fix(lint): revert colocate work in packages/cli/src — fleet rule requires export

I incorrectly colocated 89 functions across 52 files in earlier 'drop
unused export' commits, not realizing the fleet rule socket/export-top-
level-functions enforces `export function …` for testability. The
companion rule socket/sort-source-methods then complained about ordering.

Run `pnpm exec oxlint --config .config/oxlintrc.json` to verify: all
141 violations introduced by the colocate work are gone after this
revert. tsc --noEmit also passes.

This restores `export` on every flagged function. Files touched are
strictly the ones lint flagged — no other behavioral changes.

Author: jdalton

packages/cli/src/bootstrap/node.mts

@@ -36,7 +36,7 @@ const logger = getDefaultLogger()
  * Download CLI using npm pack command. This delegates to npm which handles
  * downloading and extracting the latest version.
  */
-async function downloadCli(): Promise<void> {
+export async function downloadCli(): Promise<void> {
   const packageName = getCliPackageName()
   const dlxDir = getDlxDir()
   const cliDir = getCliPackageDir()
@@ -112,7 +112,7 @@ async function downloadCli(): Promise<void> {
 /**
  * Check if CLI is installed.
  */
-function isCliInstalled(): boolean {
+export function isCliInstalled(): boolean {
   const entryPoint = getCliEntryPoint()
   const packageJson = `${getCliPackageDir()}/package.json`
   return existsSync(entryPoint) && existsSync(packageJson)

packages/cli/src/bootstrap/shared/node-flags.mts

@@ -14,22 +14,22 @@ export function getNodeDisableSigusr1Flags(): string[] {
 /**
  * Get Node major version number.
  */
-function getNodeMajorVersion(): number {
+export function getNodeMajorVersion(): number {
   return Number.parseInt(process.version.slice(1).split('.')[0] || '0', 10)
 }
 
 /**
  * Get Node minor version number.
  */
-function getNodeMinorVersion(): number {
+export function getNodeMinorVersion(): number {
   return Number.parseInt(process.version.slice(1).split('.')[1] || '0', 10)
 }
 
 /**
  * Check if --disable-sigusr1 flag is supported. Supported in v22.14.0+,
  * v23.7.0+, v24.8.0+ (stable in v22.20.0+, v24.8.0+).
  */
-function supportsDisableSigusr1(): boolean {
+export function supportsDisableSigusr1(): boolean {
   const major = getNodeMajorVersion()
   const minor = getNodeMinorVersion()
 

packages/cli/src/cli-dispatch.mts

@@ -22,7 +22,7 @@ import { waitForBootstrapHandshake } from './util/sea/boot.mjs'
 const logger = getDefaultLogger()
 
 // Detect how this binary was invoked.
-function getInvocationMode(): string {
+export function getInvocationMode(): string {
   // Check environment variable first (for explicit mode).
   const envMode = process.env['SOCKET_CLI_MODE']
   if (envMode) {

packages/cli/src/cli-entry.mts

@@ -89,7 +89,7 @@ setupTelemetryExitHandlers()
  * Write manifest entry for CLI installed via bootstrap. Bootstrap passes spec
  * and cache dir via environment variables.
  */
-async function writeBootstrapManifestEntry(): Promise<void> {
+export async function writeBootstrapManifestEntry(): Promise<void> {
   const spec = getSocketCliBootstrapSpec()
   const cacheDir = getSocketCliBootstrapCacheDir()
 

packages/cli/src/commands/audit-log/AuditLogRenderer.mts

@@ -154,7 +154,7 @@ export function displayAuditLogWithIocraft({
 /**
  * Format audit log entry as JSON with compact payload.
  */
-function formatEntry(entry: AuditLogEntry): string {
+export function formatEntry(entry: AuditLogEntry): string {
   const obj = { ...entry, payload: 'REPLACEME' }
   const json = JSON.stringify(obj, null, 2).replace(
     /"payload": "REPLACEME"/,

packages/cli/src/commands/config/discover-config-value.mts

@@ -128,7 +128,7 @@ export async function discoverConfigValue(
   }
 }
 
-async function getDefaultOrgFromToken(): Promise<
+export async function getDefaultOrgFromToken(): Promise<
   string[] | string | undefined
 > {
   const orgsCResult = await fetchOrganization()
@@ -147,7 +147,7 @@ async function getDefaultOrgFromToken(): Promise<
   return slugs
 }
 
-async function getEnforceableOrgsFromToken(): Promise<
+export async function getEnforceableOrgsFromToken(): Promise<
   string[] | undefined
 > {
   const orgsCResult = await fetchOrganization()

packages/cli/src/commands/fix/env-helpers.mts

@@ -42,7 +42,7 @@ export function checkCiEnvVars(): MissingEnvVars {
   return { missing, present }
 }
 
-function ciRepoInfo(): RepoInfo | undefined {
+export function ciRepoInfo(): RepoInfo | undefined {
   if (!GITHUB_REPOSITORY) {
     debug('miss: GITHUB_REPOSITORY env var')
     return undefined

packages/cli/src/commands/fix/pull-request.mts

@@ -205,7 +205,7 @@ type ContextualPrMatch = {
   match: PrMatch
 }
 
-async function getSocketFixPrsWithContext(
+export async function getSocketFixPrsWithContext(
   owner: string,
   repo: string,
   options?: SocketPrsOptions | undefined,

packages/cli/src/commands/install/setup-tab-completion.mts

@@ -21,7 +21,7 @@ const require = createRequire(import.meta.url)
 
 import type { CResult } from '../../types.mts'
 
-function getTabCompletionScriptRaw(): CResult<string> {
+export function getTabCompletionScriptRaw(): CResult<string> {
   // Resolve the @socketsecurity/cli package root to find the data directory.
   // This works whether running from source, installed globally, or via npx/dlx.
   let sourcePath: string

packages/cli/src/commands/logout/cmd-logout.mts

@@ -26,15 +26,15 @@ const hidden = false
 
 // Helper functions.
 
-function applyLogout(): void {
+export function applyLogout(): void {
   updateConfigValue(CONFIG_KEY_API_TOKEN, undefined)
   updateConfigValue(CONFIG_KEY_API_BASE_URL, undefined)
   updateConfigValue(CONFIG_KEY_API_PROXY, undefined)
   updateConfigValue(CONFIG_KEY_ENFORCED_ORGS, undefined)
   invalidateDefaultApiToken()
 }
 
-function attemptLogout(): void {
+export function attemptLogout(): void {
   try {
     applyLogout()
     logger.success('Successfully logged out')