@vibgrate/cli 2026.711.1 → 2026.715.1

package/dist/cli.js

@@ -1,23 +1,23 @@
 #!/usr/bin/env node
-import { resolveDsn, resolveIngestHost, dashHostForIngestHost, resolveCliInvocation, availableRegionIds, createWorkspaceDsn, writeStoredCredentials, credentialsPath, findGitRoot, ensureGitignored, gitignoreEntryForCredentials, clearStoredCredentials, inventory, uploadScanArtifact, ingestHostForRegionId, dsnCommand, pushCommand, CliError, ExitCode, NPX_INVOCATION, refreshIfStale, driftCount, embeddingsCached, resolveEmbedModel, loadEmbedder, getNodeEmbeddings, queryGraphSemantic, queryGraph, unavailableMessage, recordCliCall, CLI_TOOL_ALIASES, countPending, resolveOne, indexFor, countTokens, shortestPath, renderReport, impactOf, testsToRun, detectRunner, defaultGraphPath, serveStdio, ASSISTANTS, usageError, loadGraph, detectServeLaunch, installAssistant, writeNavigationConfig, uninstallAssistant, coveringTests, FREE_PACK, readScanArtifact, enrichOnline, ECOSYSTEMS, discoverModels, readSavings, readUsage, exportGraph, catalogPath, libDir, stableStringify, buildGraph, writeArtifacts, writeSnapshot, UsageError, ResourceLimitError, epistemicBreakdown, cacheDir, probeFreshness, discover, vibgrateDir, modelCacheInfo, clearModelCache, GraphSource, createServer, assistantById, serializeGraph, resolveLimits, loadCatalog, driftFor, addLibrary, parseDsn as parseDsn$1, publishPrivateLibrary, resolveLib, libId, resolveVersion, readDoc, localPackageDocs, localApiSurface, assessDocQuality, symbolsFromApi, fetchHostedDocs, selectForBudget, formatForExt, verifyDeterminism, renderHtml, isModelReady } from './chunk-MIJ3ZSSF.js';
-import { resolvedGrammarFiles, grammarSetVersion, canonicalize } from './chunk-X5YT263H.js';
-import { loadAdvancedScanHook, baselineCommand } from './chunk-3BWPEPWH.js';
-import { ensureDir, pathExists, writeDefaultConfig, parseDsn, detectVcs, computeRepoFingerprint, resolveRepositoryName, fetchScanPreflight, runCoreScan, VERSION, readJsonFile, writeTextFile, prepareCompressedUpload, computeDriftScore, titleBox, projectTypeToVulnEcosystem, driftBar, gitHistoryAvailable, buildVersionTimelines, findPackageAnyEcosystem, normalizeConstraint, findVersionCrossings, versionSatisfies, brandProgressBar, resolveHead, workingTreeDirty } from './chunk-2PCL4ZME.js';
+import { resolveDsn, resolveIngestHost, dashHostForIngestHost, resolveCliInvocation, availableRegionIds, createWorkspaceDsn, writeStoredCredentials, credentialsPath, findGitRoot, ensureGitignored, gitignoreEntryForCredentials, clearStoredCredentials, inventory, uploadScanArtifact, ingestHostForRegionId, dsnCommand, pushCommand, CliError, ExitCode, NPX_INVOCATION, refreshIfStale, driftCount, embeddingsCached, resolveEmbedModel, loadEmbedder, getNodeEmbeddings, queryGraphSemantic, queryGraph, unavailableMessage, recordCliCall, CLI_TOOL_ALIASES, countPending, resolveOne, indexFor, countTokens, shortestPath, renderReport, impactOf, testsToRun, detectRunner, defaultGraphPath, serveStdio, ASSISTANTS, usageError, loadGraph, detectServeLaunch, installAssistant, writeNavigationConfig, uninstallAssistant, coveringTests, FREE_PACK, readScanArtifact, enrichOnline, ECOSYSTEMS, discoverModels, readSavings, readUsage, exportGraph, catalogPath, libDir, stableStringify, buildGraph, writeArtifacts, writeSnapshot, UsageError, ResourceLimitError, epistemicBreakdown, cacheDir, probeFreshness, discover, vibgrateDir, modelCacheInfo, clearModelCache, GraphSource, createServer, assistantById, serializeGraph, resolveLimits, loadCatalog, driftFor, addLibrary, parseDsn as parseDsn$1, publishPrivateLibrary, resolveLib, libId, resolveVersion, readDoc, localPackageDocs, localApiSurface, assessDocQuality, symbolsFromApi, fetchHostedDocsCached, selectForBudget, formatForExt, verifyDeterminism, renderHtml, isModelReady } from './chunk-D4BPWARI.js';
+import { resolvedGrammarFiles, grammarSetVersion, canonicalize } from './chunk-VFO5UDAT.js';
+import { loadAdvancedScanHook, baselineCommand } from './chunk-6DKWB2OI.js';
+import { ensureDir, pathExists, writeDefaultConfig, parseDsn, detectVcs, computeRepoFingerprint, resolveRepositoryName, fetchScanPreflight, runCoreScan, VERSION, readJsonFile, writeTextFile, loadConfig, prepareCompressedUpload, computeDriftScore, titleBox, projectTypeToVulnEcosystem, driftBar, gitHistoryAvailable, buildVersionTimelines, findPackageAnyEcosystem, normalizeConstraint, findVersionCrossings, versionSatisfies, PROJECT_TYPE_TO_OSV_ECOSYSTEM, fetchRiskySymbols, brandProgressBar, resolveHead, workingTreeDirty } from './chunk-C5AVF7PT.js';
 import './chunk-RXP66R2E.js';
 import { pathExists as pathExists$1, parseExcludePatterns } from './chunk-GI6W53LM.js';
-import * as fs6 from 'fs';
-import fs6__default, { realpathSync } from 'fs';
+import * as fs7 from 'fs';
+import fs7__default, { realpathSync } from 'fs';
 import * as path from 'path';
 import path__default from 'path';
-import { fileURLToPath } from 'url';
+import { fileURLToPath, pathToFileURL } from 'url';
 import { Command, CommanderError, Option } from 'commander';
 import { execSync, spawn, spawnSync, execFileSync, execFile } from 'child_process';
 import * as crypto from 'crypto';
 import { randomUUID } from 'crypto';
 import chalk8 from 'chalk';
 import * as os from 'os';
+import * as fs13 from 'fs/promises';
 import * as readline from 'readline';
-import * as fs15 from 'fs/promises';
 import semver from 'semver';
 
 var DSSE_PAYLOAD_TYPE = "application/vnd.in-toto+json";
@@ -178,14 +178,14 @@ async function signGraphAttestation(root, graph, opts) {
   const explicitKey = opts.key ?? process.env.VG_ATTEST_KEY;
   const keyPath = explicitKey ? path.resolve(explicitKey) : path.join(root, ".vibgrate", DEFAULT_KEY);
   let keyGeneratedAt;
-  if (!fs6.existsSync(keyPath)) {
+  if (!fs7.existsSync(keyPath)) {
     if (explicitKey) {
       throw new CliError(`signing key not found: ${explicitKey}`, ExitCode.USAGE_ERROR);
     }
     const kp = generateKeypair();
-    fs6.mkdirSync(path.dirname(keyPath), { recursive: true });
-    fs6.writeFileSync(keyPath, kp.privatePem, { mode: 384 });
-    fs6.writeFileSync(`${keyPath}.pub`, kp.publicPem);
+    fs7.mkdirSync(path.dirname(keyPath), { recursive: true });
+    fs7.writeFileSync(keyPath, kp.privatePem, { mode: 384 });
+    fs7.writeFileSync(`${keyPath}.pub`, kp.publicPem);
     keyGeneratedAt = keyPath;
     notices.push(
       `minted a new Ed25519 signing key at ${rel(root, keyPath)} (keyid ${kp.keyid}) \u2014 keep it, add it to .gitignore, and reuse it to re-sign reproducibly`
@@ -193,7 +193,7 @@ async function signGraphAttestation(root, graph, opts) {
   }
   let privateKey;
   try {
-    privateKey = crypto.createPrivateKey(fs6.readFileSync(keyPath, "utf8"));
+    privateKey = crypto.createPrivateKey(fs7.readFileSync(keyPath, "utf8"));
   } catch {
     throw new CliError(`could not read an Ed25519 private key from ${rel(root, keyPath)}`, ExitCode.USAGE_ERROR);
   }
@@ -207,8 +207,8 @@ async function signGraphAttestation(root, graph, opts) {
   const statement = buildStatement(graph, { commit });
   const envelope = signStatement(statement, privateKey);
   const outPath = opts.attestation ? path.resolve(opts.attestation) : path.join(root, ".vibgrate", DEFAULT_ATTESTATION);
-  fs6.mkdirSync(path.dirname(outPath), { recursive: true });
-  fs6.writeFileSync(outPath, serializeEnvelope(envelope));
+  fs7.mkdirSync(path.dirname(outPath), { recursive: true });
+  fs7.writeFileSync(outPath, serializeEnvelope(envelope));
   return {
     summary: {
       keyid: envelope.signatures[0]?.keyid ?? "",
@@ -223,7 +223,7 @@ async function signGraphAttestation(root, graph, opts) {
 }
 function verifyGraphAttestation(root, opts) {
   const bundlePath = opts.attestation ? path.resolve(opts.attestation) : path.join(root, ".vibgrate", DEFAULT_ATTESTATION);
-  if (!fs6.existsSync(bundlePath)) {
+  if (!fs7.existsSync(bundlePath)) {
     if (opts.attestation || opts.pub) {
       throw new CliError(
         `no attestation at ${rel(root, bundlePath)} \u2014 sign one with \`vg build --attest\``,
@@ -232,8 +232,8 @@ function verifyGraphAttestation(root, opts) {
     }
     return { bundlePath, missing: true };
   }
-  const envelope = parseEnvelope(fs6.readFileSync(bundlePath, "utf8"));
-  const publicKeyPem = opts.pub ? fs6.readFileSync(path.resolve(opts.pub), "utf8") : void 0;
+  const envelope = parseEnvelope(fs7.readFileSync(bundlePath, "utf8"));
+  const publicKeyPem = opts.pub ? fs7.readFileSync(path.resolve(opts.pub), "utf8") : void 0;
   const graph = loadGraph(root) ?? void 0;
   return { bundlePath, missing: false, result: verifyEnvelope(envelope, { publicKeyPem, graph }) };
 }
@@ -245,15 +245,15 @@ async function gitCommitInfo(root) {
