refactor: inline lazy-loading for external modules

Move lazy-loading wrapper functions directly into the modules that use
them instead of keeping them in separate external/*.ts files. This
simplifies the module structure and avoids confusion with the external
re-export .js files.

- dlx-package.ts: Add inline getNpmPackageArg() and getPacote()
- versions.ts: Add inline getSemver()
- Remove src/external/{npm-package-arg,pacote,semver}.ts

Author: jdalton

src/dlx-package.ts

@@ -36,15 +36,31 @@ import path from 'node:path'
 import { WIN32 } from './constants/platform'
 import { getPacoteCachePath } from './constants/packages'
 import { generateCacheKey } from './dlx'
-import { getNpmPackageArg } from './external/npm-package-arg'
-import { getPacote } from './external/pacote'
 import { readJsonSync } from './fs'
 import { normalizePath } from './path'
 import { getSocketDlxDir } from './paths'
 import { processLock } from './process-lock'
 import type { SpawnExtra, SpawnOptions } from './spawn'
 import { spawn } from './spawn'
 
+let _npmPackageArg: typeof import('npm-package-arg') | undefined
+/*@__NO_SIDE_EFFECTS__*/
+function getNpmPackageArg() {
+  if (_npmPackageArg === undefined) {
+    _npmPackageArg = /*@__PURE__*/ require('../external/npm-package-arg')
+  }
+  return _npmPackageArg as typeof import('npm-package-arg')
+}
+
+let _pacote: typeof import('pacote') | undefined
+/*@__NO_SIDE_EFFECTS__*/
+function getPacote() {
+  if (_pacote === undefined) {
+    _pacote = /*@__PURE__*/ require('../external/pacote')
+  }
+  return _pacote as typeof import('pacote')
+}
+
 /**
  * Regex to check if a version string contains range operators.
  * Matches any version with range operators: ~, ^, >, <, =, x, X, *, spaces, or ||.

src/external/npm-package-arg.ts

@@ -1,6 +1,14 @@
 /** @fileoverview Version comparison and validation utilities for Socket ecosystem. */
 
-import { getSemver } from './external/semver'
+let _semver: typeof import('semver') | undefined
+/*@__NO_SIDE_EFFECTS__*/
+function getSemver() {
+  if (_semver === undefined) {
+    // The 'semver' package is browser safe.
+    _semver = /*@__PURE__*/ require('../external/semver')
+  }
+  return _semver as typeof import('semver')
+}
 
 /**
  * Coerce a version string to valid semver format.