@vyuhlabs/dxkit 2.4.8 → 2.5.0

package/dist/baseline/check.js

@@ -0,0 +1,462 @@
+"use strict";
+/**
+ * `dxkit guardrail check` orchestrator.
+ *
+ * The matcher (`gitAwareMatch`) and classifier (`classify`) are pure
+ * modules that already exist. This file wires them together with the
+ * baseline file format, the producer pipeline, and the per-pair
+ * context lookups (severity, drift signals, changed-line overlap)
+ * the classifier needs to make policy decisions.
+ *
+ * Pipeline:
+ *
+ *   1. Load the prior baseline file.
+ *   2. Re-run every analyzer (via `gatherCurrentScan`) to produce the
+ *      current side of the diff.
+ *   3. Convert both sides to `LocatedIdentity[]` and run the
+ *      git-aware matcher.
+ *   4. Build per-pair classify context:
+ *        - severity from the current security aggregate or per-kind
+ *          defaults
+ *        - kind from the matched BaselineEntry
+ *        - scannerVersionDiffers from per-kind tool version compare
+ *        - configDiffers from envelope hash compare
+ *        - overlapsChangedLines from `git diff base..HEAD` hunks
+ *          intersected with the finding's line
+ *   5. Run the brownfield policy classifier over every pair.
+ *   6. Optionally filter via `--changed-only`: drop pairs whose
+ *      locator falls outside the diff. Non-locator pairs (dep-vuln,
+ *      license, duplication, etc.) are always kept — their
+ *      "semantic" identity doesn't map cleanly to changed lines.
+ *   7. Compose a `GuardrailCheckResult` with a deterministic
+ *      blocks/warns verdict so the CLI can pick exit code + render.
+ *
+ * Drift signals come from comparing the baseline's `analysis` /
+ * `tools` envelope against the freshly-gathered envelope. Per-kind
+ * tool attribution uses the current run's `SecurityAggregate.provenance`
+ * — the cleaner alternative to a hardcoded kind→tool table.
+ */
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.runGuardrailCheck = runGuardrailCheck;
+const child_process_1 = require("child_process");
+const fs = __importStar(require("fs"));
+const path = __importStar(require("path"));
+const create_1 = require("./create");
+const baseline_file_1 = require("./baseline-file");
+const entry_to_located_1 = require("./entry-to-located");
+const git_aware_match_1 = require("./git-aware-match");
+const policy_1 = require("./policy");
+const KIND_DEFAULT_SEVERITY = Object.freeze({
+    secret: 'high',
+    code: 'medium',
+    config: 'medium',
+    'dep-vuln': 'medium',
+    duplication: 'medium',
+    'coverage-gap': 'medium',
+    'test-gap': 'medium',
+    hygiene: 'low',
+    license: 'low',
+    'test-file-degradation': 'medium',
+    'god-file': 'medium',
+    'stale-file': 'low',
+    'large-file': 'medium',
+    'secret-hmac': 'high',
+});
+/**
+ * Run the guardrail-check pipeline. Pure-orchestrator: loads the
+ * baseline, gathers current state, runs the matcher + classifier,
+ * and returns a structured result. Renderers + CLI are downstream.
+ */
+async function runGuardrailCheck(options) {
+    const cwd = path.resolve(options.cwd);
+    const baselinePath = options.baselinePath ?? (0, baseline_file_1.pathForBaseline)(cwd, options.name ?? baseline_file_1.DEFAULT_BASELINE_NAME);
+    if (!fs.existsSync(baselinePath)) {
+        throw new Error(`baseline file not found: ${baselinePath}. ` +
+            `Run \`vyuh-dxkit baseline create\` first to capture today's state.`);
+    }
+    const baseline = (0, baseline_file_1.readBaselineFile)(baselinePath);
+    const policy = resolvePolicy(options.policyPath, cwd);
+    const current = await (0, create_1.gatherCurrentScan)({ cwd, verbose: options.verbose });
+    const priorLocated = (0, entry_to_located_1.entriesToLocated)(baseline.findings);
+    const currentLocated = (0, entry_to_located_1.entriesToLocated)(current.findings);
+    // The matcher needs the baseline's anchor commit to drive `git
+    // diff`. Empty string is the canonical "not a git repo at capture
+    // time" value; the matcher's reachability check handles it by
+    // falling back to plain set-diff (passes 1 + 1.5 are skipped).
+    const matchResult = (0, git_aware_match_1.gitAwareMatch)(priorLocated, currentLocated, {
+        cwd,
+        baseSha: baseline.repo.commitSha || 'HEAD',
+        headSha: 'HEAD',
+    });
+    const priorById = indexById(baseline.findings);
+    const currentById = indexById(current.findings);
+    const severityByCurrentId = buildSeverityIndex(current.aggregate);
+    const envelopeDrift = diffEnvelopes(baseline, current);
+    // Per-kind tool attribution drives the per-pair
+    // scannerVersionDiffers signal. A pair is in drift only when the
+    // tools that produced its kind actually changed version between
+    // runs — narrower than "any tool drifted globally," which would
+    // overstate the drift signal for unrelated kinds.
+    const toolsByKind = buildToolsByKind(current.aggregate);
+    const changedLineCache = new Map();
+    const headSha = readHeadSha(cwd);
+    const baseSha = baseline.repo.commitSha;
+    const linesChangedFor = (file) => {
+        if (!baseSha || !headSha)
+            return undefined;
+        let cached = changedLineCache.get(file);
+        if (cached)
+            return cached;
+        cached = readChangedLineSet(cwd, baseSha, headSha, file);
+        changedLineCache.set(file, cached);
+        return cached;
+    };
+    const classifiedPairs = [];
+    let blocks = false;
+    let warns = false;
+    for (const pair of matchResult.pairs) {
+        const anchorEntry = (pair.currentId ? currentById.get(pair.currentId) : undefined) ??
+            (pair.priorId ? priorById.get(pair.priorId) : undefined);
+        if (!anchorEntry)
+            continue;
+        const severity = (pair.currentId ? severityByCurrentId.get(pair.currentId) : undefined) ??
