progmune-runtime 2.1.5 → 3.2.0

package/dist/plsb/artifact.js

@@ -0,0 +1,116 @@
+"use strict";
+/**
+ * Phase 9: PLSB Artifact Generator
+ *
+ * Generates the versioned PLSB v1.0 JSON artifact.
+ * This is a standalone, self-describing benchmark file
+ * suitable for external consumption (evaluators, CI, papers).
+ */
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.PLSB_ARTIFACT_PATH = exports.PLSB_SCHEMA_URI = exports.PLSB_PUBLIC_URI = void 0;
+exports.generatePLSBArtifact = generatePLSBArtifact;
+const fs = __importStar(require("fs"));
+const path = __importStar(require("path"));
+const crypto = __importStar(require("crypto"));
+/** Public reference URI for PLSB v1.0 — fixed, citable URL */
+exports.PLSB_PUBLIC_URI = "https://progmune.io/plsb/v1.0";
+exports.PLSB_SCHEMA_URI = `${exports.PLSB_PUBLIC_URI}/schema.json`;
+function generatePLSBArtifact(outputPath) {
+    const { buildPLSB, PROTOCOL_WEAKNESS_TAXONOMY } = require("../plsb-benchmark");
+    const benchmark = buildPLSB();
+    // Build a corpus hash from the benchmark content
+    const corpusHash = crypto
+        .createHash("sha256")
+        .update(JSON.stringify(benchmark))
+        .digest("hex")
+        .slice(0, 16);
+    const artifact = {
+        $schema: exports.PLSB_SCHEMA_URI,
+        "@id": exports.PLSB_PUBLIC_URI,
+        "@version": "1.0.0",
+        generated: new Date().toISOString(),
+        entries: (benchmark.entries || []).map((e) => ({
+            id: e.id,
+            pls_id: e.pls_id || undefined,
+            category: e.category,
+            severity: e.severity,
+            broken: e.broken || [],
+            expected: e.expected || [],
+            verified: e.verified || false,
+            source: e.source || "unknown",
+            cve: e.cve || undefined,
+            project: e.project || undefined,
+            notes: e.notes || undefined,
+        })),
+        benchmark: {
+            name: benchmark.name || "PLSB-100",
+            version: benchmark.version || "1.0",
+            taxonomy: PROTOCOL_WEAKNESS_TAXONOMY.map((t) => ({
+                id: t.id,
+                name: t.name,
+                category: t.category,
+                description: t.description,
+                example_broken: t.example_broken || [],
+                example_expected: t.example_expected || [],
+            })),
+            metadata: {
+                total: benchmark.metadata?.total || 0,
+                verified: benchmark.metadata?.verified || 0,
+                byCategory: benchmark.metadata?.byCategory || {},
+                byPLS: benchmark.metadata?.byPLS || {},
+                coverage: benchmark.metadata?.coverage || 0,
+                recall: benchmark.metadata?.recall || 0,
+                precision: benchmark.metadata?.precision || 0,
+            },
+        },
+        provenance: {
+            source: "progmune-runtime",
+            version: "3.2.0",
+            corpusHash,
+        },
+    };
+    // Write to disk
+    if (outputPath) {
+        const outDir = path.dirname(outputPath);
+        if (!fs.existsSync(outDir)) {
+            fs.mkdirSync(outDir, { recursive: true });
+        }
+        fs.writeFileSync(outputPath, JSON.stringify(artifact, null, 2), "utf-8");
+    }
+    return artifact;
+}
+/** Default output path for the PLSB artifact */
+exports.PLSB_ARTIFACT_PATH = "benchmarks/plsb-v1.0.json";

