@kinkai.cloud/vibecheck 0.1.6 → 0.2.0

package/dist/cli.js

@@ -1,11 +1,12 @@
 #!/usr/bin/env node
 var __defProp = Object.defineProperty;
-var __export = (target, all) => {
-  for (var name in all)
-    __defProp(target, name, { get: all[name], enumerable: true });
+var __export = (target, all2) => {
+  for (var name in all2)
+    __defProp(target, name, { get: all2[name], enumerable: true });
 };
 
 // ../../packages/checks/src/types.ts
+var SEVERITIES = ["fatal", "critical", "high", "medium", "low"];
 var NODE_KINDS = [
   "browser",
   "app",
@@ -17,6 +18,7 @@ var NODE_KINDS = [
   "payments",
   "secrets"
 ];
+var CATEGORIES = ["secrets", "data", "storage", "auth", "ai", "config"];
 
 // ../../node_modules/.pnpm/zod@4.4.3/node_modules/zod/v4/classic/external.js
 var external_exports = {};
@@ -14533,164 +14535,401 @@ function date4(params) {
 config(en_default());
 
 // ../../packages/graph/src/types.ts
-var ARESTA_TIPOS = ["imports", "calls", "contains"];
-var MAX_NOS = 400;
-var MAX_ARESTAS = 800;
-var MAX_COMUNIDADES = 9;
-var MAX_ARQUIVOS_POR_NO = 12;
-var MAX_ARQUIVOS_COMUNIDADE = 8;
+var EDGE_TYPES = ["imports", "calls", "contains"];
+var MAX_NODES = 400;
+var MAX_EDGES = 800;
+var MAX_COMMUNITIES = 9;
+var MAX_FILES_PER_NODE = 12;
+var MAX_COMMUNITY_FILES = 8;
 var MAX_BYTES = 256e3;
-var MAX_ROTULO = 80;
+var MAX_LABEL = 80;
 var MAX_ID = 64;
-var MAX_CAMINHO = 180;
-var MAX_PACOTES = 32;
-var caminho = external_exports.string().min(1).max(MAX_CAMINHO);
-var noSchema = external_exports.object({
+var MAX_PATH = 180;
+var MAX_PACKAGES = 32;
+var MAX_HINT_ROUTES = 80;
+var MAX_HINT_TABLES = 40;
+var MAX_HINT_BUCKETS = 24;
+var MAX_HINT_COLLECTIONS = 24;
+var EMPTY_DATA = { tables: [], buckets: [], collections: [] };
+var pathSchema = external_exports.string().min(1).max(MAX_PATH);
+var nodeSchema = external_exports.object({
   id: external_exports.string().min(1).max(MAX_ID),
   kind: external_exports.enum(NODE_KINDS),
-  rotulo: external_exports.string().min(1).max(MAX_ROTULO),
-  arquivos: external_exports.array(caminho).max(MAX_ARQUIVOS_POR_NO)
+  label: external_exports.string().min(1).max(MAX_LABEL),
+  files: external_exports.array(pathSchema).max(MAX_FILES_PER_NODE)
 });
-var arestaSchema = external_exports.object({
-  de: external_exports.string().min(1).max(MAX_ID),
-  para: external_exports.string().min(1).max(MAX_ID),
-  tipo: external_exports.enum(ARESTA_TIPOS)
+var edgeSchema = external_exports.object({
+  from: external_exports.string().min(1).max(MAX_ID),
+  to: external_exports.string().min(1).max(MAX_ID),
+  type: external_exports.enum(EDGE_TYPES)
 });
-var comunidadeSchema = external_exports.object({
+var communitySchema = external_exports.object({
   nodeKind: external_exports.enum(NODE_KINDS),
-  rotulo: external_exports.string().min(1).max(MAX_ROTULO),
-  arquivos: external_exports.array(caminho).max(MAX_ARQUIVOS_COMUNIDADE)
+  label: external_exports.string().min(1).max(MAX_LABEL),
+  files: external_exports.array(pathSchema).max(MAX_COMMUNITY_FILES)
 });
-var grafoScanSchema = external_exports.object({
-  versao: external_exports.literal(1),
-  avancado: external_exports.boolean(),
-  nos: external_exports.array(noSchema).max(MAX_NOS),
-  arestas: external_exports.array(arestaSchema).max(MAX_ARESTAS),
-  comunidades: external_exports.array(comunidadeSchema).max(MAX_COMUNIDADES),
-  pacotes: external_exports.array(external_exports.string().min(1).max(MAX_ROTULO)).max(MAX_PACOTES)
+var tableName = external_exports.string().regex(/^[A-Za-z_][A-Za-z0-9_]{0,62}$/);
+var bucketName = external_exports.string().regex(/^[A-Za-z0-9][A-Za-z0-9._-]{0,62}$/);
+var dataSchema = external_exports.object({
+  tables: external_exports.array(tableName).max(MAX_HINT_TABLES),
+  buckets: external_exports.array(bucketName).max(MAX_HINT_BUCKETS),
+  collections: external_exports.array(tableName).max(MAX_HINT_COLLECTIONS)
 });
+var scanGraphSchema = external_exports.object({
+  version: external_exports.literal(1),
+  advanced: external_exports.boolean(),
+  nodes: external_exports.array(nodeSchema).max(MAX_NODES),
+  edges: external_exports.array(edgeSchema).max(MAX_EDGES),
+  communities: external_exports.array(communitySchema).max(MAX_COMMUNITIES),
+  packages: external_exports.array(external_exports.string().min(1).max(MAX_LABEL)).max(MAX_PACKAGES),
+  data: dataSchema.optional()
+});
+var EMPTY_HINTS = {
+  apiRoutes: [],
+  tableNames: [],
+  buckets: [],
+  collections: []
+};
 
-// ../../packages/graph/src/dicas.ts
-function rotaDeArquivo(caminho2) {
-  const normal = caminho2.replaceAll("\\", "/");
+// ../../packages/graph/src/hints.ts
+function uniqueCapped(values, cap) {
+  const seen = /* @__PURE__ */ new Set();
+  const out = [];
+  for (const value of values) {
+    if (out.length >= cap) break;
+    if (seen.has(value)) continue;
+    seen.add(value);
+    out.push(value);
+  }
+  return out;
+}
+function routeFromFile(path) {
+  const normal = path.replaceAll("\\", "/");
   const app = /(?:^|\/)app\/(.+)\/route\.(t|j)sx?$/i.exec(normal);
   if (app?.[1] !== void 0) {
-    const segmentos = app[1].split("/").filter((s) => s.length > 0 && !s.startsWith("(") && !s.startsWith("@")).map((s) => s.replace(/^\[+\.\.\.(.+)\]+$/, "*").replace(/^\[+(.+)\]+$/, ":$1"));
-    if (segmentos.length === 0) return "/api";
-    return `/${segmentos.join("/")}`;
+    const segments = app[1].split("/").filter((s) => s.length > 0 && !s.startsWith("(") && !s.startsWith("@")).map((s) => s.replace(/^\[+\.\.\.(.+)\]+$/, "*").replace(/^\[+(.+)\]+$/, ":$1"));
+    if (segments.length === 0) return "/api";
+    return `/${segments.join("/")}`;
   }
   const pages = /(?:^|\/)pages\/api\/(.+)\.(t|j)sx?$/i.exec(normal);
   if (pages?.[1] !== void 0) {
-    const semIndex = pages[1].replace(/\/index$/i, "");
-    return `/api/${semIndex}`;
+    const withoutIndex = pages[1].replace(/\/index$/i, "");
+    return `/api/${withoutIndex}`;
   }
   return null;
 }
+function filesFromGraph(graph) {
+  return [
+    ...graph.nodes.flatMap((n) => n.files),
+    ...graph.communities.flatMap((c) => c.files)
+  ];
+}
+function hintsFromGraph(graph) {
+  if (graph === null || graph === void 0 || !graph.advanced) return EMPTY_HINTS;
+  const routes = [];
+  for (const file2 of filesFromGraph(graph)) {
+    const route = routeFromFile(file2);
+    if (route !== null) routes.push(route);
+  }
+  routes.sort((a, b) => a.localeCompare(b));
+  const data = graph.data ?? EMPTY_DATA;
+  return {
+    apiRoutes: uniqueCapped(routes, MAX_HINT_ROUTES),
+    tableNames: uniqueCapped(data.tables, MAX_HINT_TABLES),
+    buckets: uniqueCapped(data.buckets, MAX_HINT_BUCKETS),
+    collections: uniqueCapped(data.collections, MAX_HINT_COLLECTIONS)
+  };
+}
+
+// ../../packages/graph/src/metrics.ts
+function importCycles(graph) {
+  const adjacencia = /* @__PURE__ */ new Map();
+  for (const aresta of graph.edges) {
+    if (aresta.type !== "imports") continue;
+    const vizinhos = adjacencia.get(aresta.from) ?? [];
+    vizinhos.push(aresta.to);
+    adjacencia.set(aresta.from, vizinhos);
+  }
+  const indice = /* @__PURE__ */ new Map();
+  const lowlink = /* @__PURE__ */ new Map();
+  const naPilha = /* @__PURE__ */ new Set();
+  const pilha = [];
+  let proximo = 0;
+  let ciclos = 0;
+  for (const raiz of graph.nodes.map((n) => n.id)) {
+    if (indice.has(raiz)) continue;
+    const quadros = [{ no: raiz, vizinho: 0 }];
+    indice.set(raiz, proximo);
+    lowlink.set(raiz, proximo);
+    proximo += 1;
+    pilha.push(raiz);
+    naPilha.add(raiz);
+    while (quadros.length > 0) {
+      const quadro = quadros[quadros.length - 1];
+      if (quadro === void 0) break;
+      const vizinhos = adjacencia.get(quadro.no) ?? [];
+      if (quadro.vizinho < vizinhos.length) {
+        const vizinho = vizinhos[quadro.vizinho];
+        quadro.vizinho += 1;
+        if (!indice.has(vizinho)) {
+          indice.set(vizinho, proximo);
+          lowlink.set(vizinho, proximo);
+          proximo += 1;
+          pilha.push(vizinho);
+          naPilha.add(vizinho);
+          quadros.push({ no: vizinho, vizinho: 0 });
+        } else if (naPilha.has(vizinho)) {
+          lowlink.set(
+            quadro.no,
+            Math.min(lowlink.get(quadro.no) ?? 0, indice.get(vizinho) ?? 0)
+          );
+        }
+        continue;
+      }
+      quadros.pop();
+      const pai = quadros[quadros.length - 1];
+      if (pai !== void 0) {
+        lowlink.set(
+          pai.no,
+          Math.min(lowlink.get(pai.no) ?? 0, lowlink.get(quadro.no) ?? 0)
+        );
+      }
+      if (lowlink.get(quadro.no) === indice.get(quadro.no)) {
+        let tamanho = 0;
+        let atual;
+        do {
+          atual = pilha.pop();
+          if (atual === void 0) break;
+          naPilha.delete(atual);
+          tamanho += 1;
+        } while (atual !== quadro.no);
+        if (tamanho > 1) ciclos += 1;
+      }
+    }
+  }
+  return ciclos;
+}
+function graphMetrics(graph) {
+  return {
+    nodes: graph.nodes.length,
+    edges: graph.edges.length,
+    routes: hintsFromGraph(graph).apiRoutes.length,
+    packages: graph.packages.length,
+    cycles: importCycles(graph)
+  };
+}
 
