@vyuhlabs/dxkit 2.4.8 → 2.5.0

package/dist/baseline/producers/tests.js

@@ -0,0 +1,69 @@
+"use strict";
+/**
+ * Tests → baseline-entry producer.
+ *
+ * Two kinds today:
+ *
+ *   - `test-gap` — non-test source files lacking a matching test, as
+ *     reported by `analyzeTestGaps`. Each gap carries a risk tier
+ *     (`critical | high | medium | low`); the tier is part of identity
+ *     so a file moving between tiers (CRITICAL → HIGH, or vice
+ *     versa) registers as a fresh finding rather than a silent
+ *     persisted one — the right signal for "this file's testing
+ *     situation got worse."
+ *
+ *   - `test-file-degradation` — test files present but not actively
+ *     exercising the system under test (commented-out, empty body,
+ *     schema-only stubs). The degradation status is part of identity
+ *     for the same reason: a file moving from `'empty'` to
+ *     `'schema-only'` is a different signal.
+ *
+ * Producer is pure over its input; the orchestrator calls
+ * `analyzeTestGaps(cwd)` (which itself shares the canonical
+ * `AnalysisResult` cache so it doesn't re-gather what the security
+ * producer already triggered).
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.testGapsToBaselineEntries = testGapsToBaselineEntries;
+const finding_identity_1 = require("../finding-identity");
+/**
+ * Build `test-gap` + `test-file-degradation` entries from a
+ * `TestGapsReport`. Active test files (status: 'active') are not
+ * emitted — they're the healthy case. Source files WITH a matching
+ * test are not emitted — they're not a gap. Output preserves the
+ * report's iteration order so re-runs against the same scan are
+ * byte-stable.
+ */
+function testGapsToBaselineEntries(report) {
+    const out = [];
+    for (const gap of report.gaps) {
+        // Defensive: `gaps` already excludes files with a matching test,
+        // but guard anyway so a future report-shape change can't silently
+        // double-up.
+        if (gap.hasMatchingTest)
+            continue;
+        const input = {
+            kind: 'test-gap',
+            file: gap.path,
+            risk: gap.risk,
+        };
+        out.push({ id: (0, finding_identity_1.identityFor)(input), kind: 'test-gap', file: gap.path, risk: gap.risk });
+    }
+    for (const tf of report.testFiles) {
+        if (tf.status === 'active')
+            continue;
+        const input = {
+            kind: 'test-file-degradation',
+            file: tf.path,
+            status: tf.status,
+        };
+        out.push({
+            id: (0, finding_identity_1.identityFor)(input),
+            kind: 'test-file-degradation',
+            file: tf.path,
+            status: tf.status,
+        });
+    }
+    return out;
+}
+//# sourceMappingURL=tests.js.map

package/dist/baseline/producers/tests.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"tests.js","sourceRoot":"","sources":["../../../src/baseline/producers/tests.ts"],"names":[],"mappings":";AAAA;;;;;;;;;;;;;;;;;;;;;;;GAuBG;;AAkBH,8DAgCC;AAhDD,0DAAkD;AAQlD;;;;;;;GAOG;AACH,SAAgB,yBAAyB,CAAC,MAAsB;IAC9D,MAAM,GAAG,GAAoB,EAAE,CAAC;IAEhC,KAAK,MAAM,GAAG,IAAI,MAAM,CAAC,IAAI,EAAE,CAAC;QAC9B,iEAAiE;QACjE,kEAAkE;QAClE,aAAa;QACb,IAAI,GAAG,CAAC,eAAe;YAAE,SAAS;QAClC,MAAM,KAAK,GAAyB;YAClC,IAAI,EAAE,UAAU;YAChB,IAAI,EAAE,GAAG,CAAC,IAAI;YACd,IAAI,EAAE,GAAG,CAAC,IAAI;SACf,CAAC;QACF,GAAG,CAAC,IAAI,CAAC,EAAE,EAAE,EAAE,IAAA,8BAAW,EAAC,KAAK,CAAC,EAAE,IAAI,EAAE,UAAU,EAAE,IAAI,EAAE,GAAG,CAAC,IAAI,EAAE,IAAI,EAAE,GAAG,CAAC,IAAI,EAAE,CAAC,CAAC;IACzF,CAAC;IAED,KAAK,MAAM,EAAE,IAAI,MAAM,CAAC,SAAS,EAAE,CAAC;QAClC,IAAI,EAAE,CAAC,MAAM,KAAK,QAAQ;YAAE,SAAS;QACrC,MAAM,KAAK,GAAqC;YAC9C,IAAI,EAAE,uBAAuB;YAC7B,IAAI,EAAE,EAAE,CAAC,IAAI;YACb,MAAM,EAAE,EAAE,CAAC,MAAM;SAClB,CAAC;QACF,GAAG,CAAC,IAAI,CAAC;YACP,EAAE,EAAE,IAAA,8BAAW,EAAC,KAAK,CAAC;YACtB,IAAI,EAAE,uBAAuB;YAC7B,IAAI,EAAE,EAAE,CAAC,IAAI;YACb,MAAM,EAAE,EAAE,CAAC,MAAM;SAClB,CAAC,CAAC;IACL,CAAC;IAED,OAAO,GAAG,CAAC;AACb,CAAC"}

