@vibgrate/cli 2026.728.4 → 2026.729.1

package/dist/cli.js

@@ -1,12 +1,12 @@
 #!/usr/bin/env node
-import { sha256Hex, generateKeypair, dssePae, DSSE_PAYLOAD_TYPE, keyId, registerBuild, readGlobal, applyGlobalOptions, ProgressBar, printLogo, fetchCatalog, resolveProviders, runBuild } from './chunk-LYDH2PHN.js';
-export { runBuild } from './chunk-LYDH2PHN.js';
+import { sha256Hex, generateKeypair, dssePae, DSSE_PAYLOAD_TYPE, keyId, registerBuild, readGlobal, applyGlobalOptions, ProgressBar, printLogo, fetchCatalog, resolveProviders, runBuild } from './chunk-EEVZVXT2.js';
+export { runBuild } from './chunk-EEVZVXT2.js';
 import { CONTEXT_POLICY_VERSION, computeFcsReport, renderFcsReportMarkdown, createTrajectoryCollector, runAgent } from './chunk-2ZHWF7C6.js';
-import { loadAdvancedScanHook, baselineCommand } from './chunk-HY2RVURA.js';
+import { loadAdvancedScanHook, baselineCommand } from './chunk-CF2MLSOV.js';
 import { runCodeSession } from './chunk-PRGCCW7D.js';
 import { summarizeDiffs, ScriptedProvider } from './chunk-RZEXHDCF.js';
 import { disableColor, info, c, json, out } from './chunk-CT5BS56U.js';
-import { VGD_PROTOCOL_VERSION, startVgdServer } from './chunk-EVWW3BPM.js';
+import { VGD_PROTOCOL_VERSION, startVgdServer } from './chunk-2JV3J5NF.js';
 import './chunk-5I4VSBWQ.js';
 import './chunk-IS7VTH2Q.js';
 import { init_resolve_ollama, gatherSystemMemory, resolveOllamaBinary, hasOllamaBinary, resolve_ollama_exports } from './chunk-OWSFZQOP.js';
@@ -21,12 +21,12 @@ import { buildIdentifierTrieFromGraph } from './chunk-JIBOJTGS.js';
 import './chunk-7AVYKZEM.js';
 import { buildModelInstallPlan } from './chunk-WHJMS7XC.js';
 import { ensurePackage, ensureUnavailableMessage } from './chunk-REIGWTTH.js';
-import { serveStdio, exportGraph, GraphSource, createServer, formatForExt } from './chunk-ZU7VD4QL.js';
-import { CliError, ExitCode, refreshIfStale, driftCount, ASSISTANTS, detectAssistants, usageError, detectServeLaunch, installAssistant, writeNavigationConfig, uninstallAssistant, buildGraph, writeSnapshot, probeFreshness, discover, assistantById, SMALL_REPO_FILES, SKIP_DIRS, SKIP_FILES } from './chunk-WDJNUC6V.js';
-import { resolveDsn, resolveIngestHost, dashHostForIngestHost, availableRegionIds, createWorkspaceDsn, writeStoredCredentials, credentialsPath, findGitRoot, ensureGitignored, gitignoreEntryForCredentials, clearStoredCredentials, parseDsn as parseDsn$1, uploadScanArtifact, ingestHostForRegionId, dsnCommand, pushCommand, countTokens, shortestPath, pathDisconnect, testsToRun, detectRunner, coveringTests, FREE_PACK, readScanArtifact, publishPrivateLibrary, assessDocQuality, symbolsFromApi, fetchHostedDocsCached, selectForBudget, hostedBase, readStoredCredentials, projectCredentialsPath, homeCredentialsPath } from './chunk-SA4BMEU6.js';
+import { serveStdio, exportGraph, GraphSource, createServer, formatForExt } from './chunk-TQFY6OSV.js';
+import { CliError, ExitCode, refreshIfStale, driftCount, ASSISTANTS, detectAssistants, usageError, detectServeLaunch, installAssistant, writeNavigationConfig, uninstallAssistant, buildGraph, writeSnapshot, probeFreshness, discover, assistantById, SMALL_REPO_FILES, SKIP_DIRS, SKIP_FILES } from './chunk-YMHQZ24Q.js';
+import { resolveDsn, resolveIngestHost, dashHostForIngestHost, availableRegionIds, createWorkspaceDsn, writeStoredCredentials, credentialsPath, findGitRoot, ensureGitignored, gitignoreEntryForCredentials, clearStoredCredentials, parseDsn as parseDsn$1, uploadScanArtifact, ingestHostForRegionId, dsnCommand, pushCommand, countTokens, shortestPath, pathDisconnect, testsToRun, detectRunner, coveringTests, FREE_PACK, readScanArtifact, publishPrivateLibrary, assessDocQuality, symbolsFromApi, fetchHostedDocsCached, selectForBudget, hostedBase, readStoredCredentials, projectCredentialsPath, homeCredentialsPath } from './chunk-QS5BTBRX.js';
 import './chunk-IPICO2RV.js';
 import { inventory, enrichOnline, ECOSYSTEMS, catalogPath, libDir, loadCatalog, driftFor, addLibrary, resolveLib, libId, resolveVersion, readDoc, localPackageDocs, localApiSurface } from './chunk-G4HTI4ZM.js';
-import { writeDefaultConfig, parseDsn, detectVcs, computeRepoFingerprint, resolveRepositoryName, fetchScanPreflight, runCoreScan, VERSION, loadConfig, prepareCompressedUpload, computeDriftScore, titleBox, projectTypeToVulnEcosystem, driftBar, gitHistoryAvailable, buildVersionTimelines, findPackageAnyEcosystem, normalizeConstraint, findVersionCrossings, versionSatisfies, PROJECT_TYPE_TO_OSV_ECOSYSTEM, fetchRiskySymbols } from './chunk-RCBMY7CR.js';
+import { writeDefaultConfig, parseDsn, detectVcs, computeRepoFingerprint, resolveRepositoryName, fetchScanPreflight, runCoreScan, loadConfig, prepareCompressedUpload, computeDriftScore, titleBox, projectTypeToVulnEcosystem, driftBar, gitHistoryAvailable, buildVersionTimelines, findPackageAnyEcosystem, normalizeConstraint, findVersionCrossings, versionSatisfies, PROJECT_TYPE_TO_OSV_ECOSYSTEM, fetchRiskySymbols } from './chunk-OIWHR57Q.js';
 import { recordCliCall, CLI_TOOL_ALIASES, savingsLedgerPath, clearSavings, readSavings, readUsage, readModelSavings, CAPSULE_RANKING_VERSION, SAVINGS_TOOLS, sanitizeClient } from './chunk-US2DAKCM.js';
 import { ensureDir, pathExists, readJsonFile, writeTextFile, writeJsonFile } from './chunk-CRAMOEBE.js';
 import { resolveOne } from './chunk-J7LKEB2R.js';
@@ -36,15 +36,16 @@ import { init_cli_invocation, resolveCliInvocation, NPX_INVOCATION } from './chu
 import { freeBytesOnVolume, weightStoreDir, listCachedWeights, ensureWeightCached, catalogIntegrityReport } from './chunk-OV4KGXPD.js';
 import { resolvedGrammarFiles, grammarSetVersion } from './chunk-UTNNGKKX.js';
 import './chunk-RXP66R2E.js';
-import { resolveGraphPath, renderReport, loadGraph, writeArtifacts, vibgrateDir, SCHEMA_VERSION } from './chunk-RYNAK4LK.js';
-import { cacheDir, stableStringify } from './chunk-ZKNB4YH4.js';
+import { resolveGraphPath, renderReport, loadGraph, loadGraphFileWithSnapshot, writeArtifacts, vibgrateDir, mapFileExists, SCHEMA_VERSION } from './chunk-YKVNMNEM.js';
+import { VERSION } from './chunk-NQ4FSRXL.js';
+import { cacheDir, serializeGraph, stableStringify } from './chunk-ZKNB4YH4.js';
 import './chunk-BWPBB45M.js';
