@vyuhlabs/dxkit 2.4.8 → 2.5.0

package/dist/baseline/policy.js

@@ -0,0 +1,206 @@
+"use strict";
+/**
+ * Brownfield policy + status classifier.
+ *
+ * The matcher in `git-aware-match.ts` emits raw `MatchPair`s with one
+ * of four statuses (persisted / relocated / added / removed) plus a
+ * confidence score and structured reasons. The guardrail check needs
+ * a richer taxonomy — the difference between "developer introduced
+ * a new finding" and "a scanner update surfaced a finding that was
+ * always there" matters enormously for whether to block a PR.
+ *
+ * This module is the bridge. It takes a `MatchPair` plus optional
+ * context (severity, scanner-version diff, config diff) and a
+ * `BrownfieldPolicy`, then emits a `ClassifyResult` carrying the
+ * post-policy `FindingStatus`, the block/warn verdict, and the
+ * composed reason chain.
+ *
+ * Pure module — no I/O, deterministic over its inputs.
+ *
+ * Producer wiring note: today's classifier emits a subset of the full
+ * `FindingStatus` taxonomy. Reservations for `probable_existing`,
+ * `newly_detected`, and `fixed` are declared in the type space so
+ * Phase 3's baseline-metadata work can light them up incrementally
+ * without re-shaping consumer code.
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.DEFAULT_BROWNFIELD_POLICY = void 0;
+exports.classify = classify;
+exports.classifyAll = classifyAll;
+/**
+ * Default brownfield policy. Captures the conservative posture from
+ * the agentic-brownfield strategy: block only on high-confidence new
+ * regressions; warn on the categories that suggest a problem might
+ * be real but might also be drift; legacy debt is permitted.
+ *
+ * Confidence thresholds: secrets + critical security demand a tight
+ * confidence threshold (a low-confidence persisted secret pairing
+ * gets demoted to uncertain and warned, not blocked). Lower-severity
+ * findings can pair on weaker signal because the cost of a false
+ * "secret is new" event is much higher than a false "TODO is new."
+ */
+exports.DEFAULT_BROWNFIELD_POLICY = Object.freeze({
+    mode: 'brownfield',
+    block: Object.freeze(['added']),
+    warn: Object.freeze([
+        'probable_existing',
+        'newly_detected',
+        'tooling_drift',
+        'config_drift',
+        'uncertain',
+    ]),
+    confidence: Object.freeze({
+        critical: 0.75,
+        high: 0.8,
+        medium: 0.85,
+        low: 0.9,
+    }),
+    blockRules: Object.freeze({
+        newSecret: true,
+        newCriticalSecurity: true,
+        newHighSecurity: true,
+        newCriticalDependencyVulnerability: true,
+        newHighReachableDependencyVulnerability: true,
+        newUntestedChangedSource: true,
+        newSevereQualityIssueInChangedFiles: true,
+    }),
+    addedRequiresChangedLines: Object.freeze(['code', 'hygiene']),
+});
+/**
+ * Classify one match pair against a brownfield policy.
+ *
+ * Pipeline:
+ *   1. Start with the matcher's `pair.status` as the candidate
+ *      `FindingStatus`.
+ *   2. For `added`: check drift context. Scanner-version drift wins
+ *      (more specific signal) over config drift; both demote to
+ *      drift-bucket statuses regardless of severity.
+ *   3. For `persisted` / `relocated`: check confidence against the
+ *      per-severity threshold. Below threshold demotes to
+ *      `'uncertain'`.
+ *   4. Apply block-rule overrides: if a block-rule fires for this
+ *      kind+severity combination AND the candidate status is
+ *      `'added'`, the result blocks even if `'added'` weren't in the
+ *      policy's block list.
+ *   5. Apply the policy's `block` / `warn` membership to the final
+ *      status to produce the booleans.
+ */
+function classify(pair, policy = exports.DEFAULT_BROWNFIELD_POLICY, context = {}) {
+    let status = pair.status;
+    const reasons = [...pair.reasons];
+    // Step 2: drift context can reclassify 'added'.
+    if (status === 'added') {
+        if (context.scannerVersionDiffers) {
+            status = 'tooling_drift';
+            reasons.push({
+                code: 'tooling-drift',
+                detail: 'scanner or advisory-db version changed between runs',
+            });
+        }
+        else if (context.configDiffers) {
+            status = 'config_drift';
+            reasons.push({
+                code: 'config-drift',
+                detail: 'suppression or policy config changed between runs',
+            });
+        }
+        else if (context.kind &&
+            policy.addedRequiresChangedLines.includes(context.kind) &&
+            context.overlapsChangedLines === false) {
+            // Scanner-wobble demotion: an `added` finding from a high-
+            // wobble scanner (semgrep code, grep-based hygiene) that
+            // sits outside the diff's changed lines is more likely a
+            // baseline gap than a real regression. Demote to `uncertain`
+            // (warn). The block-rules below still fire for findings the
+            // diff actually touched.
+            status = 'uncertain';
+            reasons.push({
+                code: 'unchanged-lines',
+                detail: `${context.kind} finding outside diff hunks — demoted from added to uncertain (likely scanner wobble, not a developer-introduced regression)`,
+            });
+        }
+    }
+    // Step 3: confidence demotion for persisted/relocated pairs.
