@vibgrate/cli 1.0.76 → 1.0.78

package/dist/cli.js

@@ -1,17 +1,20 @@
 #!/usr/bin/env node
 import {
   baselineCommand
-} from "./chunk-CCU77BBA.js";
+} from "./chunk-DKSPLRJV.js";
 import {
   VERSION,
+  computeHmac,
   dsnCommand,
   formatMarkdown,
   formatText,
+  parseDsn,
   pushCommand,
   scanCommand,
   writeDefaultConfig
-} from "./chunk-S5HZOJPF.js";
+} from "./chunk-TKNDQ337.js";
 import {
+  Semaphore,
   ensureDir,
   pathExists,
   readJsonFile,
@@ -19,8 +22,8 @@ import {
 } from "./chunk-JQHUH6A3.js";
 
 // src/cli.ts
-import { Command as Command6 } from "commander";
-import chalk6 from "chalk";
+import { Command as Command8 } from "commander";
+import chalk8 from "chalk";
 
 // src/commands/init.ts
 import * as path from "path";
@@ -39,7 +42,7 @@ var initCommand = new Command("init").description("Initialize vibgrate in a proj
     console.log(chalk.green("\u2714") + ` Created ${chalk.bold("vibgrate.config.ts")}`);
   }
   if (opts.baseline) {
-    const { runBaseline } = await import("./baseline-ZFMJMB7S.js");
+    const { runBaseline } = await import("./baseline-NRKROYVK.js");
     await runBaseline(rootDir);
   }
   console.log("");
@@ -409,188 +412,1274 @@ var deltaCommand = new Command4("delta").description("Show SBOM delta between tw
 });
 var sbomCommand = new Command4("sbom").description("SBOM export and delta reports for dependency drift tracking").addCommand(exportCommand).addCommand(deltaCommand);
 
-// src/commands/help.ts
+// src/commands/extract.ts
+import * as path6 from "path";
+import * as os2 from "os";
+import * as fs2 from "fs/promises";
+import { existsSync } from "fs";
+import { spawn } from "child_process";
 import { Command as Command5 } from "commander";
 import chalk5 from "chalk";
+var EXIT_SUCCESS = 0;
+var EXIT_SCHEMA_FAILURE = 1;
+var EXIT_PARSE_FAILURE = 2;
+var EXIT_TIMEOUT = 3;
+var EXIT_PUSH_FAILURE = 4;
+var EXIT_USAGE_ERROR = 5;
+var LANGUAGE_EXTENSIONS = {
+  typescript: /* @__PURE__ */ new Set([".ts", ".tsx", ".mts", ".cts"]),
+  javascript: /* @__PURE__ */ new Set([".js", ".jsx", ".mjs", ".cjs"]),
+  swift: /* @__PURE__ */ new Set([".swift"]),
+  rust: /* @__PURE__ */ new Set([".rs"]),
+  ruby: /* @__PURE__ */ new Set([".rb", ".rake", ".gemspec"]),
+  php: /* @__PURE__ */ new Set([".php"]),
+  dart: /* @__PURE__ */ new Set([".dart"]),
+  scala: /* @__PURE__ */ new Set([".scala", ".sc"]),
+  cobol: /* @__PURE__ */ new Set([".cbl", ".cob", ".cpy", ".cob85", ".cobol"]),
+  vb6: /* @__PURE__ */ new Set([".vbp", ".bas", ".cls", ".frm", ".ctl", ".dsr"]),
+  go: /* @__PURE__ */ new Set([".go"]),
+  python: /* @__PURE__ */ new Set([".py"]),
+  java: /* @__PURE__ */ new Set([".java"]),
+  csharp: /* @__PURE__ */ new Set([".cs"])
+};
+var SUPPORTED_LANGUAGES = new Set(Object.keys(LANGUAGE_EXTENSIONS));
+var SKIP_DIRS = /* @__PURE__ */ new Set([
+  "node_modules",
+  ".git",
+  ".vibgrate",
+  ".hg",
+  ".svn",
+  "dist",
+  "build",
+  "out",
+  ".next",
+  ".nuxt",
+  ".output",
+  "bin",
+  "obj",
+  ".vs",
+  "target",
+  "vendor",
+  ".dart_tool",
+  ".build",
+  "DerivedData",
+  "Pods",
+  ".swiftpm",
+  "Carthage",
+  ".cargo",
+  ".pub-cache",
+  ".bloop",
+  ".metals",
+  ".idea",
+  "coverage",
+  "TestResults",
+  "__pycache__",
+  ".tox",
+  ".mypy_cache"
+]);
+var TEST_PATTERNS = [
+  /[/\\]test[/\\]/i,
+  /[/\\]tests[/\\]/i,
+  /[/\\]__tests__[/\\]/i,
+  /[/\\]spec[/\\]/i,
+  /\.spec\./i,
+  /\.test\./i,
+  /[/\\]test-/i
+];
+function isTestPath(relPath) {
+  return TEST_PATTERNS.some((p) => p.test(relPath));
+}
+async function detectLanguages(rootDir, includeTests) {
+  const counts = /* @__PURE__ */ new Map();
+  async function walk(dir, relBase) {
+    let entries;
+    try {
+      entries = await fs2.readdir(dir, { withFileTypes: true });
+    } catch {
+      return;
+    }
+    for (const entry of entries) {
+      if (entry.name.startsWith(".")) continue;
+      const absPath = path6.join(dir, entry.name);
+      const relPath = path6.join(relBase, entry.name);
+      if (entry.isDirectory()) {
+        if (!SKIP_DIRS.has(entry.name)) {
+          await walk(absPath, relPath);
+        }
+        continue;
+      }
+      if (!entry.isFile()) continue;
+      if (!includeTests && isTestPath(relPath)) continue;
+      const ext = path6.extname(entry.name).toLowerCase();
+      for (const [lang, exts] of Object.entries(LANGUAGE_EXTENSIONS)) {
+        if (exts.has(ext)) {
+          counts.set(lang, (counts.get(lang) ?? 0) + 1);
+          break;
+        }
+      }
+    }
+  }
+  await walk(rootDir, "");
+  return Array.from(counts.entries()).map(([language, fileCount]) => ({ language, fileCount })).sort((a, b) => b.fileCount - a.fileCount);
+}
+function validateFactLine(line) {
+  let parsed;
+  try {
+    parsed = JSON.parse(line);
+  } catch {
+    return { valid: false, error: `Invalid JSON: ${line.substring(0, 80)}...` };
+  }
+  const envelope = parsed;
+  if (typeof envelope.factId !== "string" || !envelope.factId) {
+    return { valid: false, error: "Missing or invalid factId" };
+  }
+  if (typeof envelope.factType !== "string" || !envelope.factType) {
+    return { valid: false, error: "Missing or invalid factType" };
+  }
+  if (typeof envelope.language !== "string") {
+    return { valid: false, error: "Missing or invalid language" };
+  }
+  if (typeof envelope.scanner !== "string") {
+    return { valid: false, error: "Missing or invalid scanner" };
+  }
+  if (typeof envelope.scannerVersion !== "string") {
+    return { valid: false, error: "Missing or invalid scannerVersion" };
+  }
+  if (typeof envelope.emittedAt !== "string") {
+    return { valid: false, error: "Missing or invalid emittedAt" };
+  }
+  if (envelope.payload === void 0 || envelope.payload === null) {
+    return { valid: false, error: "Missing payload" };
+  }
+  return { valid: true, fact: envelope };
+}
+function resolveHcsWorkerBin() {
+  const base = import.meta.dirname ?? path6.dirname(new URL(import.meta.url).pathname);
+  const bundledPath = path6.resolve(base, "..", "dist", "hcs-worker.js");
+  if (existsSync(bundledPath)) return bundledPath;
+  const siblingPath = path6.resolve(base, "hcs-worker.js");
+  if (existsSync(siblingPath)) return siblingPath;
+  try {
+    const resolved = import.meta.resolve("@vibgrate/hcs-node-worker");
+    const resolvedPath = resolved.startsWith("file://") ? new URL(resolved).pathname : resolved;
+    if (existsSync(resolvedPath)) return resolvedPath;
+  } catch {
+  }
+  const monorepoPath = path6.resolve(base, "..", "..", "..", "vibgrate-hcs", "node", "dist", "main.js");
+  if (existsSync(monorepoPath)) return monorepoPath;
+  const devPath = path6.resolve(base, "..", "..", "..", "vibgrate-hcs", "node", "src", "main.ts");
+  if (existsSync(devPath)) return devPath;
+  throw new Error(
+    'Cannot locate HCS worker. Run "pnpm build" in the CLI package to bundle the worker into dist/.'
