@socketsecurity/lib 6.0.5 → 6.0.7

package/dist/shell/parse.d.ts

@@ -8,10 +8,100 @@
  *   against `env`; unresolved ones collapse to an empty string.
  */
 import type { ParseEntry } from '../external/shell-quote';
+/**
+ * Visit each simple command in `cmd` in order. A "simple command" is the
+ * POSIX-grammar term for a run of bare-string tokens between shell
+ * control-operator boundaries (`&&`, `;`, `||`, `|`) — e.g. in `sudo apt && rm
+ * -rf /`, the two simple commands are `['sudo', 'apt']` and `['rm', '-rf',
+ * '/']`. Glob and comment tokens are ignored.
+ *
+ * The visitor receives each simple command's tokens as a `readonly string[]`;
+ * returning `true` short-circuits the walk so callers like `hasBinCall` /
+ * `findBinCall` can bail on the first match without finishing the parse.
+ *
+ * Public so consumers can write their own per-command matchers without
+ * re-parsing the command line. Used internally by `findBinCall` /
+ * `findBinCalls` / `hasBinCall`.
+ *
+ * Shell-quote is permissive (partial parses don't throw); the walk tolerates
+ * any shape it returns.
+ *
+ * @example
+ *   eachSimpleCommand('sudo apt && rm -rf /', tokens => {
+ *     console.log(tokens)
+ *     // → ['sudo', 'apt']
+ *     // → ['rm', '-rf', '/']
+ *   })
+ *
+ *   // Short-circuit on first match:
+ *   eachSimpleCommand('a ; b ; c', tokens => {
+ *     if (tokens[0] === 'b') {
+ *       return true // stop the walk
+ *     }
+ *   })
+ */
+export declare function eachSimpleCommand(cmd: string, visit: (tokens: readonly string[]) => boolean | void): void;
+/**
+ * Walk a parsed shell command and return the args of the FIRST binary call
+ * whose leading tokens match `prefix` (e.g. `['sudo']`, `['gh', 'auth',
+ * 'refresh']`). Returns `undefined` when no call matches.
+ *
+ * Short-circuits on the first match — does NOT materialize every match. Use
+ * this when "did any call match, and what were its args?" is enough. For audit
+ * / counting use cases where every match matters, use `findBinCalls`.
+ *
+ * @example
+ *   findBinCall('sudo apt update && sudo -k', ['sudo'])
+ *   // → ['apt', 'update']
+ *
+ *   findBinCall('echo "sudo foo"', ['sudo'])
+ *   // → undefined
+ */
+export declare function findBinCall(cmd: string, prefix: readonly string[]): readonly string[] | undefined;
+/**
+ * Walk a parsed shell command and return the args of every binary call whose
+ * leading tokens match `prefix` (e.g. `['sudo']`, `['gh', 'auth', 'refresh']`).
+ * Returns an empty array when no call matches.
+ *
+ * Segments split at op tokens (`&&`, `;`, `||`, `|`) so each chained command is
+ * scanned independently. Each match's args are returned as a `string[]` slice
+ * positioned after the matched prefix — useful for caller-side `.some(...)`
+ * over flag/value pairs.
+ *
+ * The AST walk means embedded args (`echo "sudo foo"`), variable substitutions
+ * (`$gh`), and command substitution (`$(...)`) don't trip the matcher — only
+ * actual calls do.
+ *
+ * @example
+ *   findBinCalls('sudo apt update && sudo -k', ['sudo'])
+ *   // → [['apt', 'update'], ['-k']]
+ *
+ *   findBinCalls('gh auth refresh -s workflow', ['gh', 'auth', 'refresh'])
+ *   // → [['-s', 'workflow']]
+ *
+ *   findBinCalls('echo "sudo foo"', ['sudo'])
+ *   // → []
+ */
+export declare function findBinCalls(cmd: string, prefix: readonly string[]): readonly string[][];
+/**
+ * Convenience: does `cmd` contain at least one binary call matching the
+ * leading-tokens `prefix`? The most common audit-pattern shape.
+ *
+ * Short-circuits on the first match — walks the parsed entries once and returns
+ * `true` as soon as a simple command matches. No intermediate match list or
+ * args slices are allocated.
