@xenos1996/usa 2.0.0

package/dist/engine/loader.js

@@ -0,0 +1,388 @@
+import { parse as parseYaml } from 'yaml';
+import { asMap, isMap, list, num, scalar, str, strList } from '../util/yaml.js';
+import fs from 'node:fs';
+import path from 'node:path';
+export const SEVERITY_LADDER = ['FUTURE', 'LOW', 'MEDIUM', 'HIGH', 'CRITICAL'];
+export const RULE_CLASSES = [
+    'security',
+    'supply-chain',
+    'correctness',
+    'maintainability',
+    'operations',
+    'performance',
+    'compliance',
+    'documentation',
+    'style',
+];
+export const DEFAULT_WEIGHT = {
+    CRITICAL: 10,
+    HIGH: 6,
+    MEDIUM: 3,
+    LOW: 1.5,
+    FUTURE: 0.5,
+};
+/**
+ * Load a single pack file (not the registry). Used by the evolution CLI to load
+ * a candidate capability pack that is *not* (yet) in `rules/index.yaml`.
+ */
+export function loadPackFile(file) {
+    const warnings = [];
+    const pack = parsePack(path.resolve(file), new Map(), warnings);
+    if (pack)
+        pack.source = path.basename(file);
+    return { pack, warnings };
+}
+/** Read `rules/index.yaml` and every pack it references. */
+export function loadRulePacks(rulesDir) {
+    const warnings = [];
+    const indexPath = path.join(rulesDir, 'index.yaml');
+    if (!fs.existsSync(indexPath)) {
+        throw new Error(`Rule index not found at ${indexPath}. Pass --rules-dir or run \`usa init\`.`);
+    }
+    let indexDoc;
+    try {
+        indexDoc = parseYaml(fs.readFileSync(indexPath, 'utf8'));
+    }
+    catch (err) {
+        // A corrupt index must not abort the audit with a stack trace: warn and
+        // continue with zero packs rather than zero findings with no explanation.
+        warnings.push(`rule index ${indexPath} is not valid YAML (${err.message}) — no packs loaded`);
+        return { packs: [], warnings };
+    }
+    const entries = indexDoc?.packs ?? [];
+    const packs = [];
+    const seenIds = new Set();
+    const seenRuleIds = new Map();
+    for (const entry of entries) {
+        processIndexEntry(entry, rulesDir, packs, seenIds, seenRuleIds, warnings);
+    }
+    return { packs, warnings };
+}
+function processIndexEntry(entry, rulesDir, packs, seenIds, seenRuleIds, warnings) {
+    const file = typeof entry === 'string' ? entry : entry.file;
+    const enabled = typeof entry === 'string' ? true : entry.enabled !== false;
+    if (!enabled)
+        return;
+    const abs = path.resolve(rulesDir, file);
+    if (!fs.existsSync(abs)) {
+        warnings.push(`pack listed in index but missing on disk: ${file}`);
+        return;
+    }
+    const pack = parsePack(abs, seenRuleIds, warnings);
+    if (!pack)
+        return;
+    if (seenIds.has(pack.id)) {
+        warnings.push(`duplicate pack id "${pack.id}" (${file}) — later pack ignored`);
+        return;
+    }
+    seenIds.add(pack.id);
+    pack.source = path.relative(path.dirname(rulesDir), abs) || file;
+    packs.push(pack);
+}
+function parsePack(file, seenRuleIds, warnings) {
+    let text;
+    try {
+        text = fs.readFileSync(file, 'utf8');
+    }
+    catch (err) {
+        warnings.push(`pack ${file} could not be read (${err.message}) — pack skipped`);
+        return null;
+    }
+    return parsePackText(text, file, seenRuleIds, warnings);
+}
+/**
+ * Parse a rule pack from YAML text in memory. Shared by the file loader and the
+ * evolution proposal stage, which renders a candidate pack (from the bootstrap
+ * catalog) without ever touching the checked-in registry. `sourceName` is only
+ * used in warnings and as the fallback pack id.
+ */
+export function parsePackText(text, sourceName, seenRuleIds = new Map(), warnings = []) {
+    let raw;
+    try {
+        raw = parseYaml(text);
+    }
+    catch (err) {
+        // One corrupt pack must not abort the whole audit: skip it loudly.
+        warnings.push(`pack ${sourceName} is not valid YAML (${err.message}) — pack skipped`);
+        return null;
+    }
+    if (!isMap(raw)) {
+        warnings.push(`${sourceName}: not a YAML mapping`);
+        return null;
+    }
+    const id = str(raw.id) ?? path.basename(sourceName, path.extname(sourceName));
+    const rules = [];
+    (list(raw.rules) ?? []).forEach((r, i) => {
+        const parsed = parseRule(r, id, i, warnings);
+        if (!parsed)
+            return;
+        const firstSeen = seenRuleIds.get(parsed.id);
+        if (firstSeen !== undefined) {
+            // Duplicate rule IDs double-count weight in scoring and collide as
+            // duplicate YAML keys in the report trailer (second silently wins in
+            // `usa diff`). First definition wins; the later one is dropped loudly.
+            warnings.push(`duplicate rule id "${parsed.id}" in pack "${id}" (first defined in pack "${firstSeen}") — later rule ignored`);
+            return;
+        }
+        seenRuleIds.set(parsed.id, id);
+        rules.push(parsed);
+    });
+    return {
+        id,
+        title: str(raw.title) ?? id,
+        description: str(raw.description),
+        version: str(raw.version),
+        section: str(raw.section),
+        sectionTitle: str(raw.section_title),
+        skipWhen: isMap(raw.skip_when) ? raw.skip_when : undefined,
+        provides: strList(raw.provides),