 import { canonicalize, hashString, hashBytes } from './chunk-JFGYT6BI.js';
 import './chunk-BPF3YX2U.js';
 import { pathExists as pathExists$1, parseExcludePatterns } from './chunk-GI6W53LM.js';
 import { __toCommonJS } from './chunk-Z6ZWNWWR.js';
-import * as fs8 from 'fs';
-import fs8__default, { realpathSync } from 'fs';
+import * as fs7 from 'fs';
+import fs7__default, { realpathSync } from 'fs';
 import * as path37 from 'path';
 import path37__default from 'path';
 import { fileURLToPath, pathToFileURL } from 'url';
@@ -55,7 +56,7 @@ import { randomUUID } from 'crypto';
 import { execSync, spawn, spawnSync, execFileSync } from 'child_process';
 import * as readline from 'readline';
 import chalk7 from 'chalk';
-import * as fs21 from 'fs/promises';
+import * as fs20 from 'fs/promises';
 import semver2 from 'semver';
 
 init_cli_invocation();
@@ -69,7 +70,7 @@ async function runStatus(global) {
   const root2 = path37.resolve(global.cwd ?? ".");
   const graphPath = resolveGraphPath(root2, global.graph);
   const graph = loadGraph(root2, graphPath);
-  const hasCache = fs8.existsSync(path37.join(cacheDir(root2), "parse-cache.json"));
+  const hasCache = fs7.existsSync(path37.join(cacheDir(root2), "parse-cache.json"));
   let stale = null;
   let staleExact = false;
   if (graph) {
@@ -866,14 +867,14 @@ function isCI(env = process.env) {
 function installId(env = process.env) {
   if (telemetryOptOut(env) !== null || isCI(env)) return randomUuid();
   try {
-    const existing = fs8.readFileSync(INSTALL_ID_FILE, "utf8").trim();
+    const existing = fs7.readFileSync(INSTALL_ID_FILE, "utf8").trim();
     if (isUuid(existing)) return existing;
   } catch {
   }
   const id = randomUuid();
   try {
-    fs8.mkdirSync(INSTALL_ID_DIR, { recursive: true });
-    fs8.writeFileSync(INSTALL_ID_FILE, id + "\n", { mode: 384 });
+    fs7.mkdirSync(INSTALL_ID_DIR, { recursive: true });
+    fs7.writeFileSync(INSTALL_ID_FILE, id + "\n", { mode: 384 });
   } catch {
   }
   return id;
@@ -897,7 +898,7 @@ function ledgerFilePath(root2) {
 }
 function readOffset(root2) {
   try {
-    const raw = JSON.parse(fs8.readFileSync(offsetPath(root2), "utf8"));
+    const raw = JSON.parse(fs7.readFileSync(offsetPath(root2), "utf8"));
     return typeof raw.offset === "number" && raw.offset >= 0 ? raw.offset : 0;
   } catch {
     return 0;
@@ -905,8 +906,8 @@ function readOffset(root2) {
 }
 function writeOffset(root2, offset) {
   try {
-    fs8.mkdirSync(cacheDir(root2), { recursive: true });
-    fs8.writeFileSync(offsetPath(root2), JSON.stringify({ offset }) + "\n");
+    fs7.mkdirSync(cacheDir(root2), { recursive: true });
+    fs7.writeFileSync(offsetPath(root2), JSON.stringify({ offset }) + "\n");
   } catch {
   }
 }
@@ -914,7 +915,7 @@ function buildBatch(root2, fromOffset, id = installId()) {
   const file = ledgerFilePath(root2);
   let size = 0;
   try {
-    size = fs8.statSync(file).size;
+    size = fs7.statSync(file).size;
   } catch {
     return { batch: null, newOffset: 0 };
   }
@@ -922,13 +923,13 @@ function buildBatch(root2, fromOffset, id = installId()) {
   if (start >= size) return { batch: null, newOffset: size };
   let text = "";
   try {
-    const fd = fs8.openSync(file, "r");
+    const fd = fs7.openSync(file, "r");
     try {
       const buf = Buffer.alloc(size - start);
-      fs8.readSync(fd, buf, 0, buf.length, start);
+      fs7.readSync(fd, buf, 0, buf.length, start);
       text = buf.toString("utf8");
     } finally {
-      fs8.closeSync(fd);
+      fs7.closeSync(fd);
     }
   } catch {
     return { batch: null, newOffset: fromOffset };
@@ -1069,7 +1070,7 @@ function liveStatsDir(root2) {
 function reapOtherVersionServers(dir, keepVersion, now = Date.now(), kill = (pid, signal) => process.kill(pid, signal), selfPid = process.pid) {
   let entries;
   try {
-    entries = fs8.readdirSync(dir);
+    entries = fs7.readdirSync(dir);
   } catch {
     return [];
   }
@@ -1078,7 +1079,7 @@ function reapOtherVersionServers(dir, keepVersion, now = Date.now(), kill = (pid
     if (!/^serve-\d+\.json$/.test(name)) continue;
     let parsed;
     try {
-      parsed = JSON.parse(fs8.readFileSync(path37.join(dir, name), "utf8"));
+      parsed = JSON.parse(fs7.readFileSync(path37.join(dir, name), "utf8"));
     } catch {
       continue;
     }
@@ -1132,10 +1133,10 @@ var LiveStatsBus = class {
     this.lastWriteAt = now;
     const body = { pid: this.pid, updatedAt: now, version: VERSION, snapshot: snap };
     try {
-      fs8.mkdirSync(this.dir, { recursive: true });
+      fs7.mkdirSync(this.dir, { recursive: true });
       const tmp = `${this.file}.tmp`;
-      fs8.writeFileSync(tmp, JSON.stringify(body));
-      fs8.renameSync(tmp, this.file);
+      fs7.writeFileSync(tmp, JSON.stringify(body));
+      fs7.renameSync(tmp, this.file);
     } catch {
     }
   }
@@ -1146,7 +1147,7 @@ var LiveStatsBus = class {
   siblings(now = Date.now()) {
     let entries;
     try {
-      entries = fs8.readdirSync(this.dir);
+      entries = fs7.readdirSync(this.dir);
     } catch {
       return [];
     }
@@ -1156,14 +1157,14 @@ var LiveStatsBus = class {
       const file = path37.join(this.dir, name);
       let parsed;
       try {
-        parsed = JSON.parse(fs8.readFileSync(file, "utf8"));
+        parsed = JSON.parse(fs7.readFileSync(file, "utf8"));
       } catch {
         continue;
       }
       if (typeof parsed?.pid !== "number" || typeof parsed.updatedAt !== "number" || !parsed.snapshot?.totals) continue;
       if (now - parsed.updatedAt > STALE_MS) {
         try {
-          fs8.unlinkSync(file);
+          fs7.unlinkSync(file);
         } catch {
         }
         continue;
@@ -1175,7 +1176,7 @@ var LiveStatsBus = class {
   }
   unlinkOwn = () => {
     try {
-      fs8.unlinkSync(this.file);
+      fs7.unlinkSync(this.file);
     } catch {
     }
   };
@@ -1488,12 +1489,12 @@ var LedgerTail = class {
     if (size === this.offset) return;
     let chunk;
     try {
-      const fd = fs8.openSync(this.file, "r");
+      const fd = fs7.openSync(this.file, "r");
       try {
         chunk = Buffer.alloc(size - this.offset);
-        fs8.readSync(fd, chunk, 0, chunk.length, this.offset);
+        fs7.readSync(fd, chunk, 0, chunk.length, this.offset);
