@vibgrate/cli 2026.817.2 → 2026.818.2

package/dist/{chunk-3H3SVJUY.js → chunk-RHKOUPWT.js}

@@ -1,474 +1,16 @@
+import { inventory, installedTreeVersion } from './chunk-6BEBJCK4.js';
 import { findNodes } from './chunk-J7LKEB2R.js';
-import { extractLiteralNeedles, residualForSymbolSearch } from './chunk-Q4G2BWE3.js';
+import { extractLiteralNeedles, residualForSymbolSearch } from './chunk-MRZHNUN7.js';
 import { stableStringify } from './chunk-O3LABX6I.js';
 import { hashString } from './chunk-JFGYT6BI.js';
-import * as fs3 from 'fs';
-import * as path3 from 'path';
+import * as fs2 from 'fs';
 import * as os from 'os';
+import * as path2 from 'path';
 import { execFileSync, spawnSync } from 'child_process';
 import { Worker } from 'worker_threads';
 
-var ECOSYSTEMS = ["npm", "pypi", "go", "rust", "ruby", "php", "dotnet", "swift", "dart", "java"];
-function inventory(root) {
-  const manifests = findManifests(root);
-  const records = [];
-  records.push(...npmDeps(manifests.npm, root));
-  records.push(...pypiDeps(manifests.pypi));
-  records.push(...goDeps(manifests.go));
-  records.push(...cargoDeps(manifests.rust));
-  records.push(...rubyDeps(manifests.ruby));
-  records.push(...phpDeps(manifests.php));
-  records.push(...dotnetDeps(manifests.dotnet));
-  records.push(...swiftDeps(manifests.swift));
-  records.push(...dartDeps(manifests.dart));
-  records.push(...javaDeps(manifests.java));
-  const seen = /* @__PURE__ */ new Set();
-  const deduped = records.filter((r) => {
-    const key = `${r.ecosystem}\0${r.name}`;
-    if (seen.has(key)) return false;
-    seen.add(key);
-    return true;
-  });
-  deduped.sort((a, b) => a.ecosystem.localeCompare(b.ecosystem) || a.name.localeCompare(b.name));
-  const counts = { total: deduped.length };
-  for (const e of ECOSYSTEMS) counts[e] = 0;
-  for (const r of deduped) counts[r.ecosystem]++;
-  return { records: deduped, counts };
-}
-var SKIP_DIRS = /* @__PURE__ */ new Set([
-  "node_modules",
-  ".git",
-  "dist",
-  "build",
-  "out",
-  ".vibgrate",
-  "vendor",
-  ".venv",
-  "venv",
-  "env",
-  "__pycache__",
-  "target",
-  ".next",
-  ".nuxt",
-  "coverage",
-  ".cache"
-]);
-var MANIFEST_BY_FILE = {
-  "package.json": "npm",
-  "requirements.txt": "pypi",
-  "pyproject.toml": "pypi",
-  "go.mod": "go",
-  "Cargo.toml": "rust",
-  Gemfile: "ruby",
-  "composer.json": "php",
-  "Package.swift": "swift",
-  "pubspec.yaml": "dart",
-  "pom.xml": "java",
-  "build.gradle": "java",
-  "build.gradle.kts": "java"
-};
-function findManifests(root) {
-  const set = Object.fromEntries(ECOSYSTEMS.map((e) => [e, []]));
-  const MAX_ENTRIES = 2e4;
-  let scanned = 0;
-  const walk = (dir, depth) => {
-    if (depth > 8 || scanned > MAX_ENTRIES) return;
-    let entries;
-    try {
-      entries = fs3.readdirSync(dir, { withFileTypes: true });
-    } catch {
-      return;
-    }
-    for (const e of entries) {
-      scanned++;
-      if (scanned > MAX_ENTRIES) break;
-      if (e.isDirectory()) {
-        if (!SKIP_DIRS.has(e.name) && !e.name.startsWith(".")) walk(path3.join(dir, e.name), depth + 1);
-        continue;
-      }
-      const eco = MANIFEST_BY_FILE[e.name] ?? (/\.(cs|fs)proj$/i.test(e.name) ? "dotnet" : void 0);
-      if (eco) set[eco].push(path3.join(dir, e.name));
-    }
-  };
-  walk(root, 0);
-  for (const e of ECOSYSTEMS) set[e].sort();
-  return set;
-}
-function npmDeps(files, root) {
-  const out = [];
-  for (const file of files) {
-    let pkg;
-    try {
-      pkg = JSON.parse(fs3.readFileSync(file, "utf8"));
-    } catch {
-      continue;
-    }
-    const dir = path3.dirname(file);
-    const all = { ...pkg.dependencies, ...pkg.devDependencies };
-    for (const [name, declared] of Object.entries(all)) {
-      out.push({ name, ecosystem: "npm", declared, installed: installedNpmVersion(dir, name, root) });
-    }
-  }
-  return out;
-}
-function installedNpmVersion(dir, name, root) {
-  const rootResolved = path3.resolve(root);
-  let cur = path3.resolve(dir);
-  for (let i = 0; i < 12; i++) {
-    const p = path3.join(cur, "node_modules", name, "package.json");
-    try {
-      return JSON.parse(fs3.readFileSync(p, "utf8")).version;
-    } catch {
-    }
-    if (cur === rootResolved) break;
-    const parent = path3.dirname(cur);
-    if (parent === cur) break;
-    cur = parent;
-  }
-  return void 0;
-}
-function installedTreeVersion(root, ecosystem, name) {
-  if (ecosystem === "pypi") return installedPypiVersion(root, name);
-  if (ecosystem === "php") return installedPhpVersion(root, name);
-  return void 0;