+  );
+}
+var NODE_WORKER_AST_LANGS = /* @__PURE__ */ new Set(["typescript", "javascript"]);
+var NODE_WORKER_TEXT_LANGS = /* @__PURE__ */ new Set([
+  "swift",
+  "vb6",
+  "rust",
+  "ruby",
+  "php",
+  "dart",
+  "scala",
+  "cobol"
+]);
+var NODE_WORKER_ALL_LANGS = /* @__PURE__ */ new Set([
+  ...NODE_WORKER_AST_LANGS,
+  ...NODE_WORKER_TEXT_LANGS
+]);
+var EXTERNAL_WORKER_LANGS = /* @__PURE__ */ new Set(["go", "python", "java", "csharp"]);
+async function runNodeWorker(rootDir, language, opts) {
+  const workerBin = resolveHcsWorkerBin();
+  const args = [];
+  if (NODE_WORKER_AST_LANGS.has(language)) {
+    args.push("--project", rootDir);
+  } else {
+    args.push("--project", rootDir);
+    const langFlag = `--${language}-project`;
+    args.push(langFlag, rootDir);
+    if (language === "cobol" && opts.copybookPaths) {
+      args.push("--cobol-copybook-paths", opts.copybookPaths);
+    }
+  }
+  return new Promise((resolve6) => {
+    const facts = [];
+    const errors = [];
+    let stdoutBuf = "";
+    let killed = false;
+    const child = spawn("node", ["--enable-source-maps", workerBin, ...args], {
+      cwd: rootDir,
+      stdio: ["ignore", "pipe", "pipe"],
+      env: { ...process.env, NODE_OPTIONS: "--max-old-space-size=4096" }
+    });
+    const timer = setTimeout(() => {
+      killed = true;
+      child.kill("SIGKILL");
+    }, opts.timeoutMs);
+    child.stdout.on("data", (chunk) => {
+      stdoutBuf += chunk.toString();
+      const lines = stdoutBuf.split("\n");
+      stdoutBuf = lines.pop();
+      for (const line of lines) {
+        const trimmed = line.trim();
+        if (trimmed) facts.push(trimmed);
+      }
+    });
+    child.stderr.on("data", (chunk) => {
+      const text = chunk.toString();
+      for (const line of text.split("\n")) {
+        const trimmed = line.trim();
+        if (!trimmed) continue;
+        if (trimmed.startsWith("[progress] ")) {
+          try {
+            const event = JSON.parse(trimmed.slice(11));
+            opts.onProgress?.(event);
+          } catch {
+          }
+          continue;
+        }
+        if (opts.verbose) {
+          process.stderr.write(chalk5.dim(`[${language}] ${trimmed}
+`));
+        }
+        if (trimmed.startsWith("[error]")) {
+          errors.push(trimmed);
+        }
+      }
+    });
+    child.on("close", (code) => {
+      clearTimeout(timer);
+      if (stdoutBuf.trim()) {
+        facts.push(stdoutBuf.trim());
+      }
+      if (killed) {
+        resolve6({ language, facts, errors: ["Worker killed: timeout exceeded"], exitCode: EXIT_TIMEOUT });
+      } else {
+        resolve6({ language, facts, errors, exitCode: code ?? 0 });
+      }
+    });
+    child.on("error", (err) => {
+      clearTimeout(timer);
+      errors.push(`Failed to spawn worker: ${err.message}`);
+      resolve6({ language, facts, errors, exitCode: EXIT_PARSE_FAILURE });
+    });
+  });
+}
+async function pushFacts(facts, dsn, verbose) {
+  const parsed = parseDsn(dsn);
+  if (!parsed) {
+    process.stderr.write(chalk5.red("Invalid DSN format.\n"));
+    process.stderr.write(chalk5.dim("Expected: vibgrate+https://<key_id>:<secret>@<host>/<workspace_id>\n"));
+    return false;
+  }
+  const body = facts.join("\n") + "\n";
+  const url = `${parsed.scheme}://${parsed.host}/v1/ingest/hcs`;
+  if (verbose) {
+    process.stderr.write(chalk5.dim(`Pushing ${facts.length} facts to ${parsed.host}...
+`));
+  }
+  try {
+    const hmac = computeHmac(body, parsed.secret);
+    const response = await fetch(url, {
+      method: "POST",
+      headers: {
+        "Content-Type": "application/x-ndjson",
+        "X-Vibgrate-Key": parsed.keyId,
+        "X-Vibgrate-Workspace": parsed.workspaceId,
+        "X-Vibgrate-Signature": hmac,
+        "Connection": "close"
+      },
+      body
+    });
+    if (!response.ok) {
+      const text = await response.text().catch(() => "");
+      process.stderr.write(chalk5.red(`Push failed: HTTP ${response.status} ${text}
+`));
+      return false;
+    }
+    if (verbose) {
+      process.stderr.write(chalk5.green(`\u2714 Pushed ${facts.length} facts successfully
+`));
+    }
+    return true;
+  } catch (err) {
+    process.stderr.write(chalk5.red(`Push failed: ${err instanceof Error ? err.message : String(err)}
+`));
+    return false;
+  }
+}
+async function loadFeedback(filePath) {
+  const content = await fs2.readFile(filePath, "utf-8");
+  const lines = content.split("\n").filter((l) => l.trim());
+  for (const line of lines) {
+    try {
+      JSON.parse(line);
+    } catch {
+      throw new Error(`Invalid NDJSON in feedback file at: ${line.substring(0, 60)}...`);
+    }
+  }
+  return lines;
+}
+var ProgressTracker = class {
+  constructor(languages) {
+    this.languages = languages;
+    this.isTTY = process.stderr.isTTY ?? false;
+    for (const lang of languages) {
+      this.langStatus.set(lang, {
+        phase: "waiting",
+        fileIndex: 0,
+        fileCount: 0,
+        done: false,
+        factCount: 0
+      });
+    }
+  }
+  isTTY;
+  langStatus = /* @__PURE__ */ new Map();
+  totalFacts = 0;
+  lastRender = 0;
+  throttleMs = 80;
+  // Cap redraws to ~12 fps
+  lastLineLen = 0;
+  /** Called by worker spawner on each [progress] event */
+  onProgress(language, event) {
+    const status = this.langStatus.get(language);
+    if (!status) return;
+    status.phase = event.phase;
+    if (event.fileCount !== void 0) status.fileCount = event.fileCount;
+    if (event.fileIndex !== void 0) status.fileIndex = event.fileIndex;
+    if (event.file) status.file = event.file;
+    if (event.phase === "done") status.done = true;
+    this.render();
+  }
+  /** Called when a new fact line is validated */
+  onFact() {
+    this.totalFacts++;
+    this.render();
+  }
+  /** Called per-language when facts are counted */
+  setLanguageFactCount(language, count) {
+    const status = this.langStatus.get(language);
+    if (status) status.factCount = count;
+  }
+  render() {
+    const now = Date.now();
+    if (now - this.lastRender < this.throttleMs) return;
+    this.lastRender = now;
+    if (!this.isTTY) return;
+    const parts = [];
+    for (const [lang, st] of this.langStatus) {
+      if (st.done) {
+        parts.push(chalk5.green(`${lang} \u2713`));
+      } else if (st.phase === "waiting") {
+        parts.push(chalk5.dim(`${lang} \xB7`));
+      } else if (st.phase === "discovering") {
+        parts.push(chalk5.yellow(`${lang} \u2026`));
+      } else if (st.phase === "scanning" && st.fileCount > 0) {
+        const pct = Math.round(st.fileIndex / st.fileCount * 100);
+        parts.push(chalk5.cyan(`${lang} ${st.fileIndex}/${st.fileCount} ${pct}%`));
+      } else if (st.phase === "extracting") {
+        parts.push(chalk5.cyan(`${lang} extracting`));
+      } else {
+        parts.push(chalk5.dim(`${lang} ${st.phase}`));
+      }
+    }
+    const line = `  ${parts.join("  ")}  ${chalk5.dim(`${this.totalFacts} facts`)}`;
+    const padding = Math.max(0, this.lastLineLen - line.length);
+    process.stderr.write(`\r${line}${" ".repeat(padding)}`);
+    this.lastLineLen = line.length;
+  }
+  /** Clear the progress line and print final summary */
+  finish(elapsed) {
+    if (this.isTTY) {
+      process.stderr.write(`\r${" ".repeat(this.lastLineLen)}\r`);
+    }
+  }
+};
+var extractCommand = new Command5("extract").description("Analyze source code and emit validated HCS facts (NDJSON)").argument("[path]", "Path to source directory", ".").option("-o, --out <file>", "Write NDJSON to file (default: stdout)").option("--language <langs>", "Comma-separated languages to analyze (default: auto-detect)").option("--include-tests", "Include test files in analysis").option("--push", "Stream validated facts to dashboard API").option("--dsn <dsn>", "DSN token for push (or use VIBGRATE_DSN env)").option("--concurrency <n>", "Number of parallel file workers").option("--timeout-mins <mins>", "Total analysis timeout in minutes", "60").option("--feedback <file>", "Load NDJSON diff artifact for refinement").option("--verbose", "Print worker stderr and summary statistics").action(async (targetPath, opts) => {
+  const rootDir = path6.resolve(targetPath);
+  if (!await pathExists(rootDir)) {
