@vyuhlabs/dxkit 2.4.6 → 2.4.8

package/dist/analyzers/tests/shallow.js

@@ -1,8 +1,95 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
+exports.toTestingScoreInput = toTestingScoreInput;
+exports.scoreTestFromScoreInput = scoreTestFromScoreInput;
 exports.scoreTestsDimension = scoreTestsDimension;
-const scoring_1 = require("../scoring");
+/**
+ * Testing dimension — health-side adapter over the declarative
+ * testing scoring spec.
+ *
+ * Builds `TestingScoreInput` from the health-side `ScoreInput`
+ * (HealthMetrics + CapabilityReport) and dispatches through
+ * `evaluateSpec`. The resulting `DimensionScore` carries the score,
+ * rating letter, full provenance (deductions, capsApplied,
+ * topActions), and the dimension-specific metrics + details surfaced
+ * in the health audit's markdown.
+ */
+const scoring_1 = require("../../scoring");
+function coveragePercentFrom(c) {
+    const raw = c.coverage?.coverage.linePercent;
+    return raw === undefined ? null : Math.round(raw);
+}
+function toTestingScoreInput(input) {
+    const m = input.metrics;
+    const c = input.capabilities;
+    return {
+        sourceFiles: m.sourceFiles,
+        testFiles: m.testFiles,
+        coverageConfigExists: m.coverageConfigExists,
+        testsPass: m.testsPass,
+        coveragePercent: coveragePercentFrom(c),
+        commentedCodeRatio: c.structural?.commentedCodeRatio ?? null,
+    };
+}
+/**
+ * Score-only adapter for the health remediation planner. Mirrors
+ * `scoreSecurityFromScoreInput` / `scoreQualityFromScoreInput` so
+ * `health/actions.ts` stays symmetric across dimensions.
+ */
+function scoreTestFromScoreInput(input) {
+    return (0, scoring_1.evaluateSpec)(scoring_1.TESTING_SCORING_SPEC, toTestingScoreInput(input));
+}
 function scoreTestsDimension(input) {
-    return (0, scoring_1.scoreTest)(input);
+    const m = input.metrics;
+    const c = input.capabilities;
+    const scoreInput = toTestingScoreInput(input);
+    const result = (0, scoring_1.evaluateSpec)(scoring_1.TESTING_SCORING_SPEC, scoreInput);
+    const score = result.score;
+    const testRatio = m.testFiles / Math.max(m.sourceFiles, 1);
+    const coveragePercent = scoreInput.coveragePercent;
+    const testFramework = c.testFramework?.name ?? null;
+    const commentedCodeRatio = scoreInput.commentedCodeRatio;
+    return {
+        score,
+        maxScore: 100,
+        rating: (0, scoring_1.ratingFromScore)(score),
+        rawScore: result.rawScore,
+        rawPenalty: result.rawPenalty,
+        methodology: result.methodology,
+        deductions: result.deductions,
+        capsApplied: result.capsApplied,
+        topActions: result.topActions,
+        // Schema v11: `metrics` surfaces only the non-capability signals.
+        // Capability-owned values (coverage / testFramework / structural)
+        // live in `report.capabilities.*` so downstream consumers read
+        // them from one place.
+        metrics: {
+            sourceFiles: m.sourceFiles,
+            testFiles: m.testFiles,
+            testRatio: Math.round(testRatio * 100) / 100,
+            testsPass: m.testsPass,
+            coverageConfigExists: m.coverageConfigExists,
+        },
+        details: m.testFiles === 0
+            ? `No test files found across ${m.sourceFiles} source files. 0% test coverage.`
+            : `${m.testFiles} test files for ${m.sourceFiles} source files (ratio: ${(testRatio * 100).toFixed(1)}%). ` +
+                `Tests ${m.testsPass === true ? 'pass' : m.testsPass === false ? 'fail' : 'not run'}. ` +
+                (coveragePercent !== null ? `Coverage: ${coveragePercent}%. ` : 'No coverage data. ') +
+                // Always surface framework state explicitly. A silent omission
+                // when detection fails reads as "no framework needed" rather
+                // than "we couldn't infer it" — the latter is actionable
+                // (configure the test runner; report a detection gap).
+                `Framework: ${testFramework || 'not detected'}.` +
+                // When tests are detected but haven't executed AND no coverage
+                // artifact is on disk, the customer's next step is to run
+                // dxkit's coverage subcommand — surface that explicitly so
+                // "0% coverage" doesn't read as an indictment of the codebase.
+                (m.testsPass === null && coveragePercent === null
+                    ? ' Run `vyuh-dxkit coverage` to materialize test execution + coverage data.'
+                    : '') +
+                (commentedCodeRatio !== null && commentedCodeRatio > 0.5
+                    ? ` Warning: ${(commentedCodeRatio * 100).toFixed(0)}% of source files appear to contain only comments.`
+                    : ''),
+    };
 }
 //# sourceMappingURL=shallow.js.map

