@xenos1996/usa 2.0.0

package/dist/engine/score.js

@@ -0,0 +1,141 @@
+import { ruleWeight } from './evaluate.js';
+/** How much credit a rule earns for a given outcome. */
+const CREDIT = {
+    PASS: 1,
+    EXPERIMENTAL: 0.5,
+    DEPRECATED: 0.4,
+    WRONG: 0.15,
+    MISSING: 0,
+    FAIL: 0,
+    // Not counted: unresolved judgement or deliberately skipped.
+    UNKNOWN: 0,
+    NOT_APPLICABLE: 0,
+};
+const EMPTY_COUNTS = () => ({
+    PASS: 0,
+    FAIL: 0,
+    WRONG: 0,
+    MISSING: 0,
+    DEPRECATED: 0,
+    EXPERIMENTAL: 0,
+    UNKNOWN: 0,
+    NOT_APPLICABLE: 0,
+});
+const EMPTY_SEVERITY = () => ({
+    CRITICAL: 0,
+    HIGH: 0,
+    MEDIUM: 0,
+    LOW: 0,
+    FUTURE: 0,
+});
+/**
+ * Deterministic, reproducible scoring.
+ *
+ *   credit_i   = weight_i × CREDIT[status_i]
+ *   section    = 10 × Σcredit_i / Σweight_i        (resolved applicable rules)
+ *   overall    = 100 × Σ(credit_i × sectionWeight) / Σ(weight_i × sectionWeight)
+ *
+ * Rule-level weighting (rather than averaging section scores) means a section
+ * with three rules cannot swing the total as hard as one with thirty.
+ */
+export function score(evaluated, sections, profile) {
+    const counts = EMPTY_COUNTS();
+    const severityCounts = EMPTY_SEVERITY();
+    const sectionMap = new Map(sections.map((s) => [s.id, s]));
+    const acc = {
+        bySection: new Map(),
+        counts,
+        severityCounts,
+        totalW: 0,
+        totalCredit: 0,
+        applicableAll: 0,
+        resolvedAll: 0,
+    };
+    for (const { rule, finding } of evaluated) {
+        accumulateScoredRule(acc, sectionMap, rule, finding);
+    }
+    const sectionScores = sections
+        .filter((s) => acc.bySection.has(s.id))
+        .map((s) => buildSectionScore(s, acc.bySection.get(s.id)));
+    return {
+        overall: acc.totalW > 0 ? round1((100 * acc.totalCredit) / acc.totalW) : 0,
+        sections: sectionScores,
+        counts,
+        severityCounts,
+        automationCoverage: acc.applicableAll > 0 ? round1((100 * acc.resolvedAll) / acc.applicableAll) : 0,
+        expectedBand: profile.expectedBand,
+    };
+}
+function emptyBucket() {
+    return { w: 0, credit: 0, applicable: 0, resolved: 0, passed: 0, failed: 0, unknown: 0 };
+}
+function bucketFor(bySection, id) {
+    let bucket = bySection.get(id);
+    if (!bucket) {
+        bucket = emptyBucket();
+        bySection.set(id, bucket);
+    }
+    return bucket;
+}
+function accumulateScoredRule(acc, sectionMap, rule, finding) {
+    if (finding.status === 'NOT_APPLICABLE')
+        return;
+    const sec = sectionMap.get(finding.section) ?? {
+        id: finding.section,
+        title: finding.sectionTitle,
+        weight: 1,
+    };
+    const bucket = bucketFor(acc.bySection, sec.id);
+    bucket.applicable++;
+    acc.applicableAll++;
+    // Suppressed findings live under Accepted Risk only: counting them as open
+    // once produced "HIGH: 1" next to "No CRITICAL or HIGH findings. Nice."
+    // in the same report. Unsuppressed UNKNOWN still counts — the report
+    // narrative ("N checks need a human") is driven by counts.UNKNOWN.
+    if (finding.suppressedReason) {
+        if (finding.status === 'UNKNOWN')
+            bucket.unknown++;
+        return;
+    }
+    acc.counts[finding.status]++;
+    if (finding.status !== 'PASS' && finding.status !== 'UNKNOWN') {
+        acc.severityCounts[finding.severity]++;
+    }
+    if (finding.status === 'UNKNOWN') {
+        bucket.unknown++;
+        return;
+    }
+    applyRuleCredit(acc, bucket, rule, finding, sec.weight);
+}
+function applyRuleCredit(acc, bucket, rule, finding, sectionWeight) {
+    const w = ruleWeight(rule) * sectionWeight;
+    const credit = w * CREDIT[finding.status];
+    bucket.w += w;
+    bucket.credit += credit;
+    bucket.resolved++;
+    acc.resolvedAll++;
+    if (finding.status === 'PASS')
+        bucket.passed++;
+    else
+        bucket.failed++;
+    acc.totalW += w;
+    acc.totalCredit += credit;
+}
+function buildSectionScore(s, b) {
+    return {
+        id: s.id,
+        title: s.title,
+        score: b.w > 0 ? round1((10 * b.credit) / b.w) : null,
+        weight: s.weight,
+        applicable: b.applicable,
+        resolved: b.resolved,
+        passed: b.passed,
+        failed: b.failed,
+        unknown: b.unknown,
+        confidence: b.applicable > 0 ? round1((100 * b.resolved) / b.applicable) : 100,
+    };
+}
+function round1(n) {
+    return Math.round(n * 10) / 10;
+}
+//# sourceMappingURL=score.js.map

