@vibgrate/cli 2026.711.1 → 2026.715.1

package/dist/{chunk-2PCL4ZME.js → chunk-C5AVF7PT.js}

@@ -1,5 +1,5 @@
 import { redactUrlCredentials } from './chunk-RXP66R2E.js';
-import { pathExists, readJsonFile, Semaphore, FileCache, quickTreeCount, ensureDir, writeJsonFile, writeTextFile, readTextFile, findPackageJsonFiles, findFiles, findSolutionFiles } from './chunk-GI6W53LM.js';
+import { pathExists, readTextFile, readJsonFile, Semaphore, FileCache, quickTreeCount, ensureDir, writeJsonFile, writeTextFile, findPackageJsonFiles, findFiles, findSolutionFiles } from './chunk-GI6W53LM.js';
 import * as path29 from 'path';
 import { basename, dirname } from 'path';
 import chalk3 from 'chalk';
@@ -13,14 +13,13 @@ import { readFile, mkdir, writeFile, mkdtemp, rm } from 'fs/promises';
 import { XMLParser } from 'fast-xml-parser';
 import { parse as parse$1 } from 'smol-toml';
 import * as crypto from 'crypto';
-import ts from 'typescript';
 import * as fs5 from 'fs';
 import { mkdirSync, writeFileSync } from 'fs';
 import * as zlib from 'zlib';
 import { promisify } from 'util';
 
 // src/version.ts
-var VERSION = "2026.711.1";
+var VERSION = "2026.715.1";
 var TOP_LEVEL_NODE_MODULES = /^node_modules\/((?:@[^/]+\/)?[^/]+)$/;
 function parsePackageLock(json) {
   const out = /* @__PURE__ */ new Map();
@@ -978,14 +977,6 @@ function aggregateLibyears(values) {
   if (measured === 0) return null;
   return { total, max, measured };
 }
-function freshnessScoreFromLibyears(agg) {
-  if (!agg || agg.measured === 0) return null;
-  const avg = agg.total / agg.measured;
-  const avgPenalty = Math.min(avg * 20, 100);
-  const maxPenalty = Math.min(agg.max * 10, 100);
-  const score = 100 - (avgPenalty * 0.7 + maxPenalty * 0.3);
-  return Math.max(0, Math.min(100, Math.round(score)));
-}
 
 // src/core-open/runtimes/catalog.ts
 function productForType(type) {
@@ -1055,14 +1046,14 @@ function rank(v) {
 }
 function isReleased(cycle, now) {
   if (typeof cycle.releaseDate !== "string") return true;
-  const ts2 = Date.parse(cycle.releaseDate);
-  return Number.isNaN(ts2) ? true : ts2 <= now;
+  const ts = Date.parse(cycle.releaseDate);
+  return Number.isNaN(ts) ? true : ts <= now;
 }
 function isLts(cycle, now) {
   if (cycle.lts === true) return true;
   if (typeof cycle.lts === "string") {
-    const ts2 = Date.parse(cycle.lts);
-    return !Number.isNaN(ts2) && ts2 <= now;
+    const ts = Date.parse(cycle.lts);
+    return !Number.isNaN(ts) && ts <= now;
   }
   return false;
 }
@@ -1742,10 +1733,10 @@ function parseTfmMajor(tfm) {
   return null;
 }
 function isDotnetProjectFile(name) {
-  return name.endsWith(".csproj") || name.endsWith(".vbproj");
+  return name.endsWith(".csproj") || name.endsWith(".vbproj") || name.endsWith(".sqlproj");
 }
 function stripDotnetProjectExtension(filePath) {
-  return path29.basename(filePath).replace(/\.(cs|vb)proj$/i, "");
+  return path29.basename(filePath).replace(/\.(cs|vb|sql)proj$/i, "");
 }
 function parseDotnetProjectFile(xml, filePath) {
   const parsed = parser.parse(xml);
@@ -1814,7 +1805,7 @@ async function scanDotnetProjects(rootDir, nugetCache, cache, projectScanTimeout
     try {
       const slnContent = cache ? await cache.readTextFile(slnPath) : await readTextFile(slnPath);
       const slnDir = path29.dirname(slnPath);
-      const projectRegex = /Project\("[^"]*"\)\s*=\s*"[^"]*",\s*"([^"]+\.(?:cs|vb)proj)"/g;
