@vibgrate/cli 2026.703.7 → 2026.704.1

package/dist/{chunk-ZNVLRKWK.js → chunk-W4ANUENJ.js}

@@ -1,4 +1,4 @@
-import { runCoreScan, writeJsonFile } from './chunk-QWS7M7DG.js';
+import { runCoreScan, writeJsonFile } from './chunk-RJHYTD62.js';
 import * as path from 'path';
 import { Command } from 'commander';
 import chalk from 'chalk';
@@ -27,5 +27,5 @@ var baselineCommand = new Command("baseline").description("Create a drift baseli
 });
 
 export { baselineCommand, loadAdvancedScanHook, runBaseline };
-//# sourceMappingURL=chunk-ZNVLRKWK.js.map
-//# sourceMappingURL=chunk-ZNVLRKWK.js.map
+//# sourceMappingURL=chunk-W4ANUENJ.js.map
+//# sourceMappingURL=chunk-W4ANUENJ.js.map

package/dist/{chunk-ZNVLRKWK.js.map → chunk-W4ANUENJ.js.map}

@@ -1 +1 @@
-{"version":3,"sources":["../src/reporting/advanced-hook.ts","../src/reporting/commands/baseline.ts"],"names":[],"mappings":";;;;;;AAUA,eAAsB,oBAAA,GAA8D;AAClF,EAAA,OAAO,MAAA;AACT;;;ACLA,eAAsB,YAAY,OAAA,EAAgC;AAChE,EAAA,OAAA,CAAQ,GAAA,CAAI,KAAA,CAAM,GAAA,CAAI,sBAAsB,CAAC,CAAA;AAE7C,EAAA,MAAM,QAAA,GAAW,MAAM,oBAAA,EAAqB;AAC5C,EAAA,MAAM,QAAA,GAAW,MAAM,WAAA,CAAY,OAAA,EAAS;AAAA,IAC1C,MAAA,EAAQ,MAAA;AAAA,IACR,WAAA,EAAa;AAAA,KACZ,QAAQ,CAAA;AAEX,EAAA,MAAM,YAAA,GAAoB,IAAA,CAAA,IAAA,CAAK,OAAA,EAAS,WAAA,EAAa,eAAe,CAAA;AACpE,EAAA,MAAM,aAAA,CAAc,cAAc,QAAQ,CAAA;AAC1C,EAAA,OAAA,CAAQ,GAAA,CAAI,KAAA,CAAM,KAAA,CAAM,QAAG,CAAA,GAAI,sBAAsB,KAAA,CAAM,IAAA,CAAK,yBAAyB,CAAC,CAAA,CAAE,CAAA;AAC5F,EAAA,OAAA,CAAQ,GAAA,CAAI,MAAM,GAAA,CAAI,CAAA,kBAAA,EAAqB,SAAS,KAAA,CAAM,KAAK,MAAM,CAAC,CAAA;AACxE;AAEO,IAAM,eAAA,GAAkB,IAAI,OAAA,CAAQ,UAAU,EAClD,WAAA,CAAY,kCAAkC,CAAA,CAC9C,QAAA,CAAS,UAAU,kBAAA,EAAoB,GAAG,CAAA,CAC1C,MAAA,CAAO,OAAO,UAAA,KAAuB;AACpC,EAAA,MAAM,OAAA,GAAe,aAAQ,UAAU,CAAA;AACvC,EAAA,MAAM,YAAY,OAAO,CAAA;AAC3B,CAAC","file":"chunk-ZNVLRKWK.js","sourcesContent":["import type { AdvancedScanHook } from '../core-open/index.js';\n\n/**\n * Open build: there is no proprietary advanced-analysis hook.\n *\n * In the public, Apache-2.0 distribution every reporting command runs purely on\n * the open base engine (`runCoreScan` from `@vibgrate/core-open`). This shim\n * keeps the call sites in `scan`/`baseline` unchanged while always resolving to\n * `undefined`, so the scan falls back to the open base engine.\n */\nexport async function loadAdvancedScanHook(): Promise<AdvancedScanHook | undefined> {\n  return undefined;\n}\n","import * as path from 'node:path';\nimport { Command } from 'commander';\nimport chalk from 'chalk';\nimport { runCoreScan } from '../../core-open/index.js';\nimport { writeJsonFile } from '../utils/fs.js';\nimport { loadAdvancedScanHook } from '../advanced-hook.js';\n\nexport async function runBaseline(rootDir: string): Promise<void> {\n  console.log(chalk.dim('Creating baseline...'));\n\n  const advanced = await loadAdvancedScanHook();\n  const artifact = await runCoreScan(rootDir, {\n    format: 'text',\n    concurrency: 8,\n  }, advanced);\n\n  const baselinePath = path.join(rootDir, '.vibgrate', 'baseline.json');\n  await writeJsonFile(baselinePath, artifact);\n  console.log(chalk.green('✔') + ` Baseline saved to ${chalk.bold('.vibgrate/baseline.json')}`);\n  console.log(chalk.dim(`  Baseline score: ${artifact.drift.score}/100`));\n}\n\nexport const baselineCommand = new Command('baseline')\n  .description('Create a drift baseline snapshot')\n  .argument('[path]', 'Path to baseline', '.')\n  .action(async (targetPath: string) => {\n    const rootDir = path.resolve(targetPath);\n    await runBaseline(rootDir);\n  });\n"]}
