@vyuhlabs/dxkit 2.4.8 → 2.5.0

package/dist/baseline/git-aware-match.js

@@ -0,0 +1,439 @@
+"use strict";
+/**
+ * Git-aware match — pairs prior-run identities with current-run
+ * identities through the lens of `git diff baseSha headSha`.
+ *
+ * The line-bucket identity scheme used by code/secret/config/hygiene
+ * findings tolerates ±2 lines of vertical drift. Anything past that
+ * appears to a naive set-diff as "removed + added" even though
+ * semantically the finding hasn't changed — it just moved with the
+ * surrounding code. This module closes the gap.
+ *
+ * Algorithm:
+ *
+ *   1. Exact identity match — every finding present in both runs
+ *      under the same fingerprint is `persisted` immediately.
+ *
+ *   2. For each finding in the `removed` set that carries a file +
+ *      line locator: ask git to map its base-line through the diff
+ *      to the corresponding head-line. If the `added` set contains
+ *      a finding at the same `(file, rule, mappedLine)`, the two
+ *      represent the same underlying issue moved by the diff —
+ *      move both to `persisted`.
+ *
+ *   3. Whatever remains in `added` and `removed` is genuinely new
+ *      or genuinely gone.
+ *
+ * Fallback: when git history is unavailable (no `.git`, baseSha not
+ * reachable, file deleted, etc.) the module degrades to plain
+ * set-diff matching — the same behavior `matchAcrossRuns` produces
+ * on its own. Callers in shallow-clone CI or non-git workflows get
+ * a working (if less precise) result.
+ *
+ * Known limitations (Sprint 0 v1):
+ *   - File renames are not auto-tracked. A renamed file looks like
+ *     "removed prior + added current"; future iterations will use
+ *     `git log --follow` or `git diff -M` rename detection to close
+ *     this gap.
+ *   - Cross-file refactors (function extracted to a new file) are
+ *     reported as removed-and-added.
+ *   - When the line-bucket mapping fails on context edits (tool
+ *     reports finding at a slightly different line in head than the
+ *     diff predicts), we fall back to "unmatched." Sprint 0.x adds
+ *     a content-hash fallback for this class.
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.mapLineThroughDiff = mapLineThroughDiff;
+exports.gitAwareMatch = gitAwareMatch;
+const child_process_1 = require("child_process");
+const finding_identity_1 = require("./finding-identity");
+/** Confidence assigned to a git-mapped pair when the candidate sits
+ *  on exactly the mapped line. Slightly below 1.0 so consumers can
+ *  tell apart "exact identity match" (1.0) from "different identity
+ *  but same finding through diff" (0.95). */
+const CONFIDENCE_GIT_EXACT = 0.95;
+/** Confidence when the candidate sits within ±2 lines of the mapped
+ *  line — scanners often shift the reported line slightly across
+ *  re-runs even when nothing semantic changed. */
+const CONFIDENCE_GIT_FUZZ = 0.88;
+/** Range of the line-fuzz lookup window. */
+const LINE_FUZZ_RANGE = 2;
+/** Confidence assigned to a content-hash pair. Below git-line-fuzz
+ *  so the policy's per-severity confidence thresholds naturally
+ *  distinguish "matched via git diff" from "matched via context
+ *  bytes alone." For low-severity findings (default threshold 0.90),
+ *  a content-hash pair demotes to `'uncertain'`; for critical
+ *  findings (threshold 0.75), it passes through cleanly. */
+const CONFIDENCE_CONTENT_HASH = 0.8;
+/**
+ * Map a 1-based line number in `baseSha`'s version of `file` to its
+ * corresponding 1-based line in `headSha`. Returns `null` when the
+ * line was deleted, the file was removed, or git couldn't produce a
+ * diff for any reason.
+ *
+ * Implementation runs `git diff --unified=0 baseSha headSha -- file`
+ * and walks the resulting `@@ -A,B +C,D @@` hunks. Pure-ish: the
+ * only impurity is the git subprocess; the parser is deterministic
+ * over its input.
+ */
+function mapLineThroughDiff(opts) {
+    const oldFile = opts.oldFile ?? opts.file;
+    const newFile = opts.newFile ?? opts.file ?? oldFile;
+    if (!oldFile || !newFile) {
+        throw new Error('mapLineThroughDiff requires `file` or both `oldFile` + `newFile`');
+    }
+    let diff;
+    try {
+        diff = (0, child_process_1.execFileSync)('git', [
+            'diff',
+            '--unified=0',
+            '--no-color',
+            '--find-renames',
+            opts.baseSha,
+            opts.headSha,
+            '--',
+            oldFile,
+            ...(newFile !== oldFile ? [newFile] : []),
+        ], { cwd: opts.cwd, encoding: 'utf8' });
+    }
+    catch {
+        // File missing in one revision, git not available, sha unreachable — any
+        // of these defeats the mapping. Caller treats null as "unmatched."
+        return null;
+    }
+    if (!diff.trim()) {
+        // Identical between revisions: line numbers are 1:1.
+        return opts.baseLine;
+    }
+    return walkHunks(diff, opts.baseLine);
+}
+/**
+ * Parse `@@ -oldStart,oldCount +newStart,newCount @@` hunk headers
+ * and resolve `baseLine` to its post-diff line number. Pure
+ * function over the diff text.
+ *
+ * A line falls into one of three regions:
+ *   - Before any hunk that affects it: shifted only by the
+ *     accumulated net delta of earlier hunks.
+ *   - Inside a hunk's deletion span: removed by this diff,
+ *     returns null.
+ *   - After all hunks: shifted by the full accumulated net delta.
+ */
+function walkHunks(diff, baseLine) {
+    const hunkRe = /^@@ -(\d+)(?:,(\d+))? \+(\d+)(?:,(\d+))? @@/gm;
+    let match;
+    let cumulativeShift = 0;
+    while ((match = hunkRe.exec(diff)) !== null) {
+        const oldStart = parseInt(match[1], 10);
+        const oldCount = match[2] !== undefined ? parseInt(match[2], 10) : 1;
+        const newCount = match[4] !== undefined ? parseInt(match[4], 10) : 1;
+        const oldEnd = oldStart + oldCount - 1;
+        if (baseLine < oldStart) {
+            // Line lies before this hunk — earlier shifts apply, this hunk doesn't.
