@vyuhlabs/dxkit 2.4.8 → 2.5.0

package/dist/analyzers/types.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../src/analyzers/types.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAEH,OAAO,KAAK,EACV,kBAAkB,EAClB,cAAc,EACd,aAAa,EACb,iBAAiB,EACjB,aAAa,EACb,cAAc,EACd,UAAU,EACV,aAAa,EACb,gBAAgB,EAChB,mBAAmB,EACpB,MAAM,iCAAiC,CAAC;AACzC,OAAO,KAAK,EAAE,UAAU,EAAE,SAAS,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,YAAY,CAAC;AAC3E,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,uBAAuB,CAAC;AAE/D;;;;;;;;;GASG;AACH,MAAM,WAAW,aAAa;IAC5B,WAAW,EAAE,MAAM,CAAC;IACpB,SAAS,EAAE,MAAM,CAAC;IAClB,UAAU,EAAE,MAAM,CAAC;IACnB,SAAS,EAAE,OAAO,GAAG,IAAI,CAAC;IAC1B,YAAY,EAAE,MAAM,CAAC;IACrB,YAAY,EAAE,MAAM,CAAC;IACrB,oBAAoB,EAAE,OAAO,CAAC;IAE9B,UAAU,EAAE,MAAM,GAAG,IAAI,CAAC;IAE1B,iBAAiB,EAAE,MAAM,CAAC;IAC1B,gBAAgB,EAAE,MAAM,CAAC;IACzB,eAAe,EAAE,MAAM,CAAC;IACxB;;;;;;OAMG;IACH,YAAY,EAAE,KAAK,CAAC;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IACrD,eAAe,EAAE,MAAM,CAAC;IACxB,YAAY,EAAE,MAAM,CAAC;IAErB,WAAW,EAAE,MAAM,CAAC;IACpB,YAAY,EAAE,OAAO,CAAC;IACtB,eAAe,EAAE,MAAM,CAAC;IACxB,YAAY,EAAE,OAAO,CAAC;IACtB,qBAAqB,EAAE,OAAO,CAAC;IAC/B,kBAAkB,EAAE,OAAO,CAAC;IAC5B,eAAe,EAAE,OAAO,CAAC;IAEzB,SAAS,EAAE,MAAM,CAAC;IAClB,eAAe,EAAE,MAAM,CAAC;IACxB,aAAa,EAAE,MAAM,CAAC;IACtB,gBAAgB,EAAE,MAAM,CAAC;IAQzB,SAAS,EAAE,MAAM,CAAC;IAClB,UAAU,EAAE,MAAM,CAAC;IACnB,SAAS,EAAE,MAAM,CAAC;IAClB,UAAU,EAAE,MAAM,CAAC;IACnB,cAAc,EAAE,OAAO,CAAC;IACxB,YAAY,EAAE,MAAM,GAAG,IAAI,CAAC;IAE5B;;;;;;;;;OASG;IACH,WAAW,EAAE,MAAM,CAAC;IACpB;;;;OAIG;IACH,MAAM,EAAE,MAAM,CAAC;IACf;;;;;;OAMG;IACH,iBAAiB,EAAE,MAAM,CAAC;IAC1B,WAAW,EAAE,MAAM,CAAC;IACpB,SAAS,EAAE,KAAK,CAAC;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,CAAC;QAAC,UAAU,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IACrF,iBAAiB,EAAE,MAAM,GAAG,IAAI,CAAC;IAEjC,aAAa,EAAE,MAAM,CAAC;IACtB,iBAAiB,EAAE,MAAM,CAAC;IAC1B,oBAAoB,EAAE,MAAM,CAAC;IAC7B,cAAc,EAAE,OAAO,CAAC;IACxB,gBAAgB,EAAE,OAAO,CAAC;IAC1B,eAAe,EAAE,MAAM,CAAC;IAExB,SAAS,EAAE,MAAM,EAAE,CAAC;IACpB,gBAAgB,EAAE,MAAM,EAAE,CAAC;IAG3B,aAAa,EAAE,KAAK,CAAC;QACnB,QAAQ,EAAE,MAAM,CAAC;QACjB,KAAK,EAAE,MAAM,CAAC;QACd,IAAI,EAAE,MAAM,CAAC;QACb,OAAO,EAAE,MAAM,CAAC;QAChB,KAAK,EAAE,MAAM,CAAC;KACf,CAAC,GAAG,IAAI,CAAC;CACX;AAED;;;;;;;;;;;;;;;;;;GAkBG;AACH,MAAM,WAAW,cAAc;IAC7B,KAAK,EAAE,MAAM,CAAC;IACd,QAAQ,EAAE,MAAM,CAAC;IACjB,MAAM,EAAE,MAAM,CAAC;IACf,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,GAAG,OAAO,GAAG,IAAI,CAAC,CAAC;IAC1D,OAAO,EAAE,MAAM,CAAC;IAChB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,UAAU,CAAC,EAAE,SAAS,SAAS,EAAE,CAAC;IAClC,WAAW,CAAC,EAAE,SAAS,UAAU,EAAE,CAAC;IACpC,UAAU,CAAC,EAAE,SAAS,SAAS,EAAE,CAAC;CACnC;AAED;;;;;;;;;;;GAWG;AACH,MAAM,WAAW,UAAU;IACzB,OAAO,EAAE,aAAa,CAAC;IACvB,YAAY,EAAE,gBAAgB,CAAC;IAC/B;;;;;;;OAOG;IACH,aAAa,