@securitychecks/cli 0.1.1-rc.1 → 0.2.0

package/dist/index.js

@@ -1,6 +1,6 @@
 #!/usr/bin/env node
 import { Command } from 'commander';
-import pc from 'picocolors';
+import pc2 from 'picocolors';
 import { mkdir, writeFile, readFile, chmod, unlink } from 'fs/promises';
 import { join, resolve, dirname, extname, relative } from 'path';
 import { resolveTargetPath, getInvariantById, ALL_INVARIANTS, collect, loadConfig, DEFAULT_PATTERN_CONFIG, ARTIFACT_SCHEMA_VERSION } from '@securitychecks/collector';
@@ -3311,7 +3311,7 @@ function generateFindingId(finding) {
 }
 
 // src/baseline/storage.ts
-var CLI_VERSION3 = "0.1.1-rc.1";
+var CLI_VERSION3 = "0.2.0";
 var SCHECK_DIR = ".scheck";
 var BASELINE_FILE = "baseline.json";
 var WAIVER_FILE = "waivers.json";
@@ -4045,7 +4045,7 @@ function toObservation(correlation, framework) {
       signals: correlation.compoundingEffect.signals
     },
     meta: {
-      clientVersion: "0.1.1-rc.1",
+      clientVersion: "0.2.0",
       requestId: randomUUID(),
       timestamp: (/* @__PURE__ */ new Date()).toISOString()
     }
@@ -4063,7 +4063,7 @@ async function reportCorrelations(result, config, framework) {
       correlations: observations,
       summary: result.stats,
       meta: {
-        clientVersion: "0.1.1-rc.1",
+        clientVersion: "0.2.0",
         framework
       }
     };
@@ -4075,7 +4075,7 @@ async function reportCorrelations(result, config, framework) {
         headers: {
           "Content-Type": "application/json",
           ...config.apiKey && { Authorization: `Bearer ${config.apiKey}` },
-          "X-Client-Version": "0.1.1-rc.1"
+          "X-Client-Version": "0.2.0"
         },
         body: JSON.stringify(payload),
         signal: controller.signal
@@ -4131,7 +4131,7 @@ function buildTelemetry(result, options) {
     } : void 0,
     meta: {
       duration: result.duration,
-      clientVersion: "0.1.1-rc.1",
+      clientVersion: "0.2.0",
       mode: options.mode ?? (ciProvider ? "ci" : "manual"),
       ciProvider
     },
@@ -4920,6 +4920,35 @@ function indent(text, spaces) {
 function escapeString(text) {
   return text.replace(/\\/g, "\\\\").replace(/'/g, "\\'");
 }
+function getScoreGrade(score) {
+  if (score >= 90) return "A";
+  if (score >= 70) return "B";
+  if (score >= 50) return "C";
+  return "F";
+}
+function computeReadinessScore(summary) {
+  const { total, passed, failed, byPriority } = summary;
+  const hasP0 = byPriority.P0 > 0;
+  if (total === 0) {
+    return { score: 100, grade: "A", total: 0, passed: 0, failed: 0, hasP0: false };
+  }
+  let score = Math.round(100 * passed / total);
+  if (hasP0 && score > 49) {
+    score = 49;
+  }
+  return {
+    score,
+    grade: getScoreGrade(score),
+    total,
+    passed,
+    failed,
+    hasP0
+  };
+}
+function formatScoreForCli(rs) {
+  const gradeColor = rs.grade === "A" ? pc2.green : rs.grade === "B" ? pc2.yellow : rs.grade === "C" ? pc2.red : pc2.red;
+  return gradeColor(`Score: ${rs.score}/100 (${rs.grade})`);
+}
 
 // src/commands/run.ts
 var DEFAULT_ARTIFACT_PATH = ".securitychecks/artifacts.json";
@@ -5084,14 +5113,14 @@ For air-gapped environments, contact sales for an enterprise on-premise license.
     );
   }
   if (!options.quiet) {
-    console.log(pc.dim(`Mode: cloud evaluation (IP protected)`));
+    console.log(pc2.dim(`Mode: cloud evaluation (IP protected)`));
     if (isLocalEndpoint(cloudBaseUrl)) {
-      console.log(pc.yellow("\u26A0 Using local cloud endpoint (dev/test)"));
+      console.log(pc2.yellow("\u26A0 Using local cloud endpoint (dev/test)"));
     }
   }
   const auditArtifact = toArtifact(artifact);
   if (!options.quiet) {
-    console.log(pc.dim(`Evaluating via cloud API...`));
+    console.log(pc2.dim(`Evaluating via cloud API...`));
   }
   const cloudEvalResult = await evaluateCloud(artifact, {
     apiKey: cloudApiKey,
@@ -5104,13 +5133,13 @@ For air-gapped environments, contact sales for an enterprise on-premise license.
   let findings = cloudEvalResult.findings;
   if (!options.quiet) {
     console.log(
-      pc.dim(
+      pc2.dim(
         `Cloud: ${cloudEvalResult.stats.invariantsRun} invariants, ${cloudEvalResult.stats.findingsCount} findings in ${cloudEvalResult.stats.executionMs}ms`
       )
     );
     if (cloudEvalResult.usage.scansRemaining !== Infinity) {
       console.log(
-        pc.dim(`Usage: ${cloudEvalResult.usage.scansUsed} scans used, ${cloudEvalResult.usage.scansRemaining} remaining`)
+        pc2.dim(`Usage: ${cloudEvalResult.usage.scansUsed} scans used, ${cloudEvalResult.usage.scansRemaining} remaining`)
       );
     }
   }
@@ -5150,7 +5179,7 @@ For air-gapped environments, contact sales for an enterprise on-premise license.
     };
     const frameworks = resolveFrameworks(artifact, artifactForPatterns);
     if (!options.quiet && frameworks.length > 0) {
-      console.log(pc.dim(`Frameworks detected: ${frameworks.join(", ")}`));
+      console.log(pc2.dim(`Frameworks detected: ${frameworks.join(", ")}`));
     }
     try {
       const localScanStart = Date.now();
@@ -5158,13 +5187,13 @@ For air-gapped environments, contact sales for an enterprise on-premise license.
       let patternSource = "bundled";
       if (options.patternsFile) {
         if (!options.quiet) {
-          console.log(pc.dim(`Loading patterns from ${options.patternsFile}...`));
+          console.log(pc2.dim(`Loading patterns from ${options.patternsFile}...`));
         }
         patterns = await loadPatternsFromFile(options.patternsFile);
         patternSource = "file";
       } else if (shouldUseDevPatterns()) {
         if (!options.quiet) {
-          console.log(pc.yellow("\u26A0 Using dev test patterns (SECURITYCHECKS_DEV_PATTERNS=1)"));
+          console.log(pc2.yellow("\u26A0 Using dev test patterns (SECURITYCHECKS_DEV_PATTERNS=1)"));
         }
         patterns = getTestPatternsForFrameworks(frameworks);
         patternSource = "dev";
@@ -5175,7 +5204,7 @@ For air-gapped environments, contact sales for an enterprise on-premise license.
         if (patternConfig && !patternConfig.offlineMode) {
           try {
             if (!options.quiet) {
-              console.log(pc.dim(`Fetching Pro Patterns from ${patternConfig.endpoint}...`));
+              console.log(pc2.dim(`Fetching Pro Patterns from ${patternConfig.endpoint}...`));
             }
             const apiPatterns = await fetchPatterns(
               artifactForPatterns,
@@ -5206,7 +5235,7 @@ For air-gapped environments, contact sales for an enterprise on-premise license.
           const sourceLabel = patternSource === "bundled" ? "" : ` (${patternSource})`;
           const localScanMs = Date.now() - localScanStart;
           console.log(
-            pc.dim(`Local scan: ${stats.patternsLoaded} patterns${sourceLabel}, ${stats.matchesFound} match(es) found in ${localScanMs}ms`)
+            pc2.dim(`Local scan: ${stats.patternsLoaded} patterns${sourceLabel}, ${stats.matchesFound} match(es) found in ${localScanMs}ms`)
           );
         }
         const existingKeys = new Set(
@@ -5220,11 +5249,11 @@ For air-gapped environments, contact sales for an enterprise on-premise license.
           }
         }
       } else if (!options.quiet) {
-        console.log(pc.dim(`Local scan: No applicable patterns for detected frameworks`));
+        console.log(pc2.dim(`Local scan: No applicable patterns for detected frameworks`));
       }
     } catch {
       if (!options.quiet) {
-        console.log(pc.dim(`Local scan: Pattern loading failed, using cloud findings only`));
+        console.log(pc2.dim(`Local scan: Pattern loading failed, using cloud findings only`));
       }
     } finally {
       clearPatternCaches();
@@ -5249,13 +5278,15 @@ For air-gapped environments, contact sales for an enterprise on-premise license.
     P1: findings.filter((f) => f.severity === "P1").length,
     P2: findings.filter((f) => f.severity === "P2").length
   };
+  const summaryData = { total: updatedResults.length, passed, failed, waived, byPriority };
+  const readiness = computeReadinessScore(summaryData);
   return {
     result: {
       version: "1.0",
       targetPath,
       runAt: (/* @__PURE__ */ new Date()).toISOString(),
       duration: Date.now() - startTime,
-      summary: { total: updatedResults.length, passed, failed, waived, byPriority },
+      summary: { ...summaryData, score: readiness.score, grade: readiness.grade },
       results: updatedResults,
       artifact: auditArtifact
     },
@@ -5269,19 +5300,19 @@ For air-gapped environments, contact sales for an enterprise on-premise license.
