@dailephd/my-dev-kit-lab 0.3.2 → 0.3.4

package/dist/src/audits/core/languageAnalyzerRegistry.js

@@ -1,5 +1,7 @@
 import { TYPESCRIPT_JAVASCRIPT_ANALYZER } from "./typescriptJavaScriptAnalyzer.js";
 import { PYTHON_ANALYZER } from "./pythonAnalyzer.js";
+import { JAVA_ANALYZER } from "./javaAnalyzer.js";
+import { KOTLIN_ANALYZER } from "./kotlinAnalyzer.js";
 // Validates a list has no duplicate analyzer ids. Later batches call this
 // when assembling their own registries; Batch 2's empty default trivially
 // passes.
@@ -27,10 +29,14 @@ export function selectLanguageAnalyzer(registry, language, extension) {
     return null;
 }
 // v0.3.1 Batch 3 -- registers the TypeScript/JavaScript analyzer. v0.3.2
-// Batch 1 adds the Python analyzer alongside it. Java and Kotlin remain
-// fallback-only (no analyzer registered for them) -- see
-// collectSourceFacts.ts's fallback policy.
+// Batch 1 adds the Python analyzer alongside it. v0.3.3 Batch 1 adds Java
+// and Kotlin (see javaAnalyzer.ts/kotlinAnalyzer.ts) -- no other language
+// remains fallback-only by design change here; any language not in this
+// list still degrades through collectSourceFacts.ts's existing fallback
+// policy unchanged.
 export const DEFAULT_LANGUAGE_ANALYZER_REGISTRY = createLanguageAnalyzerRegistry([
     TYPESCRIPT_JAVASCRIPT_ANALYZER,
     PYTHON_ANALYZER,
+    JAVA_ANALYZER,
+    KOTLIN_ANALYZER,
 ]);

package/dist/src/audits/core/projectInventory.js

@@ -384,6 +384,25 @@ function isPythonTestFile(relativePath, basename) {
         return true;
     return /^test_.*\.py$/.test(basename) || /^.*_test\.py$/.test(basename);
 }
+// v0.3.3 Batch 1 -- conservative JVM (Java/Kotlin) test naming/source-set
+// conventions. Gated to .java/.kt so this can never reclassify an unrelated
+// file. "tests/**/*.java" and "tests/**/*.kt" are already covered by the
+// generic, extension-agnostic check above; this adds the Gradle/Maven
+// standard "src/test/{java,kotlin}" source-set layout, the singular "test/"
+// directory convention (same style as isPythonTestFile's "test/" check
+// above), and the "*Test(s).java" / "*Test(s).kt" / "*Spec.kt" filename
+// conventions.
+function isJvmTestFile(relativePath, basename, extension) {
+    if (relativePath.includes("src/test/java/") || relativePath.includes("src/test/kotlin/"))
+        return true;
+    if (relativePath.startsWith("test/") || relativePath.includes("/test/"))
+        return true;
+    if (extension === ".java")
+        return /Tests?\.java$/.test(basename);
+    if (extension === ".kt")
+        return /Tests?\.kt$/.test(basename) || /Spec\.kt$/.test(basename);
+    return false;
+}
 function isTestFile(relativePath, basename, extension) {
     if (relativePath.startsWith("tests/") || relativePath.includes("/tests/"))
         return true;
@@ -391,6 +410,8 @@ function isTestFile(relativePath, basename, extension) {
         return true;
     if (extension === ".py" && isPythonTestFile(relativePath, basename))
         return true;
+    if ((extension === ".java" || extension === ".kt") && isJvmTestFile(relativePath, basename, extension))
+        return true;
     return false;
 }
 // v0.3.2 Batch 1 -- recognized Python project/config metadata filenames.
@@ -405,6 +426,24 @@ const PYTHON_PROJECT_METADATA_FILE_NAMES = new Set([
     "tox.ini",
     "pytest.ini",
 ]);
+// v0.3.3 Batch 1 -- recognized JVM (Gradle/Maven) project/build metadata
+// filenames. Same narrow, basename-only convention as
+// PYTHON_PROJECT_METADATA_FILE_NAMES above: does not match arbitrary *.xml/
+// *.properties files, only these exact names. `build.gradle.kts` and
+// `settings.gradle.kts` matter in particular: without this, a Gradle Kotlin
+// DSL build script would otherwise fall through to the generic
+// KNOWN_SOURCE_EXTENSIONS ".kts" -> "source" classification below and be fed
+// to the Kotlin source-facts analyzer as if it were application code.
+const JVM_PROJECT_METADATA_FILE_NAMES = new Set([
+    "build.gradle",
+    "build.gradle.kts",
+    "settings.gradle",
+    "settings.gradle.kts",
+    "pom.xml",
+    "gradle.properties",
+    "gradlew",
+    "gradlew.bat",
+]);
 function isConfigFile(relativePath, basename, extension) {
     if (/^tsconfig(\..+)?\.json$/.test(basename))
         return true;
@@ -420,6 +459,8 @@ function isConfigFile(relativePath, basename, extension) {
     // here for the same "project metadata, not source" reasoning.
     if (basename === "setup.py" || PYTHON_PROJECT_METADATA_FILE_NAMES.has(basename))
         return true;
+    if (JVM_PROJECT_METADATA_FILE_NAMES.has(basename))
+        return true;
     // Root-level dotfile configs (e.g. .prettierrc, .babelrc) not already
     // covered above -- deliberately conservative (root-only, not recursive)
     // to avoid misclassifying dotfiles inside fixture/benchmark projects.

