@vibgrate/cli 2026.702.2 → 2026.703.3

package/dist/cli.js

@@ -1,166 +1,3817 @@
 #!/usr/bin/env node
-import'./chunk-GGDB72YE.js';import {d,c,e,f,b as b$1,a as a$1,h}from'./chunk-NGFYX3CW.js';import {b,fb,Xa,ib,hb,gb,kb,eb}from'./chunk-OQSVJXWJ.js';import {a}from'./chunk-MKDRULJ6.js';import {p,b as b$3}from'./chunk-XTHPCEME.js';import {b as b$2}from'./chunk-EK7ODJWE.js';import {Command}from'commander';import l from'chalk';import*as S from'path';import {createRequire}from'module';import*as Ne from'crypto';import {randomUUID}from'crypto';import*as Ut from'os';import*as ee from'fs';import {rmSync,existsSync}from'fs';import {execSync,spawn,spawnSync}from'child_process';import*as ln from'zlib';import {promisify}from'util';import*as K from'fs/promises';import {mkdtemp,rm}from'fs/promises';import {fileURLToPath}from'url';var Ft=new Command("init").description("Initialize vibgrate in a project").argument("[path]","Path to initialize",".").option("--baseline","Create initial baseline after init").option("--yes","Skip confirmation prompts").action(async(t,e)=>{let n=S.resolve(t),o=S.join(n,".vibgrate");await d(o),console.log(l.green("\u2714")+` Created ${l.bold(".vibgrate/")} directory`);let r=S.join(n,"vibgrate.config.ts");if(await c(r)?console.log(l.dim("  vibgrate.config.ts already exists, skipping")):(await b(n),console.log(l.green("\u2714")+` Created ${l.bold("vibgrate.config.ts")}`)),e.baseline){let{runBaseline:a}=await import('./baseline-TJDKYSFL.js');await a(n);}console.log(""),console.log(l.bold("Next steps:")),console.log(`  ${l.cyan("vibgrate scan")}            Scan for upgrade drift`),console.log(`  ${l.cyan("vibgrate baseline")}        Create a drift baseline`),console.log("");});var So=createRequire(import.meta.url),ko=So("../package.json"),E=ko.version;var et=[{id:"us",label:"United States",ingestHost:"us.ingest.vibgrate.com",dashHost:"dash.vibgrate.com",available:true},{id:"eu",label:"European Union",ingestHost:"eu.ingest.vibgrate.com",dashHost:"dash.vibgrate.eu",available:true},{id:"apac",label:"Asia-Pacific (coming soon)",ingestHost:"apac.ingest.vibgrate.com",dashHost:"dash.vibgrate.com",available:false}],xo="us";function ae(){return et.filter(t=>t.available).map(t=>t.id)}function Mt(t){return et.find(e=>e.id===t)}function ne(t,e){if(e)try{return new URL(e).host}catch{throw new Error(`Invalid ingest URL: ${e}`)}let n=(t??xo).toLowerCase(),o=Mt(n);if(!o)throw new Error(`Unknown region "${n}". Supported: ${ae().join(", ")}`);if(!o.available)throw new Error(`Region "${n}" (${o.label}) is not yet available. Supported: ${ae().join(", ")}`);return o.ingestHost}function ge(t){return et.find(n=>n.ingestHost===t)?.dashHost??"dash.vibgrate.com"}function Lt(t){return Mt(t.toLowerCase())?.ingestHost}async function Co(t,e,n,o,r){let a=`https://${o}/v1/provision`;try{let s=await fetch(a,{method:"POST",headers:{"Content-Type":"application/json",Connection:"close"},body:JSON.stringify(r?{keyId:t,secret:e,workspaceId:n,region:r}:{keyId:t,secret:e,workspaceId:n})});return s.ok?{success:!0}:{success:!1,error:(await s.json()).error||`HTTP ${s.status}`}}catch(s){return {success:false,error:s instanceof Error?s.message:String(s)}}}var tt=new Command("dsn").description("Manage DSN tokens");tt.command("create").description("Create a new DSN token").option("--ingest <url>","Ingest API URL (overrides --region)").option("--region <region>",`Data residency region (${ae().join(", ")})`,"us").requiredOption("--workspace <id>",'Workspace ID (use "new" to auto-generate)').option("--write <path>","Write DSN to file").action(async t=>{let e$1=Ne.randomBytes(12).toString("hex"),n=Ne.randomBytes(32).toString("hex"),o;try{o=ne(t.region,t.ingest);}catch(c){console.error(l.red(c instanceof Error?c.message:String(c))),process.exit(1);}let r=t.workspace,a=t.workspace.toLowerCase()==="new";a&&(r=Ne.randomBytes(8).toString("hex"),console.log(l.dim(`Provisioning new workspace ${r}...`)));let s=t.ingest?void 0:t.region.toLowerCase();if(a){let c=await Co(e$1,n,r,o,s);c.success||(console.error(l.red(`Failed to provision DSN: ${c.error}`)),process.exit(1));}let i=`vibgrate+https://${e$1}:${n}@${o}/${r}`;if(console.log(l.green("\u2714")+" DSN created"),console.log(""),console.log(l.bold("Region:")),console.log(`  ${s??"custom"} (${o})`),console.log(""),console.log(l.bold("DSN:")),console.log(`  ${i}`),console.log(""),console.log(l.bold("Key ID:")),console.log(`  ${e$1}`),a&&(console.log(""),console.log(l.bold("Workspace ID:")),console.log(`  ${r}`)),console.log(""),console.log(l.dim("Set this as VIBGRATE_DSN in your CI environment.")),a||console.log(l.dim("The secret must be registered on your Vibgrate ingest API.")),t.write){let c=S.resolve(t.write);await e(c,i+`
-`),console.log(""),console.log(l.green("\u2714")+` DSN written to ${t.write}`),console.log(l.yellow("\u26A0")+" Add this file to .gitignore!");}});function Vt(){return S.join(Ut.homedir(),".vibgrate")}function de(){return S.join(Vt(),"credentials.json")}function Io(){try{let t=ee.readFileSync(de(),"utf8"),e=JSON.parse(t);return e&&typeof e.dsn=="string"&&e.dsn?e:null}catch{return null}}function Ht(t){let e=Vt();ee.mkdirSync(e,{recursive:true});let n=de();ee.writeFileSync(n,JSON.stringify(t,null,2)+`
-`,"utf8");try{ee.chmodSync(n,384);}catch{}}function Gt(){try{return ee.rmSync(de()),!0}catch{return  false}}function fe(t){return t||(process.env.VIBGRATE_DSN?process.env.VIBGRATE_DSN:Io()?.dsn??void 0)}function Oe(t,e){console.log(`VIBGRATE_INGEST_ID=${t}`),e?.unchanged&&console.log("VIBGRATE_INGEST_UNCHANGED=1");}function Wt(t,e){let n=`${t.scheme}://${e}/v1/ingest/scan`;return fetch(n,{method:"POST",headers:{"Content-Type":"application/json","Content-Encoding":t.contentEncoding,"X-Vibgrate-Timestamp":t.timestamp,Authorization:`VibgrateDSN ${t.keyId}:${t.secret}`,Connection:"close"},body:t.body})}async function Ro(t){try{let e=await t.clone().json();return e?.code!=="REGION_MISMATCH"||!e.region?void 0:Lt(e.region)}catch{return}}async function Fe(t){let e=t.host,n=await Wt(t,e);if(n.status===409){let o=await Ro(n);o&&o!==e&&(console.log(l.yellow(`\u21BB Workspace is pinned to a different region \u2014 retrying upload to ${o}...`)),e=o,n=await Wt(t,e));}return {response:n,host:e}}var Eo=[{files:["CLAUDE.md",".claude"],name:"claude"},{files:[".cursor",".cursorrules"],name:"cursor"},{files:[".windsurf"],name:"windsurf"},{files:[".github/copilot-instructions.md",".copilot"],name:"copilot"},{files:[".gemini"],name:"gemini"},{files:[".continuerc.json"],name:"continue"},{files:[".codex"],name:"codex"}];async function Xt(t){for(let e of Eo)for(let n of e.files)if(await p(S.join(t,n)))return e.name;return null}function Kt(t){let e=l.hex("#3FB0A4"),n=l.hex("#4FE3C1"),o=t?`vg install ${t}`:"vg install --all",r=t?l.dim(`  (${t} config detected)`):"";console.log(""),console.log(e("  \u2554\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2557")),console.log(e("  \u2551")+"  "+n("\u25C6")+"  "+l.bold.white("Get AI-aware answers in your editor")+"          "+e("\u2551")),console.log(e("  \u255A\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u255D")),console.log(""),console.log("  "+l.bold.white(o)+r),console.log(""),console.log("  "+e("\xB7")+" "+l.white("Code map in your assistant")+l.dim(" \u2014 call trees, impact surfaces, import paths")),console.log("  "+e("\xB7")+" "+l.white("Offline drift")+l.dim(" \u2014 DriftScore and upgrade priorities, right inside your editor")),console.log("  "+e("\xB7")+" "+l.white("Version-correct library docs")+l.dim(" \u2014 pinned to your lockfile, no hallucinated APIs")),console.log("");}async function Do(t,e,n){let o=fe(n.dsn);if(!o){console.error(l.red("No DSN provided for push.")),console.error(l.dim('Run "vibgrate login", set VIBGRATE_DSN, or use the --dsn flag.')),n.strict&&process.exit(1);return}let r=fb(o);if(!r){console.error(l.red("Invalid DSN format.")),n.strict&&process.exit(1);return}let{body:a,contentEncoding:s}=await eb(t),i=String(Date.now()),c=r.host;if(n.region)try{c=ne(n.region);}catch(u){console.error(l.red(u instanceof Error?u.message:String(u))),n.strict&&process.exit(1);return}let p=JSON.stringify(t).length,g=a.length,m=((1-g/p)*100).toFixed(0);console.log(l.dim(`Uploading to ${c}... (${(g/1024).toFixed(0)} KB, ${m}% smaller)`));try{let{response:u,host:f}=await Fe({scheme:r.scheme,host:c,keyId:r.keyId,secret:r.secret,body:a,contentEncoding:s,timestamp:i});if(c=f,!u.ok){let $=await u.text();throw new Error(`HTTP ${u.status}: ${$}`)}let v=await u.json();if(v.unchanged){if(console.log(l.green("\u2714")+` Repository unchanged since ${v.lastScannedAt??"last scan"} \u2014 skipped upload (no credit used).`),v.previousIngestId){Oe(v.previousIngestId,{unchanged:!0});let $=`https://${ge(c)}/${r.workspaceId}/scan/${v.previousIngestId}`;console.log(l.dim(`  Previous report: ${$}`));}else n.strict&&(console.error(l.red("Repository unchanged but no previous ingest id returned.")),process.exit(1));return}if(console.log(l.green("\u2714")+` Scan queued for processing (${v.ingestId??"ok"})`),v.ingestId){Oe(v.ingestId);let $=`https://${ge(c)}/${r.workspaceId}/scan/${v.ingestId}`,k=process.platform==="win32"?"\x1B[0G\x1B[2K":"";console.log(""),console.log(k+l.dim("  Processing continues in the background. Results available shortly.")),console.log(""),console.log(k+l.cyan("\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500")),console.log(k+l.bold("  \u{1F4CA} View Scan Report")),console.log(k+"  "+l.underline.cyan($)),console.log(k+l.cyan("\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500")),console.log(""),console.log("");}}catch(u){let f=u instanceof Error?u.message:String(u);console.error(l.red(`Upload failed: ${f}`)),n.strict&&process.exit(1);}}function To(t,e){return [...e,...b$3(t)]}function zt(t,e){if(t===void 0)return;let n=Number(t);if(!Number.isFinite(n)||n<0)throw new Error(`${e} must be a non-negative number.`);return n}var qt=new Command("scan").description("Scan a project for upgrade drift").argument("[path]","Path to scan",".").option("--out <file>","Output file path").option("--format <format>","Output format (text|json|sarif|md)","text").option("--fail-on <level>","Fail on warn or error").option("--baseline <file>","Compare against baseline").option("--changed-only","Only scan changed files").option("-e, --exclude <glob>",'Exclude paths matching a glob pattern. Repeatable, and a single value may list several patterns separated by commas or semicolons (e.g. --exclude "legacy/**,vendor/**"). Merged with excludes from the config file.',To,[]).option("--concurrency <n>","Max concurrent npm calls","8").option("--push","Auto-push results to Vibgrate API after scan").option("--dsn <dsn>","DSN token for push (or use VIBGRATE_DSN env)").option("--region <region>","Override data residency region for push (us, eu)").option("--strict","Fail on push errors").option("--ui-purpose","Enable optional UI purpose evidence extraction (slower)").option("--no-local-artifacts","Do not write .vibgrate JSON artifacts to disk").option("--max-privacy","Enable strongest privacy mode (minimal scanners, no local artifacts)").option("--offline","Run without network calls; do not upload results").option("--package-manifest <file>","Use local package-version manifest JSON/ZIP (for offline mode)").option("--project-scan-timeout <seconds>","Per-project scan timeout in seconds (default: 180)").option("--drift-budget <score>","Fail if drift score is above budget (0-100)").option("--drift-worsening <percent>","Fail if drift worsens by more than % since baseline").option("--repository-name <name>","Override the repository name recorded for this scan (defaults to the directory or package.json name)").action(async(t,e)=>{let n=S.resolve(t);await p(n)||(console.error(l.red(`Path does not exist: ${n}`)),process.exit(1));let o=!!fe(e.dsn),r=!e.offline&&(e.push||o),a=!await p(S.join(n,".vibgrate","scan_result.json")),s;if(r&&o){let m=fe(e.dsn),u=fb(m);if(u){let f=e.region?ne(e.region):u.host,v=await Xa(n),$=await ib(n,v),k=e.repositoryName?.trim()||await hb(n);try{let w=await gb(u,f,{repositoryName:k,vcsSha:$.vcsSha});if(s=w.region,w.vm&&!w.vm.allowed&&(console.error(l.red(w.error??"VM meter usage exhausted")),console.error(l.dim(`VM minutes: ${w.vm.used}/${w.vm.limit} (${w.plan.label} plan) \u2014 enable overages or upgrade your plan.`)),process.exit(1)),w.repositories&&!w.repositories.allowed){console.error(l.red(w.error??`Repository limit reached for the ${w.plan.label} plan \u2014 cannot scan a new repository.`));let U=w.repositories.max<0?"unlimited":String(w.repositories.max);console.error(l.dim(`Repositories: ${w.repositories.total}/${U} (${w.plan.label} plan) \u2014 archive a repository or upgrade your plan.`)),w.upgradeUrl&&console.error(l.dim(`  Upgrade: ${w.upgradeUrl}`)),process.exit(1);}if((w.status==="error"||!w.scans.allowed)&&(console.error(l.red(w.error??"Scan ingestion not allowed for this workspace.")),console.error(l.dim(`Credits: ${w.scans.used}/${w.scans.limit} (${w.plan.label} plan)`)),e.strict&&process.exit(1),process.exit(1)),console.log(l.dim(`Plan: ${w.plan.label} \u2014 scan credits ${w.scans.used}/${w.scans.limit} this month`)),w.repository?.unchanged){if(console.log(l.green("\u2714")+` Repository unchanged at ${w.repository.lastVcsSha?.slice(0,7)??"same revision"} \u2014 skipping scan.`),w.repository.lastIngestId){Oe(w.repository.lastIngestId,{unchanged:!0});let U=`https://${ge(f)}/${u.workspaceId}/scan/${w.repository.lastIngestId}`;console.log(l.dim(`  Latest report: ${U}`));}else e.strict&&(console.error(l.red("Repository unchanged but no previous ingest id available.")),process.exit(1));return}}catch(w){let U=w instanceof Error?w.message:String(w);console.error(l.yellow(`Preflight check failed: ${U}`)),e.strict&&process.exit(1);}}}let i={vibgrateVersion:E,out:e.out,format:e.format||"text",failOn:e.failOn,baseline:e.baseline,changedOnly:e.changedOnly,exclude:e.exclude,concurrency:parseInt(e.concurrency,10)||8,push:e.push,dsn:e.dsn,region:e.region??s,strict:e.strict,uiPurpose:e.uiPurpose,noLocalArtifacts:e.noLocalArtifacts,maxPrivacy:e.maxPrivacy,offline:e.offline,packageManifest:e.packageManifest,driftBudget:zt(e.driftBudget,"--drift-budget"),driftWorseningPercent:zt(e.driftWorsening,"--drift-worsening"),projectScanTimeout:e.projectScanTimeout&&parseInt(e.projectScanTimeout,10)||void 0,repositoryName:e.repositoryName?.trim()||void 0},c=await f(),p$1=await kb(n,i,c);if(e.failOn){let m=p$1.findings.some(f=>f.level==="error"),u=p$1.findings.some(f=>f.level==="warning");e.failOn==="error"&&m&&(console.error(l.red(`
-Failing: ${p$1.findings.filter(f=>f.level==="error").length} error finding(s) detected.`)),process.exit(2)),e.failOn==="warn"&&(m||u)&&(console.error(l.red(`
-Failing: findings detected at warn level or above.`)),process.exit(2));}if(i.driftBudget!==void 0&&p$1.drift.score>i.driftBudget&&(console.error(l.red(`
-Failing fitness function: drift score ${p$1.drift.score}/100 exceeds budget ${i.driftBudget}.`)),process.exit(2)),i.driftWorseningPercent!==void 0&&(p$1.delta===void 0&&(console.error(l.red(`
-Failing fitness function: --drift-worsening requires --baseline to compare against previous drift.`)),process.exit(2)),p$1.delta>0)){let m=p$1.drift.score-p$1.delta,u=Math.max(Math.abs(m),1e-4),f=p$1.delta/u*100;f>i.driftWorseningPercent&&(console.error(l.red(`
-Failing fitness function: drift worsened by ${f.toFixed(2)}% (threshold ${i.driftWorseningPercent}%).`)),process.exit(2));}if(r&&await Do(p$1,n,i),i.format==="text"&&!o&&!e.offline&&!e.noLocalArtifacts&&!e.maxPrivacy&&a){let m=await Xt(n);Kt(m);}});function Qt(t){let e=[],n=l.hex("#3FB0A4"),o=l.hex("#4FE3C1");e.push(""),e.push("   "+n("\u256D\u2500\u2500\u2500\u2500\u2500\u2500\u256E")+o("\u279C")),e.push("  "+l.dim("\u2524")+n("\u2502")+" "+o("\u25FC")+"  "+o("\u25FC")+" "+n("\u2502")+l.dim("\u251C")+"  "+l.bold.white("vibgrate")),e.push("  "+l.dim("\u2524")+n("\u2502")+"  "+l.dim("\u2581\u2581")+"  "+n("\u2502")+l.dim("\u251C")+"  "+l.dim(`Drift Intelligence Engine v${E}`)),e.push("   "+n("\u2570\u2500\u2500\u2500\u2500\u2500\u2500\u256F")),e.push(""),e.push(n("\u2554\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2557")),e.push(n("\u2551        ")+l.bold.white("Vibgrate Drift Report")+n("             \u2551")),e.push(n("\u255A\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u255D")),e.push("");for(let c of t.projects){if(e.push(l.bold(`  \u2500\u2500 ${c.name} `)+l.dim(`(${c.type}) ${c.path}`)),c.runtime){let m=c.runtimeMajorsBehind!==void 0&&c.runtimeMajorsBehind>0?l.yellow(` (${c.runtimeMajorsBehind} major${c.runtimeMajorsBehind>1?"s":""} behind)`):l.green(" (current)");e.push(`     Runtime: ${c.runtime}${m}`);}if(c.targetFramework&&e.push(`     Target:  ${c.targetFramework}`),c.frameworks.length>0){e.push("     Frameworks:");for(let m of c.frameworks){let u=m.majorsBehind!==null?m.majorsBehind===0?l.green("current"):l.yellow(`${m.majorsBehind} behind`):l.dim("unknown");e.push(`       ${m.name}: ${m.currentVersion??"?"} \u2192 ${m.latestVersion??"?"} (${u})`);}}let p=c.dependencyAgeBuckets;p.current+p.oneBehind+p.twoPlusBehind+p.unknown>0&&(e.push("     Dependencies:"),e.push(`       ${l.green(`${p.current} current`)}  ${l.yellow(`${p.oneBehind} 1-behind`)}  ${l.red(`${p.twoPlusBehind} 2+ behind`)}  ${l.dim(`${p.unknown} unknown`)}`)),e.push("");}if(t.delta!==void 0){let c=t.delta>0?l.red(`+${t.delta}`):t.delta<0?l.green(`${t.delta}`):l.dim("0");e.push(l.bold("  Drift Delta: ")+c+" (vs baseline)"),e.push("");}if(t.extended&&e.push(...No(t.extended)),t.findings.length>0){let c=t.findings.filter(u=>u.level==="error"),p=t.findings.filter(u=>u.level==="warning"),g=t.findings.filter(u=>u.level==="note"),m=[c.length>0?l.red(`${c.length} error${c.length!==1?"s":""}`):"",p.length>0?l.yellow(`${p.length} warning${p.length!==1?"s":""}`):"",g.length>0?l.blue(`${g.length} note${g.length!==1?"s":""}`):""].filter(Boolean).join(l.dim(", "));e.push(l.bold.underline("  Findings")+l.dim(` (${m})`));for(let u of t.findings){let f=u.level==="error"?l.red("\u2716"):u.level==="warning"?l.yellow("\u26A0"):l.blue("\u2139");e.push(`    ${f} ${u.message}`),e.push(l.dim(`      ${u.ruleId} in ${u.location}`));}e.push("");}let r=Fo(t);if(r.length>0){e.push(l.bold.cyan("\u2554\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2557")),e.push(l.bold.cyan("\u2551        Top Priority Actions              \u2551")),e.push(l.bold.cyan("\u255A\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u255D")),e.push("");for(let c=0;c<r.length;c++){let p=r[c],g=l.bold.cyan(`  ${c+1}.`);e.push(`${g} ${l.bold(p.title)}`),e.push(l.dim(`     ${p.explanation}`)),p.impact&&e.push(`     Impact: ${l.green(p.impact)}`),e.push("");}}if(t.extended?.architecture&&e.push(...Oo(t.extended.architecture)),t.solutions&&t.solutions.length>0){e.push(l.bold.cyan("\u2554\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2557")),e.push(l.bold.cyan("\u2551        Solution Drift Summary            \u2551")),e.push(l.bold.cyan("\u255A\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u255D")),e.push("");for(let c of t.solutions){let p=c.drift?.score,g=typeof p=="number"?p<=30?l.green:p<=60?l.yellow:l.red:l.dim;e.push(`  \u2022 ${c.name} (${c.projectPaths.length} projects) \u2014 ${typeof p=="number"?g(`${p}/100`):l.dim("n/a")}`);}e.push("");}let a=t.drift.score<=30?l.green:t.drift.score<=60?l.yellow:l.red;if(e.push(l.bold.cyan("\u2554\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2557")),e.push(l.bold.cyan("\u2551        Drift Score Summary               \u2551")),e.push(l.bold.cyan("\u255A\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u255D")),e.push(""),e.push(l.bold("  Drift Score:  ")+a.bold(`${t.drift.score}/100`)),e.push(l.bold("  Risk Level:   ")+_o(t.drift.riskLevel)),e.push(l.bold("  Projects:     ")+`${t.projects.length}`),t.vcs){let c=[t.vcs.type];t.vcs.branch&&c.push(t.vcs.branch),t.vcs.shortSha&&c.push(l.dim(t.vcs.shortSha)),e.push(l.bold("  VCS:          ")+c.join(" "));}e.push("");let s=new Set(t.drift.measured??["runtime","framework","dependency","eol"]);e.push("  "+l.bold.underline("Score Breakdown")),e.push(`    Runtime:      ${s.has("runtime")?Ce(t.drift.components.runtimeScore):l.dim("n/a")}`),e.push(`    Frameworks:   ${s.has("framework")?Ce(t.drift.components.frameworkScore):l.dim("n/a")}`),e.push(`    Dependencies: ${s.has("dependency")?Ce(t.drift.components.dependencyScore):l.dim("n/a")}`),e.push(`    EOL Risk:     ${s.has("eol")?Ce(t.drift.components.eolScore):l.dim("n/a")}`),e.push("");let i=[`Scanned at ${t.timestamp}`];if(t.durationMs!==void 0){let c=(t.durationMs/1e3).toFixed(1);i.push(`${c}s`);}return t.filesScanned!==void 0&&i.push(`${t.filesScanned} file${t.filesScanned!==1?"s":""} scanned`),t.treeSummary&&(i.push(`${t.treeSummary.totalFiles.toLocaleString()} workspace files`),i.push(`${t.treeSummary.totalDirs.toLocaleString()} dirs`)),e.push(l.dim(`  ${i.join(" \xB7 ")}`)),e.push(""),e.join(`
-`)}function _o(t){switch(t){case "low":return l.bgGreen.black(" LOW ");case "moderate":return l.bgYellow.black(" MODERATE ");case "high":return l.bgRed.white(" HIGH ");default:return t}}function Ce(t){let n=Math.round(t/100*20),o=20-n;return (t<=30?l.green:t<=60?l.yellow:l.red)("\u2588".repeat(n))+l.dim("\u2591".repeat(o))+` ${Math.round(t)}`}var Yt={frontend:"Frontend",metaFrameworks:"Meta-frameworks",bundlers:"Bundlers",css:"CSS / UI",backend:"Backend",orm:"ORM / Database",testing:"Testing",lintFormat:"Lint & Format",apiMessaging:"API & Messaging",observability:"Observability",payment:"Payment",auth:"Auth",email:"Email",cloud:"Cloud",databases:"Databases",messaging:"Messaging",crm:"CRM & Comms",storage:"Storage",search:"Search & AI"};function No(t){let e=[];if(t.toolingInventory){let n=t.toolingInventory,o=Object.entries(n).filter(([,r])=>r.length>0);if(o.length>0){e.push(l.bold.underline("  Tech Stack"));for(let[r,a]of o){let s=Yt[r]??r,i=a.map(c=>l.white(c.name)).join(l.dim(", "));e.push(`    ${l.cyan(s)}: ${i}`);}e.push("");}}if(t.serviceDependencies){let n=t.serviceDependencies,o=Object.entries(n).filter(([,r])=>r.length>0);if(o.length>0){e.push(l.bold.underline("  Services & Integrations"));for(let[r,a]of o){let s=Yt[r]??r,i=a.map(c=>{let p=c.version?l.dim(` ${c.version}`):"";return l.white(c.name)+p}).join(l.dim(", "));e.push(`    ${l.cyan(s)}: ${i}`);}e.push("");}}if(t.breakingChangeExposure){let n=t.breakingChangeExposure;if(n.deprecatedPackages.length>0||n.legacyPolyfills.length>0){e.push(l.bold.underline("  Breaking Change Exposure"));let o=n.exposureScore>=40?l.red:n.exposureScore>=20?l.yellow:l.green;e.push(`    Exposure Score: ${o.bold(`${n.exposureScore}/100`)}`),n.deprecatedPackages.length>0&&e.push(`    ${l.red("Deprecated")}: ${n.deprecatedPackages.map(a=>l.dim(a)).join(", ")}`),n.legacyPolyfills.length>0&&e.push(`    ${l.yellow("Polyfills")}: ${n.legacyPolyfills.map(a=>l.dim(a)).join(", ")}`),n.peerConflictsDetected&&e.push(`    ${l.red("\u26A0")} Peer dependency conflicts detected`),e.push(`    Recommendation: ${l.bold(n.overallRecommendation)}`);let r=n.projectIntelligence.filter(a=>a.packages.length>0).slice(0,3);if(r.length>0){e.push("    Major Upgrade Intelligence:");for(let a of r){e.push(`      - ${a.project} (${a.recommendation})`);for(let s of a.packages.slice(0,2))e.push(`        \xB7 ${s.package} ${s.currentVersion??"?"} \u2192 ${s.targetVersion??"?"} | touched ~${s.usage.touchedPercent}% | ${s.automatable}`);}}e.push("");}}if(t.tsModernity&&t.tsModernity.typescriptVersion){let n=t.tsModernity;e.push(l.bold.underline("  TypeScript"));let o=[];o.push(`v${n.typescriptVersion}`),n.strict===true?o.push(l.green("strict \u2714")):n.strict===false&&o.push(l.yellow("strict \u2716")),n.moduleType&&o.push(n.moduleType.toUpperCase()),n.target&&o.push(`target: ${n.target}`),e.push(`    ${o.join(l.dim(" \xB7 "))}`),e.push("");}if(t.buildDeploy){let n=t.buildDeploy;(n.ci.length>0||n.docker.dockerfileCount>0||n.packageManagers.length>0)&&(e.push(l.bold.underline("  Build & Deploy")),n.ci.length>0&&e.push(`    CI: ${n.ci.join(", ")}`),n.docker.dockerfileCount>0&&e.push(`    Docker: ${n.docker.dockerfileCount} Dockerfile${n.docker.dockerfileCount!==1?"s":""} (${n.docker.baseImages.join(", ")})`),n.packageManagers.length>0&&e.push(`    Package Managers: ${n.packageManagers.join(", ")}`),n.monorepoTools.length>0&&e.push(`    Monorepo: ${n.monorepoTools.join(", ")}`),n.iac.length>0&&e.push(`    IaC: ${n.iac.join(", ")}`),e.push(""));}if(t.uiPurpose){let n=t.uiPurpose;e.push(l.bold.underline("  Product Purpose Signals")),e.push(`    Frameworks: ${n.detectedFrameworks.length>0?n.detectedFrameworks.join(", "):l.dim("unknown")}`),e.push(`    Evidence: ${n.topEvidence.length}${n.capped?l.dim(` of ${n.evidenceCount} (capped)`):""}`);let o=n.topEvidence.slice(0,8);if(o.length>0){e.push("    Top Signals:");for(let r of o)e.push(`      - [${r.kind}] ${r.value} ${l.dim(`(${r.file})`)}`);}if(n.unknownSignals.length>0){e.push("    Unknowns:");for(let r of n.unknownSignals.slice(0,4))e.push(`      - ${l.yellow(r)}`);}e.push("");}if(t.securityPosture){let n=t.securityPosture;e.push(l.bold.underline("  Security Posture"));let o=[];o.push(n.lockfilePresent?l.green("Lockfile \u2714"):l.red("Lockfile \u2716")),o.push(n.gitignoreCoversEnv?l.green(".env \u2714"):l.red(".env \u2716")),o.push(n.gitignoreCoversNodeModules?l.green("node_modules \u2714"):l.yellow("node_modules \u2716")),n.multipleLockfileTypes&&o.push(l.yellow("Multiple lockfiles \u26A0")),n.envFilesTracked&&o.push(l.red("Env files tracked \u2716")),e.push(`    ${o.join(l.dim(" \xB7 "))}`),e.push("");}if(t.platformMatrix){let n=t.platformMatrix;(n.nativeModules.length>0||n.dockerBaseImages.length>0)&&(e.push(l.bold.underline("  Platform")),n.nativeModules.length>0&&e.push(`    Native modules: ${n.nativeModules.map(o=>l.dim(o)).join(", ")}`),n.osAssumptions.length>0&&e.push(`    OS assumptions: ${n.osAssumptions.join(", ")}`),e.push(""));}if(t.codeQuality){let n=t.codeQuality;if(e.push(l.bold.underline("  Code Quality")),e.push(`    Files: ${l.white(`${n.filesAnalyzed}`)} \xB7 Functions: ${l.white(`${n.functionsAnalyzed}`)} \xB7 Avg complexity: ${l.white(`${n.avgCyclomaticComplexity}`)} \xB7 Avg length: ${l.white(`${n.avgFunctionLength}`)} lines`),e.push(`    Max nesting: ${n.maxNestingDepth} \xB7 Circular deps: ${n.circularDependencies} \xB7 Dead code: ${n.deadCodePercent}%`),n.godFiles.length>0){let o=n.godFiles.slice(0,3).map(r=>`${r.path} (${r.lines} lines)`).join(", ");e.push(`    ${l.yellow("God files")}: ${o}`);}e.push("");}if(t.dependencyGraph){let n=t.dependencyGraph;n.lockfileType&&(e.push(l.bold.underline("  Dependency Graph")),e.push(`    ${n.lockfileType}: ${l.white(`${n.totalUnique}`)} unique, ${l.white(`${n.totalInstalled}`)} installed`),n.duplicatedPackages.length>0&&e.push(`    ${l.yellow(`${n.duplicatedPackages.length} duplicated`)} packages`),n.phantomDependencies.length>0&&e.push(`    ${l.red(`${n.phantomDependencies.length} phantom`)} dependencies`),e.push(""));}return e}function Oo(t){let e=[];if(e.push(l.bold.cyan("\u2554\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2557")),e.push(l.bold.cyan("\u2551        Architecture Layers               \u2551")),e.push(l.bold.cyan("\u255A\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u255D")),e.push(""),e.push(l.bold("  Archetype: ")+`${t.archetype}`+l.dim(` (${Math.round(t.archetypeConfidence*100)}% confidence)`)),e.push(`  Files classified: ${t.totalClassified}`+(t.unclassified>0?l.dim(` (${t.unclassified} unclassified)`):"")),e.push(""),t.layers.length>0){for(let n of t.layers){let o=n.riskLevel==="none"?l.dim("none"):n.riskLevel==="low"?l.green("low"):n.riskLevel==="moderate"?l.yellow("moderate"):l.red("high");e.push(`    ${l.bold(n.layer)}  ${n.fileCount} file${n.fileCount!==1?"s":""}  drift ${Ce(n.driftScore)}  risk ${o}`);}e.push("");}return e}function Fo(t){let e=[],n=t.projects.filter(s=>s.runtimeMajorsBehind!==void 0&&s.runtimeMajorsBehind>=3);if(n.length>0){let s=n.map(p=>p.name).join(", "),i="End-of-life runtimes no longer receive security patches and block ecosystem upgrades.",c=[];for(let p of n)c.push(`
-     ./${p.path}`),c.push(`
-       ${p.runtime} \u2192 ${p.runtimeLatest} (${p.runtimeMajorsBehind} major${p.runtimeMajorsBehind>1?"s":""} behind)`);i+=c.join(""),e.push({title:`Upgrade EOL runtime${n.length>1?"s":""} in ${s}`,explanation:i,impact:`\u2212${Math.min(n.length*10,30)} drift points (runtime & EOL scores)`,severity:100});}let o=[];for(let s of t.projects)for(let i of s.frameworks)i.majorsBehind!==null&&i.majorsBehind>=3&&o.push({name:i.name,fw:`${i.currentVersion} \u2192 ${i.latestVersion}`,behind:i.majorsBehind,project:s.name,projectPath:s.path});if(o.length>0){let s=o.sort((u,f)=>f.behind-u.behind)[0],i=o.length>1?` (+${o.length-1} more)`:"",c=`${s.behind} major versions behind. Major framework drift increases breaking change risk and blocks access to security fixes and performance improvements.`,p=[],g=0;for(let u of o){if(g>=8)break;p.push(`
-     ./${u.projectPath}`),p.push(`
-       ${u.name}: ${u.fw} (${u.behind} major${u.behind>1?"s":""} behind)`),g++;}let m=o.length-g;c+=p.join(""),m>0&&(c+=`
-     ... and ${m} more`),e.push({title:`Upgrade ${s.name} ${s.fw} in ${s.project}${i}`,explanation:c,impact:"\u22125\u201315 drift points",severity:90});}for(let s of t.projects){let i=s.dependencyAgeBuckets,c=i.current+i.oneBehind+i.twoPlusBehind;if(c===0)continue;let p=Math.round(i.twoPlusBehind/c*100);if(p>=40){let g=`${i.twoPlusBehind} of ${c} dependencies are 2+ majors behind. Run \`npm outdated\` and prioritise packages with known CVEs or breaking API changes.`,m=s.dependencies.filter(u=>u.majorsBehind!==null&&u.majorsBehind>=2).sort((u,f)=>(f.majorsBehind??0)-(u.majorsBehind??0));if(m.length>0){let u=[],f=0;u.push(`
-     ./${s.path}`);for(let $ of m){if(f>=8)break;let k=$.resolvedVersion??$.currentSpec,w=$.latestStable??"?";u.push(`
-       ${$.package}: ${k} \u2192 ${w} (${$.majorsBehind} major${$.majorsBehind>1?"s":""} behind)`),f++;}let v=m.length-f;g+=u.join(""),v>0&&(g+=`
-     ... and ${v} more`);}e.push({title:`Reduce dependency rot in ${s.name} (${p}% severely outdated)`,explanation:g,impact:"\u22125\u201310 drift points",severity:80+p/10});}}let r=[];for(let s of t.projects)for(let i of s.frameworks)i.majorsBehind===2&&r.push({name:i.name,project:s.name,projectPath:s.path,fw:`${i.currentVersion} \u2192 ${i.latestVersion}`});let a=[...new Map(r.map(s=>[s.name,s])).values()];if(a.length>0){let s=a.slice(0,3).map(u=>`${u.name} (${u.fw})`).join(", "),i=a.length>3?` +${a.length-3} more`:"",c="These frameworks are 2 major versions behind. Create upgrade tickets and check migration guides \u2014 the gap will widen with each new release.",p=[],g=0;for(let u of r){if(g>=8)break;p.push(`
-     ./${u.projectPath}`),p.push(`
-       ${u.name}: ${u.fw}`),g++;}let m=r.length-g;c+=p.join(""),m>0&&(c+=`
