@decantr/cli - npm Package Compare versions

Comparing version 3.6.2 to 3.7.0

dist/upgrade-4BUQAYBU.js

+import {
+  RegistryClient,
+  refreshDerivedFiles
+} from "./chunk-NDH3BDXY.js";
+
+// src/commands/upgrade.ts
+import { existsSync, readFileSync, writeFileSync } from "fs";
+import { join } from "path";
+import { isV4 } from "@decantr/essence-spec";
+var GREEN = "\x1B[32m";
+var YELLOW = "\x1B[33m";
+var RESET = "\x1B[0m";
+var DIM = "\x1B[2m";
+var CYAN = "\x1B[36m";
+async function cmdUpgrade(projectRoot = process.cwd(), options = {}) {
+  const essencePath = join(projectRoot, "decantr.essence.json");
+  if (!existsSync(essencePath)) {
+    console.error("No decantr.essence.json found. Run `decantr init` first.");
+    process.exitCode = 1;
+    return;
+  }
+  const essence = JSON.parse(readFileSync(essencePath, "utf-8"));
+  if (!isV4(essence)) {
+    console.error("Active workflows require Essence v4.0.0. Run `decantr migrate --to v4` first.");
+    process.exitCode = 1;
+    return;
+  }
+  const client = new RegistryClient({
+    cacheDir: join(projectRoot, ".decantr", "cache"),
+    projectRoot
+  });
+  console.log("Checking for updates...\n");
+  const upgrades = [];
+  const themeId = essence.dna.theme.id;
+  if (themeId) {
+    const theme = await client.fetchTheme(themeId);
+    if (theme) {
+      const latestVersion = theme.data.version;
+      if (latestVersion) {
+        const current = essence.dna.theme.version || "0.0.0";
+        if (latestVersion !== current) {
+          upgrades.push({
+            type: "theme",
+            id: themeId,
+            currentVersion: current,
+            latestVersion,
+            data: theme.data
+          });
+        }
+      }
+    }
+  }
+  if (upgrades.length === 0) {
+    console.log(`${GREEN}Everything is up to date.${RESET}`);
+    return;
+  }
+  console.log("Available upgrades:\n");
+  for (const u of upgrades) {
+    console.log(
+      `  ${u.type}/${u.id}: ${DIM}${u.currentVersion}${RESET} -> ${GREEN}${u.latestVersion}${RESET}`
+    );
+  }
+  if (!options.apply) {
+    console.log(`
+${YELLOW}Run with --apply to apply upgrades.${RESET}`);
+    return;
+  }
+  console.log(`
+${CYAN}Applying upgrades...${RESET}
+`);
+  let essenceModified = false;
+  for (const upgrade of upgrades) {
+    console.log(`  Updating ${upgrade.type}/${upgrade.id} to ${upgrade.latestVersion}...`);
+    switch (upgrade.type) {
+      case "theme": {
+        await client.fetchTheme(upgrade.id);
+        essence.dna.theme.version = upgrade.latestVersion;
+        essenceModified = true;
+        console.log(`    ${GREEN}Theme cache updated.${RESET}`);
+        break;
+      }
+      case "blueprint": {
+        await client.fetchBlueprint(upgrade.id);
+        essence.blueprintVersion = upgrade.latestVersion;
+        essenceModified = true;
+        console.log(`    ${GREEN}Blueprint cache updated.${RESET}`);
+        break;
+      }
+    }
+  }
+  if (essenceModified) {
+    writeFileSync(essencePath, JSON.stringify(essence, null, 2) + "\n");
+    console.log(`
+  ${GREEN}Essence file updated.${RESET}`);
+  }
+  console.log(`
+  Regenerating context files...`);
+  try {
+    const result = await refreshDerivedFiles(projectRoot, essence, client);
+    console.log(
+      `    ${GREEN}Updated ${result.contextFiles.length} context file(s) and ${result.cssFiles.length} CSS file(s).${RESET}`
+    );
+  } catch (e) {
+    console.log(
+      `    ${YELLOW}Warning: Could not regenerate context files: ${e.message}${RESET}`
+    );
+  }
+  console.log(`
+${GREEN}All upgrades applied.${RESET}`);
+}
+export {
+  cmdUpgrade
+};

