@vibgrate/cli 2026.615.4 → 2026.618.1

package/dist/cli.js

@@ -6,7 +6,7 @@ import {
   pathExists,
   readJsonFile,
   writeTextFile
-} from "./chunk-73LQST7Q.js";
+} from "./chunk-LWB7JBWP.js";
 import {
   computeRepoFingerprint,
   detectVcs,
@@ -16,7 +16,7 @@ import {
   resolveRepositoryName,
   runScan,
   writeDefaultConfig
-} from "./chunk-BFNY2AXU.js";
+} from "./chunk-BMLE722B.js";
 import {
   require_semver
 } from "./chunk-5IXVOEZN.js";
@@ -29,8 +29,8 @@ import {
 } from "./chunk-JSBRDJBE.js";
 
 // src/cli.ts
-import { Command as Command11 } from "commander";
-import chalk12 from "chalk";
+import { Command as Command13 } from "commander";
+import chalk15 from "chalk";
 
 // src/commands/init.ts
 import * as path from "path";
@@ -49,7 +49,7 @@ var initCommand = new Command("init").description("Initialize vibgrate in a proj
     console.log(chalk.green("\u2714") + ` Created ${chalk.bold("vibgrate.config.ts")}`);
   }
   if (opts.baseline) {
-    const { runBaseline } = await import("./baseline-YSQVPA3L.js");
+    const { runBaseline } = await import("./baseline-K2GQA6G5.js");
     await runBaseline(rootDir);
   }
   console.log("");
@@ -60,9 +60,9 @@ var initCommand = new Command("init").description("Initialize vibgrate in a proj
 });
 
 // src/commands/scan.ts
-import * as path3 from "path";
+import * as path4 from "path";
 import { Command as Command3 } from "commander";
-import chalk3 from "chalk";
+import chalk4 from "chalk";
 
 // src/version.ts
 import { createRequire } from "module";
@@ -129,6 +129,9 @@ function dashHostForIngestHost(ingestHost) {
   const match = REGIONS.find((r) => r.ingestHost === ingestHost);
   return match?.dashHost ?? "dash.vibgrate.com";
 }
+function ingestHostForRegionId(region) {
+  return findRegion(region.toLowerCase())?.ingestHost;
+}
 
 // src/commands/dsn.ts
 async function provisionDsn(keyId, secret, workspaceId, ingestHost, region) {
@@ -210,6 +213,49 @@ dsnCommand.command("create").description("Create a new DSN token").option("--ing
   }
 });
 
+// src/credentials.ts
+import * as os from "os";
+import * as path3 from "path";
+import * as fs from "fs";
+function credentialsDir() {
+  return path3.join(os.homedir(), ".vibgrate");
+}
+function credentialsPath() {
+  return path3.join(credentialsDir(), "credentials.json");
+}
+function readStoredCredentials() {
+  try {
+    const raw = fs.readFileSync(credentialsPath(), "utf8");
+    const parsed = JSON.parse(raw);
+    return parsed && typeof parsed.dsn === "string" && parsed.dsn ? parsed : null;
+  } catch {
+    return null;
+  }
+}
+function writeStoredCredentials(creds) {
+  const dir = credentialsDir();
+  fs.mkdirSync(dir, { recursive: true });
+  const file = credentialsPath();
+  fs.writeFileSync(file, JSON.stringify(creds, null, 2) + "\n", "utf8");
+  try {
+    fs.chmodSync(file, 384);
+  } catch {
+  }
+}
+function clearStoredCredentials() {
+  try {
+    fs.rmSync(credentialsPath());
+    return true;
+  } catch {
+    return false;
+  }
+}
+function resolveDsn(explicitDsn) {
+  if (explicitDsn) return explicitDsn;
+  if (process.env.VIBGRATE_DSN) return process.env.VIBGRATE_DSN;
+  return readStoredCredentials()?.dsn ?? void 0;
+}
+
 // src/utils/ingest-id-output.ts
 function emitIngestIdLine(ingestId, options) {
   console.log(`VIBGRATE_INGEST_ID=${ingestId}`);
@@ -218,18 +264,62 @@ function emitIngestIdLine(ingestId, options) {
   }
 }
 
+// src/utils/upload.ts
+import chalk3 from "chalk";
+function postOnce(input, host) {
+  const url = `${input.scheme}://${host}/v1/ingest/scan`;
+  return fetch(url, {
+    method: "POST",
+    headers: {
+      "Content-Type": "application/json",
+      "Content-Encoding": input.contentEncoding,
+      "X-Vibgrate-Timestamp": input.timestamp,
+      "Authorization": `VibgrateDSN ${input.keyId}:${input.secret}`,
+      "Connection": "close"
+      // Prevent keep-alive delays on exit
+    },
+    body: input.body
+  });
+}
+async function regionRedirectHost(response) {
+  try {
+    const payload = await response.clone().json();
+    if (payload?.code !== "REGION_MISMATCH" || !payload.region) return void 0;
+    return ingestHostForRegionId(payload.region);
+  } catch {
+    return void 0;
+  }
+}
+async function uploadScanArtifact(input) {
+  let host = input.host;
+  let response = await postOnce(input, host);
+  if (response.status === 409) {
+    const target = await regionRedirectHost(response);
+    if (target && target !== host) {
+      console.log(
+        chalk3.yellow(
+          `\u21BB Workspace is pinned to a different region \u2014 retrying upload to ${target}...`
+        )
+      );
+      host = target;
+      response = await postOnce(input, host);
+    }
+  }
+  return { response, host };
+}
+
 // src/commands/scan.ts
 async function autoPush(artifact, rootDir, opts) {
-  const dsn = opts.dsn || process.env.VIBGRATE_DSN;
+  const dsn = resolveDsn(opts.dsn);
   if (!dsn) {
-    console.error(chalk3.red("No DSN provided for push."));
-    console.error(chalk3.dim("Set VIBGRATE_DSN environment variable or use --dsn flag."));
+    console.error(chalk4.red("No DSN provided for push."));
+    console.error(chalk4.dim('Run "vibgrate login", set VIBGRATE_DSN, or use the --dsn flag.'));
     if (opts.strict) process.exit(1);
     return;
   }
   const parsed = parseDsn(dsn);
   if (!parsed) {
-    console.error(chalk3.red("Invalid DSN format."));
+    console.error(chalk4.red("Invalid DSN format."));
     if (opts.strict) process.exit(1);
     return;
   }
@@ -240,29 +330,26 @@ async function autoPush(artifact, rootDir, opts) {
     try {
       host = resolveIngestHost(opts.region);
     } catch (e) {
-      console.error(chalk3.red(e instanceof Error ? e.message : String(e)));
+      console.error(chalk4.red(e instanceof Error ? e.message : String(e)));
       if (opts.strict) process.exit(1);
       return;
     }
   }
-  const url = `${parsed.scheme}://${host}/v1/ingest/scan`;
   const originalSize = JSON.stringify(artifact).length;
   const compressedSize = body.length;
   const ratio = ((1 - compressedSize / originalSize) * 100).toFixed(0);
-  console.log(chalk3.dim(`Uploading to ${host}... (${(compressedSize / 1024).toFixed(0)} KB, ${ratio}% smaller)`));
+  console.log(chalk4.dim(`Uploading to ${host}... (${(compressedSize / 1024).toFixed(0)} KB, ${ratio}% smaller)`));
   try {
-    const response = await fetch(url, {
-      method: "POST",
-      headers: {
-        "Content-Type": "application/json",
-        "Content-Encoding": contentEncoding,
-        "X-Vibgrate-Timestamp": timestamp,
-        "Authorization": `VibgrateDSN ${parsed.keyId}:${parsed.secret}`,
-        "Connection": "close"
-        // Prevent keep-alive delays on exit
-      },
-      body
+    const { response, host: uploadedHost } = await uploadScanArtifact({
+      scheme: parsed.scheme,
+      host,
+      keyId: parsed.keyId,
+      secret: parsed.secret,
+      body,
+      contentEncoding,
+      timestamp
     });
+    host = uploadedHost;
     if (!response.ok) {
       const text = await response.text();
       throw new Error(`HTTP ${response.status}: ${text}`);
@@ -270,36 +357,36 @@ async function autoPush(artifact, rootDir, opts) {
     const result = await response.json();
     if (result.unchanged) {
       console.log(
-        chalk3.green("\u2714") + ` Repository unchanged since ${result.lastScannedAt ?? "last scan"} \u2014 skipped upload (no credit used).`
+        chalk4.green("\u2714") + ` Repository unchanged since ${result.lastScannedAt ?? "last scan"} \u2014 skipped upload (no credit used).`
       );
       if (result.previousIngestId) {
         emitIngestIdLine(result.previousIngestId, { unchanged: true });
-        const dashUrl = `https://dash.vibgrate.com/${parsed.workspaceId}/scan/${result.previousIngestId}`;
-        console.log(chalk3.dim(`  Previous report: ${dashUrl}`));
+        const dashUrl = `https://${dashHostForIngestHost(host)}/${parsed.workspaceId}/scan/${result.previousIngestId}`;
+        console.log(chalk4.dim(`  Previous report: ${dashUrl}`));
       } else if (opts.strict) {
-        console.error(chalk3.red("Repository unchanged but no previous ingest id returned."));
+        console.error(chalk4.red("Repository unchanged but no previous ingest id returned."));
         process.exit(1);
       }
       return;
     }
-    console.log(chalk3.green("\u2714") + ` Scan queued for processing (${result.ingestId ?? "ok"})`);
+    console.log(chalk4.green("\u2714") + ` Scan queued for processing (${result.ingestId ?? "ok"})`);
     if (result.ingestId) {
       emitIngestIdLine(result.ingestId);
-      const dashUrl = `https://dash.vibgrate.com/${parsed.workspaceId}/scan/${result.ingestId}`;
+      const dashUrl = `https://${dashHostForIngestHost(host)}/${parsed.workspaceId}/scan/${result.ingestId}`;
       const CLEAR_LINE = process.platform === "win32" ? "\x1B[0G\x1B[2K" : "";
       console.log("");
-      console.log(CLEAR_LINE + chalk3.dim("  Processing continues in the background. Results available shortly."));
+      console.log(CLEAR_LINE + chalk4.dim("  Processing continues in the background. Results available shortly."));
       console.log("");
-      console.log(CLEAR_LINE + chalk3.cyan("\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500"));
-      console.log(CLEAR_LINE + chalk3.bold("  \u{1F4CA} View Scan Report"));
-      console.log(CLEAR_LINE + "  " + chalk3.underline.cyan(dashUrl));
-      console.log(CLEAR_LINE + chalk3.cyan("\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500"));
+      console.log(CLEAR_LINE + chalk4.cyan("\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500"));
+      console.log(CLEAR_LINE + chalk4.bold("  \u{1F4CA} View Scan Report"));
+      console.log(CLEAR_LINE + "  " + chalk4.underline.cyan(dashUrl));
+      console.log(CLEAR_LINE + chalk4.cyan("\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500"));
       console.log("");
       console.log("");
     }
   } catch (e) {
     const msg = e instanceof Error ? e.message : String(e);
-    console.error(chalk3.red(`Upload failed: ${msg}`));
+    console.error(chalk4.red(`Upload failed: ${msg}`));
     if (opts.strict) process.exit(1);
   }
 }
@@ -320,15 +407,16 @@ var scanCommand = new Command3("scan").description("Scan a project for upgrade d
   collectExcludes,
   []
 ).option("--concurrency <n>", "Max concurrent npm calls", "8").option("--push", "Auto-push results to Vibgrate API after scan").option("--dsn <dsn>", "DSN token for push (or use VIBGRATE_DSN env)").option("--region <region>", "Override data residency region for push (us, eu)").option("--strict", "Fail on push errors").option("--ui-purpose", "Enable optional UI purpose evidence extraction (slower)").option("--no-local-artifacts", "Do not write .vibgrate JSON artifacts to disk").option("--max-privacy", "Enable strongest privacy mode (minimal scanners, no local artifacts)").option("--offline", "Run without network calls; do not upload results").option("--package-manifest <file>", "Use local package-version manifest JSON/ZIP (for offline mode)").option("--project-scan-timeout <seconds>", "Per-project scan timeout in seconds (default: 180)").option("--drift-budget <score>", "Fail if drift score is above budget (0-100)").option("--drift-worsening <percent>", "Fail if drift worsens by more than % since baseline").action(async (targetPath, opts) => {
-  const rootDir = path3.resolve(targetPath);
+  const rootDir = path4.resolve(targetPath);
   if (!await pathExists2(rootDir)) {
-    console.error(chalk3.red(`Path does not exist: ${rootDir}`));
+    console.error(chalk4.red(`Path does not exist: ${rootDir}`));
     process.exit(1);
   }
-  const hasDsn = !!(opts.dsn || process.env.VIBGRATE_DSN);
+  const hasDsn = !!resolveDsn(opts.dsn);
   const willPush = !opts.offline && (opts.push || hasDsn);
+  let pinnedRegion;
   if (willPush && hasDsn) {
-    const dsn = opts.dsn || process.env.VIBGRATE_DSN;
+    const dsn = resolveDsn(opts.dsn);
     const parsed = parseDsn(dsn);
     if (parsed) {
       const ingestHost = opts.region ? resolveIngestHost(opts.region) : parsed.host;
@@ -340,10 +428,20 @@ var scanCommand = new Command3("scan").description("Scan a project for upgrade d
           repositoryName,
           vcsSha: fingerprint.vcsSha
         });
+        pinnedRegion = preflight.region;
+        if (preflight.vm && !preflight.vm.allowed) {
+          console.error(chalk4.red(preflight.error ?? "VM meter usage exhausted"));
+          console.error(
+            chalk4.dim(
+              `VM minutes: ${preflight.vm.used}/${preflight.vm.limit} (${preflight.plan.label} plan) \u2014 enable overages or upgrade your plan.`
+            )
+          );
+          process.exit(1);
+        }
         if (preflight.status === "error" || !preflight.scans.allowed) {
-          console.error(chalk3.red(preflight.error ?? "Scan ingestion not allowed for this workspace."));
+          console.error(chalk4.red(preflight.error ?? "Scan ingestion not allowed for this workspace."));
           console.error(
-            chalk3.dim(
+            chalk4.dim(
               `Credits: ${preflight.scans.used}/${preflight.scans.limit} (${preflight.plan.label} plan)`
             )
           );
@@ -351,27 +449,27 @@ var scanCommand = new Command3("scan").description("Scan a project for upgrade d
           process.exit(1);
         }
         console.log(
-          chalk3.dim(
+          chalk4.dim(
             `Plan: ${preflight.plan.label} \u2014 scan credits ${preflight.scans.used}/${preflight.scans.limit} this month`
           )
         );
         if (preflight.repository?.unchanged) {
           console.log(
-            chalk3.green("\u2714") + ` Repository unchanged at ${preflight.repository.lastVcsSha?.slice(0, 7) ?? "same revision"} \u2014 skipping scan.`
+            chalk4.green("\u2714") + ` Repository unchanged at ${preflight.repository.lastVcsSha?.slice(0, 7) ?? "same revision"} \u2014 skipping scan.`
           );
           if (preflight.repository.lastIngestId) {
             emitIngestIdLine(preflight.repository.lastIngestId, { unchanged: true });
-            const dashUrl = `https://dash.vibgrate.com/${parsed.workspaceId}/scan/${preflight.repository.lastIngestId}`;
-            console.log(chalk3.dim(`  Latest report: ${dashUrl}`));
+            const dashUrl = `https://${dashHostForIngestHost(ingestHost)}/${parsed.workspaceId}/scan/${preflight.repository.lastIngestId}`;
+            console.log(chalk4.dim(`  Latest report: ${dashUrl}`));
           } else if (opts.strict) {
-            console.error(chalk3.red("Repository unchanged but no previous ingest id available."));
+            console.error(chalk4.red("Repository unchanged but no previous ingest id available."));
             process.exit(1);
           }
           return;
         }
       } catch (e) {
         const msg = e instanceof Error ? e.message : String(e);
-        console.error(chalk3.yellow(`Preflight check failed: ${msg}`));
+        console.error(chalk4.yellow(`Preflight check failed: ${msg}`));
         if (opts.strict) process.exit(1);
       }
     }
@@ -387,7 +485,9 @@ var scanCommand = new Command3("scan").description("Scan a project for upgrade d
     concurrency: parseInt(opts.concurrency, 10) || 8,
     push: opts.push,
     dsn: opts.dsn,
-    region: opts.region,
+    // An explicit --region wins; otherwise route to the workspace's pinned
+    // region as reported by preflight.
+    region: opts.region ?? pinnedRegion,
     strict: opts.strict,
     uiPurpose: opts.uiPurpose,
     noLocalArtifacts: opts.noLocalArtifacts,
@@ -403,24 +503,24 @@ var scanCommand = new Command3("scan").description("Scan a project for upgrade d
     const hasErrors = artifact.findings.some((f) => f.level === "error");
     const hasWarnings = artifact.findings.some((f) => f.level === "warning");
     if (opts.failOn === "error" && hasErrors) {
-      console.error(chalk3.red(`
+      console.error(chalk4.red(`
 Failing: ${artifact.findings.filter((f) => f.level === "error").length} error finding(s) detected.`));
       process.exit(2);
     }
     if (opts.failOn === "warn" && (hasErrors || hasWarnings)) {
-      console.error(chalk3.red(`
+      console.error(chalk4.red(`
 Failing: findings detected at warn level or above.`));
       process.exit(2);
     }
   }
   if (scanOpts.driftBudget !== void 0 && artifact.drift.score > scanOpts.driftBudget) {
-    console.error(chalk3.red(`
+    console.error(chalk4.red(`
 Failing fitness function: drift score ${artifact.drift.score}/100 exceeds budget ${scanOpts.driftBudget}.`));
     process.exit(2);
   }
   if (scanOpts.driftWorseningPercent !== void 0) {
     if (artifact.delta === void 0) {
-      console.error(chalk3.red("\nFailing fitness function: --drift-worsening requires --baseline to compare against previous drift."));
+      console.error(chalk4.red("\nFailing fitness function: --drift-worsening requires --baseline to compare against previous drift."));
       process.exit(2);
     }
     if (artifact.delta > 0) {
@@ -428,7 +528,7 @@ Failing fitness function: drift score ${artifact.drift.score}/100 exceeds budget
       const denominator = Math.max(Math.abs(baselineScore), 1e-4);
       const worseningPercent = artifact.delta / denominator * 100;
       if (worseningPercent > scanOpts.driftWorseningPercent) {
-        console.error(chalk3.red(`
+        console.error(chalk4.red(`
 Failing fitness function: drift worsened by ${worseningPercent.toFixed(2)}% (threshold ${scanOpts.driftWorseningPercent}%).`));
         process.exit(2);
       }
@@ -440,30 +540,30 @@ Failing fitness function: drift worsened by ${worseningPercent.toFixed(2)}% (thr
 });
 
 // src/commands/report.ts
-import * as path4 from "path";
+import * as path5 from "path";
 import { Command as Command4 } from "commander";
-import chalk5 from "chalk";
+import chalk6 from "chalk";
 
