@vibecheck-ai/mcp 24.6.8 → 24.6.11

package/dist/chunk-G3FQJC2H.js

@@ -0,0 +1,1968 @@
+import { createRequire } from 'module';
+import { fileURLToPath } from 'url';
+import * as path from 'path';
+import { dirname, join, resolve } from 'path';
+import { isRelativeOrAlias, extractPackageName, extractJavaScriptNpmImports } from './chunk-NR36RTVO.js';
+import { readFileSync, existsSync, readdirSync, unwatchFile, watchFile, statSync, mkdirSync, writeFileSync } from 'fs';
+import { EventEmitter } from 'events';
+
+createRequire(import.meta.url);
+const __filename$1 = fileURLToPath(import.meta.url);
+dirname(__filename$1);
+var EngineErrorCode = /* @__PURE__ */ ((EngineErrorCode2) => {
+  EngineErrorCode2["INVALID_CONFIG"] = "INVALID_CONFIG";
+  EngineErrorCode2["MISSING_CONFIG"] = "MISSING_CONFIG";
+  EngineErrorCode2["NETWORK_ERROR"] = "NETWORK_ERROR";
+  EngineErrorCode2["TIMEOUT_ERROR"] = "TIMEOUT_ERROR";
+  EngineErrorCode2["IO_ERROR"] = "IO_ERROR";
+  EngineErrorCode2["PARSE_ERROR"] = "PARSE_ERROR";
+  EngineErrorCode2["INVALID_SYNTAX"] = "INVALID_SYNTAX";
+  EngineErrorCode2["CACHE_ERROR"] = "CACHE_ERROR";
+  EngineErrorCode2["CACHE_MISS"] = "CACHE_MISS";
+  EngineErrorCode2["VALIDATION_ERROR"] = "VALIDATION_ERROR";
+  EngineErrorCode2["INVALID_INPUT"] = "INVALID_INPUT";
+  EngineErrorCode2["RUNTIME_ERROR"] = "RUNTIME_ERROR";
+  EngineErrorCode2["MEMORY_ERROR"] = "MEMORY_ERROR";
+  EngineErrorCode2["RESOURCE_EXHAUSTED"] = "RESOURCE_EXHAUSTED";
+  EngineErrorCode2["SERVICE_UNAVAILABLE"] = "SERVICE_UNAVAILABLE";
+  EngineErrorCode2["RATE_LIMITED"] = "RATE_LIMITED";
+  EngineErrorCode2["AUTHENTICATION_ERROR"] = "AUTHENTICATION_ERROR";
+  EngineErrorCode2["UNKNOWN_ERROR"] = "UNKNOWN_ERROR";
+  EngineErrorCode2["INTERNAL_ERROR"] = "INTERNAL_ERROR";
+  return EngineErrorCode2;
+})(EngineErrorCode || {});
+var EngineError = class _EngineError extends Error {
+  code;
+  context;
+  recoverable;
+  retryable;
+  constructor(code, message, context = {}, recoverable = false, retryable = false) {
+    super(message);
+    this.name = "EngineError";
+    this.code = code;
+    this.context = context;
+    this.recoverable = recoverable;
+    this.retryable = retryable;
+    if (Error.captureStackTrace) {
+      Error.captureStackTrace(this, _EngineError);
+    }
+  }
+  /**
+   * Convert to serializable format for logging/transport
+   */
+  toJSON() {
+    return {
+      name: this.name,
+      code: this.code,
+      message: this.message,
+      context: this.context,
+      recoverable: this.recoverable,
+      retryable: this.retryable,
+      stack: this.stack
+    };
+  }
+  /**
+   * Create a network error with retry capability
+   */
+  static network(message, context = {}) {
+    return new _EngineError(
+      "NETWORK_ERROR",
+      message,
+      context,
+      true,
+      // recoverable
+      true
+      // retryable
+    );
+  }
+  /**
+   * Create a timeout error with retry capability
+   */
+  static timeout(message, context = {}) {
+    return new _EngineError(
+      "TIMEOUT_ERROR",
+      message,
+      context,
+      true,
+      // recoverable
+      true
+      // retryable
+    );
+  }
+  /**
+   * Create a parse error (not retryable)
+   */
+  static parse(message, context = {}) {
+    return new _EngineError(
+      "PARSE_ERROR",
+      message,
+      context,
+      false,
+      // not recoverable
+      false
+      // not retryable
+    );
+  }
+  /**
+   * Create a configuration error (not retryable)
+   */
+  static config(message, context = {}) {
+    return new _EngineError(
+      "INVALID_CONFIG",
+      message,
+      context,
+      false,
+      // not recoverable
+      false
+      // not retryable
+    );
+  }
+  /**
+   * Create a service unavailable error (retryable)
+   */
+  static unavailable(message, context = {}) {
+    return new _EngineError(
+      "SERVICE_UNAVAILABLE",
+      message,
+      context,
+      true,
+      // recoverable
+      true
+      // retryable
+    );
+  }
+  /**
+   * Create a validation error (not retryable)
+   */
+  static validation(message, context = {}) {
+    return new _EngineError(
+      "VALIDATION_ERROR",
+      message,
+      context,
+      false,
+      // not recoverable
+      false
+      // not retryable
+    );
+  }
+};
+function withEngineErrorHandling(operation, context = {}, errorMapper) {
+  return operation().catch((error) => {
+    if (error instanceof EngineError) {
+      throw error;
+    }
+    if (error instanceof Error) {
+      if (error.name === "AbortError" || error.message.includes("timeout")) {
+        throw EngineError.timeout(error.message, context);
+      }
+      if (error.message.includes("fetch") || error.message.includes("network")) {
+        throw EngineError.network(error.message, context);
+      }
+      if (error.message.includes("parse") || error.message.includes("syntax")) {
+        throw EngineError.parse(error.message, context);
+      }
+    }
+    if (errorMapper) {
+      throw errorMapper(error);
+    }
+    throw new EngineError(
+      "UNKNOWN_ERROR",
+      error instanceof Error ? error.message : String(error),
+      context,
+      false,
+      false
+    );
+  });
+}
+function isEngineError(error) {
+  return error instanceof EngineError;
+}
+function createContext(engine, filePath, additional = {}) {
+  return {
+    engine,
+    filePath,
+    timestamp: (/* @__PURE__ */ new Date()).toISOString(),
+    ...additional
+  };
+}
+var javascriptLanguageProfile = {
+  id: "javascript",
+  extractImportSpecifiers: extractJavaScriptNpmImports
+};
+var PY_STDLIB_TOP = /* @__PURE__ */ new Set([
+  "abc",
+  "aifc",
+  "argparse",
+  "array",
+  "ast",
+  "asyncio",
+  "atexit",
+  "base64",
+  "bdb",
+  "binascii",
+  "bisect",
+  "builtins",
+  "bz2",
+  "calendar",
+  "cgi",
+  "cgitb",
+  "chunk",
+  "cmath",
+  "cmd",
+  "code",
+  "codecs",
+  "codeop",
+  "collections",
+  "colorsys",
+  "compileall",
+  "concurrent",
+  "configparser",
+  "contextlib",
+  "contextvars",
+  "copy",
+  "copyreg",
+  "cProfile",
+  "crypt",
+  "csv",
+  "ctypes",
+  "curses",
+  "dataclasses",
+  "datetime",
+  "dbm",
+  "decimal",
+  "difflib",
+  "dis",
+  "distutils",
+  "doctest",
+  "email",
+  "encodings",
+  "enum",
+  "errno",
+  "faulthandler",
+  "fcntl",
+  "filecmp",
+  "fileinput",
+  "fnmatch",
+  "fractions",
+  "ftplib",
+  "functools",
+  "gc",
+  "getopt",
+  "getpass",
+  "gettext",
+  "glob",
+  "graphlib",
+  "grp",
+  "gzip",
+  "hashlib",
+  "heapq",
+  "hmac",
+  "html",
+  "http",
+  "idlelib",
+  "imaplib",
+  "imghdr",
+  "imp",
+  "importlib",
+  "inspect",
+  "io",
+  "ipaddress",
+  "itertools",
+  "json",
+  "keyword",
+  "lib2to3",
+  "linecache",
+  "locale",
+  "logging",
+  "lzma",
+  "mailbox",
+  "mailcap",
+  "marshal",
