@vibgrate/cli 2026.711.2 → 2026.717.1

package/dist/{chunk-NNU2PW2H.js → chunk-M62BGJMK.js}

@@ -1,5 +1,5 @@
 import { redactUrlCredentials } from './chunk-RXP66R2E.js';
-import { pathExists, readJsonFile, Semaphore, FileCache, quickTreeCount, ensureDir, writeJsonFile, writeTextFile, readTextFile, findPackageJsonFiles, findFiles, findSolutionFiles } from './chunk-GI6W53LM.js';
+import { pathExists, readTextFile, readJsonFile, Semaphore, FileCache, quickTreeCount, ensureDir, writeJsonFile, writeTextFile, findPackageJsonFiles, findFiles, findSolutionFiles } from './chunk-GI6W53LM.js';
 import * as path29 from 'path';
 import { basename, dirname } from 'path';
 import chalk3 from 'chalk';
@@ -19,7 +19,7 @@ import * as zlib from 'zlib';
 import { promisify } from 'util';
 
 // src/version.ts
-var VERSION = "2026.711.2";
+var VERSION = "2026.717.1";
 var TOP_LEVEL_NODE_MODULES = /^node_modules\/((?:@[^/]+\/)?[^/]+)$/;
 function parsePackageLock(json) {
   const out = /* @__PURE__ */ new Map();
@@ -977,14 +977,6 @@ function aggregateLibyears(values) {
   if (measured === 0) return null;
   return { total, max, measured };
 }
-function freshnessScoreFromLibyears(agg) {
-  if (!agg || agg.measured === 0) return null;
-  const avg = agg.total / agg.measured;
-  const avgPenalty = Math.min(avg * 20, 100);
-  const maxPenalty = Math.min(agg.max * 10, 100);
-  const score = 100 - (avgPenalty * 0.7 + maxPenalty * 0.3);
-  return Math.max(0, Math.min(100, Math.round(score)));
-}
 
 // src/core-open/runtimes/catalog.ts
 function productForType(type) {
@@ -1178,6 +1170,8 @@ var BUNDLED_RUNTIME_CATALOG = {
 };
 
 // src/core-open/scanners/node-scanner.ts
+var MS_PER_DAY2 = 864e5;
+var ABANDONED_MAX_DAYS = 730;
 var KNOWN_FRAMEWORKS = {
   // ── Frontend ──
   "react": "React",
@@ -1445,6 +1439,14 @@ async function scanOnePackageJson(packageJsonPath, rootDir, npmCache, cache, cat
     }
     const ageDays = ageDaysBetween(resolvedVersion, latestStable2, meta.releaseDates);
     const libyears = daysToLibyears(ageDays);
+    const latestIso = latestStable2 ? meta.releaseDates?.[latestStable2] : void 0;
+    let abandoned = false;
+    if (latestIso) {
+      const publishedMs = Date.parse(latestIso);
+      if (!Number.isNaN(publishedMs)) {
+        abandoned = (Date.now() - publishedMs) / MS_PER_DAY2 > ABANDONED_MAX_DAYS;
+      }
+    }
     dependencies.push({
       package: pkg,
       section,
@@ -1455,7 +1457,8 @@ async function scanOnePackageJson(packageJsonPath, rootDir, npmCache, cache, cat
       drift,
       license: buildDependencyLicense(meta.license, "registry"),
       ageDays,
-      libyears
+      libyears,
+      ...abandoned ? { abandoned: true } : {}
     });
     if (pkg in KNOWN_FRAMEWORKS) {
       frameworks.push({
@@ -1741,10 +1744,10 @@ function parseTfmMajor(tfm) {
   return null;
 }
 function isDotnetProjectFile(name) {
-  return name.endsWith(".csproj") || name.endsWith(".vbproj");
+  return name.endsWith(".csproj") || name.endsWith(".vbproj") || name.endsWith(".sqlproj");
 }
 function stripDotnetProjectExtension(filePath) {
-  return path29.basename(filePath).replace(/\.(cs|vb)proj$/i, "");
+  return path29.basename(filePath).replace(/\.(cs|vb|sql)proj$/i, "");
 }
 function parseDotnetProjectFile(xml, filePath) {
   const parsed = parser.parse(xml);
