@vibgrate/cli 2026.721.2 → 2026.722.1

package/dist/chunk-2EVQKZTO.js

@@ -0,0 +1,696 @@
+import { usageError, buildGraph, UsageError, ResourceLimitError, CliError, ExitCode, writeArtifacts, writeSnapshot, refreshInstalledInstructions, SMALL_REPO_FILES, epistemicBreakdown, verifyDeterminism, renderHtml, renderReport, discoverModels, loadGraph } from './chunk-VXT6LUGP.js';
+import { VERSION, brandProgressBar, resolveHead, workingTreeDirty } from './chunk-JSNHZCIV.js';
+import { MockProvider, OPENAI_COMPATIBLE, OllamaProvider, LocalLlamaProvider, OpenAiCompatibleProvider } from './chunk-CS37OBE3.js';
+import { resolveEmbedModel, isModelReady, countPending, serializeGraph } from './chunk-WNIIKCNF.js';
+import { canonicalize } from './chunk-JFGYT6BI.js';
+import { c, info, json, out } from './chunk-CT5BS56U.js';
+import * as path from 'path';
+import * as fs from 'fs';
+import { spawn, execFile } from 'child_process';
+import * as crypto from 'crypto';
+
+// src/util/logo.ts
+var teal = (s) => c.hex("#3FB0A4")(s);
+var mint = (s) => c.hex("#4FE3C1")(s);
+var ROBOT = [
+  "   " + teal("\u256D\u2500\u2500\u2500\u2500\u2500\u2500\u256E") + mint("\u279C"),
+  "  " + c.dim("\u2524") + teal("\u2502") + " " + mint("\u25FC") + "  " + mint("\u25FC") + " " + teal("\u2502") + c.dim("\u251C"),
+  "  " + c.dim("\u2524") + teal("\u2502") + "  " + c.dim("\u2581\u2581") + "  " + teal("\u2502") + c.dim("\u251C"),
+  "   " + teal("\u2570\u2500\u2500\u2500\u2500\u2500\u2500\u256F")
+];
+function logoLines(root, opts = {}) {
+  const product = opts.product ?? "Graph";
+  const tagline = opts.tagline ?? "Code Intelligence Engine";
+  return [
+    "",
+    `  ${ROBOT[0]}`,
+    `  ${ROBOT[1]}`,
+    `  ${ROBOT[2]}`,
+    `  ${ROBOT[3]}`,
+    `  ${c.bold.white("Vibgrate")} ${teal(product)}  ${c.dim(`\xB7 ${tagline} \xB7 v${VERSION}`)}`,
+    ...root ? [`  ${c.dim(root)}`] : [],
+    ""
+  ];
+}
+function printLogo(root, opts = {}) {
+  if (!process.stderr.isTTY) return;
+  process.stderr.write(`${logoLines(root, opts).join("\n")}
+`);
+}
+function codeLogoLines(root) {
+  return [
+    "",
+    `  ${ROBOT[0]}`,
+    `  ${ROBOT[1]}`,
+    `  ${ROBOT[2]}`,
+    `  ${ROBOT[3]}`,
+    `  ${c.bold.white("VG")} ${teal("Code")}  ${c.dim(`\xB7 graph-grounded coding \xB7 v${VERSION}`)}`,
+    ...root ? [`  ${c.dim(root)}`] : [],
+    ""
+  ];
+}
+function printCodeLogo(root) {
+  if (!process.stderr.isTTY) return;
+  process.stderr.write(`${codeLogoLines(root).join("\n")}
+`);
+}
+var DSSE_PAYLOAD_TYPE = "application/vnd.in-toto+json";
+var IN_TOTO_STATEMENT_TYPE = "https://in-toto.io/Statement/v1";
+var VG_PREDICATE_TYPE = "https://vibgrate.com/attestation/code-graph/v1";
+function sha256Hex(input) {
+  return crypto.createHash("sha256").update(input).digest("hex");
+}
+function graphSubjectDigest(graph) {
+  const { generatedAt: _omit, ...rest } = graph;
+  return sha256Hex(canonicalize(rest));
+}
+function keyId(publicKey) {
+  return sha256Hex(publicKey.export({ type: "spki", format: "der" })).slice(0, 16);
+}
+function buildStatement(graph, input = {}) {
+  const graphDigest = graphSubjectDigest(graph);
+  const predicate = {
+    tool: { name: "vg", version: VERSION },
+    toolchain: graph.provenance.toolchain,
+    corpusHash: graph.provenance.corpusHash,
+    graphDigest,
+    counts: graph.meta.counts
+  };
+  if (input.commit) predicate.commit = input.commit;
+  if (input.sbomDigest) predicate.sbomDigest = input.sbomDigest;
+  if (input.timestamp) predicate.timestamp = input.timestamp;
+  return {
+    _type: IN_TOTO_STATEMENT_TYPE,
+    subject: [{ name: "graph.json", digest: { sha256: graphDigest } }],
+    predicateType: VG_PREDICATE_TYPE,
+    predicate
+  };
+}
+function dssePae(payloadType, body) {
+  const typeBytes = Buffer.from(payloadType, "utf8");
+  const header = Buffer.from(
