@dailephd/my-dev-kit-lab 0.4.5 → 0.4.7

package/dist/src/tutorial/types.js

@@ -0,0 +1,48 @@
+/**
+ * v0.4.7 tutorial domain contracts.
+ *
+ * Everything here is declarative and serializable by design. A scenario can
+ * describe what to do, but it can never carry JavaScript, a shell command, or
+ * an arbitrary URL -- those escape hatches are deliberately absent from the
+ * union types below and are rejected by validation, not merely undocumented.
+ */
+export const TUTORIAL_SCHEMA_VERSION = "1.0.0";
+export const TARGET_CONTRACT_SCHEMA_VERSION = "1.0.0";
+/** Result schema version for TutorialRunResultV1. */
+export const TUTORIAL_RUN_RESULT_SCHEMA_VERSION = "1.0.0";
+export const MAX_TUTORIAL_STEPS = 500;
+export const MAX_STEP_PAUSE_MS = 60_000;
+export const MIN_VIEWPORT_WIDTH = 320;
+export const MAX_VIEWPORT_WIDTH = 3840;
+export const MIN_VIEWPORT_HEIGHT = 240;
+export const MAX_VIEWPORT_HEIGHT = 2160;
+export const DEFAULT_TUTORIAL_ACTION_TIMEOUT_MS = 5_000;
+export const DEFAULT_TUTORIAL_ASSERTION_TIMEOUT_MS = 5_000;
+/** Stable, path-safe, lowercase identifier shape shared by every tutorial id. */
+export const TUTORIAL_ID_PATTERN = /^[a-z0-9][a-z0-9._-]*$/;
+/** The only placeholder a trusted target contract may use. */
+export const TARGET_ROOT_PLACEHOLDER = "{{targetRoot}}";
+export const TUTORIAL_LOCATOR_KINDS = ["role", "text", "css", "test-id"];
+export const TUTORIAL_ACTION_TYPES = [
+    "goto",
+    "click",
+    "fill",
+    "press",
+    "hover",
+    "drag",
+    "wait-for"
+];
+export const TUTORIAL_GOTO_WAIT_UNTIL = ["load", "domcontentloaded", "networkidle"];
+export const TUTORIAL_WAIT_FOR_STATES = ["visible", "hidden", "attached", "detached"];
+export const TUTORIAL_ASSERTION_TYPES = [
+    "element-visible",
+    "text-equals",
+    "text-contains",
+    "url-path-equals",
+    "attribute-equals",
+    "http-json-equals",
+    "json-file-equals",
+    "file-exists"
+];
+export const TUTORIAL_CALLOUT_PLACEMENTS = ["auto", "top", "right", "bottom", "left"];
+export const TUTORIAL_TARGET_PROCESS_CWDS = ["contract-root", "target-root"];

