@vibgrate/cli 2026.814.2 → 2026.817.2

package/dist/{chunk-TNROG5CO.js → chunk-E2FAQREZ.js}

@@ -1,15 +1,17 @@
-import { FREE_PACK, navigationToolsetConfig, deferredToolNames, HOT_TOOLS } from './chunk-WWGLVF7D.js';
+import { FREE_PACK, navigationToolsetConfig, deferredToolNames, HOT_TOOLS } from './chunk-DVW3SVCW.js';
+import { CliError, ExitCode } from './chunk-MS6V5XKB.js';
 import { edgeId, buildModuleResolver, resolve, applyStaticTestLinkage, nodeId } from './chunk-VIWZ4QT7.js';
-import { indexFor } from './chunk-KGPX4EUN.js';
-import { writeGraphIndex, SCHEMA_VERSION, loadGraph } from './chunk-WQLZSVNF.js';
-import { init_cli_invocation, whichOnPath, isInstalledOwnBinary } from './chunk-3LSG7Z4I.js';
-import { langById, grammarSetVersion, langForExtension, setGrammarsOverride, parseSource } from './chunk-UTNNGKKX.js';
-import { redactSecrets } from './chunk-RXP66R2E.js';
-import { loadCache, cacheDir } from './chunk-2U37PFB2.js';
-import { serializeGraph, stableStringify, ensureVibgrateGitignore } from './chunk-75LJM5XD.js';
-import { VERSION } from './chunk-2H2U3DC7.js';
+import { indexFor } from './chunk-Q4G2BWE3.js';
+import { writeGraphIndex, SCHEMA_VERSION, loadGraph } from './chunk-3FMRFECC.js';
+import { init_cli_invocation, whichOnPath, isInstalledOwnBinary } from './chunk-EZ7UC5Y5.js';
+import { langById, grammarSetVersion, toolchainGrammarSetVersion, fileRolesFromParses, langForExtension, setGrammarsOverride, parseSource, toolchainParser } from './chunk-XLXJC7H3.js';
+import { redactSecrets } from './chunk-T7RSQ5WD.js';
+import { ensureVibgrateGitignore } from './chunk-WVMOGIPC.js';
+import { loadCache, cacheDir } from './chunk-MVPRPSXU.js';
+import { serializeGraph, stableStringify } from './chunk-O3LABX6I.js';
+import { VERSION } from './chunk-PRG2ULPK.js';
 import { shortId, canonicalize, hashString, hashBytes } from './chunk-JFGYT6BI.js';
-import * as fs11 from 'fs';
+import * as fs12 from 'fs';
 import * as path11 from 'path';
 import ignore from 'ignore';
 import * as v8 from 'v8';
@@ -22,7 +24,8 @@ import * as os from 'os';
 import { fileURLToPath } from 'url';
 import ts from 'typescript';
 import * as crypto from 'crypto';
-import * as fs8 from 'fs/promises';
+import YAML from 'yaml';
+import * as fs9 from 'fs/promises';
 
 var SKIP_DIRS = /* @__PURE__ */ new Set([
   // Version control, IDE & tool metadata
@@ -192,8 +195,8 @@ function toPosix(p) {
 function buildRootIgnore(root, exclude) {
   const ig = ignore();
   const gitignorePath = path11.join(root, ".gitignore");
-  if (fs11.existsSync(gitignorePath)) {
-    ig.add(fs11.readFileSync(gitignorePath, "utf8"));
+  if (fs12.existsSync(gitignorePath)) {
+    ig.add(fs12.readFileSync(gitignorePath, "utf8"));
   }
   if (exclude.length) ig.add(exclude);
   return ig;
@@ -208,7 +211,7 @@ function discover(options) {
     }
   }
   const rootIg = buildRootIgnore(root, options.exclude ?? []);
-  const scopeAbs = (options.paths && options.paths.length ? options.paths.map((p) => path11.resolve(root, p)) : [root]).filter((p) => fs11.existsSync(p));
+  const scopeAbs = (options.paths && options.paths.length ? options.paths.map((p) => path11.resolve(root, p)) : [root]).filter((p) => fs12.existsSync(p));
   const found = /* @__PURE__ */ new Map();
   const considerFile = (abs) => {
     const rel2 = toPosix(path11.relative(root, abs));
@@ -222,7 +225,7 @@ function discover(options) {
   const walk = (dir) => {
     let entries;
     try {
-      entries = fs11.readdirSync(dir, { withFileTypes: true });
+      entries = fs12.readdirSync(dir, { withFileTypes: true });
     } catch {
       return;
     }
@@ -239,7 +242,7 @@ function discover(options) {
     }
   };
   for (const scope of scopeAbs) {
-    const stat = fs11.statSync(scope);
+    const stat = fs12.statSync(scope);
     if (stat.isDirectory()) walk(scope);
     else if (stat.isFile()) considerFile(scope);
   }
@@ -723,12 +726,12 @@ function loadCoverage(root, explicit) {
   const candidates = (explicit && explicit.length ? explicit : DEFAULT_PATHS).map(
     (p) => path11.resolve(root, p)
   );
-  const found = candidates.filter((p) => fs11.existsSync(p));
+  const found = candidates.filter((p) => fs12.existsSync(p));
   if (found.length === 0) return null;
   const map = /* @__PURE__ */ new Map();
   for (const file of found) {
     try {
-      const text = fs11.readFileSync(file, "utf8");
+      const text = fs12.readFileSync(file, "utf8");
       if (file.endsWith(".json")) mergeIstanbul(map, text, root);
       else mergeLcov(map, text, root);
     } catch {
@@ -949,7 +952,7 @@ async function parseInline(files, options) {
   onProgress?.(0, files.length);
   for (const file of files) {
     try {
-      const source = fs11.readFileSync(file.abs, "utf8");
+      const source = fs12.readFileSync(file.abs, "utf8");
       out.push(await parseSource(file.rel, file.lang.id, source));
     } catch (err) {
       out.push(emptyParse(file, `parse failed: ${err.message}`));
@@ -1006,7 +1009,7 @@ function isWorkerOom(err) {
 function resolveWorkerFile() {
   const here = path11.dirname(fileURLToPath(import.meta.url));
   const candidate = path11.join(here, "parse-worker.js");
-  return fs11.existsSync(candidate) ? candidate : null;
+  return fs12.existsSync(candidate) ? candidate : null;
 }
 function chunk(items, buckets) {
   const out = Array.from({ length: Math.min(buckets, items.length || 1) }, () => []);
@@ -1300,9 +1303,9 @@ function loadTscCache(root, opts) {
     ts: ts.version,
     entries: {}
   };
-  if (!opts.disabled && fs11.existsSync(file)) {
+  if (!opts.disabled && fs12.existsSync(file)) {
     try {
-      const loaded = JSON.parse(fs11.readFileSync(file, "utf8"));
+      const loaded = JSON.parse(fs12.readFileSync(file, "utf8"));
       if (loaded.version === TSC_CACHE_VERSION && loaded.toolVersion === opts.toolVersion && loaded.ts === ts.version && loaded.entries) {
         data = loaded;
       }
@@ -1333,8 +1336,8 @@ function loadTscCache(root, opts) {
     },
     save() {
       if (opts.disabled) return;
-      fs11.mkdirSync(cacheDir(root), { recursive: true });
-      fs11.writeFileSync(file, stableStringify(data, 0));
+      fs12.mkdirSync(cacheDir(root), { recursive: true });
+      fs12.writeFileSync(file, stableStringify(data, 0));
     }
   };
 }
@@ -1344,7 +1347,7 @@ function abs$(root, rel2) {
 function detectAmbient(rel2, abs) {
   if (rel2.endsWith(".d.ts")) return true;
   try {
-    return AMBIENT_RE.test(fs11.readFileSync(abs, "utf8"));
+    return AMBIENT_RE.test(fs12.readFileSync(abs, "utf8"));
   } catch {
     return true;
   }
@@ -1643,9 +1646,9 @@ function toPosix2(p) {
 function buildRootIgnore2(root, exclude) {
   const ig = ignore();
   const gitignorePath = path11.join(root, ".gitignore");
-  if (fs11.existsSync(gitignorePath)) {
+  if (fs12.existsSync(gitignorePath)) {
     try {
-      ig.add(fs11.readFileSync(gitignorePath, "utf8"));
+      ig.add(fs12.readFileSync(gitignorePath, "utf8"));
     } catch {
     }
   }
@@ -1689,7 +1692,7 @@ function discoverDocs(options) {
   const maxFiles = options.maxFiles ?? DOC_MAX_FILES;
   const rootIg = buildRootIgnore2(root, options.exclude ?? []);
   const scopeAbs = (options.paths?.length ? options.paths.map((p) => path11.resolve(root, p)) : [root]).filter(
-    (p) => fs11.existsSync(p)
+    (p) => fs12.existsSync(p)
   );
   const found = /* @__PURE__ */ new Map();
   const consider = (abs) => {
@@ -1702,7 +1705,7 @@ function discoverDocs(options) {
     const category = classifyProjectContext(rel2);
     if (!category) return;
     try {
-      const st = fs11.statSync(abs);
+      const st = fs12.statSync(abs);
       if (!st.isFile() || st.size > DOC_FILE_MAX_BYTES) return;
       if (st.size === 0) return;
     } catch {
@@ -1714,7 +1717,7 @@ function discoverDocs(options) {
     if (found.size >= maxFiles || depth > 12) return;
     let entries;
     try {
-      entries = fs11.readdirSync(dir, { withFileTypes: true });
+      entries = fs12.readdirSync(dir, { withFileTypes: true });
     } catch {
       return;
     }
@@ -1733,7 +1736,7 @@ function discoverDocs(options) {
   };
   for (const scope of scopeAbs) {
     try {
-      const st = fs11.statSync(scope);
+      const st = fs12.statSync(scope);
       if (st.isDirectory()) walk(scope, 0);
       else if (st.isFile()) consider(scope);
     } catch {
@@ -1790,7 +1793,7 @@ function documentNodesFromDocs(docs) {
   for (const d of docs) {
     let raw = "";
     try {
-      raw = fs11.readFileSync(d.abs, "utf8");
+      raw = fs12.readFileSync(d.abs, "utf8");
     } catch {
       continue;
     }
@@ -1826,6 +1829,1640 @@ function documentNodesFromDocs(docs) {
   }
   return nodes.sort((a, b) => a.file.localeCompare(b.file) || a.id.localeCompare(b.id));
 }
+
+// src/engine/toolchain/util.ts
+var TOOLCHAIN_FILE_MAX_BYTES = 2 * 1024 * 1024;
+var TOOLCHAIN_NODES_PER_FILE_MAX = 2e3;
+var DOC_MAX_CHARS = 240;
+var LineIndex = class {
+  /** Byte offset at which each line starts. */
+  starts;
+  constructor(source) {
+    const starts = [0];
+    for (let i = 0; i < source.length; i++) {
+      if (source.charCodeAt(i) === 10) starts.push(i + 1);
+    }
+    this.starts = starts;
+  }
+  /** 1-based line number containing `offset`. */
+  lineAt(offset) {
+    if (offset <= 0) return 1;
+    let lo = 0;
+    let hi = this.starts.length - 1;
+    while (lo < hi) {
+      const mid = lo + hi + 1 >> 1;
+      if (this.starts[mid] <= offset) lo = mid;
+      else hi = mid - 1;
+    }
+    return lo + 1;
+  }
+  /** Span covering the byte range `[start, end)`. */
+  span(start, end) {
+    const s = this.lineAt(start);
+    const e = this.lineAt(Math.max(start, end - 1));
+    return { start: s, end: Math.max(s, e) };
+  }
+  get lineCount() {
+    return this.starts.length;
+  }
+};
+function safeDoc(text) {
+  if (!text) return void 0;
+  const collapsed = text.replace(/\s+/g, " ").trim();
+  if (!collapsed) return void 0;
+  const redacted = redactSecrets(collapsed);
+  return redacted.length > DOC_MAX_CHARS ? `${redacted.slice(0, DOC_MAX_CHARS - 1)}\u2026` : redacted;
+}
+function parseImageRef(raw) {
+  const value = raw.trim();
+  if (!value || /\s/.test(value)) return null;
+  if (value.includes("$") || value.includes("{{")) return null;
+  const atIdx = value.lastIndexOf("@");
+  let digest;
+  let rest = value;
+  if (atIdx > 0) {
+    digest = value.slice(atIdx + 1);
+    rest = value.slice(0, atIdx);
+  }
+  let tag;
+  const colonIdx = rest.lastIndexOf(":");
+  if (colonIdx > 0 && colonIdx > rest.lastIndexOf("/")) {
+    tag = rest.slice(colonIdx + 1);
+    rest = rest.slice(0, colonIdx);
+  }
+  if (!rest) return null;
+  return { raw: value, repository: rest, tag, digest };
+}
+function imageIdentity(ref) {
+  if (ref.digest) return `${ref.repository}@${ref.digest}`;
+  return ref.tag ? `${ref.repository}:${ref.tag}` : ref.repository;
+}
+function toPosix3(rel2) {
+  return rel2.replace(/\\/g, "/");
+}
+function resolveRelative(fromFileRel, target) {
+  const base = toPosix3(fromFileRel).split("/").slice(0, -1);
+  const parts = toPosix3(target).split("/");
+  const out = [...base];
+  for (const part of parts) {
+    if (!part || part === ".") continue;
+    if (part === "..") {
+      if (!out.length) return null;
+      out.pop();
+      continue;
+    }
+    out.push(part);
+  }
+  const joined = out.join("/");
+  return joined || null;
+}
+function parseYamlStream(rel2, source) {
+  const warnings = [];
+  let parsed;
+  try {
+    parsed = YAML.parseAllDocuments(source, {
+      // Parsing itself does not expand aliases — the bomb only detonates on
+      // materialisation, so the alias budget is applied at `toJS` below.