+            KIND_DEFAULT_SEVERITY[anchorEntry.kind];
+        const file = locatorFile(anchorEntry);
+        const line = locatorLine(anchorEntry);
+        const overlapsChangedLines = file !== undefined && line !== undefined && line > 0
+            ? (linesChangedFor(file)?.has(line) ?? false)
+            : undefined;
+        const scannerVersionDiffers = pair.status === 'added' && kindHasDriftingTool(anchorEntry.kind, toolsByKind, envelopeDrift);
+        const configDiffers = pair.status === 'added' &&
+            (envelopeDrift.configHashChanged ||
+                envelopeDrift.ignoreHashChanged ||
+                envelopeDrift.policyHashChanged);
+        const context = {
+            severity,
+            kind: anchorEntry.kind,
+            ...(scannerVersionDiffers ? { scannerVersionDiffers: true } : {}),
+            ...(configDiffers ? { configDiffers: true } : {}),
+            ...(overlapsChangedLines !== undefined ? { overlapsChangedLines } : {}),
+        };
+        const classification = (0, policy_1.classify)(pair, policy, context);
+        if (classification.blocks)
+            blocks = true;
+        if (classification.warns)
+            warns = true;
+        classifiedPairs.push({
+            pair,
+            classification,
+            severity,
+            kind: anchorEntry.kind,
+            ...(file !== undefined ? { file } : {}),
+            ...(line !== undefined ? { line } : {}),
+            ...(overlapsChangedLines !== undefined ? { overlapsChangedLines } : {}),
+        });
+    }
+    const filteredPairs = options.changedOnly
+        ? classifiedPairs.filter((p) => keepUnderChangedOnly(p))
+        : classifiedPairs;
+    // Re-derive the verdict after filtering — a --changed-only run
+    // shouldn't be blocked by a pair that the filter just dropped.
+    let filteredBlocks = false;
+    let filteredWarns = false;
+    for (const p of filteredPairs) {
+        if (p.classification.blocks)
+            filteredBlocks = true;
+        if (p.classification.warns)
+            filteredWarns = true;
+    }
+    return {
+        baselinePath,
+        baseline,
+        current,
+        matchResult,
+        pairs: filteredPairs,
+        envelopeDrift,
+        policy,
+        blocks: options.changedOnly ? filteredBlocks : blocks,
+        warns: options.changedOnly ? filteredWarns : warns,
+    };
+}
+/** Conventional location for a per-repo brownfield policy. Loaded
+ *  automatically when present; can be overridden with `--policy`. */
+const DEFAULT_POLICY_FILENAME = path.join('.dxkit', 'policy.json');
+function resolvePolicy(policyPath, cwd) {
+    // Resolution order:
+    //   1. `--policy <path>` flag (explicit; errors if unreadable)
+    //   2. `<cwd>/.dxkit/policy.json` (conventional; silently skipped
+    //      when absent so consumers without a policy use the defaults)
+    //   3. DEFAULT_BROWNFIELD_POLICY (compiled-in defaults)
+    let resolvedPath = policyPath;
+    if (!resolvedPath) {
+        const conventional = path.join(cwd, DEFAULT_POLICY_FILENAME);
+        if (fs.existsSync(conventional))
+            resolvedPath = conventional;
+    }
+    if (!resolvedPath)
+        return policy_1.DEFAULT_BROWNFIELD_POLICY;
+    let raw;
+    try {
+        raw = fs.readFileSync(resolvedPath, 'utf8');
+    }
+    catch (err) {
+        throw new Error(`policy file not readable: ${resolvedPath} (${err.message})`);
+    }
+    let parsed;
+    try {
+        parsed = JSON.parse(raw);
+    }
+    catch (err) {
+        throw new Error(`policy file is not valid JSON: ${resolvedPath} (${err.message})`);
+    }
+    if (!parsed || typeof parsed !== 'object' || Array.isArray(parsed)) {
+        throw new Error(`policy file root is not an object: ${resolvedPath}`);
+    }
+    // Shallow merge over the default. Per-field overrides win; unknown
+    // fields are preserved (the classifier reads only the fields it
+    // knows so unknowns are harmless).
+    const obj = parsed;
+    return {
+        ...policy_1.DEFAULT_BROWNFIELD_POLICY,
+        ...obj,
+        confidence: { ...policy_1.DEFAULT_BROWNFIELD_POLICY.confidence, ...(obj.confidence ?? {}) },
+        blockRules: { ...policy_1.DEFAULT_BROWNFIELD_POLICY.blockRules, ...(obj.blockRules ?? {}) },
+        block: obj.block ?? policy_1.DEFAULT_BROWNFIELD_POLICY.block,
+        warn: obj.warn ?? policy_1.DEFAULT_BROWNFIELD_POLICY.warn,
+        addedRequiresChangedLines: obj.addedRequiresChangedLines ?? policy_1.DEFAULT_BROWNFIELD_POLICY.addedRequiresChangedLines,
+        mode: 'brownfield',
+    };
+}
+function indexById(entries) {
+    const out = new Map();
+    for (const e of entries)
+        out.set(e.id, e);
+    return out;
+}
+/**
+ * Severity-by-fingerprint index built from the current run's
+ * security aggregate. CodeFindings carry `fingerprint` (computed via
+ * `computeCodeFingerprint` — the same hash `identityFor` produces
+ * for secret/code/config kinds), and DepVulnFindings carry
+ * `fingerprint` (computed via `computeFingerprint` — same as
+ * identityFor for dep-vulns). For other kinds the lookup misses and
+ * the caller falls back to `KIND_DEFAULT_SEVERITY`.
