@vyuhlabs/dxkit 2.4.8 → 2.5.0

package/dist/baseline/producers/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../src/baseline/producers/index.ts"],"names":[],"mappings":";AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAkDG;;;AAuNH,oCASC;AAOD,gCAMC;AAvOD,qCAAuD;AACvD,yCAAuD;AACvD,uCAAsF;AACtF,+CAA4D;AAC5D,yCAAgE;AAChE,mCAAoD;AAyEpD;;;;;;;;;;;;;GAaG;AACU,QAAA,cAAc,GAEvB,MAAM,CAAC,MAAM,CAAC;IAChB,UAAU,EAAE;QACV,MAAM,EACJ,6EAA6E;YAC7E,kEAAkE;YAClE,gFAAgF;QAClF,YAAY,EAAE,gDAAgD;KAC/D;IACD,OAAO,EAAE;QACP,MAAM,EACJ,6EAA6E;YAC7E,+EAA+E;YAC/E,iEAAiE;YACjE,+EAA+E;QACjF,YAAY,EAAE,6BAA6B;KAC5C;IACD,cAAc,EAAE;QACd,MAAM,EACJ,yEAAyE;YACzE,uEAAuE;YACvE,yEAAyE;YACzE,6CAA6C;YAC7C,2EAA2E;YAC3E,uEAAuE;QACzE,YAAY,EAAE,uCAAuC;KACtD;CACF,CAAC,CAAC;AAEH,6EAA6E;AAC7E,mEAAmE;AACnE,qEAAqE;AACrE,mEAAmE;AACnE,iEAAiE;AACjE,aAAa;AAEb,MAAM,iBAAiB,GAAqB;IAC1C,IAAI,EAAE,UAAU;IAChB,WAAW,EAAE,CAAC,QAAQ,EAAE,MAAM,EAAE,QAAQ,EAAE,UAAU,CAAC;IACrD,OAAO,CAAC,GAAG;QACT,MAAM,SAAS,GAAG,GAAG,CAAC,cAAc,CAAC,YAAY,CAAC,iBAAiB,CAAC;QACpE,IAAI,CAAC,SAAS;YAAE,OAAO,EAAE,CAAC;QAC1B,OAAO,IAAA,6CAAkC,EAAC,SAAS,EAAE;YACnD,GAAG,EAAE,GAAG,CAAC,GAAG;YACZ,SAAS,EAAE,GAAG,CAAC,SAAS,IAAI,SAAS;SACtC,CAAC,CAAC;IACL,CAAC;CACF,CAAC;AAEF,MAAM,oBAAoB,GAAqB;IAC7C,IAAI,EAAE,aAAa;IACnB,WAAW,EAAE,CAAC,aAAa,CAAC;IAC5B,OAAO,CAAC,GAAG;QACT,OAAO,IAAA,yCAA2B,EAAC,EAAE,UAAU,EAAE,GAAG,CAAC,UAAU,EAAE,IAAI,EAAE,GAAG,CAAC,IAAI,EAAE,CAAC,CAAC;IACrF,CAAC;CACF,CAAC;AAEF,MAAM,gBAAgB,GAAqB;IACzC,IAAI,EAAE,SAAS;IACf,WAAW,EAAE,CAAC,aAAa,EAAE,YAAY,CAAC;IAC1C,OAAO,CAAC,GAAG;QACT,OAAO;YACL,GAAG,IAAA,sCAA4B,EAAC,GAAG,CAAC,cAAc,CAAC,YAAY,CAAC,WAAW,CAAC;YAC5E,GAAG,IAAA,qCAA2B,EAAC,GAAG,CAAC,OAAO,CAAC,UAAU,CAAC;SACvD,CAAC;IACJ,CAAC;CACF,CAAC;AAEF,MAAM,eAAe,GAAqB;IACxC,IAAI,EAAE,QAAQ;IACd,WAAW,EAAE,CAAC,YAAY,CAAC;IAC3B,OAAO,CAAC,GAAG;QACT,OAAO,IAAA,oCAA2B,EAAC,GAAG,CAAC,cAAc,CAAC,OAAO,CAAC,CAAC;IACjE,CAAC;CACF,CAAC;AAEF,MAAM,iBAAiB,GAAqB;IAC1C,IAAI,EAAE,UAAU;IAChB,WAAW,EAAE,CAAC,SAAS,CAAC;IACxB,OAAO,CAAC,GAAG;QACT,OAAO,IAAA,oCAAyB,EAAC,GAAG,CAAC,cAAc,CAAC,YAAY,CAAC,QAAQ,CAAC,CAAC;IAC7E,CAAC;CACF,CAAC;AAEF,MAAM,cAAc,GAAqB;IACvC,IAAI,EAAE,OAAO;IACb,WAAW,EAAE,CAAC,UAAU,EAAE,uBAAuB,CAAC;IAClD,OAAO,CAAC,GAAG;QACT,OAAO,IAAA,iCAAyB,EAAC,GAAG,CAAC,cAAc,CAAC,CAAC;IACvD,CAAC;CACF,CAAC;AAEF;;;;;;;;GAQG;AACU,QAAA,SAAS,GAAoC,MAAM,CAAC,MAAM,CAAC;IACtE,iBAAiB;IACjB,oBAAoB;IACpB,gBAAgB;IAChB,eAAe;IACf,iBAAiB;IACjB,cAAc;CACf,CAAC,CAAC;AAEH;;;;;GAKG;AACH,SAAgB,YAAY,CAC1B,GAAoB,EACpB,YAA6C,iBAAS;IAEtD,MAAM,GAAG,GAAoB,EAAE,CAAC;IAChC,KAAK,MAAM,QAAQ,IAAI,SAAS,EAAE,CAAC;QACjC,GAAG,CAAC,IAAI,CAAC,GAAG,QAAQ,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC;IACrC,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED;;;;GAIG;AACH,SAAgB,UAAU,CACxB,YAA6C,iBAAS;IAEtD,MAAM,GAAG,GAAG,IAAI,GAAG,EAAgB,CAAC;IACpC,KAAK,MAAM,CAAC,IAAI,SAAS;QAAE,KAAK,MAAM,CAAC,IAAI,CAAC,CAAC,WAAW;YAAE,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;IACrE,OAAO,GAAG,CAAC;AACb,CAAC"}

