@vibgrate/cli 2026.728.5 → 2026.729.2

package/dist/cli.js

@@ -1,12 +1,12 @@
 #!/usr/bin/env node
-import { sha256Hex, generateKeypair, dssePae, DSSE_PAYLOAD_TYPE, keyId, registerBuild, readGlobal, applyGlobalOptions, ProgressBar, printLogo, fetchCatalog, resolveProviders, runBuild } from './chunk-643KXZ54.js';
-export { runBuild } from './chunk-643KXZ54.js';
+import { sha256Hex, generateKeypair, dssePae, DSSE_PAYLOAD_TYPE, keyId, registerBuild, readGlobal, applyGlobalOptions, ProgressBar, printLogo, fetchCatalog, resolveProviders, runBuild } from './chunk-QDZ47G45.js';
+export { runBuild } from './chunk-QDZ47G45.js';
 import { CONTEXT_POLICY_VERSION, computeFcsReport, renderFcsReportMarkdown, createTrajectoryCollector, runAgent } from './chunk-2ZHWF7C6.js';
-import { loadAdvancedScanHook, baselineCommand } from './chunk-SGI5ZP2Y.js';
+import { loadAdvancedScanHook, baselineCommand } from './chunk-F6ZPUKED.js';
 import { runCodeSession } from './chunk-PRGCCW7D.js';
 import { summarizeDiffs, ScriptedProvider } from './chunk-RZEXHDCF.js';
 import { disableColor, info, c, json, out } from './chunk-CT5BS56U.js';
-import { VGD_PROTOCOL_VERSION, startVgdServer } from './chunk-EVWW3BPM.js';
+import { VGD_PROTOCOL_VERSION, startVgdServer } from './chunk-74ZMAOVF.js';
 import './chunk-5I4VSBWQ.js';
 import './chunk-IS7VTH2Q.js';
 import { init_resolve_ollama, gatherSystemMemory, resolveOllamaBinary, hasOllamaBinary, resolve_ollama_exports } from './chunk-OWSFZQOP.js';
@@ -21,12 +21,12 @@ import { buildIdentifierTrieFromGraph } from './chunk-JIBOJTGS.js';
 import './chunk-7AVYKZEM.js';
 import { buildModelInstallPlan } from './chunk-WHJMS7XC.js';
 import { ensurePackage, ensureUnavailableMessage } from './chunk-REIGWTTH.js';
-import { serveStdio, exportGraph, GraphSource, createServer, formatForExt } from './chunk-NH5NJ3UO.js';
-import { CliError, ExitCode, refreshIfStale, driftCount, ASSISTANTS, detectAssistants, usageError, detectServeLaunch, installAssistant, writeNavigationConfig, uninstallAssistant, buildGraph, writeSnapshot, probeFreshness, discover, assistantById, SMALL_REPO_FILES, SKIP_DIRS, SKIP_FILES } from './chunk-RCP2KQGG.js';
-import { resolveDsn, resolveIngestHost, dashHostForIngestHost, availableRegionIds, createWorkspaceDsn, writeStoredCredentials, credentialsPath, findGitRoot, ensureGitignored, gitignoreEntryForCredentials, clearStoredCredentials, parseDsn as parseDsn$1, uploadScanArtifact, ingestHostForRegionId, dsnCommand, pushCommand, countTokens, shortestPath, pathDisconnect, testsToRun, detectRunner, coveringTests, FREE_PACK, readScanArtifact, publishPrivateLibrary, assessDocQuality, symbolsFromApi, fetchHostedDocsCached, selectForBudget, hostedBase, readStoredCredentials, projectCredentialsPath, homeCredentialsPath } from './chunk-VBVY733D.js';
+import { serveStdio, exportGraph, GraphSource, createServer, formatForExt } from './chunk-PXXVLX7K.js';
+import { CliError, ExitCode, refreshIfStale, driftCount, ASSISTANTS, detectAssistants, usageError, detectServeLaunch, installAssistant, writeNavigationConfig, uninstallAssistant, buildGraph, writeSnapshot, probeFreshness, discover, assistantById, SMALL_REPO_FILES, SKIP_DIRS, SKIP_FILES } from './chunk-CYC3ZI32.js';
+import { resolveDsn, resolveIngestHost, dashHostForIngestHost, availableRegionIds, createWorkspaceDsn, writeStoredCredentials, credentialsPath, findGitRoot, ensureGitignored, gitignoreEntryForCredentials, clearStoredCredentials, parseDsn as parseDsn$1, uploadScanArtifact, ingestHostForRegionId, dsnCommand, pushCommand, countTokens, shortestPath, pathDisconnect, testsToRun, detectRunner, coveringTests, FREE_PACK, readScanArtifact, publishPrivateLibrary, assessDocQuality, symbolsFromApi, fetchHostedDocsCached, selectForBudget, hostedBase, readStoredCredentials, projectCredentialsPath, homeCredentialsPath } from './chunk-67YG3R5F.js';
 import './chunk-IPICO2RV.js';
 import { inventory, enrichOnline, ECOSYSTEMS, catalogPath, libDir, loadCatalog, driftFor, addLibrary, resolveLib, libId, resolveVersion, readDoc, localPackageDocs, localApiSurface } from './chunk-G4HTI4ZM.js';
-import { writeDefaultConfig, parseDsn, detectVcs, computeRepoFingerprint, resolveRepositoryName, fetchScanPreflight, runCoreScan, VERSION, loadConfig, prepareCompressedUpload, computeDriftScore, titleBox, projectTypeToVulnEcosystem, driftBar, gitHistoryAvailable, buildVersionTimelines, findPackageAnyEcosystem, normalizeConstraint, findVersionCrossings, versionSatisfies, PROJECT_TYPE_TO_OSV_ECOSYSTEM, fetchRiskySymbols } from './chunk-4JD63RUR.js';
+import { writeDefaultConfig, parseDsn, detectVcs, computeRepoFingerprint, resolveRepositoryName, fetchScanPreflight, runCoreScan, loadConfig, prepareCompressedUpload, computeDriftScore, titleBox, projectTypeToVulnEcosystem, driftBar, gitHistoryAvailable, buildVersionTimelines, findPackageAnyEcosystem, normalizeConstraint, findVersionCrossings, versionSatisfies, PROJECT_TYPE_TO_OSV_ECOSYSTEM, fetchRiskySymbols } from './chunk-HDQG3QYV.js';
 import { recordCliCall, CLI_TOOL_ALIASES, savingsLedgerPath, clearSavings, readSavings, readUsage, readModelSavings, CAPSULE_RANKING_VERSION, SAVINGS_TOOLS, sanitizeClient } from './chunk-US2DAKCM.js';
 import { ensureDir, pathExists, readJsonFile, writeTextFile, writeJsonFile } from './chunk-CRAMOEBE.js';
 import { resolveOne } from './chunk-J7LKEB2R.js';
@@ -36,15 +36,16 @@ import { init_cli_invocation, resolveCliInvocation, NPX_INVOCATION } from './chu
 import { freeBytesOnVolume, weightStoreDir, listCachedWeights, ensureWeightCached, catalogIntegrityReport } from './chunk-OV4KGXPD.js';
 import { resolvedGrammarFiles, grammarSetVersion } from './chunk-UTNNGKKX.js';
 import './chunk-RXP66R2E.js';
-import { resolveGraphPath, renderReport, loadGraph, writeArtifacts, vibgrateDir, SCHEMA_VERSION } from './chunk-RYNAK4LK.js';
-import { cacheDir, stableStringify } from './chunk-ZKNB4YH4.js';
