@vibgrate/cli 2026.615.3 → 2026.617.1

package/dist/cli.js

@@ -6,7 +6,7 @@ import {
   pathExists,
   readJsonFile,
   writeTextFile
-} from "./chunk-7343XMW2.js";
+} from "./chunk-LWB7JBWP.js";
 import {
   computeRepoFingerprint,
   detectVcs,
@@ -16,7 +16,7 @@ import {
   resolveRepositoryName,
   runScan,
   writeDefaultConfig
-} from "./chunk-4G4YRE6K.js";
+} from "./chunk-BMLE722B.js";
 import {
   require_semver
 } from "./chunk-5IXVOEZN.js";
@@ -29,8 +29,8 @@ import {
 } from "./chunk-JSBRDJBE.js";
 
 // src/cli.ts
-import { Command as Command11 } from "commander";
-import chalk12 from "chalk";
+import { Command as Command13 } from "commander";
+import chalk14 from "chalk";
 
 // src/commands/init.ts
 import * as path from "path";
@@ -49,7 +49,7 @@ var initCommand = new Command("init").description("Initialize vibgrate in a proj
     console.log(chalk.green("\u2714") + ` Created ${chalk.bold("vibgrate.config.ts")}`);
   }
   if (opts.baseline) {
-    const { runBaseline } = await import("./baseline-OK4HC3QV.js");
+    const { runBaseline } = await import("./baseline-K2GQA6G5.js");
     await runBaseline(rootDir);
   }
   console.log("");
@@ -60,7 +60,7 @@ var initCommand = new Command("init").description("Initialize vibgrate in a proj
 });
 
 // src/commands/scan.ts
-import * as path3 from "path";
+import * as path4 from "path";
 import { Command as Command3 } from "commander";
 import chalk3 from "chalk";
 
@@ -210,6 +210,49 @@ dsnCommand.command("create").description("Create a new DSN token").option("--ing
   }
 });
 
+// src/credentials.ts
+import * as os from "os";
+import * as path3 from "path";
+import * as fs from "fs";
+function credentialsDir() {
+  return path3.join(os.homedir(), ".vibgrate");
+}
+function credentialsPath() {
+  return path3.join(credentialsDir(), "credentials.json");
+}
+function readStoredCredentials() {
+  try {
+    const raw = fs.readFileSync(credentialsPath(), "utf8");
+    const parsed = JSON.parse(raw);
+    return parsed && typeof parsed.dsn === "string" && parsed.dsn ? parsed : null;
+  } catch {
+    return null;
+  }
+}
+function writeStoredCredentials(creds) {
+  const dir = credentialsDir();
+  fs.mkdirSync(dir, { recursive: true });
+  const file = credentialsPath();
+  fs.writeFileSync(file, JSON.stringify(creds, null, 2) + "\n", "utf8");
+  try {
+    fs.chmodSync(file, 384);
+  } catch {
+  }
+}
+function clearStoredCredentials() {
+  try {
+    fs.rmSync(credentialsPath());
+    return true;
+  } catch {
+    return false;
+  }
+}
+function resolveDsn(explicitDsn) {
+  if (explicitDsn) return explicitDsn;
+  if (process.env.VIBGRATE_DSN) return process.env.VIBGRATE_DSN;
+  return readStoredCredentials()?.dsn ?? void 0;
+}
+
 // src/utils/ingest-id-output.ts
 function emitIngestIdLine(ingestId, options) {
   console.log(`VIBGRATE_INGEST_ID=${ingestId}`);
@@ -220,10 +263,10 @@ function emitIngestIdLine(ingestId, options) {
 
 // src/commands/scan.ts
 async function autoPush(artifact, rootDir, opts) {
-  const dsn = opts.dsn || process.env.VIBGRATE_DSN;
+  const dsn = resolveDsn(opts.dsn);
   if (!dsn) {
     console.error(chalk3.red("No DSN provided for push."));
-    console.error(chalk3.dim("Set VIBGRATE_DSN environment variable or use --dsn flag."));
+    console.error(chalk3.dim('Run "vibgrate login", set VIBGRATE_DSN, or use the --dsn flag.'));
     if (opts.strict) process.exit(1);
     return;
   }
@@ -320,15 +363,15 @@ var scanCommand = new Command3("scan").description("Scan a project for upgrade d
   collectExcludes,
   []
 ).option("--concurrency <n>", "Max concurrent npm calls", "8").option("--push", "Auto-push results to Vibgrate API after scan").option("--dsn <dsn>", "DSN token for push (or use VIBGRATE_DSN env)").option("--region <region>", "Override data residency region for push (us, eu)").option("--strict", "Fail on push errors").option("--ui-purpose", "Enable optional UI purpose evidence extraction (slower)").option("--no-local-artifacts", "Do not write .vibgrate JSON artifacts to disk").option("--max-privacy", "Enable strongest privacy mode (minimal scanners, no local artifacts)").option("--offline", "Run without network calls; do not upload results").option("--package-manifest <file>", "Use local package-version manifest JSON/ZIP (for offline mode)").option("--project-scan-timeout <seconds>", "Per-project scan timeout in seconds (default: 180)").option("--drift-budget <score>", "Fail if drift score is above budget (0-100)").option("--drift-worsening <percent>", "Fail if drift worsens by more than % since baseline").action(async (targetPath, opts) => {
-  const rootDir = path3.resolve(targetPath);
+  const rootDir = path4.resolve(targetPath);
   if (!await pathExists2(rootDir)) {
     console.error(chalk3.red(`Path does not exist: ${rootDir}`));
     process.exit(1);
   }
-  const hasDsn = !!(opts.dsn || process.env.VIBGRATE_DSN);
+  const hasDsn = !!resolveDsn(opts.dsn);
   const willPush = !opts.offline && (opts.push || hasDsn);
   if (willPush && hasDsn) {
-    const dsn = opts.dsn || process.env.VIBGRATE_DSN;
+    const dsn = resolveDsn(opts.dsn);
     const parsed = parseDsn(dsn);
     if (parsed) {
       const ingestHost = opts.region ? resolveIngestHost(opts.region) : parsed.host;
@@ -340,6 +383,15 @@ var scanCommand = new Command3("scan").description("Scan a project for upgrade d
           repositoryName,
           vcsSha: fingerprint.vcsSha
         });
+        if (preflight.vm && !preflight.vm.allowed) {
+          console.error(chalk3.red(preflight.error ?? "VM meter usage exhausted"));
+          console.error(
+            chalk3.dim(
+              `VM minutes: ${preflight.vm.used}/${preflight.vm.limit} (${preflight.plan.label} plan) \u2014 enable overages or upgrade your plan.`
+            )
+          );
+          process.exit(1);
+        }
         if (preflight.status === "error" || !preflight.scans.allowed) {
           console.error(chalk3.red(preflight.error ?? "Scan ingestion not allowed for this workspace."));
           console.error(
@@ -440,7 +492,7 @@ Failing fitness function: drift worsened by ${worseningPercent.toFixed(2)}% (thr
 });
 
 // src/commands/report.ts
-import * as path4 from "path";
+import * as path5 from "path";
 import { Command as Command4 } from "commander";
 import chalk5 from "chalk";
 
@@ -1157,7 +1209,7 @@ function formatMarkdown(artifact) {
 
 // src/commands/report.ts
 var reportCommand = new Command4("report").description("Generate a drift report from a scan artifact").option("--in <file>", "Input artifact file", ".vibgrate/scan_result.json").option("--format <format>", "Output format (md|text|json)", "text").action(async (opts) => {
-  const artifactPath = path4.resolve(opts.in);
+  const artifactPath = path5.resolve(opts.in);
   if (!await pathExists(artifactPath)) {
     console.error(chalk5.red(`Artifact not found: ${artifactPath}`));
     console.error(chalk5.dim('Run "vibgrate scan" first to generate a scan artifact.'));
@@ -1178,12 +1230,146 @@ var reportCommand = new Command4("report").description("Generate a drift report
   }
 });
 
-// src/commands/push.ts
-import * as crypto2 from "crypto";
-import * as path5 from "path";
+// src/commands/login.ts
 import { Command as Command5 } from "commander";
 import chalk6 from "chalk";
 
+// src/utils/open-url.ts
+import { spawn } from "child_process";
+function openUrl(url) {
+  const platform = process.platform;
+  let command;
+  let args;
+  if (platform === "darwin") {
+    command = "open";
+    args = [url];
+  } else if (platform === "win32") {
+    command = "cmd";
+    args = ["/c", "start", "", url];
+  } else {
+    command = "xdg-open";
+    args = [url];
+  }
+  try {
+    const child = spawn(command, args, { stdio: "ignore", detached: true });
+    child.on("error", () => {
+    });
+    child.unref();
+    return true;
+  } catch {
+    return false;
+  }
+}
+
+// src/commands/login.ts
+var delay = (ms) => new Promise((resolve10) => setTimeout(resolve10, ms));
+var loginCommand = new Command5("login").description("Authenticate the CLI with your Vibgrate workspace via the browser").option("--ingest <url>", "Ingest API URL (overrides --region)").option("--region <region>", `Data residency region (${availableRegionIds().join(", ")})`, "us").option("--no-browser", "Do not attempt to open a browser automatically").action(async (opts) => {
+  let ingestHost;
+  try {
+    ingestHost = resolveIngestHost(opts.region, opts.ingest);
+  } catch (e) {
+    console.error(chalk6.red(e instanceof Error ? e.message : String(e)));
+    process.exit(1);
+  }
+  const base = `https://${ingestHost}/v1/auth/device`;
+  let start;
+  try {
+    const res = await fetch(`${base}/start`, {
+      method: "POST",
+      headers: { "Content-Type": "application/json", Connection: "close" },
+      body: "{}"
+    });
+    if (!res.ok) {
+      console.error(chalk6.red(`Failed to start login (HTTP ${res.status}).`));
+      process.exit(1);
+    }
+    start = await res.json();
+  } catch (e) {
+    console.error(chalk6.red(`Could not reach ${ingestHost}: ${e instanceof Error ? e.message : String(e)}`));
+    process.exit(1);
+  }
+  console.log("");
+  console.log("To finish signing in, open this URL and approve the request:");
+  console.log("");
+  console.log("  " + chalk6.cyan(start.verificationUri));
+  console.log("");
+  console.log("  Your code: " + chalk6.bold(start.userCode));
+  console.log("");
+  if (opts.browser) {
+    const opened = openUrl(start.verificationUriComplete);
+    if (opened) {
+      console.log(chalk6.dim("Opening your browser\u2026 (if it does not open, use the URL above)"));
+    }
+  }
+  console.log(chalk6.dim("Waiting for approval\u2026"));
+  const intervalMs = Math.max(2, start.interval || 5) * 1e3;
+  const deadline = Date.now() + (start.expiresIn || 900) * 1e3;
+  while (Date.now() < deadline) {
+    await delay(intervalMs);
+    let token;
+    try {
+      const res = await fetch(`${base}/token`, {
+        method: "POST",
+        headers: { "Content-Type": "application/json", Connection: "close" },
+        body: JSON.stringify({ deviceCode: start.deviceCode })
+      });
+      token = await res.json();
+    } catch {
+      continue;
+    }
+    if (token.status === "authorization_pending") continue;
+    if (token.status === "complete" && token.dsn) {
+      writeStoredCredentials({
+        dsn: token.dsn,
+        workspaceId: token.workspaceId,
+        keyId: token.keyId,
+        ingestHost: token.ingestHost ?? ingestHost,
+        savedAt: (/* @__PURE__ */ new Date()).toISOString()
+      });
+      console.log("");
+      console.log(chalk6.green("\u2714") + " Logged in.");
+      if (token.workspaceId) {
+        console.log("  Workspace: " + chalk6.bold(token.workspaceId));
+      }
+      console.log(chalk6.dim(`  Credentials saved to ${credentialsPath()}`));
+      console.log(chalk6.dim('  You can now run "vibgrate scan --push".'));
+      return;
+    }
+    if (token.status === "access_denied") {
+      console.error(chalk6.red("\u2716 Login was denied in the browser."));
+      process.exit(1);
+    }
+    if (token.status === "expired" || token.status === "invalid") {
+      console.error(chalk6.red('\u2716 Login request expired. Run "vibgrate login" again.'));
+      process.exit(1);
+    }
+    if (token.status === "error") {
+      console.error(chalk6.red(`\u2716 ${token.error ?? "Login failed."}`));
+      process.exit(1);
+    }
+  }
+  console.error(chalk6.red('\u2716 Timed out waiting for approval. Run "vibgrate login" again.'));
+  process.exit(1);
+});
+
+// src/commands/logout.ts
+import { Command as Command6 } from "commander";
+import chalk7 from "chalk";
+var logoutCommand = new Command6("logout").description("Clear stored Vibgrate login credentials").action(() => {
+  const cleared = clearStoredCredentials();
+  if (cleared) {
+    console.log(chalk7.green("\u2714") + " Logged out. Stored credentials removed.");
+  } else {
+    console.log(chalk7.dim(`No stored credentials found at ${credentialsPath()}.`));
+  }
+});
+
+// src/commands/push.ts
+import * as crypto2 from "crypto";
+import * as path6 from "path";
+import { Command as Command7 } from "commander";
+import chalk8 from "chalk";
+
 // src/utils/compact-artifact.ts
 import * as zlib from "zlib";
 import { promisify } from "util";
@@ -1454,25 +1640,25 @@ function parseDsn2(dsn) {
 function computeHmac(body, secret) {
   return crypto2.createHmac("sha256", secret).update(body).digest("base64");
 }
-var pushCommand = new Command5("push").description("Push scan results to Vibgrate API").option("--dsn <dsn>", "DSN token (or use VIBGRATE_DSN env)").option("--region <region>", `Override data residency region (${availableRegionIds().join(", ")})`).option("--file <file>", "Scan artifact file", ".vibgrate/scan_result.json").option("--strict", "Fail on upload errors").action(async (opts) => {
-  const dsn = opts.dsn || process.env.VIBGRATE_DSN;
+var pushCommand = new Command7("push").description("Push scan results to Vibgrate API").option("--dsn <dsn>", "DSN token (or use VIBGRATE_DSN env)").option("--region <region>", `Override data residency region (${availableRegionIds().join(", ")})`).option("--file <file>", "Scan artifact file", ".vibgrate/scan_result.json").option("--strict", "Fail on upload errors").action(async (opts) => {
+  const dsn = resolveDsn(opts.dsn);
   if (!dsn) {
-    console.error(chalk6.red("No DSN provided."));
-    console.error(chalk6.dim("Set VIBGRATE_DSN environment variable or use --dsn flag."));
+    console.error(chalk8.red("No DSN provided."));
+    console.error(chalk8.dim('Run "vibgrate login", set VIBGRATE_DSN, or use the --dsn flag.'));
     if (opts.strict) process.exit(1);
     return;
   }
   const parsed = parseDsn2(dsn);
   if (!parsed) {
-    console.error(chalk6.red("Invalid DSN format."));
-    console.error(chalk6.dim("Expected: vibgrate+https://<key_id>:<secret>@<host>/<workspace_id>"));
+    console.error(chalk8.red("Invalid DSN format."));
+    console.error(chalk8.dim("Expected: vibgrate+https://<key_id>:<secret>@<host>/<workspace_id>"));
     if (opts.strict) process.exit(1);
     return;
   }
-  const filePath = path5.resolve(opts.file);
+  const filePath = path6.resolve(opts.file);
   if (!await pathExists(filePath)) {
-    console.error(chalk6.red(`Scan artifact not found: ${filePath}`));
-    console.error(chalk6.dim('Run "vibgrate scan" first.'));
+    console.error(chalk8.red(`Scan artifact not found: ${filePath}`));
+    console.error(chalk8.dim('Run "vibgrate scan" first.'));
     if (opts.strict) process.exit(1);
     return;
   }
@@ -1484,7 +1670,7 @@ var pushCommand = new Command5("push").description("Push scan results to Vibgrat
     try {
       host = resolveIngestHost(opts.region);
     } catch (e) {
-      console.error(chalk6.red(e instanceof Error ? e.message : String(e)));
+      console.error(chalk8.red(e instanceof Error ? e.message : String(e)));
       if (opts.strict) process.exit(1);
       return;
     }
@@ -1493,7 +1679,7 @@ var pushCommand = new Command5("push").description("Push scan results to Vibgrat
   const originalSize = JSON.stringify(artifact).length;
   const compressedSize = body.length;
   const ratio = ((1 - compressedSize / originalSize) * 100).toFixed(0);
-  console.log(chalk6.dim(`Uploading to ${host}... (${(compressedSize / 1024).toFixed(0)} KB, ${ratio}% smaller)`));
+  console.log(chalk8.dim(`Uploading to ${host}... (${(compressedSize / 1024).toFixed(0)} KB, ${ratio}% smaller)`));
   try {
     const response = await fetch(url, {
       method: "POST",
@@ -1512,36 +1698,36 @@ var pushCommand = new Command5("push").description("Push scan results to Vibgrat
       throw new Error(`HTTP ${response.status}: ${text}`);
     }
     const result = await response.json();
-    console.log(chalk6.green("\u2714") + ` Scan queued for processing (${result.ingestId ?? "ok"})`);
+    console.log(chalk8.green("\u2714") + ` Scan queued for processing (${result.ingestId ?? "ok"})`);
     console.log();
-    console.log(chalk6.dim("Processing continues in the background. Results available shortly."));
+    console.log(chalk8.dim("Processing continues in the background. Results available shortly."));
     console.log();
     if (result.ingestId) {
       const dashHost = dashHostForIngestHost(host);
       const reportUrl = `https://${dashHost}/${parsed.workspaceId}/scan/${result.ingestId}`;
-      console.log(chalk6.dim("View report: ") + chalk6.underline(reportUrl));
+      console.log(chalk8.dim("View report: ") + chalk8.underline(reportUrl));
     }
   } catch (e) {
     const msg = e instanceof Error ? e.message : String(e);
-    console.error(chalk6.red(`Upload failed: ${msg}`));
+    console.error(chalk8.red(`Upload failed: ${msg}`));
     if (opts.strict) process.exit(1);
   }
 });
 