+      logLevel: "silent",
+      uniqueKeys: false
+    });
+  } catch (err) {
+    warnings.push(`${rel2}: YAML parse failed (${err.message})`);
+    return { docs: [], warnings };
+  }
+  const docs = [];
+  parsed.forEach((ast, index) => {
+    if (ast.errors.length) {
+      warnings.push(`${rel2}: YAML document ${index + 1} has errors \u2014 skipped`);
+      return;
+    }
+    let value;
+    try {
+      value = ast.toJS({ maxAliasCount: 100 });
+    } catch (err) {
+      warnings.push(`${rel2}: YAML document ${index + 1} could not be materialised (${err.message})`);
+      return;
+    }
+    if (value === null || value === void 0) return;
+    docs.push({ value, ast, index });
+  });
+  return { docs, warnings };
+}
+function spanAt(doc, lines, path12) {
+  const node = path12.length ? safeGetIn(doc.ast, path12) : doc.ast.contents;
+  const range = nodeRange(node) ?? nodeRange(doc.ast.contents);
+  if (!range) return { start: 1, end: 1 };
+  return lines.span(range[0], range[2] ?? range[1]);
+}
+function safeGetIn(ast, path12) {
+  try {
+    return ast.getIn(path12, true);
+  } catch {
+    return void 0;
+  }
+}
+function nodeRange(node) {
+  const range = node?.range;
+  return Array.isArray(range) ? range : null;
+}
+function getPath(value, path12) {
+  let current = value;
+  for (const key of path12) {
+    if (current === null || typeof current !== "object") return void 0;
+    current = current[key];
+  }
+  return current;
+}
+function getString(value, path12) {
+  const found = getPath(value, path12);
+  if (typeof found === "string") return found;
+  if (typeof found === "number" || typeof found === "boolean") return String(found);
+  return void 0;
+}
+function getArray(value, path12) {
+  const found = getPath(value, path12);
+  return Array.isArray(found) ? found : [];
+}
+function getRecordEntries(value, path12) {
+  const found = getPath(value, path12);
+  if (!found || typeof found !== "object" || Array.isArray(found)) return [];
+  return Object.entries(found).sort(([a], [b]) => a.localeCompare(b, "en"));
+}
+function looksTemplated(source) {
+  return /\{\{-?\s*(if|range|with|end|define|template|include|toYaml|\.Values|\.Release|\.Chart)/.test(
+    source
+  );
+}
+
+// src/engine/toolchain/compose.ts
+var DEFAULT_DOCKERFILE = "Dockerfile";
+var composeExtractor = {
+  format: "compose",
+  matches(rel2, category) {
+    if (category === "compose") return true;
+    return /(^|\/)(docker-)?compose([.-][\w.-]+)?\.ya?ml$/i.test(rel2);
+  },
+  extract(rel2, source) {
+    const { docs, warnings } = parseYamlStream(rel2, source);
+    const lines = new LineIndex(source);
+    const nodes = [];
+    const edges = [];
+    const doc = docs[0];
+    if (!doc) return { nodes, edges, warnings };
+    const services = getRecordEntries(doc.value, ["services"]);
+    const declared = new Set(services.map(([name]) => `service:${name}`));
+    for (const [name, service] of services) {
+      if (nodes.length >= TOOLCHAIN_NODES_PER_FILE_MAX) {
+        warnings.push(`${rel2}: stopped at ${TOOLCHAIN_NODES_PER_FILE_MAX} nodes`);
+        break;
+      }
+      const address = `service:${name}`;
+      const image = getString(service, ["image"]);
+      const ports = getArray(service, ["ports"]).map(String);
+      nodes.push({
+        kind: "resource",
+        name,
+        qualifiedName: address,
+        span: spanAt(doc, lines, ["services", name]),
+        signature: "compose.service",
+        doc: safeDoc(
+          [image && `image ${image}`, ports.length && `ports ${ports.join(", ")}`].filter(Boolean).join(", ")
+        ),
+        importance: 0.5
+      });
+      if (image) {
+        const ref = parseImageRef(image);
+        if (ref) {
+          nodes.push({
+            kind: "image",
+            name: ref.repository.split("/").pop() ?? ref.repository,
+            qualifiedName: `image:${ref.raw}`,
+            span: spanAt(doc, lines, ["services", name, "image"]),
+            signature: "compose.image",
+            doc: safeDoc(ref.tag ? `${ref.repository} tag ${ref.tag}` : ref.repository),
+            importance: 0.3
+          });
+          edges.push({ kind: "builds_from", from: address, to: `image:${ref.raw}`, confidence: 1 });
+        }
+      }
+      const dockerfileRel = composeDockerfilePath(rel2, service);
+      if (dockerfileRel) {
+        nodes.push({
+          kind: "image",
+          name: dockerfileRel.split("/").pop() ?? dockerfileRel,
+          qualifiedName: `dockerfile:${dockerfileRel}`,
+          span: spanAt(doc, lines, ["services", name, "build"]),
+          signature: "compose.build",
+          doc: safeDoc(`builds from ${dockerfileRel}`),
+          importance: 0.4
+        });
+        edges.push({
+          kind: "builds_from",
+          from: address,
+          to: `dockerfile:${dockerfileRel}`,
+          confidence: 1
+        });
+      }
+      for (const target of composeDependsOn(service)) {
+        const to = `service:${target}`;
+        if (declared.has(to)) edges.push({ kind: "depends_on", from: address, to, confidence: 1 });
+      }
+      for (const port of ports) {
+        edges.push({ kind: "exposes", from: address, to: `port:${port}`, confidence: 1 });
+      }
+    }
+    const portTargets = new Set(
+      edges.filter((e) => e.kind === "exposes").map((e) => e.to)
+    );
+    for (const target of [...portTargets].sort()) {
+      nodes.push({
+        kind: "property",
+        name: target.slice("port:".length),
+        qualifiedName: target,
+        span: { start: 1, end: 1 },
+        signature: "compose.port",
+        importance: 0.1
+      });
+    }
+    return { nodes, edges, warnings };
+  }
+};
+function composeDockerfilePath(rel2, service) {
+  const build = getPath(service, ["build"]);
+  if (build === void 0 || build === null) return null;
+  if (typeof build === "string") {
+    return resolveRelative(rel2, `${build}/${DEFAULT_DOCKERFILE}`);
+  }
+  if (typeof build !== "object") return null;
+  const context = getString(build, ["context"]) ?? ".";
+  const dockerfile = getString(build, ["dockerfile"]) ?? DEFAULT_DOCKERFILE;
+  return resolveRelative(rel2, `${context}/${dockerfile}`);
+}
+function composeDependsOn(service) {
+  const raw = getPath(service, ["depends_on"]);
+  if (Array.isArray(raw)) {
+    return raw.filter((v) => typeof v === "string").sort();
+  }
+  if (raw && typeof raw === "object") {
+    return Object.keys(raw).sort();
+  }
+  return [];
+}
+
+// src/engine/toolchain/dockerfile.ts
+var INSTRUCTION = /^([A-Za-z][A-Za-z0-9_]*)\s+([\s\S]*)$/;
+function logicalLines(source) {
+  const rawLines = source.split(/\r?\n/);
+  let escapeChar = "\\";
+  for (const line of rawLines) {
+    const trimmed = line.trim();
+    if (!trimmed) continue;
+    if (!trimmed.startsWith("#")) break;
+    const directive = /^#\s*escape\s*=\s*(\S)/i.exec(trimmed);
+    if (directive) escapeChar = directive[1];
+  }
+  const out = [];
+  let buffer = null;
+  let startLine = 0;
+  for (let i = 0; i < rawLines.length; i++) {
+    const raw = rawLines[i];
+    const trimmed = raw.trim();
+    if (!trimmed || trimmed.startsWith("#")) continue;
+    const continues = trimmed.endsWith(escapeChar);
+    const fragment = continues ? trimmed.slice(0, -1).trimEnd() : trimmed;
+    if (buffer === null) {
+      buffer = fragment;
+      startLine = i + 1;
+    } else {
+      buffer += ` ${fragment}`;
+    }
+    if (!continues) {
+      const match = INSTRUCTION.exec(buffer);
+      if (match) {
+        out.push({
+          instruction: match[1].toUpperCase(),
+          args: match[2].trim(),
+          startLine,
+          endLine: i + 1
+        });
+      }
+      buffer = null;
+    }
+  }
+  if (buffer !== null) {
+    const match = INSTRUCTION.exec(buffer);
+    if (match) {
+      out.push({
+        instruction: match[1].toUpperCase(),
+        args: match[2].trim(),
+        startLine,
+        endLine: rawLines.length
+      });
+    }
+  }
+  return out;
+}
+function parseFrom(args) {
+  const tokens = args.split(/\s+/).filter(Boolean);
+  const positional = [];
+  for (const token of tokens) {
+    if (token.startsWith("--")) continue;
+    positional.push(token);
+  }
+  if (!positional.length) return null;
+  const image = positional[0];
+  const asIdx = positional.findIndex((t) => t.toUpperCase() === "AS");
+  const stage = asIdx > 0 && positional[asIdx + 1] ? positional[asIdx + 1] : void 0;
+  return { image, stage };
+}
+function parseCopyFrom(args) {
+  const match = /--from=(\S+)/i.exec(args);
+  return match ? match[1] : null;
+}
+function parseExpose(args) {
+  return args.split(/\s+/).filter(Boolean).filter((token) => !token.startsWith("--"));
+}
+function copySourcePaths(args, hasFromFlag) {
+  const tokens = args.split(/\s+/).filter(Boolean).filter((t) => !t.startsWith("--"));
+  if (tokens.length < 2) return [];
+  const sources = tokens.slice(0, -1);
+  return sources.filter(
+    (source) => source !== "." && !source.includes("*") && !source.includes("?") && !source.includes("[") && !source.includes("$") && !/^https?:\/\//i.test(source)
+  ).map((source) => source.replace(/^\.\//, "")).sort();
+}
+var dockerfileExtractor = {
+  format: "dockerfile",
+  matches(rel2, category) {
+    if (category === "docker") return true;
+    const base = toPosix3(rel2).split("/").pop()?.toLowerCase() ?? "";
+    return base === "dockerfile" || base === "containerfile" || base.startsWith("dockerfile.");
+  },
+  extract(rel2, source) {
+    const lines = new LineIndex(source);
+    const nodes = [];
+    const edges = [];
+    const warnings = [];
+    const posixRel = toPosix3(rel2);
+    const fileAddress = `dockerfile:${posixRel}`;
+    nodes.push({
+      kind: "image",
+      name: posixRel.split("/").pop() ?? posixRel,
+      qualifiedName: fileAddress,
+      span: { start: 1, end: Math.max(1, lines.lineCount) },
+      signature: "dockerfile",
+      importance: 0.5
+    });
+    const stages = /* @__PURE__ */ new Map();