dist/bin.js

 #!/usr/bin/env node
-import "./chunk-4HFBFQNN.js";
-import "./chunk-SIDKK73N.js";
+import "./chunk-O7N4CCWS.js";
+import "./chunk-NDH3BDXY.js";
 import "./chunk-56HUEUO3.js";
 import "./chunk-WAGVDMJV.js";
 import "./chunk-24JR4ZNG.js";

dist/index.js

@@ -1,5 +0,5 @@
-import "./chunk-4HFBFQNN.js";
-import "./chunk-SIDKK73N.js";
+import "./chunk-O7N4CCWS.js";
+import "./chunk-NDH3BDXY.js";
 import "./chunk-56HUEUO3.js";
 import "./chunk-WAGVDMJV.js";
 import "./chunk-24JR4ZNG.js";

package.json

 {
   "name": "@decantr/cli",
-  "version": "3.6.2",
+  "version": "3.7.0",
   "description": "Decantr CLI - adopt, verify, graph, and govern frontend codebases touched by AI agents",
@@ -54,5 +54,5 @@ "keywords": [
     "@decantr/essence-spec": "3.4.0",
+    "@decantr/registry": "3.4.0",
     "@decantr/telemetry": "3.4.0",
-    "@decantr/registry": "3.4.0",
-    "@decantr/verifier": "3.6.1"
+    "@decantr/verifier": "3.7.0"
   },
@@ -59,0 +59,0 @@ "scripts": {