-}
-function normalizePep503(name) {
-  return name.trim().toLowerCase().replace(/[-_.]+/g, "-");
-}
-function sitePackagesDirs(base) {
-  const out = [];
-  try {
-    for (const d of fs3.readdirSync(path3.join(base, "lib"))) {
-      if (d.startsWith("python")) out.push(path3.join(base, "lib", d, "site-packages"));
-    }
-  } catch {
-  }
-  out.push(path3.join(base, "Lib", "site-packages"));
-  return out;
-}
-function installedPypiVersion(root, name) {
-  const target = normalizePep503(name);
-  for (const venv of [".venv", "venv", "env", ".tox"]) {
-    for (const sp of sitePackagesDirs(path3.join(root, venv))) {
-      let entries;
-      try {
-        entries = fs3.readdirSync(sp);
-      } catch {
-        continue;
-      }
-      for (const entry of entries) {
-        const m = /^(.+?)-(\d[^-]*)\.dist-info$/.exec(entry);
-        if (m && normalizePep503(m[1]) === target) return m[2];
-      }
-    }
-  }
-  return void 0;
-}
-function installedPhpVersion(root, name) {
-  let data;
-  try {
-    data = JSON.parse(fs3.readFileSync(path3.join(root, "vendor", "composer", "installed.json"), "utf8"));
-  } catch {
-    return void 0;
-  }
-  const pkgs = Array.isArray(data) ? data : data.packages;
-  if (!Array.isArray(pkgs)) return void 0;
-  const p = pkgs.find((x) => x && typeof x === "object" && x.name === name);
-  return typeof p?.version === "string" ? p.version.replace(/^v/, "") : void 0;
-}
-function pypiDeps(files) {
-  const byName = /* @__PURE__ */ new Map();
-  const add = (name, declared) => {
-    const clean = name.trim().replace(/\[.*\]$/, "");
-    if (!clean || clean.toLowerCase() === "python") return;
-    if (!byName.has(clean)) byName.set(clean, { name: clean, ecosystem: "pypi", declared: declared.trim() || "*" });
-  };
-  for (const file of files) {
-    let text;
-    try {
-      text = fs3.readFileSync(file, "utf8");
-    } catch {
-      continue;
-    }
-    if (path3.basename(file) === "requirements.txt") {
-      for (const line of text.split("\n")) {
-        const t = line.trim();
-        if (!t || t.startsWith("#") || t.startsWith("-")) continue;
-        const m = /^([A-Za-z0-9._-]+(?:\[[^\]]*\])?)\s*([<>=!~).*]+.*)?$/.exec(t);
-        if (m) add(m[1], m[2] ?? "*");
-      }
-    } else {
-      for (const dep of pep621Dependencies(text)) {
-        const m = /^([A-Za-z0-9._-]+(?:\[[^\]]*\])?)\s*(.*)$/.exec(dep.trim());
-        if (m) add(m[1], m[2] ?? "*");
-      }
-      for (const [name, spec] of poetryDependencies(text)) add(name, spec);
-    }
-  }
-  return [...byName.values()];
-}
-function pep621Dependencies(text) {
-  const section = sectionBody(text, "project");
-  if (!section) return [];
-  const start = /dependencies\s*=\s*\[/.exec(section);
-  if (!start) return [];
-  let depth = 0;
-  let inStr = false;
-  let strCh = "";
-  const out = [];
-  let cur = "";
-  for (let i = start.index + start[0].length - 1; i < section.length; i++) {
-    const ch = section[i];
-    if (inStr) {
-      if (ch === strCh) {
-        out.push(cur);
-        inStr = false;
-      } else cur += ch;
-      continue;
-    }
-    if (ch === '"' || ch === "'") {
-      inStr = true;
-      strCh = ch;
-      cur = "";
-    } else if (ch === "[") depth++;
-    else if (ch === "]") {
-      depth--;
-      if (depth === 0) break;
-    }
-  }
-  return out;
-}
-function poetryDependencies(text) {
-  const out = [];
-  const lines = text.split("\n");
-  let inDeps = false;
-  for (const raw of lines) {
-    const line = raw.trim();
-    if (line.startsWith("[")) {
-      inDeps = /^\[tool\.poetry(\.group\.[^.\]]+)?\.dependencies\]$/.test(line);
-      continue;
-    }
-    if (!inDeps || !line || line.startsWith("#")) continue;
-    const m = /^([A-Za-z0-9._-]+)\s*=\s*["']([^"']*)["']/.exec(line);
-    if (m) out.push([m[1], m[2] || "*"]);
-  }
-  return out;
-}
-function sectionBody(text, name) {
-  const lines = text.split("\n");
-  let capturing = false;
-  const body = [];
-  for (const raw of lines) {
-    const line = raw.trim();
-    if (/^\[/.test(line)) {
-      if (capturing) break;
-      capturing = line === `[${name}]`;
-      continue;
-    }
-    if (capturing) body.push(raw);
-  }
-  return capturing || body.length ? body.join("\n") : null;
-}
-function goDeps(files) {
-  const out = [];
-  for (const mod of files) {
-    let text;
-    try {
-      text = fs3.readFileSync(mod, "utf8");
-    } catch {
-      continue;
-    }
-    const re = /^\s*(?:require\s+)?([\w./-]+)\s+v(\S+)/gm;
-    let m;
-    while (m = re.exec(text)) {
