@vibgrate/cli 2026.715.1 → 2026.718.2

package/dist/{chunk-C5AVF7PT.js → chunk-RME7BFMU.js}

@@ -19,7 +19,7 @@ import * as zlib from 'zlib';
 import { promisify } from 'util';
 
 // src/version.ts
-var VERSION = "2026.715.1";
+var VERSION = "2026.718.2";
 var TOP_LEVEL_NODE_MODULES = /^node_modules\/((?:@[^/]+\/)?[^/]+)$/;
 function parsePackageLock(json) {
   const out = /* @__PURE__ */ new Map();
@@ -1170,6 +1170,8 @@ var BUNDLED_RUNTIME_CATALOG = {
 };
 
 // src/core-open/scanners/node-scanner.ts
+var MS_PER_DAY2 = 864e5;
+var ABANDONED_MAX_DAYS = 730;
 var KNOWN_FRAMEWORKS = {
   // ── Frontend ──
   "react": "React",
@@ -1437,6 +1439,14 @@ async function scanOnePackageJson(packageJsonPath, rootDir, npmCache, cache, cat
     }
     const ageDays = ageDaysBetween(resolvedVersion, latestStable2, meta.releaseDates);
     const libyears = daysToLibyears(ageDays);
+    const latestIso = latestStable2 ? meta.releaseDates?.[latestStable2] : void 0;
+    let abandoned = false;
+    if (latestIso) {
+      const publishedMs = Date.parse(latestIso);
+      if (!Number.isNaN(publishedMs)) {
+        abandoned = (Date.now() - publishedMs) / MS_PER_DAY2 > ABANDONED_MAX_DAYS;
+      }
+    }
     dependencies.push({
       package: pkg,
       section,
@@ -1447,7 +1457,8 @@ async function scanOnePackageJson(packageJsonPath, rootDir, npmCache, cache, cat
       drift,
       license: buildDependencyLicense(meta.license, "registry"),
       ageDays,
-      libyears
+      libyears,
+      ...abandoned ? { abandoned: true } : {}
     });
     if (pkg in KNOWN_FRAMEWORKS) {
       frameworks.push({
@@ -6792,11 +6803,6 @@ function frameworkScore(projects) {
   const avgPenalty = Math.min(avgLag * 15, 100);
   return clamp2(100 - (maxPenalty * 0.6 + avgPenalty * 0.4), 0, 100);
 }
-function dependencyScore(projects) {
-  const deps = projects.flatMap((p) => p.dependencies);
-  const agg = aggregateDependencyDrift(deps);
-  return agg ? 100 - agg.drift : null;
-}
 var MONTH_MS = 1e3 * 60 * 60 * 24 * 30;
 function eolScore(projects) {
   const hasRuntimeData = projects.some(
@@ -6855,9 +6861,18 @@ function coverageConfidence(projects) {
   return Math.round(known / total * 100) / 100;
 }
 function computeDriftScore(projects) {
+  const depAgg = aggregateDependencyDrift(
+    projects.flatMap((p) => p.dependencies),
+    // Per-dependency context for the v3 floors: an unsupported/deprecated major
+    // floors drift at 70, an abandoned ("no pulse") package at 50. Threaded from
+    // the row where the ecosystem scanner set it; absent → the floor doesn't
+    // fire (spec §6.1). Transitive weighting still awaits the lockfile graph, so
+    // manifest deps default to direct.
+    (dep) => ({ unsupported: dep.unsupported === true, abandoned: dep.abandoned === true })
+  );
   const rs = runtimeScore(projects);
   const fs9 = frameworkScore(projects);
-  const ds = dependencyScore(projects);
+  const ds = depAgg ? 100 - depAgg.drift : null;
   const es = eolScore(projects);
   const components = [
     { score: rs, weight: 0.25 },
@@ -6876,6 +6891,21 @@ function computeDriftScore(projects) {
     };
     return c;
   };
+  const envelope = depAgg ? {
+    mode: depAgg.mode,
+    dependencyDrift: {
+      p95: depAgg.p95,
+      unsupportedShare: depAgg.unsupportedShare,
+      coverage: depAgg.coverage,
+      top: depAgg.top.map((t) => ({
+        package: t.package,
+        drift: t.drift,
+        mode: t.mode,
+        unsupported: t.unsupported,
+        flags: t.flags
+      }))
+    }
+  } : {};
   const active = components.filter((c) => c.score !== null);
   if (active.length === 0) {
     return {
@@ -6883,7 +6913,8 @@ function computeDriftScore(projects) {
       riskLevel: "low",
       components: buildComponents(),
       methodologyVersion: DRIFT_SCORE_METHODOLOGY_VERSION,
-      ...confidence !== void 0 ? { confidence } : {}
+      ...confidence !== void 0 ? { confidence } : {},
+      ...envelope
     };
   }
   const totalActiveWeight = active.reduce((sum, c) => sum + c.weight, 0);
@@ -6907,7 +6938,8 @@ function computeDriftScore(projects) {
     components: buildComponents(),
     measured,
     methodologyVersion: DRIFT_SCORE_METHODOLOGY_VERSION,
-    ...confidence !== void 0 ? { confidence } : {}
+    ...confidence !== void 0 ? { confidence } : {},
+    ...envelope
   };
 }
 function generateFindings(projects, config) {
@@ -11654,5 +11686,5 @@ async function writeTextFile2(filePath, content) {
 }
 
 export { PROJECT_TYPE_TO_OSV_ECOSYSTEM, VERSION, brandProgressBar, buildVersionTimelines, compactUiPurpose, computeDriftScore, computeRepoFingerprint, computeUpgradeImpact, detectVcs, driftBar, ensureDir2 as ensureDir, fetchRiskySymbols, fetchScanPreflight, findPackageAnyEcosystem, findPackageTimeline, findVersionCrossings, getChangelogSignals, gitHistoryAvailable, loadConfig, normalizeConstraint, parseDsn, pathExists2 as pathExists, prepareCompressedUpload, projectTypeToVulnEcosystem, readJsonFile2 as readJsonFile, resolveHead, resolveRepositoryName, runCoreScan, severityRank, titleBox, versionSatisfies, workingTreeDirty, writeDefaultConfig, writeJsonFile2 as writeJsonFile, writeTextFile2 as writeTextFile };
-//# sourceMappingURL=chunk-C5AVF7PT.js.map
-//# sourceMappingURL=chunk-C5AVF7PT.js.map
+//# sourceMappingURL=chunk-RME7BFMU.js.map
+//# sourceMappingURL=chunk-RME7BFMU.js.map