@vibgrate/cli 2026.711.1 → 2026.715.1

package/DOCS.md

@@ -1,6 +1,6 @@
 # Vibgrate CLI — Full Documentation
 
-> Continuous Drift Intelligence for Node, .NET, Python, and Java (all supported in the CLI today)
+> [Code Drift Intelligence](https://vibgrate.com/code-drift-intelligence) across ~19 ecosystems — Node, .NET, Python, Java, Go, Rust, and more
 
 For a quick overview, see the [README](./README.md). This document covers everything in detail.
 
@@ -76,6 +76,7 @@ For a quick overview, see the [README](./README.md). This document covers everyt
   - [Security Posture](#security-posture)
   - [Security Scanners](#security-scanners)
   - [Service Dependencies](#service-dependencies)
+  - [Database Schema](#database-schema)
   - [Architecture Layers](#architecture-layers)
   - [Code Quality Metrics](#code-quality-metrics)
   - [OWASP Category Mapping](#owasp-category-mapping)
@@ -100,10 +101,10 @@ Vibgrate recursively scans your repository for `package.json` (Node/TypeScript),
 1. **Detects** the runtime version, target framework, and all dependencies
 2. **Queries** the npm/NuGet registry for latest stable versions (with built-in caching and concurrency control)
 3. **Computes** how far behind each component is — major version lag, EOL proximity, dependency age distribution
-4. **Generates** a deterministic DriftScore (0–100)
+4. **Generates** a deterministic [DriftScore](https://vibgrate.com/driftscore) (0–100)
 5. **Produces** findings, a full JSON artifact, and optional SARIF output
 
-Core drift analysis does not execute source code. Optional security scanners can run lightweight secret heuristics and local toolchain checks. Vibgrate Cloud upload remains optional.
+Core drift analysis does not execute source code. Optional security scanners can run lightweight secret heuristics and local toolchain checks. [Vibgrate Cloud](https://vibgrate.com/cloud) upload remains optional.
 
 ---
 
@@ -291,9 +292,9 @@ breaking-change signals, and considers the API surface — the classes and
 functions your code imports — that a new version must preserve.
 
 Security is folded in with **real-world exploitability**. Each upgrade is checked
-against OSV in both directions (advisories **remediated** vs. **introduced**), and
-current-version advisories are cross-referenced with the **CISA KEV** (known-
-exploited) list and **FIRST EPSS** (exploit-probability) scores. A package with a
+against [OSV](https://vibgrate.com/glossary/osv) in both directions (advisories **remediated** vs. **introduced**), and
+current-version advisories are cross-referenced with the [**CISA KEV**](https://vibgrate.com/glossary/kev) (known-
+exploited) list and [**FIRST EPSS**](https://vibgrate.com/glossary/epss) (exploit-probability) scores. A package with a
 known-exploited advisory is treated as must-fix, so the recommendation prioritises
 "fix these few" over churning everything. Advisories with no upgrade path in any
 plan are called out as unresolved.
@@ -409,7 +410,7 @@ vg report [--in <file>] [--format md|text|json]
 