package/dist/analyzers/tests/shallow.js.map

@@ -1 +1 @@
-{"version":3,"file":"shallow.js","sourceRoot":"","sources":["../../../src/analyzers/tests/shallow.ts"],"names":[],"mappings":";;AASA,kDAEC;AAJD,wCAAmD;AAEnD,SAAgB,mBAAmB,CAAC,KAAiB;IACnD,OAAO,IAAA,mBAAS,EAAC,KAAK,CAAC,CAAC;AAC1B,CAAC"}
+{"version":3,"file":"shallow.js","sourceRoot":"","sources":["../../../src/analyzers/tests/shallow.ts"],"names":[],"mappings":";;AAyBA,kDAWC;AAOD,0DAEC;AAED,kDAuDC;AAtGD;;;;;;;;;;GAUG;AACH,2CAKuB;AAIvB,SAAS,mBAAmB,CAAC,CAAmB;IAC9C,MAAM,GAAG,GAAG,CAAC,CAAC,QAAQ,EAAE,QAAQ,CAAC,WAAW,CAAC;IAC7C,OAAO,GAAG,KAAK,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;AACpD,CAAC;AAED,SAAgB,mBAAmB,CAAC,KAAiB;IACnD,MAAM,CAAC,GAAG,KAAK,CAAC,OAAO,CAAC;IACxB,MAAM,CAAC,GAAG,KAAK,CAAC,YAAY,CAAC;IAC7B,OAAO;QACL,WAAW,EAAE,CAAC,CAAC,WAAW;QAC1B,SAAS,EAAE,CAAC,CAAC,SAAS;QACtB,oBAAoB,EAAE,CAAC,CAAC,oBAAoB;QAC5C,SAAS,EAAE,CAAC,CAAC,SAAS;QACtB,eAAe,EAAE,mBAAmB,CAAC,CAAC,CAAC;QACvC,kBAAkB,EAAE,CAAC,CAAC,UAAU,EAAE,kBAAkB,IAAI,IAAI;KAC7D,CAAC;AACJ,CAAC;AAED;;;;GAIG;AACH,SAAgB,uBAAuB,CAAC,KAAiB;IACvD,OAAO,IAAA,sBAAY,EAAC,8BAAoB,EAAE,mBAAmB,CAAC,KAAK,CAAC,CAAC,CAAC;AACxE,CAAC;AAED,SAAgB,mBAAmB,CAAC,KAAiB;IACnD,MAAM,CAAC,GAAG,KAAK,CAAC,OAAO,CAAC;IACxB,MAAM,CAAC,GAAG,KAAK,CAAC,YAAY,CAAC;IAC7B,MAAM,UAAU,GAAG,mBAAmB,CAAC,KAAK,CAAC,CAAC;IAC9C,MAAM,MAAM,GAAG,IAAA,sBAAY,EAAC,8BAAoB,EAAE,UAAU,CAAC,CAAC;IAC9D,MAAM,KAAK,GAAG,MAAM,CAAC,KAAK,CAAC;IAE3B,MAAM,SAAS,GAAG,CAAC,CAAC,SAAS,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC;IAC3D,MAAM,eAAe,GAAG,UAAU,CAAC,eAAe,CAAC;IACnD,MAAM,aAAa,GAAG,CAAC,CAAC,aAAa,EAAE,IAAI,IAAI,IAAI,CAAC;IACpD,MAAM,kBAAkB,GAAG,UAAU,CAAC,kBAAkB,CAAC;IAEzD,OAAO;QACL,KAAK;QACL,QAAQ,EAAE,GAAG;QACb,MAAM,EAAE,IAAA,yBAAe,EAAC,KAAK,CAAC;QAC9B,QAAQ,EAAE,MAAM,CAAC,QAAQ;QACzB,UAAU,EAAE,MAAM,CAAC,UAAU;QAC7B,WAAW,EAAE,MAAM,CAAC,WAAW;QAC/B,UAAU,EAAE,MAAM,CAAC,UAAU;QAC7B,WAAW,EAAE,MAAM,CAAC,WAAW;QAC/B,UAAU,EAAE,MAAM,CAAC,UAAU;QAC7B,kEAAkE;QAClE,kEAAkE;QAClE,+DAA+D;QAC/D,uBAAuB;QACvB,OAAO,EAAE;YACP,WAAW,EAAE,CAAC,CAAC,WAAW;YAC1B,SAAS,EAAE,CAAC,CAAC,SAAS;YACtB,SAAS,EAAE,IAAI,CAAC,KAAK,CAAC,SAAS,GAAG,GAAG,CAAC,GAAG,GAAG;YAC5C,SAAS,EAAE,CAAC,CAAC,SAAS;YACtB,oBAAoB,EAAE,CAAC,CAAC,oBAAoB;SAC7C;QACD,OAAO,EACL,CAAC,CAAC,SAAS,KAAK,CAAC;YACf,CAAC,CAAC,8BAA8B,CAAC,CAAC,WAAW,kCAAkC;YAC/E,CAAC,CAAC,GAAG,CAAC,CAAC,SAAS,mBAAmB,CAAC,CAAC,WAAW,yBAAyB,CAAC,SAAS,GAAG,GAAG,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM;gBACzG,SAAS,CAAC,CAAC,SAAS,KAAK,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS,KAAK,KAAK,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,SAAS,IAAI;gBACvF,CAAC,eAAe,KAAK,IAAI,CAAC,CAAC,CAAC,aAAa,eAAe,KAAK,CAAC,CAAC,CAAC,oBAAoB,CAAC;gBACrF,+DAA+D;gBAC/D,6DAA6D;gBAC7D,yDAAyD;gBACzD,uDAAuD;gBACvD,cAAc,aAAa,IAAI,cAAc,GAAG;gBAChD,+DAA+D;gBAC/D,0DAA0D;gBAC1D,2DAA2D;gBAC3D,+DAA+D;gBAC/D,CAAC,CAAC,CAAC,SAAS,KAAK,IAAI,IAAI,eAAe,KAAK,IAAI;oBAC/C,CAAC,CAAC,2EAA2E;oBAC7E,CAAC,CAAC,EAAE,CAAC;gBACP,CAAC,kBAAkB,KAAK,IAAI,IAAI,kBAAkB,GAAG,GAAG;oBACtD,CAAC,CAAC,aAAa,CAAC,kBAAkB,GAAG,GAAG,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,oDAAoD;oBACxG,CAAC,CAAC,EAAE,CAAC;KACd,CAAC;AACJ,CAAC"}

package/dist/analyzers/tests/types.d.ts

@@ -10,7 +10,18 @@ export interface TestFile {
 export interface SourceFile {
     path: string;
     lines: number;
-    type: 'controller' | 'service' | 'interceptor' | 'model' | 'repository' | 'other';
+    /**
+     * Architectural-role label drawn from the path segment that matched
+     * an active language pack's `architecturalShape` contribution. Pre-
+     * extension this was a closed union with backend-shaped values
+     * (`'controller' | 'service' | 'interceptor' | 'model' |
+     * 'repository' | 'other'`). Post-extension the values come from
+     * the matched path pattern (e.g. `'Forms'` for a csharp WinForms
+     * file, `'components'` for a React component), so the field is a
+     * free string with `'other'` as the fallback when no pack pattern
+     * matches.
+     */
+    type: string;
     risk: RiskTier;
     hasMatchingTest: boolean;
 }
@@ -26,6 +37,29 @@ export interface SourceFile {
  */
 import type { CoverageSource as ArtifactCoverageSource } from '../tools/coverage';
 export type CoverageSource = ArtifactCoverageSource | 'filename-match' | 'import-graph';
+/**
+ * D021 (sub-branch #6, 2.4.7): tier-classification of `coverageSource`.
+ * Surfaces the trust level of `effectiveCoverage` so reports + the
+ * dashboard can warn users when the headline is heuristic vs ground-truth.
+ *
+ *   `line-coverage` — real artifact (istanbul, coverage-py, jacoco,
+ *                     simplecov, lcov, cobertura, go, ...). The percent
+ *                     is line-coverage truth — what your test run
+ *                     actually exercised.
+ *   `import-graph`  — derived from test files' import edges (up to N
+ *                     hops). Stronger than filename-match because
+ *                     it follows real call paths, but it doesn't know
+ *                     what actually executed at runtime.
+ *   `filename-match`— share of source files with a name-matched test.
+ *                     Pure heuristic: a 200-line file with a 5-line
+ *                     test passes the predicate. Install a coverage
+ *                     pipeline to get line-level truth.
+ *
+ * Computed deterministically from `coverageSource` via
+ * `tierFromCoverageSource()` in `tests/index.ts`; no separate input
+ * needed.
+ */
+export type CoverageFidelity = 'line-coverage' | 'import-graph' | 'filename-match';
 export interface TestGapsReport {
     repo: string;
     analyzedAt: string;
@@ -43,6 +77,12 @@ export interface TestGapsReport {
         effectiveCoverage: number;
         /** Which signal produced `effectiveCoverage`. */
         coverageSource: CoverageSource;
+        /**
+         * D021 (2.4.7): tier-classification of `coverageSource` so consumers
+         * can render trust banners + filter on heuristic-vs-ground-truth
+         * without re-parsing the source string. See `CoverageFidelity`.
+         */
+        coverageFidelity: CoverageFidelity;
         /** Project-relative path of the artifact, when one was used. */
         coverageSourceFile?: string;
         sourceFiles: number;