@@ -1813,7 +1816,7 @@ async function scanDotnetProjects(rootDir, nugetCache, cache, projectScanTimeout
     try {
       const slnContent = cache ? await cache.readTextFile(slnPath) : await readTextFile(slnPath);
       const slnDir = path29.dirname(slnPath);
-      const projectRegex = /Project\("[^"]*"\)\s*=\s*"[^"]*",\s*"([^"]+\.(?:cs|vb)proj)"/g;
+      const projectRegex = /Project\("[^"]*"\)\s*=\s*"[^"]*",\s*"([^"]+\.(?:cs|vb|sql)proj)"/g;
       let match;
       while ((match = projectRegex.exec(slnContent)) !== null) {
         if (match[1]) {
@@ -6604,7 +6607,166 @@ var PubCache = class {
     return p;
   }
 };
-var DRIFT_SCORE_METHODOLOGY_VERSION = "driftscore-2.0";
+
+// src/core-open/scoring/dependency-drift-v3.ts
+var POINTS_PER_LIBYEAR = 25;
+var TIME_WEIGHT = 0.55;
+var VERSION_WEIGHT = 0.45;
+var UNSUPPORTED_FLOOR = 70;
+var ABANDONED_FLOOR = 50;
+var AGG_MEAN_WEIGHT = 0.5;
+var AGG_P95_WEIGHT = 0.3;
+var AGG_UNSUPPORTED_SHARE_WEIGHT = 0.2;
+var WEIGHT_DIRECT_PROD = 1;
+var WEIGHT_DIRECT_DEV = 0.5;
+var WEIGHT_TRANSITIVE = 0.4;
+var CANARY_MAJOR_THRESHOLD = 900;
+var SCHEME_JUMP_MAX_MAJORS = 20;
+var HIGH_CADENCE_TIME_CAP = 50;
+var PLACEHOLDER_STUBS = /* @__PURE__ */ new Set([
+  "fs",
+  "crypto",
+  "path",
+  "util",
+  "os",
+  "events",
+  "stream",
+  "http",
+  "https",
+  "assert",
+  "buffer",
+  "punycode",
+  "querystring",
+  "url",
+  "zlib",
+  "domain"
+]);
+var HIGH_CADENCE_PREFIXES = [
+  "@aws-sdk/",
+  "aws-sdk",
+  "@google-cloud/",
+  "@azure/"
+];
+function clamp(v, min, max) {
+  return Math.min(max, Math.max(min, v));
+}
+function majorOf(version) {
+  if (!version) return null;
+  const m = /^\D*(\d+)/.exec(version);
+  return m ? Number(m[1]) : null;
+}
+function isHighCadence(pkg) {
+  return HIGH_CADENCE_PREFIXES.some((p) => pkg === p || pkg.startsWith(p));
+}
+function versionDriftPoints(dep) {
+  const mb = dep.majorsBehind;
+  if (mb === null || mb === void 0) return 0;
+  if (mb <= 0) {
+    return dep.drift === "current" ? 0 : 15;
+  }
+  if (mb === 1) return 45;
+  if (mb === 2) return 70;
+  if (mb === 3) return 85;
+  return 100;
+}
+function timeDriftPoints(libyears) {
+  if (libyears === null || libyears === void 0 || Number.isNaN(libyears)) return null;
+  return clamp(libyears * POINTS_PER_LIBYEAR, 0, 100);
+}
+function perDependencyDrift(dep, ctx = {}) {
+  const flags = [];
+  if (PLACEHOLDER_STUBS.has(dep.package)) {
+    return {
+      package: dep.package,
+      drift: 0,
+      mode: "estimated",
+      unsupported: false,
+      weight: 0,
+      flags: ["placeholder-stub"],
+      excluded: true
+    };
+  }
+  const latestMajor = majorOf(dep.latestStable);
+  let versionReliable = true;
+  if (latestMajor !== null && latestMajor >= CANARY_MAJOR_THRESHOLD) {
+    versionReliable = false;
+    flags.push("canary-latest");
+  }
+  if (dep.majorsBehind !== null && dep.majorsBehind !== void 0 && dep.majorsBehind > SCHEME_JUMP_MAX_MAJORS) {
+    versionReliable = false;
+    flags.push("scheme-jump");
+  }
+  const highCadence = isHighCadence(dep.package);
+  if (highCadence) flags.push("high-cadence-damped");
+  const V = versionReliable ? versionDriftPoints(dep) : 0;
+  let T = timeDriftPoints(dep.libyears);
+  if (T !== null && highCadence) T = Math.min(T, HIGH_CADENCE_TIME_CAP);
+  let base;