 }
 async function runSingleScan(options) {
   if (!options.quiet) {
-    console.log(pc.bold("\n\u{1F50D} Scanning for invariants AI misses...\n"));
+    console.log(pc2.bold("\n\u{1F50D} Scanning for invariants AI misses...\n"));
   }
   try {
     let artifact;
     if (options.artifact) {
       if (!options.quiet) {
-        console.log(pc.dim(`Loading artifact from ${options.artifact}...`));
+        console.log(pc2.dim(`Loading artifact from ${options.artifact}...`));
       }
       artifact = await loadArtifact(options.artifact);
     } else {
       const targetPath2 = resolveTargetPath(options.path);
       if (!options.quiet) {
-        console.log(pc.dim(`Collecting artifacts from ${targetPath2}...`));
+        console.log(pc2.dim(`Collecting artifacts from ${targetPath2}...`));
       }
       artifact = await collect({
         targetPath: targetPath2,
@@ -5292,16 +5323,16 @@ async function runSingleScan(options) {
         await mkdir(dirname(artifactPath), { recursive: true });
         await writeFile(artifactPath, JSON.stringify(artifact, null, 2), "utf-8");
         if (!options.quiet) {
-          console.log(pc.dim(`Artifact cached at ${DEFAULT_ARTIFACT_PATH}`));
+          console.log(pc2.dim(`Artifact cached at ${DEFAULT_ARTIFACT_PATH}`));
         }
       } catch {
       }
     }
     if (!options.quiet) {
       const schemaVer = artifact.schemaVersion ?? "1.0.0";
-      console.log(pc.dim(`Artifact: v${artifact.version}, schema=${schemaVer}, profile=${artifact.profile}`));
-      console.log(pc.dim(`Codebase: ${artifact.codebase.root}`));
-      console.log(pc.dim(`Files: ${artifact.codebase.filesScanned}, Services: ${artifact.services.length}`));
+      console.log(pc2.dim(`Artifact: v${artifact.version}, schema=${schemaVer}, profile=${artifact.profile}`));
+      console.log(pc2.dim(`Codebase: ${artifact.codebase.root}`));
+      console.log(pc2.dim(`Files: ${artifact.codebase.filesScanned}, Services: ${artifact.services.length}`));
       console.log("");
     }
     const {
@@ -5322,7 +5353,7 @@ async function runSingleScan(options) {
     const categorization = categorizeFindings(allFindings, baseline, waivers);
     const correlationResult = correlateFindings(result.results, result.artifact);
     if (!options.quiet && correlationResult.correlations.length > 0) {
-      console.log(pc.dim(`Correlation: ${correlationResult.stats.correlationGroups} compounding risk group(s) detected`));
+      console.log(pc2.dim(`Correlation: ${correlationResult.stats.correlationGroups} compounding risk group(s) detected`));
     }
     const artifactForFrameworks = {
       version: "1.0",
@@ -5361,18 +5392,18 @@ async function runSingleScan(options) {
         if (calibrationResult.data) {
           aggregateCalibration = calibrationResult.data;
           if (!options.quiet && calibrationResult.data.meta.totalScansAnalyzed > 0) {
-            console.log(pc.dim(`Calibration: Loaded baseline from ${calibrationResult.data.meta.totalScansAnalyzed} scans${calibrationResult.fromCache ? " (cached)" : ""}`));
+            console.log(pc2.dim(`Calibration: Loaded baseline from ${calibrationResult.data.meta.totalScansAnalyzed} scans${calibrationResult.fromCache ? " (cached)" : ""}`));
           }
         }
       } catch {
       }
     }
     if (options.sarif) {
-      const cliVersion = "0.1.1-rc.1";
+      const cliVersion = "0.2.0";
       const sarifOutput = toSarif(result, cliVersion);
       await writeFile(options.sarif, JSON.stringify(sarifOutput, null, 2), "utf-8");
       if (!options.quiet) {
-        console.log(pc.green(`\u2713 SARIF report written to ${options.sarif}`));
+        console.log(pc2.green(`\u2713 SARIF report written to ${options.sarif}`));
       }
     }
     if (options.json) {
@@ -5415,12 +5446,12 @@ async function runSingleScan(options) {
         const isLow = scansRemaining / total <= 0.2;
         const isNthScan = scansUsed % 5 === 0;
         if (isLow || isNthScan) {
-          const color = isLow ? pc.red : pc.yellow;
+          const color = isLow ? pc2.red : pc2.yellow;
           const label = isLow ? "Low quota" : "Quota";
           console.log(color(`\u26A0 ${label}: ${scansUsed} of ${total} scans used this month (${scansRemaining} remaining)`));
-          console.log(pc.dim("  Upgrade at https://securitychecks.ai/pricing"));
+          console.log(pc2.dim("  Upgrade at https://securitychecks.ai/pricing"));
           if (!isLow) {
-            console.log(pc.dim("  Suppress with --no-usage-banner or SECURITYCHECKS_NO_USAGE_BANNER=1"));
+            console.log(pc2.dim("  Suppress with --no-usage-banner or SECURITYCHECKS_NO_USAGE_BANNER=1"));
           }
         }
       }
@@ -5446,13 +5477,13 @@ async function runSingleScan(options) {
     if (options.ci) {
       const exitCode = getCIExitCode(categorization);
       if (exitCode !== 0) {
-        console.log(pc.red(`
+        console.log(pc2.red(`
 ${getCISummary(categorization)}`));
-        console.log(pc.dim("Use `scheck baseline --update` to baseline known issues."));
-        console.log(pc.dim("Use `scheck waive <findingId>` to temporarily waive issues.\n"));
+        console.log(pc2.dim("Use `scheck baseline --update` to baseline known issues."));
+        console.log(pc2.dim("Use `scheck waive <findingId>` to temporarily waive issues.\n"));
         process.exit(exitCode);
       } else {
-        console.log(pc.green(`
+        console.log(pc2.green(`
 ${getCISummary(categorization)}
 `));
       }
@@ -5462,22 +5493,22 @@ ${getCISummary(categorization)}
     if (options.json) {
       console.error(JSON.stringify(cliError.toJSON(), null, 2));
     } else {
-      console.error(pc.red(`
+      console.error(pc2.red(`
 ${cliError.toUserString()}
 `));
       const remediation = cliError.getRemediation();
       if (remediation) {
-        console.error(pc.yellow("How to fix:"));
+        console.error(pc2.yellow("How to fix:"));
         for (const line of remediation.split("\n")) {
-          console.error(pc.dim(`  ${line}`));
+          console.error(pc2.dim(`  ${line}`));
         }
         console.error("");
       }
       if (cliError.cause) {
-        console.error(pc.dim(`Caused by: ${cliError.cause.message}`));
+        console.error(pc2.dim(`Caused by: ${cliError.cause.message}`));
         console.error("");
       }
-      console.error(pc.dim("Need help? https://securitychecks.ai/docs/troubleshooting"));
+      console.error(pc2.dim("Need help? https://securitychecks.ai/docs/troubleshooting"));
       console.error("");
     }
     process.exit(1);
@@ -5489,35 +5520,35 @@ function isCLIEnabled() {
 }
 async function runCommand(options) {
   if (!isCLIEnabled()) {
-    console.log(pc.bold("\nSecurityChecks CLI is currently in private beta.\n"));
+    console.log(pc2.bold("\nSecurityChecks CLI is currently in private beta.\n"));
     console.log("For public access, use our GitHub App instead:");
-    console.log(pc.cyan("  https://securitychecks.ai\n"));
+    console.log(pc2.cyan("  https://securitychecks.ai\n"));
     console.log("Benefits of the GitHub App:");
     console.log("  - No installation required");
     console.log("  - Automatic PR checks");
     console.log("  - Evidence directly in your PRs");
     console.log("  - Free tier available\n");
-    console.log(pc.dim("Enterprise or beta access? Contact sales@securitychecks.ai"));
-    console.log(pc.dim("Set SECURITYCHECKS_CLI_ENABLED=1 if you have approved access.\n"));
+    console.log(pc2.dim("Enterprise or beta access? Contact sales@securitychecks.ai"));
+    console.log(pc2.dim("Set SECURITYCHECKS_CLI_ENABLED=1 if you have approved access.\n"));
     process.exit(0);
   }
   if (options.watch) {
     if (options.ci) {
-      console.error(pc.red("Error: --watch cannot be used with --ci mode"));
+      console.error(pc2.red("Error: --watch cannot be used with --ci mode"));
       process.exit(1);
     }
     if (options.artifact) {
-      console.error(pc.red("Error: --watch cannot be used with --artifact"));
+      console.error(pc2.red("Error: --watch cannot be used with --artifact"));
       process.exit(1);
     }
     if (options.json) {
-      console.error(pc.red("Error: --watch cannot be used with --json output"));
+      console.error(pc2.red("Error: --watch cannot be used with --json output"));
       process.exit(1);
     }
     const targetPath = resolveTargetPath(options.path);
-    console.log(pc.bold("\n\u{1F440} Watch mode enabled\n"));
-    console.log(pc.dim(`Watching: ${targetPath}`));
-    console.log(pc.dim("Press Ctrl+C to stop\n"));
+    console.log(pc2.bold("\n\u{1F440} Watch mode enabled\n"));
+    console.log(pc2.dim(`Watching: ${targetPath}`));
+    console.log(pc2.dim("Press Ctrl+C to stop\n"));
     await runSingleScan(options);
     let runCount = 1;
     const watcher = new FileWatcher({
@@ -5526,28 +5557,28 @@ async function runCommand(options) {
       onChanged: async () => {
         runCount++;
         console.clear();
-        console.log(pc.bold(`
+        console.log(pc2.bold(`
 \u{1F440} Watch mode (run #${runCount})
 `));
-        console.log(pc.dim(`Watching: ${targetPath}`));
-        console.log(pc.dim("Press Ctrl+C to stop\n"));
+        console.log(pc2.dim(`Watching: ${targetPath}`));
+        console.log(pc2.dim("Press Ctrl+C to stop\n"));
         try {
           await runSingleScan(options);
         } catch {
-          console.log(pc.dim("\nWaiting for changes...\n"));
+          console.log(pc2.dim("\nWaiting for changes...\n"));
         }
       }
     });
