@vibgrate/cli 2026.826.1 → 2026.829.1

package/dist/{chunk-TUVB6Q6F.js → chunk-65YN3BG3.js}

@@ -1,17 +1,20 @@
 import { availableRegionIds, resolveIngestHost, dashHostForIngestHost, ingestHostForRegionId } from './chunk-HTLDXEHW.js';
-import { loadConfig, computeUpgradeImpact, getChangelogSignals, gitHistoryAvailable, buildVersionTimelines, findPackageTimeline, severityRank, projectTypeToVulnEcosystem } from './chunk-5UG4UHKU.js';
-import { searchSymbols, resolveVersion, resolveLib, loadCatalog, driftFor, localPackageDocs, readDoc, localApiSurface } from './chunk-QONHVC4H.js';
+import { loadConfig, computeUpgradeImpact, getChangelogSignals, gitHistoryAvailable, buildVersionTimelines, findPackageTimeline, severityRank, projectTypeToVulnEcosystem, classifyFile } from './chunk-HUJZO4K5.js';
+import { searchSymbols, resolveVersion, resolveLib, loadCatalog, driftFor, localPackageDocs, readDoc, localApiSurface } from './chunk-TWFPHXPN.js';
 import { discoverModels } from './chunk-WNKGRXUA.js';
+import { CliError, ExitCode } from './chunk-MS6V5XKB.js';
 import { writeTextFile, pathExists, readJsonFile } from './chunk-CRAMOEBE.js';
 import { inventory } from './chunk-6BEBJCK4.js';
 import { resolveOne } from './chunk-J7LKEB2R.js';
-import { impactOf, indexFor, queryGraphSemantic, queryGraph } from './chunk-NQU6E6OG.js';
+import { impactOf, indexFor, rankingAskFrom, queryGraphSemantic, queryGraph } from './chunk-YL332BU2.js';
 import { loadOrDiscoverFederation, highConfidenceBridges } from './chunk-RTURQXQL.js';
-import { withTimeout, getNodeEmbeddings, loadEmbedder, isModelReady } from './chunk-WU2DVESP.js';
-import { loadTopicTags, rankQuestion } from './chunk-K2IWOZEQ.js';
+import { withTimeout, getNodeEmbeddings, loadEmbedder, isModelReady } from './chunk-BA6YBVNT.js';
+import { loadTopicTags, rankQuestion } from './chunk-FPIMNVLI.js';
 import { cacheDir } from './chunk-MVPRPSXU.js';
 import { parseGraph } from './chunk-O3LABX6I.js';
+import { VERSION } from './chunk-UGRUG2FA.js';
 import { repositoryIdFromRoot } from './chunk-XP6UUCZZ.js';
+import { canonicalize } from './chunk-JFGYT6BI.js';
 import { bidirectional } from 'graphology-shortest-path/unweighted.js';
 import Graph from 'graphology';
 import * as fs from 'fs';
@@ -19,10 +22,13 @@ import * as path4 from 'path';
 import * as crypto from 'crypto';
 import { createHash } from 'crypto';
 import { Command } from 'commander';
-import chalk from 'chalk';
+import chalk3 from 'chalk';
 import * as os from 'os';
 import * as zlib from 'zlib';
 import { promisify } from 'util';
+import { sha256 } from '@noble/hashes/sha2.js';
+import { bytesToHex } from '@noble/hashes/utils.js';
+import { spawnSync } from 'child_process';
 import { encode, decode } from 'gpt-tokenizer/encoding/cl100k_base';
 
 // src/grounding/pack.ts
@@ -317,63 +323,63 @@ dsnCommand.command("create").description("Create a new DSN token").option("--ing
   try {
     ingestHost = resolveIngestHost(opts.region, opts.ingest);
   } catch (e) {
-    console.error(chalk.red(e instanceof Error ? e.message : String(e)));
+    console.error(chalk3.red(e instanceof Error ? e.message : String(e)));
     process.exit(1);
   }
   let workspaceId = opts.workspace;
   const isNewWorkspace = opts.workspace.toLowerCase() === "new";
   if (isNewWorkspace) {
     workspaceId = crypto.randomBytes(8).toString("hex");
-    console.log(chalk.dim(`Provisioning new workspace ${workspaceId}...`));
+    console.log(chalk3.dim(`Provisioning new workspace ${workspaceId}...`));
   }
   const region = opts.ingest ? void 0 : opts.region.toLowerCase();
   if (isNewWorkspace) {
     const result = await provisionDsn(keyId, secret, workspaceId, ingestHost, region);
     if (!result.success) {
-      console.error(chalk.red(`Failed to provision DSN: ${result.error}`));
+      console.error(chalk3.red(`Failed to provision DSN: ${result.error}`));
       process.exit(1);
     }
   }
   const dsn = buildDsn(keyId, secret, ingestHost, workspaceId);
-  console.log(chalk.green("\u2714") + " DSN created");
+  console.log(chalk3.green("\u2714") + " DSN created");
   console.log("");
-  console.log(chalk.bold("Region:"));
+  console.log(chalk3.bold("Region:"));
   console.log(`  ${region ?? "custom"} (${ingestHost})`);
   console.log("");
-  console.log(chalk.bold("DSN:"));
+  console.log(chalk3.bold("DSN:"));
   console.log(`  ${dsn}`);
   console.log("");
-  console.log(chalk.bold("Key ID:"));
+  console.log(chalk3.bold("Key ID:"));
   console.log(`  ${keyId}`);
   if (isNewWorkspace) {
     console.log("");
-    console.log(chalk.bold("Workspace ID:"));
+    console.log(chalk3.bold("Workspace ID:"));
     console.log(`  ${workspaceId}`);
   }
   console.log("");
-  console.log(chalk.dim("Set this as VIBGRATE_DSN in your CI environment."));
+  console.log(chalk3.dim("Set this as VIBGRATE_DSN in your CI environment."));
   if (!isNewWorkspace) {
-    console.log(chalk.dim("The secret must be registered on your Vibgrate ingest API."));
+    console.log(chalk3.dim("The secret must be registered on your Vibgrate ingest API."));
   }
   if (opts.write) {
     const writePath = path4.resolve(opts.write);
     await writeTextFile(writePath, dsn + "\n");
     console.log("");
-    console.log(chalk.green("\u2714") + ` DSN written to ${opts.write}`);
+    console.log(chalk3.green("\u2714") + ` DSN written to ${opts.write}`);
     const root = findGitRoot(path4.dirname(writePath));
     const rel = root ? path4.relative(root, writePath).split(path4.sep).join("/") : "";
     if (root && rel && !rel.startsWith("..")) {
       const res = ensureGitignored(rel, path4.dirname(writePath));
       if (res.status === "created") {
-        console.log(chalk.green("\u2714") + ` Created .gitignore and ignored ${rel}`);
+        console.log(chalk3.green("\u2714") + ` Created .gitignore and ignored ${rel}`);
       } else if (res.status === "added") {
-        console.log(chalk.green("\u2714") + ` Added ${rel} to .gitignore`);
+        console.log(chalk3.green("\u2714") + ` Added ${rel} to .gitignore`);
       } else if (res.status === "present") {
-        console.log(chalk.dim(`  ${rel} is already in .gitignore`));
+        console.log(chalk3.dim(`  ${rel} is already in .gitignore`));
       }
     } else {
       console.log(
-        chalk.yellow("\u26A0") + " Add this file to .gitignore to keep the DSN out of version control."
+        chalk3.yellow("\u26A0") + " Add this file to .gitignore to keep the DSN out of version control."
