@socketsecurity/lib 6.0.6 → 6.0.8

package/dist/temporal/system.js

@@ -18,10 +18,10 @@ const require_primordials_globals = require('../primordials/globals.js');
 *   polyfill makes for browser hosts. Spec:
 *   https://tc39.es/proposal-temporal/#sec-temporal-systemutcepochnanoseconds.
 */
-const _hrtimeBigint = globalThis.process?.hrtime?.bigint;
-const _anchorWallMs = require_primordials_globals.BigIntCtor(require_primordials_date.DateNow());
-const _anchorHrns = _hrtimeBigint ? _hrtimeBigint() : 0n;
-const _NS_PER_MS = 1000000n;
+const hrtimeBigint = globalThis.process?.hrtime?.bigint;
+const anchorWallMs = require_primordials_globals.BigIntCtor(require_primordials_date.DateNow());
+const anchorHrns = hrtimeBigint ? hrtimeBigint() : 0n;
+const NS_PER_MS = 1000000n;
 /**
 * Returns the current UTC time as nanoseconds since 1970-01-01T00:00:00Z.
 *
@@ -29,13 +29,13 @@ const _NS_PER_MS = 1000000n;
 * module load), millisecond elsewhere.
 */
 function systemUTCEpochNanoseconds() {
-	if (_hrtimeBigint) {
-		const elapsedNs = _hrtimeBigint() - _anchorHrns;
-		return _anchorWallMs * _NS_PER_MS + elapsedNs;
+	if (hrtimeBigint) {
+		const elapsedNs = hrtimeBigint() - anchorHrns;
+		return anchorWallMs * NS_PER_MS + elapsedNs;
 	}
 	/* c8 ignore next - Non-Node runtime fallback; tests always run under Node
-	where _hrtimeBigint is bound from process.hrtime.bigint. */
-	return require_primordials_globals.BigIntCtor(require_primordials_date.DateNow()) * _NS_PER_MS;
+	where hrtimeBigint is bound from process.hrtime.bigint. */
+	return require_primordials_globals.BigIntCtor(require_primordials_date.DateNow()) * NS_PER_MS;
 }
 
 //#endregion

package/dist/themes/context.d.ts

@@ -3,7 +3,8 @@
  *   context isolation via AsyncLocalStorage.
  */
 import type { Theme } from './types';
-import { type ThemeName } from './themes';
+import type { ThemeName } from './themes';
+import type * as AsyncHooks from 'node:async_hooks';
 /**
  * Theme change event listener signature.
  */
@@ -19,7 +20,7 @@ export declare function emitThemeChange(theme: Theme): void;
  *
  * @private
  */
-export declare function getAsyncHooks(): typeof import('node:async_hooks');
+export declare function getAsyncHooks(): typeof AsyncHooks;
 /**
  * Get the active theme from context.
  *

package/dist/themes/context.js

@@ -5,7 +5,7 @@ const require_primordials_map_set = require('../primordials/map-set.js');
 const require_themes_themes = require('./themes.js');
 
 //#region src/themes/context.ts
-let _async_hooks;
+let asyncHooks;
 /**
 * Emit theme change event to listeners.
 *
@@ -19,15 +19,14 @@ function emitThemeChange(theme) {
 *
 * @private
 */
-/*@__NO_SIDE_EFFECTS__*/
 function getAsyncHooks() {
-	if (_async_hooks === void 0) _async_hooks = /*@__PURE__*/ require("node:async_hooks");
-	return _async_hooks;
+	if (asyncHooks === void 0) asyncHooks = /*@__PURE__*/ require("node:async_hooks");
+	return asyncHooks;
 }
 /**
 * AsyncLocalStorage for theme context isolation.
 */
-const { AsyncLocalStorage } = /* @__PURE__ */ getAsyncHooks();
+const { AsyncLocalStorage } = getAsyncHooks();
 const themeStorage = new AsyncLocalStorage();
 /**
 * Fallback theme for global context.

