@vyuhlabs/dxkit 2.13.2 → 2.14.0

package/dist/baseline/create.js

@@ -63,9 +63,8 @@ const fs = __importStar(require("fs"));
 const path = __importStar(require("path"));
 const health_1 = require("../analyzers/health");
 const cache_1 = require("../analyzers/cache");
-const gather_1 = require("../analyzers/quality/gather");
-const tests_1 = require("../analyzers/tests");
-const gitleaks_1 = require("../analyzers/tools/gitleaks");
+const gather_scope_1 = require("./gather-scope");
+const scoped_inputs_1 = require("./scoped-inputs");
 const tool_registry_1 = require("../analyzers/tools/tool-registry");
 const detect_1 = require("../detect");
 const coverage_1 = require("./coverage");
@@ -77,7 +76,6 @@ const producers_1 = require("./producers");
 const salt_1 = require("../analyzers/tools/salt");
 const sanitize_1 = require("./sanitize");
 const types_1 = require("./types");
-const gather_2 = require("../allowlist/gather");
 /** Hash used for baseline-envelope metadata fields (policy, ignore,
  *  toolchain, config). Distinct concern from finding-identity
  *  fingerprints — these never enter the matcher's identity space. */
@@ -251,9 +249,19 @@ function clearToolVersionCache() {
  */
 async function gatherCurrentScan(options) {
     const cwd = path.resolve(options.cwd);
+    const scope = options.scope ?? gather_scope_1.FULL_SCOPE;
+    // A scoped OR incrementally-scanned result is partial — it must never
+    // enter the shared cache where a later full `health` read would consume
+    // an incomplete codePatterns set.
+    const partial = !(0, gather_scope_1.isFullScope)(scope) || options.incrementalFiles !== undefined;
     const analysisResult = await (0, cache_1.readOrBuildAnalysisResult)({
         cwd,
-        build: (innerCwd) => (0, health_1.gatherAnalysisResultBody)(innerCwd, { verbose: !!options.verbose }),
+        build: (innerCwd) => (0, health_1.gatherAnalysisResultBody)(innerCwd, {
+            verbose: !!options.verbose,
+            scope,
+            incrementalFiles: options.incrementalFiles,
+        }),
+        opts: { partial },
     });
     const aggregate = analysisResult.capabilities.securityAggregate;
     if (!aggregate) {
@@ -273,22 +281,18 @@ async function gatherCurrentScan(options) {
     // here (or earlier inside readOrBuildAnalysisResult) so producers
     // can be pure or near-pure consumers — adding a new producer
     // means extending this context with one more input, never
-    // adding another producer-specific block in this function.
-    const testGapsReport = await (0, tests_1.analyzeTestGaps)(cwd, { verbose: !!options.verbose });
-    const hygieneMarkers = (0, gather_1.gatherHygieneMarkers)(cwd);
-    const gitleaksOutcome = (0, gitleaks_1.gatherGitleaksResult)(cwd);
-    const rawSecrets = gitleaksOutcome.kind === 'success' ? gitleaksOutcome.rawSecrets : [];
-    // Inline `dxkit-allow:` annotations gathered from source so the
-    // stale-allow producer can flag orphans whose underlying findings
-    // are no longer present.
-    const inlineAllowlistAnnotations = (0, gather_2.gatherInlineAllowlistAnnotations)(cwd);
+    // adding another producer-specific block in this function. The
+    // scope-aware analyzer inputs (test-gaps, hygiene, raw secrets,
+    // inline annotations) come from one helper that skips the gathers a
+    // scope can't block on (see scoped-inputs.ts).
+    const { testGapsReport, hygiene, rawSecrets, inlineAllowlistAnnotations } = await (0, scoped_inputs_1.gatherScopedProducerInputs)(cwd, scope, !!options.verbose);
     const producerCtx = {
         cwd,
         commitSha: repoState.commitSha,
         salt,
         analysisResult,
         testGapsReport,
-        hygiene: hygieneMarkers,
+        hygiene,
         rawSecrets,
         inlineAllowlistAnnotations,
     };