       );
     }
   }
@@ -754,7 +760,7 @@ async function uploadScanArtifact(input) {
     const target = await regionRedirectHost(response);
     if (target && target !== host) {
       console.log(
-        chalk.yellow(
+        chalk3.yellow(
           `\u21BB Workspace is pinned to a different region \u2014 retrying upload to ${target}...`
         )
       );
@@ -764,6 +770,125 @@ async function uploadScanArtifact(input) {
   }
   return { response, host };
 }
+var CAPSULE_SCHEMA = "vg.analysis.capsule.v1";
+var FINDINGS_SCHEMA = "vg.review.findings.v1";
+var RECEIPT_SCHEMA = "vg.review.receipt.v1";
+var REVIEW_POLICY_VERSION = "vg-policy-0.1.0";
+var CAPSULE_BUDGETS = {
+  "interactive-narrow": { median: 3e3, cap: 16e3 },
+  "ci-wide": { median: 1e4, cap: 16e3 }
+};
+var MAX_ROLE_PEERS = 5;
+var TARGET_ALIGNMENTS = [
+  "regression",
+  "target",
+  "legacy_consistent",
+  "approved_exception",
+  "unknown"
+];
+function digest(value) {
+  return `sha256:${bytesToHex(sha256(new TextEncoder().encode(canonicalize(value))))}`;
+}
+function digestString(input) {
+  return `sha256:${bytesToHex(sha256(new TextEncoder().encode(input)))}`;
+}
+function receiptDigest(receipt) {
+  const { digests, signature: _signature, ...rest } = receipt;
+  const { receipt: _self, ...digestsWithoutSelf } = digests;
+  return digest({ ...rest, digests: digestsWithoutSelf });
+}
+function receiptId(createdAtMs, entropy) {
+  const alphabet = "0123456789ABCDEFGHJKMNPQRSTVWXYZ";
+  let time = "";
+  let ms = Math.max(0, Math.floor(createdAtMs));
+  for (let i = 0; i < 10; i++) {
+    time = alphabet[ms % 32] + time;
+    ms = Math.floor(ms / 32);
+  }
+  const tail = bytesToHex(sha256(new TextEncoder().encode(entropy))).slice(0, 16).toUpperCase().replace(/[^0-9A-HJKMNP-TV-Z]/g, "0");
+  return `rvw_${time}${tail}`;
+}
+
+// src/review/push.ts
+var MAX_SNIPPET_LINES = 12;
+var MAX_SNIPPET_FINDINGS = 20;
+function rejectPushWhenOffline(offline) {
+  if (!offline) return;
+  throw new CliError(
+    "`--push` needs the network \u2014 drop `--offline` (or `--local`) to upload the receipt, or drop `--push` to keep it on disk",
+    ExitCode.USAGE_ERROR
+  );
+}
+function buildEnvelope(receipt, opts = { pushedAt: (/* @__PURE__ */ new Date()).toISOString() }) {
+  return {
+    kind: "review",
+    schema_version: RECEIPT_SCHEMA,
+    workspace_id: opts.workspaceId ?? receipt.workspace_id ?? null,
+    pushed_at: opts.pushedAt,
+    cli_version: VERSION,
+    receipt
+  };
+}
+function collectSpans(root, receipt, capsule, privacy) {
+  if (!privacy.includeSpans && !privacy.includeSnippets) return void 0;
+  const citedIds = new Set(
+    [...receipt.findings.architecture_findings, ...receipt.findings.security_findings].slice(0, MAX_SNIPPET_FINDINGS).flatMap((f) => f.evidence_ids)
+  );
+  const spans = [];
+  for (const e of capsule.evidence) {
+    if (!citedIds.has(e.id)) continue;
+    if (!e.path || e.start_line === void 0 || e.end_line === void 0) continue;
+    const ref = {
+      evidence_id: e.id,
+      path: e.path,
+      start_line: e.start_line,
+      end_line: e.end_line
+    };
+    if (privacy.includeSnippets) {
+      const snippet = readSnippet(root, e.path, e.start_line, e.end_line);
+      if (snippet) ref.snippet = snippet;
+    }
+    spans.push(ref);
+  }
+  return spans;
+}
+function readSnippet(root, rel, start, end) {
+  try {
+    const abs = path4.join(root, rel);
+    if (!fs.existsSync(abs)) return null;
+    const lines = fs.readFileSync(abs, "utf8").split("\n");
+    return lines.slice(Math.max(0, start - 1), Math.min(lines.length, start - 1 + MAX_SNIPPET_LINES, end)).join("\n");
+  } catch {
+    return null;
+  }
+}
+async function pushReceipt(dsn, body, fetchImpl = fetch) {
+  const url = `${dsn.scheme}://${dsn.host}/v1/ingest/review`;
+  const payload = JSON.stringify(body);
+  let res;
+  try {
+    res = await fetchImpl(url, {
+      method: "POST",
+      headers: {
+        "Content-Type": "application/json",
+        "X-Vibgrate-Timestamp": String(Date.now()),
+        Authorization: `VibgrateDSN ${dsn.keyId}:${dsn.secret}`
+      },
+      body: payload,
+      signal: AbortSignal.timeout(3e4)
+    });
+  } catch (e) {
+    throw new CliError(
+      `could not reach ${dsn.host}: ${e instanceof Error ? e.message : String(e)}`,
+      ExitCode.ERROR
+    );
+  }
+  if (!res.ok) {
+    const detail = await res.text().catch(() => "");
+    return { ok: false, status: res.status, host: dsn.host, detail: detail.slice(0, 200) };
+  }
+  return { ok: true, status: res.status, host: dsn.host };
+}
 
 // src/reporting/commands/push.ts
 function parseDsn(dsn) {
@@ -778,29 +903,48 @@ function parseDsn(dsn) {
     workspaceId: match[5]
   };
 }
-var pushCommand = new Command("push").description("Push scan results to Vibgrate API").option("--dsn <dsn>", "DSN token (or use VIBGRATE_DSN env)").option("--region <region>", `Override data residency region (${availableRegionIds().join(", ")})`).option("--file <file>", "Scan artifact file", ".vibgrate/scan_result.json").option("--strict", "Fail on upload errors").action(async (opts) => {
+var pushCommand = new Command("push").description("Push a scan artifact \u2014 or a `vg review` receipt \u2014 to Vibgrate Cloud").option("--dsn <dsn>", "DSN token (or use VIBGRATE_DSN env)").option("--region <region>", `Override data residency region (${availableRegionIds().join(", ")})`).option("--file <file>", "Scan artifact, or a vg.review.receipt.v1 file (auto-detected)", ".vibgrate/scan_result.json").option("--strict", "Fail on upload errors").action(async (opts) => {
   const dsn = resolveDsn(opts.dsn);
   if (!dsn) {
-    console.error(chalk.red("No DSN provided."));
-    console.error(chalk.dim('Run "vibgrate login", set VIBGRATE_DSN, or use the --dsn flag.'));
+    console.error(chalk3.red("No DSN provided."));
+    console.error(chalk3.dim('Run "vibgrate login", set VIBGRATE_DSN, or use the --dsn flag.'));
     if (opts.strict) process.exit(1);
     return;
   }
   const parsed = parseDsn(dsn);
   if (!parsed) {
-    console.error(chalk.red("Invalid DSN format."));
-    console.error(chalk.dim("Expected: vibgrate+https://<key_id>:<secret>@<host>/<workspace_id>"));
+    console.error(chalk3.red("Invalid DSN format."));
+    console.error(chalk3.dim("Expected: vibgrate+https://<key_id>:<secret>@<host>/<workspace_id>"));
     if (opts.strict) process.exit(1);
     return;
   }
   const filePath = path4.resolve(opts.file);
   if (!await pathExists(filePath)) {
-    console.error(chalk.red(`Scan artifact not found: ${filePath}`));
-    console.error(chalk.dim('Run "vibgrate scan" first.'));
+    console.error(chalk3.red(`Artifact not found: ${filePath}`));
+    console.error(chalk3.dim('Run "vg scan" (or "vg review --out <file>") first.'));
     if (opts.strict) process.exit(1);
     return;
   }
-  const artifact = await readJsonFile(filePath);
+  const document = await readJsonFile(filePath);
+  if (document?.schema_version === RECEIPT_SCHEMA) {
+    const receipt = document;
+    const envelope = buildEnvelope(receipt, {
+      workspaceId: parsed.workspaceId,
+      pushedAt: (/* @__PURE__ */ new Date()).toISOString()
+    });
+    console.log(
+      chalk3.dim(`Uploading review receipt (${receipt.decision}) for ${receipt.git.head_sha.slice(0, 8)}...`)
+    );
+    const result = await pushReceipt(parsed, envelope);
+    if (!result.ok) {
+      console.error(chalk3.red(`Upload failed (${result.status}): ${result.detail ?? ""}`));
+      if (opts.strict) process.exit(1);
+      return;
+    }
+    console.log(chalk3.green("\u2714") + ` Review receipt pushed to ${result.host}`);
+    return;
+  }
+  const artifact = document;
   const config = await loadConfig(process.cwd());
   const databaseSchemaCaps = config.scanners !== false ? config.scanners?.databaseSchema : void 0;
   const { body, contentEncoding } = await prepareCompressedUpload(artifact, { databaseSchemaCaps });