+    process.stderr.write(chalk5.red(`Path does not exist: ${rootDir}
+`));
+    process.exit(EXIT_USAGE_ERROR);
+  }
+  let stat3;
+  try {
+    stat3 = await fs2.stat(rootDir);
+  } catch {
+    process.stderr.write(chalk5.red(`Cannot read path: ${rootDir}
+`));
+    process.exit(EXIT_USAGE_ERROR);
+  }
+  if (!stat3.isDirectory()) {
+    process.stderr.write(chalk5.red(`Path must be a directory: ${rootDir}
+`));
+    process.exit(EXIT_USAGE_ERROR);
+  }
+  const dsn = opts.dsn || process.env.VIBGRATE_DSN;
+  if (opts.push && !dsn) {
+    process.stderr.write(chalk5.red("--push requires --dsn or VIBGRATE_DSN environment variable\n"));
+    process.exit(EXIT_USAGE_ERROR);
+  }
+  if (dsn && !parseDsn(dsn)) {
+    process.stderr.write(chalk5.red("Invalid DSN format.\n"));
+    process.stderr.write(chalk5.dim("Expected: vibgrate+https://<key_id>:<secret>@<host>/<workspace_id>\n"));
+    process.exit(EXIT_USAGE_ERROR);
+  }
+  const concurrency = opts.concurrency ? parseInt(opts.concurrency, 10) : os2.cpus().length;
+  if (isNaN(concurrency) || concurrency < 1) {
+    process.stderr.write(chalk5.red("--concurrency must be >= 1\n"));
+    process.exit(EXIT_USAGE_ERROR);
+  }
+  const timeoutMins = parseInt(opts.timeoutMins, 10);
+  if (isNaN(timeoutMins) || timeoutMins < 1) {
+    process.stderr.write(chalk5.red("--timeout-mins must be >= 1\n"));
+    process.exit(EXIT_USAGE_ERROR);
+  }
+  const timeoutMs = timeoutMins * 60 * 1e3;
+  if (opts.out) {
+    const outDir = path6.dirname(path6.resolve(opts.out));
+    if (!await pathExists(outDir)) {
+      process.stderr.write(chalk5.red(`Output directory does not exist: ${outDir}
+`));
+      process.exit(EXIT_USAGE_ERROR);
+    }
+    try {
+      const outStat = await fs2.stat(path6.resolve(opts.out));
+      if (outStat.isDirectory()) {
+        process.stderr.write(chalk5.red(`--out cannot be a directory: ${opts.out}
+`));
+        process.exit(EXIT_USAGE_ERROR);
+      }
+    } catch {
+    }
+  }
+  let feedbackLines;
+  if (opts.feedback) {
+    const feedbackPath = path6.resolve(opts.feedback);
+    if (!await pathExists(feedbackPath)) {
+      process.stderr.write(chalk5.red(`Feedback file not found: ${feedbackPath}
+`));
+      process.exit(EXIT_USAGE_ERROR);
+    }
+    try {
+      feedbackLines = await loadFeedback(feedbackPath);
+    } catch (err) {
+      process.stderr.write(chalk5.red(`Invalid feedback file: ${err instanceof Error ? err.message : String(err)}
+`));
+      process.exit(EXIT_USAGE_ERROR);
+    }
+  }
+  let targetLanguages;
+  if (opts.language) {
+    targetLanguages = opts.language.split(",").map((l) => l.trim().toLowerCase()).filter(Boolean);
+    for (const lang of targetLanguages) {
+      if (!SUPPORTED_LANGUAGES.has(lang)) {
+        process.stderr.write(chalk5.red(`Unknown language: "${lang}"
+`));
+        process.stderr.write(chalk5.dim(`Supported: ${[...SUPPORTED_LANGUAGES].sort().join(", ")}
+`));
+        process.exit(EXIT_USAGE_ERROR);
+      }
+    }
+  } else {
+    const detected = await detectLanguages(rootDir, opts.includeTests ?? false);
+    if (detected.length === 0) {
+      process.stderr.write(chalk5.yellow("No supported source files detected.\n"));
+      process.exit(EXIT_SUCCESS);
+    }
+    targetLanguages = detected.map((d) => d.language);
+    if (opts.verbose) {
+      process.stderr.write(chalk5.dim("Detected languages:\n"));
+      for (const d of detected) {
+        process.stderr.write(chalk5.dim(`  ${d.language}: ${d.fileCount} files
+`));
+      }
+    }
+  }
+  const runnableLanguages = targetLanguages.filter((l) => NODE_WORKER_ALL_LANGS.has(l));
+  const skippedLanguages = targetLanguages.filter((l) => EXTERNAL_WORKER_LANGS.has(l));
+  const unknownWorkerLangs = targetLanguages.filter(
+    (l) => !NODE_WORKER_ALL_LANGS.has(l) && !EXTERNAL_WORKER_LANGS.has(l)
+  );
+  if (skippedLanguages.length > 0 && opts.verbose) {
+    process.stderr.write(chalk5.yellow(
+      `Skipping languages without built-in HCS worker: ${skippedLanguages.join(", ")}
+` + chalk5.dim("These require dedicated external workers.\n")
+    ));
+  }
+  if (runnableLanguages.length === 0) {
+    process.stderr.write(chalk5.yellow("No languages with available HCS workers found.\n"));
+    if (skippedLanguages.length > 0) {
+      process.stderr.write(chalk5.dim(
+        `Detected: ${skippedLanguages.join(", ")} \u2014 these require external workers not yet integrated.
+`
+      ));
+    }
+    process.exit(EXIT_SUCCESS);
+  }
+  const startTime = Date.now();
+  const globalDeadline = startTime + timeoutMs;
+  process.stderr.write(
+    chalk5.bold(`Extracting HCS facts from ${rootDir}
+`) + chalk5.dim(`Languages: ${runnableLanguages.join(", ")}  Concurrency: ${concurrency}  Timeout: ${timeoutMins}m
+`)
+  );
+  const progress = new ProgressTracker(runnableLanguages);
+  const sem = new Semaphore(concurrency);
+  const allFacts = [];
+  const allErrors = [];
+  let hasSchemaFailure = false;
+  let hasParseFailure = false;
+  let hasTimeout = false;
+  const workerPromises = runnableLanguages.map(
+    (language) => sem.run(async () => {
+      const remaining = globalDeadline - Date.now();
+      if (remaining <= 0) {
+        hasTimeout = true;
+        return;
+      }
+      const result = await runNodeWorker(rootDir, language, {
+        includeTests: opts.includeTests ?? false,
+        verbose: opts.verbose ?? false,
+        timeoutMs: remaining,
+        onProgress: (event) => progress.onProgress(language, event)
+      });
+      if (result.exitCode === EXIT_TIMEOUT) {
+        hasTimeout = true;
+      }
+      let langFactCount = 0;
+      for (const line of result.facts) {
+        const validation = validateFactLine(line);
+        if (validation.valid) {
+          allFacts.push(line);
+          langFactCount++;
+          progress.onFact();
+        } else {
+          hasSchemaFailure = true;
+          allErrors.push(`[${language}] Schema validation: ${validation.error}`);
+          if (opts.verbose) {
+            process.stderr.write(chalk5.red(`[${language}] Invalid fact: ${validation.error}
+`));
+          }
+        }
+      }
+      progress.setLanguageFactCount(language, langFactCount);
+      if (result.errors.length > 0) {
+        allErrors.push(...result.errors.map((e) => `[${language}] ${e}`));
+      }
+      if (result.exitCode !== 0 && result.exitCode !== EXIT_TIMEOUT) {
+        hasParseFailure = true;
+      }
+    })
+  );
+  await Promise.all(workerPromises);
+  const elapsed = ((Date.now() - startTime) / 1e3).toFixed(1);
+  progress.finish(elapsed);
+  allFacts.sort();
+  const ndjsonOutput = allFacts.map((f) => f).join("\n") + (allFacts.length > 0 ? "\n" : "");
+  if (opts.out) {
+    const outPath = path6.resolve(opts.out);
+    await fs2.writeFile(outPath, ndjsonOutput, "utf-8");
+    process.stderr.write(chalk5.green(`\u2714 Wrote ${allFacts.length} facts to ${outPath}
+`));
+  } else {
+    process.stdout.write(ndjsonOutput);
+  }
+  if (opts.push && dsn && allFacts.length > 0) {
+    const pushOk = await pushFacts(allFacts, dsn, opts.verbose ?? false);
+    if (!pushOk) {
+      process.exit(EXIT_PUSH_FAILURE);
+    }
+  }
+  if (opts.verbose) {
+    process.stderr.write(chalk5.dim("\n\u2500\u2500 Summary \u2500\u2500\n"));
+    process.stderr.write(chalk5.dim(`  Facts emitted : ${allFacts.length}
+`));
+    process.stderr.write(chalk5.dim(`  Languages     : ${runnableLanguages.join(", ")}
+`));
+    process.stderr.write(chalk5.dim(`  Elapsed       : ${elapsed}s
+`));
+    if (allErrors.length > 0) {
+      process.stderr.write(chalk5.dim(`  Errors        : ${allErrors.length}
+`));
+      for (const err of allErrors.slice(0, 10)) {
+        process.stderr.write(chalk5.dim(`    ${err}
+`));
+      }
+      if (allErrors.length > 10) {
+        process.stderr.write(chalk5.dim(`    ... and ${allErrors.length - 10} more
+`));
+      }
+    }
+    process.stderr.write(chalk5.dim("\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\n\n"));
+  }
+  if (hasTimeout) {
+    process.stderr.write(chalk5.red(`Timeout exceeded (${timeoutMins} minutes)
+`));
+    process.exit(EXIT_TIMEOUT);
+  }
+  if (hasSchemaFailure) {
+    process.stderr.write(chalk5.red("Fact schema validation failures detected\n"));
+    process.exit(EXIT_SCHEMA_FAILURE);
+  }
