@xenos1996/usa 2.26.2 → 2.27.0

package/dist/engine/audit-config.d.ts

@@ -0,0 +1,66 @@
+import type { Depth, Finding, Maturity, Suppression, UsaConfig } from '../types.js';
+import type { SectionDef } from './sections.js';
+import type { AuditOptions } from './audit-types.js';
+/**
+ * Option, config, and policy resolution for an audit run.
+ *
+ * Everything here turns user input (CLI flags, `.usa.yaml`) into validated
+ * values, and every invalid value warns and falls back instead of throwing:
+ * a typo in a config file must not brick the audit it configures.
+ */
+export declare const DEFAULT_RULES_DIR: string;
+/** Version of this build, read from package.json so it never drifts. */
+export declare const DEFAULT_VERSION: string;
+export declare function normalizeAuditOptions(options: AuditOptions, config: UsaConfig): {
+    rulesDir: string;
+    depth: Depth;
+    profile: Maturity | "auto";
+    allowCommands: boolean;
+    usaVersion: string;
+    target: string;
+    config: UsaConfig;
+};
+/**
+ * Expired (or undated) waivers fail closed: an `until` date in the past — or
+ * one that cannot be parsed — excludes the suppression and raises a warning,
+ * so an audit never silently honours dead risk acceptances.
+ */
+export declare function resolveSuppressions(suppressions: Suppression[] | undefined, warnings: string[]): Suppression[];
+export declare function isSuppressionExpired(rule: string, until: string, warnings: string[]): boolean;
+export declare const MATURITIES: Maturity[];
+/**
+ * CLI --profile wins; otherwise a valid config `maturity` pins the bar;
+ * otherwise auto-detection stands. Invalid config values warn and fall back.
+ */
+export declare function resolveMaturity(cliProfile: Maturity | 'auto', configMaturity: Maturity | undefined, detected: Maturity, warnings: string[]): Maturity;
+/** Restrict scoring and reporting to the configured sections, if any. */
+export declare function selectSections(all: SectionDef[], wanted: string[] | undefined, warnings: string[]): SectionDef[];
+/**
+ * CLI flags win over config file; both are validated with warnings.
+ * Invalid values fall back to engine defaults (never zero, never infinite).
+ */
+export declare function resolveLimits(options: AuditOptions, config: UsaConfig, warnings: string[]): {
+    maxFiles?: number;
+    maxBytes?: number;
+};
+export declare function validatedLimit(v: number | undefined, name: string, warnings: string[]): number | undefined;
+export declare function resolvePackSets(options: AuditOptions, config: UsaConfig): {
+    include: Set<string>;
+    exclude: Set<string>;
+};
+export type RuleOverride = {
+    severity?: Finding['severity'];
+    weight?: number;
+};
+export declare function collectRuleSettings(config: UsaConfig, warnings: string[]): {
+    disabled: Set<string>;
+    overrides: Record<string, RuleOverride>;
+};
+/**
+ * Config overrides flow straight into scoring arithmetic — an invalid severity
+ * yields NaN totals and a negative weight yields scores outside 0–100.
+ * Reject loudly rather than corrupt the report.
+ */
+export declare function validateOverrideSeverity(id: string, v: unknown, warnings: string[]): RuleOverride['severity'];
+export declare function validateOverrideWeight(id: string, v: unknown, warnings: string[]): number | undefined;
+//# sourceMappingURL=audit-config.d.ts.map

package/dist/engine/audit-config.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"audit-config.d.ts","sourceRoot":"","sources":["../../src/engine/audit-config.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EAAE,KAAK,EAAE,OAAO,EAAE,QAAQ,EAAE,WAAW,EAAE,SAAS,EAAE,MAAM,aAAa,CAAC;AACpF,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,eAAe,CAAC;AAEhD,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,kBAAkB,CAAC;AAErD;;;;;;GAMG;AACH,eAAO,MAAM,iBAAiB,QAK7B,CAAC;AAEF,wEAAwE;AACxE,eAAO,MAAM,eAAe,QAYxB,CAAC;AAEL,wBAAgB,qBAAqB,CAAC,OAAO,EAAE,YAAY,EAAE,MAAM,EAAE,SAAS;;;;;;;;EAU7E;AAED;;;;GAIG;AACH,wBAAgB,mBAAmB,CACjC,YAAY,EAAE,WAAW,EAAE,GAAG,SAAS,EACvC,QAAQ,EAAE,MAAM,EAAE,GACjB,WAAW,EAAE,CAQf;AAED,wBAAgB,oBAAoB,CAAC,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,GAAG,OAAO,CAa7F;AAED,eAAO,MAAM,UAAU,EAAE,QAAQ,EAAyD,CAAC;AAE3F;;;GAGG;AACH,wBAAgB,eAAe,CAC7B,UAAU,EAAE,QAAQ,GAAG,MAAM,EAC7B,cAAc,EAAE,QAAQ,GAAG,SAAS,EACpC,QAAQ,EAAE,QAAQ,EAClB,QAAQ,EAAE,MAAM,EAAE,GACjB,QAAQ,CAQV;AAED,yEAAyE;AAEzE,wBAAgB,cAAc,CAC5B,GAAG,EAAE,UAAU,EAAE,EACjB,MAAM,EAAE,MAAM,EAAE,GAAG,SAAS,EAC5B,QAAQ,EAAE,MAAM,EAAE,GACjB,UAAU,EAAE,CAOd;AAED;;;GAGG;AACH,wBAAgB,aAAa,CAC3B,OAAO,EAAE,YAAY,EACrB,MAAM,EAAE,SAAS,EACjB,QAAQ,EAAE,MAAM,EAAE,GACjB;IAAE,QAAQ,CAAC,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,EAAE,MAAM,CAAA;CAAE,CAa1C;AAED,wBAAgB,cAAc,CAC5B,CAAC,EAAE,MAAM,GAAG,SAAS,EACrB,IAAI,EAAE,MAAM,EACZ,QAAQ,EAAE,MAAM,EAAE,GACjB,MAAM,GAAG,SAAS,CAKpB;AAED,wBAAgB,eAAe,CAC7B,OAAO,EAAE,YAAY,EACrB,MAAM,EAAE,SAAS,GAChB;IAAE,OAAO,EAAE,GAAG,CAAC,MAAM,CAAC,CAAC;IAAC,OAAO,EAAE,GAAG,CAAC,MAAM,CAAC,CAAA;CAAE,CAKhD;AAED,MAAM,MAAM,YAAY,GAAG;IAAE,QAAQ,CAAC,EAAE,OAAO,CAAC,UAAU,CAAC,CAAC;IAAC,MAAM,CAAC,EAAE,MAAM,CAAA;CAAE,CAAC;AAE/E,wBAAgB,mBAAmB,CACjC,MAAM,EAAE,SAAS,EACjB,QAAQ,EAAE,MAAM,EAAE,GACjB;IACD,QAAQ,EAAE,GAAG,CAAC,MAAM,CAAC,CAAC;IACtB,SAAS,EAAE,MAAM,CAAC,MAAM,EAAE,YAAY,CAAC,CAAC;CACzC,CAYA;AAED;;;;GAIG;AACH,wBAAgB,wBAAwB,CACtC,EAAE,EAAE,MAAM,EACV,CAAC,EAAE,OAAO,EACV,QAAQ,EAAE,MAAM,EAAE,GACjB,YAAY,CAAC,UAAU,CAAC,CAO1B;AAED,wBAAgB,sBAAsB,CACpC,EAAE,EAAE,MAAM,EACV,CAAC,EAAE,OAAO,EACV,QAAQ,EAAE,MAAM,EAAE,GACjB,MAAM,GAAG,SAAS,CAOpB"}

