@vyuhlabs/dxkit 2.4.7 → 2.5.0

package/dist/analyzers/tools/deadline.d.ts

@@ -0,0 +1,67 @@
+/**
+ * Race a Promise against a deadline. The wrapper always settles within
+ * `deadlineMs + epsilon`, whether the inner Promise resolves, rejects,
+ * or never settles at all. Rejection of the inner Promise propagates
+ * untouched so callers can still see real provider errors.
+ *
+ * Why this exists: capability providers shell out to external tools
+ * (semgrep, jscpd, graphify, npm audit, pip-audit, …) and occasionally
+ * produce a Promise that never settles — typically because the
+ * provider awaits multiple async operations in turn and one of them
+ * (a `Promise.all`, a non-`runDetached` subprocess, a network call)
+ * silently hangs. `runDetached` has its own safety-deadline that
+ * forces its Promise to resolve, but providers can produce abandoned
+ * Promises outside `runDetached` too. The dispatcher used to wrap
+ * those calls in `Promise.allSettled`, which only collapses settled
+ * Promises — an unsettled Promise inside leaves the whole capability
+ * gather pending forever, the Node event loop empties, and the
+ * subprocess exits cleanly with no work done — a silent rc=0 with
+ * no report on disk. The reproducible offender on at least one
+ * heavy JS-stack customer audit has been `license-checker` walking
+ * a deep `node_modules` tree, which occasionally produces an
+ * unsettling Promise under concurrent subprocess load.
+ *
+ * The dispatcher applies this helper per-provider so any single
+ * provider that stalls is bounded; the rest of the Promise.allSettled
+ * still completes; the stalled source ends up in
+ * `DispatchOutcome.skipped` with a deadline reason that surfaces
+ * downstream in `toolsUnavailable`. Two non-dispatcher gathers
+ * (`gatherDepVulnsWithAvailability`, `gatherLicensesWithAvailability`)
+ * iterate packs themselves; they apply the same pattern at their
+ * own iteration site.
+ */
+export type DeadlineOutcome<T> = {
+    stalled: false;
+    value: T;
+} | {
+    stalled: true;
+    stalledMs: number;
+};
+/**
+ * Race `promise` against a `deadlineMs` timer. Returns:
+ *  - `{ stalled: false, value }` if the Promise resolves before the deadline
+ *  - `{ stalled: true, stalledMs }` if the deadline fires first
+ *
+ * Rejections of the inner Promise propagate as rejections of the
+ * returned Promise — callers handle them separately (e.g. via
+ * `Promise.allSettled`). The internal timer is cleared on settle so a
+ * resolved Promise doesn't leave a stray pending timer keeping Node
+ * alive past process exit.
+ */
+export declare function withDeadline<T>(promise: Promise<T>, deadlineMs: number): Promise<DeadlineOutcome<T>>;
+/**
+ * Default per-provider deadline for capability gathers. Chosen so the
+ * deadline only fires on genuine abandoned-Promise hangs, not on slow
+ * legitimate tool runs:
+ *  - jscpd's `runDetached` timeout is 600s; its safety-deadline adds 30s
+ *  - semgrep's `runDetached` timeout is 300s
+ *  - depVulns providers (npm/pip/gem audit, govulncheck, cargo-audit,
+ *    dotnet) typically settle within 60–180s on large monorepos
+ *
+ * 720s (12 min) sits above the slowest legitimate provider by ~90s of
+ * slack for parsing + aggregation. Real provider runs on the customer
+ * benchmark repos finish well inside this; only the stuck case trips
+ * it.
+ */
+export declare const DEFAULT_PROVIDER_DEADLINE_MS = 720000;
+//# sourceMappingURL=deadline.d.ts.map

package/dist/analyzers/tools/deadline.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"deadline.d.ts","sourceRoot":"","sources":["../../../src/analyzers/tools/deadline.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA+BG;AAEH,MAAM,MAAM,eAAe,CAAC,CAAC,IACzB;IAAE,OAAO,EAAE,KAAK,CAAC;IAAC,KAAK,EAAE,CAAC,CAAA;CAAE,GAC5B;IAAE,OAAO,EAAE,IAAI,CAAC;IAAC,SAAS,EAAE,MAAM,CAAA;CAAE,CAAC;AAEzC;;;;;;;;;;GAUG;AACH,wBAAgB,YAAY,CAAC,CAAC,EAC5B,OAAO,EAAE,OAAO,CAAC,CAAC,CAAC,EACnB,UAAU,EAAE,MAAM,GACjB,OAAO,CAAC,eAAe,CAAC,CAAC,CAAC,CAAC,CAkB7B;AAED;;;;;;;;;;;;;GAaG;AACH,eAAO,MAAM,4BAA4B,SAAU,CAAC"}

package/dist/analyzers/tools/deadline.js

@@ -0,0 +1,81 @@
+"use strict";
+/**
+ * Race a Promise against a deadline. The wrapper always settles within
+ * `deadlineMs + epsilon`, whether the inner Promise resolves, rejects,
+ * or never settles at all. Rejection of the inner Promise propagates
+ * untouched so callers can still see real provider errors.
+ *
+ * Why this exists: capability providers shell out to external tools
+ * (semgrep, jscpd, graphify, npm audit, pip-audit, …) and occasionally
+ * produce a Promise that never settles — typically because the
+ * provider awaits multiple async operations in turn and one of them
+ * (a `Promise.all`, a non-`runDetached` subprocess, a network call)
+ * silently hangs. `runDetached` has its own safety-deadline that
+ * forces its Promise to resolve, but providers can produce abandoned
+ * Promises outside `runDetached` too. The dispatcher used to wrap
+ * those calls in `Promise.allSettled`, which only collapses settled
+ * Promises — an unsettled Promise inside leaves the whole capability
+ * gather pending forever, the Node event loop empties, and the
+ * subprocess exits cleanly with no work done — a silent rc=0 with
+ * no report on disk. The reproducible offender on at least one
+ * heavy JS-stack customer audit has been `license-checker` walking
+ * a deep `node_modules` tree, which occasionally produces an
+ * unsettling Promise under concurrent subprocess load.
+ *
+ * The dispatcher applies this helper per-provider so any single
+ * provider that stalls is bounded; the rest of the Promise.allSettled
+ * still completes; the stalled source ends up in
+ * `DispatchOutcome.skipped` with a deadline reason that surfaces
+ * downstream in `toolsUnavailable`. Two non-dispatcher gathers
+ * (`gatherDepVulnsWithAvailability`, `gatherLicensesWithAvailability`)
+ * iterate packs themselves; they apply the same pattern at their
+ * own iteration site.
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.DEFAULT_PROVIDER_DEADLINE_MS = void 0;
+exports.withDeadline = withDeadline;
+/**
+ * Race `promise` against a `deadlineMs` timer. Returns:
+ *  - `{ stalled: false, value }` if the Promise resolves before the deadline
+ *  - `{ stalled: true, stalledMs }` if the deadline fires first
+ *
+ * Rejections of the inner Promise propagate as rejections of the
+ * returned Promise — callers handle them separately (e.g. via
+ * `Promise.allSettled`). The internal timer is cleared on settle so a
+ * resolved Promise doesn't leave a stray pending timer keeping Node
+ * alive past process exit.
+ */
+function withDeadline(promise, deadlineMs) {
+    let timer;
+    const deadlinePromise = new Promise((resolve) => {
+        timer = setTimeout(() => {
+            resolve({ stalled: true, stalledMs: deadlineMs });
+        }, deadlineMs);
+    });
+    const racedInner = promise.then((value) => {
+        if (timer !== undefined)
+            clearTimeout(timer);
+        return { stalled: false, value };
+    }, (err) => {
+        if (timer !== undefined)
+            clearTimeout(timer);
+        throw err;
+    });
+    return Promise.race([racedInner, deadlinePromise]);
+}
+/**
+ * Default per-provider deadline for capability gathers. Chosen so the
+ * deadline only fires on genuine abandoned-Promise hangs, not on slow
+ * legitimate tool runs:
+ *  - jscpd's `runDetached` timeout is 600s; its safety-deadline adds 30s
+ *  - semgrep's `runDetached` timeout is 300s
+ *  - depVulns providers (npm/pip/gem audit, govulncheck, cargo-audit,
+ *    dotnet) typically settle within 60–180s on large monorepos
+ *
+ * 720s (12 min) sits above the slowest legitimate provider by ~90s of
+ * slack for parsing + aggregation. Real provider runs on the customer
+ * benchmark repos finish well inside this; only the stuck case trips
+ * it.
+ */
+exports.DEFAULT_PROVIDER_DEADLINE_MS = 720_000;
+//# sourceMappingURL=deadline.js.map