package/dist/baseline/producers/licenses.d.ts

@@ -0,0 +1,23 @@
+/**
+ * Licenses → baseline-entry producer.
+ *
+ * One kind: `license` — per-package license attribution.
+ * `(package, version, licenseType)` is the identity tuple, so a
+ * re-licensing event on the same pinned version (compliance teams'
+ * canonical concern) registers as a fresh finding even when no
+ * version bump happened.
+ *
+ * Reads from `CapabilityReport.licenses.findings` — already in the
+ * cached `AnalysisResult`, no extra gather work needed. Pure
+ * function over its input.
+ */
+import type { BaselineEntry } from '../types';
+import type { LicensesResult } from '../../languages/capabilities/types';
+/**
+ * Build `license` entries from a licenses capability envelope.
+ * Findings with an empty `licenseType` are emitted with the literal
+ * `'UNKNOWN'` so identity stays stable across runs even when the
+ * underlying tool can't resolve the SPDX id.
+ */
+export declare function licensesToBaselineEntries(licenses: LicensesResult | undefined): BaselineEntry[];
+//# sourceMappingURL=licenses.d.ts.map

package/dist/baseline/producers/licenses.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"licenses.d.ts","sourceRoot":"","sources":["../../../src/baseline/producers/licenses.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAGH,OAAO,KAAK,EAAE,aAAa,EAAwB,MAAM,UAAU,CAAC;AACpE,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,oCAAoC,CAAC;AAEzE;;;;;GAKG;AACH,wBAAgB,yBAAyB,CAAC,QAAQ,EAAE,cAAc,GAAG,SAAS,GAAG,aAAa,EAAE,CAoB/F"}

package/dist/baseline/producers/licenses.js

@@ -0,0 +1,46 @@
+"use strict";
+/**
+ * Licenses → baseline-entry producer.
+ *
+ * One kind: `license` — per-package license attribution.
+ * `(package, version, licenseType)` is the identity tuple, so a
+ * re-licensing event on the same pinned version (compliance teams'
+ * canonical concern) registers as a fresh finding even when no
+ * version bump happened.
+ *
+ * Reads from `CapabilityReport.licenses.findings` — already in the
+ * cached `AnalysisResult`, no extra gather work needed. Pure
+ * function over its input.
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.licensesToBaselineEntries = licensesToBaselineEntries;
+const finding_identity_1 = require("../finding-identity");
+/**
+ * Build `license` entries from a licenses capability envelope.
+ * Findings with an empty `licenseType` are emitted with the literal
+ * `'UNKNOWN'` so identity stays stable across runs even when the
+ * underlying tool can't resolve the SPDX id.
+ */
+function licensesToBaselineEntries(licenses) {
+    if (!licenses)
+        return [];
+    const out = [];
+    for (const f of licenses.findings) {
+        const licenseType = f.licenseType.length > 0 ? f.licenseType : 'UNKNOWN';
+        const input = {
+            kind: 'license',
+            package: f.package,
+            version: f.version,
+            licenseType,
+        };
+        out.push({
+            id: (0, finding_identity_1.identityFor)(input),
+            kind: 'license',
+            package: f.package,
+            version: f.version,
+            licenseType,
+        });
+    }
+    return out;
+}
+//# sourceMappingURL=licenses.js.map

package/dist/baseline/producers/licenses.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"licenses.js","sourceRoot":"","sources":["../../../src/baseline/producers/licenses.ts"],"names":[],"mappings":";AAAA;;;;;;;;;;;;GAYG;;AAYH,8DAoBC;AA9BD,0DAAkD;AAIlD;;;;;GAKG;AACH,SAAgB,yBAAyB,CAAC,QAAoC;IAC5E,IAAI,CAAC,QAAQ;QAAE,OAAO,EAAE,CAAC;IACzB,MAAM,GAAG,GAAoB,EAAE,CAAC;IAChC,KAAK,MAAM,CAAC,IAAI,QAAQ,CAAC,QAAQ,EAAE,CAAC;QAClC,MAAM,WAAW,GAAG,CAAC,CAAC,WAAW,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,SAAS,CAAC;QACzE,MAAM,KAAK,GAAyB;YAClC,IAAI,EAAE,SAAS;YACf,OAAO,EAAE,CAAC,CAAC,OAAO;YAClB,OAAO,EAAE,CAAC,CAAC,OAAO;YAClB,WAAW;SACZ,CAAC;QACF,GAAG,CAAC,IAAI,CAAC;YACP,EAAE,EAAE,IAAA,8BAAW,EAAC,KAAK,CAAC;YACtB,IAAI,EAAE,SAAS;YACf,OAAO,EAAE,CAAC,CAAC,OAAO;YAClB,OAAO,EAAE,CAAC,CAAC,OAAO;YAClB,WAAW;SACZ,CAAC,CAAC;IACL,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC"}

