@vibgrate/cli 2026.728.3 → 2026.728.5

package/dist/chunk-VBVY733D.js

@@ -0,0 +1,2184 @@
+import { searchSymbols, resolveVersion, resolveLib, loadCatalog, driftFor, localPackageDocs, readDoc, inventory, localApiSurface } from './chunk-G4HTI4ZM.js';
+import { loadConfig, computeUpgradeImpact, getChangelogSignals, gitHistoryAvailable, buildVersionTimelines, findPackageTimeline, severityRank, projectTypeToVulnEcosystem } from './chunk-4JD63RUR.js';
+import { writeTextFile, pathExists, readJsonFile } from './chunk-CRAMOEBE.js';
+import { resolveOne } from './chunk-J7LKEB2R.js';
+import { impactOf, indexFor, withTimeout, getNodeEmbeddings, queryGraphSemantic, queryGraph, loadEmbedder, isModelReady } from './chunk-EETK7S43.js';
+import { discoverModels } from './chunk-CQDUBAQY.js';
+import { cacheDir } from './chunk-ZKNB4YH4.js';
+import { bidirectional } from 'graphology-shortest-path/unweighted.js';
+import Graph from 'graphology';
+import * as fs from 'fs';
+import * as path4 from 'path';
+import * as crypto from 'crypto';
+import { createHash } from 'crypto';
+import { Command } from 'commander';
+import chalk from 'chalk';
+import * as os from 'os';
+import * as zlib from 'zlib';
+import { promisify } from 'util';
+import { encode, decode } from 'gpt-tokenizer/encoding/cl100k_base';
+
+// src/grounding/pack.ts
+var FREE_PACK = {
+  id: "vibgrate-free",
+  version: "2026.06",
+  license: "CC-BY (standards summaries) + Apache-2.0 (own content)",
+  entries: [
+    {
+      id: "owasp-a01-access-control",
+      topic: "access-control",
+      summary: "Enforce authorization on every request server-side; deny by default and check the user\u2019s role and ownership, not just authentication.",
+      citation: { title: "OWASP Top 10 2021 A01: Broken Access Control", url: "https://owasp.org/Top10/A01_2021-Broken_Access_Control/" },
+      kind: "should_follow",
+      rationale: "recommended",
+      match: {
+        keywords: ["auth", "authorize", "authorization", "permission", "role", "access", "acl", "rbac", "tenant"],
+        imports: ["casl", "accesscontrol", "next-auth"]
+      }
+    },
+    {
+      id: "owasp-a07-auth-failures",
+      topic: "authentication",
+      summary: "Use vetted auth libraries, hash passwords with a strong adaptive function, rate-limit logins, and keep sessions short and rotated.",
+      citation: { title: "OWASP Top 10 2021 A07: Identification & Authentication Failures", url: "https://owasp.org/Top10/A07_2021-Identification_and_Authentication_Failures/" },
+      kind: "should_follow",
+      rationale: "recommended",
+      match: {
+        keywords: ["login", "authenticate", "signin", "session", "jwt", "password", "credential"],
+        imports: ["passport", "jsonwebtoken", "bcrypt", "argon2", "next-auth", "lucia"]
+      }
+    },
+    {
+      id: "owasp-a02-crypto-failures",
+      topic: "cryptography",
+      summary: "Prefer well-reviewed primitives; never roll your own crypto; use authenticated encryption and a strong KDF; never hardcode keys.",
+      citation: { title: "OWASP Top 10 2021 A02: Cryptographic Failures", url: "https://owasp.org/Top10/A02_2021-Cryptographic_Failures/" },
+      kind: "should_follow",
+      rationale: "recommended",
+      match: { keywords: ["encrypt", "decrypt", "cipher", "hash", "hmac", "crypto", "sign", "verify"], imports: ["crypto", "bcrypt", "argon2", "node:crypto", "tweetnacl"], calls: ["createCipheriv", "createHash", "randomBytes"] }
+    },
+    {
+      id: "owasp-a03-injection",
+      topic: "input-validation",
+      summary: "Validate and parameterize all untrusted input; use parameterized queries and schema validation rather than string concatenation.",
+      citation: { title: "OWASP Top 10 2021 A03: Injection", url: "https://owasp.org/Top10/A03_2021-Injection/" },
+      kind: "should_follow",
+      rationale: "recommended",
+      match: { keywords: ["validate", "sanitize", "escape", "schema", "parse"], imports: ["zod", "joi", "yup", "ajv", "validator", "class-validator"] }
+    },
+    {
+      id: "cwe-89-sql-injection",
+      topic: "sql-injection",
+      summary: "Use parameterized queries / prepared statements or a query builder; never build SQL by concatenating user input.",
+      citation: { title: "CWE-89: SQL Injection", url: "https://cwe.mitre.org/data/definitions/89.html" },
+      kind: "relevant_to",
+      rationale: "recommended",
+      match: { keywords: ["sql", "query", "where", "select"], imports: ["pg", "mysql", "mysql2", "sqlite3", "better-sqlite3", "knex", "sequelize", "typeorm", "prisma", "drizzle"], calls: ["query", "execute", "raw"] }
+    },
+    {
+      id: "cwe-798-hardcoded-credentials",
+      topic: "secrets",
+      summary: "Do not embed secrets/API keys/passwords in source; load them from a secrets manager or environment and keep them out of version control.",
+      citation: { title: "CWE-798: Use of Hard-coded Credentials", url: "https://cwe.mitre.org/data/definitions/798.html" },
+      kind: "smells_like",
+      rationale: "conjectured",
+      match: { keywords: ["secret", "apikey", "apikeys", "token", "credential", "password", "privatekey"] }
+    },
+    {
+      id: "cwe-502-deserialization",
+      topic: "deserialization",
+      summary: "Avoid deserializing untrusted data and never eval it; prefer safe parsers and explicit schemas.",
+      citation: { title: "CWE-502: Deserialization of Untrusted Data", url: "https://cwe.mitre.org/data/definitions/502.html" },
+      kind: "smells_like",
+      rationale: "conjectured",
+      match: { keywords: ["deserialize", "unserialize", "eval"], calls: ["eval", "Function", "deserialize"] }
+    },
+    {
+      id: "owasp-a10-ssrf",
+      topic: "ssrf",
+      summary: "Validate and allowlist outbound URLs built from user input to prevent server-side request forgery.",
+      citation: { title: "OWASP Top 10 2021 A10: Server-Side Request Forgery", url: "https://owasp.org/Top10/A10_2021-Server-Side_Request_Forgery_%28SSRF%29/" },
+      kind: "relevant_to",
+      rationale: "recommended",
+      match: { keywords: ["fetch", "request", "webhook", "proxy"], imports: ["axios", "node-fetch", "got", "undici", "superagent"], calls: ["fetch", "request", "get", "post"] }
+    },
+    {
+      id: "owasp-a09-logging",
+      topic: "logging",
+      summary: "Log security-relevant events with enough context to detect and investigate, but never log secrets or PII.",
+      citation: { title: "OWASP Top 10 2021 A09: Security Logging & Monitoring Failures", url: "https://owasp.org/Top10/A09_2021-Security_Logging_and_Monitoring_Failures/" },
+      kind: "relevant_to",
+      rationale: "recommended",
+      match: { keywords: ["log", "logger", "audit", "trace"], imports: ["winston", "pino", "bunyan", "log4js"] }
+    }
+  ]
+};
+function buildGraphologyGraph(nodes, edges) {
+  const g = new Graph({ type: "directed", multi: true, allowSelfLoops: true });
+  for (const n of nodes) {
+    g.addNode(n.id, { kind: n.kind, name: n.name });
+  }
+  for (const e of edges) {
+    if (!g.hasNode(e.src) || !g.hasNode(e.dst)) continue;
+    if (g.hasEdge(e.id)) continue;
+    g.addDirectedEdgeWithKey(e.id, e.src, e.dst, { kind: e.kind, weight: e.confidence });
+  }
+  return g;
+}
+
+// src/engine/paths.ts
+function shortestPath(graph, srcId, dstId) {
+  const g = buildGraphologyGraph(graph.nodes, graph.edges);
+  if (!g.hasNode(srcId) || !g.hasNode(dstId)) return null;
+  const forward = bidirectional(g, srcId, dstId);
+  if (forward) return { ids: forward, direction: "forward" };
+  const reverse = bidirectional(g, dstId, srcId);
+  if (reverse) return { ids: reverse.slice().reverse(), direction: "reverse" };
+  return null;
+}
+var NEIGHBOR_CAP = 6;
+function pathDisconnect(graph, srcId, dstId) {
+  const idx = indexFor(graph);
+  const from = neighborhood(idx, srcId);
+  const to = neighborhood(idx, dstId);
+  const hint = from.calls.length || from.calledBy.length || to.calls.length || to.calledBy.length ? "No direct call/import chain links these symbols. Try `vg show` / `vg impact` on each end, or path via a shared hub." : "Neither endpoint has call/import neighbors in the map \u2014 they may be isolated docs/externals, or the link needs a more precise build.";
+  return { connected: false, from, to, hint };
+}
+function neighborhood(idx, id) {
+  const node = idx.node(id);
+  const name = node?.qualifiedName ?? id;
+  const calls = uniqueNames(idx.callees(id).map((x) => x.node.qualifiedName));
+  const calledBy = uniqueNames(idx.callers(id).map((x) => x.node.qualifiedName));
+  const imports = uniqueNames(
+    idx.out(id, "import").map((e) => idx.node(e.dst)?.qualifiedName).filter((n) => !!n)
+  );
+  const importedBy = uniqueNames(
+    idx.in(id, "import").map((e) => idx.node(e.src)?.qualifiedName).filter((n) => !!n)
+  );
+  return { name, calls, calledBy, imports, importedBy };
+}
+function uniqueNames(names) {
+  return [...new Set(names)].sort((a, b) => a.localeCompare(b)).slice(0, NEIGHBOR_CAP);
+}
+function coveringTests(graph, node, index) {
+  const idx = index ?? indexFor(graph);
+  const byId = idx.nodeById;
+  const out = /* @__PURE__ */ new Map();
+  for (const e of idx.in(node.id, "test")) {
+    const testNode = byId.get(e.src);
+    if (!testNode) continue;
+    out.set(testNode.file, { file: testNode.file, basis: "call", confidence: e.confidence });
+  }
+  if (typeof node.coverage === "number" && node.coverage > 0 && out.size === 0) {
+    out.set("(coverage)", { file: "(coverage report)", basis: "coverage", confidence: node.coverage });
+  }
+  return [...out.values()].sort((a, b) => b.confidence - a.confidence || a.file.localeCompare(b.file));
+}
+function testsToRun(graph, rootId, depth = 4) {
+  const idx = indexFor(graph);
+  const impact = impactOf(graph, rootId, { depth });
+  const affectedIds = /* @__PURE__ */ new Set([rootId, ...impact.affected.map((a) => a.id)]);