+  if (hasParseFailure) {
+    process.stderr.write(chalk5.red("Parsing failures detected\n"));
+    process.exit(EXIT_PARSE_FAILURE);
+  }
+});
+
+// src/commands/diff.ts
+import * as path7 from "path";
+import * as fs3 from "fs/promises";
+import * as crypto from "crypto";
+import { Command as Command6 } from "commander";
+import chalk6 from "chalk";
+var EXIT_INVALID_PATH = 2;
+var EXIT_USAGE_ERROR2 = 5;
+var VALID_FORMATS = /* @__PURE__ */ new Set(["ndjson", "json", "patch"]);
+var SKIP_DIRS2 = /* @__PURE__ */ new Set([
+  ".git",
+  ".hg",
+  ".svn",
+  "node_modules",
+  ".vibgrate"
+]);
+async function discoverFiles(root, includeGlobs, excludeGlobs) {
+  const result = [];
+  async function walk(dir, relBase) {
+    let entries;
+    try {
+      entries = await fs3.readdir(dir, { withFileTypes: true });
+    } catch {
+      return;
+    }
+    for (const entry of entries) {
+      if (entry.name.startsWith(".") && SKIP_DIRS2.has(entry.name)) continue;
+      const absPath = path7.join(dir, entry.name);
+      const relPath = path7.join(relBase, entry.name);
+      if (entry.isDirectory()) {
+        if (!SKIP_DIRS2.has(entry.name)) {
+          await walk(absPath, relPath);
+        }
+        continue;
+      }
+      if (!entry.isFile()) continue;
+      if (includeGlobs && includeGlobs.length > 0) {
+        if (!matchesAnyGlob(relPath, includeGlobs)) continue;
+      }
+      if (excludeGlobs && excludeGlobs.length > 0) {
+        if (matchesAnyGlob(relPath, excludeGlobs)) continue;
+      }
+      result.push({ relPath, absPath });
+    }
+  }
+  await walk(root, "");
+  return result;
+}
+function matchesAnyGlob(filePath, globs) {
+  for (const glob of globs) {
+    if (matchGlob(filePath, glob)) return true;
+  }
+  return false;
+}
+function matchGlob(filePath, glob) {
+  const pattern = glob.replace(/[.+^${}()|[\]\\]/g, "\\$&").replace(/\*/g, ".*");
+  return new RegExp(pattern, "i").test(filePath);
+}
+function computeLineDiff(originalLines, generatedLines, contextLines, ignoreWhitespace) {
+  const aLines = ignoreWhitespace ? originalLines.map((l) => l.trim()) : originalLines;
+  const bLines = ignoreWhitespace ? generatedLines.map((l) => l.trim()) : generatedLines;
+  const changes = computeEditScript(aLines, bLines);
+  let insertions = 0;
+  let deletions = 0;
+  for (const change of changes) {
+    if (change.type === "insert") insertions++;
+    if (change.type === "delete") deletions++;
+  }
+  const hunks = buildHunks(originalLines, generatedLines, changes, contextLines);
+  return { hunks, insertions, deletions };
+}
+function computeEditScript(a, b) {
+  const n = a.length;
+  const m = b.length;
+  if (n === 0 && m === 0) return [];
+  if (n === 0) return b.map((_, i2) => ({ type: "insert", aIndex: 0, bIndex: i2 }));
+  if (m === 0) return a.map((_, i2) => ({ type: "delete", aIndex: i2, bIndex: 0 }));
+  const dp = Array.from({ length: n + 1 }, () => new Array(m + 1).fill(0));
+  for (let i2 = 1; i2 <= n; i2++) {
+    for (let j2 = 1; j2 <= m; j2++) {
+      if (a[i2 - 1] === b[j2 - 1]) {
+        dp[i2][j2] = dp[i2 - 1][j2 - 1] + 1;
+      } else {
+        dp[i2][j2] = Math.max(dp[i2 - 1][j2], dp[i2][j2 - 1]);
+      }
+    }
+  }
+  const changes = [];
+  let i = n, j = m;
+  while (i > 0 || j > 0) {
+    if (i > 0 && j > 0 && a[i - 1] === b[j - 1]) {
+      changes.unshift({ type: "equal", aIndex: i - 1, bIndex: j - 1 });
+      i--;
+      j--;
+    } else if (j > 0 && (i === 0 || dp[i][j - 1] >= dp[i - 1][j])) {
+      changes.unshift({ type: "insert", aIndex: i, bIndex: j - 1 });
+      j--;
+    } else {
+      changes.unshift({ type: "delete", aIndex: i - 1, bIndex: j });
+      i--;
+    }
+  }
+  return changes;
+}
+function buildHunks(aLines, bLines, changes, contextLines) {
+  const hunks = [];
+  let currentHunk = null;
+  let lastChangeEnd = -1;
+  for (let ci = 0; ci < changes.length; ci++) {
+    const change = changes[ci];
+    if (change.type === "equal") {
+      if (currentHunk && ci - lastChangeEnd > contextLines * 2) {
+        for (let k = lastChangeEnd + 1; k <= Math.min(lastChangeEnd + contextLines, ci); k++) {
+          const c = changes[k];
+          if (c && c.type === "equal") {
+            currentHunk.lines.push(` ${aLines[c.aIndex] ?? ""}`);
+            currentHunk.originalCount++;
+            currentHunk.generatedCount++;
+          }
+        }
+        hunks.push(currentHunk);
+        currentHunk = null;
+      }
+      continue;
+    }
+    if (!currentHunk) {
+      const contextStart = Math.max(0, ci - contextLines);
+      const aStart = changes[contextStart]?.aIndex ?? 0;
+      const bStart = changes[contextStart]?.bIndex ?? 0;
+      currentHunk = {
+        originalStart: aStart + 1,
+        originalCount: 0,
+        generatedStart: bStart + 1,
+        generatedCount: 0,
+        lines: []
+      };
+      for (let k = contextStart; k < ci; k++) {
+        const c = changes[k];
+        if (c && c.type === "equal") {
+          currentHunk.lines.push(` ${aLines[c.aIndex] ?? ""}`);
+          currentHunk.originalCount++;
+          currentHunk.generatedCount++;
+        }
+      }
+    }
+    if (change.type === "delete") {
+      currentHunk.lines.push(`-${aLines[change.aIndex] ?? ""}`);
+      currentHunk.originalCount++;
+    } else if (change.type === "insert") {
+      currentHunk.lines.push(`+${bLines[change.bIndex] ?? ""}`);
+      currentHunk.generatedCount++;
+    }
+    lastChangeEnd = ci;
+  }
+  if (currentHunk) {
+    for (let k = lastChangeEnd + 1; k < Math.min(changes.length, lastChangeEnd + 1 + contextLines); k++) {
+      const c = changes[k];
+      if (c && c.type === "equal") {
+        currentHunk.lines.push(` ${aLines[c.aIndex] ?? ""}`);
+        currentHunk.originalCount++;
+        currentHunk.generatedCount++;
+      }
+    }
+    hunks.push(currentHunk);
+  }
+  return hunks;
+}
+function computeSimilarity(a, b) {
+  if (a === b) return 1;
+  if (a.length === 0 && b.length === 0) return 1;
+  if (a.length === 0 || b.length === 0) return 0;
+  const aLines = a.split("\n");
+  const bLines = b.split("\n");
+  const n = aLines.length;
+  const m = bLines.length;
+  if (n * m > 1e6) {
+    const sampleA = [...aLines.slice(0, 100), ...aLines.slice(-100)];
+    const sampleB = [...bLines.slice(0, 100), ...bLines.slice(-100)];
+    return lcsRatio(sampleA, sampleB);
+  }
+  return lcsRatio(aLines, bLines);
+}
+function lcsRatio(a, b) {
+  const n = a.length;
+  const m = b.length;
+  const dp = Array.from({ length: n + 1 }, () => new Array(m + 1).fill(0));
+  for (let i = 1; i <= n; i++) {
+    for (let j = 1; j <= m; j++) {
+      if (a[i - 1] === b[j - 1]) {
+        dp[i][j] = dp[i - 1][j - 1] + 1;
+      } else {
+        dp[i][j] = Math.max(dp[i - 1][j], dp[i][j - 1]);
+      }
+    }
+  }
+  const lcsLen = dp[n][m];
+  return 2 * lcsLen / (n + m);
+}
+function generateDeltaId(kind, filePath) {
+  const hash = crypto.createHash("sha256").update(`${kind}:${filePath}`).digest("hex").substring(0, 16);
+  return `hcs:delta:${hash}`;
+}
+function formatNdjson(deltas) {
+  return deltas.map((d) => JSON.stringify(d)).join("\n") + (deltas.length > 0 ? "\n" : "");
+}
+function formatJson(deltas) {
+  return JSON.stringify({ deltas, count: deltas.length }, null, 2) + "\n";
+}
+function formatPatch(deltas, originalPath, generatedPath) {
+  const lines = [];
+  for (const delta of deltas) {
+    const aFile = delta.originalPath ? path7.join("a", delta.originalPath) : "/dev/null";
+    const bFile = delta.generatedPath ? path7.join("b", delta.generatedPath) : "/dev/null";
+    if (delta.changeKind === "renamed" && delta.originalPath && delta.generatedPath) {
+      lines.push(`diff --vibgrate ${aFile} ${bFile}`);
+      lines.push(`similarity index ${Math.round((delta.similarity ?? 0) * 100)}%`);
+      lines.push(`rename from ${delta.originalPath}`);
+      lines.push(`rename to ${delta.generatedPath}`);
+    } else {
+      lines.push(`diff --vibgrate ${aFile} ${bFile}`);
+    }
+    lines.push(`--- ${delta.changeKind === "added" ? "/dev/null" : aFile}`);
+    lines.push(`+++ ${delta.changeKind === "removed" ? "/dev/null" : bFile}`);
+    if (delta.hunks) {
+      for (const hunk of delta.hunks) {