package/dist/plsb/cli.js

@@ -0,0 +1,71 @@
+"use strict";
+/**
+ * Phase 9: PLSB CLI
+ *
+ * Usage:
+ *   npx ts-node src/plsb/cli.ts --export        write plsb-v1.0.json
+ *   npx ts-node src/plsb/cli.ts --report        write plsb-report.md
+ *   npx ts-node src/plsb/cli.ts --all           both
+ *   npx ts-node src/plsb/cli.ts --summary       terminal summary
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+const artifact_1 = require("./artifact");
+const schema_1 = require("./schema");
+const report_md_1 = require("./report-md");
+const leaderboard_1 = require("./leaderboard");
+const args = process.argv.slice(2);
+if (args.includes("--help") || args.includes("-h") || args.length === 0) {
+    console.log(`
+PLSB CLI — Protocol Lifecycle Security Benchmark
+
+Usage:
+  npx ts-node src/plsb/cli.ts [options]
+
+Options:
+  --export      Generate ${artifact_1.PLSB_ARTIFACT_PATH}
+  --report      Generate ${report_md_1.PLSB_REPORT_PATH}
+  --all          Generate both artifact and report
+  --leaderboard  Generate PLSB Leaderboard (JSON + Markdown)
+  --summary      Print terminal summary
+  --help, -h     Show this help
+  `);
+    process.exit(0);
+}
+const doExport = args.includes("--export") || args.includes("--all");
+const doReport = args.includes("--report") || args.includes("--all");
+const doSummary = args.includes("--summary") || (!doExport && !doReport);
+if (args.includes("--leaderboard")) {
+    (0, leaderboard_1.exportLeaderboard)();
+    process.exit(0);
+}
+if (doExport) {
+    const artifact = (0, artifact_1.generatePLSBArtifact)(artifact_1.PLSB_ARTIFACT_PATH);
+    (0, schema_1.generatePLSBSchema)(schema_1.PLSB_SCHEMA_PATH);
+    console.log(`✅ Exported: ${artifact_1.PLSB_ARTIFACT_PATH}`);
+    console.log(`✅ Schema:   ${schema_1.PLSB_SCHEMA_PATH}`);
+    console.log(`   Public URI: ${artifact["@id"]}`);
+    console.log(`   ${artifact.benchmark.metadata.total} entries, ${Object.keys(artifact.benchmark.metadata.byPLS).length}/${artifact.benchmark.taxonomy.length} categories covered`);
+}
+if (doReport) {
+    (0, report_md_1.generatePLSBReportMarkdown)(report_md_1.PLSB_REPORT_PATH);
+    console.log(`✅ Report: ${report_md_1.PLSB_REPORT_PATH}`);
+}
+if (doSummary) {
+    const { buildPLSB, PROTOCOL_WEAKNESS_TAXONOMY } = require("../plsb-benchmark");
+    const benchmark = buildPLSB();
+    const taxonomy = PROTOCOL_WEAKNESS_TAXONOMY;
+    const byPLS = benchmark.metadata?.byPLS || {};
+    console.log("");
+    console.log("PLSB v1.0 — Protocol Lifecycle Security Benchmark");
+    console.log("==================================================");
+    console.log(`  Entries:    ${benchmark.metadata?.total || 0} (${benchmark.metadata?.verified || 0} verified)`);
+    console.log(`  Recall:     ${((benchmark.metadata?.recall || 0) * 100).toFixed(0)}%`);
+    console.log(`  Precision:  ${((benchmark.metadata?.precision || 0) * 100).toFixed(0)}%`);
+    console.log("");
+    for (const t of taxonomy) {
+        const count = byPLS[t.id] || 0;
+        const icon = count > 0 ? "✅" : "⚠️";
+        console.log(`  ${icon} ${t.id} ${t.name.padEnd(22)} ${t.category.padEnd(18)} ${count} entries`);
+    }
+    console.log("");
+}

package/dist/plsb/index.js

@@ -0,0 +1,19 @@
+"use strict";
+/**
+ * Phase 9: PLSB Productization Module
+ *
+ * Public API for PLSB v1.0 artifact and report generation.