package/dist/baseline/salt.d.ts

@@ -0,0 +1,45 @@
+/**
+ * Per-repo salt resolution for secret HMAC identity.
+ *
+ * The secret-HMAC scheme uses a salt that's:
+ *   1. Consistent across `baseline create` (writes HMACs) and every
+ *      subsequent `guardrail check` (reads them).
+ *   2. Not stored in git — a baseline-file leak should not enable
+ *      secret recovery via rainbow tables.
+ *   3. Reachable from every consumer — single dev, multiple devs on
+ *      one repo, CI, shallow clones, detached HEADs.
+ *
+ * A three-step waterfall satisfies all three:
+ *
+ *   1. `DXKIT_BASELINE_SALT` env var — opt-in override for teams
+ *      who want stronger isolation than the deterministic default.
+ *   2. `.dxkit/salt` file — reserved for environments where env-vars
+ *      are awkward (cron jobs, embedded runners). Gitignored by
+ *      default.
+ *   3. Deterministic default — `HMAC("dxkit-baseline-salt-v1",
+ *      initialCommitSha)`. Zero-setup; same across clones of the
+ *      same repo; different across different repos; reachable in
+ *      shallow clones (git always includes the root commit).
+ *
+ * Every baseline file records which mode produced it so the
+ * matcher can either match the same mode (HMAC compare works) or
+ * gracefully degrade to location-only matching when the salt is
+ * unrecoverable on the current run.
+ */
+/** Resolution path that produced the salt. Stamped on every baseline
+ *  file so the guardrail check knows what the matcher needs. */
+export type SaltMode = 'env-var' | 'file' | 'deterministic';
+export interface ResolvedSalt {
+    readonly mode: SaltMode;
+    readonly salt: string;
+}
+/**
+ * Resolve the salt for a repo. Pure dispatch over the three-step
+ * waterfall; no I/O happens past the resolution step that succeeds.
+ *
+ * Throws when none of the three paths can produce a salt — typically
+ * a non-git checkout with no env var set. Callers should surface the
+ * message verbatim so users learn which mode to configure.
+ */
+export declare function resolveSalt(cwd: string): ResolvedSalt;
+//# sourceMappingURL=salt.d.ts.map

package/dist/baseline/salt.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"salt.d.ts","sourceRoot":"","sources":["../../src/baseline/salt.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2BG;AAOH;gEACgE;AAChE,MAAM,MAAM,QAAQ,GAAG,SAAS,GAAG,MAAM,GAAG,eAAe,CAAC;AAE5D,MAAM,WAAW,YAAY;IAC3B,QAAQ,CAAC,IAAI,EAAE,QAAQ,CAAC;IACxB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;CACvB;AAQD;;;;;;;GAOG;AACH,wBAAgB,WAAW,CAAC,GAAG,EAAE,MAAM,GAAG,YAAY,CAiCrD"}

