@vibgrate/cli 2026.721.3 → 2026.722.1

package/dist/chunk-JFGYT6BI.js

@@ -0,0 +1,32 @@
+import { blake3 } from '@noble/hashes/blake3.js';
+import { bytesToHex } from '@noble/hashes/utils.js';
+
+// src/engine/hash.ts
+var encoder = new TextEncoder();
+function hashString(input) {
+  return bytesToHex(blake3(encoder.encode(input)));
+}
+function hashBytes(input) {
+  return bytesToHex(blake3(input));
+}
+function shortId(input) {
+  return bytesToHex(blake3(encoder.encode(input), { dkLen: 16 }));
+}
+function canonicalize(value) {
+  return JSON.stringify(sortKeys(value));
+}
+function sortKeys(value) {
+  if (Array.isArray(value)) return value.map(sortKeys);
+  if (value && typeof value === "object") {
+    const out = {};
+    for (const key of Object.keys(value).sort()) {
+      out[key] = sortKeys(value[key]);
+    }
+    return out;
+  }
+  return value;
+}
+
+export { canonicalize, hashBytes, hashString, shortId };
+//# sourceMappingURL=chunk-JFGYT6BI.js.map
+//# sourceMappingURL=chunk-JFGYT6BI.js.map

package/dist/chunk-JFGYT6BI.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/engine/hash.ts"],"names":[],"mappings":";;;;AAYA,IAAM,OAAA,GAAU,IAAI,WAAA,EAAY;AAGzB,SAAS,WAAW,KAAA,EAAuB;AAChD,EAAA,OAAO,WAAW,MAAA,CAAO,OAAA,CAAQ,MAAA,CAAO,KAAK,CAAC,CAAC,CAAA;AACjD;AAGO,SAAS,UAAU,KAAA,EAA2B;AACnD,EAAA,OAAO,UAAA,CAAW,MAAA,CAAO,KAAK,CAAC,CAAA;AACjC;AAOO,SAAS,QAAQ,KAAA,EAAuB;AAC7C,EAAA,OAAO,UAAA,CAAW,MAAA,CAAO,OAAA,CAAQ,MAAA,CAAO,KAAK,GAAG,EAAE,KAAA,EAAO,EAAA,EAAI,CAAC,CAAA;AAChE;AAOO,SAAS,aAAa,KAAA,EAAwB;AACnD,EAAA,OAAO,IAAA,CAAK,SAAA,CAAU,QAAA,CAAS,KAAK,CAAC,CAAA;AACvC;AAEA,SAAS,SAAS,KAAA,EAAyB;AACzC,EAAA,IAAI,MAAM,OAAA,CAAQ,KAAK,GAAG,OAAO,KAAA,CAAM,IAAI,QAAQ,CAAA;AACnD,EAAA,IAAI,KAAA,IAAS,OAAO,KAAA,KAAU,QAAA,EAAU;AACtC,IAAA,MAAM,MAA+B,EAAC;AACtC,IAAA,KAAA,MAAW,OAAO,MAAA,CAAO,IAAA,CAAK,KAAgC,CAAA,CAAE,MAAK,EAAG;AACtE,MAAA,GAAA,CAAI,GAAG,CAAA,GAAI,QAAA,CAAU,KAAA,CAAkC,GAAG,CAAC,CAAA;AAAA,IAC7D;AACA,IAAA,OAAO,GAAA;AAAA,EACT;AACA,EAAA,OAAO,KAAA;AACT","file":"chunk-JFGYT6BI.js","sourcesContent":["import { blake3 } from '@noble/hashes/blake3.js';\nimport { bytesToHex } from '@noble/hashes/utils.js';\n\n/**\n * Content hashing — the bedrock of vg's determinism contract.\n *\n * Ids are blake3 over a canonical payload. blake3 is pure-WASM/JS (no native\n * build, no platform variance), so identical input → identical id on every\n * machine. We never let timestamps, RNG, locale, or filesystem order into a\n * hashed payload (VG-ENGINE-TEARDOWN.md §5).\n */\n\nconst encoder = new TextEncoder();\n\n/** Full hex digest of a UTF-8 string. */\nexport function hashString(input: string): string {\n  return bytesToHex(blake3(encoder.encode(input)));\n}\n\n/** Full hex digest of raw bytes (file contents). */\nexport function hashBytes(input: Uint8Array): string {\n  return bytesToHex(blake3(input));\n}\n\n/**\n * A short, collision-resistant id for nodes/edges. 16 bytes (128 bits) of\n * blake3 is ample for repo-scale graphs and keeps `graph.json` compact and\n * human-diffable.