package/dist/analyzers/tests/types.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../../src/analyzers/tests/types.ts"],"names":[],"mappings":"AAAA;;GAEG;AAEH,MAAM,MAAM,QAAQ,GAAG,UAAU,GAAG,MAAM,GAAG,QAAQ,GAAG,KAAK,CAAC;AAE9D,MAAM,WAAW,QAAQ;IACvB,IAAI,EAAE,MAAM,CAAC;IACb,MAAM,EAAE,QAAQ,GAAG,eAAe,GAAG,OAAO,GAAG,aAAa,CAAC;IAC7D,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;CAC1B;AAED,MAAM,WAAW,UAAU;IACzB,IAAI,EAAE,MAAM,CAAC;IACb,KAAK,EAAE,MAAM,CAAC;IACd,IAAI,EAAE,YAAY,GAAG,SAAS,GAAG,aAAa,GAAG,OAAO,GAAG,YAAY,GAAG,OAAO,CAAC;IAClF,IAAI,EAAE,QAAQ,CAAC;IACf,eAAe,EAAE,OAAO,CAAC;CAC1B;AAED;;;;;;;;;GASG;AACH,OAAO,KAAK,EAAE,cAAc,IAAI,sBAAsB,EAAE,MAAM,mBAAmB,CAAC;AAElF,MAAM,MAAM,cAAc,GACtB,sBAAsB,GACtB,gBAAgB,GAChB,cAAc,CAAC;AAEnB,MAAM,WAAW,cAAc;IAC7B,IAAI,EAAE,MAAM,CAAC;IACb,UAAU,EAAE,MAAM,CAAC;IACnB,SAAS,EAAE,MAAM,CAAC;IAClB,MAAM,EAAE,MAAM,CAAC;IACf,OAAO,EAAE;QACP,SAAS,EAAE,MAAM,CAAC;QAClB,eAAe,EAAE,MAAM,CAAC;QACxB,iBAAiB,EAAE,MAAM,CAAC;QAC1B;;;;WAIG;QACH,iBAAiB,EAAE,MAAM,CAAC;QAC1B,iDAAiD;QACjD,cAAc,EAAE,cAAc,CAAC;QAC/B,gEAAgE;QAChE,kBAAkB,CAAC,EAAE,MAAM,CAAC;QAC5B,WAAW,EAAE,MAAM,CAAC;QACpB,gBAAgB,EAAE,MAAM,CAAC;QACzB,YAAY,EAAE,MAAM,CAAC;QACrB,cAAc,EAAE,MAAM,CAAC;QACvB,WAAW,EAAE,MAAM,CAAC;KACrB,CAAC;IACF,SAAS,EAAE,QAAQ,EAAE,CAAC;IACtB,IAAI,EAAE,UAAU,EAAE,CAAC;IACnB,SAAS,EAAE,MAAM,EAAE,CAAC;IACpB,gBAAgB,EAAE,MAAM,EAAE,CAAC;CAC5B"}
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../../src/analyzers/tests/types.ts"],"names":[],"mappings":"AAAA;;GAEG;AAEH,MAAM,MAAM,QAAQ,GAAG,UAAU,GAAG,MAAM,GAAG,QAAQ,GAAG,KAAK,CAAC;AAE9D,MAAM,WAAW,QAAQ;IACvB,IAAI,EAAE,MAAM,CAAC;IACb,MAAM,EAAE,QAAQ,GAAG,eAAe,GAAG,OAAO,GAAG,aAAa,CAAC;IAC7D,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;CAC1B;AAED,MAAM,WAAW,UAAU;IACzB,IAAI,EAAE,MAAM,CAAC;IACb,KAAK,EAAE,MAAM,CAAC;IACd;;;;;;;;;;OAUG;IACH,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,QAAQ,CAAC;IACf,eAAe,EAAE,OAAO,CAAC;CAC1B;AAED;;;;;;;;;GASG;AACH,OAAO,KAAK,EAAE,cAAc,IAAI,sBAAsB,EAAE,MAAM,mBAAmB,CAAC;AAElF,MAAM,MAAM,cAAc,GACtB,sBAAsB,GACtB,gBAAgB,GAChB,cAAc,CAAC;AAEnB;;;;;;;;;;;;;;;;;;;;;GAqBG;AACH,MAAM,MAAM,gBAAgB,GAAG,eAAe,GAAG,cAAc,GAAG,gBAAgB,CAAC;AAEnF,MAAM,WAAW,cAAc;IAC7B,IAAI,EAAE,MAAM,CAAC;IACb,UAAU,EAAE,MAAM,CAAC;IACnB,SAAS,EAAE,MAAM,CAAC;IAClB,MAAM,EAAE,MAAM,CAAC;IACf,OAAO,EAAE;QACP,SAAS,EAAE,MAAM,CAAC;QAClB,eAAe,EAAE,MAAM,CAAC;QACxB,iBAAiB,EAAE,MAAM,CAAC;QAC1B;;;;WAIG;QACH,iBAAiB,EAAE,MAAM,CAAC;QAC1B,iDAAiD;QACjD,cAAc,EAAE,cAAc,CAAC;QAC/B;;;;WAIG;QACH,gBAAgB,EAAE,gBAAgB,CAAC;QACnC,gEAAgE;QAChE,kBAAkB,CAAC,EAAE,MAAM,CAAC;QAC5B,WAAW,EAAE,MAAM,CAAC;QACpB,gBAAgB,EAAE,MAAM,CAAC;QACzB,YAAY,EAAE,MAAM,CAAC;QACrB,cAAc,EAAE,MAAM,CAAC;QACvB,WAAW,EAAE,MAAM,CAAC;KACrB,CAAC;IACF,SAAS,EAAE,QAAQ,EAAE,CAAC;IACtB,IAAI,EAAE,UAAU,EAAE,CAAC;IACnB,SAAS,EAAE,MAAM,EAAE,CAAC;IACpB,gBAAgB,EAAE,MAAM,EAAE,CAAC;CAC5B"}

package/dist/analyzers/tools/autogen-header.d.ts

@@ -0,0 +1,8 @@
+/**
+ * Probe the first ~2KB of `absPath` for a known auto-generated
+ * marker. Returns true on match, false otherwise (including on read
+ * errors — over-include is preferable to silently dropping unreadable
+ * files).
+ */
+export declare function isAutogeneratedByHeader(absPath: string): boolean;
+//# sourceMappingURL=autogen-header.d.ts.map

package/dist/analyzers/tools/autogen-header.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"autogen-header.d.ts","sourceRoot":"","sources":["../../../src/analyzers/tools/autogen-header.ts"],"names":[],"mappings":"AA4CA;;;;;GAKG;AACH,wBAAgB,uBAAuB,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO,CAmBhE"}

