@dailephd/my-dev-kit-lab 0.2.1 → 0.3.0

package/dist/src/audits/core/projectInventory.js

@@ -0,0 +1,308 @@
+import fs from "node:fs";
+import path from "node:path";
+import { relativeWithinRoot } from "../../core/pathSafety.js";
+// ---------------------------------------------------------------------------
+// v0.3.0 Batch 2 — deterministic project inventory scanner.
+//
+// Pure data collection: this module classifies files and produces counts. It
+// deliberately never returns an AuditIssue -- that begins in a later
+// detector batch. Reused pattern from src/core/pathSafety.ts for path
+// normalization/containment (relativeWithinRoot already forward-slash
+// normalizes, matching the "path separators normalize consistently"
+// requirement), but this scanner is its own walker rather than reusing
+// src/core/fileGlobs.ts's private walkFiles(), because inventory needs a
+// different, broader exclusion set (notably "reports", which fileGlobs.ts's
+// scanner does not exclude) and a wider default surface (docs, tests, CI,
+// package, config -- not just src/scripts).
+// ---------------------------------------------------------------------------
+export const INVENTORY_FILE_CATEGORIES = [
+    "source",
+    "tests",
+    "docs",
+    "package",
+    "config",
+    "scripts",
+    "ci",
+    "generated",
+    "report",
+    "unknown",
+];
+// Directory names excluded from traversal entirely -- never descended into.
+const EXCLUDED_DIR_NAMES = new Set([
+    "node_modules",
+    ".git",
+    "dist",
+    "build",
+    "coverage",
+    "reports",
+    "lab-output",
+    ".my-dev-kit",
+    ".my-dev-kit-v1",
+    ".my-dev-kit-lab",
+    "__pycache__",
+    ".idea",
+    ".vscode",
+    // Vitest's own local cache directory (gitignored) -- generated tool
+    // output, same category as coverage/.
+    ".vitest",
+]);
+// OS/editor noise filenames, mirroring .gitignore's own conventions.
+const EXCLUDED_FILE_NAMES = new Set([".DS_Store", "Thumbs.db", "desktop.ini"]);
+function isNoiseFile(basename) {
+    return EXCLUDED_FILE_NAMES.has(basename) || basename.endsWith(".swp") || basename.endsWith("~");
+}
+// Known package/manifest filenames -> "package" category.
+const PACKAGE_FILE_NAMES = new Set([
+    "package.json",
+    "package-lock.json",
+    "yarn.lock",
+    "pnpm-lock.yaml",
+    "npm-shrinkwrap.json",
+    "LICENSE",
+    ".npmrc",
+]);
+// Known binary/media extensions -- never read for content (line count, etc).
+const BINARY_EXTENSIONS = new Set([
+    ".png",
+    ".jpg",
+    ".jpeg",
+    ".gif",
+    ".ico",
+    ".pdf",
+    ".zip",
+    ".tgz",
+    ".tar",
+    ".gz",
+    ".woff",
+    ".woff2",
+    ".ttf",
+    ".eot",
+    ".exe",
+    ".dll",
+    ".so",
+    ".dylib",
+    ".wasm",
+    ".db",
+    ".sqlite",
+]);
+const KNOWN_SOURCE_EXTENSIONS = new Set([
+    ".ts",
+    ".tsx",
+    ".js",
+    ".jsx",
+    ".mjs",
+    ".cjs",
+    ".py",
+    ".go",
+    ".rs",
+    ".java",
+]);
+// A file this large or larger is skipped entirely (not even stat'd into the
+// inventory) -- protects against pathological huge-file scan cost.
+const DEFAULT_HARD_SKIP_FILE_BYTES = 20_000_000;
+// A file this large or larger is still inventoried (category, size, etc.)
+// but never read for line-count -- keeps content reads bounded.
+const DEFAULT_MAX_FILE_BYTES_FOR_LINE_COUNT = 500_000;
+// Bytes read (at most) when sniffing for a NUL byte to detect binary content
+// for files without a known binary extension.