+  const testFiles = /* @__PURE__ */ new Set();
+  const untested = [];
+  for (const id of affectedIds) {
+    const node = idx.node(id);
+    if (!node) continue;
+    const covers = coveringTests(graph, node, idx).filter((c) => c.basis === "call");
+    for (const c of covers) testFiles.add(c.file);
+    if ((node.kind === "function" || node.kind === "method") && node.tested === false) {
+      untested.push({ id: node.id, name: node.qualifiedName, file: node.file });
+    }
+  }
+  return {
+    affectedTestFiles: [...testFiles].sort(),
+    untestedAffected: untested.sort((a, b) => a.name.localeCompare(b.name))
+  };
+}
+function detectRunner(root, lang) {
+  const pkgPath = path4.join(root, "package.json");
+  if (fs.existsSync(pkgPath)) {
+    try {
+      const pkg = JSON.parse(fs.readFileSync(pkgPath, "utf8"));
+      const deps = { ...pkg.dependencies, ...pkg.devDependencies };
+      if (deps.vitest) return { name: "vitest", command: (f) => `npx vitest run ${f.join(" ")}`.trim() };
+      if (deps.jest) return { name: "jest", command: (f) => `npx jest ${f.join(" ")}`.trim() };
+      if (deps.mocha) return { name: "mocha", command: (f) => `npx mocha ${f.join(" ")}`.trim() };
+    } catch {
+    }
+  }
+  if (lang === "py" || fs.existsSync(path4.join(root, "pyproject.toml")) || fs.existsSync(path4.join(root, "pytest.ini"))) {
+    return { name: "pytest", command: (f) => `pytest ${f.join(" ")}`.trim() };
+  }
+  if (lang === "go" || fs.existsSync(path4.join(root, "go.mod"))) {
+    return { name: "go test", command: () => "go test ./..." };
+  }
+  if (lang === "cs" || hasFile(root, /\.csproj$/) || hasFile(root, /\.sln$/)) {
+    return { name: "dotnet test", command: () => "dotnet test" };
+  }
+  if (lang === "rb") return { name: "rspec", command: (f) => `bundle exec rspec ${f.join(" ")}`.trim() };
+  return { name: "tests", command: (f) => f.length ? f.join(" ") : "(no runner detected)" };
+}
+function hasFile(root, re) {
+  try {
+    return fs.readdirSync(root).some((f) => re.test(f));
+  } catch {
+    return false;
+  }
+}
+function findGitRoot(startDir = process.cwd()) {
+  let dir = path4.resolve(startDir);
+  for (; ; ) {
+    if (fs.existsSync(path4.join(dir, ".git"))) return dir;
+    const parent = path4.dirname(dir);
+    if (parent === dir) return null;
+    dir = parent;
+  }
+}
+function normalizeEntry(line) {
+  return line.trim().replace(/^\.\//, "").replace(/\/+$/, "");
+}
+function ensureGitignored(entry, startDir = process.cwd()) {
+  const root = findGitRoot(startDir);
+  if (!root) return { status: "not-a-repo", entry };
+  const gitignorePath = path4.join(root, ".gitignore");
+  const target = normalizeEntry(entry);
+  let existing = "";
+  let fileExisted = true;
+  try {
+    existing = fs.readFileSync(gitignorePath, "utf8");
+  } catch {
+    fileExisted = false;
+  }
+  const alreadyPresent = existing.split(/\r?\n/).some((line) => normalizeEntry(line) === target);
+  if (alreadyPresent) return { status: "present", entry, gitignorePath };
+  const needsLeadingNewline = existing.length > 0 && !existing.endsWith("\n");
+  fs.appendFileSync(gitignorePath, `${needsLeadingNewline ? "\n" : ""}${entry}
+`, "utf8");
+  return { status: fileExisted ? "added" : "created", entry, gitignorePath };
+}
+
+// src/reporting/regions.ts
+var REGIONS = [
+  {
+    id: "us",
+    label: "United States",
+    ingestHost: "us.ingest.vibgrate.com",
+    dashHost: "dash.vibgrate.com",
+    available: true
+  },
+  {
+    id: "eu",
+    label: "European Union",
+    ingestHost: "eu.ingest.vibgrate.com",
+    dashHost: "dash.vibgrate.eu",
+    available: true
+  },
+  {
+    id: "apac",
+    label: "Asia-Pacific (coming soon)",
+    ingestHost: "apac.ingest.vibgrate.com",
+    dashHost: "dash.vibgrate.com",
+    available: false
+  }
+];
+var DEFAULT_REGION = "us";
+function availableRegionIds() {
+  return REGIONS.filter((r) => r.available).map((r) => r.id);
+}
+function findRegion(id) {
+  return REGIONS.find((r) => r.id === id);
+}
+function resolveIngestHost(region, ingest) {
+  if (ingest) {
+    try {
+      return new URL(ingest).host;
+    } catch {
+      throw new Error(`Invalid ingest URL: ${ingest}`);
+    }
+  }
+  const id = (region ?? DEFAULT_REGION).toLowerCase();
+  const match = findRegion(id);
+  if (!match) {
+    throw new Error(`Unknown region "${id}". Supported: ${availableRegionIds().join(", ")}`);
+  }
+  if (!match.available) {
+    throw new Error(`Region "${id}" (${match.label}) is not yet available. Supported: ${availableRegionIds().join(", ")}`);
+  }
+  return match.ingestHost;
+}
+function dashHostForIngestHost(ingestHost) {
+  const match = REGIONS.find((r) => r.ingestHost === ingestHost);
+  return match?.dashHost ?? "dash.vibgrate.com";
+}
+function ingestHostForRegionId(region) {
+  return findRegion(region.toLowerCase())?.ingestHost;
+}
+
+// src/reporting/commands/dsn.ts
+function generateKeyMaterial() {
+  return {
+    keyId: crypto.randomBytes(12).toString("hex"),
+    secret: crypto.randomBytes(32).toString("hex")
+  };
+}
+function buildDsn(keyId, secret, ingestHost, workspaceId) {
+  return `vibgrate+https://${keyId}:${secret}@${ingestHost}/${workspaceId}`;
+}
+async function provisionDsn(keyId, secret, workspaceId, ingestHost, region) {
+  const url = `https://${ingestHost}/v1/provision`;
+  try {
+    const response = await fetch(url, {
+      method: "POST",
+      headers: {
+        "Content-Type": "application/json",
+        "Connection": "close"
+        // Prevent keep-alive delays on exit
+      },
+      // Pin the workspace to the selected region. The API rejects the request
+      // if `region` doesn't match the endpoint host (residency guard). For a
+      // custom --ingest host we omit it and let the API derive it from the host.
+      body: JSON.stringify(region ? { keyId, secret, workspaceId, region } : { keyId, secret, workspaceId })
+    });
+    if (!response.ok) {
+      const result = await response.json();
+      return { success: false, error: result.error || `HTTP ${response.status}` };
+    }
+    return { success: true };
+  } catch (e) {
+    return { success: false, error: e instanceof Error ? e.message : String(e) };
+  }
+}
+async function createWorkspaceDsn(opts) {
+  const ingestHost = resolveIngestHost(opts.region, opts.ingest);
+  const { keyId, secret } = generateKeyMaterial();
+  const workspaceId = crypto.randomBytes(8).toString("hex");
+  const region = opts.ingest ? void 0 : (opts.region ?? "us").toLowerCase();
+  const result = await provisionDsn(keyId, secret, workspaceId, ingestHost, region);
+  if (!result.success) {
+    throw new Error(`Failed to provision workspace: ${result.error}`);
+  }
+  return { dsn: buildDsn(keyId, secret, ingestHost, workspaceId), keyId, workspaceId, ingestHost, region };
+}
+var dsnCommand = new Command("dsn").description("Manage DSN tokens");
+dsnCommand.command("create").description("Create a new DSN token").option("--ingest <url>", "Ingest API URL (overrides --region)").option("--region <region>", `Data residency region (${availableRegionIds().join(", ")})`, "us").requiredOption("--workspace <id>", 'Workspace ID (use "new" to auto-generate)').option("--write <path>", "Write DSN to file").action(async (opts) => {
+  const keyId = crypto.randomBytes(12).toString("hex");
+  const secret = crypto.randomBytes(32).toString("hex");
+  let ingestHost;
+  try {
+    ingestHost = resolveIngestHost(opts.region, opts.ingest);
+  } catch (e) {
+    console.error(chalk.red(e instanceof Error ? e.message : String(e)));
+    process.exit(1);
+  }
+  let workspaceId = opts.workspace;
+  const isNewWorkspace = opts.workspace.toLowerCase() === "new";
+  if (isNewWorkspace) {
+    workspaceId = crypto.randomBytes(8).toString("hex");
+    console.log(chalk.dim(`Provisioning new workspace ${workspaceId}...`));
+  }
+  const region = opts.ingest ? void 0 : opts.region.toLowerCase();
+  if (isNewWorkspace) {
+    const result = await provisionDsn(keyId, secret, workspaceId, ingestHost, region);
+    if (!result.success) {
+      console.error(chalk.red(`Failed to provision DSN: ${result.error}`));
+      process.exit(1);
+    }
+  }
+  const dsn = buildDsn(keyId, secret, ingestHost, workspaceId);
+  console.log(chalk.green("\u2714") + " DSN created");
+  console.log("");
+  console.log(chalk.bold("Region:"));
+  console.log(`  ${region ?? "custom"} (${ingestHost})`);
+  console.log("");
+  console.log(chalk.bold("DSN:"));
+  console.log(`  ${dsn}`);
+  console.log("");
+  console.log(chalk.bold("Key ID:"));
+  console.log(`  ${keyId}`);
+  if (isNewWorkspace) {
+    console.log("");
+    console.log(chalk.bold("Workspace ID:"));
+    console.log(`  ${workspaceId}`);
+  }
+  console.log("");
+  console.log(chalk.dim("Set this as VIBGRATE_DSN in your CI environment."));
+  if (!isNewWorkspace) {
+    console.log(chalk.dim("The secret must be registered on your Vibgrate ingest API."));
+  }
+  if (opts.write) {
+    const writePath = path4.resolve(opts.write);
+    await writeTextFile(writePath, dsn + "\n");
+    console.log("");
+    console.log(chalk.green("\u2714") + ` DSN written to ${opts.write}`);
+    const root = findGitRoot(path4.dirname(writePath));
+    const rel = root ? path4.relative(root, writePath).split(path4.sep).join("/") : "";
+    if (root && rel && !rel.startsWith("..")) {
+      const res = ensureGitignored(rel, path4.dirname(writePath));
+      if (res.status === "created") {
+        console.log(chalk.green("\u2714") + ` Created .gitignore and ignored ${rel}`);
+      } else if (res.status === "added") {
+        console.log(chalk.green("\u2714") + ` Added ${rel} to .gitignore`);
+      } else if (res.status === "present") {
+        console.log(chalk.dim(`  ${rel} is already in .gitignore`));
+      }
+    } else {
+      console.log(
+        chalk.yellow("\u26A0") + " Add this file to .gitignore to keep the DSN out of version control."