package/dist/analyzers/tools/autogen-header.js

@@ -0,0 +1,107 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.isAutogeneratedByHeader = isAutogeneratedByHeader;
+/**
+ * D028 extension (2.4.7): auto-generated source-file detection via
+ * file headers. Complements `LanguageSupport.autogeneratedSourcePatterns`
+ * (basename globs like `*.designer.cs`, `*.pb.go`) by catching the
+ * harder case: hand-named generated files that don't match any basename
+ * pattern.
+ *
+ * Motivating case: the .NET WinForms benchmark's SAP Business One integration code
+ * includes 30+ files named `OWTQ.cs`, `OPCH.cs`, `ADOC.cs`, etc. —
+ * each 11,517 lines, generated by SAP's tool chain. None match the
+ * standard csharp autogen patterns (no `.designer.cs` / `.g.cs` /
+ * `Reference.cs` suffix), so pre-D028-headers they appeared as
+ * legitimate source files. They clutter:
+ *   - test-gaps LOW priority (30 × 11K-line "untested files")
+ *   - Maintainability "largest file" + "files over 500 lines"
+ *   - Code Quality function counts (62,271 → likely ~20,000 real)
+ *
+ * Header markers cover the de-facto industry conventions:
+ *
+ *   `<auto-generated>`       .NET MSBuild / WCF / EF Core; appears in
+ *                            XML doc on line 2 of generated .cs files
+ *   `@generated`             Facebook's universal convention; recognised
+ *                            by Phabricator, GitHub's linguist, etc.
+ *                            Used by Hack, JS, Python, Java, more
+ *   `Code generated by`      Go protobuf / stringer / mockgen / cmd/cgo;
+ *                            documented in golang.org/s/generatedcode
+ *   `Generated by`           Common across OpenAPI Generator, GraphQL
+ *                            codegen, Thrift, Avro, etc.
+ *   `DO NOT EDIT`            Near-universal — most autogen tools emit
+ *                            this string somewhere in the first few lines
+ *   `AUTO-GENERATED`         Variant of DO NOT EDIT
+ *
+ * Read at most the first 2KB of each file (covers >5 lines for any
+ * reasonable language) and apply a single regex over the union.
+ *
+ * Cost: ~4MB of disk I/O for a 4163-file repo (~1KB read per file
+ * via the underlying page cache). Negligible vs. the wc-l pass that
+ * already reads every file fully.
+ */
+const fs = __importStar(require("fs"));
+const AUTOGEN_HEADER_RE = /<auto-generated>|@generated\b|Code generated by\b|Generated by\b|DO NOT EDIT|AUTO-GENERATED/i;
+/**
+ * Probe the first ~2KB of `absPath` for a known auto-generated
+ * marker. Returns true on match, false otherwise (including on read
+ * errors — over-include is preferable to silently dropping unreadable
+ * files).
+ */
+function isAutogeneratedByHeader(absPath) {
+    let fd = null;
+    try {
+        fd = fs.openSync(absPath, 'r');
+        const buf = Buffer.alloc(2048);
+        const n = fs.readSync(fd, buf, 0, 2048, 0);
+        const head = buf.toString('utf-8', 0, n);
+        return AUTOGEN_HEADER_RE.test(head);
+    }
+    catch {
+        return false;
+    }
+    finally {
+        if (fd !== null) {
+            try {
+                fs.closeSync(fd);
+            }
+            catch {
+                /* ignore */
+            }
+        }
+    }
+}
+//# sourceMappingURL=autogen-header.js.map

package/dist/analyzers/tools/autogen-header.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"autogen-header.js","sourceRoot":"","sources":["../../../src/analyzers/tools/autogen-header.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAkDA,0DAmBC;AArED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAsCG;AACH,uCAAyB;AAEzB,MAAM,iBAAiB,GACrB,8FAA8F,CAAC;AAEjG;;;;;GAKG;AACH,SAAgB,uBAAuB,CAAC,OAAe;IACrD,IAAI,EAAE,GAAkB,IAAI,CAAC;IAC7B,IAAI,CAAC;QACH,EAAE,GAAG,EAAE,CAAC,QAAQ,CAAC,OAAO,EAAE,GAAG,CAAC,CAAC;QAC/B,MAAM,GAAG,GAAG,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;QAC/B,MAAM,CAAC,GAAG,EAAE,CAAC,QAAQ,CAAC,EAAE,EAAE,GAAG,EAAE,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC;QAC3C,MAAM,IAAI,GAAG,GAAG,CAAC,QAAQ,CAAC,OAAO,EAAE,CAAC,EAAE,CAAC,CAAC,CAAC;QACzC,OAAO,iBAAiB,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IACtC,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;YAAS,CAAC;QACT,IAAI,EAAE,KAAK,IAAI,EAAE,CAAC;YAChB,IAAI,CAAC;gBACH,EAAE,CAAC,SAAS,CAAC,EAAE,CAAC,CAAC;YACnB,CAAC;YAAC,MAAM,CAAC;gBACP,YAAY;YACd,CAAC;QACH,CAAC;IACH,CAAC;AACH,CAAC"}

package/dist/analyzers/tools/cloc.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"cloc.d.ts","sourceRoot":"","sources":["../../../src/analyzers/tools/cloc.ts"],"names":[],"mappings":"AAAA;;;GAGG;AACH,OAAO,EAAE,aAAa,EAAE,MAAM,UAAU,CAAC;AAYzC,uCAAuC;AACvC,wBAAgB,iBAAiB,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,aAAa,CAAC,CAkBrE"}
+{"version":3,"file":"cloc.d.ts","sourceRoot":"","sources":["../../../src/analyzers/tools/cloc.ts"],"names":[],"mappings":"AAAA;;;GAGG;AACH,OAAO,EAAE,aAAa,EAAE,MAAM,UAAU,CAAC;AAazC,uCAAuC;AACvC,wBAAgB,iBAAiB,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,aAAa,CAAC,CAqBrE"}