 ### vg sbom
 
-Export SBOMs from an existing scan artifact or compare two artifacts.
+Export [SBOMs](https://vibgrate.com/glossary/sbom) from an existing scan artifact or compare two artifacts.
 
 ```bash
 vg sbom export [--in <file>] [--format cyclonedx|spdx] [--out <file>]
@@ -491,7 +492,7 @@ Expected results:
 
 `vg scan --vulns` matches your installed dependencies against the public OSV database and records each known vulnerability — advisory id and CVE, severity, CVSS, and the fixing version — in the scan artifact, as findings, and in SARIF. Supply advisories in a `--package-manifest` bundle to run it offline.
 
-In a git repository the scan also attributes each finding: the commit, author, and date that introduced the vulnerable version, and how long you have been exposed. These exposure windows aggregate into remediation metrics framed around the EU Cyber Resilience Act (CRA): open counts by severity, mean and maximum time exposed, and per-severity SLA breaches (defaults: critical 7 days, high 30, moderate 90, low 180). The metrics are descriptive — they show whether remediation keeps pace; they are not a compliance certification.
+In a git repository the scan also attributes each finding: the commit, author, and date that introduced the vulnerable version, and how long you have been exposed. These exposure windows aggregate into remediation metrics framed around the [EU Cyber Resilience Act (CRA)](https://vibgrate.com/compliance/cra): open counts by severity, mean and maximum time exposed, and per-severity SLA breaches (defaults: critical 7 days, high 30, moderate 90, low 180). The metrics are descriptive — they show whether remediation keeps pace; they are not a compliance certification.
 
 The scan also reconstructs **closed** exposure windows from history — a vulnerable version that was later bumped out of the affected range or removed from the lockfile entirely — and reports real remediation time (MTTR) from them: measured, not estimated. Offline, a package-version manifest extends this to advisories that are fully fixed today, so a dependency that is clean now but was once vulnerable still counts toward your remediation record.
 
@@ -855,7 +856,7 @@ Add `--json` for machine-readable output.
 
 ### vg serve
 
-Start Vibgrate AI Context — a local-first MCP serving your code map, drift, and version-correct docs to your AI assistant (fully offline under `--local`).
+Start [Vibgrate AI Context](https://vibgrate.com/library) — a local-first [MCP](https://vibgrate.com/glossary/model-context-protocol) serving your code map, drift, and version-correct docs to your AI assistant (fully offline under `--local`).
 
 ```bash
 vg serve
@@ -1027,6 +1028,8 @@ The DriftScore is a deterministic, versioned metric (0–100) that represents ho
 
 **Lower score = healthier upgrade posture.** 0 means no drift (fully current); 100 means maximum drift. Higher is worse.
 
+The methodology is published: see the [public scoring specification](./docs/public/SCORING-METHODOLOGY-PUBLIC.md) in this repository and the overview at [vibgrate.com/driftscore](https://vibgrate.com/driftscore).
+
 ### Risk Levels
 
 | Score  | Risk Level                           |
@@ -1107,6 +1110,7 @@ const config: VibgrateConfig = {
     securityPosture: { enabled: true },
     securityScanners: { enabled: true },
     serviceDependencies: { enabled: true },
+    databaseSchema: { enabled: true },
   },
 };
 
@@ -1162,7 +1166,34 @@ Beyond the core drift score, Vibgrate runs a suite of extended scanners that col
 - Are **read-only** — they never write files or execute project code
 - Run **in parallel** — failures in one scanner never affect the others
 - Can be **individually toggled** in the config
-- Collect **zero sensitive data** — no source code, no secrets, no PII
+- Collect **zero sensitive data** — no secrets, no PII, and no credentials, even the ones that do open source files (below)
+
+The core drift score is manifest/lockfile-only. Several extended scanners, and
+the code graph (`vg build`/`vg map`/`vg share`/`vg serve`), go further and open
+your source files locally — that is how they work, not an accident:
+
+| Reads source locally | What it extracts | Keeps raw text? |
+|---|---|---|
+| **Code graph** (`vg build`/`vg map`) | Symbol names, call edges, file paths, hubs/areas — the graph itself | No — never a source line, only structural graph facts |
+| **Code Quality** (`codeQuality`) | Cyclomatic complexity, function length, nesting depth, dead code, "god files" | No — computed metrics only |
+| **Breaking Change Exposure** (`breakingChangeExposure`) | Import/usage-pattern hit counts for majorly-outdated packages | No — counts only |
+| **Database Schema** (`databaseSchema`) | Table/model names, column names and types, relation/key flags from SQL/Prisma/Drizzle/TypeORM files | No — never a query, row, or credential |
+| **UI Purpose** (`uiPurpose`) | Route/nav/title/CTA copy, for feature detection | **Yes** — short evidence samples of the literal UI text are kept locally (never business logic, never a full file) |
+
+None of this is executed, and **nothing above leaves your machine** unless you
+run `vg share`/`vg push` or scan with a DSN configured — and even then, what
+uploads is the computed/structural output in the table above, never a raw
+source file. Each of these is individually toggleable; set the matching
+`scanners.<name>.enabled` to `false` (or `scanners: false` for all extended
+scanners, which does not affect the code graph) if you don't want the read to
+happen at all. See [Scanner Toggles](#scanner-toggles) above and each
+scanner's own section below.
+
+The one exception where code truly leaves your machine is the **remediation
+agent**: when you ask it to write a fix, it clones your repository into an
+isolated virtual machine Vibgrate controls, makes the change, and hands you a
+pull request. That only happens when you ask for it. See
+[vibgrate.com/subprocessors](https://vibgrate.com/subprocessors) for who processes what.
 
