@vibecodeqa/cli 0.21.0 → 0.23.0

package/dist/report/svg.js

@@ -157,10 +157,12 @@ export function buildSparkline(values, opts) {
     const range = max - min || 1;
     const step = width / (values.length - 1);
     const points = values.map((v, i) => `${(i * step).toFixed(1)},${(height - ((v - min) / range) * (height - 4) - 2).toFixed(1)}`).join(" ");
-    const dots = values.map((v, i) => {
+    const dots = values
+        .map((v, i) => {
         const x = (i * step).toFixed(1);
         const y = (height - ((v - min) / range) * (height - 4) - 2).toFixed(1);
         return `<circle cx="${x}" cy="${y}" r="1.5" fill="${color}"/>`;
-    }).join("");
+    })
+        .join("");
     return `<svg viewBox="0 0 ${width} ${height}" width="${width}" height="${height}"><polyline points="${points}" fill="none" stroke="${color}" stroke-width="1.5" stroke-linecap="round"/>${dots}</svg>`;
 }

package/dist/runners/accessibility.js

@@ -1,13 +1,20 @@
 /** Accessibility check — detects common a11y violations in JSX/TSX code. */
 import { existsSync, readFileSync } from "node:fs";
 import { join } from "node:path";
-import { gradeFromScore } from "../types.js";
 import { getProductionFiles } from "../fs-utils.js";
+import { gradeFromScore } from "../types.js";
 export function runAccessibility(cwd) {
     const start = Date.now();
     const files = getProductionFiles(cwd).filter((f) => f.ext === ".tsx" || f.ext === ".jsx");
     if (files.length === 0) {
-        return { name: "accessibility", score: 100, grade: "A", details: { skipped: true, reason: "no JSX/TSX files" }, issues: [], duration: Date.now() - start };
+        return {
+            name: "accessibility",
+            score: 100,
+            grade: "A",
+            details: { skipped: true, reason: "no JSX/TSX files" },
+            issues: [],
+            duration: Date.now() - start,
+        };
     }
     const issues = [];
     let missingAlt = 0;
@@ -36,7 +43,13 @@ export function runAccessibility(cwd) {
                 const block = lines.slice(i, Math.min(i + 3, lines.length)).join(" ");
                 if (!(/role=/.test(block) && /(?:onKeyDown|onKeyUp|onKeyPress|tabIndex)/.test(block))) {
                     clickDiv++;
-                    issues.push({ severity: "warning", message: "Click handler on non-interactive element without role + keyboard handler", file: f.path, line: i + 1, rule: "click-events" });
+                    issues.push({
+                        severity: "warning",
+                        message: "Click handler on non-interactive element without role + keyboard handler",
+                        file: f.path,
+                        line: i + 1,
+                        rule: "click-events",
+                    });
                 }
             }
             // 3. <input>/<select>/<textarea> without associated label
@@ -44,18 +57,36 @@ export function runAccessibility(cwd) {
                 const block = lines.slice(Math.max(0, i - 3), Math.min(i + 3, lines.length)).join(" ");
                 if (!/aria-label=/.test(block) && !/aria-labelledby=/.test(block) && !/<label/.test(block) && !/id=/.test(trimmed)) {
                     missingLabel++;
-                    issues.push({ severity: "warning", message: "Form control without label, aria-label, or aria-labelledby", file: f.path, line: i + 1, rule: "form-label" });
+                    issues.push({
+                        severity: "warning",
+                        message: "Form control without label, aria-label, or aria-labelledby",
+                        file: f.path,
+                        line: i + 1,
+                        rule: "form-label",
+                    });
                 }
             }
             // 4. autoFocus
             if (/\bautoFocus\b/.test(trimmed) || /\bautofocus\b/.test(trimmed)) {
                 autofocus++;
-                issues.push({ severity: "warning", message: "autoFocus can disorient screen reader users", file: f.path, line: i + 1, rule: "no-autofocus" });
+                issues.push({
+                    severity: "warning",
+                    message: "autoFocus can disorient screen reader users",
+                    file: f.path,
+                    line: i + 1,
+                    rule: "no-autofocus",