+      const projectRegex = /Project\("[^"]*"\)\s*=\s*"[^"]*",\s*"([^"]+\.(?:cs|vb|sql)proj)"/g;
       let match;
       while ((match = projectRegex.exec(slnContent)) !== null) {
         if (match[1]) {
@@ -6605,7 +6596,166 @@ var PubCache = class {
     return p;
   }
 };
-var DRIFT_SCORE_METHODOLOGY_VERSION = "driftscore-2.0";
+
+// src/core-open/scoring/dependency-drift-v3.ts
+var POINTS_PER_LIBYEAR = 25;
+var TIME_WEIGHT = 0.55;
+var VERSION_WEIGHT = 0.45;
+var UNSUPPORTED_FLOOR = 70;
+var ABANDONED_FLOOR = 50;
+var AGG_MEAN_WEIGHT = 0.5;
+var AGG_P95_WEIGHT = 0.3;
+var AGG_UNSUPPORTED_SHARE_WEIGHT = 0.2;
+var WEIGHT_DIRECT_PROD = 1;
+var WEIGHT_DIRECT_DEV = 0.5;
+var WEIGHT_TRANSITIVE = 0.4;
+var CANARY_MAJOR_THRESHOLD = 900;
+var SCHEME_JUMP_MAX_MAJORS = 20;
+var HIGH_CADENCE_TIME_CAP = 50;
+var PLACEHOLDER_STUBS = /* @__PURE__ */ new Set([
+  "fs",
+  "crypto",
+  "path",
+  "util",
+  "os",
+  "events",
+  "stream",
+  "http",
+  "https",
+  "assert",
+  "buffer",
+  "punycode",
+  "querystring",
+  "url",
+  "zlib",
+  "domain"
+]);
+var HIGH_CADENCE_PREFIXES = [
+  "@aws-sdk/",
+  "aws-sdk",
+  "@google-cloud/",
+  "@azure/"
+];
+function clamp(v, min, max) {
+  return Math.min(max, Math.max(min, v));
+}
+function majorOf(version) {
+  if (!version) return null;
+  const m = /^\D*(\d+)/.exec(version);
+  return m ? Number(m[1]) : null;
+}
+function isHighCadence(pkg) {
+  return HIGH_CADENCE_PREFIXES.some((p) => pkg === p || pkg.startsWith(p));
+}
+function versionDriftPoints(dep) {
+  const mb = dep.majorsBehind;
+  if (mb === null || mb === void 0) return 0;
+  if (mb <= 0) {
+    return dep.drift === "current" ? 0 : 15;
+  }
+  if (mb === 1) return 45;
+  if (mb === 2) return 70;
+  if (mb === 3) return 85;
+  return 100;
+}
+function timeDriftPoints(libyears) {
+  if (libyears === null || libyears === void 0 || Number.isNaN(libyears)) return null;
+  return clamp(libyears * POINTS_PER_LIBYEAR, 0, 100);
+}
+function perDependencyDrift(dep, ctx = {}) {
+  const flags = [];
+  if (PLACEHOLDER_STUBS.has(dep.package)) {
+    return {
+      package: dep.package,
+      drift: 0,
+      mode: "estimated",
+      unsupported: false,
+      weight: 0,
+      flags: ["placeholder-stub"],
+      excluded: true
+    };
+  }
+  const latestMajor = majorOf(dep.latestStable);
+  let versionReliable = true;
+  if (latestMajor !== null && latestMajor >= CANARY_MAJOR_THRESHOLD) {
+    versionReliable = false;
+    flags.push("canary-latest");
+  }
+  if (dep.majorsBehind !== null && dep.majorsBehind !== void 0 && dep.majorsBehind > SCHEME_JUMP_MAX_MAJORS) {
+    versionReliable = false;
+    flags.push("scheme-jump");
+  }
+  const highCadence = isHighCadence(dep.package);
+  if (highCadence) flags.push("high-cadence-damped");
+  const V = versionReliable ? versionDriftPoints(dep) : 0;
+  let T = timeDriftPoints(dep.libyears);
+  if (T !== null && highCadence) T = Math.min(T, HIGH_CADENCE_TIME_CAP);
+  let base;
+  let mode;
+  if (T !== null) {
+    mode = "verified";
+    base = versionReliable ? TIME_WEIGHT * T + VERSION_WEIGHT * V : T;
+  } else {
+    mode = "estimated";
+    base = V;
+  }
+  const unsupported = ctx.unsupported === true;
+  if (unsupported) {
+    base = Math.max(base, UNSUPPORTED_FLOOR);
+    flags.push("unsupported-floor");
+  }
+  if (ctx.abandoned === true) {
+    base = Math.max(base, ABANDONED_FLOOR);
