@vibgrate/cli 2026.613.1 → 2026.615.2

package/dist/cli.js

@@ -6,7 +6,7 @@ import {
   pathExists,
   readJsonFile,
   writeTextFile
-} from "./chunk-UNIBRNYG.js";
+} from "./chunk-HJ4D6B3B.js";
 import {
   computeRepoFingerprint,
   detectVcs,
@@ -16,10 +16,10 @@ import {
   resolveRepositoryName,
   runScan,
   writeDefaultConfig
-} from "./chunk-RPI2K62L.js";
+} from "./chunk-BOGC5GYS.js";
 import {
   require_semver
-} from "./chunk-74ZJFYEM.js";
+} from "./chunk-5IXVOEZN.js";
 import {
   parseExcludePatterns,
   pathExists as pathExists2
@@ -49,7 +49,7 @@ var initCommand = new Command("init").description("Initialize vibgrate in a proj
     console.log(chalk.green("\u2714") + ` Created ${chalk.bold("vibgrate.config.ts")}`);
   }
   if (opts.baseline) {
-    const { runBaseline } = await import("./baseline-LTB3IFRV.js");
+    const { runBaseline } = await import("./baseline-WUHK4LQY.js");
     await runBaseline(rootDir);
   }
   console.log("");
@@ -1667,7 +1667,7 @@ var updateCommand = new Command6("update").description("Update vibgrate to the l
     console.error(chalk7.red("Could not reach the npm registry. Check your network connection."));
     process.exit(1);
   }
-  const semver2 = await import("./semver-JBJZTHUX.js");
+  const semver2 = await import("./semver-2FJFIYVN.js");
   if (!semver2.gt(latest, VERSION)) {
     console.log(chalk7.green("\u2714") + ` You are on the latest version (${VERSION}).`);
     return;
@@ -1885,6 +1885,859 @@ import { existsSync } from "fs";
 import { spawn, spawnSync } from "child_process";
 import { Command as Command8 } from "commander";
 import chalk9 from "chalk";
+
+// src/behavioural/derive.ts
+import { createHash as createHash2 } from "crypto";
+
+// src/behavioural/hxl.ts
+import { createHash } from "crypto";
+var HxlTable = class {
+  nodes = [];
+  byKey = /* @__PURE__ */ new Map();
+  intern(node) {
+    const key = canonicalKey(node);
+    const existing = this.byKey.get(key);
+    if (existing !== void 0) return existing;
+    const idx = this.nodes.length;
+    this.nodes.push(node);
+    this.byKey.set(key, idx);
+    return idx;
+  }
+  /** Fraction of nodes that are faithfully represented (not Opaque). */
+  fidelity() {
+    if (this.nodes.length === 0) return 1;
+    const opaque = this.nodes.filter((n) => n.k === "Opaque").length;
+    return 1 - opaque / this.nodes.length;
+  }
+};
+function canonicalKey(n) {
+  switch (n.k) {
+    case "Lit":
+      return `L:${n.type}:${JSON.stringify(n.value)}`;
+    case "Ref":
+      return `R:${n.name}`;
+    case "Member":
+      return `M:${n.obj}.${n.name}`;
+    case "Call":
+      return `C:${n.callee}(${n.args.join(",")})`;
+    case "Unary":
+      return `U:${n.op}:${n.x}`;
+    case "Binary":
+      return `B:${n.op}:${n.l}:${n.r}`;
+    case "Opaque":
+      return `O:${n.raw}`;
+  }
+}
+var BIN_OPS = {
+  "==": "eq",
+  "===": "eq",
+  "!=": "ne",
+  "!==": "ne",
+  "<": "lt",
+  "<=": "le",
+  ">": "gt",
+  ">=": "ge",
+  "&&": "and",
+  "||": "or",
+  "+": "add",
+  "-": "sub",
+  "*": "mul",
+  "/": "div",
+  "%": "mod"
+};
+function tokenize(src) {
+  const toks = [];
+  let i = 0;
+  const ops3 = ["===", "!=="];
+  const ops2 = ["==", "!=", "<=", ">=", "&&", "||"];
+  while (i < src.length) {
+    const c = src[i];
+    if (c === " " || c === "	" || c === "\n" || c === "\r") {
+      i++;
+      continue;
+    }
+    if (src.startsWith("=>", i)) return null;
+    const three = src.slice(i, i + 3);
+    if (ops3.includes(three)) {
+      toks.push({ t: "op", v: three });
+      i += 3;
+      continue;
+    }
+    const two = src.slice(i, i + 2);
+    if (ops2.includes(two)) {
+      toks.push({ t: "op", v: two });
+      i += 2;
+      continue;
+    }
+    if ("<>+-*/%".includes(c)) {
+      toks.push({ t: "op", v: c });
+      i++;
+      continue;
+    }
+    if (c === "!") {
+      toks.push({ t: "not", v: "!" });
+      i++;
+      continue;
+    }
+    if (c === "(" || c === ")" || c === "." || c === ",") {
+      toks.push({ t: c, v: c });
+      i++;
+      continue;
+    }
+    if (c === '"' || c === "'") {
+      let j = i + 1;
+      let s = "";
+      while (j < src.length && src[j] !== c) {
+        if (src[j] === "\\") {
+          s += src[j + 1] ?? "";
+          j += 2;
+        } else {
+          s += src[j];
+          j++;
+        }
+      }
+      if (j >= src.length) return null;
+      toks.push({ t: "str", v: s });
+      i = j + 1;
+      continue;
+    }
+    if (/[0-9]/.test(c)) {
+      let j = i;
+      while (j < src.length && /[0-9.]/.test(src[j])) j++;
+      toks.push({ t: "num", v: src.slice(i, j) });
+      i = j;
+      continue;
+    }