+  "math",
+  "mimetypes",
+  "mmap",
+  "modulefinder",
+  "multiprocessing",
+  "netrc",
+  "nis",
+  "nntplib",
+  "numbers",
+  "operator",
+  "optparse",
+  "os",
+  "ossaudiodev",
+  "pathlib",
+  "pdb",
+  "pickle",
+  "pickletools",
+  "pipes",
+  "pkgutil",
+  "platform",
+  "plistlib",
+  "poplib",
+  "posix",
+  "posixpath",
+  "pprint",
+  "profile",
+  "pstats",
+  "pty",
+  "pwd",
+  "py_compile",
+  "pyclbr",
+  "pydoc",
+  "queue",
+  "quopri",
+  "random",
+  "re",
+  "readline",
+  "reprlib",
+  "resource",
+  "rlcompleter",
+  "runpy",
+  "sched",
+  "secrets",
+  "select",
+  "selectors",
+  "shelve",
+  "shlex",
+  "shutil",
+  "signal",
+  "site",
+  "smtpd",
+  "smtplib",
+  "sndhdr",
+  "socket",
+  "socketserver",
+  "sqlite3",
+  "ssl",
+  "stat",
+  "statistics",
+  "string",
+  "stringprep",
+  "struct",
+  "subprocess",
+  "sunau",
+  "symtable",
+  "sys",
+  "sysconfig",
+  "syslog",
+  "tabnanny",
+  "tarfile",
+  "telnetlib",
+  "tempfile",
+  "termios",
+  "test",
+  "textwrap",
+  "threading",
+  "time",
+  "timeit",
+  "tkinter",
+  "token",
+  "tokenize",
+  "trace",
+  "traceback",
+  "tracemalloc",
+  "tty",
+  "turtle",
+  "turtledemo",
+  "types",
+  "typing",
+  "unicodedata",
+  "unittest",
+  "urllib",
+  "uu",
+  "uuid",
+  "venv",
+  "warnings",
+  "wave",
+  "weakref",
+  "webbrowser",
+  "winsound",
+  "wsgiref",
+  "xdrlib",
+  "xml",
+  "xmlrpc",
+  "zipapp",
+  "zipfile",
+  "zipimport",
+  "zlib",
+  "__future__",
+  "typing_extensions"
+]);
+function shouldSkipTop(name) {
+  const top = name.split(".")[0];
+  if (!top || top.startsWith("_")) return true;
+  return PY_STDLIB_TOP.has(top);
+}
+function pushUnique(out, seen, packageName, line, column, code, importKind) {
+  if (shouldSkipTop(packageName)) return;
+  const top = packageName.split(".")[0];
+  if (seen.has(top)) return;
+  seen.add(top);
+  out.push({
+    specifier: packageName,
+    packageName: top,
+    subpath: packageName.includes(".") ? packageName.slice(top.length + 1) : void 0,
+    line,
+    column,
+    code,
+    importKind
+  });
+}
+function extractPythonPypiImports(source, preLines) {
+  const results = [];
+  const seen = /* @__PURE__ */ new Set();
+  const lines = preLines ?? source.split("\n");
+  const reImportFrom = /^\s*from\s+([\w.]+)\s+import\s+/;
+  const reImportPlain = /^\s*import\s+([\w.]+(?:\s*,\s*[\w.]+)*)\s*(?:#|$)/;
+  const reImportAs = /^\s*import\s+([\w.]+)\s+as\s+\w+/;
+  for (let lineIdx = 0; lineIdx < lines.length; lineIdx++) {
+    const line = lines[lineIdx];
+    const trimmed = line.trimStart();
+    if (!trimmed || trimmed.startsWith("#")) continue;
+    const mFrom = trimmed.match(reImportFrom);
+    if (mFrom) {
+      const mod = mFrom[1].trim();
+      if (mod === "__future__") continue;
+      pushUnique(results, seen, mod, lineIdx + 1, line.indexOf(mod), trimmed, "value");
+      continue;
+    }
+    const mAs = trimmed.match(reImportAs);
+    if (mAs) {
+      pushUnique(results, seen, mAs[1].trim(), lineIdx + 1, line.indexOf(mAs[1]), trimmed, "value");
+      continue;
+    }
+    const mPlain = trimmed.match(reImportPlain);
+    if (mPlain) {
+      const parts = mPlain[1].split(/\s*,\s*/);
+      for (const p of parts) {
+        const mod = p.trim();
+        if (!mod || mod === "__future__") continue;
+        pushUnique(results, seen, mod, lineIdx + 1, line.indexOf(mod), trimmed, "value");
+      }
+    }
+  }
+  return results;
+}
+var pythonLanguageProfile = {
+  id: "python",
+  extractImportSpecifiers: extractPythonPypiImports
+};
+var goLanguageProfile = {
+  id: "go",
+  extractImportSpecifiers(_source, _preLines) {
+    return [];
+  }
+};
+var JS_EXTENSIONS = /* @__PURE__ */ new Set([
+  ".ts",
+  ".tsx",
+  ".js",
+  ".jsx",
+  ".mjs",
+  ".cjs",
+  ".mts",
+  ".cts"
+]);
+function getLanguageProfile(delta) {
+  const lang = delta.documentLanguage.toLowerCase();
+  const uriPath = delta.documentUri.replace(/^file:\/\//, "");
+  const ext = path.extname(uriPath).toLowerCase();
+  const base = path.basename(uriPath).toLowerCase();
+  if (lang.includes("python") || ext === ".py" || ext === ".pyi") return pythonLanguageProfile;
+  if (lang.includes("go") || ext === ".go" || base === "go.mod" || base === "go.work") return goLanguageProfile;
+  const isJsLang = lang.includes("typescript") || lang.includes("javascript") || lang.includes("typescriptreact") || lang.includes("javascriptreact");
+  const isJsExt = JS_EXTENSIONS.has(ext);
+  if (isJsLang || isJsExt) return javascriptLanguageProfile;
+  return null;
+}
+function deterministicId(uri, line, col, category, pkg) {
+  const input = `phantom:${uri}::${line}::${col}::${category}::${pkg}`;
+  let hash = 2166136261;
+  for (let i = 0; i < input.length; i++) {
+    hash ^= input.charCodeAt(i);
+    hash = hash * 16777619 >>> 0;
+  }
+  return `phantom-${hash.toString(16).padStart(8, "0")}`;
+}
+var KNOWN_FAKE_PACKAGES = /* @__PURE__ */ new Set([
+  // Auth
+  "react-auth-provider",
+  "react-secure-auth",
+  "next-auth-helpers",
+  "react-auth-kit-v2",
+  "auth-provider-react",
+  "next-auth-provider",
+  "next-auth-client",
+  "vercel-auth",
+  "vercel-auth-helpers",
+  "supabase-auth-helpers",
+  "supabase-auth-utils",
+  "firebase-auth-helpers",
+  "clerk-auth-utils",
+  "auth0-helpers",
+  "passport-auth-helpers",
+  // Payments
+  "stripe-auth-helper",
+  "stripe-payment-helper",
+  "stripe-checkout-helper",
+  "stripe-webhook-utils",
+  "stripe-utils",
+  "paypal-checkout-helper",
+  // Utilities
+  "string-utils-pro",
+  "array-helpers-ts",
+  "object-deep-merge",
+  "config-loader-pro",
+  "api-response-handler",
+  "env-loader-utils",
+  "lodash-helpers",
+  "ramda-utils",
+  "underscore-helpers",
+  // AI / ML
+  "openai-helpers",
+  "openai-utils",
+  "anthropic-helpers",
+  "claude-helpers",
+  "langchain-helpers",
+  "langchain-utils",
+  "ai-sdk-helpers",
+  // Next.js
+  "next-seo-helper",
+  "next-middleware-helper",
+  "next-api-handler",
+  "next-server-utils",
+  "next-router-helpers",
+  "next-image-utils",
+  // React ecosystem
+  "react-query-helpers",
+  "react-store-helpers",
+  "react-form-validator",
+  "react-hook-form-validator",
+  "react-state-manager",
+  "react-context-utils",
+  "react-router-helpers",
+  "react-animation-utils",
+  "react-modal-helper",
+  // Database / ORM
+  "prisma-helpers",
+  "prisma-utils",
+  "drizzle-helpers",
+  "drizzle-utils",
+  "mongoose-helpers",
+  "sequelize-helpers",
+  "typeorm-utils",
+  // Server
+  "express-middleware-helper",
+  "express-validator-pro",
+  "fastify-helpers",
+  "koa-helpers",
+  "hono-utils",
+  // Misc
+  "jwt-handler",
+  "crypto-helpers",
+  "form-validation-utils",
+  "tailwind-merge-utils",
+  "clsx-merge",
+  "date-fns-utils",
+  "dayjs-helpers",
+  "zod-helpers",