+    const copySources = /* @__PURE__ */ new Map();
+    let stageIndex = 0;
+    let currentStage = null;
+    for (const line of logicalLines(source)) {
+      if (nodes.length >= TOOLCHAIN_NODES_PER_FILE_MAX) {
+        warnings.push(`${rel2}: stopped at ${TOOLCHAIN_NODES_PER_FILE_MAX} nodes`);
+        break;
+      }
+      switch (line.instruction) {
+        case "FROM": {
+          const from = parseFrom(line.args);
+          if (!from) break;
+          const stageName = from.stage ?? String(stageIndex);
+          const stageAddress = `${fileAddress}#${stageName}`;
+          stages.set(stageName.toLowerCase(), stageAddress);
+          currentStage = stageAddress;
+          stageIndex++;
+          nodes.push({
+            kind: "image",
+            name: from.stage ?? `stage ${stageIndex - 1}`,
+            qualifiedName: stageAddress,
+            span: { start: line.startLine, end: line.endLine },
+            signature: "dockerfile.stage",
+            doc: safeDoc(`from ${from.image}`),
+            importance: 0.4
+          });
+          edges.push({ kind: "contains", from: fileAddress, to: stageAddress, confidence: 1 });
+          const baseStage = stages.get(from.image.toLowerCase());
+          if (baseStage && baseStage !== stageAddress) {
+            edges.push({
+              kind: "builds_from",
+              from: stageAddress,
+              to: baseStage,
+              confidence: 1
+            });
+          } else {
+            const ref = parseImageRef(from.image);
+            if (ref) {
+              const imageAddress = `image:${ref.raw}`;
+              nodes.push({
+                kind: "image",
+                name: ref.repository.split("/").pop() ?? ref.repository,
+                qualifiedName: imageAddress,
+                span: { start: line.startLine, end: line.endLine },
+                signature: "dockerfile.base",
+                doc: safeDoc(ref.tag ? `${ref.repository} tag ${ref.tag}` : ref.repository),
+                importance: 0.3
+              });
+              edges.push({
+                kind: "builds_from",
+                from: stageAddress,
+                to: imageAddress,
+                confidence: 1
+              });
+            }
+          }
+          break;
+        }
+        case "COPY":
+        case "ADD": {
+          const fromRef = parseCopyFrom(line.args);
+          if (fromRef) {
+            if (!currentStage) break;
+            const target = stages.get(fromRef.toLowerCase());
+            if (target && target !== currentStage) {
+              edges.push({ kind: "depends_on", from: currentStage, to: target, confidence: 1 });
+            }
+            break;
+          }
+          if (!currentStage) break;
+          const forStage = copySources.get(currentStage) ?? /* @__PURE__ */ new Set();
+          for (const source2 of copySourcePaths(line.args)) {
+            const relativeToDockerfile = resolveRelative(posixRel, source2);
+            if (relativeToDockerfile) forStage.add(relativeToDockerfile);
+            forStage.add(toPosix3(source2).replace(/^\.\//, ""));
+          }
+          if (forStage.size) copySources.set(currentStage, forStage);
+          break;
+        }
+        case "EXPOSE": {
+          if (!currentStage) break;
+          for (const port of parseExpose(line.args)) {
+            const portAddress = `port:${port}`;
+            nodes.push({
+              kind: "property",
+              name: port,
+              qualifiedName: portAddress,
+              span: { start: line.startLine, end: line.endLine },
+              signature: "dockerfile.expose",
+              importance: 0.1
+            });
+            edges.push({ kind: "exposes", from: currentStage, to: portAddress, confidence: 1 });
+          }
+          break;
+        }
+      }
+    }
+    const copySourcesByStage = {};
+    for (const stage of [...copySources.keys()].sort()) {
+      copySourcesByStage[stage] = [...copySources.get(stage) ?? []].sort();
+    }
+    return { nodes, edges, warnings, linkHints: { copySourcesByStage } };
+  }
+};
+
+// src/engine/toolchain/helm.ts
+function collectValuesImages(value, prefix, out) {
+  if (!value || typeof value !== "object" || Array.isArray(value)) return;
+  const repository = getString(value, ["repository"]);
+  const tag = getString(value, ["tag"]);
+  const registry = getString(value, ["registry"]);
+  if (repository) {
+    const full = [registry, repository].filter(Boolean).join("/");
+    const raw = tag ? `${full}:${tag}` : full;
+    if (!out.has(raw)) out.set(raw, prefix);
+  }
+  const direct = getString(value, ["image"]);
+  if (direct && parseImageRef(direct)) {
+    if (!out.has(direct)) out.set(direct, [...prefix, "image"]);
+  }
+  for (const [key, child] of getRecordEntries(value, [])) {
+    if (key === "repository" || key === "tag" || key === "registry") continue;
+    collectValuesImages(child, [...prefix, key], out);
+  }
+}
+var helmExtractor = {
+  format: "helm",
+  matches(rel2) {
+    const base = toPosix3(rel2).split("/").pop()?.toLowerCase() ?? "";
+    if (base === "chart.yaml" || base === "chart.yml") return true;
+    return /(^|\/)values([.-][\w.-]+)?\.ya?ml$/i.test(rel2) && /(^|\/)charts?\//i.test(rel2);
+  },
+  extract(rel2, source) {
+    const { docs, warnings } = parseYamlStream(rel2, source);
+    const lines = new LineIndex(source);
+    const nodes = [];
+    const edges = [];
+    const doc = docs[0];
+    if (!doc) return { nodes, edges, warnings };
+    const base = toPosix3(rel2).split("/").pop()?.toLowerCase() ?? "";
+    const isChartFile = base === "chart.yaml" || base === "chart.yml";
+    if (isChartFile) {
+      const name = getString(doc.value, ["name"]);
+      if (!name) return { nodes, edges, warnings };
+      const version = getString(doc.value, ["version"]);
+      const appVersion = getString(doc.value, ["appVersion"]);
+      const address = `chart:${name}`;
+      nodes.push({
+        kind: "chart",
+        name,
+        qualifiedName: address,
+        span: spanAt(doc, lines, []),
+        signature: "helm.chart",
+        doc: safeDoc(
+          [version && `version ${version}`, appVersion && `app ${appVersion}`].filter(Boolean).join(", ")
+        ),
+        importance: 0.7
+      });
+      for (const dependency of getArray(doc.value, ["dependencies"])) {
+        const depName = getString(dependency, ["name"]);
+        if (!depName) continue;
+        const depVersion = getString(dependency, ["version"]);
+        const depAddress = `chart:${depName}`;
+        nodes.push({
+          kind: "chart",
+          name: depName,
+          qualifiedName: depAddress,
+          span: spanAt(doc, lines, ["dependencies"]),
+          signature: "helm.dependency",
+          doc: safeDoc(depVersion ? `version ${depVersion}` : void 0),
+          importance: 0.4
+        });
+        edges.push({ kind: "depends_on", from: address, to: depAddress, confidence: 1 });
+      }
+      return { nodes, edges, warnings };
+    }
+    const images = /* @__PURE__ */ new Map();
+    collectValuesImages(doc.value, [], images);
+    for (const raw of [...images.keys()].sort()) {
+      const ref = parseImageRef(raw);
+      if (!ref) continue;
+      nodes.push({
+        kind: "image",
+        name: ref.repository.split("/").pop() ?? ref.repository,
+        qualifiedName: `image:${ref.raw}`,
+        span: spanAt(doc, lines, images.get(raw) ?? []),
+        signature: "helm.values.image",
+        doc: safeDoc(ref.tag ? `${ref.repository} tag ${ref.tag}` : ref.repository),
+        importance: 0.3
+      });
+    }
+    return { nodes, edges, warnings };
+  }
+};
+
+// src/engine/toolchain/kubernetes.ts
+var WORKLOAD_TEMPLATE_PATHS = {
+  Deployment: ["spec", "template"],
+  StatefulSet: ["spec", "template"],
+  DaemonSet: ["spec", "template"],
+  ReplicaSet: ["spec", "template"],
+  ReplicationController: ["spec", "template"],
+  Job: ["spec", "template"],
+  CronJob: ["spec", "jobTemplate", "spec", "template"],
+  Pod: []
+};
+var CONTAINER_FIELDS = ["initContainers", "containers", "ephemeralContainers"];
+function isKubernetesDoc(value) {
+  return typeof getString(value, ["apiVersion"]) === "string" && typeof getString(value, ["kind"]) === "string";
+}
+function objectAddress(value) {
+  const kind = getString(value, ["kind"]);
+  const name = getString(value, ["metadata", "name"]);
+  if (!kind || !name) return null;
+  const namespace = getString(value, ["metadata", "namespace"]) ?? "default";
+  return `${namespace}/${kind}/${name}`;
+}
+function podSpecPath(kind) {
+  const templatePath = WORKLOAD_TEMPLATE_PATHS[kind];
+  if (!templatePath) return null;
+  return [...templatePath, "spec"];
+}
+var kubernetesExtractor = {
+  format: "kubernetes",
+  matches(rel2, category, head) {
+    if (!/\.ya?ml$/i.test(rel2)) return false;
+    if (looksTemplated(head)) return false;
+    if (/(^|\/)templates\//i.test(rel2)) return false;
+    return /(^|\n)apiVersion:\s*\S/.test(head) && /(^|\n)kind:\s*\S/.test(head);
+  },
+  extract(rel2, source) {
+    const { docs, warnings } = parseYamlStream(rel2, source);
+    const lines = new LineIndex(source);
+    const nodes = [];
+    const edges = [];
+    const workloadLabels = /* @__PURE__ */ new Map();
+    for (const doc of docs) {
+      if (nodes.length >= TOOLCHAIN_NODES_PER_FILE_MAX) {
+        warnings.push(`${rel2}: stopped at ${TOOLCHAIN_NODES_PER_FILE_MAX} nodes`);
+        break;
+      }
+      if (!isKubernetesDoc(doc.value)) continue;
+      const address = objectAddress(doc.value);
+      if (!address) continue;
+      const kind = getString(doc.value, ["kind"]);
+      const name = getString(doc.value, ["metadata", "name"]);
+      const podPath = podSpecPath(kind);
+      const isWorkload = podPath !== null;
+      nodes.push({
+        kind: isWorkload ? "workload" : "resource",
+        name,
+        qualifiedName: address,
+        span: spanAt(doc, lines, []),
