@vibgrate/cli 0.1.4 → 1.0.1

package/README.md

@@ -56,13 +56,19 @@ That's it. You'll see a full drift report in seconds.
 ## What You Get
 
 ```
+    ╭───╮➜
+   ╭┤◉ ◉├╮  V I B G R A T E
+   ╰┤───├╯  Drift Intelligence Engine v1.x.x
+    ╰───╯
+
 ╔══════════════════════════════════════════╗
 ║        Vibgrate Drift Report             ║
 ╚══════════════════════════════════════════╝
 
   Drift Score:  72/100
-  Risk Level:   Low
+  Risk Level:   LOW
   Projects:     3
+  VCS:          git main a1b2c3d
 
   Score Breakdown
     Runtime:      ████████████████████ 100
@@ -77,9 +83,61 @@ That's it. You'll see a full drift report in seconds.
      Dependencies:
        42 current  8 1-behind  3 2+ behind
 
-  Findings
+  ── web-app (node) src/web
+     Runtime: 20.11.0 (current)
+     Frameworks:
+       React: 18.2.0 → 19.0.0 (1 behind)
+     Dependencies:
+       31 current  5 1-behind  2 2+ behind
+
+  Tech Stack
+    Frontend: React, Tailwind CSS
+    Bundlers: Vite
+    Testing: Vitest, Playwright
+    Lint & Format: ESLint, Prettier
+
+  Services & Integrations
+    Cloud: AWS SDK v3
+    Databases: PostgreSQL
+
+  TypeScript
+    v5.4.2 · strict ✔ · ESM · target: ES2022
+
+  Build & Deploy
+    CI: GitHub Actions
+    Docker: 2 Dockerfiles (node:20-alpine)
+    Package Managers: pnpm
+
+  Security Posture
+    Lockfile ✔ · .env ✔ · node_modules ✔
+
+  Dependency Graph
+    pnpm-lock.yaml: 312 unique, 487 installed
+    5 duplicated packages
+
+  Findings (2 warnings, 1 note)
     ⚠ Framework "NestJS" is 1 major version(s) behind
+      framework/outdated in src/api/package.json
     ⚠ 12% of dependencies are 2+ major versions behind
+      dependency/outdated in src/api/package.json
+    ℹ TypeScript target is ES2022
+      ts/target in tsconfig.json
+
+╔══════════════════════════════════════════╗
+║        Top Priority Actions              ║
+╚══════════════════════════════════════════╝
+
+  1. Upgrade NestJS 10.3.0 → 11.0.0 in my-api
+     1 major version behind. Major framework drift increases
+     breaking change risk and blocks access to security fixes.
+     Impact: +5–15 points (framework score)
+
+  2. Reduce dependency rot in my-api (42% severely outdated)
+     3 of 53 dependencies are 2+ majors behind. Run `npm outdated`
+     and prioritise packages with known CVEs.
+     Impact: +5–10 points (dependency score)
+
+  Scanned at 2026-02-16T00:00:00.000Z · 1.2s · 48 files scanned
 ```
 
 ---

package/dist/{baseline-45AWVXG4.js → baseline-35XRSRAD.js}

@@ -1,8 +1,8 @@
 import {
   baselineCommand,
   runBaseline
-} from "./chunk-BTIIFIOD.js";
-import "./chunk-WO6EZ6AF.js";
+} from "./chunk-NTRKEIKP.js";
+import "./chunk-VMNBKARQ.js";
 export {
   baselineCommand,
   runBaseline

package/dist/{chunk-BTIIFIOD.js → chunk-NTRKEIKP.js}

@@ -1,7 +1,7 @@
 import {
   runScan,
   writeJsonFile
-} from "./chunk-WO6EZ6AF.js";
+} from "./chunk-VMNBKARQ.js";
 
 // src/commands/baseline.ts
 import * as path from "path";

package/dist/{chunk-WO6EZ6AF.js → chunk-VMNBKARQ.js}

@@ -275,11 +275,22 @@ function generateFindings(projects, config) {
   return findings;
 }
 