+  "yup-utils",
+  "joi-helpers",
+  "ajv-utils",
+  "docker-helpers",
+  "kubernetes-utils",
+  "terraform-helpers",
+  "graphql-helpers",
+  "apollo-utils",
+  "trpc-helpers",
+  "socket-io-helpers",
+  "websocket-utils",
+  "redis-helpers",
+  "kafka-utils",
+  "rabbitmq-helpers",
+  "aws-sdk-helpers",
+  "gcp-utils",
+  "azure-helpers",
+  "testing-utils-pro",
+  "jest-helpers",
+  "vitest-utils",
+  "playwright-helpers",
+  "cypress-utils"
+]);
+var KNOWN_MALICIOUS_PACKAGES = /* @__PURE__ */ new Set([
+  "event-stream",
+  // Compromised in 2018 — flatmap-stream injection
+  "ua-parser-js",
+  // Compromised versions 0.7.29, 0.8.0, 1.0.0
+  "coa",
+  // Hijacked Nov 2021
+  "rc",
+  // Hijacked Nov 2021
+  "colors",
+  // Sabotaged by maintainer Jan 2022
+  "faker",
+  // Sabotaged by maintainer Jan 2022
+  "node-ipc",
+  // Protestware (peacenotwar) Mar 2022
+  "es5-ext",
+  // Protestware
+  "crossenv",
+  // Typosquat of cross-env
+  "mongose",
+  // Typosquat of mongoose
+  "babelcli",
+  // Typosquat of babel-cli
+  "eslint-scope",
+  // Compromised Jul 2018
+  "flatmap-stream",
+  // Malicious — injected into event-stream
+  "getcookies",
+  // Malicious backdoor
+  "mailparser",
+  // Typosquat versions
+  "http-proxy.js",
+  // Typosquat of http-proxy
+  "discordi.js",
+  // Typosquat of discord.js
+  "discord.jss",
+  "twilio-npm",
+  // Typosquat
+  "loadyaml",
+  // Malicious
+  "lodashs",
+  // Typosquat of lodash
+  "lodahs",
+  "@aspect-build/rules_js"
+  // Dependency confusion PoC
+]);
+var POPULAR_PACKAGES = [
+  // Core utilities
+  "lodash",
+  "underscore",
+  "ramda",
+  "date-fns",
+  "dayjs",
+  "moment",
+  "uuid",
+  "nanoid",
+  "chalk",
+  "debug",
+  "dotenv",
+  "cross-env",
+  "rimraf",
+  "glob",
+  "minimatch",
+  "semver",
+  "yargs",
+  "commander",
+  "inquirer",
+  // Type checking / validation
+  "zod",
+  "yup",
+  "joi",
+  "ajv",
+  "io-ts",
+  "superstruct",
+  "typebox",
+  // React
+  "react",
+  "react-dom",
+  "react-router",
+  "react-router-dom",
+  "react-hook-form",
+  "react-query",
+  "@tanstack/react-query",
+  "react-select",
+  "react-modal",
+  "react-table",
+  "react-spring",
+  "framer-motion",
+  "react-icons",
+  "react-toastify",
+  "react-dropzone",
+  // State management
+  "redux",
+  "zustand",
+  "jotai",
+  "recoil",
+  "mobx",
+  "valtio",
+  "immer",
+  // Next.js
+  "next",
+  "next-auth",
+  "@next/font",
+  "@next/image",
+  "next-seo",
+  // Styling
+  "tailwindcss",
+  "postcss",
+  "autoprefixer",
+  "sass",
+  "styled-components",
+  "@emotion/react",
+  "@emotion/styled",
+  "clsx",
+  "classnames",
+  "tailwind-merge",
+  // Build / bundling
+  "webpack",
+  "vite",
+  "esbuild",
+  "rollup",
+  "turbo",
+  "tsup",
+  "unbuild",
+  "typescript",
+  "babel",
+  "@babel/core",
+  // Testing
+  "jest",
+  "vitest",
+  "mocha",
+  "chai",
+  "sinon",
+  "cypress",
+  "playwright",
+  "@testing-library/react",
+  "@testing-library/jest-dom",
+  // Server
+  "express",
+  "fastify",
+  "koa",
+  "hono",
+  "h3",
+  "cors",
+  "helmet",
+  "body-parser",
+  "cookie-parser",
+  "morgan",
+  "compression",
+  // Database / ORM
+  "prisma",
+  "@prisma/client",
+  "drizzle-orm",
+  "mongoose",
+  "sequelize",
+  "typeorm",
+  "knex",
+  "pg",
+  "mysql2",
+  "better-sqlite3",
+  "redis",
+  "ioredis",
+  // Auth
+  "passport",
+  "jsonwebtoken",
+  "bcrypt",
+  "bcryptjs",
+  "argon2",
+  // HTTP
+  "axios",
+  "node-fetch",
+  "got",
+  "ky",
+  "superagent",
+  "undici",
+  // Linting
+  "eslint",
+  "prettier",
+  "stylelint",
+  "oxlint",
+  "biome",
+  // AI / ML
+  "openai",
+  "@anthropic-ai/sdk",
+  "langchain",
+  "@langchain/core",
+  "ai",
+  // Payments
+  "stripe",
+  "@stripe/stripe-js",
+  // Cloud
+  "aws-sdk",
+  "@aws-sdk/client-s3",
+  "firebase",
+  "@google-cloud/storage",
+  // Misc popular
+  "sharp",
+  "jimp",
+  "puppeteer",
+  "cheerio",
+  "pdf-lib",
+  "xlsx",
+  "nodemailer",
+  "bull",
+  "bullmq",
+  "socket.io",
+  "ws",
+  "graphql",
+  "@apollo/client",
+  "@apollo/server",
+  "@trpc/server",
+  "@trpc/client",
+  "pino",
+  "winston",
+  "bunyan",
+  "p-limit",
+  "p-queue",
+  "p-retry",
+  "execa",
+  "zx",
+  "msw",
+  "nock",
+  "supertest",
+  "docker-compose",
+  "dockerode"
+];
+var PROVIDED_MODULES = /* @__PURE__ */ new Set(["vscode", "electron", "deno"]);
+var DEFAULT_CONFIG = {
+  confidenceThreshold: 0.7,
+  registryConcurrency: 6,
+  registryTimeoutMs: 3e3,
+  registryCacheTtlMs: 36e5,
+  // 1 hour
+  registryNegativeTtlMs: 864e5,
+  // 24 hours
+  fsCacheTtlMs: 3e4,
+  // 30 seconds
+  enableTyposquatDetection: true,
+  typosquatMaxDistance: 2,
+  enableDepConfusionDetection: true,
+  enableLockfileAnalysis: true,
+  enableFileWatchers: false,
+  customRegistries: [],
+  additionalSafePackages: []
+};
+var LRUCache = class {
+  constructor(_maxSize = 2048, _defaultTtlMs = 6e4) {
+    this._maxSize = _maxSize;
+    this._defaultTtlMs = _defaultTtlMs;
+  }
+  _map = /* @__PURE__ */ new Map();
+  get(key) {
+    const entry = this._map.get(key);
+    if (!entry) return void 0;
+    if (Date.now() > entry.expiresAt) {
+      this._map.delete(key);
+      return void 0;
+    }
+    this._map.delete(key);
+    this._map.set(key, entry);
+    return entry.value;
+  }
+  set(key, value, ttlMs) {
+    if (this._map.has(key)) this._map.delete(key);
+    if (this._map.size >= this._maxSize) {
+      const oldest = this._map.keys().next().value;
+      if (oldest !== void 0) this._map.delete(oldest);
+    }
+    this._map.set(key, {
+      value,
+      expiresAt: Date.now() + (ttlMs ?? this._defaultTtlMs)
+    });
+  }
+  has(key) {
+    return this.get(key) !== void 0;
+  }
+  delete(key) {
+    this._map.delete(key);
+  }
+  clear() {
+    this._map.clear();
+  }
+  get size() {
+    return this._map.size;
+  }
+  /** Snapshot for persistence: [key, { value, expiresAt }][] */
+  entries() {
+    const now = Date.now();
+    return Array.from(this._map.entries()).filter(([, e]) => now <= e.expiresAt).map(([k, e]) => [k, { value: e.value, expiresAt: e.expiresAt }]);
+  }
+  /** Evict all expired entries */
+  prune() {
+    const now = Date.now();
+    let evicted = 0;
+    for (const [key, entry] of this._map) {
+      if (now > entry.expiresAt) {
+        this._map.delete(key);
+        evicted++;
+      }
+    }
+    return evicted;
+  }
+};
+var MONOREPO_DIR_ALIASES = /* @__PURE__ */ new Set([
+  "test",
+  "tests",
+  "src",
+  "lib",
+  "app",
+  "server",
+  "client",
+  "shared",
+  "common",
+  "utils",
+  "config",
+  "scripts",
+  "build",
+  "docs",
+  "helpers",
+  "fixtures",
+  "mocks",
+  "stubs",
+  "support",
+  "tools",
+  "internal",
+  "core",
+  "api",
+  "models",
+  "views",
+  "controllers",
+  "middleware",
+  "routes",
+  "schemas",
+  "types",