 // src/commands/update.ts
 import { execSync } from "child_process";
-import * as path7 from "path";
-import { Command as Command6 } from "commander";
-import chalk7 from "chalk";
+import * as path8 from "path";
+import { Command as Command8 } from "commander";
+import chalk9 from "chalk";
 
 // src/utils/update-check.ts
 var import_semver = __toESM(require_semver(), 1);
-import * as fs from "fs/promises";
-import * as path6 from "path";
-import * as os from "os";
+import * as fs2 from "fs/promises";
+import * as path7 from "path";
+import * as os2 from "os";
 var REGISTRY_URL = "https://registry.npmjs.org/@vibgrate%2fcli/latest";
-var CACHE_DIR = path6.join(os.homedir(), ".vibgrate");
-var CACHE_FILE = path6.join(CACHE_DIR, "update-check.json");
+var CACHE_DIR = path7.join(os2.homedir(), ".vibgrate");
+var CACHE_FILE = path7.join(CACHE_DIR, "update-check.json");
 var CHECK_INTERVAL_MS = 12 * 60 * 60 * 1e3;
 async function checkForUpdate() {
   try {
@@ -1605,7 +1791,7 @@ async function fetchLatestVersion() {
 }
 async function readCache() {
   try {
-    const raw = await fs.readFile(CACHE_FILE, "utf-8");
+    const raw = await fs2.readFile(CACHE_FILE, "utf-8");
     const data = JSON.parse(raw);
     if (data.latest && typeof data.checkedAt === "number") return data;
     return null;
@@ -1615,8 +1801,8 @@ async function readCache() {
 }
 async function writeCache(data) {
   try {
-    await fs.mkdir(CACHE_DIR, { recursive: true });
-    await fs.writeFile(CACHE_FILE, JSON.stringify(data), "utf-8");
+    await fs2.mkdir(CACHE_DIR, { recursive: true });
+    await fs2.writeFile(CACHE_FILE, JSON.stringify(data), "utf-8");
   } catch {
   }
 }
@@ -1649,9 +1835,9 @@ function getGlobalUpdateCommand(pm, pkg2, version) {
   }
 }
 async function detectPackageManager(cwd) {
-  if (await pathExists(path7.join(cwd, "pnpm-lock.yaml"))) return "pnpm";
-  if (await pathExists(path7.join(cwd, "bun.lockb"))) return "bun";
-  if (await pathExists(path7.join(cwd, "yarn.lock"))) return "yarn";
+  if (await pathExists(path8.join(cwd, "pnpm-lock.yaml"))) return "pnpm";
+  if (await pathExists(path8.join(cwd, "bun.lockb"))) return "bun";
+  if (await pathExists(path8.join(cwd, "yarn.lock"))) return "yarn";
   return "npm";
 }
 function getInstallCommand(pm, pkg2, version, isDev) {
@@ -1670,7 +1856,7 @@ function getInstallCommand(pm, pkg2, version, isDev) {
 }
 async function isDevDependency(cwd) {
   try {
-    const pkgPath = path7.join(cwd, "package.json");
+    const pkgPath = path8.join(cwd, "package.json");
     const raw = await (await import("fs/promises")).readFile(pkgPath, "utf-8");
     const pkg2 = JSON.parse(raw);
     return Boolean(pkg2.devDependencies?.["@vibgrate/cli"]);
@@ -1678,22 +1864,22 @@ async function isDevDependency(cwd) {
     return true;
   }
 }
-var updateCommand = new Command6("update").description("Update vibgrate to the latest version").option("--check", "Only check for updates, do not install").option("--pm <manager>", "Package manager to use (npm, pnpm, yarn, bun)").option("--global", "Update global installation").action(async (opts) => {
-  console.log(chalk7.dim(`Current version: ${VERSION}`));
-  console.log(chalk7.dim("Checking npm registry..."));
+var updateCommand = new Command8("update").description("Update vibgrate to the latest version").option("--check", "Only check for updates, do not install").option("--pm <manager>", "Package manager to use (npm, pnpm, yarn, bun)").option("--global", "Update global installation").action(async (opts) => {
+  console.log(chalk9.dim(`Current version: ${VERSION}`));
+  console.log(chalk9.dim("Checking npm registry..."));
   const latest = await fetchLatestVersion();
   if (!latest) {
-    console.error(chalk7.red("Could not reach the npm registry. Check your network connection."));
+    console.error(chalk9.red("Could not reach the npm registry. Check your network connection."));
     process.exit(1);
   }
   const semver2 = await import("./semver-2FJFIYVN.js");
   if (!semver2.gt(latest, VERSION)) {
-    console.log(chalk7.green("\u2714") + ` You are on the latest version (${VERSION}).`);
+    console.log(chalk9.green("\u2714") + ` You are on the latest version (${VERSION}).`);
     return;
   }
-  console.log(chalk7.yellow(`Update available: ${VERSION} \u2192 ${latest}`));
+  console.log(chalk9.yellow(`Update available: ${VERSION} \u2192 ${latest}`));
   if (opts.check) {
-    console.log(chalk7.dim('Run "vibgrate update" to install.'));
+    console.log(chalk9.dim('Run "vibgrate update" to install.'));
     return;
   }
   const cwd = process.cwd();
@@ -1703,26 +1889,26 @@ var updateCommand = new Command6("update").description("Update vibgrate to the l
   let cmd;
   if (isGlobal) {
     cmd = getGlobalUpdateCommand(pm, "@vibgrate/cli", latest);
-    console.log(chalk7.dim(`Updating global installation with ${pm}: ${cmd}`));
+    console.log(chalk9.dim(`Updating global installation with ${pm}: ${cmd}`));
   } else {
     const isDev = await isDevDependency(cwd);
     cmd = getInstallCommand(pm, "@vibgrate/cli", latest, isDev);
-    console.log(chalk7.dim(`Using ${pm}: ${cmd}`));
+    console.log(chalk9.dim(`Using ${pm}: ${cmd}`));
   }
   try {
     execSync(cmd, { cwd, stdio: "inherit" });
-    console.log(chalk7.green("\u2714") + ` Updated to @vibgrate/cli@${latest}`);
+    console.log(chalk9.green("\u2714") + ` Updated to @vibgrate/cli@${latest}`);
   } catch {
-    console.error(chalk7.red(`Update failed. Run manually: ${cmd}`));
+    console.error(chalk9.red(`Update failed. Run manually: ${cmd}`));
     process.exit(1);
   }
 });
 
 // src/commands/sbom.ts
-import * as path8 from "path";
+import * as path9 from "path";
 import { randomUUID } from "crypto";
-import { Command as Command7 } from "commander";
-import chalk8 from "chalk";
+import { Command as Command9 } from "commander";
+import chalk10 from "chalk";
 function flattenDependencies(artifact) {
   const rows = [];
   for (const project of artifact.projects) {
@@ -1860,50 +2046,50 @@ function formatDeltaText(base, current) {
   return lines.join("\n");
 }
 async function readArtifactOrExit(filePath) {
-  const absolutePath = path8.resolve(filePath);
+  const absolutePath = path9.resolve(filePath);
   if (!await pathExists(absolutePath)) {
-    console.error(chalk8.red(`Artifact not found: ${absolutePath}`));
+    console.error(chalk10.red(`Artifact not found: ${absolutePath}`));
     process.exit(1);
   }
   return readJsonFile(absolutePath);
 }
-var exportCommand = new Command7("export").description("Export scan artifact as SBOM").option("--in <file>", "Input artifact file", ".vibgrate/scan_result.json").option("--out <file>", "Output SBOM file").option("--format <format>", "SBOM format (cyclonedx|spdx)", "cyclonedx").action(async (opts) => {
+var exportCommand = new Command9("export").description("Export scan artifact as SBOM").option("--in <file>", "Input artifact file", ".vibgrate/scan_result.json").option("--out <file>", "Output SBOM file").option("--format <format>", "SBOM format (cyclonedx|spdx)", "cyclonedx").action(async (opts) => {
   const artifact = await readArtifactOrExit(opts.in);
   const format = opts.format.toLowerCase();
   if (format !== "cyclonedx" && format !== "spdx") {
-    console.error(chalk8.red("Invalid SBOM format. Use cyclonedx or spdx."));
+    console.error(chalk10.red("Invalid SBOM format. Use cyclonedx or spdx."));
     process.exit(1);
   }
   const sbom = format === "cyclonedx" ? toCycloneDx(artifact) : toSpdx(artifact);
   const body = JSON.stringify(sbom, null, 2);
   if (opts.out) {
-    await writeTextFile(path8.resolve(opts.out), body);
-    console.log(chalk8.green("\u2714") + ` SBOM written to ${opts.out}`);
+    await writeTextFile(path9.resolve(opts.out), body);
+    console.log(chalk10.green("\u2714") + ` SBOM written to ${opts.out}`);
   } else {
     console.log(body);
   }
 });
-var deltaCommand = new Command7("delta").description("Show SBOM delta between two scan artifacts").requiredOption("--from <file>", "Baseline scan artifact path").requiredOption("--to <file>", "Current scan artifact path").option("--out <file>", "Write report to file").action(async (opts) => {
+var deltaCommand = new Command9("delta").description("Show SBOM delta between two scan artifacts").requiredOption("--from <file>", "Baseline scan artifact path").requiredOption("--to <file>", "Current scan artifact path").option("--out <file>", "Write report to file").action(async (opts) => {
   const base = await readArtifactOrExit(opts.from);
   const current = await readArtifactOrExit(opts.to);
   const report = formatDeltaText(base, current);
   if (opts.out) {
-    await writeTextFile(path8.resolve(opts.out), report);
-    console.log(chalk8.green("\u2714") + ` SBOM delta report written to ${opts.out}`);
+    await writeTextFile(path9.resolve(opts.out), report);
+    console.log(chalk10.green("\u2714") + ` SBOM delta report written to ${opts.out}`);
   } else {
     console.log(report);
   }
 });
-var sbomCommand = new Command7("sbom").description("SBOM export and delta reports for dependency drift tracking").addCommand(exportCommand).addCommand(deltaCommand);
+var sbomCommand = new Command9("sbom").description("SBOM export and delta reports for dependency drift tracking").addCommand(exportCommand).addCommand(deltaCommand);
 
 // src/commands/extract.ts
-import * as path9 from "path";
-import * as os2 from "os";
-import * as fs2 from "fs/promises";
-import { existsSync } from "fs";
-import { spawn, spawnSync } from "child_process";
-import { Command as Command8 } from "commander";
-import chalk9 from "chalk";
+import * as path12 from "path";
+import * as os4 from "os";
+import * as fs4 from "fs/promises";
+import { existsSync, rmSync as rmSync2 } from "fs";
+import { spawn as spawn3, spawnSync as spawnSync2 } from "child_process";
+import { Command as Command10 } from "commander";
+import chalk11 from "chalk";
 
