// engine/supply-chain/index.ts — SPEC-046
// Orchestrator: runs all supply chain checkers and produces a SupplyChainReport.
import { detectSlsaLevel, buildSlsaGaps } from './slsa-checker.js';
import { checkSbom, buildSbomGaps } from './sbom-checker.js';
import { checkDependencies, buildDependencyGaps } from './dependency-checker.js';
import { checkBuild, buildBuildGaps } from './build-checker.js';
export { detectSlsaLevel, buildSlsaGaps, detectSlsaProvenanceFormat, detectNpmProvenance, } from './slsa-checker.js';
export { checkSbom, buildSbomGaps } from './sbom-checker.js';
export { checkDependencies, buildDependencyGaps } from './dependency-checker.js';
export { checkBuild, buildBuildGaps } from './build-checker.js';
/**
 * Run all supply chain security checks and return a consolidated SupplyChainReport.
 * Accepts an optional compliance context to tune gap severities.
 */
export async function runSupplyChainChecks(projectPath, isGovernmentOrEnterprise = false) {
    const [slsaResult, sbomResult, depResult, buildResult] = await Promise.all([
        detectSlsaLevel(projectPath),
        checkSbom(projectPath),
        checkDependencies(projectPath),
        checkBuild(projectPath),
    ]);
    const slsaGaps = buildSlsaGaps(slsaResult.level, slsaResult.isPublishing, slsaResult.hasOidc);
    const sbomGaps = buildSbomGaps(sbomResult, isGovernmentOrEnterprise);
    const depGaps = buildDependencyGaps(depResult);
    const buildGaps = buildBuildGaps(buildResult);
    return {
        slsaLevel: slsaResult.level,
        sbomPresent: sbomResult.sbomPresent,
        sbomValid: sbomResult.sbomValid,
        sbomFormat: sbomResult.sbomFormat,
        lockfilePresent: depResult.lockFile !== null,
        dependencyConfusionRisk: depResult.dependencyConfusionRisk,
        reproducibleBuild: buildResult.reproducibleBuild,
        signingPresent: slsaResult.level === 'L2' || slsaResult.level === 'L3',
        gaps: [...slsaGaps, ...sbomGaps, ...depGaps, ...buildGaps],
    };
}
//# sourceMappingURL=index.js.map