package/dist/src/audits/security/securityAuditAdapter.js

@@ -1,9 +1,8 @@
-import fs from "node:fs";
 import path from "node:path";
 import { runSecurityValidation } from "../../securityValidation/validate/runSecurityValidation.js";
 import { reportFilenamePrefix } from "../../securityValidation/validate/resolveTarget.js";
-import { renderJsonReport, renderTextReport } from "../../securityValidation/report/renderSecurityReport.js";
 import { buildSecurityReportFromSummary } from "../../securityValidation/report/buildSecurityReport.js";
+import { writeSecurityReportFiles } from "../../securityValidation/report/writeSecurityReportFiles.js";
 import { DEFAULT_SECURITY_CHECKS, DEFAULT_SECURITY_PROFILE } from "../../securityValidation/validate/cliOptions.js";
 import { verdictToHumanLabel } from "../../securityValidation/validate/verdict.js";
 import { mapSecurityFindingToAuditIssue } from "./mapSecurityFindingToAuditIssue.js";
@@ -23,23 +22,21 @@ export async function runSecurityAuditAdapter(options) {
         selectedChecks: [...DEFAULT_SECURITY_CHECKS],
         formats: ["text", "json"],
     });
-    // Always under my-dev-kit-lab's own reports/ tree (toolRoot), never under
-    // the audited target's root — matches the target-safety guarantee
-    // AuditTarget.safeReportOutputRoot already documents for code-rot reports.
     const reportDir = path.join(toolRoot, "reports", "security");
-    if (!fs.existsSync(reportDir)) {
-        fs.mkdirSync(reportDir, { recursive: true });
-    }
     const prefix = reportFilenamePrefix({
         isSelf: summary.isSelf,
         packageName: summary.packageName,
         packageVersion: summary.packageVersion,
         targetRoot: summary.targetRoot,
     });
-    const textPath = path.join(reportDir, `${prefix}-security-validation.txt`);
-    const jsonPath = path.join(reportDir, `${prefix}-security-validation.json`);
-    fs.writeFileSync(textPath, renderTextReport(report), "utf8");
-    fs.writeFileSync(jsonPath, renderJsonReport(report), "utf8");
+    const runSuffix = buildRunScopedReportSuffix(summary.startedAt, summary.finishedAt);
+    const { textPath, jsonPath } = writeSecurityReportFiles({
+        outDir: reportDir,
+        prefix,
+        report,
+        formats: ["text", "json"],
+        reportPathSuffix: runSuffix,
+    });
     const findingCounts = {
         blocker: summary.findings.filter((f) => f.severity === "blocker").length,
         major: summary.findings.filter((f) => f.severity === "major").length,
@@ -65,3 +62,9 @@ export async function runSecurityAuditAdapter(options) {
     };
     return { issues, summary: securitySummary };
 }
+function buildRunScopedReportSuffix(startedAt, finishedAt) {
+    return `${sanitizeTimestamp(startedAt)}-${sanitizeTimestamp(finishedAt)}-${process.pid}`;
+}
+function sanitizeTimestamp(value) {
+    return value.replace(/[^0-9]/g, "").slice(0, 14) || "run";
+}