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.PLSB_REPORT_PATH = exports.generatePLSBReportMarkdown = exports.PLSB_SCHEMA_PATH = exports.generatePLSBSchema = exports.PLSB_SCHEMA_URI = exports.PLSB_PUBLIC_URI = exports.PLSB_ARTIFACT_PATH = exports.generatePLSBArtifact = void 0;
+var artifact_1 = require("./artifact");
+Object.defineProperty(exports, "generatePLSBArtifact", { enumerable: true, get: function () { return artifact_1.generatePLSBArtifact; } });
+Object.defineProperty(exports, "PLSB_ARTIFACT_PATH", { enumerable: true, get: function () { return artifact_1.PLSB_ARTIFACT_PATH; } });
+Object.defineProperty(exports, "PLSB_PUBLIC_URI", { enumerable: true, get: function () { return artifact_1.PLSB_PUBLIC_URI; } });
+Object.defineProperty(exports, "PLSB_SCHEMA_URI", { enumerable: true, get: function () { return artifact_1.PLSB_SCHEMA_URI; } });
+var schema_1 = require("./schema");
+Object.defineProperty(exports, "generatePLSBSchema", { enumerable: true, get: function () { return schema_1.generatePLSBSchema; } });
+Object.defineProperty(exports, "PLSB_SCHEMA_PATH", { enumerable: true, get: function () { return schema_1.PLSB_SCHEMA_PATH; } });
+var report_md_1 = require("./report-md");
+Object.defineProperty(exports, "generatePLSBReportMarkdown", { enumerable: true, get: function () { return report_md_1.generatePLSBReportMarkdown; } });
+Object.defineProperty(exports, "PLSB_REPORT_PATH", { enumerable: true, get: function () { return report_md_1.PLSB_REPORT_PATH; } });

package/dist/plsb/leaderboard.js

@@ -0,0 +1,249 @@
+"use strict";
+/**
+ * Phase 12: PLSB Leaderboard
+ *
+ * Public comparison of protocol lifecycle security detection tools.
+ * The market believes rankings, not papers.
+ *
+ * Generates a transparent, reproducible leaderboard:
+ *   - Progmune's real scores from buildPLSB()
+ *   - Placeholder rows for other tools with methodology notes
+ *   - JSON artifact + Markdown + HTML
+ *
+ * Usage:
+ *   npx ts-node src/plsb/cli.ts --leaderboard
+ */
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.LEADERBOARD_MD_PATH = exports.LEADERBOARD_JSON_PATH = void 0;
+exports.generateLeaderboard = generateLeaderboard;
+exports.formatLeaderboardMarkdown = formatLeaderboardMarkdown;
+exports.formatLeaderboardJSON = formatLeaderboardJSON;
+exports.exportLeaderboard = exportLeaderboard;
+const fs = __importStar(require("fs"));
+const path = __importStar(require("path"));
+// ═══════════════════════════════════════════════════════════════
+// Generator
+// ═══════════════════════════════════════════════════════════════
+function generateLeaderboard() {
+    const { buildPLSB, PROTOCOL_WEAKNESS_TAXONOMY } = require("../plsb-benchmark");
+    const benchmark = buildPLSB();
+    const taxonomy = PROTOCOL_WEAKNESS_TAXONOMY;
+    const byPLS = benchmark.metadata?.byPLS || {};
+    const covered = taxonomy.filter((t) => (byPLS[t.id] || 0) > 0).length;
+    const totalEntries = benchmark.metadata?.total || 0;
+    const verifiedEntries = benchmark.metadata?.verified || 0;
+    // Progmune's real scores
+    const progmuneEntry = {
+        tool: "Progmune Runtime",
+        version: "3.2.0",
+        vendor: "Progmune (Open Source)",
+        score: 0, // F1 requires hand-labeled ground truth — will be filled when .progmune_labels.json exists
+        recall: 0,
+        precision: 0,
+        categoriesCovered: covered,
+        categoriesTotal: taxonomy.length,
+        entriesTested: totalEntries,
+        benchmarkDate: new Date().toISOString().slice(0, 10),
+        status: "benchmarked",
+        methodology: "SSG state machine validation + auto-discovered protocol rules. Score requires hand-labeled ground truth per repo (.progmune_labels.json).",
+        artifacts: "benchmarks/plsb-v1.0.json",
