@vyuhlabs/dxkit 2.5.1 → 2.6.0

package/dist/baseline/producers/secret-hmac.js.map

@@ -1 +1 @@
-{"version":3,"file":"secret-hmac.js","sourceRoot":"","sources":["../../../src/baseline/producers/secret-hmac.ts"],"names":[],"mappings":";AAAA;;;;;;;;;;;;;;;;;;;;;GAqBG;;AA2BH,kEA6BC;AAtDD,mEAAsE;AAEtE,0DAAkD;AAalD;;;;;;;;;GASG;AACH,SAAgB,2BAA2B,CAAC,KAA8B;IACxE,MAAM,GAAG,GAAoB,EAAE,CAAC;IAChC,oEAAoE;IACpE,mEAAmE;IACnE,kEAAkE;IAClE,8DAA8D;IAC9D,qDAAqD;IACrD,MAAM,IAAI,GAAG,IAAI,GAAG,EAAU,CAAC;IAC/B,KAAK,MAAM,GAAG,IAAI,KAAK,CAAC,UAAU,EAAE,CAAC;QACnC,IAAI,CAAC,GAAG,CAAC,MAAM;YAAE,SAAS;QAC1B,MAAM,IAAI,GAAG,IAAA,+BAAiB,EAAC,GAAG,CAAC,MAAM,EAAE,KAAK,CAAC,IAAI,CAAC,CAAC;QACvD,MAAM,aAAa,GAA4B;YAC7C,IAAI,EAAE,aAAa;YACnB,IAAI,EAAE,UAAU;YAChB,IAAI,EAAE,GAAG,CAAC,IAAI;YACd,IAAI;SACL,CAAC;QACF,MAAM,EAAE,GAAG,IAAA,8BAAW,EAAC,aAAa,CAAC,CAAC;QACtC,IAAI,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC;YAAE,SAAS;QAC3B,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QACb,GAAG,CAAC,IAAI,CAAC;YACP,EAAE;YACF,IAAI,EAAE,aAAa;YACnB,IAAI,EAAE,UAAU;YAChB,IAAI,EAAE,GAAG,CAAC,IAAI;YACd,IAAI;SACL,CAAC,CAAC;IACL,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC"}
+{"version":3,"file":"secret-hmac.js","sourceRoot":"","sources":["../../../src/baseline/producers/secret-hmac.ts"],"names":[],"mappings":";AAAA;;;;;;;;;;;;;;;;;;;;;GAqBG;;AA2BH,kEA6BC;AAtDD,mEAAsE;AAEtE,0DAAkD;AAalD;;;;;;;;;GASG;AACH,SAAgB,2BAA2B,CAAC,KAA8B;IACxE,MAAM,GAAG,GAAwB,EAAE,CAAC;IACpC,oEAAoE;IACpE,mEAAmE;IACnE,kEAAkE;IAClE,8DAA8D;IAC9D,qDAAqD;IACrD,MAAM,IAAI,GAAG,IAAI,GAAG,EAAU,CAAC;IAC/B,KAAK,MAAM,GAAG,IAAI,KAAK,CAAC,UAAU,EAAE,CAAC;QACnC,IAAI,CAAC,GAAG,CAAC,MAAM;YAAE,SAAS;QAC1B,MAAM,IAAI,GAAG,IAAA,+BAAiB,EAAC,GAAG,CAAC,MAAM,EAAE,KAAK,CAAC,IAAI,CAAC,CAAC;QACvD,MAAM,aAAa,GAA4B;YAC7C,IAAI,EAAE,aAAa;YACnB,IAAI,EAAE,UAAU;YAChB,IAAI,EAAE,GAAG,CAAC,IAAI;YACd,IAAI;SACL,CAAC;QACF,MAAM,EAAE,GAAG,IAAA,8BAAW,EAAC,aAAa,CAAC,CAAC;QACtC,IAAI,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC;YAAE,SAAS;QAC3B,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QACb,GAAG,CAAC,IAAI,CAAC;YACP,EAAE;YACF,IAAI,EAAE,aAAa;YACnB,IAAI,EAAE,UAAU;YAChB,IAAI,EAAE,GAAG,CAAC,IAAI;YACd,IAAI;SACL,CAAC,CAAC;IACL,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC"}

package/dist/baseline/producers/security.d.ts

@@ -38,7 +38,7 @@
  * work.
  */
 import type { SecurityAggregate } from '../../analyzers/security/aggregator';
-import type { BaselineEntry } from '../types';
+import type { RichBaselineEntry } from '../types';
 export interface SecurityProducerOptions {
     /** Repo path; used by `computeContentHashFromCommit` to invoke
      *  `git show`. Omitting it disables content-hash stamping. */
@@ -55,5 +55,5 @@ export interface SecurityProducerOptions {
  * iteration order of the four categories so the produced baseline
  * stays stable across re-runs of the same scan.
  */
-export declare function securityAggregateToBaselineEntries(aggregate: SecurityAggregate, options?: SecurityProducerOptions): BaselineEntry[];
+export declare function securityAggregateToBaselineEntries(aggregate: SecurityAggregate, options?: SecurityProducerOptions): RichBaselineEntry[];
 //# sourceMappingURL=security.d.ts.map

package/dist/baseline/producers/security.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"security.d.ts","sourceRoot":"","sources":["../../../src/baseline/producers/security.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAsCG;AAGH,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,qCAAqC,CAAC;AAE7E,OAAO,KAAK,EACV,aAAa,EAKd,MAAM,UAAU,CAAC;AAElB,MAAM,WAAW,uBAAuB;IACtC;kEAC8D;IAC9D,QAAQ,CAAC,GAAG,CAAC,EAAE,MAAM,CAAC;IACtB;;;;eAIW;IACX,QAAQ,CAAC,SAAS,CAAC,EAAE,MAAM,CAAC;CAC7B;AAED;;;;GAIG;AACH,wBAAgB,kCAAkC,CAChD,SAAS,EAAE,iBAAiB,EAC5B,OAAO,GAAE,uBAA4B,GACpC,aAAa,EAAE,CAwFjB"}
+{"version":3,"file":"security.d.ts","sourceRoot":"","sources":["../../../src/baseline/producers/security.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAsCG;AAGH,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,qCAAqC,CAAC;AAE7E,OAAO,KAAK,EACV,iBAAiB,EAKlB,MAAM,UAAU,CAAC;AAElB,MAAM,WAAW,uBAAuB;IACtC;kEAC8D;IAC9D,QAAQ,CAAC,GAAG,CAAC,EAAE,MAAM,CAAC;IACtB;;;;eAIW;IACX,QAAQ,CAAC,SAAS,CAAC,EAAE,MAAM,CAAC;CAC7B;AAED;;;;GAIG;AACH,wBAAgB,kCAAkC,CAChD,SAAS,EAAE,iBAAiB,EAC5B,OAAO,GAAE,uBAA4B,GACpC,iBAAiB,EAAE,CAwFrB"}