package/dist/src/securityValidation/report/writeSecurityReportFiles.js

@@ -0,0 +1,28 @@
+import fs from "node:fs";
+import path from "node:path";
+import { renderJsonReport, renderTextReport } from "./renderSecurityReport.js";
+export function writeSecurityReportFiles(options) {
+    const reportDir = options.outDir;
+    if (!fs.existsSync(reportDir)) {
+        fs.mkdirSync(reportDir, { recursive: true });
+    }
+    const basename = options.reportPathSuffix
+        ? `${options.prefix}-${options.reportPathSuffix}-security-validation`
+        : `${options.prefix}-security-validation`;
+    const textPath = options.formats.includes("text")
+        ? path.join(reportDir, `${basename}.txt`)
+        : null;
+    const jsonPath = options.formats.includes("json")
+        ? path.join(reportDir, `${basename}.json`)
+        : null;
+    const writtenPaths = [];
+    if (textPath) {
+        fs.writeFileSync(textPath, renderTextReport(options.report), "utf8");
+        writtenPaths.push(textPath);
+    }
+    if (jsonPath) {
+        fs.writeFileSync(jsonPath, renderJsonReport(options.report), "utf8");
+        writtenPaths.push(jsonPath);
+    }
+    return { textPath, jsonPath, writtenPaths };
+}

