@vibgrate/cli 1.0.56 → 1.0.57

package/DOCS.md

@@ -770,4 +770,4 @@ import type {
 
 ---
 
-Copyright © 2026 Vibgrate. All rights reserved. See [LICENSE](./LICENSE) for terms.
+Copyright © 2026 Vibgrate. All rights reserved. See [LICENSE](https://vibgrate.com/license) for terms.

package/README.md

@@ -350,8 +350,8 @@ The CLI writes per-project score files to `.vibgrate/` inside each detected proj
 
 ## Full docs
 
-For full command reference, configuration, scanner details, and advanced examples, see [DOCS.md](./DOCS.md).
+For full command reference, configuration, scanner details, and advanced examples, see [CLI reference](https://vibgrate.com/cli).
 
 ---
 
-Copyright © 2026 Vibgrate. All rights reserved. See [LICENSE.md](./LICENSE.md) for terms.
+Copyright © 2026 Vibgrate. All rights reserved. See [Vibgrate CLI License](https://vibgrate.com/license) for terms.

package/dist/baseline-NZZNS4UI.js

@@ -0,0 +1,10 @@
+import {
+  baselineCommand,
+  runBaseline
+} from "./chunk-KLJ5NIGX.js";
+import "./chunk-H473HICY.js";
+import "./chunk-43ACU2WV.js";
+export {
+  baselineCommand,
+  runBaseline
+};

package/dist/{chunk-RNVZIZNL.js → chunk-43ACU2WV.js}

@@ -1,7 +1,9 @@
 // src/utils/fs.ts
+import { execFile } from "child_process";
 import * as fs from "fs/promises";
 import * as os from "os";
 import * as path2 from "path";
+import { promisify } from "util";
 
 // src/utils/semaphore.ts
 var Semaphore = class {
@@ -113,6 +115,7 @@ function escapeRegex(s) {
 }
 