CAAC,EAAE,OAAO,UAAU,EAAE,aAAa,CAAC,WAAW,CAAC,CAAC;CAC/D;AAED;;;;;;;;;;;;GAYG;AACH,MAAM,WAAW,gBAAgB;IAC/B,QAAQ,CAAC,EAAE,aAAa,CAAC;IACzB,IAAI,CAAC,EAAE,UAAU,CAAC;IAClB,QAAQ,CAAC,EAAE,cAAc,CAAC;IAC1B,OAAO,CAAC,EAAE,aAAa,CAAC;IACxB,aAAa,CAAC,EAAE,mBAAmB,CAAC;IACpC,OAAO,CAAC,EAAE,aAAa,CAAC;IACxB,YAAY,CAAC,EAAE,kBAAkB,CAAC;IAClC,WAAW,CAAC,EAAE,iBAAiB,CAAC;IAChC,UAAU,CAAC,EAAE,gBAAgB,CAAC;IAC9B;;;;;;;;OAQG;IACH,QAAQ,CAAC,EAAE,cAAc,CAAC;IAE1B;;;;;;;;;;OAUG;IACH,oBAAoB,CAAC,EAAE;QAAE,SAAS,EAAE,OAAO,CAAC;QAAC,iBAAiB,EAAE,MAAM,CAAA;KAAE,CAAC;IAEzE;;;;;;;;;OASG;IACH,gBAAgB,CAAC,EAAE;QAAE,SAAS,EAAE,OAAO,CAAC;QAAC,iBAAiB,EAAE,MAAM,CAAA;KAAE,CAAC;IAErE;;;;oCAIgC;IAChC,wBAAwB,CAAC,EAAE;QAAE,SAAS,EAAE,OAAO,CAAC;QAAC,iBAAiB,EAAE,MAAM,CAAA;KAAE,CAAC;IAE7E,wDAAwD;IACxD,uBAAuB,CAAC,EAAE;QAAE,SAAS,EAAE,OAAO,CAAC;QAAC,iBAAiB,EAAE,MAAM,CAAA;KAAE,CAAC;IAE5E,0DAA0D;IAC1D,sBAAsB,CAAC,EAAE;QAAE,SAAS,EAAE,OAAO,CAAC;QAAC,iBAAiB,EAAE,MAAM,CAAA;KAAE,CAAC;IAC3E;;;;;;;;;;;;;;;;OAgBG;IACH,oBAAoB,CAAC,EAAE;QAAE,SAAS,EAAE,OAAO,CAAC;QAAC,iBAAiB,EAAE,MAAM,CAAA;KAAE,CAAC;IAEzE;;;;;;;;;;OAUG;IACH,iBAAiB,CAAC,EAAE,iBAAiB,CAAC;CACvC;AAED,8BAA8B;AAC9B,MAAM,WAAW,YAAY;IAC3B,IAAI,EAAE,MAAM,CAAC;IACb,UAAU,EAAE,MAAM,CAAC;IACnB,SAAS,EAAE,MAAM,CAAC;IAClB,MAAM,EAAE,MAAM,CAAC;IACf,OAAO,EAAE;QACP,YAAY,EAAE,MAAM,CAAC;QACrB;;;;;;;WAOG;QACH,MAAM,EAAE,MAAM,CAAC;KAChB,CAAC;IACF,UAAU,EAAE;QACV,OAAO,EAAE,cAAc,CAAC;QACxB,OAAO,EAAE,cAAc,CAAC;QACxB,aAAa,EAAE,cAAc,CAAC;QAC9B,QAAQ,EAAE,cAAc,CAAC;QACzB,eAAe,EAAE,cAAc,CAAC;QAChC,mBAAmB,EAAE,cAAc,CAAC;KACrC,CAAC;IACF,SAAS,EAAE,KAAK,CAAC;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,CAAC;QAAC,UAAU,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IACrF;;;;;OAKG;IACH,YAAY,EAAE,KAAK,CAAC;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IACrD,SAAS,EAAE,MAAM,EAAE,CAAC;IACpB,gBAAgB,EAAE,MAAM,EAAE,CAAC;IAC3B;;;;;OAKG;IACH,YAAY,CAAC,EAAE,gBAAgB,CAAC;CACjC"}
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../src/analyzers/types.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAEH,OAAO,KAAK,EACV,kBAAkB,EAClB,cAAc,EACd,aAAa,EACb,iBAAiB,EACjB,aAAa,EACb,cAAc,EACd,UAAU,EACV,aAAa,EACb,gBAAgB,EAChB,mBAAmB,EACpB,MAAM,iCAAiC,CAAC;AACzC,OAAO,KAAK,EAAE,UAAU,EAAE,SAAS,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,YAAY,CAAC;AAC3E,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,uBAAuB,CAAC;AAE/D;;;;;;;;;GASG;AACH,MAAM,WAAW,aAAa;IAC5B,WAAW,EAAE,MAAM,CAAC;IACpB,SAAS,EAAE,MAAM,CAAC;IAClB,UAAU,EAAE,MAAM,CAAC;IACnB,SAAS,EAAE,OAAO,GAAG,IAAI,CAAC;IAC1B,YAAY,EAAE,MAAM,CAAC;IACrB,YAAY,EAAE,MAAM,CAAC;IACrB,oBAAoB,EAAE,OAAO,CAAC;IAE9B,UAAU,EAAE,MAAM,GAAG,IAAI,CAAC;IAE1B,iBAAiB,EAAE,MAAM,CAAC;IAC1B,gBAAgB,EAAE,MAAM,CAAC;IACzB,eAAe,EAAE,MAAM,CAAC;IACxB;;;;;;OAMG;IACH,YAAY,EAAE,KAAK,CAAC;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