+        signature: `k8s.${kind}`,
+        doc: safeDoc(describeObject(doc.value, kind)),
+        importance: isWorkload ? 0.6 : 0.4
+      });
+      if (isWorkload) {
+        const labels = readLabels(doc.value, [...WORKLOAD_TEMPLATE_PATHS[kind] ?? [], "metadata", "labels"]);
+        if (Object.keys(labels).length) workloadLabels.set(address, labels);
+        extractContainers(doc, lines, address, podPath, nodes, edges);
+      }
+      for (const reference of referencedConfig(doc.value, podPath)) {
+        edges.push({ kind: "mounts", from: address, to: reference, confidence: 1 });
+      }
+    }
+    for (const doc of docs) {
+      if (getString(doc.value, ["kind"]) !== "Service") continue;
+      const from = objectAddress(doc.value);
+      if (!from) continue;
+      const selector = readLabels(doc.value, ["spec", "selector"]);
+      if (!Object.keys(selector).length) continue;
+      for (const [address, labels] of [...workloadLabels].sort(([a], [b]) => a.localeCompare(b, "en"))) {
+        if (isSubset(selector, labels)) {
+          edges.push({ kind: "exposes", from, to: address, confidence: 1 });
+        }
+      }
+    }
+    return { nodes, edges, warnings };
+  }
+};
+function extractContainers(doc, lines, workloadAddress, podPath, nodes, edges) {
+  const seenImages = /* @__PURE__ */ new Set();
+  for (const field of CONTAINER_FIELDS) {
+    const containers = getArray(doc.value, [...podPath, field]);
+    containers.forEach((container, index) => {
+      const image = getString(container, ["image"]);
+      if (!image) return;
+      const ref = parseImageRef(image);
+      if (!ref) return;
+      if (seenImages.has(ref.raw)) return;
+      seenImages.add(ref.raw);
+      nodes.push({
+        kind: "image",
+        name: ref.repository.split("/").pop() ?? ref.repository,
+        qualifiedName: `image:${ref.raw}`,
+        span: spanAt(doc, lines, [...podPath, field, index, "image"]),
+        signature: "k8s.image",
+        doc: safeDoc(ref.tag ? `${ref.repository} tag ${ref.tag}` : ref.repository),
+        importance: 0.3
+      });
+      edges.push({
+        kind: "builds_from",
+        from: workloadAddress,
+        to: `image:${ref.raw}`,
+        confidence: 1
+      });
+    });
+  }
+}
+function referencedConfig(value, podPath) {
+  if (!podPath) return [];
+  const out = /* @__PURE__ */ new Set();
+  for (const volume of getArray(value, [...podPath, "volumes"])) {
+    const configMap = getString(volume, ["configMap", "name"]);
+    if (configMap) out.add(`ConfigMap/${configMap}`);
+    const secret = getString(volume, ["secret", "secretName"]);
+    if (secret) out.add(`Secret/${secret}`);
+    const claim = getString(volume, ["persistentVolumeClaim", "claimName"]);
+    if (claim) out.add(`PersistentVolumeClaim/${claim}`);
+  }
+  for (const field of CONTAINER_FIELDS) {
+    for (const container of getArray(value, [...podPath, field])) {
+      for (const envFrom of getArray(container, ["envFrom"])) {
+        const configMap = getString(envFrom, ["configMapRef", "name"]);
+        if (configMap) out.add(`ConfigMap/${configMap}`);
+        const secret = getString(envFrom, ["secretRef", "name"]);
+        if (secret) out.add(`Secret/${secret}`);
+      }
+      for (const env of getArray(container, ["env"])) {
+        const configMap = getString(env, ["valueFrom", "configMapKeyRef", "name"]);
+        if (configMap) out.add(`ConfigMap/${configMap}`);
+        const secret = getString(env, ["valueFrom", "secretKeyRef", "name"]);
+        if (secret) out.add(`Secret/${secret}`);
+      }
+    }
+  }
+  return [...out].sort();
+}
+function readLabels(value, path12) {
+  const out = {};
+  for (const [key, raw] of getRecordEntries(value, path12)) {
+    if (typeof raw === "string") out[key] = raw;
+    else if (typeof raw === "number" || typeof raw === "boolean") out[key] = String(raw);
+  }
+  return out;
+}
+function isSubset(selector, labels) {
+  const keys = Object.keys(selector);
+  if (!keys.length) return false;
+  return keys.every((key) => labels[key] === selector[key]);
+}
+function describeObject(value, kind) {
+  const parts = [];
+  const replicas = getPath(value, ["spec", "replicas"]);
+  if (typeof replicas === "number") parts.push(`${replicas} replica${replicas === 1 ? "" : "s"}`);
+  const podPath = podSpecPath(kind);
+  if (podPath) {
+    const count = CONTAINER_FIELDS.reduce(
+      (sum, field) => sum + getArray(value, [...podPath, field]).length,
+      0
+    );
+    if (count) parts.push(`${count} container${count === 1 ? "" : "s"}`);
+  }
+  if (kind === "Service") {
+    const type = getString(value, ["spec", "type"]);
+    if (type) parts.push(type);
+    const ports = getArray(value, ["spec", "ports"]).map((p) => getString(p, ["port"])).filter(Boolean);
+    if (ports.length) parts.push(`port ${ports.join(", ")}`);
+  }
+  return parts.join(", ");
+}
+
+// src/engine/toolchain/terraform.ts
+var BUILTIN_REF_PREFIXES = /* @__PURE__ */ new Set([
+  "count",
+  "each",
+  "self",
+  "path",
+  "terraform"
+]);
+var BLOCK_SPECS = {
+  resource: {
+    kind: "resource",
+    labels: 2,
+    address: ([type, name]) => `${type}.${name}`,
+    signature: "terraform.resource",
+    importance: 0.5
+  },
+  data: {
+    kind: "resource",
+    labels: 2,
+    address: ([type, name]) => `data.${type}.${name}`,
+    signature: "terraform.data",
+    importance: 0.3
+  },
+  module: {
+    kind: "module",
+    labels: 1,
+    address: ([name]) => `module.${name}`,
+    signature: "terraform.module",
+    importance: 0.6
+  },
+  variable: {
+    kind: "property",
+    labels: 1,
+    address: ([name]) => `var.${name}`,
+    signature: "terraform.variable",
+    importance: 0.2
+  },
+  output: {
+    kind: "property",
+    labels: 1,
+    address: ([name]) => `output.${name}`,
+    signature: "terraform.output",
+    importance: 0.3
+  },
+  provider: {
+    kind: "package",
+    labels: 1,
+    address: ([name]) => `provider.${name}`,
+    signature: "terraform.provider",
+    importance: 0.4
+  }
+};
+function stringLitValue(node) {
+  for (const child of node.namedChildren) {
+    if (child?.type === "template_literal") return child.text;
+  }
+  return "";
+}
+function topLevelBlocks(root) {
+  const out = [];
+  for (const bodyCandidate of root.namedChildren) {
+    if (!bodyCandidate) continue;
+    const body = bodyCandidate.type === "body" ? bodyCandidate : null;
+    if (!body) continue;
+    for (const child of body.namedChildren) {
+      if (child?.type === "block") out.push(child);
+    }
+  }
+  return out;
+}
+function blockBody(block) {
+  for (const child of block.namedChildren) {
+    if (child?.type === "body") return child;
+  }
+  return null;
+}
+function attributes(body) {
+  const out = [];
+  for (const child of body.namedChildren) {
+    if (child?.type !== "attribute") continue;
+    let name = "";
+    let expr = null;
+    for (const part of child.namedChildren) {
+      if (!part) continue;
+      if (!name && part.type === "identifier") name = part.text;
+      else if (part.type === "expression") expr = part;
+    }
+    if (name) out.push({ name, expr, node: child });
+  }
+  return out;
+}
+function nestedBlocks(body) {
+  const out = [];
+  for (const child of body.namedChildren) {
+    if (child?.type === "block") out.push(child);
+  }
+  return out;
+}
+function blockHead(block) {
+  let type = "";
+  const labels = [];
+  for (const child of block.namedChildren) {
+    if (!child) continue;
+    if (!type && child.type === "identifier") type = child.text;
+    else if (child.type === "string_lit") labels.push(stringLitValue(child));
+    else if (child.type === "body") break;
+  }
+  return { type, labels };
+}
+function referencedAddresses(expr, out) {
+  if (!expr) return;
+  const stack = [expr];
+  while (stack.length) {
+    const node = stack.pop();
+    if (!node) continue;
+    if (node.type === "variable_expr") {
+      const root = node.text;
+      const parts = [root];
+      let sibling = node.nextNamedSibling;
+      while (sibling && sibling.type === "get_attr") {
+        const id = sibling.namedChildren.find((c) => c?.type === "identifier");
+        if (!id) break;
+        parts.push(id.text);
+        sibling = sibling.nextNamedSibling;
+      }
+      const address = terraformAddress(parts);
+      if (address) out.add(address);
+      continue;
+    }
+    for (const child of node.namedChildren) {
+      if (child) stack.push(child);
+    }
+  }
+}
+function terraformAddress(parts) {
+  const [head, ...rest] = parts;
+  if (!head || BUILTIN_REF_PREFIXES.has(head)) return null;
+  if (head === "var" || head === "local") return rest.length ? `${head}.${rest[0]}` : null;
+  if (head === "module") return rest.length ? `module.${rest[0]}` : null;
+  if (head === "data") return rest.length >= 2 ? `data.${rest[0]}.${rest[1]}` : null;
+  return rest.length ? `${head}.${rest[0]}` : null;
+}
+function extractRequiredProviders(terraformBlock, lines, nodes, seen) {
+  const body = blockBody(terraformBlock);
+  if (!body) return;
+  for (const nested of nestedBlocks(body)) {
+    const { type } = blockHead(nested);
+    if (type !== "required_providers") continue;
+    const inner = blockBody(nested);
+    if (!inner) continue;
+    for (const attr of attributes(inner)) {
+      let source;
+      let version;
+      const objectAttrs = attr.expr ? collectObjectAttributes(attr.expr) : [];
+      if (objectAttrs.length) {
+        for (const { key, value } of objectAttrs) {
+          if (key === "source") source = value;
+          else if (key === "version") version = value;
+        }
+      } else if (attr.expr) {
+        const literal = findFirst(attr.expr, "string_lit");
+        if (literal) {
+          version = stringLitValue(literal);
+          source = `hashicorp/${attr.name}`;
+        }
+      }
+      const address = `provider.${attr.name}`;
+      if (seen.has(address)) continue;
+      seen.add(address);
+      nodes.push({
