@socketsecurity/lib 6.0.8 → 6.0.10

package/dist/stdio/prompts.js

@@ -1,49 +1,18 @@
 "use strict";
 /* Socket Lib - Built with rolldown */
 Object.defineProperty(exports, Symbol.toStringTag, { value: 'Module' });
-const require_runtime = require('../_virtual/_rolldown/runtime.js');
 const require_process_abort = require('../process/abort.js');
 const require_themes_themes = require('../themes/themes.js');
 const require_themes_context = require('../themes/context.js');
+const require_logger_colors = require('../logger/colors.js');
 const require_themes_resolve = require('../themes/resolve.js');
 const require_spinner_default = require('../spinner/default.js');
-let src_external_yoctocolors_cjs = require("../external/yoctocolors-cjs");
-src_external_yoctocolors_cjs = require_runtime.__toESM(src_external_yoctocolors_cjs);
-let src_external__inquirer_checkbox = require("../external/@inquirer/checkbox");
-src_external__inquirer_checkbox = require_runtime.__toESM(src_external__inquirer_checkbox);
-let src_external__inquirer_confirm = require("../external/@inquirer/confirm");
-src_external__inquirer_confirm = require_runtime.__toESM(src_external__inquirer_confirm);
-let src_external__inquirer_input = require("../external/@inquirer/input");
-src_external__inquirer_input = require_runtime.__toESM(src_external__inquirer_input);
-let src_external__inquirer_password = require("../external/@inquirer/password");
-src_external__inquirer_password = require_runtime.__toESM(src_external__inquirer_password);
-let src_external__inquirer_search = require("../external/@inquirer/search");
-src_external__inquirer_search = require_runtime.__toESM(src_external__inquirer_search);
-let src_external__inquirer_select = require("../external/@inquirer/select");
-src_external__inquirer_select = require_runtime.__toESM(src_external__inquirer_select);
 