+const BINARY_SNIFF_BYTES = 512;
+export function scanProjectInventory(targetRoot, options = {}) {
+    const resolvedRoot = path.resolve(targetRoot);
+    const hardSkipFileBytes = options.hardSkipFileBytes ?? DEFAULT_HARD_SKIP_FILE_BYTES;
+    const maxFileBytesForLineCount = options.maxFileBytesForLineCount ?? DEFAULT_MAX_FILE_BYTES_FOR_LINE_COUNT;
+    const warnings = [];
+    const excludedDirCounts = new Map();
+    const files = [];
+    let totalFileCount = 0;
+    let skippedFileCount = 0;
+    let oversizedSkipCount = 0;
+    walk(resolvedRoot);
+    files.sort((a, b) => a.relativePath.localeCompare(b.relativePath));
+    if (oversizedSkipCount > 0) {
+        warnings.push(`Skipped ${oversizedSkipCount} oversized file(s) (>= ${hardSkipFileBytes} bytes): possible generated bundle or binary artifact.`);
+    }
+    const filesByCategory = countByCategory(files);
+    const filesByExtension = countByExtension(files);
+    const excludedDirectorySummary = [...excludedDirCounts.entries()]
+        .map(([name, occurrences]) => ({ name, occurrences }))
+        .sort((a, b) => a.name.localeCompare(b.name));
+    return {
+        targetRoot: resolvedRoot,
+        scanRoot: resolvedRoot,
+        totalFileCount,
+        totalScannedFileCount: files.length,
+        skippedFileCount,
+        filesByCategory,
+        filesByExtension,
+        packageFiles: files.filter((f) => f.category === "package"),
+        docsFiles: files.filter((f) => f.category === "docs"),
+        sourceFiles: files.filter((f) => f.category === "source"),
+        testFiles: files.filter((f) => f.category === "tests"),
+        scriptFiles: files.filter((f) => f.category === "scripts"),
+        ciFiles: files.filter((f) => f.category === "ci"),
+        excludedDirectorySummary,
+        warnings,
+        files,
+    };
+    function walk(dir) {
+        let entries;
+        try {
+            entries = fs.readdirSync(dir, { withFileTypes: true });
+        }
+        catch (err) {
+            warnings.push(`Could not read directory: ${dir} (${err instanceof Error ? err.message : String(err)})`);
+            return;
+        }
+        // Sort entries so traversal order (and therefore file discovery order
+        // before the final sort-by-relativePath) is stable across platforms
+        // regardless of the OS's own readdir ordering.
+        const sorted = [...entries].sort((a, b) => a.name.localeCompare(b.name));
+        for (const entry of sorted) {
+            const fullPath = path.join(dir, entry.name);
+            if (entry.isDirectory()) {
+                if (EXCLUDED_DIR_NAMES.has(entry.name)) {
+                    excludedDirCounts.set(entry.name, (excludedDirCounts.get(entry.name) ?? 0) + 1);
+                    continue;
+                }
+                walk(fullPath);
+                continue;
+            }
+            if (!entry.isFile()) {
+                // Skip symlinks and other special entries -- not part of Batch 2 scope.
+                continue;
+            }
+            if (isNoiseFile(entry.name)) {
+                continue;
+            }
+            totalFileCount += 1;
+            let stat;
+            try {
+                stat = fs.statSync(fullPath);
+            }
+            catch (err) {
+                skippedFileCount += 1;
+                warnings.push(`Could not stat file: ${fullPath} (${err instanceof Error ? err.message : String(err)})`);
+                continue;
+            }
+            if (stat.size >= hardSkipFileBytes) {
+                skippedFileCount += 1;
+                oversizedSkipCount += 1;
+                continue;
+            }
+            const relativePath = relativeWithinRoot(resolvedRoot, fullPath);
+            const extension = path.extname(entry.name).toLowerCase();
+            const category = classifyFile(relativePath, entry.name, extension);
+            const entryResult = {
+                relativePath,
+                normalizedPath: relativePath.toLowerCase(),
+                extension,
+                category,
+                sizeBytes: stat.size,
+                likelyGenerated: category === "generated" || category === "report",
+                likelyConfig: category === "config" || category === "package",
+                likelyDocs: category === "docs",
+                likelyTest: category === "tests",
+                likelySource: category === "source" || category === "scripts",
+            };
+            if (!BINARY_EXTENSIONS.has(extension) && stat.size <= maxFileBytesForLineCount) {
+                const lineCount = tryCountLines(fullPath, warnings);
+                if (lineCount !== undefined) {
+                    entryResult.lineCount = lineCount;
+                }
+            }
+            files.push(entryResult);
+        }
+    }
+}
+function classifyFile(relativePath, basename, extension) {
+    if (PACKAGE_FILE_NAMES.has(basename))
+        return "package";
+    if (relativePath.startsWith(".github/workflows/") && (extension === ".yml" || extension === ".yaml")) {
+        return "ci";
+    }
+    if (isTestFile(relativePath, basename))
+        return "tests";
+    // Top-level scripts/ directory -- classified before generic "source" so
+    // scripts (which are also .ts/.js) land in their own category.
