@dailephd/my-dev-kit-lab 0.3.1 → 0.3.3

package/dist/src/audits/codeRot/utils/jvmSourceFactsUtils.js

@@ -0,0 +1,153 @@
+// ---------------------------------------------------------------------------
+// v0.3.3 Batch 2 -- shared JVM (Java/Kotlin) source-facts helpers reused by
+// deadCodeCandidateDetector.ts, duplicateImplementationDetector.ts, and
+// testRotDetector.ts.
+//
+// Deterministic and dependency-free: no Gradle/Maven execution, no
+// classpath resolution, no Java/Kotlin compiler, no traversal outside the
+// target root. Everything here operates purely on already-collected
+// SourceFacts/inventory data (see javaAnalyzer.ts/kotlinAnalyzer.ts/
+// jvmProjectMetadata.ts from v0.3.3 Batch 1).
+// ---------------------------------------------------------------------------
+// Import prefixes considered standard-library or common third-party test
+// framework noise -- never treated as "possibly a local project import" by
+// testRotDetector.ts's JVM resolver, regardless of whether a local file
+// happens to share a path segment. Matched against the import source's
+// leading dotted segments so "java.util.List" matches "java." but a
+// hypothetical local package literally named "javautils.Foo" (no dot after
+// "java") would not.
+const JVM_SKIPPABLE_IMPORT_PREFIXES = [
+    "java.",
+    "javax.",
+    "jakarta.",
+    "kotlin.",
+    "kotlinx.",
+    "org.junit.",
+    "org.assertj.",
+    "org.mockito.",
+    "org.hamcrest.",
+    "io.kotest.",
+];
+export function isJvmSkippableImportSource(source) {
+    return JVM_SKIPPABLE_IMPORT_PREFIXES.some((prefix) => source.startsWith(prefix));
+}
+// True for a wildcard-style import (`import com.example.*` or, for Java
+// static imports, `import static com.example.Foo.*`). Deliberately treated
+// as never "safely local" by testRotDetector.ts's JVM resolver -- there is
+// no way to derive a single candidate file from a wildcard without real
+// classpath/package-member awareness, so guessing would either miss real
+// stale imports (if resolved unconditionally) or produce high-noise false
+// positives (if flagged unconditionally). Skipping entirely is the
+// conservative choice.
+export function isJvmWildcardImportSource(source) {
+    return source.endsWith(".*");
+}
+// The simple (unqualified) name a dotted JVM import source resolves to --
+// the last segment after the final ".". For a Java static import
+// (`static com.example.Foo.bar`), this is the imported static member name,
+// not the enclosing class -- an accepted, documented conflation for this
+// conservative, best-effort scan (see javaAnalyzer.ts's own header comment
+// on why `import static` is not modeled any more precisely than a plain
+// import).
+export function jvmImportSimpleName(source) {
+    const idx = source.lastIndexOf(".");
+    return idx === -1 ? source : source.slice(idx + 1);
+}
+// Converts a dotted JVM import source (e.g. "com.example.Foo") into a
+// package-shaped relative path segment (e.g. "com/example/Foo"), dropping
+// any trailing wildcard/member segment handling -- callers are responsible
+// for skipping wildcards via isJvmWildcardImportSource() first.
+export function jvmImportToPackagePath(source) {
+    return source.split(".").join("/");
+}
+// Candidate on-disk relative paths for a (non-wildcard, non-skippable)
+// import, given the project's recognized Java/Kotlin source-set
+// directories (see jvmProjectMetadata.ts's recognizedSourceDirectories).
+// Conservative and path-based only: this never resolves the real classpath,
+// only checks the conventional Gradle/Maven `src/main/{java,kotlin}/...`
+// layout. `extensions` lets a Kotlin importer also check `.java` (Kotlin
+// can legitimately import Java source in a mixed JVM project) while a Java
+// importer only ever checks `.java`.
+export function jvmImportCandidatePaths(source, recognizedSourceDirectories, extensions) {
+    const packagePath = jvmImportToPackagePath(source);
+    const candidates = [];
+    for (const dir of recognizedSourceDirectories) {
+        for (const ext of extensions) {
+            candidates.push(`${dir}/${packagePath}.${ext}`);
+        }
+    }
+    return candidates;
+}
+// True when an ImportFact looks worth checking for local-file existence at
+// all -- i.e. not a standard-library/common-test-framework import and not a
+// wildcard. Callers still need their own existence check; this only
+// filters out imports this conservative scan should never second-guess.
