@vibgrate/cli 2026.817.1 → 2026.817.2

package/dist/cli.js

@@ -1,21 +1,21 @@
 #!/usr/bin/env node
-import { fetchCatalog, resolveProviders } from './chunk-NHB53JTV.js';
-import { telemetryOptOut, StatsSharer, statsEndpoint, isCI } from './chunk-45AKSS4A.js';
-import { loadAdvancedScanHook, baselineCommand } from './chunk-2BURPMYA.js';
-import { sha256Hex, generateKeypair, dssePae, DSSE_PAYLOAD_TYPE, keyId, registerBuild, ProgressBar, printLogo, runBuild } from './chunk-JHLCKMKF.js';
-export { runBuild } from './chunk-JHLCKMKF.js';
-import { restartVgdIfRunning, stopVgd, registerDaemon, rootOf, requireGraph } from './chunk-FMS6G67U.js';
+import { fetchCatalog, resolveProviders } from './chunk-C3LMWZKF.js';
+import { telemetryOptOut, StatsSharer, statsEndpoint, isCI } from './chunk-EXV4QSAD.js';
+import { loadAdvancedScanHook, baselineCommand } from './chunk-6K3XK7C5.js';
+import { sha256Hex, generateKeypair, dssePae, DSSE_PAYLOAD_TYPE, keyId, registerBuild, ProgressBar, printLogo, runBuild } from './chunk-LHKQGVRF.js';
+export { runBuild } from './chunk-LHKQGVRF.js';
+import { restartVgdIfRunning, stopVgd, registerDaemon, rootOf, requireGraph } from './chunk-KNGAZDGF.js';
 import { readGlobal, applyGlobalOptions } from './chunk-OZ3IFXRD.js';
 import { disableColor, info, c, json, out } from './chunk-CT5BS56U.js';
-import './chunk-OWSXI3PJ.js';
+import './chunk-GOGMS3ST.js';
 import './chunk-IS7VTH2Q.js';
 import { defaultProcessEndpoint, startProcessHostServer, resolveInferenceIsolation } from './chunk-JFE7XCAE.js';
 import { clearHostSessionPool, acquireHostSession, generateOnSession, listHostSessions, hostSessionPoolSize } from './chunk-3LOWJSAF.js';
-import { runCodeSession } from './chunk-UBEVY5UT.js';
-import { CONTEXT_POLICY_VERSION, computeFcsReport, renderFcsReportMarkdown, createTrajectoryCollector, runAgent } from './chunk-YL4OIUA5.js';
+import { runCodeSession } from './chunk-3NJUOIZQ.js';
+import { CONTEXT_POLICY_VERSION, computeFcsReport, renderFcsReportMarkdown, createTrajectoryCollector, runAgent } from './chunk-K6DXETMC.js';
 import './chunk-543E6WDJ.js';
-import './chunk-ZSECAGSU.js';
-import './chunk-RQAKBRAV.js';
+import './chunk-Q3M6K3HY.js';
+import './chunk-TVDMNIUT.js';
 import './chunk-RBIRXQR6.js';
 import { buildIdentifierTrieFromGraph } from './chunk-5HYCB55P.js';
 import { parseReasoningEffort, summarizeDiffs, ScriptedProvider } from './chunk-74UBGF4P.js';
@@ -26,39 +26,40 @@ import { init_resolve_ollama, gatherSystemMemory, resolveOllamaBinary, hasOllama
 import { readOrchestratorState, writeOrchestratorState, parseMode, setDefaultMode, recommendMode, activePin, resolveMode, providerForBackend, QUALIFIED_PACKS, pinPack, unpinPack, buildOrchestratorStatus } from './chunk-NZELMYT4.js';
 import { fmt, estimateModelBytes } from './chunk-7N4Y3E47.js';
 import './chunk-IZDH67DX.js';
-import { serveStdio, isRelevantChange, exportGraph, GraphSource, createServer, formatForExt, RefreshScheduler } from './chunk-A7EKFLAN.js';
-import { refreshIfStale } from './chunk-K267DHCF.js';
-import { driftCount, ASSISTANTS, detectAssistants, isAssistantInstalled, detectServeLaunch, installAssistant, writeNavigationConfig, uninstallAssistant, TOOLCHAIN_GRAMMARS, resolveToolchainGrammar, buildGraph, writeSnapshot, probeFreshness, discover, assistantById, SMALL_REPO_FILES, isSkippedDirName, SKIP_FILES, SKIP_DIRS } from './chunk-RJCRWQNS.js';
-import { resolveDsn, createWorkspaceDsn, writeStoredCredentials, credentialsPath, findGitRoot, ensureGitignored, gitignoreEntryForCredentials, clearStoredCredentials, parseDsn as parseDsn$1, uploadScanArtifact, dsnCommand, pushCommand, countTokens, shortestPath, pathDisconnect, testsToRun, detectRunner, coveringTests, FREE_PACK, readScanArtifact, publishPrivateLibrary, assessDocQuality, symbolsFromApi, fetchHostedDocsCached, selectForBudget, hostedBase, readStoredCredentials, projectCredentialsPath, homeCredentialsPath } from './chunk-FD2HPGX2.js';
+import { serveStdio, isRelevantChange, exportGraph, GraphSource, createServer, formatForExt, RefreshScheduler } from './chunk-M7IO3DXH.js';
+import { refreshIfStale } from './chunk-O2DL2Q55.js';
+import { driftCount, ASSISTANTS, detectAssistants, isAssistantInstalled, detectServeLaunch, installAssistant, writeNavigationConfig, uninstallAssistant, buildGraph, writeSnapshot, probeFreshness, discover, assistantById, SMALL_REPO_FILES, isSkippedDirName, SKIP_FILES, SKIP_DIRS } from './chunk-E2FAQREZ.js';
+import { resolveDsn, createWorkspaceDsn, writeStoredCredentials, credentialsPath, findGitRoot, ensureGitignored, gitignoreEntryForCredentials, clearStoredCredentials, parseDsn as parseDsn$1, uploadScanArtifact, dsnCommand, pushCommand, countTokens, shortestPath, pathDisconnect, testsToRun, detectRunner, coveringTests, FREE_PACK, readScanArtifact, publishPrivateLibrary, assessDocQuality, symbolsFromApi, fetchHostedDocsCached, selectForBudget, hostedBase, readStoredCredentials, projectCredentialsPath, homeCredentialsPath } from './chunk-DVW3SVCW.js';
 import { resolveIngestHost, dashHostForIngestHost, availableRegionIds, ingestHostForRegionId } from './chunk-HTLDXEHW.js';
-import { writeDefaultConfig, parseDsn, detectVcs, computeRepoFingerprint, resolveRepositoryName, fetchScanPreflight, runCoreScan, loadConfig, prepareCompressedUpload, computeDriftScore, titleBox, projectTypeToVulnEcosystem, driftBar, gitHistoryAvailable, buildVersionTimelines, findPackageAnyEcosystem, normalizeConstraint, findVersionCrossings, versionSatisfies, PROJECT_TYPE_TO_OSV_ECOSYSTEM, fetchRiskySymbols, perDependencyDrift } from './chunk-ANYL7SUI.js';
+import { writeDefaultConfig, parseDsn, detectVcs, computeRepoFingerprint, resolveRepositoryName, fetchScanPreflight, runCoreScan, loadConfig, prepareCompressedUpload, computeDriftScore, titleBox, projectTypeToVulnEcosystem, driftBar, gitHistoryAvailable, buildVersionTimelines, findPackageAnyEcosystem, normalizeConstraint, findVersionCrossings, versionSatisfies, refineArchitectureWithGraph, refineArchitectureWithAstRoles, PROJECT_TYPE_TO_OSV_ECOSYSTEM, fetchRiskySymbols, perDependencyDrift } from './chunk-WAKP7SK7.js';
 import { CliError, ExitCode, usageError, engineUnavailable } from './chunk-MS6V5XKB.js';
 import './chunk-VIWZ4QT7.js';
-import { inventory, enrichOnline, ECOSYSTEMS, catalogPath, libDir, loadCatalog, driftFor, addLibrary, resolveLib, libId, resolveVersion, readDoc, localPackageDocs, localApiSurface } from './chunk-NQUWC2IA.js';
+import { inventory, enrichOnline, ECOSYSTEMS, catalogPath, libDir, loadCatalog, driftFor, addLibrary, resolveLib, libId, resolveVersion, readDoc, localPackageDocs, localApiSurface } from './chunk-3H3SVJUY.js';
 import { resolveOne } from './chunk-J7LKEB2R.js';
-import { recordCliCall, CLI_TOOL_ALIASES, savingsLedgerPath, clearSavings, readSavings, readUsage, readModelSavings, CAPSULE_RANKING_VERSION, SAVINGS_TOOLS, sanitizeClient } from './chunk-NKRWKCME.js';
-import { queryGraphSemantic, queryGraph, indexFor, impactOf } from './chunk-2TJ5EY4I.js';
+import { recordCliCall, CLI_TOOL_ALIASES, savingsLedgerPath, clearSavings, readSavings, readUsage, readModelSavings, CAPSULE_RANKING_VERSION, SAVINGS_TOOLS, sanitizeClient } from './chunk-KJT2R6WW.js';
+import { queryGraphSemantic, queryGraph, indexFor, impactOf } from './chunk-Q4G2BWE3.js';
 import { discoverModels } from './chunk-CQDUBAQY.js';
 import { freeBytesOnVolume, weightStoreDir, listCachedWeights, ensureWeightCached, catalogIntegrityReport } from './chunk-OV4KGXPD.js';
-import { loadGraph, loadGraphPreferIndex, SCHEMA_VERSION } from './chunk-MIYXVY57.js';
+import { loadGraph, loadGraphPreferIndex, SCHEMA_VERSION } from './chunk-3FMRFECC.js';
 import './chunk-5I4VSBWQ.js';
-import { pathExists as pathExists$1, parseExcludePatterns } from './chunk-DT4KIVRI.js';
+import { pathExists as pathExists$1, parseExcludePatterns } from './chunk-NG4KIJW6.js';
 import { ensureDir, pathExists, readJsonFile, writeTextFile, writeJsonFile } from './chunk-CRAMOEBE.js';
 import { init_cli_invocation, resolveCliInvocation, NPX_INVOCATION } from './chunk-EZ7UC5Y5.js';
-import { resolvedGrammarFiles, grammarSetVersion } from './chunk-6NOGNOE4.js';
-import './chunk-RXP66R2E.js';
-import { embeddingsCached, resolveEmbedModel, loadEmbedder, getNodeEmbeddings, unavailableMessage, countPending, modelCacheInfo, embeddingsPath, clearModelCache, withTimeout } from './chunk-2GSMCOIC.js';
-import { cacheDir } from './chunk-QPXVTQ7O.js';
-import { resetRelevanceProviderCache, loadRelevanceProvider, relevanceModuleDir, resolveGraphPath, analyzeQuestion, loadTopicTags, renderReport, loadGraphFileWithSnapshot, serializeGraph, stableStringify, writeArtifacts, vibgrateDir, mapFileExists, parseGraph, ensureVibgrateGitignore } from './chunk-ENFSSUNK.js';
-import { VERSION } from './chunk-PV76EO4G.js';
+import { resolvedGrammarFiles, TOOLCHAIN_GRAMMARS, resolveToolchainGrammar, grammarSetVersion, fileRolesFromParseCache } from './chunk-XLXJC7H3.js';
+import './chunk-T7RSQ5WD.js';
+import { embeddingsCached, resolveEmbedModel, loadEmbedder, getNodeEmbeddings, unavailableMessage, countPending, modelCacheInfo, embeddingsPath, clearModelCache, withTimeout } from './chunk-AXZZ5CCG.js';
+import { resetRelevanceProviderCache, loadRelevanceProvider, relevanceModuleDir, resolveGraphPath, analyzeQuestion, loadTopicTags, renderReport, loadGraphFileWithSnapshot, writeArtifacts, vibgrateDir, mapFileExists, ensureVibgrateGitignore } from './chunk-WVMOGIPC.js';
+import { cacheDir } from './chunk-MVPRPSXU.js';
+import { serializeGraph, stableStringify, parseGraph } from './chunk-O3LABX6I.js';
+import { VERSION } from './chunk-PRG2ULPK.js';
 import './chunk-BWPBB45M.js';
 import { canonicalize, hashString, hashBytes } from './chunk-JFGYT6BI.js';
 import './chunk-BPF3YX2U.js';
 import { __toCommonJS } from './chunk-Z6ZWNWWR.js';
 import * as fs14 from 'fs';
 import fs14__default, { realpathSync } from 'fs';
-import * as path43 from 'path';
-import path43__default from 'path';
+import * as path46 from 'path';
+import path46__default from 'path';
 import { fileURLToPath, pathToFileURL } from 'url';
 import { Command, CommanderError, Option } from 'commander';
 import { execSync, spawn, spawnSync, execFileSync } from 'child_process';
@@ -71,6 +72,7 @@ import * as crypto3 from 'crypto';
 import { randomUUID, createHash } from 'crypto';
 import chalk7 from 'chalk';
 import * as fs28 from 'fs/promises';
+import { parse, stringify } from 'yaml';
 
 init_cli_invocation();
 function registerStatus(program) {
@@ -80,19 +82,19 @@ function registerStatus(program) {
   applyGlobalOptions(cmd);
 }
 async function runStatus(global) {
-  const root2 = path43.resolve(global.cwd ?? ".");
-  const graphPath = resolveGraphPath(root2, global.graph);
-  const graph = loadGraph(root2, graphPath);
-  const hasCache = fs14.existsSync(path43.join(cacheDir(root2), "parse-cache.json"));
+  const root3 = path46.resolve(global.cwd ?? ".");
+  const graphPath = resolveGraphPath(root3, global.graph);
+  const graph = loadGraph(root3, graphPath);
+  const hasCache = fs14.existsSync(path46.join(cacheDir(root3), "parse-cache.json"));
   let stale = null;
   let staleExact = false;
   if (graph) {
-    const probe = probeFreshness(root2);
+    const probe = probeFreshness(root3);
     if (probe) {
       stale = driftCount(probe.drift);
       staleExact = true;
     } else {
-      const files = discover({ root: root2 });
+      const files = discover({ root: root3 });
       let changed = 0;
       const graphFiles = new Set(graph.nodes.filter((n) => n.kind === "file").map((n) => n.file));
       const currentFiles = new Set(files.map((f) => f.rel));
@@ -103,8 +105,8 @@ async function runStatus(global) {
   }
   if (global.json) {
     json({
-      root: path43.relative(process.cwd(), root2) || ".",
-      graphPath: path43.relative(root2, graphPath),
+      root: path46.relative(process.cwd(), root3) || ".",
+      graphPath: path46.relative(root3, graphPath),
       built: graph !== null,
       generatedAt: graph?.generatedAt ?? null,
       counts: graph?.meta.counts ?? null,
@@ -119,11 +121,11 @@ async function runStatus(global) {
     return;
   }
   if (!graph) {
-    info(`${c.cyan("vg")} \xB7 no map yet at ${c.dim(path43.relative(root2, graphPath))}`);
+    info(`${c.cyan("vg")} \xB7 no map yet at ${c.dim(path46.relative(root3, graphPath))}`);
     info(`  run ${c.bold("vg")} to build one`);
     return;
   }
-  info(`${c.cyan("vg")} \xB7 ${path43.relative(root2, graphPath)}`);
+  info(`${c.cyan("vg")} \xB7 ${path46.relative(root3, graphPath)}`);
   info(`  generated ${graph.generatedAt}`);
   info(
     `  nodes ${c.bold(String(graph.meta.counts.nodes))}  edges ${c.bold(
@@ -137,17 +139,17 @@ async function runStatus(global) {
   } else {
     info(c.dim("  up to date"));
   }
-  if (vibgrateDir(root2)) ;
+  if (vibgrateDir(root3)) ;
 }
 
 // src/commands/ask.ts
 function registerAsk(program) {
   const cmd = program.command("ask").description("ask the map \u2014 returns a budget-bounded context block").argument("<question...>", 'your question (a bare quoted string also works: vg "\u2026")').option("-b, --budget <n>", "approx token budget for the answer", "2000").option("--no-semantic", "lexical only (skip the local-embedding pass)").option("--no-refresh", "answer from the map as built \u2014 skip the auto-rebuild when files change").action(async function(question, opts) {
     const global = readGlobal(this);
-    const root2 = rootOf(global);
+    const root3 = rootOf(global);
     if (opts.refresh !== false && !global.graph) {
-      const graphPath = resolveGraphPath(root2, global.graph);
-      const refreshed = await refreshIfStale(root2, { graphPath });
+      const graphPath = resolveGraphPath(root3, global.graph);
+      const refreshed = await refreshIfStale(root3, { graphPath });
       if (refreshed.status === "refreshed" && !global.json) {
         const n = driftCount(refreshed.drift);
         info(c.dim(`  map refreshed \u2014 ${n} file(s) drifted (${(refreshed.ms / 1e3).toFixed(2)}s)`));
@@ -163,9 +165,9 @@ function registerAsk(program) {
     let mode = "lexical";
     let note = "";
     const relevance = await analyzeQuestion(q);
-    const topicTags = relevance ? await loadTopicTags(graph, root2, resolveGraphPath(root2, global.graph)) : null;
+    const topicTags = relevance ? await loadTopicTags(graph, root3, resolveGraphPath(root3, global.graph)) : null;
     if (wantSemantic) {
-      const firstRun = !embeddingsCached(root2, resolveEmbedModel());
+      const firstRun = !embeddingsCached(root3, resolveEmbedModel());
       if (!global.json && firstRun) {
         info(c.dim("  preparing semantic search (first use embeds the map; cached, resumable & offline after)\u2026"));
       }
@@ -180,7 +182,7 @@ function registerAsk(program) {
       });
       if (embedder) {
         const bar = !global.json && firstRun ? new ProgressBar(c.dim("embedding")) : void 0;
-        const vectors = await getNodeEmbeddings(graph, embedder, root2, bar ? (d, t) => bar.update(d, t) : void 0);
+        const vectors = await getNodeEmbeddings(graph, embedder, root3, bar ? (d, t) => bar.update(d, t) : void 0);
         bar?.done();
         result = await queryGraphSemantic(graph, q, { budget, embedder, nodeVectors: vectors, relevance, topicTags });
         mode = `semantic (${embedder.id})`;
@@ -196,7 +198,7 @@ function registerAsk(program) {
     if (global.client) {
       const files = new Set(result.matches.map((m) => m.node.file).filter(Boolean));
       recordCliCall(
-        root2,
+        root3,
         {
           tool: CLI_TOOL_ALIASES.ask,
           client: global.client,
@@ -237,11 +239,11 @@ function crashedMessage(signal) {
   return `semantic search is disabled: its native backend (onnxruntime-node, via the vendored fastembed path) crashed with ${signal} \u2014 using fast lexical search instead. This usually means the installed native binaries are broken (an interrupted install, or a platform without prebuilt CPU binaries). Reinstall to repair \u2014 ${envPrefix}npm install -g --allow-scripts=@vibgrate/cli,onnxruntime-node,msgpackr-extract @vibgrate/cli \u2014 or run with --local to stay lexical quietly.`;
 }
 function defaultCacheDir() {
-  const base = process.env.XDG_CACHE_HOME || path43.join(os.homedir(), ".cache");
-  return path43.join(base, "vibgrate", "models");
+  const base = process.env.XDG_CACHE_HOME || path46.join(os.homedir(), ".cache");
+  return path46.join(base, "vibgrate", "models");
 }
 function verdictPath(dir) {
-  return path43.join(dir, `embed-health-${process.platform}-${process.arch}.json`);
+  return path46.join(dir, `embed-health-${process.platform}-${process.arch}.json`);
 }
 function readVerdict(dir) {
   try {
@@ -261,12 +263,12 @@ function writeVerdict(dir, verdict) {
   }
 }
 function probeModuleUrl(from = import.meta.url) {
-  const dir = path43.dirname(fileURLToPath(from));
+  const dir = path46.dirname(fileURLToPath(from));
   for (const name of ["embeddings.js", "index.js"]) {
-    const candidate = path43.join(dir, name);
+    const candidate = path46.join(dir, name);
     if (fs14.existsSync(candidate)) return pathToFileURL(candidate).href;
   }
-  return pathToFileURL(path43.join(dir, "index.js")).href;
+  return pathToFileURL(path46.join(dir, "index.js")).href;
 }
 function defaultRunProbe(timeoutMs) {
   const moduleUrl = probeModuleUrl();
@@ -285,7 +287,7 @@ function defaultRunProbe(timeoutMs) {
       })
       .catch(() => process.stdout.write('{"ok":false}'));
   `;
-  return new Promise((resolve21) => {
+  return new Promise((resolve23) => {
     const child = spawn(process.execPath, ["--input-type=module", "-e", script], {
       stdio: ["ignore", "pipe", "ignore"],
       // The probe must never inherit a debugger port or loader flags that would
@@ -298,7 +300,7 @@ function defaultRunProbe(timeoutMs) {
       if (settled) return;
       settled = true;
       clearTimeout(timer);
-      resolve21({ signal, status, stdout });
+      resolve23({ signal, status, stdout });
     };
     const timer = setTimeout(() => {
       child.kill("SIGTERM");
@@ -359,7 +361,7 @@ function registerEmbed(program) {
     if (opts.where) return showWhere(rootOf(global), modelId, global.json);
     if (opts.clear) return doClear(global.json);
     const { graph } = requireGraph(global);
-    const root2 = rootOf(global);
+    const root3 = rootOf(global);
     const bg = opts.bg === true;
     const speak = !bg && !global.json;
     if (global.local) {
@@ -367,7 +369,7 @@ function registerEmbed(program) {
       else if (speak) info(c.dim("vg embed \xB7 semantic is off (--local) \u2014 lexical search only"));
       return;
     }
-    if (countPending(graph, root2, modelId) === 0) {
+    if (countPending(graph, root3, modelId) === 0) {
       if (global.json) json({ embedded: 0, pending: 0, upToDate: true, model: modelId, semantic: true });
       else if (speak) info(`${c.cyan("vg embed")} \xB7 semantic index already up to date`);
       return;
@@ -400,19 +402,19 @@ function registerEmbed(program) {
       }
       return;
     }
-    const pending = countPending(graph, root2, modelId);
+    const pending = countPending(graph, root3, modelId);
     const bar = speak ? new ProgressBar(c.dim("embedding")) : void 0;
-    await getNodeEmbeddings(graph, embedder, root2, bar ? (d, t) => bar.update(d, t) : void 0);
+    await getNodeEmbeddings(graph, embedder, root3, bar ? (d, t) => bar.update(d, t) : void 0);
     bar?.done();
     if (global.json) json({ embedded: pending, model: modelId, semantic: true });
     else if (speak) info(`${c.green("\u2714")} vg embed \xB7 semantic index ready (~${pending} node(s) \xB7 model ${modelId})`);
   });
   applyGlobalOptions(cmd);
 }
-function showWhere(root2, modelId, asJson) {
+function showWhere(root3, modelId, asJson) {
   const m = modelCacheInfo(modelId);
-  const repoCached = embeddingsCached(root2, modelId);
-  const repoPath = embeddingsPath(root2);
+  const repoCached = embeddingsCached(root3, modelId);
+  const repoPath = embeddingsPath(root3);
   if (asJson) {
     json({
       model: modelId,
@@ -1010,8 +1012,8 @@ function isLoopbackOrigin(origin) {
 var PUBLISH_INTERVAL_MS = 2e3;
 var KEEPALIVE_MS = 1e4;
 var STALE_MS = 6e4;
-function liveStatsDir(root2) {
-  return path43.join(cacheDir(root2), "serve-live");
+function liveStatsDir(root3) {
+  return path46.join(cacheDir(root3), "serve-live");
 }
 function reapOtherVersionServers(dir, keepVersion, now = Date.now(), kill = (pid, signal) => process.kill(pid, signal), selfPid = process.pid) {
   let entries;
@@ -1025,7 +1027,7 @@ function reapOtherVersionServers(dir, keepVersion, now = Date.now(), kill = (pid
     if (!/^serve-\d+\.json$/.test(name)) continue;
     let parsed;
     try {
-      parsed = JSON.parse(fs14.readFileSync(path43.join(dir, name), "utf8"));
+      parsed = JSON.parse(fs14.readFileSync(path46.join(dir, name), "utf8"));
     } catch {
       continue;
     }
@@ -1047,7 +1049,7 @@ var LiveStatsBus = class {
     this.dir = dir;
     this.stats = stats;
     this.pid = pid;
-    this.file = path43.join(dir, `serve-${this.pid}.json`);
+    this.file = path46.join(dir, `serve-${this.pid}.json`);
   }
   dir;
   stats;
@@ -1100,7 +1102,7 @@ var LiveStatsBus = class {
     const out2 = [];
     for (const name of entries.sort()) {
       if (!/^serve-\d+\.json$/.test(name)) continue;
-      const file = path43.join(this.dir, name);
+      const file = path46.join(this.dir, name);
       let parsed;
       try {
         parsed = JSON.parse(fs14.readFileSync(file, "utf8"));
@@ -1487,8 +1489,8 @@ var SHARE_FLUSH_INTERVAL_MS = 5 * 60 * 1e3;
 function registerServe(program) {
   const cmd = program.command("serve").description("start Vibgrate AI Context \u2014 local-first MCP serving your code map, drift & version-correct docs to your AI").option("--http", "serve over streamable HTTP instead of stdio").option("--port <n>", "port for --http", "7437").option("--host <h>", "host for --http", "127.0.0.1").option("--savings", "record local, counts-only usage savings (opt-in; off by default)").option("--share-stats", "ALSO upload the counts-only usage ledger to Vibgrate to improve the local MCP (opt-in; off by default; implies --savings; disabled under --local)").option("--dedup", "collapse a node's heavy relation lists on repeat reads within a session (opt-in; saves tokens)").option("--no-refresh", "serve the map as built \u2014 skip the auto-rebuild when files change").option("--no-watch", "disable the event-driven file watcher \u2014 freshness falls back to the periodic poll").option("--surface <mode>", 'tool listing surface: "hot" lists only the navigation core (orient/search_symbols/query_graph/get_node); "full" lists all tools. Every tool stays callable either way. Env: VG_MCP_SURFACE').option("--tools <names>", "comma-separated tool names to list (listing only \u2014 all tools remain callable). Env: VG_MCP_TOOLS").action(async function(opts) {
     const global = readGlobal(this);
-    const root2 = rootOf(global);
-    const graphPath = resolveGraphPath(root2, global.graph);
+    const root3 = rootOf(global);
+    const graphPath = resolveGraphPath(root3, global.graph);
     const refresh = opts.refresh !== false && !global.graph;
     const local = global.local === true;
     const optOut = telemetryOptOut();
@@ -1496,7 +1498,7 @@ function registerServe(program) {
     const quiet = global.quiet === true;
     const stats = quiet ? void 0 : new SessionStats();
     if (!quiet) {
-      printLogo(root2, { product: "AI Context", tagline: "Local-first MCP for your AI" });
+      printLogo(root3, { product: "AI Context", tagline: "Local-first MCP for your AI" });
     }
     const serveOpts = {
       // A *requested* --share-stats always implies local recording, even when
@@ -1509,7 +1511,7 @@ function registerServe(program) {
       dedup: opts.dedup === true,
       refresh,
       watch: opts.watch !== false,
-      root: root2,
+      root: root3,
       stats,
       // Listing surface: flags win over env; unknown values fall back to the
       // full surface inside listedToolNames (fail-open).