package/dist/baseline/producers/security.js.map

@@ -1 +1 @@
-{"version":3,"file":"security.js","sourceRoot":"","sources":["../../../src/baseline/producers/security.ts"],"names":[],"mappings":";AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAsCG;;AA8BH,gFA2FC;AAvHD,kDAA+D;AAE/D,0DAAkD;AAqBlD;;;;GAIG;AACH,SAAgB,kCAAkC,CAChD,SAA4B,EAC5B,UAAmC,EAAE;IAErC,MAAM,GAAG,GAAoB,EAAE,CAAC;IAChC,MAAM,KAAK,GAAG,CAAC,IAAY,EAAE,IAAY,EAAsB,EAAE;QAC/D,IAAI,CAAC,OAAO,CAAC,GAAG,IAAI,CAAC,OAAO,CAAC,SAAS,IAAI,IAAI,IAAI,CAAC;YAAE,OAAO,SAAS,CAAC;QACtE,MAAM,IAAI,GAAG,IAAA,2CAA4B,EAAC,OAAO,CAAC,GAAG,EAAE,OAAO,CAAC,SAAS,EAAE,IAAI,EAAE,IAAI,CAAC,CAAC;QACtF,OAAO,IAAI,IAAI,SAAS,CAAC;IAC3B,CAAC,CAAC;IAEF,KAAK,MAAM,CAAC,IAAI,SAAS,CAAC,kBAAkB,CAAC,MAAM,EAAE,CAAC;QACpD,MAAM,KAAK,GAAwB;YACjC,IAAI,EAAE,QAAQ;YACd,IAAI,EAAE,CAAC,CAAC,IAAI;YACZ,IAAI,EAAE,CAAC,CAAC,IAAI;YACZ,IAAI,EAAE,CAAC,CAAC,IAAI;YACZ,IAAI,EAAE,CAAC,CAAC,IAAI;SACb,CAAC;QACF,MAAM,WAAW,GAAG,KAAK,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC;QAC1C,GAAG,CAAC,IAAI,CAAC;YACP,EAAE,EAAE,IAAA,8BAAW,EAAC,KAAK,CAAC;YACtB,IAAI,EAAE,QAAQ;YACd,IAAI,EAAE,CAAC,CAAC,IAAI;YACZ,IAAI,EAAE,CAAC,CAAC,IAAI;YACZ,IAAI,EAAE,CAAC,CAAC,IAAI;YACZ,IAAI,EAAE,CAAC,CAAC,IAAI;YACZ,GAAG,CAAC,WAAW,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SACtD,CAAC,CAAC;IACL,CAAC;IAED,KAAK,MAAM,CAAC,IAAI,SAAS,CAAC,kBAAkB,CAAC,IAAI,EAAE,CAAC;QAClD,MAAM,KAAK,GAAsB;YAC/B,IAAI,EAAE,MAAM;YACZ,IAAI,EAAE,CAAC,CAAC,IAAI;YACZ,IAAI,EAAE,CAAC,CAAC,IAAI;YACZ,IAAI,EAAE,CAAC,CAAC,IAAI;YACZ,IAAI,EAAE,CAAC,CAAC,IAAI;SACb,CAAC;QACF,MAAM,WAAW,GAAG,KAAK,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC;QAC1C,GAAG,CAAC,IAAI,CAAC;YACP,EAAE,EAAE,IAAA,8BAAW,EAAC,KAAK,CAAC;YACtB,IAAI,EAAE,MAAM;YACZ,IAAI,EAAE,CAAC,CAAC,IAAI;YACZ,IAAI,EAAE,CAAC,CAAC,IAAI;YACZ,IAAI,EAAE,CAAC,CAAC,IAAI;YACZ,IAAI,EAAE,CAAC,CAAC,IAAI;YACZ,GAAG,CAAC,WAAW,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SACtD,CAAC,CAAC;IACL,CAAC;IAED,KAAK,MAAM,CAAC,IAAI,SAAS,CAAC,kBAAkB,CAAC,MAAM,EAAE,CAAC;QACpD,MAAM,KAAK,GAAwB;YACjC,IAAI,EAAE,QAAQ;YACd,IAAI,EAAE,CAAC,CAAC,IAAI;YACZ,IAAI,EAAE,CAAC,CAAC,IAAI;YACZ,IAAI,EAAE,CAAC,CAAC,IAAI;YACZ,IAAI,EAAE,CAAC,CAAC,IAAI;SACb,CAAC;QACF,iEAAiE;QACjE,yDAAyD;QACzD,MAAM,WAAW,GAAG,KAAK,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC;QAC1C,GAAG,CAAC,IAAI,CAAC;YACP,EAAE,EAAE,IAAA,8BAAW,EAAC,KAAK,CAAC;YACtB,IAAI,EAAE,QAAQ;YACd,IAAI,EAAE,CAAC,CAAC,IAAI;YACZ,IAAI,EAAE,CAAC,CAAC,IAAI;YACZ,IAAI,EAAE,CAAC,CAAC,IAAI;YACZ,IAAI,EAAE,CAAC,CAAC,IAAI;YACZ,GAAG,CAAC,WAAW,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SACtD,CAAC,CAAC;IACL,CAAC;IAED,KAAK,MAAM,CAAC,IAAI,SAAS,CAAC,kBAAkB,CAAC,UAAU,EAAE,CAAC;QACxD,MAAM,KAAK,GAAyB;YAClC,IAAI,EAAE,UAAU;YAChB,OAAO,EAAE,CAAC,CAAC,OAAO;YAClB,gBAAgB,EAAE,CAAC,CAAC,gBAAgB;YACpC,EAAE,EAAE,CAAC,CAAC,EAAE;SACT,CAAC;QACF,MAAM,KAAK,GAAkB;YAC3B,EAAE,EAAE,IAAA,8BAAW,EAAC,KAAK,CAAC;YACtB,IAAI,EAAE,UAAU;YAChB,OAAO,EAAE,CAAC,CAAC,OAAO;YAClB,UAAU,EAAE,CAAC,CAAC,EAAE;YAChB,GAAG,CAAC,CAAC,CAAC,gBAAgB,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,gBAAgB,EAAE,CAAC,CAAC,gBAAgB,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SACtF,CAAC;QACF,GAAG,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IAClB,CAAC;IAED,OAAO,GAAG,CAAC;AACb,CAAC"}
+{"version":3,"file":"security.js","sourceRoot":"","sources":["../../../src/baseline/producers/security.ts"],"names":[],"mappings":";AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAsCG;;AA8BH,gFA2FC;AAvHD,kDAA+D;AAE/D,0DAAkD;AAqBlD;;;;GAIG;AACH,SAAgB,kCAAkC,CAChD,SAA4B,EAC5B,UAAmC,EAAE;IAErC,MAAM,GAAG,GAAwB,EAAE,CAAC;IACpC,MAAM,KAAK,GAAG,CAAC,IAAY,EAAE,IAAY,EAAsB,EAAE;QAC/D,IAAI,CAAC,OAAO,CAAC,GAAG,IAAI,CAAC,OAAO,CAAC,SAAS,IAAI,IAAI,IAAI,CAAC;YAAE,OAAO,SAAS,CAAC;QACtE,MAAM,IAAI,GAAG,IAAA,2CAA4B,EAAC,OAAO,CAAC,GAAG,EAAE,OAAO,CAAC,SAAS,EAAE,IAAI,EAAE,IAAI,CAAC,CAAC;QACtF,OAAO,IAAI,IAAI,SAAS,CAAC;IAC3B,CAAC,CAAC;IAEF,KAAK,MAAM,CAAC,IAAI,SAAS,CAAC,kBAAkB,CAAC,MAAM,EAAE,CAAC;QACpD,MAAM,KAAK,GAAwB;YACjC,IAAI,EAAE,QAAQ;YACd,IAAI,EAAE,CAAC,CAAC,IAAI;YACZ,IAAI,EAAE,CAAC,CAAC,IAAI;YACZ,IAAI,EAAE,CAAC,CAAC,IAAI;YACZ,IAAI,EAAE,CAAC,CAAC,IAAI;SACb,CAAC;QACF,MAAM,WAAW,GAAG,KAAK,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC;QAC1C,GAAG,CAAC,IAAI,CAAC;YACP,EAAE,EAAE,IAAA,8BAAW,EAAC,KAAK,CAAC;YACtB,IAAI,EAAE,QAAQ;YACd,IAAI,EAAE,CAAC,CAAC,IAAI;YACZ,IAAI,EAAE,CAAC,CAAC,IAAI;YACZ,IAAI,EAAE,CAAC,CAAC,IAAI;YACZ,IAAI,EAAE,CAAC,CAAC,IAAI;YACZ,GAAG,CAAC,WAAW,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SACtD,CAAC,CAAC;IACL,CAAC;IAED,KAAK,MAAM,CAAC,IAAI,SAAS,CAAC,kBAAkB,CAAC,IAAI,EAAE,CAAC;QAClD,MAAM,KAAK,GAAsB;YAC/B,IAAI,EAAE,MAAM;YACZ,IAAI,EAAE,CAAC,CAAC,IAAI;YACZ,IAAI,EAAE,CAAC,CAAC,IAAI;YACZ,IAAI,EAAE,CAAC,CAAC,IAAI;YACZ,IAAI,EAAE,CAAC,CAAC,IAAI;SACb,CAAC;QACF,MAAM,WAAW,GAAG,KAAK,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC;QAC1C,GAAG,CAAC,IAAI,CAAC;YACP,EAAE,EAAE,IAAA,8BAAW,EAAC,KAAK,CAAC;YACtB,IAAI,EAAE,MAAM;YACZ,IAAI,EAAE,CAAC,CAAC,IAAI;YACZ,IAAI,EAAE,CAAC,CAAC,IAAI;YACZ,IAAI,EAAE,CAAC,CAAC,IAAI;YACZ,IAAI,EAAE,CAAC,CAAC,IAAI;YACZ,GAAG,CAAC,WAAW,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SACtD,CAAC,CAAC;IACL,CAAC;IAED,KAAK,MAAM,CAAC,IAAI,SAAS,CAAC,kBAAkB,CAAC,MAAM,EAAE,CAAC;QACpD,MAAM,KAAK,GAAwB;YACjC,IAAI,EAAE,QAAQ;YACd,IAAI,EAAE,CAAC,CAAC,IAAI;YACZ,IAAI,EAAE,CAAC,CAAC,IAAI;YACZ,IAAI,EAAE,CAAC,CAAC,IAAI;YACZ,IAAI,EAAE,CAAC,CAAC,IAAI;SACb,CAAC;QACF,iEAAiE;QACjE,yDAAyD;QACzD,MAAM,WAAW,GAAG,KAAK,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC;QAC1C,GAAG,CAAC,IAAI,CAAC;YACP,EAAE,EAAE,IAAA,8BAAW,EAAC,KAAK,CAAC;YACtB,IAAI,EAAE,QAAQ;YACd,IAAI,EAAE,CAAC,CAAC,IAAI;YACZ,IAAI,EAAE,CAAC,CAAC,IAAI;YACZ,IAAI,EAAE,CAAC,CAAC,IAAI;YACZ,IAAI,EAAE,CAAC,CAAC,IAAI;YACZ,GAAG,CAAC,WAAW,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SACtD,CAAC,CAAC;IACL,CAAC;IAED,KAAK,MAAM,CAAC,IAAI,SAAS,CAAC,kBAAkB,CAAC,UAAU,EAAE,CAAC;QACxD,MAAM,KAAK,GAAyB;YAClC,IAAI,EAAE,UAAU;YAChB,OAAO,EAAE,CAAC,CAAC,OAAO;YAClB,gBAAgB,EAAE,CAAC,CAAC,gBAAgB;YACpC,EAAE,EAAE,CAAC,CAAC,EAAE;SACT,CAAC;QACF,MAAM,KAAK,GAAsB;YAC/B,EAAE,EAAE,IAAA,8BAAW,EAAC,KAAK,CAAC;YACtB,IAAI,EAAE,UAAU;YAChB,OAAO,EAAE,CAAC,CAAC,OAAO;YAClB,UAAU,EAAE,CAAC,CAAC,EAAE;YAChB,GAAG,CAAC,CAAC,CAAC,gBAAgB,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,gBAAgB,EAAE,CAAC,CAAC,gBAAgB,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SACtF,CAAC;QACF,GAAG,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IAClB,CAAC;IAED,OAAO,GAAG,CAAC;AACb,CAAC"}