   return { sha, shortSha: sha.slice(0, 7), branch, dirty: dirty === true ? true : dirty === false ? false : void 0 };
 }
 function gitBranch(root) {
-  return new Promise((resolve16) => {
+  return new Promise((resolve17) => {
     execFile(
       "git",
       ["rev-parse", "--abbrev-ref", "HEAD"],
       { cwd: root, timeout: 5e3, windowsHide: true, encoding: "utf8" },
       (err, stdout) => {
-        if (err) return resolve16(void 0);
+        if (err) return resolve17(void 0);
         const name = String(stdout).trim();
-        resolve16(name && name !== "HEAD" ? name : void 0);
+        resolve17(name && name !== "HEAD" ? name : void 0);
       }
     );
   });
@@ -584,8 +584,8 @@ function writeExport(graph, target) {
         ExitCode.USAGE_ERROR
       );
   }
-  fs6.mkdirSync(path.dirname(path.resolve(target)), { recursive: true });
-  fs6.writeFileSync(target, content);
+  fs7.mkdirSync(path.dirname(path.resolve(target)), { recursive: true });
+  fs7.writeFileSync(target, content);
 }
 function collect(value, prev) {
   return [...prev, value];
@@ -604,7 +604,7 @@ async function runStatus(global) {
   const root = path.resolve(global.cwd ?? ".");
   const graphPath = global.graph ?? defaultGraphPath(root);
   const graph = loadGraph(root, graphPath);
-  const hasCache = fs6.existsSync(path.join(cacheDir(root), "parse-cache.json"));
+  const hasCache = fs7.existsSync(path.join(cacheDir(root), "parse-cache.json"));
   let stale = null;
   let staleExact = false;
   if (graph) {
@@ -1289,14 +1289,14 @@ var INSTALL_ID_FILE = path.join(INSTALL_ID_DIR, "install-id");
 var SEND_TIMEOUT_MS = 4e3;
 function installId() {
   try {
-    const existing = fs6.readFileSync(INSTALL_ID_FILE, "utf8").trim();
+    const existing = fs7.readFileSync(INSTALL_ID_FILE, "utf8").trim();
     if (isUuid(existing)) return existing;
   } catch {
   }
   const id = randomUuid();
   try {
-    fs6.mkdirSync(INSTALL_ID_DIR, { recursive: true });
-    fs6.writeFileSync(INSTALL_ID_FILE, id + "\n", { mode: 384 });
+    fs7.mkdirSync(INSTALL_ID_DIR, { recursive: true });
+    fs7.writeFileSync(INSTALL_ID_FILE, id + "\n", { mode: 384 });
   } catch {
   }
   return id;
@@ -1320,7 +1320,7 @@ function ledgerFilePath(root) {
 }
 function readOffset(root) {
   try {
-    const raw = JSON.parse(fs6.readFileSync(offsetPath(root), "utf8"));
+    const raw = JSON.parse(fs7.readFileSync(offsetPath(root), "utf8"));
     return typeof raw.offset === "number" && raw.offset >= 0 ? raw.offset : 0;
   } catch {
     return 0;
@@ -1328,8 +1328,8 @@ function readOffset(root) {
 }
 function writeOffset(root, offset) {
   try {
-    fs6.mkdirSync(cacheDir(root), { recursive: true });
-    fs6.writeFileSync(offsetPath(root), JSON.stringify({ offset }) + "\n");
+    fs7.mkdirSync(cacheDir(root), { recursive: true });
+    fs7.writeFileSync(offsetPath(root), JSON.stringify({ offset }) + "\n");
   } catch {
   }
 }
@@ -1337,7 +1337,7 @@ function buildBatch(root, fromOffset, id = installId()) {
   const file = ledgerFilePath(root);
   let size = 0;
   try {
-    size = fs6.statSync(file).size;
+    size = fs7.statSync(file).size;
   } catch {
     return { batch: null, newOffset: 0 };
   }
@@ -1345,13 +1345,13 @@ function buildBatch(root, fromOffset, id = installId()) {
   if (start >= size) return { batch: null, newOffset: size };
   let text = "";
   try {
-    const fd = fs6.openSync(file, "r");
+    const fd = fs7.openSync(file, "r");
     try {
       const buf = Buffer.alloc(size - start);
-      fs6.readSync(fd, buf, 0, buf.length, start);
+      fs7.readSync(fd, buf, 0, buf.length, start);
       text = buf.toString("utf8");
     } finally {
-      fs6.closeSync(fd);
+      fs7.closeSync(fd);
     }
   } catch {
     return { batch: null, newOffset: fromOffset };
@@ -1497,7 +1497,7 @@ function registerServe(program) {
 }
 async function ensureServableGraph(root, graphPath, global, refresh, opts = {}) {
   if (refresh) {
-    if (!fs6.existsSync(graphPath)) {
+    if (!fs7.existsSync(graphPath)) {
       info(c.dim("vg \xB7 no map found \u2014 building it before serving\u2026"));
       await runBuild(
         [],
@@ -1514,7 +1514,7 @@ async function ensureServableGraph(root, graphPath, global, refresh, opts = {})
       }
     }
   }
-  if (!fs6.existsSync(graphPath)) {
+  if (!fs7.existsSync(graphPath)) {
     throw new CliError(
       `no map found at ${graphPath} \u2014 run \`vg\` to build one first`,
       ExitCode.NOT_FOUND
@@ -1569,12 +1569,587 @@ async function serveHttp(graphPath, host, port, opts, freshness) {
       info(c.red(`vg serve: request error: ${err.message}`));
     }
   });
-  await new Promise((resolve16) => httpServer.listen(port, host, resolve16));
+  await new Promise((resolve17) => httpServer.listen(port, host, resolve17));
   info(c.dim(`vg \xB7 MCP server on http://${host}:${port}/mcp (read-only, local, ${freshness})`));
   await new Promise(() => {
   });
 }
 
+// src/lsp/protocol.ts
+var ErrorCodes = {
+  MethodNotFound: -32601,
+  InternalError: -32603
+};
+var MessageReader = class {
+  buf = Buffer.alloc(0);
+  /** Feed a chunk; returns every complete message now available. */
+  push(chunk) {
+    this.buf = this.buf.length === 0 ? chunk : Buffer.concat([this.buf, chunk]);
+    const out2 = [];
+    for (; ; ) {
+      const headerEnd = this.buf.indexOf("\r\n\r\n");
+      if (headerEnd === -1) break;
+      const header = this.buf.subarray(0, headerEnd).toString("ascii");
+      const match = /content-length:\s*(\d+)/i.exec(header);
+      if (!match) {
+        this.buf = this.buf.subarray(headerEnd + 4);
+        continue;
+      }
+      const length = Number(match[1]);
+      const bodyStart = headerEnd + 4;
+      if (this.buf.length < bodyStart + length) break;
+      const body = this.buf.subarray(bodyStart, bodyStart + length).toString("utf8");
+      this.buf = this.buf.subarray(bodyStart + length);
+      try {
+        out2.push(JSON.parse(body));
+      } catch {
+      }
+    }
+    return out2;
+  }
+};
+var MessageWriter = class {
+  constructor(out2) {
+    this.out = out2;
+  }
+  out;
+  write(msg) {
+    const body = Buffer.from(JSON.stringify(msg), "utf8");
+    this.out.write(`Content-Length: ${body.length}\r
+\r
+`);
+    this.out.write(body);
+  }
+};
+var Connection = class {
+  reader = new MessageReader();
+  writer;
+  requests = /* @__PURE__ */ new Map();
+  notifications = /* @__PURE__ */ new Map();
+  constructor(input = process.stdin, output = process.stdout) {
+    this.writer = new MessageWriter(output);
+    input.on("data", (chunk) => {
+      for (const msg of this.reader.push(chunk)) void this.dispatch(msg);
+    });
+  }
+  onRequest(method, handler) {
+    this.requests.set(method, handler);
+  }
+  onNotification(method, handler) {
+    this.notifications.set(method, handler);
+  }
+  /** Push a server→client notification (diagnostics, `vibgrate/score`, …). */
+  notify(method, params) {
+    this.writer.write({ jsonrpc: "2.0", method, params });
+  }
+  async dispatch(msg) {
+    if (!msg.method) return;
+    const isRequest = msg.id !== void 0 && msg.id !== null;
+    if (!isRequest) {
+      const handler2 = this.notifications.get(msg.method);
+      if (handler2) {
+        try {
+          await handler2(msg.method, msg.params);
+        } catch {
+        }
+      }
+      return;
+    }
+    const handler = this.requests.get(msg.method);
+    if (!handler) {
+      this.writer.write({
+        jsonrpc: "2.0",
+        id: msg.id,
+        error: { code: ErrorCodes.MethodNotFound, message: `Unhandled method: ${msg.method}` }
+      });
+      return;
+    }
+    try {
+      const result = await handler(msg.method, msg.params);
+      this.writer.write({ jsonrpc: "2.0", id: msg.id, result: result ?? null });
+    } catch (err) {
+      this.writer.write({
+        jsonrpc: "2.0",
+        id: msg.id,
+        error: {
+          code: ErrorCodes.InternalError,
+          message: err instanceof Error ? err.message : "Internal error"
+        }
+      });
+    }
+  }
+};
+
+// src/lsp/manifest-positions.ts
+function manifestKind(filePath) {
+  const base = (filePath.split(/[\\/]/).pop() ?? "").toLowerCase();
+  if (base === "package.json") return "package.json";
+  if (base === "go.mod") return "go.mod";
+  if (base === "requirements.txt" || /^requirements.*\.txt$/.test(base)) return "requirements.txt";
+  if (base === "pyproject.toml") return "pyproject.toml";
+  if (base === "cargo.toml") return "Cargo.toml";
+  if (base === "pom.xml") return "pom.xml";
+  if (base === "build.gradle" || base === "build.gradle.kts") return "build.gradle";
+  if (base === "gemfile") return "Gemfile";
