@vibgrate/cli 2026.814.2 → 2026.817.2

package/dist/{types-DLH-Ritr.d.ts → types-DHqH0XIE.d.ts}

@@ -1,12 +1,31 @@
 /**
- * The `vg-graph/1.0` on-disk schema.
+ * The `vg-graph/1.1` on-disk schema.
  *
  * This is vg's own open schema (VG-PACKAGE-AND-SCHEMA.md §4) — informed by good
  * ideas (content-hashed ids, epistemic typing of facts) but standalone and
  * self-contained. Every collection is deterministically serialized
  * (sorted keys, stable element order). These TypeScript shapes are normative.
+ *
+ * ## Version history
+ *
+ * - `vg-graph/1.0` — code-only vocabulary.
+ * - `vg-graph/1.1` — **additive**: toolchain node kinds (`resource`, `workload`,
+ *   `job`, `step`, `image`, `chart`) and toolchain edge kinds (`depends_on`,
+ *   `provisions`, `deploys`, `triggers`, `exposes`, `mounts`, `builds_from`),
+ *   produced by `engine/toolchain/`. Nothing was removed or renamed, so a 1.0
+ *   reader that tolerates unknown kinds reads a 1.1 graph correctly; readers
+ *   that hard-match the version string need widening (see
+ *   `SUPPORTED_SCHEMA_VERSIONS`).
+ */
+declare const SCHEMA_VERSION: "vg-graph/1.1";
+/**
+ * Schema versions a reader should accept. The toolchain vocabulary added in 1.1
+ * is purely additive, so a 1.0 artifact still loads — only the newer kinds are
+ * absent from it. Readers must prefer this over an equality check on
+ * {@link SCHEMA_VERSION}, which rejects perfectly readable older graphs.
  */
-declare const SCHEMA_VERSION: "vg-graph/1.0";
+declare const SUPPORTED_SCHEMA_VERSIONS: readonly ["vg-graph/1.0", "vg-graph/1.1"];
+type SupportedSchemaVersion = (typeof SUPPORTED_SCHEMA_VERSIONS)[number];
 type ResolverKind = 'scip' | 'stackgraph' | 'tsc' | 'heuristic';
 /** Coarse, honest resolution tier for an edge (see engine/epistemic.ts). */
 type EpistemicTier = 'observed' | 'name-matched' | 'declared';
@@ -54,7 +73,19 @@ interface GraphMeta {
 }
 type NodeKind = 'file' | 'module' | 'package' | 'class' | 'interface' | 'function' | 'method' | 'property' | 'test' | 'route' | 'component'
 /** Documentation / config text ingested for semantic ask (markdown, txt, env examples). */
- | 'document' | 'external';
+ | 'document' | 'external'
+/** A declared infrastructure object: Terraform resource/data, K8s object, Compose service. */
+ | 'resource'
+/** A deployable unit that runs containers (Deployment, StatefulSet, DaemonSet, Job, CronJob). */
+ | 'workload'
+/** A CI job (GitHub Actions job, GitLab CI job). */
+ | 'job'
+/** A single step within a CI job. */
+ | 'step'
+/** A container image reference (`ghcr.io/acme/web:1.2.3`) or a Dockerfile build stage. */
+ | 'image'
+/** A Helm chart (from `Chart.yaml`). */
+ | 'chart';
 interface Span {
     start: number;
     end: number;
@@ -84,7 +115,21 @@ interface GraphNode {
     coverage?: number;
     changeCoupling?: string[];
 }
-type EdgeKind = 'call' | 'import' | 'contains' | 'extends' | 'implements' | 'references' | 'test' | 'coverage';
+type EdgeKind = 'call' | 'import' | 'contains' | 'extends' | 'implements' | 'references' | 'test' | 'coverage'
+/** Declared ordering/reference dependency (Terraform `depends_on` + interpolation, Compose `depends_on`, CI `needs`). */
+ | 'depends_on'
+/** An IaC declaration creates infrastructure (Terraform module → resource, chart → workload). */
+ | 'provisions'
+/** A CI job or IaC declaration puts a workload/image into an environment. */
+ | 'deploys'
+/** An event or upstream job causes a workflow/job to run. */
+ | 'triggers'
+/** A workload/service publishes a port or endpoint. */
+ | 'exposes'
+/** A workload/service consumes a volume, config map, or secret *by reference*. */
+ | 'mounts'
+/** A build stage or workload is derived from a container image. */
+ | 'builds_from';
 interface GraphEdge {
     id: string;
     kind: EdgeKind;
@@ -159,7 +204,13 @@ interface GraphSummaries {
     hubs: HubBlastSummary[];
 }
 interface VgGraph {
-    schemaVersion: typeof SCHEMA_VERSION;
+    /**
+     * The schema this artifact was written against. A freshly built graph always
+     * carries {@link SCHEMA_VERSION}; a graph *loaded* from disk may carry any
+     * member of {@link SUPPORTED_SCHEMA_VERSIONS}, since older artifacts stay
+     * readable (the 1.1 additions are additive).
+     */
+    schemaVersion: SupportedSchemaVersion;
     generatedAt: string;
     provenance: Provenance;
     meta: GraphMeta;
@@ -232,8 +283,19 @@ interface FileParse {
      * Empty/absent for languages with no namespace query.
      */
     namespaces?: string[];
+    /**
+     * Architecture role hits extracted from the same tree as defs/calls.
+     * Omit when none (absent ≠ []).
+     */
+    roles?: Array<{
+        role: 'controller' | 'service' | 'repository' | 'entity' | 'handler' | 'router';
+        layer: 'routing' | 'middleware' | 'services' | 'domain' | 'data-access' | 'infrastructure' | 'presentation' | 'config' | 'testing' | 'shared';
+        confidence: number;
+        signal: string;
+        packId: string;
+    }>;
     /** Non-fatal issues (e.g. a query that failed to compile for this grammar). */
     warnings?: string[];
 }
 