package/dist/src/tutorial/validationPrimitives.js

@@ -0,0 +1,141 @@
+import { TUTORIAL_ID_PATTERN } from "./types.js";
+export function createErrorCollector(source) {
+    const errors = [];
+    return {
+        add(location, message) {
+            errors.push(`${source} validation failed at ${location}: ${message}`);
+        },
+        get errors() {
+            return errors;
+        },
+        get length() {
+            return errors.length;
+        }
+    };
+}
+export function isPlainObject(value) {
+    return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+export function isNonEmptyString(value) {
+    return typeof value === "string" && value.trim().length > 0;
+}
+export function isStableId(value) {
+    return typeof value === "string" && TUTORIAL_ID_PATTERN.test(value);
+}
+/** Finite positive integer. Rejects NaN, Infinity, zero, negatives and floats. */
+export function isPositiveInteger(value) {
+    return typeof value === "number" && Number.isInteger(value) && value > 0;
+}
+/** Finite non-negative integer. Rejects NaN, Infinity, negatives and floats. */
+export function isNonNegativeInteger(value) {
+    return typeof value === "number" && Number.isInteger(value) && value >= 0;
+}
+export function isJsonScalar(value) {
+    return (value === null ||
+        typeof value === "string" ||
+        typeof value === "boolean" ||
+        (typeof value === "number" && Number.isFinite(value)));
+}
+export function describeValue(value) {
+    if (value === undefined)
+        return "undefined";
+    if (value === null)
+        return "null";
+    if (typeof value === "string")
+        return JSON.stringify(value);
+    if (typeof value === "number" || typeof value === "boolean")
+        return String(value);
+    if (Array.isArray(value))
+        return "an array";
+    if (typeof value === "object")
+        return "an object";
+    return typeof value;
+}
+/**
+ * Enforces the exact supported schema version. Prompt 2 supports 1.0.0 only and
+ * never reinterprets or auto-upgrades another version, including another minor.
+ */
+export function validateSchemaVersion(errors, value, supported) {
+    if (value === undefined) {
+        errors.add("schemaVersion", `missing required schemaVersion; expected "${supported}".`);
+        return;
+    }
+    if (typeof value !== "string") {
+        errors.add("schemaVersion", `expected the string "${supported}", received ${describeValue(value)}.`);
+        return;
+    }
+    if (value !== supported) {
+        errors.add("schemaVersion", `unsupported schemaVersion ${JSON.stringify(value)}; this build supports "${supported}" only.`);
+    }
+}
+export function validateStableId(errors, location, value) {
+    if (!isNonEmptyString(value)) {
+        errors.add(location, `expected a non-empty id string, received ${describeValue(value)}.`);
+        return false;
+    }
+    if (!isStableId(value)) {
+        errors.add(location, `id ${JSON.stringify(value)} must match ${String(TUTORIAL_ID_PATTERN)} (lowercase letters, digits, dot, underscore, hyphen; must start with a letter or digit).`);
+        return false;
+    }
+    return true;
+}
+export function validateStringRecord(errors, location, value) {
+    if (value === undefined) {
+        return undefined;
+    }
+    if (!isPlainObject(value)) {
+        errors.add(location, `expected an object of string values, received ${describeValue(value)}.`);
+        return undefined;
+    }
+    let valid = true;
+    for (const [key, entry] of Object.entries(value)) {
+        if (key.length === 0) {
+            errors.add(location, "environment variable names must not be empty.");
+            valid = false;
+            continue;
+        }
+        if (typeof entry !== "string") {
+            errors.add(`${location}.${key}`, `expected a string value, received ${describeValue(entry)}.`);
+            valid = false;
+        }
+    }
+    return valid ? value : undefined;
+}
+export function validateStringArray(errors, location, value) {
+    if (value === undefined) {
+        return undefined;
+    }
+    if (!Array.isArray(value)) {
+        errors.add(location, `expected an array of strings, received ${describeValue(value)}.`);
+        return undefined;
+    }
+    let valid = true;
+    value.forEach((entry, index) => {
+        if (typeof entry !== "string") {
+            errors.add(`${location}[${index}]`, `expected a string, received ${describeValue(entry)}.`);
+            valid = false;
+        }
+    });
+    return valid ? value : undefined;
+}
+/**
+ * Optional timeout fields must be finite positive integers when supplied. Zero,
+ * negative values, NaN and Infinity are all rejected rather than silently
+ * coerced to a default.
+ */
+export function validateOptionalTimeout(errors, location, value) {
+    if (value === undefined) {
+        return;
+    }
+    if (!isPositiveInteger(value)) {
+        errors.add(location, `expected a finite positive integer number of milliseconds, received ${describeValue(value)}.`);
+    }
+}
+export function rejectUnknownKeys(errors, location, value, allowed) {
+    const allowedSet = new Set(allowed);
+    for (const key of Object.keys(value)) {
+        if (!allowedSet.has(key)) {
+            errors.add(`${location}.${key}`, `unknown field ${JSON.stringify(key)} is not part of this contract.`);
+        }
+    }
+}