package/dist/analyzers/tools/deadline.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"deadline.js","sourceRoot":"","sources":["../../../src/analyzers/tools/deadline.ts"],"names":[],"mappings":";AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA+BG;;;AAiBH,oCAqBC;AAhCD;;;;;;;;;;GAUG;AACH,SAAgB,YAAY,CAC1B,OAAmB,EACnB,UAAkB;IAElB,IAAI,KAAgD,CAAC;IACrD,MAAM,eAAe,GAAG,IAAI,OAAO,CAAqB,CAAC,OAAO,EAAE,EAAE;QAClE,KAAK,GAAG,UAAU,CAAC,GAAG,EAAE;YACtB,OAAO,CAAC,EAAE,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,UAAU,EAAE,CAAC,CAAC;QACpD,CAAC,EAAE,UAAU,CAAC,CAAC;IACjB,CAAC,CAAC,CAAC;IACH,MAAM,UAAU,GAAG,OAAO,CAAC,IAAI,CAC7B,CAAC,KAAK,EAAsB,EAAE;QAC5B,IAAI,KAAK,KAAK,SAAS;YAAE,YAAY,CAAC,KAAK,CAAC,CAAC;QAC7C,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC;IACnC,CAAC,EACD,CAAC,GAAG,EAAE,EAAE;QACN,IAAI,KAAK,KAAK,SAAS;YAAE,YAAY,CAAC,KAAK,CAAC,CAAC;QAC7C,MAAM,GAAG,CAAC;IACZ,CAAC,CACF,CAAC;IACF,OAAO,OAAO,CAAC,IAAI,CAAC,CAAC,UAAU,EAAE,eAAe,CAAC,CAAC,CAAC;AACrD,CAAC;AAED;;;;;;;;;;;;;GAaG;AACU,QAAA,4BAA4B,GAAG,OAAO,CAAC"}

package/dist/analyzers/tools/exclusions.d.ts

@@ -58,11 +58,11 @@ export declare function getGrepExcludeDirFlags(cwd: string): string;
  * multi-segment sourcePaths.
  *
  * D055 (2.4.7): pre-fix, multi-segment paths in `.dxkit-ignore` were
- * flattened to basenames here, so `Dev/Addons/DPLAddon/SAPB1/` silently
- * became `{Dev, Addons, DPLAddon, SAPB1}` — cloc then excluded EVERY
+ * flattened to basenames here, so `Dev/Addons/VendorAddon/SAPB1/` silently
+ * became `{Dev, Addons, VendorAddon, SAPB1}` — cloc then excluded EVERY
  * directory named `Dev` in the tree, killing 90% of source visibility
- * on dpl-studio. The split-flag construction preserves the path
- * structure for cloc.
+ * on the .NET WinForms benchmark. The split-flag construction preserves
+ * the path structure for cloc.
  *
  * The regex is anchored on path-segment boundaries with `(?:^|/)` /
  * `(?:/|$)` so `Dev/Addons/Foo` doesn't accidentally match `Dev/AddonsX`
@@ -83,8 +83,8 @@ export declare function getJscpdIgnorePatterns(cwd: string): string[];
  * `.dxkit-ignore` entries.
  *
  * D055 (2.4.7): pre-fix, basenames-only flattening here meant
- * `Dev/Addons/DPLAddon/SAPB1/` became `{Dev, Addons, DPLAddon, SAPB1}`
- * — graphify then skipped every `Dev/` subtree in dpl-studio (10 files
+ * `Dev/Addons/VendorAddon/SAPB1/` became `{Dev, Addons, VendorAddon, SAPB1}`
+ * — graphify then skipped every `Dev/` subtree in the .NET WinForms benchmark (10 files
  * walked instead of ~1700, Functions=13). The two-set shape lets the
  * walker check basenames via segment membership AND check paths via
  * substring match on the file's relpath.

package/dist/analyzers/tools/exclusions.js

@@ -212,11 +212,11 @@ function getGrepExcludeDirFlags(cwd) {
  * multi-segment sourcePaths.
  *
  * D055 (2.4.7): pre-fix, multi-segment paths in `.dxkit-ignore` were
- * flattened to basenames here, so `Dev/Addons/DPLAddon/SAPB1/` silently
- * became `{Dev, Addons, DPLAddon, SAPB1}` — cloc then excluded EVERY
+ * flattened to basenames here, so `Dev/Addons/VendorAddon/SAPB1/` silently
+ * became `{Dev, Addons, VendorAddon, SAPB1}` — cloc then excluded EVERY
  * directory named `Dev` in the tree, killing 90% of source visibility
- * on dpl-studio. The split-flag construction preserves the path
- * structure for cloc.
+ * on the .NET WinForms benchmark. The split-flag construction preserves
+ * the path structure for cloc.
  *
  * The regex is anchored on path-segment boundaries with `(?:^|/)` /
  * `(?:/|$)` so `Dev/Addons/Foo` doesn't accidentally match `Dev/AddonsX`
@@ -290,8 +290,8 @@ function getJscpdIgnorePatterns(cwd) {
  * `.dxkit-ignore` entries.
  *
  * D055 (2.4.7): pre-fix, basenames-only flattening here meant
- * `Dev/Addons/DPLAddon/SAPB1/` became `{Dev, Addons, DPLAddon, SAPB1}`
- * — graphify then skipped every `Dev/` subtree in dpl-studio (10 files
+ * `Dev/Addons/VendorAddon/SAPB1/` became `{Dev, Addons, VendorAddon, SAPB1}`
+ * — graphify then skipped every `Dev/` subtree in the .NET WinForms benchmark (10 files
  * walked instead of ~1700, Functions=13). The two-set shape lets the
  * walker check basenames via segment membership AND check paths via
  * substring match on the file's relpath.

package/dist/analyzers/tools/fingerprint.d.ts

@@ -1,30 +1,29 @@
 /**
- * Advisory fingerprints — durable per-finding identity across runs.
- *
- * The dispatcher's dep-vuln aggregator (src/analyzers/security/gather.ts)
- * stamps every finding with a stable hash of `(package, installedVersion,
- * id)` before scoring + reporting. The same advisory against the same
- * installed version produces the same fingerprint on every run, so
- * consumers (agent-driven upgrade bots, suppressions, CI gates) can diff
- * a current bom against a stored prior to detect:
- *
- *   - new advisories (fingerprint present now, absent before)
- *   - resolved advisories (fingerprint absent now, present before)
- *   - unchanged advisories (fingerprint in both sets)
- *
- * Excluded from the hash:
- *   - severity / cvssScore — re-scoring the same advisory against the
- *     same install must not mint a new identity
- *   - enrichment fields (epssScore, kev, reachable, riskScore) — same
- *     reason; these are signals about the advisory, not part of it
- *   - producer `tool` — the same advisory hit by two producers (e.g.
- *     npm-audit + snyk) should collapse to one identity
- *   - `upgradeAdvice` / `upgradePlan` — resolution suggestions change
- *     across releases of the fix tooling; identity must outlive them
- *
- * Format: 16-char lowercase hex (first 8 bytes of SHA-1). Short enough
- * to embed inline in reports, long enough to make collisions between
- * non-identical tuples effectively impossible for repo-scale sets.
+ * Durable per-finding identity across runs — used by both intra-run dedup
+ * (the security aggregator collapses cross-tool overlaps via fingerprint)
+ * and cross-run diff tooling (baselines compare today's fingerprint set
+ * against yesterday's to surface added / removed / persisted findings).
+ *
+ * Two fingerprint families live here:
+ *
+ *   1. Dependency-advisory fingerprints — stable hash of
+ *      `(package, installedVersion, id)`. Used by `gatherDepVulns` +
+ *      BoM. Excludes severity / cvssScore / enrichment fields
+ *      (epssScore, kev, reachable, riskScore), producer `tool`, and
+ *      `upgradeAdvice` / `upgradePlan` so re-scoring the same advisory
+ *      against the same install never mints a new identity.
+ *
+ *   2. Code/secret/config-finding fingerprints — stable hash of
+ *      `(canonicalRule, file, lineWindow)`. The canonical-rule map
+ *      collapses cross-tool overlaps (e.g. semgrep + a per-language
+ *      grep-based pattern both reporting the same TLS-bypass
+ *      construct). The line-window absorbs the small offset between
+ *      tools that report the declaration vs. the assignment.
+ *
+ * Both families share format: 16-char lowercase hex (first 8 bytes of
+ * SHA-1). Short enough to embed inline in reports, long enough to make
+ * collisions between non-identical tuples effectively impossible at
+ * repo scale. Producers may render either inline interchangeably.
  */
 import type { DepVulnFinding } from '../../languages/capabilities/types';
 /**
@@ -60,4 +59,70 @@ export declare function stampFingerprints(findings: DepVulnFinding[]): void;
  * findings outside the `gatherDepVulns` path).
  */
 export declare function collectFingerprints(findings: ReadonlyArray<DepVulnFinding>): string[];
+/**
+ * Maps raw `(tool, rule)` pairs to a canonical rule id. Two raw
+ * findings with the same canonical rule (and same file + line window)
+ * fingerprint identically — the aggregator's dedup pipeline collapses
+ * them into a single CodeFinding with `producedBy` listing every
+ * contributing tool. Adding a new collapse is a one-line addition; no
+ * algorithm changes.
+ *
+ * Unmapped pairs fall through to `raw:${tool}:${rule}` — conservative
+ * default. Never accidentally collapses unrelated findings.
+ */
+export declare const CANONICAL_RULE_MAP: ReadonlyMap<string, string>;
+/** Resolve a raw `(tool, rule)` pair to its canonical rule id. */
+export declare function canonicalRuleFor(tool: string, rule: string): string;
+/**
+ * Width of the line-number bucket used by code-finding fingerprints.
+ * Tools report the same construct at slightly different lines (one
+ * tool on the declaration, another on the assignment). Bucketing
+ * absorbs that drift without collapsing unrelated findings on
+ * nearby lines.
+ */
+export declare const CODE_FINGERPRINT_LINE_WINDOW = 3;
+/**
+ * Bucket a line number to its canonical line-window value. Findings
+ * sharing the same `(canonicalRule, file, lineWindow)` tuple share a
+ * fingerprint.
+ *
+ * Note on boundary cases: the aggregator additionally probes the two
+ * neighbor buckets (±lineWindow) to catch adjacent findings that
+ * straddle a bucket boundary; that lookup lives in the aggregator
+ * because it owns the merge policy, not here.
+ */
+export declare function lineWindowFor(line: number): number;
+/**
+ * Stable 16-char hex hash of `(canonicalRule, file, lineWindow)`.
+ * NUL-separated so distinct tuples can't collide via concatenation
+ * tricks. Same byte format as `computeFingerprint` so dep-vuln and
+ * code-finding fingerprints share a downstream type contract.
+ */
+export declare function computeCodeFingerprint(canonicalRule: string, file: string, line: number): string;
+/**
+ * HMAC-SHA256 of a detected secret value, keyed by a per-repo salt.
+ * The output is 16-char lowercase hex (first 8 bytes of the 32-byte
+ * HMAC) so it shares the byte format of the other fingerprint helpers
+ * and can be embedded inline in reports without taking real estate.
+ *
+ * Cryptographic posture: HMAC (not bare hash) so the producer cannot
+ * recover the secret from its identity even if the salt is leaked,
+ * and the salt cannot be recovered from the identity even if the
+ * secret is known. Truncating to 8 bytes is safe at repo scale —
+ * collision probability for distinct secrets is ~2^-32 per pair,
+ * negligible for any realistic finding set.
+ *
+ * Used by the secret-hmac identity scheme: a leaked token that moves
+ * files between runs produces the same HMAC, so the matcher can
+ * recognize "same secret, different location" as a relocated finding
+ * rather than a deleted+added pair. The salt is per-repo so
+ * cross-repo identity collisions are impossible (the same secret in
+ * two repos hashes to two different HMACs).
+ *
+ * The producer never stores the secret value itself — only the HMAC.
+ * That's the whole reason this scheme is preferred over a bare
+ * content hash of the secret: zero secret-recovery risk in the
+ * baseline file.
+ */
+export declare function computeSecretHmac(secret: string, salt: string): string;
 //# sourceMappingURL=fingerprint.d.ts.map