+ */
+function buildSeverityIndex(aggregate) {
+    const out = new Map();
+    for (const f of aggregate.findingsByCategory.secret) {
+        if (f.fingerprint)
+            out.set(f.fingerprint, f.severity);
+    }
+    for (const f of aggregate.findingsByCategory.code) {
+        if (f.fingerprint)
+            out.set(f.fingerprint, f.severity);
+    }
+    for (const f of aggregate.findingsByCategory.config) {
+        if (f.fingerprint)
+            out.set(f.fingerprint, f.severity);
+    }
+    for (const f of aggregate.findingsByCategory.dependency) {
+        if (f.fingerprint)
+            out.set(f.fingerprint, f.severity);
+    }
+    return out;
+}
+/**
+ * Build a per-kind map of "tools that produced this kind in the
+ * current run." Used by the `scannerVersionDiffers` per-pair
+ * computation: a pair is in tool drift only when one of the tools
+ * that produced its kind has actually drifted version.
+ */
+function buildToolsByKind(aggregate) {
+    const secretTool = aggregate.provenance.secrets.tool ?? undefined;
+    const codeTool = aggregate.provenance.codePatterns.tool ?? undefined;
+    const depTool = aggregate.provenance.depVulns.tool ?? undefined;
+    const tlsBypassRan = aggregate.provenance.tlsBypass.ran;
+    const codeTools = new Set();
+    if (codeTool)
+        codeTools.add(codeTool);
+    if (tlsBypassRan)
+        codeTools.add('tls-bypass-registry');
+    const secretTools = new Set();
+    if (secretTool)
+        secretTools.add(secretTool);
+    const depTools = new Set();
+    if (depTool)
+        depTools.add(depTool);
+    return {
+        secret: secretTools,
+        code: codeTools,
+        config: secretTools, // .env-in-git + private-key files come from the secrets/file pass
+        'dep-vuln': depTools,
+        'secret-hmac': secretTools,
+    };
+}
+function kindHasDriftingTool(kind, toolsByKind, drift) {
+    const tools = toolsByKind[kind];
+    if (!tools || tools.size === 0)
+        return false;
+    for (const diff of drift.toolVersionDiffs) {
+        if (tools.has(diff.tool))
+            return true;
+    }
+    return false;
+}
+function diffEnvelopes(baseline, current) {
+    const toolVersionDiffs = [];
+    const names = new Set([...Object.keys(baseline.tools), ...Object.keys(current.tools)]);
+    for (const tool of [...names].sort()) {
+        const baselineVersion = baseline.tools[tool];
+        const currentVersion = current.tools[tool];
+        if (baselineVersion !== currentVersion) {
+            toolVersionDiffs.push({ tool, baselineVersion, currentVersion });
+        }
+    }
+    return {
+        toolchainHashChanged: baseline.analysis.toolchainHash !== current.analysisMeta.toolchainHash,
+        policyHashChanged: baseline.analysis.policyHash !== current.analysisMeta.policyHash,
+        ignoreHashChanged: baseline.analysis.ignoreHash !== current.analysisMeta.ignoreHash,
+        configHashChanged: baseline.analysis.configHash !== current.analysisMeta.configHash,
+        dxkitVersionChanged: baseline.analysis.dxkitVersion !== current.analysisMeta.dxkitVersion,
+        toolVersionDiffs,
+    };
+}
+function locatorFile(entry) {
+    switch (entry.kind) {
+        case 'secret':
+        case 'code':
+        case 'config':
+        case 'hygiene':
+        case 'test-gap':
+        case 'test-file-degradation':
+        case 'god-file':
+        case 'stale-file':
+        case 'large-file':
+            return entry.file;
+        case 'coverage-gap':
+            return entry.file;
+        case 'duplication':
+            return entry.fileA;
+        case 'dep-vuln':
+        case 'license':
+        case 'secret-hmac':
+            return undefined;
+    }
+}
+function locatorLine(entry) {
+    switch (entry.kind) {
+        case 'secret':
+        case 'code':
+        case 'config':
+        case 'hygiene':
+            return entry.line;
+        case 'duplication':
+            return entry.startLineA;
+        case 'coverage-gap':
+            return entry.lineRange?.[0];
+        default:
+            return undefined;
+    }
+}
+/**
+ * `--changed-only` filter predicate. Keeps:
+ *   - pairs without a line locator (dep-vuln, license, duplication,
+ *     etc.) — their identity isn't line-bound, so changed-line
+ *     overlap doesn't apply
+ *   - prior-side pairs (persisted / relocated / removed) — they
+ *     represent existing state, not newly-introduced findings, so
+ *     they pass regardless of where they live in the diff
+ *   - new-side pairs whose anchor line is inside the diff
+ *
+ * Drops new-side pairs (added / tooling_drift / config_drift /
+ * newly_detected) whose locator IS known but doesn't overlap any
+ * changed line. That's the exact scope a pre-commit / pre-push hook
+ * wants — "only flag what this developer just touched."
+ */
+function keepUnderChangedOnly(p) {
+    if (p.file === undefined || p.line === undefined)
+        return true;
+    const isNewSide = p.classification.status === 'added' ||
+        p.classification.status === 'tooling_drift' ||
+        p.classification.status === 'config_drift' ||
+        p.classification.status === 'newly_detected';
+    if (!isNewSide)
+        return true;
+    return p.overlapsChangedLines === true;
+}
+function readHeadSha(cwd) {
+    try {
+        return (0, child_process_1.execFileSync)('git', ['rev-parse', 'HEAD'], { cwd, encoding: 'utf8' }).trim();
+    }
+    catch {
+        return '';
+    }
+}
+/**
+ * Compute the set of HEAD-side line numbers modified between
+ * `baseSha` and `headSha` for `file`. Used by the per-pair
+ * `overlapsChangedLines` signal: a current-side finding at line N
+ * overlaps the diff iff N is in this set.
+ *
+ * Walks `git diff --unified=0` hunks. Returns an empty set on any
+ * failure (file missing in either revision, git unavailable, etc.).