     watcher.on("change", (filename) => {
       if (!options.quiet) {
-        console.log(pc.dim(`
+        console.log(pc2.dim(`
 File changed: ${filename}`));
-        console.log(pc.dim("Re-running scan...\n"));
+        console.log(pc2.dim("Re-running scan...\n"));
       }
     });
     watcher.start();
     process.on("SIGINT", () => {
-      console.log(pc.dim("\n\nStopping watch mode..."));
+      console.log(pc2.dim("\n\nStopping watch mode..."));
       watcher.stop();
       process.exit(0);
     });
@@ -5591,19 +5622,19 @@ function displayResults(result, categorization, correlation, options, calibratio
     }
     for (const [invariantId, findings] of byInvariant) {
       const severity = findings[0]?.severity;
-      const severityColor = severity === "P0" ? pc.red : severity === "P1" ? pc.yellow : pc.blue;
+      const severityColor = severity === "P0" ? pc2.red : severity === "P1" ? pc2.yellow : pc2.blue;
       console.log(severityColor(`[${severity}] ${invariantId}`));
       console.log("");
       const staffQuestion = getStaffQuestion(invariantId);
       if (staffQuestion) {
         console.log(`    A staff engineer would ask:`);
-        console.log(`    ${pc.cyan(`"${staffQuestion}"`)}`);
+        console.log(`    ${pc2.cyan(`"${staffQuestion}"`)}`);
         console.log("");
       }
       for (const finding of findings) {
         for (const evidence of finding.evidence) {
-          console.log(`    \u2192 ${pc.white(`${evidence.file}:${evidence.line}`)}`);
-          console.log(`      ${pc.dim(finding.message)}`);
+          console.log(`    \u2192 ${pc2.white(`${evidence.file}:${evidence.line}`)}`);
+          console.log(`      ${pc2.dim(finding.message)}`);
         }
       }
       console.log("");
@@ -5611,46 +5642,48 @@ function displayResults(result, categorization, correlation, options, calibratio
   }
   const duration = (result.duration / 1e3).toFixed(1);
   const filesScanned = result.artifact?.services?.length ?? 0;
-  console.log(pc.dim(`Scanned ${filesScanned} files in ${duration}s`));
+  console.log(pc2.dim(`Scanned ${filesScanned} files in ${duration}s`));
+  const readiness = computeReadinessScore(result.summary);
+  console.log(formatScoreForCli(readiness));
   console.log("");
   if (stoppedEarly) {
-    console.log(pc.red(`\u2716 Found critical issue. Stopping early.`));
+    console.log(pc2.red(`\u2716 Found critical issue. Stopping early.`));
     console.log("");
-    console.log(pc.dim(`Run \`scheck run --all\` to see all findings.`));
-    console.log(pc.dim(`Run \`scheck explain ${displayFindings[0]?.invariantId}\` for details.`));
+    console.log(pc2.dim(`Run \`scheck run --all\` to see all findings.`));
+    console.log(pc2.dim(`Run \`scheck explain ${displayFindings[0]?.invariantId}\` for details.`));
   } else if (totalVisible === 0) {
-    console.log(pc.green(`\u2713 No issues found. Ship it.`));
+    console.log(pc2.green(`\u2713 No issues found. Ship it.`));
   } else {
     const issueWord = totalVisible === 1 ? "issue" : "issues";
     const criticalNote = criticalCount > 0 ? ` (${criticalCount} critical)` : "";
-    console.log(pc.red(`\u2716 ${totalVisible} ${issueWord} require attention${criticalNote}`));
+    console.log(pc2.red(`\u2716 ${totalVisible} ${issueWord} require attention${criticalNote}`));
     console.log("");
     const firstInvariant = displayFindings[0]?.invariantId;
     if (firstInvariant) {
-      console.log(pc.dim(`Run \`scheck explain ${firstInvariant}\` for details.`));
+      console.log(pc2.dim(`Run \`scheck explain ${firstInvariant}\` for details.`));
     }
   }
   if (!showP2 && p2Count > 0 && !stoppedEarly) {
-    console.log(pc.dim(`(${p2Count} P2 finding(s) hidden. Run with --all to see them.)`));
+    console.log(pc2.dim(`(${p2Count} P2 finding(s) hidden. Run with --all to see them.)`));
   }
   if (!options.quiet) {
     if (counts.baselined > 0 || counts.waived > 0) {
       console.log("");
       if (counts.baselined > 0) {
-        console.log(pc.dim(`Baselined: ${counts.baselined} finding(s) in baseline`));
+        console.log(pc2.dim(`Baselined: ${counts.baselined} finding(s) in baseline`));
       }
       if (counts.waived > 0) {
-        console.log(pc.dim(`Waived: ${counts.waived} finding(s) temporarily waived`));
+        console.log(pc2.dim(`Waived: ${counts.waived} finding(s) temporarily waived`));
       }
     }
   }
   if (correlation.correlations.length > 0 && !options.quiet && options.all) {
     console.log("");
-    console.log(pc.bold(pc.magenta("Compounding Risks Detected:")));
+    console.log(pc2.bold(pc2.magenta("Compounding Risks Detected:")));
     for (const corr of correlation.correlations) {
       console.log(formatCorrelatedFinding(corr));
     }
-    console.log(pc.dim(formatCorrelationStats(correlation)));
+    console.log(pc2.dim(formatCorrelationStats(correlation)));
   }
   if (calibration?.aggregateCalibration && calibration.frameworks.length > 0 && options.all) {
     const findings = {
@@ -5666,9 +5699,9 @@ function displayResults(result, categorization, correlation, options, calibratio
     );
     if (comparisonSummary) {
       console.log("");
-      console.log(pc.bold("Framework Comparison:"));
+      console.log(pc2.bold("Framework Comparison:"));
       for (const line of comparisonSummary.split("\n")) {
-        console.log(`  ${pc.dim(line)}`);
+        console.log(`  ${pc2.dim(line)}`);
       }
     }
   }
@@ -5677,34 +5710,34 @@ function displayResults(result, categorization, correlation, options, calibratio
 async function explainCommand(invariantId) {
   const invariant = getInvariantById(invariantId);
   if (!invariant) {
-    console.log(pc.red(`
+    console.log(pc2.red(`
 Unknown invariant: ${invariantId}
 `));
-    console.log(pc.bold("Available invariants:\n"));
+    console.log(pc2.bold("Available invariants:\n"));
     for (const inv of ALL_INVARIANTS) {
-      const severityColor2 = inv.severity === "P0" ? pc.red : inv.severity === "P1" ? pc.yellow : pc.blue;
+      const severityColor2 = inv.severity === "P0" ? pc2.red : inv.severity === "P1" ? pc2.yellow : pc2.blue;
       console.log(`  ${severityColor2(`[${inv.severity}]`)} ${inv.id}`);
-      console.log(pc.dim(`       ${inv.name}`));
+      console.log(pc2.dim(`       ${inv.name}`));
     }
     console.log("");
     return;
   }
-  const severityColor = invariant.severity === "P0" ? pc.red : invariant.severity === "P1" ? pc.yellow : pc.blue;
+  const severityColor = invariant.severity === "P0" ? pc2.red : invariant.severity === "P1" ? pc2.yellow : pc2.blue;
   console.log("");
-  console.log(severityColor(pc.bold(`[${invariant.severity}] ${invariant.id}`)));
-  console.log(pc.bold(invariant.name));
+  console.log(severityColor(pc2.bold(`[${invariant.severity}] ${invariant.id}`)));
+  console.log(pc2.bold(invariant.name));
   console.log("");
-  console.log(pc.bold("Description:"));
+  console.log(pc2.bold("Description:"));
   console.log(wrapText(invariant.description, 80, 2));
   console.log("");
-  console.log(pc.bold("Category:"));
+  console.log(pc2.bold("Category:"));
   console.log(`  ${invariant.category}`);
   console.log("");
-  console.log(pc.bold("Required Proof:"));
+  console.log(pc2.bold("Required Proof:"));
   console.log(wrapText(invariant.requiredProof, 80, 2));
   console.log("");
   if (invariant.documentationUrl) {
-    console.log(pc.bold("Documentation:"));
+    console.log(pc2.bold("Documentation:"));
     console.log(`  ${invariant.documentationUrl}`);
     console.log("");
   }
@@ -5838,7 +5871,7 @@ jobs:
 async function installPreCommitHook(targetPath) {
   const gitDir = join(targetPath, ".git");
   if (!existsSync(gitDir)) {
-    console.log(pc.yellow("\u26A0") + " Not a git repository, skipping pre-commit hook");
+    console.log(pc2.yellow("\u26A0") + " Not a git repository, skipping pre-commit hook");
     return;
   }
   const hooksDir = join(gitDir, "hooks");
@@ -5851,33 +5884,33 @@ async function installPreCommitHook(targetPath) {
       (fs) => fs.promises.readFile(hookPath, "utf-8")
     );
     if (existingHook.includes("SecurityChecks pre-commit hook")) {
-      console.log(pc.yellow("\u26A0") + " Pre-commit hook already installed");
+      console.log(pc2.yellow("\u26A0") + " Pre-commit hook already installed");
       return;
     }
-    console.log(pc.yellow("\u26A0") + " Existing pre-commit hook found");
-    console.log(pc.dim("  To integrate SecurityChecks, add this to your hook:"));
-    console.log(pc.cyan("  scheck run --changed --ci"));
+    console.log(pc2.yellow("\u26A0") + " Existing pre-commit hook found");
+    console.log(pc2.dim("  To integrate SecurityChecks, add this to your hook:"));
+    console.log(pc2.cyan("  scheck run --changed --ci"));
     return;
   }
   await writeFile(hookPath, PRE_COMMIT_HOOK);
   await chmod(hookPath, 493);
-  console.log(pc.green("\u2713") + " Installed pre-commit hook");
+  console.log(pc2.green("\u2713") + " Installed pre-commit hook");
 }
 async function initCommand(options) {
   const targetPath = resolveTargetPath(options.path);
-  console.log(pc.bold("\n\u{1F527} Initializing SecurityChecks for your project\n"));
+  console.log(pc2.bold("\n\u{1F527} Initializing SecurityChecks for your project\n"));
   try {
     const scheckDir = join(targetPath, ".scheck");
     if (!existsSync(scheckDir)) {
       await mkdir(scheckDir, { recursive: true });
-      console.log(pc.green("\u2713") + " Created .scheck directory");
+      console.log(pc2.green("\u2713") + " Created .scheck directory");
     }
