@vibgrate/cli 2026.721.3 → 2026.722.2

package/DOCS.md

@@ -15,6 +15,7 @@ For a quick overview, see the [README](./README.md). This document covers everyt
   - [vg bisect](#vg-bisect)
   - [vg drift](#vg-drift)
   - [vg dsn create](#vg-dsn-create)
+  - [vg evidence](#vg-evidence)
   - [vg fix](#vg-fix)
   - [vg init](#vg-init)
   - [vg login](#vg-login)
@@ -243,6 +244,55 @@ with the Vibgrate API. Rate limited to 1 new DSN per 5 minutes per IP address.
 
 ---
 
+### vg evidence
+
+Vibgrate Evidence — signed, reproducible regulatory evidence. Register products with digital elements, freeze a shipped release into an immutable component manifest, then answer "which shipped products contain this vulnerability, at which versions, in which markets, still in support?" as evidence a third party can verify offline.
+
+Reporting duties are modelled as **regimes** (jurisdiction-neutral): the EU Cyber Resilience Act (`--regime cra`) is the first; DORA incident reporting (`--regime dora-incident`) ships too. A new jurisdiction is a regime profile, not a new command.
+
+```bash
+vg evidence init [--regime <id>] [--coordinator <csirt>] [--responsible <name>] [--filing-authority] [--ooo <contact>]
+vg evidence regimes
+vg evidence product add <name> [--markets DE,FR] [--classification <id>] [--in-scope] [--rationale <text>] [--bind <ref>] [--until <date>]
+vg evidence product list
+vg evidence product show <id>
+vg evidence release <product> <version> --from <sbom-or-scan> [--ship-date <date>] [--build-id <id>] [--digest <sha256>] [--markets DE,FR]
+vg evidence exposure <vuln> [--regime <id>] [--advisory <file>] [--offline] [--as-of <date>] [--products <substr>] [--include-eol] [--format table|json] [--pack --stage <stage>] [--bundle <dir>] [--tsa <url>]
+vg evidence readiness [--regime <id>] [--format table|json]
+vg evidence support-period <product> [--from <date>] [--until <date>]
+vg evidence pack <vuln> [--regime <id>] [--stage <stage>] [--advisory <file>] [--offline] [--out <file>]
+vg evidence drill [--regime <id>] [--scenario <name>] [--elapsed <seconds>]
+vg evidence watch [--regime <id>] [--since <date>] [--webhook <url>] [--format table|json]
+vg evidence verify <bundle> [--pub <file>]
+vg evidence push [--result <bundle-or-file>] [--regime <id>] [--dsn <dsn>] [--signed]
+vg evidence export [--out <dir>] [--regime <id>]
+```
+
+| Command | Description |
+|---------|-------------|
+| `vg evidence init` | Set org, coordinator CSIRT, and the person with filing authority |
+| `vg evidence regimes` | List available reporting regimes and their clocks |
+| `vg evidence product add` | Register a product with digital elements (PDE) |
+| `vg evidence release` | Freeze a shipped release into an immutable component manifest |
+| `vg evidence exposure` | Which shipped products contain a vulnerability — with signed evidence |
+| `vg evidence readiness` | Deterministic gap report against the regime's obligations |
+| `vg evidence drill` | Timed dry-run of the determination against a simulated advisory |
+| `vg evidence pack` | Build the submission pack a human pastes into the reporting platform |
+| `vg evidence watch` | Check CISA KEV for new exposure against your shipped components |
+| `vg evidence verify` | Verify an evidence bundle offline — no account, no network |
+| `vg evidence push` | Push the product registry (and an optional exposure result) to Vibgrate Cloud |
+| `vg evidence export` | Air-gap bundle of all evidence state |
+
+`exposure` matches against manifests **frozen at ship time**, not the current tree, and never guesses: a bound product with no frozen manifest returns `undetermined` with a reason. It runs fully `--offline` against a local advisory file, and can emit a signed evidence bundle (`--bundle <dir>`) that `vg evidence verify` checks offline with honest `verified` / `unverified` / `failed` states. Pass `--tsa <url>` to anchor the bundle to a trusted **RFC 3161** timestamp (`timestamp.tsr`), fully verifiable with `openssl ts -verify`.
+
+`watch` joins the CISA **Known Exploited Vulnerabilities (KEV)** catalog to the components in your frozen manifests (via OSV) and reports any KEV-listed vulnerability that affects a shipped release — alerting via stdout or `--webhook`. It **surfaces the KEV listing**; whether a vulnerability is "actively exploited" for a filing is your determination, not the tool's.
+
+**Exit codes** (CI-usable): `0` no exposure · `2` exposure found · `3` undetermined (manual review) · `1` operational error.
+
+No language model touches any figure in the evidence path, and every determination carries an evidence-not-compliance disclaimer. Vibgrate Evidence produces evidence to support your obligations under a regime; it does not determine compliance and is not legal advice.
+
+---
+
 ### vg fix
 
 Turn a drift scan into ranked, risk-tiered upgrade plans and **apply** the one
@@ -819,6 +869,141 @@ vg models
 
 Lists the local inference backends and models Vibgrate can see, so you know what is available without any network calls. Add `--json` for machine-readable output.
 