+export function jvmImportLooksPossiblyLocal(imp) {
+    if (isJvmWildcardImportSource(imp.source))
+        return false;
+    if (isJvmSkippableImportSource(imp.source))
+        return false;
+    // A bare, undotted import (e.g. a same-package reference, or a malformed
+    // scan artifact) has no package path to resolve against -- not
+    // checkable by this path-based resolver.
+    if (!imp.source.includes("."))
+        return false;
+    return true;
+}
+// ---------------------------------------------------------------------------
+// Declaration-name conservatism helpers.
+// ---------------------------------------------------------------------------
+// Common JVM class/type names that legitimately repeat across unrelated
+// projects/modules (a "Main" class, an "App" entrypoint, a "Config" class
+// per module, etc.) -- excluded from duplicateImplementationDetector.ts's
+// JVM duplicate-declaration-candidate check the same way
+// GENERIC_DECLARATION_NAMES/GENERIC_INFRA_BASENAMES already exclude their
+// TS/JS/Python/file-basename equivalents.
+const JVM_COMMON_TYPE_NAMES = new Set([
+    "main",
+    "app",
+    "application",
+    "config",
+    "configuration",
+    "utils",
+    "helper",
+    "factory",
+    "builder",
+    "manager",
+    "service",
+    "controller",
+    "repository",
+]);
+export function isJvmCommonLowSignalDeclarationName(name) {
+    const lower = name.toLowerCase();
+    if (JVM_COMMON_TYPE_NAMES.has(lower))
+        return true;
+    if (lower.startsWith("test"))
+        return true;
+    return lower === "setup" || lower === "teardown";
+}
+// Java/Kotlin lifecycle, `Object`-override, and bean-accessor-shaped names
+// -- excluded from deadCodeCandidateDetector.ts's JVM dead-code-candidate
+// check, the same way isGenericOrTestPrefixedDeclarationName() already
+// excludes TS/JS/Python's equivalents. `get*`/`set*`/`is*` in particular
+// cover the extremely common JavaBean accessor convention, where a
+// "no detected cross-file reference" signal is essentially meaningless
+// (framework/reflection-based access is invisible to this static scan).
+const JVM_LIFECYCLE_EXACT_NAMES = new Set([
+    "main",
+    "tostring",
+    "equals",
+    "hashcode",
+    "compareto",
+    "clone",
+    "setup",
+    "teardown",
+    "copy", // Kotlin data class synthesized-like member
+]);
+const JVM_LIFECYCLE_PREFIXES = ["get", "set", "is", "can", "should", "before", "after", "test", "component"];
+export function isJvmLifecycleOrConventionalDeclarationName(name) {
+    const lower = name.toLowerCase();
+    if (JVM_LIFECYCLE_EXACT_NAMES.has(lower))
+        return true;
+    return JVM_LIFECYCLE_PREFIXES.some((prefix) => lower.startsWith(prefix));
+}

package/dist/src/audits/core/auditConfig.js

@@ -1,5 +1,5 @@
 import path from "node:path";
-import { AUDIT_FAIL_ON_THRESHOLDS, AUDIT_INCLUDE_AREAS, AUDIT_OUTPUT_FORMATS, AUDIT_TYPES, DEFAULT_AUDIT_FAIL_ON_THRESHOLD, DEFAULT_AUDIT_INCLUDE_AREAS, DEFAULT_AUDIT_OUTPUT_FORMATS, DEFAULT_AUDIT_TYPES, PLANNED_AUDIT_TYPES, } from "./auditTypes.js";
+import { AUDIT_FAIL_ON_THRESHOLDS, AUDIT_INCLUDE_AREAS, AUDIT_OUTPUT_FORMATS, AUDIT_TYPES, DEFAULT_AUDIT_FAIL_ON_THRESHOLD, DEFAULT_AUDIT_INCLUDE_AREAS, DEFAULT_AUDIT_OUTPUT_FORMATS, DEFAULT_AUDIT_TYPES, IMPLEMENTED_AUDIT_TYPES, PLANNED_AUDIT_TYPES, } from "./auditTypes.js";
 const FLAGS_WITH_VALUE = {
     "--target": "target",
     "--types": "types",
@@ -67,7 +67,7 @@ function parseTypesOption(raw) {
     }
     const planned = parts.filter((p) => PLANNED_AUDIT_TYPES.includes(p));
