@xenos1996/usat 1.0.0

package/dist/detect/index.js

@@ -0,0 +1,329 @@
+import { parse as parseYaml } from 'yaml';
+import fs from 'node:fs';
+import path from 'node:path';
+/**
+ * Paths a detection scan must ignore. Prose, tests, and examples *talk about*
+ * technology; they are not evidence that the project uses it. Without this,
+ * auditing any repo that mentions "postgres" in its docs reports a Postgres
+ * dependency.
+ */
+const CONTENT_EXCLUDES = [
+    '**/*.md',
+    '**/*.mdx',
+    '**/*.rst',
+    'README*',
+    '**/README*',
+    // NB: deliberately NOT '**/*.txt' — requirements.txt is a manifest, not prose.
+    '**/docs/**',
+    '**/doc/**',
+    '**/examples/**',
+    '**/example/**',
+    '**/templates/**',
+    '**/fixtures/**',
+    '**/__mocks__/**',
+    '**/test/**',
+    '**/tests/**',
+    '**/__tests__/**',
+    '**/spec/**',
+    '**/*.test.*',
+    '**/*.spec.*',
+    '**/*.stories.*',
+    '**/test_*',
+    '**/*_test.*',
+    'LICENSE*',
+    'CHANGELOG*',
+];
+/** Load the detector registry. */
+export function loadDetectors(file) {
+    let raw;
+    try {
+        raw = fs.readFileSync(file, 'utf8');
+    }
+    catch {
+        return [];
+    }
+    const doc = parseYaml(raw);
+    return Array.isArray(doc?.detectors) ? doc.detectors : [];
+}
+/** Run every detector against the project and derive the fact set. */
+export function detect(project, detectors, git, extraFacts = []) {
+    const flags = new Set(extraFacts);
+    const metrics = {
+        commits: git.commits,
+        contributors: git.contributors,
+        tags: git.tags,
+        branches: git.branches,
+        files: project.files.length,
+        ...(git.daysSinceLastCommit !== undefined
+            ? { daysSinceLastCommit: git.daysSinceLastCommit }
+            : {}),
+    };
+    const fired = [];
+    // Fixed-point resolution: `implies` chains of any length resolve regardless
+    // of declaration order. Bounded by detectors.length + 1 passes (each pass
+    // must fire at least one new fact to continue), so a malformed registry
+    // cannot hang detection. Two hardcoded passes silently dropped chains of
+    // length 3+ declared worst-first, inflating score and confidence.
+    for (let pass = 0; pass <= detectors.length; pass++) {
+        let changed = false;
+        for (const d of detectors) {
+            if (processDetector(d, project, flags, metrics, fired))
+                changed = true;
+        }
+        if (!changed)
+            break;
+    }
+    const { maturity, signals } = classifyMaturity(flags, metrics, project);
+    flags.add(`maturity:${maturity}`);
+    return { facts: { flags, metrics }, detectorsFired: fired, maturity, maturitySignals: signals };
+}
+function processDetector(d, project, flags, metrics, fired) {
+    if (flags.has(d.fact))
+        return false;
+    let hit = false;
+    if (d.implies?.length) {
+        hit = d.implies.every((f) => flags.has(f));
+    }
+    if (!hit && d.match) {
+        hit = evalMatch(d.match, project, flags, metrics);
+    }
+    if (!hit)
+        return false;
+    flags.add(d.fact);
+    if (!fired.some((f) => f.fact === d.fact)) {
+        fired.push({ fact: d.fact, title: d.title, category: d.category });
+    }
+    return true;
+}
+function evalMatch(m, project, flags, metrics) {
+    const checks = [
+        ...matchAnyFile(m, project),
+        ...matchFileExists(m, project),
+        ...matchDirExists(m, project),
+        ...matchContent(m, project),
+        ...matchManifest(m, project),
+        ...matchMetric(m, metrics),
+        ...matchAnyOf(m, project, flags, metrics),
+        ...matchAllOf(m, project, flags, metrics),
+    ];
+    return checks.length > 0 && checks.every(Boolean);
+}
+/** Each matcher returns [] when its clause is absent, else a single verdict. */
+function matchAnyFile(m, project) {
+    return m.any_file?.length ? [project.anyFile(m.any_file)] : [];
+}
+function matchFileExists(m, project) {
+    return m.file_exists?.length ? [m.file_exists.some((f) => project.glob([f]).length > 0)] : [];
+}
+function matchDirExists(m, project) {
+    return m.dir_exists?.length ? [m.dir_exists.some((d) => project.dirExists(d))] : [];
+}
+function matchContent(m, project) {
+    if (!m.content)
+        return [];
+    const { include, pattern } = m.content;
+    return [project.grep(pattern, include, CONTENT_EXCLUDES).length > 0];
+}
+function matchManifest(m, project) {
+    return m.manifest ? [manifestHas(project, m.manifest)] : [];
+}
+function matchMetric(m, metrics) {
+    if (!m.metric)
+        return [];
+    const v = metrics[m.metric.name] ?? 0;
+    if (m.metric.min !== undefined && v < m.metric.min)
+        return [false];
+    if (m.metric.max !== undefined && v > m.metric.max)
+        return [false];
+    return [true];
+}
+function matchAnyOf(m, project, flags, metrics) {
+    return m.any_of?.length ? [m.any_of.some((c) => evalMatch(c, project, flags, metrics))] : [];
+}
+function matchAllOf(m, project, flags, metrics) {
+    return m.all_of?.length ? [m.all_of.every((c) => evalMatch(c, project, flags, metrics))] : [];
+}
+/** Dotted key lookup across JSON manifests, with a TOML/YAML text fallback. */
+function manifestHas(project, m) {
+    const matches = project.glob([m.file]);
+    if (matches.length === 0)
+        return false;
+    const file = matches[0];
+    const parts = m.key.split('.');
+    return file.endsWith('.json')
+        ? manifestHasJson(project, file, parts, m.contains)
+        : manifestHasText(project, file, parts, m.contains);
+}
+function manifestHasJson(project, file, parts, contains) {
+    const json = project.readJson(file);
+    const value = deepGet(json, parts.join('.'));
+    // No root-leaf fallback: when sections were specified (`a.b.c`) but the
+    // full path missed, a root-level key equal to the leaf (`{"c": …}`) must
+    // not count as a section-scoped hit. That fallback fired on any JSON with
+    // a coincidentally named top-level key.
