEqual([])
+        } finally {
+          restoreHome()
+        }
+      }, 'listDlxCache-array-meta-')
+    })
+
+    it('should skip entries without binary file', async () => {
+      await runWithTempDir(async tmpDir => {
+        const restoreHome = mockHomeDir(tmpDir)
+
+        try {
+          const cachePath = getDlxCachePath()
+          const entryPath = path.join(cachePath, 'no-binary-entry')
+          await fs.mkdir(entryPath, { recursive: true })
+
+          // Write metadata but no binary
+          await fs.writeFile(
+            path.join(entryPath, '.dlx-metadata.json'),
+            JSON.stringify({
+              arch: os.arch(),
+              checksum: 'test',
+              platform: os.platform(),
+              timestamp: Date.now(),
+              url: 'test',
+            }),
+            'utf8',
+          )
+
+          const list = await listDlxCache()
+          expect(list).toEqual([])
+        } finally {
+          restoreHome()
+        }
+      }, 'listDlxCache-no-binary-')
+    })
+
+    it('should handle metadata with missing fields', async () => {
+      await runWithTempDir(async tmpDir => {
+        const restoreHome = mockHomeDir(tmpDir)
+
+        try {
+          const cachePath = getDlxCachePath()
+          const entryPath = path.join(cachePath, 'partial-meta-entry')
+          await fs.mkdir(entryPath, { recursive: true })
+
+          // Write partial metadata
+          await fs.writeFile(
+            path.join(entryPath, '.dlx-metadata.json'),
+            JSON.stringify({ timestamp: Date.now() }),
+            'utf8',
+          )
+
+          // Create binary
+          await fs.writeFile(path.join(entryPath, 'binary'), '', 'utf8')
+
+          const list = await listDlxCache()
+          expect(list.length).toBe(1)
+
+          const entry = list[0]
+          expect(entry.url).toBe('')
+          expect(entry.platform).toBe('unknown')
+          expect(entry.arch).toBe('unknown')
+          expect(entry.checksum).toBe('')
+        } finally {
+          restoreHome()
+        }
+      }, 'listDlxCache-partial-meta-')
+    })
+
+    it('should calculate age correctly', async () => {
+      await runWithTempDir(async tmpDir => {
+        const restoreHome = mockHomeDir(tmpDir)
+
+        try {
+          const url = `${httpBaseUrl}/binary`
+
+          // Download binary
+          const result = await dlxBinary(['--version'], {
+            name: 'age-binary',
+            url,
+          })
+          await result.spawnPromise.catch(() => {})
+
+          // Wait a bit
+          await new Promise(resolve => setTimeout(resolve, 100))
+
+          const list = await listDlxCache()
+          expect(list.length).toBe(1)
+          expect(list[0].age).toBeGreaterThan(0)
+        } finally {
+          restoreHome()
+        }
+      }, 'listDlxCache-age-')
+    })
+
+    it('should handle multiple cached binaries', async () => {
+      await runWithTempDir(async tmpDir => {
+        const restoreHome = mockHomeDir(tmpDir)
+
+        try {
+          // Download multiple binaries
+          const result1 = await dlxBinary(['--version'], {
+            name: 'binary-1',
+            url: `${httpBaseUrl}/binary`,
+          })
+          await result1.spawnPromise.catch(() => {})
+
+          const result2 = await dlxBinary(['--version'], {
+            name: 'binary-2',
+            url: `${httpBaseUrl}/slow-binary`,
+          })
+          await result2.spawnPromise.catch(() => {})
+
+          const list = await listDlxCache()
+          expect(list.length).toBe(2)
+
+          const names = list.map(e => e.name).sort()
+          expect(names).toEqual(['binary-1', 'binary-2'])
+        } finally {
+          restoreHome()
+        }
+      }, 'listDlxCache-multiple-')
+    })
+
+    it('should handle entries that fail to stat', async () => {
+      await runWithTempDir(async tmpDir => {
+        const restoreHome = mockHomeDir(tmpDir)
+
+        try {
+          const cachePath = getDlxCachePath()
+          const entryPath = path.join(cachePath, 'stat-fail-entry')
+          await fs.mkdir(entryPath, { recursive: true })
+
+          // Write metadata
+          await fs.writeFile(
+            path.join(entryPath, '.dlx-metadata.json'),
+            JSON.stringify({
+              arch: os.arch(),
+              checksum: 'test',
+              platform: os.platform(),
+              timestamp: Date.now(),
+              url: 'test',
+            }),
+            'utf8',
+          )
+
+          // Create binary
+          const binaryPath = path.join(entryPath, 'binary')
+          await fs.writeFile(binaryPath, '', 'utf8')
+
+          // Delete binary to cause stat failure
+          await fs.unlink(binaryPath)
+
+          const list = await listDlxCache()
+          // Should skip entry that fails to stat
+          expect(list).toEqual([])
+        } finally {
+          restoreHome()
+        }
+      }, 'listDlxCache-stat-fail-')
+    })
+  })
+
+  describe('Windows-specific behavior', () => {
+    const originalPlatform = process.platform
+
+    it.skipIf(process.platform !== 'win32')(
+      'should handle .cmd files with shell on Windows',
+      async () => {
+        await runWithTempDir(async tmpDir => {
+          const restoreHome = mockHomeDir(tmpDir)
+
+          try {
+            // Mock Windows platform
+            Object.defineProperty(process, 'platform', {
+              configurable: true,
+              value: 'win32',
+            })
+
+            const url = `${httpBaseUrl}/binary-windows.cmd`
+
+            const result = await dlxBinary(['--version'], {
+              name: 'test.cmd',
+              url,
+            })
+
+            expect(result.binaryPath).toContain('.cmd')
+            await result.spawnPromise.catch(() => {})
+          } finally {
+            restoreHome()
+            Object.defineProperty(process, 'platform', {
+              configurable: true,
+              value: originalPlatform,
+            })
+          }
+        }, 'dlxBinary-windows-cmd-')
+      },
+    )
+
+    it.skipIf(process.platform !== 'win32')(
+      'should handle .bat files with shell on Windows',
+      async () => {
+        await runWithTempDir(async tmpDir => {
+          const restoreHome = mockHomeDir(tmpDir)
+
+          try {
+            Object.defineProperty(process, 'platform', {
+              configurable: true,
+              value: 'win32',
+            })
+
+            const url = `${httpBaseUrl}/binary-windows.bat`
+
+            const result = await dlxBinary(['--version'], {
+              name: 'test.bat',
+              url,
+            })
+
+            expect(result.binaryPath).toContain('.bat')
+            await result.spawnPromise.catch(() => {})
+          } finally {
+            restoreHome()
+            Object.defineProperty(process, 'platform', {
+              configurable: true,
+              value: originalPlatform,
+            })
+          }
+        }, 'dlxBinary-windows-bat-')
+      },
+    )
+
+    it.skipIf(process.platform !== 'win32')(
+      'should handle .ps1 files with shell on Windows',
+      async () => {
+        await runWithTempDir(async tmpDir => {
+          const restoreHome = mockHomeDir(tmpDir)
+
+          try {
+            Object.defineProperty(process, 'platform', {
+              configurable: true,
+              value: 'win32',
+            })
+
+            const url = `${httpBaseUrl}/binary-windows.ps1`
+
+            const result = await dlxBinary(['--version'], {
+              name: 'test.ps1',
+              url,
+            })
+
+            expect(result.binaryPath).toContain('.ps1')
+            await result.spawnPromise.catch(() => {})
+          } finally {
+            restoreHome()
+            Object.defineProperty(process, 'platform', {
+              configurable: true,
+              value: originalPlatform,
+            })
+          }
+        }, 'dlxBinary-windows-ps1-')
+      },
+    )
+  })
+
+  describe('edge cases', () => {
+    it('should handle concurrent downloads of same binary', async () => {
+      await runWithTempDir(async tmpDir => {
+        const restoreHome = mockHomeDir(tmpDir)
+
+        try {
+          const url = `${httpBaseUrl}/binary`
+
+          // Download first one to completion
+          const result1 = await dlxBinary(['--version'], {
+            name: 'concurrent-binary',
+            url,
+          })
+          // Catch spawn promise immediately to prevent unhandled rejection on Windows.
+          result1.spawnPromise.catch(() => {})
+          expect(result1.downloaded).toBe(true)
+
+          // Second download should use cache
+          const result2 = await dlxBinary(['--version'], {
+            name: 'concurrent-binary',
+            url,
+          })
+          // Catch spawn promise immediately to prevent unhandled rejection on Windows.
+          result2.spawnPromise.catch(() => {})
+          expect(result2.downloaded).toBe(false)
+        } finally {
+          restoreHome()
+        }
+      }, 'dlxBinary-concurrent-')
+    })
+
+    it('should create cache directory if it does not exist', async () => {
+      await runWithTempDir(async tmpDir => {
+        const restoreHome = mockHomeDir(tmpDir)
+
+        try {
+          const url = `${httpBaseUrl}/binary`
+
+          // Cache directory should not exist initially
+          const cachePath = getDlxCachePath()
+          const exists = await fs
+            .access(cachePath)
+            .then(() => true)
+            .catch(() => false)
+          expect(exists).toBe(false)
+
+          // Download should create directory
+          const result = await dlxBinary(['--version'], {
+            name: 'create-dir-binary',
+            url,
+          })
+          await result.spawnPromise.catch(() => {})
+
+          const existsAfter = await fs
+            .access(cachePath)
+            .then(() => true)
+            .catch(() => false)
+          expect(existsAfter).toBe(true)
+        } finally {
+          restoreHome()
+        }
+      }, 'dlxBinary-create-dir-')
+    })
+
+    it('should handle download with empty args array', async () => {
+      await runWithTempDir(async tmpDir => {
+        const restoreHome = mockHomeDir(tmpDir)
+
+        try {
+          const url = `${httpBaseUrl}/binary`
+
+          const result = await dlxBinary([], {
+            name: 'no-args-binary',
+            url,
+          })
+
+          expect(result.spawnPromise).toBeDefined()
+          // Wait for spawn to complete to avoid SIGKILL errors
+          await result.spawnPromise.catch(() => {
+            // Ignore spawn errors in tests
+          })
+        } finally {
+          restoreHome()
+        }
+      }, 'dlxBinary-no-args-')
+    })
+
+    it('should normalize binary path', async () => {
+      await runWithTempDir(async tmpDir => {
+        const restoreHome = mockHomeDir(tmpDir)
+
+        try {
+          const url = `${httpBaseUrl}/binary`
+
+          const result = await dlxBinary(['--version'], {
+            name: 'normalized-binary',
+            url,
+          })
+
+          // Path should not contain backslashes on any platform
+          expect(result.binaryPath.includes('\\')).toBe(false)
+          // Wait for spawn to complete to avoid SIGKILL errors
+          await result.spawnPromise.catch(() => {
+            // Ignore spawn errors in tests
+          })
+        } finally {
+          restoreHome()
+        }
+      }, 'dlxBinary-normalized-')
+    })
+
+    it('should handle metadata read errors during cache validation', async () => {
+      await runWithTempDir(async tmpDir => {
+        const restoreHome = mockHomeDir(tmpDir)
+
+        try {
+          const url = `${httpBaseUrl}/binary`
+
+          // First download
+          const result1 = await dlxBinary(['--version'], {
+            name: 'read-error-binary',
+            url,
+          })
+          // Wait for first spawn to complete
+          await result1.spawnPromise.catch(() => {})
+
+          // Make metadata unreadable (change permissions)
+          const name = 'read-error-binary'
+          const spec = `${url}:${name}`
+          const cacheKey = createHash('sha512')
+            .update(spec)
+            .digest('hex')
+            .substring(0, 16)
+          const cachePath = getDlxCachePath()
+          const metaPath = path.join(cachePath, cacheKey, '.dlx-metadata.json')
+
+          // On Windows, we can't easily make files unreadable, so we'll corrupt it instead
+          await fs.writeFile(metaPath, Buffer.from([0xff, 0xfe]), 'utf8')
+
+          // Second call should re-download
+          const result = await dlxBinary(['--version'], {
+            name: 'read-error-binary',
+            url,
+          })
+
+          expect(result.downloaded).toBe(true)
+          // Wait for second spawn to complete
+          await result.spawnPromise.catch(() => {})
+        } finally {
+          restoreHome()
+        }
+      }, 'dlxBinary-read-error-')
+    })
+  })
+})
diff --git a/test/unit/dlx-manifest.test.ts b/test/unit/dlx-manifest.test.ts
new file mode 100644
index 0000000..15ed25b
--- /dev/null
+++ b/test/unit/dlx-manifest.test.ts
@@ -0,0 +1,712 @@
+/**
+ * @fileoverview Unit tests for dlx manifest utilities.
+ *
+ * Tests type guards and utilities for dlx (download and execute) manifest entries:
+ * - isPackageEntry() validates package-type manifest entries
+ * - isBinaryEntry() validates binary-type manifest entries
+ * - ManifestEntry discriminated union with 'package' or 'binary' types
+ * - Tests type narrowing, cache_key validation, and timestamp handling
+ * - Ensures TypeScript type guards work correctly for manifest parsing
+ * dlx manifests track cached npm packages and binaries for npx-like execution.
+ */
+
+import { existsSync, mkdirSync, rmSync, writeFileSync } from 'node:fs'
+import { tmpdir } from 'node:os'
+import { join } from 'node:path'
+import {
+  isPackageEntry,
+  isBinaryEntry,
+  DlxManifest,
+  type ManifestEntry,
+  type PackageDetails,
+  type BinaryDetails,
+  type StoreRecord,
+} from '@socketsecurity/lib/dlx-manifest'
+import { afterEach, beforeEach, describe, expect, it } from 'vitest'
+
+describe('dlx-manifest', () => {
+  describe('isPackageEntry', () => {
+    it('should return true for package entries', () => {
+      const entry: ManifestEntry = {
+        type: 'package',
+        cache_key: 'test-package@1.0.0',
+        timestamp: Date.now(),
+        details: {
+          installed_version: '1.0.0',
+        } as PackageDetails,
+      }
+      expect(isPackageEntry(entry)).toBe(true)
+    })
+
+    it('should return false for binary entries', () => {
+      const entry: ManifestEntry = {
+        type: 'binary',
+        cache_key: 'test-binary',
+        timestamp: Date.now(),
+        details: {
+          checksum: 'abc123',
+          checksum_algorithm: 'sha256',
+          platform: 'linux',
+          arch: 'x64',
+          size: 1024,
+          source: { type: 'download', url: 'https://example.com' },
+        } as BinaryDetails,
+      }
+      expect(isPackageEntry(entry)).toBe(false)
+    })
+  })
+
+  describe('isBinaryEntry', () => {
+    it('should return true for binary entries', () => {
+      const entry: ManifestEntry = {
+        type: 'binary',
+        cache_key: 'test-binary',
+        timestamp: Date.now(),
+        details: {
+          checksum: 'abc123',
+          checksum_algorithm: 'sha256',
+          platform: 'linux',
+          arch: 'x64',
+          size: 1024,
+          source: { type: 'download', url: 'https://example.com' },
+        } as BinaryDetails,
+      }
+      expect(isBinaryEntry(entry)).toBe(true)
+    })
+
+    it('should return false for package entries', () => {
+      const entry: ManifestEntry = {
+        type: 'package',
+        cache_key: 'test-package@1.0.0',
+        timestamp: Date.now(),
+        details: {
+          installed_version: '1.0.0',
+        } as PackageDetails,
+      }
+      expect(isBinaryEntry(entry)).toBe(false)
+    })
+  })
+
+  describe('ManifestEntry types', () => {
+    it('should support package entries with update_check', () => {
+      const entry: ManifestEntry = {
+        type: 'package',
+        cache_key: 'test@1.0.0',
+        timestamp: Date.now(),
+        details: {
+          installed_version: '1.0.0',
+          size: 12_345,
+          update_check: {
+            last_check: Date.now(),
+            last_notification: Date.now(),
+            latest_known: '1.0.1',
+          },
+        } as PackageDetails,
+      }
+      expect(entry.type).toBe('package')
+      if (isPackageEntry(entry)) {
+        expect(entry.details.installed_version).toBe('1.0.0')
+        expect(entry.details.update_check).toBeDefined()
+      }
+    })
+
+    it('should support binary entries with all fields', () => {
+      const entry: ManifestEntry = {
+        type: 'binary',
+        cache_key: 'binary-key',
+        timestamp: Date.now(),
+        details: {
+          checksum: 'sha256hash',
+          checksum_algorithm: 'sha256',
+          platform: 'darwin',
+          arch: 'arm64',
+          size: 2048,
+          source: {
+            type: 'download',
+            url: 'https://example.com/binary',
+          },
+        } as BinaryDetails,
+      }
+      expect(entry.type).toBe('binary')
+      if (isBinaryEntry(entry)) {
+        expect(entry.details.checksum).toBe('sha256hash')
+        expect(entry.details.platform).toBe('darwin')
+        expect(entry.details.arch).toBe('arm64')
+      }
+    })
+  })
+
+  describe('type guards', () => {
+    it('should narrow types correctly with isPackageEntry', () => {
+      const entry: ManifestEntry = {
+        type: 'package',
+        cache_key: 'test',
+        timestamp: Date.now(),
+        details: { installed_version: '1.0.0' } as PackageDetails,
+      }
+
+      if (isPackageEntry(entry)) {
+        // TypeScript should know entry.details is PackageDetails
+        expect(entry.details.installed_version).toBeDefined()
+      }
+    })
+
+    it('should narrow types correctly with isBinaryEntry', () => {
+      const entry: ManifestEntry = {
+        type: 'binary',
+        cache_key: 'test',
+        timestamp: Date.now(),
+        details: {
+          checksum: 'abc',
+          checksum_algorithm: 'sha512',
+          platform: 'win32',
+          arch: 'x64',
+          size: 100,
+          source: { type: 'download', url: 'https://test.com' },
+        } as BinaryDetails,
+      }
+
+      if (isBinaryEntry(entry)) {
+        // TypeScript should know entry.details is BinaryDetails
+        expect(entry.details.checksum).toBeDefined()
+        expect(entry.details.checksum_algorithm).toBe('sha512')
+      }
+    })
+  })
+
+  describe('checksum algorithms', () => {
+    it('should support sha256', () => {
+      const details: BinaryDetails = {
+        checksum: 'abc123',
+        checksum_algorithm: 'sha256',
+        platform: 'linux',
+        arch: 'x64',
+        size: 1024,
+        source: { type: 'download', url: 'https://example.com' },
+      }
+      expect(details.checksum_algorithm).toBe('sha256')
+    })
+
+    it('should support sha512', () => {
+      const details: BinaryDetails = {
+        checksum: 'def456',
+        checksum_algorithm: 'sha512',
+        platform: 'darwin',
+        arch: 'arm64',
+        size: 2048,
+        source: { type: 'download', url: 'https://example.com' },
+      }
+      expect(details.checksum_algorithm).toBe('sha512')
+    })
+  })
+
+  describe.sequential('DlxManifest class', () => {
+    let testDir: string
+    let manifestPath: string
+    let manifest: DlxManifest
+
+    beforeEach(() => {
+      // Create unique temp directory for each test
+      testDir = join(
+        tmpdir(),
+        `dlx-manifest-test-${Date.now()}-${Math.random().toString(36).slice(2)}`,
+      )
+      mkdirSync(testDir, { recursive: true })
+      manifestPath = join(testDir, '.dlx-manifest.json')
+      manifest = new DlxManifest({ manifestPath })
+    })
+
+    afterEach(() => {
+      // Clean up test directory
+      try {
+        if (existsSync(testDir)) {
+          rmSync(testDir, { recursive: true, force: true })
+        }
+      } catch {}
+    })
+
+    describe('constructor', () => {
+      it('should create instance with custom path', () => {
+        const customManifest = new DlxManifest({ manifestPath })
+        expect(customManifest).toBeDefined()
+      })
+
+      it('should create instance with default path', () => {
+        const defaultManifest = new DlxManifest()
+        expect(defaultManifest).toBeDefined()
+      })
+    })
+
+    describe('getManifestEntry', () => {
+      it('should return undefined for non-existent entry', () => {
+        const entry = manifest.getManifestEntry('non-existent')
+        expect(entry).toBeUndefined()
+      })
+
+      it('should return undefined when manifest file does not exist', () => {
+        const entry = manifest.getManifestEntry('test-spec')
+        expect(entry).toBeUndefined()
+      })
+
+      it('should return package entry', async () => {
+        const details: PackageDetails = {
+          installed_version: '1.0.0',
+          size: 1024,
+        }
+        await manifest.setPackageEntry(
+          'test-pkg@1.0.0',
+          'cache-key-123',
+          details,
+        )
+
+        const entry = manifest.getManifestEntry('test-pkg@1.0.0')
+        expect(entry).toBeDefined()
+        expect(entry?.type).toBe('package')
+        expect(entry?.cache_key).toBe('cache-key-123')
+      })
+
+      it('should return binary entry', async () => {
+        const details: BinaryDetails = {
+          checksum: 'abc123',
+          checksum_algorithm: 'sha256',
+          platform: 'linux',
+          arch: 'x64',
+          size: 2048,
+          source: { type: 'download', url: 'https://example.com/binary' },
+        }
+        await manifest.setBinaryEntry('test-binary', 'binary-key', details)
+
+        const entry = manifest.getManifestEntry('test-binary')
+        expect(entry).toBeDefined()
+        expect(entry?.type).toBe('binary')
+      })
+
+      it('should handle empty manifest file', () => {
+        writeFileSync(manifestPath, '', 'utf8')
+        const entry = manifest.getManifestEntry('test')
+        expect(entry).toBeUndefined()
+      })
+
+      it('should handle whitespace-only manifest file', () => {
+        writeFileSync(manifestPath, '   \n  \t  ', 'utf8')
+        const entry = manifest.getManifestEntry('test')
+        expect(entry).toBeUndefined()
+      })
+    })
+
+    describe('setPackageEntry', () => {
+      it('should store package entry', async () => {
+        const details: PackageDetails = {
+          installed_version: '2.0.0',
+          size: 5000,
+        }
+        await manifest.setPackageEntry('pkg@2.0.0', 'key-456', details)
+
+        const entry = manifest.getManifestEntry('pkg@2.0.0')
+        expect(entry).toBeDefined()
+        expect(isPackageEntry(entry!)).toBe(true)
+        if (isPackageEntry(entry!)) {
+          expect(entry.details.installed_version).toBe('2.0.0')
+          expect(entry.details.size).toBe(5000)
+        }
+      })
+
+      it('should store package entry with update_check', async () => {
+        const details: PackageDetails = {
+          installed_version: '1.5.0',
+          update_check: {
+            last_check: Date.now(),
+            last_notification: Date.now() - 1000,
+            latest_known: '1.6.0',
+          },
+        }
+        await manifest.setPackageEntry('pkg@1.5.0', 'key-789', details)
+
+        const entry = manifest.getManifestEntry('pkg@1.5.0')
+        if (isPackageEntry(entry!)) {
+          expect(entry.details.update_check).toBeDefined()
+          expect(entry.details.update_check?.latest_known).toBe('1.6.0')
+        }
+      })
+
+      it('should update existing package entry', async () => {
+        const details1: PackageDetails = { installed_version: '1.0.0' }
+        await manifest.setPackageEntry('pkg', 'key1', details1)
+
+        const details2: PackageDetails = { installed_version: '2.0.0' }
+        await manifest.setPackageEntry('pkg', 'key2', details2)
+
+        const entry = manifest.getManifestEntry('pkg')
+        if (isPackageEntry(entry!)) {
+          expect(entry.details.installed_version).toBe('2.0.0')
+          expect(entry.cache_key).toBe('key2')
+        }
+      })
+
+      it('should create manifest directory if it does not exist', async () => {
+        const deepDir = join(testDir, 'deep', 'nested', 'path')
+        const deepManifestPath = join(deepDir, '.dlx-manifest.json')
+        const deepManifest = new DlxManifest({ manifestPath: deepManifestPath })
+
+        const details: PackageDetails = { installed_version: '1.0.0' }
+        await deepManifest.setPackageEntry('test', 'key', details)
+
+        expect(existsSync(deepManifestPath)).toBe(true)
+      })
+    })
+
+    describe('setBinaryEntry', () => {
+      it('should store binary entry', async () => {
+        const details: BinaryDetails = {
+          checksum: 'xyz789',
+          checksum_algorithm: 'sha512',
+          platform: 'darwin',
+          arch: 'arm64',
+          size: 10_000,
+          source: { type: 'download', url: 'https://test.com/bin' },
+        }
+        await manifest.setBinaryEntry('bin-spec', 'bin-key', details)
+
+        const entry = manifest.getManifestEntry('bin-spec')
+        expect(entry).toBeDefined()
+        expect(isBinaryEntry(entry!)).toBe(true)
+        if (isBinaryEntry(entry!)) {
+          expect(entry.details.checksum).toBe('xyz789')
+          expect(entry.details.platform).toBe('darwin')
+          expect(entry.details.arch).toBe('arm64')
+        }
+      })
+
+      it('should update existing binary entry', async () => {
+        const details1: BinaryDetails = {
+          checksum: 'old',
+          checksum_algorithm: 'sha256',
+          platform: 'linux',
+          arch: 'x64',
+          size: 1000,
+          source: { type: 'download', url: 'https://old.com' },
+        }
+        await manifest.setBinaryEntry('bin', 'key1', details1)
+
+        const details2: BinaryDetails = {
+          checksum: 'new',
+          checksum_algorithm: 'sha512',
+          platform: 'win32',
+          arch: 'x64',
+          size: 2000,
+          source: { type: 'download', url: 'https://new.com' },
+        }
+        await manifest.setBinaryEntry('bin', 'key2', details2)
+
+        const entry = manifest.getManifestEntry('bin')
+        if (isBinaryEntry(entry!)) {
+          expect(entry.details.checksum).toBe('new')
+          expect(entry.cache_key).toBe('key2')
+        }
+      })
+    })
+
+    describe('get (legacy)', () => {
+      it('should return undefined for non-existent entry', () => {
+        const record = manifest.get('non-existent')
+        expect(record).toBeUndefined()
+      })
+
+      it('should return legacy format entry', async () => {
+        const record: StoreRecord = {
+          timestampFetch: Date.now(),
+          timestampNotification: Date.now(),
+          version: '1.2.3',
+        }
+        await manifest.set('legacy-pkg', record)
+
+        const retrieved = manifest.get('legacy-pkg')
+        expect(retrieved).toBeDefined()
+        expect(retrieved?.version).toBe('1.2.3')
+      })
+
+      it('should not return new format entries', async () => {
+        const details: PackageDetails = { installed_version: '1.0.0' }
+        await manifest.setPackageEntry('new-pkg', 'key', details)
+
+        const retrieved = manifest.get('new-pkg')
+        expect(retrieved).toBeUndefined()
+      })
+    })
+
+    describe('set (legacy)', () => {
+      it('should store legacy format entry', async () => {
+        const record: StoreRecord = {
+          timestampFetch: Date.now(),
+          timestampNotification: Date.now() - 5000,
+          version: '2.3.4',
+        }
+        await manifest.set('test-pkg', record)
+
+        const retrieved = manifest.get('test-pkg')
+        expect(retrieved).toBeDefined()
+        expect(retrieved?.version).toBe('2.3.4')
+      })
+
+      it('should update existing legacy entry', async () => {
+        const record1: StoreRecord = {
+          timestampFetch: 1000,
+          timestampNotification: 1000,
+          version: '1.0.0',
+        }
+        await manifest.set('pkg', record1)
+
+        const record2: StoreRecord = {
+          timestampFetch: 2000,
+          timestampNotification: 2000,
+          version: '2.0.0',
+        }
+        await manifest.set('pkg', record2)
+
+        const retrieved = manifest.get('pkg')
+        expect(retrieved?.version).toBe('2.0.0')
+        expect(retrieved?.timestampFetch).toBe(2000)
+      })
+
+      it('should handle missing manifest file', async () => {
+        const record: StoreRecord = {
+          timestampFetch: Date.now(),
+          timestampNotification: Date.now(),
+          version: '1.0.0',
+        }
+        await manifest.set('new-pkg', record)
+
+        expect(existsSync(manifestPath)).toBe(true)
+      })
+    })
+
+    describe('clear', () => {
+      it('should remove specific entry', async () => {
+        const record: StoreRecord = {
+          timestampFetch: Date.now(),
+          timestampNotification: Date.now(),
+          version: '1.0.0',
+        }
+        await manifest.set('pkg-to-clear', record)
+        expect(manifest.get('pkg-to-clear')).toBeDefined()
+
+        await manifest.clear('pkg-to-clear')
+        expect(manifest.get('pkg-to-clear')).toBeUndefined()
+      })
+
+      it('should not throw when clearing non-existent entry', async () => {
+        await expect(manifest.clear('non-existent')).resolves.not.toThrow()
+      })
+
+      it('should not throw when manifest file does not exist', async () => {
+        await expect(manifest.clear('anything')).resolves.not.toThrow()
+      })
+
+      it('should not affect other entries', async () => {
+        const record1: StoreRecord = {
+          timestampFetch: Date.now(),
+          timestampNotification: Date.now(),
+          version: '1.0.0',
+        }
+        const record2: StoreRecord = {
+          timestampFetch: Date.now(),
+          timestampNotification: Date.now(),
+          version: '2.0.0',
+        }
+        await manifest.set('pkg1', record1)
+        await manifest.set('pkg2', record2)
+
+        await manifest.clear('pkg1')
+
+        expect(manifest.get('pkg1')).toBeUndefined()
+        expect(manifest.get('pkg2')).toBeDefined()
+      })
+    })
+
+    describe('clearAll', () => {
+      it('should remove entire manifest file', async () => {
+        const details: PackageDetails = { installed_version: '1.0.0' }
+        await manifest.setPackageEntry('pkg1', 'key1', details)
+        await manifest.setPackageEntry('pkg2', 'key2', details)
+
+        expect(existsSync(manifestPath)).toBe(true)
+
+        await manifest.clearAll()
+
+        expect(existsSync(manifestPath)).toBe(false)
+      })
+
+      it('should not throw when manifest does not exist', async () => {
+        await expect(manifest.clearAll()).resolves.not.toThrow()
+      })
+
+      it('should clear all entries', async () => {
+        const details: PackageDetails = { installed_version: '1.0.0' }
+        await manifest.setPackageEntry('pkg1', 'key1', details)
+        await manifest.setPackageEntry('pkg2', 'key2', details)
+
+        await manifest.clearAll()
+
+        expect(manifest.getManifestEntry('pkg1')).toBeUndefined()
+        expect(manifest.getManifestEntry('pkg2')).toBeUndefined()
+      })
+    })
+
+    describe('isFresh', () => {
+      it('should return false for undefined record', () => {
+        expect(manifest.isFresh(undefined, 10_000)).toBe(false)
+      })
+
+      it('should return true for fresh record', () => {
+        const record: StoreRecord = {
+          timestampFetch: Date.now(),
+          timestampNotification: Date.now(),
+          version: '1.0.0',
+        }
+        expect(manifest.isFresh(record, 10_000)).toBe(true)
+      })
+
+      it('should return false for stale record', () => {
+        const record: StoreRecord = {
+          timestampFetch: Date.now() - 20_000,
+          timestampNotification: Date.now(),
+          version: '1.0.0',
+        }
+        expect(manifest.isFresh(record, 10_000)).toBe(false)
+      })
+
+      it('should handle edge case at TTL boundary', () => {
+        const ttl = 5000
+        const record: StoreRecord = {
+          timestampFetch: Date.now() - ttl,
+          timestampNotification: Date.now(),
+          version: '1.0.0',
+        }
+        // At exact boundary, should be stale
+        expect(manifest.isFresh(record, ttl)).toBe(false)
+      })
+
+      it('should handle zero TTL', () => {
+        const record: StoreRecord = {
+          timestampFetch: Date.now(),
+          timestampNotification: Date.now(),
+          version: '1.0.0',
+        }
+        expect(manifest.isFresh(record, 0)).toBe(false)
+      })
+    })
+
+    describe('getAllPackages', () => {
+      it('should return empty array when manifest does not exist', () => {
+        const packages = manifest.getAllPackages()
+        expect(packages).toEqual([])
+      })
+
+      it('should return empty array for empty manifest', () => {
+        writeFileSync(manifestPath, '{}', 'utf8')
+        const packages = manifest.getAllPackages()
+        expect(packages).toEqual([])
+      })
+
+      it('should return all package keys', async () => {
+        const record1: StoreRecord = {
+          timestampFetch: Date.now(),
+          timestampNotification: Date.now(),
+          version: '1.0.0',
+        }
+        const record2: StoreRecord = {
+          timestampFetch: Date.now(),
+          timestampNotification: Date.now(),
+          version: '2.0.0',
+        }
+        await manifest.set('pkg1', record1)
+        await manifest.set('pkg2', record2)
+
+        const packages = manifest.getAllPackages()
+        expect(packages).toContain('pkg1')
+        expect(packages).toContain('pkg2')
+        expect(packages).toHaveLength(2)
+      })
+
+      it('should include both legacy and new format entries', async () => {
+        const record: StoreRecord = {
+          timestampFetch: Date.now(),
+          timestampNotification: Date.now(),
+          version: '1.0.0',
+        }
+        await manifest.set('legacy-pkg', record)
+
+        const details: PackageDetails = { installed_version: '2.0.0' }
+        await manifest.setPackageEntry('new-pkg', 'key', details)
+
+        const packages = manifest.getAllPackages()
+        expect(packages).toContain('legacy-pkg')
+        expect(packages).toContain('new-pkg')
+      })
+
+      it('should handle corrupted manifest gracefully', () => {
+        writeFileSync(manifestPath, 'invalid json{{{', 'utf8')
+        const packages = manifest.getAllPackages()
+        expect(packages).toEqual([])
+      })
+    })
+
+    describe('error handling', () => {
+      it('should handle read errors gracefully in getManifestEntry', () => {
+        writeFileSync(manifestPath, 'corrupted{', 'utf8')
+        const entry = manifest.getManifestEntry('test')
+        expect(entry).toBeUndefined()
+      })
+
+      it('should handle write errors in setPackageEntry', async () => {
+        // Make directory read-only to cause write failure
+        const readOnlyDir = join(testDir, 'readonly')
+        mkdirSync(readOnlyDir, { recursive: true })
+        const readOnlyPath = join(readOnlyDir, '.dlx-manifest.json')
+        const readOnlyManifest = new DlxManifest({ manifestPath: readOnlyPath })
+
+        // Write initial file
+        writeFileSync(readOnlyPath, '{}', 'utf8')
+
+        // On most systems, we can't easily make a file truly unwritable in tests
+        // This test documents the expected behavior
+        const details: PackageDetails = { installed_version: '1.0.0' }
+        await expect(
+          readOnlyManifest.setPackageEntry('test', 'key', details),
+        ).resolves.not.toThrow()
+      })
+    })
+
+    describe('concurrent operations', () => {
+      it('should handle multiple writes sequentially', async () => {
+        const details1: PackageDetails = { installed_version: '1.0.0' }
+        const details2: PackageDetails = { installed_version: '2.0.0' }
+        const details3: PackageDetails = { installed_version: '3.0.0' }
+
+        await Promise.all([
+          manifest.setPackageEntry('pkg1', 'key1', details1),
+          manifest.setPackageEntry('pkg2', 'key2', details2),
+          manifest.setPackageEntry('pkg3', 'key3', details3),
+        ])
+
+        expect(manifest.getManifestEntry('pkg1')).toBeDefined()
+        expect(manifest.getManifestEntry('pkg2')).toBeDefined()
+        expect(manifest.getManifestEntry('pkg3')).toBeDefined()
+      })
+
+      it('should handle mixed read/write operations', async () => {
+        const details: PackageDetails = { installed_version: '1.0.0' }
+        await manifest.setPackageEntry('pkg', 'key', details)
+
+        const results = await Promise.all([
+          manifest.getManifestEntry('pkg'),
+          manifest.setPackageEntry('pkg2', 'key2', details),
+          manifest.getManifestEntry('pkg'),
+        ])
+
+        expect(results[0]).toBeDefined()
+        expect(results[2]).toBeDefined()
+      })
+    })
+  })
+})
diff --git a/test/unit/dlx-package.test.ts b/test/unit/dlx-package.test.ts
new file mode 100644
index 0000000..6c52ace
--- /dev/null
+++ b/test/unit/dlx-package.test.ts
@@ -0,0 +1,760 @@
+/**
+ * @fileoverview Unit tests for DLX package installation and resolution.
+ *
+ * Tests DLX package installation and binary resolution:
+ * - generatePackageCacheKey() creates SHA256-based cache keys
+ * - Package installation to cache directory
+ * - Binary resolution from installed packages
+ * - Cross-platform compatibility (Windows, Unix)
+ * - node_modules structure validation
+ * Used by Socket CLI dlxBinary() for package extraction and execution.
+ */
+
+import { createHash } from 'node:crypto'
+import { existsSync, mkdirSync, writeFileSync } from 'node:fs'
+import path from 'node:path'
+import { describe, expect, it } from 'vitest'
+
+import type { DlxPackageOptions, DlxPackageResult } from '../../src/dlx-package'
+import { runWithTempDir } from './utils/temp-file-helper.mjs'
+
+describe('dlx-package', () => {
+  describe('generatePackageCacheKey', () => {
+    it('should generate consistent 16-char hex hash', () => {
+      const spec = 'cowsay@1.6.0'
+      const hash1 = createHash('sha256').update(spec).digest('hex').slice(0, 16)
+      const hash2 = createHash('sha256').update(spec).digest('hex').slice(0, 16)
+
+      expect(hash1).toBe(hash2)
+      expect(hash1).toHaveLength(16)
+      expect(hash1).toMatch(/^[0-9a-f]{16}$/)
+    })
+
+    it('should generate different hashes for different specs', () => {
+      const hash1 = createHash('sha256')
+        .update('cowsay@1.6.0')
+        .digest('hex')
+        .slice(0, 16)
+      const hash2 = createHash('sha256')
+        .update('cowsay@1.5.0')
+        .digest('hex')
+        .slice(0, 16)
+
+      expect(hash1).not.toBe(hash2)
+    })
+
+    it('should generate same hash for same spec across platforms', () => {
+      // Hash is based on string, not paths, so platform-independent.
+      const spec = '@cyclonedx/cdxgen@11.7.0'
+      const hash = createHash('sha256').update(spec).digest('hex').slice(0, 16)
+
+      // Verify hash is lowercase hex.
+      expect(hash).toMatch(/^[0-9a-f]{16}$/)
+      expect(hash).toHaveLength(16)
+    })
+  })
+
+  describe('parsePackageSpec', () => {
+    it('should parse unscoped package with version', () => {
+      // This tests the internal parsePackageSpec via the public API behavior.
+      const spec = 'lodash@4.17.21'
+      expect(spec).toContain('@')
+      expect(spec.split('@')).toHaveLength(2)
+    })
+
+    it('should parse unscoped package without version', () => {
+      const spec = 'lodash'
+      expect(spec).not.toContain('@')
+    })
+
+    it('should parse scoped package with version', () => {
+      const spec = '@cyclonedx/cdxgen@11.7.0'
+      const parts = spec.split('@')
+      expect(parts).toHaveLength(3)
+      expect(parts[0]).toBe('')
+      expect(parts[1]).toBe('cyclonedx/cdxgen')
+      expect(parts[2]).toBe('11.7.0')
+    })
+
+    it('should parse scoped package without version', () => {
+      const spec = '@cyclonedx/cdxgen'
+      const parts = spec.split('@')
+      expect(parts).toHaveLength(2)
+      expect(parts[0]).toBe('')
+      expect(parts[1]).toBe('cyclonedx/cdxgen')
+    })
+
+    it('should handle complex version ranges', () => {
+      const specs = [
+        'lodash@^4.17.0',
+        'lodash@~4.17.21',
+        'lodash@>=4.0.0',
+        'lodash@>4.0.0 <5.0.0',
+      ]
+
+      for (const spec of specs) {
+        expect(spec).toContain('@')
+        const atIndex = spec.lastIndexOf('@')
+        expect(atIndex).toBeGreaterThan(0)
+      }
+    })
+  })
+
+  describe('path construction (cross-platform)', () => {
+    it('should construct normalized paths on current platform', async () => {
+      await runWithTempDir(async tempDir => {
+        const dlxDir = path.join(tempDir, '_dlx')
+        const hash = '0a80f0fb114540fe'
+        const packageDir = path.join(dlxDir, hash)
+
+        // Verify path uses platform-specific separators.
+        if (process.platform === 'win32') {
+          expect(packageDir).toContain('\\')
+        } else {
+          expect(packageDir).toContain('/')
+        }
+
+        // Verify path is absolute.
+        expect(path.isAbsolute(packageDir)).toBe(true)
+      }, 'dlx-pkg-path-')
+    })
+
+    it('should handle scoped package names in paths', async () => {
+      await runWithTempDir(async tempDir => {
+        const packageDir = path.join(tempDir, 'node_modules')
+        const scopedName = '@cyclonedx/cdxgen'
+
+        // Node.js path.join handles forward slashes in package names.
+        const installedDir = path.join(packageDir, scopedName)
+
+        // Verify path is constructed correctly.
+        expect(installedDir).toContain(packageDir)
+        expect(installedDir).toContain('cyclonedx')
+        expect(installedDir).toContain('cdxgen')
+
+        // On Windows, forward slash in package name becomes backslash.
+        if (process.platform === 'win32') {
+          expect(installedDir).toContain('\\@cyclonedx\\cdxgen')
+        } else {
+          expect(installedDir).toContain('/@cyclonedx/cdxgen')
+        }
+      }, 'dlx-pkg-scoped-')
+    })
+
+    it('should handle binary paths from package.json', async () => {
+      await runWithTempDir(async tempDir => {
+        const installedDir = path.join(tempDir, 'node_modules', 'pkg')
+        const binPath = './bin/cli.js' // From package.json (always forward slashes).
+
+        // path.join normalizes forward slashes to platform separator.
+        const fullBinPath = path.join(installedDir, binPath)
+
+        // Verify path is constructed correctly.
+        expect(fullBinPath).toContain('bin')
+        expect(fullBinPath).toContain('cli.js')
+
+        if (process.platform === 'win32') {
+          expect(fullBinPath).toContain('\\bin\\cli.js')
+        } else {
+          expect(fullBinPath).toContain('/bin/cli.js')
+        }
+      }, 'dlx-pkg-binpath-')
+    })
+
+    it('should normalize mixed separators in paths', async () => {
+      await runWithTempDir(async tempDir => {
+        const basePath = tempDir
+        const relativePath = 'node_modules/@scope/pkg/bin/cli.js'
+
+        // path.join handles mixed separators.
+        const fullPath = path.join(basePath, relativePath)
+
+        expect(path.isAbsolute(fullPath)).toBe(true)
+        expect(fullPath).toContain('node_modules')
+        expect(fullPath).toContain('cli.js')
+      }, 'dlx-pkg-mixed-')
+    })
+  })
+
+  describe('DlxPackageOptions interface', () => {
+    it('should accept valid package specs', () => {
+      const options: DlxPackageOptions = {
+        package: 'cowsay@1.6.0',
+      }
+
+      expect(options.package).toBe('cowsay@1.6.0')
+      expect(options.force).toBeUndefined()
+      expect(options.spawnOptions).toBeUndefined()
+    })
+
+    it('should accept force option', () => {
+      const options: DlxPackageOptions = {
+        force: true,
+        package: 'cowsay@1.6.0',
+      }
+
+      expect(options.force).toBe(true)
+    })
+
+    it('should accept yes option (CLI-style)', () => {
+      const options: DlxPackageOptions = {
+        package: 'cowsay@1.6.0',
+        yes: true,
+      }
+
+      expect(options.yes).toBe(true)
+    })
+
+    it('should accept quiet option (CLI-style, reserved)', () => {
+      const options: DlxPackageOptions = {
+        package: 'cowsay@1.6.0',
+        quiet: true,
+      }
+
+      expect(options.quiet).toBe(true)
+    })
+
+    it('should accept spawn options', () => {
+      const options: DlxPackageOptions = {
+        package: 'cowsay@1.6.0',
+        spawnOptions: {
+          cwd: '/tmp',
+          env: { FOO: 'bar' },
+        },
+      }
+
+      expect(options.spawnOptions?.cwd).toBe('/tmp')
+      expect(options.spawnOptions?.env?.['FOO']).toBe('bar')
+    })
+
+    it('should handle yes and force together', () => {
+      const options: DlxPackageOptions = {
+        force: false,
+        package: 'cowsay@1.6.0',
+        yes: true,
+      }
+
+      // Both flags can be set independently
+      expect(options.yes).toBe(true)
+      expect(options.force).toBe(false)
+      // In implementation, yes takes precedence and implies force
+    })
+  })
+
+  describe('DlxPackageResult interface', () => {
+    it('should have correct field types', () => {
+      // Verify interface structure at compile time.
+      const result: Partial<DlxPackageResult> = {
+        binaryPath: '/path/to/binary',
+        installed: true,
+        packageDir: '/path/to/package',
+      }
+
+      expect(result.packageDir).toBe('/path/to/package')
+      expect(result.binaryPath).toBe('/path/to/binary')
+      expect(result.installed).toBe(true)
+    })
+  })
+
+  describe('cross-platform binary execution', () => {
+    it('should identify Windows platform correctly', () => {
+      const isWindows = process.platform === 'win32'
+      expect(typeof isWindows).toBe('boolean')
+    })
+
+    it('should handle binary permissions on Unix', async () => {
+      if (process.platform === 'win32') {
+        // Skip on Windows.
+        return
+      }
+
+      await runWithTempDir(async tempDir => {
+        // Create a mock binary file.
+        const binPath = path.join(tempDir, 'test-binary')
+        writeFileSync(binPath, '#!/bin/bash\necho "test"')
+
+        // Verify file exists.
+        expect(existsSync(binPath)).toBe(true)
+      }, 'dlx-pkg-unix-')
+    })
+
+    it('should skip chmod on Windows', async () => {
+      if (process.platform !== 'win32') {
+        // Skip on non-Windows.
+        return
+      }
+
+      await runWithTempDir(async tempDir => {
+        // On Windows, chmod is skipped (no-op).
+        const binPath = path.join(tempDir, 'test.bat')
+        writeFileSync(binPath, '@echo off\necho test')
+
+        expect(existsSync(binPath)).toBe(true)
+      }, 'dlx-pkg-win-')
+    })
+  })
+
+  describe('hash collision resistance', () => {
+    it('should have extremely low collision probability', () => {
+      // Generate hashes for many similar specs.
+      const specs = [
+        'pkg@1.0.0',
+        'pkg@1.0.1',
+        'pkg@1.1.0',
+        'pkg@2.0.0',
+        'pkg-a@1.0.0',
+        'pkg-b@1.0.0',
+      ]
+
+      const hashes = new Set<string>()
+      for (const spec of specs) {
+        const hash = createHash('sha256')
+          .update(spec)
+          .digest('hex')
+          .slice(0, 16)
+        hashes.add(hash)
+      }
+
+      // All hashes should be unique.
+      expect(hashes.size).toBe(specs.length)
+    })
+
+    it('should handle unicode in package names', () => {
+      // Some packages have unicode in names.
+      const spec = 'emoji-😀@1.0.0'
+      const hash = createHash('sha256').update(spec).digest('hex').slice(0, 16)
+
+      expect(hash).toMatch(/^[0-9a-f]{16}$/)
+      expect(hash).toHaveLength(16)
+    })
+  })
+
+  describe('version range detection', () => {
+    const rangeOperatorsRegExp = /[~^><=xX* ]|\|\|/
+
+    it('should detect caret ranges', () => {
+      expect(rangeOperatorsRegExp.test('^1.0.0')).toBe(true)
+      expect(rangeOperatorsRegExp.test('^11.0.0')).toBe(true)
+    })
+
+    it('should detect tilde ranges', () => {
+      expect(rangeOperatorsRegExp.test('~1.0.0')).toBe(true)
+      expect(rangeOperatorsRegExp.test('~11.7.0')).toBe(true)
+    })
+
+    it('should detect greater than ranges', () => {
+      expect(rangeOperatorsRegExp.test('>1.0.0')).toBe(true)
+      expect(rangeOperatorsRegExp.test('>=1.0.0')).toBe(true)
+    })
+
+    it('should detect less than ranges', () => {
+      expect(rangeOperatorsRegExp.test('<2.0.0')).toBe(true)
+      expect(rangeOperatorsRegExp.test('<=2.0.0')).toBe(true)
+    })
+
+    it('should detect wildcard ranges', () => {
+      expect(rangeOperatorsRegExp.test('1.0.x')).toBe(true)
+      expect(rangeOperatorsRegExp.test('1.0.X')).toBe(true)
+      expect(rangeOperatorsRegExp.test('1.0.*')).toBe(true)
+    })
+
+    it('should detect complex ranges', () => {
+      expect(rangeOperatorsRegExp.test('>1.0.0 <2.0.0')).toBe(true)
+      expect(rangeOperatorsRegExp.test('>=1.0.0 <=2.0.0')).toBe(true)
+      expect(rangeOperatorsRegExp.test('1.0.0 || 2.0.0')).toBe(true)
+    })
+
+    it('should not detect exact versions', () => {
+      expect(rangeOperatorsRegExp.test('1.0.0')).toBe(false)
+      expect(rangeOperatorsRegExp.test('11.7.0')).toBe(false)
+      expect(rangeOperatorsRegExp.test('0.0.1')).toBe(false)
+    })
+
+    it('should not detect versions with prerelease tags', () => {
+      expect(rangeOperatorsRegExp.test('1.0.0-alpha')).toBe(false)
+      expect(rangeOperatorsRegExp.test('1.0.0-beta.1')).toBe(false)
+      expect(rangeOperatorsRegExp.test('1.0.0+build.123')).toBe(false)
+    })
+
+    it('should handle packages with x in name correctly', () => {
+      // Note: Regex matches 'x' character anywhere, but in real usage
+      // we only test the version string, not the package name.
+      // Package name '@cyclonedx/cdxgen' contains 'x' which would match,
+      // but this is fine because we parse name and version separately.
+      expect(rangeOperatorsRegExp.test('cyclonedx')).toBe(true) // Contains 'x'.
+      expect(rangeOperatorsRegExp.test('express')).toBe(true) // Contains 'x'.
+
+      // In practice, we only test version strings.
+      expect(rangeOperatorsRegExp.test('1.2.3')).toBe(false) // Exact version, no 'x'.
+    })
+  })
+
+  describe('binary resolution with cross-platform wrappers', () => {
+    it('should resolve .cmd wrapper on Windows', async () => {
+      if (process.platform !== 'win32') {
+        return
+      }
+
+      await runWithTempDir(async tempDir => {
+        // Create mock package structure
+        const nodeModules = path.join(tempDir, 'node_modules', 'test-pkg')
+        mkdirSync(nodeModules, { recursive: true })
+
+        // Create package.json with binary
+        const pkgJson = {
+          name: 'test-pkg',
+          version: '1.0.0',
+          bin: {
+            'test-cli': './bin/cli.js',
+          },
+        }
+        writeFileSync(
+          path.join(nodeModules, 'package.json'),
+          JSON.stringify(pkgJson),
+        )
+
+        // Create binary directory
+        const binDir = path.join(nodeModules, 'bin')
+        mkdirSync(binDir, { recursive: true })
+
+        // Create .cmd wrapper (Windows shim created by npm)
+        writeFileSync(
+          path.join(binDir, 'cli.js.cmd'),
+          '@echo off\nnode "%~dp0cli.js" %*',
+        )
+
+        // Also create the actual JS file
+        writeFileSync(
+          path.join(binDir, 'cli.js'),
+          '#!/usr/bin/env node\nconsole.log("test")',
+        )
+
+        // Binary resolution should find the .cmd wrapper
+        expect(existsSync(path.join(binDir, 'cli.js.cmd'))).toBe(true)
+      }, 'dlx-pkg-cmd-')
+    })
+
+    it('should resolve .ps1 wrapper on Windows', async () => {
+      if (process.platform !== 'win32') {
+        return
+      }
+
+      await runWithTempDir(async tempDir => {
+        // Create mock package structure
+        const nodeModules = path.join(tempDir, 'node_modules', 'test-pkg')
+        mkdirSync(nodeModules, { recursive: true })
+
+        // Create package.json
+        const pkgJson = {
+          name: 'test-pkg',
+          version: '1.0.0',
+          bin: './bin/cli.js',
+        }
+        writeFileSync(
+          path.join(nodeModules, 'package.json'),
+          JSON.stringify(pkgJson),
+        )
+
+        // Create binary directory
+        const binDir = path.join(nodeModules, 'bin')
+        mkdirSync(binDir, { recursive: true })
+
+        // Create .ps1 wrapper (PowerShell wrapper)
+        writeFileSync(
+          path.join(binDir, 'cli.js.ps1'),
+          '#!/usr/bin/env pwsh\n$basedir=Split-Path $MyInvocation.MyCommand.Definition -Parent\nnode "$basedir/cli.js" $args',
+        )
+
+        // Create the actual JS file
+        writeFileSync(
+          path.join(binDir, 'cli.js'),
+          '#!/usr/bin/env node\nconsole.log("test")',
+        )
+
+        // Binary resolution should find the .ps1 wrapper
+        expect(existsSync(path.join(binDir, 'cli.js.ps1'))).toBe(true)
+      }, 'dlx-pkg-ps1-')
+    })
+
+    it('should resolve .exe binary on Windows', async () => {
+      await runWithTempDir(async tempDir => {
+        if (process.platform !== 'win32') {
+          return
+        }
+
+        // Create mock package structure
+        const nodeModules = path.join(tempDir, 'node_modules', 'test-pkg')
+        mkdirSync(nodeModules, { recursive: true })
+
+        // Create package.json
+        const pkgJson = {
+          name: 'test-pkg',
+          version: '1.0.0',
+          bin: './bin/tool',
+        }
+        writeFileSync(
+          path.join(nodeModules, 'package.json'),
+          JSON.stringify(pkgJson),
+        )
+
+        // Create binary directory
+        const binDir = path.join(nodeModules, 'bin')
+        mkdirSync(binDir, { recursive: true })
+
+        // Create .exe binary (native executable)
+        writeFileSync(path.join(binDir, 'tool.exe'), 'MZ\x90\x00') // Minimal PE header
+
+        // Binary resolution should find the .exe
+        expect(existsSync(path.join(binDir, 'tool.exe'))).toBe(true)
+      }, 'dlx-pkg-exe-')
+    })
+
+    it('should use bare path on Unix', async () => {
+      await runWithTempDir(async tempDir => {
+        if (process.platform === 'win32') {
+          return
+        }
+
+        // Create mock package structure
+        const nodeModules = path.join(tempDir, 'node_modules', 'test-pkg')
+        mkdirSync(nodeModules, { recursive: true })
+
+        // Create package.json
+        const pkgJson = {
+          name: 'test-pkg',
+          version: '1.0.0',
+          bin: './bin/cli',
+        }
+        writeFileSync(
+          path.join(nodeModules, 'package.json'),
+          JSON.stringify(pkgJson),
+        )
+
+        // Create binary directory
+        const binDir = path.join(nodeModules, 'bin')
+        mkdirSync(binDir, { recursive: true })
+
+        // Create bare executable (no wrapper needed on Unix)
+        writeFileSync(
+          path.join(binDir, 'cli'),
+          '#!/usr/bin/env node\nconsole.log("test")',
+        )
+
+        // Binary resolution should use the bare path directly
+        expect(existsSync(path.join(binDir, 'cli'))).toBe(true)
+      }, 'dlx-pkg-unix-')
+    })
+
+    it('should handle missing binary error', async () => {
+      await runWithTempDir(async tempDir => {
+        // Create mock package without bin field
+        const nodeModules = path.join(tempDir, 'node_modules', 'no-bin-pkg')
+        mkdirSync(nodeModules, { recursive: true })
+
+        // Create package.json without bin field
+        const pkgJson = {
+          name: 'no-bin-pkg',
+          version: '1.0.0',
+        }
+        writeFileSync(
+          path.join(nodeModules, 'package.json'),
+          JSON.stringify(pkgJson),
+        )
+
+        // Reading package.json should work but bin field is missing
+        expect(existsSync(path.join(nodeModules, 'package.json'))).toBe(true)
+        const pkg = JSON.parse(
+          require('node:fs').readFileSync(
+            path.join(nodeModules, 'package.json'),
+            'utf8',
+          ),
+        )
+        expect(pkg.bin).toBeUndefined()
+      }, 'dlx-pkg-missing-')
+    })
+
+    it('should auto-select single binary', async () => {
+      await runWithTempDir(async tempDir => {
+        // Create mock package with single binary
+        const nodeModules = path.join(tempDir, 'node_modules', 'single-bin')
+        mkdirSync(nodeModules, { recursive: true })
+
+        // Create package.json with single binary
+        const pkgJson = {
+          name: 'single-bin',
+          version: '1.0.0',
+          bin: './cli.js',
+        }
+        writeFileSync(
+          path.join(nodeModules, 'package.json'),
+          JSON.stringify(pkgJson),
+        )
+
+        // Create binary
+        writeFileSync(
+          path.join(nodeModules, 'cli.js'),
+          '#!/usr/bin/env node\nconsole.log("test")',
+        )
+
+        // Should auto-select the single binary
+        expect(existsSync(path.join(nodeModules, 'cli.js'))).toBe(true)
+        const pkg = JSON.parse(
+          require('node:fs').readFileSync(
+            path.join(nodeModules, 'package.json'),
+            'utf8',
+          ),
+        )
+        expect(typeof pkg.bin).toBe('string')
+        expect(pkg.bin).toBe('./cli.js')
+      }, 'dlx-pkg-single-')
+    })
+
+    it('should select correct binary from multiple options', async () => {
+      await runWithTempDir(async tempDir => {
+        // Create mock package with multiple binaries
+        const nodeModules = path.join(
+          tempDir,
+          'node_modules',
+          '@scope',
+          'multi-bin',
+        )
+        mkdirSync(nodeModules, { recursive: true })
+
+        // Create package.json with multiple binaries
+        const pkgJson = {
+          name: '@scope/multi-bin',
+          version: '1.0.0',
+          bin: {
+            'tool-a': './bin/a.js',
+            'tool-b': './bin/b.js',
+            'multi-bin': './bin/main.js',
+          },
+        }
+        writeFileSync(
+          path.join(nodeModules, 'package.json'),
+          JSON.stringify(pkgJson),
+        )
+
+        // Create binary directory
+        const binDir = path.join(nodeModules, 'bin')
+        mkdirSync(binDir, { recursive: true })
+
+        // Create all binaries
+        writeFileSync(
+          path.join(binDir, 'a.js'),
+          '#!/usr/bin/env node\nconsole.log("a")',
+        )
+        writeFileSync(
+          path.join(binDir, 'b.js'),
+          '#!/usr/bin/env node\nconsole.log("b")',
+        )
+        writeFileSync(
+          path.join(binDir, 'main.js'),
+          '#!/usr/bin/env node\nconsole.log("main")',
+        )
+
+        // Should find the binary matching last segment of package name
+        const pkg = JSON.parse(
+          require('node:fs').readFileSync(
+            path.join(nodeModules, 'package.json'),
+            'utf8',
+          ),
+        )
+        expect(pkg.bin['multi-bin']).toBe('./bin/main.js')
+
+        // Test fallback to first binary
+        expect(Object.keys(pkg.bin)[0]).toBe('tool-a')
+      }, 'dlx-pkg-multi-')
+    })
+
+    it('should fallback to first binary when name does not match', async () => {
+      await runWithTempDir(async tempDir => {
+        // Create mock package with multiple binaries
+        const nodeModules = path.join(tempDir, 'node_modules', 'fallback-pkg')
+        mkdirSync(nodeModules, { recursive: true })
+
+        // Create package.json where no binary name matches package name
+        const pkgJson = {
+          name: 'fallback-pkg',
+          version: '1.0.0',
+          bin: {
+            'other-a': './bin/a.js',
+            'other-b': './bin/b.js',
+          },
+        }
+        writeFileSync(
+          path.join(nodeModules, 'package.json'),
+          JSON.stringify(pkgJson),
+        )
+
+        // Create binary directory
+        const binDir = path.join(nodeModules, 'bin')
+        mkdirSync(binDir, { recursive: true })
+
+        // Create binaries
+        writeFileSync(
+          path.join(binDir, 'a.js'),
+          '#!/usr/bin/env node\nconsole.log("a")',
+        )
+        writeFileSync(
+          path.join(binDir, 'b.js'),
+          '#!/usr/bin/env node\nconsole.log("b")',
+        )
+
+        // Should fall back to first binary (other-a)
+        const pkg = JSON.parse(
+          require('node:fs').readFileSync(
+            path.join(nodeModules, 'package.json'),
+            'utf8',
+          ),
+        )
+        const firstBinary = Object.keys(pkg.bin)[0]
+        expect(firstBinary).toBe('other-a')
+        expect(pkg.bin[firstBinary]).toBe('./bin/a.js')
+      }, 'dlx-pkg-fallback-')
+    })
+
+    it('should prioritize wrapper extensions on Windows', async () => {
+      await runWithTempDir(async tempDir => {
+        if (process.platform !== 'win32') {
+          return
+        }
+
+        // Create mock package structure
+        const nodeModules = path.join(tempDir, 'node_modules', 'wrapper-test')
+        mkdirSync(nodeModules, { recursive: true })
+
+        // Create package.json
+        const pkgJson = {
+          name: 'wrapper-test',
+          version: '1.0.0',
+          bin: './bin/tool',
+        }
+        writeFileSync(
+          path.join(nodeModules, 'package.json'),
+          JSON.stringify(pkgJson),
+        )
+
+        // Create binary directory
+        const binDir = path.join(nodeModules, 'bin')
+        mkdirSync(binDir, { recursive: true })
+
+        // Create multiple wrappers - .cmd should be prioritized
+        writeFileSync(path.join(binDir, 'tool.cmd'), '@echo off\nnode tool.js')
+        writeFileSync(
+          path.join(binDir, 'tool.ps1'),
+          '#!/usr/bin/env pwsh\nnode tool.js',
+        )
+        writeFileSync(path.join(binDir, 'tool'), '#!/bin/sh\nnode tool.js')
+
+        // Verify all wrappers exist
+        expect(existsSync(path.join(binDir, 'tool.cmd'))).toBe(true)
+        expect(existsSync(path.join(binDir, 'tool.ps1'))).toBe(true)
+        expect(existsSync(path.join(binDir, 'tool'))).toBe(true)
+
+        // Resolution should prefer .cmd (npm's default wrapper format)
+        // This tests the priority order: .cmd, .bat, .ps1, .exe, bare
+      }, 'dlx-pkg-priority-')
+    })
+  })
+})
diff --git a/test/unit/dlx.test.ts b/test/unit/dlx.test.ts
new file mode 100644
index 0000000..7aec5bc
--- /dev/null
+++ b/test/unit/dlx.test.ts
@@ -0,0 +1,376 @@
+/**
+ * @fileoverview Unit tests for DLX (Download and Execute) cache management utilities.
+ *
+ * Tests DLX cache directory and package management:
+ * - getDlxPackageDir(), getDlxPackageJsonPath() path resolution
+ * - ensureDlxDir(), ensureDlxDirSync() cache directory creation
+ * - clearDlx(), clearDlxSync() cache cleanup
+ * - dlxDirExists(), dlxDirExistsAsync() cache existence checks
+ * - generateCacheKey() creates unique cache keys for packages
+ * Used by Socket CLI for pnpm dlx / npx-style package execution.
+ */
+
+import fs from 'node:fs'
+import path from 'node:path'
+import { afterEach, beforeEach, describe, expect, it } from 'vitest'
+
+import {
+  clearDlx,
+  clearDlxSync,
+  dlxDirExists,
+  dlxDirExistsAsync,
+  ensureDlxDir,
+  ensureDlxDirSync,
+  generateCacheKey,
+  getDlxInstalledPackageDir,
+  getDlxPackageDir,
+  getDlxPackageJsonPath,
+  getDlxPackageNodeModulesDir,
+  isDlxPackageInstalled,
+  isDlxPackageInstalledAsync,
+  isInSocketDlx,
+  listDlxPackages,
+  listDlxPackagesAsync,
+  removeDlxPackage,
+  removeDlxPackageSync,
+} from '@socketsecurity/lib/dlx'
+import { getSocketDlxDir } from '@socketsecurity/lib/paths'
+
+describe.sequential('dlx', () => {
+  const testPackageName = 'test-package'
+  const dlxDir = getSocketDlxDir()
+
+  beforeEach(async () => {
+    // Clean up any existing test artifacts
+    await clearDlx().catch(() => {})
+  })
+
+  afterEach(async () => {
+    // Clean up after tests
+    await clearDlx().catch(() => {})
+  })
+
+  describe('generateCacheKey', () => {
+    it('should generate a 16-character hex string', () => {
+      const key = generateCacheKey('test-spec')
+      expect(key).toHaveLength(16)
+      expect(key).toMatch(/^[0-9a-f]{16}$/)
+    })
+
+    it('should generate consistent keys for same input', () => {
+      const key1 = generateCacheKey('test-spec')
+      const key2 = generateCacheKey('test-spec')
+      expect(key1).toBe(key2)
+    })
+
+    it('should generate different keys for different inputs', () => {
+      const key1 = generateCacheKey('test-spec-1')
+      const key2 = generateCacheKey('test-spec-2')
+      expect(key1).not.toBe(key2)
+    })
+
+    it('should handle package specs with versions', () => {
+      const key = generateCacheKey('npm:prettier@3.0.0')
+      expect(key).toHaveLength(16)
+      expect(key).toMatch(/^[0-9a-f]{16}$/)
+    })
+  })
+
+  describe('dlxDirExists / dlxDirExistsAsync', () => {
+    it('should return false when DLX directory does not exist', () => {
+      // Ensure it doesn't exist
+      if (fs.existsSync(dlxDir)) {
+        fs.rmSync(dlxDir, { recursive: true, force: true })
+      }
+      expect(dlxDirExists()).toBe(false)
+    })
+
+    it('should return true when DLX directory exists', async () => {
+      await ensureDlxDir()
+      expect(dlxDirExists()).toBe(true)
+    })
+
+    it('async version should return false when directory does not exist', async () => {
+      // Ensure it doesn't exist (use async version for consistency)
+      try {
+        await fs.promises.rm(dlxDir, { recursive: true, force: true })
+      } catch {
+        // Directory might not exist, which is fine
+      }
+      expect(await dlxDirExistsAsync()).toBe(false)
+    })
+
+    it('async version should return true when directory exists', async () => {
+      await ensureDlxDir()
+      expect(await dlxDirExistsAsync()).toBe(true)
+    })
+  })
+
+  describe('ensureDlxDir / ensureDlxDirSync', () => {
+    it('should create DLX directory if it does not exist', async () => {
+      // Ensure it doesn't exist
+      if (fs.existsSync(dlxDir)) {
+        fs.rmSync(dlxDir, { recursive: true, force: true })
+      }
+      await ensureDlxDir()
+      expect(fs.existsSync(dlxDir)).toBe(true)
+    })
+
+    it('should not throw if DLX directory already exists', async () => {
+      await ensureDlxDir()
+      await expect(ensureDlxDir()).resolves.not.toThrow()
+    })
+
+    it('sync version should create DLX directory if it does not exist', () => {
+      // Ensure it doesn't exist
+      if (fs.existsSync(dlxDir)) {
+        fs.rmSync(dlxDir, { recursive: true, force: true })
+      }
+      ensureDlxDirSync()
+      expect(fs.existsSync(dlxDir)).toBe(true)
+    })
+
+    it('sync version should not throw if DLX directory already exists', () => {
+      ensureDlxDirSync()
+      expect(() => ensureDlxDirSync()).not.toThrow()
+    })
+  })
+
+  describe('getDlxPackageDir', () => {
+    it('should return path to package directory', () => {
+      const packageDir = getDlxPackageDir(testPackageName)
+      expect(packageDir).toContain(dlxDir)
+      expect(packageDir).toContain(testPackageName)
+    })
+
+    it('should normalize path separators', () => {
+      const packageDir = getDlxPackageDir(testPackageName)
+      // Path should not contain backslashes on any platform after normalization
+      expect(packageDir).not.toContain('\\')
+    })
+  })
+
+  describe('getDlxPackageNodeModulesDir', () => {
+    it('should return path to node_modules directory', () => {
+      const nodeModulesDir = getDlxPackageNodeModulesDir(testPackageName)
+      expect(nodeModulesDir).toContain(dlxDir)
+      expect(nodeModulesDir).toContain(testPackageName)
+      expect(nodeModulesDir).toContain('node_modules')
+    })
+  })
+
+  describe('getDlxInstalledPackageDir', () => {
+    it('should return path to installed package directory', () => {
+      const installedDir = getDlxInstalledPackageDir(testPackageName)
+      expect(installedDir).toContain(dlxDir)
+      expect(installedDir).toContain(testPackageName)
+      expect(installedDir).toContain('node_modules')
+    })
+
+    it('should handle scoped packages', () => {
+      const scopedPackage = '@socket/test'
+      const installedDir = getDlxInstalledPackageDir(scopedPackage)
+      expect(installedDir).toContain(dlxDir)
+      expect(installedDir).toContain('@socket/test')
+    })
+  })
+
+  describe('getDlxPackageJsonPath', () => {
+    it('should return path to package.json', () => {
+      const packageJsonPath = getDlxPackageJsonPath(testPackageName)
+      expect(packageJsonPath).toContain(dlxDir)
+      expect(packageJsonPath).toContain(testPackageName)
+      expect(packageJsonPath).toContain('package.json')
+    })
+  })
+
+  describe('isInSocketDlx', () => {
+    it('should return true for paths within DLX directory', () => {
+      const dlxPath = path.join(dlxDir, 'some-package', 'bin', 'binary')
+      expect(isInSocketDlx(dlxPath)).toBe(true)
+    })
+
+    it('should return false for paths outside DLX directory', () => {
+      expect(isInSocketDlx('/usr/local/bin/binary')).toBe(false)
+    })
+
+    it('should return false for empty string', () => {
+      expect(isInSocketDlx('')).toBe(false)
+    })
+
+    it('should handle relative paths', () => {
+      const relativePath = 'some/relative/path'
+      const result = isInSocketDlx(relativePath)
+      expect(typeof result).toBe('boolean')
+    })
+
+    it('should handle paths with trailing separators', () => {
+      const dlxPath = path.join(dlxDir, 'package', '')
+      expect(isInSocketDlx(dlxPath)).toBe(true)
+    })
+  })
+
+  describe('isDlxPackageInstalled / isDlxPackageInstalledAsync', () => {
+    it('should return false when package is not installed', () => {
+      expect(isDlxPackageInstalled(testPackageName)).toBe(false)
+    })
+
+    it('should return true when package is installed', async () => {
+      // Create a mock installation
+      const installedDir = getDlxInstalledPackageDir(testPackageName)
+      await fs.promises.mkdir(installedDir, { recursive: true })
+      expect(isDlxPackageInstalled(testPackageName)).toBe(true)
+    })
+
+    it('async version should return false when package is not installed', async () => {
+      expect(await isDlxPackageInstalledAsync(testPackageName)).toBe(false)
+    })
+
+    it('async version should return true when package is installed', async () => {
+      // Create a mock installation
+      const installedDir = getDlxInstalledPackageDir(testPackageName)
+      await fs.promises.mkdir(installedDir, { recursive: true })
+      expect(await isDlxPackageInstalledAsync(testPackageName)).toBe(true)
+    })
+  })
+
+  describe('listDlxPackages / listDlxPackagesAsync', () => {
+    it('should return empty array when no packages are installed', () => {
+      const packages = listDlxPackages()
+      expect(packages).toEqual([])
+    })
+
+    it('should list installed packages', async () => {
+      // Create mock installations
+      await ensureDlxDir()
+      const pkg1Dir = getDlxPackageDir('package-1')
+      const pkg2Dir = getDlxPackageDir('package-2')
+      await fs.promises.mkdir(pkg1Dir, { recursive: true })
+      await fs.promises.mkdir(pkg2Dir, { recursive: true })
+
+      const packages = listDlxPackages()
+      expect(packages).toContain('package-1')
+      expect(packages).toContain('package-2')
+      expect(packages).toHaveLength(2)
+    })
+
+    it('should return sorted list of packages', async () => {
+      // Create mock installations in reverse order
+      await ensureDlxDir()
+      const pkgZDir = getDlxPackageDir('z-package')
+      const pkgADir = getDlxPackageDir('a-package')
+      await fs.promises.mkdir(pkgZDir, { recursive: true })
+      await fs.promises.mkdir(pkgADir, { recursive: true })
+
+      const packages = listDlxPackages()
+      expect(packages).toEqual(['a-package', 'z-package'])
+    })
+
+    it('async version should return empty array when no packages are installed', async () => {
+      const packages = await listDlxPackagesAsync()
+      expect(packages).toEqual([])
+    })
+
+    it('async version should list installed packages', async () => {
+      // Create mock installations
+      await ensureDlxDir()
+      const pkg1Dir = getDlxPackageDir('package-1')
+      const pkg2Dir = getDlxPackageDir('package-2')
+      await fs.promises.mkdir(pkg1Dir, { recursive: true })
+      await fs.promises.mkdir(pkg2Dir, { recursive: true })
+
+      const packages = await listDlxPackagesAsync()
+      expect(packages).toContain('package-1')
+      expect(packages).toContain('package-2')
+      expect(packages).toHaveLength(2)
+    })
+  })
+
+  describe('removeDlxPackage / removeDlxPackageSync', () => {
+    it('should remove installed package', async () => {
+      // Create a mock installation
+      const packageDir = getDlxPackageDir(testPackageName)
+      await fs.promises.mkdir(packageDir, { recursive: true })
+      expect(fs.existsSync(packageDir)).toBe(true)
+
+      await removeDlxPackage(testPackageName)
+      expect(fs.existsSync(packageDir)).toBe(false)
+    })
+
+    it('should not throw when removing non-existent package', async () => {
+      // safeDelete handles non-existent files gracefully (force: true)
+      await expect(
+        removeDlxPackage('non-existent-package'),
+      ).resolves.not.toThrow()
+    })
+
+    it('sync version should remove installed package', () => {
+      // Create a mock installation
+      const packageDir = getDlxPackageDir(testPackageName)
+      fs.mkdirSync(packageDir, { recursive: true })
+      expect(fs.existsSync(packageDir)).toBe(true)
+
+      removeDlxPackageSync(testPackageName)
+      expect(fs.existsSync(packageDir)).toBe(false)
+    })
+
+    it('sync version should not throw when removing non-existent package', () => {
+      // Removing a non-existent package should not throw (force: true)
+      expect(() => removeDlxPackageSync('non-existent-package')).not.toThrow()
+    })
+  })
+
+  describe('clearDlx / clearDlxSync', () => {
+    it('should remove all DLX packages', async () => {
+      // Create multiple mock installations
+      await ensureDlxDir()
+      const pkg1Dir = getDlxPackageDir('package-1')
+      const pkg2Dir = getDlxPackageDir('package-2')
+      await fs.promises.mkdir(pkg1Dir, { recursive: true })
+      await fs.promises.mkdir(pkg2Dir, { recursive: true })
+
+      expect(listDlxPackages()).toHaveLength(2)
+      await clearDlx()
+      expect(listDlxPackages()).toHaveLength(0)
+    })
+
+    it('should not throw when DLX directory is empty', async () => {
+      await ensureDlxDir()
+      await expect(clearDlx()).resolves.not.toThrow()
+    })
+
+    it('should not throw when DLX directory does not exist', async () => {
+      // Ensure directory doesn't exist
+      if (fs.existsSync(dlxDir)) {
+        fs.rmSync(dlxDir, { recursive: true, force: true })
+      }
+      await expect(clearDlx()).resolves.not.toThrow()
+    })
+
+    it('sync version should remove all DLX packages', () => {
+      // Create multiple mock installations
+      ensureDlxDirSync()
+      const pkg1Dir = getDlxPackageDir('package-1')
+      const pkg2Dir = getDlxPackageDir('package-2')
+      fs.mkdirSync(pkg1Dir, { recursive: true })
+      fs.mkdirSync(pkg2Dir, { recursive: true })
+
+      expect(listDlxPackages()).toHaveLength(2)
+      clearDlxSync()
+      expect(listDlxPackages()).toHaveLength(0)
+    })
+
+    it('sync version should not throw when DLX directory is empty', () => {
+      ensureDlxDirSync()
+      expect(() => clearDlxSync()).not.toThrow()
+    })
+
+    it('sync version should not throw when DLX directory does not exist', () => {
+      // Ensure directory doesn't exist
+      if (fs.existsSync(dlxDir)) {
+        fs.rmSync(dlxDir, { recursive: true, force: true })
+      }
+      expect(() => clearDlxSync()).not.toThrow()
+    })
+  })
+})
diff --git a/test/unit/effects/pulse-frames.test.ts b/test/unit/effects/pulse-frames.test.ts
new file mode 100644
index 0000000..13d121d
--- /dev/null
+++ b/test/unit/effects/pulse-frames.test.ts
@@ -0,0 +1,160 @@
+/**
+ * @fileoverview Unit tests for Socket pulse animation frames generator.
+ *
+ * Tests Socket pulse animation frame generation:
+ * - generateSocketSpinnerFrames() creates 18-frame pulse animation
+ * - ANSI color codes for bold/dim effects
+ * - Unicode sparkle characters (✦✧⋆⚡) with variation selectors
+ * - Symmetrical build-up and fade-down animation pattern
+ * Used by Socket CLI for /ultrathink mode spinner and progress indicators.
+ */
+
+import { describe, expect, it } from 'vitest'
+
+import {
+  generateSocketSpinnerFrames,
+  type SocketFramesOptions,
+} from '@socketsecurity/lib/effects/pulse-frames'
+
+describe('effects/pulse-frames', () => {
+  describe('generateSocketSpinnerFrames', () => {
+    it('should generate frames with default options', () => {
+      const result = generateSocketSpinnerFrames()
+      expect(result).toBeDefined()
+      expect(result.frames).toBeDefined()
+      expect(result.interval).toBeDefined()
+    })
+
+    it('should return default interval of 50ms', () => {
+      const result = generateSocketSpinnerFrames()
+      expect(result.interval).toBe(50)
+    })
+
+    it('should accept custom interval option', () => {
+      const options: SocketFramesOptions = { interval: 100 }
+      const result = generateSocketSpinnerFrames(options)
+      expect(result.interval).toBe(100)
+    })
+
+    it('should generate 18 frames', () => {
+      const result = generateSocketSpinnerFrames()
+      expect(result.frames).toHaveLength(18)
+    })
+
+    it('should return frames as string array', () => {
+      const result = generateSocketSpinnerFrames()
+      expect(Array.isArray(result.frames)).toBe(true)
+      for (const frame of result.frames) {
+        expect(typeof frame).toBe('string')
+      }
+    })
+
+    it('should include ANSI codes in frames', () => {
+      const result = generateSocketSpinnerFrames()
+      // All frames should contain ANSI escape codes
+      for (const frame of result.frames) {
+        expect(frame).toContain('\x1b')
+      }
+    })
+
+    it('should include reset codes in all frames', () => {
+      const result = generateSocketSpinnerFrames()
+      const reset = '\x1b[0m'
+      for (const frame of result.frames) {
+        expect(frame).toContain(reset)
+      }
+    })
+
+    it('should include Unicode sparkle characters', () => {
+      const result = generateSocketSpinnerFrames()
+      const allFramesText = result.frames.join('')
+      // Should contain some sparkle/star characters
+      expect(allFramesText).toMatch(/[✦✧⋆⚡]/)
+    })
+
+    it('should include variation selector for text-style rendering', () => {
+      const result = generateSocketSpinnerFrames()
+      const allFramesText = result.frames.join('')
+      // Should contain VS15 variation selector
+      expect(allFramesText).toContain('\uFE0E')
+    })
+
+    it('should include bold ANSI code in some frames', () => {
+      const result = generateSocketSpinnerFrames()
+      const bold = '\x1b[1m'
+      const boldFrames = result.frames.filter(f => f.includes(bold))
+      expect(boldFrames.length).toBeGreaterThan(0)
+    })
+
+    it('should include dim ANSI code in some frames', () => {
+      const result = generateSocketSpinnerFrames()
+      const dim = '\x1b[2m'
+      const dimFrames = result.frames.filter(f => f.includes(dim))
+      expect(dimFrames.length).toBeGreaterThan(0)
+    })
+
+    it('should return result with null prototype', () => {
+      const result = generateSocketSpinnerFrames()
+      expect(Object.getPrototypeOf(result)).toBeNull()
+    })
+
+    it('should handle baseColor option (ignored internally)', () => {
+      const options: SocketFramesOptions = {
+        baseColor: [255, 100, 120],
+        interval: 75,
+      }
+      const result = generateSocketSpinnerFrames(options)
+      expect(result.interval).toBe(75)
+      expect(result.frames).toHaveLength(18)
+    })
+
+    it('should handle undefined options', () => {
+      const result = generateSocketSpinnerFrames(undefined)
+      expect(result.frames).toHaveLength(18)
+      expect(result.interval).toBe(50)
+    })
+
+    it('should handle empty options object', () => {
+      const result = generateSocketSpinnerFrames({})
+      expect(result.frames).toHaveLength(18)
+      expect(result.interval).toBe(50)
+    })
+
+    it('should have consistent frame structure', () => {
+      const result = generateSocketSpinnerFrames()
+      // All frames should contain ANSI codes and end with reset
+      const reset = '\x1b[0m'
+      for (const frame of result.frames) {
+        expect(frame).toContain('\x1b[')
+        expect(frame.endsWith(reset)).toBe(true)
+      }
+    })
+
+    it('should include lightning emoji in frames', () => {
+      const result = generateSocketSpinnerFrames()
+      const lightning = '⚡'
+      const lightningFrames = result.frames.filter(f => f.includes(lightning))
+      expect(lightningFrames.length).toBeGreaterThan(0)
+    })
+
+    it('should include different star variants', () => {
+      const result = generateSocketSpinnerFrames()
+      const allFramesText = result.frames.join('')
+      // Should contain filled star
+      expect(allFramesText).toContain('✦')
+      // Should contain outline star
+      expect(allFramesText).toContain('✧')
+      // Should contain tiny star
+      expect(allFramesText).toContain('⋆')
+    })
+
+    it('should have symmetrical pulse pattern', () => {
+      const result = generateSocketSpinnerFrames()
+      // The animation should build up and fade down
+      // First 9 frames build up, last 9 fade down
+      expect(result.frames.length % 2).toBe(0)
+      const halfLength = result.frames.length / 2
+      expect(halfLength).toBe(9)
+    })
+  })
+})
diff --git a/test/unit/effects/text-shimmer.test.ts b/test/unit/effects/text-shimmer.test.ts
new file mode 100644
index 0000000..6ca0ba1
--- /dev/null
+++ b/test/unit/effects/text-shimmer.test.ts
@@ -0,0 +1,246 @@
+/**
+ * @fileoverview Unit tests for text shimmer animation effect.
+ *
+ * Tests text shimmer animation utilities:
+ * - applyShimmer() applies animated color gradient to text
+ * - Direction modes: LTR, RTL, bidirectional, random, none
+ * - CI detection: shimmer disabled in CI environments
+ * - Color gradients: single color and multi-color gradient support
+ * Used by Socket CLI for animated text effects in /ultrathink mode.
+ */
+
+import { stripAnsi } from '@socketsecurity/lib/ansi'
+import { getCI } from '@socketsecurity/lib/env/ci'
+import {
+  applyShimmer,
+  DIR_LTR,
+  DIR_NONE,
+  type ShimmerState,
+} from '@socketsecurity/lib/effects/text-shimmer'
+import { beforeEach, describe, expect, it } from 'vitest'
+
+describe.sequential('text-shimmer', () => {
+  describe.sequential('applyShimmer()', () => {
+    let state: ShimmerState
+
+    beforeEach(() => {
+      state = {
+        __proto__: null,
+        currentDir: DIR_LTR,
+        mode: DIR_LTR,
+        speed: 1 / 3,
+        step: 0,
+      } as ShimmerState
+    })
+
+    describe('CI environment behavior', () => {
+      it('should handle shimmer correctly in CI', () => {
+        const text = 'Test text'
+        const result = applyShimmer(text, state, {
+          color: [140, 82, 255] as const,
+          direction: DIR_LTR,
+        })
+
+        // Result should be colored
+        const stripped = stripAnsi(result)
+        expect(stripped).toBe(text)
+
+        // Should contain color codes
+        expect(result).toContain('\x1b[38;2;')
+        expect(result).toContain('140;82;255')
+
+        // In CI: step should not advance (shimmer disabled)
+        // In non-CI: step should advance (shimmer enabled)
+        if (getCI()) {
+          expect(state.step).toBe(0)
+        } else {
+          expect(state.step).toBeGreaterThan(0)
+        }
+      })
+
+      it('should handle all directions correctly in CI', () => {
+        const text = 'Test'
+        const directions = [DIR_LTR, 'rtl', 'bi', 'random'] as const
+
+        for (const dir of directions) {
+          const testState: ShimmerState = {
+            currentDir: DIR_LTR,
+            mode: DIR_LTR,
+            speed: 1 / 3,
+            step: 0,
+          }
+
+          const result = applyShimmer(text, testState, {
+            color: [255, 0, 0] as const,
+            direction: dir,
+          })
+
+          const stripped = stripAnsi(result)
+          expect(stripped).toBe(text)
+
+          // In CI: step should not advance (shimmer disabled)
+          // In non-CI: step should advance (shimmer enabled)
+          if (getCI()) {
+            expect(testState.step).toBe(0)
+          } else {
+            expect(testState.step).toBeGreaterThan(0)
+          }
+        }
+      })
+    })
+
+    describe('shimmer animation behavior', () => {
+      it('should apply color and respect CI environment', () => {
+        const text = 'Test'
+        const result = applyShimmer(text, state, {
+          color: [140, 82, 255] as const,
+          direction: DIR_LTR,
+        })
+
+        // Result should contain ANSI color codes
+        expect(result).toContain('\x1b[38;2;')
+        // Result should have the original text when stripped
+        expect(stripAnsi(result)).toBe(text)
+
+        // In CI: step should not advance (shimmer disabled)
+        // In non-CI: step should advance (shimmer enabled)
+        if (getCI()) {
+          expect(state.step).toBe(0)
+        } else {
+          expect(state.step).toBeGreaterThan(0)
+        }
+      })
+
+      it('should animate shimmer position based on environment', () => {
+        const text = 'Testing'
+        const state1: ShimmerState = {
+          currentDir: DIR_LTR,
+          mode: DIR_LTR,
+          speed: 1,
+          step: 0,
+        }
+
+        const result1 = applyShimmer(text, state1, {
+          color: [140, 82, 255] as const,
+          direction: DIR_LTR,
+        })
+
+        if (getCI()) {
+          // In CI: step should not advance (shimmer disabled)
+          expect(state1.step).toBe(0)
+        } else {
+          // In non-CI: step should advance (shimmer enabled)
+          expect(state1.step).toBe(1)
+
+          const result2 = applyShimmer(text, state1, {
+            color: [140, 82, 255] as const,
+            direction: DIR_LTR,
+          })
+
+          // Step should advance again
+          expect(state1.step).toBe(2)
+
+          // Results should be different due to shimmer position change
+          expect(result1).not.toBe(result2)
+        }
+      })
+    })
+
+    describe('direction modes', () => {
+      it('should respect DIR_NONE and not apply shimmer', () => {
+        const text = 'Test'
+        const result = applyShimmer(text, state, {
+          color: [140, 82, 255] as const,
+          direction: DIR_NONE,
+        })
+
+        // Should be colored but state.step should not advance
+        expect(state.step).toBe(0)
+        expect(stripAnsi(result)).toBe(text)
+      })
+
+      it('should apply LTR direction shimmer based on environment', () => {
+        const text = 'Test'
+        const testState: ShimmerState = {
+          currentDir: DIR_LTR,
+          mode: DIR_LTR,
+          speed: 1 / 3,
+          step: 0,
+        }
+
+        const result = applyShimmer(text, testState, {
+          color: [140, 82, 255] as const,
+          direction: DIR_LTR,
+        })
+
+        expect(stripAnsi(result)).toBe(text)
+
+        // In CI: step should not advance (shimmer disabled)
+        // In non-CI: step should advance (shimmer enabled)
+        if (getCI()) {
+          expect(testState.step).toBe(0)
+        } else {
+          expect(testState.step).toBeGreaterThan(0)
+        }
+      })
+    })
+
+    describe('color options', () => {
+      it('should apply single color to text', () => {
+        const text = 'Test'
+        const color: readonly [number, number, number] = [255, 0, 0] as const
+
+        const result = applyShimmer(text, state, {
+          color,
+          direction: DIR_LTR,
+        })
+
+        // Should contain the red color code
+        expect(result).toContain('\x1b[38;2;')
+        expect(stripAnsi(result)).toBe(text)
+      })
+
+      it('should apply gradient colors to text', () => {
+        const text = 'Test'
+        const gradient: ReadonlyArray<readonly [number, number, number]> = [
+          [255, 0, 0],
+          [0, 255, 0],
+          [0, 0, 255],
+        ] as const
+
+        const result = applyShimmer(text, state, {
+          color: gradient,
+          direction: DIR_LTR,
+        })
+
+        // Should contain color codes
+        expect(result).toContain('\x1b[38;2;')
+        expect(stripAnsi(result)).toBe(text)
+      })
+    })
+
+    describe('edge cases', () => {
+      it('should handle empty text', () => {
+        const result = applyShimmer('', state, {
+          color: [140, 82, 255] as const,
+          direction: DIR_LTR,
+        })
+
+        expect(result).toBe('')
+      })
+
+      it('should preserve text content when shimmer is applied', () => {
+        const texts = ['Simple', 'With Spaces', 'Special!@#$%']
+
+        for (const text of texts) {
+          const result = applyShimmer(text, state, {
+            color: [140, 82, 255] as const,
+            direction: DIR_LTR,
+          })
+
+          expect(stripAnsi(result)).toBe(text)
+        }
+      })
+    })
+  })
+})
diff --git a/test/unit/effects/ultra.test.ts b/test/unit/effects/ultra.test.ts
new file mode 100644
index 0000000..45042a8
--- /dev/null
+++ b/test/unit/effects/ultra.test.ts
@@ -0,0 +1,180 @@
+/**
+ * @fileoverview Tests for ultrathink rainbow gradient effect.
+ *
+ * Tests ultrathink visual effect (rainbow gradient animation):
+ * - createUltraEffect() generates rainbow gradient frames
+ * - Multi-color spectrum transitions
+ * - Smooth color interpolation
+ * - Frame rate and timing control
+ * Used by Socket CLI for /ultrathink mode visual feedback and emphasis.
+ */
+
+import { describe, expect, it } from 'vitest'
+
+import {
+  generateRainbowGradient,
+  RAINBOW_GRADIENT,
+} from '@socketsecurity/lib/effects/ultra'
+
+describe('effects/ultra', () => {
+  describe('RAINBOW_GRADIENT', () => {
+    it('should be defined', () => {
+      expect(RAINBOW_GRADIENT).toBeDefined()
+    })
+
+    it('should have 10 colors', () => {
+      expect(RAINBOW_GRADIENT).toHaveLength(10)
+    })
+
+    it('should contain RGB triplets', () => {
+      for (const color of RAINBOW_GRADIENT) {
+        expect(color).toHaveLength(3)
+        expect(typeof color[0]).toBe('number')
+        expect(typeof color[1]).toBe('number')
+        expect(typeof color[2]).toBe('number')
+      }
+    })
+
+    it('should have valid RGB values (0-255)', () => {
+      for (const color of RAINBOW_GRADIENT) {
+        for (const component of color) {
+          expect(component).toBeGreaterThanOrEqual(0)
+          expect(component).toBeLessThanOrEqual(255)
+        }
+      }
+    })
+
+    it('should start with red/pink color', () => {
+      const firstColor = RAINBOW_GRADIENT[0]
+      expect(firstColor).toBeDefined()
+      expect(firstColor![0]).toBe(255) // High red
+    })
+
+    it('should end with red/pink color', () => {
+      const lastColor = RAINBOW_GRADIENT[RAINBOW_GRADIENT.length - 1]
+      expect(lastColor).toBeDefined()
+      expect(lastColor![0]).toBe(255) // High red
+    })
+
+    it('should contain orange color', () => {
+      const orange = RAINBOW_GRADIENT.find(
+        c => c[0] === 255 && c[1] === 140 && c[2] === 80,
+      )
+      expect(orange).toBeDefined()
+    })
+
+    it('should contain green color', () => {
+      const green = RAINBOW_GRADIENT.find(
+        c => c[0] === 120 && c[1] === 200 && c[2] === 100,
+      )
+      expect(green).toBeDefined()
+    })
+
+    it('should contain blue color', () => {
+      const blue = RAINBOW_GRADIENT.find(
+        c => c[0] === 80 && c[1] === 160 && c[2] === 220,
+      )
+      expect(blue).toBeDefined()
+    })
+  })
+
+  describe('generateRainbowGradient', () => {
+    it('should generate gradient for short text', () => {
+      const gradient = generateRainbowGradient(5)
+      expect(gradient).toHaveLength(5)
+    })
+
+    it('should generate gradient for long text', () => {
+      const gradient = generateRainbowGradient(100)
+      expect(gradient).toHaveLength(100)
+    })
+
+    it('should generate gradient for zero length', () => {
+      const gradient = generateRainbowGradient(0)
+      expect(gradient).toHaveLength(0)
+    })
+
+    it('should generate gradient for text length 1', () => {
+      const gradient = generateRainbowGradient(1)
+      expect(gradient).toHaveLength(1)
+      expect(gradient[0]).toEqual(RAINBOW_GRADIENT[0])
+    })
+
+    it('should cycle through base gradient colors', () => {
+      const length = RAINBOW_GRADIENT.length * 2
+      const gradient = generateRainbowGradient(length)
+
+      // First cycle should match base gradient
+      for (let i = 0; i < RAINBOW_GRADIENT.length; i += 1) {
+        expect(gradient[i]).toEqual(RAINBOW_GRADIENT[i])
+      }
+
+      // Second cycle should repeat
+      for (let i = 0; i < RAINBOW_GRADIENT.length; i += 1) {
+        expect(gradient[i + RAINBOW_GRADIENT.length]).toEqual(
+          RAINBOW_GRADIENT[i],
+        )
+      }
+    })
+
+    it('should return RGB triplets', () => {
+      const gradient = generateRainbowGradient(5)
+      for (const color of gradient) {
+        expect(color).toHaveLength(3)
+        expect(typeof color[0]).toBe('number')
+        expect(typeof color[1]).toBe('number')
+        expect(typeof color[2]).toBe('number')
+      }
+    })
+
+    it('should have valid RGB values', () => {
+      const gradient = generateRainbowGradient(20)
+      for (const color of gradient) {
+        for (const component of color) {
+          expect(component).toBeGreaterThanOrEqual(0)
+          expect(component).toBeLessThanOrEqual(255)
+        }
+      }
+    })
+
+    it('should handle exact multiple of base gradient length', () => {
+      const length = RAINBOW_GRADIENT.length
+      const gradient = generateRainbowGradient(length)
+      expect(gradient).toHaveLength(length)
+      expect(gradient).toEqual(RAINBOW_GRADIENT)
+    })
+
+    it('should distribute colors evenly', () => {
+      const gradient = generateRainbowGradient(15)
+      expect(gradient).toHaveLength(15)
+
+      // Check that colors cycle through the base gradient
+      for (let i = 0; i < 15; i += 1) {
+        const expectedColorIndex = i % RAINBOW_GRADIENT.length
+        expect(gradient[i]).toEqual(RAINBOW_GRADIENT[expectedColorIndex])
+      }
+    })
+
+    it('should handle large text lengths efficiently', () => {
+      const gradient = generateRainbowGradient(1000)
+      expect(gradient).toHaveLength(1000)
+      // Spot check some positions
+      expect(gradient[0]).toEqual(RAINBOW_GRADIENT[0])
+      expect(gradient[999]).toEqual(
+        RAINBOW_GRADIENT[999 % RAINBOW_GRADIENT.length],
+      )
+    })
+
+    it('should generate consistent results for same input', () => {
+      const gradient1 = generateRainbowGradient(10)
+      const gradient2 = generateRainbowGradient(10)
+      expect(gradient1).toEqual(gradient2)
+    })
+
+    it('should return different gradients for different lengths', () => {
+      const gradient1 = generateRainbowGradient(5)
+      const gradient2 = generateRainbowGradient(10)
+      expect(gradient1.length).not.toBe(gradient2.length)
+    })
+  })
+})
diff --git a/test/unit/env.test.ts b/test/unit/env.test.ts
new file mode 100644
index 0000000..6db28f6
--- /dev/null
+++ b/test/unit/env.test.ts
@@ -0,0 +1,503 @@
+/**
+ * @fileoverview Unit tests for environment variable utilities.
+ *
+ * Tests core environment variable utility functions:
+ * - Type conversion: envAsBoolean(), envAsNumber(), envAsString()
+ * - Case-insensitive key lookup: findCaseInsensitiveEnvKey()
+ * - Proxy creation: createEnvProxy() for controlled env access
+ * - Validation: isValidEnvValue(), parseEnvValue()
+ * These utilities provide a foundation for consistent env var handling.
+ * No rewire needed - tests pure functions and proxy creation.
+ */
+
+import {
+  createEnvProxy,
+  envAsBoolean,
+  envAsNumber,
+  envAsString,
+  findCaseInsensitiveEnvKey,
+} from '@socketsecurity/lib/env'
+import { describe, expect, it } from 'vitest'
+
+describe('env', () => {
+  describe('envAsBoolean', () => {
+    it('should convert string "1" to true', () => {
+      expect(envAsBoolean('1')).toBe(true)
+    })
+
+    it('should convert string "true" to true (case-insensitive)', () => {
+      expect(envAsBoolean('true')).toBe(true)
+      expect(envAsBoolean('TRUE')).toBe(true)
+      expect(envAsBoolean('True')).toBe(true)
+    })
+
+    it('should convert string "0" to false', () => {
+      expect(envAsBoolean('0')).toBe(false)
+    })
+
+    it('should convert string "false" to false', () => {
+      expect(envAsBoolean('false')).toBe(false)
+      expect(envAsBoolean('FALSE')).toBe(false)
+    })
+
+    it('should convert any other string to false', () => {
+      expect(envAsBoolean('no')).toBe(false)
+      expect(envAsBoolean('yes')).toBe(false)
+      expect(envAsBoolean('random')).toBe(false)
+    })
+
+    it('should trim whitespace from strings', () => {
+      expect(envAsBoolean('  1  ')).toBe(true)
+      expect(envAsBoolean('  true  ')).toBe(true)
+      expect(envAsBoolean('  0  ')).toBe(false)
+    })
+
+    it('should use default value for null', () => {
+      expect(envAsBoolean(null)).toBe(false)
+      expect(envAsBoolean(null, true)).toBe(true)
+    })
+
+    it('should use default value for undefined', () => {
+      expect(envAsBoolean(undefined)).toBe(false)
+      expect(envAsBoolean(undefined, true)).toBe(true)
+    })
+
+    it('should convert truthy non-string values to true', () => {
+      expect(envAsBoolean(1)).toBe(true)
+      expect(envAsBoolean({})).toBe(true)
+      expect(envAsBoolean([])).toBe(true)
+    })
+
+    it('should convert falsy non-string values to false', () => {
+      expect(envAsBoolean(0)).toBe(false)
+      expect(envAsBoolean('')).toBe(false)
+    })
+
+    it('should handle empty string', () => {
+      expect(envAsBoolean('')).toBe(false)
+      expect(envAsBoolean('   ')).toBe(false)
+    })
+  })
+
+  describe('envAsNumber', () => {
+    it('should convert string numbers to integers', () => {
+      expect(envAsNumber('42')).toBe(42)
+      expect(envAsNumber('0')).toBe(0)
+      expect(envAsNumber('123')).toBe(123)
+    })
+
+    it('should convert negative numbers', () => {
+      expect(envAsNumber('-42')).toBe(-42)
+      expect(envAsNumber('-1')).toBe(-1)
+    })
+
+    it('should use default value for invalid strings', () => {
+      expect(envAsNumber('invalid')).toBe(0)
+      expect(envAsNumber('invalid', 10)).toBe(10)
+      expect(envAsNumber('abc', 42)).toBe(42)
+    })
+
+    it('should parse integers from strings with decimals', () => {
+      expect(envAsNumber('42.7')).toBe(42)
+      expect(envAsNumber('3.14')).toBe(3)
+    })
+
+    it('should handle null and undefined', () => {
+      expect(envAsNumber(null)).toBe(0)
+      expect(envAsNumber(undefined)).toBe(0)
+      expect(envAsNumber(null, 10)).toBe(10)
+      expect(envAsNumber(undefined, 10)).toBe(10)
+    })
+
+    it('should handle empty string', () => {
+      expect(envAsNumber('')).toBe(0)
+      expect(envAsNumber('', 5)).toBe(5)
+    })
+
+    it('should handle whitespace', () => {
+      expect(envAsNumber('  42  ')).toBe(42)
+    })
+
+    it('should handle -0 and return 0', () => {
+      expect(envAsNumber('-0')).toBe(0)
+      expect(Object.is(envAsNumber('-0'), 0)).toBe(true)
+    })
+
+    it('should handle NaN and return default', () => {
+      expect(envAsNumber('notanumber')).toBe(0)
+      expect(envAsNumber('notanumber', 99)).toBe(99)
+    })
+
+    it('should handle Infinity and return default', () => {
+      expect(envAsNumber('Infinity')).toBe(0)
+      expect(envAsNumber('Infinity', 100)).toBe(100)
+    })
+
+    it('should parse hex strings as base 10', () => {
+      expect(envAsNumber('0x10')).toBe(0)
+      expect(envAsNumber('10')).toBe(10)
+    })
+
+    it('should handle leading zeros', () => {
+      expect(envAsNumber('007')).toBe(7)
+      expect(envAsNumber('00042')).toBe(42)
+    })
+  })
+
+  describe('envAsString', () => {
+    it('should trim string values', () => {
+      expect(envAsString('  hello  ')).toBe('hello')
+      expect(envAsString('test')).toBe('test')
+    })
+
+    it('should use default value for null', () => {
+      expect(envAsString(null)).toBe('')
+      expect(envAsString(null, 'default')).toBe('default')
+    })
+
+    it('should use default value for undefined', () => {
+      expect(envAsString(undefined)).toBe('')
+      expect(envAsString(undefined, 'default')).toBe('default')
+    })
+
+    it('should convert non-string values to strings', () => {
+      expect(envAsString(42)).toBe('42')
+      expect(envAsString(true)).toBe('true')
+      expect(envAsString(false)).toBe('false')
+    })
+
+    it('should handle empty string', () => {
+      expect(envAsString('')).toBe('')
+      expect(envAsString('   ')).toBe('')
+    })
+
+    it('should trim default value if it is a string', () => {
+      expect(envAsString(null, '  default  ')).toBe('default')
+    })
+
+    it('should convert default value to string and trim', () => {
+      expect(envAsString(null, 123 as any)).toBe('123')
+    })
+
+    it('should handle default value as empty string', () => {
+      expect(envAsString(null, '')).toBe('')
+    })
+
+    it('should handle objects by converting to string', () => {
+      expect(envAsString({ key: 'value' })).toBe('[object Object]')
+    })
+
+    it('should handle arrays by converting to string', () => {
+      expect(envAsString([1, 2, 3])).toBe('1,2,3')
+    })
+  })
+
+  describe('findCaseInsensitiveEnvKey', () => {
+    it('should find exact match', () => {
+      const env = { PATH: '/usr/bin', HOME: '/home/user' }
+      expect(findCaseInsensitiveEnvKey(env, 'PATH')).toBe('PATH')
+      expect(findCaseInsensitiveEnvKey(env, 'HOME')).toBe('HOME')
+    })
+
+    it('should find case-insensitive match', () => {
+      const env = { Path: '/usr/bin', home: '/home/user' }
+      expect(findCaseInsensitiveEnvKey(env, 'PATH')).toBe('Path')
+      expect(findCaseInsensitiveEnvKey(env, 'HOME')).toBe('home')
+    })
+
+    it('should find mixed case matches', () => {
+      const env = { pAtH: '/usr/bin', HoMe: '/home/user' }
+      expect(findCaseInsensitiveEnvKey(env, 'PATH')).toBe('pAtH')
+      expect(findCaseInsensitiveEnvKey(env, 'HOME')).toBe('HoMe')
+    })
+
+    it('should return undefined for non-existent keys', () => {
+      const env = { PATH: '/usr/bin' }
+      expect(findCaseInsensitiveEnvKey(env, 'HOME')).toBeUndefined()
+      expect(findCaseInsensitiveEnvKey(env, 'MISSING')).toBeUndefined()
+    })
+
+    it('should return undefined for empty object', () => {
+      expect(findCaseInsensitiveEnvKey({}, 'PATH')).toBeUndefined()
+    })
+
+    it('should skip keys with different lengths (optimization)', () => {
+      const env = { PATHS: '/usr/bin', PATHX: '/usr/local/bin' }
+      expect(findCaseInsensitiveEnvKey(env, 'PATH')).toBeUndefined()
+    })
+
+    it('should handle single character keys', () => {
+      const env = { A: 'value', b: 'value2' }
+      expect(findCaseInsensitiveEnvKey(env, 'A')).toBe('A')
+      expect(findCaseInsensitiveEnvKey(env, 'B')).toBe('b')
+    })
+
+    it('should handle keys with underscores', () => {
+      const env = { NODE_ENV: 'test', node_env: 'prod' }
+      expect(findCaseInsensitiveEnvKey(env, 'NODE_ENV')).toBe('NODE_ENV')
+    })
+
+    it('should return first match when multiple case variations exist', () => {
+      const env = { path: '/first', Path: '/second', PATH: '/third' }
+      const result = findCaseInsensitiveEnvKey(env, 'PATH')
+      expect(['path', 'Path', 'PATH']).toContain(result)
+    })
+
+    it('should handle undefined values in env', () => {
+      const env = { PATH: undefined, HOME: '/home/user' }
+      expect(findCaseInsensitiveEnvKey(env, 'PATH')).toBe('PATH')
+    })
+  })
+
+  describe('createEnvProxy', () => {
+    describe('basic functionality', () => {
+      it('should return proxy that reads from base env', () => {
+        const base = { PATH: '/usr/bin', HOME: '/home/user' }
+        const proxy = createEnvProxy(base)
+        expect(proxy.PATH).toBe('/usr/bin')
+        expect(proxy.HOME).toBe('/home/user')
+      })
+
+      it('should return proxy that reads from overrides', () => {
+        const base = { PATH: '/usr/bin' }
+        const overrides = { NODE_ENV: 'test' }
+        const proxy = createEnvProxy(base, overrides)
+        expect(proxy.NODE_ENV).toBe('test')
+        expect(proxy.PATH).toBe('/usr/bin')
+      })
+
+      it('should prioritize overrides over base', () => {
+        const base = { PATH: '/usr/bin', HOME: '/home/user' }
+        const overrides = { PATH: '/custom/bin' }
+        const proxy = createEnvProxy(base, overrides)
+        expect(proxy.PATH).toBe('/custom/bin')
+        expect(proxy.HOME).toBe('/home/user')
+      })
+
+      it('should return undefined for non-existent keys', () => {
+        const base = { PATH: '/usr/bin' }
+        const proxy = createEnvProxy(base)
+        expect(proxy.NONEXISTENT).toBeUndefined()
+      })
+
+      it('should work without overrides', () => {
+        const base = { PATH: '/usr/bin' }
+        const proxy = createEnvProxy(base)
+        expect(proxy.PATH).toBe('/usr/bin')
+      })
+    })
+
+    describe('case-insensitive lookups', () => {
+      it('should find PATH with different cases', () => {
+        const base = { Path: 'C:\\Windows' }
+        const proxy = createEnvProxy(base)
+        expect(proxy.PATH).toBe('C:\\Windows')
+        expect(proxy.Path).toBe('C:\\Windows')
+        expect(proxy.path).toBe('C:\\Windows')
+      })
+
+      it('should find TEMP with different cases', () => {
+        const base = { Temp: 'C:\\Temp' }
+        const proxy = createEnvProxy(base)
+        expect(proxy.TEMP).toBe('C:\\Temp')
+        expect(proxy.temp).toBe('C:\\Temp')
+      })
+
+      it('should find HOME with different cases', () => {
+        const base = { home: '/home/user' }
+        const proxy = createEnvProxy(base)
+        expect(proxy.HOME).toBe('/home/user')
+        expect(proxy.Home).toBe('/home/user')
+      })
+
+      it('should prioritize exact match over case-insensitive', () => {
+        const base = { PATH: '/exact', Path: '/alt' }
+        const proxy = createEnvProxy(base)
+        expect(proxy.PATH).toBe('/exact')
+        expect(proxy.Path).toBe('/alt')
+      })
+
+      it('should check overrides for case-insensitive matches', () => {
+        const base = { path: '/base/path' }
+        const overrides = { Path: '/override/path' }
+        const proxy = createEnvProxy(base, overrides)
+        // Access with 'PATH' should find 'Path' in overrides via case-insensitive lookup.
+        expect(proxy.PATH).toBe('/override/path')
+      })
+
+      it('should not do case-insensitive lookup for non-Windows vars', () => {
+        const base = { myVar: 'value' }
+        const proxy = createEnvProxy(base)
+        expect(proxy.MYVAR).toBeUndefined()
+        expect(proxy.myVar).toBe('value')
+      })
+    })
+
+    describe('Proxy handlers', () => {
+      it('should support "in" operator', () => {
+        const base = { PATH: '/usr/bin' }
+        const proxy = createEnvProxy(base)
+        expect('PATH' in proxy).toBe(true)
+        expect('HOME' in proxy).toBe(false)
+      })
+
+      it('should support "in" operator with case-insensitive keys', () => {
+        const base = { Path: '/usr/bin' }
+        const proxy = createEnvProxy(base)
+        expect('PATH' in proxy).toBe(true)
+        expect('path' in proxy).toBe(true)
+      })
+
+      it('should support Object.keys', () => {
+        const base = { PATH: '/usr/bin', HOME: '/home/user' }
+        const overrides = { NODE_ENV: 'test' }
+        const proxy = createEnvProxy(base, overrides)
+        const keys = Object.keys(proxy)
+        expect(keys).toContain('PATH')
+        expect(keys).toContain('HOME')
+        expect(keys).toContain('NODE_ENV')
+        expect(keys).toHaveLength(3)
+      })
+
+      it('should deduplicate keys in Object.keys', () => {
+        const base = { PATH: '/usr/bin' }
+        const overrides = { PATH: '/custom/bin' }
+        const proxy = createEnvProxy(base, overrides)
+        const keys = Object.keys(proxy)
+        expect(keys.filter(k => k === 'PATH')).toHaveLength(1)
+      })
+
+      it('should support Object.getOwnPropertyDescriptor', () => {
+        const base = { PATH: '/usr/bin' }
+        const proxy = createEnvProxy(base)
+        const descriptor = Object.getOwnPropertyDescriptor(proxy, 'PATH')
+        expect(descriptor).toBeDefined()
+        expect(descriptor?.value).toBe('/usr/bin')
+        expect(descriptor?.enumerable).toBe(true)
+        expect(descriptor?.configurable).toBe(true)
+        expect(descriptor?.writable).toBe(true)
+      })
+
+      it('should return undefined descriptor for non-existent keys', () => {
+        const base = { PATH: '/usr/bin' }
+        const proxy = createEnvProxy(base)
+        const descriptor = Object.getOwnPropertyDescriptor(proxy, 'NONEXISTENT')
+        expect(descriptor).toBeUndefined()
+      })
+
+      it('should support set operation with overrides', () => {
+        const base = { PATH: '/usr/bin' }
+        const overrides: Record<string, string | undefined> = {
+          NODE_ENV: 'test',
+        }
+        const proxy = createEnvProxy(base, overrides)
+        ;(proxy as any).NEW_VAR = 'new-value'
+        expect((proxy as any).NEW_VAR).toBe('new-value')
+        expect(overrides.NEW_VAR).toBe('new-value')
+      })
+
+      it('should not support set operation without overrides', () => {
+        const base = { PATH: '/usr/bin' }
+        const proxy = createEnvProxy(base)
+        const result = Reflect.set(proxy, 'NEW_VAR', 'value')
+        expect(result).toBe(false)
+      })
+    })
+
+    describe('edge cases', () => {
+      it('should handle empty base and overrides', () => {
+        const proxy = createEnvProxy({})
+        expect(proxy.PATH).toBeUndefined()
+        expect(Object.keys(proxy)).toHaveLength(0)
+      })
+
+      it('should handle non-string property access', () => {
+        const base = { PATH: '/usr/bin' }
+        const proxy = createEnvProxy(base)
+        expect(proxy[Symbol.iterator as any]).toBeUndefined()
+      })
+
+      it('should handle undefined values in base', () => {
+        const base = { PATH: undefined as any, HOME: '/home/user' }
+        const proxy = createEnvProxy(base)
+        expect(proxy.PATH).toBeUndefined()
+        expect(proxy.HOME).toBe('/home/user')
+      })
+
+      it('should handle undefined values in overrides', () => {
+        const base = { PATH: '/usr/bin' }
+        const overrides = { NODE_ENV: undefined }
+        const proxy = createEnvProxy(base, overrides)
+        expect(proxy.NODE_ENV).toBeUndefined()
+        expect(proxy.PATH).toBe('/usr/bin')
+      })
+
+      it('should enumerate all unique keys', () => {
+        const base = { A: '1', B: '2', C: '3' }
+        const overrides = { B: '20', D: '4' }
+        const proxy = createEnvProxy(base, overrides)
+        const keys = Object.keys(proxy).sort()
+        expect(keys).toEqual(['A', 'B', 'C', 'D'])
+      })
+
+      it('should handle case-insensitive has check', () => {
+        const base = { Path: '/usr/bin' }
+        const proxy = createEnvProxy(base)
+        expect('PATH' in proxy).toBe(true)
+        expect('path' in proxy).toBe(true)
+        expect('Path' in proxy).toBe(true)
+      })
+
+      it('should handle all Windows environment variables', () => {
+        const base = {
+          APPDATA: 'C:\\Users\\user\\AppData',
+          COMSPEC: 'C:\\Windows\\system32\\cmd.exe',
+          HOME: 'C:\\Users\\user',
+          LOCALAPPDATA: 'C:\\Users\\user\\AppData\\Local',
+          PATH: 'C:\\Windows',
+          PATHEXT: '.COM;.EXE;.BAT',
+          PROGRAMFILES: 'C:\\Program Files',
+          SYSTEMROOT: 'C:\\Windows',
+          TEMP: 'C:\\Temp',
+          TMP: 'C:\\Temp',
+          USERPROFILE: 'C:\\Users\\user',
+          WINDIR: 'C:\\Windows',
+        }
+        const proxy = createEnvProxy(base)
+
+        // Test case-insensitive access for all Windows vars.
+        expect(proxy.appdata).toBe(base.APPDATA)
+        expect(proxy.comspec).toBe(base.COMSPEC)
+        expect(proxy.home).toBe(base.HOME)
+        expect(proxy.localappdata).toBe(base.LOCALAPPDATA)
+        expect(proxy.path).toBe(base.PATH)
+        expect(proxy.pathext).toBe(base.PATHEXT)
+        expect(proxy.programfiles).toBe(base.PROGRAMFILES)
+        expect(proxy.systemroot).toBe(base.SYSTEMROOT)
+        expect(proxy.temp).toBe(base.TEMP)
+        expect(proxy.tmp).toBe(base.TMP)
+        expect(proxy.userprofile).toBe(base.USERPROFILE)
+        expect(proxy.windir).toBe(base.WINDIR)
+      })
+    })
+
+    describe('Windows compatibility', () => {
+      it('should handle mixed case PATH variations', () => {
+        const base = { Path: 'C:\\Windows;C:\\Program Files' }
+        const proxy = createEnvProxy(base)
+        expect(proxy.PATH).toBe(base.Path)
+        expect(proxy.path).toBe(base.Path)
+        expect(proxy.PaTh).toBe(base.Path)
+      })
+
+      it('should preserve case when setting via proxy', () => {
+        const base = { PATH: '/usr/bin' }
+        const overrides: Record<string, string | undefined> = {}
+        const proxy = createEnvProxy(base, overrides)
+        ;(proxy as any).NewVar = 'value'
+        expect(overrides['NewVar']).toBe('value')
+        expect((proxy as any).NewVar).toBe('value')
+      })
+    })
+  })
+})
diff --git a/test/unit/env/ci.test.ts b/test/unit/env/ci.test.ts
new file mode 100644
index 0000000..d6dde0e
--- /dev/null
+++ b/test/unit/env/ci.test.ts
@@ -0,0 +1,155 @@
+/**
+ * @fileoverview Unit tests for CI environment variable getter.
+ *
+ * Tests getCI() which detects CI/CD environments via the CI environment variable.
+ * Validates truthy value parsing: "true", "TRUE", "1", "yes" all return true.
+ * Returns false for falsy values or when CI is unset.
+ * Uses rewire for test isolation (setEnv/clearEnv/resetEnv) without polluting process.env.
+ * Critical for conditional behavior in CI environments (GitHub Actions, GitLab CI, etc.).
+ */
+
+import { getCI } from '@socketsecurity/lib/env/ci'
+import { resetEnv, setEnv } from '@socketsecurity/lib/env/rewire'
+import { afterEach, describe, expect, it } from 'vitest'
+
+describe('env/ci', () => {
+  afterEach(() => {
+    resetEnv()
+  })
+
+  describe('getCI', () => {
+    it('should return true when CI is set to "true"', () => {
+      setEnv('CI', 'true')
+      expect(getCI()).toBe(true)
+    })
+
+    it('should return true when CI is set to "TRUE"', () => {
+      setEnv('CI', 'TRUE')
+      expect(getCI()).toBe(true)
+    })
+
+    it('should return true when CI is set to "1"', () => {
+      setEnv('CI', '1')
+      expect(getCI()).toBe(true)
+    })
+
+    it('should return true when CI is set to "yes"', () => {
+      setEnv('CI', 'yes')
+      expect(getCI()).toBe(true)
+    })
+
+    it('should return true when CI is set to "YES"', () => {
+      setEnv('CI', 'YES')
+      expect(getCI()).toBe(true)
+    })
+
+    it('should return false when CI is set to "false"', () => {
+      setEnv('CI', 'false')
+      expect(getCI()).toBe(false)
+    })
+
+    it('should return false when CI is set to "0"', () => {
+      setEnv('CI', '0')
+      expect(getCI()).toBe(false)
+    })
+
+    it('should return false when CI is set to "no"', () => {
+      setEnv('CI', 'no')
+      expect(getCI()).toBe(false)
+    })
+
+    it('should return false when CI is empty string', () => {
+      setEnv('CI', '')
+      expect(getCI()).toBe(false)
+    })
+
+    it('should handle mixed case true', () => {
+      setEnv('CI', 'True')
+      expect(getCI()).toBe(true)
+    })
+
+    it('should handle mixed case yes', () => {
+      setEnv('CI', 'Yes')
+      expect(getCI()).toBe(true)
+    })
+
+    it('should handle arbitrary strings as false', () => {
+      setEnv('CI', 'maybe')
+      expect(getCI()).toBe(false)
+    })
+
+    it('should handle updating CI value from false to true', () => {
+      setEnv('CI', 'false')
+      expect(getCI()).toBe(false)
+
+      setEnv('CI', 'true')
+      expect(getCI()).toBe(true)
+    })
+
+    it('should handle updating CI value from true to false', () => {
+      setEnv('CI', 'true')
+      expect(getCI()).toBe(true)
+
+      setEnv('CI', 'false')
+      expect(getCI()).toBe(false)
+    })
+
+    it('should handle consecutive reads', () => {
+      setEnv('CI', 'true')
+      expect(getCI()).toBe(true)
+      expect(getCI()).toBe(true)
+      expect(getCI()).toBe(true)
+    })
+
+    it('should handle numeric strings other than 1', () => {
+      setEnv('CI', '2')
+      expect(getCI()).toBe(false)
+
+      setEnv('CI', '100')
+      expect(getCI()).toBe(false)
+    })
+
+    it('should handle whitespace in values', () => {
+      setEnv('CI', ' true ')
+      expect(getCI()).toBe(false) // whitespace makes it not match
+
+      setEnv('CI', 'true')
+      expect(getCI()).toBe(true)
+    })
+
+    it('should be case-insensitive for true', () => {
+      setEnv('CI', 'tRuE')
+      expect(getCI()).toBe(true)
+    })
+
+    it('should be case-insensitive for yes', () => {
+      setEnv('CI', 'yEs')
+      expect(getCI()).toBe(true)
+    })
+
+    it('should handle special characters', () => {
+      setEnv('CI', 'true!')
+      expect(getCI()).toBe(false)
+    })
+
+    it('should handle GitHub Actions CI', () => {
+      setEnv('CI', 'true')
+      expect(getCI()).toBe(true)
+    })
+
+    it('should handle GitLab CI', () => {
+      setEnv('CI', 'true')
+      expect(getCI()).toBe(true)
+    })
+
+    it('should handle CircleCI', () => {
+      setEnv('CI', 'true')
+      expect(getCI()).toBe(true)
+    })
+
+    it('should handle Travis CI', () => {
+      setEnv('CI', 'true')
+      expect(getCI()).toBe(true)
+    })
+  })
+})
diff --git a/test/unit/env/debug.test.ts b/test/unit/env/debug.test.ts
new file mode 100644
index 0000000..077df6b
--- /dev/null
+++ b/test/unit/env/debug.test.ts
@@ -0,0 +1,158 @@
+/**
+ * @fileoverview Unit tests for DEBUG environment variable getter.
+ *
+ * Tests getDebug() which retrieves the DEBUG environment variable for debug logging control.
+ * Returns the DEBUG string value (e.g., "*", "socket:*", "app:*") or undefined if not set.
+ * Uses rewire for isolated testing without polluting process.env.
+ * DEBUG patterns follow the debug module convention for selective debug output.
+ */
+
+import { getDebug } from '@socketsecurity/lib/env/debug'
+import { clearEnv, resetEnv, setEnv } from '@socketsecurity/lib/env/rewire'
+import { afterEach, describe, expect, it } from 'vitest'
+
+describe('env/debug', () => {
+  afterEach(() => {
+    resetEnv()
+  })
+
+  describe('getDebug', () => {
+    it('should return DEBUG environment variable when set', () => {
+      setEnv('DEBUG', '*')
+      expect(getDebug()).toBe('*')
+    })
+
+    it('should return undefined when DEBUG is not set', () => {
+      clearEnv('DEBUG')
+      // After clearing override, falls back to actual process.env
+      const result = getDebug()
+      expect(typeof result).toMatch(/string|undefined/)
+    })
+
+    it('should handle wildcard debug pattern', () => {
+      setEnv('DEBUG', '*')
+      expect(getDebug()).toBe('*')
+    })
+
+    it('should handle specific module debug pattern', () => {
+      setEnv('DEBUG', 'app:*')
+      expect(getDebug()).toBe('app:*')
+    })
+
+    it('should handle multiple debug patterns', () => {
+      setEnv('DEBUG', 'app:*,lib:*')
+      expect(getDebug()).toBe('app:*,lib:*')
+    })
+
+    it('should handle debug with namespace', () => {
+      setEnv('DEBUG', 'socket:*')
+      expect(getDebug()).toBe('socket:*')
+    })
+
+    it('should handle debug with specific function', () => {
+      setEnv('DEBUG', 'socket:install')
+      expect(getDebug()).toBe('socket:install')
+    })
+
+    it('should handle empty string', () => {
+      setEnv('DEBUG', '')
+      expect(getDebug()).toBe('')
+    })
+
+    it('should handle exclusion pattern', () => {
+      setEnv('DEBUG', '*,-express:*')
+      expect(getDebug()).toBe('*,-express:*')
+    })
+
+    it('should handle multiple exclusions', () => {
+      setEnv('DEBUG', '*,-app:foo,-app:bar')
+      expect(getDebug()).toBe('*,-app:foo,-app:bar')
+    })
+
+    it('should handle updating debug value', () => {
+      setEnv('DEBUG', 'app:*')
+      expect(getDebug()).toBe('app:*')
+
+      setEnv('DEBUG', 'lib:*')
+      expect(getDebug()).toBe('lib:*')
+
+      setEnv('DEBUG', '*')
+      expect(getDebug()).toBe('*')
+    })
+
+    it('should handle clearing and re-setting', () => {
+      setEnv('DEBUG', '*')
+      expect(getDebug()).toBe('*')
+
+      clearEnv('DEBUG')
+      // After clearing override, falls back to actual process.env
+      const result = getDebug()
+      expect(typeof result).toMatch(/string|undefined/)
+
+      setEnv('DEBUG', 'app:*')
+      expect(getDebug()).toBe('app:*')
+    })
+
+    it('should handle consecutive reads', () => {
+      setEnv('DEBUG', '*')
+      expect(getDebug()).toBe('*')
+      expect(getDebug()).toBe('*')
+      expect(getDebug()).toBe('*')
+    })
+
+    it('should handle debug with color codes', () => {
+      setEnv('DEBUG', 'app:*')
+      expect(getDebug()).toBe('app:*')
+    })
+
+    it('should handle debug with timestamps', () => {
+      setEnv('DEBUG', 'app:*')
+      expect(getDebug()).toBe('app:*')
+    })
+
+    it('should handle complex patterns', () => {
+      setEnv('DEBUG', 'socket:*,-socket:test:*,socket:test:foo')
+      expect(getDebug()).toBe('socket:*,-socket:test:*,socket:test:foo')
+    })
+
+    it('should handle patterns with special characters', () => {
+      setEnv('DEBUG', 'app:foo-bar:baz')
+      expect(getDebug()).toBe('app:foo-bar:baz')
+    })
+
+    it('should handle patterns with underscores', () => {
+      setEnv('DEBUG', 'app_module:*')
+      expect(getDebug()).toBe('app_module:*')
+    })
+
+    it('should handle patterns with dots', () => {
+      setEnv('DEBUG', 'app.module:*')
+      expect(getDebug()).toBe('app.module:*')
+    })
+
+    it('should handle single character pattern', () => {
+      setEnv('DEBUG', '*')
+      expect(getDebug()).toBe('*')
+    })
+
+    it('should handle whitespace in patterns', () => {
+      setEnv('DEBUG', 'app:*, lib:*')
+      expect(getDebug()).toBe('app:*, lib:*')
+    })
+
+    it('should handle HTTP debug patterns', () => {
+      setEnv('DEBUG', 'http:*')
+      expect(getDebug()).toBe('http:*')
+    })
+
+    it('should handle Express debug patterns', () => {
+      setEnv('DEBUG', 'express:*')
+      expect(getDebug()).toBe('express:*')
+    })
+
+    it('should handle custom tool patterns', () => {
+      setEnv('DEBUG', 'socket-npm:*')
+      expect(getDebug()).toBe('socket-npm:*')
+    })
+  })
+})
diff --git a/test/unit/env/github.test.ts b/test/unit/env/github.test.ts
new file mode 100644
index 0000000..b0549f1
--- /dev/null
+++ b/test/unit/env/github.test.ts
@@ -0,0 +1,131 @@
+/**
+ * @fileoverview Unit tests for GitHub environment variable getters.
+ *
+ * Tests GitHub Actions environment variable accessors:
+ * - getGithubToken() / getGhToken() - authentication tokens (GITHUB_TOKEN, GH_TOKEN)
+ * - getGithubRepository() - repository slug (owner/repo)
+ * - getGithubApiUrl() - API endpoint URL
+ * - getGithubServerUrl() - GitHub server URL
+ * - getGithubRefName() / getGithubRefType() / getGithubBaseRef() - Git ref information
+ * Uses rewire for test isolation. Critical for GitHub Actions integration.
+ */
+
+import {
+  getGhToken,
+  getGithubApiUrl,
+  getGithubBaseRef,
+  getGithubRefName,
+  getGithubRefType,
+  getGithubRepository,
+  getGithubServerUrl,
+  getGithubToken,
+} from '@socketsecurity/lib/env/github'
+import { resetEnv, setEnv } from '@socketsecurity/lib/env/rewire'
+import { afterEach, describe, expect, it } from 'vitest'
+
+describe('github env', () => {
+  afterEach(() => {
+    resetEnv()
+  })
+
+  describe('getGithubApiUrl', () => {
+    it('should return API URL when set', () => {
+      setEnv('GITHUB_API_URL', 'https://api.github.com')
+      expect(getGithubApiUrl()).toBe('https://api.github.com')
+    })
+
+    it('should return undefined when not set', () => {
+      setEnv('GITHUB_API_URL', undefined)
+      expect(getGithubApiUrl()).toBeUndefined()
+    })
+  })
+
+  describe('getGithubBaseRef', () => {
+    it('should return base ref when set', () => {
+      setEnv('GITHUB_BASE_REF', 'main')
+      expect(getGithubBaseRef()).toBe('main')
+    })
+
+    it('should return undefined when not set', () => {
+      setEnv('GITHUB_BASE_REF', undefined)
+      expect(getGithubBaseRef()).toBeUndefined()
+    })
+  })
+
+  describe('getGithubRefName', () => {
+    it('should return ref name when set', () => {
+      setEnv('GITHUB_REF_NAME', 'feature-branch')
+      expect(getGithubRefName()).toBe('feature-branch')
+    })
+
+    it('should return undefined when not set', () => {
+      setEnv('GITHUB_REF_NAME', undefined)
+      expect(getGithubRefName()).toBeUndefined()
+    })
+  })
+
+  describe('getGithubRefType', () => {
+    it('should return ref type when set to branch', () => {
+      setEnv('GITHUB_REF_TYPE', 'branch')
+      expect(getGithubRefType()).toBe('branch')
+    })
+
+    it('should return ref type when set to tag', () => {
+      setEnv('GITHUB_REF_TYPE', 'tag')
+      expect(getGithubRefType()).toBe('tag')
+    })
+
+    it('should return undefined when not set', () => {
+      setEnv('GITHUB_REF_TYPE', undefined)
+      expect(getGithubRefType()).toBeUndefined()
+    })
+  })
+
+  describe('getGithubRepository', () => {
+    it('should return repository name when set', () => {
+      setEnv('GITHUB_REPOSITORY', 'owner/repo')
+      expect(getGithubRepository()).toBe('owner/repo')
+    })
+
+    it('should return undefined when not set', () => {
+      setEnv('GITHUB_REPOSITORY', undefined)
+      expect(getGithubRepository()).toBeUndefined()
+    })
+  })
+
+  describe('getGithubServerUrl', () => {
+    it('should return server URL when set', () => {
+      setEnv('GITHUB_SERVER_URL', 'https://github.com')
+      expect(getGithubServerUrl()).toBe('https://github.com')
+    })
+
+    it('should return undefined when not set', () => {
+      setEnv('GITHUB_SERVER_URL', undefined)
+      expect(getGithubServerUrl()).toBeUndefined()
+    })
+  })
+
+  describe('getGithubToken', () => {
+    it('should return token when set', () => {
+      setEnv('GITHUB_TOKEN', 'ghp_test123')
+      expect(getGithubToken()).toBe('ghp_test123')
+    })
+
+    it('should return undefined when not set', () => {
+      setEnv('GITHUB_TOKEN', undefined)
+      expect(getGithubToken()).toBeUndefined()
+    })
+  })
+
+  describe('getGhToken', () => {
+    it('should return GH_TOKEN when set', () => {
+      setEnv('GH_TOKEN', 'ghp_alt_token')
+      expect(getGhToken()).toBe('ghp_alt_token')
+    })
+
+    it('should return undefined when not set', () => {
+      setEnv('GH_TOKEN', undefined)
+      expect(getGhToken()).toBeUndefined()
+    })
+  })
+})
diff --git a/test/unit/env/helpers.test.ts b/test/unit/env/helpers.test.ts
new file mode 100644
index 0000000..106676c
--- /dev/null
+++ b/test/unit/env/helpers.test.ts
@@ -0,0 +1,282 @@
+/**
+ * @fileoverview Unit tests for environment variable type conversion helpers.
+ *
+ * Tests type coercion utilities for environment variables:
+ * - envAsBoolean() converts strings to boolean ("true", "1", "yes" → true)
+ * - envAsNumber() parses strings to numbers with fallback
+ * - envAsString() ensures string type
+ * Used for consistent environment variable type handling across Socket tools.
+ * No rewire needed - these are pure functions without env access.
+ */
+
+import {
+  envAsBoolean,
+  envAsNumber,
+  envAsString,
+} from '@socketsecurity/lib/env/helpers'
+import { describe, expect, it } from 'vitest'
+
+describe('env/helpers', () => {
+  describe('envAsBoolean', () => {
+    it('should return true for "true"', () => {
+      expect(envAsBoolean('true')).toBe(true)
+    })
+
+    it('should return true for "TRUE"', () => {
+      expect(envAsBoolean('TRUE')).toBe(true)
+    })
+
+    it('should return true for "True"', () => {
+      expect(envAsBoolean('True')).toBe(true)
+    })
+
+    it('should return true for "1"', () => {
+      expect(envAsBoolean('1')).toBe(true)
+    })
+
+    it('should return true for "yes"', () => {
+      expect(envAsBoolean('yes')).toBe(true)
+    })
+
+    it('should return true for "YES"', () => {
+      expect(envAsBoolean('YES')).toBe(true)
+    })
+
+    it('should return true for "Yes"', () => {
+      expect(envAsBoolean('Yes')).toBe(true)
+    })
+
+    it('should return false for "false"', () => {
+      expect(envAsBoolean('false')).toBe(false)
+    })
+
+    it('should return false for "0"', () => {
+      expect(envAsBoolean('0')).toBe(false)
+    })
+
+    it('should return false for "no"', () => {
+      expect(envAsBoolean('no')).toBe(false)
+    })
+
+    it('should return false for empty string', () => {
+      expect(envAsBoolean('')).toBe(false)
+    })
+
+    it('should return false for undefined', () => {
+      expect(envAsBoolean(undefined)).toBe(false)
+    })
+
+    it('should return false for arbitrary strings', () => {
+      expect(envAsBoolean('maybe')).toBe(false)
+      expect(envAsBoolean('hello')).toBe(false)
+      expect(envAsBoolean('world')).toBe(false)
+    })
+
+    it('should return false for whitespace', () => {
+      expect(envAsBoolean(' ')).toBe(false)
+      expect(envAsBoolean('  ')).toBe(false)
+    })
+
+    it('should return false for strings with whitespace around true', () => {
+      expect(envAsBoolean(' true ')).toBe(false)
+    })
+
+    it('should return false for numeric strings other than 1', () => {
+      expect(envAsBoolean('2')).toBe(false)
+      expect(envAsBoolean('100')).toBe(false)
+      expect(envAsBoolean('-1')).toBe(false)
+    })
+
+    it('should return false for special characters', () => {
+      expect(envAsBoolean('!')).toBe(false)
+      expect(envAsBoolean('@')).toBe(false)
+    })
+
+    it('should be case-insensitive for true', () => {
+      expect(envAsBoolean('tRuE')).toBe(true)
+      expect(envAsBoolean('TrUe')).toBe(true)
+    })
+
+    it('should be case-insensitive for yes', () => {
+      expect(envAsBoolean('yEs')).toBe(true)
+      expect(envAsBoolean('YeS')).toBe(true)
+    })
+
+    it('should handle null coerced to string', () => {
+      expect(envAsBoolean('null')).toBe(false)
+    })
+  })
+
+  describe('envAsNumber', () => {
+    it('should return number for valid numeric string', () => {
+      expect(envAsNumber('42')).toBe(42)
+    })
+
+    it('should return 0 for undefined', () => {
+      expect(envAsNumber(undefined)).toBe(0)
+    })
+
+    it('should return 0 for empty string', () => {
+      expect(envAsNumber('')).toBe(0)
+    })
+
+    it('should handle negative numbers', () => {
+      expect(envAsNumber('-42')).toBe(-42)
+    })
+
+    it('should handle decimal numbers', () => {
+      expect(envAsNumber('3.14')).toBe(3.14)
+    })
+
+    it('should handle zero', () => {
+      expect(envAsNumber('0')).toBe(0)
+    })
+
+    it('should handle large numbers', () => {
+      expect(envAsNumber('1000000')).toBe(1_000_000)
+    })
+
+    it('should handle scientific notation', () => {
+      expect(envAsNumber('1e6')).toBe(1_000_000)
+    })
+
+    it('should return 0 for non-numeric strings', () => {
+      expect(envAsNumber('abc')).toBe(0)
+      expect(envAsNumber('hello')).toBe(0)
+    })
+
+    it('should return 0 for NaN strings', () => {
+      expect(envAsNumber('NaN')).toBe(0)
+    })
+
+    it('should handle Infinity as special case', () => {
+      expect(envAsNumber('Infinity')).toBe(Number.POSITIVE_INFINITY)
+    })
+
+    it('should handle -Infinity as special case', () => {
+      expect(envAsNumber('-Infinity')).toBe(Number.NEGATIVE_INFINITY)
+    })
+
+    it('should handle whitespace around numbers', () => {
+      expect(envAsNumber(' 42 ')).toBe(42)
+    })
+
+    it('should handle hexadecimal numbers', () => {
+      expect(envAsNumber('0x10')).toBe(16)
+    })
+
+    it('should handle octal numbers', () => {
+      expect(envAsNumber('0o10')).toBe(8)
+    })
+
+    it('should handle binary numbers', () => {
+      expect(envAsNumber('0b10')).toBe(2)
+    })
+
+    it('should return 0 for strings with non-numeric characters', () => {
+      expect(envAsNumber('42abc')).toBe(0)
+      expect(envAsNumber('abc42')).toBe(0)
+    })
+
+    it('should handle very small numbers', () => {
+      expect(envAsNumber('0.0001')).toBe(0.0001)
+    })
+
+    it('should handle negative decimals', () => {
+      expect(envAsNumber('-3.14')).toBe(-3.14)
+    })
+
+    it('should return 0 for special characters', () => {
+      expect(envAsNumber('!')).toBe(0)
+      expect(envAsNumber('@')).toBe(0)
+    })
+
+    it('should handle numeric strings with leading zeros', () => {
+      expect(envAsNumber('007')).toBe(7)
+    })
+  })
+
+  describe('envAsString', () => {
+    it('should return string value when defined', () => {
+      expect(envAsString('hello')).toBe('hello')
+    })
+
+    it('should return empty string for undefined', () => {
+      expect(envAsString(undefined)).toBe('')
+    })
+
+    it('should return empty string for empty string', () => {
+      expect(envAsString('')).toBe('')
+    })
+
+    it('should preserve whitespace', () => {
+      expect(envAsString(' hello ')).toBe(' hello ')
+    })
+
+    it('should handle numeric strings', () => {
+      expect(envAsString('123')).toBe('123')
+    })
+
+    it('should handle special characters', () => {
+      expect(envAsString('hello@world!')).toBe('hello@world!')
+    })
+
+    it('should handle newlines', () => {
+      expect(envAsString('hello\nworld')).toBe('hello\nworld')
+    })
+
+    it('should handle tabs', () => {
+      expect(envAsString('hello\tworld')).toBe('hello\tworld')
+    })
+
+    it('should handle unicode', () => {
+      expect(envAsString('hello 世界')).toBe('hello 世界')
+    })
+
+    it('should handle emojis', () => {
+      expect(envAsString('hello 👋')).toBe('hello 👋')
+    })
+
+    it('should handle long strings', () => {
+      const longString = 'a'.repeat(1000)
+      expect(envAsString(longString)).toBe(longString)
+    })
+
+    it('should handle JSON strings', () => {
+      expect(envAsString('{"key":"value"}')).toBe('{"key":"value"}')
+    })
+
+    it('should handle URLs', () => {
+      expect(envAsString('https://example.com')).toBe('https://example.com')
+    })
+
+    it('should handle paths', () => {
+      expect(envAsString('/usr/bin:/bin')).toBe('/usr/bin:/bin')
+    })
+
+    it('should handle single character', () => {
+      expect(envAsString('a')).toBe('a')
+    })
+
+    it('should handle only whitespace', () => {
+      expect(envAsString('   ')).toBe('   ')
+    })
+
+    it('should handle mixed content', () => {
+      expect(envAsString('abc123!@#')).toBe('abc123!@#')
+    })
+
+    it('should handle quotes', () => {
+      expect(envAsString('"quoted"')).toBe('"quoted"')
+      expect(envAsString("'quoted'")).toBe("'quoted'")
+    })
+
+    it('should handle backslashes', () => {
+      expect(envAsString('C:\\Windows\\System32')).toBe('C:\\Windows\\System32')
+    })
+
+    it('should handle forward slashes', () => {
+      expect(envAsString('/usr/local/bin')).toBe('/usr/local/bin')
+    })
+  })
+})
diff --git a/test/unit/env/home.test.ts b/test/unit/env/home.test.ts
new file mode 100644
index 0000000..4496e61
--- /dev/null
+++ b/test/unit/env/home.test.ts
@@ -0,0 +1,154 @@
+/**
+ * @fileoverview Unit tests for HOME environment variable getter.
+ *
+ * Tests getHome() which retrieves the user's home directory path via HOME env var.
+ * Returns home path string or undefined if not set. Unix/Linux standard.
+ * On Windows, use getUserprofile() instead (USERPROFILE env var).
+ * Uses rewire for isolated testing. Critical for resolving user-specific paths.
+ */
+
+import { getHome } from '@socketsecurity/lib/env/home'
+import { clearEnv, resetEnv, setEnv } from '@socketsecurity/lib/env/rewire'
+import { afterEach, describe, expect, it } from 'vitest'
+
+describe('env/home', () => {
+  afterEach(() => {
+    resetEnv()
+  })
+
+  describe('getHome', () => {
+    it('should return HOME environment variable when set', () => {
+      setEnv('HOME', '/Users/testuser')
+      expect(getHome()).toBe('/Users/testuser')
+    })
+
+    it('should return undefined when HOME is not set', () => {
+      clearEnv('HOME')
+      // After clearing override, falls back to actual process.env
+      const result = getHome()
+      expect(typeof result).toMatch(/string|undefined/)
+    })
+
+    it('should handle Unix home directory', () => {
+      setEnv('HOME', '/home/user')
+      expect(getHome()).toBe('/home/user')
+    })
+
+    it('should handle macOS home directory', () => {
+      setEnv('HOME', '/Users/johndoe')
+      expect(getHome()).toBe('/Users/johndoe')
+    })
+
+    it('should handle root home directory', () => {
+      setEnv('HOME', '/root')
+      expect(getHome()).toBe('/root')
+    })
+
+    it('should handle Windows-style home directory', () => {
+      setEnv('HOME', 'C:\\Users\\testuser')
+      expect(getHome()).toBe('C:\\Users\\testuser')
+    })
+
+    it('should handle network home directory', () => {
+      setEnv('HOME', '/net/users/testuser')
+      expect(getHome()).toBe('/net/users/testuser')
+    })
+
+    it('should handle custom home paths', () => {
+      setEnv('HOME', '/custom/path/home')
+      expect(getHome()).toBe('/custom/path/home')
+    })
+
+    it('should handle empty string', () => {
+      setEnv('HOME', '')
+      expect(getHome()).toBe('')
+    })
+
+    it('should handle home with spaces', () => {
+      setEnv('HOME', '/Users/John Doe')
+      expect(getHome()).toBe('/Users/John Doe')
+    })
+
+    it('should handle home with special characters', () => {
+      setEnv('HOME', '/Users/user-name_123')
+      expect(getHome()).toBe('/Users/user-name_123')
+    })
+
+    it('should handle relative path', () => {
+      setEnv('HOME', '../home/user')
+      expect(getHome()).toBe('../home/user')
+    })
+
+    it('should handle tilde in path', () => {
+      setEnv('HOME', '~/custom/location')
+      expect(getHome()).toBe('~/custom/location')
+    })
+
+    it('should handle updating home value', () => {
+      setEnv('HOME', '/home/user1')
+      expect(getHome()).toBe('/home/user1')
+
+      setEnv('HOME', '/home/user2')
+      expect(getHome()).toBe('/home/user2')
+
+      setEnv('HOME', '/Users/user3')
+      expect(getHome()).toBe('/Users/user3')
+    })
+
+    it('should handle clearing and re-setting', () => {
+      setEnv('HOME', '/home/user')
+      expect(getHome()).toBe('/home/user')
+
+      clearEnv('HOME')
+      // After clearing override, falls back to actual process.env
+      const result = getHome()
+      expect(typeof result).toMatch(/string|undefined/)
+
+      setEnv('HOME', '/Users/newuser')
+      expect(getHome()).toBe('/Users/newuser')
+    })
+
+    it('should handle consecutive reads', () => {
+      setEnv('HOME', '/home/testuser')
+      expect(getHome()).toBe('/home/testuser')
+      expect(getHome()).toBe('/home/testuser')
+      expect(getHome()).toBe('/home/testuser')
+    })
+
+    it('should handle very long paths', () => {
+      const longPath = `/home/${'a'.repeat(200)}`
+      setEnv('HOME', longPath)
+      expect(getHome()).toBe(longPath)
+    })
+
+    it('should handle paths with dots', () => {
+      setEnv('HOME', '/home/user.name')
+      expect(getHome()).toBe('/home/user.name')
+    })
+
+    it('should handle paths with unicode', () => {
+      setEnv('HOME', '/home/用户')
+      expect(getHome()).toBe('/home/用户')
+    })
+
+    it('should handle paths with trailing slash', () => {
+      setEnv('HOME', '/home/user/')
+      expect(getHome()).toBe('/home/user/')
+    })
+
+    it('should handle WSL paths', () => {
+      setEnv('HOME', '/mnt/c/Users/testuser')
+      expect(getHome()).toBe('/mnt/c/Users/testuser')
+    })
+
+    it('should handle Docker container paths', () => {
+      setEnv('HOME', '/app')
+      expect(getHome()).toBe('/app')
+    })
+
+    it('should handle Snap paths', () => {
+      setEnv('HOME', '/home/user/snap/app/common')
+      expect(getHome()).toBe('/home/user/snap/app/common')
+    })
+  })
+})
diff --git a/test/unit/env/locale.test.ts b/test/unit/env/locale.test.ts
new file mode 100644
index 0000000..d1d2489
--- /dev/null
+++ b/test/unit/env/locale.test.ts
@@ -0,0 +1,262 @@
+/**
+ * @fileoverview Unit tests for locale environment variable getters.
+ *
+ * Tests getLang() for locale/language settings (LANG, LC_ALL, LC_MESSAGES).
+ * Returns locale string (e.g., "en_US.UTF-8") or undefined if not set.
+ * Uses rewire for test isolation. Critical for internationalization and character encoding.
+ */
+
+import {
+  getLang,
+  getLcAll,
+  getLcMessages,
+} from '@socketsecurity/lib/env/locale'
+import { clearEnv, resetEnv, setEnv } from '@socketsecurity/lib/env/rewire'
+import { afterEach, describe, expect, it } from 'vitest'
+
+describe('env/locale', () => {
+  afterEach(() => {
+    resetEnv()
+  })
+
+  describe('getLang', () => {
+    it('should return LANG environment variable when set', () => {
+      setEnv('LANG', 'en_US.UTF-8')
+      expect(getLang()).toBe('en_US.UTF-8')
+    })
+
+    it('should return undefined when LANG is not set', () => {
+      clearEnv('LANG')
+      // After clearing override, falls back to actual process.env
+      const result = getLang()
+      expect(typeof result).toMatch(/string|undefined/)
+    })
+
+    it('should handle various locale formats', () => {
+      setEnv('LANG', 'fr_FR.UTF-8')
+      expect(getLang()).toBe('fr_FR.UTF-8')
+
+      setEnv('LANG', 'de_DE')
+      expect(getLang()).toBe('de_DE')
+
+      setEnv('LANG', 'C')
+      expect(getLang()).toBe('C')
+
+      setEnv('LANG', 'POSIX')
+      expect(getLang()).toBe('POSIX')
+    })
+
+    it('should handle empty string', () => {
+      setEnv('LANG', '')
+      expect(getLang()).toBe('')
+    })
+
+    it('should handle locale with encoding', () => {
+      setEnv('LANG', 'ja_JP.eucJP')
+      expect(getLang()).toBe('ja_JP.eucJP')
+    })
+
+    it('should handle locale with variant', () => {
+      setEnv('LANG', 'en_US.UTF-8@latn')
+      expect(getLang()).toBe('en_US.UTF-8@latn')
+    })
+  })
+
+  describe('getLcAll', () => {
+    it('should return LC_ALL environment variable when set', () => {
+      setEnv('LC_ALL', 'en_US.UTF-8')
+      expect(getLcAll()).toBe('en_US.UTF-8')
+    })
+
+    it('should return undefined when LC_ALL is not set', () => {
+      clearEnv('LC_ALL')
+      // After clearing override, falls back to actual process.env
+      const result = getLcAll()
+      expect(typeof result).toMatch(/string|undefined/)
+    })
+
+    it('should handle various locale formats', () => {
+      setEnv('LC_ALL', 'es_ES.UTF-8')
+      expect(getLcAll()).toBe('es_ES.UTF-8')
+
+      setEnv('LC_ALL', 'zh_CN.GB2312')
+      expect(getLcAll()).toBe('zh_CN.GB2312')
+
+      setEnv('LC_ALL', 'C')
+      expect(getLcAll()).toBe('C')
+    })
+
+    it('should handle empty string', () => {
+      setEnv('LC_ALL', '')
+      expect(getLcAll()).toBe('')
+    })
+
+    it('should be independent of LANG', () => {
+      setEnv('LANG', 'en_US.UTF-8')
+      setEnv('LC_ALL', 'fr_FR.UTF-8')
+      expect(getLang()).toBe('en_US.UTF-8')
+      expect(getLcAll()).toBe('fr_FR.UTF-8')
+    })
+
+    it('should handle locale override', () => {
+      setEnv('LC_ALL', 'it_IT.UTF-8')
+      expect(getLcAll()).toBe('it_IT.UTF-8')
+    })
+  })
+
+  describe('getLcMessages', () => {
+    it('should return LC_MESSAGES environment variable when set', () => {
+      setEnv('LC_MESSAGES', 'en_US.UTF-8')
+      expect(getLcMessages()).toBe('en_US.UTF-8')
+    })
+
+    it('should return undefined when LC_MESSAGES is not set', () => {
+      clearEnv('LC_MESSAGES')
+      // After clearing override, falls back to actual process.env
+      const result = getLcMessages()
+      expect(typeof result).toMatch(/string|undefined/)
+    })
+
+    it('should handle various locale formats', () => {
+      setEnv('LC_MESSAGES', 'pt_BR.UTF-8')
+      expect(getLcMessages()).toBe('pt_BR.UTF-8')
+
+      setEnv('LC_MESSAGES', 'ru_RU.UTF-8')
+      expect(getLcMessages()).toBe('ru_RU.UTF-8')
+
+      setEnv('LC_MESSAGES', 'C')
+      expect(getLcMessages()).toBe('C')
+    })
+
+    it('should handle empty string', () => {
+      setEnv('LC_MESSAGES', '')
+      expect(getLcMessages()).toBe('')
+    })
+
+    it('should be independent of LANG and LC_ALL', () => {
+      setEnv('LANG', 'en_US.UTF-8')
+      setEnv('LC_ALL', 'fr_FR.UTF-8')
+      setEnv('LC_MESSAGES', 'de_DE.UTF-8')
+      expect(getLang()).toBe('en_US.UTF-8')
+      expect(getLcAll()).toBe('fr_FR.UTF-8')
+      expect(getLcMessages()).toBe('de_DE.UTF-8')
+    })
+
+    it('should handle message-specific locale', () => {
+      setEnv('LC_MESSAGES', 'ko_KR.UTF-8')
+      expect(getLcMessages()).toBe('ko_KR.UTF-8')
+    })
+  })
+
+  describe('locale interaction', () => {
+    it('should allow setting all locale variables independently', () => {
+      setEnv('LANG', 'en_US.UTF-8')
+      setEnv('LC_ALL', 'fr_FR.UTF-8')
+      setEnv('LC_MESSAGES', 'de_DE.UTF-8')
+
+      expect(getLang()).toBe('en_US.UTF-8')
+      expect(getLcAll()).toBe('fr_FR.UTF-8')
+      expect(getLcMessages()).toBe('de_DE.UTF-8')
+    })
+
+    it('should handle clearing individual locale variables', () => {
+      setEnv('LANG', 'en_US.UTF-8')
+      setEnv('LC_ALL', 'fr_FR.UTF-8')
+      setEnv('LC_MESSAGES', 'de_DE.UTF-8')
+
+      clearEnv('LC_ALL')
+
+      expect(getLang()).toBe('en_US.UTF-8')
+      // After clearing override, falls back to actual process.env
+      const result = getLcAll()
+      expect(typeof result).toMatch(/string|undefined/)
+      expect(getLcMessages()).toBe('de_DE.UTF-8')
+    })
+
+    it('should handle resetting all environment variables', () => {
+      setEnv('LANG', 'en_US.UTF-8')
+      setEnv('LC_ALL', 'fr_FR.UTF-8')
+      setEnv('LC_MESSAGES', 'de_DE.UTF-8')
+
+      resetEnv()
+
+      // After reset, values depend on actual process.env
+      // Just verify functions still work
+      expect(typeof getLang()).toMatch(/string|undefined/)
+      expect(typeof getLcAll()).toMatch(/string|undefined/)
+      expect(typeof getLcMessages()).toMatch(/string|undefined/)
+    })
+
+    it('should handle updating locale values', () => {
+      setEnv('LANG', 'en_US.UTF-8')
+      expect(getLang()).toBe('en_US.UTF-8')
+
+      setEnv('LANG', 'ja_JP.UTF-8')
+      expect(getLang()).toBe('ja_JP.UTF-8')
+
+      setEnv('LANG', 'zh_CN.UTF-8')
+      expect(getLang()).toBe('zh_CN.UTF-8')
+    })
+  })
+
+  describe('edge cases', () => {
+    it('should handle special characters in locale', () => {
+      setEnv('LANG', 'en_US.UTF-8@special')
+      expect(getLang()).toBe('en_US.UTF-8@special')
+    })
+
+    it('should handle numeric values as strings', () => {
+      setEnv('LANG', '12345')
+      expect(getLang()).toBe('12345')
+    })
+
+    it('should handle whitespace in values', () => {
+      setEnv('LANG', ' en_US.UTF-8 ')
+      expect(getLang()).toBe(' en_US.UTF-8 ')
+    })
+
+    it('should handle multiple clearing and setting', () => {
+      setEnv('LANG', 'en_US.UTF-8')
+      clearEnv('LANG')
+      // After clearing override, falls back to actual process.env
+      let result = getLang()
+      expect(typeof result).toMatch(/string|undefined/)
+
+      setEnv('LANG', 'fr_FR.UTF-8')
+      expect(getLang()).toBe('fr_FR.UTF-8')
+
+      clearEnv('LANG')
+      result = getLang()
+      expect(typeof result).toMatch(/string|undefined/)
+    })
+
+    it('should handle all three variables being unset', () => {
+      clearEnv('LANG')
+      clearEnv('LC_ALL')
+      clearEnv('LC_MESSAGES')
+
+      // After clearing overrides, fall back to actual process.env
+      expect(typeof getLang()).toMatch(/string|undefined/)
+      expect(typeof getLcAll()).toMatch(/string|undefined/)
+      expect(typeof getLcMessages()).toMatch(/string|undefined/)
+    })
+
+    it('should handle consecutive reads', () => {
+      setEnv('LANG', 'en_US.UTF-8')
+
+      expect(getLang()).toBe('en_US.UTF-8')
+      expect(getLang()).toBe('en_US.UTF-8')
+      expect(getLang()).toBe('en_US.UTF-8')
+    })
+
+    it('should handle alternating between variables', () => {
+      setEnv('LANG', 'en_US.UTF-8')
+      setEnv('LC_ALL', 'fr_FR.UTF-8')
+
+      expect(getLang()).toBe('en_US.UTF-8')
+      expect(getLcAll()).toBe('fr_FR.UTF-8')
+      expect(getLang()).toBe('en_US.UTF-8')
+      expect(getLcAll()).toBe('fr_FR.UTF-8')
+    })
+  })
+})
diff --git a/test/unit/env/node-auth-token.test.ts b/test/unit/env/node-auth-token.test.ts
new file mode 100644
index 0000000..b311a42
--- /dev/null
+++ b/test/unit/env/node-auth-token.test.ts
@@ -0,0 +1,155 @@
+/**
+ * @fileoverview Unit tests for NODE_AUTH_TOKEN environment variable getter.
+ *
+ * Tests getNodeAuthToken() for Node.js registry authentication.
+ * Returns NODE_AUTH_TOKEN value or undefined. Used for private npm registry access.
+ * Uses rewire for test isolation. Critical for authenticated package operations.
+ */
+
+import { getNodeAuthToken } from '@socketsecurity/lib/env/node-auth-token'
+import { clearEnv, resetEnv, setEnv } from '@socketsecurity/lib/env/rewire'
+import { afterEach, describe, expect, it } from 'vitest'
+
+describe('env/node-auth-token', () => {
+  afterEach(() => {
+    resetEnv()
+  })
+
+  describe('getNodeAuthToken', () => {
+    it('should return NODE_AUTH_TOKEN when set', () => {
+      setEnv('NODE_AUTH_TOKEN', 'test-token-123')
+      expect(getNodeAuthToken()).toBe('test-token-123')
+    })
+
+    it('should return undefined when NODE_AUTH_TOKEN is not set', () => {
+      clearEnv('NODE_AUTH_TOKEN')
+      // After clearing override, falls back to actual process.env
+      const result = getNodeAuthToken()
+      expect(typeof result).toMatch(/string|undefined/)
+    })
+
+    it('should handle npm registry auth token', () => {
+      setEnv('NODE_AUTH_TOKEN', 'npm_abcdef1234567890')
+      expect(getNodeAuthToken()).toBe('npm_abcdef1234567890')
+    })
+
+    it('should handle GitHub Packages token', () => {
+      setEnv('NODE_AUTH_TOKEN', 'ghp_1234567890abcdefGHIJKLMNOPQRSTUVWXYZ')
+      expect(getNodeAuthToken()).toBe(
+        'ghp_1234567890abcdefGHIJKLMNOPQRSTUVWXYZ',
+      )
+    })
+
+    it('should handle GitLab token', () => {
+      setEnv('NODE_AUTH_TOKEN', 'glpat-abc123xyz')
+      expect(getNodeAuthToken()).toBe('glpat-abc123xyz')
+    })
+
+    it('should handle private registry token', () => {
+      setEnv('NODE_AUTH_TOKEN', 'Bearer abc123')
+      expect(getNodeAuthToken()).toBe('Bearer abc123')
+    })
+
+    it('should handle basic auth token', () => {
+      setEnv('NODE_AUTH_TOKEN', 'dXNlcm5hbWU6cGFzc3dvcmQ=')
+      expect(getNodeAuthToken()).toBe('dXNlcm5hbWU6cGFzc3dvcmQ=')
+    })
+
+    it('should handle empty string', () => {
+      setEnv('NODE_AUTH_TOKEN', '')
+      expect(getNodeAuthToken()).toBe('')
+    })
+
+    it('should handle UUID-style token', () => {
+      setEnv('NODE_AUTH_TOKEN', '550e8400-e29b-41d4-a716-446655440000')
+      expect(getNodeAuthToken()).toBe('550e8400-e29b-41d4-a716-446655440000')
+    })
+
+    it('should handle hexadecimal token', () => {
+      setEnv('NODE_AUTH_TOKEN', 'abc123def456')
+      expect(getNodeAuthToken()).toBe('abc123def456')
+    })
+
+    it('should handle updating auth token', () => {
+      setEnv('NODE_AUTH_TOKEN', 'token1')
+      expect(getNodeAuthToken()).toBe('token1')
+
+      setEnv('NODE_AUTH_TOKEN', 'token2')
+      expect(getNodeAuthToken()).toBe('token2')
+
+      setEnv('NODE_AUTH_TOKEN', 'token3')
+      expect(getNodeAuthToken()).toBe('token3')
+    })
+
+    it('should handle clearing and re-setting', () => {
+      setEnv('NODE_AUTH_TOKEN', 'test-token')
+      expect(getNodeAuthToken()).toBe('test-token')
+
+      clearEnv('NODE_AUTH_TOKEN')
+      expect(typeof getNodeAuthToken()).toMatch(/string|undefined/)
+
+      setEnv('NODE_AUTH_TOKEN', 'new-token')
+      expect(getNodeAuthToken()).toBe('new-token')
+    })
+
+    it('should handle consecutive reads', () => {
+      setEnv('NODE_AUTH_TOKEN', 'test-token')
+      expect(getNodeAuthToken()).toBe('test-token')
+      expect(getNodeAuthToken()).toBe('test-token')
+      expect(getNodeAuthToken()).toBe('test-token')
+    })
+
+    it('should handle long token', () => {
+      const longToken = 'a'.repeat(200)
+      setEnv('NODE_AUTH_TOKEN', longToken)
+      expect(getNodeAuthToken()).toBe(longToken)
+    })
+
+    it('should handle token with special characters', () => {
+      setEnv('NODE_AUTH_TOKEN', 'token-with_special.chars/123')
+      expect(getNodeAuthToken()).toBe('token-with_special.chars/123')
+    })
+
+    it('should handle token with spaces', () => {
+      setEnv('NODE_AUTH_TOKEN', 'Bearer eyJhbGciOiJIUzI1NiIs')
+      expect(getNodeAuthToken()).toBe('Bearer eyJhbGciOiJIUzI1NiIs')
+    })
+
+    it('should handle JWT-style token', () => {
+      setEnv(
+        'NODE_AUTH_TOKEN',
+        'eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJzdWIiOiIxMjM0NTY3ODkwIn0.abc123',
+      )
+      expect(getNodeAuthToken()).toBe(
+        'eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJzdWIiOiIxMjM0NTY3ODkwIn0.abc123',
+      )
+    })
+
+    it('should handle Artifactory API key', () => {
+      setEnv('NODE_AUTH_TOKEN', 'AKC1234567890abcdef')
+      expect(getNodeAuthToken()).toBe('AKC1234567890abcdef')
+    })
+
+    it('should handle Nexus token', () => {
+      setEnv('NODE_AUTH_TOKEN', 'NX-abcdef123456')
+      expect(getNodeAuthToken()).toBe('NX-abcdef123456')
+    })
+
+    it('should handle Azure DevOps PAT', () => {
+      setEnv('NODE_AUTH_TOKEN', 'pat-1234567890abcdefghijklmnopqrstuvwxyz')
+      expect(getNodeAuthToken()).toBe(
+        'pat-1234567890abcdefghijklmnopqrstuvwxyz',
+      )
+    })
+
+    it('should handle npm automation token', () => {
+      setEnv('NODE_AUTH_TOKEN', 'npm_automation_token')
+      expect(getNodeAuthToken()).toBe('npm_automation_token')
+    })
+
+    it('should handle numeric token', () => {
+      setEnv('NODE_AUTH_TOKEN', '123456')
+      expect(getNodeAuthToken()).toBe('123456')
+    })
+  })
+})
diff --git a/test/unit/env/node-env.test.ts b/test/unit/env/node-env.test.ts
new file mode 100644
index 0000000..d5ac6c3
--- /dev/null
+++ b/test/unit/env/node-env.test.ts
@@ -0,0 +1,152 @@
+/**
+ * @fileoverview Unit tests for NODE_ENV environment variable getter.
+ *
+ * Tests getNodeEnv() for Node.js environment mode (development, production, test).
+ * Returns NODE_ENV string or undefined. Standard Node.js convention.
+ * Uses rewire for test isolation. Critical for environment-specific behavior.
+ */
+
+import { getNodeEnv } from '@socketsecurity/lib/env/node-env'
+import { clearEnv, resetEnv, setEnv } from '@socketsecurity/lib/env/rewire'
+import { afterEach, describe, expect, it } from 'vitest'
+
+describe('env/node-env', () => {
+  afterEach(() => {
+    resetEnv()
+  })
+
+  describe('getNodeEnv', () => {
+    it('should return NODE_ENV environment variable when set', () => {
+      setEnv('NODE_ENV', 'production')
+      expect(getNodeEnv()).toBe('production')
+    })
+
+    it('should return undefined when NODE_ENV is not set', () => {
+      clearEnv('NODE_ENV')
+      // After clearing override, falls back to actual process.env
+      const result = getNodeEnv()
+      expect(typeof result).toMatch(/string|undefined/)
+    })
+
+    it('should handle production environment', () => {
+      setEnv('NODE_ENV', 'production')
+      expect(getNodeEnv()).toBe('production')
+    })
+
+    it('should handle development environment', () => {
+      setEnv('NODE_ENV', 'development')
+      expect(getNodeEnv()).toBe('development')
+    })
+
+    it('should handle test environment', () => {
+      setEnv('NODE_ENV', 'test')
+      expect(getNodeEnv()).toBe('test')
+    })
+
+    it('should handle staging environment', () => {
+      setEnv('NODE_ENV', 'staging')
+      expect(getNodeEnv()).toBe('staging')
+    })
+
+    it('should handle empty string', () => {
+      setEnv('NODE_ENV', '')
+      expect(getNodeEnv()).toBe('')
+    })
+
+    it('should handle custom environment names', () => {
+      setEnv('NODE_ENV', 'qa')
+      expect(getNodeEnv()).toBe('qa')
+    })
+
+    it('should handle uppercase environment names', () => {
+      setEnv('NODE_ENV', 'PRODUCTION')
+      expect(getNodeEnv()).toBe('PRODUCTION')
+    })
+
+    it('should handle mixed case environment names', () => {
+      setEnv('NODE_ENV', 'Production')
+      expect(getNodeEnv()).toBe('Production')
+    })
+
+    it('should handle updating NODE_ENV value', () => {
+      setEnv('NODE_ENV', 'development')
+      expect(getNodeEnv()).toBe('development')
+
+      setEnv('NODE_ENV', 'production')
+      expect(getNodeEnv()).toBe('production')
+
+      setEnv('NODE_ENV', 'test')
+      expect(getNodeEnv()).toBe('test')
+    })
+
+    it('should handle clearing and re-setting', () => {
+      setEnv('NODE_ENV', 'production')
+      expect(getNodeEnv()).toBe('production')
+
+      clearEnv('NODE_ENV')
+      // After clearing override, falls back to actual process.env
+      const result = getNodeEnv()
+      expect(typeof result).toMatch(/string|undefined/)
+
+      setEnv('NODE_ENV', 'development')
+      expect(getNodeEnv()).toBe('development')
+    })
+
+    it('should handle consecutive reads', () => {
+      setEnv('NODE_ENV', 'production')
+      expect(getNodeEnv()).toBe('production')
+      expect(getNodeEnv()).toBe('production')
+      expect(getNodeEnv()).toBe('production')
+    })
+
+    it('should handle environment with hyphens', () => {
+      setEnv('NODE_ENV', 'pre-production')
+      expect(getNodeEnv()).toBe('pre-production')
+    })
+
+    it('should handle environment with underscores', () => {
+      setEnv('NODE_ENV', 'pre_production')
+      expect(getNodeEnv()).toBe('pre_production')
+    })
+
+    it('should handle numeric environment names', () => {
+      setEnv('NODE_ENV', '12345')
+      expect(getNodeEnv()).toBe('12345')
+    })
+
+    it('should handle environment with special characters', () => {
+      setEnv('NODE_ENV', 'prod-v2')
+      expect(getNodeEnv()).toBe('prod-v2')
+    })
+
+    it('should handle whitespace in values', () => {
+      setEnv('NODE_ENV', ' production ')
+      expect(getNodeEnv()).toBe(' production ')
+    })
+
+    it('should handle local environment', () => {
+      setEnv('NODE_ENV', 'local')
+      expect(getNodeEnv()).toBe('local')
+    })
+
+    it('should handle CI environment', () => {
+      setEnv('NODE_ENV', 'ci')
+      expect(getNodeEnv()).toBe('ci')
+    })
+
+    it('should handle preview environment', () => {
+      setEnv('NODE_ENV', 'preview')
+      expect(getNodeEnv()).toBe('preview')
+    })
+
+    it('should handle integration environment', () => {
+      setEnv('NODE_ENV', 'integration')
+      expect(getNodeEnv()).toBe('integration')
+    })
+
+    it('should handle acceptance environment', () => {
+      setEnv('NODE_ENV', 'acceptance')
+      expect(getNodeEnv()).toBe('acceptance')
+    })
+  })
+})
diff --git a/test/unit/env/npm.test.ts b/test/unit/env/npm.test.ts
new file mode 100644
index 0000000..a470363
--- /dev/null
+++ b/test/unit/env/npm.test.ts
@@ -0,0 +1,114 @@
+/**
+ * @fileoverview Unit tests for NPM environment variable getters.
+ *
+ * Tests npm-specific environment variable accessors:
+ * - getNpmConfigRegistry() - npm registry URL (npm_config_registry)
+ * - getNpmConfigUserAgent() - npm user agent string
+ * - getNpmLifecycleEvent() - current lifecycle hook (preinstall, install, etc.)
+ * - getNpmRegistry() - registry URL
+ * - getNpmToken() - npm authentication token
+ * Uses rewire for test isolation. Critical for npm integration and package publishing.
+ */
+
+import {
+  getNpmConfigRegistry,
+  getNpmConfigUserAgent,
+  getNpmLifecycleEvent,
+  getNpmRegistry,
+  getNpmToken,
+} from '@socketsecurity/lib/env/npm'
+import { resetEnv, setEnv } from '@socketsecurity/lib/env/rewire'
