@xenos1996/usa 2.26.2 → 2.28.0

package/dist/cli-help.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"cli-help.d.ts","sourceRoot":"","sources":["../src/cli-help.ts"],"names":[],"mappings":"AAAA,iGAAiG;AAEjG,eAAO,MAAM,gBAAgB,QAOrB,CAAC;AAET,eAAO,MAAM,cAAc,QAcnB,CAAC;AAET,eAAO,MAAM,IAAI,QAiIT,CAAC;AAET,eAAO,MAAM,iBAAiB,mbAmB7B,CAAC"}
+{"version":3,"file":"cli-help.d.ts","sourceRoot":"","sources":["../src/cli-help.ts"],"names":[],"mappings":"AAAA,iGAAiG;AAEjG,eAAO,MAAM,gBAAgB,QAOrB,CAAC;AAET,eAAO,MAAM,cAAc,QAcnB,CAAC;AAET,eAAO,MAAM,IAAI,QAmIT,CAAC;AAET,eAAO,MAAM,iBAAiB,mbAmB7B,CAAC"}

package/dist/cli-help.js

@@ -44,6 +44,8 @@ usa — Universal Software Auditor
   usa foundation show [path]    Print the effective intent and asserted facts
   usa live [path]               Conversational audit session (deterministic without a provider)
   usa serve [opts]              Localhost audit server (loopback only, bearer token)
+  usa scan [path]              Run scanner adapters, write a run manifest + evidence
+  usa intent <model.json>      Compare a declared threat model with observed evidence
   usa models --provider ID      List models the provider advertises
 
 evolve options

package/dist/cli-help.js.map

@@ -1 +1 @@
-{"version":3,"file":"cli-help.js","sourceRoot":"","sources":["../src/cli-help.ts"],"names":[],"mappings":"AAAA,iGAAiG;AAEjG,MAAM,CAAC,MAAM,gBAAgB,GAAG;;;;;;;CAO/B,CAAC,IAAI,EAAE,CAAC;AAET,MAAM,CAAC,MAAM,cAAc,GAAG;;;;;;;;;;;;;;CAc7B,CAAC,IAAI,EAAE,CAAC;AAET,MAAM,CAAC,MAAM,IAAI,GAAG;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAiInB,CAAC,IAAI,EAAE,CAAC;AAET,MAAM,CAAC,MAAM,iBAAiB,GAAG;;;;;;;;;;;;;;;;;;;CAmBhC,CAAC;AAEF,6BAA6B;AAC7B,6EAA6E;AAC7E,8EAA8E;AAC9E,4EAA4E;AAC5E,6EAA6E;AAC7E,2EAA2E"}
+{"version":3,"file":"cli-help.js","sourceRoot":"","sources":["../src/cli-help.ts"],"names":[],"mappings":"AAAA,iGAAiG;AAEjG,MAAM,CAAC,MAAM,gBAAgB,GAAG;;;;;;;CAO/B,CAAC,IAAI,EAAE,CAAC;AAET,MAAM,CAAC,MAAM,cAAc,GAAG;;;;;;;;;;;;;;CAc7B,CAAC,IAAI,EAAE,CAAC;AAET,MAAM,CAAC,MAAM,IAAI,GAAG;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAmInB,CAAC,IAAI,EAAE,CAAC;AAET,MAAM,CAAC,MAAM,iBAAiB,GAAG;;;;;;;;;;;;;;;;;;;CAmBhC,CAAC;AAEF,6BAA6B;AAC7B,6EAA6E;AAC7E,8EAA8E;AAC9E,4EAA4E;AAC5E,6EAA6E;AAC7E,2EAA2E"}

package/dist/cli-intent.d.ts

@@ -0,0 +1,4 @@
+import { type Args } from './cli-args.js';
+export declare const INTENT_HELP = "\nusa intent <model.json>      Read a declared threat model (OTM / Threat Dragon export)\n\noptions\n  --evidence <file>        A `usa scan --json` payload to join against the model\n  --json                   Print the report as JSON\n";
+export declare function cmdIntent(args: Args): number;
+//# sourceMappingURL=cli-intent.d.ts.map

package/dist/cli-intent.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"cli-intent.d.ts","sourceRoot":"","sources":["../src/cli-intent.ts"],"names":[],"mappings":"AAaA,OAAO,EAAa,KAAK,IAAI,EAAE,MAAM,eAAe,CAAC;AAKrD,eAAO,MAAM,WAAW,iPAMvB,CAAC;AAEF,wBAAgB,SAAS,CAAC,IAAI,EAAE,IAAI,GAAG,MAAM,CAoC5C"}

package/dist/cli-intent.js

@@ -0,0 +1,108 @@
+/**
+ * `usa intent` — read a declared threat model and compare it with observed
+ * evidence.
+ *
+ * Two questions, both deterministic:
+ *   1. Which declared threats did any scanner actually observe?
+ *   2. Which CWEs did the scanners observe that the model never declared?
+ *
+ * The second is the more useful one: it is the gap between the design the team
+ * wrote down and the weaknesses the tools found.
+ */
+import fs from 'node:fs';
+import path from 'node:path';
+import { bool, str } from './cli-args.js';
+import { parseOtm, IntentFormatError } from './intent/otm.js';
+import { evidenceFromScanJson, matchThreats } from './intent/match.js';
+export const INTENT_HELP = `
+usa intent <model.json>      Read a declared threat model (OTM / Threat Dragon export)
+
+options
+  --evidence <file>        A \`usa scan --json\` payload to join against the model
+  --json                   Print the report as JSON
+`;
+export function cmdIntent(args) {
+    if (bool(args, 'help')) {
+        console.log(INTENT_HELP);
+        return 0;
+    }
+    const file = args._[1] ?? '';
+    if (!file) {
+        console.error('usage: usa intent <model.json> [--evidence <scan.json>]');
+        return 1;
+    }
+    const modelPath = path.resolve(file);
+    if (!fs.existsSync(modelPath)) {
+        console.error(`model not found: ${modelPath}`);
+        return 1;
+    }
+    let report;
+    try {
+        const model = parseOtm(fs.readFileSync(modelPath, 'utf8'));
+        const evidencePath = str(args, 'evidence');
+        const evidence = evidencePath ? readEvidence(path.resolve(evidencePath)) : [];
+        report = matchThreats(model, evidence);
+    }
+    catch (err) {
+        // A model that cannot be read is a usage error, not a crash.
+        console.error(err instanceof IntentFormatError ? `intent: ${err.message}` : `${err.message}`);
+        return 1;
+    }
+    if (bool(args, 'json')) {
+        console.log(JSON.stringify(report, null, 2));
+        return 0;
+    }
+    printReport(report, Boolean(str(args, 'evidence')));
+    return 0;
+}
+function readEvidence(file) {
+    if (!fs.existsSync(file))
+        throw new Error(`evidence not found: ${file}`);
+    return evidenceFromScanJson(JSON.parse(fs.readFileSync(file, 'utf8')));
+}
+function printReport(report, joined) {
+    printHeader(report);
+    if (!joined) {
+        console.log('\nNo --evidence given: the model is read but nothing is compared.');
+        console.log('Run `usa scan . --json > scan.json` and pass it with --evidence.');
+        return;
+    }
+    printMatches(report);
+    printUnmodelled(report);
+}
+function printHeader(report) {
+    const { model } = report;
+    console.log(`${model.project.name || 'untitled model'} (OTM ${model.version})`);
+    console.log(`  ${model.assets.length} assets · ${model.components.length} components · ` +
+        `${model.dataFlows.length} flows · ${model.trustZones.length} trust zones · ` +
+        `${model.threats.length} threats · ${model.mitigations.length} mitigations`);
+    if (model.unrecognised.length > 0) {
+        console.log(`  not modelled: ${model.unrecognised.join(', ')}`);
+    }
+}
+function printMatches(report) {
+    const { matches } = report;
+    const observed = matches.filter((m) => m.verdict === 'OBSERVED');
+    const notObserved = matches.filter((m) => m.verdict === 'NOT_OBSERVED');
+    const unknown = matches.filter((m) => m.verdict === 'UNKNOWN');
+    console.log(`\nThreats: ${observed.length} observed · ${notObserved.length} not observed · ${unknown.length} unknown`);
+    for (const m of observed)
+        console.log(`  ✅ ${m.threat.name} — ${m.reason} [${m.evidenceIds.join(', ')}]`);
+    for (const m of notObserved)
+        console.log(`  ⚠️  ${m.threat.name} — ${m.reason}`);
+    for (const m of unknown)
+        console.log(`  ❓ ${m.threat.name} — ${m.reason}`);
+}
+function printUnmodelled(report) {
+    if (report.unmodeled.length > 0) {
+        console.log(`\nObserved but not declared in the model (${report.unmodeled.length}):`);
+        for (const u of report.unmodeled)
+            console.log(`  • ${u.cwe} — ${u.evidenceIds.length} evidence item(s)`);
+    }
+    if (report.emptyTrustZones.length > 0) {
+        console.log(`\nDeclared trust zones with no component (${report.emptyTrustZones.length}):`);
+        for (const z of report.emptyTrustZones)
+            console.log(`  • ${z.name || z.id} (${z.type || 'untyped'})`);
+    }
+}
+//# sourceMappingURL=cli-intent.js.map