+  "components",
+  "pages",
+  "layouts",
+  "styles",
+  "assets",
+  "public",
+  "static",
+  "vendor",
+  "plugins",
+  "modules",
+  "features"
+]);
+function damerauLevenshtein(a, b, maxDist) {
+  const m = a.length;
+  const n = b.length;
+  if (Math.abs(m - n) > maxDist) return maxDist + 1;
+  if (a === b) return 0;
+  if (m === 0) return n;
+  if (n === 0) return m;
+  if (m === 1 && n === 1) return a === b ? 0 : 1;
+  const dp = Array.from({ length: m + 1 }, () => new Array(n + 1).fill(0));
+  for (let i = 0; i <= m; i++) dp[i][0] = i;
+  for (let j = 0; j <= n; j++) dp[0][j] = j;
+  for (let i = 1; i <= m; i++) {
+    let rowMin = Infinity;
+    for (let j = 1; j <= n; j++) {
+      const cost = a[i - 1] === b[j - 1] ? 0 : 1;
+      dp[i][j] = Math.min(
+        dp[i - 1][j] + 1,
+        // deletion
+        dp[i][j - 1] + 1,
+        // insertion
+        dp[i - 1][j - 1] + cost
+        // substitution
+      );
+      if (i > 1 && j > 1 && a[i - 1] === b[j - 2] && a[i - 2] === b[j - 1]) {
+        dp[i][j] = Math.min(dp[i][j], dp[i - 2][j - 2] + cost);
+      }
+      rowMin = Math.min(rowMin, dp[i][j]);
+    }
+    if (rowMin > maxDist) return maxDist + 1;
+  }
+  return dp[m][n];
+}
+function isVisuallyConfusable(candidate, real) {
+  const norm = (s) => s.replace(/[-_.]/g, "").toLowerCase();
+  if (norm(candidate) === norm(real) && candidate !== real) return true;
+  const homoglyphs = [
+    ["0", "o"],
+    ["1", "l"],
+    ["1", "i"],
+    ["rn", "m"],
+    ["vv", "w"],
+    ["cl", "d"],
+    ["nn", "m"]
+  ];
+  let normed = candidate.toLowerCase();
+  for (const [from, to] of homoglyphs) {
+    normed = normed.replaceAll(from, to);
+  }
+  if (normed === real.toLowerCase()) return true;
+  return false;
+}
+function isNpmLikePackageName(pkg) {
+  if (pkg.startsWith("@")) {
+    return /^@[a-z][a-z0-9._-]+\/[a-z]/.test(pkg);
+  }
+  return /^[a-z0-9][a-z0-9._-]*$/.test(pkg);
+}
+function findTyposquatMatch(pkg, maxDistance) {
+  if (pkg.length < 3) return null;
+  if (pkg.includes("/") && !pkg.startsWith("@")) return null;
+  if (!isNpmLikePackageName(pkg)) return null;
+  const isScoped = pkg.startsWith("@");
+  let bestMatch = null;
+  for (const real of POPULAR_PACKAGES) {
+    if (pkg === real) return null;
+    const realIsScoped = real.startsWith("@");
+    if (isScoped !== realIsScoped) continue;
+    if (Math.abs(pkg.length - real.length) > maxDistance) continue;
+    const dist = damerauLevenshtein(pkg, real, maxDistance);
+    const visual = isVisuallyConfusable(pkg, real);
+    if (dist <= maxDistance || visual) {
+      const effective = visual ? Math.min(dist, 1) : dist;
+      if (!bestMatch || effective < bestMatch.distance) {
+        bestMatch = {
+          realPackage: real,
+          distance: dist,
+          visuallyConfusable: visual
+        };
+      }
+    }
+  }
+  return bestMatch;
+}
+function detectLockfileType(workspaceRoot) {
+  const checks = [
+    { file: "pnpm-lock.yaml", type: "pnpm" },
+    { file: "bun.lockb", type: "bun" },
+    { file: "yarn.lock", type: "yarn-classic" },
+    // or berry — distinguished by content
+    { file: "package-lock.json", type: "npm" }
+  ];
+  for (const { file, type } of checks) {
+    const filePath = join(workspaceRoot, file);
+    if (existsSync(filePath)) {
+      try {
+        const stat = statSync(filePath);
+        return { type, path: filePath, packages: /* @__PURE__ */ new Set(), mtime: stat.mtimeMs };
+      } catch (err) {
+        if (process.env.VIBECHECK_DEBUG) {
+          console.warn(`[phantom_dep] statSync failed for ${filePath}:`, err instanceof Error ? err.message : err);
+        }
+        continue;
+      }
+    }
+  }
+  return null;
+}
+function parseLockfilePackages(info) {
+  const packages = /* @__PURE__ */ new Set();
+  try {
+    const content = readFileSync(info.path, "utf-8");
+    switch (info.type) {
+      case "npm": {
+        const lock = JSON.parse(content);
+        const pkgs = typeof lock === "object" && lock !== null ? lock.packages ?? lock.dependencies ?? {} : {};
+        if (typeof pkgs !== "object" || pkgs === null) break;
+        for (const key of Object.keys(pkgs)) {
+          const name = key.replace(/^node_modules\//, "");
+          if (name && !name.includes("node_modules/")) {
+            packages.add(name);
+          }
+        }
+        break;
+      }
+      case "yarn-classic":
+      case "yarn-berry": {
+        const lineRe = /^"?(@?[^@\s"]+)@/gm;
+        let m;
+        while ((m = lineRe.exec(content)) !== null) {
+          const name = m[1];
+          if (name && !name.startsWith("__")) packages.add(name);
+        }
+        break;
+      }
+      case "pnpm": {
+        const lineRe = /^\s+\/?(@?[^@/\s:]+(?:\/[^@/\s:]+)?)[@/]\d/gm;
+        let m;
+        while ((m = lineRe.exec(content)) !== null) {
+          if (m[1]) packages.add(m[1]);
+        }
+        const depRe = /^\s{2,8}(@?[\w][\w./-]*?):\s/gm;
+        while ((m = depRe.exec(content)) !== null) {
+          const name = m[1];
+          if (name && !name.startsWith("//") && name.includes("/") || /^@?[a-z]/.test(name)) {
+            packages.add(name);
+          }
+        }
+        break;
+      }
+      case "bun": {
+        break;
+      }
+    }
+  } catch {
+  }
+  return packages;
+}
+function resolveWorkspaceGlobs(root, globs) {
+  const dirs = [];
+  for (const glob of globs) {
+    const clean = glob.replace(/\/?\*\*?$/, "");
+    const base = join(root, clean);
+    if (!existsSync(base)) continue;
+    try {
+      const entries = readdirSync(base, { withFileTypes: true });
+      for (const entry of entries) {
+        if (entry.isDirectory() && !entry.name.startsWith(".") && entry.name !== "node_modules") {
+          const pkgPath = join(base, entry.name, "package.json");
+          if (existsSync(pkgPath)) {
+            dirs.push(join(base, entry.name));
+          }
+        }
+      }
+    } catch {
+    }
+  }
+  return dirs;
+}
+function loadWorkspaceInfo(root) {
+  const info = {
+    root,
+    packageDirs: [],
+    allPackageNames: /* @__PURE__ */ new Set(),
+    allDeps: /* @__PURE__ */ new Set(),
+    lockfile: null,
+    tsconfigAliases: /* @__PURE__ */ new Set(),
+    workspaceProtocol: /* @__PURE__ */ new Set(),
+    packageJsonImports: /* @__PURE__ */ new Set()
+  };
+  const rootPkgPath = join(root, "package.json");
+  if (existsSync(rootPkgPath)) {
+    try {
+      const rootPkg = JSON.parse(readFileSync(rootPkgPath, "utf-8"));
+      const workspaces = rootPkg.workspaces;
+      const globs = Array.isArray(workspaces) ? workspaces : Array.isArray(workspaces?.packages) ? workspaces.packages : null;
+      if (globs) {
+        info.packageDirs = resolveWorkspaceGlobs(root, globs);
+      }
