@vibgrate/cli 2026.722.2 → 2026.727.2

package/README.md

@@ -293,12 +293,15 @@ See [docs/QUICKSTART-PROMPT.md](./docs/QUICKSTART-PROMPT.md) for the full prompt
 
 ## Command reference
 
+Under each set, commands are listed A–Z. A short **typical path** (usual order) is called out where it helps.
+
 ### Code graph
 
+**Typical path:** `vg build` → `vg status` → `vg ask` → `vg impact` → `vg share`
+
 | Command | Description |
 | --- | --- |
 | `vg ask "<question>"` | Query the map in natural language |
-| `vg benchmark` | Reproducible build + memory + token-reduction benchmark (honest estimates) |
 | `vg build [path]` | Build / update the code map (incremental, deterministic) |
 | `vg bundle` | Build an air-gapped bundle (grammars + graph + library catalog) |
 | `vg code "<instruction>"` | Propose a graph-grounded code edit (dry-run by default; `--apply --yes` to write) |
@@ -307,10 +310,10 @@ See [docs/QUICKSTART-PROMPT.md](./docs/QUICKSTART-PROMPT.md) for the full prompt
 | `vg facts <file>` | Deterministic facts for a node (contracts, invariants) |
 | `vg guide <file>` | Cited standards / practices for a node (free pack) |
 | `vg impact <file>` | What breaks if you change it — and the tests to run |
-| `vg install` / `vg uninstall` | Wire (or remove) **Vibgrate AI Context** + skill in your AI assistant |
+| `vg install` / `vg uninstall` | Wire (or remove) **Vibgrate AI Context** + skill in your AI assistant (`--detect`, `--all`, `--list`) |
 | `vg lib <package>` | Version-correct, drift-annotated library docs |
 | `vg map` / `vg hubs` / `vg areas` / `vg oddities` | Map insights: overview, most-depended-on code, natural groupings, cross-area smells |
-| `vg models` / `vg models pull` | The local model fleet (Ollama / LM Studio / gguf), discovered offline; `pull` fetches one (needs `--yes`) |
+| `vg models` | Code Modes (Spark / Flow / Forge) + local fleet (Ollama / LM Studio / gguf); `install` / `pull` by default (`--dry-run` to preview) |
 | `vg path <from> <to>` | How A connects to B (shortest path) |
 | `vg savings` | Local report of tokens/$ saved vs a grep baseline (estimates) |
 | `vg serve` | Start **Vibgrate AI Context** (local-first MCP: code map + drift + version-correct docs) |
@@ -321,27 +324,50 @@ See [docs/QUICKSTART-PROMPT.md](./docs/QUICKSTART-PROMPT.md) for the full prompt
 | `vg tree <file>` | Call tree rooted at a node |
 | `vg unknowns` | What the graph cannot resolve, ranked by blast radius |
 
-### Drift reporting
+### Diagnostics, IDE & runtime
+
+**Typical path:** `vg doctor` → `vg lsp` → `vg daemon`
+
+| Command | Description |
+| --- | --- |
+| `vg daemon` | Local workspace daemon for multi-root graph sessions (IDE / agents): `status`, `ensure`, `publish`, `query`, `impact`, … |
+| `vg doctor` | Read-only diagnosis: config, credentials (redacted), map freshness, hosted reachability, MCP launch |
+| `vg lsp` | Language server (stdio) — engine behind Vibgrate for VS Code and other thin IDE clients |
+| `vg policy` | Show production context-policy pin; `vg policy verify <file>` for signed learning patches |
+
+### Drift scoring & supply chain
+
+**Typical path:** `vg init` → `vg scan` → `vg baseline` → `vg report` → `vg fix`
 
 | Command | Description |
 | --- | --- |
 | `vg baseline [path]` | Create a drift baseline |
 | `vg bisect <package> <constraint>` | The commit where a dependency crossed a version line (`--assert` to gate CI) |
 | `vg drift` | What is outdated across dependencies (offline; `--online` for currency) |
-| `vg dsn create` | Generate a DSN token |
+| `vg evidence` | Signed, reproducible regulatory evidence (regime-neutral; CRA first) |
 | `vg fix` | Ranked, risk-tiered upgrade plans from the hosted planner — then apply the one you choose |
 | `vg init [path]` | Initialise config and `.vibgrate/` |
-| `vg login` / `vg logout` | Authenticate the CLI with your Vibgrate workspace (or clear stored credentials) |
-| `vg push` | Upload scan results to Vibgrate Cloud |
 | `vg report` | Generate a report from a scan artifact |
 | `vg sbom export` / `delta` / `vex` | Export CycloneDX/SPDX SBOM, diff two artifacts, or emit an OpenVEX document |
 | `vg scan [path]` | Scan for upgrade drift |
-| `vg scan --vulns` | Also detect known vulnerabilities (OSV; offline via `--package-manifest`) |
 | `vg scan --full` | Comprehensive scan: drift + vulnerabilities + a banned-dependency report |
 | `vg scan --push` | Scan and push results to Vibgrate Cloud |
+| `vg scan --vulns` | Also detect known vulnerabilities (OSV; offline via `--package-manifest`) |
 | `vg update` | Check for and install updates |
 | `vg why <package>` | Who introduced a dependency, its version history, and any open vulnerabilities |
 
+### Workspace auth & cloud upload
+
+Local scoring does not require this — nothing leaves your machine until you push.
