@sebastienrousseau/dotfiles 0.2.500 → 0.2.502

package/scripts/dot/commands/registry.sh

@@ -0,0 +1,263 @@
+#!/usr/bin/env bash
+# Copyright (c) 2015-2026 Dotfiles. All rights reserved.
+# shellcheck shell=bash
+#
+# scripts/dot/commands/registry.sh
+#
+# `dot registry` — initial scaffold for the dot module registry.
+#
+# §3 audit roadmap: ship a registry of reusable dotfile modules
+# ("rust-dev-setup", "k8s-operator-laptop") to seed network effects.
+# Hosted as a GitHub-Pages-indexed JSON file to keep ops cost near
+# zero.
+#
+# Current state: SCAFFOLD ONLY. This file ships the CLI surface and
+# the JSON contract (see _registry_default_url). The registry itself
+# is empty; populating it is its own roadmap item.
+#
+# Subcommands:
+#   list           Show modules in the configured registry
+#   search <q>     Filter modules by keyword (name, description, tags)
+#   info <name>    Print full metadata for a module
+#   install <name> Apply a module to the current workstation (stub —
+#                  prints what would be installed; full implementation
+#                  needs a sandboxed apply pipeline)
+#   url            Show the active registry URL
+#   set-url <u>    Override the registry URL (writes to user config)
+#
+# Registry JSON shape:
+#   {
+#     "version": 1,
+#     "updated": "2026-05-15T16:00:00Z",
+#     "modules": [
+#       { "name": "rust-dev-setup",
+#         "description": "Rust toolchain + cargo plugins + IDE config",
+#         "repo": "https://github.com/example/rust-dev-setup",
+#         "tags": ["rust", "dev", "language"],
+#         "maintainer": "alice@example.com",
+#         "version": "1.2.0",
+#         "sha256": "abc123..." }
+#     ]
+#   }
+
+set -euo pipefail
+
+SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
+# shellcheck source=../lib/ui.sh disable=SC1091
+source "$SCRIPT_DIR/../lib/ui.sh"
+# shellcheck source=../lib/utils.sh disable=SC1091
+source "$SCRIPT_DIR/../lib/utils.sh"
+
+_registry_default_url() {
+  printf '%s\n' "https://sebastienrousseau.github.io/dotfiles/registry.json"
+}
+
+_registry_config_file() {
+  printf '%s/dotfiles/registry.toml\n' "${XDG_CONFIG_HOME:-$HOME/.config}"
+}
+
+_registry_url() {
+  if [[ -n "${DOTFILES_REGISTRY_URL:-}" ]]; then
+    printf '%s\n' "$DOTFILES_REGISTRY_URL"
+    return
+  fi
+  local cfg
+  cfg="$(_registry_config_file)"
+  if [[ -f "$cfg" ]]; then
+    local u
+    u="$(awk -F'[ \t]*=[ \t]*' '/^url[ \t]*=/{gsub(/"/,"",$2); print $2; exit}' "$cfg")"
+    [[ -n "$u" ]] && {
+      printf '%s\n' "$u"
+      return
+    }
+  fi
+  _registry_default_url
+}
+
+_registry_cache_dir() {
+  printf '%s/dotfiles/registry\n' "${XDG_CACHE_HOME:-$HOME/.cache}"
+}
+
+_registry_fetch() {
+  local url cache_dir cache_file
+  url="$(_registry_url)"
+  cache_dir="$(_registry_cache_dir)"
+  cache_file="$cache_dir/index.json"
+  mkdir -p "$cache_dir"
+  # Refresh if older than 6h or missing.
+  local now mtime
+  now="$(date +%s)"
+  if [[ -s "$cache_file" ]]; then
+    if mtime="$(stat -f %m "$cache_file" 2>/dev/null || stat -c %Y "$cache_file" 2>/dev/null)"; then
+      if ((now - mtime < 21600)); then
+        printf '%s\n' "$cache_file"
+        return 0
+      fi
+    fi
+  fi
+  if ! command -v curl >/dev/null 2>&1; then
+    ui_err "registry" "curl not installed"
+    return 127
+  fi
+  local tmp
+  tmp="$(mktemp "${cache_file}.XXXXXX")"
+  if ! curl -fsSL --max-time 15 -o "$tmp" "$url"; then
+    rm -f "$tmp"
+    if [[ -s "$cache_file" ]]; then
+      ui_warn "registry" "fetch failed; using stale cache at $cache_file"
+      printf '%s\n' "$cache_file"
+      return 0
+    fi
+    ui_err "registry" "could not fetch $url"
+    return 1
+  fi
+  mv "$tmp" "$cache_file"
+  printf '%s\n' "$cache_file"
+}
+
+_registry_require_jq() {
+  command -v jq >/dev/null 2>&1 || {
+    ui_err "registry" "jq is required"
+    return 127
+  }
+}
+
+cmd_registry() {
+  local subcommand="${1:-list}"
+  shift || true
+
+  case "$subcommand" in
+    url)
+      printf '%s\n' "$(_registry_url)"
+      ;;
+    set-url)
+      local new_url="${1:-}"
+      [[ -n "$new_url" ]] || {
+        ui_err "set-url" "missing URL"
+        return 1
+      }
+      # Refuse non-HTTPS schemes. The registry index is unsigned today,
+      # so HTTPS is the only transport that gives us cert-pinned
+      # integrity. The `file://` exemption is for local testing only