+    `DSSEv1 ${typeBytes.length} ${payloadType} ${body.length} `,
+    "utf8"
+  );
+  return Buffer.concat([header, Buffer.from(body)]);
+}
+function signStatement(statement, privateKey) {
+  const body = Buffer.from(JSON.stringify(statement), "utf8");
+  const pae = dssePae(DSSE_PAYLOAD_TYPE, body);
+  const sig = crypto.sign(null, pae, privateKey);
+  const publicKey = crypto.createPublicKey(privateKey.export({ type: "pkcs8", format: "pem" }).toString());
+  return {
+    payloadType: DSSE_PAYLOAD_TYPE,
+    payload: body.toString("base64"),
+    signatures: [
+      {
+        keyid: keyId(publicKey),
+        sig: sig.toString("base64"),
+        publicKey: publicKey.export({ type: "spki", format: "pem" }).toString()
+      }
+    ]
+  };
+}
+function emptyStatement() {
+  return {
+    _type: "",
+    subject: [],
+    predicateType: "",
+    predicate: {
+      tool: { name: "vg", version: "" },
+      corpusHash: "",
+      graphDigest: "",
+      counts: { nodes: 0, edges: 0, areas: 0, tests: 0, untested: 0 }
+    }
+  };
+}
+function failedResult(reason) {
+  return {
+    status: "failed",
+    signatureValid: false,
+    signerPinned: false,
+    keyid: "",
+    reason,
+    statement: emptyStatement()
+  };
+}
+function verifyEnvelope(env, opts = {}) {
+  let body;
+  let statement;
+  try {
+    body = Buffer.from(env?.payload ?? "", "base64");
+    const parsed = JSON.parse(body.toString("utf8"));
+    if (!parsed || typeof parsed !== "object" || !parsed.predicate) {
+      throw new Error("missing predicate");
+    }
+    statement = parsed;
+  } catch {
+    return failedResult("malformed attestation payload (not a valid in-toto statement)");
+  }
+  const pae = dssePae(env.payloadType, body);
+  const sig0 = env.signatures?.[0];
+  const keyid = sig0?.keyid ?? "";
+  const sig = sig0?.sig ? Buffer.from(sig0.sig, "base64") : Buffer.alloc(0);
+  let signatureValid = false;
+  let signerPinned = false;
+  try {
+    if (sig0 && sig.length) {
+      if (opts.publicKeyPem) {
+        const pinnedKey = crypto.createPublicKey(opts.publicKeyPem);
+        signatureValid = crypto.verify(null, pae, pinnedKey, sig);
+        signerPinned = signatureValid;
+      } else if (sig0.publicKey) {
+        const embeddedKey = crypto.createPublicKey(sig0.publicKey);
+        signatureValid = crypto.verify(null, pae, embeddedKey, sig);
+      }
+    }
+  } catch {
+    signatureValid = false;
+    signerPinned = false;
+  }
+  const digestMatches = opts.graph ? graphSubjectDigest(opts.graph) === statement.predicate.graphDigest : void 0;
+  const dirty = statement.predicate.commit?.dirty;
+  let status;
+  let reason;
+  if (!signatureValid) {
+    status = "failed";
+    reason = sig0 ? "signature verification failed" : "no signature in envelope";
+  } else if (digestMatches === false) {
+    status = "failed";
+    reason = "graph.json no longer matches the attested digest (content changed since signing)";
+  } else if (signerPinned && !dirty) {
+    status = "verified";
+    reason = digestMatches === true ? "signature valid, signer trusted, graph digest matches" : "signature valid, signer trusted";
+  } else {
+    status = "signature-valid";
+    reason = dirty ? "signature valid but the attested tree was dirty (uncommitted changes)" : "signature valid but signer not pinned \u2014 pass --pub to establish trust";
+  }
+  return { status, signatureValid, signerPinned, digestMatches, dirty, keyid, reason, statement };
+}
+function generateKeypair() {
+  const { publicKey, privateKey } = crypto.generateKeyPairSync("ed25519");
+  return {
+    privatePem: privateKey.export({ type: "pkcs8", format: "pem" }).toString(),
+    publicPem: publicKey.export({ type: "spki", format: "pem" }).toString(),
+    keyid: keyId(publicKey)
+  };
+}
+function serializeEnvelope(env) {
+  return `${JSON.stringify(env)}