 //#region src/stdio/prompts.ts
 /**
 * @file User prompt utilities for interactive scripts. Provides inquirer.js
 *   integration with spinner support, context handling, and theming.
 */
-const abortSignal = require_process_abort.getAbortSignal();
-const spinner = require_spinner_default.getDefaultSpinner();
-const searchRaw = src_external__inquirer_search.default;
-const selectModule = src_external__inquirer_select;
-const selectRaw = selectModule.default;
-const ActualSeparator = selectModule.Separator;
-/**
-* Apply a color to text using yoctocolors. Handles both named colors and RGB
-* tuples.
-*
-* @private
-*/
-function applyColor(text, color) {
-	if (typeof color === "string") return src_external_yoctocolors_cjs.default[color](text);
-	const { 0: r, 1: g, 2: b } = color;
-	return `\u001B[38;2;${r};${g};${b}m${text}\u001B[39m`;
-}
 /**
 * Convert Socket theme to @inquirer theme format. Maps our theme colors to
 * inquirer's style functions. Handles theme names, Theme objects, and passes
@@ -75,18 +44,18 @@ function createInquirerTheme(theme) {
 		const primaryColor = socketTheme.colors.primary;
 		return {
 			style: {
-				message: (text) => applyColor(text, promptColor),
-				answer: (text) => applyColor(text, primaryColor),
-				help: (text) => applyColor(text, textDimColor),
-				description: (text) => applyColor(text, textDimColor),
-				disabled: (text) => applyColor(text, textDimColor),
-				error: (text) => applyColor(text, errorColor),
-				highlight: (text) => applyColor(text, primaryColor)
+				message: (text) => require_logger_colors.applyColor(text, promptColor),
+				answer: (text) => require_logger_colors.applyColor(text, primaryColor),
+				help: (text) => require_logger_colors.applyColor(text, textDimColor),
+				description: (text) => require_logger_colors.applyColor(text, textDimColor),
+				disabled: (text) => require_logger_colors.applyColor(text, textDimColor),
+				error: (text) => require_logger_colors.applyColor(text, errorColor),
+				highlight: (text) => require_logger_colors.applyColor(text, primaryColor)
 			},
 			icon: {
-				checked: applyColor("✓", successColor),
+				checked: require_logger_colors.applyColor("✓", successColor),
 				unchecked: " ",
-				cursor: applyColor("❯", primaryColor)
+				cursor: require_logger_colors.applyColor("❯", primaryColor)
 			}
 		};
 	}
@@ -114,7 +83,7 @@ function createInquirerTheme(theme) {
 * @returns Separator instance
 */
 function createSeparator(text) {
-	return new ActualSeparator(text);
+	return new (require("../external/@inquirer/select")).Separator(text);
 }
 /**
 * Check if value is a Socket Theme object.
@@ -156,8 +125,8 @@ function wrapPrompt(inquirerPrompt) {
 	return async (...args) => {
 		const origContext = args.length > 1 ? args[1] : void 0;
 		const { spinner: contextSpinner, ...contextWithoutSpinner } = origContext ?? {};
-		const spinnerInstance = contextSpinner !== void 0 ? contextSpinner : spinner;
-		const signal = abortSignal;
+		const spinnerInstance = contextSpinner !== void 0 ? contextSpinner : require_spinner_default.getDefaultSpinner();
+		const signal = require_process_abort.getAbortSignal();
 		const config = args[0];
 		if (config && typeof config === "object") if (!config["theme"]) config["theme"] = createInquirerTheme(require_themes_context.getTheme());
 		else config["theme"] = createInquirerTheme(config["theme"]);
@@ -192,7 +161,7 @@ function wrapPrompt(inquirerPrompt) {
 *     ],
 *   })
 */
-const checkbox = wrapPrompt(src_external__inquirer_checkbox.default);
+const checkbox = wrapPrompt((...args) => require("../external/@inquirer/checkbox").default(...args));
 /**
 * Prompt for a yes/no confirmation. Wrapped with spinner handling and abort
 * signal support.
@@ -201,7 +170,7 @@ const checkbox = wrapPrompt(src_external__inquirer_checkbox.default);
 *   const answer = await confirm({ message: 'Continue?' })
 *   if (answer) { // user confirmed }
 */
-const confirm = wrapPrompt(src_external__inquirer_confirm.default);
+const confirm = wrapPrompt((...args) => require("../external/@inquirer/confirm").default(...args));
 /**
 * Prompt for text input. Wrapped with spinner handling and abort signal
 * support. Result is automatically trimmed.
@@ -209,7 +178,7 @@ const confirm = wrapPrompt(src_external__inquirer_confirm.default);
 * @example
 *   const name = await input({ message: 'Enter your name:' })
 */
-const input = wrapPrompt(src_external__inquirer_input.default);
+const input = wrapPrompt((...args) => require("../external/@inquirer/input").default(...args));
 /**
 * Prompt for password input (hidden characters). Wrapped with spinner handling
 * and abort signal support.
@@ -217,7 +186,7 @@ const input = wrapPrompt(src_external__inquirer_input.default);
 * @example
 *   const token = await password({ message: 'Enter API token:' })
 */
-const password = wrapPrompt(src_external__inquirer_password.default);
+const password = wrapPrompt((...args) => require("../external/@inquirer/password").default(...args));
 /**
 * Prompt with searchable/filterable choices. Wrapped with spinner handling and
 * abort signal support.
@@ -228,7 +197,7 @@ const password = wrapPrompt(src_external__inquirer_password.default);
 *     source: async input => fetchPackages(input),
 *   })
 */
-const search = wrapPrompt(searchRaw);
+const search = wrapPrompt((...args) => require("../external/@inquirer/search").default(...args));
 /**
 * Prompt to select from a list of choices. Wrapped with spinner handling and
 * abort signal support.
@@ -242,11 +211,18 @@ const search = wrapPrompt(searchRaw);
 *     ],
 *   })
 */
-const select = wrapPrompt(selectRaw);
+const select = wrapPrompt((...args) => require("../external/@inquirer/select").default(...args));
+const Separator = new Proxy(function() {}, {
+	construct(_target, args) {
+		return Reflect.construct(require("../external/@inquirer/select").Separator, args);
+	},
+	get(_target, prop, receiver) {
+		return Reflect.get(require("../external/@inquirer/select").Separator, prop, receiver);
+	}
+});
 