       } finally {
-        fs8.closeSync(fd);
+        fs7.closeSync(fd);
       }
     } catch {
       return;
@@ -1506,7 +1507,7 @@ var LedgerTail = class {
   }
   sizeOf() {
     try {
-      return fs8.statSync(this.file).size;
+      return fs7.statSync(this.file).size;
     } catch {
       return 0;
     }
@@ -1589,7 +1590,7 @@ function registerServe(program) {
 }
 async function ensureServableGraph(root2, graphPath, global, refresh, opts = {}) {
   if (refresh) {
-    if (!fs8.existsSync(graphPath)) {
+    if (!mapFileExists(graphPath)) {
       info(c.dim("vg \xB7 no map found \u2014 building it before serving\u2026"));
       await runBuild(
         [],
@@ -1615,7 +1616,7 @@ async function ensureServableGraph(root2, graphPath, global, refresh, opts = {})
       if (opts.awaitStaleRefresh) await kick;
     }
   }
-  if (!fs8.existsSync(graphPath)) {
+  if (!mapFileExists(graphPath)) {
     throw new CliError(
       `no map found at ${graphPath} \u2014 run \`vg\` to build one first`,
       ExitCode.NOT_FOUND
@@ -1677,7 +1678,7 @@ async function serveHttp(graphPath, host, port, opts, freshness, onReady) {
       info(c.red(`vg serve: request error: ${err.message}`));
     }
   });
-  await new Promise((resolve20) => httpServer.listen(port, host, resolve20));
+  await new Promise((resolve21) => httpServer.listen(port, host, resolve21));
   info(c.dim(`vg \xB7 MCP server on http://${host}:${port}/mcp (read-only, local, ${freshness})`));
   onReady?.();
   await new Promise(() => {
@@ -1898,7 +1899,7 @@ function manifestHash(root2) {
   const walk2 = (dir) => {
     let entries;
     try {
-      entries = fs8.readdirSync(dir, { withFileTypes: true });
+      entries = fs7.readdirSync(dir, { withFileTypes: true });
     } catch {
       return;
     }
@@ -1914,7 +1915,7 @@ function manifestHash(root2) {
       if (!isManifest(abs) && !SKIP_FILES.has(base)) continue;
       try {
         const rel = path37.relative(root2, abs).split(path37.sep).join("/");
-        files.push({ rel, hash: hashBytes(fs8.readFileSync(abs)) });
+        files.push({ rel, hash: hashBytes(fs7.readFileSync(abs)) });
       } catch {
       }
     }
@@ -1923,9 +1924,17 @@ function manifestHash(root2) {
   files.sort((a, b) => a.rel < b.rel ? -1 : a.rel > b.rel ? 1 : 0);
   return hashString(canonicalize(files));
 }
+function isDependencyFile(root2, filePath) {
+  const rel = path37.relative(path37.resolve(root2), path37.resolve(filePath));
+  if (rel === "" || rel.startsWith("..") || path37.isAbsolute(rel)) return false;
+  const parts = rel.split(path37.sep);
+  if (parts.slice(0, -1).some((dir) => SKIP_DIRS.has(dir))) return false;
+  const base = parts[parts.length - 1].toLowerCase();
+  return isManifest(filePath) || SKIP_FILES.has(base);
+}
 function loadScanCache(root2, key2) {
   try {
-    const raw = JSON.parse(fs8.readFileSync(cachePath(root2), "utf8"));
+    const raw = JSON.parse(fs7.readFileSync(cachePath(root2), "utf8"));
     if (raw.version === CACHE_VERSION && raw.manifestHash === key2.manifestHash && raw.toolVersion === key2.toolVersion && raw.offline === key2.offline && raw.artifact) {
       return { manifestHash: raw.manifestHash, artifact: raw.artifact };
     }
@@ -1935,8 +1944,8 @@ function loadScanCache(root2, key2) {
 }
 function writeScanCache(root2, key2, artifact) {
   try {
-    fs8.mkdirSync(cacheDir(root2), { recursive: true });
-    fs8.writeFileSync(
+    fs7.mkdirSync(cacheDir(root2), { recursive: true });
+    fs7.writeFileSync(
       cachePath(root2),
       stableStringify(
         { version: CACHE_VERSION, manifestHash: key2.manifestHash, toolVersion: key2.toolVersion, offline: key2.offline, artifact },
@@ -2442,6 +2451,13 @@ var VibgrateLanguageServer = class {
       if (!uri || !this.docs.has(uri)) return;
       this.scheduleScan(400);
     });
+    this.conn.onNotification("workspace/didChangeWatchedFiles", (_m, params) => {
+      const p = params;
+      const relevant = (p.changes ?? []).some(
+        (c2) => c2.uri && isDependencyFile(this.opts.root, uriToPath(c2.uri))
+      );
+      if (relevant) this.scheduleScan(400);
+    });
     this.conn.onNotification("textDocument/didClose", (_m, params) => {
       const p = params;
       if (p.textDocument?.uri) this.docs.delete(p.textDocument.uri);
@@ -2743,7 +2759,7 @@ var VibgrateLanguageServer = class {
       const absManifest = path37.resolve(this.opts.root, relManifest);
       let text = null;
       try {
-        if (fs8.existsSync(absManifest)) text = fs8.readFileSync(absManifest, "utf8");
+        if (fs7.existsSync(absManifest)) text = fs7.readFileSync(absManifest, "utf8");
       } catch {
         text = null;
       }
@@ -3048,7 +3064,7 @@ function hoverMarkdown(dep, contribution) {
   return lines.join("\n");
 }
 function startLanguageServer(opts) {
-  if (!fs8.existsSync(opts.root)) {
+  if (!fs7.existsSync(opts.root)) {
     process.stderr.write(`vg lsp: root does not exist: ${opts.root}
 `);
     process.exit(1);
@@ -3123,7 +3139,7 @@ function registerInstall(program) {
       }
       return;
     }
-    const targets = opts.all ? ASSISTANTS : opts.detect ? detected.map((d) => d.assistant) : tools.map(resolve4);
+    const targets = opts.all ? ASSISTANTS : opts.detect ? detected.map((d) => d.assistant) : tools.map(resolve5);
     if (targets.length === 0) {
       if (opts.detect) {
         if (global.json) json({ root: root2, detected: [], results: [] });
@@ -3154,7 +3170,7 @@ function registerInstall(program) {
   const uninstall = program.command("uninstall").description("remove vg from an AI assistant").argument("<tools...>", "assistant ids").option("--purge", "also delete the skill file").action(function(tools, opts) {
     const global = readGlobal(this);
     const root2 = rootOf(global);
-    const results = tools.map(resolve4).map((a) => ({ id: a.id, removed: uninstallAssistant(a, root2, !!opts.purge) }));
+    const results = tools.map(resolve5).map((a) => ({ id: a.id, removed: uninstallAssistant(a, root2, !!opts.purge) }));
     if (global.json) {
       json({ root: root2, results });
       return;
@@ -3165,7 +3181,7 @@ function registerInstall(program) {
   });
   applyGlobalOptions(uninstall);
 }
