@dailephd/my-dev-kit-lab 0.4.5 → 0.4.6

package/dist/src/commands/runSecurityValidationCommand.js

@@ -0,0 +1,271 @@
+import path from "node:path";
+import { runSecurityValidation } from "../securityValidation/validate/runSecurityValidation.js";
+import { resolveValidationTarget, reportFilenamePrefix } from "../securityValidation/validate/resolveTarget.js";
+import { buildSecurityReportFromSummary } from "../securityValidation/report/buildSecurityReport.js";
+import { renderTextReport } from "../securityValidation/report/renderSecurityReport.js";
+import { writeSecurityReportFiles } from "../securityValidation/report/writeSecurityReportFiles.js";
+import { parseSecurityValidateArgs, normalizeSecurityValidateConfig, applyProfileDefaultChecksIfApplicable } from "../securityValidation/validate/cliOptions.js";
+import { resolveAttackProfile } from "../securityValidation/attackScenarios/attackProfile.js";
+import { findingsBreachFailOnThreshold } from "../securityValidation/validate/verdict.js";
+import { validateAndroidTarget } from "../mobile/android/validate/validateAndroidTarget.js";
+import { toAndroidReportModel } from "../mobile/android/report/model.js";
+import { renderAndroidTextReport } from "../mobile/android/report/renderAndroidReport.js";
+import { writeAndroidReportFiles } from "../mobile/android/report/writeAndroidReportFiles.js";
+import { createLabExecutionContext } from "../runtime/index.js";
+// ---------------------------------------------------------------------------
+// v0.4.6 Batch 4 -- reusable security-validation command owner.
+//
+// Extracted from scripts/security/validate.ts (formerly a top-level script
+// with inline try/catch + process.exit()) so both the contributor npm script
+// and the installed CLI router (src/cli/) call the same argument-parsing/
+// target-resolution/report-writing/exit-mapping path. Mirrors the audit
+// command extraction in src/commands/runAuditCommand.ts (Batch 3). Detector/
+// verdict/severity policy, the Android validator, and the classic check
+// pipeline are untouched -- this module only owns CLI wiring.
+// ---------------------------------------------------------------------------
+export const SECURITY_VALIDATE_USAGE = "Usage: my-dev-kit-lab security validate [--target <path>] [--out <dir>] [--report-prefix <name>] " +
+    "[--checks deps,package,static,cli-adversarial,fuzz,boundary,subprocess,secrets,network] " +
+    "[--profile node-cli-package|local-tool|npm-package|android] [--format text,json] [--fail-on blocker|high|medium|low] " +
+    "[--android-gradle-operations wrapper-version,tasks,assemble-debug,unit-test-debug,lint-debug] " +
+    "[--android-external-tools semgrep,osv,android-lint,dependency-check] " +
+    "[--android-external-network deny|allow-requested]\n" +
+    "\n" +
+    "Android profile:\n" +
+    "  --profile android performs static, read-only Android project detection, manifest parsing,\n" +
+    "  permission/exported-component/intent-filter/deep-link audits, static Gradle metadata\n" +
+    "  extraction, and (as of v0.4.1 Batch 8) eleven internal advanced security checks (network\n" +
+    "  security config, backup/release configuration, hardcoded secrets, signing configuration,\n" +
+    "  WebView, FileProvider, sensitive storage/logging, clipboard, and Firebase/Google services).\n" +
+    "  Gradle and external tools are never executed by default.\n" +
+    "  --android-gradle-operations explicitly opts into running ONLY the listed allowlisted Gradle\n" +
+    "  operations (wrapper-version, tasks, assemble-debug, unit-test-debug, lint-debug) via the\n" +
+    "  project's own Gradle wrapper. Arbitrary Gradle tasks cannot be passed. This option is only\n" +
+    "  valid together with --profile android.\n" +
+    "  --android-external-tools explicitly opts into running ONLY the listed allowlisted optional\n" +
+    "  external security tools (semgrep, osv, android-lint, dependency-check). No arbitrary tool\n" +
+    "  names, commands, or arguments can be passed. This option is only valid together with\n" +
+    "  --profile android.\n" +
+    "  --android-external-network controls whether a requested tool may use network access.\n" +
+    "  Defaults to deny (osv is skipped unless supported offline data is available; semgrep,\n" +
+    "  android-lint, and dependency-check always run offline/no-update regardless of this flag).\n" +
+    "  allow-requested authorizes network only for an explicitly requested tool whose Batch 7\n" +
+    "  contract supports it (currently only osv). This option is only valid together with\n" +
+    "  --profile android.\n" +
+    "  Example: my-dev-kit-lab security validate --target \"<android-project-path>\" --profile android\n" +
+    "  Example: my-dev-kit-lab security validate --target \"<android-project-path>\" --profile android --android-gradle-operations wrapper-version,tasks\n" +
+    "  Example: my-dev-kit-lab security validate --target \"<android-project-path>\" --profile android --android-external-tools semgrep,android-lint\n" +
+    "  Example: my-dev-kit-lab security validate --target \"<android-project-path>\" --profile android --android-external-tools osv --android-external-network allow-requested";