+    if (status === 'persisted' || status === 'relocated') {
+        const threshold = context.severity
+            ? policy.confidence[context.severity]
+            : Math.min(...Object.values(policy.confidence));
+        if (pair.confidence < threshold) {
+            reasons.push({
+                code: 'low-confidence',
+                detail: `match confidence ${pair.confidence.toFixed(2)} below threshold ${threshold.toFixed(2)}` +
+                    (context.severity ? ` for severity ${context.severity}` : ''),
+            });
+            status = 'uncertain';
+        }
+    }
+    // Step 4: block-rule overrides for newly-added findings.
+    const blockRuleHit = evaluateBlockRules(status, policy.blockRules, context);
+    if (blockRuleHit) {
+        reasons.push({
+            code: 'block-rule',
+            detail: `policy block-rule fired: ${blockRuleHit}`,
+        });
+    }
+    // Step 5: policy block/warn membership.
+    const blocks = blockRuleHit !== null || policy.block.includes(status);
+    const warns = policy.warn.includes(status);
+    return { status, blocks, warns, reasons };
+}
+/**
+ * Check whether any block-rule fires for the given classified pair.
+ * Returns the matching rule's name (for reason rendering) or null
+ * when no rule fires.
+ *
+ * Block-rules only apply to `added` status — they exist to escalate
+ * specific kinds of new findings beyond the generic policy. A
+ * `tooling_drift` reclassification means the `added` status is gone
+ * and the block-rule no longer applies.
+ */
+function evaluateBlockRules(status, rules, context) {
+    if (status !== 'added')
+        return null;
+    if (rules.newSecret && context.kind === 'secret')
+        return 'newSecret';
+    if (rules.newCriticalSecurity && context.kind === 'code' && context.severity === 'critical') {
+        return 'newCriticalSecurity';
+    }
+    if (rules.newHighSecurity && context.kind === 'code' && context.severity === 'high') {
+        return 'newHighSecurity';
+    }
+    if (rules.newCriticalDependencyVulnerability &&
+        context.kind === 'dep-vuln' &&
+        context.severity === 'critical') {
+        return 'newCriticalDependencyVulnerability';
+    }
+    if (rules.newHighReachableDependencyVulnerability &&
+        context.kind === 'dep-vuln' &&
+        context.severity === 'high' &&
+        context.reachable === true) {
+        return 'newHighReachableDependencyVulnerability';
+    }
+    if (rules.newUntestedChangedSource &&
+        context.kind === 'test-gap' &&
+        context.overlapsChangedLines === true) {
+        return 'newUntestedChangedSource';
+    }
+    if (rules.newSevereQualityIssueInChangedFiles &&
+        (context.kind === 'code' || context.kind === 'hygiene') &&
+        (context.severity === 'critical' || context.severity === 'high') &&
+        context.overlapsChangedLines === true) {
+        return 'newSevereQualityIssueInChangedFiles';
+    }
+    return null;
+}
+/**
+ * Convenience: classify every pair in a match result against the
+ * same policy. Returns an array aligned with the input pair order
+ * so callers can render side-by-side. Per-pair context (severity,
+ * kind, drift flags) is supplied via the optional `contextFor`
+ * callback — callers map their `FindingId` back to the producer
+ * envelope to fill in the fields the classifier reads.
+ */
+function classifyAll(pairs, policy = exports.DEFAULT_BROWNFIELD_POLICY, contextFor = () => ({})) {
+    return pairs.map((pair) => classify(pair, policy, contextFor(pair)));
+}
+//# sourceMappingURL=policy.js.map