-function resolve4(id) {
+function resolve5(id) {
   const a = assistantById(id);
   if (!a) {
     const near = ASSISTANTS.filter(
@@ -3186,7 +3202,7 @@ function registerShare(program) {
     const global = readGlobal(this);
     const root2 = rootOf(global);
     const gitDir = path37.join(root2, ".git");
-    if (!fs8.existsSync(gitDir)) {
+    if (!fs7.existsSync(gitDir)) {
       throw new CliError("not a git repository \u2014 run `vg share` inside a git repo", ExitCode.USAGE_ERROR);
     }
     if (opts.undo) {
@@ -3208,22 +3224,22 @@ function registerShare(program) {
 }
 function writeVibgrateGitignore(root2, reports) {
   const dir = path37.join(root2, ".vibgrate");
-  fs8.mkdirSync(dir, { recursive: true });
-  const lines = ["# Managed by `vg share` \u2014 keep graph.json committed, ignore the rest", "cache/", "facts.jsonl"];
+  fs7.mkdirSync(dir, { recursive: true });
+  const lines = ["# Managed by `vg share` \u2014 keep graph.json committed, ignore the rest", "cache/", "facts.jsonl", "graph.snap"];
   if (!reports) lines.push("graph.html", "GRAPH_REPORT.md");
-  fs8.writeFileSync(path37.join(dir, ".gitignore"), `${lines.join("\n")}
+  fs7.writeFileSync(path37.join(dir, ".gitignore"), `${lines.join("\n")}
 `);
 }
 function writeGitAttributes(root2) {
   const file = path37.join(root2, ".gitattributes");
   const line = ".vibgrate/graph.json merge=vg";
-  let content = fs8.existsSync(file) ? fs8.readFileSync(file, "utf8") : "";
+  let content = fs7.existsSync(file) ? fs7.readFileSync(file, "utf8") : "";
   if (!content.split("\n").some((l) => l.trim() === line)) {
     content = content.length ? `${content.replace(/\s*$/, "")}
 ${line}
 ` : `${line}
 `;
-    fs8.writeFileSync(file, content);
+    fs7.writeFileSync(file, content);
   }
 }
 function configureMergeDriver(root2) {
@@ -3232,7 +3248,7 @@ function configureMergeDriver(root2) {
 }
 function installPreCommitHook(root2) {
   const hooksDir = hookDir(root2);
-  fs8.mkdirSync(hooksDir, { recursive: true });
+  fs7.mkdirSync(hooksDir, { recursive: true });
   const file = path37.join(hooksDir, "pre-commit");
   const block = [
     HOOK_BEGIN,
@@ -3242,7 +3258,7 @@ function installPreCommitHook(root2) {
     "fi",
     HOOK_END
   ].join("\n");
-  let content = fs8.existsSync(file) ? fs8.readFileSync(file, "utf8") : "#!/bin/sh\n";
+  let content = fs7.existsSync(file) ? fs7.readFileSync(file, "utf8") : "#!/bin/sh\n";
   const re = new RegExp(`${escapeRe(HOOK_BEGIN)}[\\s\\S]*?${escapeRe(HOOK_END)}`);
   if (re.test(content)) content = content.replace(re, block);
   else content = `${content.replace(/\s*$/, "")}
@@ -3251,21 +3267,21 @@ ${block}
 `;
   if (!content.startsWith("#!")) content = `#!/bin/sh
 ${content}`;
-  fs8.writeFileSync(file, content);
-  fs8.chmodSync(file, 493);
+  fs7.writeFileSync(file, content);
+  fs7.chmodSync(file, 493);
 }
 function undo(root2) {
   const hookFile = path37.join(hookDir(root2), "pre-commit");
-  if (fs8.existsSync(hookFile)) {
+  if (fs7.existsSync(hookFile)) {
     const re = new RegExp(`\\n*${escapeRe(HOOK_BEGIN)}[\\s\\S]*?${escapeRe(HOOK_END)}\\n*`);
-    const next2 = fs8.readFileSync(hookFile, "utf8").replace(re, "\n");
-    if (next2.trim() === "#!/bin/sh") fs8.rmSync(hookFile);
-    else fs8.writeFileSync(hookFile, next2);
+    const next2 = fs7.readFileSync(hookFile, "utf8").replace(re, "\n");
+    if (next2.trim() === "#!/bin/sh") fs7.rmSync(hookFile);
+    else fs7.writeFileSync(hookFile, next2);
   }
   const attr = path37.join(root2, ".gitattributes");
-  if (fs8.existsSync(attr)) {
-    const next2 = fs8.readFileSync(attr, "utf8").split("\n").filter((l) => l.trim() !== ".vibgrate/graph.json merge=vg").join("\n");
-    fs8.writeFileSync(attr, next2);
+  if (fs7.existsSync(attr)) {
+    const next2 = fs7.readFileSync(attr, "utf8").split("\n").filter((l) => l.trim() !== ".vibgrate/graph.json merge=vg").join("\n");
+    fs7.writeFileSync(attr, next2);
   }
   try {
     git(root2, ["config", "--remove-section", "merge.vg"]);
@@ -3308,7 +3324,7 @@ function registerWatch(program) {
     const debounceMs = Math.max(50, Number(opts.debounce) || DEFAULT_DEBOUNCE_MS);
     const watchRoots = (paths.length ? paths : ["."]).map((p) => path37.resolve(root2, p));
     for (const w of watchRoots) {
-      if (!fs8.existsSync(w)) {
+      if (!fs7.existsSync(w)) {
         throw new CliError(`watch path not found: ${w}`, ExitCode.USAGE_ERROR);
       }
     }
@@ -3361,7 +3377,7 @@ function registerWatch(program) {
     const watchers = [];
     for (const w of watchRoots) {
       try {
-        const watcher = fs8.watch(w, { recursive: true }, (_event, filename) => {
+        const watcher = fs7.watch(w, { recursive: true }, (_event, filename) => {
           if (!filename) {
             schedule("change");
             return;
@@ -3379,11 +3395,11 @@ function registerWatch(program) {
       }
     }
     info(c.dim(`vg watch \xB7 watching ${watchRoots.map((p) => path37.relative(root2, p) || ".").join(", ")} (debounce ${debounceMs}ms) \xB7 Ctrl+C to stop`));
-    await new Promise((resolve20) => {
+    await new Promise((resolve21) => {
       const stop = () => {
         for (const w of watchers) w.close();
         if (timer) clearTimeout(timer);
-        resolve20();
+        resolve21();
       };
       process.once("SIGINT", stop);
       process.once("SIGTERM", stop);
@@ -3714,7 +3730,7 @@ function loadStandards(root2) {
     const p = path37__default.join(root2, rel);
     let text;
     try {
-      text = fs8__default.readFileSync(p, "utf8");
+      text = fs7__default.readFileSync(p, "utf8");
     } catch {
       continue;
     }
@@ -5376,7 +5392,7 @@ function registerModels(program) {
     );
   });
   applyGlobalOptions(modeCmd);
-  const resolve20 = cmd.command("resolve").description("resolve a Code Mode to pack + underlying model + fit (no download)").argument("[mode]", "spark | flow | forge (default: auto-fit or configured default)").action(function(modeArg) {
+  const resolve21 = cmd.command("resolve").description("resolve a Code Mode to pack + underlying model + fit (no download)").argument("[mode]", "spark | flow | forge (default: auto-fit or configured default)").action(function(modeArg) {
     const global = readGlobal(this);