package/dist/engine/score.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"score.js","sourceRoot":"","sources":["../../src/engine/score.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,UAAU,EAAE,MAAM,eAAe,CAAC;AAS3C,wDAAwD;AACxD,MAAM,MAAM,GAA2B;IACrC,IAAI,EAAE,CAAC;IACP,YAAY,EAAE,GAAG;IACjB,UAAU,EAAE,GAAG;IACf,KAAK,EAAE,IAAI;IACX,OAAO,EAAE,CAAC;IACV,IAAI,EAAE,CAAC;IACP,6DAA6D;IAC7D,OAAO,EAAE,CAAC;IACV,cAAc,EAAE,CAAC;CAClB,CAAC;AAEF,MAAM,YAAY,GAAG,GAA2B,EAAE,CAAC,CAAC;IAClD,IAAI,EAAE,CAAC;IACP,IAAI,EAAE,CAAC;IACP,KAAK,EAAE,CAAC;IACR,OAAO,EAAE,CAAC;IACV,UAAU,EAAE,CAAC;IACb,YAAY,EAAE,CAAC;IACf,OAAO,EAAE,CAAC;IACV,cAAc,EAAE,CAAC;CAClB,CAAC,CAAC;AAEH,MAAM,cAAc,GAAG,GAA6B,EAAE,CAAC,CAAC;IACtD,QAAQ,EAAE,CAAC;IACX,IAAI,EAAE,CAAC;IACP,MAAM,EAAE,CAAC;IACT,GAAG,EAAE,CAAC;IACN,MAAM,EAAE,CAAC;CACV,CAAC,CAAC;AAEH;;;;;;;;;GASG;AACH,MAAM,UAAU,KAAK,CACnB,SAAuB,EACvB,QAAsB,EACtB,OAAwB;IAExB,MAAM,MAAM,GAAG,YAAY,EAAE,CAAC;IAC9B,MAAM,cAAc,GAAG,cAAc,EAAE,CAAC;IACxC,MAAM,UAAU,GAAG,IAAI,GAAG,CAAqB,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC;IAE/E,MAAM,GAAG,GAAe;QACtB,SAAS,EAAE,IAAI,GAAG,EAAE;QACpB,MAAM;QACN,cAAc;QACd,MAAM,EAAE,CAAC;QACT,WAAW,EAAE,CAAC;QACd,aAAa,EAAE,CAAC;QAChB,WAAW,EAAE,CAAC;KACf,CAAC;IAEF,KAAK,MAAM,EAAE,IAAI,EAAE,OAAO,EAAE,IAAI,SAAS,EAAE,CAAC;QAC1C,oBAAoB,CAAC,GAAG,EAAE,UAAU,EAAE,IAAI,EAAE,OAAO,CAAC,CAAC;IACvD,CAAC;IAED,MAAM,aAAa,GAAmB,QAAQ;SAC3C,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,GAAG,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;SACtC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,iBAAiB,CAAC,CAAC,EAAE,GAAG,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAE,CAAC,CAAC,CAAC;IAE9D,OAAO;QACL,OAAO,EAAE,GAAG,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,GAAG,GAAG,GAAG,CAAC,WAAW,CAAC,GAAG,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC;QAC1E,QAAQ,EAAE,aAAa;QACvB,MAAM;QACN,cAAc;QACd,kBAAkB,EAChB,GAAG,CAAC,aAAa,GAAG,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,GAAG,GAAG,GAAG,CAAC,WAAW,CAAC,GAAG,GAAG,CAAC,aAAa,CAAC,CAAC,CAAC,CAAC,CAAC;QACjF,YAAY,EAAE,OAAO,CAAC,YAAY;KACnC,CAAC;AACJ,CAAC;AAsBD,SAAS,WAAW;IAClB,OAAO,EAAE,CAAC,EAAE,CAAC,EAAE,MAAM,EAAE,CAAC,EAAE,UAAU,EAAE,CAAC,EAAE,QAAQ,EAAE,CAAC,EAAE,MAAM,EAAE,CAAC,EAAE,MAAM,EAAE,CAAC,EAAE,OAAO,EAAE,CAAC,EAAE,CAAC;AAC3F,CAAC;AAED,SAAS,SAAS,CAAC,SAAqC,EAAE,EAAU;IAClE,IAAI,MAAM,GAAG,SAAS,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;IAC/B,IAAI,CAAC,MAAM,EAAE,CAAC;QACZ,MAAM,GAAG,WAAW,EAAE,CAAC;QACvB,SAAS,CAAC,GAAG,CAAC,EAAE,EAAE,MAAM,CAAC,CAAC;IAC5B,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,SAAS,oBAAoB,CAC3B,GAAe,EACf,UAAmC,EACnC,IAAU,EACV,OAAgB;IAEhB,IAAI,OAAO,CAAC,MAAM,KAAK,gBAAgB;QAAE,OAAO;IAChD,MAAM,GAAG,GAAG,UAAU,CAAC,GAAG,CAAC,OAAO,CAAC,OAAO,CAAC,IAAI;QAC7C,EAAE,EAAE,OAAO,CAAC,OAAO;QACnB,KAAK,EAAE,OAAO,CAAC,YAAY;QAC3B,MAAM,EAAE,CAAC;KACV,CAAC;IACF,MAAM,MAAM,GAAG,SAAS,CAAC,GAAG,CAAC,SAAS,EAAE,GAAG,CAAC,EAAE,CAAC,CAAC;IAChD,MAAM,CAAC,UAAU,EAAE,CAAC;IACpB,GAAG,CAAC,aAAa,EAAE,CAAC;IAEpB,2EAA2E;IAC3E,wEAAwE;IACxE,qEAAqE;IACrE,mEAAmE;IACnE,IAAI,OAAO,CAAC,gBAAgB,EAAE,CAAC;QAC7B,IAAI,OAAO,CAAC,MAAM,KAAK,SAAS;YAAE,MAAM,CAAC,OAAO,EAAE,CAAC;QACnD,OAAO;IACT,CAAC;IAED,GAAG,CAAC,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC;IAC7B,IAAI,OAAO,CAAC,MAAM,KAAK,MAAM,IAAI,OAAO,CAAC,MAAM,KAAK,SAAS,EAAE,CAAC;QAC9D,GAAG,CAAC,cAAc,CAAC,OAAO,CAAC,QAAQ,CAAC,EAAE,CAAC;IACzC,CAAC;IAED,IAAI,OAAO,CAAC,MAAM,KAAK,SAAS,EAAE,CAAC;QACjC,MAAM,CAAC,OAAO,EAAE,CAAC;QACjB,OAAO;IACT,CAAC;IACD,eAAe,CAAC,GAAG,EAAE,MAAM,EAAE,IAAI,EAAE,OAAO,EAAE,GAAG,CAAC,MAAM,CAAC,CAAC;AAC1D,CAAC;AAED,SAAS,eAAe,CACtB,GAAe,EACf,MAAqB,EACrB,IAAU,EACV,OAAgB,EAChB,aAAqB;IAErB,MAAM,CAAC,GAAG,UAAU,CAAC,IAAI,CAAC,GAAG,aAAa,CAAC;IAC3C,MAAM,MAAM,GAAG,CAAC,GAAG,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;IAC1C,MAAM,CAAC,CAAC,IAAI,CAAC,CAAC;IACd,MAAM,CAAC,MAAM,IAAI,MAAM,CAAC;IACxB,MAAM,CAAC,QAAQ,EAAE,CAAC;IAClB,GAAG,CAAC,WAAW,EAAE,CAAC;IAClB,IAAI,OAAO,CAAC,MAAM,KAAK,MAAM;QAAE,MAAM,CAAC,MAAM,EAAE,CAAC;;QAC1C,MAAM,CAAC,MAAM,EAAE,CAAC;IACrB,GAAG,CAAC,MAAM,IAAI,CAAC,CAAC;IAChB,GAAG,CAAC,WAAW,IAAI,MAAM,CAAC;AAC5B,CAAC;AAED,SAAS,iBAAiB,CAAC,CAAa,EAAE,CAAgB;IACxD,OAAO;QACL,EAAE,EAAE,CAAC,CAAC,EAAE;QACR,KAAK,EAAE,CAAC,CAAC,KAAK;QACd,KAAK,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI;QACrD,MAAM,EAAE,CAAC,CAAC,MAAM;QAChB,UAAU,EAAE,CAAC,CAAC,UAAU;QACxB,QAAQ,EAAE,CAAC,CAAC,QAAQ;QACpB,MAAM,EAAE,CAAC,CAAC,MAAM;QAChB,MAAM,EAAE,CAAC,CAAC,MAAM;QAChB,OAAO,EAAE,CAAC,CAAC,OAAO;QAClB,UAAU,EAAE,CAAC,CAAC,UAAU,GAAG,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,GAAG,GAAG,CAAC,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,GAAG;KAC/E,CAAC;AACJ,CAAC;AAED,SAAS,MAAM,CAAC,CAAS;IACvB,OAAO,IAAI,CAAC,KAAK,CAAC,CAAC,GAAG,EAAE,CAAC,GAAG,EAAE,CAAC;AACjC,CAAC"}

package/dist/engine/sections.d.ts

@@ -0,0 +1,14 @@
+export interface SectionDef {
+    id: string;
+    title: string;
+    /** Multiplier applied to every rule in the section when computing the total. */
+    weight: number;
+}
+/**
+ * Section registry. Security, supply chain and testing carry the heaviest
+ * multipliers: a repo that fails an auth control is worse than one with a
+ * slightly untidy README, and the score should say so.
+ */
+export declare const DEFAULT_SECTIONS: SectionDef[];
+export declare function loadSections(rulesDir: string): SectionDef[];
+//# sourceMappingURL=sections.d.ts.map

