refactor(cli/scripts): colocate 63 unused exports across 22 scripts

These are standalone build/test/setup scripts whose internal helpers
were exported for no reason — every helper was only called inside its
own file. Touched scripts:
  - constants/{build,paths,packages,external-tools-platforms}.mts
  - {build,build-sea,download-assets,esbuild-utils,paths,restore-cache,
     sync-checksums,test-download-external-tools,test-sea,test-wrapper,
     validate-bundle,validate-tests,wasm}.mts
  - sea-build-utils/{npm-packages,targets}.mts
  - util/{changed-test-mapper,patches,socket-btm-releases}.mts

Author: jdalton

packages/cli/scripts/build-sea.mts

@@ -35,7 +35,7 @@ const logger = getDefaultLogger()
 /**
  * Filter targets based on CLI arguments.
  */
-export function filterTargets(targets, options) {
+function filterTargets(targets, options) {
   if (options.all) {
     return targets
   }

packages/cli/scripts/build.mts

@@ -50,7 +50,7 @@ const printError = msg => {
  * @param {boolean} options.quiet - Suppress output.
  * @param {boolean} options.verbose - Show detailed output.
  */
-export async function fixNodeGypStrings(dir, options = {}) {
+async function fixNodeGypStrings(dir, options = {}) {
   const { quiet = false, verbose = false } = options
 
   // Find all .js files in build directory.

packages/cli/scripts/constants/build.mts

@@ -3,11 +3,11 @@
  */
 
 // Build configuration file names.
-export const BIOME_JSON = 'biome.json'
-export const TSCONFIG_JSON = 'tsconfig.json'
+const BIOME_JSON = 'biome.json'
+const TSCONFIG_JSON = 'tsconfig.json'
 
 // Rollup configuration.
-export const ROLLUP_EXTERNAL_SUFFIX = '?commonjs-external'
+const ROLLUP_EXTERNAL_SUFFIX = '?commonjs-external'
 
 // Encoding constants.
 export const UTF8 = 'utf8'

packages/cli/scripts/constants/external-tools-platforms.mts

@@ -167,7 +167,7 @@ export const PLATFORM_MAP_TOOLS = {
  *
  * @returns {string} Normalized platform key (e.g., 'win-x64').
  */
-export function getPlatformKey(platform, arch) {
+function getPlatformKey(platform, arch) {
   const releasePlatform = platform === 'win32' ? 'win' : platform
   return `${releasePlatform}-${arch}`
 }

packages/cli/scripts/constants/packages.mts

@@ -24,11 +24,11 @@ export const SOCKET_CLI_SENTRY_PNPM_BIN_NAME = 'socket-pnpm-with-sentry'
 export const SOCKET_CLI_SENTRY_YARN_BIN_NAME = 'socket-yarn-with-sentry'
 
 // File and directory names from registry.
-export const GITIGNORE = '.gitignore'
+const GITIGNORE = '.gitignore'
 export const NODE_MODULES = 'node_modules'
 export const PACKAGE_JSON = 'package.json'
 export const PNPM_LOCK_YAML = 'pnpm-lock.yaml'
 export const SOCKET_REGISTRY_PACKAGE_NAME = '@socketsecurity/registry-stable'
 
 // Path separators.
-export const SLASH_NODE_MODULES_SLASH = '/node_modules/'
+const SLASH_NODE_MODULES_SLASH = '/node_modules/'

packages/cli/scripts/constants/paths.mts

@@ -23,31 +23,31 @@ export const externalPath = path.join(rootPath, 'external')
 export const srcPath = path.join(rootPath, 'src')
 
 // Package and lockfile paths.
-export const rootPackageJsonPath = path.join(rootPath, PACKAGE_JSON)
-export const rootPackageLockPath = path.join(rootPath, PNPM_LOCK_YAML)
+const rootPackageJsonPath = path.join(rootPath, PACKAGE_JSON)
+const rootPackageLockPath = path.join(rootPath, PNPM_LOCK_YAML)
 export const rootNodeModulesBinPath = path.join(rootPath, NODE_MODULES, '.bin')
 
 // Socket registry path (in external, not dist).
-export const socketRegistryPath = path.join(
+const socketRegistryPath = path.join(
   externalPath,
   SOCKET_REGISTRY_PACKAGE_NAME,
 )
 
 // Cache directory paths.
-export const SOCKET_CACHE_DIR = path.join(homedir(), '.socket')
+const SOCKET_CACHE_DIR = path.join(homedir(), '.socket')
 export const SOCKET_CLI_SEA_BUILD_DIR = path.join(
   tmpdir(),
   'socket-cli-sea-build',
 )
-export const SOCKET_CLI_SEA_BUILD_DIR_FALLBACK = '/tmp/socket-cli-sea-build'
+const SOCKET_CLI_SEA_BUILD_DIR_FALLBACK = '/tmp/socket-cli-sea-build'
 