-      if (m[1] === "go" || m[1] === "require" || m[1].startsWith("module")) continue;
-      out.push({ name: m[1], ecosystem: "go", declared: `v${m[2]}` });
-    }
-  }
-  return out;
-}
-function cargoDeps(files) {
-  const out = [];
-  for (const file of files) {
-    let text;
-    try {
-      text = fs3.readFileSync(file, "utf8");
-    } catch {
-      continue;
-    }
-    for (const table of ["dependencies", "dev-dependencies", "build-dependencies"]) {
-      const body = sectionBody(text, table);
-      if (!body) continue;
-      for (const raw of body.split("\n")) {
-        const line = raw.trim();
-        if (!line || line.startsWith("#")) continue;
-        const m = /^([A-Za-z0-9._-]+)\s*=\s*(.+)$/.exec(line);
-        if (!m) continue;
-        const rhs = m[2].trim();
-        let declared = "*";
-        if (rhs.startsWith('"')) {
-          const sm = /^"([^"]+)"/.exec(rhs);
-          if (sm) declared = sm[1];
-        } else if (rhs.startsWith("{")) {
-          const vm = /version\s*=\s*"([^"]+)"/.exec(rhs);
-          if (vm) declared = vm[1];
-        }
-        out.push({ name: m[1], ecosystem: "rust", declared });
-      }
-    }
-  }
-  return out;
-}
-function rubyDeps(files) {
-  const out = [];
-  for (const file of files) {
-    let text;
-    try {
-      text = fs3.readFileSync(file, "utf8");
-    } catch {
-      continue;
-    }
-    const re = /^\s*gem\s+["']([^"']+)["']\s*(?:,\s*["']([^"']+)["'])?/gm;
-    let m;
-    while (m = re.exec(text)) out.push({ name: m[1], ecosystem: "ruby", declared: m[2] ?? "*" });
-  }
-  return out;
-}
-function phpDeps(files) {
-  const out = [];
-  for (const file of files) {
-    let pkg;
-    try {
-      pkg = JSON.parse(fs3.readFileSync(file, "utf8"));
-    } catch {
-      continue;
-    }
-    const all = { ...pkg.require, ...pkg["require-dev"] };
-    for (const [name, declared] of Object.entries(all)) {
-      if (!name.includes("/")) continue;
-      out.push({ name, ecosystem: "php", declared });
-    }
-  }
-  return out;
-}
-function dotnetDeps(files) {
-  const out = [];
-  for (const file of files) {
-    let text;
-    try {
-      text = fs3.readFileSync(file, "utf8");
-    } catch {
-      continue;
-    }
-    const tagRe = /<PackageReference\b[^>]*>/gi;
-    let m;
-    while (m = tagRe.exec(text)) {
-      const inc = /Include\s*=\s*"([^"]+)"/i.exec(m[0]);
-      if (!inc) continue;
-      const ver = /Version\s*=\s*"([^"]+)"/i.exec(m[0]);
-      out.push({ name: inc[1], ecosystem: "dotnet", declared: ver?.[1] ?? "*" });
-    }
-  }
-  return out;
-}
-function swiftDeps(files) {
-  const out = [];
-  for (const file of files) {
-    let text;
-    try {
-      text = fs3.readFileSync(file, "utf8");
-    } catch {
-      continue;
-    }
-    const re = /\.package\(/g;
-    let m;
-    while (m = re.exec(text)) {
-      const win = text.slice(m.index, m.index + 200);
-      const urlM = /url:\s*"([^"]+)"/.exec(win);
-      if (!urlM) continue;
-      const name = (urlM[1].replace(/\.git$/, "").split("/").filter(Boolean).pop() ?? urlM[1]).toLowerCase();
-      const verM = /"(\d+\.\d+(?:\.\d+)?)"/.exec(win.slice(urlM.index + urlM[0].length));
-      out.push({ name, ecosystem: "swift", declared: verM?.[1] ?? "*" });
-    }
-  }
-  return out;
-}
-function dartDeps(files) {
-  const out = [];
-  for (const file of files) {
-    let text;
-    try {
-      text = fs3.readFileSync(file, "utf8");
-    } catch {
-      continue;
-    }
-    let section = "";
-    for (const raw of text.split("\n")) {
-      const top = /^([a-z_]+):\s*$/.exec(raw);
-      if (top) {
-        section = top[1];
-        continue;
-      }
-      if (section !== "dependencies" && section !== "dev_dependencies") continue;
-      const m = /^  ([A-Za-z0-9_.]+):\s*(\S.*)?$/.exec(raw);
-      if (!m || m[1] === "flutter" || m[1] === "sdk") continue;
-      const declared = (m[2] ?? "").replace(/^["']|["']$/g, "").trim() || "*";
-      out.push({ name: m[1], ecosystem: "dart", declared });
-    }
-  }
-  return out;
-}
-function javaDeps(files) {
-  const out = [];
-  for (const file of files) {
-    let text;
-    try {
-      text = fs3.readFileSync(file, "utf8");
-    } catch {
-      continue;
-    }
-    if (path3.basename(file) === "pom.xml") {
-      for (const block of text.match(/<dependency>[\s\S]*?<\/dependency>/g) ?? []) {
-        const g = /<groupId>([^<]+)<\/groupId>/.exec(block);
-        const a = /<artifactId>([^<]+)<\/artifactId>/.exec(block);
-        if (!g || !a) continue;
-        const v = /<version>([^<]+)<\/version>/.exec(block);