package/dist/themes/themes.js

@@ -8,8 +8,6 @@ Object.defineProperty(exports, Symbol.toStringTag, { value: 'Module' });
 * designed for focus and elegance.
 */
 const SOCKET_THEME = {
-	name: "socket",
-	displayName: "Socket Security",
 	colors: {
 		primary: [
 			140,
@@ -26,6 +24,7 @@ const SOCKET_THEME = {
 		link: "cyanBright",
 		prompt: "primary"
 	},
+	displayName: "Socket Security",
 	effects: {
 		spinner: {
 			color: "primary",
@@ -41,15 +40,14 @@ const SOCKET_THEME = {
 	meta: {
 		description: "Signature theme with refined violet and subtle shimmer",
 		version: "1.0.0"
-	}
+	},
+	name: "socket"
 };
 /**
 * Sunset — Vibrant twilight gradient. Warm sunset palette with orange and
 * purple/pink tones.
 */
 const SUNSET_THEME = {
-	name: "sunset",
-	displayName: "Sunset",
 	colors: {
 		primary: [
 			255,
@@ -71,6 +69,7 @@ const SUNSET_THEME = {
 		link: "primary",
 		prompt: "primary"
 	},
+	displayName: "Sunset",
 	effects: {
 		spinner: {
 			color: "primary",
@@ -94,15 +93,14 @@ const SUNSET_THEME = {
 	meta: {
 		description: "Warm sunset theme with purple-to-orange gradient",
 		version: "2.0.0"
-	}
+	},
+	name: "sunset"
 };
 /**
 * Terracotta — Solid warmth. Rich terracotta and ember tones for grounded
 * confidence.
 */
 const TERRACOTTA_THEME = {
-	name: "terracotta",
-	displayName: "Terracotta",
 	colors: {
 		primary: [
 			255,
@@ -124,6 +122,7 @@ const TERRACOTTA_THEME = {
 		link: "secondary",
 		prompt: "primary"
 	},
+	displayName: "Terracotta",
 	effects: {
 		spinner: {
 			color: "primary",
@@ -139,14 +138,13 @@ const TERRACOTTA_THEME = {
 	meta: {
 		description: "Solid theme with rich terracotta and ember warmth",
 		version: "1.0.0"
-	}
+	},
+	name: "terracotta"
 };
 /**
 * Lush — Steel elegance. Python-inspired steel blue with golden accents.
 */
 const LUSH_THEME = {
-	name: "lush",
-	displayName: "Lush",
 	colors: {
 		primary: [
 			70,
@@ -168,6 +166,7 @@ const LUSH_THEME = {
 		link: "cyanBright",
 		prompt: "primary"
 	},
+	displayName: "Lush",
 	effects: { spinner: {
 		color: "primary",
 		style: "dots"
@@ -175,15 +174,14 @@ const LUSH_THEME = {
 	meta: {
 		description: "Elegant theme with steel blue and golden harmony",
 		version: "1.0.0"
-	}
+	},
+	name: "lush"
 };
 /**
 * Ultra — Premium intensity. Prismatic shimmer for deep analysis, where
 * complexity meets elegance.
 */
 const ULTRA_THEME = {
-	name: "ultra",
-	displayName: "Ultra",
 	colors: {
 		primary: [
 			140,
@@ -200,6 +198,7 @@ const ULTRA_THEME = {
 		link: "cyanBright",
 		prompt: "primary"
 	},
+	displayName: "Ultra",
 	effects: {
 		spinner: {
 			color: "inherit",
@@ -215,7 +214,8 @@ const ULTRA_THEME = {
 	meta: {
 		description: "Premium theme with prismatic shimmer for deep analysis",
 		version: "1.0.0"
-	}
+	},
+	name: "ultra"
 };
 /**
 * Theme registry — Curated palette collection.

package/dist/themes/types.d.ts

@@ -75,7 +75,7 @@ export type ThemeEffects = {
          * Animation style.
          */
         style?: SpinnerStyle | string | undefined;
-    };
+    } | undefined;
     /**
      * Shimmer configuration.
      */
@@ -96,7 +96,7 @@ export type ThemeEffects = {
          * Speed (steps per frame)
          */
         speed?: number | undefined;
-    };
+    } | undefined;
     /**
      * Pulse configuration.
      */
@@ -105,7 +105,7 @@ export type ThemeEffects = {
          * Speed (milliseconds)
          */
         speed?: number | undefined;
-    };
+    } | undefined;
 };
 /**
  * Theme metadata — descriptive information.