+        kind: "package",
+        name: attr.name,
+        qualifiedName: address,
+        span: lines.span(attr.node.startIndex, attr.node.endIndex),
+        signature: "terraform.required_provider",
+        doc: safeDoc(
+          [source && `source ${source}`, version && `version ${version}`].filter(Boolean).join(", ")
+        ),
+        importance: 0.4
+      });
+    }
+  }
+}
+function collectObjectAttributes(expr) {
+  const out = [];
+  const stack = [expr];
+  while (stack.length) {
+    const node = stack.pop();
+    if (!node) continue;
+    if (node.type === "object_elem") {
+      const key = node.namedChildren.find((c) => c?.type === "expression");
+      const rest = node.namedChildren.filter((c) => c?.type === "expression");
+      const valueNode = rest.length > 1 ? rest[1] : null;
+      const keyText = key ? plainText(key) : "";
+      const valueText = valueNode ? plainText(valueNode) : "";
+      if (keyText) out.push({ key: keyText, value: valueText });
+      continue;
+    }
+    for (const child of node.namedChildren) {
+      if (child) stack.push(child);
+    }
+  }
+  return out;
+}
+function plainText(expr) {
+  const lit = findFirst(expr, "string_lit");
+  if (lit) return stringLitValue(lit);
+  return expr.text.trim();
+}
+function findFirst(node, type) {
+  const stack = [node];
+  while (stack.length) {
+    const current = stack.pop();
+    if (!current) continue;
+    if (current.type === type) return current;
+    for (const child of current.namedChildren) {
+      if (child) stack.push(child);
+    }
+  }
+  return null;
+}
+var terraformExtractor = {
+  format: "terraform",
+  matches(rel2) {
+    const lower = rel2.toLowerCase();
+    return lower.endsWith(".tf") || lower.endsWith(".tofu");
+  },
+  async extract(rel2, source) {
+    const parser = await toolchainParser("hcl");
+    if (!parser) {
+      return {
+        nodes: [],
+        edges: [],
+        warnings: [`${rel2}: HCL grammar unavailable \u2014 no Terraform structure extracted`]
+      };
+    }
+    const tree = parser.parse(source);
+    if (!tree) return { nodes: [], edges: [], warnings: [`${rel2}: HCL parse produced no tree`] };
+    const lines = new LineIndex(source);
+    const nodes = [];
+    const edges = [];
+    const warnings = [];
+    const declared = /* @__PURE__ */ new Set();
+    const pendingEdges = [];
+    if (tree.rootNode.hasError) {
+      warnings.push(`${rel2}: HCL parse recovered from a syntax error \u2014 extraction may be partial`);
+    }
+    for (const block of topLevelBlocks(tree.rootNode)) {
+      if (nodes.length >= TOOLCHAIN_NODES_PER_FILE_MAX) {
+        warnings.push(`${rel2}: stopped at ${TOOLCHAIN_NODES_PER_FILE_MAX} nodes`);
+        break;
+      }
+      const { type, labels } = blockHead(block);
+      if (type === "terraform") {
+        extractRequiredProviders(block, lines, nodes, declared);
+        continue;
+      }
+      const spec = BLOCK_SPECS[type];
+      if (!spec || labels.length < spec.labels) continue;
+      const address = spec.address(labels);
+      if (declared.has(address)) continue;
+      declared.add(address);
+      const body = blockBody(block);
+      const attrs = body ? attributes(body) : [];
+      const summaryParts = [];
+      for (const attr of attrs) {
+        if (attr.name === "source" || attr.name === "version" || attr.name === "description") {
+          const value = attr.expr ? plainText(attr.expr) : "";
+          if (value) summaryParts.push(`${attr.name} ${value}`);
+        }
+      }
+      nodes.push({
+        kind: spec.kind,
+        name: labels[labels.length - 1] ?? type,
+        qualifiedName: address,
+        span: lines.span(block.startIndex, block.endIndex),
+        signature: spec.signature,
+        doc: safeDoc(summaryParts.join(", ")),
+        importance: spec.importance
+      });
+      if (!body) continue;
+      const references = /* @__PURE__ */ new Set();
+      for (const attr of attrs) {
+        referencedAddresses(attr.expr, references);
+      }
+      const nestedStack = nestedBlocks(body);
+      while (nestedStack.length) {
+        const nested = nestedStack.pop();
+        if (!nested) continue;
+        const innerBody = blockBody(nested);
+        if (!innerBody) continue;
+        for (const attr of attributes(innerBody)) referencedAddresses(attr.expr, references);
+        nestedStack.push(...nestedBlocks(innerBody));
+      }
+      references.delete(address);
+      for (const target of [...references].sort()) {
+        pendingEdges.push({ kind: "depends_on", from: address, to: target, confidence: 1 });
+      }
+    }
+    for (const edge of pendingEdges) {
+      if (declared.has(edge.to)) edges.push(edge);
+    }
+    return { nodes, edges, warnings };
+  }
+};
+
+// src/engine/toolchain/workflows.ts
+var MAX_STEPS_PER_JOB = 100;
+var GITLAB_RESERVED = /* @__PURE__ */ new Set([
+  "stages",
+  "variables",
+  "default",
+  "include",
+  "workflow",
+  "image",
+  "services",
+  "before_script",
+  "after_script",
+  "cache",
+  "pages"
+]);
+function isGitHubWorkflowPath(rel2) {
+  return /(^|\/)\.github\/workflows\/[^/]+\.ya?ml$/i.test(toPosix3(rel2));
+}
+function isGitLabCiPath(rel2) {
+  const base = toPosix3(rel2).split("/").pop()?.toLowerCase() ?? "";
+  return base === ".gitlab-ci.yml" || base === ".gitlab-ci.yaml";
+}
+function imagesBuiltBy(script) {
+  const out = /* @__PURE__ */ new Set();
+  const buildTag = /\b(?:docker|podman)\s+(?:buildx\s+)?build\b[^\n]*?(?:-t|--tag)[=\s]+(\S+)/g;
+  for (const match of script.matchAll(buildTag)) out.add(match[1]);
+  const push2 = /\b(?:docker|podman)\s+push\s+(\S+)/g;
+  for (const match of script.matchAll(push2)) out.add(match[1]);
+  return [...out].filter((tag) => !tag.includes("${") && !tag.includes("{{")).sort();
+}
+function terraformAppliedDirs(script, workingDirectory) {
+  const out = /* @__PURE__ */ new Set();
+  const apply = /\b(?:terraform|tofu)\s+(?:-chdir=(\S+)\s+)?(?:apply|destroy)\b/g;
+  for (const match of script.matchAll(apply)) {
+    out.add(match[1] ?? workingDirectory ?? ".");
+  }
+  return [...out].sort();
+}
+function collectSecretReferences(value, out) {
+  const stack = [value];
+  while (stack.length) {
+    const current = stack.pop();
+    if (typeof current === "string") {
+      for (const match of current.matchAll(/secrets\.([A-Za-z_][A-Za-z0-9_]*)/g)) {
+        out.add(`secret:${match[1]}`);
+      }
+      continue;
+    }
+    if (Array.isArray(current)) {
+      stack.push(...current);
+      continue;
+    }
+    if (current && typeof current === "object") {
+      stack.push(...Object.values(current));
+    }
+  }
+}
+var githubActionsExtractor = {
+  format: "github-actions",
+  matches(rel2) {
+    return isGitHubWorkflowPath(rel2);
+  },
+  extract(rel2, source) {
+    const { docs, warnings } = parseYamlStream(rel2, source);
+    const lines = new LineIndex(source);
+    const nodes = [];
+    const edges = [];
+    const doc = docs[0];
+    if (!doc) return { nodes, edges, warnings };
+    const workflowName = getString(doc.value, ["name"]) ?? toPosix3(rel2).split("/").pop() ?? rel2;
+    const workflowAddress = `workflow:${toPosix3(rel2)}`;
+    nodes.push({
+      kind: "job",
+      name: workflowName,
+      qualifiedName: workflowAddress,
+      span: spanAt(doc, lines, []),
+      signature: "gha.workflow",
+      doc: safeDoc(`GitHub Actions workflow`),
+      importance: 0.6
+    });
+    const onValue = getPath(doc.value, ["on"]) ?? getPath(doc.value, [true]);
+    for (const event of triggerEvents(onValue)) {
+      const eventAddress = `event:${event}`;
+      nodes.push({
+        kind: "property",
+        name: event,
+        qualifiedName: eventAddress,
+        span: spanAt(doc, lines, ["on"]),
+        signature: "gha.event",
+        importance: 0.2
+      });
+      edges.push({ kind: "triggers", from: eventAddress, to: workflowAddress, confidence: 1 });
+    }
+    const jobs = getRecordEntries(doc.value, ["jobs"]);
+    const jobAddresses = new Set(jobs.map(([id]) => `job:${id}`));
+    for (const [jobId, job] of jobs) {
+      if (nodes.length >= TOOLCHAIN_NODES_PER_FILE_MAX) {
+        warnings.push(`${rel2}: stopped at ${TOOLCHAIN_NODES_PER_FILE_MAX} nodes`);
+        break;
+      }
+      const jobAddress = `job:${jobId}`;
+      const runsOn = getPath(job, ["runs-on"]);
+      const steps = getArray(job, ["steps"]);
+      nodes.push({
+        kind: "job",
+        name: getString(job, ["name"]) ?? jobId,
+        qualifiedName: jobAddress,
+        span: spanAt(doc, lines, ["jobs", jobId]),
+        signature: "gha.job",
+        doc: safeDoc(
+          [
+            typeof runsOn === "string" ? `runs-on ${runsOn}` : null,
+            steps.length ? `${steps.length} step${steps.length === 1 ? "" : "s"}` : null
+          ].filter(Boolean).join(", ")
+        ),
+        importance: 0.5
+      });
+      edges.push({ kind: "contains", from: workflowAddress, to: jobAddress, confidence: 1 });
+      for (const need of asStringList(getPath(job, ["needs"]))) {
+        const to = `job:${need}`;
+        if (jobAddresses.has(to)) {
+          edges.push({ kind: "depends_on", from: jobAddress, to, confidence: 1 });
+        }
+      }
+      steps.slice(0, MAX_STEPS_PER_JOB).forEach((step, index) => {
+        const uses = getString(step, ["uses"]);
+        const run = getString(step, ["run"]);
+        const stepName = getString(step, ["name"]) ?? uses ?? (run ? run.split("\n")[0] : `step ${index + 1}`);
+        const stepAddress = `${jobAddress}#${index}`;
+        nodes.push({
+          kind: "step",
+          name: stepName.slice(0, 80),
+          qualifiedName: stepAddress,
+          span: spanAt(doc, lines, ["jobs", jobId, "steps", index]),
+          signature: uses ? "gha.step.uses" : "gha.step.run",
+          // `run:` bodies are shell scripts and are exactly where a token gets
+          // pasted — safeDoc redacts, and we keep only the first line.