+  let mode;
+  if (T !== null) {
+    mode = "verified";
+    base = versionReliable ? TIME_WEIGHT * T + VERSION_WEIGHT * V : T;
+  } else {
+    mode = "estimated";
+    base = V;
+  }
+  const unsupported = ctx.unsupported === true;
+  if (unsupported) {
+    base = Math.max(base, UNSUPPORTED_FLOOR);
+    flags.push("unsupported-floor");
+  }
+  if (ctx.abandoned === true) {
+    base = Math.max(base, ABANDONED_FLOOR);
+    flags.push("abandoned-floor");
+  }
+  const weight = ctx.transitive === true ? WEIGHT_TRANSITIVE : dep.section === "devDependencies" ? WEIGHT_DIRECT_DEV : WEIGHT_DIRECT_PROD;
+  return {
+    package: dep.package,
+    drift: clamp(Math.round(base), 0, 100),
+    mode,
+    unsupported,
+    weight,
+    flags,
+    excluded: false
+  };
+}
+function percentile(values, p) {
+  if (values.length === 0) return 0;
+  const sorted = [...values].sort((a, b) => a - b);
+  const rank2 = Math.ceil(p * sorted.length);
+  return sorted[clamp(rank2 - 1, 0, sorted.length - 1)];
+}
+function aggregateDependencyDrift(deps, ctxOf) {
+  const results = deps.map((d) => perDependencyDrift(d, ctxOf?.(d))).filter((r) => !r.excluded);
+  const excluded = deps.length - results.length;
+  if (results.length === 0) return null;
+  const weightSum = results.reduce((s, r) => s + r.weight, 0) || 1;
+  const weightedMean = results.reduce((s, r) => s + r.drift * r.weight, 0) / weightSum;
+  const p95 = percentile(results.map((r) => r.drift), 0.95);
+  const unsupportedShare = results.filter((r) => r.unsupported).length / results.length;
+  const verified = results.filter((r) => r.mode === "verified").length;
+  const drift = clamp(
+    Math.round(
+      AGG_MEAN_WEIGHT * weightedMean + AGG_P95_WEIGHT * p95 + AGG_UNSUPPORTED_SHARE_WEIGHT * (unsupportedShare * 100)
+    ),
+    0,
+    100
+  );
+  return {
+    drift,
+    mean: Math.round(weightedMean),
+    p95,
+    unsupportedShare,
+    mode: verified > 0 ? "verified" : "estimated",
+    scored: results.length,
+    excluded,
+    coverage: Math.round(verified / results.length * 100) / 100,
+    top: [...results].sort((a, b) => b.drift - a.drift).slice(0, 10)
+  };
+}
+
+// src/core-open/scoring/drift-score.ts
+var DRIFT_SCORE_METHODOLOGY_VERSION = "driftscore-3.0";
 var DEFAULT_THRESHOLDS = {
   failOnError: {
     eolDays: 180,
@@ -6616,7 +6778,7 @@ var DEFAULT_THRESHOLDS = {
     dependencyTwoPlusPercent: 30
   }
 };
-function clamp(val, min, max) {
+function clamp2(val, min, max) {
   return Math.min(max, Math.max(min, val));
 }
 function runtimeScore(projects) {
@@ -6639,23 +6801,7 @@ function frameworkScore(projects) {
   const avgLag = lags.reduce((a, b) => a + b, 0) / lags.length;
   const maxPenalty = Math.min(maxLag * 20, 100);
   const avgPenalty = Math.min(avgLag * 15, 100);
-  return clamp(100 - (maxPenalty * 0.6 + avgPenalty * 0.4), 0, 100);
-}
-function dependencyScore(projects) {
-  let totalCurrent = 0;
-  let totalOne = 0;
-  let totalTwo = 0;
-  for (const p of projects) {
-    totalCurrent += p.dependencyAgeBuckets.current;
-    totalOne += p.dependencyAgeBuckets.oneBehind;
-    totalTwo += p.dependencyAgeBuckets.twoPlusBehind;
-  }
-  const total = totalCurrent + totalOne + totalTwo;
-  if (total === 0) return null;
-  const currentPct = totalCurrent / total;
-  const onePct = totalOne / total;