+    if (/[A-Za-z_$]/.test(c)) {
+      let j = i;
+      while (j < src.length && /[A-Za-z0-9_$]/.test(src[j])) j++;
+      toks.push({ t: "ident", v: src.slice(i, j) });
+      i = j;
+      continue;
+    }
+    return null;
+  }
+  return toks;
+}
+function parseGuard(src, table = new HxlTable()) {
+  const toks = tokenize(src);
+  if (!toks || toks.length === 0) return null;
+  let p = 0;
+  const peek = () => toks[p];
+  const eat = () => toks[p++];
+  function parseOr() {
+    return parseBinLevel(["||"], parseAnd);
+  }
+  function parseAnd() {
+    return parseBinLevel(["&&"], parseCmp);
+  }
+  function parseCmp() {
+    const l = parseAdd();
+    if (l === null) return null;
+    const tk = peek();
+    if (tk && tk.t === "op" && ["==", "===", "!=", "!==", "<", "<=", ">", ">="].includes(tk.v)) {
+      eat();
+      const r = parseAdd();
+      if (r === null) return null;
+      return table.intern({ k: "Binary", op: BIN_OPS[tk.v], l, r });
+    }
+    return l;
+  }
+  function parseAdd() {
+    return parseBinLevel(["+", "-"], parseMul);
+  }
+  function parseMul() {
+    return parseBinLevel(["*", "/", "%"], parseUnary);
+  }
+  function parseBinLevel(ops, next) {
+    let l = next();
+    if (l === null) return null;
+    while (peek() && peek().t === "op" && ops.includes(peek().v)) {
+      const op = eat().v;
+      const r = next();
+      if (r === null) return null;
+      l = table.intern({ k: "Binary", op: BIN_OPS[op], l, r });
+    }
+    return l;
+  }
+  function parseUnary() {
+    if (peek() && peek().t === "not") {
+      eat();
+      const x = parseUnary();
+      if (x === null) return null;
+      return table.intern({ k: "Unary", op: "not", x });
+    }
+    return parsePostfix();
+  }
+  function parsePostfix() {
+    let node = parsePrimary();
+    if (node === null) return null;
+    for (; ; ) {
+      const tk = peek();
+      if (tk && tk.t === ".") {
+        eat();
+        const id = eat();
+        if (!id || id.t !== "ident") return null;
+        node = table.intern({ k: "Member", obj: node, name: id.v });
+        continue;
+      }
+      if (tk && tk.t === "(") {
+        eat();
+        const args = [];
+        if (peek() && peek().t !== ")") {
+          for (; ; ) {
+            const a = parseOr();
+            if (a === null) return null;
+            args.push(a);
+            if (peek() && peek().t === ",") {
+              eat();
+              continue;
+            }
+            break;
+          }
+        }
+        if (!peek() || eat().t !== ")") return null;
+        node = table.intern({ k: "Call", callee: node, args });
+        continue;
+      }
+      break;
+    }
+    return node;
+  }
+  function parsePrimary() {
+    const tk = peek();
+    if (!tk) return null;
+    if (tk.t === "num") {
+      eat();
+      return table.intern({ k: "Lit", value: Number(tk.v), type: tk.v.includes(".") ? "float" : "int" });
+    }
+    if (tk.t === "str") {
+      eat();
+      return table.intern({ k: "Lit", value: tk.v, type: "string" });
+    }
+    if (tk.t === "ident") {
+      if (tk.v === "true" || tk.v === "false") {
+        eat();
+        return table.intern({ k: "Lit", value: tk.v === "true", type: "bool" });
+      }
+      if (tk.v === "null") {
+        eat();
+        return table.intern({ k: "Lit", value: null, type: "null" });
+      }
+      eat();
+      return table.intern({ k: "Ref", name: tk.v });
+    }
+    if (tk.t === "(") {
+      eat();
+      const e = parseOr();
+      if (e === null) return null;
+      if (!peek() || eat().t !== ")") return null;
+      return e;
+    }
+    return null;
+  }
+  const root = parseOr();
+  if (root === null || p !== toks.length) return null;
+  return { table, root };
+}
+function lowerGuard(src) {
+  const parsed = parseGuard(src.trim());
+  if (parsed) return parsed;
+  const table = new HxlTable();
+  const root = table.intern({ k: "Opaque", raw: src.trim() });
+  return { table, root };
+}
+function renderNode(table, idx) {
+  const n = table.nodes[idx];
+  switch (n.k) {
+    case "Lit":
+      return n.type === "string" ? JSON.stringify(n.value) : String(n.value);
+    case "Ref":
+      return n.name;
+    case "Member":
+      return `${renderNode(table, n.obj)}.${n.name}`;
+    case "Call":
+      return `${renderNode(table, n.callee)}(${n.args.map((a) => renderNode(table, a)).join(", ")})`;
+    case "Unary":
+      return n.op === "not" ? `not ${renderNode(table, n.x)}` : `-${renderNode(table, n.x)}`;
+    case "Binary":
+      return `${renderNode(table, n.l)} ${n.op} ${renderNode(table, n.r)}`;
+    case "Opaque":
+      return `\xAB${n.raw}\xBB`;
+  }
+}
+
+// src/behavioural/derive.ts