-     ... and ${m} more`),e.push({title:`Plan major framework upgrades: ${s}${i}`,explanation:c,impact:"\u22125\u201310 drift points",severity:60});}if(t.extended?.breakingChangeExposure){let s=t.extended.breakingChangeExposure,i=s.deprecatedPackages.length+s.legacyPolyfills.length;if(i>0){let c=[...s.deprecatedPackages,...s.legacyPolyfills].slice(0,5).join(", "),p=i>5?` +${i-5} more`:"",g=`${i} package${i!==1?"s":""} are deprecated or legacy polyfills. These receive no updates and may have known vulnerabilities.`,m=new Set([...s.deprecatedPackages,...s.legacyPolyfills]),u=[],f=0;for(let $ of t.projects){let k=$.dependencies.filter(w=>m.has(w.package));if(k.length!==0){if(f>=10)break;u.push(`
-     ./${$.path}`);for(let w of k){if(f>=10)break;let U=w.resolvedVersion??w.currentSpec,O=s.deprecatedPackages.includes(w.package)?"deprecated":"polyfill";u.push(`
-       ${w.package}: ${U} (${O})`),f++;}}}let v=i-f;g+=u.join(""),v>0&&(g+=`
-     ... and ${v} more`),e.push({title:`Replace deprecated/legacy packages: ${c}${p}`,explanation:g,severity:55});}}if(t.extended?.dependencyGraph){let s=t.extended.dependencyGraph,i=s.phantomDependencies.length;if(i>=10){let c="Packages used in code but not declared in package.json. These rely on transitive installs and can break unpredictably when other packages update.",p=s.phantomDependencyDetails;if(p&&p.length>0){let g=new Map;for(let v of p)g.has(v.sourcePath)||g.set(v.sourcePath,[]),g.get(v.sourcePath).push({package:v.package,spec:v.spec});let m=[],u=0;for(let[v,$]of g){if(u>=10)break;m.push(`
-     ./${v}`);for(let k of $){if(u>=10)break;m.push(`
-       ${k.package}: ${k.spec}`),u++;}}let f=i-u;c+=m.join(""),f>0&&(c+=`
-     ... and ${f} more`);}e.push({title:`Fix ${i} phantom dependencies`,explanation:c,severity:45});}}if(t.extended?.securityPosture){let s=t.extended.securityPosture;if(s.envFilesTracked||!s.lockfilePresent){let i=[];s.envFilesTracked&&i.push(".env files are tracked in git"),s.lockfilePresent||i.push("no lockfile found");let c;s.envFilesTracked?(c="Environment files may contain secrets. Add them to .gitignore and rotate any exposed credentials immediately.",c+=`
-     ./.gitignore`,c+=`
-       Add: .env, .env.*, .env.local`):(c="Without a lockfile, installs are non-deterministic. Run the install command to generate one and commit it.",c+=`
-     ./`,c+=`
-       Missing: ${s.lockfileTypes.length>0?s.lockfileTypes.join(", ")+" (multiple types detected)":"package-lock.json, pnpm-lock.yaml, or yarn.lock"}`),e.push({title:`Fix security posture: ${i.join(", ")}`,explanation:c,severity:95});}}if(t.extended?.dependencyGraph){let i=t.extended.dependencyGraph.duplicatedPackages.filter(c=>c.versions.length>=3);if(i.length>=3){i.slice(0,4).map(f=>`${f.name} (${f.versions.length}v)`).join(", ");let p=`${i.length} packages have 3+ versions installed. Run \`npm dedupe\` to reduce bundle size and install time.`,g=[],m=0;for(let f of i){if(m>=8)break;g.push(`
-       ${f.name}: ${f.versions.join(", ")} (${f.consumers} consumer${f.consumers!==1?"s":""})`),m++;}let u=i.length-m;p+=g.join(""),u>0&&(p+=`
-     ... and ${u} more`),e.push({title:"Deduplicate heavily-versioned packages",explanation:p,severity:35});}}return e.sort((s,i)=>i.severity-s.severity),e.slice(0,5)}function Zt(t){let e=[];e.push("# Vibgrate Drift Report"),e.push(""),e.push("| Metric | Value |"),e.push("|--------|-------|"),e.push(`| **Drift Score** | ${t.drift.score}/100 _(lower is better; 0 = no drift)_ |`),e.push(`| **Risk Level** | ${t.drift.riskLevel.toUpperCase()} |`),e.push(`| **Projects** | ${t.projects.length} |`);let n=[t.timestamp];t.durationMs!==void 0&&n.push(`${(t.durationMs/1e3).toFixed(1)}s`),t.filesScanned!==void 0&&n.push(`${t.filesScanned} files`),t.treeSummary&&n.push(`${t.treeSummary.totalFiles.toLocaleString()} workspace files \xB7 ${t.treeSummary.totalDirs.toLocaleString()} dirs`),e.push(`| **Scanned** | ${n.join(" \xB7 ")} |`),t.vcs&&(e.push(`| **VCS** | ${t.vcs.type} |`),t.vcs.branch&&e.push(`| **Branch** | ${t.vcs.branch} |`),t.vcs.sha&&e.push(`| **Commit** | \`${t.vcs.shortSha}\` |`)),e.push(""),e.push("## Score Breakdown"),e.push(""),e.push("| Component | Score |"),e.push("|-----------|-------|"),e.push(`| Runtime | ${t.drift.components.runtimeScore} |`),e.push(`| Frameworks | ${t.drift.components.frameworkScore} |`),e.push(`| Dependencies | ${t.drift.components.dependencyScore} |`),e.push(`| EOL Risk | ${t.drift.components.eolScore} |`),e.push(""),e.push("## Projects"),e.push("");for(let o of t.projects){if(e.push(`### ${o.name} (${o.type})`),e.push(""),o.runtime){let s=o.runtimeMajorsBehind!==void 0&&o.runtimeMajorsBehind>0?` \u2014 ${o.runtimeMajorsBehind} major(s) behind`:" \u2014 current";e.push(`- **Runtime:** ${o.runtime}${s}`);}if(o.frameworks.length>0){e.push("- **Frameworks:**");for(let s of o.frameworks){let i=s.majorsBehind!==null?s.majorsBehind===0?"current":`${s.majorsBehind} behind`:"unknown";e.push(`  - ${s.name}: ${s.currentVersion??"?"} \u2192 ${s.latestVersion??"?"} (${i})`);}}let r=o.dependencyAgeBuckets;r.current+r.oneBehind+r.twoPlusBehind+r.unknown>0&&e.push(`- **Dependencies:** ${r.current} current, ${r.oneBehind} 1-behind, ${r.twoPlusBehind} 2+ behind, ${r.unknown} unknown`),e.push("");}if(t.extended?.uiPurpose){let o=t.extended.uiPurpose;if(e.push("## Product Purpose Signals"),e.push(""),e.push(`- **Frameworks:** ${o.detectedFrameworks.length>0?o.detectedFrameworks.join(", "):"unknown"}`),e.push(`- **Evidence Items:** ${o.topEvidence.length}${o.capped?` (capped from ${o.evidenceCount})`:""}`),o.topEvidence.length>0){e.push("- **Top Evidence:**");for(let r of o.topEvidence.slice(0,10))e.push(`  - [${r.kind}] ${r.value} (${r.file})`);}if(o.unknownSignals.length>0){e.push("- **Unknowns:**");for(let r of o.unknownSignals.slice(0,5))e.push(`  - ${r}`);}e.push("");}if(t.extended?.standards&&t.extended.standards.recommended.length>0){let o=t.extended.standards;e.push("## Recommended Standards"),e.push("");let r=o.projectPurposes.map(a=>`${a.project} \u2192 ${a.category}`).join(", ");if(r&&e.push(`- **Detected purpose:** ${r}`),o.frameworks.length>0){e.push("- **Compliance framework coverage:**");for(let a of o.frameworks)e.push(`  - ${a.name}: ${a.recommendedMembers}/${a.totalMembers} member standards apply`);}e.push("- **Top standards to consider:**");for(let a of o.recommended.slice(0,10)){let s=a.complianceRelevant?" _(compliance)_":"";e.push(`  - **${a.name}** \u2014 ${a.reason}${s}`);}e.push("");}if(t.findings.length>0){e.push("## Findings"),e.push(""),e.push("| Level | Rule | Message | Location |"),e.push("|-------|------|---------|----------|");for(let o of t.findings){let r=o.level==="error"?"\u{1F534}":o.level==="warning"?"\u{1F7E1}":"\u{1F535}";e.push(`| ${r} ${o.level} | ${o.ruleId} | ${o.message} | ${o.location} |`);}e.push("");}if(t.delta!==void 0){let o=t.delta>0?"\u{1F4C8}":t.delta<0?"\u{1F4C9}":"\u27A1\uFE0F",r=t.delta>0?" _(worsened)_":t.delta<0?" _(improved)_":"";e.push(`## Drift Delta: ${o} ${t.delta>0?"+":""}${t.delta} vs baseline${r}`),e.push("");}return e.join(`
-`)}var nn=new Command("report").description("Generate a drift report from a scan artifact").option("--in <file>","Input artifact file",".vibgrate/scan_result.json").option("--format <format>","Output format (md|text|json)","text").action(async t=>{let e=S.resolve(t.in);await c(e)||(console.error(l.red(`Artifact not found: ${e}`)),console.error(l.dim('Run "vibgrate scan" first to generate a scan artifact.')),process.exit(1));let n=await b$1(e);switch(t.format){case "md":console.log(Zt(n));break;case "json":console.log(JSON.stringify(n,null,2));break;default:console.log(Qt(n));break}});function on(t){let e=process.platform,n,o;e==="darwin"?(n="open",o=[t]):e==="win32"?(n="cmd",o=["/c","start","",t]):(n="xdg-open",o=[t]);try{let r=spawn(n,o,{stdio:"ignore",detached:!0});return r.on("error",()=>{}),r.unref(),!0}catch{return  false}}var Uo=t=>new Promise(e=>setTimeout(e,t)),rn=new Command("login").description("Authenticate the CLI with your Vibgrate workspace via the browser").option("--ingest <url>","Ingest API URL (overrides --region)").option("--region <region>",`Data residency region (${ae().join(", ")})`,"us").option("--no-browser","Do not attempt to open a browser automatically").action(async t=>{let e;try{e=ne(t.region,t.ingest);}catch(s){console.error(l.red(s instanceof Error?s.message:String(s))),process.exit(1);}let n=`https://${e}/v1/auth/device`,o;try{let s=await fetch(`${n}/start`,{method:"POST",headers:{"Content-Type":"application/json",Connection:"close"},body:"{}"});s.ok||(console.error(l.red(`Failed to start login (HTTP ${s.status}).`)),process.exit(1)),o=await s.json();}catch(s){console.error(l.red(`Could not reach ${e}: ${s instanceof Error?s.message:String(s)}`)),process.exit(1);}console.log(""),console.log("To finish signing in, open this URL and approve the request:"),console.log(""),console.log("  "+l.cyan(o.verificationUri)),console.log(""),console.log("  Your code: "+l.bold(o.userCode)),console.log(""),t.browser&&on(o.verificationUriComplete)&&console.log(l.dim("Opening your browser\u2026 (if it does not open, use the URL above)")),console.log(l.dim("Waiting for approval\u2026"));let r=Math.max(2,o.interval||5)*1e3,a=Date.now()+(o.expiresIn||900)*1e3;for(;Date.now()<a;){await Uo(r);let s;try{s=await(await fetch(`${n}/token`,{method:"POST",headers:{"Content-Type":"application/json",Connection:"close"},body:JSON.stringify({deviceCode:o.deviceCode})})).json();}catch{continue}if(s.status!=="authorization_pending"){if(s.status==="complete"&&s.dsn){Ht({dsn:s.dsn,workspaceId:s.workspaceId,keyId:s.keyId,ingestHost:s.ingestHost??e,savedAt:new Date().toISOString()}),console.log(""),console.log(l.green("\u2714")+" Logged in."),s.workspaceId&&console.log("  Workspace: "+l.bold(s.workspaceId)),console.log(l.dim(`  Credentials saved to ${de()}`)),console.log(l.dim('  You can now run "vibgrate scan --push".'));return}s.status==="access_denied"&&(console.error(l.red("\u2716 Login was denied in the browser.")),process.exit(1)),(s.status==="expired"||s.status==="invalid")&&(console.error(l.red('\u2716 Login request expired. Run "vibgrate login" again.')),process.exit(1)),s.status==="error"&&(console.error(l.red(`\u2716 ${s.error??"Login failed."}`)),process.exit(1));}}console.error(l.red('\u2716 Timed out waiting for approval. Run "vibgrate login" again.')),process.exit(1);});var an=new Command("logout").description("Clear stored Vibgrate login credentials").action(()=>{let t=Gt();console.log(t?l.green("\u2714")+" Logged out. Stored credentials removed.":l.dim(`No stored credentials found at ${de()}.`));});var Ho=[{category:"pricing",pattern:/price|pricing|billing|subscri|trial|credit|plan|tier|upgrade|premium|pro|enterprise/i},{category:"auth",pattern:/sign[- ]?in|sign[- ]?up|log[- ]?in|log[- ]?out|auth|sso|oauth|password|register|invite|onboard/i},{category:"dashboard",pattern:/dashboard|overview|home|main|summary|stats/i},{category:"settings",pattern:/setting|config|preference|option|profile|account/i},{category:"users",pattern:/user|member|team|role|permission|access|admin|owner/i},{category:"integrations",pattern:/integrat|connect|webhook|api[- ]?key|sync|import|export/i},{category:"reports",pattern:/report|analy|metric|chart|graph|insight|track/i},{category:"workflows",pattern:/workflow|automat|schedule|trigger|action|job|task|pipeline/i},{category:"projects",pattern:/project|workspace|organization|folder|repo/i},{category:"navigation",pattern:/menu|nav|sidebar|header|footer|breadcrumb/i}];function cn(t,e=3){let n=t.topEvidence,o=n.filter(g=>g.kind==="dependency").map(g=>g.value).slice(0,10),r=Xo(n.filter(g=>g.kind==="route").map(g=>g.value)).slice(0,15),a=n.filter(g=>g.kind!=="dependency"&&g.kind!=="route"&&g.kind!=="feature_flag"),s=new Map,i={};for(let g of a){let m=Go(g.value);s.has(m)||s.set(m,new Set);let u=Wo(g.value);u.length>=3&&s.get(m).add(u);}let c=[];for(let[g,m]of s){let u=Jo([...m]);i[g]=u.length;for(let f of u.slice(0,e))c.push({kind:"text",value:f,category:g});}let p=n.filter(g=>g.kind==="feature_flag");return p.length>0&&(i.feature_flags=p.length,c.push({kind:"feature_flag",value:"feature flags detected",category:"feature_flags"})),{samples:c,categoryCounts:i,originalCount:n.length,dependencies:o,routes:r,detectedFrameworks:t.detectedFrameworks}}function Go(t){for(let{category:e,pattern:n}of Ho)if(n.test(t))return e;return "general"}function Wo(t){return t.toLowerCase().replace(/[^a-z0-9\s-]/g," ").replace(/\s+/g," ").trim().slice(0,60)}function Jo(t){let e=t.sort((o,r)=>r.length-o.length),n=[];for(let o of e)n.some(a=>{let s=o.slice(0,6);return a.startsWith(s)||a.includes(o)||o.includes(a)})||n.push(o);return n}function Xo(t){let e=new Set,n=[];for(let o of t){let r=o.replace(/:[a-z_]+/gi,":param").replace(/\[\[*\.*\.*[a-z_]+\]*\]/gi,":param").replace(/\/+$/,"").toLowerCase();e.has(r)||(e.add(r),n.push(o));}return n}var zo=promisify(ln.gzip),J=50;function Ie(t){let e=t.match(/^(.+?)\s*\(/);return e?e[1].trim():t.trim()}function qo(t){return {databaseTechnologies:t.databaseTechnologies.slice(0,10),connectionStrings:[],connectionPoolSettings:t.connectionPoolSettings.slice(0,J),replicationSettings:t.replicationSettings.slice(0,20),readReplicaSettings:t.readReplicaSettings.slice(0,20),failoverSettings:t.failoverSettings.slice(0,20),collationAndEncoding:t.collationAndEncoding.slice(0,20),queryTimeoutDefaults:t.queryTimeoutDefaults.slice(0,20),manualIndexes:t.manualIndexes.map(Ie).slice(0,J),tables:t.tables.map(Ie).slice(0,J),views:t.views.map(Ie).slice(0,J),storedProcedures:t.storedProcedures.map(Ie).slice(0,J),triggers:t.triggers.map(Ie).slice(0,J),rowLevelSecurityPolicies:t.rowLevelSecurityPolicies.slice(0,20),otherServices:t.otherServices.slice(0,20)}}function Yo(t){let e=new Set;return {integrations:t.integrations.filter(o=>{let r=o.provider.split(":")[0];return e.has(r)?false:(e.add(r),true)}).slice(0,J).map(o=>({provider:o.provider,endpoint:"",version:o.version,parameters:[],configOptions:[],authHints:[],files:[]})),openApiSpecifications:t.openApiSpecifications.slice(0,10),webhookUrls:t.webhookUrls.slice(0,20),callbackEndpoints:t.callbackEndpoints.slice(0,20),apiVersionPins:t.apiVersionPins.slice(0,20),tokenExpirationPolicies:t.tokenExpirationPolicies.slice(0,20),rateLimitOverrides:t.rateLimitOverrides.slice(0,20),customHeaders:t.customHeaders.slice(0,20),corsPolicies:t.corsPolicies.slice(0,20),oauthScopes:t.oauthScopes.slice(0,20),apiTokens:[]}}function Qo(t){return {faviconFiles:t.faviconFiles.slice(0,1),productLogos:[]}}function Zo(t){let e={...t};if(e.extended){let n={...e.extended};if(n.dataStores&&(n.dataStores=qo(n.dataStores)),n.apiSurface&&(n.apiSurface=Yo(n.apiSurface)),n.assetBranding&&(n.assetBranding=Qo(n.assetBranding)),n.uiPurpose){let o=cn(n.uiPurpose);n.uiPurpose={enabled:n.uiPurpose.enabled,detectedFrameworks:o.detectedFrameworks,evidenceCount:o.originalCount,capped:n.uiPurpose.capped,topEvidence:[],unknownSignals:[],compacted:o};}if(n.runtimeConfiguration&&(n.runtimeConfiguration={...n.runtimeConfiguration,environmentVariables:n.runtimeConfiguration.environmentVariables.slice(0,100),hiddenConfigFiles:n.runtimeConfiguration.hiddenConfigFiles.slice(0,J),startupArguments:n.runtimeConfiguration.startupArguments.slice(0,100)}),n.operationalResilience){let o=n.operationalResilience;n.operationalResilience={implicitTimeouts:o.implicitTimeouts.slice(0,30),defaultPaginationSize:o.defaultPaginationSize.slice(0,30),implicitRetryLogic:o.implicitRetryLogic.slice(0,30),defaultLocale:o.defaultLocale.slice(0,20),defaultCurrency:o.defaultCurrency.slice(0,20),implicitTimezone:o.implicitTimezone.slice(0,20),defaultCharacterEncoding:o.defaultCharacterEncoding.slice(0,20),sessionStores:o.sessionStores.slice(0,20),distributedLocks:o.distributedLocks.slice(0,20),jobSchedulers:o.jobSchedulers.slice(0,30),idempotencyKeys:o.idempotencyKeys.slice(0,20),rateLimitingCounters:o.rateLimitingCounters.slice(0,20),circuitBreakerState:o.circuitBreakerState.slice(0,20),abTestToggles:o.abTestToggles.slice(0,20),regionalEnablementRules:o.regionalEnablementRules.slice(0,20),betaAccessGroups:o.betaAccessGroups.slice(0,20),licensingEnforcementLogic:o.licensingEnforcementLogic.slice(0,20),killSwitches:o.killSwitches.slice(0,20),connectorRetryLogic:o.connectorRetryLogic.slice(0,20),apiPollingIntervals:o.apiPollingIntervals.slice(0,20),fieldMappings:o.fieldMappings.slice(0,20),schemaRegistryRules:o.schemaRegistryRules.slice(0,20),deadLetterQueueBehavior:o.deadLetterQueueBehavior.slice(0,20),dataMaskingRules:o.dataMaskingRules.slice(0,20),transformationLogic:o.transformationLogic.slice(0,20),timezoneHandling:o.timezoneHandling.slice(0,20),encryptionSettings:o.encryptionSettings.slice(0,30),hardcodedSecretSignals:o.hardcodedSecretSignals.slice(0,20)};}n.dependencyGraph&&(n.dependencyGraph={...n.dependencyGraph,phantomDependencies:n.dependencyGraph.phantomDependencies.slice(0,J),phantomDependencyDetails:n.dependencyGraph.phantomDependencyDetails?.slice(0,J),duplicatedPackages:n.dependencyGraph.duplicatedPackages.slice(0,J)}),e.extended=n;}return e}async function er(t){let e=JSON.stringify(t);return zo(e,{level:9})}async function dn(t){let e=Zo(t);return {body:await er(e),contentEncoding:"gzip"}}function Le(t){let n=t.replace(/[\x00-\x1F\x7F\uFEFF\u200B-\u200D\u2060]/g,"").trim().match(/^vibgrate\+(https?):?\/\/([^:]+):([^@]+)@([^/]+)\/(.+)$/);return n?{scheme:n[1],keyId:n[2],secret:n[3],host:n[4],workspaceId:n[5]}:null}function gn(t,e){return Ne.createHmac("sha256",e).update(t).digest("base64")}var fn=new Command("push").description("Push scan results to Vibgrate API").option("--dsn <dsn>","DSN token (or use VIBGRATE_DSN env)").option("--region <region>",`Override data residency region (${ae().join(", ")})`).option("--file <file>","Scan artifact file",".vibgrate/scan_result.json").option("--strict","Fail on upload errors").action(async t=>{let e=fe(t.dsn);if(!e){console.error(l.red("No DSN provided.")),console.error(l.dim('Run "vibgrate login", set VIBGRATE_DSN, or use the --dsn flag.')),t.strict&&process.exit(1);return}let n=Le(e);if(!n){console.error(l.red("Invalid DSN format.")),console.error(l.dim("Expected: vibgrate+https://<key_id>:<secret>@<host>/<workspace_id>")),t.strict&&process.exit(1);return}let o=S.resolve(t.file);if(!await c(o)){console.error(l.red(`Scan artifact not found: ${o}`)),console.error(l.dim('Run "vibgrate scan" first.')),t.strict&&process.exit(1);return}let r=await b$1(o),{body:a,contentEncoding:s}=await dn(r),i=String(Date.now()),c$1=n.host;if(t.region)try{c$1=ne(t.region);}catch(u){console.error(l.red(u instanceof Error?u.message:String(u))),t.strict&&process.exit(1);return}let p=JSON.stringify(r).length,g=a.length,m=((1-g/p)*100).toFixed(0);console.log(l.dim(`Uploading to ${c$1}... (${(g/1024).toFixed(0)} KB, ${m}% smaller)`));try{let{response:u,host:f}=await Fe({scheme:n.scheme,host:c$1,keyId:n.keyId,secret:n.secret,body:a,contentEncoding:s,timestamp:i});if(c$1=f,!u.ok){let $=await u.text();throw new Error(`HTTP ${u.status}: ${$}`)}let v=await u.json();if(console.log(l.green("\u2714")+` Scan queued for processing (${v.ingestId??"ok"})`),console.log(),console.log(l.dim("Processing continues in the background. Results available shortly.")),console.log(),v.ingestId){let k=`https://${ge(c$1)}/${n.workspaceId}/scan/${v.ingestId}`;console.log(l.dim("View report: ")+l.underline(k));}}catch(u){let f=u instanceof Error?u.message:String(u);console.error(l.red(`Upload failed: ${f}`)),t.strict&&process.exit(1);}});var je=b$2(a(),1);var hn="https://registry.npmjs.org/@vibgrate%2fcli/latest",bn=S.join(Ut.homedir(),".vibgrate"),yn=S.join(bn,"update-check.json"),nr=720*60*1e3;async function wn(){try{let t=await or();if(t&&Date.now()-t.checkedAt<nr)return {current:E,latest:t.latest,updateAvailable:je.default.gt(t.latest,E)};let e=new AbortController,n=setTimeout(()=>e.abort(),5e3);n.unref?.();let o;try{o=await fetch(hn,{headers:{Accept:"application/json"},signal:e.signal});}finally{clearTimeout(n);}if(!o.ok)return null;let a=(await o.json()).version;return !a||!je.default.valid(a)?null:(await $n({latest:a,checkedAt:Date.now()}),{current:E,latest:a,updateAvailable:je.default.gt(a,E)})}catch{return null}}async function vn(){try{let t=new AbortController,e=setTimeout(()=>t.abort(),1e4);e.unref?.();let n;try{n=await fetch(hn,{headers:{Accept:"application/json"},signal:t.signal});}finally{clearTimeout(e);}if(!n.ok)return null;let r=(await n.json()).version;return !r||!je.default.valid(r)?null:(await $n({latest:r,checkedAt:Date.now()}),r)}catch{return null}}async function or(){try{let t=await K.readFile(yn,"utf-8"),e=JSON.parse(t);return e.latest&&typeof e.checkedAt=="number"?e:null}catch{return null}}async function $n(t){try{await K.mkdir(bn,{recursive:!0}),await K.writeFile(yn,JSON.stringify(t),"utf-8");}catch{}}function ir(){let t=process.argv[1]||"";return (t.includes("/lib/node_modules/")||t.includes("\\node_modules\\"))&&!t.includes(process.cwd())?t.includes("pnpm")?"pnpm":t.includes("yarn")?"yarn":t.includes("bun")?"bun":"npm":null}function ar(t,e,n){let o=`${e}@${n}`;switch(t){case "pnpm":return `pnpm add -g ${o}`;case "yarn":return `yarn global add ${o}`;case "bun":return `bun add -g ${o}`;default:return `npm install -g ${o}`}}async function cr(t){return await c(S.join(t,"pnpm-lock.yaml"))?"pnpm":await c(S.join(t,"bun.lockb"))?"bun":await c(S.join(t,"yarn.lock"))?"yarn":"npm"}function lr(t,e,n,o){let r=`${e}@${n}`;switch(t){case "pnpm":return o?`pnpm add -D ${r}`:`pnpm add ${r}`;case "yarn":return o?`yarn add --dev ${r}`:`yarn add ${r}`;case "bun":return o?`bun add -d ${r}`:`bun add ${r}`;default:return o?`npm install --save-dev ${r}`:`npm install ${r}`}}async function dr(t){try{let e=S.join(t,"package.json"),n=await(await import('fs/promises')).readFile(e,"utf-8");return !!JSON.parse(n).devDependencies?.["@vibgrate/cli"]}catch{return  true}}var Sn=new Command("update").description("Update vibgrate to the latest version").option("--check","Only check for updates, do not install").option("--pm <manager>","Package manager to use (npm, pnpm, yarn, bun)").option("--global","Update global installation").action(async t=>{console.log(l.dim(`Current version: ${E}`)),console.log(l.dim("Checking npm registry..."));let e=await vn();if(e||(console.error(l.red("Could not reach the npm registry. Check your network connection.")),process.exit(1)),!(await import('./semver-TPPMM2NV.js')).gt(e,E)){console.log(l.green("\u2714")+` You are on the latest version (${E}).`);return}if(console.log(l.yellow(`Update available: ${E} \u2192 ${e}`)),t.check){console.log(l.dim('Run "vibgrate update" to install.'));return}let o=process.cwd(),r=ir(),a=t.global||r!==null,s=t.pm||(r??await cr(o)),i;if(a)i=ar(s,"@vibgrate/cli",e),console.log(l.dim(`Updating global installation with ${s}: ${i}`));else {let c=await dr(o);i=lr(s,"@vibgrate/cli",e,c),console.log(l.dim(`Using ${s}: ${i}`));}try{execSync(i,{cwd:o,stdio:"inherit"}),console.log(l.green("\u2714")+` Updated to @vibgrate/cli@${e}`);}catch{console.error(l.red(`Update failed. Run manually: ${i}`)),process.exit(1);}});var gr="https://openvex.dev/ns/v0.2.0",kn=["not_affected","affected","fixed","under_investigation"],xn=["component_not_present","vulnerable_code_not_present","vulnerable_code_not_in_execute_path","vulnerable_code_cannot_be_controlled_by_adversary","inline_mitigations_already_exist"],X=class extends Error{};function fr(t){let e=t.statements.map((n,o)=>{if(!n.vulnerability||typeof n.vulnerability!="string")throw new X(`statement[${o}]: "vulnerability" is required`);if(!kn.includes(n.status))throw new X(`statement[${o}] (${n.vulnerability}): invalid status "${n.status}". Expected one of: ${kn.join(", ")}`);let r=n.products&&n.products.length>0?n.products:t.defaultProduct?[t.defaultProduct]:[];if(r.length===0)throw new X(`statement[${o}] (${n.vulnerability}): no product. Set "products" on the statement or pass --product.`);if(n.status==="not_affected"&&!n.justification&&!n.impact_statement)throw new X(`statement[${o}] (${n.vulnerability}): "not_affected" requires a justification or impact_statement.`);if(n.justification&&!xn.includes(n.justification))throw new X(`statement[${o}] (${n.vulnerability}): invalid justification "${n.justification}". Expected one of: ${xn.join(", ")}`);if(n.status==="affected"&&!n.action_statement)throw new X(`statement[${o}] (${n.vulnerability}): "affected" requires an action_statement.`);let a={vulnerability:{name:n.vulnerability},products:r.map(s=>({"@id":s})),status:n.status};return n.justification&&(a.justification=n.justification),n.impact_statement&&(a.impact_statement=n.impact_statement),n.action_statement&&(a.action_statement=n.action_statement),a});return {"@context":gr,"@id":t.id??`https://vibgrate.com/vex/${randomUUID()}`,author:t.author,timestamp:t.timestamp??new Date().toISOString(),version:1,statements:e}}async function mr(t){let e=await b$1(t),n=Array.isArray(e)?e:e&&typeof e=="object"&&Array.isArray(e.statements)?e.statements:null;if(!n)throw new X(`${t}: expected a JSON array of statements or an object with a "statements" array.`);return n}function hr(t,e){let n;try{n=JSON.parse(t);}catch{throw new X(`--statement must be a JSON object: ${t.slice(0,60)}\u2026`)}return [...e,n]}var Pn=new Command("vex").description("Generate an OpenVEX document (exploitability statements) for attestation").option("--from <file>",'Read statements from a JSON file (array, or an object with a "statements" array)').option("--statement <json>",`Add a statement as inline JSON, e.g. '{"vulnerability":"CVE-2024-1","status":"not_affected","justification":"vulnerable_code_not_present"}'. Repeatable.`,hr,[]).option("--product <ref>","Default product reference applied to statements without their own (e.g. an image digest)").option("--author <name>","Document author","Vibgrate").option("--timestamp <iso>","Override the document timestamp (ISO 8601) for reproducible output").option("--id <uri>","Override the document @id (otherwise a uuid URN is generated)").option("--out <file>","Write the document to a file (default: stdout)").action(async t=>{try{let e$1=[];if(t.from){let r=S.resolve(t.from);await c(r)||(process.stderr.write(l.red(`Statements file not found: ${r}
-`)),process.exit(1)),e$1.push(...await mr(r));}e$1.push(...t.statement);let n=fr({author:t.author,defaultProduct:t.product,timestamp:t.timestamp,id:t.id,statements:e$1}),o=JSON.stringify(n,null,2);t.out?(await e(S.resolve(t.out),o+`
-`),process.stderr.write(l.green("\u2714")+` Wrote OpenVEX document (${n.statements.length} statement(s)) to ${S.resolve(t.out)}
-`)):process.stdout.write(o+`
-`);}catch(e){throw e instanceof X&&(process.stderr.write(l.red(`VEX validation error: ${e.message}
-`)),process.exit(1)),e}});function jn(t){let e=[];for(let n of t.projects)for(let o of n.dependencies)e.push({project:n.name,package:o.package,version:o.resolvedVersion??o.currentSpec,currentSpec:o.currentSpec,drift:o.drift,majorsBehind:o.majorsBehind});return e}function br(t){let e=jn(t);return {bomFormat:"CycloneDX",specVersion:"1.5",serialNumber:`urn:uuid:${randomUUID()}`,version:1,metadata:{timestamp:t.timestamp,tools:[{vendor:"Vibgrate",name:"@vibgrate/cli",version:t.vibgrateVersion}],component:{type:"application",name:t.rootPath}},components:e.map(n=>({type:"library",name:n.package,version:n.version,properties:[{name:"vibgrate:project",value:n.project},{name:"vibgrate:currentSpec",value:n.currentSpec},{name:"vibgrate:drift",value:n.drift},{name:"vibgrate:majorsBehind",value:String(n.majorsBehind??"unknown")}]}))}}function yr(t){let e=jn(t);return {spdxVersion:"SPDX-2.3",dataLicense:"CC0-1.0",SPDXID:"SPDXRef-DOCUMENT",name:`${t.rootPath}-sbom`,documentNamespace:`https://vibgrate.com/spdx/${t.rootPath}/${randomUUID()}`,creationInfo:{created:t.timestamp,creators:[`Tool: @vibgrate/cli-${t.vibgrateVersion}`]},packages:e.map((n,o)=>({name:n.package,SPDXID:`SPDXRef-Package-${o+1}`,versionInfo:n.version,downloadLocation:"NOASSERTION",filesAnalyzed:false,externalRefs:[{referenceCategory:"PACKAGE-MANAGER",referenceType:"purl",referenceLocator:`pkg:npm/${encodeURIComponent(n.package)}@${encodeURIComponent(n.version)}`}],annotations:[{annotationType:"OTHER",annotator:"Tool: @vibgrate/cli",annotationDate:t.timestamp,comment:`project=${n.project}; drift=${n.drift}; majorsBehind=${n.majorsBehind??"unknown"}`}]}))}}function Cn(t){let e=new Map;for(let n of t.projects)for(let o of n.dependencies)e.set(`${n.name}:${o.package}`,o);return e}function wr(t,e){let n=Cn(t),o=Cn(e),r=[],a=[],s=[];for(let[c,p]of o.entries()){if(!n.has(c)){r.push(`${c} @ ${p.resolvedVersion??p.currentSpec}`);continue}let g=n.get(c),m=g.resolvedVersion??g.currentSpec,u=p.resolvedVersion??p.currentSpec;(m!==u||g.majorsBehind!==p.majorsBehind)&&s.push(`${c} ${m} -> ${u} (majorsBehind ${g.majorsBehind??"unknown"} -> ${p.majorsBehind??"unknown"})`);}for(let[c,p]of n.entries())o.has(c)||a.push(`${c} @ ${p.resolvedVersion??p.currentSpec}`);return ["Vibgrate SBOM Delta","===================",`Baseline: ${t.timestamp}`,`Current:  ${e.timestamp}`,`Drift score delta: ${(e.drift.score-t.drift.score).toFixed(2)} points`,"",`Added dependencies (${r.length})`,...r.map(c=>`  + ${c}`),"",`Removed dependencies (${a.length})`,...a.map(c=>`  - ${c}`),"",`Changed dependencies (${s.length})`,...s.map(c=>`  * ${c}`)].join(`
-`)}async function st(t){let e=S.resolve(t);return await c(e)||(console.error(l.red(`Artifact not found: ${e}`)),process.exit(1)),b$1(e)}var vr=new Command("export").description("Export scan artifact as SBOM").option("--in <file>","Input artifact file",".vibgrate/scan_result.json").option("--out <file>","Output SBOM file").option("--format <format>","SBOM format (cyclonedx|spdx)","cyclonedx").action(async t=>{let e$1=await st(t.in),n=t.format.toLowerCase();n!=="cyclonedx"&&n!=="spdx"&&(console.error(l.red("Invalid SBOM format. Use cyclonedx or spdx.")),process.exit(1));let o=n==="cyclonedx"?br(e$1):yr(e$1),r=JSON.stringify(o,null,2);t.out?(await e(S.resolve(t.out),r),console.log(l.green("\u2714")+` SBOM written to ${t.out}`)):console.log(r);}),$r=new Command("delta").description("Show SBOM delta between two scan artifacts").requiredOption("--from <file>","Baseline scan artifact path").requiredOption("--to <file>","Current scan artifact path").option("--out <file>","Write report to file").action(async t=>{let e$1=await st(t.from),n=await st(t.to),o=wr(e$1,n);t.out?(await e(S.resolve(t.out),o),console.log(l.green("\u2714")+` SBOM delta report written to ${t.out}`)):console.log(o);}),Rn=new Command("sbom").description("Supply-chain evidence: SBOM export/delta and OpenVEX generation").addCommand(vr).addCommand($r).addCommand(Pn);var xr=new URL("../../../../vibgrate-hcs/wasm/pkg/vibgrate_hcs_wasm.js",import.meta.url),at=fileURLToPath(xr);function Pr(){return existsSync(at)}async function Cr(){if(!Pr())throw new Error(`WASM engine not built. Run \`pnpm --filter @vibgrate/hcs build\` first.
