@vibgrate/cli 0.1.1

package/dist/chunk-OHAVLM6P.js

@@ -0,0 +1,29 @@
+import {
+  runScan,
+  writeJsonFile
+} from "./chunk-DLRBJYO6.js";
+
+// src/commands/baseline.ts
+import * as path from "path";
+import { Command } from "commander";
+import chalk from "chalk";
+async function runBaseline(rootDir) {
+  console.log(chalk.dim("Creating baseline..."));
+  const artifact = await runScan(rootDir, {
+    format: "text",
+    concurrency: 8
+  });
+  const baselinePath = path.join(rootDir, ".vibgrate", "baseline.json");
+  await writeJsonFile(baselinePath, artifact);
+  console.log(chalk.green("\u2714") + ` Baseline saved to ${chalk.bold(".vibgrate/baseline.json")}`);
+  console.log(chalk.dim(`  Baseline score: ${artifact.drift.score}/100`));
+}
+var baselineCommand = new Command("baseline").description("Create a drift baseline snapshot").argument("[path]", "Path to baseline", ".").action(async (targetPath) => {
+  const rootDir = path.resolve(targetPath);
+  await runBaseline(rootDir);
+});
+
+export {
+  runBaseline,
+  baselineCommand
+};

package/dist/cli.d.ts

@@ -0,0 +1 @@
+#!/usr/bin/env node

package/dist/cli.js

@@ -0,0 +1,377 @@
+#!/usr/bin/env node
+import {
+  formatMarkdown
+} from "./chunk-AMOJCCF5.js";
+import {
+  baselineCommand
+} from "./chunk-OHAVLM6P.js";
+import {
+  VERSION,
+  ensureDir,
+  formatText,
+  pathExists,
+  readJsonFile,
+  readTextFile,
+  scanCommand,
+  writeDefaultConfig,
+  writeTextFile
+} from "./chunk-DLRBJYO6.js";
+
+// src/cli.ts
+import { Command as Command6 } from "commander";
+import chalk6 from "chalk";
+
+// src/commands/init.ts
+import * as path from "path";
+import { Command } from "commander";
+import chalk from "chalk";
+var initCommand = new Command("init").description("Initialize vibgrate in a project").argument("[path]", "Path to initialize", ".").option("--baseline", "Create initial baseline after init").option("--yes", "Skip confirmation prompts").action(async (targetPath, opts) => {
+  const rootDir = path.resolve(targetPath);
+  const vibgrateDir = path.join(rootDir, ".vibgrate");
+  await ensureDir(vibgrateDir);
+  console.log(chalk.green("\u2714") + ` Created ${chalk.bold(".vibgrate/")} directory`);
+  const configPath = path.join(rootDir, "vibgrate.config.ts");
+  if (await pathExists(configPath)) {
+    console.log(chalk.dim("  vibgrate.config.ts already exists, skipping"));
+  } else {
+    await writeDefaultConfig(rootDir);
+    console.log(chalk.green("\u2714") + ` Created ${chalk.bold("vibgrate.config.ts")}`);
+  }
+  if (opts.baseline) {
+    const { runBaseline } = await import("./baseline-AENFLFQT.js");
+    await runBaseline(rootDir);
+  }
+  console.log("");
+  console.log(chalk.bold("Next steps:"));
+  console.log(`  ${chalk.cyan("vibgrate scan .")}          Scan for upgrade drift`);
+  console.log(`  ${chalk.cyan("vibgrate baseline .")}      Create a drift baseline`);
+  console.log("");
+});
+
+// src/commands/report.ts
+import * as path2 from "path";
+import { Command as Command2 } from "commander";
+import chalk2 from "chalk";
+var reportCommand = new Command2("report").description("Generate a drift report from a scan artifact").option("--in <file>", "Input artifact file", ".vibgrate/scan_result.json").option("--format <format>", "Output format (md|text|json)", "text").action(async (opts) => {
+  const artifactPath = path2.resolve(opts.in);
+  if (!await pathExists(artifactPath)) {
+    console.error(chalk2.red(`Artifact not found: ${artifactPath}`));
+    console.error(chalk2.dim('Run "vibgrate scan" first to generate a scan artifact.'));
+    process.exit(1);
+  }
+  const artifact = await readJsonFile(artifactPath);
+  switch (opts.format) {
+    case "md":
+      console.log(formatMarkdown(artifact));
+      break;
+    case "json":