+  if (base === "composer.json") return "composer.json";
+  if (base === "pubspec.yaml") return "pubspec.yaml";
+  if (base === "mix.exs") return "mix.exs";
+  if (base.endsWith(".csproj") || base.endsWith(".fsproj") || base.endsWith(".vbproj")) return "csproj";
+  if (base === "dockerfile" || base.startsWith("dockerfile.")) return "Dockerfile";
+  return "unknown";
+}
+function isManifest(filePath) {
+  return manifestKind(filePath) !== "unknown";
+}
+function esc(s) {
+  return s.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
+}
+function findPackageLine(text, pkg, kind) {
+  const lines = text.split(/\r?\n/);
+  const p = esc(pkg);
+  const patterns = (() => {
+    switch (kind) {
+      case "package.json":
+      case "composer.json":
+        return [new RegExp(`^\\s*"${p}"\\s*:`)];
+      case "go.mod":
+        return [new RegExp(`^\\s*(?:require\\s+)?${p}\\s+v?\\d`)];
+      case "requirements.txt":
+        return [new RegExp(`^\\s*${p}\\s*(?:\\[[^\\]]*\\])?\\s*(?:[=<>!~]|$)`, "i")];
+      case "pyproject.toml":
+      case "Cargo.toml":
+        return [
+          new RegExp(`^\\s*${p}\\s*=`),
+          new RegExp(`^\\s*"${p}\\s*(?:[=<>!~\\[]|")`)
+        ];
+      case "pom.xml":
+        return [new RegExp(`<artifactId>\\s*${p}\\s*</artifactId>`)];
+      case "build.gradle":
+        return [new RegExp(`["']${p}(?:["':])`)];
+      case "Gemfile":
+        return [new RegExp(`^\\s*gem\\s+["']${p}["']`)];
+      case "pubspec.yaml":
+        return [new RegExp(`^\\s*${p}\\s*:`)];
+      case "mix.exs":
+        return [new RegExp(`\\{\\s*:${p}\\s*,`)];
+      case "csproj":
+        return [new RegExp(`Include\\s*=\\s*"${p}"`, "i")];
+      case "Dockerfile":
+        return [new RegExp(`^\\s*FROM\\s+.*${p}`, "i")];
+      default:
+        return [];
+    }
+  })();
+  for (const re of patterns) {
+    for (let i = 0; i < lines.length; i++) {
+      if (re.test(lines[i])) return i;
+    }
+  }
+  return -1;
+}
+function findRuntimeLine(text, kind) {
+  const lines = text.split(/\r?\n/);
+  const patterns = (() => {
+    switch (kind) {
+      case "package.json":
+        return [/^\s*"node"\s*:/, /^\s*"engines"\s*:/];
+      case "go.mod":
+        return [/^\s*go\s+\d/];
+      case "pyproject.toml":
+        return [/^\s*(?:requires-python|python)\s*=/];
+      case "pom.xml":
+        return [/<(?:java\.version|maven\.compiler\.(?:source|target|release))>/];
+      case "build.gradle":
+        return [/(?:sourceCompatibility|targetCompatibility|JavaVersion)/];
+      case "csproj":
+        return [/<TargetFrameworks?>/i];
+      case "Dockerfile":
+        return [/^\s*FROM\s+/i];
+      default:
+        return [];
+    }
+  })();
+  for (const re of patterns) {
+    for (let i = 0; i < lines.length; i++) {
+      if (re.test(lines[i])) return i;
+    }
+  }
+  return -1;
+}
+function endOfLine(text, line) {
+  const lines = text.split(/\r?\n/);
+  return (lines[line] ?? "").length;
+}
+
+// src/lsp/server.ts
+function bandForDependency(dep) {
+  if (dep.drift === "major-behind") {
+    return (dep.majorsBehind ?? 1) >= 2 ? "high" : "moderate";
+  }
+  if (dep.drift === "minor-behind") return "moderate";
+  return "low";
+}
+function severityFor(level) {
+  if (level === "note") return 3;
+  return 2;
+}
+var DIAGNOSTIC_RULES = /* @__PURE__ */ new Set([
+  "vibgrate/runtime-eol",
+  "vibgrate/runtime-lag",
+  "vibgrate/unmaintained",
+  "vibgrate/abandoned",
+  "vibgrate/license-change",
+  "vibgrate/eol"
+]);
+var VibgrateLanguageServer = class {
+  constructor(opts, output = process.stdout) {
+    this.opts = opts;
+    this.conn = new Connection(process.stdin, output);
+    this.register();
+  }
+  opts;
+  conn;
+  docs = /* @__PURE__ */ new Map();
+  // uri → text
+  artifact = null;
+  scanning = false;
+  queued = false;
+  debounce = null;
+  shuttingDown = false;
+  register() {
+    this.conn.onRequest("initialize", () => ({
+      capabilities: {
+        // 1 = Full sync. We only actually act on save, but full sync keeps our
+        // buffer honest so hovers land on the text the user is looking at.
+        textDocumentSync: 1,
+        hoverProvider: true,
+        codeLensProvider: { resolveProvider: false },
+        executeCommandProvider: {
+          commands: ["vibgrate.rescan", "vibgrate.explain", "vibgrate.routeFix"]
+        }
+      },
+      serverInfo: { name: "Vibgrate", version: VERSION }
+    }));
+    this.conn.onNotification("initialized", () => this.scheduleScan(0));
+    this.conn.onNotification("textDocument/didOpen", (_m, params) => {
+      const p = params;
+      const uri = p.textDocument?.uri;
+      if (!uri || !isManifest(uriToPath(uri))) return;
+      this.docs.set(uri, p.textDocument?.text ?? "");
+      if (this.artifact) this.publishForDoc(uri);
+      else this.scheduleScan(0);
+    });
+    this.conn.onNotification("textDocument/didChange", (_m, params) => {
+      const p = params;
+      const uri = p.textDocument?.uri;
+      if (!uri || !this.docs.has(uri)) return;
+      const full = p.contentChanges?.[p.contentChanges.length - 1]?.text;
+      if (typeof full === "string") this.docs.set(uri, full);
+      if (this.artifact) this.publishForDoc(uri);
+    });
+    this.conn.onNotification("textDocument/didSave", (_m, params) => {
+      const p = params;
+      const uri = p.textDocument?.uri;
+      if (!uri || !this.docs.has(uri)) return;
+      this.scheduleScan(400);
+    });
+    this.conn.onNotification("textDocument/didClose", (_m, params) => {
+      const p = params;
+      if (p.textDocument?.uri) this.docs.delete(p.textDocument.uri);
+    });
+    this.conn.onRequest("textDocument/hover", (_m, params) => this.onHover(params));
+    this.conn.onRequest("textDocument/codeLens", (_m, params) => this.onCodeLens(params));
+    this.conn.onRequest("workspace/executeCommand", (_m, params) => {
+      const p = params;
+      if (p.command === "vibgrate.rescan") {
+        this.scheduleScan(0);
+        return { ok: true };
+      }
+      return null;
+    });
+    this.conn.onRequest("shutdown", () => {
+      this.shuttingDown = true;
+      if (this.debounce) clearTimeout(this.debounce);
+      return null;
+    });
+    this.conn.onNotification("exit", () => {
+      process.exit(this.shuttingDown ? 0 : 1);
+    });
+  }
+  // ── Scanning ─────────────────────────────────────────────────────────────
+  scheduleScan(delayMs) {
+    if (this.debounce) clearTimeout(this.debounce);
+    this.debounce = setTimeout(() => void this.scan(), delayMs);
+  }
+  async scan() {
+    if (this.scanning) {
+      this.queued = true;
+      return;
+    }
+    this.scanning = true;
+    try {
+      const scanOpts = {
+        format: "json",
+        concurrency: 8,
+        offline: this.opts.offline,
+        noLocalArtifacts: true,
+        // an editor scan must not litter the repo
+        noGraph: true,
+        // the code map is not needed to score drift; skip the cost
+        quiet: true,
+        // no spinners, no artifact dump — an editor is not a terminal
+        vibgrateVersion: VERSION
+      };
+      const advanced = await loadAdvancedScanHook();
+      this.artifact = await runCoreScan(this.opts.root, scanOpts, advanced);
+      this.publishScore();
+      for (const uri of this.docs.keys()) this.publishForDoc(uri);
+    } catch (err) {
+      this.conn.notify("window/logMessage", {
+        type: 3,
+        message: `Vibgrate scan failed: ${err instanceof Error ? err.message : String(err)}`
+      });
+      this.conn.notify("vibgrate/status", { state: "error" });
+    } finally {
+      this.scanning = false;
+      if (this.queued) {
+        this.queued = false;
+        this.scheduleScan(0);
+      }
+    }
+  }
+  // ── Publishing ───────────────────────────────────────────────────────────
+  publishScore() {
+    const a = this.artifact;
+    if (!a) return;
+    let behind = 0;
+    let unmaintained = 0;
+    let total = 0;
+    for (const proj of a.projects ?? []) {
+      for (const dep of proj.dependencies ?? []) {
+        total++;
+        if (dep.drift === "major-behind" || dep.drift === "minor-behind") behind++;
+      }
+    }
+    const eol = (a.findings ?? []).filter(
+      (f) => f.ruleId === "vibgrate/runtime-eol" || f.ruleId === "vibgrate/eol"
+    ).length;
+    unmaintained = (a.findings ?? []).filter(
+      (f) => f.ruleId === "vibgrate/unmaintained" || f.ruleId === "vibgrate/abandoned"
+    ).length;
+    const band = a.drift.riskLevel ?? "low";
+    const payload = {
+      score: a.drift.score,
+      band,
+      // v3 §2.4: `estimated` means "no timestamps at all" — it is NOT an
+      // offline marker. An air-gapped scan against a dated snapshot is Verified.