@@ -810,7 +954,7 @@ var pushCommand = new Command("push").description("Push scan results to Vibgrate
     try {
       host = resolveIngestHost(opts.region);
     } catch (e) {
-      console.error(chalk.red(e instanceof Error ? e.message : String(e)));
+      console.error(chalk3.red(e instanceof Error ? e.message : String(e)));
       if (opts.strict) process.exit(1);
       return;
     }
@@ -818,7 +962,7 @@ var pushCommand = new Command("push").description("Push scan results to Vibgrate
   const originalSize = JSON.stringify(artifact).length;
   const compressedSize = body.length;
   const ratio = ((1 - compressedSize / originalSize) * 100).toFixed(0);
-  console.log(chalk.dim(`Uploading to ${host}... (${(compressedSize / 1024).toFixed(0)} KB, ${ratio}% smaller)`));
+  console.log(chalk3.dim(`Uploading to ${host}... (${(compressedSize / 1024).toFixed(0)} KB, ${ratio}% smaller)`));
   try {
     const { response, host: uploadedHost } = await uploadScanArtifact({
       scheme: parsed.scheme,
@@ -839,18 +983,18 @@ var pushCommand = new Command("push").description("Push scan results to Vibgrate
       throw new Error(`HTTP ${response.status}: ${text}`);
     }
     const result = await response.json();
-    console.log(chalk.green("\u2714") + ` Scan queued for processing (${result.ingestId ?? "ok"})`);
+    console.log(chalk3.green("\u2714") + ` Scan queued for processing (${result.ingestId ?? "ok"})`);
     console.log();
-    console.log(chalk.dim("Processing continues in the background. Results available shortly."));
+    console.log(chalk3.dim("Processing continues in the background. Results available shortly."));
     console.log();
     if (result.ingestId) {
       const dashHost = dashHostForIngestHost(host);
       const reportUrl = `https://${dashHost}/${parsed.workspaceId}/scan/${result.ingestId}`;
-      console.log(chalk.dim("View report: ") + chalk.underline(reportUrl));
+      console.log(chalk3.dim("View report: ") + chalk3.underline(reportUrl));
     }
   } catch (e) {
     const msg = e instanceof Error ? e.message : String(e);
-    console.error(chalk.red(`Upload failed: ${msg}`));
+    console.error(chalk3.red(`Upload failed: ${msg}`));
     if (opts.strict) process.exit(1);
   }
 });
@@ -933,6 +1077,1015 @@ async function attributedInventory(root, opts = {}) {
   });
   return { ...inv, records, attribution: "git" };
 }
+
+// src/review/auth.ts
+var MIN_SECURITY_PEERS = 4;
+var AUTH_DOMINANCE_SHARE = 0.75;
+var MUTATING_METHODS = /* @__PURE__ */ new Set(["POST", "PUT", "PATCH", "DELETE", "ALL"]);
+var GUARD_CALL = /\b(authorize|authorise|authenticate|requireAuth|requireUser|requireLogin|requireRole|requireScope|requirePermission|ensureAuth|ensureLoggedIn|checkPermission|checkAccess|hasPermission|hasRole|verifyToken|verifyJwt|verifySession|assertScope|assertPermission|isAuthenticated|withAuth|protect|guard)\b/i;
+var GUARD_ATTRIBUTE = /(\[\s*Authorize\b)|(@(?:PreAuthorize|PostAuthorize|Secured|RolesAllowed|UseGuards|login_required|permission_required|requires_auth|authenticated))\b/;
+var GUARD_MIDDLEWARE = /\b(passport|jwt|oauth|session|clerk|auth0|nextAuth|authMiddleware|isAuth)\b/i;
+var PUBLIC_MARKER = /(@vibgrate-public|@public\b|\[\s*AllowAnonymous\s*\]|@AnonymousAllowed|permit_all|public\s*:\s*true)/i;
+function looksLikeGuard(expression) {
+  return GUARD_CALL.test(expression) || GUARD_ATTRIBUTE.test(expression) || GUARD_MIDDLEWARE.test(expression);
+}
+function classifyRoute(route) {
+  const decide = (verdict, rule) => ({ ...route, verdict, rule });
+  if (route.explicitlyPublic) return decide("not-auth", "explicit-public-marker");
+  if (route.unreadable) return decide("unsure", "unreadable");
+  if (route.inlineGuards.some(looksLikeGuard)) return decide("auth", "inline-guard");
+  if (route.inheritedGuards.some(looksLikeGuard)) return decide("auth", "inherited-guard");
+  if (route.inlineGuards.length > 0 || route.inheritedGuards.length > 0) {
+    return decide("unsure", "unrecognised-guard-expression");
+  }
+  return decide("not-auth", "no-guard-in-scope");
+}
+function voteAuth(group, routes) {
+  const mutating = routes.filter((r) => MUTATING_METHODS.has(r.method.toUpperCase()));
+  const unsure = mutating.filter((r) => r.verdict === "unsure");
+  const decided = mutating.filter((r) => r.verdict !== "unsure");
+  const guarded = decided.filter((r) => r.verdict === "auth");
+  const share = decided.length > 0 ? guarded.length / decided.length : 0;
+  const aboveFloor = decided.length >= MIN_SECURITY_PEERS;
+  const dominantlyGuarded = share >= AUTH_DOMINANCE_SHARE && guarded.length > 0;
+  return {
+    group,
+    classified: decided.length,
+    guarded: guarded.length,
+    share,
+    aboveFloor,
+    deviators: dominantlyGuarded ? decided.filter((r) => r.verdict === "not-auth") : [],
+    unsure
+  };
+}
+function voteAllAuth(routes) {
+  const groups = /* @__PURE__ */ new Map();
+  for (const r of routes) {
+    const dir = r.file.split("/").slice(0, -1).join("/") || ".";
+    let bucket = groups.get(dir);
+    if (!bucket) groups.set(dir, bucket = []);
+    bucket.push(r);
+  }
+  return [...groups.entries()].sort((a, b) => a[0] < b[0] ? -1 : 1).map(([dir, rs]) => voteAuth(dir, rs));
+}
+
+// src/review/dimensions.ts
+var EXEMPT = /* @__PURE__ */ new Set(["config", "shared", "testing"]);
+var PERSISTENCE = /* @__PURE__ */ new Set(["data-access", "infrastructure"]);
+function classifyDataAccess(fileLayer, dependsOnLayers) {
+  if (PERSISTENCE.has(fileLayer) || EXEMPT.has(fileLayer)) return null;
+  const targets = dependsOnLayers.filter((l) => !EXEMPT.has(l) && l !== fileLayer);
+  if (targets.some((l) => PERSISTENCE.has(l))) return "direct-persistence";
+  if (targets.includes("services")) return "via-service";
+  if (targets.includes("domain")) return "via-domain";
+  return "no-data-access";
+}
+function isRegression(actual, dominant) {
+  if (actual !== "direct-persistence") return false;
+  return dominant !== null && dominant !== "direct-persistence";
+}
+function describePattern(pattern) {
+  switch (pattern) {
+    case "direct-persistence":
+      return "reaches persistence directly";
+    case "via-service":
+      return "goes through the service layer";
+    case "via-domain":
+      return "touches only domain types";
+    case "no-data-access":
+      return "does not reach data";
+    default:
+      return pattern;
+  }
+}
+
+// src/review/routes.ts
+var JS_ROUTE = /\b(?:app|router|api|server|r)\s*\.\s*(get|post|put|patch|delete|all|use)\s*\(\s*(['"`])([^'"`]*)\2\s*(,[^)]*)?/i;
+var DECORATOR_ROUTE = /@(?:app\.|router\.)?(Get|Post|Put|Patch|Delete|RequestMapping|GetMapping|PostMapping|PutMapping|DeleteMapping|route)\s*\(\s*(['"`])?([^'"`)]*)\2?/i;
+var DOTNET_ROUTE = /\[\s*Http(Get|Post|Put|Patch|Delete)\s*(?:\(\s*"([^"]*)"\s*\))?\s*\]/i;
+var GO_ROUTE = /\b\w+\s*\.\s*(?:(GET|POST|PUT|PATCH|DELETE)|Handle(?:Func)?)\s*\(\s*"([^"]*)"\s*(,[^)]*)?/;
+var SCOPE_GUARD = /\b(?:use|Use|UseMiddleware|beforeEach|before_request|AddAuthorization|RequireAuthorization)\s*\(/;
+var CLASS_DECLARATION = /\b(?:public\s+|export\s+|abstract\s+)*class\s+\w/;
+var INHERIT_WINDOW = 12;
+var SUPPORTED = /\.(ts|tsx|js|jsx|mjs|cjs|mts|cts|cs|py|go|java|kt|rb|php)$/i;
+function methodOf(raw) {
+  const m = raw.toUpperCase().replace(/MAPPING$/, "").replace(/^REQUEST$/, "ALL");
+  return m === "ROUTE" || m === "HANDLE" || m === "HANDLEFUNC" ? "ALL" : m;
+}
+function extractRoutes(file, text) {
+  if (!SUPPORTED.test(file)) return [];
+  const lines = text.split("\n");
+  const routes = [];
+  const classGuards = [];
+  for (let i = 0; i < lines.length; i++) {
+    if (!CLASS_DECLARATION.test(lines[i])) continue;
+    for (let j = i - 1; j >= 0; j--) {
+      const above = lines[j].trim();
+      if (!above.startsWith("@") && !above.startsWith("[")) break;
+      if (looksLikeGuard(above)) classGuards.push(above);