 //#endregion
-exports.Separator = ActualSeparator;
-exports.applyColor = applyColor;
+exports.Separator = Separator;
 exports.checkbox = checkbox;
 exports.confirm = confirm;
 exports.createInquirerTheme = createInquirerTheme;

package/dist/strings/format.js

@@ -1,8 +1,8 @@
 "use strict";
 /* Socket Lib - Built with rolldown */
 Object.defineProperty(exports, Symbol.toStringTag, { value: 'Module' });
-const require_primordials_math = require('../primordials/math.js');
 const require_primordials_string = require('../primordials/string.js');
+const require_primordials_math = require('../primordials/math.js');
 const require_ansi_strip = require('../ansi/strip.js');
 
 //#region src/strings/format.ts

package/dist/strings/predicates.d.ts

@@ -3,7 +3,7 @@
  *   TypeScript type guards so callers can narrow `unknown` → `string` (or
  *   `BlankString` / non-empty string) without an extra cast.
  */
-import type { BlankString, EmptyString } from './types';
+import type { BlankString, NonEmptyString } from './types';
 /**
  * Check if a value is a blank string (empty or only whitespace).
  *
@@ -49,4 +49,4 @@ export declare function isBlankString(value: unknown): value is BlankString;
  *
  * @returns `true` if the value is a non-empty string, `false` otherwise
  */
-export declare function isNonEmptyString(value: unknown): value is Exclude<string, EmptyString>;
+export declare function isNonEmptyString(value: unknown): value is NonEmptyString;

package/dist/strings/search.js

@@ -1,8 +1,8 @@
 "use strict";
 /* Socket Lib - Built with rolldown */
 Object.defineProperty(exports, Symbol.toStringTag, { value: 'Module' });
-const require_primordials_math = require('../primordials/math.js');
 const require_primordials_string = require('../primordials/string.js');
+const require_primordials_math = require('../primordials/math.js');
 
 //#region src/strings/search.ts
 /**
@@ -43,7 +43,7 @@ function search(str, regexp, options) {
 		...options
 	};
 	const { length } = str;
-	if (fromIndex >= length) return -1;
+	if (fromIndex > length) return -1;
 	if (fromIndex === 0) return require_primordials_string.StringPrototypeSearch(str, regexp);
 	const offset = fromIndex < 0 ? require_primordials_math.MathMax(length + fromIndex, 0) : fromIndex;
 	const result = require_primordials_string.StringPrototypeSlice(str, offset).search(regexp);

package/dist/strings/types.d.ts

@@ -10,6 +10,10 @@ declare const EmptyStringBrand: unique symbol;
 export type EmptyString = string & {
     [EmptyStringBrand]: true;
 };
+declare const NonEmptyStringBrand: unique symbol;
+export type NonEmptyString = string & {
+    [NonEmptyStringBrand]: true;
+};
 export interface ApplyLinePrefixOptions {
     /**
      * The prefix to add to each line.

package/dist/strings/width.d.ts

@@ -14,6 +14,7 @@
  */
 import type { eastAsianWidth as eastAsianWidthType } from '../external/get-east-asian-width';
 export declare function getEastAsianWidth(): typeof eastAsianWidthType;
+export declare function getSegmenter(): Intl.Segmenter;
 /**
  * Get the visual width of a string in terminal columns.
  *

