@vibgrate/cli 2026.727.2 → 2026.727.4

package/dist/cli.js

@@ -1,46 +1,49 @@
 #!/usr/bin/env node
-import { loadAdvancedScanHook, baselineCommand } from './chunk-EX4PQT6W.js';
-import { sha256Hex, generateKeypair, dssePae, DSSE_PAYLOAD_TYPE, keyId, registerBuild, readGlobal, applyGlobalOptions, ProgressBar, printLogo, fetchCatalog, resolveProviders, runBuild } from './chunk-RNP3SMTV.js';
-export { runBuild } from './chunk-RNP3SMTV.js';
-import { VGD_PROTOCOL_VERSION, startVgdServer } from './chunk-TCDAZZNP.js';
+import { sha256Hex, generateKeypair, dssePae, DSSE_PAYLOAD_TYPE, keyId, registerBuild, readGlobal, applyGlobalOptions, ProgressBar, printLogo, fetchCatalog, resolveProviders, runBuild } from './chunk-FPEOIS7K.js';
+export { runBuild } from './chunk-FPEOIS7K.js';
+import { CONTEXT_POLICY_VERSION, computeFcsReport, renderFcsReportMarkdown, createTrajectoryCollector, runAgent } from './chunk-MAUJTPQW.js';
+import { loadAdvancedScanHook, baselineCommand } from './chunk-HYRAILGM.js';
+import { runCodeSession } from './chunk-R6ZRVVZT.js';
+import { summarizeDiffs, ScriptedProvider } from './chunk-KXSKFQMI.js';
+import { disableColor, info, c, json, out } from './chunk-CT5BS56U.js';
+import { VGD_PROTOCOL_VERSION, startVgdServer } from './chunk-77LYGXBI.js';
 import './chunk-5I4VSBWQ.js';
 import './chunk-IS7VTH2Q.js';
-import { CONTEXT_POLICY_VERSION, computeFcsReport, renderFcsReportMarkdown, createTrajectoryCollector, runAgent } from './chunk-J4RFRKZH.js';
 import { gatherSystemMemory } from './chunk-6UQMXIAG.js';
-import { readOrchestratorState, writeOrchestratorState, parseMode, setDefaultMode, recommendMode, activePin, resolveMode, providerForBackend, QUALIFIED_PACKS, pinPack, unpinPack, buildOrchestratorStatus } from './chunk-3V24O47U.js';
+import { readOrchestratorState, writeOrchestratorState, parseMode, setDefaultMode, recommendMode, activePin, resolveMode, providerForBackend, QUALIFIED_PACKS, pinPack, unpinPack, buildOrchestratorStatus } from './chunk-PVZBYZZR.js';
 import { fmt, estimateModelBytes } from './chunk-7N4Y3E47.js';
 import './chunk-IZDH67DX.js';
-import './chunk-6AYDFFP5.js';
+import './chunk-HK3AWUXH.js';
 import { vgdIsRunning, vgdRequest, vgdSocketPath } from './chunk-PMYWZRRS.js';
 import { defaultProcessEndpoint, startProcessHostServer, resolveInferenceIsolation } from './chunk-PXHNTC6D.js';
 import { clearHostSessionPool, acquireHostSession, generateOnSession, listHostSessions, hostSessionPoolSize } from './chunk-K7REHDQS.js';
 import { buildIdentifierTrieFromGraph } from './chunk-JIBOJTGS.js';
-import './chunk-NDMDSPFX.js';
-import { runCodeSession } from './chunk-CY4WKXB2.js';
-import { ensurePackage, ensureUnavailableMessage, isPackageInstalled, summarizeDiffs, ScriptedProvider } from './chunk-OFUC6RYN.js';
-import { disableColor, info, c, json, out } from './chunk-CT5BS56U.js';
-import { serveStdio, exportGraph, GraphSource, createServer, formatForExt } from './chunk-KCKYKDMS.js';
-import { resolveDsn, resolveIngestHost, dashHostForIngestHost, resolveCliInvocation, availableRegionIds, createWorkspaceDsn, writeStoredCredentials, credentialsPath, findGitRoot, ensureGitignored, gitignoreEntryForCredentials, clearStoredCredentials, CliError, ExitCode, parseDsn as parseDsn$1, uploadScanArtifact, ingestHostForRegionId, dsnCommand, pushCommand, NPX_INVOCATION, refreshIfStale, driftCount, countTokens, shortestPath, testsToRun, detectRunner, ASSISTANTS, detectAssistants, usageError, detectServeLaunch, installAssistant, writeNavigationConfig, uninstallAssistant, coveringTests, FREE_PACK, readScanArtifact, buildGraph, writeSnapshot, probeFreshness, discover, assistantById, SMALL_REPO_FILES, publishPrivateLibrary, assessDocQuality, symbolsFromApi, fetchHostedDocsCached, selectForBudget, hostedBase, readStoredCredentials, projectCredentialsPath, homeCredentialsPath, SKIP_DIRS, SKIP_FILES } from './chunk-KNELIQJO.js';
-import { writeDefaultConfig, parseDsn, detectVcs, computeRepoFingerprint, resolveRepositoryName, fetchScanPreflight, runCoreScan, VERSION, loadConfig, prepareCompressedUpload, computeDriftScore, titleBox, projectTypeToVulnEcosystem, driftBar, gitHistoryAvailable, buildVersionTimelines, findPackageAnyEcosystem, normalizeConstraint, findVersionCrossings, versionSatisfies, PROJECT_TYPE_TO_OSV_ECOSYSTEM, fetchRiskySymbols } from './chunk-WGUL45AV.js';
-import { inventory, enrichOnline, ECOSYSTEMS, catalogPath, libDir, loadCatalog, driftFor, addLibrary, resolveLib, libId, resolveVersion, readDoc, localPackageDocs, localApiSurface } from './chunk-LKVMI67M.js';
+import './chunk-KKRSQQ3A.js';
+import { buildModelInstallPlan } from './chunk-YCJIIGLP.js';
+import { ensurePackage, ensureUnavailableMessage } from './chunk-KUIBP3LU.js';
+import { serveStdio, exportGraph, GraphSource, createServer, formatForExt } from './chunk-LJP2EPKM.js';
+import { resolveDsn, resolveIngestHost, dashHostForIngestHost, resolveCliInvocation, availableRegionIds, createWorkspaceDsn, writeStoredCredentials, credentialsPath, findGitRoot, ensureGitignored, gitignoreEntryForCredentials, clearStoredCredentials, CliError, ExitCode, parseDsn as parseDsn$1, uploadScanArtifact, ingestHostForRegionId, dsnCommand, pushCommand, NPX_INVOCATION, refreshIfStale, driftCount, countTokens, shortestPath, pathDisconnect, testsToRun, detectRunner, ASSISTANTS, detectAssistants, usageError, detectServeLaunch, installAssistant, writeNavigationConfig, uninstallAssistant, coveringTests, FREE_PACK, readScanArtifact, buildGraph, writeSnapshot, probeFreshness, discover, assistantById, SMALL_REPO_FILES, publishPrivateLibrary, assessDocQuality, symbolsFromApi, fetchHostedDocsCached, selectForBudget, hostedBase, readStoredCredentials, projectCredentialsPath, homeCredentialsPath, SKIP_DIRS, SKIP_FILES } from './chunk-YKVH2PGF.js';
+import { inventory, enrichOnline, ECOSYSTEMS, catalogPath, libDir, loadCatalog, driftFor, addLibrary, resolveLib, libId, resolveVersion, readDoc, localPackageDocs, localApiSurface } from './chunk-6AXHLQBV.js';
+import { writeDefaultConfig, parseDsn, detectVcs, computeRepoFingerprint, resolveRepositoryName, fetchScanPreflight, runCoreScan, VERSION, loadConfig, prepareCompressedUpload, computeDriftScore, titleBox, projectTypeToVulnEcosystem, driftBar, gitHistoryAvailable, buildVersionTimelines, findPackageAnyEcosystem, normalizeConstraint, findVersionCrossings, versionSatisfies, PROJECT_TYPE_TO_OSV_ECOSYSTEM, fetchRiskySymbols } from './chunk-T3AYRS7J.js';
+import { recordCliCall, CLI_TOOL_ALIASES, savingsLedgerPath, clearSavings, readSavings, readUsage, readModelSavings, CAPSULE_RANKING_VERSION, SAVINGS_TOOLS, sanitizeClient } from './chunk-ZBTY6VV4.js';
+import { ensureDir, pathExists, readJsonFile, writeTextFile, writeJsonFile } from './chunk-CRAMOEBE.js';
 import { resolveOne } from './chunk-J7LKEB2R.js';
-import { discoverModels, listCachedWeights, isWeightCached, lookupCatalog, ensureWeightCached, catalogIntegrityReport, weightStoreDir } from './chunk-OOIG3RUM.js';
-import { recordCliCall, CLI_TOOL_ALIASES, savingsLedgerPath, clearSavings, readSavings, readUsage, readModelSavings, CAPSULE_RANKING_VERSION, SAVINGS_TOOLS, sanitizeClient } from './chunk-KSBHGWRV.js';
-import { embeddingsCached, resolveEmbedModel, loadEmbedder, getNodeEmbeddings, queryGraphSemantic, queryGraph, unavailableMessage, countPending, indexFor, impactOf, modelCacheInfo, clearModelCache } from './chunk-6ABXHZRN.js';
-import { resolvedGrammarFiles, grammarSetVersion } from './chunk-3Q7QBWFW.js';
+import { embeddingsCached, resolveEmbedModel, loadEmbedder, getNodeEmbeddings, queryGraphSemantic, queryGraph, unavailableMessage, countPending, indexFor, impactOf, modelCacheInfo, clearModelCache } from './chunk-6UK6QPTR.js';
+import { discoverModels } from './chunk-3SDV6ADQ.js';
+import { listCachedWeights, ensureWeightCached, catalogIntegrityReport, weightStoreDir } from './chunk-GYSOQH5C.js';
+import { resolvedGrammarFiles, grammarSetVersion } from './chunk-ON25BX6T.js';
 import './chunk-RXP66R2E.js';
-import { resolveGraphPath, renderReport, loadGraph, writeArtifacts, vibgrateDir, SCHEMA_VERSION } from './chunk-2XQDMLKB.js';
-import { cacheDir, stableStringify } from './chunk-K3MZIVZW.js';
+import { resolveGraphPath, renderReport, loadGraph, writeArtifacts, vibgrateDir, SCHEMA_VERSION } from './chunk-B3YUO3NW.js';
+import { cacheDir, stableStringify } from './chunk-ZKNB4YH4.js';
 import './chunk-BWPBB45M.js';
 import { canonicalize, hashString, hashBytes } from './chunk-JFGYT6BI.js';
 import './chunk-BPF3YX2U.js';
 import { pathExists as pathExists$1, parseExcludePatterns } from './chunk-GI6W53LM.js';
-import { ensureDir, pathExists, readJsonFile, writeTextFile, writeJsonFile } from './chunk-CRAMOEBE.js';
 import './chunk-DGUM43GV.js';
 import * as fs8 from 'fs';
 import fs8__default, { realpathSync } from 'fs';
-import * as path36 from 'path';
-import path36__default from 'path';
+import * as path37 from 'path';
+import path37__default from 'path';
 import { fileURLToPath, pathToFileURL } from 'url';
 import { Command, CommanderError, Option } from 'commander';
 import * as os from 'os';
@@ -49,7 +52,7 @@ import { randomUUID } from 'crypto';
 import { execSync, spawn, spawnSync, execFileSync } from 'child_process';
 import * as readline from 'readline';
 import chalk7 from 'chalk';
-import * as fs20 from 'fs/promises';
+import * as fs21 from 'fs/promises';
 import semver2 from 'semver';
 
 function registerStatus(program) {
@@ -59,10 +62,10 @@ function registerStatus(program) {
   applyGlobalOptions(cmd);
 }
 async function runStatus(global) {
-  const root2 = path36.resolve(global.cwd ?? ".");
+  const root2 = path37.resolve(global.cwd ?? ".");
   const graphPath = resolveGraphPath(root2, global.graph);
   const graph = loadGraph(root2, graphPath);
-  const hasCache = fs8.existsSync(path36.join(cacheDir(root2), "parse-cache.json"));
+  const hasCache = fs8.existsSync(path37.join(cacheDir(root2), "parse-cache.json"));
   let stale = null;
   let staleExact = false;
   if (graph) {
@@ -82,8 +85,8 @@ async function runStatus(global) {
   }
   if (global.json) {
     json({
-      root: path36.relative(process.cwd(), root2) || ".",
-      graphPath: path36.relative(root2, graphPath),
+      root: path37.relative(process.cwd(), root2) || ".",
+      graphPath: path37.relative(root2, graphPath),
       built: graph !== null,
       generatedAt: graph?.generatedAt ?? null,
       counts: graph?.meta.counts ?? null,
@@ -98,11 +101,11 @@ async function runStatus(global) {
     return;
   }
   if (!graph) {
-    info(`${c.cyan("vg")} \xB7 no map yet at ${c.dim(path36.relative(root2, graphPath))}`);
+    info(`${c.cyan("vg")} \xB7 no map yet at ${c.dim(path37.relative(root2, graphPath))}`);
     info(`  run ${c.bold("vg")} to build one`);
     return;
   }
-  info(`${c.cyan("vg")} \xB7 ${path36.relative(root2, graphPath)}`);
+  info(`${c.cyan("vg")} \xB7 ${path37.relative(root2, graphPath)}`);
   info(`  generated ${graph.generatedAt}`);
   info(
     `  nodes ${c.bold(String(graph.meta.counts.nodes))}  edges ${c.bold(
@@ -119,7 +122,7 @@ async function runStatus(global) {
   if (vibgrateDir(root2)) ;
 }
 function rootOf(global) {
-  return path36.resolve(global.cwd ?? ".");
+  return path37.resolve(global.cwd ?? ".");
 }
 function requireGraph(global) {
   const root2 = rootOf(global);
@@ -402,6 +405,19 @@ function registerPath(program) {
       );
     }
     if (!result) {
+      const disc = pathDisconnect(graph, ra.node.id, rb.node.id);
+      if (global.json) {
+        json(disc);
+        throw new CliError(
+          `no path between ${ra.node.qualifiedName} and ${rb.node.qualifiedName}`,
+          ExitCode.NOT_FOUND
+        );
+      }
+      info(`${c.cyan("vg path")} \xB7 no path between ${c.bold(disc.from.name)} and ${c.bold(disc.to.name)}`);
+      printNeighborhood("from", disc.from);
+      printNeighborhood("to", disc.to);
+      info(c.dim(`  ${disc.hint}`));