+    }
+  }
+  const scopeGuards = [];
+  for (let i = 0; i < lines.length; i++) {
+    const line = lines[i];
+    if (SCOPE_GUARD.test(line)) scopeGuards.push({ line: i, text: line.trim() });
+    const js = JS_ROUTE.exec(line);
+    const decorator = js ? null : DECORATOR_ROUTE.exec(line);
+    const dotnet = js || decorator ? null : DOTNET_ROUTE.exec(line);
+    const go = js || decorator || dotnet ? null : GO_ROUTE.exec(line);
+    if (!js && !decorator && !dotnet && !go) continue;
+    let method;
+    let routePath;
+    let inlineTail = "";
+    if (js) {
+      if (js[1].toLowerCase() === "use") continue;
+      method = methodOf(js[1]);
+      routePath = js[3] ?? "";
+      inlineTail = js[4] ?? "";
+    } else if (decorator) {
+      method = methodOf(decorator[1]);
+      routePath = decorator[3] ?? "";
+      inlineTail = looksLikeGuard(line) ? line : "";
+    } else if (dotnet) {
+      method = methodOf(dotnet[1]);
+      routePath = dotnet[2] ?? "";
+      inlineTail = looksLikeGuard(line) ? line : "";
+    } else {
+      method = methodOf(go[1] ?? "ALL");
+      routePath = go[2] ?? "";
+      inlineTail = go[3] ?? "";
+    }
+    const attached = [];
+    for (let j = i - 1; j >= 0; j--) {
+      const above = lines[j].trim();
+      if (above.startsWith("@") || above.startsWith("[")) attached.unshift(above);
+      else break;
+    }
+    const tailArgs = inlineTail.replace(/^\s*,/, "").split(",").map((a) => a.trim()).filter((a) => a.length > 0);
+    const middlewareArgs = tailArgs.slice(0, -1);
+    const inline = [...middlewareArgs, ...attached].filter((t) => t.trim().length > 0);
+    routes.push({
+      path: routePath,
+      file,
+      line: i + 1,
+      method,
+      inlineGuards: inline,
+      inheritedGuards: [
+        ...classGuards,
+        ...scopeGuards.filter((g) => i - g.line <= INHERIT_WINDOW || g.line < 20).map((g) => g.text)
+      ],
+      explicitlyPublic: [line, ...attached].some((t) => PUBLIC_MARKER.test(t)),
+      unreadable: false
+    });
+  }
+  return routes;
+}
+function looksLikeRouteFile(text) {
+  return /\b(app|router|route|controller|handler|endpoint|@Get|@Post|HttpGet|HttpPost|HandleFunc)\b/i.test(
+    text
+  );
+}
+function routesForFile(file, text) {
+  const routes = extractRoutes(file, text);
+  if (routes.length > 0) return routes;
+  if (!SUPPORTED.test(file) || !looksLikeRouteFile(text)) return [];
+  return [
+    {
+      path: "",
+      file,
+      line: 1,
+      method: "ALL",
+      inlineGuards: [],
+      inheritedGuards: [],
+      explicitlyPublic: false,
+      unreadable: true
+    }
+  ];
+}
+
+// src/review/similarity.ts
+var SHINGLE_SIZE = 5;
+var MINHASH_PERMUTATIONS = 128;
+var LSH_BANDS = 16;
+var LSH_ROWS = 8;
+var LCS_THRESHOLD = 0.6;
+var MAX_CANDIDATES = 20;
+var MIN_CALL_OVERLAP = 0.8;
+var MIN_TOKENS = 12;
+var PUNCTUATION = /^[{}()[\];,.]$|^=>$|^[=!<>]=+$|^[+\-*/%&|^!<>?:]+$/;
+function hasSubstance(tokens) {
+  const meaningful = tokens.filter((t) => !PUNCTUATION.test(t));
+  if (meaningful.length < MIN_TOKENS) return false;
+  const BRANCHING = /* @__PURE__ */ new Set(["if", "else", "for", "while", "do", "switch", "case", "try", "catch", "elif"]);
+  const branches = meaningful.filter((t) => BRANCHING.has(t)).length;
+  const distinctCalls = new Set(meaningful.filter((t) => t.startsWith("CALL:"))).size;
+  return branches > 0 || distinctCalls > 1;
+}
+function normalizeTokens(text) {
+  const withoutComments = text.replace(/\/\*[\s\S]*?\*\//g, " ").replace(/\/\/[^\n]*/g, " ").replace(/#[^\n]*/g, " ");
+  const tokens = [];
+  const pattern = /([A-Za-z_$][\w$]*)\s*\(|([A-Za-z_$][\w$]*)|(["'`])(?:\\.|(?!\3)[^\\])*\3|(\d[\d._]*)|([{}()[\];,.]|=>|[=!<>]=+|[+\-*/%&|^!<>?:]+)/g;
+  const KEYWORDS = /* @__PURE__ */ new Set([
+    "if",
+    "else",
+    "for",
+    "while",
+    "do",
+    "switch",
+    "case",
+    "return",
+    "try",
+    "catch",
+    "finally",
+    "throw",
+    "await",
+    "async",
+    "function",
+    "const",
+    "let",
+    "var",
+    "new",
+    "class",
+    "def",
+    "elif",
+    "except",
+    "raise",
+    "yield",
+    "match",
+    "foreach",
+    "using"
+  ]);
+  const DECLARATORS = /* @__PURE__ */ new Set(["function", "def", "class", "fn", "func", "sub", "method"]);
+  let m;
+  while ((m = pattern.exec(withoutComments)) !== null) {
+    const previous = tokens[tokens.length - 1];
+    if (m[1] !== void 0) {
+      if (KEYWORDS.has(m[1])) tokens.push(m[1]);
+      else if (previous !== void 0 && DECLARATORS.has(previous)) tokens.push("DECL");
+      else tokens.push(`CALL:${m[1]}`);
+    } else if (m[2] !== void 0) {
+      tokens.push(KEYWORDS.has(m[2]) ? m[2] : "ID");
+    } else if (m[3] !== void 0) {
+      tokens.push("STR");
+    } else if (m[4] !== void 0) {
+      tokens.push("NUM");
+    } else if (m[5] !== void 0) {
+      tokens.push(m[5]);
+    }
+  }
+  return tokens;
+}
+function shingles(tokens, k = SHINGLE_SIZE) {
+  if (tokens.length < k) return tokens.length > 0 ? [tokens.join(" ")] : [];
+  const out = [];
+  for (let i = 0; i + k <= tokens.length; i++) out.push(tokens.slice(i, i + k).join(" "));
+  return out;
+}
+function fnv1a(input, seed) {
+  let h = (2166136261 ^ seed) >>> 0;
+  for (let i = 0; i < input.length; i++) {
+    h ^= input.charCodeAt(i);
+    h = Math.imul(h, 16777619) >>> 0;
+  }
+  return h >>> 0;
+}
+function minhash(shingleSet, permutations = MINHASH_PERMUTATIONS) {
+  const signature = new Array(permutations).fill(4294967295);
+  for (const shingle of shingleSet) {
+    for (let p = 0; p < permutations; p++) {
+      const h = fnv1a(shingle, p);
+      if (h < signature[p]) signature[p] = h;
+    }
+  }
+  return signature;
+}
+function callVocabulary(tokens) {
+  return new Set(tokens.filter((t) => t.startsWith("CALL:")));
+}
+function callOverlap(a, b) {
+  const x = callVocabulary(a);
+  const y = callVocabulary(b);
+  if (x.size === 0 && y.size === 0) return 0;
+  let shared = 0;
+  for (const call of x) if (y.has(call)) shared++;
+  return shared / (/* @__PURE__ */ new Set([...x, ...y])).size;
+}
+function jaccard(a, b) {
+  if (a.length === 0 || a.length !== b.length) return 0;
+  let same = 0;
+  for (let i = 0; i < a.length; i++) if (a[i] === b[i]) same++;
+  return same / a.length;
+}
+function bandKeys(signature, bands = LSH_BANDS, rows = LSH_ROWS) {
+  const keys = [];
+  for (let b = 0; b < bands; b++) {
+    const slice = signature.slice(b * rows, (b + 1) * rows);
+    if (slice.length === 0) break;
+    keys.push(`${b}:${fnv1a(slice.join(","), 0)}`);
+  }
+  return keys;
+}
+function lcsRatio(a, b, cap = 400) {
+  const x = a.slice(0, cap);
+  const y = b.slice(0, cap);
+  if (x.length === 0 || y.length === 0) return 0;
+  let previous = new Array(y.length + 1).fill(0);
+  let current = new Array(y.length + 1).fill(0);
+  for (let i = 1; i <= x.length; i++) {
+    for (let j = 1; j <= y.length; j++) {
+      current[j] = x[i - 1] === y[j - 1] ? previous[j - 1] + 1 : Math.max(previous[j], current[j - 1]);
+    }
+    [previous, current] = [current, previous];
+    current.fill(0);
+  }
+  return previous[y.length] / Math.max(x.length, y.length);
+}
+var SimilarityIndex = class {
+  bodies = /* @__PURE__ */ new Map();
+  bands = /* @__PURE__ */ new Map();
+  add(body) {
+    const tokens = normalizeTokens(body.text);
+    if (!hasSubstance(tokens)) return;
+    const signature = minhash(shingles(tokens));
+    const indexed = { ...body, tokens, signature };
+    this.bodies.set(body.id, indexed);
+    for (const key of bandKeys(signature)) {
+      let bucket = this.bands.get(key);
+      if (!bucket) this.bands.set(key, bucket = []);
+      bucket.push(body.id);
+    }
+  }
+  get size() {
+    return this.bodies.size;
+  }
+  /**
+   * Bodies similar to `query`, best first. `excludeIds` drops the query's own
+   * entry (and anything else the caller knows is the same thing).