 // src/formatters/text.ts
-import chalk4 from "chalk";
+import chalk5 from "chalk";
 function formatText(artifact) {
   const lines = [];
-  const teal = chalk4.hex("#3FB0A4");
-  const mint = chalk4.hex("#4FE3C1");
+  const teal = chalk5.hex("#3FB0A4");
+  const mint = chalk5.hex("#4FE3C1");
   lines.push("");
   lines.push("   " + teal("\u256D\u2500\u2500\u2500\u2500\u2500\u2500\u256E") + mint("\u279C"));
-  lines.push("  " + chalk4.dim("\u2524") + teal("\u2502") + " " + mint("\u25FC") + "  " + mint("\u25FC") + " " + teal("\u2502") + chalk4.dim("\u251C") + "  " + chalk4.bold.white("vibgrate"));
-  lines.push("  " + chalk4.dim("\u2524") + teal("\u2502") + "  " + chalk4.dim("\u2581\u2581") + "  " + teal("\u2502") + chalk4.dim("\u251C") + "  " + chalk4.dim(`Drift Intelligence Engine v${VERSION}`));
+  lines.push("  " + chalk5.dim("\u2524") + teal("\u2502") + " " + mint("\u25FC") + "  " + mint("\u25FC") + " " + teal("\u2502") + chalk5.dim("\u251C") + "  " + chalk5.bold.white("vibgrate"));
+  lines.push("  " + chalk5.dim("\u2524") + teal("\u2502") + "  " + chalk5.dim("\u2581\u2581") + "  " + teal("\u2502") + chalk5.dim("\u251C") + "  " + chalk5.dim(`Drift Intelligence Engine v${VERSION}`));
   lines.push("   " + teal("\u2570\u2500\u2500\u2500\u2500\u2500\u2500\u256F"));
   lines.push("");
   lines.push(teal("\u2554\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2557"));
-  lines.push(teal("\u2551        ") + chalk4.bold.white("Vibgrate Drift Report") + teal("             \u2551"));
+  lines.push(teal("\u2551        ") + chalk5.bold.white("Vibgrate Drift Report") + teal("             \u2551"));
   lines.push(teal("\u255A\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u255D"));
   lines.push("");
   for (const project of artifact.projects) {
-    lines.push(chalk4.bold(`  \u2500\u2500 ${project.name} `) + chalk4.dim(`(${project.type}) ${project.path}`));
+    lines.push(chalk5.bold(`  \u2500\u2500 ${project.name} `) + chalk5.dim(`(${project.type}) ${project.path}`));
     if (project.runtime) {
-      const behindStr = project.runtimeMajorsBehind !== void 0 && project.runtimeMajorsBehind > 0 ? chalk4.yellow(` (${project.runtimeMajorsBehind} major${project.runtimeMajorsBehind > 1 ? "s" : ""} behind)`) : chalk4.green(" (current)");
+      const behindStr = project.runtimeMajorsBehind !== void 0 && project.runtimeMajorsBehind > 0 ? chalk5.yellow(` (${project.runtimeMajorsBehind} major${project.runtimeMajorsBehind > 1 ? "s" : ""} behind)`) : chalk5.green(" (current)");
       lines.push(`     Runtime: ${project.runtime}${behindStr}`);
     }
     if (project.targetFramework) {
@@ -472,7 +572,7 @@ function formatText(artifact) {
     if (project.frameworks.length > 0) {
       lines.push("     Frameworks:");
       for (const fw of project.frameworks) {
-        const lag = fw.majorsBehind !== null ? fw.majorsBehind === 0 ? chalk4.green("current") : chalk4.yellow(`${fw.majorsBehind} behind`) : chalk4.dim("unknown");
+        const lag = fw.majorsBehind !== null ? fw.majorsBehind === 0 ? chalk5.green("current") : chalk5.yellow(`${fw.majorsBehind} behind`) : chalk5.dim("unknown");
         lines.push(`       ${fw.name}: ${fw.currentVersion ?? "?"} \u2192 ${fw.latestVersion ?? "?"} (${lag})`);
       }
     }
@@ -480,13 +580,13 @@ function formatText(artifact) {
     const total = b.current + b.oneBehind + b.twoPlusBehind + b.unknown;
     if (total > 0) {
       lines.push("     Dependencies:");
-      lines.push(`       ${chalk4.green(`${b.current} current`)}  ${chalk4.yellow(`${b.oneBehind} 1-behind`)}  ${chalk4.red(`${b.twoPlusBehind} 2+ behind`)}  ${chalk4.dim(`${b.unknown} unknown`)}`);
+      lines.push(`       ${chalk5.green(`${b.current} current`)}  ${chalk5.yellow(`${b.oneBehind} 1-behind`)}  ${chalk5.red(`${b.twoPlusBehind} 2+ behind`)}  ${chalk5.dim(`${b.unknown} unknown`)}`);
     }
     lines.push("");
   }
   if (artifact.delta !== void 0) {
-    const deltaStr = artifact.delta > 0 ? chalk4.green(`+${artifact.delta}`) : artifact.delta < 0 ? chalk4.red(`${artifact.delta}`) : chalk4.dim("0");
-    lines.push(chalk4.bold("  Drift Delta: ") + deltaStr + " (vs baseline)");
+    const deltaStr = artifact.delta > 0 ? chalk5.green(`+${artifact.delta}`) : artifact.delta < 0 ? chalk5.red(`${artifact.delta}`) : chalk5.dim("0");
+    lines.push(chalk5.bold("  Drift Delta: ") + deltaStr + " (vs baseline)");
     lines.push("");
   }
   if (artifact.extended) {
@@ -497,30 +597,30 @@ function formatText(artifact) {
     const warnings = artifact.findings.filter((f) => f.level === "warning");
     const notes = artifact.findings.filter((f) => f.level === "note");
     const summary = [
-      errors.length > 0 ? chalk4.red(`${errors.length} error${errors.length !== 1 ? "s" : ""}`) : "",
-      warnings.length > 0 ? chalk4.yellow(`${warnings.length} warning${warnings.length !== 1 ? "s" : ""}`) : "",
-      notes.length > 0 ? chalk4.blue(`${notes.length} note${notes.length !== 1 ? "s" : ""}`) : ""
-    ].filter(Boolean).join(chalk4.dim(", "));
-    lines.push(chalk4.bold.underline(`  Findings`) + chalk4.dim(` (${summary})`));
+      errors.length > 0 ? chalk5.red(`${errors.length} error${errors.length !== 1 ? "s" : ""}`) : "",
+      warnings.length > 0 ? chalk5.yellow(`${warnings.length} warning${warnings.length !== 1 ? "s" : ""}`) : "",
+      notes.length > 0 ? chalk5.blue(`${notes.length} note${notes.length !== 1 ? "s" : ""}`) : ""
+    ].filter(Boolean).join(chalk5.dim(", "));
+    lines.push(chalk5.bold.underline(`  Findings`) + chalk5.dim(` (${summary})`));
     for (const f of artifact.findings) {
-      const icon = f.level === "error" ? chalk4.red("\u2716") : f.level === "warning" ? chalk4.yellow("\u26A0") : chalk4.blue("\u2139");
+      const icon = f.level === "error" ? chalk5.red("\u2716") : f.level === "warning" ? chalk5.yellow("\u26A0") : chalk5.blue("\u2139");
       lines.push(`    ${icon} ${f.message}`);
-      lines.push(chalk4.dim(`      ${f.ruleId} in ${f.location}`));
+      lines.push(chalk5.dim(`      ${f.ruleId} in ${f.location}`));
     }
     lines.push("");
   }
   const actions = generatePriorityActions(artifact);
   if (actions.length > 0) {
-    lines.push(chalk4.bold.cyan("\u2554\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2557"));
-    lines.push(chalk4.bold.cyan("\u2551        Top Priority Actions              \u2551"));
-    lines.push(chalk4.bold.cyan("\u255A\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u255D"));
+    lines.push(chalk5.bold.cyan("\u2554\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2557"));
+    lines.push(chalk5.bold.cyan("\u2551        Top Priority Actions              \u2551"));
+    lines.push(chalk5.bold.cyan("\u255A\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u255D"));
     lines.push("");
     for (let i = 0; i < actions.length; i++) {
       const a = actions[i];
-      const num = chalk4.bold.cyan(`  ${i + 1}.`);
-      lines.push(`${num} ${chalk4.bold(a.title)}`);
-      lines.push(chalk4.dim(`     ${a.explanation}`));
-      if (a.impact) lines.push(`     Impact: ${chalk4.green(a.impact)}`);
+      const num = chalk5.bold.cyan(`  ${i + 1}.`);
+      lines.push(`${num} ${chalk5.bold(a.title)}`);
+      lines.push(chalk5.dim(`     ${a.explanation}`));
+      if (a.impact) lines.push(`     Impact: ${chalk5.green(a.impact)}`);
       lines.push("");
     }
   }
@@ -528,38 +628,38 @@ function formatText(artifact) {
     lines.push(...formatArchitectureDiagram(artifact.extended.architecture));
   }
   if (artifact.solutions && artifact.solutions.length > 0) {
-    lines.push(chalk4.bold.cyan("\u2554\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2557"));
-    lines.push(chalk4.bold.cyan("\u2551        Solution Drift Summary            \u2551"));
-    lines.push(chalk4.bold.cyan("\u255A\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u255D"));
+    lines.push(chalk5.bold.cyan("\u2554\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2557"));
+    lines.push(chalk5.bold.cyan("\u2551        Solution Drift Summary            \u2551"));
+    lines.push(chalk5.bold.cyan("\u255A\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u255D"));
     lines.push("");
     for (const solution of artifact.solutions) {
       const solScore = solution.drift?.score;
-      const color = typeof solScore === "number" ? solScore >= 70 ? chalk4.green : solScore >= 40 ? chalk4.yellow : chalk4.red : chalk4.dim;
-      lines.push(`  \u2022 ${solution.name} (${solution.projectPaths.length} projects) \u2014 ${typeof solScore === "number" ? color(`${solScore}/100`) : chalk4.dim("n/a")}`);
+      const color = typeof solScore === "number" ? solScore >= 70 ? chalk5.green : solScore >= 40 ? chalk5.yellow : chalk5.red : chalk5.dim;
+      lines.push(`  \u2022 ${solution.name} (${solution.projectPaths.length} projects) \u2014 ${typeof solScore === "number" ? color(`${solScore}/100`) : chalk5.dim("n/a")}`);
     }
     lines.push("");
   }
-  const scoreColor = artifact.drift.score >= 70 ? chalk4.green : artifact.drift.score >= 40 ? chalk4.yellow : chalk4.red;
-  lines.push(chalk4.bold.cyan("\u2554\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2557"));
-  lines.push(chalk4.bold.cyan("\u2551        Drift Score Summary               \u2551"));
-  lines.push(chalk4.bold.cyan("\u255A\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u255D"));
+  const scoreColor = artifact.drift.score >= 70 ? chalk5.green : artifact.drift.score >= 40 ? chalk5.yellow : chalk5.red;
+  lines.push(chalk5.bold.cyan("\u2554\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2557"));
+  lines.push(chalk5.bold.cyan("\u2551        Drift Score Summary               \u2551"));
+  lines.push(chalk5.bold.cyan("\u255A\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u255D"));
   lines.push("");
-  lines.push(chalk4.bold("  Drift Score:  ") + scoreColor.bold(`${artifact.drift.score}/100`));
-  lines.push(chalk4.bold("  Risk Level:   ") + riskBadge(artifact.drift.riskLevel));
-  lines.push(chalk4.bold("  Projects:     ") + `${artifact.projects.length}`);
+  lines.push(chalk5.bold("  Drift Score:  ") + scoreColor.bold(`${artifact.drift.score}/100`));
+  lines.push(chalk5.bold("  Risk Level:   ") + riskBadge(artifact.drift.riskLevel));
+  lines.push(chalk5.bold("  Projects:     ") + `${artifact.projects.length}`);
   if (artifact.vcs) {
     const vcsParts = [artifact.vcs.type];
     if (artifact.vcs.branch) vcsParts.push(artifact.vcs.branch);
-    if (artifact.vcs.shortSha) vcsParts.push(chalk4.dim(artifact.vcs.shortSha));
-    lines.push(chalk4.bold("  VCS:          ") + vcsParts.join(" "));
+    if (artifact.vcs.shortSha) vcsParts.push(chalk5.dim(artifact.vcs.shortSha));
+    lines.push(chalk5.bold("  VCS:          ") + vcsParts.join(" "));
   }
   lines.push("");
   const m = new Set(artifact.drift.measured ?? ["runtime", "framework", "dependency", "eol"]);
-  lines.push("  " + chalk4.bold.underline("Score Breakdown"));
-  lines.push(`    Runtime:      ${m.has("runtime") ? scoreBar(artifact.drift.components.runtimeScore) : chalk4.dim("n/a")}`);
-  lines.push(`    Frameworks:   ${m.has("framework") ? scoreBar(artifact.drift.components.frameworkScore) : chalk4.dim("n/a")}`);
-  lines.push(`    Dependencies: ${m.has("dependency") ? scoreBar(artifact.drift.components.dependencyScore) : chalk4.dim("n/a")}`);
-  lines.push(`    EOL Risk:     ${m.has("eol") ? scoreBar(artifact.drift.components.eolScore) : chalk4.dim("n/a")}`);
+  lines.push("  " + chalk5.bold.underline("Score Breakdown"));
+  lines.push(`    Runtime:      ${m.has("runtime") ? scoreBar(artifact.drift.components.runtimeScore) : chalk5.dim("n/a")}`);
+  lines.push(`    Frameworks:   ${m.has("framework") ? scoreBar(artifact.drift.components.frameworkScore) : chalk5.dim("n/a")}`);
+  lines.push(`    Dependencies: ${m.has("dependency") ? scoreBar(artifact.drift.components.dependencyScore) : chalk5.dim("n/a")}`);
+  lines.push(`    EOL Risk:     ${m.has("eol") ? scoreBar(artifact.drift.components.eolScore) : chalk5.dim("n/a")}`);
   lines.push("");
   const scannedParts = [`Scanned at ${artifact.timestamp}`];
   if (artifact.durationMs !== void 0) {
@@ -573,18 +673,18 @@ function formatText(artifact) {
     scannedParts.push(`${artifact.treeSummary.totalFiles.toLocaleString()} workspace files`);
     scannedParts.push(`${artifact.treeSummary.totalDirs.toLocaleString()} dirs`);
   }
-  lines.push(chalk4.dim(`  ${scannedParts.join(" \xB7 ")}`));
+  lines.push(chalk5.dim(`  ${scannedParts.join(" \xB7 ")}`));
   lines.push("");
   return lines.join("\n");
 }
 function riskBadge(level) {
   switch (level) {
     case "low":
-      return chalk4.bgGreen.black(" LOW ");
+      return chalk5.bgGreen.black(" LOW ");
     case "moderate":
-      return chalk4.bgYellow.black(" MODERATE ");
+      return chalk5.bgYellow.black(" MODERATE ");
     case "high":
-      return chalk4.bgRed.white(" HIGH ");
+      return chalk5.bgRed.white(" HIGH ");
     default:
       return level;
   }
@@ -593,8 +693,8 @@ function scoreBar(score) {
   const width = 20;
   const filled = Math.round(score / 100 * width);
   const empty = width - filled;
-  const color = score >= 70 ? chalk4.green : score >= 40 ? chalk4.yellow : chalk4.red;
-  return color("\u2588".repeat(filled)) + chalk4.dim("\u2591".repeat(empty)) + ` ${Math.round(score)}`;
+  const color = score >= 70 ? chalk5.green : score >= 40 ? chalk5.yellow : chalk5.red;
+  return color("\u2588".repeat(filled)) + chalk5.dim("\u2591".repeat(empty)) + ` ${Math.round(score)}`;
 }
 var CATEGORY_LABELS = {
   frontend: "Frontend",
@@ -623,11 +723,11 @@ function formatExtended(ext) {
     const inv = ext.toolingInventory;
     const categories = Object.entries(inv).filter(([, items]) => items.length > 0);
     if (categories.length > 0) {
-      lines.push(chalk4.bold.underline("  Tech Stack"));
+      lines.push(chalk5.bold.underline("  Tech Stack"));
       for (const [cat, items] of categories) {
         const label = CATEGORY_LABELS[cat] ?? cat;
-        const names = items.map((i) => chalk4.white(i.name)).join(chalk4.dim(", "));
-        lines.push(`    ${chalk4.cyan(label)}: ${names}`);
+        const names = items.map((i) => chalk5.white(i.name)).join(chalk5.dim(", "));
+        lines.push(`    ${chalk5.cyan(label)}: ${names}`);
       }
       lines.push("");
     }
@@ -636,14 +736,14 @@ function formatExtended(ext) {
     const svc = ext.serviceDependencies;
     const categories = Object.entries(svc).filter(([, items]) => items.length > 0);
     if (categories.length > 0) {
-      lines.push(chalk4.bold.underline("  Services & Integrations"));
+      lines.push(chalk5.bold.underline("  Services & Integrations"));
       for (const [cat, items] of categories) {
         const label = CATEGORY_LABELS[cat] ?? cat;
         const names = items.map((i) => {
-          const ver = i.version ? chalk4.dim(` ${i.version}`) : "";
-          return chalk4.white(i.name) + ver;
-        }).join(chalk4.dim(", "));
-        lines.push(`    ${chalk4.cyan(label)}: ${names}`);
+          const ver = i.version ? chalk5.dim(` ${i.version}`) : "";
+          return chalk5.white(i.name) + ver;
+        }).join(chalk5.dim(", "));
+        lines.push(`    ${chalk5.cyan(label)}: ${names}`);
       }
       lines.push("");
     }
@@ -651,19 +751,19 @@ function formatExtended(ext) {
   if (ext.breakingChangeExposure) {
     const bc = ext.breakingChangeExposure;
     if (bc.deprecatedPackages.length > 0 || bc.legacyPolyfills.length > 0) {
-      lines.push(chalk4.bold.underline("  Breaking Change Exposure"));
-      const exposureColor = bc.exposureScore >= 40 ? chalk4.red : bc.exposureScore >= 20 ? chalk4.yellow : chalk4.green;
+      lines.push(chalk5.bold.underline("  Breaking Change Exposure"));
+      const exposureColor = bc.exposureScore >= 40 ? chalk5.red : bc.exposureScore >= 20 ? chalk5.yellow : chalk5.green;
       lines.push(`    Exposure Score: ${exposureColor.bold(`${bc.exposureScore}/100`)}`);
       if (bc.deprecatedPackages.length > 0) {
-        lines.push(`    ${chalk4.red("Deprecated")}: ${bc.deprecatedPackages.map((p) => chalk4.dim(p)).join(", ")}`);
+        lines.push(`    ${chalk5.red("Deprecated")}: ${bc.deprecatedPackages.map((p) => chalk5.dim(p)).join(", ")}`);
       }
       if (bc.legacyPolyfills.length > 0) {
-        lines.push(`    ${chalk4.yellow("Polyfills")}: ${bc.legacyPolyfills.map((p) => chalk4.dim(p)).join(", ")}`);
+        lines.push(`    ${chalk5.yellow("Polyfills")}: ${bc.legacyPolyfills.map((p) => chalk5.dim(p)).join(", ")}`);
       }
       if (bc.peerConflictsDetected) {
-        lines.push(`    ${chalk4.red("\u26A0")} Peer dependency conflicts detected`);
+        lines.push(`    ${chalk5.red("\u26A0")} Peer dependency conflicts detected`);
       }
-      lines.push(`    Recommendation: ${chalk4.bold(bc.overallRecommendation)}`);
+      lines.push(`    Recommendation: ${chalk5.bold(bc.overallRecommendation)}`);
       const projectsWithPlans = bc.projectIntelligence.filter((p) => p.packages.length > 0).slice(0, 3);
       if (projectsWithPlans.length > 0) {
         lines.push("    Major Upgrade Intelligence:");
@@ -679,21 +779,21 @@ function formatExtended(ext) {
   }
   if (ext.tsModernity && ext.tsModernity.typescriptVersion) {
     const ts = ext.tsModernity;
-    lines.push(chalk4.bold.underline("  TypeScript"));
+    lines.push(chalk5.bold.underline("  TypeScript"));
     const parts = [];
     parts.push(`v${ts.typescriptVersion}`);
-    if (ts.strict === true) parts.push(chalk4.green("strict \u2714"));
-    else if (ts.strict === false) parts.push(chalk4.yellow("strict \u2716"));
+    if (ts.strict === true) parts.push(chalk5.green("strict \u2714"));
+    else if (ts.strict === false) parts.push(chalk5.yellow("strict \u2716"));
     if (ts.moduleType) parts.push(ts.moduleType.toUpperCase());
     if (ts.target) parts.push(`target: ${ts.target}`);
-    lines.push(`    ${parts.join(chalk4.dim(" \xB7 "))}`);
+    lines.push(`    ${parts.join(chalk5.dim(" \xB7 "))}`);
     lines.push("");
   }
   if (ext.buildDeploy) {
     const bd = ext.buildDeploy;
     const hasSomething = bd.ci.length > 0 || bd.docker.dockerfileCount > 0 || bd.packageManagers.length > 0;
     if (hasSomething) {
-      lines.push(chalk4.bold.underline("  Build & Deploy"));
+      lines.push(chalk5.bold.underline("  Build & Deploy"));
       if (bd.ci.length > 0) lines.push(`    CI: ${bd.ci.join(", ")}`);
       if (bd.docker.dockerfileCount > 0) {
         lines.push(`    Docker: ${bd.docker.dockerfileCount} Dockerfile${bd.docker.dockerfileCount !== 1 ? "s" : ""} (${bd.docker.baseImages.join(", ")})`);
@@ -706,42 +806,42 @@ function formatExtended(ext) {
   }
   if (ext.uiPurpose) {
     const up = ext.uiPurpose;
-    lines.push(chalk4.bold.underline("  Product Purpose Signals"));
-    lines.push(`    Frameworks: ${up.detectedFrameworks.length > 0 ? up.detectedFrameworks.join(", ") : chalk4.dim("unknown")}`);
-    lines.push(`    Evidence: ${up.topEvidence.length}${up.capped ? chalk4.dim(` of ${up.evidenceCount} (capped)`) : ""}`);
+    lines.push(chalk5.bold.underline("  Product Purpose Signals"));
+    lines.push(`    Frameworks: ${up.detectedFrameworks.length > 0 ? up.detectedFrameworks.join(", ") : chalk5.dim("unknown")}`);
+    lines.push(`    Evidence: ${up.topEvidence.length}${up.capped ? chalk5.dim(` of ${up.evidenceCount} (capped)`) : ""}`);
     const top = up.topEvidence.slice(0, 8);
     if (top.length > 0) {
       lines.push("    Top Signals:");
       for (const item of top) {
-        lines.push(`      - [${item.kind}] ${item.value} ${chalk4.dim(`(${item.file})`)}`);
+        lines.push(`      - [${item.kind}] ${item.value} ${chalk5.dim(`(${item.file})`)}`);
       }
     }
     if (up.unknownSignals.length > 0) {
       lines.push("    Unknowns:");
       for (const u of up.unknownSignals.slice(0, 4)) {
-        lines.push(`      - ${chalk4.yellow(u)}`);
+        lines.push(`      - ${chalk5.yellow(u)}`);
       }
     }
     lines.push("");
   }
   if (ext.securityPosture) {
     const sec = ext.securityPosture;
-    lines.push(chalk4.bold.underline("  Security Posture"));
+    lines.push(chalk5.bold.underline("  Security Posture"));
     const checks = [];
-    checks.push(sec.lockfilePresent ? chalk4.green("Lockfile \u2714") : chalk4.red("Lockfile \u2716"));
-    checks.push(sec.gitignoreCoversEnv ? chalk4.green(".env \u2714") : chalk4.red(".env \u2716"));
-    checks.push(sec.gitignoreCoversNodeModules ? chalk4.green("node_modules \u2714") : chalk4.yellow("node_modules \u2716"));
-    if (sec.multipleLockfileTypes) checks.push(chalk4.yellow("Multiple lockfiles \u26A0"));
-    if (sec.envFilesTracked) checks.push(chalk4.red("Env files tracked \u2716"));
-    lines.push(`    ${checks.join(chalk4.dim(" \xB7 "))}`);
+    checks.push(sec.lockfilePresent ? chalk5.green("Lockfile \u2714") : chalk5.red("Lockfile \u2716"));
+    checks.push(sec.gitignoreCoversEnv ? chalk5.green(".env \u2714") : chalk5.red(".env \u2716"));
+    checks.push(sec.gitignoreCoversNodeModules ? chalk5.green("node_modules \u2714") : chalk5.yellow("node_modules \u2716"));
+    if (sec.multipleLockfileTypes) checks.push(chalk5.yellow("Multiple lockfiles \u26A0"));
+    if (sec.envFilesTracked) checks.push(chalk5.red("Env files tracked \u2716"));
+    lines.push(`    ${checks.join(chalk5.dim(" \xB7 "))}`);
     lines.push("");
   }
   if (ext.platformMatrix) {
     const pm = ext.platformMatrix;
     if (pm.nativeModules.length > 0 || pm.dockerBaseImages.length > 0) {
-      lines.push(chalk4.bold.underline("  Platform"));
+      lines.push(chalk5.bold.underline("  Platform"));
       if (pm.nativeModules.length > 0) {
-        lines.push(`    Native modules: ${pm.nativeModules.map((m) => chalk4.dim(m)).join(", ")}`);
+        lines.push(`    Native modules: ${pm.nativeModules.map((m) => chalk5.dim(m)).join(", ")}`);
       }
       if (pm.osAssumptions.length > 0) {
         lines.push(`    OS assumptions: ${pm.osAssumptions.join(", ")}`);
@@ -751,25 +851,25 @@ function formatExtended(ext) {
   }
   if (ext.codeQuality) {
     const cq = ext.codeQuality;
-    lines.push(chalk4.bold.underline("  Code Quality"));
-    lines.push(`    Files: ${chalk4.white(`${cq.filesAnalyzed}`)} \xB7 Functions: ${chalk4.white(`${cq.functionsAnalyzed}`)} \xB7 Avg complexity: ${chalk4.white(`${cq.avgCyclomaticComplexity}`)} \xB7 Avg length: ${chalk4.white(`${cq.avgFunctionLength}`)} lines`);
+    lines.push(chalk5.bold.underline("  Code Quality"));
+    lines.push(`    Files: ${chalk5.white(`${cq.filesAnalyzed}`)} \xB7 Functions: ${chalk5.white(`${cq.functionsAnalyzed}`)} \xB7 Avg complexity: ${chalk5.white(`${cq.avgCyclomaticComplexity}`)} \xB7 Avg length: ${chalk5.white(`${cq.avgFunctionLength}`)} lines`);
     lines.push(`    Max nesting: ${cq.maxNestingDepth} \xB7 Circular deps: ${cq.circularDependencies} \xB7 Dead code: ${cq.deadCodePercent}%`);
     if (cq.godFiles.length > 0) {
       const preview = cq.godFiles.slice(0, 3).map((f) => `${f.path} (${f.lines} lines)`).join(", ");
-      lines.push(`    ${chalk4.yellow("God files")}: ${preview}`);
+      lines.push(`    ${chalk5.yellow("God files")}: ${preview}`);
     }
     lines.push("");
   }
   if (ext.dependencyGraph) {
     const dg = ext.dependencyGraph;
     if (dg.lockfileType) {
-      lines.push(chalk4.bold.underline("  Dependency Graph"));
-      lines.push(`    ${dg.lockfileType}: ${chalk4.white(`${dg.totalUnique}`)} unique, ${chalk4.white(`${dg.totalInstalled}`)} installed`);
+      lines.push(chalk5.bold.underline("  Dependency Graph"));
+      lines.push(`    ${dg.lockfileType}: ${chalk5.white(`${dg.totalUnique}`)} unique, ${chalk5.white(`${dg.totalInstalled}`)} installed`);
       if (dg.duplicatedPackages.length > 0) {
-        lines.push(`    ${chalk4.yellow(`${dg.duplicatedPackages.length} duplicated`)} packages`);
+        lines.push(`    ${chalk5.yellow(`${dg.duplicatedPackages.length} duplicated`)} packages`);
       }
       if (dg.phantomDependencies.length > 0) {
-        lines.push(`    ${chalk4.red(`${dg.phantomDependencies.length} phantom`)} dependencies`);
+        lines.push(`    ${chalk5.red(`${dg.phantomDependencies.length} phantom`)} dependencies`);
       }
       lines.push("");
     }
@@ -778,17 +878,17 @@ function formatExtended(ext) {
 }
 function formatArchitectureDiagram(arch) {
   const lines = [];
-  lines.push(chalk4.bold.cyan("\u2554\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2557"));
-  lines.push(chalk4.bold.cyan("\u2551        Architecture Layers               \u2551"));
-  lines.push(chalk4.bold.cyan("\u255A\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u255D"));
+  lines.push(chalk5.bold.cyan("\u2554\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2557"));
+  lines.push(chalk5.bold.cyan("\u2551        Architecture Layers               \u2551"));
+  lines.push(chalk5.bold.cyan("\u255A\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u255D"));
   lines.push("");
-  lines.push(chalk4.bold("  Archetype: ") + `${arch.archetype}` + chalk4.dim(` (${Math.round(arch.archetypeConfidence * 100)}% confidence)`));
-  lines.push(`  Files classified: ${arch.totalClassified}` + (arch.unclassified > 0 ? chalk4.dim(` (${arch.unclassified} unclassified)`) : ""));
+  lines.push(chalk5.bold("  Archetype: ") + `${arch.archetype}` + chalk5.dim(` (${Math.round(arch.archetypeConfidence * 100)}% confidence)`));
+  lines.push(`  Files classified: ${arch.totalClassified}` + (arch.unclassified > 0 ? chalk5.dim(` (${arch.unclassified} unclassified)`) : ""));
   lines.push("");
   if (arch.layers.length > 0) {
     for (const layer of arch.layers) {
-      const risk = layer.riskLevel === "none" ? chalk4.dim("none") : layer.riskLevel === "low" ? chalk4.green("low") : layer.riskLevel === "moderate" ? chalk4.yellow("moderate") : chalk4.red("high");
-      lines.push(`    ${chalk4.bold(layer.layer)}  ${layer.fileCount} file${layer.fileCount !== 1 ? "s" : ""}  drift ${scoreBar(layer.driftScore)}  risk ${risk}`);
+      const risk = layer.riskLevel === "none" ? chalk5.dim("none") : layer.riskLevel === "low" ? chalk5.green("low") : layer.riskLevel === "moderate" ? chalk5.yellow("moderate") : chalk5.red("high");
+      lines.push(`    ${chalk5.bold(layer.layer)}  ${layer.fileCount} file${layer.fileCount !== 1 ? "s" : ""}  drift ${scoreBar(layer.driftScore)}  risk ${risk}`);
     }
     lines.push("");
   }
@@ -1157,10 +1257,10 @@ function formatMarkdown(artifact) {
 