+    flags.push("abandoned-floor");
+  }
+  const weight = ctx.transitive === true ? WEIGHT_TRANSITIVE : dep.section === "devDependencies" ? WEIGHT_DIRECT_DEV : WEIGHT_DIRECT_PROD;
+  return {
+    package: dep.package,
+    drift: clamp(Math.round(base), 0, 100),
+    mode,
+    unsupported,
+    weight,
+    flags,
+    excluded: false
+  };
+}
+function percentile(values, p) {
+  if (values.length === 0) return 0;
+  const sorted = [...values].sort((a, b) => a - b);
+  const rank2 = Math.ceil(p * sorted.length);
+  return sorted[clamp(rank2 - 1, 0, sorted.length - 1)];
+}
+function aggregateDependencyDrift(deps, ctxOf) {
+  const results = deps.map((d) => perDependencyDrift(d, ctxOf?.(d))).filter((r) => !r.excluded);
+  const excluded = deps.length - results.length;
+  if (results.length === 0) return null;
+  const weightSum = results.reduce((s, r) => s + r.weight, 0) || 1;
+  const weightedMean = results.reduce((s, r) => s + r.drift * r.weight, 0) / weightSum;
+  const p95 = percentile(results.map((r) => r.drift), 0.95);
+  const unsupportedShare = results.filter((r) => r.unsupported).length / results.length;
+  const verified = results.filter((r) => r.mode === "verified").length;
+  const drift = clamp(
+    Math.round(
+      AGG_MEAN_WEIGHT * weightedMean + AGG_P95_WEIGHT * p95 + AGG_UNSUPPORTED_SHARE_WEIGHT * (unsupportedShare * 100)
+    ),
+    0,
+    100
+  );
+  return {
+    drift,
+    mean: Math.round(weightedMean),
+    p95,
+    unsupportedShare,
+    mode: verified > 0 ? "verified" : "estimated",
+    scored: results.length,
+    excluded,
+    coverage: Math.round(verified / results.length * 100) / 100,
+    top: [...results].sort((a, b) => b.drift - a.drift).slice(0, 10)
+  };
+}
+
+// src/core-open/scoring/drift-score.ts
+var DRIFT_SCORE_METHODOLOGY_VERSION = "driftscore-3.0";
 var DEFAULT_THRESHOLDS = {
   failOnError: {
     eolDays: 180,
@@ -6617,7 +6767,7 @@ var DEFAULT_THRESHOLDS = {
     dependencyTwoPlusPercent: 30
   }
 };
-function clamp(val, min, max) {
+function clamp2(val, min, max) {
   return Math.min(max, Math.max(min, val));
 }
 function runtimeScore(projects) {
@@ -6640,23 +6790,12 @@ function frameworkScore(projects) {
   const avgLag = lags.reduce((a, b) => a + b, 0) / lags.length;
   const maxPenalty = Math.min(maxLag * 20, 100);
   const avgPenalty = Math.min(avgLag * 15, 100);
-  return clamp(100 - (maxPenalty * 0.6 + avgPenalty * 0.4), 0, 100);
+  return clamp2(100 - (maxPenalty * 0.6 + avgPenalty * 0.4), 0, 100);
 }
 function dependencyScore(projects) {
-  let totalCurrent = 0;
-  let totalOne = 0;
-  let totalTwo = 0;
-  for (const p of projects) {
-    totalCurrent += p.dependencyAgeBuckets.current;
-    totalOne += p.dependencyAgeBuckets.oneBehind;
-    totalTwo += p.dependencyAgeBuckets.twoPlusBehind;
-  }
-  const total = totalCurrent + totalOne + totalTwo;
-  if (total === 0) return null;
-  const currentPct = totalCurrent / total;
-  const onePct = totalOne / total;
-  const twoPct = totalTwo / total;
-  return clamp(Math.round(currentPct * 100 - onePct * 10 - twoPct * 40), 0, 100);
+  const deps = projects.flatMap((p) => p.dependencies);
+  const agg = aggregateDependencyDrift(deps);
+  return agg ? 100 - agg.drift : null;
 }
 var MONTH_MS = 1e3 * 60 * 60 * 24 * 30;
 function eolScore(projects) {
@@ -6704,15 +6843,6 @@ function eolScore(projects) {
   }
   return score;