+var BEHAVIOUR_BEARING_TYPES = /* @__PURE__ */ new Set([
+  "RouteDeclared",
+  "DataAccessOperation",
+  "EventEmitted",
+  "EventConsumed",
+  "ExternalServiceCall",
+  "CicsTransactionDeclared"
+]);
+function detokenize(value, refs) {
+  if (typeof value === "string") {
+    if (!value.startsWith("@@")) return value;
+    for (const [id, full] of refs) {
+      if (value === id) return full;
+      if (value.startsWith(id + "/")) return full + value.slice(id.length);
+    }
+    return value;
+  }
+  if (Array.isArray(value)) return value.map((v) => detokenize(v, refs));
+  if (value && typeof value === "object") {
+    const out = {};
+    for (const [k, v] of Object.entries(value)) out[k] = detokenize(v, refs);
+    return out;
+  }
+  return value;
+}
+function decompressFacts(lines) {
+  const models = /* @__PURE__ */ new Map();
+  const refs = /* @__PURE__ */ new Map();
+  const parsed = [];
+  for (const line of lines) {
+    const trimmed = line.trim();
+    if (!trimmed) continue;
+    let obj;
+    try {
+      obj = JSON.parse(trimmed);
+    } catch {
+      continue;
+    }
+    if (obj.factType === "Models") {
+      const list = obj.payload?.models ?? [];
+      for (const m of list) models.set(m.id, m);
+      continue;
+    }
+    if (obj.factType === "References") {
+      const list = obj.payload?.references ?? [];
+      for (const r of list) refs.set(r.id, r.value);
+      continue;
+    }
+    parsed.push(obj);
+  }
+  const out = [];
+  for (const obj of parsed) {
+    const payload = detokenize(obj.payload, refs);
+    if (typeof obj.m === "string") {
+      const model = models.get(obj.m);
+      if (!model) continue;
+      out.push({
+        factId: String(obj.factId),
+        factType: model.factType,
+        language: model.language,
+        scanner: model.scanner,
+        scannerVersion: model.scannerVersion,
+        emittedAt: "",
+        payload
+      });
+    } else if (typeof obj.factType === "string" && typeof obj.factId === "string") {
+      out.push({
+        factId: obj.factId,
+        factType: obj.factType,
+        language: String(obj.language ?? ""),
+        scanner: String(obj.scanner ?? ""),
+        scannerVersion: String(obj.scannerVersion ?? ""),
+        emittedAt: String(obj.emittedAt ?? ""),
+        payload
+      });
+    }
+  }
+  return out;
+}
+var str = (v) => typeof v === "string" && v ? v : void 0;
+var pick = (p, ...keys) => {
+  for (const k of keys) {
+    const s = str(p[k]);
+    if (s !== void 0) return s;
+  }
+  return void 0;
+};
+function buildIndex(facts) {
+  const idx = {
+    byType: /* @__PURE__ */ new Map(),
+    entityById: /* @__PURE__ */ new Map(),
+    fieldsByEntity: /* @__PURE__ */ new Map(),
+    paramsByRoute: /* @__PURE__ */ new Map(),
+    daoByHandler: /* @__PURE__ */ new Map(),
+    entityIdByName: /* @__PURE__ */ new Map()
+  };
+  for (const f of facts) {
+    (idx.byType.get(f.factType) ?? idx.byType.set(f.factType, []).get(f.factType)).push(f);
+    const p = f.payload;
+    switch (f.factType) {
+      case "EntityDeclared": {
+        const id = pick(p, "entityId");
+        const name = pick(p, "name", "shortName");
+        if (id) idx.entityById.set(id, f);
+        if (id && name) idx.entityIdByName.set(name.toLowerCase(), id);
+        break;
+      }
+      case "FieldDeclared": {
+        const id = pick(p, "entityId");
+        if (id) (idx.fieldsByEntity.get(id) ?? idx.fieldsByEntity.set(id, []).get(id)).push(f);
+        break;
+      }
+      case "ParameterBinding": {
+        const rid = pick(p, "routeId");
+        if (rid) (idx.paramsByRoute.get(rid) ?? idx.paramsByRoute.set(rid, []).get(rid)).push(f);
+        break;
+      }
+      case "DataAccessOperation": {
+        const caller = pick(p, "callerSymbol");
+        if (caller) idx.daoByHandler.set(caller, f);
+        break;
+      }
+    }
+  }
+  return idx;
+}
+function canonicalize(value) {
+  if (value === null || typeof value !== "object") return JSON.stringify(value);
+  if (Array.isArray(value)) return "[" + value.map(canonicalize).join(",") + "]";
+  const obj = value;
+  const keys = Object.keys(obj).sort();
+  return "{" + keys.map((k) => JSON.stringify(k) + ":" + canonicalize(obj[k])).join(",") + "}";
+}
+function sha16(seed) {
+  return createHash2("sha256").update(seed).digest("hex").slice(0, 16);
+}
+function factId(factType, seed) {
+  return `hcs:${factType}:${sha16(seed)}`;
+}
+function makeAssertion(kind, subjectFactIds, structuredPredicate, predicate, strength, label, surfaceRefs, expr) {
+  const subjects = [...new Set(subjectFactIds)].sort();
+  const assertionId = `ba:${kind}:${sha16(canonicalize({ kind, subjectFactIds: subjects, predicate: structuredPredicate }))}`;