 // src/behavioural/derive.ts
 import { createHash as createHash2 } from "crypto";
@@ -2756,6 +2942,303 @@ function deriveBehaviouralFacts(facts, opts) {
   return { envelopes, summary: { assertions: unique.length, surfaceFacts, assertedFacts, behaviouralConfidence } };
 }
 
+// src/utils/vcs.ts
+import * as path10 from "path";
+import * as fs3 from "fs/promises";
+async function detectVcs2(rootDir) {
+  try {
+    return await detectGit(rootDir);
+  } catch {
+    return { type: "unknown" };
+  }
+}
+async function detectGit(rootDir) {
+  const gitDir = await findGitDir(rootDir);
+  if (!gitDir) {
+    return { type: "unknown" };
+  }
+  const headPath = path10.join(gitDir, "HEAD");
+  let headContent;
+  try {
+    headContent = (await fs3.readFile(headPath, "utf8")).trim();
+  } catch {
+    return { type: "unknown" };
+  }
+  let sha;
+  let branch;
+  if (headContent.startsWith("ref: ")) {
+    const refPath = headContent.slice(5);
+    branch = refPath.startsWith("refs/heads/") ? refPath.slice(11) : refPath;
+    sha = await resolveRef(gitDir, refPath);
+  } else if (/^[0-9a-f]{40}$/i.test(headContent)) {
+    sha = headContent;
+  }
+  const remoteUrl = await readGitRemoteUrl(gitDir);
+  return {
+    type: "git",
+    sha: sha ?? void 0,
+    shortSha: sha ? sha.slice(0, 7) : void 0,
+    branch: branch ?? void 0,
+    remoteUrl
+  };
+}
+async function findGitDir(startDir) {
+  let dir = path10.resolve(startDir);
+  const root = path10.parse(dir).root;
+  while (dir !== root) {
+    const gitPath = path10.join(dir, ".git");
+    try {
+      const stat4 = await fs3.stat(gitPath);
+      if (stat4.isDirectory()) {
+        return gitPath;
+      }
+      if (stat4.isFile()) {
+        const content = (await fs3.readFile(gitPath, "utf8")).trim();
+        if (content.startsWith("gitdir: ")) {
+          const resolved = path10.resolve(dir, content.slice(8));
+          return resolved;
+        }
+      }
+    } catch {
+    }
+    dir = path10.dirname(dir);
+  }
+  return null;
+}
+async function resolveRef(gitDir, refPath) {
+  const loosePath = path10.join(gitDir, refPath);
+  try {
+    const sha = (await fs3.readFile(loosePath, "utf8")).trim();
+    if (/^[0-9a-f]{40}$/i.test(sha)) {
+      return sha;
+    }
+  } catch {
+  }
+  const packedPath = path10.join(gitDir, "packed-refs");
+  try {
+    const packed = await fs3.readFile(packedPath, "utf8");
+    for (const line of packed.split("\n")) {
+      if (line.startsWith("#") || line.startsWith("^")) continue;
+      const parts = line.trim().split(" ");
+      if (parts.length >= 2 && parts[1] === refPath) {
+        return parts[0];
+      }
+    }
+  } catch {
+  }
+  return void 0;
+}
+async function readGitRemoteUrl(gitDir) {
+  const configPath = await resolveGitConfigPath(gitDir);
+  if (!configPath) return void 0;
+  try {
+    const config = await fs3.readFile(configPath, "utf8");
+    const originBlock = config.match(/\[remote\s+"origin"\]([\s\S]*?)(?=\n\[|$)/);
+    if (!originBlock) return void 0;
+    const urlMatch = originBlock[1]?.match(/\n\s*url\s*=\s*(.+)\s*/);
+    return urlMatch?.[1]?.trim();
+  } catch {
+    return void 0;
+  }
+}
+async function resolveGitConfigPath(gitDir) {
+  const directConfig = path10.join(gitDir, "config");
+  try {
+    const stat4 = await fs3.stat(directConfig);
+    if (stat4.isFile()) return directConfig;
+  } catch {
+  }
+  const commonDirFile = path10.join(gitDir, "commondir");
+  try {
+    const commonDir = (await fs3.readFile(commonDirFile, "utf8")).trim();
+    if (!commonDir) return void 0;
+    const resolvedCommonDir = path10.resolve(gitDir, commonDir);
+    const commonConfig = path10.join(resolvedCommonDir, "config");
+    const stat4 = await fs3.stat(commonConfig);
+    if (stat4.isFile()) return commonConfig;
+  } catch {
+    return void 0;
+  }
+  return void 0;
+}
+
+// src/utils/clone.ts
+import * as path11 from "path";
+import * as os3 from "os";
+import { mkdtemp, rm } from "fs/promises";
+import { spawn as spawn2, spawnSync } from "child_process";
+var SCP_LIKE = /^[A-Za-z0-9._-]+@[A-Za-z0-9._-]+:.+$/;
+function looksLikeRepoUrl(arg) {
+  if (!arg) return false;
+  if (/^(https?|ssh|git):\/\//i.test(arg)) return true;
+  if (SCP_LIKE.test(arg)) return true;
+  return false;
+}
+function redactRemoteUrl(url) {
+  if (!url) return url;
+  if (SCP_LIKE.test(url) && !url.includes("://")) return url;
+  try {
+    const parsed = new URL(url);
+    if (parsed.username || parsed.password) {
+      parsed.username = "";
+      parsed.password = "";
+    }
+    return parsed.toString();
+  } catch {
+    return url.replace(/^([a-z]+:\/\/)[^/@]+@/i, "$1");
+  }
+}
+var CloneError = class extends Error {
+  constructor(message) {
+    super(message);
+    this.name = "CloneError";
+  }
+};
+function isGitAvailable() {
+  const result = spawnSync("git", ["--version"], { stdio: "ignore" });
+  return !result.error && result.status === 0;
+}
+function gitInstallHint() {
+  switch (process.platform) {
+    case "darwin":
+      return "Install git with: brew install git (or xcode-select --install).";
+    case "win32":
+      return "Install git with: winget install Git.Git";
+    default:
+      return "Install git via your distro package manager (e.g. apt install git).";
+  }
+}
+function runGit(args, opts) {
+  return new Promise((resolve10, reject) => {
+    const child = spawn2("git", args, {
+      stdio: ["ignore", "ignore", "pipe"],
+      // Never prompt for credentials on a private/forbidden repo — fail fast.
+      env: { ...process.env, GIT_TERMINAL_PROMPT: "0", GIT_ASKPASS: "echo" }
+    });
+    let stderr = "";
+    let killed = false;
+    const timer = setTimeout(() => {
+      killed = true;
+      child.kill("SIGKILL");
+    }, opts.timeoutMs);
+    child.stderr.on("data", (d) => {
+      if (stderr.length < 8192) stderr += scrubCredentials(String(d));
+    });
+    child.on("error", (err) => {
+      clearTimeout(timer);
+      reject(new CloneError(`Failed to run git: ${err.message}`));
+    });
+    child.on("close", (code) => {
+      clearTimeout(timer);
+      if (killed) {
+        reject(new CloneError(`git clone timed out for ${opts.redacted}`));
+        return;
+      }
+      resolve10({ code: code ?? 0, stderr: stderr.trim() });
+    });
+  });
+}
+function scrubCredentials(text) {
+  return text.replace(/([a-z]+:\/\/)[^/\s@]+@/gi, "$1");
+}
+async function cloneRepo(url, opts) {
+  const redacted = redactRemoteUrl(url);
+  if (!looksLikeRepoUrl(url)) {
+    throw new CloneError(
+      `Not a supported repository URL: ${redacted}. Use an http(s), ssh, git://, or scp-like (git@host:owner/repo.git) URL.`
+    );
+  }
+  if (/^file:\/\//i.test(url)) {
+    throw new CloneError("file:// URLs are not allowed for remote clone.");
+  }
+  if (!isGitAvailable()) {
+    throw new CloneError(`git is required to clone ${redacted} but was not found on PATH. ${gitInstallHint()}`);
+  }
+  const dir = await mkdtemp(path11.join(os3.tmpdir(), "vibgrate-hcs-clone-"));
+  const cleanup = async () => {
+    await rm(dir, { recursive: true, force: true }).catch(() => {
+    });
+  };
+  try {
+    if (opts.verbose) process.stderr.write(`Cloning ${redacted} \u2026
+`);
+    const clone = await runGit(
+      ["clone", "--depth", "1", "--quiet", "--", url, dir],
+      { timeoutMs: opts.timeoutMs, redacted }
+    );
+    if (clone.code !== 0) {
+      throw new CloneError(`git clone failed for ${redacted}: ${clone.stderr || `exit ${clone.code}`}`);
+    }
+    if (opts.ref) {
+      if (opts.verbose) process.stderr.write(`Checking out ${opts.ref} \u2026
+`);
+      const fetch2 = await runGit(
+        ["-C", dir, "fetch", "--depth", "1", "--quiet", "origin", opts.ref],
+        { timeoutMs: opts.timeoutMs, redacted }
+      );
+      const checkoutTarget = fetch2.code === 0 ? "FETCH_HEAD" : opts.ref;
+      const checkout = await runGit(
+        ["-C", dir, "checkout", "--quiet", "--detach", checkoutTarget],
+        { timeoutMs: opts.timeoutMs, redacted }
+      );
+      if (checkout.code !== 0) {
+        throw new CloneError(
+          `Could not check out ref "${opts.ref}" from ${redacted}: ${checkout.stderr || `exit ${checkout.code}`}`
+        );
+      }
+    }
+    return { dir, cleanup };
+  } catch (err) {
+    await cleanup();
+    throw err instanceof CloneError ? err : new CloneError(String(err));
+  }
+}
+
+// src/utils/scan-manifest.ts
+import * as crypto3 from "crypto";
+function computeFactContentHash(factLines) {
+  const hash = crypto3.createHash("sha256");
+  for (const line of factLines) {
+    hash.update(line);
+    hash.update("\n");
+  }
+  return `sha256:${hash.digest("hex")}`;
+}
+function deriveRepoName(remoteUrl) {
+  if (!remoteUrl) return void 0;
+  const withoutScheme = remoteUrl.replace(/^[a-z]+:\/\//i, "").replace(/^[^/@]+@/, "");
+  const pathPart = withoutScheme.replace(/^[^/:]+[/:]/, "");
+  const segments = pathPart.split("/").filter(Boolean);
+  if (segments.length === 0) return void 0;
+  const repo = segments[segments.length - 1].replace(/\.git$/i, "");
+  const owner = segments.length >= 2 ? segments[segments.length - 2] : void 0;
+  return owner ? `${owner}/${repo}` : repo;
+}
+function buildScanManifest(input) {
+  return {
+    factType: "ScanManifest",
+    manifestVersion: "1.0",
+    emittedAt: input.emittedAt ?? (/* @__PURE__ */ new Date()).toISOString(),
+    repository: {
+      remoteUrl: input.remoteUrl,
+      name: input.repositoryName ?? deriveRepoName(input.remoteUrl)
+    },
+    vcs: {
+      sha: input.sha,
+      shortSha: input.shortSha,
+      branch: input.branch,
+      ref: input.ref
+    },
+    source: input.source,
+    languages: [...input.languages].sort(),
+    scanId: input.scanId,
+    applicationId: input.applicationId,
+    vibgrateVersion: input.vibgrateVersion,
+    factCount: input.factLines.length,
+    contentHash: computeFactContentHash(input.factLines)
+  };
+}
+
 // src/commands/extract.ts
 var EXIT_SUCCESS = 0;
 var EXIT_SCHEMA_FAILURE = 1;
@@ -2840,14 +3323,14 @@ async function detectLanguages(rootDir, includeTests) {
   async function walk(dir, relBase) {
     let entries;
     try {
-      entries = await fs2.readdir(dir, { withFileTypes: true });
+      entries = await fs4.readdir(dir, { withFileTypes: true });
     } catch {
       return;
     }
     for (const entry of entries) {
       if (entry.name.startsWith(".")) continue;
-      const absPath = path9.join(dir, entry.name);
-      const relPath = path9.join(relBase, entry.name);
+      const absPath = path12.join(dir, entry.name);
+      const relPath = path12.join(relBase, entry.name);
       if (entry.isDirectory()) {
         if (!SKIP_DIRS.has(entry.name)) {
           await walk(absPath, relPath);
@@ -2856,7 +3339,7 @@ async function detectLanguages(rootDir, includeTests) {
       }
       if (!entry.isFile()) continue;
       if (!includeTests && isTestPath(relPath)) continue;
-      const ext = path9.extname(entry.name).toLowerCase();
+      const ext = path12.extname(entry.name).toLowerCase();
       for (const [lang, exts] of Object.entries(LANGUAGE_EXTENSIONS)) {
         if (exts.has(ext)) {
           counts.set(lang, (counts.get(lang) ?? 0) + 1);
@@ -2882,6 +3365,15 @@ function validateFactLine(line) {
     }
     return { valid: true };
   }
+  if (obj.factType === "ScanManifest") {
+    if (typeof obj.manifestVersion !== "string") {
+      return { valid: false, error: "ScanManifest missing manifestVersion" };
+    }
+    if (typeof obj.emittedAt !== "string") {
+      return { valid: false, error: "ScanManifest missing emittedAt" };
+    }
+    return { valid: true };
+  }
   if (typeof obj.factId !== "string" || !obj.factId) {
     return { valid: false, error: "Missing or invalid factId" };
   }
@@ -2923,7 +3415,7 @@ function splitHcsOutput(lines) {
       continue;
     }
     const obj = parsed;
-    if (obj.factType === "Models" || obj.factType === "References") {
+    if (obj.factType === "Models" || obj.factType === "References" || obj.factType === "ScanManifest") {
       preamble.push(line);
     } else {
       facts.push(line);
@@ -2932,10 +3424,10 @@ function splitHcsOutput(lines) {
   return { preamble, facts };
 }
 function resolveHcsWorkerBin() {
-  const base = import.meta.dirname ?? path9.dirname(new URL(import.meta.url).pathname);
-  const bundledPath = path9.resolve(base, "..", "dist", "hcs-worker.js");
+  const base = import.meta.dirname ?? path12.dirname(new URL(import.meta.url).pathname);
+  const bundledPath = path12.resolve(base, "..", "dist", "hcs-worker.js");
   if (existsSync(bundledPath)) return bundledPath;
-  const siblingPath = path9.resolve(base, "hcs-worker.js");
+  const siblingPath = path12.resolve(base, "hcs-worker.js");
   if (existsSync(siblingPath)) return siblingPath;
   try {
     const resolved = import.meta.resolve("@vibgrate/hcs-node-worker");
@@ -2943,9 +3435,9 @@ function resolveHcsWorkerBin() {
     if (existsSync(resolvedPath)) return resolvedPath;
   } catch {
   }
-  const monorepoPath = path9.resolve(base, "..", "..", "..", "vibgrate-hcs", "node", "dist", "main.js");
+  const monorepoPath = path12.resolve(base, "..", "..", "..", "vibgrate-hcs", "node", "dist", "main.js");
   if (existsSync(monorepoPath)) return monorepoPath;
-  const devPath = path9.resolve(base, "..", "..", "..", "vibgrate-hcs", "node", "src", "main.ts");
+  const devPath = path12.resolve(base, "..", "..", "..", "vibgrate-hcs", "node", "src", "main.ts");
   if (existsSync(devPath)) return devPath;
   throw new Error(
     'Cannot locate HCS worker. Run "pnpm build" in the CLI package to bundle the worker into dist/.'
@@ -3024,7 +3516,7 @@ var NATIVE_RUNTIME_REQUIREMENTS = {
 function commandExistsOnPath(command) {
   const probeArgs = process.platform === "win32" ? ["/c", command, "--version"] : ["--version"];
   const probeCmd = process.platform === "win32" ? "cmd" : command;
-  const result = spawnSync(probeCmd, probeArgs, { stdio: "ignore" });
+  const result = spawnSync2(probeCmd, probeArgs, { stdio: "ignore" });
   return !result.error && result.status === 0;
 }
 function buildNativeInstallHint(language) {
@@ -3048,12 +3540,12 @@ async function runNodeWorker(rootDir, language, opts) {
