@vibgrate/cli 2026.613.1 → 2026.615.2

package/dist/hcs-worker.js

@@ -2507,7 +2507,7 @@ var require_typescript = __commonJS({
         SymbolDisplayPartKind: () => SymbolDisplayPartKind,
         SymbolFlags: () => SymbolFlags,
         SymbolFormatFlags: () => SymbolFormatFlags,
-        SyntaxKind: () => SyntaxKind18,
+        SyntaxKind: () => SyntaxKind20,
         Ternary: () => Ternary,
         ThrottledCancellationToken: () => ThrottledCancellationToken,
         TokenClass: () => TokenClass,
@@ -6398,7 +6398,7 @@ Node ${formatSyntaxKind(node.kind)} was unexpected.`,
         function formatSyntaxKind(kind) {
           return formatEnum(
             kind,
-            SyntaxKind18,
+            SyntaxKind20,
             /*isFlags*/
             false
           );
@@ -7846,7 +7846,7 @@ ${lanes.join("\n")}
       })(tracingEnabled || (tracingEnabled = {}));
       var startTracing = tracingEnabled.startTracing;
       var dumpTracingLegend = tracingEnabled.dumpLegend;
-      var SyntaxKind18 = /* @__PURE__ */ ((SyntaxKind52) => {
+      var SyntaxKind20 = /* @__PURE__ */ ((SyntaxKind52) => {
         SyntaxKind52[SyntaxKind52["Unknown"] = 0] = "Unknown";
         SyntaxKind52[SyntaxKind52["EndOfFileToken"] = 1] = "EndOfFileToken";
         SyntaxKind52[SyntaxKind52["SingleLineCommentTrivia"] = 2] = "SingleLineCommentTrivia";
@@ -8352,7 +8352,7 @@ ${lanes.join("\n")}
           /* LastKeyword */
         ] = "LastContextualKeyword";
         return SyntaxKind52;
-      })(SyntaxKind18 || {});
+      })(SyntaxKind20 || {});
       var NodeFlags = /* @__PURE__ */ ((NodeFlags3) => {
         NodeFlags3[NodeFlags3["None"] = 0] = "None";
         NodeFlags3[NodeFlags3["Let"] = 1] = "Let";
@@ -198758,7 +198758,7 @@ ${options.prefix}` : "\n" : options.prefix
         SymbolDisplayPartKind: () => SymbolDisplayPartKind,
         SymbolFlags: () => SymbolFlags,
         SymbolFormatFlags: () => SymbolFormatFlags,
-        SyntaxKind: () => SyntaxKind18,
+        SyntaxKind: () => SyntaxKind20,
         Ternary: () => Ternary,
         ThrottledCancellationToken: () => ThrottledCancellationToken,
         TokenClass: () => TokenClass,
@@ -293077,7 +293077,7 @@ function useColor() {
 var program = new Command();
 
 // src/main.ts
-var import_ts_morph18 = __toESM(require_ts_morph(), 1);
+var import_ts_morph20 = __toESM(require_ts_morph(), 1);
 
 // src/facts/fact-emitter.ts
 init_esm_shims();
@@ -293206,6 +293206,21 @@ var NdjsonFactEmitter = class {
   emitHookDeclared(p) {
     this.emit("HookDeclared", p.hookId, p);
   }
+  // ── Behavioural specification facts (Phase 0) ────────────
+  // Seeded by the assertion/spec content hash so identical code + identical
+  // corpus yield identical factIds — the predictability guarantee.