package/dist/strings/width.js

@@ -26,7 +26,11 @@ function getEastAsianWidth() {
 	if (cachedEastAsianWidth === void 0) cachedEastAsianWidth = (/* @__PURE__ */ require("../external/get-east-asian-width")).eastAsianWidth;
 	return cachedEastAsianWidth;
 }
-const segmenter = new require_primordials_intl.IntlSegmenter();
+let segmenter;
+function getSegmenter() {
+	if (segmenter === void 0) segmenter = new require_primordials_intl.IntlSegmenter();
+	return segmenter;
+}
 let zeroWidthClusterRegex;
 let leadingNonPrintingRegex;
 let emojiRegex;
@@ -73,7 +77,7 @@ function stringWidth(text) {
 	let width = 0;
 	const eastAsianWidthOptions = { ambiguousAsWide: false };
 	const eastAsianWidth = getEastAsianWidth();
-	for (const { segment } of segmenter.segment(plainText)) {
+	for (const { segment } of getSegmenter().segment(plainText)) {
 		if (require_primordials_regexp.RegExpPrototypeTest(zeroWidthClusterRegex, segment)) continue;
 		if (require_primordials_regexp.RegExpPrototypeTest(emojiRegex, segment)) {
 			width += 2;
@@ -83,13 +87,17 @@ function stringWidth(text) {
 		if (codePoint === void 0) continue;
 		/* c8 ignore next - External eastAsianWidth call */
 		width += eastAsianWidth(codePoint, eastAsianWidthOptions);
-		if (segment.length > 1) for (const char of segment.slice(1)) {
-			const charCode = require_primordials_string.StringPrototypeCharCodeAt(char, 0);
-			if (charCode >= 65280 && charCode <= 65519) {
-				const trailingCodePoint = require_primordials_string.StringPrototypeCodePointAt(char, 0);
-				if (trailingCodePoint !== void 0)
+		if (segment.length > 1) {
+			const trailingChars = segment.slice(1);
+			for (let i = 0, { length } = trailingChars; i < length; i += 1) {
+				const char = trailingChars[i];
+				const charCode = require_primordials_string.StringPrototypeCharCodeAt(char, 0);
+				if (charCode >= 65280 && charCode <= 65519) {
+					const trailingCodePoint = require_primordials_string.StringPrototypeCodePointAt(char, 0);
+					if (trailingCodePoint !== void 0)
  /* c8 ignore next - External eastAsianWidth call */
-				width += eastAsianWidth(trailingCodePoint, eastAsianWidthOptions);
+					width += eastAsianWidth(trailingCodePoint, eastAsianWidthOptions);
+				}
 			}
 		}
 	}
@@ -98,4 +106,5 @@ function stringWidth(text) {
 
 //#endregion
 exports.getEastAsianWidth = getEastAsianWidth;
+exports.getSegmenter = getSegmenter;
 exports.stringWidth = stringWidth;

package/dist/themes/context.d.ts

@@ -2,9 +2,10 @@
  * @file Elegant theme context management. Async-aware theming with automatic
  *   context isolation via AsyncLocalStorage.
  */
+import type { AsyncLocalStorage } from 'node:async_hooks';
 import type { Theme } from './types';
 import type { ThemeName } from './themes';
-import type * as AsyncHooks from 'node:async_hooks';
+import { getNodeAsyncHooks } from '../node/async-hooks';
 /**
  * Theme change event listener signature.
  */
@@ -16,11 +17,13 @@ export type ThemeChangeListener = (theme: Theme) => void;
  */
 export declare function emitThemeChange(theme: Theme): void;
 /**
- * Lazily load the async_hooks module to avoid Webpack errors.
+ * Lazily load the async_hooks module. Aliases the canonical `node/async-hooks`
+ * accessor (single owner of the bundler-safe require); kept as an export so
+ * this module's surface is unchanged.
  *
  * @private
  */
-export declare function getAsyncHooks(): typeof AsyncHooks;
+export declare const getAsyncHooks: typeof getNodeAsyncHooks;
 /**
  * Get the active theme from context.
  *
@@ -33,6 +36,18 @@ export declare function getAsyncHooks(): typeof AsyncHooks;
  * @returns Current theme
  */
 export declare function getTheme(): Theme;
+/**
+ * Get the process-scoped AsyncLocalStorage used for theme context isolation.
+ *
+ * Constructed LAZILY (memoized) rather than at module-eval: an
+ * AsyncLocalStorage holds a live native handle, and constructing it at import
+ * time pins that handle into every module transitively importing this leaf —
+ * aborting V8 --build-snapshot serialization. Deferring to first use keeps the
+ * single-store semantics while leaving module import snapshot-safe.
+ *
+ * @private
+ */
+export declare function getThemeStorage(): AsyncLocalStorage<Theme>;
 /**
  * Subscribe to theme change events.
  *

package/dist/themes/context.js

@@ -1,11 +1,11 @@
 "use strict";
 /* Socket Lib - Built with rolldown */
 Object.defineProperty(exports, Symbol.toStringTag, { value: 'Module' });
+const require_node_async_hooks = require('../node/async-hooks.js');
 const require_primordials_map_set = require('../primordials/map-set.js');
 const require_themes_themes = require('./themes.js');
 