package/dist/baseline/create.js.map

@@ -1 +1 @@
-{"version":3,"file":"create.js","sourceRoot":"","sources":["../../src/baseline/create.ts"],"names":[],"mappings":";AAAA;;;;;;;;;;;;;;;;;;;GAmBG;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AA2OH,sDAEC;AAwCD,8CAsGC;AAUD,gDAGC;AAkBD,wCAoDC;AA5cD,iDAA6C;AAC7C,mCAAoC;AACpC,uCAAyB;AACzB,2CAA6B;AAC7B,gDAA+D;AAC/D,8CAA+D;AAC/D,wDAAmE;AACnE,8CAAqD;AACrD,0DAAmE;AAEnE,oEAAsF;AACtF,sCAAmC;AACnC,yCAAsD;AAEtD,4CAAwD;AACxD,mDAKyB;AAEzB,mCAA8C;AAE9C,qCAAwE;AACxE,2CAAsD;AAEtD,kDAAsD;AAEtD,yCAA0C;AAE1C,mCAAkD;AAElD,gDAAuE;AAuCvE;;qEAEqE;AACrE,SAAS,WAAW,CAAC,OAAe;IAClC,OAAO,IAAA,mBAAU,EAAC,MAAM,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,sEAAsE;AAC9I,CAAC;AAED;;;;;GAKG;AACH,SAAS,gBAAgB,CAAC,QAAgB;IACxC,IAAI,CAAC;QACH,OAAO,EAAE,CAAC,YAAY,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC;IAC3C,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,EAAE,CAAC;IACZ,CAAC;AACH,CAAC;AAED;;;qCAGqC;AACrC,SAAS,aAAa,CAAC,GAAW;IAChC,MAAM,GAAG,GAAG,CAAC,GAAG,IAAc,EAAU,EAAE;QACxC,IAAI,CAAC;YACH,OAAO,IAAA,4BAAY,EAAC,KAAK,EAAE,IAAI,EAAE;gBAC/B,GAAG;gBACH,QAAQ,EAAE,MAAM;gBAChB,KAAK,EAAE,CAAC,QAAQ,EAAE,MAAM,EAAE,MAAM,CAAC;aAClC,CAAC,CAAC,IAAI,EAAE,CAAC;QACZ,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,EAAE,CAAC;QACZ,CAAC;IACH,CAAC,CAAC;IACF,OAAO;QACL,SAAS,EAAE,GAAG,CAAC,WAAW,EAAE,MAAM,CAAC;QACnC,MAAM,EAAE,GAAG,CAAC,WAAW,EAAE,cAAc,EAAE,MAAM,CAAC;KACjD,CAAC;AACJ,CAAC;AAED,qEAAqE;AACrE,SAAS,iBAAiB,CAAC,GAAW;IACpC,MAAM,UAAU,GAAG,WAAW,CAAC,IAAI,CAAC,SAAS,CAAC,kCAAyB,CAAC,CAAC,CAAC;IAC1E,MAAM,UAAU,GAAG,WAAW,CAAC,gBAAgB,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,eAAe,CAAC,CAAC,CAAC,CAAC;IAClF,MAAM,UAAU,GAAG,WAAW,CAAC,gBAAgB,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,kBAAkB,CAAC,CAAC,CAAC,CAAC;IACrF,0DAA0D;IAC1D,kEAAkE;IAClE,OAAO,EAAE,YAAY,EAAE,mBAAa,EAAE,UAAU,EAAE,UAAU,EAAE,aAAa,EAAE,EAAE,EAAE,UAAU,EAAE,CAAC;AAChG,CAAC;AAED;;;;;;;;;;;;;;;;2CAgB2C;AAC3C,SAAS,aAAa,CAAC,SAAgC,EAAE,GAAW;IAClE,MAAM,GAAG,GAA2B,EAAE,CAAC;IACvC,KAAK,MAAM,IAAI,IAAI,SAAS,EAAE,CAAC;QAC7B,IAAI,CAAC,IAAI;YAAE,SAAS;QACpB,GAAG,CAAC,IAAI,CAAC,GAAG,kBAAkB,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC;IAC5C,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED;;;;;;;;;;;GAWG;AACH,MAAM,gBAAgB,GAAwB,IAAI,GAAG,CAAC,CAAC,qBAAqB,EAAE,cAAc,CAAC,CAAC,CAAC;AAE/F;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AACH,MAAM,aAAa,GAAG,IAAI,GAAG,EAAkB,CAAC;AAEhD,SAAS,kBAAkB,CAAC,IAAY,EAAE,GAAW;IACnD,MAAM,QAAQ,GAAG,GAAG,IAAI,KAAK,GAAG,EAAE,CAAC;IACnC,MAAM,MAAM,GAAG,aAAa,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;IAC3C,IAAI,MAAM,KAAK,SAAS;QAAE,OAAO,MAAM,CAAC;IACxC,MAAM,QAAQ,GAAG,0BAA0B,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC;IACvD,aAAa,CAAC,GAAG,CAAC,QAAQ,EAAE,QAAQ,CAAC,CAAC;IACtC,OAAO,QAAQ,CAAC;AAClB,CAAC;AAED,SAAS,0BAA0B,CAAC,IAAY,EAAE,GAAW;IAC3D,IAAI,gBAAgB,CAAC,GAAG,CAAC,IAAI,CAAC;QAAE,OAAO,SAAS,mBAAa,EAAE,CAAC;IAChE,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IAC9B,KAAK,IAAI,CAAC,GAAG,KAAK,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC;QACtC,MAAM,SAAS,GAAG,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QAC9C,MAAM,GAAG,GAAG,yBAAS,CAAC,SAAS,CAAC,CAAC;QACjC,IAAI,CAAC,GAAG;YAAE,SAAS;QACnB,iEAAiE;QACjE,iEAAiE;QACjE,4DAA4D;QAC5D,+DAA+D;QAC/D,8DAA8D;QAC9D,iEAAiE;QACjE,iEAAiE;QACjE,+DAA+D;QAC/D,8DAA8D;QAC9D,kDAAkD;QAClD,KAAK,IAAI,OAAO,GAAG,CAAC,EAAE,OAAO,GAAG,CAAC,EAAE,OAAO,EAAE,EAAE,CAAC;YAC7C,MAAM,MAAM,GAAG,IAAA,wBAAQ,EAAC,GAAG,EAAE,GAAG,CAAC,CAAC;YAClC,IAAI,MAAM,CAAC,OAAO;gBAAE,OAAO,MAAM,CAAC,OAAO,CAAC;QAC5C,CAAC;QACD,OAAO,SAAS,CAAC;IACnB,CAAC;IACD,OAAO,SAAS,CAAC;AACnB,CAAC;AAED;;;;;GAKG;AACH,SAAgB,qBAAqB;IACnC,aAAa,CAAC,KAAK,EAAE,CAAC;AACxB,CAAC;AA+BD;;;;;;;;GAQG;AACI,KAAK,UAAU,iBAAiB,CAAC,OAGvC;IACC,MAAM,GAAG,GAAG,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;IAEtC,MAAM,cAAc,GAAG,MAAM,IAAA,iCAAyB,EAAC;QACrD,GAAG;QACH,KAAK,EAAE,CAAC,QAAQ,EAAE,EAAE,CAAC,IAAA,iCAAwB,EAAC,QAAQ,EAAE,EAAE,OAAO,EAAE,CAAC,CAAC,OAAO,CAAC,OAAO,EAAE,CAAC;KACxF,CAAC,CAAC;IACH,MAAM,SAAS,GAAG,cAAc,CAAC,YAAY,CAAC,iBAAiB,CAAC;IAChE,IAAI,CAAC,SAAS,EAAE,CAAC;QACf,MAAM,IAAI,KAAK,CACb,iEAAiE;YAC/D,yDAAyD,CAC5D,CAAC;IACJ,CAAC;IAED,MAAM,SAAS,GAAsB;QACnC,GAAG,aAAa,CAAC,GAAG,CAAC;QACrB,IAAI,EAAE,GAAG;KACV,CAAC;IAEF,iEAAiE;IACjE,4DAA4D;IAC5D,kEAAkE;IAClE,aAAa;IACb,MAAM,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE,GAAG,IAAA,kBAAW,EAAC,GAAG,CAAC,CAAC;IAElD,gEAAgE;IAChE,kEAAkE;IAClE,6DAA6D;IAC7D,0DAA0D;IAC1D,2DAA2D;IAC3D,MAAM,cAAc,GAAG,MAAM,IAAA,uBAAe,EAAC,GAAG,EAAE,EAAE,OAAO,EAAE,CAAC,CAAC,OAAO,CAAC,OAAO,EAAE,CAAC,CAAC;IAClF,MAAM,cAAc,GAAG,IAAA,6BAAoB,EAAC,GAAG,CAAC,CAAC;IACjD,MAAM,eAAe,GAAG,IAAA,+BAAoB,EAAC,GAAG,CAAC,CAAC;IAClD,MAAM,UAAU,GACd,eAAe,CAAC,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,eAAe,CAAC,UAAU,CAAC,CAAC,CAAC,EAAE,CAAC;IACvE,gEAAgE;IAChE,kEAAkE;IAClE,yBAAyB;IACzB,MAAM,0BAA0B,GAAG,IAAA,yCAAgC,EAAC,GAAG,CAAC,CAAC;IAEzE,MAAM,WAAW,GAAoB;QACnC,GAAG;QACH,SAAS,EAAE,SAAS,CAAC,SAAS;QAC9B,IAAI;QACJ,cAAc;QACd,cAAc;QACd,OAAO,EAAE,cAAc;QACvB,UAAU;QACV,0BAA0B;KAC3B,CAAC;IAEF,8DAA8D;IAC9D,2DAA2D;IAC3D,gEAAgE;IAChE,QAAQ;IACR,MAAM,QAAQ,GAAwB,IAAA,wBAAY,EAAC,WAAW,EAAE,qBAAS,CAAC,CAAC;IAE3E,MAAM,SAAS,GAAG,IAAI,GAAG,EAAU,CAAC;IACpC,oEAAoE;IACpE,yEAAyE;IACzE,sEAAsE;IACtE,qEAAqE;IACrE,mEAAmE;IACnE,MAAM,QAAQ,GAAG,CAAC,MAAiC,EAAE,EAAE;QACrD,IAAI,CAAC,MAAM;YAAE,OAAO;QACpB,KAAK,MAAM,IAAI,IAAI,MAAM;aACtB,KAAK,CAAC,GAAG,CAAC;aACV,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;aACpB,MAAM,CAAC,OAAO,CAAC,EAAE,CAAC;YACnB,SAAS,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;QACtB,CAAC;IACH,CAAC,CAAC;IACF,QAAQ,CAAC,SAAS,CAAC,UAAU,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;IAC5C,QAAQ,CAAC,SAAS,CAAC,UAAU,CAAC,YAAY,CAAC,IAAI,CAAC,CAAC;IACjD,QAAQ,CAAC,SAAS,CAAC,UAAU,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC;IAC7C,IAAI,SAAS,CAAC,UAAU,CAAC,SAAS,CAAC,GAAG;QAAE,SAAS,CAAC,GAAG,CAAC,qBAAqB,CAAC,CAAC;IAC7E,MAAM,KAAK,GAAG,aAAa,CAAC,CAAC,GAAG,SAAS,CAAC,CAAC,IAAI,EAAE,EAAE,GAAG,CAAC,CAAC;IAExD,MAAM,YAAY,GAAyB;QACzC,GAAG,iBAAiB,CAAC,GAAG,CAAC;QACzB,aAAa,EAAE,WAAW,CAAC,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC;KAClD,CAAC;IAEF,sEAAsE;IACtE,kEAAkE;IAClE,wDAAwD;IACxD,MAAM,QAAQ,GAAG,IAAA,mCAAwB,EAAC,IAAA,6BAAa,EAAC,cAAc,CAAC,KAAK,CAAC,SAAS,EAAE,GAAG,CAAC,CAAC,CAAC;IAE9F,OAAO;QACL,QAAQ;QACR,SAAS;QACT,SAAS;QACT,QAAQ;QACR,KAAK;QACL,QAAQ;QACR,YAAY;QACZ,WAAW;KACZ,CAAC;AACJ,CAAC;AAED;;;;;;;GAOG;AACH,SAAgB,kBAAkB,CAAC,GAAW;IAC5C,MAAM,QAAQ,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;IACnC,OAAO,IAAA,mCAAwB,EAAC,IAAA,6BAAa,EAAC,IAAA,eAAM,EAAC,QAAQ,CAAC,CAAC,SAAS,EAAE,QAAQ,CAAC,CAAC,CAAC;AACvF,CAAC;AAED;;;;;;;;;;;;;;;GAeG;AACI,KAAK,UAAU,cAAc,CAClC,OAA8B;IAE9B,MAAM,GAAG,GAAG,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;IACtC,MAAM,IAAI,GAAG,OAAO,CAAC,IAAI,IAAI,qCAAqB,CAAC;IACnD,MAAM,IAAI,GACR,OAAO,CAAC,YAAY;QACpB,CAAC,GAAG,EAAE;YACJ,MAAM,MAAM,GAAG,IAAA,0BAAiB,EAAC,GAAG,CAAC,CAAC;YACtC,OAAO,IAAA,2BAAmB,EAAC;gBACzB,GAAG;gBACH,OAAO,EAAE,OAAO,CAAC,OAAO;gBACxB,MAAM,EAAE,OAAO,CAAC,MAAM;gBACtB,UAAU,EAAE,MAAM,CAAC,QAAQ,EAAE,IAAI;gBACjC,SAAS,EAAE,MAAM,CAAC,QAAQ,EAAE,GAAG;aAChC,CAAC,CAAC;QACL,CAAC,CAAC,EAAE,CAAC;IAEP,IAAI,IAAI,CAAC,IAAI,KAAK,WAAW,EAAE,CAAC;QAC9B,8DAA8D;QAC9D,8DAA8D;QAC9D,+DAA+D;QAC/D,gEAAgE;QAChE,OAAO,EAAE,IAAI,EAAE,CAAC;IAClB,CAAC;IAED,MAAM,QAAQ,GAAG,IAAA,+BAAe,EAAC,GAAG,EAAE,IAAI,CAAC,CAAC;IAC5C,IAAI,CAAC,OAAO,CAAC,KAAK,IAAI,EAAE,CAAC,UAAU,CAAC,QAAQ,CAAC,EAAE,CAAC;QAC9C,MAAM,IAAI,KAAK,CACb,8BAA8B,QAAQ,mCAAmC;YACvE,yCAAyC,CAC5C,CAAC;IACJ,CAAC;IAED,MAAM,IAAI,GAAG,MAAM,iBAAiB,CAAC,EAAE,GAAG,EAAE,OAAO,EAAE,OAAO,CAAC,OAAO,EAAE,CAAC,CAAC;IAExE,MAAM,QAAQ,GAAiB;QAC7B,aAAa,EAAE,uCAAuB;QACtC,IAAI;QACJ,SAAS,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;QACnC,IAAI,EAAE,IAAI,CAAC,SAAS;QACpB,QAAQ,EAAE,IAAI,CAAC,YAAY;QAC3B,KAAK,EAAE,IAAI,CAAC,KAAK;QACjB,QAAQ,EAAE,IAAI,CAAC,QAAQ;QACvB,cAAc,EAAE,+BAAuB;QACvC,QAAQ,EAAE,IAAI,CAAC,QAAQ;QACvB,QAAQ,EAAE,IAAI,CAAC,QAAQ;KACxB,CAAC;IAEF,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,KAAK,qBAAqB,CAAC,CAAC,CAAC,IAAA,uBAAY,EAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC;IACrF,IAAA,iCAAiB,EAAC,QAAQ,EAAE,IAAI,CAAC,CAAC;IAClC,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC;AACxC,CAAC"}