+      console.log(JSON.stringify(artifact, null, 2));
+      break;
+    case "text":
+    default:
+      console.log(formatText(artifact));
+      break;
+  }
+});
+
+// src/commands/dsn.ts
+import * as crypto from "crypto";
+import * as path3 from "path";
+import { Command as Command3 } from "commander";
+import chalk3 from "chalk";
+var REGION_HOSTS = {
+  us: "us.ingest.vibgrate.com",
+  eu: "eu.ingest.vibgrate.com"
+};
+function resolveIngestHost(region, ingest) {
+  if (ingest) {
+    try {
+      return new URL(ingest).host;
+    } catch {
+      throw new Error(`Invalid ingest URL: ${ingest}`);
+    }
+  }
+  const r = (region ?? "us").toLowerCase();
+  const host = REGION_HOSTS[r];
+  if (!host) {
+    throw new Error(`Unknown region "${r}". Supported: ${Object.keys(REGION_HOSTS).join(", ")}`);
+  }
+  return host;
+}
+var dsnCommand = new Command3("dsn").description("Manage DSN tokens");
+dsnCommand.command("create").description("Create a new DSN token").option("--ingest <url>", "Ingest API URL (overrides --region)").option("--region <region>", "Data residency region (us, eu)", "us").requiredOption("--workspace <id>", "Workspace ID").option("--write <path>", "Write DSN to file").action(async (opts) => {
+  const keyId = crypto.randomBytes(8).toString("hex");
+  const secret = crypto.randomBytes(32).toString("hex");
+  let ingestHost;
+  try {
+    ingestHost = resolveIngestHost(opts.region, opts.ingest);
+  } catch (e) {
+    console.error(chalk3.red(e instanceof Error ? e.message : String(e)));
+    process.exit(1);
+  }
+  const dsn = `vibgrate+https://${keyId}:${secret}@${ingestHost}/${opts.workspace}`;
+  console.log(chalk3.green("\u2714") + " DSN created");
+  console.log("");
+  console.log(chalk3.bold("DSN:"));
+  console.log(`  ${dsn}`);
+  console.log("");
+  console.log(chalk3.bold("Key ID:"));
+  console.log(`  ${keyId}`);
+  console.log("");
+  console.log(chalk3.dim("Set this as VIBGRATE_DSN in your CI environment."));
+  console.log(chalk3.dim("The secret must be registered on your Vibgrate ingest API."));
+  if (opts.write) {
+    const writePath = path3.resolve(opts.write);
+    await writeTextFile(writePath, dsn + "\n");
+    console.log("");
+    console.log(chalk3.green("\u2714") + ` DSN written to ${opts.write}`);
+    console.log(chalk3.yellow("\u26A0") + " Add this file to .gitignore!");
+  }
+});
+
+// src/commands/push.ts
+import * as crypto2 from "crypto";
+import * as path4 from "path";
+import { Command as Command4 } from "commander";
+import chalk4 from "chalk";
+function parseDsn(dsn) {
+  const match = dsn.match(/^vibgrate\+https:\/\/([^:]+):([^@]+)@([^/]+)\/(.+)$/);
+  if (!match) return null;
+  return {
+    keyId: match[1],
+    secret: match[2],
+    host: match[3],
+    workspaceId: match[4]
+  };
+}
+function computeHmac(body, secret) {
+  return crypto2.createHmac("sha256", secret).update(body).digest("base64");
+}
+var pushCommand = new Command4("push").description("Push scan results to Vibgrate API").option("--dsn <dsn>", "DSN token (or use VIBGRATE_DSN env)").option("--region <region>", "Override data residency region (us, eu)").option("--file <file>", "Scan artifact file", ".vibgrate/scan_result.json").option("--strict", "Fail on upload errors").action(async (opts) => {
+  const dsn = opts.dsn || process.env.VIBGRATE_DSN;
+  if (!dsn) {
+    console.error(chalk4.red("No DSN provided."));
+    console.error(chalk4.dim("Set VIBGRATE_DSN environment variable or use --dsn flag."));
+    if (opts.strict) process.exit(1);
+    return;
+  }
+  const parsed = parseDsn(dsn);
+  if (!parsed) {
+    console.error(chalk4.red("Invalid DSN format."));
+    console.error(chalk4.dim("Expected: vibgrate+https://<key_id>:<secret>@<host>/<workspace_id>"));