-export { type Area as A, type Centrality as C, type DerivedBy as D, type EdgeKind as E, type FileParse as F, type GraphNode as G, type HubBlastSummary as H, type NodeKind as N, type Provenance as P, type ResolverKind as R, SCHEMA_VERSION as S, type Toolchain as T, type Unknown as U, type VgGraph as V, type GraphEdge as a, type Fact as b, type GroundingKind as c, type GroundingEdge as d, type AnalysisTier as e, type EpistemicTier as f, type FactConfidence as g, type FactKind as h, type GraphMeta as i, type GraphSummaries as j, type Span as k };
+export { type Area as A, type Centrality as C, type DerivedBy as D, type EdgeKind as E, type FileParse as F, type GraphNode as G, type HubBlastSummary as H, type NodeKind as N, type Provenance as P, type ResolverKind as R, SCHEMA_VERSION as S, type Toolchain as T, type Unknown as U, type VgGraph as V, type GraphEdge as a, type Fact as b, type GroundingKind as c, type GroundingEdge as d, type AnalysisTier as e, type EpistemicTier as f, type FactConfidence as g, type FactKind as h, type GraphMeta as i, type GraphSummaries as j, SUPPORTED_SCHEMA_VERSIONS as k, type Span as l, type SupportedSchemaVersion as m };

package/dist/version-WSE3QOPK.js

@@ -0,0 +1,4 @@
+export { VERSION } from './chunk-PRG2ULPK.js';
+import './chunk-Z6ZWNWWR.js';
+//# sourceMappingURL=version-WSE3QOPK.js.map
+//# sourceMappingURL=version-WSE3QOPK.js.map

package/dist/{version-DPAMQW6M.js.map → version-WSE3QOPK.js.map}

@@ -1 +1 @@
-{"version":3,"sources":[],"names":[],"mappings":"","file":"version-DPAMQW6M.js"}
+{"version":3,"sources":[],"names":[],"mappings":"","file":"version-WSE3QOPK.js"}

package/dist/{vg-mcp-bridge-IGHJKKSL.js → vg-mcp-bridge-2CNLHNEL.js}

@@ -1,19 +1,20 @@
-import { TOOLS } from './chunk-WWGLVF7D.js';
+import { TOOLS } from './chunk-DVW3SVCW.js';
 import './chunk-HTLDXEHW.js';
-import './chunk-N6ZMZ5AI.js';
-import './chunk-7QDHQLUS.js';
+import './chunk-WAKP7SK7.js';
+import './chunk-3H3SVJUY.js';
 import './chunk-J7LKEB2R.js';
-import './chunk-KGPX4EUN.js';
+import './chunk-Q4G2BWE3.js';
 import './chunk-CQDUBAQY.js';
 import './chunk-OV4KGXPD.js';
 import './chunk-5I4VSBWQ.js';
-import './chunk-DT4KIVRI.js';
+import './chunk-NG4KIJW6.js';
 import './chunk-CRAMOEBE.js';
-import './chunk-RXP66R2E.js';
-import './chunk-X76VPOYH.js';
-import './chunk-2U37PFB2.js';
-import './chunk-75LJM5XD.js';
-import './chunk-2H2U3DC7.js';
+import './chunk-T7RSQ5WD.js';
+import './chunk-AXZZ5CCG.js';
+import './chunk-WVMOGIPC.js';
+import './chunk-MVPRPSXU.js';
+import './chunk-O3LABX6I.js';
+import './chunk-PRG2ULPK.js';
 import './chunk-BWPBB45M.js';
 import './chunk-JFGYT6BI.js';
 import './chunk-BPF3YX2U.js';
@@ -76,5 +77,5 @@ function vgMcpToolNames() {
 }
 
 export { VG_MCP_SERVER_ID, createVgBuiltinMcpTools, mergeExternalToolsets, vgMcpToolNames };
-//# sourceMappingURL=vg-mcp-bridge-IGHJKKSL.js.map
-//# sourceMappingURL=vg-mcp-bridge-IGHJKKSL.js.map
+//# sourceMappingURL=vg-mcp-bridge-2CNLHNEL.js.map
+//# sourceMappingURL=vg-mcp-bridge-2CNLHNEL.js.map