package/dist/url/assert-safe.d.ts

@@ -0,0 +1,29 @@
+/**
+ * @file SSRF guard for operator- or issuer-supplied URLs — `assertSafeHttpUrl`
+ *   parses a raw URL, rejects non-HTTP(S) schemes, and refuses hosts that
+ *   resolve to loopback / private / link-local ranges (cloud metadata, redis,
+ *   internal services). A server that fetches a URL it did not author (an OAuth
+ *   issuer, an introspection endpoint advertised in its metadata, a webhook
+ *   target) runs the candidate through this before the request leaves the box.
+ */
+import type { AssertSafeHttpUrlOptions } from './types';
+/**
+ * Parse `rawUrl` and assert it is safe to fetch server-side, returning the
+ * parsed `URL`. Throws when the value does not parse, uses a scheme other than
+ * `http:` / `https:`, or resolves to a loopback / private / link-local host.
+ * Set `allowLocalhost` to permit `localhost` / `127.0.0.1` / `::1` for
+ * local-stack development. `label` names the subject in the thrown message.
+ *
+ * @example
+ *   ;```typescript
+ *   assertSafeHttpUrl('https://api.example.com', { label: 'OAuth issuer' })
+ *   // → URL { href: 'https://api.example.com/' }
+ *
+ *   assertSafeHttpUrl('http://169.254.169.254/latest/meta-data')
+ *   // → throws: resolves to a private/loopback host
+ *
+ *   assertSafeHttpUrl('ftp://example.com')
+ *   // → throws: must use http(s)
+ *   ```
+ */
+export declare function assertSafeHttpUrl(rawUrl: string, options?: AssertSafeHttpUrlOptions | undefined): URL;

package/dist/url/assert-safe.js

@@ -0,0 +1,54 @@
+"use strict";
+/* Socket Lib - Built with rolldown */
+Object.defineProperty(exports, Symbol.toStringTag, { value: 'Module' });
+const require_url_predicates = require('./predicates.js');
+
+//#region src/url/assert-safe.ts
+/**
+* @file SSRF guard for operator- or issuer-supplied URLs — `assertSafeHttpUrl`
+*   parses a raw URL, rejects non-HTTP(S) schemes, and refuses hosts that
+*   resolve to loopback / private / link-local ranges (cloud metadata, redis,
+*   internal services). A server that fetches a URL it did not author (an OAuth
+*   issuer, an introspection endpoint advertised in its metadata, a webhook
+*   target) runs the candidate through this before the request leaves the box.
+*/
+const UrlCtor = URL;
+/**
+* Parse `rawUrl` and assert it is safe to fetch server-side, returning the
+* parsed `URL`. Throws when the value does not parse, uses a scheme other than
+* `http:` / `https:`, or resolves to a loopback / private / link-local host.
+* Set `allowLocalhost` to permit `localhost` / `127.0.0.1` / `::1` for
+* local-stack development. `label` names the subject in the thrown message.
+*
+* @example
+*   ;```typescript
+*   assertSafeHttpUrl('https://api.example.com', { label: 'OAuth issuer' })
+*   // → URL { href: 'https://api.example.com/' }
+*
+*   assertSafeHttpUrl('http://169.254.169.254/latest/meta-data')
+*   // → throws: resolves to a private/loopback host
+*
+*   assertSafeHttpUrl('ftp://example.com')
+*   // → throws: must use http(s)
+*   ```
+*/
+function assertSafeHttpUrl(rawUrl, options) {
+	const { allowLocalhost = false, label = "URL" } = {
+		__proto__: null,
+		...options
+	};
+	let url;
+	try {
+		url = new UrlCtor(rawUrl);
+	} catch {
+		throw new Error(`${label} is not a valid URL: ${rawUrl}. Provide an absolute http(s) URL.`);
+	}
+	if (url.protocol !== "http:" && url.protocol !== "https:") throw new Error(`${label} must use http(s): ${rawUrl}. Got scheme "${url.protocol}"; use http: or https:.`);
+	const { hostname } = url;
+	if (allowLocalhost && require_url_predicates.isLoopbackHost(hostname)) return url;
+	if (require_url_predicates.isPrivateHost(hostname)) throw new Error(`${label} resolves to a private/loopback host and is refused: ${rawUrl}. Point it at a public host.`);
+	return url;
+}
+
+//#endregion
+exports.assertSafeHttpUrl = assertSafeHttpUrl;

package/dist/url/parse.js

@@ -19,7 +19,6 @@ const UrlCtor = URL;
 *   createRelativeUrl('/api/test', { base: 'https://example.com' }) // 'https://example.com/api/test'
 *   ```
 */
-/*@__NO_SIDE_EFFECTS__*/
 function createRelativeUrl(path, options) {
 	const { base = "" } = {
 		__proto__: null,
@@ -42,7 +41,6 @@ function createRelativeUrl(path, options) {
 *   parseUrl('invalid') // undefined
 *   ```
 */
-/*@__NO_SIDE_EFFECTS__*/
 function parseUrl(value) {
 	try {
 		return new UrlCtor(value);