-Expected: ${at}`);return await import(at)}async function En(t,e){let o=(await Cr()).derive_behavioural_facts_from_lines(JSON.stringify(t),JSON.stringify(e));return Ir(o)}function Ir(t){let e=JSON.parse(t),n=e.filter(s=>s.factType==="BehaviouralAssertion").length,r=e.find(s=>s.factType==="BehaviouralSpec")?.payload,a=r?.coverage;return {envelopes:e,summary:{assertions:n,surfaceFacts:Number(a?.surfaceFacts??0),assertedFacts:Number(a?.assertedFacts??0),behaviouralConfidence:Number(r?.behaviouralConfidence??0)}}}async function An(t){try{return await jr(t)}catch{return {type:"unknown"}}}async function jr(t){let e=await Rr(t);if(!e)return {type:"unknown"};let n=S.join(e,"HEAD"),o;try{o=(await K.readFile(n,"utf8")).trim();}catch{return {type:"unknown"}}let r,a;if(o.startsWith("ref: ")){let i=o.slice(5);a=i.startsWith("refs/heads/")?i.slice(11):i,r=await Er(e,i);}else /^[0-9a-f]{40}$/i.test(o)&&(r=o);let s=await Ar(e);return {type:"git",sha:r??void 0,shortSha:r?r.slice(0,7):void 0,branch:a??void 0,remoteUrl:s}}async function Rr(t){let e=S.resolve(t),n=S.parse(e).root;for(;e!==n;){let o=S.join(e,".git");try{let r=await K.stat(o);if(r.isDirectory())return o;if(r.isFile()){let a=(await K.readFile(o,"utf8")).trim();if(a.startsWith("gitdir: "))return S.resolve(e,a.slice(8))}}catch{}e=S.dirname(e);}return null}async function Er(t,e){let n=S.join(t,e);try{let r=(await K.readFile(n,"utf8")).trim();if(/^[0-9a-f]{40}$/i.test(r))return r}catch{}let o=S.join(t,"packed-refs");try{let r=await K.readFile(o,"utf8");for(let a of r.split(`
-`)){if(a.startsWith("#")||a.startsWith("^"))continue;let s=a.trim().split(" ");if(s.length>=2&&s[1]===e)return s[0]}}catch{}}async function Ar(t){let e=await Dr(t);if(e)try{let o=(await K.readFile(e,"utf8")).match(/\[remote\s+"origin"\]([\s\S]*?)(?=\n\[|$)/);return o?o[1]?.match(/\n\s*url\s*=\s*(.+)\s*/)?.[1]?.trim():void 0}catch{return}}async function Dr(t){let e=S.join(t,"config");try{if((await K.stat(e)).isFile())return e}catch{}let n=S.join(t,"commondir");try{let o=(await K.readFile(n,"utf8")).trim();if(!o)return;let r=S.resolve(t,o),a=S.join(r,"config");if((await K.stat(a)).isFile())return a}catch{return}}var _n=/^[A-Za-z0-9._-]+@[A-Za-z0-9._-]+:.+$/;function lt(t){return t?!!(/^(https?|ssh|git):\/\//i.test(t)||_n.test(t)):false}function He(t){if(!t||_n.test(t)&&!t.includes("://"))return t;try{let e=new URL(t);return (e.username||e.password)&&(e.username="",e.password=""),e.toString()}catch{return t.replace(/^([a-z]+:\/\/)[^/@]+@/i,"$1")}}var L=class extends Error{constructor(e){super(e),this.name="CloneError";}};function Fr(){let t=spawnSync("git",["--version"],{stdio:"ignore"});return !t.error&&t.status===0}function Mr(){switch(process.platform){case "darwin":return "Install git with: brew install git (or xcode-select --install).";case "win32":return "Install git with: winget install Git.Git";default:return "Install git via your distro package manager (e.g. apt install git)."}}function ct(t,e){return new Promise((n,o)=>{let r=spawn("git",t,{stdio:["ignore","ignore","pipe"],env:{...process.env,GIT_TERMINAL_PROMPT:"0",GIT_ASKPASS:"echo"}}),a="",s=false,i=setTimeout(()=>{s=true,r.kill("SIGKILL");},e.timeoutMs);r.stderr.on("data",c=>{a.length<8192&&(a+=Lr(String(c)));}),r.on("error",c=>{clearTimeout(i),o(new L(`Failed to run git: ${c.message}`));}),r.on("close",c=>{if(clearTimeout(i),s){o(new L(`git clone timed out for ${e.redacted}`));return}n({code:c??0,stderr:a.trim()});});})}function Lr(t){return t.replace(/([a-z]+:\/\/)[^/\s@]+@/gi,"$1")}async function Nn(t,e){let n=He(t);if(!lt(t))throw new L(`Not a supported repository URL: ${n}. Use an http(s), ssh, git://, or scp-like (git@host:owner/repo.git) URL.`);if(/^file:\/\//i.test(t))throw new L("file:// URLs are not allowed for remote clone.");if(!Fr())throw new L(`git is required to clone ${n} but was not found on PATH. ${Mr()}`);let o=await mkdtemp(S.join(Ut.tmpdir(),"vibgrate-hcs-clone-")),r=async()=>{await rm(o,{recursive:true,force:true}).catch(()=>{});};try{e.verbose&&process.stderr.write(`Cloning ${n} \u2026
-`);let a=await ct(["clone","--depth","1","--quiet","--",t,o],{timeoutMs:e.timeoutMs,redacted:n});if(a.code!==0)throw new L(`git clone failed for ${n}: ${a.stderr||`exit ${a.code}`}`);if(e.ref){e.verbose&&process.stderr.write(`Checking out ${e.ref} \u2026
-`);let i=(await ct(["-C",o,"fetch","--depth","1","--quiet","origin",e.ref],{timeoutMs:e.timeoutMs,redacted:n})).code===0?"FETCH_HEAD":e.ref,c=await ct(["-C",o,"checkout","--quiet","--detach",i],{timeoutMs:e.timeoutMs,redacted:n});if(c.code!==0)throw new L(`Could not check out ref "${e.ref}" from ${n}: ${c.stderr||`exit ${c.code}`}`)}return {dir:o,cleanup:r}}catch(a){throw await r(),a instanceof L?a:new L(String(a))}}function Br(t){let e=Ne.createHash("sha256");for(let n of t)e.update(n),e.update(`
-`);return `sha256:${e.digest("hex")}`}function dt(t){if(!t)return;let o=t.replace(/^[a-z]+:\/\//i,"").replace(/^[^/@]+@/,"").replace(/^[^/:]+[/:]/,"").split("/").filter(Boolean);if(o.length===0)return;let r=o[o.length-1].replace(/\.git$/i,""),a=o.length>=2?o[o.length-2]:void 0;return a?`${a}/${r}`:r}function Fn(t){return {factType:"ScanManifest",manifestVersion:"1.0",emittedAt:t.emittedAt??new Date().toISOString(),repository:{remoteUrl:t.remoteUrl,name:t.repositoryName??dt(t.remoteUrl)},vcs:{sha:t.sha,shortSha:t.shortSha,branch:t.branch,ref:t.ref},source:t.source,languages:[...t.languages].sort(),scanId:t.scanId,applicationId:t.applicationId,vibgrateVersion:t.vibgrateVersion,factCount:t.factLines.length,contentHash:Br(t.factLines)}}var Mn=0,Gr=1,Ee=2,Ae=3,Wr=4,F=5,Hn={typescript:new Set([".ts",".tsx",".mts",".cts"]),javascript:new Set([".js",".jsx",".mjs",".cjs"]),swift:new Set([".swift"]),rust:new Set([".rs"]),ruby:new Set([".rb",".rake",".gemspec"]),php:new Set([".php"]),dart:new Set([".dart"]),scala:new Set([".scala",".sc"]),cobol:new Set([".cbl",".cob",".cpy",".cob85",".cobol"]),vb6:new Set([".vbp",".bas",".cls",".frm",".ctl",".dsr"]),go:new Set([".go"]),python:new Set([".py"]),java:new Set([".java"]),csharp:new Set([".cs"]),cplusplus:new Set([".cpp",".cc",".cxx",".hpp",".hh",".hxx",".h",".ixx",".vcxproj"]),vbnet:new Set([".vb"])},Ln=new Set(Object.keys(Hn)),Jr=new Set(["node_modules",".git",".vibgrate",".hg",".svn","dist","build","out",".next",".nuxt",".output","bin","obj",".vs","target","vendor",".dart_tool",".build","DerivedData","Pods",".swiftpm","Carthage",".cargo",".pub-cache",".bloop",".metals",".idea","coverage","TestResults","__pycache__",".tox",".mypy_cache"]),Xr=[/[/\\]test[/\\]/i,/[/\\]tests[/\\]/i,/[/\\]__tests__[/\\]/i,/[/\\]spec[/\\]/i,/\.spec\./i,/\.test\./i,/[/\\]test-/i];function Kr(t){return Xr.some(e=>e.test(t))}function zr(t){let e=t.trim().toLowerCase();return e==="vb.net"||e==="visualbasic"||e==="visual-basic"?"vbnet":e}async function qr(t,e){let n=new Map;async function o(r,a){let s;try{s=await K.readdir(r,{withFileTypes:!0});}catch{return}for(let i of s){if(i.name.startsWith("."))continue;let c=S.join(r,i.name),p=S.join(a,i.name);if(i.isDirectory()){Jr.has(i.name)||await o(c,p);continue}if(!i.isFile()||!e&&Kr(p))continue;let g=S.extname(i.name).toLowerCase();for(let[m,u]of Object.entries(Hn))if(u.has(g)){n.set(m,(n.get(m)??0)+1);break}}}return await o(t,""),Array.from(n.entries()).map(([r,a])=>({language:r,fileCount:a})).sort((r,a)=>a.fileCount-r.fileCount)}function pt(t){let e;try{e=JSON.parse(t);}catch{return {valid:false,error:`Invalid JSON: ${t.substring(0,80)}...`}}let n=e;return n.factType==="Models"||n.factType==="References"?n.payload===void 0||n.payload===null?{valid:false,error:`Preamble ${n.factType} missing payload`}:{valid:true}:n.factType==="ScanManifest"?typeof n.manifestVersion!="string"?{valid:false,error:"ScanManifest missing manifestVersion"}:typeof n.emittedAt!="string"?{valid:false,error:"ScanManifest missing emittedAt"}:{valid:true}:typeof n.factId!="string"||!n.factId?{valid:false,error:"Missing or invalid factId"}:typeof n.m=="string"?n.payload===void 0||n.payload===null?{valid:false,error:"Compressed fact missing payload"}:{valid:true}:typeof n.factType!="string"||!n.factType?{valid:false,error:"Missing or invalid factType"}:typeof n.language!="string"?{valid:false,error:"Missing or invalid language"}:typeof n.scanner!="string"?{valid:false,error:"Missing or invalid scanner"}:typeof n.scannerVersion!="string"?{valid:false,error:"Missing or invalid scannerVersion"}:typeof n.emittedAt!="string"?{valid:false,error:"Missing or invalid emittedAt"}:n.payload===void 0||n.payload===null?{valid:false,error:"Missing payload"}:{valid:true}}function Yr(t){let e=[],n=[];for(let o of t){let r;try{r=JSON.parse(o);}catch{n.push(o);continue}let a=r;a.factType==="Models"||a.factType==="References"||a.factType==="ScanManifest"?e.push(o):n.push(o);}return {preamble:e,facts:n}}function Qr(){let t=import.meta.dirname??S.dirname(new URL(import.meta.url).pathname),e=S.resolve(t,"..","dist","hcs-worker.js");if(existsSync(e))return e;let n=S.resolve(t,"hcs-worker.js");if(existsSync(n))return n;try{let a=import.meta.resolve("@vibgrate/hcs-node-worker"),s=a.startsWith("file://")?new URL(a).pathname:a;if(existsSync(s))return s}catch{}let o=S.resolve(t,"..","..","..","vibgrate-hcs","node","dist","main.js");if(existsSync(o))return o;let r=S.resolve(t,"..","..","..","vibgrate-hcs","node","src","main.ts");if(existsSync(r))return r;throw new Error('Cannot locate HCS worker. Run "pnpm build" in the CLI package to bundle the worker into dist/.')}var Gn=new Set(["typescript","javascript"]),Zr=new Set(["swift","vb6","rust","ruby","php","dart","scala","cobol","cplusplus"]),Wn=new Set([...Gn,...Zr]),es=new Set(["go","python","java","csharp","vbnet"]),Bn=new Set([...Wn,...es]),Jn={go:{command:"go",displayName:"Go toolchain",installGuideByPlatform:{darwin:"brew install go",linux:"Install Go 1.22+ from https://go.dev/dl/ or your distro package manager.",win32:"winget install GoLang.Go"},docsUrl:"https://go.dev/doc/install"},python:{command:"python3",displayName:"Python 3 runtime",installGuideByPlatform:{darwin:"brew install python",linux:"Install Python 3.10+ from your distro package manager (apt/dnf/pacman).",win32:"winget install Python.Python.3.12"},docsUrl:"https://www.python.org/downloads/"},java:{command:"java",displayName:"Java 17+ runtime",installGuideByPlatform:{darwin:"brew install --cask temurin",linux:"Install OpenJDK 17+ (for example: apt install openjdk-17-jre).",win32:"winget install EclipseAdoptium.Temurin.17.JRE"},docsUrl:"https://adoptium.net/"},csharp:{command:"dotnet",displayName:".NET SDK/runtime",installGuideByPlatform:{darwin:"brew install --cask dotnet-sdk",linux:"Install .NET 8 SDK/runtime from https://dotnet.microsoft.com/download.",win32:"winget install Microsoft.DotNet.SDK.8"},docsUrl:"https://dotnet.microsoft.com/download"},vbnet:{command:"dotnet",displayName:".NET SDK/runtime",installGuideByPlatform:{darwin:"brew install --cask dotnet-sdk",linux:"Install .NET 8 SDK/runtime from https://dotnet.microsoft.com/download.",win32:"winget install Microsoft.DotNet.SDK.8"},docsUrl:"https://dotnet.microsoft.com/download"}};function ts(t){let e=process.platform==="win32"?["/c",t,"--version"]:["--version"],n=process.platform==="win32"?"cmd":t,o=spawnSync(n,e,{stdio:"ignore"});return !o.error&&o.status===0}function ut(t){let e=Jn[t];return e?`${e.installGuideByPlatform[process.platform]??`Install ${e.displayName} and ensure '${e.command}' is available on PATH.`} More details: ${e.docsUrl}`:"See HCS runtime setup docs for prerequisites: https://vibgrate.com/help"}async function ns(t,e,n){let o=Qr(),r=[];if(Gn.has(e))r.push("--project",t);else {r.push("--project",t);let a=`--${e}-project`;r.push(a,t),e==="cobol"&&n.copybookPaths&&r.push("--cobol-copybook-paths",n.copybookPaths);}return new Promise(a=>{let s=[],i=[],c="",p=false,g=spawn("node",["--enable-source-maps",o,...r],{cwd:t,stdio:["ignore","pipe","pipe"],env:{...process.env,NODE_OPTIONS:"--max-old-space-size=4096"}}),m=setTimeout(()=>{p=true,g.kill("SIGKILL");},n.timeoutMs);g.stdout.on("data",u=>{c+=u.toString();let f=c.split(`
-`);c=f.pop();for(let v of f){let $=v.trim();$&&s.push($);}}),g.stderr.on("data",u=>{let f=u.toString();for(let v of f.split(`
-`)){let $=v.trim();if($){if($.startsWith("[progress] ")){try{let k=JSON.parse($.slice(11));n.onProgress?.(k);}catch{}continue}n.verbose&&process.stderr.write(l.dim(`[${e}] ${$}
-`)),$.startsWith("[error]")&&i.push($);}}}),g.on("close",u=>{clearTimeout(m),c.trim()&&s.push(c.trim()),a(p?{language:e,facts:s,errors:["Worker killed: timeout exceeded"],exitCode:Ae}:{language:e,facts:s,errors:i,exitCode:u??0});}),g.on("error",u=>{clearTimeout(m),i.push(`Failed to spawn worker: ${u.message}`),a({language:e,facts:s,errors:i,exitCode:Ee});});})}function os(t){let n={win32:["hcs-worker-win-x64.exe"],linux:["hcs-worker-linux-x64"],darwin:["hcs-worker-osx-arm64","hcs-worker-osx-x64"],aix:[],android:[],freebsd:[],haiku:[],openbsd:[],cygwin:[],netbsd:[],sunos:[]}[process.platform]??[];for(let o of n){let r=S.join(t,o);if(existsSync(r))return r}return null}function rs(t,e){let n=import.meta.dirname??S.dirname(new URL(import.meta.url).pathname),o=S.resolve(n,"..","..","vibgrate-hcs"),r=S.resolve(n,"..","..","..","vibgrate-hcs"),a=existsSync(o)?o:r,s=S.resolve(n,"workers");switch(t){case "go":{let i=S.join(s,process.platform==="win32"?"vibgrate-hcs-go.exe":"vibgrate-hcs-go");if(existsSync(i))return {cmd:i,args:["--project",e,"--output","ndjson"]};let c=S.join(a,"go");return existsSync(S.join(c,"main.go"))?{cmd:"go",args:["run",".","--project",e,"--output","ndjson"],cwd:c}:null}case "python":{let i=S.join(s,"vibgrate-hcs-python");if(existsSync(i))return {cmd:i,args:["--project",e,"--output","ndjson"]};let c=S.join(a,"python");return existsSync(S.join(c,"pyproject.toml"))?{cmd:"python3",args:["-m","vibgrate_hcs_python.main","--project",e,"--output","ndjson"],cwd:c}:null}case "java":{let i=S.join(s,"vibgrate-hcs-jvm.jar");if(existsSync(i))return {cmd:"java",args:["-jar",i,"--project",e,"--output","ndjson"]};let c=S.join(a,"jvm");if(existsSync(S.join(c,"build.gradle.kts"))){let p=S.join(c,process.platform==="win32"?"gradlew.bat":"gradlew");return {cmd:existsSync(p)?p:"gradle",args:["-q","--console=plain","run",`--args=--project ${e} --output ndjson`],cwd:c}}return null}case "csharp":case "vbnet":{let i=os(s);if(i)return {cmd:i,args:["--project",e,"--output","ndjson"]};let c=S.join(s,"VibgrateHcsWorker.dll");if(existsSync(c))return {cmd:"dotnet",args:[c,"--project",e,"--output","ndjson"]};let p=S.join(a,"dotnet","src","VibgrateHcsWorker","VibgrateHcsWorker.csproj");return existsSync(p)?{cmd:"dotnet",args:["run","--project",p,"--","--project",e,"--output","ndjson"]}:null}default:return null}}async function ss(t,e,n){let o=rs(e,t);return o?new Promise(r=>{let a=[],s=[],i="",c=false;n.verbose&&process.stderr.write(l.dim(`[${e}] Spawning: ${o.cmd} ${o.args.join(" ")}
-`));let p=Jn[e];if(p&&o.cmd===p.command&&!ts(o.cmd)){r({language:e,facts:[],errors:[`[error] Required runtime command '${o.cmd}' is not available on PATH.`,`[hint] ${ut(e)}`,"[hint] You can also package native workers into dist/workers to avoid local toolchain requirements."],exitCode:Ee});return}let m=spawn(o.cmd,o.args,{cwd:o.cwd??t,stdio:["ignore","pipe","pipe"]}),u=setTimeout(()=>{c=true,m.kill("SIGKILL");},n.timeoutMs);m.stdout.on("data",f=>{i+=f.toString();let v=i.split(`
-`);i=v.pop();for(let $ of v){let k=$.trim();k&&a.push(k);}}),m.stderr.on("data",f=>{let v=f.toString();for(let $ of v.split(`
-`)){let k=$.trim();k&&(n.verbose&&process.stderr.write(l.dim(`[${e}] ${k}
-`)),k.startsWith("[error]")&&s.push(k));}}),m.on("close",f=>{clearTimeout(u),i.trim()&&a.push(i.trim()),r(c?{language:e,facts:a,errors:["Worker killed: timeout exceeded"],exitCode:Ae}:{language:e,facts:a,errors:s,exitCode:f??0});}),m.on("error",f=>{clearTimeout(u);let v=f.code==="ENOENT";s.push(v?`[error] '${o.cmd}' not found. ${ut(e)}`:`[error] Failed to spawn native worker: ${f.message}`),r({language:e,facts:a,errors:s,exitCode:Ee});});}):{language:e,facts:[],errors:[`[error] No native worker found for '${e}'. Build/package workers for this platform or use source mode.`,`[hint] ${ut(e)}`],exitCode:Ee}}async function is(t,e,n){let o=Le(e);if(!o)return process.stderr.write(l.red(`Invalid DSN format.
-`)),process.stderr.write(l.dim(`Expected: vibgrate+https://<key_id>:<secret>@<host>/<workspace_id>
-`)),false;let r=t.join(`
-`)+`
-`,a=`${o.scheme}://${o.host}/v1/ingest/hcs`;n&&process.stderr.write(l.dim(`Pushing ${t.length} facts to ${o.host}...
-`));try{let s=gn(r,o.secret),i=await fetch(a,{method:"POST",headers:{"Content-Type":"application/x-ndjson","X-Vibgrate-Key":o.keyId,"X-Vibgrate-Workspace":o.workspaceId,"X-Vibgrate-Signature":s,Connection:"close"},body:r});if(!i.ok){let c=await i.text().catch(()=>"");return process.stderr.write(l.red(`Push failed: HTTP ${i.status} ${c}
-`)),!1}return n&&process.stderr.write(l.green(`\u2714 Pushed ${t.length} facts successfully
-`)),!0}catch(s){return process.stderr.write(l.red(`Push failed: ${s instanceof Error?s.message:String(s)}
-`)),false}}async function as(t){let n=(await K.readFile(t,"utf-8")).split(`
-`).filter(o=>o.trim());for(let o of n)try{JSON.parse(o);}catch{throw new Error(`Invalid NDJSON in feedback file at: ${o.substring(0,60)}...`)}return n}var gt=class{constructor(e){this.languages=e;this.isTTY=process.stderr.isTTY??false;for(let n of e)this.langStatus.set(n,{phase:"waiting",fileIndex:0,fileCount:0,done:false,factCount:0});}isTTY;langStatus=new Map;totalFacts=0;lastRender=0;throttleMs=80;lastLineLen=0;onProgress(e,n){let o=this.langStatus.get(e);o&&(o.phase=n.phase,n.fileCount!==void 0&&(o.fileCount=n.fileCount),n.fileIndex!==void 0&&(o.fileIndex=n.fileIndex),n.file&&(o.file=n.file),n.phase==="done"&&(o.done=true),this.render());}onFact(){this.totalFacts++,this.render();}setLanguageFactCount(e,n){let o=this.langStatus.get(e);o&&(o.factCount=n);}render(){let e=Date.now();if(e-this.lastRender<this.throttleMs||(this.lastRender=e,!this.isTTY))return;let n=[];for(let[a,s]of this.langStatus)if(s.done)n.push(l.green(`${a} \u2713`));else if(s.phase==="waiting")n.push(l.dim(`${a} \xB7`));else if(s.phase==="discovering")n.push(l.yellow(`${a} \u2026`));else if(s.phase==="scanning"&&s.fileCount>0){let i=Math.round(s.fileIndex/s.fileCount*100);n.push(l.cyan(`${a} ${s.fileIndex}/${s.fileCount} ${i}%`));}else s.phase==="extracting"?n.push(l.cyan(`${a} extracting`)):n.push(l.dim(`${a} ${s.phase}`));let o=`  ${n.join("  ")}  ${l.dim(`${this.totalFacts} facts`)}`,r=Math.max(0,this.lastLineLen-o.length);process.stderr.write(`\r${o}${" ".repeat(r)}`),this.lastLineLen=o.length;}finish(e){this.isTTY&&process.stderr.write(`\r${" ".repeat(this.lastLineLen)}\r`);}},Xn=new Command("extract").description("Analyze source code and emit validated HCS facts (NDJSON)").argument("[path-or-url]","Path to source directory, or a public repository URL to clone",".").option("--repo-url <url>","Public repository URL to clone and analyze (alternative to passing a URL positionally)").option("--ref <ref>","Branch, tag, or commit SHA to check out when cloning a repository URL").option("--keep-clone","Do not delete the temporary clone after extraction (prints its path)").option("--clone-timeout-mins <mins>","Clone/fetch timeout in minutes","10").option("-o, --out <file>","Write NDJSON to file (default: stdout)").option("--language <langs>","Comma-separated languages to analyze (default: auto-detect)").option("--include-tests","Include test files in analysis").option("--push","Stream validated facts to dashboard API").option("--dsn <dsn>","DSN token for push (or use VIBGRATE_DSN env)").option("--concurrency <n>","Number of parallel file workers").option("--timeout-mins <mins>","Total analysis timeout in minutes","60").option("--feedback <file>","Load NDJSON diff artifact for refinement").option("--derive","Derive behavioural spec facts (BehaviouralAssertion/BehaviouralSpec) from extracted facts").option("--scan-id <id>",'Scan id for the derived BehaviouralSpec (default: "local")').option("--application-id <id>","Application id for the derived BehaviouralSpec (default: directory name)").option("--verbose","Print worker stderr and summary statistics").action(async(t,e)=>{let n=e.repoUrl??(lt(t)?t:void 0),o=n?"url":"local",r,a;if(n){let b=parseInt(e.cloneTimeoutMins,10);(isNaN(b)||b<1)&&(process.stderr.write(l.red(`--clone-timeout-mins must be >= 1
-`)),process.exit(F)),a=He(n);try{let C=await Nn(n,{ref:e.ref,timeoutMs:b*60*1e3,verbose:e.verbose??!1});r=C.dir,e.keepClone?process.stderr.write(l.dim(`Clone retained at: ${C.dir}
-`)):process.once("exit",()=>{try{rmSync(C.dir,{recursive:!0,force:!0});}catch{}});}catch(C){let Q=C instanceof L||C instanceof Error?C.message:String(C);process.stderr.write(l.red(`Clone failed: ${Q}
-`)),process.exit(F);}}else {r=S.resolve(t),await c(r)||(process.stderr.write(l.red(`Path does not exist: ${r}
-`)),process.exit(F));let b;try{b=await K.stat(r);}catch{process.stderr.write(l.red(`Cannot read path: ${r}
-`)),process.exit(F);}b.isDirectory()||(process.stderr.write(l.red(`Path must be a directory: ${r}
-`)),process.exit(F));}let s=e.dsn||process.env.VIBGRATE_DSN;e.push&&!s&&(process.stderr.write(l.red(`--push requires --dsn or VIBGRATE_DSN environment variable
-`)),process.exit(F)),s&&!Le(s)&&(process.stderr.write(l.red(`Invalid DSN format.
-`)),process.stderr.write(l.dim(`Expected: vibgrate+https://<key_id>:<secret>@<host>/<workspace_id>
-`)),process.exit(F));let i=e.concurrency?parseInt(e.concurrency,10):Ut.cpus().length;(isNaN(i)||i<1)&&(process.stderr.write(l.red(`--concurrency must be >= 1
-`)),process.exit(F));let c$1=parseInt(e.timeoutMins,10);(isNaN(c$1)||c$1<1)&&(process.stderr.write(l.red(`--timeout-mins must be >= 1
-`)),process.exit(F));let p=c$1*60*1e3;if(e.out){let b=S.dirname(S.resolve(e.out));await c(b)||(process.stderr.write(l.red(`Output directory does not exist: ${b}
-`)),process.exit(F));try{(await K.stat(S.resolve(e.out))).isDirectory()&&(process.stderr.write(l.red(`--out cannot be a directory: ${e.out}
-`)),process.exit(F));}catch{}}let g;if(e.feedback){let b=S.resolve(e.feedback);await c(b)||(process.stderr.write(l.red(`Feedback file not found: ${b}
-`)),process.exit(F));try{g=await as(b);}catch(C){process.stderr.write(l.red(`Invalid feedback file: ${C instanceof Error?C.message:String(C)}
-`)),process.exit(F);}}let m;if(e.language){m=e.language.split(",").map(b=>zr(b)).filter(Boolean);for(let b of m)Ln.has(b)||(process.stderr.write(l.red(`Unknown language: "${b}"
-`)),process.stderr.write(l.dim(`Supported: ${[...Ln].sort().join(", ")}
-`)),process.exit(F));}else {let b=await qr(r,e.includeTests??false);if(b.length===0&&(process.stderr.write(l.yellow(`No supported source files detected.
-`)),process.exit(Mn)),m=b.map(C=>C.language),e.verbose){process.stderr.write(l.dim(`Detected languages:
-`));for(let C of b)process.stderr.write(l.dim(`  ${C.language}: ${C.fileCount} files
-`));}}let u=m.filter(b=>Bn.has(b)),f=m.filter(b=>!Bn.has(b));f.length>0&&e.verbose&&process.stderr.write(l.dim(`No worker registered for: ${f.join(", ")} \u2014 skipping.
-`)),u.length===0&&(process.stderr.write(l.yellow(`No languages with available HCS workers found.
-`)),process.exit(Mn));let v=Date.now(),$=v+p;process.stderr.write(l.bold(`Extracting HCS facts from ${r}
-`)+l.dim(`Languages: ${u.join(", ")}  Concurrency: ${i}  Timeout: ${c$1}m
-`));let k=new gt(u),w=new a$1(i),U=[],O=[],V=[],ce=[],ue=false,Te=false,$e=false,Ye=u.map(b=>w.run(async()=>{let C=$-Date.now();if(C<=0){$e=true;return}let Q=Wn.has(b)?await ns(r,b,{includeTests:e.includeTests??false,verbose:e.verbose??false,timeoutMs:C,onProgress:Z=>k.onProgress(b,Z)}):await ss(r,b,{verbose:e.verbose??false,timeoutMs:C});Q.exitCode===Ae&&($e=true);let{preamble:re,facts:Se}=Yr(Q.facts);U.push(...re),e.derive&&ce.push(...re,...Se);let ke=0;for(let Z of [...re,...Se]){let Qe=pt(Z);Qe.valid||(ue=true,V.push(`[${b}] Schema validation: ${Qe.error}`),e.verbose&&process.stderr.write(l.red(`[${b}] Invalid fact: ${Qe.error}
-`)));}for(let Z of Se)pt(Z).valid&&(O.push(Z),ke++,k.onFact());k.setLanguageFactCount(b,ke),Q.errors.length>0&&V.push(...Q.errors.map(Z=>`[${b}] ${Z}`)),Q.exitCode!==0&&Q.exitCode!==Ae&&(Te=true);}));await Promise.all(Ye);let _e=((Date.now()-v)/1e3).toFixed(1);if(k.finish(_e),e.derive){let b=e.scanId||"local",C=e.applicationId||S.basename(r),{envelopes:Q,summary:re}=await En(ce,{scanId:b,applicationId:C});for(let Se of Q){let ke=JSON.stringify(Se);pt(ke).valid?O.push(ke):(ue=true,V.push("[behavioural] derived fact failed schema validation"));}process.stderr.write(l.dim(`Derived ${re.assertions} behavioural assertion(s) \xB7 confidence ${re.behaviouralConfidence} (${re.assertedFacts}/${re.surfaceFacts} surface facts)
-`));}O.sort();let h=e.scanId||"local",I=e.applicationId||(o==="url"?dt(a):void 0)||S.basename(r),j;try{j=await An(r);}catch{j=void 0;}let x=Fn({remoteUrl:a??(j?.remoteUrl?He(j.remoteUrl):void 0),sha:j?.sha,shortSha:j?.shortSha,branch:j?.branch,ref:e.ref,source:o,languages:u,scanId:h,applicationId:I,vibgrateVersion:E,factLines:O}),q=[JSON.stringify(x),...U,...O],Y=q.join(`
-`)+(q.length>0?`
-`:"");if(e.out){let b=S.resolve(e.out);await K.writeFile(b,Y,"utf-8"),process.stderr.write(l.green(`\u2714 Wrote ${O.length} facts to ${b}
-`));}else process.stdout.write(Y);if(e.push&&s&&O.length>0&&(await is(q,s,e.verbose??false)||process.exit(Wr)),e.verbose){if(process.stderr.write(l.dim(`
-\u2500\u2500 Summary \u2500\u2500
-`)),process.stderr.write(l.dim(`  Facts emitted : ${O.length}
-`)),process.stderr.write(l.dim(`  Languages     : ${u.join(", ")}
-`)),process.stderr.write(l.dim(`  Elapsed       : ${_e}s
-`)),V.length>0){process.stderr.write(l.dim(`  Errors        : ${V.length}
-`));for(let b of V.slice(0,10))process.stderr.write(l.dim(`    ${b}
-`));V.length>10&&process.stderr.write(l.dim(`    ... and ${V.length-10} more
-`));}process.stderr.write(l.dim(`\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500
-
-`));}$e&&(process.stderr.write(l.red(`Timeout exceeded (${c$1} minutes)
-`)),process.exit(Ae)),ue&&(process.stderr.write(l.red(`Fact schema validation failures detected
-`)),process.exit(Gr)),Te&&(process.stderr.write(l.red(`Parsing failures detected
-`)),process.exit(Ee));});var ds=0,Ge=5,ps=new URL("../../../vibgrate-hcs/wasm/pkg/vibgrate_hcs_wasm.js",import.meta.url),Kn=fileURLToPath(ps);async function us(){return existsSync(Kn)?await import(Kn):null}var zn=new Command("digest").description('Render HCS NDJSON facts (from "hcs extract") into Markdown, JSON, or HTML').option("--in <file>","HCS NDJSON file to read (default: stdin)").option("-o, --out <file>","Write output to file (default: stdout)").option("--format <format>","Output format: md | json | html","md").option("--level <level>","Detail level: concise | full","concise").option("--title <title>","Override document title").action(async t=>{let e=["md","json","html"];e.includes(t.format)||(process.stderr.write(l.red(`--format must be one of: ${e.join(", ")}
-`)),process.exit(Ge));let n=["concise","full"];n.includes(t.level)||(process.stderr.write(l.red(`--level must be one of: ${n.join(", ")}
-`)),process.exit(Ge));let o=await us();o||(process.stderr.write(`vibgrate hcs digest requires the HCS WASM engine.
-Run: cd packages/vibgrate-hcs/wasm && ./build.sh
-`),process.exit(1));let r;if(t.in){let i=S.resolve(t.in);existsSync(i)||(process.stderr.write(l.red(`Input file not found: ${i}
-`)),process.exit(Ge)),r=await K.readFile(i,"utf-8");}else {let i=[];for await(let c of process.stdin)i.push(Buffer.isBuffer(c)?c:Buffer.from(c));r=Buffer.concat(i).toString("utf-8");}let a={format:t.format,level:t.level};t.title&&(a.title=t.title);let s;try{s=o.hcs_render_digest(r,JSON.stringify(a));}catch(i){process.stderr.write(l.red(`Digest rendering failed: ${i instanceof Error?i.message:String(i)}
-`)),process.exit(1);}if(t.out){let i=S.resolve(t.out),c=S.dirname(i);existsSync(c)||(process.stderr.write(l.red(`Output directory does not exist: ${c}
-`)),process.exit(Ge)),await K.writeFile(i,s,"utf-8"),process.stderr.write(l.green(`Wrote digest to ${i}
-`));}else process.stdout.write(s);process.exit(ds);});var ms=0,Je=5,qn=fileURLToPath(new URL("../../../vibgrate-hcs/wasm/pkg/vibgrate_hcs_wasm.js",import.meta.url));async function hs(){return existsSync(qn)?await import(qn):null}async function bs(t){if(t){let n=S.resolve(t);return existsSync(n)||(process.stderr.write(l.red(`Input file not found: ${n}
-`)),process.exit(Je)),K.readFile(n,"utf-8")}let e=[];for await(let n of process.stdin)e.push(Buffer.isBuffer(n)?n:Buffer.from(n));return Buffer.concat(e).toString("utf-8")}var mt=["json","md","mermaid"],ht=["integration","migration","governance"],Yn=new Command("map").description("Build the System Map (hcs-map/1.0) from HCS facts \u2014 routes, entities, auth, integrations, call-graph").option("--facts <file>","HCS NDJSON facts file to read (default: stdin)").option("-o, --out <file>","Write output to file (default: stdout)").option("--format <format>",`Output format: ${mt.join(" | ")}`,"json").option("--profile <profile>",`Consumer projection: ${ht.join(" | ")}`).option("--generated-at <iso>","Override generatedAt timestamp (for deterministic output)").action(async t=>{mt.includes(t.format)||(process.stderr.write(l.red(`--format must be one of: ${mt.join(", ")}
-`)),process.exit(Je)),t.profile&&!ht.includes(t.profile)&&(process.stderr.write(l.red(`--profile must be one of: ${ht.join(", ")}
-`)),process.exit(Je));let e=await hs();e||(process.stderr.write(`vibgrate hcs map requires the HCS WASM engine.
-Run: cd packages/vibgrate-hcs/wasm && ./build.sh
-`),process.exit(1));let n=await bs(t.facts),o={format:t.format,profile:t.profile,generatedAt:t.generatedAt??new Date().toISOString()},r;try{r=e.hcs_build_map(n,JSON.stringify(o));}catch(a){process.stderr.write(l.red(`Map build failed: ${a instanceof Error?a.message:String(a)}
-`)),process.exit(1);}if(t.out){let a=S.resolve(t.out);existsSync(S.dirname(a))||(process.stderr.write(l.red(`Output directory does not exist: ${S.dirname(a)}
-`)),process.exit(Je)),await K.writeFile(a,r+`
-`,"utf-8"),process.stderr.write(l.green(`Wrote System Map to ${a}
-`));}else process.stdout.write(r+`
-`);process.exit(ms);});var vs=0,$s=2,Ke=5,Qn=fileURLToPath(new URL("../../../vibgrate-hcs/wasm/pkg/vibgrate_hcs_wasm.js",import.meta.url));async function Ss(){return existsSync(Qn)?await import(Qn):null}async function ks(){let t=[];for await(let e of process.stdin)t.push(Buffer.isBuffer(e)?e:Buffer.from(e));return Buffer.concat(t).toString("utf-8")}async function yt(t,e){let n=S.resolve(t);return existsSync(n)||(process.stderr.write(l.red(`${e} file not found: ${n}
-`)),process.exit(Ke)),K.readFile(n,"utf-8")}var wt=["text","json","sarif"],Zn=new Command("gate").description("Continuous governance gate \u2014 diff two HCS fact streams and fail on material structural regressions").requiredOption("--baseline <file>",'Baseline HCS NDJSON facts file (the "before" stream)').option("--facts <file>",'Current HCS NDJSON facts file (the "after" stream; default: stdin)').option("--policy <file>","Gate policy JSON (.vibgrate/hcs-policy.json) \u2014 thresholds and disabled rules").option("-o, --out <file>","Write output to file (default: stdout)").option("--format <format>",`Output format: ${wt.join(" | ")}`,"text").action(async t=>{wt.includes(t.format)||(process.stderr.write(l.red(`--format must be one of: ${wt.join(", ")}
-`)),process.exit(Ke));let e=await Ss();e||(process.stderr.write(`vibgrate hcs gate requires the HCS WASM engine.
-Run: cd packages/vibgrate-hcs/wasm && ./build.sh
-`),process.exit(1));let n=await yt(t.baseline,"Baseline"),o=t.facts?await yt(t.facts,"Facts"):await ks(),r;if(t.policy){let i=await yt(t.policy,"Policy");try{r=JSON.parse(i);}catch(c){process.stderr.write(l.red(`Invalid policy JSON: ${c instanceof Error?c.message:String(c)}
-`)),process.exit(Ke);}}let a,s;try{let i=e.hcs_evaluate_gate(n,o,JSON.stringify({format:"json",policy:r}));a=JSON.parse(i).pass,s=t.format==="json"?i:e.hcs_evaluate_gate(n,o,JSON.stringify({format:t.format,policy:r}));}catch(i){process.stderr.write(l.red(`Gate evaluation failed: ${i instanceof Error?i.message:String(i)}
-`)),process.exit(1);}if(t.out){let i=S.resolve(t.out);existsSync(S.dirname(i))||(process.stderr.write(l.red(`Output directory does not exist: ${S.dirname(i)}
-`)),process.exit(Ke)),await K.writeFile(i,s+`
-`,"utf-8"),process.stderr.write((a?l.green:l.red)(`Gate ${a?"passed":"FAILED"} \u2014 wrote result to ${i}
-`));}else process.stdout.write(s+`
-`);process.exit(a?vs:$s);});var Cs=new URL("../../../../vibgrate-hcs/wasm/pkg/vibgrate_hcs_wasm.js",import.meta.url),$t=fileURLToPath(Cs);function St(){return existsSync($t)}async function Is(){if(!St())throw new Error(`WASM engine not built. Run \`pnpm --filter @vibgrate/hcs build\` first.
-Expected: ${$t}`);return await import($t)}var eo={SCHEMA_INVALID:1};async function to(t){let e=await Is();return JSON.parse(e.validate_lines_json(JSON.stringify(t)))}var ro=new Command("validate").description("Validate an HCS model (NDJSON) against the v0.5 spec (FR-VAL)").argument("<file>","Path to an HCS NDJSON model file (e.g. extract output)").option("--json","Emit the full ValidationReport as JSON on stdout").action(async(t,e)=>{St()||(process.stderr.write(l.red("HCS WASM engine not built. Run `pnpm --filter @vibgrate/hcs build` first.\n")),process.exit(1));let n=S.resolve(t);await c(n)||(process.stderr.write(l.red(`Model file not found: ${n}
-`)),process.exit(eo.SCHEMA_INVALID));let r=(await K.readFile(n,"utf-8")).split(`
-`).filter(s=>s.trim()),a=await to(r);if(e.json)process.stdout.write(JSON.stringify(a,null,2)+`
-`);else if(a.ok)process.stderr.write(l.green(`\u2714 Conformant \u2014 model satisfies the HCS v0.5 spec.