IACrD,eAAe,EAAE,MAAM,CAAC;IACxB,YAAY,EAAE,MAAM,CAAC;IAErB,WAAW,EAAE,MAAM,CAAC;IACpB,YAAY,EAAE,OAAO,CAAC;IACtB,eAAe,EAAE,MAAM,CAAC;IACxB,YAAY,EAAE,OAAO,CAAC;IACtB,qBAAqB,EAAE,OAAO,CAAC;IAC/B,kBAAkB,EAAE,OAAO,CAAC;IAC5B,eAAe,EAAE,OAAO,CAAC;IAEzB,SAAS,EAAE,MAAM,CAAC;IAClB,eAAe,EAAE,MAAM,CAAC;IACxB,aAAa,EAAE,MAAM,CAAC;IACtB,gBAAgB,EAAE,MAAM,CAAC;IAQzB,SAAS,EAAE,MAAM,CAAC;IAClB,UAAU,EAAE,MAAM,CAAC;IACnB,SAAS,EAAE,MAAM,CAAC;IAClB,UAAU,EAAE,MAAM,CAAC;IACnB,cAAc,EAAE,OAAO,CAAC;IACxB,YAAY,EAAE,MAAM,GAAG,IAAI,CAAC;IAE5B;;;;;;;;;OASG;IACH,WAAW,EAAE,MAAM,CAAC;IACpB;;;;OAIG;IACH,MAAM,EAAE,MAAM,CAAC;IACf;;;;;;OAMG;IACH,iBAAiB,EAAE,MAAM,CAAC;IAC1B,WAAW,EAAE,MAAM,CAAC;IACpB,SAAS,EAAE,KAAK,CAAC;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,CAAC;QAAC,UAAU,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IACrF,iBAAiB,EAAE,MAAM,GAAG,IAAI,CAAC;IAEjC,aAAa,EAAE,MAAM,CAAC;IACtB,iBAAiB,EAAE,MAAM,CAAC;IAC1B,oBAAoB,EAAE,MAAM,CAAC;IAC7B,cAAc,EAAE,OAAO,CAAC;IACxB,gBAAgB,EAAE,OAAO,CAAC;IAC1B,eAAe,EAAE,MAAM,CAAC;IAExB,SAAS,EAAE,MAAM,EAAE,CAAC;IACpB,gBAAgB,EAAE,MAAM,EAAE,CAAC;IAG3B,aAAa,EAAE,KAAK,CAAC;QACnB,QAAQ,EAAE,MAAM,CAAC;QACjB,KAAK,EAAE,MAAM,CAAC;QACd,IAAI,EAAE,MAAM,CAAC;QACb,OAAO,EAAE,MAAM,CAAC;QAChB,KAAK,EAAE,MAAM,CAAC;KACf,CAAC,GAAG,IAAI,CAAC;CACX;AAED;;;;;;;;;;;;;;;;;;GAkBG;AACH,MAAM,WAAW,cAAc;IAC7B,KAAK,EAAE,MAAM,CAAC;IACd,QAAQ,EAAE,MAAM,CAAC;IACjB,MAAM,EAAE,MAAM,CAAC;IACf,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,GAAG,OAAO,GAAG,IAAI,CAAC,CAAC;IAC1D,OAAO,EAAE,MAAM,CAAC;IAChB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,UAAU,CAAC,EAAE,SAAS,SAAS,EAAE,CAAC;IAClC,WAAW,CAAC,EAAE,SAAS,UAAU,EAAE,CAAC;IACpC,UAAU,CAAC,EAAE,SAAS,SAAS,EAAE,CAAC;CACnC;AAED;;;;;;;;;;;GAWG;AACH,MAAM,WAAW,UAAU;IACzB,OAAO,EAAE,aAAa,CAAC;IACvB,YAAY,EAAE,gBAAgB,CAAC;IAC/B;;;;;;;OAOG;IACH,aAAa,CAAC,EAAE,OAAO,UAAU,EAAE,aAAa,CAAC,WAAW,CAAC,CAAC;CAC/D;AAED;;;;;;;;;;;;GAYG;AACH,MAAM,WAAW,gBAAgB;IAC/B,QAAQ,CAAC,EAAE,aAAa,CAAC;IACzB,IAAI,CAAC,EAAE,UAAU,CAAC;IAClB,QAAQ,CAAC,EAAE,cAAc,CAAC;IAC1B,OAAO,CAAC,EAAE,aAAa,CAAC;IACxB,aAAa,CAAC,EAAE,mBAAmB,CAAC;IACpC,OAAO,CAAC,EAAE,aAAa,CAAC;IACxB,YAAY,CAAC,EAAE,kBAAkB,CAAC;IAClC,WAAW,CAAC,EAAE,iBAAiB,CAAC;IAChC,UAAU,CAAC,EAAE,gBAAgB,CAAC;IAC9B;;;;;;;;OAQG;IACH,QAAQ,CAAC,EAAE,cAAc,CAAC;IAE1B;;;;;;;;;;OAUG;IACH,oBAAoB,CAAC,EAAE;QAAE,SAAS,EAAE,OAAO,CAAC;QAAC,iBAAiB,EAAE,MAAM,CAAA;KAAE,CAAC;IAEzE;;;;;;;;;OASG;IACH,gBAAgB,CAAC,EAAE;QAAE,SAAS,EAAE,OAAO,CAAC;QAAC,iBAAiB,EAAE,MAAM,CAAA;KAAE,CAAC;IAErE;;;;oCAIgC;IAChC,wBAAwB,CAAC,EAAE;QAAE,SAAS,EAAE,OAAO,CAAC;QAAC,iBAAiB,EAAE,MAAM,CAAA;KAAE,CAAC;IAE7E,wDAAwD;IACxD,uBAAuB,CAAC,EAAE;QAAE,SAAS,EAAE,OAAO,CAAC;QAAC,iBAAiB,EAAE,MAAM,CAAA;KAAE,CAAC;IAE5E,0DAA0D;IAC1D,sBAAsB,CAAC,EAAE;QAAE,SAAS,EAAE,OAAO,CAAC;QAAC,iBAAiB,EAAE,MAAM,CAAA;KAAE,CAAC;IAC3E;;;;;;;;;;;;;;;;OAgBG;IACH,oBAAoB,CAAC,EAAE;QAAE,SAAS,EAAE,OAAO,CAAC;QAAC,iBAAiB,EAAE,MAAM,CAAA;KAAE,CAAC;IAEzE;;;;;;;;;;OAUG;IACH,iBAAiB,CAAC,EAAE,iBAAiB,CAAC;CACvC;AAED,8BAA8B;AAC9B,MAAM,WAAW,YAAY;IAC3B,IAAI,EAAE,MAAM,CAAC;IACb,UAAU,EAAE,MAAM,CAAC;IACnB,SAAS,EAAE,MAAM,CAAC;IAClB,MAAM,EAAE,MAAM,CAAC;IACf,OAAO,EAAE;QACP,YAAY,EAAE,MAAM,CAAC;QACrB;;;;;;;WAOG;QACH,MAAM,EAAE,MAAM,CAAC;KAChB,CAAC;IACF,UAAU,EAAE;QACV,OAAO,EAAE,cAAc,CAAC;QACxB,OAAO,EAAE,cAAc,CAAC;QACxB,aAAa,EAAE,cAAc,CAAC;QAC9B,QAAQ,EAAE,cAAc,CAAC;QACzB,eAAe,EAAE,cAAc,CAAC;QAChC,mBAAmB,EAAE,cAAc,CAAC;KACrC,CAAC;IACF,SAAS,EAAE,KAAK,CAAC;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,CAAC;QAAC,UAAU,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IACrF;;;;;;;OAOG;IACH,YAAY,EAAE,KAAK,CAAC;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IACrD,SAAS,EAAE,MAAM,EAAE,CAAC;IACpB,gBAAgB,EAAE,MAAM,EAAE,CAAC;IAC3B;;;;;OAKG;IACH,YAAY,CAAC,EAAE,gBAAgB,CAAC;CACjC"}

package/dist/baseline/baseline-file.d.ts

@@ -0,0 +1,104 @@
+/**
+ * On-disk baseline file — `.dxkit/baselines/<name>.json`.
+ *
+ * The baseline file is the durable contract between today's scan
+ * and tomorrow's guardrail check. It carries:
+ *
+ *   - Per-finding identities (`BaselineEntry[]`) for cross-run
+ *     matching.
+ *   - Repo state at capture time (commit SHA, branch) so the
+ *     git-aware matcher knows what to diff against.
+ *   - Analysis-environment metadata (dxkit version, tool versions,
+ *     policy hash, config hashes) so the policy classifier can
+ *     reclassify newly-detected findings as `tooling_drift` or
+ *     `config_drift` rather than blocking them as regressions.
+ *   - The salt-resolution mode used to derive any secret-HMAC
+ *     entries, so the matcher knows whether HMAC comparison is
+ *     available on the current run.
+ *
+ * Raw finding payloads (titles, secret values, source excerpts) are
+ * NEVER stored. The file is committable to git: a leak surfaces
+ * identity fingerprints + locations, but no exploitable content.
+ */
+import type { BaselineEntry } from './types';
+import type { SaltMode } from './salt';
+/** Banner stamped on every baseline file. Bump when the on-disk
+ *  shape changes incompatibly so readers can refuse old / new files
+ *  rather than silently mis-parse them. */
+export declare const BASELINE_SCHEMA_VERSION: "dxkit-baseline/v1";
+export type BaselineSchemaVersion = typeof BASELINE_SCHEMA_VERSION;
+/** Default baseline name when the user doesn't pass `--name`. */
+export declare const DEFAULT_BASELINE_NAME: "main";
+/**
+ * Repo state at the moment of capture. The matcher reads `commitSha`
+ * to drive `git diff` against the current `HEAD`; `branch` and `root`
+ * are recorded for human auditability.