+    if (relativePath.startsWith("scripts/"))
+        return "scripts";
+    if (extension === ".md" || extension === ".mdx" || relativePath.startsWith("docs/"))
+        return "docs";
+    if (isConfigFile(relativePath, basename, extension))
+        return "config";
+    if (isStrayReportFile(basename))
+        return "report";
+    if (extension === ".map")
+        return "generated";
+    if (KNOWN_SOURCE_EXTENSIONS.has(extension))
+        return "source";
+    return "unknown";
+}
+function isTestFile(relativePath, basename) {
+    if (relativePath.startsWith("tests/") || relativePath.includes("/tests/"))
+        return true;
+    return /\.(test|spec)\.[jt]sx?$/.test(basename);
+}
+function isConfigFile(relativePath, basename, extension) {
+    if (/^tsconfig(\..+)?\.json$/.test(basename))
+        return true;
+    if (/^vitest\.config\.[jt]s$/.test(basename) || basename === "vitest.workspace.ts")
+        return true;
+    if (/^\.eslintrc(\..+)?$/.test(basename) || /^eslint\.config\.[jt]s$/.test(basename))
+        return true;
+    if (basename === ".editorconfig" || basename === ".gitignore" || basename === ".npmignore")
+        return true;
+    // Root-level dotfile configs (e.g. .prettierrc, .babelrc) not already
+    // covered above -- deliberately conservative (root-only, not recursive)
+    // to avoid misclassifying dotfiles inside fixture/benchmark projects.
+    if (!relativePath.includes("/") && basename.startsWith("."))
+        return true;
+    if (extension === ".json" && basename.toLowerCase().includes("config"))
+        return true;
+    return false;
+}
+function isStrayReportFile(basename) {
+    return /-security-validation\.(txt|json)$/.test(basename) || /-audit\.(txt|json)$/.test(basename);
+}
+function tryCountLines(fullPath, warnings) {
+    let buffer;
+    try {
+        buffer = fs.readFileSync(fullPath);
+    }
+    catch (err) {
+        warnings.push(`Could not read file for line count: ${fullPath} (${err instanceof Error ? err.message : String(err)})`);
+        return undefined;
+    }
+    const sniffLength = Math.min(buffer.length, BINARY_SNIFF_BYTES);
+    for (let i = 0; i < sniffLength; i++) {
+        if (buffer[i] === 0) {
+            // NUL byte present -- treat as binary, skip line counting.
+            return undefined;
+        }
+    }
+    if (buffer.length === 0)
+        return 0;
+    const text = buffer.toString("utf8");
+    let lines = 1;
+    for (let i = 0; i < text.length; i++) {
+        if (text[i] === "\n")
+            lines += 1;
+    }
+    return lines;
+}
+function countByCategory(files) {
+    const counts = Object.fromEntries(INVENTORY_FILE_CATEGORIES.map((c) => [c, 0]));
+    for (const file of files) {
+        counts[file.category] += 1;
+    }
+    return counts;
+}
+function countByExtension(files) {
+    const counts = new Map();
+    for (const file of files) {
+        const key = file.extension || "(none)";
+        counts.set(key, (counts.get(key) ?? 0) + 1);
+    }
+    const sortedEntries = [...counts.entries()].sort(([a], [b]) => a.localeCompare(b));
+    return Object.fromEntries(sortedEntries);
+}

package/dist/src/audits/core/sourceOfTruth.js

@@ -0,0 +1,339 @@
+import fs from "node:fs";
+import path from "node:path";
+import { splitLines } from "./textLines.js";
+// ---------------------------------------------------------------------------
+// v0.3.0 Batch 2 — source-of-truth collector.