 }
-function freshnessScore(projects) {
-  const aggs = projects.map((p) => p.libyears).filter((a) => !!a);
-  if (aggs.length === 0) return null;
-  const total = aggs.reduce((s, a) => s + a.total, 0);
-  const measured = aggs.reduce((s, a) => s + a.measured, 0);
-  const max = aggs.reduce((m, a) => Math.max(m, a.max), 0);
-  if (measured === 0) return null;
-  return freshnessScoreFromLibyears({ total, max, measured });
-}
 function coverageConfidence(projects) {
   let known = 0;
   let unknown = 0;
@@ -6729,13 +6859,11 @@ function computeDriftScore(projects) {
   const fs9 = frameworkScore(projects);
   const ds = dependencyScore(projects);
   const es = eolScore(projects);
-  const frs = freshnessScore(projects);
   const components = [
     { score: rs, weight: 0.25 },
     { score: fs9, weight: 0.25 },
     { score: ds, weight: 0.3 },
-    { score: es, weight: 0.2 },
-    { score: frs, weight: 0.15 }
+    { score: es, weight: 0.2 }
   ];
   const confidence = coverageConfidence(projects) ?? void 0;
   const toDrift = (health2) => 100 - health2;
@@ -6746,7 +6874,6 @@ function computeDriftScore(projects) {
       dependencyScore: toDrift(Math.round(ds ?? 100)),
       eolScore: toDrift(Math.round(es ?? 100))
     };
-    if (frs !== null) c.freshnessScore = toDrift(Math.round(frs));
     return c;
   };
   const active = components.filter((c) => c.score !== null);
@@ -6774,7 +6901,6 @@ function computeDriftScore(projects) {
   if (fs9 !== null) measured.push("framework");
   if (ds !== null) measured.push("dependency");
   if (es !== null) measured.push("eol");
-  if (frs !== null) measured.push("freshness");
   return {
     score,
     riskLevel,
@@ -7264,14 +7390,14 @@ function formatExtended(ext) {
     }
   }
   if (ext.tsModernity && ext.tsModernity.typescriptVersion) {
-    const ts2 = ext.tsModernity;
+    const ts = ext.tsModernity;
     lines.push(chalk3.bold.underline("  TypeScript"));
     const parts = [];
-    parts.push(`v${ts2.typescriptVersion}`);
-    if (ts2.strict === true) parts.push(chalk3.green("strict \u2714"));
-    else if (ts2.strict === false) parts.push(chalk3.yellow("strict \u2716"));
-    if (ts2.moduleType) parts.push(ts2.moduleType.toUpperCase());
-    if (ts2.target) parts.push(`target: ${ts2.target}`);
+    parts.push(`v${ts.typescriptVersion}`);
+    if (ts.strict === true) parts.push(chalk3.green("strict \u2714"));
+    else if (ts.strict === false) parts.push(chalk3.yellow("strict \u2716"));
+    if (ts.moduleType) parts.push(ts.moduleType.toUpperCase());
+    if (ts.target) parts.push(`target: ${ts.target}`);
     lines.push(`    ${parts.join(chalk3.dim(" \xB7 "))}`);
     lines.push("");
   }
@@ -7346,6 +7472,26 @@ function formatExtended(ext) {
     }
     lines.push("");
   }
+  if (ext.databaseSchema) {
+    const ds = ext.databaseSchema;
+    lines.push(chalk3.bold.underline("  Database Schema"));
+    const dsHead = [];
+    if (ds.providers.length > 0) dsHead.push(ds.providers.join(", "));
+    dsHead.push(`${ds.models.length} model${ds.models.length !== 1 ? "s" : ""}`);
+    dsHead.push(`${ds.enums.length} enum${ds.enums.length !== 1 ? "s" : ""}`);
+    lines.push(`    ${dsHead.join(" \xB7 ")}`);
+    const bySource = /* @__PURE__ */ new Map();
+    for (const m of ds.models) bySource.set(m.source, (bySource.get(m.source) ?? 0) + 1);
+    if (bySource.size > 1) {