     const configPath = join(scheckDir, "config.yaml");
     if (!existsSync(configPath)) {
       await writeFile(configPath, DEFAULT_CONFIG);
-      console.log(pc.green("\u2713") + " Created .scheck/config.yaml");
+      console.log(pc2.green("\u2713") + " Created .scheck/config.yaml");
     } else {
-      console.log(pc.yellow("\u26A0") + " Config already exists, skipping");
+      console.log(pc2.yellow("\u26A0") + " Config already exists, skipping");
     }
     const baselinePath = join(scheckDir, "baseline.json");
     if (!existsSync(baselinePath)) {
@@ -5888,18 +5921,18 @@ async function initCommand(options) {
         entries: []
       };
       await writeFile(baselinePath, JSON.stringify(baseline, null, 2));
-      console.log(pc.green("\u2713") + " Created .scheck/baseline.json");
+      console.log(pc2.green("\u2713") + " Created .scheck/baseline.json");
     } else {
-      console.log(pc.yellow("\u26A0") + " Baseline already exists, skipping");
+      console.log(pc2.yellow("\u26A0") + " Baseline already exists, skipping");
     }
     const workflowDir = join(targetPath, ".github", "workflows");
     const workflowPath = join(workflowDir, "scheck.yml");
     if (!existsSync(workflowPath)) {
       await mkdir(workflowDir, { recursive: true });
       await writeFile(workflowPath, GITHUB_ACTION);
-      console.log(pc.green("\u2713") + " Created .github/workflows/scheck.yml");
+      console.log(pc2.green("\u2713") + " Created .github/workflows/scheck.yml");
     } else {
-      console.log(pc.yellow("\u26A0") + " GitHub Action already exists, skipping");
+      console.log(pc2.yellow("\u26A0") + " GitHub Action already exists, skipping");
     }
     if (options.hooks) {
       await installPreCommitHook(targetPath);
@@ -5913,25 +5946,25 @@ async function initCommand(options) {
         await import('fs').then(
           (fs) => fs.promises.appendFile(gitignorePath, "\n# SecurityChecks\n.scheck/cache/\n")
         );
-        console.log(pc.green("\u2713") + " Updated .gitignore");
+        console.log(pc2.green("\u2713") + " Updated .gitignore");
       }
     }
     console.log("");
-    console.log(pc.green("\u2713 SecurityChecks is ready."));
-    console.log(pc.dim("  Catch what Copilot misses in your codebase.\n"));
-    console.log(pc.bold("Next steps:"));
+    console.log(pc2.green("\u2713 SecurityChecks is ready."));
+    console.log(pc2.dim("  Catch what Copilot misses in your codebase.\n"));
+    console.log(pc2.bold("Next steps:"));
     console.log("");
     console.log("  1. Review the config at .scheck/config.yaml");
     console.log("  2. Run your first scan:");
-    console.log(pc.cyan("     scheck run"));
+    console.log(pc2.cyan("     scheck run"));
     console.log("");
     console.log("  3. Fix any P0/P1 violations or add waivers");
     console.log("  4. Commit the .scheck directory");
     console.log("");
-    console.log(pc.dim("Learn more: https://securitychecks.ai/docs"));
+    console.log(pc2.dim("Learn more: https://securitychecks.ai/docs"));
     console.log("");
   } catch (error2) {
-    console.error(pc.red("\nError initializing:"), error2);
+    console.error(pc2.red("\nError initializing:"), error2);
     process.exit(1);
   }
 }
@@ -6034,14 +6067,14 @@ async function showBaseline(targetPath) {
   const baseline = await loadBaseline(targetPath);
   const entries = Object.values(baseline.entries);
   if (entries.length === 0) {
-    console.log(pc.dim("No baseline entries."));
-    console.log(pc.dim(`Run ${pc.bold("scheck baseline --update")} to add current findings.`));
+    console.log(pc2.dim("No baseline entries."));
+    console.log(pc2.dim(`Run ${pc2.bold("scheck baseline --update")} to add current findings.`));
     return;
   }
-  console.log(pc.bold(`Baseline: ${entries.length} entries`));
-  console.log(pc.dim(`Schema version: ${baseline.schemaVersion}`));
-  console.log(pc.dim(`Last updated: ${baseline.updatedAt}`));
-  console.log(pc.dim(`Path: ${getBaselinePath(targetPath)}`));
+  console.log(pc2.bold(`Baseline: ${entries.length} entries`));
+  console.log(pc2.dim(`Schema version: ${baseline.schemaVersion}`));
+  console.log(pc2.dim(`Last updated: ${baseline.updatedAt}`));
+  console.log(pc2.dim(`Path: ${getBaselinePath(targetPath)}`));
   console.log();
   const byInvariant = /* @__PURE__ */ new Map();
   for (const entry of entries) {
@@ -6050,28 +6083,28 @@ async function showBaseline(targetPath) {
     byInvariant.set(entry.invariantId, list);
   }
   for (const [invariantId, invariantEntries] of byInvariant) {
-    console.log(pc.cyan(`${invariantId} (${invariantEntries.length})`));
+    console.log(pc2.cyan(`${invariantId} (${invariantEntries.length})`));
     for (const entry of invariantEntries.slice(0, 5)) {
       const symbol = entry.symbol ? `:${entry.symbol}` : "";
-      console.log(`  ${pc.dim("\u2022")} ${entry.file}${symbol}`);
+      console.log(`  ${pc2.dim("\u2022")} ${entry.file}${symbol}`);
       if (entry.notes) {
-        console.log(`    ${pc.dim(entry.notes)}`);
+        console.log(`    ${pc2.dim(entry.notes)}`);
       }
     }
     if (invariantEntries.length > 5) {
-      console.log(pc.dim(`    ... and ${invariantEntries.length - 5} more`));
+      console.log(pc2.dim(`    ... and ${invariantEntries.length - 5} more`));
     }
   }
 }
 async function updateBaseline(targetPath, notes, skipConfirmation = false) {
-  console.log(pc.dim("Running audit to collect current findings..."));
+  console.log(pc2.dim("Running audit to collect current findings..."));
   const result = await audit({
     targetPath
   });
   const baseline = await loadBaseline(targetPath);
   const findings = result.results.flatMap((r) => r.findings);
   if (findings.length === 0) {
-    console.log(pc.green("No findings to baseline."));
+    console.log(pc2.green("No findings to baseline."));
     return;
   }
   const newFindings = findings.filter((f) => {
@@ -6079,11 +6112,11 @@ async function updateBaseline(targetPath, notes, skipConfirmation = false) {
     return !(findingId2 in baseline.entries);
   });
   if (newFindings.length === 0) {
-    console.log(pc.green("All findings are already in the baseline."));
+    console.log(pc2.green("All findings are already in the baseline."));
     return;
   }
   console.log();
-  console.log(pc.yellow(`About to add ${newFindings.length} finding(s) to the baseline:`));
+  console.log(pc2.yellow(`About to add ${newFindings.length} finding(s) to the baseline:`));
   console.log();
   const byInvariant = /* @__PURE__ */ new Map();
   for (const finding of newFindings) {
@@ -6092,14 +6125,14 @@ async function updateBaseline(targetPath, notes, skipConfirmation = false) {
     byInvariant.set(finding.invariantId, list);
   }
   for (const [invariantId, invariantFindings] of byInvariant) {
-    console.log(pc.cyan(`  ${invariantId} (${invariantFindings.length})`));
+    console.log(pc2.cyan(`  ${invariantId} (${invariantFindings.length})`));
     for (const finding of invariantFindings.slice(0, 3)) {
       const evidence = finding.evidence[0];
       const location = evidence ? `${evidence.file}:${evidence.line}` : "unknown";
-      console.log(pc.dim(`    \u2022 ${location}`));
+      console.log(pc2.dim(`    \u2022 ${location}`));
     }
     if (invariantFindings.length > 3) {
-      console.log(pc.dim(`    ... and ${invariantFindings.length - 3} more`));
+      console.log(pc2.dim(`    ... and ${invariantFindings.length - 3} more`));
     }
   }
   console.log();
@@ -6108,16 +6141,16 @@ async function updateBaseline(targetPath, notes, skipConfirmation = false) {
       `Add ${newFindings.length} finding(s) to baseline? This will suppress them in CI. [y/N] `
     );
     if (!confirmed) {
-      console.log(pc.dim("Cancelled."));
+      console.log(pc2.dim("Cancelled."));
       return;
     }
   }
   const added = addToBaseline(baseline, findings, notes);
   await saveBaseline(targetPath, baseline);
-  console.log(pc.green(`\u2713 Baseline updated`));
-  console.log(`  ${pc.bold(added.toString())} new entries added`);
-  console.log(`  ${pc.dim(Object.keys(baseline.entries).length.toString())} total entries`);
-  console.log(`  ${pc.dim(`Path: ${getBaselinePath(targetPath)}`)}`);
+  console.log(pc2.green(`\u2713 Baseline updated`));
+  console.log(`  ${pc2.bold(added.toString())} new entries added`);
+  console.log(`  ${pc2.dim(Object.keys(baseline.entries).length.toString())} total entries`);
+  console.log(`  ${pc2.dim(`Path: ${getBaselinePath(targetPath)}`)}`);
 }
 function isNonInteractive() {
   return !process.stdin.isTTY || !!process.env["CI"];
@@ -6139,12 +6172,12 @@ async function pruneBaselineEntries(targetPath, staleDays) {
   const beforeCount = Object.keys(baseline.entries).length;
   const removed = pruneBaseline(baseline, staleDays);
   if (removed === 0) {
-    console.log(pc.dim(`No entries older than ${staleDays} days.`));
+    console.log(pc2.dim(`No entries older than ${staleDays} days.`));
     return;
   }
   await saveBaseline(targetPath, baseline);
-  console.log(pc.green(`\u2713 Pruned ${removed} stale entries`));
-  console.log(`  ${pc.dim(`${beforeCount} \u2192 ${Object.keys(baseline.entries).length} entries`)}`);
+  console.log(pc2.green(`\u2713 Pruned ${removed} stale entries`));
+  console.log(`  ${pc2.dim(`${beforeCount} \u2192 ${Object.keys(baseline.entries).length} entries`)}`);
 }
 async function waiverCommand(options) {
   const targetPath = resolve(options.path ?? process.cwd());
@@ -6159,24 +6192,24 @@ async function waiverCommand(options) {