package/examples/tutorial-browser/index.html

@@ -0,0 +1,47 @@
+<!doctype html>
+<html lang="en">
+  <head>
+    <meta charset="utf-8" />
+    <title>Tutorial Fixture</title>
+    <style>
+      body { font: 16px/1.5 system-ui, sans-serif; margin: 0; padding: 24px; background: #f6f7f9; color: #111; }
+      h1 { margin: 0 0 16px; font-size: 28px; }
+      .panel { background: #fff; border: 1px solid #d8dbe0; border-radius: 8px; padding: 16px; margin-bottom: 16px; }
+      .row { display: flex; gap: 16px; align-items: flex-start; }
+      .col { flex: 1; }
+      button { font: inherit; padding: 8px 16px; border-radius: 6px; border: 1px solid #5a6270; background: #fff; cursor: pointer; }
+      button:hover { background: #eef1f5; }
+      input { font: inherit; padding: 8px; border: 1px solid #b8bec8; border-radius: 6px; width: 100%; box-sizing: border-box; }
+      .dropzone { min-height: 72px; border: 2px dashed #9aa3af; border-radius: 8px; padding: 12px; }
+      .card { background: #dde7ff; border: 1px solid #5f7fd6; border-radius: 6px; padding: 10px; width: 140px; }
+      .hidden { display: none; }
+      #status-banner { padding: 10px; border-radius: 6px; background: #e8f5e9; border: 1px solid #66bb6a; }
+    </style>
+  </head>
+  <body>
+    <h1 id="page-title">Tutorial Fixture</h1>
+    <div class="panel"><p id="intro-text">Welcome to the generic tutorial fixture.</p><button id="primary-action" data-testid="primary-action" data-state="idle">Activate</button> <span id="activation-count" data-testid="activation-count">0</span></div>
+    <div class="panel"><label for="name-field">Your name</label><input id="name-field" data-testid="name-field" aria-label="Your name" /><p id="greeting" data-testid="greeting"></p></div>
+    <div class="panel"><button id="hover-target" data-testid="hover-target">Hover me</button><p id="hover-readout" data-testid="hover-readout">not hovered</p></div>
+    <div class="panel row"><div class="col"><div id="drag-card" data-testid="drag-card" class="card" draggable="true">Draggable card</div></div><div class="col"><div id="drop-zone" data-testid="drop-zone" class="dropzone">Drop target</div></div></div>
+    <div class="panel"><div id="status-banner" data-testid="status-banner" class="hidden">Delayed banner is now visible</div></div>
+    <script>
+      (() => {
+        let activations = 0;
+        const primary = document.getElementById("primary-action");
+        primary.addEventListener("click", () => { activations += 1; document.getElementById("activation-count").textContent = String(activations); primary.setAttribute("data-state", "activated"); });
+        const nameField = document.getElementById("name-field");
+        const greeting = document.getElementById("greeting");
+        nameField.addEventListener("input", () => { greeting.textContent = nameField.value ? `Hello, ${nameField.value}` : ""; });
+        nameField.addEventListener("keydown", event => { if (event.key === "Enter") greeting.textContent = `Submitted: ${nameField.value}`; });
+        document.getElementById("hover-target").addEventListener("mouseenter", () => { document.getElementById("hover-readout").textContent = "hovered"; });
+        const dragCard = document.getElementById("drag-card");
+        const dropZone = document.getElementById("drop-zone");
+        dragCard.addEventListener("dragstart", event => event.dataTransfer.setData("text/plain", "drag-card"));
+        dropZone.addEventListener("dragover", event => event.preventDefault());
+        dropZone.addEventListener("drop", event => { event.preventDefault(); dropZone.textContent = "Dropped"; dropZone.setAttribute("data-dropped", "true"); });
+        window.setTimeout(() => document.getElementById("status-banner").classList.remove("hidden"), 300);
+      })();
+    </script>
+  </body>
+</html>

package/examples/tutorial-browser/prepare.mjs

@@ -0,0 +1,14 @@
+import fs from "node:fs";
+import path from "node:path";
+import { fileURLToPath } from "node:url";
+
+const sourceRoot = path.dirname(fileURLToPath(import.meta.url));
+const targetRoot = process.argv[2];
+if (!targetRoot) {
+  console.error("prepare requires a target root argument");
+  process.exit(2);
+}
+fs.mkdirSync(path.join(targetRoot, "app"), { recursive: true });
+fs.mkdirSync(path.join(targetRoot, "out"), { recursive: true });
+for (const file of ["index.html", "server.mjs"]) fs.copyFileSync(path.join(sourceRoot, file), path.join(targetRoot, "app", file));
+fs.writeFileSync(path.join(targetRoot, "out", "report.json"), JSON.stringify({ prepared: true, counts: { widgets: 3 } }, null, 2), "utf8");