+ *
+ * @example
+ *   hasBinCall('echo hi && sudo rm', ['sudo']) // → true
+ *   hasBinCall('echo "sudo foo"', ['sudo']) // → false
+ *   hasBinCall('gh auth refresh -s workflow', ['gh', 'auth', 'refresh']) // → true
+ */
+export declare function hasBinCall(cmd: string, prefix: readonly string[]): boolean;
 export type { ParseEntry, ShellComment, ShellGlob, ShellOp, } from '../external/shell-quote';
 /**
  * Tokenize `cmd` into `ParseEntry` items, preserving operators and comments.
- * Throws on unterminated quotes.
+ * `shell-quote` is permissive — an unterminated quote does not throw; the
+ * parser drops the opening quote and returns the rest as plain tokens.
  *
  * @example
  *   parseShell('git commit -m "hello world"')
@@ -24,3 +114,20 @@ export type { ParseEntry, ShellComment, ShellGlob, ShellOp, } from '../external/
  *   // → ['echo', '/root']
  */
 export declare function parseShell(cmd: string, env?: Record<string, string> | ((key: string) => string | undefined) | undefined): ParseEntry[];
+/**
+ * Does the simple command represented by `tokens` start with `prefix`? The
+ * natural companion to `eachSimpleCommand` — the visitor callback uses this to
+ * test whether a simple command is a call to a specific binary or command-line
+ * prefix.
+ *
+ * @example
+ *   simpleCommandStartsWith(['sudo', 'apt', 'update'], ['sudo'])
+ *   // → true
+ *
+ *   simpleCommandStartsWith(
+ *     ['gh', 'auth', 'status'],
+ *     ['gh', 'auth', 'refresh'],
+ *   )
+ *   // → false
+ */
+export declare function simpleCommandStartsWith(tokens: readonly string[], prefix: readonly string[]): boolean;

package/dist/shell/parse.js

@@ -1,6 +1,7 @@
 "use strict";
 /* Socket Lib - Built with rolldown */
 Object.defineProperty(exports, Symbol.toStringTag, { value: 'Module' });
+const require_primordials_array = require('../primordials/array.js');
 let src_external_shell_quote = require("../external/shell-quote");
 
 //#region src/shell/parse.ts
@@ -14,8 +15,146 @@ let src_external_shell_quote = require("../external/shell-quote");
 *   against `env`; unresolved ones collapse to an empty string.
 */
 /**
+* Visit each simple command in `cmd` in order. A "simple command" is the
+* POSIX-grammar term for a run of bare-string tokens between shell
+* control-operator boundaries (`&&`, `;`, `||`, `|`) — e.g. in `sudo apt && rm
+* -rf /`, the two simple commands are `['sudo', 'apt']` and `['rm', '-rf',
+* '/']`. Glob and comment tokens are ignored.
+*
+* The visitor receives each simple command's tokens as a `readonly string[]`;
+* returning `true` short-circuits the walk so callers like `hasBinCall` /
+* `findBinCall` can bail on the first match without finishing the parse.
+*
+* Public so consumers can write their own per-command matchers without
+* re-parsing the command line. Used internally by `findBinCall` /
+* `findBinCalls` / `hasBinCall`.
+*
+* Shell-quote is permissive (partial parses don't throw); the walk tolerates
+* any shape it returns.
+*
+* @example
+*   eachSimpleCommand('sudo apt && rm -rf /', tokens => {
+*     console.log(tokens)
+*     // → ['sudo', 'apt']
+*     // → ['rm', '-rf', '/']
+*   })
+*
+*   // Short-circuit on first match:
+*   eachSimpleCommand('a ; b ; c', tokens => {
+*     if (tokens[0] === 'b') {
+*       return true // stop the walk
+*     }
+*   })
+*/
+function eachSimpleCommand(cmd, visit) {
+	const entries = (0, src_external_shell_quote.parse)(cmd);
+	let current = [];
+	const flush = () => {
+		if (current.length > 0) {
+			const stop = visit(current);
+			current = [];
+			return stop === true;
+		}
+		current = [];
+		return false;
+	};
+	for (let i = 0, { length } = entries; i < length; i += 1) {
+		const entry = entries[i];
+		if (entry && typeof entry === "object" && "op" in entry) {
+			if (flush()) return;
+			continue;
+		}
+		if (typeof entry === "string") require_primordials_array.ArrayPrototypePush(current, entry);
+	}
+	flush();
+}
+/**
+* Walk a parsed shell command and return the args of the FIRST binary call
+* whose leading tokens match `prefix` (e.g. `['sudo']`, `['gh', 'auth',
+* 'refresh']`). Returns `undefined` when no call matches.