-`));else {process.stderr.write(l.red(`\u2718 ${a.errors.length} validation error(s) (exit ${a.exitCode}):
-`));for(let s of a.errors.slice(0,50))process.stderr.write(l.dim(`  [${s.code}] ${s.factId||"(model)"}: ${s.message}
-`));a.errors.length>50&&process.stderr.write(l.dim(`  \u2026 and ${a.errors.length-50} more
-`));}process.exit(a.exitCode);});var so=new Command("hcs").description("Holistic Code Specification \u2014 extract and render code facts").addCommand(Xn).addCommand(zn).addCommand(Yn).addCommand(Zn).addCommand(ro);var kt=2;var io=5,As=new Set(["ndjson","json","patch"]),ao=new Set([".git",".hg",".svn","node_modules",".vibgrate"]);async function co(t,e,n){let o=[];async function r(a,s){let i;try{i=await K.readdir(a,{withFileTypes:!0});}catch{return}for(let c of i){if(c.name.startsWith(".")&&ao.has(c.name))continue;let p=S.join(a,c.name),g=S.join(s,c.name);if(c.isDirectory()){ao.has(c.name)||await r(p,g);continue}c.isFile()&&(e&&e.length>0&&!lo(g,e)||n&&n.length>0&&lo(g,n)||o.push({relPath:g,absPath:p}));}}return await r(t,""),o}function lo(t,e){for(let n of e)if(Ds(t,n))return  true;return  false}function Ds(t,e){let n=e.replace(/[.+^${}()|[\]\\]/g,"\\$&").replace(/\*/g,".*");return new RegExp(n,"i").test(t)}function po(t,e,n,o){let r=o?t.map(g=>g.trim()):t,a=o?e.map(g=>g.trim()):e,s=Ts(r,a),i=0,c=0;for(let g of s)g.type==="insert"&&i++,g.type==="delete"&&c++;return {hunks:_s(t,e,s,n),insertions:i,deletions:c}}function Ts(t,e){let n=t.length,o=e.length;if(n===0&&o===0)return [];if(n===0)return e.map((c,p)=>({type:"insert",aIndex:0,bIndex:p}));if(o===0)return t.map((c,p)=>({type:"delete",aIndex:p,bIndex:0}));let r=Array.from({length:n+1},()=>new Array(o+1).fill(0));for(let c=1;c<=n;c++)for(let p=1;p<=o;p++)t[c-1]===e[p-1]?r[c][p]=r[c-1][p-1]+1:r[c][p]=Math.max(r[c-1][p],r[c][p-1]);let a=[],s=n,i=o;for(;s>0||i>0;)s>0&&i>0&&t[s-1]===e[i-1]?(a.unshift({type:"equal",aIndex:s-1,bIndex:i-1}),s--,i--):i>0&&(s===0||r[s][i-1]>=r[s-1][i])?(a.unshift({type:"insert",aIndex:s,bIndex:i-1}),i--):(a.unshift({type:"delete",aIndex:s-1,bIndex:i}),s--);return a}function _s(t,e,n,o){let r=[],a=null,s=-1;for(let i=0;i<n.length;i++){let c=n[i];if(c.type==="equal"){if(a&&i-s>o*2){for(let p=s+1;p<=Math.min(s+o,i);p++){let g=n[p];g&&g.type==="equal"&&(a.lines.push(` ${t[g.aIndex]??""}`),a.originalCount++,a.generatedCount++);}r.push(a),a=null;}continue}if(!a){let p=Math.max(0,i-o),g=n[p]?.aIndex??0,m=n[p]?.bIndex??0;a={originalStart:g+1,originalCount:0,generatedStart:m+1,generatedCount:0,lines:[]};for(let u=p;u<i;u++){let f=n[u];f&&f.type==="equal"&&(a.lines.push(` ${t[f.aIndex]??""}`),a.originalCount++,a.generatedCount++);}}c.type==="delete"?(a.lines.push(`-${t[c.aIndex]??""}`),a.originalCount++):c.type==="insert"&&(a.lines.push(`+${e[c.bIndex]??""}`),a.generatedCount++),s=i;}if(a){for(let i=s+1;i<Math.min(n.length,s+1+o);i++){let c=n[i];c&&c.type==="equal"&&(a.lines.push(` ${t[c.aIndex]??""}`),a.originalCount++,a.generatedCount++);}r.push(a);}return r}function Ns(t,e){if(t===e||t.length===0&&e.length===0)return 1;if(t.length===0||e.length===0)return 0;let n=t.split(`
-`),o=e.split(`
-`),r=n.length,a=o.length;if(r*a>1e6){let s=[...n.slice(0,100),...n.slice(-100)],i=[...o.slice(0,100),...o.slice(-100)];return uo(s,i)}return uo(n,o)}function uo(t,e){let n=t.length,o=e.length,r=Array.from({length:n+1},()=>new Array(o+1).fill(0));for(let s=1;s<=n;s++)for(let i=1;i<=o;i++)t[s-1]===e[i-1]?r[s][i]=r[s-1][i-1]+1:r[s][i]=Math.max(r[s-1][i],r[s][i-1]);return 2*r[n][o]/(n+o)}function qe(t,e){return `hcs:delta:${Ne.createHash("sha256").update(`${t}:${e}`).digest("hex").substring(0,16)}`}function Os(t){return t.map(e=>JSON.stringify(e)).join(`
-`)+(t.length>0?`
-`:"")}function Fs(t){return JSON.stringify({deltas:t,count:t.length},null,2)+`
-`}function Ms(t,e,n){let o=[];for(let r of t){let a=r.originalPath?S.join("a",r.originalPath):"/dev/null",s=r.generatedPath?S.join("b",r.generatedPath):"/dev/null";if(r.changeKind==="renamed"&&r.originalPath&&r.generatedPath?(o.push(`diff --vibgrate ${a} ${s}`),o.push(`similarity index ${Math.round((r.similarity??0)*100)}%`),o.push(`rename from ${r.originalPath}`),o.push(`rename to ${r.generatedPath}`)):o.push(`diff --vibgrate ${a} ${s}`),o.push(`--- ${r.changeKind==="added"?"/dev/null":a}`),o.push(`+++ ${r.changeKind==="removed"?"/dev/null":s}`),r.hunks)for(let i of r.hunks)o.push(`@@ -${i.originalStart},${i.originalCount} +${i.generatedStart},${i.generatedCount} @@`),o.push(...i.lines);o.push("");}return o.join(`
-`)}var fo=new Command("diff").description("Compare two directory trees and emit structured delta facts").argument("<original_path>","Original source directory").argument("<generated_path>","Generated source directory").option("-o, --out <file>","Output file path","vibgrate.diff.ndjson").option("--format <fmt>","Output format (ndjson|json|patch)","ndjson").option("--ignore-whitespace","Ignore whitespace-only changes").option("--context <n>","Context lines for patch output","3").option("--include <globs>","Only include matching files (comma-separated)").option("--exclude <globs>","Exclude matching files (comma-separated)").option("--stats","Include insertions/deletions summary per file").option("--verbose","Print file match decisions and rename detection").action(async(t,e,n)=>{let o=S.resolve(t),r=S.resolve(e);for(let[h,I]of [["original_path",o],["generated_path",r]]){await c(I)||(process.stderr.write(l.red(`${h} does not exist: ${I}
-`)),process.exit(kt));let j;try{j=await K.stat(I);}catch{process.stderr.write(l.red(`Cannot read ${h}: ${I}
-`)),process.exit(kt);}j.isDirectory()||(process.stderr.write(l.red(`${h} must be a directory: ${I}
-`)),process.exit(kt));}let a=n.format.toLowerCase();As.has(a)||(process.stderr.write(l.red(`Invalid format: "${n.format}". Allowed: ndjson, json, patch
-`)),process.exit(io));let s=parseInt(n.context,10);(isNaN(s)||s<0)&&(process.stderr.write(l.red(`--context must be >= 0
-`)),process.exit(io));let i=n.include?n.include.split(",").map(h=>h.trim()).filter(Boolean):void 0,c$1=n.exclude?n.exclude.split(",").map(h=>h.trim()).filter(Boolean):void 0,[p,g]=await Promise.all([co(o,i,c$1),co(r,i,c$1)]),m=new Map(p.map(h=>[h.relPath,h])),u=new Map(g.map(h=>[h.relPath,h]));n.verbose&&(process.stderr.write(l.dim(`Original: ${p.length} files
-`)),process.stderr.write(l.dim(`Generated: ${g.length} files
-`)));let f=[],v=new Set,$=new Set;for(let[h,I]of m){let j=u.get(h);if(j){v.add(h),$.add(h);let x=await K.readFile(I.absPath,"utf-8"),z=await K.readFile(j.absPath,"utf-8"),q=n.ignoreWhitespace?x.replace(/\s+/g," ").trim():x,Y=n.ignoreWhitespace?z.replace(/\s+/g," ").trim():z;if(q!==Y){let b=po(x.split(`
-`),z.split(`
-`),s,n.ignoreWhitespace??false),C={deltaId:qe("modified",h),changeKind:"modified",originalPath:h,generatedPath:h,hunks:b.hunks};n.stats&&(C.stats={insertions:b.insertions,deletions:b.deletions}),f.push(C),n.verbose&&process.stderr.write(l.dim(`  modified: ${h} (+${b.insertions} -${b.deletions})
-`));}}}let k=p.filter(h=>!v.has(h.relPath)),w=g.filter(h=>!$.has(h.relPath)),U=.8,O=new Set,V=new Set;if(k.length>0&&w.length>0){let h=new Map,I=new Map;await Promise.all([...k.map(async x=>{try{h.set(x.relPath,await K.readFile(x.absPath,"utf-8"));}catch{}}),...w.map(async x=>{try{I.set(x.relPath,await K.readFile(x.absPath,"utf-8"));}catch{}})]);let j=[];for(let[x,z]of h)for(let[q,Y]of I){if(S.extname(x)!==S.extname(q))continue;let b=Ns(z,Y);b>=U&&j.push({origPath:x,genPath:q,similarity:b});}j.sort((x,z)=>z.similarity-x.similarity);for(let x of j){if(O.has(x.origPath)||V.has(x.genPath))continue;O.add(x.origPath),V.add(x.genPath);let z=h.get(x.origPath)??"",q=I.get(x.genPath)??"",Y=po(z.split(`
-`),q.split(`
-`),s,n.ignoreWhitespace??false),b={deltaId:qe("renamed",`${x.origPath} -> ${x.genPath}`),changeKind:"renamed",originalPath:x.origPath,generatedPath:x.genPath,similarity:x.similarity,hunks:Y.hunks};n.stats&&(b.stats={insertions:Y.insertions,deletions:Y.deletions}),f.push(b),n.verbose&&process.stderr.write(l.dim(`  renamed: ${x.origPath} \u2192 ${x.genPath} (${(x.similarity*100).toFixed(0)}% similar)
-`));}}for(let h of k){if(O.has(h.relPath))continue;let I={deltaId:qe("removed",h.relPath),changeKind:"removed",originalPath:h.relPath,generatedPath:null};if(n.stats)try{let j=await K.readFile(h.absPath,"utf-8");I.stats={insertions:0,deletions:j.split(`
-`).length};}catch{I.stats={insertions:0,deletions:0};}f.push(I),n.verbose&&process.stderr.write(l.dim(`  removed: ${h.relPath}
-`));}for(let h of w){if(V.has(h.relPath))continue;let I={deltaId:qe("added",h.relPath),changeKind:"added",originalPath:null,generatedPath:h.relPath};if(n.stats)try{let j=await K.readFile(h.absPath,"utf-8");I.stats={insertions:j.split(`
-`).length,deletions:0};}catch{I.stats={insertions:0,deletions:0};}f.push(I),n.verbose&&process.stderr.write(l.dim(`  added: ${h.relPath}
-`));}f.sort((h,I)=>{let j=h.originalPath??h.generatedPath??"",x=I.originalPath??I.generatedPath??"";return j.localeCompare(x)});let ce;switch(a){case "ndjson":ce=Os(f);break;case "json":ce=Fs(f);break;case "patch":ce=Ms(f);break}let ue=S.resolve(n.out);await K.writeFile(ue,ce,"utf-8");let Te=f.filter(h=>h.changeKind==="added").length,$e=f.filter(h=>h.changeKind==="removed").length,Ye=f.filter(h=>h.changeKind==="modified").length,_e=f.filter(h=>h.changeKind==="renamed").length;if(process.stderr.write(l.green("\u2714 ")+`${f.length} changes: `+l.green(`+${Te} added`)+", "+l.red(`-${$e} removed`)+", "+l.yellow(`~${Ye} modified`)+", "+l.blue(`\u2192${_e} renamed`)+`
-`),process.stderr.write(l.dim(`  Written to ${ue}
-`)),n.verbose&&n.stats){let h=0,I=0;for(let j of f)j.stats&&(h+=j.stats.insertions,I+=j.stats.deletions);process.stderr.write(l.dim(`  Total: +${h} insertions, -${I} deletions
-`));}});var Bs="https://vibgrate.com/help";function Us(){console.log(""),console.log(l.dim(`See ${Bs} for more guidance`));}var xt={scan:()=>{console.log(""),console.log(l.bold.underline("vibgrate scan")+l.dim(" \u2014 Scan a project for upgrade drift")),console.log(""),console.log(l.bold("Usage:")),console.log("  vibgrate scan [path] [options]"),console.log(""),console.log(l.bold("Arguments:")),console.log(`  ${l.cyan("[path]")}                       Path to scan (default: current directory)`),console.log(""),console.log(l.bold("Output options:")),console.log(`  ${l.cyan("--format <format>")}           Output format: ${l.white("text")} | json | sarif | md  (default: text)`),console.log(`  ${l.cyan("--out <file>")}                Write output to a file instead of stdout`),console.log(""),console.log(l.bold("Baseline & gating:")),console.log(`  ${l.cyan("--baseline <file>")}           Compare results against a saved baseline`),console.log(`  ${l.cyan("--drift-budget <score>")}      Fail if drift score exceeds this value (0\u2013100)`),console.log(`  ${l.cyan("--drift-worsening <percent>")} Fail if drift worsens by more than % since baseline`),console.log(`  ${l.cyan("--fail-on <level>")}           Fail exit code on warn or error findings`),console.log(""),console.log(l.bold("Performance:")),console.log(`  ${l.cyan("--concurrency <n>")}           Max concurrent registry calls (default: 8)`),console.log(`  ${l.cyan("--changed-only")}              Only scan files changed since last git commit`),console.log(""),console.log(l.bold("Privacy & offline:")),console.log(`  ${l.cyan("--offline")}                   Run without any network calls; skip result upload`),console.log(`  ${l.cyan("--package-manifest <file>")}   Use a local package-version manifest (JSON or ZIP) for offline mode`),console.log(`  ${l.cyan("--no-local-artifacts")}        Do not write .vibgrate JSON artifacts to disk`),console.log(`  ${l.cyan("--max-privacy")}               Strongest privacy mode: minimal scanners + no local artifacts`),console.log(""),console.log(l.bold("Tooling:")),console.log(`  ${l.cyan("--ui-purpose")}                Enable UI purpose evidence extraction (slower)`),console.log(""),console.log(l.bold("Uploading results:")),console.log(`  ${l.cyan("--push")}                      Auto-push results to Vibgrate API after scan`),console.log(`  ${l.cyan("--dsn <dsn>")}                 DSN token for push (or set VIBGRATE_DSN env var)`),console.log(`  ${l.cyan("--region <region>")}           Data residency region: us | eu  (default: us)`),console.log(`  ${l.cyan("--strict")}                    Fail if the upload to Vibgrate API fails`),console.log(""),console.log(l.bold("Examples:")),console.log(`  ${l.dim("# Scan the current directory and display a text report")}`),console.log("  vibgrate scan"),console.log(""),console.log(`  ${l.dim("# Scan, fail if drift score > 40, and write SARIF for GitHub Actions")}`),console.log("  vibgrate scan --drift-budget 40 --format sarif --out drift.sarif"),console.log(""),console.log(`  ${l.dim("# Scan and automatically upload results via a DSN")}`),console.log("  vibgrate scan --push --dsn $VIBGRATE_DSN"),console.log(""),console.log(`  ${l.dim("# Offline scan using a pre-downloaded package manifest")}`),console.log("  vibgrate scan --offline --package-manifest ./manifest.zip");},init:()=>{console.log(""),console.log(l.bold.underline("vibgrate init")+l.dim(" \u2014 Initialise vibgrate in a project directory")),console.log(""),console.log(l.bold("Usage:")),console.log("  vibgrate init [path] [options]"),console.log(""),console.log(l.bold("Arguments:")),console.log(`  ${l.cyan("[path]")}          Directory to initialise (default: current directory)`),console.log(""),console.log(l.bold("Options:")),console.log(`  ${l.cyan("--baseline")}      Create an initial drift baseline after init`),console.log(`  ${l.cyan("--yes")}           Skip all confirmation prompts`),console.log(""),console.log(l.bold("What it does:")),console.log("  \u2022 Creates a .vibgrate/ directory"),console.log("  \u2022 Writes a vibgrate.config.ts starter config"),console.log("  \u2022 Optionally runs an initial baseline scan (--baseline)"),console.log(""),console.log(l.bold("Examples:")),console.log("  vibgrate init"),console.log("  vibgrate init ./my-project --baseline");},baseline:()=>{console.log(""),console.log(l.bold.underline("vibgrate baseline")+l.dim(" \u2014 Save a drift baseline snapshot")),console.log(""),console.log(l.bold("Usage:")),console.log("  vibgrate baseline [path]"),console.log(""),console.log(l.bold("Arguments:")),console.log(`  ${l.cyan("[path]")}   Path to baseline (default: current directory)`),console.log(""),console.log(l.bold("What it does:")),console.log("  Runs a full scan and saves the result as .vibgrate/baseline.json."),console.log("  Future scans can compare against this file using --baseline."),console.log(""),console.log(l.bold("Examples:")),console.log("  vibgrate baseline"),console.log("  vibgrate scan --baseline .vibgrate/baseline.json --drift-worsening 10");},report:()=>{console.log(""),console.log(l.bold.underline("vibgrate report")+l.dim(" \u2014 Generate a report from a saved scan artifact")),console.log(""),console.log(l.bold("Usage:")),console.log("  vibgrate report [options]"),console.log(""),console.log(l.bold("Options:")),console.log(`  ${l.cyan("--in <file>")}        Input artifact file (default: .vibgrate/scan_result.json)`),console.log(`  ${l.cyan("--format <format>")}  Output format: ${l.white("text")} | md | json  (default: text)`),console.log(""),console.log(l.bold("Examples:")),console.log("  vibgrate report"),console.log("  vibgrate report --format md > DRIFT-REPORT.md"),console.log("  vibgrate report --in ./ci/scan_result.json --format json");},sbom:()=>{console.log(""),console.log(l.bold.underline("vibgrate sbom")+l.dim(" \u2014 Supply-chain evidence: SBOM export/delta and OpenVEX")),console.log(""),console.log(l.bold("Subcommands:")),console.log(`  ${l.cyan("vibgrate sbom export")}   Emit a CycloneDX or SPDX SBOM from a scan artifact`),console.log(`  ${l.cyan("vibgrate sbom delta")}    Compare dependencies between two scan artifacts`),console.log(`  ${l.cyan("vibgrate sbom vex")}      Emit an OpenVEX document (exploitability statements)`),console.log(""),console.log(l.bold("sbom export options:")),console.log(`  ${l.cyan("--in <file>")}        Input artifact (default: .vibgrate/scan_result.json)`),console.log(`  ${l.cyan("--format <format>")}  SBOM format: ${l.white("cyclonedx")} | spdx  (default: cyclonedx)`),console.log(`  ${l.cyan("--out <file>")}       Write SBOM to file instead of stdout`),console.log(""),console.log(l.bold("sbom vex options:")),console.log(`  ${l.cyan("--from <file>")}      Read OpenVEX statements from a JSON file`),console.log(`  ${l.cyan("--statement <json>")} Add a statement as inline JSON (repeatable)`),console.log(`  ${l.cyan("--product <ref>")}    Default product for statements (e.g. an image digest)`),console.log(`  ${l.cyan("--out <file>")}       Write the document to file instead of stdout`),console.log(""),console.log(l.bold("Examples:")),console.log("  vibgrate sbom export --format cyclonedx --out sbom.json"),console.log("  vibgrate sbom export --format spdx --out sbom.spdx.json"),console.log('  vibgrate sbom vex --product "$IMAGE_REF" --out openvex.json');},push:()=>{console.log(""),console.log(l.bold.underline("vibgrate push")+l.dim(" \u2014 Upload a scan artifact to the Vibgrate API")),console.log(""),console.log(l.bold("Usage:")),console.log("  vibgrate push [options]"),console.log(""),console.log(l.bold("Options:")),console.log(`  ${l.cyan("--dsn <dsn>")}        DSN token (or set VIBGRATE_DSN env var)`),console.log(`  ${l.cyan("--file <file>")}      Artifact to upload (default: .vibgrate/scan_result.json)`),console.log(`  ${l.cyan("--region <region>")}  Override data residency region: us | eu`),console.log(`  ${l.cyan("--strict")}           Fail with non-zero exit code on upload error`),console.log(""),console.log(l.bold("Examples:")),console.log("  vibgrate push --dsn $VIBGRATE_DSN"),console.log("  vibgrate push --file ./ci/scan_result.json --strict");},dsn:()=>{console.log(""),console.log(l.bold.underline("vibgrate dsn")+l.dim(" \u2014 Manage DSN tokens for API authentication")),console.log(""),console.log(l.bold("Subcommands:")),console.log(`  ${l.cyan("vibgrate dsn create")}   Generate a new DSN token`),console.log(""),console.log(l.bold("dsn create options:")),console.log(`  ${l.cyan("--workspace <id>")}   Workspace ID or "new" to auto-generate ${l.red("(required)")}`),console.log(`  ${l.cyan("--region <region>")}  Data residency region: us | eu  (default: us)`),console.log(`  ${l.cyan("--ingest <url>")}     Override ingest API URL`),console.log(`  ${l.cyan("--write <path>")}     Write the DSN to a file (add to .gitignore!)`),console.log(""),console.log(l.bold("Examples:")),console.log("  vibgrate dsn create --workspace new"),console.log("  vibgrate dsn create --workspace abc123"),console.log("  vibgrate dsn create --workspace new --region eu --write .vibgrate/.dsn");},update:()=>{console.log(""),console.log(l.bold.underline("vibgrate update")+l.dim(" \u2014 Update the vibgrate CLI to the latest version")),console.log(""),console.log(l.bold("Usage:")),console.log("  vibgrate update [options]"),console.log(""),console.log(l.bold("Options:")),console.log(`  ${l.cyan("--check")}         Check for a newer version without installing`),console.log(`  ${l.cyan("--pm <manager>")} Force a package manager: npm | pnpm | yarn | bun`),console.log(""),console.log(l.bold("Examples:")),console.log("  vibgrate update"),console.log("  vibgrate update --check"),console.log("  vibgrate update --pm pnpm");},hcs:()=>{console.log(""),console.log(l.bold.underline("vibgrate hcs")+l.dim(" \u2014 Holistic Code Specification: extract and render code facts")),console.log(""),console.log(l.bold("Subcommands:")),console.log(`  ${l.cyan("vibgrate hcs extract")}   Analyze source code and emit HCS facts as NDJSON`),console.log(`  ${l.cyan("vibgrate hcs digest")}    Render HCS NDJSON facts into Markdown, JSON, or HTML`),console.log(""),console.log(l.bold("hcs extract options:")),console.log(`  ${l.cyan("[path]")}                  Path to source directory (default: .)`),console.log(`  ${l.cyan("-o, --out <file>")}        Write NDJSON to file (default: stdout)`),console.log(`  ${l.cyan("--language <langs>")}      Comma-separated languages to analyze (default: auto-detect)`),console.log(`  ${l.cyan("--include-tests")}         Include test files in analysis`),console.log(`  ${l.cyan("--push")}                  Stream facts to Vibgrate Cloud API`),console.log(`  ${l.cyan("--dsn <dsn>")}             DSN token for push (or use VIBGRATE_DSN env)`),console.log(`  ${l.cyan("--concurrency <n>")}       Number of parallel workers`),console.log(`  ${l.cyan("--timeout-mins <mins>")}   Total analysis timeout in minutes (default: 60)`),console.log(`  ${l.cyan("--verbose")}               Print worker stderr and summary statistics`),console.log(""),console.log(l.bold("hcs digest options:")),console.log(`  ${l.cyan("--in <file>")}             HCS NDJSON file to read (default: stdin)`),console.log(`  ${l.cyan("-o, --out <file>")}        Write output to file (default: stdout)`),console.log(`  ${l.cyan("--format <format>")}       Output format: ${l.white("md")} | json | html  (default: md)`),console.log(`  ${l.cyan("--level <level>")}         Detail level: ${l.white("concise")} | full  (default: concise)`),console.log(`  ${l.cyan("--title <title>")}         Override document title`),console.log(""),console.log(l.bold("Examples:")),console.log(`  ${l.dim("# Extract HCS facts from current directory")}`),console.log("  vibgrate hcs extract . --out facts.ndjson"),console.log(""),console.log(`  ${l.dim("# Render facts as Markdown")}`),console.log("  vibgrate hcs digest --in facts.ndjson --format md > DIGEST.md"),console.log(""),console.log(`  ${l.dim("# Full pipeline: extract and pipe directly to digest")}`),console.log("  vibgrate hcs extract . | vibgrate hcs digest --format html --out digest.html");}};function mo(){console.log(""),console.log(l.bold("vibgrate")+l.dim(" \u2014 Continuous Drift Intelligence")),console.log(""),console.log(l.bold("Usage:")),console.log("  vibgrate <command> [options]"),console.log("  vibgrate help [command]     Show detailed help for a command"),console.log(""),console.log(l.bold("Getting started:")),console.log(`  ${l.cyan("init")}       Initialise vibgrate in a project (creates config & .vibgrate/ dir)`),console.log(`  ${l.cyan("login")}      Sign the CLI into your workspace via the browser`),console.log(`  ${l.cyan("logout")}     Clear stored login credentials`),console.log(""),console.log(l.bold("Core scanning:")),console.log(`  ${l.cyan("scan")}       Scan a project for upgrade drift and generate a report`),console.log(`  ${l.cyan("baseline")}   Save a baseline snapshot to compare future scans against`),console.log(""),console.log(l.bold("Reporting & export:")),console.log(`  ${l.cyan("report")}     Re-generate a report from a previously saved scan artifact`),console.log(`  ${l.cyan("sbom")}       Supply-chain evidence: SBOM (CycloneDX/SPDX) export/delta + OpenVEX`),console.log(""),console.log(l.bold("HCS (Holistic Code Specification):")),console.log(`  ${l.cyan("hcs")}        Extract and render Holistic Code Specification facts`),console.log(`  ${l.cyan("hcs extract")} Analyze source code and emit validated HCS facts (NDJSON)`),console.log(`  ${l.cyan("hcs digest")}  Render HCS NDJSON facts into Markdown, JSON, or HTML`),console.log(""),console.log(l.bold("CI/CD integration:")),console.log(`  ${l.cyan("push")}       Upload a scan artifact to the Vibgrate API`),console.log(`  ${l.cyan("dsn")}        Create and manage DSN tokens for API authentication`),console.log(""),console.log(l.bold("Maintenance:")),console.log(`  ${l.cyan("update")}     Update the vibgrate CLI to the latest version`),console.log(""),console.log(l.dim("Run")+` ${l.cyan("vibgrate help <command>")} `+l.dim("for detailed options, e.g.")+` ${l.cyan("vibgrate help scan")}`);}var ho=new Command("help").description("Show help for vibgrate commands").argument("[command]","Command to show detailed help for").helpOption(false).action(t=>{let e=t?.toLowerCase().trim();e&&xt[e]?xt[e]():(e&&(console.log(""),console.log(l.red(`Unknown command: ${e}`)),console.log(l.dim(`Available commands: ${Object.keys(xt).join(", ")}`))),mo()),Us();});var N=new Command;N.name("vibgrate").description("Continuous Drift Intelligence").version(E).addHelpText("after",`
-See https://vibgrate.com/help for more guidance`);N.addCommand(ho);N.addCommand(Ft);N.addCommand(qt);N.addCommand(h);N.addCommand(nn);N.addCommand(rn);N.addCommand(an);N.addCommand(tt);N.addCommand(fn);N.addCommand(Sn);N.addCommand(Rn);N.addCommand(so);N.addCommand(fo);function Hs(){wn().then(t=>{t?.updateAvailable&&(console.error(""),console.error(l.yellow(`  Update available: ${t.current} \u2192 ${t.latest}`)),console.error(l.dim('  Run "vibgrate update" to install the latest version.')),console.error(""));}).catch(()=>{});}N.parseAsync().then(()=>{Hs();}).catch(t=>{console.error(t),process.exit(1);});
+import { resolveDsn, resolveIngestHost, dashHostForIngestHost, availableRegionIds, createWorkspaceDsn, writeStoredCredentials, credentialsPath, findGitRoot, ensureGitignored, gitignoreEntryForCredentials, clearStoredCredentials, inventory, uploadScanArtifact, dsnCommand, pushCommand, ExitCode, CliError, verifyDeterminism, refreshIfStale, driftCount, embeddingsCached, resolveEmbedModel, loadEmbedder, getNodeEmbeddings, queryGraphSemantic, queryGraph, unavailableMessage, countPending, resolveOne, GraphIndex, shortestPath, renderReport, impactOf, testsToRun, detectRunner, defaultGraphPath, serveStdio, ASSISTANTS, usageError, loadGraph, detectServeLaunch, installAssistant, uninstallAssistant, buildGraph, serializeGraph, coveringTests, FREE_PACK, readScanArtifact, enrichOnline, ECOSYSTEMS, discoverModels, readSavings, exportGraph, catalogPath, libDir, stableStringify, writeArtifacts, writeSnapshot, UsageError, cacheDir, probeFreshness, discover, vibgrateDir, modelCacheInfo, clearModelCache, GraphSource, createServer, assistantById, loadCatalog, driftFor, addLibrary, parseDsn as parseDsn$1, publishPrivateLibrary, resolveLib, libId, resolveVersion, readDoc, localPackageDocs, localApiSurface, assessDocQuality, symbolsFromApi, fetchHostedDocs, selectForBudget, formatForExt, renderHtml, isModelReady } from './chunk-J4DFLN2Q.js';
+import { resolvedGrammarFiles, grammarSetVersion } from './chunk-X5YT263H.js';
+import { loadAdvancedScanHook, baselineCommand } from './chunk-FPUNJNXD.js';
+import { ensureDir, pathExists, writeDefaultConfig, parseDsn, detectVcs, computeRepoFingerprint, resolveRepositoryName, fetchScanPreflight, runCoreScan, VERSION, readJsonFile, writeTextFile, prepareCompressedUpload, titleBox, driftBar, gitHistoryAvailable, buildVersionTimelines, findPackageAnyEcosystem, normalizeConstraint, findVersionCrossings, versionSatisfies, brandProgressBar } from './chunk-2PJRXVUW.js';
+import './chunk-RXP66R2E.js';
+import { pathExists as pathExists$1, parseExcludePatterns } from './chunk-4M2MUQRO.js';
+import * as fs4 from 'fs';
+import fs4__default, { realpathSync } from 'fs';
+import * as path9 from 'path';
+import path9__default from 'path';
+import { fileURLToPath } from 'url';
+import { Command, CommanderError, Option } from 'commander';
+import { execSync, spawn, execFileSync } from 'child_process';
+import chalk5 from 'chalk';
+import * as fs10 from 'fs/promises';
+import * as os from 'os';
+import semver from 'semver';
+import { randomUUID } from 'crypto';
+
+function info(message = "") {
+  process.stderr.write(`${message}
+`);
+}
+function out(message) {
+  process.stdout.write(`${message}
+`);
+}
+function json(value) {
+  process.stdout.write(`${JSON.stringify(value, null, 2)}
+`);
+}
+var c = chalk5;
+function disableColor() {
+  chalk5.level = 0;
+}
+
+// src/util/logo.ts
+var teal = (s) => c.hex("#3FB0A4")(s);
+var mint = (s) => c.hex("#4FE3C1")(s);
+var ROBOT = [
+  "   " + teal("\u256D\u2500\u2500\u2500\u2500\u2500\u2500\u256E") + mint("\u279C"),
+  "  " + c.dim("\u2524") + teal("\u2502") + " " + mint("\u25FC") + "  " + mint("\u25FC") + " " + teal("\u2502") + c.dim("\u251C"),
+  "  " + c.dim("\u2524") + teal("\u2502") + "  " + c.dim("\u2581\u2581") + "  " + teal("\u2502") + c.dim("\u251C"),
+  "   " + teal("\u2570\u2500\u2500\u2500\u2500\u2500\u2500\u256F")
+];
+function logoLines(root) {
+  return [
+    "",
+    `  ${ROBOT[0]}`,
+    `  ${ROBOT[1]}`,
+    `  ${ROBOT[2]}`,
+    `  ${ROBOT[3]}`,
+    `  ${c.bold.white("vibgrate")} ${teal("graph")}  ${c.dim(`\xB7 deterministic code graph \xB7 v${VERSION}`)}`,
+    ...root ? [`  ${c.dim(root)}`] : [],
+    ""
+  ];
+}
+function printLogo(root) {
+  if (!process.stderr.isTTY) return;
+  process.stderr.write(`${logoLines(root).join("\n")}
+`);
+}
+
+// src/util/progress.ts
+var FRAMES = ["\u280B", "\u2819", "\u2839", "\u2838", "\u283C", "\u2834", "\u2826", "\u2827", "\u2807", "\u280F"];
+var WIDTH = 30;
+function fmtDuration(ms) {
+  const s = Math.max(0, Math.round(ms / 1e3));
+  if (s < 60) return `${s}s`;
+  return `${Math.floor(s / 60)}m${String(s % 60).padStart(2, "0")}s`;
+}
+function formatProgressLine(label, done, total, elapsedMs, frame) {
+  const ratio = total > 0 ? Math.min(done / total, 1) : 0;
+  const bar = brandProgressBar(ratio, WIDTH);
+  const pct = Math.round(ratio * 100);
+  const spin = c.cyan(FRAMES[(frame % FRAMES.length + FRAMES.length) % FRAMES.length]);
+  const eta = ratio > 0.02 && ratio < 1 ? ` \xB7 eta ${fmtDuration(elapsedMs / ratio * (1 - ratio))}` : "";
+  return `  ${spin} ${label} ${bar} ${c.bold(`${pct}%`)} ${c.dim(`${done}/${total} \xB7 ${fmtDuration(elapsedMs)}${eta}`)}`;
+}
+var ProgressBar = class {
+  constructor(label) {
+    this.label = label;
+  }
+  label;
+  start = Date.now();
+  frame = 0;
+  tty = Boolean(process.stderr.isTTY);
+  update(done, total) {
+    if (!this.tty) return;
+    const line = formatProgressLine(this.label, done, total, Date.now() - this.start, this.frame++);
+    process.stderr.write(`\r\x1B[2K${line}`);
+  }
+  /** Clear the bar; optionally print a final summary line. */
+  done(summary) {
+    if (!this.tty) return;
+    process.stderr.write("\r\x1B[2K");
+    if (summary) process.stderr.write(`${summary}
+`);
+  }
+};
+
+// src/cli-options.ts
+function applyGlobalOptions(cmd) {
+  return cmd.option("-C, --cwd <dir>", "run as if started in <dir>", ".").option("--deep", "do more: precise resolution, all edges, semantic links").option("--json", "machine-readable JSON on stdout").option("--generated-at <iso>", "pin the artifact timestamp for byte-deterministic output").option("--graph <file>", "override the map path").option("--no-cache", "full rebuild (ignore the incremental cache)").option("--local", "never touch the network (lexical-only semantic)").option("--quiet", "suppress progress output").option("--no-color", "disable colored output");
+}
+function readGlobal(cmd) {
+  const o = cmd.opts();
+  return {
+    cwd: o.cwd,
+    deep: o.deep,
+    json: o.json,
+    generatedAt: o.generatedAt,
+    graph: o.graph,
+    noCache: o.cache === false,
+    local: o.local,
+    quiet: o.quiet
+  };
+}
+
+// src/commands/build.ts
+function registerBuild(program) {
+  const cmd = program.command("build").description("build / update the code map (incremental, deterministic)").argument("[paths...]", "folders or files to map (default: current folder)").option("--only <langs>", "restrict to languages, e.g. ts,py,go").option("--exclude <glob>", "extra ignore glob (repeatable)", collect, []).option("--no-html", "do not write graph.html").option("--no-report", "do not write GRAPH_REPORT.md").option("--no-ground", "do not attach grounding (Phase 2)").option("--jobs <n>", "worker count (1 = single-threaded)").option("--scip <file>", "ingest a SCIP index for precise resolution (default: auto-detect index.scip)").option("--no-scip", "ignore any SCIP index").option("--no-tsc", "skip the in-process TypeScript resolver (heuristic floor only)").option("--no-warm", "do not warm the semantic index in the background after building").option("--grammars <dir>", "directory of grammar .wasm files (offline / air-gapped)").option("-o, --export <file>", "also write the map to a file (format inferred)").action(async function(paths, opts) {
+    await runBuild(paths, opts, readGlobal(this));
+  });
+  applyGlobalOptions(cmd);
+}
+async function runBuild(paths, opts, global) {
+  const root = path9.resolve(global.cwd ?? ".");
+  const interactive = !global.json && !global.quiet;
+  if (interactive) printLogo(path9.basename(root) || root);
+  const bar = interactive ? new ProgressBar(c.dim("parsing")) : void 0;
+  const jobs = opts.jobs ? Number(opts.jobs) : void 0;
+  if (jobs !== void 0 && (!Number.isInteger(jobs) || jobs < 1)) {
+    throw usageError(`--jobs must be a positive integer (got "${opts.jobs}")`);
+  }
+  const only = opts.only ? opts.only.split(",").map((s) => s.trim()).filter(Boolean) : void 0;
+  let result;
+  try {
+    result = await buildGraph({
+      root,
+      paths: paths.length ? paths : void 0,
+      only,
+      exclude: opts.exclude,
+      jobs,
+      noCache: global.noCache,
+      deep: global.deep,
+      noGround: opts.ground === false,
+      scip: typeof opts.scip === "string" ? opts.scip : void 0,
+      noScip: opts.scip === false,
+      noTsc: opts.tsc === false,
+      generatedAt: global.generatedAt,
+      onParseProgress: bar ? (done, total) => bar.update(done, total) : void 0,
+      grammarsDir: opts.grammars
+    });
+  } catch (err) {
+    bar?.done();
+    if (err instanceof UsageError) throw usageError(err.message);
+    throw err;
+  }
+  bar?.done();
+  const written = writeArtifacts(result.graph, {
+    root,
+    html: opts.html,
+    report: opts.report,
+    graphPath: global.graph
+  });
+  if (!global.graph) {
+    writeSnapshot(root, result.graph.provenance.corpusHash, result.fileStats, {
+      only,
+      exclude: opts.exclude,
+      paths: paths.length ? paths : void 0,
+      deep: global.deep,
+      noGround: opts.ground === false,
+      scip: typeof opts.scip === "string" ? opts.scip : void 0,
+      noScip: opts.scip === false,
+      noTsc: opts.tsc === false,
+      grammarsDir: opts.grammars
+    });
+  }
+  if (opts.export) writeExport(result.graph, opts.export);
+  if (global.json) {
+    json({
+      ok: true,
+      counts: result.graph.meta.counts,
+      languages: result.graph.meta.languages,
+      reparsed: result.reparsed,
+      reused: result.reused,
+      totalFiles: result.totalFiles,
+      resolve: result.resolveStats,
+      tsc: result.tsc,
+      scip: result.scip,
+      artifacts: written,
+      corpusHash: result.graph.provenance.corpusHash,
+      timingMs: result.timing.totalMs
+    });
+    return;
+  }
+  const { counts } = result.graph.meta;
+  const incremental = result.reused > 0 ? `incremental: ${result.reparsed} of ${result.totalFiles} files re-parsed` : `${result.totalFiles} files parsed`;
+  const seconds = (result.timing.totalMs / 1e3).toFixed(2);
+  info(`${c.cyan("vg")} \xB7 mapped ${rel(root)} in ${seconds}s (${incremental})`);
+  info(
+    `  nodes ${c.bold(String(counts.nodes))}   edges ${c.bold(String(counts.edges))}   areas ${counts.areas}   langs ${result.graph.meta.languages.join(",") || "\u2014"}`
+  );
+  const callPct = result.resolveStats.callsResolved + result.resolveStats.callsUnresolved > 0 ? Math.round(
+    100 * result.resolveStats.callsResolved / (result.resolveStats.callsResolved + result.resolveStats.callsUnresolved)
+  ) : 100;
+  const precise = result.tsc || result.scip;
+  const callLabel = precise ? `heuristic floor ${callPct}%` : `calls resolved ${callPct}%`;
+  info(c.dim(`  ${callLabel} \xB7 resolver ${result.graph.provenance.resolver.join(",")}`));
+  if (result.tsc) {
+    const jsx = result.tsc.jsx > 0 ? `, ${result.tsc.jsx} JSX` : "";
+    info(c.dim(`  tsc: ${result.tsc.resolved} precise edges across ${result.tsc.files} TS/JS files (${result.tsc.calls} calls${jsx})`));
+  }
+  if (result.scip) {
+    info(c.dim(`  scip: ${result.scip.resolved} precise edges from ${result.scip.tool ?? "index"} (${result.scip.documents} docs)`));
+  }
+  const artifactList = [written.graphPath, written.htmlPath, written.reportPath].filter(Boolean).map((p) => path9.relative(root, p)).join("  ");
+  info(`  \u2192 ${artifactList}`);
+  if (result.warnings.length) {
+    info(c.yellow(`  ${result.warnings.length} parse warning(s) \u2014 run with --json for detail`));
+  }
+  maybeWarmEmbeddings(root, result.graph, global, opts.warm !== false);
+}
+function maybeWarmEmbeddings(root, graph, global, warm) {
+  if (!warm || global.json || global.quiet || global.local) return;
+  if (!process.stdout.isTTY && !process.stderr.isTTY) return;
+  const modelId = resolveEmbedModel();
+  if (!isModelReady(modelId)) return;
+  if (countPending(graph, root, modelId) === 0) return;
+  const cli = process.argv[1];
+  if (!cli) return;
+  try {
+    const child = spawn(process.execPath, [cli, "embed", "-C", root, "--bg"], {
+      detached: true,
+      stdio: "ignore"
+    });
+    child.unref();
+    info(c.dim("  warming the semantic index in the background \u2014 `vg ask` will be instant"));
+  } catch {
+  }
+}
+function writeExport(graph, target) {
+  if (target === "-") {
+    out(serializeGraph(graph).trimEnd());
+    return;
+  }
+  const ext = path9.extname(target).toLowerCase();
+  let content;
+  switch (ext) {
+    case ".json":
+      content = serializeGraph(graph);
+      break;
+    case ".md":
+      content = renderReport(graph);
+      break;
+    case ".html":
+      content = renderHtml(graph);
+      break;
+    default:
+      throw new CliError(
+        `cannot export to "${ext || target}" yet \u2014 supported in Phase 0: .json, .md, .html, "-" (stdout). More formats (graphml, dot, cypher) arrive with \`vg export\` in Phase 1.`,
+        ExitCode.USAGE_ERROR
+      );
+  }
+  fs4.mkdirSync(path9.dirname(path9.resolve(target)), { recursive: true });
+  fs4.writeFileSync(target, content);
+}
+function collect(value, prev) {
+  return [...prev, value];
+}
+function rel(root) {
+  const r = path9.relative(process.cwd(), root);
+  return r === "" ? "." : r;
+}
+function registerStatus(program) {
+  const cmd = program.command("status").description("cache/freshness, counts, staleness, resolver rungs used").action(async function() {
+    await runStatus(readGlobal(this));
+  });
+  applyGlobalOptions(cmd);
+}
+async function runStatus(global) {
+  const root = path9.resolve(global.cwd ?? ".");
+  const graphPath = global.graph ?? defaultGraphPath(root);
+  const graph = loadGraph(root, graphPath);
+  const hasCache = fs4.existsSync(path9.join(cacheDir(root), "parse-cache.json"));
+  let stale = null;
+  let staleExact = false;
+  if (graph) {
+    const probe = probeFreshness(root);
+    if (probe) {
+      stale = driftCount(probe.drift);
+      staleExact = true;
+    } else {
+      const files = discover({ root });
+      let changed = 0;
+      const graphFiles = new Set(graph.nodes.filter((n) => n.kind === "file").map((n) => n.file));
+      const currentFiles = new Set(files.map((f) => f.rel));
+      for (const f of currentFiles) if (!graphFiles.has(f)) changed++;
+      for (const f of graphFiles) if (!currentFiles.has(f)) changed++;
+      stale = changed;
+    }
+  }
+  if (global.json) {
+    json({
+      root: path9.relative(process.cwd(), root) || ".",
+      graphPath: path9.relative(root, graphPath),
+      built: graph !== null,
+      generatedAt: graph?.generatedAt ?? null,
+      counts: graph?.meta.counts ?? null,
+      languages: graph?.meta.languages ?? [],
+      cluster: graph?.meta.cluster ?? null,
+      resolver: graph?.provenance.resolver ?? [],
+      corpusHash: graph?.provenance.corpusHash ?? null,
+      cache: hasCache,
+      staleFiles: stale,
+      staleExact
+    });
+    return;
+  }
+  if (!graph) {
+    info(`${c.cyan("vg")} \xB7 no map yet at ${c.dim(path9.relative(root, graphPath))}`);
+    info(`  run ${c.bold("vg")} to build one`);
+    return;
+  }
+  info(`${c.cyan("vg")} \xB7 ${path9.relative(root, graphPath)}`);
+  info(`  generated ${graph.generatedAt}`);
+  info(
+    `  nodes ${c.bold(String(graph.meta.counts.nodes))}  edges ${c.bold(
+      String(graph.meta.counts.edges)
+    )}  areas ${graph.meta.counts.areas}  langs ${graph.meta.languages.join(",") || "\u2014"}`
+  );
+  info(`  cluster ${graph.meta.cluster} \xB7 resolver ${graph.provenance.resolver.join(",")}`);
+  info(`  cache ${hasCache ? c.green("warm") : c.dim("cold")} \xB7 corpus ${graph.provenance.corpusHash.slice(0, 12)}\u2026`);
+  if (stale && stale > 0) {
+    info(c.yellow(`  ${stale} file(s) changed since last build \u2014 run ${c.bold("vg")} to refresh`));
+  } else {
+    info(c.dim("  up to date"));
+  }
+  if (vibgrateDir(root)) ;
+}
+function registerVerify(program) {
+  const cmd = program.command("verify").description("determinism self-check (exit 4 on mismatch)").option("--only <langs>", "restrict to languages, e.g. ts,py").option("--jobs <n>", "worker count").action(async function(opts) {
+    const global = readGlobal(this);
+    const root = path9.resolve(global.cwd ?? ".");
+    const result = await verifyDeterminism({
+      root,
+      only: opts.only ? opts.only.split(",").map((s) => s.trim()).filter(Boolean) : void 0,
+      jobs: opts.jobs ? Number(opts.jobs) : void 0
+    });
+    if (global.json) {
+      json({ ok: result.ok, checks: result.checks, digest: result.digest });
+    } else {
+      info(`${c.cyan("vg verify")} \xB7 ${path9.relative(process.cwd(), root) || "."}`);
+      for (const check of result.checks) {
+        const mark = check.ok ? c.green("\u2714") : c.red("\u2718");
+        const detail = check.detail ? c.dim(` (${check.detail})`) : "";
+        info(`  ${mark} ${check.name}${detail}`);
+      }
+      info(result.ok ? c.green(`  deterministic \xB7 digest ${result.digest.slice(0, 16)}\u2026`) : c.red("  NON-DETERMINISTIC"));
+    }
+    if (!result.ok) {
+      throw new CliError("determinism self-check failed", ExitCode.NON_DETERMINISTIC);
+    }
+  });
+  applyGlobalOptions(cmd);
+}
+function rootOf(global) {
+  return path9.resolve(global.cwd ?? ".");
+}
+function requireGraph(global) {
+  const root = rootOf(global);
+  const graph = loadGraph(root, global.graph);
+  if (!graph) {
+    throw new CliError(
+      `no map found \u2014 run \`vg\` to build one first` + (global.graph ? ` (looked at ${global.graph})` : ""),
+      ExitCode.NOT_FOUND
+    );
+  }
+  return { root, graph };
+}
+
+// src/commands/ask.ts
+function registerAsk(program) {
+  const cmd = program.command("ask").description("ask the map \u2014 returns a budget-bounded context block").argument("<question...>", 'your question (a bare quoted string also works: vg "\u2026")').option("-b, --budget <n>", "approx token budget for the answer", "2000").option("--no-semantic", "lexical only (skip the local-embedding pass)").option("--no-refresh", "answer from the map as built \u2014 skip the auto-rebuild when files change").action(async function(question, opts) {
+    const global = readGlobal(this);