+      info(c.dim(`  try: vg show ${disc.from.name} \xB7 vg impact ${disc.from.name} \xB7 vg show ${disc.to.name}`));
       throw new CliError(
         `no path between ${ra.node.qualifiedName} and ${rb.node.qualifiedName}`,
         ExitCode.NOT_FOUND
@@ -418,6 +434,14 @@ function registerPath(program) {
   });
   applyGlobalOptions(cmd);
 }
+function printNeighborhood(label, n) {
+  const parts = [];
+  if (n.calls.length) parts.push(`calls ${n.calls.join(", ")}`);
+  if (n.calledBy.length) parts.push(`called by ${n.calledBy.join(", ")}`);
+  if (n.imports.length) parts.push(`imports ${n.imports.join(", ")}`);
+  if (n.importedBy.length) parts.push(`imported by ${n.importedBy.join(", ")}`);
+  info(`  ${c.dim(label)} ${c.bold(n.name)}${parts.length ? c.dim(` \xB7 ${parts.join(" \xB7 ")}`) : c.dim(" \xB7 (no call/import neighbors)")}`);
+}
 
 // src/commands/tree.ts
 function registerTree(program) {
@@ -531,12 +555,12 @@ function registerInsights(program) {
     }
   });
   applyGlobalOptions(areas);
-  const oddities = program.command("oddities").description("surprising cross-area links (architectural smells)").option("-n, --limit <n>", "how many to show", "20").action(function(opts) {
+  const oddities = program.command("oddities").description("surprising cross-area links (architectural smells)").option("-n, --limit <n>", "how many to show", "20").option("--all", "include framework/runtime externals (default: filter them out)").action(function(opts) {
     const global = readGlobal(this);
     const { graph } = requireGraph(global);
     const limit = Number(opts.limit) || 20;
     const byId = new Map(graph.nodes.map((n) => [n.id, n]));
-    const list = graph.edges.filter((e) => typeof e.surprise === "number" && e.surprise > 0).sort((a, b) => (b.surprise ?? 0) - (a.surprise ?? 0) || a.id.localeCompare(b.id)).slice(0, limit);
+    const list = graph.edges.filter((e) => typeof e.surprise === "number" && e.surprise > 0).filter((e) => opts.all || !isFrameworkOddity(byId.get(e.src), byId.get(e.dst), e.kind)).sort((a, b) => (b.surprise ?? 0) - (a.surprise ?? 0) || a.id.localeCompare(b.id)).slice(0, limit);
     if (global.json) {
       json(
         list.map((e) => ({
@@ -549,7 +573,9 @@ function registerInsights(program) {
       return;
     }
     if (!list.length) {
-      info(`${c.cyan("vg oddities")} \xB7 none found (no cross-area links, or only one area)`);
+      info(
+        `${c.cyan("vg oddities")} \xB7 none found` + (opts.all ? " (no cross-area links, or only one area)" : " (no app-level surprises; try --all for framework links)")
+      );
       return;
     }
     info(`${c.cyan("vg oddities")} \xB7 top ${list.length} surprising links`);
@@ -561,6 +587,70 @@ function registerInsights(program) {
   });
   applyGlobalOptions(oddities);
 }
+var FRAMEWORK_EXTERNALS = /* @__PURE__ */ new Set([
+  "react",
+  "react-dom",
+  "react-native",
+  "vue",
+  "vue-router",
+  "svelte",
+  "svelte/store",
+  "next",
+  "next/link",
+  "next/router",
+  "next/navigation",
+  "nuxt",
+  "angular",
+  "@angular/core",
+  "@angular/common",
+  "preact",
+  "solid-js",
+  "express",
+  "fastify",
+  "koa",
+  "hono",
+  "rxjs",
+  "lodash",
+  "lodash-es",
+  "underscore",
+  "jquery",
+  "axios",
+  "node:fs",
+  "node:path",
+  "node:url",
+  "node:http",
+  "node:https",
+  "fs",
+  "path",
+  "url",
+  "http",
+  "https",
+  "crypto",
+  "util",
+  "stream",
+  "events",
+  "assert",
+  "os",
+  "child_process"
+]);
+function isFrameworkOddity(from, to, kind) {
+  if (kind !== "import") return false;
+  for (const n of [from, to]) {
+    if (n?.kind === "external" && isFrameworkName(n.qualifiedName || n.name)) return true;
+  }
+  return false;
+}
+function isFrameworkName(name) {
+  if (!name) return false;
+  if (FRAMEWORK_EXTERNALS.has(name)) return true;
+  const base = name.startsWith("@") ? name.split("/").slice(0, 2).join("/") : name.split("/")[0];
+  if (FRAMEWORK_EXTERNALS.has(base)) return true;
+  if (base.startsWith("react-") || base.startsWith("@types/react")) return true;
+  if (base.startsWith("@vue/") || base.startsWith("@angular/") || base.startsWith("@sveltejs/")) {
+    return true;
+  }
+  return false;
+}
 function nodeSummary(n) {
   return {
     id: n.id,
@@ -743,8 +833,8 @@ function pad2(s, n) {
 }
 var SCHEMA_VERSION2 = "1";
 var OFFSET_FILE = "stats-share.json";
-var INSTALL_ID_DIR = path36.join(os.homedir(), ".vibgrate");
-var INSTALL_ID_FILE = path36.join(INSTALL_ID_DIR, "install-id");
+var INSTALL_ID_DIR = path37.join(os.homedir(), ".vibgrate");
+var INSTALL_ID_FILE = path37.join(INSTALL_ID_DIR, "install-id");
 var SEND_TIMEOUT_MS = 4e3;
 function telemetryOptOut(env = process.env) {
   const dnt = (env.DO_NOT_TRACK ?? "").trim().toLowerCase();
@@ -796,10 +886,10 @@ function statsEndpoint() {
   return `https://${resolveIngestHost()}/v1/ingest/cli-mcp-usage`;
 }
 function offsetPath(root2) {
-  return path36.join(cacheDir(root2), OFFSET_FILE);
+  return path37.join(cacheDir(root2), OFFSET_FILE);
 }
 function ledgerFilePath(root2) {
-  return path36.join(cacheDir(root2), "savings.jsonl");
+  return path37.join(cacheDir(root2), "savings.jsonl");
 }
 function readOffset(root2) {
   try {
@@ -970,7 +1060,7 @@ var PUBLISH_INTERVAL_MS = 2e3;
 var KEEPALIVE_MS = 1e4;
 var STALE_MS = 6e4;
 function liveStatsDir(root2) {
-  return path36.join(cacheDir(root2), "serve-live");
+  return path37.join(cacheDir(root2), "serve-live");
 }
 function reapOtherVersionServers(dir, keepVersion, now = Date.now(), kill = (pid, signal) => process.kill(pid, signal), selfPid = process.pid) {
   let entries;
@@ -984,7 +1074,7 @@ function reapOtherVersionServers(dir, keepVersion, now = Date.now(), kill = (pid
     if (!/^serve-\d+\.json$/.test(name)) continue;
     let parsed;
     try {
-      parsed = JSON.parse(fs8.readFileSync(path36.join(dir, name), "utf8"));
+      parsed = JSON.parse(fs8.readFileSync(path37.join(dir, name), "utf8"));
     } catch {
       continue;
     }
@@ -1006,7 +1096,7 @@ var LiveStatsBus = class {
     this.dir = dir;
     this.stats = stats;
     this.pid = pid;
-    this.file = path36.join(dir, `serve-${this.pid}.json`);
+    this.file = path37.join(dir, `serve-${this.pid}.json`);
   }
   dir;
   stats;
@@ -1059,7 +1149,7 @@ var LiveStatsBus = class {
     const out2 = [];
     for (const name of entries.sort()) {
       if (!/^serve-\d+\.json$/.test(name)) continue;
-      const file = path36.join(this.dir, name);
+      const file = path37.join(this.dir, name);
       let parsed;
       try {
         parsed = JSON.parse(fs8.readFileSync(file, "utf8"));
@@ -1487,8 +1577,8 @@ function registerServe(program) {
       await serveHttp(graphPath, opts.host ?? "127.0.0.1", Number(opts.port) || 7437, serveOpts, freshness, () => display?.start());
     } else {
       info(c.dim(`vg \xB7 MCP server on stdio (read-only, ${freshness}). Connect your assistant to this process.`));
-      await serveStdio(graphPath, serveOpts);
       display?.start();
+      await serveStdio(graphPath, serveOpts);
     }
   });
   applyGlobalOptions(cmd);
@@ -1503,13 +1593,22 @@ async function ensureServableGraph(root2, graphPath, global, refresh, opts = {})
         { ...global, json: false }
       );
     } else {
-      const refreshed = await refreshIfStale(root2, { inline: opts.inline, graphPath });
-      if (refreshed.status === "refreshed") {
-        const n = driftCount(refreshed.drift);
-        info(c.dim(`vg \xB7 map refreshed before serving \u2014 ${n} file(s) drifted (${(refreshed.ms / 1e3).toFixed(2)}s)`));
-      } else if (refreshed.status === "error") {
-        info(c.yellow(`vg \xB7 map refresh failed (${refreshed.message}) \u2014 serving the last built map`));
-      }
+      const kick = refreshIfStale(root2, { inline: opts.inline, graphPath }).then((refreshed) => {
+        if (refreshed.status === "refreshed") {
+          const n = driftCount(refreshed.drift);
+          info(
+            c.dim(
+              `vg \xB7 map refreshed in background \u2014 ${n} file(s) drifted (${(refreshed.ms / 1e3).toFixed(2)}s)`
+            )
+          );
+        } else if (refreshed.status === "error") {
+          info(c.yellow(`vg \xB7 map refresh failed (${refreshed.message}) \u2014 serving the last built map`));
+        }
+      }).catch((err) => {
+        const msg = err instanceof Error ? err.message : String(err);
+        info(c.yellow(`vg \xB7 map refresh failed (${msg}) \u2014 serving the last built map`));
+      });
+      if (opts.awaitStaleRefresh) await kick;
     }
   }
   if (!fs8.existsSync(graphPath)) {
@@ -1574,7 +1673,7 @@ async function serveHttp(graphPath, host, port, opts, freshness, onReady) {
       info(c.red(`vg serve: request error: ${err.message}`));
     }
   });
-  await new Promise((resolve19) => httpServer.listen(port, host, resolve19));
+  await new Promise((resolve20) => httpServer.listen(port, host, resolve20));
   info(c.dim(`vg \xB7 MCP server on http://${host}:${port}/mcp (read-only, local, ${freshness})`));
   onReady?.();
   await new Promise(() => {
@@ -1788,7 +1887,7 @@ function endOfLine(text, line) {
 }
 var CACHE_VERSION = "vg-lsp-scan-cache/2";
 function cachePath(root2) {
-  return path36.join(cacheDir(root2), "lsp-scan.json");
+  return path37.join(cacheDir(root2), "lsp-scan.json");
 }
 function manifestHash(root2) {
   const files = [];
@@ -1800,7 +1899,7 @@ function manifestHash(root2) {
       return;
     }
     for (const entry of entries) {
-      const abs = path36.join(dir, entry.name);
+      const abs = path37.join(dir, entry.name);
       if (entry.isDirectory()) {
         if (SKIP_DIRS.has(entry.name)) continue;
         walk2(abs);
@@ -1810,7 +1909,7 @@ function manifestHash(root2) {
       const base = entry.name.toLowerCase();
       if (!isManifest(abs) && !SKIP_FILES.has(base)) continue;
       try {
-        const rel = path36.relative(root2, abs).split(path36.sep).join("/");
+        const rel = path37.relative(root2, abs).split(path37.sep).join("/");
         files.push({ rel, hash: hashBytes(fs8.readFileSync(abs)) });
       } catch {
       }
@@ -2456,12 +2555,12 @@ function uriToPath(uri) {
   }
 }
 function projectForFile(root2, a, filePath) {
-  const dir = path36.dirname(path36.resolve(filePath));
+  const dir = path37.dirname(path37.resolve(filePath));
   let best;
   let bestLen = -1;
   for (const proj of a.projects ?? []) {
-    const projDir = path36.resolve(root2, proj.path);
-    if ((dir === projDir || dir.startsWith(projDir + path36.sep)) && projDir.length > bestLen) {
+    const projDir = path37.resolve(root2, proj.path);
+    if ((dir === projDir || dir.startsWith(projDir + path37.sep)) && projDir.length > bestLen) {
       best = proj;
       bestLen = projDir.length;
     }
@@ -2469,7 +2568,7 @@ function projectForFile(root2, a, filePath) {
   return best;
 }
 function sameProject(location, projectPath) {
-  return path36.normalize(location) === path36.normalize(projectPath);
+  return path37.normalize(location) === path37.normalize(projectPath);
 }
 function hasReleaseDates(a) {
   for (const proj of a.projects ?? []) {
@@ -2795,7 +2894,7 @@ function registerShare(program) {
   const cmd = program.command("share").description("make the map committable + auto-updating for your team (git)").option("--undo", "reverse what `vg share` installed").option("--reports", "also commit graph.html / GRAPH_REPORT.md (default: gitignored)").action(function(opts) {
     const global = readGlobal(this);
     const root2 = rootOf(global);
-    const gitDir = path36.join(root2, ".git");
+    const gitDir = path37.join(root2, ".git");
     if (!fs8.existsSync(gitDir)) {
       throw new CliError("not a git repository \u2014 run `vg share` inside a git repo", ExitCode.USAGE_ERROR);
     }
@@ -2817,15 +2916,15 @@ function registerShare(program) {
   applyGlobalOptions(cmd);
 }
 function writeVibgrateGitignore(root2, reports) {
-  const dir = path36.join(root2, ".vibgrate");
+  const dir = path37.join(root2, ".vibgrate");