+
+**Typical path:** `vg login` → `vg dsn create` → `vg push` → `vg logout`
+
+| Command | Description |
+| --- | --- |
+| `vg dsn create` | Generate a DSN token |
+| `vg login` / `vg logout` | Authenticate the CLI with your Vibgrate workspace (or clear stored credentials) |
+| `vg push` | Upload scan results to Vibgrate Cloud |
+
 ```bash
 vg scan [path] [--vulns] [--full] [--format text|json|sarif|md] [--out <file>] [--fail-on warn|error] \
   [--offline] [--package-manifest <file>] [--no-local-artifacts] [--max-privacy] \

package/dist/baseline-TG4ATZGZ.js

@@ -0,0 +1,8 @@
+export { baselineCommand, runBaseline } from './chunk-EX4PQT6W.js';
+import './chunk-WGUL45AV.js';
+import './chunk-RXP66R2E.js';
+import './chunk-GI6W53LM.js';
+import './chunk-CRAMOEBE.js';
+import './chunk-DGUM43GV.js';
+//# sourceMappingURL=baseline-TG4ATZGZ.js.map
+//# sourceMappingURL=baseline-TG4ATZGZ.js.map

package/dist/{baseline-BD3A7EXD.js.map → baseline-TG4ATZGZ.js.map}

@@ -1 +1 @@
-{"version":3,"sources":[],"names":[],"mappings":"","file":"baseline-BD3A7EXD.js"}
+{"version":3,"sources":[],"names":[],"mappings":"","file":"baseline-TG4ATZGZ.js"}

package/dist/chunk-2MBL43EJ.js

@@ -0,0 +1,82 @@
+import { startVgdServer } from './chunk-TCDAZZNP.js';
+import { vgdIsRunning, vgdRequest } from './chunk-PMYWZRRS.js';
+
+// src/code/runtime-session.ts
+async function startCodeRuntimeSession(options) {
+  const socketPath = options.socketPath;
+  const isRunning = options.isRunning ?? ((sp) => vgdIsRunning({ socketPath: sp }));
+  const request = options.request ?? vgdRequest;
+  const startServer = options.startServer ?? ((opts) => startVgdServer(opts));
+  try {
+    if (await isRunning(socketPath)) {
+      return await attachExisting(options.root, socketPath, request);
+    }
+    return await startOwned(options.root, socketPath, startServer, request);
+  } catch {
+    return noneSession();
+  }
+}
+async function attachExisting(root, socketPath, request) {
+  const clientOpts = { socketPath };
+  const reg = await request({ op: "register", root }, clientOpts);
+  if (!reg.ok || !("workspace" in reg)) return noneSession();
+  const status = await request({ op: "status" }, clientOpts).catch(() => null);
+  const pid = status && status.ok && "pid" in status ? status.pid : void 0;
+  let disposed = false;
+  return {
+    kind: "attached",
+    pid,
+    workspace: reg.workspace,
+    socketPath: status && status.ok && "socketPath" in status ? status.socketPath : socketPath,
+    label: pid != null ? `vgd ${pid}` : "vgd",
+    async dispose() {
+      if (disposed) return;
+      disposed = true;
+      try {
+        await request({ op: "unregister", root }, clientOpts);
+      } catch {
+      }
+    }
+  };
+}
+async function startOwned(root, socketPath, startServer, request) {
+  const server = await startServer({ socketPath });
+  const clientOpts = { socketPath: server.socketPath };
+  let workspace;
+  try {
+    const reg = await request({ op: "register", root }, clientOpts);
+    if (reg.ok && "workspace" in reg) workspace = reg.workspace;
+  } catch {
+  }
+  let disposed = false;
+  return {
+    kind: "owned",
+    pid: process.pid,
+    workspace,
+    socketPath: server.socketPath,
+    label: `vgd (session)`,
+    async dispose() {
+      if (disposed) return;
+      disposed = true;
+      try {
+        await server.close();
+      } catch {
+      }
+    }
+  };
+}
+function noneSession() {
+  return {
+    kind: "none",
+    pid: void 0,
+    workspace: void 0,
+    socketPath: void 0,
+    label: "",
+    async dispose() {
+    }
+  };
+}
+
+export { startCodeRuntimeSession };
+//# sourceMappingURL=chunk-2MBL43EJ.js.map
+//# sourceMappingURL=chunk-2MBL43EJ.js.map

