api-tests-coverage 1.0.0

package/dist/src/index.js

@@ -0,0 +1,1441 @@
+#!/usr/bin/env node
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+Object.defineProperty(exports, "__esModule", { value: true });
+const commander_1 = require("commander");
+const path = __importStar(require("path"));
+const endpointCoverage_1 = require("./endpointCoverage");
+const parameterCoverage_1 = require("./parameterCoverage");
+const businessCoverage_1 = require("./businessCoverage");
+const integrationCoverage_1 = require("./integrationCoverage");
+const errorCoverage_1 = require("./errorCoverage");
+const securityCoverage_1 = require("./securityCoverage");
+const perfResilienceCoverage_1 = require("./perfResilienceCoverage");
+const compatibilityCoverage_1 = require("./compatibilityCoverage");
+const reporting_1 = require("./reporting");
+const config_1 = require("./config");
+const index_1 = require("./coverage/deep-analysis/index");
+const index_2 = require("./security/index");
+const pluginLoader_1 = require("./pluginLoader");
+const observability_1 = require("./observability");
+const languageDetection_1 = require("./languageDetection");
+const index_3 = require("./intelligence/index");
+const observability_2 = require("./observability");
+const buildSummary_1 = require("./summary/buildSummary");
+const prSummary_1 = require("./summary/prSummary");
+const astAnalysisOrchestrator_1 = require("./ast/astAnalysisOrchestrator");
+const projectDiscovery_1 = require("./discovery/projectDiscovery");
+const businessRuleInference_1 = require("./inference/businessRuleInference");
+const integrationFlowInference_1 = require("./inference/integrationFlowInference");
+// Register all language AST analyzers at startup.
+// This side-effect import ensures each language module's registerAnalyzer() call runs.
+(0, astAnalysisOrchestrator_1.registerAllAnalyzers)();
+const program = new commander_1.Command();
+program
+    .name('api-tests-coverage-analyzer')
+    .description('Analyze API test coverage based on OpenAPI specs')
+    .version('0.1.0')
+    .option('--config <file>', 'Path to a coverage configuration file (default: config.yaml)')
+    .option('--log-level <level>', 'Log verbosity level: trace|debug|info|warn|error|silent', 'info')
+    .option('--metrics-port <port>', 'Start a Prometheus /metrics HTTP server on this port after analysis', parseInt)
+    .option('--service-name <name>', 'Service name label added to all Prometheus metrics', 'api-coverage-analyzer')
+    .option('--trace', 'Enable OpenTelemetry tracing (spans recorded in memory or exported via OTLP)')
+    .option('--trace-endpoint <url>', 'OTLP HTTP endpoint for trace export (e.g. http://localhost:4318)');
+// ─── Config helper ─────────────────────────────────────────────────────────────
+/**
+ * Load and return the resolved CoverageConfig for a command invocation.
+ *
+ * Loads via the central config loader (config.yaml) first.  CLI threshold
+ * flags (non-zero values) take precedence and emit a deprecation warning.
+ * Legacy `testPatterns` / `plugins` are preserved via the old JSON loader
+ * for backward compatibility during the config.yaml migration.
+ */
+function loadCoverageConfig(configPath, cliThresholds) {
+    var _a, _b, _c, _d;
+    // Load via central config (config.yaml). Emits missing-config warning if absent.
+    const analyzerCfg = (0, config_1.loadCentralConfig)(configPath);
+    // Emit deprecation warnings for explicitly-set CLI threshold flags.
+    const activeCliThresholds = {};
+    for (const [key, value] of Object.entries(cliThresholds)) {
+        if (value > 0) {
+            process.stderr.write(`[DEPRECATED] --threshold-${key} CLI flag is deprecated. ` +
+                `Use thresholds.${key} in config.yaml instead.\n`);
+            activeCliThresholds[key] = value;
+        }
+    }
+    // Merge: central config thresholds < CLI threshold overrides.
+    const mergedThresholds = {
+        ...analyzerCfg.thresholds,
+        ...activeCliThresholds,
+    };
+    // For fields not covered by the new AnalyzerConfig schema (testPatterns,
+    // plugins, exclude), fall back to the legacy JSON config loader — these are
+    // only read when a legacy coverage.config.json is still present.  They are
+    // not required and default to empty when absent.
+    let legacyTestPatterns = [];
+    let legacyPlugins = [];
+    let legacyExclude = { paths: [], methods: [] };
+    if (!configPath) {
+        try {
+            const legacyCfg = (0, config_1.resolveConfig)(undefined);
+            legacyTestPatterns = (_a = legacyCfg.testPatterns) !== null && _a !== void 0 ? _a : [];
+            legacyPlugins = (_b = legacyCfg.plugins) !== null && _b !== void 0 ? _b : [];
+            if (legacyCfg.exclude)
+                legacyExclude = {
+                    paths: (_c = legacyCfg.exclude.paths) !== null && _c !== void 0 ? _c : [],
+                    methods: (_d = legacyCfg.exclude.methods) !== null && _d !== void 0 ? _d : [],
+                };
+        }
+        catch {
+            // No legacy JSON config present — safe to ignore.
+        }
+    }
+    return {
+        thresholds: mergedThresholds,
+        testPatterns: legacyTestPatterns,
+        plugins: legacyPlugins,
+        exclude: legacyExclude,
+        qualityGate: analyzerCfg.qualityGate,
+        mcp: analyzerCfg.mcp,
+        publishing: analyzerCfg.publishing
+            ? {
+                enabled: analyzerCfg.publishing.enabled,
+                githubPages: analyzerCfg.publishing.githubPages,
+            }
+            : undefined,
+    };
+}
+/**
+ * Initialise all observability subsystems from the parent program options.
+ * Safe to call multiple times; subsequent calls are no-ops if already set up.
+ */
+function setupObservability() {
+    const opts = program.opts();
+    const logLevel = opts.logLevel || 'info';
+    const metricsPort = opts.metricsPort;
+    const serviceName = opts.serviceName || 'api-coverage-analyzer';
+    const traceEnabled = Boolean(opts.trace);
+    const traceEndpoint = opts.traceEndpoint;
+    (0, observability_1.initLogger)(logLevel);
+    (0, observability_1.initMetrics)(serviceName);
+    (0, observability_1.initTracing)(traceEnabled, traceEndpoint);
+    return { metricsPort, serviceName };
+}
+/**
+ * After each command completes, record metrics, start the server (if requested),
+ * log results, and check thresholds.
+ */
+async function finaliseObservability(allResults, thresholds, metricsPort, serviceName) {
+    const logger = (0, observability_1.getLogger)();
+    // Record into Prometheus gauges
+    (0, observability_1.recordCoverageMetrics)(allResults, thresholds, serviceName);
+    // Structured log each result
+    for (const r of allResults) {
+        (0, observability_1.logCoverageResult)(logger, r, thresholds[r.type]);
+    }
+    // Log threshold breaches
+    for (const r of allResults) {
+        const t = thresholds[r.type];
+        if (t !== undefined && r.coveragePercent < t) {
+            (0, observability_1.logThresholdBreach)(logger, r.type, r.coveragePercent, t);
+        }
+    }
+    // Start metrics HTTP server if requested
+    if (metricsPort) {
+        await (0, observability_1.startMetricsServer)(metricsPort);
+        logger.info({ event: 'metrics_server_start', port: metricsPort }, `Prometheus metrics available at http://localhost:${metricsPort}/metrics`);
+        console.log(`Prometheus metrics available at http://localhost:${metricsPort}/metrics`);
+        // Keep the server alive until the process is signalled; handle graceful shutdown
+        process.once('SIGINT', () => {
+            void (0, observability_1.stopMetricsServer)().then(() => process.exit(0));
+        });
+        process.once('SIGTERM', () => {
+            void (0, observability_1.stopMetricsServer)().then(() => process.exit(0));
+        });
+    }
+}
+program
+    .command('endpoint-coverage')
+    .description('Analyze which API endpoints are covered by integration tests')
+    .option('--spec <path>', 'Path to the OpenAPI/Swagger spec file', 'sample/openapi.yaml')
+    .option('--tests <glob>', 'Glob pattern for test files', 'tests/**/*.ts')
+    .option('--language <lang>', `Test language(s) to analyse. Accepted values: ${languageDetection_1.SUPPORTED_LANGUAGES.join(', ')}. ` +
+    'Use a comma-separated list or repeat the flag for multiple languages. ' +
+    "Default: 'auto' (inferred from file extensions).", (val, prev) => {
+    const parsed = (0, languageDetection_1.parseLanguageOption)(val);
+    return prev ? [...prev, ...parsed] : parsed;
+}, [])
+    .option('--format <formats>', 'Comma-separated list of report formats: json,html,csv,junit (default: json,html)', 'json,html')
+    .option('--threshold-endpoint <percent>', 'Minimum required endpoint coverage percentage (0-100)', parseFloat, 0)
+    .action(async (options) => {
+    var _a, _b, _c;
+    const { metricsPort, serviceName } = setupObservability();
+    const logger = (0, observability_1.getLogger)();
+    const parentOpts = program.opts();
+    const config = loadCoverageConfig(parentOpts.config, {
+        endpoint: options.thresholdEndpoint,
+    });
+    const specPath = path.resolve(options.spec);
+    const languages = options.language.length > 0
+        ? options.language
+        : ['auto'];
+    // Determine the test glob: config overrides CLI, and language overrides the default
+    let testsGlob;
+    if (config.testPatterns && config.testPatterns.length > 0) {
+        testsGlob = config.testPatterns[0];