+export async function runSecurityValidationCommandFromArgs(argv, options = {}) {
+    const context = options.context ?? createLabExecutionContext();
+    const toolRoot = context.packageRoot;
+    const defaultOutRoot = options.defaultOutRoot ?? toolRoot;
+    // Help deliberately wins over every other argument. It must remain a
+    // no-work path: no target/default resolution, option normalization, report
+    // directory creation, validation orchestration, or subprocess execution.
+    if (argv.includes("--help") || argv.includes("-h")) {
+        console.log(SECURITY_VALIDATE_USAGE);
+        return 0;
+    }
+    let args;
+    let config;
+    try {
+        args = parseSecurityValidateArgs(argv);
+        config = normalizeSecurityValidateConfig(args, defaultOutRoot);
+        // v0.2.2 Batch 5: --profile with no --checks uses that profile's declared
+        // default checks. No-op unless the user passed --profile without --checks
+        // (see applyProfileDefaultChecksIfApplicable's guard) -- the true no-flag
+        // case and any explicit --checks case are always unaffected. Skipped for
+        // "android": that profile does not use the classic --checks pipeline.
+        if (config.profile !== "android") {
+            config = applyProfileDefaultChecksIfApplicable(config, resolveAttackProfile(config.profile).defaultCheckIds);
+        }
+    }
+    catch (err) {
+        const msg = err instanceof Error ? err.message : String(err);
+        console.error(`\nERROR: ${msg}`);
+        console.error(SECURITY_VALIDATE_USAGE);
+        return 2;
+    }
+    // Resolve and validate target early so we can fail fast with a clean error.
+    let target;
+    try {
+        target = resolveValidationTarget(args.target, toolRoot);
+    }
+    catch (err) {
+        const msg = err instanceof Error ? err.message : String(err);
+        console.error(`\nERROR: ${msg}`);
+        console.error(SECURITY_VALIDATE_USAGE);
+        return 1;
+    }
+    console.log("=".repeat(60));
+    console.log("my-dev-kit-lab security:validate");
+    console.log("=".repeat(60));
+    console.log(`Tool root  : ${toolRoot}`);
+    if (!target.isSelf) {
+        console.log(`Target     : ${target.targetRoot}`);
+        if (target.packageName)
+            console.log(`Package    : ${target.packageName}${target.packageVersion ? `@${target.packageVersion}` : ""}`);
+    }
+    else {
+        console.log(`Mode       : self-validation`);
+    }
+    console.log(`Profile    : ${config.profile}`);
+    // ---------------------------------------------------------------------------
+    // v0.4.0 Batch 5 -- Android profile path.
+    //
+    // A separate orchestrator (not the classic check-group/attack-scenario
+    // pipeline below) because the Android check/finding/status vocabulary
+    // established in Batches 1-4 does not fit SecurityCheckId/SecurityCheckResult.
+    // Same command, same --profile flag, same reports/security/ output root.
+    // ---------------------------------------------------------------------------
+    if (config.profile === "android") {
+        if (config.androidGradleOperationIds.length > 0) {
+            console.log(`Gradle ops : ${config.androidGradleOperationIds.join(", ")} (explicitly requested — will execute via the target's Gradle wrapper)`);
+        }
+        else {
+            console.log(`Gradle ops : (none requested — static-only validation, zero Gradle process execution)`);
+        }
+        // v0.4.1 Batch 8 -- external tools remain explicit opt-in, mirroring Gradle
+        // operations exactly. "allow-requested" (the CLI-facing value) maps to the
+        // Batch 7 dispatcher's "allow-for-requested-tool" network policy value.
+        const externalNetworkPolicy = config.androidExternalNetworkPolicy === "allow-requested" ? "allow-for-requested-tool" : "deny";
+        if (config.androidExternalToolIds.length > 0) {
+            console.log(`External   : ${config.androidExternalToolIds.join(", ")} (explicitly requested — network policy: ${config.androidExternalNetworkPolicy})`);
+        }
+        else {
+            console.log(`External   : (none requested — zero external-tool process execution)`);
+        }
+        console.log("");
+        const reportsDir = config.out;
+        let result;
+        try {
+            result = await validateAndroidTarget({
+                toolRoot,
+                targetPath: args.target,
+                requestedGradleOperationIds: config.androidGradleOperationIds,
+                requestedExternalToolIds: config.androidExternalToolIds,
+                externalNetworkPolicy: externalNetworkPolicy,
+                externalToolArtifactRoot: path.join(reportsDir, "external-tools")
+            });
+        }
+        catch (err) {
+            const msg = err instanceof Error ? err.message : String(err);
+            console.error(`\nERROR: Android validation failed to run: ${msg}`);
+            return 3;
+        }
+        const reportModel = toAndroidReportModel(result, {
+            profile: config.profile,