@@ -1518,18 +1520,18 @@ function registerServe(program) {
         tools: (opts.tools ?? process.env.VG_MCP_TOOLS)?.split(",").map((s) => s.trim()).filter(Boolean)
       }
     };
-    await ensureServableGraph(root2, graphPath, global, refresh);
+    await ensureServableGraph(root3, graphPath, global, refresh);
     if (opts.shareStats === true && local) {
       info(c.dim("vg \xB7 --share-stats ignored under --local (air-gapped): recording locally, not uploading."));
     } else if (opts.shareStats === true && optOut !== null) {
       info(c.dim(`vg \xB7 --share-stats disabled by ${optOut}: recording locally, not uploading.`));
     }
-    if (shareStats) startSharing(root2);
+    if (shareStats) startSharing(root3);
     const interactive = process.stderr.isTTY === true;
-    const bus = stats ? new LiveStatsBus(liveStatsDir(root2), stats) : void 0;
+    const bus = stats ? new LiveStatsBus(liveStatsDir(root3), stats) : void 0;
     if (bus && !interactive) bus.start();
     const display = stats ? new ServeStatusDisplay(stats, process.stderr, bus && interactive ? () => bus.siblings() : void 0) : void 0;
-    if (stats && interactive) new LedgerTail(savingsLedgerPath(root2), stats).start();
+    if (stats && interactive) new LedgerTail(savingsLedgerPath(root3), stats).start();
     const freshness = refresh ? "auto-refresh" : "as built";
     if (opts.http) {
       await serveHttp(graphPath, opts.host ?? "127.0.0.1", Number(opts.port) || 7437, serveOpts, freshness, () => display?.start());
@@ -1541,7 +1543,7 @@ function registerServe(program) {
   });
   applyGlobalOptions(cmd);
 }
-async function ensureServableGraph(root2, graphPath, global, refresh, opts = {}) {
+async function ensureServableGraph(root3, graphPath, global, refresh, opts = {}) {
   if (refresh) {
     if (!mapFileExists(graphPath)) {
       info(c.dim("vg \xB7 no map found \u2014 building it before serving\u2026"));
@@ -1551,7 +1553,7 @@ async function ensureServableGraph(root2, graphPath, global, refresh, opts = {})
         { ...global, json: false }
       );
     } else {
-      const kick = refreshIfStale(root2, { inline: opts.inline, graphPath }).then((refreshed) => {
+      const kick = refreshIfStale(root3, { inline: opts.inline, graphPath }).then((refreshed) => {
         if (refreshed.status === "refreshed") {
           const n = driftCount(refreshed.drift);
           info(
@@ -1576,8 +1578,8 @@ async function ensureServableGraph(root2, graphPath, global, refresh, opts = {})
     );
   }
 }
-function startSharing(root2) {
-  const sharer = new StatsSharer(root2);
+function startSharing(root3) {
+  const sharer = new StatsSharer(root3);
   info(
     c.dim(
       `vg \xB7 sharing counts-only usage stats with Vibgrate (${statsEndpoint()}) to improve the local MCP. No code, paths, or questions are sent. Stop by omitting --share-stats.`
@@ -1632,7 +1634,7 @@ async function serveHttp(graphPath, host, port, opts, freshness, onReady) {
       info(c.red(`vg serve: request error: ${err.message}`));
     }
   });
-  await new Promise((resolve21) => httpServer.listen(port, host, resolve21));
+  await new Promise((resolve23) => httpServer.listen(port, host, resolve23));
   info(c.dim(`vg \xB7 MCP server on http://${host}:${port}/mcp (read-only, local, ${freshness})`));
   onReady?.();
   await new Promise(() => {
@@ -1845,10 +1847,10 @@ function endOfLine(text, line) {
   return (lines[line] ?? "").length;
 }
 var CACHE_VERSION = "vg-lsp-scan-cache/2";
-function cachePath(root2) {
-  return path43.join(cacheDir(root2), "lsp-scan.json");
+function cachePath(root3) {
+  return path46.join(cacheDir(root3), "lsp-scan.json");
 }
-function manifestHash(root2) {
+function manifestHash(root3) {
   const files = [];
   const walk2 = (dir) => {
     let entries;
@@ -1858,7 +1860,7 @@ function manifestHash(root2) {
       return;
     }
     for (const entry of entries) {
-      const abs = path43.join(dir, entry.name);
+      const abs = path46.join(dir, entry.name);
       if (entry.isDirectory()) {
         if (isSkippedDirName(entry.name)) continue;
         walk2(abs);
@@ -1868,27 +1870,27 @@ function manifestHash(root2) {
       const base = entry.name.toLowerCase();
       if (!isManifest(abs) && !SKIP_FILES.has(base)) continue;
       try {
-        const rel = path43.relative(root2, abs).split(path43.sep).join("/");
+        const rel = path46.relative(root3, abs).split(path46.sep).join("/");
         files.push({ rel, hash: hashBytes(fs14.readFileSync(abs)) });
       } catch {
       }
     }
   };
-  walk2(root2);
+  walk2(root3);
   files.sort((a, b) => a.rel < b.rel ? -1 : a.rel > b.rel ? 1 : 0);
   return hashString(canonicalize(files));
 }
-function isDependencyFile(root2, filePath) {
-  const rel = path43.relative(path43.resolve(root2), path43.resolve(filePath));
-  if (rel === "" || rel.startsWith("..") || path43.isAbsolute(rel)) return false;
-  const parts = rel.split(path43.sep);
+function isDependencyFile(root3, filePath) {
+  const rel = path46.relative(path46.resolve(root3), path46.resolve(filePath));
+  if (rel === "" || rel.startsWith("..") || path46.isAbsolute(rel)) return false;
+  const parts = rel.split(path46.sep);
   if (parts.slice(0, -1).some((dir) => isSkippedDirName(dir))) return false;
   const base = parts[parts.length - 1].toLowerCase();
   return isManifest(filePath) || SKIP_FILES.has(base);
 }
-function loadScanCache(root2, key2) {
+function loadScanCache(root3, key2) {
   try {
-    const raw = JSON.parse(fs14.readFileSync(cachePath(root2), "utf8"));
+    const raw = JSON.parse(fs14.readFileSync(cachePath(root3), "utf8"));
     if (raw.version === CACHE_VERSION && raw.manifestHash === key2.manifestHash && raw.toolVersion === key2.toolVersion && raw.offline === key2.offline && raw.artifact) {
       return { manifestHash: raw.manifestHash, artifact: raw.artifact };
     }
@@ -1896,11 +1898,11 @@ function loadScanCache(root2, key2) {
   }
   return null;
 }
-function writeScanCache(root2, key2, artifact) {
+function writeScanCache(root3, key2, artifact) {
   try {
-    fs14.mkdirSync(cacheDir(root2), { recursive: true });
+    fs14.mkdirSync(cacheDir(root3), { recursive: true });
     fs14.writeFileSync(
-      cachePath(root2),
+      cachePath(root3),
       stableStringify(
         { version: CACHE_VERSION, manifestHash: key2.manifestHash, toolVersion: key2.toolVersion, offline: key2.offline, artifact },
         0
@@ -1911,8 +1913,8 @@ function writeScanCache(root2, key2, artifact) {
 }
 var MAX_ENTRIES = 1e3;
 var KEEP_ENTRIES = 500;
-function historyPath(root2) {
-  return path43.join(root2, ".vibgrate", "score-history.jsonl");
+function historyPath(root3) {
+  return path46.join(root3, ".vibgrate", "score-history.jsonl");
 }
 function parseLine(line) {
   try {
@@ -1924,27 +1926,27 @@ function parseLine(line) {
   }
   return null;
 }
-function readHistory(root2) {
+function readHistory(root3) {
   try {
-    return fs14.readFileSync(historyPath(root2), "utf8").split("\n").filter((l) => l.trim()).map(parseLine).filter((e) => e !== null);
+    return fs14.readFileSync(historyPath(root3), "utf8").split("\n").filter((l) => l.trim()).map(parseLine).filter((e) => e !== null);
   } catch {
     return [];
   }
 }
-function lastEntry(root2) {
-  const all = readHistory(root2);
+function lastEntry(root3) {
+  const all = readHistory(root3);
   return all.length ? all[all.length - 1] : null;
 }
-function recentHistory(root2, days, now = Date.now()) {
+function recentHistory(root3, days, now = Date.now()) {
   const cutoff = now - days * 24 * 60 * 60 * 1e3;
-  return readHistory(root2).filter((e) => {
+  return readHistory(root3).filter((e) => {
     const t = Date.parse(e.ts);
     return Number.isFinite(t) && t >= cutoff;
   });
 }
-function recordScore(root2, entry) {
+function recordScore(root3, entry) {
   try {
-    const prev = lastEntry(root2);
+    const prev = lastEntry(root3);
     if (prev && prev.score === entry.score && prev.band === entry.band && prev.mode === entry.mode && prev.methodology === entry.methodology) {
       const prevT = Date.parse(prev.ts);
       const nextT = Date.parse(entry.ts);
@@ -1952,12 +1954,12 @@ function recordScore(root2, entry) {
         return;
       }
     }
-    const file = historyPath(root2);
-    fs14.mkdirSync(path43.dirname(file), { recursive: true });
-    ensureVibgrateGitignore(root2);
+    const file = historyPath(root3);
+    fs14.mkdirSync(path46.dirname(file), { recursive: true });
+    ensureVibgrateGitignore(root3);
     fs14.appendFileSync(file, `${JSON.stringify(entry)}
 `);
-    const all = readHistory(root2);
+    const all = readHistory(root3);
     if (all.length > MAX_ENTRIES) {
       const kept = all.slice(-KEEP_ENTRIES);
       fs14.writeFileSync(file, kept.map((e) => JSON.stringify(e)).join("\n") + "\n");
@@ -1970,8 +1972,8 @@ function deltaFrom(prev, current) {
   if (prev.methodology !== current.methodology) return void 0;
   return current.score - prev.score;
 }
-function ignoreFilePath(root2) {
-  return path43.join(root2, ".vibgrate", "ignore.json");
+function ignoreFilePath(root3) {
+  return path46.join(root3, ".vibgrate", "ignore.json");
 }
 function isActive(entry, now = Date.now()) {
   if (!entry.until) return true;
@@ -1979,11 +1981,11 @@ function isActive(entry, now = Date.now()) {
   if (!Number.isFinite(t)) return true;
   return now <= t + 24 * 60 * 60 * 1e3 - 1;
 }
-function readIgnores(root2, now = Date.now()) {
+function readIgnores(root3, now = Date.now()) {
   const out2 = /* @__PURE__ */ new Map();
   let raw;
   try {
-    raw = fs14.readFileSync(ignoreFilePath(root2), "utf8");
+    raw = fs14.readFileSync(ignoreFilePath(root3), "utf8");
   } catch {
     return out2;
   }
@@ -2002,15 +2004,15 @@ function readIgnores(root2, now = Date.now()) {
   }
   return out2;
 }
-function inventoryPath(root2) {
-  return path43.join(root2, ".vibgrate", "inline-inventory.json");
+function inventoryPath(root3) {
+  return path46.join(root3, ".vibgrate", "inline-inventory.json");
 }
 function inventoryKey(projectPath, pkg) {
   return `${projectPath}::${pkg}`;
 }
-function readInventory(root2) {
+function readInventory(root3) {
   try {
-    const parsed = JSON.parse(fs14.readFileSync(inventoryPath(root2), "utf8"));
+    const parsed = JSON.parse(fs14.readFileSync(inventoryPath(root3), "utf8"));
     if (typeof parsed.ts === "string" && typeof parsed.methodology === "string" && Array.isArray(parsed.drifted) && parsed.drifted.every((d) => typeof d === "string")) {
       return parsed;
     }
@@ -2018,10 +2020,10 @@ function readInventory(root2) {
   }
   return null;
 }
-function recordInventory(root2, snap) {
+function recordInventory(root3, snap) {
   try {
-    ensureVibgrateGitignore(root2);
-    fs14.writeFileSync(inventoryPath(root2), `${JSON.stringify(snap)}
+    ensureVibgrateGitignore(root3);
+    fs14.writeFileSync(inventoryPath(root3), `${JSON.stringify(snap)}
 `);
   } catch {
   }
@@ -2530,6 +2532,37 @@ async function scanWorkspaceVulns(targets, opts = { offline: false }) {
 }
 
 // src/lsp/server.ts
+function architectureWire(arch) {
+  const out2 = {
+    archetype: arch.archetype,
+    archetypeConfidence: arch.archetypeConfidence,
+    layers: arch.layers,
+    totalClassified: arch.totalClassified,
+    unclassified: arch.unclassified
+  };
+  if (arch.folders) out2.folders = arch.folders;
+  if (arch.unclassifiedFiles) out2.unclassifiedFiles = arch.unclassifiedFiles;
+  if (arch.classified) out2.classified = arch.classified;
+  if (arch.workspaceShape) out2.workspaceShape = arch.workspaceShape;
+  if (arch.supportLevel !== void 0) out2.supportLevel = arch.supportLevel;
+  if (arch.packIds) out2.packIds = arch.packIds;
+  if (arch.projectKind) out2.projectKind = arch.projectKind;
+  if (arch.artifactKind) out2.artifactKind = arch.artifactKind;
+  if (arch.contractKind) out2.contractKind = arch.contractKind;
+  if (arch.semanticRole) out2.semanticRole = arch.semanticRole;
+  if (arch.evidence) out2.evidence = arch.evidence;
+  if (arch.evidenceCapped) out2.evidenceCapped = true;
+  if (arch.workspaceEdges) out2.workspaceEdges = arch.workspaceEdges;
+  if (arch.workspaceEdgesCapped) out2.workspaceEdgesCapped = true;
+  if (arch.violations) out2.violations = arch.violations;
+  if (arch.violationsCapped) out2.violationsCapped = true;
+  if (arch.boundaryProfile) out2.boundaryProfile = arch.boundaryProfile;
+  if (arch.structure) out2.structure = arch.structure;
+  if (arch.generated) out2.generated = true;
+  if (arch.generatedBy) out2.generatedBy = arch.generatedBy;
+  if (arch.sourceContract) out2.sourceContract = arch.sourceContract;
+  return out2;
+}
 function bandForDependency(dep) {
   if (dep.drift === "major-behind") {
     return (dep.majorsBehind ?? 1) >= 2 ? "high" : "moderate";
@@ -2580,6 +2613,8 @@ var VibgrateLanguageServer = class {
   debounce = null;
   shuttingDown = false;
   graph = null;
+  /** Role hits from the last graph build or recovered from the parse cache. */
+  fileRoles = [];
   graphBuilding = false;
   /**
    * Keeps the freshness probe / incremental rebuild OFF the query path. The
@@ -2689,6 +2724,7 @@ var VibgrateLanguageServer = class {
       let fromCache = false;
       if (cached2) {
         this.artifact = pruneArtifactProjects(cached2.artifact);
+        if (this.graph) refineArtifactWithGraph(this.artifact, this.graph, this.fileRoles);
         fromCache = true;
       } else {
         const scanOpts = {
@@ -2705,10 +2741,11 @@ var VibgrateLanguageServer = class {
         };
         const advanced = await loadAdvancedScanHook();
         this.artifact = pruneArtifactProjects(
-          await runCoreScanSilently(this.opts.root, scanOpts, advanced)
+          await runCoreScanSilently(this.opts.root, scanOpts, advanced, this.graph, this.fileRoles)
         );
         writeScanCache(this.opts.root, cacheKey, this.artifact);
       }
+      if (this.graph) refineArtifactWithGraph(this.artifact, this.graph, this.fileRoles);
       this.publishScore();
       this.publishScanArtifact(fromCache);
       for (const uri of this.docs.keys()) this.publishForDoc(uri);
@@ -2923,6 +2960,8 @@ var VibgrateLanguageServer = class {
       const existing = loadGraph(this.opts.root);
       if (existing) {
         this.graph = existing;
+        this.fileRoles = fileRolesFromParseCache(this.opts.root);
+        this.refineAndPublishArchitecture();
         this.conn.notify("vibgrate/graph/status", { state: "ready" });
         return;
       }
@@ -2931,6 +2970,8 @@ var VibgrateLanguageServer = class {
       writeArtifacts(result.graph, { root: this.opts.root, html: false, report: false });
       writeSnapshot(this.opts.root, result.graph.provenance.corpusHash, result.fileStats, {});
       this.graph = result.graph;
+      this.fileRoles = result.fileRoles;
+      this.refineAndPublishArchitecture();
       this.conn.notify("vibgrate/graph/status", { state: "ready" });
     } catch (err) {
       const message = err instanceof Error ? err.message : String(err);
@@ -2962,7 +3003,22 @@ var VibgrateLanguageServer = class {
     if (outcome?.status !== "refreshed" || !outcome.wrote) return;
     const graphPath = resolveGraphPath(this.opts.root);
     const reloaded = loadGraphPreferIndex(this.opts.root, graphPath)?.graph ?? loadGraph(this.opts.root);
-    if (reloaded) this.graph = reloaded;
+    if (reloaded) {
+      this.graph = reloaded;
+      this.fileRoles = fileRolesFromParseCache(this.opts.root);
+      this.refineAndPublishArchitecture();
+    }
+  }
+  /**
+   * Graph / AST-role refine can land after the first `publishScore()`. The
+   * Architecture panel only re-pulls on a score or scope change, so a silent
+   * in-memory refine would leave the first session on the path-only snapshot.
+   * Re-push `vibgrate/score` (no-op when the artifact is not ready yet).
+   */
+  refineAndPublishArchitecture() {
+    if (!this.artifact || !this.graph) return;
+    refineArtifactWithGraph(this.artifact, this.graph, this.fileRoles);
+    this.publishScore();
   }
   async onGraphQuery(params) {
     const p = params;
@@ -3031,7 +3087,7 @@ var VibgrateLanguageServer = class {
       const ecosystem = osvEcosystem(proj.type);
       if (!ecosystem) continue;
       const relManifest = manifestRelativePath(proj);
-      const absManifest = path43.resolve(this.opts.root, relManifest);
+      const absManifest = path46.resolve(this.opts.root, relManifest);
       let text = null;
       try {
         if (fs14.existsSync(absManifest)) text = fs14.readFileSync(absManifest, "utf8");
@@ -3114,21 +3170,13 @@ var VibgrateLanguageServer = class {
       const arch = a.extended?.architecture;
       if (!arch) return null;
       return {
-        archetype: arch.archetype,
-        archetypeConfidence: arch.archetypeConfidence,
-        layers: arch.layers,
-        totalClassified: arch.totalClassified,
-        unclassified: arch.unclassified
+        ...architectureWire(arch)
       };
     }
     const project = projectByPath(a, p.path);
     if (!project?.architecture) return null;
     return {
-      archetype: project.architecture.archetype,
-      archetypeConfidence: project.architecture.archetypeConfidence,
-      layers: project.architecture.layers,
-      totalClassified: project.architecture.totalClassified,
-      unclassified: project.architecture.unclassified,
+      ...architectureWire(project.architecture),
       manifestPath: manifestRelativePath(project),
       lockfilePath: lockfileRelativePath(this.opts.root, project)
     };
@@ -3141,7 +3189,7 @@ function uriToPath(uri) {
     return uri;
   }
 }
-async function runCoreScanSilently(root2, opts, advanced) {
+async function runCoreScanSilently(root3, opts, advanced, graph, fileRoles) {
   const realLog = console.log.bind(console);
   console.log = (...args) => {
     if (args.length === 1 && typeof args[0] === "string" && looksLikeScanArtifactJson(args[0])) {
@@ -3150,11 +3198,34 @@ async function runCoreScanSilently(root2, opts, advanced) {
     realLog(...args);
   };
   try {
-    return await runCoreScan(root2, opts, advanced);
+    const artifact = await runCoreScan(root3, opts, advanced);
+    if (graph) refineArtifactWithGraph(artifact, graph, fileRoles);
+    return artifact;
   } finally {
     console.log = realLog;
   }
 }
+function architectureGraphView(graph) {
+  return {
+    nodes: graph.nodes.map((n) => ({ id: n.id, file: n.file, kind: n.kind })),
+    edges: graph.edges.map((e) => ({
+      src: e.src,
+      dst: e.dst,
+      kind: e.kind,
+      confidence: e.confidence,
+      resolution: e.resolution
+    }))
+  };
+}
+function refineArtifactWithGraph(artifact, graph, fileRoles) {
+  const hasArch = Boolean(artifact.extended?.architecture) || artifact.projects.some((p) => p.architecture);
+  if (!hasArch) return;
+  const already = artifact.extended?.architecture?.violations !== void 0 || artifact.projects.some((p) => p.architecture?.violations !== void 0);
+  if (!already) refineArchitectureWithGraph(artifact, architectureGraphView(graph));
+  if (fileRoles && fileRoles.length > 0) {
+    refineArchitectureWithAstRoles(artifact, fileRoles);
+  }
+}
 function looksLikeScanArtifactJson(text) {
   const t = text.trimStart();
   if (!t.startsWith("{")) return false;
@@ -3183,7 +3254,7 @@ function pruneArtifactProjects(a) {
   return { ...a, projects, findings };
 }
 function projectByPath(a, projectPath) {
-  const norm = (p) => path43.normalize((p === "" ? "." : p).replace(/\\/g, "/"));
+  const norm = (p) => path46.normalize((p === "" ? "." : p).replace(/\\/g, "/"));
   const want = norm(projectPath);
   for (const proj of a.projects ?? []) {
     if (norm(proj.path) === want) return proj;
@@ -3221,13 +3292,13 @@ function buildProjectRefs(rootDir, projects) {
   refs.sort((a, b) => a.path.localeCompare(b.path));
   return refs.length > 0 ? refs : void 0;
 }
-function projectForFile(root2, a, filePath) {
-  const dir = path43.dirname(path43.resolve(filePath));
+function projectForFile(root3, a, filePath) {
+  const dir = path46.dirname(path46.resolve(filePath));
   let best;
   let bestLen = -1;
   for (const proj of a.projects ?? []) {
-    const projDir = path43.resolve(root2, proj.path);
-    if ((dir === projDir || dir.startsWith(projDir + path43.sep)) && projDir.length > bestLen) {
+    const projDir = path46.resolve(root3, proj.path);
+    if ((dir === projDir || dir.startsWith(projDir + path46.sep)) && projDir.length > bestLen) {
       best = proj;
       bestLen = projDir.length;
     }
@@ -3235,7 +3306,7 @@ function projectForFile(root2, a, filePath) {
   return best;
 }
 function sameProject(location, projectPath) {
-  return path43.normalize(location) === path43.normalize(projectPath);
+  return path46.normalize(location) === path46.normalize(projectPath);
 }
 function hasReleaseDates(a) {
   for (const proj of a.projects ?? []) {
@@ -3305,7 +3376,7 @@ function buildBreakdown(rootDir, projects) {
     const relManifest = manifestRelativePath(p);
     if (isPrunedWorkspacePath(p.path) || isPrunedWorkspacePath(relManifest)) continue;
     const ecosystem = osvEcosystem(p.type);
-    const absManifest = path43.resolve(rootDir, relManifest);
+    const absManifest = path46.resolve(rootDir, relManifest);
     let text = null;
     try {
       if (fs14.existsSync(absManifest)) text = fs14.readFileSync(absManifest, "utf8");
@@ -3373,34 +3444,34 @@ function buildBreakdown(rootDir, projects) {
 }
 function manifestRelativePath(proj) {
   const base = proj.path === "." || proj.path === "" ? "" : proj.path;
-  const join35 = (name) => base ? path43.join(base, name) : name;
+  const join36 = (name) => base ? path46.join(base, name) : name;
   switch (proj.type) {
     case "node":
     case "typescript":
-      return join35("package.json");
+      return join36("package.json");
     case "python":
-      return join35("pyproject.toml");
+      return join36("pyproject.toml");
     case "go":
-      return join35("go.mod");
+      return join36("go.mod");
     case "rust":
-      return join35("Cargo.toml");
+      return join36("Cargo.toml");
     case "ruby":
-      return join35("Gemfile");
+      return join36("Gemfile");
     case "php":
-      return join35("composer.json");
+      return join36("composer.json");
     case "java":
     case "kotlin":
     case "scala":
     case "groovy":
-      return join35("pom.xml");
+      return join36("pom.xml");
     case "dotnet":
-      return join35(proj.name ? `${proj.name}.csproj` : "Directory.Build.props");
+      return join36(proj.name ? `${proj.name}.csproj` : "Directory.Build.props");
     case "dart":
-      return join35("pubspec.yaml");
+      return join36("pubspec.yaml");
     case "elixir":
-      return join35("mix.exs");
+      return join36("mix.exs");
     default:
-      return join35("package.json");
+      return join36("package.json");
   }
 }
 function lockfileRelativePath(rootDir, proj) {
@@ -3431,9 +3502,9 @@ function lockfileRelativePath(rootDir, proj) {
   const dirsToTry = base ? [base, ""] : [""];
   for (const dir of dirsToTry) {
     for (const name of candidateNames) {
-      const rel = dir ? path43.join(dir, name) : name;
+      const rel = dir ? path46.join(dir, name) : name;
       try {
-        if (fs14.existsSync(path43.join(rootDir, rel))) return rel;
+        if (fs14.existsSync(path46.join(rootDir, rel))) return rel;
       } catch {
       }
     }
@@ -3497,14 +3568,14 @@ function lookupImportFiles(map, pkg) {
   const p = pkg.toLowerCase();
   if (map.has(p)) return map.get(p);
   if (!p.startsWith("@")) {
-    const root2 = p.split("/")[0];
-    if (map.has(root2)) return map.get(root2);
+    const root3 = p.split("/")[0];
+    if (map.has(root3)) return map.get(root3);
   }
   return [];
 }
-function firstPackageMentionLine(root2, relFile, pkg) {
+function firstPackageMentionLine(root3, relFile, pkg) {
   try {
-    const abs = path43.resolve(root2, relFile);
+    const abs = path46.resolve(root3, relFile);
     const stat2 = fs14.statSync(abs);
     if (!stat2.isFile() || stat2.size > 256 * 1024) return null;
     const text = fs14.readFileSync(abs, "utf8");
@@ -3730,9 +3801,9 @@ function registerLsp(program) {
     false
   ).option("--no-graph", "skip the local Vibgrate Graph entirely: no background build, and graph queries report it as turned off").option("--no-semantic", "never use semantic search for graph queries (lexical only; the embedding model is not downloaded)").action(async function(opts) {
     const global = readGlobal(this);
-    const root2 = rootOf(global);
+    const root3 = rootOf(global);
     startLanguageServer({
-      root: root2,
+      root: root3,
       // `--local` is the established air-gap flag across the CLI; honour it
       // here too, so an offline editor session stays offline.
