@socketsecurity/lib 6.0.6 → 6.0.8

package/dist/git/tracked.js

@@ -0,0 +1,163 @@
+"use strict";
+/* Socket Lib - Built with rolldown */
+Object.defineProperty(exports, Symbol.toStringTag, { value: 'Module' });
+const require_primordials_string = require('../primordials/string.js');
+const require_paths_normalize = require('../paths/normalize.js');
+const require_primordials_array = require('../primordials/array.js');
+const require_node_path = require('../node/path.js');
+const require_process_spawn_child = require('../process/spawn/child.js');
+const require_git_repo = require('./repo.js');
+
+//#region src/git/tracked.ts
+/**
+* @file Tracked-status + submodule-membership probes for a working-tree path.
+*   `isTracked` answers "does git track this exact path?"; `getSubmodulePaths`
+*   lists the repo's submodule mount points; `isInSubmodule` answers "does this
+*   path live inside one?"; `isUntrackedNonSubmodulePath` composes them into
+*   the safe-to-touch condition for cleanup tooling — never delete a tracked
+*   file or reach into a submodule's own tree (which would dirty it).
+*/
+/**
+* The repo's submodule mount points as normalized, repo-root-relative paths
+* (e.g. `vendor/acorn`). Reads `git config` on `.gitmodules`, so it lists
+* declared submodules whether or not they are initialized — the case a
+* stderr-message check on `git ls-files` misses.
+*
+* @example
+*   ;```typescript
+*   await getSubmodulePaths()
+*   // => ['packages/acorn/upstream/acorn', 'vendor/mbedtls']
+*   ```
+*/
+async function getSubmodulePaths(options) {
+	const { cwd = require_git_repo.getCwd() } = {
+		__proto__: null,
+		...options
+	};
+	const lines = require_primordials_string.StringPrototypeSplit(await require_process_spawn_child.spawn("git", [
+		"config",
+		"--file",
+		".gitmodules",
+		"--get-regexp",
+		"path"
+	], {
+		cwd,
+		stdioString: true
+	}).then(
+		/* c8 ignore next - stdioString:true always yields a string stdout; the
+		?? '' is a defensive fallback that never fires on real spawn output. */
+		(result) => String(result?.stdout ?? ""),
+		() => ""
+	), "\n");
+	const paths = [];
+	for (let i = 0, { length } = lines; i < length; i += 1) {
+		const line = require_primordials_string.StringPrototypeTrim(lines[i]);
+		/* c8 ignore start - defensive parse guards: `git config --get-regexp`
+		always emits a `key value` line, so the blank-line and no-space skips
+		and the empty-value branch never fire on real git output. */
+		if (!line) continue;
+		const spaceIdx = line.indexOf(" ");
+		if (spaceIdx === -1) continue;
+		const rel = require_primordials_string.StringPrototypeTrim(line.slice(spaceIdx + 1));
+		if (!rel) continue;
+		/* c8 ignore stop */
+		paths.push(require_paths_normalize.normalizePath(rel));
+	}
+	return paths;
+}
+/**
+* Whether `targetPath` lives inside one of the repo's submodules. Resolves the
+* submodule list itself; for a batch sweep prefer `getSubmodulePaths` once plus
+* `pathIsUnderSubmodule` per path.
+*
+* @example
+*   ;```typescript
+*   await isInSubmodule('vendor/mbedtls/x.py')  // => true
+*   await isInSubmodule('src/index.ts')         // => false
+*   ```
+*/
+async function isInSubmodule(targetPath, options) {