+To fetch a model through your Ollama runtime, use the `pull` subcommand. **No model is ever downloaded by default** — the download only happens when you pass `--yes`; without it, `pull` just prints the plan.
+
+```bash
+vg models pull qwen2.5-coder:7b --yes
+```
+
+| Flag | Default | Description |
+|------|---------|-------------|
+| `<name>` | — | Model to pull, e.g. `qwen2.5-coder:7b` |
+| `--runtime <id>` | `ollama` | Runtime to pull with |
+| `--yes` | — | Actually download (without this it only prints the plan) |
+
+---
+
+### vg code
+
+Propose a code edit for a plain-language instruction, grounded in the deterministic code graph. `vg code` is **dry-run by default**: it prints the proposed diff and writes nothing.
+
+```bash
+vg code "add a --timeout flag to the scan command"
+```
+
+**Agentic sessions.** With a real model, `vg code` is a coding *agent*, not just a one-shot editor: the model is given tools and works in steps — **search the code graph**, read files, check a symbol's blast radius, edit, create/delete files, and run your tests or build — until the task is done. Every mutating step (an edit or a command) is **governed**: you approve it, or run autonomously with `--auto`. Read-only steps (search/read/list/impact) run without prompting. `--single` forces the old one-shot diff; `--max-steps <n>` caps the loop.
+
+**Guided mode.** Run `vg code` with no instruction at an interactive terminal and it walks you through everything: it builds the code map, then asks where the model should run — a local model, or one of the current top providers (Claude, GPT, Grok, Gemini, …) surfaced live from the catalog — and which model, with an "enter a slug myself" option at every step. Before pulling any local model it runs a memory pre-flight (estimated footprint vs free RAM/VRAM and already-loaded models) and won't pull a model your machine can't run; then it drops into an agent session where you describe tasks and approve each change. For scripts and CI, pass an instruction with `--auto` (or `--mock`) — the agent only prompts at a TTY, so automation never blocks.
+
+While a session is active, Vibgrate Graph (`vg serve`) runs as a separate process for the life of the session and is stopped when you exit. Every graph-backed call is attributed to VG Code and the model in use, so `vg savings` reports token/$ savings **per model**.
+
+**A full local session (no cloud):**
+
+```bash
+# one-time: a local coding model (nothing is downloaded by default)
+vg models pull qwen2.5-coder:7b --yes
+
+# start a guided agent session — pick "Local model" → qwen2.5-coder:7b
+vg code
+```
+
+```text
+  VG Code  · graph-grounded coding · v2026.x
+
+  ✔ Code map built
+  ✔ Model catalog loaded
+  ? Where should the model run?
+  ❯ Local model (on your machine)   1 found
+    Anthropic (Claude)              via OpenRouter
+    …
+  ✔ qwen2.5-coder:7b
+  ◆ Ready — ollama/qwen2.5-coder:7b · graph 48213. Describe a task; empty line to exit.
+
+  code › add a --timeout flag to the scan command and use it
+
+    → search_code(query: --timeout flag scan command)
+      scanCommand (function) src/commands/scan.ts:12
+    → read_file(path: src/commands/scan.ts)
+      src/commands/scan.ts (40 lines): …
+    → graph_impact(symbol: runScan)
+      3 symbol(s) depend on runScan: …
+  I'll add the option and thread it through.
+    → edit_file(path: src/commands/scan.ts, …)
+--- a/src/commands/scan.ts
++++ b/src/commands/scan.ts
+@@ …
++  .option('--timeout <ms>', 'abort the scan after <ms> milliseconds')
+  ? Apply edit to src/commands/scan.ts? [Y/n] y
+      ✔ edited src/commands/scan.ts
+    → run_command(command: npm test -- scan)
+  ? Run `npm test -- scan`? [y/N] y
+      ✔ exit 0  … 12 passing
+    → finish(summary: added a --timeout flag to scan and covered it with tests)
+
+  ✔ added a --timeout flag to scan and covered it with tests
+    +6 -1 across 1 file(s) · via ollama/qwen2.5-coder:7b
+```
+
+Run it non-interactively with `vg code "add a --timeout flag to scan" --provider ollama --model qwen2.5-coder:7b --auto`, or against a hosted model with `--provider openrouter --model anthropic/claude-3.5-sonnet` (set `OPENROUTER_API_KEY`).
+
+**In a session** you can type slash-commands: `/undo` reverts the last change, `/diff` shows it, `/model` switches model, `/cost` shows the running token/$ cost, `/help` lists them, `/exit` quits.
+
+**More session controls:**