+                });
             }
             // 5. Positive tabIndex
             if (/tabIndex=\{[1-9]/.test(trimmed) || /tabindex=["'][1-9]/.test(trimmed)) {
                 positiveTabindex++;
-                issues.push({ severity: "warning", message: "Positive tabIndex disrupts natural tab order — use 0 or -1", file: f.path, line: i + 1, rule: "tabindex" });
+                issues.push({
+                    severity: "warning",
+                    message: "Positive tabIndex disrupts natural tab order — use 0 or -1",
+                    file: f.path,
+                    line: i + 1,
+                    rule: "tabindex",
+                });
             }
         }
     }

package/dist/runners/architecture.d.ts

@@ -27,4 +27,6 @@ export declare function runArchitecture(cwd: string): CheckResult;
 export declare function generateArchSVG(details: Record<string, unknown>): string;
 export declare function generateDSM(details: Record<string, unknown>): string;
 export declare function generatePackageDiagram(details: Record<string, unknown>): string;
+export declare function generateSequenceDiagram(details: Record<string, unknown>): string;
+export declare function generateContainerDiagram(cwd: string): string;
 export {};

package/dist/runners/architecture.js

@@ -9,7 +9,8 @@
  *   6. Layer violations (optional: detect cross-layer imports)
  *   7. SVG architecture diagram
  */
-import { basename, dirname, extname } from "node:path";
+import { existsSync } from "node:fs";
+import { basename, dirname, extname, join } from "node:path";
 import { getProductionFiles } from "../fs-utils.js";
 import { gradeFromScore } from "../types.js";
 export function runArchitecture(cwd) {
@@ -105,6 +106,7 @@ export function runArchitecture(cwd) {
             highFanOut,
             connectors,
             graph: graphData,
+            containerSvg: generateContainerDiagram(cwd),
         },
         issues,
         duration: Date.now() - start,
@@ -504,3 +506,155 @@ export function generatePackageDiagram(details) {
     const H = maxH + gap;
     return `<svg viewBox="0 0 ${W} ${H}" xmlns="http://www.w3.org/2000/svg" style="width:100%;max-width:${W}px">${svg}</svg>`;
 }
+// ── Sequence Diagram ─────────────────────────────────────────────────
+// Traces the longest import chains from entry points, showing how a request
+// flows through the system. UML-style lifelines with arrows.
+export function generateSequenceDiagram(details) {
+    const graph = details.graph;
+    if (!graph || Object.keys(graph).length < 3)
+        return "";
+    // Find entry points (files with 0 importers that aren't utility files)
+    const entries = Object.entries(graph);
+    const entryPoints = entries
+        .filter(([path, info]) => {
+        const name = basename(path, extname(path));
+        return info.importedBy.length === 0 && ["index", "main", "cli", "App", "app", "server"].includes(name);
+    })
+        .map(([p]) => p);
+    if (entryPoints.length === 0)
+        return "";
+    // BFS from first entry point to find the longest chain (max 8 deep)
+    const entry = entryPoints[0];
+    const chain = findLongestChain(entry, graph, 8);
+    if (chain.length < 3)
+        return "";
+    // Draw sequence diagram
+    const participants = chain.map((p) => basename(p, extname(p)));
+    const lifelineSpacing = 120;
+    const W = participants.length * lifelineSpacing + 40;
+    const messageH = 36;
+    const headerH = 50;
+    const H = headerH + (chain.length - 1) * messageH + 40;
+    let svg = "";
+    // Participant boxes (lifeline headers)
+    for (let i = 0; i < participants.length; i++) {
+        const x = 20 + i * lifelineSpacing + lifelineSpacing / 2;
+        const name = participants[i];
+        const boxW = Math.max(60, name.length * 7 + 16);
+        svg += `<rect x="${x - boxW / 2}" y="8" width="${boxW}" height="22" rx="4" fill="#ffffff08" stroke="#ffffff15"/>`;
+        svg += `<text x="${x}" y="23" text-anchor="middle" fill="#9ca3af" font-size="9" font-weight="600">${name}</text>`;
+        // Lifeline (dashed vertical)
+        svg += `<line x1="${x}" y1="30" x2="${x}" y2="${H - 10}" stroke="#ffffff10" stroke-width="1" stroke-dasharray="4,3"/>`;
+    }
+    // Arrows between lifelines (imports = calls)
