@vyuhlabs/dxkit 2.4.7 → 2.5.0

package/dist/baseline/content-hash.d.ts

@@ -0,0 +1,83 @@
+/**
+ * Content-hash identity — drift-tolerant matching via the actual
+ * source code around a finding rather than its line position.
+ *
+ * The line-bucket identity scheme tolerates ±2 lines of drift; the
+ * git-aware matcher tolerates any line shift git can describe.
+ * Neither helps when git history is unavailable (shallow clone,
+ * force-pushed baseline commit) or when the line-bucket boundary
+ * straddles a context-stable region. The content-hash layer is the
+ * third fallback: pair findings whose surrounding code is byte-
+ * identical, regardless of where in the file they live.
+ *
+ * Pipeline:
+ *
+ *   1. The producer (Phase 3 baseline-create) reads each finding's
+ *      surrounding context lines, normalizes whitespace, and
+ *      computes a SHA-1[0:16] hash. The hash is stamped on the
+ *      finding entry in the baseline file.
+ *   2. At guardrail-check time, the current scan computes content
+ *      hashes the same way for its own findings.
+ *   3. The matcher's content-hash pass pairs prior + current
+ *      findings with matching `(canonical-rule, contentHash)` after
+ *      location-based pairing has exhausted what git can do.
+ *
+ * Trade-offs vs. line-bucket / git-aware match:
+ *
+ *   - Survives any vertical drift (the line number is irrelevant).
+ *   - Survives file rename + reformat + cross-file refactor when
+ *     the immediate context survives.
+ *   - Fails when the surrounding context changes — even a single
+ *     adjacent variable rename invalidates the hash.
+ *   - Vulnerable to collisions when two findings have identical
+ *     context (rare for code-pattern findings, more likely for
+ *     hygiene markers in similar boilerplate).
+ *
+ * The matcher tags content-hash matches with confidence 0.80 — below
+ * git-line-fuzz (0.88) so the brownfield policy's per-severity
+ * thresholds naturally distinguish them. For low-severity findings
+ * (threshold 0.90 by default), a content-hash match demotes to
+ * `'uncertain'` rather than silently pairing; for critical findings
+ * (threshold 0.75), the same match passes through cleanly.
+ */
+/**
+ * Width of the context window read on each side of the finding's
+ * reported line. Three lines above + three lines below + the line
+ * itself = a seven-line window that captures the immediate
+ * surrounding code without being so wide that unrelated edits
+ * invalidate the hash.
+ */
+export declare const CONTENT_HASH_CONTEXT_LINES = 3;
+/**
+ * Pure function: compute the content hash for a finding at `line`
+ * inside `fileContent`. Whitespace is normalized — trailing
+ * whitespace stripped, internal runs collapsed to a single space,
+ * empty lines preserved as empty — so reformat-only edits don't
+ * churn the hash.
+ *
+ * `line` is 1-based to match every other dxkit line-number contract.
+ * `contextLines` defaults to `CONTENT_HASH_CONTEXT_LINES`. Lines
+ * before the start of the file or past the end are clamped (the
+ * window is smaller near the file edges; that's fine — hashing a
+ * shorter window is still deterministic).
+ */
+export declare function computeContentHash(fileContent: string, line: number, contextLines?: number): string;
+/**
+ * Read a file's content at a specific commit. Returns null when git
+ * can't resolve the path-at-commit pair — file didn't exist at
+ * `sha`, file is binary, sha is unreachable. Callers treat null
+ * the same as "content-hash unavailable for this path."
+ *
+ * Uses `git show <sha>:<path>` which does not require checking out
+ * the commit — safe to call repeatedly in a tight loop without
+ * touching the working tree.
+ */
+export declare function readFileFromCommit(cwd: string, sha: string, file: string): string | null;
+/**
+ * Combined helper: read the file at a commit and compute its
+ * content hash at the given line. Returns null when the file
+ * couldn't be read. Used by the producer (Phase 3 baseline-create)
+ * to stamp content hashes on baseline entries.