package/dist/url/predicates.d.ts

@@ -1,7 +1,37 @@
 /**
  * @file URL type-guard predicates — `isUrl` answers whether a value parses as a
- *   valid URL via `parseUrl`.
+ *   valid URL via `parseUrl`. `isLoopbackHost` / `isPrivateHost` classify a
+ *   hostname for SSRF guards: a server that fetches an operator- or
+ *   issuer-supplied URL uses these to refuse hosts that resolve to the local
+ *   machine or an internal network (cloud metadata, redis, link-local).
  */
+/**
+ * Check whether a hostname is a loopback address — `localhost`, `127.0.0.1`, or
+ * IPv6 `::1`. Compares case-insensitively; pass a bare hostname, not a URL.
+ *
+ * @example
+ *   ;```typescript
+ *   isLoopbackHost('localhost') // true
+ *   isLoopbackHost('127.0.0.1') // true
+ *   isLoopbackHost('example.com') // false
+ *   ```
+ */
+export declare function isLoopbackHost(hostname: string): boolean;
+/**
+ * Check whether a hostname resolves to a private / loopback / link-local
+ * address an SSRF probe would target (the local machine, RFC 1918 ranges, IPv6
+ * loopback / ULA / link-local). Loopback hosts count as private. Compares
+ * case-insensitively; pass a bare hostname, not a URL.
+ *
+ * @example
+ *   ;```typescript
+ *   isPrivateHost('127.0.0.1') // true
+ *   isPrivateHost('10.0.0.5') // true
+ *   isPrivateHost('169.254.169.254') // true
+ *   isPrivateHost('example.com') // false
+ *   ```
+ */
+export declare function isPrivateHost(hostname: string): boolean;
 /**
  * Check if a value is a valid URL.
  *

package/dist/url/predicates.js

@@ -1,13 +1,52 @@
 "use strict";
 /* Socket Lib - Built with rolldown */
 Object.defineProperty(exports, Symbol.toStringTag, { value: 'Module' });
+const require_primordials_string = require('../primordials/string.js');
+const require_primordials_regexp = require('../primordials/regexp.js');
 const require_url_parse = require('./parse.js');
 