+        lines.push(`@@ -${hunk.originalStart},${hunk.originalCount} +${hunk.generatedStart},${hunk.generatedCount} @@`);
+        lines.push(...hunk.lines);
+      }
+    }
+    lines.push("");
+  }
+  return lines.join("\n");
+}
+var diffCommand = new Command6("diff").description("Compare two directory trees and emit structured delta facts").argument("<original_path>", "Original source directory").argument("<generated_path>", "Generated source directory").option("-o, --out <file>", "Output file path", "vibgrate.diff.ndjson").option("--format <fmt>", "Output format (ndjson|json|patch)", "ndjson").option("--ignore-whitespace", "Ignore whitespace-only changes").option("--context <n>", "Context lines for patch output", "3").option("--include <globs>", "Only include matching files (comma-separated)").option("--exclude <globs>", "Exclude matching files (comma-separated)").option("--stats", "Include insertions/deletions summary per file").option("--verbose", "Print file match decisions and rename detection").action(async (originalPath, generatedPath, opts) => {
+  const origDir = path7.resolve(originalPath);
+  const genDir = path7.resolve(generatedPath);
+  for (const [label, dir] of [["original_path", origDir], ["generated_path", genDir]]) {
+    if (!await pathExists(dir)) {
+      process.stderr.write(chalk6.red(`${label} does not exist: ${dir}
+`));
+      process.exit(EXIT_INVALID_PATH);
+    }
+    let stat3;
+    try {
+      stat3 = await fs3.stat(dir);
+    } catch {
+      process.stderr.write(chalk6.red(`Cannot read ${label}: ${dir}
+`));
+      process.exit(EXIT_INVALID_PATH);
+    }
+    if (!stat3.isDirectory()) {
+      process.stderr.write(chalk6.red(`${label} must be a directory: ${dir}
+`));
+      process.exit(EXIT_INVALID_PATH);
+    }
+  }
+  const format = opts.format.toLowerCase();
+  if (!VALID_FORMATS.has(format)) {
+    process.stderr.write(chalk6.red(`Invalid format: "${opts.format}". Allowed: ndjson, json, patch
+`));
+    process.exit(EXIT_USAGE_ERROR2);
+  }
+  const contextLines = parseInt(opts.context, 10);
+  if (isNaN(contextLines) || contextLines < 0) {
+    process.stderr.write(chalk6.red("--context must be >= 0\n"));
+    process.exit(EXIT_USAGE_ERROR2);
+  }
+  const includeGlobs = opts.include ? opts.include.split(",").map((g) => g.trim()).filter(Boolean) : void 0;
+  const excludeGlobs = opts.exclude ? opts.exclude.split(",").map((g) => g.trim()).filter(Boolean) : void 0;
+  const [origFiles, genFiles] = await Promise.all([
+    discoverFiles(origDir, includeGlobs, excludeGlobs),
+    discoverFiles(genDir, includeGlobs, excludeGlobs)
+  ]);
+  const origMap = new Map(origFiles.map((f) => [f.relPath, f]));
+  const genMap = new Map(genFiles.map((f) => [f.relPath, f]));
+  if (opts.verbose) {
+    process.stderr.write(chalk6.dim(`Original: ${origFiles.length} files
+`));
+    process.stderr.write(chalk6.dim(`Generated: ${genFiles.length} files
+`));
+  }
+  const deltas = [];
+  const matchedOrig = /* @__PURE__ */ new Set();
+  const matchedGen = /* @__PURE__ */ new Set();
+  for (const [relPath, origFile] of origMap) {
+    const genFile = genMap.get(relPath);
+    if (genFile) {
+      matchedOrig.add(relPath);
+      matchedGen.add(relPath);
+      const origContent = await fs3.readFile(origFile.absPath, "utf-8");
+      const genContent = await fs3.readFile(genFile.absPath, "utf-8");
+      const origCompare = opts.ignoreWhitespace ? origContent.replace(/\s+/g, " ").trim() : origContent;
+      const genCompare = opts.ignoreWhitespace ? genContent.replace(/\s+/g, " ").trim() : genContent;
+      if (origCompare !== genCompare) {
+        const diffResult = computeLineDiff(
+          origContent.split("\n"),
+          genContent.split("\n"),
+          contextLines,
+          opts.ignoreWhitespace ?? false
+        );
+        const delta = {
+          deltaId: generateDeltaId("modified", relPath),
+          changeKind: "modified",
+          originalPath: relPath,
+          generatedPath: relPath,
+          hunks: diffResult.hunks
+        };
+        if (opts.stats) {
+          delta.stats = { insertions: diffResult.insertions, deletions: diffResult.deletions };
+        }
+        deltas.push(delta);
+        if (opts.verbose) {
+          process.stderr.write(chalk6.dim(`  modified: ${relPath} (+${diffResult.insertions} -${diffResult.deletions})
+`));
+        }
+      }
+    }
+  }
+  const unmatchedOrig = origFiles.filter((f) => !matchedOrig.has(f.relPath));
+  const unmatchedGen = genFiles.filter((f) => !matchedGen.has(f.relPath));
+  const RENAME_THRESHOLD = 0.8;
+  const renamedOrig = /* @__PURE__ */ new Set();
+  const renamedGen = /* @__PURE__ */ new Set();
+  if (unmatchedOrig.length > 0 && unmatchedGen.length > 0) {
+    const origContents = /* @__PURE__ */ new Map();
+    const genContents = /* @__PURE__ */ new Map();
+    await Promise.all([
+      ...unmatchedOrig.map(async (f) => {
+        try {
+          origContents.set(f.relPath, await fs3.readFile(f.absPath, "utf-8"));
+        } catch {
+        }
+      }),
+      ...unmatchedGen.map(async (f) => {
+        try {
+          genContents.set(f.relPath, await fs3.readFile(f.absPath, "utf-8"));
+        } catch {
+        }
+      })
+    ]);
+    const pairs = [];
+    for (const [origPath, origContent] of origContents) {
+      for (const [genPath, genContent] of genContents) {
+        if (path7.extname(origPath) !== path7.extname(genPath)) continue;
+        const similarity = computeSimilarity(origContent, genContent);
+        if (similarity >= RENAME_THRESHOLD) {
+          pairs.push({ origPath, genPath, similarity });
+        }
+      }
+    }
+    pairs.sort((a, b) => b.similarity - a.similarity);
+    for (const pair of pairs) {
+      if (renamedOrig.has(pair.origPath) || renamedGen.has(pair.genPath)) continue;
+      renamedOrig.add(pair.origPath);
+      renamedGen.add(pair.genPath);
+      const origContent = origContents.get(pair.origPath) ?? "";
+      const genContent = genContents.get(pair.genPath) ?? "";
+      const diffResult = computeLineDiff(
+        origContent.split("\n"),
+        genContent.split("\n"),
+        contextLines,
+        opts.ignoreWhitespace ?? false
+      );
+      const delta = {
+        deltaId: generateDeltaId("renamed", `${pair.origPath} -> ${pair.genPath}`),
+        changeKind: "renamed",
+        originalPath: pair.origPath,
+        generatedPath: pair.genPath,
+        similarity: pair.similarity,
+        hunks: diffResult.hunks
+      };
+      if (opts.stats) {
+        delta.stats = { insertions: diffResult.insertions, deletions: diffResult.deletions };
+      }
+      deltas.push(delta);
+      if (opts.verbose) {
+        process.stderr.write(chalk6.dim(
+          `  renamed: ${pair.origPath} \u2192 ${pair.genPath} (${(pair.similarity * 100).toFixed(0)}% similar)
+`
+        ));
+      }
+    }
+  }
+  for (const file of unmatchedOrig) {
+    if (renamedOrig.has(file.relPath)) continue;
+    const delta = {
+      deltaId: generateDeltaId("removed", file.relPath),
+      changeKind: "removed",
+      originalPath: file.relPath,
+      generatedPath: null
+    };
+    if (opts.stats) {
+      try {
+        const content = await fs3.readFile(file.absPath, "utf-8");
+        delta.stats = { insertions: 0, deletions: content.split("\n").length };
+      } catch {
+        delta.stats = { insertions: 0, deletions: 0 };
+      }
+    }
+    deltas.push(delta);
+    if (opts.verbose) {
+      process.stderr.write(chalk6.dim(`  removed: ${file.relPath}
+`));
+    }
+  }
+  for (const file of unmatchedGen) {
+    if (renamedGen.has(file.relPath)) continue;
+    const delta = {
+      deltaId: generateDeltaId("added", file.relPath),
+      changeKind: "added",
+      originalPath: null,
+      generatedPath: file.relPath
+    };
+    if (opts.stats) {
+      try {
+        const content = await fs3.readFile(file.absPath, "utf-8");
+        delta.stats = { insertions: content.split("\n").length, deletions: 0 };
+      } catch {
+        delta.stats = { insertions: 0, deletions: 0 };
+      }
+    }
+    deltas.push(delta);
+    if (opts.verbose) {
+      process.stderr.write(chalk6.dim(`  added: ${file.relPath}
+`));
+    }
+  }
+  deltas.sort((a, b) => {
+    const aPath = a.originalPath ?? a.generatedPath ?? "";
