@vyuhlabs/dxkit 2.5.2 → 2.6.0

package/dist/baseline/producers/tests.js.map

@@ -1 +1 @@
-{"version":3,"file":"tests.js","sourceRoot":"","sources":["../../../src/baseline/producers/tests.ts"],"names":[],"mappings":";AAAA;;;;;;;;;;;;;;;;;;;;;;;GAuBG;;AAkBH,8DAgCC;AAhDD,0DAAkD;AAQlD;;;;;;;GAOG;AACH,SAAgB,yBAAyB,CAAC,MAAsB;IAC9D,MAAM,GAAG,GAAoB,EAAE,CAAC;IAEhC,KAAK,MAAM,GAAG,IAAI,MAAM,CAAC,IAAI,EAAE,CAAC;QAC9B,iEAAiE;QACjE,kEAAkE;QAClE,aAAa;QACb,IAAI,GAAG,CAAC,eAAe;YAAE,SAAS;QAClC,MAAM,KAAK,GAAyB;YAClC,IAAI,EAAE,UAAU;YAChB,IAAI,EAAE,GAAG,CAAC,IAAI;YACd,IAAI,EAAE,GAAG,CAAC,IAAI;SACf,CAAC;QACF,GAAG,CAAC,IAAI,CAAC,EAAE,EAAE,EAAE,IAAA,8BAAW,EAAC,KAAK,CAAC,EAAE,IAAI,EAAE,UAAU,EAAE,IAAI,EAAE,GAAG,CAAC,IAAI,EAAE,IAAI,EAAE,GAAG,CAAC,IAAI,EAAE,CAAC,CAAC;IACzF,CAAC;IAED,KAAK,MAAM,EAAE,IAAI,MAAM,CAAC,SAAS,EAAE,CAAC;QAClC,IAAI,EAAE,CAAC,MAAM,KAAK,QAAQ;YAAE,SAAS;QACrC,MAAM,KAAK,GAAqC;YAC9C,IAAI,EAAE,uBAAuB;YAC7B,IAAI,EAAE,EAAE,CAAC,IAAI;YACb,MAAM,EAAE,EAAE,CAAC,MAAM;SAClB,CAAC;QACF,GAAG,CAAC,IAAI,CAAC;YACP,EAAE,EAAE,IAAA,8BAAW,EAAC,KAAK,CAAC;YACtB,IAAI,EAAE,uBAAuB;YAC7B,IAAI,EAAE,EAAE,CAAC,IAAI;YACb,MAAM,EAAE,EAAE,CAAC,MAAM;SAClB,CAAC,CAAC;IACL,CAAC;IAED,OAAO,GAAG,CAAC;AACb,CAAC"}
+{"version":3,"file":"tests.js","sourceRoot":"","sources":["../../../src/baseline/producers/tests.ts"],"names":[],"mappings":";AAAA;;;;;;;;;;;;;;;;;;;;;;;GAuBG;;AAkBH,8DAgCC;AAhDD,0DAAkD;AAQlD;;;;;;;GAOG;AACH,SAAgB,yBAAyB,CAAC,MAAsB;IAC9D,MAAM,GAAG,GAAwB,EAAE,CAAC;IAEpC,KAAK,MAAM,GAAG,IAAI,MAAM,CAAC,IAAI,EAAE,CAAC;QAC9B,iEAAiE;QACjE,kEAAkE;QAClE,aAAa;QACb,IAAI,GAAG,CAAC,eAAe;YAAE,SAAS;QAClC,MAAM,KAAK,GAAyB;YAClC,IAAI,EAAE,UAAU;YAChB,IAAI,EAAE,GAAG,CAAC,IAAI;YACd,IAAI,EAAE,GAAG,CAAC,IAAI;SACf,CAAC;QACF,GAAG,CAAC,IAAI,CAAC,EAAE,EAAE,EAAE,IAAA,8BAAW,EAAC,KAAK,CAAC,EAAE,IAAI,EAAE,UAAU,EAAE,IAAI,EAAE,GAAG,CAAC,IAAI,EAAE,IAAI,EAAE,GAAG,CAAC,IAAI,EAAE,CAAC,CAAC;IACzF,CAAC;IAED,KAAK,MAAM,EAAE,IAAI,MAAM,CAAC,SAAS,EAAE,CAAC;QAClC,IAAI,EAAE,CAAC,MAAM,KAAK,QAAQ;YAAE,SAAS;QACrC,MAAM,KAAK,GAAqC;YAC9C,IAAI,EAAE,uBAAuB;YAC7B,IAAI,EAAE,EAAE,CAAC,IAAI;YACb,MAAM,EAAE,EAAE,CAAC,MAAM;SAClB,CAAC;QACF,GAAG,CAAC,IAAI,CAAC;YACP,EAAE,EAAE,IAAA,8BAAW,EAAC,KAAK,CAAC;YACtB,IAAI,EAAE,uBAAuB;YAC7B,IAAI,EAAE,EAAE,CAAC,IAAI;YACb,MAAM,EAAE,EAAE,CAAC,MAAM;SAClB,CAAC,CAAC;IACL,CAAC;IAED,OAAO,GAAG,CAAC;AACb,CAAC"}