+        rules,
+    };
+}
+function parseRule(raw, packId, index, warnings) {
+    const where = `${packId}[${index}]`;
+    const head = readRuleHead(raw, where, warnings);
+    if (!head)
+        return null;
+    const { map: r, id, severity } = head;
+    const ruleClass = resolveRuleClass(r, where, id, warnings);
+    const check = parseCheck(r.check, `${where} ${id}`, warnings);
+    if (!check)
+        return null;
+    validatePredicate(r.applies_when, `${where} ${id}`, warnings);
+    return assembleRule(r, id, severity, ruleClass, check);
+}
+function assembleRule(r, id, severity, ruleClass, check) {
+    const depths = Array.isArray(r.depths) ? r.depths.filter(isDepth) : undefined;
+    return {
+        id,
+        title: String(r.title ?? id),
+        section: String(r.section ?? 'S0'),
+        sectionTitle: optText(r.section_title),
+        severity,
+        weight: optNumber(r.weight),
+        ruleClass,
+        appliesWhen: r.applies_when,
+        depths,
+        check,
+        why: optText(r.why),
+        evidence: optText(r.evidence),
+        remediation: optText(r.remediation),
+        references: optStrArray(r.references),
+        tags: optStrArray(r.tags),
+    };
+}
+function optText(v) {
+    return v ? String(v) : undefined;
+}
+function optNumber(v) {
+    return typeof v === 'number' ? v : undefined;
+}
+function optStrArray(v) {
+    return Array.isArray(v) ? v.map(String) : undefined;
+}
+function readRuleHead(raw, where, warnings) {
+    if (!isMap(raw)) {
+        warnings.push(`${where}: rule is not a mapping`);
+        return null;
+    }
+    const id = raw.id ? String(raw.id) : null;
+    if (!id) {
+        warnings.push(`${where}: rule missing "id"`);
+        return null;
+    }
+    const severity = normalizeSeverity(raw.severity);
+    if (!severity) {
+        warnings.push(`${where} ${id}: invalid severity "${String(raw.severity)}"`);
+        return null;
+    }
+    return { map: raw, id, severity };
+}
+function resolveRuleClass(r, where, id, warnings) {
+    const declaredClass = str(r.class);
+    if (declaredClass && !RULE_CLASSES.includes(declaredClass)) {
+        warnings.push(`${where} ${id}: unknown class "${declaredClass}" → maintainability`);
+    }
+    return declaredClass && RULE_CLASSES.includes(declaredClass)
+        ? declaredClass
+        : 'maintainability';
+}
+/** One check kind per entry — adding a kind means adding a line, not a branch. */
+const CHECK_BUILDERS = {
+    manual: () => ({ kind: 'manual' }),
+    info: () => ({ kind: 'info' }),
+    file_exists: (c) => ({ kind: 'file_exists', files: toStringArray(c.files) }),
+    file_absent: (c) => ({ kind: 'file_absent', files: toStringArray(c.files) }),
+    any_file: (c) => ({ kind: 'any_file', patterns: toStringArray(c.patterns ?? c.files) }),
+    grep_present: (c) => grepCheck('grep_present', c),
+    grep_absent: (c) => grepCheck('grep_absent', c),
+    grep_wrong: (c) => grepCheck('grep_wrong', c),
+    grep_deprecated: (c) => grepCheck('grep_deprecated', c),
+    json_path: (c) => ({
+        kind: 'json_path',
+        file: String(c.file ?? ''),
+        path: String(c.path ?? ''),
+        equals: scalar(c.equals) ?? undefined,
+    }),
+    tracked_present: (c) => ({
+        kind: 'tracked_present',
+        patterns: toStringArray(c.patterns ?? c.files),
+    }),
+    tracked_absent: (c) => ({
+        kind: 'tracked_absent',
+        patterns: toStringArray(c.patterns ?? c.files),
+    }),
+    file_lines_max: (c) => ({
+        kind: 'file_lines_max',
+        patterns: toStringArray(c.patterns ?? c.files),
+        max_lines: num(c.max_lines) ?? 800,
+    }),
+    count_min: (c) => ({
+        kind: 'count_min',
+        patterns: toStringArray(c.patterns ?? c.files),
+        min: num(c.min) ?? 1,
+    }),
+    command: (c) => ({
+        kind: 'command',
+        run: str(c.run) ?? '',
+        expect_exit: num(c.expect_exit) ?? 0,
+    }),
+};
+function parseCheck(raw, where, warnings) {
+    const c = asMap(raw);
+    const kind = str(c.kind);
+    if (!kind) {
+        warnings.push(`${where}: check missing "kind"`);
+        return null;
+    }
+    const build = CHECK_BUILDERS[kind];
+    if (!build) {
+        warnings.push(`${where}: unsupported check kind "${String(c.kind)}"`);
+        return null;
+    }
+    const built = build(c);
+    if (built.kind.startsWith('grep_') && 'pattern' in built && built.pattern === '') {
+        // `new RegExp('')` matches every line: a grep_absent rule with a missing
+        // pattern FAILs the whole repo, a grep_present one awards free credit.
+        // A malformed rule must never become a score weapon — drop it loudly.
+        warnings.push(`${where}: ${built.kind} has an empty pattern (matches every line) — rule ignored`);
+        return null;
+    }
+    return built;
+}
+/** Predicate operators the evaluator understands. Anything else fails closed. */
+const PREDICATE_OPS = new Set([
+    'exists',
+    'absent',
+    'eq',
+    'neq',
+    'in',
+    'includes',
+    'gt',
+    'lt',
+    'matches',
+]);
+/**
+ * `applies_when` is author-controlled input to the audit hot loop. An unknown
+ * key, a non-list `all`/`any`, or an uncompilable `matches` regex must warn at