+   */
+  find(query, excludeIds = /* @__PURE__ */ new Set()) {
+    const tokens = normalizeTokens(query.text);
+    if (!hasSubstance(tokens)) return [];
+    const signature = minhash(shingles(tokens));
+    const candidateIds = /* @__PURE__ */ new Set();
+    for (const key of bandKeys(signature)) {
+      for (const id of this.bands.get(key) ?? []) {
+        if (id !== query.id && !excludeIds.has(id)) candidateIds.add(id);
+      }
+    }
+    const ranked = [...candidateIds].map((id) => this.bodies.get(id)).sort((a, b) => jaccard(signature, b.signature) - jaccard(signature, a.signature)).slice(0, MAX_CANDIDATES);
+    const hits = [];
+    for (const candidate of ranked) {
+      const score = lcsRatio(tokens, candidate.tokens);
+      if (score < LCS_THRESHOLD) continue;
+      if (callOverlap(tokens, candidate.tokens) < MIN_CALL_OVERLAP) continue;
+      hits.push({
+        id: candidate.id,
+        name: candidate.name,
+        file: candidate.file,
+        startLine: candidate.startLine,
+        endLine: candidate.endLine,
+        score
+      });
+    }
+    return hits.sort((a, b) => b.score - a.score || (a.file < b.file ? -1 : 1));
+  }
+};
+function isComparable(file) {
+  const p = file.replace(/\\/g, "/");
+  if (/(^|\/)(__tests__|__mocks__|tests?|spec|fixtures?|vendor|node_modules|dist|build|generated)\//i.test(p)) {
+    return false;
+  }
+  return !/\.(test|spec|d)\.[^.]+$|\.min\.[^.]+$|\.generated\.[^.]+$/i.test(p);
+}
+
+// src/review/assess.ts
+function assessChange(input) {
+  const conflicts = [];
+  const unknowns = [];
+  const haveGraph = input.similarity !== null && input.votes.length > 0;
+  if (!haveGraph) {
+    unknowns.push("No code map was available \u2014 run `vg` to build one so this can compare against the repository.");
+  }
+  const vote = input.group ? input.votes.find((v) => v.group === input.group) : input.votes.find((v) => v.deviators.includes(input.file) || v.exemplars.includes(input.file));
+  const convention = vote && vote.reason === "dominant" && vote.dominant ? {
+    group: vote.group,
+    pattern: vote.dominant,
+    share: vote.share,
+    exemplars: vote.exemplars
+  } : null;
+  if (vote && vote.reason === "no_convention") {
+    unknowns.push(
+      `${vote.group} has no convention \u2014 its peers are split, so there is no house style to match. Pick the shape that matches the declared target.`
+    );
+  }
+  const proposedPattern = inferProposedPattern(input.content, input.dataAccess);
+  if (convention && proposedPattern) {
+    if (isRegression(proposedPattern, convention.pattern)) {
+      conflicts.push({
+        kind: "peer_deviation",
+        severity: input.declaredTarget ? "high" : "medium",
+        message: `This ${describePattern(proposedPattern)}, while ${(convention.share * 100).toFixed(0)}% of its peers in ${convention.group} ${describePattern(convention.pattern)}.`,
+        referenceFiles: convention.exemplars.slice(0, 3),
+        protectedRule: false
+      });
+    }
+  } else if (!convention && proposedPattern === "direct-persistence") {
+    unknowns.push(
+      "No peer convention could be established for this file, so reaching persistence directly is neither confirmed as normal here nor flagged as a deviation."
+    );
+  }
+  for (const route of routesForFile(input.file, input.content)) {
+    const verdict = classifyRoute(route);
+    if (verdict.verdict === "unsure") {
+      unknowns.push(
+        `A route in this file could not be classified as guarded or open (${verdict.rule}).`
+      );
+      continue;
+    }
+    if (verdict.verdict !== "not-auth") continue;
+    if (!/^(POST|PUT|PATCH|DELETE|ALL)$/i.test(route.method)) continue;
+    const share = input.guardedShare;
+    const dominantlyGuarded = share && share.classified > 0 && share.guarded / share.classified >= 0.75;
+    if (!dominantlyGuarded) {
+      unknowns.push(
+        `${route.method} ${route.path || input.file} has no guard, and there are too few classified peer routes to say whether that is the convention here.`
+      );
+      continue;
+    }
+    conflicts.push({
+      kind: "unguarded_route",
+      severity: "high",
+      message: `${route.method} ${route.path || input.file} would have no authorization guard, while ${share.guarded} of ${share.classified} mutating routes alongside it do.`,
+      referenceFiles: [],
+      // This maps to a protected rule: if it lands, `vg review` cannot pass it.
+      protectedRule: true
+    });
+  }
+  const duplicateOf = [];
+  if (input.similarity && isComparable(input.file)) {
+    const query = {
+      id: `__proposed__:${input.file}`,
+      name: "(proposed)",
+      file: input.file,
+      startLine: 1,
+      endLine: input.content.split("\n").length,
+      text: input.content
+    };
+    for (const hit of input.similarity.find(query).filter((h) => isComparable(h.file))) {
+      duplicateOf.push({ name: hit.name, file: hit.file, startLine: hit.startLine, score: hit.score });
+    }
+  }
+  const status = !haveGraph ? "no_baseline" : unknowns.length > 0 ? "partial" : "ok";
+  return {
+    status,
+    // `ok` is about the change, not the lookup — a `no_baseline` run with no
+    // conflicts is not an endorsement, and the status is what says so.