   fs8.mkdirSync(dir, { recursive: true });
   const lines = ["# Managed by `vg share` \u2014 keep graph.json committed, ignore the rest", "cache/", "facts.jsonl"];
   if (!reports) lines.push("graph.html", "GRAPH_REPORT.md");
-  fs8.writeFileSync(path36.join(dir, ".gitignore"), `${lines.join("\n")}
+  fs8.writeFileSync(path37.join(dir, ".gitignore"), `${lines.join("\n")}
 `);
 }
 function writeGitAttributes(root2) {
-  const file = path36.join(root2, ".gitattributes");
+  const file = path37.join(root2, ".gitattributes");
   const line = ".vibgrate/graph.json merge=vg";
   let content = fs8.existsSync(file) ? fs8.readFileSync(file, "utf8") : "";
   if (!content.split("\n").some((l) => l.trim() === line)) {
@@ -2843,7 +2942,7 @@ function configureMergeDriver(root2) {
 function installPreCommitHook(root2) {
   const hooksDir = hookDir(root2);
   fs8.mkdirSync(hooksDir, { recursive: true });
-  const file = path36.join(hooksDir, "pre-commit");
+  const file = path37.join(hooksDir, "pre-commit");
   const block = [
     HOOK_BEGIN,
     "if command -v vg >/dev/null 2>&1; then",
@@ -2865,14 +2964,14 @@ ${content}`;
   fs8.chmodSync(file, 493);
 }
 function undo(root2) {
-  const hookFile = path36.join(hookDir(root2), "pre-commit");
+  const hookFile = path37.join(hookDir(root2), "pre-commit");
   if (fs8.existsSync(hookFile)) {
     const re = new RegExp(`\\n*${escapeRe(HOOK_BEGIN)}[\\s\\S]*?${escapeRe(HOOK_END)}\\n*`);
     const next2 = fs8.readFileSync(hookFile, "utf8").replace(re, "\n");
     if (next2.trim() === "#!/bin/sh") fs8.rmSync(hookFile);
     else fs8.writeFileSync(hookFile, next2);
   }
-  const attr = path36.join(root2, ".gitattributes");
+  const attr = path37.join(root2, ".gitattributes");
   if (fs8.existsSync(attr)) {
     const next2 = fs8.readFileSync(attr, "utf8").split("\n").filter((l) => l.trim() !== ".vibgrate/graph.json merge=vg").join("\n");
     fs8.writeFileSync(attr, next2);
@@ -2885,10 +2984,10 @@ function undo(root2) {
 function hookDir(root2) {
   try {
     const configured = git(root2, ["config", "--get", "core.hooksPath"]).trim();
-    if (configured) return path36.resolve(root2, configured);
+    if (configured) return path37.resolve(root2, configured);
   } catch {
   }
-  return path36.join(root2, ".git", "hooks");
+  return path37.join(root2, ".git", "hooks");
 }
 function git(root2, args) {
   return execFileSync("git", args, { cwd: root2, encoding: "utf8" });
@@ -2896,6 +2995,111 @@ function git(root2, args) {
 function escapeRe(s) {
   return s.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
 }
+var DEFAULT_DEBOUNCE_MS = 400;
+var SKIP_NAME = /* @__PURE__ */ new Set([
+  ".git",
+  "node_modules",
+  ".vibgrate",
+  "dist",
+  "build",
+  "out",
+  "coverage",
+  ".next",
+  "target",
+  "__pycache__",
+  ".venv",
+  "venv"
+]);
+function registerWatch(program) {
+  const cmd = program.command("watch").description("rebuild the code map when files change (debounced)").argument("[paths...]", "folders to watch (default: current folder)").option("--debounce <ms>", "settle time after a change before rebuild", String(DEFAULT_DEBOUNCE_MS)).option("--no-html", "do not write graph.html on each rebuild").option("--no-report", "do not write GRAPH_REPORT.md on each rebuild").option("--fast", "skip precise tsc resolve on rebuilds (heuristic only)").action(async function(paths, opts) {
+    const global = readGlobal(this);
+    const root2 = rootOf(global);
+    const debounceMs = Math.max(50, Number(opts.debounce) || DEFAULT_DEBOUNCE_MS);
+    const watchRoots = (paths.length ? paths : ["."]).map((p) => path37.resolve(root2, p));
+    for (const w of watchRoots) {
+      if (!fs8.existsSync(w)) {
+        throw new CliError(`watch path not found: ${w}`, ExitCode.USAGE_ERROR);
+      }
+    }
+    let building = false;
+    let pending = false;
+    let timer = null;
+    const rebuild = async (reason) => {
+      if (building) {
+        pending = true;
+        return;
+      }
+      building = true;
+      try {
+        info(c.dim(`vg watch \xB7 rebuild (${reason})`));
+        const result = await buildGraph({
+          root: root2,
+          paths: paths.length ? paths : void 0,
+          fast: opts.fast === true,
+          noGround: false
+        });
+        writeArtifacts(result.graph, {
+          root: root2,
+          html: opts.html !== false,
+          report: opts.report !== false,
+          graphPath: global.graph
+        });
+        writeSnapshot(root2, result.graph.provenance.corpusHash, result.fileStats);
+        const { counts } = result.graph.meta;
+        info(
+          `${c.cyan("vg watch")} \xB7 ${counts.nodes} nodes \xB7 ${counts.edges} edges \xB7 ${(result.timing.totalMs / 1e3).toFixed(2)}s` + (result.statHits ? c.dim(` \xB7 ${result.statHits} mtime hits`) : "")
+        );
+      } catch (err) {
+        info(c.yellow(`vg watch \xB7 rebuild failed: ${err.message}`));
+      } finally {
+        building = false;
+        if (pending) {
+          pending = false;
+          void rebuild("queued changes");
+        }
+      }
+    };
+    const schedule = (label) => {
+      if (timer) clearTimeout(timer);
+      timer = setTimeout(() => {
+        timer = null;
+        void rebuild(label);
+      }, debounceMs);
+    };
+    await rebuild("initial");
+    const watchers = [];
+    for (const w of watchRoots) {
+      try {
+        const watcher = fs8.watch(w, { recursive: true }, (_event, filename) => {
+          if (!filename) {
+            schedule("change");
+            return;
+          }
+          const parts = filename.split(path37.sep);
+          if (parts.some((p) => SKIP_NAME.has(p))) return;
+          if (filename.includes(`${path37.sep}.vibgrate${path37.sep}`) || filename.startsWith(".vibgrate")) {
+            return;
+          }
+          schedule(filename);
+        });
+        watchers.push(watcher);
+      } catch (err) {
+        throw new CliError(`cannot watch ${w}: ${err.message}`, ExitCode.ERROR);
+      }
+    }
+    info(c.dim(`vg watch \xB7 watching ${watchRoots.map((p) => path37.relative(root2, p) || ".").join(", ")} (debounce ${debounceMs}ms) \xB7 Ctrl+C to stop`));
+    await new Promise((resolve20) => {
+      const stop = () => {
+        for (const w of watchers) w.close();
+        if (timer) clearTimeout(timer);
+        resolve20();
+      };
+      process.once("SIGINT", stop);
+      process.once("SIGTERM", stop);
+    });
+  });
+  applyGlobalOptions(cmd);
+}
 function registerTests(program) {
   const cmd = program.command("tests").description("which tests cover a node (call/coverage linkage)").argument("<name>", "node to inspect").option("--missing", "show untested nodes nearby instead").option("--run", "print the command to run exactly these tests").option("--exec", "run that command").option("--pick <n>", "pick the nth candidate when ambiguous").action(function(name, opts) {
     const global = readGlobal(this);
@@ -2951,8 +3155,17 @@ function registerFacts(program) {
     const { node: node2, candidates } = resolveOne(graph, name, opts.pick ? Number(opts.pick) : void 0);
     if (!node2) throw ambiguityError(`"${name}" ${candidates.length ? "is ambiguous" : "not found"}`, candidates);
     if (!graph.facts) {
-      if (global.json) json({ node: node2.qualifiedName, facts: [], note: "facts require a --deep build" });
-      else info(`${c.cyan("vg facts")} \xB7 run ${c.bold("vg --deep")} to derive facts (none in this map)`);
+      if (global.json) {
+        json({
+          node: node2.qualifiedName,
+          facts: [],
+          note: "map has no facts \u2014 rebuild with a current vg (facts ship on every build)"
+        });
+      } else {
+        info(
+          `${c.cyan("vg facts")} \xB7 none in this map \u2014 rebuild with ${c.bold("vg")} (facts ship on every build)`
+        );
+      }
       return;
     }
     const facts = graph.facts.filter((f) => f.subjectIds.includes(node2.id));
@@ -3207,7 +3420,7 @@ function normalizeStandards(raw) {
 }
 function loadStandards(root2) {
   for (const rel of STANDARDS_FILES) {
-    const p = path36__default.join(root2, rel);
+    const p = path37__default.join(root2, rel);
     let text;
     try {
       text = fs8__default.readFileSync(p, "utf8");
@@ -3330,166 +3543,6 @@ function toEstimateJson(e) {
     guessed: e.guessed
   };
 }
-
-// src/runtime/model-install-plan.ts
-var MODEL_INSTALL_PLAN_SCHEMA_VERSION = "model-install-plan/0";
-function runtimeDepsForBackend(backend) {
-  const b = backend.toLowerCase();
-  if (b === "llama.cpp" || b === "llama-cpp" || b === "vibgrate") {
-    return [
-      {
-        id: "node-llama-cpp",
-        kind: "npm-runtime",
-        spec: "node-llama-cpp@^3",
-        reason: "in-process llama.cpp binding for the first-party / llama-cpp provider"
-      }
-    ];
-  }
-  if (b === "ollama") {
-    return [
-      {
-        id: "ollama",
-        kind: "native-binary",
-        binary: "ollama",
-        reason: "Ollama on PATH (install from https://ollama.com \u2014 third-party apps are not auto-installed)"
-      }
-    ];
-  }
-  return [];
-}
-function weightsChannelForBackend(backend, opts) {
-  const b = backend.toLowerCase();
-  if (b === "ollama") return "ollama";
-  if (b === "llama.cpp" || b === "llama-cpp" || b === "vibgrate") {
-    if (opts?.downloadUrl || opts?.weightsRef && lookupCatalog(opts.weightsRef)) return "vibgrate";
-    return "local-path";
-  }
-  if (b === "lm-studio" || b === "lmstudio" || b === "foundry-local") return "manual";
-  return "manual";
-}
-function weightsInstalled(ref, installedNames) {
-  const want = ref.toLowerCase();
-  return installedNames.some((n) => {
-    const have = n.toLowerCase();
-    return have === want || have.includes(want) || want.includes(have);
-  });
-}
-function buildModelInstallPlan(input) {
-  const hasBinary2 = input.hasBinary ?? (() => false);
-  const pkgInstalled = input.isPackageInstalled ?? isPackageInstalled;
-  const installedNames = input.installedNames ?? [];
-  const offline = !!input.offline;
-  const backend = input.backend;
-  const provider = providerLabel(backend);
-  const runtimeDeps = runtimeDepsForBackend(backend).map((dep) => {
-    if (dep.kind === "npm-runtime" && dep.spec) {
-      return { ...dep, status: pkgInstalled(dep.spec) ? "satisfied" : "missing" };
-    }
-    if (dep.kind === "native-binary" && dep.binary) {
-      return { ...dep, status: hasBinary2(dep.binary) ? "satisfied" : "unmanaged" };
-    }
-    return { ...dep, status: "unmanaged" };
-  });
-  const channel = weightsChannelForBackend(backend, {
-    downloadUrl: input.downloadUrl,
-    weightsRef: input.weightsRef
-  });
-  const weightCached = (input.isWeightCached ?? isWeightCached)(input.weightsRef);
-  const catalog = lookupCatalog(input.weightsRef);
-  const downloadUrl = input.downloadUrl ?? catalog?.url;
-  let weightsStatus = "missing";
-  if (channel === "ollama") {
-    weightsStatus = weightsInstalled(input.weightsRef, installedNames) ? "satisfied" : "missing";
-  } else if (channel === "vibgrate") {
-    weightsStatus = weightCached || weightsInstalled(input.weightsRef, installedNames) || !!input.modelPath ? "satisfied" : "missing";
-  } else if (channel === "local-path") {
-    weightsStatus = weightsInstalled(input.weightsRef, installedNames) || !!input.modelPath || weightCached ? "satisfied" : "manual";
-  } else {
-    weightsStatus = weightsInstalled(input.weightsRef, installedNames) ? "satisfied" : "manual";
-  }
-  const alreadySatisfied = [];
-  const willInstall = [];
-  const willDownload = [];
-  const blocked = [];
-  for (const dep of runtimeDeps) {
-    if (dep.status === "satisfied") {
-      alreadySatisfied.push(dep.id);
-      continue;
-    }
-    if (dep.kind === "npm-runtime" && dep.spec && dep.status === "missing") {
-      if (offline) {
-        blocked.push({ id: dep.id, reason: `${dep.spec} needed but --local/offline forbids install` });
-      } else {
-        willInstall.push(dep.spec);
