@vibgrate/cli 0.1.3 → 0.1.4

package/dist/{baseline-D5UDXOEJ.js → baseline-45AWVXG4.js}

@@ -1,8 +1,8 @@
 import {
   baselineCommand,
   runBaseline
-} from "./chunk-3X3ZMVHI.js";
-import "./chunk-VXEZ7APL.js";
+} from "./chunk-BTIIFIOD.js";
+import "./chunk-WO6EZ6AF.js";
 export {
   baselineCommand,
   runBaseline

package/dist/{chunk-3X3ZMVHI.js → chunk-BTIIFIOD.js}

@@ -1,7 +1,7 @@
 import {
   runScan,
   writeJsonFile
-} from "./chunk-VXEZ7APL.js";
+} from "./chunk-WO6EZ6AF.js";
 
 // src/commands/baseline.ts
 import * as path from "path";

package/dist/{chunk-VXEZ7APL.js → chunk-WO6EZ6AF.js}

@@ -95,9 +95,9 @@ function clamp(val, min, max) {
   return Math.min(max, Math.max(min, val));
 }
 function runtimeScore(projects) {
-  if (projects.length === 0) return 100;
+  if (projects.length === 0) return null;
   const lags = projects.map((p) => p.runtimeMajorsBehind).filter((v) => v !== void 0);
-  if (lags.length === 0) return 100;
+  if (lags.length === 0) return null;
   const maxLag = Math.max(...lags);
   if (maxLag === 0) return 100;
   if (maxLag === 1) return 80;
@@ -107,9 +107,9 @@ function runtimeScore(projects) {
 }
 function frameworkScore(projects) {
   const allFrameworks = projects.flatMap((p) => p.frameworks);
-  if (allFrameworks.length === 0) return 100;
+  if (allFrameworks.length === 0) return null;
   const lags = allFrameworks.map((f) => f.majorsBehind).filter((v) => v !== null);
-  if (lags.length === 0) return 100;
+  if (lags.length === 0) return null;
   const maxLag = Math.max(...lags);
   const avgLag = lags.reduce((a, b) => a + b, 0) / lags.length;
   const maxPenalty = Math.min(maxLag * 20, 100);
@@ -128,13 +128,15 @@ function dependencyScore(projects) {
     totalUnknown += p.dependencyAgeBuckets.unknown;
   }
   const total = totalCurrent + totalOne + totalTwo;
-  if (total === 0) return 100;
+  if (total === 0) return null;
   const currentPct = totalCurrent / total;
   const onePct = totalOne / total;
   const twoPct = totalTwo / total;
   return clamp(Math.round(currentPct * 100 - onePct * 10 - twoPct * 40), 0, 100);
 }
 function eolScore(projects) {
+  const hasRuntimeData = projects.some((p) => p.runtimeMajorsBehind !== void 0);
+  if (!hasRuntimeData) return null;
   let score = 100;
   for (const p of projects) {
     if (p.type === "node" && p.runtimeMajorsBehind !== void 0) {
@@ -155,20 +157,50 @@ function computeDriftScore(projects) {
   const fs5 = frameworkScore(projects);
   const ds = dependencyScore(projects);
   const es = eolScore(projects);
-  const score = Math.round(rs * 0.25 + fs5 * 0.25 + ds * 0.3 + es * 0.2);
+  const components = [
+    { score: rs, weight: 0.25 },
+    { score: fs5, weight: 0.25 },
+    { score: ds, weight: 0.3 },
+    { score: es, weight: 0.2 }
+  ];
+  const active = components.filter((c) => c.score !== null);
+  if (active.length === 0) {
+    return {
+      score: 100,
+      riskLevel: "low",
+      components: {
+        runtimeScore: rs ?? 100,
+        frameworkScore: fs5 ?? 100,
+        dependencyScore: ds ?? 100,
+        eolScore: es ?? 100
+      }
+    };
+  }
+  const totalActiveWeight = active.reduce((sum, c) => sum + c.weight, 0);
+  let score = 0;
+  for (const c of active) {
+    score += c.score * (c.weight / totalActiveWeight);
+  }
+  score = Math.round(score);
   let riskLevel;
   if (score >= 70) riskLevel = "low";
   else if (score >= 40) riskLevel = "moderate";
   else riskLevel = "high";
+  const measured = [];
+  if (rs !== null) measured.push("runtime");
+  if (fs5 !== null) measured.push("framework");
+  if (ds !== null) measured.push("dependency");
+  if (es !== null) measured.push("eol");
   return {
     score,
     riskLevel,
     components: {
-      runtimeScore: rs,
-      frameworkScore: fs5,
-      dependencyScore: ds,
-      eolScore: es
-    }
+      runtimeScore: rs ?? 100,
+      frameworkScore: fs5 ?? 100,
+      dependencyScore: ds ?? 100,
+      eolScore: es ?? 100
+    },
+    measured
   };
 }
 function generateFindings(projects, config) {
@@ -263,11 +295,12 @@ function formatText(artifact) {
     lines.push(chalk.bold("  VCS:          ") + vcsParts.join(" "));
   }
   lines.push("");
+  const m = new Set(artifact.drift.measured ?? ["runtime", "framework", "dependency", "eol"]);
   lines.push(chalk.bold.underline("  Score Breakdown"));
-  lines.push(`    Runtime:      ${scoreBar(artifact.drift.components.runtimeScore)}`);
-  lines.push(`    Frameworks:   ${scoreBar(artifact.drift.components.frameworkScore)}`);
-  lines.push(`    Dependencies: ${scoreBar(artifact.drift.components.dependencyScore)}`);
-  lines.push(`    EOL Risk:     ${scoreBar(artifact.drift.components.eolScore)}`);
+  lines.push(`    Runtime:      ${m.has("runtime") ? scoreBar(artifact.drift.components.runtimeScore) : chalk.dim("n/a")}`);
+  lines.push(`    Frameworks:   ${m.has("framework") ? scoreBar(artifact.drift.components.frameworkScore) : chalk.dim("n/a")}`);
+  lines.push(`    Dependencies: ${m.has("dependency") ? scoreBar(artifact.drift.components.dependencyScore) : chalk.dim("n/a")}`);
+  lines.push(`    EOL Risk:     ${m.has("eol") ? scoreBar(artifact.drift.components.eolScore) : chalk.dim("n/a")}`);