package/package.json

@@ -1,97 +1,97 @@
-{
-  "name": "@dailephd/my-dev-kit-lab",
-  "version": "0.3.2",
-  "type": "module",
-  "description": "Evidence, benchmark, and evaluation companion for my-dev-kit.",
-  "bin": {
-    "my-dev-kit-lab": "dist/scripts/run-final-demo.js"
-  },
-  "files": [
-    "dist/scripts/",
-    "!dist/scripts/docs/",
-    "dist/src/",
-    "benchmarks/",
-    "docs/METRICS.md",
-    "examples/",
-    "tests/fixtures/"
-  ],
-  "repository": {
-    "type": "git",
-    "url": "git+https://github.com/dailephd/my-dev-kit-lab.git"
-  },
-  "homepage": "https://github.com/dailephd/my-dev-kit-lab#readme",
-  "bugs": {
-    "url": "https://github.com/dailephd/my-dev-kit-lab/issues"
-  },
-  "publishConfig": {
-    "access": "public"
-  },
-  "funding": [
-    "https://github.com/sponsors/dailephd",
-    "https://paypal.me/daile88"
-  ],
-  "keywords": [
-    "benchmark",
-    "evaluation",
-    "reporting",
-    "graph-retrieval",
-    "codex",
-    "claude"
-  ],
-  "author": "Dai Le",
-  "license": "MIT",
-  "scripts": {
-    "build": "node scripts/clean-dist.mjs && tsc -p tsconfig.json",
-    "typecheck": "tsc --noEmit",
-    "test": "vitest run",
-    "test:benchmarks": "vitest run tests/benchmarks tests/scripts",
-    "test:report": "vitest run tests/report tests/commands",
-    "test:screenshot": "vitest run tests/screenshot",
-    "test:evaluation": "vitest run tests/core tests/evaluation tests/commands",
-    "test:gallery": "vitest run tests/gallery",
-    "test:demo": "vitest run tests/commands/runLabDemo.spec.ts tests/integration/runLabDemoCommand.spec.ts",
-    "test:integration": "vitest run tests/integration",
-    "test:e2e": "vitest run tests/e2e",
-    "test:agents": "vitest run tests/agents tests/commands/runAgentPromptCommand.spec.ts tests/integration/runAgentPromptFake.spec.ts",
-    "test:experiments": "vitest run tests/evaluation/buildExperimentMatrix.spec.ts tests/evaluation/classifyAgentRunOutcome.spec.ts tests/evaluation/parseAgentAnswer.spec.ts tests/evaluation/scoreCorrectness.spec.ts tests/evaluation/compareExperimentRuns.spec.ts tests/evaluation/runControlledExperiment.spec.ts tests/commands/runControlledExperimentCommand.spec.ts tests/integration/runControlledExperimentFake.spec.ts",
-    "capture-demo-report": "tsx scripts/capture-demo-report.ts",
-    "evaluate-token-savings": "tsx scripts/evaluate-token-savings.ts",
-    "generate-experiment-plots": "tsx scripts/generate-experiment-plots.ts",
-    "generate-prompt-variants": "tsx scripts/generate-prompt-variants.ts",
-    "build-gallery": "tsx scripts/build-gallery.ts",
-    "lab-demo": "tsx scripts/run-lab-demo.ts",
-    "render-experiment-report": "tsx scripts/render-experiment-report.ts",
-    "experiment:list": "tsx scripts/experiments/listExperiments.ts",
-    "experiment:describe": "tsx scripts/experiments/describeExperiment.ts",
-    "experiment:run": "tsx scripts/experiments/runExperiment.ts",
-    "run-final-demo": "tsx scripts/run-final-demo.ts",
-    "run-agent-prompt": "tsx scripts/run-agent-prompt.ts",
-    "run-controlled-experiment": "tsx scripts/run-controlled-experiment.ts",
-    "run-visualization-demos": "tsx scripts/run-visualization-demos.ts",
-    "test:plots": "vitest run tests/plots tests/commands/generateExperimentPlotsCommand.spec.ts",
-    "test:visualization-demos": "vitest run tests/visualizationDemos tests/commands/runVisualizationDemosCommand.spec.ts",
-    "verify:benchmarks": "tsx scripts/verify-benchmarks.ts",
-    "verify": "npm run build && npm run test && npm run test:benchmarks && npm run test:report && npm run test:screenshot && npm run test:evaluation && npm run test:agents && npm run test:experiments && npm run test:plots && npm run test:visualization-demos && npm run test:gallery && npm run test:demo && npm run test:integration && npm run test:e2e && npm run verify:benchmarks",
-    "security:deps": "tsx scripts/security/runDependencyChecks.ts",
-    "security:package": "tsx scripts/security/runPackageChecks.ts",
-    "security:codeql": "tsx scripts/security/runCodeql.ts",
-    "security:semgrep": "tsx scripts/security/runSemgrep.ts",
-    "test:security": "vitest run tests/security/",
-    "test:fuzz:smoke": "tsx scripts/security/runFuzzSmoke.ts",
-    "security:validate": "tsx scripts/security/validate.ts",
-    "audit": "tsx scripts/audits/runAudit.ts"
-  },
-  "devDependencies": {
-    "@types/node": "^24.0.0",
-    "playwright": "^1.54.1",
-    "tsx": "^4.20.3",
-    "typescript": "^5.8.3",
-    "vitest": "^3.2.4"
-  },
-  "overrides": {
-    "vite": "7.3.6"
-  },
-  "engines": {