package/dist/engine/sections.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sections.d.ts","sourceRoot":"","sources":["../../src/engine/sections.ts"],"names":[],"mappings":"AAKA,MAAM,WAAW,UAAU;IACzB,EAAE,EAAE,MAAM,CAAC;IACX,KAAK,EAAE,MAAM,CAAC;IACd,gFAAgF;IAChF,MAAM,EAAE,MAAM,CAAC;CAChB;AAED;;;;GAIG;AACH,eAAO,MAAM,gBAAgB,EAAE,UAAU,EAiBxC,CAAC;AAEF,wBAAgB,YAAY,CAAC,QAAQ,EAAE,MAAM,GAAG,UAAU,EAAE,CAkB3D"}

package/dist/engine/sections.js

@@ -0,0 +1,50 @@
+import { parse as parseYaml } from 'yaml';
+import { asMap, isMap, list, num, str } from '../util/yaml.js';
+import fs from 'node:fs';
+import path from 'node:path';
+/**
+ * Section registry. Security, supply chain and testing carry the heaviest
+ * multipliers: a repo that fails an auth control is worse than one with a
+ * slightly untidy README, and the score should say so.
+ */
+export const DEFAULT_SECTIONS = [
+    { id: 'S1', title: 'Repository & Project Structure', weight: 0.7 },
+    { id: 'S2', title: 'Security', weight: 1.7 },
+    { id: 'S3', title: 'Supply Chain & Build Provenance', weight: 1.3 },
+    { id: 'S4', title: 'Architecture & Design', weight: 1.0 },
+    { id: 'S5', title: 'Code Quality', weight: 1.0 },
+    { id: 'S6', title: 'Data & Database', weight: 1.0 },
+    { id: 'S7', title: 'Testing & Quality Assurance', weight: 1.3 },
+    { id: 'S8', title: 'CI/CD, Infrastructure & Observability', weight: 1.0 },
+    { id: 'S9', title: 'Release & Change Management', weight: 0.7 },
+    { id: 'S10', title: 'Dependencies & Third-Party', weight: 1.2 },
+    { id: 'S11', title: 'Performance & Resilience', weight: 0.8 },
+    { id: 'S12', title: 'Documentation & Knowledge', weight: 0.7 },
+    { id: 'S13', title: 'Accessibility, i18n & Compliance', weight: 0.9 },
+    { id: 'S14', title: 'AI / LLM-Era Risks', weight: 1.1 },
+    { id: 'S15', title: 'Platform-Specific', weight: 1.0 },
+    { id: 'S16', title: 'Future Readiness', weight: 0.4 },
+];
+export function loadSections(rulesDir) {
+    const file = path.join(rulesDir, 'sections.yaml');
+    if (!fs.existsSync(file))
+        return DEFAULT_SECTIONS;
+    try {
+        const doc = asMap(parseYaml(fs.readFileSync(file, 'utf8')));
+        const raw = list(doc.sections);
+        if (!raw)
+            return DEFAULT_SECTIONS;
+        const parsed = raw.filter(isMap).map((s) => ({
+            id: str(s.id) ?? 'S0',
+            title: str(s.title) ?? str(s.id) ?? 'Untitled',
+            weight: num(s.weight) ?? 1,
+        }));
+        // Keep defaults for any section the override file omits.
+        const ids = new Set(parsed.map((s) => s.id));
+        return [...parsed, ...DEFAULT_SECTIONS.filter((s) => !ids.has(s.id))];
+    }
+    catch {
+        return DEFAULT_SECTIONS;
+    }
+}
+//# sourceMappingURL=sections.js.map

package/dist/engine/sections.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sections.js","sourceRoot":"","sources":["../../src/engine/sections.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,KAAK,IAAI,SAAS,EAAE,MAAM,MAAM,CAAC;AAC1C,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,IAAI,EAAE,GAAG,EAAE,GAAG,EAAE,MAAM,iBAAiB,CAAC;AAC/D,OAAO,EAAE,MAAM,SAAS,CAAC;AACzB,OAAO,IAAI,MAAM,WAAW,CAAC;AAS7B;;;;GAIG;AACH,MAAM,CAAC,MAAM,gBAAgB,GAAiB;IAC5C,EAAE,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,gCAAgC,EAAE,MAAM,EAAE,GAAG,EAAE;IAClE,EAAE,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,UAAU,EAAE,MAAM,EAAE,GAAG,EAAE;IAC5C,EAAE,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,iCAAiC,EAAE,MAAM,EAAE,GAAG,EAAE;IACnE,EAAE,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,uBAAuB,EAAE,MAAM,EAAE,GAAG,EAAE;IACzD,EAAE,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,cAAc,EAAE,MAAM,EAAE,GAAG,EAAE;IAChD,EAAE,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,iBAAiB,EAAE,MAAM,EAAE,GAAG,EAAE;IACnD,EAAE,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,6BAA6B,EAAE,MAAM,EAAE,GAAG,EAAE;IAC/D,EAAE,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,uCAAuC,EAAE,MAAM,EAAE,GAAG,EAAE;IACzE,EAAE,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,6BAA6B,EAAE,MAAM,EAAE,GAAG,EAAE;IAC/D,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,4BAA4B,EAAE,MAAM,EAAE,GAAG,EAAE;IAC/D,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,0BAA0B,EAAE,MAAM,EAAE,GAAG,EAAE;IAC7D,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,2BAA2B,EAAE,MAAM,EAAE,GAAG,EAAE;IAC9D,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,kCAAkC,EAAE,MAAM,EAAE,GAAG,EAAE;IACrE,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,oBAAoB,EAAE,MAAM,EAAE,GAAG,EAAE;IACvD,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,mBAAmB,EAAE,MAAM,EAAE,GAAG,EAAE;IACtD,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,kBAAkB,EAAE,MAAM,EAAE,GAAG,EAAE;CACtD,CAAC;AAEF,MAAM,UAAU,YAAY,CAAC,QAAgB;IAC3C,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,eAAe,CAAC,CAAC;IAClD,IAAI,CAAC,EAAE,CAAC,UAAU,CAAC,IAAI,CAAC;QAAE,OAAO,gBAAgB,CAAC;IAClD,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,KAAK,CAAC,SAAS,CAAC,EAAE,CAAC,YAAY,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC,CAAC,CAAC;QAC5D,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;QAC/B,IAAI,CAAC,GAAG;YAAE,OAAO,gBAAgB,CAAC;QAClC,MAAM,MAAM,GAAG,GAAG,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;YAC3C,EAAE,EAAE,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,IAAI,IAAI;YACrB,KAAK,EAAE,GAAG,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,IAAI,UAAU;YAC9C,MAAM,EAAE,GAAG,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC;SAC3B,CAAC,CAAC,CAAC;QACJ,yDAAyD;QACzD,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;QAC7C,OAAO,CAAC,GAAG,MAAM,EAAE,GAAG,gBAAgB,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC;IACxE,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,gBAAgB,CAAC;IAC1B,CAAC;AACH,CAAC"}

package/dist/evolution/benchmark.d.ts

@@ -0,0 +1,12 @@
+import type { BenchmarkCase, BenchmarkResult, Capability } from './types.js';
+/**
+ * Run a candidate capability against a set of flees and measure TP/TN/FP/FN,
+ * precision/recall, and the one thing that matters most: whether the candidate
+ * changed the verdict of any *existing* rule (a regression).
+ *
+ * A baseline audit (without the candidate) and a candidate audit (with it) are
+ * both run on each fixture; the candidate's own rules are excluded from the
+ * regression comparison so only collateral damage counts.
+ */
+export declare function runBenchmark(candidate: Capability, cases: BenchmarkCase[], rulesDir?: string, engineVersion?: string): BenchmarkResult;
+//# sourceMappingURL=benchmark.d.ts.map