+import { resolveGraphPath, renderReport, loadGraph, loadGraphFileWithSnapshot, writeArtifacts, vibgrateDir, mapFileExists, SCHEMA_VERSION } from './chunk-P3QIO4ZU.js';
+import { VERSION } from './chunk-WQE4OIZS.js';
+import { cacheDir, serializeGraph, stableStringify } from './chunk-ZKNB4YH4.js';
 import './chunk-BWPBB45M.js';
 import { canonicalize, hashString, hashBytes } from './chunk-JFGYT6BI.js';
 import './chunk-BPF3YX2U.js';
 import { pathExists as pathExists$1, parseExcludePatterns } from './chunk-GI6W53LM.js';
 import { __toCommonJS } from './chunk-Z6ZWNWWR.js';
-import * as fs8 from 'fs';
-import fs8__default, { realpathSync } from 'fs';
+import * as fs7 from 'fs';
+import fs7__default, { realpathSync } from 'fs';
 import * as path37 from 'path';
 import path37__default from 'path';
 import { fileURLToPath, pathToFileURL } from 'url';
@@ -52,11 +53,12 @@ import { Command, CommanderError, Option } from 'commander';
 import * as os from 'os';
 import * as crypto3 from 'crypto';
 import { randomUUID } from 'crypto';
+import * as semver3 from 'semver';
+import semver3__default from 'semver';
 import { execSync, spawn, spawnSync, execFileSync } from 'child_process';
 import * as readline from 'readline';
 import chalk7 from 'chalk';
-import * as fs21 from 'fs/promises';
-import semver2 from 'semver';
+import * as fs20 from 'fs/promises';
 
 init_cli_invocation();
 function registerStatus(program) {
@@ -69,7 +71,7 @@ async function runStatus(global) {
   const root2 = path37.resolve(global.cwd ?? ".");
   const graphPath = resolveGraphPath(root2, global.graph);
   const graph = loadGraph(root2, graphPath);
-  const hasCache = fs8.existsSync(path37.join(cacheDir(root2), "parse-cache.json"));
+  const hasCache = fs7.existsSync(path37.join(cacheDir(root2), "parse-cache.json"));
   let stale = null;
   let staleExact = false;
   if (graph) {
@@ -866,14 +868,14 @@ function isCI(env = process.env) {
 function installId(env = process.env) {
   if (telemetryOptOut(env) !== null || isCI(env)) return randomUuid();
   try {
-    const existing = fs8.readFileSync(INSTALL_ID_FILE, "utf8").trim();
+    const existing = fs7.readFileSync(INSTALL_ID_FILE, "utf8").trim();
     if (isUuid(existing)) return existing;
   } catch {
   }
   const id = randomUuid();
   try {
-    fs8.mkdirSync(INSTALL_ID_DIR, { recursive: true });
-    fs8.writeFileSync(INSTALL_ID_FILE, id + "\n", { mode: 384 });
+    fs7.mkdirSync(INSTALL_ID_DIR, { recursive: true });
+    fs7.writeFileSync(INSTALL_ID_FILE, id + "\n", { mode: 384 });
   } catch {
   }
   return id;
@@ -897,7 +899,7 @@ function ledgerFilePath(root2) {
 }
 function readOffset(root2) {
   try {
-    const raw = JSON.parse(fs8.readFileSync(offsetPath(root2), "utf8"));
+    const raw = JSON.parse(fs7.readFileSync(offsetPath(root2), "utf8"));
     return typeof raw.offset === "number" && raw.offset >= 0 ? raw.offset : 0;
   } catch {
     return 0;
@@ -905,8 +907,8 @@ function readOffset(root2) {
 }
 function writeOffset(root2, offset) {
   try {
-    fs8.mkdirSync(cacheDir(root2), { recursive: true });
-    fs8.writeFileSync(offsetPath(root2), JSON.stringify({ offset }) + "\n");
+    fs7.mkdirSync(cacheDir(root2), { recursive: true });
+    fs7.writeFileSync(offsetPath(root2), JSON.stringify({ offset }) + "\n");
   } catch {
   }
 }
@@ -914,7 +916,7 @@ function buildBatch(root2, fromOffset, id = installId()) {
   const file = ledgerFilePath(root2);
   let size = 0;
   try {
-    size = fs8.statSync(file).size;
+    size = fs7.statSync(file).size;
   } catch {
     return { batch: null, newOffset: 0 };
   }
@@ -922,13 +924,13 @@ function buildBatch(root2, fromOffset, id = installId()) {
   if (start >= size) return { batch: null, newOffset: size };
   let text = "";
   try {
-    const fd = fs8.openSync(file, "r");
+    const fd = fs7.openSync(file, "r");
     try {
       const buf = Buffer.alloc(size - start);
-      fs8.readSync(fd, buf, 0, buf.length, start);
+      fs7.readSync(fd, buf, 0, buf.length, start);
       text = buf.toString("utf8");
     } finally {
-      fs8.closeSync(fd);
+      fs7.closeSync(fd);
     }
   } catch {
     return { batch: null, newOffset: fromOffset };
@@ -1069,7 +1071,7 @@ function liveStatsDir(root2) {
 function reapOtherVersionServers(dir, keepVersion, now = Date.now(), kill = (pid, signal) => process.kill(pid, signal), selfPid = process.pid) {
   let entries;
   try {
-    entries = fs8.readdirSync(dir);
+    entries = fs7.readdirSync(dir);
   } catch {
     return [];
   }
@@ -1078,7 +1080,7 @@ function reapOtherVersionServers(dir, keepVersion, now = Date.now(), kill = (pid
     if (!/^serve-\d+\.json$/.test(name)) continue;
     let parsed;
     try {
-      parsed = JSON.parse(fs8.readFileSync(path37.join(dir, name), "utf8"));
+      parsed = JSON.parse(fs7.readFileSync(path37.join(dir, name), "utf8"));
     } catch {
       continue;
     }
@@ -1132,10 +1134,10 @@ var LiveStatsBus = class {
     this.lastWriteAt = now;
     const body = { pid: this.pid, updatedAt: now, version: VERSION, snapshot: snap };
     try {
-      fs8.mkdirSync(this.dir, { recursive: true });
+      fs7.mkdirSync(this.dir, { recursive: true });
       const tmp = `${this.file}.tmp`;
-      fs8.writeFileSync(tmp, JSON.stringify(body));
-      fs8.renameSync(tmp, this.file);
+      fs7.writeFileSync(tmp, JSON.stringify(body));
+      fs7.renameSync(tmp, this.file);
     } catch {
     }
   }
@@ -1146,7 +1148,7 @@ var LiveStatsBus = class {
   siblings(now = Date.now()) {
     let entries;
     try {
-      entries = fs8.readdirSync(this.dir);
+      entries = fs7.readdirSync(this.dir);
     } catch {
       return [];
     }
@@ -1156,14 +1158,14 @@ var LiveStatsBus = class {
       const file = path37.join(this.dir, name);
       let parsed;
       try {
-        parsed = JSON.parse(fs8.readFileSync(file, "utf8"));
+        parsed = JSON.parse(fs7.readFileSync(file, "utf8"));
       } catch {
         continue;
       }
