@vyuhlabs/dxkit 2.14.0 → 2.16.0

package/CHANGELOG.md

@@ -7,6 +7,77 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ## [Unreleased]
 
+## [2.16.0] - 2026-06-23
+
+### Changed — `--incremental` skips the dependency audit when no manifest changed
+
+`vyuh-dxkit guardrail check --incremental` now, in ref-based mode, **skips the
+OSV dependency-vulnerability audit entirely when the change touched no
+dependency manifest or lockfile.** This is the dominant latency win for the
+incremental path: profiling a 4-file documentation PR on this repo showed the
+dep audit accounting for ~100s of a ~119s scan (gitleaks was 0.4s; the rest of
+a secrets+deps scoped gather was sub-second) — and that audit ran twice (base
+and head) over an unchanged dependency set, so it could not surface anything
+net-new. The same end-to-end check now completes in **~7s**.
+
+The skip is **sound and verdict-preserving in ref-based mode only**: a net-new
+dependency vulnerability requires a manifest/lockfile change, and ref-based
+audits both sides against the *same* advisory snapshot, so an unchanged
+dependency is identical on both sides and never net-new. It deliberately does
+**not** apply to committed modes, where the baseline is an older snapshot and a
+newly-disclosed CVE on an unchanged dependency genuinely *is* net-new and must
+still surface. When the change *does* touch a manifest, the audit runs as before
+and net-new critical/high dependency vulnerabilities block normally.
+
+- **Manifest patterns are now a pack-declared fact** (CLAUDE.md Rule 6): each
+  language pack's `depVulns` capability declares a **required**
+  `manifestPatterns` field (its manifests + lockfiles). The skip consults the
+  active packs' union via `allDependencyManifestPatterns` /
+  `changedFilesTouchDependencyManifest`, so adding a language auto-extends the
+  skip's awareness. A pack that adds dependency auditing but omits the patterns
+  fails to compile **and** fails `test/languages-contract.test.ts`;
+  `test/recipe-playbook.test.ts` proves the union stays pack-driven via a
+  synthetic pack.
+
+Without `--incremental`, behavior is byte-identical to 2.15. `health`,
+`vulnerabilities`, and `committed-full`/`committed-sanitized` guardrail checks
+are unaffected.
+
+## [2.15.0] - 2026-06-22
+
+### Fixed — ref-based guardrail no longer false-blocks on `secret-hmac`
+
+In ref-based mode (the default for public repos), dxkit mints a locator-less
+`secret-hmac` companion alongside each located `secret` for cross-file
+relocation matching. On a fresh or shallow checkout the two sides of the diff
+can derive different salts, so the companions never match and read as net-new —
+a **false block**, even though the located `secret` twins match correctly.
+`secret-hmac` now joins `duplication` and `test-gap` in the set of kinds
+excluded from the ref-based diff (they can't be gathered comparably across a
+detached worktree). The located `secret` kind still gates net-new credentials;
+only the redundant companion is dropped. **Committed modes are unaffected.**
+
+### Added — opt-in `--incremental` for `guardrail check`
+
+`vyuh-dxkit guardrail check --incremental` scopes the gather to the analyzers
+the active policy can actually block on (reusing the loop Stop-gate's
+`scopeForPolicy`) and, in ref-based mode, scopes semgrep to the changed files
+on both sides. Same verdict, far less work — the check scales with PR size
+rather than repo size. **Opt-in and verdict-preserving:** without the flag,
+behavior is byte-identical to 2.14; it falls back to a full scan whenever the
+changed set can't be computed completely. The CLI flag exposes what the loop
+Stop-gate already did internally, so a ref-based CI guardrail (or a hosted
+PR-gate) can run the fast path too.
+
+### Changed — positioning: two pillars (context + gate)
+
+- README hero, package description, and `--help` tagline now lead with both
+  pillars: **"a deterministic stop condition and code-graph context layer for
+  AI coding agents."** The README opening + "What dxkit does" foreground the
+  code graph (callers, callees, blast radius) the agent uses *while making a
+  change*, then the deterministic stop-gate that blocks net-new regressions
+  *before it exits* — so the graph is no longer undersold as a footnote.
+
 ## [2.14.0] - 2026-06-22
 
 ### Changed — the loop Stop-gate gathers far less work per stop
@@ -2189,8 +2260,8 @@ the .NET WinForms benchmark, the JS-heavy customer frontend). All vuln-scan + he
 
 C2.5 also surfaced a candidate drift: platform vuln-scan code-only
 `10H 7M` vs health `10H 10M`. HIGH agreed; MEDIUM differed by 3.
-Investigation via an in-process probe (`tmp/d109-probe.js` runs
-both analyzers sequentially in ONE node process, sharing the
+Investigation via an in-process probe (running both analyzers
+sequentially in ONE node process, sharing the
 dispatcher cache) showed identical aggregates: `{ high: 10,
 medium: 20 }` on both sides. **D109 is NOT a real defect** — the
 architecture is sound. The observed drift across separate
@@ -2288,8 +2359,7 @@ pre-release audit and fixed before ship.
   pattern (different attribute name) so BoM's legitimate per-package
   aggregation is unaffected.
 
-- **Recipe codification (G_v4_8 + G_v4_9 in
-  `tmp/recipe-v4-working-doc.md`)**. Two recipe-playbook
+- **Recipe codification (G_v4_8 + G_v4_9)**. Two recipe-playbook
   synthetic-pack assertions in `test/recipe-playbook.test.ts`
   (synthetic depVuln finding flows into `depBySeverity` +
   `dependencyAdvisoryUniqueCount`; cross-tool TLS-bypass collapses
@@ -2676,10 +2746,9 @@ conditions: G2-Opt2 typed-null capability (Swift consumer), G3
 BENCHMARK_LANGUAGES auto-edit (matrix > 8 packs), G7 pre-commit hook
 polish (multi-gate diagnosis cost).
 
-### Recipe v4 (working doc opened)
+### Recipe v4
 
-`tmp/recipe-v4-working-doc.md` (gitignored, ephemeral). Surfaced
-during 10k.2:
+Surfaced during 10k.2:
 
 - **G_v4_1** — scaffolder TEST_TEMPLATE conflates source-text vs
   tool-output parsers. Future contributors must re-derive the
@@ -2792,10 +2861,8 @@ at every commit in the 10-commit branch.
   validated end-to-end — the same scan that found bug #1 also
   surfaced #2 and #3 once we knew where to look.
 
-  **Forensic evidence preserved** at
-  `tmp/regression/2.4.4/dxkit/bom.json` (gitignored — 2.4.4 baseline
-  with under-reported BoM) vs `tmp/regression/2.4.5-fixed/dxkit/bom.json`
-  (full enumeration after the fix).
+  **Forensic evidence preserved** comparing the 2.4.4 baseline
+  (under-reported BoM) against the 2.4.5 fix (full enumeration).
 
 
 
@@ -2924,8 +2991,7 @@ recipe stress test #2 — fully dynamic language outside the JVM family.
 Then **2.5.0 (Phase 10i — fingerprints + exec summary across 8-language
 matrix)**. Phase 10j.2 (Swift/iOS) is **deferred to post-10rr / pre-3.0.0
 opportunistic slot** because Linux/WSL2 development can't validate the
-xcodeproj-shape majority without macOS access. See
-`tmp/phase-10k-backend-langs-roadmap.md` for the full phase plan.
+xcodeproj-shape majority without macOS access.
 