package/dist/vg-mcp-bridge-2CNLHNEL.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/code/vg-mcp-bridge.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;AAmBO,IAAM,gBAAA,GAAmB;AAChC,IAAM,EAAA,GAAK,QAAQ,gBAAgB,CAAA,EAAA,CAAA;AAiB5B,SAAS,wBAAwB,IAAA,EAA4C;AAClF,EAAA,MAAM,MAAA,uBAAa,GAAA,EAAoB;AACvC,EAAA,KAAA,MAAW,CAAA,IAAK,KAAA,EAAO,MAAA,CAAO,GAAA,CAAI,CAAA,EAAG,EAAE,CAAA,EAAG,CAAA,CAAE,IAAI,CAAA,CAAA,EAAI,CAAC,CAAA;AAErD,EAAA,MAAM,KAAA,GAAoB,KAAA,CAAM,GAAA,CAAI,CAAC,CAAA,MAAO;AAAA,IAC1C,IAAA,EAAM,CAAA,EAAG,EAAE,CAAA,EAAG,EAAE,IAAI,CAAA,CAAA;AAAA,IACpB,WAAA,EAAa,CAAA,CAAA,EAAI,gBAAgB,CAAA,EAAA,EAAK,EAAE,WAAW,CAAA,CAAA;AAAA,IACnD,UAAA,EAAY,CAAA,CAAE,WAAA,IAAe,OAAO,EAAE,WAAA,KAAgB,QAAA,GAAW,CAAA,CAAE,WAAA,GAAc,EAAE,IAAA,EAAM,QAAA,EAAU,UAAA,EAAY,EAAC;AAAE,GACpH,CAAE,CAAA,CAAE,IAAA,CAAK,CAAC,CAAA,EAAG,CAAA,KAAM,CAAA,CAAE,IAAA,CAAK,aAAA,CAAc,CAAA,CAAE,IAAI,CAAC,CAAA;AAE/C,EAAA,OAAO;AAAA,IACL,KAAA;AAAA,IACA,IAAA,EAAM,CAAC,IAAA,KAAS,MAAA,CAAO,IAAI,IAAI,CAAA;AAAA,IAC/B,MAAM,OAAA,CAAQ,IAAA,EAAM,IAAA,EAAM;AACxB,MAAA,MAAM,IAAA,GAAO,MAAA,CAAO,GAAA,CAAI,IAAA,CAAK,IAAI,CAAA;AACjC,MAAA,IAAI,CAAC,IAAA,EAAM,OAAO,EAAE,OAAA,EAAS,oBAAoB,IAAA,CAAK,IAAI,CAAA,CAAA,EAAI,OAAA,EAAS,KAAA,EAAM;AAC7E,MAAA,IAAI;AACF,QAAA,MAAM,KAAA,GAAQ,IAAA,EAAM,KAAA,IAAS,IAAA,CAAK,QAAA,EAAS;AAC3C,QAAA,MAAM,GAAA,GAAM,MAAM,IAAA,CAAK,OAAA,CAAQ,OAAO,IAAA,CAAK,SAAA,IAAa,EAAC,EAAG;AAAA,UAC1D,MAAM,IAAA,CAAK,IAAA;AAAA,UACX,OAAO,IAAA,CAAK,KAAA;AAAA,UACZ,KAAA,EAAO;AAAA,SACR,CAAA;AACD,QAAA,MAAM,IAAA,GAAO,OAAO,GAAA,KAAQ,QAAA,GAAW,MAAM,IAAA,CAAK,SAAA,CAAU,GAAA,EAAK,IAAA,EAAM,CAAC,CAAA;AACxE,QAAA,OAAO,EAAE,SAAS,IAAA,CAAK,KAAA,CAAM,GAAG,IAAM,CAAA,EAAG,SAAS,KAAA,EAAM;AAAA,MAC1D,SAAS,CAAA,EAAG;AACV,QAAA,OAAO,EAAE,OAAA,EAAS,CAAA,SAAA,EAAY,IAAA,CAAK,IAAI,YAAa,CAAA,CAAY,OAAO,CAAA,CAAA,EAAI,OAAA,EAAS,KAAA,EAAM;AAAA,MAC5F;AAAA,IACF;AAAA,GACF;AACF;AAGO,SAAS,yBAAyB,IAAA,EAA8E;AACrH,EAAA,MAAM,MAAA,GAAS,IAAA,CAAK,MAAA,CAAO,CAAC,CAAA,KAA4B,CAAC,CAAC,CAAA,IAAK,CAAA,CAAE,KAAA,CAAM,MAAA,GAAS,CAAC,CAAA;AACjF,EAAA,IAAI,MAAA,CAAO,MAAA,KAAW,CAAA,EAAG,OAAO,MAAA;AAChC,EAAA,IAAI,MAAA,CAAO,MAAA,KAAW,CAAA,EAAG,OAAO,OAAO,CAAC,CAAA;AAExC,EAAA,MAAM,MAAA,uBAAa,GAAA,EAAsD;AACzE,EAAA,KAAA,MAAW,OAAO,MAAA,EAAQ;AACxB,IAAA,KAAA,MAAW,IAAA,IAAQ,GAAA,CAAI,KAAA,EAAO,MAAA,CAAO,GAAA,CAAI,KAAK,IAAA,EAAM,EAAE,GAAA,EAAK,IAAA,EAAM,CAAA;AAAA,EACnE;AACA,EAAA,MAAM,KAAA,GAAQ,CAAC,GAAG,MAAA,CAAO,QAAQ,CAAA,CAAE,GAAA,CAAI,CAAC,CAAA,KAAM,CAAA,CAAE,IAAI,CAAA,CAAE,IAAA,CAAK,CAAC,CAAA,EAAG,CAAA,KAAM,EAAE,IAAA,CAAK,aAAA,CAAc,CAAA,CAAE,IAAI,CAAC,CAAA;AACjG,EAAA,OAAO;AAAA,IACL,KAAA;AAAA,IACA,IAAA,EAAM,CAAC,IAAA,KAAS,MAAA,CAAO,IAAA,CAAK,CAAC,CAAA,KAAM,CAAA,CAAE,IAAA,CAAK,IAAI,CAAC,CAAA;AAAA,IAC/C,MAAM,OAAA,CAAQ,IAAA,EAAM,IAAA,EAAM;AACxB,MAAA,KAAA,IAAS,IAAI,MAAA,CAAO,MAAA,GAAS,CAAA,EAAG,CAAA,IAAK,GAAG,CAAA,EAAA,EAAK;AAC3C,QAAA,IAAI,MAAA,CAAO,CAAC,CAAA,CAAG,IAAA,CAAK,IAAA,CAAK,IAAI,CAAA,EAAG,OAAO,MAAA,CAAO,CAAC,CAAA,CAAG,OAAA,CAAQ,MAAM,IAAI,CAAA;AAAA,MACtE;AACA,MAAA,OAAO,EAAE,OAAA,EAAS,CAAA,sBAAA,EAAyB,KAAK,IAAI,CAAA,CAAA,EAAI,SAAS,KAAA,EAAM;AAAA,IACzE;AAAA,GACF;AACF;AAGO,SAAS,cAAA,GAA2B;AACzC,EAAA,OAAO,KAAA,CAAM,IAAI,CAAC,CAAA,KAAM,GAAG,EAAE,CAAA,EAAG,CAAA,CAAE,IAAI,CAAA,CAAE,CAAA;AAC1C","file":"vg-mcp-bridge-2CNLHNEL.js","sourcesContent":["/**\n * Always-on bridge from local `vg serve` (Vibgrate AI Context) tools into the\n * VG Code agent tool list.\n *\n * External project MCP servers (`.mcp.json`, etc.) remain optional. The tools\n * shipped by the installed `vg` CLI — `search_symbols`, `query_graph`,\n * `impact_of`, `library_docs`, … — are available on every run without spawning\n * a separate MCP process: same handlers as stdio `vg serve`, in-process over\n * the session graph.