@vyuhlabs/dxkit 2.4.8 → 2.5.0

package/dist/baseline/entry-to-located.js

@@ -0,0 +1,72 @@
+"use strict";
+/**
+ * Convert a stored `BaselineEntry` into the `LocatedIdentity` shape
+ * the git-aware matcher consumes. Pure function — no I/O.
+ *
+ * The matcher's location-pair pass keys off `(file, rule, line)` and
+ * its content-hash pass keys off `(rule, contentHash)`. Both passes
+ * pair on the rule string verbatim, so the converter MUST normalize
+ * the rule across tool boundaries — otherwise a finding reported by
+ * tool A in run 1 and tool B in run 2 would silently fail to pair
+ * (the identity hashes would agree via the canonical-rule mapping,
+ * but the matcher's earlier passes would have already missed them).
+ *
+ * For hygiene findings the marker acts as the rule discriminator —
+ * the identity hash partitions occurrences by marker text, so the
+ * location-pair pass must too. The canonical-rule registry doesn't
+ * apply to hygiene markers; the marker IS the canonical name.
+ *
+ * Kinds without file/line locators (dep-vuln, duplication,
+ * coverage-gap, license, test-gap, test-file-degradation, god-file,
+ * stale-file, large-file, secret-hmac) fall through to the matcher's
+ * multiset pass — they're paired by exact identity-hash equality,
+ * which the matcher already handles without any locator metadata.
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.entryToLocated = entryToLocated;
+exports.entriesToLocated = entriesToLocated;
+const fingerprint_1 = require("../analyzers/tools/fingerprint");
+/**
+ * Build a `LocatedIdentity` from one stored entry. The id is the
+ * already-computed identity hash; locator fields are populated for
+ * the kinds the matcher's location-pair / content-hash passes can
+ * use.
+ */
+function entryToLocated(entry) {
+    switch (entry.kind) {
+        case 'secret':
+        case 'code':
+        case 'config':
+            return {
+                id: entry.id,
+                file: entry.file,
+                line: entry.line,
+                rule: (0, fingerprint_1.canonicalRuleFor)(entry.tool, entry.rule),
+                ...(entry.contentHash !== undefined ? { contentHash: entry.contentHash } : {}),
+            };
+        case 'hygiene':
+            return {
+                id: entry.id,
+                file: entry.file,
+                line: entry.line,
+                rule: entry.marker,
+                ...(entry.contentHash !== undefined ? { contentHash: entry.contentHash } : {}),
+            };
+        case 'dep-vuln':
+        case 'duplication':
+        case 'coverage-gap':
+        case 'license':
+        case 'test-gap':
+        case 'test-file-degradation':
+        case 'god-file':
+        case 'stale-file':
+        case 'large-file':
+        case 'secret-hmac':
+            return { id: entry.id };
+    }
+}
+/** Convenience: map an array of entries through `entryToLocated`. */
+function entriesToLocated(entries) {
+    return entries.map(entryToLocated);
+}
+//# sourceMappingURL=entry-to-located.js.map

package/dist/baseline/entry-to-located.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"entry-to-located.js","sourceRoot":"","sources":["../../src/baseline/entry-to-located.ts"],"names":[],"mappings":";AAAA;;;;;;;;;;;;;;;;;;;;;;GAsBG;;AAYH,wCAgCC;AAGD,4CAIC;AAjDD,gEAAkE;AAIlE;;;;;GAKG;AACH,SAAgB,cAAc,CAAC,KAAoB;IACjD,QAAQ,KAAK,CAAC,IAAI,EAAE,CAAC;QACnB,KAAK,QAAQ,CAAC;QACd,KAAK,MAAM,CAAC;QACZ,KAAK,QAAQ;YACX,OAAO;gBACL,EAAE,EAAE,KAAK,CAAC,EAAE;gBACZ,IAAI,EAAE,KAAK,CAAC,IAAI;gBAChB,IAAI,EAAE,KAAK,CAAC,IAAI;gBAChB,IAAI,EAAE,IAAA,8BAAgB,EAAC,KAAK,CAAC,IAAI,EAAE,KAAK,CAAC,IAAI,CAAC;gBAC9C,GAAG,CAAC,KAAK,CAAC,WAAW,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,KAAK,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;aAC/E,CAAC;QACJ,KAAK,SAAS;YACZ,OAAO;gBACL,EAAE,EAAE,KAAK,CAAC,EAAE;gBACZ,IAAI,EAAE,KAAK,CAAC,IAAI;gBAChB,IAAI,EAAE,KAAK,CAAC,IAAI;gBAChB,IAAI,EAAE,KAAK,CAAC,MAAM;gBAClB,GAAG,CAAC,KAAK,CAAC,WAAW,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,KAAK,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;aAC/E,CAAC;QACJ,KAAK,UAAU,CAAC;QAChB,KAAK,aAAa,CAAC;QACnB,KAAK,cAAc,CAAC;QACpB,KAAK,SAAS,CAAC;QACf,KAAK,UAAU,CAAC;QAChB,KAAK,uBAAuB,CAAC;QAC7B,KAAK,UAAU,CAAC;QAChB,KAAK,YAAY,CAAC;QAClB,KAAK,YAAY,CAAC;QAClB,KAAK,aAAa;YAChB,OAAO,EAAE,EAAE,EAAE,KAAK,CAAC,EAAE,EAAE,CAAC;IAC5B,CAAC;AACH,CAAC;AAED,qEAAqE;AACrE,SAAgB,gBAAgB,CAC9B,OAAqC;IAErC,OAAO,OAAO,CAAC,GAAG,CAAC,cAAc,CAAC,CAAC;AACrC,CAAC"}

package/dist/baseline/finding-identity.d.ts

@@ -0,0 +1,47 @@
+/**
+ * Per-finding identity dispatch. Pure module — no I/O, deterministic
+ * output for deterministic input. Identity is the unit of comparison
+ * across runs: two findings with the same identity are "the same
+ * finding" for baseline / guardrail purposes.