+      mode: hasReleaseDates(a) ? "verified" : "estimated",
+      methodology: a.drift.methodologyVersion ?? "unknown",
+      scale: "0 best, 100 worst",
+      counts: { behind, eol, unmaintained, total },
+      rootPath: a.rootPath,
+      scannedAt: a.timestamp
+    };
+    this.conn.notify("vibgrate/score", payload);
+  }
+  /** Decorations + (optionally) diagnostics for one open manifest. */
+  publishForDoc(uri) {
+    const a = this.artifact;
+    const text = this.docs.get(uri);
+    if (!a || text === void 0) return;
+    const filePath = uriToPath(uri);
+    const kind = manifestKind(filePath);
+    const project = projectForFile(this.opts.root, a, filePath);
+    const items = [];
+    for (const dep of project?.dependencies ?? []) {
+      if (dep.drift === "current" || dep.drift === "unknown") continue;
+      const line = findPackageLine(text, dep.package, kind);
+      if (line === -1) continue;
+      items.push({
+        line,
+        endCol: endOfLine(text, line),
+        text: inlineLabel(dep),
+        band: bandForDependency(dep),
+        package: dep.package
+      });
+    }
+    this.conn.notify("vibgrate/inline", { uri, items });
+    if (!this.opts.diagnostics) {
+      this.conn.notify("textDocument/publishDiagnostics", { uri, diagnostics: [] });
+      return;
+    }
+    const diagnostics = (a.findings ?? []).filter((f) => DIAGNOSTIC_RULES.has(f.ruleId)).filter((f) => project && sameProject(f.location, project.path)).map((f) => {
+      const line = Math.max(0, findRuntimeLine(text, kind));
+      return {
+        range: {
+          start: { line, character: 0 },
+          end: { line, character: endOfLine(text, line) }
+        },
+        severity: severityFor(f.level),
+        // never 1 — see file header
+        source: "vibgrate",
+        code: f.ruleId,
+        message: f.message
+      };
+    });
+    this.conn.notify("textDocument/publishDiagnostics", { uri, diagnostics });
+  }
+  // ── Requests ─────────────────────────────────────────────────────────────
+  onHover(params) {
+    const p = params;
+    const uri = p.textDocument?.uri;
+    const line = p.position?.line;
+    const a = this.artifact;
+    const text = uri ? this.docs.get(uri) : void 0;
+    if (!uri || line === void 0 || !a || text === void 0) return null;
+    const filePath = uriToPath(uri);
+    const kind = manifestKind(filePath);
+    const project = projectForFile(this.opts.root, a, filePath);
+    const dep = (project?.dependencies ?? []).find(
+      (d) => findPackageLine(text, d.package, kind) === line
+    );
+    if (!dep) return null;
+    return {
+      contents: { kind: "markdown", value: hoverMarkdown(dep) }
+    };
+  }
+  onCodeLens(params) {
+    const p = params;
+    const uri = p.textDocument?.uri;
+    const a = this.artifact;
+    if (!uri || !a || !this.docs.has(uri)) return [];
+    const behind = (a.projects ?? []).reduce(
+      (n, proj) => n + (proj.dependencies ?? []).filter(
+        (d) => d.drift === "major-behind" || d.drift === "minor-behind"
+      ).length,
+      0
+    );
+    const eol = (a.findings ?? []).filter(
+      (f) => f.ruleId === "vibgrate/runtime-eol" || f.ruleId === "vibgrate/eol"
+    ).length;
+    const mode = hasReleaseDates(a) ? "" : "~";
+    const title = `Vibgrate \xB7 drift ${mode}${a.drift.score} (${a.drift.riskLevel}) \xB7 ${behind} behind \xB7 ${eol} EOL`;
+    return [
+      {
+        range: { start: { line: 0, character: 0 }, end: { line: 0, character: 0 } },
+        command: { title, command: "vibgrate.openPanel", arguments: [] }
+      }
+    ];
+  }
+};
+function uriToPath(uri) {
+  try {
+    return fileURLToPath(uri);
+  } catch {
+    return uri;
+  }
+}
+function projectForFile(root, a, filePath) {
+  const dir = path.dirname(path.resolve(filePath));
+  let best;
+  let bestLen = -1;
+  for (const proj of a.projects ?? []) {
+    const projDir = path.resolve(root, proj.path);
+    if ((dir === projDir || dir.startsWith(projDir + path.sep)) && projDir.length > bestLen) {
+      best = proj;
+      bestLen = projDir.length;
+    }
+  }
+  return best;
+}
+function sameProject(location, projectPath) {
+  return path.normalize(location) === path.normalize(projectPath);
+}
+function hasReleaseDates(a) {
+  for (const proj of a.projects ?? []) {
+    for (const dep of proj.dependencies ?? []) {
+      if (dep.ageDays !== null && dep.ageDays !== void 0) return true;
+    }
+  }
+  return false;
+}
+function inlineLabel(dep) {
+  const bits = [];
+  if (dep.drift === "major-behind") {
+    const n = dep.majorsBehind ?? 1;
+    bits.push(`${n} major behind`);
+  } else if (dep.drift === "minor-behind") {
+    bits.push("minor behind");
+  }
+  if (dep.latestStable) bits.push(dep.latestStable);
+  if (dep.ageDays != null && dep.ageDays >= 1) {
+    bits.push(`${Math.round(dep.ageDays).toLocaleString("en-US")}d stale`);
+  }
+  return bits.join(" \xB7 ");
+}
+function hoverMarkdown(dep) {
+  const lines = [];
+  lines.push(`**${dep.package}**`);
+  lines.push("");
+  const yours = dep.resolvedVersion ?? dep.currentSpec;
+  if (dep.latestStable && dep.latestStable !== yours) {
+    lines.push(`| | |`);
+    lines.push(`|---|---|`);
+    lines.push(`| yours | \`${yours}\` |`);
+    lines.push(`| latest | \`${dep.latestStable}\` |`);
+    if (dep.majorsBehind) lines.push(`| majors behind | ${dep.majorsBehind} |`);
+    if (dep.ageDays != null && dep.ageDays >= 1) {
+      lines.push(`| age | ${Math.round(dep.ageDays).toLocaleString("en-US")} days |`);
+    }
+    if (dep.libyears != null && dep.libyears >= 0.01) {
+      lines.push(`| libyears | ${dep.libyears.toFixed(2)} |`);
+    }
+    const license = dep.license?.spdxId ?? dep.license?.raw;
+    if (license) lines.push(`| license | ${license} |`);
+  } else {
+    lines.push(`\`${yours}\` \u2014 current.`);
+  }
+  lines.push("");
+  lines.push("$(shield) Resolved locally from your lockfile. No source uploaded.");
+  return lines.join("\n");
+}
+function startLanguageServer(opts) {
+  if (!fs7.existsSync(opts.root)) {
+    process.stderr.write(`vg lsp: root does not exist: ${opts.root}
+`);
+    process.exit(1);
+  }
+  const realWrite = process.stdout.write.bind(process.stdout);
+  const protocolOut = {
+    write(chunk) {
+      return realWrite(chunk);
+    }
+  };
+  process.stdout.write = ((chunk, ...rest) => process.stderr.write(chunk, ...rest));
+  process.stderr.write(
+    `vg lsp ${VERSION} \u2014 serving ${pathToFileURL(opts.root).href}${opts.offline ? " (offline)" : ""}
+`
+  );
+  new VibgrateLanguageServer(opts, protocolOut);
+}
+
+// src/commands/lsp.ts
+function registerLsp(program) {
+  const cmd = program.command("lsp").description("start the Vibgrate language server (stdio) \u2014 the engine behind the IDE extensions").option(
+    "--diagnostics",
+    "also publish Problems-panel diagnostics (EOL runtime, unmaintained, license change). Off by default: drift is not a defect, and the Problems panel is not ours to fill",
+    false
+  ).action(async function(opts) {
+    const global = readGlobal(this);
+    const root = rootOf(global);
+    startLanguageServer({
+      root,
+      // `--local` is the established air-gap flag across the CLI; honour it
+      // here too, so an offline editor session stays offline.