     if (planned.length > 0) {
-        throw new Error(`--types value(s) planned but not implemented: ${planned.join(", ")}. Only "code-rot" is implemented in this version.`);
+        throw new Error(`--types value(s) planned but not implemented: ${planned.join(", ")}. Implemented audit types: ${IMPLEMENTED_AUDIT_TYPES.join(", ")}.`);
     }
     const unique = new Set(parts);
     const ordered = AUDIT_TYPES.filter((id) => unique.has(id));

package/dist/src/audits/core/auditRunner.js

@@ -4,6 +4,9 @@ import { resolveAuditTarget } from "./auditTarget.js";
 import { scanProjectInventory } from "./projectInventory.js";
 import { collectSourceOfTruth } from "./sourceOfTruth.js";
 import { collectSourceFacts } from "./collectSourceFacts.js";
+import { collectPythonProjectMetadata } from "./pythonProjectMetadata.js";
+import { runSecurityAuditAdapter } from "../security/securityAuditAdapter.js";
+import { SECURITY_AUDIT_NOT_RUN_SUMMARY } from "../security/securityAuditTypes.js";
 export async function runAudit(options) {
     const { config, toolRoot } = options;
     const registry = options.registry ?? DEFAULT_AUDIT_REGISTRY;
@@ -11,6 +14,7 @@ export async function runAudit(options) {
     const inventory = scanProjectInventory(target.rootPath);
     const sourceOfTruth = collectSourceOfTruth(target.rootPath, inventory);
     const sourceFacts = await collectSourceFacts(target.rootPath, inventory);
+    const pythonProjectMetadata = collectPythonProjectMetadata(target.rootPath, inventory);
     const selected = selectDetectors(registry, config.types, config.include);
     const ctx = { target, config, inventory, sourceOfTruth, sourceFacts };
     const issues = [];
@@ -37,6 +41,19 @@ export async function runAudit(options) {
             });
         }
     }
+    // v0.3.2 Batch 4 -- security audit adapter. Conditional (see the
+    // AuditResult.securitySummary field comment above): only runs when --types
+    // explicitly includes "security", never as part of a default/code-rot-only
+    // run. Appended after the code-rot detector loop above, so combined
+    // `--types code-rot,security` runs keep a deterministic issue order:
+    // code-rot detector issues (registry order) first, then security findings
+    // (security-validation check-execution order).
+    let securitySummary = SECURITY_AUDIT_NOT_RUN_SUMMARY;
+    if (config.types.includes("security")) {
+        const securityAudit = await runSecurityAuditAdapter({ toolRoot, config });
+        issues.push(...securityAudit.issues);
+        securitySummary = securityAudit.summary;
+    }
     const issueCounts = countIssuesBySeverity(issues);
     const { exitCode, reason } = calculateAuditExitCode(issues, config.failOn);
     return {
@@ -62,6 +79,8 @@ export async function runAudit(options) {
         inventory,
         sourceOfTruth,
         sourceFacts,
+        pythonProjectMetadata,
+        securitySummary,
         noDetectorsRegistered: selected.length === 0,
     };
 }

package/dist/src/audits/core/auditTypes.js

@@ -7,14 +7,21 @@
 // this batch keeps the audit issue schema independent even where a
 // vocabulary word (e.g. "blocker") happens to be shared.
 // ---------------------------------------------------------------------------
-// Recognized --types values. Only "code-rot" has real detector coverage in
-// Batch 1 — the rest are known, named future audit types that must fail
-// cleanly with a "planned but not implemented" message rather than being
-// silently accepted or treated as an unknown/garbage value.