-  const twoPct = totalTwo / total;
-  return clamp(Math.round(currentPct * 100 - onePct * 10 - twoPct * 40), 0, 100);
+  return clamp2(100 - (maxPenalty * 0.6 + avgPenalty * 0.4), 0, 100);
 }
 var MONTH_MS = 1e3 * 60 * 60 * 24 * 30;
 function eolScore(projects) {
@@ -6703,15 +6849,6 @@ function eolScore(projects) {
   }
   return score;
 }
-function freshnessScore(projects) {
-  const aggs = projects.map((p) => p.libyears).filter((a) => !!a);
-  if (aggs.length === 0) return null;
-  const total = aggs.reduce((s, a) => s + a.total, 0);
-  const measured = aggs.reduce((s, a) => s + a.measured, 0);
-  const max = aggs.reduce((m, a) => Math.max(m, a.max), 0);
-  if (measured === 0) return null;
-  return freshnessScoreFromLibyears({ total, max, measured });
-}
 function coverageConfidence(projects) {
   let known = 0;
   let unknown = 0;
@@ -6724,17 +6861,24 @@ function coverageConfidence(projects) {
   return Math.round(known / total * 100) / 100;
 }
 function computeDriftScore(projects) {
+  const depAgg = aggregateDependencyDrift(
+    projects.flatMap((p) => p.dependencies),
+    // Per-dependency context for the v3 floors: an unsupported/deprecated major
+    // floors drift at 70, an abandoned ("no pulse") package at 50. Threaded from
+    // the row where the ecosystem scanner set it; absent → the floor doesn't
+    // fire (spec §6.1). Transitive weighting still awaits the lockfile graph, so
+    // manifest deps default to direct.
+    (dep) => ({ unsupported: dep.unsupported === true, abandoned: dep.abandoned === true })
+  );
   const rs = runtimeScore(projects);
   const fs9 = frameworkScore(projects);
-  const ds = dependencyScore(projects);
+  const ds = depAgg ? 100 - depAgg.drift : null;
   const es = eolScore(projects);
-  const frs = freshnessScore(projects);
   const components = [
     { score: rs, weight: 0.25 },
     { score: fs9, weight: 0.25 },
     { score: ds, weight: 0.3 },
-    { score: es, weight: 0.2 },
-    { score: frs, weight: 0.15 }
+    { score: es, weight: 0.2 }
   ];
   const confidence = coverageConfidence(projects) ?? void 0;
   const toDrift = (health2) => 100 - health2;
@@ -6745,9 +6889,23 @@ function computeDriftScore(projects) {
       dependencyScore: toDrift(Math.round(ds ?? 100)),
       eolScore: toDrift(Math.round(es ?? 100))
     };
-    if (frs !== null) c.freshnessScore = toDrift(Math.round(frs));
     return c;
   };
+  const envelope = depAgg ? {
+    mode: depAgg.mode,
+    dependencyDrift: {
+      p95: depAgg.p95,
+      unsupportedShare: depAgg.unsupportedShare,
+      coverage: depAgg.coverage,
+      top: depAgg.top.map((t) => ({
+        package: t.package,
+        drift: t.drift,
+        mode: t.mode,
+        unsupported: t.unsupported,
+        flags: t.flags
+      }))
+    }
+  } : {};
   const active = components.filter((c) => c.score !== null);
   if (active.length === 0) {
     return {
@@ -6755,7 +6913,8 @@ function computeDriftScore(projects) {
       riskLevel: "low",
       components: buildComponents(),
       methodologyVersion: DRIFT_SCORE_METHODOLOGY_VERSION,
-      ...confidence !== void 0 ? { confidence } : {}
+      ...confidence !== void 0 ? { confidence } : {},
+      ...envelope
     };
   }
   const totalActiveWeight = active.reduce((sum, c) => sum + c.weight, 0);