package/dist/baseline/policy.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"policy.js","sourceRoot":"","sources":["../../src/baseline/policy.ts"],"names":[],"mappings":";AAAA;;;;;;;;;;;;;;;;;;;;;;;GAuBG;;;AA0KH,4BAuEC;AAkED,kCAMC;AAlPD;;;;;;;;;;;GAWG;AACU,QAAA,yBAAyB,GAAqB,MAAM,CAAC,MAAM,CAAC;IACvE,IAAI,EAAE,YAAY;IAClB,KAAK,EAAE,MAAM,CAAC,MAAM,CAAC,CAAC,OAAO,CAAiC,CAAC;IAC/D,IAAI,EAAE,MAAM,CAAC,MAAM,CAAC;QAClB,mBAAmB;QACnB,gBAAgB;QAChB,eAAe;QACf,cAAc;QACd,WAAW;KACoB,CAAC;IAClC,UAAU,EAAE,MAAM,CAAC,MAAM,CAAC;QACxB,QAAQ,EAAE,IAAI;QACd,IAAI,EAAE,GAAG;QACT,MAAM,EAAE,IAAI;QACZ,GAAG,EAAE,GAAG;KACT,CAAC;IACF,UAAU,EAAE,MAAM,CAAC,MAAM,CAAC;QACxB,SAAS,EAAE,IAAI;QACf,mBAAmB,EAAE,IAAI;QACzB,eAAe,EAAE,IAAI;QACrB,kCAAkC,EAAE,IAAI;QACxC,uCAAuC,EAAE,IAAI;QAC7C,wBAAwB,EAAE,IAAI;QAC9B,mCAAmC,EAAE,IAAI;KAC1C,CAAC;IACF,yBAAyB,EAAE,MAAM,CAAC,MAAM,CAAC,CAAC,MAAM,EAAE,SAAS,CAAC,CAAC;CAC9D,CAAC,CAAC;AA0CH;;;;;;;;;;;;;;;;;;GAkBG;AACH,SAAgB,QAAQ,CACtB,IAAe,EACf,SAA2B,iCAAyB,EACpD,UAA2B,EAAE;IAE7B,IAAI,MAAM,GAAkB,IAAI,CAAC,MAAM,CAAC;IACxC,MAAM,OAAO,GAAkB,CAAC,GAAG,IAAI,CAAC,OAAO,CAAC,CAAC;IAEjD,gDAAgD;IAChD,IAAI,MAAM,KAAK,OAAO,EAAE,CAAC;QACvB,IAAI,OAAO,CAAC,qBAAqB,EAAE,CAAC;YAClC,MAAM,GAAG,eAAe,CAAC;YACzB,OAAO,CAAC,IAAI,CAAC;gBACX,IAAI,EAAE,eAAe;gBACrB,MAAM,EAAE,qDAAqD;aAC9D,CAAC,CAAC;QACL,CAAC;aAAM,IAAI,OAAO,CAAC,aAAa,EAAE,CAAC;YACjC,MAAM,GAAG,cAAc,CAAC;YACxB,OAAO,CAAC,IAAI,CAAC;gBACX,IAAI,EAAE,cAAc;gBACpB,MAAM,EAAE,mDAAmD;aAC5D,CAAC,CAAC;QACL,CAAC;aAAM,IACL,OAAO,CAAC,IAAI;YACZ,MAAM,CAAC,yBAAyB,CAAC,QAAQ,CAAC,OAAO,CAAC,IAAI,CAAC;YACvD,OAAO,CAAC,oBAAoB,KAAK,KAAK,EACtC,CAAC;YACD,2DAA2D;YAC3D,yDAAyD;YACzD,yDAAyD;YACzD,6DAA6D;YAC7D,4DAA4D;YAC5D,yBAAyB;YACzB,MAAM,GAAG,WAAW,CAAC;YACrB,OAAO,CAAC,IAAI,CAAC;gBACX,IAAI,EAAE,iBAAiB;gBACvB,MAAM,EAAE,GAAG,OAAO,CAAC,IAAI,8HAA8H;aACtJ,CAAC,CAAC;QACL,CAAC;IACH,CAAC;IAED,6DAA6D;IAC7D,IAAI,MAAM,KAAK,WAAW,IAAI,MAAM,KAAK,WAAW,EAAE,CAAC;QACrD,MAAM,SAAS,GAAG,OAAO,CAAC,QAAQ;YAChC,CAAC,CAAC,MAAM,CAAC,UAAU,CAAC,OAAO,CAAC,QAAQ,CAAC;YACrC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,GAAG,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC,CAAC;QAClD,IAAI,IAAI,CAAC,UAAU,GAAG,SAAS,EAAE,CAAC;YAChC,OAAO,CAAC,IAAI,CAAC;gBACX,IAAI,EAAE,gBAAgB;gBACtB,MAAM,EACJ,oBAAoB,IAAI,CAAC,UAAU,CAAC,OAAO,CAAC,CAAC,CAAC,oBAAoB,SAAS,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE;oBACxF,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC,CAAC,iBAAiB,OAAO,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;aAChE,CAAC,CAAC;YACH,MAAM,GAAG,WAAW,CAAC;QACvB,CAAC;IACH,CAAC;IAED,yDAAyD;IACzD,MAAM,YAAY,GAAG,kBAAkB,CAAC,MAAM,EAAE,MAAM,CAAC,UAAU,EAAE,OAAO,CAAC,CAAC;IAC5E,IAAI,YAAY,EAAE,CAAC;QACjB,OAAO,CAAC,IAAI,CAAC;YACX,IAAI,EAAE,YAAY;YAClB,MAAM,EAAE,4BAA4B,YAAY,EAAE;SACnD,CAAC,CAAC;IACL,CAAC;IAED,wCAAwC;IACxC,MAAM,MAAM,GAAG,YAAY,KAAK,IAAI,IAAI,MAAM,CAAC,KAAK,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;IACtE,MAAM,KAAK,GAAG,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;IAE3C,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE,OAAO,EAAE,CAAC;AAC5C,CAAC;AAED;;;;;;;;;GASG;AACH,SAAS,kBAAkB,CACzB,MAAqB,EACrB,KAA2B,EAC3B,OAAwB;IAExB,IAAI,MAAM,KAAK,OAAO;QAAE,OAAO,IAAI,CAAC;IACpC,IAAI,KAAK,CAAC,SAAS,IAAI,OAAO,CAAC,IAAI,KAAK,QAAQ;QAAE,OAAO,WAAW,CAAC;IACrE,IAAI,KAAK,CAAC,mBAAmB,IAAI,OAAO,CAAC,IAAI,KAAK,MAAM,IAAI,OAAO,CAAC,QAAQ,KAAK,UAAU,EAAE,CAAC;QAC5F,OAAO,qBAAqB,CAAC;IAC/B,CAAC;IACD,IAAI,KAAK,CAAC,eAAe,IAAI,OAAO,CAAC,IAAI,KAAK,MAAM,IAAI,OAAO,CAAC,QAAQ,KAAK,MAAM,EAAE,CAAC;QACpF,OAAO,iBAAiB,CAAC;IAC3B,CAAC;IACD,IACE,KAAK,CAAC,kCAAkC;QACxC,OAAO,CAAC,IAAI,KAAK,UAAU;QAC3B,OAAO,CAAC,QAAQ,KAAK,UAAU,EAC/B,CAAC;QACD,OAAO,oCAAoC,CAAC;IAC9C,CAAC;IACD,IACE,KAAK,CAAC,uCAAuC;QAC7C,OAAO,CAAC,IAAI,KAAK,UAAU;QAC3B,OAAO,CAAC,QAAQ,KAAK,MAAM;QAC3B,OAAO,CAAC,SAAS,KAAK,IAAI,EAC1B,CAAC;QACD,OAAO,yCAAyC,CAAC;IACnD,CAAC;IACD,IACE,KAAK,CAAC,wBAAwB;QAC9B,OAAO,CAAC,IAAI,KAAK,UAAU;QAC3B,OAAO,CAAC,oBAAoB,KAAK,IAAI,EACrC,CAAC;QACD,OAAO,0BAA0B,CAAC;IACpC,CAAC;IACD,IACE,KAAK,CAAC,mCAAmC;QACzC,CAAC,OAAO,CAAC,IAAI,KAAK,MAAM,IAAI,OAAO,CAAC,IAAI,KAAK,SAAS,CAAC;QACvD,CAAC,OAAO,CAAC,QAAQ,KAAK,UAAU,IAAI,OAAO,CAAC,QAAQ,KAAK,MAAM,CAAC;QAChE,OAAO,CAAC,oBAAoB,KAAK,IAAI,EACrC,CAAC;QACD,OAAO,qCAAqC,CAAC;IAC/C,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED;;;;;;;GAOG;AACH,SAAgB,WAAW,CACzB,KAA+B,EAC/B,SAA2B,iCAAyB,EACpD,aAAmD,GAAG,EAAE,CAAC,CAAC,EAAE,CAAC;IAE7D,OAAO,KAAK,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,QAAQ,CAAC,IAAI,EAAE,MAAM,EAAE,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;AACvE,CAAC"}