+    const bPath = b.originalPath ?? b.generatedPath ?? "";
+    return aPath.localeCompare(bPath);
+  });
+  let output;
+  switch (format) {
+    case "ndjson":
+      output = formatNdjson(deltas);
+      break;
+    case "json":
+      output = formatJson(deltas);
+      break;
+    case "patch":
+      output = formatPatch(deltas, originalPath, generatedPath);
+      break;
+  }
+  const outPath = path7.resolve(opts.out);
+  await fs3.writeFile(outPath, output, "utf-8");
+  const added = deltas.filter((d) => d.changeKind === "added").length;
+  const removed = deltas.filter((d) => d.changeKind === "removed").length;
+  const modified = deltas.filter((d) => d.changeKind === "modified").length;
+  const renamed = deltas.filter((d) => d.changeKind === "renamed").length;
+  process.stderr.write(
+    chalk6.green(`\u2714 `) + `${deltas.length} changes: ` + chalk6.green(`+${added} added`) + ", " + chalk6.red(`-${removed} removed`) + ", " + chalk6.yellow(`~${modified} modified`) + ", " + chalk6.blue(`\u2192${renamed} renamed`) + "\n"
+  );
+  process.stderr.write(chalk6.dim(`  Written to ${outPath}
+`));
+  if (opts.verbose && opts.stats) {
+    let totalIns = 0;
+    let totalDel = 0;
+    for (const d of deltas) {
+      if (d.stats) {
+        totalIns += d.stats.insertions;
+        totalDel += d.stats.deletions;
+      }
+    }
+    process.stderr.write(chalk6.dim(`  Total: +${totalIns} insertions, -${totalDel} deletions
+`));
+  }
+});
+
+// src/commands/help.ts
+import { Command as Command7 } from "commander";
+import chalk7 from "chalk";
 var HELP_URL = "https://vibgrate.com/help";
 function printFooter() {
   console.log("");
-  console.log(chalk5.dim(`See ${HELP_URL} for more guidance`));
+  console.log(chalk7.dim(`See ${HELP_URL} for more guidance`));
 }
 var detailedHelp = {
   scan: () => {
     console.log("");
-    console.log(chalk5.bold.underline("vibgrate scan") + chalk5.dim(" \u2014 Scan a project for upgrade drift"));
+    console.log(chalk7.bold.underline("vibgrate scan") + chalk7.dim(" \u2014 Scan a project for upgrade drift"));
     console.log("");
-    console.log(chalk5.bold("Usage:"));
+    console.log(chalk7.bold("Usage:"));
     console.log("  vibgrate scan [path] [options]");
     console.log("");
-    console.log(chalk5.bold("Arguments:"));
-    console.log(`  ${chalk5.cyan("[path]")}                       Path to scan (default: current directory)`);
-    console.log("");
-    console.log(chalk5.bold("Output options:"));
-    console.log(`  ${chalk5.cyan("--format <format>")}           Output format: ${chalk5.white("text")} | json | sarif | md  (default: text)`);
-    console.log(`  ${chalk5.cyan("--out <file>")}                Write output to a file instead of stdout`);
-    console.log("");
-    console.log(chalk5.bold("Baseline & gating:"));
-    console.log(`  ${chalk5.cyan("--baseline <file>")}           Compare results against a saved baseline`);
-    console.log(`  ${chalk5.cyan("--drift-budget <score>")}      Fail if drift score exceeds this value (0\u2013100)`);
-    console.log(`  ${chalk5.cyan("--drift-worsening <percent>")} Fail if drift worsens by more than % since baseline`);
-    console.log(`  ${chalk5.cyan("--fail-on <level>")}           Fail exit code on warn or error findings`);
-    console.log("");
-    console.log(chalk5.bold("Performance:"));
-    console.log(`  ${chalk5.cyan("--concurrency <n>")}           Max concurrent registry calls (default: 8)`);
-    console.log(`  ${chalk5.cyan("--changed-only")}              Only scan files changed since last git commit`);
-    console.log("");
-    console.log(chalk5.bold("Privacy & offline:"));
-    console.log(`  ${chalk5.cyan("--offline")}                   Run without any network calls; skip result upload`);
-    console.log(`  ${chalk5.cyan("--package-manifest <file>")}   Use a local package-version manifest (JSON or ZIP) for offline mode`);
-    console.log(`  ${chalk5.cyan("--no-local-artifacts")}        Do not write .vibgrate JSON artifacts to disk`);
-    console.log(`  ${chalk5.cyan("--max-privacy")}               Strongest privacy mode: minimal scanners + no local artifacts`);
-    console.log("");
-    console.log(chalk5.bold("Tooling:"));
-    console.log(`  ${chalk5.cyan("--install-tools")}             Auto-install missing security scanners via Homebrew`);
-    console.log(`  ${chalk5.cyan("--ui-purpose")}                Enable UI purpose evidence extraction (slower)`);
-    console.log("");
-    console.log(chalk5.bold("Uploading results:"));
-    console.log(`  ${chalk5.cyan("--push")}                      Auto-push results to Vibgrate API after scan`);
-    console.log(`  ${chalk5.cyan("--dsn <dsn>")}                 DSN token for push (or set VIBGRATE_DSN env var)`);
-    console.log(`  ${chalk5.cyan("--region <region>")}           Data residency region: us | eu  (default: us)`);
-    console.log(`  ${chalk5.cyan("--strict")}                    Fail if the upload to Vibgrate API fails`);
-    console.log("");
-    console.log(chalk5.bold("Examples:"));
-    console.log(`  ${chalk5.dim("# Scan the current directory and display a text report")}`);
+    console.log(chalk7.bold("Arguments:"));
+    console.log(`  ${chalk7.cyan("[path]")}                       Path to scan (default: current directory)`);
+    console.log("");
+    console.log(chalk7.bold("Output options:"));
+    console.log(`  ${chalk7.cyan("--format <format>")}           Output format: ${chalk7.white("text")} | json | sarif | md  (default: text)`);
+    console.log(`  ${chalk7.cyan("--out <file>")}                Write output to a file instead of stdout`);
+    console.log("");
+    console.log(chalk7.bold("Baseline & gating:"));
+    console.log(`  ${chalk7.cyan("--baseline <file>")}           Compare results against a saved baseline`);
+    console.log(`  ${chalk7.cyan("--drift-budget <score>")}      Fail if drift score exceeds this value (0\u2013100)`);
+    console.log(`  ${chalk7.cyan("--drift-worsening <percent>")} Fail if drift worsens by more than % since baseline`);
+    console.log(`  ${chalk7.cyan("--fail-on <level>")}           Fail exit code on warn or error findings`);
+    console.log("");
+    console.log(chalk7.bold("Performance:"));
+    console.log(`  ${chalk7.cyan("--concurrency <n>")}           Max concurrent registry calls (default: 8)`);
+    console.log(`  ${chalk7.cyan("--changed-only")}              Only scan files changed since last git commit`);
+    console.log("");
+    console.log(chalk7.bold("Privacy & offline:"));
+    console.log(`  ${chalk7.cyan("--offline")}                   Run without any network calls; skip result upload`);
+    console.log(`  ${chalk7.cyan("--package-manifest <file>")}   Use a local package-version manifest (JSON or ZIP) for offline mode`);
+    console.log(`  ${chalk7.cyan("--no-local-artifacts")}        Do not write .vibgrate JSON artifacts to disk`);
+    console.log(`  ${chalk7.cyan("--max-privacy")}               Strongest privacy mode: minimal scanners + no local artifacts`);
+    console.log("");
+    console.log(chalk7.bold("Tooling:"));
+    console.log(`  ${chalk7.cyan("--install-tools")}             Auto-install missing security scanners via Homebrew`);
+    console.log(`  ${chalk7.cyan("--ui-purpose")}                Enable UI purpose evidence extraction (slower)`);
+    console.log("");
+    console.log(chalk7.bold("Uploading results:"));
+    console.log(`  ${chalk7.cyan("--push")}                      Auto-push results to Vibgrate API after scan`);
+    console.log(`  ${chalk7.cyan("--dsn <dsn>")}                 DSN token for push (or set VIBGRATE_DSN env var)`);
+    console.log(`  ${chalk7.cyan("--region <region>")}           Data residency region: us | eu  (default: us)`);
+    console.log(`  ${chalk7.cyan("--strict")}                    Fail if the upload to Vibgrate API fails`);
+    console.log("");
+    console.log(chalk7.bold("Examples:"));
+    console.log(`  ${chalk7.dim("# Scan the current directory and display a text report")}`);
     console.log("  vibgrate scan .");
     console.log("");
-    console.log(`  ${chalk5.dim("# Scan, fail if drift score > 40, and write SARIF for GitHub Actions")}`);
+    console.log(`  ${chalk7.dim("# Scan, fail if drift score > 40, and write SARIF for GitHub Actions")}`);