package/dist/baseline/salt.js

@@ -0,0 +1,113 @@
+"use strict";
+/**
+ * Per-repo salt resolution for secret HMAC identity.
+ *
+ * The secret-HMAC scheme uses a salt that's:
+ *   1. Consistent across `baseline create` (writes HMACs) and every
+ *      subsequent `guardrail check` (reads them).
+ *   2. Not stored in git — a baseline-file leak should not enable
+ *      secret recovery via rainbow tables.
+ *   3. Reachable from every consumer — single dev, multiple devs on
+ *      one repo, CI, shallow clones, detached HEADs.
+ *
+ * A three-step waterfall satisfies all three:
+ *
+ *   1. `DXKIT_BASELINE_SALT` env var — opt-in override for teams
+ *      who want stronger isolation than the deterministic default.
+ *   2. `.dxkit/salt` file — reserved for environments where env-vars
+ *      are awkward (cron jobs, embedded runners). Gitignored by
+ *      default.
+ *   3. Deterministic default — `HMAC("dxkit-baseline-salt-v1",
+ *      initialCommitSha)`. Zero-setup; same across clones of the
+ *      same repo; different across different repos; reachable in
+ *      shallow clones (git always includes the root commit).
+ *
+ * Every baseline file records which mode produced it so the
+ * matcher can either match the same mode (HMAC compare works) or
+ * gracefully degrade to location-only matching when the salt is
+ * unrecoverable on the current run.
+ */
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.resolveSalt = resolveSalt;
+const child_process_1 = require("child_process");
+const crypto_1 = require("crypto");
+const fs = __importStar(require("fs"));
+const path = __importStar(require("path"));
+/** Domain separator for the deterministic default. Bumping the
+ *  suffix would invalidate every existing deterministic-mode
+ *  baseline (consumers would compute different salts for the same
+ *  commit). Treat it as a permanent identifier. */
+const DETERMINISTIC_DOMAIN = 'dxkit-baseline-salt-v1';
+/**
+ * Resolve the salt for a repo. Pure dispatch over the three-step
+ * waterfall; no I/O happens past the resolution step that succeeds.
+ *
+ * Throws when none of the three paths can produce a salt — typically
+ * a non-git checkout with no env var set. Callers should surface the
+ * message verbatim so users learn which mode to configure.
+ */
+function resolveSalt(cwd) {
+    const envSalt = process.env.DXKIT_BASELINE_SALT;
+    if (envSalt && envSalt.length > 0) {
+        return { mode: 'env-var', salt: envSalt };
+    }
+    const filePath = path.join(cwd, '.dxkit', 'salt');
+    if (fs.existsSync(filePath)) {
+        const fileSalt = fs.readFileSync(filePath, 'utf8').trim();
+        if (fileSalt.length > 0) {
+            return { mode: 'file', salt: fileSalt };
+        }
+    }
+    try {
+        const sha = (0, child_process_1.execFileSync)('git', ['rev-list', '--max-parents=0', 'HEAD'], {
+            cwd,
+            encoding: 'utf8',
+            stdio: ['ignore', 'pipe', 'pipe'],
+        })
+            .trim()
+            .split('\n')[0];
+        if (!sha) {
+            throw new Error('git rev-list returned empty output');
+        }
+        const salt = (0, crypto_1.createHmac)('sha256', DETERMINISTIC_DOMAIN).update(sha).digest('hex');
+        return { mode: 'deterministic', salt };
+    }
+    catch {
+        throw new Error('Cannot derive a baseline salt: not a git repository (or no root commit reachable). ' +
+            'Set DXKIT_BASELINE_SALT or initialize a git repo before running baseline commands.');
+    }
+}
+//# sourceMappingURL=salt.js.map

package/dist/baseline/salt.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"salt.js","sourceRoot":"","sources":["../../src/baseline/salt.ts"],"names":[],"mappings":";AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2BG;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AA8BH,kCAiCC;AA7DD,iDAA6C;AAC7C,mCAAoC;AACpC,uCAAyB;AACzB,2CAA6B;AAW7B;;;mDAGmD;AACnD,MAAM,oBAAoB,GAAG,wBAAwB,CAAC;AAEtD;;;;;;;GAOG;AACH,SAAgB,WAAW,CAAC,GAAW;IACrC,MAAM,OAAO,GAAG,OAAO,CAAC,GAAG,CAAC,mBAAmB,CAAC;IAChD,IAAI,OAAO,IAAI,OAAO,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAClC,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,IAAI,EAAE,OAAO,EAAE,CAAC;IAC5C,CAAC;IAED,MAAM,QAAQ,GAAG,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,QAAQ,EAAE,MAAM,CAAC,CAAC;IAClD,IAAI,EAAE,CAAC,UAAU,CAAC,QAAQ,CAAC,EAAE,CAAC;QAC5B,MAAM,QAAQ,GAAG,EAAE,CAAC,YAAY,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC,IAAI,EAAE,CAAC;QAC1D,IAAI,QAAQ,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACxB,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,QAAQ,EAAE,CAAC;QAC1C,CAAC;IACH,CAAC;IAED,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,IAAA,4BAAY,EAAC,KAAK,EAAE,CAAC,UAAU,EAAE,iBAAiB,EAAE,MAAM,CAAC,EAAE;YACvE,GAAG;YACH,QAAQ,EAAE,MAAM;YAChB,KAAK,EAAE,CAAC,QAAQ,EAAE,MAAM,EAAE,MAAM,CAAC;SAClC,CAAC;aACC,IAAI,EAAE;aACN,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC;QAClB,IAAI,CAAC,GAAG,EAAE,CAAC;YACT,MAAM,IAAI,KAAK,CAAC,oCAAoC,CAAC,CAAC;QACxD,CAAC;QACD,MAAM,IAAI,GAAG,IAAA,mBAAU,EAAC,QAAQ,EAAE,oBAAoB,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;QAClF,OAAO,EAAE,IAAI,EAAE,eAAe,EAAE,IAAI,EAAE,CAAC;IACzC,CAAC;IAAC,MAAM,CAAC;QACP,MAAM,IAAI,KAAK,CACb,qFAAqF;YACnF,oFAAoF,CACvF,CAAC;IACJ,CAAC;AACH,CAAC"}

