hermex 2.0.0-beta.1 → 2.0.0-beta.10

package/dist/cli.mjs

@@ -1,11 +1,10 @@
 #!/usr/bin/env node
-import { Command } from "commander";
-import ora from "ora";
+import { Command, Option } from "commander";
 import chalk from "chalk";
 import Table from "cli-table3";
 import fs, { existsSync, readFileSync } from "node:fs";
 import { fileURLToPath, pathToFileURL } from "node:url";
-import path, { join, resolve } from "node:path";
+import path, { dirname, join, resolve } from "node:path";
 import { z } from "zod";
 import { parseSync } from "@swc/core";
 import micromatch from "micromatch";
@@ -15,6 +14,10 @@ import path$1 from "path";
 import semver from "semver";
 import { load } from "js-yaml";
 import lockfile from "@yarnpkg/lockfile";
+import { randomUUID } from "node:crypto";
+import { mkdir, readFile, rename, unlink, writeFile } from "node:fs/promises";
+import { homedir } from "node:os";
+import ora from "ora";
 //#region src/utils/format-utils.ts
 /**
 * Format a number with thousand separators
@@ -24,6 +27,31 @@ import lockfile from "@yarnpkg/lockfile";
 function formatCount(num) {
 	return num.toLocaleString();
 }
+/**
+* Format how far an upgrade candidate is past its age threshold
+* @returns Formatted string (e.g., "40 days overdue", "1 day overdue")
+*/
+function formatDaysOverdue(releasedDaysAgo, thresholdDays) {
+	const overdue = releasedDaysAgo - thresholdDays;
+	return `${overdue} day${overdue === 1 ? "" : "s"} overdue`;
+}
+/**
+* Format how long until an upgrade candidate breaches its age threshold
+* @returns Formatted string (e.g., "12 days remaining", "1 day remaining")
+*/
+function formatDaysRemaining(daysRemaining) {
+	return `${daysRemaining} day${daysRemaining === 1 ? "" : "s"} remaining`;
+}
+/**
+* Join a list of items, showing only the first `limit` and summarizing the rest
+* @returns Formatted string (e.g., "a, b and 3 other files", "a, b and 1 other file")
+*/
+function formatTruncatedList(items, noun, limit = 2) {
+	const shown = items.slice(0, limit).join(", ");
+	const rest = items.length - limit;
+	if (rest <= 0) return shown;
+	return `${shown} and ${rest} other ${noun}${rest === 1 ? "" : "s"}`;
+}
 //#endregion
 //#region src/utils/print-summary.ts
 function printHeader$4() {
@@ -168,26 +196,88 @@ function printPatternsChart(patterns) {
 	})), { maxWidth: 50 });
 }
 //#endregion
+//#region src/utils/severity-format.ts
+const ICONS = {
+	error: "🔴",
+	warn: "🟡",
+	info: "🔵",
+	success: "🟢"
+};
+const COLORS = {
+	error: chalk.red,
+	warn: chalk.yellow,
+	info: chalk.blue,
+	success: chalk.green
+};
+/** Colored-circle glyph for a severity — carries meaning without relying on ANSI color. */
+function severityIcon(severity) {
+	return ICONS[severity];
+}
+/** chalk color function for a severity, for text that needs coloring. */
+function severityColor(severity) {
+	return COLORS[severity];
+}
+function formatViolationLine(opts) {
+	return `  ${opts.icon}  ${opts.label.padEnd(14)} ${opts.description}`;
+}
+/**
+* Resolves an explicit color-on/off override from CLI flags or the NO_COLOR
+* convention (https://no-color.org). Returns `undefined` when there's no
+* explicit signal, meaning chalk's own auto-detection should be left alone
+* (including its GitHub-Actions-aware detection of non-TTY streams).
+*/
+function resolveColorLevel(opts) {
+	if (opts.colorFlag === false) return 0;
+	if (opts.colorFlag === true) return 1;
+	if (opts.noColorEnv !== void 0) return 0;
+}
+const ANSI_ESCAPE_PATTERN = /\x1b\[[0-9;]*m/g;
+function stripAnsiWrites(stream) {
+	const originalWrite = stream.write.bind(stream);
+	stream.write = ((chunk, ...rest) => {
+		return originalWrite(typeof chunk === "string" ? chunk.replace(ANSI_ESCAPE_PATTERN, "") : chunk, ...rest);
+	});
+}
+/**
+* Beyond setting chalk's own level, this strips ANSI codes at the stream
+* boundary when color is explicitly disabled. hermex also prints through
+* cli-table3 and ora (whose spinner symbols come from log-symbols/yoctocolors)
+* — neither shares hermex's chalk instance or honors chalk.level, so mutating
+* chalk alone can't make NO_COLOR/--no-color hold for their output too.