+`;
+}
+function parseEnvelope(text) {
+  const line = text.trim().split("\n")[0];
+  return JSON.parse(line);
+}
+
+// src/commands/attest-actions.ts
+var DEFAULT_ATTESTATION = "attestation.intoto.jsonl";
+var DEFAULT_KEY = "attest-key.pem";
+async function signGraphAttestation(root, graph, opts) {
+  const notices = [];
+  const explicitKey = opts.key ?? process.env.VG_ATTEST_KEY;
+  const keyPath = explicitKey ? path.resolve(explicitKey) : path.join(root, ".vibgrate", DEFAULT_KEY);
+  let keyGeneratedAt;
+  if (!fs.existsSync(keyPath)) {
+    if (explicitKey) {
+      throw new CliError(`signing key not found: ${explicitKey}`, ExitCode.USAGE_ERROR);
+    }
+    const kp = generateKeypair();
+    fs.mkdirSync(path.dirname(keyPath), { recursive: true });
+    fs.writeFileSync(keyPath, kp.privatePem, { mode: 384 });
+    fs.writeFileSync(`${keyPath}.pub`, kp.publicPem);
+    keyGeneratedAt = keyPath;
+    notices.push(
+      `minted a new Ed25519 signing key at ${rel(root, keyPath)} (keyid ${kp.keyid}) \u2014 keep it, add it to .gitignore, and reuse it to re-sign reproducibly`
+    );
+  }
+  let privateKey;
+  try {
+    privateKey = crypto.createPrivateKey(fs.readFileSync(keyPath, "utf8"));
+  } catch {
+    throw new CliError(`could not read an Ed25519 private key from ${rel(root, keyPath)}`, ExitCode.USAGE_ERROR);
+  }
+  if (privateKey.asymmetricKeyType !== "ed25519") {
+    throw new CliError(
+      `attest requires an Ed25519 key, but ${rel(root, keyPath)} is ${privateKey.asymmetricKeyType ?? "unknown"}`,
+      ExitCode.USAGE_ERROR
+    );
+  }
+  const commit = await gitCommitInfo(root);
+  const statement = buildStatement(graph, { commit });
+  const envelope = signStatement(statement, privateKey);
+  const outPath = opts.attestation ? path.resolve(opts.attestation) : path.join(root, ".vibgrate", DEFAULT_ATTESTATION);
+  fs.mkdirSync(path.dirname(outPath), { recursive: true });
+  fs.writeFileSync(outPath, serializeEnvelope(envelope));
+  return {
+    summary: {
+      keyid: envelope.signatures[0]?.keyid ?? "",
+      graphDigest: statement.predicate.graphDigest,
+      fingerprint: statement.predicate.toolchain?.fingerprint,
+      commit,
+      out: rel(root, outPath),
+      keyGeneratedAt: keyGeneratedAt ? rel(root, keyGeneratedAt) : void 0
+    },
+    notices
+  };
+}
+function verifyGraphAttestation(root, opts) {
+  const bundlePath = opts.attestation ? path.resolve(opts.attestation) : path.join(root, ".vibgrate", DEFAULT_ATTESTATION);
+  if (!fs.existsSync(bundlePath)) {
+    if (opts.attestation || opts.pub) {
+      throw new CliError(
+        `no attestation at ${rel(root, bundlePath)} \u2014 sign one with \`vg build --attest\``,
+        ExitCode.NOT_FOUND
+      );
+    }
+    return { bundlePath, missing: true };
+  }
+  const envelope = parseEnvelope(fs.readFileSync(bundlePath, "utf8"));
+  const publicKeyPem = opts.pub ? fs.readFileSync(path.resolve(opts.pub), "utf8") : void 0;
+  const graph = loadGraph(root) ?? void 0;
+  return { bundlePath, missing: false, result: verifyEnvelope(envelope, { publicKeyPem, graph }) };
+}
+async function gitCommitInfo(root) {
+  const sha = await resolveHead(root);
+  if (!sha) return void 0;
+  const dirty = await workingTreeDirty(root);
+  const branch = await gitBranch(root);
+  return { sha, shortSha: sha.slice(0, 7), branch, dirty: dirty === true ? true : dirty === false ? false : void 0 };
+}
+function gitBranch(root) {
+  return new Promise((resolve3) => {
+    execFile(
+      "git",
+      ["rev-parse", "--abbrev-ref", "HEAD"],
+      { cwd: root, timeout: 5e3, windowsHide: true, encoding: "utf8" },
+      (err, stdout) => {
+        if (err) return resolve3(void 0);
+        const name = String(stdout).trim();
+        resolve3(name && name !== "HEAD" ? name : void 0);
+      }
+    );
+  });
+}