 async function waiveCommand(findingIdOrInvariant, options) {
   const targetPath = resolve(options.path ?? process.cwd());
   if (!options.reason) {
-    console.error(pc.red("Error: --reason is required"));
+    console.error(pc2.red("Error: --reason is required"));
     console.log(
-      pc.dim('Example: scheck waive WEBHOOK.IDEMPOTENT:abc123 --reason-key will_fix_later --reason "Fixing in sprint 42"')
+      pc2.dim('Example: scheck waive WEBHOOK.IDEMPOTENT:abc123 --reason-key will_fix_later --reason "Fixing in sprint 42"')
     );
     process.exit(1);
   }
   let reasonKey;
   if (options.reasonKey) {
     if (!isValidWaiverReasonKey(options.reasonKey)) {
-      console.error(pc.red(`Error: Invalid --reason-key "${options.reasonKey}"`));
-      console.log(pc.dim(`Valid reason keys: ${WAIVER_REASON_KEYS.join(", ")}`));
+      console.error(pc2.red(`Error: Invalid --reason-key "${options.reasonKey}"`));
+      console.log(pc2.dim(`Valid reason keys: ${WAIVER_REASON_KEYS.join(", ")}`));
       process.exit(1);
     }
     reasonKey = options.reasonKey;
   }
   const expiresInDays = parseExpiration(options.expires ?? "30d");
   if (expiresInDays === null) {
-    console.error(pc.red("Error: Invalid --expires format. Use: 7d, 30d, 90d, etc."));
+    console.error(pc2.red("Error: Invalid --expires format. Use: 7d, 30d, 90d, etc."));
     process.exit(1);
   }
   const owner = options.owner ?? process.env["USER"] ?? process.env["USERNAME"] ?? "unknown";
@@ -6200,25 +6233,25 @@ async function showWaivers(targetPath) {
   const waivers = await loadWaivers(targetPath);
   const entries = Object.values(waivers.entries);
   if (entries.length === 0) {
-    console.log(pc.dim("No active waivers."));
+    console.log(pc2.dim("No active waivers."));
     return;
   }
-  console.log(pc.bold(`Waivers: ${entries.length} active`));
-  console.log(pc.dim(`Schema version: ${waivers.schemaVersion}`));
-  console.log(pc.dim(`Path: ${getWaiverPath(targetPath)}`));
+  console.log(pc2.bold(`Waivers: ${entries.length} active`));
+  console.log(pc2.dim(`Schema version: ${waivers.schemaVersion}`));
+  console.log(pc2.dim(`Path: ${getWaiverPath(targetPath)}`));
   console.log();
   entries.sort((a, b) => a.expiresAt.localeCompare(b.expiresAt));
   for (const entry of entries) {
     const expiresIn = getExpiresInLabel(entry.expiresAt);
     const isExpiringSoon = new Date(entry.expiresAt) < new Date(Date.now() + 7 * 24 * 60 * 60 * 1e3);
-    console.log(pc.cyan(entry.findingId));
-    console.log(`  ${pc.dim("File:")} ${entry.file}${entry.symbol ? `:${entry.symbol}` : ""}`);
-    console.log(`  ${pc.dim("Reason:")} ${entry.reason}`);
+    console.log(pc2.cyan(entry.findingId));
+    console.log(`  ${pc2.dim("File:")} ${entry.file}${entry.symbol ? `:${entry.symbol}` : ""}`);
+    console.log(`  ${pc2.dim("Reason:")} ${entry.reason}`);
     if (entry.reasonKey) {
-      console.log(`  ${pc.dim("Reason Key:")} ${entry.reasonKey}`);
+      console.log(`  ${pc2.dim("Reason Key:")} ${entry.reasonKey}`);
     }
-    console.log(`  ${pc.dim("Owner:")} ${entry.owner}`);
-    console.log(`  ${pc.dim("Expires:")} ${isExpiringSoon ? pc.yellow(expiresIn) : expiresIn}`);
+    console.log(`  ${pc2.dim("Owner:")} ${entry.owner}`);
+    console.log(`  ${pc2.dim("Expires:")} ${isExpiringSoon ? pc2.yellow(expiresIn) : expiresIn}`);
     console.log();
   }
 }
@@ -6226,17 +6259,17 @@ async function showExpiringWaivers(targetPath, withinDays) {
   const waivers = await loadWaivers(targetPath);
   const expiring = getExpiringWaivers(waivers, withinDays);
   if (expiring.length === 0) {
-    console.log(pc.dim(`No waivers expiring within ${withinDays} days.`));
+    console.log(pc2.dim(`No waivers expiring within ${withinDays} days.`));
     return;
   }
-  console.log(pc.yellow(`\u26A0 ${expiring.length} waiver(s) expiring within ${withinDays} days:`));
+  console.log(pc2.yellow(`\u26A0 ${expiring.length} waiver(s) expiring within ${withinDays} days:`));
   console.log();
   for (const entry of expiring) {
     const expiresIn = getExpiresInLabel(entry.expiresAt);
-    console.log(pc.yellow(entry.findingId));
-    console.log(`  ${pc.dim("File:")} ${entry.file}`);
-    console.log(`  ${pc.dim("Owner:")} ${entry.owner}`);
-    console.log(`  ${pc.dim("Expires:")} ${expiresIn}`);
+    console.log(pc2.yellow(entry.findingId));
+    console.log(`  ${pc2.dim("File:")} ${entry.file}`);
+    console.log(`  ${pc2.dim("Owner:")} ${entry.owner}`);
+    console.log(`  ${pc2.dim("Expires:")} ${expiresIn}`);
     console.log();
   }
 }
@@ -6245,43 +6278,43 @@ async function pruneWaivers(targetPath) {
   const beforeCount = Object.keys(waivers.entries).length;
   const removed = pruneExpiredWaivers(waivers);
   if (removed === 0) {
-    console.log(pc.dim("No expired waivers to remove."));
+    console.log(pc2.dim("No expired waivers to remove."));
     return;
   }
   await saveWaivers(targetPath, waivers);
-  console.log(pc.green(`\u2713 Removed ${removed} expired waivers`));
-  console.log(`  ${pc.dim(`${beforeCount} \u2192 ${Object.keys(waivers.entries).length} waivers`)}`);
+  console.log(pc2.green(`\u2713 Removed ${removed} expired waivers`));
+  console.log(`  ${pc2.dim(`${beforeCount} \u2192 ${Object.keys(waivers.entries).length} waivers`)}`);
 }
 async function waiveByFindingId(targetPath, findingId2, options) {
-  console.log(pc.dim("Finding matching issue..."));
+  console.log(pc2.dim("Finding matching issue..."));
   const result = await audit({ targetPath });
   const findings = result.results.flatMap((r) => r.findings);
   const normalizedId = findingId2.split(":").slice(0, 2).join(":");
   const matching = findings.find((f) => generateFindingId(f) === normalizedId);
   if (!matching) {
-    console.error(pc.red(`Error: No finding found matching ${findingId2}`));
-    console.log(pc.dim("Run `scheck run` to see current findings."));
+    console.error(pc2.red(`Error: No finding found matching ${findingId2}`));
+    console.log(pc2.dim("Run `scheck run` to see current findings."));
     process.exit(1);
   }
   const waivers = await loadWaivers(targetPath);
   const entry = addWaiver(waivers, matching, options);
   await saveWaivers(targetPath, waivers);
-  console.log(pc.green(`\u2713 Waiver created`));
-  console.log(`  ${pc.dim("Finding:")} ${entry.findingId}`);
-  console.log(`  ${pc.dim("Reason:")} ${entry.reason}`);
+  console.log(pc2.green(`\u2713 Waiver created`));
+  console.log(`  ${pc2.dim("Finding:")} ${entry.findingId}`);
+  console.log(`  ${pc2.dim("Reason:")} ${entry.reason}`);
   if (entry.reasonKey) {
-    console.log(`  ${pc.dim("Reason Key:")} ${entry.reasonKey}`);
+    console.log(`  ${pc2.dim("Reason Key:")} ${entry.reasonKey}`);
   }
-  console.log(`  ${pc.dim("Expires:")} ${getExpiresInLabel(entry.expiresAt)}`);
+  console.log(`  ${pc2.dim("Expires:")} ${getExpiresInLabel(entry.expiresAt)}`);
 }
 async function waiveByInvariant(targetPath, invariantId, options) {
-  console.log(pc.dim("Finding matching issues..."));
+  console.log(pc2.dim("Finding matching issues..."));
   const result = await audit({ targetPath });
   const findings = result.results.flatMap((r) => r.findings);
   const matching = findings.filter((f) => f.invariantId === invariantId);
   if (matching.length === 0) {
-    console.error(pc.red(`Error: No findings found for ${invariantId}`));
-    console.log(pc.dim("Run `scheck run` to see current findings."));
+    console.error(pc2.red(`Error: No findings found for ${invariantId}`));
+    console.log(pc2.dim("Run `scheck run` to see current findings."));
     process.exit(1);
   }
   const waivers = await loadWaivers(targetPath);
@@ -6289,12 +6322,12 @@ async function waiveByInvariant(targetPath, invariantId, options) {
     addWaiver(waivers, finding, options);
   }
   await saveWaivers(targetPath, waivers);
-  console.log(pc.green(`\u2713 Created ${matching.length} waiver(s) for ${invariantId}`));
-  console.log(`  ${pc.dim("Reason:")} ${options.reason}`);
+  console.log(pc2.green(`\u2713 Created ${matching.length} waiver(s) for ${invariantId}`));
+  console.log(`  ${pc2.dim("Reason:")} ${options.reason}`);
   if (options.reasonKey) {
-    console.log(`  ${pc.dim("Reason Key:")} ${options.reasonKey}`);
+    console.log(`  ${pc2.dim("Reason Key:")} ${options.reasonKey}`);
   }
-  console.log(`  ${pc.dim("Expires:")} in ${options.expiresInDays} days`);
+  console.log(`  ${pc2.dim("Expires:")} in ${options.expiresInDays} days`);
 }
 function parseExpiration(value) {
   const match = value.match(/^(\d+)d$/i);
@@ -6336,7 +6369,7 @@ var CloudApiClient = class {
       const headers = {
         Authorization: `Bearer ${this.apiKey}`,
         "Content-Type": "application/json",
-        "User-Agent": `scheck-cli/${"0.1.1-rc.1"}`
+        "User-Agent": `scheck-cli/${"0.2.0"}`
       };
       const bypassSecret = process.env["VERCEL_AUTOMATION_BYPASS_SECRET"];
       if (bypassSecret) {
@@ -6481,8 +6514,8 @@ function createCloudClient(apiUrl, apiKey) {
 // src/commands/login.ts
 async function promptForApiKey() {
   const rl = readline.createInterface({ input: stdin, output: stdout });
-  console.log(pc.bold("\nSecurityChecks Cloud Login\n"));
-  console.log(pc.dim("Get your API key at: https://securitychecks.ai/dashboard/settings/api-keys\n"));
+  console.log(pc2.bold("\nSecurityChecks Cloud Login\n"));
+  console.log(pc2.dim("Get your API key at: https://securitychecks.ai/dashboard/settings/api-keys\n"));
   try {
     const apiKey = await rl.question("API Key: ");
     return apiKey.trim();
@@ -6495,7 +6528,7 @@ async function loginCommand(options) {