package/dist/baseline/producers/health.d.ts

@@ -0,0 +1,30 @@
+/**
+ * Health → baseline-entry producer.
+ *
+ * One kind today: `large-file` — source files whose line count
+ * exceeds the canonical large-file threshold (500 lines). Identity
+ * is per-file: the binary "this file is over the threshold" signal
+ * is what guardrails act on. Crossing back under the threshold
+ * removes the identity; crossing back over re-adds it.
+ *
+ * Producer reads from `HealthMetrics.largestFiles`, which is already
+ * an `Array<{ path, lines }>` produced by the canonical generic-
+ * metrics gather. The 500-line threshold matches the
+ * `filesOver500Lines` aggregate the same gather emits — keeping the
+ * two in sync ensures the per-file identity set sums to the
+ * aggregate count.
+ */
+import type { BaselineEntry } from '../types';
+import type { HealthMetrics } from '../../analyzers/types';
+/** Canonical large-file threshold — file is "too large" at strictly
+ *  more than this many lines. Mirror of the constant the generic-
+ *  metrics gather already uses; documented as part of the file-size
+ *  signal in the CLAUDE.md maintainability surface. */
+export declare const LARGE_FILE_THRESHOLD_LINES = 500;
+/**
+ * Build `large-file` entries from the canonical `HealthMetrics`.
+ * Files with `lines <= threshold` are skipped so the identity set
+ * matches the user-facing aggregate count.
+ */
+export declare function largeFilesToBaselineEntries(metrics: HealthMetrics): BaselineEntry[];
+//# sourceMappingURL=health.d.ts.map

package/dist/baseline/producers/health.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"health.d.ts","sourceRoot":"","sources":["../../../src/baseline/producers/health.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AAGH,OAAO,KAAK,EAAE,aAAa,EAA0B,MAAM,UAAU,CAAC;AACtE,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,uBAAuB,CAAC;AAE3D;;;uDAGuD;AACvD,eAAO,MAAM,0BAA0B,MAAM,CAAC;AAE9C;;;;GAIG;AACH,wBAAgB,2BAA2B,CAAC,OAAO,EAAE,aAAa,GAAG,aAAa,EAAE,CAQnF"}

package/dist/baseline/producers/health.js

@@ -0,0 +1,42 @@
+"use strict";
+/**
+ * Health → baseline-entry producer.
+ *
+ * One kind today: `large-file` — source files whose line count
+ * exceeds the canonical large-file threshold (500 lines). Identity
+ * is per-file: the binary "this file is over the threshold" signal
+ * is what guardrails act on. Crossing back under the threshold
+ * removes the identity; crossing back over re-adds it.
+ *
+ * Producer reads from `HealthMetrics.largestFiles`, which is already
+ * an `Array<{ path, lines }>` produced by the canonical generic-
+ * metrics gather. The 500-line threshold matches the
+ * `filesOver500Lines` aggregate the same gather emits — keeping the
+ * two in sync ensures the per-file identity set sums to the
+ * aggregate count.
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.LARGE_FILE_THRESHOLD_LINES = void 0;
+exports.largeFilesToBaselineEntries = largeFilesToBaselineEntries;
+const finding_identity_1 = require("../finding-identity");
+/** Canonical large-file threshold — file is "too large" at strictly
+ *  more than this many lines. Mirror of the constant the generic-
+ *  metrics gather already uses; documented as part of the file-size
+ *  signal in the CLAUDE.md maintainability surface. */
+exports.LARGE_FILE_THRESHOLD_LINES = 500;
+/**
+ * Build `large-file` entries from the canonical `HealthMetrics`.