+
+- `--stream` streams the model's output live as it's generated.
+- `--verify [command]` runs your tests after the agent finishes and, if they fail, feeds the failures back so it fixes them (uses the `testCommand` from config if you don't name one).
+- `--continue` resumes your most recent session — it recaps what was already done for the model and restores `/undo`.
+- A live **token/$ meter** shows after each task and via `/cost` (cost is shown when the model's price is known; local models are free).
+- **External MCP tools:** list servers under `mcpServers` in `.vibgrate/code.json` and the agent can call their tools (namespaced `mcp__<server>__<tool>`); read-only tools run freely, anything else is approved like a built-in mutating tool. VG Code also **adopts the standard MCP config files** already in your repo — `.mcp.json` (Claude Code), `.cursor/mcp.json` (Cursor), and `.vscode/mcp.json` (VS Code) — and merges them with your `.vibgrate/code.json` (which wins on any name clash), so servers you've already configured for another tool work here with no extra setup. Both local (`command`) and remote (`url`) servers are supported.
+
+**Tools the agent has:** searching is the code graph (`search_code`) — not a grep — plus `read_file`, `list_files`, `graph_impact` (blast radius), **`library_docs`** (version-correct docs for a dependency you actually have installed, so the model uses the right API for your version), `edit_file`, `create_file`, `delete_file`, and `run_command`.
+
+**Safety.** The agent never sends a secrets file (`.env`, keys, credentials) to the model, and redacts stray credential shapes from any file it reads. Under `--auto`, a denylist blocks catastrophic commands (filesystem wipes, `curl … | sh`, force-push, …); interactively you see and approve each command yourself.
+
+**Configure once** in `.vibgrate/code.json` so you can then just run `vg code` (flags still override):
+
+```json
+{
+  "provider": "ollama",
+  "model": "qwen2.5-coder:7b",
+  "testCommand": "npm test",
+  "auto": false,
+  "denyCommands": ["deploy", "kubectl\\s+delete"],
+  "maxSteps": 24,
+  "mcpServers": {
+    "playwright": { "command": "npx", "args": ["-y", "@playwright/mcp"] }
+  }
+}
+```
+
+It assembles a small, high-signal context from the map (the relevant symbols, their relations, the blast radius of changing them, and any hard constraints), asks the model you choose for a minimal edit, and applies that edit through a deterministic merge so the change lands exactly where it was meant to.
+
+Writing is opt-in and confirmed. `--apply` walks the full inspect → assess → dry-run → approve → execute → verify → log lifecycle, and still requires your explicit `--yes` (or an interactive confirmation) — there is no write-without-consent path.
+
+```bash
+vg code "rename readCfg to readConfig everywhere it is called" --apply --yes
+```
+
+Pick a backend with `--provider` and `--model`. No model is bundled, and nothing is installed until you first use a backend that needs it:
+
+- **Local** — `--provider ollama` or `--provider lmstudio` (or `--local` to force on-device only, no network).
+- **Hosted** — any OpenAI-compatible endpoint: `--provider openrouter` / `litellm` / `openai` / `together`. API keys are read from the environment only (e.g. `OPENROUTER_API_KEY`), never passed as flags.
+
+With no `--provider`, `vg code` chooses from what you have already configured (a hosted key, or a locally-pulled model) and never dials a cloud endpoint you didn't set up.
+
+| Flag | Default | Description |
+|------|---------|-------------|
+| `<instruction>` | — | What to change, in plain language |
+| `--provider <id>` | auto | `ollama`, `lmstudio`, `openrouter`, `litellm`, `openai`, `together`, `llama-cpp` |
+| `--model <id>` | — | Model id (or set `VG_CODE_MODEL`) |
+| `--file <path>` | — | Restrict the edit surface to this file (repeatable) |
+| `--budget <n>` | `3000` | Approx context token budget |
+| `--apply` | — | Write the change (still requires `--yes` or a confirmation) |
+| `--yes` | — | Consent to write, or to a first-use package install, non-interactively |
+| `--local` | — | On-device backends only; never touch the network |
+
+Add `--json` for the full machine-readable result (proposed changes, diffs, and the verification summary), or `--out <file>` to write it for CI. Requires a map — run `vg` first if you have not built one.
+
 ---
 