package/examples/tutorial-browser/scenario.json

@@ -0,0 +1,17 @@
+{
+  "schemaVersion": "1.0.0",
+  "id": "lab-browser-fixture",
+  "title": "Lab browser fixture tutorial",
+  "description": "A generic, lab-owned tutorial that exercises browser actions, locators, assertions and visual declarations against a local static fixture app.",
+  "targetId": "lab-browser-fixture",
+  "browser": { "viewport": { "width": 1024, "height": 768 } },
+  "steps": [
+    { "id": "open-app", "narration": "Open the fixture application in the browser.", "action": { "type": "goto", "path": "/", "waitUntil": "load" }, "highlight": { "kind": "css", "selector": "#page-title" }, "callout": { "text": "This is the fixture application.", "locator": { "kind": "css", "selector": "#page-title" }, "placement": "bottom" }, "screenshot": { "id": "app-open" }, "assertions": [ { "type": "url-path-equals", "expected": "/" }, { "type": "element-visible", "locator": { "kind": "role", "role": "heading", "name": "Tutorial Fixture" } }, { "type": "text-equals", "locator": { "kind": "css", "selector": "#page-title" }, "expected": "Tutorial Fixture" }, { "type": "file-exists", "path": "out/report.json" }, { "type": "json-file-equals", "path": "out/report.json", "pointer": "/counts/widgets", "expected": 3 }, { "type": "http-json-equals", "path": "/api/status", "pointer": "/ok", "expected": true } ] },
+    { "id": "activate", "narration": "Click the primary action button to activate the panel.", "action": { "type": "click", "locator": { "kind": "test-id", "testId": "primary-action" } }, "highlight": { "kind": "test-id", "testId": "primary-action" }, "callout": { "text": "Clicking here activates the panel.", "placement": "auto", "locator": { "kind": "test-id", "testId": "primary-action" } }, "screenshot": { "id": "activated" }, "assertions": [ { "type": "text-equals", "locator": { "kind": "test-id", "testId": "activation-count" }, "expected": "1" }, { "type": "attribute-equals", "locator": { "kind": "test-id", "testId": "primary-action" }, "name": "data-state", "expected": "activated" } ] },
+    { "id": "fill-name", "narration": "Type a name into the form field.", "action": { "type": "fill", "locator": { "kind": "test-id", "testId": "name-field" }, "value": "Ada" }, "assertions": [ { "type": "text-contains", "locator": { "kind": "test-id", "testId": "greeting" }, "expected": "Hello, Ada" } ] },
+    { "id": "submit-name", "narration": "Press Enter to submit the name.", "action": { "type": "press", "locator": { "kind": "test-id", "testId": "name-field" }, "key": "Enter" }, "screenshot": { "id": "submitted" }, "assertions": [ { "type": "text-contains", "locator": { "kind": "test-id", "testId": "greeting" }, "expected": "Submitted: Ada" } ] },
+    { "id": "hover-button", "narration": "Hover the secondary button to reveal its state.", "action": { "type": "hover", "locator": { "kind": "test-id", "testId": "hover-target" } }, "assertions": [ { "type": "text-equals", "locator": { "kind": "test-id", "testId": "hover-readout" }, "expected": "hovered" } ] },
+    { "id": "drag-card", "narration": "Drag the card onto the drop target.", "action": { "type": "drag", "source": { "kind": "test-id", "testId": "drag-card" }, "target": { "kind": "test-id", "testId": "drop-zone" } }, "highlight": { "kind": "test-id", "testId": "drop-zone" }, "screenshot": { "id": "dropped" }, "assertions": [ { "type": "attribute-equals", "locator": { "kind": "test-id", "testId": "drop-zone" }, "name": "data-dropped", "expected": "true" } ] },
+    { "id": "wait-banner", "narration": "Wait for the delayed status banner to appear.", "action": { "type": "wait-for", "locator": { "kind": "text", "text": "Delayed banner is now visible" }, "state": "visible", "timeoutMs": 5000 }, "callout": { "text": "The banner appears after a short delay." }, "screenshot": { "id": "banner-visible" }, "assertions": [ { "type": "element-visible", "locator": { "kind": "test-id", "testId": "status-banner" } } ] }
+  ]
+}

package/examples/tutorial-browser/server.mjs

@@ -0,0 +1,14 @@
+import http from "node:http";
+import fs from "node:fs";
+import path from "node:path";
+import { fileURLToPath } from "node:url";
+
+const root = path.dirname(fileURLToPath(import.meta.url));
+const port = Number(process.env.TUTORIAL_FIXTURE_PORT || 0);
+const server = http.createServer((req, res) => {
+  const url = new URL(req.url ?? "/", "http://127.0.0.1");
+  if (url.pathname === "/api/status") { res.writeHead(200, { "content-type": "application/json" }); res.end(JSON.stringify({ ok: true, widgets: 3 })); return; }
+  const filePath = url.pathname === "/" ? path.join(root, "index.html") : path.join(root, url.pathname);
+  fs.readFile(filePath, (error, contents) => { if (error) { res.writeHead(404); res.end("not found"); return; } res.writeHead(200, { "content-type": filePath.endsWith(".html") ? "text/html" : "application/octet-stream" }); res.end(contents); });
+});
+server.listen(port, "127.0.0.1", () => console.log("tutorial fixture listening on " + server.address().port));