+// src/version.ts
+import { createRequire } from "module";
+var require2 = createRequire(import.meta.url);
+var pkg = require2("../package.json");
+var VERSION = pkg.version;
+
 // src/formatters/text.ts
 import chalk from "chalk";
 function formatText(artifact) {
   const lines = [];
   lines.push("");
+  lines.push(chalk.cyan("    \u256D\u2500\u2500\u2500\u256E") + chalk.greenBright("\u279C"));
+  lines.push(chalk.cyan("   \u256D\u2524") + chalk.greenBright("\u25C9 \u25C9") + chalk.cyan("\u251C\u256E") + "  " + chalk.bold.white("V I B G R A T E"));
+  lines.push(chalk.cyan("   \u2570\u2524") + chalk.dim("\u2500\u2500\u2500") + chalk.cyan("\u251C\u256F") + "  " + chalk.dim(`Drift Intelligence Engine v${VERSION}`));
+  lines.push(chalk.cyan("    \u2570\u2500\u2500\u2500\u256F"));
+  lines.push("");
   lines.push(chalk.bold.cyan("\u2554\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2557"));
   lines.push(chalk.bold.cyan("\u2551        Vibgrate Drift Report             \u2551"));
   lines.push(chalk.bold.cyan("\u255A\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u255D"));
@@ -366,7 +377,15 @@ function formatText(artifact) {
       lines.push("");
     }
   }
-  lines.push(chalk.dim(`  Scanned at ${artifact.timestamp}`));
+  const scannedParts = [`Scanned at ${artifact.timestamp}`];
+  if (artifact.durationMs !== void 0) {
+    const secs = (artifact.durationMs / 1e3).toFixed(1);
+    scannedParts.push(`${secs}s`);
+  }
+  if (artifact.filesScanned !== void 0) {
+    scannedParts.push(`${artifact.filesScanned} file${artifact.filesScanned !== 1 ? "s" : ""} scanned`);
+  }
+  lines.push(chalk.dim(`  ${scannedParts.join(" \xB7 ")}`));
   lines.push("");
   return lines.join("\n");
 }
@@ -753,12 +772,6 @@ function toSarifResult(finding) {
   };
 }
 
-// src/version.ts
-import { createRequire } from "module";
-var require2 = createRequire(import.meta.url);
-var pkg = require2("../package.json");
-var VERSION = pkg.version;
-
 // src/commands/scan.ts
 import * as path12 from "path";
 import { Command } from "commander";
@@ -1549,7 +1562,7 @@ var ROBOT = [
 ];
 var BRAND = [
   chalk2.bold.white("  V I B G R A T E"),
-  chalk2.dim("  Drift Intelligence Engine")
+  chalk2.dim(`  Drift Intelligence Engine`) + chalk2.dim(` v${VERSION}`)
 ];
 var SPINNER_FRAMES = ["\u280B", "\u2819", "\u2839", "\u2838", "\u283C", "\u2834", "\u2826", "\u2827", "\u2807", "\u280F"];
 var ScanProgress = class {
@@ -3650,10 +3663,12 @@ function scanServiceDependencies(projects) {
 