       if (typeof parsed?.pid !== "number" || typeof parsed.updatedAt !== "number" || !parsed.snapshot?.totals) continue;
       if (now - parsed.updatedAt > STALE_MS) {
         try {
-          fs8.unlinkSync(file);
+          fs7.unlinkSync(file);
         } catch {
         }
         continue;
@@ -1175,7 +1177,7 @@ var LiveStatsBus = class {
   }
   unlinkOwn = () => {
     try {
-      fs8.unlinkSync(this.file);
+      fs7.unlinkSync(this.file);
     } catch {
     }
   };
@@ -1488,12 +1490,12 @@ var LedgerTail = class {
     if (size === this.offset) return;
     let chunk;
     try {
-      const fd = fs8.openSync(this.file, "r");
+      const fd = fs7.openSync(this.file, "r");
       try {
         chunk = Buffer.alloc(size - this.offset);
-        fs8.readSync(fd, chunk, 0, chunk.length, this.offset);
+        fs7.readSync(fd, chunk, 0, chunk.length, this.offset);
       } finally {
-        fs8.closeSync(fd);
+        fs7.closeSync(fd);
       }
     } catch {
       return;
@@ -1506,7 +1508,7 @@ var LedgerTail = class {
   }
   sizeOf() {
     try {
-      return fs8.statSync(this.file).size;
+      return fs7.statSync(this.file).size;
     } catch {
       return 0;
     }
@@ -1589,7 +1591,7 @@ function registerServe(program) {
 }
 async function ensureServableGraph(root2, graphPath, global, refresh, opts = {}) {
   if (refresh) {
-    if (!fs8.existsSync(graphPath)) {
+    if (!mapFileExists(graphPath)) {
       info(c.dim("vg \xB7 no map found \u2014 building it before serving\u2026"));
       await runBuild(
         [],
@@ -1615,7 +1617,7 @@ async function ensureServableGraph(root2, graphPath, global, refresh, opts = {})
       if (opts.awaitStaleRefresh) await kick;
     }
   }
-  if (!fs8.existsSync(graphPath)) {
+  if (!mapFileExists(graphPath)) {
     throw new CliError(
       `no map found at ${graphPath} \u2014 run \`vg\` to build one first`,
       ExitCode.NOT_FOUND
@@ -1898,7 +1900,7 @@ function manifestHash(root2) {
   const walk2 = (dir) => {
     let entries;
     try {
-      entries = fs8.readdirSync(dir, { withFileTypes: true });
+      entries = fs7.readdirSync(dir, { withFileTypes: true });
     } catch {
       return;
     }
@@ -1914,7 +1916,7 @@ function manifestHash(root2) {
       if (!isManifest(abs) && !SKIP_FILES.has(base)) continue;
       try {
         const rel = path37.relative(root2, abs).split(path37.sep).join("/");
-        files.push({ rel, hash: hashBytes(fs8.readFileSync(abs)) });
+        files.push({ rel, hash: hashBytes(fs7.readFileSync(abs)) });
       } catch {
       }
     }
@@ -1933,7 +1935,7 @@ function isDependencyFile(root2, filePath) {
 }
 function loadScanCache(root2, key2) {
   try {
-    const raw = JSON.parse(fs8.readFileSync(cachePath(root2), "utf8"));
+    const raw = JSON.parse(fs7.readFileSync(cachePath(root2), "utf8"));
     if (raw.version === CACHE_VERSION && raw.manifestHash === key2.manifestHash && raw.toolVersion === key2.toolVersion && raw.offline === key2.offline && raw.artifact) {
       return { manifestHash: raw.manifestHash, artifact: raw.artifact };
     }
@@ -1943,8 +1945,8 @@ function loadScanCache(root2, key2) {
 }
 function writeScanCache(root2, key2, artifact) {
   try {
-    fs8.mkdirSync(cacheDir(root2), { recursive: true });
-    fs8.writeFileSync(
+    fs7.mkdirSync(cacheDir(root2), { recursive: true });
+    fs7.writeFileSync(
       cachePath(root2),
       stableStringify(
         { version: CACHE_VERSION, manifestHash: key2.manifestHash, toolVersion: key2.toolVersion, offline: key2.offline, artifact },
@@ -2758,7 +2760,7 @@ var VibgrateLanguageServer = class {
       const absManifest = path37.resolve(this.opts.root, relManifest);
       let text = null;
       try {
-        if (fs8.existsSync(absManifest)) text = fs8.readFileSync(absManifest, "utf8");
+        if (fs7.existsSync(absManifest)) text = fs7.readFileSync(absManifest, "utf8");
       } catch {
         text = null;
       }
@@ -2977,9 +2979,19 @@ function osvEcosystem(type) {
       return null;
   }
 }
+function inRangeStep(dep) {
+  const target = dep.latestSatisfying;
+  if (!target || !dep.resolvedVersion) return null;
+  if (!semver3.valid(target) || !semver3.valid(dep.resolvedVersion)) return null;
+  if (!semver3.gt(target, dep.resolvedVersion)) return null;
+  const diff2 = semver3.diff(dep.resolvedVersion, target);
+  return { version: target, size: diff2 === "patch" || diff2 === "prepatch" ? "patch" : "minor" };
+}
 function inlineLabel(dep) {
   const bits = [];
   if (dep.drift === "major-behind") {
+    const step2 = inRangeStep(dep);
+    if (step2) bits.push(`${step2.size} behind`, step2.version);
     const n = dep.majorsBehind ?? 1;
     bits.push(`${n} major behind`);
   } else if (dep.drift === "minor-behind") {
@@ -3024,6 +3036,10 @@ function hoverMarkdown(dep, contribution) {
     lines.push(`| | |`);
     lines.push(`|---|---|`);
     lines.push(`| yours | \`${yours}\` |`);
+    const step2 = inRangeStep(dep);
+    if (step2 && step2.version !== dep.latestStable) {
+      lines.push(`| latest in range | \`${step2.version}\` |`);
+    }
     lines.push(`| latest | \`${dep.latestStable}\` |`);
     const journey = versionJourney(yours, dep.latestStable);
     if (journey) lines.push(`| journey | ${journey} |`);
@@ -3063,7 +3079,7 @@ function hoverMarkdown(dep, contribution) {
   return lines.join("\n");
 }
 function startLanguageServer(opts) {
-  if (!fs8.existsSync(opts.root)) {
+  if (!fs7.existsSync(opts.root)) {
     process.stderr.write(`vg lsp: root does not exist: ${opts.root}
 `);
     process.exit(1);
@@ -3201,7 +3217,7 @@ function registerShare(program) {
     const global = readGlobal(this);
     const root2 = rootOf(global);
     const gitDir = path37.join(root2, ".git");
-    if (!fs8.existsSync(gitDir)) {
+    if (!fs7.existsSync(gitDir)) {
       throw new CliError("not a git repository \u2014 run `vg share` inside a git repo", ExitCode.USAGE_ERROR);
     }
     if (opts.undo) {
@@ -3223,22 +3239,22 @@ function registerShare(program) {