+  const payload = { assertionId, kind, subjectFactIds: subjects, predicate, derivedBy: "static", corpusRef: null, strength, label };
+  if (expr) payload.expr = expr;
+  return { payload, surfaceRefs };
+}
+function statusForException(ex) {
+  const e = ex.toLowerCase();
+  if (e.includes("notfound")) return 404;
+  if (e.includes("unauthor") || e.includes("forbidden")) return 403;
+  if (e.includes("unauthenticated")) return 401;
+  if (e.includes("validation") || e.includes("argument") || e.includes("badrequest")) return 400;
+  if (e.includes("conflict")) return 409;
+  return 500;
+}
+var STATIC_CAP = 0.85;
+var INTEGRATION_STRENGTH = 0.55;
+var EVENT_STRENGTH = 0.5;
+function contractStrength(opts) {
+  let s = 0.35;
+  if (opts.hasParams) s += 0.1;
+  if (opts.hasResponseEntity) s += 0.2;
+  if (opts.hasErrorBranches) s += 0.15;
+  return Math.min(STATIC_CAP, s);
+}
+function invariantStrength(fidelity) {
+  return Math.min(STATIC_CAP, 0.5 + 0.3 * fidelity);
+}
+function synthesizeApiContracts(idx) {
+  const routes = idx.byType.get("RouteDeclared") ?? [];
+  const out = [];
+  for (const route of routes) {
+    const p = route.payload;
+    const method = pick(p, "method", "httpMethod") ?? "ANY";
+    const template = pick(p, "template", "routePath") ?? "";
+    const routeId = pick(p, "routeId") ?? `${method}:${template}`;
+    const handler = pick(p, "handlerSymbol", "handlerName");
+    const subjects = [route.factId];
+    const surfaceRefs = [route.factId];
+    const params = (idx.paramsByRoute.get(routeId) ?? []).map((pb) => {
+      subjects.push(pb.factId);
+      return {
+        name: pick(pb.payload, "paramName", "parameterName") ?? "",
+        source: pick(pb.payload, "source", "bindingSource") ?? "unknown",
+        type: pick(pb.payload, "typeName", "parameterType") ?? "unknown",
+        required: pb.payload.required === true || pb.payload.isRequired === true
+      };
+    });
+    let entityName;
+    let fields = [];
+    const errors = [];
+    const dao = handler ? idx.daoByHandler.get(handler) : void 0;
+    if (dao) {
+      subjects.push(dao.factId);
+      surfaceRefs.push(dao.factId);
+      entityName = pick(dao.payload, "targetEntity");
+      const steps = Array.isArray(dao.payload.steps) ? dao.payload.steps : [];
+      for (const stepEntry of steps) {
+        const kind = pick(stepEntry, "stepKind", "kind");
+        const throwsOn = pick(stepEntry, "throwsOnFail");
+        if (kind === "guard" && throwsOn) errors.push({ status: statusForException(throwsOn), when: throwsOn });
+      }
+    }
+    if (entityName) {
+      const eid = idx.entityIdByName.get(entityName.toLowerCase());
+      const entity = eid ? idx.entityById.get(eid) : void 0;
+      if (entity) subjects.push(entity.factId);
+      if (eid) {
+        fields = (idx.fieldsByEntity.get(eid) ?? []).map((fd) => ({
+          name: pick(fd.payload, "fieldName") ?? "",
+          type: pick(fd.payload, "typeName", "hcsType") ?? "unknown"
+        }));
+      }
+    }
+    const structured = { method, template, params, response: { status: 200, entity: entityName ?? null, fields }, errors };
+    const predicate = renderContract(method, template, params, entityName, fields, errors);
+    const label = `${method} ${template} contract`;
+    const strength = contractStrength({ hasParams: params.length > 0, hasResponseEntity: !!entityName, hasErrorBranches: errors.length > 0 });
+    out.push(makeAssertion("contract", subjects, structured, predicate, strength, label, surfaceRefs));
+  }
+  return out;
+}
+function renderContract(method, template, params, entity, fields, errors) {
+  const paramStr = params.map((p) => `${p.name}:${p.type}`).join(", ");
+  const fieldStr = fields.map((f) => `${f.name}:${f.type}`).join(", ");
+  const ok = entity ? `200 ${entity}{ ${fieldStr} }` : "200";
+  const errStr = errors.map((e) => `${e.status} when ${e.when}`).join(" | ");
+  return `${method} ${template}(${paramStr}) -> ${ok}${errStr ? " | " + errStr : ""}`;
+}
+function synthesizeIntegrationContracts(idx) {
+  const calls = idx.byType.get("ExternalServiceCall") ?? [];
+  const out = [];
+  for (const call of calls) {
+    const p = call.payload;
+    const target = pick(p, "targetUrl", "serviceRef", "urlOrPattern") ?? "unknown";
+    const method = pick(p, "httpMethod", "method") ?? "ANY";
+    const client = pick(p, "clientKind", "protocol") ?? "unknown";
+    const structured = { type: "integration", method, target, client };
+    const predicate = `calls ${method} ${target} via ${client}`;
+    out.push(makeAssertion("contract", [call.factId], structured, predicate, INTEGRATION_STRENGTH, `outbound ${method} ${target}`, [call.factId]));