     console.log("  vibgrate scan . --drift-budget 40 --format sarif --out drift.sarif");
     console.log("");
-    console.log(`  ${chalk5.dim("# Scan and automatically upload results via a DSN")}`);
+    console.log(`  ${chalk7.dim("# Scan and automatically upload results via a DSN")}`);
     console.log("  vibgrate scan . --push --dsn $VIBGRATE_DSN");
     console.log("");
-    console.log(`  ${chalk5.dim("# Offline scan using a pre-downloaded package manifest")}`);
+    console.log(`  ${chalk7.dim("# Offline scan using a pre-downloaded package manifest")}`);
     console.log("  vibgrate scan . --offline --package-manifest ./manifest.zip");
   },
   init: () => {
     console.log("");
-    console.log(chalk5.bold.underline("vibgrate init") + chalk5.dim(" \u2014 Initialise vibgrate in a project directory"));
+    console.log(chalk7.bold.underline("vibgrate init") + chalk7.dim(" \u2014 Initialise vibgrate in a project directory"));
     console.log("");
-    console.log(chalk5.bold("Usage:"));
+    console.log(chalk7.bold("Usage:"));
     console.log("  vibgrate init [path] [options]");
     console.log("");
-    console.log(chalk5.bold("Arguments:"));
-    console.log(`  ${chalk5.cyan("[path]")}          Directory to initialise (default: current directory)`);
+    console.log(chalk7.bold("Arguments:"));
+    console.log(`  ${chalk7.cyan("[path]")}          Directory to initialise (default: current directory)`);
     console.log("");
-    console.log(chalk5.bold("Options:"));
-    console.log(`  ${chalk5.cyan("--baseline")}      Create an initial drift baseline after init`);
-    console.log(`  ${chalk5.cyan("--yes")}           Skip all confirmation prompts`);
+    console.log(chalk7.bold("Options:"));
+    console.log(`  ${chalk7.cyan("--baseline")}      Create an initial drift baseline after init`);
+    console.log(`  ${chalk7.cyan("--yes")}           Skip all confirmation prompts`);
     console.log("");
-    console.log(chalk5.bold("What it does:"));
+    console.log(chalk7.bold("What it does:"));
     console.log("  \u2022 Creates a .vibgrate/ directory");
     console.log("  \u2022 Writes a vibgrate.config.ts starter config");
     console.log("  \u2022 Optionally runs an initial baseline scan (--baseline)");
     console.log("");
-    console.log(chalk5.bold("Examples:"));
+    console.log(chalk7.bold("Examples:"));
     console.log("  vibgrate init");
     console.log("  vibgrate init ./my-project --baseline");
   },
   baseline: () => {
     console.log("");
-    console.log(chalk5.bold.underline("vibgrate baseline") + chalk5.dim(" \u2014 Save a drift baseline snapshot"));
+    console.log(chalk7.bold.underline("vibgrate baseline") + chalk7.dim(" \u2014 Save a drift baseline snapshot"));
     console.log("");
-    console.log(chalk5.bold("Usage:"));
+    console.log(chalk7.bold("Usage:"));
     console.log("  vibgrate baseline [path]");
     console.log("");
-    console.log(chalk5.bold("Arguments:"));
-    console.log(`  ${chalk5.cyan("[path]")}   Path to baseline (default: current directory)`);
+    console.log(chalk7.bold("Arguments:"));
+    console.log(`  ${chalk7.cyan("[path]")}   Path to baseline (default: current directory)`);
     console.log("");
-    console.log(chalk5.bold("What it does:"));
+    console.log(chalk7.bold("What it does:"));
     console.log("  Runs a full scan and saves the result as .vibgrate/baseline.json.");
     console.log("  Future scans can compare against this file using --baseline.");
     console.log("");
-    console.log(chalk5.bold("Examples:"));
+    console.log(chalk7.bold("Examples:"));
     console.log("  vibgrate baseline .");
     console.log("  vibgrate scan . --baseline .vibgrate/baseline.json --drift-worsening 10");
   },
   report: () => {
     console.log("");
-    console.log(chalk5.bold.underline("vibgrate report") + chalk5.dim(" \u2014 Generate a report from a saved scan artifact"));
+    console.log(chalk7.bold.underline("vibgrate report") + chalk7.dim(" \u2014 Generate a report from a saved scan artifact"));
     console.log("");
-    console.log(chalk5.bold("Usage:"));
+    console.log(chalk7.bold("Usage:"));
     console.log("  vibgrate report [options]");
     console.log("");
-    console.log(chalk5.bold("Options:"));
-    console.log(`  ${chalk5.cyan("--in <file>")}        Input artifact file (default: .vibgrate/scan_result.json)`);
-    console.log(`  ${chalk5.cyan("--format <format>")}  Output format: ${chalk5.white("text")} | md | json  (default: text)`);
+    console.log(chalk7.bold("Options:"));
+    console.log(`  ${chalk7.cyan("--in <file>")}        Input artifact file (default: .vibgrate/scan_result.json)`);
+    console.log(`  ${chalk7.cyan("--format <format>")}  Output format: ${chalk7.white("text")} | md | json  (default: text)`);
     console.log("");
-    console.log(chalk5.bold("Examples:"));
+    console.log(chalk7.bold("Examples:"));
     console.log("  vibgrate report");
     console.log("  vibgrate report --format md > DRIFT-REPORT.md");
     console.log("  vibgrate report --in ./ci/scan_result.json --format json");
   },
   sbom: () => {
     console.log("");
-    console.log(chalk5.bold.underline("vibgrate sbom") + chalk5.dim(" \u2014 Export a Software Bill of Materials from a scan artifact"));
+    console.log(chalk7.bold.underline("vibgrate sbom") + chalk7.dim(" \u2014 Export a Software Bill of Materials from a scan artifact"));
     console.log("");
-    console.log(chalk5.bold("Usage:"));
+    console.log(chalk7.bold("Usage:"));
     console.log("  vibgrate sbom [options]");
     console.log("");
-    console.log(chalk5.bold("Options:"));
-    console.log(`  ${chalk5.cyan("--in <file>")}        Input artifact (default: .vibgrate/scan_result.json)`);
-    console.log(`  ${chalk5.cyan("--format <format>")}  SBOM format: ${chalk5.white("cyclonedx")} | spdx  (default: cyclonedx)`);
-    console.log(`  ${chalk5.cyan("--out <file>")}       Write SBOM to file instead of stdout`);
+    console.log(chalk7.bold("Options:"));
+    console.log(`  ${chalk7.cyan("--in <file>")}        Input artifact (default: .vibgrate/scan_result.json)`);
+    console.log(`  ${chalk7.cyan("--format <format>")}  SBOM format: ${chalk7.white("cyclonedx")} | spdx  (default: cyclonedx)`);
+    console.log(`  ${chalk7.cyan("--out <file>")}       Write SBOM to file instead of stdout`);
     console.log("");
-    console.log(chalk5.bold("Examples:"));
+    console.log(chalk7.bold("Examples:"));
     console.log("  vibgrate sbom --format cyclonedx --out sbom.json");
     console.log("  vibgrate sbom --format spdx --out sbom.spdx.json");
   },
   push: () => {
     console.log("");
-    console.log(chalk5.bold.underline("vibgrate push") + chalk5.dim(" \u2014 Upload a scan artifact to the Vibgrate API"));
+    console.log(chalk7.bold.underline("vibgrate push") + chalk7.dim(" \u2014 Upload a scan artifact to the Vibgrate API"));
     console.log("");
-    console.log(chalk5.bold("Usage:"));
+    console.log(chalk7.bold("Usage:"));
     console.log("  vibgrate push [options]");
     console.log("");
-    console.log(chalk5.bold("Options:"));
-    console.log(`  ${chalk5.cyan("--dsn <dsn>")}        DSN token (or set VIBGRATE_DSN env var)`);
-    console.log(`  ${chalk5.cyan("--file <file>")}      Artifact to upload (default: .vibgrate/scan_result.json)`);
-    console.log(`  ${chalk5.cyan("--region <region>")}  Override data residency region: us | eu`);
-    console.log(`  ${chalk5.cyan("--strict")}           Fail with non-zero exit code on upload error`);
+    console.log(chalk7.bold("Options:"));
+    console.log(`  ${chalk7.cyan("--dsn <dsn>")}        DSN token (or set VIBGRATE_DSN env var)`);
+    console.log(`  ${chalk7.cyan("--file <file>")}      Artifact to upload (default: .vibgrate/scan_result.json)`);
+    console.log(`  ${chalk7.cyan("--region <region>")}  Override data residency region: us | eu`);
+    console.log(`  ${chalk7.cyan("--strict")}           Fail with non-zero exit code on upload error`);
     console.log("");
-    console.log(chalk5.bold("Examples:"));
+    console.log(chalk7.bold("Examples:"));
     console.log("  vibgrate push --dsn $VIBGRATE_DSN");
     console.log("  vibgrate push --file ./ci/scan_result.json --strict");
   },
   dsn: () => {
     console.log("");