     const config = await loadCloudConfig();
     if (options.check) {
       if (!config.apiKey) {
-        console.log(pc.yellow("Not logged in to SecurityChecks cloud.\n"));
+        console.log(pc2.yellow("Not logged in to SecurityChecks cloud.\n"));
         console.log("Run `scheck login` to authenticate.");
         return;
       }
@@ -6504,18 +6537,18 @@ async function loginCommand(options) {
       try {
         const result2 = await client2.validateKey();
         if (result2.valid) {
-          console.log(pc.green("\u2713 Logged in to SecurityChecks cloud\n"));
+          console.log(pc2.green("\u2713 Logged in to SecurityChecks cloud\n"));
           console.log(formatConfig(config));
         } else {
-          console.log(pc.yellow("API key is invalid or expired.\n"));
+          console.log(pc2.yellow("API key is invalid or expired.\n"));
           console.log("Run `scheck login` to re-authenticate.");
         }
       } catch (error2) {
         if (error2 instanceof CLIError) {
-          console.log(pc.red(`\u2717 ${error2.message}
+          console.log(pc2.red(`\u2717 ${error2.message}
 `));
         } else {
-          console.log(pc.red("\u2717 Failed to validate API key\n"));
+          console.log(pc2.red("\u2717 Failed to validate API key\n"));
         }
       }
       return;
@@ -6525,7 +6558,7 @@ async function loginCommand(options) {
       apiKey = await promptForApiKey();
     }
     if (!apiKey) {
-      console.log(pc.red("\n\u2717 No API key provided.\n"));
+      console.log(pc2.red("\n\u2717 No API key provided.\n"));
       process.exit(1);
     }
     if (!isValidApiKey(apiKey)) {
@@ -6535,7 +6568,7 @@ async function loginCommand(options) {
       );
     }
     const apiUrl = options.apiUrl || getApiUrl(config);
-    console.log(pc.dim(`
+    console.log(pc2.dim(`
 Connecting to ${apiUrl}...`));
     const client = createCloudClient(apiUrl, apiKey);
     const result = await client.validateKey();
@@ -6552,7 +6585,7 @@ Connecting to ${apiUrl}...`));
       cloudEnabled: true,
       lastSync: (/* @__PURE__ */ new Date()).toISOString()
     });
-    console.log(pc.green("\n\u2713 Successfully logged in!\n"));
+    console.log(pc2.green("\n\u2713 Successfully logged in!\n"));
     console.log(`  Email:        ${userInfo.email}`);
     if (userInfo.name) {
       console.log(`  Name:         ${userInfo.name}`);
@@ -6561,24 +6594,24 @@ Connecting to ${apiUrl}...`));
       console.log(`  Organization: ${userInfo.organizations[0]?.name}`);
     }
     console.log("");
-    console.log(pc.dim("Cloud mode is now enabled by default."));
-    console.log(pc.dim("Run `scheck run --cloud` to sync findings."));
+    console.log(pc2.dim("Cloud mode is now enabled by default."));
+    console.log(pc2.dim("Run `scheck run --cloud` to sync findings."));
     console.log("");
   } catch (error2) {
     if (error2 instanceof CLIError) {
-      console.error(pc.red(`
+      console.error(pc2.red(`
 \u2717 ${error2.message}
 `));
       const remediation = error2.getRemediation();
       if (remediation) {
-        console.error(pc.yellow("How to fix:"));
+        console.error(pc2.yellow("How to fix:"));
         for (const line of remediation.split("\n")) {
-          console.error(pc.dim(`  ${line}`));
+          console.error(pc2.dim(`  ${line}`));
         }
         console.error("");
       }
     } else {
-      console.error(pc.red(`
+      console.error(pc2.red(`
 \u2717 Login failed: ${error2 instanceof Error ? error2.message : "Unknown error"}
 `));
     }
@@ -6588,7 +6621,7 @@ Connecting to ${apiUrl}...`));
 async function logoutCommand() {
   const config = await loadCloudConfig();
   if (!config.apiKey) {
-    console.log(pc.yellow("Not logged in to SecurityChecks cloud.\n"));
+    console.log(pc2.yellow("Not logged in to SecurityChecks cloud.\n"));
     return;
   }
   await updateCloudConfig({
@@ -6598,8 +6631,8 @@ async function logoutCommand() {
     cloudEnabled: false,
     lastSync: void 0
   });
-  console.log(pc.green("\u2713 Successfully logged out.\n"));
-  console.log(pc.dim("Cloud mode has been disabled."));
+  console.log(pc2.green("\u2713 Successfully logged out.\n"));
+  console.log(pc2.dim("Cloud mode has been disabled."));
   console.log("");
 }
 var ALLOWED_KEYS = ["project", "apiUrl", "cloudEnabled"];
@@ -6613,13 +6646,13 @@ async function configCommand(options) {
       console.log("");
       console.log(formatConfig(config));
       console.log("");
-      console.log(pc.dim(`Config file: ${CONFIG_FILE}`));
+      console.log(pc2.dim(`Config file: ${CONFIG_FILE}`));
       console.log("");
       return;
     }
     if (options.clear) {
       await clearCloudConfig();
-      console.log(pc.green("\u2713 Configuration cleared.\n"));
+      console.log(pc2.green("\u2713 Configuration cleared.\n"));
       return;
     }
     if (options.set) {
@@ -6642,7 +6675,7 @@ async function configCommand(options) {
         parsedValue = value === "true" || value === "1";
       }
       await updateCloudConfig({ [key]: parsedValue });
-      console.log(pc.green(`\u2713 Set ${key} = ${parsedValue}
+      console.log(pc2.green(`\u2713 Set ${key} = ${parsedValue}
 `));
       return;
     }
@@ -6655,40 +6688,40 @@ async function configCommand(options) {
         );
       }
       await updateCloudConfig({ [key]: void 0 });
-      console.log(pc.green(`\u2713 Unset ${key}
+      console.log(pc2.green(`\u2713 Unset ${key}
 `));
       return;
     }
     if (options.project !== void 0) {
       await updateCloudConfig({ project: options.project });
-      console.log(pc.green(`\u2713 Set project = ${options.project}
+      console.log(pc2.green(`\u2713 Set project = ${options.project}
 `));
     }
     if (options.apiUrl !== void 0) {
       await updateCloudConfig({ apiUrl: options.apiUrl });
-      console.log(pc.green(`\u2713 Set apiUrl = ${options.apiUrl}
+      console.log(pc2.green(`\u2713 Set apiUrl = ${options.apiUrl}
 `));
     }
     if (options.cloudEnabled !== void 0) {
       await updateCloudConfig({ cloudEnabled: options.cloudEnabled });
-      console.log(pc.green(`\u2713 Set cloudEnabled = ${options.cloudEnabled}
+      console.log(pc2.green(`\u2713 Set cloudEnabled = ${options.cloudEnabled}
 `));
     }
   } catch (error2) {
     if (error2 instanceof CLIError) {
-      console.error(pc.red(`
+      console.error(pc2.red(`
 \u2717 ${error2.message}
 `));
       const remediation = error2.getRemediation();
       if (remediation) {
-        console.error(pc.yellow("How to fix:"));
+        console.error(pc2.yellow("How to fix:"));
         for (const line of remediation.split("\n")) {
-          console.error(pc.dim(`  ${line}`));
+          console.error(pc2.dim(`  ${line}`));
         }
         console.error("");
       }
     } else {
-      console.error(pc.red(`
+      console.error(pc2.red(`
 \u2717 Config failed: ${error2 instanceof Error ? error2.message : "Unknown error"}
 `));
     }
@@ -6750,14 +6783,14 @@ async function syncCommand(options) {
       );
     }
     const findingsPath = options.findings || DEFAULT_FINDINGS_PATH;
-    console.log(pc.dim(`Loading results from ${findingsPath}...`));
+    console.log(pc2.dim(`Loading results from ${findingsPath}...`));
     const results = await loadResults(findingsPath);
     const allFindings = results.results.flatMap((r) => r.findings);
     const gitInfo = await detectGitInfo(results.targetPath);
     const branch = options.branch || gitInfo.branch;
     const commitSha = options.commit || gitInfo.commit;
     console.log("");
-    console.log(pc.bold("Sync Summary:"));
+    console.log(pc2.bold("Sync Summary:"));
     console.log(`  Project:   ${projectSlug}`);
     console.log(`  Branch:    ${branch || "(none)"}`);
     console.log(`  Commit:    ${commitSha ? commitSha.substring(0, 8) : "(none)"}`);
@@ -6765,24 +6798,24 @@ async function syncCommand(options) {
     console.log(`  P0: ${results.summary.byPriority.P0}, P1: ${results.summary.byPriority.P1}, P2: ${results.summary.byPriority.P2}`);
     console.log("");
     if (options.dryRun) {
-      console.log(pc.yellow("Dry run - no changes made.\n"));
+      console.log(pc2.yellow("Dry run - no changes made.\n"));
       return;
     }
     const apiUrl = getApiUrl(config);
     const client = createCloudClient(apiUrl, apiKey);
-    console.log(pc.dim("Creating scan..."));
+    console.log(pc2.dim("Creating scan..."));
     const scan = await client.createScan({
       projectSlug,
       branch,
       commitSha
     });
-    console.log(pc.dim(`Scan created: ${scan.id}`));
+    console.log(pc2.dim(`Scan created: ${scan.id}`));
     if (allFindings.length > 0) {
-      console.log(pc.dim("Submitting findings..."));
+      console.log(pc2.dim("Submitting findings..."));
       const submitResult = await client.submitFindings(scan.id, allFindings);
-      console.log(pc.dim(`Created: ${submitResult.created}, Updated: ${submitResult.updated}`));
+      console.log(pc2.dim(`Created: ${submitResult.created}, Updated: ${submitResult.updated}`));
     }
-    console.log(pc.dim("Completing scan..."));
+    console.log(pc2.dim("Completing scan..."));
     await client.updateScan(scan.id, {
       status: "COMPLETED",
       summary: {
@@ -6793,24 +6826,24 @@ async function syncCommand(options) {
       duration: results.duration
     });
     await updateCloudConfig({ lastSync: (/* @__PURE__ */ new Date()).toISOString() });
-    console.log(pc.green("\n\u2713 Sync complete!\n"));
-    console.log(pc.dim(`View at: https://securitychecks.ai/dashboard/scans/${scan.id}`));
