@xenos1996/usa 2.26.2 → 2.28.0

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (120) hide show
  1. package/dist/cli-help.d.ts.map +1 -1
  2. package/dist/cli-help.js +2 -0
  3. package/dist/cli-help.js.map +1 -1
  4. package/dist/cli-intent.d.ts +4 -0
  5. package/dist/cli-intent.d.ts.map +1 -0
  6. package/dist/cli-intent.js +108 -0
  7. package/dist/cli-intent.js.map +1 -0
  8. package/dist/cli-scan.d.ts +12 -0
  9. package/dist/cli-scan.d.ts.map +1 -0
  10. package/dist/cli-scan.js +142 -0
  11. package/dist/cli-scan.js.map +1 -0
  12. package/dist/cli.d.ts.map +1 -1
  13. package/dist/cli.js +4 -0
  14. package/dist/cli.js.map +1 -1
  15. package/dist/engine/audit-config.d.ts +66 -0
  16. package/dist/engine/audit-config.d.ts.map +1 -0
  17. package/dist/engine/audit-config.js +148 -0
  18. package/dist/engine/audit-config.js.map +1 -0
  19. package/dist/engine/audit-types.d.ts +44 -0
  20. package/dist/engine/audit-types.d.ts.map +1 -0
  21. package/dist/engine/audit-types.js +2 -0
  22. package/dist/engine/audit-types.js.map +1 -0
  23. package/dist/engine/audit-warnings.d.ts +56 -0
  24. package/dist/engine/audit-warnings.d.ts.map +1 -0
  25. package/dist/engine/audit-warnings.js +116 -0
  26. package/dist/engine/audit-warnings.js.map +1 -0
  27. package/dist/engine/audit.d.ts +14 -38
  28. package/dist/engine/audit.d.ts.map +1 -1
  29. package/dist/engine/audit.js +9 -500
  30. package/dist/engine/audit.js.map +1 -1
  31. package/dist/engine/evaluate-packs.d.ts +37 -0
  32. package/dist/engine/evaluate-packs.d.ts.map +1 -0
  33. package/dist/engine/evaluate-packs.js +144 -0
  34. package/dist/engine/evaluate-packs.js.map +1 -0
  35. package/dist/engine/evaluate.d.ts.map +1 -1
  36. package/dist/engine/evaluate.js +31 -8
  37. package/dist/engine/evaluate.js.map +1 -1
  38. package/dist/engine/invariants.d.ts +8 -0
  39. package/dist/engine/invariants.d.ts.map +1 -1
  40. package/dist/engine/invariants.js +11 -0
  41. package/dist/engine/invariants.js.map +1 -1
  42. package/dist/engine/pack-selection.d.ts +21 -0
  43. package/dist/engine/pack-selection.d.ts.map +1 -0
  44. package/dist/engine/pack-selection.js +63 -0
  45. package/dist/engine/pack-selection.js.map +1 -0
  46. package/dist/engine/report-build.d.ts +22 -0
  47. package/dist/engine/report-build.d.ts.map +1 -0
  48. package/dist/engine/report-build.js +67 -0
  49. package/dist/engine/report-build.js.map +1 -0
  50. package/dist/foundation/interview.d.ts.map +1 -1
  51. package/dist/foundation/interview.js +16 -5
  52. package/dist/foundation/interview.js.map +1 -1
  53. package/dist/intent/match.d.ts +38 -0
  54. package/dist/intent/match.d.ts.map +1 -0
  55. package/dist/intent/match.js +108 -0
  56. package/dist/intent/match.js.map +1 -0
  57. package/dist/intent/otm.d.ts +16 -0
  58. package/dist/intent/otm.d.ts.map +1 -0
  59. package/dist/intent/otm.js +144 -0
  60. package/dist/intent/otm.js.map +1 -0
  61. package/dist/intent/types.d.ts +111 -0
  62. package/dist/intent/types.d.ts.map +1 -0
  63. package/dist/intent/types.js +16 -0
  64. package/dist/intent/types.js.map +1 -0
  65. package/dist/scanner/adapters/codeql.d.ts +14 -0