 ## [2.4.4] - 2026-04-27
 
@@ -3012,7 +3078,7 @@ output for non-Kotlin projects.
   Triage" risk scoring — caught during the regression-check pass
   on dxkit's own BoM diff. Cross-ecosystem.test.ts: 444s peak →
   174s wall-clock after Recipe v2 (-228s, 51% reduction). Closes
-  D010 (`tmp/known-defects.md`). (`src/languages/capabilities/index.ts`,
+  D010. (`src/languages/capabilities/index.ts`,
   `src/analyzers/{health,licenses,quality,security,tests}/...`)
 
 - **`JSCPD_PATTERN` was hardcoded** with `'ts,tsx,js,jsx,py,go,rs,cs'`
@@ -3211,8 +3277,7 @@ identical output before and after.
   `generic.ts`, `grep-secrets.ts`, `project-yaml.ts`, `constants.ts`,
   `tool-registry.ts`** — all per-language if-chains replaced with
   iteration over the `LANGUAGES` registry. 12 of the 14 LP-audit
-  items closed across these files (the audit doc lives in `tmp/` if
-  curious).
+  items closed across these files.
 
 ### Internal
 

package/README.md

@@ -1,11 +1,16 @@
 # dxkit
 
-**A deterministic Stop-gate for autonomous coding loops.**
+**A deterministic stop condition and code-graph context layer for AI coding agents.**
 
-Coding agents keep editing until they decide to stop. Tests and linters catch
-broken code, but they do not know whether the agent made the repo worse than
-the baseline. So loops can quietly ship new secrets, untested paths, and other
-detector-backed regressions, then report success.
+Autonomous coding loops face two control problems: orienting in the code while
+they make a change, and deciding whether that change made the repository worse
+before they stop.
+
+dxkit addresses both. While the agent works, it provides a code graph of
+callers, callees, blast radius, and the files a change touches. Then, when the
+agent tries to stop, dxkit baselines existing findings, reruns trusted checks,
+and blocks only net-new detector-backed regressions with a concrete repair
+reason.
 
 In our loop benchmark, vanilla Claude Code-style loops stopped with net-new
 debt in **11 of 16 runs**. A prompt that told the agent to self-check still
@@ -20,9 +25,10 @@ finding, and the agent repaired before stopping clean.
 
 dxkit does not reinvent detection. It runs trusted open source scanners
 (gitleaks, Semgrep, OSV, npm audit, and more), and it can ingest results from
-Snyk and CodeQL. What it adds is the piece those tools were not built for: a
-deterministic check, on every stop, of whether this change introduced a new
-finding compared with a baseline.
+Snyk and CodeQL. What dxkit adds is the agent-loop layer around those tools: a
+per-stop, baseline-relative verdict of whether this change introduced a new
+finding, returned to the agent with the exact repair reason while the loop is
+still warm.
 
 ```bash
 npm init @vyuhlabs/dxkit -- --claude-loop --yes   # install dxkit + register the Claude Code Stop hook
@@ -30,12 +36,12 @@ npx vyuh-dxkit baseline create                    # grandfather today's findings
 npx vyuh-dxkit loop doctor                         # verify the gate is wired
 ```
 
-The gate runs locally with no model: same input, same verdict, in seconds.
+The stop verdict has no model in the path: same input, same verdict.
 Existing debt stays grandfathered; only net-new regressions block. Want to
 watch the flow first, on a sandbox dxkit creates? See the
-[walkthrough](#see-it-without-touching-your-repo).
+[fixture gate](#run-a-local-fixture-gate).
 
-[Read the benchmark](docs/benchmarks.md) · [Try it on your repo](#try-it-on-your-repo)
+[Read the benchmark](docs/benchmarks.md) · [Try it on your repo](#try-it-on-your-repo) · [Run the fixture gate](#run-a-local-fixture-gate)
 
 <p>
   <a href="https://www.npmjs.com/package/@vyuhlabs/dxkit"><img alt="npm" src="https://img.shields.io/npm/v/@vyuhlabs/dxkit"></a>
@@ -48,23 +54,27 @@ watch the flow first, on a sandbox dxkit creates? See the
 
 ## The problem: loops do not know when they made things worse
 
-An autonomous loop runs until the agent decides it is done. The only checks in
-that loop today are tests and linters, and those catch broken code, not
-regressed code. There is no notion of "worse than the baseline." So an agent
-can add a feature, leave a new untested path or a hardcoded credential behind,
-run the tests, see green, and declare success.
+An autonomous loop runs until the agent decides it is done. The common checks in
+that loop (tests, linters, scanners, CI-style commands) usually answer whether
+something is broken or flagged. They do not, by themselves, maintain a
+brownfield baseline and answer the loop-level question: did this change
+introduce something net-new? So an agent can add a feature, leave a new untested
+path or a hardcoded credential behind, run the tests, see green, and declare
+success.
 
 In our benchmark this happened in most vanilla runs, and telling the agent to
 check its own work only helped a little.
 
 ## What dxkit does
 
-1. **Baseline today's debt.** `baseline create` records every current finding,
-   so pre-existing issues are grandfathered and never block.
-2. **Run a deterministic Stop-gate on every stop.** A Claude Code Stop hook
-   re-runs the guardrail against that baseline. Same input gives the same
-   verdict, in seconds, offline, with no model in the loop.
-3. **Feed net-new findings back to the agent.** If the change introduced a
+1. **Build a structural code graph.** dxkit gives the agent callers, callees,
+   blast radius, and relevant files so it can orient before editing.
+2. **Baseline today's debt.** `baseline create` records current findings, so
+   pre-existing issues are grandfathered and never block.
+3. **Run a deterministic Stop-gate on every stop.** A Claude Code Stop hook
+   reruns the guardrail against that baseline. Same input gives the same
+   verdict; no model decides whether the gate passes.
+4. **Feed net-new findings back to the agent.** If the change introduced a
    finding, the gate blocks the stop and hands the agent the exact finding to
    fix: do not refresh the baseline, do not touch unrelated debt, fix what this
    branch introduced. The loop stops only when clean.
@@ -78,11 +88,27 @@ Use dxkit if you let coding agents:
 - touch brownfield repos that already carry debt,
 - or work where "new debt" matters more than "all debt."
 
+## What dxkit is, and is not
+
+**It is a deterministic verification layer.** It baselines today's findings,
+fingerprints them across churn, and blocks only net-new regressions.
+
+**It is not a scanner replacement.** It runs and ingests scanners (gitleaks,
+Semgrep, CodeQL, Snyk, SARIF) and makes their findings enforceable. It does not
+claim to find more bugs than they do.
+
+**It is not an LLM judge.** No model decides whether the gate passes. The model
+can repair findings. The gate itself is deterministic, and the prompt does not
+grow as the baseline grows.
+
+**It is not a guarantee of safe code.** It blocks detector-backed net-new
+findings it can observe. You still need tests, review, scanners, and judgment.
+
 ## Built on tools you already trust
 
 dxkit is an orchestration and enforcement layer, not another scanner. It runs
 established open source tools and treats their output as one stream. Which tools
-run depends on the languages in your repo — dxkit covers **8 ecosystems**
+run depends on the languages in your repo. dxkit covers **8 ecosystems**
 (TypeScript / JavaScript, Python, Go, Rust, C# / .NET, Java, Kotlin, Ruby).
 
 Universal, on every repo:
@@ -92,8 +118,8 @@ Universal, on every repo:
 - dependency advisories: OSV.dev
 - size, duplication, and the code graph: cloc, jscpd, graphify
 
-Per language, dxkit adds that ecosystem's own linter and audit tool — for
-example npm audit + ESLint (JS / TS), pip-audit + ruff (Python), govulncheck +
+Per language, dxkit adds that ecosystem's own linter and audit tool. For
+example, npm audit + ESLint (JS / TS), pip-audit + ruff (Python), govulncheck +
 golangci-lint (Go), cargo-audit + clippy (Rust), `dotnet list --vulnerable`
 (C#), osv-scanner + PMD (Java), osv-scanner + detekt (Kotlin), and
 bundler-audit + RuboCop (Ruby). The full per-language matrix is in **Per-pack
@@ -114,7 +140,7 @@ and inside the agent loop.
 ## Try it on your repo
 
 The Stop hook runs dxkit on every stop, so install dxkit into the repo. This
-one command adds it as a devDependency and registers the hook additively — your
+one command adds it as a devDependency and registers the hook additively, so your
 existing `.claude` settings are preserved:
 
 ```bash
@@ -128,9 +154,9 @@ npx vyuh-dxkit loop ledger summarize  # afterwards: blocked vs allowed, repaired
 When the agent tries to stop, dxkit runs the net-new gate against the baseline.
 Existing findings are grandfathered; only findings this change introduced block.
 
-## See it without touching your repo
+## Run a local fixture gate
 
-Want the flow first, on a sandbox dxkit creates?
+Want to see the Stop-gate before installing dxkit into your repo?
 