 // src/commands/report.ts
 var reportCommand = new Command4("report").description("Generate a drift report from a scan artifact").option("--in <file>", "Input artifact file", ".vibgrate/scan_result.json").option("--format <format>", "Output format (md|text|json)", "text").action(async (opts) => {
-  const artifactPath = path4.resolve(opts.in);
+  const artifactPath = path5.resolve(opts.in);
   if (!await pathExists(artifactPath)) {
-    console.error(chalk5.red(`Artifact not found: ${artifactPath}`));
-    console.error(chalk5.dim('Run "vibgrate scan" first to generate a scan artifact.'));
+    console.error(chalk6.red(`Artifact not found: ${artifactPath}`));
+    console.error(chalk6.dim('Run "vibgrate scan" first to generate a scan artifact.'));
     process.exit(1);
   }
   const artifact = await readJsonFile(artifactPath);
@@ -1178,11 +1278,145 @@ var reportCommand = new Command4("report").description("Generate a drift report
   }
 });
 
+// src/commands/login.ts
+import { Command as Command5 } from "commander";
+import chalk7 from "chalk";
+
+// src/utils/open-url.ts
+import { spawn } from "child_process";
+function openUrl(url) {
+  const platform = process.platform;
+  let command;
+  let args;
+  if (platform === "darwin") {
+    command = "open";
+    args = [url];
+  } else if (platform === "win32") {
+    command = "cmd";
+    args = ["/c", "start", "", url];
+  } else {
+    command = "xdg-open";
+    args = [url];
+  }
+  try {
+    const child = spawn(command, args, { stdio: "ignore", detached: true });
+    child.on("error", () => {
+    });
+    child.unref();
+    return true;
+  } catch {
+    return false;
+  }
+}
+
+// src/commands/login.ts
+var delay = (ms) => new Promise((resolve10) => setTimeout(resolve10, ms));
+var loginCommand = new Command5("login").description("Authenticate the CLI with your Vibgrate workspace via the browser").option("--ingest <url>", "Ingest API URL (overrides --region)").option("--region <region>", `Data residency region (${availableRegionIds().join(", ")})`, "us").option("--no-browser", "Do not attempt to open a browser automatically").action(async (opts) => {
+  let ingestHost;
+  try {
+    ingestHost = resolveIngestHost(opts.region, opts.ingest);
+  } catch (e) {
+    console.error(chalk7.red(e instanceof Error ? e.message : String(e)));
+    process.exit(1);
+  }
+  const base = `https://${ingestHost}/v1/auth/device`;
+  let start;
+  try {
+    const res = await fetch(`${base}/start`, {
+      method: "POST",
+      headers: { "Content-Type": "application/json", Connection: "close" },
+      body: "{}"
+    });
+    if (!res.ok) {
+      console.error(chalk7.red(`Failed to start login (HTTP ${res.status}).`));
+      process.exit(1);
+    }
+    start = await res.json();
+  } catch (e) {
+    console.error(chalk7.red(`Could not reach ${ingestHost}: ${e instanceof Error ? e.message : String(e)}`));
+    process.exit(1);
+  }
+  console.log("");
+  console.log("To finish signing in, open this URL and approve the request:");
+  console.log("");
+  console.log("  " + chalk7.cyan(start.verificationUri));
+  console.log("");
+  console.log("  Your code: " + chalk7.bold(start.userCode));
+  console.log("");
+  if (opts.browser) {
+    const opened = openUrl(start.verificationUriComplete);
+    if (opened) {
+      console.log(chalk7.dim("Opening your browser\u2026 (if it does not open, use the URL above)"));
+    }
+  }
+  console.log(chalk7.dim("Waiting for approval\u2026"));
+  const intervalMs = Math.max(2, start.interval || 5) * 1e3;
+  const deadline = Date.now() + (start.expiresIn || 900) * 1e3;
+  while (Date.now() < deadline) {
+    await delay(intervalMs);
+    let token;
+    try {
+      const res = await fetch(`${base}/token`, {
+        method: "POST",
+        headers: { "Content-Type": "application/json", Connection: "close" },
+        body: JSON.stringify({ deviceCode: start.deviceCode })
+      });
+      token = await res.json();
+    } catch {
+      continue;
+    }
+    if (token.status === "authorization_pending") continue;
+    if (token.status === "complete" && token.dsn) {
+      writeStoredCredentials({
+        dsn: token.dsn,
+        workspaceId: token.workspaceId,
+        keyId: token.keyId,
+        ingestHost: token.ingestHost ?? ingestHost,
+        savedAt: (/* @__PURE__ */ new Date()).toISOString()
+      });
+      console.log("");
+      console.log(chalk7.green("\u2714") + " Logged in.");
+      if (token.workspaceId) {
+        console.log("  Workspace: " + chalk7.bold(token.workspaceId));
+      }
+      console.log(chalk7.dim(`  Credentials saved to ${credentialsPath()}`));
+      console.log(chalk7.dim('  You can now run "vibgrate scan --push".'));
+      return;
+    }
+    if (token.status === "access_denied") {
+      console.error(chalk7.red("\u2716 Login was denied in the browser."));
+      process.exit(1);
+    }
+    if (token.status === "expired" || token.status === "invalid") {
+      console.error(chalk7.red('\u2716 Login request expired. Run "vibgrate login" again.'));
+      process.exit(1);
+    }
+    if (token.status === "error") {
+      console.error(chalk7.red(`\u2716 ${token.error ?? "Login failed."}`));
+      process.exit(1);
+    }
+  }
+  console.error(chalk7.red('\u2716 Timed out waiting for approval. Run "vibgrate login" again.'));
+  process.exit(1);
+});
+
+// src/commands/logout.ts
+import { Command as Command6 } from "commander";
+import chalk8 from "chalk";
+var logoutCommand = new Command6("logout").description("Clear stored Vibgrate login credentials").action(() => {
+  const cleared = clearStoredCredentials();
+  if (cleared) {
+    console.log(chalk8.green("\u2714") + " Logged out. Stored credentials removed.");
+  } else {
+    console.log(chalk8.dim(`No stored credentials found at ${credentialsPath()}.`));
+  }
+});
+
 // src/commands/push.ts
 import * as crypto2 from "crypto";
-import * as path5 from "path";
-import { Command as Command5 } from "commander";
-import chalk6 from "chalk";
+import * as path6 from "path";
+import { Command as Command7 } from "commander";
+import chalk9 from "chalk";
 
 // src/utils/compact-artifact.ts
 import * as zlib from "zlib";
@@ -1454,25 +1688,25 @@ function parseDsn2(dsn) {
 function computeHmac(body, secret) {
   return crypto2.createHmac("sha256", secret).update(body).digest("base64");
 }
-var pushCommand = new Command5("push").description("Push scan results to Vibgrate API").option("--dsn <dsn>", "DSN token (or use VIBGRATE_DSN env)").option("--region <region>", `Override data residency region (${availableRegionIds().join(", ")})`).option("--file <file>", "Scan artifact file", ".vibgrate/scan_result.json").option("--strict", "Fail on upload errors").action(async (opts) => {
-  const dsn = opts.dsn || process.env.VIBGRATE_DSN;
+var pushCommand = new Command7("push").description("Push scan results to Vibgrate API").option("--dsn <dsn>", "DSN token (or use VIBGRATE_DSN env)").option("--region <region>", `Override data residency region (${availableRegionIds().join(", ")})`).option("--file <file>", "Scan artifact file", ".vibgrate/scan_result.json").option("--strict", "Fail on upload errors").action(async (opts) => {
+  const dsn = resolveDsn(opts.dsn);
   if (!dsn) {
-    console.error(chalk6.red("No DSN provided."));
-    console.error(chalk6.dim("Set VIBGRATE_DSN environment variable or use --dsn flag."));
+    console.error(chalk9.red("No DSN provided."));
+    console.error(chalk9.dim('Run "vibgrate login", set VIBGRATE_DSN, or use the --dsn flag.'));
     if (opts.strict) process.exit(1);
     return;
   }
   const parsed = parseDsn2(dsn);
   if (!parsed) {
-    console.error(chalk6.red("Invalid DSN format."));
-    console.error(chalk6.dim("Expected: vibgrate+https://<key_id>:<secret>@<host>/<workspace_id>"));
+    console.error(chalk9.red("Invalid DSN format."));
+    console.error(chalk9.dim("Expected: vibgrate+https://<key_id>:<secret>@<host>/<workspace_id>"));
     if (opts.strict) process.exit(1);
     return;
   }
-  const filePath = path5.resolve(opts.file);
+  const filePath = path6.resolve(opts.file);
   if (!await pathExists(filePath)) {
-    console.error(chalk6.red(`Scan artifact not found: ${filePath}`));
-    console.error(chalk6.dim('Run "vibgrate scan" first.'));
+    console.error(chalk9.red(`Scan artifact not found: ${filePath}`));
+    console.error(chalk9.dim('Run "vibgrate scan" first.'));
     if (opts.strict) process.exit(1);
     return;
   }
@@ -1484,64 +1718,61 @@ var pushCommand = new Command5("push").description("Push scan results to Vibgrat
     try {
       host = resolveIngestHost(opts.region);
     } catch (e) {
-      console.error(chalk6.red(e instanceof Error ? e.message : String(e)));
+      console.error(chalk9.red(e instanceof Error ? e.message : String(e)));
       if (opts.strict) process.exit(1);
       return;
     }
   }
-  const url = `${parsed.scheme}://${host}/v1/ingest/scan`;
   const originalSize = JSON.stringify(artifact).length;
   const compressedSize = body.length;
   const ratio = ((1 - compressedSize / originalSize) * 100).toFixed(0);
-  console.log(chalk6.dim(`Uploading to ${host}... (${(compressedSize / 1024).toFixed(0)} KB, ${ratio}% smaller)`));
+  console.log(chalk9.dim(`Uploading to ${host}... (${(compressedSize / 1024).toFixed(0)} KB, ${ratio}% smaller)`));
   try {
-    const response = await fetch(url, {
-      method: "POST",
-      headers: {
-        "Content-Type": "application/json",
-        "Content-Encoding": contentEncoding,
-        "X-Vibgrate-Timestamp": timestamp,
-        "Authorization": `VibgrateDSN ${parsed.keyId}:${parsed.secret}`,
-        "Connection": "close"
-        // Prevent keep-alive delays on exit
-      },
-      body
+    const { response, host: uploadedHost } = await uploadScanArtifact({
+      scheme: parsed.scheme,
+      host,
+      keyId: parsed.keyId,
+      secret: parsed.secret,
+      body,
+      contentEncoding,
+      timestamp
     });
+    host = uploadedHost;
     if (!response.ok) {
       const text = await response.text();
       throw new Error(`HTTP ${response.status}: ${text}`);
     }
     const result = await response.json();
-    console.log(chalk6.green("\u2714") + ` Scan queued for processing (${result.ingestId ?? "ok"})`);
+    console.log(chalk9.green("\u2714") + ` Scan queued for processing (${result.ingestId ?? "ok"})`);
     console.log();
-    console.log(chalk6.dim("Processing continues in the background. Results available shortly."));
+    console.log(chalk9.dim("Processing continues in the background. Results available shortly."));
     console.log();
     if (result.ingestId) {
       const dashHost = dashHostForIngestHost(host);
       const reportUrl = `https://${dashHost}/${parsed.workspaceId}/scan/${result.ingestId}`;
-      console.log(chalk6.dim("View report: ") + chalk6.underline(reportUrl));
+      console.log(chalk9.dim("View report: ") + chalk9.underline(reportUrl));
     }
   } catch (e) {
     const msg = e instanceof Error ? e.message : String(e);
-    console.error(chalk6.red(`Upload failed: ${msg}`));
+    console.error(chalk9.red(`Upload failed: ${msg}`));
     if (opts.strict) process.exit(1);
   }
 });
 