  66. package/dist/scanner/adapters/codeql.d.ts.map +1 -0
  67. package/dist/scanner/adapters/codeql.js +134 -0
  68. package/dist/scanner/adapters/codeql.js.map +1 -0
  69. package/dist/scanner/adapters/dependency-cruiser.d.ts +3 -0
  70. package/dist/scanner/adapters/dependency-cruiser.d.ts.map +1 -0
  71. package/dist/scanner/adapters/dependency-cruiser.js +174 -0
  72. package/dist/scanner/adapters/dependency-cruiser.js.map +1 -0
  73. package/dist/scanner/adapters/ort.d.ts +12 -0
  74. package/dist/scanner/adapters/ort.d.ts.map +1 -0
  75. package/dist/scanner/adapters/ort.js +259 -0
  76. package/dist/scanner/adapters/ort.js.map +1 -0
  77. package/dist/scanner/adapters/scorecard.d.ts +7 -0
  78. package/dist/scanner/adapters/scorecard.d.ts.map +1 -0
  79. package/dist/scanner/adapters/scorecard.js +209 -0
  80. package/dist/scanner/adapters/scorecard.js.map +1 -0
  81. package/dist/scanner/adapters/semgrep.d.ts +3 -0
  82. package/dist/scanner/adapters/semgrep.d.ts.map +1 -0
  83. package/dist/scanner/adapters/semgrep.js +163 -0
  84. package/dist/scanner/adapters/semgrep.js.map +1 -0
  85. package/dist/scanner/adapters/trivy.d.ts +3 -0
  86. package/dist/scanner/adapters/trivy.d.ts.map +1 -0
  87. package/dist/scanner/adapters/trivy.js +163 -0
  88. package/dist/scanner/adapters/trivy.js.map +1 -0
  89. package/dist/scanner/config.d.ts +4 -0
  90. package/dist/scanner/config.d.ts.map +1 -0
  91. package/dist/scanner/config.js +15 -0
  92. package/dist/scanner/config.js.map +1 -0
  93. package/dist/scanner/identity.d.ts +17 -0
  94. package/dist/scanner/identity.d.ts.map +1 -0
  95. package/dist/scanner/identity.js +50 -0
  96. package/dist/scanner/identity.js.map +1 -0
  97. package/dist/scanner/normalize.d.ts +40 -0
  98. package/dist/scanner/normalize.d.ts.map +1 -0
  99. package/dist/scanner/normalize.js +85 -0
  100. package/dist/scanner/normalize.js.map +1 -0
  101. package/dist/scanner/registry.d.ts +19 -0
  102. package/dist/scanner/registry.d.ts.map +1 -0
  103. package/dist/scanner/registry.js +43 -0
  104. package/dist/scanner/registry.js.map +1 -0
  105. package/dist/scanner/run.d.ts +70 -0
  106. package/dist/scanner/run.d.ts.map +1 -0
  107. package/dist/scanner/run.js +419 -0
  108. package/dist/scanner/run.js.map +1 -0
  109. package/dist/scanner/sarif.d.ts +21 -0
  110. package/dist/scanner/sarif.d.ts.map +1 -0
  111. package/dist/scanner/sarif.js +156 -0
  112. package/dist/scanner/sarif.js.map +1 -0
  113. package/dist/scanner/types.d.ts +236 -0
  114. package/dist/scanner/types.d.ts.map +1 -0
  115. package/dist/scanner/types.js +11 -0
  116. package/dist/scanner/types.js.map +1 -0
  117. package/package.json +9 -8
  118. package/rules/core/code-quality.yaml +12 -2
  119. package/rules/core/provenance-attestation.yaml +5 -0
  120. package/rules/core/testing-assurance.yaml +19 -4
@@ -0,0 +1 @@
1