 ```bash
 npx -y @vyuhlabs/dxkit@latest demo loop-guardrail
@@ -141,7 +167,7 @@ net-new secret → BLOCK → repair → CLEAN, then it tears the fixture down. N
 key and no Claude Code, and your own repo is never touched. It needs gitleaks
 installed and takes about 20 seconds; without gitleaks it shows a clearly
 labelled illustration instead. (It does a one-time `npx` download, so it is not
-fully offline — the gate itself is.)
+fully offline, though the gate itself is.)
 
 ### Presets: what blocks the loop
 
@@ -192,18 +218,26 @@ ships, the graph bounds how the loop works.
 Three independent benchmark results, one theme: dxkit makes agent work more
 predictable.
 
-| Layer                      | What it bounds                       | Observed result                                                                                                  |
-| -------------------------- | ------------------------------------ | ---------------------------------------------------------------------------------------------------------------- |
-| **Stop-gate**              | unsafe final state                   | vanilla loops escaped **11/16** times, prompt-only checklist escaped **9/16**, dxkit escaped **0/16**            |
-| **Deterministic identity** | false "net-new" findings under churn | **100% catch / 0% false-block** on seeded gate tests; **0 false net-new** on tested line shifts and renames      |
-| **Graph context**          | large-repo exploration tails         | median roughly tied, but large-repo mean tokens **30% lower**, worst case **57% lower**, variance roughly halved |
-
-**Fixing in the loop is cheaper than fixing later.** A fourth arm of the
-loop-safety study measured the "detect on CI, fix later" model: deferring a
-net-new finding to a cold session cost **19–49% more tokens** (and up to 51% more
-turns) than repairing it inside the warm loop, because the cold fixer has to
-re-orient in a context it no longer holds. So the gate is not just safer than
-deferring, it is cheaper.
+| Layer                      | What it bounds                       | Observed result                                                                                                                     |
+| -------------------------- | ------------------------------------ | ----------------------------------------------------------------------------------------------------------------------------------- |
+| **Stop-gate**              | net-new detector-backed debt         | vanilla loops escaped **11/16** times, prompt-only checklist escaped **9/16**, dxkit escaped **0/16**                               |
+| **Deterministic identity** | false "net-new" findings under churn | caught **all 3** seeded regressions with **0/2** false blocks on clean edits; **0 false net-new** on tested line shifts and renames |
+| **Graph context**          | large-repo exploration tails         | median roughly tied, but large-repo mean tokens **30% lower**, worst case **57% lower**, variance roughly halved                    |
+
+**Deferral has a re-orientation cost.** A fourth arm of the
+loop-safety study measured the "detect on CI, fix later" model: on the test-gap
+task, deferring a net-new finding to a cold session cost **~49% more in
+equivalent cost** and **~51% more turns** than repairing it inside the warm loop,
+because the cold fixer has to re-orient in a context it no longer holds. (The
+secret-task premium pointed the same way but was weak (mean +19%, median
+slightly negative), so we lean on the robust test-gap result.) So the gate is not
+just safer than deferring, it is plausibly cheaper too.
+
+**And the gate is fast enough to run on every stop.** dxkit 2.14.0 scopes the
+Stop-gate scan to the active preset's blockable finding kinds and re-scans only
+the changed files, reusing cached results for everything unchanged. The verdict
+is identical to a full scan; the cost is seconds per stop, not minutes, even on
+large repositories.
 
 > **Benchmark caveats:** the loop-safety study uses controlled synthetic tasks
 > plus real-repo validation, detector-backed findings, and Sonnet runs. It is
@@ -214,22 +248,6 @@ deferring, it is cheaper.
 Full methodology, reproducibility notes, artifact status, and caveats are in
 **[docs/benchmarks.md](docs/benchmarks.md)**.
 
-## What dxkit is, and is not
-
-**It is a deterministic verification layer.** It baselines today's findings,
-fingerprints them across churn, and blocks only net-new regressions.
-
-**It is not a scanner replacement.** It runs and ingests scanners (gitleaks,
-Semgrep, CodeQL, Snyk, SARIF) and makes their findings enforceable. It does not
-claim to find more bugs than they do.
-
-**It is not an LLM judge.** No model decides whether the gate passes. The model
-can repair findings. The gate itself is deterministic, and the prompt does not
-grow as the baseline grows.
-
-**It is not a guarantee of safe code.** It blocks detector-backed net-new
-findings it can observe. You still need tests, review, scanners, and judgment.
-
 ## Why not just Snyk, SonarQube, or CodeQL?
 
 Use them. dxkit can ingest their findings. The difference is tempo and control,
@@ -240,7 +258,7 @@ every time the agent tries to declare done.
 | Loop Stop-gate need                                         | dxkit | Cloud or CI scanners                   |
 | ----------------------------------------------------------- | ----- | -------------------------------------- |
 | Runs locally on every stop, in seconds                      | yes   | usually CI or cloud cadence            |
-| Can run without network or auth                             | yes   | usually requires network or auth       |
+| Deterministic verdict, no model in the gate                 | yes   | varies (some add an LLM judge)         |
 | Grandfathers existing debt                                  | yes   | tool-dependent                         |
 | Feeds the exact block reason back to the warm agent session | yes   | usually a human-facing dashboard or PR |
 
@@ -273,7 +291,7 @@ cloc, jscpd, graphify).
 | Ruby                    | `Gemfile`, `*.rb`           | RuboCop, bundler-audit                    |
 
 <details>
-<summary><strong>Per-pack capabilities</strong> — coverage import, import-graph, severity tiers (click to expand)</summary>
+<summary><strong>Per-pack capabilities</strong>: coverage import, import-graph, severity tiers (click to expand)</summary>
 
 | Language | Detection                             | Coverage import     | Import-graph                                 | Native tools                        | Lint severity tiers    | Vuln severity tiers                           |
 | -------- | ------------------------------------- | ------------------- | -------------------------------------------- | ----------------------------------- | ---------------------- | --------------------------------------------- |
@@ -300,8 +318,8 @@ so it does not inflate the Code Quality score.
 