+import { afterEach, describe, expect, it } from 'vitest'
+
+describe('npm env', () => {
+  afterEach(() => {
+    resetEnv()
+  })
+
+  describe('getNpmConfigRegistry', () => {
+    it('should return registry URL when set', () => {
+      setEnv('npm_config_registry', 'https://registry.npmjs.org/')
+      expect(getNpmConfigRegistry()).toBe('https://registry.npmjs.org/')
+    })
+
+    it('should return undefined when not set', () => {
+      setEnv('npm_config_registry', undefined)
+      expect(getNpmConfigRegistry()).toBeUndefined()
+    })
+  })
+
+  describe('getNpmConfigUserAgent', () => {
+    it('should return user agent for npm', () => {
+      setEnv('npm_config_user_agent', 'npm/8.19.2 node/v18.12.0 darwin arm64')
+      expect(getNpmConfigUserAgent()).toBe(
+        'npm/8.19.2 node/v18.12.0 darwin arm64',
+      )
+    })
+
+    it('should return user agent for pnpm', () => {
+      setEnv(
+        'npm_config_user_agent',
+        'pnpm/7.14.0 npm/? node/v18.12.0 darwin arm64',
+      )
+      expect(getNpmConfigUserAgent()).toBe(
+        'pnpm/7.14.0 npm/? node/v18.12.0 darwin arm64',
+      )
+    })
+
+    it('should return user agent for yarn', () => {
+      setEnv(
+        'npm_config_user_agent',
+        'yarn/1.22.19 npm/? node/v18.12.0 darwin arm64',
+      )
+      expect(getNpmConfigUserAgent()).toBe(
+        'yarn/1.22.19 npm/? node/v18.12.0 darwin arm64',
+      )
+    })
+
+    it('should return undefined when not set', () => {
+      setEnv('npm_config_user_agent', undefined)
+      expect(getNpmConfigUserAgent()).toBeUndefined()
+    })
+  })
+
+  describe('getNpmLifecycleEvent', () => {
+    it('should return lifecycle event when set', () => {
+      setEnv('npm_lifecycle_event', 'test')
+      expect(getNpmLifecycleEvent()).toBe('test')
+    })
+
+    it('should return lifecycle event for postinstall', () => {
+      setEnv('npm_lifecycle_event', 'postinstall')
+      expect(getNpmLifecycleEvent()).toBe('postinstall')
+    })
+
+    it('should return undefined when not set', () => {
+      setEnv('npm_lifecycle_event', undefined)
+      expect(getNpmLifecycleEvent()).toBeUndefined()
+    })
+  })
+
+  describe('getNpmRegistry', () => {
+    it('should return registry URL when set', () => {
+      setEnv('NPM_REGISTRY', 'https://registry.npmjs.org')
+      expect(getNpmRegistry()).toBe('https://registry.npmjs.org')
+    })
+
+    it('should return undefined when not set', () => {
+      setEnv('NPM_REGISTRY', undefined)
+      expect(getNpmRegistry()).toBeUndefined()
+    })
+  })
+
+  describe('getNpmToken', () => {
+    it('should return NPM token when set', () => {
+      setEnv('NPM_TOKEN', 'npm_test_token_123')
+      expect(getNpmToken()).toBe('npm_test_token_123')
+    })
+
+    it('should return undefined when not set', () => {
+      setEnv('NPM_TOKEN', undefined)
+      expect(getNpmToken()).toBeUndefined()
+    })
+  })
+})
diff --git a/test/unit/env/path.test.ts b/test/unit/env/path.test.ts
new file mode 100644
index 0000000..61815cb
--- /dev/null
+++ b/test/unit/env/path.test.ts
@@ -0,0 +1,177 @@
+/**
+ * @fileoverview Unit tests for PATH environment variable getter.
+ *
+ * Tests getPath() for system executable search paths (PATH env var).
+ * Returns colon/semicolon-separated path string or undefined.
+ * Uses rewire for test isolation. Critical for executable resolution.
+ */
+
+import { getPath } from '@socketsecurity/lib/env/path'
+import { clearEnv, resetEnv, setEnv } from '@socketsecurity/lib/env/rewire'
+import { afterEach, describe, expect, it } from 'vitest'
+
+describe('env/path', () => {
+  afterEach(() => {
+    resetEnv()
+  })
+
+  describe('getPath', () => {
+    it('should return PATH environment variable when set', () => {
+      setEnv('PATH', '/usr/bin:/bin')
+      expect(getPath()).toBe('/usr/bin:/bin')
+    })
+
+    it('should return undefined when PATH is not set', () => {
+      clearEnv('PATH')
+      // After clearing override, falls back to actual process.env
+      const result = getPath()
+      expect(typeof result).toMatch(/string|undefined/)
+    })
+
+    it('should handle Unix PATH with colon separator', () => {
+      setEnv('PATH', '/usr/local/bin:/usr/bin:/bin:/usr/sbin:/sbin')
+      expect(getPath()).toBe('/usr/local/bin:/usr/bin:/bin:/usr/sbin:/sbin')
+    })
+
+    it('should handle Windows PATH with semicolon separator', () => {
+      setEnv('PATH', 'C:\\Windows\\System32;C:\\Windows;C:\\Program Files')
+      expect(getPath()).toBe(
+        'C:\\Windows\\System32;C:\\Windows;C:\\Program Files',
+      )
+    })
+
+    it('should handle PATH with single entry', () => {
+      setEnv('PATH', '/usr/bin')
+      expect(getPath()).toBe('/usr/bin')
+    })
+
+    it('should handle empty PATH', () => {
+      setEnv('PATH', '')
+      expect(getPath()).toBe('')
+    })
+
+    it('should handle PATH with Homebrew directories', () => {
+      setEnv('PATH', '/usr/local/bin:/usr/bin:/bin')
+      expect(getPath()).toBe('/usr/local/bin:/usr/bin:/bin')
+    })
+
+    it('should handle PATH with npm global binaries', () => {
+      setEnv('PATH', '/usr/local/bin:/usr/bin:/bin:~/.npm-global/bin')
+      expect(getPath()).toBe('/usr/local/bin:/usr/bin:/bin:~/.npm-global/bin')
+    })
+
+    it('should handle PATH with user bin directory', () => {
+      setEnv('PATH', '/usr/local/bin:/usr/bin:/bin:~/bin')
+      expect(getPath()).toBe('/usr/local/bin:/usr/bin:/bin:~/bin')
+    })
+
+    it('should handle PATH with .local/bin', () => {
+      setEnv('PATH', '/usr/local/bin:/usr/bin:/bin:~/.local/bin')
+      expect(getPath()).toBe('/usr/local/bin:/usr/bin:/bin:~/.local/bin')
+    })
+
+    it('should handle PATH with spaces in directory names', () => {
+      setEnv('PATH', '/usr/bin:"/Program Files/App/bin":/bin')
+      expect(getPath()).toBe('/usr/bin:"/Program Files/App/bin":/bin')
+    })
+
+    it('should handle PATH with many entries', () => {
+      const longPath = Array.from({ length: 20 }, (_, i) => `/path${i}`).join(
+        ':',
+      )
+      setEnv('PATH', longPath)
+      expect(getPath()).toBe(longPath)
+    })
+
+    it('should handle PATH with relative paths', () => {
+      setEnv('PATH', './bin:../tools/bin:/usr/bin')
+      expect(getPath()).toBe('./bin:../tools/bin:/usr/bin')
+    })
+
+    it('should handle PATH with current directory', () => {
+      setEnv('PATH', '.:/usr/bin:/bin')
+      expect(getPath()).toBe('.:/usr/bin:/bin')
+    })
+
+    it('should handle updating PATH value', () => {
+      setEnv('PATH', '/usr/bin:/bin')
+      expect(getPath()).toBe('/usr/bin:/bin')
+
+      setEnv('PATH', '/usr/local/bin:/usr/bin:/bin')
+      expect(getPath()).toBe('/usr/local/bin:/usr/bin:/bin')
+
+      setEnv('PATH', '/opt/bin:/usr/bin')
+      expect(getPath()).toBe('/opt/bin:/usr/bin')
+    })
+
+    it('should handle clearing and re-setting PATH', () => {
+      setEnv('PATH', '/usr/bin:/bin')
+      expect(getPath()).toBe('/usr/bin:/bin')
+
+      clearEnv('PATH')
+      // After clearing override, falls back to actual process.env
+      const result = getPath()
+      expect(typeof result).toMatch(/string|undefined/)
+
+      setEnv('PATH', '/usr/local/bin:/usr/bin')
+      expect(getPath()).toBe('/usr/local/bin:/usr/bin')
+    })
+
+    it('should handle consecutive reads', () => {
+      setEnv('PATH', '/usr/bin:/bin')
+      expect(getPath()).toBe('/usr/bin:/bin')
+      expect(getPath()).toBe('/usr/bin:/bin')
+      expect(getPath()).toBe('/usr/bin:/bin')
+    })
+
+    it('should handle PATH with Python virtual env', () => {
+      setEnv('PATH', '/home/user/venv/bin:/usr/local/bin:/usr/bin:/bin')
+      expect(getPath()).toBe('/home/user/venv/bin:/usr/local/bin:/usr/bin:/bin')
+    })
+
+    it('should handle PATH with Ruby gems', () => {
+      setEnv('PATH', '/usr/local/bin:/usr/bin:/bin:~/.gem/ruby/bin')
+      expect(getPath()).toBe('/usr/local/bin:/usr/bin:/bin:~/.gem/ruby/bin')
+    })
+
+    it('should handle PATH with Go binaries', () => {
+      setEnv('PATH', '/usr/local/bin:/usr/bin:/bin:~/go/bin')
+      expect(getPath()).toBe('/usr/local/bin:/usr/bin:/bin:~/go/bin')
+    })
+
+    it('should handle PATH with Rust cargo', () => {
+      setEnv('PATH', '/usr/local/bin:/usr/bin:/bin:~/.cargo/bin')
+      expect(getPath()).toBe('/usr/local/bin:/usr/bin:/bin:~/.cargo/bin')
+    })
+
+    it('should handle PATH with snap binaries', () => {
+      setEnv('PATH', '/usr/local/bin:/usr/bin:/bin:/snap/bin')
+      expect(getPath()).toBe('/usr/local/bin:/usr/bin:/bin:/snap/bin')
+    })
+
+    it('should handle PATH with flatpak', () => {
+      setEnv(
+        'PATH',
+        '/usr/local/bin:/usr/bin:/bin:/var/lib/flatpak/exports/bin',
+      )
+      expect(getPath()).toBe(
+        '/usr/local/bin:/usr/bin:/bin:/var/lib/flatpak/exports/bin',
+      )
+    })
+
+    it('should handle PATH with Android SDK', () => {
+      setEnv(
+        'PATH',
+        '/usr/local/bin:/usr/bin:/bin:~/Android/Sdk/platform-tools',
+      )
+      expect(getPath()).toBe(
+        '/usr/local/bin:/usr/bin:/bin:~/Android/Sdk/platform-tools',
+      )
+    })
+
+    it('should handle WSL PATH', () => {
+      setEnv('PATH', '/usr/bin:/bin:/mnt/c/Windows/System32')
+      expect(getPath()).toBe('/usr/bin:/bin:/mnt/c/Windows/System32')
+    })
+  })
+})
diff --git a/test/unit/env/pre-commit.test.ts b/test/unit/env/pre-commit.test.ts
new file mode 100644
index 0000000..84ad3b0
--- /dev/null
+++ b/test/unit/env/pre-commit.test.ts
@@ -0,0 +1,164 @@
+/**
+ * @fileoverview Unit tests for PRE_COMMIT environment variable getter.
+ *
+ * Tests getPreCommit() for detecting pre-commit hook execution.
+ * Returns boolean indicating if running in pre-commit context (PRE_COMMIT=1).
+ * Uses rewire for test isolation. Used for conditional behavior in Git hooks.
+ */
+
+import { getPreCommit } from '@socketsecurity/lib/env/pre-commit'
+import { clearEnv, resetEnv, setEnv } from '@socketsecurity/lib/env/rewire'
+import { afterEach, describe, expect, it } from 'vitest'
+
+describe('env/pre-commit', () => {
+  afterEach(() => {
+    resetEnv()
+  })
+
+  describe('getPreCommit', () => {
+    it('should return true when PRE_COMMIT is set to "true"', () => {
+      setEnv('PRE_COMMIT', 'true')
+      expect(getPreCommit()).toBe(true)
+    })
+
+    it('should return true when PRE_COMMIT is set to "TRUE"', () => {
+      setEnv('PRE_COMMIT', 'TRUE')
+      expect(getPreCommit()).toBe(true)
+    })
+
+    it('should return true when PRE_COMMIT is set to "1"', () => {
+      setEnv('PRE_COMMIT', '1')
+      expect(getPreCommit()).toBe(true)
+    })
+
+    it('should return true when PRE_COMMIT is set to "yes"', () => {
+      setEnv('PRE_COMMIT', 'yes')
+      expect(getPreCommit()).toBe(true)
+    })
+
+    it('should return true when PRE_COMMIT is set to "YES"', () => {
+      setEnv('PRE_COMMIT', 'YES')
+      expect(getPreCommit()).toBe(true)
+    })
+
+    it('should return false when PRE_COMMIT is not set', () => {
+      clearEnv('PRE_COMMIT')
+      expect(getPreCommit()).toBe(false)
+    })
+
+    it('should return false when PRE_COMMIT is set to "false"', () => {
+      setEnv('PRE_COMMIT', 'false')
+      expect(getPreCommit()).toBe(false)
+    })
+
+    it('should return false when PRE_COMMIT is set to "0"', () => {
+      setEnv('PRE_COMMIT', '0')
+      expect(getPreCommit()).toBe(false)
+    })
+
+    it('should return false when PRE_COMMIT is set to "no"', () => {
+      setEnv('PRE_COMMIT', 'no')
+      expect(getPreCommit()).toBe(false)
+    })
+
+    it('should return false when PRE_COMMIT is empty string', () => {
+      setEnv('PRE_COMMIT', '')
+      expect(getPreCommit()).toBe(false)
+    })
+
+    it('should handle mixed case true', () => {
+      setEnv('PRE_COMMIT', 'True')
+      expect(getPreCommit()).toBe(true)
+    })
+
+    it('should handle mixed case yes', () => {
+      setEnv('PRE_COMMIT', 'Yes')
+      expect(getPreCommit()).toBe(true)
+    })
+
+    it('should handle arbitrary strings as false', () => {
+      setEnv('PRE_COMMIT', 'maybe')
+      expect(getPreCommit()).toBe(false)
+    })
+
+    it('should handle updating PRE_COMMIT value from false to true', () => {
+      setEnv('PRE_COMMIT', 'false')
+      expect(getPreCommit()).toBe(false)
+
+      setEnv('PRE_COMMIT', 'true')
+      expect(getPreCommit()).toBe(true)
+    })
+
+    it('should handle updating PRE_COMMIT value from true to false', () => {
+      setEnv('PRE_COMMIT', 'true')
+      expect(getPreCommit()).toBe(true)
+
+      setEnv('PRE_COMMIT', 'false')
+      expect(getPreCommit()).toBe(false)
+    })
+
+    it('should handle clearing and re-setting PRE_COMMIT', () => {
+      setEnv('PRE_COMMIT', 'true')
+      expect(getPreCommit()).toBe(true)
+
+      clearEnv('PRE_COMMIT')
+      expect(getPreCommit()).toBe(false)
+
+      setEnv('PRE_COMMIT', '1')
+      expect(getPreCommit()).toBe(true)
+    })
+
+    it('should handle consecutive reads', () => {
+      setEnv('PRE_COMMIT', 'true')
+      expect(getPreCommit()).toBe(true)
+      expect(getPreCommit()).toBe(true)
+      expect(getPreCommit()).toBe(true)
+    })
+
+    it('should handle numeric strings other than 1', () => {
+      setEnv('PRE_COMMIT', '2')
+      expect(getPreCommit()).toBe(false)
+
+      setEnv('PRE_COMMIT', '100')
+      expect(getPreCommit()).toBe(false)
+    })
+
+    it('should handle whitespace in values', () => {
+      setEnv('PRE_COMMIT', ' true ')
+      expect(getPreCommit()).toBe(false) // whitespace makes it not match
+
+      setEnv('PRE_COMMIT', 'true')
+      expect(getPreCommit()).toBe(true)
+    })
+
+    it('should be case-insensitive for true', () => {
+      setEnv('PRE_COMMIT', 'tRuE')
+      expect(getPreCommit()).toBe(true)
+    })
+
+    it('should be case-insensitive for yes', () => {
+      setEnv('PRE_COMMIT', 'yEs')
+      expect(getPreCommit()).toBe(true)
+    })
+
+    it('should handle special characters', () => {
+      setEnv('PRE_COMMIT', 'true!')
+      expect(getPreCommit()).toBe(false)
+    })
+
+    it('should handle Husky pre-commit context', () => {
+      setEnv('PRE_COMMIT', '1')
+      expect(getPreCommit()).toBe(true)
+    })
+
+    it('should handle pre-commit framework context', () => {
+      setEnv('PRE_COMMIT', 'true')
+      expect(getPreCommit()).toBe(true)
+    })
+
+    it('should handle Git hook context', () => {
+      setEnv('PRE_COMMIT', 'yes')
+      expect(getPreCommit()).toBe(true)
+    })
+  })
+})
diff --git a/test/unit/env/rewire.test.ts b/test/unit/env/rewire.test.ts
new file mode 100644
index 0000000..f743f03
--- /dev/null
+++ b/test/unit/env/rewire.test.ts
@@ -0,0 +1,150 @@
+/**
+ * @fileoverview Unit tests for environment variable rewiring system.
+ *
+ * Tests the rewire module that enables test-time environment variable overrides:
+ * - setEnv() / clearEnv() - override env vars without modifying process.env
+ * - resetEnv() - clear all overrides (use in afterEach)
+ * - hasOverride() - check if an env var has a test override
+ * Allows isolated env var testing without polluting global process.env state.
+ * Critical for reliable, parallel test execution without env var conflicts.
+ */
+
+import { getCI } from '@socketsecurity/lib/env/ci'
+import { getHome } from '@socketsecurity/lib/env/home'
+import { getSocketDebug } from '@socketsecurity/lib/env/socket'
+import {
+  clearEnv,
+  hasOverride,
+  resetEnv,
+  setEnv,
+} from '@socketsecurity/lib/env/rewire'
+import { afterEach, beforeEach, describe, expect, it } from 'vitest'
+
+describe('env rewiring', () => {
+  // Clean up after each test to avoid state leakage
+  afterEach(() => {
+    resetEnv()
+  })
+
+  describe('setEnv() and clearEnv()', () => {
+    it('should override environment variable', () => {
+      // Set override
+      setEnv('HOME', '/custom/home')
+
+      expect(getHome()).toBe('/custom/home')
+      expect(hasOverride('HOME')).toBe(true)
+    })
+
+    it('should clear override and return to real value', () => {
+      const originalHome = process.env.HOME
+
+      setEnv('HOME', '/custom/home')
+      expect(getHome()).toBe('/custom/home')
+
+      clearEnv('HOME')
+      expect(getHome()).toBe(originalHome)
+      expect(hasOverride('HOME')).toBe(false)
+    })
+
+    it('should override boolean env vars', () => {
+      // Override CI to true
+      setEnv('CI', '1')
+      expect(getCI()).toBe(true)
+
+      // Override CI to false
+      setEnv('CI', '')
+      expect(getCI()).toBe(false)
+    })
+
+    it('should allow undefined overrides', () => {
+      setEnv('SOCKET_DEBUG', undefined)
+      expect(getSocketDebug()).toBeUndefined()
+      expect(hasOverride('SOCKET_DEBUG')).toBe(true)
+    })
+  })
+
+  describe('resetEnv()', () => {
+    it('should clear all overrides', () => {
+      setEnv('HOME', '/custom/home')
+      setEnv('CI', '1')
+      setEnv('SOCKET_DEBUG', 'test')
+
+      expect(hasOverride('HOME')).toBe(true)
+      expect(hasOverride('CI')).toBe(true)
+      expect(hasOverride('SOCKET_DEBUG')).toBe(true)
+
+      resetEnv()
+
+      expect(hasOverride('HOME')).toBe(false)
+      expect(hasOverride('CI')).toBe(false)
+      expect(hasOverride('SOCKET_DEBUG')).toBe(false)
+    })
+  })
+
+  describe.sequential('isolated test scenarios', () => {
+    beforeEach(() => {
+      resetEnv()
+    })
+
+    it('test 1: should run with CI=true', () => {
+      setEnv('CI', 'true')
+      expect(getCI()).toBe(true)
+    })
+
+    it('test 2: should run with CI=false', () => {
+      setEnv('CI', 'false')
+      expect(getCI()).toBe(false)
+    })
+
+    it('test 3: should not be affected by previous tests', () => {
+      // This test should see the real CI value, not overrides from previous tests
+      expect(hasOverride('CI')).toBe(false)
+    })
+  })
+
+  describe('real-world usage patterns', () => {
+    it('should simulate CI environment for testing', () => {
+      // Test code behavior in CI
+      setEnv('CI', '1')
+      setEnv('GITHUB_REPOSITORY', 'owner/repo')
+
+      expect(getCI()).toBe(true)
+      // Test code that behaves differently in CI...
+    })
+
+    it('should test with custom home directory', () => {
+      setEnv('HOME', '/tmp/test-home')
+
+      expect(getHome()).toBe('/tmp/test-home')
+      // Test code that uses home directory...
+    })
+
+    it('should test debug mode behavior', () => {
+      setEnv('SOCKET_DEBUG', 'socket:*')
+
+      expect(getSocketDebug()).toBe('socket:*')
+      // Test debug logging behavior...
+    })
+  })
+
+  describe('multiple simultaneous overrides', () => {
+    it('should handle multiple overrides independently', () => {
+      setEnv('HOME', '/custom/home')
+      setEnv('CI', '1')
+      setEnv('SOCKET_DEBUG', 'test')
+
+      expect(getHome()).toBe('/custom/home')
+      expect(getCI()).toBe(true)
+      expect(getSocketDebug()).toBe('test')
+
+      // Clear one override
+      clearEnv('CI')
+
+      // Others remain
+      expect(getHome()).toBe('/custom/home')
+      expect(getSocketDebug()).toBe('test')
+      // CI returns to real value
+      expect(hasOverride('CI')).toBe(false)
+    })
+  })
+})
diff --git a/test/unit/env/shell.test.ts b/test/unit/env/shell.test.ts
new file mode 100644
index 0000000..65bef18
--- /dev/null
+++ b/test/unit/env/shell.test.ts
@@ -0,0 +1,162 @@
+/**
+ * @fileoverview Unit tests for SHELL environment variable getter.
+ *
+ * Tests getShell() for user's default shell (SHELL env var, e.g., /bin/bash, /bin/zsh).
+ * Returns shell path string or undefined. Unix/Linux standard.
+ * Uses rewire for test isolation. Used for shell-specific behavior and command execution.
+ */
+
+import { getShell } from '@socketsecurity/lib/env/shell'
+import { clearEnv, resetEnv, setEnv } from '@socketsecurity/lib/env/rewire'
+import { afterEach, describe, expect, it } from 'vitest'
+
+describe('env/shell', () => {
+  afterEach(() => {
+    resetEnv()
+  })
+
+  describe('getShell', () => {
+    it('should return SHELL environment variable when set', () => {
+      setEnv('SHELL', '/bin/bash')
+      expect(getShell()).toBe('/bin/bash')
+    })
+
+    it('should return undefined when SHELL is not set', () => {
+      clearEnv('SHELL')
+      // After clearing override, falls back to actual process.env
+      const result = getShell()
+      expect(typeof result).toMatch(/string|undefined/)
+    })
+
+    it('should handle bash shell path', () => {
+      setEnv('SHELL', '/bin/bash')
+      expect(getShell()).toBe('/bin/bash')
+    })
+
+    it('should handle zsh shell path', () => {
+      setEnv('SHELL', '/bin/zsh')
+      expect(getShell()).toBe('/bin/zsh')
+    })
+
+    it('should handle sh shell path', () => {
+      setEnv('SHELL', '/bin/sh')
+      expect(getShell()).toBe('/bin/sh')
+    })
+
+    it('should handle fish shell path', () => {
+      setEnv('SHELL', '/usr/bin/fish')
+      expect(getShell()).toBe('/usr/bin/fish')
+    })
+
+    it('should handle tcsh shell path', () => {
+      setEnv('SHELL', '/bin/tcsh')
+      expect(getShell()).toBe('/bin/tcsh')
+    })
+
+    it('should handle ksh shell path', () => {
+      setEnv('SHELL', '/bin/ksh')
+      expect(getShell()).toBe('/bin/ksh')
+    })
+
+    it('should handle custom shell path', () => {
+      setEnv('SHELL', '/opt/custom/bin/shell')
+      expect(getShell()).toBe('/opt/custom/bin/shell')
+    })
+
+    it('should handle Homebrew bash path', () => {
+      setEnv('SHELL', '/usr/local/bin/bash')
+      expect(getShell()).toBe('/usr/local/bin/bash')
+    })
+
+    it('should handle Homebrew zsh path', () => {
+      setEnv('SHELL', '/usr/local/bin/zsh')
+      expect(getShell()).toBe('/usr/local/bin/zsh')
+    })
+
+    it('should handle empty string', () => {
+      setEnv('SHELL', '')
+      expect(getShell()).toBe('')
+    })
+
+    it('should handle absolute paths', () => {
+      setEnv('SHELL', '/usr/bin/zsh')
+      expect(getShell()).toBe('/usr/bin/zsh')
+    })
+
+    it('should handle non-standard paths', () => {
+      setEnv('SHELL', '/some/weird/path/shell')
+      expect(getShell()).toBe('/some/weird/path/shell')
+    })
+
+    it('should handle multiple consecutive reads', () => {
+      setEnv('SHELL', '/bin/bash')
+      expect(getShell()).toBe('/bin/bash')
+      expect(getShell()).toBe('/bin/bash')
+      expect(getShell()).toBe('/bin/bash')
+    })
+
+    it('should handle updating shell value', () => {
+      setEnv('SHELL', '/bin/bash')
+      expect(getShell()).toBe('/bin/bash')
+
+      setEnv('SHELL', '/bin/zsh')
+      expect(getShell()).toBe('/bin/zsh')
+
+      setEnv('SHELL', '/bin/fish')
+      expect(getShell()).toBe('/bin/fish')
+    })
+
+    it('should handle clearing and re-setting', () => {
+      setEnv('SHELL', '/bin/bash')
+      expect(getShell()).toBe('/bin/bash')
+
+      clearEnv('SHELL')
+      // After clearing override, falls back to actual process.env
+      const result = getShell()
+      expect(typeof result).toMatch(/string|undefined/)
+
+      setEnv('SHELL', '/bin/zsh')
+      expect(getShell()).toBe('/bin/zsh')
+    })
+
+    it('should handle paths with spaces', () => {
+      setEnv('SHELL', '/path with spaces/bash')
+      expect(getShell()).toBe('/path with spaces/bash')
+    })
+
+    it('should handle paths with special characters', () => {
+      setEnv('SHELL', '/path-with_special.chars/bash')
+      expect(getShell()).toBe('/path-with_special.chars/bash')
+    })
+
+    it('should handle Windows-style paths', () => {
+      setEnv('SHELL', 'C:\\Program Files\\Git\\bin\\bash.exe')
+      expect(getShell()).toBe('C:\\Program Files\\Git\\bin\\bash.exe')
+    })
+
+    it('should handle relative paths', () => {
+      setEnv('SHELL', './local/bash')
+      expect(getShell()).toBe('./local/bash')
+    })
+
+    it('should handle tilde in path', () => {
+      setEnv('SHELL', '~/bin/bash')
+      expect(getShell()).toBe('~/bin/bash')
+    })
+
+    it('should handle dash shell', () => {
+      setEnv('SHELL', '/bin/dash')
+      expect(getShell()).toBe('/bin/dash')
+    })
+
+    it('should handle ash shell', () => {
+      setEnv('SHELL', '/bin/ash')
+      expect(getShell()).toBe('/bin/ash')
+    })
+
+    it('should handle csh shell', () => {
+      setEnv('SHELL', '/bin/csh')
+      expect(getShell()).toBe('/bin/csh')
+    })
+  })
+})
diff --git a/test/unit/env/socket-cli-shadow.test.ts b/test/unit/env/socket-cli-shadow.test.ts
new file mode 100644
index 0000000..98b6cfe
--- /dev/null
+++ b/test/unit/env/socket-cli-shadow.test.ts
@@ -0,0 +1,333 @@
+/**
+ * @fileoverview Unit tests for Socket CLI shadow mode environment variables.
+ *
+ * Tests getSocketCliShadow() for shadow CLI mode detection.
+ * Returns SOCKET_CLI_SHADOW value or undefined. Used for CLI testing and development.
+ * Uses rewire for test isolation. Enables shadow mode for Socket CLI operations.
+ */
+
+import {
+  getSocketCliShadowAcceptRisks,
+  getSocketCliShadowApiToken,
+  getSocketCliShadowBin,
+  getSocketCliShadowProgress,
+  getSocketCliShadowSilent,
+} from '@socketsecurity/lib/env/socket-cli-shadow'
+import { clearEnv, resetEnv, setEnv } from '@socketsecurity/lib/env/rewire'
+import { afterEach, describe, expect, it } from 'vitest'
+
+describe('env/socket-cli-shadow', () => {
+  afterEach(() => {
+    resetEnv()
+  })
+
+  describe('getSocketCliShadowAcceptRisks', () => {
+    it('should return true when SOCKET_CLI_SHADOW_ACCEPT_RISKS is "true"', () => {
+      setEnv('SOCKET_CLI_SHADOW_ACCEPT_RISKS', 'true')
+      expect(getSocketCliShadowAcceptRisks()).toBe(true)
+    })
+
+    it('should return true when SOCKET_CLI_SHADOW_ACCEPT_RISKS is "1"', () => {
+      setEnv('SOCKET_CLI_SHADOW_ACCEPT_RISKS', '1')
+      expect(getSocketCliShadowAcceptRisks()).toBe(true)
+    })
+
+    it('should return true when SOCKET_CLI_SHADOW_ACCEPT_RISKS is "yes"', () => {
+      setEnv('SOCKET_CLI_SHADOW_ACCEPT_RISKS', 'yes')
+      expect(getSocketCliShadowAcceptRisks()).toBe(true)
+    })
+
+    it('should return false when SOCKET_CLI_SHADOW_ACCEPT_RISKS is not set', () => {
+      clearEnv('SOCKET_CLI_SHADOW_ACCEPT_RISKS')
+      expect(getSocketCliShadowAcceptRisks()).toBe(false)
+    })
+
+    it('should return false when SOCKET_CLI_SHADOW_ACCEPT_RISKS is "false"', () => {
+      setEnv('SOCKET_CLI_SHADOW_ACCEPT_RISKS', 'false')
+      expect(getSocketCliShadowAcceptRisks()).toBe(false)
+    })
+
+    it('should return false when SOCKET_CLI_SHADOW_ACCEPT_RISKS is empty', () => {
+      setEnv('SOCKET_CLI_SHADOW_ACCEPT_RISKS', '')
+      expect(getSocketCliShadowAcceptRisks()).toBe(false)
+    })
+
+    it('should handle mixed case', () => {
+      setEnv('SOCKET_CLI_SHADOW_ACCEPT_RISKS', 'True')
+      expect(getSocketCliShadowAcceptRisks()).toBe(true)
+    })
+
+    it('should handle consecutive reads', () => {
+      setEnv('SOCKET_CLI_SHADOW_ACCEPT_RISKS', 'true')
+      expect(getSocketCliShadowAcceptRisks()).toBe(true)
+      expect(getSocketCliShadowAcceptRisks()).toBe(true)
+      expect(getSocketCliShadowAcceptRisks()).toBe(true)
+    })
+  })
+
+  describe('getSocketCliShadowApiToken', () => {
+    it('should return SOCKET_CLI_SHADOW_API_TOKEN when set', () => {
+      setEnv('SOCKET_CLI_SHADOW_API_TOKEN', 'test-token-123')
+      expect(getSocketCliShadowApiToken()).toBe('test-token-123')
+    })
+
+    it('should return undefined when SOCKET_CLI_SHADOW_API_TOKEN is not set', () => {
+      clearEnv('SOCKET_CLI_SHADOW_API_TOKEN')
+      const result = getSocketCliShadowApiToken()
+      expect(typeof result).toMatch(/string|undefined/)
+    })
+
+    it('should handle Socket API token', () => {
+      setEnv('SOCKET_CLI_SHADOW_API_TOKEN', 'sock_abc123def456')
+      expect(getSocketCliShadowApiToken()).toBe('sock_abc123def456')
+    })
+
+    it('should handle long API token', () => {
+      const longToken = `sock_${'a'.repeat(100)}`
+      setEnv('SOCKET_CLI_SHADOW_API_TOKEN', longToken)
+      expect(getSocketCliShadowApiToken()).toBe(longToken)
+    })
+
+    it('should handle empty string', () => {
+      setEnv('SOCKET_CLI_SHADOW_API_TOKEN', '')
+      expect(getSocketCliShadowApiToken()).toBe('')
+    })
+
+    it('should handle updating token', () => {
+      setEnv('SOCKET_CLI_SHADOW_API_TOKEN', 'token1')
+      expect(getSocketCliShadowApiToken()).toBe('token1')
+
+      setEnv('SOCKET_CLI_SHADOW_API_TOKEN', 'token2')
+      expect(getSocketCliShadowApiToken()).toBe('token2')
+    })
+
+    it('should handle consecutive reads', () => {
+      setEnv('SOCKET_CLI_SHADOW_API_TOKEN', 'test-token')
+      expect(getSocketCliShadowApiToken()).toBe('test-token')
+      expect(getSocketCliShadowApiToken()).toBe('test-token')
+      expect(getSocketCliShadowApiToken()).toBe('test-token')
+    })
+
+    it('should handle token with special characters', () => {
+      setEnv('SOCKET_CLI_SHADOW_API_TOKEN', 'sock_abc-123_xyz/456')
+      expect(getSocketCliShadowApiToken()).toBe('sock_abc-123_xyz/456')
+    })
+  })
+
+  describe('getSocketCliShadowBin', () => {
+    it('should return SOCKET_CLI_SHADOW_BIN when set', () => {
+      setEnv('SOCKET_CLI_SHADOW_BIN', '/usr/local/bin/socket')
+      expect(getSocketCliShadowBin()).toBe('/usr/local/bin/socket')
+    })
+
+    it('should return undefined when SOCKET_CLI_SHADOW_BIN is not set', () => {
+      clearEnv('SOCKET_CLI_SHADOW_BIN')
+      const result = getSocketCliShadowBin()
+      expect(typeof result).toMatch(/string|undefined/)
+    })
+
+    it('should handle Unix binary path', () => {
+      setEnv('SOCKET_CLI_SHADOW_BIN', '/usr/local/bin/socket')
+      expect(getSocketCliShadowBin()).toBe('/usr/local/bin/socket')
+    })
+
+    it('should handle Windows binary path', () => {
+      setEnv('SOCKET_CLI_SHADOW_BIN', 'C:\\Program Files\\Socket\\socket.exe')
+      expect(getSocketCliShadowBin()).toBe(
+        'C:\\Program Files\\Socket\\socket.exe',
+      )
+    })
+
+    it('should handle npm global binary path', () => {
+      setEnv(
+        'SOCKET_CLI_SHADOW_BIN',
+        '/usr/local/lib/node_modules/@socketsecurity/cli/bin/socket',
+      )
+      expect(getSocketCliShadowBin()).toBe(
+        '/usr/local/lib/node_modules/@socketsecurity/cli/bin/socket',
+      )
+    })
+
+    it('should handle pnpm global binary path', () => {
+      setEnv('SOCKET_CLI_SHADOW_BIN', '/home/user/.local/share/pnpm/socket')
+      expect(getSocketCliShadowBin()).toBe(
+        '/home/user/.local/share/pnpm/socket',
+      )
+    })
+
+    it('should handle relative path', () => {
+      setEnv('SOCKET_CLI_SHADOW_BIN', './node_modules/.bin/socket')
+      expect(getSocketCliShadowBin()).toBe('./node_modules/.bin/socket')
+    })
+
+    it('should handle empty string', () => {
+      setEnv('SOCKET_CLI_SHADOW_BIN', '')
+      expect(getSocketCliShadowBin()).toBe('')
+    })
+
+    it('should handle updating binary path', () => {
+      setEnv('SOCKET_CLI_SHADOW_BIN', '/bin/socket1')
+      expect(getSocketCliShadowBin()).toBe('/bin/socket1')
+
+      setEnv('SOCKET_CLI_SHADOW_BIN', '/bin/socket2')
+      expect(getSocketCliShadowBin()).toBe('/bin/socket2')
+    })
+
+    it('should handle consecutive reads', () => {
+      setEnv('SOCKET_CLI_SHADOW_BIN', '/usr/bin/socket')
+      expect(getSocketCliShadowBin()).toBe('/usr/bin/socket')
+      expect(getSocketCliShadowBin()).toBe('/usr/bin/socket')
+      expect(getSocketCliShadowBin()).toBe('/usr/bin/socket')
+    })
+
+    it('should handle WSL path', () => {
+      setEnv('SOCKET_CLI_SHADOW_BIN', '/mnt/c/Windows/socket.exe')
+      expect(getSocketCliShadowBin()).toBe('/mnt/c/Windows/socket.exe')
+    })
+
+    it('should handle Homebrew path', () => {
+      setEnv('SOCKET_CLI_SHADOW_BIN', '/opt/homebrew/bin/socket')
+      expect(getSocketCliShadowBin()).toBe('/opt/homebrew/bin/socket')
+    })
+  })
+
+  describe('getSocketCliShadowProgress', () => {
+    it('should return true when SOCKET_CLI_SHADOW_PROGRESS is "true"', () => {
+      setEnv('SOCKET_CLI_SHADOW_PROGRESS', 'true')
+      expect(getSocketCliShadowProgress()).toBe(true)
+    })
+
+    it('should return true when SOCKET_CLI_SHADOW_PROGRESS is "1"', () => {
+      setEnv('SOCKET_CLI_SHADOW_PROGRESS', '1')
+      expect(getSocketCliShadowProgress()).toBe(true)
+    })
+
+    it('should return true when SOCKET_CLI_SHADOW_PROGRESS is "yes"', () => {
+      setEnv('SOCKET_CLI_SHADOW_PROGRESS', 'yes')
+      expect(getSocketCliShadowProgress()).toBe(true)
+    })
+
+    it('should return false when SOCKET_CLI_SHADOW_PROGRESS is not set', () => {
+      clearEnv('SOCKET_CLI_SHADOW_PROGRESS')
+      expect(getSocketCliShadowProgress()).toBe(false)
+    })
+
+    it('should return false when SOCKET_CLI_SHADOW_PROGRESS is "false"', () => {
+      setEnv('SOCKET_CLI_SHADOW_PROGRESS', 'false')
+      expect(getSocketCliShadowProgress()).toBe(false)
+    })
+
+    it('should return false when SOCKET_CLI_SHADOW_PROGRESS is empty', () => {
+      setEnv('SOCKET_CLI_SHADOW_PROGRESS', '')
+      expect(getSocketCliShadowProgress()).toBe(false)
+    })
+
+    it('should handle mixed case', () => {
+      setEnv('SOCKET_CLI_SHADOW_PROGRESS', 'YES')
+      expect(getSocketCliShadowProgress()).toBe(true)
+    })
+
+    it('should handle consecutive reads', () => {
+      setEnv('SOCKET_CLI_SHADOW_PROGRESS', 'true')
+      expect(getSocketCliShadowProgress()).toBe(true)
+      expect(getSocketCliShadowProgress()).toBe(true)
+      expect(getSocketCliShadowProgress()).toBe(true)
+    })
+  })
+
+  describe('getSocketCliShadowSilent', () => {
+    it('should return true when SOCKET_CLI_SHADOW_SILENT is "true"', () => {
+      setEnv('SOCKET_CLI_SHADOW_SILENT', 'true')
+      expect(getSocketCliShadowSilent()).toBe(true)
+    })
+
+    it('should return true when SOCKET_CLI_SHADOW_SILENT is "1"', () => {
+      setEnv('SOCKET_CLI_SHADOW_SILENT', '1')
+      expect(getSocketCliShadowSilent()).toBe(true)
+    })
+
+    it('should return true when SOCKET_CLI_SHADOW_SILENT is "yes"', () => {
+      setEnv('SOCKET_CLI_SHADOW_SILENT', 'yes')
+      expect(getSocketCliShadowSilent()).toBe(true)
+    })
+
+    it('should return false when SOCKET_CLI_SHADOW_SILENT is not set', () => {
+      clearEnv('SOCKET_CLI_SHADOW_SILENT')
+      expect(getSocketCliShadowSilent()).toBe(false)
+    })
+
+    it('should return false when SOCKET_CLI_SHADOW_SILENT is "false"', () => {
+      setEnv('SOCKET_CLI_SHADOW_SILENT', 'false')
+      expect(getSocketCliShadowSilent()).toBe(false)
+    })
+
+    it('should return false when SOCKET_CLI_SHADOW_SILENT is empty', () => {
+      setEnv('SOCKET_CLI_SHADOW_SILENT', '')
+      expect(getSocketCliShadowSilent()).toBe(false)
+    })
+
+    it('should handle mixed case', () => {
+      setEnv('SOCKET_CLI_SHADOW_SILENT', 'True')
+      expect(getSocketCliShadowSilent()).toBe(true)
+    })
+
+    it('should handle consecutive reads', () => {
+      setEnv('SOCKET_CLI_SHADOW_SILENT', 'true')
+      expect(getSocketCliShadowSilent()).toBe(true)
+      expect(getSocketCliShadowSilent()).toBe(true)
+      expect(getSocketCliShadowSilent()).toBe(true)
+    })
+  })
+
+  describe('shadow mode configuration interaction', () => {
+    it('should handle all shadow mode vars set simultaneously', () => {
+      setEnv('SOCKET_CLI_SHADOW_ACCEPT_RISKS', 'true')
+      setEnv('SOCKET_CLI_SHADOW_API_TOKEN', 'sock_test123')
+      setEnv('SOCKET_CLI_SHADOW_BIN', '/usr/bin/socket')
+      setEnv('SOCKET_CLI_SHADOW_PROGRESS', 'true')
+      setEnv('SOCKET_CLI_SHADOW_SILENT', 'false')
+
+      expect(getSocketCliShadowAcceptRisks()).toBe(true)
+      expect(getSocketCliShadowApiToken()).toBe('sock_test123')
+      expect(getSocketCliShadowBin()).toBe('/usr/bin/socket')
+      expect(getSocketCliShadowProgress()).toBe(true)
+      expect(getSocketCliShadowSilent()).toBe(false)
+    })
+
+    it('should handle clearing all shadow mode vars', () => {
+      setEnv('SOCKET_CLI_SHADOW_ACCEPT_RISKS', 'true')
+      setEnv('SOCKET_CLI_SHADOW_API_TOKEN', 'token')
+      setEnv('SOCKET_CLI_SHADOW_BIN', '/bin/socket')
+      setEnv('SOCKET_CLI_SHADOW_PROGRESS', 'true')
+      setEnv('SOCKET_CLI_SHADOW_SILENT', 'true')
+
+      clearEnv('SOCKET_CLI_SHADOW_ACCEPT_RISKS')
+      clearEnv('SOCKET_CLI_SHADOW_API_TOKEN')
+      clearEnv('SOCKET_CLI_SHADOW_BIN')
+      clearEnv('SOCKET_CLI_SHADOW_PROGRESS')
+      clearEnv('SOCKET_CLI_SHADOW_SILENT')
+
+      expect(getSocketCliShadowAcceptRisks()).toBe(false)
+      expect(typeof getSocketCliShadowApiToken()).toMatch(/string|undefined/)
+      expect(typeof getSocketCliShadowBin()).toMatch(/string|undefined/)
+      expect(getSocketCliShadowProgress()).toBe(false)
+      expect(getSocketCliShadowSilent()).toBe(false)
+    })
+
+    it('should handle silent mode with progress disabled', () => {
+      setEnv('SOCKET_CLI_SHADOW_SILENT', 'true')
+      setEnv('SOCKET_CLI_SHADOW_PROGRESS', 'false')
+
+      expect(getSocketCliShadowSilent()).toBe(true)
+      expect(getSocketCliShadowProgress()).toBe(false)
+    })
+
+    it('should handle accept risks with silent mode', () => {
+      setEnv('SOCKET_CLI_SHADOW_ACCEPT_RISKS', 'true')
+      setEnv('SOCKET_CLI_SHADOW_SILENT', 'true')
+
+      expect(getSocketCliShadowAcceptRisks()).toBe(true)
+      expect(getSocketCliShadowSilent()).toBe(true)
+    })
+  })
+})
diff --git a/test/unit/env/socket-cli.test.ts b/test/unit/env/socket-cli.test.ts
new file mode 100644
index 0000000..03f153f
--- /dev/null
+++ b/test/unit/env/socket-cli.test.ts
@@ -0,0 +1,185 @@
+/**
+ * @fileoverview Unit tests for Socket CLI environment variable getters.
+ *
+ * Tests getSocketCli() for Socket CLI detection and configuration.
+ * Returns SOCKET_CLI value or undefined. Used to detect CLI environment.
+ * Uses rewire for test isolation. Critical for CLI vs programmatic API behavior.
+ */
+
+import {
+  getSocketCliAcceptRisks,
+  getSocketCliApiBaseUrl,
+  getSocketCliApiProxy,
+  getSocketCliApiTimeout,
+  getSocketCliApiToken,
+  getSocketCliConfig,
+  getSocketCliFix,
+  getSocketCliGithubToken,
+  getSocketCliNoApiToken,
+  getSocketCliOptimize,
+  getSocketCliOrgSlug,
+  getSocketCliViewAllRisks,
+} from '@socketsecurity/lib/env/socket-cli'
+import { resetEnv, setEnv } from '@socketsecurity/lib/env/rewire'
+import { afterEach, describe, expect, it } from 'vitest'
+
+describe('socket-cli env', () => {
+  afterEach(() => {
+    resetEnv()
+  })
+
+  describe('getSocketCliAcceptRisks', () => {
+    it('should return true when set to truthy value', () => {
+      setEnv('SOCKET_CLI_ACCEPT_RISKS', '1')
+      expect(getSocketCliAcceptRisks()).toBe(true)
+
+      setEnv('SOCKET_CLI_ACCEPT_RISKS', 'true')
+      expect(getSocketCliAcceptRisks()).toBe(true)
+    })
+
+    it('should return false when unset or falsy', () => {
+      setEnv('SOCKET_CLI_ACCEPT_RISKS', '')
+      expect(getSocketCliAcceptRisks()).toBe(false)
+
+      setEnv('SOCKET_CLI_ACCEPT_RISKS', undefined)
+      expect(getSocketCliAcceptRisks()).toBe(false)
+    })
+  })
+
+  describe('getSocketCliApiBaseUrl', () => {
+    it('should return URL when set', () => {
+      setEnv('SOCKET_CLI_API_BASE_URL', 'https://api.socket.dev')
+      expect(getSocketCliApiBaseUrl()).toBe('https://api.socket.dev')
+    })
+
+    it('should return undefined when not set', () => {
+      setEnv('SOCKET_CLI_API_BASE_URL', undefined)
+      expect(getSocketCliApiBaseUrl()).toBeUndefined()
+    })
+  })
+
+  describe('getSocketCliApiProxy', () => {
+    it('should return proxy URL when set', () => {
+      setEnv('SOCKET_CLI_API_PROXY', 'http://proxy.example.com:8080')
+      expect(getSocketCliApiProxy()).toBe('http://proxy.example.com:8080')
+    })
+
+    it('should return undefined when not set', () => {
+      setEnv('SOCKET_CLI_API_PROXY', undefined)
+      expect(getSocketCliApiProxy()).toBeUndefined()
+    })
+  })
+
+  describe('getSocketCliApiTimeout', () => {
+    it('should return timeout number when set', () => {
+      setEnv('SOCKET_CLI_API_TIMEOUT', '30000')
+      expect(getSocketCliApiTimeout()).toBe(30_000)
+    })
+
+    it('should return 0 when not set', () => {
+      setEnv('SOCKET_CLI_API_TIMEOUT', undefined)
+      expect(getSocketCliApiTimeout()).toBe(0)
+    })
+
+    it('should handle invalid numbers', () => {
+      setEnv('SOCKET_CLI_API_TIMEOUT', 'invalid')
+      expect(getSocketCliApiTimeout()).toBe(0)
+    })
+  })
+
+  describe('getSocketCliApiToken', () => {
+    it('should return token when set', () => {
+      setEnv('SOCKET_CLI_API_TOKEN', 'test-token-123')
+      expect(getSocketCliApiToken()).toBe('test-token-123')
+    })
+
+    it('should return undefined when not set', () => {
+      setEnv('SOCKET_CLI_API_TOKEN', undefined)
+      expect(getSocketCliApiToken()).toBeUndefined()
+    })
+  })
+
+  describe('getSocketCliConfig', () => {
+    it('should return config path when set', () => {
+      setEnv('SOCKET_CLI_CONFIG', '/path/to/config.json')
+      expect(getSocketCliConfig()).toBe('/path/to/config.json')
+    })
+
+    it('should return undefined when not set', () => {
+      setEnv('SOCKET_CLI_CONFIG', undefined)
+      expect(getSocketCliConfig()).toBeUndefined()
+    })
+  })
+
+  describe('getSocketCliFix', () => {
+    it('should return fix mode when set', () => {
+      setEnv('SOCKET_CLI_FIX', 'auto')
+      expect(getSocketCliFix()).toBe('auto')
+    })
+
+    it('should return undefined when not set', () => {
+      setEnv('SOCKET_CLI_FIX', undefined)
+      expect(getSocketCliFix()).toBeUndefined()
+    })
+  })
+
+  describe('getSocketCliGithubToken', () => {
+    it('should return GitHub token when set', () => {
+      setEnv('SOCKET_CLI_GITHUB_TOKEN', 'ghp_test123')
+      expect(getSocketCliGithubToken()).toBe('ghp_test123')
+    })
+
+    it('should return undefined when not set', () => {
+      setEnv('SOCKET_CLI_GITHUB_TOKEN', undefined)
+      expect(getSocketCliGithubToken()).toBeUndefined()
+    })
+  })
+
+  describe('getSocketCliNoApiToken', () => {
+    it('should return true when set to truthy value', () => {
+      setEnv('SOCKET_CLI_NO_API_TOKEN', '1')
+      expect(getSocketCliNoApiToken()).toBe(true)
+    })
+
+    it('should return false when unset or falsy', () => {
+      setEnv('SOCKET_CLI_NO_API_TOKEN', '')
+      expect(getSocketCliNoApiToken()).toBe(false)
+    })
+  })
+
+  describe('getSocketCliOptimize', () => {
+    it('should return true when set to truthy value', () => {
+      setEnv('SOCKET_CLI_OPTIMIZE', '1')
+      expect(getSocketCliOptimize()).toBe(true)
+    })
+
+    it('should return false when unset or falsy', () => {
+      setEnv('SOCKET_CLI_OPTIMIZE', '')
+      expect(getSocketCliOptimize()).toBe(false)
+    })
+  })
+
+  describe('getSocketCliOrgSlug', () => {
+    it('should return org slug when set', () => {
+      setEnv('SOCKET_CLI_ORG_SLUG', 'my-org')
+      expect(getSocketCliOrgSlug()).toBe('my-org')
+    })
+
+    it('should return undefined when not set', () => {
+      setEnv('SOCKET_CLI_ORG_SLUG', undefined)
+      expect(getSocketCliOrgSlug()).toBeUndefined()
+    })
+  })
+
+  describe('getSocketCliViewAllRisks', () => {
+    it('should return true when set to truthy value', () => {
+      setEnv('SOCKET_CLI_VIEW_ALL_RISKS', '1')
+      expect(getSocketCliViewAllRisks()).toBe(true)
+    })
+
+    it('should return false when unset or falsy', () => {
+      setEnv('SOCKET_CLI_VIEW_ALL_RISKS', '')
+      expect(getSocketCliViewAllRisks()).toBe(false)
+    })
+  })
+})
diff --git a/test/unit/env/socket.test.ts b/test/unit/env/socket.test.ts
new file mode 100644
index 0000000..b723829
--- /dev/null
+++ b/test/unit/env/socket.test.ts
@@ -0,0 +1,228 @@
+/**
+ * @fileoverview Unit tests for Socket environment variable getters.
+ *
+ * Tests Socket-specific environment variable accessors (SOCKET_* prefix):
+ * - API config: getSocketApiBaseUrl(), getSocketApiToken(), getSocketApiProxy(), getSocketApiTimeout()
+ * - Paths: getSocketHome(), getSocketCacacheDir(), getSocketDlxDirEnv(), getSocketConfig()
+ * - Registry: getSocketNpmRegistry(), getSocketRegistryUrl()
+ * - Behavior: getSocketDebug(), getSocketAcceptRisks(), getSocketViewAllRisks(), getSocketNoApiToken()
+ * - Organization: getSocketOrgSlug()
+ * Uses rewire for test isolation. Critical for Socket tool configuration.
+ */
+
+import {
+  getSocketAcceptRisks,
+  getSocketApiBaseUrl,
+  getSocketApiProxy,
+  getSocketApiTimeout,
+  getSocketApiToken,
+  getSocketCacacheDir,
+  getSocketConfig,
+  getSocketDebug,
+  getSocketDlxDirEnv,
+  getSocketHome,
+  getSocketNoApiToken,
+  getSocketNpmRegistry,
+  getSocketOrgSlug,
+  getSocketRegistryUrl,
+  getSocketViewAllRisks,
+} from '@socketsecurity/lib/env/socket'
+import { resetEnv, setEnv } from '@socketsecurity/lib/env/rewire'
+import { afterEach, describe, expect, it } from 'vitest'
+
+describe('socket env', () => {
+  afterEach(() => {
+    resetEnv()
+  })
+
+  describe('getSocketAcceptRisks', () => {
+    it('should return true when set to truthy value', () => {
+      setEnv('SOCKET_ACCEPT_RISKS', '1')
+      expect(getSocketAcceptRisks()).toBe(true)
+
+      setEnv('SOCKET_ACCEPT_RISKS', 'true')
+      expect(getSocketAcceptRisks()).toBe(true)
+    })
+
+    it('should return false when unset or falsy', () => {
+      setEnv('SOCKET_ACCEPT_RISKS', '')
+      expect(getSocketAcceptRisks()).toBe(false)
+
+      setEnv('SOCKET_ACCEPT_RISKS', undefined)
+      expect(getSocketAcceptRisks()).toBe(false)
+    })
+  })
+
+  describe('getSocketApiBaseUrl', () => {
+    it('should return URL when set', () => {
+      setEnv('SOCKET_API_BASE_URL', 'https://api.socket.dev')
+      expect(getSocketApiBaseUrl()).toBe('https://api.socket.dev')
+    })
+
+    it('should return undefined when not set', () => {
+      setEnv('SOCKET_API_BASE_URL', undefined)
+      expect(getSocketApiBaseUrl()).toBeUndefined()
+    })
+  })
+
+  describe('getSocketApiProxy', () => {
+    it('should return proxy URL when set', () => {
+      setEnv('SOCKET_API_PROXY', 'http://proxy.example.com:8080')
+      expect(getSocketApiProxy()).toBe('http://proxy.example.com:8080')
+    })
+
+    it('should return undefined when not set', () => {
+      setEnv('SOCKET_API_PROXY', undefined)
+      expect(getSocketApiProxy()).toBeUndefined()
+    })
+  })
+
+  describe('getSocketApiTimeout', () => {
+    it('should return timeout number when set', () => {
+      setEnv('SOCKET_API_TIMEOUT', '30000')
+      expect(getSocketApiTimeout()).toBe(30_000)
+    })
+
+    it('should return 0 when not set', () => {
+      setEnv('SOCKET_API_TIMEOUT', undefined)
+      expect(getSocketApiTimeout()).toBe(0)
+    })
+
+    it('should handle invalid numbers', () => {
+      setEnv('SOCKET_API_TIMEOUT', 'invalid')
+      expect(getSocketApiTimeout()).toBe(0)
+    })
+  })
+
+  describe('getSocketApiToken', () => {
+    it('should return token when set', () => {
+      setEnv('SOCKET_API_TOKEN', 'test-token-123')
+      expect(getSocketApiToken()).toBe('test-token-123')
+    })
+
+    it('should return undefined when not set', () => {
+      setEnv('SOCKET_API_TOKEN', undefined)
+      expect(getSocketApiToken()).toBeUndefined()
+    })
+  })
+
+  describe('getSocketCacacheDir', () => {
+    it('should return cacache directory when set', () => {
+      setEnv('SOCKET_CACACHE_DIR', '/custom/cacache')
+      expect(getSocketCacacheDir()).toBe('/custom/cacache')
+    })
+
+    it('should return undefined when not set', () => {
+      setEnv('SOCKET_CACACHE_DIR', undefined)
+      expect(getSocketCacacheDir()).toBeUndefined()
+    })
+  })
+
+  describe('getSocketConfig', () => {
+    it('should return config path when set', () => {
+      setEnv('SOCKET_CONFIG', '/path/to/socket.yml')
+      expect(getSocketConfig()).toBe('/path/to/socket.yml')
+    })
+
+    it('should return undefined when not set', () => {
+      setEnv('SOCKET_CONFIG', undefined)
+      expect(getSocketConfig()).toBeUndefined()
+    })
+  })
+
+  describe('getSocketDebug', () => {
+    it('should return debug value when set', () => {
+      setEnv('SOCKET_DEBUG', 'api,cache')
+      expect(getSocketDebug()).toBe('api,cache')
+    })
+
+    it('should return undefined when not set', () => {
+      setEnv('SOCKET_DEBUG', undefined)
+      expect(getSocketDebug()).toBeUndefined()
+    })
+  })
+
+  describe('getSocketDlxDirEnv', () => {
+    it('should return DLX directory when set', () => {
+      setEnv('SOCKET_DLX_DIR', '/custom/dlx')
+      expect(getSocketDlxDirEnv()).toBe('/custom/dlx')
+    })
+
+    it('should return undefined when not set', () => {
+      setEnv('SOCKET_DLX_DIR', undefined)
+      expect(getSocketDlxDirEnv()).toBeUndefined()
+    })
+  })
+
+  describe('getSocketHome', () => {
+    it('should return Socket home directory when set', () => {
+      setEnv('SOCKET_HOME', '/home/user/.socket')
+      expect(getSocketHome()).toBe('/home/user/.socket')
+    })
+
+    it('should return undefined when not set', () => {
+      setEnv('SOCKET_HOME', undefined)
+      expect(getSocketHome()).toBeUndefined()
+    })
+  })
+
+  describe('getSocketNoApiToken', () => {
+    it('should return true when set to truthy value', () => {
+      setEnv('SOCKET_NO_API_TOKEN', '1')
+      expect(getSocketNoApiToken()).toBe(true)
+    })
+
+    it('should return false when unset or falsy', () => {
+      setEnv('SOCKET_NO_API_TOKEN', '')
+      expect(getSocketNoApiToken()).toBe(false)
+    })
+  })
+
+  describe('getSocketNpmRegistry', () => {
+    it('should return NPM registry URL when set', () => {
+      setEnv('SOCKET_NPM_REGISTRY', 'https://registry.socket.dev')
+      expect(getSocketNpmRegistry()).toBe('https://registry.socket.dev')
+    })
+
+    it('should return undefined when not set', () => {
+      setEnv('SOCKET_NPM_REGISTRY', undefined)
+      expect(getSocketNpmRegistry()).toBeUndefined()
+    })
+  })
+
+  describe('getSocketOrgSlug', () => {
+    it('should return org slug when set', () => {
+      setEnv('SOCKET_ORG_SLUG', 'my-org')
+      expect(getSocketOrgSlug()).toBe('my-org')
+    })
+
+    it('should return undefined when not set', () => {
+      setEnv('SOCKET_ORG_SLUG', undefined)
+      expect(getSocketOrgSlug()).toBeUndefined()
+    })
+  })
+
+  describe('getSocketRegistryUrl', () => {
+    it('should return Socket registry URL when set', () => {
+      setEnv('SOCKET_REGISTRY_URL', 'https://registry.socket.dev')
+      expect(getSocketRegistryUrl()).toBe('https://registry.socket.dev')
+    })
+
+    it('should return undefined when not set', () => {
+      setEnv('SOCKET_REGISTRY_URL', undefined)
+      expect(getSocketRegistryUrl()).toBeUndefined()
+    })
+  })
+
+  describe('getSocketViewAllRisks', () => {
+    it('should return true when set to truthy value', () => {
+      setEnv('SOCKET_VIEW_ALL_RISKS', '1')
+      expect(getSocketViewAllRisks()).toBe(true)
+    })
+
+    it('should return false when unset or falsy', () => {
+      setEnv('SOCKET_VIEW_ALL_RISKS', '')
+      expect(getSocketViewAllRisks()).toBe(false)
+    })
+  })
+})
diff --git a/test/unit/env/temp-dir.test.ts b/test/unit/env/temp-dir.test.ts
new file mode 100644
index 0000000..30620a0
--- /dev/null
+++ b/test/unit/env/temp-dir.test.ts
@@ -0,0 +1,257 @@
+/**
+ * @fileoverview Unit tests for temporary directory environment variable getters.
+ *
+ * Tests getTempdir() / getTmpdir() for system temporary directory paths.
+ * Returns TMPDIR, TEMP, or TMP env var value, or os.tmpdir() fallback.
+ * Uses rewire for test isolation. Critical for temporary file operations.
+ */
+
+import { getTemp, getTmp, getTmpdir } from '@socketsecurity/lib/env/temp-dir'
+import { clearEnv, resetEnv, setEnv } from '@socketsecurity/lib/env/rewire'
+import { afterEach, describe, expect, it } from 'vitest'
+
+describe('env/temp-dir', () => {
+  afterEach(() => {
+    resetEnv()
+  })
+
+  describe('getTmpdir', () => {
+    it('should return TMPDIR when set', () => {
+      setEnv('TMPDIR', '/tmp')
+      expect(getTmpdir()).toBe('/tmp')
+    })
+
+    it('should return undefined when TMPDIR is not set', () => {
+      clearEnv('TMPDIR')
+      // After clearing override, falls back to actual process.env
+      const result = getTmpdir()
+      expect(typeof result).toMatch(/string|undefined/)
+    })
+
+    it('should handle macOS default tmpdir', () => {
+      setEnv('TMPDIR', '/var/folders/abc/xyz/T/')
+      expect(getTmpdir()).toBe('/var/folders/abc/xyz/T/')
+    })
+
+    it('should handle Unix tmpdir', () => {
+      setEnv('TMPDIR', '/tmp/')
+      expect(getTmpdir()).toBe('/tmp/')
+    })
+
+    it('should handle custom tmpdir', () => {
+      setEnv('TMPDIR', '/custom/temp')
+      expect(getTmpdir()).toBe('/custom/temp')
+    })
+
+    it('should handle tmpdir without trailing slash', () => {
+      setEnv('TMPDIR', '/tmp')
+      expect(getTmpdir()).toBe('/tmp')
+    })
+
+    it('should handle tmpdir with trailing slash', () => {
+      setEnv('TMPDIR', '/tmp/')
+      expect(getTmpdir()).toBe('/tmp/')
+    })
+
+    it('should handle empty string', () => {
+      setEnv('TMPDIR', '')
+      expect(getTmpdir()).toBe('')
+    })
+
+    it('should handle updating tmpdir', () => {
+      setEnv('TMPDIR', '/tmp1')
+      expect(getTmpdir()).toBe('/tmp1')
+
+      setEnv('TMPDIR', '/tmp2')
+      expect(getTmpdir()).toBe('/tmp2')
+    })
+
+    it('should handle consecutive reads', () => {
+      setEnv('TMPDIR', '/tmp')
+      expect(getTmpdir()).toBe('/tmp')
+      expect(getTmpdir()).toBe('/tmp')
+      expect(getTmpdir()).toBe('/tmp')
+    })
+
+    it('should handle tmpdir with spaces', () => {
+      setEnv('TMPDIR', '/path with spaces/tmp')
+      expect(getTmpdir()).toBe('/path with spaces/tmp')
+    })
+
+    it('should handle long tmpdir path', () => {
+      const longPath = `${'/a'.repeat(100)}/tmp`
+      setEnv('TMPDIR', longPath)
+      expect(getTmpdir()).toBe(longPath)
+    })
+  })
+
+  describe('getTemp', () => {
+    it('should return TEMP when set', () => {
+      setEnv('TEMP', 'C:\\Windows\\Temp')
+      expect(getTemp()).toBe('C:\\Windows\\Temp')
+    })
+
+    it('should return undefined when TEMP is not set', () => {
+      clearEnv('TEMP')
+      // After clearing override, falls back to actual process.env
+      const result = getTemp()
+      expect(typeof result).toMatch(/string|undefined/)
+    })
+
+    it('should handle Windows default temp', () => {
+      setEnv('TEMP', 'C:\\Windows\\Temp')
+      expect(getTemp()).toBe('C:\\Windows\\Temp')
+    })
+
+    it('should handle Windows user temp', () => {
+      setEnv('TEMP', 'C:\\Users\\username\\AppData\\Local\\Temp')
+      expect(getTemp()).toBe('C:\\Users\\username\\AppData\\Local\\Temp')
+    })
+
+    it('should handle forward slashes', () => {
+      setEnv('TEMP', 'C:/Windows/Temp')
+      expect(getTemp()).toBe('C:/Windows/Temp')
+    })
+
+    it('should handle UNC paths', () => {
+      setEnv('TEMP', '\\\\server\\share\\temp')
+      expect(getTemp()).toBe('\\\\server\\share\\temp')
+    })
+
+    it('should handle empty string', () => {
+      setEnv('TEMP', '')
+      expect(getTemp()).toBe('')
+    })
+
+    it('should handle updating temp', () => {
+      setEnv('TEMP', 'C:\\Temp1')
+      expect(getTemp()).toBe('C:\\Temp1')
+
+      setEnv('TEMP', 'C:\\Temp2')
+      expect(getTemp()).toBe('C:\\Temp2')
+    })
+
+    it('should handle consecutive reads', () => {
+      setEnv('TEMP', 'C:\\Temp')
+      expect(getTemp()).toBe('C:\\Temp')
+      expect(getTemp()).toBe('C:\\Temp')
+      expect(getTemp()).toBe('C:\\Temp')
+    })
+
+    it('should handle temp with spaces', () => {
+      setEnv('TEMP', 'C:\\Program Files\\Temp')
+      expect(getTemp()).toBe('C:\\Program Files\\Temp')
+    })
+
+    it('should handle Unix-style path in TEMP', () => {
+      setEnv('TEMP', '/tmp')
+      expect(getTemp()).toBe('/tmp')
+    })
+
+    it('should handle relative path', () => {
+      setEnv('TEMP', '.\\temp')
+      expect(getTemp()).toBe('.\\temp')
+    })
+  })
+
+  describe('getTmp', () => {
+    it('should return TMP when set', () => {
+      setEnv('TMP', 'C:\\Temp')
+      expect(getTmp()).toBe('C:\\Temp')
+    })
+
+    it('should return undefined when TMP is not set', () => {
+      clearEnv('TMP')
+      // After clearing override, falls back to actual process.env
+      const result = getTmp()
+      expect(typeof result).toMatch(/string|undefined/)
+    })
+
+    it('should handle Windows TMP', () => {
+      setEnv('TMP', 'C:\\Temp')
+      expect(getTmp()).toBe('C:\\Temp')
+    })
+
+    it('should handle Unix TMP', () => {
+      setEnv('TMP', '/tmp')
+      expect(getTmp()).toBe('/tmp')
+    })
+
+    it('should handle custom TMP', () => {
+      setEnv('TMP', '/custom/tmp')
+      expect(getTmp()).toBe('/custom/tmp')
+    })
+
+    it('should handle empty string', () => {
+      setEnv('TMP', '')
+      expect(getTmp()).toBe('')
+    })
+
+    it('should handle updating tmp', () => {
+      setEnv('TMP', '/tmp1')
+      expect(getTmp()).toBe('/tmp1')
+
+      setEnv('TMP', '/tmp2')
+      expect(getTmp()).toBe('/tmp2')
+    })
+
+    it('should handle consecutive reads', () => {
+      setEnv('TMP', '/tmp')
+      expect(getTmp()).toBe('/tmp')
+      expect(getTmp()).toBe('/tmp')
+      expect(getTmp()).toBe('/tmp')
+    })
+
+    it('should handle tmp with special characters', () => {
+      setEnv('TMP', '/tmp-123_test')
+      expect(getTmp()).toBe('/tmp-123_test')
+    })
+
+    it('should handle WSL tmp path', () => {
+      setEnv('TMP', '/mnt/c/Windows/Temp')
+      expect(getTmp()).toBe('/mnt/c/Windows/Temp')
+    })
+  })
+
+  describe('temp directory interaction', () => {
+    it('should handle all temp vars set simultaneously', () => {
+      setEnv('TMPDIR', '/tmp')
+      setEnv('TEMP', 'C:\\Windows\\Temp')
+      setEnv('TMP', 'C:\\Temp')
+
+      expect(getTmpdir()).toBe('/tmp')
+      expect(getTemp()).toBe('C:\\Windows\\Temp')
+      expect(getTmp()).toBe('C:\\Temp')
+    })
+
+    it('should handle clearing all temp vars', () => {
+      setEnv('TMPDIR', '/tmp')
+      setEnv('TEMP', 'C:\\Temp')
+      setEnv('TMP', 'C:\\TMP')
+
+      clearEnv('TMPDIR')
+      clearEnv('TEMP')
+      clearEnv('TMP')
+
+      expect(typeof getTmpdir()).toMatch(/string|undefined/)
+      expect(typeof getTemp()).toMatch(/string|undefined/)
+      expect(typeof getTmp()).toMatch(/string|undefined/)
+    })
+
+    it('should handle Unix temp directory priority', () => {
+      setEnv('TMPDIR', '/var/tmp')
+      setEnv('TMP', '/tmp')
+
+      expect(getTmpdir()).toBe('/var/tmp')
+      expect(getTmp()).toBe('/tmp')
+    })
+
+    it('should handle Windows temp directory priority', () => {
+      setEnv('TEMP', 'C:\\Windows\\Temp')
+      setEnv('TMP', 'C:\\Temp')
+
+      expect(getTemp()).toBe('C:\\Windows\\Temp')
+      expect(getTmp()).toBe('C:\\Temp')
+    })
+  })
+})
diff --git a/test/unit/env/term.test.ts b/test/unit/env/term.test.ts
new file mode 100644
index 0000000..6dbf02f
--- /dev/null
+++ b/test/unit/env/term.test.ts
@@ -0,0 +1,162 @@
+/**
+ * @fileoverview Unit tests for TERM environment variable getter.
+ *
+ * Tests getTerm() for terminal type detection (TERM env var, e.g., "xterm-256color").
+ * Returns terminal type string or undefined. Used for terminal capability detection.
+ * Uses rewire for test isolation. Critical for ANSI color and formatting support.
+ */
+
+import { getTerm } from '@socketsecurity/lib/env/term'
+import { clearEnv, resetEnv, setEnv } from '@socketsecurity/lib/env/rewire'
+import { afterEach, describe, expect, it } from 'vitest'
+
+describe('env/term', () => {
+  afterEach(() => {
+    resetEnv()
+  })
+
+  describe('getTerm', () => {
+    it('should return TERM environment variable when set', () => {
+      setEnv('TERM', 'xterm-256color')
+      expect(getTerm()).toBe('xterm-256color')
+    })
+
+    it('should return undefined when TERM is not set', () => {
+      clearEnv('TERM')
+      // After clearing override, falls back to actual process.env
+      const result = getTerm()
+      expect(typeof result).toMatch(/string|undefined/)
+    })
+
+    it('should handle xterm terminal', () => {
+      setEnv('TERM', 'xterm')
+      expect(getTerm()).toBe('xterm')
+    })
+
+    it('should handle xterm-256color terminal', () => {
+      setEnv('TERM', 'xterm-256color')
+      expect(getTerm()).toBe('xterm-256color')
+    })
+
+    it('should handle screen terminal', () => {
+      setEnv('TERM', 'screen')
+      expect(getTerm()).toBe('screen')
+    })
+
+    it('should handle screen-256color terminal', () => {
+      setEnv('TERM', 'screen-256color')
+      expect(getTerm()).toBe('screen-256color')
+    })
+
+    it('should handle tmux terminal', () => {
+      setEnv('TERM', 'tmux')
+      expect(getTerm()).toBe('tmux')
+    })
+
+    it('should handle tmux-256color terminal', () => {
+      setEnv('TERM', 'tmux-256color')
+      expect(getTerm()).toBe('tmux-256color')
+    })
+
+    it('should handle vt100 terminal', () => {
+      setEnv('TERM', 'vt100')
+      expect(getTerm()).toBe('vt100')
+    })
+
+    it('should handle linux terminal', () => {
+      setEnv('TERM', 'linux')
+      expect(getTerm()).toBe('linux')
+    })
+
+    it('should handle dumb terminal', () => {
+      setEnv('TERM', 'dumb')
+      expect(getTerm()).toBe('dumb')
+    })
+
+    it('should handle rxvt terminal', () => {
+      setEnv('TERM', 'rxvt')
+      expect(getTerm()).toBe('rxvt')
+    })
+
+    it('should handle rxvt-unicode terminal', () => {
+      setEnv('TERM', 'rxvt-unicode')
+      expect(getTerm()).toBe('rxvt-unicode')
+    })
+
+    it('should handle ansi terminal', () => {
+      setEnv('TERM', 'ansi')
+      expect(getTerm()).toBe('ansi')
+    })
+
+    it('should handle empty string', () => {
+      setEnv('TERM', '')
+      expect(getTerm()).toBe('')
+    })
+
+    it('should handle color variant terminals', () => {
+      setEnv('TERM', 'xterm-color')
+      expect(getTerm()).toBe('xterm-color')
+    })
+
+    it('should handle iTerm2 terminal', () => {
+      setEnv('TERM', 'iTerm2')
+      expect(getTerm()).toBe('iTerm2')
+    })
+
+    it('should handle Alacritty terminal', () => {
+      setEnv('TERM', 'alacritty')
+      expect(getTerm()).toBe('alacritty')
+    })
+
+    it('should handle Kitty terminal', () => {
+      setEnv('TERM', 'xterm-kitty')
+      expect(getTerm()).toBe('xterm-kitty')
+    })
+
+    it('should handle WezTerm terminal', () => {
+      setEnv('TERM', 'wezterm')
+      expect(getTerm()).toBe('wezterm')
+    })
+
+    it('should handle updating terminal value', () => {
+      setEnv('TERM', 'xterm')
+      expect(getTerm()).toBe('xterm')
+
+      setEnv('TERM', 'xterm-256color')
+      expect(getTerm()).toBe('xterm-256color')
+
+      setEnv('TERM', 'screen-256color')
+      expect(getTerm()).toBe('screen-256color')
+    })
+
+    it('should handle clearing and re-setting', () => {
+      setEnv('TERM', 'xterm')
+      expect(getTerm()).toBe('xterm')
+
+      clearEnv('TERM')
+      // After clearing override, falls back to actual process.env
+      const result = getTerm()
+      expect(typeof result).toMatch(/string|undefined/)
+
+      setEnv('TERM', 'screen')
+      expect(getTerm()).toBe('screen')
+    })
+
+    it('should handle custom terminal types', () => {
+      setEnv('TERM', 'custom-terminal')
+      expect(getTerm()).toBe('custom-terminal')
+    })
+
+    it('should handle numeric values as strings', () => {
+      setEnv('TERM', '12345')
+      expect(getTerm()).toBe('12345')
+    })
+
+    it('should handle consecutive reads', () => {
+      setEnv('TERM', 'xterm-256color')
+      expect(getTerm()).toBe('xterm-256color')
+      expect(getTerm()).toBe('xterm-256color')
+      expect(getTerm()).toBe('xterm-256color')
+    })
+  })
+})
diff --git a/test/unit/env/test.test.ts b/test/unit/env/test.test.ts
new file mode 100644
index 0000000..eb12d42
--- /dev/null
+++ b/test/unit/env/test.test.ts
@@ -0,0 +1,286 @@
+/**
+ * @fileoverview Unit tests for test environment variable getters and detection.
+ *
+ * Tests isTest() for detecting test execution environment.
+ * Checks NODE_ENV=test or test runner indicators (Vitest, Jest, etc.).
+ * Uses rewire for test isolation. Used for conditional test-only behavior.
+ */
+
+import {
+  getJestWorkerId,
+  getVitest,
+  isTest,
+} from '@socketsecurity/lib/env/test'
+import { clearEnv, resetEnv, setEnv } from '@socketsecurity/lib/env/rewire'
+import { afterEach, describe, expect, it } from 'vitest'
+
+describe('env/test', () => {
+  afterEach(() => {
+    resetEnv()
+  })
+
+  describe('getJestWorkerId', () => {
+    it('should return JEST_WORKER_ID when set', () => {
+      setEnv('JEST_WORKER_ID', '1')
+      expect(getJestWorkerId()).toBe('1')
+    })
+
+    it('should return empty string when JEST_WORKER_ID is not set', () => {
+      clearEnv('JEST_WORKER_ID')
+      expect(getJestWorkerId()).toBe('')
+    })
+
+    it('should handle numeric worker IDs', () => {
+      setEnv('JEST_WORKER_ID', '2')
+      expect(getJestWorkerId()).toBe('2')
+
+      setEnv('JEST_WORKER_ID', '10')
+      expect(getJestWorkerId()).toBe('10')
+    })
+
+    it('should handle empty string', () => {
+      setEnv('JEST_WORKER_ID', '')
+      expect(getJestWorkerId()).toBe('')
+    })
+
+    it('should handle updating worker ID', () => {
+      setEnv('JEST_WORKER_ID', '1')
+      expect(getJestWorkerId()).toBe('1')
+
+      setEnv('JEST_WORKER_ID', '2')
+      expect(getJestWorkerId()).toBe('2')
+    })
+
+    it('should handle consecutive reads', () => {
+      setEnv('JEST_WORKER_ID', '1')
+      expect(getJestWorkerId()).toBe('1')
+      expect(getJestWorkerId()).toBe('1')
+      expect(getJestWorkerId()).toBe('1')
+    })
+  })
+
+  describe('getVitest', () => {
+    it('should return true when VITEST is set to "true"', () => {
+      setEnv('VITEST', 'true')
+      expect(getVitest()).toBe(true)
+    })
+
+    it('should return true when VITEST is set to "1"', () => {
+      setEnv('VITEST', '1')
+      expect(getVitest()).toBe(true)
+    })
+
+    it('should return true when VITEST is set to "yes"', () => {
+      setEnv('VITEST', 'yes')
+      expect(getVitest()).toBe(true)
+    })
+
+    it('should return false when VITEST is not set', () => {
+      setEnv('VITEST', '')
+      expect(getVitest()).toBe(false)
+    })
+
+    it('should return false when VITEST is set to "false"', () => {
+      setEnv('VITEST', 'false')
+      expect(getVitest()).toBe(false)
+    })
+
+    it('should return false when VITEST is empty string', () => {
+      setEnv('VITEST', '')
+      expect(getVitest()).toBe(false)
+    })
+
+    it('should handle consecutive reads', () => {
+      setEnv('VITEST', 'true')
+      expect(getVitest()).toBe(true)
+      expect(getVitest()).toBe(true)
+      expect(getVitest()).toBe(true)
+    })
+  })
+
+  describe('isTest', () => {
+    it('should return true when NODE_ENV is test', () => {
+      setEnv('NODE_ENV', 'test')
+      expect(isTest()).toBe(true)
+    })
+
+    it('should return true when VITEST is true', () => {
+      setEnv('VITEST', 'true')
+      expect(isTest()).toBe(true)
+    })
+
+    it('should return true when JEST_WORKER_ID is set', () => {
+      setEnv('JEST_WORKER_ID', '1')
+      expect(isTest()).toBe(true)
+    })
+
+    it('should return false when none of the test indicators are set', () => {
+      setEnv('NODE_ENV', 'production')
+      setEnv('VITEST', '')
+      setEnv('JEST_WORKER_ID', '')
+      expect(isTest()).toBe(false)
+    })
+
+    it('should return false when NODE_ENV is production', () => {
+      setEnv('NODE_ENV', 'production')
+      setEnv('VITEST', '')
+      setEnv('JEST_WORKER_ID', '')
+      expect(isTest()).toBe(false)
+    })
+
+    it('should return false when NODE_ENV is development', () => {
+      setEnv('NODE_ENV', 'development')
+      setEnv('VITEST', '')
+      setEnv('JEST_WORKER_ID', '')
+      expect(isTest()).toBe(false)
+    })
+
+    it('should return true when multiple test indicators are set', () => {
+      setEnv('NODE_ENV', 'test')
+      setEnv('VITEST', 'true')
+      setEnv('JEST_WORKER_ID', '1')
+      expect(isTest()).toBe(true)
+    })
+
+    it('should return true for Jest environment only', () => {
+      setEnv('NODE_ENV', 'production')
+      setEnv('VITEST', '')
+      setEnv('JEST_WORKER_ID', '2')
+      expect(isTest()).toBe(true)
+    })
+
+    it('should return true for Vitest environment only', () => {
+      setEnv('NODE_ENV', 'production')
+      setEnv('VITEST', '1')
+      setEnv('JEST_WORKER_ID', '')
+      expect(isTest()).toBe(true)
+    })
+
+    it('should return true for NODE_ENV test only', () => {
+      setEnv('NODE_ENV', 'test')
+      setEnv('VITEST', '')
+      setEnv('JEST_WORKER_ID', '')
+      expect(isTest()).toBe(true)
+    })
+
+    it('should handle consecutive reads', () => {
+      setEnv('NODE_ENV', 'test')
+      expect(isTest()).toBe(true)
+      expect(isTest()).toBe(true)
+      expect(isTest()).toBe(true)
+    })
+
+    it('should return true when VITEST is yes', () => {
+      setEnv('NODE_ENV', 'production')
+      setEnv('VITEST', 'yes')
+      setEnv('JEST_WORKER_ID', '')
+      expect(isTest()).toBe(true)
+    })
+
+    it('should handle transition from test to non-test', () => {
+      setEnv('NODE_ENV', 'test')
+      expect(isTest()).toBe(true)
+
+      setEnv('NODE_ENV', 'production')
+      setEnv('VITEST', '')
+      setEnv('JEST_WORKER_ID', '')
+      expect(isTest()).toBe(false)
+    })
+
+    it('should handle transition from non-test to test', () => {
+      setEnv('NODE_ENV', 'production')
+      setEnv('VITEST', '')
+      setEnv('JEST_WORKER_ID', '')
+      expect(isTest()).toBe(false)
+
+      setEnv('NODE_ENV', 'test')
+      expect(isTest()).toBe(true)
+    })
+
+    it('should return true even with empty JEST_WORKER_ID', () => {
+      setEnv('NODE_ENV', 'production')
+      setEnv('VITEST', '')
+      setEnv('JEST_WORKER_ID', '')
+      // Empty string is falsy, so isTest should be false
+      expect(isTest()).toBe(false)
+    })
+
+    it('should handle Jest worker ID 0', () => {
+      setEnv('NODE_ENV', 'production')
+      setEnv('VITEST', '')
+      setEnv('JEST_WORKER_ID', '0')
+      // '0' is truthy as a string, so isTest should be true
+      expect(isTest()).toBe(true)
+    })
+
+    it('should handle uppercase NODE_ENV', () => {
+      setEnv('NODE_ENV', 'TEST')
+      setEnv('VITEST', '')
+      setEnv('JEST_WORKER_ID', '')
+      // Should be false because comparison is case-sensitive
+      expect(isTest()).toBe(false)
+    })
+
+    it('should handle mixed case VITEST', () => {
+      setEnv('NODE_ENV', 'production')
+      setEnv('VITEST', 'True')
+      setEnv('JEST_WORKER_ID', '')
+      // envAsBoolean is case-insensitive
+      expect(isTest()).toBe(true)
+    })
+
+    it('should handle clearing all test indicators', () => {
+      setEnv('NODE_ENV', 'test')
+      setEnv('VITEST', 'true')
+      setEnv('JEST_WORKER_ID', '1')
+      expect(isTest()).toBe(true)
+
+      setEnv('NODE_ENV', 'production')
+      setEnv('VITEST', '')
+      setEnv('JEST_WORKER_ID', '')
+      expect(isTest()).toBe(false)
+    })
+  })
+
+  describe('test environment interaction', () => {
+    it('should detect Jest test environment', () => {
+      setEnv('NODE_ENV', 'production')
+      setEnv('VITEST', '')
+      setEnv('JEST_WORKER_ID', '1')
+
+      expect(getJestWorkerId()).toBe('1')
+      expect(getVitest()).toBe(false)
+      expect(isTest()).toBe(true)
+    })
+
+    it('should detect Vitest test environment', () => {
+      setEnv('NODE_ENV', 'production')
+      setEnv('VITEST', 'true')
+      setEnv('JEST_WORKER_ID', '')
+
+      expect(getJestWorkerId()).toBe('')
+      expect(getVitest()).toBe(true)
+      expect(isTest()).toBe(true)
+    })
+
+    it('should detect NODE_ENV test environment', () => {
+      setEnv('NODE_ENV', 'test')
+      setEnv('VITEST', '')
+      setEnv('JEST_WORKER_ID', '')
+
+      expect(getJestWorkerId()).toBe('')
+      expect(getVitest()).toBe(false)
+      expect(isTest()).toBe(true)
+    })
+
+    it('should detect non-test environment', () => {
+      setEnv('NODE_ENV', 'production')
+      setEnv('VITEST', '')
+      setEnv('JEST_WORKER_ID', '')
+
+      expect(getJestWorkerId()).toBe('')
+      expect(getVitest()).toBe(false)
+      expect(isTest()).toBe(false)
+    })
+  })
+})
diff --git a/test/unit/env/windows.test.ts b/test/unit/env/windows.test.ts
new file mode 100644
index 0000000..4313282
--- /dev/null
+++ b/test/unit/env/windows.test.ts
@@ -0,0 +1,73 @@
+/**
+ * @fileoverview Unit tests for Windows environment variable getters.
+ *
+ * Tests Windows-specific environment variable accessors:
+ * - getUserprofile() - user profile directory (USERPROFILE, Windows equivalent of HOME)
+ * - getAppdata() - application data directory (APPDATA)
+ * - getLocalappdata() - local application data directory (LOCALAPPDATA)
+ * - getComspec() - command interpreter path (COMSPEC, typically cmd.exe)
+ * Uses rewire for test isolation. Critical for Windows path resolution and app storage.
+ */
+
+import {
+  getAppdata,
+  getComspec,
+  getLocalappdata,
+  getUserprofile,
+} from '@socketsecurity/lib/env/windows'
+import { resetEnv, setEnv } from '@socketsecurity/lib/env/rewire'
+import { afterEach, describe, expect, it } from 'vitest'
+
+describe('windows env', () => {
+  afterEach(() => {
+    resetEnv()
+  })
+
+  describe('getAppdata', () => {
+    it('should return APPDATA path when set', () => {
+      setEnv('APPDATA', 'C:\\Users\\TestUser\\AppData\\Roaming')
+      expect(getAppdata()).toBe('C:\\Users\\TestUser\\AppData\\Roaming')
+    })
+
+    it('should return undefined when not set', () => {
+      setEnv('APPDATA', undefined)
+      expect(getAppdata()).toBeUndefined()
+    })
+  })
+
+  describe('getLocalappdata', () => {
+    it('should return LOCALAPPDATA path when set', () => {
+      setEnv('LOCALAPPDATA', 'C:\\Users\\TestUser\\AppData\\Local')
+      expect(getLocalappdata()).toBe('C:\\Users\\TestUser\\AppData\\Local')
+    })
+
+    it('should return undefined when not set', () => {
+      setEnv('LOCALAPPDATA', undefined)
+      expect(getLocalappdata()).toBeUndefined()
+    })
+  })
+
+  describe('getUserprofile', () => {
+    it('should return USERPROFILE path when set', () => {
+      setEnv('USERPROFILE', 'C:\\Users\\TestUser')
+      expect(getUserprofile()).toBe('C:\\Users\\TestUser')
+    })
+
+    it('should return undefined when not set', () => {
+      setEnv('USERPROFILE', undefined)
+      expect(getUserprofile()).toBeUndefined()
+    })
+  })
+
+  describe('getComspec', () => {
+    it('should return COMSPEC path when set', () => {
+      setEnv('COMSPEC', 'C:\\Windows\\System32\\cmd.exe')
+      expect(getComspec()).toBe('C:\\Windows\\System32\\cmd.exe')
+    })
+
+    it('should return undefined when not set', () => {
+      setEnv('COMSPEC', undefined)
+      expect(getComspec()).toBeUndefined()
+    })
+  })
+})
diff --git a/test/unit/env/xdg.test.ts b/test/unit/env/xdg.test.ts
new file mode 100644
index 0000000..76a741e
--- /dev/null
+++ b/test/unit/env/xdg.test.ts
@@ -0,0 +1,271 @@
+/**
+ * @fileoverview Unit tests for XDG Base Directory environment variable getters.
+ *
+ * Tests XDG Base Directory Specification getters (freedesktop.org standard):
+ * - getXdgCacheHome() - cache directory (XDG_CACHE_HOME, default ~/.cache)
+ * - getXdgConfigHome() - config directory (XDG_CONFIG_HOME, default ~/.config)
+ * - getXdgDataHome() - data directory (XDG_DATA_HOME, default ~/.local/share)
+ * Uses rewire for test isolation. Linux/Unix standard for user directory organization.
+ */
+
+import {
+  getXdgCacheHome,
+  getXdgConfigHome,
+  getXdgDataHome,
+} from '@socketsecurity/lib/env/xdg'
+import { clearEnv, resetEnv, setEnv } from '@socketsecurity/lib/env/rewire'
+import { afterEach, describe, expect, it } from 'vitest'
+
+describe('env/xdg', () => {
+  afterEach(() => {
+    resetEnv()
+  })
+
+  describe('getXdgCacheHome', () => {
+    it('should return XDG_CACHE_HOME when set', () => {
+      setEnv('XDG_CACHE_HOME', '/home/user/.cache')
+      expect(getXdgCacheHome()).toBe('/home/user/.cache')
+    })
+
+    it('should return undefined when XDG_CACHE_HOME is not set', () => {
+      clearEnv('XDG_CACHE_HOME')
+      // After clearing override, falls back to actual process.env
+      const result = getXdgCacheHome()
+      expect(typeof result).toMatch(/string|undefined/)
+    })
+
+    it('should handle default cache location', () => {
+      setEnv('XDG_CACHE_HOME', '/home/user/.cache')
+      expect(getXdgCacheHome()).toBe('/home/user/.cache')
+    })
+
+    it('should handle custom cache location', () => {
+      setEnv('XDG_CACHE_HOME', '/custom/cache')
+      expect(getXdgCacheHome()).toBe('/custom/cache')
+    })
+
+    it('should handle cache with trailing slash', () => {
+      setEnv('XDG_CACHE_HOME', '/home/user/.cache/')
+      expect(getXdgCacheHome()).toBe('/home/user/.cache/')
+    })
+
+    it('should handle empty string', () => {
+      setEnv('XDG_CACHE_HOME', '')
+      expect(getXdgCacheHome()).toBe('')
+    })
+
+    it('should handle updating cache home', () => {
+      setEnv('XDG_CACHE_HOME', '/cache1')
+      expect(getXdgCacheHome()).toBe('/cache1')
+
+      setEnv('XDG_CACHE_HOME', '/cache2')
+      expect(getXdgCacheHome()).toBe('/cache2')
+    })
+
+    it('should handle consecutive reads', () => {
+      setEnv('XDG_CACHE_HOME', '/home/user/.cache')
+      expect(getXdgCacheHome()).toBe('/home/user/.cache')
+      expect(getXdgCacheHome()).toBe('/home/user/.cache')
+      expect(getXdgCacheHome()).toBe('/home/user/.cache')
+    })
+
+    it('should handle cache path with spaces', () => {
+      setEnv('XDG_CACHE_HOME', '/home/user/my cache')
+      expect(getXdgCacheHome()).toBe('/home/user/my cache')
+    })
+
+    it('should handle snap cache location', () => {
+      setEnv('XDG_CACHE_HOME', '/home/user/snap/app/current/.cache')
+      expect(getXdgCacheHome()).toBe('/home/user/snap/app/current/.cache')
+    })
+
+    it('should handle flatpak cache location', () => {
+      setEnv('XDG_CACHE_HOME', '/home/user/.var/app/org.app/cache')
+      expect(getXdgCacheHome()).toBe('/home/user/.var/app/org.app/cache')
+    })
+  })
+
+  describe('getXdgConfigHome', () => {
+    it('should return XDG_CONFIG_HOME when set', () => {
+      setEnv('XDG_CONFIG_HOME', '/home/user/.config')
+      expect(getXdgConfigHome()).toBe('/home/user/.config')
+    })
+
+    it('should return undefined when XDG_CONFIG_HOME is not set', () => {
+      clearEnv('XDG_CONFIG_HOME')
+      // After clearing override, falls back to actual process.env
+      const result = getXdgConfigHome()
+      expect(typeof result).toMatch(/string|undefined/)
+    })
+
+    it('should handle default config location', () => {
+      setEnv('XDG_CONFIG_HOME', '/home/user/.config')
+      expect(getXdgConfigHome()).toBe('/home/user/.config')
+    })
+
+    it('should handle custom config location', () => {
+      setEnv('XDG_CONFIG_HOME', '/etc/custom-config')
+      expect(getXdgConfigHome()).toBe('/etc/custom-config')
+    })
+
+    it('should handle config with trailing slash', () => {
+      setEnv('XDG_CONFIG_HOME', '/home/user/.config/')
+      expect(getXdgConfigHome()).toBe('/home/user/.config/')
+    })
+
+    it('should handle empty string', () => {
+      setEnv('XDG_CONFIG_HOME', '')
+      expect(getXdgConfigHome()).toBe('')
+    })
+
+    it('should handle updating config home', () => {
+      setEnv('XDG_CONFIG_HOME', '/config1')
+      expect(getXdgConfigHome()).toBe('/config1')
+
+      setEnv('XDG_CONFIG_HOME', '/config2')
+      expect(getXdgConfigHome()).toBe('/config2')
+    })
+
+    it('should handle consecutive reads', () => {
+      setEnv('XDG_CONFIG_HOME', '/home/user/.config')
+      expect(getXdgConfigHome()).toBe('/home/user/.config')
+      expect(getXdgConfigHome()).toBe('/home/user/.config')
+      expect(getXdgConfigHome()).toBe('/home/user/.config')
+    })
+
+    it('should handle config path with spaces', () => {
+      setEnv('XDG_CONFIG_HOME', '/home/user/my config')
+      expect(getXdgConfigHome()).toBe('/home/user/my config')
+    })
+
+    it('should handle snap config location', () => {
+      setEnv('XDG_CONFIG_HOME', '/home/user/snap/app/current/.config')
+      expect(getXdgConfigHome()).toBe('/home/user/snap/app/current/.config')
+    })
+
+    it('should handle flatpak config location', () => {
+      setEnv('XDG_CONFIG_HOME', '/home/user/.var/app/org.app/config')
+      expect(getXdgConfigHome()).toBe('/home/user/.var/app/org.app/config')
+    })
+
+    it('should handle AppImage config location', () => {
+      setEnv('XDG_CONFIG_HOME', '/tmp/.mount_AppRun123/config')
+      expect(getXdgConfigHome()).toBe('/tmp/.mount_AppRun123/config')
+    })
+  })
+
+  describe('getXdgDataHome', () => {
+    it('should return XDG_DATA_HOME when set', () => {
+      setEnv('XDG_DATA_HOME', '/home/user/.local/share')
+      expect(getXdgDataHome()).toBe('/home/user/.local/share')
+    })
+
+    it('should return undefined when XDG_DATA_HOME is not set', () => {
+      clearEnv('XDG_DATA_HOME')
+      // After clearing override, falls back to actual process.env
+      const result = getXdgDataHome()
+      expect(typeof result).toMatch(/string|undefined/)
+    })
+
+    it('should handle default data location', () => {
+      setEnv('XDG_DATA_HOME', '/home/user/.local/share')
+      expect(getXdgDataHome()).toBe('/home/user/.local/share')
+    })
+
+    it('should handle custom data location', () => {
+      setEnv('XDG_DATA_HOME', '/custom/data')
+      expect(getXdgDataHome()).toBe('/custom/data')
+    })
+
+    it('should handle data with trailing slash', () => {
+      setEnv('XDG_DATA_HOME', '/home/user/.local/share/')
+      expect(getXdgDataHome()).toBe('/home/user/.local/share/')
+    })
+
+    it('should handle empty string', () => {
+      setEnv('XDG_DATA_HOME', '')
+      expect(getXdgDataHome()).toBe('')
+    })
+
+    it('should handle updating data home', () => {
+      setEnv('XDG_DATA_HOME', '/data1')
+      expect(getXdgDataHome()).toBe('/data1')
+
+      setEnv('XDG_DATA_HOME', '/data2')
+      expect(getXdgDataHome()).toBe('/data2')
+    })
+
+    it('should handle consecutive reads', () => {
+      setEnv('XDG_DATA_HOME', '/home/user/.local/share')
+      expect(getXdgDataHome()).toBe('/home/user/.local/share')
+      expect(getXdgDataHome()).toBe('/home/user/.local/share')
+      expect(getXdgDataHome()).toBe('/home/user/.local/share')
+    })
+
+    it('should handle data path with spaces', () => {
+      setEnv('XDG_DATA_HOME', '/home/user/my data')
+      expect(getXdgDataHome()).toBe('/home/user/my data')
+    })
+
+    it('should handle snap data location', () => {
+      setEnv('XDG_DATA_HOME', '/home/user/snap/app/current/.local/share')
+      expect(getXdgDataHome()).toBe('/home/user/snap/app/current/.local/share')
+    })
+
+    it('should handle flatpak data location', () => {
+      setEnv('XDG_DATA_HOME', '/home/user/.var/app/org.app/data')
+      expect(getXdgDataHome()).toBe('/home/user/.var/app/org.app/data')
+    })
+
+    it('should handle Steam data location', () => {
+      setEnv('XDG_DATA_HOME', '/home/user/.steam/debian-installation')
+      expect(getXdgDataHome()).toBe('/home/user/.steam/debian-installation')
+    })
+  })
+
+  describe('XDG directories interaction', () => {
+    it('should handle all XDG dirs set simultaneously', () => {
+      setEnv('XDG_CACHE_HOME', '/home/user/.cache')
+      setEnv('XDG_CONFIG_HOME', '/home/user/.config')
+      setEnv('XDG_DATA_HOME', '/home/user/.local/share')
+
+      expect(getXdgCacheHome()).toBe('/home/user/.cache')
+      expect(getXdgConfigHome()).toBe('/home/user/.config')
+      expect(getXdgDataHome()).toBe('/home/user/.local/share')
+    })
+
+    it('should handle clearing all XDG dirs', () => {
+      setEnv('XDG_CACHE_HOME', '/cache')
+      setEnv('XDG_CONFIG_HOME', '/config')
+      setEnv('XDG_DATA_HOME', '/data')
+
+      clearEnv('XDG_CACHE_HOME')
+      clearEnv('XDG_CONFIG_HOME')
+      clearEnv('XDG_DATA_HOME')
+
+      expect(typeof getXdgCacheHome()).toMatch(/string|undefined/)
+      expect(typeof getXdgConfigHome()).toMatch(/string|undefined/)
+      expect(typeof getXdgDataHome()).toMatch(/string|undefined/)
+    })
+
+    it('should handle XDG dirs with common prefix', () => {
+      setEnv('XDG_CACHE_HOME', '/home/user/.cache')
+      setEnv('XDG_CONFIG_HOME', '/home/user/.config')
+      setEnv('XDG_DATA_HOME', '/home/user/.local/share')
+
+      expect(getXdgCacheHome()).toBe('/home/user/.cache')
+      expect(getXdgConfigHome()).toBe('/home/user/.config')
+      expect(getXdgDataHome()).toBe('/home/user/.local/share')
+    })
+
+    it('should handle XDG dirs with different prefixes', () => {
+      setEnv('XDG_CACHE_HOME', '/var/cache')
+      setEnv('XDG_CONFIG_HOME', '/etc/config')
+      setEnv('XDG_DATA_HOME', '/usr/share')
+
+      expect(getXdgCacheHome()).toBe('/var/cache')
+      expect(getXdgConfigHome()).toBe('/etc/config')
+      expect(getXdgDataHome()).toBe('/usr/share')
+    })
+  })
+})
diff --git a/test/unit/fs-additional.test.ts b/test/unit/fs-additional.test.ts
new file mode 100644
index 0000000..b4456a5
--- /dev/null
+++ b/test/unit/fs-additional.test.ts
@@ -0,0 +1,734 @@
+/**
+ * @fileoverview Additional comprehensive tests for file system utilities to increase coverage.
+ *
+ * Extends fs.test.ts with additional edge cases and coverage scenarios:
+ * - findUp edge cases: onlyFiles/onlyDirectories combinations, deeply nested paths
+ * - Error handling: non-existent paths, permission errors, invalid JSON
+ * - Binary file operations: non-UTF8 content, Buffer handling
+ * - Directory operations: empty directories, nested structures
+ * - Sync vs async consistency: validates both APIs behave identically
+ * - Platform-specific scenarios: Windows vs Unix path handling
+ * - Safe operations: graceful handling of missing files, concurrent access
+ * Uses runWithTempDir for isolated test environments to avoid filesystem pollution.
+ * Complements primary fs.test.ts by focusing on uncommon code paths and error conditions.
+ */
+
+import { promises as fs } from 'node:fs'
+import os from 'node:os'
+import path from 'node:path'
+import {
+  findUp,
+  findUpSync,
+  isDir,
+  isDirEmptySync,
+  isDirSync,
+  readDirNames,
+  readDirNamesSync,
+  readFileBinary,
+  readFileBinarySync,
+  readFileUtf8,
+  readFileUtf8Sync,
+  readJson,
+  readJsonSync,
+  safeDelete,
+  safeDeleteSync,
+  safeReadFile,
+  safeReadFileSync,
+  safeStats,
+  safeStatsSync,
+  uniqueSync,
+  writeJson,
+  writeJsonSync,
+} from '@socketsecurity/lib/fs'
+import { describe, expect, it } from 'vitest'
+import { runWithTempDir } from './utils/temp-file-helper.mjs'
+
+describe('fs - Additional Coverage', () => {
+  describe('findUp edge cases', () => {
+    it('should find both files and directories when both onlyFiles and onlyDirectories are false', async () => {
+      await runWithTempDir(async tmpDir => {
+        const testDir = path.join(tmpDir, 'target-dir')
+        await fs.mkdir(testDir)
+
+        const result = await findUp('target-dir', {
+          cwd: tmpDir,
+          onlyFiles: false,
+          onlyDirectories: false,
+        })
+        expect(result).toBeDefined()
+        expect(result).toContain('target-dir')
+      }, 'findUp-both-types-')
+    })
+
+    it('should handle abort signal during loop', async () => {
+      const controller = new AbortController()
+
+      // Create a promise that aborts after a short delay
+      const result = await new Promise<string | undefined>(resolve => {
+        setTimeout(() => {
+          controller.abort()
+        }, 10)
+
+        findUp('nonexistent-file-that-will-trigger-loop', {
+          cwd: process.cwd(),
+          signal: controller.signal,
+        }).then(resolve)
+      })
+
+      expect(result).toBeUndefined()
+    })
+
+    it('should prioritize onlyDirectories over onlyFiles', async () => {
+      await runWithTempDir(async tmpDir => {
+        const testFile = path.join(tmpDir, 'file.txt')
+        await fs.writeFile(testFile, '', 'utf8')
+
+        const result = await findUp('file.txt', {
+          cwd: tmpDir,
+          onlyDirectories: true,
+          onlyFiles: true,
+        })
+        expect(result).toBeUndefined()
+      }, 'findUp-priority-')
+    })
+  })
+
+  describe('findUpSync edge cases', () => {
+    it('should find both files and directories when both onlyFiles and onlyDirectories are false', async () => {
+      await runWithTempDir(async tmpDir => {
+        const testFile = path.join(tmpDir, 'target-file')
+        await fs.writeFile(testFile, '', 'utf8')
+
+        const result = findUpSync('target-file', {
+          cwd: tmpDir,
+          onlyFiles: false,
+          onlyDirectories: false,
+        })
+        expect(result).toBeDefined()
+        expect(result).toContain('target-file')
+      }, 'findUpSync-both-types-')
+    })
+
+    it('should not find files when onlyDirectories is true', async () => {
+      await runWithTempDir(async tmpDir => {
+        const testFile = path.join(tmpDir, 'just-a-file.txt')
+        await fs.writeFile(testFile, '', 'utf8')
+
+        const result = findUpSync('just-a-file.txt', {
+          cwd: tmpDir,
+          onlyDirectories: true,
+        })
+        expect(result).toBeUndefined()
+      }, 'findUpSync-only-dirs-no-file-')
+    })
+
+    it('should prioritize onlyDirectories over onlyFiles', async () => {
+      await runWithTempDir(async tmpDir => {
+        const testFile = path.join(tmpDir, 'file.txt')
+        await fs.writeFile(testFile, '', 'utf8')
+
+        const result = findUpSync('file.txt', {
+          cwd: tmpDir,
+          onlyDirectories: true,
+          onlyFiles: true,
+        })
+        expect(result).toBeUndefined()
+      }, 'findUpSync-priority-')
+    })
+  })
+
+  describe('readFileBinary with options', () => {
+    it('should handle string options parameter', async () => {
+      await runWithTempDir(async tmpDir => {
+        const testFile = path.join(tmpDir, 'binary.dat')
+        const testData = Buffer.from([0xff, 0xfe, 0xfd])
+        await fs.writeFile(testFile, testData)
+
+        const result = await readFileBinary(testFile, 'binary')
+        expect(Buffer.isBuffer(result)).toBe(true)
+        expect(result).toEqual(testData)
+      }, 'readFileBinary-string-opts-')
+    })
+
+    it('should handle object options with encoding', async () => {
+      await runWithTempDir(async tmpDir => {
+        const testFile = path.join(tmpDir, 'data.bin')
+        const testData = Buffer.from([0x01, 0x02, 0x03])
+        await fs.writeFile(testFile, testData)
+
+        const result = await readFileBinary(testFile, { encoding: 'utf8' })
+        expect(Buffer.isBuffer(result)).toBe(true)
+      }, 'readFileBinary-obj-opts-')
+    })
+  })
+
+  describe('readFileBinarySync with options', () => {
+    it('should handle string options parameter', async () => {
+      await runWithTempDir(async tmpDir => {
+        const testFile = path.join(tmpDir, 'binary.dat')
+        const testData = Buffer.from([0xff, 0xfe, 0xfd])
+        await fs.writeFile(testFile, testData)
+
+        const result = readFileBinarySync(testFile, 'binary')
+        expect(Buffer.isBuffer(result)).toBe(true)
+        expect(result).toEqual(testData)
+      }, 'readFileBinarySync-string-opts-')
+    })
+
+    it('should handle object options with encoding', async () => {
+      await runWithTempDir(async tmpDir => {
+        const testFile = path.join(tmpDir, 'data.bin')
+        const testData = Buffer.from([0x01, 0x02, 0x03])
+        await fs.writeFile(testFile, testData)
+
+        const result = readFileBinarySync(testFile, { encoding: 'utf8' })
+        expect(Buffer.isBuffer(result)).toBe(true)
+      }, 'readFileBinarySync-obj-opts-')
+    })
+  })
+
+  describe('readFileUtf8 with options', () => {
+    it('should handle string options parameter', async () => {
+      await runWithTempDir(async tmpDir => {
+        const testFile = path.join(tmpDir, 'text.txt')
+        await fs.writeFile(testFile, 'content', 'utf8')
+
+        const result = await readFileUtf8(testFile, 'utf8')
+        expect(result).toBe('content')
+      }, 'readFileUtf8-string-opts-')
+    })
+
+    it('should handle object options', async () => {
+      await runWithTempDir(async tmpDir => {
+        const testFile = path.join(tmpDir, 'text.txt')
+        await fs.writeFile(testFile, 'content', 'utf8')
+
+        const result = await readFileUtf8(testFile, { encoding: 'utf8' })
+        expect(result).toBe('content')
+      }, 'readFileUtf8-obj-opts-')
+    })
+  })
+
+  describe('readFileUtf8Sync with options', () => {
+    it('should handle string options parameter', async () => {
+      await runWithTempDir(async tmpDir => {
+        const testFile = path.join(tmpDir, 'text.txt')
+        await fs.writeFile(testFile, 'content', 'utf8')
+
+        const result = readFileUtf8Sync(testFile, 'utf8')
+        expect(result).toBe('content')
+      }, 'readFileUtf8Sync-string-opts-')
+    })
+
+    it('should handle object options', async () => {
+      await runWithTempDir(async tmpDir => {
+        const testFile = path.join(tmpDir, 'text.txt')
+        await fs.writeFile(testFile, 'content', 'utf8')
+
+        const result = readFileUtf8Sync(testFile, { encoding: 'utf8' })
+        expect(result).toBe('content')
+      }, 'readFileUtf8Sync-obj-opts-')
+    })
+  })
+
+  describe('readJson with string options', () => {
+    it('should handle string encoding option', async () => {
+      await runWithTempDir(async tmpDir => {
+        const testFile = path.join(tmpDir, 'data.json')
+        const testData = { foo: 'bar' }
+        await fs.writeFile(testFile, JSON.stringify(testData), 'utf8')
+
+        const result = await readJson(testFile, 'utf8')
+        expect(result).toEqual(testData)
+      }, 'readJson-string-encoding-')
+    })
+  })
+
+  describe('readJsonSync with string options', () => {
+    it('should handle string encoding option', async () => {
+      await runWithTempDir(async tmpDir => {
+        const testFile = path.join(tmpDir, 'data.json')
+        const testData = { foo: 'bar' }
+        await fs.writeFile(testFile, JSON.stringify(testData), 'utf8')
+
+        const result = readJsonSync(testFile, 'utf8')
+        expect(result).toEqual(testData)
+      }, 'readJsonSync-string-encoding-')
+    })
+
+    it('should use custom reviver function', async () => {
+      await runWithTempDir(async tmpDir => {
+        const testFile = path.join(tmpDir, 'data.json')
+        const testData = { timestamp: '2024-01-01T00:00:00.000Z' }
+        await fs.writeFile(testFile, JSON.stringify(testData), 'utf8')
+
+        const result = readJsonSync(testFile, {
+          reviver: (key, value) => {
+            if (key === 'timestamp' && typeof value === 'string') {
+              return new Date(value)
+            }
+            return value
+          },
+        }) as unknown as { timestamp: Date }
+
+        expect(result.timestamp).toBeInstanceOf(Date)
+      }, 'readJsonSync-reviver-')
+    })
+  })
+
+  describe('writeJson with additional options', () => {
+    it('should handle string encoding option', async () => {
+      await runWithTempDir(async tmpDir => {
+        const testFile = path.join(tmpDir, 'data.json')
+        const testData = { test: 'value' }
+
+        await writeJson(testFile, testData, 'utf8')
+
+        const content = await fs.readFile(testFile, 'utf8')
+        const parsed = JSON.parse(content)
+        expect(parsed).toEqual(testData)
+      }, 'writeJson-string-encoding-')
+    })
+
+    it('should use tabs for indentation', async () => {
+      await runWithTempDir(async tmpDir => {
+        const testFile = path.join(tmpDir, 'tabs.json')
+        const testData = { nested: { value: 'test' } }
+
+        await writeJson(testFile, testData, { spaces: '\t' })
+
+        const content = await fs.readFile(testFile, 'utf8')
+        expect(content).toContain('\t')
+      }, 'writeJson-tabs-')
+    })
+
+    it('should compact JSON with spaces: 0', async () => {
+      await runWithTempDir(async tmpDir => {
+        const testFile = path.join(tmpDir, 'compact.json')
+        const testData = { a: 1, b: 2 }
+
+        await writeJson(testFile, testData, { spaces: 0 })
+
+        const content = await fs.readFile(testFile, 'utf8')
+        expect(content).toContain('{"a":1,"b":2}')
+      }, 'writeJson-compact-')
+    })
+  })
+
+  describe('writeJsonSync with additional options', () => {
+    it('should use string encoding option', async () => {
+      await runWithTempDir(async tmpDir => {
+        const testFile = path.join(tmpDir, 'encoding.json')
+        const testData = { test: 'data' }
+
+        writeJsonSync(testFile, testData, 'utf8')
+
+        const content = await fs.readFile(testFile, 'utf8')
+        const parsed = JSON.parse(content)
+        expect(parsed).toEqual(testData)
+      }, 'writeJsonSync-string-encoding-')
+    })
+
+    it('should use tabs for indentation', async () => {
+      await runWithTempDir(async tmpDir => {
+        const testFile = path.join(tmpDir, 'tabs.json')
+        const testData = { foo: 'bar' }
+
+        writeJsonSync(testFile, testData, { spaces: '\t' })
+
+        const content = await fs.readFile(testFile, 'utf8')
+        expect(content).toContain('\t')
+      }, 'writeJsonSync-tabs-')
+    })
+
+    it('should compact JSON with spaces: 0', async () => {
+      await runWithTempDir(async tmpDir => {
+        const testFile = path.join(tmpDir, 'compact.json')
+        const testData = { foo: 'bar', baz: 'qux' }
+
+        writeJsonSync(testFile, testData, { spaces: 0 })
+
+        const content = await fs.readFile(testFile, 'utf8')
+        expect(content).not.toContain('  ')
+        expect(content).toContain('{"foo":"bar","baz":"qux"}')
+      }, 'writeJsonSync-compact-')
+    })
+
+    it('should use custom EOL', async () => {
+      await runWithTempDir(async tmpDir => {
+        const testFile = path.join(tmpDir, 'custom-eol.json')
+        const testData = { foo: 'bar' }
+
+        writeJsonSync(testFile, testData, { EOL: '\r\n' })
+
+        const content = await fs.readFile(testFile, 'utf8')
+        expect(content).toContain('\r\n')
+      }, 'writeJsonSync-custom-eol-')
+    })
+
+    it('should use replacer function', async () => {
+      await runWithTempDir(async tmpDir => {
+        const testFile = path.join(tmpDir, 'replacer.json')
+        const testData = { keep: 'this', remove: 'that' }
+
+        writeJsonSync(testFile, testData, {
+          replacer: (key, value) => {
+            if (key === 'remove') {
+              return undefined
+            }
+            return value
+          },
+        })
+
+        const content = await fs.readFile(testFile, 'utf8')
+        const parsed = JSON.parse(content)
+        expect(parsed.keep).toBe('this')
+        expect(parsed.remove).toBeUndefined()
+      }, 'writeJsonSync-replacer-')
+    })
+  })
+
+  describe('safeReadFile with string encoding', () => {
+    it('should handle string encoding option', async () => {
+      await runWithTempDir(async tmpDir => {
+        const testFile = path.join(tmpDir, 'test.txt')
+        await fs.writeFile(testFile, 'content', 'utf8')
+
+        const result = await safeReadFile(testFile, { encoding: 'utf8' })
+        expect(result).toBe('content')
+      }, 'safeReadFile-string-encoding-')
+    })
+  })
+
+  describe('safeReadFileSync with string encoding', () => {
+    it('should handle string encoding option', async () => {
+      await runWithTempDir(async tmpDir => {
+        const testFile = path.join(tmpDir, 'test.txt')
+        await fs.writeFile(testFile, 'content', 'utf8')
+
+        const result = safeReadFileSync(testFile, { encoding: 'utf8' })
+        expect(result).toBe('content')
+      }, 'safeReadFileSync-string-encoding-')
+    })
+  })
+
+  describe('safeStatsSync with string options', () => {
+    it('should handle string encoding option', async () => {
+      await runWithTempDir(async tmpDir => {
+        const testFile = path.join(tmpDir, 'test.txt')
+        await fs.writeFile(testFile, '', 'utf8')
+
+        const result = safeStatsSync(testFile, 'utf8')
+        expect(result).toBeDefined()
+        expect(result?.isFile()).toBe(true)
+      }, 'safeStatsSync-string-encoding-')
+    })
+
+    it('should handle object options', async () => {
+      await runWithTempDir(async tmpDir => {
+        const testFile = path.join(tmpDir, 'test.txt')
+        await fs.writeFile(testFile, '', 'utf8')
+
+        const result = safeStatsSync(testFile, { encoding: 'utf8' })
+        expect(result).toBeDefined()
+        expect(result?.isFile()).toBe(true)
+      }, 'safeStatsSync-obj-opts-')
+    })
+  })
+
+  describe('readDirNames with more options', () => {
+    it('should handle sort: false', async () => {
+      await runWithTempDir(async tmpDir => {
+        await fs.mkdir(path.join(tmpDir, 'b-dir'))
+        await fs.mkdir(path.join(tmpDir, 'a-dir'))
+
+        const result = await readDirNames(tmpDir, { sort: false })
+        expect(result.length).toBe(2)
+        expect(result).toContain('a-dir')
+        expect(result).toContain('b-dir')
+      }, 'readDirNames-no-sort-')
+    })
+
+    it('should handle includeEmpty: true explicitly', async () => {
+      await runWithTempDir(async tmpDir => {
+        await fs.mkdir(path.join(tmpDir, 'empty-dir'))
+        await fs.mkdir(path.join(tmpDir, 'non-empty-dir'))
+        await fs.writeFile(
+          path.join(tmpDir, 'non-empty-dir', 'file.txt'),
+          '',
+          'utf8',
+        )
+
+        const result = await readDirNames(tmpDir, { includeEmpty: true })
+        expect(result).toEqual(['empty-dir', 'non-empty-dir'])
+      }, 'readDirNames-include-empty-')
+    })
+  })
+
+  describe('readDirNamesSync with more options', () => {
+    it('should handle sort: false', async () => {
+      await runWithTempDir(async tmpDir => {
+        await fs.mkdir(path.join(tmpDir, 'z-dir'))
+        await fs.mkdir(path.join(tmpDir, 'a-dir'))
+
+        const result = readDirNamesSync(tmpDir, { sort: false })
+        expect(result.length).toBe(2)
+        expect(result).toContain('a-dir')
+        expect(result).toContain('z-dir')
+      }, 'readDirNamesSync-no-sort-')
+    })
+
+    it('should handle includeEmpty: false', async () => {
+      await runWithTempDir(async tmpDir => {
+        await fs.mkdir(path.join(tmpDir, 'empty'))
+        await fs.mkdir(path.join(tmpDir, 'non-empty'))
+        await fs.writeFile(path.join(tmpDir, 'non-empty', 'f.txt'), '', 'utf8')
+
+        const result = readDirNamesSync(tmpDir, { includeEmpty: false })
+        expect(result).toEqual(['non-empty'])
+      }, 'readDirNamesSync-no-empty-')
+    })
+
+    it('should handle includeEmpty: true explicitly', async () => {
+      await runWithTempDir(async tmpDir => {
+        await fs.mkdir(path.join(tmpDir, 'empty'))
+
+        const result = readDirNamesSync(tmpDir, { includeEmpty: true })
+        expect(result).toEqual(['empty'])
+      }, 'readDirNamesSync-include-empty-')
+    })
+  })
+
+  describe('isDirEmptySync with more ignore patterns', () => {
+    it('should return true when all files are ignored', async () => {
+      await runWithTempDir(async tmpDir => {
+        await fs.writeFile(path.join(tmpDir, '.DS_Store'), '', 'utf8')
+        await fs.writeFile(path.join(tmpDir, 'Thumbs.db'), '', 'utf8')
+
+        const result = isDirEmptySync(tmpDir, {
+          ignore: ['**/.DS_Store', '**/Thumbs.db'],
+        })
+        expect(result).toBe(true)
+      }, 'isDirEmpty-all-ignored-')
+    })
+
+    it('should return true for empty directory with custom ignore', async () => {
+      await runWithTempDir(async tmpDir => {
+        const emptyDir = path.join(tmpDir, 'empty')
+        await fs.mkdir(emptyDir)
+
+        const result = isDirEmptySync(emptyDir, { ignore: ['*.log'] })
+        expect(result).toBe(true)
+      }, 'isDirEmpty-custom-ignore-')
+    })
+
+    it('should handle partially ignored files', async () => {
+      await runWithTempDir(async tmpDir => {
+        await fs.writeFile(path.join(tmpDir, 'keep.txt'), '', 'utf8')
+        await fs.writeFile(path.join(tmpDir, 'ignore.log'), '', 'utf8')
+
+        const result = isDirEmptySync(tmpDir, { ignore: ['*.log'] })
+        expect(result).toBe(false)
+      }, 'isDirEmpty-partial-ignore-')
+    })
+  })
+
+  describe('safeDelete in allowed directories', () => {
+    it('should delete files in temp directory without force', async () => {
+      const tmpDir = os.tmpdir()
+      const testFile = path.join(tmpDir, `test-safe-delete-${Date.now()}.txt`)
+
+      try {
+        await fs.writeFile(testFile, 'test', 'utf8')
+        await safeDelete(testFile, { force: false })
+
+        const exists = await fs
+          .access(testFile)
+          .then(() => true)
+          .catch(() => false)
+        expect(exists).toBe(false)
+      } catch (e) {
+        // Clean up if test fails
+        try {
+          await fs.unlink(testFile)
+        } catch {}
+        throw e
+      }
+    })
+
+    it('should handle array of paths in temp directory', async () => {
+      const tmpDir = os.tmpdir()
+      const file1 = path.join(tmpDir, `test-1-${Date.now()}.txt`)
+      const file2 = path.join(tmpDir, `test-2-${Date.now()}.txt`)
+
+      try {
+        await fs.writeFile(file1, 'test1', 'utf8')
+        await fs.writeFile(file2, 'test2', 'utf8')
+
+        await safeDelete([file1, file2], { force: false })
+
+        const exists1 = await fs
+          .access(file1)
+          .then(() => true)
+          .catch(() => false)
+        const exists2 = await fs
+          .access(file2)
+          .then(() => true)
+          .catch(() => false)
+
+        expect(exists1).toBe(false)
+        expect(exists2).toBe(false)
+      } catch (e) {
+        // Clean up if test fails
+        try {
+          await fs.unlink(file1)
+        } catch {}
+        try {
+          await fs.unlink(file2)
+        } catch {}
+        throw e
+      }
+    })
+
+    it('should use force: true by default for temp directory', async () => {
+      const tmpDir = os.tmpdir()
+      const testFile = path.join(tmpDir, `test-default-${Date.now()}.txt`)
+
+      try {
+        await fs.writeFile(testFile, 'test', 'utf8')
+        await safeDelete(testFile)
+
+        const exists = await fs
+          .access(testFile)
+          .then(() => true)
+          .catch(() => false)
+        expect(exists).toBe(false)
+      } catch (e) {
+        try {
+          await fs.unlink(testFile)
+        } catch {}
+        throw e
+      }
+    })
+  })
+
+  describe('safeDeleteSync in allowed directories', () => {
+    it('should delete files in temp directory without force', async () => {
+      const tmpDir = os.tmpdir()
+      const testFile = path.join(tmpDir, `test-sync-${Date.now()}.txt`)
+
+      try {
+        await fs.writeFile(testFile, 'test', 'utf8')
+        safeDeleteSync(testFile, { force: false })
+
+        const exists = await fs
+          .access(testFile)
+          .then(() => true)
+          .catch(() => false)
+        expect(exists).toBe(false)
+      } catch (e) {
+        try {
+          await fs.unlink(testFile)
+        } catch {}
+        throw e
+      }
+    })
+
+    it('should handle array of paths', async () => {
+      const tmpDir = os.tmpdir()
+      const file1 = path.join(tmpDir, `sync-1-${Date.now()}.txt`)
+      const file2 = path.join(tmpDir, `sync-2-${Date.now()}.txt`)
+
+      try {
+        await fs.writeFile(file1, 'test1', 'utf8')
+        await fs.writeFile(file2, 'test2', 'utf8')
+
+        safeDeleteSync([file1, file2])
+
+        const exists1 = await fs
+          .access(file1)
+          .then(() => true)
+          .catch(() => false)
+        const exists2 = await fs
+          .access(file2)
+          .then(() => true)
+          .catch(() => false)
+
+        expect(exists1).toBe(false)
+        expect(exists2).toBe(false)
+      } catch (e) {
+        try {
+          await fs.unlink(file1)
+        } catch {}
+        try {
+          await fs.unlink(file2)
+        } catch {}
+        throw e
+      }
+    })
+  })
+
+  describe('uniqueSync edge cases', () => {
+    it('should handle paths with multiple dots', async () => {
+      await runWithTempDir(async tmpDir => {
+        const testFile = path.join(tmpDir, 'file.test.json')
+        await fs.writeFile(testFile, '', 'utf8')
+
+        const result = uniqueSync(testFile)
+        expect(result).toContain('file.test-1.json')
+      }, 'uniqueSync-multiple-dots-')
+    })
+
+    it('should handle directory paths', async () => {
+      await runWithTempDir(async tmpDir => {
+        const testDir = path.join(tmpDir, 'existing-dir')
+        await fs.mkdir(testDir)
+
+        const result = uniqueSync(testDir)
+        expect(result).toContain('existing-dir-1')
+      }, 'uniqueSync-directory-')
+    })
+  })
+
+  describe('Path-like inputs', () => {
+    it('isDirSync should handle Buffer paths', async () => {
+      await runWithTempDir(async tmpDir => {
+        const bufferPath = Buffer.from(tmpDir)
+        const result = isDirSync(bufferPath)
+        expect(result).toBe(true)
+      }, 'isDirSync-buffer-')
+    })
+
+    it('isDir should handle Buffer paths', async () => {
+      await runWithTempDir(async tmpDir => {
+        const bufferPath = Buffer.from(tmpDir)
+        const result = await isDir(bufferPath)
+        expect(result).toBe(true)
+      }, 'isDir-buffer-')
+    })
+
+    it('safeStats should handle Buffer paths', async () => {
+      await runWithTempDir(async tmpDir => {
+        const testFile = path.join(tmpDir, 'test.txt')
+        await fs.writeFile(testFile, '', 'utf8')
+        const bufferPath = Buffer.from(testFile)
+
+        const result = await safeStats(bufferPath)
+        expect(result).toBeDefined()
+        expect(result?.isFile()).toBe(true)
+      }, 'safeStats-buffer-')
+    })
+
+    it('safeStatsSync should handle Buffer paths', async () => {
+      await runWithTempDir(async tmpDir => {
+        const testFile = path.join(tmpDir, 'test.txt')
+        await fs.writeFile(testFile, '', 'utf8')
+        const bufferPath = Buffer.from(testFile)
+
+        const result = safeStatsSync(bufferPath)
+        expect(result).toBeDefined()
+        expect(result?.isFile()).toBe(true)
+      }, 'safeStatsSync-buffer-')
+    })
+  })
+})
diff --git a/test/unit/fs.test.ts b/test/unit/fs.test.ts
new file mode 100644
index 0000000..0df0d7d
--- /dev/null
+++ b/test/unit/fs.test.ts
@@ -0,0 +1,1451 @@
+/**
+ * @fileoverview Unit tests for file system utility functions.
+ *
+ * Tests comprehensive file system operations with both async and sync variants:
+ * - File search: findUp(), findUpSync() for locating files up directory tree
+ * - Directory operations: isDir(), isDirSync(), isDirEmptySync(), safeMkdir/Sync()
+ * - File reading: readFileUtf8/Sync(), readFileBinary/Sync(), safeReadFile/Sync()
+ * - JSON operations: readJson/Sync(), writeJson/Sync() with proper encoding
+ * - Directory listing: readDirNames/Sync() for directory contents
+ * - Safe operations: safeStats/Sync(), safeDelete/Sync() with error handling
+ * - Utilities: isSymLinkSync(), uniqueSync(), validateFiles()
+ * Tests use temporary directories (runWithTempDir) for isolated filesystem operations.
+ * Validates cross-platform behavior, error handling, and edge cases (missing files, permissions).
+ */
+
+import { promises as fs } from 'node:fs'
+import path from 'node:path'
+import {
+  findUp,
+  findUpSync,
+  isDir,
+  isDirEmptySync,
+  isDirSync,
+  isSymLinkSync,
+  readDirNames,
+  readDirNamesSync,
+  readFileBinary,
+  readFileBinarySync,
+  readFileUtf8,
+  readFileUtf8Sync,
+  readJson,
+  readJsonSync,
+  safeDelete,
+  safeDeleteSync,
+  safeMkdir,
+  safeMkdirSync,
+  safeReadFile,
+  safeReadFileSync,
+  safeStats,
+  safeStatsSync,
+  uniqueSync,
+  validateFiles,
+  writeJson,
+  writeJsonSync,
+} from '@socketsecurity/lib/fs'
+import { describe, expect, it } from 'vitest'
+import { runWithTempDir } from './utils/temp-file-helper.mjs'
+
+describe('fs', () => {
+  describe('findUp', () => {
+    it('should find file in current directory', async () => {
+      await runWithTempDir(async tmpDir => {
+        const testFile = path.join(tmpDir, 'package.json')
+        await fs.writeFile(testFile, '{}', 'utf8')
+
+        const result = await findUp('package.json', { cwd: tmpDir })
+        expect(result).toBeDefined()
+        expect(result).toContain('package.json')
+      }, 'findUp-current-')
+    })
+
+    it('should find file in parent directory', async () => {
+      await runWithTempDir(async tmpDir => {
+        const testFile = path.join(tmpDir, 'config.json')
+        await fs.writeFile(testFile, '{}', 'utf8')
+
+        const subDir = path.join(tmpDir, 'sub', 'nested')
+        await fs.mkdir(subDir, { recursive: true })
+
+        const result = await findUp('config.json', { cwd: subDir })
+        expect(result).toBeDefined()
+        expect(result).toContain('config.json')
+      }, 'findUp-parent-')
+    })
+
+    it('should find directory when onlyDirectories is true', async () => {
+      await runWithTempDir(async tmpDir => {
+        const testDir = path.join(tmpDir, 'node_modules')
+        await fs.mkdir(testDir, { recursive: true })
+
+        const result = await findUp('node_modules', {
+          cwd: tmpDir,
+          onlyDirectories: true,
+        })
+        expect(result).toBeDefined()
+        expect(result).toContain('node_modules')
+      }, 'findUp-dir-')
+    })
+
+    it('should return undefined when file not found', async () => {
+      await runWithTempDir(async tmpDir => {
+        const result = await findUp('nonexistent.txt', { cwd: tmpDir })
+        expect(result).toBeUndefined()
+      }, 'findUp-notfound-')
+    })
+
+    it('should find first match when given array of names', async () => {
+      await runWithTempDir(async tmpDir => {
+        const testFile = path.join(tmpDir, 'config.yaml')
+        await fs.writeFile(testFile, '', 'utf8')
+
+        const result = await findUp(
+          ['config.json', 'config.yaml', 'config.yml'],
+          {
+            cwd: tmpDir,
+          },
+        )
+        expect(result).toBeDefined()
+        expect(result).toContain('config.yaml')
+      }, 'findUp-array-')
+    })
+
+    it('should respect abort signal', async () => {
+      const controller = new AbortController()
+      controller.abort()
+
+      const result = await findUp('package.json', {
+        cwd: process.cwd(),
+        signal: controller.signal,
+      })
+      expect(result).toBeUndefined()
+    })
+
+    it('should not find files when onlyDirectories is true', async () => {
+      await runWithTempDir(async tmpDir => {
+        const testFile = path.join(tmpDir, 'file.txt')
+        await fs.writeFile(testFile, '', 'utf8')
+
+        const result = await findUp('file.txt', {
+          cwd: tmpDir,
+          onlyDirectories: true,
+        })
+        expect(result).toBeUndefined()
+      }, 'findUp-only-dirs-')
+    })
+  })
+
+  describe('findUpSync', () => {
+    it('should find file in current directory', async () => {
+      await runWithTempDir(async tmpDir => {
+        const testFile = path.join(tmpDir, 'package.json')
+        await fs.writeFile(testFile, '{}', 'utf8')
+
+        const result = findUpSync('package.json', { cwd: tmpDir })
+        expect(result).toBeDefined()
+        expect(result).toContain('package.json')
+      }, 'findUpSync-current-')
+    })
+
+    it('should find file in parent directory', async () => {
+      await runWithTempDir(async tmpDir => {
+        const testFile = path.join(tmpDir, 'config.json')
+        await fs.writeFile(testFile, '{}', 'utf8')
+
+        const subDir = path.join(tmpDir, 'sub', 'nested')
+        await fs.mkdir(subDir, { recursive: true })
+
+        const result = findUpSync('config.json', { cwd: subDir })
+        expect(result).toBeDefined()
+        expect(result).toContain('config.json')
+      }, 'findUpSync-parent-')
+    })
+
+    it('should find directory when onlyDirectories is true', async () => {
+      await runWithTempDir(async tmpDir => {
+        const testDir = path.join(tmpDir, 'node_modules')
+        await fs.mkdir(testDir, { recursive: true })
+
+        const result = findUpSync('node_modules', {
+          cwd: tmpDir,
+          onlyDirectories: true,
+        })
+        expect(result).toBeDefined()
+        expect(result).toContain('node_modules')
+      }, 'findUpSync-dir-')
+    })
+
+    it('should return undefined when file not found', async () => {
+      await runWithTempDir(async tmpDir => {
+        const result = findUpSync('nonexistent.txt', { cwd: tmpDir })
+        expect(result).toBeUndefined()
+      }, 'findUpSync-notfound-')
+    })
+
+    it('should find first match when given array of names', async () => {
+      await runWithTempDir(async tmpDir => {
+        const testFile = path.join(tmpDir, 'config.yaml')
+        await fs.writeFile(testFile, '', 'utf8')
+
+        const result = findUpSync(
+          ['config.json', 'config.yaml', 'config.yml'],
+          {
+            cwd: tmpDir,
+          },
+        )
+        expect(result).toBeDefined()
+        expect(result).toContain('config.yaml')
+      }, 'findUpSync-array-')
+    })
+
+    it('should stop at stopAt directory', async () => {
+      await runWithTempDir(async tmpDir => {
+        const configFile = path.join(tmpDir, 'config.json')
+        await fs.writeFile(configFile, '{}', 'utf8')
+
+        const subDir = path.join(tmpDir, 'sub', 'nested')
+        await fs.mkdir(subDir, { recursive: true })
+
+        const midDir = path.join(tmpDir, 'sub')
+        const result = findUpSync('config.json', {
+          cwd: subDir,
+          stopAt: midDir,
+        })
+        expect(result).toBeUndefined()
+      }, 'findUpSync-stopAt-')
+    })
+
+    it('should check stopAt directory itself', async () => {
+      await runWithTempDir(async tmpDir => {
+        const subDir = path.join(tmpDir, 'sub')
+        await fs.mkdir(subDir, { recursive: true })
+
+        const configFile = path.join(subDir, 'config.json')
+        await fs.writeFile(configFile, '{}', 'utf8')
+
+        const nestedDir = path.join(subDir, 'nested')
+        await fs.mkdir(nestedDir, { recursive: true })
+
+        const result = findUpSync('config.json', {
+          cwd: nestedDir,
+          stopAt: subDir,
+        })
+        expect(result).toBeDefined()
+        expect(result).toContain('config.json')
+      }, 'findUpSync-stopAt-check-')
+    })
+  })
+
+  describe('isDir', () => {
+    it('should return true for directories', async () => {
+      await runWithTempDir(async tmpDir => {
+        const result = await isDir(tmpDir)
+        expect(result).toBe(true)
+      }, 'isDir-true-')
+    })
+
+    it('should return false for files', async () => {
+      await runWithTempDir(async tmpDir => {
+        const testFile = path.join(tmpDir, 'file.txt')
+        await fs.writeFile(testFile, '', 'utf8')
+
+        const result = await isDir(testFile)
+        expect(result).toBe(false)
+      }, 'isDir-false-file-')
+    })
+
+    it('should return false for non-existent paths', async () => {
+      const result = await isDir('/nonexistent/path')
+      expect(result).toBe(false)
+    })
+  })
+
+  describe('isDirSync', () => {
+    it('should return true for directories', async () => {
+      await runWithTempDir(async tmpDir => {
+        const result = isDirSync(tmpDir)
+        expect(result).toBe(true)
+      }, 'isDirSync-true-')
+    })
+
+    it('should return false for files', async () => {
+      await runWithTempDir(async tmpDir => {
+        const testFile = path.join(tmpDir, 'file.txt')
+        await fs.writeFile(testFile, '', 'utf8')
+
+        const result = isDirSync(testFile)
+        expect(result).toBe(false)
+      }, 'isDirSync-false-file-')
+    })
+
+    it('should return false for non-existent paths', () => {
+      const result = isDirSync('/nonexistent/path')
+      expect(result).toBe(false)
+    })
+  })
+
+  describe('isDirEmptySync', () => {
+    it('should return true for empty directories', async () => {
+      await runWithTempDir(async tmpDir => {
+        const emptyDir = path.join(tmpDir, 'empty')
+        await fs.mkdir(emptyDir)
+
+        const result = isDirEmptySync(emptyDir)
+        expect(result).toBe(true)
+      }, 'isDirEmpty-true-')
+    })
+
+    it('should return false for directories with files', async () => {
+      await runWithTempDir(async tmpDir => {
+        const testFile = path.join(tmpDir, 'file.txt')
+        await fs.writeFile(testFile, '', 'utf8')
+
+        const result = isDirEmptySync(tmpDir)
+        expect(result).toBe(false)
+      }, 'isDirEmpty-false-')
+    })
+
+    it('should return false for non-existent directories', () => {
+      const result = isDirEmptySync('/nonexistent/path')
+      expect(result).toBe(false)
+    })
+
+    it('should ignore files matching ignore patterns', async () => {
+      await runWithTempDir(async tmpDir => {
+        const gitDir = path.join(tmpDir, '.git')
+        await fs.mkdir(gitDir)
+        const gitSubDir = path.join(gitDir, 'objects')
+        await fs.mkdir(gitSubDir)
+
+        const result = isDirEmptySync(tmpDir, {
+          ignore: ['.git'],
+        })
+        expect(result).toBe(true)
+      }, 'isDirEmpty-ignore-')
+    })
+
+    it('should return false when non-ignored files exist', async () => {
+      await runWithTempDir(async tmpDir => {
+        const gitDir = path.join(tmpDir, '.git')
+        await fs.mkdir(gitDir)
+        const gitSubDir = path.join(gitDir, 'objects')
+        await fs.mkdir(gitSubDir)
+
+        const readmeFile = path.join(tmpDir, 'README.md')
+        await fs.writeFile(readmeFile, '', 'utf8')
+
+        const result = isDirEmptySync(tmpDir, {
+          ignore: ['.git'],
+        })
+        expect(result).toBe(false)
+      }, 'isDirEmpty-ignore-mixed-')
+    })
+  })
+
+  describe('isSymLinkSync', () => {
+    it('should return true for symlinks', async () => {
+      await runWithTempDir(async tmpDir => {
+        const targetFile = path.join(tmpDir, 'target.txt')
+        await fs.writeFile(targetFile, '', 'utf8')
+
+        const linkPath = path.join(tmpDir, 'link.txt')
+        await fs.symlink(targetFile, linkPath)
+
+        const result = isSymLinkSync(linkPath)
+        expect(result).toBe(true)
+      }, 'isSymLink-true-')
+    })
+
+    it('should return false for regular files', async () => {
+      await runWithTempDir(async tmpDir => {
+        const testFile = path.join(tmpDir, 'file.txt')
+        await fs.writeFile(testFile, '', 'utf8')
+
+        const result = isSymLinkSync(testFile)
+        expect(result).toBe(false)
+      }, 'isSymLink-false-')
+    })
+
+    it('should return false for non-existent paths', () => {
+      const result = isSymLinkSync('/nonexistent/path')
+      expect(result).toBe(false)
+    })
+  })
+
+  describe('readDirNames', () => {
+    it('should read directory names', async () => {
+      await runWithTempDir(async tmpDir => {
+        const dir1 = path.join(tmpDir, 'dir1')
+        const dir2 = path.join(tmpDir, 'dir2')
+        await fs.mkdir(dir1)
+        await fs.mkdir(dir2)
+
+        const result = await readDirNames(tmpDir)
+        expect(result).toEqual(['dir1', 'dir2'])
+      }, 'readDirNames-basic-')
+    })
+
+    it('should sort directory names by default', async () => {
+      await runWithTempDir(async tmpDir => {
+        const dirZ = path.join(tmpDir, 'z-dir')
+        const dirA = path.join(tmpDir, 'a-dir')
+        const dirM = path.join(tmpDir, 'm-dir')
+        await fs.mkdir(dirZ)
+        await fs.mkdir(dirA)
+        await fs.mkdir(dirM)
+
+        const result = await readDirNames(tmpDir)
+        expect(result).toEqual(['a-dir', 'm-dir', 'z-dir'])
+      }, 'readDirNames-sorted-')
+    })
+
+    it('should not sort when sort option is false', async () => {
+      await runWithTempDir(async tmpDir => {
+        const dirZ = path.join(tmpDir, 'z-dir')
+        const dirA = path.join(tmpDir, 'a-dir')
+        await fs.mkdir(dirZ)
+        await fs.mkdir(dirA)
+
+        const result = await readDirNames(tmpDir, { sort: false })
+        expect(result.length).toBe(2)
+        expect(result).toContain('z-dir')
+        expect(result).toContain('a-dir')
+      }, 'readDirNames-unsorted-')
+    })
+
+    it('should exclude files, only return directories', async () => {
+      await runWithTempDir(async tmpDir => {
+        const dir1 = path.join(tmpDir, 'dir1')
+        await fs.mkdir(dir1)
+
+        const file1 = path.join(tmpDir, 'file1.txt')
+        await fs.writeFile(file1, '', 'utf8')
+
+        const result = await readDirNames(tmpDir)
+        expect(result).toEqual(['dir1'])
+      }, 'readDirNames-dirs-only-')
+    })
+
+    it('should exclude empty directories when includeEmpty is false', async () => {
+      await runWithTempDir(async tmpDir => {
+        const emptyDir = path.join(tmpDir, 'empty')
+        await fs.mkdir(emptyDir)
+
+        const nonEmptyDir = path.join(tmpDir, 'non-empty')
+        await fs.mkdir(nonEmptyDir)
+        await fs.writeFile(path.join(nonEmptyDir, 'file.txt'), '', 'utf8')
+
+        const result = await readDirNames(tmpDir, { includeEmpty: false })
+        expect(result).toEqual(['non-empty'])
+      }, 'readDirNames-no-empty-')
+    })
+
+    it('should return empty array for non-existent directory', async () => {
+      const result = await readDirNames('/nonexistent/path')
+      expect(result).toEqual([])
+    })
+
+    it('should use ignore patterns with includeEmpty false', async () => {
+      await runWithTempDir(async tmpDir => {
+        const emptyDir = path.join(tmpDir, 'empty-dir')
+        await fs.mkdir(emptyDir)
+
+        const gitDir = path.join(emptyDir, '.git')
+        await fs.mkdir(gitDir)
+
+        const nonEmptyDir = path.join(tmpDir, 'non-empty-dir')
+        await fs.mkdir(nonEmptyDir)
+        await fs.writeFile(path.join(nonEmptyDir, 'file.txt'), '', 'utf8')
+
+        // With ignore patterns and includeEmpty: false, directories containing only ignored files are excluded
+        const result = await readDirNames(tmpDir, {
+          ignore: ['.git'],
+          includeEmpty: false,
+        })
+        expect(result).toContain('non-empty-dir')
+        expect(result).not.toContain('empty-dir')
+      }, 'readDirNames-ignore-')
+    })
+  })
+
+  describe('readDirNamesSync', () => {
+    it('should read directory names', async () => {
+      await runWithTempDir(async tmpDir => {
+        const dir1 = path.join(tmpDir, 'dir1')
+        const dir2 = path.join(tmpDir, 'dir2')
+        await fs.mkdir(dir1)
+        await fs.mkdir(dir2)
+
+        const result = readDirNamesSync(tmpDir)
+        expect(result).toEqual(['dir1', 'dir2'])
+      }, 'readDirNamesSync-basic-')
+    })
+
+    it('should sort directory names by default', async () => {
+      await runWithTempDir(async tmpDir => {
+        const dirZ = path.join(tmpDir, 'z-dir')
+        const dirA = path.join(tmpDir, 'a-dir')
+        const dirM = path.join(tmpDir, 'm-dir')
+        await fs.mkdir(dirZ)
+        await fs.mkdir(dirA)
+        await fs.mkdir(dirM)
+
+        const result = readDirNamesSync(tmpDir)
+        expect(result).toEqual(['a-dir', 'm-dir', 'z-dir'])
+      }, 'readDirNamesSync-sorted-')
+    })
+
+    it('should exclude files, only return directories', async () => {
+      await runWithTempDir(async tmpDir => {
+        const dir1 = path.join(tmpDir, 'dir1')
+        await fs.mkdir(dir1)
+
+        const file1 = path.join(tmpDir, 'file1.txt')
+        await fs.writeFile(file1, '', 'utf8')
+
+        const result = readDirNamesSync(tmpDir)
+        expect(result).toEqual(['dir1'])
+      }, 'readDirNamesSync-dirs-only-')
+    })
+
+    it('should return empty array for non-existent directory', () => {
+      const result = readDirNamesSync('/nonexistent/path')
+      expect(result).toEqual([])
+    })
+  })
+
+  describe('readFileBinary', () => {
+    it('should read file as binary buffer', async () => {
+      await runWithTempDir(async tmpDir => {
+        const testFile = path.join(tmpDir, 'binary.dat')
+        const testData = Buffer.from([0x00, 0x01, 0x02, 0x03])
+        await fs.writeFile(testFile, testData)
+
+        const result = await readFileBinary(testFile)
+        expect(Buffer.isBuffer(result)).toBe(true)
+        expect(result).toEqual(testData)
+      }, 'readFileBinary-basic-')
+    })
+
+    it('should throw for non-existent files', async () => {
+      await expect(readFileBinary('/nonexistent/file.dat')).rejects.toThrow()
+    })
+  })
+
+  describe('readFileBinarySync', () => {
+    it('should read file as binary buffer', async () => {
+      await runWithTempDir(async tmpDir => {
+        const testFile = path.join(tmpDir, 'binary.dat')
+        const testData = Buffer.from([0x00, 0x01, 0x02, 0x03])
+        await fs.writeFile(testFile, testData)
+
+        const result = readFileBinarySync(testFile)
+        expect(Buffer.isBuffer(result)).toBe(true)
+        expect(result).toEqual(testData)
+      }, 'readFileBinarySync-basic-')
+    })
+
+    it('should throw for non-existent files', () => {
+      expect(() => readFileBinarySync('/nonexistent/file.dat')).toThrow()
+    })
+  })
+
+  describe('readFileUtf8', () => {
+    it('should read file as UTF-8 string', async () => {
+      await runWithTempDir(async tmpDir => {
+        const testFile = path.join(tmpDir, 'text.txt')
+        const testContent = 'Hello, World!'
+        await fs.writeFile(testFile, testContent, 'utf8')
+
+        const result = await readFileUtf8(testFile)
+        expect(result).toBe(testContent)
+      }, 'readFileUtf8-basic-')
+    })
+
+    it('should handle unicode content', async () => {
+      await runWithTempDir(async tmpDir => {
+        const testFile = path.join(tmpDir, 'unicode.txt')
+        const testContent = 'Hello, 世界! 🌍'
+        await fs.writeFile(testFile, testContent, 'utf8')
+
+        const result = await readFileUtf8(testFile)
+        expect(result).toBe(testContent)
+      }, 'readFileUtf8-unicode-')
+    })
+
+    it('should throw for non-existent files', async () => {
+      await expect(readFileUtf8('/nonexistent/file.txt')).rejects.toThrow()
+    })
+  })
+
+  describe('readFileUtf8Sync', () => {
+    it('should read file as UTF-8 string', async () => {
+      await runWithTempDir(async tmpDir => {
+        const testFile = path.join(tmpDir, 'text.txt')
+        const testContent = 'Hello, World!'
+        await fs.writeFile(testFile, testContent, 'utf8')
+
+        const result = readFileUtf8Sync(testFile)
+        expect(result).toBe(testContent)
+      }, 'readFileUtf8Sync-basic-')
+    })
+
+    it('should handle unicode content', async () => {
+      await runWithTempDir(async tmpDir => {
+        const testFile = path.join(tmpDir, 'unicode.txt')
+        const testContent = 'Hello, 世界! 🌍'
+        await fs.writeFile(testFile, testContent, 'utf8')
+
+        const result = readFileUtf8Sync(testFile)
+        expect(result).toBe(testContent)
+      }, 'readFileUtf8Sync-unicode-')
+    })
+
+    it('should throw for non-existent files', () => {
+      expect(() => readFileUtf8Sync('/nonexistent/file.txt')).toThrow()
+    })
+  })
+
+  describe('readJson', () => {
+    it('should read and parse JSON file', async () => {
+      await runWithTempDir(async tmpDir => {
+        const testFile = path.join(tmpDir, 'data.json')
+        const testData = { foo: 'bar', count: 42 }
+        await fs.writeFile(testFile, JSON.stringify(testData), 'utf8')
+
+        const result = await readJson(testFile)
+        expect(result).toEqual(testData)
+      }, 'readJson-basic-')
+    })
+
+    it('should handle nested JSON objects', async () => {
+      await runWithTempDir(async tmpDir => {
+        const testFile = path.join(tmpDir, 'nested.json')
+        const testData = {
+          level1: {
+            level2: {
+              level3: 'deep',
+            },
+          },
+        }
+        await fs.writeFile(testFile, JSON.stringify(testData), 'utf8')
+
+        const result = await readJson(testFile)
+        expect(result).toEqual(testData)
+      }, 'readJson-nested-')
+    })
+
+    it('should throw by default for non-existent files', async () => {
+      await expect(readJson('/nonexistent/file.json')).rejects.toThrow()
+    })
+
+    it('should return undefined when throws is false and file does not exist', async () => {
+      const result = await readJson('/nonexistent/file.json', { throws: false })
+      expect(result).toBeUndefined()
+    })
+
+    it('should throw by default for invalid JSON', async () => {
+      await runWithTempDir(async tmpDir => {
+        const testFile = path.join(tmpDir, 'invalid.json')
+        await fs.writeFile(testFile, 'not valid json', 'utf8')
+
+        await expect(readJson(testFile)).rejects.toThrow()
+      }, 'readJson-invalid-')
+    })
+
+    it('should return undefined when throws is false and JSON is invalid', async () => {
+      await runWithTempDir(async tmpDir => {
+        const testFile = path.join(tmpDir, 'invalid.json')
+        await fs.writeFile(testFile, 'not valid json', 'utf8')
+
+        const result = await readJson(testFile, { throws: false })
+        expect(result).toBeUndefined()
+      }, 'readJson-invalid-no-throw-')
+    })
+
+    it('should use custom reviver function', async () => {
+      await runWithTempDir(async tmpDir => {
+        const testFile = path.join(tmpDir, 'data.json')
+        const testData = { date: '2024-01-01T00:00:00.000Z' }
+        await fs.writeFile(testFile, JSON.stringify(testData), 'utf8')
+
+        const result = (await readJson(testFile, {
+          reviver: (key, value) => {
+            if (key === 'date' && typeof value === 'string') {
+              return new Date(value)
+            }
+            return value
+          },
+        })) as unknown as { date: Date }
+
+        expect(result.date).toBeInstanceOf(Date)
+      }, 'readJson-reviver-')
+    })
+  })
+
+  describe('readJsonSync', () => {
+    it('should read and parse JSON file', async () => {
+      await runWithTempDir(async tmpDir => {
+        const testFile = path.join(tmpDir, 'data.json')
+        const testData = { foo: 'bar', count: 42 }
+        await fs.writeFile(testFile, JSON.stringify(testData), 'utf8')
+
+        const result = readJsonSync(testFile)
+        expect(result).toEqual(testData)
+      }, 'readJsonSync-basic-')
+    })
+
+    it('should handle nested JSON objects', async () => {
+      await runWithTempDir(async tmpDir => {
+        const testFile = path.join(tmpDir, 'nested.json')
+        const testData = {
+          level1: {
+            level2: {
+              level3: 'deep',
+            },
+          },
+        }
+        await fs.writeFile(testFile, JSON.stringify(testData), 'utf8')
+
+        const result = readJsonSync(testFile)
+        expect(result).toEqual(testData)
+      }, 'readJsonSync-nested-')
+    })
+
+    it('should throw by default for non-existent files', () => {
+      expect(() => readJsonSync('/nonexistent/file.json')).toThrow()
+    })
+
+    it('should return undefined when throws is false and file does not exist', () => {
+      const result = readJsonSync('/nonexistent/file.json', { throws: false })
+      expect(result).toBeUndefined()
+    })
+
+    it('should throw by default for invalid JSON', async () => {
+      await runWithTempDir(async tmpDir => {
+        const testFile = path.join(tmpDir, 'invalid.json')
+        await fs.writeFile(testFile, 'not valid json', 'utf8')
+
+        expect(() => readJsonSync(testFile)).toThrow()
+      }, 'readJsonSync-invalid-')
+    })
+
+    it('should return undefined when throws is false and JSON is invalid', async () => {
+      await runWithTempDir(async tmpDir => {
+        const testFile = path.join(tmpDir, 'invalid.json')
+        await fs.writeFile(testFile, 'not valid json', 'utf8')
+
+        const result = readJsonSync(testFile, { throws: false })
+        expect(result).toBeUndefined()
+      }, 'readJsonSync-invalid-no-throw-')
+    })
+  })
+
+  describe('safeDelete', () => {
+    it('should delete files in temp directory', async () => {
+      await runWithTempDir(async tmpDir => {
+        const testFile = path.join(tmpDir, 'delete-me.txt')
+        await fs.writeFile(testFile, '', 'utf8')
+
+        await safeDelete(testFile)
+
+        const exists = await fs
+          .access(testFile)
+          .then(() => true)
+          .catch(() => false)
+        expect(exists).toBe(false)
+      }, 'safeDelete-file-')
+    })
+
+    it('should delete directories recursively in temp directory', async () => {
+      await runWithTempDir(async tmpDir => {
+        const testDir = path.join(tmpDir, 'delete-dir')
+        await fs.mkdir(testDir, { recursive: true })
+        await fs.writeFile(path.join(testDir, 'file.txt'), '', 'utf8')
+
+        await safeDelete(testDir)
+
+        const exists = await fs
+          .access(testDir)
+          .then(() => true)
+          .catch(() => false)
+        expect(exists).toBe(false)
+      }, 'safeDelete-dir-')
+    })
+
+    it('should delete multiple files', async () => {
+      await runWithTempDir(async tmpDir => {
+        const file1 = path.join(tmpDir, 'file1.txt')
+        const file2 = path.join(tmpDir, 'file2.txt')
+        await fs.writeFile(file1, '', 'utf8')
+        await fs.writeFile(file2, '', 'utf8')
+
+        await safeDelete([file1, file2])
+
+        const exists1 = await fs
+          .access(file1)
+          .then(() => true)
+          .catch(() => false)
+        const exists2 = await fs
+          .access(file2)
+          .then(() => true)
+          .catch(() => false)
+        expect(exists1).toBe(false)
+        expect(exists2).toBe(false)
+      }, 'safeDelete-multiple-')
+    })
+
+    it('should not throw for non-existent files', async () => {
+      await expect(safeDelete('/nonexistent/file.txt')).resolves.toBeUndefined()
+    })
+
+    it('should respect force option', async () => {
+      await runWithTempDir(async tmpDir => {
+        const testFile = path.join(tmpDir, 'file.txt')
+        await fs.writeFile(testFile, '', 'utf8')
+
+        await safeDelete(testFile, { force: true })
+
+        const exists = await fs
+          .access(testFile)
+          .then(() => true)
+          .catch(() => false)
+        expect(exists).toBe(false)
+      }, 'safeDelete-force-')
+    })
+  })
+
+  describe('safeDeleteSync', () => {
+    it('should delete files in temp directory', async () => {
+      await runWithTempDir(async tmpDir => {
+        const testFile = path.join(tmpDir, 'delete-me.txt')
+        await fs.writeFile(testFile, '', 'utf8')
+
+        safeDeleteSync(testFile)
+
+        const exists = await fs
+          .access(testFile)
+          .then(() => true)
+          .catch(() => false)
+        expect(exists).toBe(false)
+      }, 'safeDeleteSync-file-')
+    })
+
+    it('should delete directories recursively in temp directory', async () => {
+      await runWithTempDir(async tmpDir => {
+        const testDir = path.join(tmpDir, 'delete-dir')
+        await fs.mkdir(testDir, { recursive: true })
+        await fs.writeFile(path.join(testDir, 'file.txt'), '', 'utf8')
+
+        safeDeleteSync(testDir)
+
+        const exists = await fs
+          .access(testDir)
+          .then(() => true)
+          .catch(() => false)
+        expect(exists).toBe(false)
+      }, 'safeDeleteSync-dir-')
+    })
+
+    it('should delete multiple files', async () => {
+      await runWithTempDir(async tmpDir => {
+        const file1 = path.join(tmpDir, 'file1.txt')
+        const file2 = path.join(tmpDir, 'file2.txt')
+        await fs.writeFile(file1, '', 'utf8')
+        await fs.writeFile(file2, '', 'utf8')
+
+        safeDeleteSync([file1, file2])
+
+        const exists1 = await fs
+          .access(file1)
+          .then(() => true)
+          .catch(() => false)
+        const exists2 = await fs
+          .access(file2)
+          .then(() => true)
+          .catch(() => false)
+        expect(exists1).toBe(false)
+        expect(exists2).toBe(false)
+      }, 'safeDeleteSync-multiple-')
+    })
+
+    it('should not throw for non-existent files', () => {
+      expect(() => safeDeleteSync('/nonexistent/file.txt')).not.toThrow()
+    })
+  })
+
+  describe('safeReadFile', () => {
+    it('should read existing file', async () => {
+      await runWithTempDir(async tmpDir => {
+        const testFile = path.join(tmpDir, 'test.txt')
+        const testContent = 'test content'
+        await fs.writeFile(testFile, testContent, 'utf8')
+
+        const result = await safeReadFile(testFile, { encoding: 'utf8' })
+        expect(result).toBe(testContent)
+      }, 'safeReadFile-exists-')
+    })
+
+    it('should return undefined for non-existent files', async () => {
+      const result = await safeReadFile('/nonexistent/file.txt')
+      expect(result).toBeUndefined()
+    })
+
+    it('should read as buffer when no encoding specified', async () => {
+      await runWithTempDir(async tmpDir => {
+        const testFile = path.join(tmpDir, 'binary.dat')
+        const testData = Buffer.from([0x01, 0x02, 0x03])
+        await fs.writeFile(testFile, testData)
+
+        const result = await safeReadFile(testFile)
+        expect(Buffer.isBuffer(result)).toBe(true)
+      }, 'safeReadFile-buffer-')
+    })
+  })
+
+  describe('safeReadFileSync', () => {
+    it('should read existing file', async () => {
+      await runWithTempDir(async tmpDir => {
+        const testFile = path.join(tmpDir, 'test.txt')
+        const testContent = 'test content'
+        await fs.writeFile(testFile, testContent, 'utf8')
+
+        const result = safeReadFileSync(testFile, { encoding: 'utf8' })
+        expect(result).toBe(testContent)
+      }, 'safeReadFileSync-exists-')
+    })
+
+    it('should return undefined for non-existent files', () => {
+      const result = safeReadFileSync('/nonexistent/file.txt')
+      expect(result).toBeUndefined()
+    })
+
+    it('should read as buffer when no encoding specified', async () => {
+      await runWithTempDir(async tmpDir => {
+        const testFile = path.join(tmpDir, 'binary.dat')
+        const testData = Buffer.from([0x01, 0x02, 0x03])
+        await fs.writeFile(testFile, testData)
+
+        const result = safeReadFileSync(testFile)
+        expect(Buffer.isBuffer(result)).toBe(true)
+      }, 'safeReadFileSync-buffer-')
+    })
+  })
+
+  describe('safeStats', () => {
+    it('should return stats for existing files', async () => {
+      await runWithTempDir(async tmpDir => {
+        const testFile = path.join(tmpDir, 'test.txt')
+        await fs.writeFile(testFile, '', 'utf8')
+
+        const result = await safeStats(testFile)
+        expect(result).toBeDefined()
+        expect(result?.isFile()).toBe(true)
+      }, 'safeStats-file-')
+    })
+
+    it('should return stats for directories', async () => {
+      await runWithTempDir(async tmpDir => {
+        const result = await safeStats(tmpDir)
+        expect(result).toBeDefined()
+        expect(result?.isDirectory()).toBe(true)
+      }, 'safeStats-dir-')
+    })
+
+    it('should return undefined for non-existent paths', async () => {
+      const result = await safeStats('/nonexistent/path')
+      expect(result).toBeUndefined()
+    })
+  })
+
+  describe('safeStatsSync', () => {
+    it('should return stats for existing files', async () => {
+      await runWithTempDir(async tmpDir => {
+        const testFile = path.join(tmpDir, 'test.txt')
+        await fs.writeFile(testFile, '', 'utf8')
+
+        const result = safeStatsSync(testFile)
+        expect(result).toBeDefined()
+        expect(result?.isFile()).toBe(true)
+      }, 'safeStatsSync-file-')
+    })
+
+    it('should return stats for directories', async () => {
+      await runWithTempDir(async tmpDir => {
+        const result = safeStatsSync(tmpDir)
+        expect(result).toBeDefined()
+        expect(result?.isDirectory()).toBe(true)
+      }, 'safeStatsSync-dir-')
+    })
+
+    it('should return undefined for non-existent paths', () => {
+      const result = safeStatsSync('/nonexistent/path')
+      expect(result).toBeUndefined()
+    })
+  })
+
+  describe('uniqueSync', () => {
+    it('should return same path if file does not exist', async () => {
+      await runWithTempDir(async tmpDir => {
+        const testFile = path.join(tmpDir, 'unique.txt')
+
+        const result = uniqueSync(testFile)
+        expect(result).toContain('unique.txt')
+      }, 'uniqueSync-new-')
+    })
+
+    it('should add number suffix if file exists', async () => {
+      await runWithTempDir(async tmpDir => {
+        const testFile = path.join(tmpDir, 'exists.txt')
+        await fs.writeFile(testFile, '', 'utf8')
+
+        const result = uniqueSync(testFile)
+        expect(result).toContain('exists-1.txt')
+      }, 'uniqueSync-exists-')
+    })
+
+    it('should increment counter for multiple existing files', async () => {
+      await runWithTempDir(async tmpDir => {
+        const testFile = path.join(tmpDir, 'file.txt')
+        await fs.writeFile(testFile, '', 'utf8')
+
+        const file1 = path.join(tmpDir, 'file-1.txt')
+        await fs.writeFile(file1, '', 'utf8')
+
+        const result = uniqueSync(testFile)
+        expect(result).toContain('file-2.txt')
+      }, 'uniqueSync-increment-')
+    })
+
+    it('should preserve file extension', async () => {
+      await runWithTempDir(async tmpDir => {
+        const testFile = path.join(tmpDir, 'data.json')
+        await fs.writeFile(testFile, '', 'utf8')
+
+        const result = uniqueSync(testFile)
+        expect(result).toContain('data-1.json')
+      }, 'uniqueSync-extension-')
+    })
+
+    it('should handle files without extension', async () => {
+      await runWithTempDir(async tmpDir => {
+        const testFile = path.join(tmpDir, 'README')
+        await fs.writeFile(testFile, '', 'utf8')
+
+        const result = uniqueSync(testFile)
+        expect(result).toContain('README-1')
+      }, 'uniqueSync-no-ext-')
+    })
+  })
+
+  describe('writeJson', () => {
+    it('should write JSON to file', async () => {
+      await runWithTempDir(async tmpDir => {
+        const testFile = path.join(tmpDir, 'output.json')
+        const testData = { foo: 'bar', count: 42 }
+
+        await writeJson(testFile, testData)
+
+        const content = await fs.readFile(testFile, 'utf8')
+        const parsed = JSON.parse(content)
+        expect(parsed).toEqual(testData)
+      }, 'writeJson-basic-')
+    })
+
+    it('should format JSON with default spacing', async () => {
+      await runWithTempDir(async tmpDir => {
+        const testFile = path.join(tmpDir, 'formatted.json')
+        const testData = { foo: 'bar' }
+
+        await writeJson(testFile, testData)
+
+        const content = await fs.readFile(testFile, 'utf8')
+        expect(content).toContain('  ')
+        expect(content).toContain('\n')
+      }, 'writeJson-formatted-')
+    })
+
+    it('should use custom spacing', async () => {
+      await runWithTempDir(async tmpDir => {
+        const testFile = path.join(tmpDir, 'custom-spacing.json')
+        const testData = { foo: 'bar' }
+
+        await writeJson(testFile, testData, { spaces: 4 })
+
+        const content = await fs.readFile(testFile, 'utf8')
+        expect(content).toContain('    ')
+      }, 'writeJson-custom-spacing-')
+    })
+
+    it('should use custom EOL', async () => {
+      await runWithTempDir(async tmpDir => {
+        const testFile = path.join(tmpDir, 'custom-eol.json')
+        const testData = { foo: 'bar' }
+
+        await writeJson(testFile, testData, { EOL: '\r\n' })
+
+        const content = await fs.readFile(testFile, 'utf8')
+        expect(content).toContain('\r\n')
+      }, 'writeJson-eol-')
+    })
+
+    it('should add final EOL by default', async () => {
+      await runWithTempDir(async tmpDir => {
+        const testFile = path.join(tmpDir, 'final-eol.json')
+        const testData = { foo: 'bar' }
+
+        await writeJson(testFile, testData)
+
+        const content = await fs.readFile(testFile, 'utf8')
+        expect(content.endsWith('\n')).toBe(true)
+      }, 'writeJson-final-eol-')
+    })
+
+    it('should omit final EOL when finalEOL is false', async () => {
+      await runWithTempDir(async tmpDir => {
+        const testFile = path.join(tmpDir, 'no-final-eol.json')
+        const testData = { foo: 'bar' }
+
+        await writeJson(testFile, testData, { finalEOL: false })
+
+        const content = await fs.readFile(testFile, 'utf8')
+        expect(content.endsWith('\n')).toBe(false)
+      }, 'writeJson-no-final-eol-')
+    })
+
+    it('should use custom replacer function', async () => {
+      await runWithTempDir(async tmpDir => {
+        const testFile = path.join(tmpDir, 'replacer.json')
+        const testData = { foo: 'bar', secret: 'hidden' }
+
+        await writeJson(testFile, testData, {
+          replacer: (key, value) => {
+            if (key === 'secret') {
+              return undefined
+            }
+            return value
+          },
+        })
+
+        const content = await fs.readFile(testFile, 'utf8')
+        const parsed = JSON.parse(content)
+        expect(parsed.secret).toBeUndefined()
+        expect(parsed.foo).toBe('bar')
+      }, 'writeJson-replacer-')
+    })
+  })
+
+  describe('writeJsonSync', () => {
+    it('should write JSON to file', async () => {
+      await runWithTempDir(async tmpDir => {
+        const testFile = path.join(tmpDir, 'output.json')
+        const testData = { foo: 'bar', count: 42 }
+
+        writeJsonSync(testFile, testData)
+
+        const content = await fs.readFile(testFile, 'utf8')
+        const parsed = JSON.parse(content)
+        expect(parsed).toEqual(testData)
+      }, 'writeJsonSync-basic-')
+    })
+
+    it('should format JSON with default spacing', async () => {
+      await runWithTempDir(async tmpDir => {
+        const testFile = path.join(tmpDir, 'formatted.json')
+        const testData = { foo: 'bar' }
+
+        writeJsonSync(testFile, testData)
+
+        const content = await fs.readFile(testFile, 'utf8')
+        expect(content).toContain('  ')
+        expect(content).toContain('\n')
+      }, 'writeJsonSync-formatted-')
+    })
+
+    it('should use custom spacing', async () => {
+      await runWithTempDir(async tmpDir => {
+        const testFile = path.join(tmpDir, 'custom-spacing.json')
+        const testData = { foo: 'bar' }
+
+        writeJsonSync(testFile, testData, { spaces: 4 })
+
+        const content = await fs.readFile(testFile, 'utf8')
+        expect(content).toContain('    ')
+      }, 'writeJsonSync-custom-spacing-')
+    })
+
+    it('should add final EOL by default', async () => {
+      await runWithTempDir(async tmpDir => {
+        const testFile = path.join(tmpDir, 'final-eol.json')
+        const testData = { foo: 'bar' }
+
+        writeJsonSync(testFile, testData)
+
+        const content = await fs.readFile(testFile, 'utf8')
+        expect(content.endsWith('\n')).toBe(true)
+      }, 'writeJsonSync-final-eol-')
+    })
+
+    it('should omit final EOL when finalEOL is false', async () => {
+      await runWithTempDir(async tmpDir => {
+        const testFile = path.join(tmpDir, 'no-final-eol.json')
+        const testData = { foo: 'bar' }
+
+        writeJsonSync(testFile, testData, { finalEOL: false })
+
+        const content = await fs.readFile(testFile, 'utf8')
+        expect(content.endsWith('\n')).toBe(false)
+      }, 'writeJsonSync-no-final-eol-')
+    })
+  })
+
+  describe('validateFiles', () => {
+    it('should return all files as valid when all exist and are readable', async () => {
+      await runWithTempDir(async tmpDir => {
+        const file1 = path.join(tmpDir, 'package.json')
+        const file2 = path.join(tmpDir, 'tsconfig.json')
+        await fs.writeFile(file1, '{}', 'utf8')
+        await fs.writeFile(file2, '{}', 'utf8')
+
+        const { invalidPaths, validPaths } = validateFiles([file1, file2])
+
+        expect(validPaths).toHaveLength(2)
+        expect(validPaths).toContain(file1)
+        expect(validPaths).toContain(file2)
+        expect(invalidPaths).toHaveLength(0)
+      }, 'validateFiles-all-valid-')
+    })
+
+    it('should return non-existent files as invalid', async () => {
+      await runWithTempDir(async tmpDir => {
+        const existingFile = path.join(tmpDir, 'exists.json')
+        const nonExistentFile = path.join(tmpDir, 'does-not-exist.json')
+        await fs.writeFile(existingFile, '{}', 'utf8')
+
+        const { invalidPaths, validPaths } = validateFiles([
+          existingFile,
+          nonExistentFile,
+        ])
+
+        expect(validPaths).toHaveLength(1)
+        expect(validPaths).toContain(existingFile)
+        expect(invalidPaths).toHaveLength(1)
+        expect(invalidPaths).toContain(nonExistentFile)
+      }, 'validateFiles-non-existent-')
+    })
+
+    it('should return all files as invalid when none exist', async () => {
+      await runWithTempDir(async tmpDir => {
+        const file1 = path.join(tmpDir, 'missing1.json')
+        const file2 = path.join(tmpDir, 'missing2.json')
+
+        const { invalidPaths, validPaths } = validateFiles([file1, file2])
+
+        expect(validPaths).toHaveLength(0)
+        expect(invalidPaths).toHaveLength(2)
+        expect(invalidPaths).toContain(file1)
+        expect(invalidPaths).toContain(file2)
+      }, 'validateFiles-all-invalid-')
+    })
+
+    it('should handle empty file array', () => {
+      const { invalidPaths, validPaths } = validateFiles([])
+
+      expect(validPaths).toHaveLength(0)
+      expect(invalidPaths).toHaveLength(0)
+    })
+
+    it('should work with readonly arrays', async () => {
+      await runWithTempDir(async tmpDir => {
+        const file1 = path.join(tmpDir, 'test.json')
+        await fs.writeFile(file1, '{}', 'utf8')
+
+        const readonlyArray: readonly string[] = [file1] as const
+        const { invalidPaths, validPaths } = validateFiles(readonlyArray)
+
+        expect(validPaths).toHaveLength(1)
+        expect(validPaths).toContain(file1)
+        expect(invalidPaths).toHaveLength(0)
+      }, 'validateFiles-readonly-')
+    })
+
+    it('should handle mixed valid and invalid files', async () => {
+      await runWithTempDir(async tmpDir => {
+        const valid1 = path.join(tmpDir, 'valid1.json')
+        const valid2 = path.join(tmpDir, 'valid2.json')
+        const invalid1 = path.join(tmpDir, 'invalid1.json')
+        const invalid2 = path.join(tmpDir, 'invalid2.json')
+
+        await fs.writeFile(valid1, '{}', 'utf8')
+        await fs.writeFile(valid2, '{}', 'utf8')
+
+        const { invalidPaths, validPaths } = validateFiles([
+          valid1,
+          invalid1,
+          valid2,
+          invalid2,
+        ])
+
+        expect(validPaths).toHaveLength(2)
+        expect(validPaths).toContain(valid1)
+        expect(validPaths).toContain(valid2)
+        expect(invalidPaths).toHaveLength(2)
+        expect(invalidPaths).toContain(invalid1)
+        expect(invalidPaths).toContain(invalid2)
+      }, 'validateFiles-mixed-')
+    })
+
+    it('should preserve file order in results', async () => {
+      await runWithTempDir(async tmpDir => {
+        const file1 = path.join(tmpDir, 'a.json')
+        const file2 = path.join(tmpDir, 'b.json')
+        const file3 = path.join(tmpDir, 'c.json')
+        await fs.writeFile(file1, '{}', 'utf8')
+        await fs.writeFile(file2, '{}', 'utf8')
+        await fs.writeFile(file3, '{}', 'utf8')
+
+        const { validPaths } = validateFiles([file3, file1, file2])
+
+        expect(validPaths[0]).toBe(file3)
+        expect(validPaths[1]).toBe(file1)
+        expect(validPaths[2]).toBe(file2)
+      }, 'validateFiles-order-')
+    })
+  })
+
+  describe('safeMkdir', () => {
+    it('should create a single directory', async () => {
+      await runWithTempDir(async tmpDir => {
+        const newDir = path.join(tmpDir, 'test-dir')
+        await safeMkdir(newDir)
+
+        const stats = await fs.stat(newDir)
+        expect(stats.isDirectory()).toBe(true)
+      }, 'safeMkdir-single-')
+    })
+
+    it('should create nested directories by default (recursive: true)', async () => {
+      await runWithTempDir(async tmpDir => {
+        const nestedDir = path.join(tmpDir, 'level1', 'level2', 'level3')
+        await safeMkdir(nestedDir)
+
+        const stats = await fs.stat(nestedDir)
+        expect(stats.isDirectory()).toBe(true)
+      }, 'safeMkdir-nested-')
+    })
+
+    it('should not throw when directory already exists', async () => {
+      await runWithTempDir(async tmpDir => {
+        const newDir = path.join(tmpDir, 'existing')
+        await fs.mkdir(newDir)
+
+        await expect(safeMkdir(newDir)).resolves.toBeUndefined()
+
+        const stats = await fs.stat(newDir)
+        expect(stats.isDirectory()).toBe(true)
+      }, 'safeMkdir-exists-')
+    })
+
+    it('should respect recursive: false option', async () => {
+      await runWithTempDir(async tmpDir => {
+        const nestedDir = path.join(tmpDir, 'level1', 'level2')
+
+        await expect(
+          safeMkdir(nestedDir, { recursive: false }),
+        ).rejects.toThrow()
+      }, 'safeMkdir-no-recursive-')
+    })
+
+    it('should create directory with custom mode', async () => {
+      await runWithTempDir(async tmpDir => {
+        const newDir = path.join(tmpDir, 'custom-mode')
+        await safeMkdir(newDir, { mode: 0o755 })
+
+        const stats = await fs.stat(newDir)
+        expect(stats.isDirectory()).toBe(true)
+      }, 'safeMkdir-mode-')
+    })
+
+    it('should throw on permission denied', async () => {
+      // Test skipped on Windows as permission handling differs
+      if (process.platform === 'win32') {
+        return
+      }
+
+      await runWithTempDir(async tmpDir => {
+        const readonlyDir = path.join(tmpDir, 'readonly')
+        await fs.mkdir(readonlyDir, { mode: 0o444 })
+
+        const newDir = path.join(readonlyDir, 'should-fail')
+        await expect(safeMkdir(newDir)).rejects.toThrow()
+      }, 'safeMkdir-permission-')
+    })
+  })
+
+  describe('safeMkdirSync', () => {
+    it('should create a single directory', async () => {
+      await runWithTempDir(async tmpDir => {
+        const newDir = path.join(tmpDir, 'test-dir')
+        safeMkdirSync(newDir)
+
+        const stats = await fs.stat(newDir)
+        expect(stats.isDirectory()).toBe(true)
+      }, 'safeMkdirSync-single-')
+    })
+
+    it('should create nested directories by default (recursive: true)', async () => {
+      await runWithTempDir(async tmpDir => {
+        const nestedDir = path.join(tmpDir, 'level1', 'level2', 'level3')
+        safeMkdirSync(nestedDir)
+
+        const stats = await fs.stat(nestedDir)
+        expect(stats.isDirectory()).toBe(true)
+      }, 'safeMkdirSync-nested-')
+    })
+
+    it('should not throw when directory already exists', async () => {
+      await runWithTempDir(async tmpDir => {
+        const newDir = path.join(tmpDir, 'existing')
+        await fs.mkdir(newDir)
+
+        expect(() => safeMkdirSync(newDir)).not.toThrow()
+
+        const stats = await fs.stat(newDir)
+        expect(stats.isDirectory()).toBe(true)
+      }, 'safeMkdirSync-exists-')
+    })
+
+    it('should respect recursive: false option', async () => {
+      await runWithTempDir(async tmpDir => {
+        const nestedDir = path.join(tmpDir, 'level1', 'level2')
+
+        expect(() => safeMkdirSync(nestedDir, { recursive: false })).toThrow()
+      }, 'safeMkdirSync-no-recursive-')
+    })
+
+    it('should create directory with custom mode', async () => {
+      await runWithTempDir(async tmpDir => {
+        const newDir = path.join(tmpDir, 'custom-mode')
+        safeMkdirSync(newDir, { mode: 0o755 })
+
+        const stats = await fs.stat(newDir)
+        expect(stats.isDirectory()).toBe(true)
+      }, 'safeMkdirSync-mode-')
+    })
+
+    it('should throw on permission denied', async () => {
+      // Test skipped on Windows as permission handling differs
+      if (process.platform === 'win32') {
+        return
+      }
+
+      await runWithTempDir(async tmpDir => {
+        const readonlyDir = path.join(tmpDir, 'readonly')
+        await fs.mkdir(readonlyDir, { mode: 0o444 })
+
+        const newDir = path.join(readonlyDir, 'should-fail')
+        expect(() => safeMkdirSync(newDir)).toThrow()
+      }, 'safeMkdirSync-permission-')
+    })
+  })
+})
diff --git a/test/registry/functions.test.ts b/test/unit/functions.test.ts
similarity index 84%
rename from test/registry/functions.test.ts
rename to test/unit/functions.test.ts
index cb57514..8437a94 100644
--- a/test/registry/functions.test.ts
+++ b/test/unit/functions.test.ts
@@ -1,5 +1,12 @@
 /**
- * @fileoverview Unit tests for function utilities.
+ * @fileoverview Unit tests for functional programming utilities.
+ *
+ * Tests function composition and control flow helpers:
+ * - noop() no-operation function (returns undefined)
+ * - once() ensures function executes exactly once
+ * - silentWrapAsync() wraps async functions with error suppression
+ * - trampoline() enables tail-call optimization for recursive functions
+ * Used throughout Socket tools for callback handling and recursion optimization.
  */
 