+ */
+export declare function computeContentHashFromCommit(cwd: string, sha: string, file: string, line: number, contextLines?: number): string | null;
+//# sourceMappingURL=content-hash.d.ts.map

package/dist/baseline/content-hash.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"content-hash.d.ts","sourceRoot":"","sources":["../../src/baseline/content-hash.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAyCG;AAKH;;;;;;GAMG;AACH,eAAO,MAAM,0BAA0B,IAAI,CAAC;AAE5C;;;;;;;;;;;;GAYG;AACH,wBAAgB,kBAAkB,CAChC,WAAW,EAAE,MAAM,EACnB,IAAI,EAAE,MAAM,EACZ,YAAY,GAAE,MAAmC,GAChD,MAAM,CAOR;AAaD;;;;;;;;;GASG;AACH,wBAAgB,kBAAkB,CAAC,GAAG,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAiBxF;AAED;;;;;GAKG;AACH,wBAAgB,4BAA4B,CAC1C,GAAG,EAAE,MAAM,EACX,GAAG,EAAE,MAAM,EACX,IAAI,EAAE,MAAM,EACZ,IAAI,EAAE,MAAM,EACZ,YAAY,GAAE,MAAmC,GAChD,MAAM,GAAG,IAAI,CAIf"}

package/dist/baseline/content-hash.js

@@ -0,0 +1,131 @@
+"use strict";
+/**
+ * Content-hash identity — drift-tolerant matching via the actual
+ * source code around a finding rather than its line position.
+ *
+ * The line-bucket identity scheme tolerates ±2 lines of drift; the
+ * git-aware matcher tolerates any line shift git can describe.
+ * Neither helps when git history is unavailable (shallow clone,
+ * force-pushed baseline commit) or when the line-bucket boundary
+ * straddles a context-stable region. The content-hash layer is the
+ * third fallback: pair findings whose surrounding code is byte-
+ * identical, regardless of where in the file they live.
+ *
+ * Pipeline:
+ *
+ *   1. The producer (Phase 3 baseline-create) reads each finding's
+ *      surrounding context lines, normalizes whitespace, and
+ *      computes a SHA-1[0:16] hash. The hash is stamped on the
+ *      finding entry in the baseline file.
+ *   2. At guardrail-check time, the current scan computes content
+ *      hashes the same way for its own findings.
+ *   3. The matcher's content-hash pass pairs prior + current
+ *      findings with matching `(canonical-rule, contentHash)` after
+ *      location-based pairing has exhausted what git can do.
+ *
+ * Trade-offs vs. line-bucket / git-aware match:
+ *
+ *   - Survives any vertical drift (the line number is irrelevant).
+ *   - Survives file rename + reformat + cross-file refactor when
+ *     the immediate context survives.
+ *   - Fails when the surrounding context changes — even a single
+ *     adjacent variable rename invalidates the hash.
+ *   - Vulnerable to collisions when two findings have identical
+ *     context (rare for code-pattern findings, more likely for
+ *     hygiene markers in similar boilerplate).
+ *
+ * The matcher tags content-hash matches with confidence 0.80 — below
+ * git-line-fuzz (0.88) so the brownfield policy's per-severity
+ * thresholds naturally distinguish them. For low-severity findings
+ * (threshold 0.90 by default), a content-hash match demotes to
+ * `'uncertain'` rather than silently pairing; for critical findings
+ * (threshold 0.75), the same match passes through cleanly.
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.CONTENT_HASH_CONTEXT_LINES = void 0;
+exports.computeContentHash = computeContentHash;
+exports.readFileFromCommit = readFileFromCommit;
+exports.computeContentHashFromCommit = computeContentHashFromCommit;
+const crypto_1 = require("crypto");
+const child_process_1 = require("child_process");
+/**
+ * Width of the context window read on each side of the finding's
+ * reported line. Three lines above + three lines below + the line
+ * itself = a seven-line window that captures the immediate
+ * surrounding code without being so wide that unrelated edits
+ * invalidate the hash.
+ */
+exports.CONTENT_HASH_CONTEXT_LINES = 3;
+/**
+ * Pure function: compute the content hash for a finding at `line`
+ * inside `fileContent`. Whitespace is normalized — trailing
+ * whitespace stripped, internal runs collapsed to a single space,
+ * empty lines preserved as empty — so reformat-only edits don't
+ * churn the hash.
+ *
+ * `line` is 1-based to match every other dxkit line-number contract.
+ * `contextLines` defaults to `CONTENT_HASH_CONTEXT_LINES`. Lines
+ * before the start of the file or past the end are clamped (the
+ * window is smaller near the file edges; that's fine — hashing a
+ * shorter window is still deterministic).