package/dist/baseline/show.d.ts

@@ -0,0 +1,79 @@
+/**
+ * `vyuh-dxkit baseline show` — pretty-print + filter the on-disk
+ * baseline file.
+ *
+ * Three render modes share one loaded `BaselineFile`:
+ *
+ *   - **summary** (`baseline show` or `baseline show --summary`) —
+ *     header (commit, branch, creation time, schema, dxkit version,
+ *     salt mode) plus per-kind counts. The fast scan a developer
+ *     reaches for to answer "what's the shape of this baseline?"
+ *
+ *   - **kind-filtered** (`baseline show --kind <X>`) — every entry
+ *     matching the named kind, with locator + identity prefix. The
+ *     drill-down for "show me every dep-vuln in this baseline."
+ *
+ *   - **JSON** (`baseline show --json [--kind <X>]`) — schema-banner-
+ *     wrapped payload. Filter applies if specified. Designed for
+ *     agents + CI consumers.
+ *
+ * Pure module — no I/O. The CLI layer loads the file via
+ * `readBaselineFile` and routes the result through these renderers.
+ */
+import type { BaselineFile } from './baseline-file';
+import type { BaselineEntry } from './types';
+/**
+ * JSON schema banner for the `baseline show --json` envelope.
+ * Distinct from the raw `schemaVersion: 'dxkit-baseline/v1'` field
+ * on the underlying file: this envelope is a *rendered view* and
+ * may carry a filter discriminator the raw file doesn't.
+ */
+export declare const BASELINE_SHOW_SCHEMA: "dxkit.baseline-show.v1";
+/**
+ * The kinds a user can filter on. Mirror of the `BaselineEntry`
+ * discriminant union — keeps the CLI's flag-validation aligned with
+ * the storage shape.
+ */
+export declare const FILTER_KINDS: ReadonlyArray<BaselineEntry['kind']>;
+/** Result of parsing the user's `--kind` value. Returns `null` for
+ *  unknown values so the CLI surfaces a helpful error including the
+ *  full list of accepted kinds. */
+export declare function parseKindFilter(raw: string): BaselineEntry['kind'] | null;
+/**
+ * Render the summary view: header lines + per-kind counts table.
+ * Always reports every kind that appears at least once; absent kinds
+ * are omitted to keep the table compact.
+ */
+export declare function renderSummary(file: BaselineFile): string;
+/**
+ * Render every entry matching `kind`. Each line carries the
+ * identity prefix (first 12 chars — enough to distinguish entries
+ * by eye without bloating the line), the locator info, and any
+ * kind-specific discriminator.
+ *
+ * Returns the header + a notice when no entries match, rather than
+ * an empty string, so the user always sees confirmation that the
+ * filter ran.
+ */
+export declare function renderKind(file: BaselineFile, kind: BaselineEntry['kind']): string;
+/**
+ * Render the JSON envelope. Wraps the underlying file (full or
+ * kind-filtered) in a top-level `schema` banner so consumers can
+ * version-gate before reading. Filter discriminator is included
+ * when present so consumers know whether they're seeing the full
+ * findings list.
+ */
+export declare function renderJson(file: BaselineFile, options?: {
+    readonly kind?: BaselineEntry['kind'];
+}): {
+    readonly schema: typeof BASELINE_SHOW_SCHEMA;
+    readonly filter: {
+        readonly kind: BaselineEntry['kind'];
+    } | null;
+    readonly baseline: BaselineFile;
+    readonly summary: {
+        readonly total: number;
+        readonly byKind: Readonly<Partial<Record<BaselineEntry['kind'], number>>>;
+    };
+};
+//# sourceMappingURL=show.d.ts.map

package/dist/baseline/show.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"show.d.ts","sourceRoot":"","sources":["../../src/baseline/show.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;GAqBG;AAGH,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,iBAAiB,CAAC;AACpD,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,SAAS,CAAC;AAE7C;;;;;GAKG;AACH,eAAO,MAAM,oBAAoB,EAAG,wBAAiC,CAAC;AAEtE;;;;GAIG;AACH,eAAO,MAAM,YAAY,EAAE,aAAa,CAAC,aAAa,CAAC,MAAM,CAAC,CAe5D,CAAC;AAEH;;mCAEmC;AACnC,wBAAgB,eAAe,CAAC,GAAG,EAAE,MAAM,GAAG,aAAa,CAAC,MAAM,CAAC,GAAG,IAAI,CAIzE;AAED;;;;GAIG;AACH,wBAAgB,aAAa,CAAC,IAAI,EAAE,YAAY,GAAG,MAAM,CA6BxD;AAED;;;;;;;;;GASG;AACH,wBAAgB,UAAU,CAAC,IAAI,EAAE,YAAY,EAAE,IAAI,EAAE,aAAa,CAAC,MAAM,CAAC,GAAG,MAAM,CAkBlF;AAED;;;;;;GAMG;AACH,wBAAgB,UAAU,CACxB,IAAI,EAAE,YAAY,EAClB,OAAO,GAAE;IAAE,QAAQ,CAAC,IAAI,CAAC,EAAE,aAAa,CAAC,MAAM,CAAC,CAAA;CAAO,GACtD;IACD,QAAQ,CAAC,MAAM,EAAE,OAAO,oBAAoB,CAAC;IAC7C,QAAQ,CAAC,MAAM,EAAE;QAAE,QAAQ,CAAC,IAAI,EAAE,aAAa,CAAC,MAAM,CAAC,CAAA;KAAE,GAAG,IAAI,CAAC;IACjE,QAAQ,CAAC,QAAQ,EAAE,YAAY,CAAC;IAChC,QAAQ,CAAC,OAAO,EAAE;QAChB,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;QACvB,QAAQ,CAAC,MAAM,EAAE,QAAQ,CAAC,OAAO,CAAC,MAAM,CAAC,aAAa,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC,CAAC,CAAC,CAAC;KAC3E,CAAC;CACH,CAcA"}