     const root2 = rootOf(global);
     const sys = gatherSystemMemory();
@@ -5408,7 +5424,7 @@ function registerModels(program) {
       info(c.yellow("  will not fit \u2014 choose a lower mode or free memory before loading"));
     }
   });
-  applyGlobalOptions(resolve20);
+  applyGlobalOptions(resolve21);
   const installCmd = cmd.command("install").description("resolve the best Code Mode for this machine and install the pack").argument("[mode]", "spark | flow | forge (default: auto-fit)").option("--dry-run", "print the install plan only \u2014 do not download").option("--yes", "skip prompts (install already runs by default)").action(async function(modeArg, opts) {
     const global = readGlobal(this);
     const root2 = rootOf(global);
@@ -5645,7 +5661,7 @@ function registerModels(program) {
         );
       }
     } else {
-      if (!target.path || !fs8.existsSync(target.path)) {
+      if (!target.path || !fs7.existsSync(target.path)) {
         throw new CliError(
           `model file not found at ${target.path || "(unknown path)"} \u2014 it may already be removed.`,
           ExitCode.NOT_FOUND
@@ -5659,7 +5675,7 @@ function registerModels(program) {
       }
       if (!global.json) info(c.dim(`  $ rm ${target.path}`));
       try {
-        fs8.unlinkSync(target.path);
+        fs7.unlinkSync(target.path);
       } catch (e) {
         const msg = e instanceof Error ? e.message : String(e);
         throw new CliError(`could not delete ${target.path}: ${msg}`, ExitCode.ERROR);
@@ -5798,8 +5814,8 @@ function registerModels(program) {
     });
     if (opts.out) {
       const outPath = path37.resolve(opts.out);
-      fs8.mkdirSync(path37.dirname(outPath), { recursive: true });
-      fs8.writeFileSync(outPath, `${JSON.stringify(report, null, 2)}
+      fs7.mkdirSync(path37.dirname(outPath), { recursive: true });
+      fs7.writeFileSync(outPath, `${JSON.stringify(report, null, 2)}
 `);
       if (!global.json) info(c.dim(`  wrote ${outPath}`));
     }
@@ -5913,11 +5929,11 @@ function fitColor(label) {
   return label;
 }
 function confirmYesNo(question) {
-  return new Promise((resolve20) => {
+  return new Promise((resolve21) => {
     const rl = readline.createInterface({ input: process.stdin, output: process.stderr });
     rl.question(`${question} [y/N] `, (answer) => {
       rl.close();
-      resolve20(/^y(es)?$/i.test(answer.trim()));
+      resolve21(/^y(es)?$/i.test(answer.trim()));
     });
   });
 }
@@ -5997,7 +6013,7 @@ function codeConfigPath(root2) {
 }
 function loadCodeConfig(root2) {
   try {
-    const raw = JSON.parse(fs8.readFileSync(codeConfigPath(root2), "utf8"));
+    const raw = JSON.parse(fs7.readFileSync(codeConfigPath(root2), "utf8"));
     return sanitize(raw);
   } catch {
     return {};
@@ -6064,7 +6080,7 @@ function contextBudgetFor(config, modelContextWindow) {
 var MCP_CONFIG_FILES = [".cursor/mcp.json", ".vscode/mcp.json", ".mcp.json"];
 function readMcpServersFile(file) {
   try {
-    const raw = JSON.parse(fs8.readFileSync(file, "utf8"));
+    const raw = JSON.parse(fs7.readFileSync(file, "utf8"));
     const map = raw.mcpServers ?? raw.servers;
     return map && typeof map === "object" ? parseMcpServers(map) : {};
   } catch {
@@ -6104,7 +6120,7 @@ function registerCode(program) {
       try {
         const { parseMode: parseMode2, resolveMode: resolveMode2, readOrchestratorState: readOrchestratorState2, activePin: activePin2 } = await import('./model-orchestrator-LHYPJBFH.js');
         const { gatherSystemMemory: gatherSystemMemory2 } = await import('./local-runtime-2ED33KK6.js');
-        const { loadGraph: loadGraph2 } = await import('./load-SEFJA3M5.js');
+        const { loadGraph: loadGraph2 } = await import('./load-WKIZF2AK.js');
         const state = readOrchestratorState2();
         const mode = parseMode2(modeFlag) ?? state.defaultMode ?? void 0;
         const pin = mode ? activePin2(mode, state) : null;
@@ -6188,7 +6204,7 @@ function registerCode(program) {
       if (!(process.stdin.isTTY && process.stdout.isTTY)) {
         throw usageError('say what to change, e.g. `vg code "add a --timeout flag to the scan command"` (guided mode needs an interactive terminal)');
       }
-      const { runInteractive } = await import('./interactive-32LSIBRG.js');
+      const { runInteractive } = await import('./interactive-R5VQGDWP.js');
       await runInteractive(
         rootOf(global),
         global,
@@ -6221,7 +6237,7 @@ function registerCode(program) {
     let mockReply;
     if (opts.mock) {
       try {
-        mockReply = fs8.readFileSync(opts.mock, "utf8");
+        mockReply = fs7.readFileSync(opts.mock, "utf8");
       } catch {
         throw new CliError(`couldn't read the --mock file: ${opts.mock}`, ExitCode.USAGE_ERROR);
       }
@@ -6277,11 +6293,11 @@ function registerCode(program) {
         const { loadOrDiscoverFederation } = await import('./federation-MDQPO3PW.js');
         const { resolveExecutionEnv } = await import('./execution-env-4MS5AYAN.js');
         const { resolveModelExecutionProfile, mergeModelExecutionProfile } = await import('./model-execution-profile-ELWF3Z6H.js');
-        const { startCodeRuntimeSession } = await import('./runtime-session-4IACVDSY.js');
+        const { startCodeRuntimeSession } = await import('./runtime-session-5NRB6BTR.js');
         const { resolveGraphBackend } = await import('./graph-backend-GBL33GMW.js');
         const { detectGitRef } = await import('./git-ref-RSRAN4OH.js');
         const { repositoryIdFromRoot } = await import('./paths-62AKTFSR.js');
-        const { vgdRequest: vgdRequest2 } = await import('./vgd-KDQFS33M.js');
+        const { vgdRequest: vgdRequest2 } = await import('./vgd-KC5RCOP6.js');
         const federation = loadOrDiscoverFederation(root2);
         const modelProfile = mergeModelExecutionProfile(
           resolveModelExecutionProfile({
@@ -6327,7 +6343,7 @@ ${res.stderr}` : ""),
             exitCode: res.status ?? 1
           };
         };
-        const { createVgBuiltinMcpTools, mergeExternalToolsets } = await import('./vg-mcp-bridge-E4SJFL7Q.js');
+        const { createVgBuiltinMcpTools, mergeExternalToolsets } = await import('./vg-mcp-bridge-YXQS6HTO.js');