+{"version":3,"file":"create.js","sourceRoot":"","sources":["../../src/baseline/create.ts"],"names":[],"mappings":";AAAA;;;;;;;;;;;;;;;;;;;GAmBG;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAwOH,sDAEC;AAwCD,8CAsHC;AAUD,gDAGC;AAkBD,wCAoDC;AAzdD,iDAA6C;AAC7C,mCAAoC;AACpC,uCAAyB;AACzB,2CAA6B;AAC7B,gDAA+D;AAC/D,8CAA+D;AAC/D,iDAA2E;AAC3E,mDAA6D;AAC7D,oEAAsF;AACtF,sCAAmC;AACnC,yCAAsD;AAEtD,4CAAwD;AACxD,mDAKyB;AAEzB,mCAA8C;AAE9C,qCAAwE;AACxE,2CAAsD;AAEtD,kDAAsD;AAEtD,yCAA0C;AAE1C,mCAAkD;AAwClD;;qEAEqE;AACrE,SAAS,WAAW,CAAC,OAAe;IAClC,OAAO,IAAA,mBAAU,EAAC,MAAM,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,sEAAsE;AAC9I,CAAC;AAED;;;;;GAKG;AACH,SAAS,gBAAgB,CAAC,QAAgB;IACxC,IAAI,CAAC;QACH,OAAO,EAAE,CAAC,YAAY,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC;IAC3C,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,EAAE,CAAC;IACZ,CAAC;AACH,CAAC;AAED;;;qCAGqC;AACrC,SAAS,aAAa,CAAC,GAAW;IAChC,MAAM,GAAG,GAAG,CAAC,GAAG,IAAc,EAAU,EAAE;QACxC,IAAI,CAAC;YACH,OAAO,IAAA,4BAAY,EAAC,KAAK,EAAE,IAAI,EAAE;gBAC/B,GAAG;gBACH,QAAQ,EAAE,MAAM;gBAChB,KAAK,EAAE,CAAC,QAAQ,EAAE,MAAM,EAAE,MAAM,CAAC;aAClC,CAAC,CAAC,IAAI,EAAE,CAAC;QACZ,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,EAAE,CAAC;QACZ,CAAC;IACH,CAAC,CAAC;IACF,OAAO;QACL,SAAS,EAAE,GAAG,CAAC,WAAW,EAAE,MAAM,CAAC;QACnC,MAAM,EAAE,GAAG,CAAC,WAAW,EAAE,cAAc,EAAE,MAAM,CAAC;KACjD,CAAC;AACJ,CAAC;AAED,qEAAqE;AACrE,SAAS,iBAAiB,CAAC,GAAW;IACpC,MAAM,UAAU,GAAG,WAAW,CAAC,IAAI,CAAC,SAAS,CAAC,kCAAyB,CAAC,CAAC,CAAC;IAC1E,MAAM,UAAU,GAAG,WAAW,CAAC,gBAAgB,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,eAAe,CAAC,CAAC,CAAC,CAAC;IAClF,MAAM,UAAU,GAAG,WAAW,CAAC,gBAAgB,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,kBAAkB,CAAC,CAAC,CAAC,CAAC;IACrF,0DAA0D;IAC1D,kEAAkE;IAClE,OAAO,EAAE,YAAY,EAAE,mBAAa,EAAE,UAAU,EAAE,UAAU,EAAE,aAAa,EAAE,EAAE,EAAE,UAAU,EAAE,CAAC;AAChG,CAAC;AAED;;;;;;;;;;;;;;;;2CAgB2C;AAC3C,SAAS,aAAa,CAAC,SAAgC,EAAE,GAAW;IAClE,MAAM,GAAG,GAA2B,EAAE,CAAC;IACvC,KAAK,MAAM,IAAI,IAAI,SAAS,EAAE,CAAC;QAC7B,IAAI,CAAC,IAAI;YAAE,SAAS;QACpB,GAAG,CAAC,IAAI,CAAC,GAAG,kBAAkB,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC;IAC5C,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED;;;;;;;;;;;GAWG;AACH,MAAM,gBAAgB,GAAwB,IAAI,GAAG,CAAC,CAAC,qBAAqB,EAAE,cAAc,CAAC,CAAC,CAAC;AAE/F;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AACH,MAAM,aAAa,GAAG,IAAI,GAAG,EAAkB,CAAC;AAEhD,SAAS,kBAAkB,CAAC,IAAY,EAAE,GAAW;IACnD,MAAM,QAAQ,GAAG,GAAG,IAAI,KAAK,GAAG,EAAE,CAAC;IACnC,MAAM,MAAM,GAAG,aAAa,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;IAC3C,IAAI,MAAM,KAAK,SAAS;QAAE,OAAO,MAAM,CAAC;IACxC,MAAM,QAAQ,GAAG,0BAA0B,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC;IACvD,aAAa,CAAC,GAAG,CAAC,QAAQ,EAAE,QAAQ,CAAC,CAAC;IACtC,OAAO,QAAQ,CAAC;AAClB,CAAC;AAED,SAAS,0BAA0B,CAAC,IAAY,EAAE,GAAW;IAC3D,IAAI,gBAAgB,CAAC,GAAG,CAAC,IAAI,CAAC;QAAE,OAAO,SAAS,mBAAa,EAAE,CAAC;IAChE,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IAC9B,KAAK,IAAI,CAAC,GAAG,KAAK,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC;QACtC,MAAM,SAAS,GAAG,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QAC9C,MAAM,GAAG,GAAG,yBAAS,CAAC,SAAS,CAAC,CAAC;QACjC,IAAI,CAAC,GAAG;YAAE,SAAS;QACnB,iEAAiE;QACjE,iEAAiE;QACjE,4DAA4D;QAC5D,+DAA+D;QAC/D,8DAA8D;QAC9D,iEAAiE;QACjE,iEAAiE;QACjE,+DAA+D;QAC/D,8DAA8D;QAC9D,kDAAkD;QAClD,KAAK,IAAI,OAAO,GAAG,CAAC,EAAE,OAAO,GAAG,CAAC,EAAE,OAAO,EAAE,EAAE,CAAC;YAC7C,MAAM,MAAM,GAAG,IAAA,wBAAQ,EAAC,GAAG,EAAE,GAAG,CAAC,CAAC;YAClC,IAAI,MAAM,CAAC,OAAO;gBAAE,OAAO,MAAM,CAAC,OAAO,CAAC;QAC5C,CAAC;QACD,OAAO,SAAS,CAAC;IACnB,CAAC;IACD,OAAO,SAAS,CAAC;AACnB,CAAC;AAED;;;;;GAKG;AACH,SAAgB,qBAAqB;IACnC,aAAa,CAAC,KAAK,EAAE,CAAC;AACxB,CAAC;AA+BD;;;;;;;;GAQG;AACI,KAAK,UAAU,iBAAiB,CAAC,OAYvC;IACC,MAAM,GAAG,GAAG,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;IACtC,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,IAAI,yBAAU,CAAC;IAC1C,sEAAsE;IACtE,wEAAwE;IACxE,kCAAkC;IAClC,MAAM,OAAO,GAAG,CAAC,IAAA,0BAAW,EAAC,KAAK,CAAC,IAAI,OAAO,CAAC,gBAAgB,KAAK,SAAS,CAAC;IAE9E,MAAM,cAAc,GAAG,MAAM,IAAA,iCAAyB,EAAC;QACrD,GAAG;QACH,KAAK,EAAE,CAAC,QAAQ,EAAE,EAAE,CAClB,IAAA,iCAAwB,EAAC,QAAQ,EAAE;YACjC,OAAO,EAAE,CAAC,CAAC,OAAO,CAAC,OAAO;YAC1B,KAAK;YACL,gBAAgB,EAAE,OAAO,CAAC,gBAAgB;SAC3C,CAAC;QACJ,IAAI,EAAE,EAAE,OAAO,EAAE;KAClB,CAAC,CAAC;IACH,MAAM,SAAS,GAAG,cAAc,CAAC,YAAY,CAAC,iBAAiB,CAAC;IAChE,IAAI,CAAC,SAAS,EAAE,CAAC;QACf,MAAM,IAAI,KAAK,CACb,iEAAiE;YAC/D,yDAAyD,CAC5D,CAAC;IACJ,CAAC;IAED,MAAM,SAAS,GAAsB;QACnC,GAAG,aAAa,CAAC,GAAG,CAAC;QACrB,IAAI,EAAE,GAAG;KACV,CAAC;IAEF,iEAAiE;IACjE,4DAA4D;IAC5D,kEAAkE;IAClE,aAAa;IACb,MAAM,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE,GAAG,IAAA,kBAAW,EAAC,GAAG,CAAC,CAAC;IAElD,gEAAgE;IAChE,kEAAkE;IAClE,6DAA6D;IAC7D,0DAA0D;IAC1D,+DAA+D;IAC/D,gEAAgE;IAChE,oEAAoE;IACpE,+CAA+C;IAC/C,MAAM,EAAE,cAAc,EAAE,OAAO,EAAE,UAAU,EAAE,0BAA0B,EAAE,GACvE,MAAM,IAAA,0CAA0B,EAAC,GAAG,EAAE,KAAK,EAAE,CAAC,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC;IAElE,MAAM,WAAW,GAAoB;QACnC,GAAG;QACH,SAAS,EAAE,SAAS,CAAC,SAAS;QAC9B,IAAI;QACJ,cAAc;QACd,cAAc;QACd,OAAO;QACP,UAAU;QACV,0BAA0B;KAC3B,CAAC;IAEF,8DAA8D;IAC9D,2DAA2D;IAC3D,gEAAgE;IAChE,QAAQ;IACR,MAAM,QAAQ,GAAwB,IAAA,wBAAY,EAAC,WAAW,EAAE,qBAAS,CAAC,CAAC;IAE3E,MAAM,SAAS,GAAG,IAAI,GAAG,EAAU,CAAC;IACpC,oEAAoE;IACpE,yEAAyE;IACzE,sEAAsE;IACtE,qEAAqE;IACrE,mEAAmE;IACnE,MAAM,QAAQ,GAAG,CAAC,MAAiC,EAAE,EAAE;QACrD,IAAI,CAAC,MAAM;YAAE,OAAO;QACpB,KAAK,MAAM,IAAI,IAAI,MAAM;aACtB,KAAK,CAAC,GAAG,CAAC;aACV,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;aACpB,MAAM,CAAC,OAAO,CAAC,EAAE,CAAC;YACnB,SAAS,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;QACtB,CAAC;IACH,CAAC,CAAC;IACF,QAAQ,CAAC,SAAS,CAAC,UAAU,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;IAC5C,QAAQ,CAAC,SAAS,CAAC,UAAU,CAAC,YAAY,CAAC,IAAI,CAAC,CAAC;IACjD,QAAQ,CAAC,SAAS,CAAC,UAAU,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC;IAC7C,IAAI,SAAS,CAAC,UAAU,CAAC,SAAS,CAAC,GAAG;QAAE,SAAS,CAAC,GAAG,CAAC,qBAAqB,CAAC,CAAC;IAC7E,MAAM,KAAK,GAAG,aAAa,CAAC,CAAC,GAAG,SAAS,CAAC,CAAC,IAAI,EAAE,EAAE,GAAG,CAAC,CAAC;IAExD,MAAM,YAAY,GAAyB;QACzC,GAAG,iBAAiB,CAAC,GAAG,CAAC;QACzB,aAAa,EAAE,WAAW,CAAC,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC;KAClD,CAAC;IAEF,sEAAsE;IACtE,kEAAkE;IAClE,wDAAwD;IACxD,MAAM,QAAQ,GAAG,IAAA,mCAAwB,EAAC,IAAA,6BAAa,EAAC,cAAc,CAAC,KAAK,CAAC,SAAS,EAAE,GAAG,CAAC,CAAC,CAAC;IAE9F,OAAO;QACL,QAAQ;QACR,SAAS;QACT,SAAS;QACT,QAAQ;QACR,KAAK;QACL,QAAQ;QACR,YAAY;QACZ,WAAW;KACZ,CAAC;AACJ,CAAC;AAED;;;;;;;GAOG;AACH,SAAgB,kBAAkB,CAAC,GAAW;IAC5C,MAAM,QAAQ,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;IACnC,OAAO,IAAA,mCAAwB,EAAC,IAAA,6BAAa,EAAC,IAAA,eAAM,EAAC,QAAQ,CAAC,CAAC,SAAS,EAAE,QAAQ,CAAC,CAAC,CAAC;AACvF,CAAC;AAED;;;;;;;;;;;;;;;GAeG;AACI,KAAK,UAAU,cAAc,CAClC,OAA8B;IAE9B,MAAM,GAAG,GAAG,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;IACtC,MAAM,IAAI,GAAG,OAAO,CAAC,IAAI,IAAI,qCAAqB,CAAC;IACnD,MAAM,IAAI,GACR,OAAO,CAAC,YAAY;QACpB,CAAC,GAAG,EAAE;YACJ,MAAM,MAAM,GAAG,IAAA,0BAAiB,EAAC,GAAG,CAAC,CAAC;YACtC,OAAO,IAAA,2BAAmB,EAAC;gBACzB,GAAG;gBACH,OAAO,EAAE,OAAO,CAAC,OAAO;gBACxB,MAAM,EAAE,OAAO,CAAC,MAAM;gBACtB,UAAU,EAAE,MAAM,CAAC,QAAQ,EAAE,IAAI;gBACjC,SAAS,EAAE,MAAM,CAAC,QAAQ,EAAE,GAAG;aAChC,CAAC,CAAC;QACL,CAAC,CAAC,EAAE,CAAC;IAEP,IAAI,IAAI,CAAC,IAAI,KAAK,WAAW,EAAE,CAAC;QAC9B,8DAA8D;QAC9D,8DAA8D;QAC9D,+DAA+D;QAC/D,gEAAgE;QAChE,OAAO,EAAE,IAAI,EAAE,CAAC;IAClB,CAAC;IAED,MAAM,QAAQ,GAAG,IAAA,+BAAe,EAAC,GAAG,EAAE,IAAI,CAAC,CAAC;IAC5C,IAAI,CAAC,OAAO,CAAC,KAAK,IAAI,EAAE,CAAC,UAAU,CAAC,QAAQ,CAAC,EAAE,CAAC;QAC9C,MAAM,IAAI,KAAK,CACb,8BAA8B,QAAQ,mCAAmC;YACvE,yCAAyC,CAC5C,CAAC;IACJ,CAAC;IAED,MAAM,IAAI,GAAG,MAAM,iBAAiB,CAAC,EAAE,GAAG,EAAE,OAAO,EAAE,OAAO,CAAC,OAAO,EAAE,CAAC,CAAC;IAExE,MAAM,QAAQ,GAAiB;QAC7B,aAAa,EAAE,uCAAuB;QACtC,IAAI;QACJ,SAAS,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;QACnC,IAAI,EAAE,IAAI,CAAC,SAAS;QACpB,QAAQ,EAAE,IAAI,CAAC,YAAY;QAC3B,KAAK,EAAE,IAAI,CAAC,KAAK;QACjB,QAAQ,EAAE,IAAI,CAAC,QAAQ;QACvB,cAAc,EAAE,+BAAuB;QACvC,QAAQ,EAAE,IAAI,CAAC,QAAQ;QACvB,QAAQ,EAAE,IAAI,CAAC,QAAQ;KACxB,CAAC;IAEF,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,KAAK,qBAAqB,CAAC,CAAC,CAAC,IAAA,uBAAY,EAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC;IACrF,IAAA,iCAAiB,EAAC,QAAQ,EAAE,IAAI,CAAC,CAAC;IAClC,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC;AACxC,CAAC"}