+function rel(root, p) {
+  const r = path.relative(root, p);
+  return r.startsWith("..") ? p : r;
+}
+
+// src/util/progress.ts
+var FRAMES = ["\u280B", "\u2819", "\u2839", "\u2838", "\u283C", "\u2834", "\u2826", "\u2827", "\u2807", "\u280F"];
+var WIDTH = 30;
+function fmtDuration(ms) {
+  const s = Math.max(0, Math.round(ms / 1e3));
+  if (s < 60) return `${s}s`;
+  return `${Math.floor(s / 60)}m${String(s % 60).padStart(2, "0")}s`;
+}
+function formatProgressLine(label, done, total, elapsedMs, frame) {
+  const ratio = total > 0 ? Math.min(done / total, 1) : 0;
+  const bar = brandProgressBar(ratio, WIDTH);
+  const pct = Math.round(ratio * 100);
+  const spin = c.cyan(FRAMES[(frame % FRAMES.length + FRAMES.length) % FRAMES.length]);
+  const eta = ratio > 0.02 && ratio < 1 ? ` \xB7 eta ${fmtDuration(elapsedMs / ratio * (1 - ratio))}` : "";
+  return `  ${spin} ${label} ${bar} ${c.bold(`${pct}%`)} ${c.dim(`${done}/${total} \xB7 ${fmtDuration(elapsedMs)}${eta}`)}`;
+}
+var ProgressBar = class {
+  constructor(label) {
+    this.label = label;
+  }
+  label;
+  start = Date.now();
+  frame = 0;
+  tty = Boolean(process.stderr.isTTY);
+  update(done, total) {
+    if (!this.tty) return;
+    const line = formatProgressLine(this.label, done, total, Date.now() - this.start, this.frame++);
+    process.stderr.write(`\r\x1B[2K${line}`);
+  }
+  /** Clear the bar; optionally print a final summary line. */
+  done(summary) {
+    if (!this.tty) return;
+    process.stderr.write("\r\x1B[2K");
+    if (summary) process.stderr.write(`${summary}
+`);
+  }
+};
+
+// src/cli-options.ts
+function applyGlobalOptions(cmd) {
+  return cmd.option("-C, --cwd <dir>", "run as if started in <dir>", ".").option("--deep", "do more: precise resolution, all edges, semantic links").option("--json", "machine-readable JSON on stdout").option("--generated-at <iso>", "pin the artifact timestamp for byte-deterministic output").option("--graph <file>", "override the map path").option("--no-cache", "full rebuild (ignore the incremental cache)").option("--local", "never touch the network (lexical-only semantic)").option("--quiet", "suppress progress output").option("--client <name>", "identify the AI client (e.g. claude) so navigation calls are counted in vg savings").option("--no-color", "disable colored output");
+}
+function readGlobal(cmd) {
+  const o = cmd.opts();
+  return {
+    cwd: o.cwd,
+    deep: o.deep,
+    json: o.json,
+    generatedAt: o.generatedAt,
+    graph: o.graph,
+    noCache: o.cache === false,
+    local: o.local,
+    quiet: o.quiet,
+    client: o.client
+  };
+}
+
+// src/commands/build.ts
+function registerBuild(program) {
+  const cmd = program.command("build").description("build / update the code map (incremental, deterministic)").argument("[paths...]", "folders or files to map (default: current folder)").option("--only <langs>", "restrict to languages, e.g. ts,py,go").option("--exclude <glob>", "extra ignore glob (repeatable)", collect, []).option("--no-html", "do not write graph.html").option("--no-report", "do not write GRAPH_REPORT.md").option("--no-ground", "do not attach grounding (Phase 2)").option("--jobs <n>", "worker count (1 = single-threaded)").option("--scip <file>", "ingest a SCIP index for precise resolution (default: auto-detect index.scip)").option("--no-scip", "ignore any SCIP index").option("--no-tsc", "skip the in-process TypeScript resolver (heuristic floor only)").option("--no-warm", "do not warm the semantic index in the background after building").option("--grammars <dir>", "directory of grammar .wasm files (offline / air-gapped)").option("-o, --export <file>", "also write the map to a file (format inferred)").option("--attest", "sign the built graph \u2192 .vibgrate/attestation.intoto.jsonl").option("--verify", "verify a committed attestation against the graph (no rebuild)").option("--attest-key <path>", "signing key PEM (else $VG_ATTEST_KEY, else .vibgrate/attest-key.pem)").option("--attestation <file>", "attestation path (out for --attest, in for --verify)").option("--pub <path>", "public key PEM to pin the signer (with --verify)").action(async function(paths, opts) {