+    }
+    else if (options.tests !== 'tests/**/*.ts') {
+        // User explicitly passed --tests
+        testsGlob = options.tests;
+    }
+    else if (!languages.includes('auto') && languages.length === 1) {
+        // Use language-specific default glob when a single language is specified
+        const langGlobs = (0, languageDetection_1.getDefaultGlobsForLanguage)(languages[0]);
+        testsGlob = langGlobs[0];
+    }
+    else {
+        testsGlob = options.tests;
+    }
+    const reportsDir = path.resolve('reports');
+    const formats = (0, reporting_1.parseFormats)(options.format);
+    const span = (0, observability_1.startSpan)('endpoint-coverage', { specPath, testsGlob });
+    logger.info({ event: 'analysis_start', coverageType: 'endpoint', specPath, testsGlob, languages }, `Parsing spec: ${specPath}`);
+    console.log(`Parsing spec: ${specPath}`);
+    const endpoints = await (0, endpointCoverage_1.parseOpenApiSpec)(specPath);
+    console.log(`Analyzing tests matching: ${testsGlob} (language: ${languages.join(', ')})`);
+    const analyzerCfgForDeep = (0, config_1.loadCentralConfig)(parentOpts.config);
+    const deepCfg = (_a = analyzerCfgForDeep.scans.coverage) === null || _a === void 0 ? void 0 : _a.deepAnalysis;
+    const deepAnalysisConfig = {
+        ...index_1.DEFAULT_DEEP_ANALYSIS_CONFIG,
+        ...(deepCfg !== null && deepCfg !== void 0 ? deepCfg : {}),
+    };
+    const coverageMap = await (0, endpointCoverage_1.analyzeTestCoverage)(endpoints, testsGlob, languages, deepAnalysisConfig);
+    const report = (0, endpointCoverage_1.buildCoverageReport)(coverageMap);
+    // Write per-command legacy reports (JSON + HTML files named endpoint-coverage.*)
+    (0, endpointCoverage_1.generateReports)(report, reportsDir);
+    // Build standardised result and write multi-format summary reports
+    const result = {
+        type: 'endpoint',
+        totalItems: report.total,
+        coveredItems: report.covered,
+        coveragePercent: report.percentage,
+        details: report,
+    };
+    const thresholds = { ...((_b = config.thresholds) !== null && _b !== void 0 ? _b : {}) };
+    // Run plugins
+    const pluginContext = {
+        testPatterns: (_c = config.testPatterns) !== null && _c !== void 0 ? _c : [],
+        results: [result],
+        config,
+    };
+    const pluginResults = await (0, pluginLoader_1.runPlugins)(config, pluginContext);
+    const allResults = [result, ...pluginResults];
+    const observabilityInfo = (0, observability_1.buildObservabilityInfo)(metricsPort);
+    (0, reporting_1.generateMultiFormatReports)(allResults, formats, reportsDir, thresholds, observabilityInfo);
+    console.log(`Endpoint coverage: ${report.covered}/${report.total} endpoints covered (${report.percentage}%)`);
+    console.log(`Reports written to: ${reportsDir}`);
+    span.end({ totalItems: report.total, coveredItems: report.covered, coveragePercent: report.percentage });
+    logger.info({ event: 'analysis_complete', coverageType: 'endpoint' }, 'Endpoint coverage analysis complete');
+    await finaliseObservability(allResults, thresholds, metricsPort, serviceName);
+    // Threshold check
+    const failures = (0, reporting_1.checkThresholds)(allResults, thresholds);
+    if (failures.length > 0) {
+        for (const msg of failures) {
+            console.error(`THRESHOLD FAILURE: ${msg}`);
+        }
+        process.exitCode = 1;
+    }
+});
+program
+    .command('parameter-coverage')
+    .description('Analyze how thoroughly each API parameter is tested (valid, boundary, missing, invalid)')
+    .option('--spec <path>', 'Path to the OpenAPI/Swagger spec file', 'sample/openapi-parameters.yaml')
+    .option('--tests <glob>', 'Glob pattern for test files', 'sample/tests/**/*.ts')
+    .option('--format <formats>', 'Comma-separated list of report formats: json,html,csv,junit (default: json,html)', 'json,html')
+    .option('--threshold-parameter <percent>', 'Minimum required parameter coverage percentage (0-100)', parseFloat, 0)
+    .action(async (options) => {
+    var _a, _b, _c, _d;
+    const { metricsPort, serviceName } = setupObservability();
+    const logger = (0, observability_1.getLogger)();
+    const parentOpts = program.opts();
+    const config = loadCoverageConfig(parentOpts.config, {
+        parameter: options.thresholdParameter,
+    });
+    const specPath = path.resolve(options.spec);
+    const testsGlob = (config.testPatterns && config.testPatterns.length > 0)
+        ? config.testPatterns[0]
+        : options.tests;
+    const reportsDir = path.resolve('reports');
+    const formats = (0, reporting_1.parseFormats)(options.format);
+    const span = (0, observability_1.startSpan)('parameter-coverage', { specPath, testsGlob });
+    logger.info({ event: 'analysis_start', coverageType: 'parameter', specPath }, `Parsing spec: ${specPath}`);
+    console.log(`Parsing spec: ${specPath}`);
+    const parameters = await (0, parameterCoverage_1.parseParameters)(specPath);
+    console.log(`Analyzing tests matching: ${testsGlob}`);
+    const analyzerCfgForParam = (0, config_1.loadCentralConfig)(parentOpts.config);
+    const astParamOptions = {
+        astConfig: (_a = analyzerCfgForParam.analysis.ast) !== null && _a !== void 0 ? _a : {},
+        deepConfig: (_b = analyzerCfgForParam.scans.coverage) === null || _b === void 0 ? void 0 : _b.deepAnalysis,
+    };
+    const coverages = await (0, parameterCoverage_1.analyzeParameterCoverage)(parameters, testsGlob, astParamOptions);
+    const report = (0, parameterCoverage_1.buildParameterCoverageReport)(coverages);
+    (0, parameterCoverage_1.generateParameterReports)(report, reportsDir);
+    const result = {
+        type: 'parameter',
+        totalItems: report.totalParameters,
+        coveredItems: coverages.filter((c) => c.ratio > 0).length,
+        coveragePercent: report.averageCoverage,
+        details: report,
+    };
+    const thresholds = { ...((_c = config.thresholds) !== null && _c !== void 0 ? _c : {}) };
+    // Run plugins
+    const pluginContext = {
+        testPatterns: (_d = config.testPatterns) !== null && _d !== void 0 ? _d : [],
+        results: [result],
+        config,
+    };
+    const pluginResults = await (0, pluginLoader_1.runPlugins)(config, pluginContext);
+    const allResults = [result, ...pluginResults];
+    const observabilityInfo = (0, observability_1.buildObservabilityInfo)(metricsPort);
+    (0, reporting_1.generateMultiFormatReports)(allResults, formats, reportsDir, thresholds, observabilityInfo);
+    console.log(`Parameter coverage: ${report.totalParameters} parameters analysed, average coverage ${report.averageCoverage}%`);
+    console.log(`Reports written to: ${reportsDir}`);
+    span.end({ totalItems: report.totalParameters, coveragePercent: report.averageCoverage });
+    logger.info({ event: 'analysis_complete', coverageType: 'parameter' }, 'Parameter coverage analysis complete');
+    await finaliseObservability(allResults, thresholds, metricsPort, serviceName);
+    const failures = (0, reporting_1.checkThresholds)(allResults, thresholds);
+    if (failures.length > 0) {
+        for (const msg of failures) {
+            console.error(`THRESHOLD FAILURE: ${msg}`);
+        }
+        process.exitCode = 1;
+    }
+});
+program
+    .command('business-coverage')
+    .description('Analyze how well tests cover defined business rules and scenarios')
+    .option('--rules <file>', 'Path to the business rules definition file (YAML or JSON)', 'sample/business-rules.yaml')
+    .option('--tests <glob>', 'Glob pattern for test files', 'sample/tests/**/*.ts')
+    .option('--format <formats>', 'Comma-separated list of report formats: json,html,csv,junit (default: json,html)', 'json,html')
+    .option('--threshold-business <percent>', 'Minimum required business logic coverage percentage (0-100)', parseFloat, 0)
+    .action(async (options) => {
+    var _a, _b;
+    const { metricsPort, serviceName } = setupObservability();
+    const logger = (0, observability_1.getLogger)();
+    const parentOpts = program.opts();
+    const config = loadCoverageConfig(parentOpts.config, {
+        business: options.thresholdBusiness,
+    });
+    const rulesPath = path.resolve(options.rules);
+    const testsGlob = (config.testPatterns && config.testPatterns.length > 0)
+        ? config.testPatterns[0]
+        : options.tests;
+    const reportsDir = path.resolve('reports');
+    const formats = (0, reporting_1.parseFormats)(options.format);
+    const span = (0, observability_1.startSpan)('business-coverage', { rulesPath, testsGlob });
+    logger.info({ event: 'analysis_start', coverageType: 'business', rulesPath }, `Parsing business rules: ${rulesPath}`);
+    console.log(`Parsing business rules: ${rulesPath}`);
+    const rules = (0, businessCoverage_1.parseBusinessRules)(rulesPath);
+    console.log(`Analyzing tests matching: ${testsGlob}`);
+    const coverages = await (0, businessCoverage_1.analyzeBusinessCoverage)(rules, testsGlob);
+    const report = (0, businessCoverage_1.buildBusinessCoverageReport)(coverages);
+    (0, businessCoverage_1.generateBusinessReports)(report, reportsDir);
+    const result = {
+        type: 'business',
+        totalItems: report.total,
+        coveredItems: report.covered,
+        coveragePercent: report.percentage,
+        details: report,
+    };
+    const thresholds = { ...((_a = config.thresholds) !== null && _a !== void 0 ? _a : {}) };
+    // Run plugins
+    const pluginContext = {