package/dist/analyzers/tools/cloc.js

@@ -3,13 +3,17 @@ Object.defineProperty(exports, "__esModule", { value: true });
 exports.gatherClocMetrics = gatherClocMetrics;
 const runner_1 = require("./runner");
 const exclusions_1 = require("./exclusions");
+const languages_1 = require("../../languages");
 const SKIP_KEYS = new Set(['header', 'SUM']);
 /** Gather metrics from cloc --json. */
 function gatherClocMetrics(cwd) {
     // --timeout 0 disables per-file timeout (suppresses warning that breaks JSON parse)
-    // cloc uses basename matching for --exclude-dir, so use dir names without slashes
-    const excludeDirs = (0, exclusions_1.getClocExcludeDirs)(cwd);
-    const flags = `--json --timeout 0 --exclude-dir=${excludeDirs}`;
+    // D055 (2.4.7): getClocExcludeFlags emits BOTH `--exclude-dir` (basenames)
+    // AND `--fullpath --not-match-d` (Perl regex on full path) so multi-segment
+    // `.dxkit-ignore` entries like `Dev/Addons/VendorAddon/SAPB1/` exclude the
+    // correct subtree instead of every dir named `Dev`.
+    const excludeFlags = (0, exclusions_1.getClocExcludeFlags)(cwd);
+    const flags = `--json --timeout 0 ${excludeFlags}`;
     // Try system cloc first (faster), then npx as fallback
     const result = (0, runner_1.runJSON)(`cloc . ${flags} 2>/dev/null`, cwd, 180000);
     if (!result || !result.SUM) {
@@ -22,13 +26,28 @@ function gatherClocMetrics(cwd) {
     return parseClocResult(result);
 }
 function parseClocResult(result) {
+    // D073 (2.4.7): filter cloc's per-language summary to the names
+    // declared by registered packs. Pre-D073 the language table + the
+    // `totalLines` denominator included markup/data formats (JSON,
+    // XML, CSV, YAML, Markdown) that cloc lists alongside "real"
+    // languages. On the .NET WinForms benchmark the 1.6M-line JSON + 1.3M-line XML
+    // dragged the quality "Comment Ratio" from a true ~25% (C#
+    // comments / C# total) to 4.3% (all comments / all-cloc-totals).
+    // The pack registry is the canonical source of "what counts as
+    // source code"; cloc's own categorization is intentionally broad.
+    const packLanguages = new Set((0, languages_1.allClocLanguageNames)());
     const clocLanguages = [];
+    let totalCode = 0;
+    let totalComment = 0;
+    let totalBlank = 0;
     for (const [key, value] of Object.entries(result)) {
         if (SKIP_KEYS.has(key))
             continue;
         const lang = value;
         if (typeof lang.nFiles !== 'number')
             continue;
+        if (!packLanguages.has(key))
+            continue;
         clocLanguages.push({
             language: key,
             files: lang.nFiles,
@@ -36,12 +55,24 @@ function parseClocResult(result) {
             comment: lang.comment,
             blank: lang.blank,
         });
+        totalCode += lang.code;
+        totalComment += lang.comment;
+        totalBlank += lang.blank;
     }
     // Sort by code lines descending
     clocLanguages.sort((a, b) => b.code - a.code);
+    // D057 (2.4.7): cloc no longer writes `sourceFiles`. Pre-fix the
+    // mergeLayer2 overlay blindly overwrote generic's find-based count
+    // with cloc's, which (a) included markup/data files (JSON/XML/CSV)
+    // that aren't source, and (b) on the .NET WinForms benchmark was broken by D055.
+    // Field ownership: generic.ts owns sourceFiles; cloc owns line
+    // counts + language breakdown. (Class-fix tracked as G_v4_8 in
+    // recipe v4 — "each gather declares which fields it owns; merger
+    // errors on overlap".)
+    // totalLines is now derived from the pack-filtered language sum so
+    // it represents source lines, not source+markup+data lines.
     return {
-        sourceFiles: result.SUM.nFiles,
-        totalLines: result.SUM.code + result.SUM.comment + result.SUM.blank,
+        totalLines: totalCode + totalComment + totalBlank,
         clocLanguages,
         toolsUsed: ['cloc'],
     };

package/dist/analyzers/tools/cloc.js.map

@@ -1 +1 @@
-{"version":3,"file":"cloc.js","sourceRoot":"","sources":["../../../src/analyzers/tools/cloc.ts"],"names":[],"mappings":";;AAiBA,8CAkBC;AA9BD,qCAAmC;AACnC,6CAAkD;AAQlD,MAAM,SAAS,GAAG,IAAI,GAAG,CAAC,CAAC,QAAQ,EAAE,KAAK,CAAC,CAAC,CAAC;AAE7C,uCAAuC;AACvC,SAAgB,iBAAiB,CAAC,GAAW;IAC3C,oFAAoF;IACpF,kFAAkF;IAClF,MAAM,WAAW,GAAG,IAAA,+BAAkB,EAAC,GAAG,CAAC,CAAC;IAC5C,MAAM,KAAK,GAAG,oCAAoC,WAAW,EAAE,CAAC;IAEhE,uDAAuD;IACvD,MAAM,MAAM,GAAG,IAAA,gBAAO,EAAa,UAAU,KAAK,cAAc,EAAE,GAAG,EAAE,MAAM,CAAC,CAAC;IAE/E,IAAI,CAAC,MAAM,IAAI,CAAC,MAAM,CAAC,GAAG,EAAE,CAAC;QAC3B,MAAM,QAAQ,GAAG,IAAA,gBAAO,EAAa,cAAc,KAAK,cAAc,EAAE,GAAG,EAAE,MAAM,CAAC,CAAC;QACrF,IAAI,CAAC,QAAQ,IAAI,CAAC,QAAQ,CAAC,GAAG,EAAE,CAAC;YAC/B,OAAO,EAAE,gBAAgB,EAAE,CAAC,MAAM,CAAC,EAAE,CAAC;QACxC,CAAC;QACD,OAAO,eAAe,CAAC,QAAQ,CAAC,CAAC;IACnC,CAAC;IAED,OAAO,eAAe,CAAC,MAAM,CAAC,CAAC;AACjC,CAAC;AAED,SAAS,eAAe,CAAC,MAAkB;IACzC,MAAM,aAAa,GAAmC,EAAE,CAAC;IAEzD,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC;QAClD,IAAI,SAAS,CAAC,GAAG,CAAC,GAAG,CAAC;YAAE,SAAS;QACjC,MAAM,IAAI,GAAG,KAAyE,CAAC;QACvF,IAAI,OAAO,IAAI,CAAC,MAAM,KAAK,QAAQ;YAAE,SAAS;QAC9C,aAAa,CAAC,IAAI,CAAC;YACjB,QAAQ,EAAE,GAAG;YACb,KAAK,EAAE,IAAI,CAAC,MAAM;YAClB,IAAI,EAAE,IAAI,CAAC,IAAI;YACf,OAAO,EAAE,IAAI,CAAC,OAAO;YACrB,KAAK,EAAE,IAAI,CAAC,KAAK;SAClB,CAAC,CAAC;IACL,CAAC;IAED,gCAAgC;IAChC,aAAa,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC;IAE9C,OAAO;QACL,WAAW,EAAE,MAAM,CAAC,GAAG,CAAC,MAAM;QAC9B,UAAU,EAAE,MAAM,CAAC,GAAG,CAAC,IAAI,GAAG,MAAM,CAAC,GAAG,CAAC,OAAO,GAAG,MAAM,CAAC,GAAG,CAAC,KAAK;QACnE,aAAa;QACb,SAAS,EAAE,CAAC,MAAM,CAAC;KACpB,CAAC;AACJ,CAAC"}
+{"version":3,"file":"cloc.js","sourceRoot":"","sources":["../../../src/analyzers/tools/cloc.ts"],"names":[],"mappings":";;AAkBA,8CAqBC;AAlCD,qCAAmC;AACnC,6CAAmD;AACnD,+CAAuD;AAQvD,MAAM,SAAS,GAAG,IAAI,GAAG,CAAC,CAAC,QAAQ,EAAE,KAAK,CAAC,CAAC,CAAC;AAE7C,uCAAuC;AACvC,SAAgB,iBAAiB,CAAC,GAAW;IAC3C,oFAAoF;IACpF,2EAA2E;IAC3E,4EAA4E;IAC5E,2EAA2E;IAC3E,oDAAoD;IACpD,MAAM,YAAY,GAAG,IAAA,gCAAmB,EAAC,GAAG,CAAC,CAAC;IAC9C,MAAM,KAAK,GAAG,sBAAsB,YAAY,EAAE,CAAC;IAEnD,uDAAuD;IACvD,MAAM,MAAM,GAAG,IAAA,gBAAO,EAAa,UAAU,KAAK,cAAc,EAAE,GAAG,EAAE,MAAM,CAAC,CAAC;IAE/E,IAAI,CAAC,MAAM,IAAI,CAAC,MAAM,CAAC,GAAG,EAAE,CAAC;QAC3B,MAAM,QAAQ,GAAG,IAAA,gBAAO,EAAa,cAAc,KAAK,cAAc,EAAE,GAAG,EAAE,MAAM,CAAC,CAAC;QACrF,IAAI,CAAC,QAAQ,IAAI,CAAC,QAAQ,CAAC,GAAG,EAAE,CAAC;YAC/B,OAAO,EAAE,gBAAgB,EAAE,CAAC,MAAM,CAAC,EAAE,CAAC;QACxC,CAAC;QACD,OAAO,eAAe,CAAC,QAAQ,CAAC,CAAC;IACnC,CAAC;IAED,OAAO,eAAe,CAAC,MAAM,CAAC,CAAC;AACjC,CAAC;AAED,SAAS,eAAe,CAAC,MAAkB;IACzC,gEAAgE;IAChE,kEAAkE;IAClE,+DAA+D;IAC/D,6DAA6D;IAC7D,+EAA+E;IAC/E,2DAA2D;IAC3D,iEAAiE;IACjE,+DAA+D;IAC/D,kEAAkE;IAClE,MAAM,aAAa,GAAG,IAAI,GAAG,CAAC,IAAA,gCAAoB,GAAE,CAAC,CAAC;IAEtD,MAAM,aAAa,GAAmC,EAAE,CAAC;IACzD,IAAI,SAAS,GAAG,CAAC,CAAC;IAClB,IAAI,YAAY,GAAG,CAAC,CAAC;IACrB,IAAI,UAAU,GAAG,CAAC,CAAC;IAEnB,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC;QAClD,IAAI,SAAS,CAAC,GAAG,CAAC,GAAG,CAAC;YAAE,SAAS;QACjC,MAAM,IAAI,GAAG,KAAyE,CAAC;QACvF,IAAI,OAAO,IAAI,CAAC,MAAM,KAAK,QAAQ;YAAE,SAAS;QAC9C,IAAI,CAAC,aAAa,CAAC,GAAG,CAAC,GAAG,CAAC;YAAE,SAAS;QACtC,aAAa,CAAC,IAAI,CAAC;YACjB,QAAQ,EAAE,GAAG;YACb,KAAK,EAAE,IAAI,CAAC,MAAM;YAClB,IAAI,EAAE,IAAI,CAAC,IAAI;YACf,OAAO,EAAE,IAAI,CAAC,OAAO;YACrB,KAAK,EAAE,IAAI,CAAC,KAAK;SAClB,CAAC,CAAC;QACH,SAAS,IAAI,IAAI,CAAC,IAAI,CAAC;QACvB,YAAY,IAAI,IAAI,CAAC,OAAO,CAAC;QAC7B,UAAU,IAAI,IAAI,CAAC,KAAK,CAAC;IAC3B,CAAC;IAED,gCAAgC;IAChC,aAAa,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC;IAE9C,iEAAiE;IACjE,mEAAmE;IACnE,mEAAmE;IACnE,iFAAiF;IACjF,+DAA+D;IAC/D,+DAA+D;IAC/D,iEAAiE;IACjE,uBAAuB;IACvB,mEAAmE;IACnE,4DAA4D;IAC5D,OAAO;QACL,UAAU,EAAE,SAAS,GAAG,YAAY,GAAG,UAAU;QACjD,aAAa;QACb,SAAS,EAAE,CAAC,MAAM,CAAC;KACpB,CAAC;AACJ,CAAC"}