+      # (the bench-script and unit tests use it).
+      if [[ ! "$new_url" =~ ^(https://|file://) ]]; then
+        ui_err "set-url" "registry URL must use https:// (or file:// for local testing) — got: $new_url"
+        return 1
+      fi
+      local cfg
+      cfg="$(_registry_config_file)"
+      mkdir -p "$(dirname "$cfg")"
+      # Atomic write so a concurrent invocation can't read a half-
+      # written file. Explicit if/else (avoid SC2015 A && B || C).
+      local _tmp
+      _tmp="$(mktemp "${cfg}.XXXXXX")"
+      if printf 'url = "%s"\n' "$new_url" >"$_tmp"; then
+        if ! mv "$_tmp" "$cfg"; then
+          rm -f "$_tmp"
+          ui_err "set-url" "failed to commit $cfg"
+          return 1
+        fi
+      else
+        rm -f "$_tmp"
+        ui_err "set-url" "failed to write $cfg"
+        return 1
+      fi
+      ui_ok "registry" "set to $new_url ($cfg)"
+      ;;
+    list)
+      _registry_require_jq || return $?
+      local index
+      index="$(_registry_fetch)" || return $?
+      ui_header "Registry modules"
+      ui_info "Source" "$(_registry_url)"
+      echo ""
+      if ! jq -e '.modules | length > 0' "$index" >/dev/null 2>&1; then
+        ui_warn "registry" "no modules published yet — see docs/operations/REGISTRY.md to contribute one"
+        return 0
+      fi
+      ui_table_begin "Module" "Version" "Description"
+      while IFS=$'\t' read -r name ver desc; do
+        ui_table_add "$name" "v$ver" "$desc"
+      done < <(jq -r '.modules[] | "\(.name)\t\(.version // "-")\t\(.description // "")"' "$index")
+      ui_table_end
+      ;;
+    search)
+      _registry_require_jq || return $?
+      local q="${1:-}"
+      [[ -n "$q" ]] || {
+        ui_err "search" "missing query"
+        return 1
+      }
+      local index
+      index="$(_registry_fetch)" || return $?
+      ui_header "Registry search: $q"
+      echo ""
+      ui_table_begin "Module" "Version" "Description"
+      while IFS=$'\t' read -r name ver desc; do
+        ui_table_add "$name" "v$ver" "$desc"
+      done < <(jq -r --arg q "$q" '
+        .modules[]
+        | select(
+            (.name // "" | ascii_downcase | contains($q | ascii_downcase)) or
+            (.description // "" | ascii_downcase | contains($q | ascii_downcase)) or
+            ((.tags // []) | map(ascii_downcase) | index($q | ascii_downcase))
+          )
+        | "\(.name)\t\(.version // "-")\t\(.description // "")"
+      ' "$index")
+      ui_table_end
+      ;;
+    info)
+      _registry_require_jq || return $?
+      local name="${1:-}"
+      [[ -n "$name" ]] || {
+        ui_err "info" "missing module name"
+        return 1
+      }
+      local index
+      index="$(_registry_fetch)" || return $?
+      local found
+      found="$(jq -r --arg n "$name" '.modules[] | select(.name == $n) | "OK"' "$index" 2>/dev/null)"
+      if [[ "$found" != "OK" ]]; then
+        ui_err "info" "module not found: $name"
+        return 1
+      fi
+      jq -r --arg n "$name" '.modules[] | select(.name == $n) | to_entries[] | "\(.key)\t\(.value | if type == "array" then join(", ") else tostring end)"' "$index" |
+        while IFS=$'\t' read -r key value; do
+          ui_ok "$key" "$value"
+        done
+      ;;
+    install)
+      local name="${1:-}"
+      [[ -n "$name" ]] || {
+        ui_err "install" "missing module name"
+        return 1
+      }
+      ui_warn "install" "scaffold only — full module installer is a roadmap item"
+      ui_info "install" "would fetch module $name from registry and apply it as a chezmoi sub-source"
+      return 0
+      ;;
+    --help | -h | help)
+      cat <<EOF
+Usage: dot registry <subcommand>
+
+Subcommands:
+  list             List modules in the configured registry
+  search <q>       Filter modules by keyword (name, description, tags)
+  info <name>      Print metadata for a single module
+  install <name>   Install a module (scaffold — see docs/operations/REGISTRY.md)
+  url              Show the active registry URL
+  set-url <url>    Override the registry URL (persists to user config)
+
+Env overrides:
+  DOTFILES_REGISTRY_URL   One-shot override of the registry URL.
+
+Default registry: $(_registry_default_url)
+EOF
+      ;;
+    *)
+      ui_err "Unknown subcommand" "$subcommand"
+      echo "Run 'dot registry --help' for usage." >&2
+      return 1
+      ;;
+  esac
+}