+// Recognized --types values. "code-rot" (Batch 1) and "security" (v0.3.2
+// Batch 4, via the security-validation audit adapter) have real coverage —
+// the rest are known, named future audit types that must fail cleanly with a
+// "planned but not implemented" message rather than being silently accepted
+// or treated as an unknown/garbage value.
 export const AUDIT_TYPES = ["code-rot", "quality", "security", "project", "all"];
-export const IMPLEMENTED_AUDIT_TYPES = ["code-rot"];
-export const PLANNED_AUDIT_TYPES = ["quality", "security", "project", "all"];
-export const DEFAULT_AUDIT_TYPES = IMPLEMENTED_AUDIT_TYPES;
+export const IMPLEMENTED_AUDIT_TYPES = ["code-rot", "security"];
+export const PLANNED_AUDIT_TYPES = ["quality", "project", "all"];
+// v0.3.2 Batch 4 — deliberately NOT derived from IMPLEMENTED_AUDIT_TYPES.
+// "security" becomes selectable via --types security (and --types
+// code-rot,security) but must never join the *default* (no --types flag)
+// audit run, since it shells out to npm audit/CodeQL/Semgrep/fuzz and is far
+// more expensive than the always-on code-rot detectors — a default,
+// unqualified `npm run audit` must keep its existing code-rot-only behavior.
+export const DEFAULT_AUDIT_TYPES = ["code-rot"];
 export const AUDIT_INCLUDE_AREAS = ["docs", "tests", "package", "architecture", "cli"];
 export const DEFAULT_AUDIT_INCLUDE_AREAS = AUDIT_INCLUDE_AREAS;
 export const AUDIT_OUTPUT_FORMATS = ["text", "json"];

package/dist/src/audits/core/javaAnalyzer.js

@@ -0,0 +1,282 @@
+// ---------------------------------------------------------------------------
+// v0.3.3 Batch 1 -- conservative, dependency-free Java source analyzer.
+//
+// There is no Java compiler/parser available in this Node/TypeScript
+// project, and per this batch's scope this analyzer must not add a new
+// parser dependency (no javac, no javaparser-style library). Facts are
+// extracted with a deliberately narrow, brace-depth-tracking line scan --
+// not a real tokenizer, not an AST, and not a syntax validator. Same
+// LanguageAnalyzer contract, same SourceFileFacts shape, and the same
+// size-bounding philosophy as typescriptJavaScriptAnalyzer.ts/
+// pythonAnalyzer.ts, but confidence is necessarily lower since nothing here
+// proves the file is syntactically valid Java.
+//
+// What this DOES extract:
+//   - a single `package foo.bar;` declaration
+//   - `import foo.bar.Baz;` and `import static foo.bar.Baz.member;` (both
+//     recorded via the existing generic ImportFactKind "static" -- the same
+//     "resolved through a static, syntactic import statement" meaning
+//     already used by every other analyzer in this project, not a claim
+//     about Java's specific "import static" keyword)
+//   - top-level and nested class/interface/enum declarations
+//   - method and constructor declarations directly inside a class/
+//     interface/enum body (both recorded as DeclarationFactKind "method" --
+//     there is no dedicated constructor kind in the shared model, and
+//     "method" is a safe, non-overclaiming fit)
+//   - visibility (public/protected/private/package-private), folded into
+//     the existing `exported` boolean: `exported: true` only for an
+//     explicit `public` modifier, `false` for protected/private/
+//     package-private -- see "Visibility mapping" below for why no new
+//     schema field was added
+//   - line counts, parse/analyze status, and diagnostics for degraded
+//     parsing
+//
+// What this explicitly does NOT do: real Java compilation, type resolution,
+// symbol/overload resolution, inheritance analysis, annotation/framework
+// lifecycle understanding, runtime behavior, Gradle/Maven source-set
+// validation, semantic duplicate-implementation proof, or dead-code proof.
+// Field/property declarations are not extracted (out of this batch's
+// required scope, and harder to distinguish conservatively from local
+// variable declarations via regex alone). Java text blocks (`"""..."""`,
+// Java 15+) are not given special multi-line handling the way Kotlin's raw
+// strings are in kotlinAnalyzer.ts -- if present, a `{`/`}`/quote character
+// inside one could be slightly miscounted, which is an accepted, narrow
+// limitation of a regex/brace-counting scanner rather than a crash risk.