@@ -6773,14 +6932,14 @@ function computeDriftScore(projects) {
   if (fs9 !== null) measured.push("framework");
   if (ds !== null) measured.push("dependency");
   if (es !== null) measured.push("eol");
-  if (frs !== null) measured.push("freshness");
   return {
     score,
     riskLevel,
     components: buildComponents(),
     measured,
     methodologyVersion: DRIFT_SCORE_METHODOLOGY_VERSION,
-    ...confidence !== void 0 ? { confidence } : {}
+    ...confidence !== void 0 ? { confidence } : {},
+    ...envelope
   };
 }
 function generateFindings(projects, config) {
@@ -7345,6 +7504,26 @@ function formatExtended(ext) {
     }
     lines.push("");
   }
+  if (ext.databaseSchema) {
+    const ds = ext.databaseSchema;
+    lines.push(chalk3.bold.underline("  Database Schema"));
+    const dsHead = [];
+    if (ds.providers.length > 0) dsHead.push(ds.providers.join(", "));
+    dsHead.push(`${ds.models.length} model${ds.models.length !== 1 ? "s" : ""}`);
+    dsHead.push(`${ds.enums.length} enum${ds.enums.length !== 1 ? "s" : ""}`);
+    lines.push(`    ${dsHead.join(" \xB7 ")}`);
+    const bySource = /* @__PURE__ */ new Map();
+    for (const m of ds.models) bySource.set(m.source, (bySource.get(m.source) ?? 0) + 1);
+    if (bySource.size > 1) {
+      const sourceSummary = [...bySource.entries()].sort(([a], [b]) => a.localeCompare(b)).map(([s, n]) => `${s}: ${n}`).join(", ");
+      lines.push(`    Sources: ${sourceSummary}`);
+    }
+    if (ds.models.length > 0) {
+      const preview = ds.models.slice(0, 5).map((m) => m.name).join(", ");
+      lines.push(`    Models: ${chalk3.white(preview)}${ds.models.length > 5 ? chalk3.dim(` (+${ds.models.length - 5} more)`) : ""}`);
+    }
+    lines.push("");
+  }
   if (ext.dependencyGraph) {
     const dg = ext.dependencyGraph;
     if (dg.lockfileType) {
@@ -11143,6 +11322,20 @@ function dedupeRoutes(routes) {
 }
 var gzip2 = promisify(zlib.gzip);
 var MAX_ITEMS = 50;
+var MAX_DB_MODELS = 300;
+var MAX_DB_FIELDS_PER_MODEL = 100;
+var MAX_DB_MODEL_FILES = 5;
+var MAX_DB_FILES_SCANNED = 500;
+var DB_UPLOAD_HARD_CEILING = {
+  maxModels: 2e3,
+  maxFieldsPerModel: 500,
+  maxFilesPerModel: 20,
+  maxFilesScanned: 5e3
+};
+function clampCap(configured, fallback, ceiling) {
+  if (typeof configured !== "number" || !Number.isFinite(configured) || configured <= 0) return fallback;
+  return Math.min(Math.floor(configured), ceiling);
+}
 function extractName(entry) {
   const match = entry.match(/^(.+?)\s*\(/);
   return match ? match[1].trim() : entry.trim();
@@ -11208,7 +11401,29 @@ function compactAssetBranding(result) {
     // Don't include logos
   };
 }
-function prepareArtifactForUpload(artifact) {
+function compactDatabaseSchema(result, caps) {
+  const maxModels = clampCap(caps?.maxModels, MAX_DB_MODELS, DB_UPLOAD_HARD_CEILING.maxModels);
+  const maxFieldsPerModel = clampCap(caps?.maxFieldsPerModel, MAX_DB_FIELDS_PER_MODEL, DB_UPLOAD_HARD_CEILING.maxFieldsPerModel);
+  const maxFilesPerModel = clampCap(caps?.maxFilesPerModel, MAX_DB_MODEL_FILES, DB_UPLOAD_HARD_CEILING.maxFilesPerModel);
+  const maxFilesScanned = clampCap(caps?.maxFilesScanned, MAX_DB_FILES_SCANNED, DB_UPLOAD_HARD_CEILING.maxFilesScanned);
+  return {
+    providers: result.providers.slice(0, MAX_ITEMS),
+    models: result.models.slice(0, maxModels).map((model) => ({