+  }
+  return out;
+}
+function synthesizeEventContracts(idx) {
+  const out = [];
+  for (const ev of idx.byType.get("EventEmitted") ?? []) {
+    const p = ev.payload;
+    const name = pick(p, "eventName") ?? "unknown";
+    const kind = pick(p, "emitterKind") ?? "event";
+    const payloadType = pick(p, "payloadType") ?? null;
+    const structured = { type: "event", direction: "emit", name, kind, payloadType };
+    const predicate = `emits ${name}${payloadType ? ` (${payloadType})` : ""} via ${kind}`;
+    out.push(makeAssertion("contract", [ev.factId], structured, predicate, EVENT_STRENGTH, `emits ${name}`, [ev.factId]));
+  }
+  for (const ev of idx.byType.get("EventConsumed") ?? []) {
+    const p = ev.payload;
+    const name = pick(p, "eventName") ?? "unknown";
+    const kind = pick(p, "consumerKind") ?? "handler";
+    const payloadType = pick(p, "payloadType") ?? null;
+    const structured = { type: "event", direction: "consume", name, kind, payloadType };
+    const predicate = `consumes ${name}${payloadType ? ` (${payloadType})` : ""} via ${kind}`;
+    out.push(makeAssertion("contract", [ev.factId], structured, predicate, EVENT_STRENGTH, `consumes ${name}`, [ev.factId]));
+  }
+  return out;
+}
+function validationRuleToExpr(field, fieldType, rule, arg) {
+  const t = new HxlTable();
+  const ref = t.intern({ k: "Ref", name: field });
+  const len = () => t.intern({ k: "Member", obj: ref, name: "length" });
+  const num = (s) => {
+    const n = Number(s);
+    return t.intern({ k: "Lit", value: Number.isFinite(n) ? n : 0, type: Number.isInteger(n) ? "int" : "float" });
+  };
+  const zero = () => t.intern({ k: "Lit", value: 0, type: "int" });
+  const isString = fieldType === "string";
+  const bin = (op, l, r) => t.intern({ k: "Binary", op, l, r });
+  const format = (name) => t.intern({ k: "Call", callee: t.intern({ k: "Member", obj: ref, name: "matches" }), args: [t.intern({ k: "Lit", value: name, type: "string" })] });
+  let root;
+  switch (rule) {
+    case "min":
+      root = bin("ge", isString ? len() : ref, num(arg));
+      break;
+    case "max":
+      root = bin("le", isString ? len() : ref, num(arg));
+      break;
+    case "gt":
+      root = bin("gt", ref, num(arg));
+      break;
+    case "gte":
+      root = bin("ge", ref, num(arg));
+      break;
+    case "lt":
+      root = bin("lt", ref, num(arg));
+      break;
+    case "lte":
+      root = bin("le", ref, num(arg));
+      break;
+    case "positive":
+      root = bin("gt", ref, zero());
+      break;
+    case "nonnegative":
+      root = bin("ge", ref, zero());
+      break;
+    case "length":
+      root = bin("eq", len(), num(arg));
+      break;
+    case "nonempty":
+      root = bin("gt", len(), zero());
+      break;
+    case "email":
+    case "url":
+    case "uuid":
+    case "datetime":
+      root = format(rule);
+      break;
+    case "regex":
+      root = format(arg ?? "regex");
+      break;
+    default:
+      return null;
+  }
+  return { table: t, root };
+}
+function schemaCandidates(typeName) {
+  const base = typeName.replace(/<.*>/, "").replace(/\[\]$/, "").trim();
+  const stripped = base.replace(/(Dto|Input|Request|Payload|Body)$/i, "");
+  return [base, stripped, `${stripped}Schema`, `${base}Schema`];
+}
+function buildSchemaRouteLinks(idx) {
+  const links = /* @__PURE__ */ new Map();
+  const schemaNames = /* @__PURE__ */ new Set();
+  for (const vr of idx.byType.get("ValidationRuleObserved") ?? []) {
+    const s = pick(vr.payload, "schemaName");
+    if (s) schemaNames.add(s);
+  }
+  if (schemaNames.size === 0) return links;
+  for (const route of idx.byType.get("RouteDeclared") ?? []) {
+    const rid = pick(route.payload, "routeId") ?? "";
+    const body = (idx.paramsByRoute.get(rid) ?? []).find((p) => pick(p.payload, "source", "bindingSource") === "body");
+    if (!body) continue;
+    const ptype = pick(body.payload, "typeName", "parameterType");
+    if (!ptype || ptype.startsWith("Record") || ptype === "any" || ptype === "unknown") continue;
+    const cands = schemaCandidates(ptype);
+    for (const sn of schemaNames) {
+      const snBase = sn.replace(/Schema\d*$/, "").replace(/\d+$/, "");
+      if (cands.includes(sn) || cands.includes(snBase) || cands.includes(`${snBase}Schema`)) {
+        links.set(sn, route.factId);
+        break;
+      }
+    }
+  }
+  return links;
+}
+function synthesizeValidationInvariants(idx, schemaRoute) {
+  const out = [];
+  for (const vr of idx.byType.get("ValidationRuleObserved") ?? []) {
+    const p = vr.payload;
+    const field = pick(p, "fieldName") ?? "field";