+            return baseLine + cumulativeShift;
+        }
+        if (oldCount > 0 && baseLine >= oldStart && baseLine <= oldEnd) {
+            // Line was deleted by this hunk.
+            return null;
+        }
+        cumulativeShift += newCount - oldCount;
+    }
+    return baseLine + cumulativeShift;
+}
+/**
+ * Composite matcher. Three passes, decreasing in match strength:
+ *
+ *   1. Location-aware pairing (when git is available): for each
+ *      line-anchored prior finding, map its base line to the
+ *      corresponding head line via `git diff`, then look up a
+ *      current finding at `(effectivePath, rule, mappedLine)`. The
+ *      effective path is the prior path translated through the
+ *      rename map; status is `'relocated'` when the path changed,
+ *      `'persisted'` when it didn't.
+ *      Lookups try the exact mapped line first (confidence 0.95),
+ *      then a ±2 fuzz window (confidence 0.88).
+ *
+ *   1.5. Content-hash pairing (when both sides carry content
+ *      hashes): match prior+current by `(canonicalRule,
+ *      contentHash)`. Runs regardless of git reachability — the
+ *      hash is file-content-derived and doesn't need git. Catches
+ *      cases git can't (shallow clone, force-pushed baseline) and
+ *      cases git misses (line-bucket boundary shifts where the
+ *      surrounding context survived intact). Confidence 0.80 — the
+ *      policy's per-severity thresholds naturally tune whether to
+ *      trust this layer.
+ *
+ *   2. Multiset exact-identity diff over whatever remains. Catches:
+ *        - findings without a file-line locator (dep-vuln, license,
+ *          symbol-based coverage-gap, duplication)
+ *        - line-anchored findings whose locations didn't survive
+ *          the diff but whose fingerprints happen to coincide
+ *          across runs
+ *        - everything when git history is unreachable (`baseSha`
+ *          missing) and pass 1 was skipped
+ *
+ * Why location-first: the line-bucket fingerprint scheme can produce
+ * spurious "persisted" matches when two findings of the same rule
+ * in the same file naturally shift into each other's buckets. Pass 1
+ * pairs them by real diff position, which is what a developer
+ * intuitively expects. Pass 1.5 catches the cases where pass 1 isn't
+ * available; pass 2 handles content-independent identity kinds.
+ */
+function gitAwareMatch(prior, current, opts) {
+    const headSha = opts.headSha ?? 'HEAD';
+    const reachability = checkShaReachable(opts.cwd, opts.baseSha);
+    const pairs = [];
+    const priorMatched = new Set();
+    const currentMatched = new Set();
+    if (reachability.ok) {
+        const renames = readRenameMap(opts.cwd, opts.baseSha, headSha);
+        // Index current findings by (file, rule, line). One key holds at
+        // most one entry — the multiset diff in pass 2 picks up any
+        // collisions left after location pairing.
+        const currentByLocation = new Map();
+        for (const c of current) {
+            if (!c.file || c.line === undefined || !c.rule)
+                continue;
+            const key = locationKey(c.file, c.rule, c.line);
+            const bucket = currentByLocation.get(key);
+            if (bucket)
+                bucket.push(c);
+            else
+                currentByLocation.set(key, [c]);
+        }
+        const takeAt = (key) => {
+            const bucket = currentByLocation.get(key);
+            if (!bucket || bucket.length === 0)
+                return undefined;
+            const head = bucket.shift();
+            if (bucket.length === 0)
+                currentByLocation.delete(key);
+            return head;
+        };
+        for (const p of prior) {
+            if (!p.file || p.line === undefined || !p.rule)
+                continue;
+            const effectivePath = renames.get(p.file) ?? p.file;
+            const pathChanged = effectivePath !== p.file;
+            const mappedLine = mapLineThroughDiff({
+                cwd: opts.cwd,
+                baseSha: opts.baseSha,
+                headSha,
+                oldFile: p.file,
+                newFile: effectivePath,
+                baseLine: p.line,
+            });
+            if (mappedLine === null)
+                continue;
+            // Exact mapped line first.
+            let candidate = takeAt(locationKey(effectivePath, p.rule, mappedLine));
+            let confidence = CONFIDENCE_GIT_EXACT;
+            let fuzzDelta = 0;
+            // Line-fuzz fallback: scanners drift the reported line by 1-2
+            // lines on re-runs. Walk outward from the mapped line.
+            if (!candidate) {
+                for (let delta = 1; delta <= LINE_FUZZ_RANGE; delta++) {
+                    for (const offset of [-delta, delta]) {
+                        const c2 = takeAt(locationKey(effectivePath, p.rule, mappedLine + offset));
+                        if (c2) {
+                            candidate = c2;
+                            confidence = CONFIDENCE_GIT_FUZZ;
+                            fuzzDelta = offset;
+                            break;
+                        }
+                    }
+                    if (candidate)
+                        break;
+                }
+            }
+            if (!candidate)
+                continue;
+            priorMatched.add(p);
+            currentMatched.add(candidate);
+            const reasons = [
+                {
+                    code: 'git-line-' + (fuzzDelta === 0 ? 'exact' : 'fuzz'),
+                    detail: fuzzDelta === 0
+                        ? `git diff mapped ${p.file}:${p.line} to ${effectivePath}:${mappedLine}`
+                        : `git diff mapped ${p.file}:${p.line} to ${effectivePath}:${mappedLine}; ` +
+                            `current finding sits ${fuzzDelta > 0 ? '+' : ''}${fuzzDelta} line(s) off (within fuzz window)`,
+                },
+            ];
+            if (pathChanged) {
+                reasons.unshift({
+                    code: 'git-rename',
+                    detail: `file renamed: ${p.file} → ${effectivePath}`,
+                });
+            }
+            pairs.push({
+                priorId: p.id,
+                currentId: candidate.id,
+                status: pathChanged ? 'relocated' : 'persisted',
+                confidence,
+                reasons,
+            });
+        }
+    }
+    // Pass 1.5 — content-hash fallback. Pairs prior+current findings
+    // by `(canonicalRule, contentHash)` when both sides carry a
+    // content hash (stamped by the producer). Runs regardless of git
+    // reachability — content hashes are file-content-derived and
+    // don't need git to compare. Confidence is below the git-line
+    // tier so the policy classifier's per-severity thresholds tune
+    // whether to trust the match.