+            requestedGradleOperations: config.androidGradleOperationIds,
+            requestedExternalTools: config.androidExternalToolIds,
+            externalNetworkPolicy: config.androidExternalNetworkPolicy
+        });
+        const textReport = renderAndroidTextReport(reportModel);
+        const prefix = args.reportPrefix ??
+            reportFilenamePrefix({
+                isSelf: result.target.local.isSelf,
+                packageName: result.target.local.packageName,
+                packageVersion: result.target.local.packageVersion,
+                targetRoot: result.target.local.targetRoot
+            });
+        let writtenPaths;
+        try {
+            ({ writtenPaths } = writeAndroidReportFiles({ outDir: reportsDir, prefix, report: reportModel, formats: config.formats }));
+        }
+        catch (err) {
+            const msg = err instanceof Error ? err.message : String(err);
+            console.error(`\nERROR: Failed to write Android report files: ${msg}`);
+            console.error("Validation completed but the report could not be written. The in-memory result was not persisted.");
+            return 4;
+        }
+        console.log(textReport);
+        console.log(`\nReports written:`);
+        for (const p of writtenPaths) {
+            console.log(`  ${p}`);
+        }
+        const blockerExists = result.verdict === "not-ready-security-blocker-remains";
+        const inconclusive = result.verdict === "inconclusive-audit-environment-incomplete";
+        if (blockerExists) {
+            console.error("\nExit 1 — security blocker remains.");
+            return 1;
+        }
+        else if (inconclusive) {
+            console.warn("\nExit 2 — android environment incomplete.");
+            return 2;
+        }
+        else {
+            console.log("\nExit 0 — validation completed.");
+            return 0;
+        }
+    }
+    // ---------------------------------------------------------------------------
+    // Classic check-group/attack-scenario pipeline (unchanged from prior versions).
+    // ---------------------------------------------------------------------------
+    if (!config.checksWereDefault) {
+        console.log(`Checks     : ${config.checks.join(", ")}`);
+    }
+    if (config.plannedChecksRequested.length > 0) {
+        console.log(`Note       : ${config.plannedChecksRequested.join(", ")} are routed through the attack-scenario framework rather than the classic check-group runners. Review the attack-scenario section in the report for their concrete results.`);
+    }
+    console.log("");
+    const summary = await runSecurityValidation({
+        cwd: toolRoot,
+        targetPath: args.target,
+        fuzzIterations: parseInt(process.env["FUZZ_ITERATIONS"] ?? "50", 10),
+        fuzzSeed: parseInt(process.env["FUZZ_SEED"] ?? "0xDEADBEEF", 16),
+        // Full selection (implemented + planned/attack-scenario ids) -- the runner
+        // gates both implemented check groups and attack-scenario checks off the
+        // same selectedChecks set.
+        selectedChecks: config.checks,
+        profile: config.profile
+    });
+    // v0.2.2 Batch 5: --fail-on breach is additive to (never a substitute for)
+    // the existing verdict-based exit decision below -- it can only escalate
+    // exit 0 to exit 1 (e.g. --fail-on medium/low catching minor/informational
+    // findings the verdict policy doesn't already treat as blocking), never
+    // downgrade an existing blocker.
+    const failOnBreached = findingsBreachFailOnThreshold(summary.findings, config.failOnThreshold);
+    // Build report object
+    const report = buildSecurityReportFromSummary(summary, {
+        profile: config.profile,
+        selectedChecks: config.checks,
+        failOnThreshold: config.failOnThreshold,
+        formats: config.formats,
+        failOnBreached
+    });
+    const textReport = renderTextReport(report);
+    // Determine output directory
+    const reportsDir = config.out;
+    // Determine report filename prefix
+    const prefix = args.reportPrefix ?? reportFilenamePrefix(target);
+    const { writtenPaths } = writeSecurityReportFiles({
+        outDir: reportsDir,
+        prefix,
+        report,
+        formats: config.formats
+    });
+    // Print report to stdout
+    console.log(textReport);
+    console.log(`\nReports written:`);
+    for (const p of writtenPaths) {
+        console.log(`  ${p}`);
+    }
+    // Exit code based on verdict, escalated (never downgraded) by --fail-on.
+    const blockerExists = summary.verdict === "not-ready-security-blocker-remains";
+    const inconclusive = summary.verdict === "inconclusive-audit-environment-incomplete";
+    if (blockerExists) {
+        console.error("\nExit 1 — security blocker remains.");
+        return 1;
+    }
+    else if (inconclusive) {
+        console.warn("\nExit 2 — audit environment incomplete.");
+        return 2;
+    }
+    else if (failOnBreached) {
+        console.error(`\nExit 1 — --fail-on ${config.failOnThreshold} threshold breached.`);
+        return 1;
+    }
+    else {
+        console.log("\nExit 0 — validation completed.");
+        return 0;
+    }
+}