package/scripts/dot/commands/tools.sh

@@ -353,7 +353,55 @@ cmd_env_mise() {
     exit 1
   fi
   case "${1:-list}" in
-    list | ls) mise ls ;;
+    list | ls)
+      if has_command jq; then
+        ui_table_begin "Tool" "Version" "Source" "Requested"
+        while IFS=$'\t' read -r tool ver source req; do
+          ui_table_add "$tool" "$ver" "${source/$HOME/\~}" "$req"
+        done < <(mise ls --json 2>/dev/null | jq -r '
+          to_entries[] as $t
+          | $t.value[]
+          | [
+              $t.key,
+              (.version // "-"),
+              (.source.path // ""),
+              (.requested_version // "")
+            ]
+          | @tsv
+        ')
+        ui_table_end
+      else
+        mise ls
+      fi
+      # Surface orphan installs (tool versions on disk that no active config
+      # claims). `--dry-run-code` exits 1 iff there is something to prune;
+      # the call is fast (no I/O beyond reading the tracked-configs index).
+      if mise prune --dry-run-code --quiet >/dev/null 2>&1; then
+        :
+      else
+        echo ""
+        ui_warn "orphan installs" "tool versions on disk are not requested by any config"
+        ui_info "to clean" "run 'dot env prune' (dry-run) or 'dot env prune --yes' to commit"
+      fi
+      ;;
+    prune)
+      shift
+      local commit=0
+      for arg in "$@"; do
+        case "$arg" in
+          --yes | -y) commit=1 ;;
+        esac
+      done
+      if ((commit)); then
+        mise prune
+      else
+        ui_info "dry-run" "showing what 'mise prune' would remove (pass --yes to commit)"
+        echo ""
+        mise prune --dry-run
+        echo ""
+        ui_info "next" "re-run with 'dot env prune --yes' to actually uninstall"
+      fi
+      ;;
     install)
       shift
       # Validate tool names to prevent injection

package/scripts/dot/lib/bento.sh

@@ -1,5 +1,6 @@
 #!/usr/bin/env bash
 # Copyright (c) 2015-2026 Dotfiles. All rights reserved.
+# Sourced by scripts/dot/commands/*.sh and dot_local/bin/executable_dot; inherits set -euo pipefail.
 # Dotfiles 2026: Atomic Intelligence Surface
 # High-fidelity, perfectly aligned, and professional.
 