-// ../../packages/graph/src/mapear.ts
-var ROTULO_KIND = {
-  browser: "navegador",
-  app: "aplica\xE7\xE3o",
+// ../../packages/graph/src/identifiers.ts
+var FROM_CALL = /([A-Za-z_$][\w$]*)\s*\.\s*from\(\s*["'`]([A-Za-z0-9._-]{1,63})["'`]\s*\)/g;
+var NOT_A_DATABASE = /* @__PURE__ */ new Set([
+  "array",
+  "buffer",
+  "object",
+  "string",
+  "number",
+  "date",
+  "map",
+  "set",
+  "promise",
+  "uint8array",
+  "int8array",
+  "float32array",
+  "float64array",
+  "blob",
+  "json",
+  "bigint",
+  "proxy",
+  "reflect"
+]);
+var STORAGE_URL = /\/storage\/v1\/object\/(?:public|sign)\/([A-Za-z0-9._-]{1,63})\//g;
+var COLLECTION_DOT = /\.\s*collection\(\s*["'`]([A-Za-z][A-Za-z0-9_-]{0,62})["'`]\s*\)/g;
+var COLLECTION_MODULAR = /\bcollection\(\s*[^,)"'`]+,\s*["'`]([A-Za-z][A-Za-z0-9_-]{0,62})["'`]/g;
+var VALID_TABLE = /^[A-Za-z_][A-Za-z0-9_]{0,62}$/;
+var VALID_BUCKET = /^[A-Za-z0-9][A-Za-z0-9._-]{0,62}$/;
+var SECRETISH = /(sk_live_|sk_test_|rk_live_|pk_live_|pk_test_|sb_secret_|sb_publishable_|eyJ[A-Za-z0-9_-]{10,}|gsk_|sk-ant-|sk-proj-|sk-or-v1-|AIza)/i;
+function capture(content, pattern, group = 1) {
+  const re = new RegExp(pattern.source, pattern.flags);
+  const out = [];
+  let m;
+  while ((m = re.exec(content)) !== null) {
+    const value = m[group];
+    if (value !== void 0) out.push(value);
+    if (m[0].length === 0) re.lastIndex += 1;
+  }
+  return out;
+}
+function identifiersFromCode(content) {
+  const tables = [];
+  const buckets = [];
+  const re = new RegExp(FROM_CALL.source, FROM_CALL.flags);
+  let m;
+  while ((m = re.exec(content)) !== null) {
+    const receiver = m[1];
+    const name = m[2];
+    if (receiver === void 0 || name === void 0) continue;
+    if (NOT_A_DATABASE.has(receiver.toLowerCase())) continue;
+    if (receiver.toLowerCase() === "storage") {
+      if (VALID_BUCKET.test(name)) buckets.push(name);
+      continue;
+    }
+    if (VALID_TABLE.test(name)) tables.push(name);
+  }
+  for (const name of capture(content, STORAGE_URL)) {
+    if (VALID_BUCKET.test(name)) buckets.push(name);
+  }
+  const collections = [
+    ...capture(content, COLLECTION_DOT),
+    ...capture(content, COLLECTION_MODULAR)
+  ].filter((name) => VALID_TABLE.test(name));
+  return {
+    tables: tables.filter((n) => !SECRETISH.test(n)),
+    buckets: buckets.filter((n) => !SECRETISH.test(n)),
+    collections: collections.filter((n) => !SECRETISH.test(n))
+  };
+}
+function mergeIdentifiers(parts, cap) {
+  const dedup = (values, max) => {
+    const seen = /* @__PURE__ */ new Set();
+    const out = [];
+    for (const value of values) {
+      const key = value.toLowerCase();
+      if (seen.has(key)) continue;
+      seen.add(key);
+      out.push(value);
+      if (out.length >= max) break;
+    }
+    return out;
+  };
+  return {
+    tables: dedup(
+      parts.flatMap((p) => p.tables),
+      cap.tables
+    ),
+    buckets: dedup(
+      parts.flatMap((p) => p.buckets),
+      cap.buckets
+    ),
+    collections: dedup(
+      parts.flatMap((p) => p.collections),
+      cap.collections
+    )
+  };
+}
+function isValidDataName(raw, kind) {
+  if (typeof raw !== "string") return null;
+  const cleaned = raw.trim();
+  if (cleaned.length === 0) return null;
+  const pattern = kind === "bucket" ? VALID_BUCKET : VALID_TABLE;
+  if (!pattern.test(cleaned)) return null;
+  if (SECRETISH.test(cleaned)) return null;
+  return cleaned;
+}
+
+// ../../packages/graph/src/map.ts
+var KIND_LABEL = {
+  browser: "browser",
+  app: "application",
   api: "API",
-  db: "banco",
-  storage: "arquivos",
-  auth: "autentica\xE7\xE3o",
-  ai: "IA",
-  payments: "pagamentos",
-  secrets: "segredos"
-};
-var REGRAS = [
+  db: "database",
+  storage: "files",
+  auth: "authentication",
+  ai: "AI",
+  payments: "payments",
+  secrets: "security"
+};
+var RULES = [
   {
     kind: "api",
-    teste: /app\/.+\/route\.(t|j)sx?\b|pages\/api\//i
+    test: /app\/.+\/route\.(t|j)sx?\b|pages\/api\//i
   },
-  { kind: "payments", teste: /\b(stripe|pagarme|mercadopago|paypal|adyen)\b/i },
-  { kind: "auth", teste: /\b(clerk|next-auth|auth0|lucia|kinde|supabase\/auth)\b/i },
-  { kind: "ai", teste: /\b(openai|anthropic|groq|ollama|\bllm\b|langchain)\b/i },
-  { kind: "storage", teste: /\b(storage|s3|r2|bucket|firebase\/storage)\b/i },
+  { kind: "payments", test: /\b(stripe|pagarme|mercadopago|paypal|adyen)\b/i },
+  { kind: "auth", test: /\b(clerk|next-auth|auth0|lucia|kinde|supabase\/auth)\b/i },
+  { kind: "ai", test: /\b(openai|anthropic|groq|ollama|\bllm\b|langchain)\b/i },
+  { kind: "storage", test: /\b(storage|s3|r2|bucket|firebase\/storage)\b/i },
   {
     kind: "db",
-    teste: /\b(supabase|prisma|drizzle|postgres|mongodb|firebase|firestore|kysely)\b/i
+    test: /\b(supabase|prisma|drizzle|postgres|mongodb|firebase|firestore|kysely)\b/i
   },
-  { kind: "secrets", teste: /\b(secret|credentials|vault)\b/i },
-  { kind: "browser", teste: /\b(middleware\.(t|j)s|proxy\.(t|j)s)\b/i }
+  { kind: "secrets", test: /\b(secret|credentials|vault)\b/i },
+  { kind: "browser", test: /\b(middleware\.(t|j)s|proxy\.(t|j)s)\b/i }
 ];
-function mapearKind(sinal) {
-  const texto = `${sinal.rotulo} ${sinal.arquivos.join(" ")}`;
-  for (const regra of REGRAS) {
-    if (regra.teste.test(texto)) return regra.kind;
+function mapKind(signal) {
+  const text = `${signal.label} ${signal.files.join(" ")}`;
+  for (const rule of RULES) {
+    if (rule.test.test(text)) return rule.kind;
   }
   return "app";
 }
 
-// ../../packages/graph/src/pacotes.ts
-var CARA_DE_CHAVE = /(sk_live_|sk_test_|rk_live_|pk_live_|pk_test_|sb_secret_|eyJ[A-Za-z0-9_-]{20,}|gsk_[A-Za-z0-9]|sk-ant-|sk-proj-|sk-or-v1-)/i;
-var REGRAS2 = [
-  { id: "next", teste: /^next(?:\/|$)/ },
-  { id: "react", teste: /^react(?:-dom)?(?:\/|$)/ },
-  { id: "vue", teste: /^vue(?:\/|$)/ },
-  { id: "svelte", teste: /^svelte(?:\/|$)/ },
-  { id: "angular", teste: /^@angular\// },
-  { id: "vite", teste: /^vite(?:\/|$)/ },
-  { id: "astro", teste: /^astro(?:\/|$)/ },
-  { id: "stripe", teste: /^(?:stripe|@stripe\/)/ },
-  { id: "supabase", teste: /^(?:@supabase\/|@supabase$)/ },
-  { id: "firebase", teste: /^(?:firebase|@firebase\/)/ },
-  { id: "clerk", teste: /^@clerk\// },
-  { id: "next-auth", teste: /^(?:next-auth|@auth\/)/ },
-  { id: "prisma", teste: /^(?:@prisma\/client|prisma)(?:\/|$)/ },
-  { id: "drizzle", teste: /^drizzle-orm(?:\/|$)/ },
-  { id: "kysely", teste: /^kysely(?:\/|$)/ },
-  { id: "postgres", teste: /^(?:postgres|pg|@neondatabase\/)/ },
-  { id: "mongodb", teste: /^(?:mongodb|mongoose)(?:\/|$)/ },
-  { id: "styled-components", teste: /^styled-components(?:\/|$)/ },
-  { id: "emotion", teste: /^@emotion\// },
-  { id: "tailwind", teste: /^tailwindcss(?:\/|$)/ },
-  { id: "openai", teste: /^openai(?:\/|$)/ },
-  { id: "anthropic", teste: /^@anthropic-ai\// },
-  { id: "langchain", teste: /^langchain(?:\/|$)/ },
-  { id: "trpc", teste: /^@trpc\// },
-  { id: "hono", teste: /^hono(?:\/|$)/ },
-  { id: "express", teste: /^express(?:\/|$)/ },
-  { id: "fastify", teste: /^fastify(?:\/|$)/ },
-  { id: "graphql", teste: /^(?:graphql|@apollo\/)/ },
-  { id: "redis", teste: /^(?:redis|ioredis)(?:\/|$)/ },
-  { id: "resend", teste: /^resend(?:\/|$)/ },
-  { id: "auth0", teste: /^(?:auth0|@auth0\/)/ },
-  { id: "lucia", teste: /^lucia(?:\/|$)/ },
-  { id: "kinde", teste: /^@kinde-oss\// }
+// ../../packages/graph/src/packages.ts
+var SECRETISH2 = /(sk_live_|sk_test_|rk_live_|pk_live_|pk_test_|sb_secret_|eyJ[A-Za-z0-9_-]{20,}|gsk_[A-Za-z0-9]|sk-ant-|sk-proj-|sk-or-v1-)/i;
+var RULES2 = [
+  { id: "next", test: /^next(?:\/|$)/ },
+  { id: "react", test: /^react(?:-dom)?(?:\/|$)/ },
+  { id: "vue", test: /^vue(?:\/|$)/ },
+  { id: "svelte", test: /^svelte(?:\/|$)/ },
+  { id: "angular", test: /^@angular\// },
+  { id: "vite", test: /^vite(?:\/|$)/ },
+  { id: "astro", test: /^astro(?:\/|$)/ },
+  { id: "stripe", test: /^(?:stripe|@stripe\/)/ },
+  { id: "supabase", test: /^(?:@supabase\/|@supabase$)/ },
+  { id: "firebase", test: /^(?:firebase|@firebase\/)/ },
+  { id: "clerk", test: /^@clerk\// },
+  { id: "next-auth", test: /^(?:next-auth|@auth\/)/ },
+  { id: "prisma", test: /^(?:@prisma\/client|prisma)(?:\/|$)/ },
+  { id: "drizzle", test: /^drizzle-orm(?:\/|$)/ },
+  { id: "kysely", test: /^kysely(?:\/|$)/ },
+  { id: "postgres", test: /^(?:postgres|pg|@neondatabase\/)/ },
+  { id: "mongodb", test: /^(?:mongodb|mongoose)(?:\/|$)/ },
+  { id: "styled-components", test: /^styled-components(?:\/|$)/ },
+  { id: "emotion", test: /^@emotion\// },
+  { id: "tailwind", test: /^tailwindcss(?:\/|$)/ },
+  { id: "openai", test: /^openai(?:\/|$)/ },
+  { id: "anthropic", test: /^@anthropic-ai\// },
+  { id: "langchain", test: /^langchain(?:\/|$)/ },
+  { id: "trpc", test: /^@trpc\// },
+  { id: "hono", test: /^hono(?:\/|$)/ },
+  { id: "express", test: /^express(?:\/|$)/ },
+  { id: "fastify", test: /^fastify(?:\/|$)/ },
+  { id: "graphql", test: /^(?:graphql|@apollo\/)/ },
+  { id: "redis", test: /^(?:redis|ioredis)(?:\/|$)/ },
+  { id: "resend", test: /^resend(?:\/|$)/ },
+  { id: "auth0", test: /^(?:auth0|@auth0\/)/ },
+  { id: "lucia", test: /^lucia(?:\/|$)/ },
+  { id: "kinde", test: /^@kinde-oss\// }
 ];
-function idDePacote(spec) {
-  const limpo = spec.trim().replace(/^npm:/, "");
-  if (limpo.length === 0 || limpo.startsWith(".") || limpo.startsWith("/")) return null;
-  if (limpo.startsWith("node:") || limpo.startsWith("#")) return null;
-  for (const regra of REGRAS2) {
-    if (regra.teste.test(limpo)) return regra.id;
+function packageId(spec) {
+  const cleaned = spec.trim().replace(/^npm:/, "");
+  if (cleaned.length === 0 || cleaned.startsWith(".") || cleaned.startsWith("/"))
+    return null;
+  if (cleaned.startsWith("node:") || cleaned.startsWith("#")) return null;
+  for (const rule of RULES2) {
+    if (rule.test.test(cleaned)) return rule.id;
   }
   return null;
 }
-function sanitizarPacote(bruto) {
-  const limpo = bruto.trim().slice(0, MAX_ROTULO);
-  if (limpo.length === 0) return null;
-  if (CARA_DE_CHAVE.test(limpo)) return null;
-  if (!/^[@a-z0-9][a-z0-9._+/-]{0,60}$/i.test(limpo)) return null;
-  return limpo;
+function sanitizePackage(raw) {
+  const cleaned = raw.trim().slice(0, MAX_LABEL);
+  if (cleaned.length === 0) return null;
+  if (SECRETISH2.test(cleaned)) return null;
+  if (!/^[@a-z0-9][a-z0-9._+/-]{0,60}$/i.test(cleaned)) return null;
+  return cleaned;
 }
-function uniquePacotes(values) {
+function uniquePackages(values) {
   const seen = /* @__PURE__ */ new Set();
   const out = [];
   for (const value of values) {
-    if (out.length >= MAX_PACOTES) break;
-    const limpo = sanitizarPacote(value);
-    if (limpo === null || seen.has(limpo)) continue;
-    seen.add(limpo);
-    out.push(limpo);
+    if (out.length >= MAX_PACKAGES) break;
+    const cleaned = sanitizePackage(value);
+    if (cleaned === null || seen.has(cleaned)) continue;
+    seen.add(cleaned);
+    out.push(cleaned);
   }
   return out;
 }
 