+        testPatterns: (_b = config.testPatterns) !== null && _b !== void 0 ? _b : [],
+        results: [result],
+        config,
+    };
+    const pluginResults = await (0, pluginLoader_1.runPlugins)(config, pluginContext);
+    const allResults = [result, ...pluginResults];
+    const observabilityInfo = (0, observability_1.buildObservabilityInfo)(metricsPort);
+    (0, reporting_1.generateMultiFormatReports)(allResults, formats, reportsDir, thresholds, observabilityInfo);
+    console.log(`Business coverage: ${report.covered}/${report.total} rules covered (${report.percentage}%)`);
+    if (report.uncoveredRules.length > 0) {
+        console.log('Uncovered rules:');
+        for (const rule of report.uncoveredRules) {
+            console.log(`  - ${rule.id}: ${rule.description}`);
+        }
+    }
+    console.log(`Reports written to: ${reportsDir}`);
+    span.end({ totalItems: report.total, coveredItems: report.covered, coveragePercent: report.percentage });
+    logger.info({ event: 'analysis_complete', coverageType: 'business' }, 'Business coverage analysis complete');
+    await finaliseObservability(allResults, thresholds, metricsPort, serviceName);
+    const failures = (0, reporting_1.checkThresholds)(allResults, thresholds);
+    if (failures.length > 0) {
+        for (const msg of failures) {
+            console.error(`THRESHOLD FAILURE: ${msg}`);
+        }
+        process.exitCode = 1;
+    }
+});
+program
+    .command('integration-coverage')
+    .description('Analyze how well integration tests exercise defined end-to-end flows')
+    .option('--flows <file>', 'Path to the integration flows definition file (YAML or JSON)', 'sample/integration-flows.yaml')
+    .option('--tests <glob>', 'Glob pattern for test files', 'sample/tests/**/*.ts')
+    .option('--format <formats>', 'Comma-separated list of report formats: json,html,csv,junit (default: json,html)', 'json,html')
+    .option('--threshold-integration <percent>', 'Minimum required integration flow coverage percentage (0-100)', parseFloat, 0)
+    .action(async (options) => {
+    var _a, _b;
+    const { metricsPort, serviceName } = setupObservability();
+    const logger = (0, observability_1.getLogger)();
+    const parentOpts = program.opts();
+    const config = loadCoverageConfig(parentOpts.config, {
+        integration: options.thresholdIntegration,
+    });
+    const flowsPath = path.resolve(options.flows);
+    const testsGlob = (config.testPatterns && config.testPatterns.length > 0)
+        ? config.testPatterns[0]
+        : options.tests;
+    const reportsDir = path.resolve('reports');
+    const formats = (0, reporting_1.parseFormats)(options.format);
+    const span = (0, observability_1.startSpan)('integration-coverage', { flowsPath, testsGlob });
+    logger.info({ event: 'analysis_start', coverageType: 'integration', flowsPath }, `Parsing integration flows: ${flowsPath}`);
+    console.log(`Parsing integration flows: ${flowsPath}`);
+    const flows = (0, integrationCoverage_1.parseIntegrationFlows)(flowsPath);
+    console.log(`Analyzing tests matching: ${testsGlob}`);
+    const coverages = await (0, integrationCoverage_1.analyzeIntegrationCoverage)(flows, testsGlob);
+    const report = (0, integrationCoverage_1.buildIntegrationCoverageReport)(coverages);
+    (0, integrationCoverage_1.generateIntegrationReports)(report, reportsDir);
+    const result = {
+        type: 'integration',
+        totalItems: report.total,
+        coveredItems: report.complete,
+        coveragePercent: report.percentage,
+        details: report,
+    };
+    const thresholds = { ...((_a = config.thresholds) !== null && _a !== void 0 ? _a : {}) };
+    // Run plugins
+    const pluginContext = {
+        testPatterns: (_b = config.testPatterns) !== null && _b !== void 0 ? _b : [],
+        results: [result],
+        config,
+    };
+    const pluginResults = await (0, pluginLoader_1.runPlugins)(config, pluginContext);
+    const allResults = [result, ...pluginResults];
+    const observabilityInfo = (0, observability_1.buildObservabilityInfo)(metricsPort);
+    (0, reporting_1.generateMultiFormatReports)(allResults, formats, reportsDir, thresholds, observabilityInfo);
+    console.log(`Integration coverage: ${report.complete}/${report.total} flows complete, ${report.partial} partial, ${report.missing} missing (${report.percentage}%)`);
+    const partialFlows = coverages.filter((c) => c.status === 'partial');
+    if (partialFlows.length > 0) {
+        console.log('Partially covered flows:');
+        for (const fc of partialFlows) {
+            const uncoveredSteps = fc.steps.filter((s) => !s.covered).map((s) => s.step.id);
+            console.log(`  - ${fc.flow.id}: ${fc.flow.name} (missing steps: ${uncoveredSteps.join(', ')})`);
+        }
+    }
+    const missingFlows = coverages.filter((c) => c.status === 'missing');
+    if (missingFlows.length > 0) {
+        console.log('Missing flows:');
+        for (const fc of missingFlows) {
+            console.log(`  - ${fc.flow.id}: ${fc.flow.name}`);
+        }
+    }
+    console.log(`Reports written to: ${reportsDir}`);
+    span.end({ totalItems: report.total, coveredItems: report.complete, coveragePercent: report.percentage });
+    logger.info({ event: 'analysis_complete', coverageType: 'integration' }, 'Integration coverage analysis complete');
+    await finaliseObservability(allResults, thresholds, metricsPort, serviceName);
+    const failures = (0, reporting_1.checkThresholds)(allResults, thresholds);
+    if (failures.length > 0) {
+        for (const msg of failures) {
+            console.error(`THRESHOLD FAILURE: ${msg}`);
+        }
+        process.exitCode = 1;
+    }
+});
+program
+    .command('error-coverage')
+    .description('Analyze how thoroughly tests cover error handling and negative scenarios defined in the API spec')
+    .option('--spec <path>', 'Path to the OpenAPI/Swagger spec file', 'sample/openapi-errors.yaml')
+    .option('--tests <glob>', 'Glob pattern for test files', 'sample/tests/**/*.ts')
+    .option('--format <formats>', 'Comma-separated list of report formats: json,html,csv,junit (default: json,html)', 'json,html')
+    .option('--threshold-error <percent>', 'Minimum required error handling coverage percentage (0-100)', parseFloat, 0)
+    .action(async (options) => {
+    var _a, _b, _c, _d;
+    const { metricsPort, serviceName } = setupObservability();
+    const logger = (0, observability_1.getLogger)();
+    const parentOpts = program.opts();
+    const config = loadCoverageConfig(parentOpts.config, {
+        error: options.thresholdError,
+    });
+    const specPath = path.resolve(options.spec);
+    const testsGlob = (config.testPatterns && config.testPatterns.length > 0)
+        ? config.testPatterns[0]
+        : options.tests;
+    const reportsDir = path.resolve('reports');
+    const formats = (0, reporting_1.parseFormats)(options.format);
+    const span = (0, observability_1.startSpan)('error-coverage', { specPath, testsGlob });
+    logger.info({ event: 'analysis_start', coverageType: 'error', specPath }, `Parsing spec: ${specPath}`);
+    console.log(`Parsing spec: ${specPath}`);
+    const scenarios = await (0, errorCoverage_1.parseErrorScenarios)(specPath);
+    console.log(`Found ${scenarios.length} error scenarios`);
+    console.log(`Analyzing tests matching: ${testsGlob}`);
+    const analyzerCfgForError = (0, config_1.loadCentralConfig)(parentOpts.config);
+    const astErrorOptions = {
+        astConfig: (_a = analyzerCfgForError.analysis.ast) !== null && _a !== void 0 ? _a : {},
+        deepConfig: (_b = analyzerCfgForError.scans.coverage) === null || _b === void 0 ? void 0 : _b.deepAnalysis,
+    };
+    const coverages = await (0, errorCoverage_1.analyzeErrorCoverage)(scenarios, testsGlob, astErrorOptions);
+    const report = (0, errorCoverage_1.buildErrorCoverageReport)(coverages);
+    (0, errorCoverage_1.generateErrorReports)(report, reportsDir);
+    const result = {
+        type: 'error',
+        totalItems: report.total,
+        coveredItems: report.covered,
+        coveragePercent: report.percentage,
+        details: report,
+    };
+    const thresholds = { ...((_c = config.thresholds) !== null && _c !== void 0 ? _c : {}) };
+    // Run plugins
+    const pluginContext = {
+        testPatterns: (_d = config.testPatterns) !== null && _d !== void 0 ? _d : [],
+        results: [result],
+        config,
+    };
+    const pluginResults = await (0, pluginLoader_1.runPlugins)(config, pluginContext);
+    const allResults = [result, ...pluginResults];
+    const observabilityInfo = (0, observability_1.buildObservabilityInfo)(metricsPort);
+    (0, reporting_1.generateMultiFormatReports)(allResults, formats, reportsDir, thresholds, observabilityInfo);
+    console.log(`Error coverage: ${report.covered}/${report.total} error scenarios covered (${report.percentage}%)`);
+    // Print category summary
+    for (const [cat, summary] of Object.entries(report.categorySummary)) {
+        if (summary.total > 0) {
+            const pct = Math.round((summary.covered / summary.total) * 100);
+            console.log(`  ${cat}: ${summary.covered}/${summary.total} (${pct}%)`);
+        }
+    }
+    const uncovered = coverages.filter((c) => !c.covered);
+    if (uncovered.length > 0) {
+        console.log('Uncovered error scenarios:');
+        for (const c of uncovered) {
+            console.log(`  - ${c.scenario.id}: ${c.scenario.description}`);
+        }
+    }
+    console.log(`Reports written to: ${reportsDir}`);