       offline: global.local === true,
@@ -3751,9 +3822,9 @@ var HOOK_TIMEOUT_S = 10;
 function hookCommand(vgBin) {
   return `${vgBin} hook pre-tool-use`;
 }
-function installClaudeHooks(root2, vgBin = "vg") {
-  const file = path43.join(root2, ".claude", "settings.json");
-  const rel = path43.join(".claude", "settings.json");
+function installClaudeHooks(root3, vgBin = "vg") {
+  const file = path46.join(root3, ".claude", "settings.json");
+  const rel = path46.join(".claude", "settings.json");
   let settings = {};
   if (fs14.existsSync(file)) {
     try {
@@ -3793,9 +3864,9 @@ function installClaudeHooks(root2, vgBin = "vg") {
   writeSettings(file, settings);
   return { file: rel, status: "written" };
 }
-function uninstallClaudeHooks(root2) {
-  const file = path43.join(root2, ".claude", "settings.json");
-  const rel = path43.join(".claude", "settings.json");
+function uninstallClaudeHooks(root3) {
+  const file = path46.join(root3, ".claude", "settings.json");
+  const rel = path46.join(".claude", "settings.json");
   if (!fs14.existsSync(file)) return { file: rel, status: "unchanged" };
   let settings;
   try {
@@ -3821,7 +3892,7 @@ function uninstallClaudeHooks(root2) {
   return { file: rel, status: "written" };
 }
 function writeSettings(file, settings) {
-  fs14.mkdirSync(path43.dirname(file), { recursive: true });
+  fs14.mkdirSync(path46.dirname(file), { recursive: true });
   fs14.writeFileSync(file, `${JSON.stringify(settings, null, 2)}
 `);
 }
@@ -3830,8 +3901,8 @@ function writeSettings(file, settings) {
 function registerInstall(program) {
   const install = program.command("install").description("add vg to your AI assistant(s): skill + MCP + advisory nudge").argument("[tools...]", `assistant ids: ${ASSISTANTS.map((a) => a.id).join(", ")}`).option("--all", "install for every supported assistant").option("--detect", "detect assistants in use (repo footprint, home config, PATH) and install for those; with --list, only report what was detected").option("--list", "show the support matrix and exit").option("--no-hook", "skip the advisory nudge").option("--hooks", "also wire the PreToolUse enrichment hook (Claude Code): Grep/Glob calls get graph context via `vg hook pre-tool-use` (project .claude/settings.json; opt-in)").action(function(tools, opts) {
     const global = readGlobal(this);
-    const root2 = rootOf(global);
-    const detected = opts.detect ? detectAssistants(root2) : [];
+    const root3 = rootOf(global);
+    const detected = opts.detect ? detectAssistants(root3) : [];
     if (opts.list) {
       if (opts.detect) {
         if (global.json) {
@@ -3855,14 +3926,14 @@ function registerInstall(program) {
             mcp: !!a.mcp,
             skill: !!a.skill,
             nudge: !!a.nudge,
-            installed: isAssistantInstalled(a, root2)
+            installed: isAssistantInstalled(a, root3)
           }))
         );
       } else {
         info(`${c.cyan("vg install")} \xB7 supported assistants`);
         const pad4 = Math.max(...ASSISTANTS.map((a) => a.id.length)) + 2;
         for (const a of ASSISTANTS) {
-          const on = isAssistantInstalled(a, root2) ? c.green("on") : c.dim("off");
+          const on = isAssistantInstalled(a, root3) ? c.green("on") : c.dim("off");
           info(
             `  ${c.bold(a.id.padEnd(pad4))} ${a.label}  ${on}  ${c.dim(`mcp:${a.mcp ? "\u2713" : "\u2014"} skill:${a.skill ? "\u2713" : "\u2014"} nudge:${a.nudge ? "\u2713" : "\u2014"}`)}`
           );
@@ -3873,20 +3944,20 @@ function registerInstall(program) {
     const targets = opts.all ? ASSISTANTS : opts.detect ? detected.map((d) => d.assistant) : tools.map(resolve4);
     if (targets.length === 0) {
       if (opts.detect) {
-        if (global.json) json({ root: root2, detected: [], results: [] });
+        if (global.json) json({ root: root3, detected: [], results: [] });
         else info(`${c.cyan("vg install")} \xB7 no AI assistants detected here \u2014 name one (e.g. \`vg install claude\`) or use --all`);
         return;
       }
       throw usageError("name an assistant (e.g. `vg install claude`) or use --all / --detect / --list");
     }
-    const graph = loadGraph(root2, global.graph);
+    const graph = loadGraph(root3, global.graph);
     const fileCount = graph ? graph.nodes.filter((n) => n.kind === "file").length : 0;
     const smallRepo = graph !== null && fileCount > 0 && fileCount < SMALL_REPO_FILES;
     const launch = detectServeLaunch();
-    const results = targets.map((a) => ({ id: a.id, ...installAssistant(a, { root: root2, hook: opts.hook, smallRepo, launch }) }));
-    const navConfig = writeNavigationConfig(root2);
+    const results = targets.map((a) => ({ id: a.id, ...installAssistant(a, { root: root3, hook: opts.hook, smallRepo, launch }) }));
+    const navConfig = writeNavigationConfig(root3);
     if (global.json) {
-      json({ root: root2, smallRepo, navConfig, launch: { command: launch.command, args: launch.args, note: launch.note ?? null }, results });
+      json({ root: root3, smallRepo, navConfig, launch: { command: launch.command, args: launch.args, note: launch.note ?? null }, results });
       return;
     }
     for (const r of results) {
@@ -3894,7 +3965,7 @@ function registerInstall(program) {
     }
     if (opts.hooks && targets.some((a) => a.id === "claude")) {
       const vgBin = launch.command === "npx" ? null : launch.command;
-      const hooksResult = vgBin ? installClaudeHooks(root2, vgBin) : { file: ".claude/settings.json", status: "skipped", note: "vg is not installed on PATH \u2014 hooks need a fast binary (npm i -g @vibgrate/cli), rerun with --hooks after" };
+      const hooksResult = vgBin ? installClaudeHooks(root3, vgBin) : { file: ".claude/settings.json", status: "skipped", note: "vg is not installed on PATH \u2014 hooks need a fast binary (npm i -g @vibgrate/cli), rerun with --hooks after" };
       if (hooksResult.status === "written") info(`${c.green("\u2714")} ${c.bold("hooks")} \u2014 wrote PreToolUse enrichment into ${hooksResult.file}`);
       else if (hooksResult.note) info(`${c.yellow("!")} hooks \u2014 ${hooksResult.note}`);
     }
@@ -3906,14 +3977,14 @@ function registerInstall(program) {
   applyGlobalOptions(install);
   const uninstall = program.command("uninstall").description("remove vg from an AI assistant").argument("<tools...>", "assistant ids").option("--purge", "also delete the skill file").action(function(tools, opts) {
     const global = readGlobal(this);
-    const root2 = rootOf(global);
-    const results = tools.map(resolve4).map((a) => ({ id: a.id, removed: uninstallAssistant(a, root2, !!opts.purge) }));
+    const root3 = rootOf(global);
+    const results = tools.map(resolve4).map((a) => ({ id: a.id, removed: uninstallAssistant(a, root3, !!opts.purge) }));
     if (tools.map(resolve4).some((a) => a.id === "claude")) {
-      const hooksResult = uninstallClaudeHooks(root2);
+      const hooksResult = uninstallClaudeHooks(root3);
       if (hooksResult.status === "written") results.find((r) => r.id === "claude")?.removed.push(`${hooksResult.file} (vg hook entries)`);
     }
     if (global.json) {
-      json({ root: root2, results });
+      json({ root: root3, results });
       return;
     }
     for (const r of results) {
@@ -3941,11 +4012,11 @@ function registryBase(opts) {
   return (process.env.VIBGRATE_MODULE_REGISTRY || opts.registry || DEFAULT_REGISTRY).replace(/\/+$/, "");
 }
 function modulesBaseDir() {
-  const base = process.env.XDG_CACHE_HOME || path43.join(os.homedir(), ".cache");
-  return path43.join(base, "vibgrate", "modules");
+  const base = process.env.XDG_CACHE_HOME || path46.join(os.homedir(), ".cache");
+  return path46.join(base, "vibgrate", "modules");
 }
 function stateFile() {
-  return path43.join(modulesBaseDir(), "consent.json");
+  return path46.join(modulesBaseDir(), "consent.json");
 }
 function readConsent() {
   try {
@@ -3956,7 +4027,7 @@ function readConsent() {
 }
 function writeConsent(state) {
   try {
-    fs14.mkdirSync(path43.dirname(stateFile()), { recursive: true });
+    fs14.mkdirSync(path46.dirname(stateFile()), { recursive: true });
     fs14.writeFileSync(stateFile(), JSON.stringify(state));
   } catch {
   }
@@ -3967,8 +4038,8 @@ function kernelDisabled() {
 }
 function moduleInstalledAt(dir) {
   try {
-    const meta = JSON.parse(fs14.readFileSync(path43.join(dir, ".module.json"), "utf8"));
-    if (fs14.existsSync(path43.join(dir, "index.js"))) {
+    const meta = JSON.parse(fs14.readFileSync(path46.join(dir, ".module.json"), "utf8"));
+    if (fs14.existsSync(path46.join(dir, "index.js"))) {
       return { installed: true, version: meta.version };
     }
   } catch {
@@ -4016,7 +4087,7 @@ function untar(data) {
     if (type !== "0" && type !== "\0") continue;
     const name = pendingName ?? (prefix ? `${prefix}/${rawName}` : rawName);
     pendingName = null;
-    if (name.split("/").includes("..") || path43.isAbsolute(name)) {
+    if (name.split("/").includes("..") || path46.isAbsolute(name)) {
       throw new Error(`unsafe path in tarball: ${name}`);
     }
     out2.push({ name, body: Buffer.from(body) });
@@ -4050,17 +4121,17 @@ async function installModule(mod, opts = {}) {
       if (e.name.startsWith("package/dist/")) rel = e.name.slice("package/dist/".length);
       else if (e.name === "package/LICENSE" || e.name === "package/README.md") rel = e.name.slice("package/".length);
       if (!rel) continue;
-      const target = path43.join(dir, rel);
-      if (!target.startsWith(dir + path43.sep) && target !== dir) throw new Error(`unsafe extract path: ${rel}`);
-      fs14.mkdirSync(path43.dirname(target), { recursive: true });
+      const target = path46.join(dir, rel);
+      if (!target.startsWith(dir + path46.sep) && target !== dir) throw new Error(`unsafe extract path: ${rel}`);
+      fs14.mkdirSync(path46.dirname(target), { recursive: true });
       fs14.writeFileSync(target, e.body);
       wrote += 1;
     }
-    if (!wrote || !fs14.existsSync(path43.join(dir, "index.js"))) {
+    if (!wrote || !fs14.existsSync(path46.join(dir, "index.js"))) {
       fs14.rmSync(dir, { recursive: true, force: true });
       return { status: "unavailable", detail: "package layout not recognized (no dist/index.js)" };
     }
-    fs14.writeFileSync(path43.join(dir, ".module.json"), JSON.stringify({ name: mod.npmName, version }));
+    fs14.writeFileSync(path46.join(dir, ".module.json"), JSON.stringify({ name: mod.npmName, version }));
     mod.onChanged?.();
     return { status: "installed", version };
   } catch (e) {
@@ -4106,19 +4177,19 @@ function disabled() {
   return v === "1" || v === "true";
 }
 function hcsModuleDir() {
-  return path43.join(modulesBaseDir(), "hcs");
+  return path46.join(modulesBaseDir(), "hcs");
 }
 function candidatePaths() {
   const custom = process.env.VIBGRATE_HCS_PATH;
   if (custom) {
-    const p = path43.resolve(custom);
+    const p = path46.resolve(custom);
     try {
-      if (fs14.statSync(p).isDirectory()) return [path43.join(p, "index.js")];
+      if (fs14.statSync(p).isDirectory()) return [path46.join(p, "index.js")];
     } catch {
     }
     return [p];
   }
-  return [path43.join(hcsModuleDir(), "index.js")];
+  return [path46.join(hcsModuleDir(), "index.js")];
 }
 var cached;
 function resetHcsEngineCache() {
@@ -4268,11 +4339,11 @@ function requireModule(name) {
   return mod;
 }
 function confirm(question) {
-  return new Promise((resolve21) => {
+  return new Promise((resolve23) => {
     const rl = readline.createInterface({ input: process.stdin, output: process.stderr });
     rl.question(question, (answer) => {
       rl.close();
-      resolve21(answer.trim() === "" || /^y(es)?$/i.test(answer.trim()));
+      resolve23(answer.trim() === "" || /^y(es)?$/i.test(answer.trim()));
     });
   });
 }
@@ -4281,7 +4352,7 @@ var MIN_PATTERN_CHARS = 3;
 function patternToQuery(pattern) {
   return pattern.replace(/\\[dwsbDWSB]/g, " ").replace(/[\\^$.*+?()[\]{}|]/g, " ").replace(/\s+/g, " ").trim();
 }
-function hookContext(payloadText, root2, graphOverride) {
+function hookContext(payloadText, root3, graphOverride) {
   let payload;
   try {
     payload = JSON.parse(payloadText);
@@ -4292,10 +4363,10 @@ function hookContext(payloadText, root2, graphOverride) {
   const raw = payload.tool_input?.pattern ?? payload.tool_input?.query ?? "";
   const query = patternToQuery(String(raw));
   if (query.length < MIN_PATTERN_CHARS) return null;
-  const graphPath = resolveGraphPath(root2, graphOverride);
+  const graphPath = resolveGraphPath(root3, graphOverride);
   let graph;
   try {
-    const preferred = loadGraphPreferIndex(root2, graphPath);
+    const preferred = loadGraphPreferIndex(root3, graphPath);
     graph = preferred ? preferred.graph : parseGraph(fs14.readFileSync(graphPath, "utf8"));
   } catch {
     return null;
@@ -4316,10 +4387,10 @@ function registerHook(program) {
   const cmd = program.command("hook", { hidden: true }).description("assistant-host hook endpoints (wired by `vg install --hooks`)");
   const pre = cmd.command("pre-tool-use").description("PreToolUse enrichment: annotate Grep/Glob calls with graph context (stdin: host hook payload)").action(async function() {
     const global = readGlobal(this);
-    const root2 = rootOf(global);
+    const root3 = rootOf(global);
     try {
       const stdin = fs14.readFileSync(0, "utf8");
-      const context = hookContext(stdin, root2, global.graph);
+      const context = hookContext(stdin, root3, global.graph);
       if (context) {
         process.stdout.write(
           `${JSON.stringify({ hookSpecificOutput: { hookEventName: "PreToolUse", additionalContext: context } })}
@@ -4337,20 +4408,20 @@ var HOOK_END = "# vg:end";
 function registerShare(program) {
   const cmd = program.command("share").description("make the map committable + auto-updating for your team (git)").option("--undo", "reverse what `vg share` installed").option("--reports", "also commit graph.html / GRAPH_REPORT.md (default: gitignored)").action(function(opts) {
     const global = readGlobal(this);
-    const root2 = rootOf(global);
-    const gitDir = path43.join(root2, ".git");
+    const root3 = rootOf(global);
+    const gitDir = path46.join(root3, ".git");
     if (!fs14.existsSync(gitDir)) {
       throw new CliError("not a git repository \u2014 run `vg share` inside a git repo", ExitCode.USAGE_ERROR);
     }
     if (opts.undo) {
-      undo(root2);
+      undo(root3);
       info(`${c.cyan("vg share")} ${c.dim("--undo")} \xB7 removed hooks, merge driver, and attributes`);
       return;
     }
-    writeVibgrateGitignore(root2, !!opts.reports);
-    writeGitAttributes(root2);
-    configureMergeDriver(root2);
-    installPreCommitHook(root2);
+    writeVibgrateGitignore(root3, !!opts.reports);
+    writeGitAttributes(root3);
+    configureMergeDriver(root3);
+    installPreCommitHook(root3);
     info(`${c.cyan("vg share")} \xB7 the map is now committable + auto-updating`);
     info(`  ${c.green("\u2714")} .vibgrate/.gitignore (cache + volatile artifacts ignored, graph.json committed)`);
     info(`  ${c.green("\u2714")} pre-commit hook (rebuilds + stages graph.json only when it changed)`);
@@ -4359,16 +4430,16 @@ function registerShare(program) {
   });
   applyGlobalOptions(cmd);
 }
-function writeVibgrateGitignore(root2, reports) {
-  const dir = path43.join(root2, ".vibgrate");
+function writeVibgrateGitignore(root3, reports) {
+  const dir = path46.join(root3, ".vibgrate");
   fs14.mkdirSync(dir, { recursive: true });
   const lines = ["# Managed by `vg share` \u2014 keep graph.json committed, ignore the rest", "cache/", "facts.jsonl", "graph.snap"];
   if (!reports) lines.push("graph.html", "GRAPH_REPORT.md");
-  fs14.writeFileSync(path43.join(dir, ".gitignore"), `${lines.join("\n")}
+  fs14.writeFileSync(path46.join(dir, ".gitignore"), `${lines.join("\n")}
 `);
 }
-function writeGitAttributes(root2) {
-  const file = path43.join(root2, ".gitattributes");
+function writeGitAttributes(root3) {
+  const file = path46.join(root3, ".gitattributes");
   const line = ".vibgrate/graph.json merge=vg";
   let content = fs14.existsSync(file) ? fs14.readFileSync(file, "utf8") : "";
   if (!content.split("\n").some((l) => l.trim() === line)) {
@@ -4379,14 +4450,14 @@ ${line}
     fs14.writeFileSync(file, content);
   }
 }
-function configureMergeDriver(root2) {
-  git(root2, ["config", "merge.vg.name", "vg deterministic graph rebuild"]);
-  git(root2, ["config", "merge.vg.driver", "vg build >/dev/null 2>&1; cp .vibgrate/graph.json %A"]);
+function configureMergeDriver(root3) {
+  git(root3, ["config", "merge.vg.name", "vg deterministic graph rebuild"]);
+  git(root3, ["config", "merge.vg.driver", "vg build >/dev/null 2>&1; cp .vibgrate/graph.json %A"]);
 }
-function installPreCommitHook(root2) {
-  const hooksDir = hookDir(root2);
+function installPreCommitHook(root3) {
+  const hooksDir = hookDir(root3);
   fs14.mkdirSync(hooksDir, { recursive: true });
-  const file = path43.join(hooksDir, "pre-commit");
+  const file = path46.join(hooksDir, "pre-commit");
   const block = [
     HOOK_BEGIN,
     "if command -v vg >/dev/null 2>&1; then",
@@ -4407,34 +4478,34 @@ ${content}`;
   fs14.writeFileSync(file, content);
   fs14.chmodSync(file, 493);
 }
-function undo(root2) {
-  const hookFile = path43.join(hookDir(root2), "pre-commit");
+function undo(root3) {
+  const hookFile = path46.join(hookDir(root3), "pre-commit");
   if (fs14.existsSync(hookFile)) {
     const re = new RegExp(`\\n*${escapeRe(HOOK_BEGIN)}[\\s\\S]*?${escapeRe(HOOK_END)}\\n*`);
     const next2 = fs14.readFileSync(hookFile, "utf8").replace(re, "\n");
     if (next2.trim() === "#!/bin/sh") fs14.rmSync(hookFile);
     else fs14.writeFileSync(hookFile, next2);
   }
-  const attr = path43.join(root2, ".gitattributes");
+  const attr = path46.join(root3, ".gitattributes");
   if (fs14.existsSync(attr)) {
     const next2 = fs14.readFileSync(attr, "utf8").split("\n").filter((l) => l.trim() !== ".vibgrate/graph.json merge=vg").join("\n");
     fs14.writeFileSync(attr, next2);
   }
   try {
-    git(root2, ["config", "--remove-section", "merge.vg"]);
+    git(root3, ["config", "--remove-section", "merge.vg"]);
   } catch {
   }
 }
-function hookDir(root2) {
+function hookDir(root3) {
   try {
-    const configured = git(root2, ["config", "--get", "core.hooksPath"]).trim();
-    if (configured) return path43.resolve(root2, configured);
+    const configured = git(root3, ["config", "--get", "core.hooksPath"]).trim();
+    if (configured) return path46.resolve(root3, configured);
   } catch {
   }
-  return path43.join(root2, ".git", "hooks");
+  return path46.join(root3, ".git", "hooks");
 }
-function git(root2, args) {
-  return execFileSync("git", args, { cwd: root2, encoding: "utf8" });
+function git(root3, args) {
+  return execFileSync("git", args, { cwd: root3, encoding: "utf8" });
 }
 function escapeRe(s) {
   return s.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
@@ -4443,9 +4514,9 @@ var DEFAULT_DEBOUNCE_MS = 400;
 function registerWatch(program) {
   const cmd = program.command("watch").description("rebuild the code map when files change (debounced)").argument("[paths...]", "folders to watch (default: current folder)").option("--debounce <ms>", "settle time after a change before rebuild", String(DEFAULT_DEBOUNCE_MS)).option("--no-html", "do not write graph.html on each rebuild").option("--no-report", "do not write GRAPH_REPORT.md on each rebuild").option("--fast", "skip precise tsc resolve on rebuilds (heuristic only)").action(async function(paths, opts) {
     const global = readGlobal(this);
-    const root2 = rootOf(global);
+    const root3 = rootOf(global);
     const debounceMs = Math.max(50, Number(opts.debounce) || DEFAULT_DEBOUNCE_MS);
-    const watchRoots = (paths.length ? paths : ["."]).map((p) => path43.resolve(root2, p));
+    const watchRoots = (paths.length ? paths : ["."]).map((p) => path46.resolve(root3, p));
     for (const w of watchRoots) {
       if (!fs14.existsSync(w)) {
         throw new CliError(`watch path not found: ${w}`, ExitCode.USAGE_ERROR);
@@ -4463,18 +4534,18 @@ function registerWatch(program) {
       try {
         info(c.dim(`vg watch \xB7 rebuild (${reason})`));
         const result = await buildGraph({
-          root: root2,
+          root: root3,
           paths: paths.length ? paths : void 0,
           fast: opts.fast === true,
           noGround: false
         });
         writeArtifacts(result.graph, {
-          root: root2,
+          root: root3,
           html: opts.html !== false,
           report: opts.report !== false,
           graphPath: global.graph
         });
-        writeSnapshot(root2, result.graph.provenance.corpusHash, result.fileStats);
+        writeSnapshot(root3, result.graph.provenance.corpusHash, result.fileStats);
         const { counts } = result.graph.meta;
         info(
           `${c.cyan("vg watch")} \xB7 ${counts.nodes} nodes \xB7 ${counts.edges} edges \xB7 ${(result.timing.totalMs / 1e3).toFixed(2)}s` + (result.statHits ? c.dim(` \xB7 ${result.statHits} mtime hits`) : "")
@@ -4513,12 +4584,12 @@ function registerWatch(program) {
         throw new CliError(`cannot watch ${w}: ${err.message}`, ExitCode.ERROR);
       }
     }
-    info(c.dim(`vg watch \xB7 watching ${watchRoots.map((p) => path43.relative(root2, p) || ".").join(", ")} (debounce ${debounceMs}ms) \xB7 Ctrl+C to stop`));
-    await new Promise((resolve21) => {
+    info(c.dim(`vg watch \xB7 watching ${watchRoots.map((p) => path46.relative(root3, p) || ".").join(", ")} (debounce ${debounceMs}ms) \xB7 Ctrl+C to stop`));
+    await new Promise((resolve23) => {
       const stop = () => {
         for (const w of watchers) w.close();
         if (timer) clearTimeout(timer);
-        resolve21();
+        resolve23();
       };
       process.once("SIGINT", stop);
       process.once("SIGTERM", stop);
@@ -4529,7 +4600,7 @@ function registerWatch(program) {
 function registerTests(program) {
   const cmd = program.command("tests").description("which tests cover a node (call/coverage linkage)").argument("<name>", "node to inspect").option("--missing", "show untested nodes nearby instead").option("--run", "print the command to run exactly these tests").option("--exec", "run that command").option("--pick <n>", "pick the nth candidate when ambiguous").action(function(name, opts) {
     const global = readGlobal(this);
-    const { root: root2, graph } = requireGraph(global);
+    const { root: root3, graph } = requireGraph(global);
     const { node: node2, candidates } = resolveOne(graph, name, opts.pick ? Number(opts.pick) : void 0);
     if (!node2) throw ambiguityError(`"${name}" ${candidates.length ? "is ambiguous" : "not found"}`, candidates);
     if (opts.missing) {
@@ -4549,7 +4620,7 @@ function registerTests(program) {
       const command = runner.command(testFiles);
       if (opts.exec) {
         info(c.dim(`$ ${command}`));
-        execSync(command, { cwd: root2, stdio: "inherit" });
+        execSync(command, { cwd: root3, stdio: "inherit" });
         return;
       }
       if (global.json) json({ runner: runner.name, command, testFiles });
@@ -4665,16 +4736,16 @@ function registerGuide(program) {
 function registerWhy(program) {
   const cmd = program.command("why").description("who introduced a dependency (and any open vulnerabilities), from git history").argument("<package>", "package name to explain").action(async function(pkg) {
     const global = readGlobal(this);
-    const root2 = rootOf(global);
-    if (!await gitHistoryAvailable(root2)) {
+    const root3 = rootOf(global);
+    if (!await gitHistoryAvailable(root3)) {
       throw new CliError(
         "git history is required for `vg why` (not a git repository, or git is unavailable)",
         ExitCode.USAGE_ERROR
       );
     }
-    const timelines = await buildVersionTimelines(root2);
+    const timelines = await buildVersionTimelines(root3);
     const pt = timelines ? findPackageAnyEcosystem(timelines, pkg) ?? null : null;
-    const artifact = readScanArtifact(root2);
+    const artifact = readScanArtifact(root3);
     const vulnPkg = artifact?.extended?.vulnerabilities?.packages.find((p) => p.package === pkg) ?? null;
     if (global.json) {
       json({ package: pkg, history: pt?.changes ?? [], vulnerabilities: vulnPkg?.advisories ?? [] });
@@ -4743,8 +4814,8 @@ function registerBisect(program) {
   const cmd = program.command("bisect").description("pinpoint the commit where a dependency crossed a version line, from git history").argument("<package>", "package name to bisect").argument("<constraint>", 'target version or semver range (a bare version means ">=" that version)').option("--assert", "exit non-zero when the current version does not satisfy the constraint (CI gate)").action(async function(pkg, constraintArg) {
     const global = readGlobal(this);
     const opts = this.opts();
-    const root2 = rootOf(global);
-    if (!await gitHistoryAvailable(root2)) {
+    const root3 = rootOf(global);
+    if (!await gitHistoryAvailable(root3)) {
       throw new CliError(
         "git history is required for `vg bisect` (not a git repository, or git is unavailable)",
         ExitCode.USAGE_ERROR
@@ -4757,7 +4828,7 @@ function registerBisect(program) {
         ExitCode.USAGE_ERROR
       );
     }
-    const timelines = await buildVersionTimelines(root2);
+    const timelines = await buildVersionTimelines(root3);
     const pt = timelines ? findPackageAnyEcosystem(timelines, pkg) ?? null : null;
     if (!pt || pt.changes.length === 0) {
       if (global.json) {
@@ -4844,9 +4915,9 @@ function normalizeStandards(raw) {
   }
   return { banned };
 }
-function loadStandards(root2) {
+function loadStandards(root3) {
   for (const rel of STANDARDS_FILES) {
-    const p = path43__default.join(root2, rel);
+    const p = path46__default.join(root3, rel);
     let text;
     try {
       text = fs14__default.readFileSync(p, "utf8");
@@ -4874,18 +4945,18 @@ function checkStandards(policy, records) {
 function registerDrift(program) {
   const cmd = program.command("drift").description("what is outdated across dependencies (offline; --online for currency)").option("--online", "query the npm registry for latest versions (opt-in network)").option("--fail-on <level>", "exit 2 on violations \u2014 major|minor (version drift) or standards (enterprise policy)").action(async function(opts) {
     const global = readGlobal(this);
-    const root2 = rootOf(global);
+    const root3 = rootOf(global);
     if (opts.online && global.local) {
       throw new CliError("--online conflicts with --local (no network in local mode)", ExitCode.USAGE_ERROR);
     }
     if (opts.failOn && !["major", "minor", "standards"].includes(opts.failOn)) {
       throw new CliError(`--fail-on must be one of: major, minor, standards (got "${opts.failOn}")`, ExitCode.USAGE_ERROR);
     }
-    const inv = inventory(root2);
+    const inv = inventory(root3);
     if (opts.online && !global.local) await enrichOnline(inv.records);
     let standards = null;
     if (opts.failOn === "standards") {
-      const loaded = loadStandards(root2);
+      const loaded = loadStandards(root3);
       if (loaded.path && !loaded.policy) {
         throw new CliError(`standards policy at ${loaded.path} is not valid JSON`, ExitCode.USAGE_ERROR);
       }
@@ -5567,8 +5638,8 @@ async function runHostBench(options = {}) {
 }
 async function runArmSimulate(input) {
   const { arm, lib, modelPath, turns, trie, env, live } = input;
-  const path45 = `${modelPath}#${arm.id}`;
-  const session = await acquireHostSession(lib, path45);
+  const path48 = `${modelPath}#${arm.id}`;
+  const session = await acquireHostSession(lib, path48);
   const system = "You are a coding agent with a Task Capsule.";
   const capsule = "function readConfig(): Config { return load(); }";
   let last = null;
@@ -6426,8 +6497,8 @@ function registerModels(program) {
       printRawFleet(report);
       return;
     }
-    const root2 = rootOf(global);
-    const orch = buildFullStatus(root2, models, sys);
+    const root3 = rootOf(global);
+    const orch = buildFullStatus(root3, models, sys);
     const backends = probeInferenceBackends({ hasBinary });
     if (global.json) {
       json({ ...orch, fleet: report, backends });
@@ -6511,9 +6582,9 @@ function registerModels(program) {
     );
   });
   applyGlobalOptions(modeCmd);
-  const resolve21 = cmd.command("resolve").description("resolve a Code Mode to pack + underlying model + fit (no download)").argument("[mode]", "spark | flow | forge (default: auto-fit or configured default)").action(function(modeArg) {
+  const resolve23 = cmd.command("resolve").description("resolve a Code Mode to pack + underlying model + fit (no download)").argument("[mode]", "spark | flow | forge (default: auto-fit or configured default)").action(function(modeArg) {
     const global = readGlobal(this);
-    const root2 = rootOf(global);
+    const root3 = rootOf(global);
     const sys = gatherSystemMemory();
     const state = readOrchestratorState();
     const mode = parseMode(modeArg) ?? state.defaultMode;
@@ -6522,7 +6593,7 @@ function registerModels(program) {
       mode: mode ?? void 0,
       autoFit: !mode,
       system: sys,
-      repo: repoSignals(root2),
+      repo: repoSignals(root3),
       pin: pin2,
       defaultMode: state.defaultMode
     });
@@ -6543,10 +6614,10 @@ function registerModels(program) {
       info(c.yellow("  will not fit \u2014 choose a lower mode or free memory before loading"));
     }
   });
-  applyGlobalOptions(resolve21);
+  applyGlobalOptions(resolve23);
   const installCmd = cmd.command("install").description("resolve the best Code Mode for this machine and install the pack").argument("[mode]", "spark | flow | forge (default: auto-fit)").option("--dry-run", "print the install plan only \u2014 do not download").option("--yes", "skip prompts (install already runs by default)").action(async function(modeArg, opts) {
     const global = readGlobal(this);
-    const root2 = rootOf(global);
+    const root3 = rootOf(global);
     const models = discoverModels();
     const sys = gatherSystemMemory();
     const state = readOrchestratorState();
@@ -6556,7 +6627,7 @@ function registerModels(program) {
       mode: mode ?? void 0,
       autoFit: !mode,
       system: sys,
-      repo: repoSignals(root2),
+      repo: repoSignals(root3),
       pin: pin2,
       installedNames: models.map((m) => m.name),
       defaultMode: state.defaultMode
@@ -6932,8 +7003,8 @@ function registerModels(program) {
       }
     });
     if (opts.out) {
-      const outPath = path43.resolve(opts.out);
-      fs14.mkdirSync(path43.dirname(outPath), { recursive: true });
+      const outPath = path46.resolve(opts.out);
+      fs14.mkdirSync(path46.dirname(outPath), { recursive: true });
       fs14.writeFileSync(outPath, `${JSON.stringify(report, null, 2)}
 `);
       if (!global.json) info(c.dim(`  wrote ${outPath}`));
@@ -6978,9 +7049,9 @@ function hasBinary(bin) {
   const probe = spawnSync(process.platform === "win32" ? "where" : "which", [bin], { stdio: "ignore" });
   return probe.status === 0;
 }
-function repoSignals(root2) {
+function repoSignals(root3) {
   try {
-    const g = loadGraph(root2);
+    const g = loadGraph(root3);
     if (!g) return {};
     const fileCount = g.nodes.filter((n) => n.kind === "file").length;
     return { fileCount, graphNodeCount: g.nodes.length };
@@ -6988,12 +7059,12 @@ function repoSignals(root2) {
     return {};
   }
 }
-function buildFullStatus(root2, models, sys) {
+function buildFullStatus(root3, models, sys) {
   const state = readOrchestratorState();
   const freeDiskBytes = freeBytesOnVolume(weightStoreDir());
   return buildOrchestratorStatus({
     system: sys,
-    repo: repoSignals(root2),
+    repo: repoSignals(root3),
     installedNames: models.map((m) => m.name),
     freeDiskBytes,
     pins: state.pins,
@@ -7048,11 +7119,11 @@ function fitColor(label) {
   return label;
 }
 function confirmYesNo(question) {
-  return new Promise((resolve21) => {
+  return new Promise((resolve23) => {
     const rl = readline.createInterface({ input: process.stdin, output: process.stderr });
     rl.question(`${question} [y/N] `, (answer) => {
       rl.close();
-      resolve21(/^y(es)?$/i.test(answer.trim()));
+      resolve23(/^y(es)?$/i.test(answer.trim()));
     });
   });
 }
@@ -7083,14 +7154,14 @@ function resolveUninstallTarget(name, runtimeOpt) {
     }
     return exact[0];
   }
-  const base = path43.basename(wantLc);
+  const base = path46.basename(wantLc);
   const soft = fleet.filter((m) => {
     const n = m.name.toLowerCase();
-    return n === base || n.endsWith("/" + base) || n.endsWith(wantLc) || path43.basename(n) === base;
+    return n === base || n.endsWith("/" + base) || n.endsWith(wantLc) || path46.basename(n) === base;
   });
   if (soft.length === 1) return soft[0];
   if (soft.length > 1) {
-    const baseHits = soft.filter((m) => path43.basename(m.name).toLowerCase() === base);
+    const baseHits = soft.filter((m) => path46.basename(m.name).toLowerCase() === base);
     const pool = baseHits.length ? baseHits : soft;
     const order = ["ollama", "gguf", "lm-studio"];
     for (const rt of order) {
@@ -7127,12 +7198,12 @@ function printBackends(backends) {
     info(c.dim(`    [${mark}] ${b.id} \xB7 ${b.detail ?? b.label}`));
   }
 }
-function codeConfigPath(root2) {