package/dist/baseline/producers/stale-allow.d.ts

@@ -0,0 +1,70 @@
+/**
+ * Stale-allow → baseline-entry producer.
+ *
+ * Detects orphaned inline allowlist annotations — `dxkit-allow:`
+ * comments in source files that no longer match any current
+ * finding. The developer added the annotation when something was
+ * flagged; the finding is now gone (resolved, scanner-rule changed,
+ * code refactored); the annotation is dead code that should be
+ * removed.
+ *
+ * # The matching contract
+ *
+ * An annotation at `(file, line)` is considered ACTIVE when at
+ * least one current finding lands at the same `(file, lineWindow)` —
+ * the 3-line window from `lineWindowFor` absorbs small formatter /
+ * line-shift drift so a still-relevant annotation doesn't get
+ * flagged stale by an unrelated edit.
+ *
+ * Annotations with no matching finding emit a `stale-allow`
+ * `BaselineEntry` whose identity is `(file, lineWindow, category)`.
+ * The strict-stale model (TypeScript's `@ts-expect-error` pattern)
+ * forces the developer to clean up — preventing the annotation
+ * graveyard pattern common to less strict tools.
+ *
+ * # What counts as a "covered location"
+ *
+ * Source-anchored finding kinds — `secret`, `code`, `config` —
+ * carry `(file, line)` and contribute to the covered set. The
+ * `findingsByCategory` arrays on the canonical `SecurityAggregate`
+ * are the only source today; the aggregator is the single canonical
+ * fingerprint-deduped source of these findings (CLAUDE.md G_v4_8).
+ *
+ * Kinds without `(file, line)` — `dep-vuln`, `duplication`,
+ * `secret-hmac`, `license`, etc. — never participate in inline-
+ * annotation matching by construction. Annotations targeting those
+ * findings always use the file-level allowlist.
+ *
+ * # Mode handling
+ *
+ * `staleHandling` lives in `.dxkit/policy.json` (out of scope for
+ * this producer — the orchestrator gates whether to call it). When
+ * called, the producer emits `stale-allow` entries unconditionally
+ * for every orphan; the policy-level "lenient mode" surfaces these
+ * as warnings in the renderer rather than as blocking entries.
+ */
+import type { SecurityAggregate } from '../../analyzers/security/aggregator';
+import type { InlineAllowlistOccurrence } from '../../allowlist/gather';
+import type { RichBaselineEntry } from '../types';
+export interface StaleAllowInput {
+    readonly annotations: ReadonlyArray<InlineAllowlistOccurrence>;
+    readonly aggregate: SecurityAggregate | null;
+}
+/**
+ * Build `stale-allow` entries from the annotation list + the
+ * canonical security aggregate. Pure function — no I/O, no side
+ * effects. Deterministic over equal inputs.
+ *
+ * Returns an empty array when:
+ *   - The annotation list is empty (nothing to check).
+ *   - The aggregate is null AND the annotation list is empty.
+ *
+ * When the aggregate is null but annotations exist, the producer
+ * conservatively emits NO stale entries — the caller has no way to
+ * know whether annotations are active or stale without the
+ * findings. Surfacing "everything is stale" in that scenario would
+ * be wrong; surfacing "everything is fine" is also wrong but less
+ * actively misleading.
+ */
+export declare function staleAllowToBaselineEntries(input: StaleAllowInput): RichBaselineEntry[];
+//# sourceMappingURL=stale-allow.d.ts.map

package/dist/baseline/producers/stale-allow.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"stale-allow.d.ts","sourceRoot":"","sources":["../../../src/baseline/producers/stale-allow.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA4CG;AAGH,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,qCAAqC,CAAC;AAC7E,OAAO,KAAK,EAAE,yBAAyB,EAAE,MAAM,wBAAwB,CAAC;AAExE,OAAO,KAAK,EAAE,iBAAiB,EAA2B,MAAM,UAAU,CAAC;AAE3E,MAAM,WAAW,eAAe;IAC9B,QAAQ,CAAC,WAAW,EAAE,aAAa,CAAC,yBAAyB,CAAC,CAAC;IAC/D,QAAQ,CAAC,SAAS,EAAE,iBAAiB,GAAG,IAAI,CAAC;CAC9C;AAED;;;;;;;;;;;;;;;GAeG;AACH,wBAAgB,2BAA2B,CAAC,KAAK,EAAE,eAAe,GAAG,iBAAiB,EAAE,CAwBvF"}