+    if (value === undefined)
+        return false;
+    if (contains === undefined)
+        return true;
+    return String(value).includes(contains);
+}
+function manifestHasText(project, file, parts, contains) {
+    // TOML / YAML / go.mod: section-scoped text search.
+    const text = project.read(file);
+    if (text === null)
+        return false;
+    const leaf = parts[parts.length - 1];
+    const sections = parts.slice(0, -1);
+    // Word boundaries on both sides: without the leading one, leaf `test`
+    // matches inside `latest = …`; without the trailing one, similar affix
+    // collisions apply. Manifest keys are identifiers, so \b is the right gate.
+    const leafRe = new RegExp(`["']?\\b${escapeRe(leaf)}\\b["']?\\s*[=:]`, 'm');
+    if (sections.length > 0) {
+        const secName = sections[sections.length - 1];
+        const block = extractSection(text, secName);
+        if (block) {
+            // The section exists: decide solely on its content. A dependency named
+            // elsewhere (comments, other sections) must not satisfy a
+            // section-scoped query, and `contains` is checked against the block.
+            return leafRe.test(block) && containsOk(block, contains);
+        }
+        // No such section block. In a section-structured file (TOML/INI) that
+        // means the requested structure is absent — fail, don't rummage the
+        // whole file. In a flat file (YAML, go.mod) there are no blocks to
+        // match, so fall through to the whole-text search below.
+        if (hasSectionHeaders(text))
+            return false;
+    }
+    if (leafRe.test(text))
+        return containsOk(text, contains);
+    return false;
+}
+/** True when the text contains at least one `[section]`-style header. */
+function hasSectionHeaders(text) {
+    return /^\s*\[[^\]]*\]\s*$/m.test(text);
+}
+function containsOk(text, contains) {
+    return contains === undefined || text.includes(contains);
+}
+/** Grabs the bodies of ini/TOML sections like `[dependencies]` or `[tool.poetry]`. */
+function extractSection(text, section) {
+    const lines = text.split(/\r?\n/);
+    const want = section.toLowerCase();
+    let collecting = false;
+    let found = false;
+    let out = '';
+    for (const line of lines) {
+        const header = /^\s*\[([^\]]*)\]\s*$/.exec(line);
+        if (header) {
+            collecting = isWantedSection(header[1], want);
+            if (collecting)
+                found = true;
+            continue;
+        }
+        if (collecting)
+            out += line + '\n';
+    }
+    return found ? out : null;
+}
+/**
+ * The requested name must equal a full dot-segment of the header,
+ * case-insensitively. The old `\bname\b` substring test matched
+ * `[dev-dependencies]` for `dependencies` (`-` is a non-word char) and missed
+ * `[tool.Poetry]` for `poetry` (case). All matching blocks are gathered, not
+ * just the first — a repeated section later in the file counts too.
+ */
+function isWantedSection(headerBody, want) {
+    const segments = headerBody.split('.').map((s) => s.trim().replace(/^["']|["']$/g, ''));
+    const last = segments[segments.length - 1] ?? '';
+    return last.toLowerCase() === want;
+}
+function deepGet(obj, dotted) {
+    let cur = obj;
+    for (const key of dotted.split('.')) {
+        if (cur === null || typeof cur !== 'object')
+            return undefined;
+        cur = cur[key];
+    }
+    return cur;
+}
+function escapeRe(s) {
+    return s.replace(/[.*+?^${}()|[\]\\]/g, '\\$&');
+}
+/* --------------------------------------------------------------- maturity -- */
+/**
+ * Lifecycle classification. Deliberately conservative: a project is only
+ * called "production" when it has release tags, CI, tests and recent activity.
+ * The result drives severity dampening so a prototype is not graded like a
+ * bank.
+ */
+export function classifyMaturity(flags, metrics, project) {
+    const signals = [];
+    let score = 0;
+    const bump = (n, why, cond) => {
+        if (cond) {
+            score += n;
+            signals.push(`+${n} ${why}`);
+        }
+        else {
+            signals.push(`+0 ${why} (absent)`);
+        }
+    };
+    bump(1, 'tests present', flags.has('has:tests'));
+    bump(1, 'CI configured', flags.has('has:ci'));
+    bump(1, 'CHANGELOG maintained', flags.has('doc:changelog'));
+    bump(1, 'release tags published', metrics['tags'] > 0);
+    bump(1, 'meaningful history (>=50 commits)', metrics['commits'] >= 50);
+    bump(1, 'security policy published', flags.has('doc:security-policy'));
+    bump(0.5, 'containerised', flags.has('has:containers'));
+    bump(0.5, 'monitoring configured', flags.has('has:monitoring'));
+    bump(0.5, 'contributing guide', flags.has('doc:contributing'));
+    const days = metrics['daysSinceLastCommit'];
+    const stale = typeof days === 'number' && days > 365;
+    const abandoned = typeof days === 'number' && days > 540;
+    const stage = decideMaturityStage(score, metrics['tags'], days, stale, abandoned, flags);
+    let maturity = stage.maturity;
+    if (stage.signal)
+        signals.push(stage.signal);
+    // A 0.x version with no tags is never "production".