@@ -30,7 +31,7 @@ _dotfiles_bento_render() {
 
   # Render a fixed-width card (42 cols) so output aligns in any terminal width
   printf "\n"
-  printf "  ${c_cyan}${c_bold}💎  D O T F I L E S${c_reset}  ${c_slate}[v0.2.500]${c_reset}\n"
+  printf "  ${c_cyan}${c_bold}💎  D O T F I L E S${c_reset}  ${c_slate}[v0.2.502]${c_reset}\n"
   printf "  ${c_slate}──────────────────────────────────────────${c_reset}\n"
 
   # Key system properties at a glance — answers "is my env healthy?" in 1 second

package/scripts/dot/lib/log.sh

@@ -1,5 +1,6 @@
 #!/usr/bin/env bash
 # Copyright (c) 2015-2026 Dotfiles. All rights reserved.
+# Sourced by scripts/dot/commands/*.sh and scripts/diagnostics/*; inherits set -euo pipefail.
 # Structured JSON logging and metrics library.
 # Source this file to emit machine-readable logs and performance metrics.
 #
@@ -8,6 +9,11 @@
 #   dot_log info "apply_start" "source=chezmoi"
 #   dot_metric "shell_startup" 142 ms
 
+# Re-source guard: re-sourcing would mint a new DOT_TRACE_ID and break
+# correlation across modules that already captured the original.
+[[ "${_DOT_LIB_LOG_LOADED:-0}" == "1" ]] && return 0
+_DOT_LIB_LOG_LOADED=1
+
 # Correlation ID for tracing across commands in a single invocation
 DOT_TRACE_ID="${DOT_TRACE_ID:-$(date +%s%N 2>/dev/null | tail -c 12 || date +%s)}"
 export DOT_TRACE_ID

package/scripts/dot/lib/platform.sh

@@ -1,5 +1,6 @@
 #!/usr/bin/env bash
 # Copyright (c) 2015-2026 Dotfiles. All rights reserved.
+# Sourced by scripts/dot/commands/*.sh; inherits set -euo pipefail.
 # Dotfiles CLI Platform Abstraction
 # Unified helpers for macOS, Linux, and WSL parity.
 
@@ -38,12 +39,22 @@ dot_host_os() {
 }
 
 # Convert host-native path into Linux path when inside WSL.
+#
+# Contract:
+#   - In WSL: requires `wslpath`. Returns 2 (with a stderr error) if
+#     missing — callers must not silently treat a Windows-style path
+#     as Linux-safe.
+#   - Outside WSL: paths are already Linux/macOS paths; echoes the
+#     input unchanged and returns 0.
+#   - Empty input returns 1 (usage error).
 dot_path_to_unix() {
   local p="${1:-}"
-  if [[ -z "$p" ]]; then
-    return 1
-  fi
-  if dot_is_wsl && command -v wslpath >/dev/null 2>&1; then
+  [[ -n "$p" ]] || return 1
+  if dot_is_wsl; then
+    if ! command -v wslpath >/dev/null 2>&1; then
+      printf "dot_path_to_unix: wslpath required in WSL but not found\n" >&2
+      return 2
+    fi
     wslpath -u "$p"
     return
   fi
@@ -51,12 +62,15 @@ dot_path_to_unix() {
 }
 
 # Convert Linux path into host-native path when inside WSL.
+# Same contract as dot_path_to_unix (see above).
 dot_path_to_native() {
   local p="${1:-}"
-  if [[ -z "$p" ]]; then
-    return 1
-  fi
-  if dot_is_wsl && command -v wslpath >/dev/null 2>&1; then
+  [[ -n "$p" ]] || return 1
+  if dot_is_wsl; then
+    if ! command -v wslpath >/dev/null 2>&1; then
+      printf "dot_path_to_native: wslpath required in WSL but not found\n" >&2
+      return 2
+    fi
     wslpath -w "$p"
     return
   fi

package/scripts/dot/lib/ui.sh

@@ -1,5 +1,6 @@
 #!/usr/bin/env bash
 # Copyright (c) 2015-2026 Dotfiles. All rights reserved.
+# Sourced by scripts/dot/commands/*.sh, scripts/diagnostics/*, scripts/ops/*; inherits set -euo pipefail.
 ## Dotfiles CLI UI Component Library — Single Source of Truth.
 ##
 ## All CLI output MUST go through these primitives.  No raw printf with
@@ -30,6 +31,11 @@
 ##   ui_header "Section Title"
 ##   ui_ok "Operation succeeded"
 