+    if (opts.strict) process.exit(1);
+    return;
+  }
+  const filePath = path4.resolve(opts.file);
+  if (!await pathExists(filePath)) {
+    console.error(chalk4.red(`Scan artifact not found: ${filePath}`));
+    console.error(chalk4.dim('Run "vibgrate scan" first.'));
+    if (opts.strict) process.exit(1);
+    return;
+  }
+  const body = await readTextFile(filePath);
+  const timestamp = String(Date.now());
+  const hmac = computeHmac(body, parsed.secret);
+  let host = parsed.host;
+  if (opts.region) {
+    try {
+      host = resolveIngestHost(opts.region);
+    } catch (e) {
+      console.error(chalk4.red(e instanceof Error ? e.message : String(e)));
+      if (opts.strict) process.exit(1);
+      return;
+    }
+  }
+  const url = `https://${host}/v1/ingest/scan`;
+  console.log(chalk4.dim(`Uploading to ${host}...`));
+  try {
+    const response = await fetch(url, {
+      method: "POST",
+      headers: {
+        "Content-Type": "application/json",
+        "X-Vibgrate-Timestamp": timestamp,
+        "Authorization": `VibgrateDSN ${parsed.keyId}:${hmac}`
+      },
+      body
+    });
+    if (!response.ok) {
+      const text = await response.text();
+      throw new Error(`HTTP ${response.status}: ${text}`);
+    }
+    const result = await response.json();
+    console.log(chalk4.green("\u2714") + ` Uploaded successfully (${result.ingestId ?? "ok"})`);
+  } catch (e) {
+    const msg = e instanceof Error ? e.message : String(e);
+    console.error(chalk4.red(`Upload failed: ${msg}`));
+    if (opts.strict) process.exit(1);
+  }
+});
+
+// src/commands/update.ts
+import { execSync } from "child_process";
+import * as path6 from "path";
+import { Command as Command5 } from "commander";
+import chalk5 from "chalk";
+
+// src/utils/update-check.ts
+import * as fs from "fs/promises";
+import * as path5 from "path";
+import * as os from "os";
+import semver from "semver";
+var REGISTRY_URL = "https://registry.npmjs.org/@vibgrate%2fcli/latest";
+var CACHE_DIR = path5.join(os.homedir(), ".vibgrate");
+var CACHE_FILE = path5.join(CACHE_DIR, "update-check.json");
+var CHECK_INTERVAL_MS = 12 * 60 * 60 * 1e3;
+async function checkForUpdate() {
+  try {
+    const cached = await readCache();
+    if (cached && Date.now() - cached.checkedAt < CHECK_INTERVAL_MS) {
+      return {
+        current: VERSION,
+        latest: cached.latest,
+        updateAvailable: semver.gt(cached.latest, VERSION)
+      };
+    }
+    const controller = new AbortController();
+    const timeout = setTimeout(() => controller.abort(), 5e3);
+    const response = await fetch(REGISTRY_URL, {
+      headers: { Accept: "application/json" },
+      signal: controller.signal
+    });
+    clearTimeout(timeout);
+    if (!response.ok) return null;
+    const data = await response.json();
+    const latest = data.version;
+    if (!latest || !semver.valid(latest)) return null;
+    await writeCache({ latest, checkedAt: Date.now() });
+    return {
+      current: VERSION,
+      latest,
+      updateAvailable: semver.gt(latest, VERSION)
+    };
+  } catch {
+    return null;
+  }
+}
+async function fetchLatestVersion() {
+  try {
+    const controller = new AbortController();
+    const timeout = setTimeout(() => controller.abort(), 1e4);
+    const response = await fetch(REGISTRY_URL, {
+      headers: { Accept: "application/json" },
+      signal: controller.signal
+    });
+    clearTimeout(timeout);
+    if (!response.ok) return null;
+    const data = await response.json();
+    const latest = data.version;
+    if (!latest || !semver.valid(latest)) return null;
+    await writeCache({ latest, checkedAt: Date.now() });
+    return latest;
+  } catch {
+    return null;
+  }
+}
+async function readCache() {
+  try {