+  emitBehaviouralAssertion(p) {
+    this.emit("BehaviouralAssertion", p.assertionId, p);
+  }
+  emitBehaviouralSpec(p) {
+    this.emit("BehaviouralSpec", p.specId, p);
+  }
+  emitValidationRuleObserved(p) {
+    this.emit("ValidationRuleObserved", p.ruleId, p);
+  }
+  emitMethodLogicObserved(p) {
+    this.emit("MethodLogicObserved", p.logicId, p);
+  }
   emitCopybookResolved(p) {
     this.emit("CopybookResolved", p.copybookId, p);
   }
@@ -293598,6 +293613,7 @@ var RouteExtractor = class _RouteExtractor {
         }
       }
       this.extractExpressRoutes(sf, filePath, emitter);
+      this.extractArrayRegisteredRoutes(sf, filePath, emitter);
     }
   }
   extractNestJsController(cls, filePath, emitter) {
@@ -293618,9 +293634,12 @@ var RouteExtractor = class _RouteExtractor {
           httpMethod,
           routePath: fullRoute,
           handlerType: controllerName,
-          handlerName: method.getName(),
+          // Qualified so it matches the method-logic container and DAO callerSymbol.
+          handlerName: `${controllerName}.${method.getName()}`,
           filePath,
-          startLine: method.getStartLineNumber()
+          startLine: method.getStartLineNumber(),
+          handlerStartLine: method.getStartLineNumber(),
+          handlerEndLine: method.getEndLineNumber()
         });
         const requiresAuth = this.hasDecorator(method, "UseGuards") || this.hasDecorator(cls, "UseGuards");
         emitter.emitEndpointMetadata({
@@ -293675,6 +293694,9 @@ var RouteExtractor = class _RouteExtractor {
       if (httpMethod === "USE" || httpMethod === "ROUTE") continue;
       const fullRoute = this.normalisePath(routePath);
       const routeId = `route:${httpMethod.toLowerCase()}:${fullRoute}`;
+      const handlerArg = args[args.length - 1];
+      const hk = handlerArg.getKind();
+      const inlineHandler = hk === import_ts_morph2.SyntaxKind.ArrowFunction || hk === import_ts_morph2.SyntaxKind.FunctionExpression;
       emitter.emitRouteDeclared({
         routeId,
         httpMethod,
@@ -293682,7 +293704,9 @@ var RouteExtractor = class _RouteExtractor {
         handlerType: "Express",
         handlerName: `${httpMethod.toLowerCase()}:${fullRoute}`,
         filePath,
-        startLine: call.getStartLineNumber()
+        startLine: call.getStartLineNumber(),
+        handlerStartLine: inlineHandler ? handlerArg.getStartLineNumber() : void 0,
+        handlerEndLine: inlineHandler ? handlerArg.getEndLineNumber() : void 0
       });
       emitter.emitEndpointMetadata({
         routeId,
@@ -293724,6 +293748,92 @@ var RouteExtractor = class _RouteExtractor {
     }
     return text;
   }
+  /**
+   * Routes registered by iterating an array of paths:
+   *   const paths = ['/a','/b']; paths.forEach((p) => router.get(p, handler));
+   * The per-element `router.get(p, …)` calls are skipped by extractExpressRoutes
+   * (the path arg is a variable, not a literal), so resolve them here.
+   */
+  extractArrayRegisteredRoutes(sf, filePath, emitter) {
+    for (const call of sf.getDescendantsOfKind(import_ts_morph2.SyntaxKind.CallExpression)) {
+      const expr = call.getExpression();
+      if (!import_ts_morph2.Node.isPropertyAccessExpression(expr)) continue;
+      const iter = expr.getName();
+      if (iter !== "forEach" && iter !== "map") continue;
+      const cb = call.getArguments()[0];
+      const cbk = cb?.getKind?.();
+      if (cbk !== import_ts_morph2.SyntaxKind.ArrowFunction && cbk !== import_ts_morph2.SyntaxKind.FunctionExpression) continue;
+      const params = cb.getParameters?.() ?? [];
+      if (params.length === 0) continue;
+      const loopVar = params[0].getName();
+      const body = cb.getBody?.();
+      if (!body) continue;
+      const calls = [];
+      if (body.getKind?.() === import_ts_morph2.SyntaxKind.CallExpression) calls.push(body);
+      calls.push(...body.getDescendantsOfKind?.(import_ts_morph2.SyntaxKind.CallExpression) ?? []);
+      let method = null;
+      for (const ic of calls) {
+        const ie = ic.getExpression();
+        if (!import_ts_morph2.Node.isPropertyAccessExpression(ie)) continue;