+ * load time, because evaluation fails closed (rule skipped) on all of them.
+ */
+export function validatePredicate(p, where, warnings) {
+    if (p === undefined || p === null)
+        return;
+    if (!isMap(p)) {
+        warnings.push(`${where}: applies_when must be a mapping — constraint ignored, rule skipped`);
+        return;
+    }
+    const keys = Object.keys(p);
+    if (keys.length === 0)
+        return;
+    for (const k of keys) {
+        validatePredicateKey(p, k, where, warnings);
+    }
+}
+function validatePredicateKey(p, k, where, warnings) {
+    if (k === 'all' || k === 'any') {
+        validatePredicateList(p[k], `${where}: applies_when.${k}`, warnings);
+        return;
+    }
+    if (k === 'not') {
+        validatePredicate(p.not, where, warnings);
+        return;
+    }
+    if (k === 'fact') {
+        validateFactPredicate(p, where, warnings);
+        return;
+    }
+    if (k === 'op' || k === 'value') {
+        // `op`/`value` are operands of a sibling `fact` — meaningful only there.
+        if (typeof p.fact !== 'string') {
+            warnings.push(`${where}: "${k}" without a "fact" — ignoring`);
+        }
+        return;
+    }
+    warnings.push(`${where}: unknown applies_when key "${k}" — constraint ignored, rule skipped`);
+}
+function validatePredicateList(v, where, warnings) {
+    const items = list(v);
+    if (!items) {
+        warnings.push(`${where} must be a list — constraint ignored`);
+        return;
+    }
+    for (const item of items)
+        validatePredicate(item, where, warnings);
+}
+function validateFactPredicate(p, where, warnings) {
+    const op = str(p.op) ?? 'exists';
+    if (!PREDICATE_OPS.has(op)) {
+        warnings.push(`${where}: unknown predicate op "${op}" — rule will never apply`);
+        return;
+    }
+    if (op === 'matches' && typeof p.value === 'string') {
+        try {
+            new RegExp(p.value);
+        }
+        catch {
+            warnings.push(`${where}: invalid regex in matches predicate ("${String(p.value)}") — rule will never apply`);
+        }
+    }
+}
+/** The four grep_* kinds share a shape; they differ only in polarity. */
+function grepCheck(kind, c) {
+    return {
+        kind,
+        pattern: str(c.pattern) ?? '',
+        include: toStringArray(c.include),
+        exclude: c.exclude ? toStringArray(c.exclude) : undefined,
+        flags: str(c.flags),
+    };
+}
+function toStringArray(v) {
+    if (Array.isArray(v))
+        return v.map(String);
+    if (typeof v === 'string')
+        return [v];
+    return [];
+}
+function normalizeSeverity(v) {
+    const s = String(v ?? '').toUpperCase();
+    return SEVERITY_LADDER.includes(s) ? s : null;
+}
+function isDepth(v) {
+    return v === 'quick' || v === 'standard' || v === 'deep';
+}
+/** Merge config-driven rule overrides onto loaded packs. */
+export function applyRuleOverrides(packs, overrides) {
+    for (const pack of packs) {
+        for (const rule of pack.rules) {
+            const o = overrides[rule.id];
+            if (!o)
+                continue;
+            if (o.severity)
+                rule.severity = o.severity;
+            if (typeof o.weight === 'number')
+                rule.weight = o.weight;
+        }
+    }
+}
+//# sourceMappingURL=loader.js.map

package/dist/engine/loader.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"loader.js","sourceRoot":"","sources":["../../src/engine/loader.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,KAAK,IAAI,SAAS,EAAE,MAAM,MAAM,CAAC;AAC1C,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,IAAI,EAAE,GAAG,EAAE,MAAM,EAAE,GAAG,EAAE,OAAO,EAAgB,MAAM,iBAAiB,CAAC;AAC9F,OAAO,EAAE,MAAM,SAAS,CAAC;AACzB,OAAO,IAAI,MAAM,WAAW,CAAC;AAG7B,MAAM,CAAC,MAAM,eAAe,GAAe,CAAC,QAAQ,EAAE,KAAK,EAAE,QAAQ,EAAE,MAAM,EAAE,UAAU,CAAC,CAAC;AAC3F,MAAM,CAAC,MAAM,YAAY,GAAgB;IACvC,UAAU;IACV,cAAc;IACd,aAAa;IACb,iBAAiB;IACjB,YAAY;IACZ,aAAa;IACb,YAAY;IACZ,eAAe;IACf,OAAO;CACR,CAAC;AAEF,MAAM,CAAC,MAAM,cAAc,GAA6B;IACtD,QAAQ,EAAE,EAAE;IACZ,IAAI,EAAE,CAAC;IACP,MAAM,EAAE,CAAC;IACT,GAAG,EAAE,GAAG;IACR,MAAM,EAAE,GAAG;CACZ,CAAC;AAOF;;;GAGG;AACH,MAAM,UAAU,YAAY,CAAC,IAAY;IACvC,MAAM,QAAQ,GAAa,EAAE,CAAC;IAC9B,MAAM,IAAI,GAAG,SAAS,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,IAAI,GAAG,EAAE,EAAE,QAAQ,CAAC,CAAC;IAChE,IAAI,IAAI;QAAE,IAAI,CAAC,MAAM,GAAG,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC;IAC5C,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,CAAC;AAC5B,CAAC;AAED,4DAA4D;AAC5D,MAAM,UAAU,aAAa,CAAC,QAAgB;IAC5C,MAAM,QAAQ,GAAa,EAAE,CAAC;IAC9B,MAAM,SAAS,GAAG,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,YAAY,CAAC,CAAC;IACpD,IAAI,CAAC,EAAE,CAAC,UAAU,CAAC,SAAS,CAAC,EAAE,CAAC;QAC9B,MAAM,IAAI,KAAK,CAAC,2BAA2B,SAAS,yCAAyC,CAAC,CAAC;IACjG,CAAC;IACD,IAAI,QAA6E,CAAC;IAClF,IAAI,CAAC;QACH,QAAQ,GAAG,SAAS,CAAC,EAAE,CAAC,YAAY,CAAC,SAAS,EAAE,MAAM,CAAC,CAAoB,CAAC;IAC9E,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,wEAAwE;QACxE,0EAA0E;QAC1E,QAAQ,CAAC,IAAI,CACX,cAAc,SAAS,uBAAwB,GAAa,CAAC,OAAO,qBAAqB,CAC1F,CAAC;QACF,OAAO,EAAE,KAAK,EAAE,EAAE,EAAE,QAAQ,EAAE,CAAC;IACjC,CAAC;IACD,MAAM,OAAO,GAAG,QAAQ,EAAE,KAAK,IAAI,EAAE,CAAC;IAEtC,MAAM,KAAK,GAAe,EAAE,CAAC;IAC7B,MAAM,OAAO,GAAG,IAAI,GAAG,EAAU,CAAC;IAClC,MAAM,WAAW,GAAG