package/dist/evolution/benchmark.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"benchmark.d.ts","sourceRoot":"","sources":["../../src/evolution/benchmark.ts"],"names":[],"mappings":"AAKA,OAAO,KAAK,EAAE,aAAa,EAAuB,eAAe,EAAE,UAAU,EAAE,MAAM,YAAY,CAAC;AAkBlG;;;;;;;;GAQG;AACH,wBAAgB,YAAY,CAC1B,SAAS,EAAE,UAAU,EACrB,KAAK,EAAE,aAAa,EAAE,EACtB,QAAQ,CAAC,EAAE,MAAM,EACjB,aAAa,SAAU,GACtB,eAAe,CAyCjB"}

package/dist/evolution/benchmark.js

@@ -0,0 +1,107 @@
+import fs from 'node:fs';
+import os from 'node:os';
+import path from 'node:path';
+import { runAudit } from '../engine/audit.js';
+const OPEN = new Set(['FAIL', 'WRONG', 'MISSING', 'DEPRECATED', 'EXPERIMENTAL']);
+function statusOf(report, ruleId) {
+    return report.findings.find((f) => f.ruleId === ruleId)?.status ?? 'NOT_APPLICABLE';
+}
+function materialize(files) {
+    const root = fs.mkdtempSync(path.join(os.tmpdir(), 'usa-bench-'));
+    for (const [rel, content] of Object.entries(files)) {
+        const abs = path.join(root, rel);
+        fs.mkdirSync(path.dirname(abs), { recursive: true });
+        fs.writeFileSync(abs, content, 'utf8');
+    }
+    return root;
+}
+/**
+ * Run a candidate capability against a set of flees and measure TP/TN/FP/FN,
+ * precision/recall, and the one thing that matters most: whether the candidate
+ * changed the verdict of any *existing* rule (a regression).
+ *
+ * A baseline audit (without the candidate) and a candidate audit (with it) are
+ * both run on each fixture; the candidate's own rules are excluded from the
+ * regression comparison so only collateral damage counts.
+ */
+export function runBenchmark(candidate, cases, rulesDir, engineVersion = 'bench') {
+    const caseResults = [];
+    for (const c of cases) {
+        const started = Date.now();
+        const root = materialize(c.fixture);
+        try {
+            const baseline = runAudit({ target: root, rulesDir, usaVersion: engineVersion });
+            const withCap = runAudit({
+                target: root,
+                rulesDir,
+                usaVersion: engineVersion,
+                extraPacks: candidate.pack ? [candidate.pack] : undefined,
+            });
+            caseResults.push(evaluateCase(c, candidate, baseline.report, withCap.report, Date.now() - started));
+        }
+        finally {
+            fs.rmSync(root, { recursive: true, force: true });
+        }
+    }
+    const summary = caseResults.reduce((acc, r) => ({
+        tp: acc.tp + r.tp,
+        tn: acc.tn + r.tn,
+        fp: acc.fp + r.fp,
+        fn: acc.fn + r.fn,
+        regressions: acc.regressions + r.regressions.length,
+        precision: 0,
+        recall: 0,
+    }), { tp: 0, tn: 0, fp: 0, fn: 0, precision: 0, recall: 0, regressions: 0 });
+    summary.precision = summary.tp + summary.fp > 0 ? summary.tp / (summary.tp + summary.fp) : 1;
+    summary.recall = summary.tp + summary.fn > 0 ? summary.tp / (summary.tp + summary.fn) : 1;
+    return {
+        capability: { id: candidate.id, version: candidate.version },
+        cases: caseResults,
+        summary,
+    };
+}
+function evaluateCase(c, candidate, baseline, withCap, elapsedMs) {
+    const acc = classify(c.expected, withCap);
+    const regressions = collectRegressions(baseline, withCap, candidate.pack?.rules.map((r) => r.id) ?? []);
+    const precision = acc.tp + acc.fp > 0 ? acc.tp / (acc.tp + acc.fp) : 1;
+    const recall = acc.tp + acc.fn > 0 ? acc.tp / (acc.tp + acc.fn) : 1;
+    return { caseId: c.id, kind: c.kind, ...acc, precision, recall, regressions, elapsedMs };
+}
+function classify(expected, withCap) {
+    let tp = 0;
+    let tn = 0;
+    let fp = 0;
+    let fn = 0;
+    for (const exp of expected) {
+        const expectedOpen = OPEN.has(exp.status);
+        const actualOpen = OPEN.has(statusOf(withCap, exp.ruleId));
+        if (expectedOpen && actualOpen)
+            tp++;
+        else if (expectedOpen)
+            fn++;
+        else if (actualOpen)
+            fp++;
+        else
+            tn++;
+    }
+    return { tp, tn, fp, fn };
+}
+function collectRegressions(baseline, withCap, candidateRules) {
+    const excluded = new Set(candidateRules);
+    const ids = new Set();
+    for (const f of baseline.findings)
+        ids.add(f.ruleId);
+    for (const f of withCap.findings)
+        ids.add(f.ruleId);
+    const regressions = [];
+    for (const id of [...ids].sort()) {
+        if (excluded.has(id))
+            continue;
+        const a = statusOf(baseline, id);
+        const b = statusOf(withCap, id);
+        if (a !== b)
+            regressions.push(`${id}: ${a} -> ${b}`);
+    }
+    return regressions;
+}
+//# sourceMappingURL=benchmark.js.map