package/dist/src/runtime/index.js

@@ -0,0 +1,3 @@
+export * from "./packageRoot.js";
+export * from "./labExecutionContext.js";
+export * from "./packageResource.js";

package/dist/src/runtime/labExecutionContext.js

@@ -0,0 +1,22 @@
+import os from "node:os";
+import path from "node:path";
+import { discoverPackageRoot } from "./packageRoot.js";
+const DEFAULT_WORKSPACE_DIR_NAME = ".my-dev-kit-lab";
+export function createLabExecutionContext(options = {}) {
+    const invocationCwd = path.resolve(options.invocationCwd ?? process.cwd());
+    const packageRoot = path.resolve(options.packageRoot ?? discoverPackageRoot());
+    const workspaceRoot = resolveWorkspaceRoot(options.workspaceRoot, invocationCwd);
+    const resourceRoot = packageRoot;
+    return Object.freeze({
+        invocationCwd,
+        packageRoot,
+        workspaceRoot,
+        resourceRoot
+    });
+}
+function resolveWorkspaceRoot(explicitWorkspaceRoot, invocationCwd) {
+    if (!explicitWorkspaceRoot) {
+        return path.join(os.homedir(), DEFAULT_WORKSPACE_DIR_NAME);
+    }
+    return path.resolve(path.isAbsolute(explicitWorkspaceRoot) ? explicitWorkspaceRoot : path.resolve(invocationCwd, explicitWorkspaceRoot));
+}