package/dist/analyzers/tools/deadline.d.ts

@@ -0,0 +1,67 @@
+/**
+ * Race a Promise against a deadline. The wrapper always settles within
+ * `deadlineMs + epsilon`, whether the inner Promise resolves, rejects,
+ * or never settles at all. Rejection of the inner Promise propagates
+ * untouched so callers can still see real provider errors.
+ *
+ * Why this exists: capability providers shell out to external tools
+ * (semgrep, jscpd, graphify, npm audit, pip-audit, …) and occasionally
+ * produce a Promise that never settles — typically because the
+ * provider awaits multiple async operations in turn and one of them
+ * (a `Promise.all`, a non-`runDetached` subprocess, a network call)
+ * silently hangs. `runDetached` has its own safety-deadline that
+ * forces its Promise to resolve, but providers can produce abandoned
+ * Promises outside `runDetached` too. The dispatcher used to wrap
+ * those calls in `Promise.allSettled`, which only collapses settled
+ * Promises — an unsettled Promise inside leaves the whole capability
+ * gather pending forever, the Node event loop empties, and the
+ * subprocess exits cleanly with no work done — a silent rc=0 with
+ * no report on disk. The reproducible offender on at least one
+ * heavy JS-stack customer audit has been `license-checker` walking
+ * a deep `node_modules` tree, which occasionally produces an
+ * unsettling Promise under concurrent subprocess load.
+ *
+ * The dispatcher applies this helper per-provider so any single
+ * provider that stalls is bounded; the rest of the Promise.allSettled
+ * still completes; the stalled source ends up in
+ * `DispatchOutcome.skipped` with a deadline reason that surfaces
+ * downstream in `toolsUnavailable`. Two non-dispatcher gathers
+ * (`gatherDepVulnsWithAvailability`, `gatherLicensesWithAvailability`)
+ * iterate packs themselves; they apply the same pattern at their
+ * own iteration site.
+ */
+export type DeadlineOutcome<T> = {
+    stalled: false;
+    value: T;
+} | {
+    stalled: true;
+    stalledMs: number;
+};
+/**
+ * Race `promise` against a `deadlineMs` timer. Returns:
+ *  - `{ stalled: false, value }` if the Promise resolves before the deadline
+ *  - `{ stalled: true, stalledMs }` if the deadline fires first
+ *
+ * Rejections of the inner Promise propagate as rejections of the
+ * returned Promise — callers handle them separately (e.g. via
+ * `Promise.allSettled`). The internal timer is cleared on settle so a
+ * resolved Promise doesn't leave a stray pending timer keeping Node
+ * alive past process exit.
+ */
+export declare function withDeadline<T>(promise: Promise<T>, deadlineMs: number): Promise<DeadlineOutcome<T>>;
+/**
+ * Default per-provider deadline for capability gathers. Chosen so the
+ * deadline only fires on genuine abandoned-Promise hangs, not on slow
+ * legitimate tool runs:
+ *  - jscpd's `runDetached` timeout is 600s; its safety-deadline adds 30s
+ *  - semgrep's `runDetached` timeout is 300s
+ *  - depVulns providers (npm/pip/gem audit, govulncheck, cargo-audit,
+ *    dotnet) typically settle within 60–180s on large monorepos
+ *
+ * 720s (12 min) sits above the slowest legitimate provider by ~90s of
+ * slack for parsing + aggregation. Real provider runs on the customer
+ * benchmark repos finish well inside this; only the stuck case trips
+ * it.
+ */
+export declare const DEFAULT_PROVIDER_DEADLINE_MS = 720000;
+//# sourceMappingURL=deadline.d.ts.map