package/dist/evolution/benchmark.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"benchmark.js","sourceRoot":"","sources":["../../src/evolution/benchmark.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,SAAS,CAAC;AACzB,OAAO,EAAE,MAAM,SAAS,CAAC;AACzB,OAAO,IAAI,MAAM,WAAW,CAAC;AAC7B,OAAO,EAAE,QAAQ,EAAE,MAAM,oBAAoB,CAAC;AAI9C,MAAM,IAAI,GAAgB,IAAI,GAAG,CAAC,CAAC,MAAM,EAAE,OAAO,EAAE,SAAS,EAAE,YAAY,EAAE,cAAc,CAAC,CAAC,CAAC;AAE9F,SAAS,QAAQ,CAAC,MAAmB,EAAE,MAAc;IACnD,OAAO,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,KAAK,MAAM,CAAC,EAAE,MAAM,IAAI,gBAAgB,CAAC;AACtF,CAAC;AAED,SAAS,WAAW,CAAC,KAA6B;IAChD,MAAM,IAAI,GAAG,EAAE,CAAC,WAAW,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,MAAM,EAAE,EAAE,YAAY,CAAC,CAAC,CAAC;IAClE,KAAK,MAAM,CAAC,GAAG,EAAE,OAAO,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;QACnD,MAAM,GAAG,GAAG,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC;QACjC,EAAE,CAAC,SAAS,CAAC,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;QACrD,EAAE,CAAC,aAAa,CAAC,GAAG,EAAE,OAAO,EAAE,MAAM,CAAC,CAAC;IACzC,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,UAAU,YAAY,CAC1B,SAAqB,EACrB,KAAsB,EACtB,QAAiB,EACjB,aAAa,GAAG,OAAO;IAEvB,MAAM,WAAW,GAA0B,EAAE,CAAC;IAC9C,KAAK,MAAM,CAAC,IAAI,KAAK,EAAE,CAAC;QACtB,MAAM,OAAO,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;QAC3B,MAAM,IAAI,GAAG,WAAW,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC;QACpC,IAAI,CAAC;YACH,MAAM,QAAQ,GAAG,QAAQ,CAAC,EAAE,MAAM,EAAE,IAAI,EAAE,QAAQ,EAAE,UAAU,EAAE,aAAa,EAAE,CAAC,CAAC;YACjF,MAAM,OAAO,GAAG,QAAQ,CAAC;gBACvB,MAAM,EAAE,IAAI;gBACZ,QAAQ;gBACR,UAAU,EAAE,aAAa;gBACzB,UAAU,EAAE,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,SAAS;aAC1D,CAAC,CAAC;YACH,WAAW,CAAC,IAAI,CACd,YAAY,CAAC,CAAC,EAAE,SAAS,EAAE,QAAQ,CAAC,MAAM,EAAE,OAAO,CAAC,MAAM,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,OAAO,CAAC,CAClF,CAAC;QACJ,CAAC;gBAAS,CAAC;YACT,EAAE,CAAC,MAAM,CAAC,IAAI,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;QACpD,CAAC;IACH,CAAC;IAED,MAAM,OAAO,GAAG,WAAW,CAAC,MAAM,CAChC,CAAC,GAAG,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC;QACX,EAAE,EAAE,GAAG,CAAC,EAAE,GAAG,CAAC,CAAC,EAAE;QACjB,EAAE,EAAE,GAAG,CAAC,EAAE,GAAG,CAAC,CAAC,EAAE;QACjB,EAAE,EAAE,GAAG,CAAC,EAAE,GAAG,CAAC,CAAC,EAAE;QACjB,EAAE,EAAE,GAAG,CAAC,EAAE,GAAG,CAAC,CAAC,EAAE;QACjB,WAAW,EAAE,GAAG,CAAC,WAAW,GAAG,CAAC,CAAC,WAAW,CAAC,MAAM;QACnD,SAAS,EAAE,CAAC;QACZ,MAAM,EAAE,CAAC;KACV,CAAC,EACF,EAAE,EAAE,EAAE,CAAC,EAAE,EAAE,EAAE,CAAC,EAAE,EAAE,EAAE,CAAC,EAAE,EAAE,EAAE,CAAC,EAAE,SAAS,EAAE,CAAC,EAAE,MAAM,EAAE,CAAC,EAAE,WAAW,EAAE,CAAC,EAAE,CACxE,CAAC;IACF,OAAO,CAAC,SAAS,GAAG,OAAO,CAAC,EAAE,GAAG,OAAO,CAAC,EAAE,GAAG,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,EAAE,GAAG,CAAC,OAAO,CAAC,EAAE,GAAG,OAAO,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IAC7F,OAAO,CAAC,MAAM,GAAG,OAAO,CAAC,EAAE,GAAG,OAAO,CAAC,EAAE,GAAG,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,EAAE,GAAG,CAAC,OAAO,CAAC,EAAE,GAAG,OAAO,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IAE1F,OAAO;QACL,UAAU,EAAE,EAAE,EAAE,EAAE,SAAS,CAAC,EAAE,EAAE,OAAO,EAAE,SAAS,CAAC,OAAO,EAAE;QAC5D,KAAK,EAAE,WAAW;QAClB,OAAO;KACR,CAAC;AACJ,CAAC;AAED,SAAS,YAAY,CACnB,CAAgB,EAChB,SAAqB,EACrB,QAAqB,EACrB,OAAoB,EACpB,SAAiB;IAEjB,MAAM,GAAG,GAAG,QAAQ,CAAC,CAAC,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC;IAC1C,MAAM,WAAW,GAAG,kBAAkB,CACpC,QAAQ,EACR,OAAO,EACP,SAAS,CAAC,IAAI,EAAE,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,IAAI,EAAE,CAC7C,CAAC;IACF,MAAM,SAAS,GAAG,GAAG,CAAC,EAAE,GAAG,GAAG,CAAC,EAAE,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,EAAE,GAAG,CAAC,GAAG,CAAC,EAAE,GAAG,GAAG,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IACvE,MAAM,MAAM,GAAG,GAAG,CAAC,EAAE,GAAG,GAAG,CAAC,EAAE,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,EAAE,GAAG,CAAC,GAAG,CAAC,EAAE,GAAG,GAAG,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IACpE,OAAO,EAAE,MAAM,EAAE,CAAC,CAAC,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,GAAG,GAAG,EAAE,SAAS,EAAE,MAAM,EAAE,WAAW,EAAE,SAAS,EAAE,CAAC;AAC3F,CAAC;AAED,SAAS,QAAQ,CACf,QAAmC,EACnC,OAAoB;IAEpB,IAAI,EAAE,GAAG,CAAC,CAAC;IACX,IAAI,EAAE,GAAG,CAAC,CAAC;IACX,IAAI,EAAE,GAAG,CAAC,CAAC;IACX,IAAI,EAAE,GAAG,CAAC,CAAC;IACX,KAAK,MAAM,GAAG,IAAI,QAAQ,EAAE,CAAC;QAC3B,MAAM,YAAY,GAAG,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;QAC1C,MAAM,UAAU,GAAG,IAAI,CAAC,GAAG,CAAC,QAAQ,CAAC,OAAO,EAAE,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC;QAC3D,IAAI,YAAY,IAAI,UAAU;YAAE,EAAE,EAAE,CAAC;aAChC,IAAI,YAAY;YAAE,EAAE,EAAE,CAAC;aACvB,IAAI,UAAU;YAAE,EAAE,EAAE,CAAC;;YACrB,EAAE,EAAE,CAAC;IACZ,CAAC;IACD,OAAO,EAAE,EAAE,EAAE,EAAE,EAAE,EAAE,EAAE,EAAE,EAAE,CAAC;AAC5B,CAAC;AAED,SAAS,kBAAkB,CACzB,QAAqB,EACrB,OAAoB,EACpB,cAAwB;IAExB,MAAM,QAAQ,GAAG,IAAI,GAAG,CAAC,cAAc,CAAC,CAAC;IACzC,MAAM,GAAG,GAAG,IAAI,GAAG,EAAU,CAAC;IAC9B,KAAK,MAAM,CAAC,IAAI,QAAQ,CAAC,QAAQ;QAAE,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC;IACrD,KAAK,MAAM,CAAC,IAAI,OAAO,CAAC,QAAQ;QAAE,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC;IACpD,MAAM,WAAW,GAAa,EAAE,CAAC;IACjC,KAAK,MAAM,EAAE,IAAI,CAAC,GAAG,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC;QACjC,IAAI,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC;YAAE,SAAS;QAC/B,MAAM,CAAC,GAAG,QAAQ,CAAC,QAAQ,EAAE,EAAE,CAAC,CAAC;QACjC,MAAM,CAAC,GAAG,QAAQ,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC;QAChC,IAAI,CAAC,KAAK,CAAC;YAAE,WAAW,CAAC,IAAI,CAAC,GAAG,EAAE,KAAK,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC;IACvD,CAAC;IACD,OAAO,WAAW,CAAC;AACrB,CAAC"}

package/dist/evolution/capability.d.ts

@@ -0,0 +1,22 @@
+import type { RulePack } from '../types.js';
+import type { Capability } from './types.js';
+/**
+ * Capability-set resolution.
+ *
+ * The resolved set is an immutable value, hashed once at the start of a run.
+ * It depends on: engine version, the base pack ids in the on-disk registry, and
+ * any released capabilities injected for this run. A model bundle would become
+ * part of this boundary once models exist — until then it is recorded as absent.
+ */
+export declare function resolveCapabilitySetId(basePackIds: string[], extraCapabilities: Capability[], engineVersion: string): string;
+/** Pack ids present in the on-disk registry (the source of truth). */
+export declare function basePackIds(rulesDir: string): string[];
+/** Wrap a candidate rule pack as a `data` capability. */
+export declare function capabilityFromPack(pack: RulePack, opts?: {
+    version?: string;
+    description?: string;
+    createdBy?: string;
+    createdAt?: string;
+    languages?: string[];
+}): Capability;
+//# sourceMappingURL=capability.d.ts.map