+      collectDeps(rootPkg, info.allDeps, info.workspaceProtocol);
+      collectPackageJsonImports(rootPkg, info.packageJsonImports);
+    } catch {
+    }
+  }
+  const pnpmWs = join(root, "pnpm-workspace.yaml");
+  if (existsSync(pnpmWs) && info.packageDirs.length === 0) {
+    try {
+      const content = readFileSync(pnpmWs, "utf-8");
+      const globs = [];
+      const re = /^\s*-\s+['"]?([^'"#\n]+)/gm;
+      let m;
+      while ((m = re.exec(content)) !== null) {
+        globs.push(m[1].trim());
+      }
+      info.packageDirs = resolveWorkspaceGlobs(root, globs);
+    } catch {
+    }
+  }
+  if (info.packageDirs.length === 0) {
+    for (const subdir of ["packages", "apps", "libs", "modules", "services", "tools"]) {
+      const dir = join(root, subdir);
+      if (existsSync(dir)) {
+        try {
+          for (const entry of readdirSync(dir, { withFileTypes: true })) {
+            if (entry.isDirectory() && existsSync(join(dir, entry.name, "package.json"))) {
+              info.packageDirs.push(join(dir, entry.name));
+            }
+          }
+        } catch {
+        }
+      }
+    }
+  }
+  for (const dir of info.packageDirs) {
+    const pkgPath = join(dir, "package.json");
+    try {
+      const pkg = JSON.parse(readFileSync(pkgPath, "utf-8"));
+      if (pkg.name) info.allPackageNames.add(pkg.name);
+      collectDeps(pkg, info.allDeps, info.workspaceProtocol);
+      collectPackageJsonImports(pkg, info.packageJsonImports);
+    } catch {
+    }
+  }
+  info.lockfile = detectLockfileType(root);
+  if (info.lockfile) {
+    const lockPkgs = parseLockfilePackages(info.lockfile);
+    lockPkgs.forEach((p) => info.allDeps.add(p));
+    info.lockfile.packages = lockPkgs;
+  }
+  info.tsconfigAliases = loadTsconfigPaths(root);
+  return info;
+}
+function collectDeps(pkg, deps, wsProtocol) {
+  for (const section of ["dependencies", "devDependencies", "peerDependencies", "optionalDependencies"]) {
+    const sectionDeps = pkg[section];
+    if (!sectionDeps || typeof sectionDeps !== "object") continue;
+    for (const [name, version] of Object.entries(sectionDeps)) {
+      deps.add(name);
+      if (typeof version === "string" && version.startsWith("workspace:")) {
+        wsProtocol.add(name);
+      }
+    }
+  }
+}
+function collectPackageJsonImports(pkg, imports) {
+  const importsField = pkg.imports;
+  if (!importsField || typeof importsField !== "object") return;
+  for (const key of Object.keys(importsField)) {
+    const alias = key.replace(/\/?\*$/, "");
+    if (alias) imports.add(alias);
+  }
+}
+function loadTsconfigPaths(root, visited = /* @__PURE__ */ new Set()) {
+  const aliases = /* @__PURE__ */ new Set();
+  for (const file of ["tsconfig.json", "tsconfig.base.json", "jsconfig.json"]) {
+    const filePath = join(root, file);
+    if (!existsSync(filePath)) continue;
+    const resolvedPath = resolve(filePath);
+    if (visited.has(resolvedPath)) break;
+    visited.add(resolvedPath);
+    try {
+      let content = readFileSync(filePath, "utf-8");
+      content = content.replace(/\/\/.*$/gm, "").replace(/\/\*[\s\S]*?\*\//g, "");
+      content = content.replace(/,\s*([\]}])/g, "$1");
+      const config = JSON.parse(content);
+      const paths = config.compilerOptions?.paths ?? {};
+      for (const pattern of Object.keys(paths)) {
+        const alias = pattern.replace(/\/?\*$/, "");
+        if (alias) aliases.add(alias);
+      }
+      if (config.extends) {
+        const extPath = resolve(root, config.extends);
+        if (existsSync(extPath)) {
+          const extAliases = loadTsconfigPaths(dirname(extPath), visited);
+          extAliases.forEach((a) => aliases.add(a));
+        }
+      }
+    } catch {
+    }
+    break;
+  }
+  return aliases;
+}
+var RegistryClient = class {
+  constructor(_config) {
+    this._config = _config;
+    this._cache = new LRUCache(4096, _config.registryCacheTtlMs);
+    if (this._config.registryCachePath) {
+      this._loadFromDisk();
+    }
+  }
+  _cache;
+  _inflightRequests = /* @__PURE__ */ new Map();
+  _queue = [];
+  _activeRequests = 0;
+  _persistTimer = null;
+  _loadFromDisk() {
+    const p = this._config.registryCachePath;
+    if (!existsSync(p)) return;
+    try {
+      const raw = readFileSync(p, "utf-8");
+      const data = JSON.parse(raw);
+      const now = Date.now();
+      for (const [pkg, entry] of Object.entries(data)) {
+        if (entry.expiresAt > now) {
+          const ttl = entry.expiresAt - now;
+          this._cache.set(pkg, entry.exists, ttl);
+        }
+      }
+    } catch {
+    }
+  }
+  _schedulePersist() {
+    if (!this._config.registryCachePath) return;
+    if (this._persistTimer) return;
+    this._persistTimer = setTimeout(() => {
+      this._persistTimer = null;
+      this._persistToDisk();
+    }, 500);
+  }
+  _persistToDisk() {
+    const p = this._config.registryCachePath;
+    try {
+      const entries = this._cache.entries();
+      const data = {};
+      for (const [k, e] of entries) {
+        data[k] = { exists: e.value, expiresAt: e.expiresAt };
+      }
+      const dir = dirname(p);
+      if (!existsSync(dir)) mkdirSync(dir, { recursive: true });
+      writeFileSync(p, JSON.stringify(data), "utf-8");
+    } catch {
+    }
+  }
+  /** Wait for all in-flight registry requests and queue to drain. */
+  async waitForIdle() {
+    while (this._queue.length > 0 || this._inflightRequests.size > 0) {
+      const promises = Array.from(this._inflightRequests.values());
+      if (promises.length > 0) {
+        await Promise.all(promises);
+      } else {
+        await new Promise((r) => setTimeout(r, 5));
+      }
+    }
+  }
+  /** Flush pending persist immediately (e.g. on engine dispose). */
+  flushPersist() {
+    if (this._persistTimer) {
+      clearTimeout(this._persistTimer);
+      this._persistTimer = null;
+    }
+    if (this._config.registryCachePath) this._persistToDisk();
+  }
+  /**
+   * Check if a package exists on the registry.
+   * Returns immediately if cached; otherwise queues an async check.
+   */
+  check(pkg) {
+    const cached = this._cache.get(pkg);
+    if (cached !== void 0) {
+      return { exists: cached, checkedAt: Date.now(), fromCache: true };
+    }
+    this._enqueue(pkg);
+    return null;
+  }
+  /**
+   * Await a definitive answer for a specific package.
+   */
+  async checkAsync(pkg) {
+    const cached = this._cache.get(pkg);
+    if (cached !== void 0) {
+      return { exists: cached, checkedAt: Date.now(), fromCache: true };
+    }
+    const exists = await this._fetchSingle(pkg);
+    return { exists, checkedAt: Date.now(), fromCache: false };
+  }
+  /**
+   * Batch check — resolves when all packages are checked.
+   * Deduplicates concurrent requests for the same package via _inflightRequests.