+ *
+ * Two of the five identity schemes already live in `tools/fingerprint`
+ * (dep-vuln + code/secret/config). This module wraps them in the
+ * baseline's discriminated-union shape and adds the two new schemes
+ * (duplication, coverage-gap) so callers reach all five through a
+ * single dispatch.
+ */
+import type { FindingId, IdentityInput, IdentitySchemeVersion, MatchResult } from './types';
+/**
+ * Compute the durable identity for a finding. `version` defaults to
+ * `'v1'` — explicit so future scheme migrations can co-exist without
+ * silent identity drift.
+ *
+ * Identity is the SAME 16-char hex string format across all kinds, so
+ * a baseline can store identities in a single flat set without
+ * tracking which kind they came from. Mixing across kinds is safe:
+ * the input space for each scheme is disjoint (a dep-vuln tuple of
+ * `(package, version, id)` can never collide with a code-finding
+ * tuple of `(canonicalRule, file, lineWindow)` at SHA-1 strength).
+ */
+export declare function identityFor(input: IdentityInput, version?: IdentitySchemeVersion): FindingId;
+/**
+ * Multiset-aware identity diff — the lowest layer of baseline
+ * comparison. Pairs identities by occurrence count, not by presence:
+ * an identity appearing twice in prior and once in current produces
+ * one persisted pair and one removed pair (set-diff would have
+ * incorrectly collapsed those to a single persisted).
+ *
+ * For each shared identity:
+ *   - the first `min(priorCount, currentCount)` occurrences pair as
+ *     `persisted` with confidence 1.0 (exact byte equality).
+ *   - excess occurrences in `current` produce `added` pairs.
+ *   - excess occurrences in `prior` produce `removed` pairs.
+ *
+ * Output ordering: pairs grouped by identity, then by status. The
+ * flat-array views (`persisted`, `added`, `removed`) preserve
+ * occurrence multiplicity — duplicate ids appear N times when N
+ * occurrences were classified that way. Callers that want a
+ * deduplicated view should run them through a Set themselves.
+ */
+export declare function matchAcrossRuns(prior: Iterable<FindingId>, current: Iterable<FindingId>): MatchResult;
+//# sourceMappingURL=finding-identity.d.ts.map

package/dist/baseline/finding-identity.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"finding-identity.d.ts","sourceRoot":"","sources":["../../src/baseline/finding-identity.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAcH,OAAO,KAAK,EACV,SAAS,EAET,aAAa,EACb,qBAAqB,EAGrB,WAAW,EAGZ,MAAM,SAAS,CAAC;AAEjB;;;;;;;;;;;GAWG;AACH,wBAAgB,WAAW,CACzB,KAAK,EAAE,aAAa,EACpB,OAAO,GAAE,qBAA4B,GACpC,SAAS,CA4CX;AA4KD;;;;;;;;;;;;;;;;;;GAkBG;AACH,wBAAgB,eAAe,CAC7B,KAAK,EAAE,QAAQ,CAAC,SAAS,CAAC,EAC1B,OAAO,EAAE,QAAQ,CAAC,SAAS,CAAC,GAC3B,WAAW,CAyDb"}

package/dist/baseline/finding-identity.js

@@ -0,0 +1,292 @@
+"use strict";
+/**
+ * Per-finding identity dispatch. Pure module — no I/O, deterministic
+ * output for deterministic input. Identity is the unit of comparison
+ * across runs: two findings with the same identity are "the same
+ * finding" for baseline / guardrail purposes.
+ *
+ * Two of the five identity schemes already live in `tools/fingerprint`
+ * (dep-vuln + code/secret/config). This module wraps them in the
+ * baseline's discriminated-union shape and adds the two new schemes
+ * (duplication, coverage-gap) so callers reach all five through a
+ * single dispatch.
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.identityFor = identityFor;
+exports.matchAcrossRuns = matchAcrossRuns;
+const crypto_1 = require("crypto");
+const fingerprint_1 = require("../analyzers/tools/fingerprint");
+/**
+ * Compute the durable identity for a finding. `version` defaults to
+ * `'v1'` — explicit so future scheme migrations can co-exist without
+ * silent identity drift.
+ *
+ * Identity is the SAME 16-char hex string format across all kinds, so
+ * a baseline can store identities in a single flat set without
+ * tracking which kind they came from. Mixing across kinds is safe:
+ * the input space for each scheme is disjoint (a dep-vuln tuple of
+ * `(package, version, id)` can never collide with a code-finding
+ * tuple of `(canonicalRule, file, lineWindow)` at SHA-1 strength).