   lines.push("");
   for (const project of artifact.projects) {
     lines.push(chalk.bold(`  \u2500\u2500 ${project.name} `) + chalk.dim(`(${project.type}) ${project.path}`));
@@ -293,8 +326,24 @@ function formatText(artifact) {
     }
     lines.push("");
   }
+  if (artifact.delta !== void 0) {
+    const deltaStr = artifact.delta > 0 ? chalk.green(`+${artifact.delta}`) : artifact.delta < 0 ? chalk.red(`${artifact.delta}`) : chalk.dim("0");
+    lines.push(chalk.bold("  Drift Delta: ") + deltaStr + " (vs baseline)");
+    lines.push("");
+  }
+  if (artifact.extended) {
+    lines.push(...formatExtended(artifact.extended));
+  }
   if (artifact.findings.length > 0) {
-    lines.push(chalk.bold.underline("  Findings"));
+    const errors = artifact.findings.filter((f) => f.level === "error");
+    const warnings = artifact.findings.filter((f) => f.level === "warning");
+    const notes = artifact.findings.filter((f) => f.level === "note");
+    const summary = [
+      errors.length > 0 ? chalk.red(`${errors.length} error${errors.length !== 1 ? "s" : ""}`) : "",
+      warnings.length > 0 ? chalk.yellow(`${warnings.length} warning${warnings.length !== 1 ? "s" : ""}`) : "",
+      notes.length > 0 ? chalk.blue(`${notes.length} note${notes.length !== 1 ? "s" : ""}`) : ""
+    ].filter(Boolean).join(chalk.dim(", "));
+    lines.push(chalk.bold.underline(`  Findings`) + chalk.dim(` (${summary})`));
     for (const f of artifact.findings) {
       const icon = f.level === "error" ? chalk.red("\u2716") : f.level === "warning" ? chalk.yellow("\u26A0") : chalk.blue("\u2139");
       lines.push(`    ${icon} ${f.message}`);
@@ -302,13 +351,20 @@ function formatText(artifact) {
     }
     lines.push("");
   }
-  if (artifact.delta !== void 0) {
-    const deltaStr = artifact.delta > 0 ? chalk.green(`+${artifact.delta}`) : artifact.delta < 0 ? chalk.red(`${artifact.delta}`) : chalk.dim("0");
-    lines.push(chalk.bold("  Drift Delta: ") + deltaStr + " (vs baseline)");
+  const actions = generatePriorityActions(artifact);
+  if (actions.length > 0) {
+    lines.push(chalk.bold.cyan("\u2554\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2557"));
+    lines.push(chalk.bold.cyan("\u2551        Top Priority Actions              \u2551"));
+    lines.push(chalk.bold.cyan("\u255A\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u255D"));
     lines.push("");
-  }
-  if (artifact.extended) {
-    lines.push(...formatExtended(artifact.extended));
+    for (let i = 0; i < actions.length; i++) {
+      const a = actions[i];
+      const num = chalk.bold.cyan(`  ${i + 1}.`);
+      lines.push(`${num} ${chalk.bold(a.title)}`);
+      lines.push(chalk.dim(`     ${a.explanation}`));
+      if (a.impact) lines.push(`     Impact: ${chalk.green(a.impact)}`);
+      lines.push("");
+    }
   }
   lines.push(chalk.dim(`  Scanned at ${artifact.timestamp}`));
   lines.push("");
@@ -331,7 +387,7 @@ function scoreBar(score) {
   const filled = Math.round(score / 100 * width);
   const empty = width - filled;
   const color = score >= 70 ? chalk.green : score >= 40 ? chalk.yellow : chalk.red;
-  return color("\u2588".repeat(filled)) + chalk.dim("\u2591".repeat(empty)) + ` ${score}`;
+  return color("\u2588".repeat(filled)) + chalk.dim("\u2591".repeat(empty)) + ` ${Math.round(score)}`;
 }
 var CATEGORY_LABELS = {
   frontend: "Frontend",
@@ -471,6 +527,149 @@ function formatExtended(ext) {
   }
   return lines;
 }
+function generatePriorityActions(artifact) {
+  const actions = [];
+  const eolProjects = artifact.projects.filter(
+    (p) => p.runtimeMajorsBehind !== void 0 && p.runtimeMajorsBehind >= 3
+  );
+  if (eolProjects.length > 0) {
+    const names = eolProjects.map((p) => p.name).join(", ");
+    const runtimes = eolProjects.map((p) => `${p.runtime} \u2192 ${p.runtimeLatest}`).join(", ");
+    actions.push({
+      title: `Upgrade EOL runtime${eolProjects.length > 1 ? "s" : ""} in ${names}`,
+      explanation: `${runtimes}. End-of-life runtimes no longer receive security patches and block ecosystem upgrades.`,
+      impact: `+${Math.min(eolProjects.length * 10, 30)} points (runtime & EOL scores)`,
+      severity: 100
+    });
+  }
+  const severeFrameworks = [];
+  for (const p of artifact.projects) {
+    for (const fw of p.frameworks) {
+      if (fw.majorsBehind !== null && fw.majorsBehind >= 3) {
+        severeFrameworks.push({ name: fw.name, fw: `${fw.currentVersion} \u2192 ${fw.latestVersion}`, behind: fw.majorsBehind, project: p.name });
+      }
+    }
+  }
+  if (severeFrameworks.length > 0) {
+    const worst = severeFrameworks.sort((a, b) => b.behind - a.behind)[0];
+    const others = severeFrameworks.length > 1 ? ` (+${severeFrameworks.length - 1} more)` : "";
+    actions.push({
+      title: `Upgrade ${worst.name} ${worst.fw} in ${worst.project}${others}`,
+      explanation: `${worst.behind} major versions behind. Major framework drift increases breaking change risk and blocks access to security fixes and performance improvements.`,
+      impact: `+5\u201315 points (framework score)`,