package/dist/chunk-2MBL43EJ.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/code/runtime-session.ts"],"names":[],"mappings":";;;;AA4CA,eAAsB,wBAAwB,OAAA,EAA6D;AACzG,EAAA,MAAM,aAAa,OAAA,CAAQ,UAAA;AAC3B,EAAA,MAAM,SAAA,GAAY,QAAQ,SAAA,KAAc,CAAC,OAAgB,YAAA,CAAa,EAAE,UAAA,EAAY,EAAA,EAAI,CAAA,CAAA;AACxF,EAAA,MAAM,OAAA,GAAU,QAAQ,OAAA,IAAW,UAAA;AACnC,EAAA,MAAM,cAAc,OAAA,CAAQ,WAAA,KAAgB,CAAC,IAAA,KAAkC,eAAe,IAAI,CAAA,CAAA;AAElG,EAAA,IAAI;AACF,IAAA,IAAI,MAAM,SAAA,CAAU,UAAU,CAAA,EAAG;AAC/B,MAAA,OAAO,MAAM,cAAA,CAAe,OAAA,CAAQ,IAAA,EAAM,YAAY,OAAO,CAAA;AAAA,IAC/D;AACA,IAAA,OAAO,MAAM,UAAA,CAAW,OAAA,CAAQ,IAAA,EAAM,UAAA,EAAY,aAAa,OAAO,CAAA;AAAA,EACxE,CAAA,CAAA,MAAQ;AACN,IAAA,OAAO,WAAA,EAAY;AAAA,EACrB;AACF;AAEA,eAAe,cAAA,CACb,IAAA,EACA,UAAA,EACA,OAAA,EAC6B;AAC7B,EAAA,MAAM,UAAA,GAAa,EAAE,UAAA,EAAW;AAChC,EAAA,MAAM,GAAA,GAAM,MAAM,OAAA,CAAQ,EAAE,IAAI,UAAA,EAAY,IAAA,IAAQ,UAAU,CAAA;AAC9D,EAAA,IAAI,CAAC,GAAA,CAAI,EAAA,IAAM,EAAE,WAAA,IAAe,GAAA,CAAA,SAAa,WAAA,EAAY;AACzD,EAAA,MAAM,MAAA,GAAS,MAAM,OAAA,CAAQ,EAAE,EAAA,EAAI,QAAA,EAAS,EAAG,UAAU,CAAA,CAAE,KAAA,CAAM,MAAM,IAAI,CAAA;AAC3E,EAAA,MAAM,MAAM,MAAA,IAAU,MAAA,CAAO,MAAM,KAAA,IAAS,MAAA,GAAS,OAAO,GAAA,GAAM,MAAA;AAClE,EAAA,IAAI,QAAA,GAAW,KAAA;AACf,EAAA,OAAO;AAAA,IACL,IAAA,EAAM,UAAA;AAAA,IACN,GAAA;AAAA,IACA,WAAW,GAAA,CAAI,SAAA;AAAA,IACf,YAAY,MAAA,IAAU,MAAA,CAAO,MAAM,YAAA,IAAgB,MAAA,GAAS,OAAO,UAAA,GAAa,UAAA;AAAA,IAChF,KAAA,EAAO,GAAA,IAAO,IAAA,GAAO,CAAA,IAAA,EAAO,GAAG,CAAA,CAAA,GAAK,KAAA;AAAA,IACpC,MAAM,OAAA,GAAU;AACd,MAAA,IAAI,QAAA,EAAU;AACd,MAAA,QAAA,GAAW,IAAA;AACX,MAAA,IAAI;AACF,QAAA,MAAM,QAAQ,EAAE,EAAA,EAAI,YAAA,EAAc,IAAA,IAAQ,UAAU,CAAA;AAAA,MACtD,CAAA,CAAA,MAAQ;AAAA,MAER;AAAA,IACF;AAAA,GACF;AACF;AAEA,eAAe,UAAA,CACb,IAAA,EACA,UAAA,EACA,WAAA,EACA,OAAA,EAC6B;AAC7B,EAAA,MAAM,MAAA,GAAS,MAAM,WAAA,CAAY,EAAE,YAAY,CAAA;AAC/C,EAAA,MAAM,UAAA,GAAa,EAAE,UAAA,EAAY,MAAA,CAAO,UAAA,EAAW;AACnD,EAAA,IAAI,SAAA;AACJ,EAAA,IAAI;AACF,IAAA,MAAM,GAAA,GAAM,MAAM,OAAA,CAAQ,EAAE,IAAI,UAAA,EAAY,IAAA,IAAQ,UAAU,CAAA;AAC9D,IAAA,IAAI,GAAA,CAAI,EAAA,IAAM,WAAA,IAAe,GAAA,cAAiB,GAAA,CAAI,SAAA;AAAA,EACpD,CAAA,CAAA,MAAQ;AAAA,EAER;AACA,EAAA,IAAI,QAAA,GAAW,KAAA;AACf,EAAA,OAAO;AAAA,IACL,IAAA,EAAM,OAAA;AAAA,IACN,KAAK,OAAA,CAAQ,GAAA;AAAA,IACb,SAAA;AAAA,IACA,YAAY,MAAA,CAAO,UAAA;AAAA,IACnB,KAAA,EAAO,CAAA,aAAA,CAAA;AAAA,IACP,MAAM,OAAA,GAAU;AACd,MAAA,IAAI,QAAA,EAAU;AACd,MAAA,QAAA,GAAW,IAAA;AACX,MAAA,IAAI;AACF,QAAA,MAAM,OAAO,KAAA,EAAM;AAAA,MACrB,CAAA,CAAA,MAAQ;AAAA,MAER;AAAA,IACF;AAAA,GACF;AACF;AAEA,SAAS,WAAA,GAAkC;AACzC,EAAA,OAAO;AAAA,IACL,IAAA,EAAM,MAAA;AAAA,IACN,GAAA,EAAK,MAAA;AAAA,IACL,SAAA,EAAW,MAAA;AAAA,IACX,UAAA,EAAY,MAAA;AAAA,IACZ,KAAA,EAAO,EAAA;AAAA,IACP,MAAM,OAAA,GAAU;AAAA,IAEhB;AAAA,GACF;AACF","file":"chunk-2MBL43EJ.js","sourcesContent":["/**\n * Session boundary between VG Code and the Fusion Runtime daemon (`vgd`).\n *\n * Replaces the old {@link GraphProcess} (`vg serve` child) for the interactive\n * coding REPL. Behaviour:\n *\n * 1. If a local vgd is already running — register this workspace and leave the\n *    daemon running when the session ends (unregister only).\n * 2. Otherwise — start an **in-process** vgd for the life of the session and\n *    tear it down on dispose. No second OS process, no `vg serve` spawn.\n *\n * Never throws: a failure to attach degrades to “no runtime session” and the\n * agent continues with the in-process graph only (same safety as GraphProcess).\n */\n\nimport { startVgdServer, vgdIsRunning, vgdRequest, type VgdServer } from '../runtime/vgd/index.js';\nimport type { WorkspaceRecord } from '../runtime/vgd/protocol.js';\n\nexport type RuntimeSessionKind = 'attached' | 'owned' | 'none';\n\nexport interface RuntimeSessionOptions {\n  root: string;\n  /** Override socket path (tests). */\n  socketPath?: string;\n  /** Injectable connect/start hooks (tests). */\n  isRunning?: (socketPath?: string) => Promise<boolean>;\n  request?: typeof vgdRequest;\n  startServer?: (opts: { socketPath?: string }) => Promise<VgdServer>;\n}\n\nexport interface CodeRuntimeSession {\n  readonly kind: RuntimeSessionKind;\n  /** Daemon pid when known (attached status or owned process). */\n  readonly pid: number | undefined;\n  readonly workspace: WorkspaceRecord | undefined;\n  readonly socketPath: string | undefined;\n  /** Human label for the REPL intro line. */\n  readonly label: string;\n  dispose(): Promise<void>;\n}\n\n/**\n * Attach VG Code to vgd for one coding session. Always resolves (never throws).