 ## Reproduce the deterministic tier
 
-The deterministic results — the net-new gate decision and the finding-identity
-matcher — reproduce offline with no API key, so you do not have to trust our
+The deterministic results (the net-new gate decision and the finding-identity
+matcher) reproduce offline with no API key, so you do not have to trust our
 numbers. These harnesses live in `benchmarks/`:
 
 ```bash

package/dist/allowlist/categories.d.ts

@@ -10,8 +10,6 @@
  * allowlist file reader/writer, the inline-annotation parser, the
  * CLI, the block-time hint formatter, and the new `allowlistHits`
  * baseline producer.
- *
- * See tmp/2.6-allowlist-design.md for the design discussion.
  */
 import type { IdentityKind } from '../baseline/producers';
 /**

package/dist/allowlist/categories.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"categories.d.ts","sourceRoot":"","sources":["../../src/allowlist/categories.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AAEH,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,uBAAuB,CAAC;AAE1D;;;;;;GAMG;AACH,eAAO,MAAM,cAAc,kGAMjB,CAAC;AAEX,MAAM,MAAM,iBAAiB,GAAG,CAAC,OAAO,cAAc,CAAC,CAAC,MAAM,CAAC,CAAC;AAEhE;;;;;;;;;;;GAWG;AACH,eAAO,MAAM,mBAAmB,EAAE,WAAW,CAAC,iBAAiB,CAG7D,CAAC;AAEH;;;;;;GAMG;AACH,eAAO,MAAM,4BAA4B,EAAE,WAAW,CAAC,iBAAiB,CAItE,CAAC;AAEH;;;;;;;;;;;;;;;;GAgBG;AACH,eAAO,MAAM,uBAAuB,EAAE,WAAW,CAAC,YAAY,CAO5D,CAAC;AAEH;;;;;;;;;;;;;GAaG;AACH,eAAO,MAAM,kBAAkB,EAAE,QAAQ,CAAC,MAAM,CAAC,YAAY,EAAE,SAAS,iBAAiB,EAAE,CAAC,CA6C3F,CAAC;AAEF;;;;;;;;;GASG;AACH,wBAAgB,YAAY,CAAC,IAAI,EAAE,YAAY,EAAE,QAAQ,EAAE,iBAAiB,GAAG,OAAO,CAErF;AAED;;;GAGG;AACH,wBAAgB,cAAc,CAAC,QAAQ,EAAE,iBAAiB,GAAG,OAAO,CAEnE;AAED;;;;;GAKG;AACH,wBAAgB,sBAAsB,CAAC,IAAI,EAAE,YAAY,EAAE,QAAQ,EAAE,iBAAiB,GAAG,OAAO,CAE/F;AAED;;;;;;GAMG;AACH,eAAO,MAAM,mBAAmB,KAAK,CAAC;AAEtC;;;;;;;GAOG;AACH,wBAAgB,iBAAiB,CAAC,GAAG,GAAE,IAAiB,GAAG,MAAM,CAIhE"}
+{"version":3,"file":"categories.d.ts","sourceRoot":"","sources":["../../src/allowlist/categories.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAEH,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,uBAAuB,CAAC;AAE1D;;;;;;GAMG;AACH,eAAO,MAAM,cAAc,kGAMjB,CAAC;AAEX,MAAM,MAAM,iBAAiB,GAAG,CAAC,OAAO,cAAc,CAAC,CAAC,MAAM,CAAC,CAAC;AAEhE;;;;;;;;;;;GAWG;AACH,eAAO,MAAM,mBAAmB,EAAE,WAAW,CAAC,iBAAiB,CAG7D,CAAC;AAEH;;;;;;GAMG;AACH,eAAO,MAAM,4BAA4B,EAAE,WAAW,CAAC,iBAAiB,CAItE,CAAC;AAEH;;;;;;;;;;;;;;;;GAgBG;AACH,eAAO,MAAM,uBAAuB,EAAE,WAAW,CAAC,YAAY,CAO5D,CAAC;AAEH;;;;;;;;;;;;;GAaG;AACH,eAAO,MAAM,kBAAkB,EAAE,QAAQ,CAAC,MAAM,CAAC,YAAY,EAAE,SAAS,iBAAiB,EAAE,CAAC,CA6C3F,CAAC;AAEF;;;;;;;;;GASG;AACH,wBAAgB,YAAY,CAAC,IAAI,EAAE,YAAY,EAAE,QAAQ,EAAE,iBAAiB,GAAG,OAAO,CAErF;AAED;;;GAGG;AACH,wBAAgB,cAAc,CAAC,QAAQ,EAAE,iBAAiB,GAAG,OAAO,CAEnE;AAED;;;;;GAKG;AACH,wBAAgB,sBAAsB,CAAC,IAAI,EAAE,YAAY,EAAE,QAAQ,EAAE,iBAAiB,GAAG,OAAO,CAE/F;AAED;;;;;;GAMG;AACH,eAAO,MAAM,mBAAmB,KAAK,CAAC;AAEtC;;;;;;;GAOG;AACH,wBAAgB,iBAAiB,CAAC,GAAG,GAAE,IAAiB,GAAG,MAAM,CAIhE"}

package/dist/allowlist/categories.js

@@ -11,8 +11,6 @@
  * allowlist file reader/writer, the inline-annotation parser, the
  * CLI, the block-time hint formatter, and the new `allowlistHits`
  * baseline producer.
- *
- * See tmp/2.6-allowlist-design.md for the design discussion.
  */
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.DEFAULT_EXPIRY_DAYS = exports.CATEGORIES_BY_KIND = exports.INLINE_COMPATIBLE_KINDS = exports.INLINE_COMPATIBLE_CATEGORIES = exports.EXPIRING_CATEGORIES = exports.ALL_CATEGORIES = void 0;

package/dist/allowlist/categories.js.map

@@ -1 +1 @@
-{"version":3,"file":"categories.js","sourceRoot":"","sources":["../../src/allowlist/categories.ts"],"names":[],"mappings":";AAAA;;;;;;;;;;;;;;GAcG;;;AAoJH,oCAEC;AAMD,wCAEC;AAQD,wDAEC;AAmBD,8CAIC;AA3LD;;;;;;GAMG;AACU,QAAA,cAAc,GAAG;IAC5B,gBAAgB;IAChB,cAAc;IACd,sBAAsB;IACtB,eAAe;IACf,UAAU;CACF,CAAC;AAIX;;;;;;;;;;;GAWG;AACU,QAAA,mBAAmB,GAAmC,IAAI,GAAG,CAAC;IACzE,eAAe;IACf,UAAU;CACX,CAAC,CAAC;AAEH;;;;;;GAMG;AACU,QAAA,4BAA4B,GAAmC,IAAI,GAAG,CAAC;IAClF,gBAAgB;IAChB,cAAc;IACd,sBAAsB;CACvB,CAAC,CAAC;AAEH;;;;;;;;;;;;;;;;GAgBG;AACU,QAAA,uBAAuB,GAA8B,IAAI,GAAG,CAAe;IACtF,QAAQ;IACR,aAAa;IACb,MAAM;IACN,QAAQ;IACR,UAAU;IACV,SAAS;CACV,CAAC,CAAC;AAEH;;;;;;;;;;;;;GAaG;AACU,QAAA,kBAAkB,GAAiE;IAC9F,yDAAyD;IACzD,MAAM,EAAE,CAAC,gBAAgB,EAAE,cAAc,EAAE,sBAAsB,EAAE,eAAe,EAAE,UAAU,CAAC;IAC/F,aAAa,EAAE;QACb,gBAAgB;QAChB,cAAc;QACd,sBAAsB;QACtB,eAAe;QACf,UAAU;KACX;IACD,IAAI,EAAE,CAAC,gBAAgB,EAAE,cAAc,EAAE,sBAAsB,EAAE,eAAe,EAAE,UAAU,CAAC;IAC7F,MAAM,EAAE,CAAC,gBAAgB,EAAE,cAAc,EAAE,sBAAsB,EAAE,eAAe,EAAE,UAAU,CAAC;IAE/F,uEAAuE;IACvE,+BAA+B;IAC/B,UAAU,EAAE,CAAC,gBAAgB,EAAE,sBAAsB,EAAE,eAAe,EAAE,UAAU,CAAC;IAEnF,iEAAiE;IACjE,uDAAuD;IACvD,WAAW,EAAE,CAAC,gBAAgB,EAAE,eAAe,EAAE,UAAU,CAAC;IAE5D,qEAAqE;IACrE,iCAAiC;IACjC,cAAc,EAAE,CAAC,eAAe,EAAE,UAAU,CAAC;IAC7C,UAAU,EAAE,CAAC,eAAe,EAAE,UAAU,CAAC;IACzC,uBAAuB,EAAE,CAAC,eAAe,EAAE,UAAU,CAAC;IAEtD,oEAAoE;IACpE,kEAAkE;IAClE,UAAU,EAAE,CAAC,gBAAgB,EAAE,eAAe,EAAE,UAAU,CAAC;IAC3D,YAAY,EAAE,CAAC,gBAAgB,EAAE,eAAe,EAAE,UAAU,CAAC;IAC7D,YAAY,EAAE,CAAC,gBAAgB,EAAE,eAAe,EAAE,UAAU,CAAC;IAE7D,6DAA6D;IAC7D,8DAA8D;IAC9D,OAAO,EAAE,CAAC,eAAe,EAAE,UAAU,CAAC;IAEtC,4DAA4D;IAC5D,8DAA8D;IAC9D,+DAA+D;IAC/D,6DAA6D;IAC7D,iEAAiE;IACjE,8DAA8D;IAC9D,YAAY;IACZ,aAAa,EAAE,EAAE;CAClB,CAAC;AAEF;;;;;;;;;GASG;AACH,SAAgB,YAAY,CAAC,IAAkB,EAAE,QAA2B;IAC1E,OAAO,+BAAuB,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,oCAA4B,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;AACzF,CAAC;AAED;;;GAGG;AACH,SAAgB,cAAc,CAAC,QAA2B;IACxD,OAAO,2BAAmB,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;AAC3C,CAAC;AAED;;;;;GAKG;AACH,SAAgB,sBAAsB,CAAC,IAAkB,EAAE,QAA2B;IACpF,OAAO,0BAAkB,CAAC,IAAI,CAAC,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC;AACrD,CAAC;AAED;;;;;;GAMG;AACU,QAAA,mBAAmB,GAAG,EAAE,CAAC;AAEtC;;;;;;;GAOG;AACH,SAAgB,iBAAiB,CAAC,MAAY,IAAI,IAAI,EAAE;IACtD,MAAM,OAAO,GAAG,IAAI,IAAI,CAAC,GAAG,CAAC,CAAC;IAC9B,OAAO,CAAC,UAAU,CAAC,OAAO,CAAC,UAAU,EAAE,GAAG,2BAAmB,CAAC,CAAC;IAC/D,OAAO,OAAO,CAAC,WAAW,EAAE,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;AAC5C,CAAC"}
+{"version":3,"file":"categories.js","sourceRoot":"","sources":["../../src/allowlist/categories.ts"],"names":[],"mappings":";AAAA;;;;;;;;;;;;GAYG;;;AAoJH,oCAEC;AAMD,wCAEC;AAQD,wDAEC;AAmBD,8CAIC;AA3LD;;;;;;GAMG;AACU,QAAA,cAAc,GAAG;IAC5B,gBAAgB;IAChB,cAAc;IACd,sBAAsB;IACtB,eAAe;IACf,UAAU;CACF,CAAC;AAIX;;;;;;;;;;;GAWG;AACU,QAAA,mBAAmB,GAAmC,IAAI,GAAG,CAAC;IACzE,eAAe;IACf,UAAU;CACX,CAAC,CAAC;AAEH;;;;;;GAMG;AACU,QAAA,4BAA4B,GAAmC,IAAI,GAAG,CAAC;IAClF,gBAAgB;IAChB,cAAc;IACd,sBAAsB;CACvB,CAAC,CAAC;AAEH;;;;;;;;;;;;;;;;GAgBG;AACU,QAAA,uBAAuB,GAA8B,IAAI,GAAG,CAAe;IACtF,QAAQ;IACR,aAAa;IACb,MAAM;IACN,QAAQ;IACR,UAAU;IACV,SAAS;CACV,CAAC,CAAC;AAEH;;;;;;;;;;;;;GAaG;AACU,QAAA,kBAAkB,GAAiE;IAC9F,yDAAyD;IACzD,MAAM,EAAE,CAAC,gBAAgB,EAAE,cAAc,EAAE,sBAAsB,EAAE,eAAe,EAAE,UAAU,CAAC;IAC/F,aAAa,EAAE;QACb,gBAAgB;QAChB,cAAc;QACd,sBAAsB;QACtB,eAAe;QACf,UAAU;KACX;IACD,IAAI,EAAE,CAAC,gBAAgB,EAAE,cAAc,EAAE,sBAAsB,EAAE,eAAe,EAAE,UAAU,CAAC;IAC7F,MAAM,EAAE,CAAC,gBAAgB,EAAE,cAAc,EAAE,sBAAsB,EAAE,eAAe,EAAE,UAAU,CAAC;IAE/F,uEAAuE;IACvE,+BAA+B;IAC/B,UAAU,EAAE,CAAC,gBAAgB,EAAE,sBAAsB,EAAE,eAAe,EAAE,UAAU,CAAC;IAEnF,iEAAiE;IACjE,uDAAuD;IACvD,WAAW,EAAE,CAAC,gBAAgB,EAAE,eAAe,EAAE,UAAU,CAAC;IAE5D,qEAAqE;IACrE,iCAAiC;IACjC,cAAc,EAAE,CAAC,eAAe,EAAE,UAAU,CAAC;IAC7C,UAAU,EAAE,CAAC,eAAe,EAAE,UAAU,CAAC;IACzC,uBAAuB,EAAE,CAAC,eAAe,EAAE,UAAU,CAAC;IAEtD,oEAAoE;IACpE,kEAAkE;IAClE,UAAU,EAAE,CAAC,gBAAgB,EAAE,eAAe,EAAE,UAAU,CAAC;IAC3D,YAAY,EAAE,CAAC,gBAAgB,EAAE,eAAe,EAAE,UAAU,CAAC;IAC7D,YAAY,EAAE,CAAC,gBAAgB,EAAE,eAAe,EAAE,UAAU,CAAC;IAE7D,6DAA6D;IAC7D,8DAA8D;IAC9D,OAAO,EAAE,CAAC,eAAe,EAAE,UAAU,CAAC;IAEtC,4DAA4D;IAC5D,8DAA8D;IAC9D,+DAA+D;IAC/D,6DAA6D;IAC7D,iEAAiE;IACjE,8DAA8D;IAC9D,YAAY;IACZ,aAAa,EAAE,EAAE;CAClB,CAAC;AAEF;;;;;;;;;GASG;AACH,SAAgB,YAAY,CAAC,IAAkB,EAAE,QAA2B;IAC1E,OAAO,+BAAuB,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,oCAA4B,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;AACzF,CAAC;AAED;;;GAGG;AACH,SAAgB,cAAc,CAAC,QAA2B;IACxD,OAAO,2BAAmB,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;AAC3C,CAAC;AAED;;;;;GAKG;AACH,SAAgB,sBAAsB,CAAC,IAAkB,EAAE,QAA2B;IACpF,OAAO,0BAAkB,CAAC,IAAI,CAAC,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC;AACrD,CAAC;AAED;;;;;;GAMG;AACU,QAAA,mBAAmB,GAAG,EAAE,CAAC;AAEtC;;;;;;;GAOG;AACH,SAAgB,iBAAiB,CAAC,MAAY,IAAI,IAAI,EAAE;IACtD,MAAM,OAAO,GAAG,IAAI,IAAI,CAAC,GAAG,CAAC,CAAC;IAC9B,OAAO,CAAC,UAAU,CAAC,OAAO,CAAC,UAAU,EAAE,GAAG,2BAAmB,CAAC,CAAC;IAC/D,OAAO,OAAO,CAAC,WAAW,EAAE,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;AAC5C,CAAC"}

package/dist/analyzers/tools/graphify.js

@@ -386,7 +386,7 @@ if __name__ == '__main__':
     # 2.7 Sprint 1: emit nodes / edges / communities / symbolIndex alongside
     # the aggregate metrics. Consumers (explore CLI, dashboard viz, future
     # 2.8 context CLI + reachability) read this via src/explore/load.ts.
-    # Schema contract documented in tmp/2.7-graph-json-schema.md.
+    # Schema contract: the GraphJson interface in src/explore/types.ts.
 
     # Determine class membership: a module-shaped node is a CLASS if it has
     # outbound 'method' edges to other nodes (it's the owner). A function-