package/dist/evolution/capability.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"capability.d.ts","sourceRoot":"","sources":["../../src/evolution/capability.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EAAa,QAAQ,EAAE,MAAM,aAAa,CAAC;AACvD,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,YAAY,CAAC;AAE7C;;;;;;;GAOG;AACH,wBAAgB,sBAAsB,CACpC,WAAW,EAAE,MAAM,EAAE,EACrB,iBAAiB,EAAE,UAAU,EAAE,EAC/B,aAAa,EAAE,MAAM,GACpB,MAAM,CAOR;AAED,sEAAsE;AACtE,wBAAgB,WAAW,CAAC,QAAQ,EAAE,MAAM,GAAG,MAAM,EAAE,CAGtD;AAED,yDAAyD;AACzD,wBAAgB,kBAAkB,CAChC,IAAI,EAAE,QAAQ,EACd,IAAI,GAAE;IACJ,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,SAAS,CAAC,EAAE,MAAM,EAAE,CAAC;CACjB,GACL,UAAU,CAcZ"}

package/dist/evolution/capability.js

@@ -0,0 +1,69 @@
+import { loadRulePacks } from '../engine/loader.js';
+import { hashText } from '../snapshot/index.js';
+import { canonicalJson } from '../snapshot/index.js';
+/**
+ * Capability-set resolution.
+ *
+ * The resolved set is an immutable value, hashed once at the start of a run.
+ * It depends on: engine version, the base pack ids in the on-disk registry, and
+ * any released capabilities injected for this run. A model bundle would become
+ * part of this boundary once models exist — until then it is recorded as absent.
+ */
+export function resolveCapabilitySetId(basePackIds, extraCapabilities, engineVersion) {
+    const payload = canonicalJson({
+        engineVersion,
+        basePacks: [...basePackIds].sort(),
+        extraCapabilities: extraCapabilities.map((c) => `${c.id}@${c.version}`).sort(),
+    });
+    return hashText(payload);
+}
+/** Pack ids present in the on-disk registry (the source of truth). */
+export function basePackIds(rulesDir) {
+    const { packs } = loadRulePacks(rulesDir);
+    return packs.map((p) => p.id).sort();
+}
+/** Wrap a candidate rule pack as a `data` capability. */
+export function capabilityFromPack(pack, opts = {}) {
+    return {
+        id: pack.id,
+        version: opts.version ?? pack.version ?? '0.1.0',
+        kind: 'data',
+        description: opts.description ?? pack.description ?? pack.title,
+        pack,
+        languages: opts.languages ?? inferLanguages(pack),
+        status: 'stable',
+        provenance: {
+            createdAt: opts.createdAt ?? new Date().toISOString(),
+            createdBy: opts.createdBy ?? 'evolution',
+        },
+    };
+}
+/**
+ * Infer which languages a pack analyzes from its declared applicability
+ * (`skip_when` / per-rule `applies_when` `lang:*` facts). A capability should
+ * declare what it covers so coverage accounting stays honest and automatic.
+ */
+function inferLanguages(pack) {
+    const langs = new Set();
+    collectLangFacts(pack.skipWhen, langs);
+    for (const rule of pack.rules)
+        collectLangFacts(rule.appliesWhen, langs);
+    const out = [...langs].sort();
+    return out.length > 0 ? out : [];
+}
+function collectLangFacts(p, out) {
+    if (!p)
+        return;
+    const q = p;
+    for (const key of ['all', 'any']) {
+        if (Array.isArray(q[key]))
+            for (const x of q[key])
+                collectLangFacts(x, out);
+    }
+    if (q.not !== undefined && q.not !== null)
+        collectLangFacts(q.not, out);
+    const fact = q.fact;
+    if (typeof fact === 'string' && fact.startsWith('lang:'))
+        out.add(fact.slice('lang:'.length));
+}
+//# sourceMappingURL=capability.js.map

package/dist/evolution/capability.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"capability.js","sourceRoot":"","sources":["../../src/evolution/capability.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAC;AACpD,OAAO,EAAE,QAAQ,EAAE,MAAM,sBAAsB,CAAC;AAChD,OAAO,EAAE,aAAa,EAAE,MAAM,sBAAsB,CAAC;AAIrD;;;;;;;GAOG;AACH,MAAM,UAAU,sBAAsB,CACpC,WAAqB,EACrB,iBAA+B,EAC/B,aAAqB;IAErB,MAAM,OAAO,GAAG,aAAa,CAAC;QAC5B,aAAa;QACb,SAAS,EAAE,CAAC,GAAG,WAAW,CAAC,CAAC,IAAI,EAAE;QAClC,iBAAiB,EAAE,iBAAiB,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,GAAG,CAAC,CAAC,EAAE,IAAI,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC,IAAI,EAAE;KAC/E,CAAC,CAAC;IACH,OAAO,QAAQ,CAAC,OAAO,CAAC,CAAC;AAC3B,CAAC;AAED,sEAAsE;AACtE,MAAM,UAAU,WAAW,CAAC,QAAgB;IAC1C,MAAM,EAAE,KAAK,EAAE,GAAG,aAAa,CAAC,QAAQ,CAAC,CAAC;IAC1C,OAAO,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;AACvC,CAAC;AAED,yDAAyD;AACzD,MAAM,UAAU,kBAAkB,CAChC,IAAc,EACd,OAMI,EAAE;IAEN,OAAO;QACL,EAAE,EAAE,IAAI,CAAC,EAAE;QACX,OAAO,EAAE,IAAI,CAAC,OAAO,IAAI,IAAI,CAAC,OAAO,IAAI,OAAO;QAChD,IAAI,EAAE,MAAM;QACZ,WAAW,EAAE,IAAI,CAAC,WAAW,IAAI,IAAI,CAAC,WAAW,IAAI,IAAI,CAAC,KAAK;QAC/D,IAAI;QACJ,SAAS,EAAE,IAAI,CAAC,SAAS,IAAI,cAAc,CAAC,IAAI,CAAC;QACjD,MAAM,EAAE,QAAQ;QAChB,UAAU,EAAE;YACV,SAAS,EAAE,IAAI,CAAC,SAAS,IAAI,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;YACrD,SAAS,EAAE,IAAI,CAAC,SAAS,IAAI,WAAW;SACzC;KACF,CAAC;AACJ,CAAC;AAED;;;;GAIG;AACH,SAAS,cAAc,CAAC,IAAc;IACpC,MAAM,KAAK,GAAG,IAAI,GAAG,EAAU,CAAC;IAChC,gBAAgB,CAAC,IAAI,CAAC,QAAQ,EAAE,KAAK,CAAC,CAAC;IACvC,KAAK,MAAM,IAAI,IAAI,IAAI,CAAC,KAAK;QAAE,gBAAgB,CAAC,IAAI,CAAC,WAAW,EAAE,KAAK,CAAC,CAAC;IACzE,MAAM,GAAG,GAAG,CAAC,GAAG,KAAK,CAAC,CAAC,IAAI,EAAE,CAAC;IAC9B,OAAO,GAAG,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC;AACnC,CAAC;AAED,SAAS,gBAAgB,CAAC,CAAwB,EAAE,GAAgB;IAClE,IAAI,CAAC,CAAC;QAAE,OAAO;IACf,MAAM,CAAC,GAAG,CAA4B,CAAC;IACvC,KAAK,MAAM,GAAG,IAAI,CAAC,KAAK,EAAE,KAAK,CAAU,EAAE,CAAC;QAC1C,IAAI,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC;YAAE,KAAK,MAAM,CAAC,IAAI,CAAC,CAAC,GAAG,CAAgB;gBAAE,gBAAgB,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC;IAC7F,CAAC;IACD,IAAI,CAAC,CAAC,GAAG,KAAK,SAAS,IAAI,CAAC,CAAC,GAAG,KAAK,IAAI;QAAE,gBAAgB,CAAC,CAAC,CAAC,GAAgB,EAAE,GAAG,CAAC,CAAC;IACrF,MAAM,IAAI,GAAG,CAAC,CAAC,IAAI,CAAC;IACpB,IAAI,OAAO,IAAI,KAAK,QAAQ,IAAI,IAAI,CAAC,UAAU,CAAC,OAAO,CAAC;QAAE,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC;AAChG,CAAC"}