+ */
+function readChangedLineSet(cwd, baseSha, headSha, file) {
+    const out = new Set();
+    let diff;
+    try {
+        diff = (0, child_process_1.execFileSync)('git', ['diff', '--unified=0', '--no-color', '--find-renames', baseSha, headSha, '--', file], { cwd, encoding: 'utf8' });
+    }
+    catch {
+        return out;
+    }
+    if (!diff.trim())
+        return out;
+    const hunkRe = /^@@ -\d+(?:,\d+)? \+(\d+)(?:,(\d+))? @@/gm;
+    let match;
+    while ((match = hunkRe.exec(diff)) !== null) {
+        const newStart = parseInt(match[1], 10);
+        const newCount = match[2] !== undefined ? parseInt(match[2], 10) : 1;
+        if (newCount === 0) {
+            // Pure-deletion hunk on the new side — no new-side lines.
+            continue;
+        }
+        for (let i = 0; i < newCount; i++)
+            out.add(newStart + i);
+    }
+    return out;
+}
+//# sourceMappingURL=check.js.map

package/dist/baseline/check.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"check.js","sourceRoot":"","sources":["../../src/baseline/check.ts"],"names":[],"mappings":";AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAoCG;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AA2HH,8CAiIC;AA1PD,iDAA6C;AAC7C,uCAAyB;AACzB,2CAA6B;AAC7B,qCAA6C;AAE7C,mDAA2F;AAE3F,yDAAsD;AACtD,uDAAkD;AAElD,qCAA+D;AAwF/D,MAAM,qBAAqB,GACzB,MAAM,CAAC,MAAM,CAAC;IACZ,MAAM,EAAE,MAAM;IACd,IAAI,EAAE,QAAQ;IACd,MAAM,EAAE,QAAQ;IAChB,UAAU,EAAE,QAAQ;IACpB,WAAW,EAAE,QAAQ;IACrB,cAAc,EAAE,QAAQ;IACxB,UAAU,EAAE,QAAQ;IACpB,OAAO,EAAE,KAAK;IACd,OAAO,EAAE,KAAK;IACd,uBAAuB,EAAE,QAAQ;IACjC,UAAU,EAAE,QAAQ;IACpB,YAAY,EAAE,KAAK;IACnB,YAAY,EAAE,QAAQ;IACtB,aAAa,EAAE,MAAM;CACtB,CAAC,CAAC;AAEL;;;;GAIG;AACI,KAAK,UAAU,iBAAiB,CACrC,OAAiC;IAEjC,MAAM,GAAG,GAAG,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;IACtC,MAAM,YAAY,GAChB,OAAO,CAAC,YAAY,IAAI,IAAA,+BAAe,EAAC,GAAG,EAAE,OAAO,CAAC,IAAI,IAAI,qCAAqB,CAAC,CAAC;IACtF,IAAI,CAAC,EAAE,CAAC,UAAU,CAAC,YAAY,CAAC,EAAE,CAAC;QACjC,MAAM,IAAI,KAAK,CACb,4BAA4B,YAAY,IAAI;YAC1C,oEAAoE,CACvE,CAAC;IACJ,CAAC;IACD,MAAM,QAAQ,GAAG,IAAA,gCAAgB,EAAC,YAAY,CAAC,CAAC;IAChD,MAAM,MAAM,GAAG,aAAa,CAAC,OAAO,CAAC,UAAU,EAAE,GAAG,CAAC,CAAC;IAEtD,MAAM,OAAO,GAAG,MAAM,IAAA,0BAAiB,EAAC,EAAE,GAAG,EAAE,OAAO,EAAE,OAAO,CAAC,OAAO,EAAE,CAAC,CAAC;IAE3E,MAAM,YAAY,GAAmC,IAAA,mCAAgB,EAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC;IACzF,MAAM,cAAc,GAAmC,IAAA,mCAAgB,EAAC,OAAO,CAAC,QAAQ,CAAC,CAAC;IAE1F,+DAA+D;IAC/D,kEAAkE;IAClE,8DAA8D;IAC9D,+DAA+D;IAC/D,MAAM,WAAW,GAAG,IAAA,+BAAa,EAAC,YAAY,EAAE,cAAc,EAAE;QAC9D,GAAG;QACH,OAAO,EAAE,QAAQ,CAAC,IAAI,CAAC,SAAS,IAAI,MAAM;QAC1C,OAAO,EAAE,MAAM;KAChB,CAAC,CAAC;IAEH,MAAM,SAAS,GAAG,SAAS,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC;IAC/C,MAAM,WAAW,GAAG,SAAS,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC;IAChD,MAAM,mBAAmB,GAAG,kBAAkB,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC;IAClE,MAAM,aAAa,GAAG,aAAa,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC;IAEvD,gDAAgD;IAChD,iEAAiE;IACjE,gEAAgE;IAChE,gEAAgE;IAChE,kDAAkD;IAClD,MAAM,WAAW,GAAG,gBAAgB,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC;IAExD,MAAM,gBAAgB,GAAG,IAAI,GAAG,EAAuB,CAAC;IACxD,MAAM,OAAO,GAAG,WAAW,CAAC,GAAG,CAAC,CAAC;IACjC,MAAM,OAAO,GAAG,QAAQ,CAAC,IAAI,CAAC,SAAS,CAAC;IACxC,MAAM,eAAe,GAAG,CAAC,IAAY,EAA2B,EAAE;QAChE,IAAI,CAAC,OAAO,IAAI,CAAC,OAAO;YAAE,OAAO,SAAS,CAAC;QAC3C,IAAI,MAAM,GAAG,gBAAgB,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;QACxC,IAAI,MAAM;YAAE,OAAO,MAAM,CAAC;QAC1B,MAAM,GAAG,kBAAkB,CAAC,GAAG,EAAE,OAAO,EAAE,OAAO,EAAE,IAAI,CAAC,CAAC;QACzD,gBAAgB,CAAC,GAAG,