 // ../../packages/graph/src/sanitize.ts
-var CAMPOS_CORPO = /* @__PURE__ */ new Set([
+var BODY_FIELDS = /* @__PURE__ */ new Set([
   "content",
   "snippet",
   "code",
@@ -14702,34 +14941,43 @@ var CAMPOS_CORPO = /* @__PURE__ */ new Set([
   "raw",
   "bytes"
 ]);
-var EXTENSOES_SEGREDO = /\.(env|pem|key|p12|pfx|crt|cer|p8|keystore)(?:\.|$)/i;
-var SEGMENTO_PROIBIDO = /(?:^|\/)(?:\.env(?:\..+)?|id_rsa|id_ed25519|credentials|secrets?)(?:\/|$)/i;
-var CARA_DE_CHAVE2 = /(sk_live_|sk_test_|rk_live_|pk_live_|pk_test_|sb_secret_|sb_publishable_|eyJ[A-Za-z0-9_-]{20,}|gsk_[A-Za-z0-9]|sk-ant-|sk-proj-|sk-or-v1-)/i;
-var MAX_ROTULO_ARQUIVO = MAX_CAMINHO;
-function eRecord(value) {
+var SECRET_EXTENSIONS = /\.(env|pem|key|p12|pfx|crt|cer|p8|keystore)(?:\.|$)/i;
+var FORBIDDEN_SEGMENT = /(?:^|\/)(?:\.env(?:\..+)?|id_rsa|id_ed25519|credentials|secrets?)(?:\/|$)/i;
+var SECRETISH3 = /(sk_live_|sk_test_|rk_live_|pk_live_|pk_test_|sb_secret_|sb_publishable_|eyJ[A-Za-z0-9_-]{20,}|gsk_[A-Za-z0-9]|sk-ant-|sk-proj-|sk-or-v1-)/i;
+var MAX_FILE_LABEL = MAX_PATH;
+function isRecord(value) {
   return typeof value === "object" && value !== null && !Array.isArray(value);
 }
-function comoString(value) {
+function asString(value) {
   return typeof value === "string" && value.length > 0 ? value : null;
 }
-function sanitizarCaminho(bruto) {
-  const cortado = bruto.trim().replaceAll("\\", "/");
-  if (cortado.length === 0 || cortado.length > MAX_ROTULO_ARQUIVO) return null;
-  if (cortado.includes("\0")) return null;
-  if (cortado.startsWith("/") || /^[a-zA-Z]:/.test(cortado)) return null;
-  if (cortado.split("/").some((p) => p === ".." || p === ".")) return null;
-  if (EXTENSOES_SEGREDO.test(cortado) || SEGMENTO_PROIBIDO.test(cortado)) return null;
-  if (/(?:^|\/)node_modules\//.test(cortado)) return null;
-  if (/(?:^|\/)\.git\//.test(cortado)) return null;
-  return cortado.slice(0, MAX_CAMINHO);
-}
-function redigirRotulo(bruto) {
-  const limpo = bruto.trim().slice(0, MAX_ROTULO);
-  if (limpo.length === 0) return "n\xF3";
-  if (CARA_DE_CHAVE2.test(limpo)) return "[redigido]";
-  return limpo;
-}
-function uniqueCapped(values, cap) {
+function sanitizePath(raw) {
+  const trimmed = raw.trim().replaceAll("\\", "/");
+  if (trimmed.length === 0 || trimmed.length > MAX_FILE_LABEL) return null;
+  if (trimmed.includes("\0")) return null;
+  if (trimmed.startsWith("/") || /^[a-zA-Z]:/.test(trimmed)) return null;
+  if (trimmed.split("/").some((p) => p === ".." || p === ".")) return null;
+  if (SECRET_EXTENSIONS.test(trimmed) || FORBIDDEN_SEGMENT.test(trimmed)) return null;
+  if (/(?:^|\/)node_modules\//.test(trimmed)) return null;
+  if (/(?:^|\/)\.git\//.test(trimmed)) return null;
+  return trimmed.slice(0, MAX_PATH);
+}
+function redactLabel(raw) {
+  const cleaned = raw.trim().slice(0, MAX_LABEL);
+  if (cleaned.length === 0) return "node";
+  if (SECRETISH3.test(cleaned)) return "[redacted]";
+  if (looksLikePath(cleaned) && sanitizePath(cleaned) === null) return "[redacted]";
+  return cleaned;
+}
+function looksLikePath(value) {
+  return /[\\/]/.test(value) || /^[a-zA-Z]:/.test(value);
+}
+function opaque(value) {
+  let h = 5381;
+  for (let i = 0; i < value.length; i += 1) h = (h << 5) + h + value.charCodeAt(i) | 0;
+  return `p${(h >>> 0).toString(36)}`;
+}
+function uniqueCapped2(values, cap) {
   const seen = /* @__PURE__ */ new Set();
   const out = [];
   for (const value of values) {
@@ -14740,252 +14988,417 @@ function uniqueCapped(values, cap) {
   }
   return out;
 }
-function arquivosDe(value) {
-  const brutos = [];
-  if (typeof value === "string") brutos.push(value);
+function filesFrom(value) {
+  const raw = [];
+  if (typeof value === "string") raw.push(value);
   if (Array.isArray(value)) {
     for (const item of value) {
-      if (typeof item === "string") brutos.push(item);
+      if (typeof item === "string") raw.push(item);
     }
   }
-  const limpos = [];
-  for (const bruto of brutos) {
-    const caminho2 = sanitizarCaminho(bruto);
-    if (caminho2 !== null) limpos.push(caminho2);
+  const cleaned = [];
+  for (const item of raw) {
+    const path = sanitizePath(item);
+    if (path !== null) cleaned.push(path);
   }
-  return uniqueCapped(limpos, MAX_ARQUIVOS_POR_NO);
+  return uniqueCapped2(cleaned, MAX_FILES_PER_NODE);
 }
-function idDe(value, fallback) {
-  const bruto = comoString(value) ?? fallback;
-  return bruto.trim().slice(0, MAX_ID).replace(/[^\w.:/-]/g, "_") || fallback;
+function idFrom(value, fallback) {
+  const raw = (asString(value) ?? fallback).trim().slice(0, MAX_ID);
+  const safe = raw.split("::").map(
+    (part) => looksLikePath(part) && sanitizePath(part) === null ? opaque(part) : part
+  ).join("::");
+  return safe.replace(/[^\w.:/-]/g, "_") || fallback;
 }
-function tipoAresta(value) {
-  const bruto = (comoString(value) ?? "contains").toLowerCase();
-  if (bruto.includes("import")) return "imports";
-  if (bruto.includes("call")) return "calls";
+function edgeType(value) {
+  const raw = (asString(value) ?? "contains").toLowerCase();
+  if (raw.includes("import")) return "imports";
+  if (raw.includes("call")) return "calls";
   return "contains";
 }
-function stripCorpo(value) {
-  if (Array.isArray(value)) return value.map(stripCorpo);
-  if (!eRecord(value)) return value;
+function stripBody(value) {
+  if (Array.isArray(value)) return value.map(stripBody);
+  if (!isRecord(value)) return value;
   const out = {};
-  for (const [chave, item] of Object.entries(value)) {
-    if (CAMPOS_CORPO.has(chave)) continue;
-    if (chave === "source" && typeof item === "string" && (item.includes("\n") || item.length > MAX_ID)) {
+  for (const [key, item] of Object.entries(value)) {
+    if (BODY_FIELDS.has(key)) continue;
+    if (key === "source" && typeof item === "string" && (item.includes("\n") || item.length > MAX_ID)) {
       continue;
     }
-    out[chave] = stripCorpo(item);
+    out[key] = stripBody(item);
   }
   return out;
 }
-function primeiroExport(value) {
+function firstExport(value) {
   if (typeof value === "string" && value.length > 0) {
-    const primeiro = value.split(/[\s,]+/)[0];
-    return primeiro !== void 0 && primeiro.length > 0 ? primeiro : null;
+    const first = value.split(/[\s,]+/)[0];
+    return first !== void 0 && first.length > 0 ? first : null;
   }
   if (!Array.isArray(value)) return null;
   for (const item of value) {
     if (typeof item === "string" && item.length > 0) return item;
-    if (eRecord(item)) {
-      const nome = comoString(item["name"]) ?? comoString(item["identifier"]);
-      if (nome !== null) return nome;
+    if (isRecord(item)) {
+      const name = asString(item["name"]) ?? asString(item["identifier"]);
+      if (name !== null) return name;
     }
   }
   return null;
 }
-function nosDoDump(dump) {
-  const bruto = dump["nodes"] ?? dump["nos"];
-  const lista = Array.isArray(bruto) ? bruto : eRecord(bruto) ? Object.entries(bruto).map(
-    ([id, n]) => eRecord(n) ? { id, ...n } : { id }
-  ) : [];
-  const nos = [];
-  for (const [i, item] of lista.entries()) {
-    if (!eRecord(item)) continue;
-    const arquivos = arquivosDe(
-      item["arquivos"] ?? item["files"] ?? item["source_file"] ?? item["sourceFile"] ?? item["file"] ?? item["path"]
+function nodesFromDump(dump) {
+  const raw = dump["nodes"] ?? dump["nos"];
+  const list = Array.isArray(raw) ? raw : isRecord(raw) ? Object.entries(raw).map(([id, n]) => isRecord(n) ? { id, ...n } : { id }) : [];
+  const nodes = [];
+  for (const [i, item] of list.entries()) {
+    if (!isRecord(item)) continue;
+    const files = filesFrom(
+      item["files"] ?? item["files"] ?? item["source_file"] ?? item["sourceFile"] ?? item["file"] ?? item["path"]
     );
-    const rotulo = redigirRotulo(
-      comoString(item["rotulo"]) ?? comoString(item["label"]) ?? comoString(item["name"]) ?? comoString(item["identifier"]) ?? comoString(item["symbol"]) ?? primeiroExport(item["exports"] ?? item["identificadores"]) ?? arquivos[0] ?? `n\xF3-${String(i)}`
+    const label = redactLabel(
+      asString(item["label"]) ?? asString(item["label"]) ?? asString(item["name"]) ?? asString(item["identifier"]) ?? asString(item["symbol"]) ?? firstExport(item["exports"] ?? item["identificadores"]) ?? files[0] ?? `node-${String(i)}`
     );
-    const kindBruto = comoString(item["kind"]) ?? comoString(item["nodeKind"]);
-    const kind = kindBruto !== null && NODE_KINDS.includes(kindBruto) ? kindBruto : mapearKind({ rotulo, arquivos });
-    nos.push({
-      id: idDe(item["id"], `n${String(i)}`),
+    const kindRaw = asString(item["kind"]) ?? asString(item["nodeKind"]);
+    const kind = kindRaw !== null && NODE_KINDS.includes(kindRaw) ? kindRaw : mapKind({ label, files });
+    nodes.push({
+      id: idFrom(item["id"], `n${String(i)}`),
       kind,
-      rotulo,
-      arquivos
+      label,
+      files
     });
-    if (nos.length >= MAX_NOS) break;
+    if (nodes.length >= MAX_NODES) break;
   }
-  return nos;
+  return nodes;
 }
-function arestasDoDump(dump, ids) {
-  const bruto = dump["edges"] ?? dump["arestas"];
-  const lista = Array.isArray(bruto) ? bruto : [];
+function edgesFromDump(dump, ids) {
+  const raw = dump["edges"] ?? dump["edges"];
+  const list = Array.isArray(raw) ? raw : [];
   const out = [];
   const seen = /* @__PURE__ */ new Set();
-  for (const item of lista) {
-    if (!eRecord(item)) continue;
-    const de = idDe(item["de"] ?? item["source"] ?? item["from"], "");
-    const para = idDe(item["para"] ?? item["target"] ?? item["to"], "");
-    if (de.length === 0 || para.length === 0) continue;
-    if (!ids.has(de) || !ids.has(para)) continue;
-    const tipo = tipoAresta(item["tipo"] ?? item["relation"] ?? item["kind"]);
-    const chave = `${de}>${para}:${tipo}`;
-    if (seen.has(chave)) continue;
-    seen.add(chave);
-    out.push({ de, para, tipo });
-    if (out.length >= MAX_ARESTAS) break;
+  for (const item of list) {
+    if (!isRecord(item)) continue;
+    const from = idFrom(item["from"] ?? item["de"] ?? item["source"], "");
+    const to = idFrom(item["to"] ?? item["para"] ?? item["target"], "");
+    if (from.length === 0 || to.length === 0) continue;
+    if (!ids.has(from) || !ids.has(to)) continue;
+    const type = edgeType(
+      item["type"] ?? item["tipo"] ?? item["relation"] ?? item["kind"]
+    );
+    const key = `${from}>${to}:${type}`;
+    if (seen.has(key)) continue;
+    seen.add(key);
+    out.push({ from, to, type });
+    if (out.length >= MAX_EDGES) break;
   }
   return out;
 }
-function comunidadesDoDump(dump, nos) {
-  const jaCurto = dump["comunidades"];
-  if (Array.isArray(jaCurto)) {
+function communitiesFromDump(dump, nodes) {
+  const alreadyShort = dump["communities"] ?? dump["communities"];
+  if (Array.isArray(alreadyShort)) {
     const out2 = [];
     const seen = /* @__PURE__ */ new Set();
-    for (const item of jaCurto) {
-      if (!eRecord(item)) continue;
-      const kindBruto = comoString(item["nodeKind"]) ?? comoString(item["kind"]);
-      if (kindBruto === null || !NODE_KINDS.includes(kindBruto)) {
+    for (const item of alreadyShort) {
+      if (!isRecord(item)) continue;
+      const kindRaw = asString(item["nodeKind"]) ?? asString(item["kind"]);
+      if (kindRaw === null || !NODE_KINDS.includes(kindRaw)) {
         continue;
       }
-      const nodeKind = kindBruto;
+      const nodeKind = kindRaw;
       if (seen.has(nodeKind)) {
-        const atual = out2.find((c) => c.nodeKind === nodeKind);
-        if (atual === void 0) continue;
-        const extra = arquivosDe(item["arquivos"] ?? item["files"]);
-        const merged = uniqueCapped([...atual.arquivos, ...extra], MAX_ARQUIVOS_COMUNIDADE);
-        out2.splice(out2.indexOf(atual), 1, {
+        const current = out2.find((c) => c.nodeKind === nodeKind);
+        if (current === void 0) continue;
+        const extra = filesFrom(item["files"] ?? item["files"]);
+        const merged = uniqueCapped2([...current.files, ...extra], MAX_COMMUNITY_FILES);
+        out2.splice(out2.indexOf(current), 1, {
           nodeKind,
-          rotulo: atual.rotulo,
-          arquivos: merged
+          label: current.label,
+          files: merged
         });
         continue;
       }
       seen.add(nodeKind);
       out2.push({
         nodeKind,
-        rotulo: ROTULO_KIND[nodeKind],
-        arquivos: uniqueCapped(
-          arquivosDe(item["arquivos"] ?? item["files"]),
-          MAX_ARQUIVOS_COMUNIDADE
+        label: KIND_LABEL[nodeKind],
+        files: uniqueCapped2(
+          filesFrom(item["files"] ?? item["files"]),
+          MAX_COMMUNITY_FILES
         )
       });
-      if (out2.length >= MAX_COMUNIDADES) break;
+      if (out2.length >= MAX_COMMUNITIES) break;
     }
     return out2;
   }
-  const porKind = /* @__PURE__ */ new Map();
-  for (const no of nos) {
-    const atual = porKind.get(no.kind) ?? { rotulo: no.rotulo, arquivos: [] };
-    atual.arquivos.push(...no.arquivos);
-    porKind.set(no.kind, atual);
+  const byKind = /* @__PURE__ */ new Map();
+  for (const node of nodes) {
+    const current = byKind.get(node.kind) ?? { label: node.label, files: [] };
+    current.files.push(...node.files);
+    byKind.set(node.kind, current);
   }
   const out = [];
   for (const kind of NODE_KINDS) {
-    const grupo = porKind.get(kind);
-    if (grupo === void 0) continue;
-    const arquivos = uniqueCapped(grupo.arquivos, MAX_ARQUIVOS_COMUNIDADE);
-    if (arquivos.length === 0 && grupo.rotulo.length === 0) continue;
-    out.push({ nodeKind: kind, rotulo: ROTULO_KIND[kind], arquivos });
-    if (out.length >= MAX_COMUNIDADES) break;
+    const group = byKind.get(kind);
+    if (group === void 0) continue;
+    const files = uniqueCapped2(group.files, MAX_COMMUNITY_FILES);
+    if (files.length === 0 && group.label.length === 0) continue;
+    out.push({ nodeKind: kind, label: KIND_LABEL[kind], files });
+    if (out.length >= MAX_COMMUNITIES) break;
   }
   return out;
 }
-function sanitizarGrafo(entrada) {
-  if (entrada === null || entrada === void 0) return { ok: false, motivo: "invalido" };
+function sanitizeGraph(input) {
+  if (input === null || input === void 0) return { ok: false, reason: "invalid" };
   let json2;
   try {
-    json2 = JSON.stringify(entrada);
+    json2 = JSON.stringify(input);
   } catch {
-    return { ok: false, motivo: "invalido" };
-  }
-  if (json2.length > MAX_BYTES) return { ok: false, motivo: "grande" };
-  const limpo = stripCorpo(entrada);
-  if (!eRecord(limpo)) return { ok: false, motivo: "invalido" };
-  const nos = nosDoDump(limpo);
-  const ids = new Set(nos.map((n) => n.id));
-  const arestas = arestasDoDump(limpo, ids);
-  const comunidades = comunidadesDoDump(limpo, nos);
-  const pacotes = uniquePacotes(pacotesDoDump(limpo, nos));
-  const temArquivo = comunidades.some((c) => c.arquivos.length > 0) || nos.some((n) => n.arquivos.length > 0);
-  if (!temArquivo) return { ok: false, motivo: "vazio" };
-  const avancado = comunidades.length > 0;
+    return { ok: false, reason: "invalid" };
+  }
+  if (json2.length > MAX_BYTES) return { ok: false, reason: "too-large" };
+  const cleaned = stripBody(input);
+  if (!isRecord(cleaned)) return { ok: false, reason: "invalid" };
+  const nodes = nodesFromDump(cleaned);
+  const ids = new Set(nodes.map((n) => n.id));
+  const edges = edgesFromDump(cleaned, ids);
+  const communities = communitiesFromDump(cleaned, nodes);
+  const packages = uniquePackages(packagesFromDump(cleaned, nodes));
+  const data = dataFromDump(cleaned);
+  const hasFile = communities.some((c) => c.files.length > 0) || nodes.some((n) => n.files.length > 0);
+  if (!hasFile) return { ok: false, reason: "empty" };
+  const advanced = communities.length > 0;
   return {
     ok: true,
-    grafo: {
-      versao: 1,
-      avancado,
-      nos,
-      arestas,
-      comunidades,
-      pacotes
+    graph: {
+      version: 1,
+      advanced,
+      nodes,
+      edges,
+      communities,
+      packages,
+      ...data === void 0 ? {} : { data }
+    }
+  };
+}
+function dataFromDump(dump) {
+  const raw = dump["data"] ?? dump["dados"];
+  if (!isRecord(raw)) return void 0;
+  const clean = (value, kind, cap) => {
+    if (!Array.isArray(value)) return [];
+    const cleaned = [];
+    for (const item of value) {
+      const name = isValidDataName(item, kind);
+      if (name !== null) cleaned.push(name);
     }
+    return uniqueCapped2(cleaned, cap);
+  };
+  const data = {
+    tables: clean(raw["tables"] ?? raw["tables"], "table", MAX_HINT_TABLES),
+    buckets: clean(raw["buckets"], "bucket", MAX_HINT_BUCKETS),
+    collections: clean(
+      raw["collections"] ?? raw["collections"],
+      "table",
+      MAX_HINT_COLLECTIONS
+    )
   };
+  if (data.tables.length === 0 && data.buckets.length === 0 && data.collections.length === 0) {
+    return void 0;
+  }
+  return data;
 }
-function pacotesDoDump(dump, nos) {
-  const brutos = [];
-  const campo = dump["pacotes"] ?? dump["packages"];
-  if (Array.isArray(campo)) {
-    for (const item of campo) {
-      if (typeof item === "string") brutos.push(item);
+function packagesFromDump(dump, nodes) {
+  const raw = [];
+  const field = dump["packages"] ?? dump["packages"];
+  if (Array.isArray(field)) {
+    for (const item of field) {
+      if (typeof item === "string") raw.push(item);
     }
   }
-  for (const no of nos) {
-    if (no.id.startsWith("pkg:")) brutos.push(no.rotulo);
+  for (const node of nodes) {
+    if (node.id.startsWith("pkg:")) raw.push(node.label);
   }
-  return brutos;
+  return raw;
 }
 