+ */
+function identityFor(input, version = 'v1') {
+    if (version !== 'v1') {
+        throw new Error(`Unsupported identity-scheme version: ${version}`);
+    }
+    switch (input.kind) {
+        case 'secret':
+        case 'code':
+        case 'config': {
+            const canonicalRule = (0, fingerprint_1.canonicalRuleFor)(input.tool, input.rule);
+            return (0, fingerprint_1.computeCodeFingerprint)(canonicalRule, input.file, input.line);
+        }
+        case 'dep-vuln':
+            return (0, fingerprint_1.computeFingerprint)({
+                package: input.package,
+                installedVersion: input.installedVersion,
+                id: input.id,
+            });
+        case 'duplication':
+            return computeDuplicationIdentity(input.fileA, input.fileB, input.lines, input.startLineA, input.startLineB);
+        case 'coverage-gap':
+            return computeCoverageGapIdentity(input.file, input.symbol, input.lineRange);
+        case 'test-gap':
+            return computeTestGapIdentity(input.file, input.risk);
+        case 'hygiene':
+            return computeHygieneIdentity(input.file, input.line, input.marker);
+        case 'license':
+            return computeLicenseIdentity(input.package, input.version, input.licenseType);
+        case 'test-file-degradation':
+            return computeTestFileDegradationIdentity(input.file, input.status);
+        case 'god-file':
+            return computeGodFileIdentity(input.file);
+        case 'stale-file':
+            return computeStaleFileIdentity(input.file, input.suffix);
+        case 'large-file':
+            return computeLargeFileIdentity(input.file);
+        case 'secret-hmac':
+            return computeSecretHmacIdentity(input.tool, input.rule, input.hmac);
+    }
+}
+/**
+ * Symmetric-by-construction identity for a duplicate-block pair. The
+ * two `(file, startLine)` pairs are sorted lexicographically (first by
+ * file path, then by start line) before hashing so a clone reported as
+ * `(a:10, b:20)` and one reported as `(b:20, a:10)` produce the same
+ * identity.
+ *
+ * `lines` is included so refactoring one side of the pair (which
+ * shrinks or grows the block) reports a fresh identity — the right
+ * signal for a guardrail: "the duplicate moved or shrank, which
+ * deserves a look." `lines` is preferred over `tokens` because
+ * jscpd's JSON reporter does not populate `tokens` in practice
+ * (always emits 0), which would silently break the size-sensitivity
+ * property.
+ *
+ * Both start lines participate in identity so intra-file clones
+ * (`fileA === fileB`, multiple copies of the same block at different
+ * line positions inside one file) produce distinct identities.
+ * Without this, three intra-file clones in a single file would all
+ * collapse to one identity.
+ */
+function computeDuplicationIdentity(fileA, fileB, lines, startLineA, startLineB) {
+    const pairs = [
+        [fileA, startLineA],
+        [fileB, startLineB],
+    ];
+    pairs.sort((x, y) => (x[0] < y[0] ? -1 : x[0] > y[0] ? 1 : x[1] - y[1]));
+    const input = `duplication\0v1\0${pairs[0][0]}\0${pairs[0][1]}\0${pairs[1][0]}\0${pairs[1][1]}\0${lines}`;
+    return (0, crypto_1.createHash)('sha1').update(input).digest('hex').slice(0, 16);
+}
+/**
+ * Identity for an uncovered-code gap. Prefers `(file, symbol)` when
+ * the gap-detection pipeline knew the symbol name — that's stable
+ * across refactors that move code within a file. Falls back to
+ * `(file, lineRange)` when only a line range is available.
+ *
+ * Producers MUST supply at least one of `symbol` or `lineRange`;
+ * supplying neither throws because the resulting identity would be
+ * `(file)` only, which collapses every uncovered region in a file
+ * into a single entry.
+ */
+function computeCoverageGapIdentity(file, symbol, lineRange) {
+    if (!symbol && !lineRange) {
+        throw new Error(`coverage-gap identity requires either a symbol or a line range (file: ${file})`);
+    }
+    const discriminator = symbol ? `sym:${symbol}` : `range:${lineRange[0]}-${lineRange[1]}`;
+    const input = `coverage-gap\0v1\0${file}\0${discriminator}`;
+    return (0, crypto_1.createHash)('sha1').update(input).digest('hex').slice(0, 16);
+}
+/**
+ * Identity for a test-gap source file. Risk tier is part of identity:
+ * a file moving between tiers (CRITICAL → HIGH, or vice versa) is
+ * semantically a fresh finding — the prior tier's identity disappears,
+ * the new tier's identity arrives. Guardrails will fire on the
+ * net-new tier, which is the correct signal for regressions.
+ */
+function computeTestGapIdentity(file, risk) {
+    const input = `test-gap\0v1\0${file}\0${risk}`;
+    return (0, crypto_1.createHash)('sha1').update(input).digest('hex').slice(0, 16);
+}
+/**
+ * Identity for a single hygiene-marker occurrence (TODO / FIXME /
+ * HACK / console-log / any-type). Line number is bucketed via the
+ * shared line-window so a reformat that shifts a TODO by one or two
+ * lines doesn't churn identity. Marker text is NOT included — the
+ * occurrence "is a TODO" regardless of what the comment body says.
+ */
+function computeHygieneIdentity(file, line, marker) {
+    const input = `hygiene\0v1\0${marker}\0${file}\0${(0, fingerprint_1.lineWindowFor)(line)}`;
+    return (0, crypto_1.createHash)('sha1').update(input).digest('hex').slice(0, 16);
+}
+/**
+ * Identity for a package license attribution. Includes the license
+ * type so a re-licensing event on the same `(package, version)` pin
+ * registers as a fresh finding — compliance teams want to be
+ * notified when a transitive dep switches from MIT to GPL even
+ * without a version bump.
+ */
+function computeLicenseIdentity(packageName, version, licenseType) {
+    const input = `license\0v1\0${packageName}\0${version}\0${licenseType}`;
+    return (0, crypto_1.createHash)('sha1').update(input).digest('hex').slice(0, 16);
+}
+/**
+ * Identity for a degraded test file. Degradation status is part of
+ * identity so transitions between states register as fresh findings
+ * (e.g. an `'empty'` test body that becomes `'commented-out'` later
+ * is semantically a different problem worth a guardrail signal).