\n */\nexport function shortId(input: string): string {\n  return bytesToHex(blake3(encoder.encode(input), { dkLen: 16 }));\n}\n\n/**\n * Canonical JSON: object keys sorted recursively, no insignificant whitespace.\n * The single source of truth for \"what bytes get hashed\" so two runs that see\n * the same logical payload produce byte-identical input to blake3.\n */\nexport function canonicalize(value: unknown): string {\n  return JSON.stringify(sortKeys(value));\n}\n\nfunction sortKeys(value: unknown): unknown {\n  if (Array.isArray(value)) return value.map(sortKeys);\n  if (value && typeof value === 'object') {\n    const out: Record<string, unknown> = {};\n    for (const key of Object.keys(value as Record<string, unknown>).sort()) {\n      out[key] = sortKeys((value as Record<string, unknown>)[key]);\n    }\n    return out;\n  }\n  return value;\n}\n"]}

package/dist/{chunk-JLRF5TFA.js → chunk-JSNHZCIV.js}

@@ -19,7 +19,7 @@ import * as zlib from 'zlib';
 import { promisify } from 'util';
 
 // src/version.ts
-var VERSION = "2026.721.3";
+var VERSION = "2026.722.1";
 var TOP_LEVEL_NODE_MODULES = /^node_modules\/((?:@[^/]+\/)?[^/]+)$/;
 function parsePackageLock(json) {
   const out = /* @__PURE__ */ new Map();
@@ -138,8 +138,8 @@ async function loadNpmLockIndex(dir, io) {
 // src/core-open/utils/timeout.ts
 async function withTimeout(promise, ms) {
   let timer;
-  const timeout = new Promise((resolve8) => {
-    timer = setTimeout(() => resolve8({ ok: false }), ms);
+  const timeout = new Promise((resolve7) => {
+    timer = setTimeout(() => resolve7({ ok: false }), ms);
   });
   try {
     const result = await Promise.race([
@@ -152,7 +152,7 @@ async function withTimeout(promise, ms) {
   }
 }
 function runCommand(cmd, args) {
-  return new Promise((resolve8, reject) => {
+  return new Promise((resolve7, reject) => {
     const child = spawn(cmd, args, { stdio: ["ignore", "pipe", "pipe"] });
     let out = "";
     let err = "";
@@ -164,7 +164,7 @@ function runCommand(cmd, args) {
         reject(new Error(`${cmd} ${args.join(" ")} failed (code=${code}): ${err.trim()}`));
         return;
       }
-      resolve8(out);
+      resolve7(out);
     });
   });
 }
@@ -294,7 +294,7 @@ function buildNpmViewChunks(pkgs, platform = process.platform) {
   return chunks;
 }
 async function npmViewJson(args, cwd) {
-  return new Promise((resolve8, reject) => {
+  return new Promise((resolve7, reject) => {
     const child = spawn(NPM_COMMAND, ["view", ...args, "--json"], {
       cwd,
       stdio: ["ignore", "pipe", "pipe"]
@@ -311,13 +311,13 @@ async function npmViewJson(args, cwd) {
       }
       const trimmed = out.trim();
       if (!trimmed) {
-        resolve8(null);
+        resolve7(null);
         return;
       }
       try {
-        resolve8(JSON.parse(trimmed));
+        resolve7(JSON.parse(trimmed));
       } catch {
-        resolve8(trimmed.replace(/^"|"$/g, ""));
+        resolve7(trimmed.replace(/^"|"$/g, ""));
       }
     });
   });
@@ -6871,12 +6871,12 @@ function computeDriftScore(projects) {
     (dep) => ({ unsupported: dep.unsupported === true, abandoned: dep.abandoned === true })
   );