\n *\n * Namespaced as `mcp__vibgrate__<tool>` so they sit next to third-party\n * `mcp__<server>__*` tools without collisions.\n */\n\nimport { TOOLS, type VgTool } from '../mcp/tools.js';\nimport type { VgGraph } from '../schema.js';\nimport type { ToolCall, ToolSpec } from './types.js';\nimport type { ToolResult } from './tools.js';\n\nexport const VG_MCP_SERVER_ID = 'vibgrate' as const;\nconst NS = `mcp__${VG_MCP_SERVER_ID}__`;\n\nexport type ExternalToolset = {\n  specs: ToolSpec[];\n  owns: (name: string) => boolean;\n  execute: (call: ToolCall, live?: { graph: VgGraph }) => Promise<ToolResult>;\n};\n\nexport interface VgBuiltinMcpOptions {\n  /** Live graph accessor (session overlay may refresh symbols mid-run). */\n  getGraph: () => VgGraph;\n  root: string;\n  /** Air-gap: no network in library/docs/embedder paths. */\n  local?: boolean;\n}\n\n/** In-process toolset matching the local `vg serve` MCP surface. */\nexport function createVgBuiltinMcpTools(opts: VgBuiltinMcpOptions): ExternalToolset {\n  const byName = new Map<string, VgTool>();\n  for (const t of TOOLS) byName.set(`${NS}${t.name}`, t);\n\n  const specs: ToolSpec[] = TOOLS.map((t) => ({\n    name: `${NS}${t.name}`,\n    description: `[${VG_MCP_SERVER_ID}] ${t.description}`,\n    parameters: t.inputSchema && typeof t.inputSchema === 'object' ? t.inputSchema : { type: 'object', properties: {} },\n  })).sort((a, b) => a.name.localeCompare(b.name));\n\n  return {\n    specs,\n    owns: (name) => byName.has(name),\n    async execute(call, live) {\n      const tool = byName.get(call.name);\n      if (!tool) return { content: `unknown MCP tool ${call.name}`, mutated: false };\n      try {\n        const graph = live?.graph ?? opts.getGraph();\n        const raw = await tool.handler(graph, call.arguments ?? {}, {\n          root: opts.root,\n          local: opts.local,\n          dedup: false,\n        });\n        const text = typeof raw === 'string' ? raw : JSON.stringify(raw, null, 2);\n        return { content: text.slice(0, 12_000), mutated: false };\n      } catch (e) {\n        return { content: `MCP tool ${call.name} failed: ${(e as Error).message}`, mutated: false };\n      }\n    },\n  };\n}\n\n/** Merge toolsets; later sets win on name clashes. */\nexport function mergeExternalToolsets(...sets: Array<ExternalToolset | undefined | null>): ExternalToolset | undefined {\n  const active = sets.filter((s): s is ExternalToolset => !!s && s.specs.length > 0);\n  if (active.length === 0) return undefined;\n  if (active.length === 1) return active[0];\n\n  const byName = new Map<string, { set: ExternalToolset; spec: ToolSpec }>();\n  for (const set of active) {\n    for (const spec of set.specs) byName.set(spec.name, { set, spec });\n  }\n  const specs = [...byName.values()].map((v) => v.spec).sort((a, b) => a.name.localeCompare(b.name));\n  return {\n    specs,\n    owns: (name) => active.some((s) => s.owns(name)),\n    async execute(call, live) {\n      for (let i = active.length - 1; i >= 0; i--) {\n        if (active[i]!.owns(call.name)) return active[i]!.execute(call, live);\n      }\n      return { content: `unknown external tool ${call.name}`, mutated: false };\n    },\n  };\n}\n\n/** Namespaced vibgrate tool names for tests / prompts. */\nexport function vgMcpToolNames(): string[] {\n  return TOOLS.map((t) => `${NS}${t.name}`);\n}\n"]}