package/dist/analyzers/tools/fingerprint.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"fingerprint.d.ts","sourceRoot":"","sources":["../../../src/analyzers/tools/fingerprint.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2BG;AAGH,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,oCAAoC,CAAC;AAEzE;;;;;;;;;GASG;AACH,wBAAgB,kBAAkB,CAChC,OAAO,EAAE,IAAI,CAAC,cAAc,EAAE,SAAS,GAAG,kBAAkB,GAAG,IAAI,CAAC,GACnE,MAAM,CAGR;AAED;;;;;;;;;GASG;AACH,wBAAgB,iBAAiB,CAAC,QAAQ,EAAE,cAAc,EAAE,GAAG,IAAI,CAIlE;AAED;;;;;;;;;GASG;AACH,wBAAgB,mBAAmB,CAAC,QAAQ,EAAE,aAAa,CAAC,cAAc,CAAC,GAAG,MAAM,EAAE,CAMrF"}
+{"version":3,"file":"fingerprint.d.ts","sourceRoot":"","sources":["../../../src/analyzers/tools/fingerprint.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;GA0BG;AAGH,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,oCAAoC,CAAC;AAEzE;;;;;;;;;GASG;AACH,wBAAgB,kBAAkB,CAChC,OAAO,EAAE,IAAI,CAAC,cAAc,EAAE,SAAS,GAAG,kBAAkB,GAAG,IAAI,CAAC,GACnE,MAAM,CAGR;AAED;;;;;;;;;GASG;AACH,wBAAgB,iBAAiB,CAAC,QAAQ,EAAE,cAAc,EAAE,GAAG,IAAI,CAIlE;AAED;;;;;;;;;GASG;AACH,wBAAgB,mBAAmB,CAAC,QAAQ,EAAE,aAAa,CAAC,cAAc,CAAC,GAAG,MAAM,EAAE,CAMrF;AAID;;;;;;;;;;GAUG;AACH,eAAO,MAAM,kBAAkB,EAAE,WAAW,CAAC,MAAM,EAAE,MAAM,CASzD,CAAC;AAEH,kEAAkE;AAClE,wBAAgB,gBAAgB,CAAC,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,MAAM,CAEnE;AAED;;;;;;GAMG;AACH,eAAO,MAAM,4BAA4B,IAAI,CAAC;AAE9C;;;;;;;;;GASG;AACH,wBAAgB,aAAa,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAElD;AAED;;;;;GAKG;AACH,wBAAgB,sBAAsB,CAAC,aAAa,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,MAAM,CAGhG;AAID;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AACH,wBAAgB,iBAAiB,CAAC,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,MAAM,CAEtE"}

package/dist/analyzers/tools/fingerprint.js

@@ -1,36 +1,40 @@
 "use strict";
 /**
- * Advisory fingerprints — durable per-finding identity across runs.
+ * Durable per-finding identity across runs — used by both intra-run dedup
+ * (the security aggregator collapses cross-tool overlaps via fingerprint)
+ * and cross-run diff tooling (baselines compare today's fingerprint set
+ * against yesterday's to surface added / removed / persisted findings).
  *
- * The dispatcher's dep-vuln aggregator (src/analyzers/security/gather.ts)
- * stamps every finding with a stable hash of `(package, installedVersion,
- * id)` before scoring + reporting. The same advisory against the same
- * installed version produces the same fingerprint on every run, so
- * consumers (agent-driven upgrade bots, suppressions, CI gates) can diff
- * a current bom against a stored prior to detect:
+ * Two fingerprint families live here:
  *
- *   - new advisories (fingerprint present now, absent before)
- *   - resolved advisories (fingerprint absent now, present before)
- *   - unchanged advisories (fingerprint in both sets)
+ *   1. Dependency-advisory fingerprints — stable hash of
+ *      `(package, installedVersion, id)`. Used by `gatherDepVulns` +
+ *      BoM. Excludes severity / cvssScore / enrichment fields
+ *      (epssScore, kev, reachable, riskScore), producer `tool`, and
+ *      `upgradeAdvice` / `upgradePlan` so re-scoring the same advisory
+ *      against the same install never mints a new identity.
  *
- * Excluded from the hash:
- *   - severity / cvssScore — re-scoring the same advisory against the
- *     same install must not mint a new identity
- *   - enrichment fields (epssScore, kev, reachable, riskScore) — same
- *     reason; these are signals about the advisory, not part of it
- *   - producer `tool` — the same advisory hit by two producers (e.g.
- *     npm-audit + snyk) should collapse to one identity
- *   - `upgradeAdvice` / `upgradePlan` — resolution suggestions change
- *     across releases of the fix tooling; identity must outlive them
+ *   2. Code/secret/config-finding fingerprints — stable hash of
+ *      `(canonicalRule, file, lineWindow)`. The canonical-rule map
+ *      collapses cross-tool overlaps (e.g. semgrep + a per-language
+ *      grep-based pattern both reporting the same TLS-bypass
+ *      construct). The line-window absorbs the small offset between
+ *      tools that report the declaration vs. the assignment.
  *
- * Format: 16-char lowercase hex (first 8 bytes of SHA-1). Short enough
- * to embed inline in reports, long enough to make collisions between
- * non-identical tuples effectively impossible for repo-scale sets.
+ * Both families share format: 16-char lowercase hex (first 8 bytes of
+ * SHA-1). Short enough to embed inline in reports, long enough to make
+ * collisions between non-identical tuples effectively impossible at
+ * repo scale. Producers may render either inline interchangeably.
  */
 Object.defineProperty(exports, "__esModule", { value: true });
+exports.CODE_FINGERPRINT_LINE_WINDOW = exports.CANONICAL_RULE_MAP = void 0;
 exports.computeFingerprint = computeFingerprint;
 exports.stampFingerprints = stampFingerprints;
 exports.collectFingerprints = collectFingerprints;
+exports.canonicalRuleFor = canonicalRuleFor;
+exports.lineWindowFor = lineWindowFor;
+exports.computeCodeFingerprint = computeCodeFingerprint;
+exports.computeSecretHmac = computeSecretHmac;
 const crypto_1 = require("crypto");
 /**
  * Stable 16-char hex fingerprint for one DepVulnFinding. Input tuple
@@ -79,4 +83,89 @@ function collectFingerprints(findings) {
     }
     return [...set].sort();
 }
+// ─── Code/secret/config-finding fingerprints ─────────────────────────────────
+/**
+ * Maps raw `(tool, rule)` pairs to a canonical rule id. Two raw
+ * findings with the same canonical rule (and same file + line window)
+ * fingerprint identically — the aggregator's dedup pipeline collapses
+ * them into a single CodeFinding with `producedBy` listing every
+ * contributing tool. Adding a new collapse is a one-line addition; no
+ * algorithm changes.
+ *
+ * Unmapped pairs fall through to `raw:${tool}:${rule}` — conservative
+ * default. Never accidentally collapses unrelated findings.
+ */
+exports.CANONICAL_RULE_MAP = new Map([
+    // TLS / certificate validation bypass
+    ['tls-bypass-registry:tls-validation-disabled', 'canonical:tls-bypass'],
+    ['semgrep:bypass-tls-verification', 'canonical:tls-bypass'],
+    ['semgrep:nodejsscan.node_tls_reject_unauthorized', 'canonical:tls-bypass'],
+    // Private-key file on disk — find + gitleaks may both surface
+    ['find:private-key-file', 'canonical:private-key-on-disk'],
+    ['gitleaks:private-key', 'canonical:private-key-on-disk'],
+]);
+/** Resolve a raw `(tool, rule)` pair to its canonical rule id. */
+function canonicalRuleFor(tool, rule) {
+    return exports.CANONICAL_RULE_MAP.get(`${tool}:${rule}`) ?? `raw:${tool}:${rule}`;
+}
+/**
+ * Width of the line-number bucket used by code-finding fingerprints.
+ * Tools report the same construct at slightly different lines (one
+ * tool on the declaration, another on the assignment). Bucketing
+ * absorbs that drift without collapsing unrelated findings on
+ * nearby lines.
+ */
+exports.CODE_FINGERPRINT_LINE_WINDOW = 3;
+/**
+ * Bucket a line number to its canonical line-window value. Findings
+ * sharing the same `(canonicalRule, file, lineWindow)` tuple share a
+ * fingerprint.
+ *
+ * Note on boundary cases: the aggregator additionally probes the two
+ * neighbor buckets (±lineWindow) to catch adjacent findings that
+ * straddle a bucket boundary; that lookup lives in the aggregator
+ * because it owns the merge policy, not here.
+ */
+function lineWindowFor(line) {
+    return Math.floor(line / exports.CODE_FINGERPRINT_LINE_WINDOW) * exports.CODE_FINGERPRINT_LINE_WINDOW;
+}
+/**
+ * Stable 16-char hex hash of `(canonicalRule, file, lineWindow)`.
+ * NUL-separated so distinct tuples can't collide via concatenation
+ * tricks. Same byte format as `computeFingerprint` so dep-vuln and
+ * code-finding fingerprints share a downstream type contract.
+ */
+function computeCodeFingerprint(canonicalRule, file, line) {
+    const input = `${canonicalRule}\0${file}\0${lineWindowFor(line)}`;
+    return (0, crypto_1.createHash)('sha1').update(input).digest('hex').slice(0, 16);
+}
+// ─── Secret HMAC primitive ───────────────────────────────────────────────────
+/**
+ * HMAC-SHA256 of a detected secret value, keyed by a per-repo salt.
+ * The output is 16-char lowercase hex (first 8 bytes of the 32-byte
+ * HMAC) so it shares the byte format of the other fingerprint helpers
+ * and can be embedded inline in reports without taking real estate.
+ *
+ * Cryptographic posture: HMAC (not bare hash) so the producer cannot
+ * recover the secret from its identity even if the salt is leaked,
+ * and the salt cannot be recovered from the identity even if the
+ * secret is known. Truncating to 8 bytes is safe at repo scale —
+ * collision probability for distinct secrets is ~2^-32 per pair,
+ * negligible for any realistic finding set.
+ *
+ * Used by the secret-hmac identity scheme: a leaked token that moves
+ * files between runs produces the same HMAC, so the matcher can
+ * recognize "same secret, different location" as a relocated finding
+ * rather than a deleted+added pair. The salt is per-repo so
+ * cross-repo identity collisions are impossible (the same secret in
+ * two repos hashes to two different HMACs).
+ *
+ * The producer never stores the secret value itself — only the HMAC.
+ * That's the whole reason this scheme is preferred over a bare
+ * content hash of the secret: zero secret-recovery risk in the
+ * baseline file.
+ */
+function computeSecretHmac(secret, salt) {
+    return (0, crypto_1.createHmac)('sha256', salt).update(secret).digest('hex').slice(0, 16);
+}
 //# sourceMappingURL=fingerprint.js.map