   const rs = runtimeScore(projects);
-  const fs9 = frameworkScore(projects);
+  const fs8 = frameworkScore(projects);
   const ds = depAgg ? 100 - depAgg.drift : null;
   const es = eolScore(projects);
   const components = [
     { score: rs, weight: 0.25 },
-    { score: fs9, weight: 0.25 },
+    { score: fs8, weight: 0.25 },
     { score: ds, weight: 0.3 },
     { score: es, weight: 0.2 }
   ];
@@ -6885,7 +6885,7 @@ function computeDriftScore(projects) {
   const buildComponents = () => {
     const c = {
       runtimeScore: toDrift(Math.round(rs ?? 100)),
-      frameworkScore: toDrift(Math.round(fs9 ?? 100)),
+      frameworkScore: toDrift(Math.round(fs8 ?? 100)),
       dependencyScore: toDrift(Math.round(ds ?? 100)),
       eolScore: toDrift(Math.round(es ?? 100))
     };
@@ -6929,7 +6929,7 @@ function computeDriftScore(projects) {
   else riskLevel = "high";
   const measured = [];
   if (rs !== null) measured.push("runtime");
-  if (fs9 !== null) measured.push("framework");
+  if (fs8 !== null) measured.push("framework");
   if (ds !== null) measured.push("dependency");
   if (es !== null) measured.push("eol");
   return {
@@ -8266,11 +8266,11 @@ async function findGitDir(startDir) {
   while (dir !== root) {
     const gitPath = path29.join(dir, ".git");
     try {
-      const stat4 = await fs2.stat(gitPath);
-      if (stat4.isDirectory()) {
+      const stat3 = await fs2.stat(gitPath);
+      if (stat3.isDirectory()) {
         return gitPath;
       }
-      if (stat4.isFile()) {
+      if (stat3.isFile()) {
         const content = (await fs2.readFile(gitPath, "utf8")).trim();
         if (content.startsWith("gitdir: ")) {
           const resolved = path29.resolve(dir, content.slice(8));
@@ -8323,8 +8323,8 @@ async function readGitRemoteUrl(gitDir) {
 async function resolveGitConfigPath(gitDir) {
   const directConfig = path29.join(gitDir, "config");
   try {
-    const stat4 = await fs2.stat(directConfig);
-    if (stat4.isFile()) return directConfig;
+    const stat3 = await fs2.stat(directConfig);
+    if (stat3.isFile()) return directConfig;
   } catch {
   }
   const commonDirFile = path29.join(gitDir, "commondir");
@@ -8333,8 +8333,8 @@ async function resolveGitConfigPath(gitDir) {
     if (!commonDir) return void 0;
     const resolvedCommonDir = path29.resolve(gitDir, commonDir);
     const commonConfig = path29.join(resolvedCommonDir, "config");
-    const stat4 = await fs2.stat(commonConfig);
-    if (stat4.isFile()) return commonConfig;
+    const stat3 = await fs2.stat(commonConfig);
+    if (stat3.isFile()) return commonConfig;
   } catch {
     return void 0;
   }
@@ -8365,8 +8365,8 @@ var ProgressTrace = class _ProgressTrace {
   flushed = false;
   /** Returns a trace when VIBGRATE_TRACE_EVENTS is set, else null. */
   static fromEnv() {
-    const path35 = process.env.VIBGRATE_TRACE_EVENTS;
-    return path35 ? new _ProgressTrace(path35) : null;
+    const path33 = process.env.VIBGRATE_TRACE_EVENTS;
+    return path33 ? new _ProgressTrace(path33) : null;
   }
   record(op, data = {}) {
     if (this.flushed) return;