+ */
+export interface BaselineRepoState {
+    readonly commitSha: string;
+    readonly branch: string;
+    readonly root: string;
+}
+/**
+ * Analysis-environment metadata. Hashes are 16-char hex (SHA-1[0:16])
+ * so a diff between baseline and current is one inequality check per
+ * field. Drift on `toolchainHash` triggers `tooling_drift`
+ * reclassification; drift on `policyHash` / `ignoreHash` / `configHash`
+ * triggers `config_drift`.
+ *
+ * `''` is the canonical "absent" value for files that didn't exist at
+ * capture time — so a baseline made before `.dxkit-ignore` existed
+ * doesn't accidentally read as "drift" against a current run where
+ * the file is still absent.
+ */
+export interface BaselineAnalysisMeta {
+    readonly dxkitVersion: string;
+    readonly policyHash: string;
+    readonly ignoreHash: string;
+    readonly toolchainHash: string;
+    readonly configHash: string;
+}
+/**
+ * The full on-disk envelope. Fields are ordered to match the order
+ * the matcher reads them in: identity-related fields first, then
+ * envelope metadata. Serialized via `JSON.stringify(file, null, 2)`
+ * for git-friendly diffs.
+ */
+export interface BaselineFile {
+    readonly schemaVersion: BaselineSchemaVersion;
+    readonly name: string;
+    readonly createdAt: string;
+    readonly repo: BaselineRepoState;
+    readonly analysis: BaselineAnalysisMeta;
+    /** Per-tool version strings keyed by tool name. Sparse: only the
+     *  tools that actually ran appear. Surfaced to the matcher as
+     *  the canonical "what scanned this repo" record so version drift
+     *  is detectable per-tool, not just at the aggregate level. */
+    readonly tools: Readonly<Record<string, string>>;
+    /** Mode used to derive the salt for any `secret-hmac` entries.
+     *  Read by the matcher to decide whether HMAC compare is
+     *  available on the current run. Recorded even when no
+     *  `secret-hmac` entries are present so the value is stable
+     *  across runs that add the first HMAC entry. */
+    readonly saltMode: SaltMode;
+    /** Per-finding entries. Multiset — duplicates allowed (an
+     *  identity appearing twice means two distinct occurrences). */
+    readonly findings: ReadonlyArray<BaselineEntry>;
+}
+/** Default storage directory. Lives under `.dxkit/` alongside the
+ *  generated reports + the salt file. */
+export declare const DEFAULT_BASELINE_DIR: string;
+/** Absolute path for a named baseline inside `cwd`. */
+export declare function pathForBaseline(cwd: string, name: string): string;
+/**
+ * Write a baseline file. Creates the parent directory when missing.
+ * Pretty-printed JSON for git-friendly diffs.
+ */
+export declare function writeBaselineFile(filePath: string, file: BaselineFile): void;
+/**
+ * Read + validate a baseline file. Throws when the schema banner is
+ * missing or unrecognized — fail fast rather than letting the
+ * matcher consume a malformed file and produce wrong verdicts.
+ */
+export declare function readBaselineFile(filePath: string): BaselineFile;
+//# sourceMappingURL=baseline-file.d.ts.map

package/dist/baseline/baseline-file.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"baseline-file.d.ts","sourceRoot":"","sources":["../../src/baseline/baseline-file.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;GAqBG;AAIH,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,SAAS,CAAC;AAC7C,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,QAAQ,CAAC;AAEvC;;2CAE2C;AAC3C,eAAO,MAAM,uBAAuB,EAAG,mBAA4B,CAAC;AACpE,MAAM,MAAM,qBAAqB,GAAG,OAAO,uBAAuB,CAAC;AAEnE,iEAAiE;AACjE,eAAO,MAAM,qBAAqB,EAAG,MAAe,CAAC;AAErD;;;;GAIG;AACH,MAAM,WAAW,iBAAiB;IAChC,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;CACvB;AAED;;;;;;;;;;;GAWG;AACH,MAAM,WAAW,oBAAoB;IACnC,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAC;IAC9B,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,aAAa,EAAE,MAAM,CAAC;IAC/B,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;CAC7B;AAED;;;;;GAKG;AACH,MAAM,WAAW,YAAY;IAC3B,QAAQ,CAAC,aAAa,EAAE,qBAAqB,CAAC;IAC9C,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,IAAI,EAAE,iBAAiB,CAAC;IACjC,QAAQ,CAAC,QAAQ,EAAE,oBAAoB,CAAC;IACxC;;;mEAG+D;IAC/D,QAAQ,CAAC,KAAK,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC;IACjD;;;;qDAIiD;IACjD,QAAQ,CAAC,QAAQ,EAAE,QAAQ,CAAC;IAC5B;oEACgE;IAChE,QAAQ,CAAC,QAAQ,EAAE,aAAa,CAAC,aAAa,CAAC,CAAC;CACjD;AAED;yCACyC;AACzC,eAAO,MAAM,oBAAoB,QAAmC,CAAC;AAErE,uDAAuD;AACvD,wBAAgB,eAAe,CAAC,GAAG,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,MAAM,CAEjE;AAED;;;GAGG;AACH,wBAAgB,iBAAiB,CAAC,QAAQ,EAAE,MAAM,EAAE,IAAI,EAAE,YAAY,GAAG,IAAI,CAG5E;AAED;;;;GAIG;AACH,wBAAgB,gBAAgB,CAAC,QAAQ,EAAE,MAAM,GAAG,YAAY,CAoB/D"}

package/dist/baseline/baseline-file.js

@@ -0,0 +1,110 @@
+"use strict";
+/**
+ * On-disk baseline file — `.dxkit/baselines/<name>.json`.