package/dist/engine/audit-config.js

@@ -0,0 +1,148 @@
+import path from 'node:path';
+import fs from 'node:fs';
+import { fileURLToPath } from 'node:url';
+import { SEVERITY_LADDER } from './loader.js';
+/**
+ * Option, config, and policy resolution for an audit run.
+ *
+ * Everything here turns user input (CLI flags, `.usa.yaml`) into validated
+ * values, and every invalid value warns and falls back instead of throwing:
+ * a typo in a config file must not brick the audit it configures.
+ */
+export const DEFAULT_RULES_DIR = path.resolve(path.dirname(fileURLToPath(import.meta.url)), '..', '..', 'rules');
+/** Version of this build, read from package.json so it never drifts. */
+export const DEFAULT_VERSION = (() => {
+    try {
+        const pkg = JSON.parse(fs.readFileSync(path.resolve(path.dirname(fileURLToPath(import.meta.url)), '..', '..', 'package.json'), 'utf8'));
+        return pkg.version ?? '0.0.0';
+    }
+    catch {
+        return '0.0.0';
+    }
+})();
+export function normalizeAuditOptions(options, config) {
+    return {
+        rulesDir: options.rulesDir ?? DEFAULT_RULES_DIR,
+        depth: options.depth ?? 'standard',
+        profile: options.profile ?? 'auto',
+        allowCommands: options.allowCommands ?? false,
+        usaVersion: options.usaVersion ?? DEFAULT_VERSION,
+        target: options.target,
+        config,
+    };
+}
+/**
+ * Expired (or undated) waivers fail closed: an `until` date in the past — or
+ * one that cannot be parsed — excludes the suppression and raises a warning,
+ * so an audit never silently honours dead risk acceptances.
+ */
+export function resolveSuppressions(suppressions, warnings) {
+    const active = [];
+    for (const s of suppressions ?? []) {
+        if (!s.rule)
+            continue;
+        if (s.until && isSuppressionExpired(s.rule, s.until, warnings))
+            continue;
+        active.push(s);
+    }
+    return active;
+}
+export function isSuppressionExpired(rule, until, warnings) {
+    const t = Date.parse(until);
+    if (Number.isNaN(t)) {
+        warnings.push(`suppression for ${rule} has an unparseable "until" date ("${until}") — waiver ignored`);
+        return true;
+    }
+    if (t < Date.now()) {
+        warnings.push(`suppression for ${rule} expired on ${until} — treating as an active finding`);
+        return true;
+    }
+    return false;
+}
+export const MATURITIES = ['prototype', 'mvp', 'beta', 'production', 'legacy'];
+/**
+ * CLI --profile wins; otherwise a valid config `maturity` pins the bar;
+ * otherwise auto-detection stands. Invalid config values warn and fall back.
+ */
+export function resolveMaturity(cliProfile, configMaturity, detected, warnings) {
+    if (cliProfile !== 'auto')
+        return cliProfile;
+    if (configMaturity === undefined)
+        return detected;
+    if (MATURITIES.includes(configMaturity))
+        return configMaturity;
+    warnings.push(`.usa.yaml: invalid maturity "${String(configMaturity)}" — using auto-detected ${detected}`);
+    return detected;
+}
+/** Restrict scoring and reporting to the configured sections, if any. */
+export function selectSections(all, wanted, warnings) {
+    if (!wanted || wanted.length === 0)
+        return all;
+    const known = new Set(all.map((s) => s.id));
+    for (const id of wanted) {
+        if (!known.has(id))
+            warnings.push(`.usa.yaml: unknown section "${id}" in sections — ignored`);
+    }
+    return all.filter((s) => wanted.includes(s.id));
+}
+/**
+ * CLI flags win over config file; both are validated with warnings.
+ * Invalid values fall back to engine defaults (never zero, never infinite).
+ */
+export function resolveLimits(options, config, warnings) {
+    return {
+        maxFiles: validatedLimit(options.maxFiles ?? config.limits?.max_files, 'limits.max_files / --max-files', warnings),
+        maxBytes: validatedLimit(options.maxBytes ?? config.limits?.max_bytes, 'limits.max_bytes / --max-bytes', warnings),
+    };
+}
+export function validatedLimit(v, name, warnings) {
+    if (v === undefined)
+        return undefined;
+    if (typeof v === 'number' && Number.isFinite(v) && v > 0)
+        return Math.floor(v);
+    warnings.push(`invalid ${name} "${String(v)}" (must be a positive number) — using defaults`);
+    return undefined;
+}
+export function resolvePackSets(options, config) {
+    return {
+        include: new Set(options.includePacks ?? config.include ?? []),
+        exclude: new Set(options.excludePacks ?? config.exclude ?? []),
+    };
+}
+export function collectRuleSettings(config, warnings) {
+    const disabled = new Set();
+    const overrides = {};
+    for (const [id, o] of Object.entries(config.rules ?? {})) {
+        if (o.disabled)
+            disabled.add(id);
+        const severity = validateOverrideSeverity(id, o.severity, warnings);
+        const weight = validateOverrideWeight(id, o.weight, warnings);
+        if (severity !== undefined || weight !== undefined) {
+            overrides[id] = { severity, weight };
+        }
+    }
+    return { disabled, overrides };
+}
+/**
+ * Config overrides flow straight into scoring arithmetic — an invalid severity
+ * yields NaN totals and a negative weight yields scores outside 0–100.
+ * Reject loudly rather than corrupt the report.
+ */
+export function validateOverrideSeverity(id, v, warnings) {
+    if (v === undefined)
+        return undefined;
+    if (SEVERITY_LADDER.includes(String(v))) {
+        return String(v);
+    }
+    warnings.push(`rules.${id}: invalid severity "${String(v)}" — override ignored`);
+    return undefined;
+}
+export function validateOverrideWeight(id, v, warnings) {
+    if (v === undefined)
+        return undefined;
+    if (typeof v === 'number' && Number.isFinite(v) && v >= 0)
+        return v;
+    warnings.push(`rules.${id}: invalid weight "${String(v)}" (must be a finite number ≥ 0) — override ignored`);
+    return undefined;
+}
+//# sourceMappingURL=audit-config.js.map