         const vgBuiltin = createVgBuiltinMcpTools({
           getGraph: () => graph,
           root: root2,
@@ -6409,7 +6425,7 @@ ${res.stderr}` : ""),
       if (!autonomous && !tty) {
         throw usageError("the agent approves each edit/command \u2014 run in a terminal to approve interactively, or pass --auto to run autonomously (or --single for a one-shot diff).");
       }
-      const { agentTask } = await import('./interactive-32LSIBRG.js');
+      const { agentTask } = await import('./interactive-R5VQGDWP.js');
       const { nodeCodeFs } = await import('./session-2JT4AUZT.js');
       const { TtyPrompter } = await import('./ui-K7D3BCHD.js');
       let priorSummary;
@@ -6419,7 +6435,7 @@ ${res.stderr}` : ""),
         if (prev) priorSummary = summarizeSession(prev);
       }
       const prompter = tty ? new TtyPrompter() : void 0;
-      const { createVgBuiltinMcpTools, mergeExternalToolsets } = await import('./vg-mcp-bridge-E4SJFL7Q.js');
+      const { createVgBuiltinMcpTools, mergeExternalToolsets } = await import('./vg-mcp-bridge-YXQS6HTO.js');
       const vgBuiltin = createVgBuiltinMcpTools({
         getGraph: () => graph,
         root: root2,
@@ -6443,11 +6459,11 @@ ${res.stderr}` : ""),
         const { loadFederation } = await import('./federation-MDQPO3PW.js');
         const { resolveExecutionEnv } = await import('./execution-env-4MS5AYAN.js');
         const { resolveModelExecutionProfile, mergeModelExecutionProfile } = await import('./model-execution-profile-ELWF3Z6H.js');
-        const { startCodeRuntimeSession } = await import('./runtime-session-4IACVDSY.js');
+        const { startCodeRuntimeSession } = await import('./runtime-session-5NRB6BTR.js');
         const { resolveGraphBackend } = await import('./graph-backend-GBL33GMW.js');
         const { detectGitRef } = await import('./git-ref-RSRAN4OH.js');
         const { repositoryIdFromRoot } = await import('./paths-62AKTFSR.js');
-        const { vgdRequest: vgdRequest2 } = await import('./vgd-KDQFS33M.js');
+        const { vgdRequest: vgdRequest2 } = await import('./vgd-KC5RCOP6.js');
         const federation = loadFederation(root2);
         const modelProfile = mergeModelExecutionProfile(
           resolveModelExecutionProfile({
@@ -6539,7 +6555,7 @@ ${res.stderr}` : ""),
       attribution: { client: "vg-code", provider: providerSlug, model: primary?.model }
     });
     if (opts.out) {
-      fs8.writeFileSync(opts.out, JSON.stringify(result, null, 2) + "\n");
+      fs7.writeFileSync(opts.out, JSON.stringify(result, null, 2) + "\n");
     }
     if (global.json) {
       json(result);
@@ -6591,11 +6607,11 @@ function resolveSecurityTierFlag(flag, fromConfig, auto) {
   return auto ? "L1" : "L0";
 }
 function confirm(question) {
-  return new Promise((resolve20) => {
+  return new Promise((resolve21) => {
     const rl = readline.createInterface({ input: process.stdin, output: process.stderr });
     rl.question(`${question} [y/N] `, (answer) => {
       rl.close();
-      resolve20(/^y(es)?$/i.test(answer.trim()));
+      resolve21(/^y(es)?$/i.test(answer.trim()));
     });
   });
 }
@@ -6752,7 +6768,7 @@ async function addCmd(root2, rest, opts, asJson) {
 }
 function readPackageVersion(root2) {
   try {
-    const pkg = JSON.parse(fs8__default.readFileSync(path37__default.join(root2, "package.json"), "utf8"));
+    const pkg = JSON.parse(fs7__default.readFileSync(path37__default.join(root2, "package.json"), "utf8"));
     return typeof pkg.version === "string" ? pkg.version : void 0;
   } catch {
     return void 0;
@@ -6760,7 +6776,7 @@ function readPackageVersion(root2) {
 }
 function readOptionalFile(p) {
   try {
-    const t = fs8__default.readFileSync(p, "utf8");
+    const t = fs7__default.readFileSync(p, "utf8");
     return t.trim() ? t : void 0;
   } catch {
     return void 0;
@@ -6908,8 +6924,8 @@ function registerExport(program) {
       out(content.trimEnd());
       return;
     }
-    fs8.mkdirSync(path37.dirname(path37.resolve(file)), { recursive: true });
-    fs8.writeFileSync(file, content);
+    fs7.mkdirSync(path37.dirname(path37.resolve(file)), { recursive: true });
+    fs7.writeFileSync(file, content);
     info(`${c.green("\u2714")} wrote ${file} ${c.dim(`(${format})`)}`);
   });
   applyGlobalOptions(cmd);
@@ -6932,24 +6948,30 @@ function registerBundle(program) {
     } catch {
       throw new CliError("no grammars found to bundle (run a build first)", ExitCode.ERROR);
     }
-    fs8.mkdirSync(path37.join(outDir, "grammars"), { recursive: true });
+    fs7.mkdirSync(path37.join(outDir, "grammars"), { recursive: true });
     let grammarCount = 0;
     for (const { fileName, absPath } of grammarFiles) {
-      fs8.copyFileSync(absPath, path37.join(outDir, "grammars", fileName));
+      fs7.copyFileSync(absPath, path37.join(outDir, "grammars", fileName));
       grammarCount++;
     }
     const included = [`grammars/ (${grammarCount} .wasm)`];
     const graphSrc = resolveGraphPath(root2, global.graph);
-    if (fs8.existsSync(graphSrc)) {
-      fs8.copyFileSync(graphSrc, path37.join(outDir, "graph.json"));
+    if (fs7.existsSync(graphSrc)) {
+      fs7.copyFileSync(graphSrc, path37.join(outDir, "graph.json"));
       included.push("graph.json");
+    } else {
+      const graph = loadGraphFileWithSnapshot(graphSrc);
+      if (graph) {
+        fs7.writeFileSync(path37.join(outDir, "graph.json"), serializeGraph(graph));
+        included.push("graph.json");
+      }
     }
     const cat = catalogPath(root2);
-    if (fs8.existsSync(cat)) {
-      fs8.copyFileSync(cat, path37.join(outDir, "vibgrate.lib.json"));
+    if (fs7.existsSync(cat)) {
+      fs7.copyFileSync(cat, path37.join(outDir, "vibgrate.lib.json"));
       included.push("vibgrate.lib.json");
-      if (fs8.existsSync(libDir(root2))) {
-        fs8.cpSync(libDir(root2), path37.join(outDir, "lib"), { recursive: true });
+      if (fs7.existsSync(libDir(root2))) {
+        fs7.cpSync(libDir(root2), path37.join(outDir, "lib"), { recursive: true });
         included.push("lib/");
       }
     }
@@ -6961,7 +6983,7 @@ function registerBundle(program) {
       included,
       usage: "Run `vg build --grammars <this dir>/grammars` to build fully offline."