+    const root = rootOf(global);
+    if (opts.refresh !== false && !global.graph) {
+      const refreshed = await refreshIfStale(root);
+      if (refreshed.status === "refreshed" && !global.json) {
+        const n = driftCount(refreshed.drift);
+        info(c.dim(`  map refreshed \u2014 ${n} file(s) drifted (${(refreshed.ms / 1e3).toFixed(2)}s)`));
+      } else if (refreshed.status === "error" && !global.json) {
+        info(c.yellow(`  map refresh failed (${refreshed.message}) \u2014 answering from the last built map`));
+      }
+    }
+    const { graph } = requireGraph(global);
+    const budget = Number(opts.budget) || 2e3;
+    const q = question.join(" ");
+    const wantSemantic = opts.semantic !== false && !global.local;
+    let result;
+    let mode = "lexical";
+    let note = "";
+    if (wantSemantic) {
+      const firstRun = !embeddingsCached(root, resolveEmbedModel());
+      if (!global.json && firstRun) {
+        info(c.dim("  preparing semantic search (first use embeds the map; cached, resumable & offline after)\u2026"));
+      }
+      let reason;
+      const embedder = await loadEmbedder({ local: global.local, onUnavailable: (r) => reason = r });
+      if (embedder) {
+        const bar = !global.json && firstRun ? new ProgressBar(c.dim("embedding")) : void 0;
+        const vectors = await getNodeEmbeddings(graph, embedder, root, bar ? (d, t) => bar.update(d, t) : void 0);
+        bar?.done();
+        result = await queryGraphSemantic(graph, q, { budget, embedder, nodeVectors: vectors });
+        mode = `semantic (${embedder.id})`;
+      } else {
+        result = queryGraph(graph, q, { budget });
+        note = reason ? unavailableMessage(reason) : "semantic unavailable; used lexical";
+      }
+    } else {
+      result = queryGraph(graph, q, { budget });
+      if (global.local) note = "semantic skipped under --local; used lexical";
+    }
+    if (global.json) {
+      json({
+        question: result.question,
+        mode,
+        note: note || void 0,
+        tokensEstimate: result.tokensEstimate,
+        matches: result.matches.map((m) => ({
+          name: m.node.qualifiedName,
+          kind: m.node.kind,
+          file: m.node.file,
+          line: m.node.span.start,
+          score: m.score,
+          why: m.why
+        })),
+        context: result.context
+      });
+      return;
+    }
+    out(result.context);
+    info("");
+    info(c.dim(`vg \xB7 ${result.matches.length} match(es) \xB7 ~${result.tokensEstimate} tokens (budget ${budget}) \xB7 ${mode}`));
+    if (note) info(c.yellow(`  ${note}`));
+  });
+  applyGlobalOptions(cmd);
+}
+function mb(bytes) {
+  if (bytes <= 0) return "0 MB";
+  if (bytes < 1024 * 1024) return `${Math.max(1, Math.round(bytes / 1024))} KB`;
+  return `${Math.round(bytes / (1024 * 1024))} MB`;
+}
+function registerEmbed(program) {
+  const cmd = program.command("embed").description("precompute the semantic index for instant `vg ask` (or --where / --clear)").option("--where", "show where the model is cached, and its size").option("--clear", "remove the downloaded model from the shared cache").addOption(new Option("--bg").hideHelp()).action(async function(opts) {
+    const global = readGlobal(this);
+    const modelId = resolveEmbedModel();
+    if (opts.where) return showWhere(rootOf(global), modelId, global.json);
+    if (opts.clear) return doClear(global.json);
+    const { graph } = requireGraph(global);
+    const root = rootOf(global);
+    const bg = opts.bg === true;
+    const speak = !bg && !global.json;
+    if (global.local) {
+      if (speak) info(c.dim("vg embed \xB7 semantic is off (--local) \u2014 lexical search only"));
+      return;
+    }
+    if (countPending(graph, root, modelId) === 0) {
+      if (global.json) json({ embedded: 0, pending: 0, upToDate: true, model: modelId });
+      else if (speak) info(`${c.cyan("vg embed")} \xB7 semantic index already up to date`);
+      return;
+    }
+    let reason;
+    const embedder = await loadEmbedder({
+      local: global.local,
+      noDownload: bg,
+      // background warm-up never downloads
+      showDownloadProgress: !bg,
+      onUnavailable: (r) => reason = r
+    });
+    if (!embedder) {
+      if (speak && reason) info(c.dim(`vg embed \xB7 ${unavailableMessage(reason)}`));
+      return;
+    }
+    const pending = countPending(graph, root, modelId);
+    const bar = speak ? new ProgressBar(c.dim("embedding")) : void 0;
+    await getNodeEmbeddings(graph, embedder, root, bar ? (d, t) => bar.update(d, t) : void 0);
+    bar?.done();
+    if (global.json) json({ embedded: pending, model: modelId });
+    else if (speak) info(`${c.green("\u2714")} vg embed \xB7 semantic index ready (~${pending} node(s) \xB7 model ${modelId})`);
+  });
+  applyGlobalOptions(cmd);
+}
+function showWhere(root, modelId, asJson) {
+  const m = modelCacheInfo(modelId);
+  const repoCached = embeddingsCached(root, modelId);
+  if (asJson) {
+    json({ model: modelId, cacheDir: m.dir, present: m.present, bytes: m.bytes, repoEmbeddings: repoCached });
+    return;
+  }
+  info(`${c.cyan("vg embed")} \xB7 model cache`);
+  info(`  model     ${c.bold(modelId)}`);
+  info(`  shared at ${m.dir}`);
+  info(`            ${m.present ? c.green(`present \xB7 ~${mb(m.bytes)}`) : c.dim("not downloaded yet (fetched on first semantic ask)")}`);
+  info(`  this repo ${repoCached ? c.green("embeddings cached") : c.dim("not embedded yet \u2014 run `vg embed`")}`);
+  info(c.dim("  no admin/sudo needed \u2014 the cache is in your home folder, shared across all repos."));
+  info(c.dim("  turn off: run with --local \xB7 relocate: XDG_CACHE_HOME=<dir> \xB7 remove: vg embed --clear"));
+}
+function doClear(asJson) {
+  const before = modelCacheInfo();
+  const freed = clearModelCache();
+  if (asJson) {
+    json({ removed: before.present, bytesFreed: freed, dir: before.dir });
+    return;
+  }
+  if (!before.present || freed === 0) {
+    info(`${c.cyan("vg embed")} \xB7 no model in the shared cache \u2014 nothing to remove (${before.dir})`);
+    return;
+  }
+  info(`${c.green("\u2714")} vg embed \xB7 removed the shared model (~${mb(freed)}) from ${before.dir}`);
+  info(c.dim("  repos use fast lexical search until the next semantic ask re-downloads it."));
+}
+
+// src/commands/ambiguity.ts
+function ambiguityError(summary, candidates, pickFlag = "--pick") {
+  if (candidates.length === 0) {
+    return new CliError(`${summary} \u2014 try \`vg hubs\` or a broader name/glob`, ExitCode.NOT_FOUND);
+  }
+  const lines = candidates.slice(0, 10).map((n, i) => `  ${i + 1}. ${n.qualifiedName} (${n.kind}, ${n.file}:${n.span.start})`);
+  const more = candidates.length > 10 ? `
+  \u2026and ${candidates.length - 10} more` : "";
+  return new CliError(
+    `${summary} \u2014 pick one with ${pickFlag} <n>:
+${lines.join("\n")}${more}`,
+    ExitCode.NOT_FOUND
+  );
+}
+
+// src/commands/show.ts
+function registerShow(program) {
+  const cmd = program.command("show").description("explain a node: what it is, what it calls, what calls it").argument("<name>", "qualified name, short name, file:line, glob, or id").option("--pick <n>", "pick the nth candidate when ambiguous").action(function(name, opts) {
+    const global = readGlobal(this);
+    const { graph } = requireGraph(global);
+    const { node, candidates } = resolveOne(graph, name, opts.pick ? Number(opts.pick) : void 0);
+    if (!node) {
+      if (candidates.length === 0) {
+        throw ambiguityError(`no node matches "${name}"`, []);
+      }
+      throw ambiguityError(`"${name}" is ambiguous`, candidates);
+    }
+    const index = new GraphIndex(graph);
+    const callees = dedupe(index.callees(node.id).map((x) => x.node));
+    const callers = dedupe(index.callers(node.id).map((x) => x.node));
+    const extendsEdges = index.out(node.id, "extends").concat(index.out(node.id, "implements"));
+    const supertypes = extendsEdges.map((e) => index.node(e.dst)?.qualifiedName).filter(Boolean);
+    const area = graph.areas.find((a) => a.id === node.area);
+    if (global.json) {
+      json({
+        id: node.id,
+        name: node.qualifiedName,
+        kind: node.kind,
+        file: node.file,
+        line: node.span.start,
+        signature: node.signature ?? null,
+        importance: node.importance,
+        centrality: node.centrality,
+        isHub: node.isHub,
+        area: node.area,
+        areaLabel: area?.label ?? null,
+        tested: node.tested,
+        calls: callees.map((n) => n.qualifiedName),
+        calledBy: callers.map((n) => n.qualifiedName),
+        extends: supertypes
+      });
+      return;
+    }
+    info(`${c.cyan(node.qualifiedName)}  ${c.dim(`(${node.kind})`)}`);
+    info(`  ${c.dim(`${node.file}:${node.span.start}`)}`);
+    if (node.signature) info(`  ${c.bold(node.signature)}`);
+    info(
+      `  importance ${node.importance.toFixed(3)}${node.isHub ? c.yellow(" \u2605 hub") : ""} \xB7 area #${node.area}${area ? ` ${c.dim(area.label)}` : ""}`
+    );
+    if (supertypes.length) info(`  ${c.dim("extends:")} ${supertypes.join(", ")}`);
+    info(`  ${c.dim("calls")} (${callees.length}): ${callees.slice(0, 12).map((n) => n.qualifiedName).join(", ") || "\u2014"}`);
+    info(`  ${c.dim("called by")} (${callers.length}): ${callers.slice(0, 12).map((n) => n.qualifiedName).join(", ") || "\u2014"}`);
+  });
+  applyGlobalOptions(cmd);
+}
+function dedupe(nodes) {
+  const seen = /* @__PURE__ */ new Set();
+  const out2 = [];
+  for (const n of nodes) {
+    if (seen.has(n.id)) continue;
+    seen.add(n.id);
+    out2.push(n);
+  }
+  return out2;
+}
+
+// src/commands/path.ts
+function registerPath(program) {
+  const cmd = program.command("path").description("how A connects to B (shortest path)").argument("<a>", "source node").argument("<b>", "target node").option("--pick-a <n>", "pick the nth candidate for A when ambiguous").option("--pick-b <n>", "pick the nth candidate for B when ambiguous").action(function(a, b, opts) {
+    const global = readGlobal(this);
+    const { graph } = requireGraph(global);
+    const ra = resolveOne(graph, a, opts.pickA ? Number(opts.pickA) : void 0);
+    if (!ra.node) throw ambiguityError(`"${a}" ${ra.candidates.length ? "is ambiguous" : "not found"}`, ra.candidates, "--pick-a");
+    const rb = resolveOne(graph, b, opts.pickB ? Number(opts.pickB) : void 0);
+    if (!rb.node) throw ambiguityError(`"${b}" ${rb.candidates.length ? "is ambiguous" : "not found"}`, rb.candidates, "--pick-b");
+    const result = shortestPath(graph, ra.node.id, rb.node.id);
+    if (!result) {
+      throw new CliError(
+        `no path between ${ra.node.qualifiedName} and ${rb.node.qualifiedName}`,
+        ExitCode.NOT_FOUND
+      );
+    }
+    const byId = new Map(graph.nodes.map((n) => [n.id, n]));
+    const names = result.ids.map((id) => byId.get(id)?.qualifiedName ?? id);
+    if (global.json) {
+      json({ from: ra.node.qualifiedName, to: rb.node.qualifiedName, hops: names.length - 1, direction: result.direction, path: names });
+      return;
+    }
+    info(`${c.cyan("vg path")} \xB7 ${names.length - 1} hop(s)${result.direction === "reverse" ? c.dim(" (reverse)") : ""}`);
+    info("  " + names.map((n) => c.bold(n)).join(c.dim(" \u2192 ")));
+  });
+  applyGlobalOptions(cmd);
+}
+
+// src/commands/tree.ts
+function registerTree(program) {
+  const cmd = program.command("tree").description("the call tree rooted at a node (callees; --callers to invert)").argument("<name>", "root node").option("--callers", "show callers instead of callees").option("--depth <n>", "max depth", "3").option("--pick <n>", "pick the nth candidate when ambiguous").action(function(name, opts) {
+    const global = readGlobal(this);
+    const { graph } = requireGraph(global);
+    const { node, candidates } = resolveOne(graph, name, opts.pick ? Number(opts.pick) : void 0);
+    if (!node) throw ambiguityError(`"${name}" ${candidates.length ? "is ambiguous" : "not found"}`, candidates);
+    const index = new GraphIndex(graph);
+    const maxDepth = Math.max(1, Number(opts.depth) || 3);
+    const direction = opts.callers ? "callers" : "callees";
+    if (global.json) {
+      json(toJsonTree(index, node, direction, maxDepth, /* @__PURE__ */ new Set()));
+      return;
+    }
+    info(`${c.cyan("vg tree")} \xB7 ${direction} of ${c.bold(node.qualifiedName)} (depth ${maxDepth})`);
+    const lines = [];
+    walk(index, node, direction, maxDepth, 0, /* @__PURE__ */ new Set(), lines, "");
+    for (const l of lines) info(l);
+  });
+  applyGlobalOptions(cmd);
+}
+function next(index, node, direction) {
+  const rel2 = direction === "callees" ? index.callees(node.id) : index.callers(node.id);
+  const seen = /* @__PURE__ */ new Set();
+  const out2 = [];
+  for (const { node: n } of rel2) {
+    if (seen.has(n.id)) continue;
+    seen.add(n.id);
+    out2.push(n);
+  }
+  return out2.sort((a, b) => b.importance - a.importance || a.qualifiedName.localeCompare(b.qualifiedName));
+}
+function walk(index, node, direction, maxDepth, depth, visited, lines, prefix) {
+  if (depth === 0) lines.push(`${c.bold(node.qualifiedName)} ${c.dim(`(${node.kind})`)}`);
+  if (depth >= maxDepth) return;
+  if (visited.has(node.id)) {
+    lines.push(`${prefix}${c.dim("\u21BB (cycle)")}`);
+    return;
+  }
+  visited.add(node.id);
+  const children = next(index, node, direction);
+  children.forEach((child, i) => {
+    const last = i === children.length - 1;
+    const branch = last ? "\u2514\u2500 " : "\u251C\u2500 ";
+    const cyc = visited.has(child.id) ? c.dim(" \u21BB") : "";
+    lines.push(`${prefix}${c.dim(branch)}${child.qualifiedName}${cyc}`);
+    walk(index, child, direction, maxDepth, depth + 1, new Set(visited), lines, prefix + (last ? "   " : c.dim("\u2502  ")));
+  });
+}
+function toJsonTree(index, node, direction, maxDepth, visited) {
+  if (maxDepth <= 0 || visited.has(node.id)) {
+    return { name: node.qualifiedName, kind: node.kind, cycle: visited.has(node.id) };
+  }
+  const nextVisited = new Set(visited).add(node.id);
+  return {
+    name: node.qualifiedName,
+    kind: node.kind,
+    children: next(index, node, direction).map(
+      (child) => toJsonTree(index, child, direction, maxDepth - 1, nextVisited)
+    )
+  };
+}
+
+// src/commands/insights.ts
+function registerInsights(program) {
+  const map = program.command("map").description("the overview report (areas, hubs, untested hotspots)").action(function() {
+    const global = readGlobal(this);
+    const { graph } = requireGraph(global);
+    if (global.json) json(reportJson(graph));
+    else out(renderReport(graph));
+  });
+  applyGlobalOptions(map);
+  const hubs = program.command("hubs").description("the most-depended-on code (centrality outliers)").option("-n, --limit <n>", "how many to show", "20").action(function(opts) {
+    const global = readGlobal(this);
+    const { graph } = requireGraph(global);
+    const limit = Number(opts.limit) || 20;
+    const list = graph.nodes.filter((n) => n.kind !== "file" && n.kind !== "external").sort((a, b) => b.importance - a.importance || a.qualifiedName.localeCompare(b.qualifiedName)).slice(0, limit);
+    if (global.json) {
+      json(list.map(nodeSummary));
+      return;
+    }
+    info(`${c.cyan("vg hubs")} \xB7 top ${list.length} by importance`);
+    for (const n of list) {
+      const hub = n.isHub ? c.yellow(" \u2605") : "";
+      info(`  ${pad(n.importance.toFixed(3), 6)}  ${c.bold(n.qualifiedName)}${hub}  ${c.dim(`${n.file}:${n.span.start}`)}`);
+    }
+  });
+  applyGlobalOptions(hubs);
+  const areas = program.command("areas").description("the natural groupings (communities), each labelled and sized").option("-n, --limit <n>", "how many to show", "30").action(function(opts) {
+    const global = readGlobal(this);
+    const { graph } = requireGraph(global);
+    const limit = Number(opts.limit) || 30;
+    const list = [...graph.areas].sort((a, b) => b.size - a.size || a.id - b.id).slice(0, limit);
+    if (global.json) {
+      json(list);
+      return;
+    }
+    info(`${c.cyan("vg areas")} \xB7 ${graph.areas.length} communities (${graph.meta.cluster})`);
+    for (const a of list) {
+      info(
+        `  ${c.bold(`#${a.id}`)} ${a.label}  ${c.dim(`${a.size} nodes \xB7 cohesion ${a.cohesion.toFixed(2)} \xB7 ${a.externalEdges} external`)}`
+      );
+    }
+  });
+  applyGlobalOptions(areas);
+  const oddities = program.command("oddities").description("surprising cross-area links (architectural smells)").option("-n, --limit <n>", "how many to show", "20").action(function(opts) {
+    const global = readGlobal(this);
+    const { graph } = requireGraph(global);
+    const limit = Number(opts.limit) || 20;
+    const byId = new Map(graph.nodes.map((n) => [n.id, n]));
+    const list = graph.edges.filter((e) => typeof e.surprise === "number" && e.surprise > 0).sort((a, b) => (b.surprise ?? 0) - (a.surprise ?? 0) || a.id.localeCompare(b.id)).slice(0, limit);
+    if (global.json) {
+      json(
+        list.map((e) => ({
+          kind: e.kind,
+          surprise: e.surprise,
+          from: byId.get(e.src)?.qualifiedName ?? e.src,
+          to: byId.get(e.dst)?.qualifiedName ?? e.dst
+        }))
+      );
+      return;
+    }
+    if (!list.length) {
+      info(`${c.cyan("vg oddities")} \xB7 none found (no cross-area links, or only one area)`);
+      return;
+    }
+    info(`${c.cyan("vg oddities")} \xB7 top ${list.length} surprising links`);
+    for (const e of list) {
+      const from = byId.get(e.src)?.qualifiedName ?? e.src;
+      const to = byId.get(e.dst)?.qualifiedName ?? e.dst;
+      info(`  ${pad((e.surprise ?? 0).toFixed(2), 5)}  ${c.bold(from)} ${c.dim(`\u2014${e.kind}\u2192`)} ${c.bold(to)}`);
+    }
+  });
+  applyGlobalOptions(oddities);
+}
+function nodeSummary(n) {
+  return {
+    id: n.id,
+    name: n.qualifiedName,
+    kind: n.kind,
+    file: n.file,
+    line: n.span.start,
+    importance: n.importance,
+    isHub: n.isHub,
+    area: n.area
+  };
+}
+function reportJson(graph) {
+  return {
+    counts: graph.meta.counts,
+    languages: graph.meta.languages,
+    cluster: graph.meta.cluster,
+    areas: graph.areas.length,
+    hubs: graph.nodes.filter((n) => n.isHub).length
+  };
+}
+function pad(s, n) {
+  return s.padStart(n, " ");
+}
+
+// src/commands/impact.ts
+function registerImpact(program) {
+  const cmd = program.command("impact").description("what breaks if you change it \u2014 and the tests to run").argument("<name>", "node to assess").option("--depth <n>", "max depth", "4").option("--tests", "also select the tests to run for the affected set").option("--fail-on-untested", "exit 2 if any affected node is untested").option("--pick <n>", "pick the nth candidate when ambiguous").action(function(name, opts) {
+    const global = readGlobal(this);
+    const { graph } = requireGraph(global);
+    const { node, candidates } = resolveOne(graph, name, opts.pick ? Number(opts.pick) : void 0);
+    if (!node) throw ambiguityError(`"${name}" ${candidates.length ? "is ambiguous" : "not found"}`, candidates);
+    const depth = Number(opts.depth) || 4;
+    const result = impactOf(graph, node.id, { depth });
+    const withTests = opts.tests || opts.failOnUntested;
+    const ti = withTests ? testsToRun(graph, node.id, depth) : void 0;
+    const runner = ti ? detectRunner(rootOf(global), node.lang) : void 0;
+    if (global.json) {
+      json({
+        ...result,
+        tests: ti ? { toRun: ti.affectedTestFiles, command: runner?.command(ti.affectedTestFiles), untestedAffected: ti.untestedAffected } : void 0
+      });
+    } else {
+      info(`${c.cyan("Impact of")} ${c.bold(result.root.name)}`);
+      info(`  Affected (${result.affected.length})   \u25B8 ${result.direct} direct, ${result.transitive} transitive (depth \u2264 ${result.depth})`);
+      const preview = result.affected.slice(0, 15);
+      for (const a of preview) {
+        info(`    ${c.dim(`d${a.depth}`)} ${a.name} ${c.dim(`${a.file}:${a.line} \xB7 conf ${a.confidence.toFixed(2)}`)}`);
+      }
+      if (result.affected.length > preview.length) info(c.dim(`    \u2026and ${result.affected.length - preview.length} more (use --json)`));
+      if (result.minEdgeConfidence < 1) info(c.dim(`  lowest edge confidence ${result.minEdgeConfidence.toFixed(2)} (ambiguous/dynamic edges lower it)`));
+      if (ti) {
+        info(`  ${c.cyan(`Tests to run (${ti.affectedTestFiles.length})`)} \u25B8 ${ti.affectedTestFiles.join(" \xB7 ") || c.dim("none found")}`);
+        if (runner && ti.affectedTestFiles.length) info(c.dim(`    $ ${runner.command(ti.affectedTestFiles)}`));
+        if (ti.untestedAffected.length) info(c.yellow(`  ${ti.untestedAffected.length} affected node(s) are untested`));
+      }
+    }
+    if (opts.failOnUntested && ti && ti.untestedAffected.length > 0) {
+      throw new CliError(
+        `${ti.untestedAffected.length} affected node(s) are untested: ${ti.untestedAffected.slice(0, 5).map((u) => u.name).join(", ")}`,
+        ExitCode.GATE_FAILED
+      );
+    }
+  });
+  applyGlobalOptions(cmd);
+}
+function registerServe(program) {
+  const cmd = program.command("serve").description("start Vibgrate AI Context \u2014 local-first MCP serving your code map, drift & version-correct docs to your AI").option("--http", "serve over streamable HTTP instead of stdio").option("--port <n>", "port for --http", "7437").option("--host <h>", "host for --http", "127.0.0.1").option("--savings", "record local, counts-only usage savings (opt-in; off by default)").option("--dedup", "collapse a node's heavy relation lists on repeat reads within a session (opt-in; saves tokens)").option("--no-refresh", "serve the map as built \u2014 skip the auto-rebuild when files change").action(async function(opts) {
+    const global = readGlobal(this);
+    const root = rootOf(global);
+    const graphPath = global.graph ?? defaultGraphPath(root);
+    const refresh = opts.refresh !== false && !global.graph;
+    const serveOpts = {
+      savings: opts.savings === true,
+      local: global.local === true,
+      dedup: opts.dedup === true,
+      refresh
+    };
+    if (!fs4.existsSync(graphPath)) {
+      throw new CliError(
+        `no map found at ${graphPath} \u2014 run \`vg\` to build one first`,
+        ExitCode.NOT_FOUND
+      );
+    }
+    const freshness = refresh ? "auto-refresh" : "as built";
+    if (opts.http) {
+      await serveHttp(graphPath, opts.host ?? "127.0.0.1", Number(opts.port) || 7437, serveOpts, freshness);
+    } else {
+      info(c.dim(`vg \xB7 MCP server on stdio (read-only, ${freshness}). Connect your assistant to this process.`));
+      await serveStdio(graphPath, serveOpts);
+    }
+  });
+  applyGlobalOptions(cmd);
+}
+async function serveHttp(graphPath, host, port, opts, freshness) {
+  const { createServer: createHttp } = await import('http');
+  const { StreamableHTTPServerTransport } = await import('@modelcontextprotocol/sdk/server/streamableHttp.js');
+  const source = new GraphSource(graphPath, opts.refresh !== false);
+  const httpServer = createHttp(async (req, res) => {
+    if (req.url !== "/mcp") {
+      res.writeHead(404).end("not found");
+      return;
+    }
+    try {
+      const transport = new StreamableHTTPServerTransport({ sessionIdGenerator: void 0 });
+      const server = createServer(source, opts);
+      res.on("close", () => {
+        void transport.close();
+        void server.close();
+      });
+      await server.connect(transport);
+      await transport.handleRequest(req, res);
+    } catch (err) {
+      if (!res.headersSent) res.writeHead(500).end("internal error");
+      info(c.red(`vg serve: request error: ${err.message}`));
+    }
+  });
+  await new Promise((resolve15) => httpServer.listen(port, host, resolve15));
+  info(c.dim(`vg \xB7 MCP server on http://${host}:${port}/mcp (read-only, local, ${freshness})`));
+  await new Promise(() => {
+  });
+}
+
+// src/commands/install.ts
+var SMALL_REPO_FILES = 150;
+function registerInstall(program) {
+  const install = program.command("install").description("add vg to your AI assistant(s): skill + MCP + advisory nudge").argument("[tools...]", `assistant ids: ${ASSISTANTS.map((a) => a.id).join(", ")}`).option("--all", "install for every supported assistant").option("--list", "show the support matrix and exit").option("--no-hook", "skip the advisory nudge").action(function(tools, opts) {
+    const global = readGlobal(this);
+    const root = rootOf(global);
+    if (opts.list) {
+      if (global.json) {
+        json(ASSISTANTS.map((a) => ({ id: a.id, label: a.label, mcp: !!a.mcp, skill: !!a.skill, nudge: !!a.nudge })));
+      } else {
+        info(`${c.cyan("vg install")} \xB7 supported assistants`);
+        const pad3 = Math.max(...ASSISTANTS.map((a) => a.id.length)) + 2;
+        for (const a of ASSISTANTS) {
+          info(`  ${c.bold(a.id.padEnd(pad3))} ${a.label}  ${c.dim(`mcp:${a.mcp ? "\u2713" : "\u2014"} skill:${a.skill ? "\u2713" : "\u2014"} nudge:${a.nudge ? "\u2713" : "\u2014"}`)}`);
+        }
+      }
+      return;
+    }
+    const targets = opts.all ? ASSISTANTS : tools.map(resolve5);
+    if (targets.length === 0) throw usageError("name an assistant (e.g. `vg install claude`) or use --all / --list");
+    const graph = loadGraph(root, global.graph);
+    const fileCount = graph ? graph.nodes.filter((n) => n.kind === "file").length : 0;
+    const smallRepo = graph !== null && fileCount > 0 && fileCount < SMALL_REPO_FILES;
+    const launch = detectServeLaunch();
+    const results = targets.map((a) => ({ id: a.id, ...installAssistant(a, { root, hook: opts.hook, smallRepo, launch }) }));
+    if (global.json) {
+      json({ root, smallRepo, launch: { command: launch.command, args: launch.args, note: launch.note ?? null }, results });
+      return;
+    }
+    for (const r of results) {
+      info(`${c.green("\u2714")} ${c.bold(r.id)} \u2014 wrote ${r.wrote.join(", ")}${r.skipped.length ? c.dim(` (skipped ${r.skipped.join(", ")})`) : ""}`);
+    }
+    if (launch.note && results.some((r) => r.note)) info(`${c.yellow("!")} ${launch.note}`);
+    if (smallRepo) info(c.dim(`  note: small repo (${fileCount} files) \u2014 nudge says searching is fine; vg is still used for impact/tests`));
+    info(c.dim("  run `vg serve` is wired via MCP; build the map with `vg` if you have not yet"));
+  });
+  applyGlobalOptions(install);
+  const uninstall = program.command("uninstall").description("remove vg from an AI assistant").argument("<tools...>", "assistant ids").option("--purge", "also delete the skill file").action(function(tools, opts) {
+    const global = readGlobal(this);
+    const root = rootOf(global);
+    const results = tools.map(resolve5).map((a) => ({ id: a.id, removed: uninstallAssistant(a, root, !!opts.purge) }));
+    if (global.json) {
+      json({ root, results });
+      return;
+    }
+    for (const r of results) {
+      info(`${c.green("\u2714")} ${c.bold(r.id)} \u2014 removed ${r.removed.length ? r.removed.join(", ") : c.dim("nothing (not installed)")}`);
+    }
+  });
+  applyGlobalOptions(uninstall);
+}
+function resolve5(id) {
+  const a = assistantById(id);
+  if (!a) {
+    const near = ASSISTANTS.filter(
+      (x) => x.id.startsWith(id) || id.startsWith(x.id) || x.id.includes(id) || x.label.toLowerCase().includes(id.toLowerCase())
+    ).map((x) => x.id);
+    const hint = near.length ? ` Did you mean: ${near.join(", ")}?` : "";
+    throw new CliError(
+      `unknown assistant "${id}".${hint} Supported: ${ASSISTANTS.map((x) => x.id).join(", ")} (see \`vg install --list\`)`,
+      ExitCode.USAGE_ERROR
+    );
+  }
+  return a;
+}
+var HOOK_BEGIN = "# vg:begin";
+var HOOK_END = "# vg:end";
+function registerShare(program) {
+  const cmd = program.command("share").description("make the map committable + auto-updating for your team (git)").option("--undo", "reverse what `vg share` installed").option("--reports", "also commit graph.html / GRAPH_REPORT.md (default: gitignored)").action(function(opts) {
+    const global = readGlobal(this);
+    const root = rootOf(global);
+    const gitDir = path9.join(root, ".git");
+    if (!fs4.existsSync(gitDir)) {
+      throw new CliError("not a git repository \u2014 run `vg share` inside a git repo", ExitCode.USAGE_ERROR);
+    }
+    if (opts.undo) {
+      undo(root);
+      info(`${c.cyan("vg share")} ${c.dim("--undo")} \xB7 removed hooks, merge driver, and attributes`);
+      return;
+    }
+    writeVibgrateGitignore(root, !!opts.reports);
+    writeGitAttributes(root);
+    configureMergeDriver(root);
+    installPreCommitHook(root);
+    info(`${c.cyan("vg share")} \xB7 the map is now committable + auto-updating`);
+    info(`  ${c.green("\u2714")} .vibgrate/.gitignore (cache + volatile artifacts ignored, graph.json committed)`);
+    info(`  ${c.green("\u2714")} pre-commit hook (rebuilds + stages graph.json only when it changed)`);
+    info(`  ${c.green("\u2714")} deterministic merge driver for .vibgrate/graph.json (rebuild on conflict)`);
+    info(c.dim("  commit .vibgrate/graph.json so teammates inherit the map on pull"));
+  });
+  applyGlobalOptions(cmd);
+}
+function writeVibgrateGitignore(root, reports) {
+  const dir = path9.join(root, ".vibgrate");
+  fs4.mkdirSync(dir, { recursive: true });
+  const lines = ["# Managed by `vg share` \u2014 keep graph.json committed, ignore the rest", "cache/", "facts.jsonl"];
+  if (!reports) lines.push("graph.html", "GRAPH_REPORT.md");
+  fs4.writeFileSync(path9.join(dir, ".gitignore"), `${lines.join("\n")}
+`);
+}
+function writeGitAttributes(root) {
+  const file = path9.join(root, ".gitattributes");
+  const line = ".vibgrate/graph.json merge=vg";
+  let content = fs4.existsSync(file) ? fs4.readFileSync(file, "utf8") : "";
+  if (!content.split("\n").some((l) => l.trim() === line)) {
+    content = content.length ? `${content.replace(/\s*$/, "")}
+${line}
+` : `${line}
+`;
+    fs4.writeFileSync(file, content);
+  }
+}
+function configureMergeDriver(root) {
+  git(root, ["config", "merge.vg.name", "vg deterministic graph rebuild"]);
+  git(root, ["config", "merge.vg.driver", "vg build >/dev/null 2>&1; cp .vibgrate/graph.json %A"]);
+}
+function installPreCommitHook(root) {
+  const hooksDir = hookDir(root);
+  fs4.mkdirSync(hooksDir, { recursive: true });
+  const file = path9.join(hooksDir, "pre-commit");
+  const block = [
+    HOOK_BEGIN,
+    "if command -v vg >/dev/null 2>&1; then",
+    "  vg build >/dev/null 2>&1 || true",
+    "  git add .vibgrate/graph.json >/dev/null 2>&1 || true",
+    "fi",
+    HOOK_END
+  ].join("\n");
+  let content = fs4.existsSync(file) ? fs4.readFileSync(file, "utf8") : "#!/bin/sh\n";
+  const re = new RegExp(`${escapeRe(HOOK_BEGIN)}[\\s\\S]*?${escapeRe(HOOK_END)}`);
+  if (re.test(content)) content = content.replace(re, block);
+  else content = `${content.replace(/\s*$/, "")}
+
+${block}
+`;
+  if (!content.startsWith("#!")) content = `#!/bin/sh
+${content}`;
+  fs4.writeFileSync(file, content);
+  fs4.chmodSync(file, 493);
+}
+function undo(root) {
+  const hookFile = path9.join(hookDir(root), "pre-commit");
+  if (fs4.existsSync(hookFile)) {
+    const re = new RegExp(`\\n*${escapeRe(HOOK_BEGIN)}[\\s\\S]*?${escapeRe(HOOK_END)}\\n*`);
+    const next2 = fs4.readFileSync(hookFile, "utf8").replace(re, "\n");
+    if (next2.trim() === "#!/bin/sh") fs4.rmSync(hookFile);
+    else fs4.writeFileSync(hookFile, next2);
+  }
+  const attr = path9.join(root, ".gitattributes");
+  if (fs4.existsSync(attr)) {
+    const next2 = fs4.readFileSync(attr, "utf8").split("\n").filter((l) => l.trim() !== ".vibgrate/graph.json merge=vg").join("\n");
+    fs4.writeFileSync(attr, next2);
+  }
+  try {
+    git(root, ["config", "--remove-section", "merge.vg"]);
+  } catch {
+  }
+}
+function hookDir(root) {
+  try {
+    const configured = git(root, ["config", "--get", "core.hooksPath"]).trim();
+    if (configured) return path9.resolve(root, configured);
+  } catch {
+  }
+  return path9.join(root, ".git", "hooks");
+}
+function git(root, args) {
+  return execFileSync("git", args, { cwd: root, encoding: "utf8" });
+}
+function escapeRe(s) {
+  return s.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
+}
+var PIN = "2020-01-01T00:00:00.000Z";
+function registerBenchmark(program) {
+  const cmd = program.command("benchmark").description("reproducible build + token-reduction benchmark (honest estimates)").option("--budget <n>", "token budget for vg answers", "2000").action(async function(opts) {
+    const global = readGlobal(this);
+    const root = rootOf(global);
+    const budget = Number(opts.budget) || 2e3;
+    const t0 = now();
+    const cold = await buildGraph({ root, generatedAt: PIN, noCache: true });
+    const coldMs = now() - t0;
+    const t1 = now();
+    const warm = await buildGraph({ root, generatedAt: PIN });
+    const warmMs = now() - t1;
+    const a = serializeGraph(cold.graph);
+    const b = serializeGraph((await buildGraph({ root, generatedAt: PIN, noCache: true })).graph);
+    const deterministic = a === b;
+    const questions = deriveQuestions(cold.graph);
+    const fileSizes = fileSizeIndex(root);
+    const perQuestion = questions.map((q) => {
+      const vgTokens = queryGraph(cold.graph, q, { budget }).tokensEstimate;
+      const baseTokens = grepBaselineTokens(q, fileSizes);
+      return { question: q, vgTokens, baselineTokens: baseTokens, ratio: baseTokens > 0 ? round(baseTokens / Math.max(vgTokens, 1)) : 1 };
+    });
+    const totalVg = perQuestion.reduce((s, x) => s + x.vgTokens, 0);
+    const totalBase = perQuestion.reduce((s, x) => s + x.baselineTokens, 0);
+    const aggregateRatio = totalVg > 0 ? round(totalBase / totalVg) : 0;
+    const result = {
+      repo: { files: cold.totalFiles, nodes: cold.graph.meta.counts.nodes, edges: cold.graph.meta.counts.edges },
+      build: { coldMs: round(coldMs), incrementalMs: round(warmMs), reusedOnWarm: warm.reused },
+      determinism: { byteIdentical: deterministic },
+      tokenReduction: { questions: perQuestion, aggregateRatio, note: "estimates (~4 chars/token); scales with repo size" }
+    };
+    if (global.json) {
+      json(result);
+      return;
+    }
+    info(`${c.cyan("vg benchmark")} \xB7 ${result.repo.files} files \xB7 ${result.repo.nodes} nodes`);
+    info(`  build   cold ${result.build.coldMs.toFixed(0)}ms \xB7 incremental ${result.build.incrementalMs.toFixed(0)}ms (reused ${warm.reused})`);
+    info(`  determinism  ${deterministic ? c.green("byte-identical \u2713") : c.red("NON-DETERMINISTIC \u2717")}`);
+    if (perQuestion.length) {
+      info(`  token reduction vs grep/read baseline (${c.dim("estimates")}):`);
+      for (const q of perQuestion) {
+        info(`    ${pad2(`${q.ratio.toFixed(1)}\xD7`, 6)} ${c.dim(`vg ${q.vgTokens} vs ~${q.baselineTokens}`)}  "${q.question}"`);
+      }
+      info(`  ${c.bold(`aggregate \u2248 ${aggregateRatio.toFixed(1)}\xD7 fewer tokens`)} ${c.dim("(honest estimate, scales with repo size)")}`);
+    }
+  });
+  applyGlobalOptions(cmd);
+}
+function deriveQuestions(graph) {
+  return graph.nodes.filter((n) => n.kind !== "file" && n.kind !== "external").sort((a, b) => b.importance - a.importance || a.qualifiedName.localeCompare(b.qualifiedName)).slice(0, 5).map((n) => n.name);
+}
+function fileSizeIndex(root) {
+  return discover({ root }).map((f) => ({ rel: f.rel, abs: f.abs, size: safeSize(f.abs) }));
+}
+function grepBaselineTokens(term, files) {
+  const lower = term.toLowerCase();
+  let bytes = 0;
+  for (const f of files) {
+    if (f.size > 512 * 1024) continue;
+    let content = "";
+    try {
+      content = fs4.readFileSync(f.abs, "utf8");
+    } catch {
+      continue;
+    }
+    if (content.toLowerCase().includes(lower)) bytes += content.length;
+  }
+  return Math.ceil(bytes / 4);
+}
+function safeSize(abs) {
+  try {
+    return fs4.statSync(abs).size;
+  } catch {
+    return 0;
+  }
+}
+function now() {
+  return Number(process.hrtime.bigint() / 1000n) / 1e3;
+}
+function round(x) {
+  return Math.round(x * 1e3) / 1e3;
+}
+function pad2(s, n) {
+  return s.padStart(n, " ");
+}
+function registerTests(program) {
+  const cmd = program.command("tests").description("which tests cover a node (call/coverage linkage)").argument("<name>", "node to inspect").option("--missing", "show untested nodes nearby instead").option("--run", "print the command to run exactly these tests").option("--exec", "run that command").option("--pick <n>", "pick the nth candidate when ambiguous").action(function(name, opts) {
+    const global = readGlobal(this);
+    const { root, graph } = requireGraph(global);
+    const { node, candidates } = resolveOne(graph, name, opts.pick ? Number(opts.pick) : void 0);
+    if (!node) throw ambiguityError(`"${name}" ${candidates.length ? "is ambiguous" : "not found"}`, candidates);
+    if (opts.missing) {
+      const nearby = graph.nodes.filter((n) => n.file === node.file && (n.kind === "function" || n.kind === "method") && n.tested === false).sort((a, b) => b.importance - a.importance);
+      if (global.json) {
+        json({ file: node.file, untested: nearby.map((n) => ({ name: n.qualifiedName, line: n.span.start })) });
+        return;
+      }
+      info(`${c.cyan("vg tests --missing")} \xB7 untested in ${node.file} (${nearby.length})`);
+      for (const n of nearby) info(`  ${c.yellow("\u25CB")} ${n.qualifiedName} ${c.dim(`:${n.span.start}`)}`);
+      return;
+    }
+    const covers = coveringTests(graph, node);
+    const testFiles = covers.filter((c2) => c2.basis === "call").map((c2) => c2.file);
+    if (opts.run || opts.exec) {
+      const runner = detectRunner(rootOf(global), node.lang);
+      const command = runner.command(testFiles);
+      if (opts.exec) {
+        info(c.dim(`$ ${command}`));
+        execSync(command, { cwd: root, stdio: "inherit" });
+        return;
+      }
+      if (global.json) json({ runner: runner.name, command, testFiles });
+      else info(command);
+      return;
+    }
+    if (global.json) {
+      json({ node: node.qualifiedName, tested: node.tested, coverage: node.coverage ?? null, covers });
+      return;
+    }
+    info(`${c.cyan("vg tests")} \xB7 ${c.bold(node.qualifiedName)}  ${node.tested ? c.green("tested") : c.yellow("untested")}`);
+    if (typeof node.coverage === "number") info(c.dim(`  line coverage ${(node.coverage * 100).toFixed(0)}%`));
+    if (covers.length === 0) {
+      info(c.dim("  no covering tests found"));
+      return;
+    }
+    for (const t of covers) {
+      info(`  ${c.green("\u2714")} ${t.file} ${c.dim(`(${t.basis}, conf ${t.confidence.toFixed(2)})`)}`);
+    }
+  });
+  applyGlobalOptions(cmd);
+}
+
+// src/commands/facts.ts
+function registerFacts(program) {
+  const cmd = program.command("facts").description("the deterministic facts for a node (contract / invariant / characterization)").argument("<name>", "node to inspect").option("--pick <n>", "pick the nth candidate when ambiguous").action(function(name, opts) {
+    const global = readGlobal(this);
+    const { graph } = requireGraph(global);
+    const { node, candidates } = resolveOne(graph, name, opts.pick ? Number(opts.pick) : void 0);
+    if (!node) throw ambiguityError(`"${name}" ${candidates.length ? "is ambiguous" : "not found"}`, candidates);
+    if (!graph.facts) {
+      if (global.json) json({ node: node.qualifiedName, facts: [], note: "facts require a --deep build" });
+      else info(`${c.cyan("vg facts")} \xB7 run ${c.bold("vg --deep")} to derive facts (none in this map)`);
+      return;
+    }
+    const facts = graph.facts.filter((f) => f.subjectIds.includes(node.id));
+    if (global.json) {
+      json({ node: node.qualifiedName, facts });
+      return;
+    }
+    info(`${c.cyan("vg facts")} \xB7 ${c.bold(node.qualifiedName)} (${facts.length})`);
+    if (facts.length === 0) {
+      info(c.dim("  no facts derived for this node"));
+      return;
+    }
+    for (const f of facts) {
+      info(`  ${c.bold(f.kind)} ${c.dim(`[${f.derivedBy}\u2192${f.confidence}]`)}: ${summarize(f.predicate)}`);
+    }
+  });
+  applyGlobalOptions(cmd);
+}
+function summarize(predicate) {
+  if (predicate && typeof predicate === "object") {
+    const o = predicate;
+    if (typeof o.signature === "string") return o.signature;
+    if (typeof o.guard === "string") return `guards: ${o.guard}`;
+    if (Array.isArray(o.pinnedBy)) return `pinned by ${o.pinnedBy.join(", ")}`;
+  }
+  return JSON.stringify(predicate);
+}
+
+// src/commands/guide.ts
+function registerGuide(program) {
+  const cmd = program.command("guide").description("cited relevant standards/practices for a node (free pack)").argument("<name>", "node to inspect").option("--pick <n>", "pick the nth candidate when ambiguous").action(function(name, opts) {
+    const global = readGlobal(this);
+    const { graph } = requireGraph(global);
+    const { node, candidates } = resolveOne(graph, name, opts.pick ? Number(opts.pick) : void 0);
+    if (!node) throw ambiguityError(`"${name}" ${candidates.length ? "is ambiguous" : "not found"}`, candidates);
+    const entries = new Map(FREE_PACK.entries.map((e) => [e.id, e]));
+    const grounding = (graph.grounding ?? []).filter((g) => g.src === node.id);
+    if (global.json) {
+      json({
+        node: node.qualifiedName,
+        guidance: grounding.map((g) => ({
+          kind: g.kind,
+          rationale: g.rationale,
+          confidence: g.confidence,
+          topic: entries.get(g.packEntryId)?.topic ?? g.packEntryId,
+          summary: entries.get(g.packEntryId)?.summary ?? "",
+          citation: g.citation
+        }))
+      });
+      return;
+    }
+    info(`${c.cyan("vg guide")} \xB7 ${c.bold(node.qualifiedName)} (${grounding.length})`);
+    if (grounding.length === 0) {
+      info(c.dim("  no matching guidance (no security-relevant signals detected)"));
+      return;
+    }
+    for (const g of grounding) {
+      const entry = entries.get(g.packEntryId);
+      const tag = g.rationale === "recommended" ? c.green(g.kind) : c.yellow(g.kind);
+      info(`  ${tag} ${c.dim(`(${g.rationale}, conf ${g.confidence.toFixed(2)})`)}`);
+      if (entry) {
+        info(`    ${entry.summary}`);
+        info(c.dim(`    ${entry.citation.title} \u2014 ${entry.citation.url}`));
+      }
+    }
+  });
+  applyGlobalOptions(cmd);
+}
+
+// src/commands/why.ts
+function registerWhy(program) {
+  const cmd = program.command("why").description("who introduced a dependency (and any open vulnerabilities), from git history").argument("<package>", "package name to explain").action(async function(pkg) {
+    const global = readGlobal(this);
+    const root = rootOf(global);
+    if (!await gitHistoryAvailable(root)) {
+      throw new CliError(
+        "git history is required for `vg why` (not a git repository, or git is unavailable)",
+        ExitCode.USAGE_ERROR
+      );
+    }
+    const timelines = await buildVersionTimelines(root);