 ### vg path

package/README.md

@@ -301,6 +301,7 @@ See [docs/QUICKSTART-PROMPT.md](./docs/QUICKSTART-PROMPT.md) for the full prompt
 | `vg benchmark` | Reproducible build + memory + token-reduction benchmark (honest estimates) |
 | `vg build [path]` | Build / update the code map (incremental, deterministic) |
 | `vg bundle` | Build an air-gapped bundle (grammars + graph + library catalog) |
+| `vg code "<instruction>"` | Propose a graph-grounded code edit (dry-run by default; `--apply --yes` to write) |
 | `vg embed` | Precompute the semantic index for instant `vg ask` |
 | `vg export` | Export the map (json / ndjson / graphml / dot / cypher / md / html / SBOM) |
 | `vg facts <file>` | Deterministic facts for a node (contracts, invariants) |
@@ -309,7 +310,7 @@ See [docs/QUICKSTART-PROMPT.md](./docs/QUICKSTART-PROMPT.md) for the full prompt
 | `vg install` / `vg uninstall` | Wire (or remove) **Vibgrate AI Context** + skill in your AI assistant |
 | `vg lib <package>` | Version-correct, drift-annotated library docs |
 | `vg map` / `vg hubs` / `vg areas` / `vg oddities` | Map insights: overview, most-depended-on code, natural groupings, cross-area smells |
-| `vg models` | The local model fleet (Ollama / LM Studio / gguf), discovered offline |
+| `vg models` / `vg models pull` | The local model fleet (Ollama / LM Studio / gguf), discovered offline; `pull` fetches one (needs `--yes`) |
 | `vg path <from> <to>` | How A connects to B (shortest path) |
 | `vg savings` | Local report of tokens/$ saved vs a grep baseline (estimates) |
 | `vg serve` | Start **Vibgrate AI Context** (local-first MCP: code map + drift + version-correct docs) |

package/dist/baseline-BD3A7EXD.js

@@ -0,0 +1,7 @@
+export { baselineCommand, runBaseline } from './chunk-NONYJLOJ.js';
+import './chunk-5BDHQ7DD.js';
+import './chunk-RXP66R2E.js';
+import './chunk-GI6W53LM.js';
+import './chunk-CRAMOEBE.js';
+//# sourceMappingURL=baseline-BD3A7EXD.js.map
+//# sourceMappingURL=baseline-BD3A7EXD.js.map

package/dist/{baseline-37G4TINM.js.map → baseline-BD3A7EXD.js.map}

@@ -1 +1 @@
-{"version":3,"sources":[],"names":[],"mappings":"","file":"baseline-37G4TINM.js"}
+{"version":3,"sources":[],"names":[],"mappings":"","file":"baseline-BD3A7EXD.js"}