+      offline: global.local === true,
+      diagnostics: opts.diagnostics === true
+    });
+    await new Promise(() => {
+    });
+  });
+  applyGlobalOptions(cmd);
+}
+
 // src/commands/install.ts
 var SMALL_REPO_FILES = 150;
 function registerInstall(program) {
@@ -1593,7 +2168,7 @@ function registerInstall(program) {
       }
       return;
     }
-    const targets = opts.all ? ASSISTANTS : tools.map(resolve5);
+    const targets = opts.all ? ASSISTANTS : tools.map(resolve6);
     if (targets.length === 0) throw usageError("name an assistant (e.g. `vg install claude`) or use --all / --list");
     const graph = loadGraph(root, global.graph);
     const fileCount = graph ? graph.nodes.filter((n) => n.kind === "file").length : 0;
@@ -1617,7 +2192,7 @@ function registerInstall(program) {
   const uninstall = program.command("uninstall").description("remove vg from an AI assistant").argument("<tools...>", "assistant ids").option("--purge", "also delete the skill file").action(function(tools, opts) {
     const global = readGlobal(this);
     const root = rootOf(global);
-    const results = tools.map(resolve5).map((a) => ({ id: a.id, removed: uninstallAssistant(a, root, !!opts.purge) }));
+    const results = tools.map(resolve6).map((a) => ({ id: a.id, removed: uninstallAssistant(a, root, !!opts.purge) }));
     if (global.json) {
       json({ root, results });
       return;
@@ -1628,7 +2203,7 @@ function registerInstall(program) {
   });
   applyGlobalOptions(uninstall);
 }
-function resolve5(id) {
+function resolve6(id) {
   const a = assistantById(id);
   if (!a) {
     const near = ASSISTANTS.filter(
@@ -1649,7 +2224,7 @@ function registerShare(program) {
     const global = readGlobal(this);
     const root = rootOf(global);
     const gitDir = path.join(root, ".git");
-    if (!fs6.existsSync(gitDir)) {
+    if (!fs7.existsSync(gitDir)) {
       throw new CliError("not a git repository \u2014 run `vg share` inside a git repo", ExitCode.USAGE_ERROR);
     }
     if (opts.undo) {
@@ -1671,22 +2246,22 @@ function registerShare(program) {
 }
 function writeVibgrateGitignore(root, reports) {
   const dir = path.join(root, ".vibgrate");
-  fs6.mkdirSync(dir, { recursive: true });
+  fs7.mkdirSync(dir, { recursive: true });
   const lines = ["# Managed by `vg share` \u2014 keep graph.json committed, ignore the rest", "cache/", "facts.jsonl"];
   if (!reports) lines.push("graph.html", "GRAPH_REPORT.md");
-  fs6.writeFileSync(path.join(dir, ".gitignore"), `${lines.join("\n")}
+  fs7.writeFileSync(path.join(dir, ".gitignore"), `${lines.join("\n")}
 `);
 }
 function writeGitAttributes(root) {
   const file = path.join(root, ".gitattributes");
   const line = ".vibgrate/graph.json merge=vg";
-  let content = fs6.existsSync(file) ? fs6.readFileSync(file, "utf8") : "";
+  let content = fs7.existsSync(file) ? fs7.readFileSync(file, "utf8") : "";
   if (!content.split("\n").some((l) => l.trim() === line)) {
     content = content.length ? `${content.replace(/\s*$/, "")}
 ${line}
 ` : `${line}
 `;
-    fs6.writeFileSync(file, content);
+    fs7.writeFileSync(file, content);
   }
 }
 function configureMergeDriver(root) {
@@ -1695,7 +2270,7 @@ function configureMergeDriver(root) {
 }
 function installPreCommitHook(root) {
   const hooksDir = hookDir(root);
-  fs6.mkdirSync(hooksDir, { recursive: true });
+  fs7.mkdirSync(hooksDir, { recursive: true });
   const file = path.join(hooksDir, "pre-commit");
   const block = [
     HOOK_BEGIN,
@@ -1705,7 +2280,7 @@ function installPreCommitHook(root) {
     "fi",
     HOOK_END
   ].join("\n");
-  let content = fs6.existsSync(file) ? fs6.readFileSync(file, "utf8") : "#!/bin/sh\n";
+  let content = fs7.existsSync(file) ? fs7.readFileSync(file, "utf8") : "#!/bin/sh\n";
   const re = new RegExp(`${escapeRe(HOOK_BEGIN)}[\\s\\S]*?${escapeRe(HOOK_END)}`);
   if (re.test(content)) content = content.replace(re, block);
   else content = `${content.replace(/\s*$/, "")}
@@ -1714,21 +2289,21 @@ ${block}
 `;
   if (!content.startsWith("#!")) content = `#!/bin/sh
 ${content}`;
-  fs6.writeFileSync(file, content);
-  fs6.chmodSync(file, 493);
+  fs7.writeFileSync(file, content);
+  fs7.chmodSync(file, 493);
 }
 function undo(root) {
   const hookFile = path.join(hookDir(root), "pre-commit");
-  if (fs6.existsSync(hookFile)) {
+  if (fs7.existsSync(hookFile)) {
     const re = new RegExp(`\\n*${escapeRe(HOOK_BEGIN)}[\\s\\S]*?${escapeRe(HOOK_END)}\\n*`);
-    const next2 = fs6.readFileSync(hookFile, "utf8").replace(re, "\n");
-    if (next2.trim() === "#!/bin/sh") fs6.rmSync(hookFile);
-    else fs6.writeFileSync(hookFile, next2);
+    const next2 = fs7.readFileSync(hookFile, "utf8").replace(re, "\n");
+    if (next2.trim() === "#!/bin/sh") fs7.rmSync(hookFile);
+    else fs7.writeFileSync(hookFile, next2);
   }
   const attr = path.join(root, ".gitattributes");
-  if (fs6.existsSync(attr)) {
-    const next2 = fs6.readFileSync(attr, "utf8").split("\n").filter((l) => l.trim() !== ".vibgrate/graph.json merge=vg").join("\n");
-    fs6.writeFileSync(attr, next2);
+  if (fs7.existsSync(attr)) {
+    const next2 = fs7.readFileSync(attr, "utf8").split("\n").filter((l) => l.trim() !== ".vibgrate/graph.json merge=vg").join("\n");
+    fs7.writeFileSync(attr, next2);
   }
   try {
     git(root, ["config", "--remove-section", "merge.vg"]);
@@ -1861,7 +2436,7 @@ function grepBaselineTokens(term, files) {
     if (f.size > 512 * 1024) continue;
     let content = "";
     try {
-      content = fs6.readFileSync(f.abs, "utf8");
+      content = fs7.readFileSync(f.abs, "utf8");
     } catch {
       continue;
     }
@@ -1871,7 +2446,7 @@ function grepBaselineTokens(term, files) {
 }
 function safeSize(abs) {
   try {
-    return fs6.statSync(abs).size;
+    return fs7.statSync(abs).size;
   } catch {
     return 0;
   }
@@ -2205,7 +2780,7 @@ function loadStandards(root) {
     const p = path__default.join(root, rel3);
     let text;
     try {
-      text = fs6__default.readFileSync(p, "utf8");
+      text = fs7__default.readFileSync(p, "utf8");
     } catch {
       continue;
     }
@@ -2443,7 +3018,7 @@ async function addCmd(root, rest, opts, asJson) {
 }
 function readPackageVersion(root) {
   try {
-    const pkg = JSON.parse(fs6__default.readFileSync(path__default.join(root, "package.json"), "utf8"));
+    const pkg = JSON.parse(fs7__default.readFileSync(path__default.join(root, "package.json"), "utf8"));
     return typeof pkg.version === "string" ? pkg.version : void 0;
   } catch {
     return void 0;
@@ -2451,7 +3026,7 @@ function readPackageVersion(root) {
 }
 function readOptionalFile(p) {
   try {
-    const t = fs6__default.readFileSync(p, "utf8");
+    const t = fs7__default.readFileSync(p, "utf8");
     return t.trim() ? t : void 0;
   } catch {
     return void 0;
@@ -2535,7 +3110,8 @@ async function showCmd(root, name, budget, asJson, opts = {}) {
   if (online && !quality.sufficient) {
     const dsn = resolveDsn();
     const parsed = dsn ? parseDsn$1(dsn) : null;
-    hosted = await fetchHostedDocs(
+    hosted = await fetchHostedDocsCached(
+      root,
       { name: displayName, query: name, maxTokens: budget },
       { region: opts.region, ingest: opts.ingest, auth: parsed ? { keyId: parsed.keyId, secret: parsed.secret } : void 0 }
     );
@@ -2596,8 +3172,8 @@ function registerExport(program) {
       out(content.trimEnd());
       return;
     }
-    fs6.mkdirSync(path.dirname(path.resolve(file)), { recursive: true });
-    fs6.writeFileSync(file, content);
+    fs7.mkdirSync(path.dirname(path.resolve(file)), { recursive: true });
+    fs7.writeFileSync(file, content);
     info(`${c.green("\u2714")} wrote ${file} ${c.dim(`(${format})`)}`);
   });
   applyGlobalOptions(cmd);
@@ -2620,24 +3196,24 @@ function registerBundle(program) {
     } catch {
       throw new CliError("no grammars found to bundle (run a build first)", ExitCode.ERROR);
     }
-    fs6.mkdirSync(path.join(outDir, "grammars"), { recursive: true });
+    fs7.mkdirSync(path.join(outDir, "grammars"), { recursive: true });
     let grammarCount = 0;
     for (const { fileName, absPath } of grammarFiles) {
-      fs6.copyFileSync(absPath, path.join(outDir, "grammars", fileName));
+      fs7.copyFileSync(absPath, path.join(outDir, "grammars", fileName));
       grammarCount++;
     }
     const included = [`grammars/ (${grammarCount} .wasm)`];
     const graphSrc = global.graph ?? defaultGraphPath(root);
-    if (fs6.existsSync(graphSrc)) {
-      fs6.copyFileSync(graphSrc, path.join(outDir, "graph.json"));
+    if (fs7.existsSync(graphSrc)) {
+      fs7.copyFileSync(graphSrc, path.join(outDir, "graph.json"));
       included.push("graph.json");
     }
     const cat = catalogPath(root);
-    if (fs6.existsSync(cat)) {
-      fs6.copyFileSync(cat, path.join(outDir, "vibgrate.lib.json"));
+    if (fs7.existsSync(cat)) {
+      fs7.copyFileSync(cat, path.join(outDir, "vibgrate.lib.json"));
       included.push("vibgrate.lib.json");
-      if (fs6.existsSync(libDir(root))) {
-        fs6.cpSync(libDir(root), path.join(outDir, "lib"), { recursive: true });
+      if (fs7.existsSync(libDir(root))) {
+        fs7.cpSync(libDir(root), path.join(outDir, "lib"), { recursive: true });
         included.push("lib/");
       }
     }
@@ -2649,7 +3225,7 @@ function registerBundle(program) {
       included,
       usage: "Run `vg build --grammars <this dir>/grammars` to build fully offline."