+*/
+function applyColorLevel(level) {
+	if (level === void 0) return;
+	chalk.level = level;
+	if (level === 0) {
+		stripAnsiWrites(process.stdout);
+		stripAnsiWrites(process.stderr);
+	}
+}
+//#endregion
 //#region src/utils/print-packages.ts
 function printHeader() {
 	console.log(chalk.blueBright.bold("\n📦 Packages\n"));
 }
 function formatPackageName(pkg, banned) {
 	let prefix = "";
-	if (pkg.releaseAge?.deprecated) prefix += chalk.red("[DEPRECATED] ");
-	if (banned) prefix += banned.severity === "error" ? chalk.red("[BANNED] ") : chalk.yellow("[RESTRICTED] ");
-	else if (pkg.internal) prefix += chalk.yellow("[int] ");
+	if (pkg.releaseAge?.deprecated) prefix += severityColor("error")("[DEPRECATED] ");
+	if (banned) prefix += banned.severity === "error" ? severityColor("error")("[BANNED] ") : severityColor("warn")("[RESTRICTED] ");
+	else if (pkg.internal) prefix += severityColor("warn")("[int] ");
 	return prefix + pkg.packageName;
 }
 function formatUpgradeCell(releaseAge) {
 	if (!releaseAge) return "";
-	const { worstLevel, upgrades, severity } = releaseAge;
-	if (!worstLevel) return chalk.green("✓");
+	const { worstLevel, upgrades, severity, pendingUpgrade } = releaseAge;
+	if (!worstLevel) {
+		if (pendingUpgrade) return `${severityIcon("info")} ${pendingUpgrade.semverBump} ${pendingUpgrade.version} (${formatDaysRemaining(pendingUpgrade.daysRemaining)})`;
+		return severityIcon("success");
+	}
 	const top = upgrades[0];
-	if (!top) return chalk.green("✓");
+	if (!top) return severityIcon("success");
 	const suffix = severity === "warn" ? chalk.gray(" [not enforced]") : "";
-	if (worstLevel === "mandatory_upgrade") return (severity === "warn" ? chalk.yellow : chalk.red)(`⚠ ${top.semverBump} ${top.version} (${top.releasedDaysAgo}d)`) + suffix;
-	return chalk.yellow(`↑ ${top.semverBump} ${top.version} (${top.releasedDaysAgo}d)`) + suffix;
+	const overdue = formatDaysOverdue(top.releasedDaysAgo, top.thresholdDays);
+	if (worstLevel === "mandatory_upgrade") return `${severityIcon(severity === "warn" ? "warn" : "error")} ${top.semverBump} ${top.version} (${overdue})${suffix}`;
+	return `${severityIcon("warn")} ${top.semverBump} ${top.version} (${overdue})${suffix}`;
 }
 function getBannedViolation(pkg, violations) {
 	return violations.find((v) => v.packageName === pkg.packageName);
@@ -221,7 +311,7 @@ function printPackagesTable(packages, violations) {
 		}
 	});
 	packages.forEach((pkg) => {
-		const versionCell = pkg.hasVersionConflict ? chalk.yellow(`⚠ ${pkg.allVersions.join(", ")} (multiple — bundle impact)`) : pkg.version || "N/A";
+		const versionCell = pkg.hasVersionConflict ? chalk.yellow(`⚠ ${pkg.allVersions.join(", ")} (${pkg.allVersions.length} versions — bundle impact)`) : pkg.version || "N/A";
 		const row = [
 			formatPackageName(pkg, getBannedViolation(pkg, violations)),
 			versionCell,
@@ -262,13 +352,6 @@ function renderBar(percentage) {
 	const empty = BAR_WIDTH - filled;
 	return chalk.cyan("█".repeat(filled)) + chalk.gray("░".repeat(empty));
 }
-function formatComponents(components, max = 3) {
-	if (components.length === 0) return "";
-	const shown = components.slice(0, max);
-	const rest = components.length - max;
-	const list = shown.join(", ");
-	return rest > 0 ? `${list} (+${rest} more)` : list;
-}
 function printVersusResult(result) {
 	console.log(chalk.bold(`  ${result.name}`));
 	console.log(chalk.gray(`  ${"─".repeat(50)}`));
@@ -278,7 +361,7 @@ function printVersusResult(result) {
 		const bar = renderBar(entry.percentage);
 		const pct = chalk.bold(`${entry.percentage.toFixed(1)}%`);
 		const usage = chalk.gray(`(${entry.count} usages)`);
-		const components = entry.components.length > 0 ? chalk.gray(`  ${formatComponents(entry.components)}`) : "";
+		const components = entry.components.length > 0 ? chalk.gray(`  ${formatTruncatedList(entry.components, "component")}`) : "";
 		console.log(`  ${name}  ${bar} ${pct} ${usage}${components}`);
 	}
 	if (result.totalCount === 0) console.log(chalk.gray("  No usage detected for any package in this group."));
@@ -295,34 +378,37 @@ function formatRuleType(type) {
 	switch (type) {
 		case "detect_files": return "detect_files";
 		case "require_files": return "require_files";
-		case "forbid_packages": return "forbid_packages";
 		case "require_packages": return "require_packages";
 		case "require_scripts": return "require_scripts";
-		case "require_package_fields": return "pkg_fields";
+		case "require_package_fields": return "package_fields";
+		case "forbid_package_fields": return "package_fields";
 		case "engine_version": return "engine_version";
+		case "codeowners": return "codeowners";
 	}
 }
-function ruleIcon(violation) {
-	if (violation.severity === "error") return chalk.red("✗");
-	if (violation.severity === "info") return chalk.blue("ℹ");
-	return chalk.yellow("⚠");
-}
 function describeViolation(v) {
 	const patterns = v.patterns.join(", ");
 	const suffix = v.message ? chalk.gray(` — ${v.message}`) : "";
-	if (v.type === "detect_files") return `${patterns} detected (${v.matchedFiles.map((f) => {
+	if (v.type === "detect_files") return `${patterns} detected (${formatTruncatedList(v.matchedFiles.map((f) => {
 		const parts = f.replace(/\\/g, "/").split("/");
 		return parts[parts.length - 1];
-	}).join(", ")})${suffix}`;
+	}), "file")})${suffix}`;
 	if (v.type === "require_files") return `${patterns} not found${suffix}`;
 	if (v.type === "require_packages") return `${patterns} not installed${suffix}`;
-	if (v.type === "forbid_packages") return `${patterns} is forbidden${suffix}`;
 	if (v.type === "require_scripts") return `script ${patterns} missing in package.json${suffix}`;
-	if (v.type === "require_package_fields") return `field ${patterns} missing in package.json${suffix}`;
+	if (v.type === "require_package_fields") {
+		if (v.fieldPath && v.actualValue !== void 0) return `field ${v.fieldPath} is ${chalk.yellow(v.actualValue)}, does not match required value${suffix}`;
+		return `field ${patterns} missing in package.json${suffix}`;
+	}
+	if (v.type === "forbid_package_fields") return `field ${v.fieldPath ?? patterns} is forbidden in package.json${suffix}`;
 	if (v.type === "engine_version") {
 		if (!v.installedRange) return `engines.node not specified (required ${v.requiredRange})${suffix}`;