+ */
+function computeTestFileDegradationIdentity(file, status) {
+    const input = `test-file-degradation\0v1\0${file}\0${status}`;
+    return (0, crypto_1.createHash)('sha1').update(input).digest('hex').slice(0, 16);
+}
+/**
+ * Identity for a "god file" complexity offender. The fact that this
+ * specific file is a top offender is the durable signal — when a
+ * different file becomes the offender, identity changes appropriately
+ * because the producer emits a fresh finding pointing at the new
+ * path.
+ */
+function computeGodFileIdentity(file) {
+    const input = `god-file\0v1\0${file}`;
+    return (0, crypto_1.createHash)('sha1').update(input).digest('hex').slice(0, 16);
+}
+/**
+ * Identity for a stale on-disk artifact tracked in git. Suffix is in
+ * identity so a path that's flagged for both a `.swp` and a `.bak`
+ * (rare but possible if a developer leaves both kinds of leftovers)
+ * surfaces as two distinct findings rather than one collapsed entry.
+ * The producer lowercases the suffix and strips the dot before
+ * calling.
+ */
+function computeStaleFileIdentity(file, suffix) {
+    const input = `stale-file\0v1\0${file}\0${suffix}`;
+    return (0, crypto_1.createHash)('sha1').update(input).digest('hex').slice(0, 16);
+}
+/**
+ * Identity for a source file flagged as exceeding the large-file
+ * line-count threshold. Per-file, no further discriminator: the
+ * binary "this file is too big" signal is what guardrails act on.
+ * Discrete crossings of the threshold add or remove the identity.
+ */
+function computeLargeFileIdentity(file) {
+    const input = `large-file\0v1\0${file}`;
+    return (0, crypto_1.createHash)('sha1').update(input).digest('hex').slice(0, 16);
+}
+/**
+ * Identity for a secret keyed on its HMAC rather than its file
+ * position. Pairs with `SecretIdentityInput` (the location-based
+ * scheme) — the same underlying secret produces both identities,
+ * and the matcher can use either to recognize the finding across
+ * runs.
+ *
+ * Canonical-rule mapping applies so two scanners detecting the same
+ * secret class (e.g., gitleaks and a hypothetical second tool) emit
+ * the same identity bytes when their HMACs match.
+ */
+function computeSecretHmacIdentity(tool, rule, hmac) {
+    const canonicalRule = (0, fingerprint_1.canonicalRuleFor)(tool, rule);
+    const input = `secret-hmac\0v1\0${canonicalRule}\0${hmac}`;
+    return (0, crypto_1.createHash)('sha1').update(input).digest('hex').slice(0, 16);
+}
+/**
+ * Multiset-aware identity diff — the lowest layer of baseline
+ * comparison. Pairs identities by occurrence count, not by presence:
+ * an identity appearing twice in prior and once in current produces
+ * one persisted pair and one removed pair (set-diff would have
+ * incorrectly collapsed those to a single persisted).
+ *
+ * For each shared identity:
+ *   - the first `min(priorCount, currentCount)` occurrences pair as
+ *     `persisted` with confidence 1.0 (exact byte equality).
+ *   - excess occurrences in `current` produce `added` pairs.
+ *   - excess occurrences in `prior` produce `removed` pairs.
+ *
+ * Output ordering: pairs grouped by identity, then by status. The
+ * flat-array views (`persisted`, `added`, `removed`) preserve
+ * occurrence multiplicity — duplicate ids appear N times when N
+ * occurrences were classified that way. Callers that want a
+ * deduplicated view should run them through a Set themselves.
+ */
+function matchAcrossRuns(prior, current) {
+    const priorCounts = countMultiset(prior);
+    const currentCounts = countMultiset(current);
+    const allIds = new Set([...priorCounts.keys(), ...currentCounts.keys()]);
+    const pairs = [];
+    const persisted = [];
+    const added = [];
+    const removed = [];
+    const exactReason = {
+        code: 'exact-id',
+        detail: 'identity fingerprint matched byte-for-byte across runs',
+    };
+    const newReason = {
+        code: 'no-prior-match',
+        detail: 'identity fingerprint not present in the baseline',
+    };