package/dist/{vgd-ORPA5C2K.js → vgd-URUZQORN.js}

@@ -1,20 +1,21 @@
-export { ActiveGraphCache, BranchGraphSession, DEFAULT_ACTIVE_GRAPH_IDLE_MS, VGD_PROTOCOL_VERSION, WorkspaceRegistry, parseRequest, startVgdServer } from './chunk-NKFXXP6W.js';
+export { ActiveGraphCache, BranchGraphSession, DEFAULT_ACTIVE_GRAPH_IDLE_MS, VGD_PROTOCOL_VERSION, WorkspaceRegistry, parseRequest, startVgdServer } from './chunk-GOGMS3ST.js';
 export { createHostExecutionEnv, detectSandboxCapabilities, detectSecurityCapabilities, firejailArgv, resolveExecutionEnv, selectSandboxBackend } from './chunk-IS7VTH2Q.js';
 import './chunk-3LOWJSAF.js';
 export { vgdIsRunning, vgdPidPath, vgdRequest, vgdSocketPath } from './chunk-RBIRXQR6.js';
 import './chunk-5HYCB55P.js';
 export { MODEL_EXECUTION_PROFILE_SCHEMA_VERSION, defaultModelExecutionProfile, mergeModelExecutionProfile, resolveModelExecutionProfile } from './chunk-IZDH67DX.js';
 import './chunk-J7LKEB2R.js';
-import './chunk-KGPX4EUN.js';
-import './chunk-WQLZSVNF.js';
+import './chunk-Q4G2BWE3.js';
+import './chunk-3FMRFECC.js';
 export { FEDERATION_SCHEMA_VERSION, federationFromWorkspaceRoots, federationPath, highConfidenceBridges, loadFederation, loadOrDiscoverFederation, writeFederationFile } from './chunk-5I4VSBWQ.js';
-import './chunk-X76VPOYH.js';
-import './chunk-2U37PFB2.js';
-import './chunk-75LJM5XD.js';
-import './chunk-2H2U3DC7.js';
+import './chunk-AXZZ5CCG.js';
+import './chunk-WVMOGIPC.js';
+import './chunk-MVPRPSXU.js';
+import './chunk-O3LABX6I.js';
+import './chunk-PRG2ULPK.js';
 import './chunk-BWPBB45M.js';
 import './chunk-JFGYT6BI.js';
 export { activeGraphSlotKey, branchGraphSnapshotId, detectGitRef } from './chunk-BPF3YX2U.js';
 import './chunk-Z6ZWNWWR.js';
-//# sourceMappingURL=vgd-ORPA5C2K.js.map
-//# sourceMappingURL=vgd-ORPA5C2K.js.map
+//# sourceMappingURL=vgd-URUZQORN.js.map
+//# sourceMappingURL=vgd-URUZQORN.js.map