\n */\nexport async function startCodeRuntimeSession(options: RuntimeSessionOptions): Promise<CodeRuntimeSession> {\n  const socketPath = options.socketPath;\n  const isRunning = options.isRunning ?? ((sp?: string) => vgdIsRunning({ socketPath: sp }));\n  const request = options.request ?? vgdRequest;\n  const startServer = options.startServer ?? ((opts: { socketPath?: string }) => startVgdServer(opts));\n\n  try {\n    if (await isRunning(socketPath)) {\n      return await attachExisting(options.root, socketPath, request);\n    }\n    return await startOwned(options.root, socketPath, startServer, request);\n  } catch {\n    return noneSession();\n  }\n}\n\nasync function attachExisting(\n  root: string,\n  socketPath: string | undefined,\n  request: typeof vgdRequest,\n): Promise<CodeRuntimeSession> {\n  const clientOpts = { socketPath };\n  const reg = await request({ op: 'register', root }, clientOpts);\n  if (!reg.ok || !('workspace' in reg)) return noneSession();\n  const status = await request({ op: 'status' }, clientOpts).catch(() => null);\n  const pid = status && status.ok && 'pid' in status ? status.pid : undefined;\n  let disposed = false;\n  return {\n    kind: 'attached',\n    pid,\n    workspace: reg.workspace,\n    socketPath: status && status.ok && 'socketPath' in status ? status.socketPath : socketPath,\n    label: pid != null ? `vgd ${pid}` : 'vgd',\n    async dispose() {\n      if (disposed) return;\n      disposed = true;\n      try {\n        await request({ op: 'unregister', root }, clientOpts);\n      } catch {\n        /* best-effort */\n      }\n    },\n  };\n}\n\nasync function startOwned(\n  root: string,\n  socketPath: string | undefined,\n  startServer: (opts: { socketPath?: string }) => Promise<VgdServer>,\n  request: typeof vgdRequest,\n): Promise<CodeRuntimeSession> {\n  const server = await startServer({ socketPath });\n  const clientOpts = { socketPath: server.socketPath };\n  let workspace: WorkspaceRecord | undefined;\n  try {\n    const reg = await request({ op: 'register', root }, clientOpts);\n    if (reg.ok && 'workspace' in reg) workspace = reg.workspace;\n  } catch {\n    /* registry optional for an empty session */\n  }\n  let disposed = false;\n  return {\n    kind: 'owned',\n    pid: process.pid,\n    workspace,\n    socketPath: server.socketPath,\n    label: `vgd (session)`,\n    async dispose() {\n      if (disposed) return;\n      disposed = true;\n      try {\n        await server.close();\n      } catch {\n        /* best-effort */\n      }\n    },\n  };\n}\n\nfunction noneSession(): CodeRuntimeSession {\n  return {\n    kind: 'none',\n    pid: undefined,\n    workspace: undefined,\n    socketPath: undefined,\n    label: '',\n    async dispose() {\n      /* no-op */\n    },\n  };\n}\n"]}

package/dist/chunk-2XQDMLKB.js

@@ -0,0 +1,465 @@
+import { stableStringify, serializeGraph, parseGraph, cacheDir } from './chunk-K3MZIVZW.js';
+import { globalGraphPathForRef, globalGraphPath, repositoryStoreDir } from './chunk-BWPBB45M.js';
+import { detectGitRef } from './chunk-BPF3YX2U.js';
+import { __require } from './chunk-DGUM43GV.js';
+import * as fs from 'fs';
+import * as path from 'path';
+
+// src/engine/report.ts
+function renderReport(graph) {
+  const { meta, provenance, nodes, edges } = graph;
+  const lines = [];
+  lines.push("# Code Graph Report");
+  lines.push("");
+  lines.push(`Generated by \`vg\` ${provenance.version} \xB7 schema \`${graph.schemaVersion}\``);
+  lines.push("");
+  lines.push("## Summary");
+  lines.push("");
+  lines.push(`- **Nodes:** ${meta.counts.nodes.toLocaleString("en-US")}`);
+  lines.push(`- **Edges:** ${meta.counts.edges.toLocaleString("en-US")}`);
+  lines.push(`- **Areas:** ${meta.counts.areas.toLocaleString("en-US")}`);
+  lines.push(`- **Languages:** ${meta.languages.join(", ") || "\u2014"}`);
+  lines.push(`- **Clustering:** ${meta.cluster}`);
+  lines.push(`- **Resolvers:** ${provenance.resolver.join(", ")}`);
+  lines.push(`- **Edge kinds:** ${meta.edgeKinds.join(", ") || "\u2014"}`);
+  lines.push("");
+  const fileNodes = nodes.filter((n) => n.kind === "file");
+  const defsByFile = /* @__PURE__ */ new Map();
+  for (const n of nodes) {
+    if (n.kind === "file" || n.kind === "external") continue;
+    defsByFile.set(n.file, (defsByFile.get(n.file) ?? 0) + 1);
+  }
+  const topFiles = [...defsByFile.entries()].sort((a, b) => b[1] - a[1] || a[0].localeCompare(b[0])).slice(0, 15);
+  if (topFiles.length) {
+    lines.push("## Largest files (by definitions)");
+    lines.push("");
+    lines.push("| File | Definitions |");