+      ...model,
+      fields: model.fields.slice(0, maxFieldsPerModel),
+      files: model.files.slice(0, maxFilesPerModel)
+    })),
+    enums: result.enums.slice(0, MAX_ITEMS),
+    filesScanned: result.filesScanned.slice(0, maxFilesScanned),
+    projects: result.projects.slice(0, MAX_ITEMS).map((project) => ({
+      project: project.project,
+      filesScanned: project.filesScanned.slice(0, MAX_ITEMS),
+      models: project.models.slice(0, MAX_ITEMS),
+      enums: project.enums.slice(0, MAX_ITEMS)
+    }))
+  };
+}
+function prepareArtifactForUpload(artifact, opts) {
   const compacted = { ...artifact };
   if (compacted.extended) {
     const ext = { ...compacted.extended };
@@ -11284,6 +11499,9 @@ function prepareArtifactForUpload(artifact) {
         duplicatedPackages: ext.dependencyGraph.duplicatedPackages.slice(0, MAX_ITEMS)
       };
     }
+    if (ext.databaseSchema) {
+      ext.databaseSchema = compactDatabaseSchema(ext.databaseSchema, opts?.databaseSchemaCaps);
+    }
     compacted.extended = ext;
   }
   return compacted;
@@ -11292,8 +11510,8 @@ async function compressArtifact(artifact) {
   const json = JSON.stringify(artifact);
   return gzip2(json, { level: 9 });
 }
-async function prepareCompressedUpload(artifact) {
-  const compacted = prepareArtifactForUpload(artifact);
+async function prepareCompressedUpload(artifact, opts) {
+  const compacted = prepareArtifactForUpload(artifact, opts);
   const compressed = await compressArtifact(compacted);
   return { body: compressed, contentEncoding: "gzip" };
 }
@@ -11467,6 +11685,6 @@ async function writeTextFile2(filePath, content) {
   await fs2.writeFile(filePath, content, "utf8");
 }
 
-export { PROJECT_TYPE_TO_OSV_ECOSYSTEM, VERSION, brandProgressBar, buildVersionTimelines, compactUiPurpose, computeDriftScore, computeRepoFingerprint, computeUpgradeImpact, detectVcs, driftBar, ensureDir2 as ensureDir, fetchRiskySymbols, fetchScanPreflight, findPackageAnyEcosystem, findPackageTimeline, findVersionCrossings, getChangelogSignals, gitHistoryAvailable, normalizeConstraint, parseDsn, pathExists2 as pathExists, prepareCompressedUpload, projectTypeToVulnEcosystem, readJsonFile2 as readJsonFile, resolveHead, resolveRepositoryName, runCoreScan, severityRank, titleBox, versionSatisfies, workingTreeDirty, writeDefaultConfig, writeJsonFile2 as writeJsonFile, writeTextFile2 as writeTextFile };
-//# sourceMappingURL=chunk-NNU2PW2H.js.map
-//# sourceMappingURL=chunk-NNU2PW2H.js.map
+export { PROJECT_TYPE_TO_OSV_ECOSYSTEM, VERSION, brandProgressBar, buildVersionTimelines, compactUiPurpose, computeDriftScore, computeRepoFingerprint, computeUpgradeImpact, detectVcs, driftBar, ensureDir2 as ensureDir, fetchRiskySymbols, fetchScanPreflight, findPackageAnyEcosystem, findPackageTimeline, findVersionCrossings, getChangelogSignals, gitHistoryAvailable, loadConfig, normalizeConstraint, parseDsn, pathExists2 as pathExists, prepareCompressedUpload, projectTypeToVulnEcosystem, readJsonFile2 as readJsonFile, resolveHead, resolveRepositoryName, runCoreScan, severityRank, titleBox, versionSatisfies, workingTreeDirty, writeDefaultConfig, writeJsonFile2 as writeJsonFile, writeTextFile2 as writeTextFile };
+//# sourceMappingURL=chunk-M62BGJMK.js.map
+//# sourceMappingURL=chunk-M62BGJMK.js.map