@vibgrate/cli 2026.704.1 → 2026.708.1

package/dist/cli.js

@@ -1,23 +1,267 @@
 #!/usr/bin/env node
-import { resolveDsn, resolveIngestHost, dashHostForIngestHost, resolveCliInvocation, availableRegionIds, createWorkspaceDsn, writeStoredCredentials, credentialsPath, findGitRoot, ensureGitignored, gitignoreEntryForCredentials, clearStoredCredentials, inventory, uploadScanArtifact, dsnCommand, pushCommand, ExitCode, CliError, NPX_INVOCATION, verifyDeterminism, refreshIfStale, driftCount, embeddingsCached, resolveEmbedModel, loadEmbedder, getNodeEmbeddings, queryGraphSemantic, queryGraph, unavailableMessage, countPending, resolveOne, GraphIndex, shortestPath, renderReport, impactOf, testsToRun, detectRunner, defaultGraphPath, serveStdio, ASSISTANTS, usageError, loadGraph, detectServeLaunch, installAssistant, uninstallAssistant, coveringTests, FREE_PACK, readScanArtifact, enrichOnline, ECOSYSTEMS, discoverModels, readSavings, exportGraph, catalogPath, libDir, stableStringify, buildGraph, writeArtifacts, writeSnapshot, UsageError, ResourceLimitError, cacheDir, probeFreshness, discover, vibgrateDir, modelCacheInfo, clearModelCache, GraphSource, createServer, assistantById, serializeGraph, resolveLimits, loadCatalog, driftFor, addLibrary, parseDsn as parseDsn$1, publishPrivateLibrary, resolveLib, libId, resolveVersion, readDoc, localPackageDocs, localApiSurface, assessDocQuality, symbolsFromApi, fetchHostedDocs, selectForBudget, formatForExt, renderHtml, isModelReady } from './chunk-YODVLV37.js';
-import { resolvedGrammarFiles, grammarSetVersion } from './chunk-X5YT263H.js';
-import { loadAdvancedScanHook, baselineCommand } from './chunk-W4ANUENJ.js';
-import { ensureDir, pathExists, writeDefaultConfig, parseDsn, detectVcs, computeRepoFingerprint, resolveRepositoryName, fetchScanPreflight, runCoreScan, VERSION, readJsonFile, writeTextFile, prepareCompressedUpload, titleBox, driftBar, gitHistoryAvailable, buildVersionTimelines, findPackageAnyEcosystem, normalizeConstraint, findVersionCrossings, versionSatisfies, brandProgressBar } from './chunk-RJHYTD62.js';
+import { resolveDsn, resolveIngestHost, dashHostForIngestHost, resolveCliInvocation, availableRegionIds, createWorkspaceDsn, writeStoredCredentials, credentialsPath, findGitRoot, ensureGitignored, gitignoreEntryForCredentials, clearStoredCredentials, inventory, uploadScanArtifact, ingestHostForRegionId, dsnCommand, pushCommand, CliError, ExitCode, NPX_INVOCATION, refreshIfStale, driftCount, embeddingsCached, resolveEmbedModel, loadEmbedder, getNodeEmbeddings, queryGraphSemantic, queryGraph, unavailableMessage, countPending, resolveOne, GraphIndex, shortestPath, renderReport, impactOf, testsToRun, detectRunner, defaultGraphPath, serveStdio, ASSISTANTS, usageError, loadGraph, detectServeLaunch, installAssistant, writeNavigationConfig, uninstallAssistant, coveringTests, FREE_PACK, readScanArtifact, enrichOnline, ECOSYSTEMS, discoverModels, readSavings, exportGraph, catalogPath, libDir, stableStringify, buildGraph, writeArtifacts, writeSnapshot, UsageError, ResourceLimitError, epistemicBreakdown, cacheDir, probeFreshness, discover, vibgrateDir, modelCacheInfo, clearModelCache, GraphSource, createServer, assistantById, serializeGraph, resolveLimits, loadCatalog, driftFor, addLibrary, parseDsn as parseDsn$1, publishPrivateLibrary, resolveLib, libId, resolveVersion, readDoc, localPackageDocs, localApiSurface, assessDocQuality, symbolsFromApi, fetchHostedDocs, selectForBudget, formatForExt, verifyDeterminism, renderHtml, isModelReady } from './chunk-2J7DPIAL.js';
+import { resolvedGrammarFiles, grammarSetVersion, canonicalize } from './chunk-X5YT263H.js';
+import { loadAdvancedScanHook, baselineCommand } from './chunk-FMCI3MXH.js';
+import { ensureDir, pathExists, writeDefaultConfig, parseDsn, detectVcs, computeRepoFingerprint, resolveRepositoryName, fetchScanPreflight, runCoreScan, VERSION, readJsonFile, writeTextFile, prepareCompressedUpload, computeDriftScore, titleBox, projectTypeToVulnEcosystem, driftBar, gitHistoryAvailable, buildVersionTimelines, findPackageAnyEcosystem, normalizeConstraint, findVersionCrossings, versionSatisfies, brandProgressBar, resolveHead, workingTreeDirty } from './chunk-SRWMZBLG.js';
 import './chunk-RXP66R2E.js';
 import { pathExists as pathExists$1, parseExcludePatterns } from './chunk-GI6W53LM.js';
-import * as fs4 from 'fs';
-import fs4__default, { realpathSync } from 'fs';
-import * as path9 from 'path';
-import path9__default from 'path';
+import * as fs5 from 'fs';
+import fs5__default, { realpathSync } from 'fs';
+import * as path from 'path';
+import path__default from 'path';
 import { fileURLToPath } from 'url';
 import { Command, CommanderError, Option } from 'commander';
-import { execSync, spawn, execFileSync } from 'child_process';
-import chalk5 from 'chalk';
-import * as fs10 from 'fs/promises';
+import { execSync, spawn, spawnSync, execFileSync, execFile } from 'child_process';
+import * as crypto from 'crypto';
+import { randomUUID } from 'crypto';
+import chalk7 from 'chalk';
 import * as os from 'os';
+import * as readline from 'readline';
+import * as fs14 from 'fs/promises';
 import semver from 'semver';
-import { randomUUID } from 'crypto';
 
+var DSSE_PAYLOAD_TYPE = "application/vnd.in-toto+json";
+var IN_TOTO_STATEMENT_TYPE = "https://in-toto.io/Statement/v1";
+var VG_PREDICATE_TYPE = "https://vibgrate.com/attestation/code-graph/v1";
+function sha256Hex(input) {
+  return crypto.createHash("sha256").update(input).digest("hex");
+}
+function graphSubjectDigest(graph) {
+  const { generatedAt: _omit, ...rest } = graph;
+  return sha256Hex(canonicalize(rest));
+}
+function keyId(publicKey) {
+  return sha256Hex(publicKey.export({ type: "spki", format: "der" })).slice(0, 16);
+}
+function buildStatement(graph, input = {}) {
+  const graphDigest = graphSubjectDigest(graph);
+  const predicate = {
+    tool: { name: "vg", version: VERSION },
+    toolchain: graph.provenance.toolchain,
+    corpusHash: graph.provenance.corpusHash,
+    graphDigest,
+    counts: graph.meta.counts
+  };
+  if (input.commit) predicate.commit = input.commit;
+  if (input.sbomDigest) predicate.sbomDigest = input.sbomDigest;
+  if (input.timestamp) predicate.timestamp = input.timestamp;
+  return {
+    _type: IN_TOTO_STATEMENT_TYPE,
+    subject: [{ name: "graph.json", digest: { sha256: graphDigest } }],
+    predicateType: VG_PREDICATE_TYPE,
+    predicate
+  };
+}
+function dssePae(payloadType, body) {
+  const typeBytes = Buffer.from(payloadType, "utf8");
+  const header = Buffer.from(
+    `DSSEv1 ${typeBytes.length} ${payloadType} ${body.length} `,
+    "utf8"
+  );
+  return Buffer.concat([header, Buffer.from(body)]);
+}
+function signStatement(statement, privateKey) {
+  const body = Buffer.from(JSON.stringify(statement), "utf8");
+  const pae = dssePae(DSSE_PAYLOAD_TYPE, body);
+  const sig = crypto.sign(null, pae, privateKey);
+  const publicKey = crypto.createPublicKey(privateKey.export({ type: "pkcs8", format: "pem" }).toString());
+  return {
+    payloadType: DSSE_PAYLOAD_TYPE,
+    payload: body.toString("base64"),
+    signatures: [
+      {
+        keyid: keyId(publicKey),
+        sig: sig.toString("base64"),
+        publicKey: publicKey.export({ type: "spki", format: "pem" }).toString()
+      }
+    ]
+  };
+}
+function emptyStatement() {
+  return {
+    _type: "",
+    subject: [],
+    predicateType: "",
+    predicate: {
+      tool: { name: "vg", version: "" },
+      corpusHash: "",
+      graphDigest: "",
+      counts: { nodes: 0, edges: 0, areas: 0, tests: 0, untested: 0 }
+    }
+  };
+}
+function failedResult(reason) {
+  return {
+    status: "failed",
+    signatureValid: false,
+    signerPinned: false,
+    keyid: "",
+    reason,
+    statement: emptyStatement()
+  };
+}
+function verifyEnvelope(env, opts = {}) {
+  let body;
+  let statement;
+  try {
+    body = Buffer.from(env?.payload ?? "", "base64");
+    const parsed = JSON.parse(body.toString("utf8"));
+    if (!parsed || typeof parsed !== "object" || !parsed.predicate) {
+      throw new Error("missing predicate");
+    }
+    statement = parsed;
+  } catch {
+    return failedResult("malformed attestation payload (not a valid in-toto statement)");
+  }
+  const pae = dssePae(env.payloadType, body);
+  const sig0 = env.signatures?.[0];
+  const keyid = sig0?.keyid ?? "";
+  const sig = sig0?.sig ? Buffer.from(sig0.sig, "base64") : Buffer.alloc(0);
+  let signatureValid = false;
+  let signerPinned = false;
+  try {
+    if (sig0 && sig.length) {
+      if (opts.publicKeyPem) {
+        const pinnedKey = crypto.createPublicKey(opts.publicKeyPem);
+        signatureValid = crypto.verify(null, pae, pinnedKey, sig);
+        signerPinned = signatureValid;
+      } else if (sig0.publicKey) {
+        const embeddedKey = crypto.createPublicKey(sig0.publicKey);
+        signatureValid = crypto.verify(null, pae, embeddedKey, sig);
+      }
+    }
+  } catch {
+    signatureValid = false;
+    signerPinned = false;
+  }
+  const digestMatches = opts.graph ? graphSubjectDigest(opts.graph) === statement.predicate.graphDigest : void 0;
+  const dirty = statement.predicate.commit?.dirty;
+  let status;
+  let reason;
+  if (!signatureValid) {
+    status = "failed";
+    reason = sig0 ? "signature verification failed" : "no signature in envelope";
+  } else if (digestMatches === false) {
+    status = "failed";
+    reason = "graph.json no longer matches the attested digest (content changed since signing)";
+  } else if (signerPinned && !dirty) {
+    status = "verified";
+    reason = digestMatches === true ? "signature valid, signer trusted, graph digest matches" : "signature valid, signer trusted";
+  } else {
+    status = "signature-valid";
+    reason = dirty ? "signature valid but the attested tree was dirty (uncommitted changes)" : "signature valid but signer not pinned \u2014 pass --pub to establish trust";
+  }
+  return { status, signatureValid, signerPinned, digestMatches, dirty, keyid, reason, statement };
+}
+function generateKeypair() {
+  const { publicKey, privateKey } = crypto.generateKeyPairSync("ed25519");
+  return {
+    privatePem: privateKey.export({ type: "pkcs8", format: "pem" }).toString(),
+    publicPem: publicKey.export({ type: "spki", format: "pem" }).toString(),
+    keyid: keyId(publicKey)
+  };
+}
+function serializeEnvelope(env) {
+  return `${JSON.stringify(env)}
+`;
+}
+function parseEnvelope(text) {
+  const line = text.trim().split("\n")[0];
+  return JSON.parse(line);
+}
+
+// src/commands/attest-actions.ts
+var DEFAULT_ATTESTATION = "attestation.intoto.jsonl";
+var DEFAULT_KEY = "attest-key.pem";
+async function signGraphAttestation(root, graph, opts) {
+  const notices = [];
+  const explicitKey = opts.key ?? process.env.VG_ATTEST_KEY;
+  const keyPath = explicitKey ? path.resolve(explicitKey) : path.join(root, ".vibgrate", DEFAULT_KEY);
+  let keyGeneratedAt;
+  if (!fs5.existsSync(keyPath)) {
+    if (explicitKey) {
+      throw new CliError(`signing key not found: ${explicitKey}`, ExitCode.USAGE_ERROR);
+    }
+    const kp = generateKeypair();
+    fs5.mkdirSync(path.dirname(keyPath), { recursive: true });
+    fs5.writeFileSync(keyPath, kp.privatePem, { mode: 384 });
+    fs5.writeFileSync(`${keyPath}.pub`, kp.publicPem);
+    keyGeneratedAt = keyPath;
+    notices.push(
+      `minted a new Ed25519 signing key at ${rel(root, keyPath)} (keyid ${kp.keyid}) \u2014 keep it, add it to .gitignore, and reuse it to re-sign reproducibly`
+    );
+  }
+  let privateKey;
+  try {
+    privateKey = crypto.createPrivateKey(fs5.readFileSync(keyPath, "utf8"));
+  } catch {
+    throw new CliError(`could not read an Ed25519 private key from ${rel(root, keyPath)}`, ExitCode.USAGE_ERROR);
+  }
+  if (privateKey.asymmetricKeyType !== "ed25519") {
+    throw new CliError(
+      `attest requires an Ed25519 key, but ${rel(root, keyPath)} is ${privateKey.asymmetricKeyType ?? "unknown"}`,
+      ExitCode.USAGE_ERROR
+    );
+  }
+  const commit = await gitCommitInfo(root);
+  const statement = buildStatement(graph, { commit });
+  const envelope = signStatement(statement, privateKey);
+  const outPath = opts.attestation ? path.resolve(opts.attestation) : path.join(root, ".vibgrate", DEFAULT_ATTESTATION);
+  fs5.mkdirSync(path.dirname(outPath), { recursive: true });
+  fs5.writeFileSync(outPath, serializeEnvelope(envelope));
+  return {
+    summary: {
+      keyid: envelope.signatures[0]?.keyid ?? "",
+      graphDigest: statement.predicate.graphDigest,
+      fingerprint: statement.predicate.toolchain?.fingerprint,
+      commit,
+      out: rel(root, outPath),
+      keyGeneratedAt: keyGeneratedAt ? rel(root, keyGeneratedAt) : void 0
+    },
+    notices
+  };
+}
+function verifyGraphAttestation(root, opts) {
+  const bundlePath = opts.attestation ? path.resolve(opts.attestation) : path.join(root, ".vibgrate", DEFAULT_ATTESTATION);
+  if (!fs5.existsSync(bundlePath)) {
+    if (opts.attestation || opts.pub) {
+      throw new CliError(
+        `no attestation at ${rel(root, bundlePath)} \u2014 sign one with \`vg build --attest\``,
+        ExitCode.NOT_FOUND
+      );
+    }
+    return { bundlePath, missing: true };
+  }
+  const envelope = parseEnvelope(fs5.readFileSync(bundlePath, "utf8"));
+  const publicKeyPem = opts.pub ? fs5.readFileSync(path.resolve(opts.pub), "utf8") : void 0;
+  const graph = loadGraph(root) ?? void 0;
+  return { bundlePath, missing: false, result: verifyEnvelope(envelope, { publicKeyPem, graph }) };
+}
+async function gitCommitInfo(root) {
+  const sha = await resolveHead(root);
+  if (!sha) return void 0;
+  const dirty = await workingTreeDirty(root);
+  const branch = await gitBranch(root);
+  return { sha, shortSha: sha.slice(0, 7), branch, dirty: dirty === true ? true : dirty === false ? false : void 0 };
+}
+function gitBranch(root) {
+  return new Promise((resolve16) => {
+    execFile(
+      "git",
+      ["rev-parse", "--abbrev-ref", "HEAD"],
+      { cwd: root, timeout: 5e3, windowsHide: true, encoding: "utf8" },
+      (err, stdout) => {
+        if (err) return resolve16(void 0);
+        const name = String(stdout).trim();
+        resolve16(name && name !== "HEAD" ? name : void 0);
+      }
+    );
+  });
+}
+function rel(root, p) {
+  const r = path.relative(root, p);
+  return r.startsWith("..") ? p : r;
+}
 function info(message = "") {
   process.stderr.write(`${message}
 `);
@@ -30,9 +274,9 @@ function json(value) {
   process.stdout.write(`${JSON.stringify(value, null, 2)}
 `);
 }
-var c = chalk5;
+var c = chalk7;
 function disableColor() {
-  chalk5.level = 0;
+  chalk7.level = 0;
 }
 
 // src/util/logo.ts
@@ -120,15 +364,19 @@ function readGlobal(cmd) {
 
 // src/commands/build.ts
 function registerBuild(program) {
-  const cmd = program.command("build").description("build / update the code map (incremental, deterministic)").argument("[paths...]", "folders or files to map (default: current folder)").option("--only <langs>", "restrict to languages, e.g. ts,py,go").option("--exclude <glob>", "extra ignore glob (repeatable)", collect, []).option("--no-html", "do not write graph.html").option("--no-report", "do not write GRAPH_REPORT.md").option("--no-ground", "do not attach grounding (Phase 2)").option("--jobs <n>", "worker count (1 = single-threaded)").option("--scip <file>", "ingest a SCIP index for precise resolution (default: auto-detect index.scip)").option("--no-scip", "ignore any SCIP index").option("--no-tsc", "skip the in-process TypeScript resolver (heuristic floor only)").option("--no-warm", "do not warm the semantic index in the background after building").option("--grammars <dir>", "directory of grammar .wasm files (offline / air-gapped)").option("-o, --export <file>", "also write the map to a file (format inferred)").action(async function(paths, opts) {
+  const cmd = program.command("build").description("build / update the code map (incremental, deterministic)").argument("[paths...]", "folders or files to map (default: current folder)").option("--only <langs>", "restrict to languages, e.g. ts,py,go").option("--exclude <glob>", "extra ignore glob (repeatable)", collect, []).option("--no-html", "do not write graph.html").option("--no-report", "do not write GRAPH_REPORT.md").option("--no-ground", "do not attach grounding (Phase 2)").option("--jobs <n>", "worker count (1 = single-threaded)").option("--scip <file>", "ingest a SCIP index for precise resolution (default: auto-detect index.scip)").option("--no-scip", "ignore any SCIP index").option("--no-tsc", "skip the in-process TypeScript resolver (heuristic floor only)").option("--no-warm", "do not warm the semantic index in the background after building").option("--grammars <dir>", "directory of grammar .wasm files (offline / air-gapped)").option("-o, --export <file>", "also write the map to a file (format inferred)").option("--attest", "sign the built graph \u2192 .vibgrate/attestation.intoto.jsonl").option("--verify", "verify a committed attestation against the graph (no rebuild)").option("--attest-key <path>", "signing key PEM (else $VG_ATTEST_KEY, else .vibgrate/attest-key.pem)").option("--attestation <file>", "attestation path (out for --attest, in for --verify)").option("--pub <path>", "public key PEM to pin the signer (with --verify)").action(async function(paths, opts) {