 		return `engines.node is ${chalk.yellow(v.installedRange)}, required ${chalk.cyan(v.requiredRange)}${suffix}`;
 	}
+	if (v.type === "codeowners") {
+		if (v.matchedFiles.length === 0) return `CODEOWNERS not found (looked in ${patterns})${suffix}`;
+		return `${v.matchedFiles.length} scanned file(s) have no owner: ${formatTruncatedList(v.matchedFiles, "file")}${suffix}`;
+	}
 	return `${patterns} not present${suffix}`;
 }
 function printRules(aggregated) {
@@ -330,25 +416,23 @@ function printRules(aggregated) {
 	const hasRuleViolations = ruleViolations.length > 0;
 	const hasBannedViolations = bannedPackageViolations.length > 0;
 	if (!hasRuleViolations && !hasBannedViolations) {
-		console.log(chalk.greenBright.bold("\n✓ Compliance\n"));
+		console.log(chalk.greenBright.bold(`\n${severityIcon("success")} Compliance\n`));
 		console.log(chalk.gray("  All compliance checks passed"));
 		return;
 	}
 	console.log(chalk.blueBright.bold("\n🔍 Compliance\n"));
-	if (hasRuleViolations) for (const v of ruleViolations) {
-		const icon = ruleIcon(v);
-		const type = chalk.gray(formatRuleType(v.type).padEnd(14));
-		const severityTag = v.severity === "error" ? chalk.red("[ERROR]") : v.severity === "info" ? chalk.blue("[INFO]") : chalk.yellow("[WARN]");
-		console.log(`  ${icon}  ${type} ${describeViolation(v)}  ${severityTag}`);
-	}
-	if (hasBannedViolations) {
-		if (hasRuleViolations) console.log();
-		for (const v of bannedPackageViolations) {
-			const icon = v.severity === "error" ? chalk.red("✗") : chalk.yellow("⚠");
-			const tag = v.severity === "error" ? chalk.red("[BANNED]") : chalk.yellow("[RESTRICTED]");
-			const msg = v.message ? chalk.gray(` — ${v.message}`) : "";
-			console.log(`  ${icon}  ${tag} ${v.packageName}${msg}`);
-		}
+	if (hasRuleViolations) for (const v of ruleViolations) console.log(formatViolationLine({
+		icon: severityIcon(v.severity),
+		label: formatRuleType(v.type),
+		description: describeViolation(v)
+	}));
+	if (hasBannedViolations) for (const v of bannedPackageViolations) {
+		const msg = v.message ? chalk.gray(` — ${v.message}`) : "";
+		console.log(formatViolationLine({
+			icon: severityIcon(v.severity),
+			label: "forbid_packages",
+			description: `${v.packageName} is forbidden${msg}`
+		}));
 	}
 	const errorCount = [...ruleViolations.filter((v) => v.severity === "error"), ...bannedPackageViolations.filter((v) => v.severity === "error")].length;
 	const warnCount = [...ruleViolations.filter((v) => v.severity === "warn"), ...bannedPackageViolations.filter((v) => v.severity === "warn")].length;
@@ -417,11 +501,19 @@ const RuleConfigSchema = z.object({
 	message: z.string().optional()
 });
 const RuleConfigOrArraySchema = z.union([RuleConfigSchema, z.array(RuleConfigSchema)]);
+const PackageFieldRuleSchema = RuleConfigSchema.extend({ 
+/** Optional micromatch patterns the field's stringified value must match */
+values: z.array(z.string()).optional() });
+const PackageFieldRuleOrArraySchema = z.union([PackageFieldRuleSchema, z.array(PackageFieldRuleSchema)]);
 const EngineVersionRuleSchema = z.object({
 	severity: RuleSeveritySchema,
 	range: z.string(),
 	message: z.string().optional()
 });
+const CodeownersRuleSchema = z.object({
+	severity: RuleSeveritySchema,
+	message: z.string().optional()
+});
 const ThresholdSchema = z.union([z.number(), z.literal(false)]);
 const HermexConfigSchema = z.object({
 	includes: z.array(z.string()).default(["**/*.{tsx,jsx,ts,js}"]),
@@ -447,15 +539,18 @@ const HermexConfigSchema = z.object({
 		forbid_packages: RuleConfigOrArraySchema.default([]),
 		require_packages: RuleConfigOrArraySchema.default([]),
 		require_scripts: RuleConfigOrArraySchema.default([]),
-		require_package_fields: RuleConfigOrArraySchema.default([]),
-		engine_version: z.union([EngineVersionRuleSchema, z.array(EngineVersionRuleSchema)]).optional()
+		require_package_fields: PackageFieldRuleOrArraySchema.default([]),
+		forbid_package_fields: PackageFieldRuleOrArraySchema.default([]),
+		engine_version: z.union([EngineVersionRuleSchema, z.array(EngineVersionRuleSchema)]).optional(),
+		codeowners: CodeownersRuleSchema.optional()
 	}).default(() => ({
 		detect_files: [],
 		require_files: [],
 		forbid_packages: [],
 		require_packages: [],
 		require_scripts: [],
-		require_package_fields: []
+		require_package_fields: [],
+		forbid_package_fields: []
 	})),
 	output: z.object({
 		summary: z.union([z.literal("log"), z.literal(false)]).default("log"),
@@ -489,7 +584,9 @@ const HermexConfigSchema = z.object({
 			minor: 45,
 			major: 60
 		})),
-		enforceOn: z.array(z.string()).default([])
+		enforceOn: z.array(z.string()).default([]),
+		cacheTtlMs: z.number().int().positive().optional(),
+		cacheDisabled: z.boolean().default(false)
 	}).default(() => ({
 		enabled: false,
 		registry: "https://registry.npmjs.org",
@@ -498,7 +595,8 @@ const HermexConfigSchema = z.object({
 			minor: 45,
 			major: 60
 		},
-		enforceOn: []
+		enforceOn: [],
+		cacheDisabled: false
 	}))
 });
 //#endregion
@@ -864,10 +962,10 @@ function analyzeConditionalExpression(node, state) {
 */
 function analyzeArrayExpression(node, state) {
 	if (node.elements?.some((elem) => {
-		if (elem?.type === "Identifier") return state.componentNames.has(elem.value);
+		if (elem?.expression?.type === "Identifier") return state.componentNames.has(elem.expression.value);
 		return false;
 	})) state.usagePatterns.arrayMappings.add({
-		components: node.elements?.map((elem) => elem?.value).filter(Boolean),
+		components: node.elements?.map((elem) => elem?.expression?.value).filter(Boolean),
 		line: node.span?.start || 0
 	});
 }
@@ -893,11 +991,11 @@ function analyzeObjectExpression(node, state) {
 * Analyzes React.lazy() imports
 */
 function analyzeLazyImport(node, state) {
-	const arg = node.arguments?.[0];
+	const arg = node.arguments?.[0]?.expression;
 	if (arg?.type === "ArrowFunctionExpression" && arg.body?.type === "CallExpression") {
 		const importCall = arg.body;
 		if (importCall.callee?.type === "Import") {
-			const source = importCall.arguments?.[0]?.value;
+			const source = importCall.arguments?.[0]?.expression?.value;
 			if (source) state.usagePatterns.lazyImports.add({
 				source,
 				line: node.span?.start || 0