+   */
+  async batchCheck(packages) {
+    const results = /* @__PURE__ */ new Map();
+    const uncached = [];
+    for (const pkg of packages) {
+      const cached = this._cache.get(pkg);
+      if (cached !== void 0) {
+        results.set(pkg, cached);
+      } else if (this._inflightRequests.has(pkg)) {
+        const exists = await this._inflightRequests.get(pkg);
+        results.set(pkg, exists);
+      } else {
+        uncached.push(pkg);
+      }
+    }
+    if (uncached.length === 0) return results;
+    const batches = [];
+    for (let i = 0; i < uncached.length; i += this._config.registryConcurrency) {
+      batches.push(uncached.slice(i, i + this._config.registryConcurrency));
+    }
+    for (const batch of batches) {
+      const batchResults = await Promise.allSettled(
+        batch.map(async (pkg) => {
+          const promise = this._fetchSingle(pkg).finally(() => {
+            this._inflightRequests.delete(pkg);
+          });
+          this._inflightRequests.set(pkg, promise);
+          const exists = await promise;
+          return { pkg, exists };
+        })
+      );
+      for (const result of batchResults) {
+        if (result.status === "fulfilled") {
+          results.set(result.value.pkg, result.value.exists);
+        }
+      }
+    }
+    return results;
+  }
+  _enqueue(pkg) {
+    if (this._inflightRequests.has(pkg)) return;
+    this._queue.push(pkg);
+    this._processQueue();
+  }
+  _processQueue() {
+    while (this._queue.length > 0 && this._activeRequests < this._config.registryConcurrency) {
+      const pkg = this._queue.shift();
+      if (this._cache.has(pkg) || this._inflightRequests.has(pkg)) continue;
+      this._activeRequests++;
+      const promise = this._fetchSingle(pkg).finally(() => {
+        this._activeRequests--;
+        this._inflightRequests.delete(pkg);
+        this._processQueue();
+      });
+      this._inflightRequests.set(pkg, promise);
+    }
+  }
+  async _fetchSingle(pkg) {
+    const registries = ["https://registry.npmjs.org", ...this._config.customRegistries];
+    for (const registry of registries) {
+      try {
+        const exists = await this._fetchWithRetry(pkg, registry);
+        const ttl = exists ? this._config.registryCacheTtlMs : this._config.registryNegativeTtlMs;
+        this._cache.set(pkg, exists, ttl);
+        this._schedulePersist();
+        return exists;
+      } catch {
+        this._cache.set(pkg, true, 6e4);
+        this._schedulePersist();
+        return true;
+      }
+    }
+    return true;
+  }
+  async _fetchWithRetry(pkg, registry) {
+    const maxRetries = 3;
+    const baseDelay = 1e3;
+    let lastError = null;
+    for (let attempt = 1; attempt <= maxRetries; attempt++) {
+      try {
+        const url = `${registry}/${pkg.startsWith("@") ? pkg : encodeURIComponent(pkg)}`;
+        const controller = new AbortController();
+        const timer = setTimeout(() => controller.abort(), this._config.registryTimeoutMs);
+        const response = await fetch(url, {
+          method: "HEAD",
+          signal: controller.signal,
+          headers: { Accept: "application/vnd.npm.install-v1+json" }
+        });
+        clearTimeout(timer);
+        return response.status === 200;
+      } catch (error) {
+        lastError = error instanceof Error ? error : new Error(String(error));
+        if (lastError.name === "AbortError" || lastError instanceof TypeError && lastError.message.includes("fetch")) {
+          throw lastError;
+        }
+        if (attempt === maxRetries) {
+          throw lastError;
+        }
+        const delay = baseDelay * Math.pow(2, attempt - 1) + Math.random() * 500;
+        await new Promise((resolve2) => setTimeout(resolve2, delay));
+      }
+    }
+    throw lastError || new Error("Max retries exceeded");
+  }
+  get cacheSize() {
+    return this._cache.size;
+  }
+  clearCache() {
+    this._cache.clear();
+  }
+};
+function computeConfidence(ctx) {
+  const signals = [];
+  let score = 0;
+  if (ctx.inKnownFakeList) {
+    signals.push({ source: "known_fake_list", weight: 0.5, detail: "Package is in the known-hallucinated-packages database" });
+    score += 0.5;
+  }
+  if (ctx.inMaliciousList) {
+    signals.push({ source: "known_malicious", weight: 0.55, detail: "Package is in the known-malicious-packages database" });
+    score += 0.55;
+  }
+  if (ctx.registryExists === false) {
+    signals.push({ source: "registry_404", weight: 0.45, detail: "npm registry returned 404 \u2014 package not found" });
+    score += 0.45;
+  }
+  if (ctx.typosquatMatch) {
+    const typoWeight = ctx.typosquatMatch.visuallyConfusable ? 0.3 : 0.2;
+    signals.push({
+      source: "typosquat",
+      weight: typoWeight,
+      detail: `Edit distance ${ctx.typosquatMatch.distance} from "${ctx.typosquatMatch.realPackage}"${ctx.typosquatMatch.visuallyConfusable ? " (visually confusable)" : ""}`
+    });
+    score += typoWeight;
+  }
+  if (!ctx.inPackageJson) {
+    signals.push({ source: "not_in_package_json", weight: 0.15, detail: "Not declared in any package.json" });
+    score += 0.15;
+  }
+  if (!ctx.inNodeModules) {
+    signals.push({ source: "not_in_node_modules", weight: 0.1, detail: "Not found in node_modules" });
+    score += 0.1;
+  }
+  if (!ctx.inLockfile) {
+    signals.push({ source: "not_in_lockfile", weight: 0.1, detail: "Not present in lockfile" });
+    score += 0.1;
+  }
+  if (ctx.inPackageJson) {
+    signals.push({ source: "in_package_json", weight: -0.4, detail: "Declared in package.json" });
+    score -= 0.4;
+  }
+  if (ctx.inNodeModules) {
+    signals.push({ source: "in_node_modules", weight: -0.35, detail: "Found in node_modules" });
+    score -= 0.35;
+  }
+  if (ctx.inLockfile) {
+    signals.push({ source: "in_lockfile", weight: -0.3, detail: "Present in lockfile" });
+    score -= 0.3;
+  }
+  if (ctx.registryExists === true && !ctx.inKnownFakeList && !ctx.inMaliciousList) {
+    signals.push({ source: "registry_200", weight: -0.45, detail: "npm registry confirms package exists" });
+    score -= 0.45;
+  }
+  return { score: Math.max(0, Math.min(1, score)), signals };
+}
+function classifyCategory(ctx) {
+  if (ctx.inMaliciousList) return "known_malicious";
+  if (ctx.typosquatMatch && ctx.registryExists === false) return "typosquat";
+  if (ctx.isScopedPackage && ctx.hasPrivateScope && ctx.registryExists === true) return "dep_confusion";
+  if (ctx.registryExists === true && !ctx.inPackageJson) return "undeclared_dep";
+  return "phantom_dep";
+}
+function classifySeverity(category, confidence) {
+  if (category === "known_malicious") return "critical";
+  if (category === "phantom_dep" && confidence >= 0.9) return "critical";
+  if (category === "typosquat") return "high";
+  if (category === "dep_confusion") return "high";
+  if (category === "phantom_dep" && confidence >= 0.75) return "high";
+  if (category === "undeclared_dep") return "medium";
+  return "low";
+}
+function ruleIdFor(category) {
+  switch (category) {
+    case "phantom_dep":
+      return "PHANTOM-001";
+    case "typosquat":
+      return "TYPO-001";
+    case "dep_confusion":
+      return "DEPCONF-001";
+    case "known_malicious":
+      return "MALWARE-001";
+    case "undeclared_dep":
+      return "UNDECL-001";
+    case "hallucinated_api":
+      return "HALAPI-001";
+    default:
+      return "UNKNOWN-001";
+  }
+}
+function messageFor(category, pkg, typoMatch) {
+  switch (category) {
+    case "phantom_dep":
+      return `\`${pkg}\` is a hallucinated package \u2014 does not exist on npm. Likely invented by an AI coding assistant.`;
+    case "typosquat":
+      return `\`${pkg}\` appears to be a typosquat of \`${typoMatch?.realPackage}\` (edit distance: ${typoMatch?.distance}). Did you mean \`${typoMatch?.realPackage}\`?`;
+    case "dep_confusion":
+      return `\`${pkg}\` uses a private scope but a package with this name exists on the public npm registry. Potential dependency confusion attack vector.`;
+    case "known_malicious":
+      return `\`${pkg}\` is a known malicious package. Remove it immediately and audit your lockfile for compromised versions.`;
+    case "undeclared_dep":
+      return `\`${pkg}\` exists on npm but is not declared in package.json. This import relies on phantom hoisting and will break in strict package managers (pnpm).`;
+    case "hallucinated_api":
+      return `\`${pkg}\` exists but the imported API does not match its exports. The import may have been hallucinated by an AI coding assistant.`;
+    default:
+      return `\`${pkg}\` \u2014 unclassified dependency issue.`;
+  }
+}
+function suggestionFor(category, pkg, typoMatch) {
+  switch (category) {
+    case "phantom_dep":
+      return `Verify this package exists at https://www.npmjs.com/package/${pkg}. This name is commonly hallucinated by AI tools \u2014 search npm for the real equivalent.`;
+    case "typosquat":
+      return `Replace with the correct package: \`${typoMatch?.realPackage}\`. Run: npm install ${typoMatch?.realPackage}`;
+    case "dep_confusion":
+      return `Configure your .npmrc to scope this package to your private registry. Add: @${pkg.split("/")[0]?.slice(1)}:registry=https://your-private-registry.com`;
+    case "known_malicious":
+      return `Run: npm uninstall ${pkg} && npm audit. Check https://socket.dev/npm/package/${pkg} for the security advisory.`;
+    case "undeclared_dep":
+      return `Add to package.json: npm install ${pkg}. Undeclared deps fail in pnpm/yarn PnP strict mode.`;
+    case "hallucinated_api":
+      return `Check the package README for correct import syntax: https://www.npmjs.com/package/${pkg}`;
+    default:
+      return `Review this dependency.`;
+  }
+}
+var PhantomDepEngine = class {
+  constructor(_workspaceRoot, configOrThreshold = {}) {
+    this._workspaceRoot = _workspaceRoot;
+    const config = typeof configOrThreshold === "number" ? { confidenceThreshold: configOrThreshold } : configOrThreshold;
+    this._config = { ...DEFAULT_CONFIG, ...config };
+    this._registry = new RegistryClient(this._config);
+    this._fsCache = new LRUCache(512, this._config.fsCacheTtlMs);
+    this._loadWorkspace();
+  }
+  id = "phantom_dep";
+  _config;
+  _workspace = null;
+  _registry;
+  _fsCache;
+  _watchedFiles = /* @__PURE__ */ new Set();
+  _stats = {
+    scansCompleted: 0,
+    findingsTotal: 0,
+    cacheHitRate: 0,
+    avgScanMs: 0,
+    registryChecks: 0,
+    registryCacheSize: 0
+  };
+  _eventEmitter = new EventEmitter();
+  _cacheHits = 0;
+  _cacheMisses = 0;
+  _scanTimesMs = [];
+  /**
+   * NPM phantom checks only apply to JS/TS. Python/Go profiles exist for workspace classification;
+   * PyPI/proxy wiring must not call the npm registry with module names.