@@ -9405,7 +9405,7 @@ function manifestAdvisoryToAdvisory(m) {
   };
 }
 function sleep(ms) {
-  return new Promise((resolve8) => setTimeout(resolve8, ms));
+  return new Promise((resolve7) => setTimeout(resolve7, ms));
 }
 async function fetchJson(url, init, sem) {
   return sem.run(async () => {
@@ -9589,7 +9589,7 @@ var GIT_MAX_BUFFER = 64 * 1024 * 1024;
 var DEFAULT_MAX_COMMITS = 500;
 var FIELD_SEP = "";
 function runGit(cwd, args) {
-  return new Promise((resolve8) => {
+  return new Promise((resolve7) => {
     execFile(
       "git",
       args,
@@ -9608,8 +9608,8 @@ function runGit(cwd, args) {
         }
       },
       (err, stdout) => {
-        if (err) resolve8({ ok: false, stdout: "" });
-        else resolve8({ ok: true, stdout: typeof stdout === "string" ? stdout : String(stdout) });
+        if (err) resolve7({ ok: false, stdout: "" });
+        else resolve7({ ok: true, stdout: typeof stdout === "string" ? stdout : String(stdout) });
       }
     );
   });
@@ -9753,18 +9753,18 @@ function walkV1Dependencies(deps, out) {
 }
 function parsePnpmPackageKey(key) {
   const k = key.replace(/^\//, "");
-  let sep4 = -1;
+  let sep2 = -1;
   for (let i = k.startsWith("@") ? 1 : 0; i < k.length - 1; i++) {
     if (k[i] === "@" && /[0-9]/.test(k[i + 1])) {
-      sep4 = i;
+      sep2 = i;
       break;
     }
   }
   let name;
   let rest;
-  if (sep4 > 0) {
-    name = k.slice(0, sep4);
-    rest = k.slice(sep4 + 1);
+  if (sep2 > 0) {
+    name = k.slice(0, sep2);
+    rest = k.slice(sep2 + 1);
   } else {
     const slash = k.lastIndexOf("/");
     if (slash <= 0) return null;
@@ -9986,16 +9986,16 @@ function parsePomXml(content) {
     properties["project.version"] = ownVersion;
     properties["project.parent.version"] = ownVersion;
   }
-  const resolve8 = (value) => value.replace(/\$\{([^}]+)\}/g, (_, key) => properties[key] ?? `\${${key}}`);
+  const resolve7 = (value) => value.replace(/\$\{([^}]+)\}/g, (_, key) => properties[key] ?? `\${${key}}`);
   const deps = project.dependencies?.dependency;
   for (const dep of pomArray(deps)) {
     if (!dep || typeof dep !== "object") continue;
     const d = dep;
     if (d.version == null) continue;
-    const groupId = d.groupId != null ? resolve8(String(d.groupId)).trim() : "";
-    const artifactId = d.artifactId != null ? resolve8(String(d.artifactId)).trim() : "";
+    const groupId = d.groupId != null ? resolve7(String(d.groupId)).trim() : "";
+    const artifactId = d.artifactId != null ? resolve7(String(d.artifactId)).trim() : "";
     if (!groupId || !artifactId) continue;
-    const version = resolve8(String(d.version)).trim();
+    const version = resolve7(String(d.version)).trim();
     if (!isConcreteMavenVersion(version)) continue;
     considerVersion(out, `${groupId}:${artifactId}`, version);
   }
@@ -10978,8 +10978,8 @@ function analyzeUsage(root, packageName, ecosystem) {
         const full = path29.join(dir, entry.name);
         let content;
         try {
-          const stat4 = fs5.statSync(full);
-          if (stat4.size > MAX_FILE_BYTES) continue;