package/dist/baseline/ref-baseline.d.ts

@@ -0,0 +1,114 @@
+/**
+ * Ref-based baseline gather — produces a `CurrentScan` for a git
+ * ref by checking it out into a temporary worktree and running the
+ * analyzer pipeline there.
+ *
+ * # When this runs
+ *
+ * `mode === 'ref-based'` (see `./modes.ts`). The guardrail check
+ * needs a "prior side" to diff against; in committed modes the
+ * prior side comes from `.dxkit/baselines/<name>.json`, but in
+ * ref-based mode no file is committed — the prior side is
+ * recomputed on the fly from a git ref (default
+ * `origin/<default-branch>`).
+ *
+ * # Mechanics
+ *
+ * 1. Resolve `ref` to a commit SHA. Failure here surfaces a
+ *    `RefBaselineError` with one of three actionable hints:
+ *      - Shallow clone → `git fetch --unshallow` / CI fetch-depth
+ *      - Ref doesn't exist → `git fetch origin` or fix policy
+ *      - Local-only ref → push it or use a remote-tracking ref
+ * 2. `git worktree add --detach <tempDir> <sha>`. The worktree is a
+ *    full checkout of the source tree at that SHA — but NOT a
+ *    package-manager install, so dep-vuln scanners that read
+ *    `node_modules` directly will see degraded results. The
+ *    dxkit dep scanners use lockfiles (`package-lock.json`,
+ *    `Pipfile.lock`, etc.) which ARE in the worktree, so coverage
+ *    survives the gap.
+ * 3. Run `gatherCurrentScan` against the worktree directory. Same
+ *    pipeline as the live current scan — same producer registry,
+ *    same envelope shape — so the matcher diffs apples-to-apples.
+ * 4. Clean up the worktree on the way out (try/finally).
+ *
+ * # Why a generic `withRefWorktree` helper
+ *
+ * The worktree setup + cleanup pattern is reusable. Future modes-
+ * aware tooling (e.g., a `vyuh-dxkit baseline diff <refA> <refB>`
+ * subcommand) can compose `withRefWorktree` directly instead of
+ * re-deriving the temp-dir + cleanup dance. `gatherFromRef` is a
+ * thin specialization for the guardrail-check use case.
+ *
+ * # Failure semantics
+ *
+ * Recoverable failures (ref unreachable, worktree-add fails) throw
+ * `RefBaselineError` with a `hint` field the CLI renders in plain
+ * prose. Unrecoverable failures (the gather pipeline itself
+ * crashes) propagate up the original Error subclass — they're not
+ * specific to ref-based mode and live with the existing error
+ * handling in the orchestrator.
+ */
+import type { CurrentScan } from './create';
+/**
+ * Recoverable error from the ref-based gather path. Carries an
+ * actionable `hint` the CLI surfaces verbatim so customers don't
+ * have to interpret raw git output. Inherits from `Error` so
+ * existing catch-by-Error code keeps working.
+ */
+export declare class RefBaselineError extends Error {
+    readonly hint: string;
+    constructor(message: string, hint: string);
+}
+export interface RefWorktreeOptions {
+    readonly cwd: string;
+    readonly ref: string;
+}
+/**
+ * Resolve a ref to a commit SHA via `git rev-parse --verify
+ * <ref>^{commit}`. Returns null when the ref isn't reachable (the
+ * caller surfaces the appropriate hint based on shallow-clone /
+ * remote-only state).
+ */
+export declare function resolveRefToSha(cwd: string, ref: string): string | null;
+/**
+ * Whether the current working tree was cloned shallowly. Drives
+ * the hint surfaced when a ref isn't reachable: a CI clone with
+ * `fetch-depth: 1` won't have the baseline ref's history, and the
+ * fix is `fetch-depth: 0`, not pushing the missing ref.
+ */
+export declare function isShallowRepo(cwd: string): boolean;
+/**
+ * Check out `ref` into a temporary worktree, run `fn` with the
+ * worktree path, and tear down the worktree on the way out.
+ *
+ * Always cleans up — even when `fn` throws. The cleanup tolerates
+ * `git worktree remove` failures (e.g., dirty worktree from a
+ * partial gather) by falling back to `rm -rf` on the temp dir.
+ */
+export declare function withRefWorktree<T>(opts: RefWorktreeOptions, fn: (worktreePath: string) => Promise<T>): Promise<T>;
+/**
+ * Copy `.dxkit/salt` from `srcCwd` into `dstCwd` when present.
+ * Public for testing — production callers reach this through
+ * `withRefWorktree`. The directory is created on demand; absent
+ * source files are silently skipped (env-var + deterministic salt
+ * modes both work without the file).
+ */
+export declare function mirrorSaltFile(srcCwd: string, dstCwd: string): void;
+/**
+ * Run `gatherCurrentScan` against a temporary worktree checked out
+ * to `ref`. Returns the same shape as a live gather — the matcher
+ * doesn't care which side was the worktree, only that both sides
+ * are `CurrentScan` envelopes.
+ *
+ * Per-tool degradation note: dep-vuln scanners may report less
+ * coverage in the worktree because `node_modules` (and analogous
+ * install artifacts) are typically gitignored and so don't exist
+ * in the worktree. The lockfile-driven scanners dxkit prefers
+ * survive the gap; `npm audit`-style probes do not.
+ */
+export declare function gatherFromRef(opts: {
+    readonly cwd: string;
+    readonly ref: string;
+    readonly verbose?: boolean;
+}): Promise<CurrentScan>;
+//# sourceMappingURL=ref-baseline.d.ts.map

package/dist/baseline/ref-baseline.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"ref-baseline.d.ts","sourceRoot":"","sources":["../../src/baseline/ref-baseline.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAiDG;AAOH,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,UAAU,CAAC;AAE5C;;;;;GAKG;AACH,qBAAa,gBAAiB,SAAQ,KAAK;IACzC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;gBACV,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM;CAK1C;AAED,MAAM,WAAW,kBAAkB;IACjC,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;IACrB,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;CACtB;AAED;;;;;GAKG;AACH,wBAAgB,eAAe,CAAC,GAAG,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAWvE;AAED;;;;;GAKG;AACH,wBAAgB,aAAa,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAWlD;AAqBD;;;;;;;GAOG;AACH,wBAAsB,eAAe,CAAC,CAAC,EACrC,IAAI,EAAE,kBAAkB,EACxB,EAAE,EAAE,CAAC,YAAY,EAAE,MAAM,KAAK,OAAO,CAAC,CAAC,CAAC,GACvC,OAAO,CAAC,CAAC,CAAC,CAuDZ;AAED;;;;;;GAMG;AACH,wBAAgB,cAAc,CAAC,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,IAAI,CAMnE;AAED;;;;;;;;;;;GAWG;AACH,wBAAsB,aAAa,CAAC,IAAI,EAAE;IACxC,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;IACrB,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;IACrB,QAAQ,CAAC,OAAO,CAAC,EAAE,OAAO,CAAC;CAC5B,GAAG,OAAO,CAAC,WAAW,CAAC,CAIvB"}