 ### Platform Matrix
 
@@ -1297,6 +1328,30 @@ Maps external service and platform dependencies by detecting SDK packages:
 | Messaging     | SQS, SNS, Kafka, BullMQ          |
 | Observability | Sentry, DataDog, New Relic       |
 
+### Database Schema
+
+Extracts structural database-schema facts across five sources — Prisma
+(`schema.prisma`), raw SQL migrations (`.sql` files), SQL Server database
+projects (`.sqlproj`), Drizzle (`pgTable`/`mysqlTable`/`sqliteTable`), and
+TypeORM (`@Entity()` classes) — merged into one report:
+
+- Table/model names, per-field name and type, and relation/list/optional/id/unique flags
+- Enum names and values (Prisma)
+- Datasource providers (e.g. `postgresql`, `mysql`) — never the connection-string `url`
+- Files scanned, with a per-project breakdown
+
+Only structural facts are ever extracted — never a raw source line, a query,
+or a connection string/credential (any `scheme://user:pass@host` line is
+stripped as defense in depth even though hand-written SQL rarely embeds one).
+Reading these facts means opening `.sql`/`.prisma`/ORM source files locally —
+see the table at the top of this section for how this compares to the code
+graph and the other scanners that also read source. It's on by default; disable it with
+`scanners.databaseSchema.enabled: false` in `vibgrate.config.ts` (see
+[Scanner Toggles](#scanner-toggles)). Like every extended scanner, results
+only leave your machine when you run `vg push` or scan with a DSN configured
+— and the models/fields/files arrays are capped before upload so a
+large-monorepo schema can't balloon the payload.
+
 ### Architecture Layers
 
 Classifies source files into architectural layers and reports drift by layer to make refactors more predictable:
@@ -1482,7 +1537,7 @@ import type {
 
 ## Requirements
 
-- **Node.js** >= 20.0.0
+- **Node.js** >= 22.0.0
 - Works on macOS, Linux, and Windows
 
 ---
@@ -1490,6 +1545,17 @@ import type {
 ## Links
 
 - [Website](https://vibgrate.com)
+- [Vibgrate CLI — live demo and simulator](https://vibgrate.com/cli)
+- [CLI benchmarks](https://vibgrate.com/cli/benchmarks) · [methodology](https://vibgrate.com/cli/benchmarks/methodology) · [token savings](https://vibgrate.com/cli/benchmarks/token-savings)
+- [DriftScore](https://vibgrate.com/driftscore)
+- [Vibgrate AI Context (local-first MCP)](https://vibgrate.com/library)
+- [Vibgrate Graph](https://vibgrate.com/graph)
+- [Vibgrate Cloud](https://vibgrate.com/cloud) · [create a free workspace](https://dash.vibgrate.com)
+- [Vibgrate MCP (hosted)](https://vibgrate.com/mcp)
+- [AI agent skills](https://vibgrate.com/skills)
+- [Glossary](https://vibgrate.com/glossary)
+- [Help center](https://vibgrate.com/help)
+- [Changelog](https://vibgrate.com/changelog)
 - [npm](https://www.npmjs.com/package/@vibgrate/cli)
 
 ---

package/README.md

@@ -19,8 +19,8 @@
 
 `vg` answers two questions for any repo:
 
-1. **What is this codebase?** — A deterministic code graph: call trees, import paths, impact surfaces, dependency facts.
-2. **How far behind is it?** — A ranked **DriftScore** (0–100) with runtime/framework lag, dependency age and EOL proximity, and a prioritised fix list.
+1. **What is this codebase?** — A deterministic [code graph](https://vibgrate.com/graph): call trees, import paths, impact surfaces, dependency facts.
+2. **How far behind is it?** — A ranked **[DriftScore](https://vibgrate.com/driftscore)** (0–100) with runtime/framework lag, dependency age and EOL proximity, and a prioritised fix list.
 