+    lines.push("| --- | ---: |");
+    for (const [file, count] of topFiles) lines.push(`| \`${file}\` | ${count} |`);
+    lines.push("");
+  }
+  const topNodes = nodes.filter((n) => n.kind !== "file" && n.kind !== "external").sort((a, b) => b.importance - a.importance || a.qualifiedName.localeCompare(b.qualifiedName)).slice(0, 15);
+  if (topNodes.length) {
+    lines.push("## Most-connected definitions");
+    lines.push("");
+    lines.push("| Symbol | Kind | File | Importance |");
+    lines.push("| --- | --- | --- | ---: |");
+    for (const n of topNodes) {
+      lines.push(
+        `| \`${n.qualifiedName}\` | ${n.kind} | \`${n.file}\`:${n.span.start} | ${n.importance.toFixed(3)} |`
+      );
+    }
+    lines.push("");
+  }
+  const byKind = /* @__PURE__ */ new Map();
+  for (const e of edges) byKind.set(e.kind, (byKind.get(e.kind) ?? 0) + 1);
+  if (byKind.size) {
+    lines.push("## Edges by kind");
+    lines.push("");
+    lines.push("| Kind | Count |");
+    lines.push("| --- | ---: |");
+    for (const [kind, count] of [...byKind.entries()].sort((a, b) => a[0].localeCompare(b[0]))) {
+      lines.push(`| ${kind} | ${count} |`);
+    }
+    lines.push("");
+  }
+  lines.push("---");
+  lines.push("");
+  lines.push(`_Files: ${fileNodes.length} \xB7 Corpus: \`${provenance.corpusHash.slice(0, 16)}\u2026\`_`);
+  lines.push("");
+  return lines.join("\n");
+}
+
+// src/engine/html.ts
+var EMBED_NODE_LIMIT = 5e3;
+function renderHtml(graph) {
+  const top = graph.nodes.filter((n) => n.kind !== "file" && n.kind !== "external").sort((a, b) => b.importance - a.importance || a.qualifiedName.localeCompare(b.qualifiedName)).slice(0, 50);
+  const areas = [...graph.areas].sort((a, b) => b.size - a.size || a.id - b.id).slice(0, 40);
+  const rows = top.map(
+    (n) => `<tr><td><code>${esc(n.qualifiedName)}</code></td><td>${esc(n.kind)}</td><td><code>${esc(n.file)}</code>:${n.span.start}</td><td>${n.importance.toFixed(3)}</td></tr>`
+  ).join("\n");
+  const areaRows = areas.map(
+    (a) => `<tr><td>${a.id}</td><td><code>${esc(a.label)}</code></td><td>${a.size}</td><td>${a.cohesion.toFixed(3)}</td><td>${a.externalEdges}</td></tr>`
+  ).join("\n");
+  const large = graph.meta.counts.nodes > EMBED_NODE_LIMIT;
+  const embedPayload = large ? {
+    schemaVersion: graph.schemaVersion,
+    generatedAt: graph.generatedAt,
+    provenance: graph.provenance,
+    meta: graph.meta,
+    hubs: top.map((n) => ({
+      id: n.id,
+      name: n.qualifiedName,
+      kind: n.kind,
+      file: n.file,
+      line: n.span.start,
+      importance: n.importance,
+      area: n.area
+    })),
+    areas: areas.map((a) => ({
+      id: a.id,
+      label: a.label,
+      size: a.size,
+      cohesion: a.cohesion,
+      externalEdges: a.externalEdges
+    })),
+    note: `Full graph omitted (${graph.meta.counts.nodes} nodes > ${EMBED_NODE_LIMIT}). Use graph.json or .vibgrate/cache/graph.db.`
+  } : graph;
+  const embedded = stableStringify(embedPayload, 0);
+  const tier = graph.meta.analysisTier ?? "full";
+  return `<!doctype html>
+<html lang="en">
+<head>
+<meta charset="utf-8">
+<meta name="viewport" content="width=device-width, initial-scale=1">
+<title>vg \xB7 code graph</title>
+<style>
+  :root { color-scheme: light dark; }
+  body { font: 14px/1.5 system-ui, sans-serif; margin: 2rem auto; max-width: 60rem; padding: 0 1rem; }
+  h1 { font-size: 1.4rem; } h2 { font-size: 1.1rem; margin-top: 2rem; }
+  table { border-collapse: collapse; width: 100%; }
+  th, td { text-align: left; padding: 4px 8px; border-bottom: 1px solid #8884; }
+  td:last-child, th:last-child { text-align: right; }
+  .meta { color: #888; } code { font-size: 0.9em; }
+  .banner { background: #8882; padding: 0.6rem 0.8rem; border-radius: 6px; margin: 1rem 0; }
+</style>
+</head>
+<body>
+<h1>vg \xB7 code graph</h1>
+<p class="meta">${graph.meta.counts.nodes} nodes \xB7 ${graph.meta.counts.edges} edges \xB7
+${graph.meta.counts.areas} areas \xB7 ${esc(graph.meta.languages.join(", ") || "\u2014")} \xB7
+clustering: ${esc(graph.meta.cluster)} \xB7 tier: ${esc(tier)} \xB7 vg ${esc(graph.provenance.version)}</p>
+${large ? `<p class="banner">Large map (${graph.meta.counts.nodes} nodes): HTML shows hubs + areas only.