-// src/graphify.ts
-import { spawn } from "child_process";
-import { readFile } from "fs/promises";
-import { join } from "path";
-async function tentarGraphify(raiz) {
-  const json2 = join(raiz, "graphify-out", "graph.json");
-  try {
-    return JSON.parse(await readFile(json2, "utf8"));
-  } catch {
-  }
-  const ok = await new Promise((resolve) => {
-    const child = spawn("graphify", [".", "--no-viz"], {
-      cwd: raiz,
-      stdio: "ignore"
-    });
-    const timer = setTimeout(() => {
-      child.kill();
-      resolve(false);
-    }, 2e4);
-    child.on("exit", (code) => {
-      clearTimeout(timer);
-      resolve(code === 0);
-    });
-    child.on("error", () => {
-      clearTimeout(timer);
-      resolve(false);
-    });
-  });
-  if (!ok) return null;
-  try {
-    return JSON.parse(await readFile(json2, "utf8"));
-  } catch {
-    return null;
-  }
-}
+// ../../packages/schema/src/quality-gate.ts
+var QUALITY_GATE_POLICY = "2026-code-gate-v1";
+var GATE_STATUSES = ["passed", "failed", "inconclusive"];
+var HTTP_SCAN_OUTCOMES = [
+  "ran",
+  "skipped-quota",
+  "skipped-flag",
+  "failed"
+];
+var ISSUE_SOURCES = ["code", "http"];
+var REPROVA = ["fatal", "critical", "high"];
+function reprova(severity) {
+  return REPROVA.includes(severity);
+}
+function contarPorSeveridade(issues) {
+  const counts = Object.fromEntries(SEVERITIES.map((s) => [s, 0]));
+  for (const issue2 of issues) counts[issue2.severity] += 1;
+  return counts;
+}
+function analysed(report) {
+  return report.codeFiles > 0 || report.httpScan === "ran";
+}
+function statusFromIssues(issues, httpScan, analisou) {
+  if (!analisou) return "inconclusive";
+  if (issues.some((i) => reprova(i.severity))) return "failed";
+  return httpScan === "failed" ? "inconclusive" : "passed";
+}
+var GATE_EXIT = {
+  passed: 0,
+  failed: 1,
+  inconclusive: 2,
+  /** Erro operacional: autenticação, transporte, persistência. */
+  operational: 3
+};
+function exitCodeFromStatus(status) {
+  return GATE_EXIT[status];
+}
+var MAX_ISSUES = 200;
+var MAX_REASON = 200;
+var MAX_PATH2 = 180;
+var issueSchema = external_exports.object({
+  checkId: external_exports.string().min(1).max(80),
+  severity: external_exports.enum(SEVERITIES),
+  path: external_exports.string().min(1).max(MAX_PATH2),
+  reason: external_exports.string().min(1).max(MAX_REASON),
+  source: external_exports.enum(ISSUE_SOURCES)
+});
+var metricsSchema = external_exports.object({
+  nodes: external_exports.number().int().nonnegative(),
+  edges: external_exports.number().int().nonnegative(),
+  routes: external_exports.number().int().nonnegative(),
+  packages: external_exports.number().int().nonnegative(),
+  cycles: external_exports.number().int().nonnegative()
+});
+var qualityGateSchema = external_exports.object({
+  policy: external_exports.literal(QUALITY_GATE_POLICY),
+  status: external_exports.enum(GATE_STATUSES),
+  httpScan: external_exports.enum(HTTP_SCAN_OUTCOMES),
+  issues: external_exports.array(issueSchema).max(MAX_ISSUES),
+  counts: external_exports.record(external_exports.enum(SEVERITIES), external_exports.number().int().nonnegative()),
+  metrics: metricsSchema.nullable(),
+  codeFiles: external_exports.number().int().nonnegative(),
+  ranAt: external_exports.string().min(1)
+});
 