 }
 function writeVibgrateGitignore(root2, reports) {
   const dir = path37.join(root2, ".vibgrate");
-  fs8.mkdirSync(dir, { recursive: true });
-  const lines = ["# Managed by `vg share` \u2014 keep graph.json committed, ignore the rest", "cache/", "facts.jsonl"];
+  fs7.mkdirSync(dir, { recursive: true });
+  const lines = ["# Managed by `vg share` \u2014 keep graph.json committed, ignore the rest", "cache/", "facts.jsonl", "graph.snap"];
   if (!reports) lines.push("graph.html", "GRAPH_REPORT.md");
-  fs8.writeFileSync(path37.join(dir, ".gitignore"), `${lines.join("\n")}
+  fs7.writeFileSync(path37.join(dir, ".gitignore"), `${lines.join("\n")}
 `);
 }
 function writeGitAttributes(root2) {
   const file = path37.join(root2, ".gitattributes");
   const line = ".vibgrate/graph.json merge=vg";
-  let content = fs8.existsSync(file) ? fs8.readFileSync(file, "utf8") : "";
+  let content = fs7.existsSync(file) ? fs7.readFileSync(file, "utf8") : "";
   if (!content.split("\n").some((l) => l.trim() === line)) {
     content = content.length ? `${content.replace(/\s*$/, "")}
 ${line}
 ` : `${line}
 `;
-    fs8.writeFileSync(file, content);
+    fs7.writeFileSync(file, content);
   }
 }
 function configureMergeDriver(root2) {
@@ -3247,7 +3263,7 @@ function configureMergeDriver(root2) {
 }
 function installPreCommitHook(root2) {
   const hooksDir = hookDir(root2);
-  fs8.mkdirSync(hooksDir, { recursive: true });
+  fs7.mkdirSync(hooksDir, { recursive: true });
   const file = path37.join(hooksDir, "pre-commit");
   const block = [
     HOOK_BEGIN,
@@ -3257,7 +3273,7 @@ function installPreCommitHook(root2) {
     "fi",
     HOOK_END
   ].join("\n");
-  let content = fs8.existsSync(file) ? fs8.readFileSync(file, "utf8") : "#!/bin/sh\n";
+  let content = fs7.existsSync(file) ? fs7.readFileSync(file, "utf8") : "#!/bin/sh\n";
   const re = new RegExp(`${escapeRe(HOOK_BEGIN)}[\\s\\S]*?${escapeRe(HOOK_END)}`);
   if (re.test(content)) content = content.replace(re, block);
   else content = `${content.replace(/\s*$/, "")}
@@ -3266,21 +3282,21 @@ ${block}
 `;
   if (!content.startsWith("#!")) content = `#!/bin/sh
 ${content}`;
-  fs8.writeFileSync(file, content);
-  fs8.chmodSync(file, 493);
+  fs7.writeFileSync(file, content);
+  fs7.chmodSync(file, 493);
 }
 function undo(root2) {
   const hookFile = path37.join(hookDir(root2), "pre-commit");
-  if (fs8.existsSync(hookFile)) {
+  if (fs7.existsSync(hookFile)) {
     const re = new RegExp(`\\n*${escapeRe(HOOK_BEGIN)}[\\s\\S]*?${escapeRe(HOOK_END)}\\n*`);
-    const next2 = fs8.readFileSync(hookFile, "utf8").replace(re, "\n");
-    if (next2.trim() === "#!/bin/sh") fs8.rmSync(hookFile);
-    else fs8.writeFileSync(hookFile, next2);
+    const next2 = fs7.readFileSync(hookFile, "utf8").replace(re, "\n");
+    if (next2.trim() === "#!/bin/sh") fs7.rmSync(hookFile);
+    else fs7.writeFileSync(hookFile, next2);
   }
   const attr = path37.join(root2, ".gitattributes");
-  if (fs8.existsSync(attr)) {
-    const next2 = fs8.readFileSync(attr, "utf8").split("\n").filter((l) => l.trim() !== ".vibgrate/graph.json merge=vg").join("\n");
-    fs8.writeFileSync(attr, next2);
+  if (fs7.existsSync(attr)) {
+    const next2 = fs7.readFileSync(attr, "utf8").split("\n").filter((l) => l.trim() !== ".vibgrate/graph.json merge=vg").join("\n");
+    fs7.writeFileSync(attr, next2);
   }
   try {
     git(root2, ["config", "--remove-section", "merge.vg"]);
@@ -3323,7 +3339,7 @@ function registerWatch(program) {
     const debounceMs = Math.max(50, Number(opts.debounce) || DEFAULT_DEBOUNCE_MS);
     const watchRoots = (paths.length ? paths : ["."]).map((p) => path37.resolve(root2, p));
     for (const w of watchRoots) {
-      if (!fs8.existsSync(w)) {
+      if (!fs7.existsSync(w)) {
         throw new CliError(`watch path not found: ${w}`, ExitCode.USAGE_ERROR);
       }
     }
@@ -3376,7 +3392,7 @@ function registerWatch(program) {
     const watchers = [];
     for (const w of watchRoots) {
       try {
-        const watcher = fs8.watch(w, { recursive: true }, (_event, filename) => {
+        const watcher = fs7.watch(w, { recursive: true }, (_event, filename) => {
           if (!filename) {
             schedule("change");
             return;
@@ -3729,7 +3745,7 @@ function loadStandards(root2) {
     const p = path37__default.join(root2, rel);
     let text;
     try {
-      text = fs8__default.readFileSync(p, "utf8");
+      text = fs7__default.readFileSync(p, "utf8");
     } catch {
       continue;
     }
@@ -5660,7 +5676,7 @@ function registerModels(program) {
         );
       }
     } else {
-      if (!target.path || !fs8.existsSync(target.path)) {
+      if (!target.path || !fs7.existsSync(target.path)) {
         throw new CliError(
           `model file not found at ${target.path || "(unknown path)"} \u2014 it may already be removed.`,
           ExitCode.NOT_FOUND
@@ -5674,7 +5690,7 @@ function registerModels(program) {
       }
       if (!global.json) info(c.dim(`  $ rm ${target.path}`));
       try {
-        fs8.unlinkSync(target.path);
+        fs7.unlinkSync(target.path);
       } catch (e) {
         const msg = e instanceof Error ? e.message : String(e);
         throw new CliError(`could not delete ${target.path}: ${msg}`, ExitCode.ERROR);
@@ -5813,8 +5829,8 @@ function registerModels(program) {
     });
     if (opts.out) {
       const outPath = path37.resolve(opts.out);
-      fs8.mkdirSync(path37.dirname(outPath), { recursive: true });
-      fs8.writeFileSync(outPath, `${JSON.stringify(report, null, 2)}
+      fs7.mkdirSync(path37.dirname(outPath), { recursive: true });
+      fs7.writeFileSync(outPath, `${JSON.stringify(report, null, 2)}
 `);
       if (!global.json) info(c.dim(`  wrote ${outPath}`));
     }
@@ -6012,7 +6028,7 @@ function codeConfigPath(root2) {
 }
 function loadCodeConfig(root2) {
   try {
-    const raw = JSON.parse(fs8.readFileSync(codeConfigPath(root2), "utf8"));