+        notes: verifiedEntries > 0
+            ? `${verifiedEntries} verified gold entries, ${covered}/${taxonomy.length} categories covered. Precision requires annotated labels per target repository.`
+            : "Gold dataset ready. Multi-repo labeling in progress.",
+    };
+    // Comparison tools — not yet independently benchmarked
+    const comparisonEntries = [
+        {
+            tool: "CodeQL",
+            version: "—",
+            vendor: "GitHub / Microsoft",
+            score: 0, recall: 0, precision: 0,
+            categoriesCovered: 0, categoriesTotal: taxonomy.length, entriesTested: 0,
+            benchmarkDate: "—",
+            status: "not_benchmarked",
+            methodology: "CodeQL detects data flow and taint patterns but does not model protocol state machines. Protocol lifecycle violations (missing release, double commit, session fixation) fall outside its taint-tracking model. Benchmark integration requires writing custom CodeQL queries for each PLS category.",
+            notes: "Custom query pack needed to map PLS-001 through PLS-013 to CodeQL predicates.",
+        },
+        {
+            tool: "Semgrep",
+            version: "—",
+            vendor: "Semgrep, Inc.",
+            score: 0, recall: 0, precision: 0,
+            categoriesCovered: 0, categoriesTotal: taxonomy.length, entriesTested: 0,
+            benchmarkDate: "—",
+            status: "not_benchmarked",
+            methodology: "Semgrep matches AST patterns but lacks stateful sequence analysis. Can detect missing function calls only if written as explicit pattern pairs. Protocol lifecycle detection requires cross-function state tracking not available in pattern-matching mode.",
+            notes: "Semgrep's taint mode may partially cover PLS-004 (auth bypass) but cannot model acquire→use→release chains.",
+        },
+        {
+            tool: "Snyk Code",
+            version: "—",
+            vendor: "Snyk Ltd.",
+            score: 0, recall: 0, precision: 0,
+            categoriesCovered: 0, categoriesTotal: taxonomy.length, entriesTested: 0,
+            benchmarkDate: "—",
+            status: "not_benchmarked",
+            methodology: "Snyk Code uses ML-based vulnerability detection trained on known CVE patterns. May implicitly learn some protocol patterns from training data, but provides no deterministic protocol state machine guarantees.",
+            notes: "Black-box evaluation would require running Snyk Code against PLSB benchmark cases and comparing detection results.",
+        },
+        {
+            tool: "Checkmarx SAST",
+            version: "—",
+            vendor: "Checkmarx Ltd.",
+            score: 0, recall: 0, precision: 0,
+            categoriesCovered: 0, categoriesTotal: taxonomy.length, entriesTested: 0,
+            benchmarkDate: "—",
+            status: "not_benchmarked",
+            methodology: "Checkmarx provides data flow analysis but does not explicitly model protocol state machines. Requires custom query configuration for cross-functional sequence detection.",
+            notes: "Undergoing acquisition by Haveli Investments. Enterprise SAST with custom query support.",
+        },
+        {
+            tool: "Copilot Code Review",
+            version: "—",
+            vendor: "GitHub / Microsoft",
+            score: 0, recall: 0, precision: 0,
+            categoriesCovered: 0, categoriesTotal: taxonomy.length, entriesTested: 0,
+            benchmarkDate: "—",
+            status: "not_benchmarked",
+            methodology: "LLM-based code review can identify individual missing function calls but lacks deterministic protocol state machine enforcement. Detection depends on prompt engineering and model behavior, not verifiable rules.",