+          doc: safeDoc(uses ? `uses ${uses}` : run?.split("\n")[0]),
+          importance: 0.2
+        });
+        edges.push({ kind: "contains", from: jobAddress, to: stepAddress, confidence: 1 });
+        if (uses) {
+          const actionAddress = `action:${uses}`;
+          nodes.push({
+            kind: "external",
+            name: uses.split("@")[0],
+            qualifiedName: actionAddress,
+            span: spanAt(doc, lines, ["jobs", jobId, "steps", index, "uses"]),
+            signature: "gha.action",
+            importance: 0.2
+          });
+          edges.push({ kind: "depends_on", from: stepAddress, to: actionAddress, confidence: 1 });
+        }
+        if (run) {
+          const stepSpan = spanAt(doc, lines, ["jobs", jobId, "steps", index]);
+          const workingDirectory = getString(step, ["working-directory"]) ?? getString(job, ["defaults", "run", "working-directory"]);
+          emitScriptEffects(rel2, run, workingDirectory, jobAddress, stepSpan, nodes, edges);
+        }
+      });
+      if (steps.length > MAX_STEPS_PER_JOB) {
+        warnings.push(`${rel2}: job ${jobId} has ${steps.length} steps \u2014 enumerated the first ${MAX_STEPS_PER_JOB}`);
+      }
+      const secrets = /* @__PURE__ */ new Set();
+      collectSecretReferences(job, secrets);
+      for (const secret of [...secrets].sort()) {
+        nodes.push({
+          kind: "property",
+          name: secret.slice("secret:".length),
+          qualifiedName: secret,
+          span: spanAt(doc, lines, ["jobs", jobId]),
+          signature: "gha.secret-ref",
+          importance: 0.2
+        });
+        edges.push({ kind: "mounts", from: jobAddress, to: secret, confidence: 1 });
+      }
+    }
+    return { nodes, edges, warnings };
+  }
+};
+var gitlabCiExtractor = {
+  format: "gitlab-ci",
+  matches(rel2) {
+    return isGitLabCiPath(rel2);
+  },
+  extract(rel2, source) {
+    const { docs, warnings } = parseYamlStream(rel2, source);
+    const lines = new LineIndex(source);
+    const nodes = [];
+    const edges = [];
+    const doc = docs[0];
+    if (!doc) return { nodes, edges, warnings };
+    const pipelineAddress = `workflow:${toPosix3(rel2)}`;
+    nodes.push({
+      kind: "job",
+      name: "GitLab CI",
+      qualifiedName: pipelineAddress,
+      span: spanAt(doc, lines, []),
+      signature: "gitlab.pipeline",
+      importance: 0.6
+    });
+    const jobs = getRecordEntries(doc.value, []).filter(
+      ([key, value]) => !GITLAB_RESERVED.has(key) && !key.startsWith(".") && value !== null && typeof value === "object" && !Array.isArray(value)
+    );
+    const jobAddresses = new Set(jobs.map(([id]) => `job:${id}`));
+    for (const [jobId, job] of jobs) {
+      if (nodes.length >= TOOLCHAIN_NODES_PER_FILE_MAX) {
+        warnings.push(`${rel2}: stopped at ${TOOLCHAIN_NODES_PER_FILE_MAX} nodes`);
+        break;
+      }
+      const jobAddress = `job:${jobId}`;
+      const stage = getString(job, ["stage"]);
+      const image = getString(job, ["image"]) ?? getString(job, ["image", "name"]);
+      nodes.push({
+        kind: "job",
+        name: jobId,
+        qualifiedName: jobAddress,
+        span: spanAt(doc, lines, [jobId]),
+        signature: "gitlab.job",
+        doc: safeDoc([stage && `stage ${stage}`, image && `image ${image}`].filter(Boolean).join(", ")),
+        importance: 0.5
+      });
+      edges.push({ kind: "contains", from: pipelineAddress, to: jobAddress, confidence: 1 });
+      for (const key of ["needs", "dependencies"]) {
+        for (const need of asStringList(getPath(job, [key]))) {
+          const to = `job:${need}`;
+          if (jobAddresses.has(to)) {
+            edges.push({ kind: "depends_on", from: jobAddress, to, confidence: 1 });
+          }
+        }
+      }
+    }
+    return { nodes, edges, warnings };
+  }
+};
+function emitScriptEffects(rel2, script, workingDirectory, jobAddress, span, nodes, edges) {
+  for (const tag of imagesBuiltBy(script)) {
+    const ref = parseImageRef(tag);
+    if (!ref) continue;
+    const address = `image:${ref.raw}`;
+    nodes.push({
+      kind: "image",
+      name: ref.repository.split("/").pop() ?? ref.repository,
+      qualifiedName: address,
+      span,
+      signature: "ci.builds-image",
+      doc: safeDoc(ref.tag ? `${ref.repository} tag ${ref.tag}` : ref.repository),
+      importance: 0.4
+    });
+    edges.push({ kind: "provisions", from: jobAddress, to: address, confidence: 1 });
+  }
+  for (const dir of terraformAppliedDirs(script, workingDirectory)) {
+    const resolved = normaliseWorkspacePath(dir);
+    const address = `tfdir:${resolved}`;
+    nodes.push({
+      kind: "resource",
+      name: resolved,
+      qualifiedName: address,
+      span,
+      signature: "ci.terraform-apply",
+      doc: safeDoc(`terraform apply in ${resolved}`),
+      importance: 0.4
+    });
+    edges.push({ kind: "deploys", from: jobAddress, to: address, confidence: 1 });
+  }
+}
+function normaliseWorkspacePath(dir) {
+  const out = [];
+  for (const part of toPosix3(dir).split("/")) {
+    if (!part || part === ".") continue;
+    if (part === "..") {
+      out.pop();
+      continue;
+    }
+    out.push(part);
+  }
+  return out.join("/") || ".";
+}
+function triggerEvents(value) {
+  if (typeof value === "string") return [value];
+  if (Array.isArray(value)) return value.filter((v) => typeof v === "string").sort();
+  if (value && typeof value === "object") return Object.keys(value).sort();
+  return [];
+}
+function asStringList(value) {
+  if (typeof value === "string") return [value];
+  if (!Array.isArray(value)) return [];
+  const out = [];
+  for (const item of value) {
+    if (typeof item === "string") out.push(item);
+    else if (item && typeof item === "object") {
+      const job = item.job;
+      if (typeof job === "string") out.push(job);
+    }
+  }
+  return out.sort();
+}
+
+// src/engine/toolchain/link.ts
+var LINK_CONFIDENCE = {
+  /** Compose names the Dockerfile path outright. */
+  composeBuild: 0.95,
+  /** A CI job builds tag X; a workload runs tag X. Same string, both sides. */
+  imageIdentity: 0.8,
+  /** A CI job applies Terraform in a directory that contains these resources. */
+  terraformDir: 0.75,
+  /** A Dockerfile copies a path that exists in the repository. */
+  dockerfileCopy: 0.6
+};
+function linkToolchain(input) {
+  const { nodes, edges, fileNodes, stageCopySources } = input;
+  const out = /* @__PURE__ */ new Map();
+  const counts = {};
+  const add3 = (kind, src, dst, confidence, join10) => {
+    if (src === dst) return;
+    const id = edgeId(kind, src, dst);
+    if (out.has(id)) return;
+    out.set(id, {
+      id,
+      kind,
+      src,
+      dst,
+      resolution: "heuristic",
+      confidence,
+      epistemic: "name-matched"
+    });
+    counts[join10] = (counts[join10] ?? 0) + 1;
+  };
+  const declared = new Set(edges.map((e) => `${e.kind} ${e.src} ${e.dst}`));
+  const dockerfileByPath = /* @__PURE__ */ new Map();
+  const dockerfileRefs = [];
+  const imageSites = /* @__PURE__ */ new Map();
+  const terraformDirMarkers = [];
+  const terraformNodesByDir = /* @__PURE__ */ new Map();
+  const stagesByDockerfile = /* @__PURE__ */ new Map();
+  for (const node of nodes) {
+    const qn = node.qualifiedName;
+    if (qn.startsWith("dockerfile:")) {
+      const target = qn.slice("dockerfile:".length);
+      if (target.includes("#")) {
+        push(stagesByDockerfile, target.split("#")[0], node);
+        continue;
+      }
+      if (toPosix3(node.file) === target) dockerfileByPath.set(target, node);
+      else dockerfileRefs.push(node);
+      continue;
+    }
+    if (qn.startsWith("image:")) {
+      const ref = parseImageRef(qn.slice("image:".length));
+      if (ref) push(imageSites, imageIdentity(ref), node);
+      continue;
+    }
+    if (qn.startsWith("tfdir:")) {
+      terraformDirMarkers.push(node);
+      continue;
+    }
+    if (node.lang === "terraform") push(terraformNodesByDir, dirOf(toPosix3(node.file)), node);
+  }
+  for (const ref of dockerfileRefs) {
+    const target = dockerfileByPath.get(ref.qualifiedName.slice("dockerfile:".length));
+    if (!target) continue;
+    add3("builds_from", ref.id, target.id, LINK_CONFIDENCE.composeBuild, "compose\u2192dockerfile");
+  }
+  const producerOf = /* @__PURE__ */ new Map();
+  const consumerOf = /* @__PURE__ */ new Map();
+  for (const edge of edges) {
+    if (edge.kind === "provisions") push(producerOf, edge.dst, edge.src);
+    else if (edge.kind === "builds_from") push(consumerOf, edge.dst, edge.src);
+  }
+  for (const identity of [...imageSites.keys()].sort((a, b) => a.localeCompare(b, "en"))) {
+    const sites = imageSites.get(identity) ?? [];
+    if (sites.length < 2) continue;
+    const producers = /* @__PURE__ */ new Set();
+    const consumers = /* @__PURE__ */ new Set();
+    for (const site of sites) {
+      for (const id of producerOf.get(site.id) ?? []) producers.add(id);
+      for (const id of consumerOf.get(site.id) ?? []) consumers.add(id);
+    }
+    for (const producer of [...producers].sort()) {
+      for (const consumer of [...consumers].sort()) {
+        if (declared.has(`deploys ${producer} ${consumer}`)) continue;
+        add3("deploys", producer, consumer, LINK_CONFIDENCE.imageIdentity, "ci\u2192workload");
+      }
+    }
+    const ordered = [...sites].sort((a, b) => a.id.localeCompare(b.id, "en"));
+    for (let i = 1; i < ordered.length; i++) {
+      add3("references", ordered[0].id, ordered[i].id, LINK_CONFIDENCE.imageIdentity, "image\u2194image");
+    }
+  }
+  const terraformDirs = [...terraformNodesByDir.keys()].sort((a, b) => a.localeCompare(b, "en"));
+  for (const marker of [...terraformDirMarkers].sort((a, b) => a.id.localeCompare(b.id, "en"))) {
+    const dir = marker.qualifiedName.slice("tfdir:".length);
+    for (const resourceDir of terraformDirs) {
+      if (resourceDir !== dir && !resourceDir.startsWith(`${dir}/`)) continue;
+      for (const resource of terraformNodesByDir.get(resourceDir) ?? []) {
+        if (resource.signature !== "terraform.resource" && resource.signature !== "terraform.module") {
+          continue;
+        }
+        add3("deploys", marker.id, resource.id, LINK_CONFIDENCE.terraformDir, "ci\u2192terraform");
+      }
+    }
+  }
+  for (const file of [...stagesByDockerfile.keys()].sort((a, b) => a.localeCompare(b, "en"))) {
+    const stages = [...stagesByDockerfile.get(file) ?? []].sort(
+      (a, b) => a.qualifiedName.localeCompare(b.qualifiedName, "en")
+    );
+    for (const stage of stages) {
+      const copied = stageCopySources.get(stage.qualifiedName);
+      if (!copied?.length) continue;
+      for (const path12 of copied) {
+        const fileNodeId = fileNodes.get(toPosix3(path12));
+        if (!fileNodeId) continue;
+        add3("depends_on", stage.id, fileNodeId, LINK_CONFIDENCE.dockerfileCopy, "dockerfile\u2192source");
+      }
+    }
+  }
+  return {
+    edges: [...out.values()].sort(
+      (a, b) => a.kind.localeCompare(b.kind, "en") || a.src.localeCompare(b.src, "en") || a.dst.localeCompare(b.dst, "en")
+    ),
+    counts
+  };
+}
+function push(map, key, value) {
+  const list = map.get(key);
+  if (list) list.push(value);
+  else map.set(key, [value]);
+}
+function dirOf(rel2) {
+  const idx = rel2.lastIndexOf("/");
+  return idx === -1 ? "." : rel2.slice(0, idx);
+}
+
+// src/engine/toolchain/index.ts
+var EXTRACTORS = [
+  terraformExtractor,
+  dockerfileExtractor,
+  githubActionsExtractor,
+  gitlabCiExtractor,
+  helmExtractor,
+  composeExtractor,
+  kubernetesExtractor
+];
+var HEAD_BYTES = 4096;
+var EMPTY_RESULT = {
+  nodes: [],
+  edges: [],
+  warnings: [],
+  counts: {},
+  linkCounts: {}
+};
+function extractorFor(doc, head) {
+  for (const extractor of EXTRACTORS) {
+    try {
+      if (extractor.matches(toPosix3(doc.rel), doc.category ?? doc.kind, head)) return extractor;
+    } catch {
+    }
+  }
+  return null;
+}
+async function extractToolchain(docs, options = {}) {
+  if (!docs.length) return EMPTY_RESULT;
+  const nodes = /* @__PURE__ */ new Map();
+  const edges = /* @__PURE__ */ new Map();
+  const warnings = [];
+  const counts = {};
+  const stageCopySources = /* @__PURE__ */ new Map();
+  const ordered = [...docs].sort((a, b) => toPosix3(a.rel).localeCompare(toPosix3(b.rel), "en"));
+  for (const doc of ordered) {
+    let source;
+    let head;
+    try {
+      const stat = fs12.statSync(doc.abs);
+      if (stat.size > TOOLCHAIN_FILE_MAX_BYTES) continue;
+      source = fs12.readFileSync(doc.abs, "utf8");
+      head = source.slice(0, HEAD_BYTES);
+    } catch {
+      continue;
+    }
+    const extractor = extractorFor(doc, head);
+    if (!extractor) continue;
+    const rel2 = toPosix3(doc.rel);
+    let extraction;
+    try {
+      extraction = await extractor.extract(rel2, source);
+    } catch (err) {
+      warnings.push(`${rel2}: ${extractor.format} extraction failed (${err.message})`);
+      continue;
+    }
+    if (extraction.warnings?.length) warnings.push(...extraction.warnings);
+    for (const [stage, paths] of Object.entries(extraction.linkHints?.copySourcesByStage ?? {})) {
+      if (paths.length) stageCopySources.set(stage, paths);
+    }
+    if (!extraction.nodes.length) continue;
+    counts[extractor.format] = (counts[extractor.format] ?? 0) + 1;
+    const idByQualifiedName = /* @__PURE__ */ new Map();
+    for (const draft of extraction.nodes) {
+      const id = nodeId({
+        kind: draft.kind,
+        qualifiedName: draft.qualifiedName,
+        file: rel2,
+        signature: draft.signature
+      });
+      if (!idByQualifiedName.has(draft.qualifiedName)) {
+        idByQualifiedName.set(draft.qualifiedName, id);
+      }
+      if (nodes.has(id)) continue;
+      nodes.set(id, toGraphNode(id, draft, rel2, extractor.format));
+    }
+    for (const draft of extraction.edges) {
+      const src = idByQualifiedName.get(draft.from);
+      const dst = idByQualifiedName.get(draft.to);
+      if (!src || !dst || src === dst) continue;
+      const id = edgeId(draft.kind, src, dst);
+      if (edges.has(id)) continue;
+      edges.set(id, {
+        id,
+        kind: draft.kind,
+        src,
+        dst,
+        // Structural extraction from a declaration in the file itself.