package/dist/baseline/producers/quality.d.ts

@@ -0,0 +1,39 @@
+/**
+ * Quality → baseline-entry producer.
+ *
+ * Two kinds today:
+ *
+ *   - `duplication` — jscpd-detected clone pairs from
+ *     `CapabilityReport.duplication.topClones`. The clone detector
+ *     emits each pair as `{ a: { file, ... }, b: { file, ... },
+ *     tokens, lines }`; identity is `(fileA, fileB, tokens)` with file
+ *     order normalized inside `identityFor` so reversed pairs hash
+ *     identically.
+ *
+ *   - `stale-file` — `.swp`, `.bak`, `.orig`, `.tmp`, `.swo`, `.pyc`,
+ *     `.log` files tracked in git. The producer accepts the file
+ *     list directly (the orchestrator passes
+ *     `gatherHygieneMarkers(cwd).staleFiles`) so the producer stays
+ *     pure and the I/O lives in the canonical hygiene gather.
+ *
+ * Two kinds intentionally NOT produced yet:
+ *
+ *   - `god-file` — the `QualityMetrics.topGodFiles` field is
+ *     forward-declared but no analyzer populates it today. Lights
+ *     up when graphify surfaces per-file complexity offenders.
+ *
+ *   - `hygiene` — per-occurrence locations (file + line + marker
+ *     kind) require extending `gatherHygieneMarkers` to emit
+ *     positions, not just counts. Pending in a follow-up commit.
+ */
+import type { BaselineEntry } from '../types';
+import type { DuplicationResult } from '../../languages/capabilities/types';
+/** Build `duplication` entries from a jscpd-style envelope. */
+export declare function duplicationToBaselineEntries(duplication: DuplicationResult | undefined): BaselineEntry[];
+/**
+ * Build `stale-file` entries from a list of repo-relative paths.
+ * Files with a suffix outside the canonical stale set are skipped
+ * (defensive — the caller's gather should already have filtered).
+ */
+export declare function staleFilesToBaselineEntries(staleFiles: ReadonlyArray<string>): BaselineEntry[];
+//# sourceMappingURL=quality.d.ts.map

package/dist/baseline/producers/quality.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"quality.d.ts","sourceRoot":"","sources":["../../../src/baseline/producers/quality.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2BG;AAGH,OAAO,KAAK,EAAE,aAAa,EAAoD,MAAM,UAAU,CAAC;AAChG,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,oCAAoC,CAAC;AAQ5E,+DAA+D;AAC/D,wBAAgB,4BAA4B,CAC1C,WAAW,EAAE,iBAAiB,GAAG,SAAS,GACzC,aAAa,EAAE,CAuBjB;AAED;;;;GAIG;AACH,wBAAgB,2BAA2B,CAAC,UAAU,EAAE,aAAa,CAAC,MAAM,CAAC,GAAG,aAAa,EAAE,CAW9F"}

package/dist/baseline/producers/quality.js

@@ -0,0 +1,84 @@
+"use strict";
+/**
+ * Quality → baseline-entry producer.
+ *
+ * Two kinds today:
+ *
+ *   - `duplication` — jscpd-detected clone pairs from
+ *     `CapabilityReport.duplication.topClones`. The clone detector
+ *     emits each pair as `{ a: { file, ... }, b: { file, ... },
+ *     tokens, lines }`; identity is `(fileA, fileB, tokens)` with file
+ *     order normalized inside `identityFor` so reversed pairs hash
+ *     identically.
+ *
+ *   - `stale-file` — `.swp`, `.bak`, `.orig`, `.tmp`, `.swo`, `.pyc`,
+ *     `.log` files tracked in git. The producer accepts the file
+ *     list directly (the orchestrator passes
+ *     `gatherHygieneMarkers(cwd).staleFiles`) so the producer stays
+ *     pure and the I/O lives in the canonical hygiene gather.
+ *
+ * Two kinds intentionally NOT produced yet:
+ *
+ *   - `god-file` — the `QualityMetrics.topGodFiles` field is
+ *     forward-declared but no analyzer populates it today. Lights
+ *     up when graphify surfaces per-file complexity offenders.
+ *
+ *   - `hygiene` — per-occurrence locations (file + line + marker
+ *     kind) require extending `gatherHygieneMarkers` to emit
+ *     positions, not just counts. Pending in a follow-up commit.
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.duplicationToBaselineEntries = duplicationToBaselineEntries;
+exports.staleFilesToBaselineEntries = staleFilesToBaselineEntries;
+const finding_identity_1 = require("../finding-identity");
+/** Suffix set the hygiene gather flags as stale on-disk artifacts.
+ *  Mirror of the shell glob in `gatherHygieneMarkers`; lives here
+ *  so the producer can derive the per-file suffix without re-parsing
+ *  the path. */
+const STALE_SUFFIXES = new Set(['swp', 'swo', 'bak', 'orig', 'tmp', 'log', 'pyc']);
+/** Build `duplication` entries from a jscpd-style envelope. */
+function duplicationToBaselineEntries(duplication) {
+    if (!duplication)
+        return [];
+    const out = [];
+    for (const clone of duplication.topClones) {
+        const input = {
+            kind: 'duplication',
+            fileA: clone.a.file,
+            fileB: clone.b.file,
+            lines: clone.lines,
+            startLineA: clone.a.startLine,
+            startLineB: clone.b.startLine,
+        };
+        out.push({
+            id: (0, finding_identity_1.identityFor)(input),
+            kind: 'duplication',
+            fileA: clone.a.file,
+            fileB: clone.b.file,
+            lines: clone.lines,
+            startLineA: clone.a.startLine,
+            startLineB: clone.b.startLine,
+        });
+    }
+    return out;
+}
+/**
+ * Build `stale-file` entries from a list of repo-relative paths.
+ * Files with a suffix outside the canonical stale set are skipped
+ * (defensive — the caller's gather should already have filtered).
+ */
+function staleFilesToBaselineEntries(staleFiles) {
+    const out = [];
+    for (const file of staleFiles) {
+        const dot = file.lastIndexOf('.');
+        if (dot < 0)
+            continue;
+        const suffix = file.slice(dot + 1).toLowerCase();
+        if (!STALE_SUFFIXES.has(suffix))
+            continue;
+        const input = { kind: 'stale-file', file, suffix };
+        out.push({ id: (0, finding_identity_1.identityFor)(input), kind: 'stale-file', file, suffix });
+    }
+    return out;
+}
+//# sourceMappingURL=quality.js.map