package/dist/baseline/ref-baseline.js

@@ -0,0 +1,260 @@
+"use strict";
+/**
+ * Ref-based baseline gather — produces a `CurrentScan` for a git
+ * ref by checking it out into a temporary worktree and running the
+ * analyzer pipeline there.
+ *
+ * # When this runs
+ *
+ * `mode === 'ref-based'` (see `./modes.ts`). The guardrail check
+ * needs a "prior side" to diff against; in committed modes the
+ * prior side comes from `.dxkit/baselines/<name>.json`, but in
+ * ref-based mode no file is committed — the prior side is
+ * recomputed on the fly from a git ref (default
+ * `origin/<default-branch>`).
+ *
+ * # Mechanics
+ *
+ * 1. Resolve `ref` to a commit SHA. Failure here surfaces a
+ *    `RefBaselineError` with one of three actionable hints:
+ *      - Shallow clone → `git fetch --unshallow` / CI fetch-depth
+ *      - Ref doesn't exist → `git fetch origin` or fix policy
+ *      - Local-only ref → push it or use a remote-tracking ref
+ * 2. `git worktree add --detach <tempDir> <sha>`. The worktree is a
+ *    full checkout of the source tree at that SHA — but NOT a
+ *    package-manager install, so dep-vuln scanners that read
+ *    `node_modules` directly will see degraded results. The
+ *    dxkit dep scanners use lockfiles (`package-lock.json`,
+ *    `Pipfile.lock`, etc.) which ARE in the worktree, so coverage
+ *    survives the gap.
+ * 3. Run `gatherCurrentScan` against the worktree directory. Same
+ *    pipeline as the live current scan — same producer registry,
+ *    same envelope shape — so the matcher diffs apples-to-apples.
+ * 4. Clean up the worktree on the way out (try/finally).
+ *
+ * # Why a generic `withRefWorktree` helper
+ *
+ * The worktree setup + cleanup pattern is reusable. Future modes-
+ * aware tooling (e.g., a `vyuh-dxkit baseline diff <refA> <refB>`
+ * subcommand) can compose `withRefWorktree` directly instead of
+ * re-deriving the temp-dir + cleanup dance. `gatherFromRef` is a
+ * thin specialization for the guardrail-check use case.
+ *
+ * # Failure semantics
+ *
+ * Recoverable failures (ref unreachable, worktree-add fails) throw
+ * `RefBaselineError` with a `hint` field the CLI renders in plain
+ * prose. Unrecoverable failures (the gather pipeline itself
+ * crashes) propagate up the original Error subclass — they're not
+ * specific to ref-based mode and live with the existing error
+ * handling in the orchestrator.
+ */
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.RefBaselineError = void 0;
+exports.resolveRefToSha = resolveRefToSha;
+exports.isShallowRepo = isShallowRepo;
+exports.withRefWorktree = withRefWorktree;
+exports.mirrorSaltFile = mirrorSaltFile;
+exports.gatherFromRef = gatherFromRef;
+const child_process_1 = require("child_process");
+const fs_1 = require("fs");
+const os_1 = require("os");
+const path = __importStar(require("path"));
+const create_1 = require("./create");
+/**
+ * Recoverable error from the ref-based gather path. Carries an
+ * actionable `hint` the CLI surfaces verbatim so customers don't
+ * have to interpret raw git output. Inherits from `Error` so
+ * existing catch-by-Error code keeps working.
+ */
+class RefBaselineError extends Error {
+    hint;
+    constructor(message, hint) {
+        super(message);
+        this.name = 'RefBaselineError';
+        this.hint = hint;
+    }
+}
+exports.RefBaselineError = RefBaselineError;
+/**
+ * Resolve a ref to a commit SHA via `git rev-parse --verify
+ * <ref>^{commit}`. Returns null when the ref isn't reachable (the
+ * caller surfaces the appropriate hint based on shallow-clone /
+ * remote-only state).
+ */
+function resolveRefToSha(cwd, ref) {
+    try {
+        const out = (0, child_process_1.execFileSync)('git', ['rev-parse', '--verify', `${ref}^{commit}`], {
+            cwd,
+            encoding: 'utf-8',
+            stdio: ['ignore', 'pipe', 'pipe'],
+        }).trim();
+        return out || null;
+    }
+    catch {
+        return null;
+    }
+}
+/**
+ * Whether the current working tree was cloned shallowly. Drives
+ * the hint surfaced when a ref isn't reachable: a CI clone with
+ * `fetch-depth: 1` won't have the baseline ref's history, and the
+ * fix is `fetch-depth: 0`, not pushing the missing ref.
+ */
+function isShallowRepo(cwd) {
+    try {
+        const out = (0, child_process_1.execFileSync)('git', ['rev-parse', '--is-shallow-repository'], {
+            cwd,
+            encoding: 'utf-8',
+            stdio: ['ignore', 'pipe', 'pipe'],
+        }).trim();
+        return out === 'true';
+    }
+    catch {
+        return false;
+    }
+}
+/**
+ * Build the right `RefBaselineError` for an unreachable ref. The
+ * hint is the actionable next step, not a tautology — shallow
+ * clones get fetch-depth advice, otherwise we suggest configuring
+ * a different ref.
+ */
+function unreachableRefError(cwd, ref) {