+    await runBuild(paths, opts, readGlobal(this));
+  });
+  applyGlobalOptions(cmd);
+}
+async function runBuild(paths, opts, global) {
+  const root = path.resolve(global.cwd ?? ".");
+  if (opts.verify) {
+    await verifyGraph(root, opts, global);
+    return;
+  }
+  const interactive = !global.json && !global.quiet;
+  if (interactive) printLogo(path.basename(root) || root);
+  const bar = interactive ? new ProgressBar(c.dim("parsing")) : void 0;
+  const jobs = opts.jobs ? Number(opts.jobs) : void 0;
+  if (jobs !== void 0 && (!Number.isInteger(jobs) || jobs < 1)) {
+    throw usageError(`--jobs must be a positive integer (got "${opts.jobs}")`);
+  }
+  const only = opts.only ? opts.only.split(",").map((s) => s.trim()).filter(Boolean) : void 0;
+  let result;
+  try {
+    result = await buildGraph({
+      root,
+      paths: paths.length ? paths : void 0,
+      only,
+      exclude: opts.exclude,
+      jobs,
+      noCache: global.noCache,
+      deep: global.deep,
+      noGround: opts.ground === false,
+      scip: typeof opts.scip === "string" ? opts.scip : void 0,
+      noScip: opts.scip === false,
+      noTsc: opts.tsc === false,
+      generatedAt: global.generatedAt,
+      onParseProgress: bar ? (done, total) => bar.update(done, total) : void 0,
+      grammarsDir: opts.grammars
+    });
+  } catch (err) {
+    bar?.done();
+    if (err instanceof UsageError) throw usageError(err.message);
+    if (err instanceof ResourceLimitError) throw new CliError(err.message, ExitCode.ERROR);
+    throw err;
+  }
+  bar?.done();
+  const written = writeArtifacts(result.graph, {
+    root,
+    html: opts.html,
+    report: opts.report,
+    graphPath: global.graph
+  });
+  if (!global.graph) {
+    writeSnapshot(root, result.graph.provenance.corpusHash, result.fileStats, {
+      only,
+      exclude: opts.exclude,
+      paths: paths.length ? paths : void 0,
+      deep: global.deep,
+      noGround: opts.ground === false,
+      scip: typeof opts.scip === "string" ? opts.scip : void 0,
+      noScip: opts.scip === false,
+      noTsc: opts.tsc === false,
+      grammarsDir: opts.grammars
+    });
+  }
+  if (opts.export) writeExport(result.graph, opts.export);
+  if (!global.graph) {
+    const fileCount = result.graph.nodes.filter((n) => n.kind === "file").length;
+    const refreshed = refreshInstalledInstructions(root, fileCount > 0 && fileCount < SMALL_REPO_FILES);
+    if (interactive) {
+      for (const r of refreshed) {
+        info(c.dim(`vg \xB7 refreshed assistant instructions ${r.file} (v${r.from} \u2192 v${r.to})`));
+      }
+    }
+  }
+  let attestation;
+  const attestNotices = [];
+  if (opts.attest) {
+    const signed = await signGraphAttestation(root, result.graph, {
+      key: opts.attestKey,
+      attestation: opts.attestation
+    });
+    attestation = signed.summary;
+    attestNotices.push(...signed.notices);
+  }
+  if (global.json) {
+    json({
+      ok: true,
+      counts: result.graph.meta.counts,
+      languages: result.graph.meta.languages,
+      reparsed: result.reparsed,
+      reused: result.reused,
+      totalFiles: result.totalFiles,
+      resolve: result.resolveStats,
+      tsc: result.tsc,
+      scip: result.scip,
+      epistemic: epistemicBreakdown(result.graph.edges),
+      artifacts: written,
+      corpusHash: result.graph.provenance.corpusHash,
+      toolchain: result.graph.provenance.toolchain,
+      attestation,
+      timingMs: result.timing.totalMs,
+      warnings: result.warnings
+    });
+    return;