package/dist/baseline/producers/stale-allow.js

@@ -0,0 +1,111 @@
+"use strict";
+/**
+ * Stale-allow → baseline-entry producer.
+ *
+ * Detects orphaned inline allowlist annotations — `dxkit-allow:`
+ * comments in source files that no longer match any current
+ * finding. The developer added the annotation when something was
+ * flagged; the finding is now gone (resolved, scanner-rule changed,
+ * code refactored); the annotation is dead code that should be
+ * removed.
+ *
+ * # The matching contract
+ *
+ * An annotation at `(file, line)` is considered ACTIVE when at
+ * least one current finding lands at the same `(file, lineWindow)` —
+ * the 3-line window from `lineWindowFor` absorbs small formatter /
+ * line-shift drift so a still-relevant annotation doesn't get
+ * flagged stale by an unrelated edit.
+ *
+ * Annotations with no matching finding emit a `stale-allow`
+ * `BaselineEntry` whose identity is `(file, lineWindow, category)`.
+ * The strict-stale model (TypeScript's `@ts-expect-error` pattern)
+ * forces the developer to clean up — preventing the annotation
+ * graveyard pattern common to less strict tools.
+ *
+ * # What counts as a "covered location"
+ *
+ * Source-anchored finding kinds — `secret`, `code`, `config` —
+ * carry `(file, line)` and contribute to the covered set. The
+ * `findingsByCategory` arrays on the canonical `SecurityAggregate`
+ * are the only source today; the aggregator is the single canonical
+ * fingerprint-deduped source of these findings (CLAUDE.md G_v4_8).
+ *
+ * Kinds without `(file, line)` — `dep-vuln`, `duplication`,
+ * `secret-hmac`, `license`, etc. — never participate in inline-
+ * annotation matching by construction. Annotations targeting those
+ * findings always use the file-level allowlist.
+ *
+ * # Mode handling
+ *
+ * `staleHandling` lives in `.dxkit/policy.json` (out of scope for
+ * this producer — the orchestrator gates whether to call it). When
+ * called, the producer emits `stale-allow` entries unconditionally
+ * for every orphan; the policy-level "lenient mode" surfaces these
+ * as warnings in the renderer rather than as blocking entries.
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.staleAllowToBaselineEntries = staleAllowToBaselineEntries;
+const fingerprint_1 = require("../../analyzers/tools/fingerprint");
+const finding_identity_1 = require("../finding-identity");
+/**
+ * Build `stale-allow` entries from the annotation list + the
+ * canonical security aggregate. Pure function — no I/O, no side
+ * effects. Deterministic over equal inputs.
+ *
+ * Returns an empty array when:
+ *   - The annotation list is empty (nothing to check).
+ *   - The aggregate is null AND the annotation list is empty.
+ *
+ * When the aggregate is null but annotations exist, the producer
+ * conservatively emits NO stale entries — the caller has no way to
+ * know whether annotations are active or stale without the
+ * findings. Surfacing "everything is stale" in that scenario would
+ * be wrong; surfacing "everything is fine" is also wrong but less
+ * actively misleading.
+ */
+function staleAllowToBaselineEntries(input) {
+    if (input.annotations.length === 0)
+        return [];
+    if (input.aggregate === null)
+        return [];
+    const covered = buildCoveredLocations(input.aggregate);
+    const out = [];
+    for (const occ of input.annotations) {
+        const key = locationKey(occ.file, occ.line);
+        if (covered.has(key))
+            continue; // active suppression — not stale
+        const identityInput = {
+            kind: 'stale-allow',
+            file: occ.file,
+            line: occ.line,
+            category: occ.category,
+        };
+        out.push({
+            id: (0, finding_identity_1.identityFor)(identityInput),
+            kind: 'stale-allow',
+            file: occ.file,
+            line: occ.line,
+            category: occ.category,
+        });
+    }
+    return out;
+}
+// ─── Internals ────────────────────────────────────────────────────────────
+function buildCoveredLocations(aggregate) {
+    const out = new Set();
+    for (const f of aggregate.findingsByCategory.secret) {
+        out.add(locationKey(f.file, f.line));
+    }
+    for (const f of aggregate.findingsByCategory.code) {
+        out.add(locationKey(f.file, f.line));
+    }
+    for (const f of aggregate.findingsByCategory.config) {
+        out.add(locationKey(f.file, f.line));
+    }
+    return out;
+}
+function locationKey(file, line) {
+    return `${file}\0${(0, fingerprint_1.lineWindowFor)(line)}`;
+}
+//# sourceMappingURL=stale-allow.js.map

package/dist/baseline/producers/stale-allow.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"stale-allow.js","sourceRoot":"","sources":["../../../src/baseline/producers/stale-allow.ts"],"names":[],"mappings":";AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA4CG;;AA6BH,kEAwBC;AAnDD,mEAAkE;AAGlE,0DAAkD;AAQlD;;;;;;;;;;;;;;;GAeG;AACH,SAAgB,2BAA2B,CAAC,KAAsB;IAChE,IAAI,KAAK,CAAC,WAAW,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,EAAE,CAAC;IAC9C,IAAI,KAAK,CAAC,SAAS,KAAK,IAAI;QAAE,OAAO,EAAE,CAAC;IAExC,MAAM,OAAO,GAAG,qBAAqB,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC;IACvD,MAAM,GAAG,GAAwB,EAAE,CAAC;IACpC,KAAK,MAAM,GAAG,IAAI,KAAK,CAAC,WAAW,EAAE,CAAC;QACpC,MAAM,GAAG,GAAG,WAAW,CAAC,GAAG,CAAC,IAAI,EAAE,GAAG,CAAC,IAAI,CAAC,CAAC;QAC5C,IAAI,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC;YAAE,SAAS,CAAC,iCAAiC;QACjE,MAAM,aAAa,GAA4B;YAC7C,IAAI,EAAE,aAAa;YACnB,IAAI,EAAE,GAAG,CAAC,IAAI;YACd,IAAI,EAAE,GAAG,CAAC,IAAI;YACd,QAAQ,EAAE,GAAG,CAAC,QAAQ;SACvB,CAAC;QACF,GAAG,CAAC,IAAI,CAAC;YACP,EAAE,EAAE,IAAA,8BAAW,EAAC,aAAa,CAAC;YAC9B,IAAI,EAAE,aAAa;YACnB,IAAI,EAAE,GAAG,CAAC,IAAI;YACd,IAAI,EAAE,GAAG,CAAC,IAAI;YACd,QAAQ,EAAE,GAAG,CAAC,QAAQ;SACvB,CAAC,CAAC;IACL,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED,6EAA6E;AAE7E,SAAS,qBAAqB,CAAC,SAA4B;IACzD,MAAM,GAAG,GAAG,IAAI,GAAG,EAAU,CAAC;IAC9B,KAAK,MAAM,CAAC,IAAI,SAAS,CAAC,kBAAkB,CAAC,MAAM,EAAE,CAAC;QACpD,GAAG,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC;IACvC,CAAC;IACD,KAAK,MAAM,CAAC,IAAI,SAAS,CAAC,kBAAkB,CAAC,IAAI,EAAE,CAAC;QAClD,GAAG,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC;IACvC,CAAC;IACD,KAAK,MAAM,CAAC,IAAI,SAAS,CAAC,kBAAkB,CAAC,MAAM,EAAE,CAAC;QACpD,GAAG,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC;IACvC,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED,SAAS,WAAW,CAAC,IAAY,EAAE,IAAY;IAC7C,OAAO,GAAG,IAAI,KAAK,IAAA,2BAAa,EAAC,IAAI,CAAC,EAAE,CAAC;AAC3C,CAAC"}