+            notes: "LLM-based review is probabilistic. PLSB requires deterministic detection for governance certification.",
+        },
+    ];
+    const entries = [progmuneEntry, ...comparisonEntries];
+    return {
+        name: "PLSB Leaderboard",
+        version: "1.0.0",
+        generated: new Date().toISOString(),
+        benchmarkVersion: "v1.0",
+        plsbUri: "https://progmune.io/plsb/v1.0",
+        entries,
+        methodology: {
+            description: "Protocol Lifecycle Security Benchmark — measures each tool's ability to detect protocol state machine violations (missing states, illegal transitions, lifecycle breaks) that traditional SAST cannot see.",
+            benchmark: "13-category Protocol Weakness Taxonomy (PLS-001 through PLS-013). Gold dataset: 25 manually-verified real-world defect cases.",
+            metric: "F1 score = harmonic mean of precision and recall. Precision = true positives / (true positives + false positives). Recall = true positives / (true positives + false negatives).",
+            categories: "resource_leak, use_after_free, auth_bypass, session_fixation, privilege_escalation, transaction_violation, double_free, race_condition, missing_validation",
+        },
+    };
+}
+// ═══════════════════════════════════════════════════════════════
+// Formatters
+// ═══════════════════════════════════════════════════════════════
+function formatLeaderboardMarkdown(lb) {
+    const lines = [];
+    lines.push("# PLSB Leaderboard — Protocol Lifecycle Security Detection");
+    lines.push("");
+    lines.push(`**Version:** ${lb.benchmarkVersion} | **Generated:** ${lb.generated}`);
+    lines.push("");
+    lines.push(`> ${lb.methodology.description}`);
+    lines.push("");
+    lines.push("## Scores");
+    lines.push("");
+    lines.push(`| # | Tool | Score (F1) | Recall | Precision | Categories | Status |`);
+    lines.push(`|---|------|-----------|--------|-----------|------------|--------|`);
+    for (let i = 0; i < lb.entries.length; i++) {
+        const e = lb.entries[i];
+        const scoreStr = e.status === "benchmarked" && e.score > 0
+            ? `${e.score}%`
+            : e.status === "benchmarked"
+                ? `⚠️ needs labels`
+                : "—";
+        const recallStr = e.recall > 0 ? `${e.recall}%` : "—";
+        const precisionStr = e.precision > 0 ? `${e.precision}%` : "—";
+        const catStr = e.categoriesCovered > 0
+            ? `${e.categoriesCovered}/${e.categoriesTotal}`
+            : "—";
+        const statusStr = e.status === "benchmarked" ? "✅" : "⏳";
+        lines.push(`| ${i + 1} | **${e.tool}** | ${scoreStr} | ${recallStr} | ${precisionStr} | ${catStr} | ${statusStr} |`);
+    }
+    lines.push("");
+    // Methodology per tool
+    lines.push("## Methodology Notes");
+    lines.push("");
+    for (const e of lb.entries) {
+        lines.push(`### ${e.tool} (${e.vendor})`);
+        lines.push("");
+        if (e.status === "benchmarked") {
+            lines.push(`- **Status:** Benchmarked on PLSB v1.0 gold dataset`);
+            lines.push(`- **Entries tested:** ${e.entriesTested}`);
+            lines.push(`- **Method:** ${e.methodology}`);
+        }
+        else {
+            lines.push(`- **Status:** Not yet benchmarked on PLSB`);
+            lines.push(`- **Why not:** ${e.methodology}`);
+        }
+        if (e.notes)
+            lines.push(`- **Note:** ${e.notes}`);
+        lines.push("");
+    }
+    // How to contribute
+    lines.push("## Contributing");
+    lines.push("");
+    lines.push("Tool vendors and researchers can submit benchmark results by:");
+    lines.push("");
+    lines.push("1. Cloning [progmune-runtime](https://github.com/shenlian19831109/progmune-runtime)");
+    lines.push("2. Running `npm run plsb:export` to get `benchmarks/plsb-v1.0.json`");