 // src/commands/scan.ts
 async function runScan(rootDir, opts) {
+  const scanStart = Date.now();
   const config = await loadConfig(rootDir);
   const sem = new Semaphore(opts.concurrency);
   const npmCache = new NpmCache(rootDir, sem);
   const scanners = config.scanners;
+  let filesScanned = 0;
   const progress = new ScanProgress(rootDir);
   const steps = [
     { id: "config", label: "Loading configuration" },
@@ -3687,6 +3702,7 @@ async function runScan(rootDir, opts) {
     progress.addDependencies(p.dependencies.length);
     progress.addFrameworks(p.frameworks.length);
   }
+  filesScanned += nodeProjects.length;
   progress.addProjects(nodeProjects.length);
   progress.completeStep("node", `${nodeProjects.length} project${nodeProjects.length !== 1 ? "s" : ""}`, nodeProjects.length);
   progress.startStep("dotnet");
@@ -3695,91 +3711,130 @@ async function runScan(rootDir, opts) {
     progress.addDependencies(p.dependencies.length);
     progress.addFrameworks(p.frameworks.length);
   }
+  filesScanned += dotnetProjects.length;
   progress.addProjects(dotnetProjects.length);
   progress.completeStep("dotnet", `${dotnetProjects.length} project${dotnetProjects.length !== 1 ? "s" : ""}`, dotnetProjects.length);
   const allProjects = [...nodeProjects, ...dotnetProjects];
   const extended = {};
   if (scanners !== false) {
+    const scannerTasks = [];
     if (scanners?.platformMatrix?.enabled !== false) {
       progress.startStep("platform");
-      extended.platformMatrix = await scanPlatformMatrix(rootDir);
-      const nativeCount = extended.platformMatrix.nativeModules.length;
-      const dockerCount = extended.platformMatrix.dockerBaseImages.length;
-      const parts = [];
-      if (nativeCount > 0) parts.push(`${nativeCount} native`);
-      if (dockerCount > 0) parts.push(`${dockerCount} docker`);
-      progress.completeStep("platform", parts.join(", ") || "clean", nativeCount + dockerCount);
+      scannerTasks.push(
+        scanPlatformMatrix(rootDir).then((result) => {
+          extended.platformMatrix = result;
+          const nativeCount = result.nativeModules.length;
+          const dockerCount = result.dockerBaseImages.length;
+          const parts = [];
+          if (nativeCount > 0) parts.push(`${nativeCount} native`);
+          if (dockerCount > 0) parts.push(`${dockerCount} docker`);
+          progress.completeStep("platform", parts.join(", ") || "clean", nativeCount + dockerCount);
+        })
+      );
     }
     if (scanners?.toolingInventory?.enabled !== false) {
       progress.startStep("tooling");
-      extended.toolingInventory = scanToolingInventory(allProjects);
-      const toolCount = Object.values(extended.toolingInventory).reduce((sum, arr) => sum + arr.length, 0);
-      progress.completeStep("tooling", `${toolCount} tool${toolCount !== 1 ? "s" : ""} mapped`, toolCount);
+      scannerTasks.push(
+        Promise.resolve().then(() => {
+          extended.toolingInventory = scanToolingInventory(allProjects);
+          const toolCount = Object.values(extended.toolingInventory).reduce((sum, arr) => sum + arr.length, 0);
+          progress.completeStep("tooling", `${toolCount} tool${toolCount !== 1 ? "s" : ""} mapped`, toolCount);
+        })
+      );
     }
     if (scanners?.serviceDependencies?.enabled !== false) {
       progress.startStep("services");
-      extended.serviceDependencies = scanServiceDependencies(allProjects);
-      const svcCount = Object.values(extended.serviceDependencies).reduce((sum, arr) => sum + arr.length, 0);
-      progress.completeStep("services", `${svcCount} service${svcCount !== 1 ? "s" : ""} detected`, svcCount);
+      scannerTasks.push(
+        Promise.resolve().then(() => {
+          extended.serviceDependencies = scanServiceDependencies(allProjects);
+          const svcCount = Object.values(extended.serviceDependencies).reduce((sum, arr) => sum + arr.length, 0);
+          progress.completeStep("services", `${svcCount} service${svcCount !== 1 ? "s" : ""} detected`, svcCount);
+        })
+      );
     }
     if (scanners?.breakingChangeExposure?.enabled !== false) {
       progress.startStep("breaking");
-      extended.breakingChangeExposure = scanBreakingChangeExposure(allProjects);
-      const bc = extended.breakingChangeExposure;
-      const bcTotal = bc.deprecatedPackages.length + bc.legacyPolyfills.length;
-      progress.completeStep(
-        "breaking",
-        bcTotal > 0 ? `${bc.deprecatedPackages.length} deprecated, ${bc.legacyPolyfills.length} polyfills` : "none found",
-        bcTotal
+      scannerTasks.push(
+        Promise.resolve().then(() => {
+          extended.breakingChangeExposure = scanBreakingChangeExposure(allProjects);
+          const bc = extended.breakingChangeExposure;
+          const bcTotal = bc.deprecatedPackages.length + bc.legacyPolyfills.length;
+          progress.completeStep(
+            "breaking",
+            bcTotal > 0 ? `${bc.deprecatedPackages.length} deprecated, ${bc.legacyPolyfills.length} polyfills` : "none found",
+            bcTotal
+          );
+        })
       );
     }
     if (scanners?.securityPosture?.enabled !== false) {
       progress.startStep("security");
-      extended.securityPosture = await scanSecurityPosture(rootDir);
-      const sec = extended.securityPosture;
-      const secDetail = sec.lockfilePresent ? `lockfile \u2714${sec.gitignoreCoversEnv ? " \xB7 .env \u2714" : " \xB7 .env \u2716"}` : "no lockfile";
-      progress.completeStep("security", secDetail);
+      scannerTasks.push(
+        scanSecurityPosture(rootDir).then((result) => {
+          extended.securityPosture = result;
+          const secDetail = result.lockfilePresent ? `lockfile \u2714${result.gitignoreCoversEnv ? " \xB7 .env \u2714" : " \xB7 .env \u2716"}` : "no lockfile";
+          progress.completeStep("security", secDetail);
+        })
+      );
     }
     if (scanners?.buildDeploy?.enabled !== false) {
       progress.startStep("build");
-      extended.buildDeploy = await scanBuildDeploy(rootDir);
-      const bd = extended.buildDeploy;
-      const bdParts = [];
-      if (bd.ci.length > 0) bdParts.push(bd.ci.join(", "));
-      if (bd.docker.dockerfileCount > 0) bdParts.push(`${bd.docker.dockerfileCount} Dockerfile${bd.docker.dockerfileCount !== 1 ? "s" : ""}`);
-      progress.completeStep("build", bdParts.join(" \xB7 ") || "none detected");
+      scannerTasks.push(
+        scanBuildDeploy(rootDir).then((result) => {
+          extended.buildDeploy = result;
+          const bdParts = [];
+          if (result.ci.length > 0) bdParts.push(result.ci.join(", "));
+          if (result.docker.dockerfileCount > 0) bdParts.push(`${result.docker.dockerfileCount} Dockerfile${result.docker.dockerfileCount !== 1 ? "s" : ""}`);
+          progress.completeStep("build", bdParts.join(" \xB7 ") || "none detected");
+        })
+      );
     }
     if (scanners?.tsModernity?.enabled !== false) {
       progress.startStep("ts");
-      extended.tsModernity = await scanTsModernity(rootDir);
-      const ts = extended.tsModernity;
-      const tsParts = [];
-      if (ts.typescriptVersion) tsParts.push(`v${ts.typescriptVersion}`);
-      if (ts.strict === true) tsParts.push("strict");
-      if (ts.moduleType) tsParts.push(ts.moduleType.toUpperCase());
-      progress.completeStep("ts", tsParts.join(" \xB7 ") || "no tsconfig");
+      scannerTasks.push(
+        scanTsModernity(rootDir).then((result) => {
+          extended.tsModernity = result;
+          const tsParts = [];
+          if (result.typescriptVersion) tsParts.push(`v${result.typescriptVersion}`);
+          if (result.strict === true) tsParts.push("strict");
+          if (result.moduleType) tsParts.push(result.moduleType.toUpperCase());
+          progress.completeStep("ts", tsParts.join(" \xB7 ") || "no tsconfig");
+        })
+      );
     }
     if (scanners?.fileHotspots?.enabled !== false) {
       progress.startStep("hotspots");
-      extended.fileHotspots = await scanFileHotspots(rootDir);
-      progress.completeStep("hotspots", `${extended.fileHotspots.totalFiles} files`, extended.fileHotspots.totalFiles);
+      scannerTasks.push(
+        scanFileHotspots(rootDir).then((result) => {
+          extended.fileHotspots = result;
+          progress.completeStep("hotspots", `${result.totalFiles} files`, result.totalFiles);
+        })
+      );
     }
     if (scanners?.dependencyGraph?.enabled !== false) {
       progress.startStep("depgraph");
-      extended.dependencyGraph = await scanDependencyGraph(rootDir);
-      const dg = extended.dependencyGraph;
-      const dgDetail = dg.lockfileType ? `${dg.lockfileType} \xB7 ${dg.totalUnique} unique` : "no lockfile";
-      progress.completeStep("depgraph", dgDetail, dg.totalUnique);
+      scannerTasks.push(
+        scanDependencyGraph(rootDir).then((result) => {
+          extended.dependencyGraph = result;
+          const dgDetail = result.lockfileType ? `${result.lockfileType} \xB7 ${result.totalUnique} unique` : "no lockfile";
+          progress.completeStep("depgraph", dgDetail, result.totalUnique);
+        })
+      );
     }
     if (scanners?.dependencyRisk?.enabled !== false) {
       progress.startStep("deprisk");
-      extended.dependencyRisk = scanDependencyRisk(allProjects);
-      const dr = extended.dependencyRisk;
-      const drParts = [];
-      if (dr.deprecatedPackages.length > 0) drParts.push(`${dr.deprecatedPackages.length} deprecated`);
-      if (dr.nativeModulePackages.length > 0) drParts.push(`${dr.nativeModulePackages.length} native`);
-      progress.completeStep("deprisk", drParts.join(", ") || "low risk");
+      scannerTasks.push(
+        Promise.resolve().then(() => {
+          extended.dependencyRisk = scanDependencyRisk(allProjects);
+          const dr = extended.dependencyRisk;
+          const drParts = [];
+          if (dr.deprecatedPackages.length > 0) drParts.push(`${dr.deprecatedPackages.length} deprecated`);
+          if (dr.nativeModulePackages.length > 0) drParts.push(`${dr.nativeModulePackages.length} native`);
+          progress.completeStep("deprisk", drParts.join(", ") || "low risk");
+        })
+      );
     }
+    await Promise.all(scannerTasks);
   }
   progress.startStep("drift");
   const drift = computeDriftScore(allProjects);
@@ -3799,6 +3854,15 @@ async function runScan(rootDir, opts) {
   if (allProjects.length === 0) {
     console.log(chalk3.yellow("No projects found."));
   }
+  if (extended.fileHotspots) filesScanned += extended.fileHotspots.totalFiles;
+  if (extended.securityPosture) filesScanned += 1;
+  if (extended.tsModernity?.typescriptVersion) filesScanned += 1;
+  if (extended.dependencyGraph?.lockfileType) filesScanned += 1;
+  if (extended.buildDeploy) {
+    filesScanned += extended.buildDeploy.docker.dockerfileCount;
+    filesScanned += extended.buildDeploy.ci.length;
+  }
+  const durationMs = Date.now() - scanStart;
   const artifact = {
     schemaVersion: "1.0",
     timestamp: (/* @__PURE__ */ new Date()).toISOString(),
@@ -3808,7 +3872,9 @@ async function runScan(rootDir, opts) {
     projects: allProjects,
     drift,
     findings,
-    ...Object.keys(extended).length > 0 ? { extended } : {}
+    ...Object.keys(extended).length > 0 ? { extended } : {},
+    durationMs,
+    filesScanned
   };
   if (opts.baseline) {
     const baselinePath = path12.resolve(opts.baseline);
@@ -3892,9 +3958,9 @@ export {
   writeDefaultConfig,
   computeDriftScore,
   generateFindings,
+  VERSION,
   formatText,
   formatSarif,
-  VERSION,
   runScan,
   scanCommand
 };