 // src/utils/fs.ts
+var execFileAsync = promisify(execFile);
 var SKIP_DIRS = /* @__PURE__ */ new Set([
   "node_modules",
   ".git",
@@ -205,6 +208,7 @@ var SKIP_EXTENSIONS = /* @__PURE__ */ new Set([
   // Source maps & lockfiles (large, not useful for drift analysis)
   ".map"
 ]);
+var EXTRA_SKIP_DIRS = /* @__PURE__ */ new Set([".nuxt", ".output", ".svelte-kit"]);
 var TEXT_CACHE_MAX_BYTES = 1048576;
 var FileCache = class _FileCache {
   /** Directory walk results keyed by rootDir */
@@ -225,6 +229,10 @@ var FileCache = class _FileCache {
   _maxFileSize = 0;
   /** Root dir for relative-path computation (set by the first walkDir call) */
   _rootDir = null;
+  /** Cached tree summary captured during the shared walk */
+  walkSummary = /* @__PURE__ */ new Map();
+  /** Fast lookup for exact filename (e.g. package.json) */
+  fileNameIndex = /* @__PURE__ */ new Map();
   /** Set exclude patterns from config (call once before the walk) */
   setExcludePatterns(patterns) {
     this.excludePredicate = compileGlobs(patterns);
@@ -266,8 +274,12 @@ var FileCache = class _FileCache {
     this.walkCache.set(rootDir, promise);
     return promise;
   }
+  /** Return tree summary from the cached walk, if available. */
+  getWalkSummary(rootDir) {
+    return this.walkSummary.get(rootDir);
+  }
   /** Additional dirs skipped only by the cached walk (framework outputs) */
-  static EXTRA_SKIP = /* @__PURE__ */ new Set([".nuxt", ".output", ".svelte-kit"]);
+  static EXTRA_SKIP = EXTRA_SKIP_DIRS;
   async _doWalk(rootDir, onProgress) {
     const results = [];
     const cores = typeof os.availableParallelism === "function" ? os.availableParallelism() : os.cpus().length || 4;
@@ -328,6 +340,20 @@ var FileCache = class _FileCache {
       await Promise.all(subWalks);
     }
     await walk(rootDir);
+    let totalDirs = 0;
+    const rootNameIndex = /* @__PURE__ */ new Map();
+    for (const entry of results) {
+      if (entry.isDirectory) totalDirs++;
+      if (!entry.isFile) continue;
+      const bucket = rootNameIndex.get(entry.name);
+      if (bucket) {
+        bucket.push(entry.absPath);
+      } else {
+        rootNameIndex.set(entry.name, [entry.absPath]);
+      }
+    }
+    this.walkSummary.set(rootDir, { totalFiles: foundCount, totalDirs });
+    this.fileNameIndex.set(rootDir, rootNameIndex);
     if (onProgress && foundCount !== lastReported) {
       onProgress(foundCount, "");
     }
@@ -342,13 +368,16 @@ var FileCache = class _FileCache {
     return entries.filter((e) => e.isFile && predicate(e.name)).map((e) => e.absPath);
   }
   async findPackageJsonFiles(rootDir) {
-    return this.findFiles(rootDir, (name) => name === "package.json");
+    await this.walkDir(rootDir);
+    return this.fileNameIndex.get(rootDir)?.get("package.json") ?? [];
   }
   async findCsprojFiles(rootDir) {
-    return this.findFiles(rootDir, (name) => name.endsWith(".csproj"));
+    const entries = await this.walkDir(rootDir);
+    return entries.filter((e) => e.isFile && e.name.endsWith(".csproj")).map((e) => e.absPath);
   }
   async findSolutionFiles(rootDir) {
-    return this.findFiles(rootDir, (name) => name.endsWith(".sln"));
+    const entries = await this.walkDir(rootDir);
+    return entries.filter((e) => e.isFile && e.name.endsWith(".sln")).map((e) => e.absPath);
   }
   // ── File content reading ──
   /**
@@ -416,6 +445,8 @@ var FileCache = class _FileCache {
   /** Release all cached data. Call after the scan completes. */
   clear() {
     this.walkCache.clear();
+    this.walkSummary.clear();
+    this.fileNameIndex.clear();
     this.textCache.clear();
     this.jsonCache.clear();
     this.existsCache.clear();
@@ -430,12 +461,14 @@ var FileCache = class _FileCache {
   }
 };
 async function quickTreeCount(rootDir, excludePatterns) {
+  const native = await quickTreeCountWithRipgrep(rootDir, excludePatterns);
+  if (native) return native;
   let totalFiles = 0;
   let totalDirs = 0;
   const cores = typeof os.availableParallelism === "function" ? os.availableParallelism() : os.cpus().length || 4;
   const maxConcurrent = Math.max(8, Math.min(128, cores * 8));
   const sem = new Semaphore(maxConcurrent);
-  const extraSkip = /* @__PURE__ */ new Set([".nuxt", ".output", ".svelte-kit"]);
+  const extraSkip = EXTRA_SKIP_DIRS;
   const isExcluded = excludePatterns ? compileGlobs(excludePatterns) : null;
   async function count(dir) {
     let entries;
@@ -462,6 +495,39 @@ async function quickTreeCount(rootDir, excludePatterns) {
   await count(rootDir);
   return { totalFiles, totalDirs };
 }
+function normalizeGlobForRipgrep(pattern) {
+  return pattern.replace(/\\/g, "/");
+}
+async function quickTreeCountWithRipgrep(rootDir, excludePatterns) {
+  const args = ["--files", "--hidden", "--no-ignore", "--null"];
+  for (const dir of SKIP_DIRS) {
+    args.push("-g", `!**/${dir}/**`);
+  }
+  for (const dir of EXTRA_SKIP_DIRS) {
+    args.push("-g", `!**/${dir}/**`);
+  }
+  for (const ext of SKIP_EXTENSIONS) {
+    args.push("-g", `!**/*${ext}`);
+  }
+  for (const pattern of excludePatterns ?? []) {
+    const trimmed = pattern.trim();
+    if (!trimmed) continue;
+    args.push("-g", `!${normalizeGlobForRipgrep(trimmed)}`);
+  }
+  try {
+    const { stdout } = await execFileAsync("rg", args, { cwd: rootDir, maxBuffer: 64 * 1024 * 1024, encoding: "utf8" });
+    if (!stdout) return { totalFiles: 0, totalDirs: 0 };
+    const files = stdout.split("\0").filter(Boolean);
+    const dirs = /* @__PURE__ */ new Set();
+    for (const file of files) {
+      const dir = path2.dirname(file);
+      if (dir && dir !== ".") dirs.add(dir);
+    }
+    return { totalFiles: files.length, totalDirs: dirs.size };
+  } catch {
+    return null;
+  }
+}
 async function countFilesInDir(dir, recursive = true) {
   let count = 0;
   const extraSkip = /* @__PURE__ */ new Set(["obj", "bin", "Debug", "Release", "TestResults"]);
@@ -555,6 +621,7 @@ export {
   Semaphore,
   FileCache,
   quickTreeCount,
+  normalizeGlobForRipgrep,
   countFilesInDir,
   findFiles,
   findPackageJsonFiles,

package/dist/{chunk-PQEUNAVK.js → chunk-H473HICY.js}

@@ -13,7 +13,7 @@ import {
   readTextFile,
   writeJsonFile,
   writeTextFile
-} from "./chunk-RNVZIZNL.js";
+} from "./chunk-43ACU2WV.js";
 