       args.push("--cobol-copybook-paths", opts.copybookPaths);
     }
   }
-  return new Promise((resolve9) => {
+  return new Promise((resolve10) => {
     const facts = [];
     const errors = [];
     let stdoutBuf = "";
     let killed = false;
-    const child = spawn("node", ["--enable-source-maps", workerBin, ...args], {
+    const child = spawn3("node", ["--enable-source-maps", workerBin, ...args], {
       cwd: rootDir,
       stdio: ["ignore", "pipe", "pipe"],
       env: { ...process.env, NODE_OPTIONS: "--max-old-space-size=4096" }
@@ -3085,7 +3577,7 @@ async function runNodeWorker(rootDir, language, opts) {
           continue;
         }
         if (opts.verbose) {
-          process.stderr.write(chalk9.dim(`[${language}] ${trimmed}
+          process.stderr.write(chalk11.dim(`[${language}] ${trimmed}
 `));
         }
         if (trimmed.startsWith("[error]")) {
@@ -3099,15 +3591,15 @@ async function runNodeWorker(rootDir, language, opts) {
         facts.push(stdoutBuf.trim());
       }
       if (killed) {
-        resolve9({ language, facts, errors: ["Worker killed: timeout exceeded"], exitCode: EXIT_TIMEOUT });
+        resolve10({ language, facts, errors: ["Worker killed: timeout exceeded"], exitCode: EXIT_TIMEOUT });
       } else {
-        resolve9({ language, facts, errors, exitCode: code ?? 0 });
+        resolve10({ language, facts, errors, exitCode: code ?? 0 });
       }
     });
     child.on("error", (err) => {
       clearTimeout(timer);
       errors.push(`Failed to spawn worker: ${err.message}`);
-      resolve9({ language, facts, errors, exitCode: EXIT_PARSE_FAILURE });
+      resolve10({ language, facts, errors, exitCode: EXIT_PARSE_FAILURE });
     });
   });
 }
@@ -3127,7 +3619,7 @@ function resolveDotnetPublishedWorker(workersDir) {
   };
   const candidates = candidatesByPlatform[process.platform] ?? [];
   for (const filename of candidates) {
-    const fullPath = path9.join(workersDir, filename);
+    const fullPath = path12.join(workersDir, filename);
     if (existsSync(fullPath)) {
       return fullPath;
     }
@@ -3135,30 +3627,30 @@ function resolveDotnetPublishedWorker(workersDir) {
   return null;
 }
 function resolveNativeWorker(language, projectDir) {
-  const base = import.meta.dirname ?? path9.dirname(new URL(import.meta.url).pathname);
-  const hcsFromBundle = path9.resolve(base, "..", "..", "vibgrate-hcs");
-  const hcsFromSrc = path9.resolve(base, "..", "..", "..", "vibgrate-hcs");
+  const base = import.meta.dirname ?? path12.dirname(new URL(import.meta.url).pathname);
+  const hcsFromBundle = path12.resolve(base, "..", "..", "vibgrate-hcs");
+  const hcsFromSrc = path12.resolve(base, "..", "..", "..", "vibgrate-hcs");
   const hcsRoot = existsSync(hcsFromBundle) ? hcsFromBundle : hcsFromSrc;
-  const workersDir = path9.resolve(base, "workers");
+  const workersDir = path12.resolve(base, "workers");
   switch (language) {
     case "go": {
-      const bin = path9.join(workersDir, process.platform === "win32" ? "vibgrate-hcs-go.exe" : "vibgrate-hcs-go");
+      const bin = path12.join(workersDir, process.platform === "win32" ? "vibgrate-hcs-go.exe" : "vibgrate-hcs-go");
       if (existsSync(bin)) {
         return { cmd: bin, args: ["--project", projectDir, "--output", "ndjson"] };
       }
-      const src = path9.join(hcsRoot, "go");
-      if (existsSync(path9.join(src, "main.go"))) {
+      const src = path12.join(hcsRoot, "go");
+      if (existsSync(path12.join(src, "main.go"))) {
         return { cmd: "go", args: ["run", ".", "--project", projectDir, "--output", "ndjson"], cwd: src };
       }
       return null;
     }
     case "python": {
-      const bin = path9.join(workersDir, "vibgrate-hcs-python");
+      const bin = path12.join(workersDir, "vibgrate-hcs-python");
       if (existsSync(bin)) {
         return { cmd: bin, args: ["--project", projectDir, "--output", "ndjson"] };
       }
-      const src = path9.join(hcsRoot, "python");
-      if (existsSync(path9.join(src, "pyproject.toml"))) {
+      const src = path12.join(hcsRoot, "python");
+      if (existsSync(path12.join(src, "pyproject.toml"))) {
         return {
           cmd: "python3",
           args: ["-m", "vibgrate_hcs_python.main", "--project", projectDir, "--output", "ndjson"],
@@ -3168,13 +3660,13 @@ function resolveNativeWorker(language, projectDir) {
       return null;
     }
     case "java": {
-      const jar = path9.join(workersDir, "vibgrate-hcs-jvm.jar");
+      const jar = path12.join(workersDir, "vibgrate-hcs-jvm.jar");
       if (existsSync(jar)) {
         return { cmd: "java", args: ["-jar", jar, "--project", projectDir, "--output", "ndjson"] };
       }
-      const src = path9.join(hcsRoot, "jvm");
-      if (existsSync(path9.join(src, "build.gradle.kts"))) {
-        const gradlew = path9.join(src, process.platform === "win32" ? "gradlew.bat" : "gradlew");
+      const src = path12.join(hcsRoot, "jvm");
+      if (existsSync(path12.join(src, "build.gradle.kts"))) {
+        const gradlew = path12.join(src, process.platform === "win32" ? "gradlew.bat" : "gradlew");
         const launcher = existsSync(gradlew) ? gradlew : "gradle";
         return {
           cmd: launcher,
@@ -3190,11 +3682,11 @@ function resolveNativeWorker(language, projectDir) {
       if (publishedWorker) {
         return { cmd: publishedWorker, args: ["--project", projectDir, "--output", "ndjson"] };
       }
-      const dll = path9.join(workersDir, "VibgrateHcsWorker.dll");
+      const dll = path12.join(workersDir, "VibgrateHcsWorker.dll");
       if (existsSync(dll)) {
         return { cmd: "dotnet", args: [dll, "--project", projectDir, "--output", "ndjson"] };
       }
-      const csproj = path9.join(hcsRoot, "dotnet", "src", "VibgrateHcsWorker", "VibgrateHcsWorker.csproj");
+      const csproj = path12.join(hcsRoot, "dotnet", "src", "VibgrateHcsWorker", "VibgrateHcsWorker.csproj");
       if (existsSync(csproj)) {
         return {
           cmd: "dotnet",
@@ -3220,19 +3712,19 @@ async function runNativeWorker(rootDir, language, opts) {
       exitCode: EXIT_PARSE_FAILURE
     };
   }
-  return new Promise((resolve9) => {
+  return new Promise((resolve10) => {
     const facts = [];
     const errors = [];
     let stdoutBuf = "";
     let killed = false;
     if (opts.verbose) {
-      process.stderr.write(chalk9.dim(`[${language}] Spawning: ${spec.cmd} ${spec.args.join(" ")}
+      process.stderr.write(chalk11.dim(`[${language}] Spawning: ${spec.cmd} ${spec.args.join(" ")}
 `));
     }
     const runtimeReq = NATIVE_RUNTIME_REQUIREMENTS[language];
     const usesPathCommand = runtimeReq && spec.cmd === runtimeReq.command;
     if (usesPathCommand && !commandExistsOnPath(spec.cmd)) {
-      resolve9({
+      resolve10({
         language,
         facts: [],
         errors: [
@@ -3244,7 +3736,7 @@ async function runNativeWorker(rootDir, language, opts) {
       });
       return;
     }
-    const child = spawn(spec.cmd, spec.args, {
+    const child = spawn3(spec.cmd, spec.args, {
       cwd: spec.cwd ?? rootDir,
       stdio: ["ignore", "pipe", "pipe"]
     });
@@ -3267,7 +3759,7 @@ async function runNativeWorker(rootDir, language, opts) {
         const trimmed = line.trim();
         if (!trimmed) continue;
         if (opts.verbose) {
-          process.stderr.write(chalk9.dim(`[${language}] ${trimmed}
+          process.stderr.write(chalk11.dim(`[${language}] ${trimmed}
 `));
         }
         if (trimmed.startsWith("[error]")) {
@@ -3279,9 +3771,9 @@ async function runNativeWorker(rootDir, language, opts) {
       clearTimeout(timer);
       if (stdoutBuf.trim()) facts.push(stdoutBuf.trim());
       if (killed) {
-        resolve9({ language, facts, errors: ["Worker killed: timeout exceeded"], exitCode: EXIT_TIMEOUT });
+        resolve10({ language, facts, errors: ["Worker killed: timeout exceeded"], exitCode: EXIT_TIMEOUT });
       } else {
-        resolve9({ language, facts, errors, exitCode: code ?? 0 });
+        resolve10({ language, facts, errors, exitCode: code ?? 0 });
       }
     });
     child.on("error", (err) => {
@@ -3290,21 +3782,21 @@ async function runNativeWorker(rootDir, language, opts) {
       errors.push(
         isNotFound ? `[error] '${spec.cmd}' not found. ${buildNativeInstallHint(language)}` : `[error] Failed to spawn native worker: ${err.message}`
       );
-      resolve9({ language, facts, errors, exitCode: EXIT_PARSE_FAILURE });
+      resolve10({ language, facts, errors, exitCode: EXIT_PARSE_FAILURE });
     });
   });
 }
 async function pushFacts(facts, dsn, verbose) {
   const parsed = parseDsn2(dsn);
   if (!parsed) {
-    process.stderr.write(chalk9.red("Invalid DSN format.\n"));
-    process.stderr.write(chalk9.dim("Expected: vibgrate+https://<key_id>:<secret>@<host>/<workspace_id>\n"));
+    process.stderr.write(chalk11.red("Invalid DSN format.\n"));
+    process.stderr.write(chalk11.dim("Expected: vibgrate+https://<key_id>:<secret>@<host>/<workspace_id>\n"));
     return false;
   }
   const body = facts.join("\n") + "\n";
   const url = `${parsed.scheme}://${parsed.host}/v1/ingest/hcs`;
   if (verbose) {
-    process.stderr.write(chalk9.dim(`Pushing ${facts.length} facts to ${parsed.host}...
+    process.stderr.write(chalk11.dim(`Pushing ${facts.length} facts to ${parsed.host}...
 `));
   }
   try {
@@ -3322,23 +3814,23 @@ async function pushFacts(facts, dsn, verbose) {
     });
     if (!response.ok) {
       const text = await response.text().catch(() => "");
-      process.stderr.write(chalk9.red(`Push failed: HTTP ${response.status} ${text}
+      process.stderr.write(chalk11.red(`Push failed: HTTP ${response.status} ${text}
 `));
       return false;
     }
     if (verbose) {
-      process.stderr.write(chalk9.green(`\u2714 Pushed ${facts.length} facts successfully
+      process.stderr.write(chalk11.green(`\u2714 Pushed ${facts.length} facts successfully
 `));
     }
     return true;
   } catch (err) {
-    process.stderr.write(chalk9.red(`Push failed: ${err instanceof Error ? err.message : String(err)}
+    process.stderr.write(chalk11.red(`Push failed: ${err instanceof Error ? err.message : String(err)}
 `));
     return false;
   }
 }
 async function loadFeedback(filePath) {
-  const content = await fs2.readFile(filePath, "utf-8");
+  const content = await fs4.readFile(filePath, "utf-8");
   const lines = content.split("\n").filter((l) => l.trim());
   for (const line of lines) {
     try {
@@ -3399,21 +3891,21 @@ var ProgressTracker = class {
     const parts = [];
     for (const [lang, st] of this.langStatus) {
       if (st.done) {
-        parts.push(chalk9.green(`${lang} \u2713`));
+        parts.push(chalk11.green(`${lang} \u2713`));
       } else if (st.phase === "waiting") {
-        parts.push(chalk9.dim(`${lang} \xB7`));
+        parts.push(chalk11.dim(`${lang} \xB7`));
       } else if (st.phase === "discovering") {
-        parts.push(chalk9.yellow(`${lang} \u2026`));
+        parts.push(chalk11.yellow(`${lang} \u2026`));
       } else if (st.phase === "scanning" && st.fileCount > 0) {
         const pct = Math.round(st.fileIndex / st.fileCount * 100);
-        parts.push(chalk9.cyan(`${lang} ${st.fileIndex}/${st.fileCount} ${pct}%`));
+        parts.push(chalk11.cyan(`${lang} ${st.fileIndex}/${st.fileCount} ${pct}%`));
       } else if (st.phase === "extracting") {
-        parts.push(chalk9.cyan(`${lang} extracting`));
+        parts.push(chalk11.cyan(`${lang} extracting`));
       } else {
-        parts.push(chalk9.dim(`${lang} ${st.phase}`));
+        parts.push(chalk11.dim(`${lang} ${st.phase}`));
       }
     }
-    const line = `  ${parts.join("  ")}  ${chalk9.dim(`${this.totalFacts} facts`)}`;
+    const line = `  ${parts.join("  ")}  ${chalk11.dim(`${this.totalFacts} facts`)}`;
     const padding = Math.max(0, this.lastLineLen - line.length);
     process.stderr.write(`\r${line}${" ".repeat(padding)}`);
     this.lastLineLen = line.length;
@@ -3425,58 +3917,95 @@ var ProgressTracker = class {
     }
   }
 };
-var extractCommand = new Command8("extract").description("Analyze source code and emit validated HCS facts (NDJSON)").argument("[path]", "Path to source directory", ".").option("-o, --out <file>", "Write NDJSON to file (default: stdout)").option("--language <langs>", "Comma-separated languages to analyze (default: auto-detect)").option("--include-tests", "Include test files in analysis").option("--push", "Stream validated facts to dashboard API").option("--dsn <dsn>", "DSN token for push (or use VIBGRATE_DSN env)").option("--concurrency <n>", "Number of parallel file workers").option("--timeout-mins <mins>", "Total analysis timeout in minutes", "60").option("--feedback <file>", "Load NDJSON diff artifact for refinement").option("--derive", "Derive behavioural spec facts (BehaviouralAssertion/BehaviouralSpec) from extracted facts").option("--scan-id <id>", 'Scan id for the derived BehaviouralSpec (default: "local")').option("--application-id <id>", "Application id for the derived BehaviouralSpec (default: directory name)").option("--verbose", "Print worker stderr and summary statistics").action(async (targetPath, opts) => {
-  const rootDir = path9.resolve(targetPath);
-  if (!await pathExists(rootDir)) {
-    process.stderr.write(chalk9.red(`Path does not exist: ${rootDir}
+var extractCommand = new Command10("extract").description("Analyze source code and emit validated HCS facts (NDJSON)").argument("[path-or-url]", "Path to source directory, or a public repository URL to clone", ".").option("--repo-url <url>", "Public repository URL to clone and analyze (alternative to passing a URL positionally)").option("--ref <ref>", "Branch, tag, or commit SHA to check out when cloning a repository URL").option("--keep-clone", "Do not delete the temporary clone after extraction (prints its path)").option("--clone-timeout-mins <mins>", "Clone/fetch timeout in minutes", "10").option("-o, --out <file>", "Write NDJSON to file (default: stdout)").option("--language <langs>", "Comma-separated languages to analyze (default: auto-detect)").option("--include-tests", "Include test files in analysis").option("--push", "Stream validated facts to dashboard API").option("--dsn <dsn>", "DSN token for push (or use VIBGRATE_DSN env)").option("--concurrency <n>", "Number of parallel file workers").option("--timeout-mins <mins>", "Total analysis timeout in minutes", "60").option("--feedback <file>", "Load NDJSON diff artifact for refinement").option("--derive", "Derive behavioural spec facts (BehaviouralAssertion/BehaviouralSpec) from extracted facts").option("--scan-id <id>", 'Scan id for the derived BehaviouralSpec (default: "local")').option("--application-id <id>", "Application id for the derived BehaviouralSpec (default: directory name)").option("--verbose", "Print worker stderr and summary statistics").action(async (targetPath, opts) => {