+//
+// Reads package.json/package-lock.json/docs/CI-workflow/config *facts* only.
+// Never executes a command, never calls security:validate or an experiment
+// command, and never produces an AuditIssue -- this is data collection for
+// later detector batches to consume, same spirit as projectInventory.ts.
+// Reuses the already-computed ProjectInventorySnapshot for file discovery
+// (docs/ci/test file lists) rather than re-walking the filesystem.
+// ---------------------------------------------------------------------------
+export const SCRIPT_GROUPS = ["build", "test", "security", "experiment", "audit", "docs", "release", "other"];
+const MAX_DOCS_READ_BYTES = 200_000;
+const MAX_CI_READ_BYTES = 100_000;
+export function collectSourceOfTruth(targetRoot, inventory) {
+    const resolvedRoot = path.resolve(targetRoot);
+    const warnings = [];
+    const pkg = readPackageTruth(resolvedRoot, warnings);
+    const lockfile = readLockfileTruth(resolvedRoot, pkg, warnings);
+    const commands = classifyCommands(pkg);
+    const docs = readDocsTruth(resolvedRoot, inventory, warnings);
+    const ci = readCiTruth(resolvedRoot, inventory, warnings);
+    const buildTooling = readBuildToolingTruth(inventory, pkg);
+    const tests = readTestTruth(inventory);
+    const security = readSecurityTruth(resolvedRoot, pkg);
+    const experiment = readExperimentTruth(resolvedRoot, pkg);
+    return {
+        targetRoot: resolvedRoot,
+        package: pkg,
+        lockfile,
+        commands,
+        docs,
+        ci,
+        buildTooling,
+        tests,
+        security,
+        experiment,
+        warnings,
+    };
+}
+function readPackageTruth(targetRoot, warnings) {
+    const pkgPath = path.join(targetRoot, "package.json");
+    let raw;
+    try {
+        raw = JSON.parse(fs.readFileSync(pkgPath, "utf8"));
+    }
+    catch {
+        return null;
+    }
+    try {
+        return {
+            name: typeof raw.name === "string" ? raw.name : null,
+            version: typeof raw.version === "string" ? raw.version : null,
+            description: typeof raw.description === "string" ? raw.description : null,
+            bin: isRecordOfStrings(raw.bin) || typeof raw.bin === "string" ? raw.bin : null,
+            main: typeof raw.main === "string" ? raw.main : null,
+            module: typeof raw.module === "string" ? raw.module : null,
+            types: typeof raw.types === "string" ? raw.types : typeof raw.typings === "string" ? raw.typings : null,
+            scripts: isRecordOfStrings(raw.scripts) ? raw.scripts : {},
+            dependencies: isRecordOfStrings(raw.dependencies) ? raw.dependencies : {},
+            devDependencies: isRecordOfStrings(raw.devDependencies) ? raw.devDependencies : {},
+            peerDependencies: isRecordOfStrings(raw.peerDependencies) ? raw.peerDependencies : null,
+            engines: isRecordOfStrings(raw.engines) ? raw.engines : null,
+            files: Array.isArray(raw.files) ? raw.files.filter((f) => typeof f === "string") : null,
+            packageManagerHint: typeof raw.packageManager === "string" ? raw.packageManager : null,
+        };
+    }
+    catch (err) {
+        warnings.push(`Could not fully parse package.json fields: ${err instanceof Error ? err.message : String(err)}`);
+        return null;
+    }
+}
+function isRecordOfStrings(value) {
+    if (typeof value !== "object" || value === null || Array.isArray(value))
+        return false;
+    return Object.values(value).every((v) => typeof v === "string");
+}
+function readLockfileTruth(targetRoot, pkg, warnings) {
+    const lockPath = path.join(targetRoot, "package-lock.json");
+    let raw;
+    try {
+        raw = JSON.parse(fs.readFileSync(lockPath, "utf8"));
+    }
+    catch {
+        return { present: false, rootName: null, rootVersion: null, lockfileVersion: null, packageManagerConsistent: null };
+    }
+    try {
+        const rootPackageEntry = raw.packages?.[""];
+        const rootName = typeof raw.name === "string" ? raw.name : typeof rootPackageEntry?.name === "string" ? rootPackageEntry.name : null;
+        const rootVersion = typeof raw.version === "string" ? raw.version : typeof rootPackageEntry?.version === "string" ? rootPackageEntry.version : null;