 // src/scoring/drift-score.ts
 import * as crypto from "crypto";
@@ -484,14 +484,14 @@ function formatExtended(ext) {
     }
   }
   if (ext.tsModernity && ext.tsModernity.typescriptVersion) {
-    const ts2 = ext.tsModernity;
+    const ts3 = ext.tsModernity;
     lines.push(chalk.bold.underline("  TypeScript"));
     const parts = [];
-    parts.push(`v${ts2.typescriptVersion}`);
-    if (ts2.strict === true) parts.push(chalk.green("strict \u2714"));
-    else if (ts2.strict === false) parts.push(chalk.yellow("strict \u2716"));
-    if (ts2.moduleType) parts.push(ts2.moduleType.toUpperCase());
-    if (ts2.target) parts.push(`target: ${ts2.target}`);
+    parts.push(`v${ts3.typescriptVersion}`);
+    if (ts3.strict === true) parts.push(chalk.green("strict \u2714"));
+    else if (ts3.strict === false) parts.push(chalk.yellow("strict \u2716"));
+    if (ts3.moduleType) parts.push(ts3.moduleType.toUpperCase());
+    if (ts3.target) parts.push(`target: ${ts3.target}`);
     lines.push(`    ${parts.join(chalk.dim(" \xB7 "))}`);
     lines.push("");
   }
@@ -1213,6 +1213,7 @@ import { Command as Command3 } from "commander";
 import chalk6 from "chalk";
 
 // src/scanners/node-scanner.ts
+import * as os2 from "os";
 import * as path4 from "path";
 import * as semver2 from "semver";
 