+      const sourceSummary = [...bySource.entries()].sort(([a], [b]) => a.localeCompare(b)).map(([s, n]) => `${s}: ${n}`).join(", ");
+      lines.push(`    Sources: ${sourceSummary}`);
+    }
+    if (ds.models.length > 0) {
+      const preview = ds.models.slice(0, 5).map((m) => m.name).join(", ");
+      lines.push(`    Models: ${chalk3.white(preview)}${ds.models.length > 5 ? chalk3.dim(` (+${ds.models.length - 5} more)`) : ""}`);
+    }
+    lines.push("");
+  }
   if (ext.dependencyGraph) {
     const dg = ext.dependencyGraph;
     if (dg.lockfileType) {
@@ -7851,11 +7997,19 @@ var CONFIG_FILES = [
   "vibgrate.config.json"
 ];
 var TRUSTED_CONFIG_ENV = "VIBGRATE_TRUST_CONFIG";
+var tsPromise = null;
+function loadTypeScript() {
+  tsPromise ??= import('typescript').then((m) => {
+    const mod = m;
+    return mod.default ?? m;
+  });
+  return tsPromise;
+}
 function isRecord(value) {
   return typeof value === "object" && value !== null && !Array.isArray(value);
 }
-function toStaticValue(expr, constBindings) {
-  if (ts.isParenthesizedExpression(expr)) return toStaticValue(expr.expression, constBindings);
+function toStaticValue(expr, constBindings, ts) {
+  if (ts.isParenthesizedExpression(expr)) return toStaticValue(expr.expression, constBindings, ts);
   if (ts.isStringLiteralLike(expr)) return expr.text;
   if (ts.isNumericLiteral(expr)) return Number(expr.text);
   if (expr.kind === ts.SyntaxKind.TrueKeyword) return true;
@@ -7864,7 +8018,7 @@ function toStaticValue(expr, constBindings) {
   if (ts.isArrayLiteralExpression(expr)) {
     return expr.elements.map((el) => {
       if (ts.isSpreadElement(el)) throw new Error("Spread not supported in static config arrays");
-      return toStaticValue(el, constBindings);
+      return toStaticValue(el, constBindings, ts);
     });
   }
   if (ts.isObjectLiteralExpression(expr)) {
@@ -7880,18 +8034,19 @@ function toStaticValue(expr, constBindings) {
       if (key === null) {
         throw new Error("Unsupported object key in static config");
       }
-      out[key] = toStaticValue(prop.initializer, constBindings);
+      out[key] = toStaticValue(prop.initializer, constBindings, ts);
     }
     return out;
   }
   if (ts.isIdentifier(expr)) {
     const bound = constBindings.get(expr.text);
     if (!bound) throw new Error(`Unknown identifier in static config: ${expr.text}`);
-    return toStaticValue(bound, constBindings);
+    return toStaticValue(bound, constBindings, ts);
   }
   throw new Error("Non-static expression in config");
 }
-function tryParseStaticConfig(text, configPath) {
+async function tryParseStaticConfig(text, configPath) {
+  const ts = await loadTypeScript();
   const scriptKind = configPath.endsWith(".ts") ? ts.ScriptKind.TS : ts.ScriptKind.JS;
   const source = ts.createSourceFile(configPath, text, ts.ScriptTarget.ESNext, true, scriptKind);
   const constBindings = /* @__PURE__ */ new Map();
@@ -7906,7 +8061,7 @@ function tryParseStaticConfig(text, configPath) {
   }
   for (const stmt of source.statements) {
     if (!ts.isExportAssignment(stmt)) continue;
-    const parsed = toStaticValue(stmt.expression, constBindings);
+    const parsed = toStaticValue(stmt.expression, constBindings, ts);
     if (!isRecord(parsed)) return null;
     return { ...DEFAULT_CONFIG, ...parsed };
   }
@@ -7943,7 +8098,7 @@ async function loadConfig(rootDir) {