+{"version":3,"sources":["../src/reporting/advanced-hook.ts","../src/reporting/commands/baseline.ts"],"names":[],"mappings":";;;;;;AAUA,eAAsB,oBAAA,GAA8D;AAClF,EAAA,OAAO,MAAA;AACT;;;ACLA,eAAsB,YAAY,OAAA,EAAgC;AAChE,EAAA,OAAA,CAAQ,GAAA,CAAI,KAAA,CAAM,GAAA,CAAI,sBAAsB,CAAC,CAAA;AAE7C,EAAA,MAAM,QAAA,GAAW,MAAM,oBAAA,EAAqB;AAC5C,EAAA,MAAM,QAAA,GAAW,MAAM,WAAA,CAAY,OAAA,EAAS;AAAA,IAC1C,MAAA,EAAQ,MAAA;AAAA,IACR,WAAA,EAAa;AAAA,KACZ,QAAQ,CAAA;AAEX,EAAA,MAAM,YAAA,GAAoB,IAAA,CAAA,IAAA,CAAK,OAAA,EAAS,WAAA,EAAa,eAAe,CAAA;AACpE,EAAA,MAAM,aAAA,CAAc,cAAc,QAAQ,CAAA;AAC1C,EAAA,OAAA,CAAQ,GAAA,CAAI,KAAA,CAAM,KAAA,CAAM,QAAG,CAAA,GAAI,sBAAsB,KAAA,CAAM,IAAA,CAAK,yBAAyB,CAAC,CAAA,CAAE,CAAA;AAC5F,EAAA,OAAA,CAAQ,GAAA,CAAI,MAAM,GAAA,CAAI,CAAA,kBAAA,EAAqB,SAAS,KAAA,CAAM,KAAK,MAAM,CAAC,CAAA;AACxE;AAEO,IAAM,eAAA,GAAkB,IAAI,OAAA,CAAQ,UAAU,EAClD,WAAA,CAAY,kCAAkC,CAAA,CAC9C,QAAA,CAAS,UAAU,kBAAA,EAAoB,GAAG,CAAA,CAC1C,MAAA,CAAO,OAAO,UAAA,KAAuB;AACpC,EAAA,MAAM,OAAA,GAAe,aAAQ,UAAU,CAAA;AACvC,EAAA,MAAM,YAAY,OAAO,CAAA;AAC3B,CAAC","file":"chunk-W4ANUENJ.js","sourcesContent":["import type { AdvancedScanHook } from '../core-open/index.js';\n\n/**\n * Open build: there is no proprietary advanced-analysis hook.\n *\n * In the public, Apache-2.0 distribution every reporting command runs purely on\n * the open base engine (`runCoreScan` from `@vibgrate/core-open`). This shim\n * keeps the call sites in `scan`/`baseline` unchanged while always resolving to\n * `undefined`, so the scan falls back to the open base engine.\n */\nexport async function loadAdvancedScanHook(): Promise<AdvancedScanHook | undefined> {\n  return undefined;\n}\n","import * as path from 'node:path';\nimport { Command } from 'commander';\nimport chalk from 'chalk';\nimport { runCoreScan } from '../../core-open/index.js';\nimport { writeJsonFile } from '../utils/fs.js';\nimport { loadAdvancedScanHook } from '../advanced-hook.js';\n\nexport async function runBaseline(rootDir: string): Promise<void> {\n  console.log(chalk.dim('Creating baseline...'));\n\n  const advanced = await loadAdvancedScanHook();\n  const artifact = await runCoreScan(rootDir, {\n    format: 'text',\n    concurrency: 8,\n  }, advanced);\n\n  const baselinePath = path.join(rootDir, '.vibgrate', 'baseline.json');\n  await writeJsonFile(baselinePath, artifact);\n  console.log(chalk.green('✔') + ` Baseline saved to ${chalk.bold('.vibgrate/baseline.json')}`);\n  console.log(chalk.dim(`  Baseline score: ${artifact.drift.score}/100`));\n}\n\nexport const baselineCommand = new Command('baseline')\n  .description('Create a drift baseline snapshot')\n  .argument('[path]', 'Path to baseline', '.')\n  .action(async (targetPath: string) => {\n    const rootDir = path.resolve(targetPath);\n    await runBaseline(rootDir);\n  });\n"]}

package/dist/{chunk-WGXDYBAN.js → chunk-YODVLV37.js}

@@ -1,9 +1,10 @@
-import { langById, shortId, canonicalize, grammarSetVersion, hashBytes, hashString, langForExtension, setGrammarsOverride, parseSource } from './chunk-X5YT263H.js';