+    span.end({ totalItems: report.total, coveredItems: report.covered, coveragePercent: report.percentage });
+    logger.info({ event: 'analysis_complete', coverageType: 'error' }, 'Error coverage analysis complete');
+    await finaliseObservability(allResults, thresholds, metricsPort, serviceName);
+    // Threshold check
+    const failures = (0, reporting_1.checkThresholds)(allResults, thresholds);
+    if (failures.length > 0) {
+        for (const msg of failures) {
+            console.error(`THRESHOLD FAILURE: ${msg}`);
+        }
+        process.exitCode = 1;
+    }
+});
+program
+    .command('security-coverage')
+    .description('Analyze how comprehensively tests cover security controls defined in the API spec')
+    .option('--spec <path>', 'Path to the OpenAPI/Swagger spec file', 'sample/openapi-security.yaml')
+    .option('--tests <glob>', 'Glob pattern for test files', 'sample/tests/**/*.ts')
+    .option('--scan-report <file>', 'Path to an external security scanner report (ZAP JSON/XML or generic JSON) for enrichment')
+    .option('--format <formats>', 'Comma-separated list of report formats: json,html,csv,junit (default: json,html)', 'json,html')
+    .option('--threshold-security <percent>', 'Minimum required security coverage percentage (0-100)', parseFloat, 0)
+    .action(async (options) => {
+    var _a, _b, _c, _d;
+    const { metricsPort, serviceName } = setupObservability();
+    const logger = (0, observability_1.getLogger)();
+    const parentOpts = program.opts();
+    const config = loadCoverageConfig(parentOpts.config, {
+        security: options.thresholdSecurity,
+    });
+    const specPath = path.resolve(options.spec);
+    const testsGlob = (config.testPatterns && config.testPatterns.length > 0)
+        ? config.testPatterns[0]
+        : options.tests;
+    const scanReportPath = options.scanReport ? path.resolve(options.scanReport) : undefined;
+    const reportsDir = path.resolve('reports');
+    const formats = (0, reporting_1.parseFormats)(options.format);
+    const span = (0, observability_1.startSpan)('security-coverage', { specPath, testsGlob });
+    logger.info({ event: 'analysis_start', coverageType: 'security', specPath }, `Parsing spec: ${specPath}`);
+    console.log(`Parsing spec: ${specPath}`);
+    const controls = await (0, securityCoverage_1.parseSecurityControls)(specPath);
+    console.log(`Found ${controls.length} security controls`);
+    console.log(`Analyzing tests matching: ${testsGlob}`);
+    const analyzerCfgForSec = (0, config_1.loadCentralConfig)(parentOpts.config);
+    const astSecOptions = {
+        astConfig: (_a = analyzerCfgForSec.analysis.ast) !== null && _a !== void 0 ? _a : {},
+        deepConfig: (_b = analyzerCfgForSec.scans.coverage) === null || _b === void 0 ? void 0 : _b.deepAnalysis,
+    };
+    const coverages = await (0, securityCoverage_1.analyzeSecurityCoverage)(controls, testsGlob, scanReportPath, astSecOptions);
+    const report = (0, securityCoverage_1.buildSecurityCoverageReport)(coverages, scanReportPath ? coverages.filter((c) => c.coveredByScanReport).length : 0);
+    (0, securityCoverage_1.generateSecurityReports)(report, reportsDir);
+    const result = {
+        type: 'security',
+        totalItems: report.total,
+        coveredItems: report.covered,
+        coveragePercent: report.percentage,
+        details: report,
+    };
+    const thresholds = { ...((_c = config.thresholds) !== null && _c !== void 0 ? _c : {}) };
+    // Run plugins
+    const pluginContext = {
+        testPatterns: (_d = config.testPatterns) !== null && _d !== void 0 ? _d : [],
+        results: [result],
+        config,
+    };
+    const pluginResults = await (0, pluginLoader_1.runPlugins)(config, pluginContext);
+    const allResults = [result, ...pluginResults];
+    const observabilityInfo = (0, observability_1.buildObservabilityInfo)(metricsPort);
+    (0, reporting_1.generateMultiFormatReports)(allResults, formats, reportsDir, thresholds, observabilityInfo);
+    console.log(`Security coverage: ${report.covered}/${report.total} controls covered (${report.percentage}%)`);
+    // Print per-category summary
+    for (const [cat, summary] of Object.entries(report.categorySummary)) {
+        if (summary.total > 0) {
+            const pct = Math.round((summary.covered / summary.total) * 100);
+            console.log(`  ${cat}: ${summary.covered}/${summary.total} (${pct}%)`);
+        }
+    }
+    if (report.scanFindings > 0) {
+        console.log(`  External scan findings credited: ${report.scanFindings}`);
+    }
+    const uncovered = coverages.filter((c) => !c.covered);
+    if (uncovered.length > 0) {
+        console.log('Uncovered security controls:');
+        for (const c of uncovered) {
+            console.log(`  - ${c.control.id}: ${c.control.description}`);
+        }
+    }
+    console.log(`Reports written to: ${reportsDir}`);
+    span.end({ totalItems: report.total, coveredItems: report.covered, coveragePercent: report.percentage });
+    logger.info({ event: 'analysis_complete', coverageType: 'security' }, 'Security coverage analysis complete');
+    await finaliseObservability(allResults, thresholds, metricsPort, serviceName);
+    const failures = (0, reporting_1.checkThresholds)(allResults, thresholds);
+    if (failures.length > 0) {
+        for (const msg of failures) {
+            console.error(`THRESHOLD FAILURE: ${msg}`);
+        }
+        process.exitCode = 1;
+    }
+});
+program
+    .command('perf-resilience-coverage')
+    .description('Analyze how well tests cover performance under load and resilience to failure conditions')
+    .option('--spec <path>', 'Path to the OpenAPI/Swagger spec file (used to enumerate endpoints)', 'sample/openapi.yaml')
+    .option('--tests <glob>', 'Glob pattern for test files', 'sample/tests/**/*.ts')
+    .option('--load-results <paths>', 'Comma-separated paths to load-test result files (JMeter .jtl/.csv or k6 .json)')
+    .option('--threshold-response-ms <ms>', 'Maximum acceptable median response time in milliseconds', parseFloat, 500)
+    .option('--threshold-error-rate <rate>', 'Maximum acceptable error rate as a decimal fraction (0–1, e.g. 0.05 = 5%)', parseFloat, 0.05)
+    .option('--format <formats>', 'Comma-separated list of report formats: json,html,csv,junit (default: json,html)', 'json,html')
+    .option('--threshold-performance <percent>', 'Minimum required performance coverage percentage (0-100)', parseFloat, 0)
+    .option('--threshold-resilience <percent>', 'Minimum required resilience coverage percentage (0-100)', parseFloat, 0)
+    .action(async (options) => {
+    var _a, _b, _c, _d, _e;
+    const { metricsPort, serviceName } = setupObservability();
+    const logger = (0, observability_1.getLogger)();
+    const parentOpts = program.opts();
+    const config = loadCoverageConfig(parentOpts.config, {
+        performance: options.thresholdPerformance,
+        resilience: options.thresholdResilience,
+    });
+    const specPath = path.resolve(options.spec);
+    const testsGlob = (config.testPatterns && config.testPatterns.length > 0)
+        ? config.testPatterns[0]
+        : options.tests;
+    const reportsDir = path.resolve('reports');
+    const formats = (0, reporting_1.parseFormats)(options.format);
+    const thresholdResponseMs = options.thresholdResponseMs;
+    const thresholdErrorRate = options.thresholdErrorRate;
+    const perfThresholds = {
+        responseMs: thresholdResponseMs,
+        errorRate: thresholdErrorRate,
+    };
+    const span = (0, observability_1.startSpan)('perf-resilience-coverage', { specPath, testsGlob });
+    logger.info({ event: 'analysis_start', coverageType: 'perf-resilience', specPath }, `Parsing spec: ${specPath}`);
+    console.log(`Parsing spec: ${specPath}`);
+    const endpoints = await (0, perfResilienceCoverage_1.parseEndpointsFromSpec)(specPath);
+    console.log(`Found ${endpoints.length} endpoints`);
+    // Load-test results
+    const loadResultPaths = options.loadResults
+        ? options.loadResults.split(',').map((p) => path.resolve(p.trim()))
+        : [];
+    const metricsMap = loadResultPaths.length > 0
+        ? (0, perfResilienceCoverage_1.parseLoadTestResults)(loadResultPaths)
+        : new Map();
+    if (loadResultPaths.length > 0) {
+        console.log(`Loaded ${metricsMap.size} metric entries from ${loadResultPaths.length} file(s)`);
+    }
+    // Performance coverage
+    const performanceCoverages = (0, perfResilienceCoverage_1.analyzePerformanceCoverage)(endpoints, metricsMap, perfThresholds);
+    // Resilience scenarios and coverage
+    const scenarios = (0, perfResilienceCoverage_1.buildResilienceScenarios)(endpoints);
+    console.log(`Analyzing resilience tests matching: ${testsGlob}`);
+    const resilienceCoverages = await (0, perfResilienceCoverage_1.analyzeResilienceCoverage)(scenarios, testsGlob);
+    // Build report
+    const report = (0, perfResilienceCoverage_1.buildPerfResilienceReport)(performanceCoverages, resilienceCoverages);
+    // Write dedicated JSON + HTML reports
+    (0, perfResilienceCoverage_1.generatePerfResilienceReports)(report, reportsDir);
+    // Build standardised results for multi-format output
+    const perfResult = {
+        type: 'performance',
+        totalItems: report.totalEndpoints,
+        coveredItems: report.endpointsWithLoadData,
+        coveragePercent: report.performanceCoveragePercent,
+        details: report,
+    };
+    const resilienceResult = {