-// src/login.ts
-import { spawn as spawn2 } from "child_process";
+// ../../packages/schema/src/stages.ts
+var SCAN_STAGES = [
+  "connecting",
+  "reading-app",
+  "secrets",
+  "data-files",
+  "api-ai",
+  "config",
+  "verdict"
+];
+var CHECK_OUTCOMES = ["passed", "found", "skipped", "error"];
+var SKIP_REASONS = ["requires-verified", "requires-consent"];
+
+// ../../packages/schema/src/events.ts
+var VERDICTS = ["sealed", "exposed"];
+var nodeId = external_exports.enum(NODE_KINDS);
+var scanEventSchema = external_exports.discriminatedUnion("type", [
+  external_exports.object({
+    type: external_exports.literal("node.discovered"),
+    nodeId,
+    kind: external_exports.enum(NODE_KINDS),
+    label: external_exports.string().min(1),
+    parentId: nodeId.optional()
+  }),
+  external_exports.object({ type: external_exports.literal("node.probing"), nodeId }),
+  external_exports.object({ type: external_exports.literal("node.sealed"), nodeId }),
+  external_exports.object({
+    type: external_exports.literal("finding.found"),
+    checkId: external_exports.string().min(1),
+    severity: external_exports.enum(SEVERITIES),
+    nodeId,
+    proof: external_exports.string().min(1),
+    subject: external_exports.string().optional()
+  }),
+  external_exports.object({
+    type: external_exports.literal("scan.done"),
+    verdict: external_exports.enum(VERDICTS),
+    exposureCount: external_exports.number().int().nonnegative(),
+    exposedNodes: external_exports.number().int().nonnegative(),
+    stack: external_exports.object({
+      language: external_exports.array(external_exports.string()),
+      framework: external_exports.array(external_exports.string()),
+      styling: external_exports.array(external_exports.string())
+    }).optional(),
+    coverage: external_exports.object({
+      bundles: external_exports.number().int().nonnegative(),
+      routes: external_exports.number().int().nonnegative(),
+      tables: external_exports.number().int().nonnegative(),
+      buckets: external_exports.number().int().nonnegative(),
+      withGraph: external_exports.boolean()
+    }).optional()
+  }),
+  external_exports.object({ type: external_exports.literal("scan.failed"), reason: external_exports.string().min(1) }),
+  external_exports.object({
+    type: external_exports.literal("graph.ready"),
+    communities: external_exports.array(
+      external_exports.object({
+        nodeKind: external_exports.enum(NODE_KINDS),
+        label: external_exports.string().min(1),
+        files: external_exports.array(external_exports.string())
+      })
+    ),
+    nodes: external_exports.array(
+      external_exports.object({
+        id: external_exports.string().min(1),
+        kind: external_exports.enum(NODE_KINDS),
+        label: external_exports.string().min(1),
+        files: external_exports.array(external_exports.string())
+      })
+    ).optional(),
+    edges: external_exports.array(
+      external_exports.object({
+        from: external_exports.string().min(1),
+        to: external_exports.string().min(1),
+        type: external_exports.enum(["imports", "calls", "contains"])
+      })
+    ).optional(),
+    packages: external_exports.array(external_exports.string()).optional(),
+    advanced: external_exports.boolean()
+  }),
+  external_exports.object({
+    type: external_exports.literal("stage.started"),
+    stage: external_exports.enum(SCAN_STAGES),
+    index: external_exports.number().int().nonnegative(),
+    total: external_exports.number().int().positive(),
+    checks: external_exports.array(external_exports.object({ checkId: external_exports.string().min(1), title: external_exports.string().min(1) }))
+  }),
+  external_exports.object({ type: external_exports.literal("stage.done"), stage: external_exports.enum(SCAN_STAGES) }),
+  external_exports.object({
+    type: external_exports.literal("check.done"),
+    checkId: external_exports.string().min(1),
+    title: external_exports.string().min(1),
+    category: external_exports.enum(CATEGORIES),
+    nodeId,
+    outcome: external_exports.enum(CHECK_OUTCOMES),
+    reason: external_exports.enum(SKIP_REASONS).optional()
+  })
+]);
+var sequencedScanEventSchema = external_exports.intersection(
+  scanEventSchema,
+  external_exports.object({ seq: external_exports.number().int().nonnegative() })
+);
+
+// src/consent.ts
+import { chmodSync as chmodSync2, mkdirSync as mkdirSync2, readFileSync as readFileSync2, writeFileSync as writeFileSync2 } from "fs";
+import { createInterface } from "readline/promises";
+import { join as join2, resolve } from "path";
 
 // src/token.ts
 import { chmodSync, mkdirSync, readFileSync, writeFileSync } from "fs";
 import { homedir } from "os";
-import { join as join2 } from "path";
+import { join } from "path";
 function dirConfig() {
-  return join2(homedir(), ".config", "vibecheck");
+  return join(homedir(), ".config", "vibecheck");
 }
 function caminhoToken() {
-  return join2(dirConfig(), "token");
+  return join(dirConfig(), "token");
 }
 function lerToken() {
   const env = process.env["VIBECHECK_TOKEN"];
@@ -15012,7 +15425,515 @@ ${host}
   chmodSync(destino, 384);
 }
 