-import { writeTextFile, pathExists, readJsonFile, VERSION, computeUpgradeImpact, getChangelogSignals, gitHistoryAvailable, buildVersionTimelines, findPackageTimeline, severityRank, projectTypeToVulnEcosystem } from './chunk-QWS7M7DG.js';
+import { langById, shortId, canonicalize, grammarSetVersion, hashString, hashBytes, langForExtension, setGrammarsOverride, parseSource } from './chunk-X5YT263H.js';
+import { writeTextFile, pathExists, readJsonFile, VERSION, computeUpgradeImpact, getChangelogSignals, gitHistoryAvailable, buildVersionTimelines, findPackageTimeline, severityRank, projectTypeToVulnEcosystem } from './chunk-RJHYTD62.js';
 import * as fs18 from 'fs';
 import { execFileSync } from 'child_process';
 import * as path18 from 'path';
 import ignore from 'ignore';
+import * as v8 from 'v8';
 import Graph from 'graphology';
 import pagerank from 'graphology-metrics/centrality/pagerank.js';
 import betweenness from 'graphology-metrics/centrality/betweenness.js';
@@ -45,47 +46,174 @@ function isOwnBinary(binPath) {
     return false;
   }
 }
+function isEphemeralNpxBinary(binPath) {
+  const NPX_SEGMENT = /[\\/]_npx[\\/]/;
+  if (NPX_SEGMENT.test(binPath)) return true;
+  try {
+    return NPX_SEGMENT.test(fs18.realpathSync(binPath));
+  } catch {
+    return false;
+  }
+}
+function isInstalledOwnBinary(binPath) {
+  return isOwnBinary(binPath) && !isEphemeralNpxBinary(binPath);
+}
 var cached;
 function resolveCliInvocation(which) {
   if (!which && cached !== void 0) return cached;
   const lookup = which ?? whichOnPath;
   const vg = lookup("vg");
   let result;
-  if (vg && isOwnBinary(vg)) {
+  if (vg && isInstalledOwnBinary(vg)) {
     result = "vg";
   } else {
     const vibgrate = lookup("vibgrate");
-    result = vibgrate && isOwnBinary(vibgrate) ? "vibgrate" : NPX_INVOCATION;
+    result = vibgrate && isInstalledOwnBinary(vibgrate) ? "vibgrate" : NPX_INVOCATION;
   }
   if (!which) cached = result;
   return result;
 }
 var SKIP_DIRS = /* @__PURE__ */ new Set([
+  // Version control, IDE & tool metadata
   ".git",
-  "node_modules",
+  ".svn",
+  ".hg",
+  ".idea",
+  ".vscode",
+  ".vs",
   ".vibgrate",
+  ".wrangler",
+  ".turbo",
+  ".cache",
+  // JavaScript / Node — installed dependency trees
+  "node_modules",
+  "bower_components",
+  "jspm_packages",
+  "web_modules",
+  ".pnpm-store",
+  ".yarn",
+  // JS/TS meta-framework & bundler build output
+  ".next",
+  ".nuxt",
+  ".output",
+  ".svelte-kit",
+  ".astro",
+  ".vercel",
+  ".netlify",
+  ".angular",
+  ".parcel-cache",
+  ".docusaurus",
+  "storybook-static",
+  // Generic build / dist / coverage output
   "dist",
   "build",
   "out",
   "coverage",
-  ".next",
-  ".nuxt",
-  ".svelte-kit",
-  ".turbo",
-  ".cache",
+  // Vendored third-party source trees
   "vendor",
-  "target",
-  // rust / java
-  "bin",
-  "obj",
-  // .NET
-  "__pycache__",
+  "Pods",
+  "Carthage",
+  // Python — virtualenvs & tool caches
   ".venv",
   "venv",
+  "virtualenv",
   ".tox",
+  ".nox",
+  "__pycache__",
+  ".mypy_cache",
+  ".pytest_cache",
+  ".ruff_cache",
+  ".eggs",
+  ".ipynb_checkpoints",
+  // Ruby
+  ".bundle",
+  // Rust / Maven / sbt / Clojure — all build into target/
+  "target",
+  // JVM (Gradle / Maven) & .NET build output