-      }
-      continue;
-    }
-    if (dep.kind === "native-binary" && dep.status === "unmanaged") {
-      blocked.push({
-        id: dep.id,
-        reason: dep.reason
-      });
-    }
-  }
-  if (weightsStatus === "satisfied") {
-    alreadySatisfied.push(`weights:${input.weightsRef}`);
-  } else if (weightsStatus === "missing" && (channel === "ollama" || channel === "vibgrate")) {
-    if (offline) {
-      blocked.push({ id: `weights:${input.weightsRef}`, reason: "weights missing and --local/offline forbids download" });
-    } else if (channel === "ollama" && runtimeDeps.some((d) => d.id === "ollama" && d.status === "unmanaged")) {
-      willDownload.push(input.weightsRef);
-    } else if (channel === "vibgrate" && !downloadUrl) {
-      blocked.push({
-        id: `weights:${input.weightsRef}`,
-        reason: `no first-party download URL for ${input.weightsRef} \u2014 place a gguf in the weight store or pass --model-path`
-      });
-    } else {
-      willDownload.push(input.weightsRef);
-    }
-  } else if (weightsStatus === "manual" || weightsStatus === "missing") {
-    blocked.push({
-      id: `weights:${input.weightsRef}`,
-      reason: channel === "local-path" ? `point --model-path at a local gguf for ${input.weightsRef}, or run install when a first-party URL is catalogued` : `install or link weights for ${input.weightsRef} via the backend app`
-    });
-  }
-  const effectiveWillInstall = offline ? [] : willInstall;
-  const effectiveWillDownload = offline ? [] : willDownload;
-  const offlineBlocked = offline && blocked.some((b) => /offline|forbids/i.test(b.reason));
-  const allRuntimeOk = runtimeDeps.every((d) => d.status === "satisfied");
-  const fullyReady = allRuntimeOk && weightsStatus === "satisfied" && blocked.length === 0;
-  return {
-    schemaVersion: MODEL_INSTALL_PLAN_SCHEMA_VERSION,
-    provider,
-    backend,
-    model: input.weightsRef,
-    mode: input.mode,
-    packId: input.packId,
-    license: input.license,
-    promise: input.promise,
-    fit: input.fit,
-    runtimeDeps,
-    weights: {
-      channel,
-      ref: input.weightsRef,
-      status: weightsStatus,
-      downloadUrl: channel === "vibgrate" ? downloadUrl : void 0
-    },
-    alreadySatisfied,
-    willInstall: effectiveWillInstall,
-    willDownload: effectiveWillDownload,
-    blocked,
-    offlineBlocked,
-    ready: fullyReady
-  };
-}
-function providerLabel(backend) {
-  const b = backend.toLowerCase();
-  if (b === "llama.cpp" || b === "llama-cpp") return "llama-cpp";
-  if (b === "vibgrate") return "vibgrate";
-  if (b === "lm-studio" || b === "lmstudio") return "lmstudio";
-  if (b === "foundry-local") return "foundry-local";
-  return b === "ollama" ? "ollama" : backend;
-}
 async function executeModelInstallPlan(plan, options = {}) {
   const installedDeps = [];
   const pulledWeights = [];
@@ -4083,8 +4136,8 @@ async function runHostBench(options = {}) {
 }
 async function runArmSimulate(input) {
   const { arm, lib, modelPath, turns, trie, env, live } = input;
-  const path38 = `${modelPath}#${arm.id}`;
-  const session = await acquireHostSession(lib, path38);
+  const path39 = `${modelPath}#${arm.id}`;
+  const session = await acquireHostSession(lib, path39);
   const system = "You are a coding agent with a Task Capsule.";
   const capsule = "function readConfig(): Config { return load(); }";
   let last = null;
@@ -5026,7 +5079,7 @@ function registerModels(program) {
     );
   });
   applyGlobalOptions(modeCmd);
-  const resolve19 = cmd.command("resolve").description("resolve a Code Mode to pack + underlying model + fit (no download)").argument("[mode]", "spark | flow | forge (default: auto-fit or configured default)").action(function(modeArg) {
+  const resolve20 = cmd.command("resolve").description("resolve a Code Mode to pack + underlying model + fit (no download)").argument("[mode]", "spark | flow | forge (default: auto-fit or configured default)").action(function(modeArg) {
     const global = readGlobal(this);
     const root2 = rootOf(global);
     const sys = gatherSystemMemory();
@@ -5058,7 +5111,7 @@ function registerModels(program) {
       info(c.yellow("  will not fit \u2014 choose a lower mode or free memory before loading"));
     }
   });
-  applyGlobalOptions(resolve19);
+  applyGlobalOptions(resolve20);
   const installCmd = cmd.command("install").description("resolve the best Code Mode for this machine and install the pack").argument("[mode]", "spark | flow | forge (default: auto-fit)").option("--dry-run", "print the install plan only \u2014 do not download").option("--yes", "skip prompts (install already runs by default)").action(async function(modeArg, opts) {
     const global = readGlobal(this);
     const root2 = rootOf(global);
@@ -5396,8 +5449,8 @@ function registerModels(program) {
       }
     });
     if (opts.out) {
-      const outPath = path36.resolve(opts.out);
-      fs8.mkdirSync(path36.dirname(outPath), { recursive: true });
+      const outPath = path37.resolve(opts.out);
+      fs8.mkdirSync(path37.dirname(outPath), { recursive: true });
       fs8.writeFileSync(outPath, `${JSON.stringify(report, null, 2)}
 `);
       if (!global.json) info(c.dim(`  wrote ${outPath}`));
@@ -5508,11 +5561,11 @@ function fitColor(label) {
   return label;
 }
 function confirmYesNo(question) {
-  return new Promise((resolve19) => {
+  return new Promise((resolve20) => {
     const rl = readline.createInterface({ input: process.stdin, output: process.stderr });
     rl.question(`${question} [y/N] `, (answer) => {
       rl.close();
-      resolve19(/^y(es)?$/i.test(answer.trim()));
+      resolve20(/^y(es)?$/i.test(answer.trim()));
     });
   });
 }
@@ -5538,7 +5591,7 @@ function printBackends(backends) {
   }
 }
 function codeConfigPath(root2) {
-  return path36.join(root2, ".vibgrate", "code.json");
+  return path37.join(root2, ".vibgrate", "code.json");
 }
 function loadCodeConfig(root2) {
   try {
@@ -5620,7 +5673,7 @@ function discoverMcpServers(root2, ownServers) {
   const servers = {};
   const sources = [];
   for (const rel of MCP_CONFIG_FILES) {
-    const found = readMcpServersFile(path36.join(root2, rel));
+    const found = readMcpServersFile(path37.join(root2, rel));
     const names = Object.keys(found);
     if (names.length) {
       sources.push(rel);
@@ -5643,11 +5696,13 @@ function registerCode(program) {
     let provider = opts.provider ?? config.provider;
     let model = opts.model ?? config.model;
     const modeFlag = opts.mode ?? config.modelProfile?.mode;
-    if (!opts.model && !opts.modelPath && (modeFlag || !provider && !model)) {
+    let codeModeActive = false;
+    const customSelection = !!(opts.provider || opts.model || opts.modelPath || config.provider || config.model);
+    if (!customSelection && (modeFlag || !provider && !model)) {
       try {
-        const { parseMode: parseMode2, resolveMode: resolveMode2, readOrchestratorState: readOrchestratorState2, activePin: activePin2, providerForBackend: providerForBackend2 } = await import('./model-orchestrator-TVONAUPS.js');
+        const { parseMode: parseMode2, resolveMode: resolveMode2, readOrchestratorState: readOrchestratorState2, activePin: activePin2 } = await import('./model-orchestrator-4VSYP4J4.js');
         const { gatherSystemMemory: gatherSystemMemory2 } = await import('./local-runtime-5O2NN3GA.js');
-        const { loadGraph: loadGraph2 } = await import('./load-I333TGNI.js');
+        const { loadGraph: loadGraph2 } = await import('./load-QPOWQD7C.js');
         const state = readOrchestratorState2();
         const mode = parseMode2(modeFlag) ?? state.defaultMode ?? void 0;
         const pin = mode ? activePin2(mode, state) : null;
@@ -5676,26 +5731,31 @@ function registerCode(program) {
             ExitCode.ERROR
           );
         }
-        const { resolveGgufPath } = await import('./resolve-gguf-VPL4YQ6J.js');
+        const { resolveGgufPath } = await import('./resolve-gguf-Y6FH3CNB.js');
+        const primaryRef = resolved.pack.primary.backend === "llama.cpp" ? resolved.pack.primary.weightsRef : resolved.underlying.weightsRef;
         const gguf = resolveGgufPath({
-          modelRef: resolved.underlying.weightsRef,
+          modelRef: primaryRef,
           modelPath: opts.modelPath
         }) ?? resolveGgufPath({
-          modelRef: resolved.pack.primary.backend === "llama.cpp" ? resolved.pack.primary.weightsRef : void 0
+          modelRef: resolved.underlying.weightsRef,
+          modelPath: opts.modelPath
         });
-        if (gguf && !opts.provider) {
+        if (!gguf && !opts.mock) {
+          throw new CliError(
+            `Code Mode ${resolved.mode} uses the Vibgrate model manager \u2014 weights not installed. Run \`vg models install ${resolved.mode}\` then retry. (Custom Ollama/LM Studio: pass --provider explicitly.)`,
+            ExitCode.NOT_FOUND
+          );
+        }
+        if (gguf) {
+          codeModeActive = true;
           provider = "llama-cpp";
-          model = model ?? gguf.ref ?? resolved.underlying.weightsRef;
+          model = model ?? gguf.ref ?? primaryRef;
           opts.modelPath = gguf.path;
           if (!global.json && !global.quiet && !opts.streamJson) {
             info(
-              `${c.cyan("vg code")} \xB7 Code Mode ${c.bold(resolved.mode)} \u2192 embedded llama.cpp ${c.dim(gguf.path)} ${c.dim(`(${resolved.fit.label})`)}`
+              `${c.cyan("vg code")} \xB7 Code Mode ${c.bold(resolved.mode)} \u2192 Vibgrate manager ${c.dim(gguf.path)} ${c.dim(`(${resolved.fit.label})`)}`
             );
           }
-        } else {
-          const ollamaFb = resolved.underlying.backend === "ollama" ? resolved.underlying : resolved.pack.fallback?.find((f) => f.backend === "ollama") ?? resolved.underlying;
-          provider = provider ?? providerForBackend2(ollamaFb.backend);
-          model = model ?? ollamaFb.weightsRef;
         }
         if (!config.modelProfile?.capsuleBudgetTokens) {
           config.modelProfile = {
@@ -5709,11 +5769,6 @@ function registerCode(program) {
         } else if (!config.modelProfile?.mode) {
           config.modelProfile = { ...config.modelProfile, mode: resolved.mode };
         }
-        if (!global.json && !global.quiet && !opts.streamJson && provider !== "llama-cpp") {
-          info(
-            `${c.cyan("vg code")} \xB7 Code Mode ${c.bold(resolved.mode)} \u2192 ${resolved.underlying.weightsRef} ${c.dim(`(${resolved.fit.label})`)}`
-          );
-        }
       } catch (e) {
         if (e instanceof CliError) throw e;
         if (!provider && !model && !opts.mock) throw e;
@@ -5731,7 +5786,7 @@ function registerCode(program) {
       if (!(process.stdin.isTTY && process.stdout.isTTY)) {
         throw usageError('say what to change, e.g. `vg code "add a --timeout flag to the scan command"` (guided mode needs an interactive terminal)');
       }
-      const { runInteractive } = await import('./interactive-372NLI5C.js');
+      const { runInteractive } = await import('./interactive-SMHVURYK.js');
       await runInteractive(
         rootOf(global),
         global,
@@ -5775,28 +5830,52 @@ function registerCode(program) {
         model,
         modelPath: opts.modelPath,
         local: global.local,
-        consent: opts.yes,
-        mockReply
+        consent: opts.yes || codeModeActive || customSelection,
+        mockReply,
+        codeMode: codeModeActive,
+        preferEmbedded: codeModeActive || void 0
       },
       {}
     );
+    if (!opts.mock && route.providers[0]) {
+      const { ensureManagerRuntime } = await import('./model-manager-PN7HEDXD.js');
+      const ensure = await ensureManagerRuntime({
+        providerId: route.providers[0].id,
+        model: route.providers[0].model,
+        offline: !!global.local,
+        // Code Mode / explicit custom selection / --yes count as consent for
+        // npm runtime deps (and ollama pull when the binary is already present).