+      );
+    }
+  }
+});
+var STORE_DIRNAME = ".vibgrate";
+var STORE_FILENAME = "credentials.json";
+function homeCredentialsPath() {
+  return path4.join(os.homedir(), STORE_DIRNAME, STORE_FILENAME);
+}
+function projectCredentialsPath(cwd = process.cwd()) {
+  const root = findGitRoot(cwd) ?? cwd;
+  return path4.join(root, STORE_DIRNAME, STORE_FILENAME);
+}
+function credentialsPath(opts = {}) {
+  const override = process.env.VIBGRATE_CREDENTIALS?.trim();
+  if (override) return path4.resolve(override);
+  const local = projectCredentialsPath(opts.cwd);
+  if (opts.local) return local;
+  if (fs.existsSync(local)) return local;
+  return homeCredentialsPath();
+}
+function gitignoreEntryForCredentials(repoRoot, credsFile = credentialsPath()) {
+  const rel = path4.relative(repoRoot, credsFile);
+  if (rel && !rel.startsWith("..") && !path4.isAbsolute(rel)) {
+    return rel.split(path4.sep).join("/");
+  }
+  return `${STORE_DIRNAME}/${STORE_FILENAME}`;
+}
+function readStoredCredentials(opts = {}) {
+  try {
+    const raw = fs.readFileSync(credentialsPath(opts), "utf8");
+    const parsed = JSON.parse(raw);
+    return parsed && typeof parsed.dsn === "string" && parsed.dsn ? parsed : null;
+  } catch {
+    return null;
+  }
+}
+function writeStoredCredentials(creds, opts = {}) {
+  const file = credentialsPath(opts);
+  fs.mkdirSync(path4.dirname(file), { recursive: true });
+  fs.writeFileSync(file, JSON.stringify(creds, null, 2) + "\n", { encoding: "utf8", mode: 384 });
+  try {
+    fs.chmodSync(file, 384);
+  } catch {
+  }
+}
+function clearStoredCredentials(opts = {}) {
+  try {
+    fs.rmSync(credentialsPath(opts));
+    return true;
+  } catch {
+    return false;
+  }
+}
+function resolveDsn(explicitDsn) {
+  if (explicitDsn) return explicitDsn;
+  if (process.env.VIBGRATE_DSN) return process.env.VIBGRATE_DSN;
+  return readStoredCredentials()?.dsn ?? void 0;
+}
+
+// src/reporting/utils/compact-evidence.ts
+var CATEGORY_PATTERNS = [
+  { category: "pricing", pattern: /price|pricing|billing|subscri|trial|credit|plan|tier|upgrade|premium|pro|enterprise/i },
+  { category: "auth", pattern: /sign[- ]?in|sign[- ]?up|log[- ]?in|log[- ]?out|auth|sso|oauth|password|register|invite|onboard/i },
+  { category: "dashboard", pattern: /dashboard|overview|home|main|summary|stats/i },
+  { category: "settings", pattern: /setting|config|preference|option|profile|account/i },
+  { category: "users", pattern: /user|member|team|role|permission|access|admin|owner/i },
+  { category: "integrations", pattern: /integrat|connect|webhook|api[- ]?key|sync|import|export/i },
+  { category: "reports", pattern: /report|analy|metric|chart|graph|insight|track/i },
+  { category: "workflows", pattern: /workflow|automat|schedule|trigger|action|job|task|pipeline/i },
+  { category: "projects", pattern: /project|workspace|organization|folder|repo/i },
+  { category: "navigation", pattern: /menu|nav|sidebar|header|footer|breadcrumb/i }
+];
+function compactUiPurpose(result, maxSamplesPerCategory = 3) {
+  const evidence = result.topEvidence;
+  const dependencies = evidence.filter((e) => e.kind === "dependency").map((e) => e.value).slice(0, 10);
+  const routes = dedupeRoutes(
+    evidence.filter((e) => e.kind === "route").map((e) => e.value)
+  ).slice(0, 15);
+  const textEvidence = evidence.filter(
+    (e) => e.kind !== "dependency" && e.kind !== "route" && e.kind !== "feature_flag"
+  );
+  const byCategory = /* @__PURE__ */ new Map();
+  const categoryCounts = {};
+  for (const item of textEvidence) {
+    const category = categorize(item.value);
+    if (!byCategory.has(category)) {
+      byCategory.set(category, /* @__PURE__ */ new Set());
+    }
+    const normalized = normalizeValue(item.value);
+    if (normalized.length >= 3) {
+      byCategory.get(category).add(normalized);
+    }
+  }
+  const samples = [];
+  for (const [category, values] of byCategory) {
+    const deduped = dedupeStrings([...values]);
+    categoryCounts[category] = deduped.length;
+    for (const value of deduped.slice(0, maxSamplesPerCategory)) {
+      samples.push({ kind: "text", value, category });
+    }
+  }
+  const featureFlags = evidence.filter((e) => e.kind === "feature_flag");
+  if (featureFlags.length > 0) {
+    categoryCounts["feature_flags"] = featureFlags.length;
+    samples.push({ kind: "feature_flag", value: "feature flags detected", category: "feature_flags" });
+  }
+  return {
+    samples,
+    categoryCounts,
+    originalCount: evidence.length,
+    dependencies,
+    routes,
+    detectedFrameworks: result.detectedFrameworks
+  };
+}
+function categorize(value) {
+  for (const { category, pattern } of CATEGORY_PATTERNS) {
+    if (pattern.test(value)) return category;
+  }
+  return "general";
+}
+function normalizeValue(value) {
+  return value.toLowerCase().replace(/[^a-z0-9\s-]/g, " ").replace(/\s+/g, " ").trim().slice(0, 60);
+}
+function dedupeStrings(values) {
+  const sorted = values.sort((a, b) => b.length - a.length);
+  const kept = [];
+  for (const value of sorted) {
+    const isDupe = kept.some((k) => {
+      const stem = value.slice(0, 6);
+      return k.startsWith(stem) || k.includes(value) || value.includes(k);
+    });
+    if (!isDupe) {
+      kept.push(value);
+    }
+  }
+  return kept;
+}
+function dedupeRoutes(routes) {
+  const seen = /* @__PURE__ */ new Set();
+  const result = [];
+  for (const route of routes) {
+    const normalized = route.replace(/:[a-z_]+/gi, ":param").replace(/\[\[*\.*\.*[a-z_]+\]*\]/gi, ":param").replace(/\/+$/, "").toLowerCase();
+    if (!seen.has(normalized)) {
+      seen.add(normalized);
+      result.push(route);
+    }
+  }
+  return result;
+}
+
+// src/reporting/utils/compact-artifact.ts
+var gzip2 = promisify(zlib.gzip);
+var MAX_ITEMS = 50;
+var MAX_DB_MODELS = 300;
+var MAX_DB_FIELDS_PER_MODEL = 100;
+var MAX_DB_MODEL_FILES = 5;
+var MAX_DB_FILES_SCANNED = 500;
+var DB_UPLOAD_HARD_CEILING = {
+  maxModels: 2e3,
+  maxFieldsPerModel: 500,
+  maxFilesPerModel: 20,
+  maxFilesScanned: 5e3
+};
+function clampCap(configured, fallback, ceiling) {
+  if (typeof configured !== "number" || !Number.isFinite(configured) || configured <= 0) return fallback;
+  return Math.min(Math.floor(configured), ceiling);
+}
+function extractName(entry) {
+  const match = entry.match(/^(.+?)\s*\(/);
+  return match ? match[1].trim() : entry.trim();
+}
+function compactDataStores(result) {
+  return {
+    databaseTechnologies: result.databaseTechnologies.slice(0, 10),
+    connectionStrings: [],
+    // Don't include connection strings in upload
+    connectionPoolSettings: result.connectionPoolSettings.slice(0, MAX_ITEMS),
+    replicationSettings: result.replicationSettings.slice(0, 20),
+    readReplicaSettings: result.readReplicaSettings.slice(0, 20),
+    failoverSettings: result.failoverSettings.slice(0, 20),
+    collationAndEncoding: result.collationAndEncoding.slice(0, 20),
+    queryTimeoutDefaults: result.queryTimeoutDefaults.slice(0, 20),
+    manualIndexes: result.manualIndexes.map(extractName).slice(0, MAX_ITEMS),
+    tables: result.tables.map(extractName).slice(0, MAX_ITEMS),
+    views: result.views.map(extractName).slice(0, MAX_ITEMS),
+    storedProcedures: result.storedProcedures.map(extractName).slice(0, MAX_ITEMS),
+    triggers: result.triggers.map(extractName).slice(0, MAX_ITEMS),
+    rowLevelSecurityPolicies: result.rowLevelSecurityPolicies.slice(0, 20),
+    otherServices: result.otherServices.slice(0, 20)
+  };
+}
+function compactApiSurface(result) {
+  const seenProviders = /* @__PURE__ */ new Set();
+  const uniqueIntegrations = result.integrations.filter((i) => {
+    const domain = i.provider.split(":")[0];
+    if (seenProviders.has(domain)) return false;
+    seenProviders.add(domain);
+    return true;
+  }).slice(0, MAX_ITEMS).map((i) => ({
+    provider: i.provider,
+    endpoint: "",
+    // Don't include full endpoints
+    version: i.version,
+    parameters: [],
+    // Don't include params
+    configOptions: [],
+    authHints: [],
+    files: []
+    // Don't include file paths
+  }));
+  return {
+    integrations: uniqueIntegrations,
+    openApiSpecifications: result.openApiSpecifications.slice(0, 10),
+    webhookUrls: result.webhookUrls.slice(0, 20),
+    callbackEndpoints: result.callbackEndpoints.slice(0, 20),
+    apiVersionPins: result.apiVersionPins.slice(0, 20),
+    tokenExpirationPolicies: result.tokenExpirationPolicies.slice(0, 20),
+    rateLimitOverrides: result.rateLimitOverrides.slice(0, 20),
+    customHeaders: result.customHeaders.slice(0, 20),
+    corsPolicies: result.corsPolicies.slice(0, 20),
+    oauthScopes: result.oauthScopes.slice(0, 20),
+    apiTokens: []
+    // Don't include token references
+  };
+}
+function compactAssetBranding(result) {
+  return {
+    faviconFiles: result.faviconFiles.slice(0, 1),
+    productLogos: []
+    // Don't include logos
+  };
+}
+function compactDatabaseSchema(result, caps) {
+  const maxModels = clampCap(caps?.maxModels, MAX_DB_MODELS, DB_UPLOAD_HARD_CEILING.maxModels);
+  const maxFieldsPerModel = clampCap(caps?.maxFieldsPerModel, MAX_DB_FIELDS_PER_MODEL, DB_UPLOAD_HARD_CEILING.maxFieldsPerModel);
+  const maxFilesPerModel = clampCap(caps?.maxFilesPerModel, MAX_DB_MODEL_FILES, DB_UPLOAD_HARD_CEILING.maxFilesPerModel);
+  const maxFilesScanned = clampCap(caps?.maxFilesScanned, MAX_DB_FILES_SCANNED, DB_UPLOAD_HARD_CEILING.maxFilesScanned);
+  return {
+    providers: result.providers.slice(0, MAX_ITEMS),
+    models: result.models.slice(0, maxModels).map((model) => ({
+      ...model,
+      fields: model.fields.slice(0, maxFieldsPerModel),
+      files: model.files.slice(0, maxFilesPerModel)
+    })),
+    enums: result.enums.slice(0, MAX_ITEMS),
+    filesScanned: result.filesScanned.slice(0, maxFilesScanned),
+    projects: result.projects.slice(0, MAX_ITEMS).map((project) => ({
+      project: project.project,
+      filesScanned: project.filesScanned.slice(0, MAX_ITEMS),
+      models: project.models.slice(0, MAX_ITEMS),
+      enums: project.enums.slice(0, MAX_ITEMS)
+    }))
+  };
+}
+function prepareArtifactForUpload(artifact, opts) {
+  const compacted = { ...artifact };
+  if (compacted.extended) {
+    const ext = { ...compacted.extended };
+    if (ext.dataStores) {
+      ext.dataStores = compactDataStores(ext.dataStores);
+    }
+    if (ext.apiSurface) {
+      ext.apiSurface = compactApiSurface(ext.apiSurface);
+    }
+    if (ext.assetBranding) {
+      ext.assetBranding = compactAssetBranding(ext.assetBranding);
+    }
+    if (ext.uiPurpose) {
+      const compactedUi = compactUiPurpose(ext.uiPurpose);
+      ext.uiPurpose = {
+        enabled: ext.uiPurpose.enabled,
+        detectedFrameworks: compactedUi.detectedFrameworks,
+        evidenceCount: compactedUi.originalCount,
+        capped: ext.uiPurpose.capped,
+        topEvidence: [],
+        // Clear full evidence
+        unknownSignals: [],