package/dist/baseline/gather-scope.d.ts

@@ -0,0 +1,116 @@
+/**
+ * Gather scope — which analyzers a guardrail gather actually needs to run.
+ *
+ * # Why this exists (2.14.0 opt 1)
+ *
+ * The full current-side gather runs every analyzer (semgrep, gitleaks,
+ * graphify AST, jscpd, OSV, lint, coverage, cloc, test-gaps, licenses, …).
+ * On a large repo that is ~60s. But a guardrail check can only ever BLOCK
+ * on the finding kinds its policy escalates — see `evaluateBlockRules` in
+ * `./policy.ts`. A `security-only` loop posture blocks on secrets + crit/
+ * high SAST + critical dep-vulns and NOTHING else, so gathering jscpd /
+ * lint / coverage / cloc / test-gaps / graphify for it is pure waste: those
+ * analyzers feed only kinds the policy can't act on.
+ *
+ * This module derives, from a `BrownfieldPolicy`, the minimal set of
+ * analyzers whose output can change the verdict, so the gather can skip the
+ * rest. It is the single source of truth for that mapping.
+ *
+ * # Safety contract (load-bearing)
+ *
+ * Scoping is correct ONLY because the verdict depends solely on BLOCKING
+ * pairs, and a kind the policy cannot block can never produce one. The map
+ * below therefore tracks `evaluateBlockRules` exactly:
+ *
+ *   - `policy.block` non-empty (e.g. `['added']`, the `full-debt` posture)
+ *     means ANY kind blocks by status alone → FULL_SCOPE, gather everything.
+ *   - otherwise each enabled `blockRule` pulls in exactly the analyzer(s)
+ *     that feed its kind.
+ *
+ * Two structural guarantees keep this honest:
+ *   1. Scoping is OPT-IN. Every existing caller (CI guardrail, `createBaseline`,
+ *      the `health` report) gets `FULL_SCOPE` and is byte-identical. Only the
+ *      loop Stop-gate passes a derived scope.
+ *   2. The security aggregate's cheap intrinsic scans (tls-bypass + file
+ *      findings, ~0.5s) always run inside `buildSecurityAggregateForHealth`,
+ *      so a `code`/`config` security finding can never be skipped by scoping.
+ *
+ * If a new block rule lands in `evaluateBlockRules`, `scopeForPolicy` MUST
+ * gain the matching analyzer here or a real finding could be skipped — the
+ * scope contract test pins this.
+ */
+import type { BrownfieldPolicy } from './policy';
+/**
+ * One boolean per skippable analyzer. `true` = run it. The names mirror the
+ * gather steps in `health.ts` / `create.ts` so threading is mechanical.
+ *
+ * Not represented (always run, never scoped away):
+ *   - the cheap tls-bypass + file-finding scans intrinsic to the security
+ *     aggregate (they contribute blockable `code`/`config` findings);
+ *   - generic Layer-0 metrics + package.json (microseconds).
+ */
+export interface GatherScope {
+    /** gitleaks + grep-secrets → `secret` (+ raw secrets → `secret-hmac`). */
+    readonly secrets: boolean;
+    /** semgrep → `code` SAST findings. */
+    readonly codePatterns: boolean;
+    /** OSV / per-pack dep audit → `dep-vuln`. */
+    readonly depVulns: boolean;
+    /** graphify AST → structural metrics + import reachability. */
+    readonly structural: boolean;
+    /** jscpd → `duplication`. */
+    readonly duplication: boolean;
+    /** per-pack linters → Quality dimension + `code`-adjacent hygiene. */
+    readonly lint: boolean;
+    /** coverage providers → Tests dimension. */
+    readonly coverage: boolean;
+    /** license scan → attribution (never a blockable kind). */
+    readonly licenses: boolean;
+    /** import graph → dep-vuln reachability + DX metrics. */
+    readonly imports: boolean;
+    /** test-framework detection → DX metrics. */
+    readonly testFramework: boolean;
+    /** cloc line counts → `large-file`, comment ratio, language breakdown. */
+    readonly cloc: boolean;
+    /** test-gap analyzer → `test-gap` / `test-file-degradation`. */
+    readonly testGaps: boolean;
+    /** hygiene markers (TODO/FIXME/stale) → `stale-file` + Quality counts. */
+    readonly hygiene: boolean;
+}
+/** Everything on — the default every non-loop caller gets. */
+export declare const FULL_SCOPE: GatherScope;
+/** True when no analyzer at all is required — caller can short-circuit. */
+export declare function isEmptyScope(s: GatherScope): boolean;
+/** True when this is the full gather (no analyzer skipped). */
+export declare function isFullScope(s: GatherScope): boolean;
+/**
+ * A compact, deterministic signature of which analyzers a scope runs.
+ * Used to namespace the ref-scan cache so a scoped ref gather is never
+ * served as if it were a full one (and vice versa). Order is fixed by the
+ * sorted key list, so the signature is stable across calls.
+ */
+export declare function scopeSignature(s: GatherScope): string;
+/**
+ * Derive the minimal gather scope a policy needs.
+ *
+ * The verdict can only be changed by a kind the policy BLOCKS, so the scope
+ * tracks `evaluateBlockRules` (in `./policy.ts`) one-to-one:
+ *
+ *   newSecret                              → secrets
+ *   newCriticalSecurity / newHighSecurity  → codePatterns
+ *   newCritical/HighReachableDependency…   → depVulns
+ *   newUntestedChangedSource               → testGaps
+ *   newSevereQualityIssueInChangedFiles    → codePatterns + hygiene
+ *
+ * A non-empty `policy.block` list (statuses that block regardless of kind,
+ * e.g. `full-debt`'s `['added']`) means any kind can block, so we cannot
+ * skip anything → `FULL_SCOPE`.
+ *
+ * NB: `newHighReachableDependencyVulnerability` needs reachability, which the
+ * guardrail's classifier never populates today (`context.reachable` is unset
+ * on the check path), so it cannot actually fire — but we still scope in
+ * `depVulns` for it so the mapping stays a faithful, future-proof mirror of
+ * the rule table rather than relying on that downstream gap.
+ */
+export declare function scopeForPolicy(policy: BrownfieldPolicy): GatherScope;
+//# sourceMappingURL=gather-scope.d.ts.map

package/dist/baseline/gather-scope.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"gather-scope.d.ts","sourceRoot":"","sources":["../../src/baseline/gather-scope.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAwCG;AACH,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,UAAU,CAAC;AAEjD;;;;;;;;GAQG;AACH,MAAM,WAAW,WAAW;IAC1B,0EAA0E;IAC1E,QAAQ,CAAC,OAAO,EAAE,OAAO,CAAC;IAC1B,sCAAsC;IACtC,QAAQ,CAAC,YAAY,EAAE,OAAO,CAAC;IAC/B,6CAA6C;IAC7C,QAAQ,CAAC,QAAQ,EAAE,OAAO,CAAC;IAC3B,+DAA+D;IAC/D,QAAQ,CAAC,UAAU,EAAE,OAAO,CAAC;IAC7B,6BAA6B;IAC7B,QAAQ,CAAC,WAAW,EAAE,OAAO,CAAC;IAC9B,sEAAsE;IACtE,QAAQ,CAAC,IAAI,EAAE,OAAO,CAAC;IACvB,4CAA4C;IAC5C,QAAQ,CAAC,QAAQ,EAAE,OAAO,CAAC;IAC3B,2DAA2D;IAC3D,QAAQ,CAAC,QAAQ,EAAE,OAAO,CAAC;IAC3B,yDAAyD;IACzD,QAAQ,CAAC,OAAO,EAAE,OAAO,CAAC;IAC1B,6CAA6C;IAC7C,QAAQ,CAAC,aAAa,EAAE,OAAO,CAAC;IAChC,0EAA0E;IAC1E,QAAQ,CAAC,IAAI,EAAE,OAAO,CAAC;IACvB,gEAAgE;IAChE,QAAQ,CAAC,QAAQ,EAAE,OAAO,CAAC;IAC3B,0EAA0E;IAC1E,QAAQ,CAAC,OAAO,EAAE,OAAO,CAAC;CAC3B;AAED,8DAA8D;AAC9D,eAAO,MAAM,UAAU,EAAE,WAcvB,CAAC;AAmBH,2EAA2E;AAC3E,wBAAgB,YAAY,CAAC,CAAC,EAAE,WAAW,GAAG,OAAO,CAEpD;AAED,+DAA+D;AAC/D,wBAAgB,WAAW,CAAC,CAAC,EAAE,WAAW,GAAG,OAAO,CAEnD;AAED;;;;;GAKG;AACH,wBAAgB,cAAc,CAAC,CAAC,EAAE,WAAW,GAAG,MAAM,CAMrD;AAED;;;;;;;;;;;;;;;;;;;;;GAqBG;AACH,wBAAgB,cAAc,CAAC,MAAM,EAAE,gBAAgB,GAAG,WAAW,CAiBpE"}

package/dist/baseline/gather-scope.js

@@ -0,0 +1,105 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.FULL_SCOPE = void 0;
+exports.isEmptyScope = isEmptyScope;
+exports.isFullScope = isFullScope;
+exports.scopeSignature = scopeSignature;
+exports.scopeForPolicy = scopeForPolicy;
+/** Everything on — the default every non-loop caller gets. */
+exports.FULL_SCOPE = Object.freeze({
+    secrets: true,
+    codePatterns: true,
+    depVulns: true,
+    structural: true,
+    duplication: true,
+    lint: true,
+    coverage: true,
+    licenses: true,
+    imports: true,
+    testFramework: true,
+    cloc: true,
+    testGaps: true,
+    hygiene: true,
+});
+/** All-off starting point for the additive derivation below. */
+const EMPTY_SCOPE = Object.freeze({
+    secrets: false,
+    codePatterns: false,
+    depVulns: false,
+    structural: false,
+    duplication: false,
+    lint: false,
+    coverage: false,
+    licenses: false,
+    imports: false,
+    testFramework: false,
+    cloc: false,
+    testGaps: false,
+    hygiene: false,
+});
+/** True when no analyzer at all is required — caller can short-circuit. */
+function isEmptyScope(s) {
+    return !Object.values(s).some(Boolean);
+}
+/** True when this is the full gather (no analyzer skipped). */
+function isFullScope(s) {
+    return Object.values(s).every(Boolean);
+}
+/**
+ * A compact, deterministic signature of which analyzers a scope runs.
+ * Used to namespace the ref-scan cache so a scoped ref gather is never
+ * served as if it were a full one (and vice versa). Order is fixed by the
+ * sorted key list, so the signature is stable across calls.
+ */
+function scopeSignature(s) {
+    if (isFullScope(s))
+        return 'full';
+    return Object.keys(s)
+        .sort()
+        .filter((k) => s[k])
+        .join('+');
+}
+/**
+ * Derive the minimal gather scope a policy needs.
+ *
+ * The verdict can only be changed by a kind the policy BLOCKS, so the scope
+ * tracks `evaluateBlockRules` (in `./policy.ts`) one-to-one:
+ *
+ *   newSecret                              → secrets
+ *   newCriticalSecurity / newHighSecurity  → codePatterns
+ *   newCritical/HighReachableDependency…   → depVulns
+ *   newUntestedChangedSource               → testGaps
+ *   newSevereQualityIssueInChangedFiles    → codePatterns + hygiene
+ *
+ * A non-empty `policy.block` list (statuses that block regardless of kind,
+ * e.g. `full-debt`'s `['added']`) means any kind can block, so we cannot
+ * skip anything → `FULL_SCOPE`.
+ *
+ * NB: `newHighReachableDependencyVulnerability` needs reachability, which the
+ * guardrail's classifier never populates today (`context.reachable` is unset
+ * on the check path), so it cannot actually fire — but we still scope in
+ * `depVulns` for it so the mapping stays a faithful, future-proof mirror of
+ * the rule table rather than relying on that downstream gap.
+ */
+function scopeForPolicy(policy) {
+    // Any status-based block applies across all kinds — nothing is safe to skip.
+    if (policy.block.length > 0)
+        return exports.FULL_SCOPE;
+    const r = policy.blockRules;
+    const scope = { ...EMPTY_SCOPE };
+    if (r.newSecret)
+        scope.secrets = true;
+    if (r.newCriticalSecurity || r.newHighSecurity)
+        scope.codePatterns = true;
+    if (r.newCriticalDependencyVulnerability || r.newHighReachableDependencyVulnerability) {
+        scope.depVulns = true;
+    }
+    if (r.newUntestedChangedSource)
+        scope.testGaps = true;
+    if (r.newSevereQualityIssueInChangedFiles) {
+        scope.codePatterns = true;
+        scope.hygiene = true;
+    }
+    return Object.freeze(scope);
+}
+//# sourceMappingURL=gather-scope.js.map