+    for (let i = 0; i < chain.length - 1; i++) {
+        const fromX = 20 + i * lifelineSpacing + lifelineSpacing / 2;
+        const toX = 20 + (i + 1) * lifelineSpacing + lifelineSpacing / 2;
+        const y = headerH + i * messageH;
+        // Arrow
+        svg += `<line x1="${fromX}" y1="${y}" x2="${toX - 6}" y2="${y}" stroke="#6d78d0" stroke-width="1.5" marker-end="url(#seq-arrow)"/>`;
+        // Label (the import)
+        const label = `import`;
+        svg += `<text x="${(fromX + toX) / 2}" y="${y - 6}" text-anchor="middle" fill="#6b7280" font-size="7">${label}</text>`;
+    }
+    // Arrow marker
+    const defs = `<defs><marker id="seq-arrow" viewBox="0 0 10 7" refX="10" refY="3.5" markerWidth="7" markerHeight="5" orient="auto"><polygon points="0 0, 10 3.5, 0 7" fill="#6d78d0"/></marker></defs>`;
+    return `<svg viewBox="0 0 ${W} ${H}" xmlns="http://www.w3.org/2000/svg" style="width:100%;max-width:${W}px">${defs}${svg}</svg>`;
+}
+function findLongestChain(start, graph, maxDepth) {
+    let longest = [start];
+    const visited = new Set([start]);
+    function dfs(node, path) {
+        if (path.length > longest.length)
+            longest = [...path];
+        if (path.length >= maxDepth)
+            return;
+        const info = graph[node];
+        if (!info)
+            return;
+        for (const imp of info.imports) {
+            if (!visited.has(imp) && graph[imp]) {
+                visited.add(imp);
+                dfs(imp, [...path, imp]);
+                visited.delete(imp);
+            }
+        }
+    }
+    dfs(start, [start]);
+    return longest;
+}
+// ── Container Diagram ────────────────────────────────────────────────
+// Auto-detects high-level system containers from config files:
+// frontend, backend/API, database, worker, static site, etc.
+export function generateContainerDiagram(cwd) {
+    const has = (f) => existsSync(join(cwd, f));
+    const containers = [];
+    // Detect containers from config files
+    if (has("src/App.tsx") || has("src/App.vue") || has("src/App.svelte") || has("web/src/App.tsx")) {
+        const tech = has("src/App.tsx") ? "React" : has("src/App.vue") ? "Vue" : "Svelte";
+        containers.push({ name: "Frontend", type: "webapp", tech });
+    }
+    if (has("wrangler.toml") || has("wrangler.json")) {
+        containers.push({ name: "Worker", type: "worker", tech: "Cloudflare Workers" });
+    }
+    if (has("Dockerfile") || has("server.ts") || has("src/server.ts") || has("src/index.ts")) {
+        if (!containers.some((c) => c.name === "Frontend")) {
+            containers.push({ name: "API Server", type: "api", tech: "Node.js" });
+        }
+    }
+    if (has("prisma/schema.prisma") || has("drizzle.config.ts")) {
+        const tech = has("prisma/schema.prisma") ? "Prisma" : "Drizzle";
+        containers.push({ name: "Database", type: "db", tech });
+    }
+    if (has("firebase.json") || has(".firebaserc")) {
+        containers.push({ name: "Firebase", type: "baas", tech: "Firebase" });
+    }
+    if (has("supabase/config.toml") || has(".supabase")) {
+        containers.push({ name: "Supabase", type: "baas", tech: "Supabase" });
+    }
+    if (has("pubspec.yaml")) {
+        containers.push({ name: "Mobile App", type: "mobile", tech: "Flutter" });
+    }
+    if (has("package.json") && !containers.length) {
+        containers.push({ name: "Application", type: "app", tech: "Node.js" });
+    }
+    if (containers.length < 2)
+        return ""; // Only interesting with 2+ containers
+    // Layout: horizontal boxes with connecting lines
+    const boxW = 140;
+    const boxH = 60;
+    const gap = 30;
+    const W = containers.length * (boxW + gap) + gap;
+    const H = 120;
+    const typeColors = {
+        webapp: "#6d78d0",
+        worker: "#d97706",
+        api: "#22c55e",
+        db: "#8b5cf6",
+        baas: "#ec4899",
+        mobile: "#06b6d4",
+        app: "#6d78d0",
+    };
+    let svg = "";
+    for (let i = 0; i < containers.length; i++) {
+        const c = containers[i];
+        const x = gap + i * (boxW + gap);
+        const y = (H - boxH) / 2;
+        const color = typeColors[c.type] || "#6d78d0";
+        // Box
+        svg += `<rect x="${x}" y="${y}" width="${boxW}" height="${boxH}" rx="8" fill="${color}15" stroke="${color}50"/>`;