+    const raw = await fs.readFile(CACHE_FILE, "utf-8");
+    const data = JSON.parse(raw);
+    if (data.latest && typeof data.checkedAt === "number") return data;
+    return null;
+  } catch {
+    return null;
+  }
+}
+async function writeCache(data) {
+  try {
+    await fs.mkdir(CACHE_DIR, { recursive: true });
+    await fs.writeFile(CACHE_FILE, JSON.stringify(data), "utf-8");
+  } catch {
+  }
+}
+
+// src/commands/update.ts
+async function detectPackageManager(cwd) {
+  if (await pathExists(path6.join(cwd, "pnpm-lock.yaml"))) return "pnpm";
+  if (await pathExists(path6.join(cwd, "bun.lockb"))) return "bun";
+  if (await pathExists(path6.join(cwd, "yarn.lock"))) return "yarn";
+  return "npm";
+}
+function getInstallCommand(pm, pkg, version, isDev) {
+  const spec = `${pkg}@${version}`;
+  switch (pm) {
+    case "pnpm":
+      return isDev ? `pnpm add -D ${spec}` : `pnpm add ${spec}`;
+    case "yarn":
+      return isDev ? `yarn add --dev ${spec}` : `yarn add ${spec}`;
+    case "bun":
+      return isDev ? `bun add -d ${spec}` : `bun add ${spec}`;
+    case "npm":
+    default:
+      return isDev ? `npm install --save-dev ${spec}` : `npm install ${spec}`;
+  }
+}
+async function isDevDependency(cwd) {
+  try {
+    const pkgPath = path6.join(cwd, "package.json");
+    const raw = await (await import("fs/promises")).readFile(pkgPath, "utf-8");
+    const pkg = JSON.parse(raw);
+    return Boolean(pkg.devDependencies?.["@vibgrate/cli"]);
+  } catch {
+    return true;
+  }
+}
+var updateCommand = new Command5("update").description("Update vibgrate to the latest version").option("--check", "Only check for updates, do not install").option("--pm <manager>", "Package manager to use (npm, pnpm, yarn, bun)").action(async (opts) => {
+  console.log(chalk5.dim(`Current version: ${VERSION}`));
+  console.log(chalk5.dim("Checking npm registry..."));
+  const latest = await fetchLatestVersion();
+  if (!latest) {
+    console.error(chalk5.red("Could not reach the npm registry. Check your network connection."));
+    process.exit(1);
+  }
+  const semver2 = await import("semver");
+  if (!semver2.gt(latest, VERSION)) {
+    console.log(chalk5.green("\u2714") + ` You are on the latest version (${VERSION}).`);
+    return;
+  }
+  console.log(chalk5.yellow(`Update available: ${VERSION} \u2192 ${latest}`));
+  if (opts.check) {
+    console.log(chalk5.dim('Run "vibgrate update" to install.'));
+    return;
+  }
+  const cwd = process.cwd();
+  const pm = opts.pm || await detectPackageManager(cwd);
+  const isDev = await isDevDependency(cwd);
+  const cmd = getInstallCommand(pm, "@vibgrate/cli", latest, isDev);
+  console.log(chalk5.dim(`Using ${pm}: ${cmd}`));
+  try {
+    execSync(cmd, { cwd, stdio: "inherit" });
+    console.log(chalk5.green("\u2714") + ` Updated to @vibgrate/cli@${latest}`);
+  } catch {
+    console.error(chalk5.red(`Update failed. Run manually: ${cmd}`));
+    process.exit(1);
+  }
+});
+
+// src/cli.ts
+var program = new Command6();
+program.name("vibgrate").description("Continuous Upgrade Drift Intelligence for Node & .NET").version(VERSION);
+program.addCommand(initCommand);
+program.addCommand(scanCommand);
+program.addCommand(baselineCommand);
+program.addCommand(reportCommand);
+program.addCommand(dsnCommand);
+program.addCommand(pushCommand);
+program.addCommand(updateCommand);
+program.parseAsync().then(async () => {
+  const update = await checkForUpdate();
+  if (update?.updateAvailable) {
+    console.error("");
+    console.error(chalk6.yellow(`  Update available: ${update.current} \u2192 ${update.latest}`));
+    console.error(chalk6.dim('  Run "vibgrate update" to install the latest version.'));
+    console.error("");
+  }
+}).catch((err) => {
+  console.error(err);
+  process.exit(1);
+});