+	const submodulePaths = await getSubmodulePaths(options);
+	if (!submodulePaths.length) return false;
+	return pathIsUnderSubmodule(targetPath, submodulePaths);
+}
+/**
+* Whether git tracks `targetPath` exactly. Uses `git ls-files --error-unmatch`,
+* which exits non-zero for an untracked path. A path inside a submodule, or one
+* git does not know, returns `false`.
+*
+* @example
+*   ;```typescript
+*   await isTracked('src/index.ts')        // => true
+*   await isTracked('.DS_Store')           // => false
+*   ```
+*/
+async function isTracked(targetPath, options) {
+	const { cwd = require_git_repo.getCwd() } = {
+		__proto__: null,
+		...options
+	};
+	return await require_process_spawn_child.spawn("git", [
+		"ls-files",
+		"--error-unmatch",
+		targetPath
+	], {
+		cwd,
+		stdioString: true
+	}).then(() => true, () => false);
+}
+/**
+* Whether `targetPath` is git does NOT track AND does not live inside a
+* submodule — the safe-to-touch condition for cleanup tooling. A tracked path
+* is a deliberate file; a submodule-internal path belongs to that submodule's
+* own git (touching it would dirty the submodule). Composes `isTracked` +
+* `getSubmodulePaths`/`pathIsUnderSubmodule`. Fails closed — any check error
+* resolves to `false`.
+*
+* For a batch sweep, call `getSubmodulePaths` once and compose `isTracked` +
+* `pathIsUnderSubmodule` per path to avoid re-reading `.gitmodules` each time.
+*
+* @example
+*   ;```typescript
+*   await isUntrackedNonSubmodulePath('.DS_Store')        // => true
+*   await isUntrackedNonSubmodulePath('src/index.ts')     // => false (tracked)
+*   await isUntrackedNonSubmodulePath('vendor/sub/x.pyc') // => false (submodule)
+*   ```
+*/
+async function isUntrackedNonSubmodulePath(targetPath, options) {
+	const { cwd = require_git_repo.getCwd() } = {
+		__proto__: null,
+		...options
+	};
+	if (await isTracked(targetPath, { cwd }).catch(() => true)) return false;
+	const submodulePaths = await getSubmodulePaths({ cwd }).catch(() => []);
+	if (submodulePaths.length) {
+		const path = require_node_path.getNodePath();
+		if (pathIsUnderSubmodule(path.relative(cwd, path.resolve(cwd, targetPath)), submodulePaths)) return false;
+	}
+	return true;
+}
+/**
+* Whether `relativePath` (repo-root-relative) lies at or under any of
+* `submodulePaths`. Pure — pass the result of `getSubmodulePaths` so the git
+* read happens once for a whole sweep.
+*
+* @example
+*   ;```typescript
+*   pathIsUnderSubmodule('vendor/mbedtls/scripts/__pycache__', ['vendor/mbedtls'])
+*   // => true
+*   ```
+*/
+function pathIsUnderSubmodule(relativePath, submodulePaths) {
+	const normalized = require_paths_normalize.normalizePath(relativePath);
+	return require_primordials_array.ArrayPrototypeSome(submodulePaths, (sub) => {
+		return normalized === sub || require_primordials_string.StringPrototypeStartsWith(normalized, `${sub}/`) || require_primordials_string.StringPrototypeEndsWith(sub, normalized);
+	});
+}
+
+//#endregion
+exports.getSubmodulePaths = getSubmodulePaths;
+exports.isInSubmodule = isInSubmodule;
+exports.isTracked = isTracked;
+exports.isUntrackedNonSubmodulePath = isUntrackedNonSubmodulePath;
+exports.pathIsUnderSubmodule = pathIsUnderSubmodule;