+        // Name
+        svg += `<text x="${x + boxW / 2}" y="${y + 24}" text-anchor="middle" fill="#e5e5e5" font-size="10" font-weight="700">${c.name}</text>`;
+        // Tech
+        svg += `<text x="${x + boxW / 2}" y="${y + 40}" text-anchor="middle" fill="#6b7280" font-size="8">[${c.tech}]</text>`;
+        // Connection to next
+        if (i < containers.length - 1) {
+            const ax = x + boxW;
+            const bx = ax + gap;
+            const ay = H / 2;
+            svg += `<line x1="${ax}" y1="${ay}" x2="${bx}" y2="${ay}" stroke="#ffffff20" stroke-width="1.5" marker-end="url(#cont-arrow)"/>`;
+        }
+    }
+    const defs = `<defs><marker id="cont-arrow" viewBox="0 0 10 7" refX="10" refY="3.5" markerWidth="7" markerHeight="5" orient="auto"><polygon points="0 0, 10 3.5, 0 7" fill="#ffffff40"/></marker></defs>`;
+    return `<svg viewBox="0 0 ${W} ${H}" xmlns="http://www.w3.org/2000/svg" style="width:100%;max-width:${W}px">${defs}${svg}</svg>`;
+}

package/dist/runners/best-practices.js

@@ -13,32 +13,23 @@ import { existsSync, readdirSync, readFileSync } from "node:fs";
 import { join } from "node:path";
 import { readDeps } from "../fs-utils.js";
 import { gradeFromScore } from "../types.js";
-export function runBestPractices(cwd) {
-    const start = Date.now();
+function checkCICD(cwd, has, read) {
     const issues = [];
     let practices = 0;
     let followed = 0;
-    const has = (f) => existsSync(join(cwd, f));
-    const read = (f) => { try {
-        return readFileSync(join(cwd, f), "utf-8");
-    }
-    catch {
-        return "";
-    } };
-    // ── 1. CI/CD Best Practices ──
     // Check for GitHub Actions workflows
     const hasWorkflows = has(".github/workflows");
     practices++;
     if (hasWorkflows) {
         followed++;
-        const workflows = readdirSync(join(cwd, ".github/workflows")).filter(f => f.endsWith(".yml") || f.endsWith(".yaml"));
+        const workflows = readdirSync(join(cwd, ".github/workflows")).filter((f) => f.endsWith(".yml") || f.endsWith(".yaml"));
         for (const wf of workflows) {
             const content = read(`.github/workflows/${wf}`);
             // Check: actions pinned to SHA (not @v4, @main)
             const actionUses = content.match(/uses:\s*([^\n]+)/g) || [];
-            const unpinned = actionUses.filter(u => !u.includes("@") || (!u.match(/@[a-f0-9]{40}/) && !u.includes("@sha")));
+            const unpinned = actionUses.filter((u) => !u.includes("@") || (!u.match(/@[a-f0-9]{40}/) && !u.includes("@sha")));
             // Only flag third-party actions (not actions/*)
-            const unpinnedThirdParty = unpinned.filter(u => !u.includes("actions/") && !u.includes("pnpm/"));
+            const unpinnedThirdParty = unpinned.filter((u) => !u.includes("actions/") && !u.includes("pnpm/"));
             if (unpinnedThirdParty.length > 0) {
                 issues.push({
                     severity: "info",
@@ -97,7 +88,12 @@ export function runBestPractices(cwd) {
             rule: "no-ci",
         });
     }
-    // ── 2. Supply Chain ──
+    return { practices, followed, issues };
+}
+function checkSupplyChain(has, read) {
+    const issues = [];
+    let practices = 0;
+    let followed = 0;
     // Lockfile committed
     practices++;
     const hasLockfile = has("pnpm-lock.yaml") || has("package-lock.json") || has("yarn.lock") || has("bun.lockb") || has("pubspec.lock");
@@ -114,7 +110,11 @@ export function runBestPractices(cwd) {
         followed++;
     }
     else {
-        issues.push({ severity: "info", message: "No engine constraints (engines in package.json or .nvmrc) — Node version not pinned", rule: "pin-node-version" });
+        issues.push({
+            severity: "info",
+            message: "No engine constraints (engines in package.json or .nvmrc) — Node version not pinned",
+            rule: "pin-node-version",
+        });
     }
     // npm provenance / package.json has repository field
     if (pkg) {
@@ -123,10 +123,19 @@ export function runBestPractices(cwd) {
             followed++;
         }
         else {
-            issues.push({ severity: "info", message: "package.json missing repository field — provenance attestation won't link to source", rule: "repository-field" });