+    const goneReason = {
+        code: 'no-current-match',
+        detail: 'identity fingerprint not present in the current scan',
+    };
+    for (const id of allIds) {
+        const p = priorCounts.get(id) ?? 0;
+        const c = currentCounts.get(id) ?? 0;
+        const matched = Math.min(p, c);
+        for (let i = 0; i < matched; i++) {
+            pairs.push({
+                priorId: id,
+                currentId: id,
+                status: 'persisted',
+                confidence: 1.0,
+                reasons: [exactReason],
+            });
+            persisted.push(id);
+        }
+        for (let i = 0; i < c - matched; i++) {
+            pairs.push({
+                currentId: id,
+                status: 'added',
+                confidence: 1.0,
+                reasons: [newReason],
+            });
+            added.push(id);
+        }
+        for (let i = 0; i < p - matched; i++) {
+            pairs.push({
+                priorId: id,
+                status: 'removed',
+                confidence: 1.0,
+                reasons: [goneReason],
+            });
+            removed.push(id);
+        }
+    }
+    return { pairs, persisted, added, removed, gitAware: false };
+}
+function countMultiset(items) {
+    const counts = new Map();
+    for (const id of items) {
+        counts.set(id, (counts.get(id) ?? 0) + 1);
+    }
+    return counts;
+}
+//# sourceMappingURL=finding-identity.js.map

package/dist/baseline/finding-identity.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"finding-identity.js","sourceRoot":"","sources":["../../src/baseline/finding-identity.ts"],"names":[],"mappings":";AAAA;;;;;;;;;;;GAWG;;AAsCH,kCA+CC;AA+LD,0CA4DC;AA9UD,mCAAoC;AACpC,gEAKwC;AAkBxC;;;;;;;;;;;GAWG;AACH,SAAgB,WAAW,CACzB,KAAoB,EACpB,UAAiC,IAAI;IAErC,IAAI,OAAO,KAAK,IAAI,EAAE,CAAC;QACrB,MAAM,IAAI,KAAK,CAAC,wCAAwC,OAAO,EAAE,CAAC,CAAC;IACrE,CAAC;IACD,QAAQ,KAAK,CAAC,IAAI,EAAE,CAAC;QACnB,KAAK,QAAQ,CAAC;QACd,KAAK,MAAM,CAAC;QACZ,KAAK,QAAQ,CAAC,CAAC,CAAC;YACd,MAAM,aAAa,GAAG,IAAA,8BAAgB,EAAC,KAAK,CAAC,IAAI,EAAE,KAAK,CAAC,IAAI,CAAC,CAAC;YAC/D,OAAO,IAAA,oCAAsB,EAAC,aAAa,EAAE,KAAK,CAAC,IAAI,EAAE,KAAK,CAAC,IAAI,CAAC,CAAC;QACvE,CAAC;QACD,KAAK,UAAU;YACb,OAAO,IAAA,gCAAkB,EAAC;gBACxB,OAAO,EAAE,KAAK,CAAC,OAAO;gBACtB,gBAAgB,EAAE,KAAK,CAAC,gBAAgB;gBACxC,EAAE,EAAE,KAAK,CAAC,EAAE;aACb,CAAC,CAAC;QACL,KAAK,aAAa;YAChB,OAAO,0BAA0B,CAC/B,KAAK,CAAC,KAAK,EACX,KAAK,CAAC,KAAK,EACX,KAAK,CAAC,KAAK,EACX,KAAK,CAAC,UAAU,EAChB,KAAK,CAAC,UAAU,CACjB,CAAC;QACJ,KAAK,cAAc;YACjB,OAAO,0BAA0B,CAAC,KAAK,CAAC,IAAI,EAAE,KAAK,CAAC,MAAM,EAAE,KAAK,CAAC,SAAS,CAAC,CAAC;QAC/E,KAAK,UAAU;YACb,OAAO,sBAAsB,CAAC,KAAK,CAAC,IAAI,EAAE,KAAK,CAAC,IAAI,CAAC,CAAC;QACxD,KAAK,SAAS;YACZ,OAAO,sBAAsB,CAAC,KAAK,CAAC,IAAI,EAAE,KAAK,CAAC,IAAI,EAAE,KAAK,CAAC,MAAM,CAAC,CAAC;QACtE,KAAK,SAAS;YACZ,OAAO,sBAAsB,CAAC,KAAK,CAAC,OAAO,EAAE,KAAK,CAAC,OAAO,EAAE,KAAK,CAAC,WAAW,CAAC,CAAC;QACjF,KAAK,uBAAuB;YAC1B,OAAO,kCAAkC,CAAC,KAAK,CAAC,IAAI,EAAE,KAAK,CAAC,MAAM,CAAC,CAAC;QACtE,KAAK,UAAU;YACb,OAAO,sBAAsB,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;QAC5C,KAAK,YAAY;YACf,OAAO,wBAAwB,CAAC,KAAK,CAAC,IAAI,EAAE,KAAK,CAAC,MAAM,CAAC,CAAC;QAC5D,KAAK,YAAY;YACf,OAAO,wBAAwB,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;QAC9C,KAAK,aAAa;YAChB,OAAO,yBAAyB,CAAC,KAAK,CAAC,IAAI,EAAE,KAAK,CAAC,IAAI,EAAE,KAAK,CAAC,IAAI,CAAC,CAAC;IACzE,CAAC;AACH,CAAC;AAED;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,SAAS,0BAA0B,CACjC,KAAa,EACb,KAAa,EACb,KAAa,EACb,UAAkB,EAClB,UAAkB;IAElB,MAAM,KAAK,GAA4B;QACrC,CAAC,KAAK,EAAE,UAAU,CAAC;QACnB,CAAC,KAAK,EAAE,UAAU,CAAC;KACpB,CAAC;IACF,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IACzE,MAAM,KAAK,GAAG,oBAAoB,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,KAAK,EAAE,CAAC;IAC1G,OAAO,IAAA,mBAAU,EAAC,MAAM,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;AACrE,CAAC;AAED;;;;;;;;;;GAUG;AACH,SAAS,0BAA0B,CACjC,IAAY,EACZ,MAA0B,EAC1B,SAAgD;IAEhD,IAAI,CAAC,MAAM,IAAI,CAAC,SAAS,EAAE,CAAC;QAC1B,MAAM,IAAI,KAAK,CACb,yEAAyE,IAAI,GAAG,CACjF,CAAC;IACJ,CAAC;IACD,MAAM,aAAa,GAAG,MAAM,CAAC,CAAC,CAAC,OAAO,MAAM,EAAE,