+*
+* Short-circuits on the first match — does NOT materialize every match. Use
+* this when "did any call match, and what were its args?" is enough. For audit
+* / counting use cases where every match matters, use `findBinCalls`.
+*
+* @example
+*   findBinCall('sudo apt update && sudo -k', ['sudo'])
+*   // → ['apt', 'update']
+*
+*   findBinCall('echo "sudo foo"', ['sudo'])
+*   // → undefined
+*/
+function findBinCall(cmd, prefix) {
+	if (prefix.length === 0) return;
+	let found;
+	eachSimpleCommand(cmd, (tokens) => {
+		if (!simpleCommandStartsWith(tokens, prefix)) return false;
+		found = require_primordials_array.ArrayPrototypeSlice(tokens, prefix.length);
+		return true;
+	});
+	return found;
+}
+/**
+* Walk a parsed shell command and return the args of every binary call whose
+* leading tokens match `prefix` (e.g. `['sudo']`, `['gh', 'auth', 'refresh']`).
+* Returns an empty array when no call matches.
+*
+* Segments split at op tokens (`&&`, `;`, `||`, `|`) so each chained command is
+* scanned independently. Each match's args are returned as a `string[]` slice
+* positioned after the matched prefix — useful for caller-side `.some(...)`
+* over flag/value pairs.
+*
+* The AST walk means embedded args (`echo "sudo foo"`), variable substitutions
+* (`$gh`), and command substitution (`$(...)`) don't trip the matcher — only
+* actual calls do.
+*
+* @example
+*   findBinCalls('sudo apt update && sudo -k', ['sudo'])
+*   // → [['apt', 'update'], ['-k']]
+*
+*   findBinCalls('gh auth refresh -s workflow', ['gh', 'auth', 'refresh'])
+*   // → [['-s', 'workflow']]
+*
+*   findBinCalls('echo "sudo foo"', ['sudo'])
+*   // → []
+*/
+function findBinCalls(cmd, prefix) {
+	if (prefix.length === 0) return [];
+	const matches = [];
+	eachSimpleCommand(cmd, (tokens) => {
+		if (simpleCommandStartsWith(tokens, prefix)) require_primordials_array.ArrayPrototypePush(matches, require_primordials_array.ArrayPrototypeSlice(tokens, prefix.length));
+	});
+	return matches;
+}
+/**
+* Convenience: does `cmd` contain at least one binary call matching the
+* leading-tokens `prefix`? The most common audit-pattern shape.
+*
+* Short-circuits on the first match — walks the parsed entries once and returns
+* `true` as soon as a simple command matches. No intermediate match list or
+* args slices are allocated.
+*
+* @example
+*   hasBinCall('echo hi && sudo rm', ['sudo']) // → true
+*   hasBinCall('echo "sudo foo"', ['sudo']) // → false
+*   hasBinCall('gh auth refresh -s workflow', ['gh', 'auth', 'refresh']) // → true
+*/
+function hasBinCall(cmd, prefix) {
+	if (prefix.length === 0) return false;
+	let found = false;
+	eachSimpleCommand(cmd, (tokens) => {
+		if (simpleCommandStartsWith(tokens, prefix)) {
+			found = true;
+			return true;
+		}
+		return false;
+	});
+	return found;
+}
+/**
 * Tokenize `cmd` into `ParseEntry` items, preserving operators and comments.
-* Throws on unterminated quotes.
+* `shell-quote` is permissive — an unterminated quote does not throw; the
+* parser drops the opening quote and returns the rest as plain tokens.