     await runBuild(paths, opts, readGlobal(this));
   });
   applyGlobalOptions(cmd);
 }
 async function runBuild(paths, opts, global) {
-  const root = path9.resolve(global.cwd ?? ".");
+  const root = path.resolve(global.cwd ?? ".");
+  if (opts.verify) {
+    await verifyGraph(root, opts, global);
+    return;
+  }
   const interactive = !global.json && !global.quiet;
-  if (interactive) printLogo(path9.basename(root) || root);
+  if (interactive) printLogo(path.basename(root) || root);
   const bar = interactive ? new ProgressBar(c.dim("parsing")) : void 0;
   const jobs = opts.jobs ? Number(opts.jobs) : void 0;
   if (jobs !== void 0 && (!Number.isInteger(jobs) || jobs < 1)) {
@@ -180,6 +428,16 @@ async function runBuild(paths, opts, global) {
     });
   }
   if (opts.export) writeExport(result.graph, opts.export);
+  let attestation;
+  const attestNotices = [];
+  if (opts.attest) {
+    const signed = await signGraphAttestation(root, result.graph, {
+      key: opts.attestKey,
+      attestation: opts.attestation
+    });
+    attestation = signed.summary;
+    attestNotices.push(...signed.notices);
+  }
   if (global.json) {
     json({
       ok: true,
@@ -191,8 +449,11 @@ async function runBuild(paths, opts, global) {
       resolve: result.resolveStats,
       tsc: result.tsc,
       scip: result.scip,
+      epistemic: epistemicBreakdown(result.graph.edges),
       artifacts: written,
       corpusHash: result.graph.provenance.corpusHash,
+      toolchain: result.graph.provenance.toolchain,
+      attestation,
       timingMs: result.timing.totalMs,
       warnings: result.warnings
     });
@@ -201,7 +462,7 @@ async function runBuild(paths, opts, global) {
   const { counts } = result.graph.meta;
   const incremental = result.reused > 0 ? `incremental: ${result.reparsed} of ${result.totalFiles} files re-parsed` : `${result.totalFiles} files parsed`;
   const seconds = (result.timing.totalMs / 1e3).toFixed(2);
-  info(`${c.cyan("vg")} \xB7 mapped ${rel(root)} in ${seconds}s (${incremental})`);
+  info(`${c.cyan("vg")} \xB7 mapped ${rel2(root)} in ${seconds}s (${incremental})`);
   info(
     `  nodes ${c.bold(String(counts.nodes))}   edges ${c.bold(String(counts.edges))}   areas ${counts.areas}   langs ${result.graph.meta.languages.join(",") || "\u2014"}`
   );
@@ -218,28 +479,84 @@ async function runBuild(paths, opts, global) {
   if (result.scip) {
     info(c.dim(`  scip: ${result.scip.resolved} precise edges from ${result.scip.tool ?? "index"} (${result.scip.documents} docs)`));
   }
-  const artifactList = [written.graphPath, written.htmlPath, written.reportPath].filter(Boolean).map((p) => path9.relative(root, p)).join("  ");
+  const ep = epistemicBreakdown(result.graph.edges);
+  info(
+    c.dim(
+      `  edges by evidence \xB7 observed ${ep.observed} \xB7 name-matched ${ep["name-matched"]} \xB7 declared ${ep.declared}`
+    )
+  );
+  const artifactList = [written.graphPath, written.htmlPath, written.reportPath].filter(Boolean).map((p) => path.relative(root, p)).join("  ");
   info(`  \u2192 ${artifactList}`);
   if (result.warnings.length) {
     info(c.yellow(`  ${result.warnings.length} parse warning(s) \u2014 run with --json for detail`));
   }
+  if (attestation) {
+    for (const n of attestNotices) info(c.yellow(`  ${n}`));
+    info(
+      c.dim(
+        `  attested \xB7 keyid ${attestation.keyid} \xB7 digest ${attestation.graphDigest.slice(0, 16)}\u2026 \u2192 ${attestation.out}`
+      )
+    );
+  }
   maybeWarmEmbeddings(root, result.graph, global, opts.warm !== false);
 }
+async function verifyGraph(root, opts, global) {
+  const only = opts.only ? opts.only.split(",").map((s) => s.trim()).filter(Boolean) : void 0;
+  const jobs = opts.jobs ? Number(opts.jobs) : void 0;
+  const det = await verifyDeterminism({ root, only, exclude: opts.exclude, jobs });
+  const attest = verifyGraphAttestation(root, { attestation: opts.attestation, pub: opts.pub });
+  const attestFailed = !attest.missing && attest.result?.status === "failed";
+  if (global.json) {
+    json({
+      ok: det.ok && !attestFailed,
+      determinism: { ok: det.ok, checks: det.checks, digest: det.digest },
+      attestation: attest.missing ? null : {
+        status: attest.result?.status,
+        signatureValid: attest.result?.signatureValid,
+        signerPinned: attest.result?.signerPinned,
+        digestMatches: attest.result?.digestMatches,
+        dirty: attest.result?.dirty,
+        keyid: attest.result?.keyid,
+        reason: attest.result?.reason
+      }
+    });
+  } else {
+    info(`${c.cyan("vg build --verify")} \xB7 ${path.relative(process.cwd(), root) || "."}`);
+    for (const check of det.checks) {
+      const mark = check.ok ? c.green("\u2714") : c.red("\u2718");
+      const detail = check.detail ? c.dim(` (${check.detail})`) : "";
+      info(`  ${mark} ${check.name}${detail}`);
+    }
+    info(det.ok ? c.green(`  deterministic \xB7 digest ${det.digest.slice(0, 16)}\u2026`) : c.red("  NON-DETERMINISTIC"));
+    if (attest.missing) {
+      info(c.dim(`  attestation: none (sign one with \`vg build --attest\`)`));
+    } else {
+      const r = attest.result;
+      const badge = r?.status === "verified" ? c.green("\u2714 attestation verified") : r?.status === "signature-valid" ? c.yellow("~ attestation signature valid") : c.red("\u2718 attestation failed");
+      info(`  ${badge}${r?.keyid ? c.dim(` \xB7 keyid ${r.keyid}`) : ""}`);
+      info(c.dim(`    ${r?.reason ?? ""}`));
+    }
+  }
+  if (!det.ok) throw new CliError("determinism self-check failed", ExitCode.NON_DETERMINISTIC);
+  if (attestFailed) throw new CliError("attestation verification failed", ExitCode.GATE_FAILED);
+}
 function maybeWarmEmbeddings(root, graph, global, warm) {
   if (!warm || global.json || global.quiet || global.local) return;
   if (!process.stdout.isTTY && !process.stderr.isTTY) return;
-  const modelId = resolveEmbedModel();
-  if (!isModelReady(modelId)) return;
-  if (countPending(graph, root, modelId) === 0) return;
   const cli = process.argv[1];
   if (!cli) return;
+  const modelId = resolveEmbedModel();
+  const ready = isModelReady(modelId);
+  if (ready && countPending(graph, root, modelId) === 0) return;
+  const args = ready ? [cli, "embed", "-C", root, "--bg"] : [cli, "embed", "-C", root, "--bg", "--download"];
   try {
-    const child = spawn(process.execPath, [cli, "embed", "-C", root, "--bg"], {
-      detached: true,
-      stdio: "ignore"
-    });
+    const child = spawn(process.execPath, args, { detached: true, stdio: "ignore" });
     child.unref();
-    info(c.dim("  warming the semantic index in the background \u2014 `vg ask` will be instant"));
+    info(
+      c.dim(
+        ready ? "  warming the semantic index in the background \u2014 `vg ask` will be instant" : "  downloading the semantic model in the background (once) \u2014 `vg ask`/`vg serve` will be instant; disable with --no-warm"
+      )
+    );
   } catch {
   }
 }
@@ -248,7 +565,7 @@ function writeExport(graph, target) {
     out(serializeGraph(graph).trimEnd());
     return;
   }
-  const ext = path9.extname(target).toLowerCase();
+  const ext = path.extname(target).toLowerCase();
   let content;
   switch (ext) {
     case ".json":
@@ -266,14 +583,14 @@ function writeExport(graph, target) {
         ExitCode.USAGE_ERROR
       );
   }
-  fs4.mkdirSync(path9.dirname(path9.resolve(target)), { recursive: true });
-  fs4.writeFileSync(target, content);
+  fs5.mkdirSync(path.dirname(path.resolve(target)), { recursive: true });
+  fs5.writeFileSync(target, content);
 }
 function collect(value, prev) {
   return [...prev, value];
 }
-function rel(root) {
-  const r = path9.relative(process.cwd(), root);
+function rel2(root) {
+  const r = path.relative(process.cwd(), root);
   return r === "" ? "." : r;
 }
 function registerStatus(program) {
@@ -283,10 +600,10 @@ function registerStatus(program) {
   applyGlobalOptions(cmd);
 }
 async function runStatus(global) {
-  const root = path9.resolve(global.cwd ?? ".");
+  const root = path.resolve(global.cwd ?? ".");
   const graphPath = global.graph ?? defaultGraphPath(root);
   const graph = loadGraph(root, graphPath);
-  const hasCache = fs4.existsSync(path9.join(cacheDir(root), "parse-cache.json"));
+  const hasCache = fs5.existsSync(path.join(cacheDir(root), "parse-cache.json"));
   let stale = null;
   let staleExact = false;
   if (graph) {
@@ -306,8 +623,8 @@ async function runStatus(global) {
   }
   if (global.json) {
     json({
-      root: path9.relative(process.cwd(), root) || ".",
-      graphPath: path9.relative(root, graphPath),
+      root: path.relative(process.cwd(), root) || ".",
+      graphPath: path.relative(root, graphPath),
       built: graph !== null,
       generatedAt: graph?.generatedAt ?? null,
       counts: graph?.meta.counts ?? null,
@@ -322,11 +639,11 @@ async function runStatus(global) {
     return;
   }
   if (!graph) {
-    info(`${c.cyan("vg")} \xB7 no map yet at ${c.dim(path9.relative(root, graphPath))}`);
+    info(`${c.cyan("vg")} \xB7 no map yet at ${c.dim(path.relative(root, graphPath))}`);
     info(`  run ${c.bold("vg")} to build one`);
     return;
   }
-  info(`${c.cyan("vg")} \xB7 ${path9.relative(root, graphPath)}`);
+  info(`${c.cyan("vg")} \xB7 ${path.relative(root, graphPath)}`);
   info(`  generated ${graph.generatedAt}`);
   info(
     `  nodes ${c.bold(String(graph.meta.counts.nodes))}  edges ${c.bold(
@@ -342,34 +659,8 @@ async function runStatus(global) {
   }
   if (vibgrateDir(root)) ;
 }
-function registerVerify(program) {
-  const cmd = program.command("verify").description("determinism self-check (exit 4 on mismatch)").option("--only <langs>", "restrict to languages, e.g. ts,py").option("--jobs <n>", "worker count").action(async function(opts) {
-    const global = readGlobal(this);
-    const root = path9.resolve(global.cwd ?? ".");
-    const result = await verifyDeterminism({
-      root,
-      only: opts.only ? opts.only.split(",").map((s) => s.trim()).filter(Boolean) : void 0,
-      jobs: opts.jobs ? Number(opts.jobs) : void 0
-    });
-    if (global.json) {
-      json({ ok: result.ok, checks: result.checks, digest: result.digest });
-    } else {
-      info(`${c.cyan("vg verify")} \xB7 ${path9.relative(process.cwd(), root) || "."}`);
-      for (const check of result.checks) {
-        const mark = check.ok ? c.green("\u2714") : c.red("\u2718");
-        const detail = check.detail ? c.dim(` (${check.detail})`) : "";
-        info(`  ${mark} ${check.name}${detail}`);
-      }
-      info(result.ok ? c.green(`  deterministic \xB7 digest ${result.digest.slice(0, 16)}\u2026`) : c.red("  NON-DETERMINISTIC"));
-    }
-    if (!result.ok) {
-      throw new CliError("determinism self-check failed", ExitCode.NON_DETERMINISTIC);
-    }
-  });
-  applyGlobalOptions(cmd);
-}
 function rootOf(global) {
-  return path9.resolve(global.cwd ?? ".");
+  return path.resolve(global.cwd ?? ".");
 }
 function requireGraph(global) {
   const root = rootOf(global);
@@ -456,7 +747,7 @@ function mb(bytes) {
   return `${Math.round(bytes / (1024 * 1024))} MB`;
 }
 function registerEmbed(program) {
-  const cmd = program.command("embed").description("precompute the semantic index for instant `vg ask` (or --where / --clear)").option("--where", "show where the model is cached, and its size").option("--clear", "remove the downloaded model from the shared cache").addOption(new Option("--bg").hideHelp()).action(async function(opts) {
+  const cmd = program.command("embed").description("precompute the semantic index for instant `vg ask` (or --where / --clear)").option("--where", "show where the model is cached, and its size").option("--clear", "remove the downloaded model from the shared cache").addOption(new Option("--bg").hideHelp()).addOption(new Option("--download").hideHelp()).action(async function(opts) {
     const global = readGlobal(this);
     const modelId = resolveEmbedModel();
     if (opts.where) return showWhere(rootOf(global), modelId, global.json);
@@ -477,8 +768,10 @@ function registerEmbed(program) {
     let reason;
     const embedder = await loadEmbedder({
       local: global.local,
-      noDownload: bg,
-      // background warm-up never downloads
+      // Background warm-ups skip the download unless explicitly asked to fetch
+      // (`--bg --download`, spawned by `vg build` so the model is ready by the
+      // time `vg serve`/`vg ask` needs it).
+      noDownload: bg && opts.download !== true,
       showDownloadProgress: !bg,
       onUnavailable: (r) => reason = r
     });
@@ -651,10 +944,10 @@ function registerTree(program) {
   applyGlobalOptions(cmd);
 }
 function next(index, node, direction) {
-  const rel2 = direction === "callees" ? index.callees(node.id) : index.callers(node.id);
+  const rel3 = direction === "callees" ? index.callees(node.id) : index.callers(node.id);
   const seen = /* @__PURE__ */ new Set();
   const out2 = [];
-  for (const { node: n } of rel2) {
+  for (const { node: n } of rel3) {
     if (seen.has(n.id)) continue;
     seen.add(n.id);
     out2.push(n);
@@ -830,6 +1123,113 @@ function registerImpact(program) {
   });
   applyGlobalOptions(cmd);
 }
+
+// src/commands/unknowns.ts
+var IMPACT_CANDIDATE_CAP = 200;
+function registerUnknowns(program) {
+  const cmd = program.command("unknowns").description("what the graph cannot resolve, ranked by blast radius").option("-n, --limit <n>", "how many sites to show", "20").action(function(opts) {
+    const global = readGlobal(this);
+    const { graph } = requireGraph(global);
+    const limit = Number(opts.limit) || 20;
+    const ranked = rankUnknowns(graph, limit);
+    const { sites, totalSites, capped } = ranked;
+    const totalRefs = (graph.unknowns ?? []).reduce((n, u) => n + u.count, 0);
+    if (global.json) {
+      json({
+        unresolvedReferences: totalRefs,
+        sites: totalSites,
+        shown: sites.length,
+        blastRankedCandidateCap: capped ? IMPACT_CANDIDATE_CAP : null,
+        top: sites.map((s) => ({
+          id: s.node.id,
+          name: s.node.qualifiedName,
+          kind: s.node.kind,
+          file: s.node.file,
+          line: s.node.span.start,
+          importance: s.node.importance,
+          blastRadius: s.blastRadius,
+          direct: s.direct,
+          transitive: s.transitive,
+          unresolved: s.refs.map((r) => ({ name: r.name, kind: r.kind, count: r.count }))
+        }))
+      });
+      return;
+    }
+    if (totalRefs === 0) {
+      info(
+        `${c.cyan("vg unknowns")} \xB7 none \u2014 every heuristic reference resolved (or was covered by a precise rung)`
+      );
+      return;
+    }
+    info(
+      `${c.cyan("vg unknowns")} \xB7 ${c.bold(String(totalRefs))} unresolved reference(s) at ${totalSites} site(s) \xB7 top ${sites.length} by blast radius`
+    );
+    for (const s of sites) {
+      info(
+        `  ${c.yellow(pad2(String(s.blastRadius), 5))}  ${c.bold(s.node.qualifiedName)}  ` + c.dim(`${s.node.file}:${s.node.span.start} \xB7 importance ${s.node.importance.toFixed(3)}`)
+      );
+      info(`         ${c.dim("cannot resolve:")} ${s.refs.map(fmtRef).join(", ")}`);
+    }
+    info(
+      c.dim(
+        `  blast radius = transitive dependents; these are the code paths the graph is blind about`
+      )
+    );
+    if (capped) {
+      info(
+        c.dim(
+          `  note: ${totalSites} sites have unknowns; only the top ${IMPACT_CANDIDATE_CAP} by centrality were blast-radius scored (the tail is ordered by centrality alone)`
+        )
+      );
+    }
+  });
+  applyGlobalOptions(cmd);
+}
+function rankUnknowns(graph, limit) {
+  const unknowns = graph.unknowns ?? [];
+  if (unknowns.length === 0) return { sites: [], totalSites: 0, capped: false };
+  const byId = new Map(graph.nodes.map((n) => [n.id, n]));
+  const grouped = /* @__PURE__ */ new Map();
+  for (const u of unknowns) {
+    const list = grouped.get(u.from);
+    if (list) list.push(u);
+    else grouped.set(u.from, [u]);
+  }
+  const candidates = [];
+  for (const [from, refs] of grouped) {
+    const node = byId.get(from);
+    if (!node) continue;
+    candidates.push({ node, refs, total: refs.reduce((n, r) => n + r.count, 0) });