 // src/commands/update.ts
 import { execSync } from "child_process";
-import * as path7 from "path";
-import { Command as Command6 } from "commander";
-import chalk7 from "chalk";
+import * as path8 from "path";
+import { Command as Command8 } from "commander";
+import chalk10 from "chalk";
 
 // src/utils/update-check.ts
 var import_semver = __toESM(require_semver(), 1);
-import * as fs from "fs/promises";
-import * as path6 from "path";
-import * as os from "os";
+import * as fs2 from "fs/promises";
+import * as path7 from "path";
+import * as os2 from "os";
 var REGISTRY_URL = "https://registry.npmjs.org/@vibgrate%2fcli/latest";
-var CACHE_DIR = path6.join(os.homedir(), ".vibgrate");
-var CACHE_FILE = path6.join(CACHE_DIR, "update-check.json");
+var CACHE_DIR = path7.join(os2.homedir(), ".vibgrate");
+var CACHE_FILE = path7.join(CACHE_DIR, "update-check.json");
 var CHECK_INTERVAL_MS = 12 * 60 * 60 * 1e3;
 async function checkForUpdate() {
   try {
@@ -1605,7 +1836,7 @@ async function fetchLatestVersion() {
 }
 async function readCache() {
   try {
-    const raw = await fs.readFile(CACHE_FILE, "utf-8");
+    const raw = await fs2.readFile(CACHE_FILE, "utf-8");
     const data = JSON.parse(raw);
     if (data.latest && typeof data.checkedAt === "number") return data;
     return null;
@@ -1615,8 +1846,8 @@ async function readCache() {
 }
 async function writeCache(data) {
   try {
-    await fs.mkdir(CACHE_DIR, { recursive: true });
-    await fs.writeFile(CACHE_FILE, JSON.stringify(data), "utf-8");
+    await fs2.mkdir(CACHE_DIR, { recursive: true });
+    await fs2.writeFile(CACHE_FILE, JSON.stringify(data), "utf-8");
   } catch {
   }
 }
@@ -1649,9 +1880,9 @@ function getGlobalUpdateCommand(pm, pkg2, version) {
   }
 }
 async function detectPackageManager(cwd) {
-  if (await pathExists(path7.join(cwd, "pnpm-lock.yaml"))) return "pnpm";
-  if (await pathExists(path7.join(cwd, "bun.lockb"))) return "bun";
-  if (await pathExists(path7.join(cwd, "yarn.lock"))) return "yarn";
+  if (await pathExists(path8.join(cwd, "pnpm-lock.yaml"))) return "pnpm";
+  if (await pathExists(path8.join(cwd, "bun.lockb"))) return "bun";
+  if (await pathExists(path8.join(cwd, "yarn.lock"))) return "yarn";
   return "npm";
 }
 function getInstallCommand(pm, pkg2, version, isDev) {
@@ -1670,7 +1901,7 @@ function getInstallCommand(pm, pkg2, version, isDev) {
 }
 async function isDevDependency(cwd) {
   try {
-    const pkgPath = path7.join(cwd, "package.json");
+    const pkgPath = path8.join(cwd, "package.json");
     const raw = await (await import("fs/promises")).readFile(pkgPath, "utf-8");
     const pkg2 = JSON.parse(raw);
     return Boolean(pkg2.devDependencies?.["@vibgrate/cli"]);
@@ -1678,22 +1909,22 @@ async function isDevDependency(cwd) {
     return true;
   }
 }
-var updateCommand = new Command6("update").description("Update vibgrate to the latest version").option("--check", "Only check for updates, do not install").option("--pm <manager>", "Package manager to use (npm, pnpm, yarn, bun)").option("--global", "Update global installation").action(async (opts) => {
-  console.log(chalk7.dim(`Current version: ${VERSION}`));
-  console.log(chalk7.dim("Checking npm registry..."));
+var updateCommand = new Command8("update").description("Update vibgrate to the latest version").option("--check", "Only check for updates, do not install").option("--pm <manager>", "Package manager to use (npm, pnpm, yarn, bun)").option("--global", "Update global installation").action(async (opts) => {
+  console.log(chalk10.dim(`Current version: ${VERSION}`));
+  console.log(chalk10.dim("Checking npm registry..."));
   const latest = await fetchLatestVersion();
   if (!latest) {
-    console.error(chalk7.red("Could not reach the npm registry. Check your network connection."));
+    console.error(chalk10.red("Could not reach the npm registry. Check your network connection."));
     process.exit(1);
   }
   const semver2 = await import("./semver-2FJFIYVN.js");
   if (!semver2.gt(latest, VERSION)) {
-    console.log(chalk7.green("\u2714") + ` You are on the latest version (${VERSION}).`);
+    console.log(chalk10.green("\u2714") + ` You are on the latest version (${VERSION}).`);
     return;
   }
-  console.log(chalk7.yellow(`Update available: ${VERSION} \u2192 ${latest}`));
+  console.log(chalk10.yellow(`Update available: ${VERSION} \u2192 ${latest}`));
   if (opts.check) {
-    console.log(chalk7.dim('Run "vibgrate update" to install.'));
+    console.log(chalk10.dim('Run "vibgrate update" to install.'));
     return;
   }
   const cwd = process.cwd();
@@ -1703,26 +1934,26 @@ var updateCommand = new Command6("update").description("Update vibgrate to the l
   let cmd;
   if (isGlobal) {
     cmd = getGlobalUpdateCommand(pm, "@vibgrate/cli", latest);
-    console.log(chalk7.dim(`Updating global installation with ${pm}: ${cmd}`));
+    console.log(chalk10.dim(`Updating global installation with ${pm}: ${cmd}`));
   } else {
     const isDev = await isDevDependency(cwd);
     cmd = getInstallCommand(pm, "@vibgrate/cli", latest, isDev);
-    console.log(chalk7.dim(`Using ${pm}: ${cmd}`));
+    console.log(chalk10.dim(`Using ${pm}: ${cmd}`));
   }
   try {
     execSync(cmd, { cwd, stdio: "inherit" });
-    console.log(chalk7.green("\u2714") + ` Updated to @vibgrate/cli@${latest}`);
+    console.log(chalk10.green("\u2714") + ` Updated to @vibgrate/cli@${latest}`);
   } catch {
-    console.error(chalk7.red(`Update failed. Run manually: ${cmd}`));
+    console.error(chalk10.red(`Update failed. Run manually: ${cmd}`));
     process.exit(1);
   }
 });
 
 // src/commands/sbom.ts
-import * as path8 from "path";
+import * as path9 from "path";
 import { randomUUID } from "crypto";
-import { Command as Command7 } from "commander";
-import chalk8 from "chalk";
+import { Command as Command9 } from "commander";
+import chalk11 from "chalk";
 function flattenDependencies(artifact) {
   const rows = [];
   for (const project of artifact.projects) {
@@ -1860,50 +2091,50 @@ function formatDeltaText(base, current) {
   return lines.join("\n");
 }
 async function readArtifactOrExit(filePath) {
-  const absolutePath = path8.resolve(filePath);
+  const absolutePath = path9.resolve(filePath);
   if (!await pathExists(absolutePath)) {
-    console.error(chalk8.red(`Artifact not found: ${absolutePath}`));
+    console.error(chalk11.red(`Artifact not found: ${absolutePath}`));
     process.exit(1);
   }
   return readJsonFile(absolutePath);
 }
-var exportCommand = new Command7("export").description("Export scan artifact as SBOM").option("--in <file>", "Input artifact file", ".vibgrate/scan_result.json").option("--out <file>", "Output SBOM file").option("--format <format>", "SBOM format (cyclonedx|spdx)", "cyclonedx").action(async (opts) => {
+var exportCommand = new Command9("export").description("Export scan artifact as SBOM").option("--in <file>", "Input artifact file", ".vibgrate/scan_result.json").option("--out <file>", "Output SBOM file").option("--format <format>", "SBOM format (cyclonedx|spdx)", "cyclonedx").action(async (opts) => {
   const artifact = await readArtifactOrExit(opts.in);
   const format = opts.format.toLowerCase();
   if (format !== "cyclonedx" && format !== "spdx") {
-    console.error(chalk8.red("Invalid SBOM format. Use cyclonedx or spdx."));
+    console.error(chalk11.red("Invalid SBOM format. Use cyclonedx or spdx."));
     process.exit(1);
   }
   const sbom = format === "cyclonedx" ? toCycloneDx(artifact) : toSpdx(artifact);
   const body = JSON.stringify(sbom, null, 2);
   if (opts.out) {
-    await writeTextFile(path8.resolve(opts.out), body);
-    console.log(chalk8.green("\u2714") + ` SBOM written to ${opts.out}`);
+    await writeTextFile(path9.resolve(opts.out), body);
+    console.log(chalk11.green("\u2714") + ` SBOM written to ${opts.out}`);
   } else {
     console.log(body);
   }
 });
-var deltaCommand = new Command7("delta").description("Show SBOM delta between two scan artifacts").requiredOption("--from <file>", "Baseline scan artifact path").requiredOption("--to <file>", "Current scan artifact path").option("--out <file>", "Write report to file").action(async (opts) => {
+var deltaCommand = new Command9("delta").description("Show SBOM delta between two scan artifacts").requiredOption("--from <file>", "Baseline scan artifact path").requiredOption("--to <file>", "Current scan artifact path").option("--out <file>", "Write report to file").action(async (opts) => {
   const base = await readArtifactOrExit(opts.from);
   const current = await readArtifactOrExit(opts.to);
   const report = formatDeltaText(base, current);
   if (opts.out) {
-    await writeTextFile(path8.resolve(opts.out), report);
-    console.log(chalk8.green("\u2714") + ` SBOM delta report written to ${opts.out}`);
+    await writeTextFile(path9.resolve(opts.out), report);
+    console.log(chalk11.green("\u2714") + ` SBOM delta report written to ${opts.out}`);
   } else {
     console.log(report);
   }
 });
-var sbomCommand = new Command7("sbom").description("SBOM export and delta reports for dependency drift tracking").addCommand(exportCommand).addCommand(deltaCommand);
+var sbomCommand = new Command9("sbom").description("SBOM export and delta reports for dependency drift tracking").addCommand(exportCommand).addCommand(deltaCommand);
 
 // src/commands/extract.ts
-import * as path9 from "path";
-import * as os2 from "os";
-import * as fs2 from "fs/promises";
-import { existsSync } from "fs";
-import { spawn, spawnSync } from "child_process";
-import { Command as Command8 } from "commander";
-import chalk9 from "chalk";
+import * as path12 from "path";
+import * as os4 from "os";
+import * as fs4 from "fs/promises";
+import { existsSync, rmSync as rmSync2 } from "fs";
+import { spawn as spawn3, spawnSync as spawnSync2 } from "child_process";
+import { Command as Command10 } from "commander";
+import chalk12 from "chalk";
 
 // src/behavioural/derive.ts
 import { createHash as createHash2 } from "crypto";
@@ -2756,6 +2987,303 @@ function deriveBehaviouralFacts(facts, opts) {
   return { envelopes, summary: { assertions: unique.length, surfaceFacts, assertedFacts, behaviouralConfidence } };
 }
 