+    if (maturity === 'production' && project && isPrereleaseVersion(project)) {
+        maturity = 'beta';
+        signals.push('downgraded: 0.x version with no stable release');
+    }
+    signals.push(`maturity score ${score.toFixed(1)}/7.5 → ${maturity}`);
+    return { maturity, signals };
+}
+function decideMaturityStage(score, tags, days, stale, abandoned, flags) {
+    if (abandoned) {
+        return { maturity: 'legacy', signal: `legacy: last commit ${days}d ago` };
+    }
+    if (stale && !flags.has('has:ci')) {
+        return { maturity: 'legacy', signal: `legacy: ${days}d since last commit and no CI` };
+    }
+    if (score >= 7 && tags > 0)
+        return { maturity: 'production' };
+    if (score >= 5)
+        return { maturity: 'beta' };
+    if (score >= 2.5)
+        return { maturity: 'mvp' };
+    return { maturity: 'prototype' };
+}
+function isPrereleaseVersion(project) {
+    const pkg = project.readJson('package.json');
+    const v = pkg?.version;
+    if (typeof v === 'string' && /^0\./.test(v))
+        return true;
+    return false;
+}
+/* ------------------------------------------------------------------ helpers */
+export function factsByPrefix(facts, prefix) {
+    const out = [];
+    for (const f of facts.flags) {
+        if (f.startsWith(`${prefix}:`))
+            out.push(f.slice(prefix.length + 1));
+    }
+    return out.sort();
+}
+export function loadDetectorFile(rulesDir) {
+    return loadDetectors(path.join(rulesDir, 'detectors.yaml'));
+}
+//# sourceMappingURL=index.js.map

package/dist/detect/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/detect/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,KAAK,IAAI,SAAS,EAAE,MAAM,MAAM,CAAC;AAC1C,OAAO,EAAE,MAAM,SAAS,CAAC;AACzB,OAAO,IAAI,MAAM,WAAW,CAAC;AAyB7B;;;;;GAKG;AACH,MAAM,gBAAgB,GAAG;IACvB,SAAS;IACT,UAAU;IACV,UAAU;IACV,SAAS;IACT,YAAY;IACZ,+EAA+E;IAC/E,YAAY;IACZ,WAAW;IACX,gBAAgB;IAChB,eAAe;IACf,iBAAiB;IACjB,gBAAgB;IAChB,iBAAiB;IACjB,YAAY;IACZ,aAAa;IACb,iBAAiB;IACjB,YAAY;IACZ,aAAa;IACb,aAAa;IACb,gBAAgB;IAChB,WAAW;IACX,aAAa;IACb,UAAU;IACV,YAAY;CACb,CAAC;AASF,kCAAkC;AAClC,MAAM,UAAU,aAAa,CAAC,IAAY;IACxC,IAAI,GAAW,CAAC;IAChB,IAAI,CAAC;QACH,GAAG,GAAG,EAAE,CAAC,YAAY,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;IACtC,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,EAAE,CAAC;IACZ,CAAC;IACD,MAAM,GAAG,GAAG,SAAS,CAAC,GAAG,CAAsC,CAAC;IAChE,OAAO,KAAK,CAAC,OAAO,CAAC,GAAG,EAAE,SAAS,CAAC,CAAC,CAAC,CAAC,GAAI,CAAC,SAAU,CAAC,CAAC,CAAC,EAAE,CAAC;AAC9D,CAAC;AAED,sEAAsE;AACtE,MAAM,UAAU,MAAM,CACpB,OAAgB,EAChB,SAAqB,EACrB,GAAmC,EACnC,aAAuB,EAAE;IAEzB,MAAM,KAAK,GAAG,IAAI,GAAG,CAAS,UAAU,CAAC,CAAC;IAC1C,MAAM,OAAO,GAA2B;QACtC,OAAO,EAAE,GAAG,CAAC,OAAO;QACpB,YAAY,EAAE,GAAG,CAAC,YAAY;QAC9B,IAAI,EAAE,GAAG,CAAC,IAAI;QACd,QAAQ,EAAE,GAAG,CAAC,QAAQ;QACtB,KAAK,EAAE,OAAO,CAAC,KAAK,CAAC,MAAM;QAC3B,GAAG,CAAC,GAAG,CAAC,mBAAmB,KAAK,SAAS;YACvC,CAAC,CAAC,EAAE,mBAAmB,EAAE,GAAG,CAAC,mBAAmB,EAAE;YAClD,CAAC,CAAC,EAAE,CAAC;KACR,CAAC;IAEF,MAAM,KAAK,GAAsC,EAAE,CAAC;IAEpD,4EAA4E;IAC5E,0EAA0E;IAC1E,wEAAwE;IACxE,yEAAyE;IACzE,kEAAkE;IAClE,KAAK,IAAI,IAAI,GAAG,CAAC,EAAE,IAAI,IAAI,SAAS,CAAC,MAAM,EAAE,IAAI,EAAE,EAAE,CAAC;QACpD,IAAI,OAAO,GAAG,KAAK,CAAC;QACpB,KAAK,MAAM,CAAC,IAAI,SAAS,EAAE,CAAC;YAC1B,IAAI,eAAe,CAAC,CAAC,EAAE,OAAO,EAAE,KAAK,EAAE,OAAO,EAAE,KAAK,CAAC;gBAAE,OAAO,GAAG,IAAI,CAAC;QACzE,CAAC;QACD,IAAI,CAAC,OAAO;YAAE,MAAM;IACtB,CAAC;IAED,MAAM,EAAE,QAAQ,EAAE,OAAO,EAAE,GAAG,gBAAgB,CAAC,KAAK,EAAE,OAAO,EAAE,OAAO,CAAC,CAAC;IACxE,KAAK,CAAC,GAAG,CAAC,YAAY,QAAQ,EAAE,CAAC,CAAC;IAElC,OAAO,EAAE,KAAK,EAAE,EAAE,KAAK,EAAE,OAAO,EAAE,EAAE,cAAc,EAAE,KAAK,EAAE,QAAQ,EAAE,eAAe,EAAE,OAAO,EAAE,CAAC;AAClG,CAAC;AAED,SAAS,eAAe,CACtB,CAAW,EACX,OAAgB,EAChB,KAAkB,EAClB,OAA+B,EAC/B,KAAwC;IAExC,IAAI,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC;QAAE,OAAO,KAAK,CAAC;IACpC,IAAI,GAAG,GAAG,KAAK,CAAC;IAChB,IAAI,CAAC,CAAC,OAAO,EAAE,MAAM,EAAE,CAAC;QACtB,GAAG,GAAG,CAAC,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;IAC7C,CAAC;IACD,IAAI,CAAC,GAAG,IAAI,CAAC,CAAC,KAAK,EAAE,CAAC;QACpB,GAAG,GAAG,SAAS,CAAC,CAAC,CAAC,KAAK,EAAE,OAAO,EAAE,KAAK,EAAE,OAAO,CAAC,CAAC;IACpD,CAAC;IACD,IAAI,CAAC,GAAG;QAAE,OAAO,KAAK,CAAC;IACvB,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;IAClB,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC;QAC1C,KAAK,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC,KAAK,EAAE,QAAQ,EAAE,CAAC,CAAC,QAAQ,EAAE,CAAC,CAAC;IACrE,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED,SAAS,SAAS,CAChB,CAAgB,EAChB,OAAgB,EAChB,KAAkB,EAClB,OAA+B;IAE/B,MAAM,MAAM,GAAG;QACb,GAAG,YAAY,CAAC,CAAC,EAAE,OAAO,CAAC;QAC3B,GAAG,eAAe,CAAC,CAAC,EAAE,OAAO,CAAC;QAC9B,GAAG,cAAc,CAAC,CAAC,EAAE,OAAO,CAAC;QAC7B,GAAG,YAAY,CAAC,CAAC,EAAE,OAAO,CAAC;QAC3B,GAAG,aAAa,CAAC,CAAC,EAAE,OAAO,CAAC;QAC5B,GAAG,WAAW,CAAC,CAAC,EAAE,OAAO,CAAC;QAC1B,GAAG,UAAU,CAAC,CAAC,EAAE,OAAO,EAAE,KAAK,EAAE,OAAO,CAAC;QACzC,GAAG,UAAU,CAAC,CAAC,EAAE,OAAO,EAAE,KAAK,EAAE,OAAO,CAAC;KAC1C,CAAC;IAEF,OAAO,MAAM,CAAC,MAAM,GAAG,CAAC,IAAI,MAAM,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;AACpD,CAAC;AAED,gFAAgF;AAChF,SAAS,YAAY,CAAC,CAAgB,EAAE,OAAgB;IACtD,OAAO,CAAC,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;AACjE,CAAC;AAED,SAAS,eAAe,CAAC,CAAgB,EAAE,OAAgB;IACzD,OAAO,CAAC,CAAC,WAAW,EAAE,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,WAAW,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;AAChG,CAAC;AAED,SAAS,cAAc,CAAC,CAAgB,EAAE,OAAgB;IACxD,OAAO,CAAC,CAAC,UAAU,EAAE,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;AACtF,CAAC;AAED,SAAS,YAAY,CAAC,CAAgB,EAAE,OAAgB;IACtD,IAAI,CAAC,CAAC,CAAC,OAAO;QAAE,OAAO,EAAE,CAAC;IAC1B,MAAM,EAAE,OAAO,EAAE,OAAO,EAAE,GAAG,CAAC,CAAC,OAAO,CAAC;IACvC,OAAO,CAAC,OAAO,CAAC,IAAI,CAAC,OAAO,EAAE,OAAO,EAAE,gBAAgB,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;AACvE,CAAC;AAED,SAAS,aAAa,CAAC,CAAgB,EAAE,OAAgB;IACvD,OAAO,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,WAAW,CAAC,OAAO,EAAE,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;AAC9D,CAAC;AAED,SAAS,WAAW,CAAC,CAAgB,EAAE,OAA+B;IACpE,IAAI,CAAC,CAAC,CAAC,MAAM;QAAE,OAAO,EAAE,CAAC;IACzB,MAAM,CAAC,GAAG,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IACtC,IAAI,CAAC,CAAC,MAAM,CAAC,GAAG,KAAK,SAAS,IAAI,CAAC,GAAG,CAAC,CAAC,MAAM,CAAC,GAAG;QAAE,OAAO,CAAC,KAAK,CAAC,CAAC;IACnE,IAAI,CAAC,CAAC,MAAM,CAAC,GAAG,KAAK,SAAS,IAAI,CAAC,GAAG,CAAC,CAAC,MAAM,CAAC,GAAG;QAAE,OAAO,CAAC,KAAK,CAAC,CAAC;IACnE,OAAO,CAAC,IAAI,CAAC,CAAC;AAChB,CAAC;AAED,SAAS,UAAU,CACjB,CAAgB,EAChB,OAAgB,EAChB,KAAkB,EAClB,OAA+B;IAE/B,OAAO,CAAC,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,SAAS,CAAC,CAAC,EAAE,OAAO,EAAE,KAAK,EAAE,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;AAC/F,CAAC;AAED,SAAS,UAAU,CACjB,CAAgB,EAChB,OAAgB,EAChB,KAAkB,EAClB,OAA+B;IAE/B,OAAO,CAAC,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,SAAS,CAAC,CAAC,EAAE,OAAO,EAAE,KAAK,EAAE,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;AAChG,CAAC;AAED,+EAA+E;AAC/E,SAAS,WAAW,CAClB,OAAgB,EAChB,CAAmD;IAEnD,MAAM,OAAO,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC;IACvC,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,KAAK,CAAC;IACvC,MAAM,IAAI,GAAG,OAAO,CAAC,CAAC,CAAE,CAAC;IACzB,MAAM,KAAK,GAAG,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IAC/B,OAAO,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC;QAC3B,CAAC,CAAC,eAAe,CAAC,OAAO,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC,QAAQ,CAAC;QACnD,CAAC,CAAC,eAAe,CAAC,OAAO,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC,QAAQ,CAAC,CAAC;AACxD,CAAC;AAED,SAAS,eAAe,CACtB,OAAgB,EAChB,IAAY,EACZ,KAAe,EACf,QAA4B;IAE5B,MAAM,IAAI,GAAG,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC;IACpC,MAAM,KAAK,GAAG,OAAO,CAAC,IAAI,EAAE,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC;IAC7C,wEAAwE;IACxE,yEAAyE;IACzE,0EAA0E;IAC1E,wCAAwC;IACxC,IAAI,KAAK,KAAK,SAAS;QAAE,OAAO,KAAK,CAAC;IACtC,IAAI,QAAQ,KAAK,SAAS;QAAE,OAAO,IAAI,CAAC;IACxC,OAAO,MAAM,CAAC,KAAK,CAAC,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC;AAC1C,CAAC;AAED,SAAS,eAAe,CACtB,OAAgB,EAChB,IAAY,EACZ,KAAe,EACf,QAA4B;IAE5B,oDAAoD;IACpD,MAAM,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAChC,IAAI,IAAI,KAAK,IAAI;QAAE,OAAO,KAAK,CAAC;IAChC,MAAM,IAAI,GAAG,KAAK,CAAC,KAAK,CAAC,MAAM,GAAG,CAAC,CAAE,CAAC;IACtC,MAAM,QAAQ,GAAG,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC;IACpC,sEAAsE;IACtE,uEAAuE;IACvE,4EAA4E;IAC5E,MAAM,MAAM,GAAG,IAAI,MAAM,CAAC,WAAW,QAAQ,CAAC,IAAI,CAAC,kBAAkB,EAAE,GAAG,CAAC,CAAC;IAE5E,IAAI,QAAQ,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACxB,MAAM,OAAO,GAAG,QAAQ,CAAC,QAAQ,CAAC,MAAM,GAAG,CAAC,CAAE,CAAC;QAC/C,MAAM,KAAK,GAAG,cAAc,