+  const urlArg = opts.repoUrl ?? (looksLikeRepoUrl(targetPath) ? targetPath : void 0);
+  const source = urlArg ? "url" : "local";
+  let rootDir;
+  let manifestRemoteUrl;
+  if (urlArg) {
+    const cloneTimeoutMins = parseInt(opts.cloneTimeoutMins, 10);
+    if (isNaN(cloneTimeoutMins) || cloneTimeoutMins < 1) {
+      process.stderr.write(chalk11.red("--clone-timeout-mins must be >= 1\n"));
+      process.exit(EXIT_USAGE_ERROR);
+    }
+    manifestRemoteUrl = redactRemoteUrl(urlArg);
+    try {
+      const cloned = await cloneRepo(urlArg, {
+        ref: opts.ref,
+        timeoutMs: cloneTimeoutMins * 60 * 1e3,
+        verbose: opts.verbose ?? false
+      });
+      rootDir = cloned.dir;
+      if (opts.keepClone) {
+        process.stderr.write(chalk11.dim(`Clone retained at: ${cloned.dir}
 `));
-    process.exit(EXIT_USAGE_ERROR);
-  }
-  let stat3;
-  try {
-    stat3 = await fs2.stat(rootDir);
-  } catch {
-    process.stderr.write(chalk9.red(`Cannot read path: ${rootDir}
+      } else {
+        process.once("exit", () => {
+          try {
+            rmSync2(cloned.dir, { recursive: true, force: true });
+          } catch {
+          }
+        });
+      }
+    } catch (err) {
+      const msg = err instanceof CloneError ? err.message : err instanceof Error ? err.message : String(err);
+      process.stderr.write(chalk11.red(`Clone failed: ${msg}
 `));
-    process.exit(EXIT_USAGE_ERROR);
-  }
-  if (!stat3.isDirectory()) {
-    process.stderr.write(chalk9.red(`Path must be a directory: ${rootDir}
+      process.exit(EXIT_USAGE_ERROR);
+    }
+  } else {
+    rootDir = path12.resolve(targetPath);
+    if (!await pathExists(rootDir)) {
+      process.stderr.write(chalk11.red(`Path does not exist: ${rootDir}
 `));
-    process.exit(EXIT_USAGE_ERROR);
+      process.exit(EXIT_USAGE_ERROR);
+    }
+    let stat4;
+    try {
+      stat4 = await fs4.stat(rootDir);
+    } catch {
+      process.stderr.write(chalk11.red(`Cannot read path: ${rootDir}
+`));
+      process.exit(EXIT_USAGE_ERROR);
+    }
+    if (!stat4.isDirectory()) {
+      process.stderr.write(chalk11.red(`Path must be a directory: ${rootDir}
+`));
+      process.exit(EXIT_USAGE_ERROR);
+    }
   }
   const dsn = opts.dsn || process.env.VIBGRATE_DSN;
   if (opts.push && !dsn) {
-    process.stderr.write(chalk9.red("--push requires --dsn or VIBGRATE_DSN environment variable\n"));
+    process.stderr.write(chalk11.red("--push requires --dsn or VIBGRATE_DSN environment variable\n"));
     process.exit(EXIT_USAGE_ERROR);
   }
   if (dsn && !parseDsn2(dsn)) {
-    process.stderr.write(chalk9.red("Invalid DSN format.\n"));
-    process.stderr.write(chalk9.dim("Expected: vibgrate+https://<key_id>:<secret>@<host>/<workspace_id>\n"));
+    process.stderr.write(chalk11.red("Invalid DSN format.\n"));
+    process.stderr.write(chalk11.dim("Expected: vibgrate+https://<key_id>:<secret>@<host>/<workspace_id>\n"));
     process.exit(EXIT_USAGE_ERROR);
   }
-  const concurrency = opts.concurrency ? parseInt(opts.concurrency, 10) : os2.cpus().length;
+  const concurrency = opts.concurrency ? parseInt(opts.concurrency, 10) : os4.cpus().length;
   if (isNaN(concurrency) || concurrency < 1) {
-    process.stderr.write(chalk9.red("--concurrency must be >= 1\n"));
+    process.stderr.write(chalk11.red("--concurrency must be >= 1\n"));
     process.exit(EXIT_USAGE_ERROR);
   }
   const timeoutMins = parseInt(opts.timeoutMins, 10);
   if (isNaN(timeoutMins) || timeoutMins < 1) {
-    process.stderr.write(chalk9.red("--timeout-mins must be >= 1\n"));
+    process.stderr.write(chalk11.red("--timeout-mins must be >= 1\n"));
     process.exit(EXIT_USAGE_ERROR);
   }
   const timeoutMs = timeoutMins * 60 * 1e3;
   if (opts.out) {
-    const outDir = path9.dirname(path9.resolve(opts.out));
+    const outDir = path12.dirname(path12.resolve(opts.out));
     if (!await pathExists(outDir)) {
-      process.stderr.write(chalk9.red(`Output directory does not exist: ${outDir}
+      process.stderr.write(chalk11.red(`Output directory does not exist: ${outDir}
 `));
       process.exit(EXIT_USAGE_ERROR);
     }
     try {
-      const outStat = await fs2.stat(path9.resolve(opts.out));
+      const outStat = await fs4.stat(path12.resolve(opts.out));
       if (outStat.isDirectory()) {
-        process.stderr.write(chalk9.red(`--out cannot be a directory: ${opts.out}
+        process.stderr.write(chalk11.red(`--out cannot be a directory: ${opts.out}
 `));
         process.exit(EXIT_USAGE_ERROR);
       }
@@ -3485,16 +4014,16 @@ var extractCommand = new Command8("extract").description("Analyze source code an
   }
   let feedbackLines;
   if (opts.feedback) {
-    const feedbackPath = path9.resolve(opts.feedback);
+    const feedbackPath = path12.resolve(opts.feedback);
     if (!await pathExists(feedbackPath)) {
-      process.stderr.write(chalk9.red(`Feedback file not found: ${feedbackPath}
+      process.stderr.write(chalk11.red(`Feedback file not found: ${feedbackPath}
 `));
       process.exit(EXIT_USAGE_ERROR);
     }
     try {
       feedbackLines = await loadFeedback(feedbackPath);
     } catch (err) {
-      process.stderr.write(chalk9.red(`Invalid feedback file: ${err instanceof Error ? err.message : String(err)}
+      process.stderr.write(chalk11.red(`Invalid feedback file: ${err instanceof Error ? err.message : String(err)}
 `));
       process.exit(EXIT_USAGE_ERROR);
     }
@@ -3504,9 +4033,9 @@ var extractCommand = new Command8("extract").description("Analyze source code an
     targetLanguages = opts.language.split(",").map((l) => normalizeLanguageToken(l)).filter(Boolean);
     for (const lang of targetLanguages) {
       if (!SUPPORTED_LANGUAGES.has(lang)) {
-        process.stderr.write(chalk9.red(`Unknown language: "${lang}"
+        process.stderr.write(chalk11.red(`Unknown language: "${lang}"
 `));
-        process.stderr.write(chalk9.dim(`Supported: ${[...SUPPORTED_LANGUAGES].sort().join(", ")}
+        process.stderr.write(chalk11.dim(`Supported: ${[...SUPPORTED_LANGUAGES].sort().join(", ")}
 `));
         process.exit(EXIT_USAGE_ERROR);
       }
@@ -3514,14 +4043,14 @@ var extractCommand = new Command8("extract").description("Analyze source code an
   } else {
     const detected = await detectLanguages(rootDir, opts.includeTests ?? false);
     if (detected.length === 0) {
-      process.stderr.write(chalk9.yellow("No supported source files detected.\n"));
+      process.stderr.write(chalk11.yellow("No supported source files detected.\n"));
       process.exit(EXIT_SUCCESS);
     }
     targetLanguages = detected.map((d) => d.language);
     if (opts.verbose) {
-      process.stderr.write(chalk9.dim("Detected languages:\n"));
+      process.stderr.write(chalk11.dim("Detected languages:\n"));
       for (const d of detected) {
-        process.stderr.write(chalk9.dim(`  ${d.language}: ${d.fileCount} files
+        process.stderr.write(chalk11.dim(`  ${d.language}: ${d.fileCount} files
 `));
       }
     }
@@ -3529,20 +4058,20 @@ var extractCommand = new Command8("extract").description("Analyze source code an
   const runnableLanguages = targetLanguages.filter((l) => ALL_WORKER_LANGS.has(l));
   const unknownWorkerLangs = targetLanguages.filter((l) => !ALL_WORKER_LANGS.has(l));
   if (unknownWorkerLangs.length > 0 && opts.verbose) {
-    process.stderr.write(chalk9.dim(
+    process.stderr.write(chalk11.dim(
       `No worker registered for: ${unknownWorkerLangs.join(", ")} \u2014 skipping.
 `
     ));
   }
   if (runnableLanguages.length === 0) {
-    process.stderr.write(chalk9.yellow("No languages with available HCS workers found.\n"));
+    process.stderr.write(chalk11.yellow("No languages with available HCS workers found.\n"));
     process.exit(EXIT_SUCCESS);
   }
   const startTime = Date.now();
   const globalDeadline = startTime + timeoutMs;
   process.stderr.write(
-    chalk9.bold(`Extracting HCS facts from ${rootDir}
-`) + chalk9.dim(`Languages: ${runnableLanguages.join(", ")}  Concurrency: ${concurrency}  Timeout: ${timeoutMins}m
+    chalk11.bold(`Extracting HCS facts from ${rootDir}
+`) + chalk11.dim(`Languages: ${runnableLanguages.join(", ")}  Concurrency: ${concurrency}  Timeout: ${timeoutMins}m
 `)
   );
   const progress = new ProgressTracker(runnableLanguages);
@@ -3589,7 +4118,7 @@ var extractCommand = new Command8("extract").description("Analyze source code an
           hasSchemaFailure = true;
           allErrors.push(`[${language}] Schema validation: ${validation.error}`);
           if (opts.verbose) {
-            process.stderr.write(chalk9.red(`[${language}] Invalid fact: ${validation.error}
+            process.stderr.write(chalk11.red(`[${language}] Invalid fact: ${validation.error}
 `));
           }
         }
@@ -3615,7 +4144,7 @@ var extractCommand = new Command8("extract").description("Analyze source code an
   progress.finish(elapsed);
   if (opts.derive) {
     const scanId = opts.scanId || "local";
-    const applicationId = opts.applicationId || path9.basename(rootDir);
+    const applicationId = opts.applicationId || path12.basename(rootDir);
     const { envelopes, summary } = deriveBehaviouralFacts(derivedInputs, { scanId, applicationId });
     for (const env of envelopes) {
       const line = JSON.stringify(env);
@@ -3626,18 +4155,42 @@ var extractCommand = new Command8("extract").description("Analyze source code an
         allErrors.push("[behavioural] derived fact failed schema validation");
       }
     }
-    process.stderr.write(chalk9.dim(
+    process.stderr.write(chalk11.dim(
       `Derived ${summary.assertions} behavioural assertion(s) \xB7 confidence ${summary.behaviouralConfidence} (${summary.assertedFacts}/${summary.surfaceFacts} surface facts)
 `
     ));
   }
   allFacts.sort();
-  const allLines = [...allPreamble, ...allFacts];
+  const manifestScanId = opts.scanId || "local";
+  const manifestApplicationId = opts.applicationId || (source === "url" ? deriveRepoName(manifestRemoteUrl) : void 0) || path12.basename(rootDir);
+  let manifestVcs;
+  try {
+    manifestVcs = await detectVcs2(rootDir);
+  } catch {
+    manifestVcs = void 0;
+  }
+  const manifest = buildScanManifest({
+    // Prefer the redacted URL we cloned from; fall back to the local repo's
+    // configured remote (also credential-redacted) for non-URL scans.
+    remoteUrl: manifestRemoteUrl ?? (manifestVcs?.remoteUrl ? redactRemoteUrl(manifestVcs.remoteUrl) : void 0),
+    sha: manifestVcs?.sha,
+    shortSha: manifestVcs?.shortSha,
+    branch: manifestVcs?.branch,
+    ref: opts.ref,
+    source,
+    languages: runnableLanguages,
+    scanId: manifestScanId,
+    applicationId: manifestApplicationId,
+    vibgrateVersion: VERSION,
+    factLines: allFacts
+  });
+  const manifestLine = JSON.stringify(manifest);
+  const allLines = [manifestLine, ...allPreamble, ...allFacts];
   const ndjsonOutput = allLines.join("\n") + (allLines.length > 0 ? "\n" : "");
   if (opts.out) {
-    const outPath = path9.resolve(opts.out);
-    await fs2.writeFile(outPath, ndjsonOutput, "utf-8");
-    process.stderr.write(chalk9.green(`\u2714 Wrote ${allFacts.length} facts to ${outPath}
+    const outPath = path12.resolve(opts.out);
+    await fs4.writeFile(outPath, ndjsonOutput, "utf-8");
+    process.stderr.write(chalk11.green(`\u2714 Wrote ${allFacts.length} facts to ${outPath}
 `));
   } else {
     process.stdout.write(ndjsonOutput);
@@ -3649,48 +4202,48 @@ var extractCommand = new Command8("extract").description("Analyze source code an
     }
   }
   if (opts.verbose) {
-    process.stderr.write(chalk9.dim("\n\u2500\u2500 Summary \u2500\u2500\n"));
-    process.stderr.write(chalk9.dim(`  Facts emitted : ${allFacts.length}
+    process.stderr.write(chalk11.dim("\n\u2500\u2500 Summary \u2500\u2500\n"));
+    process.stderr.write(chalk11.dim(`  Facts emitted : ${allFacts.length}
 `));
-    process.stderr.write(chalk9.dim(`  Languages     : ${runnableLanguages.join(", ")}
+    process.stderr.write(chalk11.dim(`  Languages     : ${runnableLanguages.join(", ")}
 `));
-    process.stderr.write(chalk9.dim(`  Elapsed       : ${elapsed}s
+    process.stderr.write(chalk11.dim(`  Elapsed       : ${elapsed}s
 `));
     if (allErrors.length > 0) {
-      process.stderr.write(chalk9.dim(`  Errors        : ${allErrors.length}
+      process.stderr.write(chalk11.dim(`  Errors        : ${allErrors.length}
 `));
       for (const err of allErrors.slice(0, 10)) {
-        process.stderr.write(chalk9.dim(`    ${err}
+        process.stderr.write(chalk11.dim(`    ${err}
 `));
       }
       if (allErrors.length > 10) {
-        process.stderr.write(chalk9.dim(`    ... and ${allErrors.length - 10} more
+        process.stderr.write(chalk11.dim(`    ... and ${allErrors.length - 10} more
 `));
       }
     }
-    process.stderr.write(chalk9.dim("\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\n\n"));
+    process.stderr.write(chalk11.dim("\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\n\n"));
   }
   if (hasTimeout) {
-    process.stderr.write(chalk9.red(`Timeout exceeded (${timeoutMins} minutes)
+    process.stderr.write(chalk11.red(`Timeout exceeded (${timeoutMins} minutes)
 `));
     process.exit(EXIT_TIMEOUT);
   }
   if (hasSchemaFailure) {
-    process.stderr.write(chalk9.red("Fact schema validation failures detected\n"));
+    process.stderr.write(chalk11.red("Fact schema validation failures detected\n"));
     process.exit(EXIT_SCHEMA_FAILURE);
   }
   if (hasParseFailure) {
-    process.stderr.write(chalk9.red("Parsing failures detected\n"));
+    process.stderr.write(chalk11.red("Parsing failures detected\n"));
     process.exit(EXIT_PARSE_FAILURE);
   }
 });
 