package/dist/baseline/show.js

@@ -0,0 +1,233 @@
+"use strict";
+/**
+ * `vyuh-dxkit baseline show` — pretty-print + filter the on-disk
+ * baseline file.
+ *
+ * Three render modes share one loaded `BaselineFile`:
+ *
+ *   - **summary** (`baseline show` or `baseline show --summary`) —
+ *     header (commit, branch, creation time, schema, dxkit version,
+ *     salt mode) plus per-kind counts. The fast scan a developer
+ *     reaches for to answer "what's the shape of this baseline?"
+ *
+ *   - **kind-filtered** (`baseline show --kind <X>`) — every entry
+ *     matching the named kind, with locator + identity prefix. The
+ *     drill-down for "show me every dep-vuln in this baseline."
+ *
+ *   - **JSON** (`baseline show --json [--kind <X>]`) — schema-banner-
+ *     wrapped payload. Filter applies if specified. Designed for
+ *     agents + CI consumers.
+ *
+ * Pure module — no I/O. The CLI layer loads the file via
+ * `readBaselineFile` and routes the result through these renderers.
+ */
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.FILTER_KINDS = exports.BASELINE_SHOW_SCHEMA = void 0;
+exports.parseKindFilter = parseKindFilter;
+exports.renderSummary = renderSummary;
+exports.renderKind = renderKind;
+exports.renderJson = renderJson;
+const logger = __importStar(require("../logger"));
+/**
+ * JSON schema banner for the `baseline show --json` envelope.
+ * Distinct from the raw `schemaVersion: 'dxkit-baseline/v1'` field
+ * on the underlying file: this envelope is a *rendered view* and
+ * may carry a filter discriminator the raw file doesn't.
+ */
+exports.BASELINE_SHOW_SCHEMA = 'dxkit.baseline-show.v1';
+/**
+ * The kinds a user can filter on. Mirror of the `BaselineEntry`
+ * discriminant union — keeps the CLI's flag-validation aligned with
+ * the storage shape.
+ */
+exports.FILTER_KINDS = Object.freeze([
+    'secret',
+    'code',
+    'config',
+    'dep-vuln',
+    'duplication',
+    'coverage-gap',
+    'test-gap',
+    'hygiene',
+    'license',
+    'test-file-degradation',
+    'god-file',
+    'stale-file',
+    'large-file',
+    'secret-hmac',
+]);
+/** Result of parsing the user's `--kind` value. Returns `null` for
+ *  unknown values so the CLI surfaces a helpful error including the
+ *  full list of accepted kinds. */
+function parseKindFilter(raw) {
+    return exports.FILTER_KINDS.includes(raw)
+        ? raw
+        : null;
+}
+/**
+ * Render the summary view: header lines + per-kind counts table.
+ * Always reports every kind that appears at least once; absent kinds
+ * are omitted to keep the table compact.
+ */
+function renderSummary(file) {
+    const lines = [];
+    lines.push(logger.bold(`Baseline '${file.name}'`));
+    lines.push('');
+    lines.push(`  Commit:      ${shortSha(file.repo.commitSha)} (${file.repo.branch || 'detached'})`);
+    lines.push(`  Captured:    ${file.createdAt}`);
+    lines.push(`  Schema:      ${file.schemaVersion}`);
+    lines.push(`  dxkit:       ${file.analysis.dxkitVersion}`);
+    lines.push(`  Salt:        ${file.saltMode}`);
+    const toolNames = Object.keys(file.tools).sort();
+    if (toolNames.length > 0) {
+        lines.push(`  Tools:       ${toolNames.map((t) => `${t}@${file.tools[t]}`).join(', ')}`);
+    }
+    lines.push('');
+    const counts = countByKind(file.findings);
+    const total = file.findings.length;
+    lines.push(logger.bold(`Findings: ${total} total`));
+    if (total > 0) {
+        const entries = Object.entries(counts);
+        entries.sort((a, b) => b[1] - a[1]);
+        const widestKind = Math.max(...entries.map(([k]) => k.length));
+        for (const [kind, count] of entries) {
+            lines.push(`  ${kind.padEnd(widestKind)}   ${count.toString().padStart(5)}`);
+        }
+        lines.push('');
+        lines.push(`  Filter to one kind: vyuh-dxkit baseline show --kind <kind>`);
+    }
+    return lines.join('\n');