     };
-    fs6.writeFileSync(path.join(outDir, "MANIFEST.json"), `${stableStringify(manifest, 2)}
+    fs7.writeFileSync(path.join(outDir, "MANIFEST.json"), `${stableStringify(manifest, 2)}
 `);
     if (global.json) {
       json({ out: path.relative(root, outDir), ...manifest });
@@ -2674,7 +3250,7 @@ var initCommand = new Command("init").description("Initialize vibgrate in a proj
     console.log(chalk8.green("\u2714") + ` Created ${chalk8.bold("vibgrate.config.ts")}`);
   }
   if (opts.baseline) {
-    const { runBaseline } = await import('./baseline-V5XGS76K.js');
+    const { runBaseline } = await import('./baseline-BTLZWSNS.js');
     await runBaseline(rootDir);
   }
   console.log("");
@@ -2683,6 +3259,270 @@ var initCommand = new Command("init").description("Initialize vibgrate in a proj
   console.log(`  ${chalk8.cyan("vibgrate baseline")}        Create a drift baseline`);
   console.log("");
 });
+var REACHABILITY_ANALYZER_VERSION = "vg-reach-1.0";
+var ECOSYSTEM_MATCH_CONFIDENCE = {
+  npm: 0.8,
+  Go: 0.8,
+  "crates.io": 0.7,
+  PyPI: 0.65,
+  RubyGems: 0.6
+};
+var GENERIC_SYMBOL_NAMES = /* @__PURE__ */ new Set([
+  "get",
+  "set",
+  "run",
+  "main",
+  "init",
+  "call",
+  "apply",
+  "exec",
+  "send",
+  "open",
+  "read",
+  "write",
+  "parse",
+  "load",
+  "save",
+  "start",
+  "stop",
+  "new",
+  "create",
+  "update",
+  "delete",
+  "handle",
+  "process",
+  "render",
+  "value",
+  "data",
+  "next"
+]);
+var MAX_FILES_PER_PACKAGE = 25;
+var MAX_FILE_BYTES = 256 * 1024;
+var MAX_MODULES_PER_PACKAGE = 50;
+var MAX_IMPORTED_MODULE_PACKAGES = 500;
+var MAX_FINDINGS = 1e3;
+function normalizePython(name) {
+  return name.toLowerCase().replace(/[-.]/g, "_");
+}
+function specifierMatchesPackage(ecosystem, pkg, spec) {
+  switch (ecosystem) {
+    case "npm":
+    case "Go":
+    case "RubyGems":
+      return spec === pkg || spec.startsWith(`${pkg}/`);
+    case "PyPI": {
+      const top = spec.split(".")[0] ?? spec;
+      return normalizePython(top) === normalizePython(pkg);
+    }
+    case "crates.io": {
+      const top = (spec.split("::")[0] ?? spec).toLowerCase().replace(/-/g, "_");
+      return top === pkg.toLowerCase().replace(/-/g, "_");
+    }
+    default:
+      return false;
+  }
+}
+function symbolIdentifier(symbol) {
+  const cleaned = symbol.replace(/\(.*\)$/, "");
+  const segments = cleaned.split(/[./:#]|::/).filter(Boolean);
+  return segments[segments.length - 1] ?? cleaned;
+}
+function isMatchableIdentifier(identifier) {
+  return identifier.length >= 3 && !GENERIC_SYMBOL_NAMES.has(identifier.toLowerCase());
+}
+function collectPackageImports(graph, ecosystem, pkg) {
+  if (!(ecosystem in ECOSYSTEM_MATCH_CONFIDENCE)) {
+    return { supported: false, modules: [], importingFiles: [] };
+  }
+  const idx = indexFor(graph);
+  const modules = /* @__PURE__ */ new Set();
+  const files = /* @__PURE__ */ new Set();
+  for (const node of graph.nodes) {
+    if (node.kind !== "external") continue;
+    if (!specifierMatchesPackage(ecosystem, pkg, node.name)) continue;
+    modules.add(node.name);
+    for (const edge of idx.in(node.id, "import")) {
+      const src = idx.nodeById.get(edge.src);
+      if (src?.file) files.add(src.file);
+    }
+  }
+  return {
+    supported: true,
+    modules: [...modules].sort(),
+    importingFiles: [...files].sort()
+  };
+}
+async function fileReferencesIdentifier(rootDir, relFile, identifier, readFile3) {
+  const content = await readFile3(path.join(rootDir, relFile));
+  if (!content) return false;
+  const escaped = identifier.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
+  return new RegExp(`\\b${escaped}\\b`).test(content);
+}
+async function defaultReadFile(absPath) {
+  try {
+    const stat2 = await fs13.stat(absPath);
+    if (!stat2.isFile() || stat2.size > MAX_FILE_BYTES) return null;
+    return await fs13.readFile(absPath, "utf8");
+  } catch {
+    return null;
+  }
+}
+async function analyzeReachability(input) {
+  const generatedAt = (/* @__PURE__ */ new Date()).toISOString();
+  const readFile3 = input.readFile ?? defaultReadFile;
+  if (!input.graph) {
+    return {
+      analyzerVersion: REACHABILITY_ANALYZER_VERSION,
+      source: "none",
+      generatedAt,
+      manifestAdvisoryCount: input.manifest.length,
+      findings: input.manifest.slice(0, MAX_FINDINGS).map((entry) => ({
+        advisoryId: entry.advisoryId,
+        ecosystem: entry.ecosystem,
+        package: entry.package,
+        version: entry.version,
+        tier: "unknown",
+        evidence: "no code map available for this scan",
+        graphConfidence: 0
+      }))
+    };
+  }
+  const evidenceByPackage = /* @__PURE__ */ new Map();
+  const importedModules = [];
+  const seenPackages = /* @__PURE__ */ new Set();
+  for (const dep of input.dependencies) {
+    const key = `${dep.ecosystem}|${dep.package}`;
+    if (seenPackages.has(key)) continue;
+    seenPackages.add(key);
+    const evidence = collectPackageImports(input.graph, dep.ecosystem, dep.package);
+    evidenceByPackage.set(key, evidence);
+    if (evidence.supported && importedModules.length < MAX_IMPORTED_MODULE_PACKAGES) {
+      importedModules.push({
+        ecosystem: dep.ecosystem,
+        package: dep.package,
+        modules: evidence.modules.slice(0, MAX_MODULES_PER_PACKAGE),
+        importingFiles: evidence.importingFiles.length
+      });
+    }
+  }
+  importedModules.sort(
+    (a, b) => a.ecosystem.localeCompare(b.ecosystem) || a.package.localeCompare(b.package)
+  );
+  const findings = [];
+  for (const entry of input.manifest) {
+    const key = `${entry.ecosystem}|${entry.package}`;
+    const evidence = evidenceByPackage.get(key) ?? collectPackageImports(input.graph, entry.ecosystem, entry.package);
+    const baseConfidence = ECOSYSTEM_MATCH_CONFIDENCE[entry.ecosystem] ?? 0;
+    if (!evidence.supported) {
+      findings.push({
+        advisoryId: entry.advisoryId,
+        ecosystem: entry.ecosystem,
+        package: entry.package,
+        version: entry.version,
+        tier: "unknown",
+        evidence: `import matching is not supported for the ${entry.ecosystem} ecosystem yet`,
+        graphConfidence: 0
+      });
+      continue;
+    }
+    if (evidence.importingFiles.length === 0) {
+      findings.push({
+        advisoryId: entry.advisoryId,
+        ecosystem: entry.ecosystem,
+        package: entry.package,
+        version: entry.version,
+        tier: "not_reached",
+        evidence: `no import of ${entry.package} was found in the code map`,
+        graphConfidence: baseConfidence
+      });
+      continue;
+    }
+    const matchableSymbols = entry.symbols.map((s) => ({ symbol: s.symbol, identifier: symbolIdentifier(s.symbol) })).filter((s) => isMatchableIdentifier(s.identifier));
+    if (entry.symbolCoverage !== "function" || matchableSymbols.length === 0) {
+      findings.push({
+        advisoryId: entry.advisoryId,
+        ecosystem: entry.ecosystem,
+        package: entry.package,
+        version: entry.version,
+        tier: "potentially_reachable",
+        evidence: `${entry.package} is imported by ${evidence.importingFiles.length} file${evidence.importingFiles.length === 1 ? "" : "s"}; vulnerable symbols unresolved (coverage: ${entry.symbolCoverage})`,
+        callPath: evidence.importingFiles.slice(0, 10),
+        graphConfidence: Math.min(baseConfidence, 0.6)
+      });
+      continue;
+    }
+    const filesToCheck = evidence.importingFiles.slice(0, MAX_FILES_PER_PACKAGE);
+    let anySymbolFound = false;
+    for (const { symbol, identifier } of matchableSymbols) {
+      const referencingFiles = [];
+      for (const relFile of filesToCheck) {
+        if (await fileReferencesIdentifier(input.rootDir, relFile, identifier, readFile3)) {
+          referencingFiles.push(relFile);
+          if (referencingFiles.length >= 5) break;
+        }
+      }
+      if (referencingFiles.length > 0) {
+        anySymbolFound = true;
+        findings.push({
+          advisoryId: entry.advisoryId,
+          ecosystem: entry.ecosystem,
+          package: entry.package,
+          version: entry.version,
+          symbol,
+          tier: "reachable",
+          evidence: `vulnerable symbol \`${identifier}\` is referenced in ${referencingFiles.length} importing file${referencingFiles.length === 1 ? "" : "s"}`,
+          callPath: referencingFiles,
+          graphConfidence: Math.min(baseConfidence, 0.75)
+        });
+      }
+    }
+    if (!anySymbolFound) {
+      findings.push({
+        advisoryId: entry.advisoryId,
+        ecosystem: entry.ecosystem,
+        package: entry.package,
+        version: entry.version,
+        tier: "not_reached",
+        evidence: `${entry.package} is imported, but none of its ${matchableSymbols.length} vulnerable symbol${matchableSymbols.length === 1 ? "" : "s"} is referenced in the ${filesToCheck.length} importing file${filesToCheck.length === 1 ? "" : "s"} checked`,
+        callPath: evidence.importingFiles.slice(0, 10),
+        graphConfidence: Math.min(baseConfidence, 0.55)
+      });
+    }
+  }
+  findings.sort(
+    (a, b) => a.ecosystem.localeCompare(b.ecosystem) || a.package.localeCompare(b.package) || a.advisoryId.localeCompare(b.advisoryId) || (a.symbol ?? "").localeCompare(b.symbol ?? "")
+  );
+  return {
+    analyzerVersion: REACHABILITY_ANALYZER_VERSION,
+    source: "graph",
+    generatedAt,
+    manifestAdvisoryCount: input.manifest.length,
+    importedModules,
+    findings: findings.slice(0, MAX_FINDINGS)
+  };
+}
+function collectPreflightDependencies(projects, projectTypeToEcosystem) {
+  const deduped = /* @__PURE__ */ new Map();
+  for (const project of projects) {
+    const ecosystem = projectTypeToEcosystem[project.type];
+    if (!ecosystem) continue;
+    for (const dep of project.dependencies) {