+        type: 'resilience',
+        totalItems: report.totalResilienceScenarios,
+        coveredItems: report.coveredResilienceScenarios,
+        coveragePercent: report.resilienceCoveragePercent,
+        details: report,
+    };
+    const thresholds = { ...((_a = config.thresholds) !== null && _a !== void 0 ? _a : {}) };
+    // Run plugins
+    const pluginContext = {
+        testPatterns: (_b = config.testPatterns) !== null && _b !== void 0 ? _b : [],
+        results: [perfResult, resilienceResult],
+        config,
+    };
+    const pluginResults = await (0, pluginLoader_1.runPlugins)(config, pluginContext);
+    const allResults = [perfResult, resilienceResult, ...pluginResults];
+    const observabilityInfo = (0, observability_1.buildObservabilityInfo)(metricsPort);
+    (0, reporting_1.generateMultiFormatReports)(allResults, formats, reportsDir, thresholds, observabilityInfo);
+    console.log(`Performance coverage: ${report.endpointsWithLoadData}/${report.totalEndpoints} endpoints with load-test data (${report.performanceCoveragePercent}%)`);
+    console.log(`Resilience coverage: ${report.coveredResilienceScenarios}/${report.totalResilienceScenarios} scenarios covered (${report.resilienceCoveragePercent}%)`);
+    // Per-category resilience summary
+    for (const [cat, summary] of Object.entries(report.resilienceCategorySummary)) {
+        if (summary.total > 0) {
+            const pct = Math.round((summary.covered / summary.total) * 100);
+            console.log(`  ${cat}: ${summary.covered}/${summary.total} (${pct}%)`);
+        }
+    }
+    // Endpoints missing load-test data
+    const missingPerf = report.performanceCoverages.filter((c) => !c.hasLoadTestData);
+    if (missingPerf.length > 0) {
+        console.log('Endpoints missing load-test data:');
+        for (const c of missingPerf) {
+            console.log(`  - ${c.endpoint.id}`);
+        }
+    }
+    // Endpoints needing improvement
+    const needsImprovement = report.performanceCoverages.filter((c) => c.status === 'needs-improvement');
+    if (needsImprovement.length > 0) {
+        console.log('Endpoints not meeting performance thresholds:');
+        for (const c of needsImprovement) {
+            console.log(`  - ${c.endpoint.id}: median=${(_c = c.metrics) === null || _c === void 0 ? void 0 : _c.median}ms (threshold: ${thresholdResponseMs}ms), errorRate=${(((_e = (_d = c.metrics) === null || _d === void 0 ? void 0 : _d.errorRate) !== null && _e !== void 0 ? _e : 0) * 100).toFixed(2)}% (threshold: ${(thresholdErrorRate * 100).toFixed(2)}%)`);
+        }
+    }
+    console.log(`Reports written to: ${reportsDir}`);
+    span.end({ coveragePercent: report.performanceCoveragePercent });
+    logger.info({ event: 'analysis_complete', coverageType: 'perf-resilience' }, 'Perf/resilience coverage analysis complete');
+    await finaliseObservability(allResults, thresholds, metricsPort, serviceName);
+    // Threshold check
+    const failures = (0, reporting_1.checkThresholds)(allResults, thresholds);
+    if (failures.length > 0) {
+        for (const msg of failures) {
+            console.error(`THRESHOLD FAILURE: ${msg}`);
+        }
+        process.exitCode = 1;
+    }
+});
+program
+    .command('compatibility-check')
+    .description('Compare two API spec versions for breaking/non-breaking changes and verify consumer-driven contracts against the new spec')
+    .option('--old-spec <path>', 'Path to the previous (published) OpenAPI/Swagger spec')
+    .option('--new-spec <path>', 'Path to the current spec to be published')
+    .option('--contracts <glob>', 'Glob pattern or directory for consumer contract files (e.g. Pact JSON files)')
+    .option('--threshold-compat <percent>', 'Minimum required compatibility percentage (0-100). Exits non-zero if not met.', parseFloat, 0)
+    .action(async (options) => {
+    const { metricsPort, serviceName } = setupObservability();
+    const logger = (0, observability_1.getLogger)();
+    const oldSpecPath = options.oldSpec ? path.resolve(options.oldSpec) : undefined;
+    const newSpecPath = options.newSpec ? path.resolve(options.newSpec) : undefined;
+    const contractsGlob = options.contracts;
+    const thresholdCompat = options.thresholdCompat;
+    const reportsDir = path.resolve('reports');
+    if (!oldSpecPath || !newSpecPath) {
+        console.error('ERROR: --old-spec and --new-spec are required.');
+        process.exitCode = 1;
+        return;
+    }
+    const span = (0, observability_1.startSpan)('compatibility-check', { oldSpecPath, newSpecPath });
+    logger.info({ event: 'analysis_start', coverageType: 'compatibility', oldSpecPath, newSpecPath }, `Loading old spec: ${oldSpecPath}`);
+    console.log(`Loading old spec: ${oldSpecPath}`);
+    const oldApi = await (0, compatibilityCoverage_1.loadSpec)(oldSpecPath);
+    console.log(`Loading new spec: ${newSpecPath}`);
+    const newApi = await (0, compatibilityCoverage_1.loadSpec)(newSpecPath);
+    // Compare specs
+    const changes = (0, compatibilityCoverage_1.compareSpecs)(oldApi, newApi);
+    const breakingChanges = changes.filter((c) => c.breaking);
+    const nonBreakingChanges = changes.filter((c) => !c.breaking);
+    // Load and verify contracts
+    const contracts = contractsGlob ? await (0, compatibilityCoverage_1.parseContractFiles)(contractsGlob) : [];
+    if (contracts.length > 0) {
+        console.log(`Loaded ${contracts.length} consumer contract(s)`);
+    }
+    const verificationResults = (0, compatibilityCoverage_1.verifyContracts)(contracts, newApi);
+    // Build and write reports
+    const report = (0, compatibilityCoverage_1.buildCompatibilityReport)(oldApi, newApi, changes, verificationResults, oldSpecPath, newSpecPath);
+    (0, compatibilityCoverage_1.generateCompatibilityReports)(report, reportsDir);
+    // Also write multi-format summary reports via the shared reporting module
+    const formats = (0, reporting_1.parseFormats)('json,html');
+    const uniqueAffectedEndpoints = new Set(breakingChanges.filter((c) => c.changeType !== 'added').map((c) => `${c.method}:${c.path}`)).size;
+    const endpointsUnaffectedByBreakingChanges = report.totalOldEndpoints - uniqueAffectedEndpoints;
+    const compatResult = {
+        type: 'compatibility',
+        totalItems: report.totalOldEndpoints,
+        coveredItems: endpointsUnaffectedByBreakingChanges,
+        coveragePercent: report.compatibilityPercent,
+        details: report,
+    };
+    const contractResult = {
+        type: 'contract-coverage',
+        totalItems: report.totalNewEndpoints,
+        coveredItems: report.contractCoveredEndpoints,
+        coveragePercent: report.contractCoveragePercent,
+        details: report,
+    };
+    const thresholds = {};
+    if (thresholdCompat > 0) {
+        thresholds['compatibility'] = thresholdCompat;
+        thresholds['contract-coverage'] = thresholdCompat;
+    }
+    const observabilityInfo = (0, observability_1.buildObservabilityInfo)(metricsPort);
+    (0, reporting_1.generateMultiFormatReports)([compatResult, contractResult], formats, reportsDir, thresholds, observabilityInfo);
+    // Console summary
+    console.log(`\nCompatibility: ${report.compatibilityPercent}% (${breakingChanges.length} breaking change${breakingChanges.length !== 1 ? 's' : ''}, ${nonBreakingChanges.length} non-breaking)`);
+    if (breakingChanges.length > 0) {
+        console.log('Breaking changes:');
+        for (const c of breakingChanges) {
+            console.log(`  ❌ ${c.description}`);
+        }
+    }
+    if (nonBreakingChanges.length > 0) {
+        console.log('Non-breaking changes:');
+        for (const c of nonBreakingChanges) {
+            console.log(`  ✅ ${c.description}`);
+        }
+    }
+    if (verificationResults.length > 0) {
+        const passedContracts = verificationResults.filter((r) => r.passed).length;
+        console.log(`\nContract verification: ${passedContracts}/${verificationResults.length} contracts passed`);
+        console.log(`Contract coverage: ${report.contractCoveredEndpoints}/${report.totalNewEndpoints} endpoints covered (${report.contractCoveragePercent}%)`);
+        for (const result of verificationResults) {
+            const failedInteractions = result.interactionResults.filter((ir) => !ir.passed);
+            if (failedInteractions.length > 0) {
+                console.log(`  Contract [${result.contract.consumer} → ${result.contract.provider}] failed:`);
+                for (const ir of failedInteractions) {
+                    console.log(`    ❌ ${ir.interaction.description}: ${ir.reason}`);
+                }
+            }
+        }
+    }
+    console.log(`\nReports written to: ${reportsDir}`);
+    span.end({ coveragePercent: report.compatibilityPercent });
+    logger.info({ event: 'analysis_complete', coverageType: 'compatibility' }, 'Compatibility check complete');
+    await finaliseObservability([compatResult, contractResult], thresholds, metricsPort, serviceName);
+    // Threshold enforcement
+    const failures = (0, reporting_1.checkThresholds)([compatResult, contractResult], thresholds);
+    if (failures.length > 0) {
+        for (const msg of failures) {
+            console.error(`THRESHOLD FAILURE: ${msg}`);
+        }
+        process.exitCode = 1;
+    }
+});
+program
+    .command('security-scan')
+    .description('Run integrated security scanners (Semgrep, Trivy, ZAP) and evaluate a security gate')
+    .option('--workspace <path>', 'Root directory to scan (default: current working directory)', '.')