+  }
+  candidates.sort(
+    (a, b) => b.node.importance - a.node.importance || a.node.id.localeCompare(b.node.id)
+  );
+  const scored = candidates.slice(0, IMPACT_CANDIDATE_CAP).map((cand) => {
+    const impact = impactOf(graph, cand.node.id);
+    return {
+      ...cand,
+      blastRadius: impact.affected.length,
+      direct: impact.direct,
+      transitive: impact.transitive
+    };
+  });
+  scored.sort(
+    (a, b) => b.blastRadius - a.blastRadius || b.node.importance - a.node.importance || b.total - a.total || a.node.id.localeCompare(b.node.id)
+  );
+  return {
+    sites: scored.slice(0, limit),
+    totalSites: candidates.length,
+    capped: candidates.length > IMPACT_CANDIDATE_CAP
+  };
+}
+function fmtRef(r) {
+  const times = r.count > 1 ? ` \xD7${r.count}` : "";
+  const kind = r.kind === "call" ? "" : ` (${r.kind})`;
+  return `${r.name}${kind}${times}`;
+}
+function pad2(s, n) {
+  return s.padStart(n, " ");
+}
 function registerServe(program) {
   const cmd = program.command("serve").description("start Vibgrate AI Context \u2014 local-first MCP serving your code map, drift & version-correct docs to your AI").option("--http", "serve over streamable HTTP instead of stdio").option("--port <n>", "port for --http", "7437").option("--host <h>", "host for --http", "127.0.0.1").option("--savings", "record local, counts-only usage savings (opt-in; off by default)").option("--dedup", "collapse a node's heavy relation lists on repeat reads within a session (opt-in; saves tokens)").option("--no-refresh", "serve the map as built \u2014 skip the auto-rebuild when files change").action(async function(opts) {
     const global = readGlobal(this);
@@ -842,7 +1242,7 @@ function registerServe(program) {
       dedup: opts.dedup === true,
       refresh
     };
-    if (!fs4.existsSync(graphPath)) {
+    if (!fs5.existsSync(graphPath)) {
       throw new CliError(
         `no map found at ${graphPath} \u2014 run \`vg\` to build one first`,
         ExitCode.NOT_FOUND
@@ -881,7 +1281,7 @@ async function serveHttp(graphPath, host, port, opts, freshness) {
       info(c.red(`vg serve: request error: ${err.message}`));
     }
   });
-  await new Promise((resolve15) => httpServer.listen(port, host, resolve15));
+  await new Promise((resolve16) => httpServer.listen(port, host, resolve16));
   info(c.dim(`vg \xB7 MCP server on http://${host}:${port}/mcp (read-only, local, ${freshness})`));
   await new Promise(() => {
   });
@@ -898,9 +1298,9 @@ function registerInstall(program) {
         json(ASSISTANTS.map((a) => ({ id: a.id, label: a.label, mcp: !!a.mcp, skill: !!a.skill, nudge: !!a.nudge })));
       } else {
         info(`${c.cyan("vg install")} \xB7 supported assistants`);
-        const pad3 = Math.max(...ASSISTANTS.map((a) => a.id.length)) + 2;
+        const pad4 = Math.max(...ASSISTANTS.map((a) => a.id.length)) + 2;
         for (const a of ASSISTANTS) {
-          info(`  ${c.bold(a.id.padEnd(pad3))} ${a.label}  ${c.dim(`mcp:${a.mcp ? "\u2713" : "\u2014"} skill:${a.skill ? "\u2713" : "\u2014"} nudge:${a.nudge ? "\u2713" : "\u2014"}`)}`);
+          info(`  ${c.bold(a.id.padEnd(pad4))} ${a.label}  ${c.dim(`mcp:${a.mcp ? "\u2713" : "\u2014"} skill:${a.skill ? "\u2713" : "\u2014"} nudge:${a.nudge ? "\u2713" : "\u2014"}`)}`);
         }
       }
       return;
@@ -912,8 +1312,9 @@ function registerInstall(program) {
     const smallRepo = graph !== null && fileCount > 0 && fileCount < SMALL_REPO_FILES;
     const launch = detectServeLaunch();
     const results = targets.map((a) => ({ id: a.id, ...installAssistant(a, { root, hook: opts.hook, smallRepo, launch }) }));
+    const navConfig = writeNavigationConfig(root);
     if (global.json) {
-      json({ root, smallRepo, launch: { command: launch.command, args: launch.args, note: launch.note ?? null }, results });
+      json({ root, smallRepo, navConfig, launch: { command: launch.command, args: launch.args, note: launch.note ?? null }, results });
       return;
     }
     for (const r of results) {
@@ -921,6 +1322,7 @@ function registerInstall(program) {
     }
     if (launch.note && results.some((r) => r.note)) info(`${c.yellow("!")} ${launch.note}`);
     if (smallRepo) info(c.dim(`  note: small repo (${fileCount} files) \u2014 nudge says searching is fine; vg is still used for impact/tests`));
+    info(c.dim(`  wrote ${navConfig} \u2014 deferred-loading config for Claude-API agents (lower per-step token cost)`));
     info(c.dim("  run `vg serve` is wired via MCP; build the map with `vg` if you have not yet"));
   });
   applyGlobalOptions(install);
@@ -958,8 +1360,8 @@ function registerShare(program) {
   const cmd = program.command("share").description("make the map committable + auto-updating for your team (git)").option("--undo", "reverse what `vg share` installed").option("--reports", "also commit graph.html / GRAPH_REPORT.md (default: gitignored)").action(function(opts) {
     const global = readGlobal(this);
     const root = rootOf(global);
-    const gitDir = path9.join(root, ".git");
-    if (!fs4.existsSync(gitDir)) {
+    const gitDir = path.join(root, ".git");
+    if (!fs5.existsSync(gitDir)) {
       throw new CliError("not a git repository \u2014 run `vg share` inside a git repo", ExitCode.USAGE_ERROR);
     }
     if (opts.undo) {
@@ -980,23 +1382,23 @@ function registerShare(program) {
   applyGlobalOptions(cmd);
 }
 function writeVibgrateGitignore(root, reports) {
-  const dir = path9.join(root, ".vibgrate");
-  fs4.mkdirSync(dir, { recursive: true });
+  const dir = path.join(root, ".vibgrate");
+  fs5.mkdirSync(dir, { recursive: true });
   const lines = ["# Managed by `vg share` \u2014 keep graph.json committed, ignore the rest", "cache/", "facts.jsonl"];
   if (!reports) lines.push("graph.html", "GRAPH_REPORT.md");
-  fs4.writeFileSync(path9.join(dir, ".gitignore"), `${lines.join("\n")}
+  fs5.writeFileSync(path.join(dir, ".gitignore"), `${lines.join("\n")}
 `);
 }
 function writeGitAttributes(root) {
-  const file = path9.join(root, ".gitattributes");
+  const file = path.join(root, ".gitattributes");
   const line = ".vibgrate/graph.json merge=vg";
-  let content = fs4.existsSync(file) ? fs4.readFileSync(file, "utf8") : "";
+  let content = fs5.existsSync(file) ? fs5.readFileSync(file, "utf8") : "";
   if (!content.split("\n").some((l) => l.trim() === line)) {
     content = content.length ? `${content.replace(/\s*$/, "")}
 ${line}
 ` : `${line}
 `;
-    fs4.writeFileSync(file, content);
+    fs5.writeFileSync(file, content);
   }
 }
 function configureMergeDriver(root) {
@@ -1005,8 +1407,8 @@ function configureMergeDriver(root) {
 }
 function installPreCommitHook(root) {
   const hooksDir = hookDir(root);
-  fs4.mkdirSync(hooksDir, { recursive: true });
-  const file = path9.join(hooksDir, "pre-commit");
+  fs5.mkdirSync(hooksDir, { recursive: true });
+  const file = path.join(hooksDir, "pre-commit");
   const block = [
     HOOK_BEGIN,
     "if command -v vg >/dev/null 2>&1; then",
@@ -1015,7 +1417,7 @@ function installPreCommitHook(root) {
     "fi",
     HOOK_END
   ].join("\n");
-  let content = fs4.existsSync(file) ? fs4.readFileSync(file, "utf8") : "#!/bin/sh\n";
+  let content = fs5.existsSync(file) ? fs5.readFileSync(file, "utf8") : "#!/bin/sh\n";
   const re = new RegExp(`${escapeRe(HOOK_BEGIN)}[\\s\\S]*?${escapeRe(HOOK_END)}`);
   if (re.test(content)) content = content.replace(re, block);
   else content = `${content.replace(/\s*$/, "")}
@@ -1024,21 +1426,21 @@ ${block}
 `;
   if (!content.startsWith("#!")) content = `#!/bin/sh
 ${content}`;
-  fs4.writeFileSync(file, content);
-  fs4.chmodSync(file, 493);
+  fs5.writeFileSync(file, content);
+  fs5.chmodSync(file, 493);
 }
 function undo(root) {
-  const hookFile = path9.join(hookDir(root), "pre-commit");
-  if (fs4.existsSync(hookFile)) {
+  const hookFile = path.join(hookDir(root), "pre-commit");
+  if (fs5.existsSync(hookFile)) {
     const re = new RegExp(`\\n*${escapeRe(HOOK_BEGIN)}[\\s\\S]*?${escapeRe(HOOK_END)}\\n*`);
-    const next2 = fs4.readFileSync(hookFile, "utf8").replace(re, "\n");
-    if (next2.trim() === "#!/bin/sh") fs4.rmSync(hookFile);
-    else fs4.writeFileSync(hookFile, next2);
+    const next2 = fs5.readFileSync(hookFile, "utf8").replace(re, "\n");
+    if (next2.trim() === "#!/bin/sh") fs5.rmSync(hookFile);
+    else fs5.writeFileSync(hookFile, next2);
   }
-  const attr = path9.join(root, ".gitattributes");
-  if (fs4.existsSync(attr)) {
-    const next2 = fs4.readFileSync(attr, "utf8").split("\n").filter((l) => l.trim() !== ".vibgrate/graph.json merge=vg").join("\n");
-    fs4.writeFileSync(attr, next2);
+  const attr = path.join(root, ".gitattributes");
+  if (fs5.existsSync(attr)) {
+    const next2 = fs5.readFileSync(attr, "utf8").split("\n").filter((l) => l.trim() !== ".vibgrate/graph.json merge=vg").join("\n");
+    fs5.writeFileSync(attr, next2);
   }
   try {
     git(root, ["config", "--remove-section", "merge.vg"]);
@@ -1048,10 +1450,10 @@ function undo(root) {
 function hookDir(root) {
   try {
     const configured = git(root, ["config", "--get", "core.hooksPath"]).trim();
-    if (configured) return path9.resolve(root, configured);
+    if (configured) return path.resolve(root, configured);
   } catch {
   }
-  return path9.join(root, ".git", "hooks");
+  return path.join(root, ".git", "hooks");
 }
 function git(root, args) {
   return execFileSync("git", args, { cwd: root, encoding: "utf8" });
@@ -1082,7 +1484,7 @@ function registerBenchmark(program) {
     if (tokenReduction.questions.length) {
       info(`  token reduction vs grep/read baseline (${c.dim("estimates")}):`);
       for (const q of tokenReduction.questions) {
-        info(`    ${pad2(`${q.ratio.toFixed(1)}\xD7`, 6)} ${c.dim(`vg ${q.vgTokens} vs ~${q.baselineTokens}`)}  "${q.question}"`);
+        info(`    ${pad3(`${q.ratio.toFixed(1)}\xD7`, 6)} ${c.dim(`vg ${q.vgTokens} vs ~${q.baselineTokens}`)}  "${q.question}"`);
       }
       info(`  ${c.bold(`aggregate \u2248 ${tokenReduction.aggregateRatio.toFixed(1)}\xD7 fewer tokens`)} ${c.dim("(honest estimate, scales with repo size)")}`);
     }
@@ -1171,7 +1573,7 @@ function grepBaselineTokens(term, files) {
     if (f.size > 512 * 1024) continue;
     let content = "";
     try {
-      content = fs4.readFileSync(f.abs, "utf8");
+      content = fs5.readFileSync(f.abs, "utf8");
     } catch {
       continue;
     }
@@ -1181,7 +1583,7 @@ function grepBaselineTokens(term, files) {
 }
 function safeSize(abs) {
   try {
-    return fs4.statSync(abs).size;
+    return fs5.statSync(abs).size;
   } catch {
     return 0;
   }
@@ -1198,7 +1600,7 @@ function round(x) {
 function round6(x) {
   return Math.round(x * 1e6) / 1e6;
 }
-function pad2(s, n) {
+function pad3(s, n) {
   return s.padStart(n, " ");
 }
 function registerTests(program) {
@@ -1511,11 +1913,11 @@ function normalizeStandards(raw) {
   return { banned };
 }
 function loadStandards(root) {
-  for (const rel2 of STANDARDS_FILES) {
-    const p = path9__default.join(root, rel2);
+  for (const rel3 of STANDARDS_FILES) {
+    const p = path__default.join(root, rel3);
     let text;
     try {
-      text = fs4__default.readFileSync(p, "utf8");
+      text = fs5__default.readFileSync(p, "utf8");
     } catch {
       continue;
     }
@@ -1710,7 +2112,7 @@ async function addCmd(root, rest, opts, asJson) {
 }
 function readPackageVersion(root) {
   try {
-    const pkg = JSON.parse(fs4__default.readFileSync(path9__default.join(root, "package.json"), "utf8"));
+    const pkg = JSON.parse(fs5__default.readFileSync(path__default.join(root, "package.json"), "utf8"));
     return typeof pkg.version === "string" ? pkg.version : void 0;
   } catch {
     return void 0;
@@ -1718,7 +2120,7 @@ function readPackageVersion(root) {
 }
 function readOptionalFile(p) {
   try {
-    const t = fs4__default.readFileSync(p, "utf8");
+    const t = fs5__default.readFileSync(p, "utf8");
     return t.trim() ? t : void 0;
   } catch {
     return void 0;
@@ -1733,8 +2135,8 @@ async function publishCmd(root, rest, opts, global, asJson) {
   if (!parsed) throw new CliError("publishing a private library requires a DSN \u2014 run `vibgrate login` or set VIBGRATE_DSN", ExitCode.USAGE_ERROR);
   const version = (opts.version || readPackageVersion(root) || "").trim();
   if (!version) throw usageError("a --version is required (or run from a package whose package.json has a version)");
-  const readme = readOptionalFile(opts.readme ? path9__default.resolve(opts.readme) : path9__default.join(root, "README.md"));
-  const dts = opts.dts ? readOptionalFile(path9__default.resolve(opts.dts)) : void 0;
+  const readme = readOptionalFile(opts.readme ? path__default.resolve(opts.readme) : path__default.join(root, "README.md"));
+  const dts = opts.dts ? readOptionalFile(path__default.resolve(opts.dts)) : void 0;
   if (!readme && !dts) throw usageError("nothing to publish \u2014 no README.md found and no --dts given");
   const result = await publishPrivateLibrary(
     { name, version, readme, dts, language: opts.language },
@@ -1846,7 +2248,7 @@ async function showCmd(root, name, budget, asJson, opts = {}) {
   out(doc);
 }
 function registerExport(program) {
-  const cmd = program.command("export").description("export the map (format inferred: json|ndjson|graphml|dot|cypher|md|html|cdx.json|spdx.json)").argument("[file]", "target file (or - for stdout)", "map.json").action(function(file) {
+  const cmd = program.command("export").description("export the map (format inferred: json|ndjson|graphml|dot|cypher|sql|md|html|cdx.json|spdx.json)").argument("[file]", "target file (or - for stdout)", "map.json").action(function(file) {
     const global = readGlobal(this);
     const { graph } = requireGraph(global);
     const root = rootOf(global);
@@ -1863,8 +2265,8 @@ function registerExport(program) {
       out(content.trimEnd());
       return;
     }
-    fs4.mkdirSync(path9.dirname(path9.resolve(file)), { recursive: true });
-    fs4.writeFileSync(file, content);
+    fs5.mkdirSync(path.dirname(path.resolve(file)), { recursive: true });
+    fs5.writeFileSync(file, content);
     info(`${c.green("\u2714")} wrote ${file} ${c.dim(`(${format})`)}`);
   });
   applyGlobalOptions(cmd);
@@ -1874,37 +2276,37 @@ function detectFormat(file) {
   if (lower.endsWith(".cdx.json")) return "cyclonedx";
   if (lower.endsWith(".spdx.json")) return "spdx";
   if (file === "-") return "json";
-  return formatForExt(path9.extname(file));
+  return formatForExt(path.extname(file));
 }
 function registerBundle(program) {
   const cmd = program.command("bundle").description("build an air-gapped bundle (grammars + graph + library catalog)").option("--offline", "offline bundle (default; present for clarity)").option("-o, --out <dir>", "output directory", "vg-bundle").action(function(opts) {
     const global = readGlobal(this);
     const root = rootOf(global);
-    const outDir = path9.resolve(root, opts.out ?? "vg-bundle");
+    const outDir = path.resolve(root, opts.out ?? "vg-bundle");
     let grammarFiles;
     try {
       grammarFiles = resolvedGrammarFiles();
     } catch {
       throw new CliError("no grammars found to bundle (run a build first)", ExitCode.ERROR);
     }
-    fs4.mkdirSync(path9.join(outDir, "grammars"), { recursive: true });
+    fs5.mkdirSync(path.join(outDir, "grammars"), { recursive: true });
     let grammarCount = 0;
     for (const { fileName, absPath } of grammarFiles) {
-      fs4.copyFileSync(absPath, path9.join(outDir, "grammars", fileName));
+      fs5.copyFileSync(absPath, path.join(outDir, "grammars", fileName));
       grammarCount++;
     }
     const included = [`grammars/ (${grammarCount} .wasm)`];
     const graphSrc = global.graph ?? defaultGraphPath(root);
-    if (fs4.existsSync(graphSrc)) {
-      fs4.copyFileSync(graphSrc, path9.join(outDir, "graph.json"));
+    if (fs5.existsSync(graphSrc)) {
+      fs5.copyFileSync(graphSrc, path.join(outDir, "graph.json"));
       included.push("graph.json");
     }
     const cat = catalogPath(root);
-    if (fs4.existsSync(cat)) {
-      fs4.copyFileSync(cat, path9.join(outDir, "vibgrate.lib.json"));
+    if (fs5.existsSync(cat)) {
+      fs5.copyFileSync(cat, path.join(outDir, "vibgrate.lib.json"));
       included.push("vibgrate.lib.json");
-      if (fs4.existsSync(libDir(root))) {
-        fs4.cpSync(libDir(root), path9.join(outDir, "lib"), { recursive: true });
+      if (fs5.existsSync(libDir(root))) {
+        fs5.cpSync(libDir(root), path.join(outDir, "lib"), { recursive: true });
         included.push("lib/");
       }
     }
@@ -1916,38 +2318,38 @@ function registerBundle(program) {
       included,
       usage: "Run `vg build --grammars <this dir>/grammars` to build fully offline."