CAAC,CAAC,CAAC,SAAS,SAAU,CAAC,CAAC,CAAC,IAAI,SAAU,CAAC,CAAC,CAAC,EAAE,CAAC;IAC3F,MAAM,KAAK,GAAG,qBAAqB,IAAI,KAAK,aAAa,EAAE,CAAC;IAC5D,OAAO,IAAA,mBAAU,EAAC,MAAM,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;AACrE,CAAC;AAED;;;;;;GAMG;AACH,SAAS,sBAAsB,CAAC,IAAY,EAAE,IAAiB;IAC7D,MAAM,KAAK,GAAG,iBAAiB,IAAI,KAAK,IAAI,EAAE,CAAC;IAC/C,OAAO,IAAA,mBAAU,EAAC,MAAM,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;AACrE,CAAC;AAED;;;;;;GAMG;AACH,SAAS,sBAAsB,CAAC,IAAY,EAAE,IAAY,EAAE,MAAqB;IAC/E,MAAM,KAAK,GAAG,gBAAgB,MAAM,KAAK,IAAI,KAAK,IAAA,2BAAa,EAAC,IAAI,CAAC,EAAE,CAAC;IACxE,OAAO,IAAA,mBAAU,EAAC,MAAM,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;AACrE,CAAC;AAED;;;;;;GAMG;AACH,SAAS,sBAAsB,CAC7B,WAAmB,EACnB,OAAe,EACf,WAAmB;IAEnB,MAAM,KAAK,GAAG,gBAAgB,WAAW,KAAK,OAAO,KAAK,WAAW,EAAE,CAAC;IACxE,OAAO,IAAA,mBAAU,EAAC,MAAM,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;AACrE,CAAC;AAED;;;;;GAKG;AACH,SAAS,kCAAkC,CACzC,IAAY,EACZ,MAAiC;IAEjC,MAAM,KAAK,GAAG,8BAA8B,IAAI,KAAK,MAAM,EAAE,CAAC;IAC9D,OAAO,IAAA,mBAAU,EAAC,MAAM,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;AACrE,CAAC;AAED;;;;;;GAMG;AACH,SAAS,sBAAsB,CAAC,IAAY;IAC1C,MAAM,KAAK,GAAG,iBAAiB,IAAI,EAAE,CAAC;IACtC,OAAO,IAAA,mBAAU,EAAC,MAAM,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;AACrE,CAAC;AAED;;;;;;;GAOG;AACH,SAAS,wBAAwB,CAAC,IAAY,EAAE,MAAc;IAC5D,MAAM,KAAK,GAAG,mBAAmB,IAAI,KAAK,MAAM,EAAE,CAAC;IACnD,OAAO,IAAA,mBAAU,EAAC,MAAM,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;AACrE,CAAC;AAED;;;;;GAKG;AACH,SAAS,wBAAwB,CAAC,IAAY;IAC5C,MAAM,KAAK,GAAG,mBAAmB,IAAI,EAAE,CAAC;IACxC,OAAO,IAAA,mBAAU,EAAC,MAAM,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;AACrE,CAAC;AAED;;;;;;;;;;GAUG;AACH,SAAS,yBAAyB,CAAC,IAAY,EAAE,IAAY,EAAE,IAAY;IACzE,MAAM,aAAa,GAAG,IAAA,8BAAgB,EAAC,IAAI,EAAE,IAAI,CAAC,CAAC;IACnD,MAAM,KAAK,GAAG,oBAAoB,aAAa,KAAK,IAAI,EAAE,CAAC;IAC3D,OAAO,IAAA,mBAAU,EAAC,MAAM,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;AACrE,CAAC;AAED;;;;;;;;;;;;;;;;;;GAkBG;AACH,SAAgB,eAAe,CAC7B,KAA0B,EAC1B,OAA4B;IAE5B,MAAM,WAAW,GAAG,aAAa,CAAC,KAAK,CAAC,CAAC;IACzC,MAAM,aAAa,GAAG,aAAa,CAAC,OAAO,CAAC,CAAC;IAC7C,MAAM,MAAM,GAAG,IAAI,GAAG,CAAY,CAAC,GAAG,WAAW,CAAC,IAAI,EAAE,EAAE,GAAG,aAAa,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC;IAEpF,MAAM,KAAK,GAAgB,EAAE,CAAC;IAC9B,MAAM,SAAS,GAAgB,EAAE,CAAC;IAClC,MAAM,KAAK,GAAgB,EAAE,CAAC;IAC9B,MAAM,OAAO,GAAgB,EAAE,CAAC;IAChC,MAAM,WAAW,GAAgB;QAC/B,IAAI,EAAE,UAAU;QAChB,MAAM,EAAE,wDAAwD;KACjE,CAAC;IACF,MAAM,SAAS,GAAgB;QAC7B,IAAI,EAAE,gBAAgB;QACtB,MAAM,EAAE,kDAAkD;KAC3D,CAAC;IACF,MAAM,UAAU,GAAgB;QAC9B,IAAI,EAAE,kBAAkB;QACxB,MAAM,EAAE,sDAAsD;KAC/D,CAAC;IAEF,KAAK,MAAM,EAAE,IAAI,MAAM,EAAE,CAAC;QACxB,MAAM,CAAC,GAAG,WAAW,CAAC,GAAG,CAAC,EAAE,CAAC,IAAI,CAAC,CAAC;QACnC,MAAM,CAAC,GAAG,aAAa,CAAC,GAAG,CAAC,EAAE,CAAC,IAAI,CAAC,CAAC;QACrC,MAAM,OAAO,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;QAC/B,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,OAAO,EAAE,CAAC,EAAE,EAAE,CAAC;YACjC,KAAK,CAAC,IAAI,CAAC;gBACT,OAAO,EAAE,EAAE;gBACX,SAAS,EAAE,EAAE;gBACb,MAAM,EAAE,WAAW;gBACnB,UAAU,EAAE,GAAG;gBACf,OAAO,EAAE,CAAC,WAAW,CAAC;aACvB,CAAC,CAAC;YACH,SAAS,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;QACrB,CAAC;QACD,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,CAAC,GAAG,OAAO,EAAE,CAAC,EAAE,EAAE,CAAC;YACrC,KAAK,CAAC,IAAI,CAAC;gBACT,SAAS,EAAE,EAAE;gBACb,MAAM,EAAE,OAAO;gBACf,UAAU,EAAE,GAAG;gBACf,OAAO,EAAE,CAAC,SAAS,CAAC;aACrB,CAAC,CAAC;YACH,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;QACjB,CAAC;QACD,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,CAAC,GAAG,OAAO,EAAE,CAAC,EAAE,EAAE,CAAC;YACrC,KAAK,CAAC,IAAI,CAAC;gBACT,OAAO,EAAE,EAAE;gBACX,MAAM,EAAE,SAAS;gBACjB,UAAU,EAAE,GAAG;gBACf,OAAO,EAAE,CAAC,UAAU,CAAC;aACtB,CAAC,CAAC;YACH,OAAO,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;QACnB,CAAC;IACH,CAAC;IAED,OAAO,EAAE,KAAK,EAAE,SAAS,EAAE,KAAK,EAAE,OAAO,EAAE,QAAQ,EAAE,KAAK,EAAE,CAAC;AAC/D,CAAC;AAED,SAAS,aAAa,CAAC,KAA0B;IAC/C,MAAM,MAAM,GAAG,IAAI,GAAG,EAAqB,CAAC;IAC5C,KAAK,MAAM,EAAE,IAAI,KAAK,EAAE,CAAC;QACvB,MAAM,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;IAC5C,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC"}