-  return path43.join(root2, ".vibgrate", "code.json");
+function codeConfigPath(root3) {
+  return path46.join(root3, ".vibgrate", "code.json");
 }
-function loadCodeConfig(root2) {
+function loadCodeConfig(root3) {
   try {
-    const raw = JSON.parse(fs14.readFileSync(codeConfigPath(root2), "utf8"));
+    const raw = JSON.parse(fs14.readFileSync(codeConfigPath(root3), "utf8"));
     return sanitize(raw);
   } catch {
     return {};
@@ -7206,11 +7277,11 @@ function readMcpServersFile(file) {
     return {};
   }
 }
-function discoverMcpServers(root2, ownServers) {
+function discoverMcpServers(root3, ownServers) {
   const servers = {};
   const sources = [];
   for (const rel of MCP_CONFIG_FILES) {
-    const found = readMcpServersFile(path43.join(root2, rel));
+    const found = readMcpServersFile(path46.join(root3, rel));
     const names = Object.keys(found);
     if (names.length) {
       sources.push(rel);
@@ -7245,11 +7316,11 @@ function registerCode(program) {
       if (!files.length) {
         throw usageError("--restore-checkpoint needs the files to restore, e.g. -f src/a.ts -f src/b.ts");
       }
-      const root3 = rootOf(global);
+      const root4 = rootOf(global);
       const child = await import('child_process');
       const gitRunner = (gitArgs, gitEnv) => {
         const res = child.spawnSync("git", gitArgs, {
-          cwd: root3,
+          cwd: root4,
           encoding: "utf8",
           env: { ...process.env, ...gitEnv ?? {} },
           timeout: 3e4,
@@ -7277,10 +7348,10 @@ function registerCode(program) {
       const child = await import('child_process');
       const os7 = await import('os');
       const pathMod = await import('path');
-      const root3 = rootOf(global);
+      const root4 = rootOf(global);
       const gitRunner = (gitArgs, gitEnv) => {
         const res = child.spawnSync("git", gitArgs, {
-          cwd: root3,
+          cwd: root4,
           encoding: "utf8",
           env: { ...process.env, ...gitEnv ?? {} },
           timeout: 6e4,
@@ -7292,7 +7363,7 @@ function registerCode(program) {
         if (opts.streamJson) process.stdout.write(JSON.stringify(line) + "\n");
         else if (global.json) json(line);
       };
-      const findWt = (id) => wt.listSessionWorktrees(gitRunner, root3).find((w) => w.id === id);
+      const findWt = (id) => wt.listSessionWorktrees(gitRunner, root4).find((w) => w.id === id);
       if (opts.worktreeDiff) {
         const target = findWt(opts.worktreeDiff);
         if (!target) throw new CliError(`no worktree ${opts.worktreeDiff} under .vibgrate/worktrees`, ExitCode.NOT_FOUND);
@@ -7328,7 +7399,7 @@ function registerCode(program) {
           "delta.patch"
         );
         fs14.writeFileSync(patchFile, diff2.patch);
-        const outcome = wt.applyWorktreePatch(gitRunner, root3, patchFile, diff2.files);
+        const outcome = wt.applyWorktreePatch(gitRunner, root4, patchFile, diff2.files);
         emitLine({ event: "worktree-applied", id: target.id, ...outcome });
         if (!opts.streamJson && !global.json) {
           out(
@@ -7339,7 +7410,7 @@ function registerCode(program) {
         return;
       }
       if (opts.worktreeRemove) {
-        const outcome = wt.removeSessionWorktree(gitRunner, root3, opts.worktreeRemove);
+        const outcome = wt.removeSessionWorktree(gitRunner, root4, opts.worktreeRemove);
         emitLine({ event: "worktree-removed", id: opts.worktreeRemove, ...outcome });
         if (!opts.streamJson && !global.json) {
           out(outcome.removed ? `removed worktree ${opts.worktreeRemove}` : `remove failed: ${outcome.error}`);
@@ -7393,7 +7464,7 @@ function registerCode(program) {
       try {
         const { parseMode: parseMode2, resolveMode: resolveMode2, readOrchestratorState: readOrchestratorState2, activePin: activePin2 } = await import('./model-orchestrator-LHYPJBFH.js');
         const { gatherSystemMemory: gatherSystemMemory2 } = await import('./local-runtime-6SNWKSA7.js');
-        const { loadGraph: loadGraph2 } = await import('./load-OR2XVGAV.js');
+        const { loadGraph: loadGraph2 } = await import('./load-AYFECIQB.js');
         const state = readOrchestratorState2();
         const mode = parseMode2(modeFlag) ?? state.defaultMode ?? void 0;
         const pin = mode ? activePin2(mode, state) : null;
@@ -7478,7 +7549,7 @@ function registerCode(program) {
       if (!(process.stdin.isTTY && process.stdout.isTTY)) {
         throw usageError('say what to change, e.g. `vg code "add a --timeout flag to the scan command"` (guided mode needs an interactive terminal)');
       }
-      const { runInteractive } = await import('./interactive-FXPAZAUJ.js');
+      const { runInteractive } = await import('./interactive-SR7TMF6M.js');
       await runInteractive(
         rootOf(global),
         global,
@@ -7508,7 +7579,7 @@ function registerCode(program) {
     }
     if (!instruction && !stdinFirstTurn) throw usageError('say what to change, e.g. `vg code "add a --timeout flag to the scan command"`');
     {
-      const { ensureCodeMap } = await import('./ensure-map-5C6KG66X.js');
+      const { ensureCodeMap } = await import('./ensure-map-342G2IV3.js');
       const mapRoot = rootOf(global);
       try {
         await ensureCodeMap(mapRoot, global, {
@@ -7541,7 +7612,7 @@ function registerCode(program) {
         throw e;
       }
     }
-    const { root: root2, graph } = requireGraph(global);
+    const { root: root3, graph } = requireGraph(global);
     let mockReply;
     if (opts.mock) {
       try {
@@ -7593,21 +7664,21 @@ function registerCode(program) {
         process.stdout.write(JSON.stringify(line) + "\n");
       };
       try {
-        const { RunOutcomeRecorder, newOneShotRunId, turnRunId } = await import('./run-outcome-M4546HLJ.js');
+        const { RunOutcomeRecorder, newOneShotRunId, turnRunId } = await import('./run-outcome-YQQJG3LW.js');
         const primarySlug = route.providers[0]?.model.includes("/") ? route.providers[0].model.split("/")[0] : route.providers[0]?.id;
-        const { runCodeStreamJson, parseHostMessage } = await import('./stream-json-4DL65D6U.js');
-        const { nodeCodeFs } = await import('./session-HCFJUSKN.js');
+        const { runCodeStreamJson, parseHostMessage } = await import('./stream-json-55YDNAFX.js');
+        const { nodeCodeFs } = await import('./session-H34HUV2Y.js');
         const readline6 = await import('readline');
         const child = await import('child_process');
         const { loadOrDiscoverFederation } = await import('./federation-MDQPO3PW.js');
         const { resolveExecutionEnv } = await import('./execution-env-4MS5AYAN.js');
         const { resolveModelExecutionProfile, mergeModelExecutionProfile } = await import('./model-execution-profile-ELWF3Z6H.js');
-        const { startCodeRuntimeSession } = await import('./runtime-session-6KKMFS6Q.js');
-        const { resolveGraphBackend } = await import('./graph-backend-HH5IIQ55.js');
+        const { startCodeRuntimeSession } = await import('./runtime-session-CNJ4DAV5.js');
+        const { resolveGraphBackend } = await import('./graph-backend-RNWQBT3P.js');
         const { detectGitRef } = await import('./git-ref-RSRAN4OH.js');
         const { repositoryIdFromRoot } = await import('./paths-62AKTFSR.js');
-        const { vgdRequest } = await import('./vgd-QR26FAZD.js');
-        const federation = loadOrDiscoverFederation(root2);
+        const { vgdRequest } = await import('./vgd-URUZQORN.js');
+        const federation = loadOrDiscoverFederation(root3);
         const modelProfile = mergeModelExecutionProfile(
           resolveModelExecutionProfile({
             providerId: primarySlug,
@@ -7618,13 +7689,13 @@ function registerCode(program) {
           config.modelProfile
         );
         const tier = securityTier ?? modelProfile.securityTier ?? (auto ? "L1" : "L0");
-        const writableRoots = federation?.members.map((m) => m.root) ?? [root2];
+        const writableRoots = federation?.members.map((m) => m.root) ?? [root3];
         const executionEnv = resolveExecutionEnv(tier, { writableRoots });
-        const runtime = await startCodeRuntimeSession({ root: root2 });
-        const git2 = detectGitRef(root2);
-        const repositoryId = repositoryIdFromRoot(root2);
+        const runtime = await startCodeRuntimeSession({ root: root3 });
+        const git2 = detectGitRef(root3);
+        const repositoryId = repositoryIdFromRoot(root3);
         const runOutcome = new RunOutcomeRecorder(
-          root2,
+          root3,
           repositoryId,
           git2.ref || null,
           { mode: codeModeActive ? modeFlag : void 0, provider: primarySlug, model: route.providers[0]?.model },
@@ -7652,7 +7723,7 @@ function registerCode(program) {
         });
         const run = (command) => {
           const res = child.spawnSync(command, {
-            cwd: root2,
+            cwd: root3,
             shell: true,
             encoding: "utf8",
             timeout: 12e4,
@@ -7664,10 +7735,10 @@ ${res.stderr}` : ""),
             exitCode: res.status ?? 1
           };
         };
-        const { createVgBuiltinMcpTools, mergeExternalToolsets } = await import('./vg-mcp-bridge-FZGX6DYO.js');
+        const { createVgBuiltinMcpTools, mergeExternalToolsets } = await import('./vg-mcp-bridge-2CNLHNEL.js');
         const vgBuiltin = createVgBuiltinMcpTools({
           getGraph: () => graph,
-          root: root2,
+          root: root3,
           local: global.local === true
         });
         let disposeMcpStream;
@@ -7693,7 +7764,7 @@ ${res.stderr}` : ""),
         );
         const gitRunner = (gitArgs, gitEnv) => {
           const res = child.spawnSync("git", gitArgs, {
-            cwd: root2,
+            cwd: root3,
             encoding: "utf8",
             env: { ...process.env, ...gitEnv ?? {} },
             timeout: 3e4,
@@ -7709,9 +7780,9 @@ ${res.stderr}` : ""),
           files,
           indexFile: checkpointIndex
         });
-        const { loadApprovalRules, addApprovalRule, ruleForAction, ruleLabel } = await import('./approvals-IPMUDEDV.js');
+        const { loadApprovalRules, addApprovalRule, ruleForAction, ruleLabel } = await import('./approvals-ASPJQUZK.js');
         const { loadProjectRules, nodeRulesReader } = await import('./rules-ASYEUNB5.js');
-        const projectRules = loadProjectRules(nodeRulesReader(root2));
+        const projectRules = loadProjectRules(nodeRulesReader(root3));
         if (projectRules.sources.length && !global.quiet) {
           emitStream({
             event: "event",
@@ -7721,9 +7792,9 @@ ${res.stderr}` : ""),
         }
         const baseAgentOptions = {
           graph,
-          root: root2,
+          root: root3,
           providers: route.providers,
-          fsImpl: nodeCodeFs(root2),
+          fsImpl: nodeCodeFs(root3),
           run,
           // Live command-output events for the VG Code panel (async shell).
           // Sandboxed executionEnv still uses its own runner when set.
@@ -7767,8 +7838,8 @@ ${res.stderr}` : ""),
         };
         try {
           if (opts.session) {
-            const { runCodeStreamJsonSession, STREAM_JSON_PROTOCOL_VERSION } = await import('./stream-json-4DL65D6U.js');
-            const { runAgent: runAgent2 } = await import('./agent-CUYQKC6S.js');
+            const { runCodeStreamJsonSession, STREAM_JSON_PROTOCOL_VERSION } = await import('./stream-json-55YDNAFX.js');
+            const { runAgent: runAgent2 } = await import('./agent-UQC7QN77.js');
             const {
               condenseSession,
               loadLatestSession,
@@ -7779,7 +7850,7 @@ ${res.stderr}` : ""),
               sessionsDir,
               summarizeSession
             } = await import('./session-store-AQUORKWB.js');
-            const { VERSION: VERSION2 } = await import('./version-UPIC3F4P.js');
+            const { VERSION: VERSION2 } = await import('./version-WSE3QOPK.js');
             const resumedRecord = typeof opts.continue === "string" ? loadSession(mainRoot, opts.continue) : opts.continue ? loadLatestSession(mainRoot) : void 0;
             if (typeof opts.continue === "string" && !resumedRecord) {
               emitStream({
@@ -7811,8 +7882,8 @@ ${res.stderr}` : ""),
               if (ended) return Promise.resolve(null);
               const queued = pendingTurns.shift();
               if (queued !== void 0) return Promise.resolve(queued);
-              return new Promise((resolve21) => {
-                wakeTurn = resolve21;
+              return new Promise((resolve23) => {
+                wakeTurn = resolve23;
               });
             };
             let turnIndex = 0;
@@ -7991,8 +8062,8 @@ ${res.stderr}` : ""),
       if (!autonomous && !tty) {
         throw usageError("the agent approves each edit/command \u2014 run in a terminal to approve interactively, or pass --auto to run autonomously (or --single for a one-shot diff).");
       }
-      const { agentTask } = await import('./interactive-FXPAZAUJ.js');
-      const { nodeCodeFs } = await import('./session-HCFJUSKN.js');
+      const { agentTask } = await import('./interactive-SR7TMF6M.js');
+      const { nodeCodeFs } = await import('./session-H34HUV2Y.js');
       const { TtyPrompter } = await import('./ui-K7D3BCHD.js');
       let priorSummary;
       let priorInstruction;
@@ -8007,10 +8078,10 @@ ${res.stderr}` : ""),
         }
       }
       const prompter = tty ? new TtyPrompter() : void 0;
-      const { createVgBuiltinMcpTools, mergeExternalToolsets } = await import('./vg-mcp-bridge-FZGX6DYO.js');
+      const { createVgBuiltinMcpTools, mergeExternalToolsets } = await import('./vg-mcp-bridge-2CNLHNEL.js');
       const vgBuiltin = createVgBuiltinMcpTools({
         getGraph: () => graph,
-        root: root2,
+        root: root3,
         local: global.local === true
       });
       let projectMcp;
@@ -8031,12 +8102,12 @@ ${res.stderr}` : ""),
         const { loadFederation } = await import('./federation-MDQPO3PW.js');
         const { resolveExecutionEnv } = await import('./execution-env-4MS5AYAN.js');
         const { resolveModelExecutionProfile, mergeModelExecutionProfile } = await import('./model-execution-profile-ELWF3Z6H.js');
-        const { startCodeRuntimeSession } = await import('./runtime-session-6KKMFS6Q.js');
-        const { resolveGraphBackend } = await import('./graph-backend-HH5IIQ55.js');
+        const { startCodeRuntimeSession } = await import('./runtime-session-CNJ4DAV5.js');
+        const { resolveGraphBackend } = await import('./graph-backend-RNWQBT3P.js');
         const { detectGitRef } = await import('./git-ref-RSRAN4OH.js');
         const { repositoryIdFromRoot } = await import('./paths-62AKTFSR.js');
-        const { vgdRequest } = await import('./vgd-QR26FAZD.js');
-        const federation = loadFederation(root2);
+        const { vgdRequest } = await import('./vgd-URUZQORN.js');
+        const federation = loadFederation(root3);
         const modelProfile = mergeModelExecutionProfile(
           resolveModelExecutionProfile({
             providerId: primarySlug,
@@ -8048,11 +8119,11 @@ ${res.stderr}` : ""),
         );
         const tier = securityTier ?? modelProfile.securityTier ?? (autonomous ? "L1" : "L0");
         const executionEnv = resolveExecutionEnv(tier, {
-          writableRoots: federation?.members.map((m) => m.root) ?? [root2]
+          writableRoots: federation?.members.map((m) => m.root) ?? [root3]
         });
-        const runtime = await startCodeRuntimeSession({ root: root2 });
-        const git2 = detectGitRef(root2);
-        const repositoryId = repositoryIdFromRoot(root2);
+        const runtime = await startCodeRuntimeSession({ root: root3 });
+        const git2 = detectGitRef(root3);
+        const repositoryId = repositoryIdFromRoot(root3);
         if (runtime.socketPath && git2.ref) {
           try {
             await vgdRequest(
@@ -8070,11 +8141,11 @@ ${res.stderr}` : ""),
         });
         try {
           const agentResult = await agentTask({
-            root: root2,
+            root: root3,
             graph,
             instruction,
             providers: route.providers,
-            fsImpl: nodeCodeFs(root2),
+            fsImpl: nodeCodeFs(root3),
             attribution: { client: "vg-code", provider: primarySlug, model: route.providers[0]?.model },
             auto: autonomous,
             maxSteps,
@@ -8107,7 +8178,7 @@ ${res.stderr}` : ""),
     }
     let consent = !!opts.yes;
     if (opts.apply && !consent && process.stdin.isTTY && process.stdout.isTTY) {
-      consent = await confirm2(`Apply the proposed change to ${root2}?`);
+      consent = await confirm2(`Apply the proposed change to ${root3}?`);
     }
     const onPhase = (phase, detail) => {
       if (!global.json && !global.quiet) info(c.dim(`  ${phase}: ${detail}`));
@@ -8116,7 +8187,7 @@ ${res.stderr}` : ""),
     const providerSlug = primary?.model.includes("/") ? primary.model.split("/")[0] : primary?.id;
     const result = await runCodeSession({
       graph,
-      root: root2,
+      root: root3,
       instruction,
       providers: route.providers,
       apply: !!opts.apply,
@@ -8181,11 +8252,11 @@ function resolveSecurityTierFlag(flag, fromConfig, auto) {
   return auto ? "L1" : "L0";
 }
 function confirm2(question) {
-  return new Promise((resolve21) => {
+  return new Promise((resolve23) => {
     const rl = readline.createInterface({ input: process.stdin, output: process.stderr });
     rl.question(`${question} [y/N] `, (answer) => {
       rl.close();
-      resolve21(/^y(es)?$/i.test(answer.trim()));
+      resolve23(/^y(es)?$/i.test(answer.trim()));
     });
   });
 }
@@ -8195,9 +8266,9 @@ function registerSavings(program) {
   const cmd = program.command("savings").description("local, privacy-safe report of tokens/$ saved vs a grep baseline (estimates)").option("--days <n>", "window in days", "30").option("--clear", "delete the recorded usage data for this repo").action(function() {
     const global = readGlobal(this);
     const days = Number(this.opts().days) || 30;
-    const root2 = rootOf(global);
+    const root3 = rootOf(global);
     if (this.opts().clear) {
-      const existed = clearSavings(root2);
+      const existed = clearSavings(root3);
       if (global.json) {
         json({ ok: true, cleared: existed });
         return;
@@ -8208,9 +8279,9 @@ function registerSavings(program) {
       return;
     }
     const now = Date.now();
-    const report = readSavings(root2, days, now);
-    const usage = readUsage(root2, days, now);
-    const models = readModelSavings(root2, days, now);
+    const report = readSavings(root3, days, now);
+    const usage = readUsage(root3, days, now);
+    const models = readModelSavings(root3, days, now);
     if (global.json) {
       json({ ...report, usage, models });
       return;
@@ -8292,16 +8363,16 @@ function printSplit(usage) {
 function registerLib(program) {
   const cmd = program.command("lib").description("library currency: version-correct, drift-annotated usage docs").argument("[args...]", "a library name, or: add <source> | publish <name> | resolve <name> | refresh").option("--name <name>", "library name for `add`").option("--version <v>", "pin the doc version for `add`/`publish`").option("--online", "(deprecated; network is on by default) allow network for add/refresh URL sources").option("-b, --budget <n>", "trim docs to ~N tokens").option("--readme <path>", "README path for `publish` (default ./README.md)").option("--dts <path>", "TypeScript declaration (.d.ts) path for `publish`").option("--language <lang>", "primary language for `publish`").option("--region <region>", "data-residency region for the hosted catalog (same as scans; default us)").option("--ingest <url>", "hosted catalog/ingest URL override (host extracted; wins over --region)").action(async function(args, opts) {
     const global = readGlobal(this);
-    const root2 = rootOf(global);
+    const root3 = rootOf(global);
     const [verb, ...rest] = args;
     const network = !global.local;
-    if (!verb) return listCatalog(root2, global.json);
+    if (!verb) return listCatalog(root3, global.json);
     const online = (Boolean(opts.online) || network) && !global.local;
-    if (verb === "add") return addCmd(root2, rest, { ...opts, online }, global.json);
-    if (verb === "publish") return publishCmd(root2, rest, opts, global, global.json);
-    if (verb === "resolve") return resolveCmd(root2, rest, global.json);
-    if (verb === "refresh") return refreshCmd(root2, { online }, global.json);
-    return showCmd(root2, args.join(" "), opts.budget ? Number(opts.budget) : void 0, global.json, {
+    if (verb === "add") return addCmd(root3, rest, { ...opts, online }, global.json);
+    if (verb === "publish") return publishCmd(root3, rest, opts, global, global.json);
+    if (verb === "resolve") return resolveCmd(root3, rest, global.json);
+    if (verb === "refresh") return refreshCmd(root3, { online }, global.json);
+    return showCmd(root3, args.join(" "), opts.budget ? Number(opts.budget) : void 0, global.json, {
       online: network,
       // hosted-on-miss allowed unless --local
       region: opts.region,
@@ -8310,8 +8381,8 @@ function registerLib(program) {
   });
   applyGlobalOptions(cmd);
 }
-function listCatalog(root2, asJson) {
-  const catalog = loadCatalog(root2);
+function listCatalog(root3, asJson) {
+  const catalog = loadCatalog(root3);
   const libs = Object.values(catalog.libraries).sort((a, b) => a.name.localeCompare(b.name));
   if (asJson) {
     json(libs.map((l) => ({ id: l.id, name: l.name, version: l.version, source: l.source.type })));
@@ -8319,18 +8390,18 @@ function listCatalog(root2, asJson) {
   }
   info(`${c.cyan("vg lib")} \xB7 ${libs.length} library(ies) in the catalog`);
   for (const l of libs) {
-    const d = driftFor(root2, l);
+    const d = driftFor(root3, l);
     const tag = d.drift === "behind" ? c.yellow(" (docs behind your version)") : d.drift === "ahead" ? c.dim(" (docs ahead)") : "";
     info(`  ${c.bold(l.name)} ${c.dim(`@${l.version}`)} ${c.dim(`[${l.source.type}]`)}${tag}`);
   }
   if (!libs.length) info(c.dim("  empty \u2014 add docs with `vg lib add <path|url>`"));
 }
-async function addCmd(root2, rest, opts, asJson) {
+async function addCmd(root3, rest, opts, asJson) {
   const source = rest[0];
   if (!source) throw usageError("usage: vg lib add <path|url|git> [--name <name>] [--version <v>] [--online]");
   let entry;
   try {
-    entry = await addLibrary(source, { root: root2, name: opts.name, version: opts.version, allowNetwork: opts.online });
+    entry = await addLibrary(source, { root: root3, name: opts.name, version: opts.version, allowNetwork: opts.online });
   } catch (err) {
     throw new CliError(err.message, ExitCode.ERROR);
   }
@@ -8340,9 +8411,9 @@ async function addCmd(root2, rest, opts, asJson) {
   }
   info(`${c.green("\u2714")} added ${c.bold(entry.name)} ${c.dim(`@${entry.version}`)} (${entry.bytes} bytes) \u2192 ${entry.docFile}`);
 }
-function readPackageVersion(root2) {
+function readPackageVersion(root3) {
   try {
-    const pkg = JSON.parse(fs14__default.readFileSync(path43__default.join(root2, "package.json"), "utf8"));
+    const pkg = JSON.parse(fs14__default.readFileSync(path46__default.join(root3, "package.json"), "utf8"));
     return typeof pkg.version === "string" ? pkg.version : void 0;
   } catch {
     return void 0;
@@ -8356,17 +8427,17 @@ function readOptionalFile(p) {
     return void 0;
   }
 }
-async function publishCmd(root2, rest, opts, global, asJson) {
+async function publishCmd(root3, rest, opts, global, asJson) {
   if (global.local) throw usageError("vg lib publish uploads to the hosted catalog \u2014 it needs network (remove --local)");
   const name = (rest.join(" ") || opts.name || "").trim();
   if (!name) throw usageError("usage: vg lib publish <name> [--version <v>] [--readme <path>] [--dts <path>] [--language <lang>]");
   const dsn = resolveDsn();
   const parsed = dsn ? parseDsn$1(dsn) : null;
   if (!parsed) throw new CliError("publishing a private library requires a DSN \u2014 run `vibgrate login` or set VIBGRATE_DSN", ExitCode.USAGE_ERROR);
-  const version = (opts.version || readPackageVersion(root2) || "").trim();
+  const version = (opts.version || readPackageVersion(root3) || "").trim();
   if (!version) throw usageError("a --version is required (or run from a package whose package.json has a version)");
-  const readme = readOptionalFile(opts.readme ? path43__default.resolve(opts.readme) : path43__default.join(root2, "README.md"));
-  const dts = opts.dts ? readOptionalFile(path43__default.resolve(opts.dts)) : void 0;
+  const readme = readOptionalFile(opts.readme ? path46__default.resolve(opts.readme) : path46__default.join(root3, "README.md"));
+  const dts = opts.dts ? readOptionalFile(path46__default.resolve(opts.dts)) : void 0;
   if (!readme && !dts) throw usageError("nothing to publish \u2014 no README.md found and no --dts given");
   const result = await publishPrivateLibrary(
     { name, version, readme, dts, language: opts.language },
@@ -8384,20 +8455,20 @@ async function publishCmd(root2, rest, opts, global, asJson) {
   info(`${c.green("\u2714")} published ${c.bold(name)} ${c.dim(`@${version}`)} \xB7 ${result.entities} entities \xB7 ${result.indexedTokens} tokens indexed (MCP-token meter)`);
   info(c.dim(`  private to your workspace \xB7 targetId ${result.targetId}`));
 }
-function resolveCmd(root2, rest, asJson) {
+function resolveCmd(root3, rest, asJson) {
   const name = rest.join(" ");
   if (!name) throw usageError("usage: vg lib resolve <name>");
-  const entry = resolveLib(loadCatalog(root2), name);
+  const entry = resolveLib(loadCatalog(root3), name);
   if (!entry) throw new CliError(`no library matches "${name}" (id ${libId(name)})`, ExitCode.NOT_FOUND);
   if (asJson) json({ id: entry.id, name: entry.name, version: entry.version });
   else info(`${entry.id} ${c.dim(`(${entry.name}@${entry.version})`)}`);
 }
-async function refreshCmd(root2, opts, asJson) {
-  const catalog = loadCatalog(root2);
+async function refreshCmd(root3, opts, asJson) {
+  const catalog = loadCatalog(root3);
   const results = [];
   for (const entry of Object.values(catalog.libraries)) {
     try {
-      await addLibrary(entry.source.location, { root: root2, name: entry.name, version: entry.version, allowNetwork: opts.online });
+      await addLibrary(entry.source.location, { root: root3, name: entry.name, version: entry.version, allowNetwork: opts.online });
       results.push({ name: entry.name, ok: true });
     } catch {
       results.push({ name: entry.name, ok: false });
@@ -8406,36 +8477,36 @@ async function refreshCmd(root2, opts, asJson) {
   if (asJson) json({ refreshed: results });
   else info(`${c.cyan("vg lib refresh")} \xB7 ${results.filter((r) => r.ok).length}/${results.length} re-ingested`);
 }
-async function showCmd(root2, name, budget, asJson, opts = {}) {
+async function showCmd(root3, name, budget, asJson, opts = {}) {
   const online = opts.online;
-  const catalog = loadCatalog(root2);
+  const catalog = loadCatalog(root3);
   const entry = resolveLib(catalog, name);
-  const ver = resolveVersion(root2, name);
+  const ver = resolveVersion(root3, name);
   const displayName = entry?.name ?? name;
   let localDoc;
   let docVersion = ver.served ?? "*";
   let docSource;
   let drift;
   if (entry) {
-    localDoc = readDoc(root2, entry);
+    localDoc = readDoc(root3, entry);
     docVersion = entry.version;
-    drift = driftFor(root2, entry);
+    drift = driftFor(root3, entry);
   } else {
-    const local = localPackageDocs(root2, name);
+    const local = localPackageDocs(root3, name);
     if (local) {
       localDoc = local.docs;
       docVersion = local.version ?? ver.served ?? "*";
       docSource = local.source;
     }
   }
-  const apiSurface = localApiSurface(root2, displayName);
+  const apiSurface = localApiSurface(root3, displayName);
   const quality = localDoc !== void 0 ? assessDocQuality([localDoc, apiSurface].filter(Boolean).join("\n\n"), { name: displayName, symbols: symbolsFromApi(apiSurface) }) : { sufficient: false, score: 0, reasons: ["no local docs"] };
   let hosted = null;
   if (online && !quality.sufficient) {
     const dsn = resolveDsn();
     const parsed = dsn ? parseDsn$1(dsn) : null;
     hosted = await fetchHostedDocsCached(
-      root2,
+      root3,
       { name: displayName, query: name, maxTokens: budget },
       { region: opts.region, ingest: opts.ingest, auth: parsed ? { keyId: parsed.keyId, secret: parsed.secret } : void 0 }
     );
@@ -8482,13 +8553,13 @@ function registerExport(program) {
   const cmd = program.command("export").description("export the map (format inferred: json|ndjson|graphml|dot|cypher|sql|md|html|cdx.json|spdx.json)").argument("[file]", "target file (or - for stdout)", "map.json").option("--compact", "compact JSON (no pretty-print; auto for large maps)").option("--slim", "drop heavy fields (area member lists, grounding) for smaller exports").action(function(file, opts) {
     const global = readGlobal(this);
     const { graph } = requireGraph(global);
-    const root2 = rootOf(global);
+    const root3 = rootOf(global);
     const format = detectFormat(file);
     if (!format) throw usageError(`unknown export format for "${file}"`);
     const needsDeps = format === "cyclonedx" || format === "spdx";
     const content = exportGraph(format, {
       graph,
-      deps: needsDeps ? inventory(root2).records : void 0,
+      deps: needsDeps ? inventory(root3).records : void 0,
       models: needsDeps && !global.local ? discoverModels() : void 0,
       generatedAt: graph.generatedAt,
       compact: opts.compact === true ? true : opts.compact === false ? false : void 0,
@@ -8498,7 +8569,7 @@ function registerExport(program) {
       out(content.trimEnd());
       return;
     }
-    fs14.mkdirSync(path43.dirname(path43.resolve(file)), { recursive: true });
+    fs14.mkdirSync(path46.dirname(path46.resolve(file)), { recursive: true });
     fs14.writeFileSync(file, content);
     info(`${c.green("\u2714")} wrote ${file} ${c.dim(`(${format})`)}`);
   });
@@ -8509,49 +8580,49 @@ function detectFormat(file) {
   if (lower.endsWith(".cdx.json")) return "cyclonedx";
   if (lower.endsWith(".spdx.json")) return "spdx";
   if (file === "-") return "json";
-  return formatForExt(path43.extname(file));
+  return formatForExt(path46.extname(file));
 }
 function registerBundle(program) {
   const cmd = program.command("bundle").description("build an air-gapped bundle (grammars + graph + library catalog)").option("--offline", "offline bundle (default; present for clarity)").option("-o, --out <dir>", "output directory", "vg-bundle").action(function(opts) {
     const global = readGlobal(this);
-    const root2 = rootOf(global);
-    const outDir = path43.resolve(root2, opts.out ?? "vg-bundle");
+    const root3 = rootOf(global);
+    const outDir = path46.resolve(root3, opts.out ?? "vg-bundle");
     let grammarFiles;
     try {
       grammarFiles = resolvedGrammarFiles();
     } catch {
       throw new CliError("no grammars found to bundle (run a build first)", ExitCode.ERROR);
     }
-    fs14.mkdirSync(path43.join(outDir, "grammars"), { recursive: true });
+    fs14.mkdirSync(path46.join(outDir, "grammars"), { recursive: true });
     let grammarCount = 0;
     for (const { fileName, absPath } of grammarFiles) {
-      fs14.copyFileSync(absPath, path43.join(outDir, "grammars", fileName));
+      fs14.copyFileSync(absPath, path46.join(outDir, "grammars", fileName));
       grammarCount++;
     }
     for (const id of Object.keys(TOOLCHAIN_GRAMMARS).sort()) {
       const absPath = resolveToolchainGrammar(id);
       if (!absPath) continue;
-      fs14.copyFileSync(absPath, path43.join(outDir, "grammars", path43.basename(absPath)));
+      fs14.copyFileSync(absPath, path46.join(outDir, "grammars", path46.basename(absPath)));
       grammarCount++;
     }
     const included = [`grammars/ (${grammarCount} .wasm)`];
-    const graphSrc = resolveGraphPath(root2, global.graph);
+    const graphSrc = resolveGraphPath(root3, global.graph);
     if (fs14.existsSync(graphSrc)) {
-      fs14.copyFileSync(graphSrc, path43.join(outDir, "graph.json"));
+      fs14.copyFileSync(graphSrc, path46.join(outDir, "graph.json"));
       included.push("graph.json");
     } else {
       const graph = loadGraphFileWithSnapshot(graphSrc);
       if (graph) {
-        fs14.writeFileSync(path43.join(outDir, "graph.json"), serializeGraph(graph));
+        fs14.writeFileSync(path46.join(outDir, "graph.json"), serializeGraph(graph));
         included.push("graph.json");
       }
     }
-    const cat = catalogPath(root2);
+    const cat = catalogPath(root3);
     if (fs14.existsSync(cat)) {
-      fs14.copyFileSync(cat, path43.join(outDir, "vibgrate.lib.json"));
+      fs14.copyFileSync(cat, path46.join(outDir, "vibgrate.lib.json"));
       included.push("vibgrate.lib.json");
-      if (fs14.existsSync(libDir(root2))) {
-        fs14.cpSync(libDir(root2), path43.join(outDir, "lib"), { recursive: true });
+      if (fs14.existsSync(libDir(root3))) {
+        fs14.cpSync(libDir(root3), path46.join(outDir, "lib"), { recursive: true });
         included.push("lib/");
       }
     }
@@ -8563,15 +8634,15 @@ function registerBundle(program) {
       included,
       usage: "Run `vg build --grammars <this dir>/grammars` to build fully offline."