package/dist/src/runtime/packageResource.js

@@ -0,0 +1,22 @@
+import { existsSync } from "node:fs";
+import path from "node:path";
+import { resolveWithinRoot } from "../core/pathSafety.js";
+/**
+ * Safely resolves a package-relative path (e.g. "benchmarks/contracts/foo.json")
+ * against resourceRoot. Rejects empty/absolute/traversal inputs and missing files
+ * so command owners never depend on process.cwd() to find bundled resources.
+ */
+export function resolvePackageResource(contextOrResourceRoot, resourceRelativePath) {
+    const resourceRoot = typeof contextOrResourceRoot === "string" ? contextOrResourceRoot : contextOrResourceRoot.resourceRoot;
+    if (!resourceRelativePath || resourceRelativePath.trim().length === 0) {
+        throw new Error("Package resource path must not be empty.");
+    }
+    if (path.isAbsolute(resourceRelativePath)) {
+        throw new Error(`Package resource path must be relative, not absolute: ${resourceRelativePath}`);
+    }
+    const resolvedPath = resolveWithinRoot(resourceRoot, resourceRelativePath);
+    if (!existsSync(resolvedPath)) {
+        throw new Error(`Required package resource not found: ${resourceRelativePath} (resolved: ${resolvedPath})`);
+    }
+    return resolvedPath;
+}

package/dist/src/runtime/packageRoot.js

@@ -0,0 +1,37 @@
+import { existsSync, readFileSync } from "node:fs";
+import path from "node:path";
+import { fileURLToPath } from "node:url";
+const PACKAGE_NAME = "@dailephd/my-dev-kit-lab";
+/**
+ * Walks upward from the executing module's location (not process.cwd()) until it
+ * finds the package.json that declares PACKAGE_NAME, so this resolves correctly
+ * from a source checkout, compiled dist output, or an installed node_modules copy.
+ */
+export function discoverPackageRoot(startDir) {
+    const start = path.resolve(startDir ?? path.dirname(fileURLToPath(import.meta.url)));
+    let current = start;
+    while (true) {
+        const candidatePackageJson = path.join(current, "package.json");
+        if (existsSync(candidatePackageJson)) {
+            const name = readPackageName(candidatePackageJson);
+            if (name === PACKAGE_NAME) {
+                return current;
+            }
+        }
+        const parent = path.dirname(current);
+        if (parent === current) {
+            break;
+        }
+        current = parent;
+    }
+    throw new Error(`Unable to locate the "${PACKAGE_NAME}" package root by walking up from ${start}.`);
+}
+function readPackageName(packageJsonPath) {
+    try {
+        const parsed = JSON.parse(readFileSync(packageJsonPath, "utf8"));
+        return typeof parsed.name === "string" ? parsed.name : undefined;
+    }
+    catch {
+        return undefined;
+    }
+}

package/dist/src/securityValidation/packageChecks/requiredPackageContents.js

@@ -2,9 +2,22 @@ export const REQUIRED_PACKAGE_CONTENTS = [
     "CHANGELOG.md",
     "LICENSE",
     "README.md",
+    "package.json",
+    // Public bin target (installed CLI router entrypoint).
+    "dist/scripts/cli.js",
+    // Legacy final-demo bin-target compatibility (pre-v0.4.6 package.json bin).
     "dist/scripts/run-final-demo.js",
+    // Compiled runtime the installed CLI router and its shared command owners
+    // depend on.
     "dist/src/index.js",
-    "package.json",
+    "dist/src/cli/runLabCli.js",
+    "dist/src/runtime/labExecutionContext.js",
+    "dist/src/runtime/packageRoot.js",
+    "dist/src/runtime/packageResource.js",
+    // Bundled runtime resources public installed commands read by default
+    // (experiment run/controlled, demo final, legacy final-demo invocation).
+    "benchmarks/contracts/benchmark-project-profiles.json",
+    "examples/token-savings-cases.json",
 ];
 function normalizeTarballPath(file) {
     const normalized = file.replace(/\\/g, "/");