package/package.json

@@ -1,20 +1,20 @@
 {
   "name": "@dailephd/my-dev-kit-lab",
-  "version": "0.4.5",
+  "version": "0.4.7",
   "type": "module",
   "description": "Evidence, benchmark, and evaluation companion for my-dev-kit.",
   "bin": {
-    "my-dev-kit-lab": "dist/scripts/run-final-demo.js"
+    "my-dev-kit-lab": "dist/scripts/cli.js"
   },
   "files": [
     "CHANGELOG.md",
-    "dist/scripts/",
-    "!dist/scripts/docs/",
+    "dist/scripts/cli.js",
+    "dist/scripts/run-final-demo.js",
     "dist/src/",
     "benchmarks/",
     "docs/METRICS.md",
-    "examples/",
-    "tests/fixtures/"
+    "examples/token-savings-cases.json",
+    "examples/tutorial-browser/"
   ],
   "repository": {
     "type": "git",
@@ -72,6 +72,7 @@
     "test:plots": "vitest run tests/plots tests/commands/generateExperimentPlotsCommand.spec.ts",
     "test:visualization-demos": "vitest run tests/visualizationDemos tests/commands/runVisualizationDemosCommand.spec.ts",
     "verify:benchmarks": "tsx scripts/verify-benchmarks.ts",
+    "verify:packed-package": "node scripts/verify-packed-package.mjs",
     "docs:check": "node scripts/check-docs.mjs",
     "verify": "npm run build && npm run verify:benchmarks",
     "security:deps": "tsx scripts/security/runDependencyChecks.ts",
@@ -79,22 +80,25 @@
     "security:codeql": "tsx scripts/security/runCodeql.ts",
     "security:semgrep": "tsx scripts/security/runSemgrep.ts",
     "test:security": "vitest run tests/security/",
+    "test:tutorial-browser": "vitest run tests/integration/tutorialRealBrowser.spec.ts",
     "test:fuzz:smoke": "tsx scripts/security/runFuzzSmoke.ts",
     "security:validate": "tsx scripts/security/validate.ts",
     "audit": "tsx scripts/audits/runAudit.ts",
     "report:context-integrity-smoke": "tsx scripts/report-context-integrity-smoke.ts"
   },
+  "dependencies": {
+    "playwright": "1.60.0"
+  },
   "devDependencies": {
     "@types/node": "^24.0.0",
-    "playwright": "^1.54.1",
     "tsx": "^4.20.3",
     "typescript": "^5.8.3",
-    "vitest": "^3.2.4"
+    "vitest": "^4.1.11"
   },
   "overrides": {
     "vite": "7.3.6"
   },
   "engines": {
-    "node": ">=20"
+    "node": ">=24"
   }
 }