+Full graph remains in <code>graph.json</code> / <code>.vibgrate/cache/graph.db</code> (query via <code>vg serve</code>).</p>` : ""}
+<h2>Areas (subsystems)</h2>
+<table>
+<thead><tr><th>Id</th><th>Label</th><th>Size</th><th>Cohesion</th><th>External</th></tr></thead>
+<tbody>
+${areaRows || '<tr><td colspan="5" class="meta">no areas</td></tr>'}
+</tbody>
+</table>
+<h2>Most-connected definitions (hubs)</h2>
+<table>
+<thead><tr><th>Symbol</th><th>Kind</th><th>Location</th><th>Importance</th></tr></thead>
+<tbody>
+${rows}
+</tbody>
+</table>
+<p class="meta">${large ? "Summary payload" : "Full graph"} embedded below for tooling.</p>
+<script type="application/json" id="vg-graph">
+${embedded}
+</script>
+</body>
+</html>
+`;
+}
+function esc(s) {
+  return s.replace(/&/g, "&amp;").replace(/</g, "&lt;").replace(/>/g, "&gt;").replace(/"/g, "&quot;");
+}
+
+// src/engine/artifacts.ts
+function vibgrateDir(root) {
+  return path.join(root, ".vibgrate");
+}
+function legacyGraphPath(root) {
+  return path.join(vibgrateDir(root), "graph.json");
+}
+function preferInRepoGraph(env = process.env) {
+  const v = env.VIBGRATE_GRAPH_IN_REPO?.trim().toLowerCase();
+  return v === "1" || v === "true" || v === "yes";
+}
+function defaultGraphPath(root, env = process.env) {
+  if (preferInRepoGraph(env)) return legacyGraphPath(root);
+  const { ref, kind } = detectGitRef(root);
+  if (kind !== "none" && ref) return globalGraphPathForRef(root, ref, env);
+  return globalGraphPath(root, "current", env);
+}
+function resolveGraphPath(root, override, env = process.env) {
+  if (override?.trim()) return path.resolve(override.trim());
+  if (preferInRepoGraph(env)) {
+    const legacy2 = legacyGraphPath(root);
+    if (fs.existsSync(legacy2)) return legacy2;
+    return legacy2;
+  }
+  const { ref, kind } = detectGitRef(root);
+  if (kind !== "none" && ref) {
+    const branchPath = globalGraphPathForRef(root, ref, env);
+    if (fs.existsSync(branchPath)) return branchPath;
+  }
+  const globalPath = globalGraphPath(root, "current", env);
+  if (fs.existsSync(globalPath)) return globalPath;
+  const legacy = legacyGraphPath(root);
+  if (fs.existsSync(legacy)) return legacy;
+  return defaultGraphPath(root, env);
+}
+var DEFAULT_GITIGNORE = [
+  "# Created once by vg \u2014 local graph artifacts stay out of git by default.",
+  "# Run `vg share` to commit the map for your team (it rewrites this file).",
+  "# vg never touches an existing .vibgrate/.gitignore: edit it (or leave it",
+  "# empty) to manage these ignores yourself.",
+  ".gitignore",
+  "cache/",
+  "graph.json",
+  "graph.html",
+  "GRAPH_REPORT.md",
+  "facts.jsonl",
+  "mcp-navigation.json"
+];
+function ensureVibgrateGitignore(root) {
+  const file = path.join(vibgrateDir(root), ".gitignore");
+  if (fs.existsSync(file)) return;
+  fs.mkdirSync(vibgrateDir(root), { recursive: true });
+  fs.writeFileSync(file, `${DEFAULT_GITIGNORE.join("\n")}
+`);
+}
+function companionArtifactDir(root, graphPath, env = process.env) {
+  const resolved = path.resolve(graphPath);
+  const legacy = path.resolve(legacyGraphPath(root));
+  if (resolved === legacy) return vibgrateDir(root);
+  const globalDefault = path.resolve(globalGraphPath(root, "current", env));
+  if (resolved === globalDefault) return repositoryStoreDir(root, env);
+  return path.dirname(resolved);
+}
+function writeArtifacts(graph, options) {
+  const graphPath = options.graphPath ?? defaultGraphPath(options.root);
+  const companions = companionArtifactDir(options.root, graphPath);
+  const inRepo = isPathInside(companions, options.root) || isPathInside(graphPath, options.root);
+  fs.mkdirSync(path.dirname(graphPath), { recursive: true });
+  fs.mkdirSync(companions, { recursive: true });
+  if (inRepo && isPathInside(companions, vibgrateDir(options.root))) {
+    ensureVibgrateGitignore(options.root);
+  } else if (path.resolve(graphPath) === path.resolve(legacyGraphPath(options.root))) {
+    ensureVibgrateGitignore(options.root);
+  }
+  const tmp = `${graphPath}.${process.pid}.tmp`;