package/dist/evolution/coverage.d.ts

@@ -0,0 +1,15 @@
+import type { AuditReport, Facts } from '../types.js';
+import type { CoverageModel } from './types.js';
+/**
+ * Coverage is tied to what the audit *actually resolved* — never to a registry
+ * that merely contains a capability. A detected language with a shipped pack, or
+ * one released and injected for this run (`extraCoveredLangs`), is "covered";
+ * anything else is "unsupported".
+ *
+ * `extraCoveredLangs` comes from the capabilities actually executed in this run
+ * (each released capability declares the languages it analyzes). The static
+ * `COVERED_LANGS` map is the base set of shipped packs; the bootstrap knowledge
+ * remains the single source of truth for "does a bootstrap proposal exist".
+ */
+export declare function computeCoverage(report: AuditReport, facts: Facts, extraCoveredLangs?: string[]): CoverageModel;
+//# sourceMappingURL=coverage.d.ts.map

package/dist/evolution/coverage.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"coverage.d.ts","sourceRoot":"","sources":["../../src/evolution/coverage.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,WAAW,EAAE,KAAK,EAAE,MAAM,aAAa,CAAC;AAEtD,OAAO,KAAK,EAAa,aAAa,EAAE,MAAM,YAAY,CAAC;AAE3D;;;;;;;;;;GAUG;AACH,wBAAgB,eAAe,CAC7B,MAAM,EAAE,WAAW,EACnB,KAAK,EAAE,KAAK,EACZ,iBAAiB,GAAE,MAAM,EAAO,GAC/B,aAAa,CAwDf"}

package/dist/evolution/coverage.js

@@ -0,0 +1,65 @@
+import { bootstrapPacks } from '../bootstrap/index.js';
+/**
+ * Coverage is tied to what the audit *actually resolved* — never to a registry
+ * that merely contains a capability. A detected language with a shipped pack, or
+ * one released and injected for this run (`extraCoveredLangs`), is "covered";
+ * anything else is "unsupported".
+ *
+ * `extraCoveredLangs` comes from the capabilities actually executed in this run
+ * (each released capability declares the languages it analyzes). The static
+ * `COVERED_LANGS` map is the base set of shipped packs; the bootstrap knowledge
+ * remains the single source of truth for "does a bootstrap proposal exist".
+ */
+export function computeCoverage(report, facts, extraCoveredLangs = []) {
+    const boot = bootstrapPacks(facts);
+    const langs = [...facts.flags]
+        .filter((f) => f.startsWith('lang:'))
+        .map((f) => f.slice('lang:'.length))
+        .sort();
+    const coveredSet = new Set([...boot.coveredLangs, ...extraCoveredLangs]);
+    const partialSet = new Set(boot.generatedLangs);
+    const blindSpots = [];
+    const coveredLanguages = [];
+    const unsupportedLanguages = [];
+    for (const lang of langs) {
+        if (coveredSet.has(lang)) {
+            coveredLanguages.push(lang);
+        }
+        else {
+            unsupportedLanguages.push(lang);
+            const hint = partialSet.has(lang)
+                ? ' (a bootstrap proposal exists, but it is not a shipped capability)'
+                : ' (no coverage at all)';
+            blindSpots.push({
+                kind: 'unsupported-language',
+                id: `lang:${lang}`,
+                detail: `No production capability analyzes ${lang}${hint}.`,
+                evidence: `detected fact "lang:${lang}"; packs loaded: ${report.options.packsLoaded.join(', ') || 'none'}`,
+            });
+        }
+    }
+    const unverifiableSections = [];
+    for (const s of report.score.sections) {
+        if (s.score === null) {
+            unverifiableSections.push(s.id);
+            blindSpots.push({
+                kind: 'unverifiable-section',
+                id: `section:${s.id}`,
+                detail: `Section ${s.id} (${s.title}) could not be verified automatically.`,
+                evidence: `${s.applicable} applicable rule(s), ${s.unknown} unresolved by the engine`,
+            });
+        }
+    }
+    const languageCoverage = langs.length > 0 ? Math.round((100 * coveredLanguages.length) / langs.length) : 100;
+    return {
+        automationCoverage: report.score.automationCoverage,
+        languageCoverage,
+        detectedLanguages: langs,
+        coveredLanguages,
+        unsupportedLanguages,
+        unverifiableSections,
+        unknownFindings: report.score.counts.UNKNOWN,
+        blindSpots,
+    };
+}
+//# sourceMappingURL=coverage.js.map

package/dist/evolution/coverage.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"coverage.js","sourceRoot":"","sources":["../../src/evolution/coverage.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,cAAc,EAAE,MAAM,uBAAuB,CAAC;AAGvD;;;;;;;;;;GAUG;AACH,MAAM,UAAU,eAAe,CAC7B,MAAmB,EACnB,KAAY,EACZ,oBAA8B,EAAE;IAEhC,MAAM,IAAI,GAAG,cAAc,CAAC,KAAK,CAAC,CAAC;IACnC,MAAM,KAAK,GAAG,CAAC,GAAG,KAAK,CAAC,KAAK,CAAC;SAC3B,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,UAAU,CAAC,OAAO,CAAC,CAAC;SACpC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;SACnC,IAAI,EAAE,CAAC;IACV,MAAM,UAAU,GAAG,IAAI,GAAG,CAAC,CAAC,GAAG,IAAI,CAAC,YAAY,EAAE,GAAG,iBAAiB,CAAC,CAAC,CAAC;IACzE,MAAM,UAAU,GAAG,IAAI,GAAG,CAAC,IAAI,CAAC,cAAc,CAAC,CAAC;IAEhD,MAAM,UAAU,GAAgB,EAAE,CAAC;IACnC,MAAM,gBAAgB,GAAa,EAAE,CAAC;IACtC,MAAM,oBAAoB,GAAa,EAAE,CAAC;IAE1C,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;QACzB,IAAI,UAAU,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC;YACzB,gBAAgB,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAC9B,CAAC;aAAM,CAAC;YACN,oBAAoB,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;YAChC,MAAM,IAAI,GAAG,UAAU,CAAC,GAAG,CAAC,IAAI,CAAC;gBAC/B,CAAC,CAAC,oEAAoE;gBACtE,CAAC,CAAC,uBAAuB,CAAC;YAC5B,UAAU,CAAC,IAAI,CAAC;gBACd,IAAI,EAAE,sBAAsB;gBAC5B,EAAE,EAAE,QAAQ,IAAI,EAAE;gBAClB,MAAM,EAAE,qCAAqC,IAAI,GAAG,IAAI,GAAG;gBAC3D,QAAQ,EAAE,uBAAuB,IAAI,oBAAoB,MAAM,CAAC,OAAO,CAAC,WAAW,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,MAAM,EAAE;aAC3G,CAAC,CAAC;QACL,CAAC;IACH,CAAC;IAED,MAAM,oBAAoB,GAAa,EAAE,CAAC;IAC1C,KAAK,MAAM,CAAC,IAAI,MAAM,CAAC,KAAK,CAAC,QAAQ,EAAE,CAAC;QACtC,IAAI,CAAC,CAAC,KAAK,KAAK,IAAI,EAAE,CAAC;YACrB,oBAAoB,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;YAChC,UAAU,CAAC,IAAI,CAAC;gBACd,IAAI,EAAE,sBAAsB;gBAC5B,EAAE,EAAE,WAAW,CAAC,CAAC,EAAE,EAAE;gBACrB,MAAM,EAAE,WAAW,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC,KAAK,wCAAwC;gBAC3E,QAAQ,EAAE,GAAG,CAAC,CAAC,UAAU,wBAAwB,CAAC,CAAC,OAAO,2BAA2B;aACtF,CAAC,CAAC;QACL,CAAC;IACH,CAAC;IAED,MAAM,gBAAgB,GACpB,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,GAAG,GAAG,gBAAgB,CAAC,MAAM,CAAC,GAAG,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC;IAEtF,OAAO;QACL,kBAAkB,EAAE,MAAM,CAAC,KAAK,CAAC,kBAAkB;QACnD,gBAAgB;QAChB,iBAAiB,EAAE,KAAK;QACxB,gBAAgB;QAChB,oBAAoB;QACpB,oBAAoB;QACpB,eAAe,EAAE,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,OAAO;QAC5C,UAAU;KACX,CAAC;AACJ,CAAC"}