       const txt = await readTextFile(configPath);
       let staticConfig = null;
       try {
-        staticConfig = tryParseStaticConfig(txt, configPath);
+        staticConfig = await tryParseStaticConfig(txt, configPath);
       } catch {
         staticConfig = null;
       }
@@ -8227,7 +8382,7 @@ var ROBOT = [
 function getBrand(version) {
   return [
     chalk3.bold.white("  V I B G R A T E"),
-    chalk3.dim(`  Code Intelligence Engine`) + chalk3.dim(` v${version}`)
+    chalk3.dim(`  Drift Intelligence Engine`) + chalk3.dim(` v${version}`)
   ];
 }
 var SPINNER_FRAMES = ["\u280B", "\u2819", "\u2839", "\u2838", "\u283C", "\u2834", "\u2826", "\u2827", "\u2807", "\u280F"];
@@ -11135,6 +11290,20 @@ function dedupeRoutes(routes) {
 }
 var gzip2 = promisify(zlib.gzip);
 var MAX_ITEMS = 50;
+var MAX_DB_MODELS = 300;
+var MAX_DB_FIELDS_PER_MODEL = 100;
+var MAX_DB_MODEL_FILES = 5;
+var MAX_DB_FILES_SCANNED = 500;
+var DB_UPLOAD_HARD_CEILING = {
+  maxModels: 2e3,
+  maxFieldsPerModel: 500,
+  maxFilesPerModel: 20,
+  maxFilesScanned: 5e3
+};
+function clampCap(configured, fallback, ceiling) {
+  if (typeof configured !== "number" || !Number.isFinite(configured) || configured <= 0) return fallback;
+  return Math.min(Math.floor(configured), ceiling);
+}
 function extractName(entry) {
   const match = entry.match(/^(.+?)\s*\(/);
   return match ? match[1].trim() : entry.trim();
@@ -11200,7 +11369,29 @@ function compactAssetBranding(result) {
     // Don't include logos
   };
 }
-function prepareArtifactForUpload(artifact) {
+function compactDatabaseSchema(result, caps) {
+  const maxModels = clampCap(caps?.maxModels, MAX_DB_MODELS, DB_UPLOAD_HARD_CEILING.maxModels);
+  const maxFieldsPerModel = clampCap(caps?.maxFieldsPerModel, MAX_DB_FIELDS_PER_MODEL, DB_UPLOAD_HARD_CEILING.maxFieldsPerModel);
+  const maxFilesPerModel = clampCap(caps?.maxFilesPerModel, MAX_DB_MODEL_FILES, DB_UPLOAD_HARD_CEILING.maxFilesPerModel);
+  const maxFilesScanned = clampCap(caps?.maxFilesScanned, MAX_DB_FILES_SCANNED, DB_UPLOAD_HARD_CEILING.maxFilesScanned);
+  return {
+    providers: result.providers.slice(0, MAX_ITEMS),
+    models: result.models.slice(0, maxModels).map((model) => ({
+      ...model,
+      fields: model.fields.slice(0, maxFieldsPerModel),
+      files: model.files.slice(0, maxFilesPerModel)
+    })),
+    enums: result.enums.slice(0, MAX_ITEMS),
+    filesScanned: result.filesScanned.slice(0, maxFilesScanned),
+    projects: result.projects.slice(0, MAX_ITEMS).map((project) => ({
+      project: project.project,
+      filesScanned: project.filesScanned.slice(0, MAX_ITEMS),
+      models: project.models.slice(0, MAX_ITEMS),
+      enums: project.enums.slice(0, MAX_ITEMS)
+    }))
+  };
+}
+function prepareArtifactForUpload(artifact, opts) {
   const compacted = { ...artifact };
   if (compacted.extended) {
     const ext = { ...compacted.extended };
@@ -11276,6 +11467,9 @@ function prepareArtifactForUpload(artifact) {
         duplicatedPackages: ext.dependencyGraph.duplicatedPackages.slice(0, MAX_ITEMS)
       };
     }
+    if (ext.databaseSchema) {
+      ext.databaseSchema = compactDatabaseSchema(ext.databaseSchema, opts?.databaseSchemaCaps);
+    }
     compacted.extended = ext;
   }
   return compacted;
@@ -11284,8 +11478,8 @@ async function compressArtifact(artifact) {
   const json = JSON.stringify(artifact);
   return gzip2(json, { level: 9 });