+        // Add compacted data under extended properties
+        ...{ compacted: compactedUi }
+      };
+    }
+    if (ext.runtimeConfiguration) {
+      ext.runtimeConfiguration = {
+        ...ext.runtimeConfiguration,
+        environmentVariables: ext.runtimeConfiguration.environmentVariables.slice(0, 100),
+        hiddenConfigFiles: ext.runtimeConfiguration.hiddenConfigFiles.slice(0, MAX_ITEMS),
+        startupArguments: ext.runtimeConfiguration.startupArguments.slice(0, 100)
+      };
+    }
+    if (ext.operationalResilience) {
+      const ops = ext.operationalResilience;
+      ext.operationalResilience = {
+        implicitTimeouts: ops.implicitTimeouts.slice(0, 30),
+        defaultPaginationSize: ops.defaultPaginationSize.slice(0, 30),
+        implicitRetryLogic: ops.implicitRetryLogic.slice(0, 30),
+        defaultLocale: ops.defaultLocale.slice(0, 20),
+        defaultCurrency: ops.defaultCurrency.slice(0, 20),
+        implicitTimezone: ops.implicitTimezone.slice(0, 20),
+        defaultCharacterEncoding: ops.defaultCharacterEncoding.slice(0, 20),
+        sessionStores: ops.sessionStores.slice(0, 20),
+        distributedLocks: ops.distributedLocks.slice(0, 20),
+        jobSchedulers: ops.jobSchedulers.slice(0, 30),
+        idempotencyKeys: ops.idempotencyKeys.slice(0, 20),
+        rateLimitingCounters: ops.rateLimitingCounters.slice(0, 20),
+        circuitBreakerState: ops.circuitBreakerState.slice(0, 20),
+        abTestToggles: ops.abTestToggles.slice(0, 20),
+        regionalEnablementRules: ops.regionalEnablementRules.slice(0, 20),
+        betaAccessGroups: ops.betaAccessGroups.slice(0, 20),
+        licensingEnforcementLogic: ops.licensingEnforcementLogic.slice(0, 20),
+        killSwitches: ops.killSwitches.slice(0, 20),
+        connectorRetryLogic: ops.connectorRetryLogic.slice(0, 20),
+        apiPollingIntervals: ops.apiPollingIntervals.slice(0, 20),
+        fieldMappings: ops.fieldMappings.slice(0, 20),
+        schemaRegistryRules: ops.schemaRegistryRules.slice(0, 20),
+        deadLetterQueueBehavior: ops.deadLetterQueueBehavior.slice(0, 20),
+        dataMaskingRules: ops.dataMaskingRules.slice(0, 20),
+        transformationLogic: ops.transformationLogic.slice(0, 20),
+        timezoneHandling: ops.timezoneHandling.slice(0, 20),
+        encryptionSettings: ops.encryptionSettings.slice(0, 30),
+        hardcodedSecretSignals: ops.hardcodedSecretSignals.slice(0, 20)
+      };
+    }
+    if (ext.dependencyGraph) {
+      ext.dependencyGraph = {
+        ...ext.dependencyGraph,
+        phantomDependencies: ext.dependencyGraph.phantomDependencies.slice(0, MAX_ITEMS),
+        phantomDependencyDetails: ext.dependencyGraph.phantomDependencyDetails?.slice(0, MAX_ITEMS),
+        duplicatedPackages: ext.dependencyGraph.duplicatedPackages.slice(0, MAX_ITEMS)
+      };
+    }
+    if (ext.databaseSchema) {
+      ext.databaseSchema = compactDatabaseSchema(ext.databaseSchema, opts?.databaseSchemaCaps);
+    }
+    compacted.extended = ext;
+  }
+  return compacted;
+}
+async function compressArtifact(artifact) {
+  const json = JSON.stringify(artifact);
+  return gzip2(json, { level: 9 });
+}
+async function prepareCompressedUpload(artifact, opts) {
+  const compacted = prepareArtifactForUpload(artifact, opts);
+  const compressed = await compressArtifact(compacted);
+  return { body: compressed, contentEncoding: "gzip" };
+}
+function postOnce(input, host) {
+  const url = input.force ? `${input.scheme}://${host}/v1/ingest/scan?force=1` : `${input.scheme}://${host}/v1/ingest/scan`;
+  return fetch(url, {
+    method: "POST",
+    headers: {
+      "Content-Type": "application/json",
+      "Content-Encoding": input.contentEncoding,
+      "X-Vibgrate-Timestamp": input.timestamp,
+      "Authorization": `VibgrateDSN ${input.keyId}:${input.secret}`,
+      "Connection": "close",
+      // Prevent keep-alive delays on exit
+      ...input.runId && input.runToken ? { "X-Vibgrate-Run-Id": input.runId, "X-Vibgrate-Run-Token": input.runToken } : {}
+    },
+    body: input.body
+  });
+}
+async function regionRedirectHost(response) {
+  try {
+    const payload = await response.clone().json();
+    if (payload?.code !== "REGION_MISMATCH" || !payload.region) return void 0;
+    return ingestHostForRegionId(payload.region);
+  } catch {
+    return void 0;
+  }
+}
+async function uploadScanArtifact(input) {
+  let host = input.host;
+  let response = await postOnce(input, host);
+  if (response.status === 409) {
+    const target = await regionRedirectHost(response);
+    if (target && target !== host) {
+      console.log(
+        chalk.yellow(
+          `\u21BB Workspace is pinned to a different region \u2014 retrying upload to ${target}...`
+        )
+      );
+      host = target;
+      response = await postOnce(input, host);
+    }
+  }
+  return { response, host };
+}
+
+// src/reporting/commands/push.ts
+function parseDsn(dsn) {
+  const cleaned = dsn.replace(/[\x00-\x1F\x7F\uFEFF\u200B-\u200D\u2060]/g, "").trim();
+  const match = cleaned.match(/^vibgrate\+(https?):?\/\/([^:]+):([^@]+)@([^/]+)\/(.+)$/);
+  if (!match) return null;
+  return {
+    scheme: match[1],
+    keyId: match[2],
+    secret: match[3],
+    host: match[4],
+    workspaceId: match[5]
+  };
+}
+var pushCommand = new Command("push").description("Push scan results to Vibgrate API").option("--dsn <dsn>", "DSN token (or use VIBGRATE_DSN env)").option("--region <region>", `Override data residency region (${availableRegionIds().join(", ")})`).option("--file <file>", "Scan artifact file", ".vibgrate/scan_result.json").option("--strict", "Fail on upload errors").action(async (opts) => {
+  const dsn = resolveDsn(opts.dsn);
+  if (!dsn) {
+    console.error(chalk.red("No DSN provided."));
+    console.error(chalk.dim('Run "vibgrate login", set VIBGRATE_DSN, or use the --dsn flag.'));
+    if (opts.strict) process.exit(1);
+    return;
+  }
+  const parsed = parseDsn(dsn);
+  if (!parsed) {
+    console.error(chalk.red("Invalid DSN format."));
+    console.error(chalk.dim("Expected: vibgrate+https://<key_id>:<secret>@<host>/<workspace_id>"));
+    if (opts.strict) process.exit(1);
+    return;
+  }
+  const filePath = path4.resolve(opts.file);
+  if (!await pathExists(filePath)) {
+    console.error(chalk.red(`Scan artifact not found: ${filePath}`));
+    console.error(chalk.dim('Run "vibgrate scan" first.'));
+    if (opts.strict) process.exit(1);
+    return;
+  }
+  const artifact = await readJsonFile(filePath);
+  const config = await loadConfig(process.cwd());
+  const databaseSchemaCaps = config.scanners !== false ? config.scanners?.databaseSchema : void 0;
+  const { body, contentEncoding } = await prepareCompressedUpload(artifact, { databaseSchemaCaps });
+  const timestamp = String(Date.now());
+  let host = parsed.host;
+  if (opts.region) {
+    try {
+      host = resolveIngestHost(opts.region);
+    } catch (e) {
+      console.error(chalk.red(e instanceof Error ? e.message : String(e)));
+      if (opts.strict) process.exit(1);
+      return;
+    }
+  }
+  const originalSize = JSON.stringify(artifact).length;
+  const compressedSize = body.length;
+  const ratio = ((1 - compressedSize / originalSize) * 100).toFixed(0);
+  console.log(chalk.dim(`Uploading to ${host}... (${(compressedSize / 1024).toFixed(0)} KB, ${ratio}% smaller)`));
+  try {
+    const { response, host: uploadedHost } = await uploadScanArtifact({
+      scheme: parsed.scheme,
+      host,
+      keyId: parsed.keyId,
+      secret: parsed.secret,
+      body,
+      contentEncoding,
+      timestamp,
+      // Set only by an automated caller running the scan on the workspace's
+      // behalf (e.g. a Vibgrate-hosted remediation run) — never a customer flag.
+      runId: process.env.VIBGRATE_SCAN_RUN_ID,
+      runToken: process.env.VIBGRATE_SCAN_RUN_TOKEN
+    });
+    host = uploadedHost;
+    if (!response.ok) {
+      const text = await response.text();
+      throw new Error(`HTTP ${response.status}: ${text}`);
+    }
+    const result = await response.json();
+    console.log(chalk.green("\u2714") + ` Scan queued for processing (${result.ingestId ?? "ok"})`);
+    console.log();
+    console.log(chalk.dim("Processing continues in the background. Results available shortly."));
+    console.log();
+    if (result.ingestId) {
+      const dashHost = dashHostForIngestHost(host);
+      const reportUrl = `https://${dashHost}/${parsed.workspaceId}/scan/${result.ingestId}`;
+      console.log(chalk.dim("View report: ") + chalk.underline(reportUrl));
+    }
+  } catch (e) {
+    const msg = e instanceof Error ? e.message : String(e);
+    console.error(chalk.red(`Upload failed: ${msg}`));
+    if (opts.strict) process.exit(1);
+  }
+});
+function readScanArtifact(root) {
+  try {
+    const file = path4.join(root, ".vibgrate", "scan_result.json");
+    return JSON.parse(fs.readFileSync(file, "utf8"));
+  } catch {
+    return null;
+  }
+}
+function loadVulnerabilities(root) {
+  return readScanArtifact(root)?.extended?.vulnerabilities ?? null;
+}
+function resolvePackageTarget(root, pkg) {
+  const artifact = readScanArtifact(root);
+  for (const project of artifact?.projects ?? []) {
+    const dep = project.dependencies?.find((d) => d.package === pkg);
+    if (dep) {
+      return {
+        ecosystem: projectTypeToVulnEcosystem(project.type) ?? "unknown",
+        currentVersion: dep.resolvedVersion,
+        latestVersion: dep.latestStable,
+        majorsBehind: dep.majorsBehind
+      };
+    }
+  }
+  const rec = inventory(root).records.find((r) => r.name === pkg);
+  if (rec) {
+    const ecosystem = rec.ecosystem === "npm" ? "npm" : rec.ecosystem === "pypi" ? "pypi" : "unknown";
+    return { ecosystem, currentVersion: rec.installed ?? null, latestVersion: rec.latest ?? null, majorsBehind: null };
+  }
+  return { ecosystem: "unknown", currentVersion: null, latestVersion: null, majorsBehind: null };
+}
+function openFixableAdvisories(root, pkg) {
+  const vulns = loadVulnerabilities(root);
+  const match = vulns?.packages.find((p) => p.package === pkg);
+  return (match?.advisories ?? []).filter((a) => a.fixedVersions.length).map((a) => a.id);
+}
+function filterBySeverity(result, minSeverity) {
+  if (!minSeverity || minSeverity === "unknown") return result;
+  const floor = severityRank(minSeverity);
+  const packages = result.packages.map((p) => ({ ...p, advisories: p.advisories.filter((a) => severityRank(a.severity) >= floor) })).filter((p) => p.advisories.length > 0);
+  const totalAdvisories = packages.reduce((n, p) => n + p.advisories.length, 0);
+  return { ...result, packages, totalAdvisories };
+}
+
+// src/mcp/attribution.ts
+var MCP_MAX_COMMITS = 300;
+var ECOSYSTEM_MAP = {
+  npm: "npm",
+  pypi: "pypi",
+  go: "go",
+  rust: "cargo",
+  ruby: "rubygems",
+  php: "composer",
+  dotnet: "nuget",
+  dart: "pub"
+  // swift (no advisory ecosystem) and java (no resolved lockfile) have no timeline.