+ */
+function computeContentHash(fileContent, line, contextLines = exports.CONTENT_HASH_CONTEXT_LINES) {
+    const lines = fileContent.split('\n');
+    const startIdx = Math.max(0, line - 1 - contextLines);
+    const endIdx = Math.min(lines.length, line + contextLines);
+    const window = lines.slice(startIdx, endIdx);
+    const normalized = window.map(normalizeLine).join('\n');
+    return (0, crypto_1.createHash)('sha1').update(normalized).digest('hex').slice(0, 16);
+}
+/**
+ * Collapse internal whitespace runs to a single space + strip
+ * leading / trailing whitespace. Tab vs spaces, mixed indentation,
+ * and trailing whitespace become equivalent. Empty lines pass
+ * through as empty (no normalization needed) so they preserve their
+ * position-information in the window.
+ */
+function normalizeLine(line) {
+    return line.replace(/\s+/g, ' ').trim();
+}
+/**
+ * Read a file's content at a specific commit. Returns null when git
+ * can't resolve the path-at-commit pair — file didn't exist at
+ * `sha`, file is binary, sha is unreachable. Callers treat null
+ * the same as "content-hash unavailable for this path."
+ *
+ * Uses `git show <sha>:<path>` which does not require checking out
+ * the commit — safe to call repeatedly in a tight loop without
+ * touching the working tree.
+ */
+function readFileFromCommit(cwd, sha, file) {
+    try {
+        return (0, child_process_1.execFileSync)('git', ['show', `${sha}:${file}`], {
+            cwd,
+            encoding: 'utf8',
+            // Cap output size — git show on a 100MB committed binary would
+            // otherwise blow the default stdio buffer. 10MB is generous for
+            // any real source file.
+            maxBuffer: 10 * 1024 * 1024,
+            // Silence the "fatal: path X does not exist" message git emits
+            // to stderr when the file/sha pair doesn't resolve. Callers
+            // expect a null return, not a stderr message bleeding through.
+            stdio: ['ignore', 'pipe', 'pipe'],
+        });
+    }
+    catch {
+        return null;
+    }
+}
+/**
+ * Combined helper: read the file at a commit and compute its
+ * content hash at the given line. Returns null when the file
+ * couldn't be read. Used by the producer (Phase 3 baseline-create)
+ * to stamp content hashes on baseline entries.
+ */
+function computeContentHashFromCommit(cwd, sha, file, line, contextLines = exports.CONTENT_HASH_CONTEXT_LINES) {
+    const content = readFileFromCommit(cwd, sha, file);
+    if (content === null)
+        return null;
+    return computeContentHash(content, line, contextLines);
+}
+//# sourceMappingURL=content-hash.js.map

package/dist/baseline/content-hash.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"content-hash.js","sourceRoot":"","sources":["../../src/baseline/content-hash.ts"],"names":[],"mappings":";AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAyCG;;;AA2BH,gDAWC;AAuBD,gDAiBC;AAQD,oEAUC;AA9FD,mCAAoC;AACpC,iDAA6C;AAE7C;;;;;;GAMG;AACU,QAAA,0BAA0B,GAAG,CAAC,CAAC;AAE5C;;;;;;;;;;;;GAYG;AACH,SAAgB,kBAAkB,CAChC,WAAmB,EACnB,IAAY,EACZ,eAAuB,kCAA0B;IAEjD,MAAM,KAAK,GAAG,WAAW,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;IACtC,MAAM,QAAQ,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,IAAI,GAAG,CAAC,GAAG,YAAY,CAAC,CAAC;IACtD,MAAM,MAAM,GAAG,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,MAAM,EAAE,IAAI,GAAG,YAAY,CAAC,CAAC;IAC3D,MAAM,MAAM,GAAG,KAAK,CAAC,KAAK,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC;IAC7C,MAAM,UAAU,GAAG,MAAM,CAAC,GAAG,CAAC,aAAa,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IACxD,OAAO,IAAA,mBAAU,EAAC,MAAM,CAAC,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;AAC1E,CAAC;AAED;;;;;;GAMG;AACH,SAAS,aAAa,CAAC,IAAY;IACjC,OAAO,IAAI,CAAC,OAAO,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC,IAAI,EAAE,CAAC;AAC1C,CAAC;AAED;;;;;;;;;GASG;AACH,SAAgB,kBAAkB,CAAC,GAAW,EAAE,GAAW,EAAE,IAAY;IACvE,IAAI,CAAC;QACH,OAAO,IAAA,4BAAY,EAAC,KAAK,EAAE,CAAC,MAAM,EAAE,GAAG,GAAG,IAAI,IAAI,EAAE,CAAC,EAAE;YACrD,GAAG;YACH,QAAQ,EAAE,MAAM;YAChB,+DAA+D;YAC/D,gEAAgE;YAChE,wBAAwB;YACxB,SAAS,EAAE,EAAE,GAAG,IAAI,GAAG,IAAI;YAC3B,+DAA+D;YAC/D,4DAA4D;YAC5D,+DAA+D;YAC/D,KAAK,EAAE,CAAC,QAAQ,EAAE,MAAM,EAAE,MAAM,CAAC;SAClC,CAAC,CAAC;IACL,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED;;;;;GAKG;AACH,SAAgB,4BAA4B,CAC1C,GAAW,EACX,GAAW,EACX,IAAY,EACZ,IAAY,EACZ,eAAuB,kCAA0B;IAEjD,MAAM,OAAO,GAAG,kBAAkB,CAAC,GAAG,EAAE,GAAG,EAAE,IAAI,CAAC,CAAC;IACnD,IAAI,OAAO,KAAK,IAAI;QAAE,OAAO,IAAI,CAAC;IAClC,OAAO,kBAAkB,CAAC,OAAO,EAAE,IAAI,EAAE,YAAY,CAAC,CAAC;AACzD,CAAC"}

package/dist/baseline/create.d.ts

@@ -0,0 +1,96 @@
+/**
+ * `dxkit baseline create` orchestrator.