package/package.json

@@ -1,20 +1,19 @@
 {
   "name": "@dailephd/my-dev-kit-lab",
-  "version": "0.4.5",
+  "version": "0.4.6",
   "type": "module",
   "description": "Evidence, benchmark, and evaluation companion for my-dev-kit.",
   "bin": {
-    "my-dev-kit-lab": "dist/scripts/run-final-demo.js"
+    "my-dev-kit-lab": "dist/scripts/cli.js"
   },
   "files": [
     "CHANGELOG.md",
-    "dist/scripts/",
-    "!dist/scripts/docs/",
+    "dist/scripts/cli.js",
+    "dist/scripts/run-final-demo.js",
     "dist/src/",
     "benchmarks/",
     "docs/METRICS.md",
-    "examples/",
-    "tests/fixtures/"
+    "examples/token-savings-cases.json"
   ],
   "repository": {
     "type": "git",
@@ -72,6 +71,7 @@
     "test:plots": "vitest run tests/plots tests/commands/generateExperimentPlotsCommand.spec.ts",
     "test:visualization-demos": "vitest run tests/visualizationDemos tests/commands/runVisualizationDemosCommand.spec.ts",
     "verify:benchmarks": "tsx scripts/verify-benchmarks.ts",
+    "verify:packed-package": "node scripts/verify-packed-package.mjs",
     "docs:check": "node scripts/check-docs.mjs",
     "verify": "npm run build && npm run verify:benchmarks",
     "security:deps": "tsx scripts/security/runDependencyChecks.ts",
@@ -95,6 +95,6 @@
     "vite": "7.3.6"
   },
   "engines": {
-    "node": ">=20"
+    "node": ">=24"
   }
 }