+// src/utils/vcs.ts
+import * as path10 from "path";
+import * as fs3 from "fs/promises";
+async function detectVcs2(rootDir) {
+  try {
+    return await detectGit(rootDir);
+  } catch {
+    return { type: "unknown" };
+  }
+}
+async function detectGit(rootDir) {
+  const gitDir = await findGitDir(rootDir);
+  if (!gitDir) {
+    return { type: "unknown" };
+  }
+  const headPath = path10.join(gitDir, "HEAD");
+  let headContent;
+  try {
+    headContent = (await fs3.readFile(headPath, "utf8")).trim();
+  } catch {
+    return { type: "unknown" };
+  }
+  let sha;
+  let branch;
+  if (headContent.startsWith("ref: ")) {
+    const refPath = headContent.slice(5);
+    branch = refPath.startsWith("refs/heads/") ? refPath.slice(11) : refPath;
+    sha = await resolveRef(gitDir, refPath);
+  } else if (/^[0-9a-f]{40}$/i.test(headContent)) {
+    sha = headContent;
+  }
+  const remoteUrl = await readGitRemoteUrl(gitDir);
+  return {
+    type: "git",
+    sha: sha ?? void 0,
+    shortSha: sha ? sha.slice(0, 7) : void 0,
+    branch: branch ?? void 0,
+    remoteUrl
+  };
+}
+async function findGitDir(startDir) {
+  let dir = path10.resolve(startDir);
+  const root = path10.parse(dir).root;
+  while (dir !== root) {
+    const gitPath = path10.join(dir, ".git");
+    try {
+      const stat4 = await fs3.stat(gitPath);
+      if (stat4.isDirectory()) {
+        return gitPath;
+      }
+      if (stat4.isFile()) {
+        const content = (await fs3.readFile(gitPath, "utf8")).trim();
+        if (content.startsWith("gitdir: ")) {
+          const resolved = path10.resolve(dir, content.slice(8));
+          return resolved;
+        }
+      }
+    } catch {
+    }
+    dir = path10.dirname(dir);
+  }
+  return null;
+}
+async function resolveRef(gitDir, refPath) {
+  const loosePath = path10.join(gitDir, refPath);
+  try {
+    const sha = (await fs3.readFile(loosePath, "utf8")).trim();
+    if (/^[0-9a-f]{40}$/i.test(sha)) {
+      return sha;
+    }
+  } catch {
+  }
+  const packedPath = path10.join(gitDir, "packed-refs");
+  try {
+    const packed = await fs3.readFile(packedPath, "utf8");
+    for (const line of packed.split("\n")) {
+      if (line.startsWith("#") || line.startsWith("^")) continue;
+      const parts = line.trim().split(" ");
+      if (parts.length >= 2 && parts[1] === refPath) {
+        return parts[0];
+      }
+    }
+  } catch {
+  }
+  return void 0;
+}
+async function readGitRemoteUrl(gitDir) {
+  const configPath = await resolveGitConfigPath(gitDir);
+  if (!configPath) return void 0;
+  try {
+    const config = await fs3.readFile(configPath, "utf8");
+    const originBlock = config.match(/\[remote\s+"origin"\]([\s\S]*?)(?=\n\[|$)/);
+    if (!originBlock) return void 0;
+    const urlMatch = originBlock[1]?.match(/\n\s*url\s*=\s*(.+)\s*/);
+    return urlMatch?.[1]?.trim();
+  } catch {
+    return void 0;
+  }
+}
+async function resolveGitConfigPath(gitDir) {
+  const directConfig = path10.join(gitDir, "config");
+  try {
+    const stat4 = await fs3.stat(directConfig);
+    if (stat4.isFile()) return directConfig;
+  } catch {
+  }
+  const commonDirFile = path10.join(gitDir, "commondir");
+  try {
+    const commonDir = (await fs3.readFile(commonDirFile, "utf8")).trim();
+    if (!commonDir) return void 0;
+    const resolvedCommonDir = path10.resolve(gitDir, commonDir);
+    const commonConfig = path10.join(resolvedCommonDir, "config");
+    const stat4 = await fs3.stat(commonConfig);
+    if (stat4.isFile()) return commonConfig;
+  } catch {
+    return void 0;
+  }
+  return void 0;
+}
+
+// src/utils/clone.ts
+import * as path11 from "path";
+import * as os3 from "os";
+import { mkdtemp, rm } from "fs/promises";
+import { spawn as spawn2, spawnSync } from "child_process";
+var SCP_LIKE = /^[A-Za-z0-9._-]+@[A-Za-z0-9._-]+:.+$/;
+function looksLikeRepoUrl(arg) {
+  if (!arg) return false;
+  if (/^(https?|ssh|git):\/\//i.test(arg)) return true;
+  if (SCP_LIKE.test(arg)) return true;
+  return false;
+}
+function redactRemoteUrl(url) {
+  if (!url) return url;
+  if (SCP_LIKE.test(url) && !url.includes("://")) return url;
+  try {
+    const parsed = new URL(url);
+    if (parsed.username || parsed.password) {
+      parsed.username = "";
+      parsed.password = "";
+    }
+    return parsed.toString();
+  } catch {
+    return url.replace(/^([a-z]+:\/\/)[^/@]+@/i, "$1");
+  }
+}
+var CloneError = class extends Error {
+  constructor(message) {
+    super(message);
+    this.name = "CloneError";
+  }
+};
+function isGitAvailable() {
+  const result = spawnSync("git", ["--version"], { stdio: "ignore" });
+  return !result.error && result.status === 0;
+}
+function gitInstallHint() {
+  switch (process.platform) {
+    case "darwin":
+      return "Install git with: brew install git (or xcode-select --install).";
+    case "win32":
+      return "Install git with: winget install Git.Git";
+    default:
+      return "Install git via your distro package manager (e.g. apt install git).";
+  }
+}
+function runGit(args, opts) {
+  return new Promise((resolve10, reject) => {
+    const child = spawn2("git", args, {
+      stdio: ["ignore", "ignore", "pipe"],
+      // Never prompt for credentials on a private/forbidden repo — fail fast.
+      env: { ...process.env, GIT_TERMINAL_PROMPT: "0", GIT_ASKPASS: "echo" }
+    });
+    let stderr = "";
+    let killed = false;
+    const timer = setTimeout(() => {
+      killed = true;
+      child.kill("SIGKILL");
+    }, opts.timeoutMs);
+    child.stderr.on("data", (d) => {
+      if (stderr.length < 8192) stderr += scrubCredentials(String(d));
+    });
+    child.on("error", (err) => {
+      clearTimeout(timer);
+      reject(new CloneError(`Failed to run git: ${err.message}`));
+    });
+    child.on("close", (code) => {
+      clearTimeout(timer);
+      if (killed) {
+        reject(new CloneError(`git clone timed out for ${opts.redacted}`));
+        return;
+      }
+      resolve10({ code: code ?? 0, stderr: stderr.trim() });
+    });
+  });
+}
+function scrubCredentials(text) {
+  return text.replace(/([a-z]+:\/\/)[^/\s@]+@/gi, "$1");
+}
+async function cloneRepo(url, opts) {
+  const redacted = redactRemoteUrl(url);
+  if (!looksLikeRepoUrl(url)) {
+    throw new CloneError(
+      `Not a supported repository URL: ${redacted}. Use an http(s), ssh, git://, or scp-like (git@host:owner/repo.git) URL.`
+    );
+  }
+  if (/^file:\/\//i.test(url)) {
+    throw new CloneError("file:// URLs are not allowed for remote clone.");
+  }
+  if (!isGitAvailable()) {
+    throw new CloneError(`git is required to clone ${redacted} but was not found on PATH. ${gitInstallHint()}`);
+  }
+  const dir = await mkdtemp(path11.join(os3.tmpdir(), "vibgrate-hcs-clone-"));
+  const cleanup = async () => {
+    await rm(dir, { recursive: true, force: true }).catch(() => {
+    });
+  };
+  try {
+    if (opts.verbose) process.stderr.write(`Cloning ${redacted} \u2026
+`);
+    const clone = await runGit(
+      ["clone", "--depth", "1", "--quiet", "--", url, dir],
+      { timeoutMs: opts.timeoutMs, redacted }
+    );
+    if (clone.code !== 0) {
+      throw new CloneError(`git clone failed for ${redacted}: ${clone.stderr || `exit ${clone.code}`}`);
+    }
+    if (opts.ref) {
+      if (opts.verbose) process.stderr.write(`Checking out ${opts.ref} \u2026
+`);
+      const fetch2 = await runGit(
+        ["-C", dir, "fetch", "--depth", "1", "--quiet", "origin", opts.ref],
+        { timeoutMs: opts.timeoutMs, redacted }
+      );
+      const checkoutTarget = fetch2.code === 0 ? "FETCH_HEAD" : opts.ref;
+      const checkout = await runGit(
+        ["-C", dir, "checkout", "--quiet", "--detach", checkoutTarget],
+        { timeoutMs: opts.timeoutMs, redacted }
+      );
+      if (checkout.code !== 0) {
+        throw new CloneError(
+          `Could not check out ref "${opts.ref}" from ${redacted}: ${checkout.stderr || `exit ${checkout.code}`}`
+        );
+      }
+    }
+    return { dir, cleanup };
+  } catch (err) {
+    await cleanup();
+    throw err instanceof CloneError ? err : new CloneError(String(err));
+  }
+}
+
+// src/utils/scan-manifest.ts
+import * as crypto3 from "crypto";
+function computeFactContentHash(factLines) {
+  const hash = crypto3.createHash("sha256");
+  for (const line of factLines) {
+    hash.update(line);
+    hash.update("\n");
+  }
+  return `sha256:${hash.digest("hex")}`;
+}
+function deriveRepoName(remoteUrl) {
+  if (!remoteUrl) return void 0;
+  const withoutScheme = remoteUrl.replace(/^[a-z]+:\/\//i, "").replace(/^[^/@]+@/, "");
+  const pathPart = withoutScheme.replace(/^[^/:]+[/:]/, "");
+  const segments = pathPart.split("/").filter(Boolean);
+  if (segments.length === 0) return void 0;
+  const repo = segments[segments.length - 1].replace(/\.git$/i, "");
+  const owner = segments.length >= 2 ? segments[segments.length - 2] : void 0;
+  return owner ? `${owner}/${repo}` : repo;
+}
+function buildScanManifest(input) {
+  return {
+    factType: "ScanManifest",
+    manifestVersion: "1.0",
+    emittedAt: input.emittedAt ?? (/* @__PURE__ */ new Date()).toISOString(),
+    repository: {
+      remoteUrl: input.remoteUrl,
+      name: input.repositoryName ?? deriveRepoName(input.remoteUrl)
+    },
+    vcs: {
+      sha: input.sha,
+      shortSha: input.shortSha,
+      branch: input.branch,
+      ref: input.ref
+    },
+    source: input.source,
+    languages: [...input.languages].sort(),
+    scanId: input.scanId,
+    applicationId: input.applicationId,
+    vibgrateVersion: input.vibgrateVersion,
+    factCount: input.factLines.length,
+    contentHash: computeFactContentHash(input.factLines)
+  };
+}
+
 // src/commands/extract.ts
 var EXIT_SUCCESS = 0;
 var EXIT_SCHEMA_FAILURE = 1;
@@ -2840,14 +3368,14 @@ async function detectLanguages(rootDir, includeTests) {
   async function walk(dir, relBase) {
     let entries;
     try {
-      entries = await fs2.readdir(dir, { withFileTypes: true });
+      entries = await fs4.readdir(dir, { withFileTypes: true });
     } catch {
       return;
     }
     for (const entry of entries) {
       if (entry.name.startsWith(".")) continue;
-      const absPath = path9.join(dir, entry.name);
-      const relPath = path9.join(relBase, entry.name);
+      const absPath = path12.join(dir, entry.name);
+      const relPath = path12.join(relBase, entry.name);
       if (entry.isDirectory()) {
         if (!SKIP_DIRS.has(entry.name)) {
           await walk(absPath, relPath);
@@ -2856,7 +3384,7 @@ async function detectLanguages(rootDir, includeTests) {
       }
       if (!entry.isFile()) continue;
       if (!includeTests && isTestPath(relPath)) continue;
-      const ext = path9.extname(entry.name).toLowerCase();
+      const ext = path12.extname(entry.name).toLowerCase();
       for (const [lang, exts] of Object.entries(LANGUAGE_EXTENSIONS)) {
         if (exts.has(ext)) {
           counts.set(lang, (counts.get(lang) ?? 0) + 1);
@@ -2882,6 +3410,15 @@ function validateFactLine(line) {
     }
     return { valid: true };
   }
+  if (obj.factType === "ScanManifest") {
+    if (typeof obj.manifestVersion !== "string") {
+      return { valid: false, error: "ScanManifest missing manifestVersion" };
+    }
+    if (typeof obj.emittedAt !== "string") {
+      return { valid: false, error: "ScanManifest missing emittedAt" };
+    }
+    return { valid: true };
+  }
   if (typeof obj.factId !== "string" || !obj.factId) {
     return { valid: false, error: "Missing or invalid factId" };
   }
@@ -2923,7 +3460,7 @@ function splitHcsOutput(lines) {
       continue;
     }
     const obj = parsed;
-    if (obj.factType === "Models" || obj.factType === "References") {
+    if (obj.factType === "Models" || obj.factType === "References" || obj.factType === "ScanManifest") {
       preamble.push(line);
     } else {
       facts.push(line);
@@ -2932,10 +3469,10 @@ function splitHcsOutput(lines) {
   return { preamble, facts };
 }
 function resolveHcsWorkerBin() {
-  const base = import.meta.dirname ?? path9.dirname(new URL(import.meta.url).pathname);
-  const bundledPath = path9.resolve(base, "..", "dist", "hcs-worker.js");
+  const base = import.meta.dirname ?? path12.dirname(new URL(import.meta.url).pathname);
+  const bundledPath = path12.resolve(base, "..", "dist", "hcs-worker.js");
   if (existsSync(bundledPath)) return bundledPath;
-  const siblingPath = path9.resolve(base, "hcs-worker.js");
+  const siblingPath = path12.resolve(base, "hcs-worker.js");
   if (existsSync(siblingPath)) return siblingPath;
   try {
     const resolved = import.meta.resolve("@vibgrate/hcs-node-worker");
@@ -2943,9 +3480,9 @@ function resolveHcsWorkerBin() {
     if (existsSync(resolvedPath)) return resolvedPath;
   } catch {
   }
-  const monorepoPath = path9.resolve(base, "..", "..", "..", "vibgrate-hcs", "node", "dist", "main.js");
+  const monorepoPath = path12.resolve(base, "..", "..", "..", "vibgrate-hcs", "node", "dist", "main.js");
   if (existsSync(monorepoPath)) return monorepoPath;
-  const devPath = path9.resolve(base, "..", "..", "..", "vibgrate-hcs", "node", "src", "main.ts");
+  const devPath = path12.resolve(base, "..", "..", "..", "vibgrate-hcs", "node", "src", "main.ts");
   if (existsSync(devPath)) return devPath;
   throw new Error(
     'Cannot locate HCS worker. Run "pnpm build" in the CLI package to bundle the worker into dist/.'
@@ -3024,7 +3561,7 @@ var NATIVE_RUNTIME_REQUIREMENTS = {
 function commandExistsOnPath(command) {
   const probeArgs = process.platform === "win32" ? ["/c", command, "--version"] : ["--version"];
   const probeCmd = process.platform === "win32" ? "cmd" : command;
-  const result = spawnSync(probeCmd, probeArgs, { stdio: "ignore" });
+  const result = spawnSync2(probeCmd, probeArgs, { stdio: "ignore" });
   return !result.error && result.status === 0;
 }
 function buildNativeInstallHint(language) {
@@ -3048,12 +3585,12 @@ async function runNodeWorker(rootDir, language, opts) {
       args.push("--cobol-copybook-paths", opts.copybookPaths);
     }
   }
-  return new Promise((resolve9) => {
+  return new Promise((resolve10) => {
     const facts = [];
     const errors = [];
     let stdoutBuf = "";
     let killed = false;
-    const child = spawn("node", ["--enable-source-maps", workerBin, ...args], {
+    const child = spawn3("node", ["--enable-source-maps", workerBin, ...args], {
       cwd: rootDir,
       stdio: ["ignore", "pipe", "pipe"],
       env: { ...process.env, NODE_OPTIONS: "--max-old-space-size=4096" }
@@ -3085,7 +3622,7 @@ async function runNodeWorker(rootDir, language, opts) {
           continue;
         }
         if (opts.verbose) {
-          process.stderr.write(chalk9.dim(`[${language}] ${trimmed}
+          process.stderr.write(chalk12.dim(`[${language}] ${trimmed}
 `));
         }
         if (trimmed.startsWith("[error]")) {
@@ -3099,15 +3636,15 @@ async function runNodeWorker(rootDir, language, opts) {
         facts.push(stdoutBuf.trim());
       }
       if (killed) {
-        resolve9({ language, facts, errors: ["Worker killed: timeout exceeded"], exitCode: EXIT_TIMEOUT });
+        resolve10({ language, facts, errors: ["Worker killed: timeout exceeded"], exitCode: EXIT_TIMEOUT });
       } else {
-        resolve9({ language, facts, errors, exitCode: code ?? 0 });
+        resolve10({ language, facts, errors, exitCode: code ?? 0 });
       }
     });
     child.on("error", (err) => {
       clearTimeout(timer);
       errors.push(`Failed to spawn worker: ${err.message}`);
-      resolve9({ language, facts, errors, exitCode: EXIT_PARSE_FAILURE });
+      resolve10({ language, facts, errors, exitCode: EXIT_PARSE_FAILURE });
     });
   });
 }
@@ -3127,7 +3664,7 @@ function resolveDotnetPublishedWorker(workersDir) {
   };
   const candidates = candidatesByPlatform[process.platform] ?? [];
   for (const filename of candidates) {
-    const fullPath = path9.join(workersDir, filename);
+    const fullPath = path12.join(workersDir, filename);
     if (existsSync(fullPath)) {
       return fullPath;
     }
@@ -3135,30 +3672,30 @@ function resolveDotnetPublishedWorker(workersDir) {
   return null;
 }
 function resolveNativeWorker(language, projectDir) {
-  const base = import.meta.dirname ?? path9.dirname(new URL(import.meta.url).pathname);
-  const hcsFromBundle = path9.resolve(base, "..", "..", "vibgrate-hcs");
-  const hcsFromSrc = path9.resolve(base, "..", "..", "..", "vibgrate-hcs");
+  const base = import.meta.dirname ?? path12.dirname(new URL(import.meta.url).pathname);
+  const hcsFromBundle = path12.resolve(base, "..", "..", "vibgrate-hcs");
+  const hcsFromSrc = path12.resolve(base, "..", "..", "..", "vibgrate-hcs");
   const hcsRoot = existsSync(hcsFromBundle) ? hcsFromBundle : hcsFromSrc;
-  const workersDir = path9.resolve(base, "workers");
+  const workersDir = path12.resolve(base, "workers");
   switch (language) {
     case "go": {
-      const bin = path9.join(workersDir, process.platform === "win32" ? "vibgrate-hcs-go.exe" : "vibgrate-hcs-go");
+      const bin = path12.join(workersDir, process.platform === "win32" ? "vibgrate-hcs-go.exe" : "vibgrate-hcs-go");
       if (existsSync(bin)) {
         return { cmd: bin, args: ["--project", projectDir, "--output", "ndjson"] };
       }
-      const src = path9.join(hcsRoot, "go");
-      if (existsSync(path9.join(src, "main.go"))) {
+      const src = path12.join(hcsRoot, "go");
+      if (existsSync(path12.join(src, "main.go"))) {
         return { cmd: "go", args: ["run", ".", "--project", projectDir, "--output", "ndjson"], cwd: src };
       }
       return null;
     }
     case "python": {
-      const bin = path9.join(workersDir, "vibgrate-hcs-python");
+      const bin = path12.join(workersDir, "vibgrate-hcs-python");
       if (existsSync(bin)) {
         return { cmd: bin, args: ["--project", projectDir, "--output", "ndjson"] };
       }
-      const src = path9.join(hcsRoot, "python");
-      if (existsSync(path9.join(src, "pyproject.toml"))) {
+      const src = path12.join(hcsRoot, "python");
+      if (existsSync(path12.join(src, "pyproject.toml"))) {
         return {
           cmd: "python3",
           args: ["-m", "vibgrate_hcs_python.main", "--project", projectDir, "--output", "ndjson"],
@@ -3168,13 +3705,13 @@ function resolveNativeWorker(language, projectDir) {
       return null;
     }
     case "java": {
-      const jar = path9.join(workersDir, "vibgrate-hcs-jvm.jar");
+      const jar = path12.join(workersDir, "vibgrate-hcs-jvm.jar");
       if (existsSync(jar)) {
         return { cmd: "java", args: ["-jar", jar, "--project", projectDir, "--output", "ndjson"] };
       }
-      const src = path9.join(hcsRoot, "jvm");
-      if (existsSync(path9.join(src, "build.gradle.kts"))) {
-        const gradlew = path9.join(src, process.platform === "win32" ? "gradlew.bat" : "gradlew");
+      const src = path12.join(hcsRoot, "jvm");
+      if (existsSync(path12.join(src, "build.gradle.kts"))) {
+        const gradlew = path12.join(src, process.platform === "win32" ? "gradlew.bat" : "gradlew");
         const launcher = existsSync(gradlew) ? gradlew : "gradle";
         return {
           cmd: launcher,
@@ -3190,11 +3727,11 @@ function resolveNativeWorker(language, projectDir) {
       if (publishedWorker) {
         return { cmd: publishedWorker, args: ["--project", projectDir, "--output", "ndjson"] };
       }
-      const dll = path9.join(workersDir, "VibgrateHcsWorker.dll");
+      const dll = path12.join(workersDir, "VibgrateHcsWorker.dll");
       if (existsSync(dll)) {
         return { cmd: "dotnet", args: [dll, "--project", projectDir, "--output", "ndjson"] };
       }
-      const csproj = path9.join(hcsRoot, "dotnet", "src", "VibgrateHcsWorker", "VibgrateHcsWorker.csproj");
+      const csproj = path12.join(hcsRoot, "dotnet", "src", "VibgrateHcsWorker", "VibgrateHcsWorker.csproj");
       if (existsSync(csproj)) {
         return {
           cmd: "dotnet",
@@ -3220,19 +3757,19 @@ async function runNativeWorker(rootDir, language, opts) {
       exitCode: EXIT_PARSE_FAILURE
     };
   }
-  return new Promise((resolve9) => {
+  return new Promise((resolve10) => {
     const facts = [];
     const errors = [];
     let stdoutBuf = "";
     let killed = false;
     if (opts.verbose) {
-      process.stderr.write(chalk9.dim(`[${language}] Spawning: ${spec.cmd} ${spec.args.join(" ")}
+      process.stderr.write(chalk12.dim(`[${language}] Spawning: ${spec.cmd} ${spec.args.join(" ")}
 `));
     }
     const runtimeReq = NATIVE_RUNTIME_REQUIREMENTS[language];
     const usesPathCommand = runtimeReq && spec.cmd === runtimeReq.command;
     if (usesPathCommand && !commandExistsOnPath(spec.cmd)) {
-      resolve9({
+      resolve10({
         language,
         facts: [],
         errors: [
@@ -3244,7 +3781,7 @@ async function runNativeWorker(rootDir, language, opts) {
       });
       return;
     }
-    const child = spawn(spec.cmd, spec.args, {
+    const child = spawn3(spec.cmd, spec.args, {
       cwd: spec.cwd ?? rootDir,
       stdio: ["ignore", "pipe", "pipe"]
     });
@@ -3267,7 +3804,7 @@ async function runNativeWorker(rootDir, language, opts) {
         const trimmed = line.trim();
         if (!trimmed) continue;
         if (opts.verbose) {