package/dist/engine/audit-config.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"audit-config.js","sourceRoot":"","sources":["../../src/engine/audit-config.ts"],"names":[],"mappings":"AAAA,OAAO,IAAI,MAAM,WAAW,CAAC;AAC7B,OAAO,EAAE,MAAM,SAAS,CAAC;AACzB,OAAO,EAAE,aAAa,EAAE,MAAM,UAAU,CAAC;AAGzC,OAAO,EAAE,eAAe,EAAE,MAAM,aAAa,CAAC;AAG9C;;;;;;GAMG;AACH,MAAM,CAAC,MAAM,iBAAiB,GAAG,IAAI,CAAC,OAAO,CAC3C,IAAI,CAAC,OAAO,CAAC,aAAa,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,EAC5C,IAAI,EACJ,IAAI,EACJ,OAAO,CACR,CAAC;AAEF,wEAAwE;AACxE,MAAM,CAAC,MAAM,eAAe,GAAG,CAAC,GAAG,EAAE;IACnC,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CACpB,EAAE,CAAC,YAAY,CACb,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,aAAa,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,IAAI,EAAE,IAAI,EAAE,cAAc,CAAC,EACtF,MAAM,CACP,CACsB,CAAC;QAC1B,OAAO,GAAG,CAAC,OAAO,IAAI,OAAO,CAAC;IAChC,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,OAAO,CAAC;IACjB,CAAC;AACH,CAAC,CAAC,EAAE,CAAC;AAEL,MAAM,UAAU,qBAAqB,CAAC,OAAqB,EAAE,MAAiB;IAC5E,OAAO;QACL,QAAQ,EAAE,OAAO,CAAC,QAAQ,IAAI,iBAAiB;QAC/C,KAAK,EAAE,OAAO,CAAC,KAAK,IAAK,UAAoB;QAC7C,OAAO,EAAE,OAAO,CAAC,OAAO,IAAK,MAA4B;QACzD,aAAa,EAAE,OAAO,CAAC,aAAa,IAAI,KAAK;QAC7C,UAAU,EAAE,OAAO,CAAC,UAAU,IAAI,eAAe;QACjD,MAAM,EAAE,OAAO,CAAC,MAAM;QACtB,MAAM;KACP,CAAC;AACJ,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,mBAAmB,CACjC,YAAuC,EACvC,QAAkB;IAElB,MAAM,MAAM,GAAkB,EAAE,CAAC;IACjC,KAAK,MAAM,CAAC,IAAI,YAAY,IAAI,EAAE,EAAE,CAAC;QACnC,IAAI,CAAC,CAAC,CAAC,IAAI;YAAE,SAAS;QACtB,IAAI,CAAC,CAAC,KAAK,IAAI,oBAAoB,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,KAAK,EAAE,QAAQ,CAAC;YAAE,SAAS;QACzE,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IACjB,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,MAAM,UAAU,oBAAoB,CAAC,IAAY,EAAE,KAAa,EAAE,QAAkB;IAClF,MAAM,CAAC,GAAG,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;IAC5B,IAAI,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC;QACpB,QAAQ,CAAC,IAAI,CACX,mBAAmB,IAAI,sCAAsC,KAAK,qBAAqB,CACxF,CAAC;QACF,OAAO,IAAI,CAAC;IACd,CAAC;IACD,IAAI,CAAC,GAAG,IAAI,CAAC,GAAG,EAAE,EAAE,CAAC;QACnB,QAAQ,CAAC,IAAI,CAAC,mBAAmB,IAAI,eAAe,KAAK,kCAAkC,CAAC,CAAC;QAC7F,OAAO,IAAI,CAAC;IACd,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED,MAAM,CAAC,MAAM,UAAU,GAAe,CAAC,WAAW,EAAE,KAAK,EAAE,MAAM,EAAE,YAAY,EAAE,QAAQ,CAAC,CAAC;AAE3F;;;GAGG;AACH,MAAM,UAAU,eAAe,CAC7B,UAA6B,EAC7B,cAAoC,EACpC,QAAkB,EAClB,QAAkB;IAElB,IAAI,UAAU,KAAK,MAAM;QAAE,OAAO,UAAU,CAAC;IAC7C,IAAI,cAAc,KAAK,SAAS;QAAE,OAAO,QAAQ,CAAC;IAClD,IAAK,UAAgC,CAAC,QAAQ,CAAC,cAAc,CAAC;QAAE,OAAO,cAAc,CAAC;IACtF,QAAQ,CAAC,IAAI,CACX,gCAAgC,MAAM,CAAC,cAAc,CAAC,2BAA2B,QAAQ,EAAE,CAC5F,CAAC;IACF,OAAO,QAAQ,CAAC;AAClB,CAAC;AAED,yEAAyE;AAEzE,MAAM,UAAU,cAAc,CAC5B,GAAiB,EACjB,MAA4B,EAC5B,QAAkB;IAElB,IAAI,CAAC,MAAM,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,GAAG,CAAC;IAC/C,MAAM,KAAK,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;IAC5C,KAAK,MAAM,EAAE,IAAI,MAAM,EAAE,CAAC;QACxB,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC;YAAE,QAAQ,CAAC,IAAI,CAAC,+BAA+B,EAAE,yBAAyB,CAAC,CAAC;IAChG,CAAC;IACD,OAAO,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;AAClD,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,aAAa,CAC3B,OAAqB,EACrB,MAAiB,EACjB,QAAkB;IAElB,OAAO;QACL,QAAQ,EAAE,cAAc,CACtB,OAAO,CAAC,QAAQ,IAAI,MAAM,CAAC,MAAM,EAAE,SAAS,EAC5C,gCAAgC,EAChC,QAAQ,CACT;QACD,QAAQ,EAAE,cAAc,CACtB,OAAO,CAAC,QAAQ,IAAI,MAAM,CAAC,MAAM,EAAE,SAAS,EAC5C,gCAAgC,EAChC,QAAQ,CACT;KACF,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,cAAc,CAC5B,CAAqB,EACrB,IAAY,EACZ,QAAkB;IAElB,IAAI,CAAC,KAAK,SAAS;QAAE,OAAO,SAAS,CAAC;IACtC,IAAI,OAAO,CAAC,KAAK,QAAQ,IAAI,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC;QAAE,OAAO,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;IAC/E,QAAQ,CAAC,IAAI,CAAC,WAAW,IAAI,KAAK,MAAM,CAAC,CAAC,CAAC,gDAAgD,CAAC,CAAC;IAC7F,OAAO,SAAS,CAAC;AACnB,CAAC;AAED,MAAM,UAAU,eAAe,CAC7B,OAAqB,EACrB,MAAiB;IAEjB,OAAO;QACL,OAAO,EAAE,IAAI,GAAG,CAAC,OAAO,CAAC,YAAY,IAAI,MAAM,CAAC,OAAO,IAAI,EAAE,CAAC;QAC9D,OAAO,EAAE,IAAI,GAAG,CAAC,OAAO,CAAC,YAAY,IAAI,MAAM,CAAC,OAAO,IAAI,EAAE,CAAC;KAC/D,CAAC;AACJ,CAAC;AAID,MAAM,UAAU,mBAAmB,CACjC,MAAiB,EACjB,QAAkB;IAKlB,MAAM,QAAQ,GAAG,IAAI,GAAG,EAAU,CAAC;IACnC,MAAM,SAAS,GAAiC,EAAE,CAAC;IACnD,KAAK,MAAM,CAAC,EAAE,EAAE,CAAC,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,KAAK,IAAI,EAAE,CAAC,EAAE,CAAC;QACzD,IAAI,CAAC,CAAC,QAAQ;YAAE,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QACjC,MAAM,QAAQ,GAAG,wBAAwB,CAAC,EAAE,EAAE,CAAC,CAAC,QAAQ,EAAE,QAAQ,CAAC,CAAC;QACpE,MAAM,MAAM,GAAG,sBAAsB,CAAC,EAAE,EAAE,CAAC,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAC;QAC9D,IAAI,QAAQ,KAAK,SAAS,IAAI,MAAM,KAAK,SAAS,EAAE,CAAC;YACnD,SAAS,CAAC,EAAE,CAAC,GAAG,EAAE,QAAQ,EAAE,MAAM,EAAE,CAAC;QACvC,CAAC;IACH,CAAC;IACD,OAAO,EAAE,QAAQ,EAAE,SAAS,EAAE,CAAC;AACjC,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,wBAAwB,CACtC,EAAU,EACV,CAAU,EACV,QAAkB;IAElB,IAAI,CAAC,KAAK,SAAS;QAAE,OAAO,SAAS,CAAC;IACtC,IAAK,eAAqC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;QAC/D,OAAO,MAAM,CAAC,CAAC,CAA6B,CAAC;IAC/C,CAAC;IACD,QAAQ,CAAC,IAAI,CAAC,SAAS,EAAE,uBAAuB,MAAM,CAAC,CAAC,CAAC,sBAAsB,CAAC,CAAC;IACjF,OAAO,SAAS,CAAC;AACnB,CAAC;AAED,MAAM,UAAU,sBAAsB,CACpC,EAAU,EACV,CAAU,EACV,QAAkB;IAElB,IAAI,CAAC,KAAK,SAAS;QAAE,OAAO,SAAS,CAAC;IACtC,IAAI,OAAO,CAAC,KAAK,QAAQ,IAAI,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC;QAAE,OAAO,CAAC,CAAC;IACpE,QAAQ,CAAC,IAAI,CACX,SAAS,EAAE,qBAAqB,MAAM,CAAC,CAAC,CAAC,oDAAoD,CAC9F,CAAC;IACF,OAAO,SAAS,CAAC;AACnB,CAAC"}