 *
 * @example
 *   parseShell('git commit -m "hello world"')
@@ -30,6 +169,33 @@ let src_external_shell_quote = require("../external/shell-quote");
 function parseShell(cmd, env) {
 	return (0, src_external_shell_quote.parse)(cmd, env);
 }
+/**
+* Does the simple command represented by `tokens` start with `prefix`? The
+* natural companion to `eachSimpleCommand` — the visitor callback uses this to
+* test whether a simple command is a call to a specific binary or command-line
+* prefix.
+*
+* @example
+*   simpleCommandStartsWith(['sudo', 'apt', 'update'], ['sudo'])
+*   // → true
+*
+*   simpleCommandStartsWith(
+*     ['gh', 'auth', 'status'],
+*     ['gh', 'auth', 'refresh'],
+*   )
+*   // → false
+*/
+function simpleCommandStartsWith(tokens, prefix) {
+	const { length: pl } = prefix;
+	if (tokens.length < pl) return false;
+	for (let i = 0; i < pl; i += 1) if (tokens[i] !== prefix[i]) return false;
+	return true;
+}
 
 //#endregion
-exports.parseShell = parseShell;
+exports.eachSimpleCommand = eachSimpleCommand;
+exports.findBinCall = findBinCall;
+exports.findBinCalls = findBinCalls;
+exports.hasBinCall = hasBinCall;
+exports.parseShell = parseShell;
+exports.simpleCommandStartsWith = simpleCommandStartsWith;

package/dist/smol/detect.js

@@ -27,26 +27,25 @@ const require_node_module = require('../node/module.js');
 /**
 * Cached smol-binary detection result.
 */
-let _isSmol;
+let isSmolCache;
 /**
 * Cached `node:smol-util` binding. `null` = probed and unavailable; `undefined`
 * = not yet probed. JS truthiness collapses both to "no binding" at the call
 * site.
 */
-let _smolUtil;
-let _smolUtilProbed = false;
+let smolUtilCache;
+let smolUtilProbed = false;
 /**
 * Returns `node:smol-util` when running on the smol Node binary, otherwise
 * `undefined`. Result is cached across calls.
 */
-/* @__NO_SIDE_EFFECTS__ */
 function getSmolUtil() {
-	if (!_smolUtilProbed) {
-		_smolUtilProbed = true;
+	if (!smolUtilProbed) {
+		smolUtilProbed = true;
 		/* c8 ignore start - smol Node binary only. */
-		if (/* @__PURE__ */ require_node_module.isNodeBuiltin("node:smol-util")) _smolUtil = require("node:smol-util");
+		if (require_node_module.isNodeBuiltin("node:smol-util")) smolUtilCache = require("node:smol-util");
 	}
-	return _smolUtil;
+	return smolUtilCache;
 }
 /**
 * Detect if the current process is running on socket-btm's smol Node binary.
@@ -66,8 +65,8 @@ function getSmolUtil() {
 *   ```
 */
 function isSmol() {
-	if (_isSmol === void 0) _isSmol = /* @__PURE__ */ require_node_module.isNodeBuiltin("node:smol-util");
-	return _isSmol;
+	if (isSmolCache === void 0) isSmolCache = require_node_module.isNodeBuiltin("node:smol-util");
+	return isSmolCache;
 }
 
 //#endregion

package/dist/smol/http.js

@@ -18,20 +18,19 @@ const require_node_module = require('../node/module.js');
 *   `httpText` exports, which already route through this when smol
 *   is present.
 */
-let _smolHttp;
-let _smolHttpProbed = false;
+let smolHttpBinding;
+let smolHttpProbed = false;
 /**
 * Returns `node:smol-http` when running on the smol Node binary, otherwise
 * `undefined`. Result is cached across calls.
 */
-/* @__NO_SIDE_EFFECTS__ */
 function getSmolHttp() {
-	if (!_smolHttpProbed) {
-		_smolHttpProbed = true;
+	if (!smolHttpProbed) {
+		smolHttpProbed = true;
 		/* c8 ignore start - smol Node binary only. */
-		if (/* @__PURE__ */ require_node_module.isNodeBuiltin("node:smol-http")) _smolHttp = require("node:smol-http");
+		if (require_node_module.isNodeBuiltin("node:smol-http")) smolHttpBinding = require("node:smol-http");
 	}
-	return _smolHttp;
+	return smolHttpBinding;
 }
 
 //#endregion

package/dist/smol/https.js

@@ -16,20 +16,19 @@ const require_node_module = require('../node/module.js');
 *   callers should use the standard server-side helpers, which
 *   route through this when smol is present.