package/dist/scripts/audits/runAudit.js

@@ -1,135 +0,0 @@
-#!/usr/bin/env node
-import { parseAuditArgs, normalizeAuditConfig } from "../../src/audits/core/auditConfig.js";
-import { resolveAuditTarget } from "../../src/audits/core/auditTarget.js";
-import { runAudit } from "../../src/audits/core/auditRunner.js";
-import { AUDIT_EXIT_CODES } from "../../src/audits/core/auditExitCode.js";
-import { resolveToolRoot } from "../security/resolveToolRoot.js";
-import { buildAuditReportModel } from "../../src/audits/report/auditReportModel.js";
-import { writeAuditReports } from "../../src/audits/report/writeAuditReports.js";
-// ---------------------------------------------------------------------------
-// v0.3.0 Batch 5 -- npm run audit entrypoint.
-//
-// Thin wiring only: parse args -> normalize config -> resolve target ->
-// runAudit() -> buildAuditReportModel() -> writeAuditReports() -> print a
-// concise console summary -> set process.exitCode. All report-shaping logic
-// (the former inline buildJsonReport()/renderMinimalTextSummary()/
-// summarizeInventory()/summarizeSourceOfTruth() functions from Batch 1/2)
-// now lives in src/audits/report/ -- see auditReportModel.ts,
-// renderAuditJsonReport.ts, renderAuditTextReport.ts, writeAuditReports.ts.
-// Mirrors the structure of scripts/security/validate.ts.
-// ---------------------------------------------------------------------------
-const USAGE = "Usage: npm run audit -- [--target <path>] [--types code-rot,security] " +
-    "[--include docs,tests,package,architecture,cli] [--format text,json] " +
-    "[--fail-on blocker|high|medium|low|none] [--out <path>] [--android]\n" +
-    "\n" +
-    "  --android opts into Batch 2's programmatic Android security integration.\n" +
-    "  Requires --types to include \"security\" (e.g. --types security or --types\n" +
-    "  code-rot,security). Runs the same static, read-only, nineteen-check\n" +
-    "  Android validation security:validate --profile android performs --\n" +
-    "  detection, manifest parsing, and internal advanced security checks --\n" +
-    "  through the existing security adapter, never a subprocess. Confirmed\n" +
-    "  findings are mapped into the normal issue collection; CandidateEvidence\n" +
-    "  remains a separate, bounded summary and is never treated as a confirmed\n" +
-    "  issue. Starts zero Gradle operations, zero external tools, and zero\n" +
-    "  network operations by default; --android does not expose any of those.\n" +
-    "  Example: npm run audit -- --target \"<android-project-path>\" --types security --android --format text,json --fail-on none";
-const rawArgs = process.argv.slice(2);
-const toolRoot = resolveToolRoot(import.meta.url);
-// Help deliberately wins over every other argument, mirroring
-// scripts/security/validate.ts -- no config normalization, target
-// resolution, audit execution, or report write.
-if (rawArgs.includes("--help") || rawArgs.includes("-h")) {
-    console.log(USAGE);
-    process.exitCode = 0;
-    process.exit(0);
-}
-let config;
-try {
-    const args = parseAuditArgs(rawArgs);
-    config = normalizeAuditConfig(args, toolRoot);
-}
-catch (err) {
-    const msg = err instanceof Error ? err.message : String(err);
-    console.error(`\nERROR: ${msg}`);
-    console.error(USAGE);
-    process.exitCode = AUDIT_EXIT_CODES.FATAL_ERROR;
-    process.exit(AUDIT_EXIT_CODES.FATAL_ERROR);
-}
-let target;
-try {
-    target = resolveAuditTarget(config.targetPathArg, toolRoot);
-}
-catch (err) {
-    const msg = err instanceof Error ? err.message : String(err);
-    console.error(`\nERROR: ${msg}`);
-    console.error(USAGE);
-    process.exitCode = AUDIT_EXIT_CODES.FATAL_ERROR;
-    process.exit(AUDIT_EXIT_CODES.FATAL_ERROR);
-}
-console.log("=".repeat(60));
-console.log("my-dev-kit-lab audit");
-console.log("=".repeat(60));
-console.log(`Tool root  : ${toolRoot}`);
-if (!target.isSelf) {
-    console.log(`Target     : ${target.rootPath}`);
-}
-else {
-    console.log(`Mode       : self-audit`);
-}
-console.log(`Types      : ${config.types.join(", ")}`);
-console.log(`Include    : ${config.include.join(", ")}`);
-console.log("");
-let result;
-try {
-    result = await runAudit({ config, toolRoot, target });
-}
-catch (err) {
-    const msg = err instanceof Error ? err.message : String(err);
-    console.error(`\nERROR: audit runtime failure: ${msg}`);
-    process.exitCode = AUDIT_EXIT_CODES.FATAL_ERROR;
-    process.exit(AUDIT_EXIT_CODES.FATAL_ERROR);
-}
-const model = buildAuditReportModel(result, { target });
-const { writtenPaths } = writeAuditReports({ model, config, outDir: config.out });
-console.log(`Issues found        : ${model.summary.totalIssues}`);
-console.log(`  blocker=${model.summary.issuesBySeverity.blocker} high=${model.summary.issuesBySeverity.high} medium=${model.summary.issuesBySeverity.medium} low=${model.summary.issuesBySeverity.low} info=${model.summary.issuesBySeverity.info}`);
-console.log(`Skipped detectors    : ${model.summary.skippedDetectorCount}`);
-if (model.summary.detectorErrorCount > 0) {
-    console.log(`Detector errors      : ${model.summary.detectorErrorCount}`);
-    for (const e of model.detectorErrors) {
-        console.log(`  [${e.id}] ${e.message}`);
-    }
-}
-if (model.summary.noDetectorsRegistered && !model.securitySummary.ran) {
-    console.log(`Note: no code-rot detectors are registered for this run's --types/--include selection -- this run collected inventory/source-of-truth data only.`);
-}
-if (model.securitySummary.ran) {
-    console.log(`\nSecurity validation: verdict=${model.securitySummary.verdictLabel} checks=${model.securitySummary.totalChecks} findings(blocker=${model.securitySummary.findingCounts.blocker} major=${model.securitySummary.findingCounts.major} minor=${model.securitySummary.findingCounts.minor} info=${model.securitySummary.findingCounts.informational})`);
-    if (model.securitySummary.reportPaths.text) {
-        console.log(`  Full report: ${model.securitySummary.reportPaths.text}`);
-    }
-}
-if (model.androidSecurity.summary.requested) {
-    const android = model.androidSecurity.summary;
-    console.log(`\nAndroid security validation: status=${android.status} applicable=${android.applicable ?? "n/a"} verdict=${android.verdict ?? "(unknown)"} checks=${android.totalChecks} confirmed=${android.confirmedFindingCount} mappedIssues=${android.mappedIssueCount} candidates=${android.candidateSummary.totalCount}`);
-    if (android.reportPaths.text) {
-        console.log(`  Full report: ${android.reportPaths.text}`);
-    }
-}
-console.log(`\nInventory: ${model.inventory.totalScannedFileCount} file(s) scanned, ${model.inventory.skippedFileCount} skipped`);
-console.log(`  source=${model.inventory.filesByCategory.source} tests=${model.inventory.filesByCategory.tests} docs=${model.inventory.filesByCategory.docs} package=${model.inventory.filesByCategory.package} config=${model.inventory.filesByCategory.config} scripts=${model.inventory.filesByCategory.scripts} ci=${model.inventory.filesByCategory.ci}`);
-console.log(`Source of truth: package=${model.sourceOfTruth.packageName ?? "(none)"}@${model.sourceOfTruth.packageVersion ?? "?"} readme=${model.sourceOfTruth.hasReadme} changelog=${model.sourceOfTruth.hasChangelog} ciWorkflows=${model.sourceOfTruth.ciWorkflowCount}`);
-console.log(`Source facts: ${model.sourceFacts.totalFilesAnalyzed} file(s) analyzed (parsed=${model.sourceFacts.filesByParseStatus.parsed} file-level-only=${model.sourceFacts.filesByParseStatus["file-level-only"]} unsupported=${model.sourceFacts.filesByParseStatus.unsupported})`);
-if (writtenPaths.length > 0) {
-    console.log(`\nReports written:`);
-    for (const p of writtenPaths) {
-        console.log(`  ${p}`);
-    }
-}
-console.log(`\nHighest severity: ${model.summary.highestSeverity ?? "(none)"}`);
-console.log(`Verdict: ${model.summary.finalVerdictLabel}`);
-console.log(`Exit reason: ${model.exit.reason}`);
-console.log(model.exit.code === AUDIT_EXIT_CODES.SUCCESS
-    ? `Exit 0 -- audit completed.`
-    : `Exit 1 -- fail-on threshold breached.`);
-process.exitCode = model.exit.code;