-          process.stderr.write(chalk9.dim(`[${language}] ${trimmed}
+          process.stderr.write(chalk12.dim(`[${language}] ${trimmed}
 `));
         }
         if (trimmed.startsWith("[error]")) {
@@ -3279,9 +3816,9 @@ async function runNativeWorker(rootDir, language, opts) {
       clearTimeout(timer);
       if (stdoutBuf.trim()) facts.push(stdoutBuf.trim());
       if (killed) {
-        resolve9({ language, facts, errors: ["Worker killed: timeout exceeded"], exitCode: EXIT_TIMEOUT });
+        resolve10({ language, facts, errors: ["Worker killed: timeout exceeded"], exitCode: EXIT_TIMEOUT });
       } else {
-        resolve9({ language, facts, errors, exitCode: code ?? 0 });
+        resolve10({ language, facts, errors, exitCode: code ?? 0 });
       }
     });
     child.on("error", (err) => {
@@ -3290,21 +3827,21 @@ async function runNativeWorker(rootDir, language, opts) {
       errors.push(
         isNotFound ? `[error] '${spec.cmd}' not found. ${buildNativeInstallHint(language)}` : `[error] Failed to spawn native worker: ${err.message}`
       );
-      resolve9({ language, facts, errors, exitCode: EXIT_PARSE_FAILURE });
+      resolve10({ language, facts, errors, exitCode: EXIT_PARSE_FAILURE });
     });
   });
 }
 async function pushFacts(facts, dsn, verbose) {
   const parsed = parseDsn2(dsn);
   if (!parsed) {
-    process.stderr.write(chalk9.red("Invalid DSN format.\n"));
-    process.stderr.write(chalk9.dim("Expected: vibgrate+https://<key_id>:<secret>@<host>/<workspace_id>\n"));
+    process.stderr.write(chalk12.red("Invalid DSN format.\n"));
+    process.stderr.write(chalk12.dim("Expected: vibgrate+https://<key_id>:<secret>@<host>/<workspace_id>\n"));
     return false;
   }
   const body = facts.join("\n") + "\n";
   const url = `${parsed.scheme}://${parsed.host}/v1/ingest/hcs`;
   if (verbose) {
-    process.stderr.write(chalk9.dim(`Pushing ${facts.length} facts to ${parsed.host}...
+    process.stderr.write(chalk12.dim(`Pushing ${facts.length} facts to ${parsed.host}...
 `));
   }
   try {
@@ -3322,23 +3859,23 @@ async function pushFacts(facts, dsn, verbose) {
     });
     if (!response.ok) {
       const text = await response.text().catch(() => "");
-      process.stderr.write(chalk9.red(`Push failed: HTTP ${response.status} ${text}
+      process.stderr.write(chalk12.red(`Push failed: HTTP ${response.status} ${text}
 `));
       return false;
     }
     if (verbose) {
-      process.stderr.write(chalk9.green(`\u2714 Pushed ${facts.length} facts successfully
+      process.stderr.write(chalk12.green(`\u2714 Pushed ${facts.length} facts successfully
 `));
     }
     return true;
   } catch (err) {
-    process.stderr.write(chalk9.red(`Push failed: ${err instanceof Error ? err.message : String(err)}
+    process.stderr.write(chalk12.red(`Push failed: ${err instanceof Error ? err.message : String(err)}
 `));
     return false;
   }
 }
 async function loadFeedback(filePath) {
-  const content = await fs2.readFile(filePath, "utf-8");
+  const content = await fs4.readFile(filePath, "utf-8");
   const lines = content.split("\n").filter((l) => l.trim());
   for (const line of lines) {
     try {
@@ -3399,21 +3936,21 @@ var ProgressTracker = class {
     const parts = [];
     for (const [lang, st] of this.langStatus) {
       if (st.done) {
-        parts.push(chalk9.green(`${lang} \u2713`));
+        parts.push(chalk12.green(`${lang} \u2713`));
       } else if (st.phase === "waiting") {
-        parts.push(chalk9.dim(`${lang} \xB7`));
+        parts.push(chalk12.dim(`${lang} \xB7`));
       } else if (st.phase === "discovering") {
-        parts.push(chalk9.yellow(`${lang} \u2026`));
+        parts.push(chalk12.yellow(`${lang} \u2026`));
       } else if (st.phase === "scanning" && st.fileCount > 0) {
         const pct = Math.round(st.fileIndex / st.fileCount * 100);
-        parts.push(chalk9.cyan(`${lang} ${st.fileIndex}/${st.fileCount} ${pct}%`));
+        parts.push(chalk12.cyan(`${lang} ${st.fileIndex}/${st.fileCount} ${pct}%`));
       } else if (st.phase === "extracting") {
-        parts.push(chalk9.cyan(`${lang} extracting`));
+        parts.push(chalk12.cyan(`${lang} extracting`));
       } else {
-        parts.push(chalk9.dim(`${lang} ${st.phase}`));
+        parts.push(chalk12.dim(`${lang} ${st.phase}`));
       }
     }
-    const line = `  ${parts.join("  ")}  ${chalk9.dim(`${this.totalFacts} facts`)}`;
+    const line = `  ${parts.join("  ")}  ${chalk12.dim(`${this.totalFacts} facts`)}`;
     const padding = Math.max(0, this.lastLineLen - line.length);
     process.stderr.write(`\r${line}${" ".repeat(padding)}`);
     this.lastLineLen = line.length;
@@ -3425,58 +3962,95 @@ var ProgressTracker = class {
     }
   }
 };
-var extractCommand = new Command8("extract").description("Analyze source code and emit validated HCS facts (NDJSON)").argument("[path]", "Path to source directory", ".").option("-o, --out <file>", "Write NDJSON to file (default: stdout)").option("--language <langs>", "Comma-separated languages to analyze (default: auto-detect)").option("--include-tests", "Include test files in analysis").option("--push", "Stream validated facts to dashboard API").option("--dsn <dsn>", "DSN token for push (or use VIBGRATE_DSN env)").option("--concurrency <n>", "Number of parallel file workers").option("--timeout-mins <mins>", "Total analysis timeout in minutes", "60").option("--feedback <file>", "Load NDJSON diff artifact for refinement").option("--derive", "Derive behavioural spec facts (BehaviouralAssertion/BehaviouralSpec) from extracted facts").option("--scan-id <id>", 'Scan id for the derived BehaviouralSpec (default: "local")').option("--application-id <id>", "Application id for the derived BehaviouralSpec (default: directory name)").option("--verbose", "Print worker stderr and summary statistics").action(async (targetPath, opts) => {
-  const rootDir = path9.resolve(targetPath);
-  if (!await pathExists(rootDir)) {
-    process.stderr.write(chalk9.red(`Path does not exist: ${rootDir}
+var extractCommand = new Command10("extract").description("Analyze source code and emit validated HCS facts (NDJSON)").argument("[path-or-url]", "Path to source directory, or a public repository URL to clone", ".").option("--repo-url <url>", "Public repository URL to clone and analyze (alternative to passing a URL positionally)").option("--ref <ref>", "Branch, tag, or commit SHA to check out when cloning a repository URL").option("--keep-clone", "Do not delete the temporary clone after extraction (prints its path)").option("--clone-timeout-mins <mins>", "Clone/fetch timeout in minutes", "10").option("-o, --out <file>", "Write NDJSON to file (default: stdout)").option("--language <langs>", "Comma-separated languages to analyze (default: auto-detect)").option("--include-tests", "Include test files in analysis").option("--push", "Stream validated facts to dashboard API").option("--dsn <dsn>", "DSN token for push (or use VIBGRATE_DSN env)").option("--concurrency <n>", "Number of parallel file workers").option("--timeout-mins <mins>", "Total analysis timeout in minutes", "60").option("--feedback <file>", "Load NDJSON diff artifact for refinement").option("--derive", "Derive behavioural spec facts (BehaviouralAssertion/BehaviouralSpec) from extracted facts").option("--scan-id <id>", 'Scan id for the derived BehaviouralSpec (default: "local")').option("--application-id <id>", "Application id for the derived BehaviouralSpec (default: directory name)").option("--verbose", "Print worker stderr and summary statistics").action(async (targetPath, opts) => {
+  const urlArg = opts.repoUrl ?? (looksLikeRepoUrl(targetPath) ? targetPath : void 0);
+  const source = urlArg ? "url" : "local";
+  let rootDir;
+  let manifestRemoteUrl;
+  if (urlArg) {
+    const cloneTimeoutMins = parseInt(opts.cloneTimeoutMins, 10);
+    if (isNaN(cloneTimeoutMins) || cloneTimeoutMins < 1) {
+      process.stderr.write(chalk12.red("--clone-timeout-mins must be >= 1\n"));
+      process.exit(EXIT_USAGE_ERROR);
+    }
+    manifestRemoteUrl = redactRemoteUrl(urlArg);
+    try {
+      const cloned = await cloneRepo(urlArg, {
+        ref: opts.ref,
+        timeoutMs: cloneTimeoutMins * 60 * 1e3,
+        verbose: opts.verbose ?? false
+      });
+      rootDir = cloned.dir;
+      if (opts.keepClone) {
+        process.stderr.write(chalk12.dim(`Clone retained at: ${cloned.dir}
 `));
-    process.exit(EXIT_USAGE_ERROR);
-  }
-  let stat3;
-  try {
-    stat3 = await fs2.stat(rootDir);
-  } catch {
-    process.stderr.write(chalk9.red(`Cannot read path: ${rootDir}
+      } else {
+        process.once("exit", () => {
+          try {
+            rmSync2(cloned.dir, { recursive: true, force: true });
+          } catch {
+          }
+        });
+      }
+    } catch (err) {
+      const msg = err instanceof CloneError ? err.message : err instanceof Error ? err.message : String(err);
+      process.stderr.write(chalk12.red(`Clone failed: ${msg}
 `));
-    process.exit(EXIT_USAGE_ERROR);
-  }
-  if (!stat3.isDirectory()) {
-    process.stderr.write(chalk9.red(`Path must be a directory: ${rootDir}
+      process.exit(EXIT_USAGE_ERROR);
+    }
+  } else {
+    rootDir = path12.resolve(targetPath);
+    if (!await pathExists(rootDir)) {
+      process.stderr.write(chalk12.red(`Path does not exist: ${rootDir}
 `));
-    process.exit(EXIT_USAGE_ERROR);
+      process.exit(EXIT_USAGE_ERROR);
+    }
+    let stat4;
+    try {
+      stat4 = await fs4.stat(rootDir);
+    } catch {
+      process.stderr.write(chalk12.red(`Cannot read path: ${rootDir}
+`));
+      process.exit(EXIT_USAGE_ERROR);
+    }
+    if (!stat4.isDirectory()) {
+      process.stderr.write(chalk12.red(`Path must be a directory: ${rootDir}
+`));
+      process.exit(EXIT_USAGE_ERROR);
+    }
   }
   const dsn = opts.dsn || process.env.VIBGRATE_DSN;
   if (opts.push && !dsn) {
-    process.stderr.write(chalk9.red("--push requires --dsn or VIBGRATE_DSN environment variable\n"));
+    process.stderr.write(chalk12.red("--push requires --dsn or VIBGRATE_DSN environment variable\n"));
     process.exit(EXIT_USAGE_ERROR);
   }
   if (dsn && !parseDsn2(dsn)) {
-    process.stderr.write(chalk9.red("Invalid DSN format.\n"));
-    process.stderr.write(chalk9.dim("Expected: vibgrate+https://<key_id>:<secret>@<host>/<workspace_id>\n"));
+    process.stderr.write(chalk12.red("Invalid DSN format.\n"));
+    process.stderr.write(chalk12.dim("Expected: vibgrate+https://<key_id>:<secret>@<host>/<workspace_id>\n"));
     process.exit(EXIT_USAGE_ERROR);
   }
-  const concurrency = opts.concurrency ? parseInt(opts.concurrency, 10) : os2.cpus().length;
+  const concurrency = opts.concurrency ? parseInt(opts.concurrency, 10) : os4.cpus().length;
   if (isNaN(concurrency) || concurrency < 1) {
-    process.stderr.write(chalk9.red("--concurrency must be >= 1\n"));
+    process.stderr.write(chalk12.red("--concurrency must be >= 1\n"));
     process.exit(EXIT_USAGE_ERROR);
   }
   const timeoutMins = parseInt(opts.timeoutMins, 10);
   if (isNaN(timeoutMins) || timeoutMins < 1) {
-    process.stderr.write(chalk9.red("--timeout-mins must be >= 1\n"));
+    process.stderr.write(chalk12.red("--timeout-mins must be >= 1\n"));
     process.exit(EXIT_USAGE_ERROR);
   }
   const timeoutMs = timeoutMins * 60 * 1e3;
   if (opts.out) {
-    const outDir = path9.dirname(path9.resolve(opts.out));
+    const outDir = path12.dirname(path12.resolve(opts.out));
     if (!await pathExists(outDir)) {
-      process.stderr.write(chalk9.red(`Output directory does not exist: ${outDir}
+      process.stderr.write(chalk12.red(`Output directory does not exist: ${outDir}
 `));
       process.exit(EXIT_USAGE_ERROR);
     }
     try {
-      const outStat = await fs2.stat(path9.resolve(opts.out));
+      const outStat = await fs4.stat(path12.resolve(opts.out));
       if (outStat.isDirectory()) {
-        process.stderr.write(chalk9.red(`--out cannot be a directory: ${opts.out}
+        process.stderr.write(chalk12.red(`--out cannot be a directory: ${opts.out}
 `));
         process.exit(EXIT_USAGE_ERROR);
       }
@@ -3485,16 +4059,16 @@ var extractCommand = new Command8("extract").description("Analyze source code an
   }
   let feedbackLines;
   if (opts.feedback) {
-    const feedbackPath = path9.resolve(opts.feedback);
+    const feedbackPath = path12.resolve(opts.feedback);
     if (!await pathExists(feedbackPath)) {
-      process.stderr.write(chalk9.red(`Feedback file not found: ${feedbackPath}
+      process.stderr.write(chalk12.red(`Feedback file not found: ${feedbackPath}
 `));
       process.exit(EXIT_USAGE_ERROR);
     }
     try {
       feedbackLines = await loadFeedback(feedbackPath);
     } catch (err) {
-      process.stderr.write(chalk9.red(`Invalid feedback file: ${err instanceof Error ? err.message : String(err)}
+      process.stderr.write(chalk12.red(`Invalid feedback file: ${err instanceof Error ? err.message : String(err)}
 `));
       process.exit(EXIT_USAGE_ERROR);
     }
@@ -3504,9 +4078,9 @@ var extractCommand = new Command8("extract").description("Analyze source code an
     targetLanguages = opts.language.split(",").map((l) => normalizeLanguageToken(l)).filter(Boolean);
     for (const lang of targetLanguages) {
       if (!SUPPORTED_LANGUAGES.has(lang)) {
-        process.stderr.write(chalk9.red(`Unknown language: "${lang}"
+        process.stderr.write(chalk12.red(`Unknown language: "${lang}"
 `));
-        process.stderr.write(chalk9.dim(`Supported: ${[...SUPPORTED_LANGUAGES].sort().join(", ")}
+        process.stderr.write(chalk12.dim(`Supported: ${[...SUPPORTED_LANGUAGES].sort().join(", ")}
 `));
         process.exit(EXIT_USAGE_ERROR);
       }
@@ -3514,14 +4088,14 @@ var extractCommand = new Command8("extract").description("Analyze source code an
   } else {
     const detected = await detectLanguages(rootDir, opts.includeTests ?? false);
     if (detected.length === 0) {
-      process.stderr.write(chalk9.yellow("No supported source files detected.\n"));
+      process.stderr.write(chalk12.yellow("No supported source files detected.\n"));
       process.exit(EXIT_SUCCESS);
     }
     targetLanguages = detected.map((d) => d.language);
     if (opts.verbose) {
-      process.stderr.write(chalk9.dim("Detected languages:\n"));
+      process.stderr.write(chalk12.dim("Detected languages:\n"));
       for (const d of detected) {
-        process.stderr.write(chalk9.dim(`  ${d.language}: ${d.fileCount} files
+        process.stderr.write(chalk12.dim(`  ${d.language}: ${d.fileCount} files
 `));
       }
     }
@@ -3529,20 +4103,20 @@ var extractCommand = new Command8("extract").description("Analyze source code an
   const runnableLanguages = targetLanguages.filter((l) => ALL_WORKER_LANGS.has(l));
   const unknownWorkerLangs = targetLanguages.filter((l) => !ALL_WORKER_LANGS.has(l));
   if (unknownWorkerLangs.length > 0 && opts.verbose) {
-    process.stderr.write(chalk9.dim(
+    process.stderr.write(chalk12.dim(
       `No worker registered for: ${unknownWorkerLangs.join(", ")} \u2014 skipping.
 `
     ));
   }
   if (runnableLanguages.length === 0) {
-    process.stderr.write(chalk9.yellow("No languages with available HCS workers found.\n"));
+    process.stderr.write(chalk12.yellow("No languages with available HCS workers found.\n"));
     process.exit(EXIT_SUCCESS);
   }
   const startTime = Date.now();
   const globalDeadline = startTime + timeoutMs;
   process.stderr.write(
-    chalk9.bold(`Extracting HCS facts from ${rootDir}
-`) + chalk9.dim(`Languages: ${runnableLanguages.join(", ")}  Concurrency: ${concurrency}  Timeout: ${timeoutMins}m
+    chalk12.bold(`Extracting HCS facts from ${rootDir}
+`) + chalk12.dim(`Languages: ${runnableLanguages.join(", ")}  Concurrency: ${concurrency}  Timeout: ${timeoutMins}m
 `)
   );
   const progress = new ProgressTracker(runnableLanguages);
@@ -3589,7 +4163,7 @@ var extractCommand = new Command8("extract").description("Analyze source code an
           hasSchemaFailure = true;
           allErrors.push(`[${language}] Schema validation: ${validation.error}`);
           if (opts.verbose) {
-            process.stderr.write(chalk9.red(`[${language}] Invalid fact: ${validation.error}
+            process.stderr.write(chalk12.red(`[${language}] Invalid fact: ${validation.error}
 `));
           }
         }
@@ -3615,7 +4189,7 @@ var extractCommand = new Command8("extract").description("Analyze source code an
   progress.finish(elapsed);
   if (opts.derive) {
     const scanId = opts.scanId || "local";
-    const applicationId = opts.applicationId || path9.basename(rootDir);
+    const applicationId = opts.applicationId || path12.basename(rootDir);
     const { envelopes, summary } = deriveBehaviouralFacts(derivedInputs, { scanId, applicationId });
     for (const env of envelopes) {
       const line = JSON.stringify(env);
@@ -3626,18 +4200,42 @@ var extractCommand = new Command8("extract").description("Analyze source code an
         allErrors.push("[behavioural] derived fact failed schema validation");
       }
     }
-    process.stderr.write(chalk9.dim(
+    process.stderr.write(chalk12.dim(
       `Derived ${summary.assertions} behavioural assertion(s) \xB7 confidence ${summary.behaviouralConfidence} (${summary.assertedFacts}/${summary.surfaceFacts} surface facts)
 `
     ));
   }
   allFacts.sort();
-  const allLines = [...allPreamble, ...allFacts];
+  const manifestScanId = opts.scanId || "local";
+  const manifestApplicationId = opts.applicationId || (source === "url" ? deriveRepoName(manifestRemoteUrl) : void 0) || path12.basename(rootDir);
+  let manifestVcs;
+  try {
+    manifestVcs = await detectVcs2(rootDir);
+  } catch {
+    manifestVcs = void 0;
+  }
+  const manifest = buildScanManifest({
+    // Prefer the redacted URL we cloned from; fall back to the local repo's
+    // configured remote (also credential-redacted) for non-URL scans.
+    remoteUrl: manifestRemoteUrl ?? (manifestVcs?.remoteUrl ? redactRemoteUrl(manifestVcs.remoteUrl) : void 0),
+    sha: manifestVcs?.sha,
+    shortSha: manifestVcs?.shortSha,
+    branch: manifestVcs?.branch,
+    ref: opts.ref,
+    source,
+    languages: runnableLanguages,
+    scanId: manifestScanId,
+    applicationId: manifestApplicationId,
+    vibgrateVersion: VERSION,
+    factLines: allFacts
+  });
+  const manifestLine = JSON.stringify(manifest);
+  const allLines = [manifestLine, ...allPreamble, ...allFacts];
   const ndjsonOutput = allLines.join("\n") + (allLines.length > 0 ? "\n" : "");
   if (opts.out) {
-    const outPath = path9.resolve(opts.out);
-    await fs2.writeFile(outPath, ndjsonOutput, "utf-8");
-    process.stderr.write(chalk9.green(`\u2714 Wrote ${allFacts.length} facts to ${outPath}
+    const outPath = path12.resolve(opts.out);
+    await fs4.writeFile(outPath, ndjsonOutput, "utf-8");
+    process.stderr.write(chalk12.green(`\u2714 Wrote ${allFacts.length} facts to ${outPath}
 `));
   } else {
     process.stdout.write(ndjsonOutput);
@@ -3649,48 +4247,48 @@ var extractCommand = new Command8("extract").description("Analyze source code an
     }
   }
   if (opts.verbose) {
-    process.stderr.write(chalk9.dim("\n\u2500\u2500 Summary \u2500\u2500\n"));
-    process.stderr.write(chalk9.dim(`  Facts emitted : ${allFacts.length}
+    process.stderr.write(chalk12.dim("\n\u2500\u2500 Summary \u2500\u2500\n"));
+    process.stderr.write(chalk12.dim(`  Facts emitted : ${allFacts.length}
 `));
-    process.stderr.write(chalk9.dim(`  Languages     : ${runnableLanguages.join(", ")}
+    process.stderr.write(chalk12.dim(`  Languages     : ${runnableLanguages.join(", ")}
 `));
-    process.stderr.write(chalk9.dim(`  Elapsed       : ${elapsed}s
+    process.stderr.write(chalk12.dim(`  Elapsed       : ${elapsed}s
 `));
     if (allErrors.length > 0) {
-      process.stderr.write(chalk9.dim(`  Errors        : ${allErrors.length}
+      process.stderr.write(chalk12.dim(`  Errors        : ${allErrors.length}
 `));
       for (const err of allErrors.slice(0, 10)) {
-        process.stderr.write(chalk9.dim(`    ${err}
+        process.stderr.write(chalk12.dim(`    ${err}
 `));
       }
       if (allErrors.length > 10) {
-        process.stderr.write(chalk9.dim(`    ... and ${allErrors.length - 10} more
+        process.stderr.write(chalk12.dim(`    ... and ${allErrors.length - 10} more
 `));
       }
     }
-    process.stderr.write(chalk9.dim("\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\n\n"));
+    process.stderr.write(chalk12.dim("\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\n\n"));
   }
   if (hasTimeout) {
-    process.stderr.write(chalk9.red(`Timeout exceeded (${timeoutMins} minutes)
+    process.stderr.write(chalk12.red(`Timeout exceeded (${timeoutMins} minutes)
 `));
     process.exit(EXIT_TIMEOUT);
   }
   if (hasSchemaFailure) {
-    process.stderr.write(chalk9.red("Fact schema validation failures detected\n"));
+    process.stderr.write(chalk12.red("Fact schema validation failures detected\n"));
     process.exit(EXIT_SCHEMA_FAILURE);
   }
   if (hasParseFailure) {
-    process.stderr.write(chalk9.red("Parsing failures detected\n"));
+    process.stderr.write(chalk12.red("Parsing failures detected\n"));
     process.exit(EXIT_PARSE_FAILURE);
   }
 });
 