+//
+// Visibility mapping (no SourceFacts schema change):
+//   DeclarationFact has no dedicated visibility field, and per this batch's
+//   "prefer no schema change" guidance, none is added here. Java's four
+//   visibility levels collapse onto the existing boolean `exported` the
+//   same way the Python analyzer already folds its own export heuristic
+//   into that field: `public` -> true, everything else (protected/private/
+//   package-private) -> false. This intentionally loses the
+//   protected-vs-private-vs-package-private distinction; callers that need
+//   finer detail must re-derive it from source, which this analyzer does
+//   not claim to make unnecessary.
+// ---------------------------------------------------------------------------
+export const JAVA_ANALYZER_ID = "java-analyzer";
+const SUPPORTED_EXTENSIONS = [".java"];
+// Mirrors typescriptJavaScriptAnalyzer.ts/pythonAnalyzer.ts's bound.
+const MAX_ANALYZABLE_BYTES = 1_000_000;
+const PACKAGE_LINE_PATTERN = /^\s*package\s+([\w.]+)\s*;/;
+const IMPORT_LINE_PATTERN = /^\s*import\s+(static\s+)?([\w.]+(?:\.\*)?)\s*;/;
+// Requires an explicit visibility modifier to be captured separately so
+// "no modifier present" (package-private) is distinguishable from an
+// explicit one -- see MODIFIER_PATTERN below.
+const MODIFIER_WORDS = "(?:public|protected|private|static|final|abstract|sealed|non-sealed|strictfp|synchronized|native|default)";
+const TYPE_DECL_PATTERN = new RegExp(`^\\s*(?:${MODIFIER_WORDS}\\s+)*(class|interface|enum|record)\\s+(\\w+)`);
+// Two separate word-tokens (a return-type-like token, then the method name)
+// before the parameter list -- this is what keeps `if (...)`, `for (...)`,
+// `while (...)`, `switch (...)`, and plain method-call statements
+// (`foo.bar(x);`, a single dotted token with no preceding space) from ever
+// matching: those all have only one space-separated token before `(`.
+// The trailing group accepts either just an opening brace (multi-line
+// body), a semicolon (abstract/interface method declaration), or a full
+// one-liner body with no nested braces (e.g. `{ return true; }`, `{}`) --
+// without the last alternative, a common one-liner accessor/getter would
+// never be recognized as a declaration at all.
+const METHOD_LINE_PATTERN = new RegExp(`^\\s*(?:${MODIFIER_WORDS}\\s+)*[\\w<>\\[\\],.?]+\\s+(\\w+)\\s*\\(([^()]*)\\)\\s*(?:throws\\s+[\\w.,\\s<>]+)?\\s*(?:\\{[^{}]*\\}|\\{|;)\\s*$`);
+// A constructor has no return-type token: just an optional visibility
+// modifier, the identifier, then the parameter list. The caller only
+// accepts a match here when the identifier equals the enclosing class/
+// enum/record name, which is what actually distinguishes a real
+// constructor from a stray call-like statement (see analyzeFile below).
+const CONSTRUCTOR_LINE_PATTERN = /^\s*(?:(?:public|protected|private)\s+)?(\w+)\s*\(([^()]*)\)\s*(?:throws\s+[\w.,\s<>]+)?\s*(?:\{[^{}]*\}|\{)\s*$/;
+const EXPLICIT_MODIFIER_PATTERN = /(?:^|\s)(public|protected|private)(?:\s|$)/;
+export const JAVA_ANALYZER = {
+    id: JAVA_ANALYZER_ID,
+    supportedLanguages: ["java"],
+    supportedExtensions: SUPPORTED_EXTENSIONS,
+    analyzeFile,
+};
+function analyzeFile(input) {
+    const { relativePath, language, role, content, inventoryEntry } = input;
+    if (Buffer.byteLength(content, "utf8") > MAX_ANALYZABLE_BYTES) {
+        return {
+            relativePath,
+            language,
+            role,
+            parseStatus: "file-level-only",
+            analyzerId: JAVA_ANALYZER_ID,
+            lineCount: inventoryEntry.lineCount,
+            imports: [],
+            exports: [],
+            declarations: [],
+            references: [],
+            diagnostics: [
+                {
+                    severity: "info",
+                    code: "file-too-large-for-analysis",
+                    message: `File exceeds the ${MAX_ANALYZABLE_BYTES}-byte analyzer bound; only inventory-level facts are available.`,
+                    path: relativePath,
+                    analyzerId: JAVA_ANALYZER_ID,
+                },
+            ],
+        };
+    }
+    const diagnostics = [];
+    const { logical, hadUnterminatedBlockComment } = buildLogicalLines(content);
+    const imports = [];
+    const declarations = [];
+    const scopeStack = [];
+    let depth = 0;
+    let packageSeen = false;
+    for (let i = 0; i < logical.length; i++) {
+        const line = logical[i];
+        const lineNumber = i + 1;