+}
+/**
+ * Render every entry matching `kind`. Each line carries the
+ * identity prefix (first 12 chars — enough to distinguish entries
+ * by eye without bloating the line), the locator info, and any
+ * kind-specific discriminator.
+ *
+ * Returns the header + a notice when no entries match, rather than
+ * an empty string, so the user always sees confirmation that the
+ * filter ran.
+ */
+function renderKind(file, kind) {
+    const lines = [];
+    const matching = file.findings.filter((e) => e.kind === kind);
+    lines.push(logger.bold(`Baseline '${file.name}' — kind: ${kind}`));
+    lines.push(`  Commit:      ${shortSha(file.repo.commitSha)}`);
+    lines.push('');
+    if (matching.length === 0) {
+        lines.push(`  (no entries of kind '${kind}')`);
+        return lines.join('\n');
+    }
+    lines.push(logger.bold(`${matching.length} ${kind} ${matching.length === 1 ? 'entry' : 'entries'}`));
+    lines.push('');
+    for (const entry of matching) {
+        lines.push(`  ${entry.id.slice(0, 12)}  ${describeEntry(entry)}`);
+    }
+    return lines.join('\n');
+}
+/**
+ * Render the JSON envelope. Wraps the underlying file (full or
+ * kind-filtered) in a top-level `schema` banner so consumers can
+ * version-gate before reading. Filter discriminator is included
+ * when present so consumers know whether they're seeing the full
+ * findings list.
+ */
+function renderJson(file, options = {}) {
+    const findings = options.kind
+        ? file.findings.filter((e) => e.kind === options.kind)
+        : file.findings;
+    const view = { ...file, findings };
+    return {
+        schema: exports.BASELINE_SHOW_SCHEMA,
+        filter: options.kind ? { kind: options.kind } : null,
+        baseline: view,
+        summary: {
+            total: findings.length,
+            byKind: countByKind(findings),
+        },
+    };
+}
+/** Per-kind occurrence count. Mirror of the matcher's multiset
+ *  semantics — duplicate identities count separately. */
+function countByKind(entries) {
+    const out = {};
+    for (const e of entries)
+        out[e.kind] = (out[e.kind] ?? 0) + 1;
+    return out;
+}
+/**
+ * One-line locator + discriminator string for a baseline entry.
+ * Kind-specific fields drive the format so a reader sees the
+ * meaningful axis (file:line for source-anchored kinds,
+ * package@version+advisory for dep-vulns, etc.).
+ */
+function describeEntry(entry) {
+    switch (entry.kind) {
+        case 'secret':
+        case 'code':
+        case 'config':
+            return `${entry.file}:${entry.line}  [${entry.tool}/${entry.rule}]`;
+        case 'hygiene':
+            return `${entry.file}:${entry.line}  [${entry.marker}]`;
+        case 'dep-vuln':
+            return `${entry.package}@${entry.installedVersion ?? '?'}  [${entry.advisoryId}]`;
+        case 'duplication':
+            return `${entry.fileA}:${entry.startLineA} <-> ${entry.fileB}:${entry.startLineB}  (${entry.lines} lines)`;
+        case 'coverage-gap':
+            return entry.symbol
+                ? `${entry.file}:${entry.symbol}`
+                : `${entry.file}:${entry.lineRange?.[0] ?? '?'}-${entry.lineRange?.[1] ?? '?'}`;
+        case 'test-gap':
+            return `${entry.file}  [risk: ${entry.risk}]`;
+        case 'license':
+            return `${entry.package}@${entry.version}  [${entry.licenseType}]`;
+        case 'test-file-degradation':
+            return `${entry.file}  [${entry.status}]`;
+        case 'god-file':
+        case 'large-file':
+            return entry.file;
+        case 'stale-file':
+            return `${entry.file}  [.${entry.suffix}]`;
+        case 'secret-hmac':
+            return `[${entry.tool}/${entry.rule}]  hmac:${entry.hmac.slice(0, 12)}`;
+    }
+}
+function shortSha(sha) {
+    if (!sha)
+        return '(no-commit)';
+    return sha.slice(0, 8);
+}
+//# sourceMappingURL=show.js.map