 // src/commands/diff.ts
-import * as path10 from "path";
-import * as fs3 from "fs/promises";
-import * as crypto3 from "crypto";
-import { Command as Command9 } from "commander";
-import chalk10 from "chalk";
+import * as path13 from "path";
+import * as fs5 from "fs/promises";
+import * as crypto4 from "crypto";
+import { Command as Command11 } from "commander";
+import chalk12 from "chalk";
 var EXIT_INVALID_PATH = 2;
 var EXIT_USAGE_ERROR2 = 5;
 var VALID_FORMATS = /* @__PURE__ */ new Set(["ndjson", "json", "patch"]);
@@ -3706,14 +4259,14 @@ async function discoverFiles(root, includeGlobs, excludeGlobs) {
   async function walk(dir, relBase) {
     let entries;
     try {
-      entries = await fs3.readdir(dir, { withFileTypes: true });
+      entries = await fs5.readdir(dir, { withFileTypes: true });
     } catch {
       return;
     }
     for (const entry of entries) {
       if (entry.name.startsWith(".") && SKIP_DIRS2.has(entry.name)) continue;
-      const absPath = path10.join(dir, entry.name);
-      const relPath = path10.join(relBase, entry.name);
+      const absPath = path13.join(dir, entry.name);
+      const relPath = path13.join(relBase, entry.name);
       if (entry.isDirectory()) {
         if (!SKIP_DIRS2.has(entry.name)) {
           await walk(absPath, relPath);
@@ -3884,7 +4437,7 @@ function lcsRatio(a, b) {
   return 2 * lcsLen / (n + m);
 }
 function generateDeltaId(kind, filePath) {
-  const hash = crypto3.createHash("sha256").update(`${kind}:${filePath}`).digest("hex").substring(0, 16);
+  const hash = crypto4.createHash("sha256").update(`${kind}:${filePath}`).digest("hex").substring(0, 16);
   return `hcs:delta:${hash}`;
 }
 function formatNdjson(deltas) {
@@ -3896,8 +4449,8 @@ function formatJson(deltas) {
 function formatPatch(deltas, originalPath, generatedPath) {
   const lines = [];
   for (const delta of deltas) {
-    const aFile = delta.originalPath ? path10.join("a", delta.originalPath) : "/dev/null";
-    const bFile = delta.generatedPath ? path10.join("b", delta.generatedPath) : "/dev/null";
+    const aFile = delta.originalPath ? path13.join("a", delta.originalPath) : "/dev/null";
+    const bFile = delta.generatedPath ? path13.join("b", delta.generatedPath) : "/dev/null";
     if (delta.changeKind === "renamed" && delta.originalPath && delta.generatedPath) {
       lines.push(`diff --vibgrate ${aFile} ${bFile}`);
       lines.push(`similarity index ${Math.round((delta.similarity ?? 0) * 100)}%`);
@@ -3918,38 +4471,38 @@ function formatPatch(deltas, originalPath, generatedPath) {
   }
   return lines.join("\n");
 }
-var diffCommand = new Command9("diff").description("Compare two directory trees and emit structured delta facts").argument("<original_path>", "Original source directory").argument("<generated_path>", "Generated source directory").option("-o, --out <file>", "Output file path", "vibgrate.diff.ndjson").option("--format <fmt>", "Output format (ndjson|json|patch)", "ndjson").option("--ignore-whitespace", "Ignore whitespace-only changes").option("--context <n>", "Context lines for patch output", "3").option("--include <globs>", "Only include matching files (comma-separated)").option("--exclude <globs>", "Exclude matching files (comma-separated)").option("--stats", "Include insertions/deletions summary per file").option("--verbose", "Print file match decisions and rename detection").action(async (originalPath, generatedPath, opts) => {
-  const origDir = path10.resolve(originalPath);
-  const genDir = path10.resolve(generatedPath);
+var diffCommand = new Command11("diff").description("Compare two directory trees and emit structured delta facts").argument("<original_path>", "Original source directory").argument("<generated_path>", "Generated source directory").option("-o, --out <file>", "Output file path", "vibgrate.diff.ndjson").option("--format <fmt>", "Output format (ndjson|json|patch)", "ndjson").option("--ignore-whitespace", "Ignore whitespace-only changes").option("--context <n>", "Context lines for patch output", "3").option("--include <globs>", "Only include matching files (comma-separated)").option("--exclude <globs>", "Exclude matching files (comma-separated)").option("--stats", "Include insertions/deletions summary per file").option("--verbose", "Print file match decisions and rename detection").action(async (originalPath, generatedPath, opts) => {
+  const origDir = path13.resolve(originalPath);
+  const genDir = path13.resolve(generatedPath);
   for (const [label, dir] of [["original_path", origDir], ["generated_path", genDir]]) {
     if (!await pathExists(dir)) {
-      process.stderr.write(chalk10.red(`${label} does not exist: ${dir}
+      process.stderr.write(chalk12.red(`${label} does not exist: ${dir}
 `));
       process.exit(EXIT_INVALID_PATH);
     }
-    let stat3;
+    let stat4;
     try {
-      stat3 = await fs3.stat(dir);
+      stat4 = await fs5.stat(dir);
     } catch {
-      process.stderr.write(chalk10.red(`Cannot read ${label}: ${dir}
+      process.stderr.write(chalk12.red(`Cannot read ${label}: ${dir}
 `));
       process.exit(EXIT_INVALID_PATH);
     }
-    if (!stat3.isDirectory()) {
-      process.stderr.write(chalk10.red(`${label} must be a directory: ${dir}
+    if (!stat4.isDirectory()) {
+      process.stderr.write(chalk12.red(`${label} must be a directory: ${dir}
 `));
       process.exit(EXIT_INVALID_PATH);
     }
   }
   const format = opts.format.toLowerCase();
   if (!VALID_FORMATS.has(format)) {
-    process.stderr.write(chalk10.red(`Invalid format: "${opts.format}". Allowed: ndjson, json, patch
+    process.stderr.write(chalk12.red(`Invalid format: "${opts.format}". Allowed: ndjson, json, patch
 `));
     process.exit(EXIT_USAGE_ERROR2);
   }
   const contextLines = parseInt(opts.context, 10);
   if (isNaN(contextLines) || contextLines < 0) {
-    process.stderr.write(chalk10.red("--context must be >= 0\n"));
+    process.stderr.write(chalk12.red("--context must be >= 0\n"));
     process.exit(EXIT_USAGE_ERROR2);
   }
   const includeGlobs = opts.include ? opts.include.split(",").map((g) => g.trim()).filter(Boolean) : void 0;
@@ -3961,9 +4514,9 @@ var diffCommand = new Command9("diff").description("Compare two directory trees
   const origMap = new Map(origFiles.map((f) => [f.relPath, f]));
   const genMap = new Map(genFiles.map((f) => [f.relPath, f]));
   if (opts.verbose) {
-    process.stderr.write(chalk10.dim(`Original: ${origFiles.length} files
+    process.stderr.write(chalk12.dim(`Original: ${origFiles.length} files
 `));
-    process.stderr.write(chalk10.dim(`Generated: ${genFiles.length} files
+    process.stderr.write(chalk12.dim(`Generated: ${genFiles.length} files
 `));
   }
   const deltas = [];
@@ -3974,8 +4527,8 @@ var diffCommand = new Command9("diff").description("Compare two directory trees
     if (genFile) {
       matchedOrig.add(relPath);
       matchedGen.add(relPath);
-      const origContent = await fs3.readFile(origFile.absPath, "utf-8");
-      const genContent = await fs3.readFile(genFile.absPath, "utf-8");
+      const origContent = await fs5.readFile(origFile.absPath, "utf-8");
+      const genContent = await fs5.readFile(genFile.absPath, "utf-8");
       const origCompare = opts.ignoreWhitespace ? origContent.replace(/\s+/g, " ").trim() : origContent;
       const genCompare = opts.ignoreWhitespace ? genContent.replace(/\s+/g, " ").trim() : genContent;
       if (origCompare !== genCompare) {
@@ -3997,7 +4550,7 @@ var diffCommand = new Command9("diff").description("Compare two directory trees
         }
         deltas.push(delta);
         if (opts.verbose) {
-          process.stderr.write(chalk10.dim(`  modified: ${relPath} (+${diffResult.insertions} -${diffResult.deletions})
+          process.stderr.write(chalk12.dim(`  modified: ${relPath} (+${diffResult.insertions} -${diffResult.deletions})
 `));
         }
       }
@@ -4014,13 +4567,13 @@ var diffCommand = new Command9("diff").description("Compare two directory trees
     await Promise.all([
       ...unmatchedOrig.map(async (f) => {
         try {
-          origContents.set(f.relPath, await fs3.readFile(f.absPath, "utf-8"));
+          origContents.set(f.relPath, await fs5.readFile(f.absPath, "utf-8"));
         } catch {
         }
       }),
       ...unmatchedGen.map(async (f) => {
         try {
-          genContents.set(f.relPath, await fs3.readFile(f.absPath, "utf-8"));
+          genContents.set(f.relPath, await fs5.readFile(f.absPath, "utf-8"));
         } catch {
         }
       })
@@ -4028,7 +4581,7 @@ var diffCommand = new Command9("diff").description("Compare two directory trees
     const pairs = [];
     for (const [origPath, origContent] of origContents) {
       for (const [genPath, genContent] of genContents) {
-        if (path10.extname(origPath) !== path10.extname(genPath)) continue;
+        if (path13.extname(origPath) !== path13.extname(genPath)) continue;
         const similarity = computeSimilarity(origContent, genContent);
         if (similarity >= RENAME_THRESHOLD) {
           pairs.push({ origPath, genPath, similarity });
@@ -4061,7 +4614,7 @@ var diffCommand = new Command9("diff").description("Compare two directory trees
       }
       deltas.push(delta);
       if (opts.verbose) {
-        process.stderr.write(chalk10.dim(
+        process.stderr.write(chalk12.dim(
           `  renamed: ${pair.origPath} \u2192 ${pair.genPath} (${(pair.similarity * 100).toFixed(0)}% similar)
 `
         ));
@@ -4078,7 +4631,7 @@ var diffCommand = new Command9("diff").description("Compare two directory trees
     };
     if (opts.stats) {
       try {
-        const content = await fs3.readFile(file.absPath, "utf-8");
+        const content = await fs5.readFile(file.absPath, "utf-8");
         delta.stats = { insertions: 0, deletions: content.split("\n").length };
       } catch {
         delta.stats = { insertions: 0, deletions: 0 };
@@ -4086,7 +4639,7 @@ var diffCommand = new Command9("diff").description("Compare two directory trees
     }
     deltas.push(delta);
     if (opts.verbose) {
-      process.stderr.write(chalk10.dim(`  removed: ${file.relPath}
+      process.stderr.write(chalk12.dim(`  removed: ${file.relPath}
 `));
     }
   }
@@ -4100,7 +4653,7 @@ var diffCommand = new Command9("diff").description("Compare two directory trees
     };
     if (opts.stats) {
       try {
-        const content = await fs3.readFile(file.absPath, "utf-8");
+        const content = await fs5.readFile(file.absPath, "utf-8");
         delta.stats = { insertions: content.split("\n").length, deletions: 0 };
       } catch {
         delta.stats = { insertions: 0, deletions: 0 };
@@ -4108,7 +4661,7 @@ var diffCommand = new Command9("diff").description("Compare two directory trees
     }
     deltas.push(delta);
     if (opts.verbose) {
-      process.stderr.write(chalk10.dim(`  added: ${file.relPath}
+      process.stderr.write(chalk12.dim(`  added: ${file.relPath}
 `));
     }
   }
@@ -4129,16 +4682,16 @@ var diffCommand = new Command9("diff").description("Compare two directory trees
       output = formatPatch(deltas, originalPath, generatedPath);
       break;
   }
-  const outPath = path10.resolve(opts.out);
-  await fs3.writeFile(outPath, output, "utf-8");
+  const outPath = path13.resolve(opts.out);
+  await fs5.writeFile(outPath, output, "utf-8");
   const added = deltas.filter((d) => d.changeKind === "added").length;
   const removed = deltas.filter((d) => d.changeKind === "removed").length;
   const modified = deltas.filter((d) => d.changeKind === "modified").length;
   const renamed = deltas.filter((d) => d.changeKind === "renamed").length;
   process.stderr.write(
-    chalk10.green(`\u2714 `) + `${deltas.length} changes: ` + chalk10.green(`+${added} added`) + ", " + chalk10.red(`-${removed} removed`) + ", " + chalk10.yellow(`~${modified} modified`) + ", " + chalk10.blue(`\u2192${renamed} renamed`) + "\n"
+    chalk12.green(`\u2714 `) + `${deltas.length} changes: ` + chalk12.green(`+${added} added`) + ", " + chalk12.red(`-${removed} removed`) + ", " + chalk12.yellow(`~${modified} modified`) + ", " + chalk12.blue(`\u2192${renamed} renamed`) + "\n"
   );
-  process.stderr.write(chalk10.dim(`  Written to ${outPath}
+  process.stderr.write(chalk12.dim(`  Written to ${outPath}
 `));
   if (opts.verbose && opts.stats) {
     let totalIns = 0;
@@ -4149,193 +4702,193 @@ var diffCommand = new Command9("diff").description("Compare two directory trees
         totalDel += d.stats.deletions;
       }
     }
-    process.stderr.write(chalk10.dim(`  Total: +${totalIns} insertions, -${totalDel} deletions
+    process.stderr.write(chalk12.dim(`  Total: +${totalIns} insertions, -${totalDel} deletions
 `));
   }
 });
 