+        const m = ie.getName();
+        if (!_RouteExtractor.EXPRESS_METHODS.has(m)) continue;
+        const recv = ie.getExpression().getText();
+        if (!recv.includes("app") && !recv.includes("router") && !recv.includes("server")) continue;
+        const iargs = ic.getArguments();
+        if (iargs.length < 1 || iargs[0].getText() !== loopVar) continue;
+        method = m;
+        break;
+      }
+      if (!method) continue;
+      const httpMethod = method.toUpperCase();
+      if (httpMethod === "USE" || httpMethod === "ROUTE") continue;
+      for (const raw of this.resolveStringArray(expr.getExpression())) {
+        const fullRoute = this.normalisePath(raw);
+        const routeId = `route:${httpMethod.toLowerCase()}:${fullRoute}`;
+        emitter.emitRouteDeclared({
+          routeId,
+          httpMethod,
+          routePath: fullRoute,
+          handlerType: "Express",
+          handlerName: `${httpMethod.toLowerCase()}:${fullRoute}`,
+          filePath,
+          startLine: call.getStartLineNumber()
+        });
+        emitter.emitEndpointMetadata({
+          routeId,
+          operationId: null,
+          tags: [],
+          summary: null,
+          responseTypes: [],
+          requiresAuth: false,
+          producesProblems: false
+        });
+      }
+    }
+  }
+  /** Resolve an array expression (literal or a const-bound identifier) to its string elements. */
+  resolveStringArray(node) {
+    let arr = node;
+    if (node?.getKind?.() === import_ts_morph2.SyntaxKind.Identifier) {
+      const decls = node.getSymbol?.()?.getDeclarations?.() ?? [];
+      for (const d of decls) {
+        if (d.getKind?.() === import_ts_morph2.SyntaxKind.VariableDeclaration) {
+          const init = d.getInitializer?.();
+          if (init?.getKind?.() === import_ts_morph2.SyntaxKind.ArrayLiteralExpression) {
+            arr = init;
+            break;
+          }
+        }
+      }
+    }
+    if (arr?.getKind?.() !== import_ts_morph2.SyntaxKind.ArrayLiteralExpression) return [];
+    const out = [];
+    for (const el of arr.getElements?.() ?? []) {
+      const s = this.extractStringLiteral(el);
+      if (s !== null) out.push(s);
+    }
+    return out;
+  }
   extractStringLiteral(node) {
     const text = node.getText();
     if (text.startsWith("'") && text.endsWith("'") || text.startsWith('"') && text.endsWith('"')) {
@@ -295388,6 +295498,7 @@ var DataAccessOperationExtractor = class _DataAccessOperationExtractor {
     if (paramFlows.length > 0) {
       this.applyParameterFlows(steps, paramFlows);
     }
+    steps.push(...this.extractGuards(method, steps.length + 1));
     const payload = {
       operationId: `dao:${filePath}:${line}`,
       callerSymbol,
@@ -295414,6 +295525,7 @@ var DataAccessOperationExtractor = class _DataAccessOperationExtractor {
     const steps = this.extractSteps(ormCalls, filePath);
     const semanticKind = this.inferSemanticKind(steps);
     const targetEntity = this.inferTargetEntity(ormCalls);
+    steps.push(...this.extractGuards(func, steps.length + 1));
     const returnType = func.getReturnType()?.getText() ?? null;
     const returnsCollection = returnType ? /\[\]|Array/.test(returnType) : null;
     const transactionScope = this.detectFunctionTransactionScope(func);
@@ -295442,6 +295554,7 @@ var DataAccessOperationExtractor = class _DataAccessOperationExtractor {
     const steps = this.extractSteps(ormCalls, filePath);
     const semanticKind = this.inferSemanticKind(steps);
     const targetEntity = this.inferTargetEntity(ormCalls);
+    steps.push(...this.extractGuards(arrow, steps.length + 1));
     const payload = {
       operationId: `dao:${filePath}:${line}`,
       callerSymbol: name,
@@ -295495,6 +295608,39 @@ var DataAccessOperationExtractor = class _DataAccessOperationExtractor {
     }
     return steps;
   }
+  // ── Guard extraction (Phase 1.5: feeds HXL invariants) ────────────
+  // Capture `if (cond) throw|return` early-exit guards inside a data-access
+  // body as guard steps carrying the condition text. The deriver lowers each
+  // predicateExpression through HXL into a static invariant.