+    if (isShallowRepo(cwd)) {
+        return new RefBaselineError(`Cannot resolve baseline ref ${ref}: this is a shallow clone.`, 'Run `git fetch --unshallow` locally, or set `fetch-depth: 0` in your CI checkout step.');
+    }
+    return new RefBaselineError(`Cannot resolve baseline ref ${ref}.`, `Run \`git fetch origin\`, push the ref upstream, or set \`baseline.ref\` in .dxkit/policy.json to an existing ref.`);
+}
+/**
+ * Check out `ref` into a temporary worktree, run `fn` with the
+ * worktree path, and tear down the worktree on the way out.
+ *
+ * Always cleans up — even when `fn` throws. The cleanup tolerates
+ * `git worktree remove` failures (e.g., dirty worktree from a
+ * partial gather) by falling back to `rm -rf` on the temp dir.
+ */
+async function withRefWorktree(opts, fn) {
+    const sha = resolveRefToSha(opts.cwd, opts.ref);
+    if (sha === null)
+        throw unreachableRefError(opts.cwd, opts.ref);
+    // mkdtempSync returns an empty dir; git worktree add wants the
+    // target path NOT to exist (or to be empty). Use a fresh subdir
+    // inside the temp parent so git creates it cleanly.
+    const tempBase = (0, fs_1.mkdtempSync)(path.join((0, os_1.tmpdir)(), 'dxkit-ref-'));
+    const worktreePath = path.join(tempBase, 'baseline');
+    let worktreeAdded = false;
+    try {
+        (0, child_process_1.execFileSync)('git', ['worktree', 'add', '--detach', worktreePath, sha], {
+            cwd: opts.cwd,
+            stdio: ['ignore', 'pipe', 'pipe'],
+        });
+        worktreeAdded = true;
+        // Mirror file-mode salt into the worktree so secret-HMAC entries
+        // pair across prior/current sides. Env-var + deterministic modes
+        // resolve identically across cwd + worktree (env inheritance +
+        // shared initial-commit SHA); file mode is the one that drifts
+        // because `.dxkit/salt` is gitignored and so isn't part of the
+        // checkout. The copy is no-op when the file doesn't exist.
+        mirrorSaltFile(opts.cwd, worktreePath);
+        return await fn(worktreePath);
+    }
+    catch (err) {
+        if (err instanceof RefBaselineError)
+            throw err;
+        if (!worktreeAdded) {
+            // The worktree-add itself failed. Surface a clean error
+            // instead of bubbling the raw stderr.
+            throw new RefBaselineError(`Failed to set up baseline worktree at ${opts.ref}.`, `Check that 'git worktree' is available and that ${tempBase} is writable.`);
+        }
+        throw err;
+    }
+    finally {
+        if (worktreeAdded) {
+            try {
+                (0, child_process_1.execFileSync)('git', ['worktree', 'remove', '--force', worktreePath], {
+                    cwd: opts.cwd,
+                    stdio: ['ignore', 'pipe', 'pipe'],
+                });
+            }
+            catch {
+                // git worktree remove can fail if the worktree dir was
+                // already cleaned externally. The rmSync below recovers.
+            }
+        }
+        try {
+            (0, fs_1.rmSync)(tempBase, { recursive: true, force: true });
+        }
+        catch {
+            // Best-effort cleanup of the temp parent. A stale temp dir
+            // is preferable to surfacing a misleading error if the gather
+            // already succeeded.
+        }
+    }
+}
+/**
+ * Copy `.dxkit/salt` from `srcCwd` into `dstCwd` when present.
+ * Public for testing — production callers reach this through
+ * `withRefWorktree`. The directory is created on demand; absent
+ * source files are silently skipped (env-var + deterministic salt
+ * modes both work without the file).
+ */
+function mirrorSaltFile(srcCwd, dstCwd) {
+    const src = path.join(srcCwd, '.dxkit', 'salt');
+    if (!(0, fs_1.existsSync)(src))
+        return;
+    const dstDir = path.join(dstCwd, '.dxkit');
+    (0, fs_1.mkdirSync)(dstDir, { recursive: true });
+    (0, fs_1.copyFileSync)(src, path.join(dstDir, 'salt'));
+}
+/**
+ * Run `gatherCurrentScan` against a temporary worktree checked out
+ * to `ref`. Returns the same shape as a live gather — the matcher
+ * doesn't care which side was the worktree, only that both sides
+ * are `CurrentScan` envelopes.
+ *
+ * Per-tool degradation note: dep-vuln scanners may report less
+ * coverage in the worktree because `node_modules` (and analogous
+ * install artifacts) are typically gitignored and so don't exist
+ * in the worktree. The lockfile-driven scanners dxkit prefers
+ * survive the gap; `npm audit`-style probes do not.
+ */
+async function gatherFromRef(opts) {
+    return withRefWorktree({ cwd: opts.cwd, ref: opts.ref }, async (worktreePath) => {
+        return (0, create_1.gatherCurrentScan)({ cwd: worktreePath, verbose: opts.verbose });
+    });
+}
+//# sourceMappingURL=ref-baseline.js.map