   ".gradle",
-  ".idea",
-  ".vscode"
+  "bin",
+  "obj",
+  "TestResults",
+  // Swift / Xcode
+  ".build",
+  ".swiftpm",
+  "DerivedData",
+  // Dart / Flutter
+  ".dart_tool",
+  // Elixir / Erlang
+  "_build",
+  "deps",
+  // Haskell (Cabal / Stack)
+  "dist-newstyle",
+  ".stack-work",
+  // Infrastructure-as-code build/state
+  ".terraform",
+  ".serverless",
+  "cdk.out",
+  ".aws-sam"
+]);
+var SKIP_FILES = /* @__PURE__ */ new Set([
+  // JavaScript / Node
+  "package-lock.json",
+  "npm-shrinkwrap.json",
+  "yarn.lock",
+  "pnpm-lock.yaml",
+  "bun.lockb",
+  "bun.lock",
+  "deno.lock",
+  ".pnp.cjs",
+  ".pnp.data.json",
+  ".pnp.loader.mjs",
+  // Python
+  "poetry.lock",
+  "pipfile.lock",
+  "pdm.lock",
+  "uv.lock",
+  "pylock.toml",
+  "conda-lock.yml",
+  // Ruby
+  "gemfile.lock",
+  // PHP
+  "composer.lock",
+  // Rust
+  "cargo.lock",
+  // Go
+  "go.sum",
+  "go.work.sum",
+  "gopkg.lock",
+  "glide.lock",
+  // .NET
+  "packages.lock.json",
+  // Java / JVM (Gradle)
+  "gradle.lockfile",
+  // Swift / Xcode
+  "package.resolved",
+  // Dart / Flutter
+  "pubspec.lock",
+  // Elixir
+  "mix.lock",
+  // Haskell (Cabal / Stack)
+  "cabal.project.freeze",
+  "stack.yaml.lock",
+  // Julia
+  "manifest.toml",
+  // R
+  "renv.lock",
+  // Perl (Carton)
+  "cpanfile.snapshot",
+  // CocoaPods / Carthage
+  "podfile.lock",
+  "cartfile.resolved",
+  // Terraform / IaC
+  ".terraform.lock.hcl",
+  // Helm
+  "chart.lock",
+  // C / C++ (Conan)
+  "conan.lock",
+  // Bazel
+  "module.bazel.lock",
+  // Nix
+  "flake.lock"
 ]);
 function toPosix(p) {
   return p.split(path18.sep).join("/");
@@ -115,6 +243,7 @@ function discover(options) {
     const rel2 = toPosix(path18.relative(root, abs));
     if (rel2.startsWith("..")) return;
     if (rel2 === "" || rootIg.ignores(rel2)) return;
+    if (SKIP_FILES.has(path18.basename(abs).toLowerCase())) return;
     const lang = langForExtension(path18.extname(abs));
     if (!lang || !allowLang(lang)) return;
     found.set(rel2, { rel: rel2, abs, lang });
@@ -152,6 +281,58 @@ var UsageError = class extends Error {
     this.name = "UsageError";
   }
 };
+var MIB = 1024 * 1024;
+var DEFAULT_MAX_FILE_BYTES = 2 * MIB;
+var DEFAULT_MAX_FILES = 1e5;
+var DEFAULT_TSC_MAX_FILES = 1e4;
+var HEAP_GUARD_FRACTION = 0.9;
+var ResourceLimitError = class extends Error {
+  isResourceLimitError = true;
+  constructor(message) {
+    super(message);
+    this.name = "ResourceLimitError";
+  }
+};
+function envInt(name, fallback) {
+  const raw = process.env[name];
+  if (raw === void 0 || raw.trim() === "") return fallback;
+  const n = Number(raw);
+  return Number.isInteger(n) && n >= 0 ? n : fallback;
+}
+function envIntOptional(name) {
+  const n = envInt(name, 0);
+  return n > 0 ? n : void 0;
+}
+function defaultMemoryBudgetMb() {
+  return Math.floor(v8.getHeapStatistics().heap_size_limit / MIB * HEAP_GUARD_FRACTION);
+}
+function resolveLimits(overrides = {}) {
+  return {
+    maxFileBytes: overrides.maxFileBytes ?? envInt("VG_MAX_FILE_BYTES", DEFAULT_MAX_FILE_BYTES),
+    maxFiles: overrides.maxFiles ?? envInt("VG_MAX_FILES", DEFAULT_MAX_FILES),
+    tscMaxFiles: overrides.tscMaxFiles ?? envInt("VG_TSC_MAX_FILES", DEFAULT_TSC_MAX_FILES),