+    ok: conflicts.length === 0 && duplicateOf.length === 0,
+    conflicts,
+    duplicateOf,
+    convention,
+    declaredTarget: input.declaredTarget,
+    unknowns,
+    confidence: confidenceOf(status, convention, conflicts.length)
+  };
+}
+function inferProposedPattern(content, dataAccess) {
+  const imports = [...content.matchAll(/(?:from|import|require)\s*\(?\s*['"]([^'"]+)['"]/g)].map(
+    (m) => m[1]
+  );
+  if (imports.length === 0) return null;
+  let sawPersistence = false;
+  let sawService = false;
+  for (const specifier of imports) {
+    const base = specifier.replace(/^.*\//, "").replace(/\.(js|ts|mjs|cjs)$/, "").toLowerCase();
+    for (const [path12, pattern] of dataAccess) {
+      const target = path12.replace(/^.*\//, "").replace(/\.[^.]+$/, "").toLowerCase();
+      if (target !== base) continue;
+      if (pattern === "direct-persistence" && /repositor|dao|store|entity|model/.test(target)) {
+        sawPersistence = true;
+      }
+      if (/service|usecase|application|handler/.test(target)) sawService = true;
+    }
+    if (/repositor|dao|persistence|entity/.test(base)) sawPersistence = true;
+    if (/service|usecase/.test(base)) sawService = true;
+  }
+  if (sawPersistence) return "direct-persistence";
+  if (sawService) return "via-service";
+  return null;
+}
+function confidenceOf(status, convention, conflictCount) {
+  if (status === "no_baseline") return 0.2;
+  let confidence = status === "ok" ? 0.8 : 0.6;
+  if (convention) confidence += 0.1;
+  if (conflictCount === 0 && !convention) confidence -= 0.2;
+  return Math.max(0, Math.min(1, Number(confidence.toFixed(2))));
+}
+
+// src/review/dominance.ts
+var MIN_GROUP_SIZE = 3;
+var DOMINANCE_SHARE = 0.7;
+var ENTROPY_NO_CONVENTION = 0.8;
+var NO_CONVENTION_MIN_FILES = 5;
+var TEMPORAL_HALF_LIFE_DAYS = 90;
+var INTENT_BOOST = 1.5;
+function temporalWeight(daysSinceCommit, halfLifeDays = TEMPORAL_HALF_LIFE_DAYS) {
+  if (daysSinceCommit === null || !Number.isFinite(daysSinceCommit)) return 1;
+  const days = Math.max(0, daysSinceCommit);
+  return 2 * Math.exp(-Math.LN2 * days / halfLifeDays);
+}
+function normalizedEntropy(tally) {
+  const values = Object.values(tally).filter((v) => v > 0);
+  if (values.length <= 1) return 0;
+  const total = values.reduce((a, b) => a + b, 0);
+  if (total <= 0) return 0;
+  let h = 0;
+  for (const v of values) {
+    const p = v / total;
+    h -= p * Math.log(p);
+  }
+  return h / Math.log(values.length);
+}
+function voteGroup(files, opts = {}) {
+  const minGroupSize = opts.minGroupSize ?? MIN_GROUP_SIZE;
+  const dominanceShare = opts.dominanceShare ?? DOMINANCE_SHARE;
+  const declared = new Set(opts.declaredPatterns ?? []);
+  const group = files[0]?.group ?? "";
+  const groupKind = files[0]?.groupKind ?? "directory";
+  const tally = {};
+  for (const f of files) {
+    const boost = declared.has(f.pattern) ? INTENT_BOOST : 1;
+    tally[f.pattern] = (tally[f.pattern] ?? 0) + temporalWeight(f.daysSinceCommit) * boost;
+  }
+  const base = {
+    group,
+    groupKind,
+    size: files.length,
+    tally,
+    entropy: normalizedEntropy(tally),
+    exemplars: [],
+    deviators: []
+  };
+  if (files.length < minGroupSize) {
+    return { ...base, dominant: null, share: 0, reason: "group_too_small" };
+  }
+  const total = Object.values(tally).reduce((a, b) => a + b, 0);
+  const ranked = Object.entries(tally).sort((a, b) => b[1] - a[1] || (a[0] < b[0] ? -1 : 1));
+  const [leader, leaderWeight] = ranked[0];
+  const share = total > 0 ? leaderWeight / total : 0;
+  const distinctPatterns = Object.values(tally).filter((v) => v > 0).length;
+  if (distinctPatterns >= 3 && base.entropy > ENTROPY_NO_CONVENTION) {
+    return {
+      ...base,
+      dominant: null,
+      share,
+      reason: files.length >= NO_CONVENTION_MIN_FILES ? "no_convention" : "no_clear_leader"
+    };
+  }
+  if (share < dominanceShare) {
+    return { ...base, dominant: null, share, reason: "no_clear_leader" };
+  }
+  const following = files.filter((f) => f.pattern === leader);
+  return {
+    ...base,
+    dominant: leader,
+    share,
+    reason: "dominant",
+    // Most recently touched first — the best example is a live one.
+    exemplars: [...following].sort((a, b) => (a.daysSinceCommit ?? 1e9) - (b.daysSinceCommit ?? 1e9)).slice(0, 3).map((f) => f.path),
+    deviators: files.filter((f) => f.pattern !== leader).map((f) => f.path).sort()
+  };
+}
+function voteAll(files, opts = {}) {
+  const groups = /* @__PURE__ */ new Map();
+  for (const f of files) {
+    let bucket = groups.get(f.group);
+    if (!bucket) groups.set(f.group, bucket = []);
+    bucket.push(f);
+  }
+  return [...groups.entries()].sort((a, b) => a[0] < b[0] ? -1 : 1).map(([, bucket]) => voteGroup(bucket, opts));
+}
+function defaultRun(args, cwd) {
+  const res = spawnSync("git", args, {
+    cwd,
+    encoding: "utf8",
+    timeout: 2e4,
+    maxBuffer: 64 * 1024 * 1024,
+    windowsHide: true
+  });
+  return { stdout: res.stdout ?? "", status: res.status ?? 1 };
+}
+function isGitRepo(root, run = defaultRun) {
+  return run(["rev-parse", "--git-dir"], root).status === 0;
+}
+function gitTopLevel(root, run = defaultRun) {
+  const res = run(["rev-parse", "--show-toplevel"], root);
+  const top = res.stdout.trim();
+  return res.status === 0 && top ? top : root;
+}
+function normalizeRemote(url) {
+  const raw = url.trim();
+  if (!raw) return null;
+  const scp = raw.match(/^[^@/]+@([^:]+):(.+)$/);
+  if (scp) return `${scp[1]}/${scp[2]}`.replace(/\.git$/, "");
+  const m = raw.match(/^[a-z+]+:\/\/(?:[^@/]*@)?([^/]+)\/(.+)$/i);
+  if (m) return `${m[1]}/${m[2]}`.replace(/\.git$/, "");
+  return raw.replace(/\.git$/, "");
+}
+function repoKey(remote, root) {
+  return digestString(`vg.review.repo\0${remote ?? `local:${root}`}`);
+}
+function parseNumstat(out) {
+  const map = /* @__PURE__ */ new Map();
+  for (const line of out.split("\n")) {
+    if (!line.trim()) continue;
+    const parts = line.split("	");
+    if (parts.length < 3) continue;
+    const added = parts[0] === "-" ? 0 : Number(parts[0]);
+    const removed = parts[1] === "-" ? 0 : Number(parts[1]);
+    const path12 = parts.length >= 4 ? parts[3] : parts[2];
+    const op = parts.length >= 4 ? "renamed" : removed > 0 && added === 0 ? "modified" : "modified";
+    map.set(path12, { added, removed, op });
+  }
+  return map;
+}
+function opFromStatusLetters(letters) {
+  if (letters.includes("R")) return "renamed";
+  if (letters.includes("A") || letters.includes("?")) return "added";
+  if (letters.includes("D")) return "removed";
+  return "modified";
+}
+function parsePorcelainStatus(out) {
+  const map = /* @__PURE__ */ new Map();
+  for (const line of out.split("\n")) {
+    if (!line.trim()) continue;
+    const letters = line.slice(0, 2);
+    const rest = line.slice(3);
+    const raw = rest.includes(" -> ") ? rest.split(" -> ")[1] : rest;
+    map.set(raw.replace(/^"|"$/g, ""), opFromStatusLetters(letters));
+  }
+  return map;
+}
+function parseDiffNameStatus(out) {
+  const map = /* @__PURE__ */ new Map();
+  for (const line of out.split("\n")) {
+    if (!line.trim()) continue;
+    const parts = line.split("	");
+    if (parts.length < 2) continue;
+    const letters = parts[0];
+    const path12 = parts.length >= 3 ? parts[2] : parts[1];
+    map.set(path12.replace(/^"|"$/g, ""), opFromStatusLetters(letters));
+  }
+  return map;
+}
+function parseHunks(diff) {
+  const map = /* @__PURE__ */ new Map();
+  let current = null;
+  for (const line of diff.split("\n")) {
+    if (line.startsWith("+++ ")) {
+      const p = line.slice(4).trim();
+      current = p === "/dev/null" ? null : p.replace(/^b\//, "");
+      if (current && !map.has(current)) map.set(current, []);
+      continue;
+    }
+    if (current && line.startsWith("@@")) {
+      const m = line.match(/@@ -\d+(?:,\d+)? \+(\d+)(?:,(\d+))? @@/);
+      if (m) {
+        const start = Number(m[1]);
+        const count = m[2] === void 0 ? 1 : Number(m[2]);
+        if (count > 0) map.get(current).push({ start, end: start + count - 1 });
+      }
+    }
+  }
+  return map;
+}
+function readBaseFileTexts(change, run = defaultRun) {
+  const out = /* @__PURE__ */ new Map();
+  const base = change.baseSha;
+  if (!base) return out;
+  for (const file of change.files) {
+    if (file.op === "added") continue;
+    const spec = `${base}:${file.path.replace(/\\/g, "/")}`;
+    const res = run(["show", spec], change.topLevel);
+    if (res.status === 0 && res.stdout.length <= 2 * 1024 * 1024) {
+      out.set(file.path.replace(/\\/g, "/"), res.stdout);
+    }
+  }
+  return out;
+}
+function collectChangeSet(root, base, run = defaultRun) {
+  const topLevel = gitTopLevel(root, run);
+  const headSha = run(["rev-parse", "HEAD"], root).stdout.trim();
+  const refRaw = run(["rev-parse", "--abbrev-ref", "HEAD"], root).stdout.trim();
+  const ref = !refRaw || refRaw === "HEAD" ? null : `refs/heads/${refRaw}`;
+  const remoteRaw = run(["config", "--get", "remote.origin.url"], root);
+  const remote = remoteRaw.status === 0 ? normalizeRemote(remoteRaw.stdout) : null;
+  if (base) {
+    const mb = run(["merge-base", "HEAD", base], root);
+    const mergeBase = mb.status === 0 ? mb.stdout.trim() : null;
+    const baseSha = mergeBase ?? run(["rev-parse", base], root).stdout.trim();
+    const numstat2 = parseNumstat(run(["diff", "--numstat", "-M", `${baseSha}..HEAD`], root).stdout);
+    const status2 = parseDiffNameStatus(run(["diff", "--name-status", "-M", `${baseSha}..HEAD`], root).stdout);
+    const hunks2 = parseHunks(run(["diff", "-U0", "-M", `${baseSha}..HEAD`], root).stdout);
+    return {
+      topLevel,
+      baseSha,
+      headSha,
+      mergeBase,
+      ref,
+      dirty: false,
+      dirtyTreeHash: null,
+      files: mergeFiles(numstat2, status2, hunks2),
+      remote
+    };
+  }
+  const numstat = parseNumstat(run(["diff", "--numstat", "-M", "HEAD"], root).stdout);
+  const status = parsePorcelainStatus(run(["status", "--porcelain", "-uall"], root).stdout);
+  const hunks = parseHunks(run(["diff", "-U0", "-M", "HEAD"], root).stdout);
+  const files = mergeFiles(numstat, status, hunks);
+  const dirty = files.length > 0;
+  return {
+    topLevel,
+    baseSha: headSha,
+    headSha,
+    mergeBase: null,
+    ref,
+    dirty,
+    // Identifies *which* dirty state was reviewed, so two reviews of the same
+    // uncommitted work dedupe and a later edit produces a new receipt.