 //#region src/themes/context.ts
-let asyncHooks;
 /**
 * Emit theme change event to listeners.
 *
@@ -15,19 +15,14 @@ function emitThemeChange(theme) {
 	for (const listener of listeners) listener(theme);
 }
 /**
-* Lazily load the async_hooks module to avoid Webpack errors.
+* Lazily load the async_hooks module. Aliases the canonical `node/async-hooks`
+* accessor (single owner of the bundler-safe require); kept as an export so
+* this module's surface is unchanged.
 *
 * @private
 */
-function getAsyncHooks() {
-	if (asyncHooks === void 0) asyncHooks = /*@__PURE__*/ require("node:async_hooks");
-	return asyncHooks;
-}
-/**
-* AsyncLocalStorage for theme context isolation.
-*/
-const { AsyncLocalStorage } = getAsyncHooks();
-const themeStorage = new AsyncLocalStorage();
+const getAsyncHooks = require_node_async_hooks.getNodeAsyncHooks;
+let themeStorage;
 /**
 * Fallback theme for global context.
 */
@@ -48,7 +43,25 @@ const listeners = new require_primordials_map_set.SetCtor();
 * @returns Current theme
 */
 function getTheme() {
-	return themeStorage.getStore() ?? fallbackTheme;
+	return getThemeStorage().getStore() ?? fallbackTheme;
+}
+/**
+* Get the process-scoped AsyncLocalStorage used for theme context isolation.
+*
+* Constructed LAZILY (memoized) rather than at module-eval: an
+* AsyncLocalStorage holds a live native handle, and constructing it at import
+* time pins that handle into every module transitively importing this leaf —
+* aborting V8 --build-snapshot serialization. Deferring to first use keeps the
+* single-store semantics while leaving module import snapshot-safe.
+*
+* @private
+*/
+function getThemeStorage() {
+	if (themeStorage === void 0) {
+		const { AsyncLocalStorage } = getAsyncHooks();
+		themeStorage = new AsyncLocalStorage();
+	}
+	return themeStorage;
 }
 /**
 * Subscribe to theme change events.
@@ -107,7 +120,7 @@ function setTheme(theme) {
 */
 async function withTheme(theme, fn) {
 	const resolvedTheme = typeof theme === "string" ? require_themes_themes.THEMES[theme] ?? fallbackTheme : theme;
-	return await themeStorage.run(resolvedTheme, async () => {
+	return await getThemeStorage().run(resolvedTheme, async () => {
 		emitThemeChange(resolvedTheme);
 		return await fn();
 	});
@@ -132,7 +145,7 @@ async function withTheme(theme, fn) {
 */
 function withThemeSync(theme, fn) {
 	const resolvedTheme = typeof theme === "string" ? require_themes_themes.THEMES[theme] ?? fallbackTheme : theme;
-	return themeStorage.run(resolvedTheme, () => {
+	return getThemeStorage().run(resolvedTheme, () => {
 		emitThemeChange(resolvedTheme);
 		return fn();
 	});
@@ -142,6 +155,7 @@ function withThemeSync(theme, fn) {
 exports.emitThemeChange = emitThemeChange;
 exports.getAsyncHooks = getAsyncHooks;
 exports.getTheme = getTheme;
+exports.getThemeStorage = getThemeStorage;
 exports.onThemeChange = onThemeChange;
 exports.setTheme = setTheme;
 exports.withTheme = withTheme;