     };
-    fs8.writeFileSync(path37.join(outDir, "MANIFEST.json"), `${stableStringify(manifest, 2)}
+    fs7.writeFileSync(path37.join(outDir, "MANIFEST.json"), `${stableStringify(manifest, 2)}
 `);
     if (global.json) {
       json({ out: path37.relative(root2, outDir), ...manifest });
@@ -6987,7 +7009,7 @@ async function runDoctor(global) {
   const root2 = rootOf(global);
   const local = global.local === true;
   const graphPath = resolveGraphPath(root2, global.graph);
-  const configFile = CONFIG_BASENAMES.find((f) => fs8.existsSync(path37.join(root2, f))) ?? null;
+  const configFile = CONFIG_BASENAMES.find((f) => fs7.existsSync(path37.join(root2, f))) ?? null;
   const graph = loadGraph(root2, graphPath);
   let staleFiles = null;
   if (graph) {
@@ -7020,7 +7042,7 @@ async function runDoctor(global) {
     },
     libCatalog: {
       path: path37.relative(root2, catalogPath(root2)),
-      present: fs8.existsSync(catalogPath(root2)),
+      present: fs7.existsSync(catalogPath(root2)),
       libraries: libCount
     },
     credentials: creds,
@@ -7281,7 +7303,7 @@ function registerDaemon(program) {
     if (!await vgdIsRunning({ socketPath })) {
       throw new CliError(`vgd is not running \u2014 start it with \`vg daemon ensure\` (${socketPath})`, ExitCode.NOT_FOUND);
     }
-    const { loadGraph: loadGraph2 } = await import('./load-SEFJA3M5.js');
+    const { loadGraph: loadGraph2 } = await import('./load-WKIZF2AK.js');
     const { detectGitRef } = await import('./git-ref-RSRAN4OH.js');
     const { repositoryIdFromRoot } = await import('./paths-62AKTFSR.js');
     const opts = this.opts();
@@ -7498,7 +7520,7 @@ function registerPolicy(program) {
     const global = readGlobal(this);
     let raw;
     try {
-      raw = fs8.readFileSync(file, "utf8");
+      raw = fs7.readFileSync(file, "utf8");
     } catch {
       throw new CliError(`cannot read ${file}`, ExitCode.NOT_FOUND);
     }
@@ -7630,7 +7652,7 @@ var initCommand = new Command("init").description("Initialize vibgrate in a proj
     console.log(chalk7.green("\u2714") + ` Created ${chalk7.bold("vibgrate.config.ts")}`);
   }
   if (opts.baseline) {
-    const { runBaseline } = await import('./baseline-QD4HVNVJ.js');
+    const { runBaseline } = await import('./baseline-MROWBNK7.js');
     await runBaseline(rootDir);
   }
   console.log("");
@@ -7740,9 +7762,9 @@ async function fileReferencesIdentifier(rootDir, relFile, identifier, readFile3)
 }
 async function defaultReadFile(absPath) {
   try {
-    const stat2 = await fs21.stat(absPath);
+    const stat2 = await fs20.stat(absPath);
     if (!stat2.isFile() || stat2.size > MAX_FILE_BYTES) return null;
-    return await fs21.readFile(absPath, "utf8");
+    return await fs20.readFile(absPath, "utf8");
   } catch {
     return null;
   }
@@ -8389,7 +8411,7 @@ var SKIP_DIRS2 = /* @__PURE__ */ new Set([
 function scanStaleness(rootDir, artifactPath) {
   let ref;
   try {
-    ref = fs8.statSync(artifactPath).mtimeMs;
+    ref = fs7.statSync(artifactPath).mtimeMs;
   } catch {
     return { stale: false };
   }
@@ -8401,7 +8423,7 @@ function scanStaleness(rootDir, artifactPath) {
     if (depth > 8 || scanned > MAX_ENTRIES) return;
     let entries;
     try {
-      entries = fs8.readdirSync(dir, { withFileTypes: true });
+      entries = fs7.readdirSync(dir, { withFileTypes: true });
     } catch {
       return;
     }
@@ -8416,7 +8438,7 @@ function scanStaleness(rootDir, artifactPath) {
       const abs = path37.join(dir, e.name);
       let mtimeMs;
       try {
-        mtimeMs = fs8.statSync(abs).mtimeMs;
+        mtimeMs = fs7.statSync(abs).mtimeMs;
       } catch {
         continue;
       }
@@ -8553,7 +8575,7 @@ function analyzeTree(root2, packages) {
     if (depth > MAX_DEPTH || filesSeen >= MAX_FILES) return;
     let entries;
     try {
-      entries = fs8.readdirSync(dir, { withFileTypes: true });
+      entries = fs7.readdirSync(dir, { withFileTypes: true });
     } catch {
       return;
     }
@@ -8571,8 +8593,8 @@ function analyzeTree(root2, packages) {
       const full = path37.join(dir, entry.name);
       let content;
       try {
-        if (fs8.statSync(full).size > MAX_FILE_BYTES2) continue;
-        content = fs8.readFileSync(full, "utf8");
+        if (fs7.statSync(full).size > MAX_FILE_BYTES2) continue;
+        content = fs7.readFileSync(full, "utf8");
       } catch {
         continue;
       }
@@ -8940,8 +8962,8 @@ async function fetchLatestVersion() {
 }
 async function writeCache(data) {
   try {
-    await fs21.mkdir(CACHE_DIR, { recursive: true });
-    await fs21.writeFile(CACHE_FILE, JSON.stringify(data), "utf-8");
+    await fs20.mkdir(CACHE_DIR, { recursive: true });
+    await fs20.writeFile(CACHE_FILE, JSON.stringify(data), "utf-8");
   } catch {
   }
 }
@@ -8952,7 +8974,7 @@ function detectGlobalInstall(execPath = process.argv[1] || "", cwd = process.cwd
   if (!execPath) return null;
   let resolved = execPath;
   try {
-    resolved = fs8.realpathSync(execPath);
+    resolved = fs7.realpathSync(execPath);
   } catch {
   }
   const p = resolved.replace(/\\/g, "/");
@@ -9053,11 +9075,11 @@ async function getLocalDependencyState(cwd, pkg = PACKAGE_NAME) {
 async function confirmWorkspaceRoot(pm) {
   if (!(process.stdin.isTTY && process.stdout.isTTY)) return false;
   const rl = readline.createInterface({ input: process.stdin, output: process.stdout });
-  return new Promise((resolve20) => {
+  return new Promise((resolve21) => {
     rl.question(chalk7.yellow(`Update the ${pm} workspace root with -w? [y/N]: `), (ans) => {
       rl.close();
       const t = ans.trim().toLowerCase();
-      resolve20(t === "y" || t === "yes");
+      resolve21(t === "y" || t === "yes");
     });
   });
 }
@@ -9424,14 +9446,14 @@ function promptPlanSelection(response) {
   const defaultIdx = plans.findIndex((p) => p.tier === response.recommended);
   const def = defaultIdx >= 0 ? defaultIdx + 1 : 1;
   const rl = readline.createInterface({ input: process.stdin, output: process.stdout });
-  return new Promise((resolve20) => {
+  return new Promise((resolve21) => {
     rl.question(`Plan [1-${plans.length}, default ${def}, q to cancel]: `, (ans) => {
       rl.close();
       const t = ans.trim().toLowerCase();
-      if (t === "q" || t === "quit") return resolve20(null);
+      if (t === "q" || t === "quit") return resolve21(null);
       const n = t === "" ? def : Number.parseInt(t, 10);
-      if (!Number.isInteger(n) || n < 1 || n > plans.length) return resolve20(null);
-      resolve20(plans[n - 1].tier);
+      if (!Number.isInteger(n) || n < 1 || n > plans.length) return resolve21(null);
+      resolve21(plans[n - 1].tier);
     });
   });
 }
@@ -10265,7 +10287,7 @@ function openUrl(url) {
 }
 
 // src/reporting/commands/login.ts
-var delay = (ms) => new Promise((resolve20) => setTimeout(resolve20, ms));
+var delay = (ms) => new Promise((resolve21) => setTimeout(resolve21, ms));