package/dist/baseline/producers/tests.d.ts

@@ -22,7 +22,7 @@
  * `AnalysisResult` cache so it doesn't re-gather what the security
  * producer already triggered).
  */
-import type { BaselineEntry } from '../types';
+import type { RichBaselineEntry } from '../types';
 import type { TestGapsReport } from '../../analyzers/tests/types';
 /**
  * Build `test-gap` + `test-file-degradation` entries from a
@@ -32,5 +32,5 @@ import type { TestGapsReport } from '../../analyzers/tests/types';
  * report's iteration order so re-runs against the same scan are
  * byte-stable.
  */
-export declare function testGapsToBaselineEntries(report: TestGapsReport): BaselineEntry[];
+export declare function testGapsToBaselineEntries(report: TestGapsReport): RichBaselineEntry[];
 //# sourceMappingURL=tests.d.ts.map

package/dist/baseline/producers/tests.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"tests.d.ts","sourceRoot":"","sources":["../../../src/baseline/producers/tests.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AAGH,OAAO,KAAK,EACV,aAAa,EAGd,MAAM,UAAU,CAAC;AAClB,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,6BAA6B,CAAC;AAElE;;;;;;;GAOG;AACH,wBAAgB,yBAAyB,CAAC,MAAM,EAAE,cAAc,GAAG,aAAa,EAAE,CAgCjF"}
+{"version":3,"file":"tests.d.ts","sourceRoot":"","sources":["../../../src/baseline/producers/tests.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AAGH,OAAO,KAAK,EACV,iBAAiB,EAGlB,MAAM,UAAU,CAAC;AAClB,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,6BAA6B,CAAC;AAElE;;;;;;;GAOG;AACH,wBAAgB,yBAAyB,CAAC,MAAM,EAAE,cAAc,GAAG,iBAAiB,EAAE,CAgCrF"}

package/dist/baseline/producers/tests.js.map

@@ -1 +1 @@
-{"version":3,"file":"tests.js","sourceRoot":"","sources":["../../../src/baseline/producers/tests.ts"],"names":[],"mappings":";AAAA;;;;;;;;;;;;;;;;;;;;;;;GAuBG;;AAkBH,8DAgCC;AAhDD,0DAAkD;AAQlD;;;;;;;GAOG;AACH,SAAgB,yBAAyB,CAAC,MAAsB;IAC9D,MAAM,GAAG,GAAoB,EAAE,CAAC;IAEhC,KAAK,MAAM,GAAG,IAAI,MAAM,CAAC,IAAI,EAAE,CAAC;QAC9B,iEAAiE;QACjE,kEAAkE;QAClE,aAAa;QACb,IAAI,GAAG,CAAC,eAAe;YAAE,SAAS;QAClC,MAAM,KAAK,GAAyB;YAClC,IAAI,EAAE,UAAU;YAChB,IAAI,EAAE,GAAG,CAAC,IAAI;YACd,IAAI,EAAE,GAAG,CAAC,IAAI;SACf,CAAC;QACF,GAAG,CAAC,IAAI,CAAC,EAAE,EAAE,EAAE,IAAA,8BAAW,EAAC,KAAK,CAAC,EAAE,IAAI,EAAE,UAAU,EAAE,IAAI,EAAE,GAAG,CAAC,IAAI,EAAE,IAAI,EAAE,GAAG,CAAC,IAAI,EAAE,CAAC,CAAC;IACzF,CAAC;IAED,KAAK,MAAM,EAAE,IAAI,MAAM,CAAC,SAAS,EAAE,CAAC;QAClC,IAAI,EAAE,CAAC,MAAM,KAAK,QAAQ;YAAE,SAAS;QACrC,MAAM,KAAK,GAAqC;YAC9C,IAAI,EAAE,uBAAuB;YAC7B,IAAI,EAAE,EAAE,CAAC,IAAI;YACb,MAAM,EAAE,EAAE,CAAC,MAAM;SAClB,CAAC;QACF,GAAG,CAAC,IAAI,CAAC;YACP,EAAE,EAAE,IAAA,8BAAW,EAAC,KAAK,CAAC;YACtB,IAAI,EAAE,uBAAuB;YAC7B,IAAI,EAAE,EAAE,CAAC,IAAI;YACb,MAAM,EAAE,EAAE,CAAC,MAAM;SAClB,CAAC,CAAC;IACL,CAAC;IAED,OAAO,GAAG,CAAC;AACb,CAAC"}
+{"version":3,"file":"tests.js","sourceRoot":"","sources":["../../../src/baseline/producers/tests.ts"],"names":[],"mappings":";AAAA;;;;;;;;;;;;;;;;;;;;;;;GAuBG;;AAkBH,8DAgCC;AAhDD,0DAAkD;AAQlD;;;;;;;GAOG;AACH,SAAgB,yBAAyB,CAAC,MAAsB;IAC9D,MAAM,GAAG,GAAwB,EAAE,CAAC;IAEpC,KAAK,MAAM,GAAG,IAAI,MAAM,CAAC,IAAI,EAAE,CAAC;QAC9B,iEAAiE;QACjE,kEAAkE;QAClE,aAAa;QACb,IAAI,GAAG,CAAC,eAAe;YAAE,SAAS;QAClC,MAAM,KAAK,GAAyB;YAClC,IAAI,EAAE,UAAU;YAChB,IAAI,EAAE,GAAG,CAAC,IAAI;YACd,IAAI,EAAE,GAAG,CAAC,IAAI;SACf,CAAC;QACF,GAAG,CAAC,IAAI,CAAC,EAAE,EAAE,EAAE,IAAA,8BAAW,EAAC,KAAK,CAAC,EAAE,IAAI,EAAE,UAAU,EAAE,IAAI,EAAE,GAAG,CAAC,IAAI,EAAE,IAAI,EAAE,GAAG,CAAC,IAAI,EAAE,CAAC,CAAC;IACzF,CAAC;IAED,KAAK,MAAM,EAAE,IAAI,MAAM,CAAC,SAAS,EAAE,CAAC;QAClC,IAAI,EAAE,CAAC,MAAM,KAAK,QAAQ;YAAE,SAAS;QACrC,MAAM,KAAK,GAAqC;YAC9C,IAAI,EAAE,uBAAuB;YAC7B,IAAI,EAAE,EAAE,CAAC,IAAI;YACb,MAAM,EAAE,EAAE,CAAC,MAAM;SAClB,CAAC;QACF,GAAG,CAAC,IAAI,CAAC;YACP,EAAE,EAAE,IAAA,8BAAW,EAAC,KAAK,CAAC;YACtB,IAAI,EAAE,uBAAuB;YAC7B,IAAI,EAAE,EAAE,CAAC,IAAI;YACb,MAAM,EAAE,EAAE,CAAC,MAAM;SAClB,CAAC,CAAC;IACL,CAAC;IAED,OAAO,GAAG,CAAC;AACb,CAAC"}