-        const declared = v ? v[1].trim().startsWith("${") ? "*" : v[1].trim() : "*";
-        out.push({ name: `${g[1].trim()}:${a[1].trim()}`, ecosystem: "java", declared });
-      }
-    } else {
-      const re = /(?:implementation|api|compileOnly|runtimeOnly|testImplementation|testRuntimeOnly|annotationProcessor)\s*[(]?\s*["']([\w.-]+):([\w.-]+):([^"']+)["']/g;
-      let m;
-      while (m = re.exec(text)) out.push({ name: `${m[1]}:${m[2]}`, ecosystem: "java", declared: m[3] });
-    }
-  }
-  return out;
-}
-async function enrichOnline(records, fetchImpl = globalThis.fetch) {
-  for (const r of records) {
-    if (r.ecosystem !== "npm" || !r.installed) continue;
-    try {
-      const res = await fetchImpl(`https://registry.npmjs.org/${encodeURIComponent(r.name)}/latest`);
-      if (!res.ok) continue;
-      const data = await res.json();
-      r.latest = data.version;
-      r.drift = classify(r.installed, r.latest);
-    } catch {
-      r.drift = "unknown";
-    }
-  }
-}
-function classify(installed, latest) {
-  if (!latest) return "unknown";
-  const a = installed.split(".").map(Number);
-  const b = latest.split(".").map(Number);
-  if (a[0] !== b[0]) return "major";
-  if (a[1] !== b[1]) return "minor";
-  if (a[2] !== b[2]) return "patch";
-  return "current";
-}
 function lockfileVersion(root, ecosystem, name) {
-  if (ecosystem === "npm") return packageLockVersion(root, name) ?? yarnLockVersion(root, name);
+  if (ecosystem === "npm") return packageLockVersion(root, name) ?? pnpmLockVersion(root, name) ?? yarnLockVersion(root, name);
   if (ecosystem === "pypi") return pypiLockVersion(root, name);
   if (ecosystem === "rust") return tomlPackageLock(root, "Cargo.lock", name, rustName);
   if (ecosystem === "ruby") return gemfileLock(root, name);
@@ -482,7 +24,7 @@ function lockfileVersion(root, ecosystem, name) {
 function gradleLock(root, name) {
   let text;
   try {
-    text = fs3.readFileSync(path3.join(root, "gradle.lockfile"), "utf8");
+    text = fs2.readFileSync(path2.join(root, "gradle.lockfile"), "utf8");
   } catch {
     return void 0;
   }
@@ -492,7 +34,7 @@ function gradleLock(root, name) {
 function packageResolved(root, name) {
   let data;
   try {
-    data = JSON.parse(fs3.readFileSync(path3.join(root, "Package.resolved"), "utf8"));
+    data = JSON.parse(fs2.readFileSync(path2.join(root, "Package.resolved"), "utf8"));
   } catch {
     return void 0;
   }
@@ -508,7 +50,7 @@ function packageResolved(root, name) {
 function pubspecLock(root, name) {
   let text;
   try {
-    text = fs3.readFileSync(path3.join(root, "pubspec.lock"), "utf8");
+    text = fs2.readFileSync(path2.join(root, "pubspec.lock"), "utf8");
   } catch {
     return void 0;
   }
@@ -532,7 +74,7 @@ function escapeRegExp(s) {
 function gemfileLock(root, name) {
   let text;
   try {
-    text = fs3.readFileSync(path3.join(root, "Gemfile.lock"), "utf8");
+    text = fs2.readFileSync(path2.join(root, "Gemfile.lock"), "utf8");
   } catch {
     return void 0;
   }
@@ -542,7 +84,7 @@ function gemfileLock(root, name) {
 function composerLock(root, name) {
   let data;
   try {
-    data = JSON.parse(fs3.readFileSync(path3.join(root, "composer.lock"), "utf8"));
+    data = JSON.parse(fs2.readFileSync(path2.join(root, "composer.lock"), "utf8"));
   } catch {
     return void 0;
   }
@@ -557,7 +99,7 @@ function composerLock(root, name) {
 function packagesLock(root, name) {
   let data;
   try {
-    data = JSON.parse(fs3.readFileSync(path3.join(root, "packages.lock.json"), "utf8"));
+    data = JSON.parse(fs2.readFileSync(path2.join(root, "packages.lock.json"), "utf8"));
   } catch {
     return void 0;
   }
@@ -582,7 +124,7 @@ function pypiLockVersion(root, name) {
 function tomlPackageLock(root, file, name, normalize) {
   let text;
   try {
-    text = fs3.readFileSync(path3.join(root, file), "utf8");
+    text = fs2.readFileSync(path2.join(root, file), "utf8");
   } catch {
     return void 0;
   }
@@ -599,7 +141,7 @@ function tomlPackageLock(root, file, name, normalize) {
 function pipfileLock(root, name) {
   let data;
   try {
-    data = JSON.parse(fs3.readFileSync(path3.join(root, "Pipfile.lock"), "utf8"));
+    data = JSON.parse(fs2.readFileSync(path2.join(root, "Pipfile.lock"), "utf8"));
   } catch {
     return void 0;
   }
@@ -618,7 +160,7 @@ function pipfileLock(root, name) {
 function packageLockVersion(root, name) {
   let data;
   try {
-    data = JSON.parse(fs3.readFileSync(path3.join(root, "package-lock.json"), "utf8"));
+    data = JSON.parse(fs2.readFileSync(path2.join(root, "package-lock.json"), "utf8"));