+  }
+  const { counts } = result.graph.meta;
+  const incremental = result.reused > 0 ? `incremental: ${result.reparsed} of ${result.totalFiles} files re-parsed` : `${result.totalFiles} files parsed`;
+  const seconds = (result.timing.totalMs / 1e3).toFixed(2);
+  info(`${c.cyan("vg")} \xB7 mapped ${rel2(root)} in ${seconds}s (${incremental})`);
+  info(
+    `  nodes ${c.bold(String(counts.nodes))}   edges ${c.bold(String(counts.edges))}   areas ${counts.areas}   langs ${result.graph.meta.languages.join(",") || "\u2014"}`
+  );
+  const callPct = result.resolveStats.callsResolved + result.resolveStats.callsUnresolved > 0 ? Math.round(
+    100 * result.resolveStats.callsResolved / (result.resolveStats.callsResolved + result.resolveStats.callsUnresolved)
+  ) : 100;
+  const precise = result.tsc || result.scip;
+  const callLabel = precise ? `heuristic floor ${callPct}%` : `calls resolved ${callPct}%`;
+  info(c.dim(`  ${callLabel} \xB7 resolver ${result.graph.provenance.resolver.join(",")}`));
+  if (result.tsc) {
+    const jsx = result.tsc.jsx > 0 ? `, ${result.tsc.jsx} JSX` : "";
+    info(c.dim(`  tsc: ${result.tsc.resolved} precise edges across ${result.tsc.files} TS/JS files (${result.tsc.calls} calls${jsx})`));
+  }
+  if (result.scip) {
+    info(c.dim(`  scip: ${result.scip.resolved} precise edges from ${result.scip.tool ?? "index"} (${result.scip.documents} docs)`));
+  }
+  const ep = epistemicBreakdown(result.graph.edges);
+  info(
+    c.dim(
+      `  edges by evidence \xB7 observed ${ep.observed} \xB7 name-matched ${ep["name-matched"]} \xB7 declared ${ep.declared}`
+    )
+  );
+  const artifactList = [written.graphPath, written.htmlPath, written.reportPath].filter(Boolean).map((p) => path.relative(root, p)).join("  ");
+  info(`  \u2192 ${artifactList}`);
+  if (result.warnings.length) {
+    info(c.yellow(`  ${result.warnings.length} parse warning(s) \u2014 run with --json for detail`));
+  }
+  if (attestation) {
+    for (const n of attestNotices) info(c.yellow(`  ${n}`));
+    info(
+      c.dim(
+        `  attested \xB7 keyid ${attestation.keyid} \xB7 digest ${attestation.graphDigest.slice(0, 16)}\u2026 \u2192 ${attestation.out}`
+      )
+    );
+  }
+  maybeWarmEmbeddings(root, result.graph, global, opts.warm !== false);
+}
+async function verifyGraph(root, opts, global) {
+  const only = opts.only ? opts.only.split(",").map((s) => s.trim()).filter(Boolean) : void 0;
+  const jobs = opts.jobs ? Number(opts.jobs) : void 0;
+  const det = await verifyDeterminism({ root, only, exclude: opts.exclude, jobs });
+  const attest = verifyGraphAttestation(root, { attestation: opts.attestation, pub: opts.pub });
+  const attestFailed = !attest.missing && attest.result?.status === "failed";
+  if (global.json) {
+    json({
+      ok: det.ok && !attestFailed,
+      determinism: { ok: det.ok, checks: det.checks, digest: det.digest },
+      attestation: attest.missing ? null : {
+        status: attest.result?.status,
+        signatureValid: attest.result?.signatureValid,
+        signerPinned: attest.result?.signerPinned,
+        digestMatches: attest.result?.digestMatches,
+        dirty: attest.result?.dirty,
+        keyid: attest.result?.keyid,
+        reason: attest.result?.reason
+      }
+    });
+  } else {
+    info(`${c.cyan("vg build --verify")} \xB7 ${path.relative(process.cwd(), root) || "."}`);
+    for (const check of det.checks) {
+      const mark = check.ok ? c.green("\u2714") : c.red("\u2718");
+      const detail = check.detail ? c.dim(` (${check.detail})`) : "";
+      info(`  ${mark} ${check.name}${detail}`);
+    }
+    info(det.ok ? c.green(`  deterministic \xB7 digest ${det.digest.slice(0, 16)}\u2026`) : c.red("  NON-DETERMINISTIC"));
+    if (attest.missing) {
+      info(c.dim(`  attestation: none (sign one with \`vg build --attest\`)`));