+ {"version":3,"file":"audit-types.d.ts","sourceRoot":"","sources":["../../src/engine/audit-types.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,WAAW,EAAE,KAAK,EAAE,QAAQ,EAAE,QAAQ,EAAE,SAAS,EAAE,MAAM,aAAa,CAAC;AACrF,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,eAAe,CAAC;AAErD;;;;GAIG;AACH,MAAM,WAAW,YAAY;IAC3B,MAAM,EAAE,MAAM,CAAC;IACf,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,KAAK,CAAC,EAAE,KAAK,CAAC;IACd,OAAO,CAAC,EAAE,QAAQ,GAAG,MAAM,CAAC;IAC5B,MAAM,CAAC,EAAE,SAAS,CAAC;IACnB,aAAa,CAAC,EAAE,OAAO,CAAC;IACxB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,2DAA2D;IAC3D,YAAY,CAAC,EAAE,MAAM,EAAE,CAAC;IACxB,YAAY,CAAC,EAAE,MAAM,EAAE,CAAC;IACxB,8EAA8E;IAC9E,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB;;;;;;OAMG;IACH,UAAU,CAAC,EAAE,QAAQ,EAAE,CAAC;IACxB;;;;;;OAMG;IACH,YAAY,CAAC,EAAE,OAAO,CAAC;CACxB;AAED,MAAM,WAAW,YAAY;IAC3B,MAAM,EAAE,WAAW,CAAC;IACpB,QAAQ,EAAE,MAAM,EAAE,CAAC;IACnB,OAAO,EAAE,eAAe,CAAC;CAC1B"}
@@ -0,0 +1,2 @@
1
+ export {};
2
+ //# sourceMappingURL=audit-types.js.map
@@ -0,0 +1 @@
1
+ {"version":3,"file":"audit-types.js","sourceRoot":"","sources":["../../src/engine/audit-types.ts"],"names":[],"mappings":""}
@@ -0,0 +1,56 @@
1
+ import type { Facts } from '../types.js';
2
+ import { type Project } from '../util/project.js';
3
+ import { buildSuppressionIndex } from './suppression.js';
4
+ import { type ReviewIndex } from './review.js';
5
+ /**
6
+ * Warnings that keep an audit honest about what it could not see.
7
+ *
8
+ * A warning is not a finding: it moves no score. It exists because a PASS
9
+ * computed over a truncated index, a single-commit history, or an ignored
10
+ * intent file is a weaker claim than it looks, and the report must say so.
11
+ */
12
+ /**
13
+ * A waiver that matched nothing is dead weight — usually a rule that no longer
14
+ * fires there, a renamed file, or a passing rule. Report it so suppressions
15
+ * decay instead of accumulating (ADR-0022, the ESLint model).
16
+ */
17
+ export declare function appendUnusedSuppressionWarnings(suppressions: ReturnType<typeof buildSuppressionIndex>, warnings: string[]): void;
18
+ /**
19
+ * Rank for the declared-vs-detected check (ADR-0041). Legacy is unranked:
20
+ * a retiring system plays a different game and gets no aspiration warning.
21
+ */
22
+ export declare const STAGE_RANK: Record<string, number>;
23
+ /**
24
+ * ADR-0041: declared stage above detected maturity is aspiration beyond
25
+ * evidence — one loud line, zero moved bars. Severity keeps following
26
+ * detected maturity (never the declaration), so claiming `prototype` buys
27
+ * no leniency and claiming `production` buys no strictness.
28
+ */
29
+ export declare function assertStageAspiration(target: string, detected: string, warnings: string[]): void;
30
+ /**
31
+ * Declared intent becomes detection facts. The loader throws on a broken
32
+ * file (fail closed); the audit converts that into a warning and proceeds
33
+ * without intent facts — a malformed promise must be loud, but it must not
34
+ * brick the audit it was meant to guide.
35
+ */
36
+ export declare function assertFoundationFacts(target: string, facts: Facts, warnings: string[]): void;
37
+ /**
38
+ * A review that matched nothing is dead provenance — the finding was fixed, the
39
+ * rule renamed, the file moved. A review whose `until` has passed is a decision
40
+ * nobody has revisited. Both are reported so the ledger decays instead of
41
+ * accumulating (ADR-0023, the ESLint model applied to attention).