package/dist/{chunk-AMOJCCF5.js → chunk-VXZT34Y5.js}

@@ -8,7 +8,10 @@ function formatMarkdown(artifact) {
   lines.push(`| **Drift Score** | ${artifact.drift.score}/100 |`);
   lines.push(`| **Risk Level** | ${artifact.drift.riskLevel.toUpperCase()} |`);
   lines.push(`| **Projects** | ${artifact.projects.length} |`);
-  lines.push(`| **Scanned** | ${artifact.timestamp} |`);
+  const scannedMeta = [artifact.timestamp];
+  if (artifact.durationMs !== void 0) scannedMeta.push(`${(artifact.durationMs / 1e3).toFixed(1)}s`);
+  if (artifact.filesScanned !== void 0) scannedMeta.push(`${artifact.filesScanned} files`);
+  lines.push(`| **Scanned** | ${scannedMeta.join(" \xB7 ")} |`);
   if (artifact.vcs) {
     lines.push(`| **VCS** | ${artifact.vcs.type} |`);
     if (artifact.vcs.branch) lines.push(`| **Branch** | ${artifact.vcs.branch} |`);

package/dist/cli.js

@@ -1,10 +1,10 @@
 #!/usr/bin/env node
 import {
   formatMarkdown
-} from "./chunk-AMOJCCF5.js";
+} from "./chunk-VXZT34Y5.js";
 import {
   baselineCommand
-} from "./chunk-BTIIFIOD.js";
+} from "./chunk-NTRKEIKP.js";
 import {
   VERSION,
   ensureDir,
@@ -15,7 +15,7 @@ import {
   scanCommand,
   writeDefaultConfig,
   writeTextFile
-} from "./chunk-WO6EZ6AF.js";
+} from "./chunk-VMNBKARQ.js";
 
 // src/cli.ts
 import { Command as Command6 } from "commander";
@@ -38,7 +38,7 @@ var initCommand = new Command("init").description("Initialize vibgrate in a proj
     console.log(chalk.green("\u2714") + ` Created ${chalk.bold("vibgrate.config.ts")}`);
   }
   if (opts.baseline) {
-    const { runBaseline } = await import("./baseline-45AWVXG4.js");
+    const { runBaseline } = await import("./baseline-35XRSRAD.js");
     await runBaseline(rootDir);
   }
   console.log("");

package/dist/index.d.ts

@@ -72,6 +72,10 @@ interface ScanArtifact {
     baseline?: string;
     delta?: number;
     extended?: ExtendedScanResults;
+    /** Scan wall-clock duration in milliseconds */
+    durationMs?: number;
+    /** Number of manifest/config files scanned */
+    filesScanned?: number;
 }
 interface ScanOptions {
     out?: string;

package/dist/index.js

@@ -1,13 +1,13 @@
 import {
   formatMarkdown
-} from "./chunk-AMOJCCF5.js";
+} from "./chunk-VXZT34Y5.js";
 import {
   computeDriftScore,
   formatSarif,
   formatText,
   generateFindings,
   runScan
-} from "./chunk-WO6EZ6AF.js";
+} from "./chunk-VMNBKARQ.js";
 export {
   computeDriftScore,
   formatMarkdown,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@vibgrate/cli",
-  "version": "0.1.4",
+  "version": "1.0.1",
   "description": "CLI for measuring upgrade drift across Node & .NET projects",
   "type": "module",
   "bin": {