package/dist/analyzers/tools/vendored-advisor.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"vendored-advisor.d.ts","sourceRoot":"","sources":["../../../src/analyzers/tools/vendored-advisor.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;GA0BG;AA4DH;;;;GAIG;AACH,wBAAgB,aAAa,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO,CAGtD;AAED;;;;;GAKG;AACH,wBAAgB,sBAAsB,CAAC,CAAC,SAAS;IAAE,IAAI,EAAE,MAAM,CAAA;CAAE,EAAE,KAAK,EAAE,aAAa,CAAC,CAAC,CAAC,GAAG,CAAC,EAAE,CAE/F"}
+{"version":3,"file":"vendored-advisor.d.ts","sourceRoot":"","sources":["../../../src/analyzers/tools/vendored-advisor.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;GA0BG;AA0DH;;;;GAIG;AACH,wBAAgB,aAAa,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO,CAGtD;AAED;;;;;GAKG;AACH,wBAAgB,sBAAsB,CAAC,CAAC,SAAS;IAAE,IAAI,EAAE,MAAM,CAAA;CAAE,EAAE,KAAK,EAAE,aAAa,CAAC,CAAC,CAAC,GAAG,CAAC,EAAE,CAE/F"}

package/dist/analyzers/tools/vendored-advisor.js

@@ -82,9 +82,7 @@ const SUSPECT_VENDORED_TOKENS = [
 // analyzes the customer's repo via graphify (looking for files with
 // proxy-shape signatures — high class:method ratio, no autogen
 // header, anomalous file size), and proposes `.dxkit-ignore`
-// entries. Scoped in the next graphify session per user direction
-// 2026-05-17 — see `tmp/next-session-graphify-deep-dive.md` and
-// `tmp/graphify-capabilities-expansion.md`.
+// entries.
 /**
  * Check if a relative POSIX path contains a suspect-vendored token.
  * Anchors the check with leading slash so `/libs/` matches a directory

package/dist/analyzers/tools/vendored-advisor.js.map

@@ -1 +1 @@
-{"version":3,"file":"vendored-advisor.js","sourceRoot":"","sources":["../../../src/analyzers/tools/vendored-advisor.ts"],"names":[],"mappings":";AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;GA0BG;;AAiEH,sCAGC;AAQD,wDAEC;AA5ED;;;;;;;;;;;GAWG;AACH,MAAM,uBAAuB,GAAG;IAC9B,QAAQ;IACR,eAAe;IACf,cAAc;IACd,sBAAsB;IACtB,WAAW;IACX,YAAY;IACZ,WAAW;IACX,eAAe;IACf,eAAe;IACf,YAAY;IACZ,gEAAgE;IAChE,kEAAkE;IAClE,gEAAgE;IAChE,aAAa;IACb,WAAW;IACX,UAAU;IACV,UAAU;IACV,WAAW;IACX,qEAAqE;IACrE,qEAAqE;IACrE,+DAA+D;IAC/D,SAAS;IACT,UAAU;IACV,SAAS;IACT,mEAAmE;IACnE,kEAAkE;IAClE,0CAA0C;IAC1C,qBAAqB;IACrB,oBAAoB;IACpB,iBAAiB;IACjB,kBAAkB;CACnB,CAAC;AAEF,+DAA+D;AAC/D,kEAAkE;AAClE,sEAAsE;AACtE,8DAA8D;AAC9D,gEAAgE;AAChE,oEAAoE;AACpE,+DAA+D;AAC/D,6DAA6D;AAC7D,kEAAkE;AAClE,gEAAgE;AAChE,4CAA4C;AAE5C;;;;GAIG;AACH,SAAgB,aAAa,CAAC,OAAe;IAC3C,MAAM,QAAQ,GAAG,CAAC,GAAG,GAAG,OAAO,CAAC,CAAC,WAAW,EAAE,CAAC;IAC/C,OAAO,uBAAuB,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC;AACnE,CAAC;AAED;;;;;GAKG;AACH,SAAgB,sBAAsB,CAA6B,KAAuB;IACxF,OAAO,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,aAAa,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC;AACpD,CAAC"}
+{"version":3,"file":"vendored-advisor.js","sourceRoot":"","sources":["../../../src/analyzers/tools/vendored-advisor.ts"],"names":[],"mappings":";AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;GA0BG;;AA+DH,sCAGC;AAQD,wDAEC;AA1ED;;;;;;;;;;;GAWG;AACH,MAAM,uBAAuB,GAAG;IAC9B,QAAQ;IACR,eAAe;IACf,cAAc;IACd,sBAAsB;IACtB,WAAW;IACX,YAAY;IACZ,WAAW;IACX,eAAe;IACf,eAAe;IACf,YAAY;IACZ,gEAAgE;IAChE,kEAAkE;IAClE,gEAAgE;IAChE,aAAa;IACb,WAAW;IACX,UAAU;IACV,UAAU;IACV,WAAW;IACX,qEAAqE;IACrE,qEAAqE;IACrE,+DAA+D;IAC/D,SAAS;IACT,UAAU;IACV,SAAS;IACT,mEAAmE;IACnE,kEAAkE;IAClE,0CAA0C;IAC1C,qBAAqB;IACrB,oBAAoB;IACpB,iBAAiB;IACjB,kBAAkB;CACnB,CAAC;AAEF,+DAA+D;AAC/D,kEAAkE;AAClE,sEAAsE;AACtE,8DAA8D;AAC9D,gEAAgE;AAChE,oEAAoE;AACpE,+DAA+D;AAC/D,6DAA6D;AAC7D,WAAW;AAEX;;;;GAIG;AACH,SAAgB,aAAa,CAAC,OAAe;IAC3C,MAAM,QAAQ,GAAG,CAAC,GAAG,GAAG,OAAO,CAAC,CAAC,WAAW,EAAE,CAAC;IAC/C,OAAO,uBAAuB,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC;AACnE,CAAC;AAED;;;;;GAKG;AACH,SAAgB,sBAAsB,CAA6B,KAAuB;IACxF,OAAO,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,aAAa,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC;AACpD,CAAC"}

package/dist/baseline/check.d.ts

@@ -98,14 +98,21 @@ export interface RunGuardrailCheckOptions {
      */
     readonly scope?: GatherScope;
     /**
-     * Incremental scanning (opt 3): when true, the CURRENT side's semgrep
-     * scans only files that changed vs the baseline's commit, instead of the
-     * whole tree. Sound for a net-new gate (semgrep is intraprocedural — a
-     * net-new code finding only appears in a changed file). The ref/baseline
-     * side stays full so it covers every file. Falls back to a full scan when
-     * the changed set can't be computed completely. Opt-in: only the loop
-     * Stop-gate sets it; CI / `baseline check` leave it false so their full
-     * report is unaffected.