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC;QAC5C,IAAI,KAAK,EAAE,CAAC;YACV,uEAAuE;YACvE,0DAA0D;YAC1D,qEAAqE;YACrE,OAAO,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,UAAU,CAAC,KAAK,EAAE,QAAQ,CAAC,CAAC;QAC3D,CAAC;QACD,sEAAsE;QACtE,oEAAoE;QACpE,mEAAmE;QACnE,yDAAyD;QACzD,IAAI,iBAAiB,CAAC,IAAI,CAAC;YAAE,OAAO,KAAK,CAAC;IAC5C,CAAC;IACD,IAAI,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC;QAAE,OAAO,UAAU,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAC;IACzD,OAAO,KAAK,CAAC;AACf,CAAC;AAED,yEAAyE;AACzE,SAAS,iBAAiB,CAAC,IAAY;IACrC,OAAO,qBAAqB,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AAC1C,CAAC;AAED,SAAS,UAAU,CAAC,IAAY,EAAE,QAAiB;IACjD,OAAO,QAAQ,KAAK,SAAS,IAAI,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC;AAC3D,CAAC;AAED,sFAAsF;AACtF,SAAS,cAAc,CAAC,IAAY,EAAE,OAAe;IACnD,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;IAClC,MAAM,IAAI,GAAG,OAAO,CAAC,WAAW,EAAE,CAAC;IACnC,IAAI,UAAU,GAAG,KAAK,CAAC;IACvB,IAAI,KAAK,GAAG,KAAK,CAAC;IAClB,IAAI,GAAG,GAAG,EAAE,CAAC;IACb,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;QACzB,MAAM,MAAM,GAAG,sBAAsB,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACjD,IAAI,MAAM,EAAE,CAAC;YACX,UAAU,GAAG,eAAe,CAAC,MAAM,CAAC,CAAC,CAAE,EAAE,IAAI,CAAC,CAAC;YAC/C,IAAI,UAAU;gBAAE,KAAK,GAAG,IAAI,CAAC;YAC7B,SAAS;QACX,CAAC;QACD,IAAI,UAAU;YAAE,GAAG,IAAI,IAAI,GAAG,IAAI,CAAC;IACrC,CAAC;IACD,OAAO,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC;AAC5B,CAAC;AAED;;;;;;GAMG;AACH,SAAS,eAAe,CAAC,UAAkB,EAAE,IAAY;IACvD,MAAM,QAAQ,GAAG,UAAU,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,OAAO,CAAC,cAAc,EAAE,EAAE,CAAC,CAAC,CAAC;IACxF,MAAM,IAAI,GAAG,QAAQ,CAAC,QAAQ,CAAC,MAAM,GAAG,CAAC,CAAC,IAAI,EAAE,CAAC;IACjD,OAAO,IAAI,CAAC,WAAW,EAAE,KAAK,IAAI,CAAC;AACrC,CAAC;AAED,SAAS,OAAO,CAAC,GAAY,EAAE,MAAc;IAC3C,IAAI,GAAG,GAAY,GAAG,CAAC;IACvB,KAAK,MAAM,GAAG,IAAI,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC;QACpC,IAAI,GAAG,KAAK,IAAI,IAAI,OAAO,GAAG,KAAK,QAAQ;YAAE,OAAO,SAAS,CAAC;QAC9D,GAAG,GAAI,GAA+B,CAAC,GAAG,CAAC,CAAC;IAC9C,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED,SAAS,QAAQ,CAAC,CAAS;IACzB,OAAO,CAAC,CAAC,OAAO,CAAC,qBAAqB,EAAE,MAAM,CAAC,CAAC;AAClD,CAAC;AAED,iFAAiF;AAEjF;;;;;GAKG;AACH,MAAM,UAAU,gBAAgB,CAC9B,KAAkB,EAClB,OAA+B,EAC/B,OAAiB;IAEjB,MAAM,OAAO,GAAa,EAAE,CAAC;IAC7B,IAAI,KAAK,GAAG,CAAC,CAAC;IAEd,MAAM,IAAI,GAAG,CAAC,CAAS,EAAE,GAAW,EAAE,IAAa,EAAE,EAAE;QACrD,IAAI,IAAI,EAAE,CAAC;YACT,KAAK,IAAI,CAAC,CAAC;YACX,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,GAAG,EAAE,CAAC,CAAC;QAC/B,CAAC;aAAM,CAAC;YACN,OAAO,CAAC,IAAI,CAAC,MAAM,GAAG,WAAW,CAAC,CAAC;QACrC,CAAC;IACH,CAAC,CAAC;IAEF,IAAI,CAAC,CAAC,EAAE,eAAe,EAAE,KAAK,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC,CAAC;IACjD,IAAI,CAAC,CAAC,EAAE,eAAe,EAAE,KAAK,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC,CAAC;IAC9C,IAAI,CAAC,CAAC,EAAE,sBAAsB,EAAE,KAAK,CAAC,GAAG,CAAC,eAAe,CAAC,CAAC,CAAC;IAC5D,IAAI,CAAC,CAAC,EAAE,wBAAwB,EAAE,OAAO,CAAC,MAAM,CAAE,GAAG,CAAC,CAAC,CAAC;IACxD,IAAI,CAAC,CAAC,EAAE,mCAAmC,EAAE,OAAO,CAAC,SAAS,CAAE,IAAI,EAAE,CAAC,CAAC;IACxE,IAAI,CAAC,CAAC,EAAE,2BAA2B,EAAE,KAAK,CAAC,GAAG,CAAC,qBAAqB,CAAC,CAAC,CAAC;IACvE,IAAI,CAAC,GAAG,EAAE,eAAe,EAAE,KAAK,CAAC,GAAG,CAAC,gBAAgB,CAAC,CAAC,CAAC;IACxD,IAAI,CAAC,GAAG,EAAE,uBAAuB,EAAE,KAAK,CAAC,GAAG,CAAC,gBAAgB,CAAC,CAAC,CAAC;IAChE,IAAI,CAAC,GAAG,EAAE,oBAAoB,EAAE,KAAK,CAAC,GAAG,CAAC,kBAAkB,CAAC,CAAC,CAAC;IAE/D,MAAM,IAAI,GAAG,OAAO,CAAC,qBAAqB,CAAC,CAAC;IAC5C,MAAM,KAAK,GAAG,OAAO,IAAI,KAAK,QAAQ,IAAI,IAAI,GAAG,GAAG,CAAC;IACrD,MAAM,SAAS,GAAG,OAAO,IAAI,KAAK,QAAQ,IAAI,IAAI,GAAG,GAAG,CAAC;IAEzD,MAAM,KAAK,GAAG,mBAAmB,CAAC,KAAK,EAAE,OAAO,CAAC,MAAM,CAAE,EAAE,IAAI,EAAE,KAAK,EAAE,SAAS,EAAE,KAAK,CAAC,CAAC;IAC1F,IAAI,QAAQ,GAAG,KAAK,CAAC,QAAQ,CAAC;IAC9B,IAAI,KAAK,CAAC,MAAM;QAAE,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;IAE7C,oDAAoD;IACpD,IAAI,QAAQ,KAAK,YAAY,IAAI,OAAO,IAAI,mBAAmB,CAAC,OAAO,CAAC,EAAE,CAAC;QACzE,QAAQ,GAAG,MAAM,CAAC;QAClB,OAAO,CAAC,IAAI,CAAC,gDAAgD,CAAC,CAAC;IACjE,CAAC;IAED,OAAO,CAAC,IAAI,CAAC,kBAAkB,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,UAAU,QAAQ,EAAE,CAAC,CAAC;IACrE,OAAO,EAAE,QAAQ,EAAE,OAAO,EAAE,CAAC;AAC/B,CAAC;AAED,SAAS,mBAAmB,CAC1B,KAAa,EACb,IAAY,EACZ,IAAwB,EACxB,KAAc,EACd,SAAkB,EAClB,KAAkB;IAElB,IAAI,SAAS,EAAE,CAAC;QACd,OAAO,EAAE,QAAQ,EAAE,QAAQ,EAAE,MAAM,EAAE,uBAAuB,IAAI,OAAO,EAAE,CAAC;IAC5E,CAAC;IACD,IAAI,KAAK,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,QAAQ,CAAC,EAAE,CAAC;QAClC,OAAO,EAAE,QAAQ,EAAE,QAAQ,EAAE,MAAM,EAAE,WAAW,IAAI,+BAA+B,EAAE,CAAC;IACxF,CAAC;IACD,IAAI,KAAK,IAAI,CAAC,IAAI,IAAI,GAAG,CAAC;QAAE,OAAO,EAAE,QAAQ,EAAE,YAAY,EAAE,CAAC;IAC9D,IAAI,KAAK,IAAI,CAAC;QAAE,OAAO,EAAE,QAAQ,EAAE,MAAM,EAAE,CAAC;IAC5C,IAAI,KAAK,IAAI,GAAG;QAAE,OAAO,EAAE,QAAQ,EAAE,KAAK,EAAE,CAAC;IAC7C,OAAO,EAAE,QAAQ,EAAE,WAAW,EAAE,CAAC;AACnC,CAAC;AAED,SAAS,mBAAmB,CAAC,OAAgB;IAC3C,MAAM,GAAG,GAAG,OAAO,CAAC,QAAQ,CAAC,cAAc,CAAgC,CAAC;IAC5E,MAAM,CAAC,GAAG,GAAG,EAAE,OAAO,CAAC;IACvB,IAAI,OAAO,CAAC,KAAK,QAAQ,IAAI,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC;QAAE,OAAO,IAAI,CAAC;IACzD,OAAO,KAAK,CAAC;AACf,CAAC;AAED,gFAAgF;AAEhF,MAAM,UAAU,aAAa,CAAC,KAAY,EAAE,MAAc;IACxD,MAAM,GAAG,GAAa,EAAE,CAAC;IACzB,KAAK,MAAM,CAAC,IAAI,KAAK,CAAC,KAAK,EAAE,CAAC;QAC5B,IAAI,CAAC,CAAC,UAAU,CAAC,GAAG,MAAM,GAAG,CAAC;YAAE,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,KAAK,CAAC,MAAM,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC;IACvE,CAAC;IACD,OAAO,GAAG,CAAC,IAAI,EAAE,CAAC;AACpB,CAAC;AAED,MAAM,UAAU,gBAAgB,CAAC,QAAgB;IAC/C,OAAO,aAAa,CAAC,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,gBAAgB,CAAC,CAAC,CAAC;AAC9D,CAAC"}

package/dist/engine/audit.d.ts

@@ -0,0 +1,21 @@
+import type { AuditReport, Depth, Maturity, UsatConfig } from '../types.js';
+import { type MaturityProfile } from './maturity.js';
+export interface AuditOptions {
+    target: string;
+    rulesDir?: string;
+    depth?: Depth;
+    profile?: Maturity | 'auto';
+    config?: UsatConfig;
+    allowCommands?: boolean;
+    usatVersion?: string;
+    /** Force these pack ids on/off regardless of detection. */
+    includePacks?: string[];
+    excludePacks?: string[];
+}
+export interface AuditOutcome {
+    report: AuditReport;
+    warnings: string[];
+    profile: MaturityProfile;
+}
+export declare function runAudit(options: AuditOptions): AuditOutcome;
+//# sourceMappingURL=audit.d.ts.map

package/dist/engine/audit.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"audit.d.ts","sourceRoot":"","sources":["../../src/engine/audit.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EACV,WAAW,EACX,KAAK,EAGL,QAAQ,EAGR,UAAU,EACX,MAAM,aAAa,CAAC;AAQrB,OAAO,EAAwB,KAAK,eAAe,EAAE,MAAM,eAAe,CAAC;AA6B3E,MAAM,WAAW,YAAY;IAC3B,MAAM,EAAE,MAAM,CAAC;IACf,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,KAAK,CAAC,EAAE,KAAK,CAAC;IACd,OAAO,CAAC,EAAE,QAAQ,GAAG,MAAM,CAAC;IAC5B,MAAM,CAAC,EAAE,UAAU,CAAC;IACpB,aAAa,CAAC,EAAE,OAAO,CAAC;IACxB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,2DAA2D;IAC3D,YAAY,CAAC,EAAE,MAAM,EAAE,CAAC;IACxB,YAAY,CAAC,EAAE,MAAM,EAAE,CAAC;CACzB;AAED,MAAM,WAAW,YAAY;IAC3B,MAAM,EAAE,WAAW,CAAC;IACpB,QAAQ,EAAE,MAAM,EAAE,CAAC;IACnB,OAAO,EAAE,eAAe,CAAC;CAC1B;AAED,wBAAgB,QAAQ,CAAC,OAAO,EAAE,YAAY,GAAG,YAAY,CAwE5D"}

package/dist/engine/audit.js

@@ -0,0 +1,295 @@
+import path from 'node:path';
+import { SEVERITY_LADDER } from './loader.js';
+import { Project } from '../util/project.js';
+import { detect, loadDetectorFile } from '../detect/index.js';
+import { loadRulePacks, applyRuleOverrides } from './loader.js';
+import { evaluateRule, packApplies, ruleApplies } from './evaluate.js';
+import { loadSections } from './sections.js';
+import { loadProfiles, dampen } from './maturity.js';
+import { loadConfig } from '../config.js';
+import fs from 'node:fs';
+import { fileURLToPath } from 'node:url';
+/** `rules/`, resolved relative to the installed package (works from src and dist). */
+const DEFAULT_RULES_DIR = path.resolve(path.dirname(fileURLToPath(import.meta.url)), '..', '..', 'rules');
+/** Version of this build, read from package.json so it never drifts. */
+const DEFAULT_VERSION = (() => {
+    try {
+        const pkg = JSON.parse(fs.readFileSync(path.resolve(path.dirname(fileURLToPath(import.meta.url)), '..', '..', 'package.json'), 'utf8'));
+        return pkg.version ?? '0.0.0';
+    }
+    catch {
+        return '0.0.0';
+    }
+})();
+import { score } from './score.js';
+export function runAudit(options) {
+    // The programmatic entry point must be usable with nothing but a target, so
+    // every knob the CLI exposes gets a sane default here rather than a crash.