package/dist/engine/audit-types.d.ts

@@ -0,0 +1,44 @@
+import type { AuditReport, Depth, Maturity, RulePack, UsaConfig } from '../types.js';
+import type { MaturityProfile } from './maturity.js';
+/**
+ * The public shape of an audit run, in its own module so the audit
+ * coordinator and the option/pack/report helpers can all depend on it
+ * without importing each other.
+ */
+export interface AuditOptions {
+    target: string;
+    rulesDir?: string;
+    depth?: Depth;
+    profile?: Maturity | 'auto';
+    config?: UsaConfig;
+    allowCommands?: boolean;
+    usaVersion?: string;
+    /** Force these pack ids on/off regardless of detection. */
+    includePacks?: string[];
+    excludePacks?: string[];
+    /** Indexing caps for bigger-than-comfortable trees (CLI wins over config). */
+    maxFiles?: number;
+    maxBytes?: number;
+    /**
+     * Extra rule packs merged into the loaded set for this run only. This is how
+     * the evolution layer injects a *released* capability into a re-audit without
+     * mutating the on-disk `rules/` registry — the resolved capability set lives
+     * in `capabilitySetId`, not in the filesystem. The CLI never passes this, so
+     * `usa audit` behaviour is unchanged.
+     */
+    extraPacks?: RulePack[];
+    /**
+     * Include the documentation universe audit (14 categories / 220 artifacts,
+     * rules/docs-taxonomy.yaml) in this run: DOCU-* findings join S12. Opt-in
+     * (CLI `--docs-universe` or `.usa.yaml` `docs.universe: true`) so existing
+     * baselines stay stable; the standalone `usa docs audit` runs the same
+     * computation and must agree (AC-8).
+     */
+    docsUniverse?: boolean;
+}
+export interface AuditOutcome {
+    report: AuditReport;
+    warnings: string[];
+    profile: MaturityProfile;
+}
+//# sourceMappingURL=audit-types.d.ts.map

package/dist/engine/audit-types.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"audit-types.d.ts","sourceRoot":"","sources":["../../src/engine/audit-types.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,WAAW,EAAE,KAAK,EAAE,QAAQ,EAAE,QAAQ,EAAE,SAAS,EAAE,MAAM,aAAa,CAAC;AACrF,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,eAAe,CAAC;AAErD;;;;GAIG;AACH,MAAM,WAAW,YAAY;IAC3B,MAAM,EAAE,MAAM,CAAC;IACf,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,KAAK,CAAC,EAAE,KAAK,CAAC;IACd,OAAO,CAAC,EAAE,QAAQ,GAAG,MAAM,CAAC;IAC5B,MAAM,CAAC,EAAE,SAAS,CAAC;IACnB,aAAa,CAAC,EAAE,OAAO,CAAC;IACxB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,2DAA2D;IAC3D,YAAY,CAAC,EAAE,MAAM,EAAE,CAAC;IACxB,YAAY,CAAC,EAAE,MAAM,EAAE,CAAC;IACxB,8EAA8E;IAC9E,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB;;;;;;OAMG;IACH,UAAU,CAAC,EAAE,QAAQ,EAAE,CAAC;IACxB;;;;;;OAMG;IACH,YAAY,CAAC,EAAE,OAAO,CAAC;CACxB;AAED,MAAM,WAAW,YAAY;IAC3B,MAAM,EAAE,WAAW,CAAC;IACpB,QAAQ,EAAE,MAAM,EAAE,CAAC;IACnB,OAAO,EAAE,eAAe,CAAC;CAC1B"}

package/dist/engine/audit-types.js

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=audit-types.js.map

package/dist/engine/audit-types.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"audit-types.js","sourceRoot":"","sources":["../../src/engine/audit-types.ts"],"names":[],"mappings":""}

package/dist/engine/audit-warnings.d.ts

@@ -0,0 +1,56 @@
+import type { Facts } from '../types.js';
+import { type Project } from '../util/project.js';
+import { buildSuppressionIndex } from './suppression.js';
+import { type ReviewIndex } from './review.js';
+/**
+ * Warnings that keep an audit honest about what it could not see.
+ *
+ * A warning is not a finding: it moves no score. It exists because a PASS
+ * computed over a truncated index, a single-commit history, or an ignored
+ * intent file is a weaker claim than it looks, and the report must say so.
+ */
+/**
+ * A waiver that matched nothing is dead weight — usually a rule that no longer
+ * fires there, a renamed file, or a passing rule. Report it so suppressions
+ * decay instead of accumulating (ADR-0022, the ESLint model).
+ */
+export declare function appendUnusedSuppressionWarnings(suppressions: ReturnType<typeof buildSuppressionIndex>, warnings: string[]): void;
+/**
+ * Rank for the declared-vs-detected check (ADR-0041). Legacy is unranked:
+ * a retiring system plays a different game and gets no aspiration warning.
+ */
+export declare const STAGE_RANK: Record<string, number>;
+/**
+ * ADR-0041: declared stage above detected maturity is aspiration beyond
+ * evidence — one loud line, zero moved bars. Severity keeps following
+ * detected maturity (never the declaration), so claiming `prototype` buys
+ * no leniency and claiming `production` buys no strictness.
+ */
+export declare function assertStageAspiration(target: string, detected: string, warnings: string[]): void;
+/**
+ * Declared intent becomes detection facts. The loader throws on a broken
+ * file (fail closed); the audit converts that into a warning and proceeds
+ * without intent facts — a malformed promise must be loud, but it must not
+ * brick the audit it was meant to guide.
+ */
+export declare function assertFoundationFacts(target: string, facts: Facts, warnings: string[]): void;
+/**
+ * A review that matched nothing is dead provenance — the finding was fixed, the
+ * rule renamed, the file moved. A review whose `until` has passed is a decision
+ * nobody has revisited. Both are reported so the ledger decays instead of
+ * accumulating (ADR-0023, the ESLint model applied to attention).
+ */
+export declare function appendReviewWarnings(reviews: ReviewIndex, warnings: string[]): void;
+/**
+ * Scale honesty: a truncated index or skipped oversize files means PASS
+ * verdicts may rest on unseen files. Loud warning, never silent absorption.
+ */
+export declare function appendIndexWarnings(project: Project, warnings: string[]): void;
+/**
+ * History-thin targets blind the history-dependent rules (REPO-003 scans
+ * `git log`, REL-002 needs tags, maturity signals need commits). The
+ * negation in REPO-003 even turns git errors into PASS — true only in the
+ * vacuous sense. Say so loudly instead of scoring blind confidence.
+ */
+export declare function appendHistoryWarnings(git: ReturnType<Project['gitInfo']>, warnings: string[]): void;
+//# sourceMappingURL=audit-warnings.d.ts.map