package/dist/baseline/producers/quality.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"quality.js","sourceRoot":"","sources":["../../../src/baseline/producers/quality.ts"],"names":[],"mappings":";AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2BG;;AAaH,oEAyBC;AAOD,kEAWC;AAtDD,0DAAkD;AAIlD;;;gBAGgB;AAChB,MAAM,cAAc,GAAG,IAAI,GAAG,CAAC,CAAC,KAAK,EAAE,KAAK,EAAE,KAAK,EAAE,MAAM,EAAE,KAAK,EAAE,KAAK,EAAE,KAAK,CAAC,CAAC,CAAC;AAEnF,+DAA+D;AAC/D,SAAgB,4BAA4B,CAC1C,WAA0C;IAE1C,IAAI,CAAC,WAAW;QAAE,OAAO,EAAE,CAAC;IAC5B,MAAM,GAAG,GAAoB,EAAE,CAAC;IAChC,KAAK,MAAM,KAAK,IAAI,WAAW,CAAC,SAAS,EAAE,CAAC;QAC1C,MAAM,KAAK,GAA6B;YACtC,IAAI,EAAE,aAAa;YACnB,KAAK,EAAE,KAAK,CAAC,CAAC,CAAC,IAAI;YACnB,KAAK,EAAE,KAAK,CAAC,CAAC,CAAC,IAAI;YACnB,KAAK,EAAE,KAAK,CAAC,KAAK;YAClB,UAAU,EAAE,KAAK,CAAC,CAAC,CAAC,SAAS;YAC7B,UAAU,EAAE,KAAK,CAAC,CAAC,CAAC,SAAS;SAC9B,CAAC;QACF,GAAG,CAAC,IAAI,CAAC;YACP,EAAE,EAAE,IAAA,8BAAW,EAAC,KAAK,CAAC;YACtB,IAAI,EAAE,aAAa;YACnB,KAAK,EAAE,KAAK,CAAC,CAAC,CAAC,IAAI;YACnB,KAAK,EAAE,KAAK,CAAC,CAAC,CAAC,IAAI;YACnB,KAAK,EAAE,KAAK,CAAC,KAAK;YAClB,UAAU,EAAE,KAAK,CAAC,CAAC,CAAC,SAAS;YAC7B,UAAU,EAAE,KAAK,CAAC,CAAC,CAAC,SAAS;SAC9B,CAAC,CAAC;IACL,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED;;;;GAIG;AACH,SAAgB,2BAA2B,CAAC,UAAiC;IAC3E,MAAM,GAAG,GAAoB,EAAE,CAAC;IAChC,KAAK,MAAM,IAAI,IAAI,UAAU,EAAE,CAAC;QAC9B,MAAM,GAAG,GAAG,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC;QAClC,IAAI,GAAG,GAAG,CAAC;YAAE,SAAS;QACtB,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,GAAG,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC;QACjD,IAAI,CAAC,cAAc,CAAC,GAAG,CAAC,MAAM,CAAC;YAAE,SAAS;QAC1C,MAAM,KAAK,GAA2B,EAAE,IAAI,EAAE,YAAY,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC;QAC3E,GAAG,CAAC,IAAI,CAAC,EAAE,EAAE,EAAE,IAAA,8BAAW,EAAC,KAAK,CAAC,EAAE,IAAI,EAAE,YAAY,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC,CAAC;IACzE,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC"}

package/dist/baseline/producers/secret-hmac.d.ts

@@ -0,0 +1,45 @@
+/**
+ * Secret-HMAC → baseline-entry producer.
+ *
+ * Companion to the location-based `secret` producer. A secret detected
+ * by gitleaks gets two baseline entries: the `secret` entry pins its
+ * file + line (stable across re-runs at the same position); the
+ * `secret-hmac` entry pins its HMAC (stable when the same secret value
+ * appears at a different file or line, e.g., a leaked token moved
+ * from `.env` to `src/config.ts`).
+ *
+ * The HMAC is computed via the canonical `computeSecretHmac` helper
+ * with the per-repo salt resolved by `resolveSalt`. The raw secret
+ * value lives only in the gitleaks outcome (`GitleaksRawSecret`)
+ * carried through process memory; this producer hashes it once and
+ * discards it. Nothing reaches disk except the 16-char HMAC.
+ *
+ * Producer scope: this module is consumed exclusively by
+ * `dxkit baseline create` (and, in C3, by `guardrail check` for the
+ * current-side scan). It is NOT consumed by the security analyzer's
+ * normal report path — those code paths never see the raw secret
+ * value, so the HMAC machinery stays out of the public envelope.
+ */
+import type { GitleaksRawSecret } from '../../analyzers/tools/gitleaks';
+import type { BaselineEntry } from '../types';
+export interface SecretHmacProducerInput {
+    /** Raw secrets from `gatherGitleaksResult(cwd).rawSecrets`. */
+    readonly rawSecrets: ReadonlyArray<GitleaksRawSecret>;
+    /** Resolved repo salt (from `resolveSalt(cwd)`). The producer
+     *  doesn't care which mode resolved it — the baseline file's
+     *  `saltMode` is recorded separately so consumers know how to
+     *  re-derive the same salt at check time. */
+    readonly salt: string;
+}
+/**
+ * Build `secret-hmac` baseline entries from a list of raw secrets +
+ * the repo salt. The output preserves the input order so a baseline
+ * regenerated against the same scan is byte-stable.
+ *
+ * Tool name on every emitted entry is `'gitleaks'` — the only
+ * upstream source today. Future scanners (trufflehog-compatible
+ * etc.) would add their own producer; the canonical-rule mapping
+ * collapses cross-tool overlaps inside `identityFor`.
+ */
+export declare function rawSecretsToBaselineEntries(input: SecretHmacProducerInput): BaselineEntry[];
+//# sourceMappingURL=secret-hmac.d.ts.map