,IAAI,GAAG,EAAkB,CAAC;IAE9C,KAAK,MAAM,KAAK,IAAI,OAAO,EAAE,CAAC;QAC5B,iBAAiB,CAAC,KAAK,EAAE,QAAQ,EAAE,KAAK,EAAE,OAAO,EAAE,WAAW,EAAE,QAAQ,CAAC,CAAC;IAC5E,CAAC;IACD,OAAO,EAAE,KAAK,EAAE,QAAQ,EAAE,CAAC;AAC7B,CAAC;AAED,SAAS,iBAAiB,CACxB,KAAmD,EACnD,QAAgB,EAChB,KAAiB,EACjB,OAAoB,EACpB,WAAgC,EAChC,QAAkB;IAElB,MAAM,IAAI,GAAG,OAAO,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC;IAC5D,MAAM,OAAO,GAAG,OAAO,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,KAAK,KAAK,CAAC;IAC3E,IAAI,CAAC,OAAO;QAAE,OAAO;IACrB,MAAM,GAAG,GAAG,IAAI,CAAC,OAAO,CAAC,QAAQ,EAAE,IAAI,CAAC,CAAC;IACzC,IAAI,CAAC,EAAE,CAAC,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC;QACxB,QAAQ,CAAC,IAAI,CAAC,6CAA6C,IAAI,EAAE,CAAC,CAAC;QACnE,OAAO;IACT,CAAC;IACD,MAAM,IAAI,GAAG,SAAS,CAAC,GAAG,EAAE,WAAW,EAAE,QAAQ,CAAC,CAAC;IACnD,IAAI,CAAC,IAAI;QAAE,OAAO;IAClB,IAAI,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC,EAAE,CAAC;QACzB,QAAQ,CAAC,IAAI,CAAC,sBAAsB,IAAI,CAAC,EAAE,MAAM,IAAI,wBAAwB,CAAC,CAAC;QAC/E,OAAO;IACT,CAAC;IACD,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IACrB,IAAI,CAAC,MAAM,GAAG,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,EAAE,GAAG,CAAC,IAAI,IAAI,CAAC;IACjE,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AACnB,CAAC;AAED,SAAS,SAAS,CAChB,IAAY,EACZ,WAAgC,EAChC,QAAkB;IAElB,IAAI,IAAY,CAAC;IACjB,IAAI,CAAC;QACH,IAAI,GAAG,EAAE,CAAC,YAAY,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;IACvC,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,QAAQ,CAAC,IAAI,CAAC,QAAQ,IAAI,uBAAwB,GAAa,CAAC,OAAO,kBAAkB,CAAC,CAAC;QAC3F,OAAO,IAAI,CAAC;IACd,CAAC;IACD,OAAO,aAAa,CAAC,IAAI,EAAE,IAAI,EAAE,WAAW,EAAE,QAAQ,CAAC,CAAC;AAC1D,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,aAAa,CAC3B,IAAY,EACZ,UAAkB,EAClB,cAAmC,IAAI,GAAG,EAAE,EAC5C,WAAqB,EAAE;IAEvB,IAAI,GAAY,CAAC;IACjB,IAAI,CAAC;QACH,GAAG,GAAG,SAAS,CAAC,IAAI,CAAC,CAAC;IACxB,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,mEAAmE;QACnE,QAAQ,CAAC,IAAI,CACX,QAAQ,UAAU,uBAAwB,GAAa,CAAC,OAAO,kBAAkB,CAClF,CAAC;QACF,OAAO,IAAI,CAAC;IACd,CAAC;IACD,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC;QAChB,QAAQ,CAAC,IAAI,CAAC,GAAG,UAAU,sBAAsB,CAAC,CAAC;QACnD,OAAO,IAAI,CAAC;IACd,CAAC;IACD,MAAM,EAAE,GAAG,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC,IAAI,IAAI,CAAC,QAAQ,CAAC,UAAU,EAAE,IAAI,CAAC,OAAO,CAAC,UAAU,CAAC,CAAC,CAAC;IAC9E,MAAM,KAAK,GAAW,EAAE,CAAC;IAEzB,CAAC,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE;QACvC,MAAM,MAAM,GAAG,SAAS,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,EAAE,QAAQ,CAAC,CAAC;QAC7C,IAAI,CAAC,MAAM;YAAE,OAAO;QACpB,MAAM,SAAS,GAAG,WAAW,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;QAC7C,IAAI,SAAS,KAAK,SAAS,EAAE,CAAC;YAC5B,mEAAmE;YACnE,qEAAqE;YACrE,uEAAuE;YACvE,QAAQ,CAAC,IAAI,CACX,sBAAsB,MAAM,CAAC,EAAE,cAAc,EAAE,6BAA6B,SAAS,yBAAyB,CAC/G,CAAC;YACF,OAAO;QACT,CAAC;QACD,WAAW,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC;QAC/B,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;IACrB,CAAC,CAAC,CAAC;IAEH,OAAO;QACL,EAAE;QACF,KAAK,EAAE,GAAG,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,EAAE;QAC3B,WAAW,EAAE,GAAG,CAAC,GAAG,CAAC,WAAW,CAAC;QACjC,OAAO,EAAE,GAAG,CAAC,GAAG,CAAC,OAAO,CAAC;QACzB,OAAO,EAAE,GAAG,CAAC,GAAG,CAAC,OAAO,CAAC;QACzB,YAAY,EAAE,GAAG,CAAC,GAAG,CAAC,aAAa,CAAC;QACpC,QAAQ,EAAE,KAAK,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC,CAAC,CAAE,GAAG,CAAC,SAAkC,CAAC,CAAC,CAAC,SAAS;QACpF,QAAQ,EAAE,OAAO,CAAC,GAAG,CAAC,QAAQ,CAAC;QAC/B,KAAK;KACN,CAAC;AACJ,CAAC;AAED,SAAS,SAAS,CAAC,GAAY,EAAE,MAAc,EAAE,KAAa,EAAE,QAAkB;IAChF,MAAM,KAAK,GAAG,GAAG,MAAM,IAAI,KAAK,GAAG,CAAC;IACpC,MAAM,IAAI,GAAG,YAAY,CAAC,GAAG,EAAE,KAAK,EAAE,QAAQ,CAAC,CAAC;IAChD,IAAI,CAAC,IAAI;QAAE,OAAO,IAAI,CAAC;IACvB,MAAM,EAAE,GAAG,EAAE,CAAC,EAAE,EAAE,EAAE,QAAQ,EAAE,GAAG,IAAI,CAAC;IACtC,MAAM,SAAS,GAAG,gBAAgB,CAAC,CAAC,EAAE,KAAK,EAAE,EAAE,EAAE,QAAQ,CAAC,CAAC;IAC3D,MAAM,KAAK,GAAG,UAAU,CAAC,CAAC,CAAC,KAAK,EAAE,GAAG,KAAK,IAAI,EAAE,EAAE,EAAE,QAAQ,CAAC,CAAC;IAC9D,IAAI,CAAC,KAAK;QAAE,OAAO,IAAI,CAAC;IACxB,iBAAiB,CAAC,CAAC,CAAC,YAAY,EAAE,GAAG,KAAK,IAAI,EAAE,EAAE,EAAE,QAAQ,CAAC,CAAC;IAC9D,OAAO,YAAY,CAAC,CAAC,EAAE,EAAE,EAAE,QAAQ,EAAE,SAAS,EAAE,KAAK,CAAC,CAAC;AACzD,CAAC;AAED,SAAS,YAAY,CACnB,CAAU,EACV,EAAU,EACV,QAAkB,EAClB,SAAoB,EACpB,KAAY;IAEZ,MAAM,MAAM,GAAG,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAE,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,OAAO,CAAa,CAAC,CAAC,CAAC,SAAS,CAAC;IAC3F,OAAO;QACL,EAAE;QACF,KAAK,EAAE,MAAM,CAAC,CAAC,CAAC,KAAK,IAAI,EAAE,CAAC;QAC5B,OAAO,EAAE,MAAM,CAAC,CAAC,CAAC,OAAO,IAAI,IAAI,CAAC;QAClC,YAAY,EAAE,OAAO,CAAC,CAAC,CAAC,aAAa,CAAC;QACtC,QAAQ;QACR,MAAM,EAAE,SAAS,CAAC,CAAC,CAAC,MAAM,CAAC;QAC3B,SAAS;QACT,WAAW,EAAE,CAAC,CAAC,YAAmC;QAClD,MAAM;QACN,KAAK;QACL,GAAG,EAAE,OAAO,CAAC,CAAC,CAAC,GAAG,CAAC;QACnB,QAAQ,EAAE,OAAO,CAAC,CAAC,CAAC,QAAQ,CAAC;QAC7B,WAAW,EAAE,OAAO,CAAC,CAAC,CAAC,WAAW,CAAC;QACnC,UAAU,EAAE,WAAW,CAAC,CAAC,CAAC,UAAU,CAAC;QACrC,IAAI,EAAE,WAAW,CAAC,CAAC,CAAC,IAAI,CAAC;KAC1B,CAAC;AACJ,CAAC;AAED,SAAS,OAAO,CAAC,CAAU;IACzB,OAAO,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;AACnC,CAAC;AAED,SAAS,SAAS,CAAC,CAAU;IAC3B,OAAO,OAAO,CAAC,KAAK,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;AAC/C,CAAC;AAED,SAAS,WAAW,CAAC,CAAU;IAC7B,OAAO,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;AACtD,CAAC;AAED,SAAS,YAAY,CACnB,GAAY,EACZ,KAAa,EACb,QAAkB;IAElB,