42
+ */
43
+ export declare function appendReviewWarnings(reviews: ReviewIndex, warnings: string[]): void;
44
+ /**
45
+ * Scale honesty: a truncated index or skipped oversize files means PASS
46
+ * verdicts may rest on unseen files. Loud warning, never silent absorption.
47
+ */
48
+ export declare function appendIndexWarnings(project: Project, warnings: string[]): void;
49
+ /**
50
+ * History-thin targets blind the history-dependent rules (REPO-003 scans
51
+ * `git log`, REL-002 needs tags, maturity signals need commits). The
52
+ * negation in REPO-003 even turns git errors into PASS — true only in the
53
+ * vacuous sense. Say so loudly instead of scoring blind confidence.
54
+ */
55
+ export declare function appendHistoryWarnings(git: ReturnType<Project['gitInfo']>, warnings: string[]): void;
56
+ //# sourceMappingURL=audit-warnings.d.ts.map
@@ -0,0 +1 @@
1
+ {"version":3,"file":"audit-warnings.d.ts","sourceRoot":"","sources":["../../src/engine/audit-warnings.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,KAAK,EAAE,MAAM,aAAa,CAAC;AACzC,OAAO,EAA6B,KAAK,OAAO,EAAE,MAAM,oBAAoB,CAAC;AAC7E,OAAO,EAAE,qBAAqB,EAA2C,MAAM,kBAAkB,CAAC;AAClG,OAAO,EAAqC,KAAK,WAAW,EAAE,MAAM,aAAa,CAAC;AAGlF;;;;;;GAMG;AACH;;;;GAIG;AACH,wBAAgB,+BAA+B,CAC7C,YAAY,EAAE,UAAU,CAAC,OAAO,qBAAqB,CAAC,EACtD,QAAQ,EAAE,MAAM,EAAE,GACjB,IAAI,CAMN;AAED;;;GAGG;AACH,eAAO,MAAM,UAAU,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAoD,CAAC;AAEnG;;;;;GAKG;AACH,wBAAgB,qBAAqB,CAAC,MAAM,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,GAAG,IAAI,CAUhG;AAED;;;;;GAKG;AACH,wBAAgB,qBAAqB,CAAC,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE,KAAK,EAAE,QAAQ,EAAE,MAAM,EAAE,GAAG,IAAI,CAM5F;AAED;;;;;GAKG;AACH,wBAAgB,oBAAoB,CAAC,OAAO,EAAE,WAAW,EAAE,QAAQ,EAAE,MAAM,EAAE,GAAG,IAAI,CAmBnF;AAED;;;GAGG;AACH,wBAAgB,mBAAmB,CAAC,OAAO,EAAE,OAAO,EAAE,QAAQ,EAAE,MAAM,EAAE,GAAG,IAAI,CAmB9E;AAED;;;;;GAKG;AACH,wBAAgB,qBAAqB,CACnC,GAAG,EAAE,UAAU,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC,EACnC,QAAQ,EAAE,MAAM,EAAE,GACjB,IAAI,CAcN"}
@@ -0,0 +1,116 @@
1
+ import { MAX_FILE_BYTES, MAX_FILES } from '../util/project.js';
2
+ import { describeSuppression, unusedSuppressions } from './suppression.js';
3
+ import { describeReview, reviewOverdueDays } from './review.js';
4
+ import { loadFoundationFacts, loadFoundationStage } from '../foundation/loader.js';
5
+ /**
6
+ * Warnings that keep an audit honest about what it could not see.
7
+ *
8
+ * A warning is not a finding: it moves no score. It exists because a PASS
9
+ * computed over a truncated index, a single-commit history, or an ignored
10
+ * intent file is a weaker claim than it looks, and the report must say so.
11
+ */
12
+ /**
13
+ * A waiver that matched nothing is dead weight — usually a rule that no longer
14
+ * fires there, a renamed file, or a passing rule. Report it so suppressions
15
+ * decay instead of accumulating (ADR-0022, the ESLint model).