+        const lockfileVersion = typeof raw.lockfileVersion === "number" ? raw.lockfileVersion : null;
+        const packageManagerConsistent = pkg?.name != null && rootName != null ? pkg.name === rootName && pkg.version === rootVersion : null;
+        return { present: true, rootName, rootVersion, lockfileVersion, packageManagerConsistent };
+    }
+    catch (err) {
+        warnings.push(`Could not fully parse package-lock.json fields: ${err instanceof Error ? err.message : String(err)}`);
+        return { present: true, rootName: null, rootVersion: null, lockfileVersion: null, packageManagerConsistent: null };
+    }
+}
+// ---------------------------------------------------------------------------
+// Command/script truth
+// ---------------------------------------------------------------------------
+function classifyScriptGroup(scriptName) {
+    const name = scriptName.toLowerCase();
+    if (name.startsWith("security") || name === "test:security" || name.startsWith("test:fuzz"))
+        return "security";
+    if (name.startsWith("experiment"))
+        return "experiment";
+    if (name === "audit" || name.startsWith("audit:"))
+        return "audit";
+    if (name === "test" || name.startsWith("test:"))
+        return "test";
+    if (name === "build" || name === "typecheck" || name === "clean" || name.includes("build"))
+        return "build";
+    if (name.includes("doc"))
+        return "docs";
+    if (name.includes("release") || name.includes("publish") || name.includes("pack") || name.includes("version")) {
+        return "release";
+    }
+    return "other";
+}
+function classifyCommands(pkg) {
+    const scriptsByGroup = Object.fromEntries(SCRIPT_GROUPS.map((g) => [g, []]));
+    if (!pkg) {
+        return { scriptsByGroup, allScriptNames: [] };
+    }
+    const allScriptNames = Object.keys(pkg.scripts).sort((a, b) => a.localeCompare(b));
+    for (const name of allScriptNames) {
+        scriptsByGroup[classifyScriptGroup(name)].push(name);
+    }
+    return { scriptsByGroup, allScriptNames };
+}
+// ---------------------------------------------------------------------------
+// Docs truth
+// ---------------------------------------------------------------------------
+function readDocsTruth(targetRoot, inventory, warnings) {
+    const files = [];
+    let hasReadme = false;
+    let hasChangelog = false;
+    for (const entry of inventory.docsFiles) {
+        const basename = path.basename(entry.relativePath).toLowerCase();
+        if (basename === "readme.md")
+            hasReadme = true;
+        if (basename === "changelog.md")
+            hasChangelog = true;
+        const fullPath = path.join(targetRoot, entry.relativePath);
+        let content = "";
+        try {
+            if (entry.sizeBytes <= MAX_DOCS_READ_BYTES) {
+                content = fs.readFileSync(fullPath, "utf8");
+            }
+        }
+        catch (err) {
+            warnings.push(`Could not read docs file: ${entry.relativePath} (${err instanceof Error ? err.message : String(err)})`);
+        }
+        const titleMatch = content.match(/^#\s+(.+)$/m);
+        files.push({
+            relativePath: entry.relativePath,
+            title: titleMatch ? titleMatch[1].trim() : null,
+            mentionsAudit: /\baudit\b/i.test(content),
+            mentionsSecurityValidation: /security[- ]?valid|security:validate/i.test(content),
+            mentionsExperiments: /\bexperiment/i.test(content),
+            mentionsReleasePublish: /\b(release|publish|npm publish)\b/i.test(content),
+            mentionsPlannedCommands: /\bplanned\b/i.test(content),
+            mentionsCurrentCommands: /\bcurrent\b/i.test(content),
+        });
+    }
+    files.sort((a, b) => a.relativePath.localeCompare(b.relativePath));
+    return { files, hasReadme, hasChangelog };
+}
+// ---------------------------------------------------------------------------
+// CI/workflow truth
+// ---------------------------------------------------------------------------
+function readCiTruth(targetRoot, inventory, warnings) {
+    const workflows = [];
+    for (const entry of inventory.ciFiles) {