+    .option('--semgrep', 'Enable Semgrep SAST scanning (requires semgrep binary or --semgrep-report)')
+    .option('--semgrep-config <config>', 'Semgrep config/ruleset (e.g. p/default, p/security-audit)', 'p/default')
+    .option('--semgrep-report <file>', 'Import pre-generated Semgrep JSON report instead of running binary')
+    .option('--trivy', 'Enable Trivy vulnerability/secret/misconfig scanning (requires trivy binary or --trivy-report)')
+    .option('--trivy-scanners <list>', 'Comma-separated Trivy scanners: vuln,secret,misconfig', 'vuln,secret')
+    .option('--trivy-report <file>', 'Import pre-generated Trivy JSON report instead of running binary')
+    .option('--zap-report <file>', 'Import pre-generated ZAP JSON report (enables ZAP findings)')
+    .option('--fail-on-critical', 'Fail the gate if any CRITICAL finding exists')
+    .option('--fail-on-high', 'Fail the gate if any HIGH finding exists')
+    .option('--max-medium <n>', 'Maximum allowed MEDIUM findings', parseInt)
+    .option('--max-secrets <n>', 'Maximum allowed secrets (any severity)', parseInt)
+    .option('--max-misconfig-high <n>', 'Maximum allowed HIGH/CRITICAL misconfigurations', parseInt)
+    .option('--max-critical-vulns <n>', 'Maximum allowed CRITICAL vulnerabilities', parseInt)
+    .option('--max-high-vulns <n>', 'Maximum allowed HIGH vulnerabilities', parseInt)
+    .action(async (options) => {
+    var _a, _b;
+    const { metricsPort, serviceName } = setupObservability();
+    const logger = (0, observability_1.getLogger)();
+    const workspace = path.resolve((_a = options.workspace) !== null && _a !== void 0 ? _a : '.');
+    const reportsDir = path.resolve('reports');
+    // Build scanner configuration from CLI flags
+    const scanConfig = {
+        enabled: true,
+        workspace,
+        scanners: {},
+        gate: {},
+    };
+    // Semgrep
+    if (options.semgrep || options.semgrepReport) {
+        const mode = options.semgrepReport ? 'import' : 'embedded';
+        scanConfig.scanners.semgrep = {
+            enabled: true,
+            mode,
+            config: options.semgrepConfig,
+            reportPath: options.semgrepReport,
+        };
+    }
+    // Trivy
+    if (options.trivy || options.trivyReport) {
+        const mode = options.trivyReport ? 'import' : 'embedded';
+        const trivyScanners = ((_b = options.trivyScanners) !== null && _b !== void 0 ? _b : 'vuln,secret')
+            .split(',')
+            .map((s) => s.trim())
+            .filter((s) => ['vuln', 'misconfig', 'secret'].includes(s));
+        scanConfig.scanners.trivy = {
+            enabled: true,
+            mode,
+            scanners: trivyScanners,
+            reportPath: options.trivyReport,
+        };
+    }
+    // ZAP
+    if (options.zapReport) {
+        scanConfig.scanners.zap = {
+            enabled: true,
+            mode: 'import',
+            reportPath: options.zapReport,
+        };
+    }
+    // Gate configuration
+    if (options.failOnCritical)
+        scanConfig.gate.failOnCritical = true;
+    if (options.failOnHigh)
+        scanConfig.gate.failOnHigh = true;
+    if (options.maxMedium !== undefined)
+        scanConfig.gate.maxMedium = options.maxMedium;
+    if (options.maxSecrets !== undefined)
+        scanConfig.gate.maxSecrets = options.maxSecrets;
+    if (options.maxMisconfigHigh !== undefined)
+        scanConfig.gate.maxMisconfigHigh = options.maxMisconfigHigh;
+    if (options.maxCriticalVulns !== undefined)
+        scanConfig.gate.maxCriticalVulns = options.maxCriticalVulns;
+    if (options.maxHighVulns !== undefined)
+        scanConfig.gate.maxHighVulns = options.maxHighVulns;
+    // Remove empty gate/scanners objects if nothing was configured
+    if (Object.keys(scanConfig.gate).length === 0)
+        delete scanConfig.gate;
+    if (Object.keys(scanConfig.scanners).length === 0)
+        delete scanConfig.scanners;
+    const span = (0, observability_1.startSpan)('security-scan', { workspace });
+    logger.info({ event: 'analysis_start', coverageType: 'security-scan', workspace }, 'Starting security scan');
+    console.log(`Running security scan in workspace: ${workspace}`);
+    const summary = await (0, index_2.runSecurityScan)(scanConfig, reportsDir);
+    // Console summary
+    console.log(`\nSecurity Scan Results:`);
+    console.log(`  Scanners run: ${summary.scannersRun.join(', ') || 'none'}`);
+    console.log(`  Total findings: ${summary.totalFindings}`);
+    console.log(`  CRITICAL: ${summary.bySeverity.CRITICAL}`);
+    console.log(`  HIGH: ${summary.bySeverity.HIGH}`);
+    console.log(`  MEDIUM: ${summary.bySeverity.MEDIUM}`);
+    console.log(`  LOW: ${summary.bySeverity.LOW}`);
+    if (summary.gateResult) {
+        const gateStatus = summary.gateResult.passed ? '✅ PASSED' : '❌ FAILED';
+        console.log(`\nSecurity Gate: ${gateStatus}`);
+        if (!summary.gateResult.passed) {
+            for (const reason of summary.gateResult.reasons) {
+                console.error(`  GATE FAILURE: ${reason}`);
+            }
+        }
+    }
+    console.log(`\nReports written to: ${reportsDir}`);
+    span.end({ totalFindings: summary.totalFindings });
+    logger.info({ event: 'analysis_complete', coverageType: 'security-scan' }, 'Security scan complete');
+    const result = {
+        type: 'security-scan',
+        totalItems: summary.totalFindings,
+        coveredItems: summary.totalFindings,
+        coveragePercent: 100,
+        details: summary,
+    };
+    // Record security-specific Prometheus metrics (by severity/category/scanner + gate status)
+    (0, observability_1.recordSecurityScanMetrics)(summary, serviceName);
+    await finaliseObservability([result], {}, metricsPort, serviceName);
+    if (summary.gateResult && !summary.gateResult.passed) {
+        process.exitCode = 1;
+    }
+});
+// ─── coverage-intelligence command ──────────────────────────────────────────
+// ─── Intelligence details normalizer ─────────────────────────────────────────
+// The linkage engine expects `details` to be a flat array of
+// { endpoint?, covered, name?, ... } objects.  Each coverage command stores
+// its raw report object in CoverageResult.details, so we normalise here at
+// read time to avoid touching the 11 coverage command implementations.