+    memoryBudgetMb: overrides.memoryBudgetMb ?? envInt("VG_MEMORY_BUDGET_MB", defaultMemoryBudgetMb())
+  };
+}
+function envJobs() {
+  return envIntOptional("VG_JOBS");
+}
+function envWorkerHeapMb() {
+  return envIntOptional("VG_WORKER_HEAP_MB");
+}
+function checkMemoryBudget(phase, budgetMb) {
+  if (budgetMb <= 0) return;
+  const usedMb = process.memoryUsage().heapUsed / MIB;
+  if (usedMb <= budgetMb) return;
+  throw new ResourceLimitError(
+    `graph build stopped during ${phase}: heap use ${Math.round(usedMb)} MiB exceeds the ${budgetMb} MiB budget. Narrow the build (scope to sub-paths, add --exclude globs, or --only <langs>), raise the Node heap (NODE_OPTIONS=--max-old-space-size=8192), or set VG_MEMORY_BUDGET_MB (0 disables this safeguard).`
+  );
+}
+function formatBytes(n) {
+  if (n >= MIB) return `${(n / MIB).toFixed(1)} MiB`;
+  if (n >= 1024) return `${(n / 1024).toFixed(1)} KiB`;
+  return `${n} B`;
+}
 var JS_TS_EXT = [".ts", ".tsx", ".mts", ".cts", ".js", ".jsx", ".mjs", ".cjs"];
 var OTHER_EXT = [
   ".py",
@@ -1293,18 +1474,18 @@ var DEFAULT_INLINE_THRESHOLD = 24;
 async function parseFiles(files, options = {}) {
   const threshold = options.inlineThreshold ?? DEFAULT_INLINE_THRESHOLD;
   const cores = Math.max(1, os.cpus()?.length ?? 1);
-  const jobs = Math.max(1, options.jobs ?? (Math.min(cores - 1, files.length) || 1));
+  const jobs = Math.max(1, options.jobs ?? envJobs() ?? (Math.min(cores - 1, files.length) || 1));
   const workerFile = resolveWorkerFile();
   const useInline = options.inline === true || jobs <= 1 || files.length < threshold || workerFile === null;
   if (useInline) {
     if (options.grammarsDir) setGrammarsOverride(options.grammarsDir);
-    return sortByRel(await parseInline(files, options.onProgress));
+    return sortByRel(await parseInline(files, options));
   }
-  return sortByRel(
-    await parsePooled(files, jobs, workerFile, options.onProgress, options.grammarsDir)
-  );
+  return sortByRel(await parsePooled(files, jobs, workerFile, options));
 }
-async function parseInline(files, onProgress) {
+var MEM_CHECK_EVERY = 64;
+async function parseInline(files, options) {
+  const { onProgress, memoryBudgetMb = 0 } = options;
   const out = [];
   onProgress?.(0, files.length);
   for (const file of files) {
@@ -1315,12 +1496,20 @@ async function parseInline(files, onProgress) {
       out.push(emptyParse(file, `parse failed: ${err.message}`));
     }
     onProgress?.(out.length, files.length);
+    if (out.length % MEM_CHECK_EVERY === 0) checkMemoryBudget("parse", memoryBudgetMb);
   }
   return out;
 }
-async function parsePooled(files, jobs, workerFile, onProgress, grammarsDir) {
+async function parsePooled(files, jobs, workerFile, options) {
+  const { onProgress, grammarsDir, memoryBudgetMb = 0 } = options;
   const { default: Tinypool } = await import('tinypool');
-  const pool = new Tinypool({ filename: workerFile, maxThreads: jobs, minThreads: 1 });
+  const workerHeapMb = envWorkerHeapMb();
+  const pool = new Tinypool({
+    filename: workerFile,
+    maxThreads: jobs,
+    minThreads: 1,
+    ...workerHeapMb ? { resourceLimits: { maxOldGenerationSizeMb: workerHeapMb } } : {}
+  });
   try {
     const total = files.length;