+// src/consent.ts
+var ARQUIVO = "code-consent.json";
+var ENV_CI_ALLOW = "VIBECHECK_ALLOW_CODE_SCAN";
+function caminho(deps) {
+  return join2((deps.configDir ?? dirConfig)(), ARQUIVO);
+}
+function repoKey(dir) {
+  return resolve(dir);
+}
+function listarConsentimentos(deps = {}) {
+  try {
+    const bruto = JSON.parse(readFileSync2(caminho(deps), "utf8"));
+    if (!Array.isArray(bruto)) return [];
+    return bruto.filter(
+      (e) => e !== null && typeof e === "object" && typeof e.repo === "string" && typeof e.acceptedAt === "string"
+    );
+  } catch {
+    return [];
+  }
+}
+function gravar(entradas, deps) {
+  const dir = (deps.configDir ?? dirConfig)();
+  mkdirSync2(dir, { recursive: true, mode: 448 });
+  const arquivo = join2(dir, ARQUIVO);
+  writeFileSync2(arquivo, `${JSON.stringify(entradas, null, 2)}
+`, { mode: 384 });
+  chmodSync2(arquivo, 384);
+}
+function temConsentimento(dir, deps = {}) {
+  const chave = repoKey(dir);
+  return listarConsentimentos(deps).some((e) => e.repo === chave);
+}
+function registrarConsentimento(dir, deps = {}) {
+  const chave = repoKey(dir);
+  const atuais = listarConsentimentos(deps).filter((e) => e.repo !== chave);
+  const quando = (deps.now ?? (() => /* @__PURE__ */ new Date()))().toISOString();
+  gravar([...atuais, { repo: chave, acceptedAt: quando }], deps);
+}
+function revogarConsentimento(dir, deps = {}) {
+  const chave = repoKey(dir);
+  const atuais = listarConsentimentos(deps);
+  const restantes = atuais.filter((e) => e.repo !== chave);
+  if (restantes.length === atuais.length) return false;
+  gravar(restantes, deps);
+  return true;
+}
+var TEXTO_DO_PEDIDO = [
+  "VibeCheck is about to read the source files in this repository, on this machine,",
+  "to run the code checks.",
+  "",
+  "What leaves your machine: the check id, its severity, the file path and the",
+  "catalog sentence. Never a line of code, never a snippet, never a value.",
+  ""
+].join("\n");
+async function resolverConsentimento(dir, opcoes, deps = {}) {
+  if (temConsentimento(dir, deps)) return "already";
+  const env = deps.env ?? process.env;
+  if (opcoes.ci) {
+    if (env[ENV_CI_ALLOW] !== "1") return "needs-ci-env";
+    registrarConsentimento(dir, deps);
+    return "granted";
+  }
+  const perguntar = deps.ask ?? (async (pergunta) => {
+    const rl = createInterface({ input: process.stdin, output: process.stderr });
+    try {
+      return await rl.question(pergunta);
+    } finally {
+      rl.close();
+    }
+  });
+  const resposta = await perguntar(`${TEXTO_DO_PEDIDO}Read this repository? [y/N] `);
+  if (!/^y(es)?$/i.test(resposta.trim())) return "denied";
+  registrarConsentimento(dir, deps);
+  return "granted";
+}
+
+// src/follow.ts
+function eventsUrl(base, scanId, shareToken) {
+  return `${base}/api/scan/${scanId}/events?t=${encodeURIComponent(shareToken)}`;
+}
+async function followScan(base, scanId, shareToken, options = {}) {
+  const fetchFn = options.fetch ?? fetch;
+  const events = [];
+  let exit = 0;
+  const resposta = await fetchFn(eventsUrl(base, scanId, shareToken));
+  if (!resposta.ok || resposta.body === null) {
+    return { events, final: null, exit: 0, opened: false };
+  }
+  const leitor = resposta.body.getReader();
+  const decoder = new TextDecoder();
+  let buf = "";
+  while (true) {
+    const { done, value } = await leitor.read();
+    if (done) break;
+    buf += decoder.decode(value, { stream: true });
+    const blocos = buf.split("\n\n");
+    buf = blocos.pop() ?? "";
+    for (const bloco of blocos) {
+      const linha = bloco.split("\n").find((l) => l.startsWith("data: "));
+      if (linha === void 0) continue;
+      let evento;
+      try {
+        evento = JSON.parse(linha.slice(6));
+      } catch {
+        continue;
+      }
+      if (typeof evento !== "object" || evento === null || !("type" in evento)) continue;
+      events.push(evento);
+      options.onEvent?.(evento);
+      if (evento.type === "finding.found" && (evento.severity === "fatal" || evento.severity === "critical")) {
+        exit = 1;
+      }
+      if (evento.type === "scan.done" || evento.type === "scan.failed") {
+        if (evento.type === "scan.failed") exit = 1;
+        return { events, final: evento, exit, opened: true };
+      }
+    }
+  }
+  return { events, final: null, exit, opened: true };
+}
+
+// src/gate.ts
+import { mkdirSync as mkdirSync3, writeFileSync as writeFileSync3 } from "fs";
+import { join as join3 } from "path";
+
+// ../../packages/checks/src/code/types.ts
+var API_ROUTE_FILE = /(^|\/)(app\/.*\/route\.(ts|js|tsx|jsx)|pages\/api\/.+\.(ts|js))$/;
+function isApiRoute(path) {
+  return API_ROUTE_FILE.test(path);
+}
+
+// ../../packages/checks/src/code/checks.ts
+var MIGRATION_FILE = /(^|\/)supabase\/migrations\/[^/]+\.sql$/;
+var CREATE_TABLE = /create\s+table\s+(?:if\s+not\s+exists\s+)?(?:"?[a-z_][a-z0-9_]*"?\.)?"?([a-z_][a-z0-9_]*)"?/gi;
+var ENABLE_RLS = /alter\s+table\s+(?:if\s+exists\s+)?(?:only\s+)?(?:"?[a-z_][a-z0-9_]*"?\.)?"?([a-z_][a-z0-9_]*)"?\s+enable\s+row\s+level\s+security/gi;
+function all(pattern, text) {
+  const out = [];
+  for (const m of text.matchAll(pattern)) {
+    const nome = m[1];
+    if (nome !== void 0) out.push(nome.toLowerCase());
+  }
+  return out;
+}
+function isClientFile(file2) {
+  if (/^\s*['"]use client['"]/.test(file2.content)) return true;
+  if (/\.client\.(tsx|jsx|ts|js)$/.test(file2.path)) return true;
+  return /(^|\/)pages\/(?!api\/).+\.(tsx|jsx|ts|js)$/.test(file2.path);
+}
+var TOUCHES_DB = /\b(supabase\.(?:from|rpc|storage)\b|prisma\.\w+\.\w+\(|drizzle\(|\bdb\.(?:select|insert|update|delete|query|execute|from)\(|\.from\(['"]|sql`|pool\.query\(|knex\(|mongoose\.|\.collection\(['"])/;
+var HAS_AUTH = /\b(getSession|getUser|auth\(\)|currentUser|requireAuth|verifyToken|verifyJwt|jwtVerify|authorization|Bearer|withAuth|clerk|next-auth|getServerSession|session)\b/i;
+var PUBLIC_ROUTE = /(^|\/)(webhooks?|health|healthz|ping|status|robots|sitemap|og|opengraph|cron)(\/|\.|$)/i;
+var AI_SDK = /from\s+['"](openai|@anthropic-ai\/sdk|ai|@ai-sdk\/[^'"]+|@google\/generative-ai|groq-sdk|cohere-ai|@mistralai\/mistralai)['"]/;
+var HAS_LIMITER = /\b(ratelimit|rateLimit|Ratelimit|upstash|limiter|throttle|slidingWindow|tokenBucket)\b/;
+var STRIPE_IMPORT = /from\s+['"]stripe['"]/;
+var WEBHOOK_PATH = /webhook/i;
+var SIGNATURE_CHECK = /constructEvent(?:Async)?\(|stripe-signature/;
+var SERVICE_ROLE_REF = /\b(SUPABASE_SERVICE_ROLE_KEY|SERVICE_ROLE_KEY|sb_secret_[A-Za-z0-9_]+|NEXT_PUBLIC_[A-Z0-9_]*(?:SECRET|SERVICE_ROLE|PRIVATE)[A-Z0-9_]*)\b/;
+var ENV_FILES = [
+  ".env",
+  ".env.local",
+  ".env.production",
+  ".env.development",
+  ".env.staging"
+];
+var codeRlsMissing = {
+  id: "code-rls-missing",
+  source: "code",
+  category: "data",
+  severity: "critical",
+  title: "Table created without row level security",
+  impact: "A migration creates a table and never turns on row level security for it. Once it has rows, anyone with the public key can read them \u2014 this is the hole the RLS check lights up from outside.",
+  howToDetect: (ctx) => {
+    const migrations = ctx.files.filter((f) => MIGRATION_FILE.test(f.path));
+    if (migrations.length === 0) return [];
+    const comRls = /* @__PURE__ */ new Set();
+    for (const m of migrations) for (const t of all(ENABLE_RLS, m.content)) comRls.add(t);
+    const out = [];
+    const vistas = /* @__PURE__ */ new Set();
+    for (const m of migrations) {
+      for (const tabela of all(CREATE_TABLE, m.content)) {
+        if (comRls.has(tabela) || vistas.has(tabela)) continue;
+        vistas.add(tabela);
+        out.push({
+          path: m.path,
+          reason: `table \`${tabela}\` is created without enable row level security`
+        });
+      }
+    }
+    return out;
+  },
+  fixPrompt: (a) => `In your code, ${a.reason} (${a.path}).
+
+We do not know the columns or who should read what. We cannot write the policy from here.
+
+Good practice: every table starts with row level security on, in the same migration that creates it. Then one policy per real access: a person reads their own rows; a public catalog, if it exists, is a deliberate read policy; writes always go through a session. Do this in a new migration, never by editing one that already ran.
+
+After, deploy and read the table with the public key and no session \u2014 it must answer empty or denied.`
+};
+var codeServiceRoleInClient = {
+  id: "code-service-role-in-client",
+  source: "code",
+  category: "secrets",
+  severity: "fatal",
+  title: "Service key referenced in client code",
+  impact: "A file that runs in the browser mentions the Supabase service key or a NEXT_PUBLIC_ secret. Whatever the bundler inlines there ships to every visitor \u2014 this is the fatal finding from outside, one build away.",
+  howToDetect: (ctx) => ctx.files.filter(isClientFile).filter((f) => SERVICE_ROLE_REF.test(f.content)).map((f) => ({
+    path: f.path,
+    reason: "client-side file references a service or secret key"
+  })),
+  fixPrompt: (a) => `In your code, a client-side file references a service or secret key (${a.path}).
+
+We do not have the value and we do not want it. The problem is the place, not the string.
+
+Good practice: the service key lives only in server code \u2014 a route handler, a server action, an edge function \u2014 read from the environment without the NEXT_PUBLIC_ prefix. The browser talks to your API; your API talks to the database. Remove the reference from the client file and, if the key was ever bundled, rotate it in the dashboard.
+
+After, search the built bundle for the key prefix and confirm it is gone.`
+};
+var codeRouteWithoutAuth = {
+  id: "code-route-without-auth",
+  source: "code",
+  category: "auth",
+  severity: "high",
+  title: "API route touches data without a session check",
+  impact: "An API route reads or writes the database and nothing in it checks who is asking. If the middleware does not cover it, anyone can call it \u2014 this is what api-route-noauth lights up from outside.",
+  howToDetect: (ctx) => ctx.files.filter((f) => isApiRoute(f.path) && !PUBLIC_ROUTE.test(f.path)).filter((f) => TOUCHES_DB.test(f.content) && !HAS_AUTH.test(f.content)).map((f) => ({
+    path: f.path,
+    reason: "route reads or writes data with no session check in the file"
+  })),
+  fixPrompt: (a) => `In your code, a route reads or writes data with no session check in the file (${a.path}).
+
+We cannot see your middleware. If it already protects this path, mark the finding as known.
+
+Good practice: the route resolves the session first and answers 401 before touching data; what it reads or writes is scoped to that user. A public route is public on purpose, with a comment saying so, and never exposes rows that belong to someone.
+
+After, call the route from a logged-out client and confirm it answers 401 or 403.`
+};
+var codeEnvCommitted = {
+  id: "code-env-committed",
+  source: "code",
+  category: "secrets",
+  severity: "critical",
+  title: ".env file tracked by git",
+  impact: "An environment file is committed to the repository. Every clone, fork, CI log and AI tool that reads the repo has the secrets in it. Even after deleting it, the history keeps the values.",
+  // Só o nome. O conteúdo nunca é lido — é o único check que não recebe
+  // `content`, e é assim de propósito.
+  howToDetect: (ctx) => ENV_FILES.filter((nome) => ctx.tracked(nome)).map((nome) => ({
+    path: nome,
+    reason: `${nome} is tracked by git`
+  })),
+  fixPrompt: (a) => `In your code, ${a.reason}.
+
+We did not read it. We only saw that git tracks it.
+
+Good practice: environment files stay out of version control \u2014 add them to .gitignore, remove them from the index, and keep a committed .env.example with the variable names and no values. Every secret that was ever in the file is compromised: rotate each one in its provider.
+
+After, run git ls-files and confirm no .env file is listed.`
+};
+var codeAiRouteWithoutLimit = {
+  id: "code-ai-route-without-limit",
+  source: "code",
+  category: "ai",
+  severity: "high",
+  title: "AI route with no rate limit",
+  impact: "A route calls an LLM provider and nothing in it limits how often. A loop from one client turns your provider account into an open bill \u2014 this is ai-proxy-open, seen from inside.",
+  howToDetect: (ctx) => ctx.files.filter((f) => isApiRoute(f.path)).filter((f) => AI_SDK.test(f.content) && !HAS_LIMITER.test(f.content)).map((f) => ({
+    path: f.path,
+    reason: "route calls an AI provider with no rate limit in the file"
+  })),
+  fixPrompt: (a) => `In your code, a route calls an AI provider with no rate limit in the file (${a.path}).
+
+We cannot see limits applied elsewhere. If your gateway already throttles this path, mark the finding as known.
+
+Good practice: the route requires a session, then applies a per-user limit (so many calls per minute, so many tokens per day) before calling the provider, and answers 429 when it is hit. Cost caps at the provider are the second net, not the first.
+
+After, call the route in a loop from one client and confirm it starts answering 429.`
+};
+var codeWebhookUnsigned = {
+  id: "code-webhook-unsigned",
+  source: "code",
+  category: "config",
+  severity: "high",
+  title: "Stripe webhook without signature verification",
+  impact: 'A webhook route imports Stripe and never verifies the event signature. Anyone can POST a fake "payment succeeded" and your app will believe it \u2014 the one check we refuse to run from outside, because proving it would mean doing exactly that.',
+  howToDetect: (ctx) => ctx.files.filter((f) => isApiRoute(f.path) && WEBHOOK_PATH.test(f.path)).filter((f) => STRIPE_IMPORT.test(f.content) && !SIGNATURE_CHECK.test(f.content)).map((f) => ({
+    path: f.path,
+    reason: "Stripe webhook route never verifies the event signature"
+  })),
+  fixPrompt: (a) => `In your code, a Stripe webhook route never verifies the event signature (${a.path}).
+
+We cannot see the secret and do not want it.
+
+Good practice: the route reads the raw body and the stripe-signature header, builds the event with the webhook secret from the environment, and rejects anything that fails. Only the verified event drives state. Each event id is processed once.
+
+After, POST a fabricated event to the route and confirm it answers 400.`
+};
+var CODE_CHECKS = [
+  codeRlsMissing,
+  codeServiceRoleInClient,
+  codeRouteWithoutAuth,
+  codeEnvCommitted,
+  codeAiRouteWithoutLimit,
+  codeWebhookUnsigned
+];
+function runCodeChecks(ctx, catalog = CODE_CHECKS) {
+  const out = [];
+  for (const check2 of catalog) {
+    let advisories = [];
+    try {
+      advisories = check2.howToDetect(ctx);
+    } catch {
+      advisories = [];
+    }
+    for (const a of advisories) {
+      out.push({
+        checkId: check2.id,
+        severity: check2.severity,
+        path: a.path,
+        reason: a.reason
+      });
+    }
+  }
+  return out;
+}
+
+// src/gate.ts
+var GATE_DIR = ".vibecheck";
+var GATE_JSON = "quality-gate.json";
+var GATE_SARIF = "quality-gate.sarif";
+function escreverArtefatos(dir, report, sarif, deps) {
+  deps.writeArtifact(
+    join3(dir, GATE_DIR, GATE_JSON),
+    `${JSON.stringify(report, null, 2)}
+`
+  );
+  deps.writeArtifact(
+    join3(dir, GATE_DIR, GATE_SARIF),
+    `${JSON.stringify(sarif, null, 2)}
+`
+  );
+}
+function gravarNoDisco(caminho2, conteudo) {
+  mkdirSync3(join3(caminho2, ".."), { recursive: true });
+  writeFileSync3(caminho2, conteudo);
+}
+async function rodarHttp(input, grafo, deps) {
+  const headers = {
+    authorization: `Bearer ${input.token}`,
+    "content-type": "application/json"
+  };
+  const criado = await deps.fetch(`${deps.base}/api/cli/scan`, {
+    method: "POST",
+    headers,
+    body: JSON.stringify({
+      url: input.url,
+      ...grafo === null ? {} : { graph: grafo }
+    })
+  });
+  const corpo = await criado.json().catch(() => ({}));
+  if (criado.status === 429) {
+    deps.log(`quota: ${corpo.error ?? "this domain was scanned recently"}`);
+    return { outcome: "skipped-quota", issues: [] };
+  }
+  if (!criado.ok || corpo.scanId === void 0) {
+    deps.log(`scan not opened: ${corpo.error ?? `HTTP ${String(criado.status)}`}`);
+    return { outcome: "failed", issues: [] };
+  }
+  const scan = {
+    scanId: corpo.scanId,
+    shareToken: corpo.shareToken ?? "",
+    liveUrl: corpo.liveUrl ?? `${deps.base}/advanced/${corpo.scanId}`
+  };
+  if (grafo !== null && grafo.advanced) {
+    const put = await deps.fetch(`${deps.base}/api/cli/scan/${scan.scanId}/graph`, {
+      method: "PUT",
+      headers,
+      body: JSON.stringify(grafo)
+    });
+    if (!put.ok) deps.log("graph rejected by the server \u2014 scan continues HTTP-only");
+  }
+  const seguido = await followScan(deps.base, scan.scanId, scan.shareToken, {
+    fetch: deps.fetch
+  });
+  if (!seguido.opened) {
+    deps.log(`could not follow the scan \u2014 see ${scan.liveUrl}`);
+    return { outcome: "failed", issues: [], scan };
+  }
+  const issues = [];
+  for (const evento of seguido.events) {
+    if (evento.type !== "finding.found") continue;
+    issues.push({
+      checkId: evento.checkId,
+      severity: evento.severity,
+      // No achado HTTP o "path" é o assunto (tabela, bucket, rota) ou o
+      // nó que acendeu — não há arquivo do lado de fora.
+      path: evento.subject ?? evento.nodeId,
+      reason: evento.proof.length > 0 ? evento.proof : evento.checkId,
+      source: "http"
+    });
+  }
+  return {
+    outcome: seguido.final?.type === "scan.failed" ? "failed" : "ran",
+    issues,
+    scan
+  };
+}
+async function runGate(input, deps) {
+  const decisao = await resolverConsentimento(input.dir, { ci: input.ci }, deps.consent);
+  if (decisao === "denied") {
+    deps.log("code scan declined \u2014 nothing was read, nothing was sent");
+    return { exit: GATE_EXIT.inconclusive, report: null };
+  }
+  if (decisao === "needs-ci-env") {
+    deps.log(
+      "CI needs VIBECHECK_ALLOW_CODE_SCAN=1 to read the repository \u2014 refusing to guess"
+    );
+    return { exit: GATE_EXIT.inconclusive, report: null };
+  }
+  const grafo = await deps.extractGraph(input.dir);
+  const metrics = grafo === null ? null : graphMetrics(grafo);
+  const repo = deps.readRepo(input.dir);
+  const codeIssues = runCodeChecks(repo).map((i) => ({
+    checkId: i.checkId,
+    severity: i.severity,
+    path: i.path,
+    reason: i.reason,
+    source: "code"
+  }));
+  let httpScan = "skipped-flag";
+  let httpIssues = [];
+  let scan;
+  if (!input.codeOnly) {
+    const resultado = await rodarHttp(input, grafo, deps);
+    httpScan = resultado.outcome;
+    httpIssues = resultado.issues;
+    scan = resultado.scan;
+  }
+  const issues = [...codeIssues, ...httpIssues];
+  const codeFiles = repo.files.length;
+  const report = {
+    policy: QUALITY_GATE_POLICY,
+    status: statusFromIssues(issues, httpScan, analysed({ codeFiles, httpScan })),
+    httpScan,
+    issues,
+    counts: contarPorSeveridade(issues),
+    metrics,
+    codeFiles,
+    ranAt: deps.now().toISOString()
+  };
+  return {
+    exit: exitCodeFromStatus(report.status),
+    report,
+    ...scan === void 0 ? {} : { scanId: scan.scanId, liveUrl: scan.liveUrl }
+  };
+}
+async function enviarGate(scanId, report, input, deps) {
+  const res = await deps.fetch(`${deps.base}/api/cli/scan/${scanId}/quality-gate`, {
+    method: "PUT",
+    headers: {
+      authorization: `Bearer ${input.token}`,
+      "content-type": "application/json"
+    },
+    body: JSON.stringify(report)
+  });
+  if (!res.ok) {
+    const corpo = await res.json().catch(() => ({}));
+    deps.log(`gate not saved: ${corpo.error ?? `HTTP ${String(res.status)}`}`);
+    return false;
+  }
+  return true;
+}
+
+// src/graphify.ts
+import { spawn } from "child_process";
+import { readFile } from "fs/promises";
+import { join as join4 } from "path";
+async function tentarGraphify(raiz) {
+  const json2 = join4(raiz, "graphify-out", "graph.json");
+  try {
+    return JSON.parse(await readFile(json2, "utf8"));
+  } catch {
+  }
+  const ok = await new Promise((resolve2) => {
+    const child = spawn("graphify", [".", "--no-viz"], {
+      cwd: raiz,
+      stdio: "ignore"
+    });
+    const timer = setTimeout(() => {
+      child.kill();
+      resolve2(false);
+    }, 2e4);
+    child.on("exit", (code) => {
+      clearTimeout(timer);
+      resolve2(code === 0);
+    });
+    child.on("error", () => {
+      clearTimeout(timer);
+      resolve2(false);
+    });
+  });
+  if (!ok) return null;
+  try {
+    return JSON.parse(await readFile(json2, "utf8"));
+  } catch {
+    return null;
+  }
+}
+
 // src/login.ts
+import { spawn as spawn2 } from "child_process";
 function urlBase() {
   return (process.env["VIBECHECK_URL"] ?? "https://vibecheck.kinkai.cloud").replace(
     /\/$/,
@@ -15032,12 +15953,12 @@ function comandosAbrirBrowser(url2, platform = process.platform, env = process.e
   return [["xdg-open", [url2]]];
 }
 function tentarSpawn(cmd, args) {
-  return new Promise((resolve) => {
+  return new Promise((resolve2) => {
     const child = spawn2(cmd, args, { stdio: "ignore", detached: true });
-    child.once("error", () => resolve(false));
+    child.once("error", () => resolve2(false));
     child.once("spawn", () => {
       child.unref();
-      resolve(true);
+      resolve2(true);
     });
   });
 }
@@ -15058,22 +15979,23 @@ async function detalheHttp(resposta) {
     }
   }
   if (resposta.status === 404) {
-    return " \u2014 a API do CLI ainda n\xE3o est\xE1 neste deploy";
+    return " \u2014 the CLI API is not in this deploy yet";
   }
   return "";
 }
-async function loginDevice(ci) {
+async function loginDevice(ci, options = {}) {
   const base = urlBase();
   const aberto = await fetch(`${base}/api/cli/device`, { method: "POST" });
   if (!aberto.ok) {
     const extra = await detalheHttp(aberto);
     throw new Error(
-      `n\xE3o foi poss\xEDvel abrir o device-code em ${base} (HTTP ${aberto.status})${extra}`
+      `could not open the device-code at ${base} (HTTP ${aberto.status})${extra}`
     );
   }
   const corpo = await aberto.json();
-  console.warn(`No navegador, entre na conta e autorize com o c\xF3digo ${corpo.user_code}`);
+  console.warn(`In the browser, sign in and authorize with code ${corpo.user_code}`);
   console.warn(corpo.verification_url);
+  options.onCode?.({ userCode: corpo.user_code, verificationUrl: corpo.verification_url });
   if (!ci) await abrirBrowser(corpo.verification_url);
   const intervalo = Math.max(3, corpo.interval ?? 3) * 1e3;
   const limite = Date.now() + 10 * 6e4;
@@ -15088,15 +16010,133 @@ async function loginDevice(ci) {
       return { token: dados.token, host: dados.host };
     }
     if (dados.status === "expired" || dados.error === "expired") {
-      throw new Error("c\xF3digo expirado \u2014 rode de novo");
+      throw new Error("code expired \u2014 run again");
+    }
+  }
+  throw new Error("timed out without authorization");
+}
+
+// src/repo.ts
+import { execFileSync } from "child_process";
+import { lstatSync, readdirSync, readFileSync as readFileSync3 } from "fs";
+import { join as join5, relative } from "path";
+var MAX_FILES = 800;
+var MAX_BYTES2 = 64e3;
+var MAX_SQL_BYTES = 512e3;
+var SOURCE = /\.(ts|tsx|js|jsx|mjs|cjs|sql)$/;
+var SKIP_DIR = /* @__PURE__ */ new Set([
+  "node_modules",
+  ".git",
+  "dist",
+  ".next",
+  "coverage",
+  "graphify-out",
+  ".turbo",
+  "out",
+  "build",
+  ".vercel"
+]);
+function gitTracked(dir) {
+  try {
+    const saida = execFileSync("git", ["ls-files", "-z"], {
+      cwd: dir,
+      encoding: "utf8",
+      stdio: ["ignore", "pipe", "ignore"],
+      maxBuffer: 16 * 1024 * 1024
+    });
+    return new Set(saida.split("\0").filter((p) => p.length > 0));
+  } catch {
+    return null;
+  }
+}
+function walk(dir, raiz, out) {
+  if (out.length >= MAX_FILES) return;
+  let entradas;
+  try {
+    entradas = readdirSync(dir);
+  } catch {
+    return;
+  }
+  for (const nome of entradas) {
+    if (out.length >= MAX_FILES) return;
+    if (SKIP_DIR.has(nome) || nome.startsWith(".") && nome !== ".env") continue;
+    const caminho2 = join5(dir, nome);
+    let st;
+    try {
+      st = lstatSync(caminho2);
+    } catch {
+      continue;
+    }
+    if (st.isSymbolicLink()) continue;
+    if (st.isDirectory()) walk(caminho2, raiz, out);
+    else if (SOURCE.test(nome)) out.push(relative(raiz, caminho2).split("\\").join("/"));
+  }
+}
+function readCodeContext(dir) {
+  const tracked = gitTracked(dir);
+  const caminhos = [];
+  walk(dir, dir, caminhos);
+  const files = [];
+  for (const path of caminhos) {
+    try {
+      const st = lstatSync(join5(dir, path));
+      if (st.size > (path.endsWith(".sql") ? MAX_SQL_BYTES : MAX_BYTES2)) continue;
+      files.push({ path, content: readFileSync3(join5(dir, path), "utf8") });
+    } catch {
     }
   }
-  throw new Error("tempo esgotado sem autoriza\xE7\xE3o");
+  return {
+    files,
+    // Sem git não há "commitado": um `.env` só presente no disco era
+    // reportado como "tracked by git" (critical) em qualquer pasta sem
+    // `.git` — tarball, contexto de build, runner sem git no PATH.
+    tracked: (path) => tracked !== null && tracked.has(path)
+  };
+}
+
+// src/sarif.ts
+var NIVEL = {
+  fatal: "error",
+  critical: "error",
+  high: "error",
+  medium: "warning",
+  low: "note"
+};
+function regras(issues) {
+  const vistos = /* @__PURE__ */ new Map();
+  for (const issue2 of issues) {
+    if (!vistos.has(issue2.checkId)) vistos.set(issue2.checkId, issue2.reason);
+  }
+  return [...vistos].map(([id, text]) => ({ id, shortDescription: { text } }));
+}
+function toSarif(report, version2) {
+  return {
+    $schema: "https://json.schemastore.org/sarif-2.1.0.json",
+    version: "2.1.0",
+    runs: [
+      {
+        tool: {
+          driver: {
+            name: "VibeCheck",
+            informationUri: "https://vibecheck.kinkai.cloud",
+            version: version2,
+            rules: regras(report.issues)
+          }
+        },
+        results: report.issues.map((issue2) => ({
+          ruleId: issue2.checkId,
+          level: NIVEL[issue2.severity],
+          message: { text: issue2.reason },
+          locations: [{ physicalLocation: { artifactLocation: { uri: issue2.path } } }]
+        }))
+      }
+    ]
+  };
 }
 