+    dirtyTreeHash: dirty ? dirtyTreeHash(files) : null,
+    files,
+    remote
+  };
+}
+var NOT_REVIEWABLE = /(^|\/)(\.vibgrate|node_modules|dist|build|out|target|bin|obj|coverage|\.next|\.turbo|vendor)\//;
+function isReviewable(path12) {
+  return !NOT_REVIEWABLE.test(path12.replace(/\\/g, "/"));
+}
+function mergeFiles(numstat, status, hunks) {
+  const paths = /* @__PURE__ */ new Set([...numstat.keys(), ...status.keys()]);
+  const files = [];
+  for (const path12 of paths) {
+    const n = numstat.get(path12);
+    files.push({
+      path: path12,
+      op: status.get(path12) ?? n?.op ?? "modified",
+      addedLines: n?.added ?? 0,
+      removedLines: n?.removed ?? 0,
+      hunks: hunks.get(path12) ?? []
+    });
+  }
+  return files.filter((f) => isReviewable(f.path)).sort((a, b) => a.path < b.path ? -1 : a.path > b.path ? 1 : 0);
+}
+function dirtyTreeHash(files) {
+  return digestString(
+    files.map((f) => `${f.path}\0${f.op}\0${f.addedLines}\0${f.removedLines}\0${f.hunks.map((h) => `${h.start}-${h.end}`).join(",")}`).join("\n")
+  );
+}
+function fileRecencyDays(root, opts = {}, run = defaultRun) {
+  const sinceDays = opts.sinceDays ?? 730;
+  const nowSec = Math.floor((opts.now ?? Date.now()) / 1e3);
+  const out = /* @__PURE__ */ new Map();
+  const res = run(
+    ["log", `--since=${sinceDays}.days.ago`, "--name-only", "--pretty=format:%ct", "--no-merges"],
+    root
+  );
+  if (res.status !== 0) return out;
+  let currentTs = null;
+  for (const line of res.stdout.split("\n")) {
+    const trimmed = line.trim();
+    if (!trimmed) continue;
+    if (/^\d{9,}$/.test(trimmed)) {
+      currentTs = Number(trimmed);
+      continue;
+    }
+    if (currentTs === null) continue;
+    if (out.has(trimmed)) continue;
+    out.set(trimmed, Math.max(0, (nowSec - currentTs) / 86400));
+  }
+  return out;
+}
+var INTENT_FILES = [
+  "CLAUDE.md",
+  "AGENTS.md",
+  ".cursorrules",
+  ".github/copilot-instructions.md",
+  "CONTRIBUTING.md"
+];
+var MAX_INTENT_BYTES = 256 * 1024;
+var PATTERN_VOCABULARY = [
+  { pattern: "clean", match: /\bclean architecture\b/i },
+  { pattern: "hexagonal", match: /\bhexagonal\b|\bports?\s+and\s+adapters?\b/i },
+  { pattern: "onion", match: /\bonion architecture\b/i },
+  { pattern: "layered", match: /\blayered architecture\b|\bn-tier\b|\bthree-tier\b/i },
+  { pattern: "vertical-slice", match: /\bvertical slices?\b|\bfeature slices?\b/i },
+  { pattern: "mvc", match: /\bMVC\b/ },
+  { pattern: "mvvm", match: /\bMVVM\b/ }
+];
+function readDeclaredIntent(root, files = INTENT_FILES) {
+  const patterns = /* @__PURE__ */ new Set();
+  const sources = [];
+  const citations = [];
+  for (const rel of files) {
+    const abs = path4.join(root, rel);
+    let text;
+    try {
+      const stat = fs.statSync(abs);
+      if (!stat.isFile() || stat.size > MAX_INTENT_BYTES) continue;
+      text = fs.readFileSync(abs, "utf8");
+    } catch {
+      continue;
+    }
+    let matchedHere = false;
+    const lines = text.split("\n");
+    for (let i = 0; i < lines.length; i++) {
+      for (const { pattern, match } of PATTERN_VOCABULARY) {
+        if (!match.test(lines[i])) continue;
+        patterns.add(pattern);
+        matchedHere = true;
+        if (citations.length < 12) {
+          citations.push({ file: rel, line: i + 1, text: lines[i].trim().slice(0, 200) });
+        }
+      }
+    }
+    if (matchedHere) sources.push(rel);
+  }
+  return { patterns: [...patterns].sort(), sources, citations };
+}
+
+// src/review/mcp-assess.ts
+var cache = /* @__PURE__ */ new Map();
+var BOUNDARY_EDGE_KINDS = /* @__PURE__ */ new Set(["import", "call"]);
+var FUNCTION_KINDS = /* @__PURE__ */ new Set(["function", "method"]);
+var ROUTE_LAYERS = /* @__PURE__ */ new Set(["routing", "middleware", "presentation"]);
+var MAX_ROUTE_FILES = 300;
+function buildBaseline(graph, root) {
+  const nodeById = new Map(graph.nodes.map((n) => [n.id, n]));
+  const normalize = (p) => p.replace(/\\/g, "/");
+  const layerCache = /* @__PURE__ */ new Map();
+  const layerOf = (p) => {
+    if (layerCache.has(p)) return layerCache.get(p);
+    const cls = classifyFile(p, "unknown");
+    const layer = cls?.layer ?? null;
+    layerCache.set(p, layer);
+    return layer;
+  };
+  const outgoing = /* @__PURE__ */ new Map();
+  for (const edge of graph.edges) {
+    if (!BOUNDARY_EDGE_KINDS.has(edge.kind)) continue;
+    const src = nodeById.get(edge.src);
+    const dst = nodeById.get(edge.dst);
+    if (!src || !dst) continue;
+    const from = normalize(src.file);
+    const to = normalize(dst.file);
+    if (from === to) continue;
+    const toLayer = layerOf(to);
+    if (!toLayer) continue;
+    let set = outgoing.get(from);
+    if (!set) outgoing.set(from, set = /* @__PURE__ */ new Set());
+    set.add(toLayer);
+  }
+  const areaOfFile = /* @__PURE__ */ new Map();
+  for (const area of graph.areas) {
+    for (const member of area.members) {
+      const node = nodeById.get(member);
+      if (node) areaOfFile.set(normalize(node.file), area.id);
+    }
+  }
+  const files = [...new Set(graph.nodes.map((n) => normalize(n.file)))].sort();
+  const recency = fileRecencyDays(root);
+  const intent = readDeclaredIntent(root);
+  const dataAccess = /* @__PURE__ */ new Map();
+  const candidates = [];
+  for (const file of files) {
+    const cls = classifyFile(file, "unknown");
+    if (!cls) continue;
+    const pattern = classifyDataAccess(cls.layer, [...outgoing.get(file) ?? []]);
+    if (!pattern) continue;
+    dataAccess.set(file, pattern);
+    const areaId = areaOfFile.get(file);
+    const role = cls.role ?? cls.layer;
+    candidates.push({
+      path: file,
+      pattern,
+      role,
+      areaGroup: areaId !== void 0 ? `area:${areaId}:${role}` : null
+    });
+  }
+  const areaCounts = /* @__PURE__ */ new Map();
+  for (const c of candidates) {
+    if (c.areaGroup) areaCounts.set(c.areaGroup, (areaCounts.get(c.areaGroup) ?? 0) + 1);
+  }
+  const peerFiles = candidates.map((c) => {
+    const useArea = c.areaGroup !== null && (areaCounts.get(c.areaGroup) ?? 0) >= MIN_GROUP_SIZE;
+    return {
+      path: c.path,
+      pattern: c.pattern,
+      group: useArea ? c.areaGroup : `role:${c.role}`,
+      groupKind: useArea ? "area" : "role",
+      daysSinceCommit: recency.get(c.path) ?? null
+    };
+  });
+  const similarity = new SimilarityIndex();
+  const lineCache = /* @__PURE__ */ new Map();
+  const linesOf = (rel) => {
+    if (lineCache.has(rel)) return lineCache.get(rel);
+    let value = null;
+    try {
+      const abs = path4.join(root, rel);
+      const stat = fs.statSync(abs);
+      if (stat.isFile() && stat.size <= 1024 * 1024) value = fs.readFileSync(abs, "utf8").split("\n");
+    } catch {
+      value = null;
+    }
+    lineCache.set(rel, value);
+    return value;
+  };
+  for (const node of graph.nodes) {