   } catch {
     return void 0;
   }
@@ -627,10 +169,33 @@ function packageLockVersion(root, name) {
   const v1 = data.dependencies?.[name]?.version;
   return typeof v1 === "string" ? v1 : void 0;
 }
+function pnpmLockVersion(root, name) {
+  let text;
+  try {
+    text = fs2.readFileSync(path2.join(root, "pnpm-lock.yaml"), "utf8");
+  } catch {
+    return void 0;
+  }
+  const importers = sectionOf(text, "importers");
+  if (!importers) return void 0;
+  const key = escapeRegExp(name);
+  const re = new RegExp(`^\\s+'?${key}'?:\\s*$\\n\\s+specifier:.*$\\n\\s+version:\\s*(\\S+)\\s*$`, "m");
+  const m = re.exec(importers);
+  if (!m?.[1]) return void 0;
+  const version = m[1].replace(/\(.*$/, "").trim();
+  return version || void 0;
+}
+function sectionOf(text, key) {
+  const start = new RegExp(`^${key}:\\s*$`, "m").exec(text);
+  if (!start) return void 0;
+  const from = start.index + start[0].length;
+  const next = /^\S[^\n]*:\s*$/m.exec(text.slice(from));
+  return next ? text.slice(from, from + next.index) : text.slice(from);
+}
 function yarnLockVersion(root, name) {
   let text;
   try {
-    text = fs3.readFileSync(path3.join(root, "yarn.lock"), "utf8");
+    text = fs2.readFileSync(path2.join(root, "yarn.lock"), "utf8");
   } catch {
     return void 0;
   }
@@ -658,19 +223,19 @@ function headerNamesPackage(header, name) {
 // src/engine/lib.ts
 var LIB_SCHEMA = "vg-lib/1.0";
 function catalogPath(root) {
-  return path3.join(root, "vibgrate.lib.json");
+  return path2.join(root, "vibgrate.lib.json");
 }
 function libDir(root) {
-  return path3.join(root, ".vibgrate", "lib");
+  return path2.join(root, ".vibgrate", "lib");
 }
 function libId(name) {
   return name.trim().toLowerCase().replace(/^@/, "").replace(/[^a-z0-9]+/g, "-").replace(/(^-|-$)/g, "");
 }
 function loadCatalog(root) {
   const file = catalogPath(root);
-  if (fs3.existsSync(file)) {
+  if (fs2.existsSync(file)) {
     try {
-      const data = JSON.parse(fs3.readFileSync(file, "utf8"));
+      const data = JSON.parse(fs2.readFileSync(file, "utf8"));
       if (data.schemaVersion === LIB_SCHEMA && data.libraries) return data;
     } catch {
     }
@@ -678,7 +243,7 @@ function loadCatalog(root) {
   return { schemaVersion: LIB_SCHEMA, libraries: {} };
 }
 function saveCatalog(root, catalog) {
-  fs3.writeFileSync(catalogPath(root), `${stableStringify(catalog, 2)}
+  fs2.writeFileSync(catalogPath(root), `${stableStringify(catalog, 2)}
 `);
 }
 function resolveLib(catalog, name) {
@@ -688,8 +253,8 @@ function resolveLib(catalog, name) {
   const all = Object.values(catalog.libraries);
   return all.find((e) => e.name.toLowerCase() === lower) ?? all.find((e) => e.id.includes(id) || e.name.toLowerCase().includes(lower));
 }
-function installedVersion(root, name) {
-  const rec = inventory(root).records.find((r) => r.name === name);
+function installedVersion(root, name, inv) {
+  const rec = (inv ?? inventory(root)).records.find((r) => r.name === name);
   return rec?.installed ?? rec?.declared;
 }
 var stripRange = (v) => v?.replace(/^[v^~>=<\s]+/, "");
@@ -710,8 +275,8 @@ function resolveVersion(root, name) {
   const source = lockfile ? "lockfile" : installed ? "installed" : declared ? "declared" : "unknown";
   return { served, source, lockfile, installed, declared, mismatch };
 }
-function driftFor(root, entry) {
-  const installed = installedVersion(root, entry.name);
+function driftFor(root, entry, inv) {
+  const installed = installedVersion(root, entry.name, inv);
   if (!installed || entry.version === "*") return { cataloged: entry.version, installed, drift: "unknown" };
   const norm = (v) => v.replace(/^[v^~>=<\s]+/, "");
   const a = norm(entry.version);
@@ -754,23 +319,23 @@ async function addLibrary(source, opts) {
     content = await res.text();
     type = source.endsWith("llms.txt") ? "llms.txt" : source.endsWith(".json") ? "openapi" : "website";
   } else {
-    const abs = path3.resolve(root, source);
-    if (!fs3.existsSync(abs)) throw new Error(`source not found: ${source}`);
+    const abs = path2.resolve(root, source);
+    if (!fs2.existsSync(abs)) throw new Error(`source not found: ${source}`);
     content = readLocal(abs);
     type = "local";
   }
   const name = opts.name ?? inferName(source);
   const id = libId(name);
   const version = opts.version ?? installedVersion(root, name) ?? "*";
-  fs3.mkdirSync(libDir(root), { recursive: true });
-  const docFileAbs = path3.join(libDir(root), `${id}.md`);
-  fs3.writeFileSync(docFileAbs, content);