 //#region src/url/predicates.ts
 /**
 * @file URL type-guard predicates — `isUrl` answers whether a value parses as a
-*   valid URL via `parseUrl`.
+*   valid URL via `parseUrl`. `isLoopbackHost` / `isPrivateHost` classify a
+*   hostname for SSRF guards: a server that fetches an operator- or
+*   issuer-supplied URL uses these to refuse hosts that resolve to the local
+*   machine or an internal network (cloud metadata, redis, link-local).
 */
+const PRIVATE_HOST_REGEXP = /^(?:0\.0\.0\.0$|10\.|127\.|169\.254\.|172\.(?:1[6-9]|2\d|3[01])\.|192\.168\.|\[?::1\]?$|\[?fc00:|\[?fd|\[?fe80:)/u;
+/**
+* Check whether a hostname is a loopback address — `localhost`, `127.0.0.1`, or
+* IPv6 `::1`. Compares case-insensitively; pass a bare hostname, not a URL.
+*
+* @example
+*   ;```typescript
+*   isLoopbackHost('localhost') // true
+*   isLoopbackHost('127.0.0.1') // true
+*   isLoopbackHost('example.com') // false
+*   ```
+*/
+function isLoopbackHost(hostname) {
+	const host = require_primordials_string.StringPrototypeToLowerCase(hostname);
+	return host === "::1" || host === "127.0.0.1" || host === "localhost";
+}
+/**
+* Check whether a hostname resolves to a private / loopback / link-local
+* address an SSRF probe would target (the local machine, RFC 1918 ranges, IPv6
+* loopback / ULA / link-local). Loopback hosts count as private. Compares
+* case-insensitively; pass a bare hostname, not a URL.
+*
+* @example
+*   ;```typescript
+*   isPrivateHost('127.0.0.1') // true
+*   isPrivateHost('10.0.0.5') // true
+*   isPrivateHost('169.254.169.254') // true
+*   isPrivateHost('example.com') // false
+*   ```
+*/
+function isPrivateHost(hostname) {
+	const host = require_primordials_string.StringPrototypeToLowerCase(hostname);
+	return isLoopbackHost(host) || require_primordials_regexp.RegExpPrototypeTest(PRIVATE_HOST_REGEXP, host);
+}
 /**
 * Check if a value is a valid URL.
 *
@@ -18,10 +57,11 @@ const require_url_parse = require('./parse.js');
 *   isUrl(null) // false
 *   ```
 */
-/*@__NO_SIDE_EFFECTS__*/
 function isUrl(value) {
-	return (typeof value === "string" && value !== "" || value !== null && typeof value === "object") && !!/* @__PURE__ */ require_url_parse.parseUrl(value);
+	return (typeof value === "string" && value !== "" || value !== null && typeof value === "object") && !!require_url_parse.parseUrl(value);
 }
 
 //#endregion
+exports.isLoopbackHost = isLoopbackHost;
+exports.isPrivateHost = isPrivateHost;
 exports.isUrl = isUrl;

package/dist/url/search-params.js

@@ -20,7 +20,6 @@ const BooleanCtor = Boolean;
 *   urlSearchParamsAsArray(null) // []
 *   ```
 */
-/*@__NO_SIDE_EFFECTS__*/
 function urlSearchParamsAsArray(value) {
 	return typeof value === "string" ? value.trim().split(/, */).map((v) => v.trim()).filter(BooleanCtor) : [];
 }
@@ -34,7 +33,6 @@ function urlSearchParamsAsArray(value) {
 *   urlSearchParamsAsBoolean(null) // false
 *   ```
 */
-/*@__NO_SIDE_EFFECTS__*/
 function urlSearchParamsAsBoolean(value, options) {
 	const { defaultValue = false } = {
 		__proto__: null,
@@ -44,7 +42,7 @@ function urlSearchParamsAsBoolean(value, options) {
 		const trimmed = value.trim();
 		if (trimmed === "") return !!defaultValue;
 		const lowered = trimmed.toLowerCase();
-		return lowered === "1" || lowered === "true" || lowered === "yes" || lowered === "on";
+		return lowered === "1" || lowered === "on" || lowered === "true" || lowered === "yes";
 	}
 	if (value === null || value === void 0) return !!defaultValue;
 	return !!value;
@@ -59,7 +57,6 @@ function urlSearchParamsAsBoolean(value, options) {
 *   urlSearchParamsAsNumber(params, 'other') // 0
 *   ```
 */
-/*@__NO_SIDE_EFFECTS__*/
 function urlSearchParamsAsNumber(params, key, options) {
 	const { defaultValue = 0 } = {
 		__proto__: null,
@@ -84,7 +81,6 @@ function urlSearchParamsAsNumber(params, key, options) {
 *   urlSearchParamsAsString(params, 'other') // ''
 *   ```
 */
-/*@__NO_SIDE_EFFECTS__*/
 function urlSearchParamsAsString(params, key, options) {
 	const { defaultValue = "" } = {
 		__proto__: null,
@@ -105,12 +101,11 @@ function urlSearchParamsAsString(params, key, options) {
 *   urlSearchParamsGetArray(params, 'tags') // ['a', 'b', 'c']
 *   ```
 */
-/*@__NO_SIDE_EFFECTS__*/
 function urlSearchParamsGetArray(params, key) {
 	if (params && typeof params.getAll === "function") {
 		const values = params.getAll(key);
 		const firstValue = values[0];
-		if (values.length === 1 && firstValue && firstValue.includes(",")) return /* @__PURE__ */ urlSearchParamsAsArray(firstValue);
+		if (values.length === 1 && firstValue && firstValue.includes(",")) return urlSearchParamsAsArray(firstValue);
 		return values;
 	}
 	return [];
@@ -125,7 +120,6 @@ function urlSearchParamsGetArray(params, key) {
 *   urlSearchParamsGetBoolean(params, 'other') // false
 *   ```
 */
-/*@__NO_SIDE_EFFECTS__*/
 function urlSearchParamsGetBoolean(params, key, options) {
 	const { defaultValue = false } = {
 		__proto__: null,
@@ -133,7 +127,7 @@ function urlSearchParamsGetBoolean(params, key, options) {
 	};
 	if (params && typeof params.get === "function") {
 		const value = params.get(key);
-		return value !== null ? /* @__PURE__ */ urlSearchParamsAsBoolean(value, { defaultValue }) : defaultValue;
+		return value !== null ? urlSearchParamsAsBoolean(value, { defaultValue }) : defaultValue;
 	}
 	return defaultValue;
 }

package/dist/url/types.d.ts

@@ -3,18 +3,22 @@
  *   `createRelativeUrl`, `urlSearchParamsAs*`, and `urlSearchParamsGet*`. Pure
  *   types, no runtime side effects.
  */
+export interface AssertSafeHttpUrlOptions {
+    label?: string | undefined;
+    allowLocalhost?: boolean | undefined;
+}
 export interface CreateRelativeUrlOptions {
-    base?: string;
+    base?: string | undefined;
 }
 export interface UrlSearchParamsAsBooleanOptions {
-    defaultValue?: boolean;
+    defaultValue?: boolean | undefined;
 }
 export interface UrlSearchParamsAsNumberOptions {
-    defaultValue?: number;
+    defaultValue?: number | undefined;
 }
 export interface UrlSearchParamsAsStringOptions {
-    defaultValue?: string;
+    defaultValue?: string | undefined;
 }
 export interface UrlSearchParamsGetBooleanOptions {
-    defaultValue?: boolean;
+    defaultValue?: boolean | undefined;
 }

package/dist/versions/_internal.js

@@ -15,20 +15,20 @@ const require_smol_versions = require('../smol/versions.js');
 *   shape (`{major, minor, patch}`) which only `semver.parse` exposes — those
 *   leaves use `getSemver()` directly instead of going through `impl`.
 */
-const _semver = require("../external/semver");
+const semver = require("../external/semver");
 /**
 * The vendored `semver` JS implementation. Always available — used directly by
 * the leaves that need the parsed `{major, minor, patch}` shape (which
 * smol-versions doesn't expose).
 */
 function getSemver() {
-	return _semver;
+	return semver;
 }
 /**
 * Resolved version implementation: smol-versions on the smol Node binary,
 * otherwise the vendored `semver`. Bound once at module load.
 */
-const impl = /* @__PURE__ */ require_smol_versions.getSmolVersions() ?? _semver;
+const impl = require_smol_versions.getSmolVersions() ?? semver;
 
 //#endregion
 exports.getSemver = getSemver;

package/dist/words/article.js

@@ -16,7 +16,6 @@ Object.defineProperty(exports, Symbol.toStringTag, { value: 'Module' });
 *   determineArticle('banana') // 'a'
 *   ```
 */
-/*@__NO_SIDE_EFFECTS__*/
 function determineArticle(word) {
 	return /^[aeiou]/i.test(word) ? "an" : "a";
 }