package/dist/analyzers/tools/deadline.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"deadline.d.ts","sourceRoot":"","sources":["../../../src/analyzers/tools/deadline.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA+BG;AAEH,MAAM,MAAM,eAAe,CAAC,CAAC,IACzB;IAAE,OAAO,EAAE,KAAK,CAAC;IAAC,KAAK,EAAE,CAAC,CAAA;CAAE,GAC5B;IAAE,OAAO,EAAE,IAAI,CAAC;IAAC,SAAS,EAAE,MAAM,CAAA;CAAE,CAAC;AAEzC;;;;;;;;;;GAUG;AACH,wBAAgB,YAAY,CAAC,CAAC,EAC5B,OAAO,EAAE,OAAO,CAAC,CAAC,CAAC,EACnB,UAAU,EAAE,MAAM,GACjB,OAAO,CAAC,eAAe,CAAC,CAAC,CAAC,CAAC,CAkB7B;AAED;;;;;;;;;;;;;GAaG;AACH,eAAO,MAAM,4BAA4B,SAAU,CAAC"}

package/dist/analyzers/tools/deadline.js

@@ -0,0 +1,81 @@
+"use strict";
+/**
+ * Race a Promise against a deadline. The wrapper always settles within
+ * `deadlineMs + epsilon`, whether the inner Promise resolves, rejects,
+ * or never settles at all. Rejection of the inner Promise propagates
+ * untouched so callers can still see real provider errors.
+ *
+ * Why this exists: capability providers shell out to external tools
+ * (semgrep, jscpd, graphify, npm audit, pip-audit, …) and occasionally
+ * produce a Promise that never settles — typically because the
+ * provider awaits multiple async operations in turn and one of them
+ * (a `Promise.all`, a non-`runDetached` subprocess, a network call)
+ * silently hangs. `runDetached` has its own safety-deadline that
+ * forces its Promise to resolve, but providers can produce abandoned
+ * Promises outside `runDetached` too. The dispatcher used to wrap
+ * those calls in `Promise.allSettled`, which only collapses settled
+ * Promises — an unsettled Promise inside leaves the whole capability
+ * gather pending forever, the Node event loop empties, and the
+ * subprocess exits cleanly with no work done — a silent rc=0 with
+ * no report on disk. The reproducible offender on at least one
+ * heavy JS-stack customer audit has been `license-checker` walking
+ * a deep `node_modules` tree, which occasionally produces an
+ * unsettling Promise under concurrent subprocess load.
+ *
+ * The dispatcher applies this helper per-provider so any single
+ * provider that stalls is bounded; the rest of the Promise.allSettled
+ * still completes; the stalled source ends up in
+ * `DispatchOutcome.skipped` with a deadline reason that surfaces
+ * downstream in `toolsUnavailable`. Two non-dispatcher gathers
+ * (`gatherDepVulnsWithAvailability`, `gatherLicensesWithAvailability`)
+ * iterate packs themselves; they apply the same pattern at their
+ * own iteration site.
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.DEFAULT_PROVIDER_DEADLINE_MS = void 0;
+exports.withDeadline = withDeadline;
+/**
+ * Race `promise` against a `deadlineMs` timer. Returns:
+ *  - `{ stalled: false, value }` if the Promise resolves before the deadline
+ *  - `{ stalled: true, stalledMs }` if the deadline fires first
+ *
+ * Rejections of the inner Promise propagate as rejections of the
+ * returned Promise — callers handle them separately (e.g. via
+ * `Promise.allSettled`). The internal timer is cleared on settle so a
+ * resolved Promise doesn't leave a stray pending timer keeping Node
+ * alive past process exit.
+ */
+function withDeadline(promise, deadlineMs) {
+    let timer;
+    const deadlinePromise = new Promise((resolve) => {
+        timer = setTimeout(() => {
+            resolve({ stalled: true, stalledMs: deadlineMs });
+        }, deadlineMs);
+    });
+    const racedInner = promise.then((value) => {
+        if (timer !== undefined)
+            clearTimeout(timer);
+        return { stalled: false, value };
+    }, (err) => {
+        if (timer !== undefined)
+            clearTimeout(timer);
+        throw err;
+    });
+    return Promise.race([racedInner, deadlinePromise]);
+}
+/**
+ * Default per-provider deadline for capability gathers. Chosen so the
+ * deadline only fires on genuine abandoned-Promise hangs, not on slow
+ * legitimate tool runs:
+ *  - jscpd's `runDetached` timeout is 600s; its safety-deadline adds 30s
+ *  - semgrep's `runDetached` timeout is 300s
+ *  - depVulns providers (npm/pip/gem audit, govulncheck, cargo-audit,
+ *    dotnet) typically settle within 60–180s on large monorepos
+ *
+ * 720s (12 min) sits above the slowest legitimate provider by ~90s of
+ * slack for parsing + aggregation. Real provider runs on the customer
+ * benchmark repos finish well inside this; only the stuck case trips
+ * it.
+ */
+exports.DEFAULT_PROVIDER_DEADLINE_MS = 720_000;
+//# sourceMappingURL=deadline.js.map

package/dist/analyzers/tools/deadline.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"deadline.js","sourceRoot":"","sources":["../../../src/analyzers/tools/deadline.ts"],"names":[],"mappings":";AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA+BG;;;AAiBH,oCAqBC;AAhCD;;;;;;;;;;GAUG;AACH,SAAgB,YAAY,CAC1B,OAAmB,EACnB,UAAkB;IAElB,IAAI,KAAgD,CAAC;IACrD,MAAM,eAAe,GAAG,IAAI,OAAO,CAAqB,CAAC,OAAO,EAAE,EAAE;QAClE,KAAK,GAAG,UAAU,CAAC,GAAG,EAAE;YACtB,OAAO,CAAC,EAAE,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,UAAU,EAAE,CAAC,CAAC;QACpD,CAAC,EAAE,UAAU,CAAC,CAAC;IACjB,CAAC,CAAC,CAAC;IACH,MAAM,UAAU,GAAG,OAAO,CAAC,IAAI,CAC7B,CAAC,KAAK,EAAsB,EAAE;QAC5B,IAAI,KAAK,KAAK,SAAS;YAAE,YAAY,CAAC,KAAK,CAAC,CAAC;QAC7C,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC;IACnC,CAAC,EACD,CAAC,GAAG,EAAE,EAAE;QACN,IAAI,KAAK,KAAK,SAAS;YAAE,YAAY,CAAC,KAAK,CAAC,CAAC;QAC7C,MAAM,GAAG,CAAC;IACZ,CAAC,CACF,CAAC;IACF,OAAO,OAAO,CAAC,IAAI,CAAC,CAAC,UAAU,EAAE,eAAe,CAAC,CAAC,CAAC;AACrD,CAAC;AAED;;;;;;;;;;;;;GAaG;AACU,QAAA,4BAA4B,GAAG,OAAO,CAAC"}

package/dist/analyzers/tools/debug-statements.d.ts

@@ -0,0 +1,17 @@
+export interface DebugStatementsResult {
+    /** Total count across all patterns + extensions. */
+    count: number;
+    /** Top N offenders (most matches per file). Empty if topN was 0. */
+    topOffenders: Array<{
+        file: string;
+        count: number;
+    }>;
+}
+/**
+ * Count print-family debug statements project-wide. Pass `topN > 0`
+ * to populate `topOffenders` (e.g. for quality's `topConsoleFiles`).
+ */
+export declare function gatherDebugStatements(cwd: string, opts?: {
+    topN?: number;
+}): DebugStatementsResult;
+//# sourceMappingURL=debug-statements.d.ts.map