+    const config = options.config ?? loadConfig(options.target);
+    const opts = normalizeAuditOptions(options, config);
+    const warnings = [];
+    const project = new Project(opts.target, config.ignore ?? []);
+    const git = project.gitInfo();
+    const detectors = loadDetectorFile(opts.rulesDir);
+    const detection = detect(project, detectors, git, config.facts ?? []);
+    const { packs, warnings: packWarnings } = loadRulePacks(opts.rulesDir);
+    warnings.push(...packWarnings);
+    const { disabled, overrides } = collectRuleSettings(config, warnings);
+    applyRuleOverrides(packs, overrides);
+    const suppressions = resolveSuppressions(config.suppressions, warnings);
+    const { include, exclude } = resolvePackSets(options, config);
+    // A pack may assert extra facts simply by applying (e.g. "we are a monorepo").
+    const facts = detection.facts;
+    const selection = selectInitialPacks(packs, facts, include, exclude);
+    // Packs can contribute facts, which can make another pack apply. Resolve to a
+    // fixed point (bounded, so a malformed pack cannot hang the audit).
+    resolvePackFacts(packs, facts, include, exclude, selection);
+    const sections = selectSections(loadSections(opts.rulesDir), config.sections, warnings);
+    const profiles = loadProfiles(opts.rulesDir);
+    const maturity = resolveMaturity(opts.profile, config.maturity, detection.maturity, warnings);
+    const profile = profiles[maturity];
+    const ctx = {
+        project,
+        facts,
+        depth: opts.depth,
+        allowCommands: opts.allowCommands,
+        disabled,
+        suppressions,
+    };
+    const evaluatedAll = evaluatePacks(selection.activePacks, facts, opts.depth, include, ctx, profile);
+    // A `sections:` restriction narrows both the scored set and the report, so a
+    // scoped audit cannot leak findings it promised to exclude.
+    const sectionFilter = config.sections ?? [];
+    const wanted = new Set(sections.map((s) => s.id));
+    const evaluated = sectionFilter.length > 0
+        ? evaluatedAll.filter((e) => wanted.has(e.finding.section))
+        : evaluatedAll;
+    const card = score(evaluated, sections, profile);
+    const report = buildReport(opts, git, detection, facts, maturity, card, evaluated, selection.packsLoaded, selection.packsSkipped);
+    return { report, warnings, profile };
+}
+function normalizeAuditOptions(options, config) {
+    return {
+        rulesDir: options.rulesDir ?? DEFAULT_RULES_DIR,
+        depth: options.depth ?? 'standard',
+        profile: options.profile ?? 'auto',
+        allowCommands: options.allowCommands ?? false,
+        usatVersion: options.usatVersion ?? DEFAULT_VERSION,
+        target: options.target,
+        config,
+    };
+}
+/**
+ * Expired (or undated) waivers fail closed: an `until` date in the past — or
+ * one that cannot be parsed — excludes the suppression and raises a warning,
+ * so an audit never silently honours dead risk acceptances.
+ */
+function resolveSuppressions(suppressions, warnings) {
+    const map = new Map();
+    for (const s of suppressions ?? []) {
+        if (!s.rule)
+            continue;
+        if (s.until && isSuppressionExpired(s.rule, s.until, warnings))
+            continue;
+        map.set(s.rule, s.reason);
+    }
+    return map;
+}
+function isSuppressionExpired(rule, until, warnings) {
+    const t = Date.parse(until);
+    if (Number.isNaN(t)) {
+        warnings.push(`suppression for ${rule} has an unparseable "until" date ("${until}") — waiver ignored`);
+        return true;
+    }
+    if (t < Date.now()) {
+        warnings.push(`suppression for ${rule} expired on ${until} — treating as an active finding`);
+        return true;
+    }
+    return false;
+}
+const MATURITIES = ['prototype', 'mvp', 'beta', 'production', 'legacy'];
+/**
+ * CLI --profile wins; otherwise a valid config `maturity` pins the bar;
+ * otherwise auto-detection stands. Invalid config values warn and fall back.