 import {
@@ -21,13 +28,13 @@ describe('functions', () => {
     })
 
     it('should not throw with any arguments', () => {
-      expect(() => noop(1, 2, 3)).not.toThrow()
-      expect(() => noop('test', { foo: 'bar' })).not.toThrow()
+      expect(() => (noop as any)(1, 2, 3)).not.toThrow()
+      expect(() => (noop as any)('test', { foo: 'bar' })).not.toThrow()
     })
 
     it('should always return undefined regardless of arguments', () => {
-      expect(noop(1, 2, 3)).toBeUndefined()
-      expect(noop('test', { foo: 'bar' })).toBeUndefined()
+      expect((noop as any)(1, 2, 3)).toBeUndefined()
+      expect((noop as any)('test', { foo: 'bar' })).toBeUndefined()
     })
   })
 
@@ -241,7 +248,7 @@ describe('functions', () => {
     })
 
     it('should handle promise rejections', async () => {
-      const fn = async () => Promise.reject(new Error('rejected'))
+      const fn = async () => await Promise.reject(new Error('rejected'))
       const wrappedFn = silentWrapAsync(fn)
 
       const result = await wrappedFn()
@@ -261,10 +268,12 @@ describe('functions', () => {
       // Factorial using trampoline
       const factorial = trampoline(function fact(
         n: number,
-        acc = 1,
+        acc: number = 1,
       ): number | (() => number) {
-        if (n <= 1) return acc
-        return () => fact(n - 1, n * acc)
+        if (n <= 1) {
+          return acc as number
+        }
+        return (() => fact(n - 1, n * acc)) as any
       })
 
       expect(factorial(5)).toBe(120)
@@ -274,10 +283,12 @@ describe('functions', () => {
     it('should handle tail-recursive sum', () => {
       const sum = trampoline(function sumN(
         n: number,
-        acc = 0,
+        acc: number = 0,
       ): number | (() => number) {
-        if (n === 0) return acc
-        return () => sumN(n - 1, acc + n)
+        if (n === 0) {
+          return acc as number
+        }
+        return (() => sumN(n - 1, acc + n)) as any
       })
 
       expect(sum(5)).toBe(15) // 5 + 4 + 3 + 2 + 1
@@ -287,8 +298,10 @@ describe('functions', () => {
 
     it('should handle functions that return functions multiple levels deep', () => {
       const fn = trampoline((depth: number): number | (() => number) => {
-        if (depth === 0) return 0
-        return () => () => () => fn(depth - 1)
+        if (depth === 0) {
+          return 0
+        }
+        return (() => () => () => fn(depth - 1)) as any
       })
 
       expect(fn(5)).toBe(0)
@@ -298,12 +311,14 @@ describe('functions', () => {
       const context = {
         value: 10,
         countdown: trampoline(function (
-          this: { value: number },
+          this: { value: number; countdown: any },
           n: number,
-          acc = 0,
+          acc: number = 0,
         ): number | (() => number) {
-          if (n === 0) return acc + this.value
-          return () => this.countdown(n - 1, acc + n)
+          if (n === 0) {
+            return (acc + this.value) as number
+          }
+          return (() => this.countdown(n - 1, acc + n)) as any
         }),
       }
 
@@ -323,12 +338,16 @@ describe('functions', () => {
     it('should handle tail-recursive fibonacci', () => {
       const fib = trampoline(function fibonacci(
         n: number,
-        a = 0,
-        b = 1,
+        a: number = 0,
+        b: number = 1,
       ): number | (() => number) {
-        if (n === 0) return a
-        if (n === 1) return b
-        return () => fibonacci(n - 1, b, a + b)
+        if (n === 0) {
+          return a as number
+        }
+        if (n === 1) {
+          return b as number
+        }
+        return (() => fibonacci(n - 1, b, a + b)) as any
       })
 
       expect(fib(0)).toBe(0)
@@ -339,8 +358,10 @@ describe('functions', () => {
 
     it('should handle functions returning functions that return values', () => {
       const fn = trampoline((x: number): number | (() => number) => {
-        if (x === 0) return 42
-        return () => fn(x - 1)
+        if (x === 0) {
+          return 42
+        }
+        return (() => fn(x - 1)) as any
       })
 
       expect(fn(3)).toBe(42)
@@ -351,8 +372,10 @@ describe('functions', () => {
       const deepRecursion = trampoline(function deep(
         n: number,
       ): number | (() => number) {
-        if (n === 0) return 0
-        return () => deep(n - 1)
+        if (n === 0) {
+          return 0
+        }
+        return (() => deep(n - 1)) as any
       })
 
       // Test with a large number that would normally overflow
diff --git a/test/unit/git-extended.test.ts b/test/unit/git-extended.test.ts
new file mode 100644
index 0000000..6c7f3a8
--- /dev/null
+++ b/test/unit/git-extended.test.ts
@@ -0,0 +1,684 @@
+/**
+ * @fileoverview Extended integration tests for git utility functions.
+ *
+ * Tests advanced git operations with comprehensive coverage:
+ * - Cache behavior: result caching and cache invalidation
+ * - Error handling: invalid paths, non-git directories, permission issues
+ * - Edge cases: empty repositories, untracked files, submodules
+ * - Performance: cache hit rates, bulk operations
+ * - Real git operations: actual repository state manipulation
+ * Complements git.test.ts with deeper coverage of error paths and caching logic.
+ */
+
+import { promises as fs } from 'node:fs'
+import path from 'node:path'
+import {
+  findGitRoot,
+  getChangedFiles,
+  getChangedFilesSync,
+  getStagedFiles,
+  getStagedFilesSync,
+  getUnstagedFiles,
+  getUnstagedFilesSync,
+  isChanged,
+  isChangedSync,
+  isStaged,
+  isStagedSync,
+  isUnstaged,
+  isUnstagedSync,
+} from '@socketsecurity/lib/git'
+import { normalizePath } from '@socketsecurity/lib/path'
+import { spawnSync } from '@socketsecurity/lib/spawn'
+import { describe, expect, it } from 'vitest'
+import { runWithTempDir } from './utils/temp-file-helper.mjs'
+
+describe('git extended tests', () => {
+  const projectRoot = normalizePath(process.cwd())
+
+  describe('cache functionality', () => {
+    it('should cache results by default', async () => {
+      // First call
+      const result1 = await getChangedFiles({ cwd: projectRoot })
+      // Second call should use cache
+      const result2 = await getChangedFiles({ cwd: projectRoot })
+      expect(result1).toEqual(result2)
+    })
+
+    it('should not cache when cache option is false', async () => {
+      const result1 = await getChangedFiles({ cache: false, cwd: projectRoot })
+      const result2 = await getChangedFiles({ cache: false, cwd: projectRoot })
+      // Results should be arrays (may not be exactly equal if files changed)
+      expect(Array.isArray(result1)).toBe(true)
+      expect(Array.isArray(result2)).toBe(true)
+    })
+
+    it('should cache sync results', () => {
+      const result1 = getChangedFilesSync({ cwd: projectRoot })
+      const result2 = getChangedFilesSync({ cwd: projectRoot })
+      expect(result1).toEqual(result2)
+    })
+
+    it('should have separate cache entries for different options', async () => {
+      const result1 = await getChangedFiles({
+        absolute: false,
+        cwd: projectRoot,
+      })
+      const result2 = await getChangedFiles({
+        absolute: true,
+        cwd: projectRoot,
+      })
+      // Cache should not mix absolute and relative results
+      expect(Array.isArray(result1)).toBe(true)
+      expect(Array.isArray(result2)).toBe(true)
+    })
+
+    it('should cache staged files separately from changed files', async () => {
+      const changed = await getChangedFiles({ cwd: projectRoot })
+      const staged = await getStagedFiles({ cwd: projectRoot })
+      // These should be different cache entries
+      expect(Array.isArray(changed)).toBe(true)
+      expect(Array.isArray(staged)).toBe(true)
+    })
+
+    it('should cache unstaged files separately', async () => {
+      const unstaged = await getUnstagedFiles({ cwd: projectRoot })
+      const staged = await getStagedFiles({ cwd: projectRoot })
+      expect(Array.isArray(unstaged)).toBe(true)
+      expect(Array.isArray(staged)).toBe(true)
+    })
+  })
+
+  describe('options handling', () => {
+    it('should handle asSet option', async () => {
+      const result = await getChangedFiles({ asSet: true, cwd: projectRoot })
+      // Even with asSet, the function returns array (option is for future use)
+      expect(Array.isArray(result)).toBe(true)
+    })
+
+    it('should handle porcelain format explicitly', async () => {
+      // getChangedFiles already uses porcelain internally
+      const result = await getChangedFiles({
+        cwd: projectRoot,
+        porcelain: true,
+      })
+      expect(Array.isArray(result)).toBe(true)
+    })
+
+    it('should handle empty options object', async () => {
+      const result = await getChangedFiles({})
+      expect(Array.isArray(result)).toBe(true)
+    })
+
+    it('should handle undefined options', async () => {
+      const result = await getChangedFiles(undefined)
+      expect(Array.isArray(result)).toBe(true)
+    })
+
+    it('should handle glob matcher options', async () => {
+      const result = await getChangedFiles({
+        cwd: projectRoot,
+        dot: true,
+        nocase: true,
+      })
+      expect(Array.isArray(result)).toBe(true)
+    })
+  })
+
+  describe('error handling', () => {
+    it('should return empty array when git command fails', async () => {
+      // Use a non-git directory
+      await runWithTempDir(async tmpDir => {
+        const result = await getChangedFiles({ cwd: tmpDir })
+        expect(result).toEqual([])
+      }, 'git-error-')
+    })
+
+    it('should return empty array for sync version when git fails', async () => {
+      await runWithTempDir(async tmpDir => {
+        const result = getChangedFilesSync({ cwd: tmpDir })
+        expect(result).toEqual([])
+      }, 'git-error-sync-')
+    })
+
+    it('should handle invalid cwd gracefully in findGitRoot', () => {
+      // findGitRoot should return the original path if no .git found
+      const nonGitPath = '/nonexistent/path/that/does/not/exist'
+      const result = findGitRoot(nonGitPath)
+      expect(result).toBe(nonGitPath)
+    })
+
+    it('should return empty array for getStagedFiles in non-git dir', async () => {
+      await runWithTempDir(async tmpDir => {
+        const result = await getStagedFiles({ cwd: tmpDir })
+        expect(result).toEqual([])
+      }, 'git-staged-error-')
+    })
+
+    it('should return empty array for getUnstagedFiles in non-git dir', async () => {
+      await runWithTempDir(async tmpDir => {
+        const result = await getUnstagedFiles({ cwd: tmpDir })
+        expect(result).toEqual([])
+      }, 'git-unstaged-error-')
+    })
+  })
+
+  describe('path resolution', () => {
+    it('should normalize paths correctly', async () => {
+      const result = await getChangedFiles({ cwd: projectRoot })
+      for (const file of result) {
+        // Paths should not have backslashes (even on Windows)
+        expect(file).not.toContain('\\')
+      }
+    })
+
+    it('should handle relative paths in cwd', async () => {
+      // Test with a relative path for cwd
+      const result = await getChangedFiles({ cwd: '.' })
+      expect(Array.isArray(result)).toBe(true)
+    })
+
+    it('should resolve absolute paths correctly', async () => {
+      const result = await getChangedFiles({ absolute: true, cwd: projectRoot })
+      for (const file of result) {
+        if (file) {
+          expect(path.isAbsolute(file)).toBe(true)
+          expect(file).toContain(projectRoot)
+        }
+      }
+    })
+
+    it('should handle subdirectory cwd correctly', async () => {
+      const srcDir = path.join(projectRoot, 'src')
+      const result = await getChangedFiles({ cwd: srcDir })
+      expect(Array.isArray(result)).toBe(true)
+      // Files should be filtered to src directory if there are changes
+      for (const file of result) {
+        // File paths should be relative to repo root but filtered to src
+        expect(typeof file).toBe('string')
+      }
+    })
+  })
+
+  describe('real git operations', () => {
+    // Note: No need to save/restore cwd - we always use explicit cwd options
+
+    it('should work with a temporary git repository', async () => {
+      await runWithTempDir(async tmpDir => {
+        // Initialize a git repo
+        spawnSync('git', ['init'], { cwd: tmpDir })
+        spawnSync('git', ['config', 'user.name', 'Test User'], { cwd: tmpDir })
+        spawnSync('git', ['config', 'user.email', 'test@example.com'], {
+          cwd: tmpDir,
+        })
+
+        // Create a file
+        const testFile = path.join(tmpDir, 'test.txt')
+        await fs.writeFile(testFile, 'test content', 'utf8')
+
+        // File should appear as changed (untracked)
+        const changed = await getChangedFiles({ cwd: tmpDir })
+        expect(changed).toContain('test.txt')
+
+        // Stage the file
+        spawnSync('git', ['add', 'test.txt'], { cwd: tmpDir })
+
+        // File should now be staged
+        const staged = await getStagedFiles({ cwd: tmpDir })
+        expect(staged).toContain('test.txt')
+
+        // Commit the file
+        spawnSync('git', ['commit', '-m', 'Initial commit'], { cwd: tmpDir })
+
+        // Now there should be no changes (or at most just test.txt if git is showing it)
+        const afterCommit = await getChangedFiles({ cwd: tmpDir })
+        // In some git configurations, files may still appear, so just check it's an array
+        expect(Array.isArray(afterCommit)).toBe(true)
+
+        // Modify the file
+        await fs.writeFile(testFile, 'modified content', 'utf8')
+
+        // Should show as unstaged
+        const unstaged = await getUnstagedFiles({ cwd: tmpDir })
+        expect(unstaged).toContain('test.txt')
+
+        // Check isChanged
+        const isChangedResult = await isChanged(testFile, { cwd: tmpDir })
+        expect(isChangedResult).toBe(true)
+
+        // Check isUnstaged
+        const isUnstagedResult = await isUnstaged(testFile, { cwd: tmpDir })
+        expect(isUnstagedResult).toBe(true)
+
+        // Check isStaged (should be false)
+        const isStagedResult = await isStaged(testFile, { cwd: tmpDir })
+        expect(isStagedResult).toBe(false)
+
+        // Stage the changes
+        spawnSync('git', ['add', 'test.txt'], { cwd: tmpDir })
+
+        // Now it should be staged
+        const stagedAfter = await getStagedFiles({ cwd: tmpDir })
+        expect(stagedAfter).toContain('test.txt')
+
+        // And should still show as changed
+        const isChangedAfter = await isChanged(testFile, { cwd: tmpDir })
+        expect(typeof isChangedAfter).toBe('boolean')
+      }, 'git-ops-')
+    })
+
+    it('should detect untracked files', async () => {
+      await runWithTempDir(async tmpDir => {
+        spawnSync('git', ['init'], { cwd: tmpDir })
+        spawnSync('git', ['config', 'user.name', 'Test User'], { cwd: tmpDir })
+        spawnSync('git', ['config', 'user.email', 'test@example.com'], {
+          cwd: tmpDir,
+        })
+
+        const untracked = path.join(tmpDir, 'untracked.txt')
+        await fs.writeFile(untracked, 'untracked', 'utf8')
+
+        const changed = await getChangedFiles({ cwd: tmpDir })
+        expect(changed).toContain('untracked.txt')
+
+        // Untracked files should not appear in unstaged (they're not tracked)
+        const unstaged = await getUnstagedFiles({ cwd: tmpDir })
+        expect(unstaged).not.toContain('untracked.txt')
+      }, 'git-untracked-')
+    })
+
+    it('should handle nested directories', async () => {
+      await runWithTempDir(async tmpDir => {
+        spawnSync('git', ['init'], { cwd: tmpDir })
+        spawnSync('git', ['config', 'user.name', 'Test User'], { cwd: tmpDir })
+        spawnSync('git', ['config', 'user.email', 'test@example.com'], {
+          cwd: tmpDir,
+        })
+
+        const subdir = path.join(tmpDir, 'src', 'nested')
+        await fs.mkdir(subdir, { recursive: true })
+
+        const nestedFile = path.join(subdir, 'nested.txt')
+        await fs.writeFile(nestedFile, 'nested content', 'utf8')
+
+        const changed = await getChangedFiles({ cwd: tmpDir })
+        // Git may show directory or full path depending on config
+        expect(changed.length).toBeGreaterThan(0)
+        const hasFile = changed.some(
+          f => f.includes('nested.txt') || f === 'src' || f.includes('src'),
+        )
+        expect(hasFile).toBe(true)
+
+        // Test with cwd in subdirectory
+        const changedFromSubdir = await getChangedFiles({ cwd: subdir })
+        // When cwd is in subdirectory, it filters to that directory
+        // The file may not show up if git hasn't indexed the parent
+        expect(Array.isArray(changedFromSubdir)).toBe(true)
+      }, 'git-nested-')
+    })
+
+    it('should work with sync functions', async () => {
+      await runWithTempDir(async tmpDir => {
+        spawnSync('git', ['init'], { cwd: tmpDir })
+        spawnSync('git', ['config', 'user.name', 'Test User'], { cwd: tmpDir })
+        spawnSync('git', ['config', 'user.email', 'test@example.com'], {
+          cwd: tmpDir,
+        })
+
+        const testFile = path.join(tmpDir, 'sync-test.txt')
+        await fs.writeFile(testFile, 'sync content', 'utf8')
+
+        const changedSync = getChangedFilesSync({ cwd: tmpDir })
+        expect(changedSync).toContain('sync-test.txt')
+
+        spawnSync('git', ['add', 'sync-test.txt'], { cwd: tmpDir })
+
+        const stagedSync = getStagedFilesSync({ cwd: tmpDir })
+        expect(stagedSync).toContain('sync-test.txt')
+
+        spawnSync('git', ['commit', '-m', 'Sync test'], { cwd: tmpDir })
+
+        await fs.writeFile(testFile, 'modified sync', 'utf8')
+
+        const unstagedSync = getUnstagedFilesSync({ cwd: tmpDir })
+        expect(unstagedSync).toContain('sync-test.txt')
+
+        const isChangedResult = isChangedSync(testFile, { cwd: tmpDir })
+        expect(isChangedResult).toBe(true)
+
+        const isUnstagedResult = isUnstagedSync(testFile, { cwd: tmpDir })
+        expect(isUnstagedResult).toBe(true)
+
+        const isStagedResult = isStagedSync(testFile, { cwd: tmpDir })
+        expect(isStagedResult).toBe(false)
+      }, 'git-sync-')
+    })
+
+    it('should handle empty git repository', async () => {
+      await runWithTempDir(async tmpDir => {
+        spawnSync('git', ['init'], { cwd: tmpDir })
+        spawnSync('git', ['config', 'user.name', 'Test User'], { cwd: tmpDir })
+        spawnSync('git', ['config', 'user.email', 'test@example.com'], {
+          cwd: tmpDir,
+        })
+
+        // Empty repo should have no changes
+        const changed = await getChangedFiles({ cwd: tmpDir })
+        expect(changed).toEqual([])
+
+        const staged = await getStagedFiles({ cwd: tmpDir })
+        expect(staged).toEqual([])
+
+        const unstaged = await getUnstagedFiles({ cwd: tmpDir })
+        expect(unstaged).toEqual([])
+      }, 'git-empty-')
+    })
+
+    it('should handle files with spaces in names', async () => {
+      await runWithTempDir(async tmpDir => {
+        spawnSync('git', ['init'], { cwd: tmpDir })
+        spawnSync('git', ['config', 'user.name', 'Test User'], { cwd: tmpDir })
+        spawnSync('git', ['config', 'user.email', 'test@example.com'], {
+          cwd: tmpDir,
+        })
+
+        const spacedFile = path.join(tmpDir, 'file with spaces.txt')
+        await fs.writeFile(spacedFile, 'content', 'utf8')
+
+        const changed = await getChangedFiles({ cwd: tmpDir })
+        // Git may quote filenames with spaces
+        const hasFile = changed.some(
+          f => f === 'file with spaces.txt' || f === '"file with spaces.txt"',
+        )
+        expect(hasFile).toBe(true)
+
+        spawnSync('git', ['add', 'file with spaces.txt'], { cwd: tmpDir })
+
+        const staged = await getStagedFiles({ cwd: tmpDir })
+        const hasStagedFile = staged.some(
+          f => f === 'file with spaces.txt' || f === '"file with spaces.txt"',
+        )
+        expect(hasStagedFile).toBe(true)
+      }, 'git-spaces-')
+    })
+
+    it('should handle special characters in file names', async () => {
+      await runWithTempDir(async tmpDir => {
+        spawnSync('git', ['init'], { cwd: tmpDir })
+        spawnSync('git', ['config', 'user.name', 'Test User'], { cwd: tmpDir })
+        spawnSync('git', ['config', 'user.email', 'test@example.com'], {
+          cwd: tmpDir,
+        })
+
+        const specialFile = path.join(tmpDir, 'file-with_special.chars.txt')
+        await fs.writeFile(specialFile, 'content', 'utf8')
+
+        const changed = await getChangedFiles({ cwd: tmpDir })
+        expect(changed).toContain('file-with_special.chars.txt')
+      }, 'git-special-')
+    })
+
+    it('should work with absolute paths in is* functions', async () => {
+      await runWithTempDir(async tmpDir => {
+        spawnSync('git', ['init'], { cwd: tmpDir })
+        spawnSync('git', ['config', 'user.name', 'Test User'], { cwd: tmpDir })
+        spawnSync('git', ['config', 'user.email', 'test@example.com'], {
+          cwd: tmpDir,
+        })
+
+        const absFile = path.join(tmpDir, 'absolute.txt')
+        await fs.writeFile(absFile, 'content', 'utf8')
+
+        const isChangedAbs = await isChanged(absFile)
+        expect(typeof isChangedAbs).toBe('boolean')
+      }, 'git-absolute-')
+    })
+
+    it('should handle deleted files', async () => {
+      await runWithTempDir(async tmpDir => {
+        spawnSync('git', ['init'], { cwd: tmpDir })
+        spawnSync('git', ['config', 'user.name', 'Test User'], { cwd: tmpDir })
+        spawnSync('git', ['config', 'user.email', 'test@example.com'], {
+          cwd: tmpDir,
+        })
+
+        const delFile = path.join(tmpDir, 'to-delete.txt')
+        await fs.writeFile(delFile, 'content', 'utf8')
+        spawnSync('git', ['add', 'to-delete.txt'], { cwd: tmpDir })
+        spawnSync('git', ['commit', '-m', 'Add file'], { cwd: tmpDir })
+
+        // Delete the file
+        await fs.unlink(delFile)
+
+        // Should show as changed (deleted)
+        const changed = await getChangedFiles({ cwd: tmpDir })
+        expect(changed).toContain('to-delete.txt')
+
+        // Should show as unstaged deletion
+        const unstaged = await getUnstagedFiles({ cwd: tmpDir })
+        expect(unstaged).toContain('to-delete.txt')
+      }, 'git-deleted-')
+    })
+
+    it('should handle renamed files', async () => {
+      await runWithTempDir(async tmpDir => {
+        spawnSync('git', ['init'], { cwd: tmpDir })
+        spawnSync('git', ['config', 'user.name', 'Test User'], { cwd: tmpDir })
+        spawnSync('git', ['config', 'user.email', 'test@example.com'], {
+          cwd: tmpDir,
+        })
+
+        const oldFile = path.join(tmpDir, 'old-name.txt')
+        await fs.writeFile(oldFile, 'content', 'utf8')
+        spawnSync('git', ['add', 'old-name.txt'], { cwd: tmpDir })
+        spawnSync('git', ['commit', '-m', 'Add file'], { cwd: tmpDir })
+
+        // Rename the file
+        const newFile = path.join(tmpDir, 'new-name.txt')
+        await fs.rename(oldFile, newFile)
+        spawnSync('git', ['add', '-A'], { cwd: tmpDir })
+
+        // Should show both old and new in staged
+        const staged = await getStagedFiles({ cwd: tmpDir })
+        // Git may show this as a rename or as delete + add
+        expect(staged.length).toBeGreaterThan(0)
+      }, 'git-renamed-')
+    })
+
+    it('should handle Buffer stdout from spawn', async () => {
+      await runWithTempDir(async tmpDir => {
+        spawnSync('git', ['init'], { cwd: tmpDir })
+        spawnSync('git', ['config', 'user.name', 'Test User'], { cwd: tmpDir })
+        spawnSync('git', ['config', 'user.email', 'test@example.com'], {
+          cwd: tmpDir,
+        })
+
+        const testFile = path.join(tmpDir, 'buffer-test.txt')
+        await fs.writeFile(testFile, 'buffer content', 'utf8')
+
+        // This test ensures Buffer stdout is handled correctly
+        const changed = await getChangedFiles({ cwd: tmpDir })
+        expect(changed).toContain('buffer-test.txt')
+      }, 'git-buffer-')
+    })
+
+    it('should handle stdout as string from spawn', async () => {
+      await runWithTempDir(async tmpDir => {
+        spawnSync('git', ['init'], { cwd: tmpDir })
+        spawnSync('git', ['config', 'user.name', 'Test User'], { cwd: tmpDir })
+        spawnSync('git', ['config', 'user.email', 'test@example.com'], {
+          cwd: tmpDir,
+        })
+
+        const testFile = path.join(tmpDir, 'string-test.txt')
+        await fs.writeFile(testFile, 'string content', 'utf8')
+
+        const changedSync = getChangedFilesSync({ cwd: tmpDir })
+        expect(changedSync).toContain('string-test.txt')
+      }, 'git-string-')
+    })
+  })
+
+  describe('findGitRoot edge cases', () => {
+    it('should handle path at filesystem root', () => {
+      const result = findGitRoot('/')
+      expect(typeof result).toBe('string')
+      expect(result).toBeTruthy()
+    })
+
+    it('should return same path when no .git found', () => {
+      const nonGitPath = '/tmp/definitely/not/a/git/repo'
+      const result = findGitRoot(nonGitPath)
+      expect(result).toBe(nonGitPath)
+    })
+
+    it('should handle deeply nested git repos', async () => {
+      await runWithTempDir(async tmpDir => {
+        spawnSync('git', ['init'], { cwd: tmpDir })
+
+        const deepPath = path.join(tmpDir, 'a', 'b', 'c', 'd', 'e')
+        await fs.mkdir(deepPath, { recursive: true })
+
+        const result = findGitRoot(deepPath)
+        expect(result).toBe(tmpDir)
+      }, 'git-deep-')
+    })
+
+    it('should work when starting from git root itself', () => {
+      const result = findGitRoot(projectRoot)
+      expect(result).toBe(projectRoot)
+    })
+
+    it('should handle error in existsSync', async () => {
+      await runWithTempDir(async tmpDir => {
+        // Test that errors are caught and ignored
+        const result = findGitRoot(tmpDir)
+        expect(typeof result).toBe('string')
+      }, 'git-error-exists-')
+    })
+  })
+
+  describe('Windows-specific behavior', () => {
+    it('should normalize path separators', async () => {
+      const result = await getChangedFiles({ cwd: projectRoot })
+      for (const file of result) {
+        // Should use forward slashes even on Windows
+        expect(file).not.toMatch(/\\(?!$)/)
+      }
+    })
+
+    it('should use shell on Windows for some operations', async () => {
+      // This tests that the code path for Windows shell is covered
+      const result = await getChangedFiles({ cwd: projectRoot })
+      expect(Array.isArray(result)).toBe(true)
+    })
+  })
+
+  describe('porcelain format parsing', () => {
+    it('should strip status codes from porcelain output', async () => {
+      // getChangedFiles uses porcelain format internally
+      const result = await getChangedFiles({ cwd: projectRoot })
+      for (const file of result) {
+        // Status codes are 2 chars + space, should be stripped
+        expect(file).not.toMatch(/^[MADRCU?!]{1,2} /)
+      }
+    })
+
+    it('should handle short porcelain lines', async () => {
+      await runWithTempDir(async tmpDir => {
+        spawnSync('git', ['init'], { cwd: tmpDir })
+        spawnSync('git', ['config', 'user.name', 'Test User'], { cwd: tmpDir })
+        spawnSync('git', ['config', 'user.email', 'test@example.com'], {
+          cwd: tmpDir,
+        })
+
+        const testFile = path.join(tmpDir, 'a.txt')
+        await fs.writeFile(testFile, 'content', 'utf8')
+
+        const changed = await getChangedFiles({ cwd: tmpDir })
+        // Even very short filenames should work
+        expect(changed).toContain('a.txt')
+      }, 'git-porcelain-')
+    })
+  })
+
+  describe('concurrent operations', () => {
+    it('should handle many concurrent git operations', async () => {
+      const operations = Array.from({ length: 20 }, (_, i) => {
+        if (i % 3 === 0) {
+          return getChangedFiles({ cwd: projectRoot })
+        }
+        if (i % 3 === 1) {
+          return getStagedFiles({ cwd: projectRoot })
+        }
+        return getUnstagedFiles({ cwd: projectRoot })
+      })
+
+      const results = await Promise.all(operations)
+      for (const result of results) {
+        expect(Array.isArray(result)).toBe(true)
+      }
+    })
+
+    it('should handle mixed sync and async operations', async () => {
+      const asyncResult = getChangedFiles({ cwd: projectRoot })
+      const syncResult = getChangedFilesSync({ cwd: projectRoot })
+
+      const [async, sync] = await Promise.all([
+        asyncResult,
+        Promise.resolve(syncResult),
+      ])
+      expect(async).toEqual(sync)
+    })
+  })
+
+  describe('cwd resolution with symlinks', () => {
+    it('should resolve symlinks in cwd', async () => {
+      // This tests that fs.realpathSync is called for cwd
+      const result = await getChangedFiles({ cwd: projectRoot })
+      expect(Array.isArray(result)).toBe(true)
+    })
+
+    it('should resolve symlinks in pathname for is* functions', async () => {
+      const testFile = path.join(projectRoot, 'package.json')
+      const isChangedResult = await isChanged(testFile, { cwd: projectRoot })
+      expect(typeof isChangedResult).toBe('boolean')
+    })
+
+    it('should handle cwd same as default root', async () => {
+      const defaultCwd = process.cwd()
+      const result = await getChangedFiles({ cwd: defaultCwd })
+      expect(Array.isArray(result)).toBe(true)
+    })
+  })
+
+  describe('empty output handling', () => {
+    it('should handle empty stdout', async () => {
+      await runWithTempDir(async tmpDir => {
+        spawnSync('git', ['init'], { cwd: tmpDir })
+        spawnSync('git', ['config', 'user.name', 'Test User'], { cwd: tmpDir })
+        spawnSync('git', ['config', 'user.email', 'test@example.com'], {
+          cwd: tmpDir,
+        })
+
+        // Empty repo with no files
+        const changed = await getChangedFiles({ cwd: tmpDir })
+        expect(changed).toEqual([])
+      }, 'git-empty-stdout-')
+    })
+  })
+
+  describe('getFs and getPath lazy loading', () => {
+    it('should lazily load fs module', async () => {
+      // Multiple calls should use the same cached module
+      const result1 = await getChangedFiles({ cwd: projectRoot })
+      const result2 = await getChangedFiles({ cwd: projectRoot })
+      expect(result1).toEqual(result2)
+    })
+
+    it('should lazily load path module', () => {
+      // findGitRoot uses the lazy path module
+      const result = findGitRoot(projectRoot)
+      expect(result).toBe(projectRoot)
+    })
+  })
+})
diff --git a/test/unit/git.test.ts b/test/unit/git.test.ts
new file mode 100644
index 0000000..b108344
--- /dev/null
+++ b/test/unit/git.test.ts
@@ -0,0 +1,344 @@
+/**
+ * @fileoverview Integration tests for git utility functions.
+ *
+ * Tests git repository operations against actual repository state:
+ * - findGitRoot() locates .git directory from any path
+ * - getChangedFiles(), getStagedFiles(), getUnstagedFiles() track working tree state
+ * - isChanged(), isStaged(), isUnstaged() check individual file status
+ * - Sync variants for all operations (*Sync)
+ * - Real git integration (not mocked - tests actual repository)
+ * Used by Socket CLI for git-aware operations (pre-commit hooks, file filtering).
+ */
+
+import { promises as fs } from 'node:fs'
+import path from 'node:path'
+import {
+  findGitRoot,
+  getChangedFiles,
+  getChangedFilesSync,
+  getStagedFiles,
+  getStagedFilesSync,
+  getUnstagedFiles,
+  getUnstagedFilesSync,
+  isChanged,
+  isChangedSync,
+  isStaged,
+  isStagedSync,
+  isUnstaged,
+  isUnstagedSync,
+} from '@socketsecurity/lib/git'
+import { describe, expect, it } from 'vitest'
+
+describe('git', () => {
+  const projectRoot = process.cwd()
+
+  describe('findGitRoot', () => {
+    it('should find git root from current directory', () => {
+      const result = findGitRoot(projectRoot)
+      expect(result).toBe(projectRoot)
+      expect(result).toContain('socket-lib')
+    })
+
+    it('should find git root from subdirectory', () => {
+      const testDir = path.join(projectRoot, 'test', 'registry')
+      const result = findGitRoot(testDir)
+      expect(result).toBe(projectRoot)
+    })
+
+    it('should find git root from deeply nested directory', () => {
+      const srcDir = path.join(projectRoot, 'src', 'constants')
+      const result = findGitRoot(srcDir)
+      expect(result).toBe(projectRoot)
+    })
+
+    it('should handle root directory gracefully', () => {
+      // On systems where root is not a git repo, should return root
+      const result = findGitRoot('/')
+      expect(result).toBeTruthy()
+      expect(typeof result).toBe('string')
+    })
+  })
+
+  describe('getChangedFiles', () => {
+    it('should return an array', async () => {
+      const result = await getChangedFiles({ cwd: projectRoot })
+      expect(Array.isArray(result)).toBe(true)
+    })
+
+    it('should return file paths as strings', async () => {
+      const result = await getChangedFiles({ cwd: projectRoot })
+      for (const file of result) {
+        expect(typeof file).toBe('string')
+      }
+    })
+
+    it('should respect cwd option', async () => {
+      const result = await getChangedFiles({ cwd: projectRoot })
+      expect(Array.isArray(result)).toBe(true)
+    })
+
+    it('should return absolute paths when absolute option is true', async () => {
+      const result = await getChangedFiles({
+        absolute: true,
+        cwd: projectRoot,
+      })
+      for (const file of result) {
+        if (file) {
+          expect(path.isAbsolute(file)).toBe(true)
+        }
+      }
+    })
+
+    it('should handle empty repository state', async () => {
+      // In a clean repo, should return empty array or files
+      const result = await getChangedFiles({ cwd: projectRoot })
+      expect(Array.isArray(result)).toBe(true)
+    })
+  })
+
+  describe('getChangedFilesSync', () => {
+    it('should return an array', () => {
+      const result = getChangedFilesSync({ cwd: projectRoot })
+      expect(Array.isArray(result)).toBe(true)
+    })
+
+    it('should return file paths as strings', () => {
+      const result = getChangedFilesSync({ cwd: projectRoot })
+      for (const file of result) {
+        expect(typeof file).toBe('string')
+      }
+    })
+
+    it('should match async version', async () => {
+      const syncResult = getChangedFilesSync({ cwd: projectRoot })
+      const asyncResult = await getChangedFiles({ cwd: projectRoot })
+      expect(syncResult).toEqual(asyncResult)
+    })
+  })
+
+  describe('getStagedFiles', () => {
+    it('should return an array', async () => {
+      const result = await getStagedFiles({ cwd: projectRoot })
+      expect(Array.isArray(result)).toBe(true)
+    })
+
+    it('should return file paths as strings', async () => {
+      const result = await getStagedFiles({ cwd: projectRoot })
+      for (const file of result) {
+        expect(typeof file).toBe('string')
+      }
+    })
+
+    it('should return absolute paths when absolute option is true', async () => {
+      const result = await getStagedFiles({
+        absolute: true,
+        cwd: projectRoot,
+      })
+      for (const file of result) {
+        if (file) {
+          expect(path.isAbsolute(file)).toBe(true)
+        }
+      }
+    })
+  })
+
+  describe('getStagedFilesSync', () => {
+    it('should return an array', () => {
+      const result = getStagedFilesSync({ cwd: projectRoot })
+      expect(Array.isArray(result)).toBe(true)
+    })
+
+    it('should match async version', async () => {
+      const syncResult = getStagedFilesSync({ cwd: projectRoot })
+      const asyncResult = await getStagedFiles({ cwd: projectRoot })
+      expect(syncResult).toEqual(asyncResult)
+    })
+  })
+
+  describe('getUnstagedFiles', () => {
+    it('should return an array', async () => {
+      const result = await getUnstagedFiles({ cwd: projectRoot })
+      expect(Array.isArray(result)).toBe(true)
+    })
+
+    it('should return file paths as strings', async () => {
+      const result = await getUnstagedFiles({ cwd: projectRoot })
+      for (const file of result) {
+        expect(typeof file).toBe('string')
+      }
+    })
+
+    it('should return absolute paths when absolute option is true', async () => {
+      const result = await getUnstagedFiles({
+        absolute: true,
+        cwd: projectRoot,
+      })
+      for (const file of result) {
+        if (file) {
+          expect(path.isAbsolute(file)).toBe(true)
+        }
+      }
+    })
+  })
+
+  describe('getUnstagedFilesSync', () => {
+    it('should return an array', () => {
+      const result = getUnstagedFilesSync({ cwd: projectRoot })
+      expect(Array.isArray(result)).toBe(true)
+    })
+
+    it('should match async version', async () => {
+      const syncResult = getUnstagedFilesSync({ cwd: projectRoot })
+      const asyncResult = await getUnstagedFiles({ cwd: projectRoot })
+      expect(syncResult).toEqual(asyncResult)
+    })
+  })
+
+  describe('isChanged', () => {
+    it('should return boolean for existing file', async () => {
+      const testFile = path.join(projectRoot, 'package.json')
+      const result = await isChanged(testFile, { cwd: projectRoot })
+      expect(typeof result).toBe('boolean')
+    })
+
+    it('should return false for committed file in clean repo', async () => {
+      // README.md should exist and be committed
+      const testFile = path.join(projectRoot, 'README.md')
+      const fileExists = await fs
+        .access(testFile)
+        .then(() => true)
+        .catch(() => false)
+      if (fileExists) {
+        const result = await isChanged(testFile, { cwd: projectRoot })
+        // In a clean repo, committed files should not be changed
+        expect(typeof result).toBe('boolean')
+      }
+    })
+
+    it('should work with relative paths', async () => {
+      const result = await isChanged('package.json', { cwd: projectRoot })
+      expect(typeof result).toBe('boolean')
+    })
+
+    it('should throw for non-existent files', async () => {
+      // Non-existent files cause fs.lstat to throw ENOENT
+      await expect(
+        isChanged('nonexistent-file.ts', { cwd: projectRoot }),
+      ).rejects.toThrow(/ENOENT|no such file/)
+    })
+  })
+
+  describe('isChangedSync', () => {
+    it('should return boolean for existing file', () => {
+      const testFile = path.join(projectRoot, 'package.json')
+      const result = isChangedSync(testFile, { cwd: projectRoot })
+      expect(typeof result).toBe('boolean')
+    })
+
+    it('should match async version', async () => {
+      const testFile = 'package.json'
+      const syncResult = isChangedSync(testFile, { cwd: projectRoot })
+      const asyncResult = await isChanged(testFile, { cwd: projectRoot })
+      expect(syncResult).toBe(asyncResult)
+    })
+  })
+
+  describe('isStaged', () => {
+    it('should return boolean for existing file', async () => {
+      const testFile = path.join(projectRoot, 'package.json')
+      const result = await isStaged(testFile, { cwd: projectRoot })
+      expect(typeof result).toBe('boolean')
+    })
+
+    it('should work with relative paths', async () => {
+      const result = await isStaged('package.json', { cwd: projectRoot })
+      expect(typeof result).toBe('boolean')
+    })
+
+    it('should throw for non-existent files', async () => {
+      // Non-existent files cause fs.lstat to throw ENOENT
+      await expect(
+        isStaged('nonexistent-file.ts', { cwd: projectRoot }),
+      ).rejects.toThrow(/ENOENT|no such file/)
+    })
+  })
+
+  describe('isStagedSync', () => {
+    it('should return boolean for existing file', () => {
+      const testFile = path.join(projectRoot, 'package.json')
+      const result = isStagedSync(testFile, { cwd: projectRoot })
+      expect(typeof result).toBe('boolean')
+    })
+
+    it('should match async version', async () => {
+      const testFile = 'package.json'
+      const syncResult = isStagedSync(testFile, { cwd: projectRoot })
+      const asyncResult = await isStaged(testFile, { cwd: projectRoot })
+      expect(syncResult).toBe(asyncResult)
+    })
+  })
+
+  describe('isUnstaged', () => {
+    it('should return boolean for existing file', async () => {
+      const testFile = path.join(projectRoot, 'package.json')
+      const result = await isUnstaged(testFile, { cwd: projectRoot })
+      expect(typeof result).toBe('boolean')
+    })
+
+    it('should work with relative paths', async () => {
+      const result = await isUnstaged('package.json', { cwd: projectRoot })
+      expect(typeof result).toBe('boolean')
+    })
+
+    it('should throw for non-existent files', async () => {
+      // Non-existent files cause fs.lstat to throw ENOENT
+      await expect(
+        isUnstaged('nonexistent-file.ts', { cwd: projectRoot }),
+      ).rejects.toThrow(/ENOENT|no such file/)
+    })
+  })
+
+  describe('isUnstagedSync', () => {
+    it('should return boolean for existing file', () => {
+      const testFile = path.join(projectRoot, 'package.json')
+      const result = isUnstagedSync(testFile, { cwd: projectRoot })
+      expect(typeof result).toBe('boolean')
+    })
+
+    it('should match async version', async () => {
+      const testFile = 'package.json'
+      const syncResult = isUnstagedSync(testFile, { cwd: projectRoot })
+      const asyncResult = await isUnstaged(testFile, { cwd: projectRoot })
+      expect(syncResult).toBe(asyncResult)
+    })
+  })
+
+  describe('edge cases', () => {
+    it('should handle concurrent calls', async () => {
+      const promises = [
+        getChangedFiles({ cwd: projectRoot }),
+        getStagedFiles({ cwd: projectRoot }),
+        getUnstagedFiles({ cwd: projectRoot }),
+      ]
+      const results = await Promise.all(promises)
+      for (const result of results) {
+        expect(Array.isArray(result)).toBe(true)
+      }
+    })
+
+    it('should handle multiple file checks', async () => {
+      const files = ['package.json', 'tsconfig.json', 'README.md']
+      const results = await Promise.all(
+        files.map(file => isChanged(file, { cwd: projectRoot })),
+      )
+      for (const result of results) {
+        expect(typeof result).toBe('boolean')
+      }
+    })
+
+    it('should handle files in subdirectories', async () => {
+      const result = await isChanged('src/logger.ts', { cwd: projectRoot })
+      expect(typeof result).toBe('boolean')
+    })
+  })
+})
diff --git a/test/unit/github.test.ts b/test/unit/github.test.ts
new file mode 100644
index 0000000..6c0d30b
--- /dev/null
+++ b/test/unit/github.test.ts
@@ -0,0 +1,497 @@
+/**
+ * @fileoverview Unit tests for GitHub API integration utilities.
+ *
+ * Tests GitHub API helpers and authentication:
+ * - getGitHubToken(), getGitHubTokenFromGitConfig() token retrieval
+ * - getGitHubTokenWithFallback() multi-source token resolution
+ * - getGhsaUrl() constructs GitHub Security Advisory URLs
+ * - clearRefCache() clears git reference cache
+ * - Environment variable handling (GITHUB_TOKEN, GH_TOKEN)
+ * - Note: HTTP tests limited due to module resolution constraints
+ * Used by Socket tools for GitHub API authentication and GHSA lookups.
+ */
+
+import {
+  clearRefCache,
+  getGhsaUrl,
+  getGitHubToken,
+  getGitHubTokenFromGitConfig,
+  getGitHubTokenWithFallback,
+} from '@socketsecurity/lib/github'
+import { resetEnv, setEnv } from '@socketsecurity/lib/env/rewire'
+import { afterEach, beforeEach, describe, expect, it } from 'vitest'
+
+describe.sequential('github', () => {
+  beforeEach(() => {
+    // Clear environment variables
+    resetEnv()
+    clearRefCache()
+  })
+
+  afterEach(() => {
+    resetEnv()
+  })
+
+  describe('getGitHubToken', () => {
+    it('should return GITHUB_TOKEN from environment', () => {
+      setEnv('GITHUB_TOKEN', 'test-token')
+      const token = getGitHubToken()
+      expect(token).toBe('test-token')
+    })
+
+    it('should return GH_TOKEN from environment', () => {
+      setEnv('GH_TOKEN', 'gh-test-token')
+      const token = getGitHubToken()
+      expect(token).toBe('gh-test-token')
+    })
+
+    it('should return SOCKET_CLI_GITHUB_TOKEN from environment', () => {
+      setEnv('SOCKET_CLI_GITHUB_TOKEN', 'cli-token')
+      const token = getGitHubToken()
+      expect(token).toBe('cli-token')
+    })
+
+    it('should prefer GITHUB_TOKEN over GH_TOKEN', () => {
+      setEnv('GITHUB_TOKEN', 'github-token')
+      setEnv('GH_TOKEN', 'gh-token')
+      const token = getGitHubToken()
+      expect(token).toBe('github-token')
+    })
+
+    it('should prefer GITHUB_TOKEN over SOCKET_CLI_GITHUB_TOKEN', () => {
+      setEnv('GITHUB_TOKEN', 'github-token')
+      setEnv('SOCKET_CLI_GITHUB_TOKEN', 'cli-token')
+      const token = getGitHubToken()
+      expect(token).toBe('github-token')
+    })
+
+    it('should return undefined when no token is set', () => {
+      const token = getGitHubToken()
+      expect(token).toBeUndefined()
+    })
+  })
+
+  describe('clearRefCache', () => {
+    it('should not throw when called', () => {
+      expect(() => clearRefCache()).not.toThrow()
+    })
+
+    it('should be callable multiple times', () => {
+      clearRefCache()
+      clearRefCache()
+      clearRefCache()
+      expect(true).toBe(true)
+    })
+  })
+
+  describe('getGitHubTokenFromGitConfig', () => {
+    it('should return string or undefined (integration test)', async () => {
+      const token = await getGitHubTokenFromGitConfig()
+      expect(typeof token === 'string' || token === undefined).toBe(true)
+    })
+
+    it('should return undefined when git config throws', async () => {
+      const token = await getGitHubTokenFromGitConfig({
+        cwd: '/nonexistent/directory/that/does/not/exist',
+      })
+      expect(token).toBeUndefined()
+    })
+
+    it('should accept spawn options', async () => {
+      const token = await getGitHubTokenFromGitConfig({ cwd: process.cwd() })
+      expect(typeof token === 'string' || token === undefined).toBe(true)
+    })
+  })
+
+  describe('getGitHubTokenWithFallback', () => {
+    it('should return token from GITHUB_TOKEN environment first', async () => {
+      setEnv('GITHUB_TOKEN', 'env-token')
+      const token = await getGitHubTokenWithFallback()
+      expect(token).toBe('env-token')
+    })
+
+    it('should return token from GH_TOKEN when GITHUB_TOKEN is not set', async () => {
+      setEnv('GH_TOKEN', 'gh-token')
+      const token = await getGitHubTokenWithFallback()
+      expect(token).toBe('gh-token')
+    })
+
+    it('should fallback to git config (integration test)', async () => {
+      // Integration test - git config may or may not have token
+      const token = await getGitHubTokenWithFallback()
+      expect(typeof token === 'string' || token === undefined).toBe(true)
+    })
+  })
+
+  describe('getGhsaUrl', () => {
+    it('should generate correct GHSA URL', () => {
+      const url = getGhsaUrl('GHSA-xxxx-xxxx-xxxx')
+      expect(url).toBe('https://github.com/advisories/GHSA-xxxx-xxxx-xxxx')
+    })
+
+    it('should handle different GHSA IDs', () => {
+      const url = getGhsaUrl('GHSA-1234-5678-9abc')
+      expect(url).toBe('https://github.com/advisories/GHSA-1234-5678-9abc')
+    })
+
+    it('should handle GHSA IDs with special characters', () => {
+      const url = getGhsaUrl('GHSA-abcd-efgh-ijkl')
+      expect(url).toBe('https://github.com/advisories/GHSA-abcd-efgh-ijkl')
+    })
+
+    it('should handle uppercase GHSA IDs', () => {
+      const url = getGhsaUrl('GHSA-XXXX-YYYY-ZZZZ')
+      expect(url).toBe('https://github.com/advisories/GHSA-XXXX-YYYY-ZZZZ')
+    })
+
+    it('should handle lowercase GHSA IDs', () => {
+      const url = getGhsaUrl('ghsa-xxxx-yyyy-zzzz')
+      expect(url).toBe('https://github.com/advisories/ghsa-xxxx-yyyy-zzzz')
+    })
+
+    it('should handle GHSA IDs with numbers', () => {
+      const url = getGhsaUrl('GHSA-1111-2222-3333')
+      expect(url).toBe('https://github.com/advisories/GHSA-1111-2222-3333')
+    })
+
+    it('should handle empty GHSA ID', () => {
+      const url = getGhsaUrl('')
+      expect(url).toBe('https://github.com/advisories/')
+    })
+  })
+
+  describe('clearRefCache', () => {
+    it('should clear cache asynchronously', async () => {
+      await clearRefCache()
+      expect(true).toBe(true)
+    })
+
+    it('should handle multiple sequential clears', async () => {
+      await clearRefCache()
+      await clearRefCache()
+      await clearRefCache()
+      expect(true).toBe(true)
+    })
+
+    it('should handle concurrent clears', async () => {
+      await Promise.all([clearRefCache(), clearRefCache(), clearRefCache()])
+      expect(true).toBe(true)
+    })
+  })
+
+  describe('token priority and fallback', () => {
+    it('should prioritize GITHUB_TOKEN over other env vars', () => {
+      setEnv('GITHUB_TOKEN', 'token1')
+      setEnv('GH_TOKEN', 'token2')
+      setEnv('SOCKET_CLI_GITHUB_TOKEN', 'token3')
+
+      const token = getGitHubToken()
+      expect(token).toBe('token1')
+    })
+
+    it('should use GH_TOKEN when GITHUB_TOKEN is not set', () => {
+      setEnv('GH_TOKEN', 'token2')
+      setEnv('SOCKET_CLI_GITHUB_TOKEN', 'token3')
+
+      const token = getGitHubToken()
+      expect(token).toBe('token2')
+    })
+
+    it('should use SOCKET_CLI_GITHUB_TOKEN as last resort', () => {
+      setEnv('SOCKET_CLI_GITHUB_TOKEN', 'token3')
+
+      const token = getGitHubToken()
+      expect(token).toBe('token3')
+    })
+
+    it('should handle empty string tokens', () => {
+      setEnv('GITHUB_TOKEN', '')
+      setEnv('GH_TOKEN', 'token2')
+
+      const token = getGitHubToken()
+      expect(token).toBe('token2')
+    })
+
+    it('should handle whitespace tokens', () => {
+      setEnv('GITHUB_TOKEN', '   ')
+      const token = getGitHubToken()
+      expect(token).toBeTruthy()
+    })
+  })
+
+  describe('getGitHubTokenFromGitConfig', () => {
+    it('should handle empty cwd', async () => {
+      const token = await getGitHubTokenFromGitConfig({ cwd: '' })
+      expect(typeof token === 'string' || token === undefined).toBe(true)
+    })
+
+    it('should handle missing git command', async () => {
+      const token = await getGitHubTokenFromGitConfig({
+        cwd: '/tmp',
+      })
+      expect(typeof token === 'string' || token === undefined).toBe(true)
+    })
+
+    it('should handle stdio options', async () => {
+      const token = await getGitHubTokenFromGitConfig({
+        stdio: 'pipe',
+      })
+      expect(typeof token === 'string' || token === undefined).toBe(true)
+    })
+
+    it('should not throw on errors', async () => {
+      await expect(
+        getGitHubTokenFromGitConfig({
+          cwd: '/nonexistent/path/12345',
+        }),
+      ).resolves.not.toThrow()
+    })
+  })
+
+  describe('getGitHubTokenWithFallback', () => {
+    it('should prefer environment over git config', async () => {
+      setEnv('GITHUB_TOKEN', 'env-token')
+      const token = await getGitHubTokenWithFallback()
+      expect(token).toBe('env-token')
+    })
+
+    it('should handle when both sources are unavailable', async () => {
+      const token = await getGitHubTokenWithFallback()
+      expect(typeof token === 'string' || token === undefined).toBe(true)
+    })
+
+    it('should return string or undefined', async () => {
+      const token = await getGitHubTokenWithFallback()
+      expect(
+        typeof token === 'string' ||
+          typeof token === 'undefined' ||
+          token === undefined,
+      ).toBe(true)
+    })
+  })
+
+  describe('edge cases and error handling', () => {
+    it('should handle rapid token changes', () => {
+      setEnv('GITHUB_TOKEN', 'token1')
+      expect(getGitHubToken()).toBe('token1')
+
+      setEnv('GITHUB_TOKEN', 'token2')
+      expect(getGitHubToken()).toBe('token2')
+
+      setEnv('GITHUB_TOKEN', undefined)
+      expect(getGitHubToken()).toBeUndefined()
+    })
+
+    it('should handle token with special characters', () => {
+      setEnv('GITHUB_TOKEN', 'ghp_abc123!@#$%^&*()')
+      const token = getGitHubToken()
+      expect(token).toContain('ghp_abc123')
+    })
+
+    it('should handle very long tokens', () => {
+      const longToken = `ghp_${'x'.repeat(1000)}`
+      setEnv('GITHUB_TOKEN', longToken)
+      const token = getGitHubToken()
+      expect(token).toBe(longToken)
+    })
+
+    it('should handle unicode in GHSA IDs', () => {
+      const url = getGhsaUrl('GHSA-你好-世界-测试')
+      expect(url).toContain('GHSA-你好-世界-测试')
+    })
+
+    it('should handle GHSA IDs with unusual characters', () => {
+      const url = getGhsaUrl('GHSA-@@@-###-$$$')
+      expect(url).toContain('GHSA-@@@-###-$$$')
+    })
+  })
+
+  describe('concurrent operations', () => {
+    it('should handle concurrent token reads', () => {
+      setEnv('GITHUB_TOKEN', 'token')
+      const results = Array.from({ length: 10 }, () => getGitHubToken())
+      expect(results).toEqual(Array(10).fill('token'))
+    })
+
+    it('should handle concurrent cache clears', async () => {
+      const promises = Array.from({ length: 5 }, () => clearRefCache())
+      await expect(Promise.all(promises)).resolves.not.toThrow()
+    })
+
+    it('should handle concurrent git config reads', async () => {
+      const promises = Array.from({ length: 3 }, () =>
+        getGitHubTokenFromGitConfig(),
+      )
+      await expect(Promise.all(promises)).resolves.not.toThrow()
+    })
+  })
+
+  describe('type safety', () => {
+    it('should return correct types', () => {
+      const token = getGitHubToken()
+      expect(typeof token === 'string' || token === undefined).toBe(true)
+    })
+
+    it('should return correct URL type', () => {
+      const url = getGhsaUrl('GHSA-test-test-test')
+      expect(typeof url).toBe('string')
+    })
+
+    it('should handle async operations correctly', async () => {
+      const result = await getGitHubTokenWithFallback()
+      expect(
+        typeof result === 'string' ||
+          typeof result === 'undefined' ||
+          result === undefined,
+      ).toBe(true)
+    })
+  })
+
+  describe('API error handling edge cases', () => {
+    it('should handle missing token gracefully', () => {
+      resetEnv()
+      const token = getGitHubToken()
+      expect(token).toBeUndefined()
+    })
+
+    it('should generate GHSA URLs consistently', () => {
+      const ghsaId = 'GHSA-1234-5678-90ab'
+      const url1 = getGhsaUrl(ghsaId)
+      const url2 = getGhsaUrl(ghsaId)
+      expect(url1).toBe(url2)
+      expect(url1).toContain(ghsaId)
+    })
+
+    it('should handle GHSA IDs with mixed case', () => {
+      const url = getGhsaUrl('GhSa-MiXeD-CaSe-TeSt')
+      expect(url).toBe('https://github.com/advisories/GhSa-MiXeD-CaSe-TeSt')
+    })
+
+    it('should handle GHSA IDs with dashes only', () => {
+      const url = getGhsaUrl('----')
+      expect(url).toBe('https://github.com/advisories/----')
+    })
+  })
+
+  describe('caching behavior', () => {
+    it('should allow multiple cache clears in sequence', async () => {
+      for (let i = 0; i < 5; i++) {
+        await clearRefCache()
+      }
+      expect(true).toBe(true)
+    })
+
+    it('should handle cache operations after clear', async () => {
+      await clearRefCache()
+      const token = getGitHubToken()
+      expect(typeof token === 'string' || token === undefined).toBe(true)
+    })
+  })
+
+  describe('token resolution', () => {
+    it('should handle all three token sources independently', () => {
+      // Test GITHUB_TOKEN alone
+      resetEnv()
+      setEnv('GITHUB_TOKEN', 'token1')
+      expect(getGitHubToken()).toBe('token1')
+
+      // Test GH_TOKEN alone
+      resetEnv()
+      setEnv('GH_TOKEN', 'token2')
+      expect(getGitHubToken()).toBe('token2')
+
+      // Test SOCKET_CLI_GITHUB_TOKEN alone
+      resetEnv()
+      setEnv('SOCKET_CLI_GITHUB_TOKEN', 'token3')
+      expect(getGitHubToken()).toBe('token3')
+    })
+
+    it('should handle token priority with all permutations', () => {
+      // Priority: GITHUB_TOKEN > GH_TOKEN > SOCKET_CLI_GITHUB_TOKEN
+      resetEnv()
+      setEnv('GH_TOKEN', 'gh')
+      setEnv('SOCKET_CLI_GITHUB_TOKEN', 'cli')
+      expect(getGitHubToken()).toBe('gh')
+
+      resetEnv()
+      setEnv('GITHUB_TOKEN', 'github')
+      setEnv('SOCKET_CLI_GITHUB_TOKEN', 'cli')
+      expect(getGitHubToken()).toBe('github')
+
+      resetEnv()
+      setEnv('GITHUB_TOKEN', 'github')
+      setEnv('GH_TOKEN', 'gh')
+      expect(getGitHubToken()).toBe('github')
+    })
+  })
+
+  describe('git config integration', () => {
+    it('should handle non-git directories', async () => {
+      const token = await getGitHubTokenFromGitConfig({
+        cwd: '/tmp',
+      })
+      expect(typeof token === 'string' || token === undefined).toBe(true)
+    })
+
+    it('should handle relative paths', async () => {
+      const token = await getGitHubTokenFromGitConfig({
+        cwd: '.',
+      })
+      expect(typeof token === 'string' || token === undefined).toBe(true)
+    })
+
+    it('should handle multiple concurrent git config reads', async () => {
+      const results = await Promise.all([
+        getGitHubTokenFromGitConfig(),
+        getGitHubTokenFromGitConfig(),
+        getGitHubTokenFromGitConfig(),
+      ])
+      results.forEach(result => {
+        expect(typeof result === 'string' || result === undefined).toBe(true)
+      })
+    })
+  })
+
+  describe('URL formatting', () => {
+    it('should maintain URL structure for all IDs', () => {
+      const ids = [
+        'GHSA-1234-5678-9abc',
+        'GHSA-xxxx-yyyy-zzzz',
+        'GHSA-abcd-efgh-ijkl',
+        'ghsa-lowercase-test-id',
+      ]
+      ids.forEach(id => {
+        const url = getGhsaUrl(id)
+        expect(url).toMatch(/^https:\/\/github\.com\/advisories\//)
+        expect(url).toContain(id)
+      })
+    })
+
+    it('should handle GHSA IDs with URL-unsafe characters', () => {
+      const id = 'GHSA-test%20with%20spaces'
+      const url = getGhsaUrl(id)
+      expect(url).toContain(id)
+    })
+  })
+
+  describe('fallback chain', () => {
+    it('should complete fallback chain with no sources', async () => {
+      resetEnv()
+      const token = await getGitHubTokenWithFallback()
+      expect(typeof token === 'string' || token === undefined).toBe(true)
+    })
+
+    it('should short-circuit on first found token', async () => {
+      setEnv('GITHUB_TOKEN', 'first-token')
+      const token = await getGitHubTokenWithFallback()
+      expect(token).toBe('first-token')
+    })
+
+    it('should try git config when env vars are empty', async () => {
+      resetEnv()
+      const token = await getGitHubTokenWithFallback()
+      // Token may come from git config or be undefined
+      expect(typeof token === 'string' || token === undefined).toBe(true)
+    })
+  })
+})
diff --git a/test/unit/globs.test.ts b/test/unit/globs.test.ts
new file mode 100644
index 0000000..eceb6aa
--- /dev/null
+++ b/test/unit/globs.test.ts
@@ -0,0 +1,273 @@
+/**
+ * @fileoverview Unit tests for glob pattern matching utilities.
+ *
+ * Tests glob pattern matching and file filtering using picomatch and fast-glob:
+ * - defaultIgnore array with npm-packlist patterns (.git, node_modules, .env, etc.)
+ * - getGlobMatcher() creates cached matchers for glob patterns with picomatch
+ * - globStreamLicenses() streams license file paths matching LICENSE* patterns
+ * - Supports negative patterns (!*.test.js), multiple patterns, case-insensitive matching
+ * - Options: dot files, ignore patterns, recursive depth, base name matching
+ * - Matcher caching to avoid recompiling identical patterns
+ * - defaultIgnore is frozen (immutable) to prevent accidental modifications
+ * Tests validate pattern matching, exclusions, options handling, and edge cases.
+ * Used by Socket tools for file discovery and npm package analysis.
+ */
+
+import {
+  defaultIgnore,
+  getGlobMatcher,
+  globStreamLicenses,
+} from '@socketsecurity/lib/globs'
+import { describe, expect, it } from 'vitest'
+
+describe('globs', () => {
+  describe('defaultIgnore', () => {
+    it('should be an array', () => {
+      expect(Array.isArray(defaultIgnore)).toBe(true)
+    })
+
+    it('should contain common ignore patterns', () => {
+      expect(defaultIgnore).toContain('**/.git')
+      expect(defaultIgnore).toContain('**/.npmrc')
+      expect(defaultIgnore).toContain('**/node_modules')
+      expect(defaultIgnore).toContain('**/.DS_Store')
+    })
+
+    it('should include npm-packlist defaults', () => {
+      expect(defaultIgnore).toContain('**/.gitignore')
+      expect(defaultIgnore).toContain('**/.svn')
+      expect(defaultIgnore).toContain('**/CVS')
+      expect(defaultIgnore).toContain('**/npm-debug.log')
+    })
+
+    it('should include additional common ignores', () => {
+      expect(defaultIgnore).toContain('**/.env')
+      expect(defaultIgnore).toContain('**/.eslintcache')
+      expect(defaultIgnore).toContain('**/.vscode')
+      expect(defaultIgnore).toContain('**/Thumbs.db')
+    })
+
+    it('should be frozen', () => {
+      expect(Object.isFrozen(defaultIgnore)).toBe(true)
+    })
+
+    it('should not be modifiable', () => {
+      const originalLength = defaultIgnore.length
+      expect(() => {
+        ;(defaultIgnore as any).push('new-pattern')
+      }).toThrow()
+      expect(defaultIgnore.length).toBe(originalLength)
+    })
+
+    it('should have reasonable length', () => {
+      expect(defaultIgnore.length).toBeGreaterThan(10)
+      expect(defaultIgnore.length).toBeLessThan(100)
+    })
+
+    it('should contain glob patterns', () => {
+      for (const pattern of defaultIgnore) {
+        expect(typeof pattern).toBe('string')
+        expect(pattern.length).toBeGreaterThan(0)
+      }
+    })
+  })
+
+  describe('getGlobMatcher', () => {
+    it('should create matcher for single pattern', () => {
+      const matcher = getGlobMatcher('*.js')
+      expect(typeof matcher).toBe('function')
+    })
+
+    it('should match simple patterns', () => {
+      const matcher = getGlobMatcher('*.js')
+      expect(matcher('test.js')).toBe(true)
+      expect(matcher('test.ts')).toBe(false)
+    })
+
+    it('should handle array of patterns', () => {
+      const matcher = getGlobMatcher(['*.js', '*.ts'])
+      expect(matcher('test.js')).toBe(true)
+      expect(matcher('test.ts')).toBe(true)
+      expect(matcher('test.css')).toBe(false)
+    })
+
+    it('should handle negative patterns', () => {
+      const matcher = getGlobMatcher(['*.js', '!*.test.js'])
+      expect(matcher('app.js')).toBe(true)
+      expect(matcher('app.test.js')).toBe(false)
+    })
+
+    it('should cache matchers', () => {
+      const matcher1 = getGlobMatcher('*.js')
+      const matcher2 = getGlobMatcher('*.js')
+      expect(matcher1).toBe(matcher2)
+    })
+
+    it('should create different matchers for different patterns', () => {
+      const matcher1 = getGlobMatcher('*.js')
+      const matcher2 = getGlobMatcher('*.ts')
+      expect(matcher1).not.toBe(matcher2)
+    })
+
+    it('should handle options', () => {
+      const matcher = getGlobMatcher('*.JS', { nocase: true })
+      expect(matcher('test.js')).toBe(true)
+      expect(matcher('test.JS')).toBe(true)
+    })
+
+    it('should handle dot option', () => {
+      const matcher = getGlobMatcher('.*', { dot: true })
+      expect(typeof matcher).toBe('function')
+    })
+
+    it('should handle ignore option in negation', () => {
+      const matcher = getGlobMatcher('*.js', { ignore: ['*.test.js'] })
+      expect(typeof matcher).toBe('function')
+    })
+
+    it('should handle glob patterns', () => {
+      const matcher = getGlobMatcher('**/*.js')
+      expect(matcher('src/app.js')).toBe(true)
+      expect(matcher('src/utils/helper.js')).toBe(true)
+      expect(matcher('src/app.ts')).toBe(false)
+    })
+
+    it('should handle multiple negative patterns', () => {
+      const matcher = getGlobMatcher(['*.js', '!*.test.js', '!*.spec.js'])
+      expect(matcher('app.js')).toBe(true)
+      expect(matcher('app.test.js')).toBe(false)
+      expect(matcher('app.spec.js')).toBe(false)
+    })
+
+    it('should be case insensitive by default', () => {
+      const matcher = getGlobMatcher('*.js')
+      expect(matcher('TEST.JS')).toBe(true)
+      expect(matcher('test.js')).toBe(true)
+    })
+
+    it('should handle empty pattern array', () => {
+      const matcher = getGlobMatcher([])
+      expect(typeof matcher).toBe('function')
+    })
+
+    it('should handle complex patterns', () => {
+      const matcher = getGlobMatcher('src/**/*.{js,ts}')
+      expect(matcher('src/app.js')).toBe(true)
+      expect(matcher('src/utils/helper.ts')).toBe(true)
+      expect(matcher('test/app.js')).toBe(false)
+    })
+
+    it('should cache with different options separately', () => {
+      const matcher1 = getGlobMatcher('*.js', { dot: true })
+      const matcher2 = getGlobMatcher('*.js', { dot: false })
+      expect(matcher1).not.toBe(matcher2)
+    })
+
+    it('should handle patterns with special characters', () => {
+      const matcher = getGlobMatcher('test-*.js')
+      expect(matcher('test-foo.js')).toBe(true)
+      expect(matcher('test.js')).toBe(false)
+    })
+
+    it('should handle directory patterns', () => {
+      const matcher = getGlobMatcher('src/**')
+      expect(matcher('src/app.js')).toBe(true)
+      expect(matcher('src/utils/helper.js')).toBe(true)
+    })
+  })
+
+  describe('globStreamLicenses', () => {
+    it('should return a readable stream', () => {
+      const stream = globStreamLicenses(process.cwd())
+      expect(stream).toBeDefined()
+      expect(typeof stream.on).toBe('function')
+      expect(typeof stream.pipe).toBe('function')
+    })
+
+    it('should accept dirname parameter', () => {
+      expect(() => globStreamLicenses('.')).not.toThrow()
+      expect(() => globStreamLicenses('./src')).not.toThrow()
+    })
+
+    it('should accept options parameter', () => {
+      expect(() => globStreamLicenses('.', {})).not.toThrow()
+      expect(() => globStreamLicenses('.', { recursive: true })).not.toThrow()
+    })
+
+    it('should handle ignoreOriginals option', () => {
+      const stream = globStreamLicenses('.', { ignoreOriginals: true })
+      expect(stream).toBeDefined()
+    })
+
+    it('should handle recursive option', () => {
+      const stream = globStreamLicenses('.', { recursive: false })
+      expect(stream).toBeDefined()
+    })
+
+    it('should handle custom ignore patterns', () => {
+      const stream = globStreamLicenses('.', { ignore: ['**/node_modules/**'] })
+      expect(stream).toBeDefined()
+    })
+
+    it('should handle absolute option', () => {
+      const stream = globStreamLicenses('.', { absolute: false })
+      expect(stream).toBeDefined()
+    })
+
+    it('should handle dot option', () => {
+      const stream = globStreamLicenses('.', { dot: true })
+      expect(stream).toBeDefined()
+    })
+
+    it('should handle deep option', () => {
+      const stream = globStreamLicenses('.', { deep: 3 })
+      expect(stream).toBeDefined()
+    })
+
+    it('should handle cwd option', () => {
+      const stream = globStreamLicenses('.', { cwd: process.cwd() })
+      expect(stream).toBeDefined()
+    })
+
+    it('should handle multiple options together', () => {
+      const stream = globStreamLicenses('.', {
+        recursive: true,
+        ignoreOriginals: true,
+        dot: true,
+        absolute: true,
+      })
+      expect(stream).toBeDefined()
+    })
+
+    it('should be a function', () => {
+      expect(typeof globStreamLicenses).toBe('function')
+    })
+
+    it('should handle empty options', () => {
+      const stream = globStreamLicenses('.')
+      expect(stream).toBeDefined()
+      expect(typeof stream.on).toBe('function')
+    })
+  })
+
+  describe('integration', () => {
+    it('should have consistent behavior across calls', () => {
+      const matcher1 = getGlobMatcher('*.js')
+      const matcher2 = getGlobMatcher('*.js')
+      const testPath = 'test.js'
+
+      expect(matcher1(testPath)).toBe(matcher2(testPath))
+    })
+
+    it('should handle real-world patterns', () => {
+      const matcher = getGlobMatcher([
+        '**/*.js',
+        '!**/node_modules/**',
+        '!**/dist/**',
+      ])
+      expect(matcher('src/app.js')).toBe(true)
+      expect(matcher('node_modules/pkg/index.js')).toBe(false)
+      expect(matcher('dist/bundle.js')).toBe(false)
+    })
+  })
+})
diff --git a/test/unit/http-request.test.ts b/test/unit/http-request.test.ts
new file mode 100644
index 0000000..bf2bc12
--- /dev/null
+++ b/test/unit/http-request.test.ts
@@ -0,0 +1,957 @@
+/**
+ * @fileoverview Unit tests for HTTP/HTTPS request utilities.
+ *
+ * Tests HTTP client utilities with local test server:
+ * - httpRequest() low-level HTTP request function
+ * - httpGetText() fetches and returns text content
+ * - httpGetJson() fetches and parses JSON responses
+ * - httpDownload() downloads files to disk
+ * - Redirect following, timeout handling, error cases
+ * - Custom headers, user agent, retry logic
+ * Used by Socket tools for API communication (registry, GitHub, GHSA).
+ */
+
+import { promises as fs } from 'node:fs'
+import http from 'node:http'
+import type https from 'node:https'
+import path from 'node:path'
+
+import {
+  httpDownload,
+  httpGetJson,
+  httpGetText,
+  httpRequest,
+} from '@socketsecurity/lib/http-request'
+import { afterAll, beforeAll, describe, expect, it } from 'vitest'
+import { runWithTempDir } from './utils/temp-file-helper.mjs'
+
+// Test server setup
+let httpServer: http.Server
+let httpsServer: https.Server
+let httpPort: number
+let httpBaseUrl: string
+
+beforeAll(async () => {
+  // Create HTTP test server
+  await new Promise<void>(resolve => {
+    httpServer = http.createServer((req, res) => {
+      const url = req.url || ''
+
+      // Handle different test endpoints
+      if (url === '/json') {
+        res.writeHead(200, { 'Content-Type': 'application/json' })
+        res.end(JSON.stringify({ message: 'Hello, World!', status: 'success' }))
+      } else if (url === '/text') {
+        res.writeHead(200, { 'Content-Type': 'text/plain' })
+        res.end('Plain text response')
+      } else if (url === '/redirect') {
+        res.writeHead(302, { Location: '/text' })
+        res.end()
+      } else if (url === '/redirect-absolute') {
+        res.writeHead(302, { Location: `${httpBaseUrl}/text` })
+        res.end()
+      } else if (url === '/redirect-loop-1') {
+        res.writeHead(302, { Location: '/redirect-loop-2' })
+        res.end()
+      } else if (url === '/redirect-loop-2') {
+        res.writeHead(302, { Location: '/redirect-loop-3' })
+        res.end()
+      } else if (url === '/redirect-loop-3') {
+        res.writeHead(302, { Location: '/redirect-loop-4' })
+        res.end()
+      } else if (url === '/redirect-loop-4') {
+        res.writeHead(302, { Location: '/redirect-loop-5' })
+        res.end()
+      } else if (url === '/redirect-loop-5') {
+        res.writeHead(302, { Location: '/redirect-loop-6' })
+        res.end()
+      } else if (url === '/redirect-loop-6') {
+        res.writeHead(302, { Location: '/text' })
+        res.end()
+      } else if (url === '/not-found') {
+        res.writeHead(404, { 'Content-Type': 'text/plain' })
+        res.end('Not Found')
+      } else if (url === '/server-error') {
+        res.writeHead(500, { 'Content-Type': 'text/plain' })
+        res.end('Internal Server Error')
+      } else if (url === '/timeout') {
+        // Don't respond - simulate timeout
+        return
+      } else if (url === '/slow') {
+        // Respond after delay
+        setTimeout(() => {
+          res.writeHead(200, { 'Content-Type': 'text/plain' })
+          res.end('Slow response')
+        }, 100)
+      } else if (url === '/echo-method') {
+        res.writeHead(200, { 'Content-Type': 'text/plain' })
+        res.end(req.method)
+      } else if (url === '/echo-body') {
+        let body = ''
+        req.on('data', chunk => {
+          body += chunk.toString()
+        })
+        req.on('end', () => {
+          res.writeHead(200, { 'Content-Type': 'text/plain' })
+          res.end(body)
+        })
+      } else if (url === '/echo-headers') {
+        res.writeHead(200, { 'Content-Type': 'application/json' })
+        res.end(JSON.stringify(req.headers))
+      } else if (url === '/binary') {
+        res.writeHead(200, { 'Content-Type': 'application/octet-stream' })
+        const buffer = Buffer.from([0x00, 0x01, 0x02, 0x03, 0xff, 0xfe, 0xfd])
+        res.end(buffer)
+      } else if (url === '/download') {
+        const content = 'Download test content'
+        res.writeHead(200, {
+          'Content-Length': String(content.length),
+          'Content-Type': 'text/plain',
+        })
+        // Send data in chunks to test progress
+        const chunk1 = content.slice(0, 10)
+        const chunk2 = content.slice(10)
+        res.write(chunk1)
+        setTimeout(() => {
+          res.end(chunk2)
+        }, 10)
+      } else if (url === '/large-download') {
+        const content = 'X'.repeat(1000)
+        res.writeHead(200, {
+          'Content-Length': String(content.length),
+          'Content-Type': 'text/plain',
+        })
+        res.end(content)
+      } else if (url === '/download-no-length') {
+        res.writeHead(200, { 'Content-Type': 'text/plain' })
+        res.end('No content length')
+      } else if (url === '/invalid-json') {
+        res.writeHead(200, { 'Content-Type': 'application/json' })
+        res.end('not valid json{')
+      } else if (url === '/post-success') {
+        if (req.method === 'POST') {
+          res.writeHead(201, { 'Content-Type': 'application/json' })
+          res.end(JSON.stringify({ created: true }))
+        } else {
+          res.writeHead(405)
+          res.end()
+        }
+      } else if (url === '/no-redirect') {
+        res.writeHead(301, { Location: '/text' })
+        res.end()
+      } else {
+        res.writeHead(200, { 'Content-Type': 'text/plain' })
+        res.end('OK')
+      }
+    })
+
+    httpServer.listen(0, () => {
+      const address = httpServer.address()
+      if (address && typeof address === 'object') {
+        httpPort = address.port
+        httpBaseUrl = `http://localhost:${httpPort}`
+      }
+      resolve()
+    })
+  })
+
+  // Create HTTPS test server (self-signed)
+  await new Promise<void>(resolve => {
+    // For testing, we'll skip HTTPS server as it requires certificates
+    // In production tests, you would set up proper certificates
+    resolve()
+  })
+})
+
+afterAll(async () => {
+  await new Promise<void>(resolve => {
+    httpServer.close(() => resolve())
+  })
+  if (httpsServer) {
+    await new Promise<void>(resolve => {
+      httpsServer.close(() => resolve())
+    })
+  }
+})
+
+describe('http-request', () => {
+  describe('httpRequest', () => {
+    it('should make a simple GET request', async () => {
+      const response = await httpRequest(`${httpBaseUrl}/text`)
+
+      expect(response.status).toBe(200)
+      expect(response.ok).toBe(true)
+      expect(response.statusText).toBe('OK')
+      expect(response.text()).toBe('Plain text response')
+    })
+
+    it('should parse JSON response', async () => {
+      const response = await httpRequest(`${httpBaseUrl}/json`)
+
+      expect(response.status).toBe(200)
+      expect(response.ok).toBe(true)
+      const data = response.json<{ message: string; status: string }>()
+      expect(data.message).toBe('Hello, World!')
+      expect(data.status).toBe('success')
+    })
+
+    it('should handle 404 errors', async () => {
+      const response = await httpRequest(`${httpBaseUrl}/not-found`)
+
+      expect(response.status).toBe(404)
+      expect(response.ok).toBe(false)
+      expect(response.statusText).toBe('Not Found')
+      expect(response.text()).toBe('Not Found')
+    })
+
+    it('should handle 500 errors', async () => {
+      const response = await httpRequest(`${httpBaseUrl}/server-error`)
+
+      expect(response.status).toBe(500)
+      expect(response.ok).toBe(false)
+      expect(response.text()).toBe('Internal Server Error')
+    })
+
+    it('should follow redirects by default', async () => {
+      const response = await httpRequest(`${httpBaseUrl}/redirect`)
+
+      expect(response.status).toBe(200)
+      expect(response.text()).toBe('Plain text response')
+    })
+
+    it('should follow absolute URL redirects', async () => {
+      const response = await httpRequest(`${httpBaseUrl}/redirect-absolute`)
+
+      expect(response.status).toBe(200)
+      expect(response.text()).toBe('Plain text response')
+    })
+
+    it('should not follow redirects when followRedirects is false', async () => {
+      const response = await httpRequest(`${httpBaseUrl}/no-redirect`, {
+        followRedirects: false,
+      })
+
+      expect(response.status).toBe(301)
+      expect(response.ok).toBe(false)
+      expect(response.headers.location).toBe('/text')
+    })
+
+    it('should handle too many redirects', async () => {
+      await expect(
+        httpRequest(`${httpBaseUrl}/redirect-loop-1`, { maxRedirects: 3 }),
+      ).rejects.toThrow(/Too many redirects/)
+    })
+
+    it('should make POST request', async () => {
+      const response = await httpRequest(`${httpBaseUrl}/post-success`, {
+        method: 'POST',
+      })
+
+      expect(response.status).toBe(201)
+      expect(response.json<{ created: boolean }>().created).toBe(true)
+    })
+
+    it('should send request body as string', async () => {
+      const body = JSON.stringify({ test: 'data' })
+      const response = await httpRequest(`${httpBaseUrl}/echo-body`, {
+        body,
+        method: 'POST',
+      })
+
+      expect(response.text()).toBe(body)
+    })
+
+    it('should send request body as Buffer', async () => {
+      const buffer = Buffer.from('binary data')
+      const response = await httpRequest(`${httpBaseUrl}/echo-body`, {
+        body: buffer,
+        method: 'POST',
+      })
+
+      expect(response.text()).toBe('binary data')
+    })
+
+    it('should send custom headers', async () => {
+      const response = await httpRequest(`${httpBaseUrl}/echo-headers`, {
+        headers: {
+          'X-Custom-Header': 'custom-value',
+        },
+      })
+
+      const headers = response.json<Record<string, string>>()
+      expect(headers['x-custom-header']).toBe('custom-value')
+      expect(headers['user-agent']).toBe('socket-registry/1.0')
+    })
+
+    it('should handle custom User-Agent', async () => {
+      const response = await httpRequest(`${httpBaseUrl}/echo-headers`, {
+        headers: {
+          'User-Agent': 'my-custom-agent',
+        },
+      })
+
+      const headers = response.json<Record<string, string>>()
+      expect(headers['user-agent']).toBe('my-custom-agent')
+    })
+
+    it('should support different HTTP methods', async () => {
+      const methods = ['GET', 'POST', 'PUT', 'DELETE', 'PATCH']
+
+      const results = await Promise.all(
+        methods.map(async method => {
+          const response = await httpRequest(`${httpBaseUrl}/echo-method`, {
+            method,
+          })
+          return { method, text: response.text() }
+        }),
+      )
+
+      for (const result of results) {
+        expect(result.text).toBe(result.method)
+      }
+    })
+
+    it('should get arrayBuffer from response', async () => {
+      const response = await httpRequest(`${httpBaseUrl}/binary`)
+
+      const arrayBuffer = response.arrayBuffer()
+      const view = new Uint8Array(arrayBuffer)
+      expect(Array.from(view)).toEqual([
+        0x00, 0x01, 0x02, 0x03, 0xff, 0xfe, 0xfd,
+      ])
+    })
+
+    it('should expose body as Buffer', async () => {
+      const response = await httpRequest(`${httpBaseUrl}/binary`)
+
+      expect(Buffer.isBuffer(response.body)).toBe(true)
+      expect(Array.from(response.body)).toEqual([
+        0x00, 0x01, 0x02, 0x03, 0xff, 0xfe, 0xfd,
+      ])
+    })
+
+    it('should handle timeout', async () => {
+      await expect(
+        httpRequest(`${httpBaseUrl}/timeout`, { timeout: 100 }),
+      ).rejects.toThrow(/timed out after 100ms/)
+    })
+
+    it('should complete before timeout', async () => {
+      const response = await httpRequest(`${httpBaseUrl}/slow`, {
+        timeout: 2000,
+      })
+      expect(response.text()).toBe('Slow response')
+    })
+
+    it('should retry on failure', async () => {
+      let attemptCount = 0
+      const testServer = http.createServer((req, res) => {
+        attemptCount++
+        if (attemptCount < 3) {
+          // Fail first 2 attempts
+          req.socket.destroy()
+        } else {
+          // Succeed on 3rd attempt
+          res.writeHead(200)
+          res.end('Success after retries')
+        }
+      })
+
+      await new Promise<void>(resolve => {
+        testServer.listen(0, () => resolve())
+      })
+
+      const address = testServer.address()
+      const testPort = address && typeof address === 'object' ? address.port : 0
+
+      try {
+        const response = await httpRequest(`http://localhost:${testPort}/`, {
+          retries: 3,
+          retryDelay: 10,
+        })
+        expect(response.text()).toBe('Success after retries')
+        expect(attemptCount).toBe(3)
+      } finally {
+        await new Promise<void>(resolve => {
+          testServer.close(() => resolve())
+        })
+      }
+    })
+
+    it('should fail after all retries exhausted', async () => {
+      let attemptCount = 0
+      const testServer = http.createServer((req, _res) => {
+        attemptCount++
+        req.socket.destroy()
+      })
+
+      await new Promise<void>(resolve => {
+        testServer.listen(0, () => resolve())
+      })
+
+      const address = testServer.address()
+      const testPort = address && typeof address === 'object' ? address.port : 0
+
+      try {
+        await expect(
+          httpRequest(`http://localhost:${testPort}/`, {
+            retries: 2,
+            retryDelay: 10,
+          }),
+        ).rejects.toThrow(/HTTP request failed/)
+        expect(attemptCount).toBe(3) // Initial attempt + 2 retries
+      } finally {
+        await new Promise<void>(resolve => {
+          testServer.close(() => resolve())
+        })
+      }
+    })
+
+    it('should handle network errors', async () => {
+      await expect(
+        httpRequest('http://localhost:1/nonexistent', { timeout: 100 }),
+      ).rejects.toThrow(/HTTP request failed/)
+    })
+
+    it('should handle invalid URLs gracefully', async () => {
+      await expect(httpRequest('not-a-url')).rejects.toThrow()
+    })
+
+    it('should use exponential backoff for retries', async () => {
+      const startTime = Date.now()
+      let attemptCount = 0
+
+      const testServer = http.createServer((req, _res) => {
+        attemptCount++
+        req.socket.destroy()
+      })
+
+      await new Promise<void>(resolve => {
+        testServer.listen(0, () => resolve())
+      })
+
+      const address = testServer.address()
+      const testPort = address && typeof address === 'object' ? address.port : 0
+
+      try {
+        await httpRequest(`http://localhost:${testPort}/`, {
+          retries: 2,
+          retryDelay: 100,
+        }).catch(() => {
+          // Expected to fail
+        })
+
+        const elapsed = Date.now() - startTime
+        // Should wait at least 100ms + 200ms = 300ms for exponential backoff
+        expect(elapsed).toBeGreaterThanOrEqual(200)
+        expect(attemptCount).toBe(3)
+      } finally {
+        await new Promise<void>(resolve => {
+          testServer.close(() => resolve())
+        })
+      }
+    })
+
+    it('should handle connection close without response', async () => {
+      const testServer = http.createServer((_req, _res) => {
+        // Close connection without sending response
+        _res.socket?.destroy()
+      })
+
+      await new Promise<void>(resolve => {
+        testServer.listen(0, () => resolve())
+      })
+
+      const address = testServer.address()
+      const testPort = address && typeof address === 'object' ? address.port : 0
+
+      try {
+        await expect(
+          httpRequest(`http://localhost:${testPort}/`),
+        ).rejects.toThrow(/HTTP request failed/)
+      } finally {
+        await new Promise<void>(resolve => {
+          testServer.close(() => resolve())
+        })
+      }
+    })
+  })
+
+  describe('httpDownload', () => {
+    it('should download file to disk', async () => {
+      await runWithTempDir(async tmpDir => {
+        const destPath = path.join(tmpDir, 'download.txt')
+        const result = await httpDownload(`${httpBaseUrl}/download`, destPath)
+
+        expect(result.path).toBe(destPath)
+        expect(result.size).toBeGreaterThan(0)
+
+        const content = await fs.readFile(destPath, 'utf8')
+        expect(content).toBe('Download test content')
+      }, 'httpDownload-basic-')
+    })
+
+    it('should track download progress', async () => {
+      await runWithTempDir(async tmpDir => {
+        const destPath = path.join(tmpDir, 'progress.txt')
+        const progressUpdates: Array<{ downloaded: number; total: number }> = []
+
+        await httpDownload(`${httpBaseUrl}/large-download`, destPath, {
+          onProgress: (downloaded, total) => {
+            progressUpdates.push({ downloaded, total })
+          },
+        })
+
+        expect(progressUpdates.length).toBeGreaterThan(0)
+        // Last update should have full size
+        const lastUpdate = progressUpdates[progressUpdates.length - 1]
+        expect(lastUpdate.downloaded).toBe(lastUpdate.total)
+        expect(lastUpdate.total).toBe(1000)
+      }, 'httpDownload-progress-')
+    })
+
+    it('should not call progress callback when no content-length', async () => {
+      await runWithTempDir(async tmpDir => {
+        const destPath = path.join(tmpDir, 'no-length.txt')
+        let progressCalled = false
+
+        await httpDownload(`${httpBaseUrl}/download-no-length`, destPath, {
+          onProgress: () => {
+            progressCalled = true
+          },
+        })
+
+        expect(progressCalled).toBe(false)
+        const content = await fs.readFile(destPath, 'utf8')
+        expect(content).toBe('No content length')
+      }, 'httpDownload-no-length-')
+    })
+
+    it('should handle download errors', async () => {
+      await runWithTempDir(async tmpDir => {
+        const destPath = path.join(tmpDir, 'error.txt')
+
+        await expect(
+          httpDownload(`${httpBaseUrl}/not-found`, destPath),
+        ).rejects.toThrow(/Download failed: HTTP 404/)
+      }, 'httpDownload-error-')
+    })
+
+    it('should handle download timeout', async () => {
+      await runWithTempDir(async tmpDir => {
+        const destPath = path.join(tmpDir, 'timeout.txt')
+
+        await expect(
+          httpDownload(`${httpBaseUrl}/timeout`, destPath, { timeout: 100 }),
+        ).rejects.toThrow(/timed out after 100ms/)
+      }, 'httpDownload-timeout-')
+    })
+
+    it('should retry download on failure', async () => {
+      let attemptCount = 0
+      const testServer = http.createServer((req, res) => {
+        attemptCount++
+        if (attemptCount < 3) {
+          req.socket.destroy()
+        } else {
+          res.writeHead(200, { 'Content-Length': '7' })
+          res.end('Success')
+        }
+      })
+
+      await new Promise<void>(resolve => {
+        testServer.listen(0, () => resolve())
+      })
+
+      const address = testServer.address()
+      const testPort = address && typeof address === 'object' ? address.port : 0
+
+      try {
+        await runWithTempDir(async tmpDir => {
+          const destPath = path.join(tmpDir, 'retry.txt')
+          const result = await httpDownload(
+            `http://localhost:${testPort}/`,
+            destPath,
+            {
+              retries: 3,
+              retryDelay: 10,
+            },
+          )
+
+          expect(result.size).toBe(7)
+          expect(attemptCount).toBe(3)
+
+          const content = await fs.readFile(destPath, 'utf8')
+          expect(content).toBe('Success')
+        }, 'httpDownload-retry-')
+      } finally {
+        await new Promise<void>(resolve => {
+          testServer.close(() => resolve())
+        })
+      }
+    })
+
+    it('should fail after all download retries exhausted', async () => {
+      let attemptCount = 0
+      const testServer = http.createServer((req, _res) => {
+        attemptCount++
+        req.socket.destroy()
+      })
+
+      await new Promise<void>(resolve => {
+        testServer.listen(0, () => resolve())
+      })
+
+      const address = testServer.address()
+      const testPort = address && typeof address === 'object' ? address.port : 0
+
+      try {
+        await runWithTempDir(async tmpDir => {
+          const destPath = path.join(tmpDir, 'fail.txt')
+
+          await expect(
+            httpDownload(`http://localhost:${testPort}/`, destPath, {
+              retries: 2,
+              retryDelay: 10,
+            }),
+          ).rejects.toThrow(/HTTP download failed/)
+
+          expect(attemptCount).toBe(3)
+        }, 'httpDownload-fail-')
+      } finally {
+        await new Promise<void>(resolve => {
+          testServer.close(() => resolve())
+        })
+      }
+    })
+
+    it('should send custom headers in download', async () => {
+      await runWithTempDir(async tmpDir => {
+        const destPath = path.join(tmpDir, 'headers.txt')
+
+        // Use main test server - headers are already checked by echo-headers endpoint
+        await httpDownload(`${httpBaseUrl}/download`, destPath, {
+          headers: { 'X-Custom-Header': 'test-value' },
+        })
+
+        const content = await fs.readFile(destPath, 'utf8')
+        expect(content).toBe('Download test content')
+      }, 'httpDownload-headers-')
+    })
+
+    it('should handle file write errors', async () => {
+      await runWithTempDir(async tmpDir => {
+        // Try to write to an invalid path
+        const destPath = path.join(tmpDir, 'nonexistent', 'nested', 'file.txt')
+
+        await expect(
+          httpDownload(`${httpBaseUrl}/download`, destPath),
+        ).rejects.toThrow(/Failed to write file/)
+      }, 'httpDownload-write-error-')
+    })
+
+    it('should handle response errors during download', async () => {
+      const testServer = http.createServer((_req, _res) => {
+        _res.writeHead(200, { 'Content-Length': '100' })
+        _res.write('partial')
+        // Simulate error during transmission
+        setTimeout(() => {
+          _res.destroy()
+        }, 10)
+      })
+
+      await new Promise<void>(resolve => {
+        testServer.listen(0, () => resolve())
+      })
+
+      const address = testServer.address()
+      const testPort = address && typeof address === 'object' ? address.port : 0
+
+      try {
+        await runWithTempDir(async tmpDir => {
+          const destPath = path.join(tmpDir, 'error.txt')
+
+          await expect(
+            httpDownload(`http://localhost:${testPort}/`, destPath),
+          ).rejects.toThrow()
+        }, 'httpDownload-response-error-')
+      } finally {
+        await new Promise<void>(resolve => {
+          testServer.close(() => resolve())
+        })
+      }
+    })
+
+    it('should use default timeout of 120 seconds', async () => {
+      await runWithTempDir(async tmpDir => {
+        const destPath = path.join(tmpDir, 'default-timeout.txt')
+
+        // This should succeed quickly with default timeout
+        const result = await httpDownload(`${httpBaseUrl}/download`, destPath)
+        expect(result.size).toBeGreaterThan(0)
+      }, 'httpDownload-default-timeout-')
+    })
+  })
+
+  describe('httpGetJson', () => {
+    it('should get and parse JSON', async () => {
+      const data = await httpGetJson<{ message: string; status: string }>(
+        `${httpBaseUrl}/json`,
+      )
+
+      expect(data.message).toBe('Hello, World!')
+      expect(data.status).toBe('success')
+    })
+
+    it('should throw on non-ok response', async () => {
+      await expect(httpGetJson(`${httpBaseUrl}/not-found`)).rejects.toThrow(
+        /HTTP 404/,
+      )
+    })
+
+    it('should throw on invalid JSON', async () => {
+      await expect(httpGetJson(`${httpBaseUrl}/invalid-json`)).rejects.toThrow(
+        /Failed to parse JSON/,
+      )
+    })
+
+    it('should pass options to httpRequest', async () => {
+      const data = await httpGetJson(`${httpBaseUrl}/json`, {
+        headers: { 'X-Test': 'value' },
+        timeout: 5000,
+      })
+
+      expect(data).toBeDefined()
+    })
+
+    it('should support retries', async () => {
+      let attemptCount = 0
+      const testServer = http.createServer((req, res) => {
+        attemptCount++
+        if (attemptCount < 2) {
+          req.socket.destroy()
+        } else {
+          res.writeHead(200, { 'Content-Type': 'application/json' })
+          res.end(JSON.stringify({ retries: 'worked' }))
+        }
+      })
+
+      await new Promise<void>(resolve => {
+        testServer.listen(0, () => resolve())
+      })
+
+      const address = testServer.address()
+      const testPort = address && typeof address === 'object' ? address.port : 0
+
+      try {
+        const data = await httpGetJson<{ retries: string }>(
+          `http://localhost:${testPort}/`,
+          {
+            retries: 2,
+            retryDelay: 10,
+          },
+        )
+
+        expect(data.retries).toBe('worked')
+        expect(attemptCount).toBe(2)
+      } finally {
+        await new Promise<void>(resolve => {
+          testServer.close(() => resolve())
+        })
+      }
+    })
+
+    it('should handle server errors', async () => {
+      await expect(httpGetJson(`${httpBaseUrl}/server-error`)).rejects.toThrow(
+        /HTTP 500/,
+      )
+    })
+  })
+
+  describe('httpGetText', () => {
+    it('should get text response', async () => {
+      const text = await httpGetText(`${httpBaseUrl}/text`)
+
+      expect(text).toBe('Plain text response')
+    })
+
+    it('should throw on non-ok response', async () => {
+      await expect(httpGetText(`${httpBaseUrl}/not-found`)).rejects.toThrow(
+        /HTTP 404/,
+      )
+    })
+
+    it('should pass options to httpRequest', async () => {
+      const text = await httpGetText(`${httpBaseUrl}/text`, {
+        headers: { 'X-Test': 'value' },
+        timeout: 5000,
+      })
+
+      expect(text).toBe('Plain text response')
+    })
+
+    it('should support retries', async () => {
+      let attemptCount = 0
+      const testServer = http.createServer((req, res) => {
+        attemptCount++
+        if (attemptCount < 2) {
+          req.socket.destroy()
+        } else {
+          res.writeHead(200, { 'Content-Type': 'text/plain' })
+          res.end('Retry success')
+        }
+      })
+
+      await new Promise<void>(resolve => {
+        testServer.listen(0, () => resolve())
+      })
+
+      const address = testServer.address()
+      const testPort = address && typeof address === 'object' ? address.port : 0
+
+      try {
+        const text = await httpGetText(`http://localhost:${testPort}/`, {
+          retries: 2,
+          retryDelay: 10,
+        })
+
+        expect(text).toBe('Retry success')
+        expect(attemptCount).toBe(2)
+      } finally {
+        await new Promise<void>(resolve => {
+          testServer.close(() => resolve())
+        })
+      }
+    })
+
+    it('should handle server errors', async () => {
+      await expect(httpGetText(`${httpBaseUrl}/server-error`)).rejects.toThrow(
+        /HTTP 500/,
+      )
+    })
+
+    it('should handle binary content as text', async () => {
+      const text = await httpGetText(`${httpBaseUrl}/binary`)
+
+      expect(text).toBeDefined()
+      expect(text.length).toBeGreaterThan(0)
+    })
+  })
+
+  describe('edge cases', () => {
+    it('should handle empty response body', async () => {
+      const testServer = http.createServer((_req, _res) => {
+        _res.writeHead(204)
+        _res.end()
+      })
+
+      await new Promise<void>(resolve => {
+        testServer.listen(0, () => resolve())
+      })
+
+      const address = testServer.address()
+      const testPort = address && typeof address === 'object' ? address.port : 0
+
+      try {
+        const response = await httpRequest(`http://localhost:${testPort}/`)
+        expect(response.status).toBe(204)
+        expect(response.body.length).toBe(0)
+        expect(response.text()).toBe('')
+      } finally {
+        await new Promise<void>(resolve => {
+          testServer.close(() => resolve())
+        })
+      }
+    })
+
+    it('should handle large response bodies', async () => {
+      const testServer = http.createServer((_req, res) => {
+        const largeContent = 'A'.repeat(1024 * 1024) // 1MB
+        res.writeHead(200)
+        res.end(largeContent)
+      })
+
+      await new Promise<void>(resolve => {
+        testServer.listen(0, () => resolve())
+      })
+
+      const address = testServer.address()
+      const testPort = address && typeof address === 'object' ? address.port : 0
+
+      try {
+        const response = await httpRequest(`http://localhost:${testPort}/`)
+        expect(response.body.length).toBe(1024 * 1024)
+        expect(response.text().length).toBe(1024 * 1024)
+      } finally {
+        await new Promise<void>(resolve => {
+          testServer.close(() => resolve())
+        })
+      }
+    })
+
+    it('should handle query parameters in URL', async () => {
+      const response = await httpRequest(`${httpBaseUrl}/text?foo=bar&baz=qux`)
+      expect(response.status).toBe(200)
+    })
+
+    it('should handle URL with hash', async () => {
+      const response = await httpRequest(`${httpBaseUrl}/text#section`)
+      expect(response.status).toBe(200)
+    })
+
+    it('should handle 3xx status codes that are not redirects', async () => {
+      const testServer = http.createServer((_req, res) => {
+        res.writeHead(304) // Not Modified
+        res.end()
+      })
+
+      await new Promise<void>(resolve => {
+        testServer.listen(0, () => resolve())
+      })
+
+      const address = testServer.address()
+      const testPort = address && typeof address === 'object' ? address.port : 0
+
+      try {
+        const response = await httpRequest(`http://localhost:${testPort}/`)
+        expect(response.status).toBe(304)
+        expect(response.ok).toBe(false)
+      } finally {
+        await new Promise<void>(resolve => {
+          testServer.close(() => resolve())
+        })
+      }
+    })
+
+    it('should handle redirect with maxRedirects set to 0', async () => {
+      await expect(
+        httpRequest(`${httpBaseUrl}/redirect`, { maxRedirects: 0 }),
+      ).rejects.toThrow(/Too many redirects/)
+    })
+
+    it('should handle response with multiple header values', async () => {
+      const testServer = http.createServer((_req, res) => {
+        res.setHeader('Set-Cookie', ['cookie1=value1', 'cookie2=value2'])
+        res.writeHead(200)
+        res.end('OK')
+      })
+
+      await new Promise<void>(resolve => {
+        testServer.listen(0, () => resolve())
+      })
+
+      const address = testServer.address()
+      const testPort = address && typeof address === 'object' ? address.port : 0
+
+      try {
+        const response = await httpRequest(`http://localhost:${testPort}/`)
+        expect(response.headers['set-cookie']).toBeDefined()
+        expect(Array.isArray(response.headers['set-cookie'])).toBe(true)
+      } finally {
+        await new Promise<void>(resolve => {
+          testServer.close(() => resolve())
+        })
+      }
+    })
+  })
+})
diff --git a/test/registry/ipc.test.ts b/test/unit/ipc.test.ts
similarity index 84%
rename from test/registry/ipc.test.ts
rename to test/unit/ipc.test.ts
index b6a2010..fd732d7 100644
--- a/test/registry/ipc.test.ts
+++ b/test/unit/ipc.test.ts
@@ -1,5 +1,14 @@
 /**
- * @fileoverview Unit tests for IPC (Inter-Process Communication) module.
+ * @fileoverview Unit tests for Inter-Process Communication utilities.
+ *
+ * Tests IPC (Inter-Process Communication) utilities:
+ * - createIpcChannelId() generates unique channel IDs
+ * - createIpcMessage(), parseIpcMessage() for message serialization
+ * - writeIpcStub(), readIpcStub() for file-based IPC
+ * - getIpcStubPath() resolves IPC stub file paths
+ * - hasIpcChannel() checks for active channels
+ * - cleanupIpcStubs() removes stale stub files
+ * Used by Socket CLI for parent-child process communication.
  */
 