package/dist/baseline/show.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"show.js","sourceRoot":"","sources":["../../src/baseline/show.ts"],"names":[],"mappings":";AAAA;;;;;;;;;;;;;;;;;;;;;GAqBG;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAuCH,0CAIC;AAOD,sCA6BC;AAYD,gCAkBC;AASD,gCAyBC;AA7ID,kDAAoC;AAIpC;;;;;GAKG;AACU,QAAA,oBAAoB,GAAG,wBAAiC,CAAC;AAEtE;;;;GAIG;AACU,QAAA,YAAY,GAAyC,MAAM,CAAC,MAAM,CAAC;IAC9E,QAAQ;IACR,MAAM;IACN,QAAQ;IACR,UAAU;IACV,aAAa;IACb,cAAc;IACd,UAAU;IACV,SAAS;IACT,SAAS;IACT,uBAAuB;IACvB,UAAU;IACV,YAAY;IACZ,YAAY;IACZ,aAAa;CACd,CAAC,CAAC;AAEH;;mCAEmC;AACnC,SAAgB,eAAe,CAAC,GAAW;IACzC,OAAQ,oBAAsC,CAAC,QAAQ,CAAC,GAAG,CAAC;QAC1D,CAAC,CAAE,GAA6B;QAChC,CAAC,CAAC,IAAI,CAAC;AACX,CAAC;AAED;;;;GAIG;AACH,SAAgB,aAAa,CAAC,IAAkB;IAC9C,MAAM,KAAK,GAAa,EAAE,CAAC;IAC3B,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,aAAa,IAAI,CAAC,IAAI,GAAG,CAAC,CAAC,CAAC;IACnD,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IACf,KAAK,CAAC,IAAI,CAAC,kBAAkB,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,KAAK,IAAI,CAAC,IAAI,CAAC,MAAM,IAAI,UAAU,GAAG,CAAC,CAAC;IAClG,KAAK,CAAC,IAAI,CAAC,kBAAkB,IAAI,CAAC,SAAS,EAAE,CAAC,CAAC;IAC/C,KAAK,CAAC,IAAI,CAAC,kBAAkB,IAAI,CAAC,aAAa,EAAE,CAAC,CAAC;IACnD,KAAK,CAAC,IAAI,CAAC,kBAAkB,IAAI,CAAC,QAAQ,CAAC,YAAY,EAAE,CAAC,CAAC;IAC3D,KAAK,CAAC,IAAI,CAAC,kBAAkB,IAAI,CAAC,QAAQ,EAAE,CAAC,CAAC;IAC9C,MAAM,SAAS,GAAG,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,IAAI,EAAE,CAAC;IACjD,IAAI,SAAS,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACzB,KAAK,CAAC,IAAI,CAAC,kBAAkB,SAAS,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,GAAG,CAAC,IAAI,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IAC3F,CAAC;IACD,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IAEf,MAAM,MAAM,GAAG,WAAW,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;IAC1C,MAAM,KAAK,GAAG,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC;IACnC,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,aAAa,KAAK,QAAQ,CAAC,CAAC,CAAC;IACpD,IAAI,KAAK,GAAG,CAAC,EAAE,CAAC;QACd,MAAM,OAAO,GAAG,MAAM,CAAC,OAAO,CAAC,MAAM,CAA2C,CAAC;QACjF,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;QACpC,MAAM,UAAU,GAAG,IAAI,CAAC,GAAG,CAAC,GAAG,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC;QAC/D,KAAK,MAAM,CAAC,IAAI,EAAE,KAAK,CAAC,IAAI,OAAO,EAAE,CAAC;YACpC,KAAK,CAAC,IAAI,CAAC,KAAK,IAAI,CAAC,MAAM,CAAC,UAAU,CAAC,MAAM,KAAK,CAAC,QAAQ,EAAE,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;QAC/E,CAAC;QACD,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;QACf,KAAK,CAAC,IAAI,CAAC,8DAA8D,CAAC,CAAC;IAC7E,CAAC;IACD,OAAO,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AAC1B,CAAC;AAED;;;;;;;;;GASG;AACH,SAAgB,UAAU,CAAC,IAAkB,EAAE,IAA2B;IACxE,MAAM,KAAK,GAAa,EAAE,CAAC;IAC3B,MAAM,QAAQ,GAAG,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,IAAI,CAAC,CAAC;IAC9D,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,aAAa,IAAI,CAAC,IAAI,aAAa,IAAI,EAAE,CAAC,CAAC,CAAC;IACnE,KAAK,CAAC,IAAI,CAAC,kBAAkB,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,CAAC,CAAC;IAC9D,