+function normalizeDetailsForIntelligence(type, raw) {
+    if (Array.isArray(raw))
+        return raw; // already normalised (e.g. dashboard sample)
+    if (!raw || typeof raw !== 'object')
+        return [];
+    const obj = raw;
+    switch (type) {
+        case 'endpoint': {
+            const eps = obj.endpoints;
+            if (!Array.isArray(eps))
+                return [];
+            return eps.map((e) => {
+                var _a;
+                return ({
+                    endpoint: { method: e.method, path: e.path },
+                    covered: (_a = e.covered) !== null && _a !== void 0 ? _a : false,
+                });
+            });
+        }
+        case 'parameter': {
+            const params = obj.parameters;
+            if (!Array.isArray(params))
+                return [];
+            return params.map((p) => {
+                var _a, _b;
+                const param = p.parameter;
+                return {
+                    endpoint: param ? { method: param.method, path: param.path } : undefined,
+                    covered: ((_a = p.ratio) !== null && _a !== void 0 ? _a : 0) > 0,
+                    name: (_b = param === null || param === void 0 ? void 0 : param.name) !== null && _b !== void 0 ? _b : param === null || param === void 0 ? void 0 : param.id,
+                };
+            });
+        }
+        case 'business': {
+            const rules = obj.rules;
+            if (!Array.isArray(rules))
+                return [];
+            return rules.flatMap((r) => {
+                var _a, _b, _c;
+                const endpoints = (_a = r.rule) === null || _a === void 0 ? void 0 : _a.endpoints;
+                if (!Array.isArray(endpoints) || endpoints.length === 0) {
+                    return [{ covered: (_b = r.covered) !== null && _b !== void 0 ? _b : false, name: (_c = r.rule) === null || _c === void 0 ? void 0 : _c.id }];
+                }
+                return endpoints.map((ep) => {
+                    var _a, _b;
+                    const parts = ep.split(' ');
+                    return {
+                        endpoint: parts.length > 1 ? { method: parts[0], path: parts[1] } : { path: parts[0] },
+                        covered: (_a = r.covered) !== null && _a !== void 0 ? _a : false,
+                        name: (_b = r.rule) === null || _b === void 0 ? void 0 : _b.id,
+                    };
+                });
+            });
+        }
+        case 'integration': {
+            const flows = obj.flows;
+            if (!Array.isArray(flows))
+                return [];
+            return flows.flatMap((f) => {
+                var _a, _b;
+                const steps = ((_b = (_a = f.flow) === null || _a === void 0 ? void 0 : _a.steps) !== null && _b !== void 0 ? _b : []);
+                return steps
+                    .filter((s) => s.method && s.path)
+                    .map((s) => {
+                    var _a;
+                    return ({
+                        endpoint: { method: s.method, path: s.path },
+                        covered: f.status !== 'missing',
+                        name: ((_a = s.id) !== null && _a !== void 0 ? _a : s.name),
+                    });
+                });
+            });
+        }
+        case 'error': {
+            const scenarios = obj.scenarios;
+            if (!Array.isArray(scenarios))
+                return [];
+            return scenarios.map((s) => {
+                var _a;
+                const sc = s.scenario;
+                return {
+                    endpoint: sc ? { method: sc.method, path: sc.path } : undefined,
+                    covered: (_a = s.covered) !== null && _a !== void 0 ? _a : false,
+                    errorCodes: (sc === null || sc === void 0 ? void 0 : sc.errorCode) ? [String(sc.errorCode)] : [],
+                    name: sc === null || sc === void 0 ? void 0 : sc.id,
+                };
+            });
+        }
+        case 'security': {
+            const controls = obj.controls;
+            if (!Array.isArray(controls))
+                return [];
+            return controls
+                .map((c) => {
+                var _a, _b, _c, _d;
+                const epStr = (_b = (_a = c.control) === null || _a === void 0 ? void 0 : _a.endpoint) !== null && _b !== void 0 ? _b : '';
+                const parts = epStr.split(' ');
+                return {
+                    endpoint: parts.length > 1 ? { method: parts[0], path: parts[1] } : undefined,
+                    covered: (_c = c.covered) !== null && _c !== void 0 ? _c : false,
+                    name: (_d = c.control) === null || _d === void 0 ? void 0 : _d.id,
+                };
+            })
+                .filter((item) => { var _a; return (_a = item.endpoint) === null || _a === void 0 ? void 0 : _a.path; });
+        }
+        case 'performance': {
+            const coverages = obj.performanceCoverages;
+            if (!Array.isArray(coverages))
+                return [];
+            return coverages.map((c) => {
+                var _a;
+                const ep = c.endpoint;
+                return {
+                    endpoint: ep ? { method: ep.method, path: ep.path } : undefined,
+                    covered: (_a = c.hasLoadTestData) !== null && _a !== void 0 ? _a : false,
+                    hasThreshold: true,
+                    name: ep === null || ep === void 0 ? void 0 : ep.id,
+                };
+            });
+        }
+        case 'resilience': {
+            const coverages = obj.resilienceCoverages;
+            if (!Array.isArray(coverages))
+                return [];
+            return coverages
+                .filter((c) => { var _a; return (_a = c.scenario) === null || _a === void 0 ? void 0 : _a.endpoint; })
+                .map((c) => {
+                var _a;
+                const sc = c.scenario;
+                return {
+                    endpoint: sc.endpoint,
+                    covered: (_a = c.covered) !== null && _a !== void 0 ? _a : false,
+                    resilience: true,
+                    name: sc.id,
+                };
+            });
+        }
+        default:
+            return [];
+    }
+}
+program
+    .command('coverage-intelligence')
+    .description('Run the coverage intelligence engine to identify functional findings and missing tests')
+    .option('--reports-dir <dir>', 'Directory containing existing coverage reports to analyse', 'reports')
+    .option('--out-dir <dir>', 'Output directory for intelligence reports', 'reports')
+    .option('--project-name <name>', 'Project / service name', 'unknown')
+    .option('--languages <langs>', 'Comma-separated list of languages (e.g. typescript,java)')
+    .option('--frameworks <fws>', 'Comma-separated list of test frameworks (e.g. jest,rest-assured)')
+    .action(async (options) => {
+    const { metricsPort, serviceName } = setupObservability();
+    const logger = (0, observability_1.getLogger)();
+    const reportsDir = path.resolve(options.reportsDir);
+    const outDir = path.resolve(options.outDir);
+    const projectName = options.projectName;
+    const languages = options.languages
+        ? options.languages.split(',').map((l) => l.trim())
+        : [];
+    const frameworks = options.frameworks
+        ? options.frameworks.split(',').map((f) => f.trim())
+        : [];
+    // Attempt to load existing coverage-summary.json from reportsDir
+    let coverageResults = [];
+    const summaryPath = path.join(reportsDir, 'coverage-summary.json');
+    try {
+        if (require('fs').existsSync(summaryPath)) {
+            const raw = require('fs').readFileSync(summaryPath, 'utf-8');
+            const parsed = JSON.parse(raw);
+            if (Array.isArray(parsed.summary)) {
+                coverageResults = parsed.summary.map((s) => {
+                    var _a, _b, _c, _d, _e;
+                    return ({
+                        type: s.type,
+                        totalItems: (_a = s.totalItems) !== null && _a !== void 0 ? _a : 0,
+                        coveredItems: (_b = s.coveredItems) !== null && _b !== void 0 ? _b : 0,
+                        coveragePercent: (_c = s.coveragePercent) !== null && _c !== void 0 ? _c : 0,
+                        details: normalizeDetailsForIntelligence(s.type, (_e = (_d = parsed.details) === null || _d === void 0 ? void 0 : _d[s.type]) !== null && _e !== void 0 ? _e : []),
+                    });
+                });
+            }
+        }
+    }
+    catch (err) {
+        logger.warn({ event: 'intelligence_load_warning', error: String(err) }, 'Could not load coverage-summary.json');
+    }
+    const report = (0, index_3.runIntelligenceEngine)({
+        coverageResults,
+        languages,
+        frameworks,
+        projectName,
+        outDir,
+    });
+    // Record intelligence metrics
+    (0, observability_2.recordIntelligenceMetrics)({
+        projectName,
+        totalFindings: report.summary.totalFindings,
+        totalRecommendations: report.summary.totalRecommendations,
+        recommendationsByPriority: report.summary.recommendationsByPriority,
+        maxRiskScore: report.summary.maxRiskScore,
+        avgRiskScore: report.summary.avgRiskScore,
+        criticalUncoveredItems: report.summary.criticalUncoveredItems,
+        unprotectedSecurityFindings: report.summary.unprotectedSecurityFindings,
+        languages,
+        frameworks,
+    }, projectName);
+    console.log(`\n=== Coverage Intelligence Results ===`);
+    console.log(`  Project: ${projectName}`);
+    console.log(`  Functional Findings: ${report.summary.totalFindings}`);
+    console.log(`  Missing Test Recommendations: ${report.summary.totalRecommendations}`);
+    console.log(`  Max Risk Score: ${report.summary.maxRiskScore}`);
+    console.log(`  Avg Risk Score: ${report.summary.avgRiskScore}`);
+    console.log(`  Critical Uncovered Items: ${report.summary.criticalUncoveredItems}`);
+    console.log(`  Unprotected Security Findings: ${report.summary.unprotectedSecurityFindings}`);
+    if (report.summary.recommendationsByPriority.P0 > 0) {
+        console.log(`\n⚠️  P0 Recommendations: ${report.summary.recommendationsByPriority.P0} — immediate action required`);
+    }
+    console.log(`\nIntelligence reports written to: ${outDir}`);
+    logger.info({ event: 'analysis_complete', coverageType: 'intelligence' }, 'Coverage intelligence analysis complete');
+    await finaliseObservability([{
+            type: 'intelligence',
+            totalItems: report.summary.totalRecommendations,
+            coveredItems: 0,
+            coveragePercent: 0,
+            details: report.summary,
+        }], {}, metricsPort, serviceName);
+});
+// ─── coverage-summary-report command ─────────────────────────────────────────
+program
+    .command('coverage-summary-report')
+    .description('Generate build-summary.md and pr-summary.md from accumulated coverage-summary.json')
+    .option('--reports-dir <dir>', 'Directory containing coverage-summary.json', 'reports')
+    .option('--out-dir <dir>', 'Output directory for summary files', 'reports')
+    .option('--project-name <name>', 'Project / service name', 'unknown')
+    .option('--branch <branch>', 'Branch name for display in summary')
+    .option('--commit-sha <sha>', 'Commit SHA for display in summary')