+   */
+  _extractImports(delta, source) {
+    const profile = getLanguageProfile(delta) ?? javascriptLanguageProfile;
+    if (profile.id !== "javascript") return [];
+    return profile.extractImportSpecifiers(source, delta.lines);
+  }
+  // ── Public API ──
+  /**
+   * Scan for phantom dependencies with standardized error handling
+   */
+  async scan(delta, signal) {
+    return withEngineErrorHandling(
+      () => this._scanInternal(delta, signal),
+      createContext(this.id, delta.documentUri)
+    );
+  }
+  async _scanInternal(delta, signal) {
+    if (signal?.aborted) return [];
+    const source = delta.fullText;
+    if (!source.includes("import") && !source.includes("require")) return [];
+    const startMs = performance.now();
+    const fileUri = delta.documentUri;
+    const filePath = fileUri.replace(/^file:\/\//, "");
+    this._eventEmitter.emit("scan:start", { fileUri });
+    const langProfile = getLanguageProfile(delta);
+    if (langProfile !== null && langProfile.id !== "javascript") {
+      const durationMs2 = performance.now() - startMs;
+      this._recordScan(0, durationMs2);
+      this._eventEmitter.emit("scan:complete", { fileUri, findingsCount: 0, durationMs: durationMs2 });
+      return [];
+    }
+    const imports = this._extractImports(delta, source);
+    const findings = [];
+    const localDeps = this._loadFileDeps(filePath);
+    for (const imp of imports) {
+      if (signal?.aborted) break;
+      const pkg = imp.packageName;
+      if (PROVIDED_MODULES.has(pkg)) continue;
+      if (pkg.startsWith("@types/")) continue;
+      if (this._config.additionalSafePackages.includes(pkg)) continue;
+      if (this._isAlias(pkg)) continue;
+      const inPackageJson = localDeps.has(pkg) || (this._workspace?.allDeps.has(pkg) ?? false);
+      const inWorkspace = this._workspace?.allPackageNames.has(pkg) ?? false;
+      const inLockfile = this._workspace?.lockfile?.packages.has(pkg) ?? false;
+      const inNodeModules = this._checkNodeModules(pkg);
+      if (inPackageJson || inWorkspace) continue;
+      if (inLockfile && inNodeModules) continue;
+      const inKnownFakeList = KNOWN_FAKE_PACKAGES.has(pkg);
+      const inMaliciousList = KNOWN_MALICIOUS_PACKAGES.has(pkg);
+      const registryResult = this._registry.check(pkg);
+      const registryExists = registryResult?.exists ?? null;
+      const typosquatMatch = this._config.enableTyposquatDetection ? findTyposquatMatch(pkg, this._config.typosquatMaxDistance) : null;
+      const scoringCtx = {
+        inKnownFakeList,
+        inMaliciousList,
+        inPackageJson,
+        inNodeModules,
+        inLockfile,
+        registryExists,
+        typosquatMatch,
+        isScopedPackage: pkg.startsWith("@"),
+        hasPrivateScope: false
+        // TODO: detect from .npmrc / org config
+      };
+      const { score: confidence, signals } = computeConfidence(scoringCtx);
+      if (confidence < this._config.confidenceThreshold) continue;
+      const category = classifyCategory(scoringCtx);
+      const severity = classifySeverity(category, confidence);
+      const finding = {
+        id: deterministicId(fileUri, imp.line, imp.column, category, pkg),
+        engine: "phantom_dep",
+        severity,
+        category,
+        file: fileUri,
+        line: imp.line,
+        column: imp.column,
+        message: messageFor(category, pkg, typosquatMatch ?? void 0),
+        evidence: imp.code,
+        suggestion: suggestionFor(category, pkg, typosquatMatch ?? void 0),
+        confidence,
+        autoFixable: category === "typosquat" || category === "undeclared_dep",
+        ruleId: ruleIdFor(category),
+        signals,
+        similarTo: typosquatMatch?.realPackage,
+        editDistance: typosquatMatch?.distance
+      };
+      findings.push(finding);
+      this._eventEmitter.emit("finding", finding);
+    }
+    const durationMs = performance.now() - startMs;
+    this._recordScan(findings.length, durationMs);
+    this._eventEmitter.emit("scan:complete", { fileUri, findingsCount: findings.length, durationMs });
+    return findings;
+  }
+  /**
+   * Deep async scan — waits for all registry checks to resolve.
+   * Use for CI/CD pipelines where latency is acceptable.