 */
-let _smolHttps;
-let _smolHttpsProbed = false;
+let smolHttps;
+let smolHttpsProbed = false;
 /**
 * Returns `node:smol-https` when running on the smol Node binary, otherwise
 * `undefined`. Result is cached across calls.
 */
-/* @__NO_SIDE_EFFECTS__ */
 function getSmolHttps() {
-	if (!_smolHttpsProbed) {
-		_smolHttpsProbed = true;
+	if (!smolHttpsProbed) {
+		smolHttpsProbed = true;
 		/* c8 ignore start - smol Node binary only. */
-		if (/* @__PURE__ */ require_node_module.isNodeBuiltin("node:smol-https")) _smolHttps = require("node:smol-https");
+		if (require_node_module.isNodeBuiltin("node:smol-https")) smolHttps = require("node:smol-https");
 	}
-	return _smolHttps;
+	return smolHttps;
 }
 
 //#endregion

package/dist/smol/manifest.d.ts

@@ -83,7 +83,7 @@ export interface ParsedLockfile {
 export interface FormatDescriptor {
     readonly ecosystem: EcosystemString;
     readonly type: 'manifest' | 'lockfile';
-    readonly format?: 'npm' | 'yarn' | 'pnpm' | 'composer' | 'cargo';
+    readonly format?: 'npm' | 'yarn' | 'pnpm' | 'composer' | 'cargo' | undefined;
 }
 /**
  * Supported-files index returned by `supportedFiles`.

package/dist/smol/manifest.js

@@ -18,20 +18,19 @@ const require_node_module = require('../node/module.js');
 *   (`@socketsecurity/lib/eco/manifest/parse`), which already routes
 *   through this when smol is present.
 */
-let _smolManifest;
-let _smolManifestProbed = false;
+let cachedSmolManifest;
+let smolManifestProbed = false;
 /**
 * Returns `node:smol-manifest` when running on the smol Node binary, otherwise
 * `undefined`. Result is cached across calls.
 */
-/* @__NO_SIDE_EFFECTS__ */
 function getSmolManifest() {
-	if (!_smolManifestProbed) {
-		_smolManifestProbed = true;
+	if (!smolManifestProbed) {
+		smolManifestProbed = true;
 		/* c8 ignore start - smol Node binary only. */
-		if (/* @__PURE__ */ require_node_module.isNodeBuiltin("node:smol-manifest")) _smolManifest = require("node:smol-manifest");
+		if (require_node_module.isNodeBuiltin("node:smol-manifest")) cachedSmolManifest = require("node:smol-manifest");
 	}
-	return _smolManifest;
+	return cachedSmolManifest;
 }
 
 //#endregion

package/dist/smol/path.d.ts

@@ -6,7 +6,7 @@
  *   and on socket-btm binaries that haven't shipped the binding yet; callers
  *   fall back to the JS implementation. Result is cached. The binding does not
  *   exist yet (the plan is unbuilt) — this accessor is the seam so that when it
- *   lands, only this file changes and `paths/walk`, `fs/access`, `fs/find-up`
+ *   lands, only this file changes and `paths/walk`, `fs/access`, `fs/find`
  *   light up natively. Today `getSmolPath()` is always `undefined` and the JS
  *   paths run.
  */

package/dist/smol/path.js

@@ -12,26 +12,25 @@ const require_node_module = require('../node/module.js');
 *   and on socket-btm binaries that haven't shipped the binding yet; callers
 *   fall back to the JS implementation. Result is cached. The binding does not
 *   exist yet (the plan is unbuilt) — this accessor is the seam so that when it
-*   lands, only this file changes and `paths/walk`, `fs/access`, `fs/find-up`
+*   lands, only this file changes and `paths/walk`, `fs/access`, `fs/find`
 *   light up natively. Today `getSmolPath()` is always `undefined` and the JS
 *   paths run.