package/dist/engine/audit-warnings.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"audit-warnings.d.ts","sourceRoot":"","sources":["../../src/engine/audit-warnings.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,KAAK,EAAE,MAAM,aAAa,CAAC;AACzC,OAAO,EAA6B,KAAK,OAAO,EAAE,MAAM,oBAAoB,CAAC;AAC7E,OAAO,EAAE,qBAAqB,EAA2C,MAAM,kBAAkB,CAAC;AAClG,OAAO,EAAqC,KAAK,WAAW,EAAE,MAAM,aAAa,CAAC;AAGlF;;;;;;GAMG;AACH;;;;GAIG;AACH,wBAAgB,+BAA+B,CAC7C,YAAY,EAAE,UAAU,CAAC,OAAO,qBAAqB,CAAC,EACtD,QAAQ,EAAE,MAAM,EAAE,GACjB,IAAI,CAMN;AAED;;;GAGG;AACH,eAAO,MAAM,UAAU,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAoD,CAAC;AAEnG;;;;;GAKG;AACH,wBAAgB,qBAAqB,CAAC,MAAM,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,GAAG,IAAI,CAUhG;AAED;;;;;GAKG;AACH,wBAAgB,qBAAqB,CAAC,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE,KAAK,EAAE,QAAQ,EAAE,MAAM,EAAE,GAAG,IAAI,CAM5F;AAED;;;;;GAKG;AACH,wBAAgB,oBAAoB,CAAC,OAAO,EAAE,WAAW,EAAE,QAAQ,EAAE,MAAM,EAAE,GAAG,IAAI,CAmBnF;AAED;;;GAGG;AACH,wBAAgB,mBAAmB,CAAC,OAAO,EAAE,OAAO,EAAE,QAAQ,EAAE,MAAM,EAAE,GAAG,IAAI,CAmB9E;AAED;;;;;GAKG;AACH,wBAAgB,qBAAqB,CACnC,GAAG,EAAE,UAAU,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC,EACnC,QAAQ,EAAE,MAAM,EAAE,GACjB,IAAI,CAcN"}

package/dist/engine/audit-warnings.js

@@ -0,0 +1,116 @@
+import { MAX_FILE_BYTES, MAX_FILES } from '../util/project.js';
+import { describeSuppression, unusedSuppressions } from './suppression.js';
+import { describeReview, reviewOverdueDays } from './review.js';
+import { loadFoundationFacts, loadFoundationStage } from '../foundation/loader.js';
+/**
+ * Warnings that keep an audit honest about what it could not see.
+ *
+ * A warning is not a finding: it moves no score. It exists because a PASS
+ * computed over a truncated index, a single-commit history, or an ignored
+ * intent file is a weaker claim than it looks, and the report must say so.
+ */
+/**
+ * A waiver that matched nothing is dead weight — usually a rule that no longer
+ * fires there, a renamed file, or a passing rule. Report it so suppressions
+ * decay instead of accumulating (ADR-0022, the ESLint model).
+ */
+export function appendUnusedSuppressionWarnings(suppressions, warnings) {
+    for (const s of unusedSuppressions(suppressions)) {
+        warnings.push(`suppression for ${describeSuppression(s)} matched no finding — remove it or fix the target`);
+    }
+}
+/**
+ * Rank for the declared-vs-detected check (ADR-0041). Legacy is unranked:
+ * a retiring system plays a different game and gets no aspiration warning.
+ */
+export const STAGE_RANK = { prototype: 0, mvp: 1, beta: 2, production: 3 };
+/**
+ * ADR-0041: declared stage above detected maturity is aspiration beyond
+ * evidence — one loud line, zero moved bars. Severity keeps following
+ * detected maturity (never the declaration), so claiming `prototype` buys
+ * no leniency and claiming `production` buys no strictness.
+ */
+export function assertStageAspiration(target, detected, warnings) {
+    const declared = loadFoundationStage(target);
+    if (declared === undefined)
+        return;
+    const want = STAGE_RANK[declared];
+    const have = STAGE_RANK[detected];
+    if (want === undefined || have === undefined || want <= have)
+        return;
+    warnings.push(`declared stage ${declared} exceeds detected maturity ${detected} — grading follows detected; ` +
+        `pass --profile ${declared} to be held to the declared bar explicitly`);
+}
+/**
+ * Declared intent becomes detection facts. The loader throws on a broken
+ * file (fail closed); the audit converts that into a warning and proceeds
+ * without intent facts — a malformed promise must be loud, but it must not
+ * brick the audit it was meant to guide.
+ */
+export function assertFoundationFacts(target, facts, warnings) {
+    try {
+        for (const flag of loadFoundationFacts(target))
+            facts.flags.add(flag);
+    }
+    catch (err) {
+        warnings.push(`foundation intent ignored: ${err.message}`);
+    }
+}
+/**
+ * A review that matched nothing is dead provenance — the finding was fixed, the
+ * rule renamed, the file moved. A review whose `until` has passed is a decision
+ * nobody has revisited. Both are reported so the ledger decays instead of
+ * accumulating (ADR-0023, the ESLint model applied to attention).
+ */
+export function appendReviewWarnings(reviews, warnings) {
+    const nowMs = Date.now();
+    for (const entries of reviews.values()) {
+        for (const entry of entries) {
+            if (!entry.used) {
+                warnings.push(`review for ${describeReview(entry.review)} matched no finding — remove it or re-target it`);
+                continue;
+            }
+            const overdue = reviewOverdueDays(entry.review, nowMs);
+            if (overdue !== null) {
+                warnings.push(`review for ${describeReview(entry.review)} was due ${entry.review.until} — ` +
+                    `overdue by ${overdue} day(s); re-review`);
+            }
+        }
+    }
+}
+/**
+ * Scale honesty: a truncated index or skipped oversize files means PASS
+ * verdicts may rest on unseen files. Loud warning, never silent absorption.
+ */
+export function appendIndexWarnings(project, warnings) {
+    if (project.truncated) {
+        warnings.push(`index truncated at ${MAX_FILES} files — the tree is bigger than the audit can see; ` +
+            'treat PASS verdicts as partial and split the target (e.g. per-package audits)');
+    }
+    if (project.skippedLarge > 0) {
+        warnings.push(`${project.skippedLarge} file(s) skipped for exceeding ${MAX_FILE_BYTES} bytes — ` +
+            'content checks could not see them');
+    }
+    if (project.skippedSymlinks > 0) {
+        warnings.push(`${project.skippedSymlinks} symlink(s) skipped without traversal — ` +
+            'linked source is invisible to every check; materialize it to audit it');
+    }
+}
+/**
+ * History-thin targets blind the history-dependent rules (REPO-003 scans
+ * `git log`, REL-002 needs tags, maturity signals need commits). The
+ * negation in REPO-003 even turns git errors into PASS — true only in the
+ * vacuous sense. Say so loudly instead of scoring blind confidence.
+ */
+export function appendHistoryWarnings(git, warnings) {
+    if (!git.isRepo) {
+        warnings.push('not a git repository — history and provenance checks cannot verify anything; ' +
+            'treat history-dependent findings as vacuous');
+        return;
+    }
+    if (git.commits <= 1) {
+        warnings.push('single-commit history (shallow clone?) — maturity signals, tag checks, and ' +
+            'history scans are under-verified; prefer a full clone for release-grade audits');
+    }
+}
+//# sourceMappingURL=audit-warnings.js.map