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC;QAChB,QAAQ,CAAC,IAAI,CAAC,GAAG,KAAK,yBAAyB,CAAC,CAAC;QACjD,OAAO,IAAI,CAAC;IACd,CAAC;IACD,MAAM,EAAE,GAAG,GAAG,CAAC,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;IAC1C,IAAI,CAAC,EAAE,EAAE,CAAC;QACR,QAAQ,CAAC,IAAI,CAAC,GAAG,KAAK,qBAAqB,CAAC,CAAC;QAC7C,OAAO,IAAI,CAAC;IACd,CAAC;IACD,MAAM,QAAQ,GAAG,iBAAiB,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;IACjD,IAAI,CAAC,QAAQ,EAAE,CAAC;QACd,QAAQ,CAAC,IAAI,CAAC,GAAG,KAAK,IAAI,EAAE,uBAAuB,MAAM,CAAC,GAAG,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC;QAC5E,OAAO,IAAI,CAAC;IACd,CAAC;IACD,OAAO,EAAE,GAAG,EAAE,GAAG,EAAE,EAAE,EAAE,QAAQ,EAAE,CAAC;AACpC,CAAC;AAED,SAAS,gBAAgB,CAAC,CAAU,EAAE,KAAa,EAAE,EAAU,EAAE,QAAkB;IACjF,MAAM,aAAa,GAAG,GAAG,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC;IACnC,IAAI,aAAa,IAAI,CAAE,YAAkC,CAAC,QAAQ,CAAC,aAAa,CAAC,EAAE,CAAC;QAClF,QAAQ,CAAC,IAAI,CAAC,GAAG,KAAK,IAAI,EAAE,oBAAoB,aAAa,qBAAqB,CAAC,CAAC;IACtF,CAAC;IACD,OAAO,aAAa,IAAK,YAAkC,CAAC,QAAQ,CAAC,aAAa,CAAC;QACjF,CAAC,CAAE,aAA2B;QAC9B,CAAC,CAAC,iBAAiB,CAAC;AACxB,CAAC;AAED,kFAAkF;AAClF,MAAM,cAAc,GAA0C;IAC5D,MAAM,EAAE,GAAG,EAAE,CAAC,CAAC,EAAE,IAAI,EAAE,QAAQ,EAAE,CAAC;IAClC,IAAI,EAAE,GAAG,EAAE,CAAC,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC;IAC9B,WAAW,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,EAAE,IAAI,EAAE,aAAa,EAAE,KAAK,EAAE,aAAa,CAAC,CAAC,CAAC,KAAK,CAAC,EAAE,CAAC;IAC5E,WAAW,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,EAAE,IAAI,EAAE,aAAa,EAAE,KAAK,EAAE,aAAa,CAAC,CAAC,CAAC,KAAK,CAAC,EAAE,CAAC;IAC5E,QAAQ,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,EAAE,IAAI,EAAE,UAAU,EAAE,QAAQ,EAAE,aAAa,CAAC,CAAC,CAAC,QAAQ,IAAI,CAAC,CAAC,KAAK,CAAC,EAAE,CAAC;IACvF,YAAY,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,SAAS,CAAC,cAAc,EAAE,CAAC,CAAC;IACjD,WAAW,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,SAAS,CAAC,aAAa,EAAE,CAAC,CAAC;IAC/C,UAAU,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,SAAS,CAAC,YAAY,EAAE,CAAC,CAAC;IAC7C,eAAe,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,SAAS,CAAC,iBAAiB,EAAE,CAAC,CAAC;IACvD,SAAS,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;QACjB,IAAI,EAAE,WAAW;QACjB,IAAI,EAAE,MAAM,CAAC,CAAC,CAAC,IAAI,IAAI,EAAE,CAAC;QAC1B,IAAI,EAAE,MAAM,CAAC,CAAC,CAAC,IAAI,IAAI,EAAE,CAAC;QAC1B,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,SAAS;KACtC,CAAC;IACF,eAAe,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;QACvB,IAAI,EAAE,iBAAiB;QACvB,QAAQ,EAAE,aAAa,CAAC,CAAC,CAAC,QAAQ,IAAI,CAAC,CAAC,KAAK,CAAC;KAC/C,CAAC;IACF,cAAc,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;QACtB,IAAI,EAAE,gBAAgB;QACtB,QAAQ,EAAE,aAAa,CAAC,CAAC,CAAC,QAAQ,IAAI,CAAC,CAAC,KAAK,CAAC;KAC/C,CAAC;IACF,cAAc,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;QACtB,IAAI,EAAE,gBAAgB;QACtB,QAAQ,EAAE,aAAa,CAAC,CAAC,CAAC,QAAQ,IAAI,CAAC,CAAC,KAAK,CAAC;QAC9C,SAAS,EAAE,GAAG,CAAC,CAAC,CAAC,SAAS,CAAC,IAAI,GAAG;KACnC,CAAC;IACF,SAAS,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;QACjB,IAAI,EAAE,WAAW;QACjB,QAAQ,EAAE,aAAa,CAAC,CAAC,CAAC,QAAQ,IAAI,CAAC,CAAC,KAAK,CAAC;QAC9C,GAAG,EAAE,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC;KACrB,CAAC;IACF,OAAO,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;QACf,IAAI,EAAE,SAAS;QACf,GAAG,EAAE,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,IAAI,EAAE;QACrB,WAAW,EAAE,GAAG,CAAC,CAAC,CAAC,WAAW,CAAC,IAAI,CAAC;KACrC,CAAC;CACH,CAAC;AAEF,SAAS,UAAU,CAAC,GAAY,EAAE,KAAa,EAAE,QAAkB;IACjE,MAAM,CAAC,GAAG,KAAK,CAAC,GAAG,CAAC,CAAC;IACrB,MAAM,IAAI,GAAG,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;IACzB,IAAI,CAAC,IAAI,EAAE,CAAC;QACV,QAAQ,CAAC,IAAI,CAAC,GAAG,KAAK,wBAAwB,CAAC,CAAC;QAChD,OAAO,IAAI,CAAC;IACd,CAAC;IACD,MAAM,KAAK,GAAG,cAAc,CAAC,IAAI,CAAC,CAAC;IACnC,IAAI,CAAC,KAAK,EAAE,CAAC;QACX,QAAQ,CAAC,IAAI,CAAC,GAAG,KAAK,6BAA6B,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QACtE,OAAO,IAAI,CAAC;IACd,CAAC;IACD,MAAM,KAAK,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC;IACvB,IAAI,KAAK,CAAC,IAAI,CAAC,UAAU,CAAC,OAAO,CAAC,IAAI,SAAS,IAAI,KAAK,IAAI,KAAK,CAAC,OAAO,KAAK,EAAE,EAAE,CAAC;QACjF,yEAAyE;QACzE,uEAAuE;QACvE,sEAAsE;QACtE,QAAQ,CAAC,IAAI,CACX,GAAG,KAAK,KAAK,KAAK,CAAC,IAAI,2DAA2D,CACnF,CAAC;QACF,OAAO,IAAI,CAAC;IACd,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED,iFAAiF;AACjF,MAAM,aAAa,GAAG,IAAI,GAAG,CAAC;IAC5B,QAAQ;IACR,QAAQ;IACR,IAAI;IACJ,KAAK;IACL,IAAI;IACJ,UAAU;IACV,IAAI;IACJ,IAAI;IACJ,SAAS;CACV,CAAC,CAAC;AAEH;;;;GAIG;AACH,MAAM,UAAU,iBAAiB,CAAC,CAAU,EAAE,KAAa,EAAE,QAAkB;IAC7E,IAAI,CAAC,KAAK,SAAS,IAAI,CAAC,KAAK,IAAI;QAAE,OAAO;IAC1C,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC;QACd,QAAQ,CAAC,IAAI,CAAC,GAAG,KAAK,qEAAqE,CAAC,CAAC;QAC7F,OAAO;IACT,CAAC;IACD,MAAM,IAAI,GAAG,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAC5B,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO;IAC9B,KAAK,MAAM,CAAC,IAAI,IAAI,EAAE,CAAC;QACrB,oBAAoB,CAAC,CAAC,EAAE,CAAC,EAAE,KAAK,EAAE,QAAQ,CAAC,CAAC;IAC9C,CAAC;AACH,CAAC;AAED,SAAS,oBAAoB,CAAC,CAAU,EAAE,CAAS,EAAE,KAAa,EAAE,QAAkB;IACpF,IAAI,CAAC,KAAK,KAAK,IAAI,CAAC,KAAK,KAAK,EAAE,CAAC;QAC/B,qBAAqB,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,GAAG,KAAK,kBAAkB,CAAC,EAAE,EAAE,QAAQ,CAAC,CAAC;QACrE,OAAO;IACT,CAAC;IACD,IAAI,CAAC,KAAK,KAAK,EAAE,CAAC;QAChB,iBAAiB,CAAC,CAAC,CAAC,GAAG,EAAE,KAAK,EAAE,QAAQ,CAAC,CAAC;QAC1C,OAAO;IACT,CAAC