+        if (line.trim().length === 0) {
+            continue;
+        }
+        if (!packageSeen) {
+            const packageMatch = line.match(PACKAGE_LINE_PATTERN);
+            if (packageMatch)
+                packageSeen = true;
+        }
+        const importMatch = line.match(IMPORT_LINE_PATTERN);
+        if (importMatch) {
+            imports.push({ source: importMatch[2], kind: "static", line: lineNumber });
+        }
+        const typeMatch = line.match(TYPE_DECL_PATTERN);
+        // "record" (a restricted, implicitly-final class variant) is folded
+        // into the existing "class" DeclarationFactKind/ScopeKind -- there is
+        // no dedicated record kind in the shared model, and "class" is a safe,
+        // non-overclaiming fit (a record's synthesized accessor/constructor
+        // methods are not separately modeled).
+        const normalizedKind = typeMatch ? (typeMatch[1] === "record" ? "class" : typeMatch[1]) : null;
+        if (typeMatch && normalizedKind) {
+            const name = typeMatch[2];
+            declarations.push({
+                name,
+                kind: normalizedKind,
+                exported: EXPLICIT_MODIFIER_PATTERN.exec(line.slice(0, typeMatch.index + typeMatch[0].length))?.[1] === "public",
+                line: lineNumber,
+            });
+        }
+        else if (scopeStack.length > 0 && depth === scopeStack[scopeStack.length - 1].bodyDepth) {
+            const currentScope = scopeStack[scopeStack.length - 1];
+            const methodMatch = line.match(METHOD_LINE_PATTERN);
+            if (methodMatch) {
+                pushMethodDeclaration(declarations, methodMatch[1], line, lineNumber);
+            }
+            else {
+                const ctorMatch = line.match(CONSTRUCTOR_LINE_PATTERN);
+                if (ctorMatch && ctorMatch[1] === currentScope.name) {
+                    pushMethodDeclaration(declarations, ctorMatch[1], line, lineNumber);
+                }
+            }
+        }
+        const depthBefore = depth;
+        depth += countChar(line, "{") - countChar(line, "}");
+        if (typeMatch && normalizedKind) {
+            // Always push assuming depth+1 is the body -- whether the opening
+            // brace was on this same line (K&R style, the common case) or a
+            // subsequent line (Allman style), the actual `{` character
+            // eventually seen will bump `depth` to exactly `depthBefore + 1`,
+            // matching this assumption either way.
+            scopeStack.push({ kind: normalizedKind, name: typeMatch[2], bodyDepth: depthBefore + 1 });
+        }
+        while (scopeStack.length > 0 && depth < scopeStack[scopeStack.length - 1].bodyDepth) {
+            scopeStack.pop();
+        }
+    }
+    if (hadUnterminatedBlockComment) {
+        diagnostics.push({
+            severity: "error",
+            code: "unterminated-block-comment",
+            message: "File appears to contain an unterminated /* block comment; facts from this best-effort scan may be incomplete.",
+            path: relativePath,
+            analyzerId: JAVA_ANALYZER_ID,
+        });
+    }
+    const parseStatus = hadUnterminatedBlockComment ? "parse-error" : "parsed";
+    return {
+        relativePath,
+        language,
+        role,
+        parseStatus,
+        analyzerId: JAVA_ANALYZER_ID,
+        lineCount: inventoryEntry.lineCount,
+        imports,
+        exports: [],
+        declarations,
+        references: [],
+        diagnostics,
+    };
+}
+function pushMethodDeclaration(declarations, name, line, lineNumber) {
+    const kind = "method";
+    declarations.push({
+        name,
+        kind,
+        exported: EXPLICIT_MODIFIER_PATTERN.exec(line)?.[1] === "public",
+        line: lineNumber,
+    });
+}
+function countChar(line, ch) {
+    let count = 0;
+    for (let i = 0; i < line.length; i++) {
+        if (line[i] === ch)
+            count += 1;
+    }
+    return count;
+}
+// ---------------------------------------------------------------------------
+// Comment/string stripping (heuristic, not a tokenizer). Strips `//` line
+// comments and `/* ... */` block comments (which may span multiple
+// lines), and blanks out the contents of `"..."` and `'...'` literals
+// (escape-aware) so a brace/quote character inside a string or comment can
+// never be misread as real code structure. Does not give Java 15+ text
+// blocks (`"""..."""`) special multi-line handling -- see this file's
+// header comment.
