refactor(cli): move socket-lib CLI trio out of src/bin/ into src/cli/

src/bin/ is the binary-resolution library (find/resolve/which/exec/
shadow). The socket-lib CLI app — entry dispatcher (socket-lib.ts), the
check subcommand group (check.ts), and the primordials handler
(check-primordials.ts) — was misfiled there. Move it to src/cli/ so bin/
stays a pure helper module. Exports regenerate ./cli/* (glob-driven);
bin.socket-lib repoints to dist/cli/socket-lib.js. Tests follow to
test/unit/cli/. prim CLI (tools/prim) untouched.

Author: jdalton

package.json

@@ -21,7 +21,7 @@
   },
   "bin": {
     "prim": "./dist/bin/prim.cjs",
-    "socket-lib": "./dist/bin/socket-lib.js"
+    "socket-lib": "./dist/cli/socket-lib.js"
   },
   "files": [
     "dist",
@@ -225,16 +225,6 @@
       "types": "./dist/arrays/unique.d.ts",
       "default": "./dist/arrays/unique.js"
     },
-    "./bin/check": {
-      "source": "./src/bin/check.ts",
-      "types": "./dist/bin/check.d.ts",
-      "default": "./dist/bin/check.js"
-    },
-    "./bin/check-primordials": {
-      "source": "./src/bin/check-primordials.ts",
-      "types": "./dist/bin/check-primordials.d.ts",
-      "default": "./dist/bin/check-primordials.js"
-    },
     "./bin/exec": {
       "source": "./src/bin/exec.ts",
       "types": "./dist/bin/exec.d.ts",
@@ -255,11 +245,6 @@
       "types": "./dist/bin/shadow.d.ts",
       "default": "./dist/bin/shadow.js"
     },
-    "./bin/socket-lib": {
-      "source": "./src/bin/socket-lib.ts",
-      "types": "./dist/bin/socket-lib.d.ts",
-      "default": "./dist/bin/socket-lib.js"
-    },
     "./bin/types": {
       "source": "./src/bin/types.ts",
       "types": "./dist/bin/types.d.ts",
@@ -315,6 +300,21 @@
       "types": "./dist/checks/primordials-defaults.d.ts",
       "default": "./dist/checks/primordials-defaults.js"
     },
+    "./cli/check": {
+      "source": "./src/cli/check.ts",
+      "types": "./dist/cli/check.d.ts",
+      "default": "./dist/cli/check.js"
+    },
+    "./cli/check-primordials": {
+      "source": "./src/cli/check-primordials.ts",
+      "types": "./dist/cli/check-primordials.d.ts",
+      "default": "./dist/cli/check-primordials.js"
+    },
+    "./cli/socket-lib": {
+      "source": "./src/cli/socket-lib.ts",
+      "types": "./dist/cli/socket-lib.d.ts",
+      "default": "./dist/cli/socket-lib.js"
+    },
     "./colors/convert": {
       "browser": {
         "source": "./src/colors/convert.ts",

src/bin/check-primordials.ts src/cli/check-primordials.tssrc/bin/check-primordials.ts renamed to src/cli/check-primordials.ts

@@ -2,7 +2,7 @@
 /**
  * @file `socket-lib` CLI entry point — top-level dispatcher. socket-lib — print
  *   help, list commands socket-lib check <name> [opts...] — run a fleet-wide
- *   check Subcommands live as siblings under `src/bin/`; each is its own file
+ *   check Subcommands live as siblings under `src/cli/`; each is its own file
  *   so a misbehaving check can't crash other commands at parse time. The
  *   dispatcher just routes; subcommands own their own arg parsing. The CLI is
  *   shipped via the `bin` field in package.json and intended to be invoked as

src/bin/check.ts src/cli/check.tssrc/bin/check.ts renamed to src/cli/check.ts

@@ -16,7 +16,7 @@ import { fileURLToPath } from 'node:url'
 
 import { afterEach, beforeEach, describe, expect, it } from 'vitest'
 
-import { runCheckPrimordials } from '../../../src/bin/check-primordials'
+import { runCheckPrimordials } from '../../../src/cli/check-primordials'
 import { safeDelete } from '../../../src/fs/safe'
 