package/dist/baseline/producers/secret-hmac.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"secret-hmac.d.ts","sourceRoot":"","sources":["../../../src/baseline/producers/secret-hmac.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;GAqBG;AAGH,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,gCAAgC,CAAC;AAExE,OAAO,KAAK,EAAE,aAAa,EAA2B,MAAM,UAAU,CAAC;AAEvE,MAAM,WAAW,uBAAuB;IACtC,+DAA+D;IAC/D,QAAQ,CAAC,UAAU,EAAE,aAAa,CAAC,iBAAiB,CAAC,CAAC;IACtD;;;iDAG6C;IAC7C,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;CACvB;AAED;;;;;;;;;GASG;AACH,wBAAgB,2BAA2B,CAAC,KAAK,EAAE,uBAAuB,GAAG,aAAa,EAAE,CA6B3F"}

package/dist/baseline/producers/secret-hmac.js

@@ -0,0 +1,70 @@
+"use strict";
+/**
+ * Secret-HMAC → baseline-entry producer.
+ *
+ * Companion to the location-based `secret` producer. A secret detected
+ * by gitleaks gets two baseline entries: the `secret` entry pins its
+ * file + line (stable across re-runs at the same position); the
+ * `secret-hmac` entry pins its HMAC (stable when the same secret value
+ * appears at a different file or line, e.g., a leaked token moved
+ * from `.env` to `src/config.ts`).
+ *
+ * The HMAC is computed via the canonical `computeSecretHmac` helper
+ * with the per-repo salt resolved by `resolveSalt`. The raw secret
+ * value lives only in the gitleaks outcome (`GitleaksRawSecret`)
+ * carried through process memory; this producer hashes it once and
+ * discards it. Nothing reaches disk except the 16-char HMAC.
+ *
+ * Producer scope: this module is consumed exclusively by
+ * `dxkit baseline create` (and, in C3, by `guardrail check` for the
+ * current-side scan). It is NOT consumed by the security analyzer's
+ * normal report path — those code paths never see the raw secret
+ * value, so the HMAC machinery stays out of the public envelope.
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.rawSecretsToBaselineEntries = rawSecretsToBaselineEntries;
+const fingerprint_1 = require("../../analyzers/tools/fingerprint");
+const finding_identity_1 = require("../finding-identity");
+/**
+ * Build `secret-hmac` baseline entries from a list of raw secrets +
+ * the repo salt. The output preserves the input order so a baseline
+ * regenerated against the same scan is byte-stable.
+ *
+ * Tool name on every emitted entry is `'gitleaks'` — the only
+ * upstream source today. Future scanners (trufflehog-compatible
+ * etc.) would add their own producer; the canonical-rule mapping
+ * collapses cross-tool overlaps inside `identityFor`.
+ */
+function rawSecretsToBaselineEntries(input) {
+    const out = [];
+    // Identity is `(rule, hmac)` — two raw secrets that map to the same
+    // `(rule, hmac)` (the same value detected at multiple lines, or by
+    // overlapping gitleaks rules pointing at the same canonical kind)
+    // collapse to one baseline entry. The location-based `secret`
+    // producer still records each occurrence separately.
+    const seen = new Set();
+    for (const raw of input.rawSecrets) {
+        if (!raw.secret)
+            continue;
+        const hmac = (0, fingerprint_1.computeSecretHmac)(raw.secret, input.salt);
+        const identityInput = {
+            kind: 'secret-hmac',
+            tool: 'gitleaks',
+            rule: raw.rule,
+            hmac,
+        };
+        const id = (0, finding_identity_1.identityFor)(identityInput);
+        if (seen.has(id))
+            continue;
+        seen.add(id);
+        out.push({
+            id,
+            kind: 'secret-hmac',
+            tool: 'gitleaks',
+            rule: raw.rule,
+            hmac,
+        });
+    }
+    return out;
+}
+//# sourceMappingURL=secret-hmac.js.map

package/dist/baseline/producers/secret-hmac.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"secret-hmac.js","sourceRoot":"","sources":["../../../src/baseline/producers/secret-hmac.ts"],"names":[],"mappings":";AAAA;;;;;;;;;;;;;;;;;;;;;GAqBG;;AA2BH,kEA6BC;AAtDD,mEAAsE;AAEtE,0DAAkD;AAalD;;;;;;;;;GASG;AACH,SAAgB,2BAA2B,CAAC,KAA8B;IACxE,MAAM,GAAG,GAAoB,EAAE,CAAC;IAChC,oEAAoE;IACpE,mEAAmE;IACnE,kEAAkE;IAClE,8DAA8D;IAC9D,qDAAqD;IACrD,MAAM,IAAI,GAAG,IAAI,GAAG,EAAU,CAAC;IAC/B,KAAK,MAAM,GAAG,IAAI,KAAK,CAAC,UAAU,EAAE,CAAC;QACnC,IAAI,CAAC,GAAG,CAAC,MAAM;YAAE,SAAS;QAC1B,MAAM,IAAI,GAAG,IAAA,+BAAiB,EAAC,GAAG,CAAC,MAAM,EAAE,KAAK,CAAC,IAAI,CAAC,CAAC;QACvD,MAAM,aAAa,GAA4B;YAC7C,IAAI,EAAE,aAAa;YACnB,IAAI,EAAE,UAAU;YAChB,IAAI,EAAE,GAAG,CAAC,IAAI;YACd,IAAI;SACL,CAAC;QACF,MAAM,EAAE,GAAG,IAAA,8BAAW,EAAC,aAAa,CAAC,CAAC;QACtC,IAAI,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC;YAAE,SAAS;QAC3B,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QACb,GAAG,CAAC,IAAI,CAAC;YACP,EAAE;YACF,IAAI,EAAE,aAAa;YACnB,IAAI,EAAE,UAAU;YAChB,IAAI,EAAE,GAAG,CAAC,IAAI;YACd,IAAI;SACL,CAAC,CAAC;IACL,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC"}