package/dist/baseline/ref-baseline.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"ref-baseline.js","sourceRoot":"","sources":["../../src/baseline/ref-baseline.ts"],"names":[],"mappings":";AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAiDG;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAmCH,0CAWC;AAQD,sCAWC;AA6BD,0CA0DC;AASD,wCAMC;AAcD,sCAQC;AA3LD,iDAA6C;AAC7C,2BAA8E;AAC9E,2BAA4B;AAC5B,2CAA6B;AAC7B,qCAA6C;AAG7C;;;;;GAKG;AACH,MAAa,gBAAiB,SAAQ,KAAK;IAChC,IAAI,CAAS;IACtB,YAAY,OAAe,EAAE,IAAY;QACvC,KAAK,CAAC,OAAO,CAAC,CAAC;QACf,IAAI,CAAC,IAAI,GAAG,kBAAkB,CAAC;QAC/B,IAAI,CAAC,IAAI,GAAG,IAAI,CAAC;IACnB,CAAC;CACF;AAPD,4CAOC;AAOD;;;;;GAKG;AACH,SAAgB,eAAe,CAAC,GAAW,EAAE,GAAW;IACtD,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,IAAA,4BAAY,EAAC,KAAK,EAAE,CAAC,WAAW,EAAE,UAAU,EAAE,GAAG,GAAG,WAAW,CAAC,EAAE;YAC5E,GAAG;YACH,QAAQ,EAAE,OAAO;YACjB,KAAK,EAAE,CAAC,QAAQ,EAAE,MAAM,EAAE,MAAM,CAAC;SAClC,CAAC,CAAC,IAAI,EAAE,CAAC;QACV,OAAO,GAAG,IAAI,IAAI,CAAC;IACrB,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED;;;;;GAKG;AACH,SAAgB,aAAa,CAAC,GAAW;IACvC,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,IAAA,4BAAY,EAAC,KAAK,EAAE,CAAC,WAAW,EAAE,yBAAyB,CAAC,EAAE;YACxE,GAAG;YACH,QAAQ,EAAE,OAAO;YACjB,KAAK,EAAE,CAAC,QAAQ,EAAE,MAAM,EAAE,MAAM,CAAC;SAClC,CAAC,CAAC,IAAI,EAAE,CAAC;QACV,OAAO,GAAG,KAAK,MAAM,CAAC;IACxB,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC;AAED;;;;;GAKG;AACH,SAAS,mBAAmB,CAAC,GAAW,EAAE,GAAW;IACnD,IAAI,aAAa,CAAC,GAAG,CAAC,EAAE,CAAC;QACvB,OAAO,IAAI,gBAAgB,CACzB,+BAA+B,GAAG,4BAA4B,EAC9D,wFAAwF,CACzF,CAAC;IACJ,CAAC;IACD,OAAO,IAAI,gBAAgB,CACzB,+BAA+B,GAAG,GAAG,EACrC,oHAAoH,CACrH,CAAC;AACJ,CAAC;AAED;;;;;;;GAOG;AACI,KAAK,UAAU,eAAe,CACnC,IAAwB,EACxB,EAAwC;IAExC,MAAM,GAAG,GAAG,eAAe,CAAC,IAAI,CAAC,GAAG,EAAE,IAAI,CAAC,GAAG,CAAC,CAAC;IAChD,IAAI,GAAG,KAAK,IAAI;QAAE,MAAM,mBAAmB,CAAC,IAAI,CAAC,GAAG,EAAE,IAAI,CAAC,GAAG,CAAC,CAAC;IAEhE,+DAA+D;IAC/D,gEAAgE;IAChE,oDAAoD;IACpD,MAAM,QAAQ,GAAG,IAAA,gBAAW,EAAC,IAAI,CAAC,IAAI,CAAC,IAAA,WAAM,GAAE,EAAE,YAAY,CAAC,CAAC,CAAC;IAChE,MAAM,YAAY,GAAG,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,UAAU,CAAC,CAAC;IACrD,IAAI,aAAa,GAAG,KAAK,CAAC;IAC1B,IAAI,CAAC;QACH,IAAA,4BAAY,EAAC,KAAK,EAAE,CAAC,UAAU,EAAE,KAAK,EAAE,UAAU,EAAE,YAAY,EAAE,GAAG,CAAC,EAAE;YACtE,GAAG,EAAE,IAAI,CAAC,GAAG;YACb,KAAK,EAAE,CAAC,QAAQ,EAAE,MAAM,EAAE,MAAM,CAAC;SAClC,CAAC,CAAC;QACH,aAAa,GAAG,IAAI,CAAC;QACrB,iEAAiE;QACjE,iEAAiE;QACjE,+DAA+D;QAC/D,+DAA+D;QAC/D,+DAA+D;QAC/D,2DAA2D;QAC3D,cAAc,CAAC,IAAI,CAAC,GAAG,EAAE,YAAY,CAAC,CAAC;QACvC,OAAO,MAAM,EAAE,CAAC,YAAY,CAAC,CAAC;IAChC,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,IAAI,GAAG,YAAY,gBAAgB;YAAE,MAAM,GAAG,CAAC;QAC/C,IAAI,CAAC,aAAa,EAAE,CAAC;YACnB,wDAAwD;YACxD,sCAAsC;YACtC,MAAM,IAAI,gBAAgB,CACxB,yCAAyC,IAAI,CAAC,GAAG,GAAG,EACpD,mDAAmD,QAAQ,eAAe,CAC3E,CAAC;QACJ,CAAC;QACD,MAAM,GAAG,CAAC;IACZ,CAAC;YAAS,CAAC;QACT,IAAI,aAAa,EAAE,CAAC;YAClB,IAAI,CAAC;gBACH,IAAA,4BAAY,EAAC,KAAK,EAAE,CAAC,UAAU,EAAE,QAAQ,EAAE,SAAS,EAAE,YAAY,CAAC,EAAE;oBACnE,GAAG,EAAE,IAAI,CAAC,GAAG;oBACb,KAAK,EAAE,CAAC,QAAQ,EAAE,MAAM,EAAE,MAAM,CAAC;iBAClC,CAAC,CAAC;YACL,CAAC;YAAC,MAAM,CAAC;gBACP,uDAAuD;gBACvD,yDAAyD;YAC3D,CAAC;QACH,CAAC;QACD,IAAI,CAAC;YACH,IAAA,WAAM,EAAC,QAAQ,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;QACrD,CAAC;QAAC,MAAM,CAAC;YACP,2DAA2D;YAC3D,8DAA8D;YAC9D,qBAAqB;QACvB,CAAC;IACH,CAAC;AACH,CAAC;AAED;;;;;;GAMG;AACH,SAAgB,cAAc,CAAC,MAAc,EAAE,MAAc;IAC3D,MAAM,GAAG,GAAG,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,QAAQ,EAAE,MAAM,CAAC,CAAC;IAChD,IAAI,CAAC,IAAA,eAAU,EAAC,GAAG,CAAC;QAAE,OAAO;IAC7B,MAAM,MAAM,GAAG,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAC;IAC3C,IAAA,cAAS,EAAC,MAAM,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IACvC,IAAA,iBAAY,EAAC,GAAG,EAAE,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC;AAC/C,CAAC;AAED;;;;;;;;;;;GAWG;AACI,KAAK,UAAU,aAAa,CAAC,IAInC;IACC,OAAO,eAAe,CAAC,EAAE,GAAG,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,EAAE,IAAI,CAAC,GAAG,EAAE,EAAE,KAAK,EAAE,YAAY,EAAE,EAAE;QAC9E,OAAO,IAAA,0BAAiB,EAAC,EAAE,GAAG,EAAE,YAAY,EAAE,OAAO,EAAE,IAAI,CAAC,OAAO,EAAE,CAAC,CAAC;IACzE,CAAC,CAAC,CAAC;AACL,CAAC"}