package/dist/baseline/ref-baseline.d.ts

@@ -0,0 +1,114 @@
+/**
+ * Ref-based baseline gather — produces a `CurrentScan` for a git
+ * ref by checking it out into a temporary worktree and running the
+ * analyzer pipeline there.
+ *
+ * # When this runs
+ *
+ * `mode === 'ref-based'` (see `./modes.ts`). The guardrail check
+ * needs a "prior side" to diff against; in committed modes the
+ * prior side comes from `.dxkit/baselines/<name>.json`, but in
+ * ref-based mode no file is committed — the prior side is
+ * recomputed on the fly from a git ref (default
+ * `origin/<default-branch>`).
+ *
+ * # Mechanics
+ *
+ * 1. Resolve `ref` to a commit SHA. Failure here surfaces a
+ *    `RefBaselineError` with one of three actionable hints:
+ *      - Shallow clone → `git fetch --unshallow` / CI fetch-depth
+ *      - Ref doesn't exist → `git fetch origin` or fix policy
+ *      - Local-only ref → push it or use a remote-tracking ref
+ * 2. `git worktree add --detach <tempDir> <sha>`. The worktree is a
+ *    full checkout of the source tree at that SHA — but NOT a
+ *    package-manager install, so dep-vuln scanners that read
+ *    `node_modules` directly will see degraded results. The
+ *    dxkit dep scanners use lockfiles (`package-lock.json`,
+ *    `Pipfile.lock`, etc.) which ARE in the worktree, so coverage
+ *    survives the gap.
+ * 3. Run `gatherCurrentScan` against the worktree directory. Same
+ *    pipeline as the live current scan — same producer registry,
+ *    same envelope shape — so the matcher diffs apples-to-apples.
+ * 4. Clean up the worktree on the way out (try/finally).
+ *
+ * # Why a generic `withRefWorktree` helper
+ *
+ * The worktree setup + cleanup pattern is reusable. Future modes-
+ * aware tooling (e.g., a `vyuh-dxkit baseline diff <refA> <refB>`
+ * subcommand) can compose `withRefWorktree` directly instead of
+ * re-deriving the temp-dir + cleanup dance. `gatherFromRef` is a
+ * thin specialization for the guardrail-check use case.
+ *
+ * # Failure semantics
+ *
+ * Recoverable failures (ref unreachable, worktree-add fails) throw
+ * `RefBaselineError` with a `hint` field the CLI renders in plain
+ * prose. Unrecoverable failures (the gather pipeline itself
+ * crashes) propagate up the original Error subclass — they're not
+ * specific to ref-based mode and live with the existing error
+ * handling in the orchestrator.
+ */
+import type { CurrentScan } from './create';
+/**
+ * Recoverable error from the ref-based gather path. Carries an
+ * actionable `hint` the CLI surfaces verbatim so customers don't
+ * have to interpret raw git output. Inherits from `Error` so
+ * existing catch-by-Error code keeps working.
+ */
+export declare class RefBaselineError extends Error {
+    readonly hint: string;
+    constructor(message: string, hint: string);
+}
+export interface RefWorktreeOptions {
+    readonly cwd: string;
+    readonly ref: string;
+}
+/**
+ * Resolve a ref to a commit SHA via `git rev-parse --verify
+ * <ref>^{commit}`. Returns null when the ref isn't reachable (the
+ * caller surfaces the appropriate hint based on shallow-clone /
+ * remote-only state).
+ */
+export declare function resolveRefToSha(cwd: string, ref: string): string | null;
+/**
+ * Whether the current working tree was cloned shallowly. Drives
+ * the hint surfaced when a ref isn't reachable: a CI clone with
+ * `fetch-depth: 1` won't have the baseline ref's history, and the
+ * fix is `fetch-depth: 0`, not pushing the missing ref.
+ */
+export declare function isShallowRepo(cwd: string): boolean;
+/**
+ * Check out `ref` into a temporary worktree, run `fn` with the
+ * worktree path, and tear down the worktree on the way out.
+ *
+ * Always cleans up — even when `fn` throws. The cleanup tolerates
+ * `git worktree remove` failures (e.g., dirty worktree from a
+ * partial gather) by falling back to `rm -rf` on the temp dir.
+ */
+export declare function withRefWorktree<T>(opts: RefWorktreeOptions, fn: (worktreePath: string) => Promise<T>): Promise<T>;
+/**
+ * Copy `.dxkit/salt` from `srcCwd` into `dstCwd` when present.
+ * Public for testing — production callers reach this through
+ * `withRefWorktree`. The directory is created on demand; absent
+ * source files are silently skipped (env-var + deterministic salt
+ * modes both work without the file).
+ */
+export declare function mirrorSaltFile(srcCwd: string, dstCwd: string): void;
+/**
+ * Run `gatherCurrentScan` against a temporary worktree checked out
+ * to `ref`. Returns the same shape as a live gather — the matcher
+ * doesn't care which side was the worktree, only that both sides
+ * are `CurrentScan` envelopes.
+ *
+ * Per-tool degradation note: dep-vuln scanners may report less
+ * coverage in the worktree because `node_modules` (and analogous
+ * install artifacts) are typically gitignored and so don't exist
+ * in the worktree. The lockfile-driven scanners dxkit prefers
+ * survive the gap; `npm audit`-style probes do not.
+ */
+export declare function gatherFromRef(opts: {
+    readonly cwd: string;
+    readonly ref: string;
+    readonly verbose?: boolean;
+}): Promise<CurrentScan>;
+//# sourceMappingURL=ref-baseline.d.ts.map

package/dist/baseline/ref-baseline.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"ref-baseline.d.ts","sourceRoot":"","sources":["../../src/baseline/ref-baseline.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAiDG;AAOH,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,UAAU,CAAC;AAE5C;;;;;GAKG;AACH,qBAAa,gBAAiB,SAAQ,KAAK;IACzC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;gBACV,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM;CAK1C;AAED,MAAM,WAAW,kBAAkB;IACjC,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;IACrB,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;CACtB;AAED;;;;;GAKG;AACH,wBAAgB,eAAe,CAAC,GAAG,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAWvE;AAED;;;;;GAKG;AACH,wBAAgB,aAAa,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAWlD;AAqBD;;;;;;;GAOG;AACH,wBAAsB,eAAe,CAAC,CAAC,EACrC,IAAI,EAAE,kBAAkB,EACxB,EAAE,EAAE,CAAC,YAAY,EAAE,MAAM,KAAK,OAAO,CAAC,CAAC,CAAC,GACvC,OAAO,CAAC,CAAC,CAAC,CAuDZ;AAED;;;;;;GAMG;AACH,wBAAgB,cAAc,CAAC,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,IAAI,CAMnE;AAED;;;;;;;;;;;GAWG;AACH,wBAAsB,aAAa,CAAC,IAAI,EAAE;IACxC,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;IACrB,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;IACrB,QAAQ,CAAC,OAAO,CAAC,EAAE,OAAO,CAAC;CAC5B,GAAG,OAAO,CAAC,WAAW,CAAC,CAIvB"}