@@ -909,7 +1007,7 @@ function analyzeLazyImport(node, state) {
 * Analyzes dynamic import() calls
 */
 function analyzeDynamicImport(node, state) {
-	const source = node.arguments?.[0]?.value;
+	const source = node.arguments?.[0]?.expression?.value;
 	if (source) state.usagePatterns.dynamicImports.add({
 		source,
 		line: node.span?.start || 0
@@ -923,7 +1021,7 @@ function analyzeDynamicImport(node, state) {
 function analyzeHOCUsage(node, state) {
 	state.usagePatterns.hocUsage.add({
 		function: node.callee?.value || "[unknown]",
-		component: node.arguments?.[0]?.value || "[unknown]",
+		component: node.arguments?.[0]?.expression?.value || "[unknown]",
 		line: node.span?.start || 0
 	});
 }
@@ -931,7 +1029,7 @@ function analyzeHOCUsage(node, state) {
 * Analyzes React.memo() usage
 */
 function analyzeMemoUsage(node, state) {
-	const component = node.arguments?.[0];
+	const component = node.arguments?.[0]?.expression;
 	if (component?.type === "Identifier" && state.componentNames.has(component.value)) state.usagePatterns.memoizedComponents.add({
 		component: component.value,
 		line: node.span?.start || 0
@@ -962,7 +1060,7 @@ function analyzeMemberExpression(node, state) {
 * Checks if a node represents HOC pattern
 */
 function isHOCPattern(node, state) {
-	return node.callee?.type === "Identifier" && node.arguments?.some((arg) => arg.type === "Identifier" && state.componentNames.has(arg.value));
+	return node.callee?.type === "Identifier" && node.arguments?.some((arg) => arg.expression?.type === "Identifier" && state.componentNames.has(arg.expression.value));
 }
 //#endregion
 //#region src/swc-parser/core/visitor.ts
@@ -1069,8 +1167,9 @@ function visitChildren(node, state, context) {
 /**
 * Generates a comprehensive usage report from parser state
 */
-function generateReport(state) {
+function generateReport(state, filePath) {
 	return {
+		filePath,
 		summary: {
 			totalImports: state.usagePatterns.defaultImports.size + state.usagePatterns.namedImports.size + state.usagePatterns.namespaceImports.size,
 			totalComponents: state.componentNames.size,
@@ -1151,7 +1250,7 @@ function swcOptionsForFile(filePath) {
 function parseCode(code, filePath = "file.tsx") {
 	const state = createState();
 	visitNode(parseSync(code, swcOptionsForFile(filePath)), state);
-	return generateReport(state);
+	return generateReport(state, filePath);
 }
 function parseFile(filePath) {
 	return parseCode(fs.readFileSync(filePath, "utf8"), filePath);
@@ -1290,18 +1389,63 @@ function evaluateScriptRules(repoPath, rulesConfig) {
 }
 //#endregion
 //#region src/rules/package-field-rules.ts
+/** Resolves a dot-path like "engines.node" against the manifest object. */
+function getFieldAtPath(pkg, path) {
+	let current = pkg;
+	for (const key of path.split(".")) {
+		if (current === null || typeof current !== "object" || !(key in current)) return {
+			exists: false,
+			value: void 0
+		};
+		current = current[key];
+	}
+	return {
+		exists: true,
+		value: current
+	};
+}
+/** Primitives compare by string form; objects/arrays never match a value pattern. */
+function valueMatches(value, valuePatterns) {
+	if (value === null || typeof value === "object") return false;
+	return micromatch.isMatch(String(value), valuePatterns);
+}
 function evaluatePackageFieldRules(repoPath, rulesConfig) {
-	const rules = toArray(rulesConfig.require_package_fields);
-	if (rules.length === 0) return [];
+	const requireRules = toArray(rulesConfig.require_package_fields);
+	const forbidRules = toArray(rulesConfig.forbid_package_fields);
+	if (requireRules.length === 0 && forbidRules.length === 0) return [];
 	const pkg = readPackageJson(repoPath);
-	const fieldKeys = pkg ? Object.keys(pkg) : [];
-	return rules.filter((rule) => !rule.patterns.some((p) => fieldKeys.includes(p))).map((rule) => ({
-		type: "require_package_fields",
-		severity: rule.severity,
-		patterns: rule.patterns,
-		message: rule.message,
-		matchedFiles: []
-	}));
+	const violations = [];
+	for (const rule of requireRules) {
+		const lookups = rule.patterns.map((p) => ({
+			path: p,
+			...getFieldAtPath(pkg, p)
+		}));
+		if (!lookups.some((l) => l.exists && (!rule.values || valueMatches(l.value, rule.values)))) {
+			const mismatch = rule.values ? lookups.find((l) => l.exists) : void 0;
+			violations.push({
+				type: "require_package_fields",
+				severity: rule.severity,
+				patterns: rule.patterns,
+				message: rule.message,
+				matchedFiles: [],
+				fieldPath: mismatch?.path,
+				actualValue: mismatch && typeof mismatch.value !== "object" ? String(mismatch.value) : void 0
+			});
+		}
+	}
+	for (const rule of forbidRules) for (const pattern of rule.patterns) {
+		const lookup = getFieldAtPath(pkg, pattern);
+		if (lookup.exists && (!rule.values || valueMatches(lookup.value, rule.values))) violations.push({
+			type: "forbid_package_fields",
+			severity: rule.severity,
+			patterns: rule.patterns,
+			message: rule.message,
+			matchedFiles: [],
+			fieldPath: pattern,
+			actualValue: lookup.value !== null && typeof lookup.value !== "object" ? String(lookup.value) : void 0
+		});
+	}
+	return violations;
 }
 //#endregion
 //#region src/rules/engine-version.ts
@@ -1332,13 +1476,102 @@ function evaluateEngineVersion(repoPath, rulesConfig) {
 	});
 }
 //#endregion
+//#region src/rules/codeowners.ts
+const CODEOWNERS_LOCATIONS = [
+	".github/CODEOWNERS",
+	"CODEOWNERS",
+	"docs/CODEOWNERS"
+];
+/** First existing location, GitHub search order. Null if none exist. */
+function findCodeownersFile(repoPath) {
+	for (const location of CODEOWNERS_LOCATIONS) {
+		const full = path$1.join(repoPath, location);
+		if (fs$1.existsSync(full)) return full;
+	}
+	return null;
+}
+/** Parses content into entries; skips blank lines and # comments. */
+function parseCodeowners(content) {
+	const entries = [];
+	for (const rawLine of content.split(/\r?\n/)) {
+		const line = rawLine.trim();
+		if (!line || line.startsWith("#")) continue;
+		const tokens = line.split(/\s+/);
+		const pattern = tokens[0];
+		const owners = tokens.slice(1);
+		entries.push({
+			pattern,
+			globs: codeownersPatternToGlobs(pattern),
+			owners
+		});
+	}
+	return entries;
+}
+/**
+* Translates a CODEOWNERS (gitignore-style) pattern into micromatch glob(s).