 */
-let _smolPath;
-let _smolPathProbed = false;
+let smolPathCache;
+let smolPathProbed = false;
 /**
 * Returns the `node:smol-path` binding when running on a smol Node binary that
 * ships it; otherwise `undefined`. Cached across calls.
 *
 * @returns The native binding, or `undefined` to signal "use the JS fallback".
 */
-/* @__NO_SIDE_EFFECTS__ */
 function getSmolPath() {
-	if (!_smolPathProbed) {
-		_smolPathProbed = true;
+	if (!smolPathProbed) {
+		smolPathProbed = true;
 		/* c8 ignore start - smol Node binary only. */
-		if (/* @__PURE__ */ require_node_module.isNodeBuiltin("node:smol-path")) _smolPath = require("node:smol-path");
+		if (require_node_module.isNodeBuiltin("node:smol-path")) smolPathCache = require("node:smol-path");
 	}
-	return _smolPath;
+	return smolPathCache;
 }
 
 //#endregion

package/dist/smol/primordial.d.ts

@@ -67,6 +67,10 @@ export interface SmolPrimordialBinding {
     numberParseInt10(s: string): number;
     stringCharCodeAt(s: string, i: number): number;
     stringIsWellFormed(s: string): boolean;
+    IntlCollator: typeof Intl.Collator;
+    IntlListFormat: typeof Intl.ListFormat;
+    IntlPluralRules: typeof Intl.PluralRules;
+    IntlSegmenter: typeof Intl.Segmenter;
 }
 /**
  * Returns `node:smol-primordial` when running on the smol Node binary,

package/dist/smol/primordial.js

@@ -20,20 +20,19 @@ const require_node_module = require('../node/module.js');
 *
 * @see https://v8.dev/blog/v8-release-99 — V8 Fast API Calls overview
 */
-let _smolPrimordial;
-let _smolPrimordialProbed = false;
+let smolPrimordial;
+let smolPrimordialProbed = false;
 /**
 * Returns `node:smol-primordial` when running on the smol Node binary,
 * otherwise `undefined`. Result is cached across calls.
 */
-/* @__NO_SIDE_EFFECTS__ */
 function getSmolPrimordial() {
-	if (!_smolPrimordialProbed) {
-		_smolPrimordialProbed = true;
+	if (!smolPrimordialProbed) {
+		smolPrimordialProbed = true;
 		/* c8 ignore start - smol Node binary only. */
-		if (/* @__PURE__ */ require_node_module.isNodeBuiltin("node:smol-primordial")) _smolPrimordial = require("node:smol-primordial");
+		if (require_node_module.isNodeBuiltin("node:smol-primordial")) smolPrimordial = require("node:smol-primordial");
 	}
-	return _smolPrimordial;
+	return smolPrimordial;
 }
 
 //#endregion

package/dist/smol/purl.d.ts

@@ -7,7 +7,7 @@
  *   calls. Callers fall back to the JS `@socketregistry/packageurl-js` import
  *   on the undefined path.
  *
- * @internal — used by `src/packages/operations.ts` to resolve the
+ * @internal — used by `src/packages/specs.ts` to resolve the
  *   `pkg:npm/<name>` parse on `resolveRegistryPackageName`. Most
  *   callers should keep using `PackageURL` from
  *   `external/@socketregistry/packageurl-js` directly; this loader

package/dist/smol/purl.js

@@ -13,26 +13,25 @@ const require_node_module = require('../node/module.js');
 *   calls. Callers fall back to the JS `@socketregistry/packageurl-js` import
 *   on the undefined path.
 *
-* @internal — used by `src/packages/operations.ts` to resolve the
+* @internal — used by `src/packages/specs.ts` to resolve the
 *   `pkg:npm/<name>` parse on `resolveRegistryPackageName`. Most
 *   callers should keep using `PackageURL` from
 *   `external/@socketregistry/packageurl-js` directly; this loader
 *   only matters where the hot path warrants the native acceleration.
 */
-let _smolPurl;
-let _smolPurlProbed = false;
+let smolPurl;
+let smolPurlProbed = false;
 /**
 * Returns `node:smol-purl` when running on the smol Node binary, otherwise
 * `undefined`. Result is cached across calls.