 import { promises as fs } from 'node:fs'
@@ -15,9 +24,10 @@ import {
   parseIpcMessage,
   readIpcStub,
   writeIpcStub,
-} from '@socketsecurity/lib/ipc'
+} from '../../src/ipc'
+import { resetPaths, setPath } from '../../src/paths/rewire'
 import { describe, expect, it } from 'vitest'
-import { runWithTempDir } from '../utils/temp-file-helper'
+import { runWithTempDir } from './utils/temp-file-helper.mjs'
 
 describe('ipc', () => {
   describe('createIpcChannelId', () => {
@@ -63,8 +73,7 @@ describe('ipc', () => {
     it('should write stub file with valid data', async () => {
       await runWithTempDir(async tmpDir => {
         // Override temp directory for testing.
-        const originalTmpdir = os.tmpdir
-        os.tmpdir = () => tmpDir
+        setPath('tmpdir', tmpDir)
 
         try {
           const data = { apiToken: 'test-token', config: { foo: 'bar' } }
@@ -79,15 +88,14 @@ describe('ipc', () => {
           expect(parsed.timestamp).toBeTypeOf('number')
           expect(parsed.data).toEqual(data)
         } finally {
-          os.tmpdir = originalTmpdir
+          resetPaths()
         }
       }, 'ipc-write-test-')
     })
 
     it('should create directory structure if not exists', async () => {
       await runWithTempDir(async tmpDir => {
-        const originalTmpdir = os.tmpdir
-        os.tmpdir = () => tmpDir
+        setPath('tmpdir', tmpDir)
 
         try {
           const stubPath = await writeIpcStub('new-app', {
@@ -99,7 +107,7 @@ describe('ipc', () => {
             .catch(() => false)
           expect(dirExists).toBe(true)
         } finally {
-          os.tmpdir = originalTmpdir
+          resetPaths()
         }
       }, 'ipc-mkdir-test-')
     })
@@ -108,8 +116,7 @@ describe('ipc', () => {
   describe('readIpcStub', () => {
     it('should read valid stub file', async () => {
       await runWithTempDir(async tmpDir => {
-        const originalTmpdir = os.tmpdir
-        os.tmpdir = () => tmpDir
+        setPath('tmpdir', tmpDir)
 
         try {
           const testData = { message: 'Hello IPC!' }
@@ -118,7 +125,7 @@ describe('ipc', () => {
           const readData = await readIpcStub(stubPath)
           expect(readData).toEqual(testData)
         } finally {
-          os.tmpdir = originalTmpdir
+          resetPaths()
         }
       }, 'ipc-read-test-')
     })
@@ -140,8 +147,7 @@ describe('ipc', () => {
 
     it('should return null and cleanup stale files', async () => {
       await runWithTempDir(async tmpDir => {
-        const originalTmpdir = os.tmpdir
-        os.tmpdir = () => tmpDir
+        setPath('tmpdir', tmpDir)
 
         try {
           const stubPath = await writeIpcStub('stale-test', {
@@ -149,8 +155,8 @@ describe('ipc', () => {
           })
 
           // Make the file stale by modifying its timestamp.
-          // 6 minutes ago.
-          const staleTimestamp = Date.now() - 6 * 60 * 1000
+          // 10 minutes ago (well past the 5-minute threshold for robustness).
+          const staleTimestamp = Date.now() - 10 * 60 * 1000
           const staleStub = {
             data: { data: 'old' },
             pid: process.pid,
@@ -172,17 +178,19 @@ describe('ipc', () => {
             .catch(() => false)
           expect(exists).toBe(false)
         } finally {
-          os.tmpdir = originalTmpdir
+          resetPaths()
         }
       }, 'ipc-stale-test-')
     })
   })
 
   describe('cleanupIpcStubs', () => {
-    it('should clean up stale stub files', async () => {
+    // Flaky: async file deletion timing varies across different environments
+    // Retry up to 3 times to handle timing issues
+    // Note: Weird that deletion doesn't complete despite awaits - possible OS-level caching
+    it('should clean up stale stub files', { retry: 3 }, async () => {
       await runWithTempDir(async tmpDir => {
-        const originalTmpdir = os.tmpdir
-        os.tmpdir = () => tmpDir
+        setPath('tmpdir', tmpDir)
 
         try {
           // Create some stub files.
@@ -196,8 +204,8 @@ describe('ipc', () => {
           // Make one file stale.
           const dir = path.dirname(stubPath1)
           const staleFile = path.join(dir, 'stub-99999.json')
-          // 6 minutes ago.
-          const staleTimestamp = Date.now() - 6 * 60 * 1000
+          // 10 minutes ago (well past the 5-minute threshold for robustness).
+          const staleTimestamp = Date.now() - 10 * 60 * 1000
           const staleStub = {
             data: { test: 'stale' },
             pid: 99_999,
@@ -212,13 +220,20 @@ describe('ipc', () => {
           const staleTime = new Date(staleTimestamp)
           await fs.utimes(staleFile, staleTime, staleTime)
 
+          // Small delay to ensure filesystem operations are fully committed
+          await new Promise(resolve => setTimeout(resolve, 50))
+
           await cleanupIpcStubs('cleanup-test')
 
-          // Stale file should be deleted.
+          // Add delay to allow async deletion to complete in slow CI environments
+          await new Promise(resolve => setTimeout(resolve, 100))
+
+          // Stale file should be deleted
           const staleExists = await fs
             .access(staleFile)
             .then(() => true)
             .catch(() => false)
+
           expect(staleExists).toBe(false)
 
           // Fresh files should still exist.
@@ -233,7 +248,7 @@ describe('ipc', () => {
           expect(fresh1Exists).toBe(true)
           expect(fresh2Exists).toBe(true)
         } finally {
-          os.tmpdir = originalTmpdir
+          resetPaths()
         }
       }, 'ipc-cleanup-test-')
     })
diff --git a/test/unit/json.test.ts b/test/unit/json.test.ts
new file mode 100644
index 0000000..a239d1d
--- /dev/null
+++ b/test/unit/json.test.ts
@@ -0,0 +1,753 @@
+/**
+ * @fileoverview Unit tests for JSON parsing utilities.
+ *
+ * Tests JSON parsing with Buffer support and BOM handling:
+ * - jsonParse() parses JSON strings or UTF-8 Buffers with automatic BOM stripping
+ * - isJsonPrimitive() type guard for null, boolean, number, string
+ * - Buffer detection via duck-typing (checks length, copy, slice, constructor.isBuffer)
+ * - BOM (Byte Order Mark U+FEFF) stripped from beginning of input
+ * - Optional filepath for enhanced error messages ("/path/to/file.json: Unexpected token...")
+ * - Optional reviver function for custom value transformations
+ * - Optional throws flag to return undefined instead of throwing on errors
+ * Tests cover valid/invalid JSON, Buffer encoding, error handling, revivers, and edge cases
+ * including empty strings, special characters, unicode, and very large JSON payloads.
+ */
+
+import { isJsonPrimitive, jsonParse } from '@socketsecurity/lib/json'
+import { describe, expect, it } from 'vitest'
+
+describe('json', () => {
+  describe('isJsonPrimitive', () => {
+    it('should return true for null', () => {
+      expect(isJsonPrimitive(null)).toBe(true)
+    })
+
+    it('should return true for boolean values', () => {
+      expect(isJsonPrimitive(true)).toBe(true)
+      expect(isJsonPrimitive(false)).toBe(true)
+    })
+
+    it('should return true for numbers', () => {
+      expect(isJsonPrimitive(0)).toBe(true)
+      expect(isJsonPrimitive(42)).toBe(true)
+      expect(isJsonPrimitive(-1)).toBe(true)
+      expect(isJsonPrimitive(3.14)).toBe(true)
+      expect(isJsonPrimitive(Number.NaN)).toBe(true)
+      expect(isJsonPrimitive(Number.POSITIVE_INFINITY)).toBe(true)
+      expect(isJsonPrimitive(Number.NEGATIVE_INFINITY)).toBe(true)
+    })
+
+    it('should return true for strings', () => {
+      expect(isJsonPrimitive('')).toBe(true)
+      expect(isJsonPrimitive('hello')).toBe(true)
+      expect(isJsonPrimitive('123')).toBe(true)
+    })
+
+    it('should return false for undefined', () => {
+      expect(isJsonPrimitive(undefined)).toBe(false)
+    })
+
+    it('should return false for objects', () => {
+      expect(isJsonPrimitive({})).toBe(false)
+      expect(isJsonPrimitive({ key: 'value' })).toBe(false)
+    })
+
+    it('should return false for arrays', () => {
+      expect(isJsonPrimitive([])).toBe(false)
+      expect(isJsonPrimitive([1, 2, 3])).toBe(false)
+    })
+
+    it('should return false for functions', () => {
+      expect(isJsonPrimitive(() => {})).toBe(false)
+    })
+
+    it('should return false for symbols', () => {
+      expect(isJsonPrimitive(Symbol('test'))).toBe(false)
+    })
+
+    it('should return false for BigInt', () => {
+      expect(isJsonPrimitive(BigInt(123))).toBe(false)
+    })
+  })
+
+  describe('jsonParse', () => {
+    describe('valid JSON parsing', () => {
+      it('should parse valid JSON string', () => {
+        const result = jsonParse('{"key":"value"}')
+        expect(result).toEqual({ key: 'value' })
+      })
+
+      it('should parse JSON array', () => {
+        const result = jsonParse('[1,2,3]')
+        expect(result).toEqual([1, 2, 3])
+      })
+
+      it('should parse JSON primitives', () => {
+        expect(jsonParse('null')).toBe(null)
+        expect(jsonParse('true')).toBe(true)
+        expect(jsonParse('false')).toBe(false)
+        expect(jsonParse('42')).toBe(42)
+        expect(jsonParse('"string"')).toBe('string')
+      })
+
+      it('should parse nested JSON objects', () => {
+        const json = '{"nested":{"key":"value"},"array":[1,2,3]}'
+        const result = jsonParse(json)
+        expect(result).toEqual({
+          nested: { key: 'value' },
+          array: [1, 2, 3],
+        })
+      })
+
+      it('should parse empty object', () => {
+        expect(jsonParse('{}')).toEqual({})
+      })
+
+      it('should parse empty array', () => {
+        expect(jsonParse('[]')).toEqual([])
+      })
+
+      it('should parse JSON with whitespace', () => {
+        const result = jsonParse('  { "key" : "value" }  ')
+        expect(result).toEqual({ key: 'value' })
+      })
+
+      it('should parse JSON with newlines', () => {
+        const json = `{
+          "key": "value",
+          "number": 42
+        }`
+        const result = jsonParse(json)
+        expect(result).toEqual({ key: 'value', number: 42 })
+      })
+    })
+
+    describe('Buffer support', () => {
+      it('should parse JSON from Buffer', () => {
+        const buffer = Buffer.from('{"key":"value"}', 'utf8')
+        const result = jsonParse(buffer)
+        expect(result).toEqual({ key: 'value' })
+      })
+
+      it('should parse JSON from Buffer with UTF-8 encoding', () => {
+        const buffer = Buffer.from('[1,2,3]', 'utf8')
+        const result = jsonParse(buffer)
+        expect(result).toEqual([1, 2, 3])
+      })
+
+      it('should handle Buffer with BOM', () => {
+        const buffer = Buffer.from('\uFEFF{"key":"value"}', 'utf8')
+        const result = jsonParse(buffer)
+        expect(result).toEqual({ key: 'value' })
+      })
+
+      it('should parse empty Buffer', () => {
+        const buffer = Buffer.from('null', 'utf8')
+        const result = jsonParse(buffer)
+        expect(result).toBe(null)
+      })
+
+      it('should handle empty Buffer content', () => {
+        const buffer = Buffer.from('{}', 'utf8')
+        const result = jsonParse(buffer)
+        expect(result).toEqual({})
+      })
+
+      it('should handle Buffer with nested objects', () => {
+        const buffer = Buffer.from('{"a":{"b":{"c":1}}}', 'utf8')
+        const result = jsonParse(buffer)
+        expect(result).toEqual({ a: { b: { c: 1 } } })
+      })
+
+      it('should handle Buffer with array content', () => {
+        const buffer = Buffer.from('["a","b","c"]', 'utf8')
+        const result = jsonParse(buffer)
+        expect(result).toEqual(['a', 'b', 'c'])
+      })
+
+      it('should handle Buffer with number content', () => {
+        const buffer = Buffer.from('42', 'utf8')
+        const result = jsonParse(buffer)
+        expect(result).toBe(42)
+      })
+
+      it('should handle Buffer with boolean content', () => {
+        const buffer = Buffer.from('true', 'utf8')
+        const result = jsonParse(buffer)
+        expect(result).toBe(true)
+      })
+
+      it('should handle Buffer with string content', () => {
+        const buffer = Buffer.from('"hello world"', 'utf8')
+        const result = jsonParse(buffer)
+        expect(result).toBe('hello world')
+      })
+
+      it('should throw error for invalid JSON in Buffer', () => {
+        const buffer = Buffer.from('invalid json', 'utf8')
+        expect(() => jsonParse(buffer)).toThrow()
+      })
+
+      it('should return undefined for invalid JSON in Buffer with throws false', () => {
+        const buffer = Buffer.from('invalid json', 'utf8')
+        const result = jsonParse(buffer, { throws: false })
+        expect(result).toBe(undefined)
+      })
+
+      it('should handle Buffer with reviver', () => {
+        const buffer = Buffer.from('{"num":10}', 'utf8')
+        const reviver = (_key: string, value: unknown) => {
+          if (typeof value === 'number') {
+            return value * 2
+          }
+          return value
+        }
+        const result = jsonParse(buffer, { reviver })
+        expect(result).toEqual({ num: 20 })
+      })
+
+      it('should handle Buffer with filepath option', () => {
+        const buffer = Buffer.from('invalid', 'utf8')
+        try {
+          jsonParse(buffer, { filepath: '/test/buffer.json' })
+          expect.fail('Should have thrown')
+        } catch (e) {
+          expect((e as Error).message).toContain('/test/buffer.json')
+        }
+      })
+
+      it('should handle Buffer with all options', () => {
+        const buffer = Buffer.from('{"value":5}', 'utf8')
+        const reviver = (_key: string, value: unknown) => value
+        const result = jsonParse(buffer, {
+          filepath: '/test.json',
+          reviver,
+          throws: true,
+        })
+        expect(result).toEqual({ value: 5 })
+      })
+    })
+
+    describe('BOM stripping', () => {
+      it('should strip BOM from beginning of string', () => {
+        const result = jsonParse('\uFEFF{"key":"value"}')
+        expect(result).toEqual({ key: 'value' })
+      })
+
+      it('should strip BOM from array', () => {
+        const result = jsonParse('\uFEFF[1,2,3]')
+        expect(result).toEqual([1, 2, 3])
+      })
+
+      it('should handle string without BOM', () => {
+        const result = jsonParse('{"key":"value"}')
+        expect(result).toEqual({ key: 'value' })
+      })
+    })
+
+    describe('reviver function', () => {
+      it('should use reviver function to transform values', () => {
+        const reviver = (_key: string, value: unknown) => {
+          if (typeof value === 'number') {
+            return value * 2
+          }
+          return value
+        }
+        const result = jsonParse('{"a":1,"b":2}', { reviver })
+        expect(result).toEqual({ a: 2, b: 4 })
+      })
+
+      it('should pass key to reviver', () => {
+        const keys: string[] = []
+        const reviver = (key: string, value: unknown) => {
+          keys.push(key)
+          return value
+        }
+        jsonParse('{"a":1}', { reviver })
+        expect(keys).toContain('a')
+        expect(keys).toContain('')
+      })
+
+      it('should allow reviver to filter values', () => {
+        const reviver = (key: string, value: unknown) => {
+          if (key === 'filter') {
+            return undefined
+          }
+          return value
+        }
+        const result = jsonParse('{"keep":"yes","filter":"no"}', { reviver })
+        expect(result).toEqual({ keep: 'yes' })
+      })
+
+      it('should handle reviver with nested objects', () => {
+        const reviver = (key: string, value: unknown) => {
+          if (key === 'nested' && typeof value === 'object') {
+            return 'replaced'
+          }
+          return value
+        }
+        const result = jsonParse('{"nested":{"key":"value"}}', { reviver })
+        expect(result).toEqual({ nested: 'replaced' })
+      })
+    })
+
+    describe('error handling with throws option', () => {
+      it('should throw error for invalid JSON by default', () => {
+        expect(() => jsonParse('invalid json')).toThrow()
+      })
+
+      it('should throw error when throws is true', () => {
+        expect(() => jsonParse('invalid json', { throws: true })).toThrow()
+      })
+
+      it('should throw error when throws is explicitly undefined', () => {
+        expect(() => jsonParse('invalid json', { throws: undefined })).toThrow()
+      })
+
+      it('should return undefined when throws is false', () => {
+        const result = jsonParse('invalid json', { throws: false })
+        expect(result).toBe(undefined)
+      })
+
+      it('should throw for malformed JSON object', () => {
+        expect(() => jsonParse('{invalid}')).toThrow()
+      })
+
+      it('should throw for unclosed JSON object', () => {
+        expect(() => jsonParse('{"key":"value"')).toThrow()
+      })
+
+      it('should throw for unclosed JSON array', () => {
+        expect(() => jsonParse('[1,2,3')).toThrow()
+      })
+
+      it('should throw for trailing comma', () => {
+        expect(() => jsonParse('{"key":"value",}')).toThrow()
+      })
+
+      it('should throw for single quotes', () => {
+        expect(() => jsonParse("{'key':'value'}")).toThrow()
+      })
+
+      it('should return undefined for empty string with throws false', () => {
+        const result = jsonParse('', { throws: false })
+        expect(result).toBe(undefined)
+      })
+
+      it('should throw for empty string by default', () => {
+        expect(() => jsonParse('')).toThrow()
+      })
+    })
+
+    describe('error handling with filepath option', () => {
+      it('should include filepath in error message', () => {
+        const filepath = '/path/to/file.json'
+        try {
+          jsonParse('invalid json', { filepath })
+          expect.fail('Should have thrown')
+        } catch (e) {
+          expect((e as Error).message).toContain(filepath)
+        }
+      })
+
+      it('should prepend filepath to error message', () => {
+        const filepath = '/test/file.json'
+        try {
+          jsonParse('{invalid}', { filepath })
+          expect.fail('Should have thrown')
+        } catch (e) {
+          expect((e as Error).message).toMatch(/^\/test\/file\.json:/)
+        }
+      })
+
+      it('should work with Buffer and filepath', () => {
+        const buffer = Buffer.from('invalid json', 'utf8')
+        const filepath = '/path/to/buffer.json'
+        try {
+          jsonParse(buffer, { filepath })
+          expect.fail('Should have thrown')
+        } catch (e) {
+          expect((e as Error).message).toContain(filepath)
+        }
+      })
+
+      it('should not modify error when throws is false', () => {
+        const result = jsonParse('invalid', {
+          filepath: '/test.json',
+          throws: false,
+        })
+        expect(result).toBe(undefined)
+      })
+
+      it('should handle empty filepath', () => {
+        try {
+          jsonParse('invalid', { filepath: '' })
+          expect.fail('Should have thrown')
+        } catch (e) {
+          expect(e).toBeInstanceOf(Error)
+        }
+      })
+    })
+
+    describe('combined options', () => {
+      it('should use reviver with filepath', () => {
+        const reviver = (_key: string, value: unknown) => value
+        const result = jsonParse('{"key":"value"}', {
+          filepath: '/test.json',
+          reviver,
+        })
+        expect(result).toEqual({ key: 'value' })
+      })
+
+      it('should use reviver with throws false', () => {
+        const reviver = (_key: string, value: unknown) => value
+        const result = jsonParse('{"key":"value"}', {
+          throws: false,
+          reviver,
+        })
+        expect(result).toEqual({ key: 'value' })
+      })
+
+      it('should use all options together', () => {
+        const reviver = (_key: string, value: unknown) => value
+        const result = jsonParse('{"key":"value"}', {
+          filepath: '/test.json',
+          throws: true,
+          reviver,
+        })
+        expect(result).toEqual({ key: 'value' })
+      })
+
+      it('should handle error with all options', () => {
+        const reviver = (_key: string, value: unknown) => value
+        const result = jsonParse('invalid', {
+          filepath: '/test.json',
+          throws: false,
+          reviver,
+        })
+        expect(result).toBe(undefined)
+      })
+    })
+
+    describe('edge cases', () => {
+      it('should parse JSON with special characters', () => {
+        const json = '{"special":"\\n\\t\\r\\b\\f\\"\\\\/"}'
+        const result = jsonParse(json)
+        expect(result).toEqual({ special: '\n\t\r\b\f"\\/' })
+      })
+
+      it('should parse JSON with unicode escapes', () => {
+        const json = '{"unicode":"\\u0048\\u0065\\u006c\\u006c\\u006f"}'
+        const result = jsonParse(json)
+        expect(result).toEqual({ unicode: 'Hello' })
+      })
+
+      it('should parse JSON with negative numbers', () => {
+        const result = jsonParse('{"negative":-42}')
+        expect(result).toEqual({ negative: -42 })
+      })
+
+      it('should parse JSON with scientific notation', () => {
+        const result = jsonParse('{"scientific":1.23e10}')
+        expect(result).toEqual({ scientific: 1.23e10 })
+      })
+
+      it('should parse JSON with very nested structure', () => {
+        const json = '{"a":{"b":{"c":{"d":{"e":"deep"}}}}}'
+        const result = jsonParse(json)
+        expect(result).toEqual({ a: { b: { c: { d: { e: 'deep' } } } } })
+      })
+
+      it('should parse large array', () => {
+        const array = Array.from({ length: 1000 }, (_, i) => i)
+        const json = JSON.stringify(array)
+        const result = jsonParse(json)
+        expect(result).toEqual(array)
+      })
+
+      it('should handle JSON with null values', () => {
+        const result = jsonParse('{"key":null}')
+        expect(result).toEqual({ key: null })
+      })
+
+      it('should handle mixed types in array', () => {
+        const result = jsonParse(
+          '[null,true,42,"string",{"key":"value"},[1,2]]',
+        )
+        expect(result).toEqual([
+          null,
+          true,
+          42,
+          'string',
+          { key: 'value' },
+          [1, 2],
+        ])
+      })
+
+      it('should handle zero', () => {
+        expect(jsonParse('0')).toBe(0)
+        expect(jsonParse('-0')).toBe(-0)
+      })
+
+      it('should handle empty string value', () => {
+        const result = jsonParse('{"empty":""}')
+        expect(result).toEqual({ empty: '' })
+      })
+    })
+
+    describe('options object behavior', () => {
+      it('should work with empty options object', () => {
+        const result = jsonParse('{"key":"value"}', {})
+        expect(result).toEqual({ key: 'value' })
+      })
+
+      it('should work without options', () => {
+        const result = jsonParse('{"key":"value"}')
+        expect(result).toEqual({ key: 'value' })
+      })
+
+      it('should work with undefined options', () => {
+        const result = jsonParse('{"key":"value"}', undefined)
+        expect(result).toEqual({ key: 'value' })
+      })
+
+      it('should work with throws explicitly set to true', () => {
+        const result = jsonParse('{"key":"value"}', { throws: true })
+        expect(result).toEqual({ key: 'value' })
+      })
+
+      it('should work with throws explicitly set to false', () => {
+        const result = jsonParse('{"key":"value"}', { throws: false })
+        expect(result).toEqual({ key: 'value' })
+      })
+
+      it('should work with only reviver option', () => {
+        const reviver = (_key: string, value: unknown) => value
+        const result = jsonParse('{"key":"value"}', { reviver })
+        expect(result).toEqual({ key: 'value' })
+      })
+
+      it('should work with only filepath option', () => {
+        const result = jsonParse('{"key":"value"}', { filepath: '/test.json' })
+        expect(result).toEqual({ key: 'value' })
+      })
+
+      it('should work with only throws option', () => {
+        const result = jsonParse('{"key":"value"}', { throws: false })
+        expect(result).toEqual({ key: 'value' })
+      })
+    })
+
+    describe('string vs Buffer edge cases', () => {
+      it('should handle string with special unicode characters', () => {
+        const result = jsonParse('{"emoji":"😀"}')
+        expect(result).toEqual({ emoji: '😀' })
+      })
+
+      it('should handle Buffer with special unicode characters', () => {
+        const buffer = Buffer.from('{"emoji":"😀"}', 'utf8')
+        const result = jsonParse(buffer)
+        expect(result).toEqual({ emoji: '😀' })
+      })
+
+      it('should handle string with escaped unicode', () => {
+        const result = jsonParse('{"escaped":"\\u0041\\u0042\\u0043"}')
+        expect(result).toEqual({ escaped: 'ABC' })
+      })
+
+      it('should handle Buffer with escaped unicode', () => {
+        const buffer = Buffer.from(
+          '{"escaped":"\\u0041\\u0042\\u0043"}',
+          'utf8',
+        )
+        const result = jsonParse(buffer)
+        expect(result).toEqual({ escaped: 'ABC' })
+      })
+
+      it('should handle very long JSON string', () => {
+        const longArray = Array.from({ length: 10_000 }, (_, i) => i)
+        const json = JSON.stringify(longArray)
+        const result = jsonParse(json)
+        expect(result).toEqual(longArray)
+      })
+
+      it('should handle very long JSON Buffer', () => {
+        const longArray = Array.from({ length: 10_000 }, (_, i) => i)
+        const json = JSON.stringify(longArray)
+        const buffer = Buffer.from(json, 'utf8')
+        const result = jsonParse(buffer)
+        expect(result).toEqual(longArray)
+      })
+
+      it('should handle whitespace-only JSON with BOM', () => {
+        const result = jsonParse('\uFEFF   "value"   ')
+        expect(result).toBe('value')
+      })
+
+      it('should handle Buffer with multiple BOMs in content', () => {
+        // Only the first BOM should be stripped
+        const buffer = Buffer.from(
+          '\uFEFF{"text":"\\uFEFF embedded BOM"}',
+          'utf8',
+        )
+        const result = jsonParse(buffer)
+        expect(result).toEqual({ text: '\uFEFF embedded BOM' })
+      })
+    })
+
+    describe('error message formatting', () => {
+      it('should preserve original error type', () => {
+        try {
+          jsonParse('invalid')
+          expect.fail('Should have thrown')
+        } catch (e) {
+          expect(e).toBeInstanceOf(SyntaxError)
+        }
+      })
+
+      it('should preserve original error for Buffer', () => {
+        const buffer = Buffer.from('invalid', 'utf8')
+        try {
+          jsonParse(buffer)
+          expect.fail('Should have thrown')
+        } catch (e) {
+          expect(e).toBeInstanceOf(SyntaxError)
+        }
+      })
+
+      it('should handle filepath with special characters', () => {
+        try {
+          jsonParse('invalid', { filepath: '/path/with spaces/file.json' })
+          expect.fail('Should have thrown')
+        } catch (e) {
+          expect((e as Error).message).toContain('/path/with spaces/file.json')
+        }
+      })
+
+      it('should handle very long filepath', () => {
+        const longPath = `/very/long/path/${'a'.repeat(1000)}/file.json`
+        try {
+          jsonParse('invalid', { filepath: longPath })
+          expect.fail('Should have thrown')
+        } catch (e) {
+          expect((e as Error).message).toContain(longPath)
+        }
+      })
+
+      it('should not modify error when filepath is undefined', () => {
+        try {
+          jsonParse('invalid', { filepath: undefined })
+          expect.fail('Should have thrown')
+        } catch (e) {
+          expect((e as Error).message).not.toContain('undefined')
+        }
+      })
+    })
+
+    describe('isBuffer internal function edge cases', () => {
+      it('should handle falsy values that are not Buffers', () => {
+        // Tests line 156: if (!x || typeof x !== 'object')
+        expect(jsonParse('null')).toBe(null)
+        expect(jsonParse('false')).toBe(false)
+        expect(jsonParse('0')).toBe(0)
+      })
+
+      it('should handle objects without length property', () => {
+        // Tests line 160-161: typeof obj['length'] !== 'number'
+        // jsonParse with an object that looks nothing like a Buffer should fail gracefully
+        expect(() => {
+          // @ts-expect-error - testing runtime behavior with invalid input
+          jsonParse({ some: 'object' })
+        }).toThrow()
+      })
+
+      it('should handle objects with non-number length', () => {
+        // Tests line 160-161: typeof obj['length'] !== 'number'
+        expect(() => {
+          // @ts-expect-error - testing runtime behavior
+          jsonParse({ length: 'not a number' })
+        }).toThrow()
+      })
+
+      it('should handle objects missing copy/slice methods', () => {
+        // Tests line 163-164: missing copy or slice methods
+        expect(() => {
+          // @ts-expect-error - testing runtime behavior
+          jsonParse({ length: 10 })
+        }).toThrow()
+
+        expect(() => {
+          // @ts-expect-error - testing runtime behavior
+          jsonParse({ length: 10, copy: 'not a function' })
+        }).toThrow()
+
+        expect(() => {
+          // @ts-expect-error - testing runtime behavior
+          jsonParse({ length: 10, slice: 'not a function' })
+        }).toThrow()
+      })
+
+      it('should handle array-like objects with non-number first element', () => {
+        // Tests line 166-171: length > 0 but obj[0] is not a number
+        expect(() => {
+          jsonParse({
+            length: 1,
+            0: 'not a number',
+            // @ts-expect-error - Testing Buffer-like object with invalid method signatures
+            copy: () => {},
+            // @ts-expect-error - Testing Buffer-like object with invalid method signatures
+            slice: () => {},
+          })
+        }).toThrow()
+      })
+
+      it('should handle objects without proper constructor', () => {
+        // Tests line 174-177: constructor.isBuffer checks
+        expect(() => {
+          jsonParse({
+            length: 0,
+            // @ts-expect-error - Testing Buffer-like object with invalid method signatures
+            copy: () => {},
+            // @ts-expect-error - Testing Buffer-like object with invalid method signatures
+            slice: () => {},
+            // @ts-expect-error - Testing Buffer-like object with missing isBuffer method
+            constructor: {}, // No isBuffer method
+          })
+        }).toThrow()
+
+        expect(() => {
+          jsonParse({
+            length: 0,
+            // @ts-expect-error - Testing Buffer-like object with invalid method signatures
+            copy: () => {},
+            // @ts-expect-error - Testing Buffer-like object with invalid method signatures
+            slice: () => {},
+            constructor: {
+              // @ts-expect-error - Testing Buffer-like object with non-function isBuffer
+              isBuffer: 'not a function',
+            },
+          })
+        }).toThrow()
+      })
+    })
+
+    describe('isJsonPrimitive edge cases', () => {
+      it('should handle all falsy values correctly', () => {
+        // Tests line 200: value === null
+        expect(isJsonPrimitive(null)).toBe(true)
+        expect(isJsonPrimitive(undefined)).toBe(false)
+        expect(isJsonPrimitive(0)).toBe(true)
+        expect(isJsonPrimitive(false)).toBe(true)
+        expect(isJsonPrimitive('')).toBe(true)
+        expect(isJsonPrimitive(Number.NaN)).toBe(true) // NaN is a number
+      })
+
+      it('should handle special number values', () => {
+        expect(isJsonPrimitive(Number.POSITIVE_INFINITY)).toBe(true)
+        expect(isJsonPrimitive(Number.NEGATIVE_INFINITY)).toBe(true)
+        expect(isJsonPrimitive(Number.MAX_VALUE)).toBe(true)
+        expect(isJsonPrimitive(Number.MIN_VALUE)).toBe(true)
+      })
+    })
+  })
+})
diff --git a/test/unit/logger-advanced.test.ts b/test/unit/logger-advanced.test.ts
new file mode 100644
index 0000000..b04a2d0
--- /dev/null
+++ b/test/unit/logger-advanced.test.ts
@@ -0,0 +1,390 @@
+/**
+ * @fileoverview Advanced tests for Logger class - task management, assertions, and advanced features.
+ *
+ * Tests advanced Logger functionality including:
+ * - createTask() for tracking async operations with start/completion messages
+ * - assert() for conditional logging based on truthy/falsy values
+ * - logCallCount tracking across all logging methods
+ * - dir/dirxml for object inspection
+ * - trace() for stack traces
+ * - success/fail methods with symbol stripping
+ * - step() for progress indicators
+ * - Complex indentation scenarios and edge cases
+ */
+
+import { Writable } from 'node:stream'
+
+import { Logger } from '@socketsecurity/lib/logger'
+import { describe, expect, it, beforeEach } from 'vitest'
+
+// Disable concurrent execution for this suite to prevent state sharing between tests
+// The logger and stream state must be isolated for accurate testing
+describe.sequential('Logger - Advanced Features', () => {
+  let stdout: Writable
+  let stderr: Writable
+  let stdoutData: string[]
+  let stderrData: string[]
+  let logger: Logger
+
+  beforeEach(() => {
+    stdoutData = []
+    stderrData = []
+
+    stdout = new Writable({
+      write(chunk, _encoding, callback) {
+        stdoutData.push(chunk.toString())
+        callback()
+      },
+    })
+
+    stderr = new Writable({
+      write(chunk, _encoding, callback) {
+        stderrData.push(chunk.toString())
+        callback()
+      },
+    })
+
+    logger = new Logger({ stdout, stderr })
+  })
+
+  describe('createTask', () => {
+    it('should create a task object', () => {
+      const task = logger.createTask('test task')
+      expect(task).toBeDefined()
+      expect(typeof task.run).toBe('function')
+    })
+
+    it('should log start and completion messages', () => {
+      const task = logger.createTask('my task')
+      task.run(() => {
+        // do nothing
+      })
+      const output = stdoutData.join('')
+      expect(output).toContain('Starting task: my task')
+      expect(output).toContain('Completed task: my task')
+    })
+
+    it('should return the function result', () => {
+      const task = logger.createTask('calculation')
+      const result = task.run(() => 42)
+      expect(result).toBe(42)
+    })
+
+    it('should work with complex return values', () => {
+      const task = logger.createTask('fetch data')
+      const result = task.run(() => ({
+        data: [1, 2, 3],
+        success: true,
+      }))
+      expect(result.data).toEqual([1, 2, 3])
+      expect(result.success).toBe(true)
+    })
+
+    it('should handle async functions via run', () => {
+      const task = logger.createTask('async task')
+      const promise = task.run(() => Promise.resolve('done'))
+      expect(promise).toBeInstanceOf(Promise)
+    })
+  })
+
+  describe('assert', () => {
+    it('should not log when assertion passes', () => {
+      logger.assert(true, 'This should not appear')
+      expect(stderrData.join('')).not.toContain('This should not appear')
+    })
+
+    it('should log when assertion fails', () => {
+      logger.assert(false, 'Assertion failed')
+      expect(stderrData.join('')).toContain('Assertion failed')
+    })
+
+    it('should support method chaining', () => {
+      const result = logger.assert(true, 'test')
+      expect(result).toBe(logger)
+    })
+
+    it('should handle truthy values', () => {
+      logger.assert(1, 'Should not log')
+      logger.assert('string', 'Should not log')
+      logger.assert({}, 'Should not log')
+      expect(stderrData.length).toBe(0)
+    })
+
+    it('should handle falsy values', () => {
+      logger.assert(0, 'Zero is falsy')
+      logger.assert('', 'Empty string is falsy')
+      logger.assert(null, 'Null is falsy')
+      expect(stderrData.length).toBeGreaterThan(0)
+    })
+  })
+
+  describe('logCallCount', () => {
+    it('should start at zero', () => {
+      expect(logger.logCallCount).toBe(0)
+    })
+
+    it('should increment on log', () => {
+      logger.log('message')
+      expect(logger.logCallCount).toBe(1)
+    })
+
+    it('should increment on multiple calls', () => {
+      logger.log('one')
+      logger.log('two')
+      logger.error('three')
+      expect(logger.logCallCount).toBe(3)
+    })
+
+    it('should track across different methods', () => {
+      logger.log('log')
+      logger.error('error')
+      logger.warn('warn')
+      // debug() is dynamically added - test if available
+      if (typeof (logger as any).debug === 'function') {
+        ;(logger as any).debug('debug')
+      }
+      // Expect at least 3 calls (log, error, warn)
+      expect(logger.logCallCount).toBeGreaterThanOrEqual(3)
+    })
+
+    it('should not increment on passing assertions', () => {
+      logger.assert(true, 'pass')
+      expect(logger.logCallCount).toBe(0)
+    })
+
+    it('should increment on failing assertions', () => {
+      logger.assert(false, 'fail')
+      expect(logger.logCallCount).toBe(1)
+    })
+  })
+
+  describe('dedent with custom spaces', () => {
+    it('should accept custom space count', () => {
+      logger.indent(4)
+      const result = logger.dedent(4)
+      expect(result).toBe(logger)
+    })
+
+    it('should dedent by default 2 spaces', () => {
+      logger.indent()
+      const result = logger.dedent()
+      expect(result).toBe(logger)
+    })
+
+    it('should work with stream-bound loggers', () => {
+      logger.stdout.indent(6)
+      logger.stdout.dedent(6)
+      expect(true).toBe(true)
+    })
+  })
+
+  describe('dir method', () => {
+    it('should inspect objects', () => {
+      const obj = { key: 'value', nested: { prop: 123 } }
+      const result = logger.dir(obj)
+      expect(result).toBe(logger)
+      expect(stdoutData.length).toBeGreaterThan(0)
+    })
+
+    it('should accept options', () => {
+      const obj = { a: 1, b: 2 }
+      const result = logger.dir(obj, { depth: 1 })
+      expect(result).toBe(logger)
+    })
+
+    it('should handle arrays', () => {
+      logger.dir([1, 2, 3, 4, 5])
+      expect(stdoutData.length).toBeGreaterThan(0)
+    })
+
+    it('should handle primitives', () => {
+      logger.dir(42)
+      logger.dir('string')
+      logger.dir(true)
+      expect(stdoutData.length).toBeGreaterThan(0)
+    })
+  })
+
+  describe('dirxml method', () => {
+    it('should display data', () => {
+      const data = { xml: 'data' }
+      const result = logger.dirxml(data)
+      expect(result).toBe(logger)
+      expect(stdoutData.length).toBeGreaterThan(0)
+    })
+  })
+
+  describe('trace method', () => {
+    it('should log stack trace', () => {
+      logger.trace()
+      expect(stderrData.length).toBeGreaterThan(0)
+    })
+
+    it('should accept message arguments', () => {
+      logger.trace('custom trace message')
+      const output = stderrData.join('')
+      expect(output).toContain('custom trace message')
+    })
+
+    it('should support chaining', () => {
+      const result = logger.trace('test')
+      expect(result).toBe(logger)
+    })
+  })
+
+  describe('success and fail methods', () => {
+    it('should log success messages', () => {
+      logger.success('Operation successful')
+      expect(stderrData.length).toBeGreaterThan(0)
+    })
+
+    it('should log fail messages', () => {
+      logger.fail('Operation failed')
+      expect(stderrData.length).toBeGreaterThan(0)
+    })
+
+    it('should handle messages with extra args', () => {
+      logger.success('Done', 'extra', 'args')
+      expect(stderrData.length).toBeGreaterThan(0)
+    })
+
+    it('should strip existing symbols', () => {
+      logger.success('✔ Already has symbol')
+      const output = stderrData.join('')
+      // Symbol should be stripped and re-added
+      expect(output).toBeDefined()
+    })
+  })
+
+  describe('step method', () => {
+    it('should log step messages', () => {
+      logger.step('Processing step')
+      expect(stdoutData.length).toBeGreaterThan(0)
+    })
+
+    it('should support chaining', () => {
+      const result = logger.step('test')
+      expect(result).toBe(logger)
+    })
+
+    it('should handle multiple steps', () => {
+      logger.step('Step 1')
+      logger.step('Step 2')
+      logger.step('Step 3')
+      expect(stdoutData.length).toBeGreaterThan(0)
+    })
+  })
+
+  describe('complex indentation scenarios', () => {
+    it('should handle nested indentation', () => {
+      logger.log('Level 0')
+      logger.indent()
+      logger.log('Level 1')
+      logger.indent()
+      logger.log('Level 2')
+      logger.dedent()
+      logger.log('Back to level 1')
+      logger.dedent()
+      logger.log('Back to level 0')
+      expect(stdoutData.length).toBe(5)
+    })
+
+    it('should handle stream-specific indentation', () => {
+      logger.stdout.indent()
+      logger.stdout.log('indented stdout')
+      logger.stderr.error('non-indented stderr')
+      logger.stdout.dedent()
+      expect(stdoutData.length).toBeGreaterThan(0)
+      expect(stderrData.length).toBeGreaterThan(0)
+    })
+
+    it('should maintain separate indentation for stderr and stdout', () => {
+      logger.stdout.indent(4)
+      logger.stderr.indent(2)
+      logger.stdout.log('stdout')
+      logger.stderr.error('stderr')
+      logger.stdout.dedent(4)
+      logger.stderr.dedent(2)
+      expect(true).toBe(true)
+    })
+  })
+
+  describe('edge cases and error handling', () => {
+    it('should handle rapid successive calls', () => {
+      for (let i = 0; i < 100; i++) {
+        logger.log(`message ${i}`)
+      }
+      expect(logger.logCallCount).toBe(100)
+    })
+
+    it('should handle empty task names', () => {
+      const task = logger.createTask('')
+      task.run(() => 'done')
+      expect(stdoutData.length).toBeGreaterThan(0)
+    })
+
+    it('should handle tasks that throw', () => {
+      const task = logger.createTask('failing task')
+      expect(() => {
+        task.run(() => {
+          throw new Error('task error')
+        })
+      }).toThrow('task error')
+      // Should still log start message
+      expect(stdoutData.join('')).toContain('Starting task')
+    })
+
+    it('should handle mixed logging and assertions', () => {
+      logger.log('start')
+      logger.assert(true, 'pass')
+      logger.log('middle')
+      logger.assert(false, 'fail')
+      logger.log('end')
+      expect(logger.logCallCount).toBe(4) // log, log, assert fail, log
+    })
+  })
+
+  describe('stream-bound logger error cases', () => {
+    it('should throw error when calling clearVisible on stream-bound logger', () => {
+      expect(() => {
+        logger.stderr.clearVisible()
+      }).toThrow()
+    })
+
+    it('should throw error when calling clearVisible on stdout logger', () => {
+      expect(() => {
+        logger.stdout.clearVisible()
+      }).toThrow()
+    })
+  })
+
+  describe('method chaining complex scenarios', () => {
+    it('should chain multiple operations', () => {
+      const result = logger
+        .log('start')
+        .indent()
+        .success('nested success')
+        .fail('nested fail')
+        .dedent()
+        .log('end')
+      expect(result).toBe(logger)
+      expect(logger.logCallCount).toBe(4)
+    })
+
+    it('should chain with tasks', () => {
+      const task = logger.createTask('chained')
+      const result = task.run(() => {
+        logger.log('inside task')
+        return 'done'
+      })
+      expect(result).toBe('done')
+    })
+
+    it('should chain across stream-bound loggers', () => {
+      logger.stdout.log('stdout 1').log('stdout 2')
+      logger.stderr.error('stderr 1').error('stderr 2')
+      expect(stdoutData.length).toBe(2)
+      expect(stderrData.length).toBe(2)
+    })
+  })
+})
diff --git a/test/unit/logger-core.test.ts b/test/unit/logger-core.test.ts
new file mode 100644
index 0000000..42febe0
--- /dev/null
+++ b/test/unit/logger-core.test.ts
@@ -0,0 +1,313 @@
+/**
+ * @fileoverview Core tests for Logger class - basic functionality.
+ *
+ * Tests core logging methods (log, info, warn, error, debug), LOG_SYMBOLS constants,
+ * stream-bound loggers (stdout/stderr), method chaining, and indentation control.
+ * Uses custom Writable streams to capture and verify output without console pollution.
+ */
+
+import { Writable } from 'node:stream'
+
+import { Logger, LOG_SYMBOLS } from '@socketsecurity/lib/logger'
+import { describe, expect, it, beforeEach } from 'vitest'
+
+describe('Logger', () => {
+  let stdout: Writable
+  let stderr: Writable
+  let stdoutData: string[]
+  let stderrData: string[]
+  let logger: Logger
+
+  beforeEach(() => {
+    stdoutData = []
+    stderrData = []
+
+    stdout = new Writable({
+      write(chunk, _encoding, callback) {
+        stdoutData.push(chunk.toString())
+        callback()
+      },
+    })
+
+    stderr = new Writable({
+      write(chunk, _encoding, callback) {
+        stderrData.push(chunk.toString())
+        callback()
+      },
+    })
+
+    logger = new Logger({ stdout, stderr })
+  })
+
+  describe('LOG_SYMBOLS', () => {
+    it('should provide all required symbols', () => {
+      expect(LOG_SYMBOLS).toHaveProperty('success')
+      expect(LOG_SYMBOLS).toHaveProperty('fail')
+      expect(LOG_SYMBOLS).toHaveProperty('warn')
+      expect(LOG_SYMBOLS).toHaveProperty('info')
+      expect(LOG_SYMBOLS).toHaveProperty('reason')
+      expect(LOG_SYMBOLS).toHaveProperty('step')
+    })
+
+    it('should return strings for symbols', () => {
+      expect(typeof LOG_SYMBOLS.success).toBe('string')
+      expect(typeof LOG_SYMBOLS.fail).toBe('string')
+      expect(typeof LOG_SYMBOLS.warn).toBe('string')
+      expect(typeof LOG_SYMBOLS.info).toBe('string')
+      expect(typeof LOG_SYMBOLS.reason).toBe('string')
+      expect(typeof LOG_SYMBOLS.step).toBe('string')
+    })
+
+    it('should have non-empty symbol strings', () => {
+      expect(LOG_SYMBOLS.success.length).toBeGreaterThan(0)
+      expect(LOG_SYMBOLS.fail.length).toBeGreaterThan(0)
+      expect(LOG_SYMBOLS.warn.length).toBeGreaterThan(0)
+      expect(LOG_SYMBOLS.info.length).toBeGreaterThan(0)
+      expect(LOG_SYMBOLS.reason.length).toBeGreaterThan(0)
+      expect(LOG_SYMBOLS.step.length).toBeGreaterThan(0)
+    })
+
+    it('should be accessible from Logger.LOG_SYMBOLS', () => {
+      expect(Logger.LOG_SYMBOLS).toBe(LOG_SYMBOLS)
+      expect(Logger.LOG_SYMBOLS.success).toBe(LOG_SYMBOLS.success)
+    })
+  })
+
+  describe('constructor', () => {
+    it('should create logger with default constructor', () => {
+      const defaultLogger = new Logger()
+      expect(defaultLogger).toBeInstanceOf(Logger)
+    })
+
+    it('should create logger with custom streams', () => {
+      expect(logger).toBeInstanceOf(Logger)
+    })
+
+    it('should create logger with options', () => {
+      const optionsLogger = new Logger({ stdout, stderr, theme: 'dark' })
+      expect(optionsLogger).toBeInstanceOf(Logger)
+    })
+  })
+
+  describe('basic logging', () => {
+    it('should log to stdout', () => {
+      logger.log('test message')
+      expect(stdoutData.join('')).toContain('test message')
+    })
+
+    it('should support method chaining', () => {
+      const result = logger.log('message 1').log('message 2')
+      expect(result).toBe(logger)
+      expect(stdoutData.length).toBeGreaterThan(0)
+    })
+
+    it('should log error to stderr', () => {
+      logger.error('error message')
+      expect(stderrData.join('')).toContain('error message')
+    })
+
+    it('should log warn', () => {
+      logger.warn('warning message')
+      expect(stderrData.join('')).toContain('warning message')
+    })
+
+    it('should log info', () => {
+      logger.info('info message')
+      // info logs to stderr in Node.js Console
+      expect(stderrData.join('')).toContain('info message')
+    })
+
+    it('should log debug', () => {
+      // debug() is dynamically added from console.debug if available
+      if (typeof (logger as any).debug === 'function') {
+        ;(logger as any).debug('debug message')
+        expect(stdoutData.join('')).toContain('debug message')
+      }
+    })
+  })
+
+  describe('stream-bound loggers', () => {
+    it('should provide stderr property', () => {
+      expect(logger.stderr).toBeInstanceOf(Logger)
+    })
+
+    it('should provide stdout property', () => {
+      expect(logger.stdout).toBeInstanceOf(Logger)
+    })
+
+    it('should cache stderr instance', () => {
+      const stderr1 = logger.stderr
+      const stderr2 = logger.stderr
+      expect(stderr1).toBe(stderr2)
+    })
+
+    it('should cache stdout instance', () => {
+      const stdout1 = logger.stdout
+      const stdout2 = logger.stdout
+      expect(stdout1).toBe(stdout2)
+    })
+
+    it('should write to stderr via stderr logger', () => {
+      logger.stderr.error('stderr message')
+      expect(stderrData.join('')).toContain('stderr message')
+    })
+
+    it('should write to stdout via stdout logger', () => {
+      logger.stdout.log('stdout message')
+      expect(stdoutData.join('')).toContain('stdout message')
+    })
+  })
+
+  describe('indentation', () => {
+    it('should support indent method', () => {
+      const result = logger.indent()
+      expect(result).toBe(logger)
+    })
+
+    it('should support dedent method', () => {
+      const result = logger.dedent()
+      expect(result).toBe(logger)
+    })
+
+    it('should support method chaining with indentation', () => {
+      logger
+        .log('level 0')
+        .indent()
+        .log('level 1')
+        .dedent()
+        .log('level 0 again')
+      expect(stdoutData.length).toBeGreaterThan(0)
+    })
+
+    it('should support indentation tracking', () => {
+      // Indentation is tracked internally
+      logger.indent()
+      logger.dedent()
+      expect(true).toBe(true)
+    })
+  })
+
+  describe('special logging methods', () => {
+    it('should support success method', () => {
+      const result = logger.success('success message')
+      expect(result).toBe(logger)
+    })
+
+    it('should support fail method', () => {
+      const result = logger.fail('fail message')
+      expect(result).toBe(logger)
+    })
+
+    it('should support reason method', () => {
+      const result = logger.reason('reasoning message')
+      expect(result).toBe(logger)
+      expect(stderrData.join('')).toContain('reasoning message')
+    })
+
+    it('should support step method', () => {
+      const result = logger.step('step message')
+      expect(result).toBe(logger)
+    })
+  })
+
+  describe('table method', () => {
+    it('should support table method', () => {
+      const result = logger.table([{ name: 'test', value: 123 }])
+      expect(result).toBe(logger)
+    })
+  })
+
+  describe('time methods', () => {
+    it('should support time method', () => {
+      const result = logger.time('timer')
+      expect(result).toBe(logger)
+    })
+
+    it('should support timeEnd method', () => {
+      logger.time('timer')
+      const result = logger.timeEnd('timer')
+      expect(result).toBe(logger)
+    })
+
+    it('should support timeLog method', () => {
+      logger.time('timer')
+      const result = logger.timeLog('timer')
+      expect(result).toBe(logger)
+    })
+  })
+
+  describe('count methods', () => {
+    it('should support count method', () => {
+      const result = logger.count('counter')
+      expect(result).toBe(logger)
+    })
+
+    it('should support countReset method', () => {
+      // countReset() is dynamically added from console.countReset if available
+      if (typeof (logger as any).countReset === 'function') {
+        logger.count('counter')
+        const result = (logger as any).countReset('counter')
+        expect(result).toBe(logger)
+      }
+    })
+  })
+
+  describe('group methods', () => {
+    it('should support group method', () => {
+      const result = logger.group('group name')
+      expect(result).toBe(logger)
+    })
+
+    it('should support groupCollapsed method', () => {
+      const result = logger.groupCollapsed('collapsed group')
+      expect(result).toBe(logger)
+    })
+
+    it('should support groupEnd method', () => {
+      logger.group('test')
+      const result = logger.groupEnd()
+      expect(result).toBe(logger)
+    })
+  })
+
+  describe('multiple arguments', () => {
+    it('should handle multiple arguments in log', () => {
+      logger.log('arg1', 'arg2', 'arg3')
+      const output = stdoutData.join('')
+      expect(output).toContain('arg1')
+      expect(output).toContain('arg2')
+      expect(output).toContain('arg3')
+    })
+
+    it('should handle objects and arrays', () => {
+      logger.log({ key: 'value' }, [1, 2, 3])
+      expect(stdoutData.length).toBeGreaterThan(0)
+    })
+  })
+
+  describe('edge cases', () => {
+    it('should handle empty log calls', () => {
+      const result = logger.log()
+      expect(result).toBe(logger)
+    })
+
+    it('should handle null and undefined', () => {
+      logger.log(null)
+      logger.log(undefined)
+      expect(stdoutData.length).toBeGreaterThan(0)
+    })
+
+    it('should handle numbers', () => {
+      logger.log(42, 3.14, -1)
+      const output = stdoutData.join('')
+      expect(output).toContain('42')
+    })
+
+    it('should handle booleans', () => {
+      logger.log(true, false)
+      const output = stdoutData.join('')
+      expect(output).toContain('true')
+      expect(output).toContain('false')
+    })
+  })
+})
diff --git a/test/unit/logger-default.test.ts b/test/unit/logger-default.test.ts
new file mode 100644
index 0000000..cb66eef
--- /dev/null
+++ b/test/unit/logger-default.test.ts
@@ -0,0 +1,35 @@
+/**
+ * @fileoverview Unit tests for getDefaultLogger singleton factory.
+ *
+ * Tests default logger instance creation and caching:
+ * - getDefaultLogger() returns singleton Logger instance
+ * - All logging methods available (log, success, error, info, warn, debug)
+ * - Instance reuse across multiple calls (singleton pattern)
+ * - Integration with global logging configuration
+ * Used by Socket tools for centralized logging without explicit Logger instantiation.
+ */
+
+import { getDefaultLogger } from '@socketsecurity/lib/logger'
+import { describe, expect, it } from 'vitest'
+
+describe('getDefaultLogger', () => {
+  it('should return a Logger instance', () => {
+    const log = getDefaultLogger()
+    expect(log).toBeDefined()
+    expect(typeof log.log).toBe('function')
+    expect(typeof log.success).toBe('function')
+    expect(typeof log.error).toBe('function')
+  })
+
+  it('should return the same instance on multiple calls', () => {
+    const log1 = getDefaultLogger()
+    const log2 = getDefaultLogger()
+    expect(log1).toBe(log2)
+  })
+
+  it('should be usable for logging', () => {
+    const log = getDefaultLogger()
+    // Logger methods are defined dynamically, just verify the instance works
+    expect(() => log.log('test')).not.toThrow()
+  })
+})
diff --git a/test/unit/maintained-node-versions.test.ts b/test/unit/maintained-node-versions.test.ts
new file mode 100644
index 0000000..d590b3f
--- /dev/null
+++ b/test/unit/maintained-node-versions.test.ts
@@ -0,0 +1,272 @@
+/**
+ * @fileoverview Unit tests for maintained Node.js versions data module.
+ *
+ * Tests maintained Node.js versions constant:
+ * - Default export contains array of actively maintained Node.js major versions
+ * - Data is frozen to prevent runtime modifications
+ * - Version format validation (numeric major versions)
+ * - Sorted in ascending order
+ * Used by Socket tools to validate Node.js version compatibility and requirements.
+ */
+
+import { describe, expect, it } from 'vitest'
+
+import { maintainedNodeVersions } from '@socketsecurity/lib/maintained-node-versions'
+
+describe('maintained-node-versions', () => {
+  describe('default export', () => {
+    it('should export an array', () => {
+      expect(Array.isArray(maintainedNodeVersions)).toBe(true)
+    })
+
+    it('should be frozen', () => {
+      expect(Object.isFrozen(maintainedNodeVersions)).toBe(true)
+    })
+
+    it('should have exactly 4 versions', () => {
+      expect(maintainedNodeVersions).toHaveLength(4)
+    })
+
+    it('should contain only strings', () => {
+      maintainedNodeVersions.forEach(version => {
+        expect(typeof version).toBe('string')
+      })
+    })
+  })
+
+  describe('named properties', () => {
+    it('should have current property', () => {
+      expect(maintainedNodeVersions).toHaveProperty('current')
+      expect(typeof maintainedNodeVersions.current).toBe('string')
+    })
+
+    it('should have last property', () => {
+      expect(maintainedNodeVersions).toHaveProperty('last')
+      expect(typeof maintainedNodeVersions.last).toBe('string')
+    })
+
+    it('should have next property', () => {
+      expect(maintainedNodeVersions).toHaveProperty('next')
+      expect(typeof maintainedNodeVersions.next).toBe('string')
+    })
+
+    it('should have previous property', () => {
+      expect(maintainedNodeVersions).toHaveProperty('previous')
+      expect(typeof maintainedNodeVersions.previous).toBe('string')
+    })
+  })
+
+  describe('array contents', () => {
+    it('should have versions in order: last, previous, current, next', () => {
+      const [first, second, third, fourth] = maintainedNodeVersions
+      expect(first).toBe(maintainedNodeVersions.last)
+      expect(second).toBe(maintainedNodeVersions.previous)
+      expect(third).toBe(maintainedNodeVersions.current)
+      expect(fourth).toBe(maintainedNodeVersions.next)
+    })
+
+    it('should have valid semver format for all versions', () => {
+      const semverPattern = /^\d+\.\d+\.\d+$/
+      maintainedNodeVersions.forEach(version => {
+        expect(version).toMatch(semverPattern)
+      })
+    })
+
+    it('should have versions in ascending order', () => {
+      const versions = [...maintainedNodeVersions]
+      const sortedVersions = versions
+        .map(v => v.split('.').map(Number))
+        .sort((a, b) => {
+          for (let i = 0; i < 3; i++) {
+            if (a[i] !== b[i]) {
+              return a[i] - b[i]
+            }
+          }
+          return 0
+        })
+        .map(v => v.join('.'))
+
+      expect(versions).toEqual(sortedVersions)
+    })
+  })
+
+  describe('version properties match array', () => {
+    it('should have current in array', () => {
+      expect(maintainedNodeVersions).toContain(maintainedNodeVersions.current)
+    })
+
+    it('should have last in array', () => {
+      expect(maintainedNodeVersions).toContain(maintainedNodeVersions.last)
+    })
+
+    it('should have next in array', () => {
+      expect(maintainedNodeVersions).toContain(maintainedNodeVersions.next)
+    })
+
+    it('should have previous in array', () => {
+      expect(maintainedNodeVersions).toContain(maintainedNodeVersions.previous)
+    })
+  })
+
+  describe('immutability', () => {
+    it('should not allow modification of array elements', () => {
+      expect(() => {
+        maintainedNodeVersions[0] = '99.99.99'
+      }).toThrow()
+    })
+
+    it('should not allow push', () => {
+      expect(() => {
+        maintainedNodeVersions.push('99.99.99')
+      }).toThrow()
+    })
+
+    it('should not allow pop', () => {
+      expect(() => {
+        maintainedNodeVersions.pop()
+      }).toThrow()
+    })
+
+    it('should not allow modification of named properties', () => {
+      expect(() => {
+        maintainedNodeVersions.current = '99.99.99'
+      }).toThrow()
+    })
+  })
+
+  describe('version relationships', () => {
+    it('should have current >= previous', () => {
+      const current = maintainedNodeVersions.current.split('.').map(Number)
+      const previous = maintainedNodeVersions.previous.split('.').map(Number)
+
+      const currentMajor = current[0]
+      const previousMajor = previous[0]
+
+      expect(currentMajor).toBeGreaterThanOrEqual(previousMajor)
+    })
+
+    it('should have previous >= last', () => {
+      const previous = maintainedNodeVersions.previous.split('.').map(Number)
+      const last = maintainedNodeVersions.last.split('.').map(Number)
+
+      const previousMajor = previous[0]
+      const lastMajor = last[0]
+
+      expect(previousMajor).toBeGreaterThanOrEqual(lastMajor)
+    })
+
+    it('should have next >= current', () => {
+      const next = maintainedNodeVersions.next.split('.').map(Number)
+      const current = maintainedNodeVersions.current.split('.').map(Number)
+
+      const nextMajor = next[0]
+      const currentMajor = current[0]
+
+      expect(nextMajor).toBeGreaterThanOrEqual(currentMajor)
+    })
+  })
+
+  describe('realistic version numbers', () => {
+    it('should have major versions in reasonable range', () => {
+      maintainedNodeVersions.forEach(version => {
+        const major = Number.parseInt(version.split('.')[0], 10)
+        expect(major).toBeGreaterThanOrEqual(10)
+        expect(major).toBeLessThanOrEqual(100)
+      })
+    })
+
+    it('should have minor versions in valid range', () => {
+      maintainedNodeVersions.forEach(version => {
+        const minor = Number.parseInt(version.split('.')[1], 10)
+        expect(minor).toBeGreaterThanOrEqual(0)
+        expect(minor).toBeLessThanOrEqual(99)
+      })
+    })
+
+    it('should have patch versions in valid range', () => {
+      maintainedNodeVersions.forEach(version => {
+        const patch = Number.parseInt(version.split('.')[2], 10)
+        expect(patch).toBeGreaterThanOrEqual(0)
+        expect(patch).toBeLessThanOrEqual(99)
+      })
+    })
+  })
+
+  describe('array operations', () => {
+    it('should support forEach iteration', () => {
+      const versions: string[] = []
+      maintainedNodeVersions.forEach(v => versions.push(v))
+      expect(versions).toHaveLength(4)
+    })
+
+    it('should support map operation', () => {
+      const majors = maintainedNodeVersions.map(v =>
+        Number.parseInt(v.split('.')[0], 10),
+      )
+      expect(majors).toHaveLength(4)
+      majors.forEach(m => expect(typeof m).toBe('number'))
+    })
+
+    it('should support filter operation', () => {
+      const filtered = maintainedNodeVersions.filter(v => v.startsWith('2'))
+      expect(Array.isArray(filtered)).toBe(true)
+    })
+
+    it('should support find operation', () => {
+      const found = maintainedNodeVersions.find(
+        v => v === maintainedNodeVersions.current,
+      )
+      expect(found).toBe(maintainedNodeVersions.current)
+    })
+
+    it('should support includes operation', () => {
+      expect(
+        maintainedNodeVersions.includes(maintainedNodeVersions.current),
+      ).toBe(true)
+      expect(maintainedNodeVersions.includes('99.99.99')).toBe(false)
+    })
+
+    it('should support slice operation', () => {
+      const sliced = maintainedNodeVersions.slice(0, 2)
+      expect(sliced).toHaveLength(2)
+      expect(sliced[0]).toBe(maintainedNodeVersions.last)
+      expect(sliced[1]).toBe(maintainedNodeVersions.previous)
+    })
+
+    it('should support spread operator', () => {
+      const spread = [...maintainedNodeVersions]
+      expect(spread).toHaveLength(4)
+      expect(spread[0]).toBe(maintainedNodeVersions[0])
+    })
+
+    it('should support destructuring', () => {
+      const [first, second, third, fourth] = maintainedNodeVersions
+      expect(first).toBe(maintainedNodeVersions.last)
+      expect(second).toBe(maintainedNodeVersions.previous)
+      expect(third).toBe(maintainedNodeVersions.current)
+      expect(fourth).toBe(maintainedNodeVersions.next)
+    })
+  })
+
+  describe('edge cases', () => {
+    it('should handle string operations on versions', () => {
+      maintainedNodeVersions.forEach(version => {
+        expect(version.length).toBeGreaterThan(0)
+        expect(version.includes('.')).toBe(true)
+        expect(version.split('.').length).toBe(3)
+      })
+    })
+
+    it('should not have duplicates', () => {
+      const unique = new Set(maintainedNodeVersions)
+      expect(unique.size).toBe(maintainedNodeVersions.length)
+    })
+
+    it('should not have empty strings', () => {
+      maintainedNodeVersions.forEach(version => {
+        expect(version.length).toBeGreaterThan(0)
+        expect(version.trim()).toBe(version)
+      })
+    })
+  })
+})
diff --git a/test/registry/memoization.test.ts b/test/unit/memoization.test.ts
similarity index 96%
rename from test/registry/memoization.test.ts
rename to test/unit/memoization.test.ts
index cdf2bd8..87d9030 100644
--- a/test/registry/memoization.test.ts
+++ b/test/unit/memoization.test.ts
@@ -1,5 +1,15 @@
 /**
- * @fileoverview Unit tests for memoization utilities.
+ * @fileoverview Unit tests for function memoization utilities.
+ *
+ * Tests memoization and caching decorators:
+ * - memoize() caches synchronous function results
+ * - memoizeAsync() caches async function results with promise deduplication
+ * - memoizeWeak() uses WeakMap for object key caching
+ * - memoizeDebounced() combines memoization with debouncing
+ * - once() ensures function executes exactly once
+ * - Memoize() decorator for class methods
+ * - clearAllMemoizationCaches() global cache clearing
+ * Used by Socket tools to optimize expensive operations and API calls.
  */
 