package/dist/baseline/producers/security.d.ts

@@ -0,0 +1,59 @@
+/**
+ * Security → baseline-entry producer.
+ *
+ * Converts the canonical `SecurityAggregate` produced by the security
+ * analyzer (`src/analyzers/security/aggregator.ts`) into the per-kind
+ * `BaselineEntry` shape stored in the baseline file. Pure function
+ * over its input apart from the optional content-hash stamp, which
+ * reads the file at the baseline commit via git (skipped when the
+ * caller doesn't supply a commit SHA).
+ *
+ * Four `BaselineEntry` kinds are derived here, matching the four
+ * categories the aggregator emits:
+ *
+ *   - `findingsByCategory.secret`    → kind: 'secret'
+ *   - `findingsByCategory.code`      → kind: 'code'
+ *   - `findingsByCategory.config`    → kind: 'config'
+ *   - `findingsByCategory.dependency`→ kind: 'dep-vuln'
+ *
+ * The location-based `secret` entries are sufficient for tracking a
+ * secret that stays in the same file. The companion `secret-hmac`
+ * scheme (recognizes a leaked token moving files) requires raw
+ * secret values that the aggregator doesn't carry — those entries
+ * are produced by the sibling `secret-hmac.ts` producer. The two
+ * schemes co-exist: a single underlying secret can be represented by
+ * both a `secret` entry (location identity, stable across re-runs at
+ * the same line) and a `secret-hmac` entry (content identity, stable
+ * across file moves).
+ *
+ * Content-hash stamping (third-pass matcher fallback): when `cwd` +
+ * `commitSha` are supplied, the producer reads each file at the
+ * baseline commit and hashes the normalized context window around
+ * the finding's line. The hash lands in `BaselineEntry.contentHash`
+ * for the secret / code / config kinds; the matcher's content-hash
+ * pass uses it to pair findings across runs even when git diff can't
+ * map the line position. Producers can pass `undefined` for the SHA
+ * (e.g., non-git directories) and content-hash matching is simply
+ * unavailable for that baseline — the matcher's other passes still
+ * work.
+ */
+import type { SecurityAggregate } from '../../analyzers/security/aggregator';
+import type { BaselineEntry } from '../types';
+export interface SecurityProducerOptions {
+    /** Repo path; used by `computeContentHashFromCommit` to invoke
+     *  `git show`. Omitting it disables content-hash stamping. */
+    readonly cwd?: string;
+    /** Commit SHA the baseline is anchored to. When the working tree
+     *  has uncommitted changes, callers may pass `'HEAD'` so the hash
+     *  reflects committed state — content-hash matching against a
+     *  later run will still work as long as both sides read the same
+     *  SHA. */
+    readonly commitSha?: string;
+}
+/**
+ * Build `BaselineEntry`s from a `SecurityAggregate`. Returned in the
+ * iteration order of the four categories so the produced baseline
+ * stays stable across re-runs of the same scan.
+ */
+export declare function securityAggregateToBaselineEntries(aggregate: SecurityAggregate, options?: SecurityProducerOptions): BaselineEntry[];
+//# sourceMappingURL=security.d.ts.map

package/dist/baseline/producers/security.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"security.d.ts","sourceRoot":"","sources":["../../../src/baseline/producers/security.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAsCG;AAGH,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,qCAAqC,CAAC;AAE7E,OAAO,KAAK,EACV,aAAa,EAKd,MAAM,UAAU,CAAC;AAElB,MAAM,WAAW,uBAAuB;IACtC;kEAC8D;IAC9D,QAAQ,CAAC,GAAG,CAAC,EAAE,MAAM,CAAC;IACtB;;;;eAIW;IACX,QAAQ,CAAC,SAAS,CAAC,EAAE,MAAM,CAAC;CAC7B;AAED;;;;GAIG;AACH,wBAAgB,kCAAkC,CAChD,SAAS,EAAE,iBAAiB,EAC5B,OAAO,GAAE,uBAA4B,GACpC,aAAa,EAAE,CAwFjB"}