+      const version = dep.resolvedVersion || normalizeVersionSpec(dep.currentSpec);
+      if (!version) continue;
+      const key = `${ecosystem}:${dep.package}:${version}`;
+      if (!deduped.has(key)) {
+        deduped.set(key, { ecosystem, package: dep.package, version });
+      }
+    }
+  }
+  return [...deduped.values()].sort(
+    (a, b) => a.ecosystem.localeCompare(b.ecosystem) || a.package.localeCompare(b.package) || a.version.localeCompare(b.version)
+  );
+}
+function normalizeVersionSpec(spec) {
+  const match = spec.trim().match(/\d+\.\d+\.\d+(?:[-+][0-9A-Za-z.-]+)?/);
+  return match?.[0] ?? null;
+}
 
 // src/reporting/utils/ingest-id-output.ts
 function emitIngestIdLine(ingestId, options) {
@@ -2738,6 +3578,47 @@ function printAiContextPrompt(detectedAssistant) {
 function shouldBuildCodeMap(opts) {
   return opts.graph !== false && !opts.maxPrivacy && !opts.noLocalArtifacts;
 }
+async function attachReachability(artifact, rootDir, opts, graph) {
+  try {
+    const dsn = resolveDsn(opts.dsn);
+    if (!dsn) return;
+    const parsed = parseDsn(dsn);
+    if (!parsed) return;
+    const ingestHost = opts.region ? resolveIngestHost(opts.region) : parsed.host;
+    const dependencies = collectPreflightDependencies(artifact.projects, PROJECT_TYPE_TO_OSV_ECOSYSTEM);
+    if (dependencies.length === 0) return;
+    const manifest = await fetchRiskySymbols(parsed, ingestHost, dependencies);
+    if (manifest.status !== "ok" || !manifest.advisories) return;
+    artifact.reachability = await analyzeReachability({
+      graph,
+      rootDir,
+      manifest: manifest.advisories,
+      dependencies
+    });
+    if (!opts.quiet && manifest.advisories.length > 0) {
+      const tiers = artifact.reachability.findings.reduce((acc, f) => {
+        acc[f.tier] = (acc[f.tier] ?? 0) + 1;
+        return acc;
+      }, {});
+      const parts = [
+        tiers.reachable ? `${tiers.reachable} reachable` : null,
+        tiers.potentially_reachable ? `${tiers.potentially_reachable} potentially reachable` : null,
+        tiers.not_reached ? `${tiers.not_reached} not reached` : null,
+        tiers.unknown ? `${tiers.unknown} unknown` : null
+      ].filter(Boolean);
+      console.log(
+        chalk8.dim(
+          `Reachability: ${manifest.advisories.length} advisor${manifest.advisories.length === 1 ? "y" : "ies"} checked against the code map \u2014 ${parts.join(", ")}`
+        )
+      );
+    }
+  } catch (e) {
+    if (!opts.quiet) {
+      const msg = e instanceof Error ? e.message : String(e);
+      console.log(chalk8.dim(`Reachability check skipped: ${msg}`));
+    }
+  }
+}
 async function autoPush(artifact, rootDir, opts) {
   const dsn = resolveDsn(opts.dsn);
   if (!dsn) {
@@ -2752,7 +3633,9 @@ async function autoPush(artifact, rootDir, opts) {
     if (opts.strict) process.exit(1);
     return;
   }
-  const { body, contentEncoding } = await prepareCompressedUpload(artifact);
+  const config = await loadConfig(rootDir);
+  const databaseSchemaCaps = config.scanners !== false ? config.scanners?.databaseSchema : void 0;
+  const { body, contentEncoding } = await prepareCompressedUpload(artifact, { databaseSchemaCaps });
   const timestamp = String(Date.now());
   let host = parsed.host;
   if (opts.region) {
@@ -2777,7 +3660,11 @@ async function autoPush(artifact, rootDir, opts) {
       body,
       contentEncoding,
       timestamp,
-      force: opts.force
+      force: opts.force,
+      // Set only by an automated caller running the scan on the workspace's
+      // behalf (e.g. a Vibgrate-hosted remediation run) — never a customer flag.
+      runId: process.env.VIBGRATE_SCAN_RUN_ID,
+      runToken: process.env.VIBGRATE_SCAN_RUN_TOKEN
     });
     host = uploadedHost;
     if (!response.ok) {
@@ -2852,7 +3739,7 @@ var scanCommand = new Command("scan").description("Scan a project for upgrade dr
   'Exclude paths matching a glob pattern. Repeatable, and a single value may list several patterns separated by commas or semicolons (e.g. --exclude "legacy/**,vendor/**"). Merged with excludes from the config file.',
   collectExcludes,
   []
-).option("--concurrency <n>", "Max concurrent npm calls", "8").option("--push", "Auto-push results to Vibgrate API after scan").option("--dsn <dsn>", "DSN token for push (or use VIBGRATE_DSN env)").option("--region <region>", "Override data residency region for push (us, eu)").option("--strict", "Fail on push errors").option("--ui-purpose", "Enable optional UI purpose evidence extraction (slower)").option("--no-local-artifacts", "Do not write .vibgrate JSON artifacts to disk").option("--max-privacy", "Enable strongest privacy mode (minimal scanners, no local artifacts)").option("--offline", "Run without network calls; do not upload results").option("--full", "Comprehensive scan: turns on known-vulnerability detection (= --vulns) and, when a standards policy exists, a banned-dependency report \u2014 on top of drift scoring and the code map").option("--vulns", "Also scan installed dependencies for known vulnerabilities (OSV online, or advisories from --package-manifest when offline)").option("--package-manifest <file>", "Use local package-version manifest JSON/ZIP (for offline mode)").option("--project-scan-timeout <seconds>", "Per-project scan timeout in seconds (default: 180)").option("--drift-budget <score>", "Fail if drift score is above budget (0-100)").option("--drift-worsening <percent>", "Fail if drift worsens by more than % since baseline").option("--repository-name <name>", "Override the repository name recorded for this scan (defaults to the directory or package.json name)").option("--force", "Always create a fresh scan ingest, even if the repository is unchanged since the last scan (skips the unchanged/reuse optimization). Used by scheduled and dashboard-triggered scans.").option("--no-graph", "Skip building the local code map (the AI/docs index) that scan produces after scoring drift").option("--quiet", "Suppress promotional output (the free-plan tracking panel and the AI Context install prompt); scan results are unaffected").action(async (targetPath, opts) => {
+).option("--concurrency <n>", "Max concurrent npm calls", "8").option("--push", "Auto-push results to Vibgrate API after scan").option("--dsn <dsn>", "DSN token for push (or use VIBGRATE_DSN env)").option("--region <region>", "Override data residency region for push (us, eu)").option("--strict", "Fail on push errors").option("--ui-purpose", "Enable optional UI purpose evidence extraction (slower)").option("--no-local-artifacts", "Do not write .vibgrate JSON artifacts to disk").option("--max-privacy", "Enable strongest privacy mode (minimal scanners, no local artifacts)").option("--offline", "Run without network calls; do not upload results").option("--full", "Comprehensive scan: turns on known-vulnerability detection (= --vulns) and, when a standards policy exists, a banned-dependency report \u2014 on top of drift scoring and the code map").option("--vulns", "Also scan installed dependencies for known vulnerabilities (OSV online, or advisories from --package-manifest when offline)").option("--package-manifest <file>", "Use local package-version manifest JSON/ZIP (for offline mode)").option("--project-scan-timeout <seconds>", "Per-project scan timeout in seconds (default: 180)").option("--drift-budget <score>", "Fail if DriftScore is above budget (0-100)").option("--drift-worsening <percent>", "Fail if drift worsens by more than % since baseline").option("--repository-name <name>", "Override the repository name recorded for this scan (defaults to the directory or package.json name)").option("--force", "Always create a fresh scan ingest, even if the repository is unchanged since the last scan (skips the unchanged/reuse optimization). Used by scheduled and dashboard-triggered scans.").option("--no-graph", "Skip building the local code map (the AI/docs index) that scan produces after scoring drift").option("--quiet", "Suppress promotional output (the free-plan tracking panel and the AI Context install prompt); scan results are unaffected").action(async (targetPath, opts) => {
   const rootDir = path.resolve(targetPath);
   if (!await pathExists$1(rootDir)) {
     console.error(chalk8.red(`Path does not exist: ${rootDir}`));
@@ -2987,6 +3874,7 @@ var scanCommand = new Command("scan").description("Scan a project for upgrade dr
     invocation: resolveCliInvocation()
   };
   const wantGraph = shouldBuildCodeMap({ graph: opts.graph, maxPrivacy: opts.maxPrivacy, noLocalArtifacts });
+  let builtGraph = null;
   if (wantGraph) {
     scanOpts.postScan = async (report) => {
       const result = await buildGraph({
@@ -2994,6 +3882,7 @@ var scanCommand = new Command("scan").description("Scan a project for upgrade dr
         exclude: opts.exclude,
         onParseProgress: (done, total) => report(done, total, "parsing")
       });
+      builtGraph = result.graph;
       writeArtifacts(result.graph, { root: rootDir });
       writeSnapshot(rootDir, result.graph.provenance.corpusHash, result.fileStats, {
         exclude: opts.exclude
@@ -3024,7 +3913,7 @@ Failing: findings detected at warn level or above.`));
   }
   if (scanOpts.driftBudget !== void 0 && artifact.drift.score > scanOpts.driftBudget) {
     console.error(chalk8.red(`
-Failing fitness function: drift score ${artifact.drift.score}/100 exceeds budget ${scanOpts.driftBudget}.`));
+Failing fitness function: DriftScore ${artifact.drift.score}/100 exceeds budget ${scanOpts.driftBudget}.`));
     process.exit(2);
   }
   if (scanOpts.driftWorseningPercent !== void 0) {
@@ -3043,6 +3932,9 @@ Failing fitness function: drift worsened by ${worseningPercent.toFixed(2)}% (thr
       }
     }
   }
+  if (willPush && hasDsn && builtGraph) {
+    await attachReachability(artifact, rootDir, scanOpts, builtGraph);
+  }