package/dist/vgd-URUZQORN.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":[],"names":[],"mappings":"","file":"vgd-URUZQORN.js"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@vibgrate/cli",
-  "version": "2026.814.2",
+  "version": "2026.817.2",
   "description": "vg — local codebase intelligence CLI + MCP server for AI coding agents: deterministic code graph, drift reporting, and version-correct library docs (Apache-2.0)",
   "//mcpName": "Official MCP registry ownership proof: the registry fetches the published npm package and requires this field to match the com.vibgrate/ai-context server entry (see docs/marketing/mcp-registry/README.md). Must ship in the published @vibgrate/cli package.json.",
   "mcpName": "com.vibgrate/ai-context",
@@ -79,7 +79,7 @@
     "chalk": "^6.0.0",
     "commander": "^15.0.0",
     "fast-xml-parser": "^5.10.1",
-    "gpt-tokenizer": "^3.0.0",
+    "gpt-tokenizer": "^4.0.0",
     "graphology": "^0.26.0",
     "graphology-communities-louvain": "^2.0.2",
     "graphology-metrics": "^2.4.0",
@@ -88,7 +88,7 @@
     "ignore": "^7.0.6",
     "msgpackr": "^2.0.4",
     "semver": "^7.8.5",
-    "smol-toml": "^1.7.1",
+    "smol-toml": "^1.8.0",
     "tinypool": "^2.1.0",
     "tree-sitter-wasms": "^0.1.13",
     "typescript": "^6.0.0",
@@ -101,14 +101,15 @@
     "tar": "^7.5.19"
   },
   "devDependencies": {
-    "@types/node": "^26.1.2",
+    "@tree-sitter-grammars/tree-sitter-hcl": "1.2.0",
+    "@types/node": "^26.2.0",
     "@types/semver": "^7.8.0",
-    "@typescript-eslint/eslint-plugin": "^8.64.0",
-    "@typescript-eslint/parser": "^8.66.0",
-    "eslint": "^10.8.0",
+    "@typescript-eslint/eslint-plugin": "^8.67.0",
+    "@typescript-eslint/parser": "^8.67.0",
+    "eslint": "^10.8.1",
     "graphology-types": "^0.24.8",
     "tsup": "^8.0.0",
-    "tsx": "^4.23.10",
+    "tsx": "^4.23.12",
     "vitest": "^4.1.10"
   },
   "engines": {

package/dist/agent-5ANHRYEI.js

@@ -1,26 +0,0 @@
-export { CONTEXT_POLICY_VERSION, DISCOVERY_TOOLS, MUTATION_TOOLS, compact, compactWithModel, runAgent } from './chunk-IHXNOY3R.js';
-import './chunk-543E6WDJ.js';
-import './chunk-TVDYEHIM.js';
-import './chunk-54RGT2T5.js';
-import './chunk-RBIRXQR6.js';
-import './chunk-5HYCB55P.js';
-import './chunk-N3XFY3PX.js';
-import './chunk-REIGWTTH.js';
-import './chunk-VIWZ4QT7.js';
-import './chunk-7QDHQLUS.js';
-import './chunk-J7LKEB2R.js';
-export { summarizeCapsule } from './chunk-DSUGC7F5.js';
-import './chunk-KGPX4EUN.js';
-import './chunk-3LSG7Z4I.js';
-import './chunk-UTNNGKKX.js';
-import './chunk-RXP66R2E.js';
-import './chunk-X76VPOYH.js';
-import './chunk-2U37PFB2.js';
-import './chunk-75LJM5XD.js';
-import './chunk-2H2U3DC7.js';
-import './chunk-BWPBB45M.js';
-import './chunk-JFGYT6BI.js';
-import './chunk-BPF3YX2U.js';
-import './chunk-Z6ZWNWWR.js';
-//# sourceMappingURL=agent-5ANHRYEI.js.map
-//# sourceMappingURL=agent-5ANHRYEI.js.map

package/dist/baseline-WVD6P5IO.js

@@ -1,9 +0,0 @@
-export { baselineCommand, runBaseline } from './chunk-TFAXW7VM.js';
-import './chunk-N6ZMZ5AI.js';
-import './chunk-DT4KIVRI.js';
-import './chunk-CRAMOEBE.js';
-import './chunk-RXP66R2E.js';
-import './chunk-2H2U3DC7.js';
-import './chunk-Z6ZWNWWR.js';
-//# sourceMappingURL=baseline-WVD6P5IO.js.map
-//# sourceMappingURL=baseline-WVD6P5IO.js.map

package/dist/chunk-2H2U3DC7.js

@@ -1,6 +0,0 @@
-// src/version.ts
-var VERSION = "2026.814.2";
-
-export { VERSION };
-//# sourceMappingURL=chunk-2H2U3DC7.js.map
-//# sourceMappingURL=chunk-2H2U3DC7.js.map