+ *
+ * The baseline file is the durable contract between today's scan
+ * and tomorrow's guardrail check. It carries:
+ *
+ *   - Per-finding identities (`BaselineEntry[]`) for cross-run
+ *     matching.
+ *   - Repo state at capture time (commit SHA, branch) so the
+ *     git-aware matcher knows what to diff against.
+ *   - Analysis-environment metadata (dxkit version, tool versions,
+ *     policy hash, config hashes) so the policy classifier can
+ *     reclassify newly-detected findings as `tooling_drift` or
+ *     `config_drift` rather than blocking them as regressions.
+ *   - The salt-resolution mode used to derive any secret-HMAC
+ *     entries, so the matcher knows whether HMAC comparison is
+ *     available on the current run.
+ *
+ * Raw finding payloads (titles, secret values, source excerpts) are
+ * NEVER stored. The file is committable to git: a leak surfaces
+ * identity fingerprints + locations, but no exploitable content.
+ */
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.DEFAULT_BASELINE_DIR = exports.DEFAULT_BASELINE_NAME = exports.BASELINE_SCHEMA_VERSION = void 0;
+exports.pathForBaseline = pathForBaseline;
+exports.writeBaselineFile = writeBaselineFile;
+exports.readBaselineFile = readBaselineFile;
+const fs = __importStar(require("fs"));
+const path = __importStar(require("path"));
+/** Banner stamped on every baseline file. Bump when the on-disk
+ *  shape changes incompatibly so readers can refuse old / new files
+ *  rather than silently mis-parse them. */
+exports.BASELINE_SCHEMA_VERSION = 'dxkit-baseline/v1';
+/** Default baseline name when the user doesn't pass `--name`. */
+exports.DEFAULT_BASELINE_NAME = 'main';
+/** Default storage directory. Lives under `.dxkit/` alongside the
+ *  generated reports + the salt file. */
+exports.DEFAULT_BASELINE_DIR = path.join('.dxkit', 'baselines');
+/** Absolute path for a named baseline inside `cwd`. */
+function pathForBaseline(cwd, name) {
+    return path.join(cwd, exports.DEFAULT_BASELINE_DIR, `${name}.json`);
+}
+/**
+ * Write a baseline file. Creates the parent directory when missing.
+ * Pretty-printed JSON for git-friendly diffs.
+ */
+function writeBaselineFile(filePath, file) {
+    fs.mkdirSync(path.dirname(filePath), { recursive: true });
+    fs.writeFileSync(filePath, JSON.stringify(file, null, 2) + '\n', 'utf8');
+}
+/**
+ * Read + validate a baseline file. Throws when the schema banner is
+ * missing or unrecognized — fail fast rather than letting the
+ * matcher consume a malformed file and produce wrong verdicts.
+ */
+function readBaselineFile(filePath) {
+    const raw = fs.readFileSync(filePath, 'utf8');
+    let parsed;
+    try {
+        parsed = JSON.parse(raw);
+    }
+    catch (err) {
+        throw new Error(`baseline file is not valid JSON: ${filePath} (${err.message})`);
+    }
+    if (!parsed || typeof parsed !== 'object' || Array.isArray(parsed)) {
+        throw new Error(`baseline file root is not an object: ${filePath}`);
+    }
+    const obj = parsed;
+    if (obj.schemaVersion !== exports.BASELINE_SCHEMA_VERSION) {
+        throw new Error(`baseline file schemaVersion is ${JSON.stringify(obj.schemaVersion)}; ` +
+            `this dxkit understands ${JSON.stringify(exports.BASELINE_SCHEMA_VERSION)} only ` +
+            `(${filePath})`);
+    }
+    return parsed;
+}
+//# sourceMappingURL=baseline-file.js.map

package/dist/baseline/baseline-file.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"baseline-file.js","sourceRoot":"","sources":["../../src/baseline/baseline-file.ts"],"names":[],"mappings":";AAAA;;;;;;;;;;;;;;;;;;;;;GAqBG;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAgFH,0CAEC;AAMD,8CAGC;AAOD,4CAoBC;AApHD,uCAAyB;AACzB,2CAA6B;AAI7B;;2CAE2C;AAC9B,QAAA,uBAAuB,GAAG,mBAA4B,CAAC;AAGpE,iEAAiE;AACpD,QAAA,qBAAqB,GAAG,MAAe,CAAC;AA6DrD;yCACyC;AAC5B,QAAA,oBAAoB,GAAG,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,WAAW,CAAC,CAAC;AAErE,uDAAuD;AACvD,SAAgB,eAAe,CAAC,GAAW,EAAE,IAAY;IACvD,OAAO,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,4BAAoB,EAAE,GAAG,IAAI,OAAO,CAAC,CAAC;AAC9D,CAAC;AAED;;;GAGG;AACH,SAAgB,iBAAiB,CAAC,QAAgB,EAAE,IAAkB;IACpE,EAAE,CAAC,SAAS,CAAC,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IAC1D,EAAE,CAAC,aAAa,CAAC,QAAQ,EAAE,IAAI,CAAC,SAAS,CAAC,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC,GAAG,IAAI,EAAE,MAAM,CAAC,CAAC;AAC3E,CAAC;AAED;;;;GAIG;AACH,SAAgB,gBAAgB,CAAC,QAAgB;IAC/C,MAAM,GAAG,GAAG,EAAE,CAAC,YAAY,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC;IAC9C,IAAI,MAAe,CAAC;IACpB,IAAI,CAAC;QACH,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IAC3B,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,MAAM,IAAI,KAAK,CAAC,oCAAoC,QAAQ,KAAM,GAAa,CAAC,OAAO,GAAG,CAAC,CAAC;IAC9F,CAAC;IACD,IAAI,CAAC,MAAM,IAAI,OAAO,MAAM,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC;QACnE,MAAM,IAAI,KAAK,CAAC,wCAAwC,QAAQ,EAAE,CAAC,CAAC;IACtE,CAAC;IACD,MAAM,GAAG,GAAG,MAAqC,CAAC;IAClD,IAAI,GAAG,CAAC,aAAa,KAAK,+BAAuB,EAAE,CAAC;QAClD,MAAM,IAAI,KAAK,CACb,kCAAkC,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,aAAa,CAAC,IAAI;YACrE,0BAA0B,IAAI,CAAC,SAAS,CAAC,+BAAuB,CAAC,QAAQ;YACzE,IAAI,QAAQ,GAAG,CAClB,CAAC;IACJ,CAAC;IACD,OAAO,MAAsB,CAAC;AAChC,CAAC"}

package/dist/baseline/check-renderers.d.ts

@@ -0,0 +1,108 @@
+/**
+ * Output renderers for `vyuh-dxkit guardrail check`.
+ *
+ * Three target surfaces, one shared `GuardrailCheckResult`:
+ *
+ *   - **Console** (`renderConsole`) — human-readable text for
+ *     terminal output. Grouped by verdict (blocking / warning /
+ *     informational), each pair showing status + kind + locator +
+ *     severity + reason chain. Color codes via the shared logger
+ *     palette so output blends with the rest of dxkit's CLI.
+ *
+ *   - **JSON** (`renderJson`) — schema-stable machine-readable
+ *     payload (top-level `schema: 'dxkit.guardrail-check.v1'`).
+ *     Designed for AI agents and CI runners that need to programmatically
+ *     decide what to do. Includes the matcher's per-pair detail,
+ *     classifier verdicts, envelope drift, and the resolved policy.
+ *
+ *   - **Markdown** (`renderMarkdown`) — Phase 4 PR-comment template.
+ *     Compact, table-heavy, status-banner-first. Renders into the
+ *     `dxkit-guardrails.yml` workflow's PR comment unchanged. No
+ *     emojis (bot-friendly; Phase 4 templates can layer presentation
+ *     on top).
+ *
+ * Pure modules. No I/O — callers handle stdout writing, file
+ * writing, or PR-comment posting.
+ */
+import type { EnvelopeDrift, GuardrailCheckResult } from './check';
+import type { BrownfieldPolicy } from './policy';
+import type { FindingStatus, MatchReason } from './types';
+/**
+ * Render the check result as a human-readable text block. Returns a
+ * single multi-line string; callers route it to stdout.
+ */
+export declare function renderConsole(result: GuardrailCheckResult): string;
+export declare const GUARDRAIL_JSON_SCHEMA: "dxkit.guardrail-check.v1";
+/**
+ * Schema-stable machine-readable payload. `schema` at the top level
+ * lets downstream tooling version-gate before reading further fields;
+ * bump it when the shape changes incompatibly.
+ */
+export interface GuardrailJsonPayload {
+    readonly schema: typeof GUARDRAIL_JSON_SCHEMA;
+    readonly verdict: {
+        readonly blocks: boolean;
+        readonly warns: boolean;
+        readonly exitCode: 0 | 1;
+    };
+    readonly baseline: {
+        readonly path: string;
+        readonly name: string;
+        readonly createdAt: string;
+        readonly commitSha: string;
+        readonly branch: string;
+        readonly findingsCount: number;
+    };
+    readonly current: {
+        readonly commitSha: string;
+        readonly branch: string;
+        readonly findingsCount: number;
+    };
+    readonly matcher: {
+        readonly gitAware: boolean;
+        readonly degradedReason?: string;
+    };
+    readonly envelopeDrift: EnvelopeDrift;
+    readonly policy: {
+        readonly mode: BrownfieldPolicy['mode'];
+        readonly block: ReadonlyArray<FindingStatus>;
+        readonly warn: ReadonlyArray<FindingStatus>;
+        readonly confidence: BrownfieldPolicy['confidence'];
+        readonly blockRules: BrownfieldPolicy['blockRules'];
+    };
+    readonly summary: {