 // src/commands/help.ts
-import { Command as Command10 } from "commander";
-import chalk11 from "chalk";
+import { Command as Command12 } from "commander";
+import chalk13 from "chalk";
 var HELP_URL = "https://vibgrate.com/help";
 function printFooter() {
   console.log("");
-  console.log(chalk11.dim(`See ${HELP_URL} for more guidance`));
+  console.log(chalk13.dim(`See ${HELP_URL} for more guidance`));
 }
 var detailedHelp = {
   scan: () => {
     console.log("");
-    console.log(chalk11.bold.underline("vibgrate scan") + chalk11.dim(" \u2014 Scan a project for upgrade drift"));
+    console.log(chalk13.bold.underline("vibgrate scan") + chalk13.dim(" \u2014 Scan a project for upgrade drift"));
     console.log("");
-    console.log(chalk11.bold("Usage:"));
+    console.log(chalk13.bold("Usage:"));
     console.log("  vibgrate scan [path] [options]");
     console.log("");
-    console.log(chalk11.bold("Arguments:"));
-    console.log(`  ${chalk11.cyan("[path]")}                       Path to scan (default: current directory)`);
+    console.log(chalk13.bold("Arguments:"));
+    console.log(`  ${chalk13.cyan("[path]")}                       Path to scan (default: current directory)`);
     console.log("");
-    console.log(chalk11.bold("Output options:"));
-    console.log(`  ${chalk11.cyan("--format <format>")}           Output format: ${chalk11.white("text")} | json | sarif | md  (default: text)`);
-    console.log(`  ${chalk11.cyan("--out <file>")}                Write output to a file instead of stdout`);
+    console.log(chalk13.bold("Output options:"));
+    console.log(`  ${chalk13.cyan("--format <format>")}           Output format: ${chalk13.white("text")} | json | sarif | md  (default: text)`);
+    console.log(`  ${chalk13.cyan("--out <file>")}                Write output to a file instead of stdout`);
     console.log("");
-    console.log(chalk11.bold("Baseline & gating:"));
-    console.log(`  ${chalk11.cyan("--baseline <file>")}           Compare results against a saved baseline`);
-    console.log(`  ${chalk11.cyan("--drift-budget <score>")}      Fail if drift score exceeds this value (0\u2013100)`);
-    console.log(`  ${chalk11.cyan("--drift-worsening <percent>")} Fail if drift worsens by more than % since baseline`);
-    console.log(`  ${chalk11.cyan("--fail-on <level>")}           Fail exit code on warn or error findings`);
+    console.log(chalk13.bold("Baseline & gating:"));
+    console.log(`  ${chalk13.cyan("--baseline <file>")}           Compare results against a saved baseline`);
+    console.log(`  ${chalk13.cyan("--drift-budget <score>")}      Fail if drift score exceeds this value (0\u2013100)`);
+    console.log(`  ${chalk13.cyan("--drift-worsening <percent>")} Fail if drift worsens by more than % since baseline`);
+    console.log(`  ${chalk13.cyan("--fail-on <level>")}           Fail exit code on warn or error findings`);
     console.log("");
-    console.log(chalk11.bold("Performance:"));
-    console.log(`  ${chalk11.cyan("--concurrency <n>")}           Max concurrent registry calls (default: 8)`);
-    console.log(`  ${chalk11.cyan("--changed-only")}              Only scan files changed since last git commit`);
+    console.log(chalk13.bold("Performance:"));
+    console.log(`  ${chalk13.cyan("--concurrency <n>")}           Max concurrent registry calls (default: 8)`);
+    console.log(`  ${chalk13.cyan("--changed-only")}              Only scan files changed since last git commit`);
     console.log("");
-    console.log(chalk11.bold("Privacy & offline:"));
-    console.log(`  ${chalk11.cyan("--offline")}                   Run without any network calls; skip result upload`);
-    console.log(`  ${chalk11.cyan("--package-manifest <file>")}   Use a local package-version manifest (JSON or ZIP) for offline mode`);
-    console.log(`  ${chalk11.cyan("--no-local-artifacts")}        Do not write .vibgrate JSON artifacts to disk`);
-    console.log(`  ${chalk11.cyan("--max-privacy")}               Strongest privacy mode: minimal scanners + no local artifacts`);
+    console.log(chalk13.bold("Privacy & offline:"));
+    console.log(`  ${chalk13.cyan("--offline")}                   Run without any network calls; skip result upload`);
+    console.log(`  ${chalk13.cyan("--package-manifest <file>")}   Use a local package-version manifest (JSON or ZIP) for offline mode`);
+    console.log(`  ${chalk13.cyan("--no-local-artifacts")}        Do not write .vibgrate JSON artifacts to disk`);
+    console.log(`  ${chalk13.cyan("--max-privacy")}               Strongest privacy mode: minimal scanners + no local artifacts`);
     console.log("");
-    console.log(chalk11.bold("Tooling:"));
-    console.log(`  ${chalk11.cyan("--install-tools")}             Auto-install missing security scanners via Homebrew`);
-    console.log(`  ${chalk11.cyan("--ui-purpose")}                Enable UI purpose evidence extraction (slower)`);
+    console.log(chalk13.bold("Tooling:"));
+    console.log(`  ${chalk13.cyan("--install-tools")}             Auto-install missing security scanners via Homebrew`);
+    console.log(`  ${chalk13.cyan("--ui-purpose")}                Enable UI purpose evidence extraction (slower)`);
     console.log("");
-    console.log(chalk11.bold("Uploading results:"));
-    console.log(`  ${chalk11.cyan("--push")}                      Auto-push results to Vibgrate API after scan`);
-    console.log(`  ${chalk11.cyan("--dsn <dsn>")}                 DSN token for push (or set VIBGRATE_DSN env var)`);
-    console.log(`  ${chalk11.cyan("--region <region>")}           Data residency region: us | eu  (default: us)`);
-    console.log(`  ${chalk11.cyan("--strict")}                    Fail if the upload to Vibgrate API fails`);
+    console.log(chalk13.bold("Uploading results:"));
+    console.log(`  ${chalk13.cyan("--push")}                      Auto-push results to Vibgrate API after scan`);
+    console.log(`  ${chalk13.cyan("--dsn <dsn>")}                 DSN token for push (or set VIBGRATE_DSN env var)`);
+    console.log(`  ${chalk13.cyan("--region <region>")}           Data residency region: us | eu  (default: us)`);
+    console.log(`  ${chalk13.cyan("--strict")}                    Fail if the upload to Vibgrate API fails`);
     console.log("");
-    console.log(chalk11.bold("Examples:"));
-    console.log(`  ${chalk11.dim("# Scan the current directory and display a text report")}`);
+    console.log(chalk13.bold("Examples:"));
+    console.log(`  ${chalk13.dim("# Scan the current directory and display a text report")}`);
     console.log("  vibgrate scan .");
     console.log("");
-    console.log(`  ${chalk11.dim("# Scan, fail if drift score > 40, and write SARIF for GitHub Actions")}`);
+    console.log(`  ${chalk13.dim("# Scan, fail if drift score > 40, and write SARIF for GitHub Actions")}`);
     console.log("  vibgrate scan . --drift-budget 40 --format sarif --out drift.sarif");
     console.log("");
-    console.log(`  ${chalk11.dim("# Scan and automatically upload results via a DSN")}`);
+    console.log(`  ${chalk13.dim("# Scan and automatically upload results via a DSN")}`);
     console.log("  vibgrate scan . --push --dsn $VIBGRATE_DSN");
     console.log("");
-    console.log(`  ${chalk11.dim("# Offline scan using a pre-downloaded package manifest")}`);
+    console.log(`  ${chalk13.dim("# Offline scan using a pre-downloaded package manifest")}`);
     console.log("  vibgrate scan . --offline --package-manifest ./manifest.zip");
   },
   init: () => {
     console.log("");
-    console.log(chalk11.bold.underline("vibgrate init") + chalk11.dim(" \u2014 Initialise vibgrate in a project directory"));
+    console.log(chalk13.bold.underline("vibgrate init") + chalk13.dim(" \u2014 Initialise vibgrate in a project directory"));
     console.log("");
-    console.log(chalk11.bold("Usage:"));
+    console.log(chalk13.bold("Usage:"));
     console.log("  vibgrate init [path] [options]");
     console.log("");
-    console.log(chalk11.bold("Arguments:"));
-    console.log(`  ${chalk11.cyan("[path]")}          Directory to initialise (default: current directory)`);
+    console.log(chalk13.bold("Arguments:"));
+    console.log(`  ${chalk13.cyan("[path]")}          Directory to initialise (default: current directory)`);
     console.log("");
-    console.log(chalk11.bold("Options:"));
-    console.log(`  ${chalk11.cyan("--baseline")}      Create an initial drift baseline after init`);
-    console.log(`  ${chalk11.cyan("--yes")}           Skip all confirmation prompts`);
+    console.log(chalk13.bold("Options:"));
+    console.log(`  ${chalk13.cyan("--baseline")}      Create an initial drift baseline after init`);
+    console.log(`  ${chalk13.cyan("--yes")}           Skip all confirmation prompts`);
     console.log("");
-    console.log(chalk11.bold("What it does:"));
+    console.log(chalk13.bold("What it does:"));
     console.log("  \u2022 Creates a .vibgrate/ directory");
     console.log("  \u2022 Writes a vibgrate.config.ts starter config");
     console.log("  \u2022 Optionally runs an initial baseline scan (--baseline)");
     console.log("");
-    console.log(chalk11.bold("Examples:"));
+    console.log(chalk13.bold("Examples:"));
     console.log("  vibgrate init");
     console.log("  vibgrate init ./my-project --baseline");
   },
   baseline: () => {
     console.log("");
-    console.log(chalk11.bold.underline("vibgrate baseline") + chalk11.dim(" \u2014 Save a drift baseline snapshot"));
+    console.log(chalk13.bold.underline("vibgrate baseline") + chalk13.dim(" \u2014 Save a drift baseline snapshot"));
     console.log("");
-    console.log(chalk11.bold("Usage:"));
+    console.log(chalk13.bold("Usage:"));
     console.log("  vibgrate baseline [path]");
     console.log("");
-    console.log(chalk11.bold("Arguments:"));
-    console.log(`  ${chalk11.cyan("[path]")}   Path to baseline (default: current directory)`);
+    console.log(chalk13.bold("Arguments:"));
+    console.log(`  ${chalk13.cyan("[path]")}   Path to baseline (default: current directory)`);
     console.log("");
-    console.log(chalk11.bold("What it does:"));
+    console.log(chalk13.bold("What it does:"));
     console.log("  Runs a full scan and saves the result as .vibgrate/baseline.json.");
     console.log("  Future scans can compare against this file using --baseline.");
     console.log("");
-    console.log(chalk11.bold("Examples:"));
+    console.log(chalk13.bold("Examples:"));
     console.log("  vibgrate baseline .");
     console.log("  vibgrate scan . --baseline .vibgrate/baseline.json --drift-worsening 10");
   },
   report: () => {
     console.log("");
-    console.log(chalk11.bold.underline("vibgrate report") + chalk11.dim(" \u2014 Generate a report from a saved scan artifact"));
+    console.log(chalk13.bold.underline("vibgrate report") + chalk13.dim(" \u2014 Generate a report from a saved scan artifact"));
     console.log("");
-    console.log(chalk11.bold("Usage:"));
+    console.log(chalk13.bold("Usage:"));
     console.log("  vibgrate report [options]");
     console.log("");
-    console.log(chalk11.bold("Options:"));
-    console.log(`  ${chalk11.cyan("--in <file>")}        Input artifact file (default: .vibgrate/scan_result.json)`);
-    console.log(`  ${chalk11.cyan("--format <format>")}  Output format: ${chalk11.white("text")} | md | json  (default: text)`);
+    console.log(chalk13.bold("Options:"));
+    console.log(`  ${chalk13.cyan("--in <file>")}        Input artifact file (default: .vibgrate/scan_result.json)`);
+    console.log(`  ${chalk13.cyan("--format <format>")}  Output format: ${chalk13.white("text")} | md | json  (default: text)`);
     console.log("");
-    console.log(chalk11.bold("Examples:"));
+    console.log(chalk13.bold("Examples:"));
     console.log("  vibgrate report");
     console.log("  vibgrate report --format md > DRIFT-REPORT.md");