package/dist/git/unstaged.js

@@ -44,6 +44,10 @@ const require_git__internal = require('./_internal.js');
 * @returns Promise resolving to array of unstaged file paths.
 */
 async function getUnstagedFiles(options) {
+	options = {
+		__proto__: null,
+		...options
+	};
 	const args = require_git__internal.getGitDiffSpawnArgs(options?.cwd).unstaged;
 	return await require_git__internal.innerDiff(args, options);
 }
@@ -79,6 +83,10 @@ async function getUnstagedFiles(options) {
 * @returns Array of unstaged file paths.
 */
 function getUnstagedFilesSync(options) {
+	options = {
+		__proto__: null,
+		...options
+	};
 	const args = require_git__internal.getGitDiffSpawnArgs(options?.cwd).unstaged;
 	return require_git__internal.innerDiffSync(args, options);
 }
@@ -123,11 +131,11 @@ async function isUnstaged(pathname, options) {
 		...options,
 		absolute: false
 	});
-	const path = /* @__PURE__ */ require_node_path.getNodePath();
+	const path = require_node_path.getNodePath();
 	const resolvedPathname = require_git_repo.getCachedRealpath(pathname);
 	/* c8 ignore start */
 	const baseCwd = options?.cwd ? require_git_repo.getCachedRealpath(options["cwd"]) : require_git_repo.getCwd();
-	return require_primordials_array.ArrayPrototypeIncludes(files, /* @__PURE__ */ require_paths_normalize.normalizePath(path.relative(baseCwd, resolvedPathname)));
+	return require_primordials_array.ArrayPrototypeIncludes(files, require_paths_normalize.normalizePath(path.relative(baseCwd, resolvedPathname)));
 }
 /**
 * Check if a file or directory has unstaged changes.
@@ -170,11 +178,11 @@ function isUnstagedSync(pathname, options) {
 		...options,
 		absolute: false
 	});
-	const path = /* @__PURE__ */ require_node_path.getNodePath();
+	const path = require_node_path.getNodePath();
 	const resolvedPathname = require_git_repo.getCachedRealpath(pathname);
 	/* c8 ignore start */
 	const baseCwd = options?.cwd ? require_git_repo.getCachedRealpath(options["cwd"]) : require_git_repo.getCwd();
-	return require_primordials_array.ArrayPrototypeIncludes(files, /* @__PURE__ */ require_paths_normalize.normalizePath(path.relative(baseCwd, resolvedPathname)));
+	return require_primordials_array.ArrayPrototypeIncludes(files, require_paths_normalize.normalizePath(path.relative(baseCwd, resolvedPathname)));
 }
 
 //#endregion

package/dist/github/ghsa.js

@@ -8,7 +8,7 @@ const require_http_request_request = require('../http-request/request.js');
 const require_github_constants = require('./constants.js');
 const require_github_errors = require('./errors.js');
 const require_github_token = require('./token.js');
-const require_github_fetch = require('./fetch.js');
+const require_github_request = require('./request.js');
 const require_github_refs_cache = require('./refs-cache.js');
 let node_process = require("node:process");
 node_process = require_runtime.__toESM(node_process);
@@ -111,7 +111,7 @@ async function fetchGhsaDetails(ghsaId, options) {
 	/* c8 ignore start - External GitHub API call */
 	const url = `https://api.github.com/advisories/${ghsaId}`;
 	try {
-		const data = await require_github_fetch.fetchGitHub(url, options);
+		const data = await require_github_request.fetchGitHub(url, options);
 		return {
 			ghsaId: data.ghsa_id,
 			summary: data.summary,

package/dist/github/refs-cache.d.ts

@@ -1,6 +1,6 @@
 /**
  * @file TtlCache singleton for github/refs. Split out of `github/refs.ts` for
- *   size hygiene. Owns the lazy `_githubCache` slot, the accessor
+ *   size hygiene. Owns the lazy `githubCache` slot, the accessor
  *   (`getGithubCache`), and the in-memory-only clear (`clearRefCache`). Caching
  *   strategy:
  *

package/dist/github/refs-cache.js

@@ -7,7 +7,7 @@ const require_cache_ttl_store = require('../cache/ttl/store.js');
 //#region src/github/refs-cache.ts
 /**
 * @file TtlCache singleton for github/refs. Split out of `github/refs.ts` for
-*   size hygiene. Owns the lazy `_githubCache` slot, the accessor
+*   size hygiene. Owns the lazy `githubCache` slot, the accessor
 *   (`getGithubCache`), and the in-memory-only clear (`clearRefCache`). Caching
 *   strategy:
 *
@@ -16,7 +16,7 @@ const require_cache_ttl_store = require('../cache/ttl/store.js');
 *   - Default TTL: 5 minutes
 *   - Disable everything with the `DISABLE_GITHUB_CACHE` env var
 */
-let _githubCache;
+let githubCache;
 /**
 * Clear the ref resolution cache (in-memory only). Clears the in-memory
 * memoization cache without affecting the persistent disk cache. Useful for
@@ -37,7 +37,7 @@ let _githubCache;
 * @returns Promise that resolves when cache is cleared
 */
 async function clearRefCache() {
-	if (_githubCache) await _githubCache.clear({ memoOnly: true });
+	if (githubCache) await githubCache.clear({ memoOnly: true });
 }
 /**
 * Get or create the GitHub cache instance. Lazy initializes the cache with
@@ -47,12 +47,12 @@ async function clearRefCache() {
 * @returns The singleton cache instance
 */
 function getGithubCache() {
-	if (_githubCache === void 0) _githubCache = require_cache_ttl_store.createTtlCache({
+	if (githubCache === void 0) githubCache = require_cache_ttl_store.createTtlCache({
 		memoize: true,
 		prefix: "github-refs",
 		ttl: require_github_constants.DEFAULT_CACHE_TTL_MS
 	});
-	return _githubCache;
+	return githubCache;
 }
 