package/dist/baseline/git-aware-match.d.ts

@@ -0,0 +1,146 @@
+/**
+ * Git-aware match — pairs prior-run identities with current-run
+ * identities through the lens of `git diff baseSha headSha`.
+ *
+ * The line-bucket identity scheme used by code/secret/config/hygiene
+ * findings tolerates ±2 lines of vertical drift. Anything past that
+ * appears to a naive set-diff as "removed + added" even though
+ * semantically the finding hasn't changed — it just moved with the
+ * surrounding code. This module closes the gap.
+ *
+ * Algorithm:
+ *
+ *   1. Exact identity match — every finding present in both runs
+ *      under the same fingerprint is `persisted` immediately.
+ *
+ *   2. For each finding in the `removed` set that carries a file +
+ *      line locator: ask git to map its base-line through the diff
+ *      to the corresponding head-line. If the `added` set contains
+ *      a finding at the same `(file, rule, mappedLine)`, the two
+ *      represent the same underlying issue moved by the diff —
+ *      move both to `persisted`.
+ *
+ *   3. Whatever remains in `added` and `removed` is genuinely new
+ *      or genuinely gone.
+ *
+ * Fallback: when git history is unavailable (no `.git`, baseSha not
+ * reachable, file deleted, etc.) the module degrades to plain
+ * set-diff matching — the same behavior `matchAcrossRuns` produces
+ * on its own. Callers in shallow-clone CI or non-git workflows get
+ * a working (if less precise) result.
+ *
+ * Known limitations (Sprint 0 v1):
+ *   - File renames are not auto-tracked. A renamed file looks like
+ *     "removed prior + added current"; future iterations will use
+ *     `git log --follow` or `git diff -M` rename detection to close
+ *     this gap.
+ *   - Cross-file refactors (function extracted to a new file) are
+ *     reported as removed-and-added.
+ *   - When the line-bucket mapping fails on context edits (tool
+ *     reports finding at a slightly different line in head than the
+ *     diff predicts), we fall back to "unmatched." Sprint 0.x adds
+ *     a content-hash fallback for this class.
+ */
+import type { FindingId, MatchResult } from './types';
+/**
+ * Per-finding identity plus the locator info needed to query git.
+ * Producers convert `BaselineEntry` (or any equivalent stored form)
+ * into this shape before calling `gitAwareMatch`.
+ *
+ * `file`, `line`, and `rule` are optional only because some finding
+ * kinds (dep-vuln, license) have no file-line locator. Those kinds
+ * are handled entirely by step-1 exact-identity match and skipped
+ * by the step-2 git fallback.
+ */
+export interface LocatedIdentity {
+    readonly id: FindingId;
+    readonly file?: string;
+    readonly line?: number;
+    readonly rule?: string;
+    /** Optional content-hash for the finding's surrounding context.
+     *  Producer (Phase 3 baseline-create) computes via
+     *  `computeContentHash` and stamps on the entry. When present on
+     *  both prior and current sides for a `(canonical-rule, hash)`
+     *  pair, the matcher's content-hash pass uses it as a fallback
+     *  after the git-aware location pass exhausts. Absent when the
+     *  producer can't read the file (binary, deleted, missing). */
+    readonly contentHash?: string;
+}
+export interface GitAwareMatchOptions {
+    /** Working directory of the repository under check. */
+    readonly cwd: string;
+    /** Commit SHA the baseline was created against. The matcher
+     *  requires this SHA to be reachable in `cwd`'s git history. */
+    readonly baseSha: string;
+    /** Commit SHA (or revision spec) to compare against. Defaults to
+     *  `'HEAD'` — the current working-tree's last commit. */
+    readonly headSha?: string;
+}
+/**
+ * Map a 1-based line number in `baseSha`'s version of `file` to its
+ * corresponding 1-based line in `headSha`. Returns `null` when the
+ * line was deleted, the file was removed, or git couldn't produce a
+ * diff for any reason.