16
+ */
17
+ export function appendUnusedSuppressionWarnings(suppressions, warnings) {
18
+ for (const s of unusedSuppressions(suppressions)) {
19
+ warnings.push(`suppression for ${describeSuppression(s)} matched no finding — remove it or fix the target`);
20
+ }
21
+ }
22
+ /**
23
+ * Rank for the declared-vs-detected check (ADR-0041). Legacy is unranked:
24
+ * a retiring system plays a different game and gets no aspiration warning.
25
+ */
26
+ export const STAGE_RANK = { prototype: 0, mvp: 1, beta: 2, production: 3 };
27
+ /**
28
+ * ADR-0041: declared stage above detected maturity is aspiration beyond
29
+ * evidence — one loud line, zero moved bars. Severity keeps following
30
+ * detected maturity (never the declaration), so claiming `prototype` buys
31
+ * no leniency and claiming `production` buys no strictness.
32
+ */
33
+ export function assertStageAspiration(target, detected, warnings) {
34
+ const declared = loadFoundationStage(target);
35
+ if (declared === undefined)
36
+ return;
37
+ const want = STAGE_RANK[declared];
38
+ const have = STAGE_RANK[detected];
39
+ if (want === undefined || have === undefined || want <= have)
40
+ return;
41
+ warnings.push(`declared stage ${declared} exceeds detected maturity ${detected} — grading follows detected; ` +
42
+ `pass --profile ${declared} to be held to the declared bar explicitly`);
43
+ }
44
+ /**
45
+ * Declared intent becomes detection facts. The loader throws on a broken
46
+ * file (fail closed); the audit converts that into a warning and proceeds
47
+ * without intent facts — a malformed promise must be loud, but it must not
48
+ * brick the audit it was meant to guide.
49
+ */
50
+ export function assertFoundationFacts(target, facts, warnings) {
51
+ try {
52
+ for (const flag of loadFoundationFacts(target))
53
+ facts.flags.add(flag);
54
+ }
55
+ catch (err) {
56
+ warnings.push(`foundation intent ignored: ${err.message}`);
57
+ }
58
+ }
59
+ /**
60
+ * A review that matched nothing is dead provenance — the finding was fixed, the
61
+ * rule renamed, the file moved. A review whose `until` has passed is a decision
62
+ * nobody has revisited. Both are reported so the ledger decays instead of
63
+ * accumulating (ADR-0023, the ESLint model applied to attention).
64
+ */
65
+ export function appendReviewWarnings(reviews, warnings) {
66
+ const nowMs = Date.now();
67
+ for (const entries of reviews.values()) {
68
+ for (const entry of entries) {
69
+ if (!entry.used) {
70
+ warnings.push(`review for ${describeReview(entry.review)} matched no finding — remove it or re-target it`);
71
+ continue;
72
+ }
73
+ const overdue = reviewOverdueDays(entry.review, nowMs);
74
+ if (overdue !== null) {
75
+ warnings.push(`review for ${describeReview(entry.review)} was due ${entry.review.until} — ` +
76
+ `overdue by ${overdue} day(s); re-review`);
77
+ }
78
+ }
79
+ }
80
+ }
81
+ /**
82
+ * Scale honesty: a truncated index or skipped oversize files means PASS
83
+ * verdicts may rest on unseen files. Loud warning, never silent absorption.
84
+ */
85
+ export function appendIndexWarnings(project, warnings) {
86
+ if (project.truncated) {
87
+ warnings.push(`index truncated at ${MAX_FILES} files — the tree is bigger than the audit can see; ` +
88
+ 'treat PASS verdicts as partial and split the target (e.g. per-package audits)');
89
+ }
90
+ if (project.skippedLarge > 0) {
91
+ warnings.push(`${project.skippedLarge} file(s) skipped for exceeding ${MAX_FILE_BYTES} bytes — ` +
92
+ 'content checks could not see them');
93
+ }
94
+ if (project.skippedSymlinks > 0) {
95
+ warnings.push(`${project.skippedSymlinks} symlink(s) skipped without traversal — ` +
96
+ 'linked source is invisible to every check; materialize it to audit it');
97
+ }
98
+ }
99
+ /**
100
+ * History-thin targets blind the history-dependent rules (REPO-003 scans
101
+ * `git log`, REL-002 needs tags, maturity signals need commits). The
102
+ * negation in REPO-003 even turns git errors into PASS — true only in the
103
+ * vacuous sense. Say so loudly instead of scoring blind confidence.