package/dist/cli-intent.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"cli-intent.js","sourceRoot":"","sources":["../src/cli-intent.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AACH,OAAO,EAAE,MAAM,SAAS,CAAC;AACzB,OAAO,IAAI,MAAM,WAAW,CAAC;AAC7B,OAAO,EAAE,IAAI,EAAE,GAAG,EAAa,MAAM,eAAe,CAAC;AACrD,OAAO,EAAE,QAAQ,EAAE,iBAAiB,EAAE,MAAM,iBAAiB,CAAC;AAC9D,OAAO,EAAE,oBAAoB,EAAE,YAAY,EAAE,MAAM,mBAAmB,CAAC;AAGvE,MAAM,CAAC,MAAM,WAAW,GAAG;;;;;;CAM1B,CAAC;AAEF,MAAM,UAAU,SAAS,CAAC,IAAU;IAClC,IAAI,IAAI,CAAC,IAAI,EAAE,MAAM,CAAC,EAAE,CAAC;QACvB,OAAO,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC;QACzB,OAAO,CAAC,CAAC;IACX,CAAC;IACD,MAAM,IAAI,GAAI,IAAI,CAAC,CAAC,CAAC,CAAC,CAAwB,IAAI,EAAE,CAAC;IACrD,IAAI,CAAC,IAAI,EAAE,CAAC;QACV,OAAO,CAAC,KAAK,CAAC,yDAAyD,CAAC,CAAC;QACzE,OAAO,CAAC,CAAC;IACX,CAAC;IACD,MAAM,SAAS,GAAG,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;IACrC,IAAI,CAAC,EAAE,CAAC,UAAU,CAAC,SAAS,CAAC,EAAE,CAAC;QAC9B,OAAO,CAAC,KAAK,CAAC,oBAAoB,SAAS,EAAE,CAAC,CAAC;QAC/C,OAAO,CAAC,CAAC;IACX,CAAC;IAED,IAAI,MAAoB,CAAC;IACzB,IAAI,CAAC;QACH,MAAM,KAAK,GAAG,QAAQ,CAAC,EAAE,CAAC,YAAY,CAAC,SAAS,EAAE,MAAM,CAAC,CAAC,CAAC;QAC3D,MAAM,YAAY,GAAG,GAAG,CAAC,IAAI,EAAE,UAAU,CAAC,CAAC;QAC3C,MAAM,QAAQ,GAAG,YAAY,CAAC,CAAC,CAAC,YAAY,CAAC,IAAI,CAAC,OAAO,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;QAC9E,MAAM,GAAG,YAAY,CAAC,KAAK,EAAE,QAAQ,CAAC,CAAC;IACzC,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,6DAA6D;QAC7D,OAAO,CAAC,KAAK,CACX,GAAG,YAAY,iBAAiB,CAAC,CAAC,CAAC,WAAW,GAAG,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,GAAI,GAAa,CAAC,OAAO,EAAE,CAC1F,CAAC;QACF,OAAO,CAAC,CAAC;IACX,CAAC;IAED,IAAI,IAAI,CAAC,IAAI,EAAE,MAAM,CAAC,EAAE,CAAC;QACvB,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC;QAC7C,OAAO,CAAC,CAAC;IACX,CAAC;IACD,WAAW,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,CAAC,IAAI,EAAE,UAAU,CAAC,CAAC,CAAC,CAAC;IACpD,OAAO,CAAC,CAAC;AACX,CAAC;AAED,SAAS,YAAY,CAAC,IAAY;IAChC,IAAI,CAAC,EAAE,CAAC,UAAU,CAAC,IAAI,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,uBAAuB,IAAI,EAAE,CAAC,CAAC;IACzE,OAAO,oBAAoB,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,YAAY,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC,CAAC,CAAC;AACzE,CAAC;AAED,SAAS,WAAW,CAAC,MAAoB,EAAE,MAAe;IACxD,WAAW,CAAC,MAAM,CAAC,CAAC;IACpB,IAAI,CAAC,MAAM,EAAE,CAAC;QACZ,OAAO,CAAC,GAAG,CAAC,mEAAmE,CAAC,CAAC;QACjF,OAAO,CAAC,GAAG,CAAC,kEAAkE,CAAC,CAAC;QAChF,OAAO;IACT,CAAC;IACD,YAAY,CAAC,MAAM,CAAC,CAAC;IACrB,eAAe,CAAC,MAAM,CAAC,CAAC;AAC1B,CAAC;AAED,SAAS,WAAW,CAAC,MAAoB;IACvC,MAAM,EAAE,KAAK,EAAE,GAAG,MAAM,CAAC;IACzB,OAAO,CAAC,GAAG,CAAC,GAAG,KAAK,CAAC,OAAO,CAAC,IAAI,IAAI,gBAAgB,SAAS,KAAK,CAAC,OAAO,GAAG,CAAC,CAAC;IAChF,OAAO,CAAC,GAAG,CACT,KAAK,KAAK,CAAC,MAAM,CAAC,MAAM,aAAa,KAAK,CAAC,UAAU,CAAC,MAAM,gBAAgB;QAC1E,GAAG,KAAK,CAAC,SAAS,CAAC,MAAM,YAAY,KAAK,CAAC,UAAU,CAAC,MAAM,iBAAiB;QAC7E,GAAG,KAAK,CAAC,OAAO,CAAC,MAAM,cAAc,KAAK,CAAC,WAAW,CAAC,MAAM,cAAc,CAC9E,CAAC;IACF,IAAI,KAAK,CAAC,YAAY,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAClC,OAAO,CAAC,GAAG,CAAC,mBAAmB,KAAK,CAAC,YAAY,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IAClE,CAAC;AACH,CAAC;AAED,SAAS,YAAY,CAAC,MAAoB;IACxC,MAAM,EAAE,OAAO,EAAE,GAAG,MAAM,CAAC;IAC3B,MAAM,QAAQ,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,OAAO,KAAK,UAAU,CAAC,CAAC;IACjE,MAAM,WAAW,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,OAAO,KAAK,cAAc,CAAC,CAAC;IACxE,MAAM,OAAO,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,OAAO,KAAK,SAAS,CAAC,CAAC;IAC/D,OAAO,CAAC,GAAG,CACT,cAAc,QAAQ,CAAC,MAAM,eAAe,WAAW,CAAC,MAAM,mBAAmB,OAAO,CAAC,MAAM,UAAU,CAC1G,CAAC;IACF,KAAK,MAAM,CAAC,IAAI,QAAQ;QACtB,OAAO,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,MAAM,CAAC,IAAI,MAAM,CAAC,CAAC,MAAM,KAAK,CAAC,CAAC,WAAW,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IAClF,KAAK,MAAM,CAAC,IAAI,WAAW;QAAE,OAAO,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC,MAAM,CAAC,IAAI,MAAM,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC;IACjF,KAAK,MAAM,CAAC,IAAI,OAAO;QAAE,OAAO,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,MAAM,CAAC,IAAI,MAAM,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC;AAC7E,CAAC;AAED,SAAS,eAAe,CAAC,MAAoB;IAC3C,IAAI,MAAM,CAAC,SAAS,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAChC,OAAO,CAAC,GAAG,CAAC,6CAA6C,MAAM,CAAC,SAAS,CAAC,MAAM,IAAI,CAAC,CAAC;QACtF,KAAK,MAAM,CAAC,IAAI,MAAM,CAAC,SAAS;YAC9B,OAAO,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,GAAG,MAAM,CAAC,CAAC,WAAW,CAAC,MAAM,mBAAmB,CAAC,CAAC;IAC3E,CAAC;IACD,IAAI,MAAM,CAAC,eAAe,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACtC,OAAO,CAAC,GAAG,CAAC,6CAA6C,MAAM,CAAC,eAAe,CAAC,MAAM,IAAI,CAAC,CAAC;QAC5F,KAAK,MAAM,CAAC,IAAI,MAAM,CAAC,eAAe;YACpC,OAAO,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,IAAI,IAAI,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC,IAAI,IAAI,SAAS,GAAG,CAAC,CAAC;IAClE,CAAC;AACH,CAAC"}

package/dist/cli-scan.d.ts

@@ -0,0 +1,12 @@
+import { type Args } from './cli-args.js';
+import type { ScanResult } from './scanner/types.js';
+export declare const SCAN_HELP = "\nusa scan [path]            Run scanner adapters, write a run manifest + evidence\n\noptions\n  --out <file>             Evidence report path (default .usa/evidence/<id>.md)\n  --scanner <id>           Run only this adapter (repeatable, or comma list)\n  --network                Allow adapters that declare they need network\n  --allow-build-commands   Permit build-requiring scanners (recorded, opt-in)\n  --json                   Print the manifest and evidence as JSON\n";
+export declare function cmdScan(args: Args): number;
+/** `--scanner a,b` and repeated occurrences both work. */
+export declare function parseScanners(args: Args): string[] | undefined;
+export declare function reportToStdout(result: ScanResult, out: string): void;
+/** A markdown artifact a human can read and a rule pack can cite. */
+export declare function writeEvidenceReport(out: string, result: ScanResult): void;
+/** Exported for tests: which adapters a config enables by default. */
+export declare function defaultEnabled(): string[];
+//# sourceMappingURL=cli-scan.d.ts.map

package/dist/cli-scan.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"cli-scan.d.ts","sourceRoot":"","sources":["../src/cli-scan.ts"],"names":[],"mappings":"AASA,OAAO,EAAiC,KAAK,IAAI,EAAE,MAAM,eAAe,CAAC;AAIzE,OAAO,KAAK,EAAc,UAAU,EAAE,MAAM,oBAAoB,CAAC;AAEjE,eAAO,MAAM,SAAS,geASrB,CAAC;AAEF,wBAAgB,OAAO,CAAC,IAAI,EAAE,IAAI,GAAG,MAAM,CA6C1C;AAED,0DAA0D;AAC1D,wBAAgB,aAAa,CAAC,IAAI,EAAE,IAAI,GAAG,MAAM,EAAE,GAAG,SAAS,CAO9D;AAED,wBAAgB,cAAc,CAAC,MAAM,EAAE,UAAU,EAAE,GAAG,EAAE,MAAM,GAAG,IAAI,CAYpE;AAED,qEAAqE;AACrE,wBAAgB,mBAAmB,CAAC,GAAG,EAAE,MAAM,EAAE,MAAM,EAAE,UAAU,GAAG,IAAI,CAyCzE;AAED,sEAAsE;AACtE,wBAAgB,cAAc,IAAI,MAAM,EAAE,CAEzC"}