+ *
+ * Implementation runs `git diff --unified=0 baseSha headSha -- file`
+ * and walks the resulting `@@ -A,B +C,D @@` hunks. Pure-ish: the
+ * only impurity is the git subprocess; the parser is deterministic
+ * over its input.
+ */
+export declare function mapLineThroughDiff(opts: {
+    readonly cwd: string;
+    readonly baseSha: string;
+    readonly headSha: string;
+    /** Path at `baseSha`. May differ from `newFile` if the caller
+     *  resolved a rename. Pass-through compat: callers that don't
+     *  track renames can use the same value for both. */
+    readonly oldFile?: string;
+    /** Path at `headSha`. */
+    readonly newFile?: string;
+    /** Legacy single-file form. When supplied, both `oldFile` and
+     *  `newFile` default to this value. Kept for back-compat with
+     *  call-sites that pre-date rename support. */
+    readonly file?: string;
+    readonly baseLine: number;
+}): number | null;
+/**
+ * Composite matcher. Three passes, decreasing in match strength:
+ *
+ *   1. Location-aware pairing (when git is available): for each
+ *      line-anchored prior finding, map its base line to the
+ *      corresponding head line via `git diff`, then look up a
+ *      current finding at `(effectivePath, rule, mappedLine)`. The
+ *      effective path is the prior path translated through the
+ *      rename map; status is `'relocated'` when the path changed,
+ *      `'persisted'` when it didn't.
+ *      Lookups try the exact mapped line first (confidence 0.95),
+ *      then a ±2 fuzz window (confidence 0.88).
+ *
+ *   1.5. Content-hash pairing (when both sides carry content
+ *      hashes): match prior+current by `(canonicalRule,
+ *      contentHash)`. Runs regardless of git reachability — the
+ *      hash is file-content-derived and doesn't need git. Catches
+ *      cases git can't (shallow clone, force-pushed baseline) and
+ *      cases git misses (line-bucket boundary shifts where the
+ *      surrounding context survived intact). Confidence 0.80 — the
+ *      policy's per-severity thresholds naturally tune whether to
+ *      trust this layer.
+ *
+ *   2. Multiset exact-identity diff over whatever remains. Catches:
+ *        - findings without a file-line locator (dep-vuln, license,
+ *          symbol-based coverage-gap, duplication)
+ *        - line-anchored findings whose locations didn't survive
+ *          the diff but whose fingerprints happen to coincide
+ *          across runs
+ *        - everything when git history is unreachable (`baseSha`
+ *          missing) and pass 1 was skipped
+ *
+ * Why location-first: the line-bucket fingerprint scheme can produce
+ * spurious "persisted" matches when two findings of the same rule
+ * in the same file naturally shift into each other's buckets. Pass 1
+ * pairs them by real diff position, which is what a developer
+ * intuitively expects. Pass 1.5 catches the cases where pass 1 isn't
+ * available; pass 2 handles content-independent identity kinds.
+ */
+export declare function gitAwareMatch(prior: ReadonlyArray<LocatedIdentity>, current: ReadonlyArray<LocatedIdentity>, opts: GitAwareMatchOptions): MatchResult;
+//# sourceMappingURL=git-aware-match.d.ts.map

package/dist/baseline/git-aware-match.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"git-aware-match.d.ts","sourceRoot":"","sources":["../../src/baseline/git-aware-match.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA0CG;AAIH,OAAO,KAAK,EAAE,SAAS,EAA0B,WAAW,EAAE,MAAM,SAAS,CAAC;AAqB9E;;;;;;;;;GASG;AACH,MAAM,WAAW,eAAe;IAC9B,QAAQ,CAAC,EAAE,EAAE,SAAS,CAAC;IACvB,QAAQ,CAAC,IAAI,CAAC,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,IAAI,CAAC,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,IAAI,CAAC,EAAE,MAAM,CAAC;IACvB;;;;;;mEAM+D;IAC/D,QAAQ,CAAC,WAAW,CAAC,EAAE,MAAM,CAAC;CAC/B;AAED,MAAM,WAAW,oBAAoB;IACnC,uDAAuD;IACvD,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;IACrB;oEACgE;IAChE,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB;6DACyD;IACzD,QAAQ,CAAC,OAAO,CAAC,EAAE,MAAM,CAAC;CAC3B;AAED;;;;;;;;;;GAUG;AACH,wBAAgB,kBAAkB,CAAC,IAAI,EAAE;IACvC,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;IACrB,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB;;yDAEqD;IACrD,QAAQ,CAAC,OAAO,CAAC,EAAE,MAAM,CAAC;IAC1B,yBAAyB;IACzB,QAAQ,CAAC,OAAO,CAAC,EAAE,MAAM,CAAC;IAC1B;;mDAE+C;IAC/C,QAAQ,CAAC,IAAI,CAAC,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;CAC3B,GAAG,MAAM,GAAG,IAAI,CAiChB;AAqCD;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAsCG;AACH,wBAAgB,aAAa,CAC3B,KAAK,EAAE,aAAa,CAAC,eAAe,CAAC,EACrC,OAAO,EAAE,aAAa,CAAC,eAAe,CAAC,EACvC,IAAI,EAAE,oBAAoB,GACzB,WAAW,CAoLb"}