+     * Incremental scanning (opt 3): when true, semgrep scans only files that
+     * changed vs the comparison base, instead of the whole tree. Sound for a
+     * net-new gate (semgrep is intraprocedural — a net-new code finding only
+     * appears in a changed file). Scope by mode:
+     *   - committed: only the CURRENT side is scoped (the prior side is the
+     *     on-disk, already-full baseline), against the baseline's commit.
+     *   - ref-based: the changed set is fully computable (`diff(ref, HEAD)`),
+     *     so BOTH the ref side and the current side are scoped to the SAME
+     *     set, keeping the cross-run diff symmetric. This makes a ref-based
+     *     guardrail (CI, pre-push, the hosted PR gate) scale with PR size
+     *     rather than repo size.
+     * Falls back to a full scan when the changed set can't be computed
+     * completely. Opt-in: the loop Stop-gate sets it, and `guardrail check
+     * --incremental` exposes it on the CLI; otherwise it stays false so the
+     * full report is unaffected.
      */
     readonly incremental?: boolean;
 }

package/dist/baseline/check.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"check.d.ts","sourceRoot":"","sources":["../../src/baseline/check.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAoCG;AAMH,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,UAAU,CAAC;AAO5C,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,iBAAiB,CAAC;AAEpD,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,YAAY,CAAC;AAKhD,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,SAAS,CAAC;AAE5C,OAAO,KAAK,EAAE,gBAAgB,EAAmB,cAAc,EAAE,MAAM,UAAU,CAAC;AAElF,OAAO,EAAE,KAAK,WAAW,EAAc,MAAM,gBAAgB,CAAC;AAG9D,OAAO,KAAK,EAAE,aAAa,EAAa,eAAe,EAAE,SAAS,EAAE,WAAW,EAAE,MAAM,SAAS,CAAC;AAGjG,OAAO,EAAyB,KAAK,cAAc,EAAE,MAAM,mBAAmB,CAAC;AAE/E,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,mBAAmB,CAAC;AACvD,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,yBAAyB,CAAC;AAEjE,MAAM,WAAW,wBAAwB;IACvC,oEAAoE;IACpE,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;IACrB;gCAC4B;IAC5B,QAAQ,CAAC,IAAI,CAAC,EAAE,MAAM,CAAC;IACvB;;2DAEuD;IACvD,QAAQ,CAAC,YAAY,CAAC,EAAE,MAAM,CAAC;IAC/B;;gBAEY;IACZ,QAAQ,CAAC,WAAW,CAAC,EAAE,OAAO,CAAC;IAC/B;;;;;0CAKsC;IACtC,QAAQ,CAAC,UAAU,CAAC,EAAE,MAAM,CAAC;IAC7B;;;;;uEAKmE;IACnE,QAAQ,CAAC,MAAM,CAAC,EAAE,gBAAgB,CAAC;IACnC,sEAAsE;IACtE,QAAQ,CAAC,OAAO,CAAC,EAAE,OAAO,CAAC;IAC3B;;8CAE0C;IAC1C,QAAQ,CAAC,YAAY,CAAC,EAAE,YAAY,CAAC;IACrC;;oBAEgB;IAChB,QAAQ,CAAC,OAAO,CAAC,EAAE,YAAY,CAAC,MAAM,CAAC,CAAC;IACxC;2DACuD;IACvD,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC;IACzB;;;;;;;;;OASG;IACH,QAAQ,CAAC,KAAK,CAAC,EAAE,WAAW,CAAC;IAC7B;;;;;;;;;OASG;IACH,QAAQ,CAAC,WAAW,CAAC,EAAE,OAAO,CAAC;CAChC;AAED;;;;;GAKG;AACH,MAAM,WAAW,cAAc;IAC7B,QAAQ,CAAC,IAAI,EAAE,SAAS,CAAC;IACzB,QAAQ,CAAC,cAAc,EAAE,cAAc,CAAC;IACxC;mEAC+D;IAC/D,QAAQ,CAAC,QAAQ,CAAC,EAAE,eAAe,CAAC;IACpC;gCAC4B;IAC5B,QAAQ,CAAC,IAAI,EAAE,aAAa,CAAC,MAAM,CAAC,CAAC;IACrC;mCAC+B;IAC/B,QAAQ,CAAC,IAAI,CAAC,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,IAAI,CAAC,EAAE,MAAM,CAAC;IACvB;;;;;uBAKmB;IACnB,QAAQ,CAAC,oBAAoB,CAAC,EAAE,OAAO,CAAC;IACxC;;;;;yEAKqE;IACrE,QAAQ,CAAC,qBAAqB,CAAC,EAAE,oBAAoB,CAAC;CACvD;AAED;;;;;GAKG;AACH,MAAM,WAAW,oBAAoB;IACnC,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B,QAAQ,CAAC,QAAQ,EAAE,iBAAiB,CAAC;IACrC;mCAC+B;IAC/B,QAAQ,CAAC,SAAS,CAAC,EAAE,MAAM,CAAC;CAC7B;AAED,MAAM,WAAW,aAAa;IAC5B,QAAQ,CAAC,oBAAoB,EAAE,OAAO,CAAC;IACvC,QAAQ,CAAC,iBAAiB,EAAE,OAAO,CAAC;IACpC,QAAQ,CAAC,iBAAiB,EAAE,OAAO,CAAC;IACpC,QAAQ,CAAC,iBAAiB,EAAE,OAAO,CAAC;IACpC,QAAQ,CAAC,mBAAmB,EAAE,OAAO,CAAC;IACtC,6DAA6D;IAC7D,QAAQ,CAAC,gBAAgB,EAAE,aAAa,CAAC;QACvC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;QACtB,QAAQ,CAAC,eAAe,EAAE,MAAM,GAAG,SAAS,CAAC;QAC7C,QAAQ,CAAC,cAAc,EAAE,MAAM,GAAG,SAAS,CAAC;KAC7C,CAAC,CAAC;IACH;;;;kDAI8C;IAC9C,QAAQ,CAAC,aAAa,EAAE,aAAa,CAAC,aAAa,CAAC,CAAC;CACtD;AAED,MAAM,WAAW,oBAAoB;IACnC;;uDAEmD;IACnD,QAAQ,CAAC,IAAI,EAAE,YAAY,CAAC;IAC5B;;uCAEmC;IACnC,QAAQ,CAAC,YAAY,CAAC,EAAE,MAAM,CAAC;IAC/B,QAAQ,CAAC,QAAQ,EAAE,YAAY,CAAC;IAChC,QAAQ,CAAC,OAAO,EAAE,WAAW,CAAC;IAC9B,QAAQ,CAAC,WAAW,EAAE,WAAW,CAAC;IAClC,QAAQ,CAAC,KAAK,EAAE,aAAa,CAAC,cAAc,CAAC,CAAC;IAC9C,QAAQ,CAAC,aAAa,EAAE,aAAa,CAAC;IACtC,QAAQ,CAAC,MAAM,EAAE,gBAAgB,CAAC;IAClC;+BAC2B;IAC3B,QAAQ,CAAC,MAAM,EAAE,OAAO,CAAC;IACzB;sCACkC;IAClC,QAAQ,CAAC,KAAK,EAAE,OAAO,CAAC;IACxB;;;;yDAIqD;IACrD,QAAQ,CAAC,cAAc,EAAE,cAAc,CAAC;IACxC;;;;;;;;mEAQ+D;IAC/D,QAAQ,CAAC,gBAAgB,EAAE,aAAa,CAAC;QACvC,QAAQ,CAAC,IAAI,EAAE,aAAa,CAAC,MAAM,CAAC,CAAC;QACrC,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAC;KAC/B,CAAC,CAAC;CACJ;AAoBD;;;;;;;;;;;;GAYG;AACH,wBAAgB,wBAAwB,CAAC,CAAC,SAAS;IAAE,QAAQ,CAAC,IAAI,EAAE,aAAa,CAAC,MAAM,CAAC,CAAA;CAAE,EACzF,aAAa,EAAE,aAAa,CAAC,CAAC,CAAC,EAC/B,eAAe,EAAE,aAAa,CAAC,CAAC,CAAC,EACjC,UAAU,EAAE,OAAO,GAClB;IACD,aAAa,EAAE,aAAa,CAAC,CAAC,CAAC,CAAC;IAChC,eAAe,EAAE,aAAa,CAAC,CAAC,CAAC,CAAC;IAClC,gBAAgB,EAAE,oBAAoB,CAAC,kBAAkB,CAAC,CAAC;CAC5D,CAoBA;AAwBD;;;;GAIG;AACH,wBAAsB,iBAAiB,CACrC,OAAO,EAAE,wBAAwB,GAChC,OAAO,CAAC,oBAAoB,CAAC,CAsN/B;AA8KD;;;;;;;;;;;;;;;;;;GAkBG;AACH,wBAAgB,uBAAuB,CACrC,SAAS,EAAE,aAAa,EACxB,WAAW,EAAE,aAAa,EAC1B,GAAG,EAAE,IAAI,GACR,oBAAoB,GAAG,SAAS,CAYlC"}