+*
+* Rules:
+* - `*` alone matches everything.
+* - A leading `/`, or a `/` anywhere in the middle of the pattern, anchors
+*   the match to the repo root (the leading `/` is stripped once anchored).
+* - A pattern with no anchoring gets a `**\/` prefix so it matches at any depth.
+* - A trailing `/` restricts the match to a directory, so `/**` is appended.
+* - A bare name (no glob characters, no slash at all) also matches as a
+*   directory anywhere, so the `/**` directory variant is added alongside
+*   the plain match.
+*/
+function codeownersPatternToGlobs(pattern) {
+	if (pattern === "*") return ["**"];
+	let p = pattern;
+	const hadLeadingSlash = p.startsWith("/");
+	if (hadLeadingSlash) p = p.slice(1);
+	const hadTrailingSlash = p.endsWith("/") && p.length > 1;
+	if (hadTrailingSlash) p = p.slice(0, -1);
+	const hasInternalSlash = p.includes("/");
+	const anchored = hadLeadingSlash || hasInternalSlash;
+	const hasGlobChars = /[*?[\]{}!()]/.test(p);
+	const isBareName = !anchored && !hasGlobChars && !hadTrailingSlash;
+	const base = anchored ? p : `**/${p}`;
+	const globs = [hadTrailingSlash ? `${base}/**` : base];
+	if (isBareName) globs.push(`${base}/**`);
+	return globs;
+}
+/** Last matching entry wins; owned iff that entry has >= 1 owner. */
+function fileIsOwned(file, entries) {
+	for (let i = entries.length - 1; i >= 0; i--) if (micromatch.isMatch(file, entries[i].globs, { dot: true })) return entries[i].owners.length > 0;
+	return false;
+}
+function evaluateCodeowners(repoPath, rulesConfig, scannedFiles) {
+	const rule = rulesConfig.codeowners;
+	if (!rule) return [];
+	const filePath = findCodeownersFile(repoPath);
+	if (!filePath) return [{
+		type: "codeowners",
+		severity: rule.severity,
+		patterns: CODEOWNERS_LOCATIONS,
+		message: rule.message,
+		matchedFiles: []
+	}];
+	const entries = parseCodeowners(fs$1.readFileSync(filePath, "utf-8"));
+	const unowned = scannedFiles.map((f) => (path$1.isAbsolute(f) ? path$1.relative(repoPath, f) : f).replace(/\\/g, "/")).filter((f) => !fileIsOwned(f, entries));
+	if (unowned.length === 0) return [];
+	return [{
+		type: "codeowners",
+		severity: rule.severity,
+		patterns: [path$1.basename(filePath)],
+		message: rule.message,
+		matchedFiles: unowned
+	}];
+}
+//#endregion
 //#region src/rules/evaluator.ts
-function evaluateRules(repoPath, rulesConfig, excludes) {
+function evaluateRules(repoPath, rulesConfig, excludes, scannedFiles = []) {
 	return [
 		...evaluateFileRules(repoPath, rulesConfig, excludes),
 		...evaluateScriptRules(repoPath, rulesConfig),
 		...evaluatePackageFieldRules(repoPath, rulesConfig),
-		...evaluateEngineVersion(repoPath, rulesConfig)
+		...evaluateEngineVersion(repoPath, rulesConfig),
+		...evaluateCodeowners(repoPath, rulesConfig, scannedFiles)
 	];
 }
 //#endregion
@@ -1456,14 +1689,16 @@ function aggregateReports(reports, versions = {}, config, multiVersions = {}) {
 		for (const jsx of report.patterns.usage.jsx) {
 			const key = jsx.component;
 			const existing = componentUsageMap.get(key);
-			if (existing) existing.count++;
-			else {
+			if (existing) {
+				existing.count++;
+				existing.files.add(report.filePath);
+			} else {
 				const source = findComponentSource(jsx.component, report, availablePackages);
 				componentUsageMap.set(key, {
 					name: jsx.component,
 					source,
 					count: 1,
-					files: /* @__PURE__ */ new Set()
+					files: /* @__PURE__ */ new Set([report.filePath])
 				});
 			}
 		}
@@ -1498,14 +1733,15 @@ function aggregateReports(reports, versions = {}, config, multiVersions = {}) {
 }
 //#endregion
 //#region src/utils/print-errors.ts
-function printErrors(errors) {
+function printErrors(errors, isJson) {
 	if (errors.length === 0) return;
-	console.log(chalk.yellow(`\n⚠ ${errors.length} file(s) failed to parse:`));
+	const stream = isJson ? process.stderr : process.stdout;
+	stream.write(chalk.yellow(`\n⚠ ${errors.length} file(s) failed to parse:\n`));
 	for (const { file, message } of errors) {
-		console.log(chalk.yellow(`  ${file}`));
-		console.log(chalk.gray(`    ${message}`));
+		stream.write(chalk.yellow(`  ${file}\n`));
+		stream.write(chalk.gray(`    ${message}\n`));
 	}
-	console.log("");
+	stream.write("\n");
 }
 //#endregion
 //#region src/utils/file-utils.ts
@@ -1587,6 +1823,20 @@ var NpmLockfileAdapter = class {
 };
 //#endregion
 //#region src/lock-parser/patterns/pnpm.ts
+function parsePackageKey(rawKey) {
+	const withoutPeerSuffix = (rawKey.startsWith("/") ? rawKey.slice(1) : rawKey).replace(/\(.*\)$/, "");
+	const atMatch = withoutPeerSuffix.match(/^(.+)@(\d+\.\d+\.\d+[^/]*)$/);
+	if (atMatch) return {
+		name: atMatch[1],
+		version: atMatch[2]
+	};
+	const slashMatch = withoutPeerSuffix.match(/^(.+?)\/(\d+\.\d+\.\d+.*)$/);
+	if (slashMatch) return {
+		name: slashMatch[1],
+		version: slashMatch[2]
+	};
+	return null;
+}
 var PnpmLockfileAdapter = class {
 	name = "pnpm";
 	supportedVersions = [
@@ -1631,9 +1881,34 @@ var PnpmLockfileAdapter = class {
 			return {};
 		}
 	}
+	parseMultiVersion(lockFilePath) {
+		try {
+			const lockData = load(fs$1.readFileSync(lockFilePath, "utf8"));
+			const versionSets = {};
+			if (lockData.packages) Object.keys(lockData.packages).forEach((key) => {
+				const parsed = parsePackageKey(key);
+				if (!parsed) return;
+				if (!versionSets[parsed.name]) versionSets[parsed.name] = /* @__PURE__ */ new Set();