README.md

@@ -22,7 +22,7 @@ # @decantr/cli
 Use `decantr setup` when you are unsure which path applies. It detects whether the repo is empty, already attached, or a Brownfield app and recommends the right entry path.
-Use `decantr scan` when you want a zero-commit Brownfield preview. It reads local files, detects framework/routes/styling/static-hosting/assistant-rule signals, previews typed Contract graph readiness in memory when a Decantr contract already exists, reports the contract capsule source-handle count and limit, prints a terminal report, and writes no `.decantr` files or report artifacts. Add `--json` when automation needs the `ScanReportV1` payload.
+Use `decantr scan` when you want a zero-commit Brownfield preview. It reads local files through the shared verifier discovery substrate, detects workspace/app scope, package manager, framework, language, route signals, taskable routes, component inventory confidence, styling/static-hosting/assistant-rule signals, previews typed Contract graph readiness in memory when a Decantr contract already exists, reports the contract capsule source-handle count and limit, prints a terminal report, and writes no `.decantr` files or report artifacts. Add `--json` when automation needs the `ScanReportV2` payload.
 Use `decantr new` for a greenfield workspace in a fresh directory. With a starter-kit blueprint or archetype it uses the runnable adapter and Decantr CSS; without certified vocabulary content it creates a contract-only workspace unless you explicitly pass `--adoption=decantr-css`.
 Use `decantr adopt` when you already have an app and want Decantr governance without adopting a blueprint. Brownfield attach is proposal-driven: Decantr inventories the app, writes an observed essence proposal, hydrates hosted execution packs when online, and only applies the contract when you explicitly accept or merge it.
 Use `decantr studio` after adoption when you want a local Control Room for routes, findings, evidence, authority, and next actions. Use `decantr connect cursor` when the opened workspace should get Cursor Agent MCP and project-rule activation; in monorepos use `decantr connect cursor --project apps/web` so the rule keeps the app scope. Use `decantr doctor` when the next step is unclear, `decantr task <route> "<intent>"` before asking an LLM to modify a route, `decantr verify` after the edit, `decantr resolve` when source and contract disagree, and `decantr ci` in required automation. If runtime source and Decantr context disagree, report the drift instead of guessing; in Brownfield the existing source is observed truth, accepted local law/style bridge is project authority where present, Essence V4 is the structural contract, and hosted packs stay advisory until mapped into local law. Use `decantr graph` when you want the Decantr 3 typed Contract graph, typed graph diff summary, manifest, content-addressed snapshot history, and cache-friendly contract capsule written under `.decantr/graph`; the capsule includes a bounded SourceArtifact path index so agents can discover valid file-impact handles without reading the full snapshot, and `--capsule-source-limit <count>` can tune that index for large repos. Add `--route /feed --task "improve loading" --json` when you want the exact task-ranked route-scoped subgraph an agent should inspect before editing, `--node cmp:button --impact --json` when you need the graph-shaped blast radius for a component, token, rule, finding, or source artifact, or `--file src/app/page.tsx --impact --json` when the agent knows the source file it is about to change. Route and impact ranking use deterministic weighted traversal plus local personalized PageRank and task boosts. Use `--snapshot-id <id>` to inspect a replayable history snapshot and `--compare-to <id> --include-diff-ops --json` to compare the selected/current graph against a prior snapshot. Use `decantr codify --from-audit --style-bridge` when you want project-owned UI patterns, optional `behavior_obligations`, local rules, and token/class bridge mappings such as button/card/shell/theme standards to appear in future task context and verification. Once accepted, that local law is the first Hybrid lane: the app still owns source and styling, but Decantr treats accepted local patterns, behavior obligations, rules, and style bridge mappings as project authority.
-In monorepos, app-scoped commands accept `--project <app-path>`. `setup` shows attach guidance before adoption and the day-two loop after adoption. Candidate discovery ranks product UI apps ahead of docs, Storybook, API, MCP helper, workbench, and package surfaces; `decantr workspace list --json` includes rank, category, score, and reason metadata so automation can explain why `apps/web`, `apps/remix`, or `apps/dashboard` was suggested first. Hosted pack hydration also follows the essence path: `decantr registry compile-packs apps/web/decantr.essence.json --write-context` writes into `apps/web/.decantr/context`. In contract-only/offline Brownfield, deferred hosted packs are optional context unless a present manifest references missing files.
+In monorepos, app-scoped commands accept `--project <app-path>`. `setup` shows attach guidance before adoption and the day-two loop after adoption. Candidate discovery ranks product UI apps ahead of docs, Storybook, API, MCP helper, workbench, and package surfaces; `decantr workspace list --json` includes rank, category, score, and reason metadata so automation can explain why `apps/web`, `apps/remix`, or `apps/dashboard` was suggested first. Once an app path is selected, scan/setup/adopt/doctor/task/verify/ci/connect preserve that app scope and inherit package-manager evidence from the workspace root, so a React app inside a pnpm Angular/React monorepo is reported as the React app, not the root or sibling app. Hosted pack hydration also follows the essence path: `decantr registry compile-packs apps/web/decantr.essence.json --write-context` writes into `apps/web/.decantr/context`. In contract-only/offline Brownfield, deferred hosted packs are optional context unless a present manifest references missing files.
 Use `decantr init`, `decantr analyze`, `decantr check`, and `decantr health` as advanced primitives when you need direct control over one step.
@@ -106,2 +106,3 @@
 - previews existing apps with read-only Brownfield scan reports
+- emits `scan-report.v2` JSON with discovery evidence, app scope, route signal/taskable route counts, component inventory confidence, and limitations
 - guides users through human workflow commands: setup, adopt, doctor, task, verify, ci, codify, and connect
@@ -108,0 +109,0 @@ - supports explicit workflow lanes: greenfield blueprint, greenfield contract-only, brownfield adoption, Hybrid local law, Hybrid style bridge, Hybrid Decantr CSS, and hybrid composition