+        resolution: "heuristic",
+        confidence: draft.confidence ?? 1,
+        epistemic: "declared"
+      });
+    }
+  }
+  const sortedNodes = [...nodes.values()].sort((a, b) => a.id.localeCompare(b.id, "en"));
+  const sortedEdges = [...edges.values()].sort(byEdgeOrder);
+  const linked = linkToolchain({
+    nodes: sortedNodes,
+    edges: sortedEdges,
+    fileNodes: options.fileNodes ?? /* @__PURE__ */ new Map(),
+    stageCopySources
+  });
+  const declaredIds = new Set(sortedEdges.map((e) => e.id));
+  const allEdges = [...sortedEdges, ...linked.edges.filter((e) => !declaredIds.has(e.id))].sort(
+    byEdgeOrder
+  );
+  return {
+    nodes: sortedNodes,
+    edges: allEdges,
+    warnings: [...new Set(warnings)].sort(),
+    counts,
+    linkCounts: linked.counts
+  };
+}
+function byEdgeOrder(a, b) {
+  return a.kind.localeCompare(b.kind, "en") || a.src.localeCompare(b.src, "en") || a.dst.localeCompare(b.dst, "en");
+}
+function toGraphNode(id, draft, rel2, format) {
+  return {
+    id,
+    kind: draft.kind,
+    name: draft.name,
+    qualifiedName: draft.qualifiedName,
+    file: rel2,
+    span: draft.span,
+    // `lang` is the format tag, so `--only` and the report can filter on it
+    // without colliding with a source language id.
+    lang: format,
+    signature: draft.signature,
+    doc: safeDoc(draft.doc),
+    importance: draft.importance ?? 0.3,
+    centrality: { degree: 0, pagerank: 0, betweenness: 0, eigenvector: 0 },
+    area: -1,
+    isHub: false,
+    // Infrastructure has no notion of unit-test coverage; `null` is the
+    // schema's "not analyzable", which is the honest answer.
+    tested: null
+  };
+}
 function shardTsProjects(root, files) {
   if (files.length === 0) return [];
   const cache = /* @__PURE__ */ new Map();
@@ -1848,8 +3485,8 @@ function nearestProjectKey(root, startDir, cache) {
   let dir = startDir;
   const rootAbs = path11.resolve(root);
   while (true) {
-    if (fs11.existsSync(path11.join(dir, "tsconfig.json")) || fs11.existsSync(path11.join(dir, "tsconfig.base.json")) || fs11.existsSync(path11.join(dir, "package.json"))) {
-      const key = toPosix3(path11.relative(rootAbs, dir)) || ".";
+    if (fs12.existsSync(path11.join(dir, "tsconfig.json")) || fs12.existsSync(path11.join(dir, "tsconfig.base.json")) || fs12.existsSync(path11.join(dir, "package.json"))) {
+      const key = toPosix4(path11.relative(rootAbs, dir)) || ".";
       cache.set(startDir, key);
       return key;
     }
@@ -1860,7 +3497,7 @@ function nearestProjectKey(root, startDir, cache) {
     dir = path11.dirname(dir);
   }
 }
-function toPosix3(p) {
+function toPosix4(p) {
   return p.split(path11.sep).join("/");
 }
 
@@ -1955,7 +3592,7 @@ var emptyNode = (partial) => ({
 function extractManifests(root, opts = {}) {
   const absRoot = path11.resolve(root);
   const ig = buildRootIgnore3(absRoot, opts.exclude ?? []);
-  const scopes = (opts.paths?.length ? opts.paths : ["."]).map((p) => path11.resolve(absRoot, p)).filter((p) => fs11.existsSync(p));
+  const scopes = (opts.paths?.length ? opts.paths : ["."]).map((p) => path11.resolve(absRoot, p)).filter((p) => fs12.existsSync(p));
   const found = /* @__PURE__ */ new Map();
   for (const scope of scopes) {
     walkManifests(absRoot, scope, ig, found);
@@ -1985,7 +3622,7 @@ function extractManifests(root, opts = {}) {
   };
 }
 function ingestPackageJson(rel2, abs, nodes, edges) {
-  const raw = JSON.parse(fs11.readFileSync(abs, "utf8"));
+  const raw = JSON.parse(fs12.readFileSync(abs, "utf8"));
   const pkgName = raw.name && String(raw.name).trim() || path11.posix.dirname(rel2) || ".";
   const localId = nodeId({ kind: "package", qualifiedName: pkgName, file: rel2 });
   nodes.set(
@@ -2029,7 +3666,7 @@ function ingestPackageJson(rel2, abs, nodes, edges) {
   return n;
 }
 function ingestGoMod(rel2, abs, nodes, edges) {
-  const text = fs11.readFileSync(abs, "utf8");
+  const text = fs12.readFileSync(abs, "utf8");
   let moduleName = path11.posix.dirname(rel2) || ".";
   const moduleMatch = /^\s*module\s+(\S+)/m.exec(text);
   if (moduleMatch) moduleName = moduleMatch[1];
@@ -2113,9 +3750,9 @@ function addEdge(edges, kind, src, dst, confidence) {
 function buildRootIgnore3(root, exclude) {
   const ig = ignore();
   const gitignorePath = path11.join(root, ".gitignore");
-  if (fs11.existsSync(gitignorePath)) {
+  if (fs12.existsSync(gitignorePath)) {
     try {
-      ig.add(fs11.readFileSync(gitignorePath, "utf8"));
+      ig.add(fs12.readFileSync(gitignorePath, "utf8"));
     } catch {
     }
   }
@@ -2125,7 +3762,7 @@ function buildRootIgnore3(root, exclude) {
 function walkManifests(root, dir, ig, found) {
   let entries;
   try {
-    entries = fs11.readdirSync(dir, { withFileTypes: true });
+    entries = fs12.readdirSync(dir, { withFileTypes: true });
   } catch {
     return;
   }
@@ -2158,7 +3795,7 @@ async function hashFilesParallel(jobs, concurrency) {
       if (i >= jobs.length) return;
       const job = jobs[i];
       try {
-        const buf = await fs8.readFile(job.abs);
+        const buf = await fs9.readFile(job.abs);
         out[i] = { rel: job.rel, hash: hashBytes(buf), ok: true };
       } catch {
         out[i] = { rel: job.rel, hash: "", ok: false };
@@ -2189,7 +3826,7 @@ async function buildGraph(options) {
     );
   }
   checkMemoryBudget("discovery", limits.memoryBudgetMb);
-  const grammars = grammarSetVersion();
+  const grammars = `${grammarSetVersion()}+${toolchainGrammarSetVersion()}`;
   const cache = loadCache(root, {
     toolVersion: VERSION,
     grammars,
@@ -2206,7 +3843,7 @@ async function buildGraph(options) {
   for (const file of files) {
     let stat;
     try {
-      stat = fs11.statSync(file.abs);
+      stat = fs12.statSync(file.abs);
     } catch {
       continue;
     }
@@ -2412,8 +4049,8 @@ async function buildGraph(options) {
   });
   for (const d of docs) {
     try {
-      const st = fs11.statSync(d.abs);
-      const hash = hashBytes(fs11.readFileSync(d.abs));
+      const st = fs12.statSync(d.abs);
+      const hash = hashBytes(fs12.readFileSync(d.abs));
       hashes.set(d.rel, hash);
       fileStats.push({ rel: d.rel, size: st.size, mtimeMs: st.mtimeMs, hash });
     } catch {
@@ -2421,14 +4058,29 @@ async function buildGraph(options) {
   }
   const docNodes = documentNodesFromDocs(docs);
   if (docNodes.length) nodes = [...nodes, ...docNodes];
+  timer.start("toolchain");
+  const fileNodesByPath = /* @__PURE__ */ new Map();
+  for (const node of nodes) {
+    if (node.kind === "file") fileNodesByPath.set(node.file.replace(/\\/g, "/"), node.id);
+  }
+  const toolchainResult = await extractToolchain(docs, { fileNodes: fileNodesByPath });
+  if (toolchainResult.nodes.length) nodes = [...nodes, ...toolchainResult.nodes];
+  timer.end("toolchain");
   timer.start("analyze");
-  const analysis = analyze(nodes, linked.edges, {
+  const graphEdges = toolchainResult.edges.length ? [...linked.edges, ...toolchainResult.edges] : linked.edges;
+  const analysis = analyze(nodes, graphEdges, {
     cluster: options.cluster,
     tier: options.analysisTier
   });
   timer.end("analyze");
   checkMemoryBudget("analysis", limits.memoryBudgetMb);
-  const languages = [.../* @__PURE__ */ new Set([...parses.map((p) => p.lang), ...docNodes.map((n) => n.lang)])].sort();
+  const languages = [
+    .../* @__PURE__ */ new Set([
+      ...parses.map((p) => p.lang),
+      ...docNodes.map((n) => n.lang),
+      ...toolchainResult.nodes.map((n) => n.lang)
+    ])
+  ].sort();
   const edgeKinds = [...new Set(analysis.edges.map((e) => e.kind))].sort();
   const corpusHash = computeCorpusHash(parses, hashes);
   const nodeKindById = new Map(analysis.nodes.map((n) => [n.id, n.kind]));
@@ -2504,7 +4156,8 @@ async function buildGraph(options) {
     tsc: tscStats,
     scip: scipStats,
     index: indexResult,
-    warnings
+    warnings,
+    fileRoles: fileRolesFromParses(parses)
   };
 }
 function toRepoRel(p) {
@@ -2518,9 +4171,9 @@ function loadScipIndex(root, explicit) {
   ].filter((p) => Boolean(p));
   for (const file of candidates) {
     const abs = path11.isAbsolute(file) ? file : path11.resolve(root, file);
-    if (!fs11.existsSync(abs)) continue;
+    if (!fs12.existsSync(abs)) continue;
     try {
-      const index = decodeScipIndex(new Uint8Array(fs11.readFileSync(abs)));
+      const index = decodeScipIndex(new Uint8Array(fs12.readFileSync(abs)));
       if (index.documents.length) {
         return { index, tool: index.toolVersion ? `${index.toolName} ${index.toolVersion}` : index.toolName };
       }
@@ -2612,36 +4265,6 @@ function diffHint(x, y) {
   }
   return "outputs differ in length";
 }
-
-// src/util/exit.ts
-var ExitCode = {
-  OK: 0,
-  ERROR: 1,
-  GATE_FAILED: 2,
-  NOT_FOUND: 3,
-  NON_DETERMINISTIC: 4,
-  USAGE_ERROR: 5,
-  /**
-   * A required optional module (engine) is not installed and could not be
-   * fetched. Deliberately distinct from GATE_FAILED so a CI gate can never
-   * read "engine missing" as "gate passed" or "gate failed".