 // src/commands/diff.ts
-import * as path10 from "path";
-import * as fs3 from "fs/promises";
-import * as crypto3 from "crypto";
-import { Command as Command9 } from "commander";
-import chalk10 from "chalk";
+import * as path13 from "path";
+import * as fs5 from "fs/promises";
+import * as crypto4 from "crypto";
+import { Command as Command11 } from "commander";
+import chalk13 from "chalk";
 var EXIT_INVALID_PATH = 2;
 var EXIT_USAGE_ERROR2 = 5;
 var VALID_FORMATS = /* @__PURE__ */ new Set(["ndjson", "json", "patch"]);
@@ -3706,14 +4304,14 @@ async function discoverFiles(root, includeGlobs, excludeGlobs) {
   async function walk(dir, relBase) {
     let entries;
     try {
-      entries = await fs3.readdir(dir, { withFileTypes: true });
+      entries = await fs5.readdir(dir, { withFileTypes: true });
     } catch {
       return;
     }
     for (const entry of entries) {
       if (entry.name.startsWith(".") && SKIP_DIRS2.has(entry.name)) continue;
-      const absPath = path10.join(dir, entry.name);
-      const relPath = path10.join(relBase, entry.name);
+      const absPath = path13.join(dir, entry.name);
+      const relPath = path13.join(relBase, entry.name);
       if (entry.isDirectory()) {
         if (!SKIP_DIRS2.has(entry.name)) {
           await walk(absPath, relPath);
@@ -3884,7 +4482,7 @@ function lcsRatio(a, b) {
   return 2 * lcsLen / (n + m);
 }
 function generateDeltaId(kind, filePath) {
-  const hash = crypto3.createHash("sha256").update(`${kind}:${filePath}`).digest("hex").substring(0, 16);
+  const hash = crypto4.createHash("sha256").update(`${kind}:${filePath}`).digest("hex").substring(0, 16);
   return `hcs:delta:${hash}`;
 }
 function formatNdjson(deltas) {
@@ -3896,8 +4494,8 @@ function formatJson(deltas) {
 function formatPatch(deltas, originalPath, generatedPath) {
   const lines = [];
   for (const delta of deltas) {
-    const aFile = delta.originalPath ? path10.join("a", delta.originalPath) : "/dev/null";
-    const bFile = delta.generatedPath ? path10.join("b", delta.generatedPath) : "/dev/null";
+    const aFile = delta.originalPath ? path13.join("a", delta.originalPath) : "/dev/null";
+    const bFile = delta.generatedPath ? path13.join("b", delta.generatedPath) : "/dev/null";
     if (delta.changeKind === "renamed" && delta.originalPath && delta.generatedPath) {
       lines.push(`diff --vibgrate ${aFile} ${bFile}`);
       lines.push(`similarity index ${Math.round((delta.similarity ?? 0) * 100)}%`);
@@ -3918,38 +4516,38 @@ function formatPatch(deltas, originalPath, generatedPath) {
   }
   return lines.join("\n");
 }
-var diffCommand = new Command9("diff").description("Compare two directory trees and emit structured delta facts").argument("<original_path>", "Original source directory").argument("<generated_path>", "Generated source directory").option("-o, --out <file>", "Output file path", "vibgrate.diff.ndjson").option("--format <fmt>", "Output format (ndjson|json|patch)", "ndjson").option("--ignore-whitespace", "Ignore whitespace-only changes").option("--context <n>", "Context lines for patch output", "3").option("--include <globs>", "Only include matching files (comma-separated)").option("--exclude <globs>", "Exclude matching files (comma-separated)").option("--stats", "Include insertions/deletions summary per file").option("--verbose", "Print file match decisions and rename detection").action(async (originalPath, generatedPath, opts) => {
-  const origDir = path10.resolve(originalPath);
-  const genDir = path10.resolve(generatedPath);
+var diffCommand = new Command11("diff").description("Compare two directory trees and emit structured delta facts").argument("<original_path>", "Original source directory").argument("<generated_path>", "Generated source directory").option("-o, --out <file>", "Output file path", "vibgrate.diff.ndjson").option("--format <fmt>", "Output format (ndjson|json|patch)", "ndjson").option("--ignore-whitespace", "Ignore whitespace-only changes").option("--context <n>", "Context lines for patch output", "3").option("--include <globs>", "Only include matching files (comma-separated)").option("--exclude <globs>", "Exclude matching files (comma-separated)").option("--stats", "Include insertions/deletions summary per file").option("--verbose", "Print file match decisions and rename detection").action(async (originalPath, generatedPath, opts) => {
+  const origDir = path13.resolve(originalPath);
+  const genDir = path13.resolve(generatedPath);
   for (const [label, dir] of [["original_path", origDir], ["generated_path", genDir]]) {
     if (!await pathExists(dir)) {
-      process.stderr.write(chalk10.red(`${label} does not exist: ${dir}
+      process.stderr.write(chalk13.red(`${label} does not exist: ${dir}
 `));
       process.exit(EXIT_INVALID_PATH);
     }
-    let stat3;
+    let stat4;
     try {
-      stat3 = await fs3.stat(dir);
+      stat4 = await fs5.stat(dir);
     } catch {
-      process.stderr.write(chalk10.red(`Cannot read ${label}: ${dir}
+      process.stderr.write(chalk13.red(`Cannot read ${label}: ${dir}
 `));
       process.exit(EXIT_INVALID_PATH);
     }
-    if (!stat3.isDirectory()) {
-      process.stderr.write(chalk10.red(`${label} must be a directory: ${dir}
+    if (!stat4.isDirectory()) {
+      process.stderr.write(chalk13.red(`${label} must be a directory: ${dir}
 `));
       process.exit(EXIT_INVALID_PATH);
     }
   }
   const format = opts.format.toLowerCase();
   if (!VALID_FORMATS.has(format)) {
-    process.stderr.write(chalk10.red(`Invalid format: "${opts.format}". Allowed: ndjson, json, patch
+    process.stderr.write(chalk13.red(`Invalid format: "${opts.format}". Allowed: ndjson, json, patch
 `));
     process.exit(EXIT_USAGE_ERROR2);
   }
   const contextLines = parseInt(opts.context, 10);
   if (isNaN(contextLines) || contextLines < 0) {
-    process.stderr.write(chalk10.red("--context must be >= 0\n"));
+    process.stderr.write(chalk13.red("--context must be >= 0\n"));
     process.exit(EXIT_USAGE_ERROR2);
   }
   const includeGlobs = opts.include ? opts.include.split(",").map((g) => g.trim()).filter(Boolean) : void 0;
@@ -3961,9 +4559,9 @@ var diffCommand = new Command9("diff").description("Compare two directory trees
   const origMap = new Map(origFiles.map((f) => [f.relPath, f]));
   const genMap = new Map(genFiles.map((f) => [f.relPath, f]));
   if (opts.verbose) {
-    process.stderr.write(chalk10.dim(`Original: ${origFiles.length} files
+    process.stderr.write(chalk13.dim(`Original: ${origFiles.length} files
 `));
-    process.stderr.write(chalk10.dim(`Generated: ${genFiles.length} files
+    process.stderr.write(chalk13.dim(`Generated: ${genFiles.length} files
 `));
   }
   const deltas = [];
@@ -3974,8 +4572,8 @@ var diffCommand = new Command9("diff").description("Compare two directory trees
     if (genFile) {
       matchedOrig.add(relPath);
       matchedGen.add(relPath);
-      const origContent = await fs3.readFile(origFile.absPath, "utf-8");
-      const genContent = await fs3.readFile(genFile.absPath, "utf-8");
+      const origContent = await fs5.readFile(origFile.absPath, "utf-8");
+      const genContent = await fs5.readFile(genFile.absPath, "utf-8");
       const origCompare = opts.ignoreWhitespace ? origContent.replace(/\s+/g, " ").trim() : origContent;
       const genCompare = opts.ignoreWhitespace ? genContent.replace(/\s+/g, " ").trim() : genContent;
       if (origCompare !== genCompare) {
@@ -3997,7 +4595,7 @@ var diffCommand = new Command9("diff").description("Compare two directory trees
         }
         deltas.push(delta);
         if (opts.verbose) {
-          process.stderr.write(chalk10.dim(`  modified: ${relPath} (+${diffResult.insertions} -${diffResult.deletions})
+          process.stderr.write(chalk13.dim(`  modified: ${relPath} (+${diffResult.insertions} -${diffResult.deletions})
 `));
         }
       }
@@ -4014,13 +4612,13 @@ var diffCommand = new Command9("diff").description("Compare two directory trees
     await Promise.all([
       ...unmatchedOrig.map(async (f) => {
         try {
-          origContents.set(f.relPath, await fs3.readFile(f.absPath, "utf-8"));
+          origContents.set(f.relPath, await fs5.readFile(f.absPath, "utf-8"));
         } catch {
         }
       }),
       ...unmatchedGen.map(async (f) => {
         try {
-          genContents.set(f.relPath, await fs3.readFile(f.absPath, "utf-8"));
+          genContents.set(f.relPath, await fs5.readFile(f.absPath, "utf-8"));
         } catch {
         }
       })
@@ -4028,7 +4626,7 @@ var diffCommand = new Command9("diff").description("Compare two directory trees
     const pairs = [];
     for (const [origPath, origContent] of origContents) {
       for (const [genPath, genContent] of genContents) {
-        if (path10.extname(origPath) !== path10.extname(genPath)) continue;
+        if (path13.extname(origPath) !== path13.extname(genPath)) continue;
         const similarity = computeSimilarity(origContent, genContent);
         if (similarity >= RENAME_THRESHOLD) {
           pairs.push({ origPath, genPath, similarity });
@@ -4061,7 +4659,7 @@ var diffCommand = new Command9("diff").description("Compare two directory trees
       }
       deltas.push(delta);
       if (opts.verbose) {
-        process.stderr.write(chalk10.dim(
+        process.stderr.write(chalk13.dim(
           `  renamed: ${pair.origPath} \u2192 ${pair.genPath} (${(pair.similarity * 100).toFixed(0)}% similar)
 `
         ));
@@ -4078,7 +4676,7 @@ var diffCommand = new Command9("diff").description("Compare two directory trees
     };
     if (opts.stats) {
       try {
-        const content = await fs3.readFile(file.absPath, "utf-8");
+        const content = await fs5.readFile(file.absPath, "utf-8");
         delta.stats = { insertions: 0, deletions: content.split("\n").length };
       } catch {
         delta.stats = { insertions: 0, deletions: 0 };
@@ -4086,7 +4684,7 @@ var diffCommand = new Command9("diff").description("Compare two directory trees
     }
     deltas.push(delta);
     if (opts.verbose) {
-      process.stderr.write(chalk10.dim(`  removed: ${file.relPath}
+      process.stderr.write(chalk13.dim(`  removed: ${file.relPath}
 `));
     }
   }
@@ -4100,7 +4698,7 @@ var diffCommand = new Command9("diff").description("Compare two directory trees
     };
     if (opts.stats) {
       try {
-        const content = await fs3.readFile(file.absPath, "utf-8");
+        const content = await fs5.readFile(file.absPath, "utf-8");
         delta.stats = { insertions: content.split("\n").length, deletions: 0 };
       } catch {
         delta.stats = { insertions: 0, deletions: 0 };
@@ -4108,7 +4706,7 @@ var diffCommand = new Command9("diff").description("Compare two directory trees
     }
     deltas.push(delta);
     if (opts.verbose) {
-      process.stderr.write(chalk10.dim(`  added: ${file.relPath}
+      process.stderr.write(chalk13.dim(`  added: ${file.relPath}
 `));
     }
   }
@@ -4129,16 +4727,16 @@ var diffCommand = new Command9("diff").description("Compare two directory trees
       output = formatPatch(deltas, originalPath, generatedPath);
       break;
   }
-  const outPath = path10.resolve(opts.out);
-  await fs3.writeFile(outPath, output, "utf-8");
+  const outPath = path13.resolve(opts.out);
+  await fs5.writeFile(outPath, output, "utf-8");
   const added = deltas.filter((d) => d.changeKind === "added").length;
   const removed = deltas.filter((d) => d.changeKind === "removed").length;
   const modified = deltas.filter((d) => d.changeKind === "modified").length;
   const renamed = deltas.filter((d) => d.changeKind === "renamed").length;
   process.stderr.write(
-    chalk10.green(`\u2714 `) + `${deltas.length} changes: ` + chalk10.green(`+${added} added`) + ", " + chalk10.red(`-${removed} removed`) + ", " + chalk10.yellow(`~${modified} modified`) + ", " + chalk10.blue(`\u2192${renamed} renamed`) + "\n"
+    chalk13.green(`\u2714 `) + `${deltas.length} changes: ` + chalk13.green(`+${added} added`) + ", " + chalk13.red(`-${removed} removed`) + ", " + chalk13.yellow(`~${modified} modified`) + ", " + chalk13.blue(`\u2192${renamed} renamed`) + "\n"
   );
-  process.stderr.write(chalk10.dim(`  Written to ${outPath}
+  process.stderr.write(chalk13.dim(`  Written to ${outPath}
 `));
   if (opts.verbose && opts.stats) {
     let totalIns = 0;
@@ -4149,193 +4747,193 @@ var diffCommand = new Command9("diff").description("Compare two directory trees
         totalDel += d.stats.deletions;
       }
     }
-    process.stderr.write(chalk10.dim(`  Total: +${totalIns} insertions, -${totalDel} deletions
+    process.stderr.write(chalk13.dim(`  Total: +${totalIns} insertions, -${totalDel} deletions
 `));
   }
 });
 
