CLI command reference

Public npm 0.5.0 provides doctor, analyze, dependency-only governance check, and the eight-domain governance run, collect and assess. It requires Node.js 24+. The examples use pnpm 10.30.3 and @anhcodo13/lattice@0.5.0.

Command reference

Command	Behavior
--version	Print the CLI version.
doctor [path]	Print the running Node version and count supported source files. Fail if none are found.
init [path]	Create .nklattice.json with empty analysis overrides and policies. Refuse to overwrite an existing file.
analyze [path]	Scan source, evaluate rules, and write HTML and JSON reports.
analyze [path] --output DIR	Write the two report files to DIR.
governance check [path]	Check direct declarations and lockfile resolutions against the bundled policy.
governance check [path] --policy SOURCE	Read policy JSON from a local path or HTTPS URL.
governance check [path] --workspace-root DIR	Allow apps under [path] to use a lockfile in an ancestor up to DIR.
governance check [path] --expect-apps N	Require exactly N managed apps; fail on an invalid or different count.
governance check [path] --json	Print the result object as JSON.
governance run [path] --evidence FILE	Run the scanners and assessment in one process; write normalized evidence and reports. Use this for CI gates.
governance collect [path] --evidence FILE	Run npm/pnpm audit, ESLint, TypeScript, Vitest, Semgrep, Gitleaks and Playwright; write normalized evidence outside the scan root.
governance assess [path]	Assess inventory, dependency policy, architecture, advisories, quality, source security and compatibility; write assessment.json and report.html.
governance assess [path] --policy SOURCE --inventory FILE	Choose reviewed policy and inventory sources. Inventory must stay inside the scan root.
governance assess [path] --workspace-root DIR --expect-apps N	Permit a shared ancestor lockfile and add a count assertion.
governance assess [path] --evidence FILE	Read fresh evidence for the same policy, source inputs and checked-out commit. Required by the bundled source policy.
governance assess [path] --output DIR --json	Choose artifact directory and print the full assessment object.

Every [path] defaults to the current working directory. Relative paths, including --output, are resolved from the process working directory, not automatically from the analyzed project. If you run from the core checkout and analyze apps/web, the default report goes under apps/web/.nklattice-report.

Source discovery and analysis

The CLI checks for Node.js 24 or newer before running any command; on an older version it prints an error and exits 3. doctor also reports the running version. doctor and analyze scan .ts, .tsx, .js, .jsx, .mts, .mjs, .cts, and .cjs. They ignore node_modules, .git, .next, dist, coverage, and *.d.ts; symlinks are not followed.

pnpm dlx @anhcodo13/lattice@0.5.0 doctor examples/governance/apps/vite
pnpm dlx @anhcodo13/lattice@0.5.0 analyze examples/governance/apps/vite

The current Vite example includes a runnable app and tests. doctor and analyze inspect those source files; the resulting score is a local review aid, not a representative benchmark. See Reports for the generated files.

Dependency-only check output

pnpm dlx @anhcodo13/lattice@0.5.0 governance check examples/governance \
  --workspace-root examples/governance \
  --policy governance/policy.json --expect-apps 3

The sample passes with three applications checked. --expect-apps accepts a positive integer and exits 3 if discovery finds a different number. It cannot prove exact inventory coverage; use governance assess for that. A dependency mismatch prints app/package, minimum range, declared range, lockfile specifier, locked version and reason. --json includes the policy version, source and SHA-256 digest without suppressing the failing exit code.

For the full assessment, run pnpm dlx @anhcodo13/lattice@0.5.0 governance run examples/governance --policy governance/policy.json --expect-apps 3 --evidence /tmp/nklattice-governance-evidence.json. Read the eight domain statuses and evidence identity in .nklattice-governance/assessment.json; the adjacent HTML is a review view. collect and assess remain separate commands for local inspection, but a CI gate should use run to avoid rereading an editable intermediate artifact. See Project governance for scanner setup, inventory format and limits.

The default policy resolves relative to the built CLI. When checking a different repository, pass --policy explicitly if you need a reviewed policy file or URL.

Exit codes

Code	Meaning	Typical cause
0	Command completed.	assess passed all configured domains; analyze can still return 0 with exploratory findings.
7	Measured policy failure.	A dependency, architecture, security, quality or browser gate failed.
3	Incomplete evidence or command error.	Inventory mismatch, scanner outage, stale evidence, unresolved import, invalid policy or file access failure.

analyze has no built-in failing gate; governance assess applies the central architecture gates to CI.