+        readonly pairs: number;
+        readonly blocking: number;
+        readonly warning: number;
+        readonly persisted: number;
+        readonly resolved: number;
+    };
+    readonly pairs: ReadonlyArray<{
+        readonly status: FindingStatus;
+        readonly blocks: boolean;
+        readonly warns: boolean;
+        readonly priorId?: string;
+        readonly currentId?: string;
+        readonly confidence: number;
+        readonly kind: string;
+        readonly severity?: string;
+        readonly file?: string;
+        readonly line?: number;
+        readonly overlapsChangedLines?: boolean;
+        readonly reasons: ReadonlyArray<MatchReason>;
+    }>;
+}
+export declare function renderJson(result: GuardrailCheckResult): GuardrailJsonPayload;
+/**
+ * PR-comment-friendly markdown. Phase 4's GitHub Actions workflow
+ * pastes the output verbatim into a PR comment. Format:
+ *
+ *   ## Guardrail: PASSED / BLOCKED
+ *   one-line summary
+ *   <blocking findings table, when any>
+ *   <warnings collapsible section, when any>
+ *   <drift signal callout, when envelope drifted>
+ *   <provenance footnote>
+ */
+export declare function renderMarkdown(result: GuardrailCheckResult): string;
+//# sourceMappingURL=check-renderers.d.ts.map

package/dist/baseline/check-renderers.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"check-renderers.d.ts","sourceRoot":"","sources":["../../src/baseline/check-renderers.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;AAGH,OAAO,KAAK,EAAkB,aAAa,EAAE,oBAAoB,EAAE,MAAM,SAAS,CAAC;AACnF,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,UAAU,CAAC;AACjD,OAAO,KAAK,EAAE,aAAa,EAAE,WAAW,EAAE,MAAM,SAAS,CAAC;AAI1D;;;GAGG;AACH,wBAAgB,aAAa,CAAC,MAAM,EAAE,oBAAoB,GAAG,MAAM,CAkFlE;AAkFD,eAAO,MAAM,qBAAqB,EAAG,0BAAmC,CAAC;AAEzE;;;;GAIG;AACH,MAAM,WAAW,oBAAoB;IACnC,QAAQ,CAAC,MAAM,EAAE,OAAO,qBAAqB,CAAC;IAC9C,QAAQ,CAAC,OAAO,EAAE;QAChB,QAAQ,CAAC,MAAM,EAAE,OAAO,CAAC;QACzB,QAAQ,CAAC,KAAK,EAAE,OAAO,CAAC;QACxB,QAAQ,CAAC,QAAQ,EAAE,CAAC,GAAG,CAAC,CAAC;KAC1B,CAAC;IACF,QAAQ,CAAC,QAAQ,EAAE;QACjB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;QACtB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;QACtB,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;QAC3B,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;QAC3B,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;QACxB,QAAQ,CAAC,aAAa,EAAE,MAAM,CAAC;KAChC,CAAC;IACF,QAAQ,CAAC,OAAO,EAAE;QAChB,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;QAC3B,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;QACxB,QAAQ,CAAC,aAAa,EAAE,MAAM,CAAC;KAChC,CAAC;IACF,QAAQ,CAAC,OAAO,EAAE;QAChB,QAAQ,CAAC,QAAQ,EAAE,OAAO,CAAC;QAC3B,QAAQ,CAAC,cAAc,CAAC,EAAE,MAAM,CAAC;KAClC,CAAC;IACF,QAAQ,CAAC,aAAa,EAAE,aAAa,CAAC;IACtC,QAAQ,CAAC,MAAM,EAAE;QACf,QAAQ,CAAC,IAAI,EAAE,gBAAgB,CAAC,MAAM,CAAC,CAAC;QACxC,QAAQ,CAAC,KAAK,EAAE,aAAa,CAAC,aAAa,CAAC,CAAC;QAC7C,QAAQ,CAAC,IAAI,EAAE,aAAa,CAAC,aAAa,CAAC,CAAC;QAC5C,QAAQ,CAAC,UAAU,EAAE,gBAAgB,CAAC,YAAY,CAAC,CAAC;QACpD,QAAQ,CAAC,UAAU,EAAE,gBAAgB,CAAC,YAAY,CAAC,CAAC;KACrD,CAAC;IACF,QAAQ,CAAC,OAAO,EAAE;QAChB,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;QACvB,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;QAC1B,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;QACzB,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;QAC3B,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;KAC3B,CAAC;IACF,QAAQ,CAAC,KAAK,EAAE,aAAa,CAAC;QAC5B,QAAQ,CAAC,MAAM,EAAE,aAAa,CAAC;QAC/B,QAAQ,CAAC,MAAM,EAAE,OAAO,CAAC;QACzB,QAAQ,CAAC,KAAK,EAAE,OAAO,CAAC;QACxB,QAAQ,CAAC,OAAO,CAAC,EAAE,MAAM,CAAC;QAC1B,QAAQ,CAAC,SAAS,CAAC,EAAE,MAAM,CAAC;QAC5B,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;QAC5B,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;QACtB,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,CAAC;QAC3B,QAAQ,CAAC,IAAI,CAAC,EAAE,MAAM,CAAC;QACvB,QAAQ,CAAC,IAAI,CAAC,EAAE,MAAM,CAAC;QACvB,QAAQ,CAAC,oBAAoB,CAAC,EAAE,OAAO,CAAC;QACxC,QAAQ,CAAC,OAAO,EAAE,aAAa,CAAC,WAAW,CAAC,CAAC;KAC9C,CAAC,CAAC;CACJ;AAED,wBAAgB,UAAU,CAAC,MAAM,EAAE,oBAAoB,GAAG,oBAAoB,CAmE7E;AAID;;;;;;;;;;GAUG;AACH,wBAAgB,cAAc,CAAC,MAAM,EAAE,oBAAoB,GAAG,MAAM,CAiEnE"}