+    lines.push("3. Testing their tool against the 25 gold cases (13 categories)");
+    lines.push("4. Submitting results as a PR to this leaderboard");
+    lines.push("");
+    lines.push("All submissions must include reproducible methodology and raw detection logs.");
+    lines.push("");
+    lines.push("---");
+    lines.push(`*Leaderboard generated by [Progmune Runtime](https://github.com/shenlian19831109/progmune-runtime)*`);
+    lines.push("");
+    return lines.join("\n");
+}
+function formatLeaderboardJSON(lb) {
+    return JSON.stringify(lb, null, 2);
+}
+// ═══════════════════════════════════════════════════════════════
+// Export
+// ═══════════════════════════════════════════════════════════════
+exports.LEADERBOARD_JSON_PATH = "benchmarks/plsb-leaderboard.json";
+exports.LEADERBOARD_MD_PATH = "benchmarks/plsb-leaderboard.md";
+function exportLeaderboard(outputDir) {
+    const lb = generateLeaderboard();
+    const dir = outputDir || "benchmarks";
+    if (!fs.existsSync(dir))
+        fs.mkdirSync(dir, { recursive: true });
+    const jsonPath = path.join(dir, "plsb-leaderboard.json");
+    const mdPath = path.join(dir, "plsb-leaderboard.md");
+    fs.writeFileSync(jsonPath, formatLeaderboardJSON(lb), "utf-8");
+    fs.writeFileSync(mdPath, formatLeaderboardMarkdown(lb), "utf-8");
+    console.error(`✅ Leaderboard JSON: ${jsonPath}`);
+    console.error(`✅ Leaderboard MD:   ${mdPath}`);
+    console.error(`   Tools: ${lb.entries.length} (1 benchmarked, ${lb.entries.length - 1} awaiting)`);
+    return { json: jsonPath, md: mdPath };
+}

package/dist/plsb/report-md.js

@@ -0,0 +1,156 @@
+"use strict";
+/**
+ * Phase 9: PLSB Markdown Report Generator
+ *
+ * Generates a self-contained markdown report for the PLSB benchmark.
+ * Suitable for human stakeholders, CI artifacts, and PDF conversion.
+ */
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.PLSB_REPORT_PATH = void 0;
+exports.generatePLSBReportMarkdown = generatePLSBReportMarkdown;
+const fs = __importStar(require("fs"));
+const path = __importStar(require("path"));
+function generatePLSBReportMarkdown(outputPath) {
+    const { buildPLSB, PROTOCOL_WEAKNESS_TAXONOMY } = require("../plsb-benchmark");
+    const benchmark = buildPLSB();
+    const taxonomy = PROTOCOL_WEAKNESS_TAXONOMY;
+    const lines = [];
+    lines.push("# PLSB Report: Protocol Lifecycle Security Benchmark");
+    lines.push("");
+    lines.push(`**Version:** ${benchmark.version || "1.0"}`);
+    lines.push(`**Generated:** ${new Date().toISOString()}`);
+    lines.push(`**Source:** Progmune Runtime v3.2.0`);
+    lines.push("");
+    // ── Summary ──
+    lines.push("## Summary");
+    lines.push("");
+    lines.push(`| Metric | Value |`);
+    lines.push(`|--------|-------|`);
+    lines.push(`| Total Entries | ${benchmark.metadata?.total || 0} |`);
+    lines.push(`| Verified Entries | ${benchmark.metadata?.verified || 0} |`);
+    lines.push(`| Recall | ${((benchmark.metadata?.recall || 0) * 100).toFixed(0)}% |`);
+    lines.push(`| Precision | ${((benchmark.metadata?.precision || 0) * 100).toFixed(0)}% |`);
+    lines.push(`| Categories Covered | ${Object.keys(benchmark.metadata?.byPLS || {}).length} / ${taxonomy.length} |`);
+    lines.push("");
+    // ── Taxonomy Grid ──
+    lines.push("## Protocol Weakness Taxonomy");
+    lines.push("");
+    lines.push(`| PLS-ID | Name | Category | Entries | Status |`);
+    lines.push(`|--------|------|----------|---------|--------|`);
+    const byPLS = benchmark.metadata?.byPLS || {};
+    for (const t of taxonomy) {
+        const count = byPLS[t.id] || 0;
+        const status = count > 0 ? "✅ Covered" : "⚠️ Uncovered";
+        lines.push(`| ${t.id} | ${t.name} | ${t.category} | ${count} | ${status} |`);