 }
-async function prepareCompressedUpload(artifact) {
-  const compacted = prepareArtifactForUpload(artifact);
+async function prepareCompressedUpload(artifact, opts) {
+  const compacted = prepareArtifactForUpload(artifact, opts);
   const compressed = await compressArtifact(compacted);
   return { body: compressed, contentEncoding: "gzip" };
 }
@@ -11314,6 +11508,48 @@ async function fetchScanPreflight(parsed, ingestHost, options) {
   }
   return body;
 }
+
+// src/core-open/utils/symbols-preflight.ts
+var PROJECT_TYPE_TO_OSV_ECOSYSTEM = {
+  node: "npm",
+  typescript: "npm",
+  dotnet: "NuGet",
+  "visual-basic": "NuGet",
+  python: "PyPI",
+  ruby: "RubyGems",
+  java: "Maven",
+  kotlin: "Maven",
+  scala: "Maven",
+  groovy: "Maven",
+  clojure: "Maven",
+  go: "Go",
+  rust: "crates.io",
+  php: "Packagist",
+  dart: "Pub",
+  elixir: "Hex"
+};
+var MAX_DEPENDENCIES = 4e3;
+async function fetchRiskySymbols(parsed, ingestHost, dependencies) {
+  const url = `${parsed.scheme}://${ingestHost}/v1/ingest/scan/preflight/symbols`;
+  const body = JSON.stringify({
+    schemaVersion: "1",
+    dependencies: dependencies.slice(0, MAX_DEPENDENCIES)
+  });
+  const response = await fetch(url, {
+    method: "POST",
+    headers: {
+      "Content-Type": "application/json",
+      "X-Vibgrate-Timestamp": String(Date.now()),
+      Authorization: `VibgrateDSN ${parsed.keyId}:${parsed.secret}`
+    },
+    body
+  });
+  const payload = await response.json();
+  if (!response.ok && payload.status !== "error") {
+    throw new Error(`HTTP ${response.status}: ${JSON.stringify(payload)}`);
+  }
+  return payload;
+}
 var SKIP_DIRS2 = /* @__PURE__ */ new Set([
   "node_modules",
   ".git",
@@ -11417,6 +11653,6 @@ async function writeTextFile2(filePath, content) {
   await fs2.writeFile(filePath, content, "utf8");
 }
 
-export { VERSION, brandProgressBar, buildVersionTimelines, compactUiPurpose, computeDriftScore, computeRepoFingerprint, computeUpgradeImpact, detectVcs, driftBar, ensureDir2 as ensureDir, fetchScanPreflight, findPackageAnyEcosystem, findPackageTimeline, findVersionCrossings, getChangelogSignals, gitHistoryAvailable, normalizeConstraint, parseDsn, pathExists2 as pathExists, prepareCompressedUpload, projectTypeToVulnEcosystem, readJsonFile2 as readJsonFile, resolveHead, resolveRepositoryName, runCoreScan, severityRank, titleBox, versionSatisfies, workingTreeDirty, writeDefaultConfig, writeJsonFile2 as writeJsonFile, writeTextFile2 as writeTextFile };
-//# sourceMappingURL=chunk-2PCL4ZME.js.map
-//# sourceMappingURL=chunk-2PCL4ZME.js.map
+export { PROJECT_TYPE_TO_OSV_ECOSYSTEM, VERSION, brandProgressBar, buildVersionTimelines, compactUiPurpose, computeDriftScore, computeRepoFingerprint, computeUpgradeImpact, detectVcs, driftBar, ensureDir2 as ensureDir, fetchRiskySymbols, fetchScanPreflight, findPackageAnyEcosystem, findPackageTimeline, findVersionCrossings, getChangelogSignals, gitHistoryAvailable, loadConfig, normalizeConstraint, parseDsn, pathExists2 as pathExists, prepareCompressedUpload, projectTypeToVulnEcosystem, readJsonFile2 as readJsonFile, resolveHead, resolveRepositoryName, runCoreScan, severityRank, titleBox, versionSatisfies, workingTreeDirty, writeDefaultConfig, writeJsonFile2 as writeJsonFile, writeTextFile2 as writeTextFile };
+//# sourceMappingURL=chunk-C5AVF7PT.js.map
+//# sourceMappingURL=chunk-C5AVF7PT.js.map