package/dist/baseline/ref-baseline.js

@@ -0,0 +1,260 @@
+"use strict";
+/**
+ * Ref-based baseline gather — produces a `CurrentScan` for a git
+ * ref by checking it out into a temporary worktree and running the
+ * analyzer pipeline there.
+ *
+ * # When this runs
+ *
+ * `mode === 'ref-based'` (see `./modes.ts`). The guardrail check
+ * needs a "prior side" to diff against; in committed modes the
+ * prior side comes from `.dxkit/baselines/<name>.json`, but in
+ * ref-based mode no file is committed — the prior side is
+ * recomputed on the fly from a git ref (default
+ * `origin/<default-branch>`).
+ *
+ * # Mechanics
+ *
+ * 1. Resolve `ref` to a commit SHA. Failure here surfaces a
+ *    `RefBaselineError` with one of three actionable hints:
+ *      - Shallow clone → `git fetch --unshallow` / CI fetch-depth
+ *      - Ref doesn't exist → `git fetch origin` or fix policy
+ *      - Local-only ref → push it or use a remote-tracking ref
+ * 2. `git worktree add --detach <tempDir> <sha>`. The worktree is a
+ *    full checkout of the source tree at that SHA — but NOT a
+ *    package-manager install, so dep-vuln scanners that read
+ *    `node_modules` directly will see degraded results. The
+ *    dxkit dep scanners use lockfiles (`package-lock.json`,
+ *    `Pipfile.lock`, etc.) which ARE in the worktree, so coverage
+ *    survives the gap.
+ * 3. Run `gatherCurrentScan` against the worktree directory. Same
+ *    pipeline as the live current scan — same producer registry,
+ *    same envelope shape — so the matcher diffs apples-to-apples.
+ * 4. Clean up the worktree on the way out (try/finally).
+ *
+ * # Why a generic `withRefWorktree` helper
+ *
+ * The worktree setup + cleanup pattern is reusable. Future modes-
+ * aware tooling (e.g., a `vyuh-dxkit baseline diff <refA> <refB>`
+ * subcommand) can compose `withRefWorktree` directly instead of
+ * re-deriving the temp-dir + cleanup dance. `gatherFromRef` is a
+ * thin specialization for the guardrail-check use case.
+ *
+ * # Failure semantics
+ *
+ * Recoverable failures (ref unreachable, worktree-add fails) throw
+ * `RefBaselineError` with a `hint` field the CLI renders in plain
+ * prose. Unrecoverable failures (the gather pipeline itself
+ * crashes) propagate up the original Error subclass — they're not
+ * specific to ref-based mode and live with the existing error
+ * handling in the orchestrator.
+ */
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.RefBaselineError = void 0;
+exports.resolveRefToSha = resolveRefToSha;
+exports.isShallowRepo = isShallowRepo;
+exports.withRefWorktree = withRefWorktree;
+exports.mirrorSaltFile = mirrorSaltFile;
+exports.gatherFromRef = gatherFromRef;
+const child_process_1 = require("child_process");
+const fs_1 = require("fs");
+const os_1 = require("os");
+const path = __importStar(require("path"));
+const create_1 = require("./create");
+/**
+ * Recoverable error from the ref-based gather path. Carries an
+ * actionable `hint` the CLI surfaces verbatim so customers don't
+ * have to interpret raw git output. Inherits from `Error` so
+ * existing catch-by-Error code keeps working.
+ */
+class RefBaselineError extends Error {
+    hint;
+    constructor(message, hint) {
+        super(message);
+        this.name = 'RefBaselineError';
+        this.hint = hint;
+    }
+}
+exports.RefBaselineError = RefBaselineError;
+/**
+ * Resolve a ref to a commit SHA via `git rev-parse --verify
+ * <ref>^{commit}`. Returns null when the ref isn't reachable (the
+ * caller surfaces the appropriate hint based on shallow-clone /
+ * remote-only state).
+ */
+function resolveRefToSha(cwd, ref) {
+    try {
+        const out = (0, child_process_1.execFileSync)('git', ['rev-parse', '--verify', `${ref}^{commit}`], {
+            cwd,
+            encoding: 'utf-8',
+            stdio: ['ignore', 'pipe', 'pipe'],
+        }).trim();
+        return out || null;
+    }
+    catch {
+        return null;
+    }
+}
+/**
+ * Whether the current working tree was cloned shallowly. Drives
+ * the hint surfaced when a ref isn't reachable: a CI clone with
+ * `fetch-depth: 1` won't have the baseline ref's history, and the
+ * fix is `fetch-depth: 0`, not pushing the missing ref.
+ */
+function isShallowRepo(cwd) {
+    try {
+        const out = (0, child_process_1.execFileSync)('git', ['rev-parse', '--is-shallow-repository'], {
+            cwd,
+            encoding: 'utf-8',
+            stdio: ['ignore', 'pipe', 'pipe'],
+        }).trim();
+        return out === 'true';
+    }
+    catch {
+        return false;
+    }
+}
+/**
+ * Build the right `RefBaselineError` for an unreachable ref. The
+ * hint is the actionable next step, not a tautology — shallow
+ * clones get fetch-depth advice, otherwise we suggest configuring
+ * a different ref.
+ */
+function unreachableRefError(cwd, ref) {
+    if (isShallowRepo(cwd)) {
+        return new RefBaselineError(`Cannot resolve baseline ref ${ref}: this is a shallow clone.`, 'Run `git fetch --unshallow` locally, or set `fetch-depth: 0` in your CI checkout step.');
+    }
+    return new RefBaselineError(`Cannot resolve baseline ref ${ref}.`, `Run \`git fetch origin\`, push the ref upstream, or set \`baseline.ref\` in .dxkit/policy.json to an existing ref.`);
+}
+/**
+ * Check out `ref` into a temporary worktree, run `fn` with the
+ * worktree path, and tear down the worktree on the way out.
+ *
+ * Always cleans up — even when `fn` throws. The cleanup tolerates
+ * `git worktree remove` failures (e.g., dirty worktree from a
+ * partial gather) by falling back to `rm -rf` on the temp dir.
+ */
+async function withRefWorktree(opts, fn) {
+    const sha = resolveRefToSha(opts.cwd, opts.ref);
+    if (sha === null)
+        throw unreachableRefError(opts.cwd, opts.ref);
+    // mkdtempSync returns an empty dir; git worktree add wants the
+    // target path NOT to exist (or to be empty). Use a fresh subdir
+    // inside the temp parent so git creates it cleanly.
+    const tempBase = (0, fs_1.mkdtempSync)(path.join((0, os_1.tmpdir)(), 'dxkit-ref-'));
+    const worktreePath = path.join(tempBase, 'baseline');
+    let worktreeAdded = false;
+    try {
+        (0, child_process_1.execFileSync)('git', ['worktree', 'add', '--detach', worktreePath, sha], {
+            cwd: opts.cwd,
+            stdio: ['ignore', 'pipe', 'pipe'],
+        });
+        worktreeAdded = true;
+        // Mirror file-mode salt into the worktree so secret-HMAC entries
+        // pair across prior/current sides. Env-var + deterministic modes
+        // resolve identically across cwd + worktree (env inheritance +
+        // shared initial-commit SHA); file mode is the one that drifts
+        // because `.dxkit/salt` is gitignored and so isn't part of the
+        // checkout. The copy is no-op when the file doesn't exist.
+        mirrorSaltFile(opts.cwd, worktreePath);
+        return await fn(worktreePath);
+    }
+    catch (err) {
+        if (err instanceof RefBaselineError)
+            throw err;
+        if (!worktreeAdded) {
+            // The worktree-add itself failed. Surface a clean error
+            // instead of bubbling the raw stderr.
+            throw new RefBaselineError(`Failed to set up baseline worktree at ${opts.ref}.`, `Check that 'git worktree' is available and that ${tempBase} is writable.`);
+        }
+        throw err;
+    }
+    finally {
+        if (worktreeAdded) {
+            try {
+                (0, child_process_1.execFileSync)('git', ['worktree', 'remove', '--force', worktreePath], {
+                    cwd: opts.cwd,
+                    stdio: ['ignore', 'pipe', 'pipe'],
+                });
+            }
+            catch {
+                // git worktree remove can fail if the worktree dir was
+                // already cleaned externally. The rmSync below recovers.
+            }
+        }
+        try {
+            (0, fs_1.rmSync)(tempBase, { recursive: true, force: true });
+        }
+        catch {
+            // Best-effort cleanup of the temp parent. A stale temp dir
+            // is preferable to surfacing a misleading error if the gather
+            // already succeeded.
+        }
+    }
+}
+/**
+ * Copy `.dxkit/salt` from `srcCwd` into `dstCwd` when present.
+ * Public for testing — production callers reach this through
+ * `withRefWorktree`. The directory is created on demand; absent
+ * source files are silently skipped (env-var + deterministic salt
+ * modes both work without the file).
+ */
+function mirrorSaltFile(srcCwd, dstCwd) {
+    const src = path.join(srcCwd, '.dxkit', 'salt');
+    if (!(0, fs_1.existsSync)(src))
+        return;
+    const dstDir = path.join(dstCwd, '.dxkit');
+    (0, fs_1.mkdirSync)(dstDir, { recursive: true });
+    (0, fs_1.copyFileSync)(src, path.join(dstDir, 'salt'));
+}
+/**
+ * Run `gatherCurrentScan` against a temporary worktree checked out
+ * to `ref`. Returns the same shape as a live gather — the matcher
+ * doesn't care which side was the worktree, only that both sides
+ * are `CurrentScan` envelopes.
+ *
+ * Per-tool degradation note: dep-vuln scanners may report less
+ * coverage in the worktree because `node_modules` (and analogous
+ * install artifacts) are typically gitignored and so don't exist
+ * in the worktree. The lockfile-driven scanners dxkit prefers
+ * survive the gap; `npm audit`-style probes do not.
+ */
+async function gatherFromRef(opts) {
+    return withRefWorktree({ cwd: opts.cwd, ref: opts.ref }, async (worktreePath) => {
+        return (0, create_1.gatherCurrentScan)({ cwd: worktreePath, verbose: opts.verbose });
+    });
+}
+//# sourceMappingURL=ref-baseline.js.map