package/dist/versions/_internal.d.ts

@@ -1,24 +1,54 @@
 /**
- * @file Private internals for `versions/*` modules — eagerly picks the right
- *   implementation at module load. On socket-btm's smol Node binary, prefers
+ * @file Private internals for `versions/*` modules — lazily picks the right
+ *   implementation at FIRST USE. On socket-btm's smol Node binary, prefers
  *   `node:smol-versions` (C++-accelerated via
  *   `internalBinding('smol_versions_native')`); on stock Node, falls through to
  *   the vendored JS `semver`. Both expose a strict-superset surface for the ops
- *   `versions/*` calls, so leaves can forward to `impl.<op>` directly without
- *   per-call branching. `getMajorVersion`-style helpers need the parsed object
- *   shape (`{major, minor, patch}`) which only `semver.parse` exposes — those
- *   leaves use `getSemver()` directly instead of going through `impl`.
+ *   `versions/*` calls, so leaves can forward to `getImpl().<op>` directly
+ *   without per-call branching. `getMajorVersion`-style helpers need the parsed
+ *   object shape (`{major, minor, patch}`) which only `semver.parse` exposes —
+ *   those leaves use `getSemver()` directly instead of going through the impl.
+ *   Snapshot safety: the vendored `semver` resolves through the npm-pack
+ *   bundle, whose module-eval constructs a live native `[Foreign]` handle
+ *   (cacache/pacote/make-fetch-happen). Requiring it at module load pins that
+ *   handle and aborts `node --build-snapshot`. So both the `require` and the
+ *   smol-vs-semver pick are deferred to first call and memoized.
  */
-import type * as semverType from '../external/semver';
+import type { coerce, compare, diff, eq, gt, gte, inc, lt, lte, maxSatisfying, minSatisfying, parse, rsort, satisfies, sort, valid } from '../external/semver';
 import type { SmolVersionsBinding } from '../smol/versions';
 /**
- * The vendored `semver` JS implementation. Always available — used directly by
- * the leaves that need the parsed `{major, minor, patch}` shape (which
- * smol-versions doesn't expose).
+ * The surface of the vendored `semver` module the `versions/*` leaves call.
+ * Built from named imports (vs. `import * as`) so the used surface stays
+ * explicit and greppable.
  */
-export declare function getSemver(): typeof semverType;
+export interface Semver {
+    coerce: typeof coerce;
+    compare: typeof compare;
+    diff: typeof diff;
+    eq: typeof eq;
+    gt: typeof gt;
+    gte: typeof gte;
+    inc: typeof inc;
+    lt: typeof lt;
+    lte: typeof lte;
+    maxSatisfying: typeof maxSatisfying;
+    minSatisfying: typeof minSatisfying;
+    parse: typeof parse;
+    rsort: typeof rsort;
+    satisfies: typeof satisfies;
+    sort: typeof sort;
+    valid: typeof valid;
+}
 /**
  * Resolved version implementation: smol-versions on the smol Node binary,
- * otherwise the vendored `semver`. Bound once at module load.
+ * otherwise the vendored `semver`. Resolved once on first call and memoized —
+ * deferred from module load so importing a `versions/*` leaf is handle-free.
+ */
+export declare function getImpl(): SmolVersionsBinding | Semver;
+/**
+ * The vendored `semver` JS implementation. Always available — used directly by
+ * the leaves that need the parsed `{major, minor, patch}` shape (which
+ * smol-versions doesn't expose). Required lazily on first call so importing a
+ * `versions/*` leaf does not pull in the native-handle-bearing npm-pack bundle.
  */
-export declare const impl: SmolVersionsBinding | typeof semverType;
+export declare function getSemver(): Semver;

package/dist/versions/_internal.js

@@ -5,31 +5,43 @@ const require_smol_versions = require('../smol/versions.js');
 