+ * Files with `lines <= threshold` are skipped so the identity set
+ * matches the user-facing aggregate count.
+ */
+function largeFilesToBaselineEntries(metrics) {
+    const out = [];
+    for (const f of metrics.largestFiles) {
+        if (f.lines <= exports.LARGE_FILE_THRESHOLD_LINES)
+            continue;
+        const input = { kind: 'large-file', file: f.path };
+        out.push({ id: (0, finding_identity_1.identityFor)(input), kind: 'large-file', file: f.path });
+    }
+    return out;
+}
+//# sourceMappingURL=health.js.map

package/dist/baseline/producers/health.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"health.js","sourceRoot":"","sources":["../../../src/baseline/producers/health.ts"],"names":[],"mappings":";AAAA;;;;;;;;;;;;;;;GAeG;;;AAiBH,kEAQC;AAvBD,0DAAkD;AAIlD;;;uDAGuD;AAC1C,QAAA,0BAA0B,GAAG,GAAG,CAAC;AAE9C;;;;GAIG;AACH,SAAgB,2BAA2B,CAAC,OAAsB;IAChE,MAAM,GAAG,GAAoB,EAAE,CAAC;IAChC,KAAK,MAAM,CAAC,IAAI,OAAO,CAAC,YAAY,EAAE,CAAC;QACrC,IAAI,CAAC,CAAC,KAAK,IAAI,kCAA0B;YAAE,SAAS;QACpD,MAAM,KAAK,GAA2B,EAAE,IAAI,EAAE,YAAY,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;QAC3E,GAAG,CAAC,IAAI,CAAC,EAAE,EAAE,EAAE,IAAA,8BAAW,EAAC,KAAK,CAAC,EAAE,IAAI,EAAE,YAAY,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC;IACzE,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC"}

package/dist/baseline/producers/index.d.ts

@@ -0,0 +1,164 @@
+/**
+ * Producer registry — the single canonical home for everything that
+ * turns analyzer output into `BaselineEntry`s.
+ *
+ * # Why this exists (CLAUDE.md Rule 10)
+ *
+ * The baseline file is the durable contract the guardrail check
+ * reads. Every analyzer that surfaces per-finding output MUST flow
+ * through a registered producer so guardrails don't silently miss
+ * its findings. Without the registry, adding a new analyzer means
+ * remembering to also edit `create.ts` orchestration — easy to
+ * forget, and the bug is invisible (the guardrail check passes even
+ * when a new finding kind is silently bypassed).
+ *
+ * With the registry:
+ *   - Adding a new analyzer is a one-line `PRODUCERS.push(...)`.
+ *   - The orchestrator iterates the registry — no per-producer
+ *     `findings.push(...)` calls to forget.
+ *   - A contract test asserts every `IdentityInput` discriminant
+ *     kind is either contributed by a registered producer OR
+ *     listed in `DEFERRED_KINDS` with explicit rationale.
+ *   - A synthetic-producer playbook test asserts the orchestrator
+ *     stays registry-driven (adding a fake producer to the
+ *     registry makes its entries appear in the baseline file
+ *     without any edits to the orchestrator).
+ *
+ * # Producer contract
+ *
+ * Each producer:
+ *   1. Declares the identity kinds it contributes via `contributes`.
+ *   2. Reads from the shared `ProducerContext` (gathered once by
+ *      the orchestrator so multiple producers don't re-shell the
+ *      same analyzer).
+ *   3. Returns `BaselineEntry[]` — pure or near-pure, depending on
+ *      whether content-hash stamping is needed.
+ *
+ * # Adding a new identity kind
+ *
+ *   1. Add the discriminant to `IdentityInput` in `types.ts`.
+ *   2. Add the case branch in `identityFor`.
+ *   3. EITHER add a new producer here (or extend an existing one)
+ *      so `contributes` covers the new kind, OR add the kind to
+ *      `DEFERRED_KINDS` with rationale + landing phase.
+ *   4. Add a fixture row in `test/baseline/finding-identity.test.ts`
+ *      (Rule 9 / per-kind fixture contract).
+ *
+ * The contract test enforces steps 3 + 4 at runtime; the
+ * exhaustive switch in `identityFor` enforces step 2 at compile
+ * time. The result: no new identity kind can land in a way that
+ * silently bypasses guardrails.
+ */
+import type { GitleaksRawSecret } from '../../analyzers/tools/gitleaks';
+import type { AnalysisResult } from '../../analysis-result';
+import type { TestGapsReport } from '../../analyzers/tests/types';
+import type { BaselineEntry } from '../types';
+/** Every discriminant value the `BaselineEntry` union takes. Mirror
+ *  of `IdentityInput['kind']` — kept as a separate alias because the
+ *  registry contract speaks in terms of stored entries, not the
+ *  identity-compute input. */
+export type IdentityKind = BaselineEntry['kind'];
+/**
+ * Hygiene-marker counts + stale-file list returned by
+ * `gatherHygieneMarkers`. Replicated here as the producer-context
+ * field type so producers don't need to depend on the analyzer
+ * module's gather signature.