-    "node": ">=20"
-  }
-}
+{
+  "name": "@dailephd/my-dev-kit-lab",
+  "version": "0.3.4",
+  "type": "module",
+  "description": "Evidence, benchmark, and evaluation companion for my-dev-kit.",
+  "bin": {
+    "my-dev-kit-lab": "dist/scripts/run-final-demo.js"
+  },
+  "files": [
+    "dist/scripts/",
+    "!dist/scripts/docs/",
+    "dist/src/",
+    "benchmarks/",
+    "docs/METRICS.md",
+    "examples/",
+    "tests/fixtures/"
+  ],
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/dailephd/my-dev-kit-lab.git"
+  },
+  "homepage": "https://github.com/dailephd/my-dev-kit-lab#readme",
+  "bugs": {
+    "url": "https://github.com/dailephd/my-dev-kit-lab/issues"
+  },
+  "publishConfig": {
+    "access": "public"
+  },
+  "funding": [
+    "https://github.com/sponsors/dailephd",
+    "https://paypal.me/daile88"
+  ],
+  "keywords": [
+    "benchmark",
+    "evaluation",
+    "reporting",
+    "graph-retrieval",
+    "codex",
+    "claude"
+  ],
+  "author": "Dai Le",
+  "license": "MIT",
+  "scripts": {
+    "build": "node scripts/clean-dist.mjs && tsc -p tsconfig.json",
+    "typecheck": "tsc --noEmit",
+    "test": "vitest run",
+    "test:benchmarks": "vitest run tests/benchmarks tests/scripts",
+    "test:report": "vitest run tests/report tests/commands",
+    "test:screenshot": "vitest run tests/screenshot",
+    "test:evaluation": "vitest run tests/core tests/evaluation tests/commands",
+    "test:gallery": "vitest run tests/gallery",
+    "test:demo": "vitest run tests/commands/runLabDemo.spec.ts tests/integration/runLabDemoCommand.spec.ts",
+    "test:integration": "vitest run tests/integration",
+    "test:e2e": "vitest run tests/e2e",
+    "test:agents": "vitest run tests/agents tests/commands/runAgentPromptCommand.spec.ts tests/integration/runAgentPromptFake.spec.ts",
+    "test:experiments": "vitest run tests/evaluation/buildExperimentMatrix.spec.ts tests/evaluation/classifyAgentRunOutcome.spec.ts tests/evaluation/parseAgentAnswer.spec.ts tests/evaluation/scoreCorrectness.spec.ts tests/evaluation/compareExperimentRuns.spec.ts tests/evaluation/runControlledExperiment.spec.ts tests/commands/runControlledExperimentCommand.spec.ts tests/integration/runControlledExperimentFake.spec.ts",
+    "capture-demo-report": "tsx scripts/capture-demo-report.ts",
+    "evaluate-token-savings": "tsx scripts/evaluate-token-savings.ts",
+    "generate-experiment-plots": "tsx scripts/generate-experiment-plots.ts",
+    "generate-prompt-variants": "tsx scripts/generate-prompt-variants.ts",
+    "build-gallery": "tsx scripts/build-gallery.ts",
+    "lab-demo": "tsx scripts/run-lab-demo.ts",
+    "render-experiment-report": "tsx scripts/render-experiment-report.ts",
+    "experiment:list": "tsx scripts/experiments/listExperiments.ts",
+    "experiment:describe": "tsx scripts/experiments/describeExperiment.ts",
+    "experiment:run": "tsx scripts/experiments/runExperiment.ts",
+    "run-final-demo": "tsx scripts/run-final-demo.ts",
+    "run-agent-prompt": "tsx scripts/run-agent-prompt.ts",
+    "run-controlled-experiment": "tsx scripts/run-controlled-experiment.ts",
+    "run-visualization-demos": "tsx scripts/run-visualization-demos.ts",
+    "test:plots": "vitest run tests/plots tests/commands/generateExperimentPlotsCommand.spec.ts",
+    "test:visualization-demos": "vitest run tests/visualizationDemos tests/commands/runVisualizationDemosCommand.spec.ts",
+    "verify:benchmarks": "tsx scripts/verify-benchmarks.ts",
+    "verify": "npm run build && npm run test && npm run test:benchmarks && npm run test:report && npm run test:screenshot && npm run test:evaluation && npm run test:agents && npm run test:experiments && npm run test:plots && npm run test:visualization-demos && npm run test:gallery && npm run test:demo && npm run test:integration && npm run test:e2e && npm run verify:benchmarks",
+    "security:deps": "tsx scripts/security/runDependencyChecks.ts",
+    "security:package": "tsx scripts/security/runPackageChecks.ts",
+    "security:codeql": "tsx scripts/security/runCodeql.ts",
+    "security:semgrep": "tsx scripts/security/runSemgrep.ts",
+    "test:security": "vitest run tests/security/",
+    "test:fuzz:smoke": "tsx scripts/security/runFuzzSmoke.ts",
+    "security:validate": "tsx scripts/security/validate.ts",
+    "audit": "tsx scripts/audits/runAudit.ts"
+  },
+  "devDependencies": {
+    "@types/node": "^24.0.0",
+    "playwright": "^1.54.1",
+    "tsx": "^4.20.3",
+    "typescript": "^5.8.3",
+    "vitest": "^3.2.4"
+  },
+  "overrides": {
+    "vite": "7.3.6"
+  },
+  "engines": {
+    "node": ">=20"
+  }
+}