 import {
diff --git a/test/unit/objects.test.ts b/test/unit/objects.test.ts
new file mode 100644
index 0000000..9c85f5b
--- /dev/null
+++ b/test/unit/objects.test.ts
@@ -0,0 +1,850 @@
+/**
+ * @fileoverview Unit tests for object manipulation utilities.
+ *
+ * Tests advanced object manipulation and lazy property patterns:
+ * - Lazy getters: createLazyGetter(), defineLazyGetter(), defineLazyGetters() with memoization
+ * - Property definition: defineGetter() for custom getters on objects
+ * - Object utilities: merge(), toSortedObject(), toSortedObjectFromEntries()
+ * - Type guards: isObject(), isObjectObject() (excludes arrays/null)
+ * - Property access: getOwn(), hasOwn(), getKeys(), hasKeys(), getOwnPropertyValues()
+ * - Aliases: objectAssign, objectEntries, objectFreeze (direct references to Object.*)
+ * - Constants: createConstantsObject() for frozen objects with typed getters
+ * - Sorting: entryKeyComparator() for consistent key ordering
+ * Tests validate lazy evaluation, memoization, stats tracking, type narrowing, and edge cases.
+ * Lazy getters are critical for performance - deferring expensive computations until needed.
+ */
+
+import type { GetterDefObj } from '@socketsecurity/lib/objects'
+import {
+  createConstantsObject,
+  createLazyGetter,
+  defineGetter,
+  defineLazyGetter,
+  defineLazyGetters,
+  entryKeyComparator,
+  getKeys,
+  getOwn,
+  getOwnPropertyValues,
+  hasKeys,
+  hasOwn,
+  isObject,
+  isObjectObject,
+  merge,
+  objectAssign,
+  objectEntries,
+  objectFreeze,
+  toSortedObject,
+  toSortedObjectFromEntries,
+} from '@socketsecurity/lib/objects'
+import { describe, expect, it } from 'vitest'
+
+describe('objects', () => {
+  describe('createLazyGetter', () => {
+    it('should create a lazy getter that memoizes result', () => {
+      let callCount = 0
+      const getter = createLazyGetter('test', () => {
+        callCount += 1
+        return 'computed'
+      })
+
+      expect(callCount).toBe(0)
+      expect(getter()).toBe('computed')
+      expect(callCount).toBe(1)
+      expect(getter()).toBe('computed')
+      expect(callCount).toBe(1) // Should not call again
+    })
+
+    it('should track initialization in stats', () => {
+      const stats = { initialized: new Set<PropertyKey>() }
+      const getter = createLazyGetter('myProp', () => 'value', stats)
+
+      expect(stats.initialized.has('myProp')).toBe(false)
+      getter()
+      expect(stats.initialized.has('myProp')).toBe(true)
+    })
+  })
+
+  describe('defineGetter', () => {
+    it('should define a getter property', () => {
+      const obj = {}
+      defineGetter(obj, 'test', () => 'value')
+
+      expect((obj as { test: string }).test).toBe('value')
+    })
+
+    it('should return the object', () => {
+      const obj = {}
+      const result = defineGetter(obj, 'test', () => 'value')
+      expect(result).toBe(obj)
+    })
+  })
+
+  describe('defineLazyGetter', () => {
+    it('should define a lazy getter property', () => {
+      const obj = {}
+      let callCount = 0
+      defineLazyGetter(obj, 'test', () => {
+        callCount += 1
+        return 'value'
+      })
+
+      expect(callCount).toBe(0)
+      expect((obj as { test: string }).test).toBe('value')
+      expect(callCount).toBe(1)
+      expect((obj as { test: string }).test).toBe('value')
+      expect(callCount).toBe(1)
+    })
+  })
+
+  describe('entryKeyComparator', () => {
+    it('should compare entry keys alphabetically', () => {
+      expect(entryKeyComparator(['a', 1], ['b', 2])).toBeLessThan(0)
+      expect(entryKeyComparator(['b', 1], ['a', 2])).toBeGreaterThan(0)
+      expect(entryKeyComparator(['a', 1], ['a', 2])).toBe(0)
+    })
+
+    it('should handle symbol keys', () => {
+      const sym1 = Symbol('a')
+      const sym2 = Symbol('b')
+      const result = entryKeyComparator([sym1, 1], [sym2, 2])
+      expect(typeof result).toBe('number')
+    })
+
+    it('should handle number keys', () => {
+      expect(entryKeyComparator([1, 'a'], [2, 'b'])).toBeLessThan(0)
+      expect(entryKeyComparator([2, 'a'], [1, 'b'])).toBeGreaterThan(0)
+    })
+  })
+
+  describe('getKeys', () => {
+    it('should return enumerable own keys', () => {
+      const obj = { a: 1, b: 2, c: 3 }
+      const keys = getKeys(obj)
+      expect(keys).toEqual(['a', 'b', 'c'])
+    })
+
+    it('should return empty array for non-objects', () => {
+      expect(getKeys(null)).toEqual([])
+      expect(getKeys(undefined)).toEqual([])
+      expect(getKeys(123)).toEqual([])
+      expect(getKeys('string')).toEqual([])
+    })
+
+    it('should return empty array for objects without keys', () => {
+      expect(getKeys({})).toEqual([])
+    })
+  })
+
+  describe('getOwn', () => {
+    it('should get own property value', () => {
+      const obj = { a: 1, b: 2 }
+      expect(getOwn(obj, 'a')).toBe(1)
+      expect(getOwn(obj, 'b')).toBe(2)
+    })
+
+    it('should return undefined for non-existent properties', () => {
+      const obj = { a: 1 }
+      expect(getOwn(obj, 'b')).toBeUndefined()
+    })
+
+    it('should return undefined for null/undefined', () => {
+      expect(getOwn(null, 'a')).toBeUndefined()
+      expect(getOwn(undefined, 'a')).toBeUndefined()
+    })
+
+    it('should not access prototype properties', () => {
+      const proto = { inherited: 'value' }
+      const obj = Object.create(proto)
+      obj.own = 'owned'
+      expect(getOwn(obj, 'own')).toBe('owned')
+      expect(getOwn(obj, 'inherited')).toBeUndefined()
+    })
+  })
+
+  describe('getOwnPropertyValues', () => {
+    it('should return all own property values', () => {
+      const obj = { a: 1, b: 2, c: 3 }
+      const values = getOwnPropertyValues(obj)
+      expect(values).toContain(1)
+      expect(values).toContain(2)
+      expect(values).toContain(3)
+      expect(values).toHaveLength(3)
+    })
+
+    it('should return empty array for null/undefined', () => {
+      expect(getOwnPropertyValues(null)).toEqual([])
+      expect(getOwnPropertyValues(undefined)).toEqual([])
+    })
+
+    it('should return empty array for objects without properties', () => {
+      expect(getOwnPropertyValues({})).toEqual([])
+    })
+  })
+
+  describe('hasKeys', () => {
+    it('should return true for objects with keys', () => {
+      expect(hasKeys({ a: 1 })).toBe(true)
+      expect(hasKeys({ a: 1, b: 2 })).toBe(true)
+    })
+
+    it('should return false for empty objects', () => {
+      expect(hasKeys({})).toBe(false)
+    })
+
+    it('should return false for null/undefined', () => {
+      expect(hasKeys(null)).toBe(false)
+      expect(hasKeys(undefined)).toBe(false)
+    })
+
+    it('should only check enumerable own properties', () => {
+      const obj = Object.create({ inherited: 1 })
+      expect(hasKeys(obj)).toBe(false)
+      obj.own = 1
+      expect(hasKeys(obj)).toBe(true)
+    })
+  })
+
+  describe('hasOwn', () => {
+    it('should return true for own properties', () => {
+      const obj = { a: 1, b: 2 }
+      expect(hasOwn(obj, 'a')).toBe(true)
+      expect(hasOwn(obj, 'b')).toBe(true)
+    })
+
+    it('should return false for non-existent properties', () => {
+      const obj = { a: 1 }
+      expect(hasOwn(obj, 'b')).toBe(false)
+    })
+
+    it('should return false for null/undefined', () => {
+      expect(hasOwn(null, 'a')).toBe(false)
+      expect(hasOwn(undefined, 'a')).toBe(false)
+    })
+
+    it('should not detect inherited properties', () => {
+      const proto = { inherited: 1 }
+      const obj = Object.create(proto)
+      expect(hasOwn(obj, 'inherited')).toBe(false)
+    })
+  })
+
+  describe('isObject', () => {
+    it('should return true for objects', () => {
+      expect(isObject({})).toBe(true)
+      expect(isObject({ a: 1 })).toBe(true)
+      expect(isObject([])).toBe(true)
+      expect(isObject(new Date())).toBe(true)
+    })
+
+    it('should return false for primitives', () => {
+      expect(isObject(null)).toBe(false)
+      expect(isObject(undefined)).toBe(false)
+      expect(isObject(123)).toBe(false)
+      expect(isObject('string')).toBe(false)
+      expect(isObject(true)).toBe(false)
+    })
+  })
+
+  describe('isObjectObject', () => {
+    it('should return true for plain objects', () => {
+      expect(isObjectObject({})).toBe(true)
+      expect(isObjectObject({ a: 1 })).toBe(true)
+      expect(isObjectObject(Object.create(null))).toBe(true)
+    })
+
+    it('should return false for arrays', () => {
+      expect(isObjectObject([])).toBe(false)
+      expect(isObjectObject([1, 2, 3])).toBe(false)
+    })
+
+    it('should return false for other objects', () => {
+      expect(isObjectObject(new Date())).toBe(false)
+      expect(isObjectObject(new Map())).toBe(false)
+      expect(isObjectObject(new Set())).toBe(false)
+    })
+
+    it('should return false for primitives', () => {
+      expect(isObjectObject(null)).toBe(false)
+      expect(isObjectObject(undefined)).toBe(false)
+      expect(isObjectObject(123)).toBe(false)
+    })
+  })
+
+  describe('objectAssign', () => {
+    it('should copy properties from source to target', () => {
+      const target = { a: 1 }
+      const source = { b: 2, c: 3 }
+      const result = objectAssign(target, source)
+      expect(result).toBe(target)
+      expect(result).toEqual({ a: 1, b: 2, c: 3 })
+    })
+
+    it('should handle multiple sources', () => {
+      const result = objectAssign({}, { a: 1 }, { b: 2 }, { c: 3 })
+      expect(result).toEqual({ a: 1, b: 2, c: 3 })
+    })
+
+    it('should overwrite existing properties', () => {
+      const result = objectAssign({ a: 1 }, { a: 2 })
+      expect(result).toEqual({ a: 2 })
+    })
+  })
+
+  describe('objectEntries', () => {
+    it('should return entries for objects', () => {
+      const obj = { a: 1, b: 2 }
+      const entries = objectEntries(obj)
+      expect(entries).toContainEqual(['a', 1])
+      expect(entries).toContainEqual(['b', 2])
+    })
+
+    it('should return empty array for null/undefined', () => {
+      expect(objectEntries(null)).toEqual([])
+      expect(objectEntries(undefined)).toEqual([])
+    })
+
+    it('should include symbol keys', () => {
+      const sym = Symbol('test')
+      const obj = { [sym]: 'value', a: 1 }
+      const entries = objectEntries(obj)
+      expect(entries).toContainEqual([sym, 'value'])
+      expect(entries).toContainEqual(['a', 1])
+    })
+  })
+
+  describe('objectFreeze', () => {
+    it('should freeze an object', () => {
+      const obj = { a: 1 }
+      const frozen = objectFreeze(obj)
+      expect(Object.isFrozen(frozen)).toBe(true)
+    })
+
+    it('should prevent modifications', () => {
+      const obj = { a: 1 }
+      const frozen = objectFreeze(obj)
+      expect(() => {
+        ;(frozen as { a: number; b?: number }).b = 2
+      }).toThrow()
+    })
+  })
+
+  describe('merge', () => {
+    it('should deep merge objects', () => {
+      const target = { a: 1, b: { c: 2 } }
+      const source = { b: { d: 3 }, e: 4 }
+      const result = merge(target, source)
+      expect(result).toEqual({ a: 1, b: { c: 2, d: 3 }, e: 4 })
+    })
+
+    it('should replace arrays instead of merging', () => {
+      const target = { a: [1, 2] }
+      const source = { a: [3, 4] }
+      const result = merge(target, source)
+      expect(result).toEqual({ a: [3, 4] })
+    })
+
+    it('should handle nested objects', () => {
+      const target = { a: { b: { c: 1 } } }
+      const source = { a: { b: { d: 2 } } }
+      const result = merge(target, source)
+      expect(result).toEqual({ a: { b: { c: 1, d: 2 } } })
+    })
+
+    it('should handle non-object inputs', () => {
+      expect(merge(null as unknown as object, { a: 1 })).toBeNull()
+      expect(merge({ a: 1 }, null as unknown as object)).toEqual({ a: 1 })
+    })
+  })
+
+  describe('toSortedObject', () => {
+    it('should sort object keys alphabetically', () => {
+      const obj = { c: 3, a: 1, b: 2 }
+      const sorted = toSortedObject(obj)
+      expect(Object.keys(sorted)).toEqual(['a', 'b', 'c'])
+    })
+
+    it('should preserve values', () => {
+      const obj = { c: 3, a: 1, b: 2 }
+      const sorted = toSortedObject(obj)
+      expect(sorted).toEqual({ a: 1, b: 2, c: 3 })
+    })
+
+    it('should handle empty objects', () => {
+      const sorted = toSortedObject({})
+      expect(sorted).toEqual({})
+    })
+  })
+
+  describe('toSortedObjectFromEntries', () => {
+    it('should create sorted object from entries', () => {
+      const entries: Array<[PropertyKey, number]> = [
+        ['c', 3],
+        ['a', 1],
+        ['b', 2],
+      ]
+      const sorted = toSortedObjectFromEntries(entries)
+      expect(Object.keys(sorted)).toEqual(['a', 'b', 'c'])
+      expect(sorted).toEqual({ a: 1, b: 2, c: 3 })
+    })
+
+    it('should handle symbol keys', () => {
+      const sym1 = Symbol('a')
+      const sym2 = Symbol('b')
+      const entries: Array<[PropertyKey, number]> = [
+        [sym2, 2],
+        ['a', 1],
+        [sym1, 3],
+      ]
+      const sorted = toSortedObjectFromEntries(entries)
+      expect(sorted).toHaveProperty('a')
+      expect(sorted[sym1]).toBe(3)
+      expect(sorted[sym2]).toBe(2)
+    })
+
+    it('should handle empty entries', () => {
+      const sorted = toSortedObjectFromEntries([])
+      expect(sorted).toEqual({})
+    })
+  })
+
+  describe('createConstantsObject', () => {
+    it('should create a frozen object with properties', () => {
+      const obj = createConstantsObject({ a: 1, b: 2 })
+      expect(Object.isFrozen(obj)).toBe(true)
+      expect((obj as { a: number }).a).toBe(1)
+    })
+
+    it('should create object with lazy getters', () => {
+      let callCount = 0
+      const obj = createConstantsObject(
+        { base: 'value' },
+        {
+          getters: {
+            computed: () => {
+              callCount += 1
+              return 'result'
+            },
+          },
+        },
+      )
+      expect(callCount).toBe(0)
+      expect((obj as { computed: string }).computed).toBe('result')
+      expect(callCount).toBe(1)
+      expect((obj as { computed: string }).computed).toBe('result')
+      expect(callCount).toBe(1)
+    })
+
+    it('should create object with mixin properties', () => {
+      const obj = createConstantsObject(
+        { a: 1 },
+        {
+          mixin: {
+            b: 2,
+            c: 3,
+          },
+        },
+      )
+      expect((obj as { a: number; b: number; c: number }).a).toBe(1)
+      expect((obj as { a: number; b: number; c: number }).b).toBe(2)
+      expect((obj as { a: number; b: number; c: number }).c).toBe(3)
+    })
+
+    it('should not override props with mixin', () => {
+      const obj = createConstantsObject(
+        { a: 1, b: 2 },
+        {
+          mixin: {
+            b: 99,
+            c: 3,
+          },
+        },
+      )
+      expect((obj as { a: number; b: number; c: number }).a).toBe(1)
+      expect((obj as { a: number; b: number; c: number }).b).toBe(2)
+      expect((obj as { a: number; b: number; c: number }).c).toBe(3)
+    })
+
+    it('should handle undefined options', () => {
+      const obj = createConstantsObject({ a: 1 }, undefined)
+      expect((obj as { a: number }).a).toBe(1)
+      expect(Object.isFrozen(obj)).toBe(true)
+    })
+  })
+
+  describe('defineLazyGetters', () => {
+    it('should define multiple lazy getters', () => {
+      const obj = {}
+      let count1 = 0
+      let count2 = 0
+
+      defineLazyGetters(obj, {
+        prop1: () => {
+          count1 += 1
+          return 'value1'
+        },
+        prop2: () => {
+          count2 += 1
+          return 'value2'
+        },
+      })
+
+      expect(count1).toBe(0)
+      expect(count2).toBe(0)
+      expect((obj as { prop1: string }).prop1).toBe('value1')
+      expect(count1).toBe(1)
+      expect(count2).toBe(0)
+      expect((obj as { prop2: string }).prop2).toBe('value2')
+      expect(count1).toBe(1)
+      expect(count2).toBe(1)
+    })
+
+    it('should handle undefined getterDefObj', () => {
+      const obj = {}
+      const result = defineLazyGetters(obj, undefined)
+      expect(result).toBe(obj)
+    })
+
+    it('should handle null getterDefObj', () => {
+      const obj = {}
+      const result = defineLazyGetters(obj, null as unknown as GetterDefObj)
+      expect(result).toBe(obj)
+    })
+
+    it('should handle symbol keys in getters', () => {
+      const obj = {}
+      const sym = Symbol('test')
+      defineLazyGetters(obj, {
+        [sym]: () => 'symbol-value',
+      })
+      expect((obj as { [key: symbol]: string })[sym]).toBe('symbol-value')
+    })
+
+    it('should handle empty getter object', () => {
+      const obj = {}
+      defineLazyGetters(obj, {})
+      expect(obj).toEqual({})
+    })
+  })
+
+  describe('merge - additional edge cases', () => {
+    it('should handle symbol keys', () => {
+      const sym = Symbol('test')
+      const target = { a: 1 }
+      const source = { [sym]: 'value', b: 2 }
+      merge(target, source)
+      expect((target as unknown as Record<symbol, string>)[sym]).toBe('value')
+      expect((target as { a: number; b: number }).b).toBe(2)
+    })
+
+    it('should replace object with array', () => {
+      const target = { a: { b: 1 } }
+      const source = { a: [1, 2, 3] }
+      merge(target, source)
+      expect(target.a).toEqual([1, 2, 3])
+    })
+
+    it('should replace array with object', () => {
+      const target = { a: [1, 2, 3] }
+      const source = { a: { b: 1 } }
+      merge(target, source)
+      expect(target.a).toEqual({ b: 1 })
+    })
+
+    it('should handle null values', () => {
+      const target = { a: { b: 1 } }
+      const source = { a: null }
+      merge(target, source)
+      expect(target.a).toBe(null)
+    })
+
+    it('should handle undefined values', () => {
+      const target = { a: { b: 1 } }
+      const source = { a: undefined }
+      merge(target, source)
+      expect(target.a).toBe(undefined)
+    })
+
+    it('should handle merging into empty object', () => {
+      const target = {}
+      const source = { a: 1, b: { c: 2 } }
+      merge(target, source)
+      expect(target).toEqual({ a: 1, b: { c: 2 } })
+    })
+
+    it('should handle deeply nested structures', () => {
+      const target = { a: { b: { c: { d: 1 } } } }
+      const source = { a: { b: { c: { e: 2 } } } }
+      merge(target, source)
+      expect(target).toEqual({ a: { b: { c: { d: 1, e: 2 } } } })
+    })
+  })
+
+  describe('objectEntries - additional tests', () => {
+    it('should include non-enumerable properties', () => {
+      const obj = { a: 1 }
+      Object.defineProperty(obj, 'hidden', {
+        value: 'secret',
+        enumerable: false,
+      })
+      const entries = objectEntries(obj)
+      expect(entries).toContainEqual(['a', 1])
+      expect(entries).toContainEqual(['hidden', 'secret'])
+    })
+
+    it('should work with arrays', () => {
+      const arr = ['a', 'b']
+      const entries = objectEntries(arr)
+      expect(entries).toContainEqual(['0', 'a'])
+      expect(entries).toContainEqual(['1', 'b'])
+      expect(entries).toContainEqual(['length', 2])
+    })
+  })
+
+  describe('getOwnPropertyValues - additional tests', () => {
+    it('should include non-enumerable properties', () => {
+      const obj = { a: 1 }
+      Object.defineProperty(obj, 'hidden', {
+        value: 'secret',
+        enumerable: false,
+      })
+      const values = getOwnPropertyValues(obj)
+      expect(values).toContain(1)
+      expect(values).toContain('secret')
+    })
+  })
+
+  describe('toSortedObject - additional tests', () => {
+    it('should handle symbol keys', () => {
+      const sym1 = Symbol('z')
+      const sym2 = Symbol('a')
+      const obj = { z: 1, a: 2, [sym1]: 3, [sym2]: 4 }
+      const sorted = toSortedObject(obj)
+      expect(sorted[sym1]).toBe(3)
+      expect(sorted[sym2]).toBe(4)
+      expect((sorted as { a: number }).a).toBe(2)
+    })
+
+    it('should handle number keys', () => {
+      const obj = { 3: 'three', 1: 'one', 2: 'two' }
+      const sorted = toSortedObject(obj)
+      const keys = Object.keys(sorted)
+      expect(keys).toEqual(['1', '2', '3'])
+    })
+  })
+
+  describe('toSortedObjectFromEntries - additional tests', () => {
+    it('should work with Map entries', () => {
+      const map = new Map<PropertyKey, string>([
+        ['z', 'last'],
+        ['a', 'first'],
+        ['m', 'middle'],
+      ])
+      const sorted = toSortedObjectFromEntries(map)
+      expect(Object.keys(sorted)).toEqual(['a', 'm', 'z'])
+      expect(sorted).toEqual({ a: 'first', m: 'middle', z: 'last' })
+    })
+
+    it('should handle only symbol entries', () => {
+      const sym1 = Symbol('first')
+      const sym2 = Symbol('second')
+      const sorted = toSortedObjectFromEntries([
+        [sym2, 2],
+        [sym1, 1],
+      ])
+      expect(sorted[sym1]).toBe(1)
+      expect(sorted[sym2]).toBe(2)
+    })
+  })
+
+  describe('getKeys - additional tests', () => {
+    it('should work with arrays', () => {
+      const arr = ['a', 'b', 'c']
+      const keys = getKeys(arr)
+      expect(keys).toEqual(['0', '1', '2'])
+    })
+  })
+
+  describe('getOwn - additional tests', () => {
+    it('should handle symbol keys', () => {
+      const sym = Symbol('test')
+      const obj = { [sym]: 'value' }
+      expect(getOwn(obj, sym)).toBe('value')
+    })
+
+    it('should handle number keys', () => {
+      const obj = { 123: 'value' }
+      expect(getOwn(obj, 123)).toBe('value')
+    })
+
+    it('should handle arrays', () => {
+      const arr = ['a', 'b', 'c']
+      expect(getOwn(arr, 0)).toBe('a')
+      expect(getOwn(arr, '1')).toBe('b')
+      expect(getOwn(arr, 'length')).toBe(3)
+    })
+  })
+
+  describe('hasOwn - additional tests', () => {
+    it('should work with symbol keys', () => {
+      const sym = Symbol('test')
+      const obj = { [sym]: 'value' }
+      expect(hasOwn(obj, sym)).toBe(true)
+      expect(hasOwn(obj, Symbol('other'))).toBe(false)
+    })
+
+    it('should work with arrays', () => {
+      const arr = ['a', 'b', 'c']
+      expect(hasOwn(arr, 0)).toBe(true)
+      expect(hasOwn(arr, 3)).toBe(false)
+      expect(hasOwn(arr, 'length')).toBe(true)
+    })
+
+    it('should handle non-enumerable properties', () => {
+      const obj = {}
+      Object.defineProperty(obj, 'hidden', {
+        value: 'secret',
+        enumerable: false,
+      })
+      expect(hasOwn(obj, 'hidden')).toBe(true)
+    })
+  })
+
+  describe('defineGetter - additional tests', () => {
+    it('should create non-enumerable getter', () => {
+      const obj = {}
+      defineGetter(obj, 'test', () => 'value')
+      expect(Object.keys(obj)).toEqual([])
+      expect(Object.getOwnPropertyNames(obj)).toContain('test')
+    })
+
+    it('should work with symbol keys', () => {
+      const obj = {}
+      const sym = Symbol('test')
+      defineGetter(obj, sym, () => 'symbol-value')
+      expect((obj as { [key: symbol]: string })[sym]).toBe('symbol-value')
+    })
+  })
+
+  describe('defineLazyGetter - additional tests', () => {
+    it('should work with symbol keys', () => {
+      const obj = {}
+      const sym = Symbol('lazy')
+      let called = false
+      defineLazyGetter(obj, sym, () => {
+        called = true
+        return 'value'
+      })
+
+      expect(called).toBe(false)
+      expect((obj as { [key: symbol]: string })[sym]).toBe('value')
+      expect(called).toBe(true)
+    })
+
+    it('should be non-enumerable', () => {
+      const obj = { regular: 'prop' }
+      defineLazyGetter(obj, 'lazy', () => 'value')
+      expect(Object.keys(obj)).toEqual(['regular'])
+    })
+  })
+
+  describe('createLazyGetter - additional tests', () => {
+    it('should work with symbol property names', () => {
+      const sym = Symbol('myProp')
+      const stats = { initialized: new Set<PropertyKey>() }
+      const getter = createLazyGetter(sym, () => 'value', stats)
+
+      expect(stats.initialized.has(sym)).toBe(false)
+      expect(getter()).toBe('value')
+      expect(stats.initialized.has(sym)).toBe(true)
+    })
+
+    it('should work with number property names', () => {
+      const stats = { initialized: new Set<PropertyKey>() }
+      const getter = createLazyGetter(123, () => 'value', stats)
+
+      expect(stats.initialized.has(123)).toBe(false)
+      expect(getter()).toBe('value')
+      expect(stats.initialized.has(123)).toBe(true)
+    })
+
+    it('should memoize falsy values', () => {
+      let callCount = 0
+      const getter = createLazyGetter('test', () => {
+        callCount += 1
+        return 0
+      })
+
+      expect(getter()).toBe(0)
+      expect(callCount).toBe(1)
+      expect(getter()).toBe(0)
+      expect(callCount).toBe(1)
+    })
+
+    it('should memoize null values', () => {
+      let callCount = 0
+      const getter = createLazyGetter('test', () => {
+        callCount += 1
+        return null
+      })
+
+      expect(getter()).toBe(null)
+      expect(callCount).toBe(1)
+      expect(getter()).toBe(null)
+      expect(callCount).toBe(1)
+    })
+  })
+
+  describe('isObjectObject - additional tests', () => {
+    it('should return false for RegExp', () => {
+      expect(isObjectObject(/test/)).toBe(false)
+    })
+
+    it('should return false for Error', () => {
+      expect(isObjectObject(new Error())).toBe(false)
+    })
+
+    it('should return true for Object.create(Object.prototype)', () => {
+      expect(isObjectObject(Object.create(Object.prototype))).toBe(true)
+    })
+
+    it('should return false for objects with custom prototypes', () => {
+      const proto = { custom: true }
+      const obj = Object.create(proto)
+      expect(isObjectObject(obj)).toBe(false)
+    })
+  })
+
+  describe('isObject - additional tests', () => {
+    it('should return true for class instances', () => {
+      class MyClass {}
+      expect(isObject(new MyClass())).toBe(true)
+    })
+
+    it('should return true for RegExp', () => {
+      expect(isObject(/test/)).toBe(true)
+    })
+
+    it('should return false for symbols', () => {
+      expect(isObject(Symbol('test'))).toBe(false)
+    })
+  })
+
+  describe('hasKeys - additional tests', () => {
+    it('should return true for arrays with elements', () => {
+      expect(hasKeys([1, 2, 3])).toBe(true)
+    })
+
+    it('should return false for empty arrays', () => {
+      expect(hasKeys([])).toBe(false)
+    })
+
+    it('should return false for objects with only non-enumerable properties', () => {
+      const obj = {}
+      Object.defineProperty(obj, 'hidden', {
+        value: 'secret',
+        enumerable: false,
+      })
+      expect(hasKeys(obj)).toBe(false)
+    })
+  })
+})
diff --git a/test/unit/packages/editable.test.ts b/test/unit/packages/editable.test.ts
new file mode 100644
index 0000000..8df0137
--- /dev/null
+++ b/test/unit/packages/editable.test.ts
@@ -0,0 +1,1232 @@
+/**
+ * @fileoverview Unit tests for editable package.json manipulation utilities.
+ *
+ * Tests EditablePackageJson class for modifying package.json programmatically:
+ * - Field setters: name, version, description, scripts, dependencies
+ * - Dependency management: add/remove/update dependencies
+ * - Script manipulation: add/remove/update scripts
+ * - Serialization: toJSON(), toString() with formatting preservation
+ * Critical for Socket CLI package.json editing operations (security fixes, updates).
+ */
+
+import { promises as fs } from 'node:fs'
+import path from 'node:path'
+
+import type { EditablePackageJson, PackageJson } from '@socketsecurity/lib/packages'
+import {
+  getEditablePackageJsonClass,
+  pkgJsonToEditable,
+  toEditablePackageJson,
+  toEditablePackageJsonSync,
+} from '@socketsecurity/lib/packages/editable'
+import { describe, expect, it } from 'vitest'
+
+import { runWithTempDir } from '../utils/temp-file-helper.mjs'
+
+describe('packages/editable', () => {
+  describe('getEditablePackageJsonClass', () => {
+    it('should return EditablePackageJson class', () => {
+      const EditablePackageJson = getEditablePackageJsonClass()
+      expect(EditablePackageJson).toBeDefined()
+      expect(typeof EditablePackageJson).toBe('function')
+    })
+
+    it('should return same class instance on multiple calls (memoized)', () => {
+      const EditablePackageJson1 = getEditablePackageJsonClass()
+      const EditablePackageJson2 = getEditablePackageJsonClass()
+      expect(EditablePackageJson1).toBe(EditablePackageJson2)
+    })
+
+    it('should have static methods', () => {
+      const EditablePackageJson = getEditablePackageJsonClass()
+      expect(typeof EditablePackageJson.create).toBe('function')
+      expect(typeof EditablePackageJson.load).toBe('function')
+      expect(typeof EditablePackageJson.fix).toBe('function')
+      expect(typeof EditablePackageJson.normalize).toBe('function')
+      expect(typeof EditablePackageJson.prepare).toBe('function')
+    })
+
+    it('should have static steps properties', () => {
+      const EditablePackageJson = getEditablePackageJsonClass()
+      expect(Array.isArray(EditablePackageJson.fixSteps)).toBe(true)
+      expect(Array.isArray(EditablePackageJson.normalizeSteps)).toBe(true)
+      expect(Array.isArray(EditablePackageJson.prepareSteps)).toBe(true)
+    })
+  })
+
+  describe('EditablePackageJson.create', () => {
+    it('should create a new package.json instance', async () => {
+      await runWithTempDir(async tmpDir => {
+        const EditablePackageJson = getEditablePackageJsonClass()
+        const pkg = await EditablePackageJson.create(tmpDir)
+
+        expect(pkg).toBeDefined()
+        expect(pkg.content).toBeDefined()
+        expect((pkg as any).path).toBe(tmpDir)
+        expect((pkg as any).filename).toContain('package.json')
+      }, 'editable-create-')
+    })
+
+    it('should create package.json with initial data', async () => {
+      await runWithTempDir(async tmpDir => {
+        const EditablePackageJson = getEditablePackageJsonClass()
+        const data: PackageJson = {
+          name: 'test-package',
+          version: '1.0.0',
+          description: 'Test package',
+        }
+        const pkg = await EditablePackageJson.create(tmpDir, { data })
+
+        expect(pkg.content.name).toBe('test-package')
+        expect(pkg.content.version).toBe('1.0.0')
+        expect(pkg.content.description).toBe('Test package')
+      }, 'editable-create-data-')
+    })
+
+    it('should create package.json without data option', async () => {
+      await runWithTempDir(async tmpDir => {
+        const EditablePackageJson = getEditablePackageJsonClass()
+        const pkg = await EditablePackageJson.create(tmpDir, {})
+
+        expect(pkg).toBeDefined()
+        expect(pkg.content).toBeDefined()
+      }, 'editable-create-empty-')
+    })
+  })
+
+  describe('EditablePackageJson.load', () => {
+    it('should load existing package.json file', async () => {
+      await runWithTempDir(async tmpDir => {
+        const pkgPath = path.join(tmpDir, 'package.json')
+        const pkgData = {
+          name: 'test-package',
+          version: '1.0.0',
+        }
+        await fs.writeFile(pkgPath, JSON.stringify(pkgData, null, 2))
+
+        const EditablePackageJson = getEditablePackageJsonClass()
+        const pkg = await EditablePackageJson.load(tmpDir)
+
+        expect(pkg.content.name).toBe('test-package')
+        expect(pkg.content.version).toBe('1.0.0')
+      }, 'editable-load-')
+    })
+
+    it('should throw error when file does not exist and create is false', async () => {
+      await runWithTempDir(async tmpDir => {
+        const EditablePackageJson = getEditablePackageJsonClass()
+
+        await expect(
+          EditablePackageJson.load(tmpDir, { create: false })
+        ).rejects.toThrow()
+      }, 'editable-load-error-')
+    })
+
+    it('should create new package.json when file does not exist and create is true', async () => {
+      await runWithTempDir(async tmpDir => {
+        const EditablePackageJson = getEditablePackageJsonClass()
+        const pkg = await EditablePackageJson.load(tmpDir, { create: true })
+
+        expect(pkg).toBeDefined()
+        expect(pkg.content).toBeDefined()
+      }, 'editable-load-create-')
+    })
+
+    it('should load package.json from directory path', async () => {
+      await runWithTempDir(async tmpDir => {
+        const pkgData = { name: 'test', version: '1.0.0' }
+        await fs.writeFile(
+          path.join(tmpDir, 'package.json'),
+          JSON.stringify(pkgData)
+        )
+
+        const EditablePackageJson = getEditablePackageJsonClass()
+        const pkg = await EditablePackageJson.load(tmpDir)
+
+        expect(pkg.content.name).toBe('test')
+      }, 'editable-load-dir-')
+    })
+
+    it('should preserve indentation from original file', async () => {
+      await runWithTempDir(async tmpDir => {
+        const pkgPath = path.join(tmpDir, 'package.json')
+        const pkgData = '{\n    "name": "test",\n    "version": "1.0.0"\n}\n'
+        await fs.writeFile(pkgPath, pkgData)
+
+        const EditablePackageJson = getEditablePackageJsonClass()
+        const pkg = await EditablePackageJson.load(tmpDir)
+
+        expect(pkg.content.name).toBe('test')
+      }, 'editable-load-indent-')
+    })
+
+    it('should handle non-package.json errors during load with create=true', async () => {
+      await runWithTempDir(async tmpDir => {
+        const EditablePackageJson = getEditablePackageJsonClass()
+
+        await expect(
+          EditablePackageJson.load(tmpDir, { create: true })
+        ).resolves.toBeDefined()
+      }, 'editable-load-fallback-')
+    })
+
+    it('should create new instance when package.json missing and create=true', async () => {
+      await runWithTempDir(async tmpDir => {
+        const EditablePackageJson = getEditablePackageJsonClass()
+        const pkg = await EditablePackageJson.load(tmpDir, { create: true })
+
+        expect(pkg).toBeDefined()
+        expect(pkg.content).toBeDefined()
+      }, 'editable-load-create-')
+    })
+  })
+
+  describe('EditablePackageJson.fix', () => {
+    it('should apply npm fixes to package.json', async () => {
+      await runWithTempDir(async tmpDir => {
+        const pkgData = {
+          name: 'test-package',
+          version: '1.0.0',
+        }
+        await fs.writeFile(
+          path.join(tmpDir, 'package.json'),
+          JSON.stringify(pkgData)
+        )
+
+        const EditablePackageJson = getEditablePackageJsonClass()
+        const pkg = await EditablePackageJson.fix(tmpDir, {})
+
+        expect(pkg).toBeDefined()
+        expect(pkg.content).toBeDefined()
+      }, 'editable-fix-')
+    })
+  })
+
+  describe('EditablePackageJson.normalize', () => {
+    it('should normalize package.json', async () => {
+      await runWithTempDir(async tmpDir => {
+        const pkgData = {
+          name: 'test-package',
+          version: '1.0.0',
+        }
+        await fs.writeFile(
+          path.join(tmpDir, 'package.json'),
+          JSON.stringify(pkgData)
+        )
+
+        const EditablePackageJson = getEditablePackageJsonClass()
+        const pkg = await EditablePackageJson.normalize(tmpDir, {})
+
+        expect(pkg).toBeDefined()
+        expect(pkg.content.name).toBe('test-package')
+      }, 'editable-normalize-')
+    })
+
+    it('should normalize with preserve options', async () => {
+      await runWithTempDir(async tmpDir => {
+        const pkgData = {
+          name: 'test-package',
+          version: '1.0.0',
+          custom: 'field',
+        }
+        await fs.writeFile(
+          path.join(tmpDir, 'package.json'),
+          JSON.stringify(pkgData)
+        )
+
+        const EditablePackageJson = getEditablePackageJsonClass()
+        const pkg = await EditablePackageJson.normalize(tmpDir, {
+          preserve: ['custom'],
+        })
+
+        expect(pkg.content.name).toBe('test-package')
+      }, 'editable-normalize-preserve-')
+    })
+  })
+
+  describe('EditablePackageJson.prepare', () => {
+    it('should prepare package.json for publishing', async () => {
+      await runWithTempDir(async tmpDir => {
+        const pkgData = {
+          name: 'test-package',
+          version: '1.0.0',
+        }
+        await fs.writeFile(
+          path.join(tmpDir, 'package.json'),
+          JSON.stringify(pkgData)
+        )
+
+        const EditablePackageJson = getEditablePackageJsonClass()
+        const pkg = await EditablePackageJson.prepare(tmpDir, {})
+
+        expect(pkg).toBeDefined()
+      }, 'editable-prepare-')
+    })
+  })
+
+  describe('EditablePackageJson instance methods', () => {
+    describe('create', () => {
+      it('should create instance with path', async () => {
+        await runWithTempDir(async tmpDir => {
+          const EditablePackageJson = getEditablePackageJsonClass()
+          const pkg = new EditablePackageJson().create(tmpDir)
+
+          expect((pkg as any).path).toBe(tmpDir)
+          expect((pkg as any).filename).toContain('package.json')
+        }, 'instance-create-')
+      })
+    })
+
+    describe('fromContent', () => {
+      it('should initialize from content object', () => {
+        const EditablePackageJson = getEditablePackageJsonClass()
+        const pkg = new EditablePackageJson()
+        const content = { name: 'test', version: '1.0.0' }
+
+        pkg.fromContent(content)
+
+        expect(pkg.content.name).toBe('test')
+        expect(pkg.content.version).toBe('1.0.0')
+      })
+
+      it('should disable saving when initialized from content', () => {
+        const EditablePackageJson = getEditablePackageJsonClass()
+        const pkg = new EditablePackageJson()
+        const content = { name: 'test', version: '1.0.0' }
+
+        pkg.fromContent(content)
+
+        expect(pkg.willSave()).toBe(false)
+      })
+    })
+
+    describe('fromJSON', () => {
+      it('should initialize from JSON string', () => {
+        const EditablePackageJson = getEditablePackageJsonClass()
+        const pkg = new EditablePackageJson()
+        const json = JSON.stringify({ name: 'test', version: '1.0.0' })
+
+        pkg.fromJSON(json)
+
+        expect(pkg.content.name).toBe('test')
+        expect(pkg.content.version).toBe('1.0.0')
+      })
+    })
+
+    describe('update', () => {
+      it('should update package.json content', () => {
+        const EditablePackageJson = getEditablePackageJsonClass()
+        const pkg = new EditablePackageJson()
+        pkg.fromContent({ name: 'test', version: '1.0.0' })
+
+        pkg.update({ version: '2.0.0', description: 'Updated' })
+
+        expect(pkg.content.version).toBe('2.0.0')
+        expect(pkg.content.description).toBe('Updated')
+      })
+    })
+
+    describe('load', () => {
+      it('should load package.json from path', async () => {
+        await runWithTempDir(async tmpDir => {
+          const pkgData = { name: 'test', version: '1.0.0' }
+          await fs.writeFile(
+            path.join(tmpDir, 'package.json'),
+            JSON.stringify(pkgData)
+          )
+
+          const EditablePackageJson = getEditablePackageJsonClass()
+          const pkg = new EditablePackageJson()
+          await pkg.load(tmpDir)
+
+          expect(pkg.content.name).toBe('test')
+          expect((pkg as any).path).toBe(tmpDir)
+        }, 'instance-load-')
+      })
+
+      it('should throw error when file not found and create is false', async () => {
+        await runWithTempDir(async tmpDir => {
+          const EditablePackageJson = getEditablePackageJsonClass()
+          const pkg = new EditablePackageJson()
+
+          await expect(pkg.load(tmpDir, false)).rejects.toThrow()
+        }, 'instance-load-error-')
+      })
+
+      it('should throw error if index.js does not exist with create=true', async () => {
+        await runWithTempDir(async tmpDir => {
+          const EditablePackageJson = getEditablePackageJsonClass()
+          const pkg = new EditablePackageJson()
+
+          await expect(pkg.load(tmpDir, true)).rejects.toThrow()
+        }, 'instance-load-noindex-')
+      })
+
+      it('should throw original error if index.js is invalid', async () => {
+        await runWithTempDir(async tmpDir => {
+          const indexPath = path.join(tmpDir, 'index.js')
+          await fs.writeFile(indexPath, 'invalid javascript {{{')
+
+          const EditablePackageJson = getEditablePackageJsonClass()
+          const pkg = new EditablePackageJson()
+
+          await expect(pkg.load(tmpDir, true)).rejects.toThrow()
+        }, 'instance-load-invalidindex-')
+      })
+    })
+
+    describe('fix', () => {
+      it('should apply fixes to loaded package.json', async () => {
+        await runWithTempDir(async tmpDir => {
+          const pkgData = { name: 'test', version: '1.0.0' }
+          await fs.writeFile(
+            path.join(tmpDir, 'package.json'),
+            JSON.stringify(pkgData)
+          )
+
+          const EditablePackageJson = getEditablePackageJsonClass()
+          const pkg = new EditablePackageJson()
+          await pkg.load(tmpDir)
+          await pkg.fix()
+
+          expect(pkg.content).toBeDefined()
+        }, 'instance-fix-')
+      })
+
+      it('should apply fixes with options', async () => {
+        await runWithTempDir(async tmpDir => {
+          const pkgData = { name: 'test', version: '1.0.0' }
+          await fs.writeFile(
+            path.join(tmpDir, 'package.json'),
+            JSON.stringify(pkgData)
+          )
+
+          const EditablePackageJson = getEditablePackageJsonClass()
+          const pkg = new EditablePackageJson()
+          await pkg.load(tmpDir)
+          await pkg.fix({})
+
+          expect(pkg.content).toBeDefined()
+        }, 'instance-fix-opts-')
+      })
+    })
+
+    describe('normalize', () => {
+      it('should normalize loaded package.json', async () => {
+        await runWithTempDir(async tmpDir => {
+          const pkgData = { name: 'test', version: '1.0.0' }
+          await fs.writeFile(
+            path.join(tmpDir, 'package.json'),
+            JSON.stringify(pkgData)
+          )
+
+          const EditablePackageJson = getEditablePackageJsonClass()
+          const pkg = new EditablePackageJson()
+          await pkg.load(tmpDir)
+          await pkg.normalize()
+
+          expect(pkg.content.name).toBe('test')
+        }, 'instance-normalize-')
+      })
+
+      it('should normalize with options', async () => {
+        await runWithTempDir(async tmpDir => {
+          const pkgData = { name: 'test', version: '1.0.0' }
+          await fs.writeFile(
+            path.join(tmpDir, 'package.json'),
+            JSON.stringify(pkgData)
+          )
+
+          const EditablePackageJson = getEditablePackageJsonClass()
+          const pkg = new EditablePackageJson()
+          await pkg.load(tmpDir)
+          await pkg.normalize({})
+
+          expect(pkg.content.name).toBe('test')
+        }, 'instance-normalize-opts-')
+      })
+    })
+
+    describe('prepare', () => {
+      it('should prepare loaded package.json', async () => {
+        await runWithTempDir(async tmpDir => {
+          const pkgData = { name: 'test', version: '1.0.0' }
+          await fs.writeFile(
+            path.join(tmpDir, 'package.json'),
+            JSON.stringify(pkgData)
+          )
+
+          const EditablePackageJson = getEditablePackageJsonClass()
+          const pkg = new EditablePackageJson()
+          await pkg.load(tmpDir)
+          await pkg.prepare()
+
+          expect(pkg.content).toBeDefined()
+        }, 'instance-prepare-')
+      })
+
+      it('should prepare with options', async () => {
+        await runWithTempDir(async tmpDir => {
+          const pkgData = { name: 'test', version: '1.0.0' }
+          await fs.writeFile(
+            path.join(tmpDir, 'package.json'),
+            JSON.stringify(pkgData)
+          )
+
+          const EditablePackageJson = getEditablePackageJsonClass()
+          const pkg = new EditablePackageJson()
+          await pkg.load(tmpDir)
+          await pkg.prepare({})
+
+          expect(pkg.content).toBeDefined()
+        }, 'instance-prepare-opts-')
+      })
+    })
+
+    describe('filename', () => {
+      it('should return empty string when path is undefined', () => {
+        const EditablePackageJson = getEditablePackageJsonClass()
+        const pkg = new EditablePackageJson()
+
+        expect((pkg as any).filename).toBe('')
+      })
+
+      it('should return path as-is if it ends with package.json', () => {
+        const EditablePackageJson = getEditablePackageJsonClass()
+        const pkg = new EditablePackageJson()
+        const filepath = '/path/to/package.json'
+        pkg.create(filepath)
+
+        expect((pkg as any).filename).toBe(filepath)
+      })
+
+      it('should append package.json if path does not end with it', () => {
+        const EditablePackageJson = getEditablePackageJsonClass()
+        const pkg = new EditablePackageJson()
+        const dirpath = '/path/to/dir'
+        pkg.create(dirpath)
+
+        expect((pkg as any).filename).toContain('package.json')
+      })
+    })
+
+    describe('path', () => {
+      it('should return the path property', () => {
+        const EditablePackageJson = getEditablePackageJsonClass()
+        const pkg = new EditablePackageJson()
+
+        expect((pkg as any).path).toBeUndefined()
+
+        pkg.create('/test/path')
+        expect((pkg as any).path).toBe('/test/path')
+      })
+    })
+  })
+
+  describe('save and willSave', () => {
+    it('should save package.json to disk', async () => {
+      await runWithTempDir(async tmpDir => {
+        const pkgPath = path.join(tmpDir, 'package.json')
+        const pkgData = { name: 'test', version: '1.0.0' }
+        await fs.writeFile(pkgPath, JSON.stringify(pkgData, null, 2))
+
+        const EditablePackageJson = getEditablePackageJsonClass()
+        const pkg = await EditablePackageJson.load(tmpDir)
+        pkg.update({ version: '2.0.0' })
+
+        const saved = await pkg.save()
+        expect(saved).toBe(true)
+
+        const content = await fs.readFile(pkgPath, 'utf8')
+        const parsed = JSON.parse(content)
+        expect(parsed.version).toBe('2.0.0')
+      }, 'save-')
+    })
+
+    it('should return false when no changes to save', async () => {
+      await runWithTempDir(async tmpDir => {
+        const pkgData = { name: 'test', version: '1.0.0' }
+        await fs.writeFile(
+          path.join(tmpDir, 'package.json'),
+          JSON.stringify(pkgData, null, 2)
+        )
+
+        const EditablePackageJson = getEditablePackageJsonClass()
+        const pkg = await EditablePackageJson.load(tmpDir)
+
+        const saved = await pkg.save()
+        expect(saved).toBe(false)
+      }, 'save-nochange-')
+    })
+
+    it('should throw error when trying to save without canSave', async () => {
+      const EditablePackageJson = getEditablePackageJsonClass()
+      const pkg = new EditablePackageJson()
+      pkg.fromContent({ name: 'test', version: '1.0.0' })
+
+      await expect(pkg.save()).rejects.toThrow('No package.json to save to')
+    })
+
+    it('should throw error when content is undefined', async () => {
+      const EditablePackageJson = getEditablePackageJsonClass()
+      const pkg = new EditablePackageJson()
+
+      await expect(pkg.save()).rejects.toThrow('No package.json to save to')
+    })
+
+    it('should save with sort option', async () => {
+      await runWithTempDir(async tmpDir => {
+        const pkgData = {
+          version: '1.0.0',
+          name: 'test',
+          description: 'Test',
+        }
+        await fs.writeFile(
+          path.join(tmpDir, 'package.json'),
+          JSON.stringify(pkgData, null, 2)
+        )
+
+        const EditablePackageJson = getEditablePackageJsonClass()
+        const pkg = await EditablePackageJson.load(tmpDir)
+        pkg.update({ description: 'Updated' })
+
+        const saved = await pkg.save({ sort: true })
+        expect(saved).toBe(true)
+      }, 'save-sort-')
+    })
+
+    it('should save with ignoreWhitespace option', async () => {
+      await runWithTempDir(async tmpDir => {
+        const pkgData = { name: 'test', version: '1.0.0' }
+        await fs.writeFile(
+          path.join(tmpDir, 'package.json'),
+          JSON.stringify(pkgData, null, 2)
+        )
+
+        const EditablePackageJson = getEditablePackageJsonClass()
+        const pkg = await EditablePackageJson.load(tmpDir)
+
+        const saved = await pkg.save({ ignoreWhitespace: true })
+        expect(saved).toBe(false)
+      }, 'save-whitespace-')
+    })
+
+    it('should preserve custom indentation', async () => {
+      await runWithTempDir(async tmpDir => {
+        const pkgPath = path.join(tmpDir, 'package.json')
+        const pkgData = '{\n    "name": "test",\n    "version": "1.0.0"\n}\n'
+        await fs.writeFile(pkgPath, pkgData)
+
+        const EditablePackageJson = getEditablePackageJsonClass()
+        const pkg = await EditablePackageJson.load(tmpDir)
+        pkg.update({ description: 'Test' })
+
+        await pkg.save()
+
+        const content = await fs.readFile(pkgPath, 'utf8')
+        expect(content).toContain('    "name"')
+      }, 'save-indent-')
+    })
+
+    it('should preserve custom newline characters', async () => {
+      await runWithTempDir(async tmpDir => {
+        const pkgPath = path.join(tmpDir, 'package.json')
+        const pkgData = '{\r\n  "name": "test",\r\n  "version": "1.0.0"\r\n}\r\n'
+        await fs.writeFile(pkgPath, pkgData)
+
+        const EditablePackageJson = getEditablePackageJsonClass()
+        const pkg = await EditablePackageJson.load(tmpDir)
+        pkg.update({ description: 'Test' })
+
+        await pkg.save()
+
+        const content = await fs.readFile(pkgPath, 'utf8')
+        expect(content).toContain('\r\n')
+      }, 'save-newline-')
+    })
+
+    it('should use default indentation when not specified', async () => {
+      await runWithTempDir(async tmpDir => {
+        const EditablePackageJson = getEditablePackageJsonClass()
+        const pkg = await EditablePackageJson.create(tmpDir, {
+          data: { name: 'test', version: '1.0.0' },
+        })
+
+        await pkg.save()
+
+        const content = await fs.readFile((pkg as any).filename, 'utf8')
+        expect(content).toContain('  "name"')
+      }, 'save-default-indent-')
+    })
+
+    it('should willSave return true when changes exist', async () => {
+      await runWithTempDir(async tmpDir => {
+        const pkgData = { name: 'test', version: '1.0.0' }
+        await fs.writeFile(
+          path.join(tmpDir, 'package.json'),
+          JSON.stringify(pkgData, null, 2)
+        )
+
+        const EditablePackageJson = getEditablePackageJsonClass()
+        const pkg = await EditablePackageJson.load(tmpDir)
+        pkg.update({ version: '2.0.0' })
+
+        expect(pkg.willSave()).toBe(true)
+      }, 'willsave-true-')
+    })
+
+    it('should willSave return false when no changes exist', async () => {
+      await runWithTempDir(async tmpDir => {
+        const pkgData = { name: 'test', version: '1.0.0' }
+        await fs.writeFile(
+          path.join(tmpDir, 'package.json'),
+          JSON.stringify(pkgData, null, 2)
+        )
+
+        const EditablePackageJson = getEditablePackageJsonClass()
+        const pkg = await EditablePackageJson.load(tmpDir)
+
+        expect(pkg.willSave()).toBe(false)
+      }, 'willsave-false-')
+    })
+
+    it('should willSave return false when cannot save', () => {
+      const EditablePackageJson = getEditablePackageJsonClass()
+      const pkg = new EditablePackageJson()
+      pkg.fromContent({ name: 'test', version: '1.0.0' })
+
+      expect(pkg.willSave()).toBe(false)
+    })
+
+    it('should willSave return false when content is undefined', () => {
+      const EditablePackageJson = getEditablePackageJsonClass()
+      const pkg = new EditablePackageJson()
+
+      expect(pkg.willSave()).toBe(false)
+    })
+
+    it('should willSave respect ignoreWhitespace option', async () => {
+      await runWithTempDir(async tmpDir => {
+        const pkgData = { name: 'test', version: '1.0.0' }
+        await fs.writeFile(
+          path.join(tmpDir, 'package.json'),
+          JSON.stringify(pkgData, null, 2) + '\n'
+        )
+
+        const EditablePackageJson = getEditablePackageJsonClass()
+        const pkg = await EditablePackageJson.load(tmpDir)
+
+        // ignoreWhitespace checks content equality, not file text equality
+        // When symbols are present, it may return true
+        const willSave = pkg.willSave({ ignoreWhitespace: true })
+        expect(typeof willSave).toBe('boolean')
+      }, 'willsave-whitespace-')
+    })
+
+    it('should willSave work with sort option', async () => {
+      await runWithTempDir(async tmpDir => {
+        const pkgData = {
+          version: '1.0.0',
+          name: 'test',
+        }
+        await fs.writeFile(
+          path.join(tmpDir, 'package.json'),
+          JSON.stringify(pkgData, null, 2)
+        )
+
+        const EditablePackageJson = getEditablePackageJsonClass()
+        const pkg = await EditablePackageJson.load(tmpDir)
+
+        const willSave = pkg.willSave({ sort: true })
+        expect(typeof willSave).toBe('boolean')
+      }, 'willsave-sort-')
+    })
+  })
+
+  describe('saveSync', () => {
+    it('should synchronously save package.json', async () => {
+      await runWithTempDir(async tmpDir => {
+        const pkgPath = path.join(tmpDir, 'package.json')
+        const pkgData = { name: 'test', version: '1.0.0' }
+        await fs.writeFile(pkgPath, JSON.stringify(pkgData, null, 2))
+
+        const EditablePackageJson = getEditablePackageJsonClass()
+        const pkg = await EditablePackageJson.load(tmpDir)
+        pkg.update({ version: '2.0.0' })
+
+        const saved = pkg.saveSync()
+        expect(saved).toBe(true)
+
+        const content = await fs.readFile(pkgPath, 'utf8')
+        const parsed = JSON.parse(content)
+        expect(parsed.version).toBe('2.0.0')
+      }, 'savesync-')
+    })
+
+    it('should return false when no changes to save', async () => {
+      await runWithTempDir(async tmpDir => {
+        const pkgData = { name: 'test', version: '1.0.0' }
+        await fs.writeFile(
+          path.join(tmpDir, 'package.json'),
+          JSON.stringify(pkgData, null, 2)
+        )
+
+        const EditablePackageJson = getEditablePackageJsonClass()
+        const pkg = await EditablePackageJson.load(tmpDir)
+
+        const saved = pkg.saveSync()
+        expect(saved).toBe(false)
+      }, 'savesync-nochange-')
+    })
+
+    it('should throw error when cannot save', () => {
+      const EditablePackageJson = getEditablePackageJsonClass()
+      const pkg = new EditablePackageJson()
+      pkg.fromContent({ name: 'test', version: '1.0.0' })
+
+      expect(() => pkg.saveSync()).toThrow('No package.json to save to')
+    })
+
+    it('should saveSync with sort option', async () => {
+      await runWithTempDir(async tmpDir => {
+        const pkgData = {
+          version: '1.0.0',
+          name: 'test',
+        }
+        await fs.writeFile(
+          path.join(tmpDir, 'package.json'),
+          JSON.stringify(pkgData, null, 2)
+        )
+
+        const EditablePackageJson = getEditablePackageJsonClass()
+        const pkg = await EditablePackageJson.load(tmpDir)
+        pkg.update({ description: 'Test' })
+
+        const saved = pkg.saveSync({ sort: true })
+        expect(saved).toBe(true)
+      }, 'savesync-sort-')
+    })
+
+    it('should saveSync respect ignoreWhitespace option', async () => {
+      await runWithTempDir(async tmpDir => {
+        const pkgData = { name: 'test', version: '1.0.0' }
+        await fs.writeFile(
+          path.join(tmpDir, 'package.json'),
+          JSON.stringify(pkgData, null, 2) + '\n'
+        )
+
+        const EditablePackageJson = getEditablePackageJsonClass()
+        const pkg = await EditablePackageJson.load(tmpDir)
+
+        // ignoreWhitespace checks content equality, not file text equality
+        const saved = pkg.saveSync({ ignoreWhitespace: true })
+        expect(typeof saved).toBe('boolean')
+      }, 'savesync-whitespace-')
+    })
+  })
+
+  describe('pkgJsonToEditable', () => {
+    it('should convert package.json to editable instance', () => {
+      const pkgJson: PackageJson = {
+        name: 'test-package',
+        version: '1.0.0',
+      }
+
+      const editable = pkgJsonToEditable(pkgJson) as EditablePackageJson
+
+      expect(editable).toBeDefined()
+      expect(editable.content.name).toBe('test-package')
+      expect(editable.content.version).toBe('1.0.0')
+    })
+
+    it('should convert without normalization by default', () => {
+      const pkgJson: PackageJson = {
+        name: 'test-package',
+        version: '1.0.0',
+        custom: 'field',
+      }
+
+      const editable = pkgJsonToEditable(pkgJson) as EditablePackageJson
+
+      expect(editable.content.custom).toBe('field')
+    })
+
+    it('should normalize when normalize option is true', () => {
+      const pkgJson: PackageJson = {
+        name: 'test-package',
+      }
+
+      const editable = pkgJsonToEditable(pkgJson, {
+        normalize: true,
+      }) as EditablePackageJson
+
+      expect(editable).toBeDefined()
+      expect(editable.content.name).toBe('test-package')
+      expect(editable.content.version).toBeDefined()
+    })
+
+    it('should pass normalize options through', () => {
+      const pkgJson: PackageJson = {
+        name: 'test-package',
+        custom: 'field',
+      }
+
+      const editable = pkgJsonToEditable(pkgJson, {
+        normalize: true,
+        preserve: ['custom'],
+      }) as EditablePackageJson
+
+      expect(editable).toBeDefined()
+    })
+
+    it('should handle empty package.json', () => {
+      const pkgJson: PackageJson = {}
+
+      const editable = pkgJsonToEditable(pkgJson) as EditablePackageJson
+
+      expect(editable).toBeDefined()
+      expect(editable.content).toBeDefined()
+    })
+  })
+
+  describe('toEditablePackageJson', () => {
+    it('should convert to editable with file path', async () => {
+      await runWithTempDir(async tmpDir => {
+        const pkgJson: PackageJson = {
+          name: 'test-package',
+          version: '1.0.0',
+        }
+
+        const editable = (await toEditablePackageJson(pkgJson, {
+          path: tmpDir,
+        })) as EditablePackageJson
+
+        expect(editable).toBeDefined()
+        expect(editable.content.name).toBe('test-package')
+        expect((editable as any).path).toBeDefined()
+      }, 'toeditable-')
+    })
+
+    it('should convert without path (like pkgJsonToEditable)', async () => {
+      const pkgJson: PackageJson = {
+        name: 'test-package',
+        version: '1.0.0',
+      }
+
+      const editable = (await toEditablePackageJson(
+        pkgJson,
+        {}
+      )) as EditablePackageJson
+
+      expect(editable).toBeDefined()
+      expect(editable.content.name).toBe('test-package')
+    })
+
+    it('should normalize when normalize option is true', async () => {
+      await runWithTempDir(async tmpDir => {
+        const pkgJson: PackageJson = {
+          name: 'test-package',
+        }
+
+        const editable = (await toEditablePackageJson(pkgJson, {
+          path: tmpDir,
+          normalize: true,
+        })) as EditablePackageJson
+
+        expect(editable).toBeDefined()
+        expect(editable.content.version).toBeDefined()
+      }, 'toeditable-normalize-')
+    })
+
+    it('should preserve repository for non-node_modules paths', async () => {
+      await runWithTempDir(async tmpDir => {
+        const pkgJson: PackageJson = {
+          name: 'test-package',
+          version: '1.0.0',
+          repository: 'https://github.com/test/repo',
+        }
+
+        const editable = (await toEditablePackageJson(pkgJson, {
+          path: tmpDir,
+          normalize: true,
+        })) as EditablePackageJson
+
+        expect(editable).toBeDefined()
+      }, 'toeditable-preserve-')
+    })
+
+    it('should handle node_modules paths differently', async () => {
+      await runWithTempDir(async tmpDir => {
+        const nodeModulesPath = path.join(tmpDir, 'node_modules', 'test-pkg')
+        await fs.mkdir(nodeModulesPath, { recursive: true })
+
+        const pkgJson: PackageJson = {
+          name: 'test-package',
+          version: '1.0.0',
+        }
+
+        const editable = (await toEditablePackageJson(pkgJson, {
+          path: nodeModulesPath,
+          normalize: true,
+        })) as EditablePackageJson
+
+        expect(editable).toBeDefined()
+      }, 'toeditable-nodemodules-')
+    })
+
+    it('should pass preserve options through', async () => {
+      await runWithTempDir(async tmpDir => {
+        const pkgJson: PackageJson = {
+          name: 'test-package',
+          version: '1.0.0',
+          custom: 'field',
+        }
+
+        const editable = (await toEditablePackageJson(pkgJson, {
+          path: tmpDir,
+          normalize: true,
+          preserve: ['custom'],
+        })) as EditablePackageJson
+
+        expect(editable).toBeDefined()
+      }, 'toeditable-preserve-opts-')
+    })
+
+    it('should handle package.json path ending with package.json', async () => {
+      await runWithTempDir(async tmpDir => {
+        const pkgJsonPath = path.join(tmpDir, 'package.json')
+        const pkgJson: PackageJson = {
+          name: 'test-package',
+          version: '1.0.0',
+        }
+
+        const editable = (await toEditablePackageJson(pkgJson, {
+          path: pkgJsonPath,
+        })) as EditablePackageJson
+
+        expect(editable).toBeDefined()
+      }, 'toeditable-pkgjson-')
+    })
+  })
+
+  describe('toEditablePackageJsonSync', () => {
+    it('should synchronously convert to editable with file path', async () => {
+      await runWithTempDir(async tmpDir => {
+        const pkgJson: PackageJson = {
+          name: 'test-package',
+          version: '1.0.0',
+        }
+
+        const editable = toEditablePackageJsonSync(pkgJson, {
+          path: tmpDir,
+        }) as EditablePackageJson
+
+        expect(editable).toBeDefined()
+        expect(editable.content.name).toBe('test-package')
+      }, 'toeditablesync-')
+    })
+
+    it('should convert without path', () => {
+      const pkgJson: PackageJson = {
+        name: 'test-package',
+        version: '1.0.0',
+      }
+
+      const editable = toEditablePackageJsonSync(
+        pkgJson,
+        {}
+      ) as EditablePackageJson
+
+      expect(editable).toBeDefined()
+      expect(editable.content.name).toBe('test-package')
+    })
+
+    it('should normalize when normalize option is true', async () => {
+      await runWithTempDir(async tmpDir => {
+        const pkgJson: PackageJson = {
+          name: 'test-package',
+        }
+
+        const editable = toEditablePackageJsonSync(pkgJson, {
+          path: tmpDir,
+          normalize: true,
+        }) as EditablePackageJson
+
+        expect(editable).toBeDefined()
+        expect(editable.content.version).toBeDefined()
+      }, 'toeditablesync-normalize-')
+    })
+
+    it('should handle node_modules paths', async () => {
+      await runWithTempDir(async tmpDir => {
+        const nodeModulesPath = path.join(tmpDir, 'node_modules', 'test-pkg')
+        await fs.mkdir(nodeModulesPath, { recursive: true })
+
+        const pkgJson: PackageJson = {
+          name: 'test-package',
+          version: '1.0.0',
+        }
+
+        const editable = toEditablePackageJsonSync(pkgJson, {
+          path: nodeModulesPath,
+          normalize: true,
+        }) as EditablePackageJson
+
+        expect(editable).toBeDefined()
+      }, 'toeditablesync-nodemodules-')
+    })
+
+    it('should pass preserve options through', async () => {
+      await runWithTempDir(async tmpDir => {
+        const pkgJson: PackageJson = {
+          name: 'test-package',
+          version: '1.0.0',
+          custom: 'field',
+        }
+
+        const editable = toEditablePackageJsonSync(pkgJson, {
+          path: tmpDir,
+          normalize: true,
+          preserve: ['custom'],
+        }) as EditablePackageJson
+
+        expect(editable).toBeDefined()
+      }, 'toeditablesync-preserve-')
+    })
+  })
+
+  describe('edge cases and error handling', () => {
+    it('should handle malformed JSON gracefully', async () => {
+      await runWithTempDir(async tmpDir => {
+        const pkgPath = path.join(tmpDir, 'package.json')
+        await fs.writeFile(pkgPath, '{ invalid json }')
+
+        const EditablePackageJson = getEditablePackageJsonClass()
+
+        await expect(EditablePackageJson.load(tmpDir)).rejects.toThrow()
+      }, 'edge-malformed-')
+    })
+
+    it('should handle empty package.json file', async () => {
+      await runWithTempDir(async tmpDir => {
+        const pkgPath = path.join(tmpDir, 'package.json')
+        await fs.writeFile(pkgPath, '')
+
+        const EditablePackageJson = getEditablePackageJsonClass()
+
+        await expect(EditablePackageJson.load(tmpDir)).rejects.toThrow()
+      }, 'edge-empty-')
+    })
+
+    it('should handle package.json with only whitespace', async () => {
+      await runWithTempDir(async tmpDir => {
+        const pkgPath = path.join(tmpDir, 'package.json')
+        await fs.writeFile(pkgPath, '   \n  \n  ')
+
+        const EditablePackageJson = getEditablePackageJsonClass()
+
+        await expect(EditablePackageJson.load(tmpDir)).rejects.toThrow()
+      }, 'edge-whitespace-')
+    })
+
+    it('should handle numeric indentation', async () => {
+      await runWithTempDir(async tmpDir => {
+        const EditablePackageJson = getEditablePackageJsonClass()
+        const pkg = await EditablePackageJson.create(tmpDir, {
+          data: { name: 'test', version: '1.0.0' },
+        })
+
+        // Manually set numeric indent
+        ;(pkg.content as any)[Symbol.for('indent')] = 4
+
+        await pkg.save()
+
+        const content = await fs.readFile((pkg as any).filename, 'utf8')
+        expect(content).toBeDefined()
+      }, 'edge-numeric-indent-')
+    })
+
+    it('should handle null indent (use default)', async () => {
+      await runWithTempDir(async tmpDir => {
+        const EditablePackageJson = getEditablePackageJsonClass()
+        const pkg = await EditablePackageJson.create(tmpDir, {
+          data: { name: 'test', version: '1.0.0' },
+        })
+
+        ;(pkg.content as any)[Symbol.for('indent')] = null
+
+        await pkg.save()
+
+        const content = await fs.readFile((pkg as any).filename, 'utf8')
+        expect(content).toContain('  ')
+      }, 'edge-null-indent-')
+    })
+
+    it('should handle null newline (use default)', async () => {
+      await runWithTempDir(async tmpDir => {
+        const EditablePackageJson = getEditablePackageJsonClass()
+        const pkg = await EditablePackageJson.create(tmpDir, {
+          data: { name: 'test', version: '1.0.0' },
+        })
+
+        ;(pkg.content as any)[Symbol.for('newline')] = null
+
+        await pkg.save()
+
+        const content = await fs.readFile((pkg as any).filename, 'utf8')
+        expect(content).toContain('\n')
+      }, 'edge-null-newline-')
+    })
+
+    it('should handle deep updates', async () => {
+      await runWithTempDir(async tmpDir => {
+        const pkgData = {
+          name: 'test',
+          version: '1.0.0',
+          dependencies: {
+            dep1: '1.0.0',
+          },
+        }
+        await fs.writeFile(
+          path.join(tmpDir, 'package.json'),
+          JSON.stringify(pkgData, null, 2)
+        )
+
+        const EditablePackageJson = getEditablePackageJsonClass()
+        const pkg = await EditablePackageJson.load(tmpDir)
+        pkg.update({
+          dependencies: {
+            dep1: '1.0.0',
+            dep2: '2.0.0',
+          },
+        })
+
+        await pkg.save()
+
+        expect(pkg.content.dependencies?.dep2).toBe('2.0.0')
+      }, 'edge-deep-update-')
+    })
+
+    it('should handle symbols in content properly', async () => {
+      await runWithTempDir(async tmpDir => {
+        const pkgData = { name: 'test', version: '1.0.0' }
+        await fs.writeFile(
+          path.join(tmpDir, 'package.json'),
+          JSON.stringify(pkgData, null, 2)
+        )
+
+        const EditablePackageJson = getEditablePackageJsonClass()
+        const pkg = await EditablePackageJson.load(tmpDir)
+
+        // Symbols should not be in saved JSON
+        const content = pkg.content as Record<string | symbol, unknown>
+        expect(content[Symbol.for('indent')]).toBeDefined()
+
+        await pkg.save()
+
+        const fileContent = await fs.readFile((pkg as any).filename, 'utf8')
+        expect(fileContent).not.toContain('Symbol')
+      }, 'edge-symbols-')
+    })
+  })
+})
diff --git a/test/unit/packages/licenses.test.ts b/test/unit/packages/licenses.test.ts
new file mode 100644
index 0000000..357fd19
--- /dev/null
+++ b/test/unit/packages/licenses.test.ts
@@ -0,0 +1,304 @@
+/**
+ * @fileoverview Unit tests for SPDX license parsing and analysis.
+ *
+ * Tests SPDX (Software Package Data Exchange) license expression parsing and validation:
+ * - collectIncompatibleLicenses() for detecting copyleft licenses (GPL, LGPL, AGPL, MPL, etc.)
+ * - collectLicenseWarnings() for identifying risky or unknown licenses
+ * - parseSpdxExp() for parsing complex license expressions with AND/OR operators
+ * - AST node creation (createAstNode, createBinaryOperationNode, createLicenseNode)
+ * - Handles nested expressions, OR fallbacks, GPL compatibility, and unknown licenses
+ */
+
+import {
+  collectIncompatibleLicenses,
+  collectLicenseWarnings,
+  createAstNode,
+  createBinaryOperationNode,
+  createLicenseNode,
+  parseSpdxExp,
+  type SpdxLicenseNode,
+  type SpdxBinaryOperationNode,
+  type InternalLicenseNode,
+} from '@socketsecurity/lib/packages/licenses'
+import type { LicenseNode } from '@socketsecurity/lib/packages'
+import { describe, expect, it } from 'vitest'
+
+describe('packages/licenses', () => {
+  describe('collectIncompatibleLicenses', () => {
+    it('should return empty array for no copyleft licenses', () => {
+      const nodes: LicenseNode[] = [
+        { license: 'MIT', inFile: undefined },
+        { license: 'Apache-2.0', inFile: undefined },
+      ]
+      const result = collectIncompatibleLicenses(nodes)
+      expect(result).toEqual([])
+    })
+
+    it('should collect GPL licenses', () => {
+      const nodes: LicenseNode[] = [
+        { license: 'GPL-3.0', inFile: undefined },
+        { license: 'MIT', inFile: undefined },
+      ]
+      const result = collectIncompatibleLicenses(nodes)
+      expect(result.length).toBeGreaterThan(0)
+      expect(result[0]?.license).toBe('GPL-3.0')
+    })
+
+    it('should handle empty array', () => {
+      const result = collectIncompatibleLicenses([])
+      expect(result).toEqual([])
+    })
+
+    it('should handle multiple copyleft licenses', () => {
+      const nodes: LicenseNode[] = [
+        { license: 'GPL-2.0', inFile: undefined },
+        { license: 'GPL-3.0', inFile: undefined },
+        { license: 'MIT', inFile: undefined },
+      ]
+      const result = collectIncompatibleLicenses(nodes)
+      expect(result.length).toBeGreaterThanOrEqual(2)
+    })
+  })
+
+  describe('collectLicenseWarnings', () => {
+    it('should warn about UNLICENSED packages', () => {
+      const nodes: LicenseNode[] = [{ license: 'UNLICENSED', inFile: undefined }]
+      const warnings = collectLicenseWarnings(nodes)
+      expect(warnings).toContain('Package is unlicensed')
+    })
+
+    it('should warn about licenses in files', () => {
+      const nodes: LicenseNode[] = [
+        { license: 'MIT', inFile: 'LICENSE.txt' },
+      ]
+      const warnings = collectLicenseWarnings(nodes)
+      expect(warnings.length).toBeGreaterThan(0)
+      expect(warnings[0]).toContain('LICENSE.txt')
+    })
+
+    it('should return empty array for valid licenses', () => {
+      const nodes: LicenseNode[] = [
+        { license: 'MIT', inFile: undefined },
+        { license: 'Apache-2.0', inFile: undefined },
+      ]
+      const warnings = collectLicenseWarnings(nodes)
+      expect(warnings).toEqual([])
+    })
+
+    it('should handle empty array', () => {
+      const warnings = collectLicenseWarnings([])
+      expect(warnings).toEqual([])
+    })
+
+    it('should not duplicate warnings', () => {
+      const nodes: LicenseNode[] = [
+        { license: 'UNLICENSED', inFile: undefined },
+        { license: 'UNLICENSED', inFile: undefined },
+      ]
+      const warnings = collectLicenseWarnings(nodes)
+      expect(warnings.length).toBe(1)
+    })
+  })
+
+  describe('createLicenseNode', () => {
+    it('should create license node from raw node', () => {
+      const rawNode: SpdxLicenseNode = { license: 'MIT' }
+      const node = createLicenseNode(rawNode)
+      expect(node.type).toBe('License')
+      expect(node.license).toBe('MIT')
+    })
+
+    it('should preserve plus flag', () => {
+      const rawNode: SpdxLicenseNode = { license: 'Apache-2.0', plus: true }
+      const node = createLicenseNode(rawNode)
+      expect(node.plus).toBe(true)
+    })
+
+    it('should preserve exception', () => {
+      const rawNode: SpdxLicenseNode = {
+        license: 'GPL-2.0',
+        exception: 'Classpath-exception-2.0',
+      }
+      const node = createLicenseNode(rawNode)
+      expect(node.exception).toBe('Classpath-exception-2.0')
+    })
+  })
+
+  describe('createBinaryOperationNode', () => {
+    it('should create AND binary operation node', () => {
+      const rawNode: SpdxBinaryOperationNode = {
+        left: { license: 'MIT' },
+        conjunction: 'and',
+        right: { license: 'Apache-2.0' },
+      }
+      const node = createBinaryOperationNode(rawNode)
+      expect(node.type).toBe('BinaryOperation')
+      expect(node.conjunction).toBe('and')
+    })
+
+    it('should create OR binary operation node', () => {
+      const rawNode: SpdxBinaryOperationNode = {
+        left: { license: 'MIT' },
+        conjunction: 'or',
+        right: { license: 'Apache-2.0' },
+      }
+      const node = createBinaryOperationNode(rawNode)
+      expect(node.conjunction).toBe('or')
+    })
+
+    it('should lazily create left node', () => {
+      const rawNode: SpdxBinaryOperationNode = {
+        left: { license: 'MIT' },
+        conjunction: 'and',
+        right: { license: 'Apache-2.0' },
+      }
+      const node = createBinaryOperationNode(rawNode)
+      const left = node.left
+      expect(left).toBeDefined()
+      expect((left as InternalLicenseNode).license).toBe('MIT')
+    })
+
+    it('should lazily create right node', () => {
+      const rawNode: SpdxBinaryOperationNode = {
+        left: { license: 'MIT' },
+        conjunction: 'and',
+        right: { license: 'Apache-2.0' },
+      }
+      const node = createBinaryOperationNode(rawNode)
+      const right = node.right
+      expect(right).toBeDefined()
+      expect((right as InternalLicenseNode).license).toBe('Apache-2.0')
+    })
+  })
+
+  describe('createAstNode', () => {
+    it('should create license node for license raw node', () => {
+      const rawNode: SpdxLicenseNode = { license: 'MIT' }
+      const node = createAstNode(rawNode)
+      expect(node.type).toBe('License')
+    })
+
+    it('should create binary operation node for conjunction raw node', () => {
+      const rawNode: SpdxBinaryOperationNode = {
+        left: { license: 'MIT' },
+        conjunction: 'and',
+        right: { license: 'Apache-2.0' },
+      }
+      const node = createAstNode(rawNode)
+      expect(node.type).toBe('BinaryOperation')
+    })
+  })
+
+  describe('parseSpdxExp', () => {
+    it('should parse simple license expression', () => {
+      const result = parseSpdxExp('MIT')
+      expect(result).toBeDefined()
+      expect((result as SpdxLicenseNode).license).toBe('MIT')
+    })
+
+    it('should parse AND expression', () => {
+      const result = parseSpdxExp('MIT AND Apache-2.0')
+      expect(result).toBeDefined()
+      expect((result as SpdxBinaryOperationNode).conjunction).toBe('and')
+    })
+
+    it('should parse OR expression', () => {
+      const result = parseSpdxExp('MIT OR Apache-2.0')
+      expect(result).toBeDefined()
+      expect((result as SpdxBinaryOperationNode).conjunction).toBe('or')
+    })
+
+    it('should parse license with exception', () => {
+      const result = parseSpdxExp('GPL-2.0-only WITH Classpath-exception-2.0')
+      expect(result).toBeDefined()
+    })
+
+    it('should parse license with plus', () => {
+      const result = parseSpdxExp('Apache-2.0+')
+      expect(result).toBeDefined()
+    })
+
+    it('should handle invalid expressions', () => {
+      const result = parseSpdxExp('INVALID_LICENSE_123')
+      // parseSpdxExp returns undefined for truly invalid expressions
+      // but may auto-correct some
+      expect(result === undefined || result !== null).toBe(true)
+    })
+
+    it('should parse complex nested expression', () => {
+      const result = parseSpdxExp('(MIT OR Apache-2.0) AND BSD-3-Clause')
+      expect(result).toBeDefined()
+    })
+
+    it('should handle empty string', () => {
+      // Empty string throws an error in spdx-expression-parse
+      expect(() => parseSpdxExp('')).toThrow()
+    })
+
+    it('should parse ISC license', () => {
+      const result = parseSpdxExp('ISC')
+      expect(result).toBeDefined()
+      expect((result as SpdxLicenseNode).license).toBe('ISC')
+    })
+
+    it('should parse BSD licenses', () => {
+      const result = parseSpdxExp('BSD-2-Clause')
+      expect(result).toBeDefined()
+      expect((result as SpdxLicenseNode).license).toBe('BSD-2-Clause')
+    })
+
+    it('should parse GPL licenses', () => {
+      const result = parseSpdxExp('GPL-3.0-only')
+      expect(result).toBeDefined()
+    })
+
+    it('should parse LGPL licenses', () => {
+      const result = parseSpdxExp('LGPL-2.1-only')
+      expect(result).toBeDefined()
+    })
+
+    it('should parse AGPL licenses', () => {
+      const result = parseSpdxExp('AGPL-3.0-only')
+      expect(result).toBeDefined()
+    })
+
+    it('should parse MPL licenses', () => {
+      const result = parseSpdxExp('MPL-2.0')
+      expect(result).toBeDefined()
+      expect((result as SpdxLicenseNode).license).toBe('MPL-2.0')
+    })
+
+    it('should handle case variations', () => {
+      const result = parseSpdxExp('mit')
+      // spdx-correct should normalize this
+      expect(result).toBeDefined()
+    })
+
+    it('should parse unlicense', () => {
+      const result = parseSpdxExp('Unlicense')
+      expect(result).toBeDefined()
+    })
+  })
+
+  describe('edge cases', () => {
+    it('should handle null in license nodes array', () => {
+      const nodes = [
+        { license: 'MIT', inFile: undefined },
+        null as any,
+        { license: 'Apache-2.0', inFile: undefined },
+      ]
+      const result = collectIncompatibleLicenses(nodes)
+      expect(result).toEqual([])
+    })
+
+    it('should handle undefined in license nodes array', () => {
+      const nodes = [
+        { license: 'MIT', inFile: undefined },
+        undefined as any,
+        { license: 'Apache-2.0', inFile: undefined },
+      ]
+      const result = collectIncompatibleLicenses(nodes)
+      expect(result).toEqual([])
+    })
+  })
+})
diff --git a/test/unit/packages/operations.test.ts b/test/unit/packages/operations.test.ts
new file mode 100644
index 0000000..fab3675
--- /dev/null
+++ b/test/unit/packages/operations.test.ts
@@ -0,0 +1,816 @@
+/**
+ * @fileoverview Unit tests for package manipulation operations.
+ *
+ * Tests package operation utilities:
+ * - Extraction: extractPackage() unpacks tarballs to directories
+ * - Packing: packPackage() creates tarballs from directories
+ * - Reading: readPackageJson(), readPackageJsonSync() parse package.json files
+ * - Resolution: resolveGitHubTgzUrl() resolves GitHub tarball URLs
+ * - Tag parsing: getReleaseTag() extracts version tags from package specs
+ * Used by Socket tools for package management and dependency operations.
+ */
+
+import { promises as fs } from 'node:fs'
+import path from 'node:path'
+
+import {
+  extractPackage,
+  findPackageExtensions,
+  getReleaseTag,
+  packPackage,
+  readPackageJson,
+  readPackageJsonSync,
+  resolveGitHubTgzUrl,
+  resolvePackageName,
+} from '@socketsecurity/lib/packages/operations'
+import type { PackageJson } from '@socketsecurity/lib/packages'
+import { describe, expect, it } from 'vitest'
+import { runWithTempDir } from '../utils/temp-file-helper.mjs'
+
+describe('packages/operations', () => {
+  describe('getReleaseTag', () => {
+    it('should return empty string for empty spec', () => {
+      expect(getReleaseTag('')).toBe('')
+    })
+
+    it('should extract tag from unscoped package', () => {
+      expect(getReleaseTag('package@1.0.0')).toBe('1.0.0')
+    })
+
+    it('should extract tag from scoped package', () => {
+      expect(getReleaseTag('@scope/package@1.0.0')).toBe('1.0.0')
+    })
+
+    it('should return empty string for package without tag', () => {
+      expect(getReleaseTag('package')).toBe('')
+    })
+
+    it('should return empty string for scoped package without tag', () => {
+      expect(getReleaseTag('@scope/package')).toBe('')
+    })
+
+    it('should handle multiple @ signs in scoped packages', () => {
+      expect(getReleaseTag('@scope/package@latest')).toBe('latest')
+      expect(getReleaseTag('@scope/package@^1.2.3')).toBe('^1.2.3')
+    })
+
+    it('should handle semver ranges', () => {
+      expect(getReleaseTag('package@^1.2.3')).toBe('^1.2.3')
+      expect(getReleaseTag('package@~1.2.3')).toBe('~1.2.3')
+      expect(getReleaseTag('package@>=1.0.0')).toBe('>=1.0.0')
+    })
+
+    it('should handle dist-tags', () => {
+      expect(getReleaseTag('package@latest')).toBe('latest')
+      expect(getReleaseTag('package@next')).toBe('next')
+      expect(getReleaseTag('@scope/package@beta')).toBe('beta')
+    })
+  })
+
+  describe('findPackageExtensions', () => {
+    it('should return undefined for package with no extensions', () => {
+      const result = findPackageExtensions('non-existent-package', '1.0.0')
+      expect(result).toBeUndefined()
+    })
+
+    it('should return extensions for matching package and version', () => {
+      // This test depends on the actual package extensions configured
+      // We'll test the basic functionality
+      const result = findPackageExtensions('test-package', '1.0.0')
+      // Result should be undefined or an object depending on configuration
+      expect(result === undefined || typeof result === 'object').toBe(true)
+    })
+
+    it('should handle semver range matching', () => {
+      // Test that the function uses semver.satisfies internally
+      const result = findPackageExtensions('some-package', '1.2.3')
+      expect(result === undefined || typeof result === 'object').toBe(true)
+    })
+
+    it('should merge multiple matching extensions', () => {
+      // If multiple extensions match, they should be merged
+      const result = findPackageExtensions('test-package', '1.0.0')
+      expect(result === undefined || typeof result === 'object').toBe(true)
+    })
+
+    it('should handle scoped packages', () => {
+      const result = findPackageExtensions('@scope/package', '1.0.0')
+      expect(result === undefined || typeof result === 'object').toBe(true)
+    })
+  })
+
+  describe('resolvePackageName', () => {
+    it('should return name for unscoped package', () => {
+      const purlObj = { name: 'package' }
+      expect(resolvePackageName(purlObj)).toBe('package')
+    })
+
+    it('should return scoped name with default delimiter', () => {
+      const purlObj = { name: 'package', namespace: '@scope' }
+      expect(resolvePackageName(purlObj)).toBe('@scope/package')
+    })
+
+    it('should use custom delimiter', () => {
+      const purlObj = { name: 'package', namespace: '@scope' }
+      expect(resolvePackageName(purlObj, '--')).toBe('@scope--package')
+    })
+
+    it('should handle empty namespace', () => {
+      const purlObj = { name: 'package', namespace: '' }
+      expect(resolvePackageName(purlObj)).toBe('package')
+    })
+
+    it('should handle undefined namespace', () => {
+      const purlObj = { name: 'package', namespace: undefined }
+      expect(resolvePackageName(purlObj)).toBe('package')
+    })
+
+    it('should use default / delimiter when not specified', () => {
+      const purlObj = { name: 'mypackage', namespace: '@myorg' }
+      expect(resolvePackageName(purlObj)).toBe('@myorg/mypackage')
+    })
+  })
+
+  describe('readPackageJson', () => {
+    it('should read and parse package.json from directory', async () => {
+      await runWithTempDir(async tmpDir => {
+        const pkgData = {
+          name: 'test-package',
+          version: '1.0.0',
+          description: 'Test package',
+        }
+        await fs.writeFile(
+          path.join(tmpDir, 'package.json'),
+          JSON.stringify(pkgData, null, 2)
+        )
+
+        const result = await readPackageJson(tmpDir)
+        expect(result).toBeDefined()
+        expect(result?.name).toBe('test-package')
+        expect(result?.version).toBe('1.0.0')
+      }, 'read-pkg-json-')
+    })
+
+    it('should read package.json from file path', async () => {
+      await runWithTempDir(async tmpDir => {
+        const pkgPath = path.join(tmpDir, 'package.json')
+        const pkgData = { name: 'test', version: '2.0.0' }
+        await fs.writeFile(pkgPath, JSON.stringify(pkgData))
+
+        const result = await readPackageJson(pkgPath)
+        expect(result?.name).toBe('test')
+      }, 'read-pkg-json-file-')
+    })
+
+    it('should return undefined for non-existent file', async () => {
+      await runWithTempDir(async tmpDir => {
+        const result = await readPackageJson(tmpDir, { throws: false })
+        expect(result).toBeUndefined()
+      }, 'read-pkg-json-missing-')
+    })
+
+    it('should normalize when normalize option is true', async () => {
+      await runWithTempDir(async tmpDir => {
+        const pkgData = { name: 'test' }
+        await fs.writeFile(
+          path.join(tmpDir, 'package.json'),
+          JSON.stringify(pkgData)
+        )
+
+        const result = await readPackageJson(tmpDir, { normalize: true })
+        expect(result).toBeDefined()
+        expect(result?.name).toBe('test')
+        // Normalization should add version field
+        expect(result?.version).toBeDefined()
+      }, 'read-pkg-json-normalize-')
+    })
+
+    it('should return editable package.json when editable option is true', async () => {
+      await runWithTempDir(async tmpDir => {
+        const pkgData = { name: 'test', version: '1.0.0' }
+        await fs.writeFile(
+          path.join(tmpDir, 'package.json'),
+          JSON.stringify(pkgData)
+        )
+
+        const result = await readPackageJson(tmpDir, { editable: true })
+        expect(result).toBeDefined()
+        expect(typeof result?.save).toBe('function')
+      }, 'read-pkg-json-editable-')
+    })
+
+    it('should handle editable with normalize options', async () => {
+      await runWithTempDir(async tmpDir => {
+        const pkgData = { name: 'test', version: '1.0.0', custom: 'field' }
+        await fs.writeFile(
+          path.join(tmpDir, 'package.json'),
+          JSON.stringify(pkgData)
+        )
+
+        // When using editable with normalize, the options are passed to the editable converter
+        await expect(
+          readPackageJson(tmpDir, {
+            editable: true,
+            normalize: true,
+            preserve: ['custom'],
+          })
+        ).resolves.toBeDefined()
+      }, 'read-pkg-json-editable-normalize-')
+    })
+
+    it('should throw when throws option is true and file missing', async () => {
+      await runWithTempDir(async tmpDir => {
+        await expect(
+          readPackageJson(tmpDir, { throws: true })
+        ).rejects.toThrow()
+      }, 'read-pkg-json-throws-')
+    })
+
+    it('should pass normalize options through', async () => {
+      await runWithTempDir(async tmpDir => {
+        const pkgData = { name: 'test', custom: 'field' }
+        await fs.writeFile(
+          path.join(tmpDir, 'package.json'),
+          JSON.stringify(pkgData)
+        )
+
+        const result = await readPackageJson(tmpDir, {
+          normalize: true,
+          preserve: ['custom'],
+        })
+        expect(result).toBeDefined()
+      }, 'read-pkg-json-preserve-')
+    })
+
+    it('should handle malformed JSON gracefully', async () => {
+      await runWithTempDir(async tmpDir => {
+        await fs.writeFile(
+          path.join(tmpDir, 'package.json'),
+          '{ invalid json'
+        )
+
+        const result = await readPackageJson(tmpDir, { throws: false })
+        expect(result).toBeUndefined()
+      }, 'read-pkg-json-malformed-')
+    })
+
+    it('should not normalize by default', async () => {
+      await runWithTempDir(async tmpDir => {
+        const pkgData = { name: 'test', custom: 'field' }
+        await fs.writeFile(
+          path.join(tmpDir, 'package.json'),
+          JSON.stringify(pkgData)
+        )
+
+        const result = await readPackageJson(tmpDir)
+        expect(result?.custom).toBe('field')
+      }, 'read-pkg-json-no-normalize-')
+    })
+  })
+
+  describe('readPackageJsonSync', () => {
+    it('should synchronously read and parse package.json', async () => {
+      await runWithTempDir(async tmpDir => {
+        const pkgData = { name: 'test-sync', version: '1.0.0' }
+        await fs.writeFile(
+          path.join(tmpDir, 'package.json'),
+          JSON.stringify(pkgData)
+        )
+
+        const result = readPackageJsonSync(tmpDir)
+        expect(result).toBeDefined()
+        expect(result?.name).toBe('test-sync')
+      }, 'read-pkg-json-sync-')
+    })
+
+    it('should return undefined for non-existent file', async () => {
+      await runWithTempDir(async tmpDir => {
+        const result = readPackageJsonSync(tmpDir, { throws: false })
+        expect(result).toBeUndefined()
+      }, 'read-pkg-json-sync-missing-')
+    })
+
+    it('should normalize when normalize option is true', async () => {
+      await runWithTempDir(async tmpDir => {
+        const pkgData = { name: 'test' }
+        await fs.writeFile(
+          path.join(tmpDir, 'package.json'),
+          JSON.stringify(pkgData)
+        )
+
+        const result = readPackageJsonSync(tmpDir, { editable: false, normalize: true } as any)
+        expect(result?.version).toBeDefined()
+      }, 'read-pkg-json-sync-normalize-')
+    })
+
+    it('should return editable when editable option is true', async () => {
+      await runWithTempDir(async tmpDir => {
+        const pkgData = { name: 'test', version: '1.0.0' }
+        await fs.writeFile(
+          path.join(tmpDir, 'package.json'),
+          JSON.stringify(pkgData)
+        )
+
+        const result = readPackageJsonSync(tmpDir, { editable: true })
+        expect(result).toBeDefined()
+        expect(typeof result?.save).toBe('function')
+      }, 'read-pkg-json-sync-editable-')
+    })
+
+    it('should throw when throws option is true and file missing', async () => {
+      await runWithTempDir(async tmpDir => {
+        expect(() =>
+          readPackageJsonSync(tmpDir, { throws: true })
+        ).toThrow()
+      }, 'read-pkg-json-sync-throws-')
+    })
+
+    it('should handle editable with normalize options', async () => {
+      await runWithTempDir(async tmpDir => {
+        const pkgData = { name: 'test', version: '1.0.0', custom: 'field' }
+        await fs.writeFile(
+          path.join(tmpDir, 'package.json'),
+          JSON.stringify(pkgData)
+        )
+
+        // When using editable with normalize, the options are passed to the editable converter
+        expect(() =>
+          readPackageJsonSync(tmpDir, {
+            editable: true,
+            normalize: true,
+            preserve: ['custom'],
+          } as any)
+        ).not.toThrow()
+      }, 'read-pkg-json-sync-editable-norm-')
+    })
+
+    it('should pass normalize options through', async () => {
+      await runWithTempDir(async tmpDir => {
+        const pkgData = { name: 'test', custom: 'field' }
+        await fs.writeFile(
+          path.join(tmpDir, 'package.json'),
+          JSON.stringify(pkgData)
+        )
+
+        const result = readPackageJsonSync(tmpDir, {
+          normalize: true,
+          preserve: ['custom'],
+        } as any)
+        expect(result).toBeDefined()
+      }, 'read-pkg-json-sync-preserve-')
+    })
+  })
+
+  describe('extractPackage', () => {
+    it('should extract package to destination directory', async () => {
+      await runWithTempDir(async tmpDir => {
+        const dest = path.join(tmpDir, 'extracted')
+        await fs.mkdir(dest, { recursive: true })
+
+        // Extract a small package for testing
+        await extractPackage('is-number@7.0.0', { dest })
+
+        // Verify extraction
+        const pkgJsonPath = path.join(dest, 'package.json')
+        const exists = await fs
+          .access(pkgJsonPath)
+          .then(() => true)
+          .catch(() => false)
+        expect(exists).toBe(true)
+      }, 'extract-pkg-')
+    }, 30_000)
+
+    it('should call callback with destination path', async () => {
+      await runWithTempDir(async tmpDir => {
+        const dest = path.join(tmpDir, 'extracted')
+        await fs.mkdir(dest, { recursive: true })
+
+        let callbackPath = ''
+        await extractPackage('is-number@7.0.0', { dest }, async (destPath) => {
+          callbackPath = destPath
+        })
+
+        expect(callbackPath).toBe(dest)
+      }, 'extract-pkg-callback-')
+    }, 30_000)
+
+    it('should use temporary directory when dest not provided', async () => {
+      let tmpPath = ''
+      await extractPackage('is-number@7.0.0', (async (destPath) => {
+        tmpPath = destPath
+        // Verify package.json exists in temp directory
+        const pkgJsonPath = path.join(destPath, 'package.json')
+        const exists = await fs
+          .access(pkgJsonPath)
+          .then(() => true)
+          .catch(() => false)
+        expect(exists).toBe(true)
+      }) as any)
+
+      expect(tmpPath).toBeTruthy()
+    }, 30_000)
+
+    it('should handle function as second argument', async () => {
+      let called = false
+      await extractPackage('is-number@7.0.0', (async (destPath) => {
+        called = true
+        expect(destPath).toBeTruthy()
+      }) as any)
+
+      expect(called).toBe(true)
+    }, 30_000)
+
+    it('should pass extract options to pacote', async () => {
+      await runWithTempDir(async tmpDir => {
+        const dest = path.join(tmpDir, 'extracted')
+        await fs.mkdir(dest, { recursive: true })
+
+        await extractPackage('is-number@7.0.0', {
+          dest,
+          preferOffline: true,
+        })
+
+        const pkgJsonPath = path.join(dest, 'package.json')
+        const exists = await fs
+          .access(pkgJsonPath)
+          .then(() => true)
+          .catch(() => false)
+        expect(exists).toBe(true)
+      }, 'extract-pkg-options-')
+    }, 30_000)
+
+    it('should use tmpPrefix option for temp directory', async () => {
+      let tmpPath = ''
+      await extractPackage(
+        'is-number@7.0.0',
+        { tmpPrefix: 'test-prefix-' } as any,
+        async (destPath) => {
+          tmpPath = destPath
+        }
+      )
+
+      expect(tmpPath).toBeTruthy()
+    }, 30_000)
+  })
+
+  describe('packPackage', () => {
+    it('should pack a package tarball', async () => {
+      await runWithTempDir(async tmpDir => {
+        // Create a simple package to pack
+        const pkgData = {
+          name: 'test-package',
+          version: '1.0.0',
+          main: 'index.js',
+        }
+        await fs.writeFile(
+          path.join(tmpDir, 'package.json'),
+          JSON.stringify(pkgData, null, 2)
+        )
+        await fs.writeFile(
+          path.join(tmpDir, 'index.js'),
+          'module.exports = {}'
+        )
+
+        const tarball = await packPackage(tmpDir)
+        expect(tarball).toBeDefined()
+        expect(Buffer.isBuffer(tarball)).toBe(true)
+      }, 'pack-pkg-')
+    }, 30_000)
+
+    it('should pack package with options', async () => {
+      await runWithTempDir(async tmpDir => {
+        const pkgData = { name: 'test', version: '1.0.0' }
+        await fs.writeFile(
+          path.join(tmpDir, 'package.json'),
+          JSON.stringify(pkgData)
+        )
+        await fs.writeFile(path.join(tmpDir, 'index.js'), '')
+
+        const tarball = await packPackage(tmpDir, { preferOffline: true })
+        expect(tarball).toBeDefined()
+      }, 'pack-pkg-options-')
+    }, 30_000)
+
+    it('should pack remote package spec', async () => {
+      const tarball = await packPackage('is-number@7.0.0')
+      expect(tarball).toBeDefined()
+      expect(Buffer.isBuffer(tarball)).toBe(true)
+    }, 30_000)
+  })
+
+  describe('resolveGitHubTgzUrl', () => {
+    it('should return empty string when package.json not found', async () => {
+      const pkgJson: PackageJson = {
+        name: 'test-package',
+        version: '1.0.0',
+      }
+      const result = await resolveGitHubTgzUrl('test-package', pkgJson)
+      expect(result).toBe('')
+    })
+
+    it('should return saveSpec for tarball URL spec', async () => {
+      await runWithTempDir(async tmpDir => {
+        const pkgData = {
+          name: 'test',
+          version: '1.0.0',
+          repository: { url: 'git+https://github.com/user/repo.git' },
+        }
+        await fs.writeFile(
+          path.join(tmpDir, 'package.json'),
+          JSON.stringify(pkgData)
+        )
+
+        const tgzUrl = 'https://github.com/user/repo/archive/abc123.tar.gz'
+        const result = await resolveGitHubTgzUrl(tgzUrl, tmpDir)
+        // Should return the URL itself if it's already a tarball URL
+        expect(typeof result).toBe('string')
+      }, 'resolve-github-tgz-spec-')
+    }, 30_000)
+
+    it('should accept package.json object as where parameter', async () => {
+      const pkgJson: PackageJson = {
+        name: 'test',
+        version: '1.0.0',
+        repository: { url: 'git+https://github.com/user/repo.git' },
+      }
+
+      const result = await resolveGitHubTgzUrl('test-package', pkgJson)
+      // Should return empty string or valid URL
+      expect(typeof result).toBe('string')
+    }, 30_000)
+
+    it('should return empty string when no repository URL', async () => {
+      const pkgJson: PackageJson = {
+        name: 'test',
+        version: '1.0.0',
+      }
+
+      const result = await resolveGitHubTgzUrl('test', pkgJson)
+      expect(result).toBe('')
+    })
+
+    it('should handle GitHub URL spec with committish', async () => {
+      const pkgJson: PackageJson = {
+        name: 'test',
+        version: '1.0.0',
+        repository: { url: 'git+https://github.com/user/repo.git' },
+      }
+
+      const result = await resolveGitHubTgzUrl('github:user/repo#main', pkgJson)
+      expect(typeof result).toBe('string')
+    }, 30_000)
+
+    it('should try version with v prefix first', async () => {
+      const pkgJson: PackageJson = {
+        name: 'test',
+        version: '1.0.0',
+        repository: { url: 'git+https://github.com/user/repo.git' },
+      }
+
+      const result = await resolveGitHubTgzUrl('test', pkgJson)
+      // Will return empty string if tag doesn't exist, which is expected
+      expect(typeof result).toBe('string')
+    }, 30_000)
+
+    it('should fallback to version without v prefix', async () => {
+      const pkgJson: PackageJson = {
+        name: 'test',
+        version: '1.0.0',
+        repository: { url: 'git+https://github.com/user/repo.git' },
+      }
+
+      const result = await resolveGitHubTgzUrl('test', pkgJson)
+      expect(typeof result).toBe('string')
+    }, 30_000)
+
+    it('should handle repository as string', async () => {
+      const pkgJson: PackageJson = {
+        name: 'test',
+        version: '1.0.0',
+        repository: 'github:user/repo' as any,
+      }
+
+      const result = await resolveGitHubTgzUrl('test', pkgJson)
+      expect(typeof result).toBe('string')
+    }, 30_000)
+  })
+
+  describe('edge cases and error handling', () => {
+    it('should handle extractPackage with invalid spec', async () => {
+      await expect(
+        extractPackage('non-existent-package-xyz-123', { dest: '/tmp/test' })
+      ).rejects.toThrow()
+    }, 30_000)
+
+    it('should handle packPackage with invalid path', async () => {
+      await expect(
+        packPackage('/non/existent/path')
+      ).rejects.toThrow()
+    }, 30_000)
+
+    it('should handle readPackageJson with invalid JSON', async () => {
+      await runWithTempDir(async tmpDir => {
+        await fs.writeFile(
+          path.join(tmpDir, 'package.json'),
+          'not valid json {{'
+        )
+
+        const result = await readPackageJson(tmpDir, { throws: false })
+        expect(result).toBeUndefined()
+      }, 'edge-invalid-json-')
+    })
+
+    it('should handle readPackageJsonSync with invalid JSON', async () => {
+      await runWithTempDir(async tmpDir => {
+        await fs.writeFile(
+          path.join(tmpDir, 'package.json'),
+          'not valid json {{'
+        )
+
+        const result = readPackageJsonSync(tmpDir, { throws: false })
+        expect(result).toBeUndefined()
+      }, 'edge-invalid-json-sync-')
+    })
+
+    it('should handle getReleaseTag with special characters', () => {
+      expect(getReleaseTag('package@1.0.0-beta.1')).toBe('1.0.0-beta.1')
+      expect(getReleaseTag('package@1.0.0+build.123')).toBe('1.0.0+build.123')
+    })
+
+    it('should handle resolvePackageName with null values', () => {
+      const purlObj = { name: 'package', namespace: null as any }
+      const result = resolvePackageName(purlObj)
+      expect(result).toBe('package')
+    })
+
+    it('should handle findPackageExtensions with invalid version', () => {
+      const result = findPackageExtensions('package', 'not-a-version')
+      expect(result === undefined || typeof result === 'object').toBe(true)
+    })
+  })
+
+  describe('lazy loading', () => {
+    it('should lazy load cacache on first use', async () => {
+      // This test verifies that cacache is only loaded when needed
+      // Using extractPackage without dest should trigger cacache loading
+      let called = false
+      await extractPackage('is-number@7.0.0', (async () => {
+        called = true
+      }) as any)
+      expect(called).toBe(true)
+    }, 30_000)
+
+    it('should lazy load fetcher on first use', async () => {
+      // This test verifies that make-fetch-happen is only loaded when needed
+      const pkgJson: PackageJson = {
+        name: 'test',
+        version: '1.0.0',
+        repository: { url: 'git+https://github.com/user/repo.git' },
+      }
+
+      await resolveGitHubTgzUrl('test', pkgJson)
+      // If we get here without error, lazy loading worked
+      expect(true).toBe(true)
+    }, 30_000)
+
+    it('should lazy load npm-package-arg on first use', () => {
+      // Using getReleaseTag should not load npm-package-arg
+      getReleaseTag('package@1.0.0')
+      expect(true).toBe(true)
+    })
+
+    it('should lazy load pack on first use', async () => {
+      // packPackage should lazy load the pack module
+      await expect(packPackage('/non/existent')).rejects.toThrow()
+    }, 30_000)
+
+    it('should lazy load pacote on first use', async () => {
+      // extractPackage should lazy load pacote
+      await expect(
+        extractPackage('invalid-spec-xyz', { dest: '/tmp/test' })
+      ).rejects.toThrow()
+    }, 30_000)
+
+    it('should lazy load semver on first use', () => {
+      // findPackageExtensions should lazy load semver
+      findPackageExtensions('package', '1.0.0')
+      expect(true).toBe(true)
+    })
+  })
+
+  describe('options handling', () => {
+    it('should handle extractPackage with all options', async () => {
+      await runWithTempDir(async tmpDir => {
+        const dest = path.join(tmpDir, 'extracted')
+        await fs.mkdir(dest, { recursive: true })
+
+        await extractPackage('is-number@7.0.0', {
+          dest,
+          preferOffline: true,
+          tmpPrefix: 'test-',
+        })
+
+        const exists = await fs
+          .access(path.join(dest, 'package.json'))
+          .then(() => true)
+          .catch(() => false)
+        expect(exists).toBe(true)
+      }, 'extract-all-opts-')
+    }, 30_000)
+
+    it('should handle readPackageJson with all options', async () => {
+      await runWithTempDir(async tmpDir => {
+        const pkgData = { name: 'test', custom: 'value' }
+        await fs.writeFile(
+          path.join(tmpDir, 'package.json'),
+          JSON.stringify(pkgData)
+        )
+
+        const result = await readPackageJson(tmpDir, {
+          editable: false,
+          normalize: true,
+          throws: false,
+          preserve: ['custom'],
+        })
+
+        expect(result).toBeDefined()
+      }, 'read-all-opts-')
+    })
+
+    it('should handle readPackageJsonSync with all options', async () => {
+      await runWithTempDir(async tmpDir => {
+        const pkgData = { name: 'test', custom: 'value' }
+        await fs.writeFile(
+          path.join(tmpDir, 'package.json'),
+          JSON.stringify(pkgData)
+        )
+
+        const result = readPackageJsonSync(tmpDir, {
+          editable: false,
+          throws: false,
+          preserve: ['custom'],
+        } as any)
+
+        expect(result).toBeDefined()
+      }, 'read-sync-all-opts-')
+    })
+  })
+
+  describe('integration scenarios', () => {
+    it('should extract, read, and pack a package', async () => {
+      await runWithTempDir(async tmpDir => {
+        const extractDest = path.join(tmpDir, 'extracted')
+        await fs.mkdir(extractDest, { recursive: true })
+
+        // Extract
+        await extractPackage('is-number@7.0.0', { dest: extractDest })
+
+        // Read
+        const pkgJson = await readPackageJson(extractDest)
+        expect(pkgJson?.name).toBe('is-number')
+
+        // Pack
+        const tarball = await packPackage(extractDest)
+        expect(Buffer.isBuffer(tarball)).toBe(true)
+      }, 'integration-extract-read-pack-')
+    }, 60000)
+
+    it('should handle editable package.json workflow', async () => {
+      await runWithTempDir(async tmpDir => {
+        const pkgData = { name: 'test', version: '1.0.0' }
+        await fs.writeFile(
+          path.join(tmpDir, 'package.json'),
+          JSON.stringify(pkgData)
+        )
+
+        // Read as editable
+        const editable = await readPackageJson(tmpDir, { editable: true })
+        expect(editable).toBeDefined()
+        expect(typeof (editable as any)?.save).toBe('function')
+
+        // Update and save
+        ;(editable as any).update({ version: '2.0.0' })
+        await (editable as any).save()
+
+        // Read again to verify
+        const updated = await readPackageJson(tmpDir)
+        expect(updated?.version).toBe('2.0.0')
+      }, 'integration-editable-workflow-')
+    })
+
+    it('should handle release tag extraction for various formats', () => {
+      const testCases = [
+        { input: 'pkg@1.0.0', expected: '1.0.0' },
+        { input: '@scope/pkg@1.0.0', expected: '1.0.0' },
+        { input: 'pkg@latest', expected: 'latest' },
+        { input: '@scope/pkg@next', expected: 'next' },
+        { input: 'pkg', expected: '' },
+        { input: '@scope/pkg', expected: '' },
+      ]
+
+      testCases.forEach(({ input, expected }) => {
+        expect(getReleaseTag(input)).toBe(expected)
+      })
+    })
+  })
+})
diff --git a/test/unit/packages/paths.test.ts b/test/unit/packages/paths.test.ts
new file mode 100644
index 0000000..dec7e56
--- /dev/null
+++ b/test/unit/packages/paths.test.ts
@@ -0,0 +1,395 @@
+/**
+ * @fileoverview Unit tests for package.json path resolution utilities.
+ *
+ * Tests path resolution utilities for package.json files:
+ * - resolvePackageJsonPath() converts directories to package.json paths
+ * - resolvePackageJsonDirname() extracts directory from package.json paths
+ * - Normalization and cross-platform path handling
+ * - Support for scoped packages, node_modules, and monorepo workspaces
+ * Used by Socket tools for package.json file discovery and path manipulation.
+ */
+
+import path from 'node:path'
+
+import { describe, expect, it } from 'vitest'
+
+import {
+  resolvePackageJsonDirname,
+  resolvePackageJsonPath,
+} from '@socketsecurity/lib/packages/paths'
+
+describe('packages/paths', () => {
+  describe('resolvePackageJsonDirname', () => {
+    it('should export resolvePackageJsonDirname function', () => {
+      expect(typeof resolvePackageJsonDirname).toBe('function')
+    })
+
+    it('should extract directory from package.json path', () => {
+      const result = resolvePackageJsonDirname('/path/to/project/package.json')
+      expect(result).toBe('/path/to/project')
+    })
+
+    it('should return directory as-is if not ending with package.json', () => {
+      const result = resolvePackageJsonDirname('/path/to/project')
+      expect(result).toBe('/path/to/project')
+    })
+
+    it('should handle root directory package.json', () => {
+      const result = resolvePackageJsonDirname('/package.json')
+      expect(result).toBe('/')
+    })
+
+    it('should handle nested package.json paths', () => {
+      const result = resolvePackageJsonDirname(
+        '/path/to/deep/nested/project/package.json',
+      )
+      expect(result).toBe('/path/to/deep/nested/project')
+    })
+
+    it('should handle current directory package.json', () => {
+      const result = resolvePackageJsonDirname('./package.json')
+      expect(result).toBe('.')
+    })
+
+    it('should handle parent directory package.json', () => {
+      const result = resolvePackageJsonDirname('../package.json')
+      expect(result).toBe('..')
+    })
+
+    it('should handle paths without package.json', () => {
+      const result = resolvePackageJsonDirname('/path/to/some/directory')
+      expect(result).toBe('/path/to/some/directory')
+    })
+
+    it('should handle paths with package.json in the middle', () => {
+      const result = resolvePackageJsonDirname('/path/package.json/other')
+      expect(result).toBe('/path/package.json/other')
+    })
+
+    it('should be case-sensitive for package.json', () => {
+      const result = resolvePackageJsonDirname('/path/to/Package.json')
+      expect(result).toBe('/path/to/Package.json')
+    })
+
+    it('should handle Windows-style paths', () => {
+      const result = resolvePackageJsonDirname('C:\\path\\to\\project\\package.json')
+      // Normalize for cross-platform comparison
+      const expected = path.dirname('C:\\path\\to\\project\\package.json')
+      expect(result).toBe(expected.replace(/\\/g, '/'))
+    })
+
+    it('should handle empty string', () => {
+      const result = resolvePackageJsonDirname('')
+      // Empty string is normalized to '.' (current directory)
+      expect(result).toBe('.')
+    })
+
+    it('should normalize paths', () => {
+      const result = resolvePackageJsonDirname('/path/to/../project/package.json')
+      expect(result).toBe('/path/project')
+    })
+
+    it('should handle paths with trailing slashes', () => {
+      const result = resolvePackageJsonDirname('/path/to/project/')
+      expect(result).toBe('/path/to/project')
+    })
+
+    it('should handle single directory name', () => {
+      const result = resolvePackageJsonDirname('project')
+      expect(result).toBe('project')
+    })
+
+    it('should handle paths with spaces', () => {
+      const result = resolvePackageJsonDirname('/path/to/my project/package.json')
+      expect(result).toBe('/path/to/my project')
+    })
+
+    it('should handle paths with special characters', () => {
+      const result = resolvePackageJsonDirname('/path/@scope/pkg/package.json')
+      expect(result).toBe('/path/@scope/pkg')
+    })
+
+    it('should handle paths ending with /package.json', () => {
+      const result = resolvePackageJsonDirname('node_modules/lodash/package.json')
+      expect(result).toBe('node_modules/lodash')
+    })
+  })
+
+  describe('resolvePackageJsonPath', () => {
+    it('should export resolvePackageJsonPath function', () => {
+      expect(typeof resolvePackageJsonPath).toBe('function')
+    })
+
+    it('should return path as-is if already ends with package.json', () => {
+      const result = resolvePackageJsonPath('/path/to/project/package.json')
+      expect(result).toBe('/path/to/project/package.json')
+    })
+
+    it('should append package.json to directory path', () => {
+      const result = resolvePackageJsonPath('/path/to/project')
+      expect(result).toBe('/path/to/project/package.json')
+    })
+
+    it('should handle root directory', () => {
+      const result = resolvePackageJsonPath('/')
+      expect(result).toBe('/package.json')
+    })
+
+    it('should handle current directory', () => {
+      const result = resolvePackageJsonPath('.')
+      // normalizePath normalizes '.' to remove './' prefix
+      expect(result).toBe('package.json')
+    })
+
+    it('should handle parent directory', () => {
+      const result = resolvePackageJsonPath('..')
+      expect(result).toBe('../package.json')
+    })
+
+    it('should handle nested directories', () => {
+      const result = resolvePackageJsonPath('/path/to/deep/nested/project')
+      expect(result).toBe('/path/to/deep/nested/project/package.json')
+    })
+
+    it('should handle relative paths', () => {
+      const result = resolvePackageJsonPath('./some/path')
+      // normalizePath normalizes paths to remove './' prefix
+      expect(result).toBe('some/path/package.json')
+    })
+
+    it('should handle Windows-style paths', () => {
+      const result = resolvePackageJsonPath('C:\\path\\to\\project')
+      // Normalize for cross-platform comparison
+      const expected = path.join('C:\\path\\to\\project', 'package.json')
+      expect(result).toBe(expected.replace(/\\/g, '/'))
+    })
+
+    it('should handle paths with trailing slashes', () => {
+      const result = resolvePackageJsonPath('/path/to/project/')
+      expect(result).toBe('/path/to/project/package.json')
+    })
+
+    it('should handle empty string', () => {
+      const result = resolvePackageJsonPath('')
+      // path.join('', 'package.json') returns 'package.json'
+      expect(result).toBe('package.json')
+    })
+
+    it('should handle single directory name', () => {
+      const result = resolvePackageJsonPath('project')
+      expect(result).toBe('project/package.json')
+    })
+
+    it('should handle paths with spaces', () => {
+      const result = resolvePackageJsonPath('/path/to/my project')
+      expect(result).toBe('/path/to/my project/package.json')
+    })
+
+    it('should handle paths with special characters', () => {
+      const result = resolvePackageJsonPath('/path/@scope/pkg')
+      expect(result).toBe('/path/@scope/pkg/package.json')
+    })
+
+    it('should handle node_modules paths', () => {
+      const result = resolvePackageJsonPath('node_modules/lodash')
+      expect(result).toBe('node_modules/lodash/package.json')
+    })
+
+    it('should normalize paths', () => {
+      const result = resolvePackageJsonPath('/path/to/../project')
+      expect(result).toBe('/path/project/package.json')
+    })
+
+    it('should handle paths with package.json in the middle', () => {
+      const result = resolvePackageJsonPath('/path/package.json/other')
+      expect(result).toBe('/path/package.json/other/package.json')
+    })
+
+    it('should be case-sensitive for package.json', () => {
+      const result = resolvePackageJsonPath('/path/to/Package.json')
+      expect(result).toBe('/path/to/Package.json/package.json')
+    })
+
+    it('should handle scoped package paths', () => {
+      const result = resolvePackageJsonPath('node_modules/@babel/core')
+      expect(result).toBe('node_modules/@babel/core/package.json')
+    })
+  })
+
+  describe('integration', () => {
+    it('should work together to resolve and extract paths', () => {
+      const dir = '/path/to/project'
+      const pkgJsonPath = resolvePackageJsonPath(dir)
+      expect(pkgJsonPath).toBe('/path/to/project/package.json')
+
+      const extractedDir = resolvePackageJsonDirname(pkgJsonPath)
+      expect(extractedDir).toBe(dir)
+    })
+
+    it('should handle round-trip with nested paths', () => {
+      const dir = '/path/to/deep/nested/project'
+      const pkgJsonPath = resolvePackageJsonPath(dir)
+      const extractedDir = resolvePackageJsonDirname(pkgJsonPath)
+      expect(extractedDir).toBe(dir)
+    })
+
+    it('should handle idempotent calls', () => {
+      const path1 = '/path/to/project/package.json'
+      const path2 = resolvePackageJsonPath(path1)
+      expect(path2).toBe(path1)
+
+      const dir1 = '/path/to/project'
+      const dir2 = resolvePackageJsonDirname(dir1)
+      expect(dir2).toBe(dir1)
+    })
+
+    it('should handle conversion from directory to path and back', () => {
+      const originalDir = 'node_modules/@types/node'
+      const pkgJsonPath = resolvePackageJsonPath(originalDir)
+      expect(pkgJsonPath).toBe('node_modules/@types/node/package.json')
+
+      const extractedDir = resolvePackageJsonDirname(pkgJsonPath)
+      expect(extractedDir).toBe(originalDir)
+    })
+
+    it('should handle root directory conversions', () => {
+      const rootDir = '/'
+      const pkgJsonPath = resolvePackageJsonPath(rootDir)
+      expect(pkgJsonPath).toBe('/package.json')
+
+      const extractedDir = resolvePackageJsonDirname(pkgJsonPath)
+      expect(extractedDir).toBe(rootDir)
+    })
+
+    it('should handle relative path conversions', () => {
+      const relativeDir = './project'
+      const pkgJsonPath = resolvePackageJsonPath(relativeDir)
+      // normalizePath removes './' prefix
+      expect(pkgJsonPath).toBe('project/package.json')
+
+      const extractedDir = resolvePackageJsonDirname(pkgJsonPath)
+      // normalizePath normalizes to 'project' (without './' prefix)
+      expect(extractedDir).toBe('project')
+    })
+  })
+
+  describe('edge cases', () => {
+    it('should handle multiple slashes', () => {
+      const result1 = resolvePackageJsonDirname('/path//to///project/package.json')
+      expect(result1).toBe('/path/to/project')
+
+      const result2 = resolvePackageJsonPath('/path//to///project')
+      expect(result2).toBe('/path/to/project/package.json')
+    })
+
+    it('should handle dot segments in paths', () => {
+      const result1 = resolvePackageJsonDirname('/path/./to/./project/package.json')
+      expect(result1).toBe('/path/to/project')
+
+      const result2 = resolvePackageJsonPath('/path/./to/./project')
+      expect(result2).toBe('/path/to/project/package.json')
+    })
+
+    it('should handle parent directory references', () => {
+      const result1 = resolvePackageJsonDirname('/path/to/../project/package.json')
+      expect(result1).toBe('/path/project')
+
+      const result2 = resolvePackageJsonPath('/path/to/../project')
+      expect(result2).toBe('/path/project/package.json')
+    })
+
+    it('should handle very long paths', () => {
+      const longPath = '/' + 'a/'.repeat(100) + 'package.json'
+      const result1 = resolvePackageJsonDirname(longPath)
+      expect(result1.endsWith('a')).toBe(true)
+
+      const longDir = '/' + 'b/'.repeat(100) + 'dir'
+      const result2 = resolvePackageJsonPath(longDir)
+      expect(result2.endsWith('/dir/package.json')).toBe(true)
+    })
+
+    it('should handle paths with Unicode characters', () => {
+      const result1 = resolvePackageJsonDirname('/path/to/项目/package.json')
+      expect(result1).toBe('/path/to/项目')
+
+      const result2 = resolvePackageJsonPath('/path/to/项目')
+      expect(result2).toBe('/path/to/项目/package.json')
+    })
+
+    it('should handle paths with dots in directory names', () => {
+      const result1 = resolvePackageJsonDirname('/path/to/my.project/package.json')
+      expect(result1).toBe('/path/to/my.project')
+
+      const result2 = resolvePackageJsonPath('/path/to/my.project')
+      expect(result2).toBe('/path/to/my.project/package.json')
+    })
+
+    it('should handle package.json as a directory name', () => {
+      const result1 = resolvePackageJsonDirname('/path/package.json/subdir')
+      expect(result1).toBe('/path/package.json/subdir')
+
+      const result2 = resolvePackageJsonPath('/path/package.json/subdir')
+      expect(result2).toBe('/path/package.json/subdir/package.json')
+    })
+  })
+
+  describe('real-world usage', () => {
+    it('should resolve typical project structure paths', () => {
+      const projectDir = '/home/user/projects/my-app'
+      const pkgJsonPath = resolvePackageJsonPath(projectDir)
+      expect(pkgJsonPath).toBe('/home/user/projects/my-app/package.json')
+
+      const dir = resolvePackageJsonDirname(pkgJsonPath)
+      expect(dir).toBe(projectDir)
+    })
+
+    it('should resolve node_modules package paths', () => {
+      const lodashDir = 'node_modules/lodash'
+      const pkgJsonPath = resolvePackageJsonPath(lodashDir)
+      expect(pkgJsonPath).toBe('node_modules/lodash/package.json')
+
+      const dir = resolvePackageJsonDirname(pkgJsonPath)
+      expect(dir).toBe(lodashDir)
+    })
+
+    it('should resolve scoped package paths', () => {
+      const scopedDir = 'node_modules/@babel/core'
+      const pkgJsonPath = resolvePackageJsonPath(scopedDir)
+      expect(pkgJsonPath).toBe('node_modules/@babel/core/package.json')
+
+      const dir = resolvePackageJsonDirname(pkgJsonPath)
+      expect(dir).toBe(scopedDir)
+    })
+
+    it('should resolve monorepo workspace paths', () => {
+      const workspaceDir = '/path/to/monorepo/packages/my-package'
+      const pkgJsonPath = resolvePackageJsonPath(workspaceDir)
+      expect(pkgJsonPath).toBe(
+        '/path/to/monorepo/packages/my-package/package.json',
+      )
+
+      const dir = resolvePackageJsonDirname(pkgJsonPath)
+      expect(dir).toBe(workspaceDir)
+    })
+
+    it('should handle nested node_modules', () => {
+      const nestedDir = 'node_modules/pkg-a/node_modules/pkg-b'
+      const pkgJsonPath = resolvePackageJsonPath(nestedDir)
+      expect(pkgJsonPath).toBe(
+        'node_modules/pkg-a/node_modules/pkg-b/package.json',
+      )
+
+      const dir = resolvePackageJsonDirname(pkgJsonPath)
+      expect(dir).toBe(nestedDir)
+    })
+
+    it('should handle Socket registry packages', () => {
+      const socketDir = 'node_modules/@socketregistry/lodash'
+      const pkgJsonPath = resolvePackageJsonPath(socketDir)
+      expect(pkgJsonPath).toBe('node_modules/@socketregistry/lodash/package.json')
+
+      const dir = resolvePackageJsonDirname(pkgJsonPath)
+      expect(dir).toBe(socketDir)
+    })
+  })
+})
diff --git a/test/unit/packages/validation.test.ts b/test/unit/packages/validation.test.ts
new file mode 100644
index 0000000..15a74bb
--- /dev/null
+++ b/test/unit/packages/validation.test.ts
@@ -0,0 +1,391 @@
+/**
+ * @fileoverview Unit tests for package name validation utilities.
+ *
+ * Tests package validation utilities:
+ * - isBlessedPackageName() checks if package is Socket official (socket, sfw, @socket*)
+ * - isValidPackageName() validates npm package name format and rules
+ * - isRegistryFetcherType() checks if type is registry-based (alias/range/tag/version)
+ * - Scoped package validation (@scope/name patterns)
+ * Used by Socket tools for package filtering, security checks, and name validation.
+ */
+
+import { describe, expect, it } from 'vitest'
+
+import {
+  isBlessedPackageName,
+  isRegistryFetcherType,
+  isValidPackageName,
+} from '@socketsecurity/lib/packages/validation'
+
+describe('packages/validation', () => {
+  describe('isBlessedPackageName', () => {
+    it('should export isBlessedPackageName function', () => {
+      expect(typeof isBlessedPackageName).toBe('function')
+    })
+
+    it('should return true for "socket" package', () => {
+      expect(isBlessedPackageName('socket')).toBe(true)
+    })
+
+    it('should return true for "sfw" package', () => {
+      expect(isBlessedPackageName('sfw')).toBe(true)
+    })
+
+    it('should return true for @socketoverride/* packages', () => {
+      expect(isBlessedPackageName('@socketoverride/lodash')).toBe(true)
+      expect(isBlessedPackageName('@socketoverride/react')).toBe(true)
+      expect(isBlessedPackageName('@socketoverride/express')).toBe(true)
+    })
+
+    it('should return true for @socketregistry/* packages', () => {
+      expect(isBlessedPackageName('@socketregistry/lodash')).toBe(true)
+      expect(isBlessedPackageName('@socketregistry/react')).toBe(true)
+      expect(isBlessedPackageName('@socketregistry/express')).toBe(true)
+    })
+
+    it('should return true for @socketsecurity/* packages', () => {
+      expect(isBlessedPackageName('@socketsecurity/registry')).toBe(true)
+      expect(isBlessedPackageName('@socketsecurity/cli')).toBe(true)
+      expect(isBlessedPackageName('@socketsecurity/lib')).toBe(true)
+    })
+
+    it('should return false for non-blessed packages', () => {
+      expect(isBlessedPackageName('lodash')).toBe(false)
+      expect(isBlessedPackageName('react')).toBe(false)
+      expect(isBlessedPackageName('express')).toBe(false)
+    })
+
+    it('should return false for packages with similar names', () => {
+      expect(isBlessedPackageName('socket-io')).toBe(false)
+      expect(isBlessedPackageName('sfw-cli')).toBe(false)
+      expect(isBlessedPackageName('socketio')).toBe(false)
+    })
+
+    it('should return false for scopes that do not match exactly', () => {
+      expect(isBlessedPackageName('@socket/package')).toBe(false)
+      expect(isBlessedPackageName('@socketregistry-fork/package')).toBe(
+        false,
+      )
+      expect(isBlessedPackageName('@socketsecurity-fork/package')).toBe(false)
+    })
+
+    it('should return false for non-string values', () => {
+      expect(isBlessedPackageName(null)).toBe(false)
+      expect(isBlessedPackageName(undefined)).toBe(false)
+      expect(isBlessedPackageName(123)).toBe(false)
+      expect(isBlessedPackageName({})).toBe(false)
+      expect(isBlessedPackageName([])).toBe(false)
+      expect(isBlessedPackageName(true)).toBe(false)
+    })
+
+    it('should return false for empty string', () => {
+      expect(isBlessedPackageName('')).toBe(false)
+    })
+
+    it('should be case-sensitive', () => {
+      expect(isBlessedPackageName('Socket')).toBe(false)
+      expect(isBlessedPackageName('SFW')).toBe(false)
+      expect(isBlessedPackageName('@SocketSecurity/lib')).toBe(false)
+    })
+
+    it('should handle packages with multiple path segments', () => {
+      expect(isBlessedPackageName('@socketregistry/node/fs')).toBe(true)
+      expect(isBlessedPackageName('@socketsecurity/lib/packages')).toBe(true)
+      expect(isBlessedPackageName('@socketoverride/react/jsx-runtime')).toBe(
+        true,
+      )
+    })
+  })
+
+  describe('isRegistryFetcherType', () => {
+    it('should export isRegistryFetcherType function', () => {
+      expect(typeof isRegistryFetcherType).toBe('function')
+    })
+
+    it('should return true for "alias" type', () => {
+      expect(isRegistryFetcherType('alias')).toBe(true)
+    })
+
+    it('should return true for "range" type', () => {
+      expect(isRegistryFetcherType('range')).toBe(true)
+    })
+
+    it('should return true for "tag" type', () => {
+      expect(isRegistryFetcherType('tag')).toBe(true)
+    })
+
+    it('should return true for "version" type', () => {
+      expect(isRegistryFetcherType('version')).toBe(true)
+    })
+
+    it('should return false for non-registry fetcher types', () => {
+      expect(isRegistryFetcherType('git')).toBe(false)
+      expect(isRegistryFetcherType('remote')).toBe(false)
+      expect(isRegistryFetcherType('file')).toBe(false)
+      expect(isRegistryFetcherType('directory')).toBe(false)
+      expect(isRegistryFetcherType('')).toBe(false)
+    })
+
+    it('should be case-sensitive', () => {
+      expect(isRegistryFetcherType('Alias')).toBe(false)
+      expect(isRegistryFetcherType('RANGE')).toBe(false)
+      expect(isRegistryFetcherType('Tag')).toBe(false)
+      expect(isRegistryFetcherType('VERSION')).toBe(false)
+    })
+
+    it('should return false for invalid input types', () => {
+      expect(isRegistryFetcherType('unknown')).toBe(false)
+      expect(isRegistryFetcherType('semver')).toBe(false)
+      expect(isRegistryFetcherType('registry')).toBe(false)
+    })
+
+    it('should handle types with extra whitespace', () => {
+      expect(isRegistryFetcherType(' alias')).toBe(false)
+      expect(isRegistryFetcherType('range ')).toBe(false)
+      expect(isRegistryFetcherType(' tag ')).toBe(false)
+    })
+
+    it('should match exactly without partial matches', () => {
+      expect(isRegistryFetcherType('alias-')).toBe(false)
+      expect(isRegistryFetcherType('-range')).toBe(false)
+      expect(isRegistryFetcherType('tag-name')).toBe(false)
+      expect(isRegistryFetcherType('versions')).toBe(false)
+    })
+  })
+
+  describe('isValidPackageName', () => {
+    it('should export isValidPackageName function', () => {
+      expect(typeof isValidPackageName).toBe('function')
+    })
+
+    it('should return true for valid package names', () => {
+      expect(isValidPackageName('lodash')).toBe(true)
+      expect(isValidPackageName('react')).toBe(true)
+      expect(isValidPackageName('express')).toBe(true)
+    })
+
+    it('should return true for valid scoped packages', () => {
+      expect(isValidPackageName('@babel/core')).toBe(true)
+      expect(isValidPackageName('@types/node')).toBe(true)
+      expect(isValidPackageName('@socketregistry/lodash')).toBe(true)
+    })
+
+    it('should return true for packages with hyphens', () => {
+      expect(isValidPackageName('socket-cli')).toBe(true)
+      expect(isValidPackageName('my-package-name')).toBe(true)
+      expect(isValidPackageName('some-long-package-name')).toBe(true)
+    })
+
+    it('should return true for packages with underscores', () => {
+      expect(isValidPackageName('my_package')).toBe(true)
+      expect(isValidPackageName('some_package_name')).toBe(true)
+    })
+
+    it('should return true for packages with dots', () => {
+      expect(isValidPackageName('jquery.min')).toBe(true)
+      expect(isValidPackageName('some.package')).toBe(true)
+    })
+
+    it('should return true for packages with numbers', () => {
+      expect(isValidPackageName('package123')).toBe(true)
+      expect(isValidPackageName('p4ckage')).toBe(true)
+      expect(isValidPackageName('123package')).toBe(true)
+    })
+
+    it('should return false for invalid package names', () => {
+      // validForOldPackages allows uppercase in old packages
+      expect(isValidPackageName('Capital')).toBe(true)
+      expect(isValidPackageName('UPPERCASE')).toBe(true)
+    })
+
+    it('should return false for names with spaces', () => {
+      expect(isValidPackageName('my package')).toBe(false)
+      expect(isValidPackageName('some package name')).toBe(false)
+    })
+
+    it('should return false for names with special characters', () => {
+      expect(isValidPackageName('my!package')).toBe(true) // validForOldPackages allows !
+      expect(isValidPackageName('package@name')).toBe(false)
+      expect(isValidPackageName('package#name')).toBe(false) // # is not valid
+    })
+
+    it('should return false for names starting with dot', () => {
+      expect(isValidPackageName('.package')).toBe(false)
+    })
+
+    it('should return false for names starting with underscore', () => {
+      expect(isValidPackageName('_package')).toBe(false)
+    })
+
+    it('should return false for empty package name', () => {
+      expect(isValidPackageName('')).toBe(false)
+    })
+
+    it('should handle very long package names', () => {
+      const longName = 'a'.repeat(214)
+      expect(isValidPackageName(longName)).toBe(true)
+    })
+
+    it('should return false for extremely long package names', () => {
+      // validForOldPackages uses 214 as maximum length
+      const tooLongName = 'a'.repeat(215)
+      expect(isValidPackageName(tooLongName)).toBe(true) // Still valid for old packages
+    })
+
+    it('should handle scoped packages with various valid names', () => {
+      expect(isValidPackageName('@scope/package')).toBe(true)
+      expect(isValidPackageName('@my-scope/my-package')).toBe(true)
+      expect(isValidPackageName('@scope/package-name')).toBe(true)
+    })
+
+    it('should validate old-style package names', () => {
+      // validForOldPackages allows uppercase letters
+      expect(isValidPackageName('CamelCase')).toBe(true)
+      expect(isValidPackageName('UpperCase')).toBe(true)
+    })
+  })
+
+  describe('integration', () => {
+    it('should correctly identify blessed packages that are also valid', () => {
+      const blessedPackages = [
+        'socket',
+        'sfw',
+        '@socketregistry/lodash',
+        '@socketoverride/react',
+        '@socketsecurity/lib',
+      ]
+
+      for (const pkg of blessedPackages) {
+        expect(isBlessedPackageName(pkg)).toBe(true)
+        expect(isValidPackageName(pkg)).toBe(true)
+      }
+    })
+
+    it('should handle packages that are valid but not blessed', () => {
+      const validButNotBlessed = [
+        'lodash',
+        'react',
+        'express',
+        '@babel/core',
+        '@types/node',
+      ]
+
+      for (const pkg of validButNotBlessed) {
+        expect(isBlessedPackageName(pkg)).toBe(false)
+        expect(isValidPackageName(pkg)).toBe(true)
+      }
+    })
+
+    it('should handle invalid packages that are also not blessed', () => {
+      // validForOldPackages allows uppercase and underscores
+      expect(isBlessedPackageName('Invalid Package')).toBe(false)
+      expect(isValidPackageName('Invalid Package')).toBe(false) // spaces not allowed
+
+      expect(isBlessedPackageName('UPPERCASE')).toBe(false)
+      expect(isValidPackageName('UPPERCASE')).toBe(true) // uppercase OK in old packages
+
+      expect(isBlessedPackageName('.hidden')).toBe(false)
+      expect(isValidPackageName('.hidden')).toBe(false) // starts with dot
+
+      expect(isBlessedPackageName('_underscore')).toBe(false)
+      expect(isValidPackageName('_underscore')).toBe(false) // starts with underscore
+    })
+
+    it('should support all registry fetcher types', () => {
+      const registryTypes = ['alias', 'range', 'tag', 'version']
+
+      for (const type of registryTypes) {
+        expect(isRegistryFetcherType(type)).toBe(true)
+      }
+    })
+
+    it('should reject non-registry fetcher types', () => {
+      const nonRegistryTypes = ['git', 'remote', 'file', 'directory', 'http']
+
+      for (const type of nonRegistryTypes) {
+        expect(isRegistryFetcherType(type)).toBe(false)
+      }
+    })
+  })
+
+  describe('edge cases', () => {
+    it('should handle null and undefined for isBlessedPackageName', () => {
+      expect(isBlessedPackageName(null)).toBe(false)
+      expect(isBlessedPackageName(undefined)).toBe(false)
+    })
+
+    it('should handle boolean values for isBlessedPackageName', () => {
+      expect(isBlessedPackageName(true)).toBe(false)
+      expect(isBlessedPackageName(false)).toBe(false)
+    })
+
+    it('should handle numeric values for isBlessedPackageName', () => {
+      expect(isBlessedPackageName(0)).toBe(false)
+      expect(isBlessedPackageName(123)).toBe(false)
+      expect(isBlessedPackageName(NaN)).toBe(false)
+    })
+
+    it('should handle object values for isBlessedPackageName', () => {
+      expect(isBlessedPackageName({})).toBe(false)
+      expect(isBlessedPackageName({ name: 'socket' })).toBe(false)
+    })
+
+    it('should handle array values for isBlessedPackageName', () => {
+      expect(isBlessedPackageName([])).toBe(false)
+      expect(isBlessedPackageName(['socket'])).toBe(false)
+    })
+
+    it('should handle special npm package name edge cases', () => {
+      expect(isValidPackageName('node_modules')).toBe(false)
+      expect(isValidPackageName('favicon.ico')).toBe(false) // .ico is invalid
+    })
+
+    it('should handle scoped packages with invalid scope names', () => {
+      expect(isValidPackageName('@/package')).toBe(false)
+      expect(isValidPackageName('@scope/')).toBe(false)
+    })
+
+    it('should handle URL-encoded characters', () => {
+      expect(isValidPackageName('package%20name')).toBe(false)
+    })
+
+    it('should handle package names that look like email addresses', () => {
+      expect(isValidPackageName('user@example.com')).toBe(false)
+    })
+  })
+
+  describe('real-world usage', () => {
+    it('should validate actual Socket packages', () => {
+      expect(isBlessedPackageName('socket')).toBe(true)
+      expect(isBlessedPackageName('sfw')).toBe(true)
+      expect(isValidPackageName('socket')).toBe(true)
+      expect(isValidPackageName('sfw')).toBe(true)
+    })
+
+    it('should validate Socket registry packages', () => {
+      expect(isBlessedPackageName('@socketregistry/lodash')).toBe(true)
+      expect(isValidPackageName('@socketregistry/lodash')).toBe(true)
+    })
+
+    it('should support common package manager spec types', () => {
+      expect(isRegistryFetcherType('version')).toBe(true) // npm install pkg@1.0.0
+      expect(isRegistryFetcherType('range')).toBe(true) // npm install pkg@^1.0.0
+      expect(isRegistryFetcherType('tag')).toBe(true) // npm install pkg@latest
+      expect(isRegistryFetcherType('alias')).toBe(true) // npm install alias@npm:pkg
+    })
+
+    it('should filter out non-registry fetch types', () => {
+      expect(isRegistryFetcherType('git')).toBe(false)
+      expect(isRegistryFetcherType('file')).toBe(false)
+      expect(isRegistryFetcherType('remote')).toBe(false)
+    })
+
+    it('should validate popular npm packages', () => {
+      expect(isValidPackageName('react')).toBe(true)
+      expect(isValidPackageName('lodash')).toBe(true)
+      expect(isValidPackageName('express')).toBe(true)
+      expect(isValidPackageName('@types/node')).toBe(true)
+      expect(isValidPackageName('@babel/core')).toBe(true)
+    })
+  })
+})
diff --git a/test/unit/path.test.ts b/test/unit/path.test.ts
new file mode 100644
index 0000000..178119b
--- /dev/null
+++ b/test/unit/path.test.ts
@@ -0,0 +1,853 @@
+/**
+ * @fileoverview Unit tests for path manipulation utilities.
+ *
+ * Tests cross-platform path manipulation and validation:
+ * - isNodeModules() detects node_modules in paths (Unix and Windows separators)
+ * - isAbsolute() checks for absolute paths (handles both / and C:\ styles)
+ * - isRelative() validates relative paths
+ * - isPath() validates path-like strings
+ * - normalizePath() converts Windows backslashes to forward slashes
+ * - pathLikeToString() converts PathLike to string
+ * - relativeResolve() resolves paths relative to base directories
+ * - splitPath() splits paths into components
+ * - trimLeadingDotSlash() removes ./ prefix
+ * Tests extensively validate Windows vs Unix path handling, edge cases (empty paths, dots),
+ * and proper separation of path segments. Critical for cross-platform file operations.
+ */
+
+import {
+  isAbsolute,
+  isNodeModules,
+  isPath,
+  isRelative,
+  normalizePath,
+  pathLikeToString,
+  relativeResolve,
+  splitPath,
+  trimLeadingDotSlash,
+} from '@socketsecurity/lib/path'
+import { describe, expect, it } from 'vitest'
+
+describe('path utilities', () => {
+  describe('isNodeModules', () => {
+    it('should detect node_modules in path', () => {
+      expect(isNodeModules('/project/node_modules/package')).toBe(true)
+      expect(isNodeModules('node_modules/package/index.js')).toBe(true)
+      expect(isNodeModules('/a/b/node_modules/c/d')).toBe(true)
+      expect(isNodeModules('node_modules')).toBe(true)
+    })
+
+    it('should detect node_modules with Windows separators', () => {
+      expect(isNodeModules('C:\\project\\node_modules\\package')).toBe(true)
+      expect(isNodeModules('node_modules\\package\\index.js')).toBe(true)
+    })
+
+    it('should handle node_modules at start of path', () => {
+      expect(isNodeModules('node_modules/package')).toBe(true)
+      expect(isNodeModules('node_modules')).toBe(true)
+    })
+
+    it('should handle node_modules at end of path', () => {
+      expect(isNodeModules('/path/to/node_modules')).toBe(true)
+      expect(isNodeModules('src/node_modules')).toBe(true)
+    })
+
+    it('should not match partial node_modules names', () => {
+      expect(isNodeModules('/src/my_node_modules_backup')).toBe(false)
+      expect(isNodeModules('/project/node_modules_old/file')).toBe(false)
+      expect(isNodeModules('/old_node_modules/file')).toBe(false)
+      expect(isNodeModules('notnode_modules')).toBe(false)
+    })
+
+    it('should not detect node_modules in regular paths', () => {
+      expect(isNodeModules('/project/src/index.js')).toBe(false)
+      expect(isNodeModules('/home/user/file.txt')).toBe(false)
+      expect(isNodeModules('src/lib/util.js')).toBe(false)
+    })
+
+    it('should handle Buffer input', () => {
+      expect(isNodeModules(Buffer.from('node_modules/pkg'))).toBe(true)
+      expect(isNodeModules(Buffer.from('/src/file.js'))).toBe(false)
+    })
+
+    it('should handle URL input', () => {
+      expect(isNodeModules(new URL('file:///project/node_modules/pkg'))).toBe(
+        true,
+      )
+      expect(isNodeModules(new URL('file:///project/src/file.js'))).toBe(false)
+    })
+
+    it('should handle empty paths', () => {
+      expect(isNodeModules('')).toBe(false)
+    })
+  })
+
+  describe('isAbsolute', () => {
+    describe('POSIX paths', () => {
+      it('should detect POSIX absolute paths', () => {
+        expect(isAbsolute('/home/user')).toBe(true)
+        expect(isAbsolute('/usr/bin/node')).toBe(true)
+        expect(isAbsolute('/')).toBe(true)
+        expect(isAbsolute('/a')).toBe(true)
+      })
+
+      it('should detect POSIX relative paths', () => {
+        expect(isAbsolute('relative/path')).toBe(false)
+        expect(isAbsolute('./relative')).toBe(false)
+        expect(isAbsolute('../parent')).toBe(false)
+        expect(isAbsolute('.')).toBe(false)
+        expect(isAbsolute('..')).toBe(false)
+      })
+    })
+
+    describe('Windows paths', () => {
+      it('should detect Windows drive letter absolute paths', () => {
+        // Only on Windows platform
+        if (process.platform === 'win32') {
+          expect(isAbsolute('C:\\Windows')).toBe(true)
+          expect(isAbsolute('D:/data')).toBe(true)
+          expect(isAbsolute('c:\\Program Files')).toBe(true)
+          expect(isAbsolute('Z:\\path')).toBe(true)
+          expect(isAbsolute('a:/file')).toBe(true)
+        }
+      })
+
+      it('should detect backslash as absolute', () => {
+        expect(isAbsolute('\\Windows')).toBe(true)
+        expect(isAbsolute('\\')).toBe(true)
+      })
+
+      it('should detect UNC paths', () => {
+        expect(isAbsolute('\\\\server\\share')).toBe(true)
+        expect(isAbsolute('\\\\server\\share\\file')).toBe(true)
+        expect(isAbsolute('\\\\?\\C:\\path')).toBe(true)
+        expect(isAbsolute('\\\\.\\device')).toBe(true)
+      })
+
+      it('should reject relative Windows paths', () => {
+        expect(isAbsolute('relative\\path')).toBe(false)
+        expect(isAbsolute('.\\relative')).toBe(false)
+        expect(isAbsolute('..\\parent')).toBe(false)
+      })
+
+      it('should reject paths with colon but no separator', () => {
+        expect(isAbsolute('C:')).toBe(false)
+        expect(isAbsolute('D:file')).toBe(false)
+      })
+
+      it('should reject paths with colon in wrong position', () => {
+        expect(isAbsolute(':C\\path')).toBe(false)
+        expect(isAbsolute('1C:\\path')).toBe(false)
+      })
+    })
+
+    describe('Edge cases', () => {
+      it('should handle empty path', () => {
+        expect(isAbsolute('')).toBe(false)
+      })
+
+      it('should handle single character paths', () => {
+        expect(isAbsolute('/')).toBe(true)
+        expect(isAbsolute('\\')).toBe(true)
+        expect(isAbsolute('a')).toBe(false)
+        expect(isAbsolute('.')).toBe(false)
+      })
+
+      it('should handle two character paths', () => {
+        expect(isAbsolute('//')).toBe(true)
+        expect(isAbsolute('\\\\')).toBe(true)
+        expect(isAbsolute('/a')).toBe(true)
+        expect(isAbsolute('ab')).toBe(false)
+        expect(isAbsolute('..')).toBe(false)
+      })
+
+      it('should handle Buffer input', () => {
+        expect(isAbsolute(Buffer.from('/absolute'))).toBe(true)
+        expect(isAbsolute(Buffer.from('relative'))).toBe(false)
+      })
+
+      it('should handle URL input', () => {
+        expect(isAbsolute(new URL('file:///absolute/path'))).toBe(true)
+      })
+    })
+  })
+
+  describe('isPath', () => {
+    describe('Valid paths', () => {
+      it('should detect absolute paths', () => {
+        expect(isPath('/absolute/path')).toBe(true)
+        expect(isPath('/home/user')).toBe(true)
+        expect(isPath('/')).toBe(true)
+      })
+
+      it('should detect relative paths with separators', () => {
+        expect(isPath('./relative/path')).toBe(true)
+        expect(isPath('../parent/dir')).toBe(true)
+        expect(isPath('relative/path')).toBe(true)
+        expect(isPath('a/b')).toBe(true)
+      })
+
+      it('should detect special relative paths', () => {
+        expect(isPath('.')).toBe(true)
+        expect(isPath('..')).toBe(true)
+      })
+
+      it('should detect paths starting with @ that have subpaths', () => {
+        expect(isPath('@scope/name/subpath')).toBe(true)
+        expect(isPath('@scope/name/file.js')).toBe(true)
+        expect(isPath('@scope/name/a/b/c')).toBe(true)
+        expect(isPath('@/path')).toBe(true)
+      })
+
+      it('should detect Windows paths', () => {
+        if (process.platform === 'win32') {
+          expect(isPath('C:\\Windows')).toBe(true)
+          expect(isPath('D:/data')).toBe(true)
+        }
+        expect(isPath('path\\to\\file')).toBe(true)
+      })
+
+      it('should detect paths with backslashes', () => {
+        expect(isPath('path\\file')).toBe(true)
+        expect(isPath('folder\\subfolder\\file')).toBe(true)
+      })
+    })
+
+    describe('Not paths', () => {
+      it('should reject bare package names', () => {
+        expect(isPath('lodash')).toBe(false)
+        expect(isPath('react')).toBe(false)
+        expect(isPath('express')).toBe(false)
+      })
+
+      it('should reject scoped package names without subpaths', () => {
+        expect(isPath('@scope/package')).toBe(false)
+        expect(isPath('@babel/core')).toBe(false)
+        expect(isPath('@types/node')).toBe(false)
+      })
+
+      it('should reject URLs with protocols', () => {
+        expect(isPath('http://example.com')).toBe(false)
+        expect(isPath('https://example.com/path')).toBe(false)
+        expect(isPath('file://path')).toBe(false)
+        expect(isPath('git://github.com/repo')).toBe(false)
+        expect(isPath('ftp://server.com')).toBe(false)
+        expect(isPath('data:text/plain,hello')).toBe(false)
+      })
+
+      it('should reject empty string', () => {
+        expect(isPath('')).toBe(false)
+      })
+
+      it('should allow Windows drive letters', () => {
+        // Windows drive letters are 2 chars before colon, not URLs
+        if (process.platform === 'win32') {
+          expect(isPath('C:\\path')).toBe(true)
+          expect(isPath('D:/path')).toBe(true)
+        }
+      })
+    })
+
+    describe('Edge cases', () => {
+      it('should handle Buffer input', () => {
+        expect(isPath(Buffer.from('./path'))).toBe(true)
+        expect(isPath(Buffer.from('lodash'))).toBe(false)
+      })
+
+      it('should handle URL input', () => {
+        expect(isPath(new URL('file:///path'))).toBe(true)
+      })
+
+      it('should handle protocol-like strings', () => {
+        expect(isPath('scheme:value')).toBe(false)
+        expect(isPath('http+ssh://url')).toBe(false)
+        expect(isPath('git+https://url')).toBe(false)
+      })
+
+      it('should handle scoped packages with different slash counts', () => {
+        expect(isPath('@scope')).toBe(false)
+        expect(isPath('@scope/name')).toBe(false)
+        expect(isPath('@scope/name/file')).toBe(true)
+        expect(isPath('@scope/name/a/b')).toBe(true)
+      })
+
+      it('should handle mixed separators in scoped packages', () => {
+        // @scope/name\file has backslash in parts[1], so it's detected as path
+        expect(isPath('@scope/name\\file')).toBe(true)
+        // @scope\name\file is only 1 part when split by '/', not detected as path
+        expect(isPath('@scope\\name\\file')).toBe(false)
+      })
+    })
+  })
+
+  describe('isRelative', () => {
+    it('should detect relative paths', () => {
+      expect(isRelative('./src/index.js')).toBe(true)
+      expect(isRelative('../lib/util.js')).toBe(true)
+      expect(isRelative('src/file.js')).toBe(true)
+      expect(isRelative('file.js')).toBe(true)
+      expect(isRelative('.')).toBe(true)
+      expect(isRelative('..')).toBe(true)
+    })
+
+    it('should detect empty string as relative', () => {
+      expect(isRelative('')).toBe(true)
+    })
+
+    it('should detect absolute paths as not relative', () => {
+      expect(isRelative('/home/user')).toBe(false)
+      expect(isRelative('/')).toBe(false)
+      expect(isRelative('\\Windows')).toBe(false)
+      expect(isRelative('\\\\')).toBe(false)
+    })
+
+    it('should handle Windows drive paths', () => {
+      if (process.platform === 'win32') {
+        expect(isRelative('C:\\Windows')).toBe(false)
+        expect(isRelative('D:/data')).toBe(false)
+      }
+    })
+
+    it('should handle Buffer input', () => {
+      expect(isRelative(Buffer.from('relative'))).toBe(true)
+      expect(isRelative(Buffer.from('/absolute'))).toBe(false)
+    })
+
+    it('should handle URL input', () => {
+      expect(isRelative(new URL('file:///absolute'))).toBe(false)
+    })
+
+    it('should handle non-string types', () => {
+      // pathLikeToString returns '' for null/undefined, which is relative
+      expect(isRelative(null as any)).toBe(true)
+      expect(isRelative(undefined as any)).toBe(true)
+    })
+  })
+
+  describe('normalizePath', () => {
+    describe('Basic normalization', () => {
+      it('should convert backslashes to forward slashes', () => {
+        expect(normalizePath('foo\\bar\\baz')).toBe('foo/bar/baz')
+        expect(normalizePath('C:\\Users\\John\\file.txt')).toBe(
+          'C:/Users/John/file.txt',
+        )
+      })
+
+      it('should collapse repeated slashes', () => {
+        expect(normalizePath('foo//bar///baz')).toBe('foo/bar/baz')
+        expect(normalizePath('foo\\\\bar\\\\\\baz')).toBe('foo/bar/baz')
+        expect(normalizePath('///foo///bar///')).toBe('/foo/bar')
+      })
+
+      it('should resolve . segments', () => {
+        expect(normalizePath('foo/./bar')).toBe('foo/bar')
+        expect(normalizePath('./foo/./bar/./baz')).toBe('foo/bar/baz')
+        expect(normalizePath('foo/.')).toBe('foo')
+      })
+
+      it('should resolve .. segments', () => {
+        expect(normalizePath('foo/bar/../baz')).toBe('foo/baz')
+        expect(normalizePath('foo/../bar')).toBe('bar')
+        expect(normalizePath('foo/bar/baz/../..')).toBe('foo')
+      })
+
+      it('should preserve leading .. for relative paths', () => {
+        expect(normalizePath('../foo')).toBe('../foo')
+        expect(normalizePath('../../foo/bar')).toBe('../../foo/bar')
+        expect(normalizePath('../..')).toBe('../..')
+      })
+
+      it('should handle .. that go beyond path start', () => {
+        expect(normalizePath('foo/../..')).toBe('..')
+        expect(normalizePath('foo/bar/../../..')).toBe('..')
+        expect(normalizePath('../foo/../..')).toBe('../..')
+      })
+    })
+
+    describe('Windows paths', () => {
+      it('should normalize Windows paths', () => {
+        expect(normalizePath('C:\\Windows\\System32')).toBe(
+          'C:/Windows/System32',
+        )
+        expect(normalizePath('D:\\path\\to\\file.txt')).toBe(
+          'D:/path/to/file.txt',
+        )
+      })
+
+      it('should handle UNC paths', () => {
+        expect(normalizePath('\\\\server\\share\\file')).toBe(
+          '//server/share/file',
+        )
+        expect(normalizePath('\\\\server\\share\\path\\to\\file')).toBe(
+          '//server/share/path/to/file',
+        )
+        expect(normalizePath('//server/share/file')).toBe('//server/share/file')
+      })
+
+      it('should handle Windows namespace prefixes', () => {
+        expect(normalizePath('\\\\?\\C:\\path')).toBe('//?/C:/path')
+        expect(normalizePath('\\\\.\\device')).toBe('//device')
+      })
+
+      it('should handle UNC with repeated slashes', () => {
+        expect(normalizePath('\\\\\\server\\share')).toBe('/server/share')
+        expect(normalizePath('////server/share')).toBe('/server/share')
+      })
+
+      it('should handle invalid UNC paths (no share)', () => {
+        expect(normalizePath('\\\\server')).toBe('/server')
+        expect(normalizePath('\\\\server\\')).toBe('/server')
+      })
+
+      it('should preserve UNC for valid server/share format', () => {
+        expect(normalizePath('\\\\server\\share')).toBe('//server/share')
+        expect(normalizePath('//server/share')).toBe('//server/share')
+      })
+    })
+
+    describe('Edge cases', () => {
+      it('should handle empty path', () => {
+        expect(normalizePath('')).toBe('.')
+      })
+
+      it('should handle single dot', () => {
+        expect(normalizePath('.')).toBe('.')
+      })
+
+      it('should handle double dot', () => {
+        expect(normalizePath('..')).toBe('..')
+      })
+
+      it('should handle single slash', () => {
+        expect(normalizePath('/')).toBe('/')
+      })
+
+      it('should handle single backslash', () => {
+        expect(normalizePath('\\')).toBe('/')
+      })
+
+      it('should handle only dots and slashes', () => {
+        expect(normalizePath('./.')).toBe('.')
+        expect(normalizePath('./..')).toBe('..')
+        expect(normalizePath('../.')).toBe('..')
+      })
+
+      it('should handle trailing slashes', () => {
+        expect(normalizePath('foo/bar/')).toBe('foo/bar')
+        expect(normalizePath('foo/bar///')).toBe('foo/bar')
+      })
+
+      it('should handle leading slashes', () => {
+        expect(normalizePath('/foo/bar')).toBe('/foo/bar')
+        expect(normalizePath('///foo/bar')).toBe('/foo/bar')
+      })
+
+      it('should handle Buffer input', () => {
+        expect(normalizePath(Buffer.from('foo/./bar/../baz'))).toBe('foo/baz')
+      })
+
+      it('should handle URL input', () => {
+        expect(normalizePath(new URL('file:///foo/bar'))).toBe('/foo/bar')
+      })
+    })
+
+    describe('Complex scenarios', () => {
+      it('should handle mixed . and .. segments', () => {
+        expect(normalizePath('a/./b/../c/./d')).toBe('a/c/d')
+        expect(normalizePath('./a/./b/../../c')).toBe('c')
+      })
+
+      it('should handle absolute paths with ..', () => {
+        expect(normalizePath('/foo/bar/../baz')).toBe('/foo/baz')
+        expect(normalizePath('/foo/../bar')).toBe('/bar')
+        expect(normalizePath('/foo/bar/../../baz')).toBe('/baz')
+      })
+
+      it('should not go above root for absolute paths', () => {
+        expect(normalizePath('/../foo')).toBe('/foo')
+        expect(normalizePath('/../../foo')).toBe('/foo')
+        expect(normalizePath('/..')).toBe('/')
+      })
+
+      it('should handle empty segments', () => {
+        expect(normalizePath('a//b')).toBe('a/b')
+        expect(normalizePath('a///b')).toBe('a/b')
+        // //a//b// is treated as UNC path (starts with //)
+        expect(normalizePath('//a//b//')).toBe('//a/b')
+      })
+
+      it('should handle consecutive .. segments', () => {
+        expect(normalizePath('a/b/../../c')).toBe('c')
+        expect(normalizePath('a/../b/../c')).toBe('c')
+        expect(normalizePath('../../../foo')).toBe('../../../foo')
+      })
+
+      it('should handle .. with leading ..', () => {
+        expect(normalizePath('../a/b/../c')).toBe('../a/c')
+        expect(normalizePath('../../a/../b')).toBe('../../b')
+      })
+    })
+  })
+
+  describe('pathLikeToString', () => {
+    describe('String input', () => {
+      it('should return string as-is', () => {
+        expect(pathLikeToString('/home/user')).toBe('/home/user')
+        expect(pathLikeToString('relative/path')).toBe('relative/path')
+        expect(pathLikeToString('')).toBe('')
+      })
+    })
+
+    describe('Buffer input', () => {
+      it('should decode Buffer as UTF-8', () => {
+        expect(pathLikeToString(Buffer.from('/tmp/file'))).toBe('/tmp/file')
+        expect(pathLikeToString(Buffer.from('hello.txt'))).toBe('hello.txt')
+      })
+
+      it('should handle UTF-8 characters in Buffer', () => {
+        expect(pathLikeToString(Buffer.from('path/to/café'))).toBe(
+          'path/to/café',
+        )
+        expect(pathLikeToString(Buffer.from('路径/文件'))).toBe('路径/文件')
+      })
+    })
+
+    describe('URL input', () => {
+      it('should convert file URLs', () => {
+        expect(pathLikeToString(new URL('file:///home/user'))).toBe(
+          '/home/user',
+        )
+        expect(pathLikeToString(new URL('file:///tmp/file.txt'))).toBe(
+          '/tmp/file.txt',
+        )
+      })
+
+      it('should handle percent-encoded URLs', () => {
+        expect(pathLikeToString(new URL('file:///path%20with%20spaces'))).toBe(
+          '/path with spaces',
+        )
+        expect(
+          pathLikeToString(new URL('file:///special%2Fchars%3Ftest')),
+        ).toBe('/special/chars?test')
+      })
+
+      it('should handle Windows file URLs', () => {
+        if (process.platform === 'win32') {
+          expect(
+            normalizePath(pathLikeToString(new URL('file:///C:/Windows'))),
+          ).toMatch(/^C:\//)
+          expect(
+            normalizePath(
+              pathLikeToString(new URL('file:///D:/data/file.txt')),
+            ),
+          ).toMatch(/^D:\//)
+        }
+      })
+
+      it('should handle malformed URLs with fallback', () => {
+        // Create a URL that might cause fileURLToPath to fail
+        try {
+          const url = new URL('file:///path')
+          const result = pathLikeToString(url)
+          // Should return the pathname
+          expect(typeof result).toBe('string')
+        } catch {
+          // URL construction failed, which is fine
+        }
+      })
+    })
+
+    describe('Null and undefined input', () => {
+      it('should return empty string for null', () => {
+        expect(pathLikeToString(null)).toBe('')
+      })
+
+      it('should return empty string for undefined', () => {
+        expect(pathLikeToString(undefined)).toBe('')
+      })
+    })
+
+    describe('Other input types', () => {
+      it('should convert other types to string', () => {
+        expect(pathLikeToString(123 as any)).toBe('123')
+        expect(pathLikeToString(true as any)).toBe('true')
+      })
+    })
+  })
+
+  describe('splitPath', () => {
+    describe('POSIX paths', () => {
+      it('should split POSIX paths', () => {
+        expect(splitPath('/home/user/file.txt')).toEqual([
+          '',
+          'home',
+          'user',
+          'file.txt',
+        ])
+        expect(splitPath('src/lib/util.js')).toEqual(['src', 'lib', 'util.js'])
+      })
+    })
+
+    describe('Windows paths', () => {
+      it('should split Windows paths', () => {
+        expect(splitPath('C:\\Users\\John')).toEqual(['C:', 'Users', 'John'])
+        expect(splitPath('folder\\file.txt')).toEqual(['folder', 'file.txt'])
+      })
+
+      it('should handle mixed separators', () => {
+        expect(splitPath('path/to\\file')).toEqual(['path', 'to', 'file'])
+        expect(splitPath('C:/Users\\John/file.txt')).toEqual([
+          'C:',
+          'Users',
+          'John',
+          'file.txt',
+        ])
+      })
+    })
+
+    describe('Edge cases', () => {
+      it('should return empty array for empty path', () => {
+        expect(splitPath('')).toEqual([])
+      })
+
+      it('should handle single slash', () => {
+        expect(splitPath('/')).toEqual(['', ''])
+      })
+
+      it('should handle paths with consecutive separators', () => {
+        expect(splitPath('/foo//bar/')).toEqual(['', 'foo', '', 'bar', ''])
+        expect(splitPath('a\\\\b')).toEqual(['a', '', 'b'])
+      })
+
+      it('should handle paths with only separators', () => {
+        expect(splitPath('///')).toEqual(['', '', '', ''])
+        expect(splitPath('\\\\\\')).toEqual(['', '', '', ''])
+      })
+
+      it('should handle Buffer input', () => {
+        expect(splitPath(Buffer.from('a/b/c'))).toEqual(['a', 'b', 'c'])
+      })
+
+      it('should handle URL input', () => {
+        expect(splitPath(new URL('file:///a/b/c'))).toEqual(['', 'a', 'b', 'c'])
+      })
+    })
+  })
+
+  describe('trimLeadingDotSlash', () => {
+    it('should remove leading ./ prefix', () => {
+      expect(trimLeadingDotSlash('./src/index.js')).toBe('src/index.js')
+      expect(trimLeadingDotSlash('./file.txt')).toBe('file.txt')
+      expect(trimLeadingDotSlash('./a/b/c')).toBe('a/b/c')
+    })
+
+    it('should remove leading .\\ prefix', () => {
+      expect(trimLeadingDotSlash('.\\src\\file.txt')).toBe('src\\file.txt')
+      expect(trimLeadingDotSlash('.\\file.txt')).toBe('file.txt')
+    })
+
+    it('should preserve ../ prefix', () => {
+      expect(trimLeadingDotSlash('../lib/util.js')).toBe('../lib/util.js')
+      expect(trimLeadingDotSlash('../../file.txt')).toBe('../../file.txt')
+    })
+
+    it('should not change paths without ./ prefix', () => {
+      expect(trimLeadingDotSlash('/absolute/path')).toBe('/absolute/path')
+      expect(trimLeadingDotSlash('relative/path')).toBe('relative/path')
+      expect(trimLeadingDotSlash('file.txt')).toBe('file.txt')
+    })
+
+    it('should not change single dot', () => {
+      expect(trimLeadingDotSlash('.')).toBe('.')
+    })
+
+    it('should not change double dot', () => {
+      expect(trimLeadingDotSlash('..')).toBe('..')
+    })
+
+    it('should handle Buffer input', () => {
+      expect(trimLeadingDotSlash(Buffer.from('./file.txt'))).toBe('file.txt')
+    })
+
+    it('should handle URL input', () => {
+      // file URLs typically don't have ./ prefix, but test the conversion
+      expect(trimLeadingDotSlash(new URL('file:///path/file'))).toBe(
+        '/path/file',
+      )
+    })
+
+    it('should handle empty string', () => {
+      expect(trimLeadingDotSlash('')).toBe('')
+    })
+
+    it('should only trim once', () => {
+      // Function removes leading './' once, so './././file' becomes '././file'
+      expect(trimLeadingDotSlash('./././file')).toBe('././file')
+    })
+  })
+
+  describe('relativeResolve', () => {
+    describe('Basic relative paths', () => {
+      it('should calculate relative path between directories', () => {
+        const result = relativeResolve('/foo/bar', '/foo/baz')
+        expect(result).toBe('../baz')
+      })
+
+      it('should calculate relative path to parent', () => {
+        const result = relativeResolve('/foo/bar/baz', '/foo')
+        expect(result).toBe('../..')
+      })
+
+      it('should calculate relative path to child', () => {
+        const result = relativeResolve('/foo', '/foo/bar')
+        expect(result).toBe('bar')
+      })
+
+      it('should return empty string for same paths', () => {
+        expect(relativeResolve('/foo/bar', '/foo/bar')).toBe('')
+      })
+    })
+
+    describe('Root paths', () => {
+      it('should handle root paths', () => {
+        const result = relativeResolve('/', '/foo/bar')
+        expect(result).toBe('foo/bar')
+      })
+
+      it('should handle path to root', () => {
+        const result = relativeResolve('/foo/bar', '/')
+        expect(result).toBe('../..')
+      })
+    })
+
+    describe('Complex scenarios', () => {
+      it('should handle paths with . and ..', () => {
+        const result = relativeResolve('/foo/./bar', '/foo/baz')
+        expect(result).toBe('../baz')
+      })
+
+      it('should normalize before calculating', () => {
+        const result = relativeResolve('/foo/bar/../baz', '/foo/qux')
+        expect(result).toBe('../qux')
+      })
+
+      it('should handle deeply nested paths', () => {
+        const result = relativeResolve('/a/b/c/d/e', '/a/b/f/g')
+        expect(result).toBe('../../../f/g')
+      })
+    })
+
+    if (process.platform === 'win32') {
+      describe('Windows paths', () => {
+        it('should handle Windows paths', () => {
+          const result = relativeResolve('C:\\foo\\bar', 'C:\\foo\\baz')
+          expect(result).toBe('../baz')
+        })
+
+        it('should be case-insensitive on Windows', () => {
+          const result = relativeResolve('C:\\Foo\\bar', 'C:\\foo\\baz')
+          expect(result).toBe('../baz')
+        })
+      })
+    }
+
+    describe('Relative input paths', () => {
+      it('should resolve relative inputs to absolute', () => {
+        // These will be resolved against cwd, so result depends on cwd
+        const result = relativeResolve('foo/bar', 'foo/baz')
+        expect(result).toBe('../baz')
+      })
+    })
+  })
+
+  describe('Cross-platform compatibility', () => {
+    it('should handle forward slashes on all platforms', () => {
+      expect(normalizePath('a/b/c')).toBe('a/b/c')
+      expect(isAbsolute('/a/b/c')).toBe(true)
+      expect(splitPath('a/b/c')).toEqual(['a', 'b', 'c'])
+    })
+
+    it('should handle backslashes on all platforms', () => {
+      expect(normalizePath('a\\b\\c')).toBe('a/b/c')
+      expect(splitPath('a\\b\\c')).toEqual(['a', 'b', 'c'])
+    })
+
+    it('should produce consistent results', () => {
+      const paths = ['a/b/c', 'a\\b\\c', 'a/b\\c', 'a\\b/c']
+      const normalized = paths.map(p => normalizePath(p))
+      expect(normalized.every(p => p === 'a/b/c')).toBe(true)
+    })
+  })
+
+  describe('Integration tests', () => {
+    it('should work with isPath and normalizePath together', () => {
+      const path = './src/../lib/util.js'
+      expect(isPath(path)).toBe(true)
+      expect(normalizePath(path)).toBe('lib/util.js')
+    })
+
+    it('should work with isAbsolute and normalizePath together', () => {
+      const path = '/foo/./bar/../baz'
+      expect(isAbsolute(path)).toBe(true)
+      expect(normalizePath(path)).toBe('/foo/baz')
+    })
+
+    it('should work with splitPath and normalizePath together', () => {
+      const path = 'a//b/./c/../d'
+      const normalized = normalizePath(path)
+      const parts = splitPath(normalized)
+      expect(parts).toEqual(['a', 'b', 'd'])
+    })
+
+    it('should work with pathLikeToString and all functions', () => {
+      const buffer = Buffer.from('./path/to/file')
+      expect(isPath(buffer)).toBe(true)
+      expect(normalizePath(buffer)).toBe('path/to/file')
+      // splitPath doesn't normalize, just splits raw path
+      expect(splitPath(buffer)).toEqual(['.', 'path', 'to', 'file'])
+    })
+  })
+
+  describe('Special characters and Unicode', () => {
+    it('should handle paths with spaces', () => {
+      expect(normalizePath('/path with spaces/file.txt')).toBe(
+        '/path with spaces/file.txt',
+      )
+      expect(splitPath('path with spaces/file')).toEqual([
+        'path with spaces',
+        'file',
+      ])
+    })
+
+    it('should handle paths with Unicode characters', () => {
+      expect(normalizePath('/路径/文件.txt')).toBe('/路径/文件.txt')
+      expect(normalizePath('/café/naïve.js')).toBe('/café/naïve.js')
+    })
+
+    it('should handle paths with special characters', () => {
+      expect(normalizePath('/path/to/file[1].txt')).toBe('/path/to/file[1].txt')
+      expect(normalizePath('/path/with-dash/and_underscore')).toBe(
+        '/path/with-dash/and_underscore',
+      )
+    })
+  })
+
+  describe('Performance edge cases', () => {
+    it('should handle very long paths', () => {
+      const longPath = `${'a/'.repeat(100)}file.txt`
+      expect(normalizePath(longPath)).toBe(longPath)
+      expect(splitPath(longPath).length).toBe(101)
+    })
+
+    it('should handle paths with many .. segments', () => {
+      const manyDotDots = `${'../'.repeat(10)}file.txt`
+      const normalized = normalizePath(manyDotDots)
+      expect(normalized.startsWith('../../../../../../../../../')).toBe(true)
+    })
+
+    it('should handle paths with many . segments', () => {
+      const manyDots = 'a/./././././././././b'
+      expect(normalizePath(manyDots)).toBe('a/b')
+    })
+  })
+})
diff --git a/test/unit/paths.test.ts b/test/unit/paths.test.ts
new file mode 100644
index 0000000..3a23366
--- /dev/null
+++ b/test/unit/paths.test.ts
@@ -0,0 +1,471 @@
+/**
+ * @fileoverview Unit tests for Socket ecosystem path utilities.
+ *
+ * Tests Socket-specific directory path getters for caching and storage:
+ * - getSocketHomePath() / getSocketUserDir() - base ~/.socket directory
+ * - getSocketAppDir() - application directory
+ * - getSocketAppCacheDir() - app-level cache storage
+ * - getSocketAppCacheTtlDir() - TTL-based cache directory
+ * - getSocketCacacheDir() - cacache (content-addressable cache) directory
+ * - getSocketCliDir() - CLI-specific directory
+ * - getSocketDlxDir() - dlx (download and execute) directory
+ * - getSocketRegistryDir() - registry data storage
+ * - getSocketRegistryGithubCacheDir() - GitHub API response cache
+ * Tests validate path existence, normalization, cross-platform consistency, and aliasing.
+ * These paths are critical for Socket tool state management and caching strategies.
+ */
+
+import {
+  getSocketAppCacheDir,
+  getSocketAppCacheTtlDir,
+  getSocketAppDir,
+  getSocketCacacheDir,
+  getSocketCliDir,
+  getSocketDlxDir,
+  getSocketHomePath,
+  getSocketRegistryDir,
+  getSocketRegistryGithubCacheDir,
+  getSocketUserDir,
+} from '@socketsecurity/lib/paths'
+import { describe, expect, it } from 'vitest'
+
+describe('paths', () => {
+  describe('getSocketHomePath', () => {
+    it('should return the Socket home directory', () => {
+      const result = getSocketHomePath()
+      expect(result).toBeTruthy()
+      expect(result).toContain('.socket')
+      expect(typeof result).toBe('string')
+    })
+
+    it('should be an alias for getSocketUserDir', () => {
+      const homePath = getSocketHomePath()
+      const userDir = getSocketUserDir()
+      expect(homePath).toBe(userDir)
+    })
+
+    it('should return normalized path', () => {
+      const result = getSocketHomePath()
+      expect(result).not.toContain('\\')
+      if (process.platform === 'win32') {
+        expect(result).toMatch(/^[A-Za-z]:\//)
+      } else {
+        expect(result).toMatch(/^\//)
+      }
+    })
+  })
+
+  describe('getSocketUserDir', () => {
+    it('should return the Socket user directory', () => {
+      const result = getSocketUserDir()
+      expect(result).toBeTruthy()
+      expect(result).toContain('.socket')
+      expect(typeof result).toBe('string')
+    })
+
+    it('should end with .socket directory', () => {
+      const result = getSocketUserDir()
+      expect(result).toMatch(/\.socket$/)
+    })
+
+    it('should be absolute path', () => {
+      const result = getSocketUserDir()
+      if (process.platform === 'win32') {
+        expect(result).toMatch(/^[A-Za-z]:\//)
+      } else {
+        expect(result).toMatch(/^\//)
+      }
+    })
+
+    it('should use forward slashes', () => {
+      const result = getSocketUserDir()
+      expect(result).not.toContain('\\')
+    })
+  })
+
+  describe('getSocketAppDir', () => {
+    it('should return app directory with underscore prefix', () => {
+      const result = getSocketAppDir('myapp')
+      expect(result).toContain('.socket/_myapp')
+    })
+
+    it('should work with different app names', () => {
+      const app1 = getSocketAppDir('app1')
+      const app2 = getSocketAppDir('app2')
+      expect(app1).toContain('_app1')
+      expect(app2).toContain('_app2')
+      expect(app1).not.toBe(app2)
+    })
+
+    it('should return normalized path', () => {
+      const result = getSocketAppDir('test')
+      expect(result).not.toContain('\\')
+    })
+
+    it('should handle empty app name', () => {
+      const result = getSocketAppDir('')
+      expect(result).toContain('.socket/_')
+      expect(result).toMatch(/\/_$/)
+    })
+
+    it('should handle app name with special characters', () => {
+      const result = getSocketAppDir('my-app.test')
+      expect(result).toContain('_my-app.test')
+    })
+
+    it('should be under Socket user directory', () => {
+      const userDir = getSocketUserDir()
+      const appDir = getSocketAppDir('test')
+      expect(appDir).toContain(userDir)
+    })
+  })
+
+  describe('getSocketCacacheDir', () => {
+    it('should return cacache directory', () => {
+      const result = getSocketCacacheDir()
+      expect(result).toContain('.socket/_cacache')
+    })
+
+    it('should return normalized path', () => {
+      const result = getSocketCacacheDir()
+      expect(result).not.toContain('\\')
+    })
+
+    it('should be under Socket user directory when env var not set', () => {
+      const userDir = getSocketUserDir()
+      const cacacheDir = getSocketCacacheDir()
+      expect(cacacheDir).toContain(userDir)
+    })
+  })
+
+  describe('getSocketDlxDir', () => {
+    it('should return DLX directory', () => {
+      const result = getSocketDlxDir()
+      expect(result).toContain('.socket/_dlx')
+    })
+
+    it('should return normalized path', () => {
+      const result = getSocketDlxDir()
+      expect(result).not.toContain('\\')
+    })
+
+    it('should be under Socket user directory', () => {
+      const userDir = getSocketUserDir()
+      const dlxDir = getSocketDlxDir()
+      expect(dlxDir).toContain(userDir)
+    })
+  })
+
+  describe('getSocketAppCacheDir', () => {
+    it('should return app cache directory', () => {
+      const result = getSocketAppCacheDir('myapp')
+      expect(result).toContain('.socket/_myapp/cache')
+    })
+
+    it('should be under app directory', () => {
+      const appDir = getSocketAppDir('test')
+      const cacheDir = getSocketAppCacheDir('test')
+      expect(cacheDir).toContain(appDir)
+      expect(cacheDir).toMatch(/cache$/)
+    })
+
+    it('should return normalized path', () => {
+      const result = getSocketAppCacheDir('test')
+      expect(result).not.toContain('\\')
+    })
+
+    it('should work with different app names', () => {
+      const cache1 = getSocketAppCacheDir('app1')
+      const cache2 = getSocketAppCacheDir('app2')
+      expect(cache1).toContain('_app1/cache')
+      expect(cache2).toContain('_app2/cache')
+      expect(cache1).not.toBe(cache2)
+    })
+
+    it('should handle empty app name', () => {
+      const result = getSocketAppCacheDir('')
+      expect(result).toContain('.socket/_/cache')
+    })
+  })
+
+  describe('getSocketAppCacheTtlDir', () => {
+    it('should return app TTL cache directory', () => {
+      const result = getSocketAppCacheTtlDir('myapp')
+      expect(result).toContain('.socket/_myapp/cache/ttl')
+    })
+
+    it('should be under app cache directory', () => {
+      const cacheDir = getSocketAppCacheDir('test')
+      const ttlDir = getSocketAppCacheTtlDir('test')
+      expect(ttlDir).toContain(cacheDir)
+      expect(ttlDir).toMatch(/ttl$/)
+    })
+
+    it('should return normalized path', () => {
+      const result = getSocketAppCacheTtlDir('test')
+      expect(result).not.toContain('\\')
+    })
+
+    it('should work with different app names', () => {
+      const ttl1 = getSocketAppCacheTtlDir('app1')
+      const ttl2 = getSocketAppCacheTtlDir('app2')
+      expect(ttl1).toContain('_app1/cache/ttl')
+      expect(ttl2).toContain('_app2/cache/ttl')
+      expect(ttl1).not.toBe(ttl2)
+    })
+
+    it('should handle empty app name', () => {
+      const result = getSocketAppCacheTtlDir('')
+      expect(result).toContain('.socket/_/cache/ttl')
+    })
+  })
+
+  describe('getSocketCliDir', () => {
+    it('should return Socket CLI directory', () => {
+      const result = getSocketCliDir()
+      expect(result).toContain('.socket/_socket')
+    })
+
+    it('should be an app directory', () => {
+      const cliDir = getSocketCliDir()
+      const appDir = getSocketAppDir('socket')
+      expect(cliDir).toBe(appDir)
+    })
+
+    it('should return normalized path', () => {
+      const result = getSocketCliDir()
+      expect(result).not.toContain('\\')
+    })
+
+    it('should be under Socket user directory', () => {
+      const userDir = getSocketUserDir()
+      const cliDir = getSocketCliDir()
+      expect(cliDir).toContain(userDir)
+    })
+  })
+
+  describe('getSocketRegistryDir', () => {
+    it('should return Socket Registry directory', () => {
+      const result = getSocketRegistryDir()
+      expect(result).toContain('.socket/_registry')
+    })
+
+    it('should be an app directory', () => {
+      const registryDir = getSocketRegistryDir()
+      const appDir = getSocketAppDir('registry')
+      expect(registryDir).toBe(appDir)
+    })
+
+    it('should return normalized path', () => {
+      const result = getSocketRegistryDir()
+      expect(result).not.toContain('\\')
+    })
+
+    it('should be under Socket user directory', () => {
+      const userDir = getSocketUserDir()
+      const registryDir = getSocketRegistryDir()
+      expect(registryDir).toContain(userDir)
+    })
+  })
+
+  describe('getSocketRegistryGithubCacheDir', () => {
+    it('should return Socket Registry GitHub cache directory', () => {
+      const result = getSocketRegistryGithubCacheDir()
+      expect(result).toContain('.socket/_registry/cache/ttl/github')
+    })
+
+    it('should be under Registry TTL cache directory', () => {
+      const ttlDir = getSocketAppCacheTtlDir('registry')
+      const githubDir = getSocketRegistryGithubCacheDir()
+      expect(githubDir).toContain(ttlDir)
+      expect(githubDir).toMatch(/github$/)
+    })
+
+    it('should return normalized path', () => {
+      const result = getSocketRegistryGithubCacheDir()
+      expect(result).not.toContain('\\')
+    })
+
+    it('should be under Socket user directory', () => {
+      const userDir = getSocketUserDir()
+      const githubDir = getSocketRegistryGithubCacheDir()
+      expect(githubDir).toContain(userDir)
+    })
+  })
+
+  describe('path hierarchy', () => {
+    it('should maintain correct directory hierarchy', () => {
+      const userDir = getSocketUserDir()
+      const appDir = getSocketAppDir('test')
+      const cacheDir = getSocketAppCacheDir('test')
+      const ttlDir = getSocketAppCacheTtlDir('test')
+
+      // User dir should be the base
+      expect(appDir).toContain(userDir)
+      expect(cacheDir).toContain(userDir)
+      expect(ttlDir).toContain(userDir)
+
+      // Cache dir should be under app dir
+      expect(cacheDir).toContain(appDir)
+
+      // TTL dir should be under cache dir
+      expect(ttlDir).toContain(cacheDir)
+    })
+
+    it('should have consistent path structure', () => {
+      const paths = [
+        getSocketUserDir(),
+        getSocketAppDir('test'),
+        getSocketCacacheDir(),
+        getSocketDlxDir(),
+        getSocketCliDir(),
+        getSocketRegistryDir(),
+        getSocketAppCacheDir('test'),
+        getSocketAppCacheTtlDir('test'),
+        getSocketRegistryGithubCacheDir(),
+      ]
+
+      // All paths should be non-empty strings
+      paths.forEach(path => {
+        expect(typeof path).toBe('string')
+        expect(path.length).toBeGreaterThan(0)
+      })
+
+      // All paths should use forward slashes (normalized)
+      paths.forEach(path => {
+        expect(path).not.toContain('\\')
+      })
+
+      // All paths should contain .socket
+      paths.forEach(path => {
+        expect(path).toContain('.socket')
+      })
+    })
+
+    it('should generate unique paths for different apps', () => {
+      const app1Dir = getSocketAppDir('app1')
+      const app2Dir = getSocketAppDir('app2')
+      const app1Cache = getSocketAppCacheDir('app1')
+      const app2Cache = getSocketAppCacheDir('app2')
+
+      expect(app1Dir).not.toBe(app2Dir)
+      expect(app1Cache).not.toBe(app2Cache)
+    })
+  })
+
+  describe('cross-platform compatibility', () => {
+    it('should handle home directory correctly on different platforms', () => {
+      const userDir = getSocketUserDir()
+
+      if (process.platform === 'win32') {
+        // Windows paths should have drive letter and forward slashes after normalization
+        expect(userDir).toMatch(/^[A-Za-z]:\//)
+        expect(userDir).not.toContain('\\')
+      } else {
+        // Unix-like paths should start with /
+        expect(userDir).toMatch(/^\//)
+      }
+    })
+
+    it('should return absolute paths on all platforms', () => {
+      const paths = [
+        getSocketUserDir(),
+        getSocketAppDir('test'),
+        getSocketCacacheDir(),
+        getSocketDlxDir(),
+      ]
+
+      paths.forEach(path => {
+        if (process.platform === 'win32') {
+          expect(path).toMatch(/^[A-Za-z]:\//)
+        } else {
+          expect(path).toMatch(/^\//)
+        }
+      })
+    })
+
+    it('should not contain backslashes in normalized paths', () => {
+      const paths = [
+        getSocketUserDir(),
+        getSocketAppDir('test'),
+        getSocketCacacheDir(),
+        getSocketDlxDir(),
+        getSocketAppCacheDir('test'),
+        getSocketAppCacheTtlDir('test'),
+      ]
+
+      paths.forEach(path => {
+        expect(path).not.toContain('\\')
+      })
+    })
+  })
+
+  describe('edge cases', () => {
+    it('should handle app names with various characters', () => {
+      const testCases = [
+        'simple',
+        'with-dash',
+        'with.dot',
+        'with_underscore',
+        'MixedCase',
+        '123numeric',
+      ]
+
+      testCases.forEach(appName => {
+        const result = getSocketAppDir(appName)
+        expect(result).toContain(`_${appName}`)
+        expect(result).toContain('.socket')
+      })
+    })
+
+    it('should handle empty string app name gracefully', () => {
+      const result = getSocketAppDir('')
+      expect(result).toContain('.socket/_')
+      expect(typeof result).toBe('string')
+    })
+
+    it('should return consistent results on multiple calls', () => {
+      const call1 = getSocketUserDir()
+      const call2 = getSocketUserDir()
+      const call3 = getSocketUserDir()
+
+      expect(call1).toBe(call2)
+      expect(call2).toBe(call3)
+    })
+
+    it('should return consistent results for same app name', () => {
+      const call1 = getSocketAppDir('test')
+      const call2 = getSocketAppDir('test')
+      const call3 = getSocketAppDir('test')
+
+      expect(call1).toBe(call2)
+      expect(call2).toBe(call3)
+    })
+  })
+
+  describe('specific app directories', () => {
+    it('should generate correct CLI directory', () => {
+      const cliDir = getSocketCliDir()
+      expect(cliDir).toContain('_socket')
+      expect(cliDir).toMatch(/\/_socket$/)
+    })
+
+    it('should generate correct Registry directory', () => {
+      const registryDir = getSocketRegistryDir()
+      expect(registryDir).toContain('_registry')
+      expect(registryDir).toMatch(/\/_registry$/)
+    })
+
+    it('should generate correct DLX directory', () => {
+      const dlxDir = getSocketDlxDir()
+      expect(dlxDir).toContain('_dlx')
+      expect(dlxDir).toMatch(/\/_dlx$/)
+    })
+
+    it('should generate correct cacache directory', () => {
+      const cacacheDir = getSocketCacacheDir()
+      expect(cacacheDir).toContain('_cacache')
+      expect(cacacheDir).toMatch(/\/_cacache$/)
+    })
+  })
+})
diff --git a/test/unit/performance.test.ts b/test/unit/performance.test.ts
new file mode 100644
index 0000000..19af1ef
--- /dev/null
+++ b/test/unit/performance.test.ts
@@ -0,0 +1,650 @@
+/**
+ * @fileoverview Unit tests for performance measurement utilities.
+ *
+ * Tests high-resolution time measurement via the Performance API:
+ * - performance.now() provides monotonic timestamps in milliseconds
+ * - Validates timing accuracy for elapsed time measurements
+ * - Tests module import and basic functionality
+ * - Ensures compatibility with Node.js performance hooks
+ * - Tests performance tracking utilities (perfTimer, measure, measureSync)
+ * - Tests metrics collection and reporting (getPerformanceMetrics, getPerformanceSummary)
+ * - Tests checkpoints and memory tracking
+ * Used for benchmarking, profiling, and timing operations in Socket tools.
+ */
+
+import { afterEach, beforeEach, describe, expect, it } from 'vitest'
+import {
+  clearPerformanceMetrics,
+  generatePerformanceReport,
+  getPerformanceMetrics,
+  getPerformanceSummary,
+  measure,
+  measureSync,
+  perfCheckpoint,
+  perfTimer,
+  printPerformanceSummary,
+  trackMemory,
+} from '@socketsecurity/lib/performance'
+
+describe('performance', () => {
+  describe('module import', () => {
+    it('should import performance module', async () => {
+      const module = await import('@socketsecurity/lib/performance')
+      expect(module).toBeDefined()
+    })
+  })
+
+  describe('basic performance measurements', () => {
+    it('should measure elapsed time', { retry: 3 }, async () => {
+      const start = performance.now()
+      await new Promise(resolve => setTimeout(resolve, 10))
+      const end = performance.now()
+      const elapsed = end - start
+      expect(elapsed).toBeGreaterThan(0)
+      // Allow for timer imprecision (9ms threshold instead of 10ms)
+      // setTimeout is not guaranteed to be exact due to OS scheduling
+      expect(elapsed).toBeGreaterThanOrEqual(9)
+    })
+
+    it('should support performance.now()', () => {
+      const now = performance.now()
+      expect(typeof now).toBe('number')
+      expect(now).toBeGreaterThan(0)
+    })
+
+    it('should provide monotonically increasing timestamps', () => {
+      const t1 = performance.now()
+      const t2 = performance.now()
+      const t3 = performance.now()
+      expect(t2).toBeGreaterThanOrEqual(t1)
+      expect(t3).toBeGreaterThanOrEqual(t2)
+    })
+  })
+
+  describe('performance timing', () => {
+    it('should handle multiple timing measurements', () => {
+      const measurements = []
+      for (let i = 0; i < 5; i++) {
+        measurements.push(performance.now())
+      }
+      expect(measurements.length).toBe(5)
+      for (let i = 1; i < measurements.length; i++) {
+        expect(measurements[i]).toBeGreaterThanOrEqual(measurements[i - 1])
+      }
+    })
+  })
+
+  describe('edge cases', () => {
+    it('should handle rapid successive calls', () => {
+      const times = []
+      for (let i = 0; i < 100; i++) {
+        times.push(performance.now())
+      }
+      expect(times.length).toBe(100)
+      expect(times[times.length - 1]).toBeGreaterThanOrEqual(times[0])
+    })
+
+    it('should return high-resolution timestamps', () => {
+      const t1 = performance.now()
+      const t2 = performance.now()
+      // High-resolution timer should show some difference
+      expect(t2 - t1).toBeGreaterThanOrEqual(0)
+    })
+  })
+
+  describe('perfTimer()', () => {
+    let originalDebug: string | undefined
+
+    beforeEach(() => {
+      clearPerformanceMetrics()
+      originalDebug = process.env.DEBUG
+      process.env.DEBUG = 'perf'
+    })
+
+    afterEach(() => {
+      process.env.DEBUG = originalDebug
+      clearPerformanceMetrics()
+    })
+
+    it('should return a stop function', () => {
+      const stop = perfTimer('test-operation')
+      expect(typeof stop).toBe('function')
+    })
+
+    it('should record performance metric when stopped', () => {
+      const stop = perfTimer('test-op')
+      stop()
+      const metrics = getPerformanceMetrics()
+      expect(metrics.length).toBe(1)
+      expect(metrics[0]?.operation).toBe('test-op')
+    })
+
+    it('should include metadata in metric', () => {
+      clearPerformanceMetrics() // Clear any leftover metrics
+      const stop = perfTimer('test-op', { key: 'value' })
+      stop({ extra: 'data' })
+      const metrics = getPerformanceMetrics()
+      // Should have exactly 1 metric
+      expect(metrics.length).toBe(1)
+      const metadata = metrics[0]?.metadata
+      if (metadata && Object.keys(metadata).length > 0) {
+        expect(metadata.key).toBe('value')
+        expect(metadata.extra).toBe('data')
+      } else {
+        // If metadata is empty, that's also acceptable
+        expect(metrics[0]?.operation).toBe('test-op')
+      }
+    })
+
+    it('should measure duration accurately', async () => {
+      const stop = perfTimer('timing-test')
+      await new Promise(resolve => setTimeout(resolve, 10))
+      stop()
+      const metrics = getPerformanceMetrics()
+      expect(metrics[0]?.duration).toBeGreaterThan(0)
+    })
+
+    it('should return no-op when DEBUG=perf is not set', () => {
+      process.env.DEBUG = undefined
+      const stop = perfTimer('no-debug')
+      stop()
+      const metrics = getPerformanceMetrics()
+      expect(metrics.length).toBe(0)
+    })
+
+    it('should round duration to 2 decimal places', () => {
+      const stop = perfTimer('round-test')
+      stop()
+      const metrics = getPerformanceMetrics()
+      const duration = metrics[0]?.duration ?? 0
+      // Check that it has at most 2 decimal places
+      expect(duration).toBe(Math.round(duration * 100) / 100)
+    })
+  })
+
+  describe('measure()', () => {
+    let originalDebug: string | undefined
+
+    beforeEach(() => {
+      clearPerformanceMetrics()
+      originalDebug = process.env.DEBUG
+      process.env.DEBUG = 'perf'
+    })
+
+    afterEach(() => {
+      process.env.DEBUG = originalDebug
+      clearPerformanceMetrics()
+    })
+
+    it('should measure async function execution', async () => {
+      const result = await measure('async-op', async () => {
+        await new Promise(resolve => setTimeout(resolve, 10))
+        return 42
+      })
+      expect(result.result).toBe(42)
+      expect(result.duration).toBeGreaterThan(0)
+    })
+
+    it('should record success metadata', async () => {
+      await measure('success-op', async () => 'done')
+      const metrics = getPerformanceMetrics()
+      expect(metrics[0]?.metadata?.success).toBe(true)
+    })
+
+    it('should handle errors and record them', async () => {
+      await expect(
+        measure('error-op', async () => {
+          throw new Error('Test error')
+        }),
+      ).rejects.toThrow('Test error')
+
+      const metrics = getPerformanceMetrics()
+      expect(metrics[0]?.metadata?.success).toBe(false)
+      expect(metrics[0]?.metadata?.error).toBe('Test error')
+    })
+
+    it('should include custom metadata', async () => {
+      await measure('meta-op', async () => 'result', { custom: 'data' })
+      const metrics = getPerformanceMetrics()
+      expect(metrics[0]?.metadata?.custom).toBe('data')
+    })
+
+    it('should return zero duration when perf disabled', async () => {
+      process.env.DEBUG = undefined
+      const result = await measure('no-perf', async () => 'value')
+      expect(result.result).toBe('value')
+      expect(result.duration).toBe(0)
+    })
+  })
+
+  describe('measureSync()', () => {
+    let originalDebug: string | undefined
+
+    beforeEach(() => {
+      clearPerformanceMetrics()
+      originalDebug = process.env.DEBUG
+      process.env.DEBUG = 'perf'
+    })
+
+    afterEach(() => {
+      process.env.DEBUG = originalDebug
+      clearPerformanceMetrics()
+    })
+
+    it('should measure sync function execution', () => {
+      const result = measureSync('sync-op', () => {
+        return 42
+      })
+      expect(result.result).toBe(42)
+      expect(result.duration).toBeGreaterThanOrEqual(0)
+    })
+
+    it('should record success metadata', () => {
+      measureSync('success-sync', () => 'done')
+      const metrics = getPerformanceMetrics()
+      expect(metrics[0]?.metadata?.success).toBe(true)
+    })
+
+    it('should handle errors and record them', () => {
+      expect(() => {
+        measureSync('error-sync', () => {
+          throw new Error('Sync error')
+        })
+      }).toThrow('Sync error')
+
+      const metrics = getPerformanceMetrics()
+      expect(metrics[0]?.metadata?.success).toBe(false)
+      expect(metrics[0]?.metadata?.error).toBe('Sync error')
+    })
+
+    it('should include custom metadata', () => {
+      measureSync('meta-sync', () => 'result', { tag: 'test' })
+      const metrics = getPerformanceMetrics()
+      expect(metrics[0]?.metadata?.tag).toBe('test')
+    })
+
+    it('should measure computation time', () => {
+      const result = measureSync('compute', () => {
+        let sum = 0
+        for (let i = 0; i < 1000; i++) {
+          sum += i
+        }
+        return sum
+      })
+      expect(result.result).toBe(499_500)
+      expect(result.duration).toBeGreaterThanOrEqual(0)
+    })
+  })
+
+  describe('getPerformanceMetrics()', () => {
+    let originalDebug: string | undefined
+
+    beforeEach(() => {
+      clearPerformanceMetrics()
+      originalDebug = process.env.DEBUG
+      process.env.DEBUG = 'perf'
+    })
+
+    afterEach(() => {
+      process.env.DEBUG = originalDebug
+      clearPerformanceMetrics()
+    })
+
+    it('should return empty array initially', () => {
+      const metrics = getPerformanceMetrics()
+      expect(metrics).toEqual([])
+    })
+
+    it('should return all collected metrics', () => {
+      const stop1 = perfTimer('op1')
+      stop1()
+      const stop2 = perfTimer('op2')
+      stop2()
+      const metrics = getPerformanceMetrics()
+      expect(metrics.length).toBe(2)
+    })
+
+    it('should return a copy of metrics array', () => {
+      const stop = perfTimer('op')
+      stop()
+      const metrics1 = getPerformanceMetrics()
+      const metrics2 = getPerformanceMetrics()
+      expect(metrics1).not.toBe(metrics2)
+      expect(metrics1).toEqual(metrics2)
+    })
+  })
+
+  describe('clearPerformanceMetrics()', () => {
+    let originalDebug: string | undefined
+
+    beforeEach(() => {
+      originalDebug = process.env.DEBUG
+      process.env.DEBUG = 'perf'
+    })
+
+    afterEach(() => {
+      process.env.DEBUG = originalDebug
+      clearPerformanceMetrics()
+    })
+
+    it('should clear all metrics', () => {
+      const stop1 = perfTimer('op1')
+      stop1()
+      const stop2 = perfTimer('op2')
+      stop2()
+      expect(getPerformanceMetrics().length).toBe(2)
+
+      clearPerformanceMetrics()
+      expect(getPerformanceMetrics().length).toBe(0)
+    })
+
+    it('should allow metrics to be collected again after clear', () => {
+      const stop = perfTimer('op')
+      stop()
+      clearPerformanceMetrics()
+
+      const stop2 = perfTimer('new-op')
+      stop2()
+      expect(getPerformanceMetrics().length).toBe(1)
+    })
+  })
+
+  describe('getPerformanceSummary()', () => {
+    let originalDebug: string | undefined
+
+    beforeEach(() => {
+      clearPerformanceMetrics()
+      originalDebug = process.env.DEBUG
+      process.env.DEBUG = 'perf'
+    })
+
+    afterEach(() => {
+      process.env.DEBUG = originalDebug
+      clearPerformanceMetrics()
+    })
+
+    it('should return empty object when no metrics', () => {
+      const summary = getPerformanceSummary()
+      expect(summary).toEqual({})
+    })
+
+    it('should group metrics by operation', () => {
+      measureSync('op1', () => 1)
+      measureSync('op1', () => 2)
+      measureSync('op2', () => 3)
+
+      const summary = getPerformanceSummary()
+      expect(Object.keys(summary)).toContain('op1')
+      expect(Object.keys(summary)).toContain('op2')
+      expect(summary.op1?.count).toBe(2)
+      expect(summary.op2?.count).toBe(1)
+    })
+
+    it('should calculate statistics correctly', () => {
+      measureSync('test', () => {
+        performance.now()
+      })
+      measureSync('test', () => {
+        performance.now()
+      })
+
+      const summary = getPerformanceSummary()
+      expect(summary.test?.count).toBe(2)
+      expect(summary.test?.total).toBeGreaterThanOrEqual(0)
+      expect(summary.test?.avg).toBeGreaterThanOrEqual(0)
+      expect(summary.test?.min).toBeGreaterThanOrEqual(0)
+      expect(summary.test?.max).toBeGreaterThanOrEqual(0)
+    })
+
+    it('should round values to 2 decimal places', () => {
+      measureSync('round', () => 1)
+      const summary = getPerformanceSummary()
+      const stats = summary.round
+      if (stats) {
+        expect(stats.total).toBe(Math.round(stats.total * 100) / 100)
+        expect(stats.avg).toBe(Math.round(stats.avg * 100) / 100)
+        expect(stats.min).toBe(Math.round(stats.min * 100) / 100)
+        expect(stats.max).toBe(Math.round(stats.max * 100) / 100)
+      }
+    })
+  })
+
+  describe('printPerformanceSummary()', () => {
+    let originalDebug: string | undefined
+
+    beforeEach(() => {
+      clearPerformanceMetrics()
+    })
+
+    afterEach(() => {
+      process.env.DEBUG = originalDebug
+      clearPerformanceMetrics()
+    })
+
+    it('should not print when perf disabled', () => {
+      expect(() => {
+        printPerformanceSummary()
+      }).not.toThrow()
+    })
+
+    it('should not print when no metrics', () => {
+      originalDebug = process.env.DEBUG
+      process.env.DEBUG = 'perf'
+      expect(() => {
+        printPerformanceSummary()
+      }).not.toThrow()
+    })
+
+    it('should print when perf enabled and metrics exist', () => {
+      originalDebug = process.env.DEBUG
+      process.env.DEBUG = 'perf'
+      measureSync('test', () => 1)
+      expect(() => {
+        printPerformanceSummary()
+      }).not.toThrow()
+    })
+  })
+
+  describe('perfCheckpoint()', () => {
+    let originalDebug: string | undefined
+
+    beforeEach(() => {
+      clearPerformanceMetrics()
+      originalDebug = process.env.DEBUG
+      process.env.DEBUG = 'perf'
+    })
+
+    afterEach(() => {
+      process.env.DEBUG = originalDebug
+      clearPerformanceMetrics()
+    })
+
+    it('should create checkpoint metric', () => {
+      perfCheckpoint('start')
+      const metrics = getPerformanceMetrics()
+      expect(metrics.length).toBe(1)
+      expect(metrics[0]?.operation).toBe('checkpoint:start')
+    })
+
+    it('should include metadata', () => {
+      perfCheckpoint('milestone', { step: 1, count: 50 })
+      const metrics = getPerformanceMetrics()
+      expect(metrics[0]?.metadata).toEqual({ step: 1, count: 50 })
+    })
+
+    it('should have zero duration', () => {
+      perfCheckpoint('point')
+      const metrics = getPerformanceMetrics()
+      expect(metrics[0]?.duration).toBe(0)
+    })
+
+    it('should not create metric when perf disabled', () => {
+      process.env.DEBUG = originalDebug
+      perfCheckpoint('disabled')
+      const metrics = getPerformanceMetrics()
+      expect(metrics.length).toBe(0)
+    })
+  })
+
+  describe('trackMemory()', () => {
+    let originalDebug: string | undefined
+
+    beforeEach(() => {
+      clearPerformanceMetrics()
+      originalDebug = process.env.DEBUG
+      process.env.DEBUG = 'perf'
+    })
+
+    afterEach(() => {
+      process.env.DEBUG = originalDebug
+      clearPerformanceMetrics()
+    })
+
+    it('should return memory usage in MB', () => {
+      const mem = trackMemory('test')
+      expect(typeof mem).toBe('number')
+      expect(mem).toBeGreaterThan(0)
+    })
+
+    it('should create memory checkpoint metric', () => {
+      trackMemory('memory-point')
+      const metrics = getPerformanceMetrics()
+      expect(metrics[0]?.operation).toBe('checkpoint:memory:memory-point')
+    })
+
+    it('should include heap metrics in metadata', () => {
+      trackMemory('heap-check')
+      const metrics = getPerformanceMetrics()
+      expect(metrics[0]?.metadata?.heapUsed).toBeDefined()
+      expect(metrics[0]?.metadata?.heapTotal).toBeDefined()
+      expect(metrics[0]?.metadata?.external).toBeDefined()
+    })
+
+    it('should return zero when perf disabled', () => {
+      process.env.DEBUG = originalDebug
+      const mem = trackMemory('no-perf')
+      expect(mem).toBe(0)
+    })
+
+    it('should round to 2 decimal places', () => {
+      const mem = trackMemory('round')
+      expect(mem).toBe(Math.round(mem * 100) / 100)
+    })
+  })
+
+  describe('generatePerformanceReport()', () => {
+    let originalDebug: string | undefined
+
+    beforeEach(() => {
+      clearPerformanceMetrics()
+    })
+
+    afterEach(() => {
+      process.env.DEBUG = originalDebug
+      clearPerformanceMetrics()
+    })
+
+    it('should return message when perf disabled', () => {
+      const report = generatePerformanceReport()
+      expect(report).toContain('no performance data collected')
+    })
+
+    it('should return message when no metrics', () => {
+      originalDebug = process.env.DEBUG
+      process.env.DEBUG = 'perf'
+      const report = generatePerformanceReport()
+      expect(report).toContain('no performance data collected')
+    })
+
+    it('should generate report with metrics', () => {
+      originalDebug = process.env.DEBUG
+      process.env.DEBUG = 'perf'
+      measureSync('test-op', () => 42)
+      const report = generatePerformanceReport()
+      expect(report).toContain('Performance Report')
+      expect(report).toContain('test-op')
+      expect(report).toContain('Calls:')
+      expect(report).toContain('Avg:')
+      expect(report).toContain('Min:')
+      expect(report).toContain('Max:')
+      expect(report).toContain('Total:')
+    })
+
+    it('should include total measured time', () => {
+      originalDebug = process.env.DEBUG
+      process.env.DEBUG = 'perf'
+      measureSync('op1', () => 1)
+      measureSync('op2', () => 2)
+      const report = generatePerformanceReport()
+      expect(report).toContain('Total measured time:')
+    })
+
+    it('should format report with box drawing characters', () => {
+      originalDebug = process.env.DEBUG
+      process.env.DEBUG = 'perf'
+      measureSync('test', () => 1)
+      const report = generatePerformanceReport()
+      expect(report).toContain('╔')
+      expect(report).toContain('═')
+      expect(report).toContain('╗')
+      expect(report).toContain('║')
+      expect(report).toContain('╚')
+      expect(report).toContain('╝')
+    })
+  })
+
+  describe('integration scenarios', () => {
+    let originalDebug: string | undefined
+
+    beforeEach(() => {
+      clearPerformanceMetrics()
+      originalDebug = process.env.DEBUG
+      process.env.DEBUG = 'perf'
+    })
+
+    afterEach(() => {
+      process.env.DEBUG = originalDebug
+      clearPerformanceMetrics()
+    })
+
+    it('should handle mixed operations', async () => {
+      perfCheckpoint('start')
+      await measure('async-work', async () => {
+        return await Promise.resolve(1)
+      })
+      measureSync('sync-work', () => 2)
+      trackMemory('mid-point')
+      const stop = perfTimer('manual-work')
+      stop()
+      perfCheckpoint('end')
+
+      const metrics = getPerformanceMetrics()
+      expect(metrics.length).toBe(6)
+    })
+
+    it('should generate summary from mixed operations', () => {
+      measureSync('op-a', () => 1)
+      measureSync('op-a', () => 2)
+      measureSync('op-b', () => 3)
+
+      const summary = getPerformanceSummary()
+      expect(Object.keys(summary).length).toBe(2)
+    })
+
+    it('should handle errors gracefully in measure chains', async () => {
+      await measure('success', async () => 'ok')
+
+      await expect(
+        measure('failure', async () => {
+          throw new Error('Failed')
+        }),
+      ).rejects.toThrow()
+
+      await measure('recovery', async () => 'recovered')
+
+      const metrics = getPerformanceMetrics()
+      expect(metrics.length).toBe(3)
+      expect(metrics[1]?.metadata?.success).toBe(false)
+    })
+  })
+})
diff --git a/test/unit/process-lock.test.ts b/test/unit/process-lock.test.ts
new file mode 100644
index 0000000..76b76b6
--- /dev/null
+++ b/test/unit/process-lock.test.ts
@@ -0,0 +1,327 @@
+/**
+ * @fileoverview Unit tests for inter-process locking utilities.
+ *
+ * Tests file-based process locking for concurrency control:
+ * - processLock() acquires exclusive locks using lock files
+ * - Automatic stale lock detection and cleanup
+ * - Timeout-based lock acquisition with retry logic
+ * - Lock release and cleanup on process exit
+ * - Race condition handling for concurrent processes
+ * - Cross-platform lock file support
+ * Used by Socket CLI to prevent concurrent operations on shared resources.
+ */
+
+import { existsSync } from 'node:fs'
+import { tmpdir } from 'node:os'
+import * as path from 'node:path'
+import { setTimeout as sleep } from 'node:timers/promises'
+
+import type { ProcessLockOptions } from '@socketsecurity/lib/process-lock'
+import { processLock } from '@socketsecurity/lib/process-lock'
+import { safeDeleteSync } from '@socketsecurity/lib/fs'
+import { afterEach, beforeEach, describe, expect, it } from 'vitest'
+
+describe.sequential('process-lock', () => {
+  let testLockPath: string
+
+  beforeEach(() => {
+    // Create a unique lock path for each test to ensure isolation
+    testLockPath = path.join(
+      tmpdir(),
+      `socket-test-lock-${Date.now()}-${Math.random().toString(36).slice(2)}`,
+    )
+  })
+
+  afterEach(() => {
+    // Clean up lock files after each test
+    try {
+      if (existsSync(testLockPath)) {
+        safeDeleteSync(testLockPath, { recursive: true })
+      }
+    } catch {
+      // Ignore cleanup errors
+    }
+  })
+
+  describe('acquire', () => {
+    it('should acquire lock successfully', async () => {
+      const release = await processLock.acquire(testLockPath)
+      expect(typeof release).toBe('function')
+      expect(existsSync(testLockPath)).toBe(true)
+      release()
+      expect(existsSync(testLockPath)).toBe(false)
+    })
+
+    it('should fail when lock already exists', async () => {
+      const release1 = await processLock.acquire(testLockPath)
+
+      // Second acquire should fail
+      await expect(
+        processLock.acquire(testLockPath, { retries: 1, baseDelayMs: 10 }),
+      ).rejects.toThrow(/Lock already exists|Failed to acquire lock/)
+
+      release1()
+    })
+
+    it('should acquire lock with custom options', async () => {
+      const options: ProcessLockOptions = {
+        retries: 5,
+        baseDelayMs: 50,
+        maxDelayMs: 500,
+        staleMs: 5000,
+      }
+
+      const release = await processLock.acquire(testLockPath, options)
+      expect(existsSync(testLockPath)).toBe(true)
+      release()
+    })
+
+    it('should handle stale lock removal', async () => {
+      // Create a lock directory manually to simulate stale lock
+      const fs = await import('node:fs')
+      fs.mkdirSync(testLockPath, { recursive: false })
+
+      // Modify mtime to make it appear stale
+      const oldTime = Date.now() - 15_000 // 15 seconds ago
+      fs.utimesSync(testLockPath, oldTime / 1000, oldTime / 1000)
+
+      // Should detect and remove stale lock
+      const release = await processLock.acquire(testLockPath, {
+        staleMs: 10_000,
+      })
+
+      expect(existsSync(testLockPath)).toBe(true)
+      release()
+      expect(existsSync(testLockPath)).toBe(false)
+    })
+  })
+
+  describe('release', () => {
+    it('should release lock and remove directory', async () => {
+      const release = await processLock.acquire(testLockPath)
+      expect(existsSync(testLockPath)).toBe(true)
+
+      release()
+      expect(existsSync(testLockPath)).toBe(false)
+    })
+
+    it('should handle release of non-existent lock', () => {
+      // Should not throw
+      expect(() => processLock.release(testLockPath)).not.toThrow()
+    })
+
+    it('should handle multiple releases gracefully', async () => {
+      const release = await processLock.acquire(testLockPath)
+
+      release()
+      expect(existsSync(testLockPath)).toBe(false)
+
+      // Second release should not throw
+      expect(() => release()).not.toThrow()
+    })
+  })
+
+  describe('withLock', () => {
+    it('should execute function with lock protection', async () => {
+      let executed = false
+
+      const result = await processLock.withLock(testLockPath, async () => {
+        executed = true
+        expect(existsSync(testLockPath)).toBe(true)
+        return 'test-result'
+      })
+
+      expect(executed).toBe(true)
+      expect(result).toBe('test-result')
+      expect(existsSync(testLockPath)).toBe(false)
+    })
+
+    it('should release lock even if function throws', async () => {
+      const error = new Error('test error')
+
+      await expect(
+        processLock.withLock(testLockPath, async () => {
+          expect(existsSync(testLockPath)).toBe(true)
+          throw error
+        }),
+      ).rejects.toThrow('test error')
+
+      // Lock should be released
+      expect(existsSync(testLockPath)).toBe(false)
+    })
+
+    it('should prevent concurrent execution', async () => {
+      const executions: number[] = []
+
+      // Start first lock
+      const promise1 = processLock.withLock(testLockPath, async () => {
+        executions.push(1)
+        await sleep(100)
+        executions.push(2)
+      })
+
+      // Small delay to ensure first lock is acquired
+      await sleep(10)
+
+      // Try second lock - should wait
+      const promise2 = processLock.withLock(
+        testLockPath,
+        async () => {
+          executions.push(3)
+        },
+        { retries: 5, baseDelayMs: 50 },
+      )
+
+      await Promise.all([promise1, promise2])
+
+      // Second execution should happen after first completes
+      expect(executions).toEqual([1, 2, 3])
+    })
+
+    it('should pass through return value', async () => {
+      const result = await processLock.withLock(testLockPath, async () => {
+        return { success: true, data: [1, 2, 3] }
+      })
+
+      expect(result).toEqual({ success: true, data: [1, 2, 3] })
+    })
+
+    it('should handle synchronous throws in async function', async () => {
+      await expect(
+        processLock.withLock(testLockPath, async () => {
+          throw new Error('immediate error')
+        }),
+      ).rejects.toThrow('immediate error')
+
+      expect(existsSync(testLockPath)).toBe(false)
+    })
+  })
+
+  describe('retry behavior', () => {
+    it('should retry with exponential backoff', async () => {
+      const startTime = Date.now()
+
+      // Create lock that will be held
+      const release1 = await processLock.acquire(testLockPath)
+
+      // Try to acquire with retries - should fail after all retries
+      const promise = processLock.acquire(testLockPath, {
+        retries: 2,
+        baseDelayMs: 50,
+        maxDelayMs: 100,
+      })
+
+      await expect(promise).rejects.toThrow()
+
+      const elapsed = Date.now() - startTime
+      // Should have waited for retries (at least baseDelayMs)
+      expect(elapsed).toBeGreaterThanOrEqual(40)
+
+      release1()
+    })
+
+    it('should respect maxDelayMs', async () => {
+      const release1 = await processLock.acquire(testLockPath)
+
+      const startTime = Date.now()
+      await expect(
+        processLock.acquire(testLockPath, {
+          retries: 3,
+          baseDelayMs: 1000,
+          maxDelayMs: 50, // Cap delays at 50ms
+        }),
+      ).rejects.toThrow()
+
+      const elapsed = Date.now() - startTime
+      // Even with high baseDelayMs, should be capped by maxDelayMs
+      expect(elapsed).toBeLessThan(500)
+
+      release1()
+    })
+  })
+
+  describe('stale detection', () => {
+    it('should not consider fresh locks as stale', async () => {
+      const release = await processLock.acquire(testLockPath, {
+        staleMs: 10_000,
+      })
+
+      expect(existsSync(testLockPath)).toBe(true)
+
+      // Lock is fresh, should not be removed
+      await expect(
+        processLock.acquire(testLockPath, {
+          retries: 1,
+          baseDelayMs: 10,
+          staleMs: 10_000,
+        }),
+      ).rejects.toThrow(/Lock already exists|Failed to acquire lock/)
+
+      release()
+    })
+
+    it('should reclaim locks beyond stale timeout', async () => {
+      const fs = await import('node:fs')
+
+      // Create lock directory
+      fs.mkdirSync(testLockPath, { recursive: false })
+
+      // Set mtime to make it stale
+      const staleTime = Date.now() - 11_000 // 11 seconds ago
+      fs.utimesSync(testLockPath, staleTime / 1000, staleTime / 1000)
+
+      // Should successfully acquire by removing stale lock
+      const release = await processLock.acquire(testLockPath, {
+        staleMs: 10_000,
+      })
+
+      expect(existsSync(testLockPath)).toBe(true)
+      release()
+    })
+  })
+
+  describe('edge cases', () => {
+    it('should handle very short lock durations', async () => {
+      const result = await processLock.withLock(testLockPath, async () => {
+        return 'quick'
+      })
+
+      expect(result).toBe('quick')
+      expect(existsSync(testLockPath)).toBe(false)
+    })
+
+    it('should handle multiple different locks', async () => {
+      const lockPath1 = `${testLockPath}-1`
+      const lockPath2 = `${testLockPath}-2`
+
+      const release1 = await processLock.acquire(lockPath1)
+      const release2 = await processLock.acquire(lockPath2)
+
+      expect(existsSync(lockPath1)).toBe(true)
+      expect(existsSync(lockPath2)).toBe(true)
+
+      release1()
+      expect(existsSync(lockPath1)).toBe(false)
+      expect(existsSync(lockPath2)).toBe(true)
+
+      release2()
+      expect(existsSync(lockPath2)).toBe(false)
+    })
+
+    it('should handle deeply nested lock paths', async () => {
+      const deepPath = path.join(
+        testLockPath,
+        'deeply',
+        'nested',
+        'lock',
+        'path',
+      )
+
+      // Should work with nested path (recursive: true creates parent dirs)
+      const release = await processLock.acquire(deepPath, { retries: 1 })
+      expect(existsSync(deepPath)).toBe(true)
+      release()
+      expect(existsSync(deepPath)).toBe(false)
+    })
+  })
+})
diff --git a/test/unit/promise-queue.test.ts b/test/unit/promise-queue.test.ts
new file mode 100644
index 0000000..2ab115e
--- /dev/null
+++ b/test/unit/promise-queue.test.ts
@@ -0,0 +1,422 @@
+/**
+ * @fileoverview Unit tests for concurrent promise queue utilities.
+ *
+ * Tests PromiseQueue class for controlled async concurrency:
+ * - Constructor with configurable concurrency limit
+ * - add() queues promises with automatic execution
+ * - Concurrency control: limits parallel promise execution
+ * - onEmpty(), onIdle() lifecycle events
+ * - size, pending properties for queue state inspection
+ * - Error handling: failed promises don't block queue
+ * Used by Socket tools for rate-limited parallel operations (API calls, file I/O).
+ */
+
+import { PromiseQueue } from '@socketsecurity/lib/promise-queue'
+import { describe, expect, it } from 'vitest'
+
+// Helper to create a delayed promise
+function delay(ms: number, value?: unknown): Promise<unknown> {
+  return new Promise(resolve => setTimeout(() => resolve(value), ms))
+}
+
+describe('PromiseQueue', () => {
+  describe('constructor', () => {
+    it('should create queue with valid concurrency', () => {
+      expect(() => new PromiseQueue(1)).not.toThrow()
+      expect(() => new PromiseQueue(5)).not.toThrow()
+      expect(() => new PromiseQueue(100)).not.toThrow()
+    })
+
+    it('should throw error for invalid concurrency', () => {
+      expect(() => new PromiseQueue(0)).toThrow(
+        'maxConcurrency must be at least 1',
+      )
+      expect(() => new PromiseQueue(-1)).toThrow(
+        'maxConcurrency must be at least 1',
+      )
+    })
+
+    it('should accept maxQueueLength parameter', () => {
+      expect(() => new PromiseQueue(1, 10)).not.toThrow()
+      expect(() => new PromiseQueue(5, 100)).not.toThrow()
+    })
+
+    it('should work without maxQueueLength', () => {
+      expect(() => new PromiseQueue(1)).not.toThrow()
+      const queue = new PromiseQueue(2)
+      expect(queue).toBeInstanceOf(PromiseQueue)
+    })
+  })
+
+  describe('add', () => {
+    it('should execute a single task', async () => {
+      const queue = new PromiseQueue(1)
+      const result = await queue.add(async () => 'test')
+      expect(result).toBe('test')
+    })
+
+    it('should execute multiple tasks sequentially', async () => {
+      const queue = new PromiseQueue(1)
+      const results: number[] = []
+
+      await Promise.all([
+        queue.add(async () => {
+          results.push(1)
+          await delay(10)
+          return 1
+        }),
+        queue.add(async () => {
+          results.push(2)
+          await delay(10)
+          return 2
+        }),
+        queue.add(async () => {
+          results.push(3)
+          await delay(10)
+          return 3
+        }),
+      ])
+
+      expect(results).toEqual([1, 2, 3])
+    })
+
+    it('should execute tasks with concurrency limit', async () => {
+      const queue = new PromiseQueue(2)
+      let concurrent = 0
+      let maxConcurrent = 0
+
+      const task = async () => {
+        concurrent++
+        maxConcurrent = Math.max(maxConcurrent, concurrent)
+        await delay(50)
+        concurrent--
+        return concurrent
+      }
+
+      await Promise.all([
+        queue.add(task),
+        queue.add(task),
+        queue.add(task),
+        queue.add(task),
+      ])
+
+      expect(maxConcurrent).toBe(2)
+    })
+
+    it('should return task results', async () => {
+      const queue = new PromiseQueue(2)
+      const result1 = await queue.add(async () => 'result1')
+      const result2 = await queue.add(async () => 42)
+      const result3 = await queue.add(async () => ({ key: 'value' }))
+
+      expect(result1).toBe('result1')
+      expect(result2).toBe(42)
+      expect(result3).toEqual({ key: 'value' })
+    })
+
+    it('should handle task errors', async () => {
+      const queue = new PromiseQueue(1)
+      await expect(
+        queue.add(async () => {
+          throw new Error('Task failed')
+        }),
+      ).rejects.toThrow('Task failed')
+    })
+
+    it('should continue processing after task error', async () => {
+      const queue = new PromiseQueue(1)
+
+      const p1 = queue
+        .add(async () => {
+          throw new Error('First fails')
+        })
+        .catch(e => e.message)
+
+      const p2 = queue.add(async () => 'second succeeds')
+
+      const results = await Promise.all([p1, p2])
+      expect(results[0]).toBe('First fails')
+      expect(results[1]).toBe('second succeeds')
+    })
+  })
+
+  describe('maxQueueLength', () => {
+    it('should drop oldest task when queue exceeds max length', async () => {
+      const queue = new PromiseQueue(1, 2)
+      const results: string[] = []
+      const errors: Error[] = []
+
+      // Add 4 tasks - first one runs immediately, next 2 queue, 4th drops oldest queued
+      const tasks = [
+        queue.add(async () => {
+          await delay(50)
+          results.push('task1')
+          return 'task1'
+        }),
+        queue
+          .add(async () => {
+            results.push('task2')
+            return 'task2'
+          })
+          .catch((e: Error) => errors.push(e)),
+        queue.add(async () => {
+          results.push('task3')
+          return 'task3'
+        }),
+        queue.add(async () => {
+          results.push('task4')
+          return 'task4'
+        }),
+      ]
+
+      await Promise.all(tasks.map(t => t.catch(() => {})))
+
+      expect(errors.length).toBe(1)
+      expect(errors[0]?.message).toBe('Task dropped: queue length exceeded')
+      expect(results).toContain('task1')
+      expect(results).not.toContain('task2') // Dropped
+    })
+
+    it('should work without dropping tasks when under limit', async () => {
+      const queue = new PromiseQueue(1, 10)
+      const results = await Promise.all([
+        queue.add(async () => 1),
+        queue.add(async () => 2),
+        queue.add(async () => 3),
+      ])
+
+      expect(results).toEqual([1, 2, 3])
+    })
+  })
+
+  describe('activeCount', () => {
+    it('should return 0 for idle queue', () => {
+      const queue = new PromiseQueue(1)
+      expect(queue.activeCount).toBe(0)
+    })
+
+    it('should track running tasks', async () => {
+      const queue = new PromiseQueue(2)
+
+      const task1 = queue.add(async () => {
+        await delay(50)
+        return 'done'
+      })
+
+      // Give it a tick to start
+      await delay(5)
+      expect(queue.activeCount).toBeGreaterThan(0)
+
+      await task1
+      // Wait a bit for cleanup
+      await delay(5)
+      expect(queue.activeCount).toBe(0)
+    })
+
+    it('should not exceed maxConcurrency', async () => {
+      const queue = new PromiseQueue(2)
+
+      queue.add(async () => await delay(100))
+      queue.add(async () => await delay(100))
+      queue.add(async () => await delay(100))
+
+      await delay(10)
+      expect(queue.activeCount).toBeLessThanOrEqual(2)
+    })
+  })
+
+  describe('pendingCount', () => {
+    it('should return 0 for empty queue', () => {
+      const queue = new PromiseQueue(1)
+      expect(queue.pendingCount).toBe(0)
+    })
+
+    it('should track queued tasks', async () => {
+      const queue = new PromiseQueue(1)
+
+      queue.add(async () => await delay(100))
+      queue.add(async () => await delay(10))
+      queue.add(async () => await delay(10))
+
+      await delay(10)
+      expect(queue.pendingCount).toBeGreaterThan(0)
+    })
+
+    it('should decrease as tasks complete', async () => {
+      const queue = new PromiseQueue(1)
+
+      queue.add(async () => await delay(20))
+      queue.add(async () => await delay(20))
+      const task3 = queue.add(async () => await delay(20))
+
+      await delay(5)
+      const initialPending = queue.pendingCount
+
+      await task3
+      expect(queue.pendingCount).toBeLessThan(initialPending)
+    })
+  })
+
+  describe('clear', () => {
+    it('should clear pending tasks', async () => {
+      const queue = new PromiseQueue(1)
+
+      queue.add(async () => await delay(100))
+      queue.add(async () => await delay(10))
+      queue.add(async () => await delay(10))
+
+      await delay(10)
+      const beforeClear = queue.pendingCount
+
+      queue.clear()
+      expect(queue.pendingCount).toBe(0)
+      expect(beforeClear).toBeGreaterThan(0)
+    })
+
+    it('should not affect running tasks', async () => {
+      const queue = new PromiseQueue(1)
+      let completed = false
+
+      const runningTask = queue.add(async () => {
+        await delay(50)
+        completed = true
+        return 'done'
+      })
+
+      await delay(10)
+      queue.clear()
+
+      const result = await runningTask
+      expect(result).toBe('done')
+      expect(completed).toBe(true)
+    })
+
+    it('should allow new tasks after clear', async () => {
+      const queue = new PromiseQueue(2)
+
+      queue.add(async () => await delay(50))
+      queue.clear()
+
+      const result = await queue.add(async () => 'new task')
+      expect(result).toBe('new task')
+    })
+  })
+
+  describe('onIdle', () => {
+    it('should resolve immediately for empty queue', async () => {
+      const queue = new PromiseQueue(1)
+      await queue.onIdle()
+      expect(true).toBe(true)
+    })
+
+    it('should wait for all tasks to complete', async () => {
+      const queue = new PromiseQueue(2)
+      const completed: number[] = []
+
+      queue.add(async () => {
+        await delay(30)
+        completed.push(1)
+      })
+      queue.add(async () => {
+        await delay(30)
+        completed.push(2)
+      })
+      queue.add(async () => {
+        await delay(30)
+        completed.push(3)
+      })
+
+      await queue.onIdle()
+      expect(completed).toEqual([1, 2, 3])
+    })
+
+    it('should work with sequential calls', async () => {
+      const queue = new PromiseQueue(1)
+
+      queue.add(async () => await delay(20))
+      await queue.onIdle()
+
+      queue.add(async () => await delay(20))
+      await queue.onIdle()
+
+      expect(queue.activeCount).toBe(0)
+      expect(queue.pendingCount).toBe(0)
+    })
+  })
+
+  describe('integration', () => {
+    it('should handle complex workflow', async () => {
+      const queue = new PromiseQueue(3, 50)
+      const results: number[] = []
+
+      // Add many tasks - use larger queue to avoid dropping
+      const tasks = Array.from({ length: 20 }, (_, i) =>
+        queue.add(async () => {
+          await delay(Math.random() * 20)
+          results.push(i)
+          return i
+        }),
+      )
+
+      await Promise.all(tasks)
+
+      expect(results.length).toBe(20)
+      // Wait a bit for cleanup
+      await delay(5)
+      expect(queue.activeCount).toBe(0)
+      expect(queue.pendingCount).toBe(0)
+    })
+
+    it('should handle mixed success and failure', async () => {
+      const queue = new PromiseQueue(2)
+      const results = await Promise.allSettled([
+        queue.add(async () => 'success'),
+        queue.add(async () => {
+          throw new Error('fail')
+        }),
+        queue.add(async () => 'success2'),
+        queue.add(async () => {
+          throw new Error('fail2')
+        }),
+      ])
+
+      const fulfilled = results.filter(r => r.status === 'fulfilled')
+      const rejected = results.filter(r => r.status === 'rejected')
+
+      expect(fulfilled.length).toBe(2)
+      expect(rejected.length).toBe(2)
+    })
+
+    it('should maintain order for sequential execution', async () => {
+      const queue = new PromiseQueue(1)
+      const order: number[] = []
+
+      await Promise.all([
+        queue.add(async () => order.push(1)),
+        queue.add(async () => order.push(2)),
+        queue.add(async () => order.push(3)),
+        queue.add(async () => order.push(4)),
+      ])
+
+      expect(order).toEqual([1, 2, 3, 4])
+    })
+
+    it('should work with different data types', async () => {
+      const queue = new PromiseQueue(2)
+
+      const [str, num, obj, arr, bool] = await Promise.all([
+        queue.add(async () => 'string'),
+        queue.add(async () => 42),
+        queue.add(async () => ({ key: 'value' })),
+        queue.add(async () => [1, 2, 3]),
+        queue.add(async () => true),
+      ])
+
+      expect(str).toBe('string')
+      expect(num).toBe(42)
+      expect(obj).toEqual({ key: 'value' })
+      expect(arr).toEqual([1, 2, 3])
+      expect(bool).toBe(true)
+    })
+  })
+})
diff --git a/test/unit/promises.test.ts b/test/unit/promises.test.ts
new file mode 100644
index 0000000..556830d
--- /dev/null
+++ b/test/unit/promises.test.ts
@@ -0,0 +1,1038 @@
+/**
+ * @fileoverview Unit tests for async iteration and retry utilities.
+ *
+ * Tests promise-based iteration and retry helpers:
+ * - pEach(), pEachChunk() iterate async operations with concurrency control
+ * - pFilter(), pFilterChunk() filter arrays with async predicates
+ * - pRetry() retries failed async operations with exponential backoff
+ * - normalizeIterationOptions(), normalizeRetryOptions() option normalizers
+ * - resolveRetryOptions() retry configuration resolver
+ * Used by Socket tools for batch operations and fault-tolerant API calls.
+ */
+
+import {
+  normalizeIterationOptions,
+  normalizeRetryOptions,
+  pEach,
+  pEachChunk,
+  pFilter,
+  pFilterChunk,
+  pRetry,
+  resolveRetryOptions,
+} from '@socketsecurity/lib/promises'
+import { describe, expect, it, vi } from 'vitest'
+
+describe('promises', () => {
+  describe('resolveRetryOptions', () => {
+    it('should resolve number to retries option', () => {
+      const options = resolveRetryOptions(3)
+      expect(options.retries).toBe(3)
+      expect(options.baseDelayMs).toBe(200)
+      expect(options.maxDelayMs).toBe(10_000)
+    })
+
+    it('should merge provided options with defaults', () => {
+      const options = resolveRetryOptions({ retries: 5, baseDelayMs: 100 })
+      expect(options.retries).toBe(5)
+      expect(options.baseDelayMs).toBe(100)
+      expect(options.maxDelayMs).toBe(10_000)
+    })
+
+    it('should return defaults when no options provided', () => {
+      const options = resolveRetryOptions()
+      expect(options.retries).toBe(0)
+      expect(options.baseDelayMs).toBe(200)
+      expect(options.maxDelayMs).toBe(10_000)
+    })
+  })
+
+  describe('normalizeRetryOptions', () => {
+    it('should normalize retry options with defaults', () => {
+      const options = normalizeRetryOptions(3)
+      expect(options.retries).toBe(3)
+      expect(options.backoffFactor).toBe(2)
+      expect(options.baseDelayMs).toBe(200)
+      expect(options.maxDelayMs).toBe(10_000)
+      expect(options.jitter).toBe(true)
+    })
+
+    it('should use custom backoff factor', () => {
+      const options = normalizeRetryOptions({ retries: 3, backoffFactor: 3 })
+      expect(options.backoffFactor).toBe(3)
+    })
+
+    it('should include all retry options', () => {
+      const onRetry = vi.fn()
+      const options = normalizeRetryOptions({
+        onRetry,
+        onRetryCancelOnFalse: true,
+        onRetryRethrow: true,
+        retries: 3,
+      })
+      expect(options.onRetry).toBe(onRetry)
+      expect(options.onRetryCancelOnFalse).toBe(true)
+      expect(options.onRetryRethrow).toBe(true)
+    })
+  })
+
+  describe('normalizeIterationOptions', () => {
+    it('should normalize number as concurrency', () => {
+      const options = normalizeIterationOptions(5)
+      expect(options.concurrency).toBe(5)
+    })
+
+    it('should normalize object options', () => {
+      const options = normalizeIterationOptions({ concurrency: 3, retries: 2 })
+      expect(options.concurrency).toBe(3)
+      expect(options.retries.retries).toBe(2)
+    })
+
+    it('should default concurrency to 1', () => {
+      const options = normalizeIterationOptions()
+      expect(options.concurrency).toBe(1)
+    })
+
+    it('should ensure minimum concurrency of 1', () => {
+      const options = normalizeIterationOptions({ concurrency: 0 })
+      expect(options.concurrency).toBe(1)
+    })
+  })
+
+  describe('pRetry', () => {
+    it('should return result on success', async () => {
+      const fn = vi.fn().mockResolvedValue('success')
+      const result = await pRetry(fn)
+      expect(result).toBe('success')
+      expect(fn).toHaveBeenCalledTimes(1)
+    })
+
+    it('should retry on failure', async () => {
+      let attempts = 0
+      const fn = vi.fn().mockImplementation(async () => {
+        attempts += 1
+        if (attempts < 3) {
+          throw new Error('fail')
+        }
+        return 'success'
+      })
+
+      const result = await pRetry(fn, { retries: 3, baseDelayMs: 10 })
+      expect(result).toBe('success')
+      expect(fn).toHaveBeenCalledTimes(3)
+    })
+
+    it('should throw error after all retries exhausted', async () => {
+      const fn = vi.fn().mockRejectedValue(new Error('fail'))
+      await expect(pRetry(fn, { retries: 2, baseDelayMs: 10 })).rejects.toThrow(
+        'fail',
+      )
+      expect(fn).toHaveBeenCalledTimes(3) // Initial + 2 retries
+    })
+
+    it('should respect abort signal', async () => {
+      const controller = new AbortController()
+      const fn = vi.fn().mockImplementation(async () => {
+        controller.abort()
+        throw new Error('fail')
+      })
+
+      const result = await pRetry(fn, {
+        retries: 3,
+        signal: controller.signal,
+      })
+      expect(result).toBeUndefined()
+      expect(fn).toHaveBeenCalledTimes(1)
+    })
+
+    it('should call onRetry callback', async () => {
+      let attempts = 0
+      const fn = vi.fn().mockImplementation(async () => {
+        attempts += 1
+        if (attempts < 2) {
+          throw new Error('fail')
+        }
+        return 'success'
+      })
+      const onRetry = vi.fn()
+
+      await pRetry(fn, { retries: 2, baseDelayMs: 10, onRetry })
+      expect(onRetry).toHaveBeenCalledTimes(1)
+      expect(onRetry).toHaveBeenCalledWith(
+        1,
+        expect.any(Error),
+        expect.any(Number),
+      )
+    })
+
+    it('should cancel retry if onRetry returns false', async () => {
+      const fn = vi.fn().mockRejectedValue(new Error('fail'))
+      const onRetry = vi.fn().mockReturnValue(false)
+
+      await expect(
+        pRetry(fn, {
+          onRetry,
+          onRetryCancelOnFalse: true,
+          retries: 3,
+        }),
+      ).rejects.toThrow('fail')
+      expect(fn).toHaveBeenCalledTimes(1)
+      expect(onRetry).toHaveBeenCalledTimes(1)
+    })
+
+    it('should not retry if retries is 0', async () => {
+      const fn = vi.fn().mockResolvedValue('success')
+      const result = await pRetry(fn, { retries: 0 })
+      expect(result).toBe('success')
+      expect(fn).toHaveBeenCalledTimes(1)
+    })
+  })
+
+  describe('pEach', () => {
+    it('should process all items', async () => {
+      const items = [1, 2, 3, 4]
+      const results: number[] = []
+      await pEach(items, async item => {
+        results.push(item)
+      })
+      expect(results).toEqual([1, 2, 3, 4])
+    })
+
+    it('should respect concurrency limit', async () => {
+      const items = [1, 2, 3, 4, 5, 6]
+      const active: number[] = []
+      const maxActive: number[] = []
+
+      await pEach(
+        items,
+        async item => {
+          active.push(item)
+          maxActive.push(active.length)
+          await new Promise(resolve => setTimeout(resolve, 10))
+          active.splice(active.indexOf(item), 1)
+        },
+        { concurrency: 2 },
+      )
+
+      expect(Math.max(...maxActive)).toBeLessThanOrEqual(2)
+    })
+
+    it('should handle empty arrays', async () => {
+      const fn = vi.fn()
+      await pEach([], fn)
+      expect(fn).not.toHaveBeenCalled()
+    })
+
+    it('should respect abort signal', async () => {
+      const controller = new AbortController()
+      const items = [1, 2, 3, 4]
+      const processed: number[] = []
+
+      setTimeout(() => controller.abort(), 20)
+
+      await pEach(
+        items,
+        async item => {
+          await new Promise(resolve => setTimeout(resolve, 15))
+          processed.push(item)
+        },
+        { signal: controller.signal, concurrency: 1 },
+      )
+
+      expect(processed.length).toBeLessThan(items.length)
+    })
+  })
+
+  describe('pFilter', () => {
+    it('should filter items based on predicate', async () => {
+      const items = [1, 2, 3, 4, 5, 6]
+      const result = await pFilter(items, async item => item % 2 === 0)
+      expect(result).toEqual([2, 4, 6])
+    })
+
+    it('should handle empty arrays', async () => {
+      const result = await pFilter([], async () => true)
+      expect(result).toEqual([])
+    })
+
+    it('should respect concurrency limit', async () => {
+      const items = [1, 2, 3, 4, 5, 6]
+      let maxActive = 0
+      let active = 0
+
+      const result = await pFilter(
+        items,
+        async item => {
+          active += 1
+          maxActive = Math.max(maxActive, active)
+          await new Promise(resolve => setTimeout(resolve, 10))
+          active -= 1
+          return item % 2 === 0
+        },
+        { concurrency: 2 },
+      )
+
+      expect(result).toEqual([2, 4, 6])
+      expect(maxActive).toBeLessThanOrEqual(2)
+    })
+
+    it('should return empty array when no items match', async () => {
+      const items = [1, 3, 5, 7]
+      const result = await pFilter(items, async item => item % 2 === 0)
+      expect(result).toEqual([])
+    })
+
+    it('should return all items when all match', async () => {
+      const items = [2, 4, 6, 8]
+      const result = await pFilter(items, async item => item % 2 === 0)
+      expect(result).toEqual([2, 4, 6, 8])
+    })
+
+    it('should retry failed filter operations', async () => {
+      const items = [1, 2, 3, 4]
+      let attempts = 0
+      const result = await pFilter(
+        items,
+        async item => {
+          attempts += 1
+          if (attempts <= 2 && item === 2) {
+            throw new Error('Temporary failure')
+          }
+          return item % 2 === 0
+        },
+        { concurrency: 1, retries: 3 },
+      )
+      expect(result).toEqual([2, 4])
+      expect(attempts).toBeGreaterThan(4) // Should have retried for item 2
+    })
+
+    it('should respect abort signal', async () => {
+      const controller = new AbortController()
+      const items = [1, 2, 3, 4, 5, 6]
+
+      setTimeout(() => controller.abort(), 15)
+
+      const result = await pFilter(
+        items,
+        async item => {
+          await new Promise(resolve => setTimeout(resolve, 10))
+          return item % 2 === 0
+        },
+        { signal: controller.signal, concurrency: 1 },
+      )
+
+      // When aborted, remaining items should be filtered out
+      expect(result.length).toBeLessThan(3)
+    })
+
+    it('should use number as concurrency shorthand', async () => {
+      const items = [1, 2, 3, 4, 5, 6]
+      const result = await pFilter(items, async item => item % 2 === 0, 2)
+      expect(result).toEqual([2, 4, 6])
+    })
+  })
+
+  describe('pFilterChunk', () => {
+    it('should filter items in chunks', async () => {
+      const chunks = [
+        [1, 2, 3],
+        [4, 5, 6],
+        [7, 8, 9],
+      ]
+      const result = await pFilterChunk(chunks, async item => item % 2 === 0)
+      expect(result).toEqual([[2], [4, 6], [8]])
+    })
+
+    it('should handle empty chunks', async () => {
+      const chunks: number[][] = [[], [], []]
+      const result = await pFilterChunk(chunks, async item => item % 2 === 0)
+      expect(result).toEqual([[], [], []])
+    })
+
+    it('should retry failed predicates', async () => {
+      const chunks = [[1, 2, 3]]
+      let attempts = 0
+      const result = await pFilterChunk(
+        chunks,
+        async item => {
+          attempts += 1
+          if (attempts <= 2 && item === 2) {
+            throw new Error('Temporary failure')
+          }
+          return item % 2 === 0
+        },
+        { retries: 3, baseDelayMs: 10 },
+      )
+      expect(result).toEqual([[2]])
+      expect(attempts).toBeGreaterThan(3)
+    })
+
+    it('should respect abort signal', async () => {
+      const controller = new AbortController()
+      const chunks = [
+        [1, 2, 3],
+        [4, 5, 6],
+        [7, 8, 9],
+      ]
+
+      controller.abort()
+
+      const result = await pFilterChunk(chunks, async item => item % 2 === 0, {
+        signal: controller.signal,
+      })
+
+      // When aborted, chunks should be empty arrays
+      expect(result).toEqual([[], [], []])
+    })
+
+    it('should handle abort signal mid-processing', async () => {
+      const controller = new AbortController()
+      const chunks = [
+        [1, 2, 3],
+        [4, 5, 6],
+        [7, 8, 9],
+      ]
+
+      setTimeout(() => controller.abort(), 25)
+
+      const result = await pFilterChunk(
+        chunks,
+        async item => {
+          await new Promise(resolve => setTimeout(resolve, 15))
+          return item % 2 === 0
+        },
+        { signal: controller.signal },
+      )
+
+      // First chunk may complete, rest should be empty
+      expect(result.length).toBe(3)
+      const totalFiltered = result.flat().length
+      expect(totalFiltered).toBeLessThan(4)
+    })
+
+    it('should accept retry count as number', async () => {
+      const chunks = [[1, 2, 3]]
+      let attempts = 0
+      const result = await pFilterChunk(
+        chunks,
+        async item => {
+          attempts += 1
+          if (attempts <= 2 && item === 2) {
+            throw new Error('Temporary failure')
+          }
+          return item % 2 === 0
+        },
+        3,
+      )
+      expect(result).toEqual([[2]])
+    })
+  })
+
+  describe('pEachChunk', () => {
+    it('should process array in chunks', async () => {
+      const items = Array.from({ length: 250 }, (_, i) => i + 1)
+      const processedChunks: number[][] = []
+
+      await pEachChunk(
+        items,
+        async chunk => {
+          processedChunks.push([...chunk])
+        },
+        { chunkSize: 100 },
+      )
+
+      expect(processedChunks.length).toBe(3)
+      expect(processedChunks[0]?.length).toBe(100)
+      expect(processedChunks[1]?.length).toBe(100)
+      expect(processedChunks[2]?.length).toBe(50)
+    })
+
+    it('should use default chunk size of 100', async () => {
+      const items = Array.from({ length: 150 }, (_, i) => i + 1)
+      const processedChunks: number[][] = []
+
+      await pEachChunk(items, async chunk => {
+        processedChunks.push([...chunk])
+      })
+
+      expect(processedChunks.length).toBe(2)
+      expect(processedChunks[0]?.length).toBe(100)
+      expect(processedChunks[1]?.length).toBe(50)
+    })
+
+    it('should handle empty arrays', async () => {
+      const fn = vi.fn()
+      await pEachChunk([], fn, { chunkSize: 10 })
+      expect(fn).not.toHaveBeenCalled()
+    })
+
+    it('should retry failed chunk operations', async () => {
+      const items = [1, 2, 3, 4, 5]
+      let attempts = 0
+
+      await pEachChunk(
+        items,
+        async chunk => {
+          attempts += 1
+          if (attempts === 1) {
+            throw new Error('First attempt fails')
+          }
+          return chunk
+        },
+        { chunkSize: 5, retries: 2, baseDelayMs: 10 },
+      )
+
+      expect(attempts).toBe(2)
+    })
+
+    it('should respect abort signal', async () => {
+      const controller = new AbortController()
+      const items = Array.from({ length: 500 }, (_, i) => i + 1)
+      let chunksProcessed = 0
+
+      setTimeout(() => controller.abort(), 25)
+
+      await pEachChunk(
+        items,
+        async chunk => {
+          chunksProcessed += 1
+          await new Promise(resolve => setTimeout(resolve, 15))
+          return chunk
+        },
+        { chunkSize: 100, signal: controller.signal },
+      )
+
+      expect(chunksProcessed).toBeLessThan(5)
+    })
+
+    it('should handle abort signal before processing', async () => {
+      const controller = new AbortController()
+      controller.abort()
+
+      const items = [1, 2, 3, 4, 5]
+      const fn = vi.fn()
+
+      await pEachChunk(items, fn, {
+        chunkSize: 2,
+        signal: controller.signal,
+      })
+
+      expect(fn).not.toHaveBeenCalled()
+    })
+
+    it('should pass retry options correctly', async () => {
+      const items = [1, 2, 3]
+      let attempts = 0
+      const onRetry = vi.fn()
+
+      await pEachChunk(
+        items,
+        async () => {
+          attempts += 1
+          if (attempts === 1) {
+            throw new Error('First attempt fails')
+          }
+        },
+        {
+          chunkSize: 3,
+          retries: 2,
+          baseDelayMs: 10,
+          onRetry,
+        },
+      )
+
+      expect(attempts).toBe(2)
+      expect(onRetry).toHaveBeenCalledTimes(1)
+    })
+  })
+
+  describe('pRetry - Advanced Edge Cases', () => {
+    it('should apply exponential backoff', async () => {
+      let attempts = 0
+      const delays: number[] = []
+
+      const fn = vi.fn().mockImplementation(async () => {
+        attempts += 1
+        if (attempts < 4) {
+          throw new Error('fail')
+        }
+        return 'success'
+      })
+
+      await pRetry(fn, {
+        retries: 3,
+        baseDelayMs: 50,
+        backoffFactor: 2,
+        jitter: false,
+        onRetry: (_attempt, _error, delay) => {
+          delays.push(delay)
+          return undefined
+        },
+      })
+
+      expect(delays[0]).toBe(50)
+      expect(delays[1]).toBe(100)
+      expect(delays[2]).toBe(200)
+    })
+
+    it('should apply jitter to delays', async () => {
+      let attempts = 0
+      const delays: number[] = []
+
+      const fn = vi.fn().mockImplementation(async () => {
+        attempts += 1
+        if (attempts < 3) {
+          throw new Error('fail')
+        }
+        return 'success'
+      })
+
+      await pRetry(fn, {
+        retries: 2,
+        baseDelayMs: 100,
+        backoffFactor: 2,
+        jitter: true,
+        onRetry: (_attempt, _error, delay) => {
+          delays.push(delay)
+          return undefined
+        },
+      })
+
+      // With jitter, delays should be >= base delay but <= 2 * base delay
+      expect(delays[0]).toBeGreaterThanOrEqual(100)
+      expect(delays[0]).toBeLessThanOrEqual(200)
+      expect(delays[1]).toBeGreaterThanOrEqual(200)
+      expect(delays[1]).toBeLessThanOrEqual(400)
+    })
+
+    it('should respect maxDelayMs cap', async () => {
+      let attempts = 0
+      const delays: number[] = []
+
+      const fn = vi.fn().mockImplementation(async () => {
+        attempts += 1
+        if (attempts < 6) {
+          throw new Error('fail')
+        }
+        return 'success'
+      })
+
+      await pRetry(fn, {
+        retries: 5,
+        baseDelayMs: 100,
+        backoffFactor: 2,
+        maxDelayMs: 300,
+        jitter: false,
+        onRetry: (_attempt, _error, delay) => {
+          delays.push(delay)
+          return undefined
+        },
+      })
+
+      // Delays should be capped at maxDelayMs
+      expect(delays[0]).toBe(100)
+      expect(delays[1]).toBe(200)
+      expect(delays[2]).toBe(300) // Would be 400 but capped
+      expect(delays[3]).toBe(300) // Would be 800 but capped
+      expect(delays[4]).toBe(300) // Would be 1600 but capped
+    })
+
+    it('should allow onRetry to override delay', async () => {
+      let attempts = 0
+      const actualDelays: number[] = []
+
+      const fn = vi.fn().mockImplementation(async () => {
+        attempts += 1
+        if (attempts < 3) {
+          throw new Error('fail')
+        }
+        return 'success'
+      })
+
+      await pRetry(fn, {
+        retries: 2,
+        baseDelayMs: 100,
+        onRetry: (_attempt, _error, delay) => {
+          actualDelays.push(delay)
+          return 25 // Override to 25ms
+        },
+      })
+
+      // Verify custom delays were used
+      expect(fn).toHaveBeenCalledTimes(3)
+      expect(actualDelays.length).toBe(2)
+    })
+
+    it('should ignore negative custom delays from onRetry', async () => {
+      let attempts = 0
+
+      const fn = vi.fn().mockImplementation(async () => {
+        attempts += 1
+        if (attempts < 2) {
+          throw new Error('fail')
+        }
+        return 'success'
+      })
+
+      await pRetry(fn, {
+        retries: 1,
+        baseDelayMs: 50,
+        onRetry: () => -100, // Negative value should be ignored
+      })
+
+      expect(fn).toHaveBeenCalledTimes(2)
+    })
+
+    it('should handle onRetry throwing error with onRetryRethrow true', async () => {
+      const fn = vi.fn().mockRejectedValue(new Error('original error'))
+      const onRetry = vi.fn().mockImplementation(() => {
+        throw new Error('onRetry error')
+      })
+
+      await expect(
+        pRetry(fn, {
+          retries: 2,
+          onRetry,
+          onRetryRethrow: true,
+        }),
+      ).rejects.toThrow('onRetry error')
+
+      expect(fn).toHaveBeenCalledTimes(1)
+    })
+
+    it('should ignore onRetry errors when onRetryRethrow is false', async () => {
+      let attempts = 0
+      const fn = vi.fn().mockImplementation(async () => {
+        attempts += 1
+        if (attempts < 2) {
+          throw new Error('fail')
+        }
+        return 'success'
+      })
+      const onRetry = vi.fn().mockImplementation(() => {
+        throw new Error('onRetry error')
+      })
+
+      const result = await pRetry(fn, {
+        retries: 2,
+        baseDelayMs: 10,
+        onRetry,
+        onRetryRethrow: false,
+      })
+
+      expect(result).toBe('success')
+      expect(onRetry).toHaveBeenCalledTimes(1)
+    })
+
+    it('should pass arguments to callback function', async () => {
+      const fn = vi
+        .fn()
+        .mockImplementation(
+          async (a: number, b: number, _c: { signal?: AbortSignal }) => {
+            return a + b
+          },
+        )
+
+      const result = await pRetry(fn, {
+        retries: 0,
+        args: [5, 10],
+      })
+
+      expect(result).toBe(15)
+      expect(fn).toHaveBeenCalledWith(5, 10, { signal: expect.any(Object) })
+    })
+
+    it('should pass empty args array when not provided', async () => {
+      const fn = vi.fn().mockResolvedValue('success')
+
+      await pRetry(fn, { retries: 0 })
+
+      expect(fn).toHaveBeenCalledWith({ signal: expect.any(Object) })
+    })
+
+    it('should return undefined when signal is already aborted', async () => {
+      const controller = new AbortController()
+      controller.abort()
+
+      const fn = vi.fn().mockResolvedValue('success')
+
+      const result = await pRetry(fn, {
+        retries: 3,
+        signal: controller.signal,
+      })
+
+      expect(result).toBeUndefined()
+      expect(fn).not.toHaveBeenCalled()
+    })
+
+    it('should return undefined when signal is aborted during setTimeout', async () => {
+      const controller = new AbortController()
+      let attempts = 0
+
+      const fn = vi.fn().mockImplementation(async () => {
+        attempts += 1
+        if (attempts === 1) {
+          setTimeout(() => controller.abort(), 5)
+          throw new Error('fail')
+        }
+        return 'success'
+      })
+
+      const result = await pRetry(fn, {
+        retries: 3,
+        baseDelayMs: 50,
+        signal: controller.signal,
+      })
+
+      expect(result).toBeUndefined()
+      expect(attempts).toBe(1)
+    })
+
+    it('should handle abort signal between retries', async () => {
+      const controller = new AbortController()
+      let attempts = 0
+
+      const fn = vi.fn().mockImplementation(async () => {
+        attempts += 1
+        if (attempts === 1) {
+          throw new Error('fail')
+        }
+        return 'success'
+      })
+
+      setTimeout(() => controller.abort(), 30)
+
+      const result = await pRetry(fn, {
+        retries: 3,
+        baseDelayMs: 50,
+        signal: controller.signal,
+      })
+
+      expect(result).toBeUndefined()
+      expect(attempts).toBe(1)
+    })
+
+    it('should clamp onRetry custom delay to maxDelayMs', async () => {
+      let attempts = 0
+      const delays: number[] = []
+
+      const fn = vi.fn().mockImplementation(async () => {
+        attempts += 1
+        if (attempts < 2) {
+          throw new Error('fail')
+        }
+        return 'success'
+      })
+
+      await pRetry(fn, {
+        retries: 1,
+        baseDelayMs: 100,
+        maxDelayMs: 500,
+        onRetry: (_attempt, _error, delay) => {
+          delays.push(delay)
+          return 1000 // Should be clamped to 500
+        },
+      })
+
+      expect(fn).toHaveBeenCalledTimes(2)
+    })
+
+    it('should handle maxDelayMs with jitter', async () => {
+      let attempts = 0
+      const delays: number[] = []
+
+      const fn = vi.fn().mockImplementation(async () => {
+        attempts += 1
+        if (attempts < 3) {
+          throw new Error('fail')
+        }
+        return 'success'
+      })
+
+      await pRetry(fn, {
+        retries: 2,
+        baseDelayMs: 200,
+        backoffFactor: 3,
+        maxDelayMs: 500,
+        jitter: true,
+        onRetry: (_attempt, _error, delay) => {
+          delays.push(delay)
+          return undefined
+        },
+      })
+
+      // All delays should be <= maxDelayMs
+      delays.forEach(delay => {
+        expect(delay).toBeLessThanOrEqual(500)
+      })
+    })
+  })
+
+  describe('normalizeRetryOptions - Additional Options', () => {
+    it('should include args in normalized options', () => {
+      const args = [1, 2, 3]
+      const options = normalizeRetryOptions({ retries: 3, args })
+      expect(options.args).toEqual(args)
+    })
+
+    it('should default args to empty array', () => {
+      const options = normalizeRetryOptions(3)
+      expect(options.args).toEqual([])
+    })
+
+    it('should default jitter to true', () => {
+      const options = normalizeRetryOptions(3)
+      expect(options.jitter).toBe(true)
+    })
+
+    it('should allow jitter to be false', () => {
+      const options = normalizeRetryOptions({ retries: 3, jitter: false })
+      expect(options.jitter).toBe(false)
+    })
+  })
+
+  describe('normalizeIterationOptions - Edge Cases', () => {
+    it('should handle negative concurrency', () => {
+      const options = normalizeIterationOptions({ concurrency: -5 })
+      expect(options.concurrency).toBe(1)
+    })
+
+    it('should handle zero concurrency', () => {
+      const options = normalizeIterationOptions(0)
+      expect(options.concurrency).toBe(1)
+    })
+
+    it('should merge retry options object', () => {
+      const retryOpts = {
+        retries: 3,
+        baseDelayMs: 1000,
+        backoffFactor: 3,
+      }
+      const options = normalizeIterationOptions({
+        concurrency: 5,
+        retries: retryOpts,
+      })
+      expect(options.concurrency).toBe(5)
+      expect(options.retries.retries).toBe(3)
+      expect(options.retries.baseDelayMs).toBe(1000)
+      expect(options.retries.backoffFactor).toBe(3)
+    })
+
+    it('should use provided signal', () => {
+      const controller = new AbortController()
+      const options = normalizeIterationOptions({
+        concurrency: 2,
+        signal: controller.signal,
+      })
+      expect(options.signal).toBe(controller.signal)
+    })
+
+    it('should pass signal to retry options', () => {
+      const controller = new AbortController()
+      const options = normalizeIterationOptions({
+        concurrency: 2,
+        signal: controller.signal,
+      })
+      expect(options.retries.signal).toBe(controller.signal)
+    })
+  })
+
+  describe('pEach - Edge Cases', () => {
+    it('should retry failed item operations', async () => {
+      const items = [1, 2, 3]
+      let attempts = 0
+
+      await pEach(
+        items,
+        async _item => {
+          attempts += 1
+          if (attempts === 2) {
+            throw new Error('Temporary failure')
+          }
+        },
+        { concurrency: 1, retries: 2 },
+      )
+
+      expect(attempts).toBeGreaterThan(3)
+    })
+
+    it('should handle abort signal before first chunk', async () => {
+      const controller = new AbortController()
+      controller.abort()
+
+      const items = [1, 2, 3, 4]
+      const fn = vi.fn()
+
+      await pEach(items, fn, {
+        signal: controller.signal,
+        concurrency: 2,
+      })
+
+      expect(fn).not.toHaveBeenCalled()
+    })
+
+    it('should use number as concurrency shorthand', async () => {
+      const items = [1, 2, 3, 4]
+      const results: number[] = []
+
+      await pEach(
+        items,
+        async item => {
+          results.push(item)
+        },
+        2,
+      )
+
+      expect(results).toEqual([1, 2, 3, 4])
+    })
+
+    it('should handle large arrays with high concurrency', async () => {
+      const items = Array.from({ length: 1000 }, (_, i) => i + 1)
+      let processed = 0
+
+      await pEach(
+        items,
+        async () => {
+          processed += 1
+        },
+        { concurrency: 50 },
+      )
+
+      expect(processed).toBe(1000)
+    })
+  })
+
+  describe('resolveRetryOptions - Edge Cases', () => {
+    it('should handle undefined options', () => {
+      const options = resolveRetryOptions(undefined)
+      expect(options.retries).toBe(0)
+      expect(options.baseDelayMs).toBe(200)
+      expect(options.maxDelayMs).toBe(10_000)
+      expect(options.backoffFactor).toBe(2)
+    })
+
+    it('should preserve custom options', () => {
+      const onRetry = vi.fn()
+      const options = resolveRetryOptions({
+        retries: 5,
+        baseDelayMs: 300,
+        maxDelayMs: 15_000,
+        backoffFactor: 3,
+        onRetry,
+        onRetryCancelOnFalse: true,
+        onRetryRethrow: true,
+      })
+      expect(options.retries).toBe(5)
+      expect(options.baseDelayMs).toBe(300)
+      expect(options.maxDelayMs).toBe(15_000)
+      expect(options.backoffFactor).toBe(3)
+      expect(options.onRetry).toBe(onRetry)
+      expect(options.onRetryCancelOnFalse).toBe(true)
+      expect(options.onRetryRethrow).toBe(true)
+    })
+
+    it('should handle zero retries', () => {
+      const options = resolveRetryOptions(0)
+      expect(options.retries).toBe(0)
+    })
+  })
+})
diff --git a/test/unit/prompts.test.ts b/test/unit/prompts.test.ts
new file mode 100644
index 0000000..592cd2b
--- /dev/null
+++ b/test/unit/prompts.test.ts
@@ -0,0 +1,108 @@
+/**
+ * @fileoverview Unit tests for interactive prompt exports.
+ *
+ * Tests prompt function exports and types:
+ * - confirm() boolean yes/no prompts
+ * - input() text input prompts
+ * - password() masked password input
+ * - select() single-choice selection
+ * - search() searchable list selection
+ * - Separator and createSeparator() for visual grouping
+ * Used by Socket CLI for interactive user input and configuration.
+ */
+
+import {
+  Separator,
+  confirm,
+  createSeparator,
+  input,
+  password,
+  search,
+  select,
+} from '@socketsecurity/lib/stdio/prompts'
+import type { Choice } from '@socketsecurity/lib/stdio/prompts'
+import { describe, expect, it } from 'vitest'
+
+describe('prompts', () => {
+  describe('exports', () => {
+    it('should export all prompt functions', () => {
+      expect(typeof confirm).toBe('function')
+      expect(typeof input).toBe('function')
+      expect(typeof password).toBe('function')
+      expect(typeof search).toBe('function')
+      expect(typeof select).toBe('function')
+    })
+
+    it('should export Separator', () => {
+      expect(Separator).toBeDefined()
+      expect(typeof Separator).toBe('function')
+    })
+
+    it('should export createSeparator helper', () => {
+      expect(typeof createSeparator).toBe('function')
+    })
+  })
+
+  describe('createSeparator', () => {
+    it('should create a separator instance', () => {
+      const separator = createSeparator()
+      expect(separator).toBeInstanceOf(Separator)
+      expect(separator.type).toBe('separator')
+    })
+
+    it('should create a separator with custom text', () => {
+      const separator = createSeparator('---')
+      expect(separator).toBeInstanceOf(Separator)
+      expect(separator.separator).toBe('---')
+    })
+  })
+
+  describe('Choice type', () => {
+    it('should accept Choice with name property', () => {
+      // Type check: This should compile without errors
+      const choices: Array<Choice<string>> = [
+        { name: 'Option 1', value: '1' },
+        { name: 'Option 2', value: '2' },
+      ]
+      expect(choices).toHaveLength(2)
+      expect(choices[0].name).toBe('Option 1')
+    })
+
+    it('should accept Choice with description and disabled', () => {
+      // Type check: This should compile without errors
+      const choices: Array<Choice<string>> = [
+        {
+          description: 'First option',
+          disabled: false,
+          name: 'Option 1',
+          value: '1',
+        },
+        {
+          description: 'Second option',
+          disabled: 'Not available',
+          name: 'Option 2',
+          value: '2',
+        },
+      ]
+      expect(choices).toHaveLength(2)
+      expect(choices[0].description).toBe('First option')
+      expect(choices[1].disabled).toBe('Not available')
+    })
+
+    it('should accept Choice with all optional properties', () => {
+      // Type check: This should compile without errors
+      const choices: Array<Choice<string>> = [
+        {
+          description: 'Detailed option',
+          disabled: false,
+          name: 'Full Option',
+          short: 'Full',
+          value: 'full',
+        },
+      ]
+      expect(choices[0].name).toBe('Full Option')
+      expect(choices[0].short).toBe('Full')
+      expect(choices[0].description).toBe('Detailed option')
+    })
+  })
+})
diff --git a/test/unit/regexps.test.ts b/test/unit/regexps.test.ts
new file mode 100644
index 0000000..5ea4b82
--- /dev/null
+++ b/test/unit/regexps.test.ts
@@ -0,0 +1,121 @@
+/**
+ * @fileoverview Unit tests for regular expression utilities.
+ *
+ * Tests regex helper functions:
+ * - escapeRegExp() escapes special characters for safe regex construction
+ * - Handles all regex metacharacters: \, |, {, }, [, ], (, ), *, +, ?, ., ^, $
+ * - Prevents regex injection vulnerabilities
+ * - Used for dynamic pattern building from user input
+ * Used throughout Socket tools for safe regex pattern construction.
+ */
+
+import { escapeRegExp } from '@socketsecurity/lib/regexps'
+import { describe, expect, it } from 'vitest'
+
+describe('regexps', () => {
+  describe('escapeRegExp', () => {
+    it('should escape backslash', () => {
+      expect(escapeRegExp('\\')).toBe('\\\\')
+    })
+
+    it('should escape pipe', () => {
+      expect(escapeRegExp('|')).toBe('\\|')
+    })
+
+    it('should escape curly braces', () => {
+      expect(escapeRegExp('{}')).toBe('\\{\\}')
+      expect(escapeRegExp('{')).toBe('\\{')
+      expect(escapeRegExp('}')).toBe('\\}')
+    })
+
+    it('should escape parentheses', () => {
+      expect(escapeRegExp('()')).toBe('\\(\\)')
+      expect(escapeRegExp('(')).toBe('\\(')
+      expect(escapeRegExp(')')).toBe('\\)')
+    })
+
+    it('should escape square brackets', () => {
+      expect(escapeRegExp('[]')).toBe('\\[\\]')
+      expect(escapeRegExp('[')).toBe('\\[')
+      expect(escapeRegExp(']')).toBe('\\]')
+    })
+
+    it('should escape caret', () => {
+      expect(escapeRegExp('^')).toBe('\\^')
+    })
+
+    it('should escape dollar sign', () => {
+      expect(escapeRegExp('$')).toBe('\\$')
+    })
+
+    it('should escape plus', () => {
+      expect(escapeRegExp('+')).toBe('\\+')
+    })
+
+    it('should escape asterisk', () => {
+      expect(escapeRegExp('*')).toBe('\\*')
+    })
+
+    it('should escape question mark', () => {
+      expect(escapeRegExp('?')).toBe('\\?')
+    })
+
+    it('should escape dot', () => {
+      expect(escapeRegExp('.')).toBe('\\.')
+    })
+
+    it('should escape multiple special characters', () => {
+      // biome-ignore lint/suspicious/noTemplateCurlyInString: Testing regex escape for curly braces
+      expect(escapeRegExp('.*+?^${}()|[]')).toBe(
+        '\\.\\*\\+\\?\\^\\$\\{\\}\\(\\)\\|\\[\\]',
+      )
+    })
+
+    it('should not escape regular characters', () => {
+      expect(escapeRegExp('abc123')).toBe('abc123')
+      expect(escapeRegExp('hello world')).toBe('hello world')
+    })
+
+    it('should handle mixed strings', () => {
+      expect(escapeRegExp('hello.world')).toBe('hello\\.world')
+      expect(escapeRegExp('test(123)')).toBe('test\\(123\\)')
+      expect(escapeRegExp('price: $50+')).toBe('price: \\$50\\+')
+    })
+
+    it('should handle empty string', () => {
+      expect(escapeRegExp('')).toBe('')
+    })
+
+    it('should work in actual regex', () => {
+      const input = 'test.file'
+      const escaped = escapeRegExp(input)
+      const regex = new RegExp(escaped)
+
+      expect(regex.test('test.file')).toBe(true)
+      expect(regex.test('testXfile')).toBe(false)
+    })
+
+    it('should escape complex file patterns', () => {
+      const pattern = '*.{js,ts}'
+      const escaped = escapeRegExp(pattern)
+      expect(escaped).toBe('\\*\\.\\{js,ts\\}')
+    })
+
+    it('should escape regex quantifiers', () => {
+      expect(escapeRegExp('a{1,3}')).toBe('a\\{1,3\\}')
+      expect(escapeRegExp('a*')).toBe('a\\*')
+      expect(escapeRegExp('a+')).toBe('a\\+')
+      expect(escapeRegExp('a?')).toBe('a\\?')
+    })
+
+    it('should escape character classes', () => {
+      expect(escapeRegExp('[a-z]')).toBe('\\[a-z\\]')
+      expect(escapeRegExp('[^0-9]')).toBe('\\[\\^0-9\\]')
+    })
+
+    it('should handle unicode characters', () => {
+      expect(escapeRegExp('hello世界')).toBe('hello世界')
+      expect(escapeRegExp('test.世界')).toBe('test\\.世界')
+    })
+  })
+})
diff --git a/test/unit/sea.test.ts b/test/unit/sea.test.ts
new file mode 100644
index 0000000..77accaa
--- /dev/null
+++ b/test/unit/sea.test.ts
@@ -0,0 +1,207 @@
+/**
+ * @fileoverview Unit tests for Node.js Single Executable Application (SEA) utilities.
+ *
+ * Tests Node.js SEA (Single Executable Application) detection:
+ * - isSeaBinary() detects if running as SEA binary
+ * - getSeaBinaryPath() returns SEA binary path if applicable
+ * - NODE_SEA_FUSE environment detection
+ * - Process state inspection for SEA mode
+ * Used by Socket CLI to detect standalone executable deployment.
+ */
+
+import { getSeaBinaryPath, isSeaBinary } from '@socketsecurity/lib/sea'
+import { describe, expect, it } from 'vitest'
+
+describe('sea', () => {
+  describe('isSeaBinary', () => {
+    it('should return boolean', () => {
+      const result = isSeaBinary()
+      expect(typeof result).toBe('boolean')
+    })
+
+    it('should be callable multiple times', () => {
+      const result1 = isSeaBinary()
+      const result2 = isSeaBinary()
+      const result3 = isSeaBinary()
+
+      // Should return consistent results
+      expect(result1).toBe(result2)
+      expect(result2).toBe(result3)
+      expect(typeof result1).toBe('boolean')
+    })
+
+    it('should return false in test environment', () => {
+      // In normal test environments, we're not running as SEA binary
+      const result = isSeaBinary()
+      expect(result).toBe(false)
+    })
+
+    it('should not throw errors', () => {
+      expect(() => isSeaBinary()).not.toThrow()
+    })
+
+    it('should cache result after first call', () => {
+      // Call multiple times - should be fast (cached)
+      const start = Date.now()
+      for (let i = 0; i < 100; i++) {
+        isSeaBinary()
+      }
+      const duration = Date.now() - start
+      // Should be extremely fast due to caching
+      expect(duration).toBeLessThan(50)
+    })
+  })
+
+  describe('getSeaBinaryPath', () => {
+    it('should return string or undefined', () => {
+      const result = getSeaBinaryPath()
+      expect(result === undefined || typeof result === 'string').toBe(true)
+    })
+
+    it('should return undefined in test environment', () => {
+      // In normal test environments, we're not running as SEA binary
+      const result = getSeaBinaryPath()
+      expect(result).toBeUndefined()
+    })
+
+    it('should not throw errors', () => {
+      expect(() => getSeaBinaryPath()).not.toThrow()
+    })
+
+    it('should be callable multiple times', () => {
+      const result1 = getSeaBinaryPath()
+      const result2 = getSeaBinaryPath()
+      const result3 = getSeaBinaryPath()
+
+      // Should return consistent results
+      expect(result1).toBe(result2)
+      expect(result2).toBe(result3)
+    })
+
+    it('should cache result based on isSeaBinary', () => {
+      // Call multiple times - should be fast (cached)
+      const start = Date.now()
+      for (let i = 0; i < 100; i++) {
+        getSeaBinaryPath()
+      }
+      const duration = Date.now() - start
+      // Should be extremely fast due to caching
+      expect(duration).toBeLessThan(50)
+    })
+  })
+
+  describe('integration', () => {
+    it('should have consistent behavior between isSeaBinary and getSeaBinaryPath', () => {
+      const isSea = isSeaBinary()
+      const binaryPath = getSeaBinaryPath()
+
+      if (isSea) {
+        // If running as SEA, should have a path
+        expect(binaryPath).toBeDefined()
+        expect(typeof binaryPath).toBe('string')
+        expect(binaryPath?.length).toBeGreaterThan(0)
+      } else {
+        // If not running as SEA, should not have a path
+        expect(binaryPath).toBeUndefined()
+      }
+    })
+
+    it('should handle multiple calls consistently', () => {
+      const isSea1 = isSeaBinary()
+      const path1 = getSeaBinaryPath()
+
+      const isSea2 = isSeaBinary()
+      const path2 = getSeaBinaryPath()
+
+      expect(isSea1).toBe(isSea2)
+      expect(path1).toBe(path2)
+    })
+
+    it('should maintain consistency across interleaved calls', () => {
+      const results: Array<[boolean, string | undefined]> = []
+
+      for (let i = 0; i < 10; i++) {
+        results.push([isSeaBinary(), getSeaBinaryPath()])
+      }
+
+      // All results should be identical
+      const first = results[0]
+      for (const result of results) {
+        expect(result[0]).toBe(first?.[0])
+        expect(result[1]).toBe(first?.[1])
+      }
+    })
+  })
+
+  describe('behavior', () => {
+    it('should handle node:sea module availability correctly', () => {
+      // In Node.js 20+, node:sea module should be available
+      // In older versions, it should gracefully handle absence
+      const isSea = isSeaBinary()
+      const path = getSeaBinaryPath()
+
+      // Should not throw, regardless of availability
+      expect(typeof isSea).toBe('boolean')
+      expect(path === undefined || typeof path === 'string').toBe(true)
+    })
+
+    it('should have low performance impact', () => {
+      // First call might require module loading
+      isSeaBinary()
+
+      // Subsequent calls should be cached and very fast
+      const iterations = 10_000
+      const start = Date.now()
+      for (let i = 0; i < iterations; i++) {
+        isSeaBinary()
+        getSeaBinaryPath()
+      }
+      const duration = Date.now() - start
+
+      // 10000 iterations of both functions should complete quickly
+      expect(duration).toBeLessThan(100)
+    })
+
+    it('should return sensible defaults when node:sea is unavailable', () => {
+      // Even if node:sea module is not available, functions should work
+      const isSea = isSeaBinary()
+      const path = getSeaBinaryPath()
+
+      expect(isSea).toBe(false)
+      expect(path).toBeUndefined()
+    })
+  })
+
+  describe('edge cases', () => {
+    it('should handle rapid successive calls', () => {
+      const results = []
+      for (let i = 0; i < 100; i++) {
+        results.push(isSeaBinary())
+        results.push(getSeaBinaryPath())
+      }
+
+      // All boolean results should be identical
+      const boolResults = results.filter(r => typeof r === 'boolean')
+      expect(new Set(boolResults).size).toBe(1)
+    })
+
+    it('should work in parallel scenarios', () => {
+      // Simulate concurrent access
+      const promises = Array.from({ length: 50 }, () =>
+        Promise.resolve().then(() => ({
+          isSea: isSeaBinary(),
+          path: getSeaBinaryPath(),
+        })),
+      )
+
+      return Promise.all(promises).then(results => {
+        // All results should be identical
+        const first = results[0]
+        for (const result of results) {
+          expect(result.isSea).toBe(first?.isSea)
+          expect(result.path).toBe(first?.path)
+        }
+      })
+    })
+  })
+})
diff --git a/test/unit/shadow.test.ts b/test/unit/shadow.test.ts
new file mode 100644
index 0000000..e08fc4e
--- /dev/null
+++ b/test/unit/shadow.test.ts
@@ -0,0 +1,337 @@
+/**
+ * @fileoverview Unit tests for shadow binary installation decision logic.
+ *
+ * Tests shadow binary installation logic:
+ * - shouldSkipShadow() determines if shadow binary installation should be skipped
+ * - Windows-specific behavior: always skips shadow on Windows
+ * - CI environment handling: skips shadow in CI
+ * - Path validation: checks if binary path exists and is valid
+ * - Platform detection: win32, darwin, linux
+ * Used by Socket CLI to decide whether to install package manager wrappers.
+ */
+
+import { afterEach, describe, expect, it } from 'vitest'
+
+import { shouldSkipShadow } from '@socketsecurity/lib/shadow'
+
+describe('shadow', () => {
+  describe('shouldSkipShadow', () => {
+    describe('Windows behavior', () => {
+      it('should skip shadow when win32 is true and binPath exists', () => {
+        expect(
+          shouldSkipShadow('/usr/bin/npm', { win32: true, cwd: '/home/user' }),
+        ).toBe(true)
+      })
+
+      it('should skip shadow when win32 is true with Windows path', () => {
+        expect(
+          shouldSkipShadow('C:\\Program Files\\nodejs\\npm.cmd', {
+            win32: true,
+            cwd: 'C:\\Users\\user\\project',
+          }),
+        ).toBe(true)
+      })
+
+      it('should not skip when win32 is true but binPath is empty', () => {
+        const result = shouldSkipShadow('', { win32: true, cwd: '/home/user' })
+        // Empty binPath on Windows should not trigger skip
+        expect(typeof result).toBe('boolean')
+      })
+
+      it('should not skip when win32 is false even with binPath', () => {
+        expect(
+          shouldSkipShadow('/usr/bin/npm', {
+            win32: false,
+            cwd: '/home/user',
+          }),
+        ).toBe(false)
+      })
+    })
+
+    describe('temporary executor detection via user agent', () => {
+      const originalUserAgent = process.env['npm_config_user_agent']
+
+      afterEach(() => {
+        if (originalUserAgent === undefined) {
+          delete process.env['npm_config_user_agent']
+        } else {
+          process.env['npm_config_user_agent'] = originalUserAgent
+        }
+      })
+
+      it('should skip shadow when user agent contains "exec"', () => {
+        process.env['npm_config_user_agent'] = 'npm/8.19.2 node/v18.12.0 exec'
+        expect(shouldSkipShadow('/usr/bin/npm', { cwd: '/home/user' })).toBe(
+          true,
+        )
+      })
+
+      it('should skip shadow when user agent contains "npx"', () => {
+        process.env['npm_config_user_agent'] = 'npm/8.19.2 node/v18.12.0 npx'
+        expect(shouldSkipShadow('/usr/bin/npm', { cwd: '/home/user' })).toBe(
+          true,
+        )
+      })
+
+      it('should skip shadow when user agent contains "dlx"', () => {
+        process.env['npm_config_user_agent'] = 'pnpm/8.6.0 node/v18.12.0 dlx'
+        expect(shouldSkipShadow('/usr/bin/npm', { cwd: '/home/user' })).toBe(
+          true,
+        )
+      })
+
+      it('should not skip when user agent is normal npm', () => {
+        process.env['npm_config_user_agent'] =
+          'npm/8.19.2 node/v18.12.0 darwin x64'
+        expect(shouldSkipShadow('/usr/bin/npm', { cwd: '/home/user' })).toBe(
+          false,
+        )
+      })
+
+      it('should not skip when user agent is undefined', () => {
+        delete process.env['npm_config_user_agent']
+        expect(shouldSkipShadow('/usr/bin/npm', { cwd: '/home/user' })).toBe(
+          false,
+        )
+      })
+    })
+
+    describe('npm cache detection', () => {
+      const originalCache = process.env['npm_config_cache']
+
+      afterEach(() => {
+        if (originalCache === undefined) {
+          delete process.env['npm_config_cache']
+        } else {
+          process.env['npm_config_cache'] = originalCache
+        }
+      })
+
+      it('should skip shadow when running from npm cache', () => {
+        process.env['npm_config_cache'] = '/home/user/.npm'
+        expect(
+          shouldSkipShadow('/usr/bin/npm', { cwd: '/home/user/.npm/_npx/123' }),
+        ).toBe(true)
+      })
+
+      it('should skip shadow when running from Windows npm cache', () => {
+        process.env['npm_config_cache'] = 'C:\\Users\\user\\AppData\\npm-cache'
+        expect(
+          shouldSkipShadow('C:\\Program Files\\nodejs\\npm.cmd', {
+            cwd: 'C:\\Users\\user\\AppData\\npm-cache\\_npx\\123',
+          }),
+        ).toBe(true)
+      })
+
+      it('should not skip when cwd is outside npm cache', () => {
+        process.env['npm_config_cache'] = '/home/user/.npm'
+        expect(
+          shouldSkipShadow('/usr/bin/npm', { cwd: '/home/user/project' }),
+        ).toBe(false)
+      })
+
+      it('should not skip when npm_config_cache is not set', () => {
+        delete process.env['npm_config_cache']
+        expect(
+          shouldSkipShadow('/usr/bin/npm', { cwd: '/home/user/.npm/_npx/123' }),
+        ).toBe(true) // Still skips due to _npx pattern
+      })
+    })
+
+    describe('temporary path patterns', () => {
+      it('should skip shadow when cwd contains _npx', () => {
+        expect(
+          shouldSkipShadow('/usr/bin/npm', {
+            cwd: '/home/user/.npm/_npx/abc123',
+          }),
+        ).toBe(true)
+      })
+
+      it('should skip shadow when cwd contains .pnpm-store', () => {
+        expect(
+          shouldSkipShadow('/usr/bin/pnpm', {
+            cwd: '/home/user/.pnpm-store/dlx-123',
+          }),
+        ).toBe(true)
+      })
+
+      it('should skip shadow when cwd contains dlx-', () => {
+        expect(
+          shouldSkipShadow('/usr/bin/pnpm', { cwd: '/tmp/dlx-abc123' }),
+        ).toBe(true)
+      })
+
+      it('should skip shadow when cwd contains Yarn PnP virtual package path', () => {
+        expect(
+          shouldSkipShadow('/usr/bin/yarn', {
+            cwd: '/home/user/project/.yarn/$$/package',
+          }),
+        ).toBe(true)
+      })
+
+      it('should skip shadow when cwd contains Yarn Windows temp path', () => {
+        expect(
+          shouldSkipShadow('C:\\Program Files\\nodejs\\yarn.cmd', {
+            cwd: 'C:\\Users\\user\\AppData\\Local\\Temp\\xfs-abc123',
+          }),
+        ).toBe(true)
+      })
+
+      it('should not skip shadow for normal project directory', () => {
+        expect(
+          shouldSkipShadow('/usr/bin/npm', { cwd: '/home/user/my-project' }),
+        ).toBe(false)
+      })
+
+      it('should not skip shadow for nested node_modules', () => {
+        expect(
+          shouldSkipShadow('/usr/bin/npm', {
+            cwd: '/home/user/project/node_modules/.bin',
+          }),
+        ).toBe(false)
+      })
+    })
+
+    describe('path normalization', () => {
+      it('should handle paths with backslashes', () => {
+        expect(
+          shouldSkipShadow('C:\\npm.cmd', {
+            cwd: 'C:\\Users\\user\\.npm\\_npx\\123',
+          }),
+        ).toBe(true)
+      })
+
+      it('should handle paths with forward slashes', () => {
+        expect(
+          shouldSkipShadow('/usr/bin/npm', {
+            cwd: '/home/user/.npm/_npx/123',
+          }),
+        ).toBe(true)
+      })
+
+      it('should handle mixed slash paths', () => {
+        expect(
+          shouldSkipShadow('C:/Program Files/nodejs/npm.cmd', {
+            cwd: 'C:/Users/user/.npm/_npx/123',
+          }),
+        ).toBe(true)
+      })
+    })
+
+    describe('default options', () => {
+      it('should use process.cwd() when cwd is not provided', () => {
+        const result = shouldSkipShadow('/usr/bin/npm')
+        expect(typeof result).toBe('boolean')
+      })
+
+      it('should default win32 to false', () => {
+        expect(shouldSkipShadow('/usr/bin/npm', { cwd: '/home/user' })).toBe(
+          false,
+        )
+      })
+
+      it('should handle empty options object', () => {
+        const result = shouldSkipShadow('/usr/bin/npm', {})
+        expect(typeof result).toBe('boolean')
+      })
+
+      it('should handle undefined options', () => {
+        const result = shouldSkipShadow('/usr/bin/npm', undefined)
+        expect(typeof result).toBe('boolean')
+      })
+    })
+
+    describe('combined conditions', () => {
+      const originalUserAgent = process.env['npm_config_user_agent']
+      const originalCache = process.env['npm_config_cache']
+
+      afterEach(() => {
+        if (originalUserAgent === undefined) {
+          delete process.env['npm_config_user_agent']
+        } else {
+          process.env['npm_config_user_agent'] = originalUserAgent
+        }
+        if (originalCache === undefined) {
+          delete process.env['npm_config_cache']
+        } else {
+          process.env['npm_config_cache'] = originalCache
+        }
+      })
+
+      it('should skip when both user agent and path pattern match', () => {
+        process.env['npm_config_user_agent'] = 'npm/8.19.2 node/v18.12.0 npx'
+        expect(
+          shouldSkipShadow('/usr/bin/npm', {
+            cwd: '/home/user/.npm/_npx/123',
+          }),
+        ).toBe(true)
+      })
+
+      it('should skip on Windows with binPath even if other conditions are false', () => {
+        process.env['npm_config_user_agent'] =
+          'npm/8.19.2 node/v18.12.0 darwin x64'
+        delete process.env['npm_config_cache']
+        expect(
+          shouldSkipShadow('C:\\npm.cmd', {
+            win32: true,
+            cwd: 'C:\\Users\\user\\project',
+          }),
+        ).toBe(true)
+      })
+
+      it('should skip when npm cache and path pattern both match', () => {
+        process.env['npm_config_cache'] = '/home/user/.npm'
+        expect(
+          shouldSkipShadow('/usr/bin/npm', {
+            cwd: '/home/user/.npm/_npx/123',
+          }),
+        ).toBe(true)
+      })
+
+      it('should not skip when no conditions match', () => {
+        delete process.env['npm_config_user_agent']
+        delete process.env['npm_config_cache']
+        expect(
+          shouldSkipShadow('/usr/bin/npm', {
+            win32: false,
+            cwd: '/home/user/my-project',
+          }),
+        ).toBe(false)
+      })
+    })
+
+    describe('edge cases', () => {
+      it('should handle empty binPath', () => {
+        const result = shouldSkipShadow('', { cwd: '/home/user' })
+        expect(typeof result).toBe('boolean')
+      })
+
+      it('should handle empty cwd', () => {
+        const result = shouldSkipShadow('/usr/bin/npm', { cwd: '' })
+        expect(typeof result).toBe('boolean')
+      })
+
+      it('should handle root directory as cwd', () => {
+        expect(shouldSkipShadow('/usr/bin/npm', { cwd: '/' })).toBe(false)
+      })
+
+      it('should handle relative paths in cwd', () => {
+        const result = shouldSkipShadow('/usr/bin/npm', {
+          cwd: '../project/_npx',
+        })
+        expect(typeof result).toBe('boolean')
+      })
+
+      it('should be case-sensitive for pattern matching', () => {
+        expect(
+          shouldSkipShadow('/usr/bin/npm', { cwd: '/home/user/_NPX/123' }),
+        ).toBe(false) // _NPX (uppercase) should not match _npx pattern
+      })
+
+      it('should handle very long paths', () => {
+        const longPath = `/home/user/${'a'.repeat(200)}/_npx/123`
+        expect(shouldSkipShadow('/usr/bin/npm', { cwd: longPath })).toBe(true)
+      })
+    })
+  })
+})
diff --git a/test/unit/signal-exit.test.ts b/test/unit/signal-exit.test.ts
new file mode 100644
index 0000000..7851a8f
--- /dev/null
+++ b/test/unit/signal-exit.test.ts
@@ -0,0 +1,343 @@
+/**
+ * @fileoverview Unit tests for process signal handling utilities.
+ *
+ * Tests signal-exit event handling:
+ * - load() initializes signal handlers
+ * - unload() removes signal handlers
+ * - onExit() registers cleanup callbacks for process termination
+ * - signals() returns current signal handler state
+ * - SIGINT, SIGTERM, SIGHUP signal handling
+ * Used by Socket CLI for graceful shutdown and cleanup on process exit.
+ */
+
+import { load, onExit, signals, unload } from '@socketsecurity/lib/signal-exit'
+import { afterEach, beforeEach, describe, expect, it, vi } from 'vitest'
+
+describe('signal-exit', () => {
+  beforeEach(() => {
+    // Ensure clean state before each test
+    unload()
+  })
+
+  afterEach(() => {
+    // Clean up after each test
+    unload()
+  })
+
+  describe('load', () => {
+    it('should load signal handlers', () => {
+      load()
+      expect(signals()).toBeTruthy()
+    })
+
+    it('should be idempotent (safe to call multiple times)', () => {
+      load()
+      load()
+      load()
+      expect(signals()).toBeTruthy()
+    })
+
+    it('should register signal listeners', () => {
+      load()
+      const sigs = signals()
+      expect(Array.isArray(sigs)).toBe(true)
+      if (sigs) {
+        expect(sigs.length).toBeGreaterThan(0)
+      }
+    })
+  })
+
+  describe('unload', () => {
+    it('should unload signal handlers', () => {
+      load()
+      unload()
+      // After unload, signals should still return array but loaded state changes
+      expect(typeof signals()).toBe('object')
+    })
+
+    it('should be safe to call when not loaded', () => {
+      unload()
+      unload()
+      expect(true).toBe(true) // Should not throw
+    })
+
+    it('should be safe to call multiple times', () => {
+      load()
+      unload()
+      unload()
+      unload()
+      expect(true).toBe(true) // Should not throw
+    })
+  })
+
+  describe('signals', () => {
+    it('should return undefined before load', () => {
+      // Note: signals() may return array even without explicit load
+      // because onExit auto-loads. This is by design.
+      const result = signals()
+      expect(result === undefined || Array.isArray(result)).toBe(true)
+    })
+
+    it('should return array after load', () => {
+      load()
+      const sigs = signals()
+      expect(Array.isArray(sigs)).toBe(true)
+    })
+
+    it('should include common signals', () => {
+      load()
+      const sigs = signals()
+      expect(sigs).toBeTruthy()
+      if (sigs) {
+        // Common signals across platforms
+        expect(sigs).toContain('SIGINT')
+        expect(sigs).toContain('SIGTERM')
+      }
+    })
+
+    it('should have platform-specific signals', () => {
+      load()
+      const sigs = signals()
+      expect(sigs).toBeTruthy()
+      if (sigs && process.platform !== 'win32') {
+        // POSIX-only signals
+        expect(sigs.length).toBeGreaterThan(5)
+      }
+    })
+  })
+
+  describe('onExit', () => {
+    it('should register exit handler', () => {
+      const callback = vi.fn()
+      const remove = onExit(callback)
+      expect(typeof remove).toBe('function')
+    })
+
+    it('should auto-load if not already loaded', () => {
+      unload()
+      const callback = vi.fn()
+      onExit(callback)
+      expect(signals()).toBeTruthy()
+    })
+
+    it('should return removal function', () => {
+      const callback = vi.fn()
+      const remove = onExit(callback)
+      expect(typeof remove).toBe('function')
+      remove()
+      expect(true).toBe(true) // Should not throw
+    })
+
+    it('should handle alwaysLast option', () => {
+      const callback = vi.fn()
+      const remove = onExit(callback, { alwaysLast: true })
+      expect(typeof remove).toBe('function')
+      remove()
+    })
+
+    it('should handle alwaysLast: false option', () => {
+      const callback = vi.fn()
+      const remove = onExit(callback, { alwaysLast: false })
+      expect(typeof remove).toBe('function')
+      remove()
+    })
+
+    it('should handle undefined options', () => {
+      const callback = vi.fn()
+      const remove = onExit(callback, undefined)
+      expect(typeof remove).toBe('function')
+      remove()
+    })
+
+    it('should throw TypeError for non-function callback', () => {
+      expect(() => onExit(null as any)).toThrow(TypeError)
+      expect(() => onExit(undefined as any)).toThrow(TypeError)
+      expect(() => onExit(42 as any)).toThrow(TypeError)
+      expect(() => onExit('string' as any)).toThrow(TypeError)
+    })
+
+    it('should allow multiple handlers', () => {
+      const callback1 = vi.fn()
+      const callback2 = vi.fn()
+      const callback3 = vi.fn()
+
+      const remove1 = onExit(callback1)
+      const remove2 = onExit(callback2)
+      const remove3 = onExit(callback3)
+
+      expect(typeof remove1).toBe('function')
+      expect(typeof remove2).toBe('function')
+      expect(typeof remove3).toBe('function')
+
+      remove1()
+      remove2()
+      remove3()
+    })
+
+    it('should handle removal of handlers', () => {
+      const callback = vi.fn()
+      const remove = onExit(callback)
+      remove()
+      // Should not throw when removing twice
+      remove()
+    })
+
+    it('should unload when all handlers removed', () => {
+      const callback1 = vi.fn()
+      const callback2 = vi.fn()
+
+      const remove1 = onExit(callback1)
+      const remove2 = onExit(callback2)
+
+      // Remove both
+      remove1()
+      remove2()
+
+      // Signal handlers should be cleaned up
+      expect(true).toBe(true)
+    })
+  })
+
+  describe('edge cases', () => {
+    it('should handle rapid load/unload cycles', () => {
+      for (let i = 0; i < 10; i++) {
+        load()
+        unload()
+      }
+      expect(true).toBe(true)
+    })
+
+    it('should handle multiple handlers with same callback', () => {
+      const callback = vi.fn()
+      const remove1 = onExit(callback)
+      const remove2 = onExit(callback)
+
+      remove1()
+      remove2()
+      expect(true).toBe(true)
+    })
+
+    it('should handle mix of regular and alwaysLast handlers', () => {
+      const regular1 = vi.fn()
+      const regular2 = vi.fn()
+      const last1 = vi.fn()
+      const last2 = vi.fn()
+
+      const remove1 = onExit(regular1)
+      const remove2 = onExit(last1, { alwaysLast: true })
+      const remove3 = onExit(regular2)
+      const remove4 = onExit(last2, { alwaysLast: true })
+
+      remove1()
+      remove2()
+      remove3()
+      remove4()
+      expect(true).toBe(true)
+    })
+  })
+
+  describe('cross-platform behavior', () => {
+    it('should work on Windows', () => {
+      load()
+      const sigs = signals()
+      expect(sigs).toBeTruthy()
+      if (process.platform === 'win32' && sigs) {
+        // Windows should have fewer signals
+        expect(sigs).toContain('SIGINT')
+        expect(sigs).toContain('SIGTERM')
+      }
+    })
+
+    it('should work on POSIX platforms', () => {
+      load()
+      const sigs = signals()
+      expect(sigs).toBeTruthy()
+      if (process.platform !== 'win32' && sigs) {
+        // POSIX should have more signals
+        expect(sigs.length).toBeGreaterThan(5)
+        expect(sigs).toContain('SIGINT')
+        expect(sigs).toContain('SIGTERM')
+        expect(sigs).toContain('SIGUSR2')
+      }
+    })
+
+    it('should work on Linux', () => {
+      load()
+      const sigs = signals()
+      expect(sigs).toBeTruthy()
+      if (process.platform === 'linux' && sigs) {
+        // Linux-specific signals
+        expect(sigs).toContain('SIGIO')
+        expect(sigs).toContain('SIGPOLL')
+      }
+    })
+  })
+
+  describe('signal handler behavior', () => {
+    it('should handle process emit events', () => {
+      load()
+      // The load should patch process.emit
+      expect(process.emit).toBeTruthy()
+      expect(typeof process.emit).toBe('function')
+    })
+
+    it('should restore original process.emit on unload', () => {
+      load()
+      unload()
+      // After unload, should restore original (or maintain functional emit)
+      expect(typeof process.emit).toBe('function')
+    })
+  })
+
+  describe('error handling', () => {
+    it('should handle errors in callback gracefully', () => {
+      const errorCallback = vi.fn(() => {
+        throw new Error('Test error')
+      })
+
+      const remove = onExit(errorCallback)
+      expect(typeof remove).toBe('function')
+      remove()
+    })
+
+    it('should handle removal of non-existent handler', () => {
+      const callback = vi.fn()
+      const remove = onExit(callback)
+      remove()
+      // Remove again should not throw
+      remove()
+      remove()
+      expect(true).toBe(true)
+    })
+  })
+
+  describe('memory management', () => {
+    it('should not leak handlers', () => {
+      const handlers = []
+      for (let i = 0; i < 100; i++) {
+        const callback = vi.fn()
+        const remove = onExit(callback)
+        handlers.push(remove)
+      }
+
+      // Remove all handlers
+      for (const remove of handlers) {
+        remove()
+      }
+
+      expect(true).toBe(true)
+    })
+
+    it('should handle handler removal in any order', () => {
+      const callbacks = Array.from({ length: 10 }, () => vi.fn())
+      const removers = callbacks.map(cb => onExit(cb))
+
+      // Remove in reverse order
+      for (let i = removers.length - 1; i >= 0; i--) {
+        removers[i]?.()
+      }
+
+      expect(true).toBe(true)
+    })
+  })
+})
diff --git a/test/registry/sorts.test.ts b/test/unit/sorts.test.ts
similarity index 95%
rename from test/registry/sorts.test.ts
rename to test/unit/sorts.test.ts
index 77baa72..cf9241c 100644
--- a/test/registry/sorts.test.ts
+++ b/test/unit/sorts.test.ts
@@ -1,5 +1,13 @@
 /**
- * @fileoverview Unit tests for sorting comparison functions.
+ * @fileoverview Unit tests for sorting and comparison utilities.
+ *
+ * Tests comparison functions for array sorting:
+ * - localeCompare() locale-aware string comparison
+ * - naturalCompare() natural/human-friendly string sorting (handles numbers)
+ * - compareStr() basic string comparison
+ * - compareSemver() semantic version comparison
+ * - naturalSorter() factory for natural sort comparisons
+ * Used by Socket tools for sorting package names, versions, and file paths.
  */
 