+ */
+export interface HygieneSnapshot {
+    readonly staleFiles: ReadonlyArray<string>;
+    readonly todoCount: number;
+    readonly fixmeCount: number;
+    readonly hackCount: number;
+    readonly consoleLogCount: number;
+    readonly mixedLanguages: boolean;
+}
+/**
+ * Per-run inputs every producer reads from. Gathered ONCE by the
+ * orchestrator; producers are pure (or content-hash-impure for
+ * stamping) over this context. Adding a new producer that needs a
+ * new analyzer means extending this context — a single, visible
+ * extension point.
+ */
+export interface ProducerContext {
+    /** Absolute repo path. */
+    readonly cwd: string;
+    /** Commit SHA the baseline anchors to. Empty string when not in
+     *  a git repo — content-hash stamping is then disabled but other
+     *  producers still emit normally. */
+    readonly commitSha: string;
+    /** Resolved repo salt (from `resolveSalt`). Threaded into
+     *  producers that compute HMACs. */
+    readonly salt: string;
+    /** Canonical cached analysis envelope — capabilities + metrics
+     *  + provenance for every gather pipeline. */
+    readonly analysisResult: AnalysisResult;
+    /** Test-gaps report (separate analyzer because the gap detection
+     *  + import-graph reachability isn't part of the cached
+     *  envelope). */
+    readonly testGapsReport: TestGapsReport;
+    /** Hygiene-marker snapshot — stale file list + aggregate counts. */
+    readonly hygiene: HygieneSnapshot;
+    /** Raw secrets gitleaks captured (process-only; never written to
+     *  disk; consumed by the secret-HMAC producer). */
+    readonly rawSecrets: ReadonlyArray<GitleaksRawSecret>;
+}
+/**
+ * The registry entry shape. A producer self-describes the kinds it
+ * contributes and supplies the function to produce them.
+ */
+export interface BaselineProducer {
+    /** Human-readable name; surfaces in logs + contract-test
+     *  diagnostics ("producer X contributed N entries"). */
+    readonly name: string;
+    /** Identity kinds this producer wires. The contract test reads
+     *  the union across every producer and asserts it covers every
+     *  `IdentityKind` value not in `DEFERRED_KINDS`. */
+    readonly contributes: ReadonlyArray<IdentityKind>;
+    /** Build `BaselineEntry`s from the shared context. Producers
+     *  emit ZERO entries when their upstream data is missing
+     *  (analyzer didn't run, envelope absent, etc.) — never throw
+     *  for missing inputs. */
+    readonly produce: (ctx: ProducerContext) => BaselineEntry[];
+}
+/**
+ * Identity kinds declared in `IdentityInput` but not yet wired by
+ * any producer. Each entry MUST carry a `reason` (what blocks the
+ * producer today) and `landingPhase` (when we intend to wire it).
+ * The contract test asserts:
+ *
+ *   - Every kind appearing here is NOT contributed by any
+ *     registered producer (no double-counting).
+ *   - Every `IdentityKind` is either contributed OR in this map.
+ *
+ * Adding a new identity kind without wiring a producer requires
+ * adding an entry here — the deferral becomes architecturally
+ * explicit rather than silently invisible.
+ */
+export declare const DEFERRED_KINDS: Readonly<Record<string, {
+    readonly reason: string;
+    readonly landingPhase: string;
+}>>;
+/**
+ * The canonical producer list. Order is preserved in baseline-file
+ * output for deterministic diffs; adding a new producer appends
+ * here and updates the contract-test expectations.
+ *
+ * Mutable for the synthetic-producer playbook test: the test
+ * substitutes a wrapped registry rather than mutating PRODUCERS
+ * directly. Callers MUST treat this as immutable.
+ */
+export declare const PRODUCERS: ReadonlyArray<BaselineProducer>;
+/**
+ * Run every producer in `producers` against the shared context and
+ * flatten the result. The orchestrator calls this with `PRODUCERS`
+ * for production use; the playbook test calls it with an extended
+ * list to verify synthetic producers flow through.
+ */
+export declare function runProducers(ctx: ProducerContext, producers?: ReadonlyArray<BaselineProducer>): BaselineEntry[];
+/**
+ * Every kind currently contributed by some producer in `producers`.
+ * Convenience used by the contract test + by the orchestrator for
+ * logging "this run produced entries across N kinds."