+ *
+ * Builds the shared producer context (runs every analyzer once),
+ * dispatches through the canonical producer registry (CLAUDE.md
+ * Rule 10), captures repo + analysis-environment metadata, and
+ * writes the result to `.dxkit/baselines/<name>.json`. The on-disk
+ * file is the durable record subsequent `guardrail check` runs diff
+ * against.
+ *
+ * This module is the producer side; the matcher + classifier on the
+ * consumer side already exist in `git-aware-match.ts` and
+ * `policy.ts`. The two are connected by the file format defined in
+ * `baseline-file.ts`.
+ *
+ * Per-kind producer coverage + deferral rationale live in the
+ * registry index (`./producers/index.ts`) — the single discovery
+ * surface. Adding a new identity kind or analyzer means
+ * registering a producer there, never an edit here.
+ */
+import type { BaselineAnalysisMeta, BaselineFile, BaselineRepoState } from './baseline-file';
+import type { ProducerContext } from './producers';
+import type { SaltMode } from './salt';
+import type { BaselineEntry } from './types';
+import type { SecurityAggregate } from '../analyzers/security/aggregator';
+export interface CreateBaselineOptions {
+    /** Repo root to baseline. Caller should pass an absolute path. */
+    readonly cwd: string;
+    /** Baseline name (becomes the filename stem under `.dxkit/baselines/`).
+     *  Defaults to `'main'`. Different names allow per-branch / per-
+     *  environment baselines to coexist on disk. */
+    readonly name?: string;
+    /** When true, overwrite an existing baseline file at the same path.
+     *  When false (default), an existing file makes `createBaseline`
+     *  throw — guards against accidentally clobbering a committed
+     *  baseline with a fresh capture. */
+    readonly force?: boolean;
+    /** Forwarded to the underlying analyzer for per-tool timing logs. */
+    readonly verbose?: boolean;
+}
+export interface CreateBaselineResult {
+    readonly path: string;
+    readonly file: BaselineFile;
+}
+/**
+ * Test seam: clear the version cache between test runs so per-test
+ * fixtures don't leak resolutions into one another. Production
+ * callers never use this — the cache lives for the entire CLI
+ * invocation and dies with the process.
+ */
+export declare function clearToolVersionCache(): void;
+/**
+ * Snapshot of one analyzer run, in the exact shape the baseline file
+ * and the guardrail-check both need. Built by `gatherCurrentScan`
+ * once and consumed by either path.
+ *
+ * Why this is shared: the guardrail check re-runs every analyzer to
+ * produce the "current" side of the diff. Without a shared step, the
+ * gather + producer-dispatch logic would have to be duplicated in
+ * `check.ts` — exactly the class of duplication CLAUDE.md Rule 2
+ * forbids for tool invocation, and the same hazard applies here.