package/dist/index.d.ts

@@ -0,0 +1,126 @@
+type DepSection = 'dependencies' | 'devDependencies' | 'peerDependencies' | 'optionalDependencies';
+type RiskLevel = 'low' | 'moderate' | 'high';
+type ProjectType = 'node' | 'dotnet';
+type OutputFormat = 'text' | 'json' | 'sarif';
+interface DependencyRow {
+    package: string;
+    section: DepSection;
+    currentSpec: string;
+    resolvedVersion: string | null;
+    latestStable: string | null;
+    majorsBehind: number | null;
+    drift: 'current' | 'minor-behind' | 'major-behind' | 'unknown';
+}
+interface DetectedFramework {
+    name: string;
+    currentVersion: string | null;
+    latestVersion: string | null;
+    majorsBehind: number | null;
+}
+interface ProjectScan {
+    type: ProjectType;
+    path: string;
+    name: string;
+    runtime?: string;
+    runtimeLatest?: string;
+    runtimeMajorsBehind?: number;
+    targetFramework?: string;
+    frameworks: DetectedFramework[];
+    dependencies: DependencyRow[];
+    dependencyAgeBuckets: {
+        current: number;
+        oneBehind: number;
+        twoPlusBehind: number;
+        unknown: number;
+    };
+}
+interface DriftScore {
+    score: number;
+    riskLevel: RiskLevel;
+    components: {
+        runtimeScore: number;
+        frameworkScore: number;
+        dependencyScore: number;
+        eolScore: number;
+    };
+}
+interface Finding {
+    ruleId: string;
+    level: 'warning' | 'error' | 'note';
+    message: string;
+    location: string;
+    details?: Record<string, unknown>;
+}
+type VcsType = 'git' | 'unknown';
+interface VcsInfo {
+    type: VcsType;
+    sha?: string;
+    shortSha?: string;
+    branch?: string;
+}
+interface ScanArtifact {
+    schemaVersion: '1.0';
+    timestamp: string;
+    vibgrateVersion: string;
+    rootPath: string;
+    vcs?: VcsInfo;
+    projects: ProjectScan[];
+    drift: DriftScore;
+    findings: Finding[];
+    baseline?: string;
+    delta?: number;
+}
+interface ScanOptions {
+    out?: string;
+    format: OutputFormat;
+    failOn?: 'warn' | 'error';
+    baseline?: string;
+    changedOnly?: boolean;
+    concurrency: number;
+}
+interface ScannerToggle {
+    enabled: boolean;
+}
+interface ScannersConfig {
+    platformMatrix?: ScannerToggle;
+    dependencyRisk?: ScannerToggle;
+    dependencyGraph?: ScannerToggle;
+    toolingInventory?: ScannerToggle;
+    buildDeploy?: ScannerToggle;
+    tsModernity?: ScannerToggle;
+    breakingChangeExposure?: ScannerToggle;
+    fileHotspots?: ScannerToggle;
+    securityPosture?: ScannerToggle;
+    serviceDependencies?: ScannerToggle;
+}
+interface VibgrateConfig {
+    include?: string[];
+    exclude?: string[];
+    scanners?: ScannersConfig | false;
+    thresholds?: {
+        failOnError?: {
+            eolDays?: number;
+            frameworkMajorLag?: number;
+            dependencyTwoPlusPercent?: number;
+        };
+        warn?: {
+            frameworkMajorLag?: number;
+            dependencyTwoPlusPercent?: number;
+        };
+    };
+}
+
+declare function runScan(rootDir: string, opts: ScanOptions): Promise<ScanArtifact>;
+
+declare function computeDriftScore(projects: ProjectScan[]): DriftScore;
+declare function generateFindings(projects: ProjectScan[], config?: VibgrateConfig): Finding[];
+
+declare function formatText(artifact: ScanArtifact): string;
+
+/** Generate a SARIF 2.1.0 document from scan artifact */
+declare function formatSarif(artifact: ScanArtifact): object;
+
+/** Generate a Markdown report from scan artifact */
+declare function formatMarkdown(artifact: ScanArtifact): string;
+
+export { type DependencyRow, type DriftScore, type Finding, type ProjectScan, type RiskLevel, type ScanArtifact, type ScanOptions, type VibgrateConfig, computeDriftScore, formatMarkdown, formatSarif, formatText, generateFindings, runScan };