package/dist/analyzers/tools/debug-statements.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"debug-statements.d.ts","sourceRoot":"","sources":["../../../src/analyzers/tools/debug-statements.ts"],"names":[],"mappings":"AAqBA,MAAM,WAAW,qBAAqB;IACpC,oDAAoD;IACpD,KAAK,EAAE,MAAM,CAAC;IACd,oEAAoE;IACpE,YAAY,EAAE,KAAK,CAAC;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;CACtD;AAED;;;GAGG;AACH,wBAAgB,qBAAqB,CACnC,GAAG,EAAE,MAAM,EACX,IAAI,GAAE;IAAE,IAAI,CAAC,EAAE,MAAM,CAAA;CAAO,GAC3B,qBAAqB,CAkCvB"}

package/dist/analyzers/tools/debug-statements.js

@@ -0,0 +1,58 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.gatherDebugStatements = gatherDebugStatements;
+/**
+ * Print-family debug-statement counter — shared between health and
+ * quality so the cross-report `consoleLogCount` metric cannot drift.
+ *
+ * D079 + cross-report convergence (2.4.7 class-fix release): pre-fix
+ * health summed JS console + Py print + Go fmt.Print across
+ * language-scoped file lists, while quality counted only
+ * console.(log|error|warn) across all extensions. Result on platform:
+ * health=698, quality=675 (23-finding gap = Python `print(` matches).
+ * Same label, different aggregations.
+ *
+ * Post-fix: ONE function with the canonical multi-pattern definition.
+ * Both reports route through it; they cannot disagree.
+ *
+ * Pattern set (skipComments: true on each):
+ *   `.ts`/`.tsx`/`.js`/`.jsx`/`.mjs`/`.cjs`  → console.(log|error|warn)
+ *   `.py`                                     → \bprint\(
+ *   `.go`                                     → fmt\.Print
+ */
+const walk_source_files_1 = require("./walk-source-files");
+/**
+ * Count print-family debug statements project-wide. Pass `topN > 0`
+ * to populate `topOffenders` (e.g. for quality's `topConsoleFiles`).
+ */
+function gatherDebugStatements(cwd, opts = {}) {
+    const topN = opts.topN ?? 0;
+    // includeTests: true preserves pre-migration scope — debug statements
+    // in test fixtures were detected before, still are.
+    const tsFiles = (0, walk_source_files_1.walkSourceFiles)(cwd, {
+        extensions: ['.ts', '.tsx', '.js', '.jsx', '.mjs', '.cjs'],
+        includeTests: true,
+    });
+    const pyFiles = (0, walk_source_files_1.walkSourceFiles)(cwd, { extensions: ['.py'], includeTests: true });
+    const goFiles = (0, walk_source_files_1.walkSourceFiles)(cwd, { extensions: ['.go'], includeTests: true });
+    const tsResult = (0, walk_source_files_1.countLineMatches)(cwd, tsFiles, ['console\\.(log|error|warn)'], {
+        skipComments: true,
+        perFileTopN: topN,
+    });
+    const pyResult = (0, walk_source_files_1.countLineMatches)(cwd, pyFiles, ['\\bprint\\('], {
+        skipComments: true,
+        perFileTopN: topN,
+    });
+    const goResult = (0, walk_source_files_1.countLineMatches)(cwd, goFiles, ['fmt\\.Print'], {
+        skipComments: true,
+        perFileTopN: topN,
+    });
+    const count = tsResult.lines + pyResult.lines + goResult.lines;
+    if (topN === 0) {
+        return { count, topOffenders: [] };
+    }
+    const merged = [...tsResult.perFile, ...pyResult.perFile, ...goResult.perFile];
+    merged.sort((a, b) => b.count - a.count);
+    return { count, topOffenders: merged.slice(0, topN) };
+}
+//# sourceMappingURL=debug-statements.js.map

package/dist/analyzers/tools/debug-statements.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"debug-statements.js","sourceRoot":"","sources":["../../../src/analyzers/tools/debug-statements.ts"],"names":[],"mappings":";;AAgCA,sDAqCC;AArED;;;;;;;;;;;;;;;;;;GAkBG;AACH,2DAAwE;AASxE;;;GAGG;AACH,SAAgB,qBAAqB,CACnC,GAAW,EACX,OAA0B,EAAE;IAE5B,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,IAAI,CAAC,CAAC;IAE5B,sEAAsE;IACtE,oDAAoD;IACpD,MAAM,OAAO,GAAG,IAAA,mCAAe,EAAC,GAAG,EAAE;QACnC,UAAU,EAAE,CAAC,KAAK,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,CAAC;QAC1D,YAAY,EAAE,IAAI;KACnB,CAAC,CAAC;IACH,MAAM,OAAO,GAAG,IAAA,mCAAe,EAAC,GAAG,EAAE,EAAE,UAAU,EAAE,CAAC,KAAK,CAAC,EAAE,YAAY,EAAE,IAAI,EAAE,CAAC,CAAC;IAClF,MAAM,OAAO,GAAG,IAAA,mCAAe,EAAC,GAAG,EAAE,EAAE,UAAU,EAAE,CAAC,KAAK,CAAC,EAAE,YAAY,EAAE,IAAI,EAAE,CAAC,CAAC;IAElF,MAAM,QAAQ,GAAG,IAAA,oCAAgB,EAAC,GAAG,EAAE,OAAO,EAAE,CAAC,4BAA4B,CAAC,EAAE;QAC9E,YAAY,EAAE,IAAI;QAClB,WAAW,EAAE,IAAI;KAClB,CAAC,CAAC;IACH,MAAM,QAAQ,GAAG,IAAA,oCAAgB,EAAC,GAAG,EAAE,OAAO,EAAE,CAAC,aAAa,CAAC,EAAE;QAC/D,YAAY,EAAE,IAAI;QAClB,WAAW,EAAE,IAAI;KAClB,CAAC,CAAC;IACH,MAAM,QAAQ,GAAG,IAAA,oCAAgB,EAAC,GAAG,EAAE,OAAO,EAAE,CAAC,aAAa,CAAC,EAAE;QAC/D,YAAY,EAAE,IAAI;QAClB,WAAW,EAAE,IAAI;KAClB,CAAC,CAAC;IAEH,MAAM,KAAK,GAAG,QAAQ,CAAC,KAAK,GAAG,QAAQ,CAAC,KAAK,GAAG,QAAQ,CAAC,KAAK,CAAC;IAE/D,IAAI,IAAI,KAAK,CAAC,EAAE,CAAC;QACf,OAAO,EAAE,KAAK,EAAE,YAAY,EAAE,EAAE,EAAE,CAAC;IACrC,CAAC;IAED,MAAM,MAAM,GAAG,CAAC,GAAG,QAAQ,CAAC,OAAO,EAAE,GAAG,QAAQ,CAAC,OAAO,EAAE,GAAG,QAAQ,CAAC,OAAO,CAAC,CAAC;IAC/E,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,KAAK,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC;IACzC,OAAO,EAAE,KAAK,EAAE,YAAY,EAAE,MAAM,CAAC,KAAK,CAAC,CAAC,EAAE,IAAI,CAAC,EAAE,CAAC;AACxD,CAAC"}