package/dist/baseline/sanitize.d.ts

@@ -0,0 +1,80 @@
+/**
+ * Baseline sanitization — pure transformation that strips every
+ * non-identity field from a `BaselineEntry`, producing a
+ * `SanitizedBaselineEntry` carrying only `id`, `kind`, and the
+ * `sanitized: true` discriminant.
+ *
+ * # Why sanitization exists
+ *
+ * A committed-to-git baseline carries human-readable metadata that
+ * can leak useful intelligence to anyone with read access to the
+ * repo:
+ *
+ *   - `secret` / `code` / `config` findings disclose the exact file
+ *     path + line + rule that flagged them — an attacker reading the
+ *     baseline knows where to grep history for the leaked credential
+ *     or which insecure call site to inspect first.
+ *   - `dep-vuln` findings disclose private package names + installed
+ *     versions + advisory ids — discloses internal repo structure
+ *     and which CVEs the codebase is currently vulnerable to.
+ *   - File paths in any source-anchored kind disclose repo layout
+ *     (module boundaries, internal naming conventions).
+ *
+ * The sanitization pass collapses every entry to identity-only.
+ * What's lost:
+ *   - The matcher's location-pair pass (no `file` / `line` to
+ *     compare across runs); the matcher falls back to identity-
+ *     multiset matching, which still works at full confidence for
+ *     exact-byte-equality matches.
+ *   - The renderer's ability to surface human-readable locators.
+ *     `baseline show` collapses to `<sanitized>` for the locator
+ *     string.
+ *
+ * What's preserved:
+ *   - The 16-char fingerprint `id`. Cross-run matching works.
+ *   - The `kind` discriminant. Severity defaults + classifier
+ *     behavior work.
+ *   - The full envelope metadata (createdAt, commitSha, tools,
+ *     analysis hashes) — none of those carry per-finding sensitive
+ *     content.
+ *
+ * # Public-repo + private-repo posture
+ *
+ * The two modes that consume sanitization (selected in a later
+ * commit alongside the visibility-aware mode picker):
+ *   - `committed-full` — store rich entries; default on private
+ *     repos with small teams.
+ *   - `committed-sanitized` — strip every entry via `sanitizeFile`;
+ *     default on public repos and on private repos with
+ *     compliance-conscious posture.
+ *
+ * Pure module — no I/O. The write path applies the transformation
+ * before serializing; the read path observes the `sanitized: true`
+ * field on each entry and routes consumers accordingly.
+ */
+import type { BaselineEntry, SanitizedBaselineEntry } from './types';
+import type { BaselineFile } from './baseline-file';
+/**
+ * Type guard: distinguishes a stripped entry from a rich one.
+ * Consumers walking a `BaselineEntry` exhaustively call this first
+ * so the rest of their switch narrows to the rich union and stays
+ * type-safe.
+ */
+export declare function isSanitized(entry: BaselineEntry): entry is SanitizedBaselineEntry;
+/**
+ * Strip every non-identity field from a single entry. Already-
+ * sanitized entries pass through unchanged. `kind` is preserved
+ * verbatim; readers can still partition the baseline by kind for
+ * count reporting + per-kind severity defaults.
+ */
+export declare function sanitizeEntry(entry: BaselineEntry): SanitizedBaselineEntry;
+/**
+ * Apply `sanitizeEntry` to every finding in a baseline file. The
+ * envelope (repo, analysis, tools, saltMode, createdAt, etc.)
+ * passes through unchanged — none of those fields carry per-finding
+ * sensitive content. The resulting file is byte-stable across
+ * repeated sanitizations: a sanitized file sanitized again returns
+ * an identity-equal file.
+ */
+export declare function sanitizeFile(file: BaselineFile): BaselineFile;
+//# sourceMappingURL=sanitize.d.ts.map

package/dist/baseline/sanitize.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sanitize.d.ts","sourceRoot":"","sources":["../../src/baseline/sanitize.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAqDG;AAEH,OAAO,KAAK,EAAE,aAAa,EAAE,sBAAsB,EAAE,MAAM,SAAS,CAAC;AACrE,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,iBAAiB,CAAC;AAEpD;;;;;GAKG;AACH,wBAAgB,WAAW,CAAC,KAAK,EAAE,aAAa,GAAG,KAAK,IAAI,sBAAsB,CAEjF;AAED;;;;;GAKG;AACH,wBAAgB,aAAa,CAAC,KAAK,EAAE,aAAa,GAAG,sBAAsB,CAG1E;AAED;;;;;;;GAOG;AACH,wBAAgB,YAAY,CAAC,IAAI,EAAE,YAAY,GAAG,YAAY,CAE7D"}