+  extractGuards(node, startOrder) {
+    const out = [];
+    let order = startOrder;
+    let ifs = [];
+    try {
+      ifs = node.getDescendantsOfKind(import_ts_morph6.SyntaxKind.IfStatement);
+    } catch {
+      return out;
+    }
+    for (const ifStmt of ifs) {
+      const then = ifStmt.getThenStatement?.();
+      if (!then) continue;
+      const stmts = then.getKind?.() === import_ts_morph6.SyntaxKind.Block ? then.getStatements() : [then];
+      const exit = stmts.find(
+        (s) => s.getKind() === import_ts_morph6.SyntaxKind.ThrowStatement || s.getKind() === import_ts_morph6.SyntaxKind.ReturnStatement
+      );
+      if (!exit) continue;
+      const cond = ifStmt.getExpression?.()?.getText?.();
+      if (!cond) continue;
+      const isThrow = exit.getKind() === import_ts_morph6.SyntaxKind.ThrowStatement;
+      let thrown = null;
+      if (isThrow) {
+        const e = exit.getExpression?.();
+        thrown = e ? e.getText() : null;
+      }
+      out.push({ order: order++, kind: "guard", predicateExpression: cond, throwsOnFail: isThrow, sourceExpression: thrown });
+    }
+    return out;
+  }
   mapMethodToStep(method, call, order, filePath) {
     const args = call.getArguments();
     const firstArgText = args.length > 0 ? args[0].getText() : null;
@@ -298112,6 +298258,169 @@ var SqlObjectDeclaredExtractor = class {
   }
 };
 
+// src/extractors/validation-schema.ts
+init_esm_shims();
+var import_ts_morph18 = __toESM(require_ts_morph(), 1);
+var ValidationSchemaExtractor = class {
+  async extract(sourceFiles, emitter) {
+    const seen = /* @__PURE__ */ new Set();
+    for (const sf of sourceFiles) {
+      const filePath = sf.getFilePath();
+      const calls = sf.getDescendantsOfKind(import_ts_morph18.SyntaxKind.CallExpression);
+      for (const call of calls) {
+        const exprText = call.getExpression().getText();
+        if (exprText !== "z.object" && exprText !== "zod.object") continue;
+        const args = call.getArguments();
+        if (args.length === 0 || args[0].getKind() !== import_ts_morph18.SyntaxKind.ObjectLiteralExpression) continue;
+        const schemaName = this.resolveSchemaName(call);
+        const obj = args[0];
+        for (const prop of obj.getProperties()) {
+          if (prop.getKind() !== import_ts_morph18.SyntaxKind.PropertyAssignment) continue;
+          const fieldName = prop.getName?.();
+          const init = prop.getInitializer?.();
+          if (!fieldName || !init) continue;
+          const parsed = this.parseZodChain(init);
+          if (!parsed) continue;
+          const line = prop.getStartLineNumber();
+          for (const r of parsed.rules) {
+            const ruleId = `${schemaName}:${fieldName}:${r.rule}:${r.arg ?? ""}`;
+            if (seen.has(ruleId)) continue;
+            seen.add(ruleId);
+            emitter.emitValidationRuleObserved({
+              ruleId,
+              schemaName,
+              fieldName,
+              fieldType: parsed.baseType,
+              rule: r.rule,
+              arg: r.arg,
+              framework: "zod",
+              filePath,
+              line
+            });
+          }
+        }
+      }
+    }
+  }
+  /** Walk up to the VariableDeclaration holding the z.object, for a schema name. */
+  resolveSchemaName(call) {
+    let node = call;
+    for (let i = 0; i < 8 && node; i++) {
+      node = node.getParent?.();
+      if (node?.getKind?.() === import_ts_morph18.SyntaxKind.VariableDeclaration) {