+ */
+export interface CurrentScan {
+    readonly findings: ReadonlyArray<BaselineEntry>;
+    readonly aggregate: SecurityAggregate;
+    readonly repoState: BaselineRepoState;
+    readonly saltMode: SaltMode;
+    /** Per-tool name → version map for the run that just completed. */
+    readonly tools: Readonly<Record<string, string>>;
+    /** Envelope metadata for the run. `toolchainHash` is already
+     *  resolved from `tools`. */
+    readonly analysisMeta: BaselineAnalysisMeta;
+    /** Echoed back so the guardrail check can attribute per-pair
+     *  severity, overlap, and reachable signals without re-gathering. */
+    readonly producerCtx: ProducerContext;
+}
+/**
+ * Run every analyzer once, dispatch through the producer registry,
+ * and return the assembled `CurrentScan`. Used by `createBaseline`
+ * to capture today's state and by `runGuardrailCheck` to gather the
+ * current side of the cross-run diff.
+ *
+ * Pure-orchestrator: each step has a single responsibility (analyze
+ * → produce entries → resolve envelope metadata).
+ */
+export declare function gatherCurrentScan(options: {
+    readonly cwd: string;
+    readonly verbose?: boolean;
+}): Promise<CurrentScan>;
+/**
+ * Run the baseline-create pipeline. Pure-orchestrator: gather the
+ * current scan via the shared step, then write it to disk under the
+ * given name.
+ */
+export declare function createBaseline(options: CreateBaselineOptions): Promise<CreateBaselineResult>;
+//# sourceMappingURL=create.d.ts.map

package/dist/baseline/create.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"create.d.ts","sourceRoot":"","sources":["../../src/baseline/create.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;GAmBG;AAoBH,OAAO,KAAK,EAAE,oBAAoB,EAAE,YAAY,EAAE,iBAAiB,EAAE,MAAM,iBAAiB,CAAC;AAG7F,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,aAAa,CAAC;AAEnD,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,QAAQ,CAAC;AACvC,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,SAAS,CAAC;AAC7C,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,kCAAkC,CAAC;AAE1E,MAAM,WAAW,qBAAqB;IACpC,kEAAkE;IAClE,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;IACrB;;oDAEgD;IAChD,QAAQ,CAAC,IAAI,CAAC,EAAE,MAAM,CAAC;IACvB;;;yCAGqC;IACrC,QAAQ,CAAC,KAAK,CAAC,EAAE,OAAO,CAAC;IACzB,qEAAqE;IACrE,QAAQ,CAAC,OAAO,CAAC,EAAE,OAAO,CAAC;CAC5B;AAED,MAAM,WAAW,oBAAoB;IACnC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,IAAI,EAAE,YAAY,CAAC;CAC7B;AA6JD;;;;;GAKG;AACH,wBAAgB,qBAAqB,IAAI,IAAI,CAE5C;AAED;;;;;;;;;;GAUG;AACH,MAAM,WAAW,WAAW;IAC1B,QAAQ,CAAC,QAAQ,EAAE,aAAa,CAAC,aAAa,CAAC,CAAC;IAChD,QAAQ,CAAC,SAAS,EAAE,iBAAiB,CAAC;IACtC,QAAQ,CAAC,SAAS,EAAE,iBAAiB,CAAC;IACtC,QAAQ,CAAC,QAAQ,EAAE,QAAQ,CAAC;IAC5B,mEAAmE;IACnE,QAAQ,CAAC,KAAK,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC;IACjD;iCAC6B;IAC7B,QAAQ,CAAC,YAAY,EAAE,oBAAoB,CAAC;IAC5C;yEACqE;IACrE,QAAQ,CAAC,WAAW,EAAE,eAAe,CAAC;CACvC;AAED;;;;;;;;GAQG;AACH,wBAAsB,iBAAiB,CAAC,OAAO,EAAE;IAC/C,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;IACrB,QAAQ,CAAC,OAAO,CAAC,EAAE,OAAO,CAAC;CAC5B,GAAG,OAAO,CAAC,WAAW,CAAC,CA0EvB;AAED;;;;GAIG;AACH,wBAAsB,cAAc,CAClC,OAAO,EAAE,qBAAqB,GAC7B,OAAO,CAAC,oBAAoB,CAAC,CA0B/B"}

package/dist/baseline/create.js

@@ -0,0 +1,339 @@
+"use strict";
+/**
+ * `dxkit baseline create` orchestrator.
+ *
+ * Builds the shared producer context (runs every analyzer once),
+ * dispatches through the canonical producer registry (CLAUDE.md
+ * Rule 10), captures repo + analysis-environment metadata, and
+ * writes the result to `.dxkit/baselines/<name>.json`. The on-disk
+ * file is the durable record subsequent `guardrail check` runs diff
+ * against.