package/dist/baseline/gather-scope.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"gather-scope.js","sourceRoot":"","sources":["../../src/baseline/gather-scope.ts"],"names":[],"mappings":";;;AAoHA,oCAEC;AAGD,kCAEC;AAQD,wCAMC;AAwBD,wCAiBC;AAjGD,8DAA8D;AACjD,QAAA,UAAU,GAAgB,MAAM,CAAC,MAAM,CAAC;IACnD,OAAO,EAAE,IAAI;IACb,YAAY,EAAE,IAAI;IAClB,QAAQ,EAAE,IAAI;IACd,UAAU,EAAE,IAAI;IAChB,WAAW,EAAE,IAAI;IACjB,IAAI,EAAE,IAAI;IACV,QAAQ,EAAE,IAAI;IACd,QAAQ,EAAE,IAAI;IACd,OAAO,EAAE,IAAI;IACb,aAAa,EAAE,IAAI;IACnB,IAAI,EAAE,IAAI;IACV,QAAQ,EAAE,IAAI;IACd,OAAO,EAAE,IAAI;CACd,CAAC,CAAC;AAEH,gEAAgE;AAChE,MAAM,WAAW,GAAgB,MAAM,CAAC,MAAM,CAAC;IAC7C,OAAO,EAAE,KAAK;IACd,YAAY,EAAE,KAAK;IACnB,QAAQ,EAAE,KAAK;IACf,UAAU,EAAE,KAAK;IACjB,WAAW,EAAE,KAAK;IAClB,IAAI,EAAE,KAAK;IACX,QAAQ,EAAE,KAAK;IACf,QAAQ,EAAE,KAAK;IACf,OAAO,EAAE,KAAK;IACd,aAAa,EAAE,KAAK;IACpB,IAAI,EAAE,KAAK;IACX,QAAQ,EAAE,KAAK;IACf,OAAO,EAAE,KAAK;CACf,CAAC,CAAC;AAEH,2EAA2E;AAC3E,SAAgB,YAAY,CAAC,CAAc;IACzC,OAAO,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;AACzC,CAAC;AAED,+DAA+D;AAC/D,SAAgB,WAAW,CAAC,CAAc;IACxC,OAAO,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;AACzC,CAAC;AAED;;;;;GAKG;AACH,SAAgB,cAAc,CAAC,CAAc;IAC3C,IAAI,WAAW,CAAC,CAAC,CAAC;QAAE,OAAO,MAAM,CAAC;IAClC,OAAQ,MAAM,CAAC,IAAI,CAAC,CAAC,CAA8B;SAChD,IAAI,EAAE;SACN,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;SACnB,IAAI,CAAC,GAAG,CAAC,CAAC;AACf,CAAC;AAED;;;;;;;;;;;;;;;;;;;;;GAqBG;AACH,SAAgB,cAAc,CAAC,MAAwB;IACrD,6EAA6E;IAC7E,IAAI,MAAM,CAAC,KAAK,CAAC,MAAM,GAAG,CAAC;QAAE,OAAO,kBAAU,CAAC;IAE/C,MAAM,CAAC,GAAG,MAAM,CAAC,UAAU,CAAC;IAC5B,MAAM,KAAK,GAAG,EAAE,GAAG,WAAW,EAAE,CAAC;IACjC,IAAI,CAAC,CAAC,SAAS;QAAE,KAAK,CAAC,OAAO,GAAG,IAAI,CAAC;IACtC,IAAI,CAAC,CAAC,mBAAmB,IAAI,CAAC,CAAC,eAAe;QAAE,KAAK,CAAC,YAAY,GAAG,IAAI,CAAC;IAC1E,IAAI,CAAC,CAAC,kCAAkC,IAAI,CAAC,CAAC,uCAAuC,EAAE,CAAC;QACtF,KAAK,CAAC,QAAQ,GAAG,IAAI,CAAC;IACxB,CAAC;IACD,IAAI,CAAC,CAAC,wBAAwB;QAAE,KAAK,CAAC,QAAQ,GAAG,IAAI,CAAC;IACtD,IAAI,CAAC,CAAC,mCAAmC,EAAE,CAAC;QAC1C,KAAK,CAAC,YAAY,GAAG,IAAI,CAAC;QAC1B,KAAK,CAAC,OAAO,GAAG,IAAI,CAAC;IACvB,CAAC;IACD,OAAO,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;AAC9B,CAAC"}

package/dist/baseline/ref-baseline.d.ts

@@ -49,6 +49,7 @@
  * handling in the orchestrator.
  */
 import type { CurrentScan } from './create';
+import { type GatherScope } from './gather-scope';
 /**
  * Recoverable error from the ref-based gather path. Carries an
  * actionable `hint` the CLI surfaces verbatim so customers don't
@@ -110,5 +111,18 @@ export declare function gatherFromRef(opts: {
     readonly cwd: string;
     readonly ref: string;
     readonly verbose?: boolean;
+    /** Scope the ref-side gather identically to the current side so the
+     *  cross-run diff stays balanced. Defaults to `FULL_SCOPE`. */
+    readonly scope?: GatherScope;
 }): Promise<CurrentScan>;
+/** Deterministic cache key over every input that can change a ref scan.
+ *  Includes the gather scope so a scoped ref scan is never reused for a
+ *  full request (or vice versa). Exported for testing. */
+export declare function refScanCacheKey(cwd: string, sha: string, scope?: GatherScope): string;
+/** Read a cached ref scan; null on miss, bypass, or any shape mismatch.
+ *  Exported for testing. */
+export declare function readRefScanCache(cwd: string, key: string): CurrentScan | null;
+/** Persist a ref scan keyed by its content address. Best-effort.
+ *  Exported for testing. */
+export declare function writeRefScanCache(cwd: string, key: string, scan: CurrentScan): void;
 //# sourceMappingURL=ref-baseline.d.ts.map

package/dist/baseline/ref-baseline.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"ref-baseline.d.ts","sourceRoot":"","sources":["../../src/baseline/ref-baseline.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAiDG;AAOH,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,UAAU,CAAC;AAE5C;;;;;GAKG;AACH,qBAAa,gBAAiB,SAAQ,KAAK;IACzC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;gBACV,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM;CAK1C;AAED,MAAM,WAAW,kBAAkB;IACjC,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;IACrB,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;CACtB;AAED;;;;;GAKG;AACH,wBAAgB,eAAe,CAAC,GAAG,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAWvE;AAED;;;;;GAKG;AACH,wBAAgB,aAAa,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAWlD;AAqBD;;;;;;;GAOG;AACH,wBAAsB,eAAe,CAAC,CAAC,EACrC,IAAI,EAAE,kBAAkB,EACxB,EAAE,EAAE,CAAC,YAAY,EAAE,MAAM,KAAK,OAAO,CAAC,CAAC,CAAC,GACvC,OAAO,CAAC,CAAC,CAAC,CAuDZ;AAED;;;;;;GAMG;AACH,wBAAgB,cAAc,CAAC,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,IAAI,CAMnE;AAED;;;;;;;;;;;GAWG;AACH,wBAAsB,aAAa,CAAC,IAAI,EAAE;IACxC,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;IACrB,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;IACrB,QAAQ,CAAC,OAAO,CAAC,EAAE,OAAO,CAAC;CAC5B,GAAG,OAAO,CAAC,WAAW,CAAC,CAIvB"}
+{"version":3,"file":"ref-baseline.d.ts","sourceRoot":"","sources":["../../src/baseline/ref-baseline.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAiDG;AAkBH,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,UAAU,CAAC;AAC5C,OAAO,EAAE,KAAK,WAAW,EAA8B,MAAM,gBAAgB,CAAC;AAE9E;;;;;GAKG;AACH,qBAAa,gBAAiB,SAAQ,KAAK;IACzC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;gBACV,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM;CAK1C;AAED,MAAM,WAAW,kBAAkB;IACjC,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;IACrB,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;CACtB;AAED;;;;;GAKG;AACH,wBAAgB,eAAe,CAAC,GAAG,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAWvE;AAED;;;;;GAKG;AACH,wBAAgB,aAAa,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAWlD;AAqBD;;;;;;;GAOG;AACH,wBAAsB,eAAe,CAAC,CAAC,EACrC,IAAI,EAAE,kBAAkB,EACxB,EAAE,EAAE,CAAC,YAAY,EAAE,MAAM,KAAK,OAAO,CAAC,CAAC,CAAC,GACvC,OAAO,CAAC,CAAC,CAAC,CAuDZ;AAED;;;;;;GAMG;AACH,wBAAgB,cAAc,CAAC,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,IAAI,CAMnE;AAED;;;;;;;;;;;GAWG;AACH,wBAAsB,aAAa,CAAC,IAAI,EAAE;IACxC,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;IACrB,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;IACrB,QAAQ,CAAC,OAAO,CAAC,EAAE,OAAO,CAAC;IAC3B;mEAC+D;IAC/D,QAAQ,CAAC,KAAK,CAAC,EAAE,WAAW,CAAC;CAC9B,GAAG,OAAO,CAAC,WAAW,CAAC,CAcvB;AAkCD;;0DAE0D;AAC1D,wBAAgB,eAAe,CAAC,GAAG,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,EAAE,KAAK,GAAE,WAAwB,GAAG,MAAM,CAUjG;AAED;4BAC4B;AAC5B,wBAAgB,gBAAgB,CAAC,GAAG,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,GAAG,WAAW,GAAG,IAAI,CAgB7E;AAED;4BAC4B;AAC5B,wBAAgB,iBAAiB,CAAC,GAAG,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,EAAE,IAAI,EAAE,WAAW,GAAG,IAAI,CAanF"}