+    } else {
+      const r = attest.result;
+      const badge = r?.status === "verified" ? c.green("\u2714 attestation verified") : r?.status === "signature-valid" ? c.yellow("~ attestation signature valid") : c.red("\u2718 attestation failed");
+      info(`  ${badge}${r?.keyid ? c.dim(` \xB7 keyid ${r.keyid}`) : ""}`);
+      info(c.dim(`    ${r?.reason ?? ""}`));
+    }
+  }
+  if (!det.ok) throw new CliError("determinism self-check failed", ExitCode.NON_DETERMINISTIC);
+  if (attestFailed) throw new CliError("attestation verification failed", ExitCode.GATE_FAILED);
+}
+function maybeWarmEmbeddings(root, graph, global, warm) {
+  if (!warm || global.json || global.quiet || global.local) return;
+  if (!process.stdout.isTTY && !process.stderr.isTTY) return;
+  const cli = process.argv[1];
+  if (!cli) return;
+  const modelId = resolveEmbedModel();
+  const ready = isModelReady(modelId);
+  if (ready && countPending(graph, root, modelId) === 0) return;
+  const args = ready ? [cli, "embed", "-C", root, "--bg"] : [cli, "embed", "-C", root, "--bg", "--download"];
+  try {
+    const child = spawn(process.execPath, args, { detached: true, stdio: "ignore" });
+    child.unref();
+    info(
+      c.dim(
+        ready ? "  warming the semantic index in the background \u2014 `vg ask` will be instant" : "  downloading the semantic model in the background (once) \u2014 `vg ask`/`vg serve` will be instant; disable with --no-warm"
+      )
+    );
+  } catch {
+  }
+}
+function writeExport(graph, target) {
+  if (target === "-") {
+    out(serializeGraph(graph).trimEnd());
+    return;
+  }
+  const ext = path.extname(target).toLowerCase();
+  let content;
+  switch (ext) {
+    case ".json":
+      content = serializeGraph(graph);
+      break;
+    case ".md":
+      content = renderReport(graph);
+      break;
+    case ".html":
+      content = renderHtml(graph);
+      break;
+    default:
+      throw new CliError(
+        `cannot export to "${ext || target}" yet \u2014 supported in Phase 0: .json, .md, .html, "-" (stdout). More formats (graphml, dot, cypher) arrive with \`vg export\` in Phase 1.`,
+        ExitCode.USAGE_ERROR
+      );
+  }
+  fs.mkdirSync(path.dirname(path.resolve(target)), { recursive: true });
+  fs.writeFileSync(target, content);
+}
+function collect(value, prev) {
+  return [...prev, value];
+}
+function rel2(root) {
+  const r = path.relative(process.cwd(), root);
+  return r === "" ? "." : r;
+}
+
+// src/code/router.ts
+var HOSTED_IDS = /* @__PURE__ */ new Set(["openrouter", "litellm", "openai", "together"]);
+function resolveProviders(opts, deps = {}) {
+  const env = deps.env ?? process.env;
+  const discover = deps.discover ?? discoverModels;
+  if (opts.mockReply !== void 0) {
+    return { providers: [new MockProvider(opts.model ?? "mock-1", opts.mockReply)], reason: "mock provider (scripted, offline)" };
+  }
+  if (opts.provider) {
+    const provider = buildExplicit(opts.provider, opts, env, discover);
+    const fallbacks = opts.local || provider.local ? localFallbacks(opts, env, discover, provider.id) : [];
+    return { providers: [provider, ...fallbacks], reason: `explicit --provider ${opts.provider}` };
+  }
+  if (opts.local) {
+    const locals2 = localFallbacks(opts, env, discover, "");
+    if (locals2.length === 0) {
+      throw new CliError(
+        "no local model backend available for --local. Start Ollama (`ollama serve` + `ollama pull <model>`), run LM Studio, or point --provider llama-cpp at a gguf. See `vg models`.",
+        ExitCode.NOT_FOUND
+      );
+    }
+    return { providers: locals2, reason: "--local (on-device backends only)" };
+  }
+  if (env.OPENROUTER_API_KEY) {
+    const model = resolveHostedModel(opts, env, "openrouter");
+    const primary = buildHosted("openrouter", model);