@@ -1314,11 +1315,52 @@ function maxStable(versions) {
   if (stable.length === 0) return null;
   return stable.sort(semver.rcompare)[0] ?? null;
 }
+function parseNpmMetaPayload(data) {
+  let latest = null;
+  let versions = [];
+  if (data && typeof data === "object") {
+    const record = data;
+    const dtLatest = record["dist-tags.latest"];
+    if (typeof dtLatest === "string") latest = dtLatest;
+    const distTags = record["dist-tags"];
+    if (!latest && distTags && typeof distTags === "object" && typeof distTags.latest === "string") {
+      latest = distTags.latest;
+    }
+    const v = record.versions;
+    if (Array.isArray(v)) versions = v.map(String);
+    else if (typeof v === "string") versions = [v];
+  }
+  const stable = stableOnly(versions);
+  const latestStableOverall = maxStable(stable);
+  if (!latest && latestStableOverall) latest = latestStableOverall;
+  return { latest, stableVersions: stable, latestStableOverall };
+}
+var BATCH_SIZE = 24;
+var WINDOWS_MAX_COMMAND_CHARS = 7e3;
+var POSIX_MAX_COMMAND_CHARS = 3e4;
+function buildNpmViewChunks(pkgs, platform = process.platform) {
+  const maxCommandChars = platform === "win32" ? WINDOWS_MAX_COMMAND_CHARS : POSIX_MAX_COMMAND_CHARS;
+  const chunks = [];
+  let current = [];
+  let currentChars = 0;
+  for (const pkg2 of pkgs) {
+    const pkgChars = pkg2.length + 1;
+    if (current.length >= BATCH_SIZE || current.length > 0 && currentChars + pkgChars > maxCommandChars) {
+      chunks.push(current);
+      current = [];
+      currentChars = 0;
+    }
+    current.push(pkg2);
+    currentChars += pkgChars;
+  }
+  if (current.length > 0) chunks.push(current);
+  return chunks;
+}
 async function npmViewJson(args, cwd) {
   return new Promise((resolve10, reject) => {
-    const child = spawn2("npm", ["view", ...args, "--json"], {
+    const npmCommand = process.platform === "win32" ? "npm.cmd" : "npm";
+    const child = spawn2(npmCommand, ["view", ...args, "--json"], {
       cwd,
-      shell: true,
       stdio: ["ignore", "pipe", "pipe"]
     });
     let out = "";
@@ -1352,56 +1394,127 @@ var NpmCache = class {
     this.offline = offline;
   }
   meta = /* @__PURE__ */ new Map();
+  async prefetch(pkgs) {
+    const unique = [...new Set(pkgs.filter(Boolean))];
+    const pending = unique.filter((pkg2) => !this.meta.has(pkg2));
+    if (pending.length === 0) return;
+    const batchPromise = this.sem.run(() => this.fetchBatch(pending));
+    for (const pkg2 of pending) {
+      const promise = batchPromise.then((batch) => batch.get(pkg2) ?? { latest: null, stableVersions: [], latestStableOverall: null });
+      this.meta.set(pkg2, promise);
+    }
+    await batchPromise;
+  }
   get(pkg2) {
     const existing = this.meta.get(pkg2);
     if (existing) return existing;
-    const p = this.sem.run(async () => {
+    const p = this.sem.run(() => this.fetchOne(pkg2));
+    this.meta.set(pkg2, p);
+    return p;
+  }
+  async fetchBatch(pkgs) {
+    const out = /* @__PURE__ */ new Map();
+    const remote = [];
+    for (const pkg2 of pkgs) {
       const manifestEntry = getManifestEntry(this.manifest, "npm", pkg2);
       if (manifestEntry) {
-        const stable2 = stableOnly(manifestEntry.versions ?? []);
-        const latestStableOverall2 = maxStable(stable2);
-        return {
-          latest: manifestEntry.latest ?? latestStableOverall2,
-          stableVersions: stable2,
-          latestStableOverall: latestStableOverall2
-        };
+        const stable = stableOnly(manifestEntry.versions ?? []);
+        const latestStableOverall = maxStable(stable);
+        out.set(pkg2, {
+          latest: manifestEntry.latest ?? latestStableOverall,
+          stableVersions: stable,
+          latestStableOverall
+        });
+      } else if (this.offline) {
+        out.set(pkg2, { latest: null, stableVersions: [], latestStableOverall: null });
+      } else {
+        remote.push(pkg2);
       }
-      if (this.offline) {
-        return { latest: null, stableVersions: [], latestStableOverall: null };
+    }
+    if (remote.length === 0) return out;
+    for (const chunk of buildNpmViewChunks(remote)) {
+      const chunkResults = await this.fetchRemoteChunk(chunk);
+      for (const [pkg2, meta] of chunkResults) {
+        out.set(pkg2, meta);
       }
+    }
+    return out;
+  }
+  async fetchRemoteChunk(pkgs) {
+    const out = /* @__PURE__ */ new Map();
+    if (pkgs.length === 1) {
+      out.set(pkgs[0], await this.fetchOneRemote(pkgs[0]));
+      return out;
+    }
+    try {
+      const data = await npmViewJson([...pkgs, "dist-tags.latest", "versions"], this.cwd);
+      if (Array.isArray(data)) {
+        for (let i = 0; i < data.length && i < pkgs.length; i++) {
+          out.set(pkgs[i], parseNpmMetaPayload(data[i]));
+        }
+      } else if (data && typeof data === "object") {
+        const record = data;
+        let keyedByPkg = 0;
+        for (const pkg2 of pkgs) {
+          if (pkg2 in record) {
+            out.set(pkg2, parseNpmMetaPayload(record[pkg2]));
+            keyedByPkg++;
+          }
+        }
+        if (keyedByPkg === 0 && pkgs.length === 1) {