+  fs2.mkdirSync(libDir(root), { recursive: true });
+  const docFileAbs = path2.join(libDir(root), `${id}.md`);
+  fs2.writeFileSync(docFileAbs, content);
   const entry = {
     id,
     name,
     version,
     source: { type, location: source },
-    docFile: path3.relative(root, docFileAbs).split(path3.sep).join("/"),
+    docFile: path2.relative(root, docFileAbs).split(path2.sep).join("/"),
     docHash: hashString(content),
     bytes: Buffer.byteLength(content, "utf8")
   };
@@ -780,15 +345,15 @@ async function addLibrary(source, opts) {
   return entry;
 }
 function readDoc(root, entry) {
-  const abs = path3.resolve(root, entry.docFile);
-  return fs3.existsSync(abs) ? fs3.readFileSync(abs, "utf8") : "";
+  const abs = path2.resolve(root, entry.docFile);
+  return fs2.existsSync(abs) ? fs2.readFileSync(abs, "utf8") : "";
 }
 function npmPackageDir(root, name) {
   let cur = root;
   for (let i = 0; i < 12; i++) {
-    const dir = path3.join(cur, "node_modules", name);
-    if (fs3.existsSync(path3.join(dir, "package.json"))) return dir;
-    const parent = path3.dirname(cur);
+    const dir = path2.join(cur, "node_modules", name);
+    if (fs2.existsSync(path2.join(dir, "package.json"))) return dir;
+    const parent = path2.dirname(cur);
     if (parent === cur) break;
     cur = parent;
   }
@@ -796,21 +361,21 @@ function npmPackageDir(root, name) {
 }
 var README_CANDIDATES = ["llms.txt", "README.md", "README.mdx", "README", "readme.md"];
 function packageDocsMarkdown(dir, query) {
-  const docsDir = path3.join(dir, "docs");
-  if (!fs3.existsSync(docsDir) || !fs3.statSync(docsDir).isDirectory()) return void 0;
+  const docsDir = path2.join(dir, "docs");
+  if (!fs2.existsSync(docsDir) || !fs2.statSync(docsDir).isDirectory()) return void 0;
   const files = [];
   const walk = (d, depth) => {
     if (depth > 3 || files.length >= 40) return;
     let entries;
     try {
-      entries = fs3.readdirSync(d, { withFileTypes: true });
+      entries = fs2.readdirSync(d, { withFileTypes: true });
     } catch {
       return;
     }
     entries.sort((a, b) => a.name.localeCompare(b.name));
     for (const e of entries) {
       if (files.length >= 40) return;
-      const full = path3.join(d, e.name);
+      const full = path2.join(d, e.name);
       if (e.isDirectory()) {
         if (e.name.startsWith(".") || e.name === "node_modules") continue;
         walk(full, depth + 1);
@@ -825,22 +390,22 @@ function packageDocsMarkdown(dir, query) {
   const scored = files.map((f) => {
     let body = "";
     try {
-      body = fs3.readFileSync(f, "utf8");
+      body = fs2.readFileSync(f, "utf8");
     } catch {
       return { f, body: "", score: -1 };
     }
-    const lc = `${path3.basename(f)}
+    const lc = `${path2.basename(f)}
 ${body}`.toLowerCase();
     const score = terms.length ? terms.filter((t) => lc.includes(t)).length : 1;
     return { f, body, score };
   });
   const picked = (terms.length ? scored.filter((s) => s.score > 0).sort((a, b) => b.score - a.score || a.f.localeCompare(b.f)) : scored).filter((s) => s.body.trim()).slice(0, terms.length ? 8 : 5);
   if (!picked.length) return void 0;
-  const text = picked.map((s) => `<!-- ${path3.relative(dir, s.f).split(path3.sep).join("/")} -->
+  const text = picked.map((s) => `<!-- ${path2.relative(dir, s.f).split(path2.sep).join("/")} -->
 ${s.body.trim()}`).join("\n\n");
   return {
     text,
-    files: picked.map((s) => path3.relative(dir, s.f).split(path3.sep).join("/"))
+    files: picked.map((s) => path2.relative(dir, s.f).split(path2.sep).join("/"))
   };
 }
 function localPackageDocs(root, name, opts) {
@@ -849,11 +414,11 @@ function localPackageDocs(root, name, opts) {
   const version = resolveVersion(root, name).served;
   let primary;
   for (const f of README_CANDIDATES) {
-    const p = path3.join(dir, f);
+    const p = path2.join(dir, f);
     try {
-      const docs = fs3.readFileSync(p, "utf8");
+      const docs = fs2.readFileSync(p, "utf8");
       if (docs.trim()) {
-        primary = { docs, source: path3.relative(root, p).split(path3.sep).join("/") };
+        primary = { docs, source: path2.relative(root, p).split(path2.sep).join("/") };
         break;
       }
     } catch {
@@ -879,19 +444,19 @@ ${extra.text}`,
     return {
       docs: extra.text,
       version,
-      source: path3.relative(root, path3.join(dir, "docs")).split(path3.sep).join("/") + "/",
+      source: path2.relative(root, path2.join(dir, "docs")).split(path2.sep).join("/") + "/",
       readmeOnly: false
     };
   }
   try {