     console.log("  vibgrate report --in ./ci/scan_result.json --format json");
   },
   sbom: () => {
     console.log("");
-    console.log(chalk11.bold.underline("vibgrate sbom") + chalk11.dim(" \u2014 Export a Software Bill of Materials from a scan artifact"));
+    console.log(chalk13.bold.underline("vibgrate sbom") + chalk13.dim(" \u2014 Export a Software Bill of Materials from a scan artifact"));
     console.log("");
-    console.log(chalk11.bold("Usage:"));
+    console.log(chalk13.bold("Usage:"));
     console.log("  vibgrate sbom [options]");
     console.log("");
-    console.log(chalk11.bold("Options:"));
-    console.log(`  ${chalk11.cyan("--in <file>")}        Input artifact (default: .vibgrate/scan_result.json)`);
-    console.log(`  ${chalk11.cyan("--format <format>")}  SBOM format: ${chalk11.white("cyclonedx")} | spdx  (default: cyclonedx)`);
-    console.log(`  ${chalk11.cyan("--out <file>")}       Write SBOM to file instead of stdout`);
+    console.log(chalk13.bold("Options:"));
+    console.log(`  ${chalk13.cyan("--in <file>")}        Input artifact (default: .vibgrate/scan_result.json)`);
+    console.log(`  ${chalk13.cyan("--format <format>")}  SBOM format: ${chalk13.white("cyclonedx")} | spdx  (default: cyclonedx)`);
+    console.log(`  ${chalk13.cyan("--out <file>")}       Write SBOM to file instead of stdout`);
     console.log("");
-    console.log(chalk11.bold("Examples:"));
+    console.log(chalk13.bold("Examples:"));
     console.log("  vibgrate sbom --format cyclonedx --out sbom.json");
     console.log("  vibgrate sbom --format spdx --out sbom.spdx.json");
   },
   push: () => {
     console.log("");
-    console.log(chalk11.bold.underline("vibgrate push") + chalk11.dim(" \u2014 Upload a scan artifact to the Vibgrate API"));
+    console.log(chalk13.bold.underline("vibgrate push") + chalk13.dim(" \u2014 Upload a scan artifact to the Vibgrate API"));
     console.log("");
-    console.log(chalk11.bold("Usage:"));
+    console.log(chalk13.bold("Usage:"));
     console.log("  vibgrate push [options]");
     console.log("");
-    console.log(chalk11.bold("Options:"));
-    console.log(`  ${chalk11.cyan("--dsn <dsn>")}        DSN token (or set VIBGRATE_DSN env var)`);
-    console.log(`  ${chalk11.cyan("--file <file>")}      Artifact to upload (default: .vibgrate/scan_result.json)`);
-    console.log(`  ${chalk11.cyan("--region <region>")}  Override data residency region: us | eu`);
-    console.log(`  ${chalk11.cyan("--strict")}           Fail with non-zero exit code on upload error`);
+    console.log(chalk13.bold("Options:"));
+    console.log(`  ${chalk13.cyan("--dsn <dsn>")}        DSN token (or set VIBGRATE_DSN env var)`);
+    console.log(`  ${chalk13.cyan("--file <file>")}      Artifact to upload (default: .vibgrate/scan_result.json)`);
+    console.log(`  ${chalk13.cyan("--region <region>")}  Override data residency region: us | eu`);
+    console.log(`  ${chalk13.cyan("--strict")}           Fail with non-zero exit code on upload error`);
     console.log("");
-    console.log(chalk11.bold("Examples:"));
+    console.log(chalk13.bold("Examples:"));
     console.log("  vibgrate push --dsn $VIBGRATE_DSN");
     console.log("  vibgrate push --file ./ci/scan_result.json --strict");
   },
   dsn: () => {
     console.log("");
-    console.log(chalk11.bold.underline("vibgrate dsn") + chalk11.dim(" \u2014 Manage DSN tokens for API authentication"));
+    console.log(chalk13.bold.underline("vibgrate dsn") + chalk13.dim(" \u2014 Manage DSN tokens for API authentication"));
     console.log("");
-    console.log(chalk11.bold("Subcommands:"));
-    console.log(`  ${chalk11.cyan("vibgrate dsn create")}   Generate a new DSN token`);
+    console.log(chalk13.bold("Subcommands:"));
+    console.log(`  ${chalk13.cyan("vibgrate dsn create")}   Generate a new DSN token`);
     console.log("");
-    console.log(chalk11.bold("dsn create options:"));
-    console.log(`  ${chalk11.cyan("--workspace <id>")}   Workspace ID or "new" to auto-generate ${chalk11.red("(required)")}`);
-    console.log(`  ${chalk11.cyan("--region <region>")}  Data residency region: us | eu  (default: us)`);
-    console.log(`  ${chalk11.cyan("--ingest <url>")}     Override ingest API URL`);
-    console.log(`  ${chalk11.cyan("--write <path>")}     Write the DSN to a file (add to .gitignore!)`);
+    console.log(chalk13.bold("dsn create options:"));
+    console.log(`  ${chalk13.cyan("--workspace <id>")}   Workspace ID or "new" to auto-generate ${chalk13.red("(required)")}`);
+    console.log(`  ${chalk13.cyan("--region <region>")}  Data residency region: us | eu  (default: us)`);
+    console.log(`  ${chalk13.cyan("--ingest <url>")}     Override ingest API URL`);
+    console.log(`  ${chalk13.cyan("--write <path>")}     Write the DSN to a file (add to .gitignore!)`);
     console.log("");
-    console.log(chalk11.bold("Examples:"));
+    console.log(chalk13.bold("Examples:"));
     console.log("  vibgrate dsn create --workspace new");
     console.log("  vibgrate dsn create --workspace abc123");
     console.log("  vibgrate dsn create --workspace new --region eu --write .vibgrate/.dsn");
   },
   update: () => {
     console.log("");
-    console.log(chalk11.bold.underline("vibgrate update") + chalk11.dim(" \u2014 Update the vibgrate CLI to the latest version"));
+    console.log(chalk13.bold.underline("vibgrate update") + chalk13.dim(" \u2014 Update the vibgrate CLI to the latest version"));
     console.log("");
-    console.log(chalk11.bold("Usage:"));
+    console.log(chalk13.bold("Usage:"));
     console.log("  vibgrate update [options]");
     console.log("");
-    console.log(chalk11.bold("Options:"));
-    console.log(`  ${chalk11.cyan("--check")}         Check for a newer version without installing`);
-    console.log(`  ${chalk11.cyan("--pm <manager>")} Force a package manager: npm | pnpm | yarn | bun`);
+    console.log(chalk13.bold("Options:"));
+    console.log(`  ${chalk13.cyan("--check")}         Check for a newer version without installing`);
+    console.log(`  ${chalk13.cyan("--pm <manager>")} Force a package manager: npm | pnpm | yarn | bun`);
     console.log("");
-    console.log(chalk11.bold("Examples:"));
+    console.log(chalk13.bold("Examples:"));
     console.log("  vibgrate update");
     console.log("  vibgrate update --check");
     console.log("  vibgrate update --pm pnpm");
@@ -4343,40 +4896,42 @@ var detailedHelp = {
 };
 function printSummaryHelp() {
   console.log("");
-  console.log(chalk11.bold("vibgrate") + chalk11.dim(" \u2014 Continuous Drift Intelligence"));
+  console.log(chalk13.bold("vibgrate") + chalk13.dim(" \u2014 Continuous Drift Intelligence"));
   console.log("");
-  console.log(chalk11.bold("Usage:"));
+  console.log(chalk13.bold("Usage:"));
   console.log("  vibgrate <command> [options]");
   console.log("  vibgrate help [command]     Show detailed help for a command");
   console.log("");
-  console.log(chalk11.bold("Getting started:"));
-  console.log(`  ${chalk11.cyan("init")}       Initialise vibgrate in a project (creates config & .vibgrate/ dir)`);
+  console.log(chalk13.bold("Getting started:"));
+  console.log(`  ${chalk13.cyan("init")}       Initialise vibgrate in a project (creates config & .vibgrate/ dir)`);
+  console.log(`  ${chalk13.cyan("login")}      Sign the CLI into your workspace via the browser`);
+  console.log(`  ${chalk13.cyan("logout")}     Clear stored login credentials`);
   console.log("");
-  console.log(chalk11.bold("Core scanning:"));
-  console.log(`  ${chalk11.cyan("scan")}       Scan a project for upgrade drift and generate a report`);
-  console.log(`  ${chalk11.cyan("baseline")}   Save a baseline snapshot to compare future scans against`);
+  console.log(chalk13.bold("Core scanning:"));
+  console.log(`  ${chalk13.cyan("scan")}       Scan a project for upgrade drift and generate a report`);
+  console.log(`  ${chalk13.cyan("baseline")}   Save a baseline snapshot to compare future scans against`);
   console.log("");
-  console.log(chalk11.bold("Reporting & export:"));
-  console.log(`  ${chalk11.cyan("report")}     Re-generate a report from a previously saved scan artifact`);
-  console.log(`  ${chalk11.cyan("sbom")}       Export a Software Bill of Materials (CycloneDX or SPDX)`);
+  console.log(chalk13.bold("Reporting & export:"));
+  console.log(`  ${chalk13.cyan("report")}     Re-generate a report from a previously saved scan artifact`);
+  console.log(`  ${chalk13.cyan("sbom")}       Export a Software Bill of Materials (CycloneDX or SPDX)`);
   console.log("");
-  console.log(chalk11.bold("CI/CD integration:"));
-  console.log(`  ${chalk11.cyan("push")}       Upload a scan artifact to the Vibgrate API`);
-  console.log(`  ${chalk11.cyan("dsn")}        Create and manage DSN tokens for API authentication`);
+  console.log(chalk13.bold("CI/CD integration:"));
+  console.log(`  ${chalk13.cyan("push")}       Upload a scan artifact to the Vibgrate API`);
+  console.log(`  ${chalk13.cyan("dsn")}        Create and manage DSN tokens for API authentication`);
   console.log("");
-  console.log(chalk11.bold("Maintenance:"));
-  console.log(`  ${chalk11.cyan("update")}     Update the vibgrate CLI to the latest version`);
+  console.log(chalk13.bold("Maintenance:"));
+  console.log(`  ${chalk13.cyan("update")}     Update the vibgrate CLI to the latest version`);
   console.log("");
-  console.log(chalk11.dim("Run") + ` ${chalk11.cyan("vibgrate help <command>")} ` + chalk11.dim("for detailed options, e.g.") + ` ${chalk11.cyan("vibgrate help scan")}`);
+  console.log(chalk13.dim("Run") + ` ${chalk13.cyan("vibgrate help <command>")} ` + chalk13.dim("for detailed options, e.g.") + ` ${chalk13.cyan("vibgrate help scan")}`);
 }
-var helpCommand = new Command10("help").description("Show help for vibgrate commands").argument("[command]", "Command to show detailed help for").helpOption(false).action((cmd) => {
+var helpCommand = new Command12("help").description("Show help for vibgrate commands").argument("[command]", "Command to show detailed help for").helpOption(false).action((cmd) => {
   const name = cmd?.toLowerCase().trim();
   if (name && detailedHelp[name]) {
     detailedHelp[name]();
   } else if (name) {
     console.log("");
-    console.log(chalk11.red(`Unknown command: ${name}`));
-    console.log(chalk11.dim(`Available commands: ${Object.keys(detailedHelp).join(", ")}`));
+    console.log(chalk13.red(`Unknown command: ${name}`));
+    console.log(chalk13.dim(`Available commands: ${Object.keys(detailedHelp).join(", ")}`));
     printSummaryHelp();
   } else {
     printSummaryHelp();
@@ -4385,13 +4940,15 @@ var helpCommand = new Command10("help").description("Show help for vibgrate comm
 });
 
 // src/cli.ts
-var program = new Command11();
+var program = new Command13();
 program.name("vibgrate").description("Continuous Drift Intelligence").version(VERSION).addHelpText("after", "\nSee https://vibgrate.com/help for more guidance");
 program.addCommand(helpCommand);
 program.addCommand(initCommand);
 program.addCommand(scanCommand);
 program.addCommand(baselineCommand);
 program.addCommand(reportCommand);
+program.addCommand(loginCommand);
+program.addCommand(logoutCommand);
 program.addCommand(dsnCommand);
 program.addCommand(pushCommand);
 program.addCommand(updateCommand);
@@ -4402,8 +4959,8 @@ function notifyIfUpdateAvailable() {
   void checkForUpdate().then((update) => {
     if (!update?.updateAvailable) return;
     console.error("");
-    console.error(chalk12.yellow(`  Update available: ${update.current} \u2192 ${update.latest}`));
-    console.error(chalk12.dim('  Run "vibgrate update" to install the latest version.'));
+    console.error(chalk14.yellow(`  Update available: ${update.current} \u2192 ${update.latest}`));
+    console.error(chalk14.dim('  Run "vibgrate update" to install the latest version.'));
     console.error("");
   }).catch(() => {
   });