package/tests/fixtures/audits/mixed-language/mixed-docs-claims/README.md

@@ -0,0 +1,16 @@
+# mixed-docs-claims fixture
+
+Current: this fixture ships `com.example.Widget` (Java) and `com.example.Gadget`
+(Kotlin), matching the classes actually present under `src/main/java` and
+`src/main/kotlin` -- these are current, accurate claims about this fixture's
+own source.
+
+Planned (not yet implemented): Android-specific validation of this project's
+JVM sources is planned for a later `v0.4.x` release track.
+
+Out of scope: this fixture's `build.gradle.kts` is never executed by Gradle,
+and `pom.xml`-style Maven execution is not performed against this project --
+static classification only.
+
+Future (not yet implemented): a combined `quality`, `project`, or `all`
+audit type covering this fixture does not exist yet.

package/tests/fixtures/audits/mixed-language/mixed-docs-claims/build.gradle.kts

@@ -0,0 +1,4 @@
+plugins {
+    id("java")
+    kotlin("jvm") version "1.9.0"
+}

package/tests/fixtures/audits/mixed-language/mixed-docs-claims/src/main/java/com/example/Widget.java

@@ -0,0 +1,7 @@
+package com.example;
+
+public class Widget {
+    public String label() {
+        return "widget";
+    }
+}

package/tests/fixtures/audits/mixed-language/mixed-docs-claims/src/main/kotlin/com/example/Gadget.kt

@@ -0,0 +1,7 @@
+package com.example
+
+class Gadget {
+    fun label(): String {
+        return "gadget"
+    }
+}

package/tests/fixtures/audits/mixed-language/mixed-generated-vendor/README.md

@@ -0,0 +1,10 @@
+# mixed-generated-vendor fixture
+
+Current: a single real source file (`src/index.ts`) alongside
+`generated/schema.ts`, `dist/index.js`, `build/Main.class`, and
+`vendor/lib.py` -- files that live under path segments the existing
+`projectInventory.ts` policy already classifies as generated/build-output/
+vendor. Used to prove those files do not pollute source-facts collection
+(role stays generated/build-output/vendor, not source/test) and are excluded
+from `SourceFactsSnapshot.files` the same way `sourceFacts.test.ts`'s
+existing vendor/generated test already proves for a single language.

package/tests/fixtures/audits/mixed-language/mixed-generated-vendor/build/Main.class

@@ -0,0 +1 @@
+binary-placeholder

package/tests/fixtures/audits/mixed-language/mixed-generated-vendor/dist/index.js