     };
-    fs4.writeFileSync(path9.join(outDir, "MANIFEST.json"), `${stableStringify(manifest, 2)}
+    fs5.writeFileSync(path.join(outDir, "MANIFEST.json"), `${stableStringify(manifest, 2)}
 `);
     if (global.json) {
-      json({ out: path9.relative(root, outDir), ...manifest });
+      json({ out: path.relative(root, outDir), ...manifest });
       return;
     }
-    info(`${c.cyan("vg bundle")} \xB7 wrote ${path9.relative(root, outDir)}/`);
+    info(`${c.cyan("vg bundle")} \xB7 wrote ${path.relative(root, outDir)}/`);
     for (const i of included) info(`  ${c.green("\u2714")} ${i}`);
-    info(c.dim(`  offline: vg build --grammars "${path9.relative(root, outDir)}/grammars"`));
+    info(c.dim(`  offline: vg build --grammars "${path.relative(root, outDir)}/grammars"`));
   });
   applyGlobalOptions(cmd);
 }
 var initCommand = new Command("init").description("Initialize vibgrate in a project").argument("[path]", "Path to initialize", ".").option("--baseline", "Create initial baseline after init").option("--yes", "Skip confirmation prompts").action(async (targetPath, opts) => {
-  const rootDir = path9.resolve(targetPath);
-  const vibgrateDir2 = path9.join(rootDir, ".vibgrate");
+  const rootDir = path.resolve(targetPath);
+  const vibgrateDir2 = path.join(rootDir, ".vibgrate");
   await ensureDir(vibgrateDir2);
-  console.log(chalk5.green("\u2714") + ` Created ${chalk5.bold(".vibgrate/")} directory`);
-  const configPath = path9.join(rootDir, "vibgrate.config.ts");
+  console.log(chalk7.green("\u2714") + ` Created ${chalk7.bold(".vibgrate/")} directory`);
+  const configPath = path.join(rootDir, "vibgrate.config.ts");
   if (await pathExists(configPath)) {
-    console.log(chalk5.dim("  vibgrate.config.ts already exists, skipping"));
+    console.log(chalk7.dim("  vibgrate.config.ts already exists, skipping"));
   } else {
     await writeDefaultConfig(rootDir);
-    console.log(chalk5.green("\u2714") + ` Created ${chalk5.bold("vibgrate.config.ts")}`);
+    console.log(chalk7.green("\u2714") + ` Created ${chalk7.bold("vibgrate.config.ts")}`);
   }
   if (opts.baseline) {
-    const { runBaseline } = await import('./baseline-FESLZK5O.js');
+    const { runBaseline } = await import('./baseline-RRO4NNNF.js');
     await runBaseline(rootDir);
   }
   console.log("");
-  console.log(chalk5.bold("Next steps:"));
-  console.log(`  ${chalk5.cyan("vibgrate scan")}            Scan for upgrade drift`);
-  console.log(`  ${chalk5.cyan("vibgrate baseline")}        Create a drift baseline`);
+  console.log(chalk7.bold("Next steps:"));
+  console.log(`  ${chalk7.cyan("vibgrate scan")}            Scan for upgrade drift`);
+  console.log(`  ${chalk7.cyan("vibgrate baseline")}        Create a drift baseline`);
   console.log("");
 });
 
@@ -1974,7 +2376,7 @@ var AI_ASSISTANT_DETECTORS = [
 async function detectAiAssistant(rootDir) {
   for (const detector of AI_ASSISTANT_DETECTORS) {
     for (const file of detector.files) {
-      if (await pathExists$1(path9.join(rootDir, file))) {
+      if (await pathExists$1(path.join(rootDir, file))) {
         return detector.name;
       }
     }
@@ -1982,22 +2384,22 @@ async function detectAiAssistant(rootDir) {
   return null;
 }
 function printAiContextPrompt(detectedAssistant) {
-  const teal2 = chalk5.hex("#3FB0A4");
-  const mint2 = chalk5.hex("#4FE3C1");
+  const teal2 = chalk7.hex("#3FB0A4");
+  const mint2 = chalk7.hex("#4FE3C1");
   const cli = resolveCliInvocation();
   const installArgs = detectedAssistant ? `install ${detectedAssistant}` : "install --all";
   const installCmd = `${cli} ${installArgs}`;
-  const detectedNote = detectedAssistant ? chalk5.dim(`  (${detectedAssistant} config detected)`) : "";
+  const detectedNote = detectedAssistant ? chalk7.dim(`  (${detectedAssistant} config detected)`) : "";
   console.log("");
   console.log(teal2("  \u256D\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u256E"));
-  console.log(teal2("  \u2502") + "  " + mint2("\u25C6") + "  " + chalk5.bold.white("Get AI-aware answers in your editor") + "          " + teal2("\u2502"));
+  console.log(teal2("  \u2502") + "  " + mint2("\u25C6") + "  " + chalk7.bold.white("Get AI-aware answers in your editor") + "          " + teal2("\u2502"));
   console.log(teal2("  \u2570\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u256F"));
   console.log("");
-  console.log("  " + chalk5.bold.white(installCmd) + detectedNote);
+  console.log("  " + chalk7.bold.white(installCmd) + detectedNote);
   console.log("");
-  console.log("  " + teal2("\xB7") + " " + chalk5.white("Code map in your assistant") + chalk5.dim(" \u2014 call trees, impact surfaces, import paths"));
-  console.log("  " + teal2("\xB7") + " " + chalk5.white("Offline drift") + chalk5.dim(" \u2014 DriftScore and upgrade priorities, right inside your editor"));
-  console.log("  " + teal2("\xB7") + " " + chalk5.white("Version-correct library docs") + chalk5.dim(" \u2014 pinned to your lockfile, no hallucinated APIs"));
+  console.log("  " + teal2("\xB7") + " " + chalk7.white("Code map in your assistant") + chalk7.dim(" \u2014 call trees, impact surfaces, import paths"));
+  console.log("  " + teal2("\xB7") + " " + chalk7.white("Offline drift") + chalk7.dim(" \u2014 DriftScore and upgrade priorities, right inside your editor"));
+  console.log("  " + teal2("\xB7") + " " + chalk7.white("Version-correct library docs") + chalk7.dim(" \u2014 pinned to your lockfile, no hallucinated APIs"));
   console.log("");
 }
 
@@ -2008,14 +2410,14 @@ function shouldBuildCodeMap(opts) {
 async function autoPush(artifact, rootDir, opts) {
   const dsn = resolveDsn(opts.dsn);
   if (!dsn) {
-    console.error(chalk5.red("No DSN provided for push."));
-    console.error(chalk5.dim('Run "vibgrate login", set VIBGRATE_DSN, or use the --dsn flag.'));
+    console.error(chalk7.red("No DSN provided for push."));
+    console.error(chalk7.dim('Run "vibgrate login", set VIBGRATE_DSN, or use the --dsn flag.'));
     if (opts.strict) process.exit(1);
     return;
   }
   const parsed = parseDsn(dsn);
   if (!parsed) {
-    console.error(chalk5.red("Invalid DSN format."));
+    console.error(chalk7.red("Invalid DSN format."));
     if (opts.strict) process.exit(1);
     return;
   }
@@ -2026,7 +2428,7 @@ async function autoPush(artifact, rootDir, opts) {
     try {
       host = resolveIngestHost(opts.region);
     } catch (e) {
-      console.error(chalk5.red(e instanceof Error ? e.message : String(e)));
+      console.error(chalk7.red(e instanceof Error ? e.message : String(e)));
       if (opts.strict) process.exit(1);
       return;
     }
@@ -2034,7 +2436,7 @@ async function autoPush(artifact, rootDir, opts) {
   const originalSize = JSON.stringify(artifact).length;
   const compressedSize = body.length;
   const ratio = ((1 - compressedSize / originalSize) * 100).toFixed(0);
-  console.log(chalk5.dim(`Uploading to ${host}... (${(compressedSize / 1024).toFixed(0)} KB, ${ratio}% smaller)`));
+  console.log(chalk7.dim(`Uploading to ${host}... (${(compressedSize / 1024).toFixed(0)} KB, ${ratio}% smaller)`));
   try {
     const { response, host: uploadedHost } = await uploadScanArtifact({
       scheme: parsed.scheme,
@@ -2054,36 +2456,36 @@ async function autoPush(artifact, rootDir, opts) {
     const result = await response.json();
     if (result.unchanged) {
       console.log(
-        chalk5.green("\u2714") + ` Repository unchanged since ${result.lastScannedAt ?? "last scan"} \u2014 skipped upload (no credit used).`
+        chalk7.green("\u2714") + ` Repository unchanged since ${result.lastScannedAt ?? "last scan"} \u2014 skipped upload (no credit used).`
       );
       if (result.previousIngestId) {
         emitIngestIdLine(result.previousIngestId, { unchanged: true });
         const dashUrl = `https://${dashHostForIngestHost(host)}/${parsed.workspaceId}/scan/${result.previousIngestId}`;
-        console.log(chalk5.dim(`  Previous report: ${dashUrl}`));
+        console.log(chalk7.dim(`  Previous report: ${dashUrl}`));
       } else if (opts.strict) {
-        console.error(chalk5.red("Repository unchanged but no previous ingest id returned."));
+        console.error(chalk7.red("Repository unchanged but no previous ingest id returned."));
         process.exit(1);
       }
       return;
     }
-    console.log(chalk5.green("\u2714") + ` Scan queued for processing (${result.ingestId ?? "ok"})`);
+    console.log(chalk7.green("\u2714") + ` Scan queued for processing (${result.ingestId ?? "ok"})`);
     if (result.ingestId) {
       emitIngestIdLine(result.ingestId);
       const dashUrl = `https://${dashHostForIngestHost(host)}/${parsed.workspaceId}/scan/${result.ingestId}`;
       const CLEAR_LINE = process.platform === "win32" ? "\x1B[0G\x1B[2K" : "";
       console.log("");
-      console.log(CLEAR_LINE + chalk5.dim("  Processing continues in the background. Results available shortly."));
+      console.log(CLEAR_LINE + chalk7.dim("  Processing continues in the background. Results available shortly."));
       console.log("");
-      console.log(CLEAR_LINE + chalk5.cyan("\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500"));
-      console.log(CLEAR_LINE + chalk5.bold("  \u{1F4CA} View Scan Report"));
-      console.log(CLEAR_LINE + "  " + chalk5.underline.cyan(dashUrl));
-      console.log(CLEAR_LINE + chalk5.cyan("\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500"));
+      console.log(CLEAR_LINE + chalk7.cyan("\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500"));
+      console.log(CLEAR_LINE + chalk7.bold("  \u{1F4CA} View Scan Report"));
+      console.log(CLEAR_LINE + "  " + chalk7.underline.cyan(dashUrl));
+      console.log(CLEAR_LINE + chalk7.cyan("\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500"));
       console.log("");
       console.log("");
     }
   } catch (e) {
     const msg = e instanceof Error ? e.message : String(e);
-    console.error(chalk5.red(`Upload failed: ${msg}`));
+    console.error(chalk7.red(`Upload failed: ${msg}`));
     if (opts.strict) process.exit(1);
   }
 }
@@ -2095,15 +2497,15 @@ function reportStandards(rootDir) {
   if (!loaded.policy) return;
   const violations = checkStandards(loaded.policy, inventory(rootDir).records);
   if (violations.length === 0) {
-    console.log(chalk5.green("\u2714") + " Standards: no banned dependencies in use");
+    console.log(chalk7.green("\u2714") + " Standards: no banned dependencies in use");
     return;
   }
-  console.log(chalk5.red(`
+  console.log(chalk7.red(`
 \u26A0 Standards: ${violations.length} banned dependency(ies) in use`));
   for (const v of violations) {
-    const fix = v.use ? chalk5.dim(` \u2192 use ${v.use}`) : "";
-    const why = v.reason ? chalk5.dim(` (${v.reason})`) : "";
-    console.log(`  ${chalk5.red("banned")} ${v.ecosystem}:${v.name}${v.installed ? chalk5.dim(` ${v.installed}`) : ""}${fix}${why}`);
+    const fix = v.use ? chalk7.dim(` \u2192 use ${v.use}`) : "";
+    const why = v.reason ? chalk7.dim(` (${v.reason})`) : "";
+    console.log(`  ${chalk7.red("banned")} ${v.ecosystem}:${v.name}${v.installed ? chalk7.dim(` ${v.installed}`) : ""}${fix}${why}`);
   }
 }
 function parseNonNegativeNumber(value, label) {
@@ -2120,16 +2522,18 @@ var scanCommand = new Command("scan").description("Scan a project for upgrade dr
   collectExcludes,
   []
 ).option("--concurrency <n>", "Max concurrent npm calls", "8").option("--push", "Auto-push results to Vibgrate API after scan").option("--dsn <dsn>", "DSN token for push (or use VIBGRATE_DSN env)").option("--region <region>", "Override data residency region for push (us, eu)").option("--strict", "Fail on push errors").option("--ui-purpose", "Enable optional UI purpose evidence extraction (slower)").option("--no-local-artifacts", "Do not write .vibgrate JSON artifacts to disk").option("--max-privacy", "Enable strongest privacy mode (minimal scanners, no local artifacts)").option("--offline", "Run without network calls; do not upload results").option("--full", "Comprehensive scan: turns on known-vulnerability detection (= --vulns) and, when a standards policy exists, a banned-dependency report \u2014 on top of drift scoring and the code map").option("--vulns", "Also scan installed dependencies for known vulnerabilities (OSV online, or advisories from --package-manifest when offline)").option("--package-manifest <file>", "Use local package-version manifest JSON/ZIP (for offline mode)").option("--project-scan-timeout <seconds>", "Per-project scan timeout in seconds (default: 180)").option("--drift-budget <score>", "Fail if drift score is above budget (0-100)").option("--drift-worsening <percent>", "Fail if drift worsens by more than % since baseline").option("--repository-name <name>", "Override the repository name recorded for this scan (defaults to the directory or package.json name)").option("--force", "Always create a fresh scan ingest, even if the repository is unchanged since the last scan (skips the unchanged/reuse optimization). Used by scheduled and dashboard-triggered scans.").option("--no-graph", "Skip building the local code map (the AI/docs index) that scan produces after scoring drift").option("--quiet", "Suppress promotional output (the free-plan tracking panel and the AI Context install prompt); scan results are unaffected").action(async (targetPath, opts) => {
-  const rootDir = path9.resolve(targetPath);
+  const rootDir = path.resolve(targetPath);
   if (!await pathExists$1(rootDir)) {
-    console.error(chalk5.red(`Path does not exist: ${rootDir}`));
+    console.error(chalk7.red(`Path does not exist: ${rootDir}`));
     process.exit(1);
   }
   const hasDsn = !!resolveDsn(opts.dsn);
   const willPush = !opts.offline && (opts.push || hasDsn);
   const noLocalArtifacts = opts.localArtifacts === false;
-  const isFirstRun = !await pathExists$1(path9.join(rootDir, ".vibgrate", "scan_result.json"));
+  const isFirstRun = !await pathExists$1(path.join(rootDir, ".vibgrate", "scan_result.json"));
   let pinnedRegion;
+  let planTier;
+  let upgradeUrl;
   if (willPush && hasDsn) {
     const dsn = resolveDsn(opts.dsn);
     const parsed = parseDsn(dsn);
@@ -2144,10 +2548,12 @@ var scanCommand = new Command("scan").description("Scan a project for upgrade dr
           vcsSha: fingerprint.vcsSha
         });
         pinnedRegion = preflight.region;
+        planTier = preflight.plan?.tier;
+        upgradeUrl = preflight.upgradeUrl ?? `https://${dashHostForIngestHost(preflight.ingestHost ?? ingestHost)}/${parsed.workspaceId}`;
         if (preflight.vm && !preflight.vm.allowed) {
-          console.error(chalk5.red(preflight.error ?? "VM meter usage exhausted"));
+          console.error(chalk7.red(preflight.error ?? "VM meter usage exhausted"));
           console.error(
-            chalk5.dim(
+            chalk7.dim(
               `VM minutes: ${preflight.vm.used}/${preflight.vm.limit} (${preflight.plan.label} plan) \u2014 enable overages or upgrade your plan.`
             )
           );
@@ -2155,25 +2561,25 @@ var scanCommand = new Command("scan").description("Scan a project for upgrade dr
         }
         if (preflight.repositories && !preflight.repositories.allowed) {
           console.error(
-            chalk5.red(
+            chalk7.red(
               preflight.error ?? `Repository limit reached for the ${preflight.plan.label} plan \u2014 cannot scan a new repository.`
             )
           );
           const max = preflight.repositories.max < 0 ? "unlimited" : String(preflight.repositories.max);
           console.error(
-            chalk5.dim(
+            chalk7.dim(
               `Repositories: ${preflight.repositories.total}/${max} (${preflight.plan.label} plan) \u2014 archive a repository or upgrade your plan.`
             )
           );
           if (preflight.upgradeUrl) {
-            console.error(chalk5.dim(`  Upgrade: ${preflight.upgradeUrl}`));
+            console.error(chalk7.dim(`  Upgrade: ${preflight.upgradeUrl}`));
           }
           process.exit(1);
         }
         if (preflight.status === "error" || !preflight.scans.allowed) {
-          console.error(chalk5.red(preflight.error ?? "Scan ingestion not allowed for this workspace."));
+          console.error(chalk7.red(preflight.error ?? "Scan ingestion not allowed for this workspace."));
           console.error(
-            chalk5.dim(
+            chalk7.dim(
               `Credits: ${preflight.scans.used}/${preflight.scans.limit} (${preflight.plan.label} plan)`
             )
           );
@@ -2181,27 +2587,27 @@ var scanCommand = new Command("scan").description("Scan a project for upgrade dr
           process.exit(1);
         }
         console.log(
-          chalk5.dim(
+          chalk7.dim(
             `Plan: ${preflight.plan.label} \u2014 scan credits ${preflight.scans.used}/${preflight.scans.limit} this month`
           )
         );
         if (preflight.repository?.unchanged && !opts.force) {
           console.log(
-            chalk5.green("\u2714") + ` Repository unchanged at ${preflight.repository.lastVcsSha?.slice(0, 7) ?? "same revision"} \u2014 skipping scan.`
+            chalk7.green("\u2714") + ` Repository unchanged at ${preflight.repository.lastVcsSha?.slice(0, 7) ?? "same revision"} \u2014 skipping scan.`
           );
           if (preflight.repository.lastIngestId) {
             emitIngestIdLine(preflight.repository.lastIngestId, { unchanged: true });
             const dashUrl = `https://${dashHostForIngestHost(ingestHost)}/${parsed.workspaceId}/scan/${preflight.repository.lastIngestId}`;
-            console.log(chalk5.dim(`  Latest report: ${dashUrl}`));
+            console.log(chalk7.dim(`  Latest report: ${dashUrl}`));
           } else if (opts.strict) {
-            console.error(chalk5.red("Repository unchanged but no previous ingest id available."));
+            console.error(chalk7.red("Repository unchanged but no previous ingest id available."));
             process.exit(1);
           }
           return;
         }
       } catch (e) {
         const msg = e instanceof Error ? e.message : String(e);
-        console.error(chalk5.yellow(`Preflight check failed: ${msg}`));
+        console.error(chalk7.yellow(`Preflight check failed: ${msg}`));
         if (opts.strict) process.exit(1);
       }
     }
@@ -2234,6 +2640,17 @@ var scanCommand = new Command("scan").description("Scan a project for upgrade dr
     repositoryName: opts.repositoryName?.trim() || void 0,
     force: opts.force,
     quiet: opts.quiet,
+    // Auth + plan signals for the free-plan upsell panel. `hasDsn` resolves the
+    // full credential precedence — `--dsn`, `VIBGRATE_DSN`, and the stored login
+    // credential (`~/.vibgrate/credentials.json`) — which the scanner's own
+    // dsn/env-only check cannot see. `planTier`/`upgradeUrl` come from preflight.
+    // Together they pick the panel audience: signed out → login CTA; signed in
+    // on free → upgrade CTA; signed in on a paid plan → no panel. Without the
+    // auth signal, a logged-in user running a bare scan was mislabelled
+    // "Vibgrate Free" and shown the login panel even as the run pushed.
+    authenticated: hasDsn,
+    planTier,
+    upgradeUrl,
     // Prefix for the upsell panel's `login → push` hint — `vg` when installed,
     // `npx @vibgrate/cli` when the user ran via npx (where bare `vg` fails).
     invocation: resolveCliInvocation()
@@ -2264,24 +2681,24 @@ var scanCommand = new Command("scan").description("Scan a project for upgrade dr
     const hasErrors = artifact.findings.some((f) => f.level === "error");
     const hasWarnings = artifact.findings.some((f) => f.level === "warning");
     if (opts.failOn === "error" && hasErrors) {
-      console.error(chalk5.red(`
+      console.error(chalk7.red(`
 Failing: ${artifact.findings.filter((f) => f.level === "error").length} error finding(s) detected.`));
       process.exit(2);
     }
     if (opts.failOn === "warn" && (hasErrors || hasWarnings)) {
-      console.error(chalk5.red(`
+      console.error(chalk7.red(`
 Failing: findings detected at warn level or above.`));
       process.exit(2);
     }
   }
   if (scanOpts.driftBudget !== void 0 && artifact.drift.score > scanOpts.driftBudget) {
-    console.error(chalk5.red(`
+    console.error(chalk7.red(`
 Failing fitness function: drift score ${artifact.drift.score}/100 exceeds budget ${scanOpts.driftBudget}.`));
     process.exit(2);
   }
   if (scanOpts.driftWorseningPercent !== void 0) {