+        const fullPath = path.join(targetRoot, entry.relativePath);
+        let content = "";
+        try {
+            if (entry.sizeBytes <= MAX_CI_READ_BYTES) {
+                content = fs.readFileSync(fullPath, "utf8");
+            }
+        }
+        catch (err) {
+            warnings.push(`Could not read workflow file: ${entry.relativePath} (${err instanceof Error ? err.message : String(err)})`);
+        }
+        workflows.push({
+            relativePath: entry.relativePath,
+            name: parseWorkflowName(content),
+            nodeVersionsReferenced: parseNodeVersions(content),
+            packageManagerCommandsReferenced: parsePackageManagerCommands(content),
+            npmScriptsReferenced: parseNpmScriptsReferenced(content),
+        });
+    }
+    workflows.sort((a, b) => a.relativePath.localeCompare(b.relativePath));
+    return { workflows };
+}
+function parseWorkflowName(content) {
+    const match = content.match(/^name:\s*(.+)$/m);
+    return match ? match[1].trim() : null;
+}
+function parseNodeVersions(content) {
+    const versions = new Set();
+    // Inline form: node-version: 20
+    for (const match of content.matchAll(/node-version:\s*["']?([\w.]+)["']?\s*$/gm)) {
+        versions.add(match[1]);
+    }
+    // List form:
+    //   node-version:
+    //     - 20
+    //     - 22
+    // v0.3.0 Batch 6 — use the canonical splitLines() helper instead of a raw
+    // string split on a newline character, so CRLF-authored workflow files
+    // (trailing carriage-return on every line) don't silently break the
+    // list-item regex below (see src/audits/core/textLines.ts's header
+    // comment). A bare split here is also exactly what
+    // crossPlatformRotDetector.ts's raw-split-detection check flags in any
+    // other src/audits/ file.
+    const lines = splitLines(content);
+    for (let i = 0; i < lines.length; i++) {
+        if (/node-version:\s*$/.test(lines[i])) {
+            for (let j = i + 1; j < lines.length; j++) {
+                const listItem = lines[j].match(/^\s*-\s*["']?([\w.]+)["']?\s*$/);
+                if (!listItem)
+                    break;
+                versions.add(listItem[1]);
+            }
+        }
+    }
+    return [...versions].sort((a, b) => a.localeCompare(b, undefined, { numeric: true }));
+}
+function parsePackageManagerCommands(content) {
+    const commands = new Set();
+    for (const match of content.matchAll(/\bnpm (ci|install|publish|pack|audit|outdated)\b/g)) {
+        commands.add(`npm ${match[1]}`);
+    }
+    for (const match of content.matchAll(/\bnpx [\w.:-]+/g)) {
+        commands.add(match[0].trim());
+    }
+    return [...commands].sort((a, b) => a.localeCompare(b));
+}
+function parseNpmScriptsReferenced(content) {
+    const scripts = new Set();
+    for (const match of content.matchAll(/\bnpm run ([\w:.-]+)/g)) {
+        scripts.add(match[1]);
+    }
+    return [...scripts].sort((a, b) => a.localeCompare(b));
+}
+// ---------------------------------------------------------------------------
+// Build tooling truth
+// ---------------------------------------------------------------------------
+function readBuildToolingTruth(inventory, pkg) {
+    const tsconfigPaths = inventory.files
+        .filter((f) => /^tsconfig(\..+)?\.json$/.test(path.basename(f.relativePath)))
+        .map((f) => f.relativePath)
+        .sort((a, b) => a.localeCompare(b));
+    const vitestConfigPaths = inventory.files
+        .filter((f) => /^vitest\.config\.[jt]s$/.test(path.basename(f.relativePath)) || path.basename(f.relativePath) === "vitest.workspace.ts")
+        .map((f) => f.relativePath)
+        .sort((a, b) => a.localeCompare(b));
+    const eslintConfigPaths = inventory.files
+        .filter((f) => /^\.eslintrc(\..+)?$/.test(path.basename(f.relativePath)) || /^eslint\.config\.[jt]s$/.test(path.basename(f.relativePath)))
+        .map((f) => f.relativePath)
+        .sort((a, b) => a.localeCompare(b));
+    const scripts = pkg?.scripts ?? {};
+    return {
+        hasTsconfig: tsconfigPaths.length > 0,
+        tsconfigPaths,
+        hasVitestConfig: vitestConfigPaths.length > 0,
+        vitestConfigPaths,
+        hasEslintConfig: eslintConfigPaths.length > 0,