+    {
+        const currentByContent = new Map();
+        for (const c of current) {
+            if (currentMatched.has(c))
+                continue;
+            if (!c.contentHash || !c.rule)
+                continue;
+            const key = contentKey(c.rule, c.contentHash);
+            const bucket = currentByContent.get(key);
+            if (bucket)
+                bucket.push(c);
+            else
+                currentByContent.set(key, [c]);
+        }
+        const takeContent = (key) => {
+            const bucket = currentByContent.get(key);
+            if (!bucket || bucket.length === 0)
+                return undefined;
+            const head = bucket.shift();
+            if (bucket.length === 0)
+                currentByContent.delete(key);
+            return head;
+        };
+        for (const p of prior) {
+            if (priorMatched.has(p))
+                continue;
+            if (!p.contentHash || !p.rule)
+                continue;
+            const candidate = takeContent(contentKey(p.rule, p.contentHash));
+            if (!candidate)
+                continue;
+            priorMatched.add(p);
+            currentMatched.add(candidate);
+            const pathChanged = !!(p.file && candidate.file && p.file !== candidate.file);
+            pairs.push({
+                priorId: p.id,
+                currentId: candidate.id,
+                status: pathChanged ? 'relocated' : 'persisted',
+                confidence: CONFIDENCE_CONTENT_HASH,
+                reasons: [
+                    {
+                        code: 'content-hash',
+                        detail: pathChanged
+                            ? `content-hash match across rename: ${p.file ?? '?'} → ${candidate.file ?? '?'}`
+                            : 'content-hash match (surrounding code byte-identical after whitespace normalization)',
+                    },
+                ],
+            });
+        }
+    }
+    // Pass 2 — multiset exact-id diff over leftovers.
+    const priorRemaining = [];
+    const currentRemaining = [];
+    for (const p of prior)
+        if (!priorMatched.has(p))
+            priorRemaining.push(p.id);
+    for (const c of current)
+        if (!currentMatched.has(c))
+            currentRemaining.push(c.id);
+    const exactRemaining = (0, finding_identity_1.matchAcrossRuns)(priorRemaining, currentRemaining);
+    for (const pair of exactRemaining.pairs)
+        pairs.push(pair);
+    // Flatten the legacy views from the pair list.
+    const persisted = [];
+    const added = [];
+    const removed = [];
+    for (const pair of pairs) {
+        switch (pair.status) {
+            case 'persisted':
+            case 'relocated':
+                if (pair.priorId)
+                    persisted.push(pair.priorId);
+                if (pair.currentId && pair.currentId !== pair.priorId)
+                    persisted.push(pair.currentId);
+                break;
+            case 'added':
+                if (pair.currentId)
+                    added.push(pair.currentId);
+                break;
+            case 'removed':
+                if (pair.priorId)
+                    removed.push(pair.priorId);
+                break;
+        }
+    }
+    return {
+        pairs,
+        persisted,
+        added,
+        removed,
+        gitAware: reachability.ok,
+        degradedReason: reachability.ok ? undefined : reachability.reason,
+    };
+}
+function locationKey(file, rule, line) {
+    return `${file}\0${rule}\0${line}`;
+}
+function contentKey(rule, contentHash) {
+    return `content\0${rule}\0${contentHash}`;
+}
+/**
+ * Build a Map<oldPath, newPath> for files renamed between baseSha
+ * and headSha. Uses git's rename detection (`--find-renames`,
+ * default similarity threshold). Files that weren't renamed don't
+ * appear in the map; callers fall back to using the prior path as
+ * the effective path.
+ */
+function readRenameMap(cwd, baseSha, headSha) {
+    const renames = new Map();
+    let output;
+    try {
+        output = (0, child_process_1.execFileSync)('git', ['diff', '--name-status', '--find-renames', baseSha, headSha], {
+            cwd,
+            encoding: 'utf8',
+        });
+    }
+    catch {
+        return renames;