package/dist/evolution/gap.d.ts

@@ -0,0 +1,10 @@
+import type { CapabilityGap, CoverageModel } from './types.js';
+/**
+ * Turn a coverage model's blind spots into evidence-backed capability gaps.
+ *
+ * Every gap cites the audit run and snapshot that produced it, plus the
+ * observed fact/pack-list evidence — a gap is a conclusion from recorded
+ * evidence, never free-floating intuition.
+ */
+export declare function deriveGaps(coverage: CoverageModel, auditRunId: string, snapshotId: string, now?: string): CapabilityGap[];
+//# sourceMappingURL=gap.d.ts.map

package/dist/evolution/gap.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"gap.d.ts","sourceRoot":"","sources":["../../src/evolution/gap.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,aAAa,EAAE,aAAa,EAAE,MAAM,YAAY,CAAC;AAE/D;;;;;;GAMG;AACH,wBAAgB,UAAU,CACxB,QAAQ,EAAE,aAAa,EACvB,UAAU,EAAE,MAAM,EAClB,UAAU,EAAE,MAAM,EAClB,GAAG,SAA2B,GAC7B,aAAa,EAAE,CAYjB"}

package/dist/evolution/gap.js

@@ -0,0 +1,52 @@
+/**
+ * Turn a coverage model's blind spots into evidence-backed capability gaps.
+ *
+ * Every gap cites the audit run and snapshot that produced it, plus the
+ * observed fact/pack-list evidence — a gap is a conclusion from recorded
+ * evidence, never free-floating intuition.
+ */
+export function deriveGaps(coverage, auditRunId, snapshotId, now = new Date().toISOString()) {
+    const gaps = [];
+    for (const spot of coverage.blindSpots) {
+        gaps.push(spot.kind === 'unsupported-language' ? languageGap(spot) : sectionGap(spot));
+    }
+    for (const gap of gaps) {
+        gap.auditRunId = auditRunId;
+        gap.snapshotId = snapshotId;
+        gap.createdAt = now;
+        gap.evidence.push(`auditRun:${auditRunId}`, `snapshot:${snapshotId}`);
+    }
+    return gaps;
+}
+function languageGap(spot) {
+    const lang = spot.id.startsWith('lang:') ? spot.id.slice('lang:'.length) : spot.id;
+    return {
+        id: `unsupported-technology:${lang}`,
+        kind: 'unsupported-technology',
+        target: lang,
+        problem: `USA cannot analyze ${lang} repositories — no capability covers this language.`,
+        evidence: [spot.evidence],
+        requiredCapability: `stacks/${lang}`,
+        priority: 'high',
+        auditRunId: '',
+        snapshotId: '',
+        createdAt: '',
+        state: 'open',
+    };
+}
+function sectionGap(spot) {
+    return {
+        id: `unverifiable-property:${spot.id}`,
+        kind: 'unverifiable-property',
+        target: spot.id,
+        problem: spot.detail,
+        evidence: [spot.evidence],
+        requiredCapability: spot.id,
+        priority: 'medium',
+        auditRunId: '',
+        snapshotId: '',
+        createdAt: '',
+        state: 'open',
+    };
+}
+//# sourceMappingURL=gap.js.map

package/dist/evolution/gap.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"gap.js","sourceRoot":"","sources":["../../src/evolution/gap.ts"],"names":[],"mappings":"AAEA;;;;;;GAMG;AACH,MAAM,UAAU,UAAU,CACxB,QAAuB,EACvB,UAAkB,EAClB,UAAkB,EAClB,GAAG,GAAG,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;IAE9B,MAAM,IAAI,GAAoB,EAAE,CAAC;IACjC,KAAK,MAAM,IAAI,IAAI,QAAQ,CAAC,UAAU,EAAE,CAAC;QACvC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,KAAK,sBAAsB,CAAC,CAAC,CAAC,WAAW,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC;IACzF,CAAC;IACD,KAAK,MAAM,GAAG,IAAI,IAAI,EAAE,CAAC;QACvB,GAAG,CAAC,UAAU,GAAG,UAAU,CAAC;QAC5B,GAAG,CAAC,UAAU,GAAG,UAAU,CAAC;QAC5B,GAAG,CAAC,SAAS,GAAG,GAAG,CAAC;QACpB,GAAG,CAAC,QAAQ,CAAC,IAAI,CAAC,YAAY,UAAU,EAAE,EAAE,YAAY,UAAU,EAAE,CAAC,CAAC;IACxE,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED,SAAS,WAAW,CAAC,IAAsD;IACzE,MAAM,IAAI,GAAG,IAAI,CAAC,EAAE,CAAC,UAAU,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC;IACnF,OAAO;QACL,EAAE,EAAE,0BAA0B,IAAI,EAAE;QACpC,IAAI,EAAE,wBAAwB;QAC9B,MAAM,EAAE,IAAI;QACZ,OAAO,EAAE,sBAAsB,IAAI,qDAAqD;QACxF,QAAQ,EAAE,CAAC,IAAI,CAAC,QAAQ,CAAC;QACzB,kBAAkB,EAAE,UAAU,IAAI,EAAE;QACpC,QAAQ,EAAE,MAAM;QAChB,UAAU,EAAE,EAAE;QACd,UAAU,EAAE,EAAE;QACd,SAAS,EAAE,EAAE;QACb,KAAK,EAAE,MAAM;KACd,CAAC;AACJ,CAAC;AAED,SAAS,UAAU,CAAC,IAAsD;IACxE,OAAO;QACL,EAAE,EAAE,yBAAyB,IAAI,CAAC,EAAE,EAAE;QACtC,IAAI,EAAE,uBAAuB;QAC7B,MAAM,EAAE,IAAI,CAAC,EAAE;QACf,OAAO,EAAE,IAAI,CAAC,MAAM;QACpB,QAAQ,EAAE,CAAC,IAAI,CAAC,QAAQ,CAAC;QACzB,kBAAkB,EAAE,IAAI,CAAC,EAAE;QAC3B,QAAQ,EAAE,QAAQ;QAClB,UAAU,EAAE,EAAE;QACd,UAAU,EAAE,EAAE;QACd,SAAS,EAAE,EAAE;QACb,KAAK,EAAE,MAAM;KACd,CAAC;AACJ,CAAC"}