+        consent: !!(opts.yes || codeModeActive || customSelection || process.stdin.isTTY),
+        onProgress: (line) => {
+          if (!global.json && !global.quiet && !opts.streamJson) info(c.dim(`  ${line}`));
+        }
+      });
+      if (!ensure.ok) {
+        throw new CliError(ensure.error ?? "model manager runtime not ready", ExitCode.ERROR);
+      }
+      if (!global.json && !global.quiet && !opts.streamJson && (ensure.installed.length || ensure.pulled.length)) {
+        for (const s of ensure.installed) info(c.dim(`  installed ${s}`));
+        for (const s of ensure.pulled) info(c.dim(`  pulled ${s}`));
+      }
+    }
     if (!global.json && !global.quiet) {
       info(`${c.cyan("vg code")} \xB7 ${c.dim(route.reason)}`);
+      info(`${c.cyan("vg code")} \xB7 manager ${c.bold(route.managerLine)}`);
     }
     if (opts.streamJson && !opts.mock) {
       const primarySlug = route.providers[0]?.model.includes("/") ? route.providers[0].model.split("/")[0] : route.providers[0]?.id;
-      const { runCodeStreamJson } = await import('./stream-json-SLMDKLXP.js');
-      const { nodeCodeFs } = await import('./session-ITPYQ5XI.js');
+      const { runCodeStreamJson } = await import('./stream-json-X7UQFB4T.js');
+      const { nodeCodeFs } = await import('./session-W3646AOV.js');
       const readline5 = await import('readline');
       const child = await import('child_process');
       const { loadOrDiscoverFederation } = await import('./federation-SZWZIFZ7.js');
       const { resolveExecutionEnv } = await import('./execution-env-ZU45JZ4G.js');
       const { resolveModelExecutionProfile, mergeModelExecutionProfile } = await import('./model-execution-profile-TFBKCNJG.js');
-      const { startCodeRuntimeSession } = await import('./runtime-session-JRKCQUHY.js');
-      const { resolveGraphBackend } = await import('./graph-backend-73URGTFY.js');
+      const { startCodeRuntimeSession } = await import('./runtime-session-4AMZIAAG.js');
+      const { resolveGraphBackend } = await import('./graph-backend-UTOL3SHE.js');
       const { detectGitRef } = await import('./git-ref-XDXB6JP5.js');
       const { repositoryIdFromRoot } = await import('./paths-2RAH3GME.js');
-      const { vgdRequest: vgdRequest2 } = await import('./vgd-7JV5KCNJ.js');
+      const { vgdRequest: vgdRequest2 } = await import('./vgd-CVLKBS7K.js');
       const federation = loadOrDiscoverFederation(root2);
       const modelProfile = mergeModelExecutionProfile(
         resolveModelExecutionProfile({
@@ -5885,8 +5964,8 @@ ${res.stderr}` : ""), exitCode: res.status ?? 1 };
       if (!autonomous && !tty) {
         throw usageError("the agent approves each edit/command \u2014 run in a terminal to approve interactively, or pass --auto to run autonomously (or --single for a one-shot diff).");
       }
-      const { agentTask } = await import('./interactive-372NLI5C.js');
-      const { nodeCodeFs } = await import('./session-ITPYQ5XI.js');
+      const { agentTask } = await import('./interactive-SMHVURYK.js');
+      const { nodeCodeFs } = await import('./session-W3646AOV.js');
       const { TtyPrompter } = await import('./ui-Q6DJ3GCU.js');
       let priorSummary;
       if (opts.continue) {
@@ -5908,11 +5987,11 @@ ${res.stderr}` : ""), exitCode: res.status ?? 1 };
         const { loadFederation } = await import('./federation-SZWZIFZ7.js');
         const { resolveExecutionEnv } = await import('./execution-env-ZU45JZ4G.js');
         const { resolveModelExecutionProfile, mergeModelExecutionProfile } = await import('./model-execution-profile-TFBKCNJG.js');
-        const { startCodeRuntimeSession } = await import('./runtime-session-JRKCQUHY.js');
-        const { resolveGraphBackend } = await import('./graph-backend-73URGTFY.js');
+        const { startCodeRuntimeSession } = await import('./runtime-session-4AMZIAAG.js');
+        const { resolveGraphBackend } = await import('./graph-backend-UTOL3SHE.js');
         const { detectGitRef } = await import('./git-ref-XDXB6JP5.js');
         const { repositoryIdFromRoot } = await import('./paths-2RAH3GME.js');
-        const { vgdRequest: vgdRequest2 } = await import('./vgd-7JV5KCNJ.js');
+        const { vgdRequest: vgdRequest2 } = await import('./vgd-CVLKBS7K.js');
         const federation = loadFederation(root2);
         const modelProfile = mergeModelExecutionProfile(
           resolveModelExecutionProfile({
@@ -6056,11 +6135,11 @@ function resolveSecurityTierFlag(flag, fromConfig, auto) {
   return auto ? "L1" : "L0";
 }
 function confirm(question) {
-  return new Promise((resolve19) => {
+  return new Promise((resolve20) => {
     const rl = readline.createInterface({ input: process.stdin, output: process.stderr });
     rl.question(`${question} [y/N] `, (answer) => {
       rl.close();
-      resolve19(/^y(es)?$/i.test(answer.trim()));
+      resolve20(/^y(es)?$/i.test(answer.trim()));
     });
   });
 }
@@ -6217,7 +6296,7 @@ async function addCmd(root2, rest, opts, asJson) {
 }
 function readPackageVersion(root2) {
   try {
-    const pkg = JSON.parse(fs8__default.readFileSync(path36__default.join(root2, "package.json"), "utf8"));
+    const pkg = JSON.parse(fs8__default.readFileSync(path37__default.join(root2, "package.json"), "utf8"));
     return typeof pkg.version === "string" ? pkg.version : void 0;
   } catch {
     return void 0;
@@ -6240,8 +6319,8 @@ async function publishCmd(root2, rest, opts, global, asJson) {
   if (!parsed) throw new CliError("publishing a private library requires a DSN \u2014 run `vibgrate login` or set VIBGRATE_DSN", ExitCode.USAGE_ERROR);
   const version = (opts.version || readPackageVersion(root2) || "").trim();
   if (!version) throw usageError("a --version is required (or run from a package whose package.json has a version)");
-  const readme = readOptionalFile(opts.readme ? path36__default.resolve(opts.readme) : path36__default.join(root2, "README.md"));
-  const dts = opts.dts ? readOptionalFile(path36__default.resolve(opts.dts)) : void 0;
+  const readme = readOptionalFile(opts.readme ? path37__default.resolve(opts.readme) : path37__default.join(root2, "README.md"));
+  const dts = opts.dts ? readOptionalFile(path37__default.resolve(opts.dts)) : void 0;
   if (!readme && !dts) throw usageError("nothing to publish \u2014 no README.md found and no --dts given");
   const result = await publishPrivateLibrary(
     { name, version, readme, dts, language: opts.language },
@@ -6354,7 +6433,7 @@ async function showCmd(root2, name, budget, asJson, opts = {}) {
   out(doc);
 }
 function registerExport(program) {
-  const cmd = program.command("export").description("export the map (format inferred: json|ndjson|graphml|dot|cypher|sql|md|html|cdx.json|spdx.json)").argument("[file]", "target file (or - for stdout)", "map.json").action(function(file) {
+  const cmd = program.command("export").description("export the map (format inferred: json|ndjson|graphml|dot|cypher|sql|md|html|cdx.json|spdx.json)").argument("[file]", "target file (or - for stdout)", "map.json").option("--compact", "compact JSON (no pretty-print; auto for large maps)").option("--slim", "drop heavy fields (area member lists, grounding) for smaller exports").action(function(file, opts) {
     const global = readGlobal(this);
     const { graph } = requireGraph(global);
     const root2 = rootOf(global);
@@ -6365,13 +6444,15 @@ function registerExport(program) {
       graph,
       deps: needsDeps ? inventory(root2).records : void 0,
       models: needsDeps && !global.local ? discoverModels() : void 0,
-      generatedAt: graph.generatedAt
+      generatedAt: graph.generatedAt,
+      compact: opts.compact === true ? true : opts.compact === false ? false : void 0,
+      slim: opts.slim === true
     });
     if (file === "-") {
       out(content.trimEnd());
       return;
     }
-    fs8.mkdirSync(path36.dirname(path36.resolve(file)), { recursive: true });
+    fs8.mkdirSync(path37.dirname(path37.resolve(file)), { recursive: true });
     fs8.writeFileSync(file, content);
     info(`${c.green("\u2714")} wrote ${file} ${c.dim(`(${format})`)}`);
   });
@@ -6382,37 +6463,37 @@ function detectFormat(file) {
   if (lower.endsWith(".cdx.json")) return "cyclonedx";
   if (lower.endsWith(".spdx.json")) return "spdx";
   if (file === "-") return "json";
-  return formatForExt(path36.extname(file));
+  return formatForExt(path37.extname(file));
 }
 function registerBundle(program) {
   const cmd = program.command("bundle").description("build an air-gapped bundle (grammars + graph + library catalog)").option("--offline", "offline bundle (default; present for clarity)").option("-o, --out <dir>", "output directory", "vg-bundle").action(function(opts) {
     const global = readGlobal(this);
     const root2 = rootOf(global);
-    const outDir = path36.resolve(root2, opts.out ?? "vg-bundle");
+    const outDir = path37.resolve(root2, opts.out ?? "vg-bundle");
     let grammarFiles;
     try {
       grammarFiles = resolvedGrammarFiles();
     } catch {
       throw new CliError("no grammars found to bundle (run a build first)", ExitCode.ERROR);
     }
-    fs8.mkdirSync(path36.join(outDir, "grammars"), { recursive: true });
+    fs8.mkdirSync(path37.join(outDir, "grammars"), { recursive: true });
     let grammarCount = 0;
     for (const { fileName, absPath } of grammarFiles) {
-      fs8.copyFileSync(absPath, path36.join(outDir, "grammars", fileName));
+      fs8.copyFileSync(absPath, path37.join(outDir, "grammars", fileName));
       grammarCount++;
     }
     const included = [`grammars/ (${grammarCount} .wasm)`];
     const graphSrc = resolveGraphPath(root2, global.graph);
     if (fs8.existsSync(graphSrc)) {
-      fs8.copyFileSync(graphSrc, path36.join(outDir, "graph.json"));
+      fs8.copyFileSync(graphSrc, path37.join(outDir, "graph.json"));
       included.push("graph.json");
     }
     const cat = catalogPath(root2);
     if (fs8.existsSync(cat)) {
-      fs8.copyFileSync(cat, path36.join(outDir, "vibgrate.lib.json"));
+      fs8.copyFileSync(cat, path37.join(outDir, "vibgrate.lib.json"));
       included.push("vibgrate.lib.json");
       if (fs8.existsSync(libDir(root2))) {
-        fs8.cpSync(libDir(root2), path36.join(outDir, "lib"), { recursive: true });
+        fs8.cpSync(libDir(root2), path37.join(outDir, "lib"), { recursive: true });
         included.push("lib/");
       }
     }
@@ -6424,15 +6505,15 @@ function registerBundle(program) {
       included,
       usage: "Run `vg build --grammars <this dir>/grammars` to build fully offline."