+    }
+    for (const line of output.split('\n')) {
+        // Rename lines look like:  R100\told/path\tnew/path
+        // M / A / D / C lines have only one path column and are ignored here.
+        if (!line.startsWith('R'))
+            continue;
+        const parts = line.split('\t');
+        if (parts.length < 3)
+            continue;
+        renames.set(parts[1], parts[2]);
+    }
+    return renames;
+}
+/**
+ * Check whether the SHA exists in the repo and return a structured
+ * verdict. Distinguishes "not a git repo," "git not installed,"
+ * "valid repo but commit unreachable" — every non-ok case produces
+ * a human-readable reason for `MatchResult.degradedReason`.
+ */
+function checkShaReachable(cwd, sha) {
+    try {
+        (0, child_process_1.execFileSync)('git', ['rev-parse', '--git-dir'], { cwd, stdio: 'ignore' });
+    }
+    catch {
+        return { ok: false, reason: 'cwd is not a git repository (or git is not installed)' };
+    }
+    try {
+        (0, child_process_1.execFileSync)('git', ['cat-file', '-e', sha], { cwd, stdio: 'ignore' });
+        return { ok: true };
+    }
+    catch {
+        return {
+            ok: false,
+            reason: `baseline commit ${sha} is not reachable in this checkout (shallow clone or force-push?)`,
+        };
+    }
+}
+//# sourceMappingURL=git-aware-match.js.map

package/dist/baseline/git-aware-match.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"git-aware-match.js","sourceRoot":"","sources":["../../src/baseline/git-aware-match.ts"],"names":[],"mappings":";AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA0CG;;AAwEH,gDAgDC;AA4ED,sCAwLC;AA1XD,iDAA6C;AAC7C,yDAAqD;AAGrD;;;6CAG6C;AAC7C,MAAM,oBAAoB,GAAG,IAAI,CAAC;AAClC;;kDAEkD;AAClD,MAAM,mBAAmB,GAAG,IAAI,CAAC;AACjC,4CAA4C;AAC5C,MAAM,eAAe,GAAG,CAAC,CAAC;AAC1B;;;;;4DAK4D;AAC5D,MAAM,uBAAuB,GAAG,GAAG,CAAC;AAsCpC;;;;;;;;;;GAUG;AACH,SAAgB,kBAAkB,CAAC,IAelC;IACC,MAAM,OAAO,GAAG,IAAI,CAAC,OAAO,IAAI,IAAI,CAAC,IAAI,CAAC;IAC1C,MAAM,OAAO,GAAG,IAAI,CAAC,OAAO,IAAI,IAAI,CAAC,IAAI,IAAI,OAAO,CAAC;IACrD,IAAI,CAAC,OAAO,IAAI,CAAC,OAAO,EAAE,CAAC;QACzB,MAAM,IAAI,KAAK,CAAC,kEAAkE,CAAC,CAAC;IACtF,CAAC;IACD,IAAI,IAAY,CAAC;IACjB,IAAI,CAAC;QACH,IAAI,GAAG,IAAA,4BAAY,EACjB,KAAK,EACL;YACE,MAAM;YACN,aAAa;YACb,YAAY;YACZ,gBAAgB;YAChB,IAAI,CAAC,OAAO;YACZ,IAAI,CAAC,OAAO;YACZ,IAAI;YACJ,OAAO;YACP,GAAG,CAAC,OAAO,KAAK,OAAO,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;SAC1C,EACD,EAAE,GAAG,EAAE,IAAI,CAAC,GAAG,EAAE,QAAQ,EAAE,MAAM,EAAE,CACpC,CAAC;IACJ,CAAC;IAAC,MAAM,CAAC;QACP,yEAAyE;QACzE,mEAAmE;QACnE,OAAO,IAAI,CAAC;IACd,CAAC;IACD,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,EAAE,CAAC;QACjB,qDAAqD;QACrD,OAAO,IAAI,CAAC,QAAQ,CAAC;IACvB,CAAC;IACD,OAAO,SAAS,CAAC,IAAI,EAAE,IAAI,CAAC,QAAQ,CAAC,CAAC;AACxC,CAAC;AAED;;;;;;;;;;;GAWG;AACH,SAAS,SAAS,CAAC,IAAY,EAAE,QAAgB;IAC/C,MAAM,MAAM,GAAG,+CAA+C,CAAC;IAC/D,IAAI,KAA6B,CAAC;IAClC,IAAI,eAAe,GAAG,CAAC,CAAC;IACxB,OAAO,CAAC,KAAK,GAAG,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,KAAK,IAAI,EAAE,CAAC;QAC5C,MAAM,QAAQ,GAAG,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;QACxC,MAAM,QAAQ,GAAG,KAAK,CAAC,CAAC,CAAC,KAAK,SAAS,CAAC,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;QACrE,MAAM,QAAQ,GAAG,KAAK,CAAC,CAAC,CAAC,KAAK,SAAS,CAAC,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;QACrE,MAAM,MAAM,GAAG,QAAQ,GAAG,QAAQ,GAAG,CAAC,CAAC;QAEvC,IAAI,QAAQ,GAAG,QAAQ,EAAE,CAAC;YACxB,wEAAwE;YACxE,OAAO,QAAQ,GAAG,eAAe,CAAC;QACpC,CAAC;QACD,IAAI,QAAQ,GAAG,CAAC,IAAI,QAAQ,IAAI,QAAQ,IAAI,QAAQ,IAAI,MAAM,EAAE,CAAC;YAC/D,iCAAiC;YACjC,OAAO,IAAI,CAAC;QACd,CAAC;QACD,eAAe,IAAI,QAAQ,GAAG,QAAQ,CAAC;IACzC,CAAC;IACD,OAAO,QAAQ,GAAG,eAAe,CAAC;AACpC,CAAC;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAsCG;AACH,SAAgB,aAAa,CAC3B,KAAqC,EACrC,OAAuC,EACvC,IAA0B;IAE1B,MAAM,OAAO,GAAG,IAAI,CAAC,OAAO,IAAI,MAAM,CAAC;IACvC,MAAM,YAAY,GAAG,iBAAiB,CAAC,IAAI,CAAC,GAAG,EAAE,IAAI,CAAC,OAAO,CAAC,CAAC;IAE/D,MAAM,KAAK,GAAgB,EAAE,CAAC;IAC9B,MAAM,YAAY,GAAG,IAAI,GAAG,EAAmB,CAAC;IAChD,MAAM,cAAc,GAAG,IAAI,GAAG,EAAmB,CAAC;IAElD,IAAI,YAAY,CAAC,EAAE,EAAE,CAAC;QACpB,MAAM,OAAO,GAAG,aAAa,CAAC,IAAI,CAAC,GAAG,EAAE,IAAI,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;QAE/D,iEAAiE;QACjE,4DAA4D;QAC5D,0CAA0C;QAC1C,MAAM,iBAAiB,GAAG,IAAI,GAAG,EAA6B,CAAC;QAC/D,KAAK,MAAM,CAAC,IAAI,OAAO,EAAE,CAAC;YACxB,IAAI,CAAC,CAAC,CAAC,IAAI,IAAI,CAAC,CAAC,IAAI,KAAK,SAAS,IAAI,CAAC,CAAC,CAAC,IAAI;gBAAE,SAAS;YACzD,MAAM,GAAG,GAAG,WAAW,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC;YAChD,MAAM,MAAM,GAAG,iBAAiB,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;YAC1C,IAAI,MAAM;gBAAE,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;;gBACtB,iBAAiB,CAAC,GAAG,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC;QACvC,CAAC;QAED,MAAM,MAAM,GAAG,CAAC,GAAW,EAA+B,EAAE;YAC1D,MAAM,MAAM,GAAG,iBAAiB,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;YAC1C,IAAI,CAAC,MAAM,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC;gBAAE,OAAO,SAAS,CAAC;YACrD,MAAM,IAAI,GAAG,MAAM,CAAC,KAAK,EAAE,CAAC;YAC5B,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC;gBAAE,iBAAiB,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;YACvD,OAAO,IAAI,CAAC;QACd,CAAC,CAAC;QAEF,KAAK,MAAM,CAAC,IAAI,KAAK,EAAE,CAAC;YACtB,IAAI,CAAC,CAAC,CAAC,IAAI,IAAI,CAAC,CAAC,IAAI,KAAK,SAAS,IAAI,CAAC,CAAC,CAAC,IAAI;gBAAE,SAAS;YACzD,MAAM,aAAa,GAAG,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC;YACpD,MAAM,WAAW,GAAG,aAAa,KAAK,CAAC,CAAC,IAAI,CAAC;YAC7C,MAAM,UAAU,GAAG,kBAAkB,CAAC;gBACpC,GAAG,EAAE,IAAI,CAAC,GAAG;gBACb,OAAO,EAAE,IAAI,CAAC,OAAO;gBACrB,OAAO;gBACP,OAAO,EAAE,CAAC,CAAC,IAAI;gBACf,OAAO,EAAE,aAAa;gBACtB,QAAQ,EAAE,CAAC,CAAC,IAAI;aACjB,CAAC,CAAC;YACH,IAAI,UAAU,KAAK,IAAI;gBAAE,SAAS;YAElC,2BAA2B;YAC3B,IAAI,SAAS,GAAG,MAAM,CAAC,WAAW,CAAC,aAAa,EAAE,CAAC,CAAC,IAAI,EAAE,UAAU,CAAC,CAAC,CAAC;YACvE,IAAI,UAAU,GAAG,oBAAoB,CAAC;YACtC,IAAI,SAAS,GAAG,CAAC,CAAC;YAClB,8DAA8D;YAC9D,uDAAuD;YACvD,IAAI,CAAC,SAAS,EAAE,CAAC;gBACf,KAAK,IAAI,KAAK,GAAG,CAAC,EAAE,KAAK,IAAI,eAAe,EAAE,KAAK,EAAE,EAAE,CAAC;oBACtD,KAAK,MAAM,MAAM,IAAI,CAAC,CAAC,KAAK,EAAE,KAAK,CAAC,EAAE,CAAC;wBACrC,MAAM,EAAE,GAAG,MAAM,CAAC,WAAW,CAAC,aAAa,EAAE,CAAC,CAAC,IAAI,EAAE,UAAU,GAAG,MAAM,CAAC,CAAC,CAAC;wBAC3E,IAAI,EAAE,EAAE,CAAC;4BACP,SAAS,GAAG,EAAE,CAAC;4BACf,UAAU,GAAG,mBAAmB,CAAC;4BACjC,SAAS,GAAG,MAAM,CAAC;4BACnB,MAAM;wBACR,CAAC;oBACH,CAAC;oBACD,IAAI,SAAS;wBAAE,MAAM;gBACvB,CAAC;YACH,CAAC;YACD,IAAI,CAAC,SAAS;gBAAE,SAAS;YAEzB,YAAY,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;YACpB,cAAc,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;YAC9B,MAAM,OAAO,GAAkB;gBAC7B;oBACE,IAAI,EAAE,WAAW,GAAG,CAAC,SAAS,KAAK,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC;oBACxD,MAAM,EACJ,SAAS,KAAK,CAAC;wBACb,CAAC,CAAC,mBAAmB,CAAC,CAAC,IAAI,IAAI,CAAC,CAAC,IAAI,OAAO,aAAa,IAAI,UAAU,EAAE;wBACzE,CAAC,CAAC,mBAAmB,CAAC,CAAC,IAAI,IAAI,CAAC,CAAC,IAAI,OAAO,aAAa,IAAI,UAAU,IAAI;4BACzE,wBAAwB,SAAS,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,GAAG,SAAS,mCAAmC;iBACtG;aACF,CAAC;YACF,IAAI,WAAW,EAAE,CAAC;gBAChB,OAAO,CAAC,OAAO,CAAC;oBACd,IAAI,EAAE,YAAY;oBAClB,MAAM,EAAE,iBAAiB,CAAC,CAAC,IAAI,MAAM,aAAa,EAAE;iBACrD,CAAC,CAAC;YACL,CAAC;YACD,KAAK,CAAC,IAAI,CAAC;gBACT,OAAO,EAAE,CAAC,CAAC,EAAE;gBACb,SAAS,EAAE,SAAS,CAAC,EAAE;gBACvB,MAAM,EAAE,WAAW,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,WAAW;gBAC/C,UAAU;gBACV,OAAO;aACR,CAAC,CAAC;QACL,CAAC;IACH,CAAC;IAED,iEAAiE;IACjE,4DAA4D;IAC5D,iEAAiE;IACjE,6DAA6D;IAC7D,8DAA8D;IAC9D,+DAA+D;IAC/D,8BAA8B;IAC9B,CAAC;QACC,MAAM,gBAAgB,GAAG,IAAI,GAAG,EAA6B,CAAC;QAC9D,KAAK,MAAM,CAAC,IAAI,OAAO,EAAE,CAAC;YACxB,IAAI,cAAc,CAAC,GAAG,CAAC,CAAC,CAAC;gBAAE,SAAS;YACpC,IAAI,CAAC,CAAC,CAAC,WAAW,IAAI,CAAC,CAAC,CAAC,IAAI;gBAAE,SAAS;YACxC,MAAM,GAAG,GAAG,UAAU,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,WAAW,CAAC,CAAC;YAC9C,MAAM,MAAM,GAAG,gBAAgB,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;YACzC,IAAI,MAAM;gBAAE,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;;gBACtB,gBAAgB,CAAC,GAAG,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC;QACtC,CAAC;QACD,MAAM,WAAW,GAAG,CAAC,GAAW,EAA+B,EAAE;YAC/D,MAAM,MAAM,GAAG,gBAAgB,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;YACzC,IAAI,CAAC,MAAM,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC;gBAAE,OAAO,SAAS,CAAC;YACrD,MAAM,IAAI,GAAG,MAAM,CAAC,KAAK,EAAE,CAAC;YAC5B,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC;gBAAE,gBAAgB,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;YACtD,OAAO,IAAI,CAAC;QACd,CAAC,CAAC;QACF,KAAK,MAAM,CAAC,IAAI,KAAK,EAAE,CAAC;YACtB,IAAI,YAAY,CAAC,GAAG,CAAC,CAAC,CAAC;gBAAE,SAAS;YAClC,IAAI,CAAC,CAAC,CAAC,WAAW,IAAI,CAAC,CAAC,CAAC,IAAI;gBAAE,SAAS;YACxC,MAAM,SAAS,GAAG,WAAW,CAAC,UAAU,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC;YACjE,IAAI,CAAC,SAAS;gBAAE,SAAS;YACzB,YAAY,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;YACpB,cAAc,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;YAC9B,MAAM,WAAW,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,IAAI,SAAS,CAAC,IAAI,IAAI,CAAC,CAAC,IAAI,KAAK,SAAS,CAAC,IAAI,CAAC,CAAC;YAC9E,KAAK,CAAC,IAAI,CAAC;gBACT,OAAO,EAAE,CAAC,CAAC,EAAE;gBACb,SAAS,EAAE,SAAS,CAAC,EAAE;gBACvB,MAAM,EAAE,WAAW,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,WAAW;gBAC/C,UAAU,EAAE,uBAAuB;gBACnC,OAAO,EAAE;oBACP;wBACE,IAAI,EAAE,cAAc;wBACpB,MAAM,EAAE,WAAW;4BACjB,CAAC,CAAC,qCAAqC,CAAC,CAAC,IAAI,IAAI,GAAG,MAAM,SAAS,CAAC,IAAI,IAAI,GAAG,EAAE;4BACjF,CAAC,CAAC,qFAAqF;qBAC1F;iBACF;aACF,CAAC,CAAC;QACL,CAAC;IACH,CAAC;IAED,kDAAkD;IAClD,MAAM,cAAc,GAAgB,EAAE,CAAC;IACvC,MAAM,gBAAgB,GAAgB,EAAE,CAAC;IACzC,KAAK,MAAM,CAAC,IAAI,KAAK;QAAE,IAAI,CAAC,YAAY,CAAC,GAAG,CAAC,CAAC,CAAC;YAAE,cAAc,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;IAC3E,KAAK,MAAM,CAAC,IAAI,OAAO;QAAE,IAAI,CAAC,cAAc,CAAC,GAAG,CAAC,CAAC,CAAC;YAAE,gBAAgB,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;IACjF,MAAM,cAAc,GAAG,IAAA,kCAAe,EAAC,cAAc,EAAE,gBAAgB,CAAC,CAAC;IACzE,KAAK,MAAM,IAAI,IAAI,cAAc,CAAC,KAAK;QAAE,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAE1D,+CAA+C;IAC/C,MAAM,SAAS,GAAgB,EAAE,CAAC;IAClC,MAAM,KAAK,GAAgB,EAAE,CAAC;IAC9B,MAAM,OAAO,GAAgB,EAAE,CAAC;IAChC,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;QACzB,QAAQ,IAAI,CAAC,MAAM,EAAE,CAAC;YACpB,KAAK,WAAW,CAAC;YACjB,KAAK,WAAW;gBACd,IAAI,IAAI,CAAC,OAAO;oBAAE,SAAS,CAAC,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;gBAC/C,IAAI,IAAI,CAAC,SAAS,IAAI,IAAI,CAAC,SAAS,KAAK,IAAI,CAAC,OAAO;oBAAE,SAAS,CAAC,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;gBACtF,MAAM;YACR,KAAK,OAAO;gBACV,IAAI,IAAI,CAAC,SAAS;oBAAE,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;gBAC/C,MAAM;YACR,KAAK,SAAS;gBACZ,IAAI,IAAI,CAAC,OAAO;oBAAE,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;gBAC7C,MAAM;QACV,CAAC;IACH,CAAC;IAED,OAAO;QACL,KAAK;QACL,SAAS;QACT,KAAK;QACL,OAAO;QACP,QAAQ,EAAE,YAAY,CAAC,EAAE;QACzB,cAAc,EAAE,YAAY,CAAC,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,YAAY,CAAC,MAAM;KAClE,CAAC;AACJ,CAAC;AAED,SAAS,WAAW,CAAC,IAAY,EAAE,IAAY,EAAE,IAAY;IAC3D,OAAO,GAAG,IAAI,KAAK,IAAI,KAAK,IAAI,EAAE,CAAC;AACrC,CAAC;AAED,SAAS,UAAU,CAAC,IAAY,EAAE,WAAmB;IACnD,OAAO,YAAY,IAAI,KAAK,WAAW,EAAE,CAAC;AAC5C,CAAC;AAED;;;;;;GAMG;AACH,SAAS,aAAa,CAAC,GAAW,EAAE,OAAe,EAAE,OAAe;IAClE,MAAM,OAAO,GAAG,IAAI,GAAG,EAAkB,CAAC;IAC1C,IAAI,MAAc,CAAC;IACnB,IAAI,CAAC;QACH,MAAM,GAAG,IAAA,4BAAY,EAAC,KAAK,EAAE,CAAC,MAAM,EAAE,eAAe,EAAE,gBAAgB,EAAE,OAAO,EAAE,OAAO,CAAC,EAAE;YAC1F,GAAG;YACH,QAAQ,EAAE,MAAM;SACjB,CAAC,CAAC;IACL,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,OAAO,CAAC;IACjB,CAAC;IACD,KAAK,MAAM,IAAI,IAAI,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC;QACtC,oDAAoD;QACpD,sEAAsE;QACtE,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC;YAAE,SAAS;QACpC,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;QAC/B,IAAI,KAAK,CAAC,MAAM,GAAG,CAAC;YAAE,SAAS;QAC/B,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;IAClC,CAAC;IACD,OAAO,OAAO,CAAC;AACjB,CAAC;AAED;;;;;GAKG;AACH,SAAS,iBAAiB,CAAC,GAAW,EAAE,GAAW;IACjD,IAAI,CAAC;QACH,IAAA,4BAAY,EAAC,KAAK,EAAE,CAAC,WAAW,EAAE,WAAW,CAAC,EAAE,EAAE,GAAG,EAAE,KAAK,EAAE,QAAQ,EAAE,CAAC,CAAC;IAC5E,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,uDAAuD,EAAE,CAAC;IACxF,CAAC;IACD,IAAI,CAAC;QACH,IAAA,4BAAY,EAAC,KAAK,EAAE,CAAC,UAAU,EAAE,IAAI,EAAE,GAAG,CAAC,EAAE,EAAE,GAAG,EAAE,KAAK,EAAE,QAAQ,EAAE,CAAC,CAAC;QACvE,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,CAAC;IACtB,CAAC;IAAC,MAAM,CAAC;QACP,OAAO;YACL,EAAE,EAAE,KAAK;YACT,MAAM,EAAE,mBAAmB,GAAG,mEAAmE;SAClG,CAAC;IACJ,CAAC;AACH,CAAC"}

package/dist/baseline/policy.d.ts

@@ -0,0 +1,171 @@
+/**
+ * Brownfield policy + status classifier.
+ *
+ * The matcher in `git-aware-match.ts` emits raw `MatchPair`s with one
+ * of four statuses (persisted / relocated / added / removed) plus a
+ * confidence score and structured reasons. The guardrail check needs
+ * a richer taxonomy — the difference between "developer introduced
+ * a new finding" and "a scanner update surfaced a finding that was
+ * always there" matters enormously for whether to block a PR.