package/dist/analyzers/tools/fingerprint.js.map

@@ -1 +1 @@
-{"version":3,"file":"fingerprint.js","sourceRoot":"","sources":["../../../src/analyzers/tools/fingerprint.ts"],"names":[],"mappings":";AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2BG;;AAeH,gDAKC;AAYD,8CAIC;AAYD,kDAMC;AApDD,mCAAoC;AAGpC;;;;;;;;;GASG;AACH,SAAgB,kBAAkB,CAChC,OAAoE;IAEpE,MAAM,KAAK,GAAG,GAAG,OAAO,CAAC,OAAO,KAAK,OAAO,CAAC,gBAAgB,IAAI,EAAE,KAAK,OAAO,CAAC,EAAE,EAAE,CAAC;IACrF,OAAO,IAAA,mBAAU,EAAC,MAAM,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;AACrE,CAAC;AAED;;;;;;;;;GASG;AACH,SAAgB,iBAAiB,CAAC,QAA0B;IAC1D,KAAK,MAAM,CAAC,IAAI,QAAQ,EAAE,CAAC;QACzB,CAAC,CAAC,WAAW,GAAG,kBAAkB,CAAC,CAAC,CAAC,CAAC;IACxC,CAAC;AACH,CAAC;AAED;;;;;;;;;GASG;AACH,SAAgB,mBAAmB,CAAC,QAAuC;IACzE,MAAM,GAAG,GAAG,IAAI,GAAG,EAAU,CAAC;IAC9B,KAAK,MAAM,CAAC,IAAI,QAAQ,EAAE,CAAC;QACzB,IAAI,CAAC,CAAC,WAAW;YAAE,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC;IAC5C,CAAC;IACD,OAAO,CAAC,GAAG,GAAG,CAAC,CAAC,IAAI,EAAE,CAAC;AACzB,CAAC"}
+{"version":3,"file":"fingerprint.js","sourceRoot":"","sources":["../../../src/analyzers/tools/fingerprint.ts"],"names":[],"mappings":";AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;GA0BG;;;AAeH,gDAKC;AAYD,8CAIC;AAYD,kDAMC;AA2BD,4CAEC;AAqBD,sCAEC;AAQD,wDAGC;AA6BD,8CAEC;AAlJD,mCAAgD;AAGhD;;;;;;;;;GASG;AACH,SAAgB,kBAAkB,CAChC,OAAoE;IAEpE,MAAM,KAAK,GAAG,GAAG,OAAO,CAAC,OAAO,KAAK,OAAO,CAAC,gBAAgB,IAAI,EAAE,KAAK,OAAO,CAAC,EAAE,EAAE,CAAC;IACrF,OAAO,IAAA,mBAAU,EAAC,MAAM,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;AACrE,CAAC;AAED;;;;;;;;;GASG;AACH,SAAgB,iBAAiB,CAAC,QAA0B;IAC1D,KAAK,MAAM,CAAC,IAAI,QAAQ,EAAE,CAAC;QACzB,CAAC,CAAC,WAAW,GAAG,kBAAkB,CAAC,CAAC,CAAC,CAAC;IACxC,CAAC;AACH,CAAC;AAED;;;;;;;;;GASG;AACH,SAAgB,mBAAmB,CAAC,QAAuC;IACzE,MAAM,GAAG,GAAG,IAAI,GAAG,EAAU,CAAC;IAC9B,KAAK,MAAM,CAAC,IAAI,QAAQ,EAAE,CAAC;QACzB,IAAI,CAAC,CAAC,WAAW;YAAE,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC;IAC5C,CAAC;IACD,OAAO,CAAC,GAAG,GAAG,CAAC,CAAC,IAAI,EAAE,CAAC;AACzB,CAAC;AAED,gFAAgF;AAEhF;;;;;;;;;;GAUG;AACU,QAAA,kBAAkB,GAAgC,IAAI,GAAG,CAAiB;IACrF,sCAAsC;IACtC,CAAC,6CAA6C,EAAE,sBAAsB,CAAC;IACvE,CAAC,iCAAiC,EAAE,sBAAsB,CAAC;IAC3D,CAAC,iDAAiD,EAAE,sBAAsB,CAAC;IAE3E,8DAA8D;IAC9D,CAAC,uBAAuB,EAAE,+BAA+B,CAAC;IAC1D,CAAC,sBAAsB,EAAE,+BAA+B,CAAC;CAC1D,CAAC,CAAC;AAEH,kEAAkE;AAClE,SAAgB,gBAAgB,CAAC,IAAY,EAAE,IAAY;IACzD,OAAO,0BAAkB,CAAC,GAAG,CAAC,GAAG,IAAI,IAAI,IAAI,EAAE,CAAC,IAAI,OAAO,IAAI,IAAI,IAAI,EAAE,CAAC;AAC5E,CAAC;AAED;;;;;;GAMG;AACU,QAAA,4BAA4B,GAAG,CAAC,CAAC;AAE9C;;;;;;;;;GASG;AACH,SAAgB,aAAa,CAAC,IAAY;IACxC,OAAO,IAAI,CAAC,KAAK,CAAC,IAAI,GAAG,oCAA4B,CAAC,GAAG,oCAA4B,CAAC;AACxF,CAAC;AAED;;;;;GAKG;AACH,SAAgB,sBAAsB,CAAC,aAAqB,EAAE,IAAY,EAAE,IAAY;IACtF,MAAM,KAAK,GAAG,GAAG,aAAa,KAAK,IAAI,KAAK,aAAa,CAAC,IAAI,CAAC,EAAE,CAAC;IAClE,OAAO,IAAA,mBAAU,EAAC,MAAM,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;AACrE,CAAC;AAED,gFAAgF;AAEhF;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AACH,SAAgB,iBAAiB,CAAC,MAAc,EAAE,IAAY;IAC5D,OAAO,IAAA,mBAAU,EAAC,QAAQ,EAAE,IAAI,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;AAC9E,CAAC"}