-   */
-  ENGINE_UNAVAILABLE: 6
-};
-var CliError = class extends Error {
-  code;
-  constructor(message, code = ExitCode.ERROR) {
-    super(message);
-    this.name = "CliError";
-    this.code = code;
-  }
-};
-function usageError(message) {
-  return new CliError(message, ExitCode.USAGE_ERROR);
-}
-function engineUnavailable(message) {
-  return new CliError(message, ExitCode.ENGINE_UNAVAILABLE);
-}
 var SNAPSHOT_VERSION = "vg-freshness/1";
 function snapshotPath(root) {
   return path11.join(cacheDir(root), "freshness.json");
@@ -2651,14 +4274,14 @@ function writeSnapshot(root, corpusHash, fileStats, scope = {}) {
   for (const f of fileStats) files[f.rel] = { size: f.size, mtimeMs: f.mtimeMs, hash: f.hash };
   const snapshot = { version: SNAPSHOT_VERSION, corpusHash, scope: pruneScope(scope), files };
   try {
-    fs11.mkdirSync(cacheDir(root), { recursive: true });
-    fs11.writeFileSync(snapshotPath(root), stableStringify(snapshot, 0));
+    fs12.mkdirSync(cacheDir(root), { recursive: true });
+    fs12.writeFileSync(snapshotPath(root), stableStringify(snapshot, 0));
   } catch {
   }
 }
 function loadSnapshot(root) {
   try {
-    const loaded = JSON.parse(fs11.readFileSync(snapshotPath(root), "utf8"));
+    const loaded = JSON.parse(fs12.readFileSync(snapshotPath(root), "utf8"));
     if (loaded.version === SNAPSHOT_VERSION && loaded.files && typeof loaded.corpusHash === "string") {
       return { ...loaded, scope: loaded.scope ?? {} };
     }
@@ -2701,7 +4324,7 @@ function probeFreshness(root) {
     }
     let stat;
     try {
-      stat = fs11.statSync(file.abs);
+      stat = fs12.statSync(file.abs);
     } catch {
       drift.removed.push(file.rel);
       continue;
@@ -2719,7 +4342,7 @@ function probeFreshness(root) {
     }
     let hash = "";
     try {
-      hash = hashBytes(fs11.readFileSync(file.abs));
+      hash = hashBytes(fs12.readFileSync(file.abs));
     } catch {
       drift.removed.push(file.rel);
       continue;
@@ -2736,7 +4359,7 @@ function probeFreshness(root) {
   }
   if (absorbed && !hasDrift(drift)) {
     try {
-      fs11.writeFileSync(snapshotPath(root), stableStringify(snapshot, 0));
+      fs12.writeFileSync(snapshotPath(root), stableStringify(snapshot, 0));
     } catch {
     }
   }
@@ -2981,12 +4604,12 @@ function detectAssistants(root, opts = {}) {
   const which = opts.which ?? whichOnPath;
   const found = [];
   for (const assistant of ASSISTANTS) {
-    const repoHit = (assistant.markers ?? []).find((m) => fs11.existsSync(path11.join(root, m)));
+    const repoHit = (assistant.markers ?? []).find((m) => fs12.existsSync(path11.join(root, m)));
     if (repoHit) {
       found.push({ assistant, via: "repo", marker: repoHit });
       continue;
     }
-    const homeHit = (assistant.homeMarkers ?? []).find((m) => fs11.existsSync(path11.join(home, m)));
+    const homeHit = (assistant.homeMarkers ?? []).find((m) => fs12.existsSync(path11.join(home, m)));
     if (homeHit) {
       found.push({ assistant, via: "home", marker: homeHit });
       continue;
@@ -3047,27 +4670,27 @@ function uninstallAssistant(a, root, purge) {
     const file = path11.join(root, a.nudge.file);
     if (a.nudge.kind === "block") {
       if (removeBlock(file)) removed.push(a.nudge.file);
-    } else if (fs11.existsSync(file)) {
-      fs11.rmSync(file);
+    } else if (fs12.existsSync(file)) {
+      fs12.rmSync(file);
       removed.push(a.nudge.file);
     }
   }
   if (purge && a.skill) {
     const file = path11.join(root, a.skill);
-    if (fs11.existsSync(file)) {
-      fs11.rmSync(file);
+    if (fs12.existsSync(file)) {
+      fs12.rmSync(file);
       removed.push(a.skill);
     }
   }
   return removed;
 }
 function isAssistantInstalled(a, root) {
-  if (a.skill && fs11.existsSync(path11.join(root, a.skill))) return true;
+  if (a.skill && fs12.existsSync(path11.join(root, a.skill))) return true;
   if (a.mcp) {
     const file = path11.join(root, a.mcp.file);
     if (a.mcp.format === "toml") {
       if (hasTomlMcp(file, a.mcp)) return true;
-    } else if (fs11.existsSync(file)) {
+    } else if (fs12.existsSync(file)) {
       try {
         const config = readJson(file);
         const bag = config[a.mcp.key];
@@ -3078,7 +4701,7 @@ function isAssistantInstalled(a, root) {
   }
   if (a.nudge) {
     const file = path11.join(root, a.nudge.file);
-    if (!fs11.existsSync(file)) return false;
+    if (!fs12.existsSync(file)) return false;
     const text = readTextSafe(file);
     if (!text) return false;
     if (a.nudge.kind === "block") return text.includes(NUDGE_BEGIN);
@@ -3087,8 +4710,8 @@ function isAssistantInstalled(a, root) {
   return false;
 }
 function writeFileEnsured(file, content) {
-  fs11.mkdirSync(path11.dirname(file), { recursive: true });
-  fs11.writeFileSync(file, content);
+  fs12.mkdirSync(path11.dirname(file), { recursive: true });
+  fs12.writeFileSync(file, content);
 }
 function writeNavigationConfig(root) {
   ensureVibgrateGitignore(root);
@@ -3129,7 +4752,7 @@ function upsertTomlMcp(file, target, launch) {
 command = ${tomlString(entry.command)}
 args = [${entry.args.map(tomlString).join(", ")}]
 `;
-  const existing = fs11.existsSync(file) ? fs11.readFileSync(file, "utf8") : "";
+  const existing = fs12.existsSync(file) ? fs12.readFileSync(file, "utf8") : "";
   const re = tomlTableRe(target.key);
   const next = re.test(existing) ? existing.replace(re, (m) => m.startsWith("\n") ? `
 ${table}` : table) : existing.length ? `${existing.replace(/\s*$/, "")}
@@ -3138,7 +4761,7 @@ ${table}` : table;
   writeFileEnsured(file, next);
 }
 function removeTomlMcp(file, target) {
-  if (!fs11.existsSync(file)) return false;
+  if (!fs12.existsSync(file)) return false;
   const existing = readTextSafe(file);
   if (existing === null) return false;
   const re = tomlTableRe(target.key);
@@ -3148,13 +4771,13 @@ function removeTomlMcp(file, target) {
   return true;
 }
 function hasTomlMcp(file, target) {
-  if (!fs11.existsSync(file)) return false;
+  if (!fs12.existsSync(file)) return false;
   const text = readTextSafe(file);
   return text !== null && tomlTableRe(target.key).test(text);
 }
 function removeMcp(file, target) {
   if (target.format === "toml") return removeTomlMcp(file, target);
-  if (!fs11.existsSync(file)) return false;
+  if (!fs12.existsSync(file)) return false;
   const config = readJson(file);
   const bag = config[target.key];
   if (!bag || !(bag.vg !== void 0)) return false;
@@ -3174,7 +4797,7 @@ function refreshInstalledInstructions(root, smallRepo) {
   for (const a of ASSISTANTS) {
     if (a.skill) {
       const file = path11.join(root, a.skill);
-      if (fs11.existsSync(file)) {
+      if (fs12.existsSync(file)) {
         const text = readTextSafe(file);
         const from = text === null ? null : staleVersion(text, "# vg \u2014 the code map");
         if (from !== null) {
@@ -3185,7 +4808,7 @@ function refreshInstalledInstructions(root, smallRepo) {
     }
     if (a.nudge) {
       const file = path11.join(root, a.nudge.file);
-      if (!fs11.existsSync(file)) continue;
+      if (!fs12.existsSync(file)) continue;
       const text = readTextSafe(file);
       if (text === null) continue;
       if (a.nudge.kind === "block") {
@@ -3209,7 +4832,7 @@ function refreshInstalledInstructions(root, smallRepo) {
 }
 function readTextSafe(file) {
   try {
-    return fs11.readFileSync(file, "utf8");
+    return fs12.readFileSync(file, "utf8");
   } catch {
     return null;
   }
@@ -3228,8 +4851,8 @@ ${stripMarkers(nudgeMarkdown(smallRepo, client))}` : stripMarkers(nudgeMarkdown(
   upsertBlock(file, nudgeMarkdown(smallRepo, client));
 }
 function upsertBlock(file, block) {
-  fs11.mkdirSync(path11.dirname(file), { recursive: true });
-  let existing = fs11.existsSync(file) ? fs11.readFileSync(file, "utf8") : "";
+  fs12.mkdirSync(path11.dirname(file), { recursive: true });
+  let existing = fs12.existsSync(file) ? fs12.readFileSync(file, "utf8") : "";
   const re = new RegExp(`${escapeRe(NUDGE_BEGIN)}[\\s\\S]*?${escapeRe(NUDGE_END)}`);
   if (re.test(existing)) existing = existing.replace(re, block);
   else existing = existing.length ? `${existing.replace(/\s*$/, "")}
@@ -3237,20 +4860,20 @@ function upsertBlock(file, block) {
 ${block}
 ` : `${block}
 `;
-  fs11.writeFileSync(file, existing);
+  fs12.writeFileSync(file, existing);
 }
 function removeBlock(file) {
-  if (!fs11.existsSync(file)) return false;
-  const existing = fs11.readFileSync(file, "utf8");
+  if (!fs12.existsSync(file)) return false;
+  const existing = fs12.readFileSync(file, "utf8");
   const re = new RegExp(`\\n*${escapeRe(NUDGE_BEGIN)}[\\s\\S]*?${escapeRe(NUDGE_END)}\\n*`);
   if (!re.test(existing)) return false;
-  fs11.writeFileSync(file, existing.replace(re, "\n"));
+  fs12.writeFileSync(file, existing.replace(re, "\n"));
   return true;
 }
 function readJson(file) {
-  if (!fs11.existsSync(file)) return {};
+  if (!fs12.existsSync(file)) return {};
   try {
-    const parsed = JSON.parse(fs11.readFileSync(file, "utf8"));
+    const parsed = JSON.parse(fs12.readFileSync(file, "utf8"));
     if (parsed && typeof parsed === "object" && !Array.isArray(parsed)) {
       return parsed;
     }
@@ -3269,6 +4892,6 @@ function escapeRe(s) {
   return s.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
 }
 
-export { ASSISTANTS, CliError, ExitCode, ResourceLimitError, SKIP_DIRS, SKIP_FILES, SMALL_REPO_FILES, UsageError, analyze, applyCoverage, assistantById, buildFacts, buildGraph, decodeScipIndex, detectAssistants, detectServeLaunch, discover, driftCount, engineUnavailable, epistemicBreakdown, groundGraph, hasDrift, installAssistant, isAssistantInstalled, isSkippedDirName, loadCoverage, loadSnapshot, probeFreshness, refreshInstalledInstructions, resolveLimits, scipEdges, uninstallAssistant, usageError, verifyDeterminism, versionMarker, writeNavigationConfig, writeSnapshot };
-//# sourceMappingURL=chunk-TNROG5CO.js.map
-//# sourceMappingURL=chunk-TNROG5CO.js.map
+export { ASSISTANTS, ResourceLimitError, SKIP_DIRS, SKIP_FILES, SMALL_REPO_FILES, UsageError, analyze, applyCoverage, assistantById, buildFacts, buildGraph, decodeScipIndex, detectAssistants, detectServeLaunch, discover, driftCount, epistemicBreakdown, groundGraph, hasDrift, installAssistant, isAssistantInstalled, isSkippedDirName, loadCoverage, loadSnapshot, probeFreshness, refreshInstalledInstructions, resolveLimits, scipEdges, uninstallAssistant, verifyDeterminism, versionMarker, writeNavigationConfig, writeSnapshot };
+//# sourceMappingURL=chunk-E2FAQREZ.js.map
+//# sourceMappingURL=chunk-E2FAQREZ.js.map