 // src/commands/help.ts
-import { Command as Command10 } from "commander";
-import chalk11 from "chalk";
+import { Command as Command12 } from "commander";
+import chalk14 from "chalk";
 var HELP_URL = "https://vibgrate.com/help";
 function printFooter() {
   console.log("");
-  console.log(chalk11.dim(`See ${HELP_URL} for more guidance`));
+  console.log(chalk14.dim(`See ${HELP_URL} for more guidance`));
 }
 var detailedHelp = {
   scan: () => {
     console.log("");
-    console.log(chalk11.bold.underline("vibgrate scan") + chalk11.dim(" \u2014 Scan a project for upgrade drift"));
+    console.log(chalk14.bold.underline("vibgrate scan") + chalk14.dim(" \u2014 Scan a project for upgrade drift"));
     console.log("");
-    console.log(chalk11.bold("Usage:"));
+    console.log(chalk14.bold("Usage:"));
     console.log("  vibgrate scan [path] [options]");
     console.log("");
-    console.log(chalk11.bold("Arguments:"));
-    console.log(`  ${chalk11.cyan("[path]")}                       Path to scan (default: current directory)`);
+    console.log(chalk14.bold("Arguments:"));
+    console.log(`  ${chalk14.cyan("[path]")}                       Path to scan (default: current directory)`);
     console.log("");
-    console.log(chalk11.bold("Output options:"));
-    console.log(`  ${chalk11.cyan("--format <format>")}           Output format: ${chalk11.white("text")} | json | sarif | md  (default: text)`);
-    console.log(`  ${chalk11.cyan("--out <file>")}                Write output to a file instead of stdout`);
+    console.log(chalk14.bold("Output options:"));
+    console.log(`  ${chalk14.cyan("--format <format>")}           Output format: ${chalk14.white("text")} | json | sarif | md  (default: text)`);
+    console.log(`  ${chalk14.cyan("--out <file>")}                Write output to a file instead of stdout`);
     console.log("");
-    console.log(chalk11.bold("Baseline & gating:"));
-    console.log(`  ${chalk11.cyan("--baseline <file>")}           Compare results against a saved baseline`);
-    console.log(`  ${chalk11.cyan("--drift-budget <score>")}      Fail if drift score exceeds this value (0\u2013100)`);
-    console.log(`  ${chalk11.cyan("--drift-worsening <percent>")} Fail if drift worsens by more than % since baseline`);
-    console.log(`  ${chalk11.cyan("--fail-on <level>")}           Fail exit code on warn or error findings`);
+    console.log(chalk14.bold("Baseline & gating:"));
+    console.log(`  ${chalk14.cyan("--baseline <file>")}           Compare results against a saved baseline`);
+    console.log(`  ${chalk14.cyan("--drift-budget <score>")}      Fail if drift score exceeds this value (0\u2013100)`);
+    console.log(`  ${chalk14.cyan("--drift-worsening <percent>")} Fail if drift worsens by more than % since baseline`);
+    console.log(`  ${chalk14.cyan("--fail-on <level>")}           Fail exit code on warn or error findings`);
     console.log("");
-    console.log(chalk11.bold("Performance:"));
-    console.log(`  ${chalk11.cyan("--concurrency <n>")}           Max concurrent registry calls (default: 8)`);
-    console.log(`  ${chalk11.cyan("--changed-only")}              Only scan files changed since last git commit`);
+    console.log(chalk14.bold("Performance:"));
+    console.log(`  ${chalk14.cyan("--concurrency <n>")}           Max concurrent registry calls (default: 8)`);
+    console.log(`  ${chalk14.cyan("--changed-only")}              Only scan files changed since last git commit`);
     console.log("");
-    console.log(chalk11.bold("Privacy & offline:"));
-    console.log(`  ${chalk11.cyan("--offline")}                   Run without any network calls; skip result upload`);
-    console.log(`  ${chalk11.cyan("--package-manifest <file>")}   Use a local package-version manifest (JSON or ZIP) for offline mode`);
-    console.log(`  ${chalk11.cyan("--no-local-artifacts")}        Do not write .vibgrate JSON artifacts to disk`);
-    console.log(`  ${chalk11.cyan("--max-privacy")}               Strongest privacy mode: minimal scanners + no local artifacts`);
+    console.log(chalk14.bold("Privacy & offline:"));
+    console.log(`  ${chalk14.cyan("--offline")}                   Run without any network calls; skip result upload`);
+    console.log(`  ${chalk14.cyan("--package-manifest <file>")}   Use a local package-version manifest (JSON or ZIP) for offline mode`);
+    console.log(`  ${chalk14.cyan("--no-local-artifacts")}        Do not write .vibgrate JSON artifacts to disk`);
+    console.log(`  ${chalk14.cyan("--max-privacy")}               Strongest privacy mode: minimal scanners + no local artifacts`);
     console.log("");
-    console.log(chalk11.bold("Tooling:"));
-    console.log(`  ${chalk11.cyan("--install-tools")}             Auto-install missing security scanners via Homebrew`);
-    console.log(`  ${chalk11.cyan("--ui-purpose")}                Enable UI purpose evidence extraction (slower)`);
+    console.log(chalk14.bold("Tooling:"));
+    console.log(`  ${chalk14.cyan("--install-tools")}             Auto-install missing security scanners via Homebrew`);
+    console.log(`  ${chalk14.cyan("--ui-purpose")}                Enable UI purpose evidence extraction (slower)`);
     console.log("");
-    console.log(chalk11.bold("Uploading results:"));
-    console.log(`  ${chalk11.cyan("--push")}                      Auto-push results to Vibgrate API after scan`);
-    console.log(`  ${chalk11.cyan("--dsn <dsn>")}                 DSN token for push (or set VIBGRATE_DSN env var)`);
-    console.log(`  ${chalk11.cyan("--region <region>")}           Data residency region: us | eu  (default: us)`);
-    console.log(`  ${chalk11.cyan("--strict")}                    Fail if the upload to Vibgrate API fails`);
+    console.log(chalk14.bold("Uploading results:"));
+    console.log(`  ${chalk14.cyan("--push")}                      Auto-push results to Vibgrate API after scan`);
+    console.log(`  ${chalk14.cyan("--dsn <dsn>")}                 DSN token for push (or set VIBGRATE_DSN env var)`);
+    console.log(`  ${chalk14.cyan("--region <region>")}           Data residency region: us | eu  (default: us)`);
+    console.log(`  ${chalk14.cyan("--strict")}                    Fail if the upload to Vibgrate API fails`);
     console.log("");
-    console.log(chalk11.bold("Examples:"));
-    console.log(`  ${chalk11.dim("# Scan the current directory and display a text report")}`);
+    console.log(chalk14.bold("Examples:"));
+    console.log(`  ${chalk14.dim("# Scan the current directory and display a text report")}`);
     console.log("  vibgrate scan .");
     console.log("");
-    console.log(`  ${chalk11.dim("# Scan, fail if drift score > 40, and write SARIF for GitHub Actions")}`);
+    console.log(`  ${chalk14.dim("# Scan, fail if drift score > 40, and write SARIF for GitHub Actions")}`);
     console.log("  vibgrate scan . --drift-budget 40 --format sarif --out drift.sarif");
     console.log("");
-    console.log(`  ${chalk11.dim("# Scan and automatically upload results via a DSN")}`);
+    console.log(`  ${chalk14.dim("# Scan and automatically upload results via a DSN")}`);
     console.log("  vibgrate scan . --push --dsn $VIBGRATE_DSN");
     console.log("");
-    console.log(`  ${chalk11.dim("# Offline scan using a pre-downloaded package manifest")}`);
+    console.log(`  ${chalk14.dim("# Offline scan using a pre-downloaded package manifest")}`);
     console.log("  vibgrate scan . --offline --package-manifest ./manifest.zip");
   },
   init: () => {
     console.log("");
-    console.log(chalk11.bold.underline("vibgrate init") + chalk11.dim(" \u2014 Initialise vibgrate in a project directory"));
+    console.log(chalk14.bold.underline("vibgrate init") + chalk14.dim(" \u2014 Initialise vibgrate in a project directory"));
     console.log("");
-    console.log(chalk11.bold("Usage:"));
+    console.log(chalk14.bold("Usage:"));
     console.log("  vibgrate init [path] [options]");
     console.log("");
-    console.log(chalk11.bold("Arguments:"));
-    console.log(`  ${chalk11.cyan("[path]")}          Directory to initialise (default: current directory)`);
+    console.log(chalk14.bold("Arguments:"));
+    console.log(`  ${chalk14.cyan("[path]")}          Directory to initialise (default: current directory)`);
     console.log("");
-    console.log(chalk11.bold("Options:"));
-    console.log(`  ${chalk11.cyan("--baseline")}      Create an initial drift baseline after init`);
-    console.log(`  ${chalk11.cyan("--yes")}           Skip all confirmation prompts`);
+    console.log(chalk14.bold("Options:"));
+    console.log(`  ${chalk14.cyan("--baseline")}      Create an initial drift baseline after init`);
+    console.log(`  ${chalk14.cyan("--yes")}           Skip all confirmation prompts`);
     console.log("");
-    console.log(chalk11.bold("What it does:"));
+    console.log(chalk14.bold("What it does:"));
     console.log("  \u2022 Creates a .vibgrate/ directory");
     console.log("  \u2022 Writes a vibgrate.config.ts starter config");
     console.log("  \u2022 Optionally runs an initial baseline scan (--baseline)");
     console.log("");
-    console.log(chalk11.bold("Examples:"));
+    console.log(chalk14.bold("Examples:"));
     console.log("  vibgrate init");
     console.log("  vibgrate init ./my-project --baseline");
   },
   baseline: () => {
     console.log("");
-    console.log(chalk11.bold.underline("vibgrate baseline") + chalk11.dim(" \u2014 Save a drift baseline snapshot"));
+    console.log(chalk14.bold.underline("vibgrate baseline") + chalk14.dim(" \u2014 Save a drift baseline snapshot"));
     console.log("");
-    console.log(chalk11.bold("Usage:"));
+    console.log(chalk14.bold("Usage:"));
     console.log("  vibgrate baseline [path]");
     console.log("");
-    console.log(chalk11.bold("Arguments:"));
-    console.log(`  ${chalk11.cyan("[path]")}   Path to baseline (default: current directory)`);
+    console.log(chalk14.bold("Arguments:"));
+    console.log(`  ${chalk14.cyan("[path]")}   Path to baseline (default: current directory)`);
     console.log("");
-    console.log(chalk11.bold("What it does:"));
+    console.log(chalk14.bold("What it does:"));
     console.log("  Runs a full scan and saves the result as .vibgrate/baseline.json.");
     console.log("  Future scans can compare against this file using --baseline.");
     console.log("");
-    console.log(chalk11.bold("Examples:"));
+    console.log(chalk14.bold("Examples:"));
     console.log("  vibgrate baseline .");
     console.log("  vibgrate scan . --baseline .vibgrate/baseline.json --drift-worsening 10");
   },
   report: () => {
     console.log("");
-    console.log(chalk11.bold.underline("vibgrate report") + chalk11.dim(" \u2014 Generate a report from a saved scan artifact"));
+    console.log(chalk14.bold.underline("vibgrate report") + chalk14.dim(" \u2014 Generate a report from a saved scan artifact"));
     console.log("");
-    console.log(chalk11.bold("Usage:"));
+    console.log(chalk14.bold("Usage:"));
     console.log("  vibgrate report [options]");
     console.log("");
-    console.log(chalk11.bold("Options:"));
-    console.log(`  ${chalk11.cyan("--in <file>")}        Input artifact file (default: .vibgrate/scan_result.json)`);
-    console.log(`  ${chalk11.cyan("--format <format>")}  Output format: ${chalk11.white("text")} | md | json  (default: text)`);
+    console.log(chalk14.bold("Options:"));
+    console.log(`  ${chalk14.cyan("--in <file>")}        Input artifact file (default: .vibgrate/scan_result.json)`);
+    console.log(`  ${chalk14.cyan("--format <format>")}  Output format: ${chalk14.white("text")} | md | json  (default: text)`);
     console.log("");
-    console.log(chalk11.bold("Examples:"));
+    console.log(chalk14.bold("Examples:"));
     console.log("  vibgrate report");
     console.log("  vibgrate report --format md > DRIFT-REPORT.md");
     console.log("  vibgrate report --in ./ci/scan_result.json --format json");
   },
   sbom: () => {
     console.log("");
-    console.log(chalk11.bold.underline("vibgrate sbom") + chalk11.dim(" \u2014 Export a Software Bill of Materials from a scan artifact"));
+    console.log(chalk14.bold.underline("vibgrate sbom") + chalk14.dim(" \u2014 Export a Software Bill of Materials from a scan artifact"));
     console.log("");
-    console.log(chalk11.bold("Usage:"));
+    console.log(chalk14.bold("Usage:"));
     console.log("  vibgrate sbom [options]");
     console.log("");
-    console.log(chalk11.bold("Options:"));
-    console.log(`  ${chalk11.cyan("--in <file>")}        Input artifact (default: .vibgrate/scan_result.json)`);
-    console.log(`  ${chalk11.cyan("--format <format>")}  SBOM format: ${chalk11.white("cyclonedx")} | spdx  (default: cyclonedx)`);
-    console.log(`  ${chalk11.cyan("--out <file>")}       Write SBOM to file instead of stdout`);
+    console.log(chalk14.bold("Options:"));
+    console.log(`  ${chalk14.cyan("--in <file>")}        Input artifact (default: .vibgrate/scan_result.json)`);
+    console.log(`  ${chalk14.cyan("--format <format>")}  SBOM format: ${chalk14.white("cyclonedx")} | spdx  (default: cyclonedx)`);
+    console.log(`  ${chalk14.cyan("--out <file>")}       Write SBOM to file instead of stdout`);
     console.log("");
-    console.log(chalk11.bold("Examples:"));
+    console.log(chalk14.bold("Examples:"));
     console.log("  vibgrate sbom --format cyclonedx --out sbom.json");
     console.log("  vibgrate sbom --format spdx --out sbom.spdx.json");
   },
   push: () => {
     console.log("");
-    console.log(chalk11.bold.underline("vibgrate push") + chalk11.dim(" \u2014 Upload a scan artifact to the Vibgrate API"));
+    console.log(chalk14.bold.underline("vibgrate push") + chalk14.dim(" \u2014 Upload a scan artifact to the Vibgrate API"));
     console.log("");
-    console.log(chalk11.bold("Usage:"));
+    console.log(chalk14.bold("Usage:"));
     console.log("  vibgrate push [options]");
     console.log("");
-    console.log(chalk11.bold("Options:"));
-    console.log(`  ${chalk11.cyan("--dsn <dsn>")}        DSN token (or set VIBGRATE_DSN env var)`);
-    console.log(`  ${chalk11.cyan("--file <file>")}      Artifact to upload (default: .vibgrate/scan_result.json)`);
-    console.log(`  ${chalk11.cyan("--region <region>")}  Override data residency region: us | eu`);
-    console.log(`  ${chalk11.cyan("--strict")}           Fail with non-zero exit code on upload error`);
+    console.log(chalk14.bold("Options:"));
+    console.log(`  ${chalk14.cyan("--dsn <dsn>")}        DSN token (or set VIBGRATE_DSN env var)`);
+    console.log(`  ${chalk14.cyan("--file <file>")}      Artifact to upload (default: .vibgrate/scan_result.json)`);
+    console.log(`  ${chalk14.cyan("--region <region>")}  Override data residency region: us | eu`);
+    console.log(`  ${chalk14.cyan("--strict")}           Fail with non-zero exit code on upload error`);
     console.log("");
-    console.log(chalk11.bold("Examples:"));
+    console.log(chalk14.bold("Examples:"));
     console.log("  vibgrate push --dsn $VIBGRATE_DSN");
     console.log("  vibgrate push --file ./ci/scan_result.json --strict");
   },
   dsn: () => {
     console.log("");
-    console.log(chalk11.bold.underline("vibgrate dsn") + chalk11.dim(" \u2014 Manage DSN tokens for API authentication"));
+    console.log(chalk14.bold.underline("vibgrate dsn") + chalk14.dim(" \u2014 Manage DSN tokens for API authentication"));
     console.log("");
-    console.log(chalk11.bold("Subcommands:"));
-    console.log(`  ${chalk11.cyan("vibgrate dsn create")}   Generate a new DSN token`);
+    console.log(chalk14.bold("Subcommands:"));
+    console.log(`  ${chalk14.cyan("vibgrate dsn create")}   Generate a new DSN token`);
     console.log("");
-    console.log(chalk11.bold("dsn create options:"));
-    console.log(`  ${chalk11.cyan("--workspace <id>")}   Workspace ID or "new" to auto-generate ${chalk11.red("(required)")}`);
-    console.log(`  ${chalk11.cyan("--region <region>")}  Data residency region: us | eu  (default: us)`);
-    console.log(`  ${chalk11.cyan("--ingest <url>")}     Override ingest API URL`);
-    console.log(`  ${chalk11.cyan("--write <path>")}     Write the DSN to a file (add to .gitignore!)`);
+    console.log(chalk14.bold("dsn create options:"));
+    console.log(`  ${chalk14.cyan("--workspace <id>")}   Workspace ID or "new" to auto-generate ${chalk14.red("(required)")}`);
+    console.log(`  ${chalk14.cyan("--region <region>")}  Data residency region: us | eu  (default: us)`);
+    console.log(`  ${chalk14.cyan("--ingest <url>")}     Override ingest API URL`);
+    console.log(`  ${chalk14.cyan("--write <path>")}     Write the DSN to a file (add to .gitignore!)`);
     console.log("");
-    console.log(chalk11.bold("Examples:"));
+    console.log(chalk14.bold("Examples:"));
     console.log("  vibgrate dsn create --workspace new");
     console.log("  vibgrate dsn create --workspace abc123");
     console.log("  vibgrate dsn create --workspace new --region eu --write .vibgrate/.dsn");
   },
   update: () => {
     console.log("");
-    console.log(chalk11.bold.underline("vibgrate update") + chalk11.dim(" \u2014 Update the vibgrate CLI to the latest version"));
+    console.log(chalk14.bold.underline("vibgrate update") + chalk14.dim(" \u2014 Update the vibgrate CLI to the latest version"));
     console.log("");
-    console.log(chalk11.bold("Usage:"));
+    console.log(chalk14.bold("Usage:"));
     console.log("  vibgrate update [options]");
     console.log("");
-    console.log(chalk11.bold("Options:"));
-    console.log(`  ${chalk11.cyan("--check")}         Check for a newer version without installing`);
-    console.log(`  ${chalk11.cyan("--pm <manager>")} Force a package manager: npm | pnpm | yarn | bun`);
+    console.log(chalk14.bold("Options:"));
+    console.log(`  ${chalk14.cyan("--check")}         Check for a newer version without installing`);
+    console.log(`  ${chalk14.cyan("--pm <manager>")} Force a package manager: npm | pnpm | yarn | bun`);
     console.log("");
-    console.log(chalk11.bold("Examples:"));
+    console.log(chalk14.bold("Examples:"));
     console.log("  vibgrate update");
     console.log("  vibgrate update --check");
     console.log("  vibgrate update --pm pnpm");
@@ -4343,40 +4941,42 @@ var detailedHelp = {
 };
 function printSummaryHelp() {
   console.log("");
-  console.log(chalk11.bold("vibgrate") + chalk11.dim(" \u2014 Continuous Drift Intelligence"));
+  console.log(chalk14.bold("vibgrate") + chalk14.dim(" \u2014 Continuous Drift Intelligence"));
   console.log("");
-  console.log(chalk11.bold("Usage:"));
+  console.log(chalk14.bold("Usage:"));
   console.log("  vibgrate <command> [options]");
   console.log("  vibgrate help [command]     Show detailed help for a command");
   console.log("");
-  console.log(chalk11.bold("Getting started:"));
-  console.log(`  ${chalk11.cyan("init")}       Initialise vibgrate in a project (creates config & .vibgrate/ dir)`);
+  console.log(chalk14.bold("Getting started:"));
+  console.log(`  ${chalk14.cyan("init")}       Initialise vibgrate in a project (creates config & .vibgrate/ dir)`);
+  console.log(`  ${chalk14.cyan("login")}      Sign the CLI into your workspace via the browser`);
+  console.log(`  ${chalk14.cyan("logout")}     Clear stored login credentials`);
   console.log("");
-  console.log(chalk11.bold("Core scanning:"));
-  console.log(`  ${chalk11.cyan("scan")}       Scan a project for upgrade drift and generate a report`);
-  console.log(`  ${chalk11.cyan("baseline")}   Save a baseline snapshot to compare future scans against`);
+  console.log(chalk14.bold("Core scanning:"));
+  console.log(`  ${chalk14.cyan("scan")}       Scan a project for upgrade drift and generate a report`);
+  console.log(`  ${chalk14.cyan("baseline")}   Save a baseline snapshot to compare future scans against`);
   console.log("");
-  console.log(chalk11.bold("Reporting & export:"));
-  console.log(`  ${chalk11.cyan("report")}     Re-generate a report from a previously saved scan artifact`);
-  console.log(`  ${chalk11.cyan("sbom")}       Export a Software Bill of Materials (CycloneDX or SPDX)`);
+  console.log(chalk14.bold("Reporting & export:"));
+  console.log(`  ${chalk14.cyan("report")}     Re-generate a report from a previously saved scan artifact`);
+  console.log(`  ${chalk14.cyan("sbom")}       Export a Software Bill of Materials (CycloneDX or SPDX)`);
   console.log("");
-  console.log(chalk11.bold("CI/CD integration:"));
-  console.log(`  ${chalk11.cyan("push")}       Upload a scan artifact to the Vibgrate API`);
-  console.log(`  ${chalk11.cyan("dsn")}        Create and manage DSN tokens for API authentication`);
+  console.log(chalk14.bold("CI/CD integration:"));
+  console.log(`  ${chalk14.cyan("push")}       Upload a scan artifact to the Vibgrate API`);
+  console.log(`  ${chalk14.cyan("dsn")}        Create and manage DSN tokens for API authentication`);
   console.log("");
-  console.log(chalk11.bold("Maintenance:"));
-  console.log(`  ${chalk11.cyan("update")}     Update the vibgrate CLI to the latest version`);
+  console.log(chalk14.bold("Maintenance:"));
+  console.log(`  ${chalk14.cyan("update")}     Update the vibgrate CLI to the latest version`);
   console.log("");
-  console.log(chalk11.dim("Run") + ` ${chalk11.cyan("vibgrate help <command>")} ` + chalk11.dim("for detailed options, e.g.") + ` ${chalk11.cyan("vibgrate help scan")}`);
+  console.log(chalk14.dim("Run") + ` ${chalk14.cyan("vibgrate help <command>")} ` + chalk14.dim("for detailed options, e.g.") + ` ${chalk14.cyan("vibgrate help scan")}`);
 }
-var helpCommand = new Command10("help").description("Show help for vibgrate commands").argument("[command]", "Command to show detailed help for").helpOption(false).action((cmd) => {
+var helpCommand = new Command12("help").description("Show help for vibgrate commands").argument("[command]", "Command to show detailed help for").helpOption(false).action((cmd) => {
   const name = cmd?.toLowerCase().trim();
   if (name && detailedHelp[name]) {
     detailedHelp[name]();
   } else if (name) {
     console.log("");
-    console.log(chalk11.red(`Unknown command: ${name}`));
-    console.log(chalk11.dim(`Available commands: ${Object.keys(detailedHelp).join(", ")}`));
+    console.log(chalk14.red(`Unknown command: ${name}`));
+    console.log(chalk14.dim(`Available commands: ${Object.keys(detailedHelp).join(", ")}`));
     printSummaryHelp();
   } else {
     printSummaryHelp();
@@ -4385,13 +4985,15 @@ var helpCommand = new Command10("help").description("Show help for vibgrate comm
 });
 
 // src/cli.ts
-var program = new Command11();
+var program = new Command13();
 program.name("vibgrate").description("Continuous Drift Intelligence").version(VERSION).addHelpText("after", "\nSee https://vibgrate.com/help for more guidance");
 program.addCommand(helpCommand);
 program.addCommand(initCommand);
 program.addCommand(scanCommand);
 program.addCommand(baselineCommand);
 program.addCommand(reportCommand);
+program.addCommand(loginCommand);
+program.addCommand(logoutCommand);
 program.addCommand(dsnCommand);
 program.addCommand(pushCommand);
 program.addCommand(updateCommand);
@@ -4402,8 +5004,8 @@ function notifyIfUpdateAvailable() {
   void checkForUpdate().then((update) => {
     if (!update?.updateAvailable) return;
     console.error("");
-    console.error(chalk12.yellow(`  Update available: ${update.current} \u2192 ${update.latest}`));
-    console.error(chalk12.dim('  Run "vibgrate update" to install the latest version.'));
+    console.error(chalk15.yellow(`  Update available: ${update.current} \u2192 ${update.latest}`));
+    console.error(chalk15.dim('  Run "vibgrate update" to install the latest version.'));
     console.error("");
   }).catch(() => {
   });