package/dist/analyzers/tools/generic.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"generic.d.ts","sourceRoot":"","sources":["../../../src/analyzers/tools/generic.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AACH,OAAO,EAAE,aAAa,EAAE,MAAM,UAAU,CAAC;AACzC,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,aAAa,CAAC;AA+DjD;;;;;;;;GAQG;AACH,wBAAgB,oBAAoB,CAClC,GAAG,EAAE,MAAM,EACX,aAAa,CAAC,EAAE,aAAa,CAAC,WAAW,CAAC,GACzC,OAAO,CAAC,aAAa,CAAC,CAiOxB"}
+{"version":3,"file":"generic.d.ts","sourceRoot":"","sources":["../../../src/analyzers/tools/generic.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AACH,OAAO,EAAE,aAAa,EAAE,MAAM,UAAU,CAAC;AACzC,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,aAAa,CAAC;AA+DjD;;;;;;;;GAQG;AACH,wBAAgB,oBAAoB,CAClC,GAAG,EAAE,MAAM,EACX,aAAa,CAAC,EAAE,aAAa,CAAC,WAAW,CAAC,GACzC,OAAO,CAAC,aAAa,CAAC,CAsOxB"}

package/dist/analyzers/tools/generic.js

@@ -57,7 +57,7 @@ const path = __importStar(require("path"));
  * Resolve the git toplevel for `cwd`. D026 (2.4.7): cross-cutting repo
  * artifacts (`.github/`, `README.md`, `CONTRIBUTING.md`, `Makefile`,
  * `.env.example`, etc.) conventionally live at the repo root, not in
- * the subdirectory a user happens to scan. dpl-studio's baseline F8:
+ * the subdirectory a user happens to scan. The .NET WinForms benchmark's baseline F8:
  * customer ran `dxkit health Code/Source/`; both Documentation and DX
  * dimensions returned 0/100 because none of those probes found
  * matches in `Code/Source/`. The fix scopes those probes to the
@@ -151,7 +151,12 @@ function gatherGenericMetrics(cwd, languageFlags) {
             filesOver500Lines++;
     }
     const sourceFiles = sourceList.length;
-    const largestFiles = [...filteredFiles].sort((a, b) => b.lines - a.lines).slice(0, 10);
+    // Every file over the canonical large-file threshold, sorted
+    // descending. Filtered (not pre-sliced) at this layer so the
+    // baseline `large-file` producer captures one entry per file and
+    // the per-kind count matches `filesOver500Lines` above. The
+    // markdown renderer caps to top 10 at the display site.
+    const largestFiles = filteredFiles.filter((f) => f.lines > 500).sort((a, b) => b.lines - a.lines);
     // ─── Console / debug / type-escape / eval counts (D074 closure) ───────────
     // skipComments: true filters lines beginning with //, /*, or # so
     // commented-out occurrences don't inflate the count.