+    console.log(pc2.green("\n\u2713 Sync complete!\n"));
+    console.log(pc2.dim(`View at: https://securitychecks.ai/dashboard/scans/${scan.id}`));
     console.log("");
   } catch (error2) {
     if (error2 instanceof CLIError) {
-      console.error(pc.red(`
+      console.error(pc2.red(`
 \u2717 ${error2.message}
 `));
       const remediation = error2.getRemediation();
       if (remediation) {
-        console.error(pc.yellow("How to fix:"));
+        console.error(pc2.yellow("How to fix:"));
         for (const line of remediation.split("\n")) {
-          console.error(pc.dim(`  ${line}`));
+          console.error(pc2.dim(`  ${line}`));
         }
         console.error("");
       }
     } else {
-      console.error(pc.red(`
+      console.error(pc2.red(`
 \u2717 Sync failed: ${error2 instanceof Error ? error2.message : "Unknown error"}
 `));
     }
@@ -6857,7 +6890,7 @@ async function hooksCommand(options) {
   const targetPath = resolveTargetPath(options.path);
   const gitDir = join(targetPath, ".git");
   if (!existsSync(gitDir)) {
-    console.error(pc.red("Error:") + " Not a git repository");
+    console.error(pc2.red("Error:") + " Not a git repository");
     process.exit(1);
   }
   const hooksDir = join(gitDir, "hooks");
@@ -6866,19 +6899,19 @@ async function hooksCommand(options) {
     options.show = true;
   }
   if (options.show) {
-    console.log(pc.bold("\nSecurityChecks Git Hooks\n"));
+    console.log(pc2.bold("\nSecurityChecks Git Hooks\n"));
     if (existsSync(hookPath)) {
       const hookContent = await readFile(hookPath, "utf-8");
       if (hookContent.includes("SecurityChecks pre-commit hook")) {
-        console.log(pc.green("\u2713") + " Pre-commit hook is installed");
-        console.log(pc.dim(`  Location: ${hookPath}`));
+        console.log(pc2.green("\u2713") + " Pre-commit hook is installed");
+        console.log(pc2.dim(`  Location: ${hookPath}`));
       } else {
-        console.log(pc.yellow("\u26A0") + " Pre-commit hook exists but is not SecurityChecks");
-        console.log(pc.dim("  Use --install to add SecurityChecks to your workflow"));
+        console.log(pc2.yellow("\u26A0") + " Pre-commit hook exists but is not SecurityChecks");
+        console.log(pc2.dim("  Use --install to add SecurityChecks to your workflow"));
       }
     } else {
-      console.log(pc.dim("\u25CB") + " Pre-commit hook is not installed");
-      console.log(pc.dim("  Use --install to install it"));
+      console.log(pc2.dim("\u25CB") + " Pre-commit hook is not installed");
+      console.log(pc2.dim("  Use --install to install it"));
     }
     console.log("");
     return;
@@ -6890,36 +6923,36 @@ async function hooksCommand(options) {
     if (existsSync(hookPath)) {
       const existingHook = await readFile(hookPath, "utf-8");
       if (existingHook.includes("SecurityChecks pre-commit hook")) {
-        console.log(pc.yellow("\u26A0") + " Pre-commit hook already installed");
+        console.log(pc2.yellow("\u26A0") + " Pre-commit hook already installed");
         return;
       }
-      console.log(pc.yellow("\u26A0") + " Existing pre-commit hook found");
-      console.log(pc.dim("  To manually integrate, add this to your hook:"));
-      console.log(pc.cyan("    scheck run --changed --ci"));
+      console.log(pc2.yellow("\u26A0") + " Existing pre-commit hook found");
+      console.log(pc2.dim("  To manually integrate, add this to your hook:"));
+      console.log(pc2.cyan("    scheck run --changed --ci"));
       console.log("");
-      console.log(pc.dim("  Or use --uninstall first to replace the existing hook"));
+      console.log(pc2.dim("  Or use --uninstall first to replace the existing hook"));
       return;
     }
     await writeFile(hookPath, PRE_COMMIT_HOOK2);
     await chmod(hookPath, 493);
-    console.log(pc.green("\u2713") + " Installed pre-commit hook");
-    console.log(pc.dim("  SecurityChecks will run on staged files before each commit"));
-    console.log(pc.dim("  To skip: git commit --no-verify"));
+    console.log(pc2.green("\u2713") + " Installed pre-commit hook");
+    console.log(pc2.dim("  SecurityChecks will run on staged files before each commit"));
+    console.log(pc2.dim("  To skip: git commit --no-verify"));
     return;
   }
   if (options.uninstall) {
     if (!existsSync(hookPath)) {
-      console.log(pc.yellow("\u26A0") + " No pre-commit hook found");
+      console.log(pc2.yellow("\u26A0") + " No pre-commit hook found");
       return;
     }
     const hookContent = await readFile(hookPath, "utf-8");
     if (!hookContent.includes("SecurityChecks pre-commit hook")) {
-      console.log(pc.yellow("\u26A0") + " Pre-commit hook is not a SecurityChecks hook");
-      console.log(pc.dim("  Not removing to avoid breaking your existing hook"));
+      console.log(pc2.yellow("\u26A0") + " Pre-commit hook is not a SecurityChecks hook");
+      console.log(pc2.dim("  Not removing to avoid breaking your existing hook"));
       return;
     }
     await unlink(hookPath);
-    console.log(pc.green("\u2713") + " Uninstalled pre-commit hook");
+    console.log(pc2.green("\u2713") + " Uninstalled pre-commit hook");
     return;
   }
 }
@@ -6991,20 +7024,20 @@ var VERDICT_MAP = {
 async function feedbackCommand(invariantIdOrFindingId, options) {
   const verdict = VERDICT_MAP[options.verdict];
   if (!verdict) {
-    console.error(pc.red(`Error: Invalid verdict "${options.verdict}"`));
-    console.log(pc.dim("Valid values: tp, fp, true_positive, false_positive"));
+    console.error(pc2.red(`Error: Invalid verdict "${options.verdict}"`));
+    console.log(pc2.dim("Valid values: tp, fp, true_positive, false_positive"));
     process.exit(1);
   }
   if (options.reason && !isValidReason(options.reason)) {
-    console.error(pc.red(`Error: Invalid reason "${options.reason}"`));
-    console.log(pc.dim(`Valid reasons: ${VALID_REASONS.join(", ")}`));
+    console.error(pc2.red(`Error: Invalid reason "${options.reason}"`));
+    console.log(pc2.dim(`Valid reasons: ${VALID_REASONS.join(", ")}`));
     process.exit(1);
   }
   const reason = options.reason;
   const invariantId = invariantIdOrFindingId.includes(":") ? invariantIdOrFindingId.split(":").slice(0, -1).join(":") : invariantIdOrFindingId;
   if (isTelemetryDisabled()) {
-    console.log(pc.yellow("Telemetry is disabled. Feedback will not be sent."));
-    console.log(pc.dim("Unset SECURITYCHECKS_TELEMETRY=false or DO_NOT_TRACK=1 to enable."));
+    console.log(pc2.yellow("Telemetry is disabled. Feedback will not be sent."));
+    console.log(pc2.dim("Unset SECURITYCHECKS_TELEMETRY=false or DO_NOT_TRACK=1 to enable."));
     return;
   }
   const cloudConfig = await loadCloudConfig();
@@ -7023,8 +7056,8 @@ async function feedbackCommand(invariantIdOrFindingId, options) {
     endpoint,
     timeout: 5e3
   };
-  const clientVersion = "0.1.1-rc.1";
-  console.log(pc.dim("Sending feedback..."));
+  const clientVersion = "0.2.0";
+  console.log(pc2.dim("Sending feedback..."));
   const success2 = await reportFeedback(
     {
       invariantId,
@@ -7035,15 +7068,15 @@ async function feedbackCommand(invariantIdOrFindingId, options) {
     feedbackConfig
   );
   if (success2) {
-    const verdictLabel = verdict === "true_positive" ? pc.green("true positive") : pc.red("false positive");
-    console.log(pc.green("\u2713 Feedback recorded"));
-    console.log(`  ${pc.dim("Invariant:")} ${invariantId}`);
-    console.log(`  ${pc.dim("Verdict:")}   ${verdictLabel}`);
+    const verdictLabel = verdict === "true_positive" ? pc2.green("true positive") : pc2.red("false positive");
+    console.log(pc2.green("\u2713 Feedback recorded"));
+    console.log(`  ${pc2.dim("Invariant:")} ${invariantId}`);
+    console.log(`  ${pc2.dim("Verdict:")}   ${verdictLabel}`);
     if (reason) {
-      console.log(`  ${pc.dim("Reason:")}    ${reason}`);
+      console.log(`  ${pc2.dim("Reason:")}    ${reason}`);
     }
   } else {
-    console.error(pc.red("Failed to send feedback. The API may be unreachable."));
+    console.error(pc2.red("Failed to send feedback. The API may be unreachable."));
     process.exit(1);
   }
 }
@@ -7070,16 +7103,16 @@ async function listInvariantsCommand(options) {
     return;
   }
   if (category || severity) {
-    console.log(pc.dim(`Filters: ${category ? `category=${category}` : ""}${category && severity ? ", " : ""}${severity ? `severity=${severity}` : ""}`));
+    console.log(pc2.dim(`Filters: ${category ? `category=${category}` : ""}${category && severity ? ", " : ""}${severity ? `severity=${severity}` : ""}`));
     console.log("");
   }
   for (const inv of invariants) {
-    const severityColor = inv.severity === "P0" ? pc.red : inv.severity === "P1" ? pc.yellow : pc.blue;
+    const severityColor = inv.severity === "P0" ? pc2.red : inv.severity === "P1" ? pc2.yellow : pc2.blue;
     console.log(`  ${severityColor(`[${inv.severity}]`)} ${inv.id}`);
-    console.log(pc.dim(`       ${inv.name}`));
+    console.log(pc2.dim(`       ${inv.name}`));
     const question = getStaffQuestion(inv.id);
     if (question) {
-      console.log(pc.dim(`       Staff asks: ${question}`));
+      console.log(pc2.dim(`       Staff asks: ${question}`));
     }
   }
   console.log("");
@@ -7087,13 +7120,117 @@ async function listInvariantsCommand(options) {
 async function generateTestCommand(invariantId, options) {
   const invariant = getInvariantById(invariantId);
   if (!invariant) {
-    console.error(pc.red(`Unknown invariant: ${invariantId}`));