-    const pkg = JSON.parse(fs3.readFileSync(path3.join(dir, "package.json"), "utf8"));
+    const pkg = JSON.parse(fs2.readFileSync(path2.join(dir, "package.json"), "utf8"));
     if (pkg.description?.trim()) {
       return {
         docs: `# ${name}
 
 ${pkg.description}`,
         version: version ?? pkg.version,
-        source: path3.relative(root, path3.join(dir, "package.json")).split(path3.sep).join("/"),
+        source: path2.relative(root, path2.join(dir, "package.json")).split(path2.sep).join("/"),
         readmeOnly: true
       };
     }
@@ -902,8 +467,8 @@ ${pkg.description}`,
 function typesFromPkg(dir, pkg) {
   const tryRel = (rel) => {
     if (typeof rel !== "string") return void 0;
-    const p = path3.join(dir, rel);
-    return fs3.existsSync(p) ? p : void 0;
+    const p = path2.join(dir, rel);
+    return fs2.existsSync(p) ? p : void 0;
   };
   const top = tryRel(pkg.types) ?? tryRel(pkg.typings);
   if (top) return top;
@@ -936,7 +501,7 @@ function typesFromPkg(dir, pkg) {
 }
 function dtsEntry(dir) {
   try {
-    const pkg = JSON.parse(fs3.readFileSync(path3.join(dir, "package.json"), "utf8"));
+    const pkg = JSON.parse(fs2.readFileSync(path2.join(dir, "package.json"), "utf8"));
     const fromPkg = typesFromPkg(dir, pkg);
     if (fromPkg) return fromPkg;
   } catch {
@@ -949,8 +514,8 @@ function dtsEntry(dir) {
     "types/index.d.ts",
     "build/index.d.ts"
   ]) {
-    const p = path3.join(dir, c);
-    if (fs3.existsSync(p)) return p;
+    const p = path2.join(dir, c);
+    if (fs2.existsSync(p)) return p;
   }
   return void 0;
 }
@@ -962,7 +527,7 @@ function collectDtsFiles(dir) {
     if (depth > 4 || out.length >= MAX_DTS_FILES) return;
     let entries;
     try {
-      entries = fs3.readdirSync(d, { withFileTypes: true });
+      entries = fs2.readdirSync(d, { withFileTypes: true });
     } catch {
       return;
     }
@@ -970,7 +535,7 @@ function collectDtsFiles(dir) {
     for (const e of entries) {
       if (out.length >= MAX_DTS_FILES) return;
       if (e.name === "node_modules" || e.name.startsWith(".")) continue;
-      const full = path3.join(d, e.name);
+      const full = path2.join(d, e.name);
       if (e.isDirectory()) walk(full, depth + 1);
       else if (e.isFile() && /\.d\.(ts|mts|cts)$/.test(e.name)) out.push(full);
     }
@@ -1026,9 +591,9 @@ function localApiSurface(root, name, query) {
   for (const f of files) {
     let src;
     try {
-      const st = fs3.statSync(f);
+      const st = fs2.statSync(f);
       if (st.size > MAX_DTS_BYTES) continue;
-      src = fs3.readFileSync(f, "utf8");
+      src = fs2.readFileSync(f, "utf8");
     } catch {
       continue;
     }
@@ -1073,36 +638,36 @@ function localApiSurface(root, name, query) {
   return allDecls.slice(0, 80).join("\n\n");
 }
 function cloneAndReadGit(url) {
-  const dir = fs3.mkdtempSync(path3.join(os.tmpdir(), "vg-lib-git-"));
+  const dir = fs2.mkdtempSync(path2.join(os.tmpdir(), "vg-lib-git-"));
   try {
     execFileSync("git", ["clone", "--depth", "1", "--quiet", url, dir], {
       stdio: ["ignore", "ignore", "pipe"]
     });
   } catch (err) {
-    fs3.rmSync(dir, { recursive: true, force: true });
+    fs2.rmSync(dir, { recursive: true, force: true });
     const detail = err instanceof Error && err.message ? `: ${err.message.split("\n")[0]}` : "";
     throw new Error(`git clone failed for ${url}${detail}`);
   }
   try {
     return readGitDocs(dir);
   } finally {
-    fs3.rmSync(dir, { recursive: true, force: true });
+    fs2.rmSync(dir, { recursive: true, force: true });
   }
 }
 function readGitDocs(dir) {
-  const docsDir = path3.join(dir, "docs");
-  if (fs3.existsSync(docsDir) && fs3.statSync(docsDir).isDirectory()) return readLocal(docsDir);
-  const readme = ["README.md", "README.mdx", "README.txt", "README.rst", "readme.md"].map((f) => path3.join(dir, f)).find((p) => fs3.existsSync(p));
-  if (readme) return fs3.readFileSync(readme, "utf8");
+  const docsDir = path2.join(dir, "docs");
+  if (fs2.existsSync(docsDir) && fs2.statSync(docsDir).isDirectory()) return readLocal(docsDir);
+  const readme = ["README.md", "README.mdx", "README.txt", "README.rst", "readme.md"].map((f) => path2.join(dir, f)).find((p) => fs2.existsSync(p));
+  if (readme) return fs2.readFileSync(readme, "utf8");
   return readLocal(dir);
 }
 function readLocal(abs) {
-  const stat = fs3.statSync(abs);
-  if (stat.isFile()) return fs3.readFileSync(abs, "utf8");
+  const stat = fs2.statSync(abs);
+  if (stat.isFile()) return fs2.readFileSync(abs, "utf8");
   const parts = [];