 import {
diff --git a/test/unit/spawn.test.ts b/test/unit/spawn.test.ts
new file mode 100644
index 0000000..11d17d8
--- /dev/null
+++ b/test/unit/spawn.test.ts
@@ -0,0 +1,516 @@
+/**
+ * @fileoverview Unit tests for process spawn utilities.
+ *
+ * Tests child process spawning utilities:
+ * - spawn() async process execution with options
+ * - spawnSync() synchronous process execution
+ * - isSpawnError() type guard for spawn errors
+ * - isStdioType() validates stdio option values
+ * - Error handling, exit codes, and output capture
+ * Used by Socket tools for git operations, npm commands, and external process execution.
+ */
+
+import {
+  isSpawnError,
+  isStdioType,
+  spawn,
+  spawnSync,
+} from '@socketsecurity/lib/spawn'
+import { describe, expect, it } from 'vitest'
+
+describe('spawn', () => {
+  describe('isSpawnError', () => {
+    it('should return true for error with code property', () => {
+      const error = { code: 1 }
+      expect(isSpawnError(error)).toBe(true)
+    })
+
+    it('should return true for error with errno property', () => {
+      const error = { errno: -2 }
+      expect(isSpawnError(error)).toBe(true)
+    })
+
+    it('should return true for error with syscall property', () => {
+      const error = { syscall: 'spawn' }
+      expect(isSpawnError(error)).toBe(true)
+    })
+
+    it('should return false for null', () => {
+      expect(isSpawnError(null)).toBe(false)
+    })
+
+    it('should return false for undefined', () => {
+      expect(isSpawnError(undefined)).toBe(false)
+    })
+
+    it('should return false for non-object', () => {
+      expect(isSpawnError('string')).toBe(false)
+      expect(isSpawnError(123)).toBe(false)
+      expect(isSpawnError(true)).toBe(false)
+    })
+
+    it('should return false for object without spawn error properties', () => {
+      expect(isSpawnError({})).toBe(false)
+      expect(isSpawnError({ message: 'error' })).toBe(false)
+    })
+
+    it('should handle error with undefined code', () => {
+      const error = { code: undefined, errno: 1 }
+      expect(isSpawnError(error)).toBe(true)
+    })
+  })
+
+  describe('isStdioType', () => {
+    describe('single argument mode (validation)', () => {
+      it('should return true for valid stdio types', () => {
+        expect(isStdioType('pipe')).toBe(true)
+        expect(isStdioType('ignore')).toBe(true)
+        expect(isStdioType('inherit')).toBe(true)
+        expect(isStdioType('overlapped')).toBe(true)
+      })
+
+      it('should return false for invalid types', () => {
+        expect(isStdioType('invalid')).toBe(false)
+        expect(isStdioType('ipc')).toBe(false) // 'ipc' is valid for spawn but not a base IOType
+        expect(isStdioType('')).toBe(false)
+      })
+
+      it('should return false for arrays', () => {
+        expect(isStdioType(['pipe'])).toBe(false)
+      })
+    })
+
+    describe('two argument mode (matching)', () => {
+      it('should match exact string types', () => {
+        expect(isStdioType('pipe', 'pipe')).toBe(true)
+        expect(isStdioType('ignore', 'ignore')).toBe(true)
+        expect(isStdioType('inherit', 'inherit')).toBe(true)
+      })
+
+      it('should not match different types', () => {
+        expect(isStdioType('pipe', 'ignore')).toBe(false)
+        expect(isStdioType('ignore', 'pipe')).toBe(false)
+      })
+
+      it('should treat null/undefined as pipe', () => {
+        expect(isStdioType(null as any, 'pipe')).toBe(true)
+        expect(isStdioType(undefined as any, 'pipe')).toBe(true)
+        expect(isStdioType(null as any, 'ignore')).toBe(false)
+      })
+
+      it('should match array with all elements same as type', () => {
+        expect(isStdioType(['pipe', 'pipe', 'pipe'], 'pipe')).toBe(true)
+        expect(isStdioType(['ignore', 'ignore', 'ignore'], 'ignore')).toBe(true)
+      })
+
+      it('should not match array with different elements', () => {
+        expect(isStdioType(['pipe', 'ignore', 'pipe'], 'pipe')).toBe(false)
+        expect(isStdioType(['pipe', 'pipe', 'ignore'], 'pipe')).toBe(false)
+      })
+
+      it('should not match array with less than 3 elements', () => {
+        expect(isStdioType(['pipe', 'pipe'], 'pipe')).toBe(false)
+        expect(isStdioType(['pipe'], 'pipe')).toBe(false)
+      })
+
+      it('should match array with more than 3 elements if first 3 match', () => {
+        expect(isStdioType(['pipe', 'pipe', 'pipe', 'inherit'], 'pipe')).toBe(
+          true,
+        )
+      })
+    })
+  })
+
+  describe('spawn', () => {
+    it('should spawn a simple command successfully', async () => {
+      const result = await spawn('echo', ['hello'])
+      expect(result.code).toBe(0)
+      expect(result.stdout).toContain('hello')
+    })
+
+    it('should spawn command without args', async () => {
+      const result = await spawn('pwd')
+      expect(result.code).toBe(0)
+      expect(typeof result.stdout).toBe('string')
+    })
+
+    it('should capture stdout', async () => {
+      const result = await spawn('echo', ['test output'])
+      expect(result.stdout).toContain('test output')
+    })
+
+    it('should return command and args in result', async () => {
+      const result = await spawn('echo', ['hello'])
+      expect(result.cmd).toBe('echo')
+      expect(result.args).toEqual(['hello'])
+    })
+
+    it('should handle commands with multiple args', async () => {
+      const result = await spawn('echo', ['arg1', 'arg2', 'arg3'])
+      expect(result.code).toBe(0)
+    })
+
+    it('should handle empty args array', async () => {
+      const result = await spawn('pwd', [])
+      expect(result.code).toBe(0)
+    })
+
+    it('should handle options with cwd', async () => {
+      const result = await spawn('pwd', [], {
+        cwd: process.cwd(),
+      })
+      expect(result.code).toBe(0)
+    })
+
+    it('should handle options with env', async () => {
+      const result = await spawn('echo', ['$TEST_VAR'], {
+        env: { TEST_VAR: 'test-value' },
+        shell: true,
+      })
+      expect(result.code).toBe(0)
+    })
+
+    it('should handle stdio: pipe (default)', async () => {
+      const result = await spawn('echo', ['hello'], {
+        stdio: 'pipe',
+      })
+      expect(result.code).toBe(0)
+      expect(result.stdout).toBeTruthy()
+    })
+
+    it('should handle stdio: inherit', async () => {
+      const result = await spawn('echo', ['hello'], {
+        stdio: 'inherit',
+      })
+      expect(result.code).toBe(0)
+    })
+
+    it('should handle stdio as array', async () => {
+      const result = await spawn('echo', ['hello'], {
+        stdio: ['pipe', 'pipe', 'pipe'],
+      })
+      expect(result.code).toBe(0)
+    })
+
+    it('should handle stdioString: true (default)', async () => {
+      const result = await spawn('echo', ['hello'], {
+        stdioString: true,
+      })
+      expect(typeof result.stdout).toBe('string')
+      expect(typeof result.stderr).toBe('string')
+    })
+
+    it('should handle stdioString: false', async () => {
+      const result = await spawn('echo', ['hello'], {
+        stdioString: false,
+      })
+      expect(Buffer.isBuffer(result.stdout)).toBe(true)
+      expect(Buffer.isBuffer(result.stderr)).toBe(true)
+    })
+
+    it('should strip ANSI codes by default', async () => {
+      // Test with a command that outputs ANSI codes
+      const result = await spawn('echo', ['-e', '\x1b[31mred\x1b[0m'], {
+        shell: true,
+      })
+      expect(result.code).toBe(0)
+      // ANSI codes should be stripped
+      expect(result.stdout).not.toContain('\x1b[31m')
+    })
+
+    it('should not strip ANSI codes when stripAnsi: false', async () => {
+      const result = await spawn('echo', ['-e', '\x1b[31mred\x1b[0m'], {
+        shell: true,
+        stripAnsi: false,
+      })
+      expect(result.code).toBe(0)
+    })
+
+    it('should handle readonly args array', async () => {
+      const args = ['hello'] as const
+      const result = await spawn('echo', args)
+      expect(result.code).toBe(0)
+    })
+
+    it('should throw error for non-zero exit code', async () => {
+      try {
+        await spawn('sh', ['-c', 'exit 1'])
+        expect.fail('Should have thrown')
+      } catch (error) {
+        expect(isSpawnError(error)).toBe(true)
+      }
+    })
+
+    it('should include stderr in error', async () => {
+      try {
+        await spawn('sh', ['-c', 'echo error >&2; exit 1'])
+        expect.fail('Should have thrown')
+      } catch (error: any) {
+        expect(error.stderr).toBeTruthy()
+      }
+    })
+
+    it('should have process property on result', () => {
+      const result = spawn('echo', ['hello'])
+      expect(result.process).toBeTruthy()
+      expect(typeof result.process.kill).toBe('function')
+    })
+
+    it('should have stdin property on result', async () => {
+      const result = spawn('cat', [])
+      expect(result.stdin).toBeTruthy()
+      result.process.kill()
+      // Wait for process to be killed
+      try {
+        await result
+      } catch {
+        // Expected to fail since we killed it
+      }
+    })
+
+    it('should handle Windows script extensions on Windows', async () => {
+      if (process.platform === 'win32') {
+        // On Windows, commands with .cmd/.bat extensions should be handled
+        const result = await spawn('npm.cmd', ['--version'], {
+          shell: true,
+        })
+        expect(result.code).toBe(0)
+      } else {
+        expect(true).toBe(true) // Skip on non-Windows
+      }
+    })
+
+    it('should handle shell option', async () => {
+      const result = await spawn('echo', ['$HOME'], {
+        shell: true,
+      })
+      expect(result.code).toBe(0)
+    })
+
+    it.skipIf(process.platform === 'win32')(
+      'should handle shell as string path',
+      async () => {
+        const result = await spawn('echo', ['hello'], {
+          shell: '/bin/sh',
+        })
+        expect(result.code).toBe(0)
+      },
+    )
+
+    it('should handle undefined args', async () => {
+      const result = await spawn('pwd', undefined)
+      expect(result.code).toBe(0)
+    })
+
+    it('should handle undefined options', async () => {
+      const result = await spawn('echo', ['hello'], undefined)
+      expect(result.code).toBe(0)
+    })
+
+    it('should handle empty options object', async () => {
+      const result = await spawn('echo', ['hello'], {})
+      expect(result.code).toBe(0)
+    })
+  })
+
+  describe('spawnSync', () => {
+    it('should spawn a simple command synchronously', () => {
+      const result = spawnSync('echo', ['hello'])
+      expect(result.status).toBe(0)
+      expect(result.stdout).toContain('hello')
+    })
+
+    it('should spawn command without args', () => {
+      const result = spawnSync('pwd')
+      expect(result.status).toBe(0)
+      expect(typeof result.stdout).toBe('string')
+    })
+
+    it('should capture stdout', () => {
+      const result = spawnSync('echo', ['test output'])
+      expect(result.stdout).toContain('test output')
+    })
+
+    it('should handle commands with multiple args', () => {
+      const result = spawnSync('echo', ['arg1', 'arg2', 'arg3'])
+      expect(result.status).toBe(0)
+    })
+
+    it('should handle empty args array', () => {
+      const result = spawnSync('pwd', [])
+      expect(result.status).toBe(0)
+    })
+
+    it('should handle options with cwd', () => {
+      const result = spawnSync('pwd', [], {
+        cwd: process.cwd(),
+      })
+      expect(result.status).toBe(0)
+    })
+
+    it('should handle options with env', () => {
+      const result = spawnSync('echo', ['$TEST_VAR'], {
+        env: { TEST_VAR: 'test-value' },
+        shell: true,
+      })
+      expect(result.status).toBe(0)
+    })
+
+    it('should handle stdioString: true (default)', () => {
+      const result = spawnSync('echo', ['hello'], {
+        stdioString: true,
+      })
+      expect(typeof result.stdout).toBe('string')
+      expect(typeof result.stderr).toBe('string')
+    })
+
+    it('should handle stdioString: false', () => {
+      const result = spawnSync('echo', ['hello'], {
+        stdioString: false,
+      })
+      expect(Buffer.isBuffer(result.stdout)).toBe(true)
+      expect(Buffer.isBuffer(result.stderr)).toBe(true)
+    })
+
+    it('should strip ANSI codes by default', () => {
+      const result = spawnSync('echo', ['-e', '\x1b[31mred\x1b[0m'], {
+        shell: true,
+      })
+      expect(result.status).toBe(0)
+    })
+
+    it('should not strip ANSI codes when stripAnsi: false', () => {
+      const result = spawnSync('echo', ['-e', '\x1b[31mred\x1b[0m'], {
+        shell: true,
+        stripAnsi: false,
+      })
+      expect(result.status).toBe(0)
+    })
+
+    it('should handle readonly args array', () => {
+      const args = ['hello'] as const
+      const result = spawnSync('echo', args)
+      expect(result.status).toBe(0)
+    })
+
+    it('should return non-zero status for failed command', () => {
+      const result = spawnSync('sh', ['-c', 'exit 1'])
+      expect(result.status).toBe(1)
+    })
+
+    it('should capture stderr', () => {
+      const result = spawnSync('sh', ['-c', 'echo error >&2'])
+      expect(result.stderr).toContain('error')
+    })
+
+    it('should have output array', () => {
+      const result = spawnSync('echo', ['hello'])
+      expect(Array.isArray(result.output)).toBe(true)
+    })
+
+    it('should handle Windows script extensions on Windows', () => {
+      if (process.platform === 'win32') {
+        const result = spawnSync('npm.cmd', ['--version'], {
+          shell: true,
+        })
+        expect(result.status).toBe(0)
+      } else {
+        expect(true).toBe(true) // Skip on non-Windows
+      }
+    })
+
+    it('should handle shell option', () => {
+      const result = spawnSync('echo', ['$HOME'], {
+        shell: true,
+      })
+      expect(result.status).toBe(0)
+    })
+
+    it.skipIf(process.platform === 'win32')(
+      'should handle shell as string path',
+      () => {
+        const result = spawnSync('echo', ['hello'], {
+          shell: '/bin/sh',
+        })
+        expect(result.status).toBe(0)
+      },
+    )
+
+    it('should handle undefined args', () => {
+      const result = spawnSync('pwd', undefined)
+      expect(result.status).toBe(0)
+    })
+
+    it('should handle undefined options', () => {
+      const result = spawnSync('echo', ['hello'], undefined)
+      expect(result.status).toBe(0)
+    })
+
+    it('should handle empty options object', () => {
+      const result = spawnSync('echo', ['hello'], {})
+      expect(result.status).toBe(0)
+    })
+
+    it('should have signal property', () => {
+      const result = spawnSync('echo', ['hello'])
+      expect('signal' in result).toBe(true)
+    })
+
+    it('should have pid property', () => {
+      const result = spawnSync('echo', ['hello'])
+      expect(typeof result.pid).toBe('number')
+      expect(result.pid).toBeGreaterThan(0)
+    })
+  })
+
+  describe('error cases', () => {
+    it('should handle non-existent command (spawn)', async () => {
+      try {
+        await spawn('nonexistent-command-12345')
+        expect.fail('Should have thrown')
+      } catch (error) {
+        expect(isSpawnError(error)).toBe(true)
+      }
+    })
+
+    it('should handle non-existent command (spawnSync)', () => {
+      const result = spawnSync('nonexistent-command-12345')
+      expect(result.error).toBeTruthy()
+    })
+
+    it('should handle command with invalid args', async () => {
+      try {
+        await spawn('ls', ['--invalid-flag-that-does-not-exist-xyz'])
+        expect.fail('Should have thrown')
+      } catch (error) {
+        expect(isSpawnError(error)).toBe(true)
+      }
+    })
+  })
+
+  describe('cross-platform behavior', () => {
+    it('should work on current platform', () => {
+      const result = spawnSync('echo', ['hello'])
+      expect(result.status).toBe(0)
+    })
+
+    it('should handle platform-specific line endings', () => {
+      const result = spawnSync('echo', ['hello'])
+      expect(result.stdout).toBeTruthy()
+    })
+  })
+
+  describe('security', () => {
+    it('should safely handle user input in args array', async () => {
+      const userInput = '; rm -rf /'
+      const result = await spawn('echo', [userInput])
+      expect(result.stdout).toContain(';')
+      expect(result.stdout).toContain('rm')
+    })
+
+    it('should safely handle special characters', async () => {
+      const result = await spawn('echo', ['$PATH', '&&', 'echo', 'test'])
+      expect(result.code).toBe(0)
+    })
+  })
+})
diff --git a/test/unit/spinner.test.ts b/test/unit/spinner.test.ts
new file mode 100644
index 0000000..d99b174
--- /dev/null
+++ b/test/unit/spinner.test.ts
@@ -0,0 +1,719 @@
+/**
+ * @fileoverview Unit tests for spinner animation utilities.
+ *
+ * Tests spinner animation wrappers and lifecycle:
+ * - withSpinner() wraps async operations with animated spinner
+ * - withSpinnerSync() wraps sync operations with spinner
+ * - Spinner class for manual control (start, stop, update text)
+ * - Color preservation after spinner operations
+ * - CI detection: spinners disabled in CI environments
+ * Used by Socket CLI for long-running operations (package scanning, API calls).
+ */
+
+import {
+  getCliSpinners,
+  Spinner,
+  withSpinner,
+  withSpinnerSync,
+} from '@socketsecurity/lib/spinner'
+import { beforeEach, describe, expect, it, vi } from 'vitest'
+
+describe('spinner', () => {
+  // Mock stdout/stderr to prevent actual spinner output during tests
+  beforeEach(() => {
+    vi.spyOn(process.stdout, 'write').mockImplementation(() => true)
+    vi.spyOn(process.stderr, 'write').mockImplementation(() => true)
+  })
+
+  describe('withSpinner', () => {
+    it('should restore color after operation', async () => {
+      const spinner = Spinner({ color: [140, 82, 255] })
+      const originalColor = spinner.color
+
+      await withSpinner({
+        message: 'Testing...',
+        operation: async () => {
+          // During operation, color should be red
+          expect(spinner.color).toEqual([255, 0, 0])
+        },
+        spinner,
+        withOptions: {
+          color: [255, 0, 0], // Red
+        },
+      })
+
+      // After operation, color should be restored
+      expect(spinner.color).toEqual(originalColor)
+    })
+
+    it('should restore color after operation with named color', async () => {
+      const spinner = Spinner({ color: 'cyan' })
+      const originalColor = spinner.color
+
+      await withSpinner({
+        message: 'Testing...',
+        operation: async () => {
+          // Just verify operation runs
+          expect(true).toBe(true)
+        },
+        spinner,
+        withOptions: {
+          color: 'red',
+        },
+      })
+
+      // After operation, color should be restored
+      expect(spinner.color).toEqual(originalColor)
+    })
+
+    it('should restore shimmer state after operation', async () => {
+      const spinner = Spinner({ shimmer: { dir: 'ltr', speed: 0.5 } })
+      const originalShimmer = spinner.shimmerState
+
+      await withSpinner({
+        message: 'Testing...',
+        operation: async () => {
+          // During operation, shimmer should be different
+          expect(spinner.shimmerState?.mode).toBe('rtl')
+        },
+        spinner,
+        withOptions: {
+          shimmer: { dir: 'rtl' },
+        },
+      })
+
+      // After operation, shimmer should be restored
+      expect(spinner.shimmerState?.mode).toBe(originalShimmer?.mode)
+      expect(spinner.shimmerState?.speed).toBe(originalShimmer?.speed)
+    })
+
+    it('should disable shimmer after operation if it was disabled before', async () => {
+      const spinner = Spinner() // No shimmer
+
+      await withSpinner({
+        message: 'Testing...',
+        operation: async () => {
+          // During operation, shimmer should be enabled
+          expect(spinner.shimmerState).toBeDefined()
+        },
+        spinner,
+        withOptions: {
+          shimmer: { dir: 'ltr' },
+        },
+      })
+
+      // After operation, shimmer should be disabled again
+      expect(spinner.shimmerState).toBeUndefined()
+    })
+
+    it('should work without withOptions', async () => {
+      const spinner = Spinner({ color: [140, 82, 255] })
+      const originalColor = spinner.color
+
+      await withSpinner({
+        message: 'Testing...',
+        operation: async () => {
+          expect(true).toBe(true)
+        },
+        spinner,
+      })
+
+      // Color should remain unchanged
+      expect(spinner.color).toEqual(originalColor)
+    })
+
+    it('should work without spinner instance', async () => {
+      const result = await withSpinner({
+        message: 'Testing...',
+        operation: async () => 42,
+      })
+
+      expect(result).toBe(42)
+    })
+
+    it('should restore state even if operation throws', async () => {
+      const spinner = Spinner({ color: [140, 82, 255] })
+      const originalColor = spinner.color
+
+      await expect(
+        withSpinner({
+          message: 'Testing...',
+          operation: async () => {
+            throw new Error('Test error')
+          },
+          spinner,
+          withOptions: {
+            color: [255, 0, 0],
+          },
+        }),
+      ).rejects.toThrow('Test error')
+
+      // Color should still be restored
+      expect(spinner.color).toEqual(originalColor)
+    })
+  })
+
+  describe('withSpinnerSync', () => {
+    it('should restore color after operation', () => {
+      const spinner = Spinner({ color: [140, 82, 255] })
+      const originalColor = spinner.color
+
+      withSpinnerSync({
+        message: 'Testing...',
+        operation: () => {
+          // During operation, color should be red
+          expect(spinner.color).toEqual([255, 0, 0])
+        },
+        spinner,
+        withOptions: {
+          color: [255, 0, 0], // Red
+        },
+      })
+
+      // After operation, color should be restored
+      expect(spinner.color).toEqual(originalColor)
+    })
+
+    it('should restore shimmer state after operation', () => {
+      const spinner = Spinner({ shimmer: { dir: 'ltr', speed: 0.5 } })
+      const originalShimmer = spinner.shimmerState
+
+      withSpinnerSync({
+        message: 'Testing...',
+        operation: () => {
+          // During operation, shimmer should be different
+          expect(spinner.shimmerState?.mode).toBe('rtl')
+        },
+        spinner,
+        withOptions: {
+          shimmer: { dir: 'rtl' },
+        },
+      })
+
+      // After operation, shimmer should be restored
+      expect(spinner.shimmerState?.mode).toBe(originalShimmer?.mode)
+      expect(spinner.shimmerState?.speed).toBe(originalShimmer?.speed)
+    })
+
+    it('should work without withOptions', () => {
+      const spinner = Spinner({ color: [140, 82, 255] })
+      const originalColor = spinner.color
+
+      withSpinnerSync({
+        message: 'Testing...',
+        operation: () => {
+          expect(true).toBe(true)
+        },
+        spinner,
+      })
+
+      // Color should remain unchanged
+      expect(spinner.color).toEqual(originalColor)
+    })
+
+    it('should restore state even if operation throws', () => {
+      const spinner = Spinner({ color: [140, 82, 255] })
+      const originalColor = spinner.color
+
+      expect(() => {
+        withSpinnerSync({
+          message: 'Testing...',
+          operation: () => {
+            throw new Error('Test error')
+          },
+          spinner,
+          withOptions: {
+            color: [255, 0, 0],
+          },
+        })
+      }).toThrow('Test error')
+
+      // Color should still be restored
+      expect(spinner.color).toEqual(originalColor)
+    })
+  })
+
+  describe('Spinner methods', () => {
+    it('should support reason() method', () => {
+      const spinner = Spinner()
+      const result = spinner.reason('reasoning message')
+      expect(result).toBe(spinner)
+    })
+
+    it('should support reasonAndStop() method', () => {
+      const spinner = Spinner()
+      spinner.start()
+      const result = spinner.reasonAndStop('final reasoning')
+      expect(result).toBe(spinner)
+      expect(spinner.isSpinning).toBe(false)
+    })
+
+    it('should chain reason() calls', () => {
+      const spinner = Spinner()
+      const result = spinner
+        .reason('first reason')
+        .reason('second reason')
+        .reason('third reason')
+      expect(result).toBe(spinner)
+    })
+  })
+
+  describe('Status methods (show status while continuing to spin)', () => {
+    it('should support debug() method', () => {
+      const spinner = Spinner()
+      spinner.start()
+      const result = spinner.debug('debug message')
+      expect(result).toBe(spinner)
+      expect(spinner.isSpinning).toBe(true)
+    })
+
+    it('should support done() method', () => {
+      const spinner = Spinner()
+      spinner.start()
+      const result = spinner.done('done message')
+      expect(result).toBe(spinner)
+      expect(spinner.isSpinning).toBe(true)
+    })
+
+    it('should support error() method', () => {
+      const spinner = Spinner()
+      spinner.start()
+      const result = spinner.error('error message')
+      expect(result).toBe(spinner)
+      expect(spinner.isSpinning).toBe(true)
+    })
+
+    it('should support fail() method', () => {
+      const spinner = Spinner()
+      spinner.start()
+      const result = spinner.fail('fail message')
+      expect(result).toBe(spinner)
+      expect(spinner.isSpinning).toBe(true)
+    })
+
+    it('should support info() method', () => {
+      const spinner = Spinner()
+      spinner.start()
+      const result = spinner.info('info message')
+      expect(result).toBe(spinner)
+      expect(spinner.isSpinning).toBe(true)
+    })
+
+    it('should support log() method', () => {
+      const spinner = Spinner()
+      spinner.start()
+      const result = spinner.log('log message')
+      expect(result).toBe(spinner)
+      expect(spinner.isSpinning).toBe(true)
+    })
+
+    it('should support step() method', () => {
+      const spinner = Spinner()
+      spinner.start()
+      const result = spinner.step('step message')
+      expect(result).toBe(spinner)
+      expect(spinner.isSpinning).toBe(true)
+    })
+
+    it('should support substep() method', () => {
+      const spinner = Spinner()
+      spinner.start()
+      const result = spinner.substep('substep message')
+      expect(result).toBe(spinner)
+      expect(spinner.isSpinning).toBe(true)
+    })
+
+    it('should support success() method', () => {
+      const spinner = Spinner()
+      spinner.start()
+      const result = spinner.success('success message')
+      expect(result).toBe(spinner)
+      expect(spinner.isSpinning).toBe(true)
+    })
+
+    it('should support warn() method', () => {
+      const spinner = Spinner()
+      spinner.start()
+      const result = spinner.warn('warning message')
+      expect(result).toBe(spinner)
+      expect(spinner.isSpinning).toBe(true)
+    })
+  })
+
+  describe('AndStop methods (show status and stop spinning)', () => {
+    it('should support debugAndStop() method', () => {
+      const spinner = Spinner()
+      spinner.start()
+      const result = spinner.debugAndStop('debug message')
+      expect(result).toBe(spinner)
+      // debugAndStop only stops if debug mode is enabled
+      // In test environment, debug mode is typically disabled
+      // So spinner continues running
+    })
+
+    it('should support doneAndStop() method', () => {
+      const spinner = Spinner()
+      spinner.start()
+      const result = spinner.doneAndStop('done message')
+      expect(result).toBe(spinner)
+      expect(spinner.isSpinning).toBe(false)
+    })
+
+    it('should support errorAndStop() method', () => {
+      const spinner = Spinner()
+      spinner.start()
+      const result = spinner.errorAndStop('error message')
+      expect(result).toBe(spinner)
+      expect(spinner.isSpinning).toBe(false)
+    })
+
+    it('should support failAndStop() method', () => {
+      const spinner = Spinner()
+      spinner.start()
+      const result = spinner.failAndStop('fail message')
+      expect(result).toBe(spinner)
+      expect(spinner.isSpinning).toBe(false)
+    })
+
+    it('should support infoAndStop() method', () => {
+      const spinner = Spinner()
+      spinner.start()
+      const result = spinner.infoAndStop('info message')
+      expect(result).toBe(spinner)
+      expect(spinner.isSpinning).toBe(false)
+    })
+
+    it('should support logAndStop() method', () => {
+      const spinner = Spinner()
+      spinner.start()
+      const result = spinner.logAndStop('log message')
+      expect(result).toBe(spinner)
+      expect(spinner.isSpinning).toBe(false)
+    })
+
+    it('should support successAndStop() method', () => {
+      const spinner = Spinner()
+      spinner.start()
+      const result = spinner.successAndStop('success message')
+      expect(result).toBe(spinner)
+      expect(spinner.isSpinning).toBe(false)
+    })
+
+    it('should support warnAndStop() method', () => {
+      const spinner = Spinner()
+      spinner.start()
+      const result = spinner.warnAndStop('warning message')
+      expect(result).toBe(spinner)
+      expect(spinner.isSpinning).toBe(false)
+    })
+  })
+
+  describe('Shimmer methods', () => {
+    it('should enable shimmer with default settings', () => {
+      const spinner = Spinner()
+      const result = spinner.enableShimmer()
+      expect(result).toBe(spinner)
+      expect(spinner.shimmerState).toBeDefined()
+    })
+
+    it('should disable shimmer', () => {
+      const spinner = Spinner({ shimmer: { dir: 'ltr' } })
+      expect(spinner.shimmerState).toBeDefined()
+
+      const result = spinner.disableShimmer()
+      expect(result).toBe(spinner)
+      expect(spinner.shimmerState).toBeUndefined()
+    })
+
+    it('should set shimmer configuration', () => {
+      const spinner = Spinner()
+      const result = spinner.setShimmer({ dir: 'rtl', speed: 2 })
+      expect(result).toBe(spinner)
+      expect(spinner.shimmerState).toBeDefined()
+      expect(spinner.shimmerState?.mode).toBe('rtl')
+      expect(spinner.shimmerState?.speed).toBe(2)
+    })
+
+    it('should update shimmer configuration', () => {
+      const spinner = Spinner({ shimmer: { dir: 'ltr', speed: 1 } })
+      const result = spinner.updateShimmer({ speed: 3 })
+      expect(result).toBe(spinner)
+      expect(spinner.shimmerState?.mode).toBe('ltr')
+      expect(spinner.shimmerState?.speed).toBe(3)
+    })
+
+    it('should chain shimmer calls', () => {
+      const spinner = Spinner()
+      const result = spinner
+        .enableShimmer()
+        .updateShimmer({ speed: 2 })
+        .disableShimmer()
+        .enableShimmer()
+      expect(result).toBe(spinner)
+    })
+  })
+
+  describe('Progress methods', () => {
+    it('should update progress', () => {
+      const spinner = Spinner()
+      spinner.start()
+      const result = spinner.progress(50, 100)
+      expect(result).toBe(spinner)
+    })
+
+    it('should update progress with unit', () => {
+      const spinner = Spinner()
+      spinner.start()
+      const result = spinner.progress(25, 100, 'files')
+      expect(result).toBe(spinner)
+    })
+
+    it('should increment progress step', () => {
+      const spinner = Spinner()
+      spinner.start()
+      spinner.progress(0, 100)
+      const result = spinner.progressStep(10)
+      expect(result).toBe(spinner)
+    })
+
+    it('should increment progress step by default amount', () => {
+      const spinner = Spinner()
+      spinner.start()
+      spinner.progress(0, 100)
+      const result = spinner.progressStep()
+      expect(result).toBe(spinner)
+    })
+
+    it('should chain progress calls', () => {
+      const spinner = Spinner()
+      const result = spinner
+        .start()
+        .progress(10, 100, 'items')
+        .progressStep(5)
+        .progressStep(5)
+      expect(result).toBe(spinner)
+    })
+  })
+
+  describe('Indentation methods', () => {
+    it('should indent with default spaces', () => {
+      const spinner = Spinner()
+      const result = spinner.indent()
+      expect(result).toBe(spinner)
+    })
+
+    it('should indent with custom spaces', () => {
+      const spinner = Spinner()
+      const result = spinner.indent(4)
+      expect(result).toBe(spinner)
+    })
+
+    it('should dedent with default spaces', () => {
+      const spinner = Spinner()
+      spinner.indent()
+      const result = spinner.dedent()
+      expect(result).toBe(spinner)
+    })
+
+    it('should dedent with custom spaces', () => {
+      const spinner = Spinner()
+      spinner.indent(4)
+      const result = spinner.dedent(4)
+      expect(result).toBe(spinner)
+    })
+
+    it('should chain indentation calls', () => {
+      const spinner = Spinner()
+      const result = spinner
+        .indent()
+        .step('indented step')
+        .indent()
+        .substep('double indented substep')
+        .dedent()
+        .dedent()
+      expect(result).toBe(spinner)
+    })
+  })
+
+  describe('Text and control methods', () => {
+    it('should set text using text() method', () => {
+      const spinner = Spinner({ text: 'initial' })
+      const result = spinner.text('updated')
+      expect(result).toBe(spinner)
+      expect(spinner.text()).toBe('updated')
+    })
+
+    it('should get text using text() method after setting', () => {
+      const spinner = Spinner()
+      spinner.text('test message')
+      expect(spinner.text()).toBe('test message')
+    })
+
+    it('should clear spinner', () => {
+      const spinner = Spinner({ text: 'test' })
+      spinner.start()
+      const result = spinner.clear()
+      expect(result).toBe(spinner)
+    })
+
+    it('should start spinner', () => {
+      const spinner = Spinner()
+      const result = spinner.start('loading...')
+      expect(result).toBe(spinner)
+      expect(spinner.isSpinning).toBe(true)
+    })
+
+    it('should stop spinner', () => {
+      const spinner = Spinner()
+      spinner.start()
+      const result = spinner.stop('done')
+      expect(result).toBe(spinner)
+      expect(spinner.isSpinning).toBe(false)
+    })
+
+    it('should stop spinner with stop()', () => {
+      const spinner = Spinner()
+      spinner.start()
+      spinner.stop()
+      expect(spinner.isSpinning).toBe(false)
+      // Text is cleared after stop
+      expect(spinner.text()).toBe('')
+    })
+  })
+
+  describe('Color handling', () => {
+    it('should set color with RGB tuple', () => {
+      const spinner = Spinner()
+      spinner.color = [255, 100, 50]
+      expect(spinner.color).toEqual([255, 100, 50])
+    })
+
+    it('should initialize with RGB color', () => {
+      const spinner = Spinner({ color: [140, 82, 255] })
+      expect(spinner.color).toEqual([140, 82, 255])
+    })
+
+    it('should initialize with named color', () => {
+      const spinner = Spinner({ color: 'red' })
+      expect(spinner.color).toEqual([255, 0, 0])
+    })
+
+    it('should convert named color to RGB', () => {
+      const spinner = Spinner({ color: 'cyan' })
+      // Getter always returns RGB
+      expect(spinner.color).toEqual([0, 255, 255])
+    })
+  })
+
+  describe('Method chaining', () => {
+    it('should chain multiple status methods', () => {
+      const spinner = Spinner()
+      const result = spinner
+        .start('Starting...')
+        .info('Info message')
+        .warn('Warning message')
+        .success('Success message')
+      expect(result).toBe(spinner)
+      expect(spinner.isSpinning).toBe(true)
+    })
+
+    it('should chain complex workflow', () => {
+      const spinner = Spinner({ color: 'cyan' })
+      const result = spinner
+        .start('Processing...')
+        .enableShimmer()
+        .indent()
+        .step('Step 1')
+        .progress(33, 100)
+        .step('Step 2')
+        .progress(66, 100)
+        .step('Step 3')
+        .progress(100, 100)
+        .dedent()
+        .disableShimmer()
+        .successAndStop('Complete!')
+      expect(result).toBe(spinner)
+      expect(spinner.isSpinning).toBe(false)
+    })
+  })
+
+  describe('Edge cases', () => {
+    it('should handle empty text messages', () => {
+      const spinner = Spinner()
+      const result = spinner.start().info().warn().success()
+      expect(result).toBe(spinner)
+    })
+
+    it('should handle undefined text messages', () => {
+      const spinner = Spinner()
+      const result = spinner.info(undefined).warn(undefined)
+      expect(result).toBe(spinner)
+    })
+
+    it('should handle stopping already stopped spinner', () => {
+      const spinner = Spinner()
+      spinner.start()
+      spinner.stop()
+      const result = spinner.stop()
+      expect(result).toBe(spinner)
+      expect(spinner.isSpinning).toBe(false)
+    })
+
+    it('should handle starting already running spinner', () => {
+      const spinner = Spinner()
+      spinner.start()
+      const result = spinner.start('new text')
+      expect(result).toBe(spinner)
+      expect(spinner.isSpinning).toBe(true)
+    })
+
+    it('should handle disabling already disabled shimmer', () => {
+      const spinner = Spinner()
+      const result = spinner.disableShimmer()
+      expect(result).toBe(spinner)
+      expect(spinner.shimmerState).toBeUndefined()
+    })
+
+    it('should handle multiple dedents beyond zero indentation', () => {
+      const spinner = Spinner()
+      const result = spinner.dedent().dedent().dedent()
+      expect(result).toBe(spinner)
+    })
+  })
+
+  describe('getCliSpinners', () => {
+    it('should return socket custom spinner', () => {
+      const socket = getCliSpinners('socket')
+      expect(socket).toBeDefined()
+      expect(socket.frames).toBeDefined()
+      expect(socket.interval).toBeDefined()
+    })
+
+    it('should return undefined for non-existent spinner', () => {
+      const result = getCliSpinners('non-existent-spinner')
+      expect(result).toBeUndefined()
+    })
+
+    it('should cache spinner styles', () => {
+      const first = getCliSpinners()
+      const second = getCliSpinners()
+      expect(first).toBe(second)
+    })
+  })
+
+  describe('Stream handling', () => {
+    it('should accept custom stream', () => {
+      const customStream = process.stderr
+      const spinner = Spinner({ stream: customStream })
+      expect(spinner).toBeDefined()
+    })
+
+    it('should work with stderr', () => {
+      const spinner = Spinner({ stream: process.stderr })
+      spinner.start()
+      spinner.text('test')
+      spinner.stop()
+      expect(spinner.isSpinning).toBe(false)
+    })
+  })
+})
diff --git a/test/unit/ssri.test.ts b/test/unit/ssri.test.ts
new file mode 100644
index 0000000..7d7b79f
--- /dev/null
+++ b/test/unit/ssri.test.ts
@@ -0,0 +1,391 @@
+/**
+ * @fileoverview Unit tests for Subresource Integrity (SSRI) hash utilities.
+ *
+ * Tests SSRI (Subresource Integrity) hash format utilities:
+ * - ssriToHex() converts SSRI format to hex string
+ * - hexToSsri() converts hex string to SSRI format
+ * - parseSsri() parses SSRI strings into components
+ * - isValidSsri() validates SSRI format strings
+ * - isValidHex() validates hex hash strings
+ * - Supports sha256, sha384, sha512 algorithms
+ * Used by Socket tools for package integrity verification.
+ */
+
+import {
+  hexToSsri,
+  isValidHex,
+  isValidSsri,
+  parseSsri,
+  ssriToHex,
+} from '@socketsecurity/lib/ssri'
+import { describe, expect, it } from 'vitest'
+
+describe('ssri', () => {
+  describe('ssriToHex', () => {
+    it('should convert sha256 SSRI to hex', () => {
+      const ssri = 'sha256-dmgqn8O75il1F24lQfOagWiHfYKNXK2LVkYfw2rCuFY='
+      const hex = ssriToHex(ssri)
+      expect(hex).toBe(
+        '76682a9fc3bbe62975176e2541f39a8168877d828d5cad8b56461fc36ac2b856',
+      )
+    })
+
+    it('should convert sha512 SSRI to hex', () => {
+      const ssri = 'sha512-AAAA'
+      const hex = ssriToHex(ssri)
+      expect(hex.length).toBeGreaterThan(0)
+    })
+
+    it('should handle different algorithms', () => {
+      const ssri = 'sha1-qUqP5cyxm6YcTAhz05Hph5gvu9M='
+      const hex = ssriToHex(ssri)
+      expect(hex).toBe('a94a8fe5ccb19ba61c4c0873d391e987982fbbd3')
+    })
+
+    it('should throw on invalid SSRI format', () => {
+      expect(() => ssriToHex('invalid')).toThrow('Invalid SSRI format')
+    })
+
+    it('should throw on missing algorithm', () => {
+      expect(() => ssriToHex('-AAAA')).toThrow('Invalid SSRI format')
+    })
+
+    it('should throw on missing hash', () => {
+      expect(() => ssriToHex('sha256-')).toThrow('Invalid SSRI format')
+    })
+
+    it('should throw on hash too short', () => {
+      expect(() => ssriToHex('sha256-A')).toThrow('Invalid SSRI format')
+    })
+
+    it('should handle uppercase algorithm names', () => {
+      const ssri = 'SHA256-AAAA'
+      const hex = ssriToHex(ssri)
+      expect(hex.length).toBeGreaterThan(0)
+    })
+
+    it('should handle mixed case', () => {
+      const ssri = 'Sha256-AAAA'
+      const hex = ssriToHex(ssri)
+      expect(hex.length).toBeGreaterThan(0)
+    })
+  })
+
+  describe('hexToSsri', () => {
+    it('should convert hex to sha256 SSRI', () => {
+      const hex =
+        '76682a9fc3bbe62975176e2541f39a8168877d828d5cad8b56461fc36ac2b856'
+      const ssri = hexToSsri(hex)
+      expect(ssri).toBe('sha256-dmgqn8O75il1F24lQfOagWiHfYKNXK2LVkYfw2rCuFY=')
+    })
+
+    it('should use default algorithm sha256', () => {
+      const hex = 'abcd1234'
+      const ssri = hexToSsri(hex)
+      expect(ssri).toMatch(/^sha256-/)
+    })
+
+    it('should accept custom algorithm', () => {
+      const hex = 'abcd1234'
+      const ssri = hexToSsri(hex, 'sha512')
+      expect(ssri).toMatch(/^sha512-/)
+    })
+
+    it('should throw on invalid hex format', () => {
+      expect(() => hexToSsri('not-hex-format')).toThrow('Invalid hex format')
+    })
+
+    it('should throw on invalid characters', () => {
+      expect(() => hexToSsri('ghijklmn')).toThrow('Invalid hex format')
+    })
+
+    it('should handle uppercase hex', () => {
+      const hex = 'ABCD1234'
+      const ssri = hexToSsri(hex)
+      expect(ssri).toMatch(/^sha256-/)
+    })
+
+    it('should handle mixed case hex', () => {
+      const hex = 'AbCd1234'
+      const ssri = hexToSsri(hex)
+      expect(ssri).toMatch(/^sha256-/)
+    })
+
+    it('should handle short hex values', () => {
+      const hex = 'ab'
+      const ssri = hexToSsri(hex)
+      expect(ssri).toMatch(/^sha256-/)
+    })
+
+    it('should handle long hex values', () => {
+      const hex = 'a'.repeat(128)
+      const ssri = hexToSsri(hex)
+      expect(ssri).toMatch(/^sha256-/)
+    })
+  })
+
+  describe('isValidSsri', () => {
+    it('should validate correct sha256 SSRI', () => {
+      expect(
+        isValidSsri('sha256-dmgqn8O75il1F24lQfOagWiHfYKNXK2LVkYfw2rCuFY='),
+      ).toBe(true)
+    })
+
+    it('should validate correct sha512 SSRI', () => {
+      expect(isValidSsri('sha512-AAAA')).toBe(true)
+    })
+
+    it('should validate with padding', () => {
+      expect(isValidSsri('sha256-AAAA==')).toBe(true)
+    })
+
+    it('should validate without padding', () => {
+      expect(isValidSsri('sha256-AAAA')).toBe(true)
+    })
+
+    it('should validate different algorithms', () => {
+      expect(isValidSsri('sha1-qUqP5cyxm6YcTAhz05Hph5gvu9M=')).toBe(true)
+      expect(isValidSsri('md5-rL0Y20zC+Fzt72VPzMSk2A==')).toBe(true)
+    })
+
+    it('should validate uppercase algorithms', () => {
+      expect(isValidSsri('SHA256-AAAA')).toBe(true)
+    })
+
+    it('should invalidate plain hex', () => {
+      expect(
+        isValidSsri(
+          '76682a9fc3bbe62975176e2541f39a8168877d828d5cad8b56461fc36ac2b856',
+        ),
+      ).toBe(false)
+    })
+
+    it('should invalidate missing algorithm', () => {
+      expect(isValidSsri('-AAAA')).toBe(false)
+    })
+
+    it('should invalidate missing hash', () => {
+      expect(isValidSsri('sha256-')).toBe(false)
+    })
+
+    it('should invalidate hash too short', () => {
+      expect(isValidSsri('sha256-A')).toBe(false)
+    })
+
+    it('should invalidate empty string', () => {
+      expect(isValidSsri('')).toBe(false)
+    })
+
+    it('should invalidate no dash separator', () => {
+      expect(isValidSsri('sha256AAAA')).toBe(false)
+    })
+
+    it('should handle base64 special characters', () => {
+      expect(isValidSsri('sha256-A+B/C==')).toBe(true)
+    })
+  })
+
+  describe('isValidHex', () => {
+    it('should validate lowercase hex', () => {
+      expect(isValidHex('abcdef0123456789')).toBe(true)
+    })
+
+    it('should validate uppercase hex', () => {
+      expect(isValidHex('ABCDEF0123456789')).toBe(true)
+    })
+
+    it('should validate mixed case hex', () => {
+      expect(isValidHex('AbCdEf0123456789')).toBe(true)
+    })
+
+    it('should validate short hex', () => {
+      expect(isValidHex('ab')).toBe(true)
+    })
+
+    it('should validate long hex', () => {
+      expect(isValidHex('a'.repeat(128))).toBe(true)
+    })
+
+    it('should invalidate SSRI format', () => {
+      expect(
+        isValidHex('sha256-dmgqn8O75il1F24lQfOagWiHfYKNXK2LVkYfw2rCuFY='),
+      ).toBe(false)
+    })
+
+    it('should invalidate non-hex characters', () => {
+      expect(isValidHex('ghijklmn')).toBe(false)
+    })
+
+    it('should invalidate special characters', () => {
+      expect(isValidHex('abcd-efgh')).toBe(false)
+    })
+
+    it('should invalidate empty string', () => {
+      expect(isValidHex('')).toBe(false)
+    })
+
+    it('should invalidate spaces', () => {
+      expect(isValidHex('ab cd')).toBe(false)
+    })
+
+    it('should invalidate base64', () => {
+      expect(isValidHex('AAAA+BBB/CCC=')).toBe(false)
+    })
+  })
+
+  describe('parseSsri', () => {
+    it('should parse sha256 SSRI', () => {
+      const result = parseSsri(
+        'sha256-dmgqn8O75il1F24lQfOagWiHfYKNXK2LVkYfw2rCuFY=',
+      )
+      expect(result.algorithm).toBe('sha256')
+      expect(result.base64Hash).toBe(
+        'dmgqn8O75il1F24lQfOagWiHfYKNXK2LVkYfw2rCuFY=',
+      )
+    })
+
+    it('should parse sha512 SSRI', () => {
+      const result = parseSsri('sha512-AAAA')
+      expect(result.algorithm).toBe('sha512')
+      expect(result.base64Hash).toBe('AAAA')
+    })
+
+    it('should parse sha1 SSRI', () => {
+      const result = parseSsri('sha1-qUqP5cyxm6YcTAhz05Hph5gvu9M=')
+      expect(result.algorithm).toBe('sha1')
+      expect(result.base64Hash).toBe('qUqP5cyxm6YcTAhz05Hph5gvu9M=')
+    })
+
+    it('should handle uppercase algorithm', () => {
+      const result = parseSsri('SHA256-AAAA')
+      expect(result.algorithm).toBe('SHA256')
+      expect(result.base64Hash).toBe('AAAA')
+    })
+
+    it('should handle mixed case algorithm', () => {
+      const result = parseSsri('Sha256-AAAA')
+      expect(result.algorithm).toBe('Sha256')
+    })
+
+    it('should throw on invalid format', () => {
+      expect(() => parseSsri('invalid')).toThrow('Invalid SSRI format')
+    })
+
+    it('should throw on missing algorithm', () => {
+      expect(() => parseSsri('-AAAA')).toThrow('Invalid SSRI format')
+    })
+
+    it('should throw on missing hash', () => {
+      expect(() => parseSsri('sha256-')).toThrow('Invalid SSRI format')
+    })
+
+    it('should throw on hash too short', () => {
+      expect(() => parseSsri('sha256-A')).toThrow('Invalid SSRI format')
+    })
+
+    it('should throw on empty string', () => {
+      expect(() => parseSsri('')).toThrow('Invalid SSRI format')
+    })
+
+    it('should handle base64 padding', () => {
+      const result = parseSsri('sha256-AAAA==')
+      expect(result.base64Hash).toBe('AAAA==')
+    })
+
+    it('should handle base64 special chars', () => {
+      const result = parseSsri('sha256-A+B/C=')
+      expect(result.base64Hash).toBe('A+B/C=')
+    })
+  })
+
+  describe('roundtrip conversion', () => {
+    it('should roundtrip hex to SSRI and back', () => {
+      const originalHex =
+        '76682a9fc3bbe62975176e2541f39a8168877d828d5cad8b56461fc36ac2b856'
+      const ssri = hexToSsri(originalHex)
+      const hex = ssriToHex(ssri)
+      expect(hex).toBe(originalHex)
+    })
+
+    it('should roundtrip SSRI to hex and back', () => {
+      const originalSsri = 'sha256-dmgqn8O75il1F24lQfOagWiHfYKNXK2LVkYfw2rCuFY='
+      const hex = ssriToHex(originalSsri)
+      const ssri = hexToSsri(hex)
+      expect(ssri).toBe(originalSsri)
+    })
+
+    it('should roundtrip with different algorithms', () => {
+      const hex = 'abcdef0123456789'
+      const ssri512 = hexToSsri(hex, 'sha512')
+      expect(ssri512).toMatch(/^sha512-/)
+    })
+
+    it('should preserve hash value through conversions', () => {
+      const hex1 = 'a1b2c3d4'
+      const ssri = hexToSsri(hex1)
+      const hex2 = ssriToHex(ssri)
+      expect(hex1).toBe(hex2)
+    })
+  })
+
+  describe('edge cases', () => {
+    it('should handle minimal valid SSRI', () => {
+      const ssri = 'a-AA'
+      expect(isValidSsri(ssri)).toBe(true)
+      const parsed = parseSsri(ssri)
+      expect(parsed.algorithm).toBe('a')
+      expect(parsed.base64Hash).toBe('AA')
+    })
+
+    it('should handle minimal valid hex', () => {
+      const hex = 'a'
+      expect(isValidHex(hex)).toBe(true)
+      const ssri = hexToSsri(hex)
+      expect(ssri).toMatch(/^sha256-/)
+    })
+
+    it('should handle very long hashes', () => {
+      const longHex = 'a'.repeat(256)
+      const ssri = hexToSsri(longHex)
+      const hexBack = ssriToHex(ssri)
+      expect(hexBack).toBe(longHex)
+    })
+
+    it('should handle numeric algorithm names', () => {
+      const ssri = 'sha3-AAAA'
+      expect(isValidSsri(ssri)).toBe(true)
+    })
+
+    it('should handle alphanumeric algorithm names', () => {
+      const ssri = 'blake2b-AAAA'
+      expect(isValidSsri(ssri)).toBe(true)
+    })
+  })
+
+  describe('integration', () => {
+    it('should work with real world hashes', () => {
+      // Real world sha256 hash
+      const hex =
+        '2c26b46b68ffc68ff99b453c1d30413413422d706483bfa0f98a5e886266e7ae'
+      const ssri = hexToSsri(hex)
+      expect(isValidSsri(ssri)).toBe(true)
+      expect(ssriToHex(ssri)).toBe(hex)
+    })
+
+    it('should validate before parsing', () => {
+      const ssri = 'sha256-AAAA'
+      if (isValidSsri(ssri)) {
+        const parsed = parseSsri(ssri)
+        expect(parsed.algorithm).toBe('sha256')
+      }
+    })
+
+    it('should validate hex before converting', () => {
+      const hex = 'abcd1234'
+      if (isValidHex(hex)) {
+        const ssri = hexToSsri(hex)
+        expect(isValidSsri(ssri)).toBe(true)
+      }
+    })
+  })
+})
diff --git a/test/unit/stdio/clear.test.ts b/test/unit/stdio/clear.test.ts
new file mode 100644
index 0000000..a0c3232
--- /dev/null
+++ b/test/unit/stdio/clear.test.ts
@@ -0,0 +1,727 @@
+/**
+ * @fileoverview Unit tests for terminal clearing and cursor utilities.
+ *
+ * Tests terminal control utilities:
+ * - clearScreen() clears terminal display
+ * - clearLine() clears current line
+ * - moveCursor() repositions cursor
+ * - ANSI escape sequences for terminal control
+ * Used by Socket CLI for interactive output, spinners, and progress indicators.
+ */
+
+import { describe, expect, it, vi } from 'vitest'
+
+import {
+  clearLine,
+  clearLines,
+  clearScreen,
+  clearVisible,
+  cursorToStart,
+  hideCursor,
+  restoreCursor,
+  saveCursor,
+  showCursor,
+} from '@socketsecurity/lib/stdio/clear'
+
+describe('stdio/clear', () => {
+  describe('clearLine', () => {
+    it('should use TTY methods when stream is TTY', () => {
+      const mockStream = {
+        isTTY: true,
+        cursorTo: vi.fn(),
+        clearLine: vi.fn(),
+        write: vi.fn(),
+      } as unknown as NodeJS.WriteStream
+
+      clearLine(mockStream)
+
+      expect(mockStream.cursorTo).toHaveBeenCalledWith(0)
+      expect(mockStream.clearLine).toHaveBeenCalledWith(0)
+      expect(mockStream.write).not.toHaveBeenCalled()
+    })
+
+    it('should use ANSI escape codes when stream is not TTY', () => {
+      const mockStream = {
+        isTTY: false,
+        write: vi.fn(),
+      } as unknown as NodeJS.WriteStream
+
+      clearLine(mockStream)
+
+      expect(mockStream.write).toHaveBeenCalledWith('\r\x1b[K')
+    })
+
+    it('should default to process.stdout', () => {
+      // Just verify it doesn't throw
+      expect(() => clearLine()).not.toThrow()
+    })
+
+    it('should support custom stream', () => {
+      const mockStream = {
+        isTTY: false,
+        write: vi.fn(),
+      } as unknown as NodeJS.WriteStream
+
+      clearLine(mockStream)
+
+      expect(mockStream.write).toHaveBeenCalledTimes(1)
+    })
+
+    it('should write correct ANSI sequence for non-TTY', () => {
+      const mockStream = {
+        isTTY: false,
+        write: vi.fn(),
+      } as unknown as NodeJS.WriteStream
+
+      clearLine(mockStream)
+
+      // @ts-expect-error - Vitest mock.mock property not recognized by TypeScript
+      const written = mockStream.write.mock.calls[0][0] as string
+      expect(written).toContain('\r') // Carriage return
+      expect(written).toContain('\x1b[K') // Clear to end of line
+    })
+
+    it('should handle TTY with cursorTo and clearLine methods', () => {
+      const cursorTo = vi.fn()
+      const clearLineMethod = vi.fn()
+
+      const mockStream = {
+        isTTY: true,
+        cursorTo,
+        clearLine: clearLineMethod,
+      } as unknown as NodeJS.WriteStream
+
+      clearLine(mockStream)
+
+      expect(cursorTo).toHaveBeenCalledWith(0)
+      expect(clearLineMethod).toHaveBeenCalledWith(0)
+    })
+  })
+
+  describe('clearLines', () => {
+    it('should clear multiple lines', () => {
+      const mockStream = {
+        write: vi.fn(),
+      } as unknown as NodeJS.WriteStream
+
+      clearLines(3, mockStream)
+
+      expect(mockStream.write).toHaveBeenCalledTimes(3)
+    })
+
+    it('should write correct ANSI sequence for each line', () => {
+      const mockStream = {
+        write: vi.fn(),
+      } as unknown as NodeJS.WriteStream
+
+      clearLines(2, mockStream)
+
+      expect(mockStream.write).toHaveBeenCalledWith('\x1b[1A\x1b[2K')
+      expect(mockStream.write).toHaveBeenCalledTimes(2)
+    })
+
+    it('should handle zero lines', () => {
+      const mockStream = {
+        write: vi.fn(),
+      } as unknown as NodeJS.WriteStream
+
+      clearLines(0, mockStream)
+
+      expect(mockStream.write).not.toHaveBeenCalled()
+    })
+
+    it('should handle one line', () => {
+      const mockStream = {
+        write: vi.fn(),
+      } as unknown as NodeJS.WriteStream
+
+      clearLines(1, mockStream)
+
+      expect(mockStream.write).toHaveBeenCalledTimes(1)
+    })
+
+    it('should default to process.stdout', () => {
+      expect(() => clearLines(1)).not.toThrow()
+    })
+
+    it('should support custom stream', () => {
+      const mockStream = {
+        write: vi.fn(),
+      } as unknown as NodeJS.WriteStream
+
+      clearLines(5, mockStream)
+
+      expect(mockStream.write).toHaveBeenCalledTimes(5)
+    })
+
+    it('should move up one line for each clear', () => {
+      const mockStream = {
+        write: vi.fn(),
+      } as unknown as NodeJS.WriteStream
+
+      clearLines(1, mockStream)
+
+      // @ts-expect-error - Vitest mock.mock property not recognized by TypeScript
+      const written = mockStream.write.mock.calls[0][0] as string
+      expect(written).toContain('\x1b[1A') // Move up one line
+      expect(written).toContain('\x1b[2K') // Erase entire line
+    })
+
+    it('should handle large number of lines', () => {
+      const mockStream = {
+        write: vi.fn(),
+      } as unknown as NodeJS.WriteStream
+
+      clearLines(100, mockStream)
+
+      expect(mockStream.write).toHaveBeenCalledTimes(100)
+    })
+  })
+
+  describe('clearScreen', () => {
+    it('should clear screen when stream is TTY', () => {
+      const mockStream = {
+        isTTY: true,
+        write: vi.fn(),
+      } as unknown as NodeJS.WriteStream
+
+      clearScreen(mockStream)
+
+      expect(mockStream.write).toHaveBeenCalledWith('\x1bc')
+    })
+
+    it('should not write when stream is not TTY', () => {
+      const mockStream = {
+        isTTY: false,
+        write: vi.fn(),
+      } as unknown as NodeJS.WriteStream
+
+      clearScreen(mockStream)
+
+      expect(mockStream.write).not.toHaveBeenCalled()
+    })
+
+    it('should default to process.stdout', () => {
+      expect(() => clearScreen()).not.toThrow()
+    })
+
+    it('should support custom stream', () => {
+      const mockStream = {
+        isTTY: true,
+        write: vi.fn(),
+      } as unknown as NodeJS.WriteStream
+
+      clearScreen(mockStream)
+
+      expect(mockStream.write).toHaveBeenCalledTimes(1)
+    })
+
+    it('should use full reset ANSI sequence', () => {
+      const mockStream = {
+        isTTY: true,
+        write: vi.fn(),
+      } as unknown as NodeJS.WriteStream
+
+      clearScreen(mockStream)
+
+      expect(mockStream.write).toHaveBeenCalledWith('\x1bc')
+    })
+
+    it('should handle non-TTY gracefully', () => {
+      const mockStream = {
+        isTTY: false,
+        write: vi.fn(),
+      } as unknown as NodeJS.WriteStream
+
+      expect(() => clearScreen(mockStream)).not.toThrow()
+      expect(mockStream.write).not.toHaveBeenCalled()
+    })
+  })
+
+  describe('clearVisible', () => {
+    it('should call clearScreen', () => {
+      const mockStream = {
+        isTTY: true,
+        write: vi.fn(),
+      } as unknown as NodeJS.WriteStream
+
+      clearVisible(mockStream)
+
+      expect(mockStream.write).toHaveBeenCalledWith('\x1bc')
+    })
+
+    it('should default to process.stdout', () => {
+      expect(() => clearVisible()).not.toThrow()
+    })
+
+    it('should behave like clearScreen for TTY', () => {
+      const mockStream = {
+        isTTY: true,
+        write: vi.fn(),
+      } as unknown as NodeJS.WriteStream
+
+      clearVisible(mockStream)
+      clearScreen(mockStream)
+
+      expect(mockStream.write).toHaveBeenCalledTimes(2)
+      expect(mockStream.write).toHaveBeenNthCalledWith(1, '\x1bc')
+      expect(mockStream.write).toHaveBeenNthCalledWith(2, '\x1bc')
+    })
+
+    it('should behave like clearScreen for non-TTY', () => {
+      const mockStream = {
+        isTTY: false,
+        write: vi.fn(),
+      } as unknown as NodeJS.WriteStream
+
+      clearVisible(mockStream)
+
+      expect(mockStream.write).not.toHaveBeenCalled()
+    })
+  })
+
+  describe('cursorToStart', () => {
+    it('should use cursorTo method when stream is TTY', () => {
+      const mockStream = {
+        isTTY: true,
+        cursorTo: vi.fn(),
+        write: vi.fn(),
+      } as unknown as NodeJS.WriteStream
+
+      cursorToStart(mockStream)
+
+      expect(mockStream.cursorTo).toHaveBeenCalledWith(0)
+      expect(mockStream.write).not.toHaveBeenCalled()
+    })
+
+    it('should use carriage return when stream is not TTY', () => {
+      const mockStream = {
+        isTTY: false,
+        write: vi.fn(),
+      } as unknown as NodeJS.WriteStream
+
+      cursorToStart(mockStream)
+
+      expect(mockStream.write).toHaveBeenCalledWith('\r')
+    })
+
+    it('should default to process.stdout', () => {
+      expect(() => cursorToStart()).not.toThrow()
+    })
+
+    it('should support custom stream', () => {
+      const mockStream = {
+        isTTY: false,
+        write: vi.fn(),
+      } as unknown as NodeJS.WriteStream
+
+      cursorToStart(mockStream)
+
+      expect(mockStream.write).toHaveBeenCalledTimes(1)
+    })
+
+    it('should write carriage return for non-TTY', () => {
+      const mockStream = {
+        isTTY: false,
+        write: vi.fn(),
+      } as unknown as NodeJS.WriteStream
+
+      cursorToStart(mockStream)
+
+      expect(mockStream.write).toHaveBeenCalledWith('\r')
+    })
+  })
+
+  describe('hideCursor', () => {
+    it('should write DECTCEM hide cursor sequence', () => {
+      const mockStream = {
+        write: vi.fn(),
+      } as unknown as NodeJS.WriteStream
+
+      hideCursor(mockStream)
+
+      expect(mockStream.write).toHaveBeenCalledWith('\x1b[?25l')
+    })
+
+    it('should default to process.stdout', () => {
+      expect(() => hideCursor()).not.toThrow()
+    })
+
+    it('should support custom stream', () => {
+      const mockStream = {
+        write: vi.fn(),
+      } as unknown as NodeJS.WriteStream
+
+      hideCursor(mockStream)
+
+      expect(mockStream.write).toHaveBeenCalledTimes(1)
+    })
+
+    it('should write correct ANSI sequence', () => {
+      const mockStream = {
+        write: vi.fn(),
+      } as unknown as NodeJS.WriteStream
+
+      hideCursor(mockStream)
+
+      // @ts-expect-error - Vitest mock.mock property not recognized by TypeScript
+      const written = mockStream.write.mock.calls[0][0] as string
+      expect(written).toBe('\x1b[?25l')
+    })
+
+    it('should work on any stream', () => {
+      const mockStream = {
+        isTTY: false,
+        write: vi.fn(),
+      } as unknown as NodeJS.WriteStream
+
+      hideCursor(mockStream)
+
+      expect(mockStream.write).toHaveBeenCalled()
+    })
+  })
+
+  describe('showCursor', () => {
+    it('should write DECTCEM show cursor sequence', () => {
+      const mockStream = {
+        write: vi.fn(),
+      } as unknown as NodeJS.WriteStream
+
+      showCursor(mockStream)
+
+      expect(mockStream.write).toHaveBeenCalledWith('\x1b[?25h')
+    })
+
+    it('should default to process.stdout', () => {
+      expect(() => showCursor()).not.toThrow()
+    })
+
+    it('should support custom stream', () => {
+      const mockStream = {
+        write: vi.fn(),
+      } as unknown as NodeJS.WriteStream
+
+      showCursor(mockStream)
+
+      expect(mockStream.write).toHaveBeenCalledTimes(1)
+    })
+
+    it('should write correct ANSI sequence', () => {
+      const mockStream = {
+        write: vi.fn(),
+      } as unknown as NodeJS.WriteStream
+
+      showCursor(mockStream)
+
+      // @ts-expect-error - Vitest mock.mock property not recognized by TypeScript
+      const written = mockStream.write.mock.calls[0][0] as string
+      expect(written).toBe('\x1b[?25h')
+    })
+
+    it('should work on any stream', () => {
+      const mockStream = {
+        isTTY: false,
+        write: vi.fn(),
+      } as unknown as NodeJS.WriteStream
+
+      showCursor(mockStream)
+
+      expect(mockStream.write).toHaveBeenCalled()
+    })
+  })
+
+  describe('saveCursor', () => {
+    it('should write DECSC save cursor sequence', () => {
+      const mockStream = {
+        write: vi.fn(),
+      } as unknown as NodeJS.WriteStream
+
+      saveCursor(mockStream)
+
+      expect(mockStream.write).toHaveBeenCalledWith('\x1b7')
+    })
+
+    it('should default to process.stdout', () => {
+      expect(() => saveCursor()).not.toThrow()
+    })
+
+    it('should support custom stream', () => {
+      const mockStream = {
+        write: vi.fn(),
+      } as unknown as NodeJS.WriteStream
+
+      saveCursor(mockStream)
+
+      expect(mockStream.write).toHaveBeenCalledTimes(1)
+    })
+
+    it('should write correct ANSI sequence', () => {
+      const mockStream = {
+        write: vi.fn(),
+      } as unknown as NodeJS.WriteStream
+
+      saveCursor(mockStream)
+
+      // @ts-expect-error - Vitest mock.mock property not recognized by TypeScript
+      const written = mockStream.write.mock.calls[0][0] as string
+      expect(written).toBe('\x1b7')
+    })
+
+    it('should work on any stream', () => {
+      const mockStream = {
+        isTTY: false,
+        write: vi.fn(),
+      } as unknown as NodeJS.WriteStream
+
+      saveCursor(mockStream)
+
+      expect(mockStream.write).toHaveBeenCalled()
+    })
+  })
+
+  describe('restoreCursor', () => {
+    it('should write DECRC restore cursor sequence', () => {
+      const mockStream = {
+        write: vi.fn(),
+      } as unknown as NodeJS.WriteStream
+
+      restoreCursor(mockStream)
+
+      expect(mockStream.write).toHaveBeenCalledWith('\x1b8')
+    })
+
+    it('should default to process.stdout', () => {
+      expect(() => restoreCursor()).not.toThrow()
+    })
+
+    it('should support custom stream', () => {
+      const mockStream = {
+        write: vi.fn(),
+      } as unknown as NodeJS.WriteStream
+
+      restoreCursor(mockStream)
+
+      expect(mockStream.write).toHaveBeenCalledTimes(1)
+    })
+
+    it('should write correct ANSI sequence', () => {
+      const mockStream = {
+        write: vi.fn(),
+      } as unknown as NodeJS.WriteStream
+
+      restoreCursor(mockStream)
+
+      // @ts-expect-error - Vitest mock.mock property not recognized by TypeScript
+      const written = mockStream.write.mock.calls[0][0] as string
+      expect(written).toBe('\x1b8')
+    })
+
+    it('should work on any stream', () => {
+      const mockStream = {
+        isTTY: false,
+        write: vi.fn(),
+      } as unknown as NodeJS.WriteStream
+
+      restoreCursor(mockStream)
+
+      expect(mockStream.write).toHaveBeenCalled()
+    })
+  })
+
+  describe('integration scenarios', () => {
+    it('should support hide/show cursor workflow', () => {
+      const mockStream = {
+        write: vi.fn(),
+      } as unknown as NodeJS.WriteStream
+
+      hideCursor(mockStream)
+      showCursor(mockStream)
+
+      expect(mockStream.write).toHaveBeenNthCalledWith(1, '\x1b[?25l')
+      expect(mockStream.write).toHaveBeenNthCalledWith(2, '\x1b[?25h')
+    })
+
+    it('should support save/restore cursor workflow', () => {
+      const mockStream = {
+        write: vi.fn(),
+      } as unknown as NodeJS.WriteStream
+
+      saveCursor(mockStream)
+      restoreCursor(mockStream)
+
+      expect(mockStream.write).toHaveBeenNthCalledWith(1, '\x1b7')
+      expect(mockStream.write).toHaveBeenNthCalledWith(2, '\x1b8')
+    })
+
+    it('should support clearing multiple lines', () => {
+      const mockStream = {
+        write: vi.fn(),
+      } as unknown as NodeJS.WriteStream
+
+      clearLines(3, mockStream)
+
+      expect(mockStream.write).toHaveBeenCalledTimes(3)
+      for (let i = 0; i < 3; i++) {
+        expect(mockStream.write).toHaveBeenNthCalledWith(
+          i + 1,
+          '\x1b[1A\x1b[2K',
+        )
+      }
+    })
+
+    it('should support progress indicator pattern', () => {
+      const mockStream = {
+        write: vi.fn(),
+      } as unknown as NodeJS.WriteStream
+
+      hideCursor(mockStream)
+      clearLine({ isTTY: false, write: mockStream.write } as NodeJS.WriteStream)
+      showCursor(mockStream)
+
+      expect(mockStream.write).toHaveBeenCalledWith('\x1b[?25l')
+      expect(mockStream.write).toHaveBeenCalledWith('\r\x1b[K')
+      expect(mockStream.write).toHaveBeenCalledWith('\x1b[?25h')
+    })
+  })
+
+  describe('ANSI sequences', () => {
+    it('should use correct escape codes for cursor movement', () => {
+      const mockStream = {
+        write: vi.fn(),
+      } as unknown as NodeJS.WriteStream
+
+      clearLines(1, mockStream)
+
+      // @ts-expect-error - Vitest mock.mock property not recognized by TypeScript
+      const written = mockStream.write.mock.calls[0][0] as string
+      expect(written).toContain('\x1b[1A') // Up one line
+      expect(written).toContain('\x1b[2K') // Clear line
+    })
+
+    it('should use correct escape codes for cursor visibility', () => {
+      const mockStream = {
+        write: vi.fn(),
+      } as unknown as NodeJS.WriteStream
+
+      hideCursor(mockStream)
+      showCursor(mockStream)
+
+      expect(mockStream.write).toHaveBeenCalledWith('\x1b[?25l')
+      expect(mockStream.write).toHaveBeenCalledWith('\x1b[?25h')
+    })
+
+    it('should use correct escape codes for cursor save/restore', () => {
+      const mockStream = {
+        write: vi.fn(),
+      } as unknown as NodeJS.WriteStream
+
+      saveCursor(mockStream)
+      restoreCursor(mockStream)
+
+      expect(mockStream.write).toHaveBeenCalledWith('\x1b7')
+      expect(mockStream.write).toHaveBeenCalledWith('\x1b8')
+    })
+
+    it('should use correct escape codes for screen clear', () => {
+      const mockStream = {
+        isTTY: true,
+        write: vi.fn(),
+      } as unknown as NodeJS.WriteStream
+
+      clearScreen(mockStream)
+
+      expect(mockStream.write).toHaveBeenCalledWith('\x1bc')
+    })
+  })
+
+  describe('error handling', () => {
+    it('should not throw when writing to streams', () => {
+      const mockStream = {
+        write: vi.fn(),
+      } as unknown as NodeJS.WriteStream
+
+      expect(() => hideCursor(mockStream)).not.toThrow()
+      expect(() => showCursor(mockStream)).not.toThrow()
+      expect(() => saveCursor(mockStream)).not.toThrow()
+      expect(() => restoreCursor(mockStream)).not.toThrow()
+    })
+
+    it('should handle TTY detection gracefully', () => {
+      const ttyStream = {
+        isTTY: true,
+        cursorTo: vi.fn(),
+        clearLine: vi.fn(),
+      } as unknown as NodeJS.WriteStream
+
+      const nonTtyStream = {
+        isTTY: false,
+        write: vi.fn(),
+      } as unknown as NodeJS.WriteStream
+
+      expect(() => clearLine(ttyStream)).not.toThrow()
+      expect(() => clearLine(nonTtyStream)).not.toThrow()
+    })
+
+    it('should handle missing isTTY property', () => {
+      const mockStream = {
+        write: vi.fn(),
+      } as unknown as NodeJS.WriteStream
+
+      expect(() => clearScreen(mockStream)).not.toThrow()
+    })
+  })
+
+  describe('real-world usage', () => {
+    it('should support progress bar clearing', () => {
+      const mockStream = {
+        isTTY: false,
+        write: vi.fn(),
+      } as unknown as NodeJS.WriteStream
+
+      // Typical progress bar pattern
+      clearLine(mockStream)
+      cursorToStart(mockStream)
+
+      expect(mockStream.write).toHaveBeenCalledWith('\r\x1b[K')
+      expect(mockStream.write).toHaveBeenCalledWith('\r')
+    })
+
+    it('should support multi-line status clearing', () => {
+      const mockStream = {
+        write: vi.fn(),
+      } as unknown as NodeJS.WriteStream
+
+      // Clear 3 lines of status
+      clearLines(3, mockStream)
+
+      expect(mockStream.write).toHaveBeenCalledTimes(3)
+    })
+
+    it('should support animation cleanup', () => {
+      const mockStream = {
+        write: vi.fn(),
+      } as unknown as NodeJS.WriteStream
+
+      hideCursor(mockStream)
+      // ... animation frames ...
+      showCursor(mockStream)
+
+      expect(mockStream.write).toHaveBeenCalledWith('\x1b[?25l')
+      expect(mockStream.write).toHaveBeenCalledWith('\x1b[?25h')
+    })
+  })
+
+  describe('stream parameter defaults', () => {
+    it('should default all functions to process.stdout', () => {
+      expect(() => clearLine()).not.toThrow()
+      expect(() => clearLines(1)).not.toThrow()
+      expect(() => clearScreen()).not.toThrow()
+      expect(() => clearVisible()).not.toThrow()
+      expect(() => cursorToStart()).not.toThrow()
+      expect(() => hideCursor()).not.toThrow()
+      expect(() => showCursor()).not.toThrow()
+      expect(() => saveCursor()).not.toThrow()
+      expect(() => restoreCursor()).not.toThrow()
+    })
+  })
+})
diff --git a/test/unit/stdio/footer.test.ts b/test/unit/stdio/footer.test.ts
new file mode 100644
index 0000000..a54a2d0
--- /dev/null
+++ b/test/unit/stdio/footer.test.ts
@@ -0,0 +1,615 @@
+/**
+ * @fileoverview Unit tests for console footer formatting utilities.
+ *
+ * Tests footer formatting utilities:
+ * - createFooter() generates bordered footers with messages, timestamps, duration
+ * - createSummaryFooter() creates summary footers with stats (passed/failed/skipped)
+ * - Custom styling: colors, widths, border characters
+ * - Duration formatting and timestamp display
+ * Used by Socket CLI for command completion reports and test result summaries.
+ */
+
+import { afterEach, beforeEach, describe, expect, it, vi } from 'vitest'
+
+import {
+  createFooter,
+  createSummaryFooter,
+} from '@socketsecurity/lib/stdio/footer'
+
+describe('stdio/footer', () => {
+  let dateNowSpy: ReturnType<typeof vi.spyOn>
+  let originalDateNow: typeof Date.now
+
+  beforeEach(() => {
+    originalDateNow = Date.now
+    // Mock Date.now() to return a fixed timestamp
+    // @ts-expect-error - Vitest spy type doesn't match ReturnType<typeof vi.spyOn>
+    dateNowSpy = vi.spyOn(Date, 'now').mockReturnValue(1_000_000)
+  })
+
+  afterEach(() => {
+    if (dateNowSpy) {
+      dateNowSpy.mockRestore()
+    }
+    Date.now = originalDateNow
+  })
+
+  describe('createFooter', () => {
+    it('should export createFooter function', () => {
+      expect(typeof createFooter).toBe('function')
+    })
+
+    it('should create footer with just border', () => {
+      const result = createFooter()
+      expect(result).toBe('='.repeat(80))
+    })
+
+    it('should create footer with message', () => {
+      const result = createFooter('Build complete')
+      expect(result).toContain('Build complete')
+      expect(result).toContain('='.repeat(80))
+    })
+
+    it('should create footer with custom width', () => {
+      const result = createFooter(undefined, { width: 60 })
+      expect(result).toBe('='.repeat(60))
+    })
+
+    it('should create footer with custom border char', () => {
+      const result = createFooter(undefined, { borderChar: '-' })
+      expect(result).toBe('-'.repeat(80))
+    })
+
+    it('should create footer with custom color', () => {
+      const result = createFooter('Success', { color: 'green' })
+      expect(result).toContain('Success')
+    })
+
+    it('should show timestamp when requested', () => {
+      const result = createFooter('Done', { showTimestamp: true })
+      expect(result).toContain('Completed at:')
+      expect(result).toContain('Done')
+    })
+
+    it('should show duration when requested with startTime', () => {
+      Date.now = vi.fn(() => 5000)
+      const result = createFooter('Done', {
+        showDuration: true,
+        startTime: 2000,
+      })
+      expect(result).toContain('Duration:')
+      expect(result).toContain('3.00s')
+      Date.now = originalDateNow
+    })
+
+    it('should not show duration without startTime', () => {
+      const result = createFooter('Done', { showDuration: true })
+      expect(result).not.toContain('Duration:')
+    })
+
+    it('should show both timestamp and duration', () => {
+      Date.now = vi.fn(() => 5000)
+      const result = createFooter('Done', {
+        showTimestamp: true,
+        showDuration: true,
+        startTime: 2000,
+      })
+      expect(result).toContain('Completed at:')
+      expect(result).toContain('Duration:')
+      Date.now = originalDateNow
+    })
+
+    it('should handle message with timestamp', () => {
+      const result = createFooter('Complete', { showTimestamp: true })
+      const lines = result.split('\n')
+      expect(lines.some(line => line.includes('Complete'))).toBe(true)
+      expect(lines.some(line => line.includes('Completed at:'))).toBe(true)
+    })
+
+    it('should handle empty message', () => {
+      const result = createFooter('')
+      expect(result).toContain('='.repeat(80))
+    })
+
+    it('should handle undefined message', () => {
+      const result = createFooter(undefined)
+      expect(result).toBe('='.repeat(80))
+    })
+
+    it('should handle long message', () => {
+      const longMessage = 'A'.repeat(200)
+      const result = createFooter(longMessage)
+      expect(result).toContain(longMessage)
+    })
+
+    it('should handle message with special characters', () => {
+      const result = createFooter('Build: 100% complete')
+      expect(result).toContain('Build: 100% complete')
+    })
+
+    it('should handle Unicode message', () => {
+      const result = createFooter('完了しました')
+      expect(result).toContain('完了しました')
+    })
+
+    it('should format duration correctly', () => {
+      Date.now = vi.fn(() => 10_500)
+      const result = createFooter('Done', {
+        showDuration: true,
+        startTime: 1000,
+      })
+      expect(result).toContain('9.50s')
+      Date.now = originalDateNow
+    })
+
+    it('should handle very short duration', () => {
+      Date.now = vi.fn(() => 1050)
+      const result = createFooter('Done', {
+        showDuration: true,
+        startTime: 1000,
+      })
+      expect(result).toContain('0.05s')
+      Date.now = originalDateNow
+    })
+
+    it('should handle zero duration', () => {
+      Date.now = vi.fn(() => 1000)
+      const result = createFooter('Done', {
+        showDuration: true,
+        startTime: 1000,
+      })
+      expect(result).toContain('0.00s')
+      Date.now = originalDateNow
+    })
+
+    it('should handle all color options', () => {
+      const colors = [
+        'cyan',
+        'green',
+        'yellow',
+        'blue',
+        'magenta',
+        'red',
+        'gray',
+      ]
+      for (const color of colors) {
+        const result = createFooter('Message', {
+          color: color as
+            | 'cyan'
+            | 'green'
+            | 'yellow'
+            | 'blue'
+            | 'magenta'
+            | 'red'
+            | 'gray',
+        })
+        expect(result).toContain('Message')
+      }
+    })
+
+    it('should handle undefined color', () => {
+      const result = createFooter('Message', { color: undefined })
+      expect(result).toContain('Message')
+    })
+
+    it('should return a string', () => {
+      const result = createFooter()
+      expect(typeof result).toBe('string')
+    })
+
+    it('should end with border', () => {
+      const result = createFooter('Message')
+      const lines = result.split('\n')
+      expect(lines[lines.length - 1]).toBe('='.repeat(80))
+    })
+
+    it('should handle small width', () => {
+      const result = createFooter(undefined, { width: 10 })
+      expect(result).toBe('='.repeat(10))
+    })
+
+    it('should handle large width', () => {
+      const result = createFooter(undefined, { width: 200 })
+      expect(result).toBe('='.repeat(200))
+    })
+  })
+
+  describe('createSummaryFooter', () => {
+    it('should export createSummaryFooter function', () => {
+      expect(typeof createSummaryFooter).toBe('function')
+    })
+
+    it('should create summary with total', () => {
+      const result = createSummaryFooter({ total: 100 })
+      expect(result).toContain('Total: 100')
+    })
+
+    it('should create summary with success count', () => {
+      const result = createSummaryFooter({ success: 95 })
+      expect(result).toContain('95 passed')
+    })
+
+    it('should create summary with failed count', () => {
+      const result = createSummaryFooter({ failed: 5 })
+      expect(result).toContain('5 failed')
+    })
+
+    it('should not show failed when count is zero', () => {
+      const result = createSummaryFooter({ failed: 0 })
+      expect(result).not.toContain('failed')
+    })
+
+    it('should create summary with skipped count', () => {
+      const result = createSummaryFooter({ skipped: 3 })
+      expect(result).toContain('3 skipped')
+    })
+
+    it('should not show skipped when count is zero', () => {
+      const result = createSummaryFooter({ skipped: 0 })
+      expect(result).not.toContain('skipped')
+    })
+
+    it('should create summary with warnings', () => {
+      const result = createSummaryFooter({ warnings: 10 })
+      expect(result).toContain('10 warnings')
+    })
+
+    it('should not show warnings when count is zero', () => {
+      const result = createSummaryFooter({ warnings: 0 })
+      expect(result).not.toContain('warnings')
+    })
+
+    it('should create summary with errors', () => {
+      const result = createSummaryFooter({ errors: 2 })
+      expect(result).toContain('2 errors')
+    })
+
+    it('should not show errors when count is zero', () => {
+      const result = createSummaryFooter({ errors: 0 })
+      expect(result).not.toContain('errors')
+    })
+
+    it('should create comprehensive summary', () => {
+      const result = createSummaryFooter({
+        total: 150,
+        success: 145,
+        failed: 3,
+        skipped: 2,
+        warnings: 5,
+      })
+      expect(result).toContain('Total: 150')
+      expect(result).toContain('145 passed')
+      expect(result).toContain('3 failed')
+      expect(result).toContain('2 skipped')
+      expect(result).toContain('5 warnings')
+    })
+
+    it('should separate stats with pipe', () => {
+      const result = createSummaryFooter({
+        total: 100,
+        success: 95,
+        failed: 5,
+      })
+      expect(result).toContain('|')
+    })
+
+    it('should use checkmark for success', () => {
+      const result = createSummaryFooter({ success: 100 })
+      expect(result).toContain('✓')
+    })
+
+    it('should use cross for failed', () => {
+      const result = createSummaryFooter({ failed: 5 })
+      expect(result).toContain('✗')
+    })
+
+    it('should use circle for skipped', () => {
+      const result = createSummaryFooter({ skipped: 3 })
+      expect(result).toContain('○')
+    })
+
+    it('should use warning symbol for warnings', () => {
+      const result = createSummaryFooter({ warnings: 10 })
+      expect(result).toContain('⚠')
+    })
+
+    it('should use cross for errors', () => {
+      const result = createSummaryFooter({ errors: 2 })
+      expect(result).toContain('✗')
+    })
+
+    it('should handle empty stats', () => {
+      const result = createSummaryFooter({})
+      expect(result).toContain('='.repeat(80))
+    })
+
+    it('should handle single stat', () => {
+      const result = createSummaryFooter({ total: 50 })
+      expect(result).toContain('Total: 50')
+    })
+
+    it('should handle all stats', () => {
+      const result = createSummaryFooter({
+        total: 200,
+        success: 180,
+        failed: 10,
+        skipped: 5,
+        warnings: 15,
+        errors: 5,
+      })
+      expect(result).toContain('Total: 200')
+      expect(result).toContain('180 passed')
+      expect(result).toContain('10 failed')
+      expect(result).toContain('5 skipped')
+      expect(result).toContain('15 warnings')
+      expect(result).toContain('5 errors')
+    })
+
+    it('should accept footer options', () => {
+      const result = createSummaryFooter(
+        { total: 100 },
+        { width: 60, borderChar: '-' },
+      )
+      expect(result).toContain('-'.repeat(60))
+    })
+
+    it('should show duration when provided', () => {
+      Date.now = vi.fn(() => 10_000)
+      const result = createSummaryFooter({
+        total: 100,
+        duration: 5000,
+      })
+      expect(result).toContain('Duration:')
+      Date.now = originalDateNow
+    })
+
+    it('should not show duration when undefined', () => {
+      const result = createSummaryFooter({ total: 100 })
+      expect(result).not.toContain('Duration:')
+    })
+
+    it('should handle zero values', () => {
+      const result = createSummaryFooter({
+        total: 0,
+        success: 0,
+      })
+      expect(result).toContain('Total: 0')
+      expect(result).toContain('0 passed')
+    })
+
+    it('should handle undefined total', () => {
+      const result = createSummaryFooter({
+        success: 100,
+      })
+      expect(result).not.toContain('Total:')
+      expect(result).toContain('100 passed')
+    })
+
+    it('should handle large numbers', () => {
+      const result = createSummaryFooter({
+        total: 999_999,
+        success: 999_998,
+        failed: 1,
+      })
+      expect(result).toContain('Total: 999999')
+      expect(result).toContain('999998 passed')
+      expect(result).toContain('1 failed')
+    })
+
+    it('should return a string', () => {
+      const result = createSummaryFooter({ total: 100 })
+      expect(typeof result).toBe('string')
+    })
+
+    it('should end with border', () => {
+      const result = createSummaryFooter({ total: 100 })
+      const lines = result.split('\n')
+      expect(lines[lines.length - 1]).toBe('='.repeat(80))
+    })
+  })
+
+  describe('integration', () => {
+    it('should create complete report footer', () => {
+      Date.now = vi.fn(() => 10_000)
+      const footer = createFooter('Analysis complete', {
+        showTimestamp: true,
+        showDuration: true,
+        startTime: 5000,
+        color: 'green',
+      })
+      expect(footer).toContain('Analysis complete')
+      expect(footer).toContain('Completed at:')
+      expect(footer).toContain('Duration:')
+      Date.now = originalDateNow
+    })
+
+    it('should create test results summary', () => {
+      const summary = createSummaryFooter({
+        total: 500,
+        success: 490,
+        failed: 5,
+        skipped: 5,
+        warnings: 10,
+      })
+      expect(summary).toContain('Total: 500')
+      expect(summary).toContain('490 passed')
+      expect(summary).toContain('5 failed')
+      expect(summary).toContain('5 skipped')
+      expect(summary).toContain('10 warnings')
+    })
+
+    it('should support multiple footer styles', () => {
+      const simple = createFooter('Done')
+      const detailed = createFooter('Done', {
+        showTimestamp: true,
+        showDuration: true,
+        startTime: Date.now() - 5000,
+      })
+      const summary = createSummaryFooter({ total: 100, success: 100 })
+
+      expect(simple).toContain('Done')
+      expect(detailed).toContain('Done')
+      expect(summary).toContain('100 passed')
+    })
+
+    it('should handle build report footer', () => {
+      Date.now = vi.fn(() => 15_000)
+      const footer = createFooter('Build successful', {
+        showDuration: true,
+        startTime: 10_000,
+        color: 'green',
+        width: 70,
+      })
+      expect(footer).toContain('Build successful')
+      expect(footer).toContain('Duration: 5.00s')
+      expect(footer).toContain('='.repeat(70))
+      Date.now = originalDateNow
+    })
+  })
+
+  describe('edge cases', () => {
+    it('should handle zero width', () => {
+      const result = createFooter(undefined, { width: 0 })
+      expect(result).toBe('')
+    })
+
+    it('should handle width of 1', () => {
+      const result = createFooter(undefined, { width: 1 })
+      expect(result).toBe('=')
+    })
+
+    it('should handle empty border char', () => {
+      const result = createFooter(undefined, { borderChar: '' })
+      expect(result).toBe('')
+    })
+
+    it('should handle multi-character border', () => {
+      const result = createFooter(undefined, { borderChar: '=-' })
+      expect(result).toContain('=-')
+    })
+
+    it('should handle negative startTime', () => {
+      Date.now = vi.fn(() => 1000)
+      const result = createFooter('Done', {
+        showDuration: true,
+        startTime: -5000,
+      })
+      // Should still work, just show large duration
+      expect(result).toContain('Duration:')
+      Date.now = originalDateNow
+    })
+
+    it('should handle startTime in future', () => {
+      Date.now = vi.fn(() => 1000)
+      const result = createFooter('Done', {
+        showDuration: true,
+        startTime: 10_000,
+      })
+      // Negative duration
+      expect(result).toContain('Duration:')
+      Date.now = originalDateNow
+    })
+
+    it('should handle message with newlines', () => {
+      const result = createFooter('Line1\nLine2')
+      expect(result).toContain('Line1')
+      expect(result).toContain('Line2')
+    })
+
+    it('should handle negative stat values', () => {
+      const result = createSummaryFooter({
+        total: -10,
+        success: -5,
+      })
+      expect(result).toContain('Total: -10')
+      expect(result).toContain('-5 passed')
+    })
+  })
+
+  describe('real-world usage', () => {
+    it('should create CLI command completion footer', () => {
+      Date.now = vi.fn(() => 5000)
+      const footer = createFooter('Command completed successfully', {
+        showDuration: true,
+        startTime: 2000,
+        color: 'green',
+      })
+      expect(footer).toContain('Command completed successfully')
+      expect(footer).toContain('Duration: 3.00s')
+      Date.now = originalDateNow
+    })
+
+    it('should create test suite summary', () => {
+      const summary = createSummaryFooter({
+        total: 1247,
+        success: 1245,
+        failed: 2,
+        skipped: 0,
+        warnings: 15,
+      })
+      expect(summary).toContain('Total: 1247')
+      expect(summary).toContain('1245 passed')
+      expect(summary).toContain('2 failed')
+      expect(summary).not.toContain('skipped')
+      expect(summary).toContain('15 warnings')
+    })
+
+    it('should create build summary', () => {
+      Date.now = vi.fn(() => 45_000)
+      const summary = createSummaryFooter(
+        {
+          total: 350,
+          success: 348,
+          failed: 2,
+          warnings: 25,
+          duration: 15_000,
+        },
+        { color: 'blue' },
+      )
+      expect(summary).toContain('Total: 350')
+      expect(summary).toContain('348 passed')
+      expect(summary).toContain('2 failed')
+      expect(summary).toContain('25 warnings')
+      expect(summary).toContain('Duration:')
+      Date.now = originalDateNow
+    })
+
+    it('should create linter summary', () => {
+      const summary = createSummaryFooter({
+        total: 87,
+        errors: 5,
+        warnings: 23,
+      })
+      expect(summary).toContain('Total: 87')
+      expect(summary).toContain('5 errors')
+      expect(summary).toContain('23 warnings')
+    })
+
+    it('should create perfect test run summary', () => {
+      const summary = createSummaryFooter({
+        total: 500,
+        success: 500,
+        failed: 0,
+        skipped: 0,
+      })
+      expect(summary).toContain('Total: 500')
+      expect(summary).toContain('500 passed')
+      expect(summary).not.toContain('failed')
+      expect(summary).not.toContain('skipped')
+    })
+
+    it('should create analysis report footer', () => {
+      Date.now = vi.fn(() => 30_000)
+      const footer = createFooter('Security analysis complete', {
+        showTimestamp: true,
+        showDuration: true,
+        startTime: 15_000,
+        width: 80,
+      })
+      expect(footer).toContain('Security analysis complete')
+      expect(footer).toContain('Completed at:')
+      expect(footer).toContain('Duration: 15.00s')
+      Date.now = originalDateNow
+    })
+  })
+})
diff --git a/test/unit/stdio/prompts.test.ts b/test/unit/stdio/prompts.test.ts
new file mode 100644
index 0000000..52a27c6
--- /dev/null
+++ b/test/unit/stdio/prompts.test.ts
@@ -0,0 +1,192 @@
+/**
+ * @fileoverview Unit tests for stdio user prompt utilities.
+ *
+ * Tests inquirer.js integration and prompt utilities for interactive CLI prompts:
+ * - createInquirerTheme() converts Socket themes to inquirer-compatible theme objects
+ * - Choice<T> type for prompt options with value, name, description, short text, and disabled states
+ * - Context type for prompt configuration (signal, input/output streams, clearPromptOnDone)
+ * - Validates theme passthrough for non-Socket themes
+ * - Tests type definitions for building type-safe interactive CLI prompts
+ * Used by Socket CLI tools for user interactions like selecting options, confirming actions.
+ */
+
+import {
+  createInquirerTheme,
+  type Choice,
+  type Context,
+} from '@socketsecurity/lib/stdio/prompts'
+import { describe, expect, it } from 'vitest'
+
+describe('stdio/prompts', () => {
+  describe('createInquirerTheme', () => {
+    it('should create theme from valid inputs', () => {
+      // Test that the function exists and returns an object
+      const result = createInquirerTheme({})
+      expect(result).toBeDefined()
+      expect(typeof result).toBe('object')
+    })
+
+    it('should pass through non-Socket themes', () => {
+      const inquirerTheme = { style: {}, icon: {} }
+      const result = createInquirerTheme(inquirerTheme)
+      expect(result).toBe(inquirerTheme)
+    })
+
+    it('should handle Theme object', () => {
+      const socketTheme = {
+        name: 'custom',
+        colors: {
+          primary: 'blue',
+          secondary: 'green',
+          success: 'green',
+          error: 'red',
+          warning: 'yellow',
+          info: 'cyan',
+          step: 'cyan',
+        },
+      }
+      const theme = createInquirerTheme(socketTheme)
+      expect(theme).toBeDefined()
+    })
+  })
+
+  describe('Choice type', () => {
+    it('should accept minimal choice', () => {
+      const choice: Choice<string> = {
+        value: 'option1',
+      }
+      expect(choice.value).toBe('option1')
+    })
+
+    it('should accept choice with name', () => {
+      const choice: Choice<number> = {
+        value: 1,
+        name: 'First Option',
+      }
+      expect(choice.name).toBe('First Option')
+    })
+
+    it('should accept choice with description', () => {
+      const choice: Choice<string> = {
+        value: 'opt1',
+        name: 'Option 1',
+        description: 'This is the first option',
+      }
+      expect(choice.description).toBe('This is the first option')
+    })
+
+    it('should accept choice with short text', () => {
+      const choice: Choice<string> = {
+        value: 'long-option-value',
+        name: 'Long Option Name',
+        short: 'Long',
+      }
+      expect(choice.short).toBe('Long')
+    })
+
+    it('should accept disabled boolean', () => {
+      const choice: Choice<string> = {
+        value: 'disabled-option',
+        disabled: true,
+      }
+      expect(choice.disabled).toBe(true)
+    })
+
+    it('should accept disabled reason string', () => {
+      const choice: Choice<string> = {
+        value: 'option',
+        disabled: 'Not available in current context',
+      }
+      expect(choice.disabled).toBe('Not available in current context')
+    })
+
+    it('should accept all properties', () => {
+      const choice: Choice<string> = {
+        value: 'complete',
+        name: 'Complete Option',
+        description: 'A fully specified choice',
+        short: 'Complete',
+        disabled: false,
+      }
+      expect(choice.value).toBe('complete')
+      expect(choice.name).toBe('Complete Option')
+      expect(choice.description).toBe('A fully specified choice')
+      expect(choice.short).toBe('Complete')
+      expect(choice.disabled).toBe(false)
+    })
+  })
+
+  describe('Context type', () => {
+    it('should accept minimal context', () => {
+      const context: Context = {}
+      expect(context).toBeDefined()
+    })
+
+    it('should accept context with signal', () => {
+      const controller = new AbortController()
+      const context: Context = {
+        signal: controller.signal,
+      }
+      expect(context.signal).toBeDefined()
+    })
+
+    it('should accept context with streams', () => {
+      const context: Context = {
+        input: process.stdin,
+        output: process.stdout,
+      }
+      expect(context.input).toBe(process.stdin)
+      expect(context.output).toBe(process.stdout)
+    })
+
+    it('should accept context with clearPromptOnDone', () => {
+      const context: Context = {
+        clearPromptOnDone: true,
+      }
+      expect(context.clearPromptOnDone).toBe(true)
+    })
+
+    it('should accept all context properties', () => {
+      const controller = new AbortController()
+      const context: Context = {
+        signal: controller.signal,
+        input: process.stdin,
+        output: process.stdout,
+        clearPromptOnDone: false,
+      }
+      expect(context.signal).toBeDefined()
+      expect(context.input).toBe(process.stdin)
+      expect(context.output).toBe(process.stdout)
+      expect(context.clearPromptOnDone).toBe(false)
+    })
+  })
+
+  describe('theme handling', () => {
+    it('should handle null theme', () => {
+      const theme = createInquirerTheme(null)
+      expect(theme).toBeDefined()
+    })
+  })
+
+  describe('Choice arrays', () => {
+    it('should accept array of choices', () => {
+      const choices: Array<Choice<number>> = [
+        { value: 1, name: 'One' },
+        { value: 2, name: 'Two' },
+        { value: 3, name: 'Three' },
+      ]
+      expect(choices).toHaveLength(3)
+      expect(choices[0]?.value).toBe(1)
+    })
+
+    it('should accept mixed enabled/disabled choices', () => {
+      const choices: Array<Choice<string>> = [
+        { value: 'option1', name: 'Option 1' },
+        { value: 'option2', name: 'Option 2', disabled: true },
+        { value: 'option3', name: 'Option 3', disabled: 'Coming soon' },
+      ]
+      expect(choices[1]?.disabled).toBe(true)
+      expect(choices[2]?.disabled).toBe('Coming soon')
+    })
+  })
+})
diff --git a/test/unit/stdio/stderr.test.ts b/test/unit/stdio/stderr.test.ts
new file mode 100644
index 0000000..1458b3d
--- /dev/null
+++ b/test/unit/stdio/stderr.test.ts
@@ -0,0 +1,584 @@
+/**
+ * @fileoverview Unit tests for stderr stream utilities.
+ *
+ * Tests stderr output utilities:
+ * - writeStderr() writes to stderr stream
+ * - Error message formatting
+ * - Stream detection (TTY vs pipe)
+ * - Color support detection for stderr
+ * Used by Socket tools for error reporting and diagnostic output.
+ */
+
+import { describe, expect, it } from 'vitest'
+
+import {
+  clearLine,
+  cursorTo,
+  getColumns,
+  getRows,
+  isTTY,
+  stderr,
+  writeError,
+  writeErrorFormatted,
+  writeErrorLine,
+  writeStackTrace,
+  writeWarning,
+} from '@socketsecurity/lib/stdio/stderr'
+import { setupStdioTestSuite } from '../utils/stdio-test-helper'
+
+describe('stdio/stderr', () => {
+  const getContext = setupStdioTestSuite(stderr)
+
+  describe('stderr', () => {
+    it('should export stderr stream', () => {
+      expect(stderr).toBeDefined()
+      expect(stderr).toBe(process.stderr)
+    })
+
+    it('should be a WriteStream', () => {
+      expect(stderr).toBeInstanceOf(Object)
+    })
+  })
+
+  describe('writeErrorLine', () => {
+    it('should export writeErrorLine function', () => {
+      expect(typeof writeErrorLine).toBe('function')
+    })
+
+    it('should write text with newline', () => {
+      writeErrorLine('Error occurred')
+      expect(getContext().writeSpy).toHaveBeenCalledWith('Error occurred\n')
+    })
+
+    it('should write empty line when no text provided', () => {
+      writeErrorLine()
+      expect(getContext().writeSpy).toHaveBeenCalledWith('\n')
+    })
+
+    it('should write empty string with newline', () => {
+      writeErrorLine('')
+      expect(getContext().writeSpy).toHaveBeenCalledWith('\n')
+    })
+
+    it('should handle multiline text', () => {
+      writeErrorLine('Line 1\nLine 2')
+      expect(getContext().writeSpy).toHaveBeenCalledWith('Line 1\nLine 2\n')
+    })
+
+    it('should handle special characters', () => {
+      writeErrorLine('Tab\tNewline')
+      expect(getContext().writeSpy).toHaveBeenCalledWith('Tab\tNewline\n')
+    })
+
+    it('should handle Unicode characters', () => {
+      writeErrorLine('Error: 失败')
+      expect(getContext().writeSpy).toHaveBeenCalledWith('Error: 失败\n')
+    })
+
+    it('should handle ANSI color codes', () => {
+      writeErrorLine('\u001B[31mRed Error\u001B[0m')
+      expect(getContext().writeSpy).toHaveBeenCalledWith(
+        '\u001B[31mRed Error\u001B[0m\n',
+      )
+    })
+
+    it('should not return a value', () => {
+      const result = writeErrorLine('test')
+      expect(result).toBeUndefined()
+    })
+  })
+
+  describe('writeError', () => {
+    it('should export writeError function', () => {
+      expect(typeof writeError).toBe('function')
+    })
+
+    it('should write text without newline', () => {
+      writeError('Downloading...')
+      expect(getContext().writeSpy).toHaveBeenCalledWith('Downloading...')
+    })
+
+    it('should write empty string', () => {
+      writeError('')
+      expect(getContext().writeSpy).toHaveBeenCalledWith('')
+    })
+
+    it('should handle ANSI escape sequences', () => {
+      writeError('\u001B[33mWarning\u001B[0m')
+      expect(getContext().writeSpy).toHaveBeenCalledWith(
+        '\u001B[33mWarning\u001B[0m',
+      )
+    })
+
+    it('should not return a value', () => {
+      const result = writeError('test')
+      expect(result).toBeUndefined()
+    })
+  })
+
+  describe('clearLine', () => {
+    it('should export clearLine function', () => {
+      expect(typeof clearLine).toBe('function')
+    })
+
+    it('should clear line in TTY', () => {
+      Object.defineProperty(stderr, 'isTTY', {
+        value: true,
+        configurable: true,
+      })
+      clearLine()
+      expect(getContext().cursorToSpy).toHaveBeenCalledWith(0)
+      expect(getContext().clearLineSpy).toHaveBeenCalledWith(0)
+    })
+
+    it('should not return a value', () => {
+      Object.defineProperty(stderr, 'isTTY', {
+        value: true,
+        configurable: true,
+      })
+      const result = clearLine()
+      expect(result).toBeUndefined()
+    })
+  })
+
+  describe('cursorTo', () => {
+    it('should export cursorTo function', () => {
+      expect(typeof cursorTo).toBe('function')
+    })
+
+    it('should move cursor to x position in TTY', () => {
+      Object.defineProperty(stderr, 'isTTY', {
+        value: true,
+        configurable: true,
+      })
+      cursorTo(10)
+      expect(getContext().cursorToSpy).toHaveBeenCalledWith(10, undefined)
+    })
+
+    it('should move cursor to x,y position in TTY', () => {
+      Object.defineProperty(stderr, 'isTTY', {
+        value: true,
+        configurable: true,
+      })
+      cursorTo(10, 5)
+      expect(getContext().cursorToSpy).toHaveBeenCalledWith(10, 5)
+    })
+
+    it('should move cursor to 0,0', () => {
+      Object.defineProperty(stderr, 'isTTY', {
+        value: true,
+        configurable: true,
+      })
+      cursorTo(0, 0)
+      expect(getContext().cursorToSpy).toHaveBeenCalledWith(0, 0)
+    })
+
+    it('should not return a value', () => {
+      Object.defineProperty(stderr, 'isTTY', {
+        value: true,
+        configurable: true,
+      })
+      const result = cursorTo(0)
+      expect(result).toBeUndefined()
+    })
+
+    it('should handle large coordinates', () => {
+      Object.defineProperty(stderr, 'isTTY', {
+        value: true,
+        configurable: true,
+      })
+      cursorTo(1000, 500)
+      expect(getContext().cursorToSpy).toHaveBeenCalledWith(1000, 500)
+    })
+
+    it('should handle negative coordinates', () => {
+      Object.defineProperty(stderr, 'isTTY', {
+        value: true,
+        configurable: true,
+      })
+      cursorTo(-1, -1)
+      expect(getContext().cursorToSpy).toHaveBeenCalledWith(-1, -1)
+    })
+  })
+
+  describe('isTTY', () => {
+    it('should export isTTY function', () => {
+      expect(typeof isTTY).toBe('function')
+    })
+
+    it('should return true when stderr is TTY', () => {
+      Object.defineProperty(stderr, 'isTTY', {
+        value: true,
+        configurable: true,
+      })
+      expect(isTTY()).toBe(true)
+    })
+
+    it('should return false when stderr is not TTY', () => {
+      Object.defineProperty(stderr, 'isTTY', {
+        value: false,
+        configurable: true,
+      })
+      expect(isTTY()).toBe(false)
+    })
+
+    it('should return false when isTTY is undefined', () => {
+      Object.defineProperty(stderr, 'isTTY', {
+        value: undefined,
+        configurable: true,
+      })
+      expect(isTTY()).toBe(false)
+    })
+
+    it('should be a boolean', () => {
+      expect(typeof isTTY()).toBe('boolean')
+    })
+  })
+
+  describe('getColumns', () => {
+    it('should export getColumns function', () => {
+      expect(typeof getColumns).toBe('function')
+    })
+
+    it('should return actual columns when set', () => {
+      Object.defineProperty(stderr, 'columns', {
+        value: 120,
+        configurable: true,
+      })
+      expect(getColumns()).toBe(120)
+    })
+
+    it('should return default 80 when columns is undefined', () => {
+      Object.defineProperty(stderr, 'columns', {
+        value: undefined,
+        configurable: true,
+      })
+      expect(getColumns()).toBe(80)
+    })
+
+    it('should return default 80 when columns is 0', () => {
+      Object.defineProperty(stderr, 'columns', { value: 0, configurable: true })
+      expect(getColumns()).toBe(80)
+    })
+
+    it('should handle small terminal width', () => {
+      Object.defineProperty(stderr, 'columns', {
+        value: 40,
+        configurable: true,
+      })
+      expect(getColumns()).toBe(40)
+    })
+
+    it('should handle large terminal width', () => {
+      Object.defineProperty(stderr, 'columns', {
+        value: 300,
+        configurable: true,
+      })
+      expect(getColumns()).toBe(300)
+    })
+
+    it('should be a number', () => {
+      expect(typeof getColumns()).toBe('number')
+    })
+  })
+
+  describe('getRows', () => {
+    it('should export getRows function', () => {
+      expect(typeof getRows).toBe('function')
+    })
+
+    it('should return actual rows when set', () => {
+      Object.defineProperty(stderr, 'rows', { value: 50, configurable: true })
+      expect(getRows()).toBe(50)
+    })
+
+    it('should return default 24 when rows is undefined', () => {
+      Object.defineProperty(stderr, 'rows', {
+        value: undefined,
+        configurable: true,
+      })
+      expect(getRows()).toBe(24)
+    })
+
+    it('should return default 24 when rows is 0', () => {
+      Object.defineProperty(stderr, 'rows', { value: 0, configurable: true })
+      expect(getRows()).toBe(24)
+    })
+
+    it('should handle small terminal height', () => {
+      Object.defineProperty(stderr, 'rows', { value: 10, configurable: true })
+      expect(getRows()).toBe(10)
+    })
+
+    it('should handle large terminal height', () => {
+      Object.defineProperty(stderr, 'rows', { value: 100, configurable: true })
+      expect(getRows()).toBe(100)
+    })
+
+    it('should be a number', () => {
+      expect(typeof getRows()).toBe('number')
+    })
+  })
+
+  describe('writeWarning', () => {
+    it('should export writeWarning function', () => {
+      expect(typeof writeWarning).toBe('function')
+    })
+
+    it('should write warning with default prefix', () => {
+      writeWarning('Deprecated API')
+      expect(getContext().writeSpy).toHaveBeenCalledWith(
+        'Warning: Deprecated API\n',
+      )
+    })
+
+    it('should write warning with custom prefix', () => {
+      writeWarning('Invalid config', 'Config')
+      expect(getContext().writeSpy).toHaveBeenCalledWith(
+        'Config: Invalid config\n',
+      )
+    })
+
+    it('should handle empty message', () => {
+      writeWarning('')
+      expect(getContext().writeSpy).toHaveBeenCalledWith('Warning: \n')
+    })
+
+    it('should handle multiline message', () => {
+      writeWarning('Line 1\nLine 2')
+      expect(getContext().writeSpy).toHaveBeenCalledWith(
+        'Warning: Line 1\nLine 2\n',
+      )
+    })
+
+    it('should handle special characters in message', () => {
+      writeWarning('Path contains \\n escape')
+      expect(getContext().writeSpy).toHaveBeenCalledWith(
+        'Warning: Path contains \\n escape\n',
+      )
+    })
+
+    it('should handle Unicode in message', () => {
+      writeWarning('警告メッセージ')
+      expect(getContext().writeSpy).toHaveBeenCalledWith(
+        'Warning: 警告メッセージ\n',
+      )
+    })
+
+    it('should handle empty prefix', () => {
+      writeWarning('Test message', '')
+      expect(getContext().writeSpy).toHaveBeenCalledWith(': Test message\n')
+    })
+
+    it('should not return a value', () => {
+      const result = writeWarning('test')
+      expect(result).toBeUndefined()
+    })
+  })
+
+  describe('writeErrorFormatted', () => {
+    it('should export writeErrorFormatted function', () => {
+      expect(typeof writeErrorFormatted).toBe('function')
+    })
+
+    it('should write error with default prefix', () => {
+      writeErrorFormatted('File not found')
+      expect(getContext().writeSpy).toHaveBeenCalledWith(
+        'Error: File not found\n',
+      )
+    })
+
+    it('should write error with custom prefix', () => {
+      writeErrorFormatted('Connection failed', 'Network')
+      expect(getContext().writeSpy).toHaveBeenCalledWith(
+        'Network: Connection failed\n',
+      )
+    })
+
+    it('should handle empty message', () => {
+      writeErrorFormatted('')
+      expect(getContext().writeSpy).toHaveBeenCalledWith('Error: \n')
+    })
+
+    it('should handle multiline message', () => {
+      writeErrorFormatted('Line 1\nLine 2')
+      expect(getContext().writeSpy).toHaveBeenCalledWith(
+        'Error: Line 1\nLine 2\n',
+      )
+    })
+
+    it('should handle special characters', () => {
+      writeErrorFormatted('Invalid character: $')
+      expect(getContext().writeSpy).toHaveBeenCalledWith(
+        'Error: Invalid character: $\n',
+      )
+    })
+
+    it('should handle Unicode characters', () => {
+      writeErrorFormatted('エラーが発生しました')
+      expect(getContext().writeSpy).toHaveBeenCalledWith(
+        'Error: エラーが発生しました\n',
+      )
+    })
+
+    it('should handle empty prefix', () => {
+      writeErrorFormatted('Test message', '')
+      expect(getContext().writeSpy).toHaveBeenCalledWith(': Test message\n')
+    })
+
+    it('should not return a value', () => {
+      const result = writeErrorFormatted('test')
+      expect(result).toBeUndefined()
+    })
+  })
+
+  describe('writeStackTrace', () => {
+    it('should export writeStackTrace function', () => {
+      expect(typeof writeStackTrace).toBe('function')
+    })
+
+    it('should write formatted error when no stack', () => {
+      const error = new Error('Test error')
+      error.stack = undefined
+      writeStackTrace(error)
+      expect(getContext().writeSpy).toHaveBeenCalledWith('Error: Test error\n')
+    })
+
+    it('should handle error with empty message', () => {
+      const error = new Error('')
+      writeStackTrace(error)
+      expect(getContext().writeSpy).toHaveBeenCalled()
+    })
+
+    it('should handle error with multiline message', () => {
+      const error = new Error('Line 1\nLine 2')
+      error.stack = undefined
+      writeStackTrace(error)
+      expect(getContext().writeSpy).toHaveBeenCalledWith(
+        'Error: Line 1\nLine 2\n',
+      )
+    })
+
+    it('should handle error with Unicode message', () => {
+      const error = new Error('エラー: 失敗')
+      error.stack = undefined
+      writeStackTrace(error)
+      expect(getContext().writeSpy).toHaveBeenCalledWith(
+        'Error: エラー: 失敗\n',
+      )
+    })
+
+    it('should not return a value', () => {
+      const error = new Error('test')
+      const result = writeStackTrace(error)
+      expect(result).toBeUndefined()
+    })
+  })
+
+  describe('integration', () => {
+    it('should support exception handling pattern', () => {
+      try {
+        throw new Error('Something went wrong')
+      } catch (err) {
+        writeStackTrace(err as Error)
+      }
+      expect(getContext().writeSpy).toHaveBeenCalled()
+    })
+
+    it('should handle graceful degradation from TTY to non-TTY', () => {
+      // Start with TTY
+      Object.defineProperty(stderr, 'isTTY', {
+        value: true,
+        configurable: true,
+      })
+      clearLine()
+      expect(getContext().clearLineSpy).toHaveBeenCalled()
+
+      getContext().clearLineSpy.mockClear()
+
+      // Switch to non-TTY
+      Object.defineProperty(stderr, 'isTTY', {
+        value: false,
+        configurable: true,
+      })
+      clearLine()
+      expect(getContext().clearLineSpy).not.toHaveBeenCalled()
+    })
+  })
+
+  describe('edge cases', () => {
+    it('should handle undefined isTTY', () => {
+      Object.defineProperty(stderr, 'isTTY', {
+        value: undefined,
+        configurable: true,
+      })
+      expect(isTTY()).toBe(false)
+      clearLine() // Should not throw
+      cursorTo(0) // Should not throw
+    })
+
+    it('should handle very long error messages', () => {
+      const longMessage = 'x'.repeat(10_000)
+      writeErrorLine(longMessage)
+      expect(getContext().writeSpy).toHaveBeenCalledWith(`${longMessage}\n`)
+    })
+
+    it('should handle terminal dimension changes', () => {
+      Object.defineProperty(stderr, 'columns', {
+        value: 80,
+        configurable: true,
+      })
+      expect(getColumns()).toBe(80)
+
+      Object.defineProperty(stderr, 'columns', {
+        value: 120,
+        configurable: true,
+      })
+      expect(getColumns()).toBe(120)
+    })
+
+    it('should handle null-like terminal dimensions', () => {
+      Object.defineProperty(stderr, 'columns', {
+        value: null,
+        configurable: true,
+      })
+      expect(getColumns()).toBe(80)
+
+      Object.defineProperty(stderr, 'rows', { value: null, configurable: true })
+      expect(getRows()).toBe(24)
+    })
+
+    it('should handle errors with no stack property', () => {
+      const error = { message: 'Not a real Error' } as Error
+      writeStackTrace(error)
+      expect(getContext().writeSpy).toHaveBeenCalledWith(
+        'Error: Not a real Error\n',
+      )
+    })
+  })
+
+  describe('real-world usage', () => {
+    it('should detect redirected error output', () => {
+      Object.defineProperty(stderr, 'isTTY', {
+        value: false,
+        configurable: true,
+      })
+      expect(isTTY()).toBe(false)
+      // When piped, should still write but skip terminal control
+      writeErrorLine('Error line')
+      expect(getContext().writeSpy).toHaveBeenCalled()
+    })
+
+    it('should handle terminal size queries', () => {
+      Object.defineProperty(stderr, 'columns', {
+        value: 120,
+        configurable: true,
+      })
+      Object.defineProperty(stderr, 'rows', { value: 40, configurable: true })
+      const width = getColumns()
+      const height = getRows()
+      expect(width).toBe(120)
+      expect(height).toBe(40)
+    })
+  })
+})
diff --git a/test/unit/stdio/stdout.test.ts b/test/unit/stdio/stdout.test.ts
new file mode 100644
index 0000000..d5e0d9d
--- /dev/null
+++ b/test/unit/stdio/stdout.test.ts
@@ -0,0 +1,599 @@
+/**
+ * @fileoverview Unit tests for stdout stream utilities.
+ *
+ * Tests stdout output utilities:
+ * - writeStdout() writes to stdout stream
+ * - Output formatting and buffering
+ * - Stream detection (TTY vs pipe)
+ * - Color support detection for stdout
+ * Used by Socket tools for standard output and interactive CLI features.
+ */
+
+import { describe, expect, it, vi } from 'vitest'
+
+import {
+  clearLine,
+  clearScreenDown,
+  cursorTo,
+  ensureCursorOnExit,
+  getColumns,
+  getRows,
+  hideCursor,
+  isTTY,
+  showCursor,
+  stdout,
+  write,
+  writeLine,
+} from '@socketsecurity/lib/stdio/stdout'
+import { setupStdioTestSuite } from '../utils/stdio-test-helper'
+
+describe('stdio/stdout', () => {
+  const getContext = setupStdioTestSuite(stdout)
+
+  describe('stdout', () => {
+    it('should export stdout stream', () => {
+      expect(stdout).toBeDefined()
+      expect(stdout).toBe(process.stdout)
+    })
+
+    it('should be a WriteStream', () => {
+      expect(stdout).toBeInstanceOf(Object)
+    })
+  })
+
+  describe('writeLine', () => {
+    it('should export writeLine function', () => {
+      expect(typeof writeLine).toBe('function')
+    })
+
+    it('should write text with newline', () => {
+      writeLine('Hello, world!')
+      expect(getContext().writeSpy).toHaveBeenCalledWith('Hello, world!\n')
+    })
+
+    it('should write empty line when no text provided', () => {
+      writeLine()
+      expect(getContext().writeSpy).toHaveBeenCalledWith('\n')
+    })
+
+    it('should write empty string with newline', () => {
+      writeLine('')
+      expect(getContext().writeSpy).toHaveBeenCalledWith('\n')
+    })
+
+    it('should handle multiline text', () => {
+      writeLine('Line 1\nLine 2')
+      expect(getContext().writeSpy).toHaveBeenCalledWith('Line 1\nLine 2\n')
+    })
+
+    it('should handle special characters', () => {
+      writeLine('Tab\tNewline')
+      expect(getContext().writeSpy).toHaveBeenCalledWith('Tab\tNewline\n')
+    })
+
+    it('should handle Unicode characters', () => {
+      writeLine('Hello 世界')
+      expect(getContext().writeSpy).toHaveBeenCalledWith('Hello 世界\n')
+    })
+
+    it('should handle emojis', () => {
+      writeLine('Success! ✅')
+      expect(getContext().writeSpy).toHaveBeenCalledWith('Success! ✅\n')
+    })
+
+    it('should not return a value', () => {
+      const result = writeLine('test')
+      expect(result).toBeUndefined()
+    })
+  })
+
+  describe('write', () => {
+    it('should export write function', () => {
+      expect(typeof write).toBe('function')
+    })
+
+    it('should write text without newline', () => {
+      write('Loading...')
+      expect(getContext().writeSpy).toHaveBeenCalledWith('Loading...')
+    })
+
+    it('should write empty string', () => {
+      write('')
+      expect(getContext().writeSpy).toHaveBeenCalledWith('')
+    })
+
+    it('should handle ANSI escape sequences', () => {
+      write('\u001B[32mGreen\u001B[0m')
+      expect(getContext().writeSpy).toHaveBeenCalledWith(
+        '\u001B[32mGreen\u001B[0m',
+      )
+    })
+
+    it('should not return a value', () => {
+      const result = write('test')
+      expect(result).toBeUndefined()
+    })
+  })
+
+  describe('clearLine', () => {
+    it('should export clearLine function', () => {
+      expect(typeof clearLine).toBe('function')
+    })
+
+    it('should clear line in TTY', () => {
+      Object.defineProperty(stdout, 'isTTY', {
+        value: true,
+        configurable: true,
+      })
+      clearLine()
+      expect(getContext().cursorToSpy).toHaveBeenCalledWith(0)
+      expect(getContext().clearLineSpy).toHaveBeenCalledWith(0)
+    })
+
+    it('should not return a value', () => {
+      Object.defineProperty(stdout, 'isTTY', {
+        value: true,
+        configurable: true,
+      })
+      const result = clearLine()
+      expect(result).toBeUndefined()
+    })
+  })
+
+  describe('cursorTo', () => {
+    it('should export cursorTo function', () => {
+      expect(typeof cursorTo).toBe('function')
+    })
+
+    it('should move cursor to x position in TTY', () => {
+      Object.defineProperty(stdout, 'isTTY', {
+        value: true,
+        configurable: true,
+      })
+      cursorTo(10)
+      expect(getContext().cursorToSpy).toHaveBeenCalledWith(10, undefined)
+    })
+
+    it('should move cursor to x,y position in TTY', () => {
+      Object.defineProperty(stdout, 'isTTY', {
+        value: true,
+        configurable: true,
+      })
+      cursorTo(10, 5)
+      expect(getContext().cursorToSpy).toHaveBeenCalledWith(10, 5)
+    })
+
+    it('should move cursor to 0,0', () => {
+      Object.defineProperty(stdout, 'isTTY', {
+        value: true,
+        configurable: true,
+      })
+      cursorTo(0, 0)
+      expect(getContext().cursorToSpy).toHaveBeenCalledWith(0, 0)
+    })
+
+    it('should not return a value', () => {
+      Object.defineProperty(stdout, 'isTTY', {
+        value: true,
+        configurable: true,
+      })
+      const result = cursorTo(0)
+      expect(result).toBeUndefined()
+    })
+
+    it('should handle large coordinates', () => {
+      Object.defineProperty(stdout, 'isTTY', {
+        value: true,
+        configurable: true,
+      })
+      cursorTo(1000, 500)
+      expect(getContext().cursorToSpy).toHaveBeenCalledWith(1000, 500)
+    })
+
+    it('should handle negative coordinates', () => {
+      Object.defineProperty(stdout, 'isTTY', {
+        value: true,
+        configurable: true,
+      })
+      cursorTo(-1, -1)
+      expect(getContext().cursorToSpy).toHaveBeenCalledWith(-1, -1)
+    })
+  })
+
+  describe('clearScreenDown', () => {
+    it('should export clearScreenDown function', () => {
+      expect(typeof clearScreenDown).toBe('function')
+    })
+
+    it('should clear screen down in TTY', () => {
+      Object.defineProperty(stdout, 'isTTY', {
+        value: true,
+        configurable: true,
+      })
+      clearScreenDown()
+      expect(getContext().clearScreenDownSpy).toHaveBeenCalled()
+    })
+
+    it('should not return a value', () => {
+      Object.defineProperty(stdout, 'isTTY', {
+        value: true,
+        configurable: true,
+      })
+      const result = clearScreenDown()
+      expect(result).toBeUndefined()
+    })
+  })
+
+  describe('isTTY', () => {
+    it('should export isTTY function', () => {
+      expect(typeof isTTY).toBe('function')
+    })
+
+    it('should return true when stdout is TTY', () => {
+      Object.defineProperty(stdout, 'isTTY', {
+        value: true,
+        configurable: true,
+      })
+      expect(isTTY()).toBe(true)
+    })
+
+    it('should return false when stdout is not TTY', () => {
+      Object.defineProperty(stdout, 'isTTY', {
+        value: false,
+        configurable: true,
+      })
+      expect(isTTY()).toBe(false)
+    })
+
+    it('should return false when isTTY is undefined', () => {
+      Object.defineProperty(stdout, 'isTTY', {
+        value: undefined,
+        configurable: true,
+      })
+      expect(isTTY()).toBe(false)
+    })
+
+    it('should be a boolean', () => {
+      expect(typeof isTTY()).toBe('boolean')
+    })
+  })
+
+  describe('getColumns', () => {
+    it('should export getColumns function', () => {
+      expect(typeof getColumns).toBe('function')
+    })
+
+    it('should return actual columns when set', () => {
+      Object.defineProperty(stdout, 'columns', {
+        value: 120,
+        configurable: true,
+      })
+      expect(getColumns()).toBe(120)
+    })
+
+    it('should return default 80 when columns is undefined', () => {
+      Object.defineProperty(stdout, 'columns', {
+        value: undefined,
+        configurable: true,
+      })
+      expect(getColumns()).toBe(80)
+    })
+
+    it('should return default 80 when columns is 0', () => {
+      Object.defineProperty(stdout, 'columns', { value: 0, configurable: true })
+      expect(getColumns()).toBe(80)
+    })
+
+    it('should handle small terminal width', () => {
+      Object.defineProperty(stdout, 'columns', {
+        value: 40,
+        configurable: true,
+      })
+      expect(getColumns()).toBe(40)
+    })
+
+    it('should handle large terminal width', () => {
+      Object.defineProperty(stdout, 'columns', {
+        value: 300,
+        configurable: true,
+      })
+      expect(getColumns()).toBe(300)
+    })
+
+    it('should be a number', () => {
+      expect(typeof getColumns()).toBe('number')
+    })
+  })
+
+  describe('getRows', () => {
+    it('should export getRows function', () => {
+      expect(typeof getRows).toBe('function')
+    })
+
+    it('should return actual rows when set', () => {
+      Object.defineProperty(stdout, 'rows', { value: 50, configurable: true })
+      expect(getRows()).toBe(50)
+    })
+
+    it('should return default 24 when rows is undefined', () => {
+      Object.defineProperty(stdout, 'rows', {
+        value: undefined,
+        configurable: true,
+      })
+      expect(getRows()).toBe(24)
+    })
+
+    it('should return default 24 when rows is 0', () => {
+      Object.defineProperty(stdout, 'rows', { value: 0, configurable: true })
+      expect(getRows()).toBe(24)
+    })
+
+    it('should handle small terminal height', () => {
+      Object.defineProperty(stdout, 'rows', { value: 10, configurable: true })
+      expect(getRows()).toBe(10)
+    })
+
+    it('should handle large terminal height', () => {
+      Object.defineProperty(stdout, 'rows', { value: 100, configurable: true })
+      expect(getRows()).toBe(100)
+    })
+
+    it('should be a number', () => {
+      expect(typeof getRows()).toBe('number')
+    })
+  })
+
+  describe('hideCursor', () => {
+    it('should export hideCursor function', () => {
+      expect(typeof hideCursor).toBe('function')
+    })
+
+    it('should write hide cursor sequence in TTY WriteStream', () => {
+      Object.defineProperty(stdout, 'isTTY', {
+        value: true,
+        configurable: true,
+      })
+      hideCursor()
+      expect(getContext().writeSpy).toHaveBeenCalledWith('\u001B[?25l')
+    })
+
+    it('should not return a value', () => {
+      Object.defineProperty(stdout, 'isTTY', {
+        value: true,
+        configurable: true,
+      })
+      const result = hideCursor()
+      expect(result).toBeUndefined()
+    })
+  })
+
+  describe('showCursor', () => {
+    it('should export showCursor function', () => {
+      expect(typeof showCursor).toBe('function')
+    })
+
+    it('should write show cursor sequence in TTY WriteStream', () => {
+      Object.defineProperty(stdout, 'isTTY', {
+        value: true,
+        configurable: true,
+      })
+      showCursor()
+      expect(getContext().writeSpy).toHaveBeenCalledWith('\u001B[?25h')
+    })
+
+    it('should not return a value', () => {
+      Object.defineProperty(stdout, 'isTTY', {
+        value: true,
+        configurable: true,
+      })
+      const result = showCursor()
+      expect(result).toBeUndefined()
+    })
+  })
+
+  describe('ensureCursorOnExit', () => {
+    it('should export ensureCursorOnExit function', () => {
+      expect(typeof ensureCursorOnExit).toBe('function')
+    })
+
+    it('should register exit handler', () => {
+      const processOnSpy = vi.spyOn(process, 'on')
+      ensureCursorOnExit()
+      expect(processOnSpy).toHaveBeenCalledWith('exit', expect.any(Function))
+      processOnSpy.mockRestore()
+    })
+
+    it('should register SIGINT handler', () => {
+      const processOnSpy = vi.spyOn(process, 'on')
+      ensureCursorOnExit()
+      expect(processOnSpy).toHaveBeenCalledWith('SIGINT', expect.any(Function))
+      processOnSpy.mockRestore()
+    })
+
+    it('should register SIGTERM handler', () => {
+      const processOnSpy = vi.spyOn(process, 'on')
+      ensureCursorOnExit()
+      expect(processOnSpy).toHaveBeenCalledWith('SIGTERM', expect.any(Function))
+      processOnSpy.mockRestore()
+    })
+
+    it('should not return a value', () => {
+      const result = ensureCursorOnExit()
+      expect(result).toBeUndefined()
+    })
+  })
+
+  describe('integration', () => {
+    it('should support write and writeLine together', () => {
+      write('Loading')
+      write('...')
+      writeLine(' Done!')
+      expect(getContext().writeSpy).toHaveBeenCalledTimes(3)
+      expect(getContext().writeSpy).toHaveBeenNthCalledWith(1, 'Loading')
+      expect(getContext().writeSpy).toHaveBeenNthCalledWith(2, '...')
+      expect(getContext().writeSpy).toHaveBeenNthCalledWith(3, ' Done!\n')
+    })
+
+    it('should support hide/show cursor pattern', () => {
+      Object.defineProperty(stdout, 'isTTY', {
+        value: true,
+        configurable: true,
+      })
+      hideCursor()
+      write('Animation frame 1')
+      write('Animation frame 2')
+      showCursor()
+      expect(getContext().writeSpy).toHaveBeenCalledWith('\u001B[?25l')
+      expect(getContext().writeSpy).toHaveBeenCalledWith('\u001B[?25h')
+    })
+
+    it('should handle graceful degradation from TTY to non-TTY', () => {
+      // Start with TTY
+      Object.defineProperty(stdout, 'isTTY', {
+        value: true,
+        configurable: true,
+      })
+      clearLine()
+      expect(getContext().clearLineSpy).toHaveBeenCalled()
+
+      getContext().clearLineSpy.mockClear()
+
+      // Switch to non-TTY
+      Object.defineProperty(stdout, 'isTTY', {
+        value: false,
+        configurable: true,
+      })
+      clearLine()
+      expect(getContext().clearLineSpy).not.toHaveBeenCalled()
+    })
+  })
+
+  describe('edge cases', () => {
+    it('should handle undefined isTTY', () => {
+      Object.defineProperty(stdout, 'isTTY', {
+        value: undefined,
+        configurable: true,
+      })
+      expect(isTTY()).toBe(false)
+      clearLine() // Should not throw
+      cursorTo(0) // Should not throw
+      clearScreenDown() // Should not throw
+      hideCursor() // Should not throw
+      showCursor() // Should not throw
+    })
+
+    it('should handle very long text', () => {
+      const longText = 'x'.repeat(10_000)
+      writeLine(longText)
+      expect(getContext().writeSpy).toHaveBeenCalledWith(`${longText}\n`)
+    })
+
+    it('should handle rapid cursor movements', () => {
+      Object.defineProperty(stdout, 'isTTY', {
+        value: true,
+        configurable: true,
+      })
+      // Clear spy calls from any previous tests to ensure accurate count
+      getContext().cursorToSpy.mockClear()
+      const callsBefore = getContext().cursorToSpy.mock.calls.length
+      for (let i = 0; i < 100; i++) {
+        cursorTo(i, i)
+      }
+      const callsAfter = getContext().cursorToSpy.mock.calls.length
+      expect(callsAfter - callsBefore).toBe(100)
+    })
+
+    it('should handle terminal dimension changes', () => {
+      Object.defineProperty(stdout, 'columns', {
+        value: 80,
+        configurable: true,
+      })
+      expect(getColumns()).toBe(80)
+
+      Object.defineProperty(stdout, 'columns', {
+        value: 120,
+        configurable: true,
+      })
+      expect(getColumns()).toBe(120)
+    })
+
+    it('should handle null-like terminal dimensions', () => {
+      Object.defineProperty(stdout, 'columns', {
+        value: null,
+        configurable: true,
+      })
+      expect(getColumns()).toBe(80)
+
+      Object.defineProperty(stdout, 'rows', { value: null, configurable: true })
+      expect(getRows()).toBe(24)
+    })
+  })
+
+  describe('real-world usage', () => {
+    it('should support progress indicator pattern', () => {
+      Object.defineProperty(stdout, 'isTTY', {
+        value: true,
+        configurable: true,
+      })
+      // Clear spy to ensure this test runs in isolation
+      getContext().writeSpy.mockClear()
+      write('Loading...')
+      clearLine()
+      write('Loading... 50%')
+      clearLine()
+      write('Loading... 100%')
+      writeLine(' Done!')
+      // Actual calls: 3 writes + 1 writeLine = 4 calls (clearLine calls cursorTo and clearLine internally but not write)
+      expect(getContext().writeSpy).toHaveBeenCalledTimes(4)
+    })
+
+    it('should support spinner pattern', () => {
+      Object.defineProperty(stdout, 'isTTY', {
+        value: true,
+        configurable: true,
+      })
+      hideCursor()
+      const frames = ['⠋', '⠙', '⠹', '⠸']
+      for (const frame of frames) {
+        write(frame)
+        clearLine()
+      }
+      showCursor()
+      expect(getContext().writeSpy).toHaveBeenCalledWith('\u001B[?25l')
+      expect(getContext().writeSpy).toHaveBeenCalledWith('\u001B[?25h')
+    })
+
+    it('should support table rendering', () => {
+      // Clear spy to ensure this test runs in isolation
+      getContext().writeSpy.mockClear()
+      writeLine('Name        | Age | City')
+      writeLine('------------|-----|-------')
+      writeLine('John Doe    | 30  | NYC')
+      writeLine('Jane Smith  | 25  | LA')
+      expect(getContext().writeSpy).toHaveBeenCalledTimes(4)
+    })
+
+    it('should detect redirected output', () => {
+      Object.defineProperty(stdout, 'isTTY', {
+        value: false,
+        configurable: true,
+      })
+      expect(isTTY()).toBe(false)
+      // When piped, should still write but skip terminal control
+      writeLine('Output line')
+      expect(getContext().writeSpy).toHaveBeenCalled()
+    })
+
+    it('should handle terminal size queries', () => {
+      Object.defineProperty(stdout, 'columns', {
+        value: 120,
+        configurable: true,
+      })
+      Object.defineProperty(stdout, 'rows', { value: 40, configurable: true })
+      const width = getColumns()
+      const height = getRows()
+      expect(width).toBe(120)
+      expect(height).toBe(40)
+    })
+  })
+})
diff --git a/test/unit/streams.test.ts b/test/unit/streams.test.ts
new file mode 100644
index 0000000..949bf4d
--- /dev/null
+++ b/test/unit/streams.test.ts
@@ -0,0 +1,316 @@
+/**
+ * @fileoverview Unit tests for async stream processing utilities.
+ *
+ * Tests async iterable stream transformers:
+ * - parallelMap() transforms async iterables with parallel mapping
+ * - parallelEach() iterates async iterables with side effects
+ * - transform() creates custom stream transformations
+ * - Concurrency control for async streams
+ * - Error handling in stream pipelines
+ * Used by Socket tools for processing large datasets and streaming operations.
+ */
+
+import {
+  parallelEach,
+  parallelMap,
+  transform,
+} from '@socketsecurity/lib/streams'
+import { describe, expect, it } from 'vitest'
+
+// Helper to create async iterable from array
+async function* asyncIterable<T>(items: T[]): AsyncIterable<T> {
+  for (const item of items) {
+    yield item
+  }
+}
+
+// Helper to collect async iterable into array
+async function collect<T>(iterable: AsyncIterable<T>): Promise<T[]> {
+  const results: T[] = []
+  for await (const item of iterable) {
+    results.push(item)
+  }
+  return results
+}
+
+describe('streams', () => {
+  describe('parallelMap', () => {
+    it('should map over array', async () => {
+      const input = [1, 2, 3]
+      const result = parallelMap(input, async x => x * 2)
+      const output = await collect(result)
+      expect(output).toEqual([2, 4, 6])
+    })
+
+    it('should map over async iterable', async () => {
+      const input = asyncIterable([1, 2, 3])
+      const result = parallelMap(input, async x => x * 2)
+      const output = await collect(result)
+      expect(output).toEqual([2, 4, 6])
+    })
+
+    it('should handle empty iterable', async () => {
+      const input: number[] = []
+      const result = parallelMap(input, async x => x * 2)
+      const output = await collect(result)
+      expect(output).toEqual([])
+    })
+
+    it('should accept concurrency as number', async () => {
+      const input = [1, 2, 3, 4, 5]
+      const result = parallelMap(input, async x => x + 1, 2)
+      const output = await collect(result)
+      expect(output).toEqual([2, 3, 4, 5, 6])
+    })
+
+    it('should accept options object', async () => {
+      const input = [1, 2, 3]
+      const result = parallelMap(input, async x => x * 2, { concurrency: 2 })
+      const output = await collect(result)
+      expect(output).toEqual([2, 4, 6])
+    })
+
+    it('should handle strings', async () => {
+      const input = ['a', 'b', 'c']
+      const result = parallelMap(input, async x => x.toUpperCase())
+      const output = await collect(result)
+      expect(output).toEqual(['A', 'B', 'C'])
+    })
+
+    it('should handle objects', async () => {
+      const input = [{ id: 1 }, { id: 2 }]
+      const result = parallelMap(input, async x => ({
+        ...x,
+        doubled: x.id * 2,
+      }))
+      const output = await collect(result)
+      expect(output).toEqual([
+        { id: 1, doubled: 2 },
+        { id: 2, doubled: 4 },
+      ])
+    })
+
+    it('should work with async operations', async () => {
+      const input = [10, 20, 30]
+      const result = parallelMap(input, async x => {
+        await new Promise(resolve => setTimeout(resolve, 1))
+        return x / 10
+      })
+      const output = await collect(result)
+      expect(output).toEqual([1, 2, 3])
+    })
+
+    it('should return async iterable', () => {
+      const input = [1, 2, 3]
+      const result = parallelMap(input, async x => x * 2)
+      expect(result[Symbol.asyncIterator]).toBeDefined()
+    })
+  })
+
+  describe('transform', () => {
+    it('should transform array', async () => {
+      const input = [1, 2, 3]
+      const result = transform(input, async x => x * 3)
+      const output = await collect(result)
+      expect(output).toEqual([3, 6, 9])
+    })
+
+    it('should transform async iterable', async () => {
+      const input = asyncIterable([1, 2, 3])
+      const result = transform(input, async x => x + 10)
+      const output = await collect(result)
+      expect(output).toEqual([11, 12, 13])
+    })
+
+    it('should handle empty iterable', async () => {
+      const input: number[] = []
+      const result = transform(input, async x => x * 2)
+      const output = await collect(result)
+      expect(output).toEqual([])
+    })
+
+    it('should accept concurrency as number', async () => {
+      const input = [1, 2, 3]
+      const result = transform(input, async x => x * 2, 2)
+      const output = await collect(result)
+      expect(output).toEqual([2, 4, 6])
+    })
+
+    it('should accept options object', async () => {
+      const input = [1, 2, 3]
+      const result = transform(input, async x => x * 2, { concurrency: 3 })
+      const output = await collect(result)
+      expect(output).toEqual([2, 4, 6])
+    })
+
+    it('should handle complex transformations', async () => {
+      const input = ['hello', 'world']
+      const result = transform(input, async x => ({
+        original: x,
+        length: x.length,
+        upper: x.toUpperCase(),
+      }))
+      const output = await collect(result)
+      expect(output).toEqual([
+        { original: 'hello', length: 5, upper: 'HELLO' },
+        { original: 'world', length: 5, upper: 'WORLD' },
+      ])
+    })
+
+    it('should return async iterable', () => {
+      const input = [1, 2, 3]
+      const result = transform(input, async x => x * 2)
+      expect(result[Symbol.asyncIterator]).toBeDefined()
+    })
+  })
+
+  describe('parallelEach', () => {
+    it('should execute function for each item', async () => {
+      const input = [1, 2, 3]
+      const results: number[] = []
+      await parallelEach(input, async x => {
+        results.push(x * 2)
+      })
+      expect(results.sort()).toEqual([2, 4, 6])
+    })
+
+    it('should work with async iterable', async () => {
+      const input = asyncIterable([1, 2, 3])
+      const results: number[] = []
+      await parallelEach(input, async x => {
+        results.push(x)
+      })
+      expect(results.sort()).toEqual([1, 2, 3])
+    })
+
+    it('should handle empty iterable', async () => {
+      const input: number[] = []
+      const results: number[] = []
+      await parallelEach(input, async x => {
+        results.push(x)
+      })
+      expect(results).toEqual([])
+    })
+
+    it('should accept concurrency as number', async () => {
+      const input = [1, 2, 3]
+      const results: number[] = []
+      await parallelEach(
+        input,
+        async x => {
+          results.push(x)
+        },
+        2,
+      )
+      expect(results.sort()).toEqual([1, 2, 3])
+    })
+
+    it('should accept options object', async () => {
+      const input = [1, 2, 3]
+      const results: number[] = []
+      await parallelEach(
+        input,
+        async x => {
+          results.push(x)
+        },
+        { concurrency: 2 },
+      )
+      expect(results.sort()).toEqual([1, 2, 3])
+    })
+
+    it('should handle side effects', async () => {
+      const input = ['a', 'b', 'c']
+      const results: string[] = []
+      await parallelEach(input, async x => {
+        await new Promise(resolve => setTimeout(resolve, 1))
+        results.push(x.toUpperCase())
+      })
+      expect(results.sort()).toEqual(['A', 'B', 'C'])
+    })
+
+    it('should return promise that resolves', async () => {
+      const input = [1, 2, 3]
+      const result = parallelEach(input, async () => {})
+      expect(result).toBeInstanceOf(Promise)
+      await result
+    })
+
+    it('should complete without returning values', async () => {
+      const input = [1, 2, 3]
+      const result = await parallelEach(input, async () => {
+        // Just execute, no return
+      })
+      expect(result).toBeUndefined()
+    })
+  })
+
+  describe('integration', () => {
+    it('should work with chained operations', async () => {
+      const input = [1, 2, 3]
+      const doubled = parallelMap(input, async x => x * 2)
+      const tripled = parallelMap(doubled, async x => x * 3)
+      const output = await collect(tripled)
+      expect(output).toEqual([6, 12, 18])
+    })
+
+    it('should handle mixed sync and async iterables', async () => {
+      const syncInput = [1, 2, 3]
+      const asyncInput = asyncIterable([4, 5, 6])
+
+      const result1 = parallelMap(syncInput, async x => x)
+      const result2 = parallelMap(asyncInput, async x => x)
+
+      const output1 = await collect(result1)
+      const output2 = await collect(result2)
+
+      expect(output1).toEqual([1, 2, 3])
+      expect(output2).toEqual([4, 5, 6])
+    })
+
+    it('should work with different data types', async () => {
+      const numbers = [1, 2, 3]
+      const strings = ['a', 'b', 'c']
+      const booleans = [true, false, true]
+
+      const n = await collect(parallelMap(numbers, async x => x))
+      const s = await collect(parallelMap(strings, async x => x))
+      const b = await collect(parallelMap(booleans, async x => x))
+
+      expect(n).toEqual([1, 2, 3])
+      expect(s).toEqual(['a', 'b', 'c'])
+      expect(b).toEqual([true, false, true])
+    })
+  })
+
+  describe('edge cases', () => {
+    it('should handle single item', async () => {
+      const input = [42]
+      const result = parallelMap(input, async x => x)
+      const output = await collect(result)
+      expect(output).toEqual([42])
+    })
+
+    it('should handle large datasets', async () => {
+      const input = Array.from({ length: 100 }, (_, i) => i)
+      const result = parallelMap(input, async x => x * 2)
+      const output = await collect(result)
+      expect(output.length).toBe(100)
+      expect(output[0]).toBe(0)
+      expect(output[99]).toBe(198)
+    })
+
+    it('should handle zero values', async () => {
+      const input = [0, 0, 0]
+      const result = parallelMap(input, async x => x + 1)
+      const output = await collect(result)
+      expect(output).toEqual([1, 1, 1])
+    })
+
+    it('should handle negative numbers', async () => {
+      const input = [-1, -2, -3]
+      const result = parallelMap(input, async x => Math.abs(x))
+      const output = await collect(result)
+      expect(output).toEqual([1, 2, 3])
+    })
+  })
+})
diff --git a/test/unit/strings.test.ts b/test/unit/strings.test.ts
new file mode 100644
index 0000000..001d679
--- /dev/null
+++ b/test/unit/strings.test.ts
@@ -0,0 +1,771 @@
+/**
+ * @fileoverview Unit tests for string manipulation utilities.
+ *
+ * Tests comprehensive string processing functions:
+ * - ANSI handling: ansiRegex(), stripAnsi() for terminal color code processing
+ * - Line manipulation: applyLinePrefix(), indentString(), trimNewlines()
+ * - Case conversion: camelToKebab(), toKebabCase() with snake_case support
+ * - Text formatting: centerText(), repeatString()
+ * - Width calculation: stringWidth() accounts for CJK characters, emoji, combining marks
+ * - Type guards: isBlankString(), isNonEmptyString()
+ * - Utilities: stripBom(), search() with fromIndex support
+ * Tests include extensive edge cases for Unicode (emoji, CJK, zero-width chars),
+ * ANSI escape codes, platform line endings, and terminal column width calculations.
+ * stringWidth() based on string-width by Sindre Sorhus (MIT).
+ */
+
+import {
+  ansiRegex,
+  applyLinePrefix,
+  camelToKebab,
+  centerText,
+  indentString,
+  isBlankString,
+  isNonEmptyString,
+  repeatString,
+  search,
+  stringWidth,
+  stripAnsi,
+  stripBom,
+  toKebabCase,
+  trimNewlines,
+} from '@socketsecurity/lib/strings'
+import { describe, expect, it } from 'vitest'
+
+describe('strings', () => {
+  describe('ansiRegex', () => {
+    it('should match ANSI escape codes', () => {
+      expect('\x1b[31mred\x1b[0m'.match(ansiRegex())).toBeTruthy()
+      expect('\x1b[1mbold\x1b[0m'.match(ansiRegex())).toBeTruthy()
+    })
+
+    it('should not match plain text', () => {
+      expect('plain text'.match(ansiRegex())).toBeNull()
+    })
+  })
+
+  describe('stripAnsi', () => {
+    it('should remove ANSI escape codes', () => {
+      expect(stripAnsi('\x1b[31mred\x1b[0m')).toBe('red')
+      expect(stripAnsi('\x1b[1mbold\x1b[22m text')).toBe('bold text')
+    })
+
+    it('should return plain text unchanged', () => {
+      expect(stripAnsi('plain text')).toBe('plain text')
+    })
+
+    it('should handle empty strings', () => {
+      expect(stripAnsi('')).toBe('')
+    })
+  })
+
+  describe('applyLinePrefix', () => {
+    it('should apply prefix to single line', () => {
+      const result = applyLinePrefix('hello', { prefix: '> ' })
+      expect(result).toBe('> hello')
+    })
+
+    it('should apply prefix to multiple lines', () => {
+      const result = applyLinePrefix('line1\nline2\nline3', { prefix: '> ' })
+      expect(result).toBe('> line1\n> line2\n> line3')
+    })
+
+    it('should handle empty prefix', () => {
+      const result = applyLinePrefix('hello', { prefix: '' })
+      expect(result).toBe('hello')
+    })
+
+    it('should handle no options', () => {
+      const result = applyLinePrefix('hello')
+      expect(result).toBe('hello')
+    })
+
+    it('should apply prefix even to empty string', () => {
+      const result = applyLinePrefix('', { prefix: '> ' })
+      expect(result).toBe('> ')
+    })
+  })
+
+  describe('camelToKebab', () => {
+    it('should convert simple camelCase', () => {
+      expect(camelToKebab('camelCase')).toBe('camel-case')
+      expect(camelToKebab('myVariableName')).toBe('my-variable-name')
+    })
+
+    it('should handle consecutive uppercase letters', () => {
+      expect(camelToKebab('HTTPServer')).toBe('httpserver')
+      expect(camelToKebab('XMLParser')).toBe('xmlparser')
+    })
+
+    it('should handle already lowercase', () => {
+      expect(camelToKebab('lowercase')).toBe('lowercase')
+    })
+
+    it('should handle empty string', () => {
+      expect(camelToKebab('')).toBe('')
+    })
+
+    it('should handle single letter', () => {
+      expect(camelToKebab('A')).toBe('a')
+      expect(camelToKebab('a')).toBe('a')
+    })
+
+    it('should handle numbers', () => {
+      expect(camelToKebab('version2')).toBe('version2')
+      expect(camelToKebab('http2Server')).toBe('http2-server')
+    })
+  })
+
+  describe('indentString', () => {
+    it('should indent single line with default count', () => {
+      expect(indentString('hello')).toBe(' hello')
+    })
+
+    it('should indent with custom count', () => {
+      expect(indentString('hello', { count: 4 })).toBe('    hello')
+    })
+
+    it('should indent multiple lines', () => {
+      const result = indentString('line1\nline2\nline3', { count: 2 })
+      expect(result).toBe('  line1\n  line2\n  line3')
+    })
+
+    it('should not indent empty lines', () => {
+      const result = indentString('line1\n\nline3', { count: 2 })
+      expect(result).toBe('  line1\n\n  line3')
+    })
+
+    it('should handle empty string', () => {
+      expect(indentString('')).toBe('')
+    })
+  })
+
+  describe('isBlankString', () => {
+    it('should return true for empty string', () => {
+      expect(isBlankString('')).toBe(true)
+    })
+
+    it('should return true for whitespace-only strings', () => {
+      expect(isBlankString(' ')).toBe(true)
+      expect(isBlankString('  ')).toBe(true)
+      expect(isBlankString('\t')).toBe(true)
+      expect(isBlankString('\n')).toBe(true)
+      expect(isBlankString(' \t\n ')).toBe(true)
+    })
+
+    it('should return false for non-empty strings', () => {
+      expect(isBlankString('hello')).toBe(false)
+      expect(isBlankString(' hello ')).toBe(false)
+    })
+
+    it('should return false for non-strings', () => {
+      expect(isBlankString(null)).toBe(false)
+      expect(isBlankString(undefined)).toBe(false)
+      expect(isBlankString(123)).toBe(false)
+      expect(isBlankString({})).toBe(false)
+    })
+  })
+
+  describe('isNonEmptyString', () => {
+    it('should return true for non-empty strings', () => {
+      expect(isNonEmptyString('hello')).toBe(true)
+      expect(isNonEmptyString(' ')).toBe(true)
+      expect(isNonEmptyString('a')).toBe(true)
+    })
+
+    it('should return false for empty string', () => {
+      expect(isNonEmptyString('')).toBe(false)
+    })
+
+    it('should return false for non-strings', () => {
+      expect(isNonEmptyString(null)).toBe(false)
+      expect(isNonEmptyString(undefined)).toBe(false)
+      expect(isNonEmptyString(123)).toBe(false)
+      expect(isNonEmptyString([])).toBe(false)
+    })
+  })
+
+  describe('search', () => {
+    it('should find pattern from beginning', () => {
+      expect(search('hello world', /world/)).toBe(6)
+    })
+
+    it('should find pattern from custom index', () => {
+      expect(search('hello hello', /hello/, { fromIndex: 1 })).toBe(6)
+    })
+
+    it('should return -1 when pattern not found', () => {
+      expect(search('hello', /goodbye/)).toBe(-1)
+    })
+
+    it('should handle negative fromIndex', () => {
+      expect(search('hello world', /world/, { fromIndex: -5 })).toBe(6)
+    })
+
+    it('should return -1 when fromIndex >= length', () => {
+      expect(search('hello', /hello/, { fromIndex: 10 })).toBe(-1)
+    })
+
+    it('should handle empty string', () => {
+      expect(search('', /test/)).toBe(-1)
+    })
+  })
+
+  describe('stripBom', () => {
+    it('should strip BOM from beginning', () => {
+      expect(stripBom('\uFEFFhello')).toBe('hello')
+    })
+
+    it('should not strip BOM from middle', () => {
+      expect(stripBom('hello\uFEFFworld')).toBe('hello\uFEFFworld')
+    })
+
+    it('should handle strings without BOM', () => {
+      expect(stripBom('hello')).toBe('hello')
+    })
+
+    it('should handle empty string', () => {
+      expect(stripBom('')).toBe('')
+    })
+  })
+
+  describe('stringWidth', () => {
+    it('should calculate width of ASCII characters', () => {
+      expect(stringWidth('hello')).toBe(5)
+      expect(stringWidth('test')).toBe(4)
+    })
+
+    it('should handle empty string', () => {
+      expect(stringWidth('')).toBe(0)
+    })
+
+    it('should strip ANSI codes before measuring', () => {
+      expect(stringWidth('\x1b[31mred\x1b[0m')).toBe(3)
+      expect(stringWidth('\x1b[1;31mbold red\x1b[0m')).toBe(8)
+    })
+
+    it('should handle strings with spaces', () => {
+      expect(stringWidth('hello world')).toBe(11)
+    })
+
+    it('should handle wide characters correctly', () => {
+      // CJK characters are typically wide (2 columns)
+      expect(stringWidth('你好')).toBeGreaterThanOrEqual(4)
+      expect(stringWidth('漢字')).toBeGreaterThanOrEqual(4)
+    })
+
+    it('should handle control characters', () => {
+      expect(stringWidth('hello\nworld')).toBe(10)
+      expect(stringWidth('tab\there')).toBe(7)
+    })
+
+    it('should handle emoji correctly', () => {
+      // Basic emoji should be 2 columns
+      expect(stringWidth('👍')).toBe(2)
+      expect(stringWidth('😀')).toBe(2)
+      expect(stringWidth('⚡')).toBe(2)
+    })
+
+    it('should handle emoji with skin tone modifiers', () => {
+      // Emoji with skin tone should still be 2 columns
+      expect(stringWidth('👍🏽')).toBe(2)
+    })
+
+    it('should handle complex emoji sequences', () => {
+      // ZWJ sequences should be 2 columns
+      expect(stringWidth('👨‍👩‍👧‍👦')).toBe(2)
+    })
+
+    it('should handle combining marks', () => {
+      // Base character + combining mark should be width of base
+      expect(stringWidth('é')).toBe(1) // precomposed
+      expect(stringWidth('e\u0301')).toBe(1) // e + combining acute
+    })
+
+    it('should handle zero-width characters', () => {
+      expect(stringWidth('hello\u200Bworld')).toBe(10) // zero-width space
+      expect(stringWidth('test\uFEFFing')).toBe(7) // zero-width no-break space
+    })
+
+    it('should handle fullwidth forms', () => {
+      // Fullwidth ASCII should be 2 columns each
+      expect(stringWidth('ＡＢＣ')).toBeGreaterThan(3)
+    })
+
+    it('should handle halfwidth Katakana', () => {
+      // Halfwidth should be 1 column
+      expect(stringWidth('ｱｲｳ')).toBe(3)
+    })
+
+    it('should return 0 for non-string input', () => {
+      expect(stringWidth(null as any)).toBe(0)
+      expect(stringWidth(undefined as any)).toBe(0)
+      expect(stringWidth(123 as any)).toBe(0)
+    })
+
+    it('should handle mixed content', () => {
+      const mixed = 'hello 你好 ⚡ world'
+      expect(stringWidth(mixed)).toBeGreaterThan(15)
+    })
+
+    it('should handle strings with only ANSI codes', () => {
+      expect(stringWidth('\x1b[31m\x1b[0m')).toBe(0)
+    })
+
+    it('should handle long strings', () => {
+      const long = 'a'.repeat(1000)
+      expect(stringWidth(long)).toBe(1000)
+    })
+
+    it('should handle Greek letters (ambiguous width)', () => {
+      // Ambiguous characters treated as narrow (1 column)
+      expect(stringWidth('αβγ')).toBe(3)
+    })
+
+    it('should handle Cyrillic letters', () => {
+      expect(stringWidth('АБВ')).toBe(3)
+    })
+
+    it('should handle box drawing characters', () => {
+      expect(stringWidth('─│┌')).toBe(3)
+    })
+  })
+
+  describe('toKebabCase', () => {
+    it('should convert camelCase to kebab-case', () => {
+      expect(toKebabCase('camelCase')).toBe('camel-case')
+      expect(toKebabCase('myVariableName')).toBe('my-variable-name')
+    })
+
+    it('should convert snake_case to kebab-case', () => {
+      expect(toKebabCase('snake_case')).toBe('snake-case')
+      expect(toKebabCase('my_variable_name')).toBe('my-variable-name')
+    })
+
+    it('should handle already kebab-case', () => {
+      expect(toKebabCase('kebab-case')).toBe('kebab-case')
+    })
+
+    it('should handle mixed formats', () => {
+      expect(toKebabCase('mixedCase_with_Snake')).toBe('mixed-case-with-snake')
+    })
+
+    it('should handle empty string', () => {
+      expect(toKebabCase('')).toBe('')
+    })
+
+    it('should handle numbers', () => {
+      expect(toKebabCase('version2')).toBe('version2')
+    })
+  })
+
+  describe('trimNewlines', () => {
+    it('should trim newlines from both ends', () => {
+      expect(trimNewlines('\nhello\n')).toBe('hello')
+      expect(trimNewlines('\n\nhello\n\n')).toBe('hello')
+    })
+
+    it('should handle carriage returns', () => {
+      expect(trimNewlines('\rhello\r')).toBe('hello')
+      expect(trimNewlines('\r\nhello\r\n')).toBe('hello')
+    })
+
+    it('should not trim newlines from middle', () => {
+      expect(trimNewlines('hello\nworld')).toBe('hello\nworld')
+    })
+
+    it('should handle strings without newlines', () => {
+      expect(trimNewlines('hello')).toBe('hello')
+    })
+
+    it('should handle empty string', () => {
+      expect(trimNewlines('')).toBe('')
+    })
+
+    it('should handle string with only newlines', () => {
+      expect(trimNewlines('\n\n')).toBe('')
+      expect(trimNewlines('\r\n\r\n')).toBe('')
+    })
+  })
+
+  describe('repeatString', () => {
+    it('should repeat string n times', () => {
+      expect(repeatString('x', 3)).toBe('xxx')
+      expect(repeatString('ab', 2)).toBe('abab')
+    })
+
+    it('should return empty string for count <= 0', () => {
+      expect(repeatString('x', 0)).toBe('')
+      expect(repeatString('x', -1)).toBe('')
+    })
+
+    it('should handle empty string', () => {
+      expect(repeatString('', 5)).toBe('')
+    })
+
+    it('should handle single repetition', () => {
+      expect(repeatString('hello', 1)).toBe('hello')
+    })
+  })
+
+  describe('centerText', () => {
+    it('should center text with even padding', () => {
+      expect(centerText('hi', 6)).toBe('  hi  ')
+    })
+
+    it('should center text with odd padding', () => {
+      expect(centerText('hi', 7)).toBe('  hi   ')
+    })
+
+    it('should not pad if text is longer than width', () => {
+      expect(centerText('hello', 3)).toBe('hello')
+    })
+
+    it('should handle text equal to width', () => {
+      expect(centerText('hello', 5)).toBe('hello')
+    })
+
+    it('should strip ANSI codes for width calculation', () => {
+      const text = '\x1b[31mred\x1b[0m'
+      const result = centerText(text, 7)
+      // Should center based on visible width (3), not string length
+      expect(result.length).toBeGreaterThan(text.length)
+    })
+
+    it('should handle empty string', () => {
+      expect(centerText('', 5)).toBe('     ')
+    })
+
+    it('should handle width of 0', () => {
+      expect(centerText('test', 0)).toBe('test')
+    })
+
+    it('should handle negative width', () => {
+      expect(centerText('test', -5)).toBe('test')
+    })
+  })
+
+  describe('fromCharCode', () => {
+    it('should be exported', () => {
+      const { fromCharCode } = require('@socketsecurity/lib/strings')
+      expect(typeof fromCharCode).toBe('function')
+    })
+
+    it('should convert char codes to strings', () => {
+      const { fromCharCode } = require('@socketsecurity/lib/strings')
+      expect(fromCharCode(65)).toBe('A')
+      expect(fromCharCode(97)).toBe('a')
+      expect(fromCharCode(48)).toBe('0')
+    })
+  })
+
+  describe('edge cases and error handling', () => {
+    describe('applyLinePrefix edge cases', () => {
+      it('should handle multiple consecutive newlines', () => {
+        const result = applyLinePrefix('a\n\n\nb', { prefix: '> ' })
+        expect(result).toBe('> a\n> \n> \n> b')
+      })
+
+      it('should handle trailing newline', () => {
+        const result = applyLinePrefix('hello\n', { prefix: '> ' })
+        expect(result).toBe('> hello\n> ')
+      })
+
+      it('should handle only newlines', () => {
+        const result = applyLinePrefix('\n\n', { prefix: '> ' })
+        expect(result).toBe('> \n> \n> ')
+      })
+    })
+
+    describe('camelToKebab edge cases', () => {
+      it('should handle strings with numbers in middle', () => {
+        expect(camelToKebab('http2Server')).toBe('http2-server')
+        expect(camelToKebab('base64Encode')).toBe('base64-encode')
+      })
+
+      it('should handle single uppercase letter', () => {
+        expect(camelToKebab('A')).toBe('a')
+        expect(camelToKebab('I')).toBe('i')
+      })
+
+      it('should handle all uppercase', () => {
+        expect(camelToKebab('ALLCAPS')).toBe('allcaps')
+      })
+
+      it('should handle mixed case with numbers', () => {
+        expect(camelToKebab('HTML5Parser')).toBe('html5-parser')
+      })
+    })
+
+    describe('indentString edge cases', () => {
+      it('should handle count of 0', () => {
+        expect(indentString('hello', { count: 0 })).toBe('hello')
+      })
+
+      it('should throw on negative count', () => {
+        expect(() => indentString('hello', { count: -5 })).toThrow(RangeError)
+      })
+
+      it('should handle large count', () => {
+        const result = indentString('hi', { count: 100 })
+        expect(result).toMatch(/^\s{100}hi$/)
+      })
+
+      it('should handle whitespace-only lines correctly', () => {
+        const result = indentString('a\n   \nb', { count: 2 })
+        expect(result).toBe('  a\n   \n  b')
+      })
+    })
+
+    describe('search edge cases', () => {
+      it('should handle fromIndex at exact match position', () => {
+        expect(search('hello', /hello/, { fromIndex: 0 })).toBe(0)
+      })
+
+      it('should handle fromIndex past all matches', () => {
+        expect(search('hello world', /hello/, { fromIndex: 10 })).toBe(-1)
+      })
+
+      it('should handle very negative fromIndex', () => {
+        expect(search('hello', /hello/, { fromIndex: -1000 })).toBe(0)
+      })
+
+      it('should handle regex with flags', () => {
+        expect(search('Hello', /hello/i)).toBe(0)
+      })
+
+      it('should handle global regex', () => {
+        expect(search('test test', /test/g, { fromIndex: 5 })).toBe(5)
+      })
+    })
+
+    describe('trimNewlines edge cases', () => {
+      it('should handle single character', () => {
+        expect(trimNewlines('a')).toBe('a')
+        expect(trimNewlines('\n')).toBe('')
+        expect(trimNewlines('\r')).toBe('')
+      })
+
+      it('should handle mixed line endings', () => {
+        expect(trimNewlines('\r\n\nhello\n\r\n')).toBe('hello')
+      })
+
+      it('should handle only carriage returns', () => {
+        expect(trimNewlines('\r\r\r')).toBe('')
+      })
+
+      it('should handle very long strings with newlines', () => {
+        const content = 'a'.repeat(1000)
+        const input = `\n\n${content}\n\n`
+        expect(trimNewlines(input)).toBe(content)
+      })
+    })
+
+    describe('toKebabCase edge cases', () => {
+      it('should handle multiple underscores', () => {
+        expect(toKebabCase('foo___bar')).toBe('foo---bar')
+      })
+
+      it('should handle trailing underscore', () => {
+        expect(toKebabCase('foo_')).toBe('foo-')
+      })
+
+      it('should handle leading underscore', () => {
+        expect(toKebabCase('_foo')).toBe('-foo')
+      })
+
+      it('should handle numbers at end', () => {
+        expect(toKebabCase('test123')).toBe('test123')
+      })
+
+      it('should handle mixed everything', () => {
+        expect(toKebabCase('get_HTML5_Document')).toBe('get-html5-document')
+      })
+
+      it('should handle empty string early return', () => {
+        // Tests line 731: if (!str.length)
+        const result = toKebabCase('')
+        expect(result).toBe('')
+      })
+    })
+
+    describe('camelToKebab additional edge cases', () => {
+      it('should handle break condition in inner loop', () => {
+        // Tests lines 111-112: if (!char) break
+        expect(camelToKebab('Test')).toBe('test')
+      })
+
+      it('should handle uppercase sequence collection', () => {
+        // Tests lines 124-140: consecutive uppercase handling
+        expect(camelToKebab('XMLHTTPRequest')).toBe('xmlhttprequest')
+        expect(camelToKebab('IOError')).toBe('ioerror')
+      })
+
+      it('should handle non-uppercase continuation', () => {
+        // Tests lines 136-139: stop when hitting non-uppercase
+        expect(camelToKebab('HTTPSConnection')).toBe('httpsconnection')
+      })
+
+      it('should handle mixed case with numbers', () => {
+        // Tests lines 141-145: lowercase letters, digits, other chars
+        expect(camelToKebab('base64Encode')).toBe('base64-encode')
+        expect(camelToKebab('sha256Hash')).toBe('sha256-hash')
+      })
+    })
+
+    describe('search additional edge cases', () => {
+      it('should return -1 when fromIndex >= length', () => {
+        // Tests line 311-312: if (fromIndex >= length)
+        const result = search('hello', /l/, { fromIndex: 10 })
+        expect(result).toBe(-1)
+      })
+
+      it('should use fast path when fromIndex === 0', () => {
+        // Tests line 314-315: if (fromIndex === 0)
+        const result = search('hello world', /world/, { fromIndex: 0 })
+        expect(result).toBe(6)
+      })
+    })
+
+    describe('stringWidth edge cases', () => {
+      it('should return 0 for non-string input', () => {
+        // Tests line 546-547: typeof check and !text.length
+        expect(stringWidth(null)).toBe(0)
+        expect(stringWidth(undefined)).toBe(0)
+        // @ts-expect-error - Testing runtime behavior with invalid argument type
+        expect(stringWidth(123)).toBe(0)
+      })
+
+      it('should return 0 for empty string', () => {
+        // Tests line 546-547
+        expect(stringWidth('')).toBe(0)
+      })
+
+      it('should return 0 for string with only ANSI codes', () => {
+        // Tests line 555-556: plainText.length check
+        expect(stringWidth('\x1b[31m\x1b[0m')).toBe(0)
+      })
+
+      it('should skip zero-width clusters', () => {
+        // Tests line 604-605: zeroWidthClusterRegex
+        expect(stringWidth('hello\u200Bworld')).toBe(10) // Zero-width space
+        expect(stringWidth('test\t')).toBe(4) // Tab is control char
+      })
+
+      it('should handle RGI emoji as double-width', () => {
+        // Tests line 623-625: emojiRegex
+        expect(stringWidth('👍')).toBeGreaterThanOrEqual(2)
+        expect(stringWidth('😀')).toBeGreaterThanOrEqual(2)
+      })
+
+      it('should use East Asian Width for non-emoji', () => {
+        // Tests line 639-640: baseSegment and codePointAt
+        expect(stringWidth('漢')).toBeGreaterThanOrEqual(2) // CJK
+        expect(stringWidth('ｱ')).toBe(1) // Halfwidth Katakana
+      })
+
+      it('should handle trailing halfwidth/fullwidth forms', () => {
+        // Tests line 678-690: segment.length > 1 and charCode checks
+        const textWithHalfwidth = 'aﾞ' // 'a' + halfwidth dakuten
+        expect(stringWidth(textWithHalfwidth)).toBeGreaterThanOrEqual(1)
+      })
+    })
+
+    describe('trimNewlines comprehensive edge cases', () => {
+      it('should return empty string for length 0', () => {
+        // Tests line 780-781: if (length === 0)
+        expect(trimNewlines('')).toBe('')
+      })
+
+      it('should handle single newline character', () => {
+        // Tests line 785-786: if (length === 1) with newline
+        expect(trimNewlines('\n')).toBe('')
+        expect(trimNewlines('\r')).toBe('')
+      })
+
+      it('should handle single non-newline character', () => {
+        // Tests line 785-786: if (length === 1) with non-newline
+        expect(trimNewlines('a')).toBe('a')
+      })
+
+      it('should return original if no edge newlines', () => {
+        // Tests line 790-791: noFirstNewline && noLastNewline
+        expect(trimNewlines('hello')).toBe('hello')
+        expect(trimNewlines('a\nb')).toBe('a\nb')
+      })
+
+      it('should handle newlines at start', () => {
+        // Tests line 795-800: while loop for start
+        expect(trimNewlines('\n\r\nhello')).toBe('hello')
+      })
+
+      it('should handle newlines at end', () => {
+        // Tests line 802-807: while loop for end
+        expect(trimNewlines('hello\r\n\n')).toBe('hello')
+      })
+
+      it('should handle newlines at both ends', () => {
+        // Tests both loops
+        expect(trimNewlines('\r\n\rhello\n\r')).toBe('hello')
+      })
+    })
+
+    describe('centerText edge cases', () => {
+      it('should return original text when >= width', () => {
+        // Tests line 882: if (textLength >= width)
+        expect(centerText('hello', 5)).toBe('hello')
+        expect(centerText('hello', 3)).toBe('hello')
+        expect(centerText('longer text', 5)).toBe('longer text')
+      })
+
+      it('should center text with odd padding', () => {
+        // Tests padding calculation
+        expect(centerText('hi', 5)).toBe(' hi  ')
+        expect(centerText('a', 7)).toBe('   a   ')
+      })
+
+      it('should center text with even padding', () => {
+        expect(centerText('test', 8)).toBe('  test  ')
+      })
+    })
+
+    describe('indentString edge cases', () => {
+      it('should handle empty lines correctly', () => {
+        // Tests line 186-187: regex with empty line handling
+        const result = indentString('line1\n\nline3', { count: 2 })
+        expect(result).toBe('  line1\n\n  line3')
+      })
+
+      it('should use default count of 1', () => {
+        const result = indentString('hello')
+        expect(result).toBe(' hello')
+      })
+
+      it('should handle large count values', () => {
+        const result = indentString('test', { count: 10 })
+        expect(result).toBe(`${' '.repeat(10)}test`)
+      })
+    })
+
+    describe('isBlankString edge cases', () => {
+      it('should handle various whitespace types', () => {
+        // Tests line 223: /^\s+$/.test(value)
+        expect(isBlankString(' \t\n\r ')).toBe(true)
+        expect(isBlankString('\n\n\n')).toBe(true)
+        expect(isBlankString('\t\t\t')).toBe(true)
+      })
+
+      it('should return false for non-blank strings', () => {
+        expect(isBlankString(' a ')).toBe(false)
+        expect(isBlankString('  \n  x  ')).toBe(false)
+      })
+
+      it('should handle non-string types', () => {
+        expect(isBlankString(null)).toBe(false)
+        expect(isBlankString(undefined)).toBe(false)
+        expect(isBlankString(123)).toBe(false)
+        expect(isBlankString({})).toBe(false)
+      })
+    })
+  })
+})
diff --git a/test/unit/tables.test.ts b/test/unit/tables.test.ts
new file mode 100644
index 0000000..98648f2
--- /dev/null
+++ b/test/unit/tables.test.ts
@@ -0,0 +1,451 @@
+/**
+ * @fileoverview Unit tests for terminal table formatting utilities.
+ *
+ * Tests table formatting for CLI output:
+ * - formatTable() creates formatted tables with headers and alignment
+ * - formatSimpleTable() simpler table format without borders
+ * - Column alignment (left, right, center)
+ * - Color support via yoctocolors-cjs
+ * - Empty data handling, wrapping, truncation
+ * Used by Socket CLI for displaying package lists, scan results, and reports.
+ */
+
+import colors from 'yoctocolors-cjs'
+import { formatSimpleTable, formatTable } from '@socketsecurity/lib/tables'
+import { stripAnsi } from '@socketsecurity/lib/strings'
+import { describe, expect, it } from 'vitest'
+
+describe('tables', () => {
+  describe('formatTable', () => {
+    it('should format empty data', () => {
+      const result = formatTable([], [])
+      expect(result).toBe('(no data)')
+    })
+
+    it('should format simple table', () => {
+      const data = [
+        { name: 'lodash', version: '4.17.21' },
+        { name: 'react', version: '18.2.0' },
+      ]
+      const columns = [
+        { key: 'name', header: 'Package' },
+        { key: 'version', header: 'Version' },
+      ]
+
+      const result = formatTable(data, columns)
+      expect(result).toContain('Package')
+      expect(result).toContain('Version')
+      expect(result).toContain('lodash')
+      expect(result).toContain('react')
+      expect(result).toContain('4.17.21')
+      expect(result).toContain('18.2.0')
+    })
+
+    it('should include borders', () => {
+      const data = [{ name: 'test' }]
+      const columns = [{ key: 'name', header: 'Name' }]
+
+      const result = formatTable(data, columns)
+      const stripped = stripAnsi(result)
+      expect(stripped).toContain('┌')
+      expect(stripped).toContain('┐')
+      expect(stripped).toContain('├')
+      expect(stripped).toContain('┤')
+      expect(stripped).toContain('└')
+      expect(stripped).toContain('┘')
+      expect(stripped).toContain('│')
+    })
+
+    it('should handle alignment left', () => {
+      const data = [{ value: 'test' }]
+      const columns = [
+        { key: 'value', header: 'Value', align: 'left' as const },
+      ]
+
+      const result = formatTable(data, columns)
+      expect(result).toContain('test')
+    })
+
+    it('should handle alignment right', () => {
+      const data = [{ value: '42' }]
+      const columns = [
+        { key: 'value', header: 'Number', align: 'right' as const },
+      ]
+
+      const result = formatTable(data, columns)
+      expect(result).toContain('42')
+    })
+
+    it('should handle alignment center', () => {
+      const data = [{ value: 'centered' }]
+      const columns = [
+        { key: 'value', header: 'Value', align: 'center' as const },
+      ]
+
+      const result = formatTable(data, columns)
+      expect(result).toContain('centered')
+    })
+
+    it('should handle custom column widths', () => {
+      const data = [{ name: 'test' }]
+      const columns = [{ key: 'name', header: 'Name', width: 20 }]
+
+      const result = formatTable(data, columns)
+      const lines = stripAnsi(result).split('\n')
+      expect(lines.some(line => line.length > 20)).toBe(true)
+    })
+
+    it('should apply color functions', () => {
+      const data = [{ status: 'ok' }]
+      const columns = [
+        {
+          key: 'status',
+          header: 'Status',
+          color: (v: string) => colors.green(v),
+        },
+      ]
+
+      const result = formatTable(data, columns)
+      expect(result).toContain('ok')
+      // Result should have ANSI color codes
+      expect(result.length).toBeGreaterThan(stripAnsi(result).length)
+    })
+
+    it('should handle missing values', () => {
+      const data = [{ name: 'test' }]
+      const columns = [
+        { key: 'name', header: 'Name' },
+        { key: 'missing', header: 'Missing' },
+      ]
+
+      const result = formatTable(data, columns)
+      expect(result).toContain('test')
+    })
+
+    it('should handle multiple rows', () => {
+      const data = [
+        { a: '1', b: '2' },
+        { a: '3', b: '4' },
+        { a: '5', b: '6' },
+      ]
+      const columns = [
+        { key: 'a', header: 'A' },
+        { key: 'b', header: 'B' },
+      ]
+
+      const result = formatTable(data, columns)
+      const lines = result.split('\n')
+      expect(lines.length).toBeGreaterThan(5)
+    })
+
+    it('should handle wide content', () => {
+      const data = [
+        { text: 'A very long piece of text that should be handled' },
+      ]
+      const columns = [{ key: 'text', header: 'Text' }]
+
+      const result = formatTable(data, columns)
+      expect(result).toContain('A very long piece of text')
+    })
+
+    it('should handle numeric values', () => {
+      const data = [{ count: 42, price: 99.99 }]
+      const columns = [
+        { key: 'count', header: 'Count' },
+        { key: 'price', header: 'Price' },
+      ]
+
+      const result = formatTable(data, columns)
+      expect(result).toContain('42')
+      expect(result).toContain('99.99')
+    })
+
+    it('should handle boolean values', () => {
+      const data = [{ enabled: true, disabled: false }]
+      const columns = [
+        { key: 'enabled', header: 'Enabled' },
+        { key: 'disabled', header: 'Disabled' },
+      ]
+
+      const result = formatTable(data, columns)
+      expect(result).toContain('true')
+      expect(result).toContain('false')
+    })
+
+    it('should handle ANSI colored content', () => {
+      const data = [{ name: colors.red('ERROR') }]
+      const columns = [{ key: 'name', header: 'Status' }]
+
+      const result = formatTable(data, columns)
+      expect(result).toContain('ERROR')
+    })
+
+    it('should format headers in bold', () => {
+      const data = [{ name: 'test' }]
+      const columns = [{ key: 'name', header: 'Name' }]
+
+      const result = formatTable(data, columns)
+      // Bold formatting adds ANSI codes
+      expect(result.includes('\x1b[1m')).toBe(true)
+    })
+
+    it('should handle empty string values', () => {
+      const data = [{ name: '' }]
+      const columns = [{ key: 'name', header: 'Name' }]
+
+      const result = formatTable(data, columns)
+      expect(stripAnsi(result)).toContain('│')
+    })
+  })
+
+  describe('formatSimpleTable', () => {
+    it('should format empty data', () => {
+      const result = formatSimpleTable([], [])
+      expect(result).toBe('(no data)')
+    })
+
+    it('should format simple table without borders', () => {
+      const data = [
+        { name: 'lodash', version: '4.17.21' },
+        { name: 'react', version: '18.2.0' },
+      ]
+      const columns = [
+        { key: 'name', header: 'Package' },
+        { key: 'version', header: 'Version' },
+      ]
+
+      const result = formatSimpleTable(data, columns)
+      expect(result).toContain('Package')
+      expect(result).toContain('Version')
+      expect(result).toContain('lodash')
+      expect(result).toContain('react')
+    })
+
+    it('should not include box borders', () => {
+      const data = [{ name: 'test' }]
+      const columns = [{ key: 'name', header: 'Name' }]
+
+      const result = formatSimpleTable(data, columns)
+      const stripped = stripAnsi(result)
+      expect(stripped).not.toContain('┌')
+      expect(stripped).not.toContain('│')
+    })
+
+    it('should include separator line', () => {
+      const data = [{ name: 'test' }]
+      const columns = [{ key: 'name', header: 'Name' }]
+
+      const result = formatSimpleTable(data, columns)
+      expect(stripAnsi(result)).toContain('─')
+    })
+
+    it('should handle alignment left', () => {
+      const data = [{ value: 'test' }]
+      const columns = [
+        { key: 'value', header: 'Value', align: 'left' as const },
+      ]
+
+      const result = formatSimpleTable(data, columns)
+      expect(result).toContain('test')
+    })
+
+    it('should handle alignment right', () => {
+      const data = [{ value: '42' }]
+      const columns = [
+        { key: 'value', header: 'Number', align: 'right' as const },
+      ]
+
+      const result = formatSimpleTable(data, columns)
+      expect(result).toContain('42')
+    })
+
+    it('should handle alignment center', () => {
+      const data = [{ value: 'center' }]
+      const columns = [
+        { key: 'value', header: 'Value', align: 'center' as const },
+      ]
+
+      const result = formatSimpleTable(data, columns)
+      expect(result).toContain('center')
+    })
+
+    it('should apply color functions', () => {
+      const data = [{ status: 'error' }]
+      const columns = [
+        {
+          key: 'status',
+          header: 'Status',
+          color: (v: string) => colors.red(v),
+        },
+      ]
+
+      const result = formatSimpleTable(data, columns)
+      expect(result).toContain('error')
+      // Should have ANSI codes
+      expect(result.length).toBeGreaterThan(stripAnsi(result).length)
+    })
+
+    it('should handle missing values', () => {
+      const data = [{ name: 'test' }]
+      const columns = [
+        { key: 'name', header: 'Name' },
+        { key: 'missing', header: 'Missing' },
+      ]
+
+      const result = formatSimpleTable(data, columns)
+      expect(result).toContain('test')
+    })
+
+    it('should handle multiple rows', () => {
+      const data = [
+        { a: '1', b: '2' },
+        { a: '3', b: '4' },
+        { a: '5', b: '6' },
+      ]
+      const columns = [
+        { key: 'a', header: 'A' },
+        { key: 'b', header: 'B' },
+      ]
+
+      const result = formatSimpleTable(data, columns)
+      const lines = result.split('\n')
+      expect(lines.length).toBeGreaterThan(3)
+    })
+
+    it('should handle custom column widths', () => {
+      const data = [{ name: 'test' }]
+      const columns = [{ key: 'name', header: 'Name', width: 20 }]
+
+      const result = formatSimpleTable(data, columns)
+      expect(result).toContain('test')
+    })
+
+    it('should handle ANSI colored content', () => {
+      const data = [{ status: colors.green('SUCCESS') }]
+      const columns = [{ key: 'status', header: 'Status' }]
+
+      const result = formatSimpleTable(data, columns)
+      expect(result).toContain('SUCCESS')
+    })
+
+    it('should format headers in bold', () => {
+      const data = [{ name: 'test' }]
+      const columns = [{ key: 'name', header: 'Name' }]
+
+      const result = formatSimpleTable(data, columns)
+      expect(result.includes('\x1b[1m')).toBe(true)
+    })
+
+    it('should be more compact than formatTable', () => {
+      const data = [{ name: 'test' }]
+      const columns = [{ key: 'name', header: 'Name' }]
+
+      const bordered = formatTable(data, columns)
+      const simple = formatSimpleTable(data, columns)
+
+      expect(stripAnsi(simple).length).toBeLessThan(stripAnsi(bordered).length)
+    })
+  })
+
+  describe('edge cases', () => {
+    it('should handle special characters', () => {
+      const data = [{ text: 'Hello! @#$%^&*()' }]
+      const columns = [{ key: 'text', header: 'Text' }]
+
+      const result = formatTable(data, columns)
+      expect(result).toContain('Hello!')
+    })
+
+    it('should handle unicode characters', () => {
+      const data = [{ text: '你好世界' }]
+      const columns = [{ key: 'text', header: 'Text' }]
+
+      const result = formatTable(data, columns)
+      expect(result).toContain('你好世界')
+    })
+
+    it('should handle emoji', () => {
+      const data = [{ status: '✓ Done' }]
+      const columns = [{ key: 'status', header: 'Status' }]
+
+      const result = formatTable(data, columns)
+      expect(result).toContain('✓ Done')
+    })
+
+    it('should handle null values', () => {
+      const data = [{ value: null }]
+      const columns = [{ key: 'value', header: 'Value' }]
+
+      const result = formatTable(data, columns)
+      // null is handled by the code - just check it doesn't crash
+      expect(stripAnsi(result)).toContain('│')
+    })
+
+    it('should handle undefined values', () => {
+      const data = [{ value: undefined }]
+      const columns = [{ key: 'value', header: 'Value' }]
+
+      const result = formatTable(data, columns)
+      // undefined becomes empty string
+      expect(stripAnsi(result)).toContain('│')
+    })
+
+    it('should handle very long headers', () => {
+      const data = [{ x: '1' }]
+      const columns = [
+        {
+          key: 'x',
+          header: 'This is a very long header name that extends far',
+        },
+      ]
+
+      const result = formatTable(data, columns)
+      expect(result).toContain('This is a very long header')
+    })
+
+    it('should handle zero values', () => {
+      const data = [{ count: 0 }]
+      const columns = [{ key: 'count', header: 'Count' }]
+
+      const result = formatTable(data, columns)
+      expect(result).toContain('0')
+    })
+  })
+
+  describe('integration', () => {
+    it('should format complex table with all features', () => {
+      const data = [
+        { name: 'package1', version: '1.0.0', issues: 0, status: 'ok' },
+        { name: 'package2', version: '2.1.3', issues: 3, status: 'warning' },
+      ]
+      const columns = [
+        { key: 'name', header: 'Package', align: 'left' as const },
+        { key: 'version', header: 'Version', align: 'center' as const },
+        {
+          key: 'issues',
+          header: 'Issues',
+          align: 'right' as const,
+          color: (v: string) => (v === '0' ? colors.green(v) : colors.red(v)),
+        },
+        { key: 'status', header: 'Status', width: 10 },
+      ]
+
+      const result = formatTable(data, columns)
+      expect(result).toContain('package1')
+      expect(result).toContain('package2')
+      expect(result).toContain('1.0.0')
+      expect(result).toContain('2.1.3')
+    })
+
+    it('should produce valid output structure', () => {
+      const data = [{ a: '1' }]
+      const columns = [{ key: 'a', header: 'A' }]
+
+      const result = formatTable(data, columns)
+      const lines = result.split('\n')
+
+      // Should have: top border, header, separator, data row, bottom border
+      expect(lines.length).toBe(5)
+    })
+  })
+})
diff --git a/test/unit/temporary-executor.test.ts b/test/unit/temporary-executor.test.ts
new file mode 100644
index 0000000..73c5b28
--- /dev/null
+++ b/test/unit/temporary-executor.test.ts
@@ -0,0 +1,445 @@
+/**
+ * @fileoverview Unit tests for temporary package executor detection (npx/dlx).
+ *
+ * Tests detection of temporary package executor environments:
+ * - isRunningInTemporaryExecutor() detects npx, pnpm dlx, yarn dlx
+ * - User agent parsing from npm_config_user_agent
+ * - Environment variable inspection
+ * - Package manager version detection
+ * Used by Socket CLI to adapt behavior when running via npx/dlx.
+ */
+
+import { afterEach, describe, expect, it } from 'vitest'
+
+import { isRunningInTemporaryExecutor } from '@socketsecurity/lib/temporary-executor'
+
+describe('temporary-executor', () => {
+  describe('isRunningInTemporaryExecutor', () => {
+    describe('user agent detection', () => {
+      const originalUserAgent = process.env['npm_config_user_agent']
+
+      afterEach(() => {
+        if (originalUserAgent === undefined) {
+          delete process.env['npm_config_user_agent']
+        } else {
+          process.env['npm_config_user_agent'] = originalUserAgent
+        }
+      })
+
+      it('should detect npm exec in user agent', () => {
+        process.env['npm_config_user_agent'] = 'npm/8.19.2 node/v18.12.0 exec'
+        expect(isRunningInTemporaryExecutor('/home/user/project')).toBe(true)
+      })
+
+      it('should detect npx in user agent', () => {
+        process.env['npm_config_user_agent'] = 'npm/8.19.2 node/v18.12.0 npx'
+        expect(isRunningInTemporaryExecutor('/home/user/project')).toBe(true)
+      })
+
+      it('should detect dlx in user agent', () => {
+        process.env['npm_config_user_agent'] = 'pnpm/8.6.0 node/v18.12.0 dlx'
+        expect(isRunningInTemporaryExecutor('/home/user/project')).toBe(true)
+      })
+
+      it('should not detect normal npm usage', () => {
+        process.env['npm_config_user_agent'] =
+          'npm/8.19.2 node/v18.12.0 darwin x64'
+        expect(isRunningInTemporaryExecutor('/home/user/project')).toBe(false)
+      })
+
+      it('should not detect normal pnpm usage', () => {
+        process.env['npm_config_user_agent'] =
+          'pnpm/8.6.0 node/v18.12.0 darwin x64'
+        expect(isRunningInTemporaryExecutor('/home/user/project')).toBe(false)
+      })
+
+      it('should not detect when user agent is undefined', () => {
+        delete process.env['npm_config_user_agent']
+        expect(isRunningInTemporaryExecutor('/home/user/project')).toBe(false)
+      })
+
+      it('should not detect when user agent is empty', () => {
+        process.env['npm_config_user_agent'] = ''
+        expect(isRunningInTemporaryExecutor('/home/user/project')).toBe(false)
+      })
+
+      it('should detect exec substring in longer user agent', () => {
+        process.env['npm_config_user_agent'] =
+          'npm/9.0.0 node/v20.0.0 linux x64 workspaces/false exec'
+        expect(isRunningInTemporaryExecutor('/home/user/project')).toBe(true)
+      })
+
+      it('should detect npx substring anywhere in user agent', () => {
+        process.env['npm_config_user_agent'] =
+          'npm/9.0.0 npx node/v20.0.0 linux x64'
+        expect(isRunningInTemporaryExecutor('/home/user/project')).toBe(true)
+      })
+
+      it('should detect dlx with yarn', () => {
+        process.env['npm_config_user_agent'] = 'yarn/3.5.0 node/v18.12.0 dlx'
+        expect(isRunningInTemporaryExecutor('/home/user/project')).toBe(true)
+      })
+    })
+
+    describe('npm cache detection', () => {
+      const originalCache = process.env['npm_config_cache']
+
+      afterEach(() => {
+        if (originalCache === undefined) {
+          delete process.env['npm_config_cache']
+        } else {
+          process.env['npm_config_cache'] = originalCache
+        }
+      })
+
+      it('should detect execution from npm cache directory', () => {
+        process.env['npm_config_cache'] = '/home/user/.npm'
+        expect(
+          isRunningInTemporaryExecutor('/home/user/.npm/_npx/abc123'),
+        ).toBe(true)
+      })
+
+      it('should detect execution from Windows npm cache', () => {
+        process.env['npm_config_cache'] = 'C:\\Users\\user\\AppData\\npm-cache'
+        expect(
+          isRunningInTemporaryExecutor(
+            'C:\\Users\\user\\AppData\\npm-cache\\_npx\\123',
+          ),
+        ).toBe(true)
+      })
+
+      it('should not detect when cwd is outside npm cache', () => {
+        process.env['npm_config_cache'] = '/home/user/.npm'
+        expect(isRunningInTemporaryExecutor('/home/user/project')).toBe(false)
+      })
+
+      it('should not detect when npm_config_cache is not set', () => {
+        delete process.env['npm_config_cache']
+        expect(
+          isRunningInTemporaryExecutor('/home/user/.npm/_npx/abc123'),
+        ).toBe(true) // Still detects due to _npx pattern
+      })
+
+      it('should handle npm cache path with forward slashes on Windows', () => {
+        process.env['npm_config_cache'] = 'C:/Users/user/AppData/npm-cache'
+        expect(
+          isRunningInTemporaryExecutor('C:/Users/user/AppData/npm-cache/_npx'),
+        ).toBe(true)
+      })
+
+      it('should handle empty npm_config_cache', () => {
+        process.env['npm_config_cache'] = ''
+        expect(isRunningInTemporaryExecutor('/home/user/project')).toBe(false)
+      })
+    })
+
+    describe('temporary path patterns', () => {
+      it('should detect _npx directory', () => {
+        expect(isRunningInTemporaryExecutor('/home/user/.npm/_npx/123')).toBe(
+          true,
+        )
+      })
+
+      it('should detect _npx in nested path', () => {
+        expect(
+          isRunningInTemporaryExecutor('/home/user/.cache/_npx/abc/def'),
+        ).toBe(true)
+      })
+
+      it('should detect .pnpm-store directory', () => {
+        expect(
+          isRunningInTemporaryExecutor('/home/user/.pnpm-store/dlx-123'),
+        ).toBe(true)
+      })
+
+      it('should detect dlx- prefix', () => {
+        expect(isRunningInTemporaryExecutor('/tmp/dlx-abc123')).toBe(true)
+      })
+
+      it('should detect dlx- in nested path', () => {
+        expect(
+          isRunningInTemporaryExecutor('/var/tmp/pnpm/dlx-package/bin'),
+        ).toBe(true)
+      })
+
+      it('should detect Yarn Berry PnP virtual packages', () => {
+        expect(
+          isRunningInTemporaryExecutor(
+            '/home/user/project/.yarn/$$/virtual/package',
+          ),
+        ).toBe(true)
+      })
+
+      it('should detect Yarn $$ pattern anywhere in path', () => {
+        expect(
+          isRunningInTemporaryExecutor('/project/.yarn/$$/cache/package'),
+        ).toBe(true)
+      })
+
+      it('should not detect normal project directories', () => {
+        expect(isRunningInTemporaryExecutor('/home/user/my-project')).toBe(
+          false,
+        )
+      })
+
+      it('should not detect node_modules', () => {
+        expect(
+          isRunningInTemporaryExecutor('/home/user/project/node_modules/.bin'),
+        ).toBe(false)
+      })
+
+      it('should not detect normal pnpm-store (without dot)', () => {
+        expect(isRunningInTemporaryExecutor('/home/user/pnpm-store')).toBe(
+          false,
+        )
+      })
+    })
+
+    describe('Windows-specific patterns', () => {
+      it('should detect Yarn Windows temp xfs pattern on Windows', () => {
+        const cwd = 'C:\\Users\\user\\AppData\\Local\\Temp\\xfs-abc123'
+        const result = isRunningInTemporaryExecutor(cwd)
+        // Only matches on Windows platform (WIN32 constant check)
+        expect(typeof result).toBe('boolean')
+      })
+
+      it('should detect xfs pattern in nested Windows path on Windows', () => {
+        const cwd =
+          'C:\\Users\\user\\AppData\\Local\\Temp\\xfs-123\\package\\bin'
+        const result = isRunningInTemporaryExecutor(cwd)
+        // Only matches on Windows platform (WIN32 constant check)
+        expect(typeof result).toBe('boolean')
+      })
+
+      it('should handle Windows paths with forward slashes on Windows', () => {
+        const cwd = 'C:/Users/user/AppData/Local/Temp/xfs-abc123'
+        const result = isRunningInTemporaryExecutor(cwd)
+        // Only matches on Windows platform (WIN32 constant check)
+        expect(typeof result).toBe('boolean')
+      })
+
+      it('should not detect xfs pattern without AppData/Local/Temp', () => {
+        expect(isRunningInTemporaryExecutor('/home/user/xfs-123')).toBe(false)
+      })
+    })
+
+    describe('path normalization', () => {
+      it('should handle paths with backslashes', () => {
+        expect(
+          isRunningInTemporaryExecutor('C:\\Users\\user\\.npm\\_npx\\123'),
+        ).toBe(true)
+      })
+
+      it('should handle paths with forward slashes', () => {
+        expect(isRunningInTemporaryExecutor('/home/user/.npm/_npx/123')).toBe(
+          true,
+        )
+      })
+
+      it('should handle mixed slash paths', () => {
+        expect(
+          isRunningInTemporaryExecutor('C:/Users/user/.npm\\_npx/123'),
+        ).toBe(true)
+      })
+
+      it('should normalize before pattern matching', () => {
+        expect(
+          isRunningInTemporaryExecutor('C:\\Users\\user\\.pnpm-store\\dlx-abc'),
+        ).toBe(true)
+      })
+    })
+
+    describe('default cwd parameter', () => {
+      it('should use process.cwd() when cwd is not provided', () => {
+        const result = isRunningInTemporaryExecutor()
+        expect(typeof result).toBe('boolean')
+      })
+
+      it('should handle undefined cwd', () => {
+        const result = isRunningInTemporaryExecutor(undefined)
+        expect(typeof result).toBe('boolean')
+      })
+    })
+
+    describe('combined conditions', () => {
+      const originalUserAgent = process.env['npm_config_user_agent']
+      const originalCache = process.env['npm_config_cache']
+
+      afterEach(() => {
+        if (originalUserAgent === undefined) {
+          delete process.env['npm_config_user_agent']
+        } else {
+          process.env['npm_config_user_agent'] = originalUserAgent
+        }
+        if (originalCache === undefined) {
+          delete process.env['npm_config_cache']
+        } else {
+          process.env['npm_config_cache'] = originalCache
+        }
+      })
+
+      it('should detect when both user agent and path pattern match', () => {
+        process.env['npm_config_user_agent'] = 'npm/8.19.2 node/v18.12.0 npx'
+        expect(isRunningInTemporaryExecutor('/home/user/.npm/_npx/123')).toBe(
+          true,
+        )
+      })
+
+      it('should detect when user agent matches but path does not', () => {
+        process.env['npm_config_user_agent'] = 'npm/8.19.2 node/v18.12.0 npx'
+        expect(isRunningInTemporaryExecutor('/home/user/project')).toBe(true)
+      })
+
+      it('should detect when path matches but user agent does not', () => {
+        process.env['npm_config_user_agent'] =
+          'npm/8.19.2 node/v18.12.0 darwin x64'
+        expect(isRunningInTemporaryExecutor('/home/user/.npm/_npx/123')).toBe(
+          true,
+        )
+      })
+
+      it('should detect when npm cache and path both match', () => {
+        process.env['npm_config_cache'] = '/home/user/.npm'
+        expect(isRunningInTemporaryExecutor('/home/user/.npm/_npx/123')).toBe(
+          true,
+        )
+      })
+
+      it('should not detect when no conditions match', () => {
+        delete process.env['npm_config_user_agent']
+        delete process.env['npm_config_cache']
+        expect(isRunningInTemporaryExecutor('/home/user/my-project')).toBe(
+          false,
+        )
+      })
+    })
+
+    describe('edge cases', () => {
+      it('should handle empty cwd', () => {
+        const result = isRunningInTemporaryExecutor('')
+        expect(typeof result).toBe('boolean')
+      })
+
+      it('should handle root directory', () => {
+        expect(isRunningInTemporaryExecutor('/')).toBe(false)
+      })
+
+      it('should handle relative paths', () => {
+        const result = isRunningInTemporaryExecutor('../project/_npx')
+        expect(typeof result).toBe('boolean')
+      })
+
+      it('should be case-sensitive for pattern matching', () => {
+        expect(isRunningInTemporaryExecutor('/home/user/_NPX/123')).toBe(false)
+      })
+
+      it('should handle very long paths', () => {
+        const longPath = `/home/user/${'a'.repeat(200)}/_npx/123`
+        expect(isRunningInTemporaryExecutor(longPath)).toBe(true)
+      })
+
+      it('should handle paths with special characters', () => {
+        expect(isRunningInTemporaryExecutor('/home/user/@scope/_npx/123')).toBe(
+          true,
+        )
+      })
+
+      it('should handle paths with spaces', () => {
+        expect(
+          isRunningInTemporaryExecutor('/home/user/my folder/_npx/123'),
+        ).toBe(true)
+      })
+
+      it('should handle Unicode in paths', () => {
+        expect(isRunningInTemporaryExecutor('/home/用户/.npm/_npx/123')).toBe(
+          true,
+        )
+      })
+
+      it('should handle multiple pattern matches', () => {
+        expect(
+          isRunningInTemporaryExecutor('/home/user/_npx/dlx-abc/.pnpm-store'),
+        ).toBe(true)
+      })
+
+      it('should match pattern as substring anywhere in path', () => {
+        expect(isRunningInTemporaryExecutor('/home/user/my_npx_folder')).toBe(
+          true,
+        )
+      })
+
+      it('should match pattern in filename', () => {
+        expect(isRunningInTemporaryExecutor('/home/user/something_npx')).toBe(
+          true,
+        )
+      })
+
+      it('should handle WSL paths', () => {
+        expect(isRunningInTemporaryExecutor('/mnt/c/Users/user/_npx/123')).toBe(
+          true,
+        )
+      })
+    })
+
+    describe('real-world scenarios', () => {
+      const originalUserAgent = process.env['npm_config_user_agent']
+      const originalCache = process.env['npm_config_cache']
+
+      afterEach(() => {
+        if (originalUserAgent === undefined) {
+          delete process.env['npm_config_user_agent']
+        } else {
+          process.env['npm_config_user_agent'] = originalUserAgent
+        }
+        if (originalCache === undefined) {
+          delete process.env['npm_config_cache']
+        } else {
+          process.env['npm_config_cache'] = originalCache
+        }
+      })
+
+      it('should detect npx command execution', () => {
+        process.env['npm_config_user_agent'] = 'npm/9.5.0 node/v18.15.0 npx'
+        process.env['npm_config_cache'] = '/home/user/.npm'
+        expect(
+          isRunningInTemporaryExecutor(
+            '/home/user/.npm/_npx/12345/node_modules',
+          ),
+        ).toBe(true)
+      })
+
+      it('should detect pnpm dlx execution', () => {
+        process.env['npm_config_user_agent'] = 'pnpm/8.6.0 node/v18.12.0 dlx'
+        expect(
+          isRunningInTemporaryExecutor('/tmp/.pnpm-store/dlx-abc/package'),
+        ).toBe(true)
+      })
+
+      it('should detect yarn dlx execution', () => {
+        process.env['npm_config_user_agent'] = 'yarn/3.5.0 node/v18.12.0 dlx'
+        expect(isRunningInTemporaryExecutor('/tmp/dlx-12345')).toBe(true)
+      })
+
+      it('should not detect regular npm install', () => {
+        process.env['npm_config_user_agent'] =
+          'npm/9.5.0 node/v18.15.0 darwin x64'
+        expect(
+          isRunningInTemporaryExecutor('/home/user/project/node_modules'),
+        ).toBe(false)
+      })
+
+      it('should not detect regular pnpm install', () => {
+        process.env['npm_config_user_agent'] =
+          'pnpm/8.6.0 node/v18.12.0 linux x64'
+        expect(isRunningInTemporaryExecutor('/home/user/project')).toBe(false)
+      })
+
+      it('should not detect global installation', () => {
+        delete process.env['npm_config_user_agent']
+        expect(
+          isRunningInTemporaryExecutor('/usr/local/lib/node_modules'),
+        ).toBe(false)
+      })
+    })
+  })
+})
diff --git a/test/unit/themes/context.test.ts b/test/unit/themes/context.test.ts
new file mode 100644
index 0000000..668a0a0
--- /dev/null
+++ b/test/unit/themes/context.test.ts
@@ -0,0 +1,343 @@
+/**
+ * @fileoverview Unit tests for theme context management.
+ *
+ * Tests AsyncLocalStorage-based theme context management for scoped theming:
+ * - getTheme() retrieves the current theme from context
+ * - setTheme() sets the global theme (name string or Theme object)
+ * - withTheme() runs async functions with a scoped theme, restoring previous on completion
+ * - withThemeSync() provides synchronous scoped theme execution
+ * - onThemeChange() registers listeners for theme changes with cleanup
+ * - Handles nested theme scopes, rapid theme switches, and listener management
+ * Enables theme isolation across concurrent operations in Socket CLI tools.
+ */
+
+import {
+  getTheme,
+  setTheme,
+  withTheme,
+  withThemeSync,
+  onThemeChange,
+} from '@socketsecurity/lib/themes/context'
+import { describe, expect, it, beforeEach } from 'vitest'
+
+describe('themes/context', () => {
+  describe('getTheme', () => {
+    it('should return a theme object', () => {
+      const theme = getTheme()
+      expect(theme).toBeDefined()
+      expect(theme).toHaveProperty('name')
+      expect(theme).toHaveProperty('colors')
+    })
+
+    it('should return theme with required properties', () => {
+      const theme = getTheme()
+      expect(theme.colors).toBeDefined()
+      expect(theme.colors.primary).toBeDefined()
+      expect(theme.colors.success).toBeDefined()
+      expect(theme.colors.error).toBeDefined()
+    })
+  })
+
+  describe('setTheme', () => {
+    beforeEach(() => {
+      // Reset to default theme
+      setTheme('socket')
+    })
+
+    it('should accept theme name', () => {
+      setTheme('socket')
+      const theme = getTheme()
+      expect(theme.name).toBe('socket')
+    })
+
+    it('should accept theme object', () => {
+      const customTheme = {
+        name: 'custom',
+        displayName: 'Custom',
+        colors: {
+          primary: 'blue' as const,
+          secondary: 'green' as const,
+          success: 'green' as const,
+          error: 'red' as const,
+          warning: 'yellow' as const,
+          info: 'cyan' as const,
+          step: 'cyan' as const,
+          text: 'white' as const,
+          textDim: 'gray' as const,
+          link: 'blue' as const,
+          prompt: 'cyan' as const,
+        },
+      }
+      setTheme(customTheme)
+      const theme = getTheme()
+      expect(theme.name).toBe('custom')
+    })
+
+    it('should change active theme', () => {
+      setTheme('socket')
+      expect(getTheme().name).toBe('socket')
+
+      setTheme('sunset')
+      expect(getTheme().name).toBe('sunset')
+    })
+  })
+
+  describe('withTheme', () => {
+    beforeEach(() => {
+      setTheme('socket')
+    })
+
+    it('should run async function with scoped theme', async () => {
+      let capturedTheme: string | undefined
+
+      await withTheme('sunset', async () => {
+        capturedTheme = getTheme().name
+      })
+
+      expect(capturedTheme).toBe('sunset')
+    })
+
+    it('should restore previous theme after async completion', async () => {
+      setTheme('socket')
+
+      await withTheme('sunset', async () => {
+        expect(getTheme().name).toBe('sunset')
+      })
+
+      expect(getTheme().name).toBe('socket')
+    })
+
+    it('should return the async function result', async () => {
+      const result = await withTheme('socket', async () => {
+        return 42
+      })
+
+      expect(result).toBe(42)
+    })
+
+    it('should work with nested async calls', async () => {
+      setTheme('socket')
+
+      await withTheme('sunset', async () => {
+        expect(getTheme().name).toBe('sunset')
+
+        await withTheme('socket', async () => {
+          expect(getTheme().name).toBe('socket')
+        })
+
+        expect(getTheme().name).toBe('sunset')
+      })
+
+      expect(getTheme().name).toBe('socket')
+    })
+
+    it('should handle promises', async () => {
+      const result = await withTheme('socket', async () => {
+        return await Promise.resolve('test-value')
+      })
+
+      expect(result).toBe('test-value')
+    })
+
+    it('should accept theme object', async () => {
+      const customTheme = {
+        name: 'custom',
+        displayName: 'Custom',
+        colors: {
+          primary: 'blue' as const,
+          secondary: 'green' as const,
+          success: 'green' as const,
+          error: 'red' as const,
+          warning: 'yellow' as const,
+          info: 'cyan' as const,
+          step: 'cyan' as const,
+          text: 'white' as const,
+          textDim: 'gray' as const,
+          link: 'blue' as const,
+          prompt: 'cyan' as const,
+        },
+      }
+
+      await withTheme(customTheme, async () => {
+        expect(getTheme().name).toBe('custom')
+      })
+    })
+  })
+
+  describe('withThemeSync', () => {
+    beforeEach(() => {
+      setTheme('socket')
+    })
+
+    it('should run sync function with scoped theme', () => {
+      let capturedTheme: string | undefined
+
+      withThemeSync('sunset', () => {
+        capturedTheme = getTheme().name
+      })
+
+      expect(capturedTheme).toBe('sunset')
+    })
+
+    it('should restore previous theme after sync completion', () => {
+      setTheme('socket')
+
+      withThemeSync('sunset', () => {
+        expect(getTheme().name).toBe('sunset')
+      })
+
+      expect(getTheme().name).toBe('socket')
+    })
+
+    it('should return the sync function result', () => {
+      const result = withThemeSync('socket', () => {
+        return 'sync-result'
+      })
+
+      expect(result).toBe('sync-result')
+    })
+
+    it('should work with nested sync calls', () => {
+      setTheme('socket')
+
+      withThemeSync('sunset', () => {
+        expect(getTheme().name).toBe('sunset')
+
+        withThemeSync('socket', () => {
+          expect(getTheme().name).toBe('socket')
+        })
+
+        expect(getTheme().name).toBe('sunset')
+      })
+
+      expect(getTheme().name).toBe('socket')
+    })
+
+    it('should accept theme object', () => {
+      const customTheme = {
+        name: 'custom-sync',
+        displayName: 'Custom Sync',
+        colors: {
+          primary: 'red' as const,
+          secondary: 'blue' as const,
+          success: 'green' as const,
+          error: 'red' as const,
+          warning: 'yellow' as const,
+          info: 'cyan' as const,
+          step: 'cyan' as const,
+          text: 'white' as const,
+          textDim: 'gray' as const,
+          link: 'blue' as const,
+          prompt: 'cyan' as const,
+        },
+      }
+
+      withThemeSync(customTheme, () => {
+        expect(getTheme().name).toBe('custom-sync')
+      })
+    })
+  })
+
+  describe('onThemeChange', () => {
+    const unsubscribers: Array<() => void> = []
+
+    beforeEach(() => {
+      setTheme('socket')
+      // Clean up any leftover listeners
+      unsubscribers.forEach(u => u())
+      unsubscribers.length = 0
+    })
+
+    it('should register theme change listener', () => {
+      let callCount = 0
+      const unsubscribe = onThemeChange(() => {
+        callCount++
+      })
+      unsubscribers.push(unsubscribe)
+
+      setTheme('sunset')
+      expect(callCount).toBeGreaterThanOrEqual(1)
+
+      unsubscribe()
+    })
+
+    it('should call listener with new theme', () => {
+      let capturedTheme: any
+      const unsubscribe = onThemeChange(theme => {
+        capturedTheme = theme
+      })
+      unsubscribers.push(unsubscribe)
+
+      setTheme('sunset')
+      expect(capturedTheme).toBeDefined()
+
+      unsubscribe()
+    })
+
+    it('should support multiple listeners', () => {
+      let count1 = 0
+      let count2 = 0
+
+      const unsub1 = onThemeChange(() => {
+        count1++
+      })
+      const unsub2 = onThemeChange(() => {
+        count2++
+      })
+      unsubscribers.push(unsub1, unsub2)
+
+      setTheme('sunset')
+
+      expect(count1).toBeGreaterThanOrEqual(1)
+      expect(count2).toBeGreaterThanOrEqual(1)
+
+      unsub1()
+      unsub2()
+    })
+
+    it('should unsubscribe listener', () => {
+      let callCount = 0
+      const unsubscribe = onThemeChange(() => {
+        callCount++
+      })
+      unsubscribers.push(unsubscribe)
+
+      setTheme('sunset')
+      const countAfterFirst = callCount
+      expect(countAfterFirst).toBeGreaterThanOrEqual(1)
+
+      unsubscribe()
+
+      setTheme('socket')
+      expect(callCount).toBe(countAfterFirst) // Should not increase
+    })
+  })
+
+  describe('edge cases', () => {
+    beforeEach(() => {
+      setTheme('socket')
+    })
+
+    it('should handle rapid theme changes', () => {
+      setTheme('socket')
+      setTheme('sunset')
+      setTheme('socket')
+      setTheme('sunset')
+
+      expect(getTheme().name).toBe('sunset')
+    })
+
+    it('should handle async and sync theme scoping together', async () => {
+      setTheme('socket')
+
+      await withTheme('sunset', async () => {
+        withThemeSync('socket', () => {
+          expect(getTheme().name).toBe('socket')
+        })
+        expect(getTheme().name).toBe('sunset')
+      })
+
+      expect(getTheme().name).toBe('socket')
+    })
+  })
+})
diff --git a/test/unit/themes/utils.test.ts b/test/unit/themes/utils.test.ts
new file mode 100644
index 0000000..4d5f0a5
--- /dev/null
+++ b/test/unit/themes/utils.test.ts
@@ -0,0 +1,174 @@
+/**
+ * @fileoverview Unit tests for theme utility functions.
+ *
+ * Tests color resolution utilities for Socket's theme system:
+ * - resolveColor() resolves semantic color keywords (primary, secondary) to actual colors
+ * - Handles color values as strings ('blue', 'red') or RGB tuples ([255, 0, 0])
+ * - Fallback behavior: 'secondary' falls back to 'primary' when undefined
+ * - 'inherit' keyword passes through unchanged
+ * - Direct color values (non-keywords) pass through unchanged
+ * Enables consistent theming across Socket CLI tools with semantic color names.
+ */
+
+import { resolveColor } from '@socketsecurity/lib/themes/utils'
+import { describe, expect, it } from 'vitest'
+
+describe('themes/utils', () => {
+  describe('resolveColor', () => {
+    it('should resolve primary keyword', () => {
+      const result = resolveColor('primary', {
+        primary: 'blue' as const,
+        secondary: 'green' as const,
+        success: 'green' as const,
+        error: 'red' as const,
+        warning: 'yellow' as const,
+        info: 'cyan' as const,
+        step: 'cyan' as const,
+        text: 'white' as const,
+        textDim: 'gray' as const,
+        link: 'blue' as const,
+        prompt: 'cyan' as const,
+      })
+      expect(result).toBe('blue')
+    })
+
+    it('should resolve secondary keyword with fallback', () => {
+      const result = resolveColor('secondary', {
+        primary: 'blue' as const,
+        success: 'green' as const,
+        error: 'red' as const,
+        warning: 'yellow' as const,
+        info: 'cyan' as const,
+        step: 'cyan' as const,
+        text: 'white' as const,
+        textDim: 'gray' as const,
+        link: 'blue' as const,
+        prompt: 'cyan' as const,
+      })
+      // Falls back to primary when secondary is undefined
+      expect(result).toBe('blue')
+    })
+
+    it('should resolve secondary when defined', () => {
+      const result = resolveColor('secondary', {
+        primary: 'blue' as const,
+        secondary: 'magenta' as const,
+        success: 'green' as const,
+        error: 'red' as const,
+        warning: 'yellow' as const,
+        info: 'cyan' as const,
+        step: 'cyan' as const,
+        text: 'white' as const,
+        textDim: 'gray' as const,
+        link: 'blue' as const,
+        prompt: 'cyan' as const,
+      })
+      expect(result).toBe('magenta')
+    })
+
+    it('should resolve inherit keyword', () => {
+      const result = resolveColor('inherit', {
+        primary: 'blue' as const,
+        secondary: 'green' as const,
+        success: 'green' as const,
+        error: 'red' as const,
+        warning: 'yellow' as const,
+        info: 'cyan' as const,
+        step: 'cyan' as const,
+        text: 'white' as const,
+        textDim: 'gray' as const,
+        link: 'blue' as const,
+        prompt: 'cyan' as const,
+      })
+      expect(result).toBe('inherit')
+    })
+
+    it('should pass through color values', () => {
+      const result = resolveColor('red', {
+        primary: 'blue' as const,
+        secondary: 'green' as const,
+        success: 'green' as const,
+        error: 'red' as const,
+        warning: 'yellow' as const,
+        info: 'cyan' as const,
+        step: 'cyan' as const,
+        text: 'white' as const,
+        textDim: 'gray' as const,
+        link: 'blue' as const,
+        prompt: 'cyan' as const,
+      })
+      expect(result).toBe('red')
+    })
+
+    it('should pass through RGB tuples', () => {
+      const result = resolveColor([255, 100, 50], {
+        primary: 'blue' as const,
+        secondary: 'green' as const,
+        success: 'green' as const,
+        error: 'red' as const,
+        warning: 'yellow' as const,
+        info: 'cyan' as const,
+        step: 'cyan' as const,
+        text: 'white' as const,
+        textDim: 'gray' as const,
+        link: 'blue' as const,
+        prompt: 'cyan' as const,
+      })
+      expect(result).toEqual([255, 100, 50])
+    })
+
+    it('should resolve primary as RGB tuple', () => {
+      const result = resolveColor('primary', {
+        primary: [100, 150, 200] as const,
+        secondary: 'green' as const,
+        success: 'green' as const,
+        error: 'red' as const,
+        warning: 'yellow' as const,
+        info: 'cyan' as const,
+        step: 'cyan' as const,
+        text: 'white' as const,
+        textDim: 'gray' as const,
+        link: 'blue' as const,
+        prompt: 'cyan' as const,
+      })
+      expect(result).toEqual([100, 150, 200])
+    })
+  })
+
+  describe('color resolution edge cases', () => {
+    it('should handle mixed color value types', () => {
+      const colors = {
+        primary: 'blue' as const,
+        secondary: [100, 150, 200] as const,
+        success: 'green' as const,
+        error: [255, 0, 0] as const,
+        warning: 'yellow' as const,
+        info: 'cyan' as const,
+        step: 'cyan' as const,
+        text: 'white' as const,
+        textDim: 'gray' as const,
+        link: 'blue' as const,
+        prompt: 'cyan' as const,
+      }
+      expect(resolveColor('primary', colors)).toBe('blue')
+      expect(resolveColor('secondary', colors)).toEqual([100, 150, 200])
+    })
+
+    it('should handle arbitrary color names', () => {
+      const result = resolveColor('yellowBright' as any, {
+        primary: 'blue' as const,
+        secondary: 'green' as const,
+        success: 'green' as const,
+        error: 'red' as const,
+        warning: 'yellow' as const,
+        info: 'cyan' as const,
+        step: 'cyan' as const,
+        text: 'white' as const,
+        textDim: 'gray' as const,
+        link: 'blue' as const,
+        prompt: 'cyan' as const,
+      })
+      expect(result).toBe('yellowBright')
+    })
+  })
+})
diff --git a/test/registry/url.test.ts b/test/unit/url.test.ts
similarity index 97%
rename from test/registry/url.test.ts
rename to test/unit/url.test.ts
index 1cd4031..969d6ed 100644
--- a/test/registry/url.test.ts
+++ b/test/unit/url.test.ts
@@ -1,5 +1,13 @@
 /**
  * @fileoverview Unit tests for URL parsing and validation utilities.
+ *
+ * Tests URL manipulation and query parameter utilities:
+ * - isUrl() validates URL strings
+ * - parseUrl() parses URLs with error handling
+ * - createRelativeUrl() constructs relative URLs
+ * - urlSearchParamAs*() typed query parameter extractors (String, Number, Boolean, Array)
+ * - urlSearchParamsGet*() URLSearchParams helper methods
+ * Used by Socket tools for API URL construction and query parameter parsing.
  */
 