+ *
+ * This module is the bridge. It takes a `MatchPair` plus optional
+ * context (severity, scanner-version diff, config diff) and a
+ * `BrownfieldPolicy`, then emits a `ClassifyResult` carrying the
+ * post-policy `FindingStatus`, the block/warn verdict, and the
+ * composed reason chain.
+ *
+ * Pure module — no I/O, deterministic over its inputs.
+ *
+ * Producer wiring note: today's classifier emits a subset of the full
+ * `FindingStatus` taxonomy. Reservations for `probable_existing`,
+ * `newly_detected`, and `fixed` are declared in the type space so
+ * Phase 3's baseline-metadata work can light them up incrementally
+ * without re-shaping consumer code.
+ */
+import type { FindingSeverity, FindingStatus, MatchPair, MatchReason } from './types';
+/**
+ * Per-finding-kind overrides that escalate specific guardrail rules
+ * beyond the generic `block` / `warn` lists. Each rule maps to a
+ * common product-level concern; the classifier checks them when the
+ * relevant context fields are present.
+ */
+export interface BrownfieldBlockRules {
+    /** Block any newly-introduced secret regardless of confidence. */
+    readonly newSecret?: boolean;
+    /** Block any newly-introduced critical security finding. */
+    readonly newCriticalSecurity?: boolean;
+    /** Block any newly-introduced high-severity security finding. */
+    readonly newHighSecurity?: boolean;
+    /** Block any newly-introduced critical dependency vulnerability. */
+    readonly newCriticalDependencyVulnerability?: boolean;
+    /** Block any newly-introduced high-severity reachable dep vuln. */
+    readonly newHighReachableDependencyVulnerability?: boolean;
+    /** Block when an untested source file is added in a changed file. */
+    readonly newUntestedChangedSource?: boolean;
+    /** Block any newly-introduced severe quality issue in changed files. */
+    readonly newSevereQualityIssueInChangedFiles?: boolean;
+}
+/**
+ * Brownfield-mode policy. The product promise — "existing debt is
+ * allowed; new regressions are blocked" — flows from these settings.
+ */
+export interface BrownfieldPolicy {
+    readonly mode: 'brownfield';
+    /** Statuses that fail the guardrail check (non-zero exit code). */
+    readonly block: ReadonlyArray<FindingStatus>;
+    /** Statuses that emit a warning but don't fail. */
+    readonly warn: ReadonlyArray<FindingStatus>;
+    /**
+     * Per-severity confidence thresholds. A `relocated` or `persisted`
+     * match with confidence below the per-severity threshold demotes
+     * to `'uncertain'` — the policy can warn rather than silently
+     * accept a low-confidence pairing.
+     */
+    readonly confidence: Readonly<Record<FindingSeverity, number>>;
+    /** Per-kind block-on-new overrides. */
+    readonly blockRules: BrownfieldBlockRules;
+    /**
+     * Finding kinds whose `added` classification only blocks when the
+     * finding overlaps lines actually changed in the current diff.
+     *
+     * Some upstream scanners (notably semgrep on large codebases) are
+     * non-deterministic across runs — parallel rule execution + per-
+     * rule timeouts mean each run discovers a slightly different
+     * subset of the full match space. When the baseline missed a real
+     * finding and a later scan catches it on UNCHANGED code, the
+     * matcher legitimately reports `added` — but the developer
+     * didn't introduce it.
+     *
+     * For kinds listed here, an `added` finding outside the diff's
+     * changed lines gets demoted to `uncertain` (a warn status).
+     * Findings inside changed lines still block — that's where the
+     * developer actually wrote code.
+     *
+     * Default: `['code', 'hygiene']` — the kinds with confirmed
+     * scanner-wobble risk. Customers can extend (`'duplication'`,
+     * `'large-file'`) or clear it (block on everything regardless of
+     * diff overlap) via `.dxkit/policy.json`.
+     */
+    readonly addedRequiresChangedLines: ReadonlyArray<string>;
+}
+/**
+ * Default brownfield policy. Captures the conservative posture from
+ * the agentic-brownfield strategy: block only on high-confidence new
+ * regressions; warn on the categories that suggest a problem might
+ * be real but might also be drift; legacy debt is permitted.
+ *
+ * Confidence thresholds: secrets + critical security demand a tight
+ * confidence threshold (a low-confidence persisted secret pairing
+ * gets demoted to uncertain and warned, not blocked). Lower-severity
+ * findings can pair on weaker signal because the cost of a false
+ * "secret is new" event is much higher than a false "TODO is new."
+ */
+export declare const DEFAULT_BROWNFIELD_POLICY: BrownfieldPolicy;
+/**
+ * Contextual signals the classifier reads when available. Every field
+ * is optional — pass `{}` for the basic matcher-only classification.
+ * Phase 3 baseline-metadata work will populate these from the stored
+ * baseline + current scan envelope.
+ */
+export interface ClassifyContext {
+    /** Severity of the underlying finding. */
+    readonly severity?: FindingSeverity;
+    /** Kind discriminator from `IdentityInput`, for block-rule checks. */
+    readonly kind?: string;
+    /** True when the baseline's scanner / advisory-db version differs
+     *  from the current scan. Reclassifies an `added` finding as
+     *  `tooling_drift` rather than blocking it as a new regression. */
+    readonly scannerVersionDiffers?: boolean;
+    /** True when the baseline's `.dxkit-ignore` / policy hash differs
+     *  from the current scan. Reclassifies `added` as `config_drift`. */
+    readonly configDiffers?: boolean;
+    /** True when the underlying source file's lines overlap lines
+     *  changed by the current diff. Used by `newSevereQualityIssueIn
+     *  ChangedFiles` and similar rules; absent context is treated as
+     *  "we don't know, assume outside changed lines." */
+    readonly overlapsChangedLines?: boolean;
+    /** True when an `added` dep-vuln is on a reachable code path. */
+    readonly reachable?: boolean;
+}
+/** Verdict + reasoning for one classified pair. */
+export interface ClassifyResult {
+    readonly status: FindingStatus;
+    /** Whether the policy blocks based on the classified status or a
+     *  specific block-rule override. */
+    readonly blocks: boolean;
+    /** Whether the policy warns. */
+    readonly warns: boolean;
+    /** Reasons backing the status — composed of the matcher's reasons
+     *  plus any classification-time additions. */
+    readonly reasons: ReadonlyArray<MatchReason>;
+}
+/**
+ * Classify one match pair against a brownfield policy.