+    if (!FUNCTION_KINDS.has(node.kind)) continue;
+    const rel = normalize(node.file);
+    if (!isComparable(rel)) continue;
+    const lines = linesOf(rel);
+    if (!lines) continue;
+    const text = lines.slice(node.span.start - 1, node.span.end).join("\n");
+    if (!text.trim()) continue;
+    const body = {
+      id: node.id,
+      name: node.name,
+      file: rel,
+      startLine: node.span.start,
+      endLine: node.span.end,
+      text
+    };
+    similarity.add(body);
+  }
+  const guardedByDirectory = /* @__PURE__ */ new Map();
+  let routeFiles = 0;
+  for (const file of files) {
+    if (routeFiles >= MAX_ROUTE_FILES) break;
+    const layer = layerOf(file);
+    if (!layer || !ROUTE_LAYERS.has(layer)) continue;
+    const lines = linesOf(file);
+    if (!lines) continue;
+    routeFiles++;
+    const dir = file.split("/").slice(0, -1).join("/") || ".";
+    for (const route of routesForFile(file, lines.join("\n"))) {
+      const verdict = classifyRoute(route);
+      if (verdict.verdict === "unsure") continue;
+      if (!/^(POST|PUT|PATCH|DELETE|ALL)$/i.test(route.method)) continue;
+      const entry = guardedByDirectory.get(dir) ?? { guarded: 0, classified: 0 };
+      entry.classified++;
+      if (verdict.verdict === "auth") entry.guarded++;
+      guardedByDirectory.set(dir, entry);
+    }
+  }
+  return {
+    corpusHash: graph.provenance.corpusHash,
+    votes: voteAll(peerFiles, { declaredPatterns: intent.patterns }),
+    dataAccess,
+    similarity,
+    declaredTarget: intent.patterns[0] ?? null,
+    guardedByDirectory
+  };
+}
+function assessProposedChange(graph, root, file, content) {
+  if (!file) return { error: "bad_request", message: "file is required" };
+  if (!content) return { error: "bad_request", message: "content is required" };
+  const key = path4.resolve(root);
+  let baseline = cache.get(key);
+  if (!baseline || baseline.corpusHash !== graph.provenance.corpusHash) {
+    try {
+      baseline = buildBaseline(graph, root);
+      cache.set(key, baseline);
+    } catch {
+      return {
+        status: "no_baseline",
+        ok: true,
+        conflicts: [],
+        duplicateOf: [],
+        convention: null,
+        declaredTarget: null,
+        unknowns: ["The baseline could not be built from the code map, so nothing was checked."],
+        confidence: 0.2
+      };
+    }
+  }
+  const normalized = file.replace(/\\/g, "/");
+  const cls = classifyFile(normalized, "unknown");
+  const role = cls ? cls.role ?? cls.layer : null;
+  const directory = normalized.split("/").slice(0, -1).join("/") || ".";
+  return assessChange({
+    file: normalized,
+    content,
+    votes: baseline.votes,
+    dataAccess: baseline.dataAccess,
+    similarity: baseline.similarity,
+    declaredTarget: baseline.declaredTarget,
+    // Resolve the peer group the same way the capsule does, preferring the
+    // file's area when it has one and falling back to its role.
+    group: baseline.votes.find((v) => v.exemplars.includes(normalized) || v.deviators.includes(normalized))?.group ?? (role ? `role:${role}` : void 0),
+    guardedShare: baseline.guardedByDirectory.get(directory) ?? null
+  });
+}
 function countTokens(text) {
   return encode(text).length;
 }
@@ -1414,7 +2567,7 @@ function readyEmbedder(local) {
 async function retrieve(graph, question, budget, ctx) {
   let mode = "lexical";
   const topicTags = await loadTopicTags(graph, ctx.root, ctx.graphPath);
-  const modRank = await rankQuestion(graph, question, { limit: 48, topicTags });
+  const modRank = await rankQuestion(graph, rankingAskFrom(question), { limit: 48, topicTags });
   if (ctx.semanticSession && !ctx.local) {
     try {
       const ranked = await withTimeout(
@@ -2158,6 +3311,20 @@ var TOOLS = [
       }
       return answer ?? { error: "not_found" };
     }
+  },
+  {
+    name: "assess_change",
+    description: "Before you write: would this code fit? One call reports whether the proposal conflicts with what its peers do, would add an unguarded route, or re-implements something that already exists \u2014 with the files to follow instead. Ask this while deciding; `vg review` asks the same questions after the fact, when the fix costs more.",
+    inputSchema: obj(
+      {
+        file: { type: "string", description: "repo-relative path the code would live at" },
+        content: { type: "string", maxLength: 2e4, description: "the proposed code" }
+      },
+      ["file", "content"]
+    ),
+    // A thin adapter. Every rule lives in `review/assess.ts`, transport-free, so
+    // the hook, the CLI and this tool cannot drift into three sets of answers.
+    handler: (graph, args, ctx) => assessProposedChange(graph, ctx.root, String(args.file ?? ""), String(args.content ?? ""))
   }
 ];
 var VERBOSITY_BUDGET = { concise: 1500, balanced: 4e3, exhaustive: 12e3 };
@@ -2243,6 +3410,6 @@ function navigationToolsetConfig(serverName = "vibgrate") {
   };
 }
 
-export { FREE_PACK, HOT_TOOLS, TOOLS, assessDocQuality, budgetSuffix, clearStoredCredentials, countTokens, coveringTests, createWorkspaceDsn, credentialsPath, deferredToolNames, detectRunner, dsnCommand, ensureGitignored, fetchHostedDocsCached, findGitRoot, gitignoreEntryForCredentials, homeCredentialsPath, hostedBase, listedToolNames, navigationToolsetConfig, parseDsn, pathDisconnect, projectCredentialsPath, publishPrivateLibrary, pushCommand, readScanArtifact, readStoredCredentials, renderToolResult, resolveDsn, selectForBudget, shortestPath, symbolsFromApi, testsToRun, uploadScanArtifact, warmEmbedderInBackground, writeStoredCredentials };
-//# sourceMappingURL=chunk-TUVB6Q6F.js.map
-//# sourceMappingURL=chunk-TUVB6Q6F.js.map
+export { CAPSULE_BUDGETS, CAPSULE_SCHEMA, FINDINGS_SCHEMA, FREE_PACK, HOT_TOOLS, MAX_ROLE_PEERS, MIN_GROUP_SIZE, RECEIPT_SCHEMA, REVIEW_POLICY_VERSION, SimilarityIndex, TARGET_ALIGNMENTS, TOOLS, assessDocQuality, budgetSuffix, buildEnvelope, classifyDataAccess, classifyRoute, clearStoredCredentials, collectChangeSet, collectSpans, countTokens, coveringTests, createWorkspaceDsn, credentialsPath, defaultRun, deferredToolNames, describePattern, detectRunner, digest, digestString, dsnCommand, ensureGitignored, fetchHostedDocsCached, fileRecencyDays, findGitRoot, gitignoreEntryForCredentials, homeCredentialsPath, hostedBase, isComparable, isGitRepo, isRegression, listedToolNames, navigationToolsetConfig, parseDsn, pathDisconnect, projectCredentialsPath, publishPrivateLibrary, pushCommand, pushReceipt, readBaseFileTexts, readDeclaredIntent, readScanArtifact, readStoredCredentials, receiptDigest, receiptId, rejectPushWhenOffline, renderToolResult, repoKey, resolveDsn, routesForFile, selectForBudget, shortestPath, symbolsFromApi, testsToRun, uploadScanArtifact, voteAll, voteAllAuth, warmEmbedderInBackground, writeStoredCredentials };
+//# sourceMappingURL=chunk-65YN3BG3.js.map
+//# sourceMappingURL=chunk-65YN3BG3.js.map