+    .option('--build-id <id>', 'Build identifier for display in summary')
+    .option('--write-step-summary', 'Append build-summary.md to $GITHUB_STEP_SUMMARY')
+    .action(async (options) => {
+    var _a, _b, _c, _d, _e, _f, _g, _h, _j;
+    const logger = (0, observability_1.getLogger)();
+    const parentOpts = program.opts();
+    const reportsDir = path.resolve(options.reportsDir);
+    const outDir = path.resolve(options.outDir);
+    const projectName = options.projectName;
+    // Load thresholds from config
+    const analyzerCfg = (0, config_1.loadCentralConfig)(parentOpts.config);
+    const thresholds = ((_a = analyzerCfg.thresholds) !== null && _a !== void 0 ? _a : {});
+    // Read accumulated coverage-summary.json
+    let coverageResults = [];
+    let qualityGateResult;
+    const summaryPath = require('path').join(reportsDir, 'coverage-summary.json');
+    try {
+        if (require('fs').existsSync(summaryPath)) {
+            const raw = require('fs').readFileSync(summaryPath, 'utf-8');
+            const parsed = JSON.parse(raw);
+            if (Array.isArray(parsed.summary)) {
+                coverageResults = parsed.summary.map((s) => {
+                    var _a, _b, _c, _d;
+                    return ({
+                        type: s.type,
+                        totalItems: (_a = s.totalItems) !== null && _a !== void 0 ? _a : 0,
+                        coveredItems: (_b = s.coveredItems) !== null && _b !== void 0 ? _b : 0,
+                        coveragePercent: (_c = s.coveragePercent) !== null && _c !== void 0 ? _c : 0,
+                        details: (_d = s.details) !== null && _d !== void 0 ? _d : {},
+                    });
+                });
+            }
+            if (parsed.qualityGate && typeof parsed.qualityGate === 'object') {
+                qualityGateResult = parsed.qualityGate;
+            }
+        }
+    }
+    catch (err) {
+        logger.warn({ event: 'summary_report_load_warning', error: String(err) }, 'Could not load coverage-summary.json');
+    }
+    // Optionally load coverage-intelligence.json for intelligence section
+    let intelligenceSummary;
+    const intelligencePath = require('path').join(reportsDir, 'coverage-intelligence.json');
+    try {
+        if (require('fs').existsSync(intelligencePath)) {
+            const raw = require('fs').readFileSync(intelligencePath, 'utf-8');
+            const parsed = JSON.parse(raw);
+            if (parsed.summary && typeof parsed.summary === 'object') {
+                const s = parsed.summary;
+                intelligenceSummary = {
+                    totalFindings: (_b = s.totalFindings) !== null && _b !== void 0 ? _b : 0,
+                    totalRecommendations: (_c = s.totalRecommendations) !== null && _c !== void 0 ? _c : 0,
+                    maxRiskScore: (_d = s.maxRiskScore) !== null && _d !== void 0 ? _d : 0,
+                    avgRiskScore: (_e = s.avgRiskScore) !== null && _e !== void 0 ? _e : 0,
+                    criticalUncoveredItems: (_f = s.criticalUncoveredItems) !== null && _f !== void 0 ? _f : 0,
+                    unprotectedSecurityFindings: (_g = s.unprotectedSecurityFindings) !== null && _g !== void 0 ? _g : 0,
+                    recommendationsByPriority: (_h = s.recommendationsByPriority) !== null && _h !== void 0 ? _h : {},
+                    topRiskAreas: (_j = s.topRiskAreas) !== null && _j !== void 0 ? _j : [],
+                };
+            }
+        }
+    }
+    catch (_) {
+        // intelligence report is optional — ignore read errors
+    }
+    const summaryInput = {
+        results: coverageResults,
+        qualityGate: qualityGateResult,
+        thresholds,
+        projectName,
+        branch: options.branch,
+        commitSha: options.commitSha,
+        buildId: options.buildId,
+        intelligenceSummary,
+    };
+    const buildResult = await (0, buildSummary_1.generateBuildSummary)(summaryInput, outDir);
+    await (0, prSummary_1.generatePrSummary)(summaryInput, outDir);
+    // Optionally write to GITHUB_STEP_SUMMARY
+    if (options.writeStepSummary) {
+        const stepSummaryPath = process.env['GITHUB_STEP_SUMMARY'];
+        if (stepSummaryPath) {
+            require('fs').appendFileSync(stepSummaryPath, buildResult.markdown + '\n', 'utf-8');
+            console.log(`Step summary written to ${stepSummaryPath}`);
+        }
+        else {
+            logger.warn({ event: 'step_summary_missing_env' }, 'GITHUB_STEP_SUMMARY env var not set; skipping step summary write');
+        }
+    }
+    console.log(`\n=== Coverage Summary Report ===`);
+    console.log(`  Project: ${projectName}`);
+    console.log(`  Metrics: ${coverageResults.length}`);
+    if (qualityGateResult !== undefined) {
+        console.log(`  Overall: ${qualityGateResult.passed ? 'PASSED' : 'FAILED'}`);
+    }
+    console.log(`\nSummary reports written to: ${outDir}`);
+    logger.info({ event: 'summary_report_complete' }, 'Coverage summary report generated');
+});
+// ─── analyze command ─────────────────────────────────────────────────────────
+program
+    .command('analyze')
+    .description('Zero-config full analysis: discover project artifacts, infer missing rules/flows, compute coverage.')
+    .option('--root <dir>', 'Project root to analyze (default: current working directory)')
+    .option('--reports-dir <dir>', 'Directory to write reports to (default: reports/)')
+    .option('--export-inferred-rules', 'Export inferred rules/flows as editable YAML files')
+    .option('--no-infer-business-rules', 'Disable business rule inference')
+    .option('--no-infer-integration-flows', 'Disable integration flow inference')
+    .action(async (options) => {
+    var _a, _b, _c, _d, _e, _f, _g, _h, _j, _k;
+    const { metricsPort, serviceName } = setupObservability();
+    const logger = (0, observability_1.getLogger)();
+    const configPath = program.opts()['config'];
+    const analyzerCfg = (0, config_1.loadCentralConfig)(configPath);
+    const rootDir = (_a = options['root']) !== null && _a !== void 0 ? _a : process.cwd();
+    const reportsDir = (_d = (_b = options['reportsDir']) !== null && _b !== void 0 ? _b : (_c = analyzerCfg.reports) === null || _c === void 0 ? void 0 : _c.outputDir) !== null && _d !== void 0 ? _d : 'reports';
+    const doInferRules = options['inferBusinessRules'] !== false &&
+        ((_f = (_e = analyzerCfg.analysis) === null || _e === void 0 ? void 0 : _e.inferBusinessRules) !== null && _f !== void 0 ? _f : true);
+    const doInferFlows = options['inferIntegrationFlows'] !== false &&
+        ((_h = (_g = analyzerCfg.analysis) === null || _g === void 0 ? void 0 : _g.inferIntegrationFlows) !== null && _h !== void 0 ? _h : true);
+    const agnosticDisc = (_k = (_j = analyzerCfg.analysis) === null || _j === void 0 ? void 0 : _j.agnosticDiscovery) !== null && _k !== void 0 ? _k : true;
+    logger.info({ event: 'analyze_start', rootDir }, 'Starting agnostic project analysis');
+    // ── 1. Discover project artifacts ──────────────────────────────────────
+    const artifacts = (0, projectDiscovery_1.discoverProject)({ rootDir });
+    console.log('\n=== API Test Coverage Analyzer ===');
+    console.log(`Project root: ${rootDir}`);
+    console.log(`Languages detected: ${artifacts.languages.join(', ') || 'none'}`);
+    console.log(`Frameworks detected: ${artifacts.frameworks.join(', ') || 'none'}`);
+    console.log(`API specs found: ${artifacts.specs.length}`);
+    console.log(`Test files found: ${artifacts.testFiles.length}`);
+    console.log(`Service files found: ${artifacts.serviceFiles.length}`);
+    if (!agnosticDisc && artifacts.specs.length === 0) {
+        console.error('\n[ERROR] No API spec found and agnosticDiscovery is disabled. Aborting.');
+        process.exitCode = 1;
+        return;
+    }
+    const warnings = [];
+    // ── 2. Business rule inference ─────────────────────────────────────────
+    if (doInferRules) {
+        console.log('\nNo business-rules.yaml file detected.');
+        console.log('Business rules will be inferred automatically.');
+        const rulesResult = (0, businessRuleInference_1.inferBusinessRules)(artifacts.serviceFiles, warnings);
+        const rulesPath = (0, businessRuleInference_1.writeInferredBusinessRules)(rulesResult, reportsDir);
+        console.log(`\nBusiness Rule Coverage`);
+        console.log(`  Source: inferred`);
+        console.log(`  Rules detected: ${rulesResult.rules.length}`);
+        console.log(`  Written to: ${rulesPath}`);
+        if (options['exportInferredRules']) {
+            const fsMod = require('fs');
+            const yaml = rulesResult.rules.map((r) => [
+                `- id: ${r.id}`,
+                `  name: ${r.name}`,
+                `  type: ${r.type}`,
+                r.endpoint ? `  endpoint: "${r.endpoint}"` : null,
+                `  condition: "${r.condition.replace(/"/g, "'")}"`,
+                `  source: ${r.source_location}`,
+            ].filter(Boolean).join('\n')).join('\n');
+            fsMod.writeFileSync(path.join(rootDir, 'generated-business-rules.yaml'), yaml, 'utf-8');
+            console.log('  Exported: generated-business-rules.yaml');
+        }
+    }
+    // ── 3. Integration flow inference ──────────────────────────────────────
+    if (doInferFlows) {
+        console.log('\nNo integration-flows.yaml file detected.');
+        console.log('Integration flows will be inferred automatically.');
+        const flowsResult = (0, integrationFlowInference_1.inferIntegrationFlows)(artifacts.testFiles, warnings);
+        const flowsPath = (0, integrationFlowInference_1.writeInferredIntegrationFlows)(flowsResult, reportsDir);
+        console.log(`\nIntegration Flow Coverage`);
+        console.log(`  Source: inferred`);
+        console.log(`  Flows detected: ${flowsResult.flows.length}`);
+        console.log(`  Written to: ${flowsPath}`);
+        if (options['exportInferredRules']) {
+            const fs = require('fs');
+            const yaml = flowsResult.flows.map((f) => [
+                `- id: ${f.id}`,
+                `  name: "${f.name}"`,
+                `  steps:`,
+                ...f.steps.map((s) => `    - { method: ${s.method}, path: "${s.path}" }`),
+            ].join('\n')).join('\n');
+            fs.writeFileSync(path.join(rootDir, 'generated-integration-flows.yaml'), yaml, 'utf-8');
+            console.log('  Exported: generated-integration-flows.yaml');
+        }
+    }
+    // ── 4. Emit warnings ───────────────────────────────────────────────────
+    for (const w of warnings) {
+        console.warn(`[WARN] ${w}`);
+    }
+    // ── 5. Configuration override log ──────────────────────────────────────
+    if (options['inferBusinessRules'] === false) {
+        console.log('\nConfiguration override detected: business rule inference disabled via CLI');
+    }
+    if (options['inferIntegrationFlows'] === false) {
+        console.log('\nConfiguration override detected: integration flow inference disabled via CLI');
+    }
+    logger.info({ event: 'analyze_complete', warnings: warnings.length }, 'Agnostic project analysis complete');
+    await finaliseObservability([], {}, metricsPort, serviceName);
+});
+// Parse the command-line arguments
+program.parse(process.argv);
+// When invoked with no arguments (no subcommand), display help
+if (process.argv.length <= 2) {
+    program.help();
+}