+    const fieldType = pick(p, "fieldType") ?? "unknown";
+    const rule = pick(p, "rule") ?? "";
+    const arg = pick(p, "arg") ?? null;
+    const schema = pick(p, "schemaName") ?? "";
+    const built = validationRuleToExpr(`${schema}.${field}`, fieldType, rule, arg);
+    if (!built) continue;
+    const rendered = renderNode(built.table, built.root);
+    const structured = { type: "validation", hxl: built.table.nodes, root: built.root };
+    const routeRef = schemaRoute.get(schema);
+    out.push(makeAssertion("invariant", [vr.factId], structured, rendered, invariantStrength(built.table.fidelity()), `rule ${rendered}`, routeRef ? [routeRef] : [], { nodes: built.table.nodes, root: built.root }));
+  }
+  return out;
+}
+function buildRouteIntervals(idx) {
+  const map = /* @__PURE__ */ new Map();
+  for (const route of idx.byType.get("RouteDeclared") ?? []) {
+    const file = pick(route.payload, "filePath");
+    const start = route.payload.handlerStartLine;
+    const end = route.payload.handlerEndLine;
+    if (!file || typeof start !== "number" || typeof end !== "number") continue;
+    (map.get(file) ?? map.set(file, []).get(file)).push({ start, end, factId: route.factId });
+  }
+  return map;
+}
+function routeAt(intervals, file, line) {
+  if (!file || typeof line !== "number") return void 0;
+  for (const iv of intervals.get(file) ?? []) if (line >= iv.start && line <= iv.end) return iv.factId;
+  return void 0;
+}
+function synthesizeMethodLogicInvariants(idx) {
+  const out = [];
+  const surfaceByContainer = /* @__PURE__ */ new Map();
+  for (const dao of idx.byType.get("DataAccessOperation") ?? []) {
+    const c = pick(dao.payload, "callerSymbol");
+    if (c) surfaceByContainer.set(c, dao.factId);
+  }
+  for (const route of idx.byType.get("RouteDeclared") ?? []) {
+    const h = pick(route.payload, "handlerSymbol", "handlerName");
+    if (h) surfaceByContainer.set(h, route.factId);
+  }
+  const callsFrom = /* @__PURE__ */ new Map();
+  for (const co of idx.byType.get("CallObserved") ?? []) {
+    const caller = pick(co.payload, "callerId", "callerSymbol");
+    const callee = pick(co.payload, "calleeId", "calleeSymbol");
+    if (!caller || !callee) continue;
+    const short = callee.split(".").pop();
+    (callsFrom.get(caller) ?? callsFrom.set(caller, /* @__PURE__ */ new Set()).get(caller)).add(short);
+  }
+  const routeIntervals = buildRouteIntervals(idx);
+  for (const m of idx.byType.get("MethodLogicObserved") ?? []) {
+    const expr = pick(m.payload, "expression");
+    if (!expr) continue;
+    const container = pick(m.payload, "containerSymbol") ?? "<m>";
+    const kind = pick(m.payload, "kind") ?? "guard";
+    const { table, root } = lowerGuard(expr);
+    if (table.fidelity() === 0) continue;
+    const rendered = renderNode(table, root);
+    let surfaceRef = surfaceByContainer.get(container);
+    if (!surfaceRef) {
+      const shortName = container.split(".").pop();
+      for (const [cont, fid] of surfaceByContainer) {
+        if (callsFrom.get(cont)?.has(shortName)) {
+          surfaceRef = fid;
+          break;
+        }
+      }
+    }
+    if (!surfaceRef) surfaceRef = routeAt(routeIntervals, pick(m.payload, "filePath"), m.payload.line);
+    const structured = { type: "methodlogic", kind, hxl: table.nodes, root };
+    out.push(makeAssertion("invariant", [m.factId], structured, rendered, invariantStrength(table.fidelity()), `${kind} ${rendered}`, surfaceRef ? [surfaceRef] : [], { nodes: table.nodes, root }));
+  }
+  return out;
+}
+function synthesizeEntityConstraints(idx) {
+  const out = [];
+  for (const fd of idx.byType.get("FieldDeclared") ?? []) {
+    const field = pick(fd.payload, "fieldName");
+    if (!field) continue;
+    const base = `${pick(fd.payload, "entityId") ?? ""}.${field}`;
+    if (fd.payload.isNullable === false) {
+      const t = new HxlTable();
+      const root = t.intern({ k: "Binary", op: "ne", l: t.intern({ k: "Ref", name: base }), r: t.intern({ k: "Lit", value: null, type: "null" }) });
+      out.push(makeAssertion("invariant", [fd.factId], { type: "entity-constraint", hxl: t.nodes, root }, renderNode(t, root), invariantStrength(1), `nonnull ${base}`, [], { nodes: t.nodes, root }));
+    }
+    if (typeof fd.payload.maxLength === "number") {
+      const t = new HxlTable();
+      const ref = t.intern({ k: "Ref", name: base });
+      const root = t.intern({ k: "Binary", op: "le", l: t.intern({ k: "Member", obj: ref, name: "length" }), r: t.intern({ k: "Lit", value: fd.payload.maxLength, type: "int" }) });
+      out.push(makeAssertion("invariant", [fd.factId], { type: "entity-constraint", hxl: t.nodes, root }, renderNode(t, root), invariantStrength(1), `maxlen ${base}`, [], { nodes: t.nodes, root }));