+          out.set(pkgs[0], parseNpmMetaPayload(record));
+        }
+      }
+    } catch {
+    }
+    for (const pkg2 of pkgs) {
+      if (!out.has(pkg2)) {
+        out.set(pkg2, await this.fetchOneRemote(pkg2));
+      }
+    }
+    return out;
+  }
+  async fetchOne(pkg2) {
+    const manifestEntry = getManifestEntry(this.manifest, "npm", pkg2);
+    if (manifestEntry) {
+      const stable = stableOnly(manifestEntry.versions ?? []);
+      const latestStableOverall = maxStable(stable);
+      return {
+        latest: manifestEntry.latest ?? latestStableOverall,
+        stableVersions: stable,
+        latestStableOverall
+      };
+    }
+    if (this.offline) {
+      return { latest: null, stableVersions: [], latestStableOverall: null };
+    }
+    return this.fetchOneRemote(pkg2);
+  }
+  async fetchOneRemote(pkg2) {
+    try {
+      const data = await npmViewJson([pkg2, "dist-tags.latest", "versions"], this.cwd);
+      return parseNpmMetaPayload(data);
+    } catch {
       let latest = null;
       let versions = [];
       try {
-        const data = await npmViewJson([pkg2, "dist-tags.latest", "versions"], this.cwd);
-        if (data && typeof data === "object") {
-          const dt = data["dist-tags.latest"];
-          if (typeof dt === "string") latest = dt;
-          const v = data.versions;
-          if (Array.isArray(v)) versions = v.map(String);
-          else if (typeof v === "string") versions = [v];
+        const dist = await npmViewJson([pkg2, "dist-tags"], this.cwd);
+        if (dist && typeof dist === "object" && typeof dist.latest === "string") {
+          latest = dist.latest;
         }
       } catch {
-        try {
-          const dist = await npmViewJson([pkg2, "dist-tags"], this.cwd);
-          if (dist && typeof dist === "object" && typeof dist.latest === "string") {
-            latest = dist.latest;
-          }
-        } catch {
-        }
-        try {
-          const v = await npmViewJson([pkg2, "versions"], this.cwd);
-          if (Array.isArray(v)) versions = v.map(String);
-          else if (typeof v === "string") versions = [v];
-        } catch {
-        }
+      }
+      try {
+        const v = await npmViewJson([pkg2, "versions"], this.cwd);
+        if (Array.isArray(v)) versions = v.map(String);
+        else if (typeof v === "string") versions = [v];
+      } catch {
       }
       const stable = stableOnly(versions);
       const latestStableOverall = maxStable(stable);
       if (!latest && latestStableOverall) latest = latestStableOverall;
       return { latest, stableVersions: stable, latestStableOverall };
-    });
-    this.meta.set(pkg2, p);
-    return p;
+    }
   }
 };
 async function checkRegistryAccess(cwd) {
@@ -1514,24 +1627,32 @@ async function scanNodeProjects(rootDir, npmCache, cache) {
   const results = [];
   const packageNameToPath = /* @__PURE__ */ new Map();
   const STUCK_TIMEOUT_MS = 6e4;
-  for (const pjPath of packageJsonFiles) {
+  const cores = typeof os2.availableParallelism === "function" ? os2.availableParallelism() : os2.cpus().length || 4;
+  const projectConcurrency = Math.max(2, Math.min(16, cores * 2));
+  const projectSem = new Semaphore(projectConcurrency);
+  const scannedProjects = await Promise.all(packageJsonFiles.map(async (pjPath) => projectSem.run(async () => {
     try {
       const scanPromise = scanOnePackageJson(pjPath, rootDir, npmCache, cache);
       const result = await withTimeout(scanPromise, STUCK_TIMEOUT_MS);
       if (result.ok) {
-        results.push(result.value);
-        packageNameToPath.set(result.value.name, result.value.path);
-      } else {
-        const relPath = path4.relative(rootDir, path4.dirname(pjPath));
-        if (cache) {
-          cache.addStuckPath(relPath || ".");
-        }
-        console.error(`Timeout scanning ${pjPath} (>${STUCK_TIMEOUT_MS / 1e3}s) \u2014 skipped`);
+        return result.value;
       }
+      const relPath = path4.relative(rootDir, path4.dirname(pjPath));
+      if (cache) {
+        cache.addStuckPath(relPath || ".");
+      }
+      console.error(`Timeout scanning ${pjPath} (>${STUCK_TIMEOUT_MS / 1e3}s) \u2014 skipped`);
+      return null;
     } catch (e) {
       const msg = e instanceof Error ? e.message : String(e);
       console.error(`Error scanning ${pjPath}: ${msg}`);
+      return null;
     }
+  })));
+  for (const project of scannedProjects) {
+    if (!project) continue;
+    results.push(project);
+    packageNameToPath.set(project.name, project.path);
   }
   for (const project of results) {
     const workspaceRefs = [];
@@ -1584,6 +1705,7 @@ async function scanOnePackageJson(packageJsonPath, rootDir, npmCache, cache) {
       depEntries.push({ pkg: pkg2, section: s.name, spec });
     }
   }
+  await npmCache.prefetch(depEntries.map((entry) => entry.pkg));
   const metaPromises = depEntries.map(async (entry) => {
     const meta = await npmCache.get(entry.pkg);
     return { ...entry, meta };
@@ -2338,7 +2460,7 @@ async function scanPythonProjects(rootDir, pypiCache, cache) {
   return results;
 }
 async function findPythonManifests(rootDir) {