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IACf,IAAI,QAAQ,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC1B,KAAK,CAAC,IAAI,CAAC,0BAA0B,IAAI,IAAI,CAAC,CAAC;QAC/C,OAAO,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAC1B,CAAC;IACD,KAAK,CAAC,IAAI,CACR,MAAM,CAAC,IAAI,CAAC,GAAG,QAAQ,CAAC,MAAM,IAAI,IAAI,IAAI,QAAQ,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,SAAS,EAAE,CAAC,CACzF,CAAC;IACF,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IACf,KAAK,MAAM,KAAK,IAAI,QAAQ,EAAE,CAAC;QAC7B,KAAK,CAAC,IAAI,CAAC,KAAK,KAAK,CAAC,EAAE,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,KAAK,aAAa,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;IACpE,CAAC;IACD,OAAO,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AAC1B,CAAC;AAED;;;;;;GAMG;AACH,SAAgB,UAAU,CACxB,IAAkB,EAClB,UAAqD,EAAE;IAUvD,MAAM,QAAQ,GAAG,OAAO,CAAC,IAAI;QAC3B,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,OAAO,CAAC,IAAI,CAAC;QACtD,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC;IAClB,MAAM,IAAI,GAAiB,EAAE,GAAG,IAAI,EAAE,QAAQ,EAAE,CAAC;IACjD,OAAO;QACL,MAAM,EAAE,4BAAoB;QAC5B,MAAM,EAAE,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,OAAO,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,IAAI;QACpD,QAAQ,EAAE,IAAI;QACd,OAAO,EAAE;YACP,KAAK,EAAE,QAAQ,CAAC,MAAM;YACtB,MAAM,EAAE,WAAW,CAAC,QAAQ,CAAC;SAC9B;KACF,CAAC;AACJ,CAAC;AAED;yDACyD;AACzD,SAAS,WAAW,CAClB,OAAqC;IAErC,MAAM,GAAG,GAAmD,EAAE,CAAC;IAC/D,KAAK,MAAM,CAAC,IAAI,OAAO;QAAE,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC;IAC9D,OAAO,GAAG,CAAC;AACb,CAAC;AAED;;;;;GAKG;AACH,SAAS,aAAa,CAAC,KAAoB;IACzC,QAAQ,KAAK,CAAC,IAAI,EAAE,CAAC;QACnB,KAAK,QAAQ,CAAC;QACd,KAAK,MAAM,CAAC;QACZ,KAAK,QAAQ;YACX,OAAO,GAAG,KAAK,CAAC,IAAI,IAAI,KAAK,CAAC,IAAI,MAAM,KAAK,CAAC,IAAI,IAAI,KAAK,CAAC,IAAI,GAAG,CAAC;QACtE,KAAK,SAAS;YACZ,OAAO,GAAG,KAAK,CAAC,IAAI,IAAI,KAAK,CAAC,IAAI,MAAM,KAAK,CAAC,MAAM,GAAG,CAAC;QAC1D,KAAK,UAAU;YACb,OAAO,GAAG,KAAK,CAAC,OAAO,IAAI,KAAK,CAAC,gBAAgB,IAAI,GAAG,MAAM,KAAK,CAAC,UAAU,GAAG,CAAC;QACpF,KAAK,aAAa;YAChB,OAAO,GAAG,KAAK,CAAC,KAAK,IAAI,KAAK,CAAC,UAAU,QAAQ,KAAK,CAAC,KAAK,IAAI,KAAK,CAAC,UAAU,MAAM,KAAK,CAAC,KAAK,SAAS,CAAC;QAC7G,KAAK,cAAc;YACjB,OAAO,KAAK,CAAC,MAAM;gBACjB,CAAC,CAAC,GAAG,KAAK,CAAC,IAAI,IAAI,KAAK,CAAC,MAAM,EAAE;gBACjC,CAAC,CAAC,GAAG,KAAK,CAAC,IAAI,IAAI,KAAK,CAAC,SAAS,EAAE,CAAC,CAAC,CAAC,IAAI,GAAG,IAAI,KAAK,CAAC,SAAS,EAAE,CAAC,CAAC,CAAC,IAAI,GAAG,EAAE,CAAC;QACpF,KAAK,UAAU;YACb,OAAO,GAAG,KAAK,CAAC,IAAI,YAAY,KAAK,CAAC,IAAI,GAAG,CAAC;QAChD,KAAK,SAAS;YACZ,OAAO,GAAG,KAAK,CAAC,OAAO,IAAI,KAAK,CAAC,OAAO,MAAM,KAAK,CAAC,WAAW,GAAG,CAAC;QACrE,KAAK,uBAAuB;YAC1B,OAAO,GAAG,KAAK,CAAC,IAAI,MAAM,KAAK,CAAC,MAAM,GAAG,CAAC;QAC5C,KAAK,UAAU,CAAC;QAChB,KAAK,YAAY;YACf,OAAO,KAAK,CAAC,IAAI,CAAC;QACpB,KAAK,YAAY;YACf,OAAO,GAAG,KAAK,CAAC,IAAI,OAAO,KAAK,CAAC,MAAM,GAAG,CAAC;QAC7C,KAAK,aAAa;YAChB,OAAO,IAAI,KAAK,CAAC,IAAI,IAAI,KAAK,CAAC,IAAI,WAAW,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,EAAE,CAAC;IAC5E,CAAC;AACH,CAAC;AAED,SAAS,QAAQ,CAAC,GAAW;IAC3B,IAAI,CAAC,GAAG;QAAE,OAAO,aAAa,CAAC;IAC/B,OAAO,GAAG,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;AACzB,CAAC"}