package/dist/cli-scan.js

@@ -0,0 +1,142 @@
+/**
+ * `usa scan` — run the Tier-1 scanner adapters and write evidence artifacts.
+ *
+ * This command never merges scanner output into AUDIT.md and never changes a
+ * rule verdict: it produces a run manifest plus evidence, which a rule consumes
+ * later through the existing `oracle` check. `usa audit` semantics are untouched.
+ */
+import fs from 'node:fs';
+import path from 'node:path';
+import { str, bool, list, dryRunWrites } from './cli-args.js';
+import { ScannerRunner } from './scanner/run.js';
+import { enabledAdapters, scanners } from './scanner/registry.js';
+import { loadScannerConfig } from './scanner/config.js';
+export const SCAN_HELP = `
+usa scan [path]            Run scanner adapters, write a run manifest + evidence
+
+options
+  --out <file>             Evidence report path (default .usa/evidence/<id>.md)
+  --scanner <id>           Run only this adapter (repeatable, or comma list)
+  --network                Allow adapters that declare they need network
+  --allow-build-commands   Permit build-requiring scanners (recorded, opt-in)
+  --json                   Print the manifest and evidence as JSON
+`;
+export function cmdScan(args) {
+    if (bool(args, 'help')) {
+        console.log(SCAN_HELP);
+        return 0;
+    }
+    // `_` includes the command word itself (scan .), so the path is index 1.
+    const positional = args._[1] ?? '.';
+    const root = path.resolve(positional);
+    if (!fs.existsSync(root)) {
+        console.error(`path not found: ${root}`);
+        return 1;
+    }
+    const runner = new ScannerRunner(scanners);
+    const only = parseScanners(args);
+    let result;
+    try {
+        result = runner.run({
+            target: root,
+            adapters: only,
+            config: loadScannerConfig(root),
+            network: bool(args, 'network'),
+            allowBuildCommands: bool(args, 'allow-build-commands'),
+        });
+    }
+    catch (err) {
+        // A bad --scanner id is a usage error: the message names the known ids.
+        console.error(`${err.message}`);
+        return 1;
+    }
+    if (bool(args, 'json')) {
+        console.log(JSON.stringify(result, null, 2));
+        return 0;
+    }
+    // Mirrors `usa audit --out`: a relative path resolves against the target the
+    // operator named, so the artifact lands inside that project rather than
+    // wherever the process happened to start.
+    const outArg = str(args, 'out') ?? ['.usa', 'evidence', result.manifest.executionId + '.md'].join('/');
+    const out = path.resolve(root, outArg);
+    if (!dryRunWrites(args, [out]))
+        return 0;
+    writeEvidenceReport(out, result);
+    reportToStdout(result, out);
+    return 0;
+}
+/** `--scanner a,b` and repeated occurrences both work. */
+export function parseScanners(args) {
+    const raw = [...list(args, 'scanner'), ...list(args, 'scanners')];
+    const ids = raw
+        .flatMap((entry) => entry.split(','))
+        .map((s) => s.trim())
+        .filter(Boolean);
+    return ids.length > 0 ? ids : undefined;
+}
+export function reportToStdout(result, out) {
+    const { manifest } = result;
+    console.log(`scan ${manifest.target} @ ${manifest.repositoryRevision}`);
+    for (const a of manifest.adapters) {
+        if (a.status === 'ok') {
+            console.log(`  ✅ ${a.id} ${a.version} → ${a.evidenceCount} evidence item(s)`);
+        }
+        else {
+            console.log(`  ⚠️  ${a.id} ${a.status}: ${a.reason ?? 'no detail'}`);
+        }
+    }
+    const findings = result.findings.length;
+    console.log(`${result.evidence.length} evidence · ${findings} findings → ${out}`);
+}
+/** A markdown artifact a human can read and a rule pack can cite. */
+export function writeEvidenceReport(out, result) {
+    const { manifest, evidence, findings } = result;
+    const lines = [
+        '# Scanner evidence',
+        '',
+        `- execution: \`${manifest.executionId}\``,
+        `- target: \`${manifest.target}\``,
+        `- revision: \`${manifest.repositoryRevision}\``,
+        `- timestamp: ${manifest.timestamp}`,
+        `- sandbox: ${manifest.environment.sandbox} · network ${manifest.environment.network}`,
+        '',
+        '## Coverage',
+        '',
+        '| Adapter | Version | Status | Evidence | Time | Source |',
+        '| --- | --- | --- | --- | --- | --- |',
+        ...manifest.adapters.map((a) => `| ${a.id} | ${a.version || '—'} | ${a.status}${a.reason ? ` (${a.reason})` : ''} | ${a.evidenceCount} | ${a.elapsedMs}ms | ${evidenceSource(a)} |`),
+        '',
+        '## Evidence',
+        '',
+    ];
+    for (const e of evidence) {
+        const where = e.location
+            ? `${e.location.file}${e.location.line ? `:${e.location.line}` : ''}`
+            : '—';
+        lines.push(`- \`${e.id}\` **${e.source.tool}** ${e.severity} · \`${e.source.identifier}\` — ${e.claim} (${where})`);
+    }
+    if (findings.length > 0) {
+        lines.push('', '## Findings', '');
+        for (const f of findings) {
+            lines.push(`- **${f.severity}** ${f.title} — ${f.remediation} [evidence: ${f.evidenceIds.join(', ')}]`);
+        }
+    }
+    fs.mkdirSync(path.dirname(path.resolve(out)), { recursive: true });
+    fs.writeFileSync(out, lines.join('\n') + '\n');
+}
+/** Exported for tests: which adapters a config enables by default. */
+export function defaultEnabled() {
+    return enabledAdapters({}).map((a) => a.id);
+}
+/**
+ * Where an adapter's evidence came from, and whether the process objected.
+ *
+ * A tool that writes its payload to a file and one that prints it are different
+ * enough to be worth saying out loud: the file-based case is the one that used
+ * to be parsed from the wrong stream.
+ */
+function evidenceSource(a) {
+    const where = a.artifact ? `\`${a.artifact}\`` : 'stdout';
+    return a.exitCode ? `${where} (exit ${a.exitCode})` : where;
+}
+//# sourceMappingURL=cli-scan.js.map