+# Re-source guard: re-sourcing would zero out the BOLD/RED/etc colour
+# variables that ui_init() populated, breaking already-rendered output.
+[[ "${_DOT_LIB_UI_LOADED:-0}" == "1" ]] && return 0
+_DOT_LIB_UI_LOADED=1
+
 # ═══════════════════════════════════════════════════════════════════════
 # State — all zeroed before ui_init
 # ═══════════════════════════════════════════════════════════════════════
@@ -265,7 +271,12 @@ ui_spinner_stop() {
   fi
   ui_clear_line
   ui_show_cursor
+  # The newline is only needed when stdout is NOT a TTY. We must return
+  # 0 either way — without the explicit `return 0`, the function's exit
+  # status comes from the trailing `[[ ! -t 1 ]] && printf` chain, which
+  # is rc=1 on a TTY and breaks every caller running under `set -e`.
   [[ ! -t 1 ]] && printf "\n"
+  return 0
 }
 
 # ═══════════════════════════════════════════════════════════════════════
@@ -348,9 +359,13 @@ ui_run_cmd() {
   done
   wait "$pid" 2>/dev/null
 
-  local rc
-  rc=$(cat "$rc_file" 2>/dev/null || echo 1)
+  # Guard against the rc_file being empty (race between subshell exit
+  # and parent read): an unset rc would default to non-numeric "" and
+  # fail the `[[ == "0" ]]` check confusingly. Treat empty as failure.
+  local rc=""
+  [[ -s "$rc_file" ]] && rc="$(<"$rc_file")"
   rm -f "$rc_file"
+  rc="${rc:-1}"
 
   ui_clear_line
   ui_show_cursor
@@ -461,6 +476,134 @@ ui_table_sep() {
   printf '\n'
 }
 