-  const { findFiles: findFiles2 } = await import("./fs-Q63DRR7L.js");
+  const { findFiles: findFiles2 } = await import("./fs-TWKR3VSL.js");
   return findFiles2(rootDir, (name) => PYTHON_MANIFEST_FILES.has(name) || /^requirements.*\.txt$/.test(name));
 }
 async function scanOnePythonProject(dir, manifestFiles, rootDir, pypiCache, cache) {
@@ -2737,7 +2859,7 @@ async function scanJavaProjects(rootDir, mavenCache, cache) {
   return results;
 }
 async function findJavaManifests(rootDir) {
-  const { findFiles: findFiles2 } = await import("./fs-Q63DRR7L.js");
+  const { findFiles: findFiles2 } = await import("./fs-TWKR3VSL.js");
   return findFiles2(rootDir, (name) => JAVA_MANIFEST_FILES.has(name));
 }
 async function scanOneJavaProject(dir, manifestFiles, rootDir, mavenCache, cache) {
@@ -3225,11 +3347,74 @@ var MavenCache = class {
 // src/config.ts
 import * as path9 from "path";
 import * as fs from "fs/promises";
+import ts from "typescript";
 var CONFIG_FILES = [
   "vibgrate.config.ts",
   "vibgrate.config.js",
   "vibgrate.config.json"
 ];
+var TRUSTED_CONFIG_ENV = "VIBGRATE_TRUST_CONFIG";
+function isRecord(value) {
+  return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+function toStaticValue(expr, constBindings) {
+  if (ts.isParenthesizedExpression(expr)) return toStaticValue(expr.expression, constBindings);
+  if (ts.isStringLiteralLike(expr)) return expr.text;
+  if (ts.isNumericLiteral(expr)) return Number(expr.text);
+  if (expr.kind === ts.SyntaxKind.TrueKeyword) return true;
+  if (expr.kind === ts.SyntaxKind.FalseKeyword) return false;
+  if (expr.kind === ts.SyntaxKind.NullKeyword) return null;
+  if (ts.isArrayLiteralExpression(expr)) {
+    return expr.elements.map((el) => {
+      if (ts.isSpreadElement(el)) throw new Error("Spread not supported in static config arrays");
+      return toStaticValue(el, constBindings);
+    });
+  }
+  if (ts.isObjectLiteralExpression(expr)) {
+    const out = {};
+    for (const prop of expr.properties) {
+      if (!ts.isPropertyAssignment(prop) || prop.initializer === void 0) {
+        throw new Error("Only plain object properties are supported in static config");
+      }
+      if (ts.isComputedPropertyName(prop.name)) {
+        throw new Error("Computed property names are not supported in static config");
+      }
+      const key = ts.isIdentifier(prop.name) ? prop.name.text : ts.isStringLiteral(prop.name) ? prop.name.text : ts.isNumericLiteral(prop.name) ? prop.name.text : null;
+      if (key === null) {
+        throw new Error("Unsupported object key in static config");
+      }
+      out[key] = toStaticValue(prop.initializer, constBindings);
+    }
+    return out;
+  }
+  if (ts.isIdentifier(expr)) {
+    const bound = constBindings.get(expr.text);
+    if (!bound) throw new Error(`Unknown identifier in static config: ${expr.text}`);
+    return toStaticValue(bound, constBindings);
+  }
+  throw new Error("Non-static expression in config");
+}
+function tryParseStaticConfig(text, configPath) {
+  const scriptKind = configPath.endsWith(".ts") ? ts.ScriptKind.TS : ts.ScriptKind.JS;
+  const source = ts.createSourceFile(configPath, text, ts.ScriptTarget.ESNext, true, scriptKind);
+  const constBindings = /* @__PURE__ */ new Map();
+  for (const stmt of source.statements) {
+    if (!ts.isVariableStatement(stmt)) continue;
+    if (!(stmt.declarationList.flags & ts.NodeFlags.Const)) continue;
+    for (const decl of stmt.declarationList.declarations) {
+      if (ts.isIdentifier(decl.name) && decl.initializer) {
+        constBindings.set(decl.name.text, decl.initializer);
+      }
+    }
+  }
+  for (const stmt of source.statements) {
+    if (!ts.isExportAssignment(stmt)) continue;
+    const parsed = toStaticValue(stmt.expression, constBindings);
+    if (!isRecord(parsed)) return null;
+    return { ...DEFAULT_CONFIG, ...parsed };
+  }
+  return null;
+}
 var DEFAULT_MAX_FILE_SIZE = 5242880;
 var DEFAULT_CONFIG = {
   exclude: [],
@@ -3252,15 +3437,28 @@ async function loadConfig(rootDir) {
     const configPath = path9.join(rootDir, file);
     if (await pathExists(configPath)) {
       if (file.endsWith(".json")) {
-        const txt = await readTextFile(configPath);
-        config = { ...DEFAULT_CONFIG, ...JSON.parse(txt) };
+        const txt2 = await readTextFile(configPath);
+        config = { ...DEFAULT_CONFIG, ...JSON.parse(txt2) };
         break;
       }
+      const txt = await readTextFile(configPath);
+      let staticConfig = null;
       try {
-        const mod = await import(configPath);
-        config = { ...DEFAULT_CONFIG, ...mod.default ?? mod };
-        break;
+        staticConfig = tryParseStaticConfig(txt, configPath);
       } catch {
+        staticConfig = null;
+      }
+      if (staticConfig) {
+        config = staticConfig;
+        break;
+      }
+      if (process.env[TRUSTED_CONFIG_ENV] === "1") {
+        try {
+          const mod = await import(configPath);
+          config = { ...DEFAULT_CONFIG, ...mod.default ?? mod };
+          break;
+        } catch {
+        }
       }
     }
   }
@@ -6587,7 +6785,7 @@ async function scanArchitecture(rootDir, projects, tooling, services, cache) {
 