     };
-    fs8.writeFileSync(path36.join(outDir, "MANIFEST.json"), `${stableStringify(manifest, 2)}
+    fs8.writeFileSync(path37.join(outDir, "MANIFEST.json"), `${stableStringify(manifest, 2)}
 `);
     if (global.json) {
-      json({ out: path36.relative(root2, outDir), ...manifest });
+      json({ out: path37.relative(root2, outDir), ...manifest });
       return;
     }
-    info(`${c.cyan("vg bundle")} \xB7 wrote ${path36.relative(root2, outDir)}/`);
+    info(`${c.cyan("vg bundle")} \xB7 wrote ${path37.relative(root2, outDir)}/`);
     for (const i of included) info(`  ${c.green("\u2714")} ${i}`);
-    info(c.dim(`  offline: vg build --grammars "${path36.relative(root2, outDir)}/grammars"`));
+    info(c.dim(`  offline: vg build --grammars "${path37.relative(root2, outDir)}/grammars"`));
   });
   applyGlobalOptions(cmd);
 }
@@ -6450,7 +6531,7 @@ async function runDoctor(global) {
   const root2 = rootOf(global);
   const local = global.local === true;
   const graphPath = resolveGraphPath(root2, global.graph);
-  const configFile = CONFIG_BASENAMES.find((f) => fs8.existsSync(path36.join(root2, f))) ?? null;
+  const configFile = CONFIG_BASENAMES.find((f) => fs8.existsSync(path37.join(root2, f))) ?? null;
   const graph = loadGraph(root2, graphPath);
   let staleFiles = null;
   if (graph) {
@@ -6476,13 +6557,13 @@ async function runDoctor(global) {
     root: root2,
     configFile,
     map: {
-      path: path36.relative(root2, graphPath),
+      path: path37.relative(root2, graphPath),
       built: graph !== null,
       generatedAt: graph?.generatedAt ?? null,
       staleFiles
     },
     libCatalog: {
-      path: path36.relative(root2, catalogPath(root2)),
+      path: path37.relative(root2, catalogPath(root2)),
       present: fs8.existsSync(catalogPath(root2)),
       libraries: libCount
     },
@@ -6540,7 +6621,7 @@ async function runDoctor(global) {
   );
   info(
     `  host pool  ${li.hostPool.size} warm session(s)` + (li.hostPool.sessions[0] ? c.dim(
-      ` \xB7 last ${path36.basename(li.hostPool.sessions[0].modelPath)} kv=${li.hostPool.sessions[0].kvBlocks}`
+      ` \xB7 last ${path37.basename(li.hostPool.sessions[0].modelPath)} kv=${li.hostPool.sessions[0].kvBlocks}`
     ) : c.dim(" \xB7 none (load via vg code / vgd host-load)"))
   );
   if (li.dynamicOnToken || li.dynamicCustomSampler) {
@@ -6676,7 +6757,7 @@ function registerDaemon(program) {
   const register = cmd.command("register").description("register the current repository with a running vgd").argument("[root]", "repository root (default: cwd)").action(async function(rootArg) {
     const global = readGlobal(this);
     const socketPath = socketOf(this);
-    const root2 = path36.resolve(rootArg ?? rootOf(global));
+    const root2 = path37.resolve(rootArg ?? rootOf(global));
     if (!await vgdIsRunning({ socketPath })) {
       throw new CliError(`vgd is not running \u2014 start it with \`vg daemon start\` (${socketPath})`, ExitCode.NOT_FOUND);
     }
@@ -6712,7 +6793,7 @@ function registerDaemon(program) {
   const federation = cmd.command("federation").description("register a multi-root federation from .vibgrate/federation.json (or primary cwd)").argument("[root]", "primary repository root (default: cwd)").action(async function(rootArg) {
     const global = readGlobal(this);
     const socketPath = socketOf(this);
-    const primary = path36.resolve(rootArg ?? rootOf(global));
+    const primary = path37.resolve(rootArg ?? rootOf(global));
     if (!await vgdIsRunning({ socketPath })) {
       throw new CliError(`vgd is not running \u2014 start it with \`vg daemon start\` (${socketPath})`, ExitCode.NOT_FOUND);
     }
@@ -6740,11 +6821,11 @@ function registerDaemon(program) {
   const publish = cmd.command("publish").description("load the workspace code map into vgd ActiveGraph (from global/legacy store)").argument("[root]", "repository root (default: cwd)").option("--git-ref <ref>", "branch or SHA (default: detect HEAD)").action(async function(rootArg) {
     const global = readGlobal(this);
     const socketPath = socketOf(this);
-    const root2 = path36.resolve(rootArg ?? rootOf(global));
+    const root2 = path37.resolve(rootArg ?? rootOf(global));
     if (!await vgdIsRunning({ socketPath })) {
       throw new CliError(`vgd is not running \u2014 start it with \`vg daemon ensure\` (${socketPath})`, ExitCode.NOT_FOUND);
     }
-    const { loadGraph: loadGraph2 } = await import('./load-I333TGNI.js');
+    const { loadGraph: loadGraph2 } = await import('./load-QPOWQD7C.js');
     const { detectGitRef } = await import('./git-ref-XDXB6JP5.js');
     const { repositoryIdFromRoot } = await import('./paths-2RAH3GME.js');
     const opts = this.opts();
@@ -6860,7 +6941,7 @@ function socketOf(cmd) {
   let c2 = cmd;
   while (c2) {
     const opts = c2.opts();
-    if (opts.socket) return path36.resolve(opts.socket);
+    if (opts.socket) return path37.resolve(opts.socket);
     c2 = c2.parent;
   }
   return vgdSocketPath();
@@ -7077,11 +7158,11 @@ function registerLlmHost(program) {
   applyGlobalOptions(cmd);
 }
 var initCommand = new Command("init").description("Initialize vibgrate in a project").argument("[path]", "Path to initialize", ".").option("--baseline", "Create initial baseline after init").option("--yes", "Skip confirmation prompts").action(async (targetPath, opts) => {
-  const rootDir = path36.resolve(targetPath);
-  const vibgrateDir2 = path36.join(rootDir, ".vibgrate");
+  const rootDir = path37.resolve(targetPath);
+  const vibgrateDir2 = path37.join(rootDir, ".vibgrate");
   await ensureDir(vibgrateDir2);
   console.log(chalk7.green("\u2714") + ` Created ${chalk7.bold(".vibgrate/")} directory`);
-  const configPath = path36.join(rootDir, "vibgrate.config.ts");
+  const configPath = path37.join(rootDir, "vibgrate.config.ts");
   if (await pathExists(configPath)) {
     console.log(chalk7.dim("  vibgrate.config.ts already exists, skipping"));
   } else {
@@ -7089,7 +7170,7 @@ var initCommand = new Command("init").description("Initialize vibgrate in a proj
     console.log(chalk7.green("\u2714") + ` Created ${chalk7.bold("vibgrate.config.ts")}`);
   }
   if (opts.baseline) {
-    const { runBaseline } = await import('./baseline-TG4ATZGZ.js');
+    const { runBaseline } = await import('./baseline-ENCOSJYQ.js');
     await runBaseline(rootDir);
   }
   console.log("");
@@ -7192,16 +7273,16 @@ function collectPackageImports(graph, ecosystem, pkg) {
   };
 }
 async function fileReferencesIdentifier(rootDir, relFile, identifier, readFile3) {
-  const content = await readFile3(path36.join(rootDir, relFile));
+  const content = await readFile3(path37.join(rootDir, relFile));
   if (!content) return false;
   const escaped = identifier.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
   return new RegExp(`\\b${escaped}\\b`).test(content);
 }
 async function defaultReadFile(absPath) {
   try {
-    const stat2 = await fs20.stat(absPath);
+    const stat2 = await fs21.stat(absPath);
     if (!stat2.isFile() || stat2.size > MAX_FILE_BYTES) return null;
-    return await fs20.readFile(absPath, "utf8");
+    return await fs21.readFile(absPath, "utf8");
   } catch {
     return null;
   }
@@ -7386,7 +7467,7 @@ var AI_ASSISTANT_DETECTORS = [
 async function detectAiAssistant(rootDir) {
   for (const detector of AI_ASSISTANT_DETECTORS) {
     for (const file of detector.files) {
-      if (await pathExists$1(path36.join(rootDir, file))) {
+      if (await pathExists$1(path37.join(rootDir, file))) {
         return detector.name;
       }
     }
@@ -7579,7 +7660,7 @@ var scanCommand = new Command("scan").description("Scan a project for upgrade dr
   collectExcludes,
   []
 ).option("--concurrency <n>", "Max concurrent npm calls", "8").option("--push", "Auto-push results to Vibgrate API after scan").option("--dsn <dsn>", "DSN token for push (or use VIBGRATE_DSN env)").option("--region <region>", "Override data residency region for push (us, eu)").option("--strict", "Fail on push errors").option("--ui-purpose", "Enable optional UI purpose evidence extraction (slower)").option("--no-local-artifacts", "Do not write .vibgrate JSON artifacts to disk").option("--max-privacy", "Enable strongest privacy mode (minimal scanners, no local artifacts)").option("--offline", "Run without network calls; do not upload results").option("--full", "Comprehensive scan: turns on known-vulnerability detection (= --vulns) and, when a standards policy exists, a banned-dependency report \u2014 on top of drift scoring and the code map").option("--vulns", "Also scan installed dependencies for known vulnerabilities (OSV online, or advisories from --package-manifest when offline)").option("--package-manifest <file>", "Use local package-version manifest JSON/ZIP (for offline mode)").option("--project-scan-timeout <seconds>", "Per-project scan timeout in seconds (default: 180)").option("--drift-budget <score>", "Fail if DriftScore is above budget (0-100)").option("--drift-worsening <percent>", "Fail if drift worsens by more than % since baseline").option("--repository-name <name>", "Override the repository name recorded for this scan (defaults to the directory or package.json name)").option("--force", "Always create a fresh scan ingest, even if the repository is unchanged since the last scan (skips the unchanged/reuse optimization). Used by scheduled and dashboard-triggered scans.").option("--no-graph", "Skip building the local code map (the AI/docs index) that scan produces after scoring drift").option("--quiet", "Suppress promotional output (the free-plan tracking panel and the AI Context install prompt); scan results are unaffected").action(async (targetPath, opts) => {
-  const rootDir = path36.resolve(targetPath);
+  const rootDir = path37.resolve(targetPath);
   if (!await pathExists$1(rootDir)) {
     console.error(chalk7.red(`Path does not exist: ${rootDir}`));
     process.exit(1);
@@ -7587,7 +7668,7 @@ var scanCommand = new Command("scan").description("Scan a project for upgrade dr
   const hasDsn = !!resolveDsn(opts.dsn);
   const willPush = !opts.offline && (opts.push || hasDsn);
   const noLocalArtifacts = opts.localArtifacts === false;
-  const isFirstRun = !await pathExists$1(path36.join(rootDir, ".vibgrate", "scan_result.json"));
+  const isFirstRun = !await pathExists$1(path37.join(rootDir, ".vibgrate", "scan_result.json"));
   let pinnedRegion;
   let planTier;
   let upgradeUrl;
@@ -7866,11 +7947,11 @@ function scanStaleness(rootDir, artifactPath) {
       scanned++;
       if (scanned > MAX_ENTRIES) break;
       if (e.isDirectory()) {
-        if (!SKIP_DIRS2.has(e.name) && !e.name.startsWith(".")) walk2(path36.join(dir, e.name), depth + 1);
+        if (!SKIP_DIRS2.has(e.name) && !e.name.startsWith(".")) walk2(path37.join(dir, e.name), depth + 1);
         continue;
       }
       if (!WATCHED_FILES.has(e.name) && !WATCHED_EXT.test(e.name)) continue;
-      const abs = path36.join(dir, e.name);
+      const abs = path37.join(dir, e.name);
       let mtimeMs;
       try {
         mtimeMs = fs8.statSync(abs).mtimeMs;
@@ -7879,7 +7960,7 @@ function scanStaleness(rootDir, artifactPath) {
       }
       if (mtimeMs > newest) {
         newest = mtimeMs;
-        newestChanged = path36.relative(rootDir, abs) || e.name;
+        newestChanged = path37.relative(rootDir, abs) || e.name;
       }
     }
   };
@@ -8016,13 +8097,13 @@ function analyzeTree(root2, packages) {
       if (filesSeen >= MAX_FILES) return;
       if (entry.isDirectory()) {
         if (SKIP_DIRS3.has(entry.name) || entry.name.startsWith(".")) continue;
-        walk2(path36.join(dir, entry.name), depth + 1);
+        walk2(path37.join(dir, entry.name), depth + 1);
         continue;
       }
-      const fileEco = EXT_ECOSYSTEM[path36.extname(entry.name)];
+      const fileEco = EXT_ECOSYSTEM[path37.extname(entry.name)];
       if (!fileEco || fileEco === "unknown") continue;
       filesSeen++;
-      const full = path36.join(dir, entry.name);
+      const full = path37.join(dir, entry.name);
       let content;
       try {
         if (fs8.statSync(full).size > MAX_FILE_BYTES2) continue;
@@ -8337,7 +8418,7 @@ function applyPlan(rootDir, upgrades, opts = {}) {
     }
     const outcomes = effective.map((t) => {
       const c2 = pmCommandFor(u.ecosystem, u.package, u.to, opts.packageManager, { workspaceRoot: t.isWorkspaceRoot });
-      return { t, res: run(c2, path36.join(rootDir, t.dir)) };
+      return { t, res: run(c2, path37.join(rootDir, t.dir)) };
     });
     const failures = outcomes.filter((o) => !o.res.ok);
     if (failures.length === 0) {
@@ -8366,8 +8447,8 @@ function applyPlan(rootDir, upgrades, opts = {}) {
   return results;
 }
 var REGISTRY_URL = "https://registry.npmjs.org/@vibgrate%2fcli/latest";
-var CACHE_DIR = path36.join(os.homedir(), ".vibgrate");
-var CACHE_FILE = path36.join(CACHE_DIR, "update-check.json");
+var CACHE_DIR = path37.join(os.homedir(), ".vibgrate");
+var CACHE_FILE = path37.join(CACHE_DIR, "update-check.json");
 async function fetchLatestVersion() {
   try {
     const controller = new AbortController();
@@ -8394,8 +8475,8 @@ async function fetchLatestVersion() {