 // src/walker.ts
-import { lstatSync, readdirSync, readFileSync as readFileSync2 } from "fs";
-import { join as join3, relative } from "path";
+import { lstatSync as lstatSync2, readdirSync as readdirSync2, readFileSync as readFileSync4 } from "fs";
+import { join as join6, relative as relative2 } from "path";
 var IGNORAR = /* @__PURE__ */ new Set([
   "node_modules",
   ".git",
@@ -15111,7 +16151,19 @@ var IGNORAR = /* @__PURE__ */ new Set([
 var CODIGO = /\.(m?[jt]sx?)$/;
 var MAX_ARQUIVOS = 800;
 var MAX_NOS_WALKER = 120;
-var EXT = ["", ".ts", ".tsx", ".js", ".jsx", ".mjs", ".cjs", "/index.ts", "/index.tsx", "/index.js"];
+var MAX_BYTES_ARQUIVO = 32e3;
+var EXT = [
+  "",
+  ".ts",
+  ".tsx",
+  ".js",
+  ".jsx",
+  ".mjs",
+  ".cjs",
+  "/index.ts",
+  "/index.tsx",
+  "/index.js"
+];
 var EXPORT_RE = /export\s+(?:default\s+)?(?:async\s+)?(?:function\*?|class|const|let|var|enum)\s+([A-Za-z_$][\w$]*)/g;
 var EXPORT_LISTA_RE = /export\s+\{([^}]+)\}/g;
 var FROM_RE = /(?:from\s+|import\s*\(\s*|require\s*\(\s*)['"]([^'"]+)['"]/g;
@@ -15119,16 +16171,16 @@ var HANDLERS = /* @__PURE__ */ new Set(["GET", "POST", "PUT", "PATCH", "DELETE",
 function listar(raiz, dir, acc) {
   let nomes;
   try {
-    nomes = readdirSync(dir);
+    nomes = readdirSync2(dir);
   } catch {
     return;
   }
   for (const nome of nomes) {
     if (IGNORAR.has(nome) || nome.startsWith(".")) continue;
-    const cheio = join3(dir, nome);
+    const cheio = join6(dir, nome);
     let stat;
     try {
-      stat = lstatSync(cheio);
+      stat = lstatSync2(cheio);
     } catch {
       continue;
     }
@@ -15142,7 +16194,7 @@ function listar(raiz, dir, acc) {
   }
 }
 function posixRel(raiz, cheio) {
-  return relative(raiz, cheio).replaceAll("\\", "/");
+  return relative2(raiz, cheio).replaceAll("\\", "/");
 }
 function dirnamePosix(caminho2) {
   const i = caminho2.lastIndexOf("/");
@@ -15215,7 +16267,7 @@ function resolverSpec(de, spec, indice) {
   return null;
 }
 function rotuloDe(rel, exports) {
-  const rota = rotaDeArquivo(rel);
+  const rota = routeFromFile(rel);
   const handlers = exports.filter((e) => HANDLERS.has(e));
   if (rota !== null && handlers.length > 0) return `${handlers[0]} ${rota}`;
   if (rota !== null) return rota;
@@ -15228,7 +16280,7 @@ function lerArquivo(raiz, cheio) {
   const rel = posixRel(raiz, cheio);
   let conteudo = "";
   try {
-    conteudo = readFileSync2(cheio, "utf8").slice(0, 12e3);
+    conteudo = readFileSync4(cheio, "utf8").slice(0, MAX_BYTES_ARQUIVO);
   } catch {
     return null;
   }
@@ -15236,21 +16288,25 @@ function lerArquivo(raiz, cheio) {
   const specs = specsDe(conteudo);
   return {
     rel,
-    rotulo: rotuloDe(rel, exports),
+    label: rotuloDe(rel, exports),
     exports,
-    importsRel: specs.filter((s) => s.startsWith(".") || s.startsWith("@/") || s.startsWith("~/")),
-    importsPkg: specs
+    importsRel: specs.filter(
+      (s) => s.startsWith(".") || s.startsWith("@/") || s.startsWith("~/")
+    ),
+    importsPkg: specs,
+    data: identifiersFromCode(conteudo)
   };
 }
 function prioridade(info) {
-  const kind = mapearKind({ rotulo: info.rotulo, arquivos: [info.rel] });
+  const kind = mapKind({ label: info.label, files: [info.rel] });
   if (kind === "api") return 0;
   if (kind === "payments" || kind === "auth" || kind === "db") return 1;
-  if (kind === "storage" || kind === "secrets" || kind === "browser" || kind === "ai") return 2;
-  if (info.importsPkg.some((s) => idDePacote(s) !== null)) return 3;
+  if (kind === "storage" || kind === "secrets" || kind === "browser" || kind === "ai")
+    return 2;
+  if (info.importsPkg.some((s) => packageId(s) !== null)) return 3;
   return 8;
 }
-function extrairDoRepo(raiz) {
+function extractFromRepo(raiz) {
   const caminhos = [];
   listar(raiz, raiz, caminhos);
   if (caminhos.length === 0) return null;
@@ -15265,7 +16321,9 @@ function extrairDoRepo(raiz) {
   if (infos.length === 0) return null;
   const porRel = new Map(infos.map((i) => [i.rel, i]));
   const escolhidos = /* @__PURE__ */ new Set();
-  const ordenados = [...infos].sort((a, b) => prioridade(a) - prioridade(b) || a.rel.localeCompare(b.rel));
+  const ordenados = [...infos].sort(
+    (a, b) => prioridade(a) - prioridade(b) || a.rel.localeCompare(b.rel)
+  );
   for (const info of ordenados) {
     if (prioridade(info) <= 3) escolhidos.add(info.rel);
   }
@@ -15295,31 +16353,31 @@ function extrairDoRepo(raiz) {
   const files = [...escolhidos].map((rel) => porRel.get(rel)).filter((i) => i !== void 0).sort((a, b) => prioridade(a) - prioridade(b) || a.rel.localeCompare(b.rel)).slice(0, MAX_NOS_WALKER);
   const nodes = [];
   const edges = [];
-  const pacotes = /* @__PURE__ */ new Set();
-  const idDe2 = /* @__PURE__ */ new Map();
+  const packages = /* @__PURE__ */ new Set();
+  const idDe = /* @__PURE__ */ new Map();
   for (const [i, info] of files.entries()) {
     const id = `f${String(i)}`;
-    idDe2.set(info.rel, id);
+    idDe.set(info.rel, id);
     nodes.push({
       id,
-      label: info.rotulo,
-      identifier: info.exports[0] ?? info.rotulo,
+      label: info.label,
+      identifier: info.exports[0] ?? info.label,
       source_file: info.rel
     });
   }
   for (const info of files) {
-    const de = idDe2.get(info.rel);
+    const de = idDe.get(info.rel);
     if (de === void 0) continue;
     for (const spec of info.importsRel) {
       const alvo = resolverSpec(info.rel, spec, indice);
-      const para = alvo === null ? void 0 : idDe2.get(alvo);
+      const para = alvo === null ? void 0 : idDe.get(alvo);
       if (para === void 0) continue;
       edges.push({ source: de, target: para, relation: "imports" });
     }
     for (const spec of info.importsPkg) {
-      const pkg = idDePacote(spec);
+      const pkg = packageId(spec);
       if (pkg === null) continue;
-      pacotes.add(pkg);
+      packages.add(pkg);
       const pkgId = `pkg:${pkg}`;
       if (!nodes.some((n) => n["id"] === pkgId)) {
         nodes.push({ id: pkgId, label: pkg });
@@ -15327,15 +16385,44 @@ function extrairDoRepo(raiz) {
       edges.push({ source: de, target: pkgId, relation: "imports" });
     }
   }
-  const sanitizado = sanitizarGrafo({ nodes, edges, pacotes: [...pacotes] });
-  if (!sanitizado.ok || !sanitizado.grafo.avancado) return null;
-  return sanitizado.grafo;
+  const data = mergeIdentifiers(
+    infos.map((i) => i.data),
+    {
+      tables: MAX_HINT_TABLES,
+      buckets: MAX_HINT_BUCKETS,
+      collections: MAX_HINT_COLLECTIONS
+    }
+  );
+  const sanitizado = sanitizeGraph({ nodes, edges, packages: [...packages], data });
+  if (!sanitizado.ok || !sanitizado.graph.advanced) return null;
+  return sanitizado.graph;
 }
-function scanEhAvancado(grafo) {
-  return grafo !== null && grafo.avancado === true;
+function isAdvancedScan(grafo) {
+  return grafo !== null && grafo.advanced === true;
 }
 