dist/upgrade-WBFE6EN7.js

-import {
-  RegistryClient,
-  refreshDerivedFiles
-} from "./chunk-SIDKK73N.js";
-
-// src/commands/upgrade.ts
-import { existsSync, readFileSync, writeFileSync } from "fs";
-import { join } from "path";
-import { isV4 } from "@decantr/essence-spec";
-var GREEN = "\x1B[32m";
-var YELLOW = "\x1B[33m";
-var RESET = "\x1B[0m";
-var DIM = "\x1B[2m";
-var CYAN = "\x1B[36m";
-async function cmdUpgrade(projectRoot = process.cwd(), options = {}) {
-  const essencePath = join(projectRoot, "decantr.essence.json");
-  if (!existsSync(essencePath)) {
-    console.error("No decantr.essence.json found. Run `decantr init` first.");
-    process.exitCode = 1;
-    return;
-  }
-  const essence = JSON.parse(readFileSync(essencePath, "utf-8"));
-  if (!isV4(essence)) {
-    console.error("Active workflows require Essence v4.0.0. Run `decantr migrate --to v4` first.");
-    process.exitCode = 1;
-    return;
-  }
-  const client = new RegistryClient({
-    cacheDir: join(projectRoot, ".decantr", "cache"),
-    projectRoot
-  });
-  console.log("Checking for updates...\n");
-  const upgrades = [];
-  const themeId = essence.dna.theme.id;
-  if (themeId) {
-    const theme = await client.fetchTheme(themeId);
-    if (theme) {
-      const latestVersion = theme.data.version;
-      if (latestVersion) {
-        const current = essence.dna.theme.version || "0.0.0";
-        if (latestVersion !== current) {
-          upgrades.push({
-            type: "theme",
-            id: themeId,
-            currentVersion: current,
-            latestVersion,
-            data: theme.data
-          });
-        }
-      }
-    }
-  }
-  if (upgrades.length === 0) {
-    console.log(`${GREEN}Everything is up to date.${RESET}`);
-    return;
-  }
-  console.log("Available upgrades:\n");
-  for (const u of upgrades) {
-    console.log(
-      `  ${u.type}/${u.id}: ${DIM}${u.currentVersion}${RESET} -> ${GREEN}${u.latestVersion}${RESET}`
-    );
-  }
-  if (!options.apply) {
-    console.log(`
-${YELLOW}Run with --apply to apply upgrades.${RESET}`);
-    return;
-  }
-  console.log(`
-${CYAN}Applying upgrades...${RESET}
-`);
-  let essenceModified = false;
-  for (const upgrade of upgrades) {
-    console.log(`  Updating ${upgrade.type}/${upgrade.id} to ${upgrade.latestVersion}...`);
-    switch (upgrade.type) {
-      case "theme": {
-        await client.fetchTheme(upgrade.id);
-        essence.dna.theme.version = upgrade.latestVersion;
-        essenceModified = true;
-        console.log(`    ${GREEN}Theme cache updated.${RESET}`);
-        break;
-      }
-      case "blueprint": {
-        await client.fetchBlueprint(upgrade.id);
-        essence.blueprintVersion = upgrade.latestVersion;
-        essenceModified = true;
-        console.log(`    ${GREEN}Blueprint cache updated.${RESET}`);
-        break;
-      }
-    }
-  }
-  if (essenceModified) {
-    writeFileSync(essencePath, JSON.stringify(essence, null, 2) + "\n");
-    console.log(`
-  ${GREEN}Essence file updated.${RESET}`);
-  }
-  console.log(`
-  Regenerating context files...`);
-  try {
-    const result = await refreshDerivedFiles(projectRoot, essence, client);
-    console.log(
-      `    ${GREEN}Updated ${result.contextFiles.length} context file(s) and ${result.cssFiles.length} CSS file(s).${RESET}`
-    );
-  } catch (e) {
-    console.log(
-      `    ${YELLOW}Warning: Could not regenerate context files: ${e.message}${RESET}`
-    );
-  }
-  console.log(`
-${GREEN}All upgrades applied.${RESET}`);
-}
-export {
-  cmdUpgrade
-};

New alerts

Major refactor

Supply chain risk

Package has recently undergone a major refactor. It may be unstable or indicate significant internal changes. Use caution when updating to versions that include significant changes.

Filesystem access

Supply chain risk

Accesses the file system, and could potentially read sensitive data.

AI-detected potential code anomaly

Supply chain risk

AI has identified unusual behaviors that may pose a security risk.

Found 2 instances

URL strings

Supply chain risk

Package contains fragments of external URLs or IP addresses, which the package may be accessing at runtime.

Fixed alerts

Filesystem access

Supply chain risk

Accesses the file system, and could potentially read sensitive data.

AI-detected potential code anomaly

Supply chain risk

AI has identified unusual behaviors that may pose a security risk.

URL strings

Supply chain risk

Package contains fragments of external URLs or IP addresses, which the package may be accessing at runtime.

Improved metrics

Number of lines in readme file

392

0.26%

Worsened metrics

Total package byte prevSize

1287412

-0.33%

Lines of code

30596

-0.41%

Number of low supply chain risk alerts

97

1.04%

Number of medium supply chain risk alerts

9

12.5%

Dependency changes

• + Added

  @decantr/verifier@3.7.0
  (transitive)

• - Removed

  @decantr/verifier@3.6.1
  (transitive)

• Updated

  @decantr/verifier@3.7.0