@@ -0,0 +1 @@
+module.exports = { identity: (v) => v };

package/tests/fixtures/audits/mixed-language/mixed-generated-vendor/generated/schema.ts

@@ -0,0 +1 @@
+export type GeneratedSchema = { id: string };

package/tests/fixtures/audits/mixed-language/mixed-generated-vendor/src/index.ts

@@ -0,0 +1,3 @@
+export function identity<T>(value: T): T {
+  return value;
+}

package/tests/fixtures/audits/mixed-language/mixed-generated-vendor/vendor/lib.py

@@ -0,0 +1,2 @@
+def vendored():
+    return "vendored"

package/tests/fixtures/audits/mixed-language/mixed-java-kotlin/README.md

@@ -0,0 +1,10 @@
+# mixed-java-kotlin fixture
+
+Current: a conventional Gradle Kotlin DSL JVM project layout with one Java
+class (`src/main/java/com/example/FooService.java`), one Kotlin class
+(`src/main/kotlin/com/example/BarService.kt`), and matching test classes
+under `src/test/java` and `src/test/kotlin`. `build.gradle.kts` and
+`settings.gradle.kts` are present to prove Gradle Kotlin DSL build scripts
+are classified as config, not Kotlin source. Used to prove Java and Kotlin
+source facts coexist in one JVM-style project without disrupting each
+other's declarations or role classification.

package/tests/fixtures/audits/mixed-language/mixed-java-kotlin/build.gradle.kts

@@ -0,0 +1,8 @@
+plugins {
+    id("java")
+    kotlin("jvm") version "1.9.0"
+}
+
+repositories {
+    mavenCentral()
+}

package/tests/fixtures/audits/mixed-language/mixed-java-kotlin/settings.gradle.kts

@@ -0,0 +1 @@
+rootProject.name = "mixed-java-kotlin-fixture"

package/tests/fixtures/audits/mixed-language/mixed-java-kotlin/src/main/java/com/example/FooService.java

@@ -0,0 +1,7 @@
+package com.example;
+
+public class FooService {
+    public String greet(String name) {
+        return "Hello, " + name;
+    }
+}

package/tests/fixtures/audits/mixed-language/mixed-java-kotlin/src/main/kotlin/com/example/BarService.kt

@@ -0,0 +1,7 @@
+package com.example
+
+class BarService {
+    fun greet(name: String): String {
+        return "Hello, $name"
+    }
+}

package/tests/fixtures/audits/mixed-language/mixed-java-kotlin/src/test/java/com/example/FooServiceTest.java

@@ -0,0 +1,8 @@
+package com.example;
+
+public class FooServiceTest {
+    public void testGreet() {
+        FooService service = new FooService();
+        assert service.greet("world").equals("Hello, world");
+    }
+}

package/tests/fixtures/audits/mixed-language/mixed-java-kotlin/src/test/kotlin/com/example/BarServiceTest.kt

@@ -0,0 +1,8 @@
+package com.example
+
+class BarServiceTest {
+    fun testGreet() {
+        val service = BarService()
+        assert(service.greet("world") == "Hello, world")
+    }
+}

package/tests/fixtures/audits/mixed-language/mixed-python-ts/README.md

@@ -0,0 +1,8 @@
+# mixed-python-ts fixture
+
+Current: a Python module (`src/app.py`) and a TypeScript module
+(`src/index.ts`) that both declare an equivalent `add` function/declaration,
+plus one Python test file. Used to prove Python and TypeScript source facts
+coexist without schema or ordering drift, and that a duplicate-name
+declaration across languages is not merged into a single cross-language
+candidate.

package/tests/fixtures/audits/mixed-language/mixed-python-ts/src/app.py

@@ -0,0 +1,7 @@
+def add(a, b):
+    return a + b
+
+
+class Calculator:
+    def compute(self, a, b):
+        return add(a, b)

package/tests/fixtures/audits/mixed-language/mixed-python-ts/src/index.ts

@@ -0,0 +1,3 @@
+export function add(a: number, b: number): number {
+  return a + b;
+}

package/tests/fixtures/audits/mixed-language/mixed-python-ts/tests/test_app.py

@@ -0,0 +1,5 @@
+from src.app import add
+
+
+def test_add():
+    assert add(1, 2) == 3

package/tests/fixtures/audits/mixed-language/mixed-ts-js/README.md

@@ -0,0 +1,7 @@
+# mixed-ts-js fixture
+
+Current: a minimal TypeScript entrypoint (`src/index.ts`) calling a plain
+JavaScript helper (`src/helper.js`), with one test file. Used by
+`tests/audits/mixedLanguageSourceFacts.test.ts` to prove TypeScript and
+JavaScript files coexist in a single source-facts collection without schema
+or ordering drift.

package/tests/fixtures/audits/mixed-language/mixed-ts-js/src/helper.js

@@ -0,0 +1,5 @@
+function greet(name) {
+  return "Hello, " + name;
+}
+
+module.exports = { greet };

package/tests/fixtures/audits/mixed-language/mixed-ts-js/src/index.ts

@@ -0,0 +1,3 @@
+export function main(name: string): string {
+  return `Hello, ${name}`;
+}

package/tests/fixtures/audits/mixed-language/mixed-ts-js/tests/index.sample.ts

@@ -0,0 +1,5 @@
+import { main } from "../src/index.js";
+
+test("main returns a greeting", () => {
+  expect(main("world")).toContain("world");
+});

package/tests/fixtures/audits/mixed-language/mixed-ts-python-jvm/README.md

@@ -0,0 +1,10 @@
+# mixed-ts-python-jvm fixture
+
+Current: TypeScript, JavaScript, Python, Java, and Kotlin source files
+coexisting in one target, plus a `build.gradle.kts` JVM metadata file. Used
+to prove all currently-supported language families (v0.3.3 baseline) can be
+collected together without crashing, without cross-language schema drift,
+and without one analyzer's output disturbing another's.
+
+Planned (not implemented): Android-specific source-set validation and
+manual pentest coverage are out of scope for this fixture and for v0.3.4.

package/tests/fixtures/audits/mixed-language/mixed-ts-python-jvm/build.gradle.kts

@@ -0,0 +1,4 @@
+plugins {
+    id("java")
+    kotlin("jvm") version "1.9.0"
+}

package/tests/fixtures/audits/mixed-language/mixed-ts-python-jvm/pytests/test_app.py

@@ -0,0 +1,5 @@
+from src.app import multiply
+
+
+def test_multiply():
+    assert multiply(2, 3) == 6

package/tests/fixtures/audits/mixed-language/mixed-ts-python-jvm/src/app.py

@@ -0,0 +1,2 @@
+def multiply(a, b):
+    return a * b

package/tests/fixtures/audits/mixed-language/mixed-ts-python-jvm/src/helper.js

@@ -0,0 +1,5 @@
+function double(x) {
+  return x * 2;
+}
+
+module.exports = { double };

package/tests/fixtures/audits/mixed-language/mixed-ts-python-jvm/src/index.ts

@@ -0,0 +1,3 @@
+export function multiply(a: number, b: number): number {
+  return a * b;
+}

package/tests/fixtures/audits/mixed-language/mixed-ts-python-jvm/src/main/java/com/example/Multiplier.java

@@ -0,0 +1,7 @@
+package com.example;
+
+public class Multiplier {
+    public int multiply(int a, int b) {
+        return a * b;
+    }
+}

package/tests/fixtures/audits/mixed-language/mixed-ts-python-jvm/src/main/kotlin/com/example/Divider.kt

@@ -0,0 +1,7 @@
+package com.example
+
+class Divider {
+    fun divide(a: Int, b: Int): Int {
+        return a / b
+    }
+}