+// ---------------------------------------------------------------------------
+function buildLogicalLines(content) {
+    const rawLines = content.split(/\r\n|\r|\n/);
+    const logical = [];
+    let inBlockComment = false;
+    for (const rawLine of rawLines) {
+        logical.push(stripLine(rawLine));
+    }
+    return { logical, hadUnterminatedBlockComment: inBlockComment };
+    function stripLine(line) {
+        let result = "";
+        let i = 0;
+        while (i < line.length) {
+            if (inBlockComment) {
+                const closeIdx = line.indexOf("*/", i);
+                if (closeIdx === -1)
+                    return result;
+                inBlockComment = false;
+                i = closeIdx + 2;
+                continue;
+            }
+            const ch = line[i];
+            if (ch === "/" && line[i + 1] === "/")
+                return result;
+            if (ch === "/" && line[i + 1] === "*") {
+                inBlockComment = true;
+                i += 2;
+                continue;
+            }
+            if (ch === '"' || ch === "'") {
+                const quote = ch;
+                let j = i + 1;
+                while (j < line.length) {
+                    if (line[j] === "\\") {
+                        j += 2;
+                        continue;
+                    }
+                    if (line[j] === quote) {
+                        j += 1;
+                        break;
+                    }
+                    j += 1;
+                }
+                i = j;
+                continue;
+            }
+            result += ch;
+            i += 1;
+        }
+        return result;
+    }
+}

package/dist/src/audits/core/jvmProjectMetadata.js

@@ -0,0 +1,106 @@
+import fs from "node:fs";
+import path from "node:path";
+const GRADLE_BUILD_FILE_NAMES = new Set(["build.gradle", "build.gradle.kts"]);
+const GRADLE_SETTINGS_FILE_NAMES = new Set(["settings.gradle", "settings.gradle.kts"]);
+const GRADLE_WRAPPER_FILE_NAMES = new Set(["gradlew", "gradlew.bat"]);
+// Conservative, single-line extraction: `rootProject.name = "foo"` (Groovy
+// or Kotlin DSL both use this exact call-and-assign shape). Does not handle
+// multi-line expressions, string concatenation, or computed values.
+const GRADLE_SETTINGS_PROJECT_NAME_PATTERN = /rootProject\.name\s*=\s*["']([^"']+)["']/;
+// Conservative, single-line/non-nested extraction: the first top-level
+// `<artifactId>...</artifactId>` in the file. Real pom.xml can nest an
+// `<artifactId>` inside `<parent>` or `<dependencies>`, which this naive
+// first-match scan cannot distinguish -- so this is intentionally treated as
+// best-effort only, matching this module's "leave null rather than guess"
+// policy for anything structurally ambiguous. A `<parent>` block, if present
+// before the project's own `<artifactId>`, is skipped over so the far more
+// common case (parent declared first, then the project's own coordinates)
+// resolves to the right value instead of the parent's.
