Triage: open issues, planned fixes & performance findings

Full pass over the open issues on this repo, with draft PRs opened for everything code-tractable.

| Issue | Title | Category | Addressed-by-PR |
|---|---|---|---|
| #10 | feature: add empty statement builder | fixed-in-this-wave | #229 (`EmptyBuilder` for the `EmptyStatement` type; issue body was empty so the intended semantics are inferred — flagged in the PR) |
| #12 | fix: export all types | fixed-in-this-wave | #228 (re-exports the statement types + `LogicalStatementType` from the package index) |
| #176 | The automated release is failing 🚨 | needs-your-decision | — (semantic-release reports an invalid `NPM_TOKEN`; only you can rotate the repo secret) |

Additional draft PRs from this pass (no pre-existing issue):

- #230 — `package.json` `types` field pointed at `dist/index.d.js` (never emitted) instead of `dist/index.d.ts`.
- #231 — chore: `__tests__/xone-test .ts` stray space in filename, README example uses an undeclared `builder` variable, README license link points at `jeswr/useState`.

## Performance findings

No perf PR is warranted. The library is a thin builder with no parsing loops, regexes, IO or O(n²) scans; the only hot path is the recursive `build()` tree walk, which is allocation-bound. Microbenchmark on a ~4.7k-node tree: ~3.2 ms per full `build()` (~0.7 µs/node) on a small shared 2-core box (noisy, order-of-magnitude only). The five per-node child arrays are always allocated even when empty; sharing frozen empties would save allocations but changes mutability semantics of the returned objects for marginal gain — not recommended.

## Needs your decision

- **#176 / releases:** the `NPM_TOKEN` secret is invalid, so nothing merged here (including #228–#231) can publish until you rotate the token on npm and update the repo secret.
- **Dependabot backlog (#215–#217, #219, #220, #227):** six open dep-bump PRs, several security-motivated (braces, tough-cookie, @babel/traverse, ws). The eslint 7→9 bump (#227) will likely need config migration (`.eslintrc.json` → flat config) — worth deciding whether to take it or pin.
- **Toolchain age:** jest 26 / ts-jest 26 / TypeScript 4.1 still install and pass on Node 22, but a coordinated devDependency refresh may be preferable to piecemeal dependabot merges.

Review timing: prepared with Claude; @jeswr will personally review before it progresses — expect active review Wed-Fri.

Start by reviewing the issue table and draft PRs #228–#231, then inspect #176 and the Dependabot backlog (#215–#217, #219, #220, #227). This is a coordination and review pass rather than a self-contained change; the work is done when the listed PRs and release, dependency, and toolchain decisions have been reviewed by the maintainer.

Written by the indexing model from the issue text.