package/dist/engine/audit-warnings.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"audit-warnings.js","sourceRoot":"","sources":["../../src/engine/audit-warnings.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,cAAc,EAAE,SAAS,EAAgB,MAAM,oBAAoB,CAAC;AAC7E,OAAO,EAAyB,mBAAmB,EAAE,kBAAkB,EAAE,MAAM,kBAAkB,CAAC;AAClG,OAAO,EAAE,cAAc,EAAE,iBAAiB,EAAoB,MAAM,aAAa,CAAC;AAClF,OAAO,EAAE,mBAAmB,EAAE,mBAAmB,EAAE,MAAM,yBAAyB,CAAC;AAEnF;;;;;;GAMG;AACH;;;;GAIG;AACH,MAAM,UAAU,+BAA+B,CAC7C,YAAsD,EACtD,QAAkB;IAElB,KAAK,MAAM,CAAC,IAAI,kBAAkB,CAAC,YAAY,CAAC,EAAE,CAAC;QACjD,QAAQ,CAAC,IAAI,CACX,mBAAmB,mBAAmB,CAAC,CAAC,CAAC,mDAAmD,CAC7F,CAAC;IACJ,CAAC;AACH,CAAC;AAED;;;GAGG;AACH,MAAM,CAAC,MAAM,UAAU,GAA2B,EAAE,SAAS,EAAE,CAAC,EAAE,GAAG,EAAE,CAAC,EAAE,IAAI,EAAE,CAAC,EAAE,UAAU,EAAE,CAAC,EAAE,CAAC;AAEnG;;;;;GAKG;AACH,MAAM,UAAU,qBAAqB,CAAC,MAAc,EAAE,QAAgB,EAAE,QAAkB;IACxF,MAAM,QAAQ,GAAG,mBAAmB,CAAC,MAAM,CAAC,CAAC;IAC7C,IAAI,QAAQ,KAAK,SAAS;QAAE,OAAO;IACnC,MAAM,IAAI,GAAG,UAAU,CAAC,QAAQ,CAAC,CAAC;IAClC,MAAM,IAAI,GAAG,UAAU,CAAC,QAAQ,CAAC,CAAC;IAClC,IAAI,IAAI,KAAK,SAAS,IAAI,IAAI,KAAK,SAAS,IAAI,IAAI,IAAI,IAAI;QAAE,OAAO;IACrE,QAAQ,CAAC,IAAI,CACX,kBAAkB,QAAQ,8BAA8B,QAAQ,+BAA+B;QAC7F,kBAAkB,QAAQ,4CAA4C,CACzE,CAAC;AACJ,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,qBAAqB,CAAC,MAAc,EAAE,KAAY,EAAE,QAAkB;IACpF,IAAI,CAAC;QACH,KAAK,MAAM,IAAI,IAAI,mBAAmB,CAAC,MAAM,CAAC;YAAE,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;IACxE,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,QAAQ,CAAC,IAAI,CAAC,8BAA+B,GAAa,CAAC,OAAO,EAAE,CAAC,CAAC;IACxE,CAAC;AACH,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,oBAAoB,CAAC,OAAoB,EAAE,QAAkB;IAC3E,MAAM,KAAK,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;IACzB,KAAK,MAAM,OAAO,IAAI,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC;QACvC,KAAK,MAAM,KAAK,IAAI,OAAO,EAAE,CAAC;YAC5B,IAAI,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC;gBAChB,QAAQ,CAAC,IAAI,CACX,cAAc,cAAc,CAAC,KAAK,CAAC,MAAM,CAAC,iDAAiD,CAC5F,CAAC;gBACF,SAAS;YACX,CAAC;YACD,MAAM,OAAO,GAAG,iBAAiB,CAAC,KAAK,CAAC,MAAM,EAAE,KAAK,CAAC,CAAC;YACvD,IAAI,OAAO,KAAK,IAAI,EAAE,CAAC;gBACrB,QAAQ,CAAC,IAAI,CACX,cAAc,cAAc,CAAC,KAAK,CAAC,MAAM,CAAC,YAAY,KAAK,CAAC,MAAM,CAAC,KAAK,KAAK;oBAC3E,cAAc,OAAO,oBAAoB,CAC5C,CAAC;YACJ,CAAC;QACH,CAAC;IACH,CAAC;AACH,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,mBAAmB,CAAC,OAAgB,EAAE,QAAkB;IACtE,IAAI,OAAO,CAAC,SAAS,EAAE,CAAC;QACtB,QAAQ,CAAC,IAAI,CACX,sBAAsB,SAAS,sDAAsD;YACnF,+EAA+E,CAClF,CAAC;IACJ,CAAC;IACD,IAAI,OAAO,CAAC,YAAY,GAAG,CAAC,EAAE,CAAC;QAC7B,QAAQ,CAAC,IAAI,CACX,GAAG,OAAO,CAAC,YAAY,kCAAkC,cAAc,WAAW;YAChF,mCAAmC,CACtC,CAAC;IACJ,CAAC;IACD,IAAI,OAAO,CAAC,eAAe,GAAG,CAAC,EAAE,CAAC;QAChC,QAAQ,CAAC,IAAI,CACX,GAAG,OAAO,CAAC,eAAe,0CAA0C;YAClE,uEAAuE,CAC1E,CAAC;IACJ,CAAC;AACH,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,qBAAqB,CACnC,GAAmC,EACnC,QAAkB;IAElB,IAAI,CAAC,GAAG,CAAC,MAAM,EAAE,CAAC;QAChB,QAAQ,CAAC,IAAI,CACX,+EAA+E;YAC7E,6CAA6C,CAChD,CAAC;QACF,OAAO;IACT,CAAC;IACD,IAAI,GAAG,CAAC,OAAO,IAAI,CAAC,EAAE,CAAC;QACrB,QAAQ,CAAC,IAAI,CACX,6EAA6E;YAC3E,gFAAgF,CACnF,CAAC;IACJ,CAAC;AACH,CAAC"}