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;QACnC,OAAO,MAAM,CAAC;IAChB,CAAC,CAAC;IAEF,MAAM,eAAe,GAAqB,EAAE,CAAC;IAC7C,IAAI,MAAM,GAAG,KAAK,CAAC;IACnB,IAAI,KAAK,GAAG,KAAK,CAAC;IAClB,KAAK,MAAM,IAAI,IAAI,WAAW,CAAC,KAAK,EAAE,CAAC;QACrC,MAAM,WAAW,GACf,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,WAAW,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;YAC9D,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,SAAS,CAAC,GAAG,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC;QAC3D,IAAI,CAAC,WAAW;YAAE,SAAS;QAE3B,MAAM,QAAQ,GACZ,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,mBAAmB,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;YACtE,qBAAqB,CAAC,WAAW,CAAC,IAAI,CAAC,CAAC;QAE1C,MAAM,IAAI,GAAG,WAAW,CAAC,WAAW,CAAC,CAAC;QACtC,MAAM,IAAI,GAAG,WAAW,CAAC,WAAW,CAAC,CAAC;QACtC,MAAM,oBAAoB,GACxB,IAAI,KAAK,SAAS,IAAI,IAAI,KAAK,SAAS,IAAI,IAAI,GAAG,CAAC;YAClD,CAAC,CAAC,CAAC,eAAe,CAAC,IAAI,CAAC,EAAE,GAAG,CAAC,IAAI,CAAC,IAAI,KAAK,CAAC;YAC7C,CAAC,CAAC,SAAS,CAAC;QAEhB,MAAM,qBAAqB,GACzB,IAAI,CAAC,MAAM,KAAK,OAAO,IAAI,mBAAmB,CAAC,WAAW,CAAC,IAAI,EAAE,WAAW,EAAE,aAAa,CAAC,CAAC;QAC/F,MAAM,aAAa,GACjB,IAAI,CAAC,MAAM,KAAK,OAAO;YACvB,CAAC,aAAa,CAAC,iBAAiB;gBAC9B,aAAa,CAAC,iBAAiB;gBAC/B,aAAa,CAAC,iBAAiB,CAAC,CAAC;QAErC,MAAM,OAAO,GAAoB;YAC/B,QAAQ;YACR,IAAI,EAAE,WAAW,CAAC,IAAI;YACtB,GAAG,CAAC,qBAAqB,CAAC,CAAC,CAAC,EAAE,qBAAqB,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YACjE,GAAG,CAAC,aAAa,CAAC,CAAC,CAAC,EAAE,aAAa,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YACjD,GAAG,CAAC,oBAAoB,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,oBAAoB,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SACxE,CAAC;QAEF,MAAM,cAAc,GAAG,IAAA,iBAAQ,EAAC,IAAI,EAAE,MAAM,EAAE,OAAO,CAAC,CAAC;QACvD,IAAI,cAAc,CAAC,MAAM;YAAE,MAAM,GAAG,IAAI,CAAC;QACzC,IAAI,cAAc,CAAC,KAAK;YAAE,KAAK,GAAG,IAAI,CAAC;QAEvC,eAAe,CAAC,IAAI,CAAC;YACnB,IAAI;YACJ,cAAc;YACd,QAAQ;YACR,IAAI,EAAE,WAAW,CAAC,IAAI;YACtB,GAAG,CAAC,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YACvC,GAAG,CAAC,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YACvC,GAAG,CAAC,oBAAoB,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,oBAAoB,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SACxE,CAAC,CAAC;IACL,CAAC;IAED,MAAM,aAAa,GAAG,OAAO,CAAC,WAAW;QACvC,CAAC,CAAC,eAAe,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,oBAAoB,CAAC,CAAC,CAAC,CAAC;QACxD,CAAC,CAAC,eAAe,CAAC;IAEpB,+DAA+D;IAC/D,+DAA+D;IAC/D,IAAI,cAAc,GAAG,KAAK,CAAC;IAC3B,IAAI,aAAa,GAAG,KAAK,CAAC;IAC1B,KAAK,MAAM,CAAC,IAAI,aAAa,EAAE,CAAC;QAC9B,IAAI,CAAC,CAAC,cAAc,CAAC,MAAM;YAAE,cAAc,GAAG,IAAI,CAAC;QACnD,IAAI,CAAC,CAAC,cAAc,CAAC,KAAK;YAAE,aAAa,GAAG,IAAI,CAAC;IACnD,CAAC;IAED,OAAO;QACL,YAAY;QACZ,QAAQ;QACR,OAAO;QACP,WAAW;QACX,KAAK,EAAE,aAAa;QACpB,aAAa;QACb,MAAM;QACN,MAAM,EAAE,OAAO,CAAC,WAAW,CAAC,CAAC,CAAC,cAAc,CAAC,CAAC,CAAC,MAAM;QACrD,KAAK,EAAE,OAAO,CAAC,WAAW,CAAC,CAAC,CAAC,aAAa,CAAC,CAAC,CAAC,KAAK;KACnD,CAAC;AACJ,CAAC;AAED;qEACqE;AACrE,MAAM,uBAAuB,GAAG,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,aAAa,CAAC,CAAC;AAEnE,SAAS,aAAa,CAAC,UAA8B,EAAE,GAAW;IAChE,oBAAoB;IACpB,+DAA+D;IAC/D,kEAAkE;IAClE,mEAAmE;IACnE,wDAAwD;IACxD,IAAI,YAAY,GAAuB,UAAU,CAAC;IAClD,IAAI,CAAC,YAAY,EAAE,CAAC;QAClB,MAAM,YAAY,GAAG,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,uBAAuB,CAAC,CAAC;QAC7D,IAAI,EAAE,CAAC,UAAU,CAAC,YAAY,CAAC;YAAE,YAAY,GAAG,YAAY,CAAC;IAC/D,CAAC;IACD,IAAI,CAAC,YAAY;QAAE,OAAO,kCAAyB,CAAC;IACpD,IAAI,GAAW,CAAC;IAChB,IAAI,CAAC;QACH,GAAG,GAAG,EAAE,CAAC,YAAY,CAAC,YAAY,EAAE,MAAM,CAAC,CAAC;IAC9C,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,MAAM,IAAI,KAAK,CAAC,6BAA6B