package/dist/words/capitalize.js

@@ -17,7 +17,6 @@ Object.defineProperty(exports, Symbol.toStringTag, { value: 'Module' });
 *   capitalize('') // ''
 *   ```
 */
-/*@__NO_SIDE_EFFECTS__*/
 function capitalize(word) {
 	if (word.length === 0) return word;
 	const [first, ...rest] = [...word];

package/dist/words/pluralize.js

@@ -1,22 +1,33 @@
 "use strict";
 /* Socket Lib - Built with rolldown */
 Object.defineProperty(exports, Symbol.toStringTag, { value: 'Module' });
+const require_primordials_intl = require('../primordials/intl.js');
 
 //#region src/words/pluralize.ts
+/**
+* @file Count-based pluralization. Two modes:
+*
+*   - Default: appends a trailing `'s'` when the count is anything other than 1.
+*     Zero-cost; no Intl dependency on the hot path.
+*   - Dictionary: when `options.forms` is given, selects from a caller-supplied
+*     dictionary of forms keyed by plural category. Honors locale + cardinal /
+*     ordinal via `Intl.PluralRules`. Required `plural` acts as the fallback
+*     for any category not explicitly listed.
+*/
 const CLDR_TO_FIELD = {
+	few: "few",
+	many: "many",
 	one: "singular",
 	other: "plural",
-	zero: "zero",
 	two: "two",
-	few: "few",
-	many: "many"
+	zero: "zero"
 };
 const RULES_CACHE = /* @__PURE__ */ new Map();
 function getRules(locale, type) {
 	const key = `${locale}:${type}`;
 	let r = RULES_CACHE.get(key);
 	if (!r) {
-		r = new Intl.PluralRules(locale, { type });
+		r = new require_primordials_intl.IntlPluralRules(locale, { type });
 		RULES_CACHE.set(key, r);
 	}
 	return r;
@@ -46,7 +57,6 @@ function getRules(locale, type) {
 *   }) // 'nd'
 *   ```
 */
-/*@__NO_SIDE_EFFECTS__*/
 function pluralize(word, options) {
 	const { count = 1, forms, locale = "en-US", type = "cardinal" } = {
 		__proto__: null,