package/dist/scripts/audits/runAudit.js

@@ -1,135 +0,0 @@
-#!/usr/bin/env node
-import { parseAuditArgs, normalizeAuditConfig } from "../../src/audits/core/auditConfig.js";
-import { resolveAuditTarget } from "../../src/audits/core/auditTarget.js";
-import { runAudit } from "../../src/audits/core/auditRunner.js";
-import { AUDIT_EXIT_CODES } from "../../src/audits/core/auditExitCode.js";
-import { resolveToolRoot } from "../security/resolveToolRoot.js";
-import { buildAuditReportModel } from "../../src/audits/report/auditReportModel.js";
-import { writeAuditReports } from "../../src/audits/report/writeAuditReports.js";
-// ---------------------------------------------------------------------------
-// v0.3.0 Batch 5 -- npm run audit entrypoint.
-//
-// Thin wiring only: parse args -> normalize config -> resolve target ->
-// runAudit() -> buildAuditReportModel() -> writeAuditReports() -> print a
-// concise console summary -> set process.exitCode. All report-shaping logic
-// (the former inline buildJsonReport()/renderMinimalTextSummary()/
-// summarizeInventory()/summarizeSourceOfTruth() functions from Batch 1/2)
-// now lives in src/audits/report/ -- see auditReportModel.ts,
-// renderAuditJsonReport.ts, renderAuditTextReport.ts, writeAuditReports.ts.
-// Mirrors the structure of scripts/security/validate.ts.
-// ---------------------------------------------------------------------------
-const USAGE = "Usage: npm run audit -- [--target <path>] [--types code-rot,security] " +
-    "[--include docs,tests,package,architecture,cli] [--format text,json] " +
-    "[--fail-on blocker|high|medium|low|none] [--out <path>] [--android]\n" +
-    "\n" +
-    "  --android opts into Batch 2's programmatic Android security integration.\n" +
-    "  Requires --types to include \"security\" (e.g. --types security or --types\n" +
-    "  code-rot,security). Runs the same static, read-only, nineteen-check\n" +
-    "  Android validation security:validate --profile android performs --\n" +
-    "  detection, manifest parsing, and internal advanced security checks --\n" +
-    "  through the existing security adapter, never a subprocess. Confirmed\n" +
-    "  findings are mapped into the normal issue collection; CandidateEvidence\n" +
-    "  remains a separate, bounded summary and is never treated as a confirmed\n" +
-    "  issue. Starts zero Gradle operations, zero external tools, and zero\n" +
-    "  network operations by default; --android does not expose any of those.\n" +
-    "  Example: npm run audit -- --target \"<android-project-path>\" --types security --android --format text,json --fail-on none";
-const rawArgs = process.argv.slice(2);
-const toolRoot = resolveToolRoot(import.meta.url);
-// Help deliberately wins over every other argument, mirroring
-// scripts/security/validate.ts -- no config normalization, target
-// resolution, audit execution, or report write.
-if (rawArgs.includes("--help") || rawArgs.includes("-h")) {
-    console.log(USAGE);
-    process.exitCode = 0;
-    process.exit(0);
-}
-let config;
-try {
-    const args = parseAuditArgs(rawArgs);
-    config = normalizeAuditConfig(args, toolRoot);
-}
-catch (err) {
-    const msg = err instanceof Error ? err.message : String(err);
-    console.error(`\nERROR: ${msg}`);
-    console.error(USAGE);
-    process.exitCode = AUDIT_EXIT_CODES.FATAL_ERROR;
-    process.exit(AUDIT_EXIT_CODES.FATAL_ERROR);
-}
-let target;
-try {
-    target = resolveAuditTarget(config.targetPathArg, toolRoot);
-}
-catch (err) {
-    const msg = err instanceof Error ? err.message : String(err);
-    console.error(`\nERROR: ${msg}`);
-    console.error(USAGE);
-    process.exitCode = AUDIT_EXIT_CODES.FATAL_ERROR;
-    process.exit(AUDIT_EXIT_CODES.FATAL_ERROR);
-}
-console.log("=".repeat(60));
-console.log("my-dev-kit-lab audit");
-console.log("=".repeat(60));
-console.log(`Tool root  : ${toolRoot}`);
-if (!target.isSelf) {
-    console.log(`Target     : ${target.rootPath}`);
-}
-else {
-    console.log(`Mode       : self-audit`);
-}
-console.log(`Types      : ${config.types.join(", ")}`);
-console.log(`Include    : ${config.include.join(", ")}`);
-console.log("");
-let result;
-try {
-    result = await runAudit({ config, toolRoot, target });
-}
-catch (err) {
-    const msg = err instanceof Error ? err.message : String(err);
-    console.error(`\nERROR: audit runtime failure: ${msg}`);
-    process.exitCode = AUDIT_EXIT_CODES.FATAL_ERROR;
-    process.exit(AUDIT_EXIT_CODES.FATAL_ERROR);
-}
-const model = buildAuditReportModel(result, { target });
-const { writtenPaths } = writeAuditReports({ model, config, outDir: config.out });
-console.log(`Issues found        : ${model.summary.totalIssues}`);
-console.log(`  blocker=${model.summary.issuesBySeverity.blocker} high=${model.summary.issuesBySeverity.high} medium=${model.summary.issuesBySeverity.medium} low=${model.summary.issuesBySeverity.low} info=${model.summary.issuesBySeverity.info}`);
-console.log(`Skipped detectors    : ${model.summary.skippedDetectorCount}`);
-if (model.summary.detectorErrorCount > 0) {
-    console.log(`Detector errors      : ${model.summary.detectorErrorCount}`);
-    for (const e of model.detectorErrors) {
-        console.log(`  [${e.id}] ${e.message}`);
-    }
-}
-if (model.summary.noDetectorsRegistered && !model.securitySummary.ran) {
-    console.log(`Note: no code-rot detectors are registered for this run's --types/--include selection -- this run collected inventory/source-of-truth data only.`);
-}
-if (model.securitySummary.ran) {
-    console.log(`\nSecurity validation: verdict=${model.securitySummary.verdictLabel} checks=${model.securitySummary.totalChecks} findings(blocker=${model.securitySummary.findingCounts.blocker} major=${model.securitySummary.findingCounts.major} minor=${model.securitySummary.findingCounts.minor} info=${model.securitySummary.findingCounts.informational})`);
-    if (model.securitySummary.reportPaths.text) {
-        console.log(`  Full report: ${model.securitySummary.reportPaths.text}`);
-    }
-}
-if (model.androidSecurity.summary.requested) {
-    const android = model.androidSecurity.summary;
-    console.log(`\nAndroid security validation: status=${android.status} applicable=${android.applicable ?? "n/a"} verdict=${android.verdict ?? "(unknown)"} checks=${android.totalChecks} confirmed=${android.confirmedFindingCount} mappedIssues=${android.mappedIssueCount} candidates=${android.candidateSummary.totalCount}`);
-    if (android.reportPaths.text) {
-        console.log(`  Full report: ${android.reportPaths.text}`);
-    }
-}
-console.log(`\nInventory: ${model.inventory.totalScannedFileCount} file(s) scanned, ${model.inventory.skippedFileCount} skipped`);
-console.log(`  source=${model.inventory.filesByCategory.source} tests=${model.inventory.filesByCategory.tests} docs=${model.inventory.filesByCategory.docs} package=${model.inventory.filesByCategory.package} config=${model.inventory.filesByCategory.config} scripts=${model.inventory.filesByCategory.scripts} ci=${model.inventory.filesByCategory.ci}`);
-console.log(`Source of truth: package=${model.sourceOfTruth.packageName ?? "(none)"}@${model.sourceOfTruth.packageVersion ?? "?"} readme=${model.sourceOfTruth.hasReadme} changelog=${model.sourceOfTruth.hasChangelog} ciWorkflows=${model.sourceOfTruth.ciWorkflowCount}`);
-console.log(`Source facts: ${model.sourceFacts.totalFilesAnalyzed} file(s) analyzed (parsed=${model.sourceFacts.filesByParseStatus.parsed} file-level-only=${model.sourceFacts.filesByParseStatus["file-level-only"]} unsupported=${model.sourceFacts.filesByParseStatus.unsupported})`);
-if (writtenPaths.length > 0) {
-    console.log(`\nReports written:`);
-    for (const p of writtenPaths) {
-        console.log(`  ${p}`);
-    }
-}
-console.log(`\nHighest severity: ${model.summary.highestSeverity ?? "(none)"}`);
-console.log(`Verdict: ${model.summary.finalVerdictLabel}`);
-console.log(`Exit reason: ${model.exit.reason}`);
-console.log(model.exit.code === AUDIT_EXIT_CODES.SUCCESS
-    ? `Exit 0 -- audit completed.`
-    : `Exit 1 -- fail-on threshold breached.`);
-process.exitCode = model.exit.code;