+				versionSets[parsed.name].add(parsed.version);
+			});
+			const result = {};
+			for (const [pkg, versions] of Object.entries(versionSets)) result[pkg] = Array.from(versions).sort();
+			return result;
+		} catch {
+			return {};
+		}
+	}
 };
 //#endregion
 //#region src/lock-parser/patterns/yarn.ts
+function extractPackageName(key) {
+	if (key.startsWith("@")) {
+		const match = key.match(/^(@[^@]+\/[^@]+)@/);
+		return match ? match[1] : key;
+	}
+	const match = key.match(/^([^@]+)@/);
+	return match ? match[1] : key;
+}
 var YarnLockfileAdapter = class {
 	name = "yarn";
 	supportedVersions = ["v1", "v2+"];
@@ -1651,15 +1926,8 @@ var YarnLockfileAdapter = class {
 			}
 			const versions = {};
 			Object.entries(parsed.object).forEach(([key, value]) => {
-				let pkgName = key;
-				if (key.startsWith("@")) {
-					const match = key.match(/^(@[^@]+\/[^@]+)@/);
-					if (match) pkgName = match[1];
-				} else {
-					const match = key.match(/^([^@]+)@/);
-					if (match) pkgName = match[1];
-				}
-				if (value.version && (!versions[pkgName] || value.version)) versions[pkgName] = value.version;
+				const pkgName = extractPackageName(key);
+				if (value.version && !versions[pkgName]) versions[pkgName] = value.version;
 			});
 			return versions;
 		} catch (error) {
@@ -1668,6 +1936,25 @@ var YarnLockfileAdapter = class {
 			return {};
 		}
 	}
+	parseMultiVersion(lockFilePath) {
+		try {
+			const content = fs$1.readFileSync(lockFilePath, "utf8");
+			const parsed = lockfile.parse(content);
+			if (parsed.type !== "success") return {};
+			const versionSets = {};
+			Object.entries(parsed.object).forEach(([key, value]) => {
+				if (!value.version) return;
+				const pkgName = extractPackageName(key);
+				if (!versionSets[pkgName]) versionSets[pkgName] = /* @__PURE__ */ new Set();
+				versionSets[pkgName].add(value.version);
+			});
+			const result = {};
+			for (const [pkg, vers] of Object.entries(versionSets)) result[pkg] = Array.from(vers).sort();
+			return result;
+		} catch {
+			return {};
+		}
+	}
 };
 //#endregion
 //#region src/lock-parser/index.ts
@@ -1724,6 +2011,53 @@ async function fetchPackageInfo(name, registryUrl, authToken) {
 	}
 }
 //#endregion
+//#region src/npm-registry/cache.ts
+const DEFAULT_TTL_MS = 3600 * 1e3;
+const DEFAULT_CACHE_DIR = join(homedir(), ".hermex", "cache", "npm");
+function cachePathFor(registryUrl, packageName, options) {
+	return join(options?.cacheDir ?? DEFAULT_CACHE_DIR, new URL(registryUrl).host.replace(/:/g, "_"), `${encodeURIComponent(packageName)}.json`);
+}
+async function readCache(registryUrl, packageName, options) {
+	const ttlMs = options?.ttlMs ?? DEFAULT_TTL_MS;
+	try {
+		const raw = await readFile(cachePathFor(registryUrl, packageName, options), "utf8");
+		const entry = JSON.parse(raw);
+		if (entry.registryUrl !== registryUrl || entry.packageName !== packageName) return null;
+		if (Date.now() - entry.cachedAt >= ttlMs) return null;
+		return entry.data;
+	} catch {
+		return null;
+	}
+}
+async function writeCache(registryUrl, packageName, data, options) {
+	const finalPath = cachePathFor(registryUrl, packageName, options);
+	const tmpPath = `${finalPath}.tmp-${randomUUID()}`;
+	try {
+		await mkdir(dirname(finalPath), { recursive: true });
+		await writeFile(tmpPath, JSON.stringify({
+			cachedAt: Date.now(),
+			registryUrl,
+			packageName,
+			data
+		}), "utf8");
+		await rename(tmpPath, finalPath);
+	} catch {
+		try {
+			await unlink(tmpPath);
+		} catch {}
+	}
+}
+async function getPackageInfo(packageName, registryUrl, authToken, options) {
+	const cacheEnabled = !authToken && !options?.disabled;
+	if (cacheEnabled) {
+		const cached = await readCache(registryUrl, packageName, options);
+		if (cached) return cached;
+	}
+	const info = await fetchPackageInfo(packageName, registryUrl, authToken);
+	if (info && cacheEnabled) await writeCache(registryUrl, packageName, info, options);
+	return info;
+}
+//#endregion
 //#region src/npm-registry/enricher.ts
 const CONCURRENCY = 8;
 function daysSince(dateStr) {
@@ -1738,6 +2072,9 @@ function classifyBump(installed, candidate) {
 	if (diff === "major" || diff === "premajor") return "major";
 	return null;
 }
+function pickNewest(versions) {
+	return versions.reduce((a, b) => a.daysAgo < b.daysAgo ? a : b);
+}
 function upgradeLevel(daysAgo, bump, thresholds) {
 	const threshold = thresholds[bump];
 	if (threshold === false || threshold === void 0) return null;
@@ -1751,6 +2088,7 @@ function computeReleaseAge(installedVersion, timeMap, deprecated, thresholds, di
 	for (const [version, dateStr] of Object.entries(timeMap)) {
 		if (version === "created" || version === "modified") continue;
 		if (!semver.valid(version)) continue;
+		if (semver.prerelease(version)) continue;
 		if (semver.lte(version, installedVersion)) continue;
 		const bump = classifyBump(installedVersion, version);
 		if (!bump) continue;
@@ -1761,8 +2099,8 @@ function computeReleaseAge(installedVersion, timeMap, deprecated, thresholds, di
 			daysAgo
 		});
 		byBump.set(bump, list);
-		const threshold = thresholds.patch;
-		if (bump === "patch" && threshold !== false && threshold !== void 0 && daysAgo <= threshold && (minCompliantReleasedDaysAgo === void 0 || daysAgo > minCompliantReleasedDaysAgo)) {
+		const threshold = thresholds[bump];