 Everything runs **on your machine**. No API key, no network call, no data leaving your repo unless you explicitly push. The `vibgrate` command is an alias for `vg` — they are interchangeable.
 
@@ -68,7 +68,7 @@ npx vg scan                     # vg is the primary command; vibgrate is an alia
 
 ## Use it with your AI assistant
 
-`vg serve` starts **Vibgrate AI Context** — a local-first MCP server that
+`vg serve` starts **[Vibgrate AI Context](https://vibgrate.com/library)** — a local-first [MCP](https://vibgrate.com/glossary/model-context-protocol) server that
 gives any MCP-compatible assistant (Claude, Cursor, Windsurf, Copilot, Gemini
 CLI, …) your code map, **offline drift**, local models, and **version-correct
 library docs**, all from your machine (no account, nothing uploaded; thin
@@ -85,7 +85,7 @@ vg install                      # interactive: pick your assistant(s) and done
 vg install --all                # install for every detected assistant at once
 ```
 
-This writes the MCP config for your chosen tool(s) and installs a skill that teaches the assistant how to query the graph. After reloading your assistant you get graph-aware answers: call trees, impact analysis, drift findings, version-correct library docs — all from local data.
+This writes the MCP config for your chosen tool(s) and installs a skill that teaches the assistant how to query the graph. After reloading your assistant you get graph-aware answers: call trees, impact analysis, drift findings, version-correct library docs — all from local data. The token savings are measured and published, methodology included, at [vibgrate.com/cli/benchmarks/token-savings](https://vibgrate.com/cli/benchmarks/token-savings).
 
 Browse all 21+ supported assistants and their skill descriptions at **[vibgrate.com/skills](https://vibgrate.com/skills)**.
 
@@ -129,21 +129,21 @@ One scan gives you:
 - **Score breakdown** — runtime, frameworks, dependencies, EOL
 - **Per-project detail** across Node.js/TypeScript, .NET, Python, and Java
 - **Actionable findings** ranked by likely impact
-- **SBOM export** (CycloneDX / SPDX)
+- **[SBOM](https://vibgrate.com/glossary/sbom) export** (CycloneDX / SPDX)
 - **Known vulnerabilities** (opt in with `--vulns`) — severity, CVSS, the fixing version, and, in a git repo, who introduced them
 
 ---
 
 ## Find known vulnerabilities and who introduced them
 
-`vg scan --vulns` checks your installed dependencies against the public OSV database and reports each known vulnerability with its severity, CVSS score, and the version that fixes it — as text, JSON, or SARIF. Add `--package-manifest` to run it fully offline from a local advisory bundle.
+`vg scan --vulns` checks your installed dependencies against the public [OSV](https://vibgrate.com/glossary/osv) database and reports each known vulnerability with its severity, CVSS score, and the version that fixes it — as text, JSON, or SARIF. Add `--package-manifest` to run it fully offline from a local advisory bundle.
 
 ```bash
 vg scan --vulns                 # drift score + known vulnerabilities
 vg scan --full                  # drift + vulnerabilities + a banned-dependency report
 ```
 
-In a git repository, every finding is attributed from history: who introduced the vulnerable version, in which commit, and how long you have been exposed. Those exposure windows roll up into remediation metrics framed around the EU Cyber Resilience Act (CRA) — per-severity time-exposed and SLA breaches — so "are we fixing things fast enough?" has a number.
+In a git repository, every finding is attributed from history: who introduced the vulnerable version, in which commit, and how long you have been exposed. Those exposure windows roll up into remediation metrics framed around the [EU Cyber Resilience Act (CRA)](https://vibgrate.com/compliance/cra) — per-severity time-exposed and SLA breaches — so "are we fixing things fast enough?" has a number.
 