package/dist/baseline/producers/security.js

@@ -0,0 +1,135 @@
+"use strict";
+/**
+ * Security → baseline-entry producer.
+ *
+ * Converts the canonical `SecurityAggregate` produced by the security
+ * analyzer (`src/analyzers/security/aggregator.ts`) into the per-kind
+ * `BaselineEntry` shape stored in the baseline file. Pure function
+ * over its input apart from the optional content-hash stamp, which
+ * reads the file at the baseline commit via git (skipped when the
+ * caller doesn't supply a commit SHA).
+ *
+ * Four `BaselineEntry` kinds are derived here, matching the four
+ * categories the aggregator emits:
+ *
+ *   - `findingsByCategory.secret`    → kind: 'secret'
+ *   - `findingsByCategory.code`      → kind: 'code'
+ *   - `findingsByCategory.config`    → kind: 'config'
+ *   - `findingsByCategory.dependency`→ kind: 'dep-vuln'
+ *
+ * The location-based `secret` entries are sufficient for tracking a
+ * secret that stays in the same file. The companion `secret-hmac`
+ * scheme (recognizes a leaked token moving files) requires raw
+ * secret values that the aggregator doesn't carry — those entries
+ * are produced by the sibling `secret-hmac.ts` producer. The two
+ * schemes co-exist: a single underlying secret can be represented by
+ * both a `secret` entry (location identity, stable across re-runs at
+ * the same line) and a `secret-hmac` entry (content identity, stable
+ * across file moves).
+ *
+ * Content-hash stamping (third-pass matcher fallback): when `cwd` +
+ * `commitSha` are supplied, the producer reads each file at the
+ * baseline commit and hashes the normalized context window around
+ * the finding's line. The hash lands in `BaselineEntry.contentHash`
+ * for the secret / code / config kinds; the matcher's content-hash
+ * pass uses it to pair findings across runs even when git diff can't
+ * map the line position. Producers can pass `undefined` for the SHA
+ * (e.g., non-git directories) and content-hash matching is simply
+ * unavailable for that baseline — the matcher's other passes still
+ * work.
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.securityAggregateToBaselineEntries = securityAggregateToBaselineEntries;
+const content_hash_1 = require("../content-hash");
+const finding_identity_1 = require("../finding-identity");
+/**
+ * Build `BaselineEntry`s from a `SecurityAggregate`. Returned in the
+ * iteration order of the four categories so the produced baseline
+ * stays stable across re-runs of the same scan.
+ */
+function securityAggregateToBaselineEntries(aggregate, options = {}) {
+    const out = [];
+    const stamp = (file, line) => {
+        if (!options.cwd || !options.commitSha || line <= 0)
+            return undefined;
+        const hash = (0, content_hash_1.computeContentHashFromCommit)(options.cwd, options.commitSha, file, line);
+        return hash ?? undefined;
+    };
+    for (const f of aggregate.findingsByCategory.secret) {
+        const input = {
+            kind: 'secret',
+            tool: f.tool,
+            rule: f.rule,
+            file: f.file,
+            line: f.line,
+        };
+        const contentHash = stamp(f.file, f.line);
+        out.push({
+            id: (0, finding_identity_1.identityFor)(input),
+            kind: 'secret',
+            tool: f.tool,
+            rule: f.rule,
+            file: f.file,
+            line: f.line,
+            ...(contentHash !== undefined ? { contentHash } : {}),
+        });
+    }
+    for (const f of aggregate.findingsByCategory.code) {
+        const input = {
+            kind: 'code',
+            tool: f.tool,
+            rule: f.rule,
+            file: f.file,
+            line: f.line,
+        };
+        const contentHash = stamp(f.file, f.line);
+        out.push({
+            id: (0, finding_identity_1.identityFor)(input),
+            kind: 'code',
+            tool: f.tool,
+            rule: f.rule,
+            file: f.file,
+            line: f.line,
+            ...(contentHash !== undefined ? { contentHash } : {}),
+        });
+    }
+    for (const f of aggregate.findingsByCategory.config) {
+        const input = {
+            kind: 'config',
+            tool: f.tool,
+            rule: f.rule,
+            file: f.file,
+            line: f.line,
+        };
+        // Whole-file findings (`.env in git`) carry line 0; content-hash
+        // is meaningless for them and `stamp` returns undefined.
+        const contentHash = stamp(f.file, f.line);
+        out.push({
+            id: (0, finding_identity_1.identityFor)(input),
+            kind: 'config',
+            tool: f.tool,
+            rule: f.rule,
+            file: f.file,
+            line: f.line,
+            ...(contentHash !== undefined ? { contentHash } : {}),
+        });
+    }
+    for (const f of aggregate.findingsByCategory.dependency) {
+        const input = {
+            kind: 'dep-vuln',
+            package: f.package,
+            installedVersion: f.installedVersion,
+            id: f.id,
+        };
+        const entry = {
+            id: (0, finding_identity_1.identityFor)(input),
+            kind: 'dep-vuln',
+            package: f.package,
+            advisoryId: f.id,
+            ...(f.installedVersion !== undefined ? { installedVersion: f.installedVersion } : {}),
+        };
+        out.push(entry);
+    }
+    return out;
+}
+//# sourceMappingURL=security.js.map