+		if (threshold !== false && threshold !== void 0 && daysAgo <= threshold && (minCompliantReleasedDaysAgo === void 0 || daysAgo > minCompliantReleasedDaysAgo)) {
 			minCompliantVersion = version;
 			minCompliantReleasedDaysAgo = daysAgo;
 		}
@@ -1771,12 +2109,13 @@ function computeReleaseAge(installedVersion, timeMap, deprecated, thresholds, di
 	for (const [bump, versions] of byBump.entries()) {
 		const level = upgradeLevel(Math.max(...versions.map((v) => v.daysAgo)), bump, thresholds);
 		if (!level) continue;
-		const newest = versions.reduce((a, b) => a.daysAgo < b.daysAgo ? a : b);
+		const newest = pickNewest(versions);
 		upgrades.push({
 			version: newest.version,
 			releasedDaysAgo: newest.daysAgo,
 			semverBump: bump,
-			level
+			level,
+			thresholdDays: thresholds[bump]
 		});
 	}
 	const finalUpgrades = upgrades.sort((a, b) => b.releasedDaysAgo - a.releasedDaysAgo);
@@ -1784,10 +2123,29 @@ function computeReleaseAge(installedVersion, timeMap, deprecated, thresholds, di
 	const latestEntry = latestVersion ? timeMap[latestVersion] : void 0;
 	const latestReleasedDaysAgo = latestEntry ? daysSince(latestEntry) : void 0;
 	for (const upgrade of finalUpgrades) if (latestVersion && upgrade.version === latestVersion) upgrade.isLatest = true;
+	const worstLevel = finalUpgrades.some((u) => u.level === "mandatory_upgrade") ? "mandatory_upgrade" : finalUpgrades.length > 0 ? "needs_upgrade" : null;
+	let pendingUpgrade;
+	if (worstLevel === null) for (const [bump, versions] of byBump.entries()) {
+		const threshold = thresholds[bump];
+		if (threshold === false || threshold === void 0) continue;
+		const daysRemaining = threshold - Math.max(...versions.map((v) => v.daysAgo));
+		if (daysRemaining <= 0) continue;
+		if (!pendingUpgrade || daysRemaining < pendingUpgrade.daysRemaining) {
+			const newest = pickNewest(versions);
+			pendingUpgrade = {
+				version: newest.version,
+				semverBump: bump,
+				releasedDaysAgo: newest.daysAgo,
+				thresholdDays: threshold,
+				daysRemaining
+			};
+		}
+	}
 	return {
 		installedVersion,
 		upgrades: finalUpgrades,
-		worstLevel: finalUpgrades.some((u) => u.level === "mandatory_upgrade") ? "mandatory_upgrade" : finalUpgrades.length > 0 ? "needs_upgrade" : null,
+		worstLevel,
+		pendingUpgrade,
 		deprecated,
 		latestVersion,
 		latestReleasedDaysAgo,
@@ -1802,10 +2160,15 @@ async function enrichWithReleaseAge(packages, config) {
 	const targets = packages.filter((p) => !p.internal && p.version);
 	const enriched = [...packages];
 	let skipped = 0;
+	const envTtl = Number(process.env["HERMEX_REGISTRY_CACHE_TTL_MS"]);
+	const cacheOptions = {
+		ttlMs: Number.isFinite(envTtl) && envTtl > 0 ? envTtl : config.cacheTtlMs,
+		disabled: process.env["HERMEX_REGISTRY_CACHE_DISABLED"] === "1" || config.cacheDisabled === true
+	};
 	for (let i = 0; i < targets.length; i += CONCURRENCY) {
 		const batch = targets.slice(i, i + CONCURRENCY);
 		const results = await Promise.all(batch.map(async (pkg) => {
-			const info = await fetchPackageInfo(pkg.packageName, registryUrl, authToken);
+			const info = await getPackageInfo(pkg.packageName, registryUrl, authToken, cacheOptions);
 			if (!info || !info.time) {
 				skipped++;
 				return {
@@ -1836,16 +2199,20 @@ async function enrichWithReleaseAge(packages, config) {
 }
 //#endregion
 //#region src/commands/pipeline.ts
+const DECLARATION_FILE_RE = /\.d\.(ts|mts|cts)$/;
+function isDeclarationFile(filePath) {
+	return DECLARATION_FILE_RE.test(filePath);
+}
 /**
 * Runs the shared parse → aggregate → rules → release-age pipeline used by
 * both `scan` and `comply`. Returns `null` if no files matched (the spinner
 * has already reported the failure); throws on unexpected errors.
 */
-async function runPipeline(config, spinner) {
+async function runPipeline(config, spinner, isJson) {
 	const lockfileResult = findAndParseLockfile(process.cwd());
 	spinner.succeed(chalk.blue(`📦 Found ${lockfileResult.lockfileType} lockfile (supports: ${lockfileResult.supportedVersions.join(", ")}) - ${Object.keys(lockfileResult.versions).length} packages`));
 	spinner.start("Finding files...");
-	const files = await findFiles(config.includes, config.excludes);
+	const files = (await findFiles(config.includes, config.excludes)).filter((f) => !isDeclarationFile(f));
 	if (files.length === 0) {
 		spinner.fail(chalk.red(`No files found matching includes: ${config.includes.join(", ")}`));
 		return null;
@@ -1869,9 +2236,9 @@ async function runPipeline(config, spinner) {
 		}
 	}
 	spinner.succeed(chalk.green(`Analysis complete! Analyzed ${reports.length}/${files.length} files`));
-	printErrors(parseErrors);
+	printErrors(parseErrors, isJson);
 	const aggregated = aggregateReports(reports, lockfileResult.versions, config, lockfileResult.multiVersions);
-	const evaluatorViolations = evaluateRules(process.cwd(), config.rules, config.excludes);
+	const evaluatorViolations = evaluateRules(process.cwd(), config.rules, config.excludes, files);
 	aggregated.ruleViolations = [...aggregated.ruleViolations, ...evaluatorViolations];
 	if (config.releaseAge.enabled) {
 		spinner.start("Fetching release age from registry...");
@@ -1882,29 +2249,48 @@ async function runPipeline(config, spinner) {
 	return aggregated;
 }
 //#endregion
+//#region src/commands/command-context.ts
+/**
+* Shared command preamble: routes human-readable chrome (version line,
+* spinner) to stderr when the command emits JSON on stdout.