package/dist/cli-scan.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"cli-scan.js","sourceRoot":"","sources":["../src/cli-scan.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AACH,OAAO,EAAE,MAAM,SAAS,CAAC;AACzB,OAAO,IAAI,MAAM,WAAW,CAAC;AAC7B,OAAO,EAAE,GAAG,EAAE,IAAI,EAAE,IAAI,EAAE,YAAY,EAAa,MAAM,eAAe,CAAC;AACzE,OAAO,EAAE,aAAa,EAAE,MAAM,kBAAkB,CAAC;AACjD,OAAO,EAAE,eAAe,EAAE,QAAQ,EAAE,MAAM,uBAAuB,CAAC;AAClE,OAAO,EAAE,iBAAiB,EAAE,MAAM,qBAAqB,CAAC;AAGxD,MAAM,CAAC,MAAM,SAAS,GAAG;;;;;;;;;CASxB,CAAC;AAEF,MAAM,UAAU,OAAO,CAAC,IAAU;IAChC,IAAI,IAAI,CAAC,IAAI,EAAE,MAAM,CAAC,EAAE,CAAC;QACvB,OAAO,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;QACvB,OAAO,CAAC,CAAC;IACX,CAAC;IACD,yEAAyE;IACzE,MAAM,UAAU,GAAI,IAAI,CAAC,CAAC,CAAC,CAAC,CAAwB,IAAI,GAAG,CAAC;IAC5D,MAAM,IAAI,GAAG,IAAI,CAAC,OAAO,CAAC,UAAU,CAAC,CAAC;IACtC,IAAI,CAAC,EAAE,CAAC,UAAU,CAAC,IAAI,CAAC,EAAE,CAAC;QACzB,OAAO,CAAC,KAAK,CAAC,mBAAmB,IAAI,EAAE,CAAC,CAAC;QACzC,OAAO,CAAC,CAAC;IACX,CAAC;IACD,MAAM,MAAM,GAAG,IAAI,aAAa,CAAC,QAAQ,CAAC,CAAC;IAC3C,MAAM,IAAI,GAAG,aAAa,CAAC,IAAI,CAAC,CAAC;IAEjC,IAAI,MAAkB,CAAC;IACvB,IAAI,CAAC;QACH,MAAM,GAAG,MAAM,CAAC,GAAG,CAAC;YAClB,MAAM,EAAE,IAAI;YACZ,QAAQ,EAAE,IAAI;YACd,MAAM,EAAE,iBAAiB,CAAC,IAAI,CAAC;YAC/B,OAAO,EAAE,IAAI,CAAC,IAAI,EAAE,SAAS,CAAC;YAC9B,kBAAkB,EAAE,IAAI,CAAC,IAAI,EAAE,sBAAsB,CAAC;SACvD,CAAC,CAAC;IACL,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,wEAAwE;QACxE,OAAO,CAAC,KAAK,CAAC,GAAI,GAAa,CAAC,OAAO,EAAE,CAAC,CAAC;QAC3C,OAAO,CAAC,CAAC;IACX,CAAC;IAED,IAAI,IAAI,CAAC,IAAI,EAAE,MAAM,CAAC,EAAE,CAAC;QACvB,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC;QAC7C,OAAO,CAAC,CAAC;IACX,CAAC;IAED,6EAA6E;IAC7E,wEAAwE;IACxE,0CAA0C;IAC1C,MAAM,MAAM,GACV,GAAG,CAAC,IAAI,EAAE,KAAK,CAAC,IAAI,CAAC,MAAM,EAAE,UAAU,EAAE,MAAM,CAAC,QAAQ,CAAC,WAAW,GAAG,KAAK,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IAC1F,MAAM,GAAG,GAAG,IAAI,CAAC,OAAO,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;IACvC,IAAI,CAAC,YAAY,CAAC,IAAI,EAAE,CAAC,GAAG,CAAC,CAAC;QAAE,OAAO,CAAC,CAAC;IACzC,mBAAmB,CAAC,GAAG,EAAE,MAAM,CAAC,CAAC;IACjC,cAAc,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC;IAC5B,OAAO,CAAC,CAAC;AACX,CAAC;AAED,0DAA0D;AAC1D,MAAM,UAAU,aAAa,CAAC,IAAU;IACtC,MAAM,GAAG,GAAG,CAAC,GAAG,IAAI,CAAC,IAAI,EAAE,SAAS,CAAC,EAAE,GAAG,IAAI,CAAC,IAAI,EAAE,UAAU,CAAC,CAAC,CAAC;IAClE,MAAM,GAAG,GAAG,GAAG;SACZ,OAAO,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;SACpC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;SACpB,MAAM,CAAC,OAAO,CAAC,CAAC;IACnB,OAAO,GAAG,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,SAAS,CAAC;AAC1C,CAAC;AAED,MAAM,UAAU,cAAc,CAAC,MAAkB,EAAE,GAAW;IAC5D,MAAM,EAAE,QAAQ,EAAE,GAAG,MAAM,CAAC;IAC5B,OAAO,CAAC,GAAG,CAAC,QAAQ,QAAQ,CAAC,MAAM,MAAM,QAAQ,CAAC,kBAAkB,EAAE,CAAC,CAAC;IACxE,KAAK,MAAM,CAAC,IAAI,QAAQ,CAAC,QAAQ,EAAE,CAAC;QAClC,IAAI,CAAC,CAAC,MAAM,KAAK,IAAI,EAAE,CAAC;YACtB,OAAO,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,EAAE,IAAI,CAAC,CAAC,OAAO,MAAM,CAAC,CAAC,aAAa,mBAAmB,CAAC,CAAC;QAChF,CAAC;aAAM,CAAC;YACN,OAAO,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC,EAAE,IAAI,CAAC,CAAC,MAAM,KAAK,CAAC,CAAC,MAAM,IAAI,WAAW,EAAE,CAAC,CAAC;QACvE,CAAC;IACH,CAAC;IACD,MAAM,QAAQ,GAAG,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC;IACxC,OAAO,CAAC,GAAG,CAAC,GAAG,MAAM,CAAC,QAAQ,CAAC,MAAM,eAAe,QAAQ,eAAe,GAAG,EAAE,CAAC,CAAC;AACpF,CAAC;AAED,qEAAqE;AACrE,MAAM,UAAU,mBAAmB,CAAC,GAAW,EAAE,MAAkB;IACjE,MAAM,EAAE,QAAQ,EAAE,QAAQ,EAAE,QAAQ,EAAE,GAAG,MAAM,CAAC;IAChD,MAAM,KAAK,GAAa;QACtB,oBAAoB;QACpB,EAAE;QACF,kBAAkB,QAAQ,CAAC,WAAW,IAAI;QAC1C,eAAe,QAAQ,CAAC,MAAM,IAAI;QAClC,iBAAiB,QAAQ,CAAC,kBAAkB,IAAI;QAChD,gBAAgB,QAAQ,CAAC,SAAS,EAAE;QACpC,cAAc,QAAQ,CAAC,WAAW,CAAC,OAAO,cAAc,QAAQ,CAAC,WAAW,CAAC,OAAO,EAAE;QACtF,EAAE;QACF,aAAa;QACb,EAAE;QACF,2DAA2D;QAC3D,uCAAuC;QACvC,GAAG,QAAQ,CAAC,QAAQ,CAAC,GAAG,CACtB,CAAC,CAAC,EAAE,EAAE,CACJ,KAAK,CAAC,CAAC,EAAE,MAAM,CAAC,CAAC,OAAO,IAAI,GAAG,MAAM,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,EAAE,MAAM,CAAC,CAAC,aAAa,MAAM,CAAC,CAAC,SAAS,QAAQ,cAAc,CAAC,CAAC,CAAC,IAAI,CACtJ;QACD,EAAE;QACF,aAAa;QACb,EAAE;KACH,CAAC;IACF,KAAK,MAAM,CAAC,IAAI,QAAQ,EAAE,CAAC;QACzB,MAAM,KAAK,GAAG,CAAC,CAAC,QAAQ;YACtB,CAAC,CAAC,GAAG,CAAC,CAAC,QAAQ,CAAC,IAAI,GAAG,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,QAAQ,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,EAAE;YACrE,CAAC,CAAC,GAAG,CAAC;QACR,KAAK,CAAC,IAAI,CACR,OAAO,CAAC,CAAC,EAAE,QAAQ,CAAC,CAAC,MAAM,CAAC,IAAI,MAAM,CAAC,CAAC,QAAQ,QAAQ,CAAC,CAAC,MAAM,CAAC,UAAU,QAAQ,CAAC,CAAC,KAAK,KAAK,KAAK,GAAG,CACxG,CAAC;IACJ,CAAC;IACD,IAAI,QAAQ,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACxB,KAAK,CAAC,IAAI,CAAC,EAAE,EAAE,aAAa,EAAE,EAAE,CAAC,CAAC;QAClC,KAAK,MAAM,CAAC,IAAI,QAAQ,EAAE,CAAC;YACzB,KAAK,CAAC,IAAI,CACR,OAAO,CAAC,CAAC,QAAQ,MAAM,CAAC,CAAC,KAAK,MAAM,CAAC,CAAC,WAAW,eAAe,CAAC,CAAC,WAAW,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAC5F,CAAC;QACJ,CAAC;IACH,CAAC;IACD,EAAE,CAAC,SAAS,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IACnE,EAAE,CAAC,aAAa,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,IAAI,CAAC,CAAC;AACjD,CAAC;AAED,sEAAsE;AACtE,MAAM,UAAU,cAAc;IAC5B,OAAO,eAAe,CAAC,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;AAC9C,CAAC;AAED;;;;;;GAMG;AACH,SAAS,cAAc,CAAC,CAAa;IACnC,MAAM,KAAK,GAAG,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,QAAQ,IAAI,CAAC,CAAC,CAAC,QAAQ,CAAC;IAC1D,OAAO,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,GAAG,KAAK,UAAU,CAAC,CAAC,QAAQ,GAAG,CAAC,CAAC,CAAC,KAAK,CAAC;AAC9D,CAAC"}

package/dist/cli.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"cli.d.ts","sourceRoot":"","sources":["../src/cli.ts"],"names":[],"mappings":";AAuDA,wBAAgB,IAAI,CAAC,IAAI,EAAE,MAAM,EAAE,GAAG,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CA2B7D;AAID,+EAA+E;AAE/E,iBAAS,YAAY,CACnB,KAAK,GAAE,MAAM,GAAG,SAA2B,EAC3C,OAAO,GAAE,MAAwB,GAChC,OAAO,CAOT;AAED,OAAO,EAAE,YAAY,EAAE,CAAC"}
+{"version":3,"file":"cli.d.ts","sourceRoot":"","sources":["../src/cli.ts"],"names":[],"mappings":";AA2DA,wBAAgB,IAAI,CAAC,IAAI,EAAE,MAAM,EAAE,GAAG,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CA2B7D;AAID,+EAA+E;AAE/E,iBAAS,YAAY,CACnB,KAAK,GAAE,MAAM,GAAG,SAA2B,EAC3C,OAAO,GAAE,MAAwB,GAChC,OAAO,CAOT;AAED,OAAO,EAAE,YAAY,EAAE,CAAC"}

package/dist/cli.js

@@ -12,6 +12,8 @@ import { cmdDiff, cmdVerifyReport } from './cli-reports.js';
 import { cmdBootstrap, cmdInit, cmdLearn } from './cli-scaffold.js';
 import { cmdEvolve } from './cli-evolve.js';
 import { cmdServe } from './cli-serve.js';
+import { cmdScan } from './cli-scan.js';
+import { cmdIntent } from './cli-intent.js';
 /** Dispatch only: every command lives in its own cli-*.ts module. */
 /* -------------------------------------------------------------------- main -- */
 const COMMANDS = {
@@ -32,6 +34,8 @@ const COMMANDS = {
     live: cmdLive,
     models: cmdModels,
     serve: cmdServe,
+    scan: cmdScan,
+    intent: cmdIntent,
 };
 /** Global --help/--version, resolved before dispatch. Returns null to continue. */
 function handleTopLevelFlags(args, cmd) {