     if (artifact.delta === void 0) {
-      console.error(chalk5.red("\nFailing fitness function: --drift-worsening requires --baseline to compare against previous drift."));
+      console.error(chalk7.red("\nFailing fitness function: --drift-worsening requires --baseline to compare against previous drift."));
       process.exit(2);
     }
     if (artifact.delta > 0) {
@@ -2289,7 +2706,7 @@ Failing fitness function: drift score ${artifact.drift.score}/100 exceeds budget
       const denominator = Math.max(Math.abs(baselineScore), 1e-4);
       const worseningPercent = artifact.delta / denominator * 100;
       if (worseningPercent > scanOpts.driftWorseningPercent) {
-        console.error(chalk5.red(`
+        console.error(chalk7.red(`
 Failing fitness function: drift worsened by ${worseningPercent.toFixed(2)}% (threshold ${scanOpts.driftWorseningPercent}%).`));
         process.exit(2);
       }
@@ -2304,22 +2721,853 @@ Failing fitness function: drift worsened by ${worseningPercent.toFixed(2)}% (thr
     printAiContextPrompt(detectedAssistant);
   }
 });
+var WATCHED_FILES = /* @__PURE__ */ new Set([
+  // npm
+  "package.json",
+  "package-lock.json",
+  "npm-shrinkwrap.json",
+  "pnpm-lock.yaml",
+  "yarn.lock",
+  "bun.lockb",
+  // pypi
+  "requirements.txt",
+  "pyproject.toml",
+  "poetry.lock",
+  "Pipfile",
+  "Pipfile.lock",
+  "uv.lock",
+  // go
+  "go.mod",
+  "go.sum",
+  // rust
+  "Cargo.toml",
+  "Cargo.lock",
+  // ruby
+  "Gemfile",
+  "Gemfile.lock",
+  // php
+  "composer.json",
+  "composer.lock",
+  // swift
+  "Package.swift",
+  "Package.resolved",
+  // dart
+  "pubspec.yaml",
+  "pubspec.lock",
+  // java
+  "pom.xml",
+  "build.gradle",
+  "build.gradle.kts",
+  "gradle.lockfile",
+  // dotnet
+  "packages.lock.json"
+]);
+var WATCHED_EXT = /\.(cs|fs)proj$/i;
+var SKIP_DIRS = /* @__PURE__ */ new Set([
+  "node_modules",
+  ".git",
+  "dist",
+  "build",
+  "out",
+  ".vibgrate",
+  "vendor",
+  ".venv",
+  "venv",
+  "env",
+  "__pycache__",
+  "target",
+  ".next",
+  ".nuxt",
+  "coverage",
+  ".cache"
+]);
+function scanStaleness(rootDir, artifactPath) {
+  let ref;
+  try {
+    ref = fs5.statSync(artifactPath).mtimeMs;
+  } catch {
+    return { stale: false };
+  }
+  let newest = -Infinity;
+  let newestChanged;
+  const MAX_ENTRIES = 2e4;
+  let scanned = 0;
+  const walk2 = (dir, depth) => {
+    if (depth > 8 || scanned > MAX_ENTRIES) return;
+    let entries;
+    try {
+      entries = fs5.readdirSync(dir, { withFileTypes: true });
+    } catch {
+      return;
+    }
+    for (const e of entries) {
+      scanned++;
+      if (scanned > MAX_ENTRIES) break;
+      if (e.isDirectory()) {
+        if (!SKIP_DIRS.has(e.name) && !e.name.startsWith(".")) walk2(path.join(dir, e.name), depth + 1);
+        continue;
+      }
+      if (!WATCHED_FILES.has(e.name) && !WATCHED_EXT.test(e.name)) continue;
+      const abs = path.join(dir, e.name);
+      let mtimeMs;
+      try {
+        mtimeMs = fs5.statSync(abs).mtimeMs;
+      } catch {
+        continue;
+      }
+      if (mtimeMs > newest) {
+        newest = mtimeMs;
+        newestChanged = path.relative(rootDir, abs) || e.name;
+      }
+    }
+  };
+  walk2(rootDir, 0);
+  return newest > ref ? { stale: true, newestChanged } : { stale: false };
+}
+var MAX_CONTRACTS = 40;
+function escapeRegExp(s) {
+  return s.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
+}
+function parseJsClause(clause, out2) {
+  const trimmed = clause.trim();
+  if (!trimmed) return;
+  if (/^\*\s+as\s+\w+/.test(trimmed)) {
+    out2.add("* (namespace)");
+    return;
+  }
+  const braceMatch = /\{([^}]*)\}/.exec(trimmed);
+  const beforeBrace = braceMatch ? trimmed.slice(0, braceMatch.index) : trimmed;
+  const defaultId = beforeBrace.replace(/,/g, "").trim();
+  if (defaultId && /^\w+$/.test(defaultId)) out2.add("default");
+  if (braceMatch) {
+    for (const raw of braceMatch[1].split(",")) {
+      const name = raw.trim().split(/\s+as\s+/)[0]?.trim();
+      if (name && /^[\w$]+$/.test(name)) out2.add(name);
+    }
+  }
+}
+function extractContracts(content, pkg, ecosystem) {
+  const out2 = /* @__PURE__ */ new Set();
+  const e = escapeRegExp(pkg);
+  if (ecosystem === "npm") {
+    const importRe = new RegExp(`import\\s+([^;'"\\n]*?)\\s+from\\s+['"]${e}(?:/[^'"]*)?['"]`, "g");
+    let m;
+    while (m = importRe.exec(content)) parseJsClause(m[1], out2);
+    const requireDestructureRe = new RegExp(`\\{([^}]*)\\}\\s*=\\s*require\\(\\s*['"]${e}(?:/[^'"]*)?['"]\\s*\\)`, "g");
+    while (m = requireDestructureRe.exec(content)) {
+      for (const raw of m[1].split(",")) {
+        const name = raw.trim().split(":")[0]?.trim();
+        if (name && /^[\w$]+$/.test(name)) out2.add(name);
+      }
+    }
+  } else if (ecosystem === "pypi") {
+    const fromRe = new RegExp(`^\\s*from\\s+${e}(?:\\.[\\w.]+)?\\s+import\\s+(.+)$`, "gm");
+    let m;
+    while (m = fromRe.exec(content)) {
+      const names = m[1].replace(/[()]/g, "").split(",");
+      for (const raw of names) {
+        const name = raw.trim().split(/\s+as\s+/)[0]?.trim();
+        if (name === "*") out2.add("* (module)");
+        else if (name && /^[\w.]+$/.test(name)) out2.add(name);
+      }
+    }
+    const importRe = new RegExp(`^\\s*import\\s+${e}\\b`, "gm");
+    if (importRe.test(content)) out2.add(`${pkg} (module)`);
+  }
+  return [...out2].sort();
+}
+
+// src/reporting/planning/usage.ts
+var SKIP_DIRS2 = /* @__PURE__ */ new Set([
+  "node_modules",
+  ".git",
+  "dist",
+  "build",
+  "out",
+  ".vibgrate",
+  "vendor",
+  ".venv",
+  "venv",
+  "env",
+  "__pycache__",
+  "target",
+  ".next",
+  ".nuxt",
+  "coverage",
+  ".cache"
+]);
+var MAX_FILES = 8e3;
+var MAX_DEPTH = 12;
+var MAX_FILE_BYTES = 1048576;
+var EXT_ECOSYSTEM = {
+  ".ts": "npm",
+  ".tsx": "npm",
+  ".js": "npm",
+  ".jsx": "npm",
+  ".mjs": "npm",
+  ".cjs": "npm",
+  ".mts": "npm",
+  ".cts": "npm",
+  ".vue": "npm",
+  ".svelte": "npm",
+  ".py": "pypi"
+};
+function escapeRegExp2(s) {
+  return s.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
+}
+function importPattern(ecosystem, pkg) {
+  const e = escapeRegExp2(pkg);
+  if (ecosystem === "npm") {
+    return new RegExp(`(?:from\\s+|require\\(\\s*|import\\(\\s*)['"]${e}(?:/[^'"]*)?['"]`, "g");
+  }
+  return new RegExp(`^\\s*(?:import\\s+${e}(?:[.\\s]|$)|from\\s+${e}(?:[.\\s]))`, "gm");
+}
+function analyzeTree(root, packages) {
+  const result = /* @__PURE__ */ new Map();
+  const tracked = [];
+  for (const p of packages) {
+    if (p.ecosystem === "npm" || p.ecosystem === "pypi") {
+      tracked.push({
+        name: p.name,
+        ecosystem: p.ecosystem,
+        pattern: importPattern(p.ecosystem, p.name),
+        importSites: 0,
+        filesTouched: 0,
+        contracts: /* @__PURE__ */ new Set()
+      });
+    } else {
+      result.set(p.name, { importSites: 0, filesTouched: 0, contracts: [] });
+    }
+  }
+  if (tracked.length === 0) return result;
+  let filesSeen = 0;
+  const walk2 = (dir, depth) => {
+    if (depth > MAX_DEPTH || filesSeen >= MAX_FILES) return;
+    let entries;
+    try {
+      entries = fs5.readdirSync(dir, { withFileTypes: true });
+    } catch {
+      return;
+    }
+    entries.sort((a, b) => a.name.localeCompare(b.name));
+    for (const entry of entries) {
+      if (filesSeen >= MAX_FILES) return;
+      if (entry.isDirectory()) {
+        if (SKIP_DIRS2.has(entry.name) || entry.name.startsWith(".")) continue;
+        walk2(path.join(dir, entry.name), depth + 1);
+        continue;
+      }
+      const fileEco = EXT_ECOSYSTEM[path.extname(entry.name)];
+      if (!fileEco || fileEco === "unknown") continue;
+      filesSeen++;
+      const full = path.join(dir, entry.name);
+      let content;
+      try {
+        if (fs5.statSync(full).size > MAX_FILE_BYTES) continue;
+        content = fs5.readFileSync(full, "utf8");
+      } catch {
+        continue;
+      }
+      for (const t of tracked) {
+        if (t.ecosystem !== fileEco) continue;
+        t.pattern.lastIndex = 0;
+        const matches = content.match(t.pattern);
+        if (matches && matches.length) {
+          t.importSites += matches.length;
+          t.filesTouched++;
+          if (t.contracts.size < MAX_CONTRACTS) {
+            for (const sym of extractContracts(content, t.name, t.ecosystem)) t.contracts.add(sym);
+          }
+        }
+      }
+    }
+  };
+  walk2(root, 0);
+  for (const t of tracked) {
+    result.set(t.name, {
+      importSites: t.importSites,
+      filesTouched: t.filesTouched,
+      contracts: [...t.contracts].sort().slice(0, MAX_CONTRACTS)
+    });
+  }
+  return result;
+}
+
+// src/reporting/utils/fix-plan.ts
+function postOnce(input, host) {
+  return fetch(`${input.scheme}://${host}/v1/fix/plan`, {
+    method: "POST",
+    headers: {
+      "Content-Type": "application/json",
+      "X-Vibgrate-Timestamp": input.timestamp,
+      Authorization: `VibgrateDSN ${input.keyId}:${input.secret}`,
+      Connection: "close"
+    },
+    body: JSON.stringify(input.request)
+  });
+}
+async function regionRedirectHost(response) {
+  try {
+    const payload = await response.clone().json();
+    if (payload?.code !== "REGION_MISMATCH" || !payload.region) return void 0;
+    return ingestHostForRegionId(payload.region);
+  } catch {
+    return void 0;
+  }
+}
+async function requestFixPlan(input) {
+  let host = input.host;
+  let response = await postOnce(input, host);
+  if (response.status === 409) {
+    const target = await regionRedirectHost(response);
+    if (target && target !== host) {
+      host = target;
+      response = await postOnce(input, host);
+    }
+  }
+  return { response, host };
+}
+async function parseFixPlanResponse(response) {
+  return await response.json();
+}
+var SEVERITY_ORDER = ["critical", "high", "moderate", "low", "unknown"];
+function deltaSummary(delta) {
+  if (delta.total === 0) return "none";
+  const parts = SEVERITY_ORDER.filter((s) => delta.bySeverity[s]).map((s) => `${delta.bySeverity[s]} ${s}`);
+  return parts.length ? parts.join(", ") : `${delta.total}`;
+}
+function riskLabel(score) {
+  if (score <= 15) return chalk7.green(`${score}/100 low`);
+  if (score <= 40) return chalk7.yellow(`${score}/100 moderate`);
+  return chalk7.red(`${score}/100 high`);
+}
+function planBlock(plan, recommended) {
+  const lines = [];
+  const marker = recommended ? chalk7.green("\u25CF recommended") : chalk7.dim("\u25CB");
+  lines.push(`${marker} ${chalk7.bold(plan.label)} \u2014 ${chalk7.dim(plan.description)}`);
+  const drift = typeof plan.expectedDriftScore === "number" && typeof plan.driftDelta === "number" ? `  \xB7  DriftScore \u2192${plan.expectedDriftScore} (${plan.driftDelta <= 0 ? "" : "+"}${plan.driftDelta})` : "";
+  lines.push(
+    `    risk ${riskLabel(plan.riskScore)}  \xB7  ${plan.upgrades.length} upgrade(s)  \xB7  fixes ${deltaSummary(plan.fixes)}${drift}`
+  );
+  if (plan.introduces.total) {
+    lines.push(chalk7.red(`    \u26A0 introduces ${deltaSummary(plan.introduces)} advisory(ies) in target versions`));
+  }
+  const shown = plan.upgrades.slice(0, 12);
+  for (const u of shown) {
+    const codemod = u.playbook?.codemod ? chalk7.magenta(`  [codemod: ${u.playbook.codemod}]`) : "";
+    lines.push(`      ${chalk7.cyan(u.package)} ${chalk7.dim(`${u.from ?? "?"} \u2192 ${u.to ?? "?"}`)}  ${chalk7.dim(u.reason)}${codemod}`);
+  }
+  if (plan.upgrades.length > shown.length) {
+    lines.push(chalk7.dim(`      \u2026 and ${plan.upgrades.length - shown.length} more`));
+  }
+  if (plan.upgrades.length === 0) {
+    lines.push(chalk7.dim("      (no upgrades in this plan)"));
+  }
+  return lines.join("\n");
+}
+function dataNote(report) {
+  if (report.vulnerabilityData === "unavailable") {
+    return chalk7.dim("Advisory data was unavailable \u2014 vulnerability impact is not shown.");
+  }
+  if (report.vulnerabilityData === "partial") {
+    return chalk7.dim("Advisory data was partial \u2014 some ecosystems were not checked.");
+  }
+  return null;
+}
+function renderText(report) {
+  const out2 = [];
+  out2.push(chalk7.bold("Vibgrate fix \u2014 upgrade plan"));
+  out2.push(
+    chalk7.dim(
+      `${report.totalCandidates} drifted dependency(ies) analysed \xB7 ${report.deepAnalysis ? "deep (major) analysis on" : "preflight only"}`
+    )
+  );
+  const note = dataNote(report);
+  if (note) out2.push(note);
+  if (report.exploitability && report.exploitability.kevPackages > 0) {
+    const epss = report.exploitability.maxEpss != null ? `, peak EPSS ${(report.exploitability.maxEpss * 100).toFixed(0)}%` : "";
+    out2.push(chalk7.red(`\u26A0 ${report.exploitability.kevPackages} package(s) carry a KNOWN-EXPLOITED (KEV) advisory${epss} \u2014 prioritise these.`));
+  }
+  out2.push("");
+  for (const plan of report.plans) {
+    out2.push(planBlock(plan, plan.tier === report.recommended));
+    out2.push("");
+  }
+  out2.push(chalk7.bold("Recommendation"));
+  out2.push(`  ${chalk7.green(report.plans.find((p) => p.tier === report.recommended)?.label ?? report.recommended)} \u2014 ${report.rationale}`);
+  if (report.unresolved.total) {
+    out2.push("");
+    out2.push(chalk7.red(`\u26A0 ${deltaSummary(report.unresolved)} advisory(ies) have no upgrade path in any plan.`));
+  }
+  return out2.join("\n");
+}
+function renderMarkdown(report) {
+  const out2 = [];
+  out2.push("# Vibgrate fix \u2014 upgrade plan");
+  out2.push("");
+  out2.push(
+    `${report.totalCandidates} drifted dependency(ies) analysed \xB7 ${report.deepAnalysis ? "deep (major) analysis on" : "preflight only"}.`
+  );
+  const note = dataNote(report);
+  if (note) {
+    out2.push("");
+    out2.push(`_${report.vulnerabilityData === "unavailable" ? "Advisory data was unavailable \u2014 vulnerability impact is not shown." : "Advisory data was partial \u2014 some ecosystems were not checked."}_`);
+  }
+  out2.push("");
+  for (const plan of report.plans) {
+    const rec = plan.tier === report.recommended ? " \u2705 **recommended**" : "";
+    out2.push(`## ${plan.label}${rec}`);
+    out2.push("");
+    out2.push(`_${plan.description}_`);
+    out2.push("");
+    out2.push(`- Risk: **${plan.riskScore}/100** (${plan.confidence} confidence)`);
+    out2.push(`- Upgrades: **${plan.upgrades.length}**`);
+    out2.push(`- Fixes advisories: ${deltaSummary(plan.fixes)}`);
+    if (plan.introduces.total) {
+      out2.push(`- \u26A0 Introduces advisories in target versions: ${deltaSummary(plan.introduces)}`);
+    }
+    out2.push("");
+    if (plan.upgrades.length) {
+      out2.push("| Package | From | To | Kind | Reason |");
+      out2.push("|---|---|---|---|---|");
+      for (const u of plan.upgrades) {
+        out2.push(`| \`${u.package}\` | ${u.from ?? "?"} | ${u.to ?? "?"} | ${u.kind} | ${u.reason} |`);
+      }
+      out2.push("");
+    }
+  }
+  out2.push("## Recommendation");
+  out2.push("");
+  const recLabel = report.plans.find((p) => p.tier === report.recommended)?.label ?? report.recommended;
+  out2.push(`**${recLabel}** \u2014 ${report.rationale}`);
+  if (report.unresolved.total) {
+    out2.push("");
+    out2.push(`> \u26A0 ${deltaSummary(report.unresolved)} advisory(ies) have no upgrade path in any plan.`);
+  }
+  return out2.join("\n");
+}
+
+// src/reporting/planning/expected-drift.ts
+function estimateDriftScore(artifact, upgraded) {
+  const projects = JSON.parse(JSON.stringify(artifact.projects ?? []));
+  for (const p of projects) {
+    const buckets = p.dependencyAgeBuckets;
+    for (const dep of p.dependencies ?? []) {
+      if (!upgraded.has(dep.package)) continue;
+      const mb3 = dep.majorsBehind ?? 0;
+      if (mb3 >= 2 && buckets.twoPlusBehind > 0) {
+        buckets.twoPlusBehind--;
+        buckets.current++;
+      } else if (mb3 === 1 && buckets.oneBehind > 0) {
+        buckets.oneBehind--;
+        buckets.current++;
+      }
+    }
+    for (const fw of p.frameworks ?? []) {
+      if (upgraded.has(fw.name)) fw.majorsBehind = 0;
+    }
+  }
+  return computeDriftScore(projects).score;
+}
+function pmCommandFor(ecosystem, pkg, version, pm = "npm") {
+  switch (ecosystem) {
+    case "npm":
+      if (pm === "pnpm") return { cmd: "pnpm", args: ["add", `${pkg}@${version}`] };
+      if (pm === "yarn") return { cmd: "yarn", args: ["add", `${pkg}@${version}`] };
+      if (pm === "bun") return { cmd: "bun", args: ["add", `${pkg}@${version}`] };
+      return { cmd: "npm", args: ["install", `${pkg}@${version}`] };
+    case "pypi":
+      return { cmd: "pip", args: ["install", `${pkg}==${version}`] };
+    case "cargo":
+      return { cmd: "cargo", args: ["add", `${pkg}@${version}`] };
+    case "go":
+      return { cmd: "go", args: ["get", `${pkg}@${version.startsWith("v") ? version : `v${version}`}`] };
+    case "composer":
+      return { cmd: "composer", args: ["require", `${pkg}:${version}`] };
+    case "nuget":
+      return { cmd: "dotnet", args: ["add", "package", pkg, "--version", version] };
+    case "dotnet":
+      return { cmd: "dotnet", args: ["add", "package", pkg, "--version", version] };
+    case "dart":
+    case "pub":
+      return { cmd: "dart", args: ["pub", "add", `${pkg}:${version}`] };
+    case "rubygems":
+    case "ruby":
+      return { cmd: "bundle", args: ["update", pkg] };
+    default:
+      return null;
+  }
+}
+function defaultRun(cmd, cwd) {
+  const res = spawnSync(cmd.cmd, cmd.args, { cwd, stdio: "inherit", shell: false });
+  if (res.error) return { ok: false, detail: res.error.message };
+  if (res.status !== 0) return { ok: false, detail: `exit ${res.status ?? "signal"}` };
+  return { ok: true };
+}
+function applyPlan(rootDir, upgrades, opts = {}) {
+  const run = opts.run ?? defaultRun;
+  const results = [];
+  for (const u of upgrades) {
+    if (!u.to) {
+      results.push({ package: u.package, to: u.to, status: "skipped", detail: "no target version" });
+      continue;
+    }
+    const command = pmCommandFor(u.ecosystem, u.package, u.to, opts.packageManager);
+    if (!command) {
+      results.push({ package: u.package, to: u.to, status: "manual", detail: `${u.ecosystem}: update the manifest to ${u.to} manually` });
+      continue;
+    }
+    if (opts.dryRun) {
+      results.push({ package: u.package, to: u.to, status: "skipped", detail: `would run: ${command.cmd} ${command.args.join(" ")}` });
+      continue;
+    }
+    const outcome = run(command, rootDir);
+    results.push({
+      package: u.package,
+      to: u.to,
+      status: outcome.ok ? "applied" : "failed",
+      detail: outcome.detail
+    });
+  }
+  return results;
+}
+
+// src/reporting/commands/fix.ts
+var SEVERITY_RANK = { unknown: 0, low: 1, moderate: 2, high: 3, critical: 4 };
+function ecosystemId(type) {
+  return projectTypeToVulnEcosystem(type) ?? type;
+}
+function sourceEcosystem(ecosystem) {
+  if (ecosystem === "npm") return "npm";
+  if (ecosystem === "pypi") return "pypi";
+  return "unknown";
+}
+function collectCandidates(artifact) {
+  const seen = /* @__PURE__ */ new Set();
+  const out2 = [];
+  for (const project of artifact.projects ?? []) {
+    const ecosystem = ecosystemId(project.type);
+    for (const dep of project.dependencies ?? []) {
+      const key = `${ecosystem}\0${dep.package}`;
+      if (seen.has(key)) continue;
+      if (!dep.latestStable || dep.latestStable === dep.resolvedVersion) continue;
+      if (dep.drift === "current" || dep.drift === "unknown") continue;
+      seen.add(key);
+      out2.push({
+        package: dep.package,
+        ecosystem,
+        source: sourceEcosystem(ecosystem),
+        from: dep.resolvedVersion,
+        to: dep.latestStable,
+        majorsBehind: dep.majorsBehind,
+        section: dep.section
+      });
+    }
+  }
+  out2.sort((a, b) => a.ecosystem.localeCompare(b.ecosystem) || a.package.localeCompare(b.package));
+  return out2;
+}
+var defaultFixScanner = async (rootDir) => {
+  const scratch = path.join(os.tmpdir(), `vg-fix-scan-${process.pid}.json`);
+  const scanOpts = { vibgrateVersion: VERSION, format: "json", out: scratch, quiet: true, concurrency: 8 };
+  const advanced = await loadAdvancedScanHook();
+  return runCoreScan(rootDir, scanOpts, advanced);
+};
+async function loadArtifact(rootDir, inFile, scan = defaultFixScanner) {
+  const artifactPath = path.isAbsolute(inFile) ? inFile : path.join(rootDir, inFile);
+  if (await pathExists(artifactPath)) {
+    const staleness = scanStaleness(rootDir, artifactPath);