+    }
+    lines.push("");
+    // ── Entries Table ──
+    const entries = benchmark.entries || [];
+    if (entries.length > 0) {
+        lines.push("## Entries");
+        lines.push("");
+        lines.push(`| ID | PLS | Category | Severity | Verified | CVE / Source |`);
+        lines.push(`|----|-----|----------|----------|----------|-------------|`);
+        for (const e of entries.slice(0, 30)) {
+            const cveRef = e.cve ? `CVE-${e.cve}` : e.source || "—";
+            lines.push(`| ${e.id} | ${e.pls_id || "—"} | ${e.category} | ${e.severity} | ${e.verified ? "✅" : "—"} | ${cveRef} |`);
+        }
+        if (entries.length > 30) {
+            lines.push(`| ... | ... | ${entries.length - 30} more entries ... |`);
+        }
+        lines.push("");
+    }
+    // ── Per-Category Detail ──
+    lines.push("## Category Breakdown");
+    lines.push("");
+    const byCategory = benchmark.metadata?.byCategory || {};
+    const categories = [...new Set(taxonomy.map((t) => t.category))];
+    for (const cat of categories) {
+        const count = byCategory[cat] || 0;
+        const plsInCat = taxonomy.filter((t) => t.category === cat).map((t) => t.id);
+        lines.push(`### ${cat} (${count} entries)`);
+        lines.push(`Covered PLS: ${plsInCat.filter((id) => (byPLS[id] || 0) > 0).join(", ") || "none"}`);
+        lines.push("");
+    }
+    // ── Detector Performance ──
+    lines.push("## Detector Performance");
+    lines.push("");
+    const recall = (benchmark.metadata?.recall || 0) * 100;
+    const precision = (benchmark.metadata?.precision || 0) * 100;
+    lines.push(`| Metric | Value | Rating |`);
+    lines.push(`|--------|-------|--------|`);
+    lines.push(`| Recall | ${recall.toFixed(0)}% | ${recall > 85 ? "✅ Excellent" : recall > 70 ? "⚠️ Good" : "❌ Needs Improvement"} |`);
+    lines.push(`| Precision | ${precision.toFixed(0)}% | ${precision > 80 ? "✅ Excellent" : precision > 60 ? "⚠️ Good" : "❌ Needs Improvement"} |`);
+    lines.push("");
+    // ── Certification ──
+    lines.push("## Certification");
+    lines.push("");
+    lines.push("This benchmark was generated by **Progmune Runtime** — an AI-generated software governance system.");
+    lines.push("");
+    lines.push("- **Detector:** Protocol Lifecycle Security (13-category taxonomy)");
+    lines.push("- **Methodology:** State machine fingerprint comparison (structural violation detection)");
+    lines.push("- **Gold Standard:** 20 manually-verified real-world defect cases");
+    lines.push("");
+    if (recall > 85) {
+        lines.push("### Verdict: CERTIFIED ✅");
+        lines.push("");
+        lines.push("The PLSB detector exceeds the 85% recall threshold for protocol lifecycle vulnerability detection.");
+    }
+    else if (recall > 70) {
+        lines.push("### Verdict: PROMISING ⚠️");
+        lines.push("");
+        lines.push("The PLSB detector exceeds 70% recall. Additional gold cases are needed for uncovered categories.");
+    }
+    else {
+        lines.push("### Verdict: IN DEVELOPMENT 🔬");
+        lines.push("");
+        lines.push("The PLSB detector is under active development. Recall is below 70% — more protocol rules and gold cases needed.");
+    }
+    lines.push("");
+    lines.push("---");
+    lines.push("*Generated by [Progmune Runtime](https://github.com/shenlian19831109/progmune-runtime)*");
+    const output = lines.join("\n");
+    // Write to disk
+    if (outputPath) {
+        const outDir = path.dirname(outputPath);
+        if (!fs.existsSync(outDir)) {
+            fs.mkdirSync(outDir, { recursive: true });
+        }
+        fs.writeFileSync(outputPath, output, "utf-8");
+    }
+    return output;
+}
+exports.PLSB_REPORT_PATH = "benchmarks/plsb-report.md";