package/dist/cli.js.map

@@ -1 +1 @@
-{"version":3,"file":"cli.js","sourceRoot":"","sources":["../src/cli.ts"],"names":[],"mappings":";AACA,OAAO,EAAE,MAAM,SAAS,CAAC;AACzB,OAAO,EAAE,aAAa,EAAE,MAAM,UAAU,CAAC;AACzC,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,SAAS,EAAa,MAAM,eAAe,CAAC;AACpE,OAAO,EAAE,IAAI,EAAE,MAAM,eAAe,CAAC;AACrC,OAAO,EAAE,WAAW,EAAE,MAAM,eAAe,CAAC;AAC5C,OAAO,EAAE,QAAQ,EAAE,MAAM,gBAAgB,CAAC;AAC1C,OAAO,EAAE,OAAO,EAAE,MAAM,eAAe,CAAC;AACxC,OAAO,EAAE,SAAS,EAAE,QAAQ,EAAE,UAAU,EAAE,YAAY,EAAE,aAAa,EAAE,MAAM,gBAAgB,CAAC;AAC9F,OAAO,EAAE,aAAa,EAAE,OAAO,EAAE,SAAS,EAAE,MAAM,kBAAkB,CAAC;AACrE,OAAO,EAAE,OAAO,EAAE,eAAe,EAAE,MAAM,kBAAkB,CAAC;AAC5D,OAAO,EAAE,YAAY,EAAE,OAAO,EAAE,QAAQ,EAAE,MAAM,mBAAmB,CAAC;AACpE,OAAO,EAAE,SAAS,EAAE,MAAM,iBAAiB,CAAC;AAC5C,OAAO,EAAE,QAAQ,EAAE,MAAM,gBAAgB,CAAC;AAE1C,qEAAqE;AACrE,kFAAkF;AAElF,MAAM,QAAQ,GAA6D;IACzE,KAAK,EAAE,QAAQ;IACf,IAAI,EAAE,OAAO;IACb,MAAM,EAAE,SAAS;IACjB,KAAK,EAAE,QAAQ;IACf,OAAO,EAAE,UAAU;IACnB,IAAI,EAAE,OAAO;IACb,eAAe,EAAE,eAAe;IAChC,IAAI,EAAE,OAAO;IACb,SAAS,EAAE,YAAY;IACvB,KAAK,EAAE,QAAQ;IACf,MAAM,EAAE,SAAS;IACjB,SAAS,EAAE,YAAY;IACvB,UAAU,EAAE,aAAa;IACzB,UAAU,EAAE,aAAa;IACzB,IAAI,EAAE,OAAO;IACb,MAAM,EAAE,SAAS;IACjB,KAAK,EAAE,QAAQ;CAChB,CAAC;AAEF,mFAAmF;AACnF,SAAS,mBAAmB,CAAC,IAAU,EAAE,GAAW;IAClD,IAAI,IAAI,CAAC,IAAI,EAAE,MAAM,CAAC,EAAE,CAAC;QACvB,2EAA2E;QAC3E,qEAAqE;QACrE,IAAI,GAAG,KAAK,MAAM;YAAE,OAAO,OAAO,CAAC,IAAI,CAAC,CAAC;QACzC,IAAI,GAAG,KAAK,MAAM;YAAE,OAAO,OAAO,CAAC,IAAI,CAAC,CAAC;QACzC,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;QAClB,OAAO,CAAC,CAAC;IACX,CAAC;IACD,IAAI,IAAI,CAAC,IAAI,EAAE,SAAS,CAAC,EAAE,CAAC;QAC1B,OAAO,CAAC,GAAG,CAAC,OAAO,OAAO,EAAE,CAAC,CAAC;QAC9B,OAAO,CAAC,CAAC;IACX,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED,MAAM,UAAU,IAAI,CAAC,IAAc;IACjC,2EAA2E;IAC3E,6EAA6E;IAC7E,4EAA4E;IAC5E,WAAW,CAAC,OAAO,CAAC,GAAG,EAAE,CAAC,CAAC;IAC3B,MAAM,IAAI,GAAG,SAAS,CAAC,IAAI,CAAC,CAAC;IAC7B,MAAM,GAAG,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,OAAO,CAAW,CAAC;IAC7C,MAAM,OAAO,GAAG,mBAAmB,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC;IAC/C,IAAI,OAAO,KAAK,IAAI;QAAE,OAAO,OAAO,CAAC;IAErC,MAAM,GAAG,GAAG,QAAQ,CAAC,GAAG,CAAC,CAAC;IAC1B,IAAI,GAAG;QAAE,OAAO,GAAG,CAAC,IAAI,CAAC,CAAC;IAC1B,QAAQ,GAAG,EAAE,CAAC;QACZ,KAAK,SAAS,CAAC;QACf,KAAK,WAAW;YACd,OAAO,CAAC,GAAG,CAAC,OAAO,OAAO,EAAE,CAAC,CAAC;YAC9B,OAAO,CAAC,CAAC;QACX,KAAK,MAAM,CAAC;QACZ,KAAK,QAAQ,CAAC;QACd,KAAK,IAAI;YACP,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;YAClB,OAAO,CAAC,CAAC;QACX;YACE,OAAO,CAAC,KAAK,CAAC,oBAAoB,GAAG,IAAI,CAAC,CAAC;YAC3C,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;YACpB,OAAO,CAAC,CAAC;IACb,CAAC;AACH,CAAC;AAED,iFAAiF;AAEjF,+EAA+E;AAE/E,SAAS,YAAY,CACnB,QAA4B,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,EAC3C,UAAkB,MAAM,CAAC,IAAI,CAAC,GAAG;IAEjC,IAAI,CAAC,KAAK;QAAE,OAAO,KAAK,CAAC;IACzB,IAAI,CAAC;QACH,OAAO,OAAO,KAAK,aAAa,CAAC,EAAE,CAAC,YAAY,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC;IAChE,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC;AAED,OAAO,EAAE,YAAY,EAAE,CAAC;AAExB,IAAI,YAAY,EAAE,EAAE,CAAC;IACnB,MAAM,GAAG,GAAG,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;IACxC,IAAI,OAAO,GAAG,KAAK,QAAQ,EAAE,CAAC;QAC5B,OAAO,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IACpB,CAAC;SAAM,CAAC;QACN,wEAAwE;QACxE,uEAAuE;QACvE,sEAAsE;QACtE,yEAAyE;QACzE,GAAG,CAAC,IAAI,CACN,CAAC,IAAI,EAAE,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,EAC5B,GAAG,EAAE;YACH,OAAO,CAAC,KAAK,CAAC,kDAAkD,CAAC,CAAC;YAClE,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAClB,CAAC,CACF,CAAC;IACJ,CAAC;AACH,CAAC"}
+{"version":3,"file":"cli.js","sourceRoot":"","sources":["../src/cli.ts"],"names":[],"mappings":";AACA,OAAO,EAAE,MAAM,SAAS,CAAC;AACzB,OAAO,EAAE,aAAa,EAAE,MAAM,UAAU,CAAC;AACzC,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,SAAS,EAAa,MAAM,eAAe,CAAC;AACpE,OAAO,EAAE,IAAI,EAAE,MAAM,eAAe,CAAC;AACrC,OAAO,EAAE,WAAW,EAAE,MAAM,eAAe,CAAC;AAC5C,OAAO,EAAE,QAAQ,EAAE,MAAM,gBAAgB,CAAC;AAC1C,OAAO,EAAE,OAAO,EAAE,MAAM,eAAe,CAAC;AACxC,OAAO,EAAE,SAAS,EAAE,QAAQ,EAAE,UAAU,EAAE,YAAY,EAAE,aAAa,EAAE,MAAM,gBAAgB,CAAC;AAC9F,OAAO,EAAE,aAAa,EAAE,OAAO,EAAE,SAAS,EAAE,MAAM,kBAAkB,CAAC;AACrE,OAAO,EAAE,OAAO,EAAE,eAAe,EAAE,MAAM,kBAAkB,CAAC;AAC5D,OAAO,EAAE,YAAY,EAAE,OAAO,EAAE,QAAQ,EAAE,MAAM,mBAAmB,CAAC;AACpE,OAAO,EAAE,SAAS,EAAE,MAAM,iBAAiB,CAAC;AAC5C,OAAO,EAAE,QAAQ,EAAE,MAAM,gBAAgB,CAAC;AAC1C,OAAO,EAAE,OAAO,EAAE,MAAM,eAAe,CAAC;AACxC,OAAO,EAAE,SAAS,EAAE,MAAM,iBAAiB,CAAC;AAE5C,qEAAqE;AACrE,kFAAkF;AAElF,MAAM,QAAQ,GAA6D;IACzE,KAAK,EAAE,QAAQ;IACf,IAAI,EAAE,OAAO;IACb,MAAM,EAAE,SAAS;IACjB,KAAK,EAAE,QAAQ;IACf,OAAO,EAAE,UAAU;IACnB,IAAI,EAAE,OAAO;IACb,eAAe,EAAE,eAAe;IAChC,IAAI,EAAE,OAAO;IACb,SAAS,EAAE,YAAY;IACvB,KAAK,EAAE,QAAQ;IACf,MAAM,EAAE,SAAS;IACjB,SAAS,EAAE,YAAY;IACvB,UAAU,EAAE,aAAa;IACzB,UAAU,EAAE,aAAa;IACzB,IAAI,EAAE,OAAO;IACb,MAAM,EAAE,SAAS;IACjB,KAAK,EAAE,QAAQ;IACf,IAAI,EAAE,OAAO;IACb,MAAM,EAAE,SAAS;CAClB,CAAC;AAEF,mFAAmF;AACnF,SAAS,mBAAmB,CAAC,IAAU,EAAE,GAAW;IAClD,IAAI,IAAI,CAAC,IAAI,EAAE,MAAM,CAAC,EAAE,CAAC;QACvB,2EAA2E;QAC3E,qEAAqE;QACrE,IAAI,GAAG,KAAK,MAAM;YAAE,OAAO,OAAO,CAAC,IAAI,CAAC,CAAC;QACzC,IAAI,GAAG,KAAK,MAAM;YAAE,OAAO,OAAO,CAAC,IAAI,CAAC,CAAC;QACzC,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;QAClB,OAAO,CAAC,CAAC;IACX,CAAC;IACD,IAAI,IAAI,CAAC,IAAI,EAAE,SAAS,CAAC,EAAE,CAAC;QAC1B,OAAO,CAAC,GAAG,CAAC,OAAO,OAAO,EAAE,CAAC,CAAC;QAC9B,OAAO,CAAC,CAAC;IACX,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED,MAAM,UAAU,IAAI,CAAC,IAAc;IACjC,2EAA2E;IAC3E,6EAA6E;IAC7E,4EAA4E;IAC5E,WAAW,CAAC,OAAO,CAAC,GAAG,EAAE,CAAC,CAAC;IAC3B,MAAM,IAAI,GAAG,SAAS,CAAC,IAAI,CAAC,CAAC;IAC7B,MAAM,GAAG,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,OAAO,CAAW,CAAC;IAC7C,MAAM,OAAO,GAAG,mBAAmB,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC;IAC/C,IAAI,OAAO,KAAK,IAAI;QAAE,OAAO,OAAO,CAAC;IAErC,MAAM,GAAG,GAAG,QAAQ,CAAC,GAAG,CAAC,CAAC;IAC1B,IAAI,GAAG;QAAE,OAAO,GAAG,CAAC,IAAI,CAAC,CAAC;IAC1B,QAAQ,GAAG,EAAE,CAAC;QACZ,KAAK,SAAS,CAAC;QACf,KAAK,WAAW;YACd,OAAO,CAAC,GAAG,CAAC,OAAO,OAAO,EAAE,CAAC,CAAC;YAC9B,OAAO,CAAC,CAAC;QACX,KAAK,MAAM,CAAC;QACZ,KAAK,QAAQ,CAAC;QACd,KAAK,IAAI;YACP,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;YAClB,OAAO,CAAC,CAAC;QACX;YACE,OAAO,CAAC,KAAK,CAAC,oBAAoB,GAAG,IAAI,CAAC,CAAC;YAC3C,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;YACpB,OAAO,CAAC,CAAC;IACb,CAAC;AACH,CAAC;AAED,iFAAiF;AAEjF,+EAA+E;AAE/E,SAAS,YAAY,CACnB,QAA4B,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,EAC3C,UAAkB,MAAM,CAAC,IAAI,CAAC,GAAG;IAEjC,IAAI,CAAC,KAAK;QAAE,OAAO,KAAK,CAAC;IACzB,IAAI,CAAC;QACH,OAAO,OAAO,KAAK,aAAa,CAAC,EAAE,CAAC,YAAY,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC;IAChE,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC;AAED,OAAO,EAAE,YAAY,EAAE,CAAC;AAExB,IAAI,YAAY,EAAE,EAAE,CAAC;IACnB,MAAM,GAAG,GAAG,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;IACxC,IAAI,OAAO,GAAG,KAAK,QAAQ,EAAE,CAAC;QAC5B,OAAO,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IACpB,CAAC;SAAM,CAAC;QACN,wEAAwE;QACxE,uEAAuE;QACvE,sEAAsE;QACtE,yEAAyE;QACzE,GAAG,CAAC,IAAI,CACN,CAAC,IAAI,EAAE,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,EAC5B,GAAG,EAAE;YACH,OAAO,CAAC,KAAK,CAAC,kDAAkD,CAAC,CAAC;YAClE,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAClB,CAAC,CACF,CAAC;IACJ,CAAC;AACH,CAAC"}