,YAAY,KAAM,GAAa,CAAC,OAAO,GAAG,CAAC,CAAC;IAC3F,CAAC;IACD,IAAI,MAAe,CAAC;IACpB,IAAI,CAAC;QACH,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IAC3B,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,MAAM,IAAI,KAAK,CAAC,kCAAkC,YAAY,KAAM,GAAa,CAAC,OAAO,GAAG,CAAC,CAAC;IAChG,CAAC;IACD,IAAI,CAAC,MAAM,IAAI,OAAO,MAAM,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC;QACnE,MAAM,IAAI,KAAK,CAAC,sCAAsC,YAAY,EAAE,CAAC,CAAC;IACxE,CAAC;IACD,mEAAmE;IACnE,gEAAgE;IAChE,mCAAmC;IACnC,MAAM,GAAG,GAAG,MAAmC,CAAC;IAChD,OAAO;QACL,GAAG,kCAAyB;QAC5B,GAAG,GAAG;QACN,UAAU,EAAE,EAAE,GAAG,kCAAyB,CAAC,UAAU,EAAE,GAAG,CAAC,GAAG,CAAC,UAAU,IAAI,EAAE,CAAC,EAAE;QAClF,UAAU,EAAE,EAAE,GAAG,kCAAyB,CAAC,UAAU,EAAE,GAAG,CAAC,GAAG,CAAC,UAAU,IAAI,EAAE,CAAC,EAAE;QAClF,KAAK,EAAE,GAAG,CAAC,KAAK,IAAI,kCAAyB,CAAC,KAAK;QACnD,IAAI,EAAE,GAAG,CAAC,IAAI,IAAI,kCAAyB,CAAC,IAAI;QAChD,yBAAyB,EACvB,GAAG,CAAC,yBAAyB,IAAI,kCAAyB,CAAC,yBAAyB;QACtF,IAAI,EAAE,YAAY;KACnB,CAAC;AACJ,CAAC;AAED,SAAS,SAAS,CAAC,OAAqC;IACtD,MAAM,GAAG,GAAG,IAAI,GAAG,EAA4B,CAAC;IAChD,KAAK,MAAM,CAAC,IAAI,OAAO;QAAE,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC;IAC1C,OAAO,GAAG,CAAC;AACb,CAAC;AAED;;;;;;;;GAQG;AACH,SAAS,kBAAkB,CAAC,SAA4B;IACtD,MAAM,GAAG,GAAG,IAAI,GAAG,EAA8B,CAAC;IAClD,KAAK,MAAM,CAAC,IAAI,SAAS,CAAC,kBAAkB,CAAC,MAAM,EAAE,CAAC;QACpD,IAAI,CAAC,CAAC,WAAW;YAAE,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC,CAAC,QAAQ,CAAC,CAAC;IACxD,CAAC;IACD,KAAK,MAAM,CAAC,IAAI,SAAS,CAAC,kBAAkB,CAAC,IAAI,EAAE,CAAC;QAClD,IAAI,CAAC,CAAC,WAAW;YAAE,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC,CAAC,QAAQ,CAAC,CAAC;IACxD,CAAC;IACD,KAAK,MAAM,CAAC,IAAI,SAAS,CAAC,kBAAkB,CAAC,MAAM,EAAE,CAAC;QACpD,IAAI,CAAC,CAAC,WAAW;YAAE,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC,CAAC,QAAQ,CAAC,CAAC;IACxD,CAAC;IACD,KAAK,MAAM,CAAC,IAAI,SAAS,CAAC,kBAAkB,CAAC,UAAU,EAAE,CAAC;QACxD,IAAI,CAAC,CAAC,WAAW;YAAE,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC,CAAC,QAAQ,CAAC,CAAC;IACxD,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED;;;;;GAKG;AACH,SAAS,gBAAgB,CACvB,SAA4B;IAE5B,MAAM,UAAU,GAAG,SAAS,CAAC,UAAU,CAAC,OAAO,CAAC,IAAI,IAAI,SAAS,CAAC;IAClE,MAAM,QAAQ,GAAG,SAAS,CAAC,UAAU,CAAC,YAAY,CAAC,IAAI,IAAI,SAAS,CAAC;IACrE,MAAM,OAAO,GAAG,SAAS,CAAC,UAAU,CAAC,QAAQ,CAAC,IAAI,IAAI,SAAS,CAAC;IAChE,MAAM,YAAY,GAAG,SAAS,CAAC,UAAU,CAAC,SAAS,CAAC,GAAG,CAAC;IAExD,MAAM,SAAS,GAAG,IAAI,GAAG,EAAU,CAAC;IACpC,IAAI,QAAQ;QAAE,SAAS,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;IACtC,IAAI,YAAY;QAAE,SAAS,CAAC,GAAG,CAAC,qBAAqB,CAAC,CAAC;IAEvD,MAAM,WAAW,GAAG,IAAI,GAAG,EAAU,CAAC;IACtC,IAAI,UAAU;QAAE,WAAW,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC;IAE5C,MAAM,QAAQ,GAAG,IAAI,GAAG,EAAU,CAAC;IACnC,IAAI,OAAO;QAAE,QAAQ,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;IAEnC,OAAO;QACL,MAAM,EAAE,WAAW;QACnB,IAAI,EAAE,SAAS;QACf,MAAM,EAAE,WAAW,EAAE,kEAAkE;QACvF,UAAU,EAAE,QAAQ;QACpB,aAAa,EAAE,WAAW;KAC3B,CAAC;AACJ,CAAC;AAED,SAAS,mBAAmB,CAC1B,IAA2B,EAC3B,WAAkF,EAClF,KAAoB;IAEpB,MAAM,KAAK,GAAG,WAAW,CAAC,IAAI,CAAC,CAAC;IAChC,IAAI,CAAC,KAAK,IAAI,KAAK,CAAC,IAAI,KAAK,CAAC;QAAE,OAAO,KAAK,CAAC;IAC7C,KAAK,MAAM,IAAI,IAAI,KAAK,CAAC,gBAAgB,EAAE,CAAC;QAC1C,IAAI,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC;YAAE,OAAO,IAAI,CAAC;IACxC,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED,SAAS,aAAa,CAAC,QAAsB,EAAE,OAAoB;IACjE,MAAM,gBAAgB,GAIjB,EAAE,CAAC;IACR,MAAM,KAAK,GAAG,IAAI,GAAG,CAAS,CAAC,GAAG,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC,EAAE,GAAG,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;IAC/F,KAAK,MAAM,IAAI,IAAI,CAAC,GAAG,KAAK,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC;QACrC,MAAM,eAAe,GAAG,QAAQ,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;QAC7C,MAAM,cAAc,GAAG,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;QAC3C,IAAI,eAAe,KAAK,cAAc,EAAE,CAAC;YACvC,gBAAgB,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,eAAe,EAAE,cAAc,EAAE,CAAC,CAAC;QACnE,CAAC;IACH,CAAC;IACD,OAAO;QACL,oBAAoB,EAAE,QAAQ,CAAC,QAAQ,CAAC,aAAa,KAAK,OAAO,CAAC,YAAY,CAAC,aAAa;QAC5F,iBAAiB,EAAE,QAAQ,CAAC,QAAQ,CAAC,UAAU,KAAK,OAAO,CAAC,YAAY,CAAC,UAAU;QACnF,iBAAiB,EAAE,QAAQ,CAAC,QAAQ,CAAC,UAAU,KAAK,OAAO,CAAC,YAAY,CAAC,UAAU;QACnF,iBAAiB,EAAE,QAAQ,CAAC,QAAQ,CAAC,UAAU,KAAK,OAAO,CAAC,YAAY,CAAC,UAAU;QACnF,mBAAmB,EAAE,QAAQ,CAAC,QAAQ,CAAC,YAAY,KAAK,OAAO,CAAC,YAAY,CAAC,YAAY;QACzF,gBAAgB;KACjB,CAAC;AACJ,CAAC;AAED,SAAS,WAAW,CAAC,KAAoB;IACvC,QAAQ,KAAK,CAAC,IAAI,EAAE,CAAC;QACnB,KAAK,QAAQ,CAAC;QACd,KAAK,MAAM,CAAC;QACZ,KAAK,QAAQ,CAAC;QACd,KAAK,SAAS,CAAC;QACf,KAAK,UAAU,CAAC;QAChB,KAAK,uBAAuB,CAAC;QAC7B,KAAK,UAAU,CAAC;QAChB,KAAK,YAAY,CAAC;QAClB,KAAK,YAAY;YACf,OAAO,KAAK,CAAC,IAAI,CAAC;QACpB,KAAK,cAAc;YACjB,OAAO,KAAK,CAAC,IAAI,CAAC;QACpB,KAAK,aAAa;YAChB,OAAO,KAAK,CAAC,KAAK,CAAC;QACrB,KAAK,UAAU,CAAC;QAChB,KAAK,SAAS,CAAC;QACf,KAAK,aAAa;YAChB,OAAO,SAAS,CAAC;IACrB,CAAC;AACH,CAAC;AAED,SAAS,WAAW,CAAC,KAAoB;IACvC,QAAQ,KAAK,CAAC,IAAI,EAAE,CAAC;QACnB,KAAK,QAAQ,CAAC;QACd,KAAK,MAAM,CAAC;QACZ,KAAK,QAAQ,CAAC;QACd,KAAK,SAAS;YACZ,OAAO,KAAK,CAAC,IAAI,CAAC;QACpB,KAAK,aAAa;YAChB,OAAO,KAAK,CAAC,UAAU,CAAC;QAC1B,KAAK,cAAc;YACjB,OAAO,KAAK,CAAC,SAAS,EAAE,CAAC,CAAC,CAAC,CAAC;QAC9B;YACE,OAAO,SAAS,CAAC;IACrB,CAAC;AACH,CAAC;AAED;;;;;;;;;;;;;;GAcG;AACH,SAAS,oBAAoB,CAAC,CAAiB;IAC7C,IAAI,CAAC,CAAC,IAAI,KAAK,SAAS,IAAI,CAAC,CAAC,IAAI,KAAK,SAAS;QAAE,OAAO,IAAI,CAAC;IAC9D,MAAM,SAAS,GACb,CAAC,CAAC,cAAc,CAAC,MAAM,KAAK,OAAO;QACnC,CAAC,CAAC,cAAc,CAAC,MAAM,KAAK,eAAe;QAC3C,CAAC,CAAC,cAAc,CAAC,MAAM,KAAK,cAAc;QAC1C,CAAC,CAAC,cAAc,CAAC,MAAM,KAAK,gBAAgB,CAAC;IAC/C,IAAI,CAAC,SAAS;QAAE,OAAO,IAAI,CAAC;IAC5B,OAAO,CAAC,CAAC,oBAAoB,KAAK,IAAI,CAAC;AACzC,CAAC;AAED,SAAS,WAAW,CAAC,GAAW;IAC9B,IAAI,CAAC;QACH,OAAO,IAAA,4BAAY,EAAC,KAAK,EAAE,CAAC,WAAW,EAAE,MAAM,CAAC,EAAE,EAAE,GAAG,EAAE,QAAQ,EAAE,MAAM,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;IACtF,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,EAAE,CAAC;IACZ,CAAC;AACH,CAAC;AAED;;;;;;;;GAQG;AACH,SAAS,kBAAkB,CACzB,GAAW,EACX,OAAe,EACf,OAAe,EACf,IAAY;IAEZ,MAAM,GAAG,GAAG,IAAI,GAAG,EAAU,CAAC;IAC9B,IAAI,IAAY,CAAC;IACjB,IAAI,CAAC;QACH,IAAI,GAAG,IAAA,4BAAY,EACjB,KAAK,EACL,CAAC,MAAM,EAAE,aAAa,EAAE,YAAY,EAAE,gBAAgB,EAAE,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,IAAI,CAAC,EACrF,EAAE,GAAG,EAAE,QAAQ,EAAE,MAAM,EAAE,CAC1B,CAAC;IACJ,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,GAAG,CAAC;IACb,CAAC;IACD,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE;QAAE,OAAO,GAAG,CAAC;IAC7B,MAAM,MAAM,GAAG,2CAA2C,CAAC;IAC3D,IAAI,KAA6B,CAAC;IAClC,OAAO,CAAC,KAAK,GAAG,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,KAAK,IAAI,EAAE,CAAC;QAC5C,MAAM,QAAQ,GAAG,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;QACxC,MAAM,QAAQ,GAAG,KAAK,CAAC,CAAC,CAAC,KAAK,SAAS,CAAC,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;QACrE,IAAI,QAAQ,KAAK,CAAC,EAAE,CAAC;YACnB,0DAA0D;YAC1D,SAAS;QACX,CAAC;QACD,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,QAAQ,EAAE,CAAC,EAAE;YAAE,GAAG,CAAC,GAAG,CAAC,QAAQ,GAAG,CAAC,CAAC,CAAC;IAC3D,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC"}

package/dist/baseline/content-hash.d.ts

@@ -0,0 +1,83 @@
+/**
+ * Content-hash identity — drift-tolerant matching via the actual
+ * source code around a finding rather than its line position.