+ *
+ * This module is the producer side; the matcher + classifier on the
+ * consumer side already exist in `git-aware-match.ts` and
+ * `policy.ts`. The two are connected by the file format defined in
+ * `baseline-file.ts`.
+ *
+ * Per-kind producer coverage + deferral rationale live in the
+ * registry index (`./producers/index.ts`) — the single discovery
+ * surface. Adding a new identity kind or analyzer means
+ * registering a producer there, never an edit here.
+ */
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.clearToolVersionCache = clearToolVersionCache;
+exports.gatherCurrentScan = gatherCurrentScan;
+exports.createBaseline = createBaseline;
+const child_process_1 = require("child_process");
+const crypto_1 = require("crypto");
+const fs = __importStar(require("fs"));
+const path = __importStar(require("path"));
+const health_1 = require("../analyzers/health");
+const cache_1 = require("../analyzers/cache");
+const gather_1 = require("../analyzers/quality/gather");
+const tests_1 = require("../analyzers/tests");
+const gitleaks_1 = require("../analyzers/tools/gitleaks");
+const tool_registry_1 = require("../analyzers/tools/tool-registry");
+const constants_1 = require("../constants");
+const baseline_file_1 = require("./baseline-file");
+const policy_1 = require("./policy");
+const producers_1 = require("./producers");
+const salt_1 = require("./salt");
+/** Hash used for baseline-envelope metadata fields (policy, ignore,
+ *  toolchain, config). Distinct concern from finding-identity
+ *  fingerprints — these never enter the matcher's identity space. */
+function hashContent(content) {
+    return (0, crypto_1.createHash)('sha1').update(content).digest('hex').slice(0, 16); // fingerprint-helper-ok: envelope-metadata hash, not finding identity
+}
+/**
+ * Read a small file's text content with the canonical "absent → ''"
+ * convention. Treating absent files as the empty string keeps the
+ * downstream metadata hash stable across runs where the file is
+ * still missing.
+ */
+function readOptionalFile(filePath) {
+    try {
+        return fs.readFileSync(filePath, 'utf8');
+    }
+    catch {
+        return '';
+    }
+}
+/** Resolve the absolute commit SHA + branch name of the working tree.
+ *  Empty strings when the directory isn't a git repo — the rest of
+ *  the orchestrator works fine, only the git-aware matcher loses its
+ *  diff anchor on a future check. */
+function readRepoState(cwd) {
+    const run = (...args) => {
+        try {
+            return (0, child_process_1.execFileSync)('git', args, {
+                cwd,
+                encoding: 'utf8',
+                stdio: ['ignore', 'pipe', 'pipe'],
+            }).trim();
+        }
+        catch {
+            return '';
+        }
+    };
+    return {
+        commitSha: run('rev-parse', 'HEAD'),
+        branch: run('rev-parse', '--abbrev-ref', 'HEAD'),
+    };
+}
+/** Build the analysis-environment hash bundle from the live repo. */
+function buildAnalysisMeta(cwd) {
+    const policyHash = hashContent(JSON.stringify(policy_1.DEFAULT_BROWNFIELD_POLICY));
+    const ignoreHash = hashContent(readOptionalFile(path.join(cwd, '.dxkit-ignore')));
+    const configHash = hashContent(readOptionalFile(path.join(cwd, '.vyuh-dxkit.json')));
+    // toolchainHash is filled in by `createBaseline` once the
+    // per-tool version map has been resolved (depends on the gather).
+    return { dxkitVersion: constants_1.VERSION, policyHash, ignoreHash, toolchainHash: '', configHash };
+}
+/** Build the per-tool name → version map from the security
+ *  aggregate's provenance. Sparse; only the tools that actually
+ *  ran appear. Versions come from each tool's registered
+ *  `versionCheck` invocation via `findTool`, so the resulting
+ *  `toolchainHash` actually differs when a tool is upgraded —
+ *  closing the drift-detection gap that placeholder values left
+ *  open. In-process scanners (no external binary) are tagged with
+ *  the dxkit version so a dxkit upgrade invalidates the toolchain
+ *  hash even when no external tool changed — see
+ *  `IN_PROCESS_TOOLS`.