package/dist/engine/audit-config.d.ts

@@ -0,0 +1,66 @@
+import type { Depth, Finding, Maturity, Suppression, UsaConfig } from '../types.js';
+import type { SectionDef } from './sections.js';
+import type { AuditOptions } from './audit-types.js';
+/**
+ * Option, config, and policy resolution for an audit run.
+ *
+ * Everything here turns user input (CLI flags, `.usa.yaml`) into validated
+ * values, and every invalid value warns and falls back instead of throwing:
+ * a typo in a config file must not brick the audit it configures.
+ */
+export declare const DEFAULT_RULES_DIR: string;
+/** Version of this build, read from package.json so it never drifts. */
+export declare const DEFAULT_VERSION: string;
+export declare function normalizeAuditOptions(options: AuditOptions, config: UsaConfig): {
+    rulesDir: string;
+    depth: Depth;
+    profile: Maturity | "auto";
+    allowCommands: boolean;
+    usaVersion: string;
+    target: string;
+    config: UsaConfig;
+};
+/**
+ * Expired (or undated) waivers fail closed: an `until` date in the past — or
+ * one that cannot be parsed — excludes the suppression and raises a warning,
+ * so an audit never silently honours dead risk acceptances.
+ */
+export declare function resolveSuppressions(suppressions: Suppression[] | undefined, warnings: string[]): Suppression[];
+export declare function isSuppressionExpired(rule: string, until: string, warnings: string[]): boolean;
+export declare const MATURITIES: Maturity[];
+/**
+ * CLI --profile wins; otherwise a valid config `maturity` pins the bar;
+ * otherwise auto-detection stands. Invalid config values warn and fall back.
+ */
+export declare function resolveMaturity(cliProfile: Maturity | 'auto', configMaturity: Maturity | undefined, detected: Maturity, warnings: string[]): Maturity;
+/** Restrict scoring and reporting to the configured sections, if any. */
+export declare function selectSections(all: SectionDef[], wanted: string[] | undefined, warnings: string[]): SectionDef[];
+/**
+ * CLI flags win over config file; both are validated with warnings.
+ * Invalid values fall back to engine defaults (never zero, never infinite).
+ */
+export declare function resolveLimits(options: AuditOptions, config: UsaConfig, warnings: string[]): {
+    maxFiles?: number;
+    maxBytes?: number;
+};
+export declare function validatedLimit(v: number | undefined, name: string, warnings: string[]): number | undefined;
+export declare function resolvePackSets(options: AuditOptions, config: UsaConfig): {
+    include: Set<string>;
+    exclude: Set<string>;
+};
+export type RuleOverride = {
+    severity?: Finding['severity'];
+    weight?: number;
+};
+export declare function collectRuleSettings(config: UsaConfig, warnings: string[]): {
+    disabled: Set<string>;
+    overrides: Record<string, RuleOverride>;
+};
+/**
+ * Config overrides flow straight into scoring arithmetic — an invalid severity
+ * yields NaN totals and a negative weight yields scores outside 0–100.
+ * Reject loudly rather than corrupt the report.
+ */
+export declare function validateOverrideSeverity(id: string, v: unknown, warnings: string[]): RuleOverride['severity'];
+export declare function validateOverrideWeight(id: string, v: unknown, warnings: string[]): number | undefined;
+//# sourceMappingURL=audit-config.d.ts.map

package/dist/engine/audit-config.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"audit-config.d.ts","sourceRoot":"","sources":["../../src/engine/audit-config.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EAAE,KAAK,EAAE,OAAO,EAAE,QAAQ,EAAE,WAAW,EAAE,SAAS,EAAE,MAAM,aAAa,CAAC;AACpF,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,eAAe,CAAC;AAEhD,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,kBAAkB,CAAC;AAErD;;;;;;GAMG;AACH,eAAO,MAAM,iBAAiB,QAK7B,CAAC;AAEF,wEAAwE;AACxE,eAAO,MAAM,eAAe,QAYxB,CAAC;AAEL,wBAAgB,qBAAqB,CAAC,OAAO,EAAE,YAAY,EAAE,MAAM,EAAE,SAAS;;;;;;;;EAU7E;AAED;;;;GAIG;AACH,wBAAgB,mBAAmB,CACjC,YAAY,EAAE,WAAW,EAAE,GAAG,SAAS,EACvC,QAAQ,EAAE,MAAM,EAAE,GACjB,WAAW,EAAE,CAQf;AAED,wBAAgB,oBAAoB,CAAC,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,GAAG,OAAO,CAa7F;AAED,eAAO,MAAM,UAAU,EAAE,QAAQ,EAAyD,CAAC;AAE3F;;;GAGG;AACH,wBAAgB,eAAe,CAC7B,UAAU,EAAE,QAAQ,GAAG,MAAM,EAC7B,cAAc,EAAE,QAAQ,GAAG,SAAS,EACpC,QAAQ,EAAE,QAAQ,EAClB,QAAQ,EAAE,MAAM,EAAE,GACjB,QAAQ,CAQV;AAED,yEAAyE;AAEzE,wBAAgB,cAAc,CAC5B,GAAG,EAAE,UAAU,EAAE,EACjB,MAAM,EAAE,MAAM,EAAE,GAAG,SAAS,EAC5B,QAAQ,EAAE,MAAM,EAAE,GACjB,UAAU,EAAE,CAOd;AAED;;;GAGG;AACH,wBAAgB,aAAa,CAC3B,OAAO,EAAE,YAAY,EACrB,MAAM,EAAE,SAAS,EACjB,QAAQ,EAAE,MAAM,EAAE,GACjB;IAAE,QAAQ,CAAC,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,EAAE,MAAM,CAAA;CAAE,CAa1C;AAED,wBAAgB,cAAc,CAC5B,CAAC,EAAE,MAAM,GAAG,SAAS,EACrB,IAAI,EAAE,MAAM,EACZ,QAAQ,EAAE,MAAM,EAAE,GACjB,MAAM,GAAG,SAAS,CAKpB;AAED,wBAAgB,eAAe,CAC7B,OAAO,EAAE,YAAY,EACrB,MAAM,EAAE,SAAS,GAChB;IAAE,OAAO,EAAE,GAAG,CAAC,MAAM,CAAC,CAAC;IAAC,OAAO,EAAE,GAAG,CAAC,MAAM,CAAC,CAAA;CAAE,CAKhD;AAED,MAAM,MAAM,YAAY,GAAG;IAAE,QAAQ,CAAC,EAAE,OAAO,CAAC,UAAU,CAAC,CAAC;IAAC,MAAM,CAAC,EAAE,MAAM,CAAA;CAAE,CAAC;AAE/E,wBAAgB,mBAAmB,CACjC,MAAM,EAAE,SAAS,EACjB,QAAQ,EAAE,MAAM,EAAE,GACjB;IACD,QAAQ,EAAE,GAAG,CAAC,MAAM,CAAC,CAAC;IACtB,SAAS,EAAE,MAAM,CAAC,MAAM,EAAE,YAAY,CAAC,CAAC;CACzC,CAYA;AAED;;;;GAIG;AACH,wBAAgB,wBAAwB,CACtC,EAAE,EAAE,MAAM,EACV,CAAC,EAAE,OAAO,EACV,QAAQ,EAAE,MAAM,EAAE,GACjB,YAAY,CAAC,UAAU,CAAC,CAO1B;AAED,wBAAgB,sBAAsB,CACpC,EAAE,EAAE,MAAM,EACV,CAAC,EAAE,OAAO,EACV,QAAQ,EAAE,MAAM,EAAE,GACjB,MAAM,GAAG,SAAS,CAOpB"}