+    const pt = timelines ? findPackageAnyEcosystem(timelines, pkg) ?? null : null;
+    const artifact = readScanArtifact(root);
+    const vulnPkg = artifact?.extended?.vulnerabilities?.packages.find((p) => p.package === pkg) ?? null;
+    if (global.json) {
+      json({ package: pkg, history: pt?.changes ?? [], vulnerabilities: vulnPkg?.advisories ?? [] });
+      return;
+    }
+    info(`${c.cyan("vg why")} ${c.bold(pkg)}`);
+    if (!pt || pt.changes.length === 0) {
+      info(c.dim("  no git history found for this package (npm lockfile). It may not be an npm dependency,"));
+      info(c.dim("  or the lockfile predates its introduction."));
+    } else {
+      for (let i = 0; i < pt.changes.length; i++) {
+        const ch = pt.changes[i];
+        const verb = i === 0 ? c.green("added") : c.yellow("\u2192");
+        const date = ch.commit.date.slice(0, 10);
+        info(
+          `  ${verb} ${c.bold(ch.version)} ${c.dim(`${ch.commit.shortSha} ${date} ${ch.commit.authorName}`)}`
+        );
+        info(c.dim(`      ${ch.commit.subject}`));
+      }
+    }
+    if (vulnPkg && vulnPkg.advisories.length) {
+      info("");
+      info(c.red(`  ${vulnPkg.advisories.length} open vulnerabilit${vulnPkg.advisories.length === 1 ? "y" : "ies"} at ${pkg}@${vulnPkg.version}:`));
+      for (const adv of vulnPkg.advisories) {
+        const cve = adv.aliases.find((a) => a.startsWith("CVE-"));
+        const idLabel = cve && cve !== adv.id ? `${adv.id} (${cve})` : adv.id;
+        const cvss = adv.cvss != null ? ` cvss ${adv.cvss}` : "";
+        const fixed = adv.fixedVersions.length ? ` \u2014 fixed in ${adv.fixedVersions.join(", ")}` : " \u2014 no fix available";
+        info(`    ${severityTag(adv.severity)} ${idLabel}${c.dim(cvss)}${c.dim(fixed)}`);
+        if (adv.introduced) {
+          const exposure = adv.exposureDays != null ? `, ${adv.exposureDays}d exposed` : "";
+          info(
+            c.dim(
+              `        introduced by ${adv.introduced.authorName} in ${adv.introduced.shortSha} on ${adv.introduced.date.slice(0, 10)}${exposure}`
+            )
+          );
+        }
+      }
+    } else if (artifact?.extended?.vulnerabilities) {
+      info("");
+      info(c.green("  no known vulnerabilities for this package in the last scan"));
+    } else {
+      info("");
+      info(c.dim("  run `vg scan --vulns` to check this package for known vulnerabilities"));
+    }
+  });
+  applyGlobalOptions(cmd);
+}
+function severityTag(severity) {
+  switch (severity) {
+    case "critical":
+      return c.red("critical");
+    case "high":
+      return c.red("high");
+    case "moderate":
+      return c.yellow("moderate");
+    case "low":
+      return c.dim("low");
+    default:
+      return c.dim(severity);
+  }
+}
+
+// src/commands/bisect.ts
+function registerBisect(program) {
+  const cmd = program.command("bisect").description("pinpoint the commit where a dependency crossed a version line, from git history").argument("<package>", "package name to bisect").argument("<constraint>", 'target version or semver range (a bare version means ">=" that version)').option("--assert", "exit non-zero when the current version does not satisfy the constraint (CI gate)").action(async function(pkg, constraintArg) {
+    const global = readGlobal(this);
+    const opts = this.opts();
+    const root = rootOf(global);
+    if (!await gitHistoryAvailable(root)) {
+      throw new CliError(
+        "git history is required for `vg bisect` (not a git repository, or git is unavailable)",
+        ExitCode.USAGE_ERROR
+      );
+    }
+    const range = normalizeConstraint(constraintArg);
+    if (!range) {
+      throw new CliError(
+        `not a valid version or semver range: ${constraintArg}`,
+        ExitCode.USAGE_ERROR
+      );
+    }
+    const timelines = await buildVersionTimelines(root);
+    const pt = timelines ? findPackageAnyEcosystem(timelines, pkg) ?? null : null;
+    if (!pt || pt.changes.length === 0) {
+      if (global.json) {
+        json({ package: pkg, constraint: range, found: false, satisfiedNow: false, crossings: [] });
+        return;
+      }
+      info(`${c.cyan("vg bisect")} ${c.bold(pkg)} ${c.dim(range)}`);
+      info(c.dim("  no git history found for this package (lockfile). It may not be a resolved"));
+      info(c.dim("  dependency in a supported ecosystem, or the lockfile predates its introduction."));
+      throw new CliError(`no version history for ${pkg}`, ExitCode.NOT_FOUND);
+    }
+    const crossings = findVersionCrossings(pt, range);
+    const current = pt.changes[pt.changes.length - 1];
+    const satisfiedNow = versionSatisfies(current.version, range);
+    const firstEntered = crossings.find((cr) => cr.kind === "entered") ?? null;
+    if (global.json) {
+      json({
+        package: pt.name,
+        ecosystem: pt.ecosystem,
+        constraint: range,
+        currentVersion: current.version,
+        satisfiedNow,
+        firstEntered,
+        crossings
+      });
+    } else {
+      info(`${c.cyan("vg bisect")} ${c.bold(pt.name)} ${c.dim(range)}`);
+      const verdict = satisfiedNow ? c.green(`current ${current.version} satisfies ${range}`) : c.yellow(`current ${current.version} does not satisfy ${range}`);
+      info(`  ${verdict}`);
+      info("");
+      if (!firstEntered) {
+        info(c.dim(`  never crossed ${range} in git history`));
+        info(
+          c.dim(
+            `  latest in history: ${current.version} ${c.dim(`(${current.commit.shortSha} ${current.commit.date.slice(0, 10)})`)}`
+          )
+        );
+      } else {
+        info(`  ${c.bold("first reached")} ${range}:`);
+        printCrossing(firstEntered, true);
+        const rest = crossings.slice(crossings.indexOf(firstEntered) + 1);
+        if (rest.length) {
+          info("");
+          info(c.dim(`  ${rest.length} later crossing${rest.length === 1 ? "" : "s"}:`));
+          for (const cr of rest) printCrossing(cr, false);
+        }
+      }
+    }
+    if (opts.assert && !satisfiedNow) {
+      throw new CliError(
+        `${pt.name}@${current.version} does not satisfy ${range}`,
+        ExitCode.GATE_FAILED
+      );
+    }
+  });
+  applyGlobalOptions(cmd);
+}
+function printCrossing(cr, primary) {
+  const arrow = cr.kind === "entered" ? c.green("\u2192") : c.yellow("\u2193");
+  const date = cr.commit.date.slice(0, 10);
+  const from = cr.previousVersion ? c.dim(` from ${cr.previousVersion}`) : c.dim(" (added)");
+  const ver = primary ? c.bold(cr.version) : cr.version;
+  info(`    ${arrow} ${ver}${from} ${c.dim(`${cr.commit.shortSha} ${date} ${cr.commit.authorName}`)}`);
+  info(c.dim(`        ${cr.commit.subject}`));
+}
+var STANDARDS_FILES = [".vibgrate/standards.json", "vibgrate.standards.json"];
+function asString(v) {
+  return typeof v === "string" && v.trim() ? v.trim() : void 0;
+}
+function normalizeStandards(raw) {
+  const list = Array.isArray(raw) ? raw : Array.isArray(raw?.banned) ? raw.banned : [];
+  const seen = /* @__PURE__ */ new Set();
+  const banned = [];
+  for (const item of list) {
+    if (!item || typeof item !== "object") continue;
+    const r = item;
+    const name = asString(r.name);
+    if (!name) continue;
+    const ecosystem = asString(r.ecosystem)?.toLowerCase();
+    const key = `${ecosystem ?? "*"}\0${name.toLowerCase()}`;
+    if (seen.has(key)) continue;
+    seen.add(key);
+    banned.push({ name, ...ecosystem ? { ecosystem } : {}, ...asString(r.use) ? { use: asString(r.use) } : {}, ...asString(r.reason) ? { reason: asString(r.reason) } : {} });
+  }
+  return { banned };
+}
+function loadStandards(root) {
+  for (const rel2 of STANDARDS_FILES) {
+    const p = path9__default.join(root, rel2);
+    let text;
+    try {
+      text = fs4__default.readFileSync(p, "utf8");
+    } catch {
+      continue;
+    }
+    try {
+      return { policy: normalizeStandards(JSON.parse(text)), path: p };
+    } catch {
+      return { policy: null, path: p };
+    }
+  }
+  return { policy: null, path: null };
+}
+function checkStandards(policy, records) {
+  const out2 = [];
+  for (const r of records) {
+    const rule = policy.banned.find((b) => b.name.toLowerCase() === r.name.toLowerCase() && (!b.ecosystem || b.ecosystem === r.ecosystem));
+    if (rule) out2.push({ ecosystem: r.ecosystem, name: r.name, installed: r.installed ?? null, use: rule.use ?? null, reason: rule.reason ?? null });
+  }
+  return out2.sort((a, b) => a.ecosystem.localeCompare(b.ecosystem) || a.name.localeCompare(b.name));
+}
+
+// src/commands/drift.ts
+function registerDrift(program) {
+  const cmd = program.command("drift").description("what is outdated across dependencies (offline; --online for currency)").option("--online", "query the npm registry for latest versions (opt-in network)").option("--fail-on <level>", "exit 2 on violations \u2014 major|minor (version drift) or standards (enterprise policy)").action(async function(opts) {
+    const global = readGlobal(this);
+    const root = rootOf(global);
+    if (opts.online && global.local) {
+      throw new CliError("--online conflicts with --local (no network in local mode)", ExitCode.USAGE_ERROR);
+    }
+    if (opts.failOn && !["major", "minor", "standards"].includes(opts.failOn)) {
+      throw new CliError(`--fail-on must be one of: major, minor, standards (got "${opts.failOn}")`, ExitCode.USAGE_ERROR);
+    }
+    const inv = inventory(root);
+    if (opts.online && !global.local) await enrichOnline(inv.records);
+    let standards = null;
+    if (opts.failOn === "standards") {
+      const loaded = loadStandards(root);
+      if (loaded.path && !loaded.policy) {
+        throw new CliError(`standards policy at ${loaded.path} is not valid JSON`, ExitCode.USAGE_ERROR);
+      }
+      standards = { policyPath: loaded.path, defined: !!loaded.policy, violations: loaded.policy ? checkStandards(loaded.policy, inv.records) : [] };
+    }
+    if (global.json) {
+      json(standards ? { ...inv, standards } : inv);
+    } else {
+      const breakdown = ECOSYSTEMS.filter((e) => inv.counts[e] > 0).map((e) => `${e} ${inv.counts[e]}`).join(" \xB7 ");
+      info(`${c.cyan("vg drift")} \xB7 ${inv.counts.total} dependencies${breakdown ? ` (${breakdown})` : ""}`);
+      if (opts.online) {
+        const drifted = inv.records.filter((r) => r.drift && r.drift !== "current" && r.drift !== "unknown");
+        if (drifted.length === 0) info(c.green("  all checked dependencies are current"));
+        for (const r of drifted.sort((a, b) => rank(b.drift) - rank(a.drift))) {
+          const tag = r.drift === "major" ? c.red("major") : r.drift === "minor" ? c.yellow("minor") : c.dim("patch");
+          info(`  ${tag} ${r.name} ${c.dim(`${r.installed} \u2192 ${r.latest}`)}`);
+        }
+      } else {
+        info(c.dim("  offline inventory \u2014 run with --online for currency vs the npm registry"));
+        info(c.dim("  CVE/EOL/governance: the Vibgrate platform (vg push)"));
+      }
+      if (standards) printStandards(standards);
+    }
+    if (standards && standards.violations.length) {
+      throw new CliError(`${standards.violations.length} banned dependency(ies) violate standards`, ExitCode.GATE_FAILED);
+    }
+    if (opts.failOn && opts.failOn !== "standards") {
+      const threshold = opts.failOn === "minor" ? 2 : 3;
+      const bad = inv.records.filter((r) => rank(r.drift) >= threshold);
+      if (bad.length) {
+        throw new CliError(`${bad.length} dependency(ies) drift at/above ${opts.failOn}`, ExitCode.GATE_FAILED);
+      }
+    }
+  });
+  applyGlobalOptions(cmd);
+}
+function rank(drift) {
+  return drift === "major" ? 3 : drift === "minor" ? 2 : drift === "patch" ? 1 : 0;
+}
+function printStandards(s) {
+  if (!s.defined) {
+    info(c.dim(`  no standards policy (${STANDARDS_FILES.join(" or ")}) \u2014 nothing to enforce`));
+    return;
+  }
+  if (s.violations.length === 0) {
+    info(c.green("  standards: no banned dependencies in use"));
+    return;
+  }
+  info(c.red(`  standards: ${s.violations.length} banned dependency(ies)`));
+  for (const v of s.violations) {
+    const fix = v.use ? c.dim(` \u2192 use ${v.use}`) : "";
+    const why = v.reason ? c.dim(` (${v.reason})`) : "";
+    info(`    ${c.red("banned")} ${v.ecosystem}:${v.name}${v.installed ? c.dim(` ${v.installed}`) : ""}${fix}${why}`);
+  }
+}
+
+// src/commands/models.ts
+function registerModels(program) {
+  const cmd = program.command("models").description("the local model fleet (Ollama / LM Studio / gguf), discovered offline").action(function() {
+    const global = readGlobal(this);
+    const models = discoverModels();
+    if (global.json) {
+      json({ models });
+      return;
+    }
+    info(`${c.cyan("vg models")} \xB7 ${models.length} local model(s) discovered`);
+    if (models.length === 0) {
+      info(c.dim("  none found (looked in ~/.ollama, ~/.lmstudio, ~/models, ~/.cache)"));
+      return;
+    }
+    for (const m of models) info(`  ${c.bold(m.runtime.padEnd(10))} ${m.name}`);
+  });
+  applyGlobalOptions(cmd);
+}
+
+// src/commands/savings.ts
+function registerSavings(program) {
+  const cmd = program.command("savings").description("local, privacy-safe report of tokens/$ saved vs a grep baseline (estimates)").option("--days <n>", "window in days", "30").action(function() {
+    const global = readGlobal(this);
+    const days = Number(this.opts().days) || 30;
+    const report = readSavings(rootOf(global), days, Date.now());
+    if (global.json) {
+      json(report);
+      return;
+    }
+    info(`${c.cyan("vg savings")} \xB7 last ${days} days ${c.dim("(local, nothing left your machine)")}`);
+    if (!report.enabled && report.queries === 0) {
+      info(c.dim("  recording is off. Enable with `vg serve --savings`, then query via MCP."));
+      return;
+    }
+    if (report.queries === 0) {
+      info(c.dim("  no queries recorded yet in this window"));
+      return;
+    }
+    info(`  queries ${report.queries} \xB7 context tokens ${fmt(report.vgTokens)}  (grep/read baseline \u2248 ${fmt(report.baselineTokens)})  \u2192 ${report.ratio}\xD7 fewer`);
+    info(`  est. cost (${report.rateLabel}): $${report.estCostVg} vs $${report.estCostBaseline}  \u2192 saved \u2248 $${report.saved}`);
+    info(c.dim("  estimates with stated assumptions (~4 chars/token; ~400 tokens/file baseline); scales with repo size."));
+  });
+  applyGlobalOptions(cmd);
+}
+function fmt(n) {
+  if (n >= 1e6) return `${(n / 1e6).toFixed(2)}M`;
+  if (n >= 1e3) return `${(n / 1e3).toFixed(1)}k`;
+  return String(n);
+}
+function registerLib(program) {
+  const cmd = program.command("lib").description("library currency: version-correct, drift-annotated usage docs").argument("[args...]", "a library name, or: add <source> | publish <name> | resolve <name> | refresh").option("--name <name>", "library name for `add`").option("--version <v>", "pin the doc version for `add`/`publish`").option("--online", "(deprecated; network is on by default) allow network for add/refresh URL sources").option("-b, --budget <n>", "trim docs to ~N tokens").option("--readme <path>", "README path for `publish` (default ./README.md)").option("--dts <path>", "TypeScript declaration (.d.ts) path for `publish`").option("--language <lang>", "primary language for `publish`").option("--region <region>", "data-residency region for the hosted catalog (same as scans; default us)").option("--ingest <url>", "hosted catalog/ingest URL override (host extracted; wins over --region)").action(async function(args, opts) {
+    const global = readGlobal(this);
+    const root = rootOf(global);
+    const [verb, ...rest] = args;
+    const network = !global.local;
+    if (!verb) return listCatalog(root, global.json);
+    const online = (Boolean(opts.online) || network) && !global.local;
+    if (verb === "add") return addCmd(root, rest, { ...opts, online }, global.json);
+    if (verb === "publish") return publishCmd(root, rest, opts, global, global.json);
+    if (verb === "resolve") return resolveCmd(root, rest, global.json);
+    if (verb === "refresh") return refreshCmd(root, { online }, global.json);
+    return showCmd(root, args.join(" "), opts.budget ? Number(opts.budget) : void 0, global.json, {
+      online: network,
+      // hosted-on-miss allowed unless --local
+      region: opts.region,
+      ingest: opts.ingest
+    });
+  });
+  applyGlobalOptions(cmd);
+}
+function listCatalog(root, asJson) {
+  const catalog = loadCatalog(root);
+  const libs = Object.values(catalog.libraries).sort((a, b) => a.name.localeCompare(b.name));
+  if (asJson) {
+    json(libs.map((l) => ({ id: l.id, name: l.name, version: l.version, source: l.source.type })));
+    return;
+  }
+  info(`${c.cyan("vg lib")} \xB7 ${libs.length} library(ies) in the catalog`);
+  for (const l of libs) {
+    const d = driftFor(root, l);
+    const tag = d.drift === "behind" ? c.yellow(" (docs behind your version)") : d.drift === "ahead" ? c.dim(" (docs ahead)") : "";
+    info(`  ${c.bold(l.name)} ${c.dim(`@${l.version}`)} ${c.dim(`[${l.source.type}]`)}${tag}`);
+  }
+  if (!libs.length) info(c.dim("  empty \u2014 add docs with `vg lib add <path|url>`"));
+}
+async function addCmd(root, rest, opts, asJson) {
+  const source = rest[0];
+  if (!source) throw usageError("usage: vg lib add <path|url|git> [--name <name>] [--version <v>] [--online]");
+  let entry;
+  try {
+    entry = await addLibrary(source, { root, name: opts.name, version: opts.version, allowNetwork: opts.online });
+  } catch (err) {
+    throw new CliError(err.message, ExitCode.ERROR);
+  }
+  if (asJson) {
+    json(entry);
+    return;
+  }
+  info(`${c.green("\u2714")} added ${c.bold(entry.name)} ${c.dim(`@${entry.version}`)} (${entry.bytes} bytes) \u2192 ${entry.docFile}`);
+}
+function readPackageVersion(root) {
+  try {
+    const pkg = JSON.parse(fs4__default.readFileSync(path9__default.join(root, "package.json"), "utf8"));
+    return typeof pkg.version === "string" ? pkg.version : void 0;
+  } catch {
+    return void 0;
+  }
+}
+function readOptionalFile(p) {
+  try {
+    const t = fs4__default.readFileSync(p, "utf8");
+    return t.trim() ? t : void 0;
+  } catch {
+    return void 0;
+  }
+}
+async function publishCmd(root, rest, opts, global, asJson) {
+  if (global.local) throw usageError("vg lib publish uploads to the hosted catalog \u2014 it needs network (remove --local)");
+  const name = (rest.join(" ") || opts.name || "").trim();
+  if (!name) throw usageError("usage: vg lib publish <name> [--version <v>] [--readme <path>] [--dts <path>] [--language <lang>]");
+  const dsn = resolveDsn();
+  const parsed = dsn ? parseDsn$1(dsn) : null;
+  if (!parsed) throw new CliError("publishing a private library requires a DSN \u2014 run `vibgrate login` or set VIBGRATE_DSN", ExitCode.USAGE_ERROR);
+  const version = (opts.version || readPackageVersion(root) || "").trim();
+  if (!version) throw usageError("a --version is required (or run from a package whose package.json has a version)");
+  const readme = readOptionalFile(opts.readme ? path9__default.resolve(opts.readme) : path9__default.join(root, "README.md"));
+  const dts = opts.dts ? readOptionalFile(path9__default.resolve(opts.dts)) : void 0;
+  if (!readme && !dts) throw usageError("nothing to publish \u2014 no README.md found and no --dts given");
+  const result = await publishPrivateLibrary(
+    { name, version, readme, dts, language: opts.language },
+    { region: opts.region, ingest: opts.ingest, auth: { keyId: parsed.keyId, secret: parsed.secret } }
+  );
+  if (!result.ok) {
+    const msg = result.message || result.error || `publish failed (HTTP ${result.status})`;
+    const code = result.status === 402 ? ExitCode.GATE_FAILED : result.status === 401 ? ExitCode.USAGE_ERROR : ExitCode.ERROR;
+    throw new CliError(msg, code);
+  }
+  if (asJson) {
+    json(result);
+    return;
+  }
+  info(`${c.green("\u2714")} published ${c.bold(name)} ${c.dim(`@${version}`)} \xB7 ${result.entities} entities \xB7 ${result.indexedTokens} tokens indexed (MCP-token meter)`);
+  info(c.dim(`  private to your workspace \xB7 targetId ${result.targetId}`));
+}
+function resolveCmd(root, rest, asJson) {
+  const name = rest.join(" ");
+  if (!name) throw usageError("usage: vg lib resolve <name>");
+  const entry = resolveLib(loadCatalog(root), name);
+  if (!entry) throw new CliError(`no library matches "${name}" (id ${libId(name)})`, ExitCode.NOT_FOUND);
+  if (asJson) json({ id: entry.id, name: entry.name, version: entry.version });
+  else info(`${entry.id} ${c.dim(`(${entry.name}@${entry.version})`)}`);
+}
+async function refreshCmd(root, opts, asJson) {
+  const catalog = loadCatalog(root);
+  const results = [];
+  for (const entry of Object.values(catalog.libraries)) {
+    try {
+      await addLibrary(entry.source.location, { root, name: entry.name, version: entry.version, allowNetwork: opts.online });
+      results.push({ name: entry.name, ok: true });
+    } catch {
+      results.push({ name: entry.name, ok: false });
+    }
+  }
+  if (asJson) json({ refreshed: results });
+  else info(`${c.cyan("vg lib refresh")} \xB7 ${results.filter((r) => r.ok).length}/${results.length} re-ingested`);
+}
+async function showCmd(root, name, budget, asJson, opts = {}) {
+  const online = opts.online;
+  const catalog = loadCatalog(root);
+  const entry = resolveLib(catalog, name);
+  const ver = resolveVersion(root, name);
+  const displayName = entry?.name ?? name;
+  let localDoc;
+  let docVersion = ver.served ?? "*";
+  let docSource;
+  let drift;
+  if (entry) {
+    localDoc = readDoc(root, entry);
+    docVersion = entry.version;
+    drift = driftFor(root, entry);
+  } else {
+    const local = localPackageDocs(root, name);
+    if (local) {
+      localDoc = local.docs;
+      docVersion = local.version ?? ver.served ?? "*";
+      docSource = local.source;
+    }
+  }
+  const apiSurface = localApiSurface(root, displayName);
+  const quality = localDoc !== void 0 ? assessDocQuality([localDoc, apiSurface].filter(Boolean).join("\n\n"), { name: displayName, symbols: symbolsFromApi(apiSurface) }) : { sufficient: false, score: 0, reasons: ["no local docs"] };
+  let hosted = null;
+  if (online && !quality.sufficient) {
+    const dsn = resolveDsn();
+    const parsed = dsn ? parseDsn$1(dsn) : null;
+    hosted = await fetchHostedDocs(
+      { name: displayName, query: name, maxTokens: budget },
+      { region: opts.region, ingest: opts.ingest, auth: parsed ? { keyId: parsed.keyId, secret: parsed.secret } : void 0 }
+    );
+  }
+  if (localDoc === void 0 && !hosted) {
+    throw new CliError(
+      `no library docs for "${name}" \u2014 add with \`vg lib add <path|url> --name ${name}\` or install the package${online ? "" : " (or retry with --online for the hosted catalog)"}`,
+      ExitCode.NOT_FOUND
+    );
+  }
+  let doc;
+  if (hosted) {
+    doc = hosted.content;
+    docSource = "hosted";
+    docVersion = hosted.version ?? docVersion;
+  } else {
+    doc = selectForBudget({ readme: localDoc, apiSurface, budget }).text;
+  }
+  if (asJson) {
+    json({
+      id: entry?.id,
+      name: displayName,
+      version: docVersion,
+      source: docSource ?? "catalog",
+      drift: drift ?? null,
+      version_mismatch: ver.mismatch ?? null,
+      quality: { sufficient: quality.sufficient, score: quality.score, reasons: quality.reasons },
+      escalate: quality.sufficient ? null : "hosted",
+      escalated: Boolean(hosted),
+      docs: doc
+    });
+    return;
+  }
+  info(`${c.cyan("vg lib")} \xB7 ${c.bold(displayName)} ${c.dim(`@${docVersion}`)}${docSource ? c.dim(` (from ${docSource})`) : ""}`);
+  if (ver.mismatch) info(c.yellow(`  \u26A0 ${ver.mismatch.note}`));
+  if (hosted) info(c.green("  \u2714 local docs were thin \u2014 served richer docs from the hosted catalog"));
+  else if (!quality.sufficient) info(c.yellow(`  \u26A0 local docs look thin (${quality.reasons.join(", ")})${online ? " \u2014 hosted catalog had nothing better" : " \u2014 run without --local for the hosted catalog"}`));
+  if (drift?.drift === "behind") info(c.yellow(`  \u26A0 docs are for ${drift.cataloged}, but your installed version is ${drift.installed} \u2014 refresh the docs`));
+  else if (drift?.drift === "current") info(c.green(`  \u2714 docs match your installed version (${drift.installed})`));
+  info("");
+  out(doc);
+}
+function registerExport(program) {
+  const cmd = program.command("export").description("export the map (format inferred: json|ndjson|graphml|dot|cypher|md|html|cdx.json|spdx.json)").argument("[file]", "target file (or - for stdout)", "map.json").action(function(file) {
+    const global = readGlobal(this);
+    const { graph } = requireGraph(global);
+    const root = rootOf(global);
+    const format = detectFormat(file);
+    if (!format) throw usageError(`unknown export format for "${file}"`);
+    const needsDeps = format === "cyclonedx" || format === "spdx";
+    const content = exportGraph(format, {
+      graph,
+      deps: needsDeps ? inventory(root).records : void 0,
+      models: needsDeps && !global.local ? discoverModels() : void 0,
+      generatedAt: graph.generatedAt
+    });
+    if (file === "-") {
+      out(content.trimEnd());
+      return;
+    }
+    fs4.mkdirSync(path9.dirname(path9.resolve(file)), { recursive: true });
+    fs4.writeFileSync(file, content);
+    info(`${c.green("\u2714")} wrote ${file} ${c.dim(`(${format})`)}`);
+  });
+  applyGlobalOptions(cmd);
+}
+function detectFormat(file) {
+  const lower = file.toLowerCase();
+  if (lower.endsWith(".cdx.json")) return "cyclonedx";
+  if (lower.endsWith(".spdx.json")) return "spdx";
+  if (file === "-") return "json";
+  return formatForExt(path9.extname(file));
+}
+function registerBundle(program) {
+  const cmd = program.command("bundle").description("build an air-gapped bundle (grammars + graph + library catalog)").option("--offline", "offline bundle (default; present for clarity)").option("-o, --out <dir>", "output directory", "vg-bundle").action(function(opts) {
+    const global = readGlobal(this);
+    const root = rootOf(global);
+    const outDir = path9.resolve(root, opts.out ?? "vg-bundle");
+    let grammarFiles;
+    try {
+      grammarFiles = resolvedGrammarFiles();
+    } catch {
+      throw new CliError("no grammars found to bundle (run a build first)", ExitCode.ERROR);
+    }
+    fs4.mkdirSync(path9.join(outDir, "grammars"), { recursive: true });
+    let grammarCount = 0;
+    for (const { fileName, absPath } of grammarFiles) {
+      fs4.copyFileSync(absPath, path9.join(outDir, "grammars", fileName));
+      grammarCount++;
+    }
+    const included = [`grammars/ (${grammarCount} .wasm)`];
+    const graphSrc = global.graph ?? defaultGraphPath(root);
+    if (fs4.existsSync(graphSrc)) {
+      fs4.copyFileSync(graphSrc, path9.join(outDir, "graph.json"));
+      included.push("graph.json");
+    }
+    const cat = catalogPath(root);
+    if (fs4.existsSync(cat)) {
+      fs4.copyFileSync(cat, path9.join(outDir, "vibgrate.lib.json"));
+      included.push("vibgrate.lib.json");
+      if (fs4.existsSync(libDir(root))) {
+        fs4.cpSync(libDir(root), path9.join(outDir, "lib"), { recursive: true });
+        included.push("lib/");
+      }
+    }
+    const manifest = {
+      tool: "vg",
+      version: VERSION,
+      grammars: grammarSetVersion(),
+      grammarCount,
+      included,
+      usage: "Run `vg build --grammars <this dir>/grammars` to build fully offline."
+    };
+    fs4.writeFileSync(path9.join(outDir, "MANIFEST.json"), `${stableStringify(manifest, 2)}
+`);
+    if (global.json) {
+      json({ out: path9.relative(root, outDir), ...manifest });
+      return;
+    }
+    info(`${c.cyan("vg bundle")} \xB7 wrote ${path9.relative(root, outDir)}/`);
+    for (const i of included) info(`  ${c.green("\u2714")} ${i}`);
+    info(c.dim(`  offline: vg build --grammars "${path9.relative(root, outDir)}/grammars"`));
+  });
+  applyGlobalOptions(cmd);
+}
+var initCommand = new Command("init").description("Initialize vibgrate in a project").argument("[path]", "Path to initialize", ".").option("--baseline", "Create initial baseline after init").option("--yes", "Skip confirmation prompts").action(async (targetPath, opts) => {
+  const rootDir = path9.resolve(targetPath);
+  const vibgrateDir2 = path9.join(rootDir, ".vibgrate");
+  await ensureDir(vibgrateDir2);
+  console.log(chalk5.green("\u2714") + ` Created ${chalk5.bold(".vibgrate/")} directory`);
+  const configPath = path9.join(rootDir, "vibgrate.config.ts");
+  if (await pathExists(configPath)) {
+    console.log(chalk5.dim("  vibgrate.config.ts already exists, skipping"));
+  } else {
+    await writeDefaultConfig(rootDir);
+    console.log(chalk5.green("\u2714") + ` Created ${chalk5.bold("vibgrate.config.ts")}`);
+  }
+  if (opts.baseline) {
+    const { runBaseline } = await import('./baseline-ZBXJONQ6.js');
+    await runBaseline(rootDir);
+  }
+  console.log("");
+  console.log(chalk5.bold("Next steps:"));
+  console.log(`  ${chalk5.cyan("vibgrate scan")}            Scan for upgrade drift`);
+  console.log(`  ${chalk5.cyan("vibgrate baseline")}        Create a drift baseline`);
+  console.log("");
+});
+
+// src/reporting/utils/ingest-id-output.ts
+function emitIngestIdLine(ingestId, options) {
+  console.log(`VIBGRATE_INGEST_ID=${ingestId}`);
+  if (options?.unchanged) {
+    console.log("VIBGRATE_INGEST_UNCHANGED=1");
+  }
+}
+function emitDriftScoreLine(score) {
+  if (process.env.VIBGRATE_EMIT_MARKERS !== "1") return;
+  console.log(`VIBGRATE_DRIFT_SCORE=${score}`);
+}
+var AI_ASSISTANT_DETECTORS = [
+  { files: ["CLAUDE.md", ".claude"], name: "claude" },
+  { files: [".cursor", ".cursorrules"], name: "cursor" },
+  { files: [".windsurf"], name: "windsurf" },
+  { files: [".github/copilot-instructions.md", ".copilot"], name: "copilot" },
+  { files: [".gemini"], name: "gemini" },
+  { files: [".continuerc.json"], name: "continue" },
+  { files: [".codex"], name: "codex" }
+];
+async function detectAiAssistant(rootDir) {
+  for (const detector of AI_ASSISTANT_DETECTORS) {
+    for (const file of detector.files) {
+      if (await pathExists$1(path9.join(rootDir, file))) {
+        return detector.name;
+      }
+    }
+  }
+  return null;
+}
+function printAiContextPrompt(detectedAssistant) {
+  const teal2 = chalk5.hex("#3FB0A4");
+  const mint2 = chalk5.hex("#4FE3C1");
+  const installCmd = detectedAssistant ? `vg install ${detectedAssistant}` : "vg install --all";
+  const detectedNote = detectedAssistant ? chalk5.dim(`  (${detectedAssistant} config detected)`) : "";
+  console.log("");
+  console.log(teal2("  \u256D\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u256E"));
+  console.log(teal2("  \u2502") + "  " + mint2("\u25C6") + "  " + chalk5.bold.white("Get AI-aware answers in your editor") + "          " + teal2("\u2502"));
+  console.log(teal2("  \u2570\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u256F"));
+  console.log("");
+  console.log("  " + chalk5.bold.white(installCmd) + detectedNote);
+  console.log("");
+  console.log("  " + teal2("\xB7") + " " + chalk5.white("Code map in your assistant") + chalk5.dim(" \u2014 call trees, impact surfaces, import paths"));
+  console.log("  " + teal2("\xB7") + " " + chalk5.white("Offline drift") + chalk5.dim(" \u2014 DriftScore and upgrade priorities, right inside your editor"));
+  console.log("  " + teal2("\xB7") + " " + chalk5.white("Version-correct library docs") + chalk5.dim(" \u2014 pinned to your lockfile, no hallucinated APIs"));
+  console.log("");
+}
+
+// src/reporting/commands/scan.ts
+async function autoPush(artifact, rootDir, opts) {
+  const dsn = resolveDsn(opts.dsn);
+  if (!dsn) {
+    console.error(chalk5.red("No DSN provided for push."));
+    console.error(chalk5.dim('Run "vibgrate login", set VIBGRATE_DSN, or use the --dsn flag.'));
+    if (opts.strict) process.exit(1);
+    return;
+  }
+  const parsed = parseDsn(dsn);
+  if (!parsed) {
+    console.error(chalk5.red("Invalid DSN format."));
+    if (opts.strict) process.exit(1);
+    return;
+  }
+  const { body, contentEncoding } = await prepareCompressedUpload(artifact);
+  const timestamp = String(Date.now());
+  let host = parsed.host;
+  if (opts.region) {
+    try {
+      host = resolveIngestHost(opts.region);
+    } catch (e) {
+      console.error(chalk5.red(e instanceof Error ? e.message : String(e)));
+      if (opts.strict) process.exit(1);
+      return;
+    }
+  }
+  const originalSize = JSON.stringify(artifact).length;
+  const compressedSize = body.length;
+  const ratio = ((1 - compressedSize / originalSize) * 100).toFixed(0);
+  console.log(chalk5.dim(`Uploading to ${host}... (${(compressedSize / 1024).toFixed(0)} KB, ${ratio}% smaller)`));
+  try {
+    const { response, host: uploadedHost } = await uploadScanArtifact({
+      scheme: parsed.scheme,
+      host,
+      keyId: parsed.keyId,
+      secret: parsed.secret,
+      body,
+      contentEncoding,
+      timestamp,
+      force: opts.force
+    });
+    host = uploadedHost;
+    if (!response.ok) {
+      const text = await response.text();
+      throw new Error(`HTTP ${response.status}: ${text}`);
+    }
+    const result = await response.json();
+    if (result.unchanged) {
+      console.log(
+        chalk5.green("\u2714") + ` Repository unchanged since ${result.lastScannedAt ?? "last scan"} \u2014 skipped upload (no credit used).`
+      );
+      if (result.previousIngestId) {
+        emitIngestIdLine(result.previousIngestId, { unchanged: true });
+        const dashUrl = `https://${dashHostForIngestHost(host)}/${parsed.workspaceId}/scan/${result.previousIngestId}`;
+        console.log(chalk5.dim(`  Previous report: ${dashUrl}`));
+      } else if (opts.strict) {
+        console.error(chalk5.red("Repository unchanged but no previous ingest id returned."));
+        process.exit(1);
+      }
+      return;
+    }
+    console.log(chalk5.green("\u2714") + ` Scan queued for processing (${result.ingestId ?? "ok"})`);
+    if (result.ingestId) {
+      emitIngestIdLine(result.ingestId);
+      const dashUrl = `https://${dashHostForIngestHost(host)}/${parsed.workspaceId}/scan/${result.ingestId}`;
+      const CLEAR_LINE = process.platform === "win32" ? "\x1B[0G\x1B[2K" : "";
+      console.log("");
+      console.log(CLEAR_LINE + chalk5.dim("  Processing continues in the background. Results available shortly."));
+      console.log("");
+      console.log(CLEAR_LINE + chalk5.cyan("\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500"));
+      console.log(CLEAR_LINE + chalk5.bold("  \u{1F4CA} View Scan Report"));
+      console.log(CLEAR_LINE + "  " + chalk5.underline.cyan(dashUrl));
+      console.log(CLEAR_LINE + chalk5.cyan("\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500"));
+      console.log("");
+      console.log("");
+    }
+  } catch (e) {
+    const msg = e instanceof Error ? e.message : String(e);
+    console.error(chalk5.red(`Upload failed: ${msg}`));
+    if (opts.strict) process.exit(1);
+  }
+}
+function collectExcludes(value, previous) {
+  return [...previous, ...parseExcludePatterns(value)];
+}
+function reportStandards(rootDir) {
+  const loaded = loadStandards(rootDir);
+  if (!loaded.policy) return;
+  const violations = checkStandards(loaded.policy, inventory(rootDir).records);
+  if (violations.length === 0) {
+    console.log(chalk5.green("\u2714") + " Standards: no banned dependencies in use");
+    return;
+  }
+  console.log(chalk5.red(`
+\u26A0 Standards: ${violations.length} banned dependency(ies) in use`));
+  for (const v of violations) {
+    const fix = v.use ? chalk5.dim(` \u2192 use ${v.use}`) : "";
+    const why = v.reason ? chalk5.dim(` (${v.reason})`) : "";
+    console.log(`  ${chalk5.red("banned")} ${v.ecosystem}:${v.name}${v.installed ? chalk5.dim(` ${v.installed}`) : ""}${fix}${why}`);
+  }
+}
+function parseNonNegativeNumber(value, label) {
+  if (value === void 0) return void 0;
+  const parsed = Number(value);
+  if (!Number.isFinite(parsed) || parsed < 0) {
+    throw new Error(`${label} must be a non-negative number.`);
+  }
+  return parsed;
+}
+var scanCommand = new Command("scan").description("Scan a project for upgrade drift").argument("[path]", "Path to scan", ".").option("--out <file>", "Output file path").option("--format <format>", "Output format (text|json|sarif|md)", "text").option("--fail-on <level>", "Fail on warn or error").option("--baseline <file>", "Compare against baseline").option("--changed-only", "Only scan changed files").option(
+  "-e, --exclude <glob>",
+  'Exclude paths matching a glob pattern. Repeatable, and a single value may list several patterns separated by commas or semicolons (e.g. --exclude "legacy/**,vendor/**"). Merged with excludes from the config file.',
+  collectExcludes,
+  []
+).option("--concurrency <n>", "Max concurrent npm calls", "8").option("--push", "Auto-push results to Vibgrate API after scan").option("--dsn <dsn>", "DSN token for push (or use VIBGRATE_DSN env)").option("--region <region>", "Override data residency region for push (us, eu)").option("--strict", "Fail on push errors").option("--ui-purpose", "Enable optional UI purpose evidence extraction (slower)").option("--no-local-artifacts", "Do not write .vibgrate JSON artifacts to disk").option("--max-privacy", "Enable strongest privacy mode (minimal scanners, no local artifacts)").option("--offline", "Run without network calls; do not upload results").option("--full", "Comprehensive scan: turns on known-vulnerability detection (= --vulns) and, when a standards policy exists, a banned-dependency report \u2014 on top of drift scoring and the code map").option("--vulns", "Also scan installed dependencies for known vulnerabilities (OSV online, or advisories from --package-manifest when offline)").option("--package-manifest <file>", "Use local package-version manifest JSON/ZIP (for offline mode)").option("--project-scan-timeout <seconds>", "Per-project scan timeout in seconds (default: 180)").option("--drift-budget <score>", "Fail if drift score is above budget (0-100)").option("--drift-worsening <percent>", "Fail if drift worsens by more than % since baseline").option("--repository-name <name>", "Override the repository name recorded for this scan (defaults to the directory or package.json name)").option("--force", "Always create a fresh scan ingest, even if the repository is unchanged since the last scan (skips the unchanged/reuse optimization). Used by scheduled and dashboard-triggered scans.").option("--no-graph", "Skip building the local code map (the AI/docs index) that scan produces after scoring drift").action(async (targetPath, opts) => {
+  const rootDir = path9.resolve(targetPath);
+  if (!await pathExists$1(rootDir)) {
+    console.error(chalk5.red(`Path does not exist: ${rootDir}`));
+    process.exit(1);
+  }
+  const hasDsn = !!resolveDsn(opts.dsn);
+  const willPush = !opts.offline && (opts.push || hasDsn);
+  const isFirstRun = !await pathExists$1(path9.join(rootDir, ".vibgrate", "scan_result.json"));
+  let pinnedRegion;
+  if (willPush && hasDsn) {
+    const dsn = resolveDsn(opts.dsn);
+    const parsed = parseDsn(dsn);
+    if (parsed) {
+      const ingestHost = opts.region ? resolveIngestHost(opts.region) : parsed.host;
+      const vcs = await detectVcs(rootDir);
+      const fingerprint = await computeRepoFingerprint(rootDir, vcs);
+      const repositoryName = opts.repositoryName?.trim() || await resolveRepositoryName(rootDir);
+      try {
+        const preflight = await fetchScanPreflight(parsed, ingestHost, {
+          repositoryName,
+          vcsSha: fingerprint.vcsSha
+        });
+        pinnedRegion = preflight.region;
+        if (preflight.vm && !preflight.vm.allowed) {
+          console.error(chalk5.red(preflight.error ?? "VM meter usage exhausted"));
+          console.error(
+            chalk5.dim(
+              `VM minutes: ${preflight.vm.used}/${preflight.vm.limit} (${preflight.plan.label} plan) \u2014 enable overages or upgrade your plan.`
+            )
+          );
+          process.exit(1);
+        }
+        if (preflight.repositories && !preflight.repositories.allowed) {
+          console.error(
+            chalk5.red(
+              preflight.error ?? `Repository limit reached for the ${preflight.plan.label} plan \u2014 cannot scan a new repository.`
+            )
+          );
+          const max = preflight.repositories.max < 0 ? "unlimited" : String(preflight.repositories.max);
+          console.error(
+            chalk5.dim(
+              `Repositories: ${preflight.repositories.total}/${max} (${preflight.plan.label} plan) \u2014 archive a repository or upgrade your plan.`
+            )
+          );
+          if (preflight.upgradeUrl) {
+            console.error(chalk5.dim(`  Upgrade: ${preflight.upgradeUrl}`));
+          }
+          process.exit(1);
+        }
+        if (preflight.status === "error" || !preflight.scans.allowed) {
+          console.error(chalk5.red(preflight.error ?? "Scan ingestion not allowed for this workspace."));
+          console.error(
+            chalk5.dim(
+              `Credits: ${preflight.scans.used}/${preflight.scans.limit} (${preflight.plan.label} plan)`
+            )
+          );
+          if (opts.strict) process.exit(1);
+          process.exit(1);
+        }
+        console.log(
+          chalk5.dim(
+            `Plan: ${preflight.plan.label} \u2014 scan credits ${preflight.scans.used}/${preflight.scans.limit} this month`
+          )
+        );
+        if (preflight.repository?.unchanged && !opts.force) {
+          console.log(
+            chalk5.green("\u2714") + ` Repository unchanged at ${preflight.repository.lastVcsSha?.slice(0, 7) ?? "same revision"} \u2014 skipping scan.`
+          );
+          if (preflight.repository.lastIngestId) {
+            emitIngestIdLine(preflight.repository.lastIngestId, { unchanged: true });
+            const dashUrl = `https://${dashHostForIngestHost(ingestHost)}/${parsed.workspaceId}/scan/${preflight.repository.lastIngestId}`;
+            console.log(chalk5.dim(`  Latest report: ${dashUrl}`));
+          } else if (opts.strict) {
+            console.error(chalk5.red("Repository unchanged but no previous ingest id available."));
+            process.exit(1);
+          }
+          return;
+        }
+      } catch (e) {
+        const msg = e instanceof Error ? e.message : String(e);
+        console.error(chalk5.yellow(`Preflight check failed: ${msg}`));
+        if (opts.strict) process.exit(1);
+      }
+    }
+  }
+  const scanOpts = {
+    vibgrateVersion: VERSION,
+    out: opts.out,
+    format: opts.format || "text",
+    failOn: opts.failOn,
+    baseline: opts.baseline,
+    changedOnly: opts.changedOnly,
+    exclude: opts.exclude,
+    concurrency: parseInt(opts.concurrency, 10) || 8,
+    push: opts.push,
+    dsn: opts.dsn,
+    // An explicit --region wins; otherwise route to the workspace's pinned
+    // region as reported by preflight.