     const buckets = chunk(
@@ -1334,15 +1523,27 @@ async function parsePooled(files, jobs, workerFile, onProgress, grammarsDir) {
         (b) => pool.run({ tasks: b, grammarsDir }).then((r) => {
           done += b.length;
           onProgress?.(done, total);
+          checkMemoryBudget("parse", memoryBudgetMb);
           return r;
         })
       )
     );
     return results.flat();
+  } catch (err) {
+    if (isWorkerOom(err)) {
+      throw new ResourceLimitError(
+        `graph build stopped: a parse worker exceeded its ${workerHeapMb ?? "?"} MiB heap cap (VG_WORKER_HEAP_MB). Raise the cap, exclude the offending files (--exclude), or run single-threaded with --jobs 1.`
+      );
+    }
+    throw err;
   } finally {
     await pool.destroy();
   }
 }
+function isWorkerOom(err) {
+  const e = err;
+  return e?.code === "ERR_WORKER_OUT_OF_MEMORY" || /out of memory/i.test(e?.message ?? "");
+}
 function resolveWorkerFile() {
   const here = path18.dirname(fileURLToPath(import.meta.url));
   const candidate = path18.join(here, "parse-worker.js");
@@ -1845,6 +2046,13 @@ async function buildGraph(options) {
     exclude: options.exclude,
     paths: options.paths
   });
+  const limits = resolveLimits(options.limits);
+  if (limits.maxFiles > 0 && files.length > limits.maxFiles) {
+    throw new ResourceLimitError(
+      `graph build stopped: ${files.length.toLocaleString()} files exceed the ${limits.maxFiles.toLocaleString()}-file limit. Scope the build (pass sub-paths, add --exclude globs, or --only <langs>), or set VG_MAX_FILES to raise the limit (0 disables it).`
+    );
+  }
+  checkMemoryBudget("discovery", limits.memoryBudgetMb);
   const grammars = grammarSetVersion();
   const cache = loadCache(root, {
     toolVersion: VERSION,
@@ -1855,11 +2063,28 @@ async function buildGraph(options) {
   const fileStats = [];
   const toParse = [];
   const reused = [];
+  const buildWarnings = [];
   for (const file of files) {
-    let hash = "";
     let stat;
     try {
       stat = fs18.statSync(file.abs);
+    } catch {
+      continue;
+    }
+    if (limits.maxFileBytes > 0 && stat.size > limits.maxFileBytes) {
+      fileStats.push({
+        rel: file.rel,
+        size: stat.size,
+        mtimeMs: stat.mtimeMs,
+        hash: hashString(`vg:oversize:${stat.size}`)
+      });
+      buildWarnings.push(
+        `${file.rel}: skipped \u2014 ${formatBytes(stat.size)} exceeds the ${formatBytes(limits.maxFileBytes)} per-file limit (set VG_MAX_FILE_BYTES to raise it, 0 to disable)`
+      );
+      continue;
+    }
+    let hash = "";
+    try {
       hash = hashBytes(fs18.readFileSync(file.abs));
     } catch {
       continue;
@@ -1874,8 +2099,10 @@ async function buildGraph(options) {
     jobs: options.jobs,
     inline: options.inline,
     onProgress: options.onParseProgress,
-    grammarsDir: options.grammarsDir
+    grammarsDir: options.grammarsDir,
+    memoryBudgetMb: limits.memoryBudgetMb
   });
+  checkMemoryBudget("parse", limits.memoryBudgetMb);
   for (const p of parsedNew) cache.set(p.rel, p);
   const currentRels = new Set(files.map((f) => f.rel));
   cache.prune(currentRels);
@@ -1883,14 +2110,21 @@ async function buildGraph(options) {