     };
-    fs14.writeFileSync(path43.join(outDir, "MANIFEST.json"), `${stableStringify(manifest, 2)}
+    fs14.writeFileSync(path46.join(outDir, "MANIFEST.json"), `${stableStringify(manifest, 2)}
 `);
     if (global.json) {
-      json({ out: path43.relative(root2, outDir), ...manifest });
+      json({ out: path46.relative(root3, outDir), ...manifest });
       return;
     }
-    info(`${c.cyan("vg bundle")} \xB7 wrote ${path43.relative(root2, outDir)}/`);
+    info(`${c.cyan("vg bundle")} \xB7 wrote ${path46.relative(root3, outDir)}/`);
     for (const i of included) info(`  ${c.green("\u2714")} ${i}`);
-    info(c.dim(`  offline: vg build --grammars "${path43.relative(root2, outDir)}/grammars"`));
+    info(c.dim(`  offline: vg build --grammars "${path46.relative(root3, outDir)}/grammars"`));
   });
   applyGlobalOptions(cmd);
 }
@@ -8586,19 +8657,19 @@ function registerDoctor(program) {
 var REACH_TIMEOUT_MS = 3e3;
 var CONFIG_BASENAMES = ["vibgrate.config.ts", "vibgrate.config.js", "vibgrate.config.json"];
 async function runDoctor(global) {
-  const root2 = rootOf(global);
+  const root3 = rootOf(global);
   const local = global.local === true;
-  const graphPath = resolveGraphPath(root2, global.graph);
-  const configFile = CONFIG_BASENAMES.find((f) => fs14.existsSync(path43.join(root2, f))) ?? null;
-  const graph = loadGraph(root2, graphPath);
+  const graphPath = resolveGraphPath(root3, global.graph);
+  const configFile = CONFIG_BASENAMES.find((f) => fs14.existsSync(path46.join(root3, f))) ?? null;
+  const graph = loadGraph(root3, graphPath);
   let staleFiles = null;
   if (graph) {
-    const probe = probeFreshness(root2);
+    const probe = probeFreshness(root3);
     if (probe) staleFiles = driftCount(probe.drift);
   }
-  const catalog = loadCatalog(root2);
+  const catalog = loadCatalog(root3);
   const libCount = Object.keys(catalog.libraries).length;
-  const creds = diagnoseCredentials(root2);
+  const creds = diagnoseCredentials(root3);
   const base = hostedBase();
   const reachable = local ? null : await probeReachable(base);
   const launch = detectServeLaunch();
@@ -8612,17 +8683,17 @@ async function runDoctor(global) {
     version: VERSION,
     node: process.version,
     platform: `${process.platform}/${process.arch}`,
-    root: root2,
+    root: root3,
     configFile,
     map: {
-      path: path43.relative(root2, graphPath),
+      path: path46.relative(root3, graphPath),
       built: graph !== null,
       generatedAt: graph?.generatedAt ?? null,
       staleFiles
     },
     libCatalog: {
-      path: path43.relative(root2, catalogPath(root2)),
-      present: fs14.existsSync(catalogPath(root2)),
+      path: path46.relative(root3, catalogPath(root3)),
+      present: fs14.existsSync(catalogPath(root3)),
       libraries: libCount
     },
     credentials: creds,
@@ -8679,7 +8750,7 @@ async function runDoctor(global) {
   );
   info(
     `  host pool  ${li.hostPool.size} warm session(s)` + (li.hostPool.sessions[0] ? c.dim(
-      ` \xB7 last ${path43.basename(li.hostPool.sessions[0].modelPath)} kv=${li.hostPool.sessions[0].kvBlocks}`
+      ` \xB7 last ${path46.basename(li.hostPool.sessions[0].modelPath)} kv=${li.hostPool.sessions[0].kvBlocks}`
     ) : c.dim(" \xB7 none (load via vg code / vgd host-load)"))
   );
   if (li.dynamicOnToken || li.dynamicCustomSampler) {
@@ -8692,16 +8763,16 @@ async function runDoctor(global) {
   }
   info(c.dim("  tip        `vg models mode --apply-recommend` pins the recommended Code Mode"));
 }
-function diagnoseCredentials(root2) {
+function diagnoseCredentials(root3) {
   const none = { source: "none", path: null, host: null, workspaceId: null };
   if (process.env.VIBGRATE_DSN) {
     const parsed2 = parseDsn$1(process.env.VIBGRATE_DSN);
     return { source: "env", path: null, host: parsed2?.host ?? null, workspaceId: parsed2?.workspaceId ?? null };
   }
-  const stored = readStoredCredentials({ cwd: root2 });
+  const stored = readStoredCredentials({ cwd: root3 });
   if (!stored) return none;
-  const file = credentialsPath({ cwd: root2 });
-  const source = process.env.VIBGRATE_CREDENTIALS ? "env" : file === projectCredentialsPath(root2) ? "project" : "home";
+  const file = credentialsPath({ cwd: root3 });
+  const source = process.env.VIBGRATE_CREDENTIALS ? "env" : file === projectCredentialsPath(root3) ? "project" : "home";
   const parsed = parseDsn$1(stored.dsn);
   return {
     source,
@@ -8986,7 +9057,7 @@ async function readStdin() {
   return Buffer.concat(chunks).toString("utf-8");
 }
 function readFileOrThrow(file, label) {
-  const p = path43.resolve(file);
+  const p = path46.resolve(file);
   if (!fs14.existsSync(p)) throw usageError(`${label} file not found: ${p}`);
   return fs14.readFileSync(p, "utf-8");
 }
@@ -8998,8 +9069,8 @@ function writeOutput(outFile, content) {
     process.stdout.write(content.endsWith("\n") ? content : content + "\n");
     return;
   }
-  const outPath = path43.resolve(outFile);
-  const dir = path43.dirname(outPath);
+  const outPath = path46.resolve(outFile);
+  const dir = path46.dirname(outPath);
   if (!fs14.existsSync(dir)) throw usageError(`output directory does not exist: ${dir}`);
   fs14.writeFileSync(outPath, content.endsWith("\n") ? content : content + "\n", "utf-8");
   info(c.dim(`wrote ${outPath}`));
@@ -9034,9 +9105,9 @@ function registerHcs(program) {
     }
     const statePath = opts.previous ?? opts.out;
     const useIncremental = canIncremental && statePath !== void 0;
-    const root2 = path43.resolve(dir);
-    if (!fs14.existsSync(root2) || !fs14.statSync(root2).isDirectory()) {
-      throw usageError(`not a directory: ${root2}`);
+    const root3 = path46.resolve(dir);
+    if (!fs14.existsSync(root3) || !fs14.statSync(root3).isDirectory()) {
+      throw usageError(`not a directory: ${root3}`);
     }
     const supported = new Set(
       engine.supportedLanguages().split(",").map((l) => l.trim()).filter(Boolean)
@@ -9059,7 +9130,7 @@ function registerHcs(program) {
       }
       for (const entry of entries.sort((a, b) => a.name < b.name ? -1 : 1)) {
         if (entry.name.startsWith(".")) continue;
-        const absChild = path43.join(abs, entry.name);
+        const absChild = path46.join(abs, entry.name);
         const relChild = rel ? `${rel}/${entry.name}` : entry.name;
         if (entry.isDirectory()) {
           if (!SKIP_DIRS2.has(entry.name)) walk2(absChild, relChild);
@@ -9067,7 +9138,7 @@ function registerHcs(program) {
         }
         if (!entry.isFile()) continue;
         if (!opts.includeTests && TEST_PATTERNS.some((p) => p.test(relChild))) continue;
-        const lang = extToLang.get(path43.extname(entry.name).toLowerCase());
+        const lang = extToLang.get(path46.extname(entry.name).toLowerCase());
         if (!lang) continue;
         try {
           if (fs14.statSync(absChild).size > MAX_EXTRACT_FILE_BYTES) continue;
@@ -9079,9 +9150,9 @@ function registerHcs(program) {
         }
       }
     };
-    walk2(root2, "");
+    walk2(root3, "");
     if (byLanguage.size === 0 && !useIncremental) {
-      info(`no extractable sources found under ${root2} (languages: ${[...wanted].sort().join(", ")})`);
+      info(`no extractable sources found under ${root3} (languages: ${[...wanted].sort().join(", ")})`);
       writeOutput(opts.out, "");
       return;
     }
@@ -9101,7 +9172,7 @@ function registerHcs(program) {
       writeOutput(opts.out, parts2.join("\n"));
       return;
     }
-    const previousPath = path43.resolve(statePath);
+    const previousPath = path46.resolve(statePath);
     const previousNdjson = !opts.full && fs14.existsSync(previousPath) ? fs14.readFileSync(previousPath, "utf-8") : "";
     if (opts.full) info(c.dim("running a full re-extraction (--full)"));
     else if (!previousNdjson) info(c.dim(`previous stream not found at ${previousPath} \u2014 running a full extraction`));
@@ -9206,11 +9277,11 @@ function registerHcs(program) {
   applyGlobalOptions(cmd);
 }
 var initCommand = new Command("init").description("Initialize vibgrate in a project").argument("[path]", "Path to initialize", ".").option("--baseline", "Create initial baseline after init").option("--yes", "Skip confirmation prompts").action(async (targetPath, opts) => {
-  const rootDir = path43.resolve(targetPath);
-  const vibgrateDir2 = path43.join(rootDir, ".vibgrate");
+  const rootDir = path46.resolve(targetPath);
+  const vibgrateDir2 = path46.join(rootDir, ".vibgrate");
   await ensureDir(vibgrateDir2);
   console.log(chalk7.green("\u2714") + ` Created ${chalk7.bold(".vibgrate/")} directory`);
-  const configPath = path43.join(rootDir, "vibgrate.config.ts");
+  const configPath = path46.join(rootDir, "vibgrate.config.ts");
   if (await pathExists(configPath)) {
     console.log(chalk7.dim("  vibgrate.config.ts already exists, skipping"));
   } else {
@@ -9218,7 +9289,7 @@ var initCommand = new Command("init").description("Initialize vibgrate in a proj
     console.log(chalk7.green("\u2714") + ` Created ${chalk7.bold("vibgrate.config.ts")}`);
   }
   if (opts.baseline) {
-    const { runBaseline } = await import('./baseline-NZFGLMER.js');
+    const { runBaseline } = await import('./baseline-FIV6PR2M.js');
     await runBaseline(rootDir);
   }
   console.log("");
@@ -9321,7 +9392,7 @@ function collectPackageImports(graph, ecosystem, pkg) {
   };
 }
 async function firstReferenceLine(rootDir, relFile, identifier, readFile3) {
-  const content = await readFile3(path43.join(rootDir, relFile));
+  const content = await readFile3(path46.join(rootDir, relFile));
   if (!content) return null;
   const escaped = identifier.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
   const re = new RegExp(`\\b${escaped}\\b`);
@@ -9557,7 +9628,7 @@ var AI_ASSISTANT_DETECTORS = [
 async function detectAiAssistant(rootDir) {
   for (const detector of AI_ASSISTANT_DETECTORS) {
     for (const file of detector.files) {
-      if (await pathExists$1(path43.join(rootDir, file))) {
+      if (await pathExists$1(path46.join(rootDir, file))) {
         return detector.name;
       }
     }
@@ -9589,6 +9660,18 @@ init_cli_invocation();
 function shouldBuildCodeMap(opts) {
   return opts.graph !== false && !opts.maxPrivacy && !opts.noLocalArtifacts;
 }
+function architectureGraphView2(graph) {
+  return {
+    nodes: graph.nodes.map((n) => ({ id: n.id, file: n.file, kind: n.kind })),
+    edges: graph.edges.map((e) => ({
+      src: e.src,
+      dst: e.dst,
+      kind: e.kind,
+      confidence: e.confidence,
+      resolution: e.resolution
+    }))
+  };
+}
 async function attachReachability(artifact, rootDir, opts, graph) {
   try {
     const dsn = resolveDsn(opts.dsn);
@@ -9750,8 +9833,8 @@ var scanCommand = new Command("scan").description("Scan a project for upgrade dr
   'Exclude paths matching a glob pattern. Repeatable, and a single value may list several patterns separated by commas or semicolons (e.g. --exclude "legacy/**,vendor/**"). Merged with excludes from the config file.',
   collectExcludes,
   []
-).option("--concurrency <n>", "Max concurrent npm calls", "8").option("--push", "Auto-push results to Vibgrate API after scan").option("--dsn <dsn>", "DSN token for push (or use VIBGRATE_DSN env)").option("--region <region>", "Override data residency region for push (us, eu)").option("--strict", "Fail on push errors").option("--ui-purpose", "Enable optional UI purpose evidence extraction (slower)").option("--no-local-artifacts", "Do not write .vibgrate JSON artifacts to disk").option("--max-privacy", "Enable strongest privacy mode (minimal scanners, no local artifacts)").option("--offline", "Run without network calls; do not upload results").option("--full", "Comprehensive scan: turns on known-vulnerability detection (= --vulns) and, when a standards policy exists, a banned-dependency report \u2014 on top of drift scoring and the code map").option("--vulns", "Also scan installed dependencies for known vulnerabilities (OSV online, or advisories from --package-manifest when offline)").option("--package-manifest <file>", "Use local package-version manifest JSON/ZIP (for offline mode)").option("--project-scan-timeout <seconds>", "Per-project scan timeout in seconds (default: 180)").option("--drift-budget <score>", "Fail if DriftScore is above budget (0-100)").option("--drift-worsening <percent>", "Fail if drift worsens by more than % since baseline").option("--repository-name <name>", "Override the repository name recorded for this scan (defaults to the directory or package.json name)").option("--force", "Always create a fresh scan ingest, even if the repository is unchanged since the last scan (skips the unchanged/reuse optimization). Used by scheduled and dashboard-triggered scans.").option("--no-graph", "Skip building the local code map (the AI/docs index) that scan produces after scoring drift").option("--quiet", "Suppress promotional output (the free-plan tracking panel and the AI Context install prompt); scan results are unaffected").action(async (targetPath, opts) => {
-  const rootDir = path43.resolve(targetPath);
+).option("--concurrency <n>", "Max concurrent registry lookups", "8").option("--push", "Auto-push results to Vibgrate API after scan").option("--dsn <dsn>", "DSN token for push (or use VIBGRATE_DSN env)").option("--region <region>", "Override data residency region for push (us, eu)").option("--strict", "Fail on push errors").option("--ui-purpose", "Enable optional UI purpose evidence extraction (slower)").option("--no-local-artifacts", "Do not write .vibgrate JSON artifacts to disk").option("--max-privacy", "Enable strongest privacy mode (minimal scanners, no local artifacts)").option("--offline", "Run without network calls; do not upload results").option("--full", "Comprehensive scan: turns on known-vulnerability detection (= --vulns) and, when a standards policy exists, a banned-dependency report \u2014 on top of drift scoring and the code map").option("--vulns", "Also scan installed dependencies for known vulnerabilities (OSV online, or advisories from --package-manifest when offline)").option("--package-manifest <file>", "Use local package-version manifest JSON/ZIP (for offline mode)").option("--project-scan-timeout <seconds>", "Per-project scan timeout in seconds (default: 180)").option("--drift-budget <score>", "Fail if DriftScore is above budget (0-100)").option("--drift-worsening <percent>", "Fail if drift worsens by more than % since baseline").option("--repository-name <name>", "Override the repository name recorded for this scan (defaults to the directory or package.json name)").option("--force", "Always create a fresh scan ingest, even if the repository is unchanged since the last scan (skips the unchanged/reuse optimization). Used by scheduled and dashboard-triggered scans.").option("--no-graph", "Skip building the local code map (the AI/docs index) that scan produces after scoring drift").option("--quiet", "Suppress promotional output (the free-plan tracking panel and the AI Context install prompt); scan results are unaffected").action(async (targetPath, opts) => {
+  const rootDir = path46.resolve(targetPath);
   if (!await pathExists$1(rootDir)) {
     console.error(chalk7.red(`Path does not exist: ${rootDir}`));
     process.exit(1);
@@ -9759,7 +9842,7 @@ var scanCommand = new Command("scan").description("Scan a project for upgrade dr
   const hasDsn = !!resolveDsn(opts.dsn);
   let willPush = !opts.offline && (opts.push || hasDsn);
   const noLocalArtifacts = opts.localArtifacts === false;
-  const isFirstRun = !await pathExists$1(path43.join(rootDir, ".vibgrate", "scan_result.json"));
+  const isFirstRun = !await pathExists$1(path46.join(rootDir, ".vibgrate", "scan_result.json"));
   let pinnedRegion;
   let planTier;
   let upgradeUrl;
@@ -9891,7 +9974,7 @@ var scanCommand = new Command("scan").description("Scan a project for upgrade dr
   const wantGraph = shouldBuildCodeMap({ graph: opts.graph, maxPrivacy: opts.maxPrivacy, noLocalArtifacts });
   let builtGraph = null;
   if (wantGraph) {
-    scanOpts.postScan = async (report) => {
+    scanOpts.postScan = async (report, ctx) => {
       const result = await buildGraph({
         root: rootDir,
         exclude: opts.exclude,
@@ -9902,6 +9985,14 @@ var scanCommand = new Command("scan").description("Scan a project for upgrade dr
       writeSnapshot(rootDir, result.graph.provenance.corpusHash, result.fileStats, {
         exclude: opts.exclude
       });
+      refineArchitectureWithGraph(
+        { projects: ctx.projects, solutions: ctx.solutions, extended: ctx.extended },
+        architectureGraphView2(result.graph)
+      );
+      refineArchitectureWithAstRoles(
+        { projects: ctx.projects, solutions: ctx.solutions, extended: ctx.extended },
+        result.fileRoles
+      );
       const { counts } = result.graph.meta;
       return `${counts.nodes.toLocaleString()} nodes \xB7 ${counts.edges.toLocaleString()} edges`;
     };
@@ -10048,11 +10139,11 @@ function scanStaleness(rootDir, artifactPath) {
       scanned++;
       if (scanned > MAX_ENTRIES2) break;
       if (e.isDirectory()) {
-        if (!SKIP_DIRS3.has(e.name) && !e.name.startsWith(".")) walk2(path43.join(dir, e.name), depth + 1);
+        if (!SKIP_DIRS3.has(e.name) && !e.name.startsWith(".")) walk2(path46.join(dir, e.name), depth + 1);
         continue;
       }
       if (!WATCHED_FILES.has(e.name) && !WATCHED_EXT.test(e.name)) continue;
-      const abs = path43.join(dir, e.name);
+      const abs = path46.join(dir, e.name);
       let mtimeMs;
       try {
         mtimeMs = fs14.statSync(abs).mtimeMs;
@@ -10061,7 +10152,7 @@ function scanStaleness(rootDir, artifactPath) {
       }
       if (mtimeMs > newest) {
         newest = mtimeMs;
-        newestChanged = path43.relative(rootDir, abs) || e.name;
+        newestChanged = path46.relative(rootDir, abs) || e.name;
       }
     }
   };
@@ -10169,7 +10260,7 @@ function importPattern(ecosystem, pkg) {
   }
   return new RegExp(`^\\s*(?:import\\s+${e}(?:[.\\s]|$)|from\\s+${e}(?:[.\\s]))`, "gm");
 }
-function analyzeTree(root2, packages) {
+function analyzeTree(root3, packages) {
   const result = /* @__PURE__ */ new Map();
   const tracked = [];
   for (const p of packages) {
@@ -10201,13 +10292,13 @@ function analyzeTree(root2, packages) {
       if (filesSeen >= MAX_FILES) return;
       if (entry.isDirectory()) {
         if (SKIP_DIRS4.has(entry.name) || entry.name.startsWith(".")) continue;
-        walk2(path43.join(dir, entry.name), depth + 1);
+        walk2(path46.join(dir, entry.name), depth + 1);
         continue;
       }
-      const fileEco = EXT_ECOSYSTEM[path43.extname(entry.name)];
+      const fileEco = EXT_ECOSYSTEM[path46.extname(entry.name)];
       if (!fileEco || fileEco === "unknown") continue;
       filesSeen++;
-      const full = path43.join(dir, entry.name);
+      const full = path46.join(dir, entry.name);
       let content;
       try {
         if (fs14.statSync(full).size > MAX_FILE_BYTES2) continue;
@@ -10229,7 +10320,7 @@ function analyzeTree(root2, packages) {
       }
     }
   };
-  walk2(root2, 0);
+  walk2(root3, 0);
   for (const t of tracked) {
     result.set(t.name, {
       importSites: t.importSites,
@@ -10522,7 +10613,7 @@ function applyPlan(rootDir, upgrades, opts = {}) {
     }
     const outcomes = effective.map((t) => {
       const c2 = pmCommandFor(u.ecosystem, u.package, u.to, opts.packageManager, { workspaceRoot: t.isWorkspaceRoot });
-      return { t, res: run(c2, path43.join(rootDir, t.dir)) };
+      return { t, res: run(c2, path46.join(rootDir, t.dir)) };
     });
     const failures = outcomes.filter((o) => !o.res.ok);
     if (failures.length === 0) {
@@ -10551,8 +10642,8 @@ function applyPlan(rootDir, upgrades, opts = {}) {
   return results;
 }
 var REGISTRY_URL = "https://registry.npmjs.org/@vibgrate%2fcli/latest";
-var CACHE_DIR = path43.join(os.homedir(), ".vibgrate");
-var CACHE_FILE = path43.join(CACHE_DIR, "update-check.json");
+var CACHE_DIR = path46.join(os.homedir(), ".vibgrate");
+var CACHE_FILE = path46.join(CACHE_DIR, "update-check.json");
 async function fetchLatestVersion() {
   try {
     const controller = new AbortController();
@@ -10615,8 +10706,8 @@ function buildDeferredUpdateScript(opts) {
 }
 function scheduleDeferredUpdate(command, pid = process.pid, dir = os.tmpdir()) {
   const stamp = `${pid}-${process.hrtime.bigint().toString(36)}`;
-  const scriptPath = path43.join(dir, `vg-update-${stamp}.cmd`);
-  const logPath = path43.join(dir, `vg-update-${stamp}.log`);
+  const scriptPath = path46.join(dir, `vg-update-${stamp}.cmd`);
+  const logPath = path46.join(dir, `vg-update-${stamp}.log`);
   try {
     fs14.writeFileSync(scriptPath, buildDeferredUpdateScript({ pid, command, logPath }), "utf8");
     const child = spawn(process.env.ComSpec || "cmd.exe", ["/d", "/s", "/c", scriptPath], {
@@ -10672,14 +10763,14 @@ async function findGlobalInstall(pkg = PACKAGE_NAME, run = defaultRunner) {
       pm: "yarn",
       root: () => {
         const dir = tryRun("yarn global dir");
-        return dir ? path43.join(dir, "node_modules") : null;
+        return dir ? path46.join(dir, "node_modules") : null;
       }
     },
-    { pm: "bun", root: () => path43.join(os.homedir(), ".bun", "install", "global", "node_modules") }
+    { pm: "bun", root: () => path46.join(os.homedir(), ".bun", "install", "global", "node_modules") }
   ];
   for (const probe of probes) {
-    const root2 = probe.root();
-    if (root2 && await pathExists(path43.join(root2, pkg))) return probe.pm;
+    const root3 = probe.root();
+    if (root3 && await pathExists(path46.join(root3, pkg))) return probe.pm;
   }
   return null;
 }
@@ -10698,15 +10789,15 @@ function getGlobalUpdateCommand(pm, pkg, version) {
   }
 }
 async function detectPackageManager(cwd) {
-  if (await pathExists(path43.join(cwd, "pnpm-lock.yaml"))) return "pnpm";
-  if (await pathExists(path43.join(cwd, "bun.lockb"))) return "bun";
-  if (await pathExists(path43.join(cwd, "yarn.lock"))) return "yarn";
+  if (await pathExists(path46.join(cwd, "pnpm-lock.yaml"))) return "pnpm";
+  if (await pathExists(path46.join(cwd, "bun.lockb"))) return "bun";
+  if (await pathExists(path46.join(cwd, "yarn.lock"))) return "yarn";
   return "npm";
 }
 async function detectWorkspaceRoot(cwd) {
-  if (await pathExists(path43.join(cwd, "pnpm-workspace.yaml"))) return true;
+  if (await pathExists(path46.join(cwd, "pnpm-workspace.yaml"))) return true;
   try {
-    const pkgPath = path43.join(cwd, "package.json");
+    const pkgPath = path46.join(cwd, "package.json");
     const raw = await (await import('fs/promises')).readFile(pkgPath, "utf-8");
     const pkg = JSON.parse(raw);
     return pkg.workspaces != null;
@@ -10733,7 +10824,7 @@ function getInstallCommand(pm, pkg, version, isDev, opts = {}) {
 }
 async function getLocalDependencyState(cwd, pkg = PACKAGE_NAME) {
   try {
-    const pkgPath = path43.join(cwd, "package.json");
+    const pkgPath = path46.join(cwd, "package.json");
     const raw = await (await import('fs/promises')).readFile(pkgPath, "utf-8");
     const parsed = JSON.parse(raw);
     if (parsed.devDependencies?.[pkg]) return "dev";
@@ -10748,18 +10839,18 @@ async function confirmWorkspaceRoot(pm) {
 async function confirm3(question) {
   if (!(process.stdin.isTTY && process.stdout.isTTY)) return false;
   const rl = readline.createInterface({ input: process.stdin, output: process.stdout });
-  return new Promise((resolve21) => {
+  return new Promise((resolve23) => {
     rl.question(chalk7.yellow(question), (ans) => {
       rl.close();
       const t = ans.trim().toLowerCase();
-      resolve21(t === "y" || t === "yes");
+      resolve23(t === "y" || t === "yes");
     });
   });
 }
 var CAPTURED_OUTPUT_LIMIT = 64e3;
 async function runInstall(cmd, cwd) {
   const { spawn: spawn4 } = await import('child_process');
-  return new Promise((resolve21) => {
+  return new Promise((resolve23) => {
     const child = spawn4(cmd, {
       cwd,
       shell: true,
@@ -10778,15 +10869,15 @@ async function runInstall(cmd, cwd) {
     };
     tee(child.stdout, process.stdout);
     tee(child.stderr, process.stderr);
-    child.on("error", (err) => resolve21({ ok: false, output: `${output}
+    child.on("error", (err) => resolve23({ ok: false, output: `${output}
 ${String(err)}` }));