package/dist/index.js

@@ -0,0 +1,18 @@
+import {
+  formatMarkdown
+} from "./chunk-AMOJCCF5.js";
+import {
+  computeDriftScore,
+  formatSarif,
+  formatText,
+  generateFindings,
+  runScan
+} from "./chunk-DLRBJYO6.js";
+export {
+  computeDriftScore,
+  formatMarkdown,
+  formatSarif,
+  formatText,
+  generateFindings,
+  runScan
+};

package/package.json

@@ -0,0 +1,57 @@
+{
+  "name": "@vibgrate/cli",
+  "version": "0.1.1",
+  "description": "CLI for measuring upgrade drift across Node & .NET projects",
+  "type": "module",
+  "bin": {
+    "vibgrate": "./dist/cli.js"
+  },
+  "main": "./dist/index.js",
+  "types": "./dist/index.d.ts",
+  "exports": {
+    ".": {
+      "types": "./dist/index.d.ts",
+      "import": "./dist/index.js"
+    }
+  },
+  "files": [
+    "dist"
+  ],
+  "scripts": {
+    "build": "tsup src/cli.ts src/index.ts --format esm --dts --clean",
+    "dev": "tsx src/cli.ts",
+    "lint": "eslint src",
+    "typecheck": "tsc --noEmit",
+    "test": "vitest run"
+  },
+  "keywords": [
+    "upgrade",
+    "drift",
+    "dependencies",
+    "cli",
+    "node",
+    "dotnet",
+    "sarif"
+  ],
+  "author": "Vibgrate",
+  "license": "UNLICENSED",
+  "devDependencies": {
+    "@types/node": "^20.0.0",
+    "@types/semver": "^7.5.0",
+    "eslint": "^9.0.0",
+    "tsup": "^8.0.0",
+    "tsx": "^4.0.0",
+    "typescript": "^5.4.0",
+    "vitest": "^2.0.0"
+  },
+  "dependencies": {
+    "chalk": "^5.3.0",
+    "commander": "^12.0.0",
+    "fast-xml-parser": "^4.3.0",
+    "semver": "^7.6.0",
+    "zod": "^3.23.0"
+  },
+  "engines": {
+    "node": ">=20.0.0"
+  }
+}