package/dist/baseline/ref-baseline.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"ref-baseline.js","sourceRoot":"","sources":["../../src/baseline/ref-baseline.ts"],"names":[],"mappings":";AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAiDG;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAmCH,0CAWC;AAQD,sCAWC;AA6BD,0CA0DC;AASD,wCAMC;AAcD,sCAQC;AA3LD,iDAA6C;AAC7C,2BAA8E;AAC9E,2BAA4B;AAC5B,2CAA6B;AAC7B,qCAA6C;AAG7C;;;;;GAKG;AACH,MAAa,gBAAiB,SAAQ,KAAK;IAChC,IAAI,CAAS;IACtB,YAAY,OAAe,EAAE,IAAY;QACvC,KAAK,CAAC,OAAO,CAAC,CAAC;QACf,IAAI,CAAC,IAAI,GAAG,kBAAkB,CAAC;QAC/B,IAAI,CAAC,IAAI,GAAG,IAAI,CAAC;IACnB,CAAC;CACF;AAPD,4CAOC;AAOD;;;;;GAKG;AACH,SAAgB,eAAe,CAAC,GAAW,EAAE,GAAW;IACtD,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,IAAA,4BAAY,EAAC,KAAK,EAAE,CAAC,WAAW,EAAE,UAAU,EAAE,GAAG,GAAG,WAAW,CAAC,EAAE;YAC5E,GAAG;YACH,QAAQ,EAAE,OAAO;YACjB,KAAK,EAAE,CAAC,QAAQ,EAAE,MAAM,EAAE,MAAM,CAAC;SAClC,CAAC,CAAC,IAAI,EAAE,CAAC;QACV,OAAO,GAAG,IAAI,IAAI,CAAC;IACrB,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED;;;;;GAKG;AACH,SAAgB,aAAa,CAAC,GAAW;IACvC,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,IAAA,4BAAY,EAAC,KAAK,EAAE,CAAC,WAAW,EAAE,yBAAyB,CAAC,EAAE;YACxE,GAAG;YACH,QAAQ,EAAE,OAAO;YACjB,KAAK,EAAE,CAAC,QAAQ,EAAE,MAAM,EAAE,MAAM,CAAC;SAClC,CAAC,CAAC,IAAI,EAAE,CAAC;QACV,OAAO,GAAG,KAAK,MAAM,CAAC;IACxB,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC;AAED;;;;;GAKG;AACH,SAAS,mBAAmB,CAAC,GAAW,EAAE,GAAW;IACnD,IAAI,aAAa,CAAC,GAAG,CAAC,EAAE,CAAC;QACvB,OAAO,IAAI,gBAAgB,CACzB,+BAA+B,GAAG,4BAA4B,EAC9D,wFAAwF,CACzF,CAAC;IACJ,CAAC;IACD,OAAO,IAAI,gBAAgB,CACzB,+BAA+B,GAAG,GAAG,EACrC,oHAAoH,CACrH,CAAC;AACJ,CAAC;AAED;;;;;;;GAOG;AACI,KAAK,UAAU,eAAe,CACnC,IAAwB,EACxB,EAAwC;IAExC,MAAM,GAAG,GAAG,eAAe,CAAC,IAAI,CAAC,GAAG,EAAE,IAAI,CAAC,GAAG,CAAC,CAAC;IAChD,IAAI,GAAG,KAAK,IAAI;QAAE,MAAM,mBAAmB,CAAC,IAAI,CAAC,GAAG,EAAE,IAAI,CAAC,GAAG,CAAC,CAAC;IAEhE,+DAA+D;IAC/D,gEAAgE;IAChE,oDAAoD;IACpD,MAAM,QAAQ,GAAG,IAAA,gBAAW,EAAC,IAAI,CAAC,IAAI,CAAC,IAAA,WAAM,GAAE,EAAE,YAAY,CAAC,CAAC,CAAC;IAChE,MAAM,YAAY,GAAG,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,UAAU,CAAC,CAAC;IACrD,IAAI,aAAa,GAAG,KAAK,CAAC;IAC1B,IAAI,CAAC;QACH,IAAA,4BAAY,EAAC,KAAK,EAAE,CAAC,UAAU,EAAE,KAAK,EAAE,UAAU,EAAE,YAAY,EAAE,GAAG,CAAC,EAAE;YACtE,GAAG,EAAE,IAAI,CAAC,GAAG;YACb,KAAK,EAAE,CAAC,QAAQ,EAAE,MAAM,EAAE,MAAM,CAAC;SAClC,CAAC,CAAC;QACH,aAAa,GAAG,IAAI,CAAC;QACrB,iEAAiE;QACjE,iEAAiE;QACjE,+DAA+D;QAC/D,+DAA+D;QAC/D,+DAA+D;QAC/D,2DAA2D;QAC3D,cAAc,CAAC,IAAI,CAAC,GAAG,EAAE,YAAY,CAAC,CAAC;QACvC,OAAO,MAAM,EAAE,CAAC,YAAY,CAAC,CAAC;IAChC,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,IAAI,GAAG,YAAY,gBAAgB;YAAE,MAAM,GAAG,CAAC;QAC/C,IAAI,CAAC,aAAa,EAAE,CAAC;YACnB,wDAAwD;YACxD,sCAAsC;YACtC,MAAM,IAAI,gBAAgB,CACxB,yCAAyC,IAAI,CAAC,GAAG,GAAG,EACpD,mDAAmD,QAAQ,eAAe,CAC3E,CAAC;QACJ,CAAC;QACD,MAAM,GAAG,CAAC;IACZ,CAAC;YAAS,CAAC;QACT,IAAI,aAAa,EAAE,CAAC;YAClB,IAAI,CAAC;gBACH,IAAA,4BAAY,EAAC,KAAK,EAAE,CAAC,UAAU,EAAE,QAAQ,EAAE,SAAS,EAAE,YAAY,CAAC,EAAE;oBACnE,GAAG,EAAE,IAAI,CAAC,GAAG;oBACb,KAAK,EAAE,CAAC,QAAQ,EAAE,MAAM,EAAE,MAAM,CAAC;iBAClC,CAAC,CAAC;YACL,CAAC;YAAC,MAAM,CAAC;gBACP,uDAAuD;gBACvD,yDAAyD;YAC3D,CAAC;QACH,CAAC;QACD,IAAI,CAAC;YACH,IAAA,WAAM,EAAC,QAAQ,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;QACrD,CAAC;QAAC,MAAM,CAAC;YACP,2DAA2D;YAC3D,8DAA8D;YAC9D,qBAAqB;QACvB,CAAC;IACH,CAAC;AACH,CAAC;AAED;;;;;;GAMG;AACH,SAAgB,cAAc,CAAC,MAAc,EAAE,MAAc;IAC3D,MAAM,GAAG,GAAG,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,QAAQ,EAAE,MAAM,CAAC,CAAC;IAChD,IAAI,CAAC,IAAA,eAAU,EAAC,GAAG,CAAC;QAAE,OAAO;IAC7B,MAAM,MAAM,GAAG,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAC;IAC3C,IAAA,cAAS,EAAC,MAAM,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IACvC,IAAA,iBAAY,EAAC,GAAG,EAAE,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC;AAC/C,CAAC;AAED;;;;;;;;;;;GAWG;AACI,KAAK,UAAU,aAAa,CAAC,IAInC;IACC,OAAO,eAAe,CAAC,EAAE,GAAG,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,EAAE,IAAI,CAAC,GAAG,EAAE,EAAE,KAAK,EAAE,YAAY,EAAE,EAAE;QAC9E,OAAO,IAAA,0BAAiB,EAAC,EAAE,GAAG,EAAE,YAAY,EAAE,OAAO,EAAE,IAAI,CAAC,OAAO,EAAE,CAAC,CAAC;IACzE,CAAC,CAAC,CAAC;AACL,CAAC"}