-    child.on("close", (code) => resolve21({ ok: code === 0, output }));
+    child.on("close", (code) => resolve23({ ok: code === 0, output }));
   });
 }
 async function releaseWindowsFileLocks(cwd, keepVersion) {
   reapAndReport(cwd, keepVersion);
   try {
-    const { vgdSocketPath } = await import('./vgd-QR26FAZD.js');
+    const { vgdSocketPath } = await import('./vgd-URUZQORN.js');
     const result = await stopVgd(vgdSocketPath());
     if (result === "stopped") {
       console.log(chalk7.dim("Stopped the vgd daemon so its files can be replaced \u2014 it restarts on the next command."));
@@ -10911,7 +11002,7 @@ var updateCommand = new Command("update").description("Update vibgrate to the la
 );
 async function rewarmVgdAndReport(cwd) {
   try {
-    const { vgdIsRunning, vgdRequest } = await import('./vgd-QR26FAZD.js');
+    const { vgdIsRunning, vgdRequest } = await import('./vgd-URUZQORN.js');
     if (!await vgdIsRunning()) return;
     const loaded = await vgdRequest({ op: "load-graph", root: cwd });
     if (!loaded.ok || !("repositoryId" in loaded)) return;
@@ -11000,13 +11091,13 @@ function collectCandidates(artifact) {
   return out2;
 }
 var defaultFixScanner = async (rootDir) => {
-  const scratch = path43.join(os.tmpdir(), `vg-fix-scan-${process.pid}.json`);
+  const scratch = path46.join(os.tmpdir(), `vg-fix-scan-${process.pid}.json`);
   const scanOpts = { vibgrateVersion: VERSION, format: "json", out: scratch, quiet: true, concurrency: 8 };
   const advanced = await loadAdvancedScanHook();
   return runCoreScan(rootDir, scanOpts, advanced);
 };
 async function loadArtifact(rootDir, inFile, scan = defaultFixScanner) {
-  const artifactPath = path43.isAbsolute(inFile) ? inFile : path43.join(rootDir, inFile);
+  const artifactPath = path46.isAbsolute(inFile) ? inFile : path46.join(rootDir, inFile);
   if (await pathExists(artifactPath)) {
     const staleness = scanStaleness(rootDir, artifactPath);
     if (!staleness.stale) {
@@ -11033,7 +11124,7 @@ async function repositoryIdentity(rootDir, override) {
   }
 }
 var fixCommand = new Command("fix").description("Get ranked, risk-tiered upgrade plans from the hosted planner and optionally apply them (prompts before changing files; --yes applies non-interactively, --dry-run previews, --no-apply only prints). Requires login/DSN.").argument("[path]", "Path to analyse", ".").option("--in <file>", "Scan artifact to read", ".vibgrate/scan_result.json").option("--format <format>", "Output format (text|json|md)", "text").option("--dsn <dsn>", 'DSN token (or use VIBGRATE_DSN env / "vg login")').option("--region <region>", "Override data residency region (us, eu)").option("--repository-name <name>", "Override the repository name recorded for this plan").option("--plan <tier>", "Apply a specific plan non-interactively (safe|balanced|aggressive)").option("--yes", "Apply the recommended plan without prompting").option("--dry-run", "Preview the recommended plan (or --plan <tier>) without applying; never prompts").option("--no-apply", "Only print the plans; never modify the project").option("--fail-on-vulns <severity>", "Exit non-zero if the recommended plan leaves an advisory at/above this severity unresolved (low|moderate|high|critical)").action(async (targetPath, opts) => {
-  const rootDir = path43.resolve(targetPath);
+  const rootDir = path46.resolve(targetPath);
   if (!await pathExists(rootDir)) {
     console.error(chalk7.red(`Path does not exist: ${rootDir}`));
     process.exit(1);
@@ -11194,7 +11285,7 @@ function emit(report, format) {
   }
 }
 function relProjectDir(rootDir, projectPath) {
-  const rel = path43.isAbsolute(projectPath) ? path43.relative(rootDir, projectPath) : projectPath;
+  const rel = path46.isAbsolute(projectPath) ? path46.relative(rootDir, projectPath) : projectPath;
   return rel === "" ? "." : rel;
 }
 async function buildTargetResolver(rootDir, artifact) {
@@ -11235,14 +11326,14 @@ function promptPlanSelection(response) {
   const defaultIdx = plans.findIndex((p) => p.tier === response.recommended);
   const def = defaultIdx >= 0 ? defaultIdx + 1 : 1;
   const rl = readline.createInterface({ input: process.stdin, output: process.stdout });
-  return new Promise((resolve21) => {
+  return new Promise((resolve23) => {
     rl.question(`Plan [1-${plans.length}, default ${def}, q to cancel]: `, (ans) => {
       rl.close();
       const t = ans.trim().toLowerCase();
-      if (t === "q" || t === "quit") return resolve21(null);
+      if (t === "q" || t === "quit") return resolve23(null);
       const n = t === "" ? def : Number.parseInt(t, 10);
-      if (!Number.isInteger(n) || n < 1 || n > plans.length) return resolve21(null);
-      resolve21(plans[n - 1].tier);
+      if (!Number.isInteger(n) || n < 1 || n > plans.length) return resolve23(null);
+      resolve23(plans[n - 1].tier);
     });
   });
 }
@@ -11664,6 +11755,19 @@ function formatArchitectureDiagram(arch) {
   lines.push("");
   lines.push(chalk7.bold("  Archetype: ") + `${arch.archetype}` + chalk7.dim(` (${Math.round(arch.archetypeConfidence * 100)}% confidence)`));
   lines.push(`  Files classified: ${arch.totalClassified}` + (arch.unclassified > 0 ? chalk7.dim(` (${arch.unclassified} unclassified)`) : ""));
+  if (arch.folders && arch.folders.length > 0) {
+    lines.push(`  Folders classified: ${arch.folders.length}`);
+    for (const folder of arch.folders.slice(0, 12)) {
+      lines.push(`    ${folder.path}  ${folder.layer}  ${Math.round(folder.confidence * 100)}%  ${folder.fileCount} file${folder.fileCount !== 1 ? "s" : ""}`);
+    }
+    if (arch.folders.length > 12) {
+      lines.push(chalk7.dim(`    + ${arch.folders.length - 12} more`));
+    }
+  }
+  if (arch.unclassifiedFiles && arch.unclassifiedFiles.length > 0) {
+    const extra = arch.unclassified > arch.unclassifiedFiles.length ? ` of ${arch.unclassified}` : "";
+    lines.push(`  Unclassified source (sample): ${arch.unclassifiedFiles.length}${extra}`);
+  }
   lines.push("");
   if (arch.layers.length > 0) {
     for (const layer of arch.layers) {
@@ -11672,6 +11776,17 @@ function formatArchitectureDiagram(arch) {
     }
     lines.push("");
   }
+  if (arch.violations && arch.violations.length > 0) {
+    const extra = arch.violationsCapped ? "+" : "";
+    lines.push(`  Boundary violations (${arch.violations.length}${extra})`);
+    for (const v of arch.violations.slice(0, 8)) {
+      lines.push(`    ${v.fromFile} \u2192 ${v.toFile}  ${v.rule}`);
+    }
+    if (arch.violations.length > 8) {
+      lines.push(chalk7.dim(`    + ${arch.violations.length - 8} more`));
+    }
+    lines.push("");
+  }
   return lines;
 }
 function generatePriorityActions(artifact) {
@@ -12037,7 +12152,7 @@ function formatMarkdown(artifact) {
 
 // src/reporting/commands/report.ts
 var reportCommand = new Command("report").description("Generate a drift report from a scan artifact").option("--in <file>", "Input artifact file", ".vibgrate/scan_result.json").option("--format <format>", "Output format (md|text|json)", "text").action(async (opts) => {
-  const artifactPath = path43.resolve(opts.in);
+  const artifactPath = path46.resolve(opts.in);
   if (!await pathExists(artifactPath)) {
     console.error(chalk7.red(`Artifact not found: ${artifactPath}`));
     console.error(chalk7.dim('Run "vibgrate scan" first to generate a scan artifact.'));
@@ -12084,10 +12199,10 @@ function openUrl(url) {
 }
 
 // src/reporting/commands/login.ts
-var delay = (ms) => new Promise((resolve21) => setTimeout(resolve21, ms));
+var delay = (ms) => new Promise((resolve23) => setTimeout(resolve23, ms));
 function isInside(dir, file) {
-  const rel = path43.relative(dir, file);
-  return !!rel && !rel.startsWith("..") && !path43.isAbsolute(rel);
+  const rel = path46.relative(dir, file);
+  return !!rel && !rel.startsWith("..") && !path46.isAbsolute(rel);
 }
 var loginCommand = new Command("login").description("Authenticate the CLI with your Vibgrate workspace via the browser").option("--ingest <url>", "Ingest API URL (overrides --region)").option("--region <region>", `Data residency region (${availableRegionIds().join(", ")})`, "us").option("--no-browser", "Do not attempt to open a browser automatically").option(
   "--local",
@@ -12191,9 +12306,9 @@ var loginCommand = new Command("login").description("Authenticate the CLI with y
       }
       console.log(chalk7.dim(`  Credentials saved to ${credsFile}`));
       try {
-        const root2 = findGitRoot();
-        if (root2 && isInside(root2, credsFile)) {
-          const res = ensureGitignored(gitignoreEntryForCredentials(root2, credsFile), root2);
+        const root3 = findGitRoot();
+        if (root3 && isInside(root3, credsFile)) {
+          const res = ensureGitignored(gitignoreEntryForCredentials(root3, credsFile), root3);
           if (res.status === "created") {
             console.log(chalk7.dim(`  Created .gitignore and ignored ${res.entry}`));
           } else if (res.status === "added") {
@@ -12253,6 +12368,789 @@ var logoutCommand = new Command("logout").description("Clear stored Vibgrate log
     );
   }
 });
+
+// src/reporting/commands/locale/client.ts
+function buildUrl(scheme, host, path48, query) {
+  const url = new URL(`${scheme}://${host}/v1/locale${path48}`);
+  for (const [key2, value] of Object.entries(query ?? {})) {
+    if (value !== void 0 && value !== "") url.searchParams.set(key2, String(value));
+  }
+  return url.toString();
+}
+async function toEnvelope(response, url) {
+  let envelope = null;
+  const text = await response.text();
+  try {
+    envelope = text ? JSON.parse(text) : null;
+  } catch {
+    envelope = null;
+  }
+  if (response.ok && envelope) return envelope;
+  const serverMessage = envelope?.errors?.map((e) => e.message).join(" ") ?? "";
+  const requestId = envelope?.meta?.requestId;
+  const suffix = requestId ? ` (request ${requestId})` : "";
+  if (response.status === 401) {
+    throw new CliError(
+      `${serverMessage || "Authentication failed."}${suffix}
+Run "vg login", set VIBGRATE_DSN, or pass --dsn.`,
+      ExitCode.ERROR
+    );
+  }
+  if (response.status === 402) {
+    throw new CliError(`${serverMessage || "This feature requires a paid plan."}${suffix}`, ExitCode.ERROR);
+  }
+  if (response.status === 403) {
+    throw new CliError(`${serverMessage || "Not permitted."}${suffix}`, ExitCode.ERROR);
+  }
+  if (response.status === 404) {
+    throw new CliError(`${serverMessage || "Not found."}${suffix}`, ExitCode.ERROR);
+  }
+  throw new CliError(
+    `Vibgrate Cloud returned ${response.status} for ${new URL(url).pathname}.${suffix}` + (serverMessage ? `
+${serverMessage}` : ""),
+    ExitCode.ERROR
+  );
+}
+function createLocaleClient(dsn) {
+  const parsed = parseDsn$1(dsn);
+  if (!parsed) {
+    throw new CliError(
+      "Invalid DSN format.\nExpected: vibgrate+https://<key_id>:<secret>@<host>/<workspace_id>",
+      ExitCode.ERROR
+    );
+  }
+  const request = async (method, path48, opts = {}) => {
+    const url = buildUrl(parsed.scheme, parsed.host, path48, opts.query);
+    const body = opts.body === void 0 ? void 0 : JSON.stringify(opts.body);
+    const response = await fetch(url, {
+      method,
+      headers: {
+        // Same presentation as the ingest path — see the module header.
+        Authorization: `VibgrateDSN ${parsed.keyId}:${parsed.secret}`,
+        "X-Vibgrate-Timestamp": String(Date.now()),
+        ...body ? { "Content-Type": "application/json" } : {}
+      },
+      body
+    });
+    return toEnvelope(response, url);
+  };
+  return {
+    workspaceId: parsed.workspaceId,
+    get: (path48, query) => request("GET", path48, { query }),
+    post: (path48, body) => request("POST", path48, { body }),
+    patch: (path48, body) => request("PATCH", path48, { body }),
+    del: (path48, body) => request("DELETE", path48, { body })
+  };
+}
+var LOCALE_CONFIG_FILENAMES = ["vibgrate.locale.yaml", ".vibgrate/locale.yaml"];
+function findLocaleConfig(cwd) {
+  for (const name of LOCALE_CONFIG_FILENAMES) {
+    const candidate = path46.join(cwd, name);
+    if (fs14.existsSync(candidate)) return candidate;
+  }
+  return null;
+}
+function parseLocaleConfig(text) {
+  const raw = parse(text);
+  if (!raw || typeof raw !== "object" || Array.isArray(raw)) return {};
+  const obj = raw;
+  const stringArray = (value) => {
+    if (!Array.isArray(value)) return void 0;
+    const items = value.filter((v) => typeof v === "string" && v.trim().length > 0);
+    return items.length ? items : void 0;
+  };
+  const str = (value) => typeof value === "string" && value.trim() ? value.trim() : void 0;
+  return {
+    project: str(obj.project),
+    sourceLanguage: str(obj.sourceLanguage),
+    targetLanguages: stringArray(obj.targetLanguages),
+    format: str(obj.format),
+    path: str(obj.path),
+    namespaces: stringArray(obj.namespaces),
+    version: str(obj.version)
+  };
+}
+function loadLocaleConfig(cwd) {
+  const file = findLocaleConfig(cwd);
+  if (!file) return { config: {}, file: null };
+  try {
+    return { config: parseLocaleConfig(fs14.readFileSync(file, "utf8")), file };
+  } catch (error) {
+    throw new Error(
+      `Could not parse ${path46.relative(cwd, file)}: ${error instanceof Error ? error.message : String(error)}`
+    );
+  }
+}
+function serializeLocaleConfig(config) {
+  const out2 = {};
+  for (const [key2, value] of Object.entries(config)) {
+    if (value === void 0 || value === null) continue;
+    if (Array.isArray(value) && value.length === 0) continue;
+    if (typeof value === "string" && !value.trim()) continue;
+    out2[key2] = value;
+  }
+  return stringify(out2);
+}
+function writeLocaleConfig(cwd, config, filename) {
+  const target = filename ?? path46.join(cwd, LOCALE_CONFIG_FILENAMES[0]);
+  fs14.mkdirSync(path46.dirname(target), { recursive: true });
+  fs14.writeFileSync(target, serializeLocaleConfig(config), "utf8");
+  return target;
+}
+function resolveLocaleSettings(config, flags) {
+  return {
+    project: flags.project ?? config.project,
+    sourceLanguage: flags.sourceLanguage ?? config.sourceLanguage ?? "en-US",
+    targetLanguages: flags.targetLanguages ?? config.targetLanguages ?? [],
+    format: flags.format ?? config.format ?? "nested",
+    path: flags.path ?? config.path ?? "src/locales/{language}/{namespace}.json",
+    namespaces: flags.namespaces ?? config.namespaces ?? ["common"],
+    version: flags.version ?? config.version ?? "latest"
+  };
+}
+var SUPPORTED_FORMATS = ["json", "nested", "flat", "yaml", "yml"];
+var PLANNED_FORMATS = [
+  "po",
+  "xliff",
+  "xliff2",
+  "android",
+  "strings",
+  "resx",
+  "csv",
+  "arb",
+  "properties"
+];
+var LocaleNestConflictError = class extends Error {
+  constructor(leafKey, branchKey) {
+    super(
+      `Cannot write nested output: "${leafKey}" is a value and "${branchKey}" needs it to be a group. Rename one of them, or switch this project to the "flat" format, which stores keys verbatim.`
+    );
+    this.leafKey = leafKey;
+    this.branchKey = branchKey;
+    this.name = "LocaleNestConflictError";
+  }
+  leafKey;
+  branchKey;
+};
+function nest(catalog) {
+  const out2 = {};
+  for (const [key2, value] of Object.entries(catalog)) {
+    const parts = key2.split(".");
+    let cursor = out2;
+    for (let i = 0; i < parts.length - 1; i += 1) {
+      const part = parts[i];
+      const existing2 = cursor[part];
+      if (existing2 === void 0) {
+        cursor[part] = {};
+      } else if (typeof existing2 !== "object" || existing2 === null || Array.isArray(existing2)) {
+        throw new LocaleNestConflictError(parts.slice(0, i + 1).join("."), key2);
+      }
+      cursor = cursor[part];
+    }
+    const leaf = parts[parts.length - 1];
+    const existing = cursor[leaf];
+    if (typeof existing === "object" && existing !== null && !Array.isArray(existing)) {
+      throw new LocaleNestConflictError(key2, `${key2}.\u2026`);
+    }
+    cursor[leaf] = value;
+  }
+  return out2;
+}
+function flatten(input, prefix = "") {
+  const out2 = {};
+  if (input === null || typeof input !== "object" || Array.isArray(input)) {
+    if (prefix) out2[prefix] = input === null || input === void 0 ? "" : String(input);
+    return out2;
+  }
+  for (const [key2, value] of Object.entries(input)) {
+    const next2 = prefix ? `${prefix}.${key2}` : key2;
+    if (value !== null && typeof value === "object" && !Array.isArray(value)) {
+      Object.assign(out2, flatten(value, next2));
+    } else if (Array.isArray(value)) {
+      out2[next2] = JSON.stringify(value);
+    } else {
+      out2[next2] = value === null || value === void 0 ? "" : String(value);
+    }
+  }
+  return out2;
+}
+var nestedJson = {
+  id: "nested",
+  extension: ".json",
+  encode: (catalog) => `${JSON.stringify(nest(sortKeys(catalog)), null, 2)}
+`,
+  decode: (text) => text.trim() ? flatten(JSON.parse(text)) : {}
+};
+var flatJson = {
+  id: "flat",
+  extension: ".json",
+  encode: (catalog) => `${JSON.stringify(sortKeys(catalog), null, 2)}
+`,
+  decode: (text) => {
+    if (!text.trim()) return {};
+    const parsed = JSON.parse(text);
+    const out2 = {};
+    for (const [key2, value] of Object.entries(parsed)) {
+      out2[key2] = value === null || value === void 0 ? "" : String(value);
+    }
+    return out2;
+  }
+};
+var yamlCodec = {
+  id: "yaml",
+  extension: ".yaml",
+  encode: (catalog) => stringify(nest(sortKeys(catalog))),
+  decode: (text) => text.trim() ? flatten(parse(text)) : {}
+};
+function sortKeys(catalog) {
+  return Object.fromEntries(Object.entries(catalog).sort(([a], [b]) => a.localeCompare(b)));
+}
+var CODECS = {
+  json: nestedJson,
+  nested: nestedJson,
+  flat: flatJson,
+  yaml: yamlCodec,
+  yml: { ...yamlCodec, id: "yml", extension: ".yml" }
+};
+function isSupportedFormat(format) {
+  return format in CODECS;
+}
+function isPlannedFormat(format) {
+  return PLANNED_FORMATS.includes(format);
+}
+function codecFor(format) {
+  const codec = CODECS[format];
+  if (codec) return codec;
+  if (isPlannedFormat(format)) {
+    throw new Error(
+      `The "${format}" format is not available in this release yet. Supported now: ${SUPPORTED_FORMATS.join(", ")}.`
+    );
+  }
+  throw new Error(
+    `Unknown format "${format}". Supported: ${SUPPORTED_FORMATS.join(", ")}. Planned: ${PLANNED_FORMATS.join(", ")}.`
+  );
+}
+function validatePathTemplate(template) {
+  if (!template.trim()) return "path template is required.";
+  if (!template.includes("{language}")) {
+    return 'path template must contain {language} (e.g. "src/locales/{language}/{namespace}.json").';
+  }
+  if (path46.isAbsolute(template)) {
+    return "path template must be relative to the project directory.";
+  }
+  if (template.split(/[\\/]/).includes("..")) {
+    return 'path template must not contain "..".';
+  }
+  return null;
+}
+function renderPath(template, language, namespace) {
+  return template.replaceAll("{language}", language).replaceAll("{namespace}", namespace);
+}
+function resolveLocaleFiles(cwd, template, languages, namespaces) {
+  const out2 = [];
+  for (const language of languages) {
+    for (const namespace of namespaces) {
+      const relative13 = renderPath(template, language, namespace);
+      const file = path46.resolve(cwd, relative13);
+      out2.push({ language, namespace, file, relative: relative13, exists: fs14.existsSync(file) });
+    }
+  }
+  return out2;
+}
+function readCatalog(file, format) {
+  if (!fs14.existsSync(file)) return {};
+  const text = fs14.readFileSync(file, "utf8");
+  try {
+    return codecFor(format).decode(text);
+  } catch (error) {
+    throw new Error(
+      `Could not parse ${file}: ${error instanceof Error ? error.message : String(error)}`
+    );
+  }
+}
+function writeCatalog(file, format, catalog, opts = {}) {
+  const encoded = codecFor(format).encode(sortKeys(catalog));
+  const existing = fs14.existsSync(file) ? fs14.readFileSync(file, "utf8") : null;
+  const changed = existing !== encoded;
+  if (changed && !opts.dryRun) {
+    fs14.mkdirSync(path46.dirname(file), { recursive: true });
+    fs14.writeFileSync(file, encoded, "utf8");
+  }
+  return { file, changed, bytes: Buffer.byteLength(encoded, "utf8") };
+}
+function diffCatalogs(before, after) {
+  const diff2 = { added: [], changed: [], removed: [], unchanged: [] };
+  for (const [key2, value] of Object.entries(after)) {
+    if (!(key2 in before)) diff2.added.push(key2);
+    else if (before[key2] !== value) diff2.changed.push(key2);
+    else diff2.unchanged.push(key2);
+  }
+  for (const key2 of Object.keys(before)) {
+    if (!(key2 in after)) diff2.removed.push(key2);
+  }
+  return diff2;
+}
+
+// src/reporting/commands/locale/index.ts
+var cwdOption = ["-C, --cwd <dir>", "Run against this directory (default: current)"];
+function root(opts) {
+  return path46.resolve(opts.cwd ?? process.cwd());
+}
+function withCommonOptions(cmd) {
+  return cmd.option(...cwdOption).option("--dsn <dsn>", 'DSN token (or use VIBGRATE_DSN, or run "vg login")').option("--project <slug>", "Locale project slug or id").option("--format <format>", `Locale file format (${SUPPORTED_FORMATS.join(", ")})`).option("--path <template>", "Path template, e.g. src/locales/{language}/{namespace}.json").option("--namespace <name>", "Restrict to one namespace").option("--language <code>", "Restrict to one BCP-47 language").option("--ver <version>", "Target version (default: latest)").option("--json", "Machine-readable output").option("-q, --quiet", "Suppress non-essential output");
+}
+function settingsFor(opts) {
+  const dir = root(opts);
+  const { config } = loadLocaleConfig(dir);
+  const merged = resolveLocaleSettings(config, {
+    project: opts.project,
+    format: opts.format,
+    path: opts.path,
+    version: opts.ver,
+    namespaces: opts.namespace ? [opts.namespace] : void 0,
+    targetLanguages: opts.language ? [opts.language] : void 0
+  });
+  if (!merged.project) {
+    throw new CliError(
+      'No locale project configured.\nRun "vg locale config --project <slug>", or pass --project <slug>.',
+      ExitCode.ERROR
+    );
+  }
+  if (!isSupportedFormat(merged.format)) {
+    codecFor(merged.format);
+  }
+  const pathError = validatePathTemplate(merged.path);
+  if (pathError) throw new CliError(pathError, ExitCode.ERROR);
+  return {
+    dir,
+    settings: merged
+  };
+}
+function clientFor(opts) {
+  const dsn = resolveDsn(opts.dsn);
+  if (!dsn) {
+    throw new CliError(
+      'No DSN available.\nRun "vg login", set VIBGRATE_DSN, or pass --dsn.',
+      ExitCode.ERROR
+    );
+  }
+  return createLocaleClient(dsn);
+}
+function emit2(opts, payload, human) {
+  if (opts.json) {
+    console.log(JSON.stringify(payload, null, 2));
+    return;
+  }
+  if (!opts.quiet) human();
+}
+var configCmd = withCommonOptions(
+  new Command("config").description("Create or update vibgrate.locale.yaml (no credentials are stored)")
+).option("--source-language <code>", "Source language (default: en-US)").option("--target-languages <codes>", "Comma-separated target languages").option("--namespaces <names>", "Comma-separated namespaces").action(
+  async (opts) => {
+    const dir = root(opts);
+    const { config, file } = loadLocaleConfig(dir);
+    const csv2 = (v) => v ? v.split(",").map((s) => s.trim()).filter(Boolean) : void 0;
+    const next2 = {
+      project: opts.project ?? config.project,
+      sourceLanguage: opts.sourceLanguage ?? config.sourceLanguage ?? "en-US",
+      targetLanguages: csv2(opts.targetLanguages) ?? config.targetLanguages,
+      format: opts.format ?? config.format ?? "nested",
+      path: opts.path ?? config.path ?? "src/locales/{language}/{namespace}.json",
+      namespaces: csv2(opts.namespaces) ?? config.namespaces ?? ["common"],
+      version: opts.ver ?? config.version ?? "latest"
+    };
+    const pathError = validatePathTemplate(next2.path);
+    if (pathError) throw new CliError(pathError, ExitCode.ERROR);
+    if (!isSupportedFormat(next2.format)) codecFor(next2.format);
+    const written = writeLocaleConfig(dir, next2, file ?? void 0);
+    emit2(opts, { file: written, config: next2 }, () => {
+      console.log(chalk7.green(`Wrote ${path46.relative(dir, written) || path46.basename(written)}`));
+      console.log(
+        chalk7.dim('Credentials are not stored here \u2014 run "vg login" or set VIBGRATE_DSN.')