-    console.log(chalk5.bold.underline("vibgrate dsn") + chalk5.dim(" \u2014 Manage DSN tokens for API authentication"));
+    console.log(chalk7.bold.underline("vibgrate dsn") + chalk7.dim(" \u2014 Manage DSN tokens for API authentication"));
     console.log("");
-    console.log(chalk5.bold("Subcommands:"));
-    console.log(`  ${chalk5.cyan("vibgrate dsn create")}   Generate a new DSN token`);
+    console.log(chalk7.bold("Subcommands:"));
+    console.log(`  ${chalk7.cyan("vibgrate dsn create")}   Generate a new DSN token`);
     console.log("");
-    console.log(chalk5.bold("dsn create options:"));
-    console.log(`  ${chalk5.cyan("--workspace <id>")}   Workspace ID or "new" to auto-generate ${chalk5.red("(required)")}`);
-    console.log(`  ${chalk5.cyan("--region <region>")}  Data residency region: us | eu  (default: us)`);
-    console.log(`  ${chalk5.cyan("--ingest <url>")}     Override ingest API URL`);
-    console.log(`  ${chalk5.cyan("--write <path>")}     Write the DSN to a file (add to .gitignore!)`);
+    console.log(chalk7.bold("dsn create options:"));
+    console.log(`  ${chalk7.cyan("--workspace <id>")}   Workspace ID or "new" to auto-generate ${chalk7.red("(required)")}`);
+    console.log(`  ${chalk7.cyan("--region <region>")}  Data residency region: us | eu  (default: us)`);
+    console.log(`  ${chalk7.cyan("--ingest <url>")}     Override ingest API URL`);
+    console.log(`  ${chalk7.cyan("--write <path>")}     Write the DSN to a file (add to .gitignore!)`);
     console.log("");
-    console.log(chalk5.bold("Examples:"));
+    console.log(chalk7.bold("Examples:"));
     console.log("  vibgrate dsn create --workspace new");
     console.log("  vibgrate dsn create --workspace abc123");
     console.log("  vibgrate dsn create --workspace new --region eu --write .vibgrate/.dsn");
   },
   update: () => {
     console.log("");
-    console.log(chalk5.bold.underline("vibgrate update") + chalk5.dim(" \u2014 Update the vibgrate CLI to the latest version"));
+    console.log(chalk7.bold.underline("vibgrate update") + chalk7.dim(" \u2014 Update the vibgrate CLI to the latest version"));
     console.log("");
-    console.log(chalk5.bold("Usage:"));
+    console.log(chalk7.bold("Usage:"));
     console.log("  vibgrate update [options]");
     console.log("");
-    console.log(chalk5.bold("Options:"));
-    console.log(`  ${chalk5.cyan("--check")}         Check for a newer version without installing`);
-    console.log(`  ${chalk5.cyan("--pm <manager>")} Force a package manager: npm | pnpm | yarn | bun`);
+    console.log(chalk7.bold("Options:"));
+    console.log(`  ${chalk7.cyan("--check")}         Check for a newer version without installing`);
+    console.log(`  ${chalk7.cyan("--pm <manager>")} Force a package manager: npm | pnpm | yarn | bun`);
     console.log("");
-    console.log(chalk5.bold("Examples:"));
+    console.log(chalk7.bold("Examples:"));
     console.log("  vibgrate update");
     console.log("  vibgrate update --check");
     console.log("  vibgrate update --pm pnpm");
@@ -598,40 +1687,40 @@ var detailedHelp = {
 };
 function printSummaryHelp() {
   console.log("");
-  console.log(chalk5.bold("vibgrate") + chalk5.dim(" \u2014 Continuous Drift Intelligence"));
+  console.log(chalk7.bold("vibgrate") + chalk7.dim(" \u2014 Continuous Drift Intelligence"));
   console.log("");
-  console.log(chalk5.bold("Usage:"));
+  console.log(chalk7.bold("Usage:"));
   console.log("  vibgrate <command> [options]");
   console.log("  vibgrate help [command]     Show detailed help for a command");
   console.log("");
-  console.log(chalk5.bold("Getting started:"));
-  console.log(`  ${chalk5.cyan("init")}       Initialise vibgrate in a project (creates config & .vibgrate/ dir)`);
+  console.log(chalk7.bold("Getting started:"));
+  console.log(`  ${chalk7.cyan("init")}       Initialise vibgrate in a project (creates config & .vibgrate/ dir)`);
   console.log("");
-  console.log(chalk5.bold("Core scanning:"));
-  console.log(`  ${chalk5.cyan("scan")}       Scan a project for upgrade drift and generate a report`);
-  console.log(`  ${chalk5.cyan("baseline")}   Save a baseline snapshot to compare future scans against`);
+  console.log(chalk7.bold("Core scanning:"));
+  console.log(`  ${chalk7.cyan("scan")}       Scan a project for upgrade drift and generate a report`);
+  console.log(`  ${chalk7.cyan("baseline")}   Save a baseline snapshot to compare future scans against`);
   console.log("");
-  console.log(chalk5.bold("Reporting & export:"));
-  console.log(`  ${chalk5.cyan("report")}     Re-generate a report from a previously saved scan artifact`);
-  console.log(`  ${chalk5.cyan("sbom")}       Export a Software Bill of Materials (CycloneDX or SPDX)`);
+  console.log(chalk7.bold("Reporting & export:"));
+  console.log(`  ${chalk7.cyan("report")}     Re-generate a report from a previously saved scan artifact`);
+  console.log(`  ${chalk7.cyan("sbom")}       Export a Software Bill of Materials (CycloneDX or SPDX)`);
   console.log("");
-  console.log(chalk5.bold("CI/CD integration:"));
-  console.log(`  ${chalk5.cyan("push")}       Upload a scan artifact to the Vibgrate API`);
-  console.log(`  ${chalk5.cyan("dsn")}        Create and manage DSN tokens for API authentication`);
+  console.log(chalk7.bold("CI/CD integration:"));
+  console.log(`  ${chalk7.cyan("push")}       Upload a scan artifact to the Vibgrate API`);
+  console.log(`  ${chalk7.cyan("dsn")}        Create and manage DSN tokens for API authentication`);
   console.log("");
-  console.log(chalk5.bold("Maintenance:"));
-  console.log(`  ${chalk5.cyan("update")}     Update the vibgrate CLI to the latest version`);
+  console.log(chalk7.bold("Maintenance:"));
+  console.log(`  ${chalk7.cyan("update")}     Update the vibgrate CLI to the latest version`);
   console.log("");
-  console.log(chalk5.dim("Run") + ` ${chalk5.cyan("vibgrate help <command>")} ` + chalk5.dim("for detailed options, e.g.") + ` ${chalk5.cyan("vibgrate help scan")}`);
+  console.log(chalk7.dim("Run") + ` ${chalk7.cyan("vibgrate help <command>")} ` + chalk7.dim("for detailed options, e.g.") + ` ${chalk7.cyan("vibgrate help scan")}`);
 }
-var helpCommand = new Command5("help").description("Show help for vibgrate commands").argument("[command]", "Command to show detailed help for").helpOption(false).action((cmd) => {
+var helpCommand = new Command7("help").description("Show help for vibgrate commands").argument("[command]", "Command to show detailed help for").helpOption(false).action((cmd) => {
   const name = cmd?.toLowerCase().trim();
   if (name && detailedHelp[name]) {
     detailedHelp[name]();
   } else if (name) {
     console.log("");
-    console.log(chalk5.red(`Unknown command: ${name}`));
-    console.log(chalk5.dim(`Available commands: ${Object.keys(detailedHelp).join(", ")}`));
+    console.log(chalk7.red(`Unknown command: ${name}`));
+    console.log(chalk7.dim(`Available commands: ${Object.keys(detailedHelp).join(", ")}`));
     printSummaryHelp();
   } else {
     printSummaryHelp();
@@ -640,7 +1729,7 @@ var helpCommand = new Command5("help").description("Show help for vibgrate comma
 });
 
 // src/cli.ts
-var program = new Command6();
+var program = new Command8();
 program.name("vibgrate").description("Continuous Drift Intelligence").version(VERSION).addHelpText("after", "\nSee https://vibgrate.com/help for more guidance");
 program.addCommand(helpCommand);
 program.addCommand(initCommand);
@@ -651,12 +1740,14 @@ program.addCommand(dsnCommand);
 program.addCommand(pushCommand);
 program.addCommand(updateCommand);
 program.addCommand(sbomCommand);
+program.addCommand(extractCommand);
+program.addCommand(diffCommand);
 function notifyIfUpdateAvailable() {
   void checkForUpdate().then((update) => {
     if (!update?.updateAvailable) return;
     console.error("");
-    console.error(chalk6.yellow(`  Update available: ${update.current} \u2192 ${update.latest}`));
-    console.error(chalk6.dim('  Run "vibgrate update" to install the latest version.'));
+    console.error(chalk8.yellow(`  Update available: ${update.current} \u2192 ${update.latest}`));
+    console.error(chalk8.dim('  Run "vibgrate update" to install the latest version.'));
     console.error("");
   }).catch(() => {
   });