+   */
+  async deepScan(delta, signal) {
+    if (signal?.aborted) return [];
+    const startMs = performance.now();
+    const fileUri = delta.documentUri;
+    const filePath = fileUri.replace(/^file:\/\//, "");
+    this._eventEmitter.emit("scan:start", { fileUri });
+    const langProfile = getLanguageProfile(delta);
+    if (langProfile !== null && langProfile.id !== "javascript") {
+      const durationMs2 = performance.now() - startMs;
+      this._recordScan(0, durationMs2);
+      this._eventEmitter.emit("scan:complete", { fileUri, findingsCount: 0, durationMs: durationMs2 });
+      return [];
+    }
+    const imports = this._extractImports(delta, delta.fullText);
+    const findings = [];
+    const localDeps = this._loadFileDeps(filePath);
+    const toCheck = [];
+    for (const imp of imports) {
+      const pkg = imp.packageName;
+      if (PROVIDED_MODULES.has(pkg) || pkg.startsWith("@types/")) continue;
+      if (this._config.additionalSafePackages.includes(pkg)) continue;
+      if (this._isAlias(pkg)) continue;
+      const inPackageJson = localDeps.has(pkg) || (this._workspace?.allDeps.has(pkg) ?? false);
+      const inWorkspace = this._workspace?.allPackageNames.has(pkg) ?? false;
+      if (inPackageJson || inWorkspace) continue;
+      toCheck.push(imp);
+    }
+    const registryResults = await this._registry.batchCheck(
+      toCheck.map((i) => i.packageName)
+    );
+    for (const imp of toCheck) {
+      if (signal?.aborted) break;
+      const pkg = imp.packageName;
+      const inNodeModules = this._checkNodeModules(pkg);
+      const inLockfile = this._workspace?.lockfile?.packages.has(pkg) ?? false;
+      const registryExists = registryResults.get(pkg) ?? null;
+      const inKnownFakeList = KNOWN_FAKE_PACKAGES.has(pkg);
+      const inMaliciousList = KNOWN_MALICIOUS_PACKAGES.has(pkg);
+      const typosquatMatch = this._config.enableTyposquatDetection ? findTyposquatMatch(pkg, this._config.typosquatMaxDistance) : null;
+      const scoringCtx = {
+        inKnownFakeList,
+        inMaliciousList,
+        inPackageJson: false,
+        inNodeModules,
+        inLockfile,
+        registryExists,
+        typosquatMatch,
+        isScopedPackage: pkg.startsWith("@"),
+        hasPrivateScope: false
+      };
+      const { score: confidence, signals } = computeConfidence(scoringCtx);
+      if (confidence < this._config.confidenceThreshold) continue;
+      const category = classifyCategory(scoringCtx);
+      const severity = classifySeverity(category, confidence);
+      const finding = {
+        id: deterministicId(fileUri, imp.line, imp.column, category, pkg),
+        engine: "phantom_dep",
+        severity,
+        category,
+        file: fileUri,
+        line: imp.line,
+        column: imp.column,
+        message: messageFor(category, pkg, typosquatMatch ?? void 0),
+        evidence: imp.code,
+        suggestion: suggestionFor(category, pkg, typosquatMatch ?? void 0),
+        confidence,
+        autoFixable: category === "typosquat" || category === "undeclared_dep",
+        ruleId: ruleIdFor(category),
+        signals,
+        similarTo: typosquatMatch?.realPackage,
+        editDistance: typosquatMatch?.distance
+      };
+      findings.push(finding);
+      this._eventEmitter.emit("finding", finding);
+    }
+    const durationMs = performance.now() - startMs;
+    this._recordScan(findings.length, durationMs);
+    this._eventEmitter.emit("scan:complete", { fileUri, findingsCount: findings.length, durationMs });
+    return findings;
+  }
+  /** Refresh all caches and re-read workspace info */
+  refresh() {
+    this._fsCache.clear();
+    this._loadWorkspace();
+    this._eventEmitter.emit("cache:invalidate", { reason: "manual refresh" });
+  }
+  /** Update engine configuration at runtime */
+  updateConfig(config) {
+    this._config = { ...this._config, ...config };
+    if (config.registryConcurrency || config.registryTimeoutMs || config.customRegistries) {
+      this._registry = new RegistryClient(this._config);
+    }
+  }
+  /** Get engine performance stats */
+  getStats() {
+    return {
+      ...this._stats,
+      cacheHitRate: this._cacheHits + this._cacheMisses > 0 ? this._cacheHits / (this._cacheHits + this._cacheMisses) : 0,
+      avgScanMs: this._scanTimesMs.length > 0 ? this._scanTimesMs.reduce((a, b) => a + b, 0) / this._scanTimesMs.length : 0,
+      registryCacheSize: this._registry.cacheSize
+    };
+  }
+  /** Cleanup watchers and caches */
+  async prepareDispose() {
+    await this._registry.waitForIdle();
+    this._registry.flushPersist();
+  }
+  dispose() {
+    this._registry.flushPersist();
+    for (const file of this._watchedFiles) {
+      try {
+        unwatchFile(file);
+      } catch {
+      }
+    }
+    this._watchedFiles.clear();
+    this._fsCache.clear();
+    this._registry.clearCache();
+    this._eventEmitter.removeAllListeners();
+  }
+  // ── Private ──
+  _loadWorkspace() {
+    this._workspace = loadWorkspaceInfo(this._workspaceRoot);
+    if (this._config.enableFileWatchers) {
+      this._setupFileWatchers();
+    }
+  }
+  _setupFileWatchers() {
+    const rootPkg = join(this._workspaceRoot, "package.json");
+    if (existsSync(rootPkg)) {
+      this._watch(rootPkg);
+    }
+    if (this._workspace?.lockfile) {
+      this._watch(this._workspace.lockfile.path);
+    }
+    for (const dir of this._workspace?.packageDirs ?? []) {
+      const pkgPath = join(dir, "package.json");
+      if (existsSync(pkgPath)) {
+        this._watch(pkgPath);
+      }
+    }
+  }
+  _watch(filePath) {
+    if (this._watchedFiles.has(filePath)) return;
+    this._watchedFiles.add(filePath);
+    watchFile(filePath, { interval: 5e3 }, () => {
+      this._fsCache.clear();
+      this._loadWorkspace();
+      this._emit({ type: "cache:invalidate", reason: `${filePath} changed` });
+    });
+  }
+  _loadFileDeps(filePath) {
+    let dir = dirname(filePath);
+    for (let depth = 0; depth < 10; depth++) {
+      const pkgPath = join(dir, "package.json");
+      const cacheKey = `deps:${pkgPath}`;
+      const cached = this._fsCache.get(cacheKey);
+      if (cached) {
+        this._cacheHits++;
+        return cached;
+      }
+      if (existsSync(pkgPath)) {
+        this._cacheMisses++;
+        const deps = /* @__PURE__ */ new Set();
+        try {
+          const pkg = JSON.parse(readFileSync(pkgPath, "utf-8"));
+          collectDeps(pkg, deps, /* @__PURE__ */ new Set());
+        } catch (err) {
+          if (process.env.VIBECHECK_DEBUG) {
+            console.warn(`[phantom_dep] readFileSync package.json failed for ${pkgPath}:`, err instanceof Error ? err.message : err);
+          }
+        }
+        this._fsCache.set(cacheKey, deps);
+        return deps;
+      }
+      const parent = dirname(dir);
+      if (parent === dir) break;
+      dir = parent;
+    }
+    return /* @__PURE__ */ new Set();
+  }
+  _checkNodeModules(pkg) {
+    const cacheKey = `nm:${pkg}`;
+    const cached = this._fsCache.get(cacheKey);
+    if (cached !== void 0) {
+      this._cacheHits++;
+      return cached.size > 0;
+    }
+    this._cacheMisses++;
+    let dir = this._workspaceRoot;
+    for (let depth = 0; depth < 6; depth++) {
+      if (existsSync(join(dir, "node_modules", pkg))) {
+        this._fsCache.set(cacheKey, /* @__PURE__ */ new Set(["found"]));
+        return true;
+      }
+      const parent = dirname(dir);
+      if (parent === dir) break;
+      dir = parent;
+    }
+    this._fsCache.set(cacheKey, /* @__PURE__ */ new Set());
+    return false;
+  }
+  _isAlias(pkg) {
+    if (!this._workspace) return false;
+    for (const alias of this._workspace.tsconfigAliases) {
+      if (pkg === alias || pkg.startsWith(alias + "/") || pkg.startsWith(alias)) return true;
+    }
+    for (const imp of this._workspace.packageJsonImports) {
+      if (pkg === imp || pkg.startsWith(imp + "/")) return true;
+    }
+    if (this._workspace.workspaceProtocol.has(pkg)) return true;
+    if (this._workspace.allPackageNames.has(pkg)) return true;
+    const rootSegment = pkg.includes("/") && !pkg.startsWith("@") ? pkg.split("/")[0] : pkg;
+    if (MONOREPO_DIR_ALIASES.has(rootSegment)) {
+      try {
+        const dirPath = join(this._workspaceRoot, rootSegment);
+        if (existsSync(dirPath) && statSync(dirPath).isDirectory()) return true;
+      } catch {
+      }
+      if (this._workspace) {
+        for (const pkgDir of this._workspace.packageDirs) {
+          try {
+            const subDirPath = join(pkgDir, rootSegment);
+            if (existsSync(subDirPath) && statSync(subDirPath).isDirectory()) return true;
+          } catch {
+          }
+        }
+      }
+    }
+    if (pkg.startsWith("@")) {
+      const scope = pkg.split("/")[0];
+      for (const wsName of this._workspace.allPackageNames) {
+        if (wsName.startsWith(scope + "/")) return true;
+      }
+    }
+    return false;
+  }
+  _emit(event) {
+    this._eventEmitter.emit(event.type, event);
+  }
+  _recordScan(findings, durationMs) {
+    this._stats.scansCompleted++;
+    this._stats.findingsTotal += findings;
+    this._scanTimesMs.push(durationMs);
+    if (this._scanTimesMs.length > 100) {
+      this._scanTimesMs = this._scanTimesMs.slice(-100);
+    }
+  }
+};
+var _internals = {
+  extractImports: extractJavaScriptNpmImports,
+  extractPackageName,
+  isRelativeOrAlias,
+  isNpmLikePackageName,
+  damerauLevenshtein,
+  findTyposquatMatch,
+  isVisuallyConfusable,
+  computeConfidence,
+  classifyCategory,
+  parseLockfilePackages,
+  loadWorkspaceInfo,
+  collectPackageJsonImports,
+  KNOWN_FAKE_PACKAGES,
+  KNOWN_MALICIOUS_PACKAGES,
+  POPULAR_PACKAGES,
+  MONOREPO_DIR_ALIASES
+};
+
+export { EngineError, EngineErrorCode, PhantomDepEngine, _internals, createContext, extractPythonPypiImports, getLanguageProfile, goLanguageProfile, isEngineError, javascriptLanguageProfile, pythonLanguageProfile, withEngineErrorHandling };