+  try {
+    fs.writeFileSync(tmp, serializeGraph(graph));
+    fs.renameSync(tmp, graphPath);
+  } catch (err) {
+    fs.rmSync(tmp, { force: true });
+    throw err;
+  }
+  const written = { graphPath };
+  if (options.report !== false) {
+    const reportPath = path.join(companions, "GRAPH_REPORT.md");
+    fs.writeFileSync(reportPath, renderReport(graph));
+    written.reportPath = reportPath;
+  }
+  if (options.html !== false) {
+    const htmlPath = path.join(companions, "graph.html");
+    fs.writeFileSync(htmlPath, renderHtml(graph));
+    written.htmlPath = htmlPath;
+  }
+  if (graph.facts && graph.facts.length) {
+    const factsPath = path.join(companions, "facts.jsonl");
+    fs.writeFileSync(factsPath, graph.facts.map((f) => JSON.stringify(f)).join("\n") + "\n");
+    written.factsPath = factsPath;
+  }
+  return written;
+}
+function isPathInside(child, parent) {
+  const rel = path.relative(path.resolve(parent), path.resolve(child));
+  return rel === "" || !rel.startsWith("..") && !path.isAbsolute(rel);
+}
+
+// src/schema.ts
+var SCHEMA_VERSION = "vg-graph/1.0";
+
+// src/engine/index-db.ts
+function indexDbPath(root) {
+  return path.join(cacheDir(root), "graph.db");
+}
+function writeGraphIndex(root, graph) {
+  const file = indexDbPath(root);
+  try {
+    const { DatabaseSync } = __require("sqlite");
+    fs.mkdirSync(path.dirname(file), { recursive: true });
+    const tmp = `${file}.${process.pid}.tmp`;
+    try {
+      if (fs.existsSync(tmp)) fs.unlinkSync(tmp);
+    } catch {
+    }
+    const db = new DatabaseSync(tmp);
+    db.exec(`
+      PRAGMA journal_mode = OFF;
+      PRAGMA synchronous = OFF;
+      CREATE TABLE meta (
+        key TEXT PRIMARY KEY,
+        value TEXT NOT NULL
+      );
+      CREATE TABLE nodes (
+        id TEXT PRIMARY KEY,
+        name TEXT NOT NULL,
+        qualified_name TEXT NOT NULL,
+        kind TEXT NOT NULL,
+        file TEXT NOT NULL,
+        line INTEGER NOT NULL,
+        importance REAL NOT NULL,
+        area INTEGER NOT NULL,
+        is_hub INTEGER NOT NULL,
+        lang TEXT NOT NULL,
+        json TEXT NOT NULL
+      );
+      CREATE TABLE edges (
+        id TEXT PRIMARY KEY,
+        kind TEXT NOT NULL,
+        src TEXT NOT NULL,
+        dst TEXT NOT NULL,
+        resolution TEXT NOT NULL,
+        confidence REAL NOT NULL,
+        epistemic TEXT NOT NULL,
+        json TEXT NOT NULL
+      );
+      CREATE TABLE areas (
+        id INTEGER PRIMARY KEY,
+        json TEXT NOT NULL
+      );
+      CREATE INDEX idx_nodes_name ON nodes(name);
+      CREATE INDEX idx_nodes_qn ON nodes(qualified_name);
+      CREATE INDEX idx_nodes_file ON nodes(file);
+      CREATE INDEX idx_edges_src ON edges(src);
+      CREATE INDEX idx_edges_dst ON edges(dst);
+      CREATE INDEX idx_edges_kind ON edges(kind);
+    `);
+    const insMeta = db.prepare("INSERT INTO meta(key, value) VALUES (?, ?)");
+    insMeta.run("corpusHash", graph.provenance.corpusHash);
+    insMeta.run("schemaVersion", graph.schemaVersion);
+    insMeta.run("generatedAt", graph.generatedAt);
+    insMeta.run("nodeCount", String(graph.nodes.length));
+    insMeta.run("edgeCount", String(graph.edges.length));
+    insMeta.run("analysisTier", graph.meta.analysisTier ?? "full");
+    insMeta.run("indexVersion", "vg-graph-index/2");
+    insMeta.run("graphMeta", JSON.stringify(graph.meta));
+    insMeta.run("graphProvenance", JSON.stringify(graph.provenance));
+    if (graph.facts) insMeta.run("factsJson", JSON.stringify(graph.facts));
+    if (graph.grounding) insMeta.run("groundingJson", JSON.stringify(graph.grounding));
+    const insNode = db.prepare(
+      `INSERT INTO nodes(id, name, qualified_name, kind, file, line, importance, area, is_hub, lang, json)
+       VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)`
+    );
+    for (const n of graph.nodes) {
+      insNode.run(
+        n.id,
+        n.name,
+        n.qualifiedName,
+        n.kind,
+        n.file,
+        n.span.start,