104
+ */
105
+ export function appendHistoryWarnings(git, warnings) {
106
+ if (!git.isRepo) {
107
+ warnings.push('not a git repository — history and provenance checks cannot verify anything; ' +
108
+ 'treat history-dependent findings as vacuous');
109
+ return;
110
+ }
111
+ if (git.commits <= 1) {
112
+ warnings.push('single-commit history (shallow clone?) — maturity signals, tag checks, and ' +
113
+ 'history scans are under-verified; prefer a full clone for release-grade audits');
114
+ }
115
+ }
116
+ //# sourceMappingURL=audit-warnings.js.map
@@ -0,0 +1 @@
1
+ {"version":3,"file":"audit-warnings.js","sourceRoot":"","sources":["../../src/engine/audit-warnings.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,cAAc,EAAE,SAAS,EAAgB,MAAM,oBAAoB,CAAC;AAC7E,OAAO,EAAyB,mBAAmB,EAAE,kBAAkB,EAAE,MAAM,kBAAkB,CAAC;AAClG,OAAO,EAAE,cAAc,EAAE,iBAAiB,EAAoB,MAAM,aAAa,CAAC;AAClF,OAAO,EAAE,mBAAmB,EAAE,mBAAmB,EAAE,MAAM,yBAAyB,CAAC;AAEnF;;;;;;GAMG;AACH;;;;GAIG;AACH,MAAM,UAAU,+BAA+B,CAC7C,YAAsD,EACtD,QAAkB;IAElB,KAAK,MAAM,CAAC,IAAI,kBAAkB,CAAC,YAAY,CAAC,EAAE,CAAC;QACjD,QAAQ,CAAC,IAAI,CACX,mBAAmB,mBAAmB,CAAC,CAAC,CAAC,mDAAmD,CAC7F,CAAC;IACJ,CAAC;AACH,CAAC;AAED;;;GAGG;AACH,MAAM,CAAC,MAAM,UAAU,GAA2B,EAAE,SAAS,EAAE,CAAC,EAAE,GAAG,EAAE,CAAC,EAAE,IAAI,EAAE,CAAC,EAAE,UAAU,EAAE,CAAC,EAAE,CAAC;AAEnG;;;;;GAKG;AACH,MAAM,UAAU,qBAAqB,CAAC,MAAc,EAAE,QAAgB,EAAE,QAAkB;IACxF,MAAM,QAAQ,GAAG,mBAAmB,CAAC,MAAM,CAAC,CAAC;IAC7C,IAAI,QAAQ,KAAK,SAAS;QAAE,OAAO;IACnC,MAAM,IAAI,GAAG,UAAU,CAAC,QAAQ,CAAC,CAAC;IAClC,MAAM,IAAI,GAAG,UAAU,CAAC,QAAQ,CAAC,CAAC;IAClC,IAAI,IAAI,KAAK,SAAS,IAAI,IAAI,KAAK,SAAS,IAAI,IAAI,IAAI,IAAI;QAAE,OAAO;IACrE,QAAQ,CAAC,IAAI,CACX,kBAAkB,QAAQ,8BAA8B,QAAQ,+BAA+B;QAC7F,kBAAkB,QAAQ,4CAA4C,CACzE,CAAC;AACJ,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,qBAAqB,CAAC,MAAc,EAAE,KAAY,EAAE,QAAkB;IACpF,IAAI,CAAC;QACH,KAAK,MAAM,IAAI,IAAI,mBAAmB,CAAC,MAAM,CAAC;YAAE,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;IACxE,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,QAAQ,CAAC,IAAI,CAAC,8BAA+B,GAAa,CAAC,OAAO,EAAE,CAAC,CAAC;IACxE,CAAC;AACH,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,oBAAoB,CAAC,OAAoB,EAAE,QAAkB;IAC3E,MAAM,KAAK,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;IACzB,KAAK,MAAM,OAAO,IAAI,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC;QACvC,KAAK,MAAM,KAAK,IAAI,OAAO,EAAE,CAAC;YAC5B,IAAI,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC;gBAChB,QAAQ,CAAC,IAAI,CACX,cAAc,cAAc,CAAC,KAAK,CAAC,MAAM,CAAC,iDAAiD,CAC5F,CAAC;gBACF,SAAS;YACX,CAAC;YACD,MAAM,OAAO,GAAG,iBAAiB,CAAC,KAAK,CAAC,MAAM,EAAE,KAAK,CAAC,CAAC;YACvD,IAAI,OAAO,KAAK,IAAI,EAAE,CAAC;gBACrB,QAAQ,CAAC,IAAI,CACX,cAAc,cAAc,CAAC,KAAK,CAAC,MAAM,CAAC,YAAY,KAAK,CAAC,MAAM,CAAC,KAAK,KAAK;oBAC3E,cAAc,OAAO,oBAAoB,CAC5C,CAAC;YACJ,CAAC;QACH,CAAC;IACH,CAAC;AACH,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,mBAAmB,CAAC,OAAgB,EAAE,QAAkB;IACtE,IAAI,OAAO,CAAC,SAAS,EAAE,CAAC;QACtB,QAAQ,CAAC,IAAI,CACX,sBAAsB,SAAS,sDAAsD;YACnF,+EAA+E,CAClF,CAAC;IACJ,CAAC;IACD,IAAI,OAAO,CAAC,YAAY,GAAG,CAAC,EAAE,CAAC;QAC7B,QAAQ,CAAC,IAAI,CACX,GAAG,OAAO,CAAC,YAAY,kCAAkC,cAAc,WAAW;YAChF,mCAAmC,CACtC,CAAC;IACJ,CAAC;IACD,IAAI,OAAO,CAAC,eAAe,GAAG,CAAC,EAAE,CAAC;QAChC,QAAQ,CAAC,IAAI,CACX,GAAG,OAAO,CAAC,eAAe,0CAA0C;YAClE,uEAAuE,CAC1E,CAAC;IACJ,CAAC;AACH,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,qBAAqB,CACnC,GAAmC,EACnC,QAAkB;IAElB,IAAI,CAAC,GAAG,CAAC,MAAM,EAAE,CAAC;QAChB,QAAQ,CAAC,IAAI,CACX,+EAA+E;YAC7E,6CAA6C,CAChD,CAAC;QACF,OAAO;IACT,CAAC;IACD,IAAI,GAAG,CAAC,OAAO,IAAI,CAAC,EAAE,CAAC;QACrB,QAAQ,CAAC,IAAI,CACX,6EAA6E;YAC3E,gFAAgF,CACnF,CAAC;IACJ,CAAC;AACH,CAAC"}
@@ -1,40 +1,16 @@
1
- import type { AuditReport, Depth, Maturity, RulePack, UsaConfig } from '../types.js';
2
- import { type MaturityProfile } from './maturity.js';
3
- export interface AuditOptions {
4
- target: string;
5
- rulesDir?: string;
6
- depth?: Depth;
7
- profile?: Maturity | 'auto';
8
- config?: UsaConfig;
9
- allowCommands?: boolean;
10
- usaVersion?: string;
11
- /** Force these pack ids on/off regardless of detection. */
12
- includePacks?: string[];
13
- excludePacks?: string[];
14
- /** Indexing caps for bigger-than-comfortable trees (CLI wins over config). */
15
- maxFiles?: number;
16
- maxBytes?: number;
17
- /**
18
- * Extra rule packs merged into the loaded set for this run only. This is how
19
- * the evolution layer injects a *released* capability into a re-audit without
20
- * mutating the on-disk `rules/` registry — the resolved capability set lives
21
- * in `capabilitySetId`, not in the filesystem. The CLI never passes this, so
22
- * `usa audit` behaviour is unchanged.