package/dist/chunk-2U37PFB2.js.map

@@ -1 +0,0 @@
-{"version":3,"sources":["../src/engine/cache.ts"],"names":[],"mappings":";;;;AAoBA,IAAM,aAAA,GAAgB,kBAAA;AA0Bf,SAAS,SAAS,IAAA,EAAsB;AAC7C,EAAA,OAAY,IAAA,CAAA,IAAA,CAAK,IAAA,EAAM,WAAA,EAAa,OAAO,CAAA;AAC7C;AAEA,SAAS,UAAU,IAAA,EAAsB;AACvC,EAAA,OAAY,IAAA,CAAA,IAAA,CAAK,QAAA,CAAS,IAAI,CAAA,EAAG,kBAAkB,CAAA;AACrD;AAEO,SAAS,SAAA,CACd,MACA,IAAA,EACY;AACZ,EAAA,MAAM,IAAA,GAAO,UAAU,IAAI,CAAA;AAC3B,EAAA,IAAI,IAAA,GAAkB;AAAA,IACpB,OAAA,EAAS,aAAA;AAAA,IACT,aAAa,IAAA,CAAK,WAAA;AAAA,IAClB,UAAU,IAAA,CAAK,QAAA;AAAA,IACf,SAAS;AAAC,GACZ;AAEA,EAAA,IAAI,CAAC,IAAA,CAAK,QAAA,IAAe,EAAA,CAAA,UAAA,CAAW,IAAI,CAAA,EAAG;AACzC,IAAA,IAAI;AACF,MAAA,MAAM,SAAS,IAAA,CAAK,KAAA,CAAS,EAAA,CAAA,YAAA,CAAa,IAAA,EAAM,MAAM,CAAC,CAAA;AAEvD,MAAA,IAAA,CACG,MAAA,CAAO,OAAA,KAAY,aAAA,IAAiB,MAAA,CAAO,YAAY,kBAAA,KACxD,MAAA,CAAO,WAAA,KAAgB,IAAA,CAAK,eAC5B,MAAA,CAAO,QAAA,KAAa,IAAA,CAAK,QAAA,IACzB,OAAO,OAAA,EACP;AACA,QAAA,IAAA,GAAO,EAAE,GAAG,MAAA,EAAQ,OAAA,EAAS,aAAA,EAAc;AAAA,MAC7C;AAAA,IACF,CAAA,CAAA,MAAQ;AAAA,IAER;AAAA,EACF;AAEA,EAAA,OAAO;AAAA,IACL,GAAA,CAAI,KAAK,IAAA,EAAM;AACb,MAAA,MAAM,KAAA,GAAQ,IAAA,CAAK,OAAA,CAAQ,GAAG,CAAA;AAC9B,MAAA,OAAO,KAAA,IAAS,KAAA,CAAM,IAAA,KAAS,IAAA,GAAO,MAAM,KAAA,GAAQ,MAAA;AAAA,IACtD,CAAA;AAAA,IACA,SAAA,CAAU,GAAA,EAAK,OAAA,EAAS,IAAA,EAAM;AAC5B,MAAA,MAAM,KAAA,GAAQ,IAAA,CAAK,OAAA,CAAQ,GAAG,CAAA;AAC9B,MAAA,IAAI,CAAC,OAAO,OAAO,MAAA;AACnB,MAAA,IAAI,MAAM,OAAA,KAAY,OAAA,IAAW,MAAM,IAAA,KAAS,IAAA,IAAQ,MAAM,KAAA,EAAO;AACnE,QAAA,OAAO,EAAE,KAAA,EAAO,KAAA,CAAM,KAAA,EAAO,IAAA,EAAM,MAAM,IAAA,EAAK;AAAA,MAChD;AACA,MAAA,OAAO,MAAA;AAAA,IACT,CAAA;AAAA,IACA,GAAA,CAAI,GAAA,EAAK,KAAA,EAAO,IAAA,EAAM;AACpB,MAAA,IAAA,CAAK,OAAA,CAAQ,GAAG,CAAA,GAAI;AAAA,QAClB,MAAM,KAAA,CAAM,IAAA;AAAA,QACZ,KAAA;AAAA,QACA,SAAS,IAAA,EAAM,OAAA;AAAA,QACf,MAAM,IAAA,EAAM;AAAA,OACd;AAAA,IACF,CAAA;AAAA,IACA,MAAM,WAAA,EAAa;AACjB,MAAA,KAAA,MAAW,GAAA,IAAO,MAAA,CAAO,IAAA,CAAK,IAAA,CAAK,OAAO,CAAA,EAAG;AAC3C,QAAA,IAAI,CAAC,YAAY,GAAA,CAAI,GAAG,GAAG,OAAO,IAAA,CAAK,QAAQ,GAAG,CAAA;AAAA,MACpD;AAAA,IACF,CAAA;AAAA,IACA,IAAA,GAAO;AACL,MAAG,aAAU,QAAA,CAAS,IAAI,GAAG,EAAE,SAAA,EAAW,MAAM,CAAA;AAChD,MAAG,EAAA,CAAA,aAAA,CAAc,IAAA,EAAM,eAAA,CAAgB,IAAA,EAAM,CAAC,CAAC,CAAA;AAAA,IACjD;AAAA,GACF;AACF","file":"chunk-2U37PFB2.js","sourcesContent":["import * as fs from 'node:fs';\nimport * as path from 'node:path';\nimport { stableStringify } from './serialize.js';\nimport type { FileParse } from './types.js';\n\n/**\n * Incremental parse cache. Maps a file's content hash to its parsed\n * symbol/edge tables, so a rebuild re-parses only files whose content actually\n * changed (VG-DEVELOPMENT-PLAN Phase 0.4). Lives under `.vibgrate/cache/` and is\n * gitignored — never part of the committed artifact.\n *\n * The cache is a pure performance optimisation: a reused FileParse is identical\n * to a freshly-parsed one (parsing is pure over content), so the graph is\n * byte-identical whether or not the cache was warm. CI-enforced by the\n * mutation-corpus identity gate (incremental-identity.test.ts): warm\n * incremental rebuild ≡ cold full rebuild, byte for byte, across\n * edit/add/delete/rename/touch mutations and the production refresh path.\n */\n\n// Bumped to /4: optional mtime+size fingerprint for stat-skip fast path.\nconst CACHE_VERSION = 'vg-parse-cache/4';\n\ninterface CacheEntry {\n  hash: string;\n  mtimeMs?: number;\n  size?: number;\n  parse: FileParse;\n}\n\ninterface CacheFile {\n  version: string;\n  toolVersion: string;\n  grammars: string;\n  entries: Record<string, CacheEntry>;\n}\n\nexport interface ParseCache {\n  get(rel: string, hash: string): FileParse | undefined;\n  /** Fast path: mtime+size match → reuse parse without re-reading bytes. */\n  getByStat(rel: string, mtimeMs: number, size: number): { parse: FileParse; hash: string } | undefined;\n  set(rel: string, parse: FileParse, stat?: { mtimeMs: number; size: number }): void;\n  /** Drop entries for files no longer present. */\n  prune(currentRels: Set<string>): void;\n  save(): void;\n}\n\nexport function cacheDir(root: string): string {\n  return path.join(root, '.vibgrate', 'cache');\n}\n\nfunction cachePath(root: string): string {\n  return path.join(cacheDir(root), 'parse-cache.json');\n}\n\nexport function loadCache(\n  root: string,\n  opts: { toolVersion: string; grammars: string; disabled?: boolean },\n): ParseCache {\n  const file = cachePath(root);\n  let data: CacheFile = {\n    version: CACHE_VERSION,\n    toolVersion: opts.toolVersion,\n    grammars: opts.grammars,\n    entries: {},\n  };\n\n  if (!opts.disabled && fs.existsSync(file)) {\n    try {\n      const loaded = JSON.parse(fs.readFileSync(file, 'utf8')) as CacheFile;\n      // Accept v3 → v4 (stat fields optional).\n      if (\n        (loaded.version === CACHE_VERSION || loaded.version === 'vg-parse-cache/3') &&\n        loaded.toolVersion === opts.toolVersion &&\n        loaded.grammars === opts.grammars &&\n        loaded.entries\n      ) {\n        data = { ...loaded, version: CACHE_VERSION };\n      }\n    } catch {\n      /* corrupt cache — start fresh */\n    }\n  }\n\n  return {\n    get(rel, hash) {\n      const entry = data.entries[rel];\n      return entry && entry.hash === hash ? entry.parse : undefined;\n    },\n    getByStat(rel, mtimeMs, size) {\n      const entry = data.entries[rel];\n      if (!entry) return undefined;\n      if (entry.mtimeMs === mtimeMs && entry.size === size && entry.parse) {\n        return { parse: entry.parse, hash: entry.hash };\n      }\n      return undefined;\n    },\n    set(rel, parse, stat) {\n      data.entries[rel] = {\n        hash: parse.hash,\n        parse,\n        mtimeMs: stat?.mtimeMs,\n        size: stat?.size,\n      };\n    },\n    prune(currentRels) {\n      for (const rel of Object.keys(data.entries)) {\n        if (!currentRels.has(rel)) delete data.entries[rel];\n      }\n    },\n    save() {\n      fs.mkdirSync(cacheDir(root), { recursive: true });\n      fs.writeFileSync(file, stableStringify(data, 0));\n    },\n  };\n}\n"]}