+ */
+export declare function wiredKinds(producers?: ReadonlyArray<BaselineProducer>): ReadonlySet<IdentityKind>;
+//# sourceMappingURL=index.d.ts.map

package/dist/baseline/producers/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/baseline/producers/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAkDG;AAEH,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,gCAAgC,CAAC;AACxE,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,uBAAuB,CAAC;AAC5D,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,6BAA6B,CAAC;AAClE,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,UAAU,CAAC;AAQ9C;;;8BAG8B;AAC9B,MAAM,MAAM,YAAY,GAAG,aAAa,CAAC,MAAM,CAAC,CAAC;AAEjD;;;;;GAKG;AACH,MAAM,WAAW,eAAe;IAC9B,QAAQ,CAAC,UAAU,EAAE,aAAa,CAAC,MAAM,CAAC,CAAC;IAC3C,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,eAAe,EAAE,MAAM,CAAC;IACjC,QAAQ,CAAC,cAAc,EAAE,OAAO,CAAC;CAClC;AAED;;;;;;GAMG;AACH,MAAM,WAAW,eAAe;IAC9B,0BAA0B;IAC1B,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;IACrB;;yCAEqC;IACrC,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B;wCACoC;IACpC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB;kDAC8C;IAC9C,QAAQ,CAAC,cAAc,EAAE,cAAc,CAAC;IACxC;;qBAEiB;IACjB,QAAQ,CAAC,cAAc,EAAE,cAAc,CAAC;IACxC,oEAAoE;IACpE,QAAQ,CAAC,OAAO,EAAE,eAAe,CAAC;IAClC;uDACmD;IACnD,QAAQ,CAAC,UAAU,EAAE,aAAa,CAAC,iBAAiB,CAAC,CAAC;CACvD;AAED;;;GAGG;AACH,MAAM,WAAW,gBAAgB;IAC/B;4DACwD;IACxD,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB;;wDAEoD;IACpD,QAAQ,CAAC,WAAW,EAAE,aAAa,CAAC,YAAY,CAAC,CAAC;IAClD;;;8BAG0B;IAC1B,QAAQ,CAAC,OAAO,EAAE,CAAC,GAAG,EAAE,eAAe,KAAK,aAAa,EAAE,CAAC;CAC7D;AAED;;;;;;;;;;;;;GAaG;AACH,eAAO,MAAM,cAAc,EAAE,QAAQ,CACnC,MAAM,CAAC,MAAM,EAAE;IAAE,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAA;CAAE,CAAC,CA2B1E,CAAC;AAiEH;;;;;;;;GAQG;AACH,eAAO,MAAM,SAAS,EAAE,aAAa,CAAC,gBAAgB,CAOpD,CAAC;AAEH;;;;;GAKG;AACH,wBAAgB,YAAY,CAC1B,GAAG,EAAE,eAAe,EACpB,SAAS,GAAE,aAAa,CAAC,gBAAgB,CAAa,GACrD,aAAa,EAAE,CAMjB;AAED;;;;GAIG;AACH,wBAAgB,UAAU,CACxB,SAAS,GAAE,aAAa,CAAC,gBAAgB,CAAa,GACrD,WAAW,CAAC,YAAY,CAAC,CAI3B"}

package/dist/baseline/producers/index.js

@@ -0,0 +1,200 @@
+"use strict";
+/**
+ * Producer registry — the single canonical home for everything that
+ * turns analyzer output into `BaselineEntry`s.
+ *
+ * # Why this exists (CLAUDE.md Rule 10)
+ *
+ * The baseline file is the durable contract the guardrail check
+ * reads. Every analyzer that surfaces per-finding output MUST flow
+ * through a registered producer so guardrails don't silently miss
+ * its findings. Without the registry, adding a new analyzer means
+ * remembering to also edit `create.ts` orchestration — easy to
+ * forget, and the bug is invisible (the guardrail check passes even
+ * when a new finding kind is silently bypassed).
+ *
+ * With the registry:
+ *   - Adding a new analyzer is a one-line `PRODUCERS.push(...)`.
+ *   - The orchestrator iterates the registry — no per-producer
+ *     `findings.push(...)` calls to forget.
+ *   - A contract test asserts every `IdentityInput` discriminant
+ *     kind is either contributed by a registered producer OR
+ *     listed in `DEFERRED_KINDS` with explicit rationale.
+ *   - A synthetic-producer playbook test asserts the orchestrator
+ *     stays registry-driven (adding a fake producer to the
+ *     registry makes its entries appear in the baseline file
+ *     without any edits to the orchestrator).
+ *
+ * # Producer contract
+ *
+ * Each producer:
+ *   1. Declares the identity kinds it contributes via `contributes`.
+ *   2. Reads from the shared `ProducerContext` (gathered once by
+ *      the orchestrator so multiple producers don't re-shell the
+ *      same analyzer).
+ *   3. Returns `BaselineEntry[]` — pure or near-pure, depending on
+ *      whether content-hash stamping is needed.
+ *
+ * # Adding a new identity kind
+ *
+ *   1. Add the discriminant to `IdentityInput` in `types.ts`.
+ *   2. Add the case branch in `identityFor`.
+ *   3. EITHER add a new producer here (or extend an existing one)
+ *      so `contributes` covers the new kind, OR add the kind to
+ *      `DEFERRED_KINDS` with rationale + landing phase.
+ *   4. Add a fixture row in `test/baseline/finding-identity.test.ts`
+ *      (Rule 9 / per-kind fixture contract).
+ *
+ * The contract test enforces steps 3 + 4 at runtime; the
+ * exhaustive switch in `identityFor` enforces step 2 at compile
+ * time. The result: no new identity kind can land in a way that
+ * silently bypasses guardrails.
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.PRODUCERS = exports.DEFERRED_KINDS = void 0;
+exports.runProducers = runProducers;
+exports.wiredKinds = wiredKinds;
+const health_1 = require("./health");
+const licenses_1 = require("./licenses");
+const quality_1 = require("./quality");
+const secret_hmac_1 = require("./secret-hmac");
+const security_1 = require("./security");
+const tests_1 = require("./tests");
+/**
+ * Identity kinds declared in `IdentityInput` but not yet wired by
+ * any producer. Each entry MUST carry a `reason` (what blocks the
+ * producer today) and `landingPhase` (when we intend to wire it).
+ * The contract test asserts:
+ *
+ *   - Every kind appearing here is NOT contributed by any
+ *     registered producer (no double-counting).
+ *   - Every `IdentityKind` is either contributed OR in this map.
+ *
+ * Adding a new identity kind without wiring a producer requires
+ * adding an entry here — the deferral becomes architecturally
+ * explicit rather than silently invisible.