+        return node.getName?.() ?? "<anonymous>";
+      }
+    }
+    return "<anonymous>";
+  }
+  /** Peel a zod method chain into a base type + ordered rules. */
+  parseZodChain(node) {
+    const rules = [];
+    let baseType = "unknown";
+    let cur = node;
+    for (let guard = 0; guard < 50 && cur; guard++) {
+      if (cur.getKind?.() !== import_ts_morph18.SyntaxKind.CallExpression) break;
+      const callExpr = cur.getExpression?.();
+      if (!callExpr || callExpr.getKind() !== import_ts_morph18.SyntaxKind.PropertyAccessExpression) break;
+      const method = callExpr.getName();
+      const obj = callExpr.getExpression();
+      const objText = obj.getText?.();
+      if (obj.getKind() === import_ts_morph18.SyntaxKind.Identifier && (objText === "z" || objText === "zod")) {
+        baseType = method;
+        break;
+      }
+      const args = cur.getArguments?.() ?? [];
+      const arg = args.length > 0 ? args[0].getText().replace(/_/g, "") : null;
+      rules.push({ rule: method, arg });
+      cur = obj;
+    }
+    rules.reverse();
+    return { baseType, rules };
+  }
+};
+
+// src/extractors/method-logic.ts
+init_esm_shims();
+var import_ts_morph19 = __toESM(require_ts_morph(), 1);
+var MethodLogicExtractor = class {
+  async extract(sourceFiles, emitter) {
+    for (const sf of sourceFiles) {
+      const filePath = sf.getFilePath();
+      const seen = /* @__PURE__ */ new Set();
+      for (const ifStmt of sf.getDescendantsOfKind(import_ts_morph19.SyntaxKind.IfStatement)) {
+        const then = ifStmt.getThenStatement();
+        if (!then) continue;
+        const stmts = then.getKind() === import_ts_morph19.SyntaxKind.Block ? then.getStatements() : [then];
+        const exit = stmts.find(
+          (s) => s.getKind() === import_ts_morph19.SyntaxKind.ThrowStatement || s.getKind() === import_ts_morph19.SyntaxKind.ReturnStatement
+        );
+        if (!exit) continue;
+        const cond = ifStmt.getExpression()?.getText();
+        if (!cond) continue;
+        const isThrow = exit.getKind() === import_ts_morph19.SyntaxKind.ThrowStatement;
+        const container = this.containerOf(ifStmt);
+        const line = ifStmt.getStartLineNumber();
+        const logicId = `${container}:guard:${line}`;
+        if (seen.has(logicId)) continue;
+        seen.add(logicId);
+        emitter.emitMethodLogicObserved({
+          logicId,
+          containerSymbol: container,
+          kind: "guard",
+          expression: cond,
+          effect: isThrow ? "throw" : "return",
+          throwsType: isThrow ? exit.getExpression?.()?.getText() ?? null : null,
+          filePath,
+          line
+        });
+      }
+      for (const ret of sf.getDescendantsOfKind(import_ts_morph19.SyntaxKind.ReturnStatement)) {
+        const expr = ret.getExpression();
+        if (!expr) continue;
+        const k = expr.getKind();
+        if (k !== import_ts_morph19.SyntaxKind.BinaryExpression && k !== import_ts_morph19.SyntaxKind.ConditionalExpression) continue;
+        const container = this.containerOf(ret);
+        const line = ret.getStartLineNumber();
+        const logicId = `${container}:return:${line}`;
+        if (seen.has(logicId)) continue;
+        seen.add(logicId);
+        emitter.emitMethodLogicObserved({
+          logicId,
+          containerSymbol: container,
+          kind: "return",
+          expression: expr.getText(),
+          effect: null,