package/dist/chunk-2O5YZVZV.js

@@ -0,0 +1,417 @@
+import { refreshIfStale, TOOLS, renderToolResult, warmEmbedderInBackground, countTokens, renderHtml, renderReport } from './chunk-3MXNNBLI.js';
+import { VERSION } from './chunk-5BDHQ7DD.js';
+import { parseGraph, sanitizeClient, recordSaving, SAVINGS_TOOLS, PER_FILE_TOKENS, serializeGraph } from './chunk-WNIIKCNF.js';
+import * as fs from 'fs';
+import * as path from 'path';
+import { Server } from '@modelcontextprotocol/sdk/server/index.js';
+import { StdioServerTransport } from '@modelcontextprotocol/sdk/server/stdio.js';
+import { ListToolsRequestSchema, CallToolRequestSchema } from '@modelcontextprotocol/sdk/types.js';
+
+var PROBE_INTERVAL_MS = 2e3;
+var MAX_PROBE_INTERVAL_MS = 3e4;
+var PROBE_DUTY_FACTOR = 20;
+var REFRESH_BUDGET_MS = 5e3;
+var FAILURE_COOLDOWN_MS = 6e4;
+var GraphSource = class {
+  constructor(graphPath, refresh = false, tuning = {}) {
+    this.graphPath = graphPath;
+    this.refresh = refresh;
+    this.tuning = tuning;
+    this.root = path.dirname(path.dirname(graphPath));
+  }
+  graphPath;
+  refresh;
+  tuning;
+  cachedMtimeMs = -1;
+  cached = null;
+  root;
+  lastProbeAt = 0;
+  failedUntil = 0;
+  inflight = null;
+  /** Self-tuned: grows with measured probe cost so huge repos aren't penalized. */
+  probeIntervalMs = PROBE_INTERVAL_MS;
+  /** Current graph: auto-refreshed if the tree drifted, reloaded if the file changed. */
+  async get() {
+    if (this.refresh) await this.maybeRefresh();
+    const stat = fs.statSync(this.graphPath);
+    if (stat.mtimeMs !== this.cachedMtimeMs || !this.cached) {
+      this.cached = parseGraph(fs.readFileSync(this.graphPath, "utf8"));
+      this.cachedMtimeMs = stat.mtimeMs;
+    }
+    return this.cached;
+  }
+  /**
+   * Debounced, single-flight refresh. Never throws — a refresh problem must
+   * degrade to "answer from the current map", not break the tool call.
+   */
+  async maybeRefresh() {
+    const now = Date.now();
+    if (!this.inflight) {
+      const interval = this.tuning.probeIntervalMs ?? this.probeIntervalMs;
+      if (now < this.failedUntil || now - this.lastProbeAt < interval) return;
+      this.lastProbeAt = now;
+      this.inflight = refreshIfStale(this.root).then((r) => {
+        if (r.status === "error") this.failedUntil = Date.now() + FAILURE_COOLDOWN_MS;
+        if (r.status === "fresh" || r.status === "no-snapshot" || r.status === "locked") {
+          const cost = Date.now() - now;
+          this.probeIntervalMs = Math.min(
+            MAX_PROBE_INTERVAL_MS,
+            Math.max(PROBE_INTERVAL_MS, cost * PROBE_DUTY_FACTOR)
+          );
+        }
+      }).catch(() => {
+        this.failedUntil = Date.now() + FAILURE_COOLDOWN_MS;
+      }).finally(() => {
+        this.inflight = null;
+      });
+    }
+    await Promise.race([this.inflight, sleep(this.tuning.refreshBudgetMs ?? REFRESH_BUDGET_MS)]);
+  }
+};
+function createServer(source, opts = {}) {
+  const { savings = false, shareStats = false, local = false, dedup = false, stats } = opts;
+  const record = savings || shareStats;
+  const root = path.dirname(path.dirname(source.graphPath));
+  const seen = /* @__PURE__ */ new Set();
+  const server = new Server(
+    { name: "vg", version: VERSION },
+    {
+      capabilities: { tools: {} },
+      // Routing guidance once at the server level (hosts that surface
+      // `instructions` get it at zero per-step schema cost): the flashlight
+      // vs the map.
+      instructions: 'vg is a code map. Use search_symbols to find a known name or literal string fast \u2014 a multi-word/quoted phrase runs a complete literal sweep and reports totalTextMatches, so reach for it instead of grep even for plain-string "find every occurrence" lookups. Use orient/query_graph for meaning: symptoms, relationships, and what-breaks-if. Responses are concise by default; pass response_format:"detailed" only when a node proves load-bearing. Navigate as little as possible: one good search/query usually locates the code. As soon as you have the file and line, read that file and make the edit \u2014 do not call further graph tools unless the edit fails or the match was wrong. For how-do-I-use-this-library questions call resolve_library once, then library_docs with the returned targetId and a focused query: the docs are official and matched to the version THIS project has installed (drift-annotated) \u2014 prefer them over web search or training-data recall when they conflict. Skip them for language built-ins or APIs already shown in context. If two library_docs calls have not surfaced the section you need, read the package source under node_modules instead of searching again.'