+        eslintConfigPaths,
+        hasBuildScript: "build" in scripts,
+        hasTypecheckScript: "typecheck" in scripts,
+        hasTestScript: "test" in scripts,
+    };
+}
+// ---------------------------------------------------------------------------
+// Test truth
+// ---------------------------------------------------------------------------
+function readTestTruth(inventory) {
+    const testFilesByTopLevelArea = {};
+    let auditTestFileCount = 0;
+    let securityTestFileCount = 0;
+    let experimentTestFileCount = 0;
+    for (const file of inventory.testFiles) {
+        const match = file.relativePath.match(/^tests\/([^/]+)\//);
+        const area = match ? match[1] : "other";
+        testFilesByTopLevelArea[area] = (testFilesByTopLevelArea[area] ?? 0) + 1;
+        if (area === "audits")
+            auditTestFileCount += 1;
+        if (area === "security")
+            securityTestFileCount += 1;
+        if (area === "experiments")
+            experimentTestFileCount += 1;
+    }
+    const orderedAreas = Object.fromEntries(Object.entries(testFilesByTopLevelArea).sort(([a], [b]) => a.localeCompare(b)));
+    return {
+        totalTestFileCount: inventory.testFiles.length,
+        auditTestFileCount,
+        securityTestFileCount,
+        experimentTestFileCount,
+        testFilesByTopLevelArea: orderedAreas,
+    };
+}
+// ---------------------------------------------------------------------------
+// Security / experiment truth (script + directory presence only)
+// ---------------------------------------------------------------------------
+function readSecurityTruth(targetRoot, pkg) {
+    const scripts = pkg?.scripts ?? {};
+    return {
+        hasSecurityValidateScript: "security:validate" in scripts,
+        hasSecurityDepsScript: "security:deps" in scripts,
+        hasSecurityPackageScript: "security:package" in scripts,
+        hasSecurityCodeqlScript: "security:codeql" in scripts,
+        hasSecuritySemgrepScript: "security:semgrep" in scripts,
+        hasTestSecurityScript: "test:security" in scripts,
+        hasSecurityValidationSourceDir: dirExists(path.join(targetRoot, "src", "securityValidation")),
+    };
+}
+function readExperimentTruth(targetRoot, pkg) {
+    const scripts = pkg?.scripts ?? {};
+    return {
+        hasExperimentListScript: "experiment:list" in scripts,
+        hasExperimentDescribeScript: "experiment:describe" in scripts,
+        hasExperimentRunScript: "experiment:run" in scripts,
+        hasExperimentsSourceDir: dirExists(path.join(targetRoot, "src", "experiments")),
+    };
+}
+function dirExists(dirPath) {
+    try {
+        return fs.statSync(dirPath).isDirectory();
+    }
+    catch {
+        return false;
+    }
+}

package/dist/src/audits/core/textLines.js

@@ -0,0 +1,24 @@
+// ---------------------------------------------------------------------------
+// v0.3.0 Batch 6 — canonical, core-level line-splitting helper.
+//
+// Moved here from src/audits/codeRot/utils/textLines.ts (Batch 3), because
+// src/audits/core/sourceOfTruth.ts (a core-level module) needed the same
+// CRLF-safe splitting behavior for parseNodeVersions()'s list-form
+// "node-version:\n  - 20\n  - 22" parsing, and core/ depending on
+// codeRot/utils/ would be architecturally backwards (core is lower-level
+// than codeRot). This is now the single canonical implementation; the
+// codeRot-side module re-exports it so no existing detector import path
+// changes (see src/audits/codeRot/utils/textLines.ts).
+//
+// Windows-authored files in this repo (e.g. docs/ROADMAP.md) commonly have
+// CRLF line endings. A plain content.split("\n") leaves a trailing "\r" on
+// every line, which silently breaks any "$"-anchored regex against that
+// line (JS regex "." does not match "\r", a line terminator character) --
+// discovered via a real false negative where a heading-tracking regex
+// matched zero headings in a CRLF file. Every module that splits doc/text
+// content into lines must go through this helper instead of a bare
+// .split("\n").
+// ---------------------------------------------------------------------------
+export function splitLines(content) {
+    return content.replace(/\r\n/g, "\n").split("\n");
+}