-  const files = fs3.readdirSync(abs, { withFileTypes: true }).filter((e) => e.isFile() && /\.(md|mdx|txt|rst)$/i.test(e.name)).map((e) => e.name).sort();
+  const files = fs2.readdirSync(abs, { withFileTypes: true }).filter((e) => e.isFile() && /\.(md|mdx|txt|rst)$/i.test(e.name)).map((e) => e.name).sort();
   for (const f of files) parts.push(`<!-- ${f} -->
-${fs3.readFileSync(path3.join(abs, f), "utf8")}`);
+${fs2.readFileSync(path2.join(abs, f), "utf8")}`);
   return parts.join("\n\n");
 }
 function inferName(source) {
@@ -1144,7 +709,7 @@ function measure(root, files) {
   for (const rel of files) {
     let size;
     try {
-      size = fs3.statSync(path3.join(root, rel)).size;
+      size = fs2.statSync(path2.join(root, rel)).size;
     } catch {
       continue;
     }
@@ -1167,9 +732,9 @@ function matchLines(text, needleLower) {
 }
 function readCandidate(abs, knownSize) {
   try {
-    const size = knownSize ?? fs3.statSync(abs).size;
+    const size = knownSize ?? fs2.statSync(abs).size;
     if (size > MAX_FILE_BYTES) return null;
-    const text = fs3.readFileSync(abs, "utf8");
+    const text = fs2.readFileSync(abs, "utf8");
     return text.includes(NUL) ? null : text;
   } catch {
     return null;
@@ -1180,7 +745,7 @@ function scanInline(root, files, needleLower, cap, stopAtCap, sizes) {
   let total = 0;
   let truncated = false;
   for (const rel of files) {
-    const text = readCandidate(path3.join(root, rel), sizes?.get(rel));
+    const text = readCandidate(path2.join(root, rel), sizes?.get(rel));
     if (text === null) continue;
     for (const h of matchLines(text, needleLower)) {
       total++;
@@ -1247,12 +812,12 @@ var WORKER_SOURCE = [
   "parentPort.postMessage({ hits, total, truncated });"
 ].join("\n");
 function runWorker(root, files, needleLower) {
-  return new Promise((resolve3, reject) => {
+  return new Promise((resolve2, reject) => {
     const w = new Worker(WORKER_SOURCE, { eval: true, workerData: { root, files, needleLower } });
     let settled = false;
     w.once("message", (m) => {
       settled = true;
-      resolve3(m);
+      resolve2(m);
     });
     w.once("error", reject);
     w.once("exit", (code) => {
@@ -1322,10 +887,10 @@ var BINARY_EXTS = /* @__PURE__ */ new Set([
   ".pdf"
 ]);
 function hasBinaryExt(rel) {
-  return BINARY_EXTS.has(path3.extname(rel).toLowerCase());
+  return BINARY_EXTS.has(path2.extname(rel).toLowerCase());
 }
 function toPosix(rel) {
-  return path3.sep === "\\" ? rel.replaceAll("\\", "/") : rel;
+  return path2.sep === "\\" ? rel.replaceAll("\\", "/") : rel;
 }
 async function searchSymbols(graph, root, query, limit) {
   let q = query.trim();
@@ -1473,13 +1038,13 @@ function walkCandidates(root) {
     const dir = stack.pop();
     let entries;
     try {
-      entries = fs3.readdirSync(dir, { withFileTypes: true });
+      entries = fs2.readdirSync(dir, { withFileTypes: true });
     } catch {
       continue;
     }
     for (const e of entries) {
       if (e.name.startsWith(".") || IGNORE_DIRS.has(e.name)) continue;
-      const abs = path3.join(dir, e.name);
+      const abs = path2.join(dir, e.name);
       if (e.isDirectory()) {
         stack.push(abs);
         continue;
@@ -1489,7 +1054,7 @@ function walkCandidates(root) {
         truncated = true;
         continue;
       }
-      files.push(toPosix(path3.relative(root, abs)));
+      files.push(toPosix(path2.relative(root, abs)));
     }
   }
   files.sort();
@@ -1520,7 +1085,7 @@ function ripgrepCandidates(root, needle) {
   if (files.length > MAX_FILES_SCANNED) return { files: files.slice(0, MAX_FILES_SCANNED), truncated: true };
   return { files, truncated: false };
 }
-function parseRgFileList(stdout, sep3 = path3.sep) {
+function parseRgFileList(stdout, sep3 = path2.sep) {
   const seen = /* @__PURE__ */ new Set();
   for (const raw of stdout.split("\n")) {
     if (!raw) continue;
@@ -1535,6 +1100,6 @@ function parseRgFileList(stdout, sep3 = path3.sep) {
   return [...seen].sort();
 }
 
-export { ECOSYSTEMS, addLibrary, catalogPath, driftFor, enrichOnline, inventory, libDir, libId, loadCatalog, localApiSurface, localPackageDocs, readDoc, resolveLib, resolveVersion, saveCatalog, searchSymbols };
-//# sourceMappingURL=chunk-3H3SVJUY.js.map
-//# sourceMappingURL=chunk-3H3SVJUY.js.map
+export { addLibrary, catalogPath, driftFor, libDir, libId, loadCatalog, localApiSurface, localPackageDocs, readDoc, resolveLib, resolveVersion, saveCatalog, searchSymbols };
+//# sourceMappingURL=chunk-RHKOUPWT.js.map
+//# sourceMappingURL=chunk-RHKOUPWT.js.map