package/dist/scripts/build-gallery.js

@@ -1,3 +0,0 @@
-#!/usr/bin/env node
-import { runBuildGalleryCommand } from "../src/commands/buildGalleryCommand.js";
-process.exitCode = await runBuildGalleryCommand(process.argv.slice(2));

package/dist/scripts/capture-demo-report.js

@@ -1,3 +0,0 @@
-import { runCaptureDemoReportCommand } from "../src/commands/captureDemoReport.js";
-const exitCode = await runCaptureDemoReportCommand(process.argv.slice(2));
-process.exitCode = exitCode;

package/dist/scripts/evaluate-token-savings.js

@@ -1,2 +0,0 @@
-import { runEvaluateTokenSavingsCommand } from "../src/commands/evaluateTokenSavings.js";
-process.exitCode = await runEvaluateTokenSavingsCommand(process.argv.slice(2));

package/dist/scripts/generate-experiment-plots.js

@@ -1,3 +0,0 @@
-#!/usr/bin/env node
-import { runGenerateExperimentPlotsCommand } from "../src/commands/generateExperimentPlotsCommand.js";
-process.exitCode = await runGenerateExperimentPlotsCommand(process.argv.slice(2));

package/dist/scripts/generate-prompt-variants.js

@@ -1,2 +0,0 @@
-import { runGeneratePromptVariantsCommand } from "../src/commands/generatePromptVariants.js";
-process.exitCode = await runGeneratePromptVariantsCommand(process.argv.slice(2));

package/dist/scripts/render-experiment-report.js

@@ -1,2 +0,0 @@
-import { runRenderExperimentReportCommand } from "../src/commands/renderExperimentReportCommand.js";
-process.exitCode = await runRenderExperimentReportCommand(process.argv.slice(2));