   const parses = [...reused, ...parsedNew].sort(
     (a, b) => a.rel < b.rel ? -1 : a.rel > b.rel ? 1 : 0
   );
-  const warnings = parses.flatMap((p) => p.warnings ?? []);
+  const warnings = [...buildWarnings, ...parses.flatMap((p) => p.warnings ?? [])];
   const moduleResolver = buildModuleResolver(root, new Set(parses.map((p) => p.rel)));
   const resolved = resolve4(parses, moduleResolver);
+  checkMemoryBudget("resolve", limits.memoryBudgetMb);
   const nodeFileById = new Map(resolved.nodes.map((n) => [n.id, n.file]));
   let edges = resolved.edges;
   const resolvers = [...resolved.stats.resolvers];
   let tscStats;
-  const tsFiles = options.noTsc ? [] : files.filter((f) => f.lang.id === "ts" || f.lang.id === "tsx" || f.lang.id === "js").map((f) => ({ rel: f.rel, abs: f.abs }));
+  let tsFiles = options.noTsc ? [] : files.filter((f) => (f.lang.id === "ts" || f.lang.id === "tsx" || f.lang.id === "js") && hashes.has(f.rel)).map((f) => ({ rel: f.rel, abs: f.abs }));
+  if (limits.tscMaxFiles > 0 && tsFiles.length > limits.tscMaxFiles) {
+    warnings.push(
+      `typescript resolver skipped \u2014 ${tsFiles.length.toLocaleString()} TS/JS files exceed the ${limits.tscMaxFiles.toLocaleString()}-file limit; calls use the heuristic resolver (set VG_TSC_MAX_FILES to raise it, 0 to disable)`
+    );
+    tsFiles = [];
+  }
   if (tsFiles.length) {
     const res = tsResolveEdges(root, tsFiles, resolved.nodes);
     if (res.stats.files > 0) {
@@ -1898,6 +2132,7 @@ async function buildGraph(options) {
       if (!resolvers.includes("tsc")) resolvers.unshift("tsc");
       tscStats = res.stats;
     }
+    checkMemoryBudget("typescript resolution", limits.memoryBudgetMb);
   }
   const scip = options.noScip ? null : loadScipIndex(root, options.scip);
   let scipStats;
@@ -1912,6 +2147,7 @@ async function buildGraph(options) {
   const coverage = options.noCoverage ? null : loadCoverage(root, options.coverage);
   if (coverage) nodes = applyCoverage(nodes, coverage);
   const analysis = analyze(nodes, linked.edges, { cluster: options.cluster });
+  checkMemoryBudget("analysis", limits.memoryBudgetMb);
   const languages = [...new Set(parses.map((p) => p.lang))].sort();
   const edgeKinds = [...new Set(analysis.edges.map((e) => e.kind))].sort();
   const corpusHash = computeCorpusHash(parses, hashes);
@@ -6007,9 +6243,9 @@ function assistantById(id) {
 }
 function detectServeLaunch(which = whichOnPath) {
   const vg = which("vg");
-  if (vg && isOwnBinary(vg)) return { command: "vg", args: ["serve"] };
+  if (vg && isInstalledOwnBinary(vg)) return { command: "vg", args: ["serve"] };
   const vibgrate = which("vibgrate");
-  if (vibgrate && isOwnBinary(vibgrate)) {
+  if (vibgrate && isInstalledOwnBinary(vibgrate)) {
     return {
       command: "vibgrate",
       args: ["serve"],
@@ -6288,6 +6524,6 @@ function spdx(ctx) {
   return JSON.stringify(doc, null, 2) + "\n";
 }
 