+          throwsType: null,
+          filePath,
+          line
+        });
+      }
+    }
+  }
+  /** Resolve the qualified symbol of the enclosing function/method. */
+  containerOf(node) {
+    let n = node;
+    for (let i = 0; i < 30 && n; i++) {
+      n = n.getParent?.();
+      if (!n) break;
+      const k = n.getKind?.();
+      if (k === import_ts_morph19.SyntaxKind.MethodDeclaration) {
+        const cls = n.getFirstAncestorByKind?.(import_ts_morph19.SyntaxKind.ClassDeclaration);
+        const clsName = cls?.getName?.() ?? "<anon>";
+        return `${clsName}.${n.getName?.() ?? "<anon>"}`;
+      }
+      if (k === import_ts_morph19.SyntaxKind.FunctionDeclaration) {
+        return n.getName?.() ?? "<anon>";
+      }
+      if (k === import_ts_morph19.SyntaxKind.ArrowFunction || k === import_ts_morph19.SyntaxKind.FunctionExpression) {
+        const vd = n.getFirstAncestorByKind?.(import_ts_morph19.SyntaxKind.VariableDeclaration);
+        if (vd) return vd.getName?.() ?? "<anon>";
+      }
+    }
+    return "<module>";
+  }
+};
+
 // src/extractors/swift-api-calls.ts
 init_esm_shims();
 var SwiftApiCallExtractor = class {
@@ -373173,13 +373482,13 @@ function emitProgress(event) {
 }
 function createProject(projectPath) {
   if (projectPath.endsWith("tsconfig.json")) {
-    return new import_ts_morph18.Project({ tsConfigFilePath: projectPath });
+    return new import_ts_morph20.Project({ tsConfigFilePath: projectPath });
   }
   const tsconfigPath = resolve2(projectPath, "tsconfig.json");
   if (existsSync3(tsconfigPath)) {
-    return new import_ts_morph18.Project({ tsConfigFilePath: tsconfigPath });
+    return new import_ts_morph20.Project({ tsConfigFilePath: tsconfigPath });
   }
-  const project = new import_ts_morph18.Project({
+  const project = new import_ts_morph20.Project({
     compilerOptions: {
       allowJs: true,
       checkJs: false,
@@ -373223,6 +373532,8 @@ async function runExtractors(sourceFiles, emitter) {
     new EventConsumedExtractor(),
     new ExternalServiceCallExtractor(),
     new SqlObjectDeclaredExtractor(),
+    new ValidationSchemaExtractor(),
+    new MethodLogicExtractor(),
     // Frontend / UI extractors
     new ComponentExtractor(),
     new ClientRouteExtractor(),

package/dist/index.js

@@ -5,8 +5,8 @@ import {
   formatText,
   generateFindings,
   runScan
-} from "./chunk-RPI2K62L.js";
-import "./chunk-74ZJFYEM.js";
+} from "./chunk-BOGC5GYS.js";
+import "./chunk-5IXVOEZN.js";
 import "./chunk-C7LU6YIL.js";
 import "./chunk-JSBRDJBE.js";
 export {

package/dist/{semver-JBJZTHUX.js → semver-2FJFIYVN.js}

@@ -1,5 +1,5 @@
 import {
   require_semver
-} from "./chunk-74ZJFYEM.js";
+} from "./chunk-5IXVOEZN.js";
 import "./chunk-JSBRDJBE.js";
 export default require_semver();

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@vibgrate/cli",
-  "version": "2026.613.1",
+  "version": "2026.615.2",
   "description": "CLI for measuring upgrade drift across Node, .NET, Python & Java projects",
   "type": "module",
   "bin": {
@@ -47,11 +47,11 @@
   "license": "SEE LICENSE IN LICENSE",
   "homepage": "https://vibgrate.com",
   "devDependencies": {
-    "@types/node": "^25.9.2",
+    "@types/node": "^25.9.3",
     "@types/semver": "^7.5.0",
-    "eslint": "^9.0.0",
-    "fast-xml-parser": "^4.3.0",
-    "semver": "^7.6.0",
+    "eslint": "^10.5.0",
+    "fast-xml-parser": "^5.9.0",
+    "semver": "^7.8.4",
     "tsup": "^8.0.0",
     "tsx": "^4.22.4",
     "vitest": "^2.0.0"