package/dist/scripts/build-gallery.js

@@ -1,3 +0,0 @@
-#!/usr/bin/env node
-import { runBuildGalleryCommand } from "../src/commands/buildGalleryCommand.js";
-process.exitCode = await runBuildGalleryCommand(process.argv.slice(2));

package/dist/scripts/capture-demo-report.js

@@ -1,3 +0,0 @@
-import { runCaptureDemoReportCommand } from "../src/commands/captureDemoReport.js";
-const exitCode = await runCaptureDemoReportCommand(process.argv.slice(2));
-process.exitCode = exitCode;

package/dist/scripts/evaluate-token-savings.js

@@ -1,2 +0,0 @@
-import { runEvaluateTokenSavingsCommand } from "../src/commands/evaluateTokenSavings.js";
-process.exitCode = await runEvaluateTokenSavingsCommand(process.argv.slice(2));

package/dist/scripts/generate-experiment-plots.js

@@ -1,3 +0,0 @@
-#!/usr/bin/env node
-import { runGenerateExperimentPlotsCommand } from "../src/commands/generateExperimentPlotsCommand.js";
-process.exitCode = await runGenerateExperimentPlotsCommand(process.argv.slice(2));

package/dist/scripts/generate-prompt-variants.js

@@ -1,2 +0,0 @@
-import { runGeneratePromptVariantsCommand } from "../src/commands/generatePromptVariants.js";
-process.exitCode = await runGeneratePromptVariantsCommand(process.argv.slice(2));

package/dist/scripts/render-experiment-report.js

@@ -1,2 +0,0 @@
-import { runRenderExperimentReportCommand } from "../src/commands/renderExperimentReportCommand.js";
-process.exitCode = await runRenderExperimentReportCommand(process.argv.slice(2));