+    const raw = JSON.parse(fs7.readFileSync(codeConfigPath(root2), "utf8"));
     return sanitize(raw);
   } catch {
     return {};
@@ -6079,7 +6095,7 @@ function contextBudgetFor(config, modelContextWindow) {
 var MCP_CONFIG_FILES = [".cursor/mcp.json", ".vscode/mcp.json", ".mcp.json"];
 function readMcpServersFile(file) {
   try {
-    const raw = JSON.parse(fs8.readFileSync(file, "utf8"));
+    const raw = JSON.parse(fs7.readFileSync(file, "utf8"));
     const map = raw.mcpServers ?? raw.servers;
     return map && typeof map === "object" ? parseMcpServers(map) : {};
   } catch {
@@ -6119,7 +6135,7 @@ function registerCode(program) {
       try {
         const { parseMode: parseMode2, resolveMode: resolveMode2, readOrchestratorState: readOrchestratorState2, activePin: activePin2 } = await import('./model-orchestrator-LHYPJBFH.js');
         const { gatherSystemMemory: gatherSystemMemory2 } = await import('./local-runtime-2ED33KK6.js');
-        const { loadGraph: loadGraph2 } = await import('./load-SEFJA3M5.js');
+        const { loadGraph: loadGraph2 } = await import('./load-4MLIHGXF.js');
         const state = readOrchestratorState2();
         const mode = parseMode2(modeFlag) ?? state.defaultMode ?? void 0;
         const pin = mode ? activePin2(mode, state) : null;
@@ -6203,7 +6219,7 @@ function registerCode(program) {
       if (!(process.stdin.isTTY && process.stdout.isTTY)) {
         throw usageError('say what to change, e.g. `vg code "add a --timeout flag to the scan command"` (guided mode needs an interactive terminal)');
       }
-      const { runInteractive } = await import('./interactive-KVDKRKNK.js');
+      const { runInteractive } = await import('./interactive-HLGJJFLI.js');
       await runInteractive(
         rootOf(global),
         global,
@@ -6236,7 +6252,7 @@ function registerCode(program) {
     let mockReply;
     if (opts.mock) {
       try {
-        mockReply = fs8.readFileSync(opts.mock, "utf8");
+        mockReply = fs7.readFileSync(opts.mock, "utf8");
       } catch {
         throw new CliError(`couldn't read the --mock file: ${opts.mock}`, ExitCode.USAGE_ERROR);
       }
@@ -6292,11 +6308,11 @@ function registerCode(program) {
         const { loadOrDiscoverFederation } = await import('./federation-MDQPO3PW.js');
         const { resolveExecutionEnv } = await import('./execution-env-4MS5AYAN.js');
         const { resolveModelExecutionProfile, mergeModelExecutionProfile } = await import('./model-execution-profile-ELWF3Z6H.js');
-        const { startCodeRuntimeSession } = await import('./runtime-session-4IACVDSY.js');
+        const { startCodeRuntimeSession } = await import('./runtime-session-5M6QZZOS.js');
         const { resolveGraphBackend } = await import('./graph-backend-GBL33GMW.js');
         const { detectGitRef } = await import('./git-ref-RSRAN4OH.js');
         const { repositoryIdFromRoot } = await import('./paths-62AKTFSR.js');
-        const { vgdRequest: vgdRequest2 } = await import('./vgd-KDQFS33M.js');
+        const { vgdRequest: vgdRequest2 } = await import('./vgd-TGGEAGQZ.js');
         const federation = loadOrDiscoverFederation(root2);
         const modelProfile = mergeModelExecutionProfile(
           resolveModelExecutionProfile({
@@ -6342,7 +6358,7 @@ ${res.stderr}` : ""),
             exitCode: res.status ?? 1
           };
         };
-        const { createVgBuiltinMcpTools, mergeExternalToolsets } = await import('./vg-mcp-bridge-B35WCSAS.js');
+        const { createVgBuiltinMcpTools, mergeExternalToolsets } = await import('./vg-mcp-bridge-ZCKBYQ2D.js');
         const vgBuiltin = createVgBuiltinMcpTools({
           getGraph: () => graph,
           root: root2,
@@ -6424,7 +6440,7 @@ ${res.stderr}` : ""),
       if (!autonomous && !tty) {
         throw usageError("the agent approves each edit/command \u2014 run in a terminal to approve interactively, or pass --auto to run autonomously (or --single for a one-shot diff).");
       }
-      const { agentTask } = await import('./interactive-KVDKRKNK.js');
+      const { agentTask } = await import('./interactive-HLGJJFLI.js');
       const { nodeCodeFs } = await import('./session-2JT4AUZT.js');
       const { TtyPrompter } = await import('./ui-K7D3BCHD.js');
       let priorSummary;
@@ -6434,7 +6450,7 @@ ${res.stderr}` : ""),
         if (prev) priorSummary = summarizeSession(prev);
       }
       const prompter = tty ? new TtyPrompter() : void 0;
-      const { createVgBuiltinMcpTools, mergeExternalToolsets } = await import('./vg-mcp-bridge-B35WCSAS.js');
+      const { createVgBuiltinMcpTools, mergeExternalToolsets } = await import('./vg-mcp-bridge-ZCKBYQ2D.js');
       const vgBuiltin = createVgBuiltinMcpTools({
         getGraph: () => graph,
         root: root2,
@@ -6458,11 +6474,11 @@ ${res.stderr}` : ""),
         const { loadFederation } = await import('./federation-MDQPO3PW.js');
         const { resolveExecutionEnv } = await import('./execution-env-4MS5AYAN.js');
         const { resolveModelExecutionProfile, mergeModelExecutionProfile } = await import('./model-execution-profile-ELWF3Z6H.js');
-        const { startCodeRuntimeSession } = await import('./runtime-session-4IACVDSY.js');
+        const { startCodeRuntimeSession } = await import('./runtime-session-5M6QZZOS.js');
         const { resolveGraphBackend } = await import('./graph-backend-GBL33GMW.js');
         const { detectGitRef } = await import('./git-ref-RSRAN4OH.js');
         const { repositoryIdFromRoot } = await import('./paths-62AKTFSR.js');
-        const { vgdRequest: vgdRequest2 } = await import('./vgd-KDQFS33M.js');
+        const { vgdRequest: vgdRequest2 } = await import('./vgd-TGGEAGQZ.js');
         const federation = loadFederation(root2);
         const modelProfile = mergeModelExecutionProfile(
           resolveModelExecutionProfile({
@@ -6554,7 +6570,7 @@ ${res.stderr}` : ""),
       attribution: { client: "vg-code", provider: providerSlug, model: primary?.model }
     });