 */
-/* @__NO_SIDE_EFFECTS__ */
 function getSmolPurl() {
-	if (!_smolPurlProbed) {
-		_smolPurlProbed = true;
+	if (!smolPurlProbed) {
+		smolPurlProbed = true;
 		/* c8 ignore start - smol Node binary only. */
-		if (/* @__PURE__ */ require_node_module.isNodeBuiltin("node:smol-purl")) _smolPurl = require("node:smol-purl");
+		if (require_node_module.isNodeBuiltin("node:smol-purl")) smolPurl = require("node:smol-purl");
 	}
-	return _smolPurl;
+	return smolPurl;
 }
 
 //#endregion

package/dist/smol/versions.js

@@ -16,20 +16,19 @@ const require_node_module = require('../node/module.js');
 *   ops. Most callers should use the standard `versions` exports,
 *   which already route through this when smol is present.
 */
-let _smolVersions;
-let _smolVersionsProbed = false;
+let smolVersions;
+let smolVersionsProbed = false;
 /**
 * Returns `node:smol-versions` when running on the smol Node binary, otherwise
 * `undefined`. Result is cached across calls.
 */
-/* @__NO_SIDE_EFFECTS__ */
 function getSmolVersions() {
-	if (!_smolVersionsProbed) {
-		_smolVersionsProbed = true;
+	if (!smolVersionsProbed) {
+		smolVersionsProbed = true;
 		/* c8 ignore start - smol Node binary only. */
-		if (/* @__PURE__ */ require_node_module.isNodeBuiltin("node:smol-versions")) _smolVersions = require("node:smol-versions");
+		if (require_node_module.isNodeBuiltin("node:smol-versions")) smolVersions = require("node:smol-versions");
 	}
-	return _smolVersions;
+	return smolVersions;
 }
 
 //#endregion

package/dist/smol/vfs.js

@@ -26,8 +26,8 @@ const require_node_module = require('../node/module.js');
 *     binding. Result is cached across calls. Callers fall back to PATH lookup
 *     (or out-of-band downloads in socket-cli's case) when this is missing.
 */
-let _smolVfs;
-let _smolVfsProbed = false;
+let cachedSmolVfs;
+let smolVfsProbed = false;
 /**
 * Returns the pre-mounted SEA `SmolVirtualFileSystem` instance when running on
 * a smol Node binary with an embedded SEA payload; otherwise `undefined`.
@@ -37,14 +37,13 @@ let _smolVfsProbed = false;
 * binding-module loader is collapsed into this function so callers don't deal
 * with two indirection levels.
 */
-/* @__NO_SIDE_EFFECTS__ */
 function getSmolVfs() {
-	if (!_smolVfsProbed) {
-		_smolVfsProbed = true;
+	if (!smolVfsProbed) {
+		smolVfsProbed = true;
 		/* c8 ignore start - smol Node binary only. */
-		if (/* @__PURE__ */ require_node_module.isNodeBuiltin("node:smol-vfs")) _smolVfs = require("node:smol-vfs").getSmolVfs();
+		if (require_node_module.isNodeBuiltin("node:smol-vfs")) cachedSmolVfs = require("node:smol-vfs").getSmolVfs();
 	}
-	return _smolVfs;
+	return cachedSmolVfs;
 }
 
 //#endregion

package/dist/sorts/_internal.js

@@ -3,17 +3,15 @@
 Object.defineProperty(exports, Symbol.toStringTag, { value: 'Module' });
 
 //#region src/sorts/_internal.ts
-let _fastSort;
-let _semver;
-/* @__NO_SIDE_EFFECTS__ */
+let fastSort;
+let semver;
 function getFastSort() {
-	if (_fastSort === void 0) _fastSort = /* @__PURE__ */ require("../external/fast-sort.js");
-	return _fastSort;
+	if (fastSort === void 0) fastSort = /*@__PURE__*/ require("../external/fast-sort.js");
+	return fastSort;
 }
-/* @__NO_SIDE_EFFECTS__ */
 function getSemver() {
-	if (_semver === void 0) _semver = /* @__PURE__ */ require("../external/semver.js");
-	return _semver;
+	if (semver === void 0) semver = /*@__PURE__*/ require("../external/semver.js");
+	return semver;
 }
 
 //#endregion