+ *
+ * Pipeline:
+ *   1. Start with the matcher's `pair.status` as the candidate
+ *      `FindingStatus`.
+ *   2. For `added`: check drift context. Scanner-version drift wins
+ *      (more specific signal) over config drift; both demote to
+ *      drift-bucket statuses regardless of severity.
+ *   3. For `persisted` / `relocated`: check confidence against the
+ *      per-severity threshold. Below threshold demotes to
+ *      `'uncertain'`.
+ *   4. Apply block-rule overrides: if a block-rule fires for this
+ *      kind+severity combination AND the candidate status is
+ *      `'added'`, the result blocks even if `'added'` weren't in the
+ *      policy's block list.
+ *   5. Apply the policy's `block` / `warn` membership to the final
+ *      status to produce the booleans.
+ */
+export declare function classify(pair: MatchPair, policy?: BrownfieldPolicy, context?: ClassifyContext): ClassifyResult;
+/**
+ * Convenience: classify every pair in a match result against the
+ * same policy. Returns an array aligned with the input pair order
+ * so callers can render side-by-side. Per-pair context (severity,
+ * kind, drift flags) is supplied via the optional `contextFor`
+ * callback — callers map their `FindingId` back to the producer
+ * envelope to fill in the fields the classifier reads.
+ */
+export declare function classifyAll(pairs: ReadonlyArray<MatchPair>, policy?: BrownfieldPolicy, contextFor?: (pair: MatchPair) => ClassifyContext): ReadonlyArray<ClassifyResult>;
+//# sourceMappingURL=policy.d.ts.map

package/dist/baseline/policy.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"policy.d.ts","sourceRoot":"","sources":["../../src/baseline/policy.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AAEH,OAAO,KAAK,EAAE,eAAe,EAAE,aAAa,EAAE,SAAS,EAAE,WAAW,EAAE,MAAM,SAAS,CAAC;AAEtF;;;;;GAKG;AACH,MAAM,WAAW,oBAAoB;IACnC,kEAAkE;IAClE,QAAQ,CAAC,SAAS,CAAC,EAAE,OAAO,CAAC;IAC7B,4DAA4D;IAC5D,QAAQ,CAAC,mBAAmB,CAAC,EAAE,OAAO,CAAC;IACvC,iEAAiE;IACjE,QAAQ,CAAC,eAAe,CAAC,EAAE,OAAO,CAAC;IACnC,oEAAoE;IACpE,QAAQ,CAAC,kCAAkC,CAAC,EAAE,OAAO,CAAC;IACtD,mEAAmE;IACnE,QAAQ,CAAC,uCAAuC,CAAC,EAAE,OAAO,CAAC;IAC3D,qEAAqE;IACrE,QAAQ,CAAC,wBAAwB,CAAC,EAAE,OAAO,CAAC;IAC5C,wEAAwE;IACxE,QAAQ,CAAC,mCAAmC,CAAC,EAAE,OAAO,CAAC;CACxD;AAED;;;GAGG;AACH,MAAM,WAAW,gBAAgB;IAC/B,QAAQ,CAAC,IAAI,EAAE,YAAY,CAAC;IAC5B,mEAAmE;IACnE,QAAQ,CAAC,KAAK,EAAE,aAAa,CAAC,aAAa,CAAC,CAAC;IAC7C,mDAAmD;IACnD,QAAQ,CAAC,IAAI,EAAE,aAAa,CAAC,aAAa,CAAC,CAAC;IAC5C;;;;;OAKG;IACH,QAAQ,CAAC,UAAU,EAAE,QAAQ,CAAC,MAAM,CAAC,eAAe,EAAE,MAAM,CAAC,CAAC,CAAC;IAC/D,uCAAuC;IACvC,QAAQ,CAAC,UAAU,EAAE,oBAAoB,CAAC;IAC1C;;;;;;;;;;;;;;;;;;;;;OAqBG;IACH,QAAQ,CAAC,yBAAyB,EAAE,aAAa,CAAC,MAAM,CAAC,CAAC;CAC3D;AAED;;;;;;;;;;;GAWG;AACH,eAAO,MAAM,yBAAyB,EAAE,gBA0BtC,CAAC;AAEH;;;;;GAKG;AACH,MAAM,WAAW,eAAe;IAC9B,0CAA0C;IAC1C,QAAQ,CAAC,QAAQ,CAAC,EAAE,eAAe,CAAC;IACpC,sEAAsE;IACtE,QAAQ,CAAC,IAAI,CAAC,EAAE,MAAM,CAAC;IACvB;;uEAEmE;IACnE,QAAQ,CAAC,qBAAqB,CAAC,EAAE,OAAO,CAAC;IACzC;yEACqE;IACrE,QAAQ,CAAC,aAAa,CAAC,EAAE,OAAO,CAAC;IACjC;;;yDAGqD;IACrD,QAAQ,CAAC,oBAAoB,CAAC,EAAE,OAAO,CAAC;IACxC,iEAAiE;IACjE,QAAQ,CAAC,SAAS,CAAC,EAAE,OAAO,CAAC;CAC9B;AAED,mDAAmD;AACnD,MAAM,WAAW,cAAc;IAC7B,QAAQ,CAAC,MAAM,EAAE,aAAa,CAAC;IAC/B;wCACoC;IACpC,QAAQ,CAAC,MAAM,EAAE,OAAO,CAAC;IACzB,gCAAgC;IAChC,QAAQ,CAAC,KAAK,EAAE,OAAO,CAAC;IACxB;kDAC8C;IAC9C,QAAQ,CAAC,OAAO,EAAE,aAAa,CAAC,WAAW,CAAC,CAAC;CAC9C;AAED;;;;;;;;;;;;;;;;;;GAkBG;AACH,wBAAgB,QAAQ,CACtB,IAAI,EAAE,SAAS,EACf,MAAM,GAAE,gBAA4C,EACpD,OAAO,GAAE,eAAoB,GAC5B,cAAc,CAmEhB;AA0DD;;;;;;;GAOG;AACH,wBAAgB,WAAW,CACzB,KAAK,EAAE,aAAa,CAAC,SAAS,CAAC,EAC/B,MAAM,GAAE,gBAA4C,EACpD,UAAU,GAAE,CAAC,IAAI,EAAE,SAAS,KAAK,eAA4B,GAC5D,aAAa,CAAC,cAAc,CAAC,CAE/B"}