+        n.importance,
+        n.area,
+        n.isHub ? 1 : 0,
+        n.lang,
+        JSON.stringify(n)
+      );
+    }
+    const insEdge = db.prepare(
+      `INSERT INTO edges(id, kind, src, dst, resolution, confidence, epistemic, json)
+       VALUES (?, ?, ?, ?, ?, ?, ?, ?)`
+    );
+    for (const e of graph.edges) {
+      insEdge.run(
+        e.id,
+        e.kind,
+        e.src,
+        e.dst,
+        e.resolution,
+        e.confidence,
+        e.epistemic ?? "observed",
+        JSON.stringify(e)
+      );
+    }
+    const insArea = db.prepare("INSERT INTO areas(id, json) VALUES (?, ?)");
+    for (const a of graph.areas) {
+      insArea.run(a.id, JSON.stringify(a));
+    }
+    db.close();
+    fs.renameSync(tmp, file);
+    return { path: file, nodes: graph.nodes.length, edges: graph.edges.length, ok: true };
+  } catch (err) {
+    return {
+      path: file,
+      nodes: 0,
+      edges: 0,
+      ok: false,
+      reason: err.message
+    };
+  }
+}
+function loadGraphFromIndex(root) {
+  const file = indexDbPath(root);
+  if (!fs.existsSync(file)) return null;
+  try {
+    const { DatabaseSync } = __require("sqlite");
+    const db = new DatabaseSync(file, { readOnly: true });
+    const metaRows = db.prepare("SELECT key, value FROM meta").all();
+    const meta = {};
+    for (const r of metaRows) meta[r.key] = r.value;
+    if (meta.indexVersion !== "vg-graph-index/2" || !meta.graphMeta || !meta.graphProvenance) {
+      db.close();
+      return null;
+    }
+    const nodeRows = db.prepare("SELECT json FROM nodes ORDER BY id").all();
+    const edgeRows = db.prepare("SELECT json FROM edges ORDER BY id").all();
+    const areaRows = db.prepare("SELECT json FROM areas ORDER BY id").all();
+    db.close();
+    const nodes = nodeRows.map((r) => JSON.parse(r.json));
+    const edges = edgeRows.map((r) => JSON.parse(r.json));
+    const areas = areaRows.map((r) => JSON.parse(r.json));
+    nodes.sort((a, b) => a.id.localeCompare(b.id));
+    edges.sort(
+      (a, b) => a.kind.localeCompare(b.kind) || a.src.localeCompare(b.src) || a.dst.localeCompare(b.dst)
+    );
+    areas.sort((a, b) => a.id - b.id);
+    const graph = {
+      schemaVersion: meta.schemaVersion || SCHEMA_VERSION,
+      generatedAt: meta.generatedAt ?? (/* @__PURE__ */ new Date(0)).toISOString(),
+      provenance: JSON.parse(meta.graphProvenance),
+      meta: JSON.parse(meta.graphMeta),
+      nodes,
+      edges,
+      areas
+    };
+    if (meta.factsJson) graph.facts = JSON.parse(meta.factsJson);
+    if (meta.groundingJson) graph.grounding = JSON.parse(meta.groundingJson);
+    for (const e of edges) {
+      if (!e.resolution) e.resolution = "heuristic";
+      if (!e.epistemic) e.epistemic = "observed";
+    }
+    return graph;
+  } catch {
+    return null;
+  }
+}
+function loadGraphPreferIndex(root, graphJsonPath) {
+  let jsonGraph = null;
+  if (fs.existsSync(graphJsonPath)) {
+    try {
+      jsonGraph = JSON.parse(fs.readFileSync(graphJsonPath, "utf8"));
+    } catch {
+      jsonGraph = null;
+    }
+  }
+  const fromIndex = loadGraphFromIndex(root);
+  if (fromIndex) {
+    if (!jsonGraph || fromIndex.provenance.corpusHash === jsonGraph.provenance.corpusHash) {
+      return { graph: fromIndex, source: "index" };
+    }
+  }
+  if (jsonGraph) return { graph: jsonGraph, source: "json" };
+  return null;
+}
+
+// src/engine/load.ts
+function loadGraph(root, graphPath) {
+  const file = resolveGraphPath(root, graphPath);
+  if (!graphPath) {
+    const preferred = loadGraphPreferIndex(root, file);
+    if (preferred) return preferred.graph;
+  }
+  if (!fs.existsSync(file)) return null;
+  return parseGraph(fs.readFileSync(file, "utf8"));
+}
+
+export { SCHEMA_VERSION, defaultGraphPath, ensureVibgrateGitignore, legacyGraphPath, loadGraph, loadGraphPreferIndex, preferInRepoGraph, renderHtml, renderReport, resolveGraphPath, vibgrateDir, writeArtifacts, writeGraphIndex };
+//# sourceMappingURL=chunk-2XQDMLKB.js.map
+//# sourceMappingURL=chunk-2XQDMLKB.js.map