package/dist/analyzers/tools/generic.js.map

@@ -1 +1 @@
-{"version":3,"file":"generic.js","sourceRoot":"","sources":["../../../src/analyzers/tools/generic.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AA+EA,oDAoOC;AA3SD,qCAAuD;AACvD,6CAAmD;AACnD,2DAAwE;AACxE,yDAA2D;AAC3D,+CAMyB;AACzB,uCAAyB;AACzB,2CAA6B;AAE7B,wEAAwE;AACxE,uEAAuE;AACvE,gEAAgE;AAChE,qEAAqE;AACrE,gEAAgE;AAChE,6DAA6D;AAC7D,oEAAoE;AACpE,EAAE;AACF,kEAAkE;AAClE,iEAAiE;AACjE,6DAA6D;AAC7D,qCAAqC;AAErC;;;;;;;;;;;;;GAaG;AACH,SAAS,kBAAkB,CAAC,GAAW;IACrC,MAAM,GAAG,GAAG,IAAA,YAAG,EAAC,2CAA2C,EAAE,GAAG,CAAC,CAAC,IAAI,EAAE,CAAC;IACzE,OAAO,GAAG,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC;AACpC,CAAC;AAED;;;;GAIG;AACH,SAAS,SAAS,CAAC,OAAe;IAChC,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,CAAC,CAAC;IACnC,IAAI,KAAK,GAAG,CAAC,CAAC;IACd,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QACxC,IAAI,OAAO,CAAC,UAAU,CAAC,CAAC,CAAC,KAAK,EAAE,CAAC,QAAQ;YAAE,KAAK,EAAE,CAAC;IACrD,CAAC;IACD,8DAA8D;IAC9D,IAAI,OAAO,CAAC,UAAU,CAAC,OAAO,CAAC,MAAM,GAAG,CAAC,CAAC,KAAK,EAAE;QAAE,KAAK,EAAE,CAAC;IAC3D,OAAO,KAAK,CAAC;AACf,CAAC;AAED;;;;;;;;GAQG;AACH,SAAgB,oBAAoB,CAClC,GAAW,EACX,aAA0C;IAE1C,MAAM,OAAO,GAAG,IAAA,gCAAmB,EAAC,GAAG,CAAC,CAAC;IACzC,qEAAqE;IACrE,iEAAiE;IACjE,kEAAkE;IAClE,yBAAyB;IACzB,MAAM,QAAQ,GAAG,kBAAkB,CAAC,GAAG,CAAC,CAAC;IAEzC,6EAA6E;IAC7E,oEAAoE;IACpE,qEAAqE;IACrE,kEAAkE;IAClE,wEAAwE;IACxE,kEAAkE;IAClE,EAAE;IACF,oEAAoE;IACpE,mEAAmE;IACnE,+DAA+D;IAC/D,+DAA+D;IAC/D,iEAAiE;IACjE,gEAAgE;IAChE,oCAAoC;IACpC,MAAM,UAAU,GAAG,IAAA,mCAAe,EAAC,GAAG,CAAC,CAAC;IACxC,MAAM,mBAAmB,GAAG,IAAA,mCAAe,EAAC,GAAG,EAAE,EAAE,YAAY,EAAE,IAAI,EAAE,CAAC,CAAC;IACzE,MAAM,QAAQ,GAAG,mBAAmB,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC;IAE5E,6EAA6E;IAC7E,iEAAiE;IACjE,kEAAkE;IAClE,sEAAsE;IACtE,MAAM,aAAa,GAA2C,EAAE,CAAC;IACjE,KAAK,MAAM,OAAO,IAAI,UAAU,EAAE,CAAC;QACjC,IAAI,OAAe,CAAC;QACpB,IAAI,CAAC;YACH,OAAO,GAAG,EAAE,CAAC,YAAY,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,OAAO,CAAC,EAAE,OAAO,CAAC,CAAC;QAC9D,CAAC;QAAC,MAAM,CAAC;YACP,SAAS;QACX,CAAC;QACD,aAAa,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,OAAO,EAAE,KAAK,EAAE,SAAS,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC;IACnE,CAAC;IACD,IAAI,UAAU,GAAG,CAAC,CAAC;IACnB,IAAI,gBAAgB,GAAG,CAAC,CAAC;IACzB,IAAI,eAAe,GAAG,EAAE,CAAC;IACzB,IAAI,iBAAiB,GAAG,CAAC,CAAC;IAC1B,KAAK,MAAM,CAAC,IAAI,aAAa,EAAE,CAAC;QAC9B,UAAU,IAAI,CAAC,CAAC,KAAK,CAAC;QACtB,IAAI,CAAC,CAAC,KAAK,GAAG,gBAAgB,EAAE,CAAC;YAC/B,gBAAgB,GAAG,CAAC,CAAC,KAAK,CAAC;YAC3B,eAAe,GAAG,CAAC,CAAC,IAAI,CAAC;QAC3B,CAAC;QACD,IAAI,CAAC,CAAC,KAAK,GAAG,GAAG;YAAE,iBAAiB,EAAE,CAAC;IACzC,CAAC;IACD,MAAM,WAAW,GAAG,UAAU,CAAC,MAAM,CAAC;IACtC,MAAM,YAAY,GAAG,CAAC,GAAG,aAAa,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,KAAK,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;IAEvF,6EAA6E;IAC7E,kEAAkE;IAClE,qDAAqD;IACrD,EAAE;IACF,sEAAsE;IACtE,qEAAqE;IACrE,kEAAkE;IAClE,0DAA0D;IAC1D,MAAM,eAAe,GAAG,IAAA,wCAAqB,EAAC,GAAG,CAAC,CAAC,KAAK,CAAC;IAEzD,iCAAiC;IACjC,MAAM,OAAO,GAAG,IAAA,mCAAe,EAAC,GAAG,EAAE;QACnC,UAAU,EAAE,CAAC,KAAK,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,CAAC;QAC1C,YAAY,EAAE,IAAI;KACnB,CAAC,CAAC;IACH,kBAAkB;IAClB,MAAM,YAAY,GAAG,IAAA,oCAAgB,EAAC,GAAG,EAAE,OAAO,EAAE,CAAC,OAAO,CAAC,EAAE,EAAE,YAAY,EAAE,IAAI,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,UAAU;IAExG,6EAA6E;IAC7E,oDAAoD;IACpD,MAAM,YAAY,GAAG,IAAA,mBAAU,EAAC,QAAQ,EAAE,WAAW,EAAE,WAAW,CAAC,CAAC;IACpE,MAAM,WAAW,GACf,QAAQ,CAAC,IAAA,YAAG,EAAC,gDAAgD,EAAE,QAAQ,CAAC,CAAC,IAAI,CAAC,CAAC;IACjF,kEAAkE;IAClE,oEAAoE;IACpE,uEAAuE;IACvE,MAAM,kBAAkB,GAAG,IAAA,iCAAqB,GAAE,CAAC;IACnD,MAAM,eAAe,GACnB,kBAAkB,CAAC,MAAM,GAAG,CAAC;QAC3B,CAAC,CAAC,IAAA,oCAAgB,EAAC,GAAG,EAAE,UAAU,EAAE,kBAAkB,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,CAAC,CAAC,KAAK;QAChF,CAAC,CAAC,CAAC,CAAC;IACR,MAAM,YAAY,GAAG,IAAA,mBAAU,EAC7B,QAAQ,EACR,cAAc,EACd,cAAc,EACd,cAAc,EACd,cAAc,CACf,CAAC;IACF,MAAM,qBAAqB,GAAG,IAAA,mBAAU,EAAC,QAAQ,EAAE,iBAAiB,EAAE,OAAO,EAAE,MAAM,EAAE,MAAM,CAAC,CAAC;IAC/F,MAAM,kBAAkB,GAAG,IAAA,mBAAU,EAAC,QAAQ,EAAE,iBAAiB,CAAC,CAAC;IACnE,MAAM,eAAe,GAAG,IAAA,mBAAU,EAAC,QAAQ,EAAE,cAAc,EAAE,YAAY,CAAC,CAAC;IAE3E,6EAA6E;IAC7E,wEAAwE;IACxE,sEAAsE;IACtE,sDAAsD;IACtD,MAAM,SAAS,GAAG,IAAA,mCAAe,EAAC,GAAG,EAAE;QACrC,UAAU,EAAE,CAAC,KAAK,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,KAAK,CAAC;QACjD,YAAY,EAAE,IAAI;KACnB,CAAC,CAAC;IACH,MAAM,SAAS,GAAG,IAAA,oCAAgB,EAAC,GAAG,EAAE,SAAS,EAAE,CAAC,YAAY,CAAC,EAAE;QACjE,YAAY,EAAE,IAAI;KACnB,CAAC,CAAC,KAAK,CAAC;IAET,MAAM,eAAe,GAAG,IAAA,mBAAU,EAChC,iDAAiD,OAAO,cAAc,EACtE,GAAG,CACJ,CAAC;IACF,MAAM,aAAa,GAAG,IAAA,mBAAU,EAAC,sCAAsC,EAAE,GAAG,CAAC,CAAC;IAC9E,qEAAqE;IACrE,8DAA8D;IAC9D,iEAAiE;IACjE,oCAAoC;IACpC,MAAM,iBAAiB,GAAG,IAAA,gCAAoB,GAAE,CAAC;IACjD,MAAM,gBAAgB,GACpB,iBAAiB,CAAC,MAAM,GAAG,CAAC;QAC1B,CAAC,CAAC,IAAA,oCAAgB,EAAC,GAAG,EAAE,UAAU,EAAE,iBAAiB,EAAE,EAAE,YAAY,EAAE,IAAI,EAAE,CAAC,CAAC,KAAK;QACpF,CAAC,CAAC,CAAC,CAAC;IAER,8EAA8E;IAC9E,iEAAiE;IACjE,sEAAsE;IACtE,oEAAoE;IACpE,sEAAsE;IACtE,qEAAqE;IACrE,oEAAoE;IACpE,oEAAoE;IACpE,qEAAqE;IACrE,oEAAoE;IACpE,sBAAsB;IACtB,MAAM,KAAK,GAAG,aAAa,IAAK,EAAiC,CAAC;IAClE,MAAM,YAAY,GAAG,IAAA,oCAAwB,EAAC,KAAK,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC,CAAC;IACjF,MAAM,UAAU,GAAG,IAAA,yBAAa,EAAC,KAAK,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC,CAAC;IACpE,MAAM,UAAU,GAAG,IAAA,yBAAa,EAAC,KAAK,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC,CAAC;IACpE,MAAM,UAAU,GAAG,CAAC,CAAS,EAAE,OAAiB,EAAW,EAAE;QAC3D,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC;YAAE,OAAO,KAAK,CAAC;QACvC,MAAM,KAAK,GAAG,CAAC,CAAC,WAAW,EAAE,CAAC;QAC9B,KAAK,MAAM,CAAC,IAAI,OAAO,EAAE,CAAC;YACxB,IAAI,KAAK,CAAC,QAAQ,CAAC,CAAC,CAAC;gBAAE,OAAO,IAAI,CAAC;QACrC,CAAC;QACD,OAAO,KAAK,CAAC;IACf,CAAC,CAAC;IACF,IAAI,WAAW,GAAG,CAAC,CAAC;IACpB,IAAI,iBAAiB,GAAG,CAAC,CAAC;IAC1B,IAAI,MAAM,GAAG,CAAC,CAAC;IACf,KAAK,MAAM,GAAG,IAAI,UAAU,EAAE,CAAC;QAC7B,oEAAoE;QACpE,kEAAkE;QAClE,qEAAqE;QACrE,MAAM,QAAQ,GAAG,GAAG,GAAG,GAAG,CAAC;QAC3B,IAAI,UAAU,CAAC,QAAQ,EAAE,YAAY,CAAC;YAAE,WAAW,EAAE,CAAC;QACtD,IAAI,UAAU,CAAC,QAAQ,EAAE,UAAU,CAAC;YAAE,iBAAiB,EAAE,CAAC;QAC1D,IAAI,UAAU,CAAC,QAAQ,EAAE,UAAU,CAAC;YAAE,MAAM,EAAE,CAAC;IACjD,CAAC;IACD,MAAM,WAAW,GAAG,IAAA,mBAAU,EAAC,kBAAkB,OAAO,cAAc,EAAE,GAAG,CAAC,CAAC;IAE7E,6EAA6E;IAC7E,MAAM,aAAa,GAAG,IAAA,mBAAU,EAC9B,oIAAoI,EACpI,QAAQ,CACT,CAAC;IACF,MAAM,iBAAiB,GAAG,IAAA,mBAAU,EAClC,kGAAkG,EAClG,QAAQ,CACT,CAAC;IACF,MAAM,oBAAoB,GAAG,IAAA,mBAAU,EACrC,wEAAwE,EACxE,QAAQ,CACT,CAAC;IACF,MAAM,cAAc,GAAG,IAAA,mBAAU,EAAC,QAAQ,EAAE,UAAU,EAAE,UAAU,EAAE,cAAc,CAAC,CAAC;IACpF,MAAM,gBAAgB,GAAG,IAAA,mBAAU,EAAC,QAAQ,EAAE,cAAc,EAAE,aAAa,EAAE,eAAe,CAAC,CAAC;IAC9F,MAAM,oBAAoB,GAAG,IAAA,mBAAU,EACrC,QAAQ,EACR,QAAQ,EACR,aAAa,EACb,OAAO,EACP,YAAY,EACZ,gBAAgB,EAChB,gBAAgB,EAChB,kBAAkB,EAClB,kBAAkB,EAClB,aAAa,EACb,WAAW,EACX,YAAY,CACb,CAAC;IAEF,OAAO;QACL,WAAW;QACX,SAAS,EAAE,QAAQ,CAAC,MAAM;QAC1B,UAAU;QACV,oBAAoB;QACpB,iBAAiB;QACjB,gBAAgB;QAChB,eAAe;QACf,YAAY;QACZ,eAAe;QACf,YAAY;QACZ,YAAY;QACZ,WAAW;QACX,eAAe;QACf,YAAY;QACZ,qBAAqB;QACrB,kBAAkB;QAClB,eAAe;QACf,SAAS;QACT,eAAe;QACf,aAAa;QACb,gBAAgB;QAChB,WAAW;QACX,MAAM;QACN,iBAAiB;QACjB,WAAW;QACX,aAAa;QACb,iBAAiB;QACjB,oBAAoB;QACpB,cAAc;QACd,gBAAgB;QAChB,SAAS,EAAE,CAAC,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,KAAK,CAAC;QACxC,gBAAgB,EAAE,EAAE;KACrB,CAAC;AACJ,CAAC"}