+};
+function brief(commit) {
+  return { sha: commit.shortSha, author: commit.authorName, date: commit.date, subject: commit.subject };
+}
+async function attributedInventory(root, opts = {}) {
+  const inv = inventory(root);
+  if (!opts.attribute) return { ...inv, attribution: "off" };
+  if (!await gitHistoryAvailable(root)) return { ...inv, attribution: "unavailable" };
+  const timelines = await buildVersionTimelines(root, { maxCommits: MCP_MAX_COMMITS });
+  if (!timelines) return { ...inv, attribution: "unavailable" };
+  const records = inv.records.map((r) => {
+    const ecosystem = ECOSYSTEM_MAP[r.ecosystem];
+    if (!ecosystem) return r;
+    const pt = findPackageTimeline(timelines, ecosystem, r.name);
+    if (!pt || !pt.changes.length) return r;
+    return {
+      ...r,
+      addedBy: brief(pt.changes[0].commit),
+      currentVersionBy: brief(pt.changes[pt.changes.length - 1].commit)
+    };
+  });
+  return { ...inv, records, attribution: "git" };
+}
+function countTokens(text) {
+  return encode(text).length;
+}
+function truncateToTokens(text, budget, marker = "\n\u2026(truncated)") {
+  if (!Number.isFinite(budget) || budget <= 0) return { text, truncated: false, tokens: countTokens(text) };
+  const tokens = encode(text);
+  if (tokens.length <= budget) return { text, truncated: false, tokens: tokens.length };
+  const markerTokens = encode(marker).length;
+  const keep = Math.max(0, budget - markerTokens);
+  let slice = decode(tokens.slice(0, keep));
+  const lastNl = slice.lastIndexOf("\n");
+  if (lastNl > 0) slice = slice.slice(0, lastNl);
+  const out = slice + marker;
+  return { text: out, truncated: true, tokens: countTokens(out) };
+}
+
+// src/engine/selection-weights.ts
+var DEFAULT_SELECTION_WEIGHTS = {
+  headingUsage: 4,
+  headingPreamble: -6,
+  hasCode: 3,
+  codeDensity: 0.5,
+  queryOverlap: 5,
+  symbolMatch: 2,
+  position: -0.1,
+  linkDensity: -3
+};
+
+// src/engine/select.ts
+var STOPWORDS = /* @__PURE__ */ new Set(["the", "a", "an", "to", "of", "in", "for", "and", "or", "is", "how", "do", "i", "use", "using", "with", "on", "my"]);
+var USAGE_RE = /\b(usage|example|examples|quick ?start|getting started|api|guide|how to|reference|tutorial|basic)\b/i;
+var PREAMBLE_RE = /\b(install|installation|license|licence|contributing|contributors?|sponsors?|table of contents|toc|changelog|funding|code of conduct|security|acknowledge)\b/i;
+function splitSections(md) {
+  const out = [];
+  let cur = { heading: "", level: 0};
+  let buf = [];
+  const flush = () => {
+    const body = buf.join("\n").trim();
+    if (cur.heading || body) out.push({ heading: cur.heading, level: cur.level, body });
+    buf = [];
+  };
+  for (const line of md.split("\n")) {
+    const h = /^(#{1,6})\s+(.*\S)\s*$/.exec(line);
+    if (h) {
+      flush();
+      cur = { heading: h[2].trim(), level: h[1].length, body: "" };
+    } else {
+      buf.push(line);
+    }
+  }
+  flush();
+  return out;
+}
+function chunkBody(body) {
+  const chunks = [];
+  let cur = [];
+  let inFence = false;
+  const flush = () => {
+    const c = cur.join("\n").trim();
+    if (c) chunks.push(c);
+    cur = [];
+  };
+  for (const line of body.split("\n")) {
+    if (/^\s*```/.test(line)) inFence = !inFence;
+    if (!inFence && line.trim() === "") {
+      flush();
+      continue;
+    }
+    cur.push(line);
+  }
+  flush();
+  return chunks;
+}
+function stripNoise(body) {
+  return body.split("\n").filter((l) => !/^\s*(?:!\[[^\]]*\]\([^)]*\)\s*)+$/.test(l)).join("\n").trim();
+}
+function tokenizeQuery(q) {
+  if (!q) return [];
+  return [...new Set(q.toLowerCase().split(/[^a-z0-9]+/).filter((w) => w.length > 1 && !STOPWORDS.has(w)))];
+}
+function symbolsFromApi(api) {
+  if (!api) return [];
+  const out = /* @__PURE__ */ new Set();
+  const re = /\b(?:function|class|interface|type|const|enum|namespace)\s+([A-Za-z_$][\w$]*)/g;
+  let m;
+  while (m = re.exec(api)) out.add(m[1]);
+  return [...out];
+}
+function scoreSection(s, idx, queryTerms, symbols, w) {
+  const text = `${s.heading}
+${s.body}`.toLowerCase();
+  let score = 0;
+  if (USAGE_RE.test(s.heading)) score += w.headingUsage;
+  if (PREAMBLE_RE.test(s.heading)) score += w.headingPreamble;
+  const codeBlocks = Math.floor((s.body.match(/```/g) ?? []).length / 2);
+  if (codeBlocks > 0) score += w.hasCode + Math.min(codeBlocks, 5) * w.codeDensity;
+  for (const t of queryTerms) if (text.includes(t)) score += w.queryOverlap;
+  for (const sym of symbols) if (sym.length > 2 && text.includes(sym.toLowerCase())) score += w.symbolMatch;
+  score += idx * w.position;
+  const links = (s.body.match(/\]\(|https?:\/\//g) ?? []).length;
+  const lineCount = Math.max(1, s.body.split("\n").filter((l) => l.trim()).length);
+  if (links / lineCount > 0.5) score += w.linkDensity;
+  return score;
+}
+var apiBlock = (api) => api ? `## API (types)
+
+\`\`\`ts
+${api}
+\`\`\`` : "";
+function selectForBudget(input) {
+  const w = input.weights ?? DEFAULT_SELECTION_WEIGHTS;
+  const api = apiBlock(input.apiSurface);
+  const readme = input.readme.trim();
+  if (!input.budget || !Number.isFinite(input.budget)) {
+    const full2 = [readme, api].filter(Boolean).join("\n\n");
+    return { text: full2, tokens: countTokens(full2), truncated: false };
+  }
+  const budget = input.budget;
+  const queryTerms = tokenizeQuery(input.query);
+  const symbols = symbolsFromApi(input.apiSurface);
+  const render = (s) => {
+    const body = stripNoise(s.body);
+    if (!body) return "";
+    return `${s.heading ? `## ${s.heading}
+` : ""}${body}`.trim();
+  };
+  const sections = splitSections(readme).filter((s) => !PREAMBLE_RE.test(s.heading));
+  const full = [api, ...sections.map(render)].filter(Boolean).join("\n\n").trim();
+  if (countTokens(full) <= budget) {
+    return { text: full, tokens: countTokens(full), truncated: false };
+  }
+  const units = [];
+  for (const s of sections) {
+    if (countTokens(s.body) > budget) {
+      chunkBody(s.body).forEach((p, i) => units.push({ heading: i === 0 ? s.heading : "", level: s.level, body: p }));
+    } else {
+      units.push(s);
+    }
+  }
+  const ranked = units.map((s, idx) => ({ s, idx, score: scoreSection(s, idx, queryTerms, symbols, w) })).sort((a, b) => b.score - a.score || a.idx - b.idx);
+  const out = [];
+  let used = 0;
+  const add = (chunk) => {
+    const t = countTokens(chunk);
+    if (used + t <= budget) {
+      out.push(chunk);
+      used += t;
+      return true;
+    }
+    return false;
+  };
+  if (api && !add(api) && used < budget) {
+    out.push(truncateToTokens(api, budget - used).text);
+    used = budget;
+  }
+  const picked = [];
+  for (const { s, idx } of ranked) {
+    const chunk = render(s);
+    if (!chunk) continue;
+    if (used + countTokens(`
+${chunk}`) <= budget) {
+      picked.push(idx);
+      used += countTokens(`
+${chunk}`);
+    }
+  }
+  picked.sort((a, b) => a - b);
+  for (const idx of picked) out.push(render(units[idx]));
+  if (used < budget - 20) {
+    const next = ranked.find((r) => !picked.includes(r.idx) && render(r.s));
+    if (next) {
+      const head = truncateToTokens(render(next.s), budget - used).text;
+      if (head.trim()) out.push(head);
+    }
+  }
+  const text = out.join("\n\n").trim();
+  return { text, tokens: countTokens(text), truncated: true };
+}
+
+// src/engine/quality.ts
+var IDENT_RE = /^(?:[A-Za-z][a-z0-9]*[A-Z][A-Za-z0-9]*|[a-z][a-z0-9]*(?:_[a-z0-9]+)+|[a-z][a-z0-9]*(?:-[a-z0-9]+)+)$/;
+function identifierTerms(query) {
+  if (!query) return [];
+  const raw = [...new Set(query.split(/[^A-Za-z0-9_-]+/).filter((w) => w.length > 2))];
+  return raw.filter((t) => IDENT_RE.test(t) || t.length >= 6 && /[A-Z]/.test(t) && /[a-z]/.test(t));
+}
+function assessDocQuality(content, opts = {}) {
+  const minTokens = opts.minTokens ?? 60;
+  const lc = content.toLowerCase();
+  const reasons = [];
+  let score = 0;
+  const hasCode = /```/.test(content) || /(^|\n)( {4}|\t)\S/.test(content);
+  if (hasCode) score += 2;
+  else reasons.push("no code example");
+  const tokens = countTokens(content);
+  if (tokens >= minTokens) score += 1;
+  else reasons.push(`thin (${tokens} tokens)`);
+  const bareName = opts.name?.toLowerCase().replace(/^@[^/]+\//, "");
+  if (bareName && bareName.length > 1) {
+    if (lc.includes(bareName)) score += 1;
+    else reasons.push("library name absent");
+  }
+  const qt = tokenizeQuery(opts.query);
+  const idents = identifierTerms(opts.query);
+  let onTopic = qt.length === 0;
+  if (qt.length) {
+    const missingIdents = idents.filter((id) => !lc.includes(id.toLowerCase()));
+    if (missingIdents.length) {
+      reasons.push(`API symbol(s) absent: ${missingIdents.join(", ")}`);
+      onTopic = false;
+    } else {
+      const hits = qt.filter((t) => lc.includes(t)).length;
+      const need = Math.max(1, Math.floor(qt.length / 2) + 1);
+      if (hits >= need) {
+        score += Math.min(hits, 2);
+        onTopic = true;
+      } else {
+        reasons.push(hits === 0 ? "query terms absent" : `query terms weak (${hits}/${qt.length})`);
+        onTopic = false;
+      }
+    }
+  }
+  if (opts.symbols?.length) {
+    if (opts.symbols.some((s) => s.length > 2 && lc.includes(s.toLowerCase()))) score += 1;
+    else reasons.push("no API symbols present");
+  }
+  if (opts.readmeOnly && (idents.length > 0 || qt.length >= 2)) {
+    onTopic = false;
+    if (!reasons.includes("README-only source cannot answer a focused API query")) {
+      reasons.push("README-only source cannot answer a focused API query");
+    }
+    score = Math.min(score, 4);
+  }
+  const sufficient = hasCode && tokens >= minTokens && onTopic;
+  return { score, sufficient, reasons };
+}
+
+// src/engine/hosted.ts
+function hostedBase(opts = {}) {
+  const explicit = opts.base || process.env.VIBGRATE_LIB_HOST;
+  if (explicit) return explicit.replace(/\/+$/, "");
+  let host;
+  try {
+    host = resolveIngestHost(opts.region, opts.ingest);
+  } catch {
+    host = "us.ingest.vibgrate.com";
+  }
+  return `https://${host}`;
+}
+async function fetchHostedDocs(req, opts = {}) {
+  const f = opts.fetchImpl ?? globalThis.fetch;
+  if (!f) return null;
+  const url = `${hostedBase(opts)}/v1/lib/docs`;
+  const ctrl = new AbortController();
+  const timer = setTimeout(() => ctrl.abort(), opts.timeoutMs ?? 4e3);
+  const headers = { "content-type": "application/json" };
+  if (opts.auth) {
+    headers["Authorization"] = `VibgrateDSN ${opts.auth.keyId}:${opts.auth.secret}`;
+    headers["X-Vibgrate-Timestamp"] = String(Date.now());
+  }
+  try {
+    const res = await f(url, {
+      method: "POST",
+      headers,
+      body: JSON.stringify({
+        name: req.name,
+        targetId: req.targetId,
+        query: req.query,
+        verbosity: req.verbosity,
+        max_tokens: req.maxTokens
+      }),
+      signal: ctrl.signal
+    });
+    if (!res.ok) return null;
+    const data = await res.json();
+    const content = typeof data.content === "string" ? data.content : typeof data.docs === "string" ? data.docs : "";
+    if (!content.trim()) return null;
+    return {
+      content,
+      version: typeof data.version === "string" ? data.version : null,
+      source: "hosted",
+      metadata: data.metadata ?? void 0
+    };
+  } catch {
+    return null;
+  } finally {
+    clearTimeout(timer);
+  }
+}
+async function publishPrivateLibrary(req, opts = {}) {
+  const f = opts.fetchImpl ?? globalThis.fetch;
+  if (!f) return { ok: false, status: 0, message: "no network available" };
+  if (!opts.auth) return { ok: false, status: 401, message: "a DSN is required to publish a private library (run `vibgrate login` or set VIBGRATE_DSN)" };
+  const url = `${hostedBase(opts)}/v1/lib/private`;
+  const ctrl = new AbortController();
+  const timer = setTimeout(() => ctrl.abort(), opts.timeoutMs ?? 15e3);
+  try {
+    const res = await f(url, {
+      method: "POST",
+      headers: {
+        "content-type": "application/json",
+        Authorization: `VibgrateDSN ${opts.auth.keyId}:${opts.auth.secret}`,
+        "X-Vibgrate-Timestamp": String(Date.now())
+      },
+      body: JSON.stringify({
+        name: req.name,
+        version: req.version,
+        readme: req.readme,
+        dts: req.dts,
+        compliance: req.compliance,
+        language: req.language,
+        sourceUrl: req.sourceUrl
+      }),
+      signal: ctrl.signal
+    });
+    const data = await res.json().catch(() => ({}));
+    if (!res.ok) return { ok: false, status: res.status, error: typeof data.error === "string" ? data.error : void 0, message: typeof data.message === "string" ? data.message : void 0 };
+    return {
+      ok: true,
+      targetId: String(data.targetId ?? ""),
+      ecosystem: String(data.ecosystem ?? ""),
+      entities: Number(data.entities) || 0,
+      indexedTokens: Number(data.indexedTokens) || 0
+    };
+  } catch (err) {
+    return { ok: false, status: 0, message: err instanceof Error ? err.message : "request failed" };