 //#region src/versions/_internal.ts
 /**
-* @file Private internals for `versions/*` modules — eagerly picks the right
-*   implementation at module load. On socket-btm's smol Node binary, prefers
+* @file Private internals for `versions/*` modules — lazily picks the right
+*   implementation at FIRST USE. On socket-btm's smol Node binary, prefers
 *   `node:smol-versions` (C++-accelerated via
 *   `internalBinding('smol_versions_native')`); on stock Node, falls through to
 *   the vendored JS `semver`. Both expose a strict-superset surface for the ops
-*   `versions/*` calls, so leaves can forward to `impl.<op>` directly without
-*   per-call branching. `getMajorVersion`-style helpers need the parsed object
-*   shape (`{major, minor, patch}`) which only `semver.parse` exposes — those
-*   leaves use `getSemver()` directly instead of going through `impl`.
+*   `versions/*` calls, so leaves can forward to `getImpl().<op>` directly
+*   without per-call branching. `getMajorVersion`-style helpers need the parsed
+*   object shape (`{major, minor, patch}`) which only `semver.parse` exposes —
+*   those leaves use `getSemver()` directly instead of going through the impl.
+*   Snapshot safety: the vendored `semver` resolves through the npm-pack
+*   bundle, whose module-eval constructs a live native `[Foreign]` handle
+*   (cacache/pacote/make-fetch-happen). Requiring it at module load pins that
+*   handle and aborts `node --build-snapshot`. So both the `require` and the
+*   smol-vs-semver pick are deferred to first call and memoized.
 */
-const semver = require("../external/semver");
+let impl;
+/**
+* Resolved version implementation: smol-versions on the smol Node binary,
+* otherwise the vendored `semver`. Resolved once on first call and memoized —
+* deferred from module load so importing a `versions/*` leaf is handle-free.
+*/
+function getImpl() {
+	if (impl === void 0) impl = require_smol_versions.getSmolVersions() ?? getSemver();
+	return impl;
+}
+let semver;
 /**
 * The vendored `semver` JS implementation. Always available — used directly by
 * the leaves that need the parsed `{major, minor, patch}` shape (which
-* smol-versions doesn't expose).
+* smol-versions doesn't expose). Required lazily on first call so importing a
+* `versions/*` leaf does not pull in the native-handle-bearing npm-pack bundle.
 */
 function getSemver() {
+	if (semver === void 0) semver = require("../external/semver");
 	return semver;
 }
-/**
-* Resolved version implementation: smol-versions on the smol Node binary,
-* otherwise the vendored `semver`. Bound once at module load.
-*/
-const impl = require_smol_versions.getSmolVersions() ?? semver;
 
 //#endregion
-exports.getSemver = getSemver;
-exports.impl = impl;
+exports.getImpl = getImpl;
+exports.getSemver = getSemver;

package/dist/versions/compare.d.ts

@@ -14,7 +14,11 @@
  *     "invalid version" throw into `undefined` for the caller's convenience;
  *     all other ops surface whatever the underlying impl returns. The vendored
  *     `semver` export has no `neq` helper, so when we fall back to it we route
- *     `neq` through `!eq` to match smol's semantics.
+ *     `neq` through `!eq` to match smol's semantics. Snapshot safety: each
+ *     export is a thin forwarding function that resolves `getImpl()` at FIRST
+ *     CALL, not at module-eval. Binding the impl methods at module load
+ *     (`impl.eq.bind(impl)`) pinned the native-handle-bearing semver/npm-pack
+ *     bundle into the heap and aborted `node --build-snapshot`.
  */
 /**
  * Compare two semantic version strings.
@@ -25,27 +29,29 @@ export declare function compare(a: string, b: string): -1 | 0 | 1 | undefined;
 /**
  * Check if a equals b.
  */
-export declare const eq: (a: string, b: string) => boolean;
-/**
- * Check if a does not equal b.
- */
-export declare const neq: (a: string, b: string) => boolean;
+export declare function eq(a: string, b: string): boolean;
 /**
  * Check if a is greater than b.
  */
-export declare const gt: (a: string, b: string) => boolean;
+export declare function gt(a: string, b: string): boolean;
 /**
  * Check if a is greater than or equal to b.
  */
-export declare const gte: (a: string, b: string) => boolean;
+export declare function gte(a: string, b: string): boolean;
 /**
  * Check if a is less than b.
  */
-export declare const lt: (a: string, b: string) => boolean;
+export declare function lt(a: string, b: string): boolean;
 /**
  * Check if a is less than or equal to b.
  */
-export declare const lte: (a: string, b: string) => boolean;
+export declare function lte(a: string, b: string): boolean;
+/**
+ * Check if a does not equal b. The vendored `semver` export exposes no `neq`
+ * helper, so on the fallback path we route through `!eq` to match smol's
+ * semantics; smol-versions has a native `.neq` and uses it directly.
+ */
+export declare function neq(a: string, b: string): boolean;
 /**
  * Sort versions in descending order.
  */