+    }
+  );
+  server.setRequestHandler(ListToolsRequestSchema, async () => ({
+    tools: TOOLS.map((t) => ({
+      name: t.name,
+      description: t.description,
+      inputSchema: t.inputSchema,
+      annotations: { readOnlyHint: true, openWorldHint: false }
+    }))
+  }));
+  server.setRequestHandler(CallToolRequestSchema, async (request) => {
+    const tool = TOOLS.find((t) => t.name === request.params.name);
+    if (!tool) {
+      return errorResult(`unknown tool "${request.params.name}"`);
+    }
+    let graph;
+    try {
+      graph = await source.get();
+    } catch {
+      return errorResult(
+        "no code map found. Run `vg` in the project to build .vibgrate/graph.json, then retry."
+      );
+    }
+    const startedAt = Date.now();
+    try {
+      const args = request.params.arguments ?? {};
+      const result = await tool.handler(graph, args, { root, local, dedup, seen });
+      const ms = Date.now() - startedAt;
+      stats?.record({ ...measureCall(tool.name, result), client: sanitizeClient(detectClient(server)), ms });
+      if (record) recordUsage(root, tool.name, result, detectClient(server), ms);
+      return renderToolResult(result);
+    } catch (err) {
+      stats?.record({
+        tool: tool.name,
+        client: sanitizeClient(detectClient(server)),
+        outcome: "miss",
+        ms: Date.now() - startedAt,
+        vgTokens: 0,
+        baselineTokens: 0
+      });
+      return errorResult(`tool "${tool.name}" failed: ${err.message}`);
+    }
+  });
+  return server;
+}
+async function serveStdio(graphPath, opts = {}) {
+  const source = new GraphSource(graphPath, opts.refresh !== false);
+  const server = createServer(source, opts);
+  warmEmbedderInBackground(opts.local);
+  await server.connect(new StdioServerTransport());
+}
+function sleep(ms) {
+  return new Promise((resolve) => {
+    const timer = setTimeout(resolve, ms);
+    timer.unref?.();
+  });
+}
+function recordUsage(root, tool, result, client, ms) {
+  recordSaving(
+    root,
+    { ...measureCall(tool, result), source: "mcp", client: sanitizeClient(client), ...ms !== void 0 ? { ms } : {} },
+    Date.now()
+  );
+}
+function measureCall(tool, result) {
+  const outcome = classifyOutcome(result);
+  let vgTokens = 0;
+  let baselineTokens = 0;
+  if (SAVINGS_TOOLS.has(tool) && result && typeof result === "object") {
+    vgTokens = countTokens(renderedText(renderToolResult(result)));
+    baselineTokens = referencedFiles(result).size * PER_FILE_TOKENS;
+  }
+  return { tool, outcome, vgTokens, baselineTokens };
+}
+function detectClient(server) {
+  try {
+    const info = server.getClientVersion?.();
+    return typeof info?.name === "string" ? info.name : void 0;
+  } catch {
+    return void 0;
+  }
+}
+function classifyOutcome(result) {
+  if (Array.isArray(result)) return result.length === 0 ? "miss" : "complete";
+  if (!result || typeof result !== "object") return "miss";
+  const r = result;
+  if (typeof r.error === "string" && r.error) return "miss";
+  if (r.connected === false) return "miss";
+  if (Array.isArray(r.matches) && r.matches.length === 0) return "miss";
+  return isPartial(r) ? "partial" : "complete";
+}
+function isPartial(r) {
+  if (r.moreAvailable === true) return true;
+  if (r._truncated && typeof r._truncated === "object") return true;
+  for (const [key, value] of Object.entries(r)) {
+    if (typeof value !== "number" || !key.endsWith("Total")) continue;
+    const base = key.slice(0, -"Total".length);
+    const shown = Array.isArray(r[base]) ? r[base].length : 0;
+    if (value > shown) return true;
+  }
+  return false;
+}
+function renderedText(rendered) {
+  const block = rendered.content?.find((b) => b.type === "text");
+  return block && "text" in block && typeof block.text === "string" ? block.text : "";
+}
+function referencedFiles(result) {
+  const r = result;
+  const files = /* @__PURE__ */ new Set();
+  if (typeof r.file === "string" && r.file) files.add(r.file);
+  for (const m of asArray(r.matches)) {
+    const f = m.file;
+    if (typeof f === "string" && f) files.add(f);