package/dist/engine/audit-config.js

@@ -0,0 +1,148 @@
+import path from 'node:path';
+import fs from 'node:fs';
+import { fileURLToPath } from 'node:url';
+import { SEVERITY_LADDER } from './loader.js';
+/**
+ * Option, config, and policy resolution for an audit run.
+ *
+ * Everything here turns user input (CLI flags, `.usa.yaml`) into validated
+ * values, and every invalid value warns and falls back instead of throwing:
+ * a typo in a config file must not brick the audit it configures.
+ */
+export const DEFAULT_RULES_DIR = path.resolve(path.dirname(fileURLToPath(import.meta.url)), '..', '..', 'rules');
+/** Version of this build, read from package.json so it never drifts. */
+export const DEFAULT_VERSION = (() => {
+    try {
+        const pkg = JSON.parse(fs.readFileSync(path.resolve(path.dirname(fileURLToPath(import.meta.url)), '..', '..', 'package.json'), 'utf8'));
+        return pkg.version ?? '0.0.0';
+    }
+    catch {
+        return '0.0.0';
+    }
+})();
+export function normalizeAuditOptions(options, config) {
+    return {
+        rulesDir: options.rulesDir ?? DEFAULT_RULES_DIR,
+        depth: options.depth ?? 'standard',
+        profile: options.profile ?? 'auto',
+        allowCommands: options.allowCommands ?? false,
+        usaVersion: options.usaVersion ?? DEFAULT_VERSION,
+        target: options.target,
+        config,
+    };
+}
+/**
+ * Expired (or undated) waivers fail closed: an `until` date in the past — or
+ * one that cannot be parsed — excludes the suppression and raises a warning,
+ * so an audit never silently honours dead risk acceptances.
+ */
+export function resolveSuppressions(suppressions, warnings) {
+    const active = [];
+    for (const s of suppressions ?? []) {
+        if (!s.rule)
+            continue;
+        if (s.until && isSuppressionExpired(s.rule, s.until, warnings))
+            continue;
+        active.push(s);
+    }
+    return active;
+}
+export function isSuppressionExpired(rule, until, warnings) {
+    const t = Date.parse(until);
+    if (Number.isNaN(t)) {
+        warnings.push(`suppression for ${rule} has an unparseable "until" date ("${until}") — waiver ignored`);
+        return true;
+    }
+    if (t < Date.now()) {
+        warnings.push(`suppression for ${rule} expired on ${until} — treating as an active finding`);
+        return true;
+    }
+    return false;
+}
+export const MATURITIES = ['prototype', 'mvp', 'beta', 'production', 'legacy'];
+/**
+ * CLI --profile wins; otherwise a valid config `maturity` pins the bar;
+ * otherwise auto-detection stands. Invalid config values warn and fall back.
+ */
+export function resolveMaturity(cliProfile, configMaturity, detected, warnings) {
+    if (cliProfile !== 'auto')
+        return cliProfile;
+    if (configMaturity === undefined)
+        return detected;
+    if (MATURITIES.includes(configMaturity))
+        return configMaturity;
+    warnings.push(`.usa.yaml: invalid maturity "${String(configMaturity)}" — using auto-detected ${detected}`);
+    return detected;
+}
+/** Restrict scoring and reporting to the configured sections, if any. */
+export function selectSections(all, wanted, warnings) {
+    if (!wanted || wanted.length === 0)
+        return all;
+    const known = new Set(all.map((s) => s.id));
+    for (const id of wanted) {
+        if (!known.has(id))
+            warnings.push(`.usa.yaml: unknown section "${id}" in sections — ignored`);
+    }
+    return all.filter((s) => wanted.includes(s.id));
+}
+/**
+ * CLI flags win over config file; both are validated with warnings.
+ * Invalid values fall back to engine defaults (never zero, never infinite).
+ */
+export function resolveLimits(options, config, warnings) {
+    return {
+        maxFiles: validatedLimit(options.maxFiles ?? config.limits?.max_files, 'limits.max_files / --max-files', warnings),
+        maxBytes: validatedLimit(options.maxBytes ?? config.limits?.max_bytes, 'limits.max_bytes / --max-bytes', warnings),
+    };
+}
+export function validatedLimit(v, name, warnings) {
+    if (v === undefined)
+        return undefined;
+    if (typeof v === 'number' && Number.isFinite(v) && v > 0)
+        return Math.floor(v);
+    warnings.push(`invalid ${name} "${String(v)}" (must be a positive number) — using defaults`);
+    return undefined;
+}
+export function resolvePackSets(options, config) {
+    return {
+        include: new Set(options.includePacks ?? config.include ?? []),
+        exclude: new Set(options.excludePacks ?? config.exclude ?? []),
+    };
+}
+export function collectRuleSettings(config, warnings) {
+    const disabled = new Set();
+    const overrides = {};
+    for (const [id, o] of Object.entries(config.rules ?? {})) {
+        if (o.disabled)
+            disabled.add(id);
+        const severity = validateOverrideSeverity(id, o.severity, warnings);
+        const weight = validateOverrideWeight(id, o.weight, warnings);
+        if (severity !== undefined || weight !== undefined) {
+            overrides[id] = { severity, weight };
+        }
+    }
+    return { disabled, overrides };
+}
+/**
+ * Config overrides flow straight into scoring arithmetic — an invalid severity
+ * yields NaN totals and a negative weight yields scores outside 0–100.
+ * Reject loudly rather than corrupt the report.
+ */
+export function validateOverrideSeverity(id, v, warnings) {
+    if (v === undefined)
+        return undefined;
+    if (SEVERITY_LADDER.includes(String(v))) {
+        return String(v);
+    }
+    warnings.push(`rules.${id}: invalid severity "${String(v)}" — override ignored`);
+    return undefined;
+}
+export function validateOverrideWeight(id, v, warnings) {
+    if (v === undefined)
+        return undefined;
+    if (typeof v === 'number' && Number.isFinite(v) && v >= 0)
+        return v;
+    warnings.push(`rules.${id}: invalid weight "${String(v)}" (must be a finite number ≥ 0) — override ignored`);
+    return undefined;
+}
+//# sourceMappingURL=audit-config.js.map