+  } finally {
+    clearTimeout(timer);
+  }
+}
+
+// src/engine/hosted-cache.ts
+var CACHE_VERSION = "vg-hosted-docs/1";
+var HOSTED_DOCS_TTL_MS = 24 * 60 * 60 * 1e3;
+var MAX_ENTRIES = 64;
+function cachePath(root) {
+  return path4.join(cacheDir(root), "hosted-docs.json");
+}
+function hostedDocsCacheKey(req, opts = {}) {
+  const material = JSON.stringify([
+    req.name ?? "",
+    req.targetId ?? "",
+    req.query ?? "",
+    req.verbosity ?? "",
+    req.maxTokens ?? 0,
+    hostedBase(opts),
+    opts.auth?.keyId ?? "anon"
+  ]);
+  return createHash("sha256").update(material).digest("hex");
+}
+function loadFile(root) {
+  try {
+    const parsed = JSON.parse(fs.readFileSync(cachePath(root), "utf8"));
+    if (parsed && parsed.version === CACHE_VERSION && parsed.entries && typeof parsed.entries === "object") return parsed;
+  } catch {
+  }
+  return { version: CACHE_VERSION, entries: {} };
+}
+function saveFile(root, file) {
+  try {
+    const keys = Object.keys(file.entries);
+    if (keys.length > MAX_ENTRIES) {
+      for (const k of keys.sort((a, b) => file.entries[a].at - file.entries[b].at).slice(0, keys.length - MAX_ENTRIES)) {
+        delete file.entries[k];
+      }
+    }
+    fs.mkdirSync(cacheDir(root), { recursive: true });
+    fs.writeFileSync(cachePath(root), JSON.stringify(file));
+  } catch {
+  }
+}
+async function fetchHostedDocsCached(root, req, opts = {}) {
+  const now = opts.now ?? Date.now;
+  const ttl = opts.ttlMs ?? HOSTED_DOCS_TTL_MS;
+  const key = hostedDocsCacheKey(req, opts);
+  const file = loadFile(root);
+  if (!opts.bypass) {
+    const hit = file.entries[key];
+    if (hit && now() - hit.at < ttl && hit.result?.content) {
+      return { ...hit.result, metadata: { ...hit.result.metadata ?? {}, cached: true } };
+    }
+  }
+  const result = await fetchHostedDocs(req, opts);
+  if (result) {
+    file.entries[key] = { at: now(), result };
+    saveFile(root, file);
+  }
+  return result;
+}
+
+// src/mcp/response.ts
+var MAX_RESULT_TOKENS = 25e3;
+function renderToolResult(result, maxTokens = MAX_RESULT_TOKENS) {
+  return toolResult(clampToBudget(compactResult(result), maxTokens));
+}
+function toolResult(result) {
+  return {
+    content: [{ type: "text", text: JSON.stringify(result) }],
+    structuredContent: asStructured(result)
+  };
+}
+function compactResult(value) {
+  return prune(value);
+}
+function prune(v) {
+  if (Array.isArray(v)) return v.map(prune);
+  if (v && typeof v === "object") {
+    const out = {};
+    for (const [k, raw] of Object.entries(v)) {
+      const pv = prune(raw);
+      if (!isEmpty(pv)) out[k] = pv;
+    }
+    return out;
+  }
+  return v;
+}
+function isEmpty(v) {
+  if (v === null || v === void 0 || v === "") return true;
+  if (Array.isArray(v)) return v.length === 0;
+  if (typeof v === "object") return Object.keys(v).length === 0;
+  return false;
+}
+function clampToBudget(value, maxTokens = MAX_RESULT_TOKENS) {
+  if (!value || typeof value !== "object" || Array.isArray(value)) return value;
+  if (tokensOf(value) <= maxTokens) return value;
+  const obj2 = { ...value };
+  const truncated = {};
+  for (let guard = 0; guard < 64 && tokensOf(obj2) > maxTokens; guard++) {
+    const arrays = Object.entries(obj2).filter(
+      (e) => Array.isArray(e[1]) && e[1].length > 0
+    );
+    if (arrays.length === 0) break;
+    arrays.sort((a, b) => tokensOf(b[1]) - tokensOf(a[1]));
+    const [field, arr] = arrays[0];
+    const total = truncated[field]?.total ?? arr.length;
+    const shown = Math.max(1, Math.floor(arr.length / 2));
+    obj2[field] = arr.slice(0, shown);
+    truncated[field] = { shown, total };
+  }
+  if (Object.keys(truncated).length) obj2._truncated = truncated;
+  return obj2;
+}
+function tokensOf(v) {
+  return countTokens(JSON.stringify(v));
+}
+function asStructured(result) {
+  if (result && typeof result === "object" && !Array.isArray(result)) {
+    return result;
+  }
+  return { result };
+}
+function boundList(items, max) {
+  if (!Number.isFinite(max) || max < 0 || items.length <= max) {
+    return { items, total: items.length };
+  }
+  return { items: items.slice(0, max), total: items.length };
+}
+var NODE_EDGE_CAP = 50;
+
+// src/mcp/tools.ts
+var warmEmbedder = null;
+var bgWarmStarted = false;
+function warmEmbedderInBackground(local) {
+  if (local || bgWarmStarted || isModelReady()) return;
+  bgWarmStarted = true;
+  loadEmbedder({}).then((e) => {
+    if (e) warmEmbedder = Promise.resolve(e);
+  }).catch(() => {
+    bgWarmStarted = false;
+  });
+}
+function readyEmbedder(local) {
+  if (warmEmbedder) return warmEmbedder;
+  if (local) return warmEmbedder = loadEmbedder({ local, noDownload: true });
+  if (isModelReady()) return warmEmbedder = loadEmbedder({ noDownload: true });
+  warmEmbedderInBackground(local);
+  return Promise.resolve(null);
+}
+async function retrieve(graph, question, budget, ctx) {
+  let mode = "lexical";
+  try {
+    const q = await withTimeout(
+      (async () => {
+        const embedder = await readyEmbedder(ctx.local);
+        if (!embedder) return null;
+        const nodeVectors = await getNodeEmbeddings(graph, embedder, ctx.root);
+        const r = await queryGraphSemantic(graph, question, { budget, embedder, nodeVectors });
+        mode = `semantic (${embedder.id})`;
+        return r;
+      })(),
+      SEMANTIC_BUDGET_MS,
+      "semantic path over budget"
+    );
+    if (q) return { q, mode };
+  } catch {
+  }
+  return { q: queryGraph(graph, question, { budget }), mode: "lexical" };
+}
+var SEMANTIC_BUDGET_MS = (() => {
+  const n = Number(process.env.VG_SEMANTIC_BUDGET_MS);
+  return Number.isFinite(n) && n > 0 ? n : 4e3;
+})();
+var obj = (properties, required = []) => ({
+  type: "object",
+  properties,
+  ...required.length ? { required } : {},
+  additionalProperties: false
+});
+var RESPONSE_FORMAT = { type: "string", enum: ["concise", "detailed"] };
+var isDetailed = (args) => args.response_format === "detailed";
+var CONCISE_MATCHES = 5;
+var EPISTEMIC_TIERS = ["observed", "name-matched", "declared"];
+var EDGE_FILTER_SCHEMA = {
+  min_edge_confidence: { type: "number", description: "0..1 \u2014 drop edges below this confidence" },
+  epistemic: { type: "string", enum: EPISTEMIC_TIERS, description: "keep only edges of this evidence tier" }
+};
+function edgeRecordFilter(args) {
+  const min = numOrU(args.min_edge_confidence);
+  const tier = EPISTEMIC_TIERS.includes(String(args.epistemic)) ? String(args.epistemic) : void 0;
+  if (min == null && !tier) return () => true;
+  return (x) => (min == null || x.edge.confidence >= min) && (!tier || x.edge.epistemic === tier);
+}
+var TOOLS = [
+  {
+    name: "orient",
+    description: "Start here: one call returns the map overview, ranked matches for your question, and the top hit\u2019s blast radius \u2014 replaces summary+query+impact round-trips.",
+    // `query` is a no-description back-compat alias for `question`: the sibling
+    // discovery tools (search_symbols, resolve_library) take `query`, so an agent
+    // naturally reaches for it here too — accepting it turns what was a wasted
+    // "question is required" round-trip into a hit. Neither is `required` (either
+    // satisfies the in-handler check), matching library_docs/resolve_library.
+    inputSchema: obj({
+      question: { type: "string", maxLength: 300 },
+      query: { type: "string", maxLength: 300 },
+      scope: { type: "string", description: "path prefix to orient within" },
+      budget: { type: "number", description: "token budget in detailed mode (default 1500)" },
+      response_format: RESPONSE_FORMAT
+    }),
+    handler: async (graph, args, ctx) => {
+      const question = String(args.question ?? args.query ?? "");
+      if (!question) return { error: "bad_request", message: "question is required" };
+      const budget = numOr(args.budget, 1500);
+      const { q, mode } = await retrieve(graph, question, budget, ctx);
+      const rawScope = String(args.scope ?? "").trim();
+      const scope = rawScope === "." || rawScope === "./" ? "" : rawScope.replace(/^\.\//, "");
+      const scoped = scope ? q.matches.filter((m) => m.node.file.startsWith(scope)) : q.matches;
+      const detailed = isDetailed(args);
+      let topImpact = null;
+      const top = scoped[0]?.node;
+      if (detailed && top) {
+        const r = impactOf(graph, top.id, { depth: 3 });
+        topImpact = { node: top.qualifiedName, direct: r.direct, transitive: r.transitive, affected: r.affected.slice(0, 10).map(stripId) };
+      }
+      const shown = detailed ? scoped : scoped.slice(0, CONCISE_MATCHES);
+      return {
+        // Concise "find X" calls need a one-line map (counts + languages), not the
+        // full topAreas/topHubs blocks — those were ~half of every orient
+        // response's tokens on the hot discovery path and the caller navigates by
+        // `matches`. Detailed keeps the full overview.
+        summary: detailed ? summarize(graph, 10) : conciseSummary(graph),
+        mode,
+        // The fact-annotated context block is detail: concise callers navigate
+        // by the ranked matches and fetch nodes on demand (plan P2).
+        ...detailed ? { context: q.context } : {},
+        matches: shown.map((m) => ({ name: m.node.qualifiedName, kind: m.node.kind, file: m.node.file, line: m.node.span.start, score: m.score })),
+        // A neutral availability flag, not a directive to keep querying: a
+        // retrieval tool that coaches "narrow the question / see more" nudges the
+        // over-navigation that re-bills the whole context on every extra step.
+        ...scoped.length > shown.length ? { moreAvailable: true } : {},
+        ...detailed ? { topImpact } : {}
+      };
+    }
+  },
+  {
+    name: "search_symbols",
+    description: 'Find a known name or literal string fast: ranked symbol lookup, plus a complete literal file-search for any quoted, multi-word, or path-like query (config keys, routes, log lines, UI copy). Quote a single name ("AddJwtBearer") to sweep every occurrence of it as text. A sweep reports totalTextMatches so you know you have every occurrence \u2014 use it instead of grep. Use first for most discovery; use query_graph for meaning.',
+    inputSchema: obj(
+      {
+        query: { type: "string", maxLength: 120, description: "a symbol name, or a literal phrase to sweep for every occurrence of" },
+        limit: { type: "number", description: "default 8, max 50 (raise it to fetch a whole literal sweep in one call)" }
+      },
+      ["query"]
+    ),
+    handler: async (graph, args, ctx) => {
+      const limit = Math.min(50, numOr(args.limit, 8));
+      return searchSymbols(graph, ctx.root, String(args.query ?? ""), limit);
+    }
+  },
+  {
+    name: "query_graph",
+    description: "Find code by meaning when you don\u2019t know the name: symptoms, relationships, what-breaks-if. For a known name or literal string use search_symbols.",
+    // `query` is a no-description back-compat alias for `question` (see orient):
+    // sibling tools take `query`, so accept it here rather than reject the call.
+    inputSchema: obj({
+      question: { type: "string", maxLength: 300 },
+      query: { type: "string", maxLength: 300 },
+      limit: { type: "number", description: "ranked matches to return (default 5)" },
+      offset: { type: "number" },
+      budget: { type: "number", description: "context-block token budget in detailed mode (default 2000)" },
+      response_format: RESPONSE_FORMAT
+    }),
+    handler: async (graph, args, ctx) => {
+      const question = String(args.question ?? args.query ?? "");
+      if (!question) return { mode: "lexical", matches: [], hint: "question (or query) is required" };
+      const budget = numOr(args.budget, 2e3);
+      const { q: r, mode } = await retrieve(graph, question, budget, ctx);
+      if (r.matches.length === 0) {
+        return { mode, matches: [], hint: "no semantic match \u2014 for a known name or literal string use search_symbols; otherwise rephrase around the behaviour you observe" };
+      }
+      const limit = numOr(args.limit, CONCISE_MATCHES);
+      const offset = Math.max(0, numOrU(args.offset) ?? 0);
+      const page = r.matches.slice(offset, offset + limit);
+      return {
+        mode,
+        summary: `${r.matches.length} match${r.matches.length === 1 ? "" : "es"}; top: ${r.matches[0].node.qualifiedName}`,
+        // The fact-annotated context block is detail (plan P2): ranked matches
+        // first, fetch nodes on demand.
+        ...isDetailed(args) ? { context: r.context, tokensEstimate: r.tokensEstimate } : {},
+        matches: page.map((m) => ({ name: m.node.qualifiedName, kind: m.node.kind, file: m.node.file, line: m.node.span.start, score: m.score })),
+        // Neutral pagination fact (nextOffset if the model genuinely needs more),
+        // not a "narrow the question" nudge that invites another discovery round.