+{"version":3,"file":"generic.js","sourceRoot":"","sources":["../../../src/analyzers/tools/generic.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AA+EA,oDAyOC;AAhTD,qCAAuD;AACvD,6CAAmD;AACnD,2DAAwE;AACxE,yDAA2D;AAC3D,+CAMyB;AACzB,uCAAyB;AACzB,2CAA6B;AAE7B,wEAAwE;AACxE,uEAAuE;AACvE,gEAAgE;AAChE,qEAAqE;AACrE,gEAAgE;AAChE,6DAA6D;AAC7D,oEAAoE;AACpE,EAAE;AACF,kEAAkE;AAClE,iEAAiE;AACjE,6DAA6D;AAC7D,qCAAqC;AAErC;;;;;;;;;;;;;GAaG;AACH,SAAS,kBAAkB,CAAC,GAAW;IACrC,MAAM,GAAG,GAAG,IAAA,YAAG,EAAC,2CAA2C,EAAE,GAAG,CAAC,CAAC,IAAI,EAAE,CAAC;IACzE,OAAO,GAAG,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC;AACpC,CAAC;AAED;;;;GAIG;AACH,SAAS,SAAS,CAAC,OAAe;IAChC,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,CAAC,CAAC;IACnC,IAAI,KAAK,GAAG,CAAC,CAAC;IACd,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QACxC,IAAI,OAAO,CAAC,UAAU,CAAC,CAAC,CAAC,KAAK,EAAE,CAAC,QAAQ;YAAE,KAAK,EAAE,CAAC;IACrD,CAAC;IACD,8DAA8D;IAC9D,IAAI,OAAO,CAAC,UAAU,CAAC,OAAO,CAAC,MAAM,GAAG,CAAC,CAAC,KAAK,EAAE;QAAE,KAAK,EAAE,CAAC;IAC3D,OAAO,KAAK,CAAC;AACf,CAAC;AAED;;;;;;;;GAQG;AACH,SAAgB,oBAAoB,CAClC,GAAW,EACX,aAA0C;IAE1C,MAAM,OAAO,GAAG,IAAA,gCAAmB,EAAC,GAAG,CAAC,CAAC;IACzC,qEAAqE;IACrE,iEAAiE;IACjE,kEAAkE;IAClE,yBAAyB;IACzB,MAAM,QAAQ,GAAG,kBAAkB,CAAC,GAAG,CAAC,CAAC;IAEzC,6EAA6E;IAC7E,oEAAoE;IACpE,qEAAqE;IACrE,kEAAkE;IAClE,wEAAwE;IACxE,kEAAkE;IAClE,EAAE;IACF,oEAAoE;IACpE,mEAAmE;IACnE,+DAA+D;IAC/D,+DAA+D;IAC/D,iEAAiE;IACjE,gEAAgE;IAChE,oCAAoC;IACpC,MAAM,UAAU,GAAG,IAAA,mCAAe,EAAC,GAAG,CAAC,CAAC;IACxC,MAAM,mBAAmB,GAAG,IAAA,mCAAe,EAAC,GAAG,EAAE,EAAE,YAAY,EAAE,IAAI,EAAE,CAAC,CAAC;IACzE,MAAM,QAAQ,GAAG,mBAAmB,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC;IAE5E,6EAA6E;IAC7E,iEAAiE;IACjE,kEAAkE;IAClE,sEAAsE;IACtE,MAAM,aAAa,GAA2C,EAAE,CAAC;IACjE,KAAK,MAAM,OAAO,IAAI,UAAU,EAAE,CAAC;QACjC,IAAI,OAAe,CAAC;QACpB,IAAI,CAAC;YACH,OAAO,GAAG,EAAE,CAAC,YAAY,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,OAAO,CAAC,EAAE,OAAO,CAAC,CAAC;QAC9D,CAAC;QAAC,MAAM,CAAC;YACP,SAAS;QACX,CAAC;QACD,aAAa,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,OAAO,EAAE,KAAK,EAAE,SAAS,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC;IACnE,CAAC;IACD,IAAI,UAAU,GAAG,CAAC,CAAC;IACnB,IAAI,gBAAgB,GAAG,CAAC,CAAC;IACzB,IAAI,eAAe,GAAG,EAAE,CAAC;IACzB,IAAI,iBAAiB,GAAG,CAAC,CAAC;IAC1B,KAAK,MAAM,CAAC,IAAI,aAAa,EAAE,CAAC;QAC9B,UAAU,IAAI,CAAC,CAAC,KAAK,CAAC;QACtB,IAAI,CAAC,CAAC,KAAK,GAAG,gBAAgB,EAAE,CAAC;YAC/B,gBAAgB,GAAG,CAAC,CAAC,KAAK,CAAC;YAC3B,eAAe,GAAG,CAAC,CAAC,IAAI,CAAC;QAC3B,CAAC;QACD,IAAI,CAAC,CAAC,KAAK,GAAG,GAAG;YAAE,iBAAiB,EAAE,CAAC;IACzC,CAAC;IACD,MAAM,WAAW,GAAG,UAAU,CAAC,MAAM,CAAC;IACtC,6DAA6D;IAC7D,6DAA6D;IAC7D,iEAAiE;IACjE,4DAA4D;IAC5D,wDAAwD;IACxD,MAAM,YAAY,GAAG,aAAa,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,KAAK,GAAG,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,KAAK,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC;IAElG,6EAA6E;IAC7E,kEAAkE;IAClE,qDAAqD;IACrD,EAAE;IACF,sEAAsE;IACtE,qEAAqE;IACrE,kEAAkE;IAClE,0DAA0D;IAC1D,MAAM,eAAe,GAAG,IAAA,wCAAqB,EAAC,GAAG,CAAC,CAAC,KAAK,CAAC;IAEzD,iCAAiC;IACjC,MAAM,OAAO,GAAG,IAAA,mCAAe,EAAC,GAAG,EAAE;QACnC,UAAU,EAAE,CAAC,KAAK,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,CAAC;QAC1C,YAAY,EAAE,IAAI;KACnB,CAAC,CAAC;IACH,kBAAkB;IAClB,MAAM,YAAY,GAAG,IAAA,oCAAgB,EAAC,GAAG,EAAE,OAAO,EAAE,CAAC,OAAO,CAAC,EAAE,EAAE,YAAY,EAAE,IAAI,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,UAAU;IAExG,6EAA6E;IAC7E,oDAAoD;IACpD,MAAM,YAAY,GAAG,IAAA,mBAAU,EAAC,QAAQ,EAAE,WAAW,EAAE,WAAW,CAAC,CAAC;IACpE,MAAM,WAAW,GACf,QAAQ,CAAC,IAAA,YAAG,EAAC,gDAAgD,EAAE,QAAQ,CAAC,CAAC,IAAI,CAAC,CAAC;IACjF,kEAAkE;IAClE,oEAAoE;IACpE,uEAAuE;IACvE,MAAM,kBAAkB,GAAG,IAAA,iCAAqB,GAAE,CAAC;IACnD,MAAM,eAAe,GACnB,kBAAkB,CAAC,MAAM,GAAG,CAAC;QAC3B,CAAC,CAAC,IAAA,oCAAgB,EAAC,GAAG,EAAE,UAAU,EAAE,kBAAkB,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,CAAC,CAAC,KAAK;QAChF,CAAC,CAAC,CAAC,CAAC;IACR,MAAM,YAAY,GAAG,IAAA,mBAAU,EAC7B,QAAQ,EACR,cAAc,EACd,cAAc,EACd,cAAc,EACd,cAAc,CACf,CAAC;IACF,MAAM,qBAAqB,GAAG,IAAA,mBAAU,EAAC,QAAQ,EAAE,iBAAiB,EAAE,OAAO,EAAE,MAAM,EAAE,MAAM,CAAC,CAAC;IAC/F,MAAM,kBAAkB,GAAG,IAAA,mBAAU,EAAC,QAAQ,EAAE,iBAAiB,CAAC,CAAC;IACnE,MAAM,eAAe,GAAG,IAAA,mBAAU,EAAC,QAAQ,EAAE,cAAc,EAAE,YAAY,CAAC,CAAC;IAE3E,6EAA6E;IAC7E,wEAAwE;IACxE,sEAAsE;IACtE,sDAAsD;IACtD,MAAM,SAAS,GAAG,IAAA,mCAAe,EAAC,GAAG,EAAE;QACrC,UAAU,EAAE,CAAC,KAAK,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,KAAK,CAAC;QACjD,YAAY,EAAE,IAAI;KACnB,CAAC,CAAC;IACH,MAAM,SAAS,GAAG,IAAA,oCAAgB,EAAC,GAAG,EAAE,SAAS,EAAE,CAAC,YAAY,CAAC,EAAE;QACjE,YAAY,EAAE,IAAI;KACnB,CAAC,CAAC,KAAK,CAAC;IAET,MAAM,eAAe,GAAG,IAAA,mBAAU,EAChC,iDAAiD,OAAO,cAAc,EACtE,GAAG,CACJ,CAAC;IACF,MAAM,aAAa,GAAG,IAAA,mBAAU,EAAC,sCAAsC,EAAE,GAAG,CAAC,CAAC;IAC9E,qEAAqE;IACrE,8DAA8D;IAC9D,iEAAiE;IACjE,oCAAoC;IACpC,MAAM,iBAAiB,GAAG,IAAA,gCAAoB,GAAE,CAAC;IACjD,MAAM,gBAAgB,GACpB,iBAAiB,CAAC,MAAM,GAAG,CAAC;QAC1B,CAAC,CAAC,IAAA,oCAAgB,EAAC,GAAG,EAAE,UAAU,EAAE,iBAAiB,EAAE,EAAE,YAAY,EAAE,IAAI,EAAE,CAAC,CAAC,KAAK;QACpF,CAAC,CAAC,CAAC,CAAC;IAER,8EAA8E;IAC9E,iEAAiE;IACjE,sEAAsE;IACtE,oEAAoE;IACpE,sEAAsE;IACtE,qEAAqE;IACrE,oEAAoE;IACpE,oEAAoE;IACpE,qEAAqE;IACrE,oEAAoE;IACpE,sBAAsB;IACtB,MAAM,KAAK,GAAG,aAAa,IAAK,EAAiC,CAAC;IAClE,MAAM,YAAY,GAAG,IAAA,oCAAwB,EAAC,KAAK,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC,CAAC;IACjF,MAAM,UAAU,GAAG,IAAA,yBAAa,EAAC,KAAK,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC,CAAC;IACpE,MAAM,UAAU,GAAG,IAAA,yBAAa,EAAC,KAAK,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC,CAAC;IACpE,MAAM,UAAU,GAAG,CAAC,CAAS,EAAE,OAAiB,EAAW,EAAE;QAC3D,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC;YAAE,OAAO,KAAK,CAAC;QACvC,MAAM,KAAK,GAAG,CAAC,CAAC,WAAW,EAAE,CAAC;QAC9B,KAAK,MAAM,CAAC,IAAI,OAAO,EAAE,CAAC;YACxB,IAAI,KAAK,CAAC,QAAQ,CAAC,CAAC,CAAC;gBAAE,OAAO,IAAI,CAAC;QACrC,CAAC;QACD,OAAO,KAAK,CAAC;IACf,CAAC,CAAC;IACF,IAAI,WAAW,GAAG,CAAC,CAAC;IACpB,IAAI,iBAAiB,GAAG,CAAC,CAAC;IAC1B,IAAI,MAAM,GAAG,CAAC,CAAC;IACf,KAAK,MAAM,GAAG,IAAI,UAAU,EAAE,CAAC;QAC7B,oEAAoE;QACpE,kEAAkE;QAClE,qEAAqE;QACrE,MAAM,QAAQ,GAAG,GAAG,GAAG,GAAG,CAAC;QAC3B,IAAI,UAAU,CAAC,QAAQ,EAAE,YAAY,CAAC;YAAE,WAAW,EAAE,CAAC;QACtD,IAAI,UAAU,CAAC,QAAQ,EAAE,UAAU,CAAC;YAAE,iBAAiB,EAAE,CAAC;QAC1D,IAAI,UAAU,CAAC,QAAQ,EAAE,UAAU,CAAC;YAAE,MAAM,EAAE,CAAC;IACjD,CAAC;IACD,MAAM,WAAW,GAAG,IAAA,mBAAU,EAAC,kBAAkB,OAAO,cAAc,EAAE,GAAG,CAAC,CAAC;IAE7E,6EAA6E;IAC7E,MAAM,aAAa,GAAG,IAAA,mBAAU,EAC9B,oIAAoI,EACpI,QAAQ,CACT,CAAC;IACF,MAAM,iBAAiB,GAAG,IAAA,mBAAU,EAClC,kGAAkG,EAClG,QAAQ,CACT,CAAC;IACF,MAAM,oBAAoB,GAAG,IAAA,mBAAU,EACrC,wEAAwE,EACxE,QAAQ,CACT,CAAC;IACF,MAAM,cAAc,GAAG,IAAA,mBAAU,EAAC,QAAQ,EAAE,UAAU,EAAE,UAAU,EAAE,cAAc,CAAC,CAAC;IACpF,MAAM,gBAAgB,GAAG,IAAA,mBAAU,EAAC,QAAQ,EAAE,cAAc,EAAE,aAAa,EAAE,eAAe,CAAC,CAAC;IAC9F,MAAM,oBAAoB,GAAG,IAAA,mBAAU,EACrC,QAAQ,EACR,QAAQ,EACR,aAAa,EACb,OAAO,EACP,YAAY,EACZ,gBAAgB,EAChB,gBAAgB,EAChB,kBAAkB,EAClB,kBAAkB,EAClB,aAAa,EACb,WAAW,EACX,YAAY,CACb,CAAC;IAEF,OAAO;QACL,WAAW;QACX,SAAS,EAAE,QAAQ,CAAC,MAAM;QAC1B,UAAU;QACV,oBAAoB;QACpB,iBAAiB;QACjB,gBAAgB;QAChB,eAAe;QACf,YAAY;QACZ,eAAe;QACf,YAAY;QACZ,YAAY;QACZ,WAAW;QACX,eAAe;QACf,YAAY;QACZ,qBAAqB;QACrB,kBAAkB;QAClB,eAAe;QACf,SAAS;QACT,eAAe;QACf,aAAa;QACb,gBAAgB;QAChB,WAAW;QACX,MAAM;QACN,iBAAiB;QACjB,WAAW;QACX,aAAa;QACb,iBAAiB;QACjB,oBAAoB;QACpB,cAAc;QACd,gBAAgB;QAChB,SAAS,EAAE,CAAC,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,KAAK,CAAC;QACxC,gBAAgB,EAAE,EAAE;KACrB,CAAC;AACJ,CAAC"}