+      severity: 90
+    });
+  }
+  for (const p of artifact.projects) {
+    const b = p.dependencyAgeBuckets;
+    const total = b.current + b.oneBehind + b.twoPlusBehind;
+    if (total === 0) continue;
+    const twoPlusPct = Math.round(b.twoPlusBehind / total * 100);
+    if (twoPlusPct >= 40) {
+      actions.push({
+        title: `Reduce dependency rot in ${p.name} (${twoPlusPct}% severely outdated)`,
+        explanation: `${b.twoPlusBehind} of ${total} dependencies are 2+ majors behind. Run \`npm outdated\` and prioritise packages with known CVEs or breaking API changes.`,
+        impact: `+5\u201310 points (dependency score)`,
+        severity: 80 + twoPlusPct / 10
+      });
+    }
+  }
+  const twoMajorFrameworks = [];
+  for (const p of artifact.projects) {
+    for (const fw of p.frameworks) {
+      if (fw.majorsBehind === 2) {
+        twoMajorFrameworks.push({ name: fw.name, project: p.name, fw: `${fw.currentVersion} \u2192 ${fw.latestVersion}` });
+      }
+    }
+  }
+  const uniqueTwo = [...new Map(twoMajorFrameworks.map((f) => [f.name, f])).values()];
+  if (uniqueTwo.length > 0) {
+    const list = uniqueTwo.slice(0, 3).map((f) => `${f.name} (${f.fw})`).join(", ");
+    const moreCount = uniqueTwo.length > 3 ? ` +${uniqueTwo.length - 3} more` : "";
+    actions.push({
+      title: `Plan major framework upgrades: ${list}${moreCount}`,
+      explanation: `These frameworks are 2 major versions behind. Create upgrade tickets and check migration guides \u2014 the gap will widen with each new release.`,
+      impact: `+5\u201310 points (framework score)`,
+      severity: 60
+    });
+  }
+  if (artifact.extended?.breakingChangeExposure) {
+    const bc = artifact.extended.breakingChangeExposure;
+    const total = bc.deprecatedPackages.length + bc.legacyPolyfills.length;
+    if (total > 0) {
+      const items = [...bc.deprecatedPackages, ...bc.legacyPolyfills].slice(0, 5).join(", ");
+      const moreCount = total > 5 ? ` +${total - 5} more` : "";
+      actions.push({
+        title: `Replace deprecated/legacy packages: ${items}${moreCount}`,
+        explanation: `${total} package${total !== 1 ? "s" : ""} are deprecated or legacy polyfills. These receive no updates and may have known vulnerabilities.`,
+        severity: 55
+      });
+    }
+  }
+  if (artifact.extended?.dependencyGraph) {
+    const dg = artifact.extended.dependencyGraph;
+    const phantomCount = dg.phantomDependencies.length;
+    if (phantomCount >= 10) {
+      let detail = `Packages used in code but not declared in package.json. These rely on transitive installs and can break unpredictably when other packages update.`;
+      const details = dg.phantomDependencyDetails;
+      if (details && details.length > 0) {
+        const byPath = /* @__PURE__ */ new Map();
+        for (const d of details) {
+          if (!byPath.has(d.sourcePath)) byPath.set(d.sourcePath, []);
+          byPath.get(d.sourcePath).push({ package: d.package, spec: d.spec });
+        }
+        const pathLines = [];
+        let shown = 0;
+        for (const [srcPath, pkgs] of byPath) {
+          if (shown >= 10) break;
+          pathLines.push(`
+     ./${srcPath}`);
+          for (const pkg2 of pkgs) {
+            if (shown >= 10) break;
+            pathLines.push(`       ${pkg2.package}: ${pkg2.spec}`);
+            shown++;
+          }
+        }
+        const remaining = phantomCount - shown;
+        detail += pathLines.join("");
+        if (remaining > 0) detail += `
+     ... and ${remaining} more`;
+      }
+      actions.push({
+        title: `Fix ${phantomCount} phantom dependencies`,
+        explanation: detail,
+        severity: 45
+      });
+    }
+  }
+  if (artifact.extended?.securityPosture) {
+    const sec = artifact.extended.securityPosture;
+    if (sec.envFilesTracked || !sec.lockfilePresent) {
+      const issues = [];
+      if (sec.envFilesTracked) issues.push(".env files are tracked in git");
+      if (!sec.lockfilePresent) issues.push("no lockfile found");
+      actions.push({
+        title: `Fix security posture: ${issues.join(", ")}`,
+        explanation: sec.envFilesTracked ? "Environment files may contain secrets. Add them to .gitignore and rotate any exposed credentials immediately." : "Without a lockfile, installs are non-deterministic. Run the install command to generate one and commit it.",
+        severity: 95
+      });
+    }
+  }
+  if (artifact.extended?.dependencyGraph) {
+    const dupes = artifact.extended.dependencyGraph.duplicatedPackages;
+    const highImpactDupes = dupes.filter((d) => d.versions.length >= 3);
+    if (highImpactDupes.length >= 3) {
+      const names = highImpactDupes.slice(0, 4).map((d) => `${d.name} (${d.versions.length}v)`).join(", ");
+      actions.push({
+        title: `Deduplicate heavily-versioned packages`,
+        explanation: `${highImpactDupes.length} packages have 3+ versions installed: ${names}. Run \`npm dedupe\` to reduce bundle size and install time.`,
+        severity: 35
+      });
+    }
+  }
+  actions.sort((a, b) => b.severity - a.severity);
+  return actions.slice(0, 5);
+}
 