package/dist/baseline/ref-baseline.js

@@ -89,11 +89,18 @@ exports.isShallowRepo = isShallowRepo;
 exports.withRefWorktree = withRefWorktree;
 exports.mirrorSaltFile = mirrorSaltFile;
 exports.gatherFromRef = gatherFromRef;
+exports.refScanCacheKey = refScanCacheKey;
+exports.readRefScanCache = readRefScanCache;
+exports.writeRefScanCache = writeRefScanCache;
 const child_process_1 = require("child_process");
+const crypto_1 = require("crypto");
 const fs_1 = require("fs");
 const os_1 = require("os");
 const path = __importStar(require("path"));
+const constants_1 = require("../constants");
+const types_1 = require("./types");
 const create_1 = require("./create");
+const gather_scope_1 = require("./gather-scope");
 /**
  * Recoverable error from the ref-based gather path. Carries an
  * actionable `hint` the CLI surfaces verbatim so customers don't
@@ -253,8 +260,96 @@ function mirrorSaltFile(srcCwd, dstCwd) {
  * survive the gap; `npm audit`-style probes do not.
  */
 async function gatherFromRef(opts) {
-    return withRefWorktree({ cwd: opts.cwd, ref: opts.ref }, async (worktreePath) => {
-        return (0, create_1.gatherCurrentScan)({ cwd: worktreePath, verbose: opts.verbose });
+    const sha = resolveRefToSha(opts.cwd, opts.ref);
+    if (sha === null)
+        throw unreachableRefError(opts.cwd, opts.ref);
+    const scope = opts.scope ?? gather_scope_1.FULL_SCOPE;
+    const key = refScanCacheKey(opts.cwd, sha, scope);
+    const cached = readRefScanCache(opts.cwd, key);
+    if (cached)
+        return cached;
+    const scan = await withRefWorktree({ cwd: opts.cwd, ref: opts.ref }, async (worktreePath) => {
+        return (0, create_1.gatherCurrentScan)({ cwd: worktreePath, verbose: opts.verbose, scope });
     });
+    writeRefScanCache(opts.cwd, key, scan);
+    return scan;
+}
+/**
+ * Content-addressed cache for ref-side gathers.
+ *
+ * A ref scan is a pure function of its inputs: the ref commit, the dxkit
+ * version, the identity scheme, and the salt. The loop Stop-gate fires the
+ * ref gather on every stop against an `origin/main` that rarely moves, so
+ * without this cache it re-scans an unchanged ref each time — the dominant
+ * cost of a ref-based gate. A cache hit is only ever a genuinely identical
+ * scan (the key captures every input that can change the findings), so the
+ * cache can never alter a guardrail verdict.
+ *
+ * Safety note: `gatherFromRef` returns a full `CurrentScan`, but the sole
+ * consumer (the ref-based branch of `runGuardrailCheck`) reads only the
+ * plain `findings`/`repoState`/`analysisMeta`/`tools`/`saltMode` fields,
+ * all of which JSON round-trip exactly. The cache file is JSON, lives under
+ * the already-gitignored `.dxkit/cache/`, and is bypassed entirely with
+ * `DXKIT_NO_REF_CACHE=1`. Bump `REF_SCAN_CACHE_FORMAT` if `CurrentScan`'s
+ * serialized shape changes.
+ */
+const REF_SCAN_CACHE_FORMAT = 1;
+const REF_SCAN_CACHE_DIR = path.join('.dxkit', 'cache', 'ref-scan');
+/** Hash of the file-mode salt, or a sentinel when absent. */
+function saltSignature(cwd) {
+    try {
+        const buf = (0, fs_1.readFileSync)(path.join(cwd, '.dxkit', 'salt'));
+        return (0, crypto_1.createHash)('sha256').update(buf).digest('hex').slice(0, 16); // fingerprint-helper-ok
+    }
+    catch {
+        return 'no-salt';
+    }
+}
+/** Deterministic cache key over every input that can change a ref scan.
+ *  Includes the gather scope so a scoped ref scan is never reused for a
+ *  full request (or vice versa). Exported for testing. */
+function refScanCacheKey(cwd, sha, scope = gather_scope_1.FULL_SCOPE) {
+    const material = [
+        `fmt:${REF_SCAN_CACHE_FORMAT}`,
+        `sha:${sha}`,
+        `ver:${constants_1.VERSION}`,
+        `scheme:${types_1.CURRENT_IDENTITY_SCHEME}`,
+        `salt:${saltSignature(cwd)}`,
+        `scope:${(0, gather_scope_1.scopeSignature)(scope)}`,
+    ].join('\0');
+    return (0, crypto_1.createHash)('sha256').update(material).digest('hex').slice(0, 32); // fingerprint-helper-ok
+}
+/** Read a cached ref scan; null on miss, bypass, or any shape mismatch.
+ *  Exported for testing. */
+function readRefScanCache(cwd, key) {
+    if (process.env.DXKIT_NO_REF_CACHE === '1')
+        return null;
+    try {
+        const raw = (0, fs_1.readFileSync)(path.join(cwd, REF_SCAN_CACHE_DIR, `${key}.json`), 'utf8');
+        const parsed = JSON.parse(raw);
+        if (parsed.format !== REF_SCAN_CACHE_FORMAT ||
+            !parsed.scan ||
+            !Array.isArray(parsed.scan.findings)) {
+            return null; // unexpected shape → gather fresh (safe default)
+        }
+        return parsed.scan;
+    }
+    catch {
+        return null; // miss / unreadable / parse error → gather fresh (safe default)
+    }
+}
+/** Persist a ref scan keyed by its content address. Best-effort.
+ *  Exported for testing. */
+function writeRefScanCache(cwd, key, scan) {
+    if (process.env.DXKIT_NO_REF_CACHE === '1')
+        return;
+    try {
+        const dir = path.join(cwd, REF_SCAN_CACHE_DIR);
+        (0, fs_1.mkdirSync)(dir, { recursive: true });
+        (0, fs_1.writeFileSync)(path.join(dir, `${key}.json`), JSON.stringify({ format: REF_SCAN_CACHE_FORMAT, scan }) + '\n', 'utf8');
+    }
+    catch {
+        /* A cache write must never break the gather. */
+    }
 }
 //# sourceMappingURL=ref-baseline.js.map