 }
 async function writeCache(data) {
   try {
-    await fs20.mkdir(CACHE_DIR, { recursive: true });
-    await fs20.writeFile(CACHE_FILE, JSON.stringify(data), "utf-8");
+    await fs21.mkdir(CACHE_DIR, { recursive: true });
+    await fs21.writeFile(CACHE_FILE, JSON.stringify(data), "utf-8");
   } catch {
   }
 }
@@ -8436,14 +8517,14 @@ async function findGlobalInstall(pkg = PACKAGE_NAME, run = defaultRunner) {
       pm: "yarn",
       root: () => {
         const dir = tryRun("yarn global dir");
-        return dir ? path36.join(dir, "node_modules") : null;
+        return dir ? path37.join(dir, "node_modules") : null;
       }
     },
-    { pm: "bun", root: () => path36.join(os.homedir(), ".bun", "install", "global", "node_modules") }
+    { pm: "bun", root: () => path37.join(os.homedir(), ".bun", "install", "global", "node_modules") }
   ];
   for (const probe of probes) {
     const root2 = probe.root();
-    if (root2 && await pathExists(path36.join(root2, pkg))) return probe.pm;
+    if (root2 && await pathExists(path37.join(root2, pkg))) return probe.pm;
   }
   return null;
 }
@@ -8462,15 +8543,15 @@ function getGlobalUpdateCommand(pm, pkg, version) {
   }
 }
 async function detectPackageManager(cwd) {
-  if (await pathExists(path36.join(cwd, "pnpm-lock.yaml"))) return "pnpm";
-  if (await pathExists(path36.join(cwd, "bun.lockb"))) return "bun";
-  if (await pathExists(path36.join(cwd, "yarn.lock"))) return "yarn";
+  if (await pathExists(path37.join(cwd, "pnpm-lock.yaml"))) return "pnpm";
+  if (await pathExists(path37.join(cwd, "bun.lockb"))) return "bun";
+  if (await pathExists(path37.join(cwd, "yarn.lock"))) return "yarn";
   return "npm";
 }
 async function detectWorkspaceRoot(cwd) {
-  if (await pathExists(path36.join(cwd, "pnpm-workspace.yaml"))) return true;
+  if (await pathExists(path37.join(cwd, "pnpm-workspace.yaml"))) return true;
   try {
-    const pkgPath = path36.join(cwd, "package.json");
+    const pkgPath = path37.join(cwd, "package.json");
     const raw = await (await import('fs/promises')).readFile(pkgPath, "utf-8");
     const pkg = JSON.parse(raw);
     return pkg.workspaces != null;
@@ -8495,7 +8576,7 @@ function getInstallCommand(pm, pkg, version, isDev, opts = {}) {
 }
 async function getLocalDependencyState(cwd, pkg = PACKAGE_NAME) {
   try {
-    const pkgPath = path36.join(cwd, "package.json");
+    const pkgPath = path37.join(cwd, "package.json");
     const raw = await (await import('fs/promises')).readFile(pkgPath, "utf-8");
     const parsed = JSON.parse(raw);
     if (parsed.devDependencies?.[pkg]) return "dev";
@@ -8507,11 +8588,11 @@ async function getLocalDependencyState(cwd, pkg = PACKAGE_NAME) {
 async function confirmWorkspaceRoot(pm) {
   if (!(process.stdin.isTTY && process.stdout.isTTY)) return false;
   const rl = readline.createInterface({ input: process.stdin, output: process.stdout });
-  return new Promise((resolve19) => {
+  return new Promise((resolve20) => {
     rl.question(chalk7.yellow(`Update the ${pm} workspace root with -w? [y/N]: `), (ans) => {
       rl.close();
       const t = ans.trim().toLowerCase();
-      resolve19(t === "y" || t === "yes");
+      resolve20(t === "y" || t === "yes");
     });
   });
 }
@@ -8643,13 +8724,13 @@ function collectCandidates(artifact) {
   return out2;
 }
 var defaultFixScanner = async (rootDir) => {
-  const scratch = path36.join(os.tmpdir(), `vg-fix-scan-${process.pid}.json`);
+  const scratch = path37.join(os.tmpdir(), `vg-fix-scan-${process.pid}.json`);
   const scanOpts = { vibgrateVersion: VERSION, format: "json", out: scratch, quiet: true, concurrency: 8 };
   const advanced = await loadAdvancedScanHook();
   return runCoreScan(rootDir, scanOpts, advanced);
 };
 async function loadArtifact(rootDir, inFile, scan = defaultFixScanner) {
-  const artifactPath = path36.isAbsolute(inFile) ? inFile : path36.join(rootDir, inFile);
+  const artifactPath = path37.isAbsolute(inFile) ? inFile : path37.join(rootDir, inFile);
   if (await pathExists(artifactPath)) {
     const staleness = scanStaleness(rootDir, artifactPath);
     if (!staleness.stale) {
@@ -8676,7 +8757,7 @@ async function repositoryIdentity(rootDir, override) {
   }
 }
 var fixCommand = new Command("fix").description("Get ranked, risk-tiered upgrade plans from the hosted planner and optionally apply them (prompts before changing files; --yes applies non-interactively, --dry-run previews, --no-apply only prints). Requires login/DSN.").argument("[path]", "Path to analyse", ".").option("--in <file>", "Scan artifact to read", ".vibgrate/scan_result.json").option("--format <format>", "Output format (text|json|md)", "text").option("--dsn <dsn>", 'DSN token (or use VIBGRATE_DSN env / "vg login")').option("--region <region>", "Override data residency region (us, eu)").option("--repository-name <name>", "Override the repository name recorded for this plan").option("--plan <tier>", "Apply a specific plan non-interactively (safe|balanced|aggressive)").option("--yes", "Apply the recommended plan without prompting").option("--dry-run", "Show what would change without applying").option("--no-apply", "Only print the plans; never modify the project").option("--fail-on-vulns <severity>", "Exit non-zero if the recommended plan leaves an advisory at/above this severity unresolved (low|moderate|high|critical)").action(async (targetPath, opts) => {
-  const rootDir = path36.resolve(targetPath);
+  const rootDir = path37.resolve(targetPath);
   if (!await pathExists(rootDir)) {
     console.error(chalk7.red(`Path does not exist: ${rootDir}`));
     process.exit(1);
@@ -8837,7 +8918,7 @@ function emit(report, format) {
   }
 }
 function relProjectDir(rootDir, projectPath) {
-  const rel = path36.isAbsolute(projectPath) ? path36.relative(rootDir, projectPath) : projectPath;
+  const rel = path37.isAbsolute(projectPath) ? path37.relative(rootDir, projectPath) : projectPath;
   return rel === "" ? "." : rel;
 }
 async function buildTargetResolver(rootDir, artifact) {
@@ -8878,14 +8959,14 @@ function promptPlanSelection(response) {
   const defaultIdx = plans.findIndex((p) => p.tier === response.recommended);
   const def = defaultIdx >= 0 ? defaultIdx + 1 : 1;
   const rl = readline.createInterface({ input: process.stdin, output: process.stdout });
-  return new Promise((resolve19) => {
+  return new Promise((resolve20) => {
     rl.question(`Plan [1-${plans.length}, default ${def}, q to cancel]: `, (ans) => {
       rl.close();
       const t = ans.trim().toLowerCase();
-      if (t === "q" || t === "quit") return resolve19(null);
+      if (t === "q" || t === "quit") return resolve20(null);
       const n = t === "" ? def : Number.parseInt(t, 10);
-      if (!Number.isInteger(n) || n < 1 || n > plans.length) return resolve19(null);
-      resolve19(plans[n - 1].tier);
+      if (!Number.isInteger(n) || n < 1 || n > plans.length) return resolve20(null);
+      resolve20(plans[n - 1].tier);
     });
   });
 }
@@ -9672,7 +9753,7 @@ function formatMarkdown(artifact) {
 
 // src/reporting/commands/report.ts
 var reportCommand = new Command("report").description("Generate a drift report from a scan artifact").option("--in <file>", "Input artifact file", ".vibgrate/scan_result.json").option("--format <format>", "Output format (md|text|json)", "text").action(async (opts) => {
-  const artifactPath = path36.resolve(opts.in);
+  const artifactPath = path37.resolve(opts.in);
   if (!await pathExists(artifactPath)) {
     console.error(chalk7.red(`Artifact not found: ${artifactPath}`));
     console.error(chalk7.dim('Run "vibgrate scan" first to generate a scan artifact.'));
@@ -9718,10 +9799,10 @@ function openUrl(url) {
 }
 
 // src/reporting/commands/login.ts
-var delay = (ms) => new Promise((resolve19) => setTimeout(resolve19, ms));
+var delay = (ms) => new Promise((resolve20) => setTimeout(resolve20, ms));
 function isInside(dir, file) {
-  const rel = path36.relative(dir, file);
-  return !!rel && !rel.startsWith("..") && !path36.isAbsolute(rel);
+  const rel = path37.relative(dir, file);
+  return !!rel && !rel.startsWith("..") && !path37.isAbsolute(rel);
 }
 var loginCommand = new Command("login").description("Authenticate the CLI with your Vibgrate workspace via the browser").option("--ingest <url>", "Ingest API URL (overrides --region)").option("--region <region>", `Data residency region (${availableRegionIds().join(", ")})`, "us").option("--no-browser", "Do not attempt to open a browser automatically").option(
   "--local",
@@ -9976,7 +10057,7 @@ var vexCommand = new Command("vex").description("Generate an OpenVEX document (e
   try {
     const statements = [];
     if (opts.from) {
-      const fromPath = path36.resolve(opts.from);
+      const fromPath = path37.resolve(opts.from);
       if (!await pathExists(fromPath)) {
         process.stderr.write(chalk7.red(`Statements file not found: ${fromPath}
 `));
@@ -9994,9 +10075,9 @@ var vexCommand = new Command("vex").description("Generate an OpenVEX document (e
     });
     const json2 = JSON.stringify(doc, null, 2);
     if (opts.out) {
-      await writeTextFile(path36.resolve(opts.out), json2 + "\n");
+      await writeTextFile(path37.resolve(opts.out), json2 + "\n");
       process.stderr.write(
-        chalk7.green("\u2714") + ` Wrote OpenVEX document (${doc.statements.length} statement(s)) to ${path36.resolve(opts.out)}
+        chalk7.green("\u2714") + ` Wrote OpenVEX document (${doc.statements.length} statement(s)) to ${path37.resolve(opts.out)}
 `
       );
     } else {
@@ -10179,7 +10260,7 @@ function formatDeltaText(base, current) {
   return lines.join("\n");
 }
 async function readArtifactOrExit(filePath) {
-  const absolutePath = path36.resolve(filePath);
+  const absolutePath = path37.resolve(filePath);
   if (!await pathExists(absolutePath)) {
     console.error(chalk7.red(`Artifact not found: ${absolutePath}`));
     process.exit(1);
@@ -10196,7 +10277,7 @@ var exportCommand = new Command("export").description("Export scan artifact as S
   const sbom = format === "cyclonedx" ? toCycloneDx(artifact) : toSpdx(artifact);
   const body = JSON.stringify(sbom, null, 2);
   if (opts.out) {
-    await writeTextFile(path36.resolve(opts.out), body);
+    await writeTextFile(path37.resolve(opts.out), body);
     console.log(chalk7.green("\u2714") + ` SBOM written to ${opts.out}`);
   } else {
     console.log(body);
@@ -10207,7 +10288,7 @@ var deltaCommand = new Command("delta").description("Show SBOM delta between two
   const current = await readArtifactOrExit(opts.to);
   const report = formatDeltaText(base, current);
   if (opts.out) {
-    await writeTextFile(path36.resolve(opts.out), report);
+    await writeTextFile(path37.resolve(opts.out), report);
     console.log(chalk7.green("\u2714") + ` SBOM delta report written to ${opts.out}`);
   } else {
     console.log(report);
@@ -10338,20 +10419,20 @@ function resolveRegime(id) {
   return regime;
 }
 function evidenceDir(root2) {
-  return path36.join(root2, ".vibgrate", "evidence");
+  return path37.join(root2, ".vibgrate", "evidence");
 }
 function orgPath(root2) {
-  return path36.join(evidenceDir(root2), "org.json");
+  return path37.join(evidenceDir(root2), "org.json");
 }
 function productsPath(root2) {
-  return path36.join(evidenceDir(root2), "products.json");
+  return path37.join(evidenceDir(root2), "products.json");
 }
 function releasesDir(root2) {
-  return path36.join(evidenceDir(root2), "releases");
+  return path37.join(evidenceDir(root2), "releases");
 }
 function releasePath(root2, productId, version) {
   const safe = `${productId}@${version}`.replace(/[^A-Za-z0-9._@-]/g, "_");
-  return path36.join(releasesDir(root2), `${safe}.json`);
+  return path37.join(releasesDir(root2), `${safe}.json`);
 }
 var DEFAULT_ORG = {
   responsiblePersons: [],
@@ -10382,7 +10463,7 @@ async function freezeRelease(root2, release) {
   const p = releasePath(root2, release.productId, release.version);
   if (await pathExists(p)) {
     throw new CliError(
-      `release ${release.productId}@${release.version} is already frozen and manifests are immutable \u2014 delete ${path36.relative(root2, p)} only if it was frozen in error`,
+      `release ${release.productId}@${release.version} is already frozen and manifests are immutable \u2014 delete ${path37.relative(root2, p)} only if it was frozen in error`,
       ExitCode.USAGE_ERROR
     );
   }
@@ -10396,7 +10477,7 @@ async function loadReleases(root2, productId) {
   const files = (await readdir(dir)).filter((f) => f.endsWith(".json")).sort();
   const releases = [];
   for (const f of files) {
-    const rel = await readJsonFile(path36.join(dir, f));
+    const rel = await readJsonFile(path37.join(dir, f));
     if (!productId || rel.productId === productId) releases.push(rel);
   }
   return releases;
@@ -11091,12 +11172,12 @@ function verifyEvidenceEnvelope(env, opts = {}) {
 var DEFAULT_KEY = "attest-key.pem";
 function resolveSigningKey(root2, explicit) {
   const chosen = process.env.VG_ATTEST_KEY;
-  const keyPath = chosen ? path36.resolve(chosen) : path36.join(root2, ".vibgrate", DEFAULT_KEY);