 function isInside(dir, file) {
   const rel = path37.relative(dir, file);
   return !!rel && !rel.startsWith("..") && !path37.isAbsolute(rel);
@@ -11640,17 +11662,17 @@ function resolveSigningKey(root2, explicit) {
   const chosen = process.env.VG_ATTEST_KEY;
   const keyPath = chosen ? path37.resolve(chosen) : path37.join(root2, ".vibgrate", DEFAULT_KEY);
   let minted = false;
-  if (!fs8.existsSync(keyPath)) {
+  if (!fs7.existsSync(keyPath)) {
     if (chosen) throw new CliError(`signing key not found: ${chosen}`, ExitCode.USAGE_ERROR);
     const kp = generateKeypair();
-    fs8.mkdirSync(path37.dirname(keyPath), { recursive: true });
-    fs8.writeFileSync(keyPath, kp.privatePem, { mode: 384 });
-    fs8.writeFileSync(`${keyPath}.pub`, kp.publicPem);
+    fs7.mkdirSync(path37.dirname(keyPath), { recursive: true });
+    fs7.writeFileSync(keyPath, kp.privatePem, { mode: 384 });
+    fs7.writeFileSync(`${keyPath}.pub`, kp.publicPem);
     minted = true;
   }
   let key2;
   try {
-    key2 = crypto3.createPrivateKey(fs8.readFileSync(keyPath, "utf8"));
+    key2 = crypto3.createPrivateKey(fs7.readFileSync(keyPath, "utf8"));
   } catch {
     throw new CliError(`could not read an Ed25519 private key from ${keyPath}`, ExitCode.USAGE_ERROR);
   }
@@ -11661,8 +11683,8 @@ function resolveSigningKey(root2, explicit) {
 }
 function writeBundle(input) {
   const dir = input.outDir;
-  fs8.mkdirSync(path37.join(dir, "inputs", "releases"), { recursive: true });
-  const write = (rel, data) => fs8.writeFileSync(path37.join(dir, rel), `${JSON.stringify(data, null, 2)}
+  fs7.mkdirSync(path37.join(dir, "inputs", "releases"), { recursive: true });
+  const write = (rel, data) => fs7.writeFileSync(path37.join(dir, rel), `${JSON.stringify(data, null, 2)}
 `);
   write("result.json", input.result);
   write(path37.join("inputs", "advisory.json"), input.advisory);
@@ -11686,13 +11708,13 @@ function writeBundle(input) {
     disclaimer: input.regime.disclaimer
   });
   if (input.envelope) {
-    fs8.writeFileSync(path37.join(dir, "evidence.intoto.jsonl"), `${JSON.stringify(input.envelope)}
+    fs7.writeFileSync(path37.join(dir, "evidence.intoto.jsonl"), `${JSON.stringify(input.envelope)}
 `);
   }
   if (input.timestampToken) {
-    fs8.writeFileSync(path37.join(dir, "timestamp.tsr"), input.timestampToken);
+    fs7.writeFileSync(path37.join(dir, "timestamp.tsr"), input.timestampToken);
   }
-  fs8.writeFileSync(path37.join(dir, "VERIFY.md"), verifyDoc(input));
+  fs7.writeFileSync(path37.join(dir, "VERIFY.md"), verifyDoc(input));
   return dir;
 }
 function verifyDoc(input) {
@@ -12035,7 +12057,7 @@ var packCmd = new Command("pack").description("Build the submission pack a human
   const stage = opts.stage ?? regime.clocks[0]?.stage ?? "early-warning";
   const md = buildPack(result, regime, org, stage);
   if (opts.out) {
-    fs8.writeFileSync(path37.resolve(rootDir, opts.out), md);
+    fs7.writeFileSync(path37.resolve(rootDir, opts.out), md);
     console.error(chalk7.green("\u2714") + ` pack written to ${opts.out}`);
   } else {
     console.log(md);
@@ -12078,19 +12100,19 @@ var drillCmd = new Command("drill").description("Timed dry-run of the determinat
 });
 var verifyCmd = new Command("verify").description("Verify an evidence bundle offline (no Vibgrate needed)").argument("<bundle>", "Path to an evidence bundle directory or evidence.intoto.jsonl").option("--pub <file>", "Public key PEM to pin the signer (establish trust)").action((bundlePath, opts) => {
   const abs = path37.resolve(bundlePath);
-  const envPath = fs8.statSync(abs).isDirectory() ? path37.join(abs, "evidence.intoto.jsonl") : abs;
-  if (!fs8.existsSync(envPath)) throw new CliError(`no evidence.intoto.jsonl at ${bundlePath}`, ExitCode.NOT_FOUND);
-  const envelope = JSON.parse(fs8.readFileSync(envPath, "utf8").trim().split("\n")[0]);
+  const envPath = fs7.statSync(abs).isDirectory() ? path37.join(abs, "evidence.intoto.jsonl") : abs;
+  if (!fs7.existsSync(envPath)) throw new CliError(`no evidence.intoto.jsonl at ${bundlePath}`, ExitCode.NOT_FOUND);
+  const envelope = JSON.parse(fs7.readFileSync(envPath, "utf8").trim().split("\n")[0]);
   const resultPath = path37.join(path37.dirname(envPath), "result.json");
-  const result = fs8.existsSync(resultPath) ? JSON.parse(fs8.readFileSync(resultPath, "utf8")) : void 0;
-  const publicKeyPem = opts.pub ? fs8.readFileSync(path37.resolve(opts.pub), "utf8") : void 0;
+  const result = fs7.existsSync(resultPath) ? JSON.parse(fs7.readFileSync(resultPath, "utf8")) : void 0;
+  const publicKeyPem = opts.pub ? fs7.readFileSync(path37.resolve(opts.pub), "utf8") : void 0;
   const v = verifyEvidenceEnvelope(envelope, { publicKeyPem, result });
   const color = v.status === "verified" ? chalk7.green : v.status === "failed" ? chalk7.red : chalk7.yellow;
   console.log("  " + color(v.status.toUpperCase()) + `  ${v.reason}`);
   if (v.evidenceId) console.log("  " + chalk7.dim(`evidence ${v.evidenceId} \xB7 regime ${v.regime} \xB7 advisory ${v.advisoryId} \xB7 ${v.overallStatus}`));
   const tsrPath = path37.join(path37.dirname(envPath), "timestamp.tsr");
-  if (fs8.existsSync(tsrPath) && result) {
-    const t = verifyTimestamp(fs8.readFileSync(tsrPath), exposureSubjectDigest(result));
+  if (fs7.existsSync(tsrPath) && result) {
+    const t = verifyTimestamp(fs7.readFileSync(tsrPath), exposureSubjectDigest(result));
     const tcolor = t.imprintMatches ? chalk7.green : chalk7.red;
     console.log("  " + tcolor("TIMESTAMP") + `  ${t.reason}`);
   }
@@ -12189,9 +12211,9 @@ var pushCmd = new Command("push").description("Push the product registry (and an
   let exposure;
   if (opts.result) {
     const raw = path37.resolve(rootDir, opts.result);
-    const resultPath = fs8.existsSync(raw) && fs8.statSync(raw).isDirectory() ? path37.join(raw, "result.json") : raw;
-    if (!fs8.existsSync(resultPath)) throw new CliError(`no result.json at ${opts.result}`, ExitCode.NOT_FOUND);
-    exposure = JSON.parse(fs8.readFileSync(resultPath, "utf8"));
+    const resultPath = fs7.existsSync(raw) && fs7.statSync(raw).isDirectory() ? path37.join(raw, "result.json") : raw;
+    if (!fs7.existsSync(resultPath)) throw new CliError(`no result.json at ${opts.result}`, ExitCode.NOT_FOUND);
+    exposure = JSON.parse(fs7.readFileSync(resultPath, "utf8"));
   }
   const payload = { schemaVersion: "evidence-push-1", regime: regime.id, generatedAt: nowIso(), signed: Boolean(opts.signed), products: productPayload, exposure };
   const body = JSON.stringify(payload);
@@ -12381,7 +12403,7 @@ function dispatch(argv, cwd) {
   }
   const looksLikeQuestion = /\s/.test(first) || first.endsWith("?");
   if (looksLikeQuestion) return ["ask", ...args];
-  if (fs8.existsSync(path37.resolve(cwd, first))) {
+  if (fs7.existsSync(path37.resolve(cwd, first))) {
     return [hasBuildOnlyFlag(args) ? "build" : "scan", ...args];
   }
   const moved = MOVED_COMMANDS[first];