 // src/formatters/sarif.ts
 function formatSarif(artifact) {
@@ -2021,9 +2220,11 @@ async function scanDependencyGraph(rootDir) {
   const lockedNames = new Set(versionMap.keys());
   const pkgFiles = await findPackageJsonFiles(rootDir);
   const phantoms = /* @__PURE__ */ new Set();
+  const phantomDetails = [];
   for (const pjPath of pkgFiles) {
     try {
       const pj = await readJsonFile(pjPath);
+      const relPath = path7.relative(rootDir, pjPath);
       for (const section of ["dependencies", "devDependencies"]) {
         const deps = pj[section];
         if (!deps) continue;
@@ -2031,6 +2232,7 @@ async function scanDependencyGraph(rootDir) {
           const ver = typeof version === "string" ? version : "";
           if (!lockedNames.has(name) && !ver.startsWith("workspace:")) {
             phantoms.add(name);
+            phantomDetails.push({ package: name, spec: ver, sourcePath: relPath });
           }
         }
       }
@@ -2038,6 +2240,7 @@ async function scanDependencyGraph(rootDir) {
     }
   }
   result.phantomDependencies = [...phantoms].sort();
+  result.phantomDependencyDetails = phantomDetails.sort((a, b) => a.sourcePath.localeCompare(b.sourcePath) || a.package.localeCompare(b.package));
   return result;
 }
 