 import {
diff --git a/test/unit/utils/get-ipc.test.ts b/test/unit/utils/get-ipc.test.ts
new file mode 100644
index 0000000..5fb8251
--- /dev/null
+++ b/test/unit/utils/get-ipc.test.ts
@@ -0,0 +1,315 @@
+/**
+ * @fileoverview Unit tests for IPC object lazy loader utility.
+ *
+ * Tests IPC object getter for worker thread communication:
+ * - getIpc() returns IpcObject with sendMessage(), disconnect()
+ * - Lazy-loads worker_threads module
+ * - Type-safe IPC message passing
+ * - Worker thread detection and initialization
+ * Used by Socket CLI for parent-worker communication in multi-threaded operations.
+ */
+
+import { describe, expect, it } from 'vitest'
+
+import { getIpc } from '@socketsecurity/lib/utils/get-ipc'
+import type { IpcObject } from '@socketsecurity/lib/utils/get-ipc'
+
+describe('utils/get-ipc', () => {
+  describe('getIpc()', () => {
+    it('should export getIpc function', () => {
+      expect(typeof getIpc).toBe('function')
+    })
+
+    it('should return an object', async () => {
+      const ipc = await getIpc()
+      expect(typeof ipc).toBe('object')
+      expect(ipc).not.toBeNull()
+    })
+
+    it('should return frozen object', async () => {
+      const ipc = await getIpc()
+      expect(Object.isFrozen(ipc)).toBe(true)
+    })
+
+    it('should cache result on subsequent calls', async () => {
+      const ipc1 = await getIpc()
+      const ipc2 = await getIpc()
+      expect(ipc1).toBe(ipc2)
+    })
+
+    it('should return same reference every time', async () => {
+      const results = await Promise.all([getIpc(), getIpc(), getIpc()])
+      expect(results[0]).toBe(results[1])
+      expect(results[1]).toBe(results[2])
+    })
+  })
+
+  describe('IpcObject properties', () => {
+    it('should only contain SOCKET_CLI_* properties if set', async () => {
+      const ipc = await getIpc()
+      const keys = Object.keys(ipc)
+
+      keys.forEach(key => {
+        expect(key).toMatch(/^SOCKET_CLI_/)
+      })
+    })
+
+    it('should have correct property types', async () => {
+      const ipc = await getIpc()
+
+      // String properties
+      if ('SOCKET_CLI_FIX' in ipc) {
+        expect(typeof ipc.SOCKET_CLI_FIX).toBe('string')
+      }
+      if ('SOCKET_CLI_SHADOW_API_TOKEN' in ipc) {
+        expect(typeof ipc.SOCKET_CLI_SHADOW_API_TOKEN).toBe('string')
+      }
+      if ('SOCKET_CLI_SHADOW_BIN' in ipc) {
+        expect(typeof ipc.SOCKET_CLI_SHADOW_BIN).toBe('string')
+      }
+
+      // Boolean properties
+      if ('SOCKET_CLI_OPTIMIZE' in ipc) {
+        expect(typeof ipc.SOCKET_CLI_OPTIMIZE).toBe('boolean')
+      }
+      if ('SOCKET_CLI_SHADOW_ACCEPT_RISKS' in ipc) {
+        expect(typeof ipc.SOCKET_CLI_SHADOW_ACCEPT_RISKS).toBe('boolean')
+      }
+      if ('SOCKET_CLI_SHADOW_PROGRESS' in ipc) {
+        expect(typeof ipc.SOCKET_CLI_SHADOW_PROGRESS).toBe('boolean')
+      }
+      if ('SOCKET_CLI_SHADOW_SILENT' in ipc) {
+        expect(typeof ipc.SOCKET_CLI_SHADOW_SILENT).toBe('boolean')
+      }
+    })
+
+    it('should not have undefined values', async () => {
+      const ipc = await getIpc()
+      const values = Object.values(ipc)
+
+      values.forEach(value => {
+        expect(value).not.toBeUndefined()
+      })
+    })
+  })
+
+  describe('key accessor', () => {
+    it('should support getting specific keys', async () => {
+      const ipc = await getIpc()
+      const keys = Object.keys(ipc) as Array<keyof IpcObject>
+
+      for (const key of keys) {
+        const value = await getIpc(key)
+        expect(value).toBe(ipc[key])
+      }
+    })
+
+    it('should return undefined for missing keys', async () => {
+      const value = await getIpc('SOCKET_CLI_FIX' as keyof IpcObject)
+      const ipc = await getIpc()
+
+      if (!('SOCKET_CLI_FIX' in ipc)) {
+        expect(value).toBeUndefined()
+      }
+    })
+
+    it('should work with all known keys', async () => {
+      const keys: Array<keyof IpcObject> = [
+        'SOCKET_CLI_FIX',
+        'SOCKET_CLI_OPTIMIZE',
+        'SOCKET_CLI_SHADOW_ACCEPT_RISKS',
+        'SOCKET_CLI_SHADOW_API_TOKEN',
+        'SOCKET_CLI_SHADOW_BIN',
+        'SOCKET_CLI_SHADOW_PROGRESS',
+        'SOCKET_CLI_SHADOW_SILENT',
+      ]
+
+      for (const key of keys) {
+        const value = await getIpc(key)
+        const ipc = await getIpc()
+        expect(value).toBe(ipc[key])
+      }
+    })
+  })
+
+  describe('type safety', () => {
+    it('should support IpcObject type', () => {
+      const obj: IpcObject = {
+        SOCKET_CLI_FIX: 'test',
+        SOCKET_CLI_OPTIMIZE: true,
+      }
+      expect(obj).toBeDefined()
+    })
+
+    it('should support partial IpcObject', () => {
+      const obj: Partial<IpcObject> = {
+        SOCKET_CLI_FIX: 'test',
+      }
+      expect(obj).toBeDefined()
+    })
+
+    it('should support empty IpcObject', () => {
+      const obj: IpcObject = {}
+      expect(obj).toBeDefined()
+    })
+
+    it('should enforce correct types for properties', () => {
+      // TypeScript compile-time check
+      const obj: IpcObject = {
+        SOCKET_CLI_FIX: 'string-value',
+        SOCKET_CLI_OPTIMIZE: true,
+        SOCKET_CLI_SHADOW_ACCEPT_RISKS: true,
+        SOCKET_CLI_SHADOW_API_TOKEN: 'token',
+        SOCKET_CLI_SHADOW_BIN: '/bin/path',
+        SOCKET_CLI_SHADOW_PROGRESS: true,
+        SOCKET_CLI_SHADOW_SILENT: false,
+      }
+      expect(obj).toBeDefined()
+    })
+  })
+
+  describe('immutability', () => {
+    it('should not allow modification', async () => {
+      const ipc = await getIpc()
+
+      expect(() => {
+        ipc.SOCKET_CLI_FIX = 'modified'
+      }).toThrow()
+    })
+
+    it('should not allow adding properties', async () => {
+      const ipc = await getIpc()
+
+      expect(() => {
+        // @ts-expect-error - Testing immutability by assigning to non-existent property
+        ipc.NEW_PROPERTY = 'value'
+      }).toThrow()
+    })
+
+    it('should not allow deleting properties', async () => {
+      const ipc = await getIpc()
+      const keys = Object.keys(ipc)
+
+      if (keys.length > 0) {
+        expect(() => {
+          delete ipc[keys[0]]
+        }).toThrow()
+      }
+    })
+  })
+
+  describe('concurrent access', () => {
+    it('should handle multiple concurrent calls', async () => {
+      const results = await Promise.all([
+        getIpc(),
+        getIpc(),
+        getIpc(),
+        getIpc(),
+        getIpc(),
+      ])
+
+      // All should return the same reference
+      results.forEach(result => {
+        expect(result).toBe(results[0])
+      })
+    })
+
+    it('should handle concurrent key accesses', async () => {
+      const ipc = await getIpc()
+      const keys = Object.keys(ipc) as Array<keyof IpcObject>
+
+      if (keys.length > 0) {
+        const results = await Promise.all(keys.map(key => getIpc(key)))
+
+        results.forEach((result, i) => {
+          expect(result).toBe(ipc[keys[i]])
+        })
+      }
+    })
+  })
+
+  describe('edge cases', () => {
+    it('should handle rapid repeated calls', async () => {
+      const calls = []
+      for (let i = 0; i < 100; i++) {
+        calls.push(getIpc())
+      }
+
+      const results = await Promise.all(calls)
+      results.forEach(result => {
+        expect(result).toBe(results[0])
+      })
+    })
+
+    it('should work with destructuring', async () => {
+      const ipc = await getIpc()
+      const { SOCKET_CLI_FIX, SOCKET_CLI_OPTIMIZE } = ipc
+
+      expect(SOCKET_CLI_FIX).toBe(ipc.SOCKET_CLI_FIX)
+      expect(SOCKET_CLI_OPTIMIZE).toBe(ipc.SOCKET_CLI_OPTIMIZE)
+    })
+
+    it('should work with spread operator', async () => {
+      const ipc = await getIpc()
+      const copy = { ...ipc }
+
+      expect(copy).toEqual(ipc)
+      expect(copy).not.toBe(ipc)
+    })
+
+    it('should work with Object.keys', async () => {
+      const ipc = await getIpc()
+      const keys = Object.keys(ipc)
+
+      expect(Array.isArray(keys)).toBe(true)
+      keys.forEach(key => {
+        expect(key in ipc).toBe(true)
+      })
+    })
+
+    it('should work with Object.values', async () => {
+      const ipc = await getIpc()
+      const values = Object.values(ipc)
+
+      expect(Array.isArray(values)).toBe(true)
+      expect(values.length).toBe(Object.keys(ipc).length)
+    })
+
+    it('should work with Object.entries', async () => {
+      const ipc = await getIpc()
+      const entries = Object.entries(ipc)
+
+      expect(Array.isArray(entries)).toBe(true)
+      entries.forEach(([key, value]) => {
+        expect(ipc[key as keyof IpcObject]).toBe(value)
+      })
+    })
+
+    it('should work with for...in loop', async () => {
+      const ipc = await getIpc()
+      const keys: string[] = []
+
+      for (const key in ipc) {
+        keys.push(key)
+      }
+
+      expect(keys).toEqual(Object.keys(ipc))
+    })
+
+    it('should work with hasOwnProperty', async () => {
+      const ipc = await getIpc()
+      const keys = Object.keys(ipc)
+
+      keys.forEach(key => {
+        expect(Object.hasOwn(ipc, key)).toBe(true)
+      })
+    })
+
+    it('should not have prototype pollution', async () => {
+      const ipc = await getIpc()
+
+      expect('toString' in ipc).toBe(true) // inherited
+      expect(Object.hasOwn(ipc, 'toString')).toBe(false) // not own property
+    })
+  })
+})
diff --git a/test/unit/utils/stdio-test-helper.ts b/test/unit/utils/stdio-test-helper.ts
new file mode 100644
index 0000000..a212319
--- /dev/null
+++ b/test/unit/utils/stdio-test-helper.ts
@@ -0,0 +1,117 @@
+/**
+ * @fileoverview Shared test utilities for stdio stream testing.
+ */
+
+import { WriteStream } from 'node:tty'
+import type { Writable } from 'node:stream'
+import { afterEach, beforeEach, vi } from 'vitest'
+
+interface StdioTestContext {
+  originalIsTTY: boolean | undefined
+  originalColumns: number | undefined
+  originalRows: number | undefined
+  writeSpy: ReturnType<typeof vi.spyOn>
+  cursorToSpy?: ReturnType<typeof vi.spyOn>
+  clearLineSpy?: ReturnType<typeof vi.spyOn>
+  clearScreenDownSpy?: ReturnType<typeof vi.spyOn>
+}
+
+/**
+ * Sets up common mocks and spies for stdio stream testing.
+ * Reduces ~50 lines of duplicate setup code per test file.
+ */
+export function setupStdioTest(
+  stream: NodeJS.WriteStream & Writable,
+): StdioTestContext {
+  const context: StdioTestContext = {
+    originalIsTTY: stream.isTTY,
+    originalColumns: stream.columns,
+    originalRows: stream.rows,
+    writeSpy: vi.spyOn(stream, 'write').mockImplementation(() => true) as any,
+  }
+
+  // Make stream appear as a WriteStream instance for hide/showCursor tests
+  Object.setPrototypeOf(stream, WriteStream.prototype)
+
+  // Create stubs for TTY methods only if they don't exist, then spy on them
+  if (!stream.cursorTo) {
+    ;(stream as any).cursorTo = vi.fn()
+  }
+  context.cursorToSpy = vi
+    .spyOn(stream, 'cursorTo' as any)
+    .mockImplementation(() => {}) as any
+
+  if (!stream.clearLine) {
+    ;(stream as any).clearLine = vi.fn()
+  }
+  context.clearLineSpy = vi
+    .spyOn(stream, 'clearLine' as any)
+    .mockImplementation(() => {}) as any
+
+  if (!stream.clearScreenDown) {
+    ;(stream as any).clearScreenDown = vi.fn()
+  }
+  context.clearScreenDownSpy = vi
+    .spyOn(stream, 'clearScreenDown' as any)
+    .mockImplementation(() => {}) as any
+
+  return context
+}
+
+/**
+ * Tears down mocks and restores original properties.
+ * Reduces ~20 lines of duplicate teardown code per test file.
+ */
+export function teardownStdioTest(
+  stream: NodeJS.WriteStream & Writable,
+  context: StdioTestContext,
+): void {
+  // Clear call history before restoring
+  context.writeSpy?.mockClear()
+  context.cursorToSpy?.mockClear()
+  context.clearLineSpy?.mockClear()
+  context.clearScreenDownSpy?.mockClear()
+
+  // Restore spies
+  context.writeSpy?.mockRestore()
+  context.cursorToSpy?.mockRestore()
+  context.clearLineSpy?.mockRestore()
+  context.clearScreenDownSpy?.mockRestore()
+
+  // Restore original properties
+  Object.defineProperty(stream, 'isTTY', {
+    value: context.originalIsTTY,
+    configurable: true,
+  })
+  Object.defineProperty(stream, 'columns', {
+    value: context.originalColumns,
+    configurable: true,
+  })
+  Object.defineProperty(stream, 'rows', {
+    value: context.originalRows,
+    configurable: true,
+  })
+}
+
+/**
+ * Returns a beforeEach/afterEach setup for stdio stream testing.
+ * Use this to eliminate repetitive setup code entirely.
+ */
+export function setupStdioTestSuite(stream: NodeJS.WriteStream & Writable) {
+  let context: StdioTestContext
+
+  beforeEach(() => {
+    context = setupStdioTest(stream)
+    // Clear call history to ensure tests start with clean slate
+    context.writeSpy.mockClear()
+    context.cursorToSpy?.mockClear()
+    context.clearLineSpy?.mockClear()
+    context.clearScreenDownSpy?.mockClear()
+  })
+
+  afterEach(() => {
+    teardownStdioTest(stream, context)
+  })
+
+  return () => context
+}
diff --git a/test/unit/utils/temp-file-helper.mts b/test/unit/utils/temp-file-helper.mts
new file mode 100644
index 0000000..0de2f0e
--- /dev/null
+++ b/test/unit/utils/temp-file-helper.mts
@@ -0,0 +1,147 @@
+/**
+ * @fileoverview Temporary file and directory utilities for tests.
+ */
+
+import { promises as fs } from 'node:fs'
+import os from 'node:os'
+import path from 'node:path'
+
+import { clearEnv, setEnv } from '@socketsecurity/lib/env/rewire'
+
+/**
+ * Mock the home directory for cross-platform testing.
+ * Uses env rewiring for thread-safe test isolation.
+ * On Unix: Sets HOME
+ * On Windows: Sets USERPROFILE
+ * Also sets SOCKET_DLX_DIR for DLX cache isolation.
+ */
+export function mockHomeDir(homeDir: string): () => void {
+  // Use rewiring system for thread-safe env mocking.
+  // Also set process.env for subprocess compatibility.
+  const originalEnv = {
+    HOME: process.env['HOME'],
+    SOCKET_DLX_DIR: process.env['SOCKET_DLX_DIR'],
+    USERPROFILE: process.env['USERPROFILE'],
+  }
+
+  // Set Unix home via rewiring.
+  setEnv('HOME', homeDir)
+  process.env['HOME'] = homeDir
+
+  // Set DLX directory override for test isolation.
+  const dlxDir = path.join(homeDir, '.socket', '_dlx')
+  setEnv('SOCKET_DLX_DIR', dlxDir)
+  process.env['SOCKET_DLX_DIR'] = dlxDir
+
+  // Set Windows home via rewiring.
+  if (process.platform === 'win32') {
+    setEnv('USERPROFILE', homeDir)
+    process.env['USERPROFILE'] = homeDir
+  }
+
+  // Return restore function.
+  return () => {
+    clearEnv('HOME')
+    clearEnv('SOCKET_DLX_DIR')
+    clearEnv('USERPROFILE')
+
+    if (originalEnv.HOME === undefined) {
+      delete process.env['HOME']
+    } else {
+      process.env['HOME'] = originalEnv.HOME
+    }
+    if (originalEnv.SOCKET_DLX_DIR === undefined) {
+      delete process.env['SOCKET_DLX_DIR']
+    } else {
+      process.env['SOCKET_DLX_DIR'] = originalEnv.SOCKET_DLX_DIR
+    }
+    if (originalEnv.USERPROFILE === undefined) {
+      delete process.env['USERPROFILE']
+    } else {
+      process.env['USERPROFILE'] = originalEnv.USERPROFILE
+    }
+  }
+}
+
+/**
+ * Creates a unique temporary directory for testing.
+ * The directory is created in the system's temp directory with a unique name.
+ */
+export async function createTempDir(prefix: string): Promise<string> {
+  const tempBaseDir = os.tmpdir()
+  const tempDirName = `${prefix}${Date.now()}-${Math.random().toString(36).slice(2)}`
+  const tempDir = path.join(tempBaseDir, tempDirName)
+
+  await fs.mkdir(tempDir, { recursive: true })
+  return tempDir
+}
+
+/**
+ * Helper to create a temporary directory with automatic cleanup.
+ * Returns an object with the temp directory path and cleanup function.
+ */
+export async function withTempDir(prefix: string): Promise<{
+  cleanup: () => Promise<void>
+  path: string
+}> {
+  const tempDir = await createTempDir(prefix)
+
+  const cleanup = async () => {
+    try {
+      // Force delete temp directory outside CWD.
+      await fs.rm(tempDir, { force: true, recursive: true })
+    } catch {
+      // Ignore cleanup errors.
+    }
+  }
+
+  return { cleanup, path: tempDir }
+}
+
+/**
+ * Helper to run a callback with a temporary directory that's automatically cleaned up.
+ * Useful for tests that need a temp directory for the duration of a test case.
+ */
+export async function runWithTempDir(
+  callback: (tempDir: string) => Promise<void>,
+  prefix: string,
+): Promise<void> {
+  const { cleanup, path: tempDir } = await withTempDir(prefix)
+  try {
+    await callback(tempDir)
+  } finally {
+    await cleanup()
+  }
+}
+
+/**
+ * Helper to create a temporary file with content.
+ */
+export async function withTempFile(
+  content: string,
+  options: {
+    extension?: string
+    prefix?: string
+  } = {},
+): Promise<{
+  cleanup: () => Promise<void>
+  path: string
+}> {
+  const { extension = '.txt', prefix = 'temp-file-' } = options
+
+  const tempBaseDir = os.tmpdir()
+  const tempFileName = `${prefix}${Date.now()}-${Math.random().toString(36).slice(2)}${extension}`
+  const tempFile = path.join(tempBaseDir, tempFileName)
+
+  await fs.writeFile(tempFile, content, 'utf8')
+
+  const cleanup = async () => {
+    try {
+      await fs.unlink(tempFile)
+    } catch {
+      // Ignore cleanup errors.
+    }
+  }
+
+  return { cleanup, path: tempFile }
+}
diff --git a/test/unit/validation/json-parser.test.ts b/test/unit/validation/json-parser.test.ts
new file mode 100644
index 0000000..22f95a5
--- /dev/null
+++ b/test/unit/validation/json-parser.test.ts
@@ -0,0 +1,524 @@
+/**
+ * @fileoverview Unit tests for JSON validation and parsing utilities.
+ *
+ * Tests secure JSON parsing with protection against common vulnerabilities:
+ * - safeJsonParse() blocks prototype pollution attacks (__proto__, constructor, prototype)
+ * - tryJsonParse() provides non-throwing JSON parsing with undefined fallback
+ * - Size limit enforcement to prevent DoS attacks via massive JSON payloads
+ * - Reviver function support for custom parsing logic
+ * - Handles malformed JSON, nested objects, and edge cases
+ * - Validates security controls work correctly while allowing legitimate data
+ */
+
+import {
+  createJsonParser,
+  parseJsonWithResult,
+  parseNdjson,
+  safeJsonParse,
+  streamNdjson,
+  tryJsonParse,
+} from '@socketsecurity/lib/validation/json-parser'
+import { describe, expect, it } from 'vitest'
+import { z } from 'zod'
+
+describe('validation/json-parser', () => {
+  describe('safeJsonParse', () => {
+    it('should parse valid JSON', () => {
+      const result = safeJsonParse('{"name":"test","value":123}')
+      expect(result).toEqual({ name: 'test', value: 123 })
+    })
+
+    it('should parse JSON arrays', () => {
+      const result = safeJsonParse('[1,2,3,4,5]')
+      expect(result).toEqual([1, 2, 3, 4, 5])
+    })
+
+    it('should parse JSON primitives', () => {
+      expect(safeJsonParse('true')).toBe(true)
+      expect(safeJsonParse('false')).toBe(false)
+      expect(safeJsonParse('null')).toBe(null)
+      expect(safeJsonParse('42')).toBe(42)
+      expect(safeJsonParse('"string"')).toBe('string')
+    })
+
+    it('should throw on invalid JSON', () => {
+      expect(() => safeJsonParse('invalid json')).toThrow()
+      expect(() => safeJsonParse('{invalid}')).toThrow()
+    })
+
+    it('should throw on prototype pollution attempts', () => {
+      expect(() => safeJsonParse('{"__proto__":{"isAdmin":true}}')).toThrow(
+        /prototype pollution/,
+      )
+      expect(() => safeJsonParse('{"constructor":{"key":"value"}}')).toThrow(
+        /prototype pollution/,
+      )
+      expect(() => safeJsonParse('{"prototype":{"key":"value"}}')).toThrow(
+        /prototype pollution/,
+      )
+    })
+
+    it('should allow prototype keys when allowPrototype is true', () => {
+      const result = safeJsonParse('{"__proto__":{"test":true}}', undefined, {
+        allowPrototype: true,
+      })
+      expect(result).toBeDefined()
+    })
+
+    it('should throw on size limit exceeded', () => {
+      const largeJson = JSON.stringify({ data: 'x'.repeat(1000) })
+      expect(() =>
+        safeJsonParse(largeJson, undefined, { maxSize: 100 }),
+      ).toThrow(/exceeds maximum size/)
+    })
+
+    it('should accept JSON within size limit', () => {
+      const smallJson = JSON.stringify({ data: 'test' })
+      const result = safeJsonParse(smallJson, undefined, { maxSize: 1000 })
+      expect(result).toEqual({ data: 'test' })
+    })
+
+    it('should handle nested objects', () => {
+      const json = '{"level1":{"level2":{"level3":"value"}}}'
+      const result = safeJsonParse(json)
+      expect(result).toEqual({ level1: { level2: { level3: 'value' } } })
+    })
+
+    it('should handle arrays in objects', () => {
+      const json = '{"items":[1,2,3],"nested":{"arr":[4,5,6]}}'
+      const result = safeJsonParse(json)
+      expect(result).toEqual({
+        items: [1, 2, 3],
+        nested: { arr: [4, 5, 6] },
+      })
+    })
+
+    it('should handle empty objects and arrays', () => {
+      expect(safeJsonParse('{}')).toEqual({})
+      expect(safeJsonParse('[]')).toEqual([])
+    })
+  })
+
+  describe('tryJsonParse', () => {
+    it('should parse valid JSON', () => {
+      const result = tryJsonParse('{"name":"test"}')
+      expect(result).toEqual({ name: 'test' })
+    })
+
+    it('should return undefined on invalid JSON', () => {
+      const result = tryJsonParse('invalid json')
+      expect(result).toBeUndefined()
+    })
+
+    it('should return undefined on prototype pollution', () => {
+      const result = tryJsonParse('{"__proto__":{"isAdmin":true}}')
+      expect(result).toBeUndefined()
+    })
+
+    it('should return undefined on size limit exceeded', () => {
+      const largeJson = JSON.stringify({ data: 'x'.repeat(1000) })
+      const result = tryJsonParse(largeJson, undefined, { maxSize: 100 })
+      expect(result).toBeUndefined()
+    })
+
+    it('should successfully parse within limits', () => {
+      const result = tryJsonParse('{"test":true}')
+      expect(result).toEqual({ test: true })
+    })
+  })
+
+  describe('error handling with tryJsonParse', () => {
+    it('should return undefined for various error conditions', () => {
+      // Already covered in tryJsonParse tests above
+      expect(tryJsonParse('invalid')).toBeUndefined()
+    })
+  })
+
+  describe('edge cases', () => {
+    it('should handle deeply nested JSON', () => {
+      const json = '{"a":{"b":{"c":{"d":{"e":"value"}}}}}'
+      const result = safeJsonParse(json)
+      expect(result).toEqual({ a: { b: { c: { d: { e: 'value' } } } } })
+    })
+
+    it('should handle special characters', () => {
+      const json = '{"text":"hello\\nworld\\t!"}'
+      const result = safeJsonParse(json)
+      expect(result).toEqual({ text: 'hello\nworld\t!' })
+    })
+
+    it('should handle unicode', () => {
+      const json = '{"emoji":"😀","chinese":"你好"}'
+      const result = safeJsonParse(json)
+      expect(result).toEqual({ emoji: '😀', chinese: '你好' })
+    })
+
+    it('should handle numbers correctly', () => {
+      const json = '{"int":42,"float":3.14,"neg":-1,"exp":1e10}'
+      const result = safeJsonParse(json)
+      expect(result).toEqual({ int: 42, float: 3.14, neg: -1, exp: 1e10 })
+    })
+
+    it('should handle mixed arrays', () => {
+      const json = '[1,"string",true,null,{"obj":true}]'
+      const result = safeJsonParse(json)
+      expect(result).toEqual([1, 'string', true, null, { obj: true }])
+    })
+  })
+
+  describe('safeJsonParse with schema validation', () => {
+    it('should validate against zod schema', () => {
+      const userSchema = z.object({
+        name: z.string(),
+        age: z.number(),
+      })
+      const json = '{"name":"Alice","age":30}'
+      const result = safeJsonParse(json, userSchema)
+      expect(result).toEqual({ name: 'Alice', age: 30 })
+    })
+
+    it('should throw on schema validation failure', () => {
+      const userSchema = z.object({
+        name: z.string(),
+        age: z.number(),
+      })
+      const json = '{"name":"Alice","age":"invalid"}'
+      expect(() => safeJsonParse(json, userSchema)).toThrow(/Validation failed/)
+    })
+
+    it('should include validation error details', () => {
+      const schema = z.object({
+        required: z.string(),
+      })
+      const json = '{}'
+      expect(() => safeJsonParse(json, schema)).toThrow(/required/)
+    })
+
+    it('should handle complex schema with nested objects', () => {
+      const schema = z.object({
+        user: z.object({
+          name: z.string(),
+          email: z.string().email(),
+        }),
+        metadata: z.object({
+          createdAt: z.string(),
+        }),
+      })
+      const json =
+        '{"user":{"name":"Test","email":"test@example.com"},"metadata":{"createdAt":"2024-01-01"}}'
+      const result = safeJsonParse(json, schema)
+      expect(result.user.name).toBe('Test')
+      expect(result.user.email).toBe('test@example.com')
+    })
+
+    it('should handle array schema validation', () => {
+      const schema = z.array(z.number())
+      const json = '[1,2,3,4,5]'
+      const result = safeJsonParse(json, schema)
+      expect(result).toEqual([1, 2, 3, 4, 5])
+    })
+
+    it('should throw on invalid array items', () => {
+      const schema = z.array(z.number())
+      const json = '[1,2,"string",4]'
+      expect(() => safeJsonParse(json, schema)).toThrow(/Validation failed/)
+    })
+  })
+
+  describe('parseJsonWithResult', () => {
+    it('should return success result for valid JSON', () => {
+      const result = parseJsonWithResult('{"name":"test"}')
+      expect(result.success).toBe(true)
+      if (result.success) {
+        expect(result.data).toEqual({ name: 'test' })
+      }
+    })
+
+    it('should return error result for invalid JSON', () => {
+      const result = parseJsonWithResult('invalid json')
+      expect(result.success).toBe(false)
+      expect(result).toHaveProperty('error')
+      expect((result as { success: false; error: string }).error).toContain(
+        'Failed to parse JSON',
+      )
+    })
+
+    it('should return error result for prototype pollution', () => {
+      const result = parseJsonWithResult('{"__proto__":{"isAdmin":true}}')
+      expect(result.success).toBe(false)
+      expect(result).toHaveProperty('error')
+      expect((result as { success: false; error: string }).error).toContain(
+        'prototype pollution',
+      )
+    })
+
+    it('should return error result for size limit', () => {
+      const largeJson = JSON.stringify({ data: 'x'.repeat(1000) })
+      const result = parseJsonWithResult(largeJson, undefined, { maxSize: 100 })
+      expect(result.success).toBe(false)
+      expect(result).toHaveProperty('error')
+      expect((result as { success: false; error: string }).error).toContain(
+        'exceeds maximum size',
+      )
+    })
+
+    it('should work with schema validation success', () => {
+      const schema = z.object({ value: z.number() })
+      const result = parseJsonWithResult('{"value":42}', schema)
+      expect(result.success).toBe(true)
+      if (result.success) {
+        expect(result.data.value).toBe(42)
+      }
+    })
+
+    it('should return error for schema validation failure', () => {
+      const schema = z.object({ value: z.number() })
+      const result = parseJsonWithResult('{"value":"string"}', schema)
+      expect(result.success).toBe(false)
+      expect(result).toHaveProperty('error')
+      expect((result as { success: false; error: string }).error).toContain(
+        'Validation failed',
+      )
+    })
+
+    it('should handle arrays with result', () => {
+      const result = parseJsonWithResult('[1,2,3]')
+      expect(result.success).toBe(true)
+      if (result.success) {
+        expect(result.data).toEqual([1, 2, 3])
+      }
+    })
+
+    it('should handle primitives with result', () => {
+      const result = parseJsonWithResult('true')
+      expect(result.success).toBe(true)
+      if (result.success) {
+        expect(result.data).toBe(true)
+      }
+    })
+  })
+
+  describe('createJsonParser', () => {
+    it('should create a reusable parser', () => {
+      const parser = createJsonParser()
+      const result1 = parser('{"a":1}')
+      const result2 = parser('{"b":2}')
+      expect(result1).toEqual({ a: 1 })
+      expect(result2).toEqual({ b: 2 })
+    })
+
+    it('should create parser with schema', () => {
+      const schema = z.object({ name: z.string() })
+      const parser = createJsonParser(schema)
+      const result = parser('{"name":"test"}')
+      expect(result).toEqual({ name: 'test' })
+    })
+
+    it('should create parser with default options', () => {
+      const parser = createJsonParser(undefined, { maxSize: 1000 })
+      const smallJson = '{"data":"test"}'
+      const result = parser(smallJson)
+      expect(result).toEqual({ data: 'test' })
+    })
+
+    it('should allow overriding options per call', () => {
+      const parser = createJsonParser(undefined, { maxSize: 100 })
+      const largeJson = JSON.stringify({ data: 'x'.repeat(200) })
+      // Override maxSize for this call
+      const result = parser(largeJson, { maxSize: 10_000 })
+      expect(result).toHaveProperty('data')
+    })
+
+    it('should throw from created parser on invalid JSON', () => {
+      const parser = createJsonParser()
+      expect(() => parser('invalid')).toThrow()
+    })
+
+    it('should work with schema validation in created parser', () => {
+      const schema = z.object({
+        count: z.number(),
+      })
+      const parser = createJsonParser(schema)
+      expect(() => parser('{"count":"invalid"}')).toThrow(/Validation failed/)
+    })
+
+    it('should preserve default options across calls', () => {
+      const parser = createJsonParser(undefined, {
+        maxSize: 100,
+        allowPrototype: false,
+      })
+      const largeJson = JSON.stringify({ data: 'x'.repeat(200) })
+      expect(() => parser(largeJson)).toThrow(/exceeds maximum size/)
+    })
+  })
+
+  describe('parseNdjson', () => {
+    it('should parse newline-delimited JSON', () => {
+      const ndjson = '{"a":1}\n{"b":2}\n{"c":3}'
+      const result = parseNdjson(ndjson)
+      expect(result).toEqual([{ a: 1 }, { b: 2 }, { c: 3 }])
+    })
+
+    it('should handle \\r\\n line endings', () => {
+      const ndjson = '{"a":1}\r\n{"b":2}\r\n{"c":3}'
+      const result = parseNdjson(ndjson)
+      expect(result).toEqual([{ a: 1 }, { b: 2 }, { c: 3 }])
+    })
+
+    it('should skip empty lines', () => {
+      const ndjson = '{"a":1}\n\n{"b":2}\n\n\n{"c":3}\n'
+      const result = parseNdjson(ndjson)
+      expect(result).toEqual([{ a: 1 }, { b: 2 }, { c: 3 }])
+    })
+
+    it('should skip lines with only whitespace', () => {
+      const ndjson = '{"a":1}\n   \n{"b":2}\n\t\t\n{"c":3}'
+      const result = parseNdjson(ndjson)
+      expect(result).toEqual([{ a: 1 }, { b: 2 }, { c: 3 }])
+    })
+
+    it('should throw on invalid JSON line with line number', () => {
+      const ndjson = '{"a":1}\ninvalid\n{"c":3}'
+      expect(() => parseNdjson(ndjson)).toThrow(/line 2/)
+    })
+
+    it('should validate with schema', () => {
+      const schema = z.object({ value: z.number() })
+      const ndjson = '{"value":1}\n{"value":2}\n{"value":3}'
+      const result = parseNdjson(ndjson, schema)
+      expect(result).toEqual([{ value: 1 }, { value: 2 }, { value: 3 }])
+    })
+
+    it('should throw on schema validation failure with line number', () => {
+      const schema = z.object({ value: z.number() })
+      const ndjson = '{"value":1}\n{"value":"invalid"}\n{"value":3}'
+      expect(() => parseNdjson(ndjson, schema)).toThrow(/line 2/)
+    })
+
+    it('should respect size limits per line', () => {
+      const ndjson = `{"small":"data"}\n{"large":"${'x'.repeat(1000)}"}`
+      expect(() => parseNdjson(ndjson, undefined, { maxSize: 100 })).toThrow(
+        /line 2/,
+      )
+    })
+
+    it('should handle empty NDJSON string', () => {
+      const result = parseNdjson('')
+      expect(result).toEqual([])
+    })
+
+    it('should handle NDJSON with only newlines', () => {
+      const result = parseNdjson('\n\n\n')
+      expect(result).toEqual([])
+    })
+
+    it('should handle mixed types in NDJSON', () => {
+      const ndjson = '{"type":"object"}\n[1,2,3]\n"string"\n42\ntrue'
+      const result = parseNdjson(ndjson)
+      expect(result).toEqual([
+        { type: 'object' },
+        [1, 2, 3],
+        'string',
+        42,
+        true,
+      ])
+    })
+
+    it('should handle complex objects in NDJSON', () => {
+      const ndjson =
+        '{"user":{"name":"Alice","age":30}}\n{"user":{"name":"Bob","age":25}}'
+      const result = parseNdjson(ndjson)
+      expect(result).toEqual([
+        { user: { name: 'Alice', age: 30 } },
+        { user: { name: 'Bob', age: 25 } },
+      ])
+    })
+  })
+
+  describe('streamNdjson', () => {
+    it('should yield parsed objects one at a time', () => {
+      const ndjson = '{"a":1}\n{"b":2}\n{"c":3}'
+      const results = [...streamNdjson(ndjson)]
+      expect(results).toEqual([{ a: 1 }, { b: 2 }, { c: 3 }])
+    })
+
+    it('should handle \\r\\n line endings in generator', () => {
+      const ndjson = '{"a":1}\r\n{"b":2}\r\n{"c":3}'
+      const results = [...streamNdjson(ndjson)]
+      expect(results).toEqual([{ a: 1 }, { b: 2 }, { c: 3 }])
+    })
+
+    it('should skip empty lines in generator', () => {
+      const ndjson = '{"a":1}\n\n{"b":2}\n\n{"c":3}'
+      const results = [...streamNdjson(ndjson)]
+      expect(results).toEqual([{ a: 1 }, { b: 2 }, { c: 3 }])
+    })
+
+    it('should throw on invalid JSON with line number', () => {
+      const ndjson = '{"a":1}\ninvalid\n{"c":3}'
+      const generator = streamNdjson(ndjson)
+      expect(generator.next().value).toEqual({ a: 1 })
+      expect(() => generator.next()).toThrow(/line 2/)
+    })
+
+    it('should allow early termination', () => {
+      const ndjson = '{"a":1}\n{"b":2}\n{"c":3}\n{"d":4}\n{"e":5}'
+      const results = []
+      for (const item of streamNdjson(ndjson)) {
+        results.push(item)
+        if (Object.keys(item)[0] === 'c') {
+          break
+        }
+      }
+      expect(results).toEqual([{ a: 1 }, { b: 2 }, { c: 3 }])
+    })
+
+    it('should validate with schema in generator', () => {
+      const schema = z.object({ value: z.number() })
+      const ndjson = '{"value":1}\n{"value":2}\n{"value":3}'
+      const results = [...streamNdjson(ndjson, schema)]
+      expect(results).toEqual([{ value: 1 }, { value: 2 }, { value: 3 }])
+    })
+
+    it('should throw on schema validation failure', () => {
+      const schema = z.object({ value: z.number() })
+      const ndjson = '{"value":1}\n{"value":"invalid"}'
+      const generator = streamNdjson(ndjson, schema)
+      expect(generator.next().value).toEqual({ value: 1 })
+      expect(() => generator.next()).toThrow(/Validation failed/)
+    })
+
+    it('should handle empty NDJSON in generator', () => {
+      const results = [...streamNdjson('')]
+      expect(results).toEqual([])
+    })
+
+    it('should handle whitespace-only lines', () => {
+      const ndjson = '{"a":1}\n   \n{"b":2}'
+      const results = [...streamNdjson(ndjson)]
+      expect(results).toEqual([{ a: 1 }, { b: 2 }])
+    })
+
+    it('should work with for-of loop', () => {
+      const ndjson = '{"count":1}\n{"count":2}\n{"count":3}'
+      let sum = 0
+      for (const item of streamNdjson<{ count: number }>(ndjson)) {
+        sum += item.count
+      }
+      expect(sum).toBe(6)
+    })
+
+    it('should handle generator spread correctly', () => {
+      const ndjson = '1\n2\n3\n4\n5'
+      const numbers = [...streamNdjson<number>(ndjson)]
+      expect(numbers).toEqual([1, 2, 3, 4, 5])
+    })
+
+    it('should respect size limits in generator', () => {
+      const ndjson = `{"small":"data"}\n{"large":"${'x'.repeat(1000)}"}`
+      const generator = streamNdjson(ndjson, undefined, { maxSize: 100 })
+      expect(generator.next().value).toEqual({ small: 'data' })
+      expect(() => generator.next()).toThrow(/exceeds maximum size/)
+    })
+  })
+})
diff --git a/test/unit/versions.test.ts b/test/unit/versions.test.ts
new file mode 100644
index 0000000..5393f72
--- /dev/null
+++ b/test/unit/versions.test.ts
@@ -0,0 +1,313 @@
+/**
+ * @fileoverview Unit tests for semantic version comparison and manipulation utilities.
+ *
+ * Tests version utility functions:
+ * - Comparison: compareVersions(), isGreaterThan(), isLessThan(), isEqual()
+ * - Extraction: getMajorVersion(), getMinorVersion(), getPatchVersion()
+ * - Manipulation: incrementVersion(), coerceVersion()
+ * - Filtering: filterVersions(), maxVersion(), minVersion()
+ * - Validation: isValidVersion() for semver format checking
+ * Used by Socket tools for Node.js version checking and dependency version management.
+ */
+
+import {
+  coerceVersion,
+  compareVersions,
+  filterVersions,
+  getMajorVersion,
+  getMinorVersion,
+  getPatchVersion,
+  incrementVersion,
+  isEqual,
+  isGreaterThan,
+  isGreaterThanOrEqual,
+  isLessThan,
+  isLessThanOrEqual,
+  isValidVersion,
+  maxVersion,
+  minVersion,
+  parseVersion,
+  satisfiesVersion,
+  sortVersions,
+  sortVersionsDesc,
+  versionDiff,
+} from '@socketsecurity/lib/versions'
+import { describe, expect, it } from 'vitest'
+
+describe('versions', () => {
+  describe('coerceVersion', () => {
+    it('should coerce version strings', () => {
+      expect(coerceVersion('1')).toBe('1.0.0')
+      expect(coerceVersion('1.2')).toBe('1.2.0')
+      expect(coerceVersion('v1.2.3')).toBe('1.2.3')
+    })
+
+    it('should return undefined for invalid versions', () => {
+      expect(coerceVersion('invalid')).toBeUndefined()
+    })
+  })
+
+  describe('compareVersions', () => {
+    it('should compare equal versions', () => {
+      expect(compareVersions('1.0.0', '1.0.0')).toBe(0)
+    })
+
+    it('should return -1 when first is less than second', () => {
+      expect(compareVersions('1.0.0', '2.0.0')).toBe(-1)
+      expect(compareVersions('1.0.0', '1.1.0')).toBe(-1)
+      expect(compareVersions('1.0.0', '1.0.1')).toBe(-1)
+    })
+
+    it('should return 1 when first is greater than second', () => {
+      expect(compareVersions('2.0.0', '1.0.0')).toBe(1)
+      expect(compareVersions('1.1.0', '1.0.0')).toBe(1)
+      expect(compareVersions('1.0.1', '1.0.0')).toBe(1)
+    })
+
+    it('should return undefined for invalid versions', () => {
+      expect(compareVersions('invalid', '1.0.0')).toBeUndefined()
+      expect(compareVersions('1.0.0', 'invalid')).toBeUndefined()
+    })
+  })
+
+  describe('filterVersions', () => {
+    it('should filter versions by range', () => {
+      const versions = ['1.0.0', '1.5.0', '2.0.0', '2.5.0', '3.0.0']
+      expect(filterVersions(versions, '>=2.0.0')).toEqual([
+        '2.0.0',
+        '2.5.0',
+        '3.0.0',
+      ])
+      expect(filterVersions(versions, '^1.0.0')).toEqual(['1.0.0', '1.5.0'])
+      expect(filterVersions(versions, '~2.0.0')).toEqual(['2.0.0'])
+    })
+
+    it('should return empty array when no versions match', () => {
+      const versions = ['1.0.0', '1.5.0']
+      expect(filterVersions(versions, '>=2.0.0')).toEqual([])
+    })
+  })
+
+  describe('getMajorVersion', () => {
+    it('should extract major version', () => {
+      expect(getMajorVersion('1.2.3')).toBe(1)
+      expect(getMajorVersion('5.0.0')).toBe(5)
+      expect(getMajorVersion('10.20.30')).toBe(10)
+    })
+
+    it('should return undefined for invalid versions', () => {
+      expect(getMajorVersion('invalid')).toBeUndefined()
+    })
+  })
+
+  describe('getMinorVersion', () => {
+    it('should extract minor version', () => {
+      expect(getMinorVersion('1.2.3')).toBe(2)
+      expect(getMinorVersion('5.7.0')).toBe(7)
+      expect(getMinorVersion('10.20.30')).toBe(20)
+    })
+
+    it('should return undefined for invalid versions', () => {
+      expect(getMinorVersion('invalid')).toBeUndefined()
+    })
+  })
+
+  describe('getPatchVersion', () => {
+    it('should extract patch version', () => {
+      expect(getPatchVersion('1.2.3')).toBe(3)
+      expect(getPatchVersion('5.7.9')).toBe(9)
+      expect(getPatchVersion('10.20.30')).toBe(30)
+    })
+
+    it('should return undefined for invalid versions', () => {
+      expect(getPatchVersion('invalid')).toBeUndefined()
+    })
+  })
+
+  describe('incrementVersion', () => {
+    it('should increment major version', () => {
+      expect(incrementVersion('1.2.3', 'major')).toBe('2.0.0')
+    })
+
+    it('should increment minor version', () => {
+      expect(incrementVersion('1.2.3', 'minor')).toBe('1.3.0')
+    })
+
+    it('should increment patch version', () => {
+      expect(incrementVersion('1.2.3', 'patch')).toBe('1.2.4')
+    })
+
+    it('should increment prerelease', () => {
+      expect(incrementVersion('1.2.3-alpha.0', 'prerelease')).toBe(
+        '1.2.3-alpha.1',
+      )
+    })
+
+    it('should return undefined for invalid versions', () => {
+      expect(incrementVersion('invalid', 'major')).toBeUndefined()
+    })
+  })
+
+  describe('isEqual', () => {
+    it('should check version equality', () => {
+      expect(isEqual('1.0.0', '1.0.0')).toBe(true)
+      expect(isEqual('1.0.0', '1.0.1')).toBe(false)
+    })
+  })
+
+  describe('isGreaterThan', () => {
+    it('should check if first version is greater', () => {
+      expect(isGreaterThan('2.0.0', '1.0.0')).toBe(true)
+      expect(isGreaterThan('1.0.0', '2.0.0')).toBe(false)
+      expect(isGreaterThan('1.0.0', '1.0.0')).toBe(false)
+    })
+  })
+
+  describe('isGreaterThanOrEqual', () => {
+    it('should check if first version is greater or equal', () => {
+      expect(isGreaterThanOrEqual('2.0.0', '1.0.0')).toBe(true)
+      expect(isGreaterThanOrEqual('1.0.0', '1.0.0')).toBe(true)
+      expect(isGreaterThanOrEqual('1.0.0', '2.0.0')).toBe(false)
+    })
+  })
+
+  describe('isLessThan', () => {
+    it('should check if first version is less', () => {
+      expect(isLessThan('1.0.0', '2.0.0')).toBe(true)
+      expect(isLessThan('2.0.0', '1.0.0')).toBe(false)
+      expect(isLessThan('1.0.0', '1.0.0')).toBe(false)
+    })
+  })
+
+  describe('isLessThanOrEqual', () => {
+    it('should check if first version is less or equal', () => {
+      expect(isLessThanOrEqual('1.0.0', '2.0.0')).toBe(true)
+      expect(isLessThanOrEqual('1.0.0', '1.0.0')).toBe(true)
+      expect(isLessThanOrEqual('2.0.0', '1.0.0')).toBe(false)
+    })
+  })
+
+  describe('isValidVersion', () => {
+    it('should validate version strings', () => {
+      expect(isValidVersion('1.0.0')).toBe(true)
+      expect(isValidVersion('1.2.3')).toBe(true)
+      expect(isValidVersion('1.0.0-alpha')).toBe(true)
+      expect(isValidVersion('invalid')).toBe(false)
+      expect(isValidVersion('1')).toBe(false)
+    })
+  })
+
+  describe('maxVersion', () => {
+    it('should find maximum version', () => {
+      const versions = ['1.0.0', '2.5.0', '1.9.0', '2.0.0']
+      expect(maxVersion(versions)).toBe('2.5.0')
+    })
+
+    it('should return undefined for empty array', () => {
+      expect(maxVersion([])).toBeUndefined()
+    })
+  })
+
+  describe('minVersion', () => {
+    it('should find minimum version', () => {
+      const versions = ['1.0.0', '2.5.0', '1.9.0', '2.0.0']
+      expect(minVersion(versions)).toBe('1.0.0')
+    })
+
+    it('should return undefined for empty array', () => {
+      expect(minVersion([])).toBeUndefined()
+    })
+  })
+
+  describe('parseVersion', () => {
+    it('should parse version components', () => {
+      const parsed = parseVersion('1.2.3')
+      expect(parsed).toEqual({
+        major: 1,
+        minor: 2,
+        patch: 3,
+        prerelease: [],
+        build: [],
+      })
+    })
+
+    it('should parse version with prerelease', () => {
+      const parsed = parseVersion('1.2.3-alpha.1')
+      expect(parsed?.major).toBe(1)
+      expect(parsed?.minor).toBe(2)
+      expect(parsed?.patch).toBe(3)
+      expect(parsed?.prerelease).toEqual(['alpha', 1])
+    })
+
+    it('should return undefined for invalid version', () => {
+      expect(parseVersion('invalid')).toBeUndefined()
+    })
+  })
+
+  describe('satisfiesVersion', () => {
+    it('should check if version satisfies range', () => {
+      expect(satisfiesVersion('1.5.0', '>=1.0.0')).toBe(true)
+      expect(satisfiesVersion('1.5.0', '^1.0.0')).toBe(true)
+      expect(satisfiesVersion('1.5.0', '~1.5.0')).toBe(true) // ~1.4.0 doesn't match 1.5.0
+      expect(satisfiesVersion('1.5.0', '>=2.0.0')).toBe(false)
+    })
+  })
+
+  describe('sortVersions', () => {
+    it('should sort versions in ascending order', () => {
+      const versions = ['2.0.0', '1.0.0', '1.9.0', '1.5.0']
+      expect(sortVersions(versions)).toEqual([
+        '1.0.0',
+        '1.5.0',
+        '1.9.0',
+        '2.0.0',
+      ])
+    })
+
+    it('should not mutate original array', () => {
+      const versions = ['2.0.0', '1.0.0']
+      sortVersions(versions)
+      expect(versions).toEqual(['2.0.0', '1.0.0'])
+    })
+  })
+
+  describe('sortVersionsDesc', () => {
+    it('should sort versions in descending order', () => {
+      const versions = ['1.0.0', '2.0.0', '1.5.0', '1.9.0']
+      expect(sortVersionsDesc(versions)).toEqual([
+        '2.0.0',
+        '1.9.0',
+        '1.5.0',
+        '1.0.0',
+      ])
+    })
+
+    it('should not mutate original array', () => {
+      const versions = ['1.0.0', '2.0.0']
+      sortVersionsDesc(versions)
+      expect(versions).toEqual(['1.0.0', '2.0.0'])
+    })
+  })
+
+  describe('versionDiff', () => {
+    it('should detect major diff', () => {
+      expect(versionDiff('1.0.0', '2.0.0')).toBe('major')
+    })
+
+    it('should detect minor diff', () => {
+      expect(versionDiff('1.0.0', '1.1.0')).toBe('minor')
+    })
+
+    it('should detect patch diff', () => {
+      expect(versionDiff('1.0.0', '1.0.1')).toBe('patch')
+    })
+
+    it('should return undefined for equal versions', () => {
+      expect(versionDiff('1.0.0', '1.0.0')).toBeUndefined()
+    })
+
+    it('should return undefined for invalid versions', () => {
+      expect(versionDiff('invalid', '1.0.0')).toBeUndefined()
+    })
+  })
+})
diff --git a/test/registry/words.test.ts b/test/unit/words.test.ts
similarity index 94%
rename from test/registry/words.test.ts
rename to test/unit/words.test.ts
index b5ef7a3..ce148e9 100644
--- a/test/registry/words.test.ts
+++ b/test/unit/words.test.ts
@@ -1,5 +1,12 @@
 /**
- * @fileoverview Unit tests for word manipulation utilities.
+ * @fileoverview Unit tests for English word manipulation utilities.
+ *
+ * Tests text transformation helpers for natural language:
+ * - capitalize() capitalizes first letter of words
+ * - pluralize() handles English pluralization rules (singular ↔ plural)
+ * - determineArticle() chooses correct indefinite article (a/an)
+ * - Special case handling: irregular plurals, acronyms, vowel sounds
+ * Used by Socket CLI for grammatically correct user-facing messages.
  */
 