package/dist/baseline/ref-baseline.js.map

@@ -1 +1 @@
-{"version":3,"file":"ref-baseline.js","sourceRoot":"","sources":["../../src/baseline/ref-baseline.ts"],"names":[],"mappings":";AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAiDG;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAmCH,0CAWC;AAQD,sCAWC;AA6BD,0CA0DC;AASD,wCAMC;AAcD,sCAQC;AA3LD,iDAA6C;AAC7C,2BAA8E;AAC9E,2BAA4B;AAC5B,2CAA6B;AAC7B,qCAA6C;AAG7C;;;;;GAKG;AACH,MAAa,gBAAiB,SAAQ,KAAK;IAChC,IAAI,CAAS;IACtB,YAAY,OAAe,EAAE,IAAY;QACvC,KAAK,CAAC,OAAO,CAAC,CAAC;QACf,IAAI,CAAC,IAAI,GAAG,kBAAkB,CAAC;QAC/B,IAAI,CAAC,IAAI,GAAG,IAAI,CAAC;IACnB,CAAC;CACF;AAPD,4CAOC;AAOD;;;;;GAKG;AACH,SAAgB,eAAe,CAAC,GAAW,EAAE,GAAW;IACtD,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,IAAA,4BAAY,EAAC,KAAK,EAAE,CAAC,WAAW,EAAE,UAAU,EAAE,GAAG,GAAG,WAAW,CAAC,EAAE;YAC5E,GAAG;YACH,QAAQ,EAAE,OAAO;YACjB,KAAK,EAAE,CAAC,QAAQ,EAAE,MAAM,EAAE,MAAM,CAAC;SAClC,CAAC,CAAC,IAAI,EAAE,CAAC;QACV,OAAO,GAAG,IAAI,IAAI,CAAC;IACrB,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED;;;;;GAKG;AACH,SAAgB,aAAa,CAAC,GAAW;IACvC,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,IAAA,4BAAY,EAAC,KAAK,EAAE,CAAC,WAAW,EAAE,yBAAyB,CAAC,EAAE;YACxE,GAAG;YACH,QAAQ,EAAE,OAAO;YACjB,KAAK,EAAE,CAAC,QAAQ,EAAE,MAAM,EAAE,MAAM,CAAC;SAClC,CAAC,CAAC,IAAI,EAAE,CAAC;QACV,OAAO,GAAG,KAAK,MAAM,CAAC;IACxB,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC;AAED;;;;;GAKG;AACH,SAAS,mBAAmB,CAAC,GAAW,EAAE,GAAW;IACnD,IAAI,aAAa,CAAC,GAAG,CAAC,EAAE,CAAC;QACvB,OAAO,IAAI,gBAAgB,CACzB,+BAA+B,GAAG,4BAA4B,EAC9D,wFAAwF,CACzF,CAAC;IACJ,CAAC;IACD,OAAO,IAAI,gBAAgB,CACzB,+BAA+B,GAAG,GAAG,EACrC,oHAAoH,CACrH,CAAC;AACJ,CAAC;AAED;;;;;;;GAOG;AACI,KAAK,UAAU,eAAe,CACnC,IAAwB,EACxB,EAAwC;IAExC,MAAM,GAAG,GAAG,eAAe,CAAC,IAAI,CAAC,GAAG,EAAE,IAAI,CAAC,GAAG,CAAC,CAAC;IAChD,IAAI,GAAG,KAAK,IAAI;QAAE,MAAM,mBAAmB,CAAC,IAAI,CAAC,GAAG,EAAE,IAAI,CAAC,GAAG,CAAC,CAAC;IAEhE,+DAA+D;IAC/D,gEAAgE;IAChE,oDAAoD;IACpD,MAAM,QAAQ,GAAG,IAAA,gBAAW,EAAC,IAAI,CAAC,IAAI,CAAC,IAAA,WAAM,GAAE,EAAE,YAAY,CAAC,CAAC,CAAC;IAChE,MAAM,YAAY,GAAG,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,UAAU,CAAC,CAAC;IACrD,IAAI,aAAa,GAAG,KAAK,CAAC;IAC1B,IAAI,CAAC;QACH,IAAA,4BAAY,EAAC,KAAK,EAAE,CAAC,UAAU,EAAE,KAAK,EAAE,UAAU,EAAE,YAAY,EAAE,GAAG,CAAC,EAAE;YACtE,GAAG,EAAE,IAAI,CAAC,GAAG;YACb,KAAK,EAAE,CAAC,QAAQ,EAAE,MAAM,EAAE,MAAM,CAAC;SAClC,CAAC,CAAC;QACH,aAAa,GAAG,IAAI,CAAC;QACrB,iEAAiE;QACjE,iEAAiE;QACjE,+DAA+D;QAC/D,+DAA+D;QAC/D,+DAA+D;QAC/D,2DAA2D;QAC3D,cAAc,CAAC,IAAI,CAAC,GAAG,EAAE,YAAY,CAAC,CAAC;QACvC,OAAO,MAAM,EAAE,CAAC,YAAY,CAAC,CAAC;IAChC,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,IAAI,GAAG,YAAY,gBAAgB;YAAE,MAAM,GAAG,CAAC;QAC/C,IAAI,CAAC,aAAa,EAAE,CAAC;YACnB,wDAAwD;YACxD,sCAAsC;YACtC,MAAM,IAAI,gBAAgB,CACxB,yCAAyC,IAAI,CAAC,GAAG,GAAG,EACpD,mDAAmD,QAAQ,eAAe,CAC3E,CAAC;QACJ,CAAC;QACD,MAAM,GAAG,CAAC;IACZ,CAAC;YAAS,CAAC;QACT,IAAI,aAAa,EAAE,CAAC;YAClB,IAAI,CAAC;gBACH,IAAA,4BAAY,EAAC,KAAK,EAAE,CAAC,UAAU,EAAE,QAAQ,EAAE,SAAS,EAAE,YAAY,CAAC,EAAE;oBACnE,GAAG,EAAE,IAAI,CAAC,GAAG;oBACb,KAAK,EAAE,CAAC,QAAQ,EAAE,MAAM,EAAE,MAAM,CAAC;iBAClC,CAAC,CAAC;YACL,CAAC;YAAC,MAAM,CAAC;gBACP,uDAAuD;gBACvD,yDAAyD;YAC3D,CAAC;QACH,CAAC;QACD,IAAI,CAAC;YACH,IAAA,WAAM,EAAC,QAAQ,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;QACrD,CAAC;QAAC,MAAM,CAAC;YACP,2DAA2D;YAC3D,8DAA8D;YAC9D,qBAAqB;QACvB,CAAC;IACH,CAAC;AACH,CAAC;AAED;;;;;;GAMG;AACH,SAAgB,cAAc,CAAC,MAAc,EAAE,MAAc;IAC3D,MAAM,GAAG,GAAG,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,QAAQ,EAAE,MAAM,CAAC,CAAC;IAChD,IAAI,CAAC,IAAA,eAAU,EAAC,GAAG,CAAC;QAAE,OAAO;IAC7B,MAAM,MAAM,GAAG,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAC;IAC3C,IAAA,cAAS,EAAC,MAAM,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IACvC,IAAA,iBAAY,EAAC,GAAG,EAAE,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC;AAC/C,CAAC;AAED;;;;;;;;;;;GAWG;AACI,KAAK,UAAU,aAAa,CAAC,IAInC;IACC,OAAO,eAAe,CAAC,EAAE,GAAG,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,EAAE,IAAI,CAAC,GAAG,EAAE,EAAE,KAAK,EAAE,YAAY,EAAE,EAAE;QAC9E,OAAO,IAAA,0BAAiB,EAAC,EAAE,GAAG,EAAE,YAAY,EAAE,OAAO,EAAE,IAAI,CAAC,OAAO,EAAE,CAAC,CAAC;IACzE,CAAC,CAAC,CAAC;AACL,CAAC"}
+{"version":3,"file":"ref-baseline.js","sourceRoot":"","sources":["../../src/baseline/ref-baseline.ts"],"names":[],"mappings":";AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAiDG;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AA+CH,0CAWC;AAQD,sCAWC;AA6BD,0CA0DC;AASD,wCAMC;AAcD,sCAqBC;AAqCD,0CAUC;AAID,4CAgBC;AAID,8CAaC;AAxSD,iDAA6C;AAC7C,mCAAoC;AACpC,2BAQY;AACZ,2BAA4B;AAC5B,2CAA6B;AAC7B,4CAAuC;AACvC,mCAAkD;AAClD,qCAA6C;AAE7C,iDAA8E;AAE9E;;;;;GAKG;AACH,MAAa,gBAAiB,SAAQ,KAAK;IAChC,IAAI,CAAS;IACtB,YAAY,OAAe,EAAE,IAAY;QACvC,KAAK,CAAC,OAAO,CAAC,CAAC;QACf,IAAI,CAAC,IAAI,GAAG,kBAAkB,CAAC;QAC/B,IAAI,CAAC,IAAI,GAAG,IAAI,CAAC;IACnB,CAAC;CACF;AAPD,4CAOC;AAOD;;;;;GAKG;AACH,SAAgB,eAAe,CAAC,GAAW,EAAE,GAAW;IACtD,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,IAAA,4BAAY,EAAC,KAAK,EAAE,CAAC,WAAW,EAAE,UAAU,EAAE,GAAG,GAAG,WAAW,CAAC,EAAE;YAC5E,GAAG;YACH,QAAQ,EAAE,OAAO;YACjB,KAAK,EAAE,CAAC,QAAQ,EAAE,MAAM,EAAE,MAAM,CAAC;SAClC,CAAC,CAAC,IAAI,EAAE,CAAC;QACV,OAAO,GAAG,IAAI,IAAI,CAAC;IACrB,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED;;;;;GAKG;AACH,SAAgB,aAAa,CAAC,GAAW;IACvC,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,IAAA,4BAAY,EAAC,KAAK,EAAE,CAAC,WAAW,EAAE,yBAAyB,CAAC,EAAE;YACxE,GAAG;YACH,QAAQ,EAAE,OAAO;YACjB,KAAK,EAAE,CAAC,QAAQ,EAAE,MAAM,EAAE,MAAM,CAAC;SAClC,CAAC,CAAC,IAAI,EAAE,CAAC;QACV,OAAO,GAAG,KAAK,MAAM,CAAC;IACxB,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC;AAED;;;;;GAKG;AACH,SAAS,mBAAmB,CAAC,GAAW,EAAE,GAAW;IACnD,IAAI,aAAa,CAAC,GAAG,CAAC,EAAE,CAAC;QACvB,OAAO,IAAI,gBAAgB,CACzB,+BAA+B,GAAG,4BAA4B,EAC9D,wFAAwF,CACzF,CAAC;IACJ,CAAC;IACD,OAAO,IAAI,gBAAgB,CACzB,+BAA+B,GAAG,GAAG,EACrC,oHAAoH,CACrH,CAAC;AACJ,CAAC;AAED;;;;;;;GAOG;AACI,KAAK,UAAU,eAAe,CACnC,IAAwB,EACxB,EAAwC;IAExC,MAAM,GAAG,GAAG,eAAe,CAAC,IAAI,CAAC,GAAG,EAAE,IAAI,CAAC,GAAG,CAAC,CAAC;IAChD,IAAI,GAAG,KAAK,IAAI;QAAE,MAAM,mBAAmB,CAAC,IAAI,CAAC,GAAG,EAAE,IAAI,CAAC,GAAG,CAAC,CAAC;IAEhE,+DAA+D;IAC/D,gEAAgE;IAChE,oDAAoD;IACpD,MAAM,QAAQ,GAAG,IAAA,gBAAW,EAAC,IAAI,CAAC,IAAI,CAAC,IAAA,WAAM,GAAE,EAAE,YAAY,CAAC,CAAC,CAAC;IAChE,MAAM,YAAY,GAAG,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,UAAU,CAAC,CAAC;IACrD,IAAI,aAAa,GAAG,KAAK,CAAC;IAC1B,IAAI,CAAC;QACH,IAAA,4BAAY,EAAC,KAAK,EAAE,CAAC,UAAU,EAAE,KAAK,EAAE,UAAU,EAAE,YAAY,EAAE,GAAG,CAAC,EAAE;YACtE,GAAG,EAAE,IAAI,CAAC,GAAG;YACb,KAAK,EAAE,CAAC,QAAQ,EAAE,MAAM,EAAE,MAAM,CAAC;SAClC,CAAC,CAAC;QACH,aAAa,GAAG,IAAI,CAAC;QACrB,iEAAiE;QACjE,iEAAiE;QACjE,+DAA+D;QAC/D,+DAA+D;QAC/D,+DAA+D;QAC/D,2DAA2D;QAC3D,cAAc,CAAC,IAAI,CAAC,GAAG,EAAE,YAAY,CAAC,CAAC;QACvC,OAAO,MAAM,EAAE,CAAC,YAAY,CAAC,CAAC;IAChC,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,IAAI,GAAG,YAAY,gBAAgB;YAAE,MAAM,GAAG,CAAC;QAC/C,IAAI,CAAC,aAAa,EAAE,CAAC;YACnB,wDAAwD;YACxD,sCAAsC;YACtC,MAAM,IAAI,gBAAgB,CACxB,yCAAyC,IAAI,CAAC,GAAG,GAAG,EACpD,mDAAmD,QAAQ,eAAe,CAC3E,CAAC;QACJ,CAAC;QACD,MAAM,GAAG,CAAC;IACZ,CAAC;YAAS,CAAC;QACT,IAAI,aAAa,EAAE,CAAC;YAClB,IAAI,CAAC;gBACH,IAAA,4BAAY,EAAC,KAAK,EAAE,CAAC,UAAU,EAAE,QAAQ,EAAE,SAAS,EAAE,YAAY,CAAC,EAAE;oBACnE,GAAG,EAAE,IAAI,CAAC,GAAG;oBACb,KAAK,EAAE,CAAC,QAAQ,EAAE,MAAM,EAAE,MAAM,CAAC;iBAClC,CAAC,CAAC;YACL,CAAC;YAAC,MAAM,CAAC;gBACP,uDAAuD;gBACvD,yDAAyD;YAC3D,CAAC;QACH,CAAC;QACD,IAAI,CAAC;YACH,IAAA,WAAM,EAAC,QAAQ,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;QACrD,CAAC;QAAC,MAAM,CAAC;YACP,2DAA2D;YAC3D,8DAA8D;YAC9D,qBAAqB;QACvB,CAAC;IACH,CAAC;AACH,CAAC;AAED;;;;;;GAMG;AACH,SAAgB,cAAc,CAAC,MAAc,EAAE,MAAc;IAC3D,MAAM,GAAG,GAAG,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,QAAQ,EAAE,MAAM,CAAC,CAAC;IAChD,IAAI,CAAC,IAAA,eAAU,EAAC,GAAG,CAAC;QAAE,OAAO;IAC7B,MAAM,MAAM,GAAG,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAC;IAC3C,IAAA,cAAS,EAAC,MAAM,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IACvC,IAAA,iBAAY,EAAC,GAAG,EAAE,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC;AAC/C,CAAC;AAED;;;;;;;;;;;GAWG;AACI,KAAK,UAAU,aAAa,CAAC,IAOnC;IACC,MAAM,GAAG,GAAG,eAAe,CAAC,IAAI,CAAC,GAAG,EAAE,IAAI,CAAC,GAAG,CAAC,CAAC;IAChD,IAAI,GAAG,KAAK,IAAI;QAAE,MAAM,mBAAmB,CAAC,IAAI,CAAC,GAAG,EAAE,IAAI,CAAC,GAAG,CAAC,CAAC;IAEhE,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,IAAI,yBAAU,CAAC;IACvC,MAAM,GAAG,GAAG,eAAe,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,EAAE,KAAK,CAAC,CAAC;IAClD,MAAM,MAAM,GAAG,gBAAgB,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC;IAC/C,IAAI,MAAM;QAAE,OAAO,MAAM,CAAC;IAE1B,MAAM,IAAI,GAAG,MAAM,eAAe,CAAC,EAAE,GAAG,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,EAAE,IAAI,CAAC,GAAG,EAAE,EAAE,KAAK,EAAE,YAAY,EAAE,EAAE;QAC1F,OAAO,IAAA,0BAAiB,EAAC,EAAE,GAAG,EAAE,YAAY,EAAE,OAAO,EAAE,IAAI,CAAC,OAAO,EAAE,KAAK,EAAE,CAAC,CAAC;IAChF,CAAC,CAAC,CAAC;IACH,iBAAiB,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,EAAE,IAAI,CAAC,CAAC;IACvC,OAAO,IAAI,CAAC;AACd,CAAC;AAED;;;;;;;;;;;;;;;;;;GAkBG;AACH,MAAM,qBAAqB,GAAG,CAAC,CAAC;AAChC,MAAM,kBAAkB,GAAG,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,OAAO,EAAE,UAAU,CAAC,CAAC;AAEpE,6DAA6D;AAC7D,SAAS,aAAa,CAAC,GAAW;IAChC,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,IAAA,iBAAY,EAAC,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,QAAQ,EAAE,MAAM,CAAC,CAAC,CAAC;QAC3D,OAAO,IAAA,mBAAU,EAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,wBAAwB;IAC9F,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,SAAS,CAAC;IACnB,CAAC;AACH,CAAC;AAED;;0DAE0D;AAC1D,SAAgB,eAAe,CAAC,GAAW,EAAE,GAAW,EAAE,QAAqB,yBAAU;IACvF,MAAM,QAAQ,GAAG;QACf,OAAO,qBAAqB,EAAE;QAC9B,OAAO,GAAG,EAAE;QACZ,OAAO,mBAAO,EAAE;QAChB,UAAU,+BAAuB,EAAE;QACnC,QAAQ,aAAa,CAAC,GAAG,CAAC,EAAE;QAC5B,SAAS,IAAA,6BAAc,EAAC,KAAK,CAAC,EAAE;KACjC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IACb,OAAO,IAAA,mBAAU,EAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,wBAAwB;AACnG,CAAC;AAED;4BAC4B;AAC5B,SAAgB,gBAAgB,CAAC,GAAW,EAAE,GAAW;IACvD,IAAI,OAAO,CAAC,GAAG,CAAC,kBAAkB,KAAK,GAAG;QAAE,OAAO,IAAI,CAAC;IACxD,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,IAAA,iBAAY,EAAC,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,kBAAkB,EAAE,GAAG,GAAG,OAAO,CAAC,EAAE,MAAM,CAAC,CAAC;QACpF,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAA4C,CAAC;QAC1E,IACE,MAAM,CAAC,MAAM,KAAK,qBAAqB;YACvC,CAAC,MAAM,CAAC,IAAI;YACZ,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,EACpC,CAAC;YACD,OAAO,IAAI,CAAC,CAAC,iDAAiD;QAChE,CAAC;QACD,OAAO,MAAM,CAAC,IAAI,CAAC;IACrB,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC,CAAC,gEAAgE;IAC/E,CAAC;AACH,CAAC;AAED;4BAC4B;AAC5B,SAAgB,iBAAiB,CAAC,GAAW,EAAE,GAAW,EAAE,IAAiB;IAC3E,IAAI,OAAO,CAAC,GAAG,CAAC,kBAAkB,KAAK,GAAG;QAAE,OAAO;IACnD,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,kBAAkB,CAAC,CAAC;QAC/C,IAAA,cAAS,EAAC,GAAG,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;QACpC,IAAA,kBAAa,EACX,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,GAAG,OAAO,CAAC,EAC7B,IAAI,CAAC,SAAS,CAAC,EAAE,MAAM,EAAE,qBAAqB,EAAE,IAAI,EAAE,CAAC,GAAG,IAAI,EAC9D,MAAM,CACP,CAAC;IACJ,CAAC;IAAC,MAAM,CAAC;QACP,gDAAgD;IAClD,CAAC;AACH,CAAC"}