+const POM_ARTIFACT_ID_PATTERN = /<artifactId>\s*([^<\s][^<]*?)\s*<\/artifactId>/;
+function findSourceSetDirectories(inventory, segment, language) {
+    const dirName = `src/${segment}/${language}`;
+    const prefix = `${dirName}/`;
+    const found = inventory.files.some((f) => f.relativePath === dirName || f.relativePath.startsWith(prefix));
+    return found ? [dirName] : [];
+}
+export function collectJvmProjectMetadata(targetRoot, inventory) {
+    const warnings = [];
+    const knownPaths = new Set(inventory.files.map((f) => f.relativePath));
+    const recognizedBuildFiles = inventory.files
+        .map((f) => f.relativePath)
+        .filter((relativePath) => {
+        const basename = path.posix.basename(relativePath);
+        return (GRADLE_BUILD_FILE_NAMES.has(basename) ||
+            GRADLE_SETTINGS_FILE_NAMES.has(basename) ||
+            GRADLE_WRAPPER_FILE_NAMES.has(basename) ||
+            basename === "pom.xml" ||
+            basename === "gradle.properties");
+    })
+        .sort((a, b) => a.localeCompare(b));
+    const hasGradleBuild = recognizedBuildFiles.some((p) => GRADLE_BUILD_FILE_NAMES.has(path.posix.basename(p)));
+    const hasGradleSettings = recognizedBuildFiles.some((p) => GRADLE_SETTINGS_FILE_NAMES.has(path.posix.basename(p)));
+    const hasMavenPom = knownPaths.has("pom.xml");
+    const hasGradleWrapper = recognizedBuildFiles.some((p) => GRADLE_WRAPPER_FILE_NAMES.has(path.posix.basename(p)));
+    const javaSourceDirs = findSourceSetDirectories(inventory, "main", "java");
+    const kotlinSourceDirs = findSourceSetDirectories(inventory, "main", "kotlin");
+    const javaTestDirs = findSourceSetDirectories(inventory, "test", "java");
+    const kotlinTestDirs = findSourceSetDirectories(inventory, "test", "kotlin");
+    // Source-set directory presence is a conservative signal only -- a
+    // project can validly keep Java/Kotlin files outside the conventional
+    // src/main|test/{java,kotlin} layout, so this does not attempt to prove
+    // "has no Java/Kotlin source"; it only reports the conventional-layout
+    // signal explicitly. hasJavaSource/hasKotlinSource below fall back to any
+    // scanned file of that language so they stay meaningful even for
+    // non-conventional layouts.
+    const hasJavaSource = javaSourceDirs.length > 0 || inventory.filesByLanguage.java > 0;
+    const hasKotlinSource = kotlinSourceDirs.length > 0 || inventory.filesByLanguage.kotlin > 0;
+    const hasJavaTests = javaTestDirs.length > 0;
+    const hasKotlinTests = kotlinTestDirs.length > 0;
+    const recognizedSourceDirectories = [...new Set([...javaSourceDirs, ...kotlinSourceDirs])].sort((a, b) => a.localeCompare(b));
+    const recognizedTestDirectories = [...new Set([...javaTestDirs, ...kotlinTestDirs])].sort((a, b) => a.localeCompare(b));
+    let projectName = null;
+    if (hasGradleSettings) {
+        const settingsPath = recognizedBuildFiles.find((p) => GRADLE_SETTINGS_FILE_NAMES.has(path.posix.basename(p)));
+        if (settingsPath) {
+            const content = readSafely(targetRoot, settingsPath, warnings);
+            if (content !== null) {
+                const match = content.match(GRADLE_SETTINGS_PROJECT_NAME_PATTERN);
+                if (match)
+                    projectName = match[1];
+            }
+        }
+    }
+    if (projectName === null && hasMavenPom) {
+        const content = readSafely(targetRoot, "pom.xml", warnings);
+        if (content !== null) {
+            const withoutParentBlock = content.replace(/<parent>[\s\S]*?<\/parent>/, "");
+            const match = withoutParentBlock.match(POM_ARTIFACT_ID_PATTERN);
+            if (match)
+                projectName = match[1];
+        }
+    }
+    return {
+        hasGradleBuild,
+        hasGradleSettings,
+        hasMavenPom,
+        hasGradleWrapper,
+        hasJavaSource,
+        hasKotlinSource,
+        hasJavaTests,
+        hasKotlinTests,
+        recognizedBuildFiles,
+        recognizedSourceDirectories,
+        recognizedTestDirectories,
+        projectName,
+        warnings,
+    };
+}
+function readSafely(targetRoot, relativePath, warnings) {
+    try {
+        return fs.readFileSync(path.join(targetRoot, relativePath), "utf8");
+    }
+    catch (err) {
+        warnings.push(`Could not read ${relativePath}: ${err instanceof Error ? err.message : String(err)}`);
+        return null;
+    }
+}