+  }
+  for (const name of [...asArray(r.calls), ...asArray(r.calledBy)]) {
+    if (typeof name !== "string") continue;
+    const i = name.indexOf(":");
+    if (i > 0) files.add(name.slice(0, i));
+  }
+  return files;
+}
+function asArray(v) {
+  return Array.isArray(v) ? v : [];
+}
+function errorResult(message) {
+  return { content: [{ type: "text", text: message }], isError: true };
+}
+
+// src/engine/export.ts
+function formatForExt(ext) {
+  switch (ext.toLowerCase()) {
+    case ".json":
+      return "json";
+    case ".ndjson":
+      return "ndjson";
+    case ".graphml":
+      return "graphml";
+    case ".dot":
+    case ".gv":
+      return "dot";
+    case ".cypher":
+      return "cypher";
+    case ".sql":
+      return "sql";
+    case ".md":
+      return "md";
+    case ".html":
+      return "html";
+    default:
+      return null;
+  }
+}
+function exportGraph(format, ctx) {
+  switch (format) {
+    case "json":
+      return serializeGraph(ctx.graph);
+    case "md":
+      return renderReport(ctx.graph);
+    case "html":
+      return renderHtml(ctx.graph);
+    case "ndjson":
+      return ndjson(ctx.graph);
+    case "graphml":
+      return graphml(ctx.graph);
+    case "dot":
+      return dot(ctx.graph);
+    case "cypher":
+      return cypher(ctx.graph);
+    case "sql":
+      return sql(ctx);
+    case "cyclonedx":
+      return cyclonedx(ctx);
+    case "spdx":
+      return spdx(ctx);
+  }
+}
+function ndjson(graph) {
+  const rows = graph.facts && graph.facts.length ? graph.facts : graph.nodes;
+  return rows.map((r) => JSON.stringify(r)).join("\n") + "\n";
+}
+function esc(s) {
+  return s.replace(/&/g, "&amp;").replace(/</g, "&lt;").replace(/>/g, "&gt;").replace(/"/g, "&quot;");
+}
+function graphml(graph) {
+  const lines = [];
+  lines.push('<?xml version="1.0" encoding="UTF-8"?>');
+  lines.push('<graphml xmlns="http://graphml.graphdrawing.org/xmlns">');
+  lines.push('  <key id="name" for="node" attr.name="name" attr.type="string"/>');
+  lines.push('  <key id="kind" for="node" attr.name="kind" attr.type="string"/>');
+  lines.push('  <key id="file" for="node" attr.name="file" attr.type="string"/>');
+  lines.push('  <key id="ekind" for="edge" attr.name="kind" attr.type="string"/>');
+  lines.push('  <graph edgedefault="directed">');
+  for (const n of graph.nodes) {
+    lines.push(`    <node id="${esc(n.id)}"><data key="name">${esc(n.qualifiedName)}</data><data key="kind">${esc(n.kind)}</data><data key="file">${esc(n.file)}</data></node>`);
+  }
+  for (const e of graph.edges) {
+    lines.push(`    <edge source="${esc(e.src)}" target="${esc(e.dst)}"><data key="ekind">${esc(e.kind)}</data></edge>`);
+  }
+  lines.push("  </graph>");
+  lines.push("</graphml>");
+  return lines.join("\n") + "\n";
+}
+function dot(graph) {
+  const lines = ["digraph vg {"];
+  for (const n of graph.nodes) lines.push(`  "${n.id}" [label="${dotEsc(n.qualifiedName)}"];`);
+  for (const e of graph.edges) lines.push(`  "${e.src}" -> "${e.dst}" [label="${e.kind}"];`);
+  lines.push("}");
+  return lines.join("\n") + "\n";
+}
+function dotEsc(s) {
+  return s.replace(/"/g, '\\"');
+}
+function cypher(graph) {
+  const lines = [];
+  for (const n of graph.nodes) {
+    lines.push(
+      `CREATE (:\`${cypherLabel(n.kind)}\` {id:${q(n.id)}, name:${q(n.qualifiedName)}, file:${q(n.file)}});`
+    );
+  }
+  for (const e of graph.edges) {
+    lines.push(
+      `MATCH (a {id:${q(e.src)}}),(b {id:${q(e.dst)}}) CREATE (a)-[:\`${cypherLabel(e.kind)}\`]->(b);`
+    );
+  }
+  return lines.join("\n") + "\n";
+}
+function cypherLabel(s) {
+  return s.replace(/[^A-Za-z0-9_]/g, "_");
+}
+function q(s) {
+  return JSON.stringify(s);
+}
+function sql(ctx) {
+  const graph = ctx.graph;
+  const lines = [];
+  lines.push("BEGIN;");
+  lines.push("CREATE TABLE IF NOT EXISTS meta (key TEXT PRIMARY KEY, value TEXT);");
+  const meta = [
+    ["schemaVersion", graph.schemaVersion],
+    ["generatedAt", ctx.generatedAt],
+    ["corpusHash", graph.provenance.corpusHash],
+    ["tool", graph.provenance.tool],
+    ["toolVersion", graph.provenance.version],
+    ["resolver", graph.provenance.resolver.join(",")],
+    ["fingerprint", graph.provenance.toolchain?.fingerprint ?? null]
+  ];
+  for (const [k, v] of meta) lines.push(`INSERT INTO meta VALUES (${sqlStr(k)}, ${sqlStr(v)});`);
+  lines.push(