+{"version":3,"file":"check.d.ts","sourceRoot":"","sources":["../../src/baseline/check.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAoCG;AAMH,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,UAAU,CAAC;AAO5C,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,iBAAiB,CAAC;AAEpD,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,YAAY,CAAC;AAKhD,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,SAAS,CAAC;AAE5C,OAAO,KAAK,EAAE,gBAAgB,EAAmB,cAAc,EAAE,MAAM,UAAU,CAAC;AAElF,OAAO,EAAE,KAAK,WAAW,EAA8B,MAAM,gBAAgB,CAAC;AAI9E,OAAO,KAAK,EAAE,aAAa,EAAa,eAAe,EAAE,SAAS,EAAE,WAAW,EAAE,MAAM,SAAS,CAAC;AAGjG,OAAO,EAAyB,KAAK,cAAc,EAAE,MAAM,mBAAmB,CAAC;AAE/E,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,mBAAmB,CAAC;AACvD,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,yBAAyB,CAAC;AAEjE,MAAM,WAAW,wBAAwB;IACvC,oEAAoE;IACpE,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;IACrB;gCAC4B;IAC5B,QAAQ,CAAC,IAAI,CAAC,EAAE,MAAM,CAAC;IACvB;;2DAEuD;IACvD,QAAQ,CAAC,YAAY,CAAC,EAAE,MAAM,CAAC;IAC/B;;gBAEY;IACZ,QAAQ,CAAC,WAAW,CAAC,EAAE,OAAO,CAAC;IAC/B;;;;;0CAKsC;IACtC,QAAQ,CAAC,UAAU,CAAC,EAAE,MAAM,CAAC;IAC7B;;;;;uEAKmE;IACnE,QAAQ,CAAC,MAAM,CAAC,EAAE,gBAAgB,CAAC;IACnC,sEAAsE;IACtE,QAAQ,CAAC,OAAO,CAAC,EAAE,OAAO,CAAC;IAC3B;;8CAE0C;IAC1C,QAAQ,CAAC,YAAY,CAAC,EAAE,YAAY,CAAC;IACrC;;oBAEgB;IAChB,QAAQ,CAAC,OAAO,CAAC,EAAE,YAAY,CAAC,MAAM,CAAC,CAAC;IACxC;2DACuD;IACvD,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC;IACzB;;;;;;;;;OASG;IACH,QAAQ,CAAC,KAAK,CAAC,EAAE,WAAW,CAAC;IAC7B;;;;;;;;;;;;;;;;OAgBG;IACH,QAAQ,CAAC,WAAW,CAAC,EAAE,OAAO,CAAC;CAChC;AAED;;;;;GAKG;AACH,MAAM,WAAW,cAAc;IAC7B,QAAQ,CAAC,IAAI,EAAE,SAAS,CAAC;IACzB,QAAQ,CAAC,cAAc,EAAE,cAAc,CAAC;IACxC;mEAC+D;IAC/D,QAAQ,CAAC,QAAQ,CAAC,EAAE,eAAe,CAAC;IACpC;gCAC4B;IAC5B,QAAQ,CAAC,IAAI,EAAE,aAAa,CAAC,MAAM,CAAC,CAAC;IACrC;mCAC+B;IAC/B,QAAQ,CAAC,IAAI,CAAC,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,IAAI,CAAC,EAAE,MAAM,CAAC;IACvB;;;;;uBAKmB;IACnB,QAAQ,CAAC,oBAAoB,CAAC,EAAE,OAAO,CAAC;IACxC;;;;;yEAKqE;IACrE,QAAQ,CAAC,qBAAqB,CAAC,EAAE,oBAAoB,CAAC;CACvD;AAED;;;;;GAKG;AACH,MAAM,WAAW,oBAAoB;IACnC,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B,QAAQ,CAAC,QAAQ,EAAE,iBAAiB,CAAC;IACrC;mCAC+B;IAC/B,QAAQ,CAAC,SAAS,CAAC,EAAE,MAAM,CAAC;CAC7B;AAED,MAAM,WAAW,aAAa;IAC5B,QAAQ,CAAC,oBAAoB,EAAE,OAAO,CAAC;IACvC,QAAQ,CAAC,iBAAiB,EAAE,OAAO,CAAC;IACpC,QAAQ,CAAC,iBAAiB,EAAE,OAAO,CAAC;IACpC,QAAQ,CAAC,iBAAiB,EAAE,OAAO,CAAC;IACpC,QAAQ,CAAC,mBAAmB,EAAE,OAAO,CAAC;IACtC,6DAA6D;IAC7D,QAAQ,CAAC,gBAAgB,EAAE,aAAa,CAAC;QACvC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;QACtB,QAAQ,CAAC,eAAe,EAAE,MAAM,GAAG,SAAS,CAAC;QAC7C,QAAQ,CAAC,cAAc,EAAE,MAAM,GAAG,SAAS,CAAC;KAC7C,CAAC,CAAC;IACH;;;;kDAI8C;IAC9C,QAAQ,CAAC,aAAa,EAAE,aAAa,CAAC,aAAa,CAAC,CAAC;CACtD;AAED,MAAM,WAAW,oBAAoB;IACnC;;uDAEmD;IACnD,QAAQ,CAAC,IAAI,EAAE,YAAY,CAAC;IAC5B;;uCAEmC;IACnC,QAAQ,CAAC,YAAY,CAAC,EAAE,MAAM,CAAC;IAC/B,QAAQ,CAAC,QAAQ,EAAE,YAAY,CAAC;IAChC,QAAQ,CAAC,OAAO,EAAE,WAAW,CAAC;IAC9B,QAAQ,CAAC,WAAW,EAAE,WAAW,CAAC;IAClC,QAAQ,CAAC,KAAK,EAAE,aAAa,CAAC,cAAc,CAAC,CAAC;IAC9C,QAAQ,CAAC,aAAa,EAAE,aAAa,CAAC;IACtC,QAAQ,CAAC,MAAM,EAAE,gBAAgB,CAAC;IAClC;+BAC2B;IAC3B,QAAQ,CAAC,MAAM,EAAE,OAAO,CAAC;IACzB;sCACkC;IAClC,QAAQ,CAAC,KAAK,EAAE,OAAO,CAAC;IACxB;;;;yDAIqD;IACrD,QAAQ,CAAC,cAAc,EAAE,cAAc,CAAC;IACxC;;;;;;;;mEAQ+D;IAC/D,QAAQ,CAAC,gBAAgB,EAAE,aAAa,CAAC;QACvC,QAAQ,CAAC,IAAI,EAAE,aAAa,CAAC,MAAM,CAAC,CAAC;QACrC,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAC;KAC/B,CAAC,CAAC;CACJ;AAkCD;;;;;;;;;;;;GAYG;AACH,wBAAgB,wBAAwB,CAAC,CAAC,SAAS;IAAE,QAAQ,CAAC,IAAI,EAAE,aAAa,CAAC,MAAM,CAAC,CAAA;CAAE,EACzF,aAAa,EAAE,aAAa,CAAC,CAAC,CAAC,EAC/B,eAAe,EAAE,aAAa,CAAC,CAAC,CAAC,EACjC,UAAU,EAAE,OAAO,GAClB;IACD,aAAa,EAAE,aAAa,CAAC,CAAC,CAAC,CAAC;IAChC,eAAe,EAAE,aAAa,CAAC,CAAC,CAAC,CAAC;IAClC,gBAAgB,EAAE,oBAAoB,CAAC,kBAAkB,CAAC,CAAC;CAC5D,CAoBA;AAwBD;;;;GAIG;AACH,wBAAsB,iBAAiB,CACrC,OAAO,EAAE,wBAAwB,GAChC,OAAO,CAAC,oBAAoB,CAAC,CAiR/B;AA8KD;;;;;;;;;;;;;;;;;;GAkBG;AACH,wBAAgB,uBAAuB,CACrC,SAAS,EAAE,aAAa,EACxB,WAAW,EAAE,aAAa,EAC1B,GAAG,EAAE,IAAI,GACR,oBAAoB,GAAG,SAAS,CAYlC"}