package/dist/baseline/sanitize.js

@@ -0,0 +1,91 @@
+"use strict";
+/**
+ * Baseline sanitization — pure transformation that strips every
+ * non-identity field from a `BaselineEntry`, producing a
+ * `SanitizedBaselineEntry` carrying only `id`, `kind`, and the
+ * `sanitized: true` discriminant.
+ *
+ * # Why sanitization exists
+ *
+ * A committed-to-git baseline carries human-readable metadata that
+ * can leak useful intelligence to anyone with read access to the
+ * repo:
+ *
+ *   - `secret` / `code` / `config` findings disclose the exact file
+ *     path + line + rule that flagged them — an attacker reading the
+ *     baseline knows where to grep history for the leaked credential
+ *     or which insecure call site to inspect first.
+ *   - `dep-vuln` findings disclose private package names + installed
+ *     versions + advisory ids — discloses internal repo structure
+ *     and which CVEs the codebase is currently vulnerable to.
+ *   - File paths in any source-anchored kind disclose repo layout
+ *     (module boundaries, internal naming conventions).
+ *
+ * The sanitization pass collapses every entry to identity-only.
+ * What's lost:
+ *   - The matcher's location-pair pass (no `file` / `line` to
+ *     compare across runs); the matcher falls back to identity-
+ *     multiset matching, which still works at full confidence for
+ *     exact-byte-equality matches.
+ *   - The renderer's ability to surface human-readable locators.
+ *     `baseline show` collapses to `<sanitized>` for the locator
+ *     string.
+ *
+ * What's preserved:
+ *   - The 16-char fingerprint `id`. Cross-run matching works.
+ *   - The `kind` discriminant. Severity defaults + classifier
+ *     behavior work.
+ *   - The full envelope metadata (createdAt, commitSha, tools,
+ *     analysis hashes) — none of those carry per-finding sensitive
+ *     content.
+ *
+ * # Public-repo + private-repo posture
+ *
+ * The two modes that consume sanitization (selected in a later
+ * commit alongside the visibility-aware mode picker):
+ *   - `committed-full` — store rich entries; default on private
+ *     repos with small teams.
+ *   - `committed-sanitized` — strip every entry via `sanitizeFile`;
+ *     default on public repos and on private repos with
+ *     compliance-conscious posture.
+ *
+ * Pure module — no I/O. The write path applies the transformation
+ * before serializing; the read path observes the `sanitized: true`
+ * field on each entry and routes consumers accordingly.
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.isSanitized = isSanitized;
+exports.sanitizeEntry = sanitizeEntry;
+exports.sanitizeFile = sanitizeFile;
+/**
+ * Type guard: distinguishes a stripped entry from a rich one.
+ * Consumers walking a `BaselineEntry` exhaustively call this first
+ * so the rest of their switch narrows to the rich union and stays
+ * type-safe.
+ */
+function isSanitized(entry) {
+    return entry.sanitized === true;
+}
+/**
+ * Strip every non-identity field from a single entry. Already-
+ * sanitized entries pass through unchanged. `kind` is preserved
+ * verbatim; readers can still partition the baseline by kind for
+ * count reporting + per-kind severity defaults.
+ */
+function sanitizeEntry(entry) {
+    if (isSanitized(entry))
+        return entry;
+    return { id: entry.id, kind: entry.kind, sanitized: true };
+}
+/**
+ * Apply `sanitizeEntry` to every finding in a baseline file. The
+ * envelope (repo, analysis, tools, saltMode, createdAt, etc.)
+ * passes through unchanged — none of those fields carry per-finding
+ * sensitive content. The resulting file is byte-stable across
+ * repeated sanitizations: a sanitized file sanitized again returns
+ * an identity-equal file.
+ */
+function sanitizeFile(file) {
+    return { ...file, findings: file.findings.map(sanitizeEntry) };
+}
+//# sourceMappingURL=sanitize.js.map

package/dist/baseline/sanitize.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sanitize.js","sourceRoot":"","sources":["../../src/baseline/sanitize.ts"],"names":[],"mappings":";AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAqDG;;AAWH,kCAEC;AAQD,sCAGC;AAUD,oCAEC;AA/BD;;;;;GAKG;AACH,SAAgB,WAAW,CAAC,KAAoB;IAC9C,OAAQ,KAAiC,CAAC,SAAS,KAAK,IAAI,CAAC;AAC/D,CAAC;AAED;;;;;GAKG;AACH,SAAgB,aAAa,CAAC,KAAoB;IAChD,IAAI,WAAW,CAAC,KAAK,CAAC;QAAE,OAAO,KAAK,CAAC;IACrC,OAAO,EAAE,EAAE,EAAE,KAAK,CAAC,EAAE,EAAE,IAAI,EAAE,KAAK,CAAC,IAAI,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC;AAC7D,CAAC;AAED;;;;;;;GAOG;AACH,SAAgB,YAAY,CAAC,IAAkB;IAC7C,OAAO,EAAE,GAAG,IAAI,EAAE,QAAQ,EAAE,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,aAAa,CAAC,EAAE,CAAC;AACjE,CAAC"}