 //#endregion

package/dist/github/refs-graphql.js

@@ -48,6 +48,10 @@ const require_github_token = require('./token.js');
 *   error.
 */
 async function fetchRefShaViaGraphQL(owner, repo, ref, options) {
+	options = {
+		__proto__: null,
+		...options
+	};
 	const token = options.token || require_github_token.getGitHubToken();
 	const headers = {
 		Accept: "application/vnd.github.v3+json",

package/dist/github/refs-rest.js

@@ -5,7 +5,7 @@ const require_primordials_error = require('../primordials/error.js');
 const require_errors_message = require('../errors/message.js');
 const require_github_constants = require('./constants.js');
 const require_github_errors = require('./errors.js');
-const require_github_fetch = require('./fetch.js');
+const require_github_request = require('./request.js');
 const require_github_refs_graphql = require('./refs-graphql.js');
 
 //#region src/github/refs-rest.ts
@@ -31,6 +31,10 @@ const require_github_refs_graphql = require('./refs-graphql.js');
 * @throws {Error} When ref cannot be resolved after all strategies fail
 */
 async function fetchRefSha(owner, repo, ref, options) {
+	options = {
+		__proto__: null,
+		...options
+	};
 	const fetchOptions = { token: options.token };
 	let sawEmptyBody = false;
 	const note404 = (e) => {
@@ -38,17 +42,17 @@ async function fetchRefSha(owner, repo, ref, options) {
 		return e;
 	};
 	try {
-		const tagData = await require_github_fetch.fetchGitHub(`${require_github_constants.GITHUB_API_BASE_URL}/repos/${owner}/${repo}/git/refs/tags/${ref}`, fetchOptions);
-		if (tagData.object.type === "tag") return (await require_github_fetch.fetchGitHub(tagData.object.url, fetchOptions)).object.sha;
+		const tagData = await require_github_request.fetchGitHub(`${require_github_constants.GITHUB_API_BASE_URL}/repos/${owner}/${repo}/git/refs/tags/${ref}`, fetchOptions);
+		if (tagData.object.type === "tag") return (await require_github_request.fetchGitHub(tagData.object.url, fetchOptions)).object.sha;
 		return tagData.object.sha;
 	} catch (e) {
 		note404(e);
 		try {
-			return (await require_github_fetch.fetchGitHub(`${require_github_constants.GITHUB_API_BASE_URL}/repos/${owner}/${repo}/git/refs/heads/${ref}`, fetchOptions)).object.sha;
+			return (await require_github_request.fetchGitHub(`${require_github_constants.GITHUB_API_BASE_URL}/repos/${owner}/${repo}/git/refs/heads/${ref}`, fetchOptions)).object.sha;
 		} catch (e2) {
 			note404(e2);
 			try {
-				return (await require_github_fetch.fetchGitHub(`${require_github_constants.GITHUB_API_BASE_URL}/repos/${owner}/${repo}/commits/${ref}`, fetchOptions)).sha;
+				return (await require_github_request.fetchGitHub(`${require_github_constants.GITHUB_API_BASE_URL}/repos/${owner}/${repo}/commits/${ref}`, fetchOptions)).sha;
 			} catch (e3) {
 				note404(e3);
 				if (sawEmptyBody) {

package/dist/github/refs.js

@@ -1,12 +1,7 @@
 "use strict";
 /* Socket Lib - Built with rolldown */
 Object.defineProperty(exports, Symbol.toStringTag, { value: 'Module' });
-const require_runtime = require('../_virtual/_rolldown/runtime.js');
-const require_github_refs_graphql = require('./refs-graphql.js');
-const require_github_refs_rest = require('./refs-rest.js');
 const require_github_refs_cache = require('./refs-cache.js');
-let node_process = require("node:process");
-node_process = require_runtime.__toESM(node_process);
 
 //#region src/github/refs.ts
 /**
@@ -94,15 +89,25 @@ async function resolveRefToSha(owner, repo, ref, options) {
 		...options
 	};
 	const cacheKey = `${owner}/${repo}@${ref}`;
-	if (node_process.default.env["DISABLE_GITHUB_CACHE"]) return await require_github_refs_rest.fetchRefSha(owner, repo, ref, opts);
-	return await require_github_refs_cache.getGithubCache().getOrFetch(cacheKey, async () => {
-		return await require_github_refs_rest.fetchRefSha(owner, repo, ref, opts);
+	if (process.env["DISABLE_GITHUB_CACHE"]) return await fetchRefSha$1(owner, repo, ref, opts);
+	return await getGithubCache$1().getOrFetch(cacheKey, async () => {
+		return await fetchRefSha$1(owner, repo, ref, opts);
 	});
 }
 
 //#endregion
 exports.clearRefCache = require_github_refs_cache.clearRefCache;
-exports.fetchRefSha = require_github_refs_rest.fetchRefSha;
-exports.fetchRefShaViaGraphQL = require_github_refs_graphql.fetchRefShaViaGraphQL;
+Object.defineProperty(exports, 'fetchRefSha', {
+  enumerable: true,
+  get: function () {
+    return fetchRefSha;
+  }
+});
+Object.defineProperty(exports, 'fetchRefShaViaGraphQL', {
+  enumerable: true,
+  get: function () {
+    return fetchRefShaViaGraphQL;
+  }
+});
 exports.getGithubCache = require_github_refs_cache.getGithubCache;
 exports.resolveRefToSha = resolveRefToSha;

package/dist/github/{fetch.js → request.js}

@@ -6,10 +6,11 @@ const require_primordials_date = require('../primordials/date.js');
 const require_primordials_json = require('../primordials/json.js');
 const require_errors_message = require('../errors/message.js');
 const require_http_request_request = require('../http-request/request.js');
+const require_env_github_status = require('../env/github-status.js');
 const require_github_errors = require('./errors.js');
 const require_github_token = require('./token.js');
 
-//#region src/github/fetch.ts
+//#region src/github/request.ts
 /**
 * @file Authenticated GitHub REST fetch. `fetchGitHub` is the single entry
 *   point that the rest of the github/ modules go through for REST calls. It
@@ -87,7 +88,7 @@ async function fetchGitHub(url, options) {
 		__proto__: null,
 		...options
 	};
-	const token = opts.token || require_github_token.getGitHubToken();
+	const token = opts.token ?? require_github_token.getGitHubToken();
 	const headers = {
 		Accept: "application/vnd.github.v3+json",
 		"User-Agent": "socket-registry-github-client",
@@ -110,6 +111,16 @@ async function fetchGitHub(url, options) {
 				throw error;
 			}
 		}
+		if (response.status >= 500) {
+			/* c8 ignore start - External status probe, non-deterministic */
+			const ghStatus = await require_env_github_status.probeGitHubStatus(4e3).catch(() => void 0);
+			/* c8 ignore stop */
+			let statusNote = "";
+			if (ghStatus) if (ghStatus.status === "unknown") statusNote = " (githubstatus.com unreachable — could not confirm platform health)";
+			else if (ghStatus.degraded) statusNote = `\nGitHub platform status at time of failure:\n${ghStatus.components.map((c) => `  ${c.name}: ${c.status}`).join("\n")}`;
+			else statusNote = "\nGitHub platform status: all monitored components operational — this may be a transient issue or a request-specific error.";
+			throw new require_primordials_error.ErrorCtor(`GitHub API error ${response.status}: ${response.statusText}.${statusNote}`);
+		}
 		throw new require_primordials_error.ErrorCtor(`GitHub API error ${response.status}: ${response.statusText}`);
 	}
 	if (response.body.byteLength === 0) throw new require_github_errors.GitHubEmptyBodyError(url);

package/dist/github/token.js

@@ -34,7 +34,7 @@ const require_env_socket_cli = require('../env/socket-cli.js');
 * @returns The first available GitHub token, or `undefined` if none found
 */
 function getGitHubToken() {
-	return /* @__PURE__ */ require_env_github.getGithubToken() || /* @__PURE__ */ require_env_github.getGhToken() || /* @__PURE__ */ require_env_socket_cli.getSocketCliGithubToken() || void 0;
+	return require_env_github.getGithubToken() || require_env_github.getGhToken() || require_env_socket_cli.getSocketCliGithubToken() || void 0;
 }
 /**
 * Get GitHub authentication token from git config. Reads the `github.token`

package/dist/github/types.d.ts

@@ -114,7 +114,7 @@ export interface GitHubTag {
          * Tagger's name.
          */
         name: string;
-    };
+    } | undefined;
     /**
      * API URL for this tag object.
      */

package/dist/globs/_internal.js

@@ -1,10 +1,10 @@
 "use strict";
 /* Socket Lib - Built with rolldown */
 Object.defineProperty(exports, Symbol.toStringTag, { value: 'Module' });
+const require_primordials_map_set = require('../primordials/map-set.js');
 const require_primordials_string = require('../primordials/string.js');
 const require_paths_normalize = require('../paths/normalize.js');
 const require_primordials_array = require('../primordials/array.js');
-const require_primordials_map_set = require('../primordials/map-set.js');
 const require_node_fs = require('../node/fs.js');
 const require_globs_defaults = require('./defaults.js');
 const require_node_fs_promises = require('../node/fs-promises.js');
@@ -18,17 +18,15 @@ const require_node_fs_promises = require('../node/fs-promises.js');
 */
 const MATCHER_CACHE_MAX_SIZE = 100;
 const matcherCache = new require_primordials_map_set.MapCtor();
-let _fastGlob;
-let _picomatch;
-/*@__NO_SIDE_EFFECTS__*/
+let cachedFastGlob;
+let cachedPicomatch;
 function getFastGlob() {
-	if (_fastGlob === void 0) _fastGlob = /*@__PURE__*/ require("../external/fast-glob.js");
-	return _fastGlob;
+	if (cachedFastGlob === void 0) cachedFastGlob = /*@__PURE__*/ require("../external/fast-glob.js");
+	return cachedFastGlob;
 }
-/*@__NO_SIDE_EFFECTS__*/
 function getPicomatch() {
-	if (_picomatch === void 0) _picomatch = /*@__PURE__*/ require("../external/picomatch.js");
-	return _picomatch;
+	if (cachedPicomatch === void 0) cachedPicomatch = /*@__PURE__*/ require("../external/picomatch.js");
+	return cachedPicomatch;
 }
 /**
 * Glob results are normalized to forward slashes regardless of the backend
@@ -38,7 +36,7 @@ function getPicomatch() {
 * this stays consistent with every other path-shaped string in the lib.
 */
 function normalizeGlobResults(out) {
-	for (let i = 0; i < out.length; i += 1) out[i] = /* @__PURE__ */ require_paths_normalize.normalizePath(out[i]);
+	for (let i = 0; i < out.length; i += 1) out[i] = require_paths_normalize.normalizePath(out[i]);
 	return out;
 }
 /**

package/dist/globs/match.js

@@ -1,8 +1,8 @@
 "use strict";
 /* Socket Lib - Built with rolldown */
 Object.defineProperty(exports, Symbol.toStringTag, { value: 'Module' });
-const require_node_fs = require('../node/fs.js');
 const require_primordials_object = require('../primordials/object.js');
+const require_node_fs = require('../node/fs.js');
 const require_node_fs_promises = require('../node/fs-promises.js');
 const require_globs__internal = require('./_internal.js');
 const require_promises_resolvers = require('../promises/resolvers.js');
@@ -58,15 +58,18 @@ function canUseNodeFsGlob(options) {
 *   console.log(files) // ['src/index.ts', 'src/utils.ts']
 *   ```
 */
-/*@__NO_SIDE_EFFECTS__*/
 async function glob(patterns, options) {
+	options = {
+		__proto__: null,
+		...options
+	};
 	const normalizedIgnore = require_globs__internal.normalizeIgnorePatterns(options?.ignore);
 	/* c8 ignore start */
-	if (canUseNodeFsGlob(options)) return require_globs__internal.normalizeGlobResults(await require_promises_resolvers.fromAsync((/* @__PURE__ */ require_node_fs_promises.getNodeFsPromises()).glob(patterns, {
+	if (canUseNodeFsGlob(options)) return require_globs__internal.normalizeGlobResults(await require_promises_resolvers.fromAsync(require_node_fs_promises.getNodeFsPromises().glob(patterns, {
 		...options?.cwd ? { cwd: options.cwd } : {},
 		...normalizedIgnore ? { exclude: normalizedIgnore } : {}
 	})));
-	return require_globs__internal.normalizeGlobResults(await (/* @__PURE__ */ require_globs__internal.getFastGlob()).glob(patterns, {
+	return require_globs__internal.normalizeGlobResults(await require_globs__internal.getFastGlob().glob(patterns, {
 		...options,
 		...normalizedIgnore ? { ignore: normalizedIgnore } : {}
 	}));
@@ -81,15 +84,18 @@ async function glob(patterns, options) {
 *   console.log(files) // ['package.json', 'tsconfig.json']
 *   ```
 */
-/*@__NO_SIDE_EFFECTS__*/
 function globSync(patterns, options) {
+	options = {
+		__proto__: null,
+		...options
+	};
 	const normalizedIgnore = require_globs__internal.normalizeIgnorePatterns(options?.ignore);
 	/* c8 ignore start */
-	if (canUseNodeFsGlob(options)) return require_globs__internal.normalizeGlobResults([...(/* @__PURE__ */ require_node_fs.getNodeFs()).globSync(patterns, {
+	if (canUseNodeFsGlob(options)) return require_globs__internal.normalizeGlobResults([...require_node_fs.getNodeFs().globSync(patterns, {
 		...options?.cwd ? { cwd: options.cwd } : {},
 		...normalizedIgnore ? { exclude: normalizedIgnore } : {}
 	})]);
-	return require_globs__internal.normalizeGlobResults((/* @__PURE__ */ require_globs__internal.getFastGlob()).globSync(patterns, {
+	return require_globs__internal.normalizeGlobResults(require_globs__internal.getFastGlob().globSync(patterns, {
 		...options,
 		...normalizedIgnore ? { ignore: normalizedIgnore } : {}
 	}));

package/dist/globs/matcher.d.ts

@@ -30,9 +30,9 @@ import type { Pattern } from './types';
  *   ```
  */
 export declare function getGlobMatcher(glob: Pattern | Pattern[], options?: {
-    dot?: boolean;
-    nocase?: boolean;
-    ignore?: string[];
+    dot?: boolean | undefined;
+    nocase?: boolean | undefined;
+    ignore?: string[] | undefined;
 }): (path: string) => boolean;
 /**
  * Resolve `path.matchesGlob` (or `undefined` if the runtime predates it).

package/dist/globs/matcher.js

@@ -1,9 +1,9 @@
 "use strict";
 /* Socket Lib - Built with rolldown */
 Object.defineProperty(exports, Symbol.toStringTag, { value: 'Module' });
+const require_primordials_object = require('../primordials/object.js');
 const require_primordials_string = require('../primordials/string.js');
 const require_primordials_array = require('../primordials/array.js');
-const require_primordials_object = require('../primordials/object.js');
 const require_primordials_json = require('../primordials/json.js');
 const require_globs__internal = require('./_internal.js');
 
@@ -14,8 +14,8 @@ const require_globs__internal = require('./_internal.js');
 *   `path.matchesGlob` for the rare case where the caller wants strict
 *   (`nocase: false`, `dot: false`) matching.
 */
-let _matchesGlob;
-let _matchesGlobProbed = false;
+let matchesGlobCache;
+let matchesGlobProbed = false;
 /**
 * Return a glob-matcher function, memoized by pattern + options.
 *
@@ -40,13 +40,16 @@ let _matchesGlobProbed = false;
 *   const isSource = getGlobMatcher(['src/**', '!**\/*.test.ts'])
 *   ```
 */
-/*@__NO_SIDE_EFFECTS__*/
 function getGlobMatcher(glob, options) {
+	options = {
+		__proto__: null,
+		...options
+	};
 	const patterns = require_primordials_array.ArrayIsArray(glob) ? glob : [glob];
-	const sortedPatterns = [...patterns].sort();
-	const sortedOptions = options ? require_primordials_object.ObjectKeys(options).sort().map((k) => {
+	const sortedPatterns = [...patterns].toSorted();
+	const sortedOptions = options ? require_primordials_object.ObjectKeys(options).toSorted().map((k) => {
 		const value = options[k];
-		return `${k}:${require_primordials_json.JSONStringify(require_primordials_array.ArrayIsArray(value) ? [...value].sort() : value)}`;
+		return `${k}:${require_primordials_json.JSONStringify(require_primordials_array.ArrayIsArray(value) ? [...value].toSorted() : value)}`;
 	}).join(",") : "";
 	const key = `${sortedPatterns.join("|")}:${sortedOptions}`;
 	const existing = require_globs__internal.matcherCache.get(key);
@@ -64,7 +67,7 @@ function getGlobMatcher(glob, options) {
 	let matcher;
 	/* c8 ignore start */
 	if (patterns.length === 1 && !require_primordials_string.StringPrototypeStartsWith(patterns[0], "!") && options !== void 0 && options.nocase === false && options.dot === false && (options.ignore === void 0 || options.ignore.length === 0)) {
-		const matchesGlob = /* @__PURE__ */ getMatchesGlob();
+		const matchesGlob = getMatchesGlob();
 		if (matchesGlob !== void 0) {
 			const pattern = patterns[0];
 			matcher = (p) => matchesGlob(p, pattern);
@@ -80,7 +83,7 @@ function getGlobMatcher(glob, options) {
 			...options,
 			...negativePatterns.length > 0 ? { ignore: negativePatterns } : {}
 		};
-		matcher = (/* @__PURE__ */ require_globs__internal.getPicomatch())(positivePatterns.length > 0 ? positivePatterns : patterns, matchOptions);
+		matcher = require_globs__internal.getPicomatch()(positivePatterns.length > 0 ? positivePatterns : patterns, matchOptions);
 	}
 	require_globs__internal.matcherCache.set(key, matcher);
 	return matcher;
@@ -94,16 +97,15 @@ function getGlobMatcher(glob, options) {
 *
 * @internal
 */
-/*@__NO_SIDE_EFFECTS__*/
 function getMatchesGlob() {
-	if (!_matchesGlobProbed) {
+	if (!matchesGlobProbed) {
 		const fn = (/* @__PURE__ */ require("node:path")).matchesGlob;
 		/* c8 ignore start */
-		if (typeof fn === "function") _matchesGlob = fn;
+		if (typeof fn === "function") matchesGlobCache = fn;
 		/* c8 ignore stop */
-		_matchesGlobProbed = true;
+		matchesGlobProbed = true;
 	}
-	return _matchesGlob;
+	return matchesGlobCache;
 }
 
 //#endregion

package/dist/globs/stream.js

@@ -23,7 +23,6 @@ const require_paths_globs = require('../paths/globs.js');
 *   }
 *   ```
 */
-/*@__NO_SIDE_EFFECTS__*/
 function globStreamLicenses(dirname, options) {
 	const { ignore: ignoreOpt, ignoreOriginals, recursive, ...globOptions } = {
 		__proto__: null,
@@ -31,7 +30,7 @@ function globStreamLicenses(dirname, options) {
 	};
 	const ignore = [...require_primordials_array.ArrayIsArray(ignoreOpt) ? require_globs__internal.normalizeIgnorePatterns(ignoreOpt) : require_globs_defaults.defaultIgnore, "**/*.{cjs,cts,js,json,mjs,mts,ts}"];
 	if (ignoreOriginals) ignore.push(require_paths_globs.LICENSE_ORIGINAL_GLOB_RECURSIVE);
-	return (/* @__PURE__ */ require_globs__internal.getFastGlob()).globStream([recursive ? require_paths_globs.LICENSE_GLOB_RECURSIVE : require_paths_globs.LICENSE_GLOB], {
+	return require_globs__internal.getFastGlob().globStream([recursive ? require_paths_globs.LICENSE_GLOB_RECURSIVE : require_paths_globs.LICENSE_GLOB], {
 		__proto__: null,
 		absolute: true,
 		caseSensitiveMatch: false,