+        ...offset + page.length < r.matches.length ? { moreAvailable: true, nextOffset: offset + page.length } : {}
+      };
+    }
+  },
+  {
+    name: "get_node",
+    description: "Inspect one symbol: signature, callers, callees, area. Accepts name, file:line, glob or id.",
+    inputSchema: obj(
+      {
+        name: { type: "string" },
+        pick: { type: "number", description: "nth candidate if ambiguous" },
+        ...EDGE_FILTER_SCHEMA,
+        response_format: RESPONSE_FORMAT
+      },
+      ["name"]
+    ),
+    handler: (graph, args, ctx) => {
+      const { node, candidates } = resolveOne(graph, String(args.name ?? ""), numOrU(args.pick));
+      if (!node) return unresolved(candidates);
+      const index = indexFor(graph);
+      const edgeOk = edgeRecordFilter(args);
+      const calleeRecs = index.callees(node.id).filter(edgeOk);
+      const callerRecs = index.callers(node.id).filter(edgeOk);
+      const base = {
+        name: node.qualifiedName,
+        kind: node.kind,
+        file: node.file,
+        line: node.span.start,
+        signature: node.signature ?? null,
+        importance: node.importance,
+        isHub: node.isHub,
+        area: node.area
+      };
+      if (ctx?.dedup && ctx.seen?.has(node.id)) {
+        return { ...base, repeat: true, callsTotal: uniqueNames2(calleeRecs.map((x) => x.node.qualifiedName)).length, calledByTotal: uniqueNames2(callerRecs.map((x) => x.node.qualifiedName)).length };
+      }
+      const edgeCap = isDetailed(args) ? NODE_EDGE_CAP : CONCISE_MATCHES;
+      const calls = boundList(uniqueNames2(calleeRecs.map((x) => x.node.qualifiedName)), edgeCap);
+      const calledBy = boundList(uniqueNames2(callerRecs.map((x) => x.node.qualifiedName)), edgeCap);
+      ctx?.seen?.add(node.id);
+      return {
+        ...base,
+        calls: calls.items,
+        callsTotal: calls.total,
+        calledBy: calledBy.items,
+        calledByTotal: calledBy.total
+      };
+    }
+  },
+  {
+    name: "find_path",
+    description: "Shortest connection from a to b.",
+    inputSchema: obj(
+      {
+        a: { type: "string" },
+        b: { type: "string" },
+        pick_a: { type: "number" },
+        pick_b: { type: "number" }
+      },
+      ["a", "b"]
+    ),
+    handler: (graph, args) => {
+      const ra = resolveOne(graph, String(args.a ?? ""), numOrU(args.pick_a));
+      const rb = resolveOne(graph, String(args.b ?? ""), numOrU(args.pick_b));
+      if (!ra.node) return { endpoint: "a", ...unresolved(ra.candidates) };
+      if (!rb.node) return { endpoint: "b", ...unresolved(rb.candidates) };
+      const result = shortestPath(graph, ra.node.id, rb.node.id);
+      if (!result) return pathDisconnect(graph, ra.node.id, rb.node.id);
+      const byId = new Map(graph.nodes.map((n) => [n.id, n]));
+      return { connected: true, direction: result.direction, path: result.ids.map((id) => byId.get(id)?.qualifiedName ?? id) };
+    }
+  },
+  {
+    name: "impact_of",
+    description: "Blast radius of a change: what breaks if this symbol changes \u2014 dependents, files, covering tests, risk.",
+    inputSchema: obj(
+      {
+        name: { type: "string" },
+        change_type: { type: "string", enum: ["modify", "delete", "rename", "add_dependency"] },
+        depth: { type: "number", description: "default 4" },
+        pick: { type: "number", description: "nth candidate if ambiguous" },
+        min_edge_confidence: { type: "number", description: "0..1 \u2014 drop dependents below this (decayed) confidence" },
+        response_format: RESPONSE_FORMAT
+      },
+      ["name"]
+    ),
+    handler: (graph, args) => {
+      const { node, candidates } = resolveOne(graph, String(args.name ?? ""), numOrU(args.pick));
+      if (!node) return unresolved(candidates);
+      const changeType = ["modify", "delete", "rename", "add_dependency"].includes(String(args.change_type)) ? String(args.change_type) : "modify";
+      const r = impactOf(graph, node.id, { depth: numOr(args.depth, 4) });
+      const minConf = numOrU(args.min_edge_confidence);
+      if (minConf != null) {
+        const kept = r.affected.filter((a) => a.confidence >= minConf);
+        r.affected = kept;
+        r.direct = kept.filter((i) => i.depth === 1).length;
+        r.transitive = kept.filter((i) => i.depth > 1).length;
+        r.minEdgeConfidence = kept.length ? Math.min(...kept.map((i) => i.confidence)) : 1;
+      }
+      const tests = coveringTests(graph, node);
+      const filesAffected = [...new Set(r.affected.map((a) => a.file))];
+      const heavyChange = changeType === "delete" || changeType === "rename";
+      const riskLevel = node.isHub || r.direct >= 10 || r.transitive >= 50 || heavyChange && r.direct >= 3 ? "high" : r.direct >= 3 || r.transitive >= 10 ? "medium" : "low";
+      const summary = `${changeType} ${r.root.name}: ${r.direct} direct dependent${r.direct === 1 ? "" : "s"}, ${r.transitive} transitive across ${filesAffected.length} file${filesAffected.length === 1 ? "" : "s"}; ${tests.length} covering test${tests.length === 1 ? "" : "s"} \u2014 ${riskLevel} risk.`;
+      return {
+        root: r.root.name,
+        changeType,
+        directCallers: r.direct,
+        transitiveCount: r.transitive,
+        filesAffected: filesAffected.slice(0, 20),
+        testsAffected: tests.length,
+        riskLevel,
+        summary,
+        // The full row set is detail; concise callers act on the contract above.
+        ...isDetailed(args) ? { affected: r.affected.slice(0, 100).map(stripId) } : r.affected.length > 0 ? { hint: 'response_format:"detailed" lists the affected nodes' } : {}
+      };
+    }
+  },
+  {
+    name: "tests_for",
+    description: "Which tests cover this symbol \u2014 is a change here tested?",
+    inputSchema: obj(
+      {
+        name: { type: "string" },
+        pick: { type: "number", description: "nth candidate if ambiguous" },
+        response_format: RESPONSE_FORMAT
+      },
+      ["name"]
+    ),
+    handler: (graph, args) => {
+      const { node, candidates } = resolveOne(graph, String(args.name ?? ""), numOrU(args.pick));
+      if (!node) return unresolved(candidates);
+      const covers = coveringTests(graph, node);
+      return {
+        node: node.qualifiedName,
+        tested: node.tested,
+        coverage: node.coverage ?? null,
+        testCount: covers.length,
+        covers: isDetailed(args) ? covers : covers.slice(0, 10),
+        ...covers.length > 10 && !isDetailed(args) ? { moreAvailable: true } : {},
+        ...covers.length === 0 ? { hint: "no covering tests found \u2014 a change here lands untested" } : {}
+      };
+    }
+  },
+  {
+    name: "get_graph_summary",
+    description: "Code map overview: counts, languages, top areas and hubs.",
+    inputSchema: obj({}),
+    handler: (graph) => summarize(graph)
+  },
+  {
+    name: "list_areas",
+    description: "Code areas (communities) by size.",
+    inputSchema: obj({ limit: { type: "number" } }),
+    // Strip `members` (raw content-hash id arrays): a model cannot use them and
+    // on a large repo they ballooned this result past 20k tokens.
+    handler: (graph, args) => [...graph.areas].sort((a, b) => b.size - a.size).slice(0, numOr(args.limit, 30)).map((a) => ({ id: a.id, label: a.label, size: a.size, cohesion: a.cohesion, externalEdges: a.externalEdges }))
+  },
+  {
+    name: "list_hubs",
+    description: "Most-depended-on symbols (includes precomputed blast-radius counts when available).",
+    inputSchema: obj({ limit: { type: "number" } }),
+    handler: (graph, args) => {
+      const limit = numOr(args.limit, 20);
+      if (graph.summaries?.hubs?.length) {
+        return graph.summaries.hubs.slice(0, limit).map((h) => ({
+          name: h.name,
+          kind: h.kind,
+          file: h.file,
+          importance: h.importance,
+          isHub: true,
+          directDependents: h.direct,
+          depth2Dependents: h.depth2,
+          filesAffected: h.files,
+          tested: h.tested
+        }));
+      }
+      return graph.nodes.filter((n) => n.kind !== "file" && n.kind !== "external").sort((a, b) => b.importance - a.importance).slice(0, limit).map((n) => ({
+        name: n.qualifiedName,
+        kind: n.kind,
+        file: n.file,
+        line: n.span.start,
+        importance: n.importance,
+        isHub: n.isHub
+      }));
+    }
+  },
+  {
+    name: "get_facts",
+    description: "Deterministic facts for a node (contract / invariant / characterization).",
+    inputSchema: obj(
+      {
+        name: { type: "string" },
+        pick: { type: "number", description: "nth candidate if ambiguous" }
+      },
+      ["name"]
+    ),
+    handler: (graph, args) => {
+      const { node, candidates } = resolveOne(graph, String(args.name ?? ""), numOrU(args.pick));
+      if (!node) return unresolved(candidates);
+      if (!graph.facts) {
+        return {
+          node: node.qualifiedName,
+          facts: [],
+          note: "map has no facts \u2014 rebuild with a current vg (facts ship on every build)"
+        };
+      }
+      return { node: node.qualifiedName, facts: graph.facts.filter((f) => f.subjectIds.includes(node.id)) };
+    }
+  },
+  {
+    name: "guide_node",
+    description: "Cited standards/practices for a node (OWASP/CWE).",
+    inputSchema: obj(
+      {
+        name: { type: "string" },
+        pick: { type: "number", description: "nth candidate if ambiguous" }
+      },
+      ["name"]
+    ),
+    handler: (graph, args) => {
+      const { node, candidates } = resolveOne(graph, String(args.name ?? ""), numOrU(args.pick));
+      if (!node) return unresolved(candidates);
+      const entries = new Map(FREE_PACK.entries.map((e) => [e.id, e]));
+      return {
+        node: node.qualifiedName,
+        guidance: (graph.grounding ?? []).filter((g) => g.src === node.id).map((g) => ({ kind: g.kind, rationale: g.rationale, confidence: g.confidence, summary: entries.get(g.packEntryId)?.summary ?? "", citation: g.citation }))
+      };
+    }
+  },
+  {
+    name: "check_drift",
+    description: "Offline dependency inventory (npm/pypi/go); attribute:true adds git who-added attribution.",
+    inputSchema: obj(
+      { attribute: { type: "boolean" } },
+      []
+    ),
+    handler: (_graph, args, ctx) => attributedInventory(ctx.root, { attribute: args.attribute === true })
+  },
+  {
+    name: "vuln_attribution",
+    description: "Who introduced each open vulnerability, exposure windows, and CRA remediation metrics (MTTR, SLA breaches). Reads the last `vg scan --vulns`.",
+    inputSchema: obj({ package: { type: "string", description: "restrict to one package" } }, []),
+    handler: (_graph, args, ctx) => {
+      const data = loadVulnerabilities(ctx.root);
+      if (!data) {
+        return {
+          status: "not_scanned",
+          message: "No vulnerability data found. Run `vg scan --vulns` first (attribution needs git history at scan time)."
+        };
+      }
+      const only = args.package ? String(args.package) : null;
+      const packages = (only ? data.packages.filter((p) => p.package === only) : data.packages).map((p) => ({
+        ecosystem: p.ecosystem,
+        package: p.package,
+        installedVersion: p.version,
+        advisories: p.advisories.map((a) => ({
+          id: a.id,
+          cve: a.aliases.find((x) => x.startsWith("CVE-")) ?? null,
+          severity: a.severity,
+          cvss: a.cvss,
+          exposureDays: a.exposureDays ?? null,
+          introduced: a.introduced ?? null,
+          fixedVersions: a.fixedVersions
+        }))
+      }));
+      return { status: "ok", source: data.source, cra: data.cra ?? null, packages };
+    }
+  },
+  {
+    name: "list_vulnerabilities",
+    description: "Known vulnerabilities from the last `vg scan --vulns`: id/CVE, severity, CVSS, fixed version.",
+    inputSchema: obj(
+      { severity: { type: "string", enum: ["low", "moderate", "high", "critical"], description: "minimum severity" } },
+      []
+    ),
+    handler: (_graph, args, ctx) => {
+      const data = loadVulnerabilities(ctx.root);
+      if (!data) {
+        return {
+          status: "not_scanned",
+          message: "No vulnerability data found. Run `vg scan --vulns` first (online OSV, or offline with a --package-manifest carrying advisories)."