     if (opts.out) {
-      fs8.writeFileSync(opts.out, JSON.stringify(result, null, 2) + "\n");
+      fs7.writeFileSync(opts.out, JSON.stringify(result, null, 2) + "\n");
     }
     if (global.json) {
       json(result);
@@ -6767,7 +6783,7 @@ async function addCmd(root2, rest, opts, asJson) {
 }
 function readPackageVersion(root2) {
   try {
-    const pkg = JSON.parse(fs8__default.readFileSync(path37__default.join(root2, "package.json"), "utf8"));
+    const pkg = JSON.parse(fs7__default.readFileSync(path37__default.join(root2, "package.json"), "utf8"));
     return typeof pkg.version === "string" ? pkg.version : void 0;
   } catch {
     return void 0;
@@ -6775,7 +6791,7 @@ function readPackageVersion(root2) {
 }
 function readOptionalFile(p) {
   try {
-    const t = fs8__default.readFileSync(p, "utf8");
+    const t = fs7__default.readFileSync(p, "utf8");
     return t.trim() ? t : void 0;
   } catch {
     return void 0;
@@ -6923,8 +6939,8 @@ function registerExport(program) {
       out(content.trimEnd());
       return;
     }
-    fs8.mkdirSync(path37.dirname(path37.resolve(file)), { recursive: true });
-    fs8.writeFileSync(file, content);
+    fs7.mkdirSync(path37.dirname(path37.resolve(file)), { recursive: true });
+    fs7.writeFileSync(file, content);
     info(`${c.green("\u2714")} wrote ${file} ${c.dim(`(${format})`)}`);
   });
   applyGlobalOptions(cmd);
@@ -6947,24 +6963,30 @@ function registerBundle(program) {
     } catch {
       throw new CliError("no grammars found to bundle (run a build first)", ExitCode.ERROR);
     }
-    fs8.mkdirSync(path37.join(outDir, "grammars"), { recursive: true });
+    fs7.mkdirSync(path37.join(outDir, "grammars"), { recursive: true });
     let grammarCount = 0;
     for (const { fileName, absPath } of grammarFiles) {
-      fs8.copyFileSync(absPath, path37.join(outDir, "grammars", fileName));
+      fs7.copyFileSync(absPath, path37.join(outDir, "grammars", fileName));
       grammarCount++;
     }
     const included = [`grammars/ (${grammarCount} .wasm)`];
     const graphSrc = resolveGraphPath(root2, global.graph);
-    if (fs8.existsSync(graphSrc)) {
-      fs8.copyFileSync(graphSrc, path37.join(outDir, "graph.json"));
+    if (fs7.existsSync(graphSrc)) {
+      fs7.copyFileSync(graphSrc, path37.join(outDir, "graph.json"));
       included.push("graph.json");
+    } else {
+      const graph = loadGraphFileWithSnapshot(graphSrc);
+      if (graph) {
+        fs7.writeFileSync(path37.join(outDir, "graph.json"), serializeGraph(graph));
+        included.push("graph.json");
+      }
     }
     const cat = catalogPath(root2);
-    if (fs8.existsSync(cat)) {
-      fs8.copyFileSync(cat, path37.join(outDir, "vibgrate.lib.json"));
+    if (fs7.existsSync(cat)) {
+      fs7.copyFileSync(cat, path37.join(outDir, "vibgrate.lib.json"));
       included.push("vibgrate.lib.json");
-      if (fs8.existsSync(libDir(root2))) {
-        fs8.cpSync(libDir(root2), path37.join(outDir, "lib"), { recursive: true });
+      if (fs7.existsSync(libDir(root2))) {
+        fs7.cpSync(libDir(root2), path37.join(outDir, "lib"), { recursive: true });
         included.push("lib/");
       }
     }
@@ -6976,7 +6998,7 @@ function registerBundle(program) {
       included,
       usage: "Run `vg build --grammars <this dir>/grammars` to build fully offline."
     };
-    fs8.writeFileSync(path37.join(outDir, "MANIFEST.json"), `${stableStringify(manifest, 2)}
+    fs7.writeFileSync(path37.join(outDir, "MANIFEST.json"), `${stableStringify(manifest, 2)}
 `);
     if (global.json) {
       json({ out: path37.relative(root2, outDir), ...manifest });
@@ -7002,7 +7024,7 @@ async function runDoctor(global) {
   const root2 = rootOf(global);
   const local = global.local === true;
   const graphPath = resolveGraphPath(root2, global.graph);
-  const configFile = CONFIG_BASENAMES.find((f) => fs8.existsSync(path37.join(root2, f))) ?? null;
+  const configFile = CONFIG_BASENAMES.find((f) => fs7.existsSync(path37.join(root2, f))) ?? null;
   const graph = loadGraph(root2, graphPath);
   let staleFiles = null;
   if (graph) {
@@ -7035,7 +7057,7 @@ async function runDoctor(global) {
     },
     libCatalog: {
       path: path37.relative(root2, catalogPath(root2)),
-      present: fs8.existsSync(catalogPath(root2)),
+      present: fs7.existsSync(catalogPath(root2)),
       libraries: libCount
     },
     credentials: creds,
@@ -7296,7 +7318,7 @@ function registerDaemon(program) {
     if (!await vgdIsRunning({ socketPath })) {
       throw new CliError(`vgd is not running \u2014 start it with \`vg daemon ensure\` (${socketPath})`, ExitCode.NOT_FOUND);
     }
-    const { loadGraph: loadGraph2 } = await import('./load-SEFJA3M5.js');
+    const { loadGraph: loadGraph2 } = await import('./load-4MLIHGXF.js');
     const { detectGitRef } = await import('./git-ref-RSRAN4OH.js');
     const { repositoryIdFromRoot } = await import('./paths-62AKTFSR.js');
     const opts = this.opts();
@@ -7513,7 +7535,7 @@ function registerPolicy(program) {
     const global = readGlobal(this);
     let raw;
     try {
-      raw = fs8.readFileSync(file, "utf8");
+      raw = fs7.readFileSync(file, "utf8");
     } catch {
       throw new CliError(`cannot read ${file}`, ExitCode.NOT_FOUND);
     }
@@ -7645,7 +7667,7 @@ var initCommand = new Command("init").description("Initialize vibgrate in a proj
     console.log(chalk7.green("\u2714") + ` Created ${chalk7.bold("vibgrate.config.ts")}`);
   }
   if (opts.baseline) {
-    const { runBaseline } = await import('./baseline-Y5FBYWNJ.js');
+    const { runBaseline } = await import('./baseline-UOTGTJYT.js');
     await runBaseline(rootDir);
   }
   console.log("");
@@ -7755,9 +7777,9 @@ async function fileReferencesIdentifier(rootDir, relFile, identifier, readFile3)
 }
 async function defaultReadFile(absPath) {
   try {
-    const stat2 = await fs21.stat(absPath);
+    const stat2 = await fs20.stat(absPath);