+      );
+    });
+  }
+);
+var statusCmd = withCommonOptions(
+  new Command("status").description("Show translation coverage and health for the locale project")
+).action(async (opts) => {
+  const { settings } = settingsFor(opts);
+  const client = clientFor(opts);
+  const res = await client.get(
+    `/projects/${encodeURIComponent(settings.project)}/status`
+  );
+  const data = res.data;
+  if (!data) throw new CliError("Vibgrate Cloud returned no status data.", ExitCode.ERROR);
+  emit2(opts, data, () => {
+    console.log(chalk7.bold(`${data.project.name} (${data.project.slug})`));
+    console.log(chalk7.dim(`Source: ${data.project.sourceLanguage} \xB7 ${data.coverage.totalKeys} keys`));
+    console.log("");
+    for (const lang of data.coverage.languages) {
+      const pct = lang.coveragePercent === null ? "\u2014" : `${lang.coveragePercent}%`;
+      const parts = [`${lang.translated} translated`];
+      if (lang.machine) parts.push(chalk7.yellow(`${lang.machine} machine`));
+      if (lang.needsReview) parts.push(chalk7.yellow(`${lang.needsReview} to review`));
+      if (lang.missing) parts.push(chalk7.dim(`${lang.missing} missing`));
+      console.log(`  ${lang.language.padEnd(10)} ${pct.padStart(6)}  ${parts.join(" \xB7 ")}`);
+    }
+    if (data.namespaces.length) {
+      console.log("");
+      console.log(chalk7.dim(`Namespaces: ${data.namespaces.map((n) => `${n.name} (${n.keys})`).join(", ")}`));
+    }
+    console.log(
+      chalk7.dim(
+        data.lastTranslationAt ? `Last translation: ${data.lastTranslationAt}` : "No translations recorded yet."
+      )
+    );
+  });
+});
+function collectLocalKeys(dir, settings, languages) {
+  const namespaces = settings.namespaces ?? ["common"];
+  const sourceLanguage = settings.sourceLanguage ?? "en-US";
+  const format = settings.format;
+  const template = settings.path;
+  const byKey = /* @__PURE__ */ new Map();
+  const filesRead = [];
+  const allLanguages = [sourceLanguage, ...languages.filter((l) => l !== sourceLanguage)];
+  for (const file of resolveLocaleFiles(dir, template, allLanguages, namespaces)) {
+    if (!file.exists) continue;
+    filesRead.push(file.relative);
+    const catalog = readCatalog(file.file, format);
+    for (const [key2, value] of Object.entries(catalog)) {
+      const id = `${file.namespace}\0${key2}`;
+      const entry = byKey.get(id) ?? {
+        namespace: file.namespace,
+        key: key2,
+        sourceValue: null,
+        translations: []
+      };
+      if (file.language === sourceLanguage) entry.sourceValue = value;
+      else entry.translations.push({ language: file.language, value });
+      byKey.set(id, entry);
+    }
+  }
+  return { keys: [...byKey.values()], filesRead };
+}
+var PUSH_BATCH_SIZE = 400;
+function makePushCommand(name, description) {
+  return withCommonOptions(new Command(name).description(description)).option("--dry-run", "Report what would be pushed without sending anything").option(
+    "--source-only",
+    "Push only source-language keys, leaving existing translations untouched"
+  ).action(async (opts) => {
+    const { dir, settings } = settingsFor(opts);
+    const languages = opts.sourceOnly ? [] : settings.targetLanguages ?? [];
+    const { keys, filesRead } = collectLocalKeys(dir, settings, languages);
+    if (!keys.length) {
+      throw new CliError(
+        `No locale files found for template "${settings.path}".
+Check the template with "vg locale config --path <template>", or create the source files first.`,
+        ExitCode.ERROR
+      );
+    }
+    if (opts.dryRun) {
+      const summary = {
+        dryRun: true,
+        filesRead,
+        keys: keys.length,
+        translations: keys.reduce((n, k) => n + k.translations.length, 0),
+        version: settings.version
+      };
+      emit2(opts, summary, () => {
+        console.log(chalk7.bold("Dry run \u2014 nothing was sent."));
+        console.log(`  ${summary.keys} keys from ${filesRead.length} file(s)`);
+        console.log(`  ${summary.translations} translations`);
+        console.log(chalk7.dim(`  version: ${summary.version}`));
+      });
+      return;
+    }
+    const client = clientFor(opts);
+    let created = 0;
+    let updated = 0;
+    let translationsWritten = 0;
+    for (let i = 0; i < keys.length; i += PUSH_BATCH_SIZE) {
+      const batch = keys.slice(i, i + PUSH_BATCH_SIZE);
+      const res = await client.post(
+        `/projects/${encodeURIComponent(settings.project)}/keys`,
+        {
+          version: settings.version,
+          keys: batch.map((k) => ({
+            namespace: k.namespace,
+            key: k.key,
+            sourceValue: k.sourceValue,
+            translations: k.translations.map((t) => ({
+              language: t.language,
+              value: t.value,
+              origin: "import"
+            }))
+          }))
+        }
+      );
+      created += res.data?.created ?? 0;
+      updated += res.data?.updated ?? 0;
+      translationsWritten += res.data?.translationsWritten ?? 0;
+    }
+    emit2(opts, { created, updated, translationsWritten, version: settings.version }, () => {
+      console.log(
+        chalk7.green(
+          `Pushed ${keys.length} keys \u2014 ${created} created, ${updated} updated, ${translationsWritten} translations.`
+        )
+      );
+    });
+  });
+}
+var PULL_PAGE_SIZE = 200;
+async function fetchAllKeys(client, project, language, namespace) {
+  const out2 = [];
+  let offset = 0;
+  for (; ; ) {
+    const res = await client.get(`/projects/${encodeURIComponent(project)}/keys`, {
+      language,
+      namespace,
+      limit: PULL_PAGE_SIZE,
+      offset
+    });
+    const page = res.data?.keys ?? [];
+    out2.push(...page);
+    const total = res.meta?.pagination?.total ?? out2.length;
+    offset += page.length;
+    if (!page.length || out2.length >= total) break;
+  }
+  return out2;
+}
+function makePullCommand(name, description) {
+  return withCommonOptions(new Command(name).description(description)).option("--dry-run", "Report what would change without writing any file").option(
+    "--include-machine",
+    "Also write machine and needs-review translations (default: accepted translations only)"
+  ).action(async (opts) => {
+    const { dir, settings } = settingsFor(opts);
+    const client = clientFor(opts);
+    const languages = opts.language ? [opts.language] : settings.targetLanguages ?? [];
+    if (!languages.length) {
+      throw new CliError(
+        'No target languages configured.\nRun "vg locale config --target-languages fr-FR,de-DE", or pass --language <code>.',
+        ExitCode.ERROR
+      );
+    }
+    const namespaces = settings.namespaces ?? ["common"];
+    const results = [];
+    for (const language of languages) {
+      for (const namespace of namespaces) {
+        const keys = await fetchAllKeys(client, settings.project, language, namespace);
+        const catalog = {};
+        for (const entry of keys) {
+          const t = entry.translation;
+          if (!t || t.value === null) continue;
+          const accepted = t.status === "translated";
+          if (!accepted && !opts.includeMachine) continue;
+          catalog[entry.key] = t.value;
+        }
+        const target = resolveLocaleFiles(dir, settings.path, [language], [namespace])[0];
+        const before = readCatalog(target.file, settings.format);
+        const diff2 = diffCatalogs(before, catalog);
+        const write = writeCatalog(target.file, settings.format, catalog, {
+          dryRun: opts.dryRun
+        });
+        results.push({
+          file: target.relative,
+          changed: write.changed,
+          added: diff2.added.length,
+          updated: diff2.changed.length
+        });
+      }
+    }
+    const changed = results.filter((r) => r.changed);
+    emit2(opts, { dryRun: Boolean(opts.dryRun), files: results }, () => {
+      if (opts.dryRun) console.log(chalk7.bold("Dry run \u2014 no files were written."));
+      for (const r of changed) {
+        console.log(`  ${chalk7.green(r.changed ? "update" : "ok")} ${r.file} (+${r.added} ~${r.updated})`);
+      }
+      const unchanged = results.length - changed.length;
+      console.log(
+        chalk7.dim(
+          `${changed.length} file(s) ${opts.dryRun ? "would change" : "written"}, ${unchanged} unchanged.`
+        )
+      );
+    });
+  });
+}
+var saveMissingCmd = withCommonOptions(
+  new Command("save-missing").description(
+    "Push only keys that do not exist in Vibgrate Cloud yet (never overwrites a translation)"
+  )
+).option("--dry-run", "Report what would be sent without sending anything").action(async (opts) => {
+  const { dir, settings } = settingsFor(opts);
+  const client = clientFor(opts);
+  const sourceLanguage = settings.sourceLanguage ?? "en-US";
+  const { keys } = collectLocalKeys(dir, settings, []);
+  const namespaces = settings.namespaces ?? ["common"];
+  const existing = /* @__PURE__ */ new Set();
+  for (const namespace of namespaces) {
+    const remote = await fetchAllKeys(client, settings.project, sourceLanguage, namespace);
+    for (const entry of remote) existing.add(`${entry.namespace}\0${entry.key}`);
+  }
+  const missing = keys.filter((k) => !existing.has(`${k.namespace}\0${k.key}`));
+  if (!missing.length) {
+    emit2(opts, { missing: 0 }, () => console.log(chalk7.dim("No missing keys \u2014 nothing to send.")));
+    return;
+  }
+  if (opts.dryRun) {
+    emit2(opts, { dryRun: true, missing: missing.length, keys: missing.map((k) => `${k.namespace}:${k.key}`) }, () => {
+      console.log(chalk7.bold(`Dry run \u2014 ${missing.length} missing key(s) would be created.`));
+      for (const k of missing.slice(0, 20)) console.log(`  ${chalk7.green("+")} ${k.namespace}:${k.key}`);
+      if (missing.length > 20) console.log(chalk7.dim(`  \u2026and ${missing.length - 20} more`));
+    });
+    return;
+  }
+  let created = 0;
+  for (let i = 0; i < missing.length; i += PUSH_BATCH_SIZE) {
+    const res = await client.post(
+      `/projects/${encodeURIComponent(settings.project)}/keys`,
+      {
+        version: settings.version,
+        keys: missing.slice(i, i + PUSH_BATCH_SIZE).map((k) => ({
+          namespace: k.namespace,
+          key: k.key,
+          sourceValue: k.sourceValue
+        }))
+      }
+    );
+    created += res.data?.created ?? 0;
+  }
+  emit2(opts, { created }, () => console.log(chalk7.green(`Created ${created} missing key(s).`)));
+});
+var addCmd2 = withCommonOptions(
+  new Command("add").description("Add or update a single key").argument("<key>", "Key name").argument(
+    "[value]",
+    "Source value"
+  )
+).action(async (key2, value, opts) => {
+  const { settings } = settingsFor(opts);
+  const client = clientFor(opts);
+  const namespace = opts.namespace ?? settings.namespaces?.[0] ?? "common";
+  const res = await client.post(
+    `/projects/${encodeURIComponent(settings.project)}/keys`,
+    {
+      version: settings.version,
+      keys: [
+        {
+          namespace,
+          key: key2,
+          sourceValue: value ?? null,
+          translations: opts.language && value !== void 0 ? [{ language: opts.language, value, origin: "manual" }] : []
+        }
+      ]
+    }
+  );
+  emit2(
+    opts,
+    res.data,
+    () => console.log(chalk7.green(`${res.data?.created ? "Created" : "Updated"} ${namespace}:${key2}`))
+  );
+});
+var removeCmd = withCommonOptions(
+  new Command("remove").description("Remove one or more keys").argument("<keys...>", "Key names")
+).action(async (keys, opts) => {
+  const { settings } = settingsFor(opts);
+  const client = clientFor(opts);
+  const namespace = opts.namespace ?? settings.namespaces?.[0] ?? "common";
+  const res = await client.del(
+    `/projects/${encodeURIComponent(settings.project)}/keys`,
+    { namespace, keys }
+  );
+  emit2(
+    opts,
+    res.data,
+    () => console.log(
+      chalk7.green(
+        `Removed ${res.data?.removed ?? 0} key(s) and ${res.data?.translationsRemoved ?? 0} translation(s).`
+      )
+    )
+  );
+});
+var getCmd = withCommonOptions(
+  new Command("get").description("Show one key and its translations").argument("<key>", "Key name")
+).action(async (key2, opts) => {
+  const { settings } = settingsFor(opts);
+  const client = clientFor(opts);
+  const namespace = opts.namespace ?? settings.namespaces?.[0] ?? "common";
+  const res = await client.get(
+    `/projects/${encodeURIComponent(settings.project)}/keys`,
+    { namespace, q: key2, language: opts.language, limit: 50 }
+  );
+  const match = (res.data?.keys ?? []).find((k) => k.key === key2);
+  if (!match) {
+    throw new CliError(`Key "${key2}" not found in namespace "${namespace}".`, ExitCode.ERROR);
+  }
+  emit2(opts, match, () => {
+    console.log(chalk7.bold(`${match.namespace}:${match.key}`));
+    if (match.sourceValue !== null) console.log(`  source: ${match.sourceValue}`);
+    if (match.translation) {
+      const value = match.translation.value ?? chalk7.dim("(not translated)");
+      console.log(`  ${opts.language}: ${value} ${chalk7.dim(`[${match.translation.status}]`)}`);
+    }
+  });
+});
+var formatCmd = withCommonOptions(
+  new Command("format").description(
+    "Re-format local locale files in place (local-only \u2014 no network, works on any plan)"
+  )
+).option("--dry-run", "Report which files would change without writing").action(async (opts) => {
+  const dir = root(opts);
+  const { config } = loadLocaleConfig(dir);
+  const settings = resolveLocaleSettings(config, {
+    format: opts.format,
+    path: opts.path,
+    namespaces: opts.namespace ? [opts.namespace] : void 0,
+    targetLanguages: opts.language ? [opts.language] : void 0
+  });
+  const pathError = validatePathTemplate(settings.path);
+  if (pathError) throw new CliError(pathError, ExitCode.ERROR);
+  const languages = [
+    settings.sourceLanguage ?? "en-US",
+    ...settings.targetLanguages ?? []
+  ];
+  const files = resolveLocaleFiles(dir, settings.path, languages, settings.namespaces ?? ["common"]);
+  const changed = [];
+  for (const file of files) {
+    if (!file.exists) continue;
+    const catalog = readCatalog(file.file, settings.format);
+    const result = writeCatalog(file.file, settings.format, catalog, { dryRun: opts.dryRun });
+    if (result.changed) changed.push(file.relative);
+  }
+  emit2(opts, { dryRun: Boolean(opts.dryRun), changed }, () => {
+    for (const f of changed) console.log(`  ${chalk7.green("format")} ${f}`);
+    console.log(
+      chalk7.dim(`${changed.length} file(s) ${opts.dryRun ? "would be reformatted" : "reformatted"}.`)
+    );
+  });
+});
+function buildLocaleCommand(name) {
+  const cmd = new Command(name).description(
+    "Manage application translations \u2014 locale projects, keys, and translations in Vibgrate Cloud"
+  );
+  cmd.addCommand(configCmd);
+  cmd.addCommand(makePushCommand("push", "Upload local locale files to Vibgrate Cloud"));
+  cmd.addCommand(makePushCommand("sync", "Alias for push"));
+  cmd.addCommand(makePullCommand("pull", "Write translations from Vibgrate Cloud into local files"));
+  cmd.addCommand(makePullCommand("download", "Alias for pull"));
+  cmd.addCommand(saveMissingCmd);
+  cmd.addCommand(addCmd2);
+  cmd.addCommand(removeCmd);
+  cmd.addCommand(getCmd);
+  cmd.addCommand(statusCmd);
+  cmd.addCommand(formatCmd);
+  cmd.addHelpText(
+    "after",
+    "\nLocal-only commands (no network, any plan): config, format\nCloud commands (Team plan or above): push, pull, save-missing, add, remove, get, status\n"
+  );
+  return cmd;
+}
+function registerLocale(program) {
+  program.addCommand(buildLocaleCommand("locale"));
+  const alias = buildLocaleCommand("localize");
+  alias.description('Alias for "vg locale"');
+  program.addCommand(alias, { hidden: true });
+}
 var OPENVEX_CONTEXT = "https://openvex.dev/ns/v0.2.0";
 var VEX_STATUSES = ["not_affected", "affected", "fixed", "under_investigation"];
 var VEX_JUSTIFICATIONS = [
@@ -12342,7 +13240,7 @@ var vexCommand = new Command("vex").description("Generate an OpenVEX document (e
   try {
     const statements = [];
     if (opts.from) {
-      const fromPath = path43.resolve(opts.from);
+      const fromPath = path46.resolve(opts.from);
       if (!await pathExists(fromPath)) {
         process.stderr.write(chalk7.red(`Statements file not found: ${fromPath}
 `));
@@ -12360,9 +13258,9 @@ var vexCommand = new Command("vex").description("Generate an OpenVEX document (e
     });
     const json2 = JSON.stringify(doc, null, 2);
     if (opts.out) {
-      await writeTextFile(path43.resolve(opts.out), json2 + "\n");
+      await writeTextFile(path46.resolve(opts.out), json2 + "\n");
       process.stderr.write(
-        chalk7.green("\u2714") + ` Wrote OpenVEX document (${doc.statements.length} statement(s)) to ${path43.resolve(opts.out)}
+        chalk7.green("\u2714") + ` Wrote OpenVEX document (${doc.statements.length} statement(s)) to ${path46.resolve(opts.out)}
 `
       );
     } else {
@@ -12545,7 +13443,7 @@ function formatDeltaText(base, current) {
   return lines.join("\n");
 }
 async function readArtifactOrExit(filePath) {
-  const absolutePath = path43.resolve(filePath);
+  const absolutePath = path46.resolve(filePath);
   if (!await pathExists(absolutePath)) {
     console.error(chalk7.red(`Artifact not found: ${absolutePath}`));
     process.exit(1);
@@ -12562,7 +13460,7 @@ var exportCommand = new Command("export").description("Export scan artifact as S
   const sbom = format === "cyclonedx" ? toCycloneDx(artifact) : toSpdx(artifact);
   const body = JSON.stringify(sbom, null, 2);
   if (opts.out) {
-    await writeTextFile(path43.resolve(opts.out), body);
+    await writeTextFile(path46.resolve(opts.out), body);
     console.log(chalk7.green("\u2714") + ` SBOM written to ${opts.out}`);
   } else {
     console.log(body);
@@ -12573,7 +13471,7 @@ var deltaCommand = new Command("delta").description("Show SBOM delta between two
   const current = await readArtifactOrExit(opts.to);
   const report = formatDeltaText(base, current);
   if (opts.out) {
-    await writeTextFile(path43.resolve(opts.out), report);
+    await writeTextFile(path46.resolve(opts.out), report);
     console.log(chalk7.green("\u2714") + ` SBOM delta report written to ${opts.out}`);
   } else {
     console.log(report);
@@ -12703,66 +13601,66 @@ function resolveRegime(id) {
   }
   return regime;
 }
-function evidenceDir(root2) {
-  return path43.join(root2, ".vibgrate", "evidence");
+function evidenceDir(root3) {
+  return path46.join(root3, ".vibgrate", "evidence");
 }
-function orgPath(root2) {
-  return path43.join(evidenceDir(root2), "org.json");
+function orgPath(root3) {
+  return path46.join(evidenceDir(root3), "org.json");
 }
-function productsPath(root2) {
-  return path43.join(evidenceDir(root2), "products.json");
+function productsPath(root3) {
+  return path46.join(evidenceDir(root3), "products.json");
 }
-function releasesDir(root2) {
-  return path43.join(evidenceDir(root2), "releases");
+function releasesDir(root3) {
+  return path46.join(evidenceDir(root3), "releases");
 }
-function releasePath(root2, productId, version) {
+function releasePath(root3, productId, version) {
   const safe = `${productId}@${version}`.replace(/[^A-Za-z0-9._@-]/g, "_");
-  return path43.join(releasesDir(root2), `${safe}.json`);
+  return path46.join(releasesDir(root3), `${safe}.json`);
 }
 var DEFAULT_ORG = {
   responsiblePersons: [],
   defaultRegime: DEFAULT_REGIME
 };
-async function loadOrg(root2) {
-  const p = orgPath(root2);
+async function loadOrg(root3) {
+  const p = orgPath(root3);
   if (!await pathExists(p)) return { ...DEFAULT_ORG };
   const org = await readJsonFile(p);
   return { ...DEFAULT_ORG, ...org, responsiblePersons: org.responsiblePersons ?? [] };
 }
-async function saveOrg(root2, org) {
-  await writeJsonFile(orgPath(root2), org);
+async function saveOrg(root3, org) {
+  await writeJsonFile(orgPath(root3), org);
 }
-async function loadProducts(root2) {
-  const p = productsPath(root2);
+async function loadProducts(root3) {
+  const p = productsPath(root3);
   if (!await pathExists(p)) return [];
   return readJsonFile(p);
 }
-async function saveProducts(root2, products) {
-  await writeJsonFile(productsPath(root2), products);
+async function saveProducts(root3, products) {
+  await writeJsonFile(productsPath(root3), products);
 }
-async function getProduct(root2, id) {
-  const products = await loadProducts(root2);
+async function getProduct(root3, id) {
+  const products = await loadProducts(root3);
   return products.find((p) => p.id === id || p.name === id);
 }
-async function freezeRelease(root2, release) {
-  const p = releasePath(root2, release.productId, release.version);
+async function freezeRelease(root3, release) {
+  const p = releasePath(root3, release.productId, release.version);
   if (await pathExists(p)) {
     throw new CliError(
-      `release ${release.productId}@${release.version} is already frozen and manifests are immutable \u2014 delete ${path43.relative(root2, p)} only if it was frozen in error`,
+      `release ${release.productId}@${release.version} is already frozen and manifests are immutable \u2014 delete ${path46.relative(root3, p)} only if it was frozen in error`,
       ExitCode.USAGE_ERROR
     );
   }
   await writeJsonFile(p, release);
   return p;
 }
-async function loadReleases(root2, productId) {
-  const dir = releasesDir(root2);
+async function loadReleases(root3, productId) {
+  const dir = releasesDir(root3);
   if (!await pathExists(dir)) return [];
   const { readdir } = await import('fs/promises');
   const files = (await readdir(dir)).filter((f) => f.endsWith(".json")).sort();
   const releases = [];
   for (const f of files) {
-    const rel = await readJsonFile(path43.join(dir, f));
+    const rel = await readJsonFile(path46.join(dir, f));
     if (!productId || rel.productId === productId) releases.push(rel);
   }
   return releases;
@@ -13455,14 +14353,14 @@ function verifyEvidenceEnvelope(env, opts = {}) {
   };
 }
 var DEFAULT_KEY = "attest-key.pem";
-function resolveSigningKey(root2, explicit) {
+function resolveSigningKey(root3, explicit) {
   const chosen = process.env.VG_ATTEST_KEY;
-  const keyPath = chosen ? path43.resolve(chosen) : path43.join(root2, ".vibgrate", DEFAULT_KEY);
+  const keyPath = chosen ? path46.resolve(chosen) : path46.join(root3, ".vibgrate", DEFAULT_KEY);
   let minted = false;
   if (!fs14.existsSync(keyPath)) {
     if (chosen) throw new CliError(`signing key not found: ${chosen}`, ExitCode.USAGE_ERROR);
     const kp = generateKeypair();
-    fs14.mkdirSync(path43.dirname(keyPath), { recursive: true });
+    fs14.mkdirSync(path46.dirname(keyPath), { recursive: true });
     fs14.writeFileSync(keyPath, kp.privatePem, { mode: 384 });
     fs14.writeFileSync(`${keyPath}.pub`, kp.publicPem);
     minted = true;
@@ -13480,16 +14378,16 @@ function resolveSigningKey(root2, explicit) {
 }
 function writeBundle(input) {
   const dir = input.outDir;
-  fs14.mkdirSync(path43.join(dir, "inputs", "releases"), { recursive: true });
-  const write = (rel, data) => fs14.writeFileSync(path43.join(dir, rel), `${JSON.stringify(data, null, 2)}
+  fs14.mkdirSync(path46.join(dir, "inputs", "releases"), { recursive: true });
+  const write = (rel, data) => fs14.writeFileSync(path46.join(dir, rel), `${JSON.stringify(data, null, 2)}
 `);
   write("result.json", input.result);
-  write(path43.join("inputs", "advisory.json"), input.advisory);
+  write(path46.join("inputs", "advisory.json"), input.advisory);
   for (const rel of input.releases) {
     const safe = `${rel.productId}@${rel.version}`.replace(/[^A-Za-z0-9._@-]/g, "_");
-    write(path43.join("inputs", "releases", `${safe}.json`), rel);
+    write(path46.join("inputs", "releases", `${safe}.json`), rel);
   }
-  write(path43.join("inputs", "datapack.lock"), { dataPackVersion: input.result.meta.dataPackVersion, kernelVersion: input.result.meta.kernelVersion });
+  write(path46.join("inputs", "datapack.lock"), { dataPackVersion: input.result.meta.dataPackVersion, kernelVersion: input.result.meta.kernelVersion });
   write("provenance.json", {
     method: "deterministic",
     modelDrafted: [],
@@ -13505,13 +14403,13 @@ function writeBundle(input) {
     disclaimer: input.regime.disclaimer
   });
   if (input.envelope) {
-    fs14.writeFileSync(path43.join(dir, "evidence.intoto.jsonl"), `${JSON.stringify(input.envelope)}
+    fs14.writeFileSync(path46.join(dir, "evidence.intoto.jsonl"), `${JSON.stringify(input.envelope)}
 `);
   }
   if (input.timestampToken) {
-    fs14.writeFileSync(path43.join(dir, "timestamp.tsr"), input.timestampToken);
+    fs14.writeFileSync(path46.join(dir, "timestamp.tsr"), input.timestampToken);
   }
-  fs14.writeFileSync(path43.join(dir, "VERIFY.md"), verifyDoc(input));
+  fs14.writeFileSync(path46.join(dir, "VERIFY.md"), verifyDoc(input));
   return dir;
 }
 function verifyDoc(input) {
@@ -13571,14 +14469,14 @@ function undeterminedFields(result, regime) {
   if (result.products.some((p) => p.status === "affected" && p.memberStates.length === 0)) gaps.push("member_states");
   return gaps.filter((g) => regime.submission.requires.some((r) => g.startsWith(r)) || g.startsWith("exposure") || g.startsWith("member"));
 }
-async function recordDrill(root2, record) {
-  const dir = path43.join(evidenceDir(root2), "drills");
-  const p = path43.join(dir, `${record.drillId}.json`);
+async function recordDrill(root3, record) {
+  const dir = path46.join(evidenceDir(root3), "drills");
+  const p = path46.join(dir, `${record.drillId}.json`);
   await writeJsonFile(p, record);
   return p;
 }
-async function hasRecentDrill(root2, asOf) {
-  const dir = path43.join(evidenceDir(root2), "drills");
+async function hasRecentDrill(root3, asOf) {
+  const dir = path46.join(evidenceDir(root3), "drills");
   if (!await pathExists(dir)) return void 0;
   const { readdir } = await import('fs/promises');
   const { readJsonFile: readJsonFile2 } = await import('./fs-4G5A65KS.js');
@@ -13586,7 +14484,7 @@ async function hasRecentDrill(root2, asOf) {
   if (files.length === 0) return void 0;
   const cutoff = new Date(new Date(asOf).getTime() - 90 * 24 * 3600 * 1e3).toISOString();
   for (const f of files) {
-    const rec = await readJsonFile2(path43.join(dir, f));
+    const rec = await readJsonFile2(path46.join(dir, f));
     if (rec.ranAt >= cutoff) return true;
   }
   return false;
@@ -13665,8 +14563,8 @@ function formatRegimeList() {
 }
 
 // src/reporting/commands/evidence/index.ts
-function root(opts) {
-  return path43.resolve(opts.cwd ?? process.cwd());
+function root2(opts) {
+  return path46.resolve(opts.cwd ?? process.cwd());
 }
 function slug(name) {
   return name.trim().toLowerCase().replace(/[^a-z0-9]+/g, "-").replace(/^-+|-+$/g, "") || "product";
@@ -13680,14 +14578,14 @@ function nowIso() {
 function csv(v) {
   return v ? v.split(",").map((s) => s.trim()).filter(Boolean) : [];
 }
-var cwdOption = ["-C, --cwd <dir>", "Run against this directory (default: current)"];
+var cwdOption2 = ["-C, --cwd <dir>", "Run against this directory (default: current)"];
 async function releasesByProductMap(rootDir, products) {