;IACD,IAAI,CAAC,KAAK,MAAM,EAAE,CAAC;QACjB,qBAAqB,CAAC,CAAC,EAAE,KAAK,EAAE,QAAQ,CAAC,CAAC;QAC1C,OAAO;IACT,CAAC;IACD,IAAI,CAAC,KAAK,IAAI,IAAI,CAAC,KAAK,OAAO,EAAE,CAAC;QAChC,yEAAyE;QACzE,IAAI,OAAO,CAAC,CAAC,IAAI,KAAK,QAAQ,EAAE,CAAC;YAC/B,QAAQ,CAAC,IAAI,CAAC,GAAG,KAAK,MAAM,CAAC,+BAA+B,CAAC,CAAC;QAChE,CAAC;QACD,OAAO;IACT,CAAC;IACD,QAAQ,CAAC,IAAI,CAAC,GAAG,KAAK,+BAA+B,CAAC,sCAAsC,CAAC,CAAC;AAChG,CAAC;AAED,SAAS,qBAAqB,CAAC,CAAU,EAAE,KAAa,EAAE,QAAkB;IAC1E,MAAM,KAAK,GAAG,IAAI,CAAC,CAAC,CAAC,CAAC;IACtB,IAAI,CAAC,KAAK,EAAE,CAAC;QACX,QAAQ,CAAC,IAAI,CAAC,GAAG,KAAK,sCAAsC,CAAC,CAAC;QAC9D,OAAO;IACT,CAAC;IACD,KAAK,MAAM,IAAI,IAAI,KAAK;QAAE,iBAAiB,CAAC,IAAI,EAAE,KAAK,EAAE,QAAQ,CAAC,CAAC;AACrE,CAAC;AAED,SAAS,qBAAqB,CAAC,CAAU,EAAE,KAAa,EAAE,QAAkB;IAC1E,MAAM,EAAE,GAAG,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,IAAI,QAAQ,CAAC;IACjC,IAAI,CAAC,aAAa,CAAC,GAAG,CAAC,EAAE,CAAC,EAAE,CAAC;QAC3B,QAAQ,CAAC,IAAI,CAAC,GAAG,KAAK,2BAA2B,EAAE,2BAA2B,CAAC,CAAC;QAChF,OAAO;IACT,CAAC;IACD,IAAI,EAAE,KAAK,SAAS,IAAI,OAAO,CAAC,CAAC,KAAK,KAAK,QAAQ,EAAE,CAAC;QACpD,IAAI,CAAC;YACH,IAAI,MAAM,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC;QACtB,CAAC;QAAC,MAAM,CAAC;YACP,QAAQ,CAAC,IAAI,CACX,GAAG,KAAK,0CAA0C,MAAM,CAAC,CAAC,CAAC,KAAK,CAAC,4BAA4B,CAC9F,CAAC;QACJ,CAAC;IACH,CAAC;AACH,CAAC;AAED,yEAAyE;AACzE,SAAS,SAAS,CAChB,IAAuE,EACvE,CAAU;IAEV,OAAO;QACL,IAAI;QACJ,OAAO,EAAE,GAAG,CAAC,CAAC,CAAC,OAAO,CAAC,IAAI,EAAE;QAC7B,OAAO,EAAE,aAAa,CAAC,CAAC,CAAC,OAAO,CAAC;QACjC,OAAO,EAAE,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,aAAa,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,SAAS;QACzD,KAAK,EAAE,GAAG,CAAC,CAAC,CAAC,KAAK,CAAC;KACpB,CAAC;AACJ,CAAC;AAED,SAAS,aAAa,CAAC,CAAU;IAC/B,IAAI,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC;QAAE,OAAO,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;IAC3C,IAAI,OAAO,CAAC,KAAK,QAAQ;QAAE,OAAO,CAAC,CAAC,CAAC,CAAC;IACtC,OAAO,EAAE,CAAC;AACZ,CAAC;AAED,SAAS,iBAAiB,CAAC,CAAU;IACnC,MAAM,CAAC,GAAG,MAAM,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,WAAW,EAAE,CAAC;IACxC,OAAQ,eAA4B,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,CAAE,CAAc,CAAC,CAAC,CAAC,IAAI,CAAC;AAC5E,CAAC;AAED,SAAS,OAAO,CAAC,CAAU;IACzB,OAAO,CAAC,KAAK,OAAO,IAAI,CAAC,KAAK,UAAU,IAAI,CAAC,KAAK,MAAM,CAAC;AAC3D,CAAC;AAED,4DAA4D;AAC5D,MAAM,UAAU,kBAAkB,CAChC,KAAiB,EACjB,SAAmE;IAEnE,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;QACzB,KAAK,MAAM,IAAI,IAAI,IAAI,CAAC,KAAK,EAAE,CAAC;YAC9B,MAAM,CAAC,GAAG,SAAS,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;YAC7B,IAAI,CAAC,CAAC;gBAAE,SAAS;YACjB,IAAI,CAAC,CAAC,QAAQ;gBAAE,IAAI,CAAC,QAAQ,GAAG,CAAC,CAAC,QAAQ,CAAC;YAC3C,IAAI,OAAO,CAAC,CAAC,MAAM,KAAK,QAAQ;gBAAE,IAAI,CAAC,MAAM,GAAG,CAAC,CAAC,MAAM,CAAC;QAC3D,CAAC;IACH,CAAC;AACH,CAAC"}

package/dist/engine/maturity.d.ts

@@ -0,0 +1,20 @@
+import type { Maturity, RuleClass, Severity } from '../types.js';
+export interface MaturityProfile {
+    key: Maturity;
+    label: string;
+    summary: string;
+    dampen: Record<RuleClass, number>;
+    expectedBand: [number, number];
+    focus: string[];
+    defer: string[];
+}
+export declare function loadProfiles(rulesDir: string): Record<Maturity, MaturityProfile>;
+/**
+ * Apply the maturity profile to a rule's declared severity.
+ * CRITICAL is never dampened — see the hard rule in profiles/maturity.yaml.
+ */
+export declare function dampen(severity: Severity, ruleClass: RuleClass, profile: MaturityProfile): {
+    severity: Severity;
+    dampened: boolean;
+};
+//# sourceMappingURL=maturity.d.ts.map

package/dist/engine/maturity.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"maturity.d.ts","sourceRoot":"","sources":["../../src/engine/maturity.ts"],"names":[],"mappings":"AAIA,OAAO,KAAK,EAAE,QAAQ,EAAE,SAAS,EAAE,QAAQ,EAAE,MAAM,aAAa,CAAC;AAEjE,MAAM,WAAW,eAAe;IAC9B,GAAG,EAAE,QAAQ,CAAC;IACd,KAAK,EAAE,MAAM,CAAC;IACd,OAAO,EAAE,MAAM,CAAC;IAChB,MAAM,EAAE,MAAM,CAAC,SAAS,EAAE,MAAM,CAAC,CAAC;IAClC,YAAY,EAAE,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAC/B,KAAK,EAAE,MAAM,EAAE,CAAC;IAChB,KAAK,EAAE,MAAM,EAAE,CAAC;CACjB;AA+GD,wBAAgB,YAAY,CAAC,QAAQ,EAAE,MAAM,GAAG,MAAM,CAAC,QAAQ,EAAE,eAAe,CAAC,CAwBhF;AAED;;;GAGG;AACH,wBAAgB,MAAM,CACpB,QAAQ,EAAE,QAAQ,EAClB,SAAS,EAAE,SAAS,EACpB,OAAO,EAAE,eAAe,GACvB;IAAE,QAAQ,EAAE,QAAQ,CAAC;IAAC,QAAQ,EAAE,OAAO,CAAA;CAAE,CAU3C"}

package/dist/engine/maturity.js

@@ -0,0 +1,157 @@
+import { parse as parseYaml } from 'yaml';
+import { asMap, list, num, str, strList } from '../util/yaml.js';
+import fs from 'node:fs';
+import path from 'node:path';
+const LADDER = ['FUTURE', 'LOW', 'MEDIUM', 'HIGH', 'CRITICAL'];
+const FALLBACK = {
+    prototype: {
+        key: 'prototype',
+        label: 'Prototype / Spike',
+        summary: 'Proving an idea.',
+        dampen: {
+            security: 1,
+            'supply-chain': 1,
+            correctness: 1,
+            maintainability: 2,
+            operations: 2,
+            performance: 2,
+            compliance: 2,
+            documentation: 2,
+            style: 2,
+        },
+        expectedBand: [30, 65],
+        focus: [],
+        defer: [],
+    },
+    mvp: {
+        key: 'mvp',
+        label: 'MVP / Early product',
+        summary: 'Real users, real data.',
+        dampen: {
+            security: 0,
+            'supply-chain': 1,