23
- */
24
- extraPacks?: RulePack[];
25
- /**
26
- * Include the documentation universe audit (14 categories / 220 artifacts,
27
- * rules/docs-taxonomy.yaml) in this run: DOCU-* findings join S12. Opt-in
28
- * (CLI `--docs-universe` or `.usa.yaml` `docs.universe: true`) so existing
29
- * baselines stay stable; the standalone `usa docs audit` runs the same
30
- * computation and must agree (AC-8).
31
- */
32
- docsUniverse?: boolean;
33
- }
34
- export interface AuditOutcome {
35
- report: AuditReport;
36
- warnings: string[];
37
- profile: MaturityProfile;
38
- }
1
+ import type { AuditOptions, AuditOutcome } from './audit-types.js';
2
+ /**
3
+ * The audit coordinator.
4
+ *
5
+ * This module owns the *order* of an audit and nothing else: resolve options,
6
+ * index the tree, detect facts, choose packs, score, warn about what was not
7
+ * seen, build the report. Each step lives in a sibling module —
8
+ * `audit-config` (validation), `pack-selection` (fixed point), `evaluate-packs`
9
+ * (two-pass scoring), `audit-warnings` (honesty), `report-build` (assembly).
10
+ *
11
+ * The split is not cosmetic: at 840 lines this file was the project's only
12
+ * god file, and these are the seams the pipeline already had.
13
+ */
14
+ export type { AuditOptions, AuditOutcome } from './audit-types.js';
39
15
  export declare function runAudit(options: AuditOptions): AuditOutcome;
40
16
  //# sourceMappingURL=audit.d.ts.map
@@ -1 +1 @@
1
- {"version":3,"file":"audit.d.ts","sourceRoot":"","sources":["../../src/engine/audit.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EACV,WAAW,EACX,KAAK,EAGL,QAAQ,EAER,QAAQ,EAER,SAAS,EACV,MAAM,aAAa,CAAC;AA2BrB,OAAO,EAAwB,KAAK,eAAe,EAAE,MAAM,eAAe,CAAC;AA+B3E,MAAM,WAAW,YAAY;IAC3B,MAAM,EAAE,MAAM,CAAC;IACf,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,KAAK,CAAC,EAAE,KAAK,CAAC;IACd,OAAO,CAAC,EAAE,QAAQ,GAAG,MAAM,CAAC;IAC5B,MAAM,CAAC,EAAE,SAAS,CAAC;IACnB,aAAa,CAAC,EAAE,OAAO,CAAC;IACxB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,2DAA2D;IAC3D,YAAY,CAAC,EAAE,MAAM,EAAE,CAAC;IACxB,YAAY,CAAC,EAAE,MAAM,EAAE,CAAC;IACxB,8EAA8E;IAC9E,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB;;;;;;OAMG;IACH,UAAU,CAAC,EAAE,QAAQ,EAAE,CAAC;IACxB;;;;;;OAMG;IACH,YAAY,CAAC,EAAE,OAAO,CAAC;CACxB;AAED,MAAM,WAAW,YAAY;IAC3B,MAAM,EAAE,WAAW,CAAC;IACpB,QAAQ,EAAE,MAAM,EAAE,CAAC;IACnB,OAAO,EAAE,eAAe,CAAC;CAC1B;AAED,wBAAgB,QAAQ,CAAC,OAAO,EAAE,YAAY,GAAG,YAAY,CAkH5D"}
1
+ {"version":3,"file":"audit.d.ts","sourceRoot":"","sources":["../../src/engine/audit.ts"],"names":[],"mappings":"AAWA,OAAO,KAAK,EAAE,YAAY,EAAE,YAAY,EAAE,MAAM,kBAAkB,CAAC;AAsBnE;;;;;;;;;;;GAWG;AAEH,YAAY,EAAE,YAAY,EAAE,YAAY,EAAE,MAAM,kBAAkB,CAAC;AAEnE,wBAAgB,QAAQ,CAAC,OAAO,EAAE,YAAY,GAAG,YAAY,CAkH5D"}