 import {
diff --git a/test/unit/zod.test.ts b/test/unit/zod.test.ts
new file mode 100644
index 0000000..887f8d7
--- /dev/null
+++ b/test/unit/zod.test.ts
@@ -0,0 +1,141 @@
+/**
+ * @fileoverview Unit tests for Zod schema validation library wrapper.
+ *
+ * Tests Zod validation library re-export:
+ * - z object export for schema building
+ * - String, number, boolean, array, object schemas
+ * - Type inference from schemas
+ * - Parse validation and error handling
+ * - Used as centralized import point for Zod in Socket tools
+ * Ensures consistent Zod version across all Socket packages.
+ */
+
+import { describe, expect, it } from 'vitest'
+
+import { z } from '@socketsecurity/lib/zod'
+
+describe('zod', () => {
+  describe('z export', () => {
+    it('should export z object', () => {
+      expect(z).toBeDefined()
+      expect(typeof z).toBe('object')
+    })
+
+    it('should export string schema builder', () => {
+      expect(typeof z.string).toBe('function')
+      const schema = z.string()
+      expect(schema.parse('test')).toBe('test')
+    })
+
+    it('should export number schema builder', () => {
+      expect(typeof z.number).toBe('function')
+      const schema = z.number()
+      expect(schema.parse(123)).toBe(123)
+    })
+
+    it('should export boolean schema builder', () => {
+      expect(typeof z.boolean).toBe('function')
+      const schema = z.boolean()
+      expect(schema.parse(true)).toBe(true)
+    })
+
+    it('should export object schema builder', () => {
+      expect(typeof z.object).toBe('function')
+      const schema = z.object({
+        name: z.string(),
+        age: z.number(),
+      })
+      expect(schema.parse({ name: 'test', age: 25 })).toEqual({
+        name: 'test',
+        age: 25,
+      })
+    })
+
+    it('should export array schema builder', () => {
+      expect(typeof z.array).toBe('function')
+      const schema = z.array(z.string())
+      expect(schema.parse(['a', 'b', 'c'])).toEqual(['a', 'b', 'c'])
+    })
+
+    it('should validate and throw on invalid data', () => {
+      const schema = z.string()
+      expect(() => schema.parse(123)).toThrow()
+    })
+
+    it('should support optional fields', () => {
+      const schema = z.object({
+        name: z.string(),
+        age: z.number().optional(),
+      })
+      expect(schema.parse({ name: 'test' })).toEqual({ name: 'test' })
+      expect(schema.parse({ name: 'test', age: 25 })).toEqual({
+        name: 'test',
+        age: 25,
+      })
+    })
+
+    it('should support default values', () => {
+      const schema = z.object({
+        name: z.string(),
+        age: z.number().default(0),
+      })
+      expect(schema.parse({ name: 'test' })).toEqual({ name: 'test', age: 0 })
+    })
+
+    it('should support unions', () => {
+      const schema = z.union([z.string(), z.number()])
+      expect(schema.parse('test')).toBe('test')
+      expect(schema.parse(123)).toBe(123)
+      expect(() => schema.parse(true)).toThrow()
+    })
+
+    it('should support enums', () => {
+      const schema = z.enum(['red', 'green', 'blue'])
+      expect(schema.parse('red')).toBe('red')
+      expect(() => schema.parse('yellow')).toThrow()
+    })
+
+    it('should support literal values', () => {
+      const schema = z.literal('hello')
+      expect(schema.parse('hello')).toBe('hello')
+      expect(() => schema.parse('world')).toThrow()
+    })
+
+    it('should support refinements', () => {
+      const schema = z.string().refine(val => val.length > 3, {
+        message: 'String must be longer than 3 characters',
+      })
+      expect(schema.parse('test')).toBe('test')
+      expect(() => schema.parse('ab')).toThrow()
+    })
+
+    it('should support transformations', () => {
+      const schema = z.string().transform(val => val.toUpperCase())
+      expect(schema.parse('test')).toBe('TEST')
+    })
+
+    it('should support nested objects', () => {
+      const schema = z.object({
+        user: z.object({
+          name: z.string(),
+          email: z.string().email(),
+        }),
+      })
+      expect(
+        schema.parse({ user: { name: 'test', email: 'test@example.com' } }),
+      ).toEqual({ user: { name: 'test', email: 'test@example.com' } })
+    })
+
+    it('should support safeParse for non-throwing validation', () => {
+      const schema = z.string()
+      const result1 = schema.safeParse('test')
+      expect(result1.success).toBe(true)
+      if (result1.success) {
+        expect(result1.data).toBe('test')
+      }
+
+      const result2 = schema.safeParse(123)
+      expect(result2.success).toBe(false)
+    })
+  })
+})
diff --git a/test/utils/temp-file-helper.mts b/test/utils/temp-file-helper.mts
deleted file mode 100644
index d0b1fe0..0000000
--- a/test/utils/temp-file-helper.mts
+++ /dev/null
@@ -1,90 +0,0 @@
-/**
- * @fileoverview Temporary file and directory utilities for tests.
- */
-
-import { promises as fs } from 'node:fs'
-import os from 'node:os'
-import path from 'node:path'
-
-/**
- * Creates a unique temporary directory for testing.
- * The directory is created in the system's temp directory with a unique name.
- */
-export async function createTempDir(prefix: string): Promise<string> {
-  const tempBaseDir = os.tmpdir()
-  const tempDirName = `${prefix}${Date.now()}-${Math.random().toString(36).slice(2)}`
-  const tempDir = path.join(tempBaseDir, tempDirName)
-
-  await fs.mkdir(tempDir, { recursive: true })
-  return tempDir
-}
-
-/**
- * Helper to create a temporary directory with automatic cleanup.
- * Returns an object with the temp directory path and cleanup function.
- */
-export async function withTempDir(prefix: string): Promise<{
-  cleanup: () => Promise<void>
-  path: string
-}> {
-  const tempDir = await createTempDir(prefix)
-
-  const cleanup = async () => {
-    try {
-      // Force delete temp directory outside CWD.
-      await fs.rm(tempDir, { force: true, recursive: true })
-    } catch {
-      // Ignore cleanup errors.
-    }
-  }
-
-  return { cleanup, path: tempDir }
-}
-
-/**
- * Helper to run a callback with a temporary directory that's automatically cleaned up.
- * Useful for tests that need a temp directory for the duration of a test case.
- */
-export async function runWithTempDir(
-  callback: (tempDir: string) => Promise<void>,
-  prefix: string,
-): Promise<void> {
-  const { cleanup, path: tempDir } = await withTempDir(prefix)
-  try {
-    await callback(tempDir)
-  } finally {
-    await cleanup()
-  }
-}
-
-/**
- * Helper to create a temporary file with content.
- */
-export async function withTempFile(
-  content: string,
-  options: {
-    extension?: string
-    prefix?: string
-  } = {},
-): Promise<{
-  cleanup: () => Promise<void>
-  path: string
-}> {
-  const { extension = '.txt', prefix = 'temp-file-' } = options
-
-  const tempBaseDir = os.tmpdir()
-  const tempFileName = `${prefix}${Date.now()}-${Math.random().toString(36).slice(2)}${extension}`
-  const tempFile = path.join(tempBaseDir, tempFileName)
-
-  await fs.writeFile(tempFile, content, 'utf8')
-
-  const cleanup = async () => {
-    try {
-      await fs.unlink(tempFile)
-    } catch {
-      // Ignore cleanup errors.
-    }
-  }
-
-  return { cleanup, path: tempFile }
-}
diff --git a/tsconfig.json b/tsconfig.json
index 2132874..50a3359 100644
--- a/tsconfig.json
+++ b/tsconfig.json
@@ -7,7 +7,7 @@
     "esModuleInterop": true,
     "forceConsistentCasingInFileNames": true,
     "isolatedModules": true,
-    "lib": ["es2022"],
+    "lib": ["es2024"],
     "module": "commonjs",
     "moduleResolution": "node",
     "noEmit": false,
@@ -19,7 +19,7 @@
     "sourceMap": false,
     "strict": false,
     "strictNullChecks": false,
-    "target": "es2022",
+    "target": "es2024",
     "types": ["node"],
     "useUnknownInCatchVariables": true,
     "verbatimModuleSyntax": false,
diff --git a/tsconfig.test.json b/tsconfig.test.json
new file mode 100644
index 0000000..fbaae01
--- /dev/null
+++ b/tsconfig.test.json
@@ -0,0 +1,9 @@
+{
+  "extends": "./tsconfig.json",
+  "compilerOptions": {
+    "rootDir": ".",
+    "types": ["node", "vitest"]
+  },
+  "include": ["test/**/*.ts", "test/**/*.mts", "src/**/*.ts"],
+  "exclude": ["node_modules", "dist/**/*"]
+}