+ */
+exports.DEFERRED_KINDS = Object.freeze({
+    'god-file': {
+        reason: 'graphify Python script does not yet surface per-file complexity offenders; ' +
+            'QualityMetrics.topGodFiles is forward-declared but unpopulated. ' +
+            'Substitute: large-file (>500 lines) overlaps the same files ~80%+ of the time.',
+        landingPhase: '2.6 / Phase 10s.2 (graphify-symbols expansion)',
+    },
+    hygiene: {
+        reason: 'gatherHygieneMarkers emits aggregate counts, not per-occurrence positions; ' +
+            'extending to surface Array<{file, line, marker}> is a small gather refactor. ' +
+            'Substitute: aggregate counts feed the Quality dimension score; ' +
+            'newSevereQualityIssueInChangedFiles block rule catches high-severity overlap.',
+        landingPhase: 'Phase 5 (pre-launch polish)',
+    },
+    'coverage-gap': {
+        reason: 'per-pack coverage adapters do not yet surface uncovered symbol ranges. ' +
+            'Five of eight packs (typescript / java / kotlin / ruby / go) land in ' +
+            'Phase 3.5 inside 2.5; remaining three (python / csharp / rust) decided ' +
+            'mid-Phase-3.5 based on adapter complexity. ' +
+            'Substitute: test-gap covers file-level untested; new uncovered functions ' +
+            'inside an already-tested file remain invisible until Phase 3.5 lands.',
+        landingPhase: 'Phase 3.5 (5 packs) / 2.6 (remaining)',
+    },
+});
+// ─── Producer module wrappers ─────────────────────────────────────────────
+// Each wraps a producer module's pure function with the registry's
+// `BaselineProducer` shape. Kept in this file (rather than alongside
+// each producer module) so the registry stays the single discovery
+// surface — readers see every wired producer + every deferral in
+// one place.
+const SECURITY_PRODUCER = {
+    name: 'security',
+    contributes: ['secret', 'code', 'config', 'dep-vuln'],
+    produce(ctx) {
+        const aggregate = ctx.analysisResult.capabilities.securityAggregate;
+        if (!aggregate)
+            return [];
+        return (0, security_1.securityAggregateToBaselineEntries)(aggregate, {
+            cwd: ctx.cwd,
+            commitSha: ctx.commitSha || undefined,
+        });
+    },
+};
+const SECRET_HMAC_PRODUCER = {
+    name: 'secret-hmac',
+    contributes: ['secret-hmac'],
+    produce(ctx) {
+        return (0, secret_hmac_1.rawSecretsToBaselineEntries)({ rawSecrets: ctx.rawSecrets, salt: ctx.salt });
+    },
+};
+const QUALITY_PRODUCER = {
+    name: 'quality',
+    contributes: ['duplication', 'stale-file'],
+    produce(ctx) {
+        return [
+            ...(0, quality_1.duplicationToBaselineEntries)(ctx.analysisResult.capabilities.duplication),
+            ...(0, quality_1.staleFilesToBaselineEntries)(ctx.hygiene.staleFiles),
+        ];
+    },
+};
+const HEALTH_PRODUCER = {
+    name: 'health',
+    contributes: ['large-file'],
+    produce(ctx) {
+        return (0, health_1.largeFilesToBaselineEntries)(ctx.analysisResult.metrics);
+    },
+};
+const LICENSES_PRODUCER = {
+    name: 'licenses',
+    contributes: ['license'],
+    produce(ctx) {
+        return (0, licenses_1.licensesToBaselineEntries)(ctx.analysisResult.capabilities.licenses);
+    },
+};
+const TESTS_PRODUCER = {
+    name: 'tests',
+    contributes: ['test-gap', 'test-file-degradation'],
+    produce(ctx) {
+        return (0, tests_1.testGapsToBaselineEntries)(ctx.testGapsReport);
+    },
+};
+/**
+ * The canonical producer list. Order is preserved in baseline-file
+ * output for deterministic diffs; adding a new producer appends
+ * here and updates the contract-test expectations.
+ *
+ * Mutable for the synthetic-producer playbook test: the test
+ * substitutes a wrapped registry rather than mutating PRODUCERS
+ * directly. Callers MUST treat this as immutable.
+ */
+exports.PRODUCERS = Object.freeze([
+    SECURITY_PRODUCER,
+    SECRET_HMAC_PRODUCER,
+    QUALITY_PRODUCER,
+    HEALTH_PRODUCER,
+    LICENSES_PRODUCER,
+    TESTS_PRODUCER,
+]);
+/**
+ * Run every producer in `producers` against the shared context and
+ * flatten the result. The orchestrator calls this with `PRODUCERS`
+ * for production use; the playbook test calls it with an extended
+ * list to verify synthetic producers flow through.
+ */
+function runProducers(ctx, producers = exports.PRODUCERS) {
+    const out = [];
+    for (const producer of producers) {
+        out.push(...producer.produce(ctx));
+    }
+    return out;
+}
+/**
+ * Every kind currently contributed by some producer in `producers`.
+ * Convenience used by the contract test + by the orchestrator for
+ * logging "this run produced entries across N kinds."
+ */
+function wiredKinds(producers = exports.PRODUCERS) {
+    const out = new Set();
+    for (const p of producers)
+        for (const k of p.contributes)
+            out.add(k);
+    return out;
+}
+//# sourceMappingURL=index.js.map