+    region: opts.region ?? pinnedRegion,
+    strict: opts.strict,
+    uiPurpose: opts.uiPurpose,
+    noLocalArtifacts: opts.noLocalArtifacts,
+    maxPrivacy: opts.maxPrivacy,
+    offline: opts.offline,
+    // `--full` is the comprehensive umbrella: it turns on vulnerability scanning.
+    vulns: opts.vulns || opts.full,
+    packageManifest: opts.packageManifest,
+    driftBudget: parseNonNegativeNumber(opts.driftBudget, "--drift-budget"),
+    driftWorseningPercent: parseNonNegativeNumber(opts.driftWorsening, "--drift-worsening"),
+    projectScanTimeout: opts.projectScanTimeout ? parseInt(opts.projectScanTimeout, 10) || void 0 : void 0,
+    repositoryName: opts.repositoryName?.trim() || void 0,
+    force: opts.force
+  };
+  const wantGraph = opts.graph !== false && !opts.maxPrivacy;
+  if (wantGraph) {
+    scanOpts.postScan = async (report) => {
+      const result = await buildGraph({
+        root: rootDir,
+        exclude: opts.exclude,
+        onParseProgress: (done, total) => report(done, total, "parsing")
+      });
+      writeArtifacts(result.graph, { root: rootDir });
+      writeSnapshot(rootDir, result.graph.provenance.corpusHash, result.fileStats, {
+        exclude: opts.exclude
+      });
+      const { counts } = result.graph.meta;
+      return `${counts.nodes.toLocaleString()} nodes \xB7 ${counts.edges.toLocaleString()} edges`;
+    };
+  }
+  const advanced = await loadAdvancedScanHook();
+  const artifact = await runCoreScan(rootDir, scanOpts, advanced);
+  emitDriftScoreLine(artifact.drift.score);
+  if (opts.full) {
+    reportStandards(rootDir);
+  }
+  if (opts.failOn) {
+    const hasErrors = artifact.findings.some((f) => f.level === "error");
+    const hasWarnings = artifact.findings.some((f) => f.level === "warning");
+    if (opts.failOn === "error" && hasErrors) {
+      console.error(chalk5.red(`
+Failing: ${artifact.findings.filter((f) => f.level === "error").length} error finding(s) detected.`));
+      process.exit(2);
+    }
+    if (opts.failOn === "warn" && (hasErrors || hasWarnings)) {
+      console.error(chalk5.red(`
+Failing: findings detected at warn level or above.`));
+      process.exit(2);
+    }
+  }
+  if (scanOpts.driftBudget !== void 0 && artifact.drift.score > scanOpts.driftBudget) {
+    console.error(chalk5.red(`
+Failing fitness function: drift score ${artifact.drift.score}/100 exceeds budget ${scanOpts.driftBudget}.`));
+    process.exit(2);
+  }
+  if (scanOpts.driftWorseningPercent !== void 0) {
+    if (artifact.delta === void 0) {
+      console.error(chalk5.red("\nFailing fitness function: --drift-worsening requires --baseline to compare against previous drift."));
+      process.exit(2);
+    }
+    if (artifact.delta > 0) {
+      const baselineScore = artifact.drift.score - artifact.delta;
+      const denominator = Math.max(Math.abs(baselineScore), 1e-4);
+      const worseningPercent = artifact.delta / denominator * 100;
+      if (worseningPercent > scanOpts.driftWorseningPercent) {
+        console.error(chalk5.red(`
+Failing fitness function: drift worsened by ${worseningPercent.toFixed(2)}% (threshold ${scanOpts.driftWorseningPercent}%).`));
+        process.exit(2);
+      }
+    }
+  }
+  if (willPush) {
+    await autoPush(artifact, rootDir, scanOpts);
+  }
+  const showAiPrompt = scanOpts.format === "text" && !hasDsn && !opts.offline && !opts.noLocalArtifacts && !opts.maxPrivacy && isFirstRun;
+  if (showAiPrompt) {
+    const detectedAssistant = await detectAiAssistant(rootDir);
+    printAiContextPrompt(detectedAssistant);
+  }
+});
+function formatText(artifact) {
+  const lines = [];
+  const teal2 = chalk5.hex("#3FB0A4");
+  const mint2 = chalk5.hex("#4FE3C1");
+  lines.push("");
+  lines.push("   " + teal2("\u256D\u2500\u2500\u2500\u2500\u2500\u2500\u256E") + mint2("\u279C"));
+  lines.push("  " + chalk5.dim("\u2524") + teal2("\u2502") + " " + mint2("\u25FC") + "  " + mint2("\u25FC") + " " + teal2("\u2502") + chalk5.dim("\u251C") + "  " + chalk5.bold.white("vibgrate"));
+  lines.push("  " + chalk5.dim("\u2524") + teal2("\u2502") + "  " + chalk5.dim("\u2581\u2581") + "  " + teal2("\u2502") + chalk5.dim("\u251C") + "  " + chalk5.dim(`Drift Intelligence Engine v${VERSION}`));
+  lines.push("   " + teal2("\u2570\u2500\u2500\u2500\u2500\u2500\u2500\u256F"));
+  lines.push("");
+  lines.push(...titleBox("Vibgrate Drift Report", teal2));
+  lines.push("");
+  for (const project of artifact.projects) {
+    lines.push(chalk5.bold(`  \u2500\u2500 ${project.name} `) + chalk5.dim(`(${project.type}) ${project.path}`));
+    if (project.runtime) {
+      const behindStr = project.runtimeMajorsBehind !== void 0 && project.runtimeMajorsBehind > 0 ? chalk5.yellow(` (${project.runtimeMajorsBehind} major${project.runtimeMajorsBehind > 1 ? "s" : ""} behind)`) : chalk5.green(" (current)");
+      lines.push(`     Runtime: ${project.runtime}${behindStr}`);
+    }
+    if (project.targetFramework) {
+      lines.push(`     Target:  ${project.targetFramework}`);
+    }
+    if (project.frameworks.length > 0) {
+      lines.push("     Frameworks:");
+      for (const fw of project.frameworks) {
+        const lag = fw.majorsBehind !== null ? fw.majorsBehind === 0 ? chalk5.green("current") : chalk5.yellow(`${fw.majorsBehind} behind`) : chalk5.dim("unknown");
+        lines.push(`       ${fw.name}: ${fw.currentVersion ?? "?"} \u2192 ${fw.latestVersion ?? "?"} (${lag})`);
+      }
+    }
+    const b = project.dependencyAgeBuckets;
+    const total = b.current + b.oneBehind + b.twoPlusBehind + b.unknown;
+    if (total > 0) {
+      lines.push("     Dependencies:");
+      lines.push(`       ${chalk5.green(`${b.current} current`)}  ${chalk5.yellow(`${b.oneBehind} 1-behind`)}  ${chalk5.red(`${b.twoPlusBehind} 2+ behind`)}  ${chalk5.dim(`${b.unknown} unknown`)}`);
+    }
+    lines.push("");
+  }
+  if (artifact.delta !== void 0) {
+    const deltaStr = artifact.delta > 0 ? chalk5.red(`+${artifact.delta}`) : artifact.delta < 0 ? chalk5.green(`${artifact.delta}`) : chalk5.dim("0");
+    lines.push(chalk5.bold("  Drift Delta: ") + deltaStr + " (vs baseline)");
+    lines.push("");
+  }
+  if (artifact.extended) {
+    lines.push(...formatExtended(artifact.extended));
+  }
+  if (artifact.findings.length > 0) {
+    const errors = artifact.findings.filter((f) => f.level === "error");
+    const warnings = artifact.findings.filter((f) => f.level === "warning");
+    const notes = artifact.findings.filter((f) => f.level === "note");
+    const summary = [
+      errors.length > 0 ? chalk5.red(`${errors.length} error${errors.length !== 1 ? "s" : ""}`) : "",
+      warnings.length > 0 ? chalk5.yellow(`${warnings.length} warning${warnings.length !== 1 ? "s" : ""}`) : "",
+      notes.length > 0 ? chalk5.blue(`${notes.length} note${notes.length !== 1 ? "s" : ""}`) : ""
+    ].filter(Boolean).join(chalk5.dim(", "));
+    lines.push(chalk5.bold.underline(`  Findings`) + chalk5.dim(` (${summary})`));
+    for (const f of artifact.findings) {
+      const icon = f.level === "error" ? chalk5.red("\u2716") : f.level === "warning" ? chalk5.yellow("\u26A0") : chalk5.blue("\u2139");
+      lines.push(`    ${icon} ${f.message}`);
+      lines.push(chalk5.dim(`      ${f.ruleId} in ${f.location}`));
+    }
+    lines.push("");
+  }
+  const actions = generatePriorityActions(artifact);
+  if (actions.length > 0) {
+    lines.push(...titleBox("Top Priority Actions"));
+    lines.push("");
+    for (let i = 0; i < actions.length; i++) {
+      const a = actions[i];
+      const num = chalk5.bold.cyan(`  ${i + 1}.`);
+      lines.push(`${num} ${chalk5.bold(a.title)}`);
+      lines.push(chalk5.dim(`     ${a.explanation}`));
+      if (a.impact) lines.push(`     Impact: ${chalk5.green(a.impact)}`);
+      lines.push("");
+    }
+  }
+  if (artifact.extended?.architecture) {
+    lines.push(...formatArchitectureDiagram(artifact.extended.architecture));
+  }
+  if (artifact.solutions && artifact.solutions.length > 0) {
+    lines.push(...titleBox("Solution Drift Summary"));
+    lines.push("");
+    for (const solution of artifact.solutions) {
+      const solScore = solution.drift?.score;
+      const color = typeof solScore === "number" ? solScore <= 30 ? chalk5.green : solScore <= 60 ? chalk5.yellow : chalk5.red : chalk5.dim;
+      lines.push(`  \u2022 ${solution.name} (${solution.projectPaths.length} projects) \u2014 ${typeof solScore === "number" ? color(`${solScore}/100`) : chalk5.dim("n/a")}`);
+    }
+    lines.push("");
+  }
+  const scoreColor = artifact.drift.score <= 30 ? chalk5.green : artifact.drift.score <= 60 ? chalk5.yellow : chalk5.red;
+  lines.push(...titleBox("Drift Score Summary"));
+  lines.push("");
+  lines.push(chalk5.bold("  Drift Score:  ") + scoreColor.bold(`${artifact.drift.score}/100`));
+  lines.push(chalk5.bold("  Risk Level:   ") + riskBadge(artifact.drift.riskLevel));
+  lines.push(chalk5.bold("  Projects:     ") + `${artifact.projects.length}`);
+  if (artifact.vcs) {
+    const vcsParts = [artifact.vcs.type];
+    if (artifact.vcs.branch) vcsParts.push(artifact.vcs.branch);
+    if (artifact.vcs.shortSha) vcsParts.push(chalk5.dim(artifact.vcs.shortSha));
+    lines.push(chalk5.bold("  VCS:          ") + vcsParts.join(" "));
+  }
+  lines.push("");
+  const m = new Set(artifact.drift.measured ?? ["runtime", "framework", "dependency", "eol"]);
+  lines.push("  " + chalk5.bold.underline("Score Breakdown"));
+  lines.push(`    Runtime:      ${m.has("runtime") ? scoreBar(artifact.drift.components.runtimeScore) : chalk5.dim("n/a")}`);
+  lines.push(`    Frameworks:   ${m.has("framework") ? scoreBar(artifact.drift.components.frameworkScore) : chalk5.dim("n/a")}`);
+  lines.push(`    Dependencies: ${m.has("dependency") ? scoreBar(artifact.drift.components.dependencyScore) : chalk5.dim("n/a")}`);
+  lines.push(`    EOL Risk:     ${m.has("eol") ? scoreBar(artifact.drift.components.eolScore) : chalk5.dim("n/a")}`);
+  lines.push("");
+  const scannedParts = [`Scanned at ${artifact.timestamp}`];
+  if (artifact.durationMs !== void 0) {
+    const secs = (artifact.durationMs / 1e3).toFixed(1);
+    scannedParts.push(`${secs}s`);
+  }
+  if (artifact.filesScanned !== void 0) {
+    scannedParts.push(`${artifact.filesScanned} file${artifact.filesScanned !== 1 ? "s" : ""} scanned`);
+  }
+  if (artifact.treeSummary) {
+    scannedParts.push(`${artifact.treeSummary.totalFiles.toLocaleString()} workspace files`);
+    scannedParts.push(`${artifact.treeSummary.totalDirs.toLocaleString()} dirs`);
+  }
+  lines.push(chalk5.dim(`  ${scannedParts.join(" \xB7 ")}`));
+  lines.push("");
+  return lines.join("\n");
+}
+function riskBadge(level) {
+  switch (level) {
+    case "low":
+      return chalk5.bgGreen.black(" LOW ");
+    case "moderate":
+      return chalk5.bgYellow.black(" MODERATE ");
+    case "high":
+      return chalk5.bgRed.white(" HIGH ");
+    default:
+      return level;
+  }
+}
+function scoreBar(score) {
+  return driftBar(score, 20);
+}
+var CATEGORY_LABELS = {
+  frontend: "Frontend",
+  metaFrameworks: "Meta-frameworks",
+  bundlers: "Bundlers",
+  css: "CSS / UI",
+  backend: "Backend",
+  orm: "ORM / Database",
+  testing: "Testing",
+  lintFormat: "Lint & Format",
+  apiMessaging: "API & Messaging",
+  observability: "Observability",
+  payment: "Payment",
+  auth: "Auth",
+  email: "Email",
+  cloud: "Cloud",
+  databases: "Databases",
+  messaging: "Messaging",
+  crm: "CRM & Comms",
+  storage: "Storage",
+  search: "Search & AI"
+};
+function formatExtended(ext) {
+  const lines = [];
+  if (ext.toolingInventory) {
+    const inv = ext.toolingInventory;
+    const categories = Object.entries(inv).filter(([, items]) => items.length > 0);
+    if (categories.length > 0) {
+      lines.push(chalk5.bold.underline("  Tech Stack"));
+      for (const [cat, items] of categories) {
+        const label = CATEGORY_LABELS[cat] ?? cat;
+        const names = items.map((i) => chalk5.white(i.name)).join(chalk5.dim(", "));
+        lines.push(`    ${chalk5.cyan(label)}: ${names}`);
+      }
+      lines.push("");
+    }
+  }
+  if (ext.serviceDependencies) {
+    const svc = ext.serviceDependencies;
+    const categories = Object.entries(svc).filter(([, items]) => items.length > 0);
+    if (categories.length > 0) {
+      lines.push(chalk5.bold.underline("  Services & Integrations"));
+      for (const [cat, items] of categories) {
+        const label = CATEGORY_LABELS[cat] ?? cat;
+        const names = items.map((i) => {
+          const ver = i.version ? chalk5.dim(` ${i.version}`) : "";
+          return chalk5.white(i.name) + ver;
+        }).join(chalk5.dim(", "));
+        lines.push(`    ${chalk5.cyan(label)}: ${names}`);
+      }
+      lines.push("");
+    }
+  }
+  if (ext.breakingChangeExposure) {
+    const bc = ext.breakingChangeExposure;
+    if (bc.deprecatedPackages.length > 0 || bc.legacyPolyfills.length > 0) {
+      lines.push(chalk5.bold.underline("  Breaking Change Exposure"));
+      const exposureColor = bc.exposureScore >= 40 ? chalk5.red : bc.exposureScore >= 20 ? chalk5.yellow : chalk5.green;
+      lines.push(`    Exposure Score: ${exposureColor.bold(`${bc.exposureScore}/100`)}`);
+      if (bc.deprecatedPackages.length > 0) {
+        lines.push(`    ${chalk5.red("Deprecated")}: ${bc.deprecatedPackages.map((p) => chalk5.dim(p)).join(", ")}`);
+      }
+      if (bc.legacyPolyfills.length > 0) {
+        lines.push(`    ${chalk5.yellow("Polyfills")}: ${bc.legacyPolyfills.map((p) => chalk5.dim(p)).join(", ")}`);
+      }
+      if (bc.peerConflictsDetected) {
+        lines.push(`    ${chalk5.red("\u26A0")} Peer dependency conflicts detected`);
+      }
+      lines.push(`    Recommendation: ${chalk5.bold(bc.overallRecommendation)}`);
+      const projectsWithPlans = bc.projectIntelligence.filter((p) => p.packages.length > 0).slice(0, 3);
+      if (projectsWithPlans.length > 0) {
+        lines.push("    Major Upgrade Intelligence:");
+        for (const p of projectsWithPlans) {
+          lines.push(`      - ${p.project} (${p.recommendation})`);
+          for (const pkg of p.packages.slice(0, 2)) {
+            lines.push(`        \xB7 ${pkg.package} ${pkg.currentVersion ?? "?"} \u2192 ${pkg.targetVersion ?? "?"} | touched ~${pkg.usage.touchedPercent}% | ${pkg.automatable}`);
+          }
+        }
+      }
+      lines.push("");
+    }
+  }
+  if (ext.tsModernity && ext.tsModernity.typescriptVersion) {
+    const ts = ext.tsModernity;
+    lines.push(chalk5.bold.underline("  TypeScript"));
+    const parts = [];
+    parts.push(`v${ts.typescriptVersion}`);
+    if (ts.strict === true) parts.push(chalk5.green("strict \u2714"));
+    else if (ts.strict === false) parts.push(chalk5.yellow("strict \u2716"));
+    if (ts.moduleType) parts.push(ts.moduleType.toUpperCase());
+    if (ts.target) parts.push(`target: ${ts.target}`);
+    lines.push(`    ${parts.join(chalk5.dim(" \xB7 "))}`);
+    lines.push("");
+  }
+  if (ext.buildDeploy) {
+    const bd = ext.buildDeploy;
+    const hasSomething = bd.ci.length > 0 || bd.docker.dockerfileCount > 0 || bd.packageManagers.length > 0;
+    if (hasSomething) {
+      lines.push(chalk5.bold.underline("  Build & Deploy"));
+      if (bd.ci.length > 0) lines.push(`    CI: ${bd.ci.join(", ")}`);
+      if (bd.docker.dockerfileCount > 0) {
+        lines.push(`    Docker: ${bd.docker.dockerfileCount} Dockerfile${bd.docker.dockerfileCount !== 1 ? "s" : ""} (${bd.docker.baseImages.join(", ")})`);
+      }
+      if (bd.packageManagers.length > 0) lines.push(`    Package Managers: ${bd.packageManagers.join(", ")}`);
+      if (bd.monorepoTools.length > 0) lines.push(`    Monorepo: ${bd.monorepoTools.join(", ")}`);
+      if (bd.iac.length > 0) lines.push(`    IaC: ${bd.iac.join(", ")}`);
+      lines.push("");
+    }
+  }
+  if (ext.uiPurpose) {
+    const up = ext.uiPurpose;
+    lines.push(chalk5.bold.underline("  Product Purpose Signals"));
+    lines.push(`    Frameworks: ${up.detectedFrameworks.length > 0 ? up.detectedFrameworks.join(", ") : chalk5.dim("unknown")}`);
+    lines.push(`    Evidence: ${up.topEvidence.length}${up.capped ? chalk5.dim(` of ${up.evidenceCount} (capped)`) : ""}`);
+    const top = up.topEvidence.slice(0, 8);
+    if (top.length > 0) {
+      lines.push("    Top Signals:");
+      for (const item of top) {
+        lines.push(`      - [${item.kind}] ${item.value} ${chalk5.dim(`(${item.file})`)}`);
+      }
+    }
+    if (up.unknownSignals.length > 0) {
+      lines.push("    Unknowns:");
+      for (const u of up.unknownSignals.slice(0, 4)) {
+        lines.push(`      - ${chalk5.yellow(u)}`);
+      }
+    }
+    lines.push("");
+  }
+  if (ext.securityPosture) {
+    const sec = ext.securityPosture;
+    lines.push(chalk5.bold.underline("  Security Posture"));
+    const checks = [];
+    checks.push(sec.lockfilePresent ? chalk5.green("Lockfile \u2714") : chalk5.red("Lockfile \u2716"));
+    checks.push(sec.gitignoreCoversEnv ? chalk5.green(".env \u2714") : chalk5.red(".env \u2716"));
+    checks.push(sec.gitignoreCoversNodeModules ? chalk5.green("node_modules \u2714") : chalk5.yellow("node_modules \u2716"));
+    if (sec.multipleLockfileTypes) checks.push(chalk5.yellow("Multiple lockfiles \u26A0"));
+    if (sec.envFilesTracked) checks.push(chalk5.red("Env files tracked \u2716"));
+    lines.push(`    ${checks.join(chalk5.dim(" \xB7 "))}`);
+    lines.push("");
+  }
+  if (ext.platformMatrix) {
+    const pm = ext.platformMatrix;
+    if (pm.nativeModules.length > 0 || pm.dockerBaseImages.length > 0) {
+      lines.push(chalk5.bold.underline("  Platform"));
+      if (pm.nativeModules.length > 0) {
+        lines.push(`    Native modules: ${pm.nativeModules.map((m) => chalk5.dim(m)).join(", ")}`);
+      }
+      if (pm.osAssumptions.length > 0) {
+        lines.push(`    OS assumptions: ${pm.osAssumptions.join(", ")}`);
+      }
+      lines.push("");
+    }
+  }
+  if (ext.codeQuality) {
+    const cq = ext.codeQuality;
+    lines.push(chalk5.bold.underline("  Code Quality"));
+    lines.push(`    Files: ${chalk5.white(`${cq.filesAnalyzed}`)} \xB7 Functions: ${chalk5.white(`${cq.functionsAnalyzed}`)} \xB7 Avg complexity: ${chalk5.white(`${cq.avgCyclomaticComplexity}`)} \xB7 Avg length: ${chalk5.white(`${cq.avgFunctionLength}`)} lines`);
+    lines.push(`    Max nesting: ${cq.maxNestingDepth} \xB7 Circular deps: ${cq.circularDependencies} \xB7 Dead code: ${cq.deadCodePercent}%`);
+    if (cq.godFiles.length > 0) {
+      const preview = cq.godFiles.slice(0, 3).map((f) => `${f.path} (${f.lines} lines)`).join(", ");
+      lines.push(`    ${chalk5.yellow("God files")}: ${preview}`);
+    }
+    lines.push("");
+  }
+  if (ext.dependencyGraph) {
+    const dg = ext.dependencyGraph;
+    if (dg.lockfileType) {
+      lines.push(chalk5.bold.underline("  Dependency Graph"));
+      lines.push(`    ${dg.lockfileType}: ${chalk5.white(`${dg.totalUnique}`)} unique, ${chalk5.white(`${dg.totalInstalled}`)} installed`);
+      if (dg.duplicatedPackages.length > 0) {
+        lines.push(`    ${chalk5.yellow(`${dg.duplicatedPackages.length} duplicated`)} packages`);
+      }
+      if (dg.phantomDependencies.length > 0) {
+        lines.push(`    ${chalk5.red(`${dg.phantomDependencies.length} phantom`)} dependencies`);
+      }
+      lines.push("");
+    }
+  }
+  return lines;
+}
+function formatArchitectureDiagram(arch) {
+  const lines = [];
+  lines.push(...titleBox("Architecture Layers"));
+  lines.push("");
+  lines.push(chalk5.bold("  Archetype: ") + `${arch.archetype}` + chalk5.dim(` (${Math.round(arch.archetypeConfidence * 100)}% confidence)`));
+  lines.push(`  Files classified: ${arch.totalClassified}` + (arch.unclassified > 0 ? chalk5.dim(` (${arch.unclassified} unclassified)`) : ""));
+  lines.push("");
+  if (arch.layers.length > 0) {
+    for (const layer of arch.layers) {
+      const risk = layer.riskLevel === "none" ? chalk5.dim("none") : layer.riskLevel === "low" ? chalk5.green("low") : layer.riskLevel === "moderate" ? chalk5.yellow("moderate") : chalk5.red("high");
+      lines.push(`    ${chalk5.bold(layer.layer)}  ${layer.fileCount} file${layer.fileCount !== 1 ? "s" : ""}  drift ${scoreBar(layer.driftScore)}  risk ${risk}`);
+    }
+    lines.push("");
+  }
+  return lines;
+}
+function generatePriorityActions(artifact) {
+  const actions = [];
+  const eolProjects = artifact.projects.filter(
+    (p) => p.runtimeMajorsBehind !== void 0 && p.runtimeMajorsBehind >= 3
+  );
+  if (eolProjects.length > 0) {
+    const names = eolProjects.map((p) => p.name).join(", ");
+    let detail = `End-of-life runtimes no longer receive security patches and block ecosystem upgrades.`;
+    const fileLines = [];
+    for (const p of eolProjects) {
+      fileLines.push(`
+     ./${p.path}`);
+      fileLines.push(`
+       ${p.runtime} \u2192 ${p.runtimeLatest} (${p.runtimeMajorsBehind} major${p.runtimeMajorsBehind > 1 ? "s" : ""} behind)`);
+    }
+    detail += fileLines.join("");
+    actions.push({
+      title: `Upgrade EOL runtime${eolProjects.length > 1 ? "s" : ""} in ${names}`,
+      explanation: detail,
+      impact: `\u2212${Math.min(eolProjects.length * 10, 30)} drift points (runtime & EOL scores)`,
+      severity: 100
+    });
+  }
+  const severeFrameworks = [];
+  for (const p of artifact.projects) {
+    for (const fw of p.frameworks) {
+      if (fw.majorsBehind !== null && fw.majorsBehind >= 3) {
+        severeFrameworks.push({ name: fw.name, fw: `${fw.currentVersion} \u2192 ${fw.latestVersion}`, behind: fw.majorsBehind, project: p.name, projectPath: p.path });
+      }
+    }
+  }
+  if (severeFrameworks.length > 0) {
+    const worst = severeFrameworks.sort((a, b) => b.behind - a.behind)[0];
+    const others = severeFrameworks.length > 1 ? ` (+${severeFrameworks.length - 1} more)` : "";
+    let detail = `${worst.behind} major versions behind. Major framework drift increases breaking change risk and blocks access to security fixes and performance improvements.`;
+    const fileLines = [];
+    let shown = 0;
+    for (const sf of severeFrameworks) {
+      if (shown >= 8) break;
+      fileLines.push(`
+     ./${sf.projectPath}`);
+      fileLines.push(`
+       ${sf.name}: ${sf.fw} (${sf.behind} major${sf.behind > 1 ? "s" : ""} behind)`);
+      shown++;
+    }
+    const remaining = severeFrameworks.length - shown;
+    detail += fileLines.join("");
+    if (remaining > 0) detail += `
+     ... and ${remaining} more`;
+    actions.push({
+      title: `Upgrade ${worst.name} ${worst.fw} in ${worst.project}${others}`,
+      explanation: detail,
+      impact: `\u22125\u201315 drift points`,
+      severity: 90
+    });
+  }
+  for (const p of artifact.projects) {
+    const b = p.dependencyAgeBuckets;
+    const total = b.current + b.oneBehind + b.twoPlusBehind;
+    if (total === 0) continue;
+    const twoPlusPct = Math.round(b.twoPlusBehind / total * 100);
+    if (twoPlusPct >= 40) {
+      let detail = `${b.twoPlusBehind} of ${total} dependencies are 2+ majors behind. Run \`npm outdated\` and prioritise packages with known CVEs or breaking API changes.`;
+      const worstDeps = p.dependencies.filter((d) => d.majorsBehind !== null && d.majorsBehind >= 2).sort((a, b2) => (b2.majorsBehind ?? 0) - (a.majorsBehind ?? 0));
+      if (worstDeps.length > 0) {
+        const depLines = [];
+        let shown = 0;
+        depLines.push(`
+     ./${p.path}`);
+        for (const dep of worstDeps) {
+          if (shown >= 8) break;
+          const current = dep.resolvedVersion ?? dep.currentSpec;
+          const latest = dep.latestStable ?? "?";
+          depLines.push(`
+       ${dep.package}: ${current} \u2192 ${latest} (${dep.majorsBehind} major${dep.majorsBehind > 1 ? "s" : ""} behind)`);
+          shown++;
+        }
+        const remaining = worstDeps.length - shown;
+        detail += depLines.join("");
+        if (remaining > 0) detail += `
+     ... and ${remaining} more`;
+      }
+      actions.push({
+        title: `Reduce dependency rot in ${p.name} (${twoPlusPct}% severely outdated)`,
+        explanation: detail,
+        impact: `\u22125\u201310 drift points`,
+        severity: 80 + twoPlusPct / 10
+      });
+    }
+  }
+  const twoMajorFrameworks = [];
+  for (const p of artifact.projects) {
+    for (const fw of p.frameworks) {
+      if (fw.majorsBehind === 2) {
+        twoMajorFrameworks.push({ name: fw.name, project: p.name, projectPath: p.path, fw: `${fw.currentVersion} \u2192 ${fw.latestVersion}` });
+      }
+    }
+  }
+  const uniqueTwo = [...new Map(twoMajorFrameworks.map((f) => [f.name, f])).values()];
+  if (uniqueTwo.length > 0) {
+    const list = uniqueTwo.slice(0, 3).map((f) => `${f.name} (${f.fw})`).join(", ");
+    const moreCount = uniqueTwo.length > 3 ? ` +${uniqueTwo.length - 3} more` : "";
+    let detail = `These frameworks are 2 major versions behind. Create upgrade tickets and check migration guides \u2014 the gap will widen with each new release.`;
+    const fileLines = [];
+    let shown = 0;
+    for (const tf of twoMajorFrameworks) {
+      if (shown >= 8) break;
+      fileLines.push(`
+     ./${tf.projectPath}`);
+      fileLines.push(`
+       ${tf.name}: ${tf.fw}`);
+      shown++;
+    }
+    const remaining = twoMajorFrameworks.length - shown;
+    detail += fileLines.join("");
+    if (remaining > 0) detail += `
+     ... and ${remaining} more`;
+    actions.push({
+      title: `Plan major framework upgrades: ${list}${moreCount}`,
+      explanation: detail,
+      impact: `\u22125\u201310 drift points`,
+      severity: 60
+    });
+  }
+  if (artifact.extended?.breakingChangeExposure) {
+    const bc = artifact.extended.breakingChangeExposure;
+    const total = bc.deprecatedPackages.length + bc.legacyPolyfills.length;
+    if (total > 0) {
+      const items = [...bc.deprecatedPackages, ...bc.legacyPolyfills].slice(0, 5).join(", ");
+      const moreCount = total > 5 ? ` +${total - 5} more` : "";
+      let detail = `${total} package${total !== 1 ? "s" : ""} are deprecated or legacy polyfills. These receive no updates and may have known vulnerabilities.`;
+      const allPkgNames = /* @__PURE__ */ new Set([...bc.deprecatedPackages, ...bc.legacyPolyfills]);
+      const fileLines = [];
+      let shown = 0;
+      for (const p of artifact.projects) {
+        const matches = p.dependencies.filter((d) => allPkgNames.has(d.package));
+        if (matches.length === 0) continue;
+        if (shown >= 10) break;
+        fileLines.push(`
+     ./${p.path}`);
+        for (const dep of matches) {
+          if (shown >= 10) break;
+          const ver = dep.resolvedVersion ?? dep.currentSpec;
+          const label = bc.deprecatedPackages.includes(dep.package) ? "deprecated" : "polyfill";
+          fileLines.push(`
+       ${dep.package}: ${ver} (${label})`);
+          shown++;
+        }
+      }
+      const remaining = total - shown;
+      detail += fileLines.join("");
+      if (remaining > 0) detail += `
+     ... and ${remaining} more`;
+      actions.push({
+        title: `Replace deprecated/legacy packages: ${items}${moreCount}`,
+        explanation: detail,
+        severity: 55
+      });
+    }
+  }
+  if (artifact.extended?.dependencyGraph) {
+    const dg = artifact.extended.dependencyGraph;
+    const phantomCount = dg.phantomDependencies.length;
+    if (phantomCount >= 10) {
+      let detail = `Packages used in code but not declared in package.json. These rely on transitive installs and can break unpredictably when other packages update.`;
+      const details = dg.phantomDependencyDetails;
+      if (details && details.length > 0) {
+        const byPath = /* @__PURE__ */ new Map();
+        for (const d of details) {
+          if (!byPath.has(d.sourcePath)) byPath.set(d.sourcePath, []);
+          byPath.get(d.sourcePath).push({ package: d.package, spec: d.spec });
+        }
+        const pathLines = [];
+        let shown = 0;
+        for (const [srcPath, pkgs] of byPath) {
+          if (shown >= 10) break;
+          pathLines.push(`
+     ./${srcPath}`);
+          for (const pkg of pkgs) {
+            if (shown >= 10) break;
+            pathLines.push(`
+       ${pkg.package}: ${pkg.spec}`);
+            shown++;
+          }
+        }
+        const remaining = phantomCount - shown;
+        detail += pathLines.join("");
+        if (remaining > 0) detail += `
+     ... and ${remaining} more`;
+      }
+      actions.push({
+        title: `Fix ${phantomCount} phantom dependencies`,
+        explanation: detail,
+        severity: 45
+      });
+    }
+  }
+  if (artifact.extended?.securityPosture) {
+    const sec = artifact.extended.securityPosture;
+    if (sec.envFilesTracked || !sec.lockfilePresent) {
+      const issues = [];
+      if (sec.envFilesTracked) issues.push(".env files are tracked in git");
+      if (!sec.lockfilePresent) issues.push("no lockfile found");
+      let detail;
+      if (sec.envFilesTracked) {
+        detail = "Environment files may contain secrets. Add them to .gitignore and rotate any exposed credentials immediately.";
+        detail += "\n     ./.gitignore";
+        detail += "\n       Add: .env, .env.*, .env.local";
+      } else {
+        detail = "Without a lockfile, installs are non-deterministic. Run the install command to generate one and commit it.";
+        detail += "\n     ./";
+        detail += `
+       Missing: ${sec.lockfileTypes.length > 0 ? sec.lockfileTypes.join(", ") + " (multiple types detected)" : "package-lock.json, pnpm-lock.yaml, or yarn.lock"}`;
+      }
+      actions.push({
+        title: `Fix security posture: ${issues.join(", ")}`,
+        explanation: detail,
+        severity: 95
+      });
+    }
+  }
+  if (artifact.extended?.dependencyGraph) {
+    const dupes = artifact.extended.dependencyGraph.duplicatedPackages;
+    const highImpactDupes = dupes.filter((d) => d.versions.length >= 3);
+    if (highImpactDupes.length >= 3) {
+      let detail = `${highImpactDupes.length} packages have 3+ versions installed. Run \`npm dedupe\` to reduce bundle size and install time.`;
+      const dupeLines = [];
+      let shown = 0;
+      for (const d of highImpactDupes) {
+        if (shown >= 8) break;
+        dupeLines.push(`
+       ${d.name}: ${d.versions.join(", ")} (${d.consumers} consumer${d.consumers !== 1 ? "s" : ""})`);
+        shown++;
+      }
+      const remaining = highImpactDupes.length - shown;
+      detail += dupeLines.join("");
+      if (remaining > 0) detail += `
+     ... and ${remaining} more`;
+      actions.push({
+        title: `Deduplicate heavily-versioned packages`,
+        explanation: detail,
+        severity: 35
+      });
+    }
+  }
+  actions.sort((a, b) => b.severity - a.severity);
+  return actions.slice(0, 5);
+}
+
+// src/reporting/formatters/markdown.ts
+function formatMarkdown(artifact) {
+  const lines = [];
+  lines.push("# Vibgrate Drift Report");
+  lines.push("");
+  lines.push(`| Metric | Value |`);
+  lines.push(`|--------|-------|`);
+  lines.push(`| **Drift Score** | ${artifact.drift.score}/100 _(lower is better; 0 = no drift)_ |`);
+  lines.push(`| **Risk Level** | ${artifact.drift.riskLevel.toUpperCase()} |`);
+  lines.push(`| **Projects** | ${artifact.projects.length} |`);
+  const scannedMeta = [artifact.timestamp];
+  if (artifact.durationMs !== void 0) scannedMeta.push(`${(artifact.durationMs / 1e3).toFixed(1)}s`);
+  if (artifact.filesScanned !== void 0) scannedMeta.push(`${artifact.filesScanned} files`);
+  if (artifact.treeSummary) scannedMeta.push(`${artifact.treeSummary.totalFiles.toLocaleString()} workspace files \xB7 ${artifact.treeSummary.totalDirs.toLocaleString()} dirs`);
+  lines.push(`| **Scanned** | ${scannedMeta.join(" \xB7 ")} |`);
+  if (artifact.vcs) {
+    lines.push(`| **VCS** | ${artifact.vcs.type} |`);
+    if (artifact.vcs.branch) lines.push(`| **Branch** | ${artifact.vcs.branch} |`);
+    if (artifact.vcs.sha) lines.push(`| **Commit** | \`${artifact.vcs.shortSha}\` |`);
+  }
+  lines.push("");
+  lines.push("## Score Breakdown");
+  lines.push("");
+  lines.push(`| Component | Score |`);
+  lines.push(`|-----------|-------|`);
+  lines.push(`| Runtime | ${artifact.drift.components.runtimeScore} |`);
+  lines.push(`| Frameworks | ${artifact.drift.components.frameworkScore} |`);
+  lines.push(`| Dependencies | ${artifact.drift.components.dependencyScore} |`);
+  lines.push(`| EOL Risk | ${artifact.drift.components.eolScore} |`);
+  lines.push("");
+  lines.push("## Projects");
+  lines.push("");
+  for (const project of artifact.projects) {
+    lines.push(`### ${project.name} (${project.type})`);
+    lines.push("");
+    if (project.runtime) {
+      const lag = project.runtimeMajorsBehind !== void 0 && project.runtimeMajorsBehind > 0 ? ` \u2014 ${project.runtimeMajorsBehind} major(s) behind` : " \u2014 current";
+      lines.push(`- **Runtime:** ${project.runtime}${lag}`);
+    }
+    if (project.frameworks.length > 0) {
+      lines.push("- **Frameworks:**");
+      for (const fw of project.frameworks) {
+        const lag = fw.majorsBehind !== null ? fw.majorsBehind === 0 ? "current" : `${fw.majorsBehind} behind` : "unknown";
+        lines.push(`  - ${fw.name}: ${fw.currentVersion ?? "?"} \u2192 ${fw.latestVersion ?? "?"} (${lag})`);
+      }
+    }
+    const b = project.dependencyAgeBuckets;
+    const total = b.current + b.oneBehind + b.twoPlusBehind + b.unknown;
+    if (total > 0) {
+      lines.push(`- **Dependencies:** ${b.current} current, ${b.oneBehind} 1-behind, ${b.twoPlusBehind} 2+ behind, ${b.unknown} unknown`);
+    }
+    lines.push("");
+  }
+  if (artifact.extended?.uiPurpose) {
+    const up = artifact.extended.uiPurpose;
+    lines.push("## Product Purpose Signals");
+    lines.push("");
+    lines.push(`- **Frameworks:** ${up.detectedFrameworks.length > 0 ? up.detectedFrameworks.join(", ") : "unknown"}`);
+    lines.push(`- **Evidence Items:** ${up.topEvidence.length}${up.capped ? ` (capped from ${up.evidenceCount})` : ""}`);
+    if (up.topEvidence.length > 0) {
+      lines.push("- **Top Evidence:**");
+      for (const item of up.topEvidence.slice(0, 10)) {
+        lines.push(`  - [${item.kind}] ${item.value} (${item.file})`);
+      }
+    }
+    if (up.unknownSignals.length > 0) {
+      lines.push("- **Unknowns:**");
+      for (const u of up.unknownSignals.slice(0, 5)) {
+        lines.push(`  - ${u}`);
+      }
+    }
+    lines.push("");
+  }
+  if (artifact.extended?.standards && artifact.extended.standards.recommended.length > 0) {
+    const std = artifact.extended.standards;
+    lines.push("## Recommended Standards");
+    lines.push("");
+    const purposes = std.projectPurposes.map((p) => `${p.project} \u2192 ${p.category}`).join(", ");
+    if (purposes) lines.push(`- **Detected purpose:** ${purposes}`);
+    if (std.frameworks.length > 0) {
+      lines.push("- **Compliance framework coverage:**");
+      for (const f of std.frameworks) {
+        lines.push(`  - ${f.name}: ${f.recommendedMembers}/${f.totalMembers} member standards apply`);
+      }
+    }
+    lines.push("- **Top standards to consider:**");
+    for (const rec of std.recommended.slice(0, 10)) {
+      const flag = rec.complianceRelevant ? " _(compliance)_" : "";
+      lines.push(`  - **${rec.name}** \u2014 ${rec.reason}${flag}`);
+    }
+    lines.push("");
+  }
+  if (artifact.findings.length > 0) {
+    lines.push("## Findings");
+    lines.push("");
+    lines.push(`| Level | Rule | Message | Location |`);
+    lines.push(`|-------|------|---------|----------|`);
+    for (const f of artifact.findings) {
+      const emoji = f.level === "error" ? "\u{1F534}" : f.level === "warning" ? "\u{1F7E1}" : "\u{1F535}";
+      lines.push(`| ${emoji} ${f.level} | ${f.ruleId} | ${f.message} | ${f.location} |`);
+    }
+    lines.push("");
+  }
+  if (artifact.delta !== void 0) {
+    const dir = artifact.delta > 0 ? "\u{1F4C8}" : artifact.delta < 0 ? "\u{1F4C9}" : "\u27A1\uFE0F";
+    const trend = artifact.delta > 0 ? " _(worsened)_" : artifact.delta < 0 ? " _(improved)_" : "";
+    lines.push(`## Drift Delta: ${dir} ${artifact.delta > 0 ? "+" : ""}${artifact.delta} vs baseline${trend}`);
+    lines.push("");
+  }
+  return lines.join("\n");
+}
+
+// src/reporting/commands/report.ts
+var reportCommand = new Command("report").description("Generate a drift report from a scan artifact").option("--in <file>", "Input artifact file", ".vibgrate/scan_result.json").option("--format <format>", "Output format (md|text|json)", "text").action(async (opts) => {
+  const artifactPath = path9.resolve(opts.in);
+  if (!await pathExists(artifactPath)) {
+    console.error(chalk5.red(`Artifact not found: ${artifactPath}`));
+    console.error(chalk5.dim('Run "vibgrate scan" first to generate a scan artifact.'));
+    process.exit(1);
+  }
+  const artifact = await readJsonFile(artifactPath);
+  switch (opts.format) {
+    case "md":
+      console.log(formatMarkdown(artifact));
+      break;
+    case "json":
+      console.log(JSON.stringify(artifact, null, 2));
+      break;
+    case "text":
+    default:
+      console.log(formatText(artifact));
+      break;
+  }
+});
+function openUrl(url) {
+  const platform = process.platform;
+  let command;
+  let args;
+  if (platform === "darwin") {
+    command = "open";
+    args = [url];
+  } else if (platform === "win32") {
+    command = "cmd";
+    args = ["/c", "start", "", url];
+  } else {
+    command = "xdg-open";
+    args = [url];
+  }
+  try {
+    const child = spawn(command, args, { stdio: "ignore", detached: true });
+    child.on("error", () => {
+    });
+    child.unref();
+    return true;
+  } catch {
+    return false;
+  }
+}
+
+// src/reporting/commands/login.ts
+var delay = (ms) => new Promise((resolve15) => setTimeout(resolve15, ms));
+var loginCommand = new Command("login").description("Authenticate the CLI with your Vibgrate workspace via the browser").option("--ingest <url>", "Ingest API URL (overrides --region)").option("--region <region>", `Data residency region (${availableRegionIds().join(", ")})`, "us").option("--no-browser", "Do not attempt to open a browser automatically").action(async (opts) => {
+  let ingestHost;
+  try {
+    ingestHost = resolveIngestHost(opts.region, opts.ingest);
+  } catch (e) {
+    console.error(chalk5.red(e instanceof Error ? e.message : String(e)));
+    process.exit(1);
+  }
+  const base = `https://${ingestHost}/v1/auth/device`;
+  let start;
+  try {
+    const res = await fetch(`${base}/start`, {
+      method: "POST",
+      headers: { "Content-Type": "application/json", Connection: "close" },
+      body: "{}"
+    });
+    if (!res.ok) {
+      console.error(chalk5.red(`Failed to start login (HTTP ${res.status}).`));
+      process.exit(1);
+    }
+    start = await res.json();
+  } catch (e) {
+    console.error(chalk5.red(`Could not reach ${ingestHost}: ${e instanceof Error ? e.message : String(e)}`));
+    process.exit(1);
+  }
+  console.log("");
+  console.log("To finish signing in, open this URL and approve the request:");
+  console.log("");
+  console.log("  " + chalk5.cyan(start.verificationUri));
+  console.log("");
+  console.log("  Your code: " + chalk5.bold(start.userCode));
+  console.log("");
+  if (opts.browser) {
+    const opened = openUrl(start.verificationUriComplete);
+    if (opened) {
+      console.log(chalk5.dim("Opening your browser\u2026 (if it does not open, use the URL above)"));
+    }
+  }
+  console.log(chalk5.dim("Waiting for approval\u2026"));
+  const intervalMs = Math.max(2, start.interval || 5) * 1e3;
+  const deadline = Date.now() + (start.expiresIn || 900) * 1e3;
+  while (Date.now() < deadline) {
+    await delay(intervalMs);
+    let token;
+    try {
+      const res = await fetch(`${base}/token`, {
+        method: "POST",
+        headers: { "Content-Type": "application/json", Connection: "close" },
+        body: JSON.stringify({ deviceCode: start.deviceCode })
+      });
+      token = await res.json();
+    } catch {
+      continue;
+    }
+    if (token.status === "authorization_pending") continue;
+    if (token.status === "complete") {
+      let creds;
+      if (token.dsn) {
+        creds = {
+          dsn: token.dsn,
+          workspaceId: token.workspaceId,
+          keyId: token.keyId,
+          ingestHost: token.ingestHost ?? ingestHost,
+          savedAt: (/* @__PURE__ */ new Date()).toISOString()
+        };
+      } else {
+        console.log(chalk5.dim("Setting up your workspace\u2026"));
+        try {
+          const provisioned = await createWorkspaceDsn({
+            region: opts.region,
+            ingest: opts.ingest
+          });
+          creds = {
+            dsn: provisioned.dsn,
+            workspaceId: provisioned.workspaceId,
+            keyId: provisioned.keyId,
+            ingestHost: provisioned.ingestHost,
+            savedAt: (/* @__PURE__ */ new Date()).toISOString()
+          };
+        } catch (e) {
+          console.error(
+            chalk5.red("\u2716 Signed in, but workspace setup failed: ") + (e instanceof Error ? e.message : String(e))
+          );
+          console.error(
+            chalk5.dim('  Finish setup with "vibgrate dsn create --workspace new".')