+        };
+      }
+      const filtered = filterBySeverity(data, args.severity);
+      return {
+        status: "ok",
+        source: filtered.source,
+        totalAdvisories: filtered.totalAdvisories,
+        affectedPackages: filtered.packages.length,
+        severityCounts: filtered.severityCounts,
+        packages: filtered.packages.map((p) => ({
+          ecosystem: p.ecosystem,
+          package: p.package,
+          installedVersion: p.version,
+          advisories: p.advisories.map((a) => ({
+            id: a.id,
+            cve: a.aliases.find((x) => x.startsWith("CVE-")) ?? null,
+            severity: a.severity,
+            cvss: a.cvss,
+            fixedVersions: a.fixedVersions,
+            summary: a.summary
+          }))
+        }))
+      };
+    }
+  },
+  {
+    name: "upgrade_impact",
+    description: "What breaks if you upgrade a package: major distance, import blast radius, vulns fixed, recommended posture. changelog:true adds GitHub breaking-change signals (online).",
+    inputSchema: obj(
+      {
+        package: { type: "string" },
+        changelog: { type: "boolean" }
+      },
+      ["package"]
+    ),
+    handler: async (_graph, args, ctx) => {
+      const pkg = String(args.package ?? "");
+      if (!pkg) return { error: "bad_request", message: "package is required" };
+      const target = resolvePackageTarget(ctx.root, pkg);
+      const fixesVulnerabilities = openFixableAdvisories(ctx.root, pkg);
+      const impact = computeUpgradeImpact(ctx.root, { package: pkg, ...target }, { fixesVulnerabilities });
+      const changelog = args.changelog === true && !ctx.local && target.ecosystem !== "unknown" ? await getChangelogSignals(target.ecosystem, pkg, target.currentVersion, target.latestVersion) : void 0;
+      return { status: "ok", ...impact, ...changelog ? { changelog } : {} };
+    }
+  },
+  {
+    name: "list_models",
+    description: "Local models on disk (Ollama / LM Studio / gguf).",
+    inputSchema: obj({}),
+    handler: () => ({ models: discoverModels() })
+  },
+  {
+    name: "resolve_library",
+    description: "Resolve a library to its canonical id and the version YOUR project uses (drift-annotated). Call once per library and reuse the returned targetId for every library_docs follow-up \u2014 never guess an id.",
+    // Canonical §4: `query` (+ optional `context_project`). `name` kept as a back-compat alias.
+    inputSchema: obj(
+      {
+        query: {
+          type: "string",
+          description: 'the package name as written in the dependency file. Good: "react-hook-form". Bad: "forms"'
+        },
+        name: { type: "string" },
+        context_project: { type: "string" }
+      },
+      []
+    ),
+    handler: (_graph, args, ctx) => {
+      const query = String(args.query ?? args.name ?? "");
+      if (!query) return { error: "bad_request", message: "query is required" };
+      const ver = resolveVersion(ctx.root, query);
+      const entry = resolveLib(loadCatalog(ctx.root), query);
+      if (entry) {
+        const drift = driftFor(ctx.root, entry);
+        return {
+          targetId: entry.id,
+          id: entry.id,
+          // back-compat
+          name: entry.name,
+          resolvedVersion: ver.served ?? entry.version,
+          version: entry.version,
+          // back-compat
+          isInstalled: ver.installed != null,
+          driftStatus: driftStatusOf(drift),
+          drift,
+          version_mismatch: ver.mismatch ?? null,
+          source: "catalog"
+        };
+      }
+      const local = localPackageDocs(ctx.root, query);
+      if (local) {
+        return {
+          targetId: query,
+          name: query,
+          resolvedVersion: local.version ?? ver.served ?? null,
+          isInstalled: true,
+          driftStatus: "unknown",
+          version_mismatch: ver.mismatch ?? null,
+          source: local.source
+        };
+      }
+      return { error: "not_found" };
+    }
+  },
+  {
+    name: "library_docs",
+    description: "Version-correct usage docs for a library, sliced to a token budget \u2014 official content matched to the version this project has installed, not web-search results. Ask a focused question via query; one call usually answers. After 2 calls without the section you need, stop and read the package source under node_modules instead of searching again.",
+    // Canonical §4: `targetId`/`query`, `verbosity`, `max_tokens`. `name`/`tokens` kept as aliases.
+    inputSchema: obj(
+      {
+        targetId: { type: "string", description: "id from resolve_library (preferred over query)" },
+        query: {
+          type: "string",
+          description: 'the library plus the specific need. Good: "zod refine custom error message". Bad: "zod" or "docs"'
+        },
+        name: { type: "string" },
+        context_project: { type: "string" },
+        verbosity: { type: "string", enum: ["concise", "balanced", "exhaustive"] },
+        // Tolerant on purpose: models often send budgets as strings — the
+        // handler coerces, so don't fail validation over "4000" vs 4000.
+        max_tokens: { type: ["number", "string"], description: "token budget (a numeric string is accepted)" },
+        tokens: { type: ["number", "string"] },
+        enterprise_strict: { type: "boolean" },
+        follow_up: { type: "boolean" }
+      },
+      []
+    ),
+    handler: (_graph, args, ctx) => {
+      const id = String(args.targetId ?? args.query ?? args.name ?? "");
+      if (!id) return { error: "bad_request", message: "targetId or query is required" };
+      const query = String(args.query ?? args.name ?? "");
+      const verbosity = ["concise", "balanced", "exhaustive"].includes(String(args.verbosity)) ? String(args.verbosity) : query ? "concise" : "balanced";
+      const budget = numOrU(args.max_tokens) ?? numOrU(args.tokens) ?? VERBOSITY_BUDGET[verbosity];
+      const ver = resolveVersion(ctx.root, id);
+      const focusQuery = (() => {
+        const q = query.trim();
+        if (!q) return q;
+        const bare = id.replace(/^@[^/]+\//, "").toLowerCase();
+        const parts = q.split(/\s+/);
+        if (parts.length > 1 && parts[0].toLowerCase().replace(/^@[^/]+\//, "") === bare) {
+          return parts.slice(1).join(" ");
+        }
+        return q;
+      })();
+      const render = (readme, libName, readmeOnly) => {
+        const apiSurface = localApiSurface(ctx.root, libName, focusQuery || void 0);
+        const sel = selectForBudget({ readme, query: focusQuery || query, apiSurface, budget });
+        const quality = assessDocQuality(sel.text, {
+          name: libName,
+          query: focusQuery || query || void 0,
+          symbols: symbolsFromApi(apiSurface),
+          readmeOnly: readmeOnly === true && !apiSurface
+        });
+        return {
+          content: sel.text,
+          metadata: {
+            verbosity,
+            tokens: sel.tokens,
+            truncated: sel.truncated,
+            quality: { sufficient: quality.sufficient, score: quality.score, reasons: quality.reasons },
+            escalate: quality.sufficient ? null : "hosted"
+          }
+        };
+      };
+      const entry = resolveLib(loadCatalog(ctx.root), id);
+      let answer = null;
+      let sufficient = false;
+      if (entry) {
+        const r = render(readDoc(ctx.root, entry), entry.name, false);
+        sufficient = r.metadata.quality.sufficient;
+        answer = {
+          targetId: entry.id,
+          name: entry.name,
+          version: entry.version,
+          source: "catalog",
+          drift: driftFor(ctx.root, entry),
+          version_mismatch: ver.mismatch ?? null,
+          content: r.content,
+          docs: r.content,
+          // back-compat
+          metadata: r.metadata
+        };
+      } else {
+        const local = localPackageDocs(ctx.root, id, { query: focusQuery || query || void 0 });
+        if (local) {
+          const r = render(local.docs, id, local.readmeOnly);
+          sufficient = r.metadata.quality.sufficient;
+          answer = {
+            targetId: id,
+            name: id,
+            version: local.version ?? ver.served,
+            source: local.source,
+            version_mismatch: ver.mismatch ?? null,
+            content: r.content,
+            docs: r.content,
+            // back-compat
+            metadata: r.metadata
+          };
+        }
+      }
+      if (!sufficient && !ctx.local) {
+        return (async () => {
+          const dsn = resolveDsn();
+          const parsed = dsn ? parseDsn(dsn) : null;
+          const hosted = await fetchHostedDocsCached(
+            ctx.root,
+            { name: entry?.name ?? id, targetId: entry?.id, query: query || void 0, maxTokens: budget },
+            { auth: parsed ? { keyId: parsed.keyId, secret: parsed.secret } : void 0 }
+          );
+          if (hosted) {
+            return {
+              targetId: entry?.id ?? id,
+              name: entry?.name ?? id,
+              version: hosted.version ?? ver.served ?? null,
+              source: "hosted",
+              version_mismatch: ver.mismatch ?? null,
+              content: hosted.content,
+              docs: hosted.content,
+              // back-compat
+              metadata: { verbosity, escalated: true, ...hosted.metadata ?? {} }
+            };
+          }
+          return answer ?? { error: "not_found" };
+        })();
+      }
+      return answer ?? { error: "not_found" };
+    }
+  }
+];
+var VERBOSITY_BUDGET = { concise: 1500, balanced: 4e3, exhaustive: 12e3 };
+function conciseSummary(graph) {
+  return { counts: graph.meta.counts, languages: graph.meta.languages };
+}
+function summarize(graph, top = 10) {
+  const topHubs = graph.summaries?.hubs?.length ? graph.summaries.hubs.slice(0, top).map((h) => ({
+    name: h.name,
+    file: h.file,
+    importance: h.importance,
+    directDependents: h.direct,
+    depth2Dependents: h.depth2
+  })) : graph.nodes.filter((n) => n.isHub).sort((a, b) => b.importance - a.importance).slice(0, top).map((n) => ({ name: n.qualifiedName, file: n.file, importance: n.importance }));
+  return {
+    counts: graph.meta.counts,
+    languages: graph.meta.languages,
+    cluster: graph.meta.cluster,
+    analysisTier: graph.meta.analysisTier ?? "full",
+    resolver: graph.provenance.resolver,
+    generatedAt: graph.generatedAt,
+    topAreas: [...graph.areas].sort((a, b) => b.size - a.size).slice(0, top).map((a) => ({ id: a.id, label: a.label, size: a.size })),
+    topHubs
+  };
+}
+function stripId(item) {
+  const { id: _id, ...rest } = item;
+  return rest;
+}
+function unresolved(candidates) {
+  return {
+    error: candidates.length ? "ambiguous" : "not_found",
+    candidates: candidates.slice(0, 10).map((n, i) => ({ pick: i + 1, name: n.qualifiedName, kind: n.kind, file: n.file, line: n.span.start })),
+    ...candidates.length ? { hint: "call again with pick:<n> or a file:line name" } : {}
+  };
+}
+function driftStatusOf(d) {
+  if (d.drift === "current") return "current";
+  if (d.drift === "behind") return "outdated";
+  if (d.drift === "ahead") return "ahead";
+  return "unknown";
+}
+function numOr(v, def) {
+  const n = Number(v);
+  return Number.isFinite(n) && n > 0 ? n : def;
+}
+function numOrU(v) {
+  const n = Number(v);
+  return Number.isFinite(n) ? n : void 0;
+}
+function uniqueNames2(xs) {
+  return [...new Set(xs)];
+}
+var HOT_TOOLS = ["orient", "search_symbols", "query_graph", "get_node"];
+function deferredToolNames() {
+  const hot = new Set(HOT_TOOLS);
+  return TOOLS.map((t) => t.name).filter((n) => !hot.has(n));
+}
+function navigationToolsetConfig(serverName = "vibgrate") {
+  return {
+    type: "mcp_toolset",
+    mcp_server_name: serverName,
+    default_config: { defer_loading: true },
+    configs: Object.fromEntries(HOT_TOOLS.map((n) => [n, { defer_loading: false }]))
+  };
+}
+
+export { FREE_PACK, HOT_TOOLS, TOOLS, assessDocQuality, availableRegionIds, clearStoredCredentials, countTokens, coveringTests, createWorkspaceDsn, credentialsPath, dashHostForIngestHost, deferredToolNames, detectRunner, dsnCommand, ensureGitignored, fetchHostedDocsCached, findGitRoot, gitignoreEntryForCredentials, homeCredentialsPath, hostedBase, ingestHostForRegionId, navigationToolsetConfig, parseDsn, pathDisconnect, projectCredentialsPath, publishPrivateLibrary, pushCommand, readScanArtifact, readStoredCredentials, renderToolResult, resolveDsn, resolveIngestHost, selectForBudget, shortestPath, symbolsFromApi, testsToRun, uploadScanArtifact, warmEmbedderInBackground, writeStoredCredentials };
+//# sourceMappingURL=chunk-VBVY733D.js.map
+//# sourceMappingURL=chunk-VBVY733D.js.map