 // src/scanners/code-quality.ts
 import * as path21 from "path";
-import * as ts from "typescript";
+import * as ts2 from "typescript";
 var SOURCE_EXTENSIONS2 = /* @__PURE__ */ new Set([".ts", ".tsx", ".js", ".jsx", ".mjs", ".cjs"]);
 var DEFAULT_RESULT = {
   filesAnalyzed: 0,
@@ -6618,7 +6816,7 @@ async function scanCodeQuality(rootDir, cache) {
     }
     if (!raw.trim()) continue;
     const rel = normalizeModuleId(path21.relative(rootDir, filePath));
-    const source = ts.createSourceFile(filePath, raw, ts.ScriptTarget.Latest, true);
+    const source = ts2.createSourceFile(filePath, raw, ts2.ScriptTarget.Latest, true);
     const imports = collectLocalImports(source, path21.dirname(filePath), rootDir);
     depGraph.set(rel, imports);
     const fileMetrics = computeFileMetrics(source, raw);
@@ -6661,11 +6859,11 @@ async function findSourceFiles(rootDir, cache) {
 function collectLocalImports(source, fileDir, rootDir) {
   const deps = /* @__PURE__ */ new Set();
   const visit = (node) => {
-    if (ts.isImportDeclaration(node) && ts.isStringLiteral(node.moduleSpecifier)) {
+    if (ts2.isImportDeclaration(node) && ts2.isStringLiteral(node.moduleSpecifier)) {
       const target = resolveLocalImport(node.moduleSpecifier.text, fileDir, rootDir);
       if (target) deps.add(target);
     }
-    if (ts.isCallExpression(node) && node.expression.kind === ts.SyntaxKind.ImportKeyword && node.arguments[0] && ts.isStringLiteral(node.arguments[0])) {
+    if (ts2.isCallExpression(node) && node.expression.kind === ts2.SyntaxKind.ImportKeyword && node.arguments[0] && ts2.isStringLiteral(node.arguments[0])) {
       const target = resolveLocalImport(node.arguments[0].text, fileDir, rootDir);
       if (target) deps.add(target);
     }
@@ -6701,7 +6899,7 @@ function computeFileMetrics(source, raw) {
       totalFunctionLength += lineLength;
       maxNestingDepth = Math.max(maxNestingDepth, nestingDepth);
     }
-    if (ts.isFunctionDeclaration(node) && node.name) {
+    if (ts2.isFunctionDeclaration(node) && node.name) {
       functionDecls.push(node);
     }
     visitEach(node, visit);
@@ -6728,20 +6926,20 @@ function computeCyclomatic(fn) {
   let complexity = 1;
   const visit = (node) => {
     switch (node.kind) {
-      case ts.SyntaxKind.IfStatement:
-      case ts.SyntaxKind.ForStatement:
-      case ts.SyntaxKind.ForOfStatement:
-      case ts.SyntaxKind.ForInStatement:
-      case ts.SyntaxKind.WhileStatement:
-      case ts.SyntaxKind.DoStatement:
-      case ts.SyntaxKind.CaseClause:
-      case ts.SyntaxKind.CatchClause:
-      case ts.SyntaxKind.ConditionalExpression:
+      case ts2.SyntaxKind.IfStatement:
+      case ts2.SyntaxKind.ForStatement:
+      case ts2.SyntaxKind.ForOfStatement:
+      case ts2.SyntaxKind.ForInStatement:
+      case ts2.SyntaxKind.WhileStatement:
+      case ts2.SyntaxKind.DoStatement:
+      case ts2.SyntaxKind.CaseClause:
+      case ts2.SyntaxKind.CatchClause:
+      case ts2.SyntaxKind.ConditionalExpression:
         complexity++;
         break;
-      case ts.SyntaxKind.BinaryExpression: {
+      case ts2.SyntaxKind.BinaryExpression: {
         const be = node;
-        if (be.operatorToken.kind === ts.SyntaxKind.AmpersandAmpersandToken || be.operatorToken.kind === ts.SyntaxKind.BarBarToken || be.operatorToken.kind === ts.SyntaxKind.QuestionQuestionToken) {
+        if (be.operatorToken.kind === ts2.SyntaxKind.AmpersandAmpersandToken || be.operatorToken.kind === ts2.SyntaxKind.BarBarToken || be.operatorToken.kind === ts2.SyntaxKind.QuestionQuestionToken) {
           complexity++;
         }
         break;
@@ -6793,15 +6991,15 @@ function computeNodeLineLength(source, node) {
   return end - start + 1;
 }
 function isFunctionLike(node) {
-  return ts.isFunctionDeclaration(node) || ts.isMethodDeclaration(node) || ts.isFunctionExpression(node) || ts.isArrowFunction(node) || ts.isConstructorDeclaration(node);
+  return ts2.isFunctionDeclaration(node) || ts2.isMethodDeclaration(node) || ts2.isFunctionExpression(node) || ts2.isArrowFunction(node) || ts2.isConstructorDeclaration(node);
 }
 function isNestingNode(node) {
-  return node.kind === ts.SyntaxKind.IfStatement || node.kind === ts.SyntaxKind.ForStatement || node.kind === ts.SyntaxKind.ForOfStatement || node.kind === ts.SyntaxKind.ForInStatement || node.kind === ts.SyntaxKind.WhileStatement || node.kind === ts.SyntaxKind.DoStatement || node.kind === ts.SyntaxKind.SwitchStatement || node.kind === ts.SyntaxKind.TryStatement || node.kind === ts.SyntaxKind.CatchClause;
+  return node.kind === ts2.SyntaxKind.IfStatement || node.kind === ts2.SyntaxKind.ForStatement || node.kind === ts2.SyntaxKind.ForOfStatement || node.kind === ts2.SyntaxKind.ForInStatement || node.kind === ts2.SyntaxKind.WhileStatement || node.kind === ts2.SyntaxKind.DoStatement || node.kind === ts2.SyntaxKind.SwitchStatement || node.kind === ts2.SyntaxKind.TryStatement || node.kind === ts2.SyntaxKind.CatchClause;
 }
 function isExported(node) {
-  if (!ts.canHaveModifiers(node)) return false;
-  const modifiers = ts.getModifiers(node);
-  return !!modifiers?.some((m) => m.kind === ts.SyntaxKind.ExportKeyword);
+  if (!ts2.canHaveModifiers(node)) return false;
+  const modifiers = ts2.getModifiers(node);
+  return !!modifiers?.some((m) => m.kind === ts2.SyntaxKind.ExportKeyword);
 }
 function countWholeWord(input, word) {
   const re = new RegExp(`\\b${escapeRegExp(word)}\\b`, "g");
@@ -7513,8 +7711,9 @@ async function runScan(rootDir, opts) {
     console.error(msg);
     process.exit(1);
   }
+  const treeCountPromise = quickTreeCount(rootDir, excludePatterns);
   progress.startStep("discovery");
-  const treeCount = await quickTreeCount(rootDir, excludePatterns);
+  const treeCount = await treeCountPromise;
   progress.updateStats({ treeSummary: treeCount });
   progress.completeStep(
     "discovery",
@@ -7532,6 +7731,10 @@ async function runScan(rootDir, opts) {
   await fileCache.walkDir(rootDir, (found, currentPath) => {
     progress.updateStepProgress("walk", found, treeCount.totalFiles, currentPath);
   });
+  const indexedTreeCount = fileCache.getWalkSummary(rootDir);
+  if (indexedTreeCount && (indexedTreeCount.totalFiles !== treeCount.totalFiles || indexedTreeCount.totalDirs !== treeCount.totalDirs)) {
+    progress.updateStats({ treeSummary: indexedTreeCount });
+  }
   progress.completeStep("walk", `${treeCount.totalFiles.toLocaleString()} files indexed`);
   progress.startStep("node");
   const nodeProjects = await scanNodeProjects(rootDir, npmCache, fileCache);