+          const stat3 = fs5.statSync(full);
+          if (stat3.size > MAX_FILE_BYTES) continue;
           content = fs5.readFileSync(full, "utf8");
         } catch {
           continue;
@@ -11639,8 +11639,8 @@ async function computeTreeMetadataHash(rootDir, options) {
       const relPath = relDir ? `${relDir}/${entry.name}` : entry.name;
       const absPath = path29.join(absDir, entry.name);
       try {
-        const stat4 = await fs2.stat(absPath);
-        leaves.push(`${relPath}|${stat4.size}|${stat4.mtimeMs}`);
+        const stat3 = await fs2.stat(absPath);
+        leaves.push(`${relPath}|${stat3.size}|${stat3.mtimeMs}`);
       } catch {
       }
     }
@@ -11656,35 +11656,6 @@ async function computeTreeMetadataHash(rootDir, options) {
   return digest.digest("hex");
 }
 
-// src/reporting/utils/fs.ts
-promisify(execFile);
-function stripBom(text) {
-  return text.charCodeAt(0) === 65279 ? text.slice(1) : text;
-}
-async function readJsonFile2(filePath) {
-  const txt = await fs2.readFile(filePath, "utf8");
-  return JSON.parse(stripBom(txt));
-}
-async function pathExists2(p) {
-  try {
-    await fs2.access(p);
-    return true;
-  } catch {
-    return false;
-  }
-}
-async function ensureDir2(dir) {
-  await fs2.mkdir(dir, { recursive: true });
-}
-async function writeJsonFile2(filePath, data) {
-  await ensureDir2(path29.dirname(filePath));
-  await fs2.writeFile(filePath, JSON.stringify(data, null, 2) + "\n", "utf8");
-}
-async function writeTextFile2(filePath, content) {
-  await ensureDir2(path29.dirname(filePath));
-  await fs2.writeFile(filePath, content, "utf8");
-}
-
-export { PROJECT_TYPE_TO_OSV_ECOSYSTEM, VERSION, brandProgressBar, buildVersionTimelines, compactUiPurpose, computeDriftScore, computeRepoFingerprint, computeUpgradeImpact, detectVcs, driftBar, ensureDir2 as ensureDir, fetchRiskySymbols, fetchScanPreflight, findPackageAnyEcosystem, findPackageTimeline, findVersionCrossings, getChangelogSignals, gitHistoryAvailable, loadConfig, normalizeConstraint, parseDsn, pathExists2 as pathExists, prepareCompressedUpload, projectTypeToVulnEcosystem, readJsonFile2 as readJsonFile, resolveHead, resolveRepositoryName, runCoreScan, severityRank, titleBox, versionSatisfies, workingTreeDirty, writeDefaultConfig, writeJsonFile2 as writeJsonFile, writeTextFile2 as writeTextFile };
-//# sourceMappingURL=chunk-JLRF5TFA.js.map
-//# sourceMappingURL=chunk-JLRF5TFA.js.map
+export { PROJECT_TYPE_TO_OSV_ECOSYSTEM, VERSION, brandProgressBar, buildVersionTimelines, compactUiPurpose, computeDriftScore, computeRepoFingerprint, computeUpgradeImpact, detectVcs, driftBar, fetchRiskySymbols, fetchScanPreflight, findPackageAnyEcosystem, findPackageTimeline, findVersionCrossings, getChangelogSignals, gitHistoryAvailable, loadConfig, normalizeConstraint, parseDsn, prepareCompressedUpload, projectTypeToVulnEcosystem, resolveHead, resolveRepositoryName, runCoreScan, severityRank, titleBox, versionSatisfies, workingTreeDirty, writeDefaultConfig };
+//# sourceMappingURL=chunk-JSNHZCIV.js.map
+//# sourceMappingURL=chunk-JSNHZCIV.js.map