+    }
+  }
+  return out;
+}
+function synthesizeDataOpContracts(idx) {
+  const out = [];
+  for (const dao of idx.byType.get("DataAccessOperation") ?? []) {
+    const p = dao.payload;
+    const kind = pick(p, "semanticKind") ?? "unknown";
+    const entity = pick(p, "targetEntity");
+    const returnType = pick(p, "returnType");
+    const steps = Array.isArray(p.steps) ? p.steps : [];
+    const collection = p.returnsCollection === true;
+    let strength = 0.4;
+    if (entity) strength += 0.15;
+    if (steps.length > 0) strength += 0.1;
+    if (returnType) strength += 0.1;
+    strength = Math.min(STATIC_CAP, strength);
+    const structured = { type: "dataop", kind, entity: entity ?? null, returnType: returnType ?? null, collection };
+    const predicate = `${kind} ${entity ?? "?"}${collection ? "[]" : ""}`;
+    out.push(makeAssertion("contract", [dao.factId], structured, predicate, strength, `data ${predicate}`, [dao.factId]));
+  }
+  return out;
+}
+function synthesizeInvariants(idx) {
+  const out = [];
+  for (const dao of idx.byType.get("DataAccessOperation") ?? []) {
+    const steps = Array.isArray(dao.payload.steps) ? dao.payload.steps : [];
+    for (const step of steps) {
+      const expr = pick(step, "predicateExpression");
+      if (!expr) continue;
+      const { table, root } = lowerGuard(expr);
+      const fidelity = table.fidelity();
+      if (fidelity === 0) continue;
+      const rendered = renderNode(table, root);
+      const structured = { type: "invariant", hxl: table.nodes, root };
+      out.push(makeAssertion("invariant", [dao.factId], structured, rendered, invariantStrength(fidelity), `invariant ${rendered}`, [dao.factId], { nodes: table.nodes, root }));
+    }
+  }
+  return out;
+}
+function deriveBehaviouralFacts(facts, opts) {
+  const emittedAt = opts.emittedAt ?? (/* @__PURE__ */ new Date()).toISOString();
+  const idx = buildIndex(facts);
+  const derived = [
+    ...synthesizeApiContracts(idx),
+    ...synthesizeIntegrationContracts(idx),
+    ...synthesizeEventContracts(idx),
+    ...synthesizeDataOpContracts(idx),
+    ...synthesizeInvariants(idx),
+    ...synthesizeValidationInvariants(idx, buildSchemaRouteLinks(idx)),
+    ...synthesizeMethodLogicInvariants(idx),
+    ...synthesizeEntityConstraints(idx)
+  ];
+  const seenAssertion = /* @__PURE__ */ new Set();
+  const unique = [];
+  for (const d of derived) {
+    if (seenAssertion.has(d.payload.assertionId)) continue;
+    seenAssertion.add(d.payload.assertionId);
+    unique.push(d);
+  }
+  unique.sort((a, b) => a.payload.assertionId.localeCompare(b.payload.assertionId));
+  const envelopes = [];
+  const assertionFactIds = [];
+  const byKind = {};
+  const assertedSurface = /* @__PURE__ */ new Map();
+  for (const d of unique) {
+    const fid = factId("BehaviouralAssertion", d.payload.assertionId);
+    assertionFactIds.push(fid);
+    byKind[d.payload.kind] = (byKind[d.payload.kind] ?? 0) + 1;
+    for (const ref of d.surfaceRefs) {
+      assertedSurface.set(ref, Math.max(assertedSurface.get(ref) ?? 0, d.payload.strength));
+    }
+    envelopes.push({
+      factId: fid,
+      factType: "BehaviouralAssertion",
+      language: "multi",
+      scanner: "hcs-behavioural",
+      scannerVersion: "0.3.0",
+      emittedAt,
+      payload: d.payload
+    });
+  }
+  const surfaceFactIds = [...new Set(facts.filter((f) => BEHAVIOUR_BEARING_TYPES.has(f.factType)).map((f) => f.factId))];
+  const surfaceFacts = surfaceFactIds.length;
+  const assertedFacts = surfaceFactIds.filter((id) => assertedSurface.has(id)).length;
+  const strengthSum = surfaceFactIds.reduce((acc, id) => acc + (assertedSurface.get(id) ?? 0), 0);
+  const behaviouralConfidence = surfaceFacts === 0 ? 0 : Math.min(100, Math.round(strengthSum / surfaceFacts * 100));
+  const sortedAssertionIds = [...new Set(assertionFactIds)].sort();
+  const specId = `spec:${sha16(canonicalize({ scanId: opts.scanId, assertionIds: sortedAssertionIds }))}`;
+  const specFactId = factId("BehaviouralSpec", specId);
+  const invariants = unique.filter((d) => d.payload.kind === "invariant");
+  const logicFacts = invariants.length;
+  let nodes = 0;
+  let opaque = 0;
+  for (const inv of invariants) {
+    const t = inv.payload.expr?.nodes ?? [];
+    nodes += t.length;
+    opaque += t.filter((n) => n.k === "Opaque").length;
+  }
+  const logicCoverage = nodes === 0 ? 0 : Math.round((1 - opaque / nodes) * 100);
+  envelopes.push({
+    factId: specFactId,
+    factType: "BehaviouralSpec",
+    language: "multi",
+    scanner: "hcs-behavioural",
+    scannerVersion: "0.3.0",