+            correctness: 1,
+            maintainability: 1,
+            operations: 1,
+            performance: 1,
+            compliance: 1,
+            documentation: 2,
+            style: 2,
+        },
+        expectedBand: [45, 75],
+        focus: [],
+        defer: [],
+    },
+    beta: {
+        key: 'beta',
+        label: 'Beta / Growing',
+        summary: 'Scaling users and contributors.',
+        dampen: {
+            security: 0,
+            'supply-chain': 0,
+            correctness: 0,
+            maintainability: 1,
+            operations: 1,
+            performance: 1,
+            compliance: 1,
+            documentation: 1,
+            style: 1,
+        },
+        expectedBand: [60, 85],
+        focus: [],
+        defer: [],
+    },
+    production: {
+        key: 'production',
+        label: 'Production / GA',
+        summary: 'Full bar.',
+        dampen: {
+            security: 0,
+            'supply-chain': 0,
+            correctness: 0,
+            maintainability: 0,
+            operations: 0,
+            performance: 0,
+            compliance: 0,
+            documentation: 0,
+            style: 0,
+        },
+        expectedBand: [75, 95],
+        focus: [],
+        defer: [],
+    },
+    legacy: {
+        key: 'legacy',
+        label: 'Legacy / Maintenance',
+        summary: 'Contain risk, plan exit.',
+        dampen: {
+            security: 0,
+            'supply-chain': 0,
+            correctness: 0,
+            maintainability: 1,
+            operations: 0,
+            performance: 1,
+            compliance: 0,
+            documentation: 1,
+            style: 1,
+        },
+        expectedBand: [40, 70],
+        focus: [],
+        defer: [],
+    },
+};
+/** `[min, max]` if the pack wrote a two-number band, else the built-in. */
+function expectedBand(v, fallback) {
+    const band = list(v);
+    if (!band || band.length < 2)
+        return fallback;
+    const min = num(band[0]);
+    const max = num(band[1]);
+    return min !== undefined && max !== undefined ? [min, max] : fallback;
+}
+export function loadProfiles(rulesDir) {
+    const file = path.join(rulesDir, 'profiles', 'maturity.yaml');
+    if (!fs.existsSync(file))
+        return { ...FALLBACK };
+    try {
+        const doc = asMap(parseYaml(fs.readFileSync(file, 'utf8')));
+        const profiles = asMap(doc.profiles);
+        const out = { ...FALLBACK };
+        for (const key of Object.keys(FALLBACK)) {
+            const p = asMap(profiles[key]);
+            if (!profiles[key])
+                continue;
+            out[key] = {
+                key,
+                label: str(p.label) ?? FALLBACK[key].label,
+                summary: (str(p.summary) ?? '').trim(),
+                dampen: { ...FALLBACK[key].dampen, ...asMap(p.dampen) },
+                expectedBand: expectedBand(p.expected_band, FALLBACK[key].expectedBand),
+                focus: strList(p.focus) ?? [],
+                defer: strList(p.defer) ?? [],
+            };
+        }
+        return out;
+    }
+    catch {
+        return { ...FALLBACK };
+    }
+}
+/**
+ * Apply the maturity profile to a rule's declared severity.
+ * CRITICAL is never dampened — see the hard rule in profiles/maturity.yaml.
+ */
+export function dampen(severity, ruleClass, profile) {
+    if (severity === 'CRITICAL')
+        return { severity, dampened: false };
+    const raw = profile.dampen[ruleClass] ?? 0;
+    // Pack-supplied dampen steps are untrusted input: a fractional step indexes
+    // the ladder at a hole (severity: undefined → NaN scores downstream), so
+    // only non-negative integers dampen. Anything else means full severity.
+    if (!Number.isInteger(raw) || raw <= 0)
+        return { severity, dampened: false };
+    const idx = LADDER.indexOf(severity);
+    const next = Math.max(0, idx - raw);
+    return { severity: LADDER[next], dampened: next !== idx };
+}
+//# sourceMappingURL=maturity.js.map

package/dist/engine/maturity.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"maturity.js","sourceRoot":"","sources":["../../src/engine/maturity.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,KAAK,IAAI,SAAS,EAAE,MAAM,MAAM,CAAC;AAC1C,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,GAAG,EAAE,GAAG,EAAE,OAAO,EAAE,MAAM,iBAAiB,CAAC;AACjE,OAAO,EAAE,MAAM,SAAS,CAAC;AACzB,OAAO,IAAI,MAAM,WAAW,CAAC;AAa7B,MAAM,MAAM,GAAe,CAAC,QAAQ,EAAE,KAAK,EAAE,QAAQ,EAAE,MAAM,EAAE,UAAU,CAAC,CAAC;AAE3E,MAAM,QAAQ,GAAsC;IAClD,SAAS,EAAE;QACT,GAAG,EAAE,WAAW;QAChB,KAAK,EAAE,mBAAmB;QAC1B,OAAO,EAAE,kBAAkB;QAC3B,MAAM,EAAE;YACN,QAAQ,EAAE,CAAC;YACX,cAAc,EAAE,CAAC;YACjB,WAAW,EAAE,CAAC;YACd,eAAe,EAAE,CAAC;YAClB,UAAU,EAAE,CAAC;YACb,WAAW,EAAE,CAAC;YACd,UAAU,EAAE,CAAC;YACb,aAAa,EAAE,CAAC;YAChB,KAAK,EAAE,CAAC;SACT;QACD,YAAY,EAAE,CAAC,EAAE,EAAE,EAAE,CAAC;QACtB,KAAK,EAAE,EAAE;QACT,KAAK,EAAE,EAAE;KACV;IACD,GAAG,EAAE;QACH,GAAG,EAAE,KAAK;QACV,KAAK,EAAE,qBAAqB;QAC5B,OAAO,EAAE,wBAAwB;QACjC,MAAM,EAAE;YACN,QAAQ,EAAE,CAAC;YACX,cAAc,EAAE,CAAC;YACjB,WAAW,EAAE,CAAC;YACd,eAAe,EAAE,CAAC;YAClB,UAAU,EAAE,CAAC;YACb,WAAW,EAAE,CAAC;YACd,UAAU,EAAE,CAAC;YACb,aAAa,EAAE,CAAC;YAChB,KAAK,EAAE,CAAC;SACT;QACD,YAAY,EAAE,CAAC,EAAE,EAAE,EAAE,CAAC;QACtB,KAAK,EAAE,EAAE;QACT,KAAK,EAAE,EAAE;KACV