package/dist/baseline/producers/security.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"security.js","sourceRoot":"","sources":["../../../src/baseline/producers/security.ts"],"names":[],"mappings":";AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAsCG;;AA8BH,gFA2FC;AAvHD,kDAA+D;AAE/D,0DAAkD;AAqBlD;;;;GAIG;AACH,SAAgB,kCAAkC,CAChD,SAA4B,EAC5B,UAAmC,EAAE;IAErC,MAAM,GAAG,GAAoB,EAAE,CAAC;IAChC,MAAM,KAAK,GAAG,CAAC,IAAY,EAAE,IAAY,EAAsB,EAAE;QAC/D,IAAI,CAAC,OAAO,CAAC,GAAG,IAAI,CAAC,OAAO,CAAC,SAAS,IAAI,IAAI,IAAI,CAAC;YAAE,OAAO,SAAS,CAAC;QACtE,MAAM,IAAI,GAAG,IAAA,2CAA4B,EAAC,OAAO,CAAC,GAAG,EAAE,OAAO,CAAC,SAAS,EAAE,IAAI,EAAE,IAAI,CAAC,CAAC;QACtF,OAAO,IAAI,IAAI,SAAS,CAAC;IAC3B,CAAC,CAAC;IAEF,KAAK,MAAM,CAAC,IAAI,SAAS,CAAC,kBAAkB,CAAC,MAAM,EAAE,CAAC;QACpD,MAAM,KAAK,GAAwB;YACjC,IAAI,EAAE,QAAQ;YACd,IAAI,EAAE,CAAC,CAAC,IAAI;YACZ,IAAI,EAAE,CAAC,CAAC,IAAI;YACZ,IAAI,EAAE,CAAC,CAAC,IAAI;YACZ,IAAI,EAAE,CAAC,CAAC,IAAI;SACb,CAAC;QACF,MAAM,WAAW,GAAG,KAAK,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC;QAC1C,GAAG,CAAC,IAAI,CAAC;YACP,EAAE,EAAE,IAAA,8BAAW,EAAC,KAAK,CAAC;YACtB,IAAI,EAAE,QAAQ;YACd,IAAI,EAAE,CAAC,CAAC,IAAI;YACZ,IAAI,EAAE,CAAC,CAAC,IAAI;YACZ,IAAI,EAAE,CAAC,CAAC,IAAI;YACZ,IAAI,EAAE,CAAC,CAAC,IAAI;YACZ,GAAG,CAAC,WAAW,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SACtD,CAAC,CAAC;IACL,CAAC;IAED,KAAK,MAAM,CAAC,IAAI,SAAS,CAAC,kBAAkB,CAAC,IAAI,EAAE,CAAC;QAClD,MAAM,KAAK,GAAsB;YAC/B,IAAI,EAAE,MAAM;YACZ,IAAI,EAAE,CAAC,CAAC,IAAI;YACZ,IAAI,EAAE,CAAC,CAAC,IAAI;YACZ,IAAI,EAAE,CAAC,CAAC,IAAI;YACZ,IAAI,EAAE,CAAC,CAAC,IAAI;SACb,CAAC;QACF,MAAM,WAAW,GAAG,KAAK,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC;QAC1C,GAAG,CAAC,IAAI,CAAC;YACP,EAAE,EAAE,IAAA,8BAAW,EAAC,KAAK,CAAC;YACtB,IAAI,EAAE,MAAM;YACZ,IAAI,EAAE,CAAC,CAAC,IAAI;YACZ,IAAI,EAAE,CAAC,CAAC,IAAI;YACZ,IAAI,EAAE,CAAC,CAAC,IAAI;YACZ,IAAI,EAAE,CAAC,CAAC,IAAI;YACZ,GAAG,CAAC,WAAW,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SACtD,CAAC,CAAC;IACL,CAAC;IAED,KAAK,MAAM,CAAC,IAAI,SAAS,CAAC,kBAAkB,CAAC,MAAM,EAAE,CAAC;QACpD,MAAM,KAAK,GAAwB;YACjC,IAAI,EAAE,QAAQ;YACd,IAAI,EAAE,CAAC,CAAC,IAAI;YACZ,IAAI,EAAE,CAAC,CAAC,IAAI;YACZ,IAAI,EAAE,CAAC,CAAC,IAAI;YACZ,IAAI,EAAE,CAAC,CAAC,IAAI;SACb,CAAC;QACF,iEAAiE;QACjE,yDAAyD;QACzD,MAAM,WAAW,GAAG,KAAK,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC;QAC1C,GAAG,CAAC,IAAI,CAAC;YACP,EAAE,EAAE,IAAA,8BAAW,EAAC,KAAK,CAAC;YACtB,IAAI,EAAE,QAAQ;YACd,IAAI,EAAE,CAAC,CAAC,IAAI;YACZ,IAAI,EAAE,CAAC,CAAC,IAAI;YACZ,IAAI,EAAE,CAAC,CAAC,IAAI;YACZ,IAAI,EAAE,CAAC,CAAC,IAAI;YACZ,GAAG,CAAC,WAAW,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SACtD,CAAC,CAAC;IACL,CAAC;IAED,KAAK,MAAM,CAAC,IAAI,SAAS,CAAC,kBAAkB,CAAC,UAAU,EAAE,CAAC;QACxD,MAAM,KAAK,GAAyB;YAClC,IAAI,EAAE,UAAU;YAChB,OAAO,EAAE,CAAC,CAAC,OAAO;YAClB,gBAAgB,EAAE,CAAC,CAAC,gBAAgB;YACpC,EAAE,EAAE,CAAC,CAAC,EAAE;SACT,CAAC;QACF,MAAM,KAAK,GAAkB;YAC3B,EAAE,EAAE,IAAA,8BAAW,EAAC,KAAK,CAAC;YACtB,IAAI,EAAE,UAAU;YAChB,OAAO,EAAE,CAAC,CAAC,OAAO;YAClB,UAAU,EAAE,CAAC,CAAC,EAAE;YAChB,GAAG,CAAC,CAAC,CAAC,gBAAgB,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,gBAAgB,EAAE,CAAC,CAAC,gBAAgB,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SACtF,CAAC;QACF,GAAG,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IAClB,CAAC;IAED,OAAO,GAAG,CAAC;AACb,CAAC"}

package/dist/baseline/producers/tests.d.ts

@@ -0,0 +1,36 @@
+/**
+ * Tests → baseline-entry producer.
+ *
+ * Two kinds today:
+ *
+ *   - `test-gap` — non-test source files lacking a matching test, as
+ *     reported by `analyzeTestGaps`. Each gap carries a risk tier
+ *     (`critical | high | medium | low`); the tier is part of identity
+ *     so a file moving between tiers (CRITICAL → HIGH, or vice
+ *     versa) registers as a fresh finding rather than a silent
+ *     persisted one — the right signal for "this file's testing
+ *     situation got worse."
+ *
+ *   - `test-file-degradation` — test files present but not actively
+ *     exercising the system under test (commented-out, empty body,
+ *     schema-only stubs). The degradation status is part of identity
+ *     for the same reason: a file moving from `'empty'` to
+ *     `'schema-only'` is a different signal.
+ *
+ * Producer is pure over its input; the orchestrator calls
+ * `analyzeTestGaps(cwd)` (which itself shares the canonical
+ * `AnalysisResult` cache so it doesn't re-gather what the security
+ * producer already triggered).
+ */
+import type { BaselineEntry } from '../types';
+import type { TestGapsReport } from '../../analyzers/tests/types';
+/**
+ * Build `test-gap` + `test-file-degradation` entries from a
+ * `TestGapsReport`. Active test files (status: 'active') are not
+ * emitted — they're the healthy case. Source files WITH a matching
+ * test are not emitted — they're not a gap. Output preserves the
+ * report's iteration order so re-runs against the same scan are
+ * byte-stable.
+ */
+export declare function testGapsToBaselineEntries(report: TestGapsReport): BaselineEntry[];
+//# sourceMappingURL=tests.d.ts.map

package/dist/baseline/producers/tests.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"tests.d.ts","sourceRoot":"","sources":["../../../src/baseline/producers/tests.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AAGH,OAAO,KAAK,EACV,aAAa,EAGd,MAAM,UAAU,CAAC;AAClB,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,6BAA6B,CAAC;AAElE;;;;;;;GAOG;AACH,wBAAgB,yBAAyB,CAAC,MAAM,EAAE,cAAc,GAAG,aAAa,EAAE,CAgCjF"}