+ *
+ *  Compound tool names like `'osv-scanner-nuget-direct'` (the
+ *  per-pack synthetic names the dep-vuln providers emit) are
+ *  resolved by progressively shortening on `-` boundaries until a
+ *  matching TOOL_DEFS key is found — so
+ *  `'osv-scanner-nuget-direct'` → `'osv-scanner-nuget'` →
+ *  `'osv-scanner'` (the canonical key). */
+function buildToolsMap(toolNames, cwd) {
+    const out = {};
+    for (const name of toolNames) {
+        if (!name)
+            continue;
+        out[name] = resolveToolVersion(name, cwd);
+    }
+    return out;
+}
+/**
+ * Scanner names that don't correspond to an external binary — their
+ * "version" tracks the dxkit version. Adding a new in-process
+ * scanner (e.g. a future regex-based dependency checker) means
+ * appending its name here, never special-casing inside
+ * `resolveToolVersion`.
+ *
+ * Drives the `provenance.{secrets,codePatterns,...}.tool` values
+ * that surface when external tools are unavailable — gitleaks
+ * absent → `grep-secrets` runs the in-process fallback; the
+ * TLS-bypass registry is always in-process.
+ */
+const IN_PROCESS_TOOLS = new Set(['tls-bypass-registry', 'grep-secrets']);
+/**
+ * Per-process cache of resolved tool versions, keyed by `${name}::${cwd}`.
+ *
+ * Why this exists: `findTool` spawns an `execFileSync` subprocess to
+ * run each tool's `versionCheck` command. Under heavy concurrent
+ * load (parallel vitest workers, large suites running side-by-side),
+ * that subprocess can occasionally complete with empty stdout —
+ * `resolveToolVersion`'s `if (status.version) return status.version`
+ * branch is skipped, the `return 'present'` fallback fires, and the
+ * resulting toolchainHash drifts between two back-to-back gathers
+ * within the same process. The matcher's `tooling_drift` gate then
+ * fires spuriously.
+ *
+ * Tool versions don't change mid-process — once we've resolved
+ * `gitleaks → 8.24.0` for `cwd`, every subsequent ask in the same
+ * process should return the same answer. The cache locks the first
+ * probe's outcome and skips later subprocess spawns entirely; same
+ * answer always, with the side benefit of faster repeated gathers.
+ *
+ * NOT applied to `findTool` itself: `tools-cli.ts` runs an install
+ * command then immediately re-probes (the install just created the
+ * binary, we need fresh state). That callsite must keep getting
+ * uncached results. The cache stays local to the toolchain-version
+ * resolver here.
+ */
+const VERSION_CACHE = new Map();
+function resolveToolVersion(name, cwd) {
+    const cacheKey = `${name}::${cwd}`;
+    const cached = VERSION_CACHE.get(cacheKey);
+    if (cached !== undefined)
+        return cached;
+    const resolved = resolveToolVersionUncached(name, cwd);
+    VERSION_CACHE.set(cacheKey, resolved);
+    return resolved;
+}
+function resolveToolVersionUncached(name, cwd) {
+    if (IN_PROCESS_TOOLS.has(name))
+        return `dxkit-${constants_1.VERSION}`;
+    const parts = name.split('-');
+    for (let i = parts.length; i > 0; i--) {
+        const candidate = parts.slice(0, i).join('-');
+        const def = tool_registry_1.TOOL_DEFS[candidate];
+        if (!def)
+            continue;
+        // Probe the version a few times — under heavy CPU load (parallel
+        // test pools, concurrent scanner runs) the underlying `execSync`
+        // subprocess can occasionally return before its `--version`
+        // output streams back, leaving us with a bare `'present'` even
+        // though the tool itself is fully functional. The per-process
+        // VERSION_CACHE then locks that empty result for the lifetime of
+        // the run, which is what we want for byte-stable toolchainHashes
+        // but is wrong when the empty result was a transient artifact.
+        // Three attempts absorb the hiccup without slowing the common
+        // path (first probe succeeds → exit immediately).
+        for (let attempt = 0; attempt < 3; attempt++) {
+            const status = (0, tool_registry_1.findTool)(def, cwd);
+            if (status.version)
+                return status.version;
+        }
+        return 'present';
+    }
+    return 'unknown';
+}
+/**
+ * Test seam: clear the version cache between test runs so per-test
+ * fixtures don't leak resolutions into one another. Production
+ * callers never use this — the cache lives for the entire CLI
+ * invocation and dies with the process.
+ */
+function clearToolVersionCache() {
+    VERSION_CACHE.clear();
+}
+/**
+ * Run every analyzer once, dispatch through the producer registry,
+ * and return the assembled `CurrentScan`. Used by `createBaseline`
+ * to capture today's state and by `runGuardrailCheck` to gather the
+ * current side of the cross-run diff.