 // Directory name constant.
-export const CONSTANTS = 'constants'
+const CONSTANTS = 'constants'
 
 /**
  * Get all global cache directories.
  */
-export function getGlobalCacheDirs() {
+function getGlobalCacheDirs() {
   return [
     { name: '~/.socket', path: SOCKET_CACHE_DIR },
     { name: '$TMPDIR/socket-cli-sea-build', path: SOCKET_CLI_SEA_BUILD_DIR },

packages/cli/scripts/download-assets.mts

@@ -172,7 +172,7 @@ async function downloadAssets(assetNames, parallel = true) {
 /**
  * Extract tar.gz archive.
  */
-export async function extractArchive(tarGzPath, extractConfig, assetName) {
+async function extractArchive(tarGzPath, extractConfig, assetName) {
   const { outputDir } = extractConfig
 
   await fs.mkdir(outputDir, { recursive: true })

packages/cli/scripts/esbuild-utils.mts

@@ -48,7 +48,7 @@ export function createBaseConfig(
  * Helper to create both dot and bracket notation define keys. This ensures
  * esbuild can replace both forms of process.env access.
  */
-export function createDefineEntries(envVars: Record<string, string>) {
+function createDefineEntries(envVars: Record<string, string>) {
   const entries: Record<string, string> = {}
   // oxlint-disable-next-line socket/prefer-cached-for-loop -- loop variable is destructured
   for (const [key, value] of Object.entries(envVars)) {

packages/cli/scripts/paths.mts

@@ -5,7 +5,7 @@ import { fileURLToPath } from 'node:url'
 import { existsSync } from 'node:fs'
 
 /* oxlint-disable-next-line socket/sort-source-methods -- helper used by PACKAGE_ROOT below. */
-export function resolvePackageRoot(): string {
+function resolvePackageRoot(): string {
   let cur = path.dirname(fileURLToPath(import.meta.url))
   const root = path.parse(cur).root
   while (cur && cur !== root) {

packages/cli/scripts/restore-cache.mts

@@ -35,7 +35,7 @@ const isVerbose = () => process.argv.includes('--verbose')
 /**
  * Check if cache exists in GitHub Actions.
  */
-export async function cacheExists(repo, cacheKey) {
+async function cacheExists(repo, cacheKey) {
   try {
     const result = await spawn(
       'gh',
@@ -73,7 +73,7 @@ export async function cacheExists(repo, cacheKey) {
 /**
  * Generate CLI build cache key (matches CI workflow).
  */
-export async function generateCacheKey() {
+async function generateCacheKey() {
   const pnpmLockHash = await hashFile(path.join(repoRoot, 'pnpm-lock.yaml'))
   const srcHash = await hashFiles('packages/cli/src', repoRoot)
   const configHash = await hashFiles(
@@ -87,7 +87,7 @@ export async function generateCacheKey() {
 /**
  * Get current git commit SHA.
  */
-export async function getCurrentCommit() {
+async function getCurrentCommit() {
   try {
     const result = await spawn('git', ['rev-parse', 'HEAD'], {
       cwd: repoRoot,
@@ -105,7 +105,7 @@ export async function getCurrentCommit() {
 /**
  * Check if gh CLI is available.
  */
-export async function hasGhCli() {
+async function hasGhCli() {
   try {
     const result = await spawn('gh', ['--version'], {
       stdio: 'pipe',
@@ -119,7 +119,7 @@ export async function hasGhCli() {
 /**
  * Compute hash of file.
  */
-export async function hashFile(filePath) {
+async function hashFile(filePath) {
   try {
     const content = await fs.readFile(filePath, 'utf8')
     return createHash('sha256').update(content).digest('hex')
@@ -131,7 +131,7 @@ export async function hashFile(filePath) {
 /**
  * Compute hash of all files matching glob pattern.
  */
-export async function hashFiles(globPattern, cwd) {
+async function hashFiles(globPattern, cwd) {
   try {
     const result = await spawn(
       'find',
@@ -177,7 +177,7 @@ export async function hashFiles(globPattern, cwd) {
 /**
  * Download and extract cache from GitHub Actions.
  */
-export async function restoreCache(repo, cacheKey) {
+async function restoreCache(repo, cacheKey) {
   const tempDir = path.join(packageRoot, 'node_modules', '.cache', 'restore')
   await fs.mkdir(tempDir, { recursive: true })