package/dist/analyzers/tools/gitleaks.d.ts

@@ -1,16 +1,39 @@
 import type { CapabilityProvider } from '../../languages/capabilities/provider';
 import type { SecretsResult } from '../../languages/capabilities/types';
+/**
+ * Per-finding raw value carried alongside the public envelope. Stays
+ * out of `SecretsResult` (and therefore out of `SecurityAggregate`,
+ * `SecurityReport`, the dashboard, JSON outputs) so the secret value
+ * never leaks through the normal reporting surfaces. The only legit
+ * consumer is the baseline-side secret-HMAC producer, which immediately
+ * HMACs the value and discards it.
+ *
+ * Lives in this outcome rather than fetched separately so the memoized
+ * gitleaks invocation (`gatherGitleaksResult` runs at most once per
+ * cwd) covers both the public envelope path and the HMAC path.
+ */
+export interface GitleaksRawSecret {
+    readonly file: string;
+    readonly line: number;
+    readonly rule: string;
+    /** The matched secret value as reported by gitleaks. Process-only;
+     *  callers MUST NOT write this to disk, log it, or include it in
+     *  any output payload. */
+    readonly secret: string;
+}
 /**
  * Outcome union used by `gatherGitleaksResult`. The capability provider
  * collapses this to `SecretsResult | null`; the Layer 2 reshape in
  * `tools/parallel.ts` reads `unavailable.reason` so the
  * `toolsUnavailable` strings carry install-missing vs parse-failure
- * detail.
+ * detail. The `rawSecrets` field is read only by the baseline-side
+ * secret-HMAC producer; other consumers ignore it.
  */
 export type SecretsGatherOutcome = {
     kind: 'success';
     envelope: SecretsResult;
     suppressedCount: number;
+    rawSecrets: ReadonlyArray<GitleaksRawSecret>;
 } | {
     kind: 'unavailable';
     reason: string;

package/dist/analyzers/tools/gitleaks.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"gitleaks.d.ts","sourceRoot":"","sources":["../../../src/analyzers/tools/gitleaks.ts"],"names":[],"mappings":"AAgBA,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,uCAAuC,CAAC;AAChF,OAAO,KAAK,EAAiB,aAAa,EAAE,MAAM,oCAAoC,CAAC;AAUvF;;;;;;GAMG;AACH,MAAM,MAAM,oBAAoB,GAC5B;IAAE,IAAI,EAAE,SAAS,CAAC;IAAC,QAAQ,EAAE,aAAa,CAAC;IAAC,eAAe,EAAE,MAAM,CAAA;CAAE,GACrE;IAAE,IAAI,EAAE,aAAa,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAE,CAAC;AAgB5C;;;;;GAKG;AACH,wBAAgB,oBAAoB,CAAC,GAAG,EAAE,MAAM,GAAG,oBAAoB,CAMtE;AA6ED;;;;GAIG;AACH,eAAO,MAAM,gBAAgB,EAAE,kBAAkB,CAAC,aAAa,CAM9D,CAAC"}
+{"version":3,"file":"gitleaks.d.ts","sourceRoot":"","sources":["../../../src/analyzers/tools/gitleaks.ts"],"names":[],"mappings":"AAgBA,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,uCAAuC,CAAC;AAChF,OAAO,KAAK,EAAiB,aAAa,EAAE,MAAM,oCAAoC,CAAC;AAUvF;;;;;;;;;;;GAWG;AACH,MAAM,WAAW,iBAAiB;IAChC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB;;8BAE0B;IAC1B,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;CACzB;AAED;;;;;;;GAOG;AACH,MAAM,MAAM,oBAAoB,GAC5B;IACE,IAAI,EAAE,SAAS,CAAC;IAChB,QAAQ,EAAE,aAAa,CAAC;IACxB,eAAe,EAAE,MAAM,CAAC;IACxB,UAAU,EAAE,aAAa,CAAC,iBAAiB,CAAC,CAAC;CAC9C,GACD;IAAE,IAAI,EAAE,aAAa,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAE,CAAC;AAgB5C;;;;;GAKG;AACH,wBAAgB,oBAAoB,CAAC,GAAG,EAAE,MAAM,GAAG,oBAAoB,CAMtE;AA0FD;;;;GAIG;AACH,eAAO,MAAM,gBAAgB,EAAE,kBAAkB,CAAC,aAAa,CAM9D,CAAC"}