package/dist/{chunk-CQMW6PVB.js → chunk-KLJ5NIGX.js}

@@ -1,9 +1,9 @@
 import {
   runScan
-} from "./chunk-PQEUNAVK.js";
+} from "./chunk-H473HICY.js";
 import {
   writeJsonFile
-} from "./chunk-RNVZIZNL.js";
+} from "./chunk-43ACU2WV.js";
 
 // src/commands/baseline.ts
 import * as path from "path";

package/dist/cli.js

@@ -1,7 +1,7 @@
 #!/usr/bin/env node
 import {
   baselineCommand
-} from "./chunk-CQMW6PVB.js";
+} from "./chunk-KLJ5NIGX.js";
 import {
   VERSION,
   dsnCommand,
@@ -10,13 +10,13 @@ import {
   pushCommand,
   scanCommand,
   writeDefaultConfig
-} from "./chunk-PQEUNAVK.js";
+} from "./chunk-H473HICY.js";
 import {
   ensureDir,
   pathExists,
   readJsonFile,
   writeTextFile
-} from "./chunk-RNVZIZNL.js";
+} from "./chunk-43ACU2WV.js";
 
 // src/cli.ts
 import { Command as Command6 } from "commander";
@@ -39,7 +39,7 @@ var initCommand = new Command("init").description("Initialize vibgrate in a proj
     console.log(chalk.green("\u2714") + ` Created ${chalk.bold("vibgrate.config.ts")}`);
   }
   if (opts.baseline) {
-    const { runBaseline } = await import("./baseline-5ZOILNXB.js");
+    const { runBaseline } = await import("./baseline-NZZNS4UI.js");
     await runBaseline(rootDir);
   }
   console.log("");

package/dist/{fs-Q63DRR7L.js → fs-TWKR3VSL.js}

@@ -6,13 +6,14 @@ import {
   findFiles,
   findPackageJsonFiles,
   findSolutionFiles,
+  normalizeGlobForRipgrep,
   pathExists,
   quickTreeCount,
   readJsonFile,
   readTextFile,
   writeJsonFile,
   writeTextFile
-} from "./chunk-RNVZIZNL.js";
+} from "./chunk-43ACU2WV.js";
 export {
   FileCache,
   countFilesInDir,
@@ -21,6 +22,7 @@ export {
   findFiles,
   findPackageJsonFiles,
   findSolutionFiles,
+  normalizeGlobForRipgrep,
   pathExists,
   quickTreeCount,
   readJsonFile,

package/dist/index.js

@@ -5,8 +5,8 @@ import {
   formatText,
   generateFindings,
   runScan
-} from "./chunk-PQEUNAVK.js";
-import "./chunk-RNVZIZNL.js";
+} from "./chunk-H473HICY.js";
+import "./chunk-43ACU2WV.js";
 export {
   computeDriftScore,
   formatMarkdown,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@vibgrate/cli",
-  "version": "1.0.56",
+  "version": "1.0.57",
   "description": "CLI for measuring upgrade drift across Node, .NET, Python & Java projects",
   "type": "module",
   "bin": {

package/dist/baseline-5ZOILNXB.js

@@ -1,10 +0,0 @@
-import {
-  baselineCommand,
-  runBaseline
-} from "./chunk-CQMW6PVB.js";
-import "./chunk-PQEUNAVK.js";
-import "./chunk-RNVZIZNL.js";
-export {
-  baselineCommand,
-  runBaseline
-};