+          );
+          process.exit(1);
+        }
+      }
+      writeStoredCredentials(creds);
+      console.log("");
+      console.log(chalk5.green("\u2714") + " Logged in.");
+      if (creds.workspaceId) {
+        console.log("  Workspace: " + chalk5.bold(creds.workspaceId));
+      }
+      console.log(chalk5.dim(`  Credentials saved to ${credentialsPath()}`));
+      try {
+        const root = findGitRoot();
+        if (root) {
+          const res = ensureGitignored(gitignoreEntryForCredentials(root), root);
+          if (res.status === "created") {
+            console.log(chalk5.dim(`  Created .gitignore and ignored ${res.entry}`));
+          } else if (res.status === "added") {
+            console.log(chalk5.dim(`  Added ${res.entry} to .gitignore`));
+          }
+        }
+      } catch {
+      }
+      console.log(chalk5.dim('  You can now run "vibgrate scan --push".'));
+      return;
+    }
+    if (token.status === "access_denied") {
+      console.error(chalk5.red("\u2716 Login was denied in the browser."));
+      process.exit(1);
+    }
+    if (token.status === "expired" || token.status === "invalid") {
+      console.error(chalk5.red('\u2716 Login request expired. Run "vibgrate login" again.'));
+      process.exit(1);
+    }
+    if (token.status === "error") {
+      console.error(chalk5.red(`\u2716 ${token.error ?? "Login failed."}`));
+      process.exit(1);
+    }
+  }
+  console.error(chalk5.red('\u2716 Timed out waiting for approval. Run "vibgrate login" again.'));
+  process.exit(1);
+});
+
+// src/reporting/utils/shell.ts
+function unsetEnvCommand(varName, env = {}) {
+  const platform = env.platform ?? process.platform;
+  if (platform === "win32") {
+    return `PowerShell: Remove-Item Env:${varName}  |  cmd.exe: set ${varName}=`;
+  }
+  const shell = env.shell ?? process.env.SHELL ?? "";
+  const base = shell.split("/").pop() ?? "";
+  if (base === "fish") return `set -e ${varName}`;
+  if (base === "csh" || base === "tcsh") return `unsetenv ${varName}`;
+  return `unset ${varName}`;
+}
+
+// src/reporting/commands/logout.ts
+var logoutCommand = new Command("logout").description("Clear stored Vibgrate login credentials").action(() => {
+  const cleared = clearStoredCredentials();
+  if (cleared) {
+    console.log(chalk5.green("\u2714") + " Logged out. Stored credentials removed.");
+  } else {
+    console.log(chalk5.dim(`No stored credentials found at ${credentialsPath()}.`));
+  }
+  if (process.env.VIBGRATE_DSN) {
+    console.log("");
+    console.log(
+      chalk5.yellow("\u26A0") + " VIBGRATE_DSN is still set in your environment, so commands will keep using it."
+    );
+    console.log(
+      chalk5.dim(`  Unset it to fully sign out: ${unsetEnvCommand("VIBGRATE_DSN")}`)
+    );
+  }
+});
+var REGISTRY_URL = "https://registry.npmjs.org/@vibgrate%2fcli/latest";
+var CACHE_DIR = path9.join(os.homedir(), ".vibgrate");
+var CACHE_FILE = path9.join(CACHE_DIR, "update-check.json");
+async function fetchLatestVersion() {
+  try {
+    const controller = new AbortController();
+    const timeout = setTimeout(() => controller.abort(), 1e4);
+    timeout.unref?.();
+    let response;
+    try {
+      response = await fetch(REGISTRY_URL, {
+        headers: { Accept: "application/json" },
+        signal: controller.signal
+      });
+    } finally {
+      clearTimeout(timeout);
+    }
+    if (!response.ok) return null;
+    const data = await response.json();
+    const latest = data.version;
+    if (!latest || !semver.valid(latest)) return null;
+    await writeCache({ latest, checkedAt: Date.now() });
+    return latest;
+  } catch {
+    return null;
+  }
+}
+async function writeCache(data) {
+  try {
+    await fs10.mkdir(CACHE_DIR, { recursive: true });
+    await fs10.writeFile(CACHE_FILE, JSON.stringify(data), "utf-8");
+  } catch {
+  }
+}
+
+// src/reporting/commands/update.ts
+function detectGlobalInstall() {
+  const execPath = process.argv[1] || "";
+  if (execPath.includes("/lib/node_modules/") || execPath.includes("\\node_modules\\")) {
+    if (!execPath.includes(process.cwd())) {
+      if (execPath.includes("pnpm")) return "pnpm";
+      if (execPath.includes("yarn")) return "yarn";
+      if (execPath.includes("bun")) return "bun";
+      return "npm";
+    }
+  }
+  return null;
+}
+function getGlobalUpdateCommand(pm, pkg, version) {
+  const spec = `${pkg}@${version}`;
+  switch (pm) {
+    case "pnpm":
+      return `pnpm add -g ${spec}`;
+    case "yarn":
+      return `yarn global add ${spec}`;
+    case "bun":
+      return `bun add -g ${spec}`;
+    case "npm":
+    default:
+      return `npm install -g ${spec}`;
+  }
+}
+async function detectPackageManager(cwd) {
+  if (await pathExists(path9.join(cwd, "pnpm-lock.yaml"))) return "pnpm";
+  if (await pathExists(path9.join(cwd, "bun.lockb"))) return "bun";
+  if (await pathExists(path9.join(cwd, "yarn.lock"))) return "yarn";
+  return "npm";
+}
+function getInstallCommand(pm, pkg, version, isDev) {
+  const spec = `${pkg}@${version}`;
+  switch (pm) {
+    case "pnpm":
+      return isDev ? `pnpm add -D ${spec}` : `pnpm add ${spec}`;
+    case "yarn":
+      return isDev ? `yarn add --dev ${spec}` : `yarn add ${spec}`;
+    case "bun":
+      return isDev ? `bun add -d ${spec}` : `bun add ${spec}`;
+    case "npm":
+    default:
+      return isDev ? `npm install --save-dev ${spec}` : `npm install ${spec}`;
+  }
+}
+async function isDevDependency(cwd) {
+  try {
+    const pkgPath = path9.join(cwd, "package.json");
+    const raw = await (await import('fs/promises')).readFile(pkgPath, "utf-8");
+    const pkg = JSON.parse(raw);
+    return Boolean(pkg.devDependencies?.["@vibgrate/cli"]);
+  } catch {
+    return true;
+  }
+}
+var updateCommand = new Command("update").description("Update vibgrate to the latest version").option("--check", "Only check for updates, do not install").option("--pm <manager>", "Package manager to use (npm, pnpm, yarn, bun)").option("--global", "Update global installation").action(async (opts) => {
+  console.log(chalk5.dim(`Current version: ${VERSION}`));
+  console.log(chalk5.dim("Checking npm registry..."));
+  const latest = await fetchLatestVersion();
+  if (!latest) {
+    console.error(chalk5.red("Could not reach the npm registry. Check your network connection."));
+    process.exit(1);
+  }
+  const semver2 = await import('semver');
+  if (!semver2.gt(latest, VERSION)) {
+    console.log(chalk5.green("\u2714") + ` You are on the latest version (${VERSION}).`);
+    return;
+  }
+  console.log(chalk5.yellow(`Update available: ${VERSION} \u2192 ${latest}`));
+  if (opts.check) {
+    console.log(chalk5.dim('Run "vibgrate update" to install.'));
+    return;
+  }
+  const cwd = process.cwd();
+  const globalPm = detectGlobalInstall();
+  const isGlobal = opts.global || globalPm !== null;
+  const pm = opts.pm || (globalPm ?? await detectPackageManager(cwd));
+  let cmd;
+  if (isGlobal) {
+    cmd = getGlobalUpdateCommand(pm, "@vibgrate/cli", latest);
+    console.log(chalk5.dim(`Updating global installation with ${pm}: ${cmd}`));
+  } else {
+    const isDev = await isDevDependency(cwd);
+    cmd = getInstallCommand(pm, "@vibgrate/cli", latest, isDev);
+    console.log(chalk5.dim(`Using ${pm}: ${cmd}`));
+  }
+  try {
+    execSync(cmd, { cwd, stdio: "inherit" });
+    console.log(chalk5.green("\u2714") + ` Updated to @vibgrate/cli@${latest}`);
+  } catch {
+    console.error(chalk5.red(`Update failed. Run manually: ${cmd}`));
+    process.exit(1);
+  }
+});
+var OPENVEX_CONTEXT = "https://openvex.dev/ns/v0.2.0";
+var VEX_STATUSES = ["not_affected", "affected", "fixed", "under_investigation"];
+var VEX_JUSTIFICATIONS = [
+  "component_not_present",
+  "vulnerable_code_not_present",
+  "vulnerable_code_not_in_execute_path",
+  "vulnerable_code_cannot_be_controlled_by_adversary",
+  "inline_mitigations_already_exist"
+];
+var VexValidationError = class extends Error {
+};
+function buildVexDocument(opts) {
+  const statements = opts.statements.map((s, i) => {
+    if (!s.vulnerability || typeof s.vulnerability !== "string") {
+      throw new VexValidationError(`statement[${i}]: "vulnerability" is required`);
+    }
+    if (!VEX_STATUSES.includes(s.status)) {
+      throw new VexValidationError(
+        `statement[${i}] (${s.vulnerability}): invalid status "${s.status}". Expected one of: ${VEX_STATUSES.join(", ")}`
+      );
+    }
+    const products = s.products && s.products.length > 0 ? s.products : opts.defaultProduct ? [opts.defaultProduct] : [];
+    if (products.length === 0) {
+      throw new VexValidationError(
+        `statement[${i}] (${s.vulnerability}): no product. Set "products" on the statement or pass --product.`
+      );
+    }
+    if (s.status === "not_affected" && !s.justification && !s.impact_statement) {
+      throw new VexValidationError(
+        `statement[${i}] (${s.vulnerability}): "not_affected" requires a justification or impact_statement.`
+      );
+    }
+    if (s.justification && !VEX_JUSTIFICATIONS.includes(s.justification)) {
+      throw new VexValidationError(
+        `statement[${i}] (${s.vulnerability}): invalid justification "${s.justification}". Expected one of: ${VEX_JUSTIFICATIONS.join(", ")}`
+      );
+    }
+    if (s.status === "affected" && !s.action_statement) {
+      throw new VexValidationError(
+        `statement[${i}] (${s.vulnerability}): "affected" requires an action_statement.`
+      );
+    }
+    const out2 = {
+      vulnerability: { name: s.vulnerability },
+      products: products.map((p) => ({ "@id": p })),
+      status: s.status
+    };
+    if (s.justification) out2.justification = s.justification;
+    if (s.impact_statement) out2.impact_statement = s.impact_statement;
+    if (s.action_statement) out2.action_statement = s.action_statement;
+    return out2;
+  });
+  return {
+    "@context": OPENVEX_CONTEXT,
+    "@id": opts.id ?? `https://vibgrate.com/vex/${randomUUID()}`,
+    author: opts.author,
+    timestamp: opts.timestamp ?? (/* @__PURE__ */ new Date()).toISOString(),
+    version: 1,
+    statements
+  };
+}
+async function loadStatementsFile(filePath) {
+  const data = await readJsonFile(filePath);
+  const arr = Array.isArray(data) ? data : data && typeof data === "object" && Array.isArray(data.statements) ? data.statements : null;
+  if (!arr) {
+    throw new VexValidationError(
+      `${filePath}: expected a JSON array of statements or an object with a "statements" array.`
+    );
+  }
+  return arr;
+}
+function collectStatement(value, previous) {
+  let parsed;
+  try {
+    parsed = JSON.parse(value);
+  } catch {
+    throw new VexValidationError(`--statement must be a JSON object: ${value.slice(0, 60)}\u2026`);
+  }
+  return [...previous, parsed];
+}
+var vexCommand = new Command("vex").description("Generate an OpenVEX document (exploitability statements) for attestation").option("--from <file>", 'Read statements from a JSON file (array, or an object with a "statements" array)').option(
+  "--statement <json>",
+  `Add a statement as inline JSON, e.g. '{"vulnerability":"CVE-2024-1","status":"not_affected","justification":"vulnerable_code_not_present"}'. Repeatable.`,
+  collectStatement,
+  []
+).option("--product <ref>", "Default product reference applied to statements without their own (e.g. an image digest)").option("--author <name>", "Document author", "Vibgrate").option("--timestamp <iso>", "Override the document timestamp (ISO 8601) for reproducible output").option("--id <uri>", "Override the document @id (otherwise a uuid URN is generated)").option("--out <file>", "Write the document to a file (default: stdout)").action(async (opts) => {
+  try {
+    const statements = [];
+    if (opts.from) {
+      const fromPath = path9.resolve(opts.from);
+      if (!await pathExists(fromPath)) {
+        process.stderr.write(chalk5.red(`Statements file not found: ${fromPath}
+`));
+        process.exit(1);
+      }
+      statements.push(...await loadStatementsFile(fromPath));
+    }
+    statements.push(...opts.statement);
+    const doc = buildVexDocument({
+      author: opts.author,
+      defaultProduct: opts.product,
+      timestamp: opts.timestamp,
+      id: opts.id,
+      statements
+    });
+    const json2 = JSON.stringify(doc, null, 2);
+    if (opts.out) {
+      await writeTextFile(path9.resolve(opts.out), json2 + "\n");
+      process.stderr.write(
+        chalk5.green("\u2714") + ` Wrote OpenVEX document (${doc.statements.length} statement(s)) to ${path9.resolve(opts.out)}
+`
+      );
+    } else {
+      process.stdout.write(json2 + "\n");
+    }
+  } catch (err) {
+    if (err instanceof VexValidationError) {
+      process.stderr.write(chalk5.red(`VEX validation error: ${err.message}
+`));
+      process.exit(1);
+    }
+    throw err;
+  }
+});
+
+// src/reporting/commands/sbom.ts
+function deterministicUuid(seed) {
+  const bytes = new Uint8Array(16);
+  for (let block = 0; block < 4; block++) {
+    let h = 2166136261;
+    const s = `${block} ${seed}`;
+    for (let i = 0; i < s.length; i++) {
+      h ^= s.charCodeAt(i);
+      h = Math.imul(h, 16777619);
+    }
+    h >>>= 0;
+    bytes[block * 4] = h >>> 24 & 255;
+    bytes[block * 4 + 1] = h >>> 16 & 255;
+    bytes[block * 4 + 2] = h >>> 8 & 255;
+    bytes[block * 4 + 3] = h & 255;
+  }
+  bytes[6] = bytes[6] & 15 | 128;
+  bytes[8] = bytes[8] & 63 | 128;
+  const hex = Array.from(bytes, (b) => b.toString(16).padStart(2, "0")).join("");
+  return `${hex.slice(0, 8)}-${hex.slice(8, 12)}-${hex.slice(12, 16)}-${hex.slice(16, 20)}-${hex.slice(20)}`;
+}
+function sbomSerialSeed(format, artifact, deps) {
+  return [
+    format,
+    artifact.rootPath ?? "",
+    artifact.timestamp ?? "",
+    artifact.vibgrateVersion ?? "",
+    ...deps.map((d) => `${d.package}|${d.version}|${d.currentSpec}|${d.project}|${d.drift}|${d.majorsBehind ?? ""}`)
+  ].join("\n");
+}
+function flattenDependencies(artifact) {
+  const rows = [];
+  for (const project of artifact.projects) {
+    for (const dep of project.dependencies) {
+      rows.push({
+        project: project.name,
+        package: dep.package,
+        version: dep.resolvedVersion ?? dep.currentSpec,
+        currentSpec: dep.currentSpec,
+        drift: dep.drift,
+        majorsBehind: dep.majorsBehind
+      });
+    }
+  }
+  return rows;
+}
+function toCycloneDx(artifact) {
+  const dependencies = flattenDependencies(artifact);
+  return {
+    bomFormat: "CycloneDX",
+    specVersion: "1.5",
+    serialNumber: `urn:uuid:${deterministicUuid(sbomSerialSeed("cyclonedx", artifact, dependencies))}`,
+    version: 1,
+    metadata: {
+      timestamp: artifact.timestamp,
+      tools: [
+        {
+          vendor: "Vibgrate",
+          name: "@vibgrate/cli",
+          version: artifact.vibgrateVersion
+        }
+      ],
+      component: {
+        type: "application",
+        name: artifact.rootPath
+      }
+    },
+    components: dependencies.map((dep) => ({
+      type: "library",
+      name: dep.package,
+      version: dep.version,
+      properties: [
+        { name: "vibgrate:project", value: dep.project },
+        { name: "vibgrate:currentSpec", value: dep.currentSpec },
+        { name: "vibgrate:drift", value: dep.drift },
+        { name: "vibgrate:majorsBehind", value: String(dep.majorsBehind ?? "unknown") }
+      ]
+    }))
+  };
+}
+function toSpdx(artifact) {
+  const dependencies = flattenDependencies(artifact);
+  return {
+    spdxVersion: "SPDX-2.3",
+    dataLicense: "CC0-1.0",
+    SPDXID: "SPDXRef-DOCUMENT",
+    name: `${artifact.rootPath}-sbom`,
+    documentNamespace: `https://vibgrate.com/spdx/${artifact.rootPath}/${deterministicUuid(sbomSerialSeed("spdx", artifact, dependencies))}`,
+    creationInfo: {
+      created: artifact.timestamp,
+      creators: [`Tool: @vibgrate/cli-${artifact.vibgrateVersion}`]
+    },
+    packages: dependencies.map((dep, i) => ({
+      name: dep.package,
+      SPDXID: `SPDXRef-Package-${i + 1}`,
+      versionInfo: dep.version,
+      downloadLocation: "NOASSERTION",
+      filesAnalyzed: false,
+      externalRefs: [
+        {
+          referenceCategory: "PACKAGE-MANAGER",
+          referenceType: "purl",
+          referenceLocator: `pkg:npm/${encodeURIComponent(dep.package)}@${encodeURIComponent(dep.version)}`
+        }
+      ],
+      annotations: [
+        {
+          annotationType: "OTHER",
+          annotator: "Tool: @vibgrate/cli",
+          annotationDate: artifact.timestamp,
+          comment: `project=${dep.project}; drift=${dep.drift}; majorsBehind=${dep.majorsBehind ?? "unknown"}`
+        }
+      ]
+    }))
+  };
+}
+function projectDependencyMap(artifact) {
+  const map = /* @__PURE__ */ new Map();
+  for (const project of artifact.projects) {
+    for (const dep of project.dependencies) {
+      map.set(`${project.name}:${dep.package}`, dep);
+    }
+  }
+  return map;
+}
+function formatDeltaText(base, current) {
+  const baseMap = projectDependencyMap(base);
+  const currentMap = projectDependencyMap(current);
+  const added = [];
+  const removed = [];
+  const changed = [];
+  for (const [key, dep] of currentMap.entries()) {
+    if (!baseMap.has(key)) {
+      added.push(`${key} @ ${dep.resolvedVersion ?? dep.currentSpec}`);
+      continue;
+    }
+    const prev = baseMap.get(key);
+    const prevVersion = prev.resolvedVersion ?? prev.currentSpec;
+    const nowVersion = dep.resolvedVersion ?? dep.currentSpec;
+    if (prevVersion !== nowVersion || prev.majorsBehind !== dep.majorsBehind) {
+      changed.push(`${key} ${prevVersion} -> ${nowVersion} (majorsBehind ${prev.majorsBehind ?? "unknown"} -> ${dep.majorsBehind ?? "unknown"})`);
+    }
+  }
+  for (const [key, dep] of baseMap.entries()) {
+    if (!currentMap.has(key)) {
+      removed.push(`${key} @ ${dep.resolvedVersion ?? dep.currentSpec}`);
+    }
+  }
+  const lines = [
+    "Vibgrate SBOM Delta",
+    "===================",
+    `Baseline: ${base.timestamp}`,
+    `Current:  ${current.timestamp}`,
+    `Drift score delta: ${(current.drift.score - base.drift.score).toFixed(2)} points`,
+    "",
+    `Added dependencies (${added.length})`,
+    ...added.map((d) => `  + ${d}`),
+    "",
+    `Removed dependencies (${removed.length})`,
+    ...removed.map((d) => `  - ${d}`),
+    "",
+    `Changed dependencies (${changed.length})`,
+    ...changed.map((d) => `  * ${d}`)
+  ];
+  return lines.join("\n");
+}
+async function readArtifactOrExit(filePath) {
+  const absolutePath = path9.resolve(filePath);
+  if (!await pathExists(absolutePath)) {
+    console.error(chalk5.red(`Artifact not found: ${absolutePath}`));
+    process.exit(1);
+  }
+  return readJsonFile(absolutePath);
+}
+var exportCommand = new Command("export").description("Export scan artifact as SBOM").option("--in <file>", "Input artifact file", ".vibgrate/scan_result.json").option("--out <file>", "Output SBOM file").option("--format <format>", "SBOM format (cyclonedx|spdx)", "cyclonedx").action(async (opts) => {
+  const artifact = await readArtifactOrExit(opts.in);
+  const format = opts.format.toLowerCase();
+  if (format !== "cyclonedx" && format !== "spdx") {
+    console.error(chalk5.red("Invalid SBOM format. Use cyclonedx or spdx."));
+    process.exit(1);
+  }
+  const sbom = format === "cyclonedx" ? toCycloneDx(artifact) : toSpdx(artifact);
+  const body = JSON.stringify(sbom, null, 2);
+  if (opts.out) {
+    await writeTextFile(path9.resolve(opts.out), body);
+    console.log(chalk5.green("\u2714") + ` SBOM written to ${opts.out}`);
+  } else {
+    console.log(body);
+  }
+});
+var deltaCommand = new Command("delta").description("Show SBOM delta between two scan artifacts").requiredOption("--from <file>", "Baseline scan artifact path").requiredOption("--to <file>", "Current scan artifact path").option("--out <file>", "Write report to file").action(async (opts) => {
+  const base = await readArtifactOrExit(opts.from);
+  const current = await readArtifactOrExit(opts.to);
+  const report = formatDeltaText(base, current);
+  if (opts.out) {
+    await writeTextFile(path9.resolve(opts.out), report);
+    console.log(chalk5.green("\u2714") + ` SBOM delta report written to ${opts.out}`);
+  } else {
+    console.log(report);
+  }
+});
+var sbomCommand = new Command("sbom").description("Supply-chain evidence: SBOM export/delta and OpenVEX generation").addCommand(exportCommand).addCommand(deltaCommand).addCommand(vexCommand);
+
+// src/cli.ts
+var KNOWN_COMMANDS = /* @__PURE__ */ new Set([
+  "build",
+  "status",
+  "verify",
+  "ask",
+  "embed",
+  "show",
+  "path",
+  "tree",
+  "impact",
+  "tests",
+  "facts",
+  "guide",
+  "why",
+  "bisect",
+  "drift",
+  "models",
+  "savings",
+  "lib",
+  "export",
+  "push",
+  "bundle",
+  "map",
+  "hubs",
+  "areas",
+  "oddities",
+  "serve",
+  "install",
+  "uninstall",
+  "share",
+  "benchmark",
+  "help",
+  // Drift-reporting verbs (merged from the Vibgrate CLI).
+  "init",
+  "scan",
+  "baseline",
+  "report",
+  "login",
+  "logout",
+  "dsn",
+  "update",
+  "sbom"
+]);
+function buildProgram() {
+  const program = new Command();
+  program.name("vg").description(
+    "vg \u2014 local codebase intelligence for AI coding agents: a deterministic, no-API-key code graph + MCP server, drift reporting, and version-correct library docs"
+  ).version(VERSION, "--version", "output the version number").showSuggestionAfterError(true).addHelpText(
+    "after",
+    '\nRun `vg` to scan + map the current folder, `vg "<question>"` to ask, `vg status`/`vg verify` for state.\nDrift: `vg scan` / `vg report`. Wire into your AI agent: `vg install`.\nThe `vibgrate` command is an alias for `vg`.\nDocs: https://vibgrate.com/help'
+  );
+  registerBuild(program);
+  registerStatus(program);
+  registerVerify(program);
+  registerAsk(program);
+  registerEmbed(program);
+  registerShow(program);
+  registerPath(program);
+  registerTree(program);
+  registerInsights(program);
+  registerImpact(program);
+  registerServe(program);
+  registerInstall(program);
+  registerShare(program);
+  registerBenchmark(program);
+  registerTests(program);
+  registerFacts(program);
+  registerGuide(program);
+  registerWhy(program);
+  registerBisect(program);
+  registerDrift(program);
+  registerModels(program);
+  registerSavings(program);
+  registerLib(program);
+  registerExport(program);
+  registerBundle(program);
+  program.addCommand(initCommand);
+  program.addCommand(scanCommand);
+  program.addCommand(baselineCommand);
+  program.addCommand(reportCommand);
+  program.addCommand(loginCommand);
+  program.addCommand(logoutCommand);
+  program.addCommand(dsnCommand);
+  program.addCommand(pushCommand);
+  program.addCommand(updateCommand);
+  program.addCommand(sbomCommand);
+  return program;
+}
+var VALUE_FLAGS = /* @__PURE__ */ new Set([
+  "-C",
+  "--cwd",
+  "--generated-at",
+  "--graph",
+  "--jobs",
+  "--only",
+  "--exclude",
+  "--export",
+  "-o",
+  "--budget",
+  "-b"
+]);
+var BUILD_ONLY_FLAGS = /* @__PURE__ */ new Set([
+  "--json",
+  "--jobs",
+  "--only",
+  "--export",
+  "--graph",
+  "--generated-at",
+  "--no-cache",
+  "--deep",
+  "--scip",
+  "--no-scip",
+  "--tsc",
+  "--no-tsc",
+  "--ground",
+  "--no-ground",
+  "--html",
+  "--no-html",
+  "--report",
+  "--no-report",
+  "--warm"
+]);
+function hasBuildOnlyFlag(args) {
+  return args.some((a) => BUILD_ONLY_FLAGS.has(a.split("=")[0]));
+}
+function dispatch(argv, cwd) {
+  const args = [...argv];
+  const firstPositionalIdx = findFirstPositional(args);
+  if (firstPositionalIdx === -1) {
+    if (args.includes("--help") || args.includes("-h") || args.includes("--version")) {
+      return args;
+    }
+    return [hasBuildOnlyFlag(args) ? "build" : "scan", ...args];
+  }
+  const first = args[firstPositionalIdx];
+  if (KNOWN_COMMANDS.has(first)) {
+    const rest = [...args];
+    rest.splice(firstPositionalIdx, 1);
+    return [first, ...rest];
+  }
+  const looksLikeQuestion = /\s/.test(first) || first.endsWith("?");
+  if (looksLikeQuestion) return ["ask", ...args];
+  if (fs4.existsSync(path9.resolve(cwd, first))) {
+    return [hasBuildOnlyFlag(args) ? "build" : "scan", ...args];
+  }
+  return ["ask", ...args];
+}
+function findFirstPositional(args) {
+  for (let i = 0; i < args.length; i++) {
+    const a = args[i];
+    if (a.startsWith("-")) {
+      if (VALUE_FLAGS.has(a)) i++;
+      continue;
+    }
+    return i;
+  }
+  return -1;
+}
+async function main(argv = process.argv) {
+  const raw = argv.slice(2);
+  if (process.env.NO_COLOR || raw.includes("--no-color")) disableColor();
+  const cwd = readCwd(raw);
+  const dispatched = dispatch(raw, cwd);
+  const program = buildProgram();
+  program.exitOverride((err) => {
+    throw err;
+  });
+  program.configureOutput({
+    writeErr: (str) => process.stderr.write(str),
+    writeOut: (str) => process.stdout.write(str)
+  });
+  try {
+    await program.parseAsync(dispatched, { from: "user" });
+  } catch (err) {
+    handleError(err);
+  }
+}
+function readCwd(raw) {
+  const i = raw.findIndex((a) => a === "-C" || a === "--cwd");
+  if (i >= 0 && raw[i + 1]) return path9.resolve(raw[i + 1]);
+  const eq = raw.find((a) => a.startsWith("--cwd="));
+  if (eq) return path9.resolve(eq.slice("--cwd=".length));
+  return process.cwd();
+}
+function handleError(err) {
+  if (err instanceof CommanderError) {
+    if (err.code === "commander.helpDisplayed" || err.code === "commander.help") {
+      process.exit(ExitCode.OK);
+    }
+    if (err.code === "commander.version") process.exit(ExitCode.OK);
+    process.exit(ExitCode.USAGE_ERROR);
+  }
+  if (err instanceof CliError) {
+    info(c.red(`error: ${err.message}`));
+    process.exit(err.code);
+  }
+  const message = err instanceof Error ? err.message : String(err);
+  const correlation = Math.random().toString(36).slice(2, 10);
+  info(c.red(`error: ${message}`));
+  info(c.dim(`  (ref ${correlation}) \u2014 re-run with --json for detail, or report at https://vibgrate.com/help`));
+  process.exit(ExitCode.ERROR);
+}
+function isEntry() {
+  try {
+    if (!process.argv[1]) return false;
+    return realpathSync(process.argv[1]) === fileURLToPath(import.meta.url);
+  } catch {
+    return false;
+  }
+}
+if (isEntry()) {
+  void main();
+}
+
+export { KNOWN_COMMANDS, buildProgram, dispatch, main, runBuild };
+//# sourceMappingURL=cli.js.map
+//# sourceMappingURL=cli.js.map