+            issues.push({
+                severity: "info",
+                message: "package.json missing repository field — provenance attestation won't link to source",
+                rule: "repository-field",
+            });
         }
     }
-    // ── 3. Repo Hygiene ──
+    return { practices, followed, issues };
+}
+function checkRepoHygiene(has) {
+    const issues = [];
+    let practices = 0;
+    let followed = 0;
     // SECURITY.md or security policy
     practices++;
     if (has("SECURITY.md") || has(".github/SECURITY.md")) {
@@ -149,14 +158,27 @@ export function runBestPractices(cwd) {
         followed++;
     }
     else {
-        issues.push({ severity: "info", message: "No CONTRIBUTING.md — onboarding is harder for new contributors", rule: "contributing-guide" });
+        issues.push({
+            severity: "info",
+            message: "No CONTRIBUTING.md — onboarding is harder for new contributors",
+            rule: "contributing-guide",
+        });
     }
-    // ── 4. Developer Experience ──
+    return { practices, followed, issues };
+}
+function checkDevExperience(cwd, has) {
+    const issues = [];
+    let practices = 0;
+    let followed = 0;
     // .env.example
     practices++;
     const hasEnvFiles = has(".env") || has(".env.local") || has(".env.development");
     if (hasEnvFiles && !has(".env.example")) {
-        issues.push({ severity: "info", message: "Has .env files but no .env.example — new developers won't know what vars are needed", rule: "env-example" });
+        issues.push({
+            severity: "info",
+            message: "Has .env files but no .env.example — new developers won't know what vars are needed",
+            rule: "env-example",
+        });
     }
     else {
         followed++;
@@ -168,7 +190,11 @@ export function runBestPractices(cwd) {
         followed++;
     }
     else {
-        issues.push({ severity: "info", message: "No pre-commit hooks (husky/lefthook) — lint/format not enforced before commit", rule: "pre-commit-hooks" });
+        issues.push({
+            severity: "info",
+            message: "No pre-commit hooks (husky/lefthook) — lint/format not enforced before commit",
+            rule: "pre-commit-hooks",
+        });
     }
     // Renovate/Dependabot for automated dependency updates
     practices++;
@@ -176,16 +202,34 @@ export function runBestPractices(cwd) {
         followed++;
     }
     else {
-        issues.push({ severity: "info", message: "No Dependabot/Renovate — dependency updates are manual and often forgotten", rule: "automated-deps" });
+        issues.push({
+            severity: "info",
+            message: "No Dependabot/Renovate — dependency updates are manual and often forgotten",
+            rule: "automated-deps",
+        });
     }
-    // ── 5. Code Quality Tooling ──
+    return { practices, followed, issues };
+}
+function checkCodeQualityTooling(has, read) {
+    const issues = [];
+    let practices = 0;
+    let followed = 0;
     // Linter configured
     practices++;
-    if (has("biome.json") || has(".eslintrc.json") || has(".eslintrc.js") || has("eslint.config.js") || has("eslint.config.ts") || has("analysis_options.yaml")) {
+    if (has("biome.json") ||
+        has(".eslintrc.json") ||
+        has(".eslintrc.js") ||
+        has("eslint.config.js") ||
+        has("eslint.config.ts") ||
+        has("analysis_options.yaml")) {
         followed++;
     }
     else {
-        issues.push({ severity: "warning", message: "No linter config (ESLint/Biome/dart analyze) — code style not enforced", rule: "linter-config" });
+        issues.push({
+            severity: "warning",
+            message: "No linter config (ESLint/Biome/dart analyze) — code style not enforced",
+            rule: "linter-config",
+        });
     }
     // Formatter configured
     practices++;
@@ -193,7 +237,11 @@ export function runBestPractices(cwd) {
         followed++;
     }
     else {
-        issues.push({ severity: "info", message: "No formatter config (Prettier/Biome/.editorconfig) — inconsistent code formatting", rule: "formatter-config" });
+        issues.push({
+            severity: "info",