     if (!stat2.isFile() || stat2.size > MAX_FILE_BYTES) return null;
-    return await fs21.readFile(absPath, "utf8");
+    return await fs20.readFile(absPath, "utf8");
   } catch {
     return null;
   }
@@ -8404,7 +8426,7 @@ var SKIP_DIRS2 = /* @__PURE__ */ new Set([
 function scanStaleness(rootDir, artifactPath) {
   let ref;
   try {
-    ref = fs8.statSync(artifactPath).mtimeMs;
+    ref = fs7.statSync(artifactPath).mtimeMs;
   } catch {
     return { stale: false };
   }
@@ -8416,7 +8438,7 @@ function scanStaleness(rootDir, artifactPath) {
     if (depth > 8 || scanned > MAX_ENTRIES) return;
     let entries;
     try {
-      entries = fs8.readdirSync(dir, { withFileTypes: true });
+      entries = fs7.readdirSync(dir, { withFileTypes: true });
     } catch {
       return;
     }
@@ -8431,7 +8453,7 @@ function scanStaleness(rootDir, artifactPath) {
       const abs = path37.join(dir, e.name);
       let mtimeMs;
       try {
-        mtimeMs = fs8.statSync(abs).mtimeMs;
+        mtimeMs = fs7.statSync(abs).mtimeMs;
       } catch {
         continue;
       }
@@ -8568,7 +8590,7 @@ function analyzeTree(root2, packages) {
     if (depth > MAX_DEPTH || filesSeen >= MAX_FILES) return;
     let entries;
     try {
-      entries = fs8.readdirSync(dir, { withFileTypes: true });
+      entries = fs7.readdirSync(dir, { withFileTypes: true });
     } catch {
       return;
     }
@@ -8586,8 +8608,8 @@ function analyzeTree(root2, packages) {
       const full = path37.join(dir, entry.name);
       let content;
       try {
-        if (fs8.statSync(full).size > MAX_FILE_BYTES2) continue;
-        content = fs8.readFileSync(full, "utf8");
+        if (fs7.statSync(full).size > MAX_FILE_BYTES2) continue;
+        content = fs7.readFileSync(full, "utf8");
       } catch {
         continue;
       }
@@ -8946,7 +8968,7 @@ async function fetchLatestVersion() {
     if (!response.ok) return null;
     const data = await response.json();
     const latest = data.version;
-    if (!latest || !semver2.valid(latest)) return null;
+    if (!latest || !semver3__default.valid(latest)) return null;
     await writeCache({ latest, checkedAt: Date.now() });
     return latest;
   } catch {
@@ -8955,8 +8977,8 @@ async function fetchLatestVersion() {
 }
 async function writeCache(data) {
   try {
-    await fs21.mkdir(CACHE_DIR, { recursive: true });
-    await fs21.writeFile(CACHE_FILE, JSON.stringify(data), "utf-8");
+    await fs20.mkdir(CACHE_DIR, { recursive: true });
+    await fs20.writeFile(CACHE_FILE, JSON.stringify(data), "utf-8");
   } catch {
   }
 }
@@ -8967,7 +8989,7 @@ function detectGlobalInstall(execPath = process.argv[1] || "", cwd = process.cwd
   if (!execPath) return null;
   let resolved = execPath;
   try {
-    resolved = fs8.realpathSync(execPath);
+    resolved = fs7.realpathSync(execPath);
   } catch {
   }
   const p = resolved.replace(/\\/g, "/");
@@ -9085,8 +9107,8 @@ var updateCommand = new Command("update").description("Update vibgrate to the la
       console.error(chalk7.red("Could not reach the npm registry. Check your network connection."));
       process.exit(1);
     }
-    const semver3 = await import('semver');
-    if (!semver3.gt(latest, VERSION)) {
+    const semver4 = await import('semver');
+    if (!semver4.gt(latest, VERSION)) {
       console.log(chalk7.green("\u2714") + ` You are on the latest version (${VERSION}).`);
       if (opts.reap !== false) reapAndReport(process.cwd(), VERSION);
       return;
@@ -10964,9 +10986,9 @@ async function loadReleases(root2, productId) {
   return releases;
 }
 function coerce(version) {
-  const parsed = semver2.parse(version, { loose: true });
+  const parsed = semver3__default.parse(version, { loose: true });
   if (parsed) return parsed.version;
-  const c2 = semver2.coerce(version);
+  const c2 = semver3__default.coerce(version);
   return c2 ? c2.version : null;
 }
 function versionAffected(version, range) {
@@ -10976,11 +10998,11 @@ function versionAffected(version, range) {
   if (!range.introduced && !range.fixed && !range.versions) return false;
   const introduced = range.introduced ? coerce(range.introduced) : "0.0.0";
   if (!introduced) return false;
-  if (semver2.lt(v, introduced)) return false;
+  if (semver3__default.lt(v, introduced)) return false;
   if (range.fixed) {
     const fixed = coerce(range.fixed);
     if (!fixed) return false;
-    if (semver2.gte(v, fixed)) return false;
+    if (semver3__default.gte(v, fixed)) return false;
   }
   return true;
 }
@@ -11061,8 +11083,8 @@ function computeExposure(input) {
       productName: product.name,
       classification: product.classification,
       status,
-      affectedVersions: [...affectedVersions].sort(semver2.compareLoose),
-      releases: affectedReleases.sort((a, b) => semver2.compareLoose(a.version, b.version)),
+      affectedVersions: [...affectedVersions].sort(semver3__default.compareLoose),
+      releases: affectedReleases.sort((a, b) => semver3__default.compareLoose(a.version, b.version)),
       memberStates: product.memberStates,
       supportStatus: support.status,
       supportDetail: support.detail
@@ -11655,17 +11677,17 @@ function resolveSigningKey(root2, explicit) {
   const chosen = process.env.VG_ATTEST_KEY;
   const keyPath = chosen ? path37.resolve(chosen) : path37.join(root2, ".vibgrate", DEFAULT_KEY);
   let minted = false;
-  if (!fs8.existsSync(keyPath)) {
+  if (!fs7.existsSync(keyPath)) {
     if (chosen) throw new CliError(`signing key not found: ${chosen}`, ExitCode.USAGE_ERROR);
     const kp = generateKeypair();
-    fs8.mkdirSync(path37.dirname(keyPath), { recursive: true });
-    fs8.writeFileSync(keyPath, kp.privatePem, { mode: 384 });
-    fs8.writeFileSync(`${keyPath}.pub`, kp.publicPem);
+    fs7.mkdirSync(path37.dirname(keyPath), { recursive: true });
+    fs7.writeFileSync(keyPath, kp.privatePem, { mode: 384 });
+    fs7.writeFileSync(`${keyPath}.pub`, kp.publicPem);
     minted = true;
   }