+    console.error(pc2.red(`Unknown invariant: ${invariantId}`));
     process.exit(1);
   }
   const framework = options.framework ?? "vitest";
   const test = generateTestSkeleton(invariant, framework, options.context);
   console.log(test);
 }
+var PREFLIGHT_INVARIANTS = [
+  "AUTHZ.SERVICE_LAYER.ENFORCED",
+  "WEBHOOK.IDEMPOTENT",
+  "WEBHOOK.SIGNATURE.VERIFIED",
+  "TRANSACTION.POST_COMMIT.SIDE_EFFECTS",
+  "CONFIG.ENV_HARDCODED",
+  "CONFIG.HEALTH_CHECK_MISSING",
+  "CONFIG.ERROR_STACK_LEAK",
+  "CONFIG.GRACEFUL_SHUTDOWN_MISSING",
+  "SECRETS.HARDCODED",
+  "DATAFLOW.UNTRUSTED.SQL_QUERY"
+];
+var INVARIANT_LABELS = {
+  "AUTHZ.SERVICE_LAYER.ENFORCED": "Auth at service layer",
+  "WEBHOOK.IDEMPOTENT": "Webhook idempotency",
+  "WEBHOOK.SIGNATURE.VERIFIED": "Webhook signature verification",
+  "TRANSACTION.POST_COMMIT.SIDE_EFFECTS": "No side effects in transactions",
+  "CONFIG.ENV_HARDCODED": "No hardcoded env values",
+  "CONFIG.HEALTH_CHECK_MISSING": "Health endpoint exists",
+  "CONFIG.ERROR_STACK_LEAK": "No stack traces leaked",
+  "CONFIG.GRACEFUL_SHUTDOWN_MISSING": "Graceful shutdown",
+  "SECRETS.HARDCODED": "No hardcoded secrets",
+  "DATAFLOW.UNTRUSTED.SQL_QUERY": "No SQL injection"
+};
+async function preflightCommand(options) {
+  if (!options.quiet) {
+    console.log(pc2.bold("\nPreflight Check\n"));
+  }
+  try {
+    const result = await audit({
+      targetPath: options.path,
+      only: PREFLIGHT_INVARIANTS
+    });
+    const readiness = computeReadinessScore(result.summary);
+    const failedInvariants = /* @__PURE__ */ new Map();
+    for (const r of result.results) {
+      if (!r.passed) {
+        const evidence = r.findings.map((f) => ({
+          file: f.evidence?.[0]?.file ?? "unknown",
+          line: f.evidence?.[0]?.line ?? 0,
+          message: f.message
+        }));
+        failedInvariants.set(r.invariantId, evidence);
+      }
+    }
+    if (options.json) {
+      const jsonOutput = {
+        passed: readiness.passed,
+        failed: readiness.failed,
+        total: readiness.total,
+        score: readiness.score,
+        grade: readiness.grade,
+        hasP0: readiness.hasP0,
+        checks: PREFLIGHT_INVARIANTS.map((id) => ({
+          invariantId: id,
+          label: INVARIANT_LABELS[id] ?? id,
+          passed: !failedInvariants.has(id),
+          findings: failedInvariants.get(id) ?? []
+        }))
+      };
+      console.log(JSON.stringify(jsonOutput, null, 2));
+      return;
+    }
+    if (options.quiet) {
+      if (readiness.failed > 0) {
+        process.exit(1);
+      }
+      return;
+    }
+    console.log(`Preflight Check \u2014 ${readiness.passed}/${readiness.total} passed
+`);
+    for (const id of PREFLIGHT_INVARIANTS) {
+      const label = INVARIANT_LABELS[id] ?? id;
+      const evidence = failedInvariants.get(id);
+      if (evidence) {
+        console.log(pc2.red(`  \u2717 ${label}`));
+        for (const e of evidence) {
+          console.log(pc2.dim(`    \u2192 ${e.file}:${e.line} \u2014 ${e.message}`));
+        }
+      } else {
+        console.log(pc2.green(`  \u2713 ${label}`));
+      }
+    }
+    console.log("");
+    console.log(`  ${formatScoreForCli(readiness)}`);
+    if (readiness.failed > 0) {
+      const issueWord = readiness.failed === 1 ? "issue" : "issues";
+      console.log(`  ${readiness.failed} ${issueWord} to fix before deploy.`);
+    } else {
+      console.log(pc2.green("  Ready to deploy."));
+    }
+    console.log("");
+  } catch (error2) {
+    const message = error2 instanceof Error ? error2.message : String(error2);
+    if (options.json) {
+      console.error(JSON.stringify({ error: message }, null, 2));
+    } else {
+      console.error(pc2.red(`
+Preflight failed: ${message}
+`));
+    }
+    process.exit(1);
+  }
+}
 var SENSITIVE_PATTERNS = [
   /api[_-]?key/i,
   /secret/i,
@@ -7132,20 +7269,20 @@ var Logger = class {
    */
   step(step2, total, message) {
     if (this.silent) return;
-    console.log(pc.dim(`[${step2}/${total}]`), message);
+    console.log(pc2.dim(`[${step2}/${total}]`), message);
   }
   /**
    * Log a success message
    */
   success(message) {
     if (this.silent) return;
-    console.log(pc.green("\u2713"), message);
+    console.log(pc2.green("\u2713"), message);
   }
   /**
    * Log a failure message
    */
   fail(message) {
-    console.log(pc.red("\u2717"), message);
+    console.log(pc2.red("\u2717"), message);
   }
   log(level, message, data) {
     const timestamp = (/* @__PURE__ */ new Date()).toISOString();
@@ -7169,19 +7306,19 @@ var Logger = class {
       console.log(formattedMessage);
     }
     if (this.verbose && redactedData) {
-      console.log(pc.dim(JSON.stringify(redactedData, null, 2)));
+      console.log(pc2.dim(JSON.stringify(redactedData, null, 2)));
     }
   }
   getPrefix(level) {
     switch (level) {
       case "debug":
-        return pc.dim("[DEBUG]");
+        return pc2.dim("[DEBUG]");
       case "info":
-        return pc.blue("[INFO]");
+        return pc2.blue("[INFO]");
       case "warn":
-        return pc.yellow("[WARN]");
+        return pc2.yellow("[WARN]");
       case "error":
-        return pc.red("[ERROR]");
+        return pc2.red("[ERROR]");
     }
   }
   /**
@@ -7225,7 +7362,7 @@ logger.success.bind(logger);
 logger.fail.bind(logger);
 
 // src/index.ts
-var version = "0.1.1-rc.1";
+var version = "0.2.0";
 var program = new Command();
 program.name("scheck").description("Enforce backend invariants in your codebase").version(version);
 program.command("run").description("Scan for security invariants").option("-p, --path <path>", "Target path to audit (default: current directory)").option("-a, --artifact <path>", "Use pre-collected artifact from scc (skips collection)").option("--changed", "Only check changed files (requires git)").option("--ci", "CI mode - fail on new violations").option("--all", "Show all findings (don't stop early, include P2)").option("--include-p2", "Include P2 (medium) findings").option("--only <invariants...>", "Only run specific invariant checks").option("--skip <invariants...>", "Skip specific invariant checks").option("--json", "Output results as JSON").option("--sarif <path>", "Write SARIF report to file (for GitHub Code Scanning)").option("--quiet", "Suppress output except errors").option("-v, --verbose", "Enable verbose output").option("--calibrate", "Enable calibration API (default: enabled)").option("--offline", "Disable all API calls (not supported - shows error)").option("--calibration-endpoint <url>", "Override calibration API endpoint").option("--patterns", "Enable Pro Patterns fetching (default: enabled)").option("--no-patterns", "Disable Pro Patterns fetching").option("--pattern-endpoint <url>", "Override patterns API endpoint").option("--patterns-file <path>", "Load patterns from local JSON file (dev/testing)").option("-w, --watch", "Watch for file changes and re-run").option("--no-local-scan", "Skip local source-level pattern scanning").option("--no-usage-banner", "Suppress periodic API usage reminders").action((options) => {
@@ -7239,6 +7376,10 @@ program.command("run").description("Scan for security invariants").option("-p, -
 program.command("explain <invariant>").description("Deep-dive on any invariant (why it matters, what good looks like)").action(explainCommand);
 program.command("list-invariants").description("List all invariants (optionally filtered)").option("--category <category>", "Filter by category (authz, webhooks, transactions, etc.)").option("--severity <severity>", "Filter by severity (P0, P1, P2)").option("--json", "Output as JSON").action((options) => listInvariantsCommand(options));
 program.command("generate-test <invariantId>").description("Generate a test skeleton proving an invariant is enforced").option("--framework <framework>", "Test framework: vitest, jest, playwright", "vitest").option("--context <context>", "Extra context to make the test more targeted").action((invariantId, options) => generateTestCommand(invariantId, options));
+program.command("preflight").description("Quick deployment readiness check (curated invariant subset)").option("-p, --path <path>", "Target path to audit (default: current directory)").option("--json", "Output results as JSON").option("--quiet", "Suppress output except errors (exit code only)").action((options) => {
+  logger.configure({ silent: options.quiet, json: options.json });
+  return preflightCommand(options);
+});
 program.command("init").description("Initialize SecurityChecks in a project").option("-p, --path <path>", "Target path (default: current directory)").option("--hooks", "Install git pre-commit hook to run checks before commits").action(initCommand);
 program.command("hooks").description("Manage git pre-commit hooks").option("-p, --path <path>", "Target path (default: current directory)").option("--install", "Install pre-commit hook").option("--uninstall", "Uninstall pre-commit hook").option("--show", "Show current hook status (default)").action(hooksCommand);
 program.command("baseline").description("Manage the baseline of known issues").option("-p, --path <path>", "Target path (default: current directory)").option("--update", "Update baseline with current findings").option("--show", "Show current baseline").option("--prune", "Remove stale entries not seen recently").option("--prune-days <days>", "Days before considering stale (default: 90)").option("--notes <notes>", "Notes to attach to new baseline entries").option("-y, --yes", "Skip confirmation prompt (for CI/automation)").action(baselineCommand);