package/dist/engine/audit-config.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"audit-config.js","sourceRoot":"","sources":["../../src/engine/audit-config.ts"],"names":[],"mappings":"AAAA,OAAO,IAAI,MAAM,WAAW,CAAC;AAC7B,OAAO,EAAE,MAAM,SAAS,CAAC;AACzB,OAAO,EAAE,aAAa,EAAE,MAAM,UAAU,CAAC;AAGzC,OAAO,EAAE,eAAe,EAAE,MAAM,aAAa,CAAC;AAG9C;;;;;;GAMG;AACH,MAAM,CAAC,MAAM,iBAAiB,GAAG,IAAI,CAAC,OAAO,CAC3C,IAAI,CAAC,OAAO,CAAC,aAAa,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,EAC5C,IAAI,EACJ,IAAI,EACJ,OAAO,CACR,CAAC;AAEF,wEAAwE;AACxE,MAAM,CAAC,MAAM,eAAe,GAAG,CAAC,GAAG,EAAE;IACnC,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CACpB,EAAE,CAAC,YAAY,CACb,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,aAAa,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,IAAI,EAAE,IAAI,EAAE,cAAc,CAAC,EACtF,MAAM,CACP,CACsB,CAAC;QAC1B,OAAO,GAAG,CAAC,OAAO,IAAI,OAAO,CAAC;IAChC,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,OAAO,CAAC;IACjB,CAAC;AACH,CAAC,CAAC,EAAE,CAAC;AAEL,MAAM,UAAU,qBAAqB,CAAC,OAAqB,EAAE,MAAiB;IAC5E,OAAO;QACL,QAAQ,EAAE,OAAO,CAAC,QAAQ,IAAI,iBAAiB;QAC/C,KAAK,EAAE,OAAO,CAAC,KAAK,IAAK,UAAoB;QAC7C,OAAO,EAAE,OAAO,CAAC,OAAO,IAAK,MAA4B;QACzD,aAAa,EAAE,OAAO,CAAC,aAAa,IAAI,KAAK;QAC7C,UAAU,EAAE,OAAO,CAAC,UAAU,IAAI,eAAe;QACjD,MAAM,EAAE,OAAO,CAAC,MAAM;QACtB,MAAM;KACP,CAAC;AACJ,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,mBAAmB,CACjC,YAAuC,EACvC,QAAkB;IAElB,MAAM,MAAM,GAAkB,EAAE,CAAC;IACjC,KAAK,MAAM,CAAC,IAAI,YAAY,IAAI,EAAE,EAAE,CAAC;QACnC,IAAI,CAAC,CAAC,CAAC,IAAI;YAAE,SAAS;QACtB,IAAI,CAAC,CAAC,KAAK,IAAI,oBAAoB,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,KAAK,EAAE,QAAQ,CAAC;YAAE,SAAS;QACzE,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IACjB,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,MAAM,UAAU,oBAAoB,CAAC,IAAY,EAAE,KAAa,EAAE,QAAkB;IAClF,MAAM,CAAC,GAAG,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;IAC5B,IAAI,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC;QACpB,QAAQ,CAAC,IAAI,CACX,mBAAmB,IAAI,sCAAsC,KAAK,qBAAqB,CACxF,CAAC;QACF,OAAO,IAAI,CAAC;IACd,CAAC;IACD,IAAI,CAAC,GAAG,IAAI,CAAC,GAAG,EAAE,EAAE,CAAC;QACnB,QAAQ,CAAC,IAAI,CAAC,mBAAmB,IAAI,eAAe,KAAK,kCAAkC,CAAC,CAAC;QAC7F,OAAO,IAAI,CAAC;IACd,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED,MAAM,CAAC,MAAM,UAAU,GAAe,CAAC,WAAW,EAAE,KAAK,EAAE,MAAM,EAAE,YAAY,EAAE,QAAQ,CAAC,CAAC;AAE3F;;;GAGG;AACH,MAAM,UAAU,eAAe,CAC7B,UAA6B,EAC7B,cAAoC,EACpC,QAAkB,EAClB,QAAkB;IAElB,IAAI,UAAU,KAAK,MAAM;QAAE,OAAO,UAAU,CAAC;IAC7C,IAAI,cAAc,KAAK,SAAS;QAAE,OAAO,QAAQ,CAAC;IAClD,IAAK,UAAgC,CAAC,QAAQ,CAAC,cAAc,CAAC;QAAE,OAAO,cAAc,CAAC;IACtF,QAAQ,CAAC,IAAI,CACX,gCAAgC,MAAM,CAAC,cAAc,CAAC,2BAA2B,QAAQ,EAAE,CAC5F,CAAC;IACF,OAAO,QAAQ,CAAC;AAClB,CAAC;AAED,yEAAyE;AAEzE,MAAM,UAAU,cAAc,CAC5B,GAAiB,EACjB,MAA4B,EAC5B,QAAkB;IAElB,IAAI,CAAC,MAAM,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,GAAG,CAAC;IAC/C,MAAM,KAAK,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;IAC5C,KAAK,MAAM,EAAE,IAAI,MAAM,EAAE,CAAC;QACxB,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC;YAAE,QAAQ,CAAC,IAAI,CAAC,+BAA+B,EAAE,yBAAyB,CAAC,CAAC;IAChG,CAAC;IACD,OAAO,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;AAClD,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,aAAa,CAC3B,OAAqB,EACrB,MAAiB,EACjB,QAAkB;IAElB,OAAO;QACL,QAAQ,EAAE,cAAc,CACtB,OAAO,CAAC,QAAQ,IAAI,MAAM,CAAC,MAAM,EAAE,SAAS,EAC5C,gCAAgC,EAChC,QAAQ,CACT;QACD,QAAQ,EAAE,cAAc,CACtB,OAAO,CAAC,QAAQ,IAAI,MAAM,CAAC,MAAM,EAAE,SAAS,EAC5C,gCAAgC,EAChC,QAAQ,CACT;KACF,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,cAAc,CAC5B,CAAqB,EACrB,IAAY,EACZ,QAAkB;IAElB,IAAI,CAAC,KAAK,SAAS;QAAE,OAAO,SAAS,CAAC;IACtC,IAAI,OAAO,CAAC,KAAK,QAAQ,IAAI,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC;QAAE,OAAO,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;IAC/E,QAAQ,CAAC,IAAI,CAAC,WAAW,IAAI,KAAK,MAAM,CAAC,CAAC,CAAC,gDAAgD,CAAC,CAAC;IAC7F,OAAO,SAAS,CAAC;AACnB,CAAC;AAED,MAAM,UAAU,eAAe,CAC7B,OAAqB,EACrB,MAAiB;IAEjB,OAAO;QACL,OAAO,EAAE,IAAI,GAAG,CAAC,OAAO,CAAC,YAAY,IAAI,MAAM,CAAC,OAAO,IAAI,EAAE,CAAC;QAC9D,OAAO,EAAE,IAAI,GAAG,CAAC,OAAO,CAAC,YAAY,IAAI,MAAM,CAAC,OAAO,IAAI,EAAE,CAAC;KAC/D,CAAC;AACJ,CAAC;AAID,MAAM,UAAU,mBAAmB,CACjC,MAAiB,EACjB,QAAkB;IAKlB,MAAM,QAAQ,GAAG,IAAI,GAAG,EAAU,CAAC;IACnC,MAAM,SAAS,GAAiC,EAAE,CAAC;IACnD,KAAK,MAAM,CAAC,EAAE,EAAE,CAAC,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,KAAK,IAAI,EAAE,CAAC,EAAE,CAAC;QACzD,IAAI,CAAC,CAAC,QAAQ;YAAE,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QACjC,MAAM,QAAQ,GAAG,wBAAwB,CAAC,EAAE,EAAE,CAAC,CAAC,QAAQ,EAAE,QAAQ,CAAC,CAAC;QACpE,MAAM,MAAM,GAAG,sBAAsB,CAAC,EAAE,EAAE,CAAC,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAC;QAC9D,IAAI,QAAQ,KAAK,SAAS,IAAI,MAAM,KAAK,SAAS,EAAE,CAAC;YACnD,SAAS,CAAC,EAAE,CAAC,GAAG,EAAE,QAAQ,EAAE,MAAM,EAAE,CAAC;QACvC,CAAC;IACH,CAAC;IACD,OAAO,EAAE,QAAQ,EAAE,SAAS,EAAE,CAAC;AACjC,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,wBAAwB,CACtC,EAAU,EACV,CAAU,EACV,QAAkB;IAElB,IAAI,CAAC,KAAK,SAAS;QAAE,OAAO,SAAS,CAAC;IACtC,IAAK,eAAqC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;QAC/D,OAAO,MAAM,CAAC,CAAC,CAA6B,CAAC;IAC/C,CAAC;IACD,QAAQ,CAAC,IAAI,CAAC,SAAS,EAAE,uBAAuB,MAAM,CAAC,CAAC,CAAC,sBAAsB,CAAC,CAAC;IACjF,OAAO,SAAS,CAAC;AACnB,CAAC;AAED,MAAM,UAAU,sBAAsB,CACpC,EAAU,EACV,CAAU,EACV,QAAkB;IAElB,IAAI,CAAC,KAAK,SAAS;QAAE,OAAO,SAAS,CAAC;IACtC,IAAI,OAAO,CAAC,KAAK,QAAQ,IAAI,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC;QAAE,OAAO,CAAC,CAAC;IACpE,QAAQ,CAAC,IAAI,CACX,SAAS,EAAE,qBAAqB,MAAM,CAAC,CAAC,CAAC,oDAAoD,CAC9F,CAAC;IACF,OAAO,SAAS,CAAC;AACnB,CAAC"}

package/dist/engine/audit-types.d.ts

@@ -0,0 +1,44 @@
+import type { AuditReport, Depth, Maturity, RulePack, UsaConfig } from '../types.js';
+import type { MaturityProfile } from './maturity.js';
+/**
+ * The public shape of an audit run, in its own module so the audit
+ * coordinator and the option/pack/report helpers can all depend on it
+ * without importing each other.
+ */
+export interface AuditOptions {
+    target: string;
+    rulesDir?: string;
+    depth?: Depth;
+    profile?: Maturity | 'auto';
+    config?: UsaConfig;
+    allowCommands?: boolean;
+    usaVersion?: string;
+    /** Force these pack ids on/off regardless of detection. */
+    includePacks?: string[];
+    excludePacks?: string[];
+    /** Indexing caps for bigger-than-comfortable trees (CLI wins over config). */
+    maxFiles?: number;
+    maxBytes?: number;
+    /**
+     * Extra rule packs merged into the loaded set for this run only. This is how
+     * the evolution layer injects a *released* capability into a re-audit without
+     * mutating the on-disk `rules/` registry — the resolved capability set lives
+     * in `capabilitySetId`, not in the filesystem. The CLI never passes this, so
+     * `usa audit` behaviour is unchanged.
+     */
+    extraPacks?: RulePack[];
+    /**
+     * Include the documentation universe audit (14 categories / 220 artifacts,
+     * rules/docs-taxonomy.yaml) in this run: DOCU-* findings join S12. Opt-in
+     * (CLI `--docs-universe` or `.usa.yaml` `docs.universe: true`) so existing
+     * baselines stay stable; the standalone `usa docs audit` runs the same
+     * computation and must agree (AC-8).
+     */
+    docsUniverse?: boolean;
+}
+export interface AuditOutcome {
+    report: AuditReport;
+    warnings: string[];
+    profile: MaturityProfile;
+}
+//# sourceMappingURL=audit-types.d.ts.map