+*/
+function createCommandContext(config, options = {}) {
+	applyColorLevel(resolveColorLevel({
+		colorFlag: options.color === false ? false : void 0,
+		noColorEnv: process.env["NO_COLOR"]
+	}));
+	const isJson = (options.format ?? config.output.format) === "json";
+	const stream = isJson ? process.stderr : process.stdout;
+	stream.write(chalk.gray(`hermex v${getVersion()}\n`));
+	return {
+		isJson,
+		spinner: ora({
+			text: "Parsing lockfile...",
+			stream
+		}).start()
+	};
+}
+//#endregion
 //#region src/commands/scan.ts
 function registerScanCommand(program) {
-	program.command("scan").description("Scan and analyze local files").option("--config <path>", "Path to hermex config file (overrides CWD discovery)").action(async (options) => {
-		await executeScan(await loadConfig(process.cwd(), options.config));
+	program.command("scan").description("Scan and analyze local files").option("--config <path>", "Path to hermex config file (overrides CWD discovery)").addOption(new Option("--format <format>", "Output format, overrides output.format in the config file").choices(["human", "json"])).option("--no-color", "Disable colored output (see also NO_COLOR env var)").action(async (options) => {
+		await executeScan(await loadConfig(process.cwd(), options.config), {
+			format: options.format,
+			color: options.color
+		});
 	});
 }
-async function executeScan(config) {
-	const isJson = config.output.format === "json";
-	(isJson ? process.stderr : process.stdout).write(chalk.gray(`hermex v${getVersion()}\n`));
-	const spinner = ora({
-		text: "Parsing lockfile...",
-		stream: isJson ? process.stderr : process.stdout
-	}).start();
+async function executeScan(config, contextOptions = {}) {
+	const { isJson, spinner } = createCommandContext(config, contextOptions);
 	try {
-		const aggregated = await runPipeline(config, spinner);
+		const aggregated = await runPipeline(config, spinner, isJson);
 		if (!aggregated) return;
 		if (isJson) printJson(aggregated);
 		else printScanResults(aggregated, config);
 	} catch (error) {
 		const message = error instanceof Error ? error.message : String(error);
 		spinner.fail(chalk.red("Analysis failed: " + message));
-		console.error(error);
-		process.exit(1);
+		process.exitCode = 1;
 	}
 }
 function printScanResults(aggregated, config) {
@@ -1918,21 +2304,19 @@ function printScanResults(aggregated, config) {
 }
 //#endregion
 //#region src/utils/print-compliance.ts
+/**
+* Prints only the bottom-line verdict — the Compliance and Packages sections
+* printed above this already itemize every violation (rule and release-age
+* alike), so repeating them here would just restate the same 🔴 rows.
+*/
 function printComplianceVerdict(result) {
 	const mandatoryCount = result.errorRuleViolations.length + result.errorBannedPackageViolations.length + result.mandatoryReleaseAgeViolations.length;
 	if (result.compliant) {
-		console.log(chalk.greenBright.bold("\n✓ COMPLIANT\n"));
+		console.log(chalk.greenBright.bold(`\n${severityIcon("success")} COMPLIANT\n`));
 		return;
 	}
-	console.log(chalk.redBright.bold(`\n✗ NOT COMPLIANT`));
+	console.log(chalk.redBright.bold(`\n${severityIcon("error")} NOT COMPLIANT`));
 	console.log(chalk.red(`  ${mandatoryCount} mandatory violation${mandatoryCount > 1 ? "s" : ""} found`));
-	if (result.mandatoryReleaseAgeViolations.length > 0) {
-		console.log();
-		for (const pkg of result.mandatoryReleaseAgeViolations) {
-			const top = pkg.releaseAge?.upgrades[0];
-			console.log(chalk.red(`  ✗  releaseAge     ${pkg.packageName} is ${top?.semverBump} version behind (${top?.releasedDaysAgo}d) — mandatory upgrade  [ERROR]`));
-		}
-	}
 	console.log();
 }
 //#endregion
@@ -1958,19 +2342,17 @@ function computeCompliance(aggregated) {
 //#endregion
 //#region src/commands/comply.ts
 function registerComplyCommand(program) {
-	program.command("comply").description("Check compliance with hermex.config.ts rules and release-age policy (exits non-zero if not compliant)").option("--config <path>", "Path to hermex config file (overrides CWD discovery)").action(async (options) => {
-		await executeComply(await loadConfig(process.cwd(), options.config));
+	program.command("comply").description("Check compliance with hermex.config.ts rules and release-age policy (exits non-zero if not compliant)").option("--config <path>", "Path to hermex config file (overrides CWD discovery)").addOption(new Option("--format <format>", "Output format, overrides output.format in the config file").choices(["human", "json"])).option("--no-color", "Disable colored output (see also NO_COLOR env var)").action(async (options) => {
+		await executeComply(await loadConfig(process.cwd(), options.config), {
+			format: options.format,
+			color: options.color
+		});
 	});
 }
-async function executeComply(config) {
-	const isJson = config.output.format === "json";
-	(isJson ? process.stderr : process.stdout).write(chalk.gray(`hermex v${getVersion()}\n`));
-	const spinner = ora({
-		text: "Parsing lockfile...",
-		stream: isJson ? process.stderr : process.stdout
-	}).start();
+async function executeComply(config, contextOptions = {}) {
+	const { isJson, spinner } = createCommandContext(config, contextOptions);
 	try {
-		const aggregated = await runPipeline(config, spinner);
+		const aggregated = await runPipeline(config, spinner, isJson);
 		if (!aggregated) {
 			process.exitCode = 2;
 			return;
@@ -1980,13 +2362,13 @@ async function executeComply(config) {
 		else {
 			printRules(aggregated);
 			if (config.releaseAge.enabled) printPackages(aggregated, "table");
+			if (config.output.versus) printVersus(aggregated);
 			printComplianceVerdict(compliance);
 		}
 		process.exitCode = compliance.compliant ? 0 : 1;
 	} catch (error) {
 		const message = error instanceof Error ? error.message : String(error);
 		spinner.fail(chalk.red("Compliance check failed: " + message));
-		console.error(error);
 		process.exitCode = 2;
 	}
 }