 // src/cli.ts
+var VERSION = "0.2.0";
+var AJUDA = `vibecheck \u2014 security check for AI-built apps
+
+  npx @kinkai.cloud/vibecheck [options]
+
+Options
+  --url <url>        target; defaults to https://<verified host of the token>
+  --dir <path>       repository root (default: current directory)
+  --gate             CI mode: HTTP checks + code checks + graph signals,
+                     writes ${GATE_DIR}/${GATE_JSON} (+ .sarif) and exits
+                     0 passed \xB7 1 failed \xB7 2 inconclusive \xB7 3 error
+  --code-only        with --gate: skip the HTTP scan (no quota, no history)
+  --ci               never open a browser; requires VIBECHECK_TOKEN
+  --no-wait          do not follow the scan; exit as soon as it is queued
+  --gate-consent <list|revoke>   manage local code-scan consent
+  --help, --version
+
+Environment
+  VIBECHECK_TOKEN, VIBECHECK_HOST, VIBECHECK_URL
+  VIBECHECK_ALLOW_CODE_SCAN=1    required by --gate in CI
+`;
 function arg(nome, argv) {
   const i = argv.indexOf(nome);
   if (i < 0) return null;
@@ -15347,87 +16434,134 @@ function temFlag(nome, argv) {
 async function extrairGrafo(raiz) {
   const dump = await tentarGraphify(raiz);
   if (dump !== null) {
-    const sanitizado = sanitizarGrafo(dump);
-    if (sanitizado.ok && sanitizado.grafo.avancado) return sanitizado.grafo;
+    const sanitizado = sanitizeGraph(dump);
+    if (sanitizado.ok && sanitizado.graph.advanced) return sanitizado.graph;
   }
-  return extrairDoRepo(raiz);
+  return extractFromRepo(raiz);
 }
 async function acompanhar(liveUrl, scanId, shareToken) {
-  const base = urlBase();
-  const streamUrl = `${base}/api/scan/${scanId}/events?t=${encodeURIComponent(shareToken)}`;
-  const resposta = await fetch(streamUrl);
-  if (!resposta.ok || resposta.body === null) {
-    console.warn(`Acompanhe em ${liveUrl}`);
-    return 0;
-  }
-  const leitor = resposta.body.getReader();
-  const decoder = new TextDecoder();
-  let buf = "";
-  let exit = 0;
   let gravidades = "";
-  while (true) {
-    const { done, value } = await leitor.read();
-    if (done) break;
-    buf += decoder.decode(value, { stream: true });
-    const blocos = buf.split("\n\n");
-    buf = blocos.pop() ?? "";
-    for (const bloco of blocos) {
-      const linha = bloco.split("\n").find((l) => l.startsWith("data: "));
-      if (linha === void 0) continue;
-      let evento;
-      try {
-        evento = JSON.parse(linha.slice(6));
-      } catch {
-        continue;
-      }
+  const resultado = await followScan(urlBase(), scanId, shareToken, {
+    onEvent: (evento) => {
       if (evento.type === "finding.found" && (evento.severity === "fatal" || evento.severity === "critical")) {
-        exit = 1;
         gravidades = evento.severity;
       }
-      if (evento.type === "scan.done" || evento.type === "scan.failed") {
-        if (evento.type === "scan.failed") exit = 1;
-        console.warn(`scan ${evento.type}${gravidades.length > 0 ? ` \xB7 ${gravidades}` : ""}`);
-        return exit;
-      }
     }
+  });
+  if (!resultado.opened) {
+    console.warn(`Follow along at ${liveUrl}`);
+    return 0;
   }
-  return exit;
+  if (resultado.final !== null) {
+    console.warn(
+      `scan ${resultado.final.type}${gravidades.length > 0 ? ` \xB7 ${gravidades}` : ""}`
+    );
+  }
+  return resultado.exit;
+}
+async function comandoConsentimento(acao, raiz) {
+  if (acao === "list") {
+    const entradas = listarConsentimentos();
+    if (entradas.length === 0) console.warn("no repository consented to code scan");
+    for (const e of entradas) console.warn(`${e.repo}  ${e.acceptedAt}`);
+    return 0;
+  }
+  if (acao === "revoke") {
+    console.warn(
+      revogarConsentimento(raiz) ? `revoked for ${raiz}` : `nothing to revoke for ${raiz}`
+    );
+    return 0;
+  }
+  console.error("usage: --gate-consent <list|revoke>");
+  return GATE_EXIT.operational;
 }
 async function main(argv) {
+  if (temFlag("--help", argv) || temFlag("-h", argv)) {
+    console.warn(AJUDA);
+    return 0;
+  }
+  if (temFlag("--version", argv)) {
+    console.warn(VERSION);
+    return 0;
+  }
   const ci = temFlag("--ci", argv) || process.env["CI"] === "true" || process.env["VIBECHECK_TOKEN"] !== void 0 && process.env["VIBECHECK_TOKEN"].length > 0;
   const noWait = temFlag("--no-wait", argv);
   const raiz = arg("--dir", argv) ?? process.cwd();
-  let url2 = arg("--url", argv) ?? argv.find((a) => a.startsWith("http")) ?? null;
-  let cred = lerToken();
+  const posicional = argv.find(
+    (a, i) => /^https?:\/\//.test(a) && !(argv[i - 1] ?? "").startsWith("--")
+  );
+  let url2 = arg("--url", argv) ?? posicional ?? null;
+  const consentimento = arg("--gate-consent", argv);
+  if (consentimento !== null || temFlag("--gate-consent", argv)) {
+    return comandoConsentimento(consentimento, raiz);
+  }
+  const gate = temFlag("--gate", argv);
+  const codeOnly = gate && temFlag("--code-only", argv);
+  let cred = codeOnly ? { token: "", host: "" } : lerToken();
   if (cred === null) {
     if (ci) {
-      console.error("CI exige VIBECHECK_TOKEN");
-      return 1;
+      console.error("CI requires VIBECHECK_TOKEN");
+      return gate ? GATE_EXIT.operational : 1;
     }
     cred = await loginDevice(false);
   }
   if (url2 === null) {
-    if (cred.host.length === 0) {
-      console.error("informe --url https://seu-app.com");
-      return 1;
+    if (codeOnly) {
+      url2 = "https://localhost";
+    } else if (cred.host.length === 0) {
+      console.error("pass --url https://your-app.com");
+      return gate ? GATE_EXIT.operational : 1;
+    } else {
+      url2 = `https://${cred.host}`;
     }
-    url2 = `https://${cred.host}`;
   }
   const base = urlBase();
+  if (gate) {
+    const resultado = await runGate(
+      { dir: raiz, url: url2, token: cred.token, ci, codeOnly },
+      {
+        base,
+        fetch,
+        readRepo: readCodeContext,
+        extractGraph: extrairGrafo,
+        writeArtifact: gravarNoDisco,
+        log: (m) => console.warn(m),
+        now: () => /* @__PURE__ */ new Date()
+      }
+    );
+    if (resultado.report !== null) {
+      escreverArtefatos(raiz, resultado.report, toSarif(resultado.report, VERSION), {
+        writeArtifact: gravarNoDisco
+      });
+      const { status, httpScan, counts } = resultado.report;
+      console.warn(
+        `gate ${status} \xB7 http ${httpScan} \xB7 ${String(counts.fatal + counts.critical + counts.high)} blocking \xB7 ${String(resultado.report.issues.length)} total`
+      );
+      if (resultado.scanId !== void 0) {
+        await enviarGate(resultado.scanId, resultado.report, cred, {
+          base,
+          fetch,
+          log: (m) => console.warn(m)
+        });
+        console.warn(resultado.liveUrl ?? `${base}/report/${resultado.scanId}`);
+      }
+    }
+    return resultado.exit;
+  }
   const headers = {
     authorization: `Bearer ${cred.token}`,
     "content-type": "application/json"
   };
-  console.warn("Gerando GrafoScan\u2026");
+  console.warn("Building ScanGraph\u2026");
   const grafo = await extrairGrafo(raiz);
-  const avancado = scanEhAvancado(grafo);
-  if (!avancado) {
+  const advanced = isAdvancedScan(grafo);
+  if (!advanced) {
     console.warn(
-      "Sem grafo extra\xEDvel (nem graphify, nem JS/TS). O HTTP roda, mas isto n\xE3o \xE9 scan avan\xE7ado."
+      "No extractable graph (neither graphify nor JS/TS). HTTP still runs, but this is not an advanced scan."
     );
   } else {
     console.warn(
-      `GrafoScan pronto \xB7 ${String(grafo?.nos.length ?? 0)} n\xF3s \xB7 ${String(grafo?.arestas.length ?? 0)} arestas`
+      `ScanGraph ready \xB7 ${String(grafo?.nodes.length ?? 0)} nodes \xB7 ${String(grafo?.edges.length ?? 0)} edges`
     );
   }
   const criado = await fetch(`${base}/api/cli/scan`, {
@@ -15440,22 +16574,31 @@ async function main(argv) {
   });
   const corpo = await criado.json();
   if (!criado.ok || corpo.scanId === void 0) {
-    console.error(corpo.error ?? "n\xE3o foi poss\xEDvel abrir o scan");
+    console.error(corpo.error ?? "could not open the scan");
     return 1;
   }
-  if (avancado && grafo !== null) {
+  if (advanced && grafo !== null) {
     const put = await fetch(`${base}/api/cli/scan/${corpo.scanId}/graph`, {
       method: "PUT",
       headers,
       body: JSON.stringify(grafo)
     });
-    if (!put.ok) console.warn("grafo rejeitado pelo servidor \u2014 scan segue s\xF3 HTTP");
+    if (!put.ok) console.warn("graph rejected by the server \u2014 scan continues HTTP-only");
   }
-  const live = corpo.liveUrl ?? `${base}/avancado/${corpo.scanId}`;
+  const live = corpo.liveUrl ?? `${base}/advanced/${corpo.scanId}`;
   console.warn(live);
   if (deveAbrirNavegador({ ci, noWait })) await abrirBrowser(live);
   if (noWait) return 0;
   return acompanhar(live, corpo.scanId, corpo.shareToken ?? "");
 }
-var codigo = await main(process.argv.slice(2));
+var codigo;
+try {
+  codigo = await main(process.argv.slice(2));
+} catch (erro) {
+  console.error(erro instanceof Error ? erro.message : String(erro));
+  codigo = GATE_EXIT.operational;
+}
 process.exit(codigo);
+export {
+  VERSION
+};