package/dist/baseline/scoped-inputs.d.ts

@@ -0,0 +1,21 @@
+import { type TestGapsReport } from '../analyzers/tests/types';
+import type { GitleaksRawSecret } from '../analyzers/tools/gitleaks';
+import type { InlineAllowlistOccurrence } from '../allowlist/gather';
+import type { GatherScope } from './gather-scope';
+import type { HygieneSnapshot } from './producers';
+/** The non-cached analyzer outputs the producer registry consumes. */
+export interface ScopedProducerInputs {
+    readonly testGapsReport: TestGapsReport;
+    readonly hygiene: HygieneSnapshot;
+    readonly rawSecrets: ReadonlyArray<GitleaksRawSecret>;
+    readonly inlineAllowlistAnnotations: ReadonlyArray<InlineAllowlistOccurrence>;
+}
+/**
+ * Gather the producer-context inputs a scope needs. Each gather is skipped
+ * when its scope flag is off, substituting an empty value so the
+ * corresponding producer emits zero entries. `inlineAllowlistAnnotations` is
+ * always gathered (a cheap source scan that feeds the stale-allow producer,
+ * which has no scope flag).
+ */
+export declare function gatherScopedProducerInputs(cwd: string, scope: GatherScope, verbose: boolean): Promise<ScopedProducerInputs>;
+//# sourceMappingURL=scoped-inputs.d.ts.map

package/dist/baseline/scoped-inputs.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"scoped-inputs.d.ts","sourceRoot":"","sources":["../../src/baseline/scoped-inputs.ts"],"names":[],"mappings":"AAcA,OAAO,EAAuB,KAAK,cAAc,EAAE,MAAM,0BAA0B,CAAC;AAGpF,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,6BAA6B,CAAC;AAErE,OAAO,KAAK,EAAE,yBAAyB,EAAE,MAAM,qBAAqB,CAAC;AACrE,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,gBAAgB,CAAC;AAClD,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,aAAa,CAAC;AAenD,sEAAsE;AACtE,MAAM,WAAW,oBAAoB;IACnC,QAAQ,CAAC,cAAc,EAAE,cAAc,CAAC;IACxC,QAAQ,CAAC,OAAO,EAAE,eAAe,CAAC;IAClC,QAAQ,CAAC,UAAU,EAAE,aAAa,CAAC,iBAAiB,CAAC,CAAC;IACtD,QAAQ,CAAC,0BAA0B,EAAE,aAAa,CAAC,yBAAyB,CAAC,CAAC;CAC/E;AAED;;;;;;GAMG;AACH,wBAAsB,0BAA0B,CAC9C,GAAG,EAAE,MAAM,EACX,KAAK,EAAE,WAAW,EAClB,OAAO,EAAE,OAAO,GACf,OAAO,CAAC,oBAAoB,CAAC,CAY/B"}

package/dist/baseline/scoped-inputs.js

@@ -0,0 +1,53 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.gatherScopedProducerInputs = gatherScopedProducerInputs;
+/**
+ * Scope-aware producer-context inputs.
+ *
+ * Extracted from `create.ts` so `gatherCurrentScan` stays focused on
+ * orchestration. The producer registry (CLAUDE.md Rule 10) reads a handful
+ * of analyzer outputs from `ProducerContext` beyond the cached
+ * `AnalysisResult`: the test-gaps report, hygiene markers, raw secrets, and
+ * inline allowlist annotations. Each feeds exactly one producer family, so a
+ * gather scope that can't block on that family skips the (sometimes
+ * expensive) gather and substitutes an empty input — the producer then
+ * emits zero entries. The ref side is scoped identically, so the cross-run
+ * diff stays balanced (see `gather-scope.ts`).
+ */
+const tests_1 = require("../analyzers/tests");
+const types_1 = require("../analyzers/tests/types");
+const gather_1 = require("../analyzers/quality/gather");
+const gitleaks_1 = require("../analyzers/tools/gitleaks");
+const gather_2 = require("../allowlist/gather");
+/** Vacuous hygiene snapshot for the scope-aware gather when a posture
+ *  cannot block on `stale-file` / hygiene counts (`scope.hygiene === false`),
+ *  so the hygiene grep is skipped. The `quality` producer reads
+ *  `hygiene.staleFiles` and emits zero entries from the empty list. */
+const EMPTY_HYGIENE_SNAPSHOT = {
+    staleFiles: [],
+    todoCount: 0,
+    fixmeCount: 0,
+    hackCount: 0,
+    consoleLogCount: 0,
+    mixedLanguages: false,
+};
+/**
+ * Gather the producer-context inputs a scope needs. Each gather is skipped
+ * when its scope flag is off, substituting an empty value so the
+ * corresponding producer emits zero entries. `inlineAllowlistAnnotations` is
+ * always gathered (a cheap source scan that feeds the stale-allow producer,
+ * which has no scope flag).
+ */
+async function gatherScopedProducerInputs(cwd, scope, verbose) {
+    const testGapsReport = scope.testGaps
+        ? await (0, tests_1.analyzeTestGaps)(cwd, { verbose })
+        : (0, types_1.emptyTestGapsReport)();
+    const hygiene = scope.hygiene ? (0, gather_1.gatherHygieneMarkers)(cwd) : EMPTY_HYGIENE_SNAPSHOT;
+    const gitleaksOutcome = scope.secrets
+        ? (0, gitleaks_1.gatherGitleaksResult)(cwd)
+        : { kind: 'unavailable', reason: 'scoped out' };
+    const rawSecrets = gitleaksOutcome.kind === 'success' ? gitleaksOutcome.rawSecrets : [];
+    const inlineAllowlistAnnotations = (0, gather_2.gatherInlineAllowlistAnnotations)(cwd);
+    return { testGapsReport, hygiene, rawSecrets, inlineAllowlistAnnotations };
+}
+//# sourceMappingURL=scoped-inputs.js.map

package/dist/baseline/scoped-inputs.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"scoped-inputs.js","sourceRoot":"","sources":["../../src/baseline/scoped-inputs.ts"],"names":[],"mappings":";;AAmDA,gEAgBC;AAnED;;;;;;;;;;;;GAYG;AACH,8CAAqD;AACrD,oDAAoF;AACpF,wDAAmE;AACnE,0DAAmE;AAEnE,gDAAuE;AAKvE;;;uEAGuE;AACvE,MAAM,sBAAsB,GAAoB;IAC9C,UAAU,EAAE,EAAE;IACd,SAAS,EAAE,CAAC;IACZ,UAAU,EAAE,CAAC;IACb,SAAS,EAAE,CAAC;IACZ,eAAe,EAAE,CAAC;IAClB,cAAc,EAAE,KAAK;CACtB,CAAC;AAUF;;;;;;GAMG;AACI,KAAK,UAAU,0BAA0B,CAC9C,GAAW,EACX,KAAkB,EAClB,OAAgB;IAEhB,MAAM,cAAc,GAAG,KAAK,CAAC,QAAQ;QACnC,CAAC,CAAC,MAAM,IAAA,uBAAe,EAAC,GAAG,EAAE,EAAE,OAAO,EAAE,CAAC;QACzC,CAAC,CAAC,IAAA,2BAAmB,GAAE,CAAC;IAC1B,MAAM,OAAO,GAAG,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,IAAA,6BAAoB,EAAC,GAAG,CAAC,CAAC,CAAC,CAAC,sBAAsB,CAAC;IACnF,MAAM,eAAe,GAAG,KAAK,CAAC,OAAO;QACnC,CAAC,CAAC,IAAA,+BAAoB,EAAC,GAAG,CAAC;QAC3B,CAAC,CAAE,EAAE,IAAI,EAAE,aAAa,EAAE,MAAM,EAAE,YAAY,EAAY,CAAC;IAC7D,MAAM,UAAU,GACd,eAAe,CAAC,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,eAAe,CAAC,UAAU,CAAC,CAAC,CAAC,EAAE,CAAC;IACvE,MAAM,0BAA0B,GAAG,IAAA,yCAAgC,EAAC,GAAG,CAAC,CAAC;IACzE,OAAO,EAAE,cAAc,EAAE,OAAO,EAAE,UAAU,EAAE,0BAA0B,EAAE,CAAC;AAC7E,CAAC"}

package/dist/loop/doctor.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"doctor.d.ts","sourceRoot":"","sources":["../../src/loop/doctor.ts"],"names":[],"mappings":"AAwBA;2EAC2E;AAC3E,MAAM,MAAM,eAAe,GAAG,MAAM,GAAG,MAAM,GAAG,MAAM,CAAC;AAEvD,MAAM,WAAW,SAAS;IACxB,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,MAAM,EAAE,eAAe,CAAC;IACjC,6CAA6C;IAC7C,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,2EAA2E;IAC3E,QAAQ,CAAC,GAAG,CAAC,EAAE;QACb,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;QACtB,QAAQ,CAAC,OAAO,CAAC,EAAE,MAAM,CAAC;QAC1B,QAAQ,CAAC,KAAK,CAAC,EAAE,MAAM,CAAC;KACzB,CAAC;CACH;AAED,MAAM,WAAW,gBAAgB;IAC/B,QAAQ,CAAC,MAAM,EAAE,gBAAgB,CAAC;IAClC,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;IACrB,2DAA2D;IAC3D,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,MAAM,EAAE,aAAa,CAAC,SAAS,CAAC,CAAC;IAC1C;iDAC6C;IAC7C,QAAQ,CAAC,EAAE,EAAE,OAAO,CAAC;CACtB;AA6ED,mEAAmE;AACnE,wBAAgB,qBAAqB,CAAC,GAAG,EAAE,MAAM,GAAG,gBAAgB,CA8KnE;AAED;;;;GAIG;AACH,wBAAsB,aAAa,CAAC,GAAG,EAAE,MAAM,EAAE,IAAI,GAAE;IAAE,IAAI,CAAC,EAAE,OAAO,CAAA;CAAO,GAAG,OAAO,CAAC,IAAI,CAAC,CA0B7F"}
+{"version":3,"file":"doctor.d.ts","sourceRoot":"","sources":["../../src/loop/doctor.ts"],"names":[],"mappings":"AAyBA;2EAC2E;AAC3E,MAAM,MAAM,eAAe,GAAG,MAAM,GAAG,MAAM,GAAG,MAAM,CAAC;AAEvD,MAAM,WAAW,SAAS;IACxB,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,MAAM,EAAE,eAAe,CAAC;IACjC,6CAA6C;IAC7C,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,2EAA2E;IAC3E,QAAQ,CAAC,GAAG,CAAC,EAAE;QACb,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;QACtB,QAAQ,CAAC,OAAO,CAAC,EAAE,MAAM,CAAC;QAC1B,QAAQ,CAAC,KAAK,CAAC,EAAE,MAAM,CAAC;KACzB,CAAC;CACH;AAED,MAAM,WAAW,gBAAgB;IAC/B,QAAQ,CAAC,MAAM,EAAE,gBAAgB,CAAC;IAClC,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;IACrB,2DAA2D;IAC3D,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,MAAM,EAAE,aAAa,CAAC,SAAS,CAAC,CAAC;IAC1C;iDAC6C;IAC7C,QAAQ,CAAC,EAAE,EAAE,OAAO,CAAC;CACtB;AA6ED,mEAAmE;AACnE,wBAAgB,qBAAqB,CAAC,GAAG,EAAE,MAAM,GAAG,gBAAgB,CAgMnE;AAED;;;;GAIG;AACH,wBAAsB,aAAa,CAAC,GAAG,EAAE,MAAM,EAAE,IAAI,GAAE;IAAE,IAAI,CAAC,EAAE,OAAO,CAAA;CAAO,GAAG,OAAO,CAAC,IAAI,CAAC,CA0B7F"}