 // Absolute path to socket-lib's own primordials source. Each test
@@ -291,13 +291,13 @@ describe('runCheckPrimordials', () => {
 describe('resolveConfigPath', () => {
   it('returns the explicit path verbatim when provided', async () => {
     const { resolveConfigPath } =
-      await import('../../../src/bin/check-primordials')
+      await import('../../../src/cli/check-primordials')
     expect(resolveConfigPath('/explicit/path.json')).toBe('/explicit/path.json')
   })
 
   it('returns the first fallback when no explicit path is given', async () => {
     const { resolveConfigPath } =
-      await import('../../../src/bin/check-primordials')
+      await import('../../../src/cli/check-primordials')
     // No explicit + none of the fallback paths exist → returns the head
     // of FALLBACK_CONFIG_PATHS so the "config file not found" error
     // names the canonical default.
@@ -309,14 +309,14 @@ describe('resolveConfigPath', () => {
 
 describe('printHelp', () => {
   it('writes usage text to stdout without throwing', async () => {
-    const { printHelp } = await import('../../../src/bin/check-primordials')
+    const { printHelp } = await import('../../../src/cli/check-primordials')
     expect(() => printHelp()).not.toThrow()
   })
 })
 
 describe('renderHuman', () => {
   it('emits success when no findings + silent=false', async () => {
-    const { renderHuman } = await import('../../../src/bin/check-primordials')
+    const { renderHuman } = await import('../../../src/cli/check-primordials')
     expect(() =>
       renderHuman(
         {
@@ -336,7 +336,7 @@ describe('renderHuman', () => {
   })
 
   it('emits nothing when silent + no findings', async () => {
-    const { renderHuman } = await import('../../../src/bin/check-primordials')
+    const { renderHuman } = await import('../../../src/cli/check-primordials')
     expect(() =>
       renderHuman(
         {
@@ -356,7 +356,7 @@ describe('renderHuman', () => {
   })
 
   it('renders findings with hint when --explain is set', async () => {
-    const { renderHuman } = await import('../../../src/bin/check-primordials')
+    const { renderHuman } = await import('../../../src/cli/check-primordials')
     expect(() =>
       renderHuman(
         {
@@ -383,7 +383,7 @@ describe('renderHuman', () => {
   })
 
   it('renders findings without files when files list is empty', async () => {
-    const { renderHuman } = await import('../../../src/bin/check-primordials')
+    const { renderHuman } = await import('../../../src/cli/check-primordials')
     expect(() =>
       renderHuman(
         {
@@ -410,7 +410,7 @@ describe('renderHuman', () => {
   })
 
   it('emits trailing "run with --explain" hint when not explaining', async () => {
-    const { renderHuman } = await import('../../../src/bin/check-primordials')
+    const { renderHuman } = await import('../../../src/cli/check-primordials')
     expect(() =>
       renderHuman(
         {

src/bin/socket-lib.ts src/cli/socket-lib.tssrc/bin/socket-lib.ts renamed to src/cli/socket-lib.ts

@@ -7,7 +7,7 @@
 
 import { describe, expect, it } from 'vitest'
 
-import { runCheck } from '../../../src/bin/check'
+import { runCheck } from '../../../src/cli/check'
 
 describe('socket-lib check dispatcher', () => {
   it('prints help and exits 0 when called with no args', async () => {

test/unit/bin/check-primordials.test.mts test/unit/cli/check-primordials.test.mtstest/unit/bin/check-primordials.test.mts renamed to test/unit/cli/check-primordials.test.mts

@@ -3,13 +3,13 @@
  *   dispatcher's job is to route the first argv slot — print help when empty /
  *   --help, hand off to runCheck when 'check', error out otherwise. Tests call
  *   the exported `main` function directly so coverage attributes to
- *   src/bin/socket-lib.ts; the require.main === module entry guard is a no-op
+ *   src/cli/socket-lib.ts; the require.main === module entry guard is a no-op
  *   when imported.
  */
 
 import { describe, expect, it } from 'vitest'
 
-import { main, printHelp } from '../../../src/bin/socket-lib'
+import { main, printHelp } from '../../../src/cli/socket-lib'
 
 describe('socket-lib CLI dispatcher', () => {
   it('prints help and exits 0 with no args', async () => {