+# ═══════════════════════════════════════════════════════════════════════
+# Buffered table — accumulates rows then renders via `gum table -p`
+# (rounded borders) when gum is on PATH and stdout is a TTY; falls back
+# to the existing printf-based ui_table_header/row otherwise.
+#
+#   ui_table_begin "Tool" "Version" "Source" "Requested"
+#   ui_table_add   "node" "24.14.0" "~/.dotfiles/mise.toml" "24.14.0"
+#   ui_table_add   "node" "25.9.0"  ""                       ""
+#   ui_table_end
+#
+# Cells may contain anything except ASCII US (0x1f), the internal row
+# separator. Empty cells render as blank in both modes.
+#
+# Environment overrides:
+#   DOTFILES_NO_TUI=1   force the printf fallback even if gum is installed
+#   NO_COLOR=…          standard convention; also forces the fallback
+# ═══════════════════════════════════════════════════════════════════════
+_UI_TABLE_HEADERS=()
+_UI_TABLE_ROWS=()
+
+ui_table_begin() {
+  _UI_TABLE_HEADERS=("$@")
+  _UI_TABLE_ROWS=()
+}
+
+ui_table_add() {
+  if [[ "${#_UI_TABLE_HEADERS[@]}" -eq 0 ]]; then
+    return 1
+  fi
+  local IFS=$'\x1f'
+  _UI_TABLE_ROWS+=("$*")
+}
+
+ui_table_end() {
+  if [[ "${#_UI_TABLE_HEADERS[@]}" -eq 0 ]]; then
+    return 0
+  fi
+
+  local use_gum=0
+  if command -v gum >/dev/null 2>&1 &&
+    [[ -t 1 ]] &&
+    [[ "${DOTFILES_NO_TUI:-0}" != "1" ]] &&
+    [[ -z "${NO_COLOR:-}" ]]; then
+    use_gum=1
+  fi
+
+  if ((use_gum)); then
+    local header_row
+    local IFS=$'\x1f'
+    header_row="${_UI_TABLE_HEADERS[*]}"
+    # Charm palette: 212 = hot pink (matches ui_header), 240 = muted grey.
+    # Cell colour intentionally left at terminal default so the table
+    # reads on both light and dark backgrounds.
+    # Override via DOTFILES_TABLE_{BORDER,HEADER}_FG env vars.
+    local border_fg="${DOTFILES_TABLE_BORDER_FG:-240}"
+    local header_fg="${DOTFILES_TABLE_HEADER_FG:-212}"
+    {
+      printf '%s\n' "$header_row"
+      printf '%s\n' "${_UI_TABLE_ROWS[@]}"
+    } | gum table --print \
+      --separator=$'\x1f' \
+      --border=rounded \
+      --border.foreground="$border_fg" \
+      --header.foreground="$header_fg" \
+      --padding="0 1" 2>/dev/null ||
+      _ui_table_printf_fallback
+  else
+    _ui_table_printf_fallback
+  fi
+
+  _UI_TABLE_HEADERS=()
+  _UI_TABLE_ROWS=()
+}
+
+_ui_table_printf_fallback() {
+  ui_init
+  # Pre-scan all buffered rows + headers to compute per-column width so
+  # values aren't truncated or collide. Min width 8, +2 padding.
+  local ncols="${#_UI_TABLE_HEADERS[@]}"
+  local -a widths=()
+  local i
+  for ((i = 0; i < ncols; i++)); do
+    widths[i]="${#_UI_TABLE_HEADERS[i]}"
+  done
+  local row
+  for row in "${_UI_TABLE_ROWS[@]}"; do
+    local -a _fields=()
+    local IFS=$'\x1f'
+    read -ra _fields <<<"$row"
+    for ((i = 0; i < ncols; i++)); do
+      local len="${#_fields[i]}"
+      ((len > widths[i])) && widths[i]=$len
+    done
+  done
+  for ((i = 0; i < ncols; i++)); do
+    ((widths[i] += 2))
+    ((widths[i] < 8)) && widths[i]=8
+  done
+
+  # Emit header (bold when color available), separator, then rows.
+  local out="  "
+  for ((i = 0; i < ncols; i++)); do
+    if [[ "$UI_COLOR" = "1" ]]; then
+      out+="$(printf '%s%-*s%s' "$BOLD" "${widths[i]}" "${_UI_TABLE_HEADERS[i]}" "$NORMAL")"
+    else
+      out+="$(printf '%-*s' "${widths[i]}" "${_UI_TABLE_HEADERS[i]}")"
+    fi
+  done
+  printf '%s\n' "$out"
+
+  local total=2
+  for ((i = 0; i < ncols; i++)); do ((total += widths[i])); done
+  printf '  '
+  for ((i = 0; i < total - 2; i++)); do printf '─'; done
+  printf '\n'
+
+  for row in "${_UI_TABLE_ROWS[@]}"; do
+    local -a _fields=()
+    local IFS=$'\x1f'
+    read -ra _fields <<<"$row"
+    out="  "
+    for ((i = 0; i < ncols; i++)); do
+      out+="$(printf '%-*s' "${widths[i]}" "${_fields[i]:-}")"
+    done
+    printf '%s\n' "$out"
+  done
+}
+
 # ═══════════════════════════════════════════════════════════════════════
 # Logo
 # ═══════════════════════════════════════════════════════════════════════

package/scripts/dot/lib/utils.sh

@@ -1,8 +1,13 @@
 #!/usr/bin/env bash
 # Copyright (c) 2015-2026 Dotfiles. All rights reserved.
+# Sourced by scripts/dot/commands/*.sh and dot_local/bin/executable_dot; inherits set -euo pipefail.
 # Dotfiles CLI Utilities
 # Shared functions for dot command modules
 
+# Re-source guard: cheap short-circuit when sourced from multiple modules.
+[[ "${_DOT_LIB_UTILS_LOADED:-0}" == "1" ]] && return 0
+_DOT_LIB_UTILS_LOADED=1
+
 SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
 # shellcheck source=ui.sh
 source "$SCRIPT_DIR/ui.sh"
@@ -269,7 +274,7 @@ dot_command_summary() {
       echo "Manage secrets (set/get/list/load/provider)."
       ;;
     env)
-      echo "Load secret buckets into shell exports."
+      echo "List mise-managed toolchain versions and sources."
       ;;
     secrets-create)
       echo "Create a new encrypted secrets file."

package/scripts/git-hooks/pre-commit-audit.sh

@@ -140,6 +140,6 @@ if [[ $FAILED -eq 1 ]]; then
   printf '%b\\n' "   (Use --no-verify to bypass if absolutely necessary)"
   exit 1
 else
-  printf '%b\n' "${GREEN}${BOLD}✅ Audit passed.${NC} v0.2.500 standards maintained."
+  printf '%b\n' "${GREEN}${BOLD}✅ Audit passed.${NC} v0.2.502 standards maintained."
   exit 0
 fi