+ *
+ * The line-bucket identity scheme tolerates ±2 lines of drift; the
+ * git-aware matcher tolerates any line shift git can describe.
+ * Neither helps when git history is unavailable (shallow clone,
+ * force-pushed baseline commit) or when the line-bucket boundary
+ * straddles a context-stable region. The content-hash layer is the
+ * third fallback: pair findings whose surrounding code is byte-
+ * identical, regardless of where in the file they live.
+ *
+ * Pipeline:
+ *
+ *   1. The producer (Phase 3 baseline-create) reads each finding's
+ *      surrounding context lines, normalizes whitespace, and
+ *      computes a SHA-1[0:16] hash. The hash is stamped on the
+ *      finding entry in the baseline file.
+ *   2. At guardrail-check time, the current scan computes content
+ *      hashes the same way for its own findings.
+ *   3. The matcher's content-hash pass pairs prior + current
+ *      findings with matching `(canonical-rule, contentHash)` after
+ *      location-based pairing has exhausted what git can do.
+ *
+ * Trade-offs vs. line-bucket / git-aware match:
+ *
+ *   - Survives any vertical drift (the line number is irrelevant).
+ *   - Survives file rename + reformat + cross-file refactor when
+ *     the immediate context survives.
+ *   - Fails when the surrounding context changes — even a single
+ *     adjacent variable rename invalidates the hash.
+ *   - Vulnerable to collisions when two findings have identical
+ *     context (rare for code-pattern findings, more likely for
+ *     hygiene markers in similar boilerplate).
+ *
+ * The matcher tags content-hash matches with confidence 0.80 — below
+ * git-line-fuzz (0.88) so the brownfield policy's per-severity
+ * thresholds naturally distinguish them. For low-severity findings
+ * (threshold 0.90 by default), a content-hash match demotes to
+ * `'uncertain'` rather than silently pairing; for critical findings
+ * (threshold 0.75), the same match passes through cleanly.
+ */
+/**
+ * Width of the context window read on each side of the finding's
+ * reported line. Three lines above + three lines below + the line
+ * itself = a seven-line window that captures the immediate
+ * surrounding code without being so wide that unrelated edits
+ * invalidate the hash.
+ */
+export declare const CONTENT_HASH_CONTEXT_LINES = 3;
+/**
+ * Pure function: compute the content hash for a finding at `line`
+ * inside `fileContent`. Whitespace is normalized — trailing
+ * whitespace stripped, internal runs collapsed to a single space,
+ * empty lines preserved as empty — so reformat-only edits don't
+ * churn the hash.
+ *
+ * `line` is 1-based to match every other dxkit line-number contract.
+ * `contextLines` defaults to `CONTENT_HASH_CONTEXT_LINES`. Lines
+ * before the start of the file or past the end are clamped (the
+ * window is smaller near the file edges; that's fine — hashing a
+ * shorter window is still deterministic).
+ */
+export declare function computeContentHash(fileContent: string, line: number, contextLines?: number): string;
+/**
+ * Read a file's content at a specific commit. Returns null when git
+ * can't resolve the path-at-commit pair — file didn't exist at
+ * `sha`, file is binary, sha is unreachable. Callers treat null
+ * the same as "content-hash unavailable for this path."
+ *
+ * Uses `git show <sha>:<path>` which does not require checking out
+ * the commit — safe to call repeatedly in a tight loop without
+ * touching the working tree.
+ */
+export declare function readFileFromCommit(cwd: string, sha: string, file: string): string | null;
+/**
+ * Combined helper: read the file at a commit and compute its
+ * content hash at the given line. Returns null when the file
+ * couldn't be read. Used by the producer (Phase 3 baseline-create)
+ * to stamp content hashes on baseline entries.
+ */
+export declare function computeContentHashFromCommit(cwd: string, sha: string, file: string, line: number, contextLines?: number): string | null;
+//# sourceMappingURL=content-hash.d.ts.map

package/dist/baseline/content-hash.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"content-hash.d.ts","sourceRoot":"","sources":["../../src/baseline/content-hash.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAyCG;AAKH;;;;;;GAMG;AACH,eAAO,MAAM,0BAA0B,IAAI,CAAC;AAE5C;;;;;;;;;;;;GAYG;AACH,wBAAgB,kBAAkB,CAChC,WAAW,EAAE,MAAM,EACnB,IAAI,EAAE,MAAM,EACZ,YAAY,GAAE,MAAmC,GAChD,MAAM,CAOR;AAaD;;;;;;;;;GASG;AACH,wBAAgB,kBAAkB,CAAC,GAAG,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAiBxF;AAED;;;;;GAKG;AACH,wBAAgB,4BAA4B,CAC1C,GAAG,EAAE,MAAM,EACX,GAAG,EAAE,MAAM,EACX,IAAI,EAAE,MAAM,EACZ,IAAI,EAAE,MAAM,EACZ,YAAY,GAAE,MAAmC,GAChD,MAAM,GAAG,IAAI,CAIf"}