   let key2;
   try {
-    key2 = crypto3.createPrivateKey(fs8.readFileSync(keyPath, "utf8"));
+    key2 = crypto3.createPrivateKey(fs7.readFileSync(keyPath, "utf8"));
   } catch {
     throw new CliError(`could not read an Ed25519 private key from ${keyPath}`, ExitCode.USAGE_ERROR);
   }
@@ -11676,8 +11698,8 @@ function resolveSigningKey(root2, explicit) {
 }
 function writeBundle(input) {
   const dir = input.outDir;
-  fs8.mkdirSync(path37.join(dir, "inputs", "releases"), { recursive: true });
-  const write = (rel, data) => fs8.writeFileSync(path37.join(dir, rel), `${JSON.stringify(data, null, 2)}
+  fs7.mkdirSync(path37.join(dir, "inputs", "releases"), { recursive: true });
+  const write = (rel, data) => fs7.writeFileSync(path37.join(dir, rel), `${JSON.stringify(data, null, 2)}
 `);
   write("result.json", input.result);
   write(path37.join("inputs", "advisory.json"), input.advisory);
@@ -11701,13 +11723,13 @@ function writeBundle(input) {
     disclaimer: input.regime.disclaimer
   });
   if (input.envelope) {
-    fs8.writeFileSync(path37.join(dir, "evidence.intoto.jsonl"), `${JSON.stringify(input.envelope)}
+    fs7.writeFileSync(path37.join(dir, "evidence.intoto.jsonl"), `${JSON.stringify(input.envelope)}
 `);
   }
   if (input.timestampToken) {
-    fs8.writeFileSync(path37.join(dir, "timestamp.tsr"), input.timestampToken);
+    fs7.writeFileSync(path37.join(dir, "timestamp.tsr"), input.timestampToken);
   }
-  fs8.writeFileSync(path37.join(dir, "VERIFY.md"), verifyDoc(input));
+  fs7.writeFileSync(path37.join(dir, "VERIFY.md"), verifyDoc(input));
   return dir;
 }
 function verifyDoc(input) {
@@ -12050,7 +12072,7 @@ var packCmd = new Command("pack").description("Build the submission pack a human
   const stage = opts.stage ?? regime.clocks[0]?.stage ?? "early-warning";
   const md = buildPack(result, regime, org, stage);
   if (opts.out) {
-    fs8.writeFileSync(path37.resolve(rootDir, opts.out), md);
+    fs7.writeFileSync(path37.resolve(rootDir, opts.out), md);
     console.error(chalk7.green("\u2714") + ` pack written to ${opts.out}`);
   } else {
     console.log(md);
@@ -12093,19 +12115,19 @@ var drillCmd = new Command("drill").description("Timed dry-run of the determinat
 });
 var verifyCmd = new Command("verify").description("Verify an evidence bundle offline (no Vibgrate needed)").argument("<bundle>", "Path to an evidence bundle directory or evidence.intoto.jsonl").option("--pub <file>", "Public key PEM to pin the signer (establish trust)").action((bundlePath, opts) => {
   const abs = path37.resolve(bundlePath);
-  const envPath = fs8.statSync(abs).isDirectory() ? path37.join(abs, "evidence.intoto.jsonl") : abs;
-  if (!fs8.existsSync(envPath)) throw new CliError(`no evidence.intoto.jsonl at ${bundlePath}`, ExitCode.NOT_FOUND);
-  const envelope = JSON.parse(fs8.readFileSync(envPath, "utf8").trim().split("\n")[0]);
+  const envPath = fs7.statSync(abs).isDirectory() ? path37.join(abs, "evidence.intoto.jsonl") : abs;
+  if (!fs7.existsSync(envPath)) throw new CliError(`no evidence.intoto.jsonl at ${bundlePath}`, ExitCode.NOT_FOUND);
+  const envelope = JSON.parse(fs7.readFileSync(envPath, "utf8").trim().split("\n")[0]);
   const resultPath = path37.join(path37.dirname(envPath), "result.json");
-  const result = fs8.existsSync(resultPath) ? JSON.parse(fs8.readFileSync(resultPath, "utf8")) : void 0;
-  const publicKeyPem = opts.pub ? fs8.readFileSync(path37.resolve(opts.pub), "utf8") : void 0;
+  const result = fs7.existsSync(resultPath) ? JSON.parse(fs7.readFileSync(resultPath, "utf8")) : void 0;
+  const publicKeyPem = opts.pub ? fs7.readFileSync(path37.resolve(opts.pub), "utf8") : void 0;
   const v = verifyEvidenceEnvelope(envelope, { publicKeyPem, result });
   const color = v.status === "verified" ? chalk7.green : v.status === "failed" ? chalk7.red : chalk7.yellow;
   console.log("  " + color(v.status.toUpperCase()) + `  ${v.reason}`);
   if (v.evidenceId) console.log("  " + chalk7.dim(`evidence ${v.evidenceId} \xB7 regime ${v.regime} \xB7 advisory ${v.advisoryId} \xB7 ${v.overallStatus}`));
   const tsrPath = path37.join(path37.dirname(envPath), "timestamp.tsr");
-  if (fs8.existsSync(tsrPath) && result) {
-    const t = verifyTimestamp(fs8.readFileSync(tsrPath), exposureSubjectDigest(result));
+  if (fs7.existsSync(tsrPath) && result) {
+    const t = verifyTimestamp(fs7.readFileSync(tsrPath), exposureSubjectDigest(result));
     const tcolor = t.imprintMatches ? chalk7.green : chalk7.red;
     console.log("  " + tcolor("TIMESTAMP") + `  ${t.reason}`);
   }
@@ -12204,9 +12226,9 @@ var pushCmd = new Command("push").description("Push the product registry (and an
   let exposure;
   if (opts.result) {
     const raw = path37.resolve(rootDir, opts.result);
-    const resultPath = fs8.existsSync(raw) && fs8.statSync(raw).isDirectory() ? path37.join(raw, "result.json") : raw;
-    if (!fs8.existsSync(resultPath)) throw new CliError(`no result.json at ${opts.result}`, ExitCode.NOT_FOUND);
-    exposure = JSON.parse(fs8.readFileSync(resultPath, "utf8"));
+    const resultPath = fs7.existsSync(raw) && fs7.statSync(raw).isDirectory() ? path37.join(raw, "result.json") : raw;
+    if (!fs7.existsSync(resultPath)) throw new CliError(`no result.json at ${opts.result}`, ExitCode.NOT_FOUND);
+    exposure = JSON.parse(fs7.readFileSync(resultPath, "utf8"));
   }
   const payload = { schemaVersion: "evidence-push-1", regime: regime.id, generatedAt: nowIso(), signed: Boolean(opts.signed), products: productPayload, exposure };
   const body = JSON.stringify(payload);
@@ -12396,7 +12418,7 @@ function dispatch(argv, cwd) {
   }
   const looksLikeQuestion = /\s/.test(first) || first.endsWith("?");
   if (looksLikeQuestion) return ["ask", ...args];
-  if (fs8.existsSync(path37.resolve(cwd, first))) {
+  if (fs7.existsSync(path37.resolve(cwd, first))) {
     return [hasBuildOnlyFlag(args) ? "build" : "scan", ...args];
   }
   const moved = MOVED_COMMANDS[first];