package/dist/chunk-3LSG7Z4I.js.map

@@ -1 +0,0 @@
-{"version":3,"sources":["../src/util/cli-invocation.ts"],"names":[],"mappings":";;;;AAkCO,SAAS,YAAY,GAAA,EAA4B;AACtD,EAAA,IAAI;AACF,IAAA,MAAM,GAAA,GAAM,aAAa,OAAA,CAAQ,QAAA,KAAa,UAAU,OAAA,GAAU,OAAA,EAAS,CAAC,GAAG,CAAA,EAAG;AAAA,MAChF,QAAA,EAAU,MAAA;AAAA,MACV,KAAA,EAAO,CAAC,QAAA,EAAU,MAAA,EAAQ,QAAQ;AAAA,KACnC,CAAA,CACE,IAAA,GACA,KAAA,CAAM,OAAO,EAAE,CAAC,CAAA;AACnB,IAAA,OAAO,GAAA,IAAO,IAAA;AAAA,EAChB,CAAA,CAAA,MAAQ;AACN,IAAA,OAAO,IAAA;AAAA,EACT;AACF;AASO,SAAS,YAAY,OAAA,EAA0B;AACpD,EAAA,IAAI;AACF,IAAA,MAAM,IAAA,GAAU,gBAAa,OAAO,CAAA;AACpC,IAAA,IAAI,6BAAA,CAA8B,IAAA,CAAK,IAAI,CAAA,EAAG,OAAO,IAAA;AACrD,IAAA,MAAM,IAAA,GAAU,EAAA,CAAA,YAAA,CAAa,IAAA,EAAM,EAAE,QAAA,EAAU,QAAQ,CAAA,CAAE,KAAA,CAAM,CAAA,EAAG,IAAI,CAAA;AACtE,IAAA,OAAO,KAAK,QAAA,CAAS,eAAe,CAAA,IAAK,IAAA,CAAK,SAAS,UAAU,CAAA;AAAA,EACnE,CAAA,CAAA,MAAQ;AACN,IAAA,OAAO,KAAA;AAAA,EACT;AACF;AAYO,SAAS,qBAAqB,OAAA,EAA0B;AAC7D,EAAA,MAAM,WAAA,GAAc,gBAAA;AACpB,EAAA,IAAI,WAAA,CAAY,IAAA,CAAK,OAAO,CAAA,EAAG,OAAO,IAAA;AACtC,EAAA,IAAI;AACF,IAAA,OAAO,WAAA,CAAY,IAAA,CAAQ,EAAA,CAAA,YAAA,CAAa,OAAO,CAAC,CAAA;AAAA,EAClD,CAAA,CAAA,MAAQ;AACN,IAAA,OAAO,KAAA;AAAA,EACT;AACF;AASO,SAAS,qBAAqB,OAAA,EAA0B;AAC7D,EAAA,OAAO,WAAA,CAAY,OAAO,CAAA,IAAK,CAAC,qBAAqB,OAAO,CAAA;AAC9D;AAUO,SAAS,qBAAqB,KAAA,EAAgD;AACnF,EAAA,IAAI,CAAC,KAAA,IAAS,MAAA,KAAW,MAAA,EAAW,OAAO,MAAA;AAC3C,EAAA,MAAM,SAAS,KAAA,IAAS,WAAA;AAExB,EAAA,MAAM,EAAA,GAAK,OAAO,IAAI,CAAA;AACtB,EAAA,IAAI,MAAA;AACJ,EAAA,IAAI,EAAA,IAAM,oBAAA,CAAqB,EAAE,CAAA,EAAG;AAClC,IAAA,MAAA,GAAS,IAAA;AAAA,EACX,CAAA,MAAO;AACL,IAAA,MAAM,QAAA,GAAW,OAAO,UAAU,CAAA;AAClC,IAAA,MAAA,GAAS,QAAA,IAAY,oBAAA,CAAqB,QAAQ,CAAA,GAAI,UAAA,GAAa,cAAA;AAAA,EACrE;AAEA,EAAA,IAAI,CAAC,OAAO,MAAA,GAAS,MAAA;AACrB,EAAA,OAAO,MAAA;AACT;AAxHA,IA4Ba,cAAA,CAAA,CAqET;AAjGJ,IAAA,mBAAA,GAAA,KAAA,CAAA;AAAA,EAAA,4BAAA,GAAA;AA4BO,IAAM,cAAA,GAAiB,mBAAA;AAAA,EAAA;AAAA,CAAA","file":"chunk-3LSG7Z4I.js","sourcesContent":["import * as fs from 'node:fs';\nimport { execFileSync } from 'node:child_process';\n\n/**\n * How the user should re-invoke this CLI in a \"next step\" hint.\n *\n * A user who ran `npx @vibgrate/cli scan` has no *persistent* `vg` (or\n * `vibgrate`) on PATH, so a hint like `vg install` or `vg login` would fail for\n * them once the run ends. We answer the practical question \"what will actually\n * run this CLI for this user again?\" by checking whether an *installed* copy of\n * our binary is reachable on PATH:\n *\n *   installed `vg`       → `vg`                 (the normal installed case)\n *   installed `vibgrate` → `vibgrate`           (alias present, `vg` shadowed)\n *   neither              → `npx @vibgrate/cli`  (npx / not installed globally)\n *\n * \"Installed\" is the key qualifier: `npx` prepends its own throwaway\n * `_npx/<hash>/node_modules/.bin` to PATH for the run, so `which vg` finds a `vg`\n * that is genuinely ours yet gone the moment the process exits. That ephemeral\n * binary is excluded (see {@link isEphemeralNpxBinary}) so npx users get the npx\n * form, not a `vg` they can't call again.\n *\n * This is deliberately the same ladder `detectServeLaunch` uses for the MCP\n * launch command — the underlying question (\"is an installed `vg` ours?\") is\n * identical.\n */\n\n/** The npx form that always works without a global install. */\nexport const NPX_INVOCATION = 'npx @vibgrate/cli';\n\n/**\n * Locate `cmd` on PATH, returning its resolved path or null. Best-effort: a\n * missing command or an unavailable `which`/`where` both yield null.\n */\nexport function whichOnPath(cmd: string): string | null {\n  try {\n    const out = execFileSync(process.platform === 'win32' ? 'where' : 'which', [cmd], {\n      encoding: 'utf8',\n      stdio: ['ignore', 'pipe', 'ignore'],\n    })\n      .trim()\n      .split(/\\r?\\n/)[0];\n    return out || null;\n  } catch {\n    return null;\n  }\n}\n\n/**\n * Does this PATH entry launch *this* package? Symlink installs resolve into a\n * `…/@vibgrate/cli/…` directory; script shims (pnpm/bun/yarn, Windows .cmd)\n * reference the package path in their first bytes. Best-effort: unreadable or\n * unrecognisable entries count as foreign, which only makes callers pick a safer\n * fallback.\n */\nexport function isOwnBinary(binPath: string): boolean {\n  try {\n    const real = fs.realpathSync(binPath);\n    if (/[\\\\/]@vibgrate[\\\\/]cli[\\\\/]/.test(real)) return true;\n    const head = fs.readFileSync(real, { encoding: 'utf8' }).slice(0, 2048);\n    return head.includes('@vibgrate/cli') || head.includes('vibgrate');\n  } catch {\n    return false;\n  }\n}\n\n/**\n * Is this resolved binary an *ephemeral* npx-cache entry rather than a persistent\n * install? `npx @vibgrate/cli …` unpacks the package into an npm `_npx/<hash>/`\n * cache directory and prepends its `node_modules/.bin` to PATH for the duration\n * of the run — so `which vg` finds a `vg` that is *ours* yet vanishes the instant\n * the process exits. Treating that as an installed `vg` is exactly what made the\n * post-scan hints tell npx users to run `vg login`/`vg push`, commands they have\n * no `vg` on PATH for. npm's cache segment is `_npx` on every platform; we test\n * the raw PATH entry and its realpath (symlink shims resolve into the same tree).\n */\nexport function isEphemeralNpxBinary(binPath: string): boolean {\n  const NPX_SEGMENT = /[\\\\/]_npx[\\\\/]/;\n  if (NPX_SEGMENT.test(binPath)) return true;\n  try {\n    return NPX_SEGMENT.test(fs.realpathSync(binPath));\n  } catch {\n    return false;\n  }\n}\n\n/**\n * Does this PATH entry launch *this* CLI in a way that will still work after the\n * current process exits? True only for a persistent install of our package — an\n * ephemeral npx-cache binary does not count, because the user cannot re-invoke it\n * by name. This is the predicate \"next step\" hints and the MCP launch command\n * must use, not {@link isOwnBinary} alone.\n */\nexport function isInstalledOwnBinary(binPath: string): boolean {\n  return isOwnBinary(binPath) && !isEphemeralNpxBinary(binPath);\n}\n\nlet cached: string | undefined;\n\n/**\n * The command prefix a user should type to re-run this CLI (see module doc).\n * Memoized per-process: PATH does not change mid-run, and each call would\n * otherwise spawn `which`. Pass `which` to override lookup in tests, which also\n * bypasses the cache.\n */\nexport function resolveCliInvocation(which?: (cmd: string) => string | null): string {\n  if (!which && cached !== undefined) return cached;\n  const lookup = which ?? whichOnPath;\n\n  const vg = lookup('vg');\n  let result: string;\n  if (vg && isInstalledOwnBinary(vg)) {\n    result = 'vg';\n  } else {\n    const vibgrate = lookup('vibgrate');\n    result = vibgrate && isInstalledOwnBinary(vibgrate) ? 'vibgrate' : NPX_INVOCATION;\n  }\n\n  if (!which) cached = result;\n  return result;\n}\n\n/** Reset the memoized invocation. Test-only. */\nexport function resetCliInvocationCache(): void {\n  cached = undefined;\n}\n"]}