package/dist/scripts/report-context-integrity-smoke.js

@@ -1,70 +0,0 @@
-// v0.4.5 context-integrity evaluation: report smoke script. Loads the frozen failed-run and
-// corrected-replay fixtures, evaluates them through the existing producer-readiness bridge,
-// and writes JSON/text/HTML reports for manual inspection. Not part of any release-readiness
-// gate; a developer convenience for inspecting ContextIntegrityReportV1 output.
-import { mkdirSync, writeFileSync } from "node:fs";
-import { loadContextIntegrityFixture } from "../src/evaluation/ecosystemFixtures/loadContextIntegrityFixture.js";
-import { evaluateProducerReadinessBridge } from "../src/evaluation/stageContextMetrics/evaluateProducerReadinessBridge.js";
-import { calculateStageContextDeterminism } from "../src/evaluation/stageContextDeterminism/calculateStageContextDeterminism.js";
-import { buildContextIntegrityReport } from "../src/report/experiments/buildContextIntegrityReport.js";
-import { renderContextIntegrityJsonReport } from "../src/report/experiments/renderContextIntegrityJsonReport.js";
-import { renderContextIntegrityText } from "../src/report/experiments/renderContextIntegrityText.js";
-import { renderContextIntegrityHtml } from "../src/report/experiments/renderContextIntegrityHtml.js";
-const CASES = [
-    {
-        kind: "failed-run",
-        root: "tests/fixtures/ecosystem/context-integrity/v0.4.5/failed-run",
-        manifest: "tests/fixtures/ecosystem/context-integrity/v0.4.5/manifests/failed-run-manifest.json"
-    },
-    {
-        kind: "corrected-replay",
-        root: "tests/fixtures/ecosystem/context-integrity/v0.4.5/corrected-replay",
-        manifest: "tests/fixtures/ecosystem/context-integrity/v0.4.5/manifests/corrected-replay-manifest.json"
-    }
-];
-async function main() {
-    const outDir = "lab-output/context-integrity-report-smoke";
-    mkdirSync(outDir, { recursive: true });
-    for (const c of CASES) {
-        const fixture = await loadContextIntegrityFixture(c.root, c.manifest);
-        if (!fixture.ok) {
-            console.error(`Fixture load failed for ${c.kind}:`, fixture.issues);
-            process.exitCode = 1;
-            continue;
-        }
-        const bridgeResult = evaluateProducerReadinessBridge({
-            implementation: { role: "implementation", contextCapsule: fixture.implementationCapsule, retrievalAuditRecord: fixture.implementationAudit },
-            readiness: fixture.runIntegrityEvidence?.gate.implementationContext,
-            runIntegrityEvidence: fixture.runIntegrityEvidence,
-            expectations: {
-                schemaVersion: "1.0.0",
-                caseId: "CASE-SMOKE",
-                title: "smoke",
-                description: "smoke",
-                expectedEvidence: [],
-                expectedStates: {},
-                warnings: [],
-                producerReadinessExpectations: {}
-            }
-        });
-        const determinism = calculateStageContextDeterminism([
-            { runNumber: 1, value: bridgeResult },
-            { runNumber: 2, value: bridgeResult }
-        ]);
-        const report = buildContextIntegrityReport({
-            fixtureKind: c.kind,
-            manifest: fixture.manifest,
-            hashVerification: fixture.hashVerification,
-            capsule: fixture.implementationCapsule,
-            audit: fixture.implementationAudit,
-            bridgeResult,
-            determinism,
-            fixtureSelfImmutable: true
-        });
-        writeFileSync(`${outDir}/${c.kind}.report.json`, renderContextIntegrityJsonReport(report), "utf8");
-        writeFileSync(`${outDir}/${c.kind}.report.txt`, renderContextIntegrityText(report), "utf8");
-        writeFileSync(`${outDir}/${c.kind}.report.html`, renderContextIntegrityHtml(report), "utf8");
-        console.log(`Wrote ${c.kind} reports. endToEnd=${report.endToEnd?.category}`);
-    }
-}
-main();

package/dist/scripts/run-agent-prompt.js

@@ -1,2 +0,0 @@
-import { runAgentPromptCommand } from "../src/commands/runAgentPromptCommand.js";
-process.exitCode = await runAgentPromptCommand(process.argv.slice(2));

package/dist/scripts/run-controlled-experiment.js

@@ -1,2 +0,0 @@
-import { runControlledExperimentCommand } from "../src/commands/runControlledExperimentCommand.js";
-process.exitCode = await runControlledExperimentCommand(process.argv.slice(2));

package/dist/scripts/run-lab-demo.js

@@ -1,5 +0,0 @@
-import { runLabDemoCommand } from "../src/commands/runLabDemo.js";
-const exitCode = await runLabDemoCommand(process.argv.slice(2));
-if (exitCode !== 0) {
-    process.exitCode = exitCode;
-}

package/dist/scripts/run-visualization-demos.js

@@ -1,3 +0,0 @@
-#!/usr/bin/env node
-import { runVisualizationDemosCommand } from "../src/commands/runVisualizationDemosCommand.js";
-process.exitCode = await runVisualizationDemosCommand(process.argv.slice(2));

package/dist/scripts/security/resolveToolRoot.js

@@ -1,16 +0,0 @@
-import fs from "node:fs";
-import path from "node:path";
-import { fileURLToPath } from "node:url";
-export function resolveToolRoot(moduleUrl) {
-    let current = path.dirname(fileURLToPath(moduleUrl));
-    while (true) {
-        if (fs.existsSync(path.join(current, "package.json"))) {
-            return current;
-        }
-        const parent = path.dirname(current);
-        if (parent === current) {
-            return process.cwd();
-        }
-        current = parent;
-    }
-}