   if (willPush) {
     await autoPush(artifact, rootDir, scanOpts);
   }
@@ -3115,7 +4007,7 @@ var SKIP_DIRS = /* @__PURE__ */ new Set([
 function scanStaleness(rootDir, artifactPath) {
   let ref;
   try {
-    ref = fs6.statSync(artifactPath).mtimeMs;
+    ref = fs7.statSync(artifactPath).mtimeMs;
   } catch {
     return { stale: false };
   }
@@ -3127,7 +4019,7 @@ function scanStaleness(rootDir, artifactPath) {
     if (depth > 8 || scanned > MAX_ENTRIES) return;
     let entries;
     try {
-      entries = fs6.readdirSync(dir, { withFileTypes: true });
+      entries = fs7.readdirSync(dir, { withFileTypes: true });
     } catch {
       return;
     }
@@ -3142,7 +4034,7 @@ function scanStaleness(rootDir, artifactPath) {
       const abs = path.join(dir, e.name);
       let mtimeMs;
       try {
-        mtimeMs = fs6.statSync(abs).mtimeMs;
+        mtimeMs = fs7.statSync(abs).mtimeMs;
       } catch {
         continue;
       }
@@ -3229,7 +4121,7 @@ var SKIP_DIRS2 = /* @__PURE__ */ new Set([
 ]);
 var MAX_FILES = 8e3;
 var MAX_DEPTH = 12;
-var MAX_FILE_BYTES = 1048576;
+var MAX_FILE_BYTES2 = 1048576;
 var EXT_ECOSYSTEM = {
   ".ts": "npm",
   ".tsx": "npm",
@@ -3276,7 +4168,7 @@ function analyzeTree(root, packages) {
     if (depth > MAX_DEPTH || filesSeen >= MAX_FILES) return;
     let entries;
     try {
-      entries = fs6.readdirSync(dir, { withFileTypes: true });
+      entries = fs7.readdirSync(dir, { withFileTypes: true });
     } catch {
       return;
     }
@@ -3294,8 +4186,8 @@ function analyzeTree(root, packages) {
       const full = path.join(dir, entry.name);
       let content;
       try {
-        if (fs6.statSync(full).size > MAX_FILE_BYTES) continue;
-        content = fs6.readFileSync(full, "utf8");
+        if (fs7.statSync(full).size > MAX_FILE_BYTES2) continue;
+        content = fs7.readFileSync(full, "utf8");
       } catch {
         continue;
       }
@@ -3486,6 +4378,11 @@ function estimateDriftScore(artifact, upgraded) {
     for (const dep of p.dependencies ?? []) {
       if (!upgraded.has(dep.package)) continue;
       const mb3 = dep.majorsBehind ?? 0;
+      dep.majorsBehind = 0;
+      dep.drift = "current";
+      if (dep.libyears != null) dep.libyears = 0;
+      if (dep.ageDays != null) dep.ageDays = 0;
+      if (dep.latestStable) dep.resolvedVersion = dep.latestStable;
       if (mb3 >= 2 && buckets.twoPlusBehind > 0) {
         buckets.twoPlusBehind--;
         buckets.current++;
@@ -3629,8 +4526,8 @@ async function fetchLatestVersion() {
 }
 async function writeCache(data) {
   try {
-    await fs15.mkdir(CACHE_DIR, { recursive: true });
-    await fs15.writeFile(CACHE_FILE, JSON.stringify(data), "utf-8");
+    await fs13.mkdir(CACHE_DIR, { recursive: true });
+    await fs13.writeFile(CACHE_FILE, JSON.stringify(data), "utf-8");
   } catch {
   }
 }
@@ -3707,11 +4604,11 @@ async function isDevDependency(cwd) {
 async function confirmWorkspaceRoot(pm) {
   if (!(process.stdin.isTTY && process.stdout.isTTY)) return false;
   const rl = readline.createInterface({ input: process.stdin, output: process.stdout });
-  return new Promise((resolve16) => {
+  return new Promise((resolve17) => {
     rl.question(chalk8.yellow(`Update the ${pm} workspace root with -w? [y/N]: `), (ans) => {
       rl.close();
       const t = ans.trim().toLowerCase();
-      resolve16(t === "y" || t === "yes");
+      resolve17(t === "y" || t === "yes");
     });
   });
 }
@@ -3839,7 +4736,7 @@ async function repositoryIdentity(rootDir, override) {
     return { name: override?.trim() || void 0 };
   }
 }
-var fixCommand = new Command("fix").description("Analyse drift and get ranked, risk-tiered upgrade plans from the hosted planner (requires login/DSN; read-only \u2014 never edits your project)").argument("[path]", "Path to analyse", ".").option("--in <file>", "Scan artifact to read", ".vibgrate/scan_result.json").option("--format <format>", "Output format (text|json|md)", "text").option("--dsn <dsn>", 'DSN token (or use VIBGRATE_DSN env / "vg login")').option("--region <region>", "Override data residency region (us, eu)").option("--repository-name <name>", "Override the repository name recorded for this plan").option("--plan <tier>", "Apply a specific plan non-interactively (safe|balanced|aggressive)").option("--yes", "Apply the recommended plan without prompting").option("--dry-run", "Show what would change without applying").option("--no-apply", "Only print the plans; never modify the project").option("--fail-on-vulns <severity>", "Exit non-zero if the recommended plan leaves an advisory at/above this severity unresolved (low|moderate|high|critical)").action(async (targetPath, opts) => {
+var fixCommand = new Command("fix").description("Get ranked, risk-tiered upgrade plans from the hosted planner and optionally apply them (prompts before changing files; --yes applies non-interactively, --dry-run previews, --no-apply only prints). Requires login/DSN.").argument("[path]", "Path to analyse", ".").option("--in <file>", "Scan artifact to read", ".vibgrate/scan_result.json").option("--format <format>", "Output format (text|json|md)", "text").option("--dsn <dsn>", 'DSN token (or use VIBGRATE_DSN env / "vg login")').option("--region <region>", "Override data residency region (us, eu)").option("--repository-name <name>", "Override the repository name recorded for this plan").option("--plan <tier>", "Apply a specific plan non-interactively (safe|balanced|aggressive)").option("--yes", "Apply the recommended plan without prompting").option("--dry-run", "Show what would change without applying").option("--no-apply", "Only print the plans; never modify the project").option("--fail-on-vulns <severity>", "Exit non-zero if the recommended plan leaves an advisory at/above this severity unresolved (low|moderate|high|critical)").action(async (targetPath, opts) => {
   const rootDir = path.resolve(targetPath);
   if (!await pathExists(rootDir)) {
     console.error(chalk8.red(`Path does not exist: ${rootDir}`));
@@ -4038,14 +4935,14 @@ function promptPlanSelection(response) {
   const defaultIdx = plans.findIndex((p) => p.tier === response.recommended);
   const def = defaultIdx >= 0 ? defaultIdx + 1 : 1;
   const rl = readline.createInterface({ input: process.stdin, output: process.stdout });
-  return new Promise((resolve16) => {
+  return new Promise((resolve17) => {
     rl.question(`Plan [1-${plans.length}, default ${def}, q to cancel]: `, (ans) => {
       rl.close();
       const t = ans.trim().toLowerCase();
-      if (t === "q" || t === "quit") return resolve16(null);
+      if (t === "q" || t === "quit") return resolve17(null);
       const n = t === "" ? def : Number.parseInt(t, 10);
-      if (!Number.isInteger(n) || n < 1 || n > plans.length) return resolve16(null);
-      resolve16(plans[n - 1].tier);
+      if (!Number.isInteger(n) || n < 1 || n > plans.length) return resolve17(null);
+      resolve17(plans[n - 1].tier);
     });
   });
 }
@@ -4416,6 +5313,26 @@ function formatExtended(ext) {
     }
     lines.push("");
   }
+  if (ext.databaseSchema) {
+    const ds = ext.databaseSchema;
+    lines.push(chalk8.bold.underline("  Database Schema"));
+    const dsHead = [];
+    if (ds.providers.length > 0) dsHead.push(ds.providers.join(", "));
+    dsHead.push(`${ds.models.length} model${ds.models.length !== 1 ? "s" : ""}`);
+    dsHead.push(`${ds.enums.length} enum${ds.enums.length !== 1 ? "s" : ""}`);
+    lines.push(`    ${dsHead.join(" \xB7 ")}`);
+    const bySource = /* @__PURE__ */ new Map();
+    for (const m of ds.models) bySource.set(m.source, (bySource.get(m.source) ?? 0) + 1);
+    if (bySource.size > 1) {
+      const sourceSummary = [...bySource.entries()].sort(([a], [b]) => a.localeCompare(b)).map(([s, n]) => `${s}: ${n}`).join(", ");
+      lines.push(`    Sources: ${sourceSummary}`);
+    }
+    if (ds.models.length > 0) {
+      const preview = ds.models.slice(0, 5).map((m) => m.name).join(", ");
+      lines.push(`    Models: ${chalk8.white(preview)}${ds.models.length > 5 ? chalk8.dim(` (+${ds.models.length - 5} more)`) : ""}`);
+    }
+    lines.push("");
+  }
   if (ext.dependencyGraph) {
     const dg = ext.dependencyGraph;
     if (dg.lockfileType) {
@@ -4857,7 +5774,7 @@ function openUrl(url) {
 }
 
 // src/reporting/commands/login.ts
-var delay = (ms) => new Promise((resolve16) => setTimeout(resolve16, ms));
+var delay = (ms) => new Promise((resolve17) => setTimeout(resolve17, ms));
 function isInside(dir, file) {
   const rel3 = path.relative(dir, file);
   return !!rel3 && !rel3.startsWith("..") && !path.isAbsolute(rel3);
@@ -5304,7 +6221,7 @@ function formatDeltaText(base, current) {
     "===================",
     `Baseline: ${base.timestamp}`,
     `Current:  ${current.timestamp}`,
-    `Drift score delta: ${(current.drift.score - base.drift.score).toFixed(2)} points`,
+    `DriftScore delta: ${(current.drift.score - base.drift.score).toFixed(2)} points`,
     "",
     `Added dependencies (${added.length})`,
     ...added.map((d) => `  + ${d}`),
@@ -5382,6 +6299,7 @@ var KNOWN_COMMANDS = /* @__PURE__ */ new Set([
   "areas",
   "oddities",
   "serve",
+  "lsp",
   "install",
   "uninstall",
   "share",
@@ -5422,6 +6340,7 @@ ${aliasNote}Docs: https://vibgrate.com/help`;
   registerImpact(program);
   registerUnknowns(program);
   registerServe(program);
+  registerLsp(program);
   registerInstall(program);
   registerShare(program);
   registerBenchmark(program);
@@ -5503,7 +6422,7 @@ function dispatch(argv, cwd) {
   }
   const looksLikeQuestion = /\s/.test(first) || first.endsWith("?");
   if (looksLikeQuestion) return ["ask", ...args];
-  if (fs6.existsSync(path.resolve(cwd, first))) {
+  if (fs7.existsSync(path.resolve(cwd, first))) {
     return [hasBuildOnlyFlag(args) ? "build" : "scan", ...args];
   }
   const moved = MOVED_COMMANDS[first];