;IACD,IAAI,EAAE;QACJ,GAAG,EAAE,MAAM;QACX,KAAK,EAAE,gBAAgB;QACvB,OAAO,EAAE,iCAAiC;QAC1C,MAAM,EAAE;YACN,QAAQ,EAAE,CAAC;YACX,cAAc,EAAE,CAAC;YACjB,WAAW,EAAE,CAAC;YACd,eAAe,EAAE,CAAC;YAClB,UAAU,EAAE,CAAC;YACb,WAAW,EAAE,CAAC;YACd,UAAU,EAAE,CAAC;YACb,aAAa,EAAE,CAAC;YAChB,KAAK,EAAE,CAAC;SACT;QACD,YAAY,EAAE,CAAC,EAAE,EAAE,EAAE,CAAC;QACtB,KAAK,EAAE,EAAE;QACT,KAAK,EAAE,EAAE;KACV;IACD,UAAU,EAAE;QACV,GAAG,EAAE,YAAY;QACjB,KAAK,EAAE,iBAAiB;QACxB,OAAO,EAAE,WAAW;QACpB,MAAM,EAAE;YACN,QAAQ,EAAE,CAAC;YACX,cAAc,EAAE,CAAC;YACjB,WAAW,EAAE,CAAC;YACd,eAAe,EAAE,CAAC;YAClB,UAAU,EAAE,CAAC;YACb,WAAW,EAAE,CAAC;YACd,UAAU,EAAE,CAAC;YACb,aAAa,EAAE,CAAC;YAChB,KAAK,EAAE,CAAC;SACT;QACD,YAAY,EAAE,CAAC,EAAE,EAAE,EAAE,CAAC;QACtB,KAAK,EAAE,EAAE;QACT,KAAK,EAAE,EAAE;KACV;IACD,MAAM,EAAE;QACN,GAAG,EAAE,QAAQ;QACb,KAAK,EAAE,sBAAsB;QAC7B,OAAO,EAAE,0BAA0B;QACnC,MAAM,EAAE;YACN,QAAQ,EAAE,CAAC;YACX,cAAc,EAAE,CAAC;YACjB,WAAW,EAAE,CAAC;YACd,eAAe,EAAE,CAAC;YAClB,UAAU,EAAE,CAAC;YACb,WAAW,EAAE,CAAC;YACd,UAAU,EAAE,CAAC;YACb,aAAa,EAAE,CAAC;YAChB,KAAK,EAAE,CAAC;SACT;QACD,YAAY,EAAE,CAAC,EAAE,EAAE,EAAE,CAAC;QACtB,KAAK,EAAE,EAAE;QACT,KAAK,EAAE,EAAE;KACV;CACF,CAAC;AAEF,2EAA2E;AAC3E,SAAS,YAAY,CAAC,CAAU,EAAE,QAA0B;IAC1D,MAAM,IAAI,GAAG,IAAI,CAAC,CAAC,CAAC,CAAC;IACrB,IAAI,CAAC,IAAI,IAAI,IAAI,CAAC,MAAM,GAAG,CAAC;QAAE,OAAO,QAAQ,CAAC;IAC9C,MAAM,GAAG,GAAG,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC;IACzB,MAAM,GAAG,GAAG,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC;IACzB,OAAO,GAAG,KAAK,SAAS,IAAI,GAAG,KAAK,SAAS,CAAC,CAAC,CAAC,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC;AACxE,CAAC;AAED,MAAM,UAAU,YAAY,CAAC,QAAgB;IAC3C,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,UAAU,EAAE,eAAe,CAAC,CAAC;IAC9D,IAAI,CAAC,EAAE,CAAC,UAAU,CAAC,IAAI,CAAC;QAAE,OAAO,EAAE,GAAG,QAAQ,EAAE,CAAC;IACjD,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,KAAK,CAAC,SAAS,CAAC,EAAE,CAAC,YAAY,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC,CAAC,CAAC;QAC5D,MAAM,QAAQ,GAAG,KAAK,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;QACrC,MAAM,GAAG,GAAG,EAAE,GAAG,QAAQ,EAAE,CAAC;QAC5B,KAAK,MAAM,GAAG,IAAI,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAe,EAAE,CAAC;YACtD,MAAM,CAAC,GAAG,KAAK,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC;YAC/B,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC;gBAAE,SAAS;YAC7B,GAAG,CAAC,GAAG,CAAC,GAAG;gBACT,GAAG;gBACH,KAAK,EAAE,GAAG,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,QAAQ,CAAC,GAAG,CAAC,CAAC,KAAK;gBAC1C,OAAO,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,OAAO,CAAC,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE;gBACtC,MAAM,EAAE,EAAE,GAAG,QAAQ,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,GAAG,KAAK,CAAC,CAAC,CAAC,MAAM,CAAC,EAAE;gBACvD,YAAY,EAAE,YAAY,CAAC,CAAC,CAAC,aAAa,EAAE,QAAQ,CAAC,GAAG,CAAC,CAAC,YAAY,CAAC;gBACvE,KAAK,EAAE,OAAO,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,EAAE;gBAC7B,KAAK,EAAE,OAAO,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,EAAE;aAC9B,CAAC;QACJ,CAAC;QACD,OAAO,GAAG,CAAC;IACb,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,EAAE,GAAG,QAAQ,EAAE,CAAC;IACzB,CAAC;AACH,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,MAAM,CACpB,QAAkB,EAClB,SAAoB,EACpB,OAAwB;IAExB,IAAI,QAAQ,KAAK,UAAU;QAAE,OAAO,EAAE,QAAQ,EAAE,QAAQ,EAAE,KAAK,EAAE,CAAC;IAClE,MAAM,GAAG,GAAG,OAAO,CAAC,MAAM,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC;IAC3C,4EAA4E;IAC5E,yEAAyE;IACzE,wEAAwE;IACxE,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,GAAG,CAAC,IAAI,GAAG,IAAI,CAAC;QAAE,OAAO,EAAE,QAAQ,EAAE,QAAQ,EAAE,KAAK,EAAE,CAAC;IAC7E,MAAM,GAAG,GAAG,MAAM,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC;IACrC,MAAM,IAAI,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,GAAG,GAAG,GAAG,CAAC,CAAC;IACpC,OAAO,EAAE,QAAQ,EAAE,MAAM,CAAC,IAAI,CAAE,EAAE,QAAQ,EAAE,IAAI,KAAK,GAAG,EAAE,CAAC;AAC7D,CAAC"}

package/dist/engine/score.d.ts

@@ -0,0 +1,19 @@
+import type { Finding, Rule, ScoreCard } from '../types.js';
+import type { SectionDef } from './sections.js';
+import type { MaturityProfile } from './maturity.js';
+export interface ScoredRule {
+    rule: Rule;
+    finding: Finding;
+}
+/**
+ * Deterministic, reproducible scoring.
+ *
+ *   credit_i   = weight_i × CREDIT[status_i]
+ *   section    = 10 × Σcredit_i / Σweight_i        (resolved applicable rules)
+ *   overall    = 100 × Σ(credit_i × sectionWeight) / Σ(weight_i × sectionWeight)
+ *
+ * Rule-level weighting (rather than averaging section scores) means a section
+ * with three rules cannot swing the total as hard as one with thirty.
+ */
+export declare function score(evaluated: ScoredRule[], sections: SectionDef[], profile: MaturityProfile): ScoreCard;
+//# sourceMappingURL=score.d.ts.map

package/dist/engine/score.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"score.d.ts","sourceRoot":"","sources":["../../src/engine/score.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,OAAO,EAAE,IAAI,EAAE,SAAS,EAAkC,MAAM,aAAa,CAAC;AAE5F,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,eAAe,CAAC;AAChD,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,eAAe,CAAC;AAErD,MAAM,WAAW,UAAU;IACzB,IAAI,EAAE,IAAI,CAAC;IACX,OAAO,EAAE,OAAO,CAAC;CAClB;AAkCD;;;;;;;;;GASG;AACH,wBAAgB,KAAK,CACnB,SAAS,EAAE,UAAU,EAAE,EACvB,QAAQ,EAAE,UAAU,EAAE,EACtB,OAAO,EAAE,eAAe,GACvB,SAAS,CAgCX"}