+            message: "No formatter config (Prettier/Biome/.editorconfig) — inconsistent code formatting",
+            rule: "formatter-config",
+        });
     }
     // TypeScript strict mode
     practices++;
@@ -202,9 +250,19 @@ export function runBestPractices(cwd) {
         followed++;
     }
     else {
-        issues.push({ severity: "info", message: "TypeScript strict mode not enabled — allows implicit any and null errors", rule: "ts-strict-mode" });
+        issues.push({
+            severity: "info",
+            message: "TypeScript strict mode not enabled — allows implicit any and null errors",
+            rule: "ts-strict-mode",
+        });
     }
-    // ── 6. Testing Best Practices ──
+    return { practices, followed, issues };
+}
+function checkTesting(has, read) {
+    const issues = [];
+    let practices = 0;
+    let followed = 0;
+    const pkg = read("package.json");
     // Test script exists
     practices++;
     if (pkg.includes('"test"') || has("pubspec.yaml")) {
@@ -219,9 +277,18 @@ export function runBestPractices(cwd) {
         followed++;
     }
     else {
-        issues.push({ severity: "info", message: "No test coverage configuration — coverage thresholds not enforced", rule: "coverage-config" });
+        issues.push({
+            severity: "info",
+            message: "No test coverage configuration — coverage thresholds not enforced",
+            rule: "coverage-config",
+        });
     }
-    // ── 7. Docker / Deployment ──
+    return { practices, followed, issues };
+}
+function checkDocker(has, read) {
+    const issues = [];
+    let practices = 0;
+    let followed = 0;
     // Dockerfile best practices (if Docker is used)
     if (has("Dockerfile") || has("docker-compose.yml") || has("docker-compose.yaml")) {
         practices++;
@@ -230,7 +297,11 @@ export function runBestPractices(cwd) {
             followed++;
         }
         else if (dockerfile.includes(":latest")) {
-            issues.push({ severity: "warning", message: "Dockerfile uses :latest tag — pin to a specific version for reproducible builds", rule: "docker-pin-version" });
+            issues.push({
+                severity: "warning",
+                message: "Dockerfile uses :latest tag — pin to a specific version for reproducible builds",
+                rule: "docker-pin-version",
+            });
         }
         else {
             followed++;
@@ -242,7 +313,11 @@ export function runBestPractices(cwd) {
             followed++;
         }
         else if (dockerfile.length > 100) {
-            issues.push({ severity: "info", message: "Dockerfile is single-stage — consider multi-stage to reduce image size", rule: "docker-multi-stage" });
+            issues.push({
+                severity: "info",
+                message: "Dockerfile is single-stage — consider multi-stage to reduce image size",
+                rule: "docker-multi-stage",
+            });
         }
         else {
             followed++;
@@ -253,10 +328,20 @@ export function runBestPractices(cwd) {
             followed++;
         }
         else {
-            issues.push({ severity: "info", message: "No .dockerignore — node_modules and build artifacts will bloat Docker image", rule: "dockerignore" });
+            issues.push({
+                severity: "info",
+                message: "No .dockerignore — node_modules and build artifacts will bloat Docker image",
+                rule: "dockerignore",
+            });
         }
     }
-    // ── 8. Git Practices ──
+    return { practices, followed, issues };
+}
+function checkGitPractices(cwd, has, read) {
+    const issues = [];
+    let practices = 0;
+    let followed = 0;
+    const deps = readDeps(cwd);
     // .gitignore is comprehensive
     practices++;
     const gitignore = read(".gitignore");
@@ -264,7 +349,11 @@ export function runBestPractices(cwd) {
         followed++;
     }
     else if (gitignore) {
-        issues.push({ severity: "info", message: ".gitignore exists but may be incomplete — ensure build artifacts are excluded", rule: "gitignore-complete" });
+        issues.push({
+            severity: "info",
+            message: ".gitignore exists but may be incomplete — ensure build artifacts are excluded",
+            rule: "gitignore-complete",
+        });