-export { ASSISTANTS, CliError, ECOSYSTEMS, ExitCode, FREE_PACK, GraphIndex, GraphSource, NPX_INVOCATION, SCHEMA_VERSION, SKIP_DIRS, TOOLS, UsageError, addLibrary, analyze, applyCoverage, applyStaticTestLinkage, assessDocQuality, assistantById, availableRegionIds, buildFacts, buildGraph, buildModuleResolver, cacheDir, catalogPath, clearModelCache, clearStoredCredentials, cosine, countPending, coveringTests, createServer, createWorkspaceDsn, credentialsPath, dashHostForIngestHost, decodeScipIndex, defaultGraphPath, detectRunner, detectServeLaunch, discover, discoverModels, driftCount, driftFor, dsnCommand, embeddingsCached, enrichOnline, ensureGitignored, exportGraph, fetchHostedDocs, findGitRoot, findNodes, formatForExt, getNodeEmbeddings, gitignoreEntryForCredentials, groundGraph, hasDrift, identifierParts, impactOf, installAssistant, inventory, isModelReady, isTestFile, libDir, libId, loadCatalog, loadCoverage, loadEmbedder, loadGraph, loadSnapshot, localApiSurface, localPackageDocs, modelCacheInfo, nodeById, nodeEmbedText, parseDsn, parseGraph, parseJsonc, probeFreshness, publishPrivateLibrary, pushCommand, queryGraph, queryGraphSemantic, readDoc, readSavings, readScanArtifact, recordSaving, refreshIfStale, relativeResolver, renderHtml, renderReport, resolveCliInvocation, resolveDsn, resolveEmbedModel, resolveIngestHost, resolveLib, resolveOne, resolveVersion, saveCatalog, savingsRecorded, scipEdges, selectForBudget, serializeGraph, serveStdio, shortestPath, stableStringify, symbolsFromApi, testsToRun, unavailableMessage, uninstallAssistant, uploadScanArtifact, usageError, verifyDeterminism, vibgrateDir, writeArtifacts, writeSnapshot, writeStoredCredentials };
-//# sourceMappingURL=chunk-WGXDYBAN.js.map
-//# sourceMappingURL=chunk-WGXDYBAN.js.map
+export { ASSISTANTS, CliError, ECOSYSTEMS, ExitCode, FREE_PACK, GraphIndex, GraphSource, NPX_INVOCATION, ResourceLimitError, SCHEMA_VERSION, SKIP_DIRS, SKIP_FILES, TOOLS, UsageError, addLibrary, analyze, applyCoverage, applyStaticTestLinkage, assessDocQuality, assistantById, availableRegionIds, buildFacts, buildGraph, buildModuleResolver, cacheDir, catalogPath, clearModelCache, clearStoredCredentials, cosine, countPending, coveringTests, createServer, createWorkspaceDsn, credentialsPath, dashHostForIngestHost, decodeScipIndex, defaultGraphPath, detectRunner, detectServeLaunch, discover, discoverModels, driftCount, driftFor, dsnCommand, embeddingsCached, enrichOnline, ensureGitignored, exportGraph, fetchHostedDocs, findGitRoot, findNodes, formatForExt, getNodeEmbeddings, gitignoreEntryForCredentials, groundGraph, hasDrift, identifierParts, impactOf, installAssistant, inventory, isModelReady, isTestFile, libDir, libId, loadCatalog, loadCoverage, loadEmbedder, loadGraph, loadSnapshot, localApiSurface, localPackageDocs, modelCacheInfo, nodeById, nodeEmbedText, parseDsn, parseGraph, parseJsonc, probeFreshness, publishPrivateLibrary, pushCommand, queryGraph, queryGraphSemantic, readDoc, readSavings, readScanArtifact, recordSaving, refreshIfStale, relativeResolver, renderHtml, renderReport, resolveCliInvocation, resolveDsn, resolveEmbedModel, resolveIngestHost, resolveLib, resolveLimits, resolveOne, resolveVersion, saveCatalog, savingsRecorded, scipEdges, selectForBudget, serializeGraph, serveStdio, shortestPath, stableStringify, symbolsFromApi, testsToRun, unavailableMessage, uninstallAssistant, uploadScanArtifact, usageError, verifyDeterminism, vibgrateDir, writeArtifacts, writeSnapshot, writeStoredCredentials };
+//# sourceMappingURL=chunk-YODVLV37.js.map
+//# sourceMappingURL=chunk-YODVLV37.js.map