+  const keyPath = chosen ? path37.resolve(chosen) : path37.join(root2, ".vibgrate", DEFAULT_KEY);
   let minted = false;
   if (!fs8.existsSync(keyPath)) {
     if (chosen) throw new CliError(`signing key not found: ${chosen}`, ExitCode.USAGE_ERROR);
     const kp = generateKeypair();
-    fs8.mkdirSync(path36.dirname(keyPath), { recursive: true });
+    fs8.mkdirSync(path37.dirname(keyPath), { recursive: true });
     fs8.writeFileSync(keyPath, kp.privatePem, { mode: 384 });
     fs8.writeFileSync(`${keyPath}.pub`, kp.publicPem);
     minted = true;
@@ -11114,16 +11195,16 @@ function resolveSigningKey(root2, explicit) {
 }
 function writeBundle(input) {
   const dir = input.outDir;
-  fs8.mkdirSync(path36.join(dir, "inputs", "releases"), { recursive: true });
-  const write = (rel, data) => fs8.writeFileSync(path36.join(dir, rel), `${JSON.stringify(data, null, 2)}
+  fs8.mkdirSync(path37.join(dir, "inputs", "releases"), { recursive: true });
+  const write = (rel, data) => fs8.writeFileSync(path37.join(dir, rel), `${JSON.stringify(data, null, 2)}
 `);
   write("result.json", input.result);
-  write(path36.join("inputs", "advisory.json"), input.advisory);
+  write(path37.join("inputs", "advisory.json"), input.advisory);
   for (const rel of input.releases) {
     const safe = `${rel.productId}@${rel.version}`.replace(/[^A-Za-z0-9._@-]/g, "_");
-    write(path36.join("inputs", "releases", `${safe}.json`), rel);
+    write(path37.join("inputs", "releases", `${safe}.json`), rel);
   }
-  write(path36.join("inputs", "datapack.lock"), { dataPackVersion: input.result.meta.dataPackVersion, kernelVersion: input.result.meta.kernelVersion });
+  write(path37.join("inputs", "datapack.lock"), { dataPackVersion: input.result.meta.dataPackVersion, kernelVersion: input.result.meta.kernelVersion });
   write("provenance.json", {
     method: "deterministic",
     modelDrafted: [],
@@ -11139,13 +11220,13 @@ function writeBundle(input) {
     disclaimer: input.regime.disclaimer
   });
   if (input.envelope) {
-    fs8.writeFileSync(path36.join(dir, "evidence.intoto.jsonl"), `${JSON.stringify(input.envelope)}
+    fs8.writeFileSync(path37.join(dir, "evidence.intoto.jsonl"), `${JSON.stringify(input.envelope)}
 `);
   }
   if (input.timestampToken) {
-    fs8.writeFileSync(path36.join(dir, "timestamp.tsr"), input.timestampToken);
+    fs8.writeFileSync(path37.join(dir, "timestamp.tsr"), input.timestampToken);
   }
-  fs8.writeFileSync(path36.join(dir, "VERIFY.md"), verifyDoc(input));
+  fs8.writeFileSync(path37.join(dir, "VERIFY.md"), verifyDoc(input));
   return dir;
 }
 function verifyDoc(input) {
@@ -11206,13 +11287,13 @@ function undeterminedFields(result, regime) {
   return gaps.filter((g) => regime.submission.requires.some((r) => g.startsWith(r)) || g.startsWith("exposure") || g.startsWith("member"));
 }
 async function recordDrill(root2, record) {
-  const dir = path36.join(evidenceDir(root2), "drills");
-  const p = path36.join(dir, `${record.drillId}.json`);
+  const dir = path37.join(evidenceDir(root2), "drills");
+  const p = path37.join(dir, `${record.drillId}.json`);
   await writeJsonFile(p, record);
   return p;
 }
 async function hasRecentDrill(root2, asOf) {
-  const dir = path36.join(evidenceDir(root2), "drills");
+  const dir = path37.join(evidenceDir(root2), "drills");
   if (!await pathExists(dir)) return void 0;
   const { readdir } = await import('fs/promises');
   const { readJsonFile: readJsonFile2 } = await import('./fs-O5IQYXHO.js');
@@ -11220,7 +11301,7 @@ async function hasRecentDrill(root2, asOf) {
   if (files.length === 0) return void 0;
   const cutoff = new Date(new Date(asOf).getTime() - 90 * 24 * 3600 * 1e3).toISOString();
   for (const f of files) {
-    const rec = await readJsonFile2(path36.join(dir, f));
+    const rec = await readJsonFile2(path37.join(dir, f));
     if (rec.ranAt >= cutoff) return true;
   }
   return false;
@@ -11300,7 +11381,7 @@ function formatRegimeList() {
 
 // src/reporting/commands/evidence/index.ts
 function root(opts) {
-  return path36.resolve(opts.cwd ?? process.cwd());
+  return path37.resolve(opts.cwd ?? process.cwd());
 }
 function slug(name) {
   return name.trim().toLowerCase().replace(/[^a-z0-9]+/g, "-").replace(/^-+|-+$/g, "") || "product";
@@ -11388,7 +11469,7 @@ var releaseCmd = new Command("release").description("Freeze a shipped release in
   const release = await buildRelease({
     productId: product.id,
     version,
-    from: path36.resolve(rootDir, opts.from),
+    from: path37.resolve(rootDir, opts.from),
     shipDate: opts.shipDate,
     buildId: opts.buildId,
     artefactDigest: opts.digest,
@@ -11396,7 +11477,7 @@ var releaseCmd = new Command("release").description("Freeze a shipped release in
     frozenAt: nowIso()
   });
   const p = await freezeRelease(rootDir, release);
-  console.log(chalk7.green("\u2714") + ` froze ${chalk7.bold(`${product.id}@${version}`)} \u2014 ${release.components.length} components, immutable at ${path36.relative(rootDir, p)}`);
+  console.log(chalk7.green("\u2714") + ` froze ${chalk7.bold(`${product.id}@${version}`)} \u2014 ${release.components.length} components, immutable at ${path37.relative(rootDir, p)}`);
 });
 async function runExposure(rootDir, vuln, opts) {
   const org = await loadOrg(rootDir);
@@ -11448,7 +11529,7 @@ var exposureCmd = new Command("exposure").description("Which shipped products co
     console.log("\n" + buildPack(result, regime, org, stage));
   }
   if (opts.bundle) {
-    const dir = path36.resolve(rootDir, opts.bundle, `evidence-${result.meta.evidenceId}`);
+    const dir = path37.resolve(rootDir, opts.bundle, `evidence-${result.meta.evidenceId}`);
     let envelope;
     if (opts.sign !== false) {
       const { key: key2, minted } = resolveSigningKey(rootDir);
@@ -11456,7 +11537,7 @@ var exposureCmd = new Command("exposure").description("Which shipped products co
       envelope = signEvidenceStatement(buildEvidenceStatement(result, VERSION), key2);
     }
     writeBundle({ outDir: dir, result, advisory, releases, regime, envelope, timestampToken, cliVersion: VERSION });
-    console.error(chalk7.green("\u2714") + ` evidence bundle written to ${path36.relative(rootDir, dir)}${envelope ? " (signed)" : " (unsigned)"}${timestampToken ? " \xB7 RFC 3161" : ""}`);
+    console.error(chalk7.green("\u2714") + ` evidence bundle written to ${path37.relative(rootDir, dir)}${envelope ? " (signed)" : " (unsigned)"}${timestampToken ? " \xB7 RFC 3161" : ""}`);
   }
   process.exitCode = exposureExit(result.overallStatus);
 });
@@ -11488,7 +11569,7 @@ var packCmd = new Command("pack").description("Build the submission pack a human
   const stage = opts.stage ?? regime.clocks[0]?.stage ?? "early-warning";
   const md = buildPack(result, regime, org, stage);
   if (opts.out) {
-    fs8.writeFileSync(path36.resolve(rootDir, opts.out), md);
+    fs8.writeFileSync(path37.resolve(rootDir, opts.out), md);
     console.error(chalk7.green("\u2714") + ` pack written to ${opts.out}`);
   } else {
     console.log(md);
@@ -11530,18 +11611,18 @@ var drillCmd = new Command("drill").description("Timed dry-run of the determinat
   }
 });
 var verifyCmd = new Command("verify").description("Verify an evidence bundle offline (no Vibgrate needed)").argument("<bundle>", "Path to an evidence bundle directory or evidence.intoto.jsonl").option("--pub <file>", "Public key PEM to pin the signer (establish trust)").action((bundlePath, opts) => {
-  const abs = path36.resolve(bundlePath);
-  const envPath = fs8.statSync(abs).isDirectory() ? path36.join(abs, "evidence.intoto.jsonl") : abs;
+  const abs = path37.resolve(bundlePath);
+  const envPath = fs8.statSync(abs).isDirectory() ? path37.join(abs, "evidence.intoto.jsonl") : abs;
   if (!fs8.existsSync(envPath)) throw new CliError(`no evidence.intoto.jsonl at ${bundlePath}`, ExitCode.NOT_FOUND);
   const envelope = JSON.parse(fs8.readFileSync(envPath, "utf8").trim().split("\n")[0]);
-  const resultPath = path36.join(path36.dirname(envPath), "result.json");
+  const resultPath = path37.join(path37.dirname(envPath), "result.json");
   const result = fs8.existsSync(resultPath) ? JSON.parse(fs8.readFileSync(resultPath, "utf8")) : void 0;
-  const publicKeyPem = opts.pub ? fs8.readFileSync(path36.resolve(opts.pub), "utf8") : void 0;
+  const publicKeyPem = opts.pub ? fs8.readFileSync(path37.resolve(opts.pub), "utf8") : void 0;
   const v = verifyEvidenceEnvelope(envelope, { publicKeyPem, result });
   const color = v.status === "verified" ? chalk7.green : v.status === "failed" ? chalk7.red : chalk7.yellow;
   console.log("  " + color(v.status.toUpperCase()) + `  ${v.reason}`);
   if (v.evidenceId) console.log("  " + chalk7.dim(`evidence ${v.evidenceId} \xB7 regime ${v.regime} \xB7 advisory ${v.advisoryId} \xB7 ${v.overallStatus}`));
-  const tsrPath = path36.join(path36.dirname(envPath), "timestamp.tsr");
+  const tsrPath = path37.join(path37.dirname(envPath), "timestamp.tsr");
   if (fs8.existsSync(tsrPath) && result) {
     const t = verifyTimestamp(fs8.readFileSync(tsrPath), exposureSubjectDigest(result));
     const tcolor = t.imprintMatches ? chalk7.green : chalk7.red;
@@ -11610,12 +11691,12 @@ var exportCmd = new Command("export").description("Air-gap bundle of all evidenc
   const releases = [];
   for (const list of releasesByProduct.values()) releases.push(...list);
   const report = computeReadiness({ regime, org, products, releasesByProduct, recentDrill: await hasRecentDrill(rootDir, today()) });
-  const dir = path36.resolve(rootDir, opts.out);
-  await writeJsonFile(path36.join(dir, "org.json"), org);
-  await writeJsonFile(path36.join(dir, "products.json"), products);
-  for (const r of releases) await writeJsonFile(path36.join(dir, "releases", `${r.productId}@${r.version}.json`.replace(/[^A-Za-z0-9._@-]/g, "_")), r);
-  await writeJsonFile(path36.join(dir, "readiness.json"), report);
-  console.error(chalk7.green("\u2714") + ` exported evidence state to ${path36.relative(rootDir, dir)} (${products.length} products, ${releases.length} frozen releases)`);
+  const dir = path37.resolve(rootDir, opts.out);
+  await writeJsonFile(path37.join(dir, "org.json"), org);
+  await writeJsonFile(path37.join(dir, "products.json"), products);
+  for (const r of releases) await writeJsonFile(path37.join(dir, "releases", `${r.productId}@${r.version}.json`.replace(/[^A-Za-z0-9._@-]/g, "_")), r);
+  await writeJsonFile(path37.join(dir, "readiness.json"), report);
+  console.error(chalk7.green("\u2714") + ` exported evidence state to ${path37.relative(rootDir, dir)} (${products.length} products, ${releases.length} frozen releases)`);
 });
 var pushCmd = new Command("push").description("Push the product registry (and an optional exposure result) to Vibgrate Cloud").option(...cwdOption).option("--dsn <dsn>", "DSN token (or use VIBGRATE_DSN env / `vg login`)").option("--regime <id>", "Reporting regime").option("--result <file>", "An exposure result.json (or a bundle dir) to include").option("--signed", "Mark the included exposure result as signed").option("--strict", "Fail on push errors").action(async (opts) => {
   const rootDir = root(opts);
@@ -11641,8 +11722,8 @@ var pushCmd = new Command("push").description("Push the product registry (and an
   }));
   let exposure;
   if (opts.result) {
-    const raw = path36.resolve(rootDir, opts.result);
-    const resultPath = fs8.existsSync(raw) && fs8.statSync(raw).isDirectory() ? path36.join(raw, "result.json") : raw;
+    const raw = path37.resolve(rootDir, opts.result);
+    const resultPath = fs8.existsSync(raw) && fs8.statSync(raw).isDirectory() ? path37.join(raw, "result.json") : raw;
     if (!fs8.existsSync(resultPath)) throw new CliError(`no result.json at ${opts.result}`, ExitCode.NOT_FOUND);
     exposure = JSON.parse(fs8.readFileSync(resultPath, "utf8"));
   }
@@ -11708,6 +11789,7 @@ var KNOWN_COMMANDS = /* @__PURE__ */ new Set([
   "install",
   "uninstall",
   "share",
+  "watch",
   "help",
   // Drift-reporting verbs (merged from the Vibgrate CLI).
   "init",
@@ -11748,6 +11830,7 @@ ${aliasNote}Docs: https://vibgrate.com/help`;
   registerLsp(program);
   registerInstall(program);
   registerShare(program);
+  registerWatch(program);
   registerTests(program);
   registerFacts(program);
   registerGuide(program);
@@ -11832,7 +11915,7 @@ function dispatch(argv, cwd) {
   }
   const looksLikeQuestion = /\s/.test(first) || first.endsWith("?");
   if (looksLikeQuestion) return ["ask", ...args];
-  if (fs8.existsSync(path36.resolve(cwd, first))) {
+  if (fs8.existsSync(path37.resolve(cwd, first))) {
     return [hasBuildOnlyFlag(args) ? "build" : "scan", ...args];
   }
   const moved = MOVED_COMMANDS[first];
@@ -11877,9 +11960,9 @@ async function main(argv = process.argv) {
 }
 function readCwd(raw) {
   const i = raw.findIndex((a) => a === "-C" || a === "--cwd");
-  if (i >= 0 && raw[i + 1]) return path36.resolve(raw[i + 1]);
+  if (i >= 0 && raw[i + 1]) return path37.resolve(raw[i + 1]);
   const eq = raw.find((a) => a.startsWith("--cwd="));
-  if (eq) return path36.resolve(eq.slice("--cwd=".length));
+  if (eq) return path37.resolve(eq.slice("--cwd=".length));
   return process.cwd();
 }
 function handleError(err) {