package/dist/cli.js

@@ -4,7 +4,7 @@ import {
 } from "./chunk-AMOJCCF5.js";
 import {
   baselineCommand
-} from "./chunk-3X3ZMVHI.js";
+} from "./chunk-BTIIFIOD.js";
 import {
   VERSION,
   ensureDir,
@@ -15,7 +15,7 @@ import {
   scanCommand,
   writeDefaultConfig,
   writeTextFile
-} from "./chunk-VXEZ7APL.js";
+} from "./chunk-WO6EZ6AF.js";
 
 // src/cli.ts
 import { Command as Command6 } from "commander";
@@ -38,7 +38,7 @@ var initCommand = new Command("init").description("Initialize vibgrate in a proj
     console.log(chalk.green("\u2714") + ` Created ${chalk.bold("vibgrate.config.ts")}`);
   }
   if (opts.baseline) {
-    const { runBaseline } = await import("./baseline-D5UDXOEJ.js");
+    const { runBaseline } = await import("./baseline-45AWVXG4.js");
     await runBaseline(rootDir);
   }
   console.log("");

package/dist/index.d.ts

@@ -43,6 +43,8 @@ interface DriftScore {
         dependencyScore: number;
         eolScore: number;
     };
+    /** Which components had sufficient data to score. Missing = no data available. */
+    measured?: ('runtime' | 'framework' | 'dependency' | 'eol')[];
 }
 interface Finding {
     ruleId: string;
@@ -130,12 +132,18 @@ interface DuplicatedPackage {
     versions: string[];
     consumers: number;
 }
+interface PhantomDependency {
+    package: string;
+    spec: string;
+    sourcePath: string;
+}
 interface DependencyGraphResult {
     lockfileType: string | null;
     totalUnique: number;
     totalInstalled: number;
     duplicatedPackages: DuplicatedPackage[];
     phantomDependencies: string[];
+    phantomDependencyDetails?: PhantomDependency[];
 }
 interface InventoryItem {
     name: string;

package/dist/index.js

@@ -7,7 +7,7 @@ import {
   formatText,
   generateFindings,
   runScan
-} from "./chunk-VXEZ7APL.js";
+} from "./chunk-WO6EZ6AF.js";
 export {
   computeDriftScore,
   formatMarkdown,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@vibgrate/cli",
-  "version": "0.1.3",
+  "version": "0.1.4",
   "description": "CLI for measuring upgrade drift across Node & .NET projects",
   "type": "module",
   "bin": {