+ *
+ * Pure-orchestrator: each step has a single responsibility (analyze
+ * → produce entries → resolve envelope metadata).
+ */
+async function gatherCurrentScan(options) {
+    const cwd = path.resolve(options.cwd);
+    const analysisResult = await (0, cache_1.readOrBuildAnalysisResult)({
+        cwd,
+        build: (innerCwd) => (0, health_1.gatherAnalysisResultBody)(innerCwd, { verbose: !!options.verbose }),
+    });
+    const aggregate = analysisResult.capabilities.securityAggregate;
+    if (!aggregate) {
+        throw new Error('baseline scan: cached AnalysisResult missing securityAggregate ' +
+            '(expected to be populated by gatherAnalysisResultBody).');
+    }
+    const repoState = {
+        ...readRepoState(cwd),
+        root: cwd,
+    };
+    // Salt resolves once; threaded into every producer that needs to
+    // compute HMACs. The mode lands on the baseline file so the
+    // matcher can re-derive the same salt at check time (or warn when
+    // it can't).
+    const { mode: saltMode, salt } = (0, salt_1.resolveSalt)(cwd);
+    // Build the producer context once. Every analyzer's gather runs
+    // here (or earlier inside readOrBuildAnalysisResult) so producers
+    // can be pure or near-pure consumers — adding a new producer
+    // means extending this context with one more input, never
+    // adding another producer-specific block in this function.
+    const testGapsReport = await (0, tests_1.analyzeTestGaps)(cwd, { verbose: !!options.verbose });
+    const hygieneMarkers = (0, gather_1.gatherHygieneMarkers)(cwd);
+    const gitleaksOutcome = (0, gitleaks_1.gatherGitleaksResult)(cwd);
+    const rawSecrets = gitleaksOutcome.kind === 'success' ? gitleaksOutcome.rawSecrets : [];
+    const producerCtx = {
+        cwd,
+        commitSha: repoState.commitSha,
+        salt,
+        analysisResult,
+        testGapsReport,
+        hygiene: hygieneMarkers,
+        rawSecrets,
+    };
+    // Dispatch through the canonical producer registry (CLAUDE.md
+    // Rule 10). Adding a new identity kind means registering a
+    // producer in `src/baseline/producers/index.ts` — never an edit
+    // here.
+    const findings = (0, producers_1.runProducers)(producerCtx, producers_1.PRODUCERS);
+    const toolNames = new Set();
+    if (aggregate.provenance.secrets.tool)
+        toolNames.add(aggregate.provenance.secrets.tool);
+    if (aggregate.provenance.codePatterns.tool)
+        toolNames.add(aggregate.provenance.codePatterns.tool);
+    if (aggregate.provenance.depVulns.tool)
+        toolNames.add(aggregate.provenance.depVulns.tool);
+    if (aggregate.provenance.tlsBypass.ran)
+        toolNames.add('tls-bypass-registry');
+    const tools = buildToolsMap([...toolNames].sort(), cwd);
+    const analysisMeta = {
+        ...buildAnalysisMeta(cwd),
+        toolchainHash: hashContent(JSON.stringify(tools)),
+    };
+    return {
+        findings,
+        aggregate,
+        repoState,
+        saltMode,
+        tools,
+        analysisMeta,
+        producerCtx,
+    };
+}
+/**
+ * Run the baseline-create pipeline. Pure-orchestrator: gather the
+ * current scan via the shared step, then write it to disk under the
+ * given name.
+ */
+async function createBaseline(options) {
+    const cwd = path.resolve(options.cwd);
+    const name = options.name ?? baseline_file_1.DEFAULT_BASELINE_NAME;
+    const filePath = (0, baseline_file_1.pathForBaseline)(cwd, name);
+    if (!options.force && fs.existsSync(filePath)) {
+        throw new Error(`baseline already exists at ${filePath}. Pass force: true to overwrite, ` +
+            `or use a different --name to keep both.`);
+    }
+    const scan = await gatherCurrentScan({ cwd, verbose: options.verbose });
+    const file = {
+        schemaVersion: baseline_file_1.BASELINE_SCHEMA_VERSION,
+        name,
+        createdAt: new Date().toISOString(),
+        repo: scan.repoState,
+        analysis: scan.analysisMeta,
+        tools: scan.tools,
+        saltMode: scan.saltMode,
+        findings: scan.findings,
+    };
+    (0, baseline_file_1.writeBaselineFile)(filePath, file);
+    return { path: filePath, file };
+}
+//# sourceMappingURL=create.js.map