+    "CREATE TABLE IF NOT EXISTS nodes (id TEXT PRIMARY KEY, kind TEXT, name TEXT, qualified_name TEXT, file TEXT, span_start INTEGER, span_end INTEGER, lang TEXT, visibility TEXT, signature TEXT, importance REAL, area INTEGER, is_hub INTEGER, tested INTEGER, coverage REAL);"
+  );
+  for (const n of graph.nodes) {
+    lines.push(
+      `INSERT INTO nodes VALUES (${sqlStr(n.id)}, ${sqlStr(n.kind)}, ${sqlStr(n.name)}, ${sqlStr(n.qualifiedName)}, ${sqlStr(n.file)}, ${sqlNum(n.span.start)}, ${sqlNum(n.span.end)}, ${sqlStr(n.lang)}, ${sqlStr(n.visibility)}, ${sqlStr(n.signature)}, ${sqlNum(n.importance)}, ${sqlNum(n.area)}, ${sqlBool(n.isHub)}, ${sqlBool(n.tested)}, ${sqlNum(n.coverage)});`
+    );
+  }
+  lines.push(
+    'CREATE TABLE IF NOT EXISTS edges (id TEXT PRIMARY KEY, kind TEXT, src TEXT, dst TEXT, resolution TEXT, confidence REAL, epistemic TEXT, surprise REAL, "count" INTEGER);'
+  );
+  for (const e of graph.edges) {
+    lines.push(
+      `INSERT INTO edges VALUES (${sqlStr(e.id)}, ${sqlStr(e.kind)}, ${sqlStr(e.src)}, ${sqlStr(e.dst)}, ${sqlStr(e.resolution)}, ${sqlNum(e.confidence)}, ${sqlStr(e.epistemic)}, ${sqlNum(e.surprise)}, ${sqlNum(e.count)});`
+    );
+  }
+  lines.push("CREATE TABLE IF NOT EXISTS areas (id INTEGER PRIMARY KEY, label TEXT, size INTEGER, cohesion REAL, external_edges INTEGER);");
+  lines.push("CREATE TABLE IF NOT EXISTS area_members (area_id INTEGER, node_id TEXT);");
+  for (const a of graph.areas) {
+    lines.push(`INSERT INTO areas VALUES (${sqlNum(a.id)}, ${sqlStr(a.label)}, ${sqlNum(a.size)}, ${sqlNum(a.cohesion)}, ${sqlNum(a.externalEdges)});`);
+    for (const m of a.members) lines.push(`INSERT INTO area_members VALUES (${sqlNum(a.id)}, ${sqlStr(m)});`);
+  }
+  if (graph.facts && graph.facts.length) {
+    lines.push("CREATE TABLE IF NOT EXISTS facts (id TEXT PRIMARY KEY, kind TEXT, predicate_json TEXT, derived_by TEXT, confidence TEXT);");
+    lines.push("CREATE TABLE IF NOT EXISTS fact_subjects (fact_id TEXT, node_id TEXT);");
+    lines.push("CREATE TABLE IF NOT EXISTS fact_evidence (fact_id TEXT, file TEXT, span_start INTEGER, span_end INTEGER);");
+    for (const f of graph.facts) {
+      lines.push(`INSERT INTO facts VALUES (${sqlStr(f.id)}, ${sqlStr(f.kind)}, ${sqlStr(JSON.stringify(f.predicate))}, ${sqlStr(f.derivedBy)}, ${sqlStr(f.confidence)});`);
+      for (const s of f.subjectIds) lines.push(`INSERT INTO fact_subjects VALUES (${sqlStr(f.id)}, ${sqlStr(s)});`);
+      for (const ev of f.evidence) lines.push(`INSERT INTO fact_evidence VALUES (${sqlStr(f.id)}, ${sqlStr(ev.file)}, ${sqlNum(ev.span.start)}, ${sqlNum(ev.span.end)});`);
+    }
+  }
+  lines.push("COMMIT;");
+  return lines.join("\n") + "\n";
+}
+function sqlStr(v) {
+  if (v == null) return "NULL";
+  return `'${v.replace(/'/g, "''")}'`;
+}
+function sqlNum(v) {
+  return v == null || !Number.isFinite(v) ? "NULL" : String(v);
+}
+function sqlBool(v) {
+  return v == null ? "NULL" : v ? "1" : "0";
+}
+function cyclonedx(ctx) {
+  const components = [];
+  for (const d of ctx.deps ?? []) {
+    components.push({
+      type: "library",
+      name: d.name,
+      version: d.installed ?? d.declared,
+      purl: d.ecosystem === "npm" ? `pkg:npm/${d.name}@${d.installed ?? ""}` : void 0
+    });
+  }
+  for (const m of ctx.models ?? []) {
+    components.push({ type: "machine-learning-model", name: m.name, properties: [{ name: "vg:runtime", value: m.runtime }] });
+  }
+  const bom = {
+    bomFormat: "CycloneDX",
+    specVersion: "1.6",
+    metadata: { timestamp: ctx.generatedAt, tools: [{ name: "vg", version: ctx.graph.provenance.version }] },
+    components
+  };
+  return JSON.stringify(bom, null, 2) + "\n";
+}
+function spdx(ctx) {
+  const packages = (ctx.deps ?? []).map((d) => ({
+    SPDXID: `SPDXRef-Package-${cypherLabel(d.name)}`,
+    name: d.name,
+    versionInfo: d.installed ?? d.declared,
+    downloadLocation: "NOASSERTION"
+  }));
+  const doc = {
+    spdxVersion: "SPDX-2.3",
+    dataLicense: "CC0-1.0",
+    SPDXID: "SPDXRef-DOCUMENT",
+    name: "vg-sbom",
+    creationInfo: { created: ctx.generatedAt, creators: [`Tool: vg-${ctx.graph.provenance.version}`] },
+    packages
+  };
+  return JSON.stringify(doc, null, 2) + "\n";
+}
+
+export { GraphSource, createServer, exportGraph, formatForExt, serveStdio };
+//# sourceMappingURL=chunk-2O5YZVZV.js.map
+//# sourceMappingURL=chunk-2O5YZVZV.js.map