+    emittedAt,
+    payload: {
+      specId,
+      scanId: opts.scanId,
+      applicationId: opts.applicationId,
+      assertionIds: sortedAssertionIds,
+      coverage: { surfaceFacts, assertedFacts, byKind },
+      behaviouralConfidence,
+      logicFacts,
+      logicCoverage
+    }
+  });
+  return { envelopes, summary: { assertions: unique.length, surfaceFacts, assertedFacts, behaviouralConfidence } };
+}
+
+// src/commands/extract.ts
 var EXIT_SUCCESS = 0;
 var EXIT_SCHEMA_FAILURE = 1;
 var EXIT_PARSE_FAILURE = 2;
@@ -2553,7 +3406,7 @@ var ProgressTracker = class {
     }
   }
 };
-var extractCommand = new Command8("extract").description("Analyze source code and emit validated HCS facts (NDJSON)").argument("[path]", "Path to source directory", ".").option("-o, --out <file>", "Write NDJSON to file (default: stdout)").option("--language <langs>", "Comma-separated languages to analyze (default: auto-detect)").option("--include-tests", "Include test files in analysis").option("--push", "Stream validated facts to dashboard API").option("--dsn <dsn>", "DSN token for push (or use VIBGRATE_DSN env)").option("--concurrency <n>", "Number of parallel file workers").option("--timeout-mins <mins>", "Total analysis timeout in minutes", "60").option("--feedback <file>", "Load NDJSON diff artifact for refinement").option("--verbose", "Print worker stderr and summary statistics").action(async (targetPath, opts) => {
+var extractCommand = new Command8("extract").description("Analyze source code and emit validated HCS facts (NDJSON)").argument("[path]", "Path to source directory", ".").option("-o, --out <file>", "Write NDJSON to file (default: stdout)").option("--language <langs>", "Comma-separated languages to analyze (default: auto-detect)").option("--include-tests", "Include test files in analysis").option("--push", "Stream validated facts to dashboard API").option("--dsn <dsn>", "DSN token for push (or use VIBGRATE_DSN env)").option("--concurrency <n>", "Number of parallel file workers").option("--timeout-mins <mins>", "Total analysis timeout in minutes", "60").option("--feedback <file>", "Load NDJSON diff artifact for refinement").option("--derive", "Derive behavioural spec facts (BehaviouralAssertion/BehaviouralSpec) from extracted facts").option("--scan-id <id>", 'Scan id for the derived BehaviouralSpec (default: "local")').option("--application-id <id>", "Application id for the derived BehaviouralSpec (default: directory name)").option("--verbose", "Print worker stderr and summary statistics").action(async (targetPath, opts) => {
   const rootDir = path9.resolve(targetPath);
   if (!await pathExists(rootDir)) {
     process.stderr.write(chalk9.red(`Path does not exist: ${rootDir}
@@ -2678,6 +3531,7 @@ var extractCommand = new Command8("extract").description("Analyze source code an
   const allPreamble = [];
   const allFacts = [];
   const allErrors = [];
+  const derivedInputs = [];
   let hasSchemaFailure = false;
   let hasParseFailure = false;
   let hasTimeout = false;
@@ -2703,6 +3557,12 @@ var extractCommand = new Command8("extract").description("Analyze source code an
       }
       const { preamble, facts } = splitHcsOutput(result.facts);
       allPreamble.push(...preamble);
+      if (opts.derive) {
+        try {
+          derivedInputs.push(...decompressFacts([...preamble, ...facts]));
+        } catch {
+        }
+      }
       let langFactCount = 0;
       for (const line of [...preamble, ...facts]) {
         const validation = validateFactLine(line);
@@ -2734,6 +3594,24 @@ var extractCommand = new Command8("extract").description("Analyze source code an
   await Promise.all(workerPromises);
   const elapsed = ((Date.now() - startTime) / 1e3).toFixed(1);
   progress.finish(elapsed);
+  if (opts.derive) {
+    const scanId = opts.scanId || "local";
+    const applicationId = opts.applicationId || path9.basename(rootDir);
+    const { envelopes, summary } = deriveBehaviouralFacts(derivedInputs, { scanId, applicationId });
+    for (const env of envelopes) {
+      const line = JSON.stringify(env);
+      if (validateFactLine(line).valid) {
+        allFacts.push(line);
+      } else {
+        hasSchemaFailure = true;
+        allErrors.push("[behavioural] derived fact failed schema validation");
+      }
+    }
+    process.stderr.write(chalk9.dim(
+      `Derived ${summary.assertions} behavioural assertion(s) \xB7 confidence ${summary.behaviouralConfidence} (${summary.assertedFacts}/${summary.surfaceFacts} surface facts)
+`
+    ));
+  }
   allFacts.sort();
   const allLines = [...allPreamble, ...allFacts];
   const ndjsonOutput = allLines.join("\n") + (allLines.length > 0 ? "\n" : "");