package/dist/engine/audit.d.ts

@@ -1,40 +1,16 @@
-import type { AuditReport, Depth, Maturity, RulePack, UsaConfig } from '../types.js';
-import { type MaturityProfile } from './maturity.js';
-export interface AuditOptions {
-    target: string;
-    rulesDir?: string;
-    depth?: Depth;
-    profile?: Maturity | 'auto';
-    config?: UsaConfig;
-    allowCommands?: boolean;
-    usaVersion?: string;
-    /** Force these pack ids on/off regardless of detection. */
-    includePacks?: string[];
-    excludePacks?: string[];
-    /** Indexing caps for bigger-than-comfortable trees (CLI wins over config). */
-    maxFiles?: number;
-    maxBytes?: number;
-    /**
-     * Extra rule packs merged into the loaded set for this run only. This is how
-     * the evolution layer injects a *released* capability into a re-audit without
-     * mutating the on-disk `rules/` registry — the resolved capability set lives
-     * in `capabilitySetId`, not in the filesystem. The CLI never passes this, so
-     * `usa audit` behaviour is unchanged.
-     */
-    extraPacks?: RulePack[];
-    /**
-     * Include the documentation universe audit (14 categories / 220 artifacts,
-     * rules/docs-taxonomy.yaml) in this run: DOCU-* findings join S12. Opt-in
-     * (CLI `--docs-universe` or `.usa.yaml` `docs.universe: true`) so existing
-     * baselines stay stable; the standalone `usa docs audit` runs the same
-     * computation and must agree (AC-8).
-     */
-    docsUniverse?: boolean;
-}
-export interface AuditOutcome {
-    report: AuditReport;
-    warnings: string[];
-    profile: MaturityProfile;
-}
+import type { AuditOptions, AuditOutcome } from './audit-types.js';
+/**
+ * The audit coordinator.
+ *
+ * This module owns the *order* of an audit and nothing else: resolve options,
+ * index the tree, detect facts, choose packs, score, warn about what was not
+ * seen, build the report. Each step lives in a sibling module —
+ * `audit-config` (validation), `pack-selection` (fixed point), `evaluate-packs`
+ * (two-pass scoring), `audit-warnings` (honesty), `report-build` (assembly).
+ *
+ * The split is not cosmetic: at 840 lines this file was the project's only
+ * god file, and these are the seams the pipeline already had.
+ */
+export type { AuditOptions, AuditOutcome } from './audit-types.js';
 export declare function runAudit(options: AuditOptions): AuditOutcome;
 //# sourceMappingURL=audit.d.ts.map

package/dist/engine/audit.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"audit.d.ts","sourceRoot":"","sources":["../../src/engine/audit.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EACV,WAAW,EACX,KAAK,EAGL,QAAQ,EAER,QAAQ,EAER,SAAS,EACV,MAAM,aAAa,CAAC;AA2BrB,OAAO,EAAwB,KAAK,eAAe,EAAE,MAAM,eAAe,CAAC;AA+B3E,MAAM,WAAW,YAAY;IAC3B,MAAM,EAAE,MAAM,CAAC;IACf,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,KAAK,CAAC,EAAE,KAAK,CAAC;IACd,OAAO,CAAC,EAAE,QAAQ,GAAG,MAAM,CAAC;IAC5B,MAAM,CAAC,EAAE,SAAS,CAAC;IACnB,aAAa,CAAC,EAAE,OAAO,CAAC;IACxB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,2DAA2D;IAC3D,YAAY,CAAC,EAAE,MAAM,EAAE,CAAC;IACxB,YAAY,CAAC,EAAE,MAAM,EAAE,CAAC;IACxB,8EAA8E;IAC9E,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB;;;;;;OAMG;IACH,UAAU,CAAC,EAAE,QAAQ,EAAE,CAAC;IACxB;;;;;;OAMG;IACH,YAAY,CAAC,EAAE,OAAO,CAAC;CACxB;AAED,MAAM,WAAW,YAAY;IAC3B,MAAM,EAAE,WAAW,CAAC;IACpB,QAAQ,EAAE,MAAM,EAAE,CAAC;IACnB,OAAO,EAAE,eAAe,CAAC;CAC1B;AAED,wBAAgB,QAAQ,CAAC,OAAO,EAAE,YAAY,GAAG,YAAY,CAkH5D"}
+{"version":3,"file":"audit.d.ts","sourceRoot":"","sources":["../../src/engine/audit.ts"],"names":[],"mappings":"AAWA,OAAO,KAAK,EAAE,YAAY,EAAE,YAAY,EAAE,MAAM,kBAAkB,CAAC;AAsBnE;;;;;;;;;;;GAWG;AAEH,YAAY,EAAE,YAAY,EAAE,YAAY,EAAE,MAAM,kBAAkB,CAAC;AAEnE,wBAAgB,QAAQ,CAAC,OAAO,EAAE,YAAY,GAAG,YAAY,CAkH5D"}