     }
     else {
         followed++; // no gitignore = handled by structure check
@@ -275,9 +364,19 @@ export function runBestPractices(cwd) {
         followed++;
     }
     else {
-        issues.push({ severity: "info", message: "No commit convention enforcement (commitlint/changesets) — changelog generation is manual", rule: "conventional-commits" });
+        issues.push({
+            severity: "info",
+            message: "No commit convention enforcement (commitlint/changesets) — changelog generation is manual",
+            rule: "conventional-commits",
+        });
     }
-    // ── 9. Monitoring & Observability ──
+    return { practices, followed, issues };
+}
+function checkMonitoring(cwd) {
+    const issues = [];
+    let practices = 0;
+    let followed = 0;
+    const deps = readDeps(cwd);
     // Error tracking (Sentry, Bugsnag, etc.) — only for apps/servers, not CLI tools
     const isApp = deps.react || deps.vue || deps.svelte || deps.express || deps.fastify || deps.hono || deps.next || deps.nuxt;
     if (isApp) {
@@ -286,10 +385,21 @@ export function runBestPractices(cwd) {
             followed++;
         }
         else {
-            issues.push({ severity: "info", message: "No error tracking (Sentry/Bugsnag) — production errors may go unnoticed", rule: "error-tracking" });
+            issues.push({
+                severity: "info",
+                message: "No error tracking (Sentry/Bugsnag) — production errors may go unnoticed",
+                rule: "error-tracking",
+            });
         }
     }
-    // ── 10. API & Configuration ──
+    return { practices, followed, issues };
+}
+function checkAPIConfig(cwd, read) {
+    const issues = [];
+    let practices = 0;
+    let followed = 0;
+    const deps = readDeps(cwd);
+    const pkg = read("package.json");
     // Environment validation (zod, joi, envalid)
     practices++;
     if (deps.zod || deps.joi || deps.envalid || deps["@t3-oss/env-core"] || deps["@t3-oss/env-nextjs"]) {
@@ -298,12 +408,49 @@ export function runBestPractices(cwd) {
     else {
         const hasEnvUsage = pkg.includes("process.env") || read("src/index.ts").includes("process.env") || read("src/main.ts").includes("process.env");
         if (hasEnvUsage) {
-            issues.push({ severity: "info", message: "Uses env vars but no validation library (zod/envalid) — missing vars crash at runtime", rule: "env-validation" });
+            issues.push({
+                severity: "info",
+                message: "Uses env vars but no validation library (zod/envalid) — missing vars crash at runtime",
+                rule: "env-validation",
+            });
         }
         else {
             followed++;
         }
     }
+    return { practices, followed, issues };
+}
+export function runBestPractices(cwd) {
+    const start = Date.now();
+    const has = (f) => existsSync(join(cwd, f));
+    const read = (f) => {
+        try {
+            return readFileSync(join(cwd, f), "utf-8");
+        }
+        catch {
+            return "";
+        }
+    };
+    const categories = [
+        checkCICD(cwd, has, read),
+        checkSupplyChain(has, read),
+        checkRepoHygiene(has),
+        checkDevExperience(cwd, has),
+        checkCodeQualityTooling(has, read),
+        checkTesting(has, read),
+        checkDocker(has, read),
+        checkGitPractices(cwd, has, read),
+        checkMonitoring(cwd),
+        checkAPIConfig(cwd, read),
+    ];
+    let practices = 0;
+    let followed = 0;
+    const issues = [];
+    for (const cat of categories) {
+        practices += cat.practices;
+        followed += cat.followed;
+        issues.push(...cat.issues);
+    }
     // ── Score ──
     const pct = practices > 0 ? Math.round((followed / practices) * 100) : 100;
     const score = pct;

package/dist/runners/dependencies.js

@@ -20,7 +20,9 @@ export function runDependencies(cwd, stack) {
                 }
             }
         }
-        catch { /* parse failed */ }
+        catch {
+            /* parse failed */
+        }
         if (majorOutdated > 0)
             issues.push({ severity: "warning", message: `${majorOutdated} packages behind by a major version` });
         const score = Math.max(0, Math.min(100, 100 - majorOutdated));