+    if (!staleness.stale) {
+      return readJsonFile(artifactPath);
+    }
+    console.error(
+      chalk7.dim(
+        `Scan is out of date (${staleness.newestChanged ?? "a dependency manifest"} changed since the last scan) \u2014 re-running a drift scan first (code map skipped)\u2026`
+      )
+    );
+  } else {
+    console.error(chalk7.dim("No scan found \u2014 running a drift scan first (code map skipped)\u2026"));
+  }
+  return scan(rootDir);
+}
+async function repositoryIdentity(rootDir, override) {
+  try {
+    const vcs = await detectVcs(rootDir);
+    const fingerprint = await computeRepoFingerprint(rootDir, vcs);
+    const name = override?.trim() || await resolveRepositoryName(rootDir);
+    return { name, vcsSha: fingerprint.vcsSha };
+  } catch {
+    return { name: override?.trim() || void 0 };
+  }
+}
+var fixCommand = new Command("fix").description("Analyse drift and get ranked, risk-tiered upgrade plans from the hosted planner (requires login/DSN; read-only \u2014 never edits your project)").argument("[path]", "Path to analyse", ".").option("--in <file>", "Scan artifact to read", ".vibgrate/scan_result.json").option("--format <format>", "Output format (text|json|md)", "text").option("--dsn <dsn>", 'DSN token (or use VIBGRATE_DSN env / "vg login")').option("--region <region>", "Override data residency region (us, eu)").option("--repository-name <name>", "Override the repository name recorded for this plan").option("--plan <tier>", "Apply a specific plan non-interactively (safe|balanced|aggressive)").option("--yes", "Apply the recommended plan without prompting").option("--dry-run", "Show what would change without applying").option("--no-apply", "Only print the plans; never modify the project").option("--fail-on-vulns <severity>", "Exit non-zero if the recommended plan leaves an advisory at/above this severity unresolved (low|moderate|high|critical)").action(async (targetPath, opts) => {
+  const rootDir = path.resolve(targetPath);
+  if (!await pathExists(rootDir)) {
+    console.error(chalk7.red(`Path does not exist: ${rootDir}`));
+    process.exit(1);
+  }
+  const failOn = opts.failOnVulns;
+  if (failOn && !(failOn in SEVERITY_RANK)) {
+    console.error(chalk7.red(`Invalid --fail-on-vulns value '${opts.failOnVulns}'. Use one of: low, moderate, high, critical.`));
+    process.exit(1);
+  }
+  const dsn = resolveDsn(opts.dsn);
+  if (!dsn) {
+    const cli = resolveCliInvocation();
+    console.error(chalk7.red("vg fix needs a Vibgrate login."));
+    console.error(
+      chalk7.dim(
+        `Run "${cli} login" (or set VIBGRATE_DSN / pass --dsn) to analyse upgrades with the hosted planner. See https://vibgrate.com/cli for details.`
+      )
+    );
+    process.exit(1);
+  }
+  const parsed = parseDsn(dsn);
+  if (!parsed) {
+    console.error(chalk7.red('Invalid DSN format. Re-run "vg login" or check VIBGRATE_DSN.'));
+    process.exit(1);
+  }
+  let host;
+  try {
+    host = opts.region ? resolveIngestHost(opts.region) : parsed.host;
+  } catch (e) {
+    console.error(chalk7.red(e instanceof Error ? e.message : String(e)));
+    process.exit(1);
+  }
+  let artifact;
+  try {
+    artifact = await loadArtifact(rootDir, opts.in);
+  } catch (e) {
+    console.error(chalk7.red(e instanceof Error ? e.message : String(e)));
+    process.exit(1);
+  }
+  const raw = collectCandidates(artifact);
+  const usage = analyzeTree(
+    rootDir,
+    raw.filter((c2) => c2.source !== "unknown").map((c2) => ({ name: c2.package, ecosystem: c2.source }))
+  );
+  const candidates = raw.map((c2) => {
+    const u = usage.get(c2.package);
+    return {
+      package: c2.package,
+      ecosystem: c2.ecosystem,
+      currentVersion: c2.from,
+      latestVersion: c2.to,
+      majorsBehind: c2.majorsBehind,
+      section: c2.section,
+      ...u && (u.importSites > 0 || u.filesTouched > 0) ? { usage: { importSites: u.importSites, filesTouched: u.filesTouched } } : {},
+      ...u && u.contracts.length ? { contracts: u.contracts } : {}
+    };
+  });
+  const request = {
+    cliVersion: VERSION,
+    repository: await repositoryIdentity(rootDir, opts.repositoryName),
+    candidates
+  };
+  let response;
+  try {
+    const { response: httpResponse } = await requestFixPlan({
+      scheme: parsed.scheme,
+      host,
+      keyId: parsed.keyId,
+      secret: parsed.secret,
+      request,
+      timestamp: String(Date.now())
+    });
+    if (!httpResponse.ok) {
+      handleHttpError(httpResponse, parsed.workspaceId, host);
+      return;
+    }
+    response = await parseFixPlanResponse(httpResponse);
+  } catch (e) {
+    const msg = e instanceof Error ? e.message : String(e);
+    console.error(chalk7.red(`Could not reach the upgrade planner: ${msg}`));
+    console.error(chalk7.dim("Check your connection and try again, or see https://vibgrate.com/help."));
+    process.exit(1);
+  }
+  if (response.status === "error") {
+    console.error(chalk7.red(response.error ?? "The planner returned an error."));
+    if (response.requestId) console.error(chalk7.dim(`  (ref ${response.requestId})`));
+    process.exit(1);
+  }
+  const currentDrift = artifact.drift?.score;
+  if (typeof currentDrift === "number") {
+    response.currentDriftScore = currentDrift;
+    for (const plan of response.plans) {
+      const upgraded = new Set(plan.upgrades.map((u) => u.package));
+      const expected = estimateDriftScore(artifact, upgraded);
+      plan.expectedDriftScore = expected;
+      plan.driftDelta = expected - currentDrift;
+    }
+  }
+  emit(response, opts.format);
+  if (opts.format === "text" && opts.apply !== false) {
+    await runApplyFlow(rootDir, artifact, response, opts);
+  }
+  if (failOn) {
+    const recommended = response.plans.find((p) => p.tier === response.recommended);
+    const threshold = SEVERITY_RANK[failOn];
+    let stillOpen = 0;
+    for (const sev of Object.keys(SEVERITY_RANK)) {
+      if (SEVERITY_RANK[sev] < threshold) continue;
+      const open = response.unresolved.bySeverity[sev] ?? 0;
+      const notFixedByRecommended = (response.plans.find((p) => p.tier === "aggressive")?.fixes.bySeverity[sev] ?? 0) - (recommended?.fixes.bySeverity[sev] ?? 0);
+      stillOpen += open + Math.max(0, notFixedByRecommended);
+    }
+    if (stillOpen > 0) {
+      console.error(
+        chalk7.red(`
+Failing: the recommended plan leaves ${stillOpen} advisory(ies) at/above ${failOn} unresolved.`)
+      );
+      process.exit(2);
+    }
+  }
+});
+function handleHttpError(response, workspaceId, host) {
+  const upgradeUrl = `https://${dashHostForIngestHost(host)}/${workspaceId}`;
+  if (response.status === 401 || response.status === 403) {
+    console.error(chalk7.red("Not authorised. Your DSN may be invalid or lack access to this workspace."));
+    console.error(chalk7.dim('Re-run "vg login" or check VIBGRATE_DSN.'));
+    process.exit(1);
+  }
+  if (response.status === 402) {
+    console.error(chalk7.red("vg fix is a paid capability that is not enabled on your current plan."));
+    console.error(chalk7.dim(`Upgrade to enable the hosted upgrade planner: ${upgradeUrl}`));
+    process.exit(1);
+  }
+  if (response.status === 429) {
+    console.error(chalk7.red("Rate limited by the planner. Wait a moment and try again."));
+    process.exit(1);
+  }
+  console.error(chalk7.red(`The planner returned HTTP ${response.status}.`));
+  console.error(chalk7.dim("Try again shortly, or see https://vibgrate.com/help."));
+  process.exit(1);
+}
+function emit(report, format) {
+  switch (format) {
+    case "json":
+      console.log(JSON.stringify(report, null, 2));
+      break;
+    case "md":
+      console.log(renderMarkdown(report));
+      break;
+    case "text":
+    default:
+      console.log(renderText(report));
+      break;
+  }
+}
+function npmPackageManager(artifact) {
+  for (const p of artifact.projects ?? []) {
+    if ((p.type === "node" || p.type === "typescript") && p.packageManager) {
+      const pm = p.packageManager;
+      if (pm === "pnpm" || pm === "yarn" || pm === "bun" || pm === "npm") return pm;
+    }
+  }
+  return "npm";
+}
+function promptPlanSelection(response) {
+  const plans = response.plans.filter((p) => p.upgrades.length > 0);
+  console.log(chalk7.bold("\nSelect a plan to apply:"));
+  plans.forEach((p, i) => {
+    const rec = p.tier === response.recommended ? chalk7.green(" (recommended)") : "";
+    const drift = typeof p.expectedDriftScore === "number" && typeof response.currentDriftScore === "number" ? ` \xB7 DriftScore ${response.currentDriftScore}\u2192${p.expectedDriftScore}` : "";
+    console.log(`  ${i + 1}) ${chalk7.bold(p.label)}${rec}  risk ${p.riskScore}/100 \xB7 ${p.upgrades.length} upgrade(s)${drift}`);
+  });
+  const defaultIdx = plans.findIndex((p) => p.tier === response.recommended);
+  const def = defaultIdx >= 0 ? defaultIdx + 1 : 1;
+  const rl = readline.createInterface({ input: process.stdin, output: process.stdout });
+  return new Promise((resolve16) => {
+    rl.question(`Plan [1-${plans.length}, default ${def}, q to cancel]: `, (ans) => {
+      rl.close();
+      const t = ans.trim().toLowerCase();
+      if (t === "q" || t === "quit") return resolve16(null);
+      const n = t === "" ? def : Number.parseInt(t, 10);
+      if (!Number.isInteger(n) || n < 1 || n > plans.length) return resolve16(null);
+      resolve16(plans[n - 1].tier);
+    });
+  });
+}
+async function runApplyFlow(rootDir, artifact, response, opts) {
+  const nonEmpty = response.plans.filter((p) => p.upgrades.length > 0);
+  if (nonEmpty.length === 0) {
+    console.log(chalk7.green("\n\u2714 Nothing to upgrade \u2014 every tracked dependency is current."));
+    return;
+  }
+  let chosen;
+  if (opts.plan) {
+    chosen = response.plans.find((p) => p.tier === opts.plan);
+    if (!chosen) {
+      console.error(chalk7.red(`Unknown plan '${opts.plan}'. Use safe, balanced, or aggressive.`));
+      process.exit(1);
+    }
+  } else if (nonEmpty.length === 1) {
+    chosen = nonEmpty[0];
+  } else if (opts.yes) {
+    chosen = response.plans.find((p) => p.tier === response.recommended) ?? nonEmpty[0];
+  } else if (process.stdin.isTTY && process.stdout.isTTY) {
+    const tier = await promptPlanSelection(response);
+    if (!tier) {
+      console.log(chalk7.dim("No plan applied."));
+      return;
+    }
+    chosen = response.plans.find((p) => p.tier === tier);
+  } else {
+    console.log(chalk7.dim("\nMultiple plans available \u2014 re-run with --plan <tier> or --yes to apply, or --dry-run to preview."));
+    return;
+  }
+  if (!chosen || chosen.upgrades.length === 0) {
+    console.log(chalk7.dim("Selected plan has no upgrades."));
+    return;
+  }
+  const pm = npmPackageManager(artifact);
+  const results = applyPlan(rootDir, chosen.upgrades, { dryRun: opts.dryRun, packageManager: pm });
+  if (opts.dryRun) {
+    console.log(chalk7.bold(`
+Dry run \u2014 ${chosen.label} plan (${chosen.upgrades.length} upgrade(s)):`));
+    for (const r of results) {
+      if (r.status === "manual") console.log(chalk7.yellow(`  \u26A0 ${r.package}: ${r.detail}`));
+      else console.log(chalk7.dim(`  ${r.package}: ${r.detail}`));
+    }
+    if (typeof chosen.expectedDriftScore === "number") {
+      console.log(chalk7.dim(`Expected DriftScore after apply: ~${chosen.expectedDriftScore} (was ${response.currentDriftScore ?? "?"}).`));
+    }
+    return;
+  }
+  const applied = results.filter((r) => r.status === "applied");
+  const failed = results.filter((r) => r.status === "failed");
+  const manual = results.filter((r) => r.status === "manual");
+  console.log(chalk7.bold(`
+Applied the ${chosen.label} plan:`));
+  console.log(
+    chalk7.green(`  \u2714 ${applied.length} upgraded`) + (failed.length ? chalk7.red(`   \u2716 ${failed.length} failed`) : "") + (manual.length ? chalk7.yellow(`   \u26A0 ${manual.length} need manual work`) : "")
+  );
+  for (const r of failed) console.log(chalk7.red(`    \u2716 ${r.package} \u2192 ${r.to}: ${r.detail ?? "failed"}`));
+  for (const r of manual) console.log(chalk7.yellow(`    \u26A0 ${r.package} \u2192 ${r.to}: ${r.detail}`));
+  if (typeof chosen.expectedDriftScore === "number" && typeof response.currentDriftScore === "number") {
+    const delta = chosen.expectedDriftScore - response.currentDriftScore;
+    console.log(
+      `  Expected DriftScore: ${response.currentDriftScore} \u2192 ~${chosen.expectedDriftScore} (${delta <= 0 ? "" : "+"}${delta}). Re-run \`vg\` to confirm the actual score.`
+    );
+  }
+  if (failed.length) process.exitCode = 2;
+}
 function formatText(artifact) {
   const lines = [];
-  const teal2 = chalk5.hex("#3FB0A4");
-  const mint2 = chalk5.hex("#4FE3C1");
+  const teal2 = chalk7.hex("#3FB0A4");
+  const mint2 = chalk7.hex("#4FE3C1");
   lines.push("");
   lines.push("   " + teal2("\u256D\u2500\u2500\u2500\u2500\u2500\u2500\u256E") + mint2("\u279C"));
-  lines.push("  " + chalk5.dim("\u2524") + teal2("\u2502") + " " + mint2("\u25FC") + "  " + mint2("\u25FC") + " " + teal2("\u2502") + chalk5.dim("\u251C") + "  " + chalk5.bold.white("vibgrate"));
-  lines.push("  " + chalk5.dim("\u2524") + teal2("\u2502") + "  " + chalk5.dim("\u2581\u2581") + "  " + teal2("\u2502") + chalk5.dim("\u251C") + "  " + chalk5.dim(`Drift Intelligence Engine v${VERSION}`));
+  lines.push("  " + chalk7.dim("\u2524") + teal2("\u2502") + " " + mint2("\u25FC") + "  " + mint2("\u25FC") + " " + teal2("\u2502") + chalk7.dim("\u251C") + "  " + chalk7.bold.white("vibgrate"));
+  lines.push("  " + chalk7.dim("\u2524") + teal2("\u2502") + "  " + chalk7.dim("\u2581\u2581") + "  " + teal2("\u2502") + chalk7.dim("\u251C") + "  " + chalk7.dim(`Drift Intelligence Engine v${VERSION}`));
   lines.push("   " + teal2("\u2570\u2500\u2500\u2500\u2500\u2500\u2500\u256F"));
   lines.push("");
   lines.push(...titleBox("Vibgrate Drift Report", teal2));
   lines.push("");
   for (const project of artifact.projects) {
-    lines.push(chalk5.bold(`  \u2500\u2500 ${project.name} `) + chalk5.dim(`(${project.type}) ${project.path}`));
+    lines.push(chalk7.bold(`  \u2500\u2500 ${project.name} `) + chalk7.dim(`(${project.type}) ${project.path}`));
     if (project.runtime) {
-      const behindStr = project.runtimeMajorsBehind !== void 0 && project.runtimeMajorsBehind > 0 ? chalk5.yellow(` (${project.runtimeMajorsBehind} major${project.runtimeMajorsBehind > 1 ? "s" : ""} behind)`) : chalk5.green(" (current)");
+      const behindStr = project.runtimeMajorsBehind !== void 0 && project.runtimeMajorsBehind > 0 ? chalk7.yellow(` (${project.runtimeMajorsBehind} major${project.runtimeMajorsBehind > 1 ? "s" : ""} behind)`) : chalk7.green(" (current)");
       lines.push(`     Runtime: ${project.runtime}${behindStr}`);
     }
     if (project.targetFramework) {
@@ -2328,7 +3576,7 @@ function formatText(artifact) {
     if (project.frameworks.length > 0) {
       lines.push("     Frameworks:");
       for (const fw of project.frameworks) {
-        const lag = fw.majorsBehind !== null ? fw.majorsBehind === 0 ? chalk5.green("current") : chalk5.yellow(`${fw.majorsBehind} behind`) : chalk5.dim("unknown");
+        const lag = fw.majorsBehind !== null ? fw.majorsBehind === 0 ? chalk7.green("current") : chalk7.yellow(`${fw.majorsBehind} behind`) : chalk7.dim("unknown");
         lines.push(`       ${fw.name}: ${fw.currentVersion ?? "?"} \u2192 ${fw.latestVersion ?? "?"} (${lag})`);
       }
     }
@@ -2336,13 +3584,13 @@ function formatText(artifact) {
     const total = b.current + b.oneBehind + b.twoPlusBehind + b.unknown;
     if (total > 0) {
       lines.push("     Dependencies:");
-      lines.push(`       ${chalk5.green(`${b.current} current`)}  ${chalk5.yellow(`${b.oneBehind} 1-behind`)}  ${chalk5.red(`${b.twoPlusBehind} 2+ behind`)}  ${chalk5.dim(`${b.unknown} unknown`)}`);
+      lines.push(`       ${chalk7.green(`${b.current} current`)}  ${chalk7.yellow(`${b.oneBehind} 1-behind`)}  ${chalk7.red(`${b.twoPlusBehind} 2+ behind`)}  ${chalk7.dim(`${b.unknown} unknown`)}`);
     }
     lines.push("");
   }
   if (artifact.delta !== void 0) {
-    const deltaStr = artifact.delta > 0 ? chalk5.red(`+${artifact.delta}`) : artifact.delta < 0 ? chalk5.green(`${artifact.delta}`) : chalk5.dim("0");
-    lines.push(chalk5.bold("  Drift Delta: ") + deltaStr + " (vs baseline)");
+    const deltaStr = artifact.delta > 0 ? chalk7.red(`+${artifact.delta}`) : artifact.delta < 0 ? chalk7.green(`${artifact.delta}`) : chalk7.dim("0");
+    lines.push(chalk7.bold("  Drift Delta: ") + deltaStr + " (vs baseline)");
     lines.push("");
   }
   if (artifact.extended) {
@@ -2353,15 +3601,15 @@ function formatText(artifact) {
     const warnings = artifact.findings.filter((f) => f.level === "warning");
     const notes = artifact.findings.filter((f) => f.level === "note");
     const summary = [
-      errors.length > 0 ? chalk5.red(`${errors.length} error${errors.length !== 1 ? "s" : ""}`) : "",
-      warnings.length > 0 ? chalk5.yellow(`${warnings.length} warning${warnings.length !== 1 ? "s" : ""}`) : "",
-      notes.length > 0 ? chalk5.blue(`${notes.length} note${notes.length !== 1 ? "s" : ""}`) : ""
-    ].filter(Boolean).join(chalk5.dim(", "));
-    lines.push(chalk5.bold.underline(`  Findings`) + chalk5.dim(` (${summary})`));
+      errors.length > 0 ? chalk7.red(`${errors.length} error${errors.length !== 1 ? "s" : ""}`) : "",
+      warnings.length > 0 ? chalk7.yellow(`${warnings.length} warning${warnings.length !== 1 ? "s" : ""}`) : "",
+      notes.length > 0 ? chalk7.blue(`${notes.length} note${notes.length !== 1 ? "s" : ""}`) : ""
+    ].filter(Boolean).join(chalk7.dim(", "));
+    lines.push(chalk7.bold.underline(`  Findings`) + chalk7.dim(` (${summary})`));
     for (const f of artifact.findings) {
-      const icon = f.level === "error" ? chalk5.red("\u2716") : f.level === "warning" ? chalk5.yellow("\u26A0") : chalk5.blue("\u2139");
+      const icon = f.level === "error" ? chalk7.red("\u2716") : f.level === "warning" ? chalk7.yellow("\u26A0") : chalk7.blue("\u2139");
       lines.push(`    ${icon} ${f.message}`);
-      lines.push(chalk5.dim(`      ${f.ruleId} in ${f.location}`));
+      lines.push(chalk7.dim(`      ${f.ruleId} in ${f.location}`));
     }
     lines.push("");
   }
@@ -2371,10 +3619,10 @@ function formatText(artifact) {
     lines.push("");
     for (let i = 0; i < actions.length; i++) {
       const a = actions[i];
-      const num = chalk5.bold.cyan(`  ${i + 1}.`);
-      lines.push(`${num} ${chalk5.bold(a.title)}`);
-      lines.push(chalk5.dim(`     ${a.explanation}`));
-      if (a.impact) lines.push(`     Impact: ${chalk5.green(a.impact)}`);
+      const num = chalk7.bold.cyan(`  ${i + 1}.`);
+      lines.push(`${num} ${chalk7.bold(a.title)}`);
+      lines.push(chalk7.dim(`     ${a.explanation}`));
+      if (a.impact) lines.push(`     Impact: ${chalk7.green(a.impact)}`);
       lines.push("");
     }
   }
@@ -2386,30 +3634,30 @@ function formatText(artifact) {
     lines.push("");
     for (const solution of artifact.solutions) {
       const solScore = solution.drift?.score;
-      const color = typeof solScore === "number" ? solScore <= 30 ? chalk5.green : solScore <= 60 ? chalk5.yellow : chalk5.red : chalk5.dim;
-      lines.push(`  \u2022 ${solution.name} (${solution.projectPaths.length} projects) \u2014 ${typeof solScore === "number" ? color(`${solScore}/100`) : chalk5.dim("n/a")}`);
+      const color = typeof solScore === "number" ? solScore <= 30 ? chalk7.green : solScore <= 60 ? chalk7.yellow : chalk7.red : chalk7.dim;
+      lines.push(`  \u2022 ${solution.name} (${solution.projectPaths.length} projects) \u2014 ${typeof solScore === "number" ? color(`${solScore}/100`) : chalk7.dim("n/a")}`);
     }
     lines.push("");
   }
-  const scoreColor = artifact.drift.score <= 30 ? chalk5.green : artifact.drift.score <= 60 ? chalk5.yellow : chalk5.red;
-  lines.push(...titleBox("Drift Score Summary"));
+  const scoreColor = artifact.drift.score <= 30 ? chalk7.green : artifact.drift.score <= 60 ? chalk7.yellow : chalk7.red;
+  lines.push(...titleBox("DriftScore Summary"));
   lines.push("");
-  lines.push(chalk5.bold("  Drift Score:  ") + scoreColor.bold(`${artifact.drift.score}/100`));
-  lines.push(chalk5.bold("  Risk Level:   ") + riskBadge(artifact.drift.riskLevel));
-  lines.push(chalk5.bold("  Projects:     ") + `${artifact.projects.length}`);
+  lines.push(chalk7.bold("  DriftScore:   ") + scoreColor.bold(`${artifact.drift.score}/100`));
+  lines.push(chalk7.bold("  Risk Level:   ") + riskBadge(artifact.drift.riskLevel));
+  lines.push(chalk7.bold("  Projects:     ") + `${artifact.projects.length}`);
   if (artifact.vcs) {
     const vcsParts = [artifact.vcs.type];
     if (artifact.vcs.branch) vcsParts.push(artifact.vcs.branch);
-    if (artifact.vcs.shortSha) vcsParts.push(chalk5.dim(artifact.vcs.shortSha));
-    lines.push(chalk5.bold("  VCS:          ") + vcsParts.join(" "));
+    if (artifact.vcs.shortSha) vcsParts.push(chalk7.dim(artifact.vcs.shortSha));
+    lines.push(chalk7.bold("  VCS:          ") + vcsParts.join(" "));
   }
   lines.push("");
   const m = new Set(artifact.drift.measured ?? ["runtime", "framework", "dependency", "eol"]);
-  lines.push("  " + chalk5.bold.underline("Score Breakdown"));
-  lines.push(`    Runtime:      ${m.has("runtime") ? scoreBar(artifact.drift.components.runtimeScore) : chalk5.dim("n/a")}`);
-  lines.push(`    Frameworks:   ${m.has("framework") ? scoreBar(artifact.drift.components.frameworkScore) : chalk5.dim("n/a")}`);
-  lines.push(`    Dependencies: ${m.has("dependency") ? scoreBar(artifact.drift.components.dependencyScore) : chalk5.dim("n/a")}`);
-  lines.push(`    EOL Risk:     ${m.has("eol") ? scoreBar(artifact.drift.components.eolScore) : chalk5.dim("n/a")}`);
+  lines.push("  " + chalk7.bold.underline("Score Breakdown"));
+  lines.push(`    Runtime:      ${m.has("runtime") ? scoreBar(artifact.drift.components.runtimeScore) : chalk7.dim("n/a")}`);
+  lines.push(`    Frameworks:   ${m.has("framework") ? scoreBar(artifact.drift.components.frameworkScore) : chalk7.dim("n/a")}`);
+  lines.push(`    Dependencies: ${m.has("dependency") ? scoreBar(artifact.drift.components.dependencyScore) : chalk7.dim("n/a")}`);
+  lines.push(`    EOL Risk:     ${m.has("eol") ? scoreBar(artifact.drift.components.eolScore) : chalk7.dim("n/a")}`);
   lines.push("");
   const scannedParts = [`Scanned at ${artifact.timestamp}`];
   if (artifact.durationMs !== void 0) {
@@ -2423,18 +3671,18 @@ function formatText(artifact) {
     scannedParts.push(`${artifact.treeSummary.totalFiles.toLocaleString()} workspace files`);
     scannedParts.push(`${artifact.treeSummary.totalDirs.toLocaleString()} dirs`);
   }
-  lines.push(chalk5.dim(`  ${scannedParts.join(" \xB7 ")}`));
+  lines.push(chalk7.dim(`  ${scannedParts.join(" \xB7 ")}`));
   lines.push("");
   return lines.join("\n");
 }
 function riskBadge(level) {
   switch (level) {
     case "low":
-      return chalk5.bgGreen.black(" LOW ");
+      return chalk7.bgGreen.black(" LOW ");
     case "moderate":
-      return chalk5.bgYellow.black(" MODERATE ");
+      return chalk7.bgYellow.black(" MODERATE ");
     case "high":
-      return chalk5.bgRed.white(" HIGH ");
+      return chalk7.bgRed.white(" HIGH ");
     default:
       return level;
   }
@@ -2469,11 +3717,11 @@ function formatExtended(ext) {
     const inv = ext.toolingInventory;
     const categories = Object.entries(inv).filter(([, items]) => items.length > 0);
     if (categories.length > 0) {
-      lines.push(chalk5.bold.underline("  Tech Stack"));
+      lines.push(chalk7.bold.underline("  Tech Stack"));
       for (const [cat, items] of categories) {
         const label = CATEGORY_LABELS[cat] ?? cat;
-        const names = items.map((i) => chalk5.white(i.name)).join(chalk5.dim(", "));
-        lines.push(`    ${chalk5.cyan(label)}: ${names}`);
+        const names = items.map((i) => chalk7.white(i.name)).join(chalk7.dim(", "));
+        lines.push(`    ${chalk7.cyan(label)}: ${names}`);
       }
       lines.push("");
     }
@@ -2482,14 +3730,14 @@ function formatExtended(ext) {
     const svc = ext.serviceDependencies;
     const categories = Object.entries(svc).filter(([, items]) => items.length > 0);
     if (categories.length > 0) {
-      lines.push(chalk5.bold.underline("  Services & Integrations"));
+      lines.push(chalk7.bold.underline("  Services & Integrations"));
       for (const [cat, items] of categories) {
         const label = CATEGORY_LABELS[cat] ?? cat;
         const names = items.map((i) => {
-          const ver = i.version ? chalk5.dim(` ${i.version}`) : "";
-          return chalk5.white(i.name) + ver;
-        }).join(chalk5.dim(", "));
-        lines.push(`    ${chalk5.cyan(label)}: ${names}`);
+          const ver = i.version ? chalk7.dim(` ${i.version}`) : "";
+          return chalk7.white(i.name) + ver;
+        }).join(chalk7.dim(", "));
+        lines.push(`    ${chalk7.cyan(label)}: ${names}`);
       }
       lines.push("");
     }
@@ -2497,19 +3745,19 @@ function formatExtended(ext) {
   if (ext.breakingChangeExposure) {
     const bc = ext.breakingChangeExposure;
     if (bc.deprecatedPackages.length > 0 || bc.legacyPolyfills.length > 0) {
-      lines.push(chalk5.bold.underline("  Breaking Change Exposure"));
-      const exposureColor = bc.exposureScore >= 40 ? chalk5.red : bc.exposureScore >= 20 ? chalk5.yellow : chalk5.green;
+      lines.push(chalk7.bold.underline("  Breaking Change Exposure"));
+      const exposureColor = bc.exposureScore >= 40 ? chalk7.red : bc.exposureScore >= 20 ? chalk7.yellow : chalk7.green;
       lines.push(`    Exposure Score: ${exposureColor.bold(`${bc.exposureScore}/100`)}`);
       if (bc.deprecatedPackages.length > 0) {
-        lines.push(`    ${chalk5.red("Deprecated")}: ${bc.deprecatedPackages.map((p) => chalk5.dim(p)).join(", ")}`);
+        lines.push(`    ${chalk7.red("Deprecated")}: ${bc.deprecatedPackages.map((p) => chalk7.dim(p)).join(", ")}`);
       }
       if (bc.legacyPolyfills.length > 0) {
-        lines.push(`    ${chalk5.yellow("Polyfills")}: ${bc.legacyPolyfills.map((p) => chalk5.dim(p)).join(", ")}`);
+        lines.push(`    ${chalk7.yellow("Polyfills")}: ${bc.legacyPolyfills.map((p) => chalk7.dim(p)).join(", ")}`);
       }
       if (bc.peerConflictsDetected) {
-        lines.push(`    ${chalk5.red("\u26A0")} Peer dependency conflicts detected`);
+        lines.push(`    ${chalk7.red("\u26A0")} Peer dependency conflicts detected`);
       }
-      lines.push(`    Recommendation: ${chalk5.bold(bc.overallRecommendation)}`);
+      lines.push(`    Recommendation: ${chalk7.bold(bc.overallRecommendation)}`);
       const projectsWithPlans = bc.projectIntelligence.filter((p) => p.packages.length > 0).slice(0, 3);
       if (projectsWithPlans.length > 0) {
         lines.push("    Major Upgrade Intelligence:");
@@ -2525,21 +3773,21 @@ function formatExtended(ext) {
   }
   if (ext.tsModernity && ext.tsModernity.typescriptVersion) {
     const ts = ext.tsModernity;
-    lines.push(chalk5.bold.underline("  TypeScript"));
+    lines.push(chalk7.bold.underline("  TypeScript"));
     const parts = [];
     parts.push(`v${ts.typescriptVersion}`);
-    if (ts.strict === true) parts.push(chalk5.green("strict \u2714"));
-    else if (ts.strict === false) parts.push(chalk5.yellow("strict \u2716"));
+    if (ts.strict === true) parts.push(chalk7.green("strict \u2714"));
+    else if (ts.strict === false) parts.push(chalk7.yellow("strict \u2716"));
     if (ts.moduleType) parts.push(ts.moduleType.toUpperCase());
     if (ts.target) parts.push(`target: ${ts.target}`);
-    lines.push(`    ${parts.join(chalk5.dim(" \xB7 "))}`);
+    lines.push(`    ${parts.join(chalk7.dim(" \xB7 "))}`);
     lines.push("");
   }
   if (ext.buildDeploy) {
     const bd = ext.buildDeploy;
     const hasSomething = bd.ci.length > 0 || bd.docker.dockerfileCount > 0 || bd.packageManagers.length > 0;
     if (hasSomething) {
-      lines.push(chalk5.bold.underline("  Build & Deploy"));
+      lines.push(chalk7.bold.underline("  Build & Deploy"));
       if (bd.ci.length > 0) lines.push(`    CI: ${bd.ci.join(", ")}`);
       if (bd.docker.dockerfileCount > 0) {
         lines.push(`    Docker: ${bd.docker.dockerfileCount} Dockerfile${bd.docker.dockerfileCount !== 1 ? "s" : ""} (${bd.docker.baseImages.join(", ")})`);
@@ -2552,42 +3800,42 @@ function formatExtended(ext) {
   }
   if (ext.uiPurpose) {
     const up = ext.uiPurpose;
-    lines.push(chalk5.bold.underline("  Product Purpose Signals"));
-    lines.push(`    Frameworks: ${up.detectedFrameworks.length > 0 ? up.detectedFrameworks.join(", ") : chalk5.dim("unknown")}`);
-    lines.push(`    Evidence: ${up.topEvidence.length}${up.capped ? chalk5.dim(` of ${up.evidenceCount} (capped)`) : ""}`);
+    lines.push(chalk7.bold.underline("  Product Purpose Signals"));
+    lines.push(`    Frameworks: ${up.detectedFrameworks.length > 0 ? up.detectedFrameworks.join(", ") : chalk7.dim("unknown")}`);
+    lines.push(`    Evidence: ${up.topEvidence.length}${up.capped ? chalk7.dim(` of ${up.evidenceCount} (capped)`) : ""}`);
     const top = up.topEvidence.slice(0, 8);
     if (top.length > 0) {
       lines.push("    Top Signals:");
       for (const item of top) {
-        lines.push(`      - [${item.kind}] ${item.value} ${chalk5.dim(`(${item.file})`)}`);
+        lines.push(`      - [${item.kind}] ${item.value} ${chalk7.dim(`(${item.file})`)}`);
       }
     }
     if (up.unknownSignals.length > 0) {
       lines.push("    Unknowns:");
       for (const u of up.unknownSignals.slice(0, 4)) {
-        lines.push(`      - ${chalk5.yellow(u)}`);
+        lines.push(`      - ${chalk7.yellow(u)}`);
       }
     }
     lines.push("");
   }
   if (ext.securityPosture) {
     const sec = ext.securityPosture;
-    lines.push(chalk5.bold.underline("  Security Posture"));
+    lines.push(chalk7.bold.underline("  Security Posture"));
     const checks = [];
-    checks.push(sec.lockfilePresent ? chalk5.green("Lockfile \u2714") : chalk5.red("Lockfile \u2716"));
-    checks.push(sec.gitignoreCoversEnv ? chalk5.green(".env \u2714") : chalk5.red(".env \u2716"));
-    checks.push(sec.gitignoreCoversNodeModules ? chalk5.green("node_modules \u2714") : chalk5.yellow("node_modules \u2716"));
-    if (sec.multipleLockfileTypes) checks.push(chalk5.yellow("Multiple lockfiles \u26A0"));
-    if (sec.envFilesTracked) checks.push(chalk5.red("Env files tracked \u2716"));
-    lines.push(`    ${checks.join(chalk5.dim(" \xB7 "))}`);
+    checks.push(sec.lockfilePresent ? chalk7.green("Lockfile \u2714") : chalk7.red("Lockfile \u2716"));
+    checks.push(sec.gitignoreCoversEnv ? chalk7.green(".env \u2714") : chalk7.red(".env \u2716"));
+    checks.push(sec.gitignoreCoversNodeModules ? chalk7.green("node_modules \u2714") : chalk7.yellow("node_modules \u2716"));
+    if (sec.multipleLockfileTypes) checks.push(chalk7.yellow("Multiple lockfiles \u26A0"));
+    if (sec.envFilesTracked) checks.push(chalk7.red("Env files tracked \u2716"));
+    lines.push(`    ${checks.join(chalk7.dim(" \xB7 "))}`);
     lines.push("");
   }
   if (ext.platformMatrix) {
     const pm = ext.platformMatrix;
     if (pm.nativeModules.length > 0 || pm.dockerBaseImages.length > 0) {
-      lines.push(chalk5.bold.underline("  Platform"));
+      lines.push(chalk7.bold.underline("  Platform"));
       if (pm.nativeModules.length > 0) {
-        lines.push(`    Native modules: ${pm.nativeModules.map((m) => chalk5.dim(m)).join(", ")}`);
+        lines.push(`    Native modules: ${pm.nativeModules.map((m) => chalk7.dim(m)).join(", ")}`);
       }
       if (pm.osAssumptions.length > 0) {
         lines.push(`    OS assumptions: ${pm.osAssumptions.join(", ")}`);
@@ -2597,25 +3845,25 @@ function formatExtended(ext) {
   }
   if (ext.codeQuality) {
     const cq = ext.codeQuality;
-    lines.push(chalk5.bold.underline("  Code Quality"));
-    lines.push(`    Files: ${chalk5.white(`${cq.filesAnalyzed}`)} \xB7 Functions: ${chalk5.white(`${cq.functionsAnalyzed}`)} \xB7 Avg complexity: ${chalk5.white(`${cq.avgCyclomaticComplexity}`)} \xB7 Avg length: ${chalk5.white(`${cq.avgFunctionLength}`)} lines`);
+    lines.push(chalk7.bold.underline("  Code Quality"));
+    lines.push(`    Files: ${chalk7.white(`${cq.filesAnalyzed}`)} \xB7 Functions: ${chalk7.white(`${cq.functionsAnalyzed}`)} \xB7 Avg complexity: ${chalk7.white(`${cq.avgCyclomaticComplexity}`)} \xB7 Avg length: ${chalk7.white(`${cq.avgFunctionLength}`)} lines`);
     lines.push(`    Max nesting: ${cq.maxNestingDepth} \xB7 Circular deps: ${cq.circularDependencies} \xB7 Dead code: ${cq.deadCodePercent}%`);
     if (cq.godFiles.length > 0) {
       const preview = cq.godFiles.slice(0, 3).map((f) => `${f.path} (${f.lines} lines)`).join(", ");
-      lines.push(`    ${chalk5.yellow("God files")}: ${preview}`);
+      lines.push(`    ${chalk7.yellow("God files")}: ${preview}`);
     }
     lines.push("");
   }
   if (ext.dependencyGraph) {
     const dg = ext.dependencyGraph;
     if (dg.lockfileType) {
-      lines.push(chalk5.bold.underline("  Dependency Graph"));
-      lines.push(`    ${dg.lockfileType}: ${chalk5.white(`${dg.totalUnique}`)} unique, ${chalk5.white(`${dg.totalInstalled}`)} installed`);
+      lines.push(chalk7.bold.underline("  Dependency Graph"));
+      lines.push(`    ${dg.lockfileType}: ${chalk7.white(`${dg.totalUnique}`)} unique, ${chalk7.white(`${dg.totalInstalled}`)} installed`);
       if (dg.duplicatedPackages.length > 0) {
-        lines.push(`    ${chalk5.yellow(`${dg.duplicatedPackages.length} duplicated`)} packages`);
+        lines.push(`    ${chalk7.yellow(`${dg.duplicatedPackages.length} duplicated`)} packages`);
       }
       if (dg.phantomDependencies.length > 0) {
-        lines.push(`    ${chalk5.red(`${dg.phantomDependencies.length} phantom`)} dependencies`);
+        lines.push(`    ${chalk7.red(`${dg.phantomDependencies.length} phantom`)} dependencies`);
       }
       lines.push("");
     }
@@ -2626,13 +3874,13 @@ function formatArchitectureDiagram(arch) {
   const lines = [];
   lines.push(...titleBox("Architecture Layers"));
   lines.push("");
-  lines.push(chalk5.bold("  Archetype: ") + `${arch.archetype}` + chalk5.dim(` (${Math.round(arch.archetypeConfidence * 100)}% confidence)`));
-  lines.push(`  Files classified: ${arch.totalClassified}` + (arch.unclassified > 0 ? chalk5.dim(` (${arch.unclassified} unclassified)`) : ""));
+  lines.push(chalk7.bold("  Archetype: ") + `${arch.archetype}` + chalk7.dim(` (${Math.round(arch.archetypeConfidence * 100)}% confidence)`));
+  lines.push(`  Files classified: ${arch.totalClassified}` + (arch.unclassified > 0 ? chalk7.dim(` (${arch.unclassified} unclassified)`) : ""));
   lines.push("");
   if (arch.layers.length > 0) {
     for (const layer of arch.layers) {
-      const risk = layer.riskLevel === "none" ? chalk5.dim("none") : layer.riskLevel === "low" ? chalk5.green("low") : layer.riskLevel === "moderate" ? chalk5.yellow("moderate") : chalk5.red("high");
-      lines.push(`    ${chalk5.bold(layer.layer)}  ${layer.fileCount} file${layer.fileCount !== 1 ? "s" : ""}  drift ${scoreBar(layer.driftScore)}  risk ${risk}`);
+      const risk = layer.riskLevel === "none" ? chalk7.dim("none") : layer.riskLevel === "low" ? chalk7.green("low") : layer.riskLevel === "moderate" ? chalk7.yellow("moderate") : chalk7.red("high");
+      lines.push(`    ${chalk7.bold(layer.layer)}  ${layer.fileCount} file${layer.fileCount !== 1 ? "s" : ""}  drift ${scoreBar(layer.driftScore)}  risk ${risk}`);
     }
     lines.push("");
   }
@@ -2894,7 +4142,7 @@ function formatMarkdown(artifact) {
   lines.push("");
   lines.push(`| Metric | Value |`);
   lines.push(`|--------|-------|`);
-  lines.push(`| **Drift Score** | ${artifact.drift.score}/100 _(lower is better; 0 = no drift)_ |`);
+  lines.push(`| **DriftScore** | ${artifact.drift.score}/100 _(lower is better; 0 = no drift)_ |`);
   lines.push(`| **Risk Level** | ${artifact.drift.riskLevel.toUpperCase()} |`);
   lines.push(`| **Projects** | ${artifact.projects.length} |`);
   const scannedMeta = [artifact.timestamp];
@@ -3001,10 +4249,10 @@ function formatMarkdown(artifact) {
 
 // src/reporting/commands/report.ts
 var reportCommand = new Command("report").description("Generate a drift report from a scan artifact").option("--in <file>", "Input artifact file", ".vibgrate/scan_result.json").option("--format <format>", "Output format (md|text|json)", "text").action(async (opts) => {
-  const artifactPath = path9.resolve(opts.in);
+  const artifactPath = path.resolve(opts.in);
   if (!await pathExists(artifactPath)) {
-    console.error(chalk5.red(`Artifact not found: ${artifactPath}`));
-    console.error(chalk5.dim('Run "vibgrate scan" first to generate a scan artifact.'));
+    console.error(chalk7.red(`Artifact not found: ${artifactPath}`));
+    console.error(chalk7.dim('Run "vibgrate scan" first to generate a scan artifact.'));
     process.exit(1);
   }
   const artifact = await readJsonFile(artifactPath);
@@ -3047,10 +4295,10 @@ function openUrl(url) {
 }
 
 // src/reporting/commands/login.ts
-var delay = (ms) => new Promise((resolve15) => setTimeout(resolve15, ms));
+var delay = (ms) => new Promise((resolve16) => setTimeout(resolve16, ms));
 function isInside(dir, file) {
-  const rel2 = path9.relative(dir, file);
-  return !!rel2 && !rel2.startsWith("..") && !path9.isAbsolute(rel2);
+  const rel3 = path.relative(dir, file);
+  return !!rel3 && !rel3.startsWith("..") && !path.isAbsolute(rel3);
 }
 var loginCommand = new Command("login").description("Authenticate the CLI with your Vibgrate workspace via the browser").option("--ingest <url>", "Ingest API URL (overrides --region)").option("--region <region>", `Data residency region (${availableRegionIds().join(", ")})`, "us").option("--no-browser", "Do not attempt to open a browser automatically").option(
   "--local",
@@ -3060,7 +4308,7 @@ var loginCommand = new Command("login").description("Authenticate the CLI with y
   try {
     ingestHost = resolveIngestHost(opts.region, opts.ingest);
   } catch (e) {
-    console.error(chalk5.red(e instanceof Error ? e.message : String(e)));
+    console.error(chalk7.red(e instanceof Error ? e.message : String(e)));
     process.exit(1);
   }
   const base = `https://${ingestHost}/v1/auth/device`;
@@ -3072,28 +4320,28 @@ var loginCommand = new Command("login").description("Authenticate the CLI with y
       body: "{}"
     });
     if (!res.ok) {
-      console.error(chalk5.red(`Failed to start login (HTTP ${res.status}).`));
+      console.error(chalk7.red(`Failed to start login (HTTP ${res.status}).`));
       process.exit(1);
     }
     start = await res.json();
   } catch (e) {
-    console.error(chalk5.red(`Could not reach ${ingestHost}: ${e instanceof Error ? e.message : String(e)}`));
+    console.error(chalk7.red(`Could not reach ${ingestHost}: ${e instanceof Error ? e.message : String(e)}`));
     process.exit(1);
   }
   console.log("");
   console.log("To finish signing in, open this URL and approve the request:");
   console.log("");
-  console.log("  " + chalk5.cyan(start.verificationUri));
+  console.log("  " + chalk7.cyan(start.verificationUri));
   console.log("");
-  console.log("  Your code: " + chalk5.bold(start.userCode));
+  console.log("  Your code: " + chalk7.bold(start.userCode));
   console.log("");
   if (opts.browser) {
     const opened = openUrl(start.verificationUriComplete);
     if (opened) {
-      console.log(chalk5.dim("Opening your browser\u2026 (if it does not open, use the URL above)"));
+      console.log(chalk7.dim("Opening your browser\u2026 (if it does not open, use the URL above)"));
     }
   }
-  console.log(chalk5.dim("Waiting for approval\u2026"));
+  console.log(chalk7.dim("Waiting for approval\u2026"));
   const intervalMs = Math.max(2, start.interval || 5) * 1e3;
   const deadline = Date.now() + (start.expiresIn || 900) * 1e3;
   while (Date.now() < deadline) {
@@ -3121,7 +4369,7 @@ var loginCommand = new Command("login").description("Authenticate the CLI with y
           savedAt: (/* @__PURE__ */ new Date()).toISOString()
         };
       } else {
-        console.log(chalk5.dim("Setting up your workspace\u2026"));
+        console.log(chalk7.dim("Setting up your workspace\u2026"));
         try {
           const provisioned = await createWorkspaceDsn({
             region: opts.region,
@@ -3136,10 +4384,10 @@ var loginCommand = new Command("login").description("Authenticate the CLI with y
           };
         } catch (e) {
           console.error(
-            chalk5.red("\u2716 Signed in, but workspace setup failed: ") + (e instanceof Error ? e.message : String(e))
+            chalk7.red("\u2716 Signed in, but workspace setup failed: ") + (e instanceof Error ? e.message : String(e))
           );
           console.error(
-            chalk5.dim('  Finish setup with "vibgrate dsn create --workspace new".')
+            chalk7.dim('  Finish setup with "vibgrate dsn create --workspace new".')
           );
           process.exit(1);
         }
@@ -3148,40 +4396,40 @@ var loginCommand = new Command("login").description("Authenticate the CLI with y
       writeStoredCredentials(creds, storeOpts);
       const credsFile = credentialsPath(storeOpts);
       console.log("");
-      console.log(chalk5.green("\u2714") + " Logged in.");
+      console.log(chalk7.green("\u2714") + " Logged in.");
       if (creds.workspaceId) {
-        console.log("  Workspace: " + chalk5.bold(creds.workspaceId));
+        console.log("  Workspace: " + chalk7.bold(creds.workspaceId));
       }
-      console.log(chalk5.dim(`  Credentials saved to ${credsFile}`));
+      console.log(chalk7.dim(`  Credentials saved to ${credsFile}`));
       try {
         const root = findGitRoot();
         if (root && isInside(root, credsFile)) {
           const res = ensureGitignored(gitignoreEntryForCredentials(root, credsFile), root);
           if (res.status === "created") {
-            console.log(chalk5.dim(`  Created .gitignore and ignored ${res.entry}`));
+            console.log(chalk7.dim(`  Created .gitignore and ignored ${res.entry}`));
           } else if (res.status === "added") {
-            console.log(chalk5.dim(`  Added ${res.entry} to .gitignore`));
+            console.log(chalk7.dim(`  Added ${res.entry} to .gitignore`));
           }
         }
       } catch {
       }
-      console.log(chalk5.dim(`  You can now run "${resolveCliInvocation()} scan --push".`));
+      console.log(chalk7.dim(`  You can now run "${resolveCliInvocation()} scan --push".`));
       return;
     }
     if (token.status === "access_denied") {
-      console.error(chalk5.red("\u2716 Login was denied in the browser."));
+      console.error(chalk7.red("\u2716 Login was denied in the browser."));
       process.exit(1);
     }
     if (token.status === "expired" || token.status === "invalid") {
-      console.error(chalk5.red('\u2716 Login request expired. Run "vibgrate login" again.'));
+      console.error(chalk7.red('\u2716 Login request expired. Run "vibgrate login" again.'));
       process.exit(1);
     }
     if (token.status === "error") {
-      console.error(chalk5.red(`\u2716 ${token.error ?? "Login failed."}`));
+      console.error(chalk7.red(`\u2716 ${token.error ?? "Login failed."}`));
       process.exit(1);
     }
   }
-  console.error(chalk5.red('\u2716 Timed out waiting for approval. Run "vibgrate login" again.'));
+  console.error(chalk7.red('\u2716 Timed out waiting for approval. Run "vibgrate login" again.'));
   process.exit(1);
 });
 
@@ -3202,23 +4450,23 @@ function unsetEnvCommand(varName, env = {}) {
 var logoutCommand = new Command("logout").description("Clear stored Vibgrate login credentials").action(() => {
   const cleared = clearStoredCredentials();
   if (cleared) {
-    console.log(chalk5.green("\u2714") + " Logged out. Stored credentials removed.");
+    console.log(chalk7.green("\u2714") + " Logged out. Stored credentials removed.");
   } else {
-    console.log(chalk5.dim(`No stored credentials found at ${credentialsPath()}.`));
+    console.log(chalk7.dim(`No stored credentials found at ${credentialsPath()}.`));
   }
   if (process.env.VIBGRATE_DSN) {
     console.log("");
     console.log(
-      chalk5.yellow("\u26A0") + " VIBGRATE_DSN is still set in your environment, so commands will keep using it."
+      chalk7.yellow("\u26A0") + " VIBGRATE_DSN is still set in your environment, so commands will keep using it."
     );
     console.log(
-      chalk5.dim(`  Unset it to fully sign out: ${unsetEnvCommand("VIBGRATE_DSN")}`)
+      chalk7.dim(`  Unset it to fully sign out: ${unsetEnvCommand("VIBGRATE_DSN")}`)
     );
   }
 });
 var REGISTRY_URL = "https://registry.npmjs.org/@vibgrate%2fcli/latest";
-var CACHE_DIR = path9.join(os.homedir(), ".vibgrate");
-var CACHE_FILE = path9.join(CACHE_DIR, "update-check.json");
+var CACHE_DIR = path.join(os.homedir(), ".vibgrate");
+var CACHE_FILE = path.join(CACHE_DIR, "update-check.json");
 async function fetchLatestVersion() {
   try {
     const controller = new AbortController();
@@ -3245,8 +4493,8 @@ async function fetchLatestVersion() {
 }
 async function writeCache(data) {
   try {
-    await fs10.mkdir(CACHE_DIR, { recursive: true });
-    await fs10.writeFile(CACHE_FILE, JSON.stringify(data), "utf-8");
+    await fs14.mkdir(CACHE_DIR, { recursive: true });
+    await fs14.writeFile(CACHE_FILE, JSON.stringify(data), "utf-8");
   } catch {
   }
 }
@@ -3279,9 +4527,9 @@ function getGlobalUpdateCommand(pm, pkg, version) {
   }
 }
 async function detectPackageManager(cwd) {
-  if (await pathExists(path9.join(cwd, "pnpm-lock.yaml"))) return "pnpm";
-  if (await pathExists(path9.join(cwd, "bun.lockb"))) return "bun";
-  if (await pathExists(path9.join(cwd, "yarn.lock"))) return "yarn";
+  if (await pathExists(path.join(cwd, "pnpm-lock.yaml"))) return "pnpm";
+  if (await pathExists(path.join(cwd, "bun.lockb"))) return "bun";
+  if (await pathExists(path.join(cwd, "yarn.lock"))) return "yarn";
   return "npm";
 }
 function getInstallCommand(pm, pkg, version, isDev) {
@@ -3300,7 +4548,7 @@ function getInstallCommand(pm, pkg, version, isDev) {
 }
 async function isDevDependency(cwd) {
   try {
-    const pkgPath = path9.join(cwd, "package.json");
+    const pkgPath = path.join(cwd, "package.json");
     const raw = await (await import('fs/promises')).readFile(pkgPath, "utf-8");
     const pkg = JSON.parse(raw);
     return Boolean(pkg.devDependencies?.["@vibgrate/cli"]);
@@ -3309,21 +4557,21 @@ async function isDevDependency(cwd) {
   }
 }
 var updateCommand = new Command("update").description("Update vibgrate to the latest version").option("--check", "Only check for updates, do not install").option("--pm <manager>", "Package manager to use (npm, pnpm, yarn, bun)").option("--global", "Update global installation").action(async (opts) => {
-  console.log(chalk5.dim(`Current version: ${VERSION}`));
-  console.log(chalk5.dim("Checking npm registry..."));
+  console.log(chalk7.dim(`Current version: ${VERSION}`));
+  console.log(chalk7.dim("Checking npm registry..."));
   const latest = await fetchLatestVersion();
   if (!latest) {
-    console.error(chalk5.red("Could not reach the npm registry. Check your network connection."));
+    console.error(chalk7.red("Could not reach the npm registry. Check your network connection."));
     process.exit(1);
   }
   const semver2 = await import('semver');
   if (!semver2.gt(latest, VERSION)) {
-    console.log(chalk5.green("\u2714") + ` You are on the latest version (${VERSION}).`);
+    console.log(chalk7.green("\u2714") + ` You are on the latest version (${VERSION}).`);
     return;
   }
-  console.log(chalk5.yellow(`Update available: ${VERSION} \u2192 ${latest}`));
+  console.log(chalk7.yellow(`Update available: ${VERSION} \u2192 ${latest}`));
   if (opts.check) {
-    console.log(chalk5.dim('Run "vibgrate update" to install.'));
+    console.log(chalk7.dim('Run "vibgrate update" to install.'));
     return;
   }
   const cwd = process.cwd();
@@ -3333,17 +4581,17 @@ var updateCommand = new Command("update").description("Update vibgrate to the la
   let cmd;
   if (isGlobal) {
     cmd = getGlobalUpdateCommand(pm, "@vibgrate/cli", latest);
-    console.log(chalk5.dim(`Updating global installation with ${pm}: ${cmd}`));
+    console.log(chalk7.dim(`Updating global installation with ${pm}: ${cmd}`));
   } else {
     const isDev = await isDevDependency(cwd);
     cmd = getInstallCommand(pm, "@vibgrate/cli", latest, isDev);
-    console.log(chalk5.dim(`Using ${pm}: ${cmd}`));
+    console.log(chalk7.dim(`Using ${pm}: ${cmd}`));
   }
   try {
     execSync(cmd, { cwd, stdio: "inherit" });
-    console.log(chalk5.green("\u2714") + ` Updated to @vibgrate/cli@${latest}`);
+    console.log(chalk7.green("\u2714") + ` Updated to @vibgrate/cli@${latest}`);
   } catch {
-    console.error(chalk5.red(`Update failed. Run manually: ${cmd}`));
+    console.error(chalk7.red(`Update failed. Run manually: ${cmd}`));
     process.exit(1);
   }
 });
@@ -3436,9 +4684,9 @@ var vexCommand = new Command("vex").description("Generate an OpenVEX document (e
   try {
     const statements = [];
     if (opts.from) {
-      const fromPath = path9.resolve(opts.from);
+      const fromPath = path.resolve(opts.from);
       if (!await pathExists(fromPath)) {
-        process.stderr.write(chalk5.red(`Statements file not found: ${fromPath}
+        process.stderr.write(chalk7.red(`Statements file not found: ${fromPath}
 `));
         process.exit(1);
       }
@@ -3454,9 +4702,9 @@ var vexCommand = new Command("vex").description("Generate an OpenVEX document (e
     });
     const json2 = JSON.stringify(doc, null, 2);
     if (opts.out) {
-      await writeTextFile(path9.resolve(opts.out), json2 + "\n");
+      await writeTextFile(path.resolve(opts.out), json2 + "\n");
       process.stderr.write(
-        chalk5.green("\u2714") + ` Wrote OpenVEX document (${doc.statements.length} statement(s)) to ${path9.resolve(opts.out)}
+        chalk7.green("\u2714") + ` Wrote OpenVEX document (${doc.statements.length} statement(s)) to ${path.resolve(opts.out)}
 `
       );
     } else {
@@ -3464,7 +4712,7 @@ var vexCommand = new Command("vex").description("Generate an OpenVEX document (e
     }
   } catch (err) {
     if (err instanceof VexValidationError) {
-      process.stderr.write(chalk5.red(`VEX validation error: ${err.message}
+      process.stderr.write(chalk7.red(`VEX validation error: ${err.message}
 `));
       process.exit(1);
     }
@@ -3639,9 +4887,9 @@ function formatDeltaText(base, current) {
   return lines.join("\n");
 }
 async function readArtifactOrExit(filePath) {
-  const absolutePath = path9.resolve(filePath);
+  const absolutePath = path.resolve(filePath);
   if (!await pathExists(absolutePath)) {
-    console.error(chalk5.red(`Artifact not found: ${absolutePath}`));
+    console.error(chalk7.red(`Artifact not found: ${absolutePath}`));
     process.exit(1);
   }
   return readJsonFile(absolutePath);
@@ -3650,14 +4898,14 @@ var exportCommand = new Command("export").description("Export scan artifact as S
   const artifact = await readArtifactOrExit(opts.in);
   const format = opts.format.toLowerCase();
   if (format !== "cyclonedx" && format !== "spdx") {
-    console.error(chalk5.red("Invalid SBOM format. Use cyclonedx or spdx."));
+    console.error(chalk7.red("Invalid SBOM format. Use cyclonedx or spdx."));
     process.exit(1);
   }
   const sbom = format === "cyclonedx" ? toCycloneDx(artifact) : toSpdx(artifact);
   const body = JSON.stringify(sbom, null, 2);
   if (opts.out) {
-    await writeTextFile(path9.resolve(opts.out), body);
-    console.log(chalk5.green("\u2714") + ` SBOM written to ${opts.out}`);
+    await writeTextFile(path.resolve(opts.out), body);
+    console.log(chalk7.green("\u2714") + ` SBOM written to ${opts.out}`);
   } else {
     console.log(body);
   }
@@ -3667,8 +4915,8 @@ var deltaCommand = new Command("delta").description("Show SBOM delta between two
   const current = await readArtifactOrExit(opts.to);
   const report = formatDeltaText(base, current);
   if (opts.out) {
-    await writeTextFile(path9.resolve(opts.out), report);
-    console.log(chalk5.green("\u2714") + ` SBOM delta report written to ${opts.out}`);
+    await writeTextFile(path.resolve(opts.out), report);
+    console.log(chalk7.green("\u2714") + ` SBOM delta report written to ${opts.out}`);
   } else {
     console.log(report);
   }
@@ -3679,13 +4927,13 @@ var sbomCommand = new Command("sbom").description("Supply-chain evidence: SBOM e
 var KNOWN_COMMANDS = /* @__PURE__ */ new Set([
   "build",
   "status",
-  "verify",
   "ask",
   "embed",
   "show",
   "path",
   "tree",
   "impact",
+  "unknowns",
   "tests",
   "facts",
   "guide",
@@ -3711,6 +4959,7 @@ var KNOWN_COMMANDS = /* @__PURE__ */ new Set([
   // Drift-reporting verbs (merged from the Vibgrate CLI).
   "init",
   "scan",
+  "fix",
   "baseline",
   "report",
   "login",
@@ -3733,7 +4982,6 @@ ${aliasNote}Docs: https://vibgrate.com/help`;
   });
   registerBuild(program);
   registerStatus(program);
-  registerVerify(program);
   registerAsk(program);
   registerEmbed(program);
   registerShow(program);
@@ -3741,6 +4989,7 @@ ${aliasNote}Docs: https://vibgrate.com/help`;
   registerTree(program);
   registerInsights(program);
   registerImpact(program);
+  registerUnknowns(program);
   registerServe(program);
   registerInstall(program);
   registerShare(program);
@@ -3758,6 +5007,7 @@ ${aliasNote}Docs: https://vibgrate.com/help`;
   registerBundle(program);
   program.addCommand(initCommand);
   program.addCommand(scanCommand);
+  program.addCommand(fixCommand);
   program.addCommand(baselineCommand);
   program.addCommand(reportCommand);
   program.addCommand(loginCommand);
@@ -3822,11 +5072,19 @@ function dispatch(argv, cwd) {
   }
   const looksLikeQuestion = /\s/.test(first) || first.endsWith("?");
   if (looksLikeQuestion) return ["ask", ...args];
-  if (fs4.existsSync(path9.resolve(cwd, first))) {
+  if (fs5.existsSync(path.resolve(cwd, first))) {
     return [hasBuildOnlyFlag(args) ? "build" : "scan", ...args];
   }
+  const moved = MOVED_COMMANDS[first];
+  if (moved) {
+    throw new CliError(`\`vg ${first}\` has moved to \`${moved}\``, ExitCode.USAGE_ERROR);
+  }
   return ["ask", ...args];
 }
+var MOVED_COMMANDS = {
+  verify: "vg build --verify",
+  attest: "vg build --attest"
+};
 function findFirstPositional(args) {
   for (let i = 0; i < args.length; i++) {
     const a = args[i];
@@ -3842,7 +5100,6 @@ async function main(argv = process.argv) {
   const raw = argv.slice(2);
   if (process.env.NO_COLOR || raw.includes("--no-color")) disableColor();
   const cwd = readCwd(raw);
-  const dispatched = dispatch(raw, cwd);
   const program = buildProgram();
   program.exitOverride((err) => {
     throw err;
@@ -3852,6 +5109,7 @@ async function main(argv = process.argv) {
     writeOut: (str) => process.stdout.write(str)
   });
   try {
+    const dispatched = dispatch(raw, cwd);
     await program.parseAsync(dispatched, { from: "user" });
   } catch (err) {
     handleError(err);
@@ -3859,9 +5117,9 @@ async function main(argv = process.argv) {
 }
 function readCwd(raw) {
   const i = raw.findIndex((a) => a === "-C" || a === "--cwd");
-  if (i >= 0 && raw[i + 1]) return path9.resolve(raw[i + 1]);
+  if (i >= 0 && raw[i + 1]) return path.resolve(raw[i + 1]);
   const eq = raw.find((a) => a.startsWith("--cwd="));
-  if (eq) return path9.resolve(eq.slice("--cwd=".length));
+  if (eq) return path.resolve(eq.slice("--cwd=".length));
   return process.cwd();
 }
 function handleError(err) {