   const map = /* @__PURE__ */ new Map();
   for (const p of products) map.set(p.id, await loadReleases(rootDir, p.id));
   return map;
 }
-var initCmd = new Command("init").description("Set org, coordinator, and the person with filing authority (per regime)").option(...cwdOption).option("--regime <id>", "Default regime for this repo", DEFAULT_REGIME).option("--legal-entity <name>", "Legal entity name").option("--establishment <cc>", "Main establishment (country code)").option("--eu-rep <name>", "EU authorised representative").option("--coordinator <csirt>", "Coordinator CSIRT / competent authority").option("--responsible <name>", "Add a responsible person").option("--role <role>", "Role of the responsible person").option("--filing-authority", "The responsible person has filing authority").option("--ooo <contact>", "Out-of-hours contact for the responsible person").action(async (opts) => {
-  const rootDir = root(opts);
+var initCmd = new Command("init").description("Set org, coordinator, and the person with filing authority (per regime)").option(...cwdOption2).option("--regime <id>", "Default regime for this repo", DEFAULT_REGIME).option("--legal-entity <name>", "Legal entity name").option("--establishment <cc>", "Main establishment (country code)").option("--eu-rep <name>", "EU authorised representative").option("--coordinator <csirt>", "Coordinator CSIRT / competent authority").option("--responsible <name>", "Add a responsible person").option("--role <role>", "Role of the responsible person").option("--filing-authority", "The responsible person has filing authority").option("--ooo <contact>", "Out-of-hours contact for the responsible person").action(async (opts) => {
+  const rootDir = root2(opts);
   resolveRegime(opts.regime);
   const org = await loadOrg(rootDir);
   org.defaultRegime = opts.regime;
@@ -13709,8 +14607,8 @@ var initCmd = new Command("init").description("Set org, coordinator, and the per
 var regimesCmd = new Command("regimes").description("List available reporting regimes").action(() => {
   console.log(formatRegimeList());
 });
-var productAdd = new Command("add").description("Register a product with digital elements (PDE)").argument("<name>", "Product name").option(...cwdOption).option("--regime <id>", "Regime whose classification vocabulary applies").option("--classification <id>", "Regime classification id (see `vg evidence regimes`)", "default").option("--markets <cc,cc>", "Member states / markets, comma-separated").option("--bind <ref>", "Bind to a repo/image/registry (repeatable)", (v, acc) => [...acc, v], []).option("--in-scope", "Record an in-scope determination").option("--out-of-scope", "Record an out-of-scope determination").option("--rationale <text>", "Scope determination rationale").option("--until <date>", "Declared support period end (YYYY-MM-DD)").action(async (name, opts) => {
-  const rootDir = root(opts);
+var productAdd = new Command("add").description("Register a product with digital elements (PDE)").argument("<name>", "Product name").option(...cwdOption2).option("--regime <id>", "Regime whose classification vocabulary applies").option("--classification <id>", "Regime classification id (see `vg evidence regimes`)", "default").option("--markets <cc,cc>", "Member states / markets, comma-separated").option("--bind <ref>", "Bind to a repo/image/registry (repeatable)", (v, acc) => [...acc, v], []).option("--in-scope", "Record an in-scope determination").option("--out-of-scope", "Record an out-of-scope determination").option("--rationale <text>", "Scope determination rationale").option("--until <date>", "Declared support period end (YYYY-MM-DD)").action(async (name, opts) => {
+  const rootDir = root2(opts);
   const regime = resolveRegime(opts.regime ?? (await loadOrg(rootDir)).defaultRegime);
   if (opts.classification !== "default" && regime.classifications.length && !regime.classifications.some((c2) => c2.id === opts.classification)) {
     throw new CliError(`classification "${opts.classification}" is not valid for regime ${regime.id} \u2014 options: ${regime.classifications.map((c2) => c2.id).join(", ")}`, ExitCode.USAGE_ERROR);
@@ -13732,29 +14630,29 @@ var productAdd = new Command("add").description("Register a product with digital
   await saveProducts(rootDir, products);
   console.log(chalk7.green("\u2714") + ` product ${chalk7.bold(id)} registered (${regime.name})`);
 });
-var productList = new Command("list").description("List registered products").option(...cwdOption).action(async (opts) => {
-  const products = await loadProducts(root(opts));
+var productList = new Command("list").description("List registered products").option(...cwdOption2).action(async (opts) => {
+  const products = await loadProducts(root2(opts));
   if (!products.length) return console.log(chalk7.dim("no products registered \u2014 vg evidence product add <name>"));
   for (const p of products) {
     console.log(`  ${chalk7.bold(p.id)}  ${p.name}  ${chalk7.dim(`[${p.classification}]`)}  ${chalk7.dim(p.memberStates.join(" ") || "no markets")}`);
   }
 });
-var productShow = new Command("show").description("Show a product and its frozen releases").argument("<id>").option(...cwdOption).action(async (id, opts) => {
-  const rootDir = root(opts);
+var productShow = new Command("show").description("Show a product and its frozen releases").argument("<id>").option(...cwdOption2).action(async (id, opts) => {
+  const rootDir = root2(opts);
   const product = await getProduct(rootDir, id);
   if (!product) throw new CliError(`no such product: ${id}`, ExitCode.NOT_FOUND);
   const releases = await loadReleases(rootDir, product.id);
   console.log(JSON.stringify({ product, releases: releases.map((r) => ({ version: r.version, shipDate: r.shipDate, components: r.components.length })) }, null, 2));
 });
 var productCmd = new Command("product").description("Register and inspect products with digital elements").addCommand(productAdd).addCommand(productList).addCommand(productShow);
-var releaseCmd = new Command("release").description("Freeze a shipped release into an immutable component manifest").argument("<product>", "Product id").argument("<version>", "Shipped version").option(...cwdOption).option("--from <file>", "Scan artifact or SBOM captured at release", ".vibgrate/scan_result.json").option("--ship-date <date>", "Ship date (YYYY-MM-DD)").option("--build-id <id>", "Build id").option("--digest <sha256>", "Artefact digest").option("--markets <cc,cc>", "Distribution markets/channels, comma-separated").action(async (productId, version, opts) => {
-  const rootDir = root(opts);
+var releaseCmd = new Command("release").description("Freeze a shipped release into an immutable component manifest").argument("<product>", "Product id").argument("<version>", "Shipped version").option(...cwdOption2).option("--from <file>", "Scan artifact or SBOM captured at release", ".vibgrate/scan_result.json").option("--ship-date <date>", "Ship date (YYYY-MM-DD)").option("--build-id <id>", "Build id").option("--digest <sha256>", "Artefact digest").option("--markets <cc,cc>", "Distribution markets/channels, comma-separated").action(async (productId, version, opts) => {
+  const rootDir = root2(opts);
   const product = await getProduct(rootDir, productId);
   if (!product) throw new CliError(`no such product: ${productId} \u2014 register it with \`vg evidence product add\``, ExitCode.NOT_FOUND);
   const release = await buildRelease({
     productId: product.id,
     version,
-    from: path43.resolve(rootDir, opts.from),
+    from: path46.resolve(rootDir, opts.from),
     shipDate: opts.shipDate,
     buildId: opts.buildId,
     artefactDigest: opts.digest,
@@ -13762,7 +14660,7 @@ var releaseCmd = new Command("release").description("Freeze a shipped release in
     frozenAt: nowIso()
   });
   const p = await freezeRelease(rootDir, release);
-  console.log(chalk7.green("\u2714") + ` froze ${chalk7.bold(`${product.id}@${version}`)} \u2014 ${release.components.length} components, immutable at ${path43.relative(rootDir, p)}`);
+  console.log(chalk7.green("\u2714") + ` froze ${chalk7.bold(`${product.id}@${version}`)} \u2014 ${release.components.length} components, immutable at ${path46.relative(rootDir, p)}`);
 });
 async function runExposure(rootDir, vuln, opts) {
   const org = await loadOrg(rootDir);
@@ -13794,8 +14692,8 @@ function exposureExit(status) {
   if (status === "undetermined") return ExitCode.NOT_FOUND;
   return ExitCode.OK;
 }
-var exposureCmd = new Command("exposure").description("Which shipped products contain this vulnerability \u2014 with signed evidence").argument("<vuln>", "Vulnerability id (CVE / GHSA / OSV / EUVD)").option(...cwdOption).option("--regime <id>", "Reporting regime").option("--advisory <file>", "Advisory file (OSV or Vibgrate-shaped) instead of fetching").option("--offline", "No network; requires --advisory").option("--as-of <date>", "Determine as of this date (drives support status)").option("--products <substr>", "Restrict to products matching this substring").option("--include-eol", "Include releases whose support period has expired").option("--format <fmt>", "Output format (table|json)", "table").option("--generated-at <iso>", "Override the recorded timestamp (reproducibility)").option("--data-pack-version <v>", "Record the data pack version used").option("--pack", "Also print the submission pack").option("--stage <stage>", "Pack stage (regime-specific)").option("--bundle <dir>", "Write a signed evidence bundle to this directory").option("--no-sign", "Do not sign the evidence bundle").option("--tsa <url>", "RFC 3161 Time-Stamping Authority URL to timestamp the result").option("--pub <file>", "Trust root to pin the signer when re-verifying").action(async (vuln, opts) => {
-  const rootDir = root(opts);
+var exposureCmd = new Command("exposure").description("Which shipped products contain this vulnerability \u2014 with signed evidence").argument("<vuln>", "Vulnerability id (CVE / GHSA / OSV / EUVD)").option(...cwdOption2).option("--regime <id>", "Reporting regime").option("--advisory <file>", "Advisory file (OSV or Vibgrate-shaped) instead of fetching").option("--offline", "No network; requires --advisory").option("--as-of <date>", "Determine as of this date (drives support status)").option("--products <substr>", "Restrict to products matching this substring").option("--include-eol", "Include releases whose support period has expired").option("--format <fmt>", "Output format (table|json)", "table").option("--generated-at <iso>", "Override the recorded timestamp (reproducibility)").option("--data-pack-version <v>", "Record the data pack version used").option("--pack", "Also print the submission pack").option("--stage <stage>", "Pack stage (regime-specific)").option("--bundle <dir>", "Write a signed evidence bundle to this directory").option("--no-sign", "Do not sign the evidence bundle").option("--tsa <url>", "RFC 3161 Time-Stamping Authority URL to timestamp the result").option("--pub <file>", "Trust root to pin the signer when re-verifying").action(async (vuln, opts) => {
+  const rootDir = root2(opts);
   const { result, regime, releases, advisory } = await runExposure(rootDir, vuln, opts);
   let timestampToken;
   if (opts.tsa) {
@@ -13814,7 +14712,7 @@ var exposureCmd = new Command("exposure").description("Which shipped products co
     console.log("\n" + buildPack(result, regime, org, stage));
   }
   if (opts.bundle) {
-    const dir = path43.resolve(rootDir, opts.bundle, `evidence-${result.meta.evidenceId}`);
+    const dir = path46.resolve(rootDir, opts.bundle, `evidence-${result.meta.evidenceId}`);
     let envelope;
     if (opts.sign !== false) {
       const { key: key2, minted } = resolveSigningKey(rootDir);
@@ -13822,12 +14720,12 @@ var exposureCmd = new Command("exposure").description("Which shipped products co
       envelope = signEvidenceStatement(buildEvidenceStatement(result, VERSION), key2);
     }
     writeBundle({ outDir: dir, result, advisory, releases, regime, envelope, timestampToken, cliVersion: VERSION });
-    console.error(chalk7.green("\u2714") + ` evidence bundle written to ${path43.relative(rootDir, dir)}${envelope ? " (signed)" : " (unsigned)"}${timestampToken ? " \xB7 RFC 3161" : ""}`);
+    console.error(chalk7.green("\u2714") + ` evidence bundle written to ${path46.relative(rootDir, dir)}${envelope ? " (signed)" : " (unsigned)"}${timestampToken ? " \xB7 RFC 3161" : ""}`);
   }
   process.exitCode = exposureExit(result.overallStatus);
 });
-var readinessCmd = new Command("readiness").description("Deterministic gap report against the regime obligations").option(...cwdOption).option("--regime <id>", "Reporting regime").option("--format <fmt>", "Output format (table|json)", "table").action(async (opts) => {
-  const rootDir = root(opts);
+var readinessCmd = new Command("readiness").description("Deterministic gap report against the regime obligations").option(...cwdOption2).option("--regime <id>", "Reporting regime").option("--format <fmt>", "Output format (table|json)", "table").action(async (opts) => {
+  const rootDir = root2(opts);
   const org = await loadOrg(rootDir);
   const regime = resolveRegime(opts.regime ?? org.defaultRegime);
   const products = await loadProducts(rootDir);
@@ -13836,8 +14734,8 @@ var readinessCmd = new Command("readiness").description("Deterministic gap repor
   const report = computeReadiness({ regime, org, products, releasesByProduct, recentDrill });
   console.log(opts.format === "json" ? JSON.stringify(report, null, 2) : formatReadiness(report, regime));
 });
-var supportCmd = new Command("support-period").description("Declare or show a product support period").argument("<product>", "Product id").option(...cwdOption).option("--from <date>", "Declared support start (YYYY-MM-DD)").option("--until <date>", "Declared support end (YYYY-MM-DD)").action(async (productId, opts) => {
-  const rootDir = root(opts);
+var supportCmd = new Command("support-period").description("Declare or show a product support period").argument("<product>", "Product id").option(...cwdOption2).option("--from <date>", "Declared support start (YYYY-MM-DD)").option("--until <date>", "Declared support end (YYYY-MM-DD)").action(async (productId, opts) => {
+  const rootDir = root2(opts);
   const products = await loadProducts(rootDir);
   const product = products.find((p) => p.id === productId || p.name === productId);
   if (!product) throw new CliError(`no such product: ${productId}`, ExitCode.NOT_FOUND);
@@ -13847,22 +14745,22 @@ var supportCmd = new Command("support-period").description("Declare or show a pr
   }
   console.log(`  ${chalk7.bold(product.id)} support period: ${product.supportPeriod?.declaredFrom ?? "\u2014"} \u2192 ${chalk7.bold(product.supportPeriod?.declaredUntil ?? "not declared")}`);
 });
-var packCmd = new Command("pack").description("Build the submission pack a human pastes into the reporting platform").argument("<vuln>", "Vulnerability id").option(...cwdOption).option("--regime <id>", "Reporting regime").option("--stage <stage>", "Reporting stage").option("--advisory <file>", "Advisory file (OSV or Vibgrate-shaped)").option("--offline", "No network; requires --advisory").option("--out <file>", "Write the pack to this file").action(async (vuln, opts) => {
-  const rootDir = root(opts);
+var packCmd = new Command("pack").description("Build the submission pack a human pastes into the reporting platform").argument("<vuln>", "Vulnerability id").option(...cwdOption2).option("--regime <id>", "Reporting regime").option("--stage <stage>", "Reporting stage").option("--advisory <file>", "Advisory file (OSV or Vibgrate-shaped)").option("--offline", "No network; requires --advisory").option("--out <file>", "Write the pack to this file").action(async (vuln, opts) => {
+  const rootDir = root2(opts);
   const { result, regime } = await runExposure(rootDir, vuln, opts);
   const org = await loadOrg(rootDir);
   const stage = opts.stage ?? regime.clocks[0]?.stage ?? "early-warning";
   const md = buildPack(result, regime, org, stage);
   if (opts.out) {
-    fs14.writeFileSync(path43.resolve(rootDir, opts.out), md);
+    fs14.writeFileSync(path46.resolve(rootDir, opts.out), md);
     console.error(chalk7.green("\u2714") + ` pack written to ${opts.out}`);
   } else {
     console.log(md);
   }
   process.exitCode = exposureExit(result.overallStatus);
 });
-var drillCmd = new Command("drill").description("Timed dry-run of the determination step against a simulated advisory").option(...cwdOption).option("--regime <id>", "Reporting regime").option("--scenario <name>", "Scenario seed (deterministic pick)", "kev-recent").option("--elapsed <seconds>", "Record the wall-clock your team actually took").option("--format <fmt>", "Output format (table|json)", "table").action(async (opts) => {
-  const rootDir = root(opts);
+var drillCmd = new Command("drill").description("Timed dry-run of the determination step against a simulated advisory").option(...cwdOption2).option("--regime <id>", "Reporting regime").option("--scenario <name>", "Scenario seed (deterministic pick)", "kev-recent").option("--elapsed <seconds>", "Record the wall-clock your team actually took").option("--format <fmt>", "Output format (table|json)", "table").action(async (opts) => {
+  const rootDir = root2(opts);
   const org = await loadOrg(rootDir);
   const regime = resolveRegime(opts.regime ?? org.defaultRegime);
   const products = await loadProducts(rootDir);
@@ -13896,18 +14794,18 @@ var drillCmd = new Command("drill").description("Timed dry-run of the determinat
   }
 });
 var verifyCmd = new Command("verify").description("Verify an evidence bundle offline (no Vibgrate needed)").argument("<bundle>", "Path to an evidence bundle directory or evidence.intoto.jsonl").option("--pub <file>", "Public key PEM to pin the signer (establish trust)").action((bundlePath, opts) => {
-  const abs = path43.resolve(bundlePath);
-  const envPath = fs14.statSync(abs).isDirectory() ? path43.join(abs, "evidence.intoto.jsonl") : abs;
+  const abs = path46.resolve(bundlePath);
+  const envPath = fs14.statSync(abs).isDirectory() ? path46.join(abs, "evidence.intoto.jsonl") : abs;
   if (!fs14.existsSync(envPath)) throw new CliError(`no evidence.intoto.jsonl at ${bundlePath}`, ExitCode.NOT_FOUND);
   const envelope = JSON.parse(fs14.readFileSync(envPath, "utf8").trim().split("\n")[0]);
-  const resultPath = path43.join(path43.dirname(envPath), "result.json");
+  const resultPath = path46.join(path46.dirname(envPath), "result.json");
   const result = fs14.existsSync(resultPath) ? JSON.parse(fs14.readFileSync(resultPath, "utf8")) : void 0;
-  const publicKeyPem = opts.pub ? fs14.readFileSync(path43.resolve(opts.pub), "utf8") : void 0;
+  const publicKeyPem = opts.pub ? fs14.readFileSync(path46.resolve(opts.pub), "utf8") : void 0;
   const v = verifyEvidenceEnvelope(envelope, { publicKeyPem, result });
   const color = v.status === "verified" ? chalk7.green : v.status === "failed" ? chalk7.red : chalk7.yellow;
   console.log("  " + color(v.status.toUpperCase()) + `  ${v.reason}`);
   if (v.evidenceId) console.log("  " + chalk7.dim(`evidence ${v.evidenceId} \xB7 regime ${v.regime} \xB7 advisory ${v.advisoryId} \xB7 ${v.overallStatus}`));
-  const tsrPath = path43.join(path43.dirname(envPath), "timestamp.tsr");
+  const tsrPath = path46.join(path46.dirname(envPath), "timestamp.tsr");
   if (fs14.existsSync(tsrPath) && result) {
     const t = verifyTimestamp(fs14.readFileSync(tsrPath), exposureSubjectDigest(result));
     const tcolor = t.imprintMatches ? chalk7.green : chalk7.red;
@@ -13915,8 +14813,8 @@ var verifyCmd = new Command("verify").description("Verify an evidence bundle off
   }
   process.exitCode = v.status === "verified" ? ExitCode.OK : v.status === "unverified" ? ExitCode.GATE_FAILED : ExitCode.ERROR;
 });
-var watchCmd = new Command("watch").description('Check CISA KEV for new exposure against your shipped components (surfaces the listing; does not decide "actively exploited")').option(...cwdOption).option("--regime <id>", "Reporting regime").option("--since <date>", "Only KEV entries added on/after this date (YYYY-MM-DD)").option("--webhook <url>", "POST the alert payload to this URL when there are hits").option("--format <fmt>", "Output format (table|json)", "table").action(async (opts) => {
-  const rootDir = root(opts);
+var watchCmd = new Command("watch").description('Check CISA KEV for new exposure against your shipped components (surfaces the listing; does not decide "actively exploited")').option(...cwdOption2).option("--regime <id>", "Reporting regime").option("--since <date>", "Only KEV entries added on/after this date (YYYY-MM-DD)").option("--webhook <url>", "POST the alert payload to this URL when there are hits").option("--format <fmt>", "Output format (table|json)", "table").action(async (opts) => {
+  const rootDir = root2(opts);
   const org = await loadOrg(rootDir);
   const regime = resolveRegime(opts.regime ?? org.defaultRegime);
   const products = await loadProducts(rootDir);
@@ -13967,8 +14865,8 @@ var watchCmd = new Command("watch").description('Check CISA KEV for new exposure
   console.log("  " + chalk7.dim('watch surfaces the CISA KEV listing. Whether a vulnerability is "actively exploited" for a filing is your determination, not ours.'));
   process.exitCode = hits.some((h) => h.result.overallStatus === "affected") ? ExitCode.GATE_FAILED : hits.some((h) => h.result.overallStatus === "undetermined") ? ExitCode.NOT_FOUND : ExitCode.OK;
 });
-var exportCmd = new Command("export").description("Air-gap bundle of all evidence state (org, products, frozen releases, readiness)").option(...cwdOption).option("--out <dir>", "Output directory", "evidence-export").option("--regime <id>", "Reporting regime for the readiness snapshot").action(async (opts) => {
-  const rootDir = root(opts);
+var exportCmd = new Command("export").description("Air-gap bundle of all evidence state (org, products, frozen releases, readiness)").option(...cwdOption2).option("--out <dir>", "Output directory", "evidence-export").option("--regime <id>", "Reporting regime for the readiness snapshot").action(async (opts) => {
+  const rootDir = root2(opts);
   const org = await loadOrg(rootDir);
   const regime = resolveRegime(opts.regime ?? org.defaultRegime);
   const products = await loadProducts(rootDir);
@@ -13976,15 +14874,15 @@ var exportCmd = new Command("export").description("Air-gap bundle of all evidenc
   const releases = [];
   for (const list of releasesByProduct.values()) releases.push(...list);
   const report = computeReadiness({ regime, org, products, releasesByProduct, recentDrill: await hasRecentDrill(rootDir, today()) });
-  const dir = path43.resolve(rootDir, opts.out);
-  await writeJsonFile(path43.join(dir, "org.json"), org);
-  await writeJsonFile(path43.join(dir, "products.json"), products);
-  for (const r of releases) await writeJsonFile(path43.join(dir, "releases", `${r.productId}@${r.version}.json`.replace(/[^A-Za-z0-9._@-]/g, "_")), r);
-  await writeJsonFile(path43.join(dir, "readiness.json"), report);
-  console.error(chalk7.green("\u2714") + ` exported evidence state to ${path43.relative(rootDir, dir)} (${products.length} products, ${releases.length} frozen releases)`);
+  const dir = path46.resolve(rootDir, opts.out);
+  await writeJsonFile(path46.join(dir, "org.json"), org);
+  await writeJsonFile(path46.join(dir, "products.json"), products);
+  for (const r of releases) await writeJsonFile(path46.join(dir, "releases", `${r.productId}@${r.version}.json`.replace(/[^A-Za-z0-9._@-]/g, "_")), r);
+  await writeJsonFile(path46.join(dir, "readiness.json"), report);
+  console.error(chalk7.green("\u2714") + ` exported evidence state to ${path46.relative(rootDir, dir)} (${products.length} products, ${releases.length} frozen releases)`);
 });
-var pushCmd = new Command("push").description("Push the product registry (and an optional exposure result) to Vibgrate Cloud").option(...cwdOption).option("--dsn <dsn>", "DSN token (or use VIBGRATE_DSN env / `vg login`)").option("--regime <id>", "Reporting regime").option("--result <file>", "An exposure result.json (or a bundle dir) to include").option("--signed", "Mark the included exposure result as signed").option("--strict", "Fail on push errors").action(async (opts) => {
-  const rootDir = root(opts);
+var pushCmd = new Command("push").description("Push the product registry (and an optional exposure result) to Vibgrate Cloud").option(...cwdOption2).option("--dsn <dsn>", "DSN token (or use VIBGRATE_DSN env / `vg login`)").option("--regime <id>", "Reporting regime").option("--result <file>", "An exposure result.json (or a bundle dir) to include").option("--signed", "Mark the included exposure result as signed").option("--strict", "Fail on push errors").action(async (opts) => {
+  const rootDir = root2(opts);
   const dsn = resolveDsn(opts.dsn);
   if (!dsn) throw new CliError("no DSN \u2014 run `vg login`, set VIBGRATE_DSN, or pass --dsn", ExitCode.USAGE_ERROR);
   const parsed = parseDsn$1(dsn);
@@ -14007,8 +14905,8 @@ var pushCmd = new Command("push").description("Push the product registry (and an
   }));
   let exposure;
   if (opts.result) {
-    const raw = path43.resolve(rootDir, opts.result);
-    const resultPath = fs14.existsSync(raw) && fs14.statSync(raw).isDirectory() ? path43.join(raw, "result.json") : raw;
+    const raw = path46.resolve(rootDir, opts.result);
+    const resultPath = fs14.existsSync(raw) && fs14.statSync(raw).isDirectory() ? path46.join(raw, "result.json") : raw;
     if (!fs14.existsSync(resultPath)) throw new CliError(`no result.json at ${opts.result}`, ExitCode.NOT_FOUND);
     exposure = JSON.parse(fs14.readFileSync(resultPath, "utf8"));
   }
@@ -14090,7 +14988,9 @@ var KNOWN_COMMANDS = /* @__PURE__ */ new Set([
   "dsn",
   "update",
   "sbom",
-  "evidence"
+  "evidence",
+  "locale",
+  "localize"
 ]);
 function buildProgram() {
   const program = new Command();
@@ -14150,6 +15050,7 @@ ${aliasNote}Docs: https://vibgrate.com/help`;
   program.addCommand(updateCommand);
   program.addCommand(sbomCommand);
   program.addCommand(evidenceCommand);
+  registerLocale(program);
   return program;
 }
 var VALUE_FLAGS = /* @__PURE__ */ new Set([
@@ -14206,7 +15107,7 @@ function dispatch(argv, cwd) {
   }
   const looksLikeQuestion = /\s/.test(first) || first.endsWith("?");
   if (looksLikeQuestion) return ["ask", ...args];
-  if (fs14.existsSync(path43.resolve(cwd, first))) {
+  if (fs14.existsSync(path46.resolve(cwd, first))) {
     return [hasBuildOnlyFlag(args) ? "build" : "scan", ...args];
   }
   const moved = MOVED_COMMANDS[first];
@@ -14251,9 +15152,9 @@ async function main(argv = process.argv) {
 }
 function readCwd(raw) {
   const i = raw.findIndex((a) => a === "-C" || a === "--cwd");
-  if (i >= 0 && raw[i + 1]) return path43.resolve(raw[i + 1]);
+  if (i >= 0 && raw[i + 1]) return path46.resolve(raw[i + 1]);
   const eq = raw.find((a) => a.startsWith("--cwd="));
-  if (eq) return path43.resolve(eq.slice("--cwd=".length));
+  if (eq) return path46.resolve(eq.slice("--cwd=".length));
   return process.cwd();
 }
 function handleError(err) {