 ```bash
 vg why lodash                   # who added a dependency, every version since, and any open vulnerabilities
@@ -158,7 +158,7 @@ Your AI assistant sees this too: `vg serve` exposes `list_vulnerabilities`, `vul
 
 ## Track drift over time → create a free workspace
 
-The CLI is fully useful offline. When you want **trends across runs and repos** — so drift becomes a metric you manage, not a surprise you discover — push scans to a workspace:
+The CLI is fully useful offline. When you want **trends across runs and repos** — so drift becomes a metric you manage, not a surprise you discover — push scans to a [Vibgrate Cloud](https://vibgrate.com/cloud) workspace:
 
 1. **Create a workspace** at **[dash.vibgrate.com](https://dash.vibgrate.com)** and copy your DSN.
 2. **Connect and push:**
@@ -232,8 +232,8 @@ vg vex                          # generate an OpenVEX document for attestation
 
 ## Privacy & offline-first
 
-- No data leaves your machine unless you run `--push` / `vg push`.
-- Core graph analysis and drift scoring read manifests and configs — **not your source code**.
+- No data leaves your machine unless you run `--push` / `vg push` / `vg share`.
+- Drift scoring reads manifests and configs only. The code graph (`vg build`/`vg map`) and a few extended scanners (code quality, database schema, UI text) read your source **locally** to compute structural facts and metrics — never a raw source line, and never uploaded as-is; see [DOCS.md](./DOCS.md#extended-scanners) for exactly what each one reads.
 - Works without login and without any SaaS dependency.
 - `--offline` disables registry/network lookups; `--package-manifest <file>` feeds drift scoring a local version bundle.
 - `--max-privacy` suppresses local artifact writes and high-context scanners; `--no-local-artifacts` skips writing `.vibgrate/*.json` to disk.
@@ -244,6 +244,8 @@ vg scan --offline --package-manifest ./package-versions.zip --max-privacy --form
 
 Add `.vibgrate/` to your `.gitignore` — those are regenerated local outputs.
 
+More on how Vibgrate handles code and data: [vibgrate.com/security](https://vibgrate.com/security).
+
 ---
 
 ## Quick start with AI assistants
@@ -325,7 +327,7 @@ Full flag and configuration reference: **[DOCS.md](./DOCS.md)** · **[vibgrate.c
 
 ## Why teams adopt Vibgrate
 
-Most systems don't fail all at once — they accumulate upgrade debt and architectural drift silently until migrations become expensive. `vg` makes that debt measurable and repeatable, and gives AI assistants the local context they need to be useful:
+Most systems don't fail all at once — they accumulate upgrade debt and architectural [drift](https://vibgrate.com/glossary/code-drift) silently until migrations become expensive. `vg` makes that debt measurable and repeatable — the practice we call [Code Drift Intelligence](https://vibgrate.com/code-drift-intelligence) — and gives AI assistants the local context they need to be useful:
 
 | Mode | What you get | Best for |
 | --- | --- | --- |
@@ -363,7 +365,9 @@ When `@vibgrate/cli` is installed, it registers **both** bin entries uncondition
   &nbsp;·&nbsp;
   <a href="https://vibgrate.com/cli">Try the live demo</a>
   &nbsp;·&nbsp;
-  <a href="./DOCS.md">Vibgrate AI Context (local MCP)</a>
+  <a href="https://vibgrate.com/cli/benchmarks">Benchmarks</a>
+  &nbsp;·&nbsp;
+  <a href="https://vibgrate.com/library">Vibgrate AI Context (local MCP)</a>
   &nbsp;·&nbsp;
   <a href="https://vibgrate.com/mcp">Vibgrate MCP (hosted)</a>
   &nbsp;·&nbsp;

package/dist/baseline-BTLZWSNS.js

@@ -0,0 +1,6 @@
+export { baselineCommand, runBaseline } from './chunk-6DKWB2OI.js';
+import './chunk-C5AVF7PT.js';
+import './chunk-RXP66R2E.js';
+import './chunk-GI6W53LM.js';
+//# sourceMappingURL=baseline-BTLZWSNS.js.map
+//# sourceMappingURL=baseline-BTLZWSNS.js.map

package/dist/{baseline-V5XGS76K.js.map → baseline-BTLZWSNS.js.map}

@@ -1 +1 @@
-{"version":3,"sources":[],"names":[],"mappings":"","file":"baseline-V5XGS76K.js"}
+{"version":3,"sources":[],"names":[],"mappings":"","file":"baseline-BTLZWSNS.js"}