package/dist/baseline/show.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"show.d.ts","sourceRoot":"","sources":["../../src/baseline/show.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;GAqBG;AAGH,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,iBAAiB,CAAC;AACpD,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,SAAS,CAAC;AAE7C;;;;;GAKG;AACH,eAAO,MAAM,oBAAoB,EAAG,wBAAiC,CAAC;AAEtE;;;;GAIG;AACH,eAAO,MAAM,YAAY,EAAE,aAAa,CAAC,aAAa,CAAC,MAAM,CAAC,CAe5D,CAAC;AAEH;;mCAEmC;AACnC,wBAAgB,eAAe,CAAC,GAAG,EAAE,MAAM,GAAG,aAAa,CAAC,MAAM,CAAC,GAAG,IAAI,CAIzE;AAED;;;;GAIG;AACH,wBAAgB,aAAa,CAAC,IAAI,EAAE,YAAY,GAAG,MAAM,CA6BxD;AAED;;;;;;;;;GASG;AACH,wBAAgB,UAAU,CAAC,IAAI,EAAE,YAAY,EAAE,IAAI,EAAE,aAAa,CAAC,MAAM,CAAC,GAAG,MAAM,CAkBlF;AAED;;;;;;GAMG;AACH,wBAAgB,UAAU,CACxB,IAAI,EAAE,YAAY,EAClB,OAAO,GAAE;IAAE,QAAQ,CAAC,IAAI,CAAC,EAAE,aAAa,CAAC,MAAM,CAAC,CAAA;CAAO,GACtD;IACD,QAAQ,CAAC,MAAM,EAAE,OAAO,oBAAoB,CAAC;IAC7C,QAAQ,CAAC,MAAM,EAAE;QAAE,QAAQ,CAAC,IAAI,EAAE,aAAa,CAAC,MAAM,CAAC,CAAA;KAAE,GAAG,IAAI,CAAC;IACjE,QAAQ,CAAC,QAAQ,EAAE,YAAY,CAAC;IAChC,QAAQ,CAAC,OAAO,EAAE;QAChB,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;QACvB,QAAQ,CAAC,MAAM,EAAE,QAAQ,CAAC,OAAO,CAAC,MAAM,CAAC,aAAa,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC,CAAC,CAAC,CAAC;KAC3E,CAAC;CACH,CAcA"}
+{"version":3,"file":"show.d.ts","sourceRoot":"","sources":["../../src/baseline/show.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;GAqBG;AAGH,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,iBAAiB,CAAC;AAEpD,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,SAAS,CAAC;AAE7C;;;;;GAKG;AACH,eAAO,MAAM,oBAAoB,EAAG,wBAAiC,CAAC;AAEtE;;;;GAIG;AACH,eAAO,MAAM,YAAY,EAAE,aAAa,CAAC,aAAa,CAAC,MAAM,CAAC,CAc5D,CAAC;AAEH;;mCAEmC;AACnC,wBAAgB,eAAe,CAAC,GAAG,EAAE,MAAM,GAAG,aAAa,CAAC,MAAM,CAAC,GAAG,IAAI,CAIzE;AAED;;;;GAIG;AACH,wBAAgB,aAAa,CAAC,IAAI,EAAE,YAAY,GAAG,MAAM,CA6BxD;AAED;;;;;;;;;GASG;AACH,wBAAgB,UAAU,CAAC,IAAI,EAAE,YAAY,EAAE,IAAI,EAAE,aAAa,CAAC,MAAM,CAAC,GAAG,MAAM,CAkBlF;AAED;;;;;;GAMG;AACH,wBAAgB,UAAU,CACxB,IAAI,EAAE,YAAY,EAClB,OAAO,GAAE;IAAE,QAAQ,CAAC,IAAI,CAAC,EAAE,aAAa,CAAC,MAAM,CAAC,CAAA;CAAO,GACtD;IACD,QAAQ,CAAC,MAAM,EAAE,OAAO,oBAAoB,CAAC;IAC7C,QAAQ,CAAC,MAAM,EAAE;QAAE,QAAQ,CAAC,IAAI,EAAE,aAAa,CAAC,MAAM,CAAC,CAAA;KAAE,GAAG,IAAI,CAAC;IACjE,QAAQ,CAAC,QAAQ,EAAE,YAAY,CAAC;IAChC,QAAQ,CAAC,OAAO,EAAE;QAChB,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;QACvB,QAAQ,CAAC,MAAM,EAAE,QAAQ,CAAC,OAAO,CAAC,MAAM,CAAC,aAAa,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC,CAAC,CAAC,CAAC;KAC3E,CAAC;CACH,CAcA"}

package/dist/baseline/show.js

@@ -61,6 +61,7 @@ exports.renderSummary = renderSummary;
 exports.renderKind = renderKind;
 exports.renderJson = renderJson;
 const logger = __importStar(require("../logger"));
+const sanitize_1 = require("./sanitize");
 /**
  * JSON schema banner for the `baseline show --json` envelope.
  * Distinct from the raw `schemaVersion: 'dxkit-baseline/v1'` field
@@ -82,7 +83,6 @@ exports.FILTER_KINDS = Object.freeze([
     'coverage-gap',
     'test-gap',
     'hygiene',
-    'license',
     'test-file-degradation',
     'god-file',
     'stale-file',
@@ -193,8 +193,14 @@ function countByKind(entries) {
  * Kind-specific fields drive the format so a reader sees the
  * meaningful axis (file:line for source-anchored kinds,
  * package@version+advisory for dep-vulns, etc.).
+ *
+ * Sanitized entries carry only identity + kind; renderer surfaces
+ * `<sanitized>` so the user knows location detail was stripped at
+ * write time. The fingerprint prefix still anchors the row.
  */
 function describeEntry(entry) {
+    if ((0, sanitize_1.isSanitized)(entry))
+        return '<sanitized>';
     switch (entry.kind) {
         case 'secret':
         case 'code':
@@ -212,8 +218,6 @@ function describeEntry(entry) {
                 : `${entry.file}:${entry.lineRange?.[0] ?? '?'}-${entry.lineRange?.[1] ?? '?'}`;
         case 'test-gap':
             return `${entry.file}  [risk: ${entry.risk}]`;
-        case 'license':
-            return `${entry.package}@${entry.version}  [${entry.licenseType}]`;
         case 'test-file-degradation':
             return `${entry.file}  [${entry.status}]`;
         case 'god-file':
@@ -223,6 +227,8 @@ function describeEntry(entry) {
             return `${entry.file}  [.${entry.suffix}]`;
         case 'secret-hmac':
             return `[${entry.tool}/${entry.rule}]  hmac:${entry.hmac.slice(0, 12)}`;
+        case 'stale-allow':
+            return `${entry.file}:${entry.line}  [stale dxkit-allow:${entry.category}]`;
     }
 }
 function shortSha(sha) {

package/dist/baseline/show.js.map

@@ -1 +1 @@
-{"version":3,"file":"show.js","sourceRoot":"","sources":["../../src/baseline/show.ts"],"names":[],"mappings":";AAAA;;;;;;;;;;;;;;;;;;;;;GAqBG;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAuCH,0CAIC;AAOD,sCA6BC;AAYD,gCAkBC;AASD,gCAyBC;AA7ID,kDAAoC;AAIpC;;;;;GAKG;AACU,QAAA,oBAAoB,GAAG,wBAAiC,CAAC;AAEtE;;;;GAIG;AACU,QAAA,YAAY,GAAyC,MAAM,CAAC,MAAM,CAAC;IAC9E,QAAQ;IACR,MAAM;IACN,QAAQ;IACR,UAAU;IACV,aAAa;IACb,cAAc;IACd,UAAU;IACV,SAAS;IACT,SAAