What code can reach outside the codebase, so that running it twice can give different answers: the time, random numbers, the network, files, the machine and process it runs in (its environment variables, platform, working directory), and other processes; and what it writes out (`console`), which a value kept rather than computed wouldn't.
What one definition's own code (its stored IR) reaches outside the codebase, not counting what it uses: from Node's modules it imports, the globals it reads (`fetch`, `process.env`, `Date.now()`, `new Date()`, `Math.random()`), and which of their members. What's only named in types (`b: Buffer`, `typeof process` in a type, a type imported from `node:fs`) is erased, so it reaches nothing. What npm packages do inside isn't seen.