+    return { providers: [primary, ...localFallbacks(opts, env, discover, "openrouter")], reason: "OPENROUTER_API_KEY is set \u2192 OpenRouter (with local fallback)" };
+  }
+  const locals = localFallbacks(opts, env, discover, "");
+  if (locals.length) return { providers: locals, reason: "a local model is available \u2192 on-device (no key needed)" };
+  for (const id of ["litellm", "openai", "together"]) {
+    const keyEnv = OPENAI_COMPATIBLE[id].apiKeyEnv;
+    if (keyEnv && env[keyEnv]) {
+      const model = resolveHostedModel(opts, env, id);
+      return { providers: [buildHosted(id, model)], reason: `${keyEnv} is set \u2192 ${OPENAI_COMPATIBLE[id].label}` };
+    }
+  }
+  throw new CliError(
+    "no model backend configured. Do one of: set OPENROUTER_API_KEY for the hosted router, run Ollama locally (`ollama serve`), or use --local with a local model. Set the model with --model or VG_CODE_MODEL. (No models are installed by default.)",
+    ExitCode.NOT_FOUND
+  );
+}
+function buildExplicit(id, opts, env, discover) {
+  if (id === "ollama") return new OllamaProvider(resolveLocalModel(opts, discover, "ollama"), env.OLLAMA_HOST);
+  if (id === "llama-cpp") {
+    const modelPath = opts.modelPath || env.VG_CODE_MODEL_PATH;
+    if (!modelPath) throw new CliError("--provider llama-cpp needs a gguf path via --model-path or VG_CODE_MODEL_PATH (no weights are downloaded automatically; see `vg models`).", ExitCode.USAGE_ERROR);
+    return new LocalLlamaProvider(opts.model ?? basename2(modelPath), modelPath, void 0, !!opts.consent);
+  }
+  if (id === "lmstudio") return buildHosted("lmstudio", resolveHostedModel(opts, env, "lmstudio"));
+  if (HOSTED_IDS.has(id)) return buildHosted(id, resolveHostedModel(opts, env, id));
+  throw new CliError(`unknown --provider "${id}". Known: ollama, lmstudio, openrouter, litellm, openai, together, llama-cpp.`, ExitCode.USAGE_ERROR);
+}
+function buildHosted(id, model) {
+  const base = OPENAI_COMPATIBLE[id];
+  const config = { ...base, id };
+  return new OpenAiCompatibleProvider(model, config);
+}
+function localFallbacks(opts, env, discover, exclude) {
+  const out2 = [];
+  const models = safeDiscover(discover);
+  const ollamaModel = opts.model ?? firstOfRuntime(models, "ollama");
+  if (exclude !== "ollama" && ollamaModel) out2.push(new OllamaProvider(ollamaModel, env.OLLAMA_HOST));
+  const lmModel = opts.model ?? firstOfRuntime(models, "lm-studio");
+  if (exclude !== "lmstudio" && lmModel) out2.push(buildHosted("lmstudio", lmModel));
+  return out2;
+}
+function resolveLocalModel(opts, discover, runtime) {
+  if (opts.model) return opts.model;
+  const found = firstOfRuntime(safeDiscover(discover), runtime);
+  if (found) return found;
+  throw new CliError(`--provider ${runtime} needs a model. Pull one (\`ollama pull <model>\`) then re-run, or pass --model. See \`vg models\`.`, ExitCode.NOT_FOUND);
+}
+function resolveHostedModel(opts, env, id) {
+  const model = opts.model || env.VG_CODE_MODEL;
+  if (model) return model;
+  throw new CliError(
+    `${OPENAI_COMPATIBLE[id].label} needs a model id \u2014 pass --model (e.g. a current best-in-breed coding model) or set VG_CODE_MODEL. We don't hard-code a model so you always pick the current best one.`,
+    ExitCode.USAGE_ERROR
+  );
+}
+function firstOfRuntime(models, runtime) {
+  const m = models.find((x) => x.runtime === runtime);
+  return m?.name;
+}
+function safeDiscover(discover) {
+  try {
+    return discover();
+  } catch {
+    return [];
+  }
+}
+function basename2(p) {
+  return p.replace(/\\/g, "/").split("/").pop() ?? p;
+}
+
+export { DSSE_PAYLOAD_TYPE, ProgressBar, applyGlobalOptions, dssePae, generateKeypair, keyId, printCodeLogo, printLogo, readGlobal, registerBuild, resolveProviders, runBuild, sha256Hex };
+//# sourceMappingURL=chunk-2EVQKZTO.js.map
+//# sourceMappingURL=chunk-2EVQKZTO.js.map