+ */
+function resolveMaturity(cliProfile, configMaturity, detected, warnings) {
+    if (cliProfile !== 'auto')
+        return cliProfile;
+    if (configMaturity === undefined)
+        return detected;
+    if (MATURITIES.includes(configMaturity))
+        return configMaturity;
+    warnings.push(`.usat.yaml: invalid maturity "${String(configMaturity)}" — using auto-detected ${detected}`);
+    return detected;
+}
+/** Restrict scoring and reporting to the configured sections, if any. */
+function selectSections(all, wanted, warnings) {
+    if (!wanted || wanted.length === 0)
+        return all;
+    const known = new Set(all.map((s) => s.id));
+    for (const id of wanted) {
+        if (!known.has(id))
+            warnings.push(`.usat.yaml: unknown section "${id}" in sections — ignored`);
+    }
+    return all.filter((s) => wanted.includes(s.id));
+}
+function resolvePackSets(options, config) {
+    return {
+        include: new Set(options.includePacks ?? config.include ?? []),
+        exclude: new Set(options.excludePacks ?? config.exclude ?? []),
+    };
+}
+function collectRuleSettings(config, warnings) {
+    const disabled = new Set();
+    const overrides = {};
+    for (const [id, o] of Object.entries(config.rules ?? {})) {
+        if (o.disabled)
+            disabled.add(id);
+        const severity = validateOverrideSeverity(id, o.severity, warnings);
+        const weight = validateOverrideWeight(id, o.weight, warnings);
+        if (severity !== undefined || weight !== undefined) {
+            overrides[id] = { severity, weight };
+        }
+    }
+    return { disabled, overrides };
+}
+/**
+ * Config overrides flow straight into scoring arithmetic — an invalid severity
+ * yields NaN totals and a negative weight yields scores outside 0–100.
+ * Reject loudly rather than corrupt the report.
+ */
+function validateOverrideSeverity(id, v, warnings) {
+    if (v === undefined)
+        return undefined;
+    if (SEVERITY_LADDER.includes(String(v))) {
+        return String(v);
+    }
+    warnings.push(`rules.${id}: invalid severity "${String(v)}" — override ignored`);
+    return undefined;
+}
+function validateOverrideWeight(id, v, warnings) {
+    if (v === undefined)
+        return undefined;
+    if (typeof v === 'number' && Number.isFinite(v) && v >= 0)
+        return v;
+    warnings.push(`rules.${id}: invalid weight "${String(v)}" (must be a finite number ≥ 0) — override ignored`);
+    return undefined;
+}
+function selectInitialPacks(packs, facts, include, exclude) {
+    const selection = { activePacks: [], packsLoaded: [], packsSkipped: [] };
+    selection.activePacks = packs.filter((p) => selectPack(p, facts, include, exclude, selection));
+    return selection;
+}
+function selectPack(pack, facts, include, exclude, selection) {
+    if (exclude.has(pack.id)) {
+        selection.packsSkipped.push(pack.id);
+        return false;
+    }
+    if (include.has(pack.id)) {
+        selection.packsLoaded.push(pack.id);
+        pack.provides?.forEach((f) => facts.flags.add(f));
+        return true;
+    }
+    if (!packApplies(pack, facts)) {
+        selection.packsSkipped.push(pack.id);
+        return false;
+    }
+    selection.packsLoaded.push(pack.id);
+    pack.provides?.forEach((f) => facts.flags.add(f));
+    return true;
+}
+function resolvePackFacts(packs, facts, include, exclude, selection) {
+    for (let pass = 0; pass < 3; pass++) {
+        let changed = false;
+        for (const p of packs) {
+            if (selection.packsLoaded.includes(p.id) || exclude.has(p.id) || include.has(p.id))
+                continue;
+            if (!packApplies(p, facts))
+                continue;
+            selection.packsLoaded.push(p.id);
+            p.provides?.forEach((f) => facts.flags.add(f));
+            selection.activePacks.push(p);
+            changed = true;
+        }
+        if (!changed)
+            break;
+    }
+}
+function evaluatePacks(activePacks, facts, depth, include, ctx, profile) {
+    const evaluated = [];
+    for (const pack of activePacks) {
+        for (const rule of pack.rules) {
+            if (!ruleApplies(rule, facts, depth, include.has(pack.id)))
+                continue;
+            evaluated.push(scoreFinding(rule, ctx, profile));
+        }
+    }
+    return evaluated;
+}
+function scoreFinding(rule, ctx, profile) {
+    const finding = evaluateRule(rule, ctx);
+    if (finding.status === 'PASS' || finding.status === 'NOT_APPLICABLE') {
+        return { rule, finding };
+    }
+    const { severity, dampened } = dampen(rule.severity, rule.ruleClass, profile);
+    finding.severity = severity;
+    finding.dampened = dampened;
+    return { rule, finding };
+}
+function buildReport(opts, git, detection, facts, maturity, card, evaluated, packsLoaded, packsSkipped) {
+    return {
+        schema: 'usat-report-v1',
+        generatedAt: new Date().toISOString(),
+        usatVersion: opts.usatVersion,
+        target: {
+            path: path.resolve(opts.target),
+            name: path.basename(path.resolve(opts.target)) || opts.target,
+            commit: git.commit,
+            ref: git.ref,
+            repoUrl: git.repoUrl,
+        },
+        detection: {
+            maturity,
+            maturitySignals: detection.maturitySignals,
+            projectTypes: pick(facts, 'project'),
+            platforms: pick(facts, 'platform'),
+            languages: pick(facts, 'lang'),
+            frameworks: pick(facts, 'fw'),
+            packageManagers: pick(facts, 'pm'),
+            databases: pick(facts, 'db'),
+            flags: [...facts.flags].filter((f) => f.startsWith('has:')).sort(),
+            metrics: facts.metrics,
+        },
+        options: {
+            depth: opts.depth,
+            profile: opts.profile,
+            rulesDir: opts.rulesDir,
+            packsLoaded,
+            packsSkipped,
+        },
+        score: card,
+        findings: evaluated
+            .map((e) => e.finding)
+            .filter((f) => f.status !== 'NOT_APPLICABLE')
+            .sort(bySeverityThenSection),
+    };
+}
+function pick(facts, prefix) {
+    const out = [];
+    for (const f of facts.flags) {
+        if (f.startsWith(`${prefix}:`))
+            out.push(f.slice(prefix.length + 1));
+    }
+    return out.sort();
+}
+const ORDER = { CRITICAL: 0, HIGH: 1, MEDIUM: 2, LOW: 3, FUTURE: 4 };
+function bySeverityThenSection(a, b) {
+    const sa = ORDER[a.severity] ?? 9;
+    const sb = ORDER[b.severity] ?? 9;
+    if (sa !== sb)
+        return sa - sb;
+    if (a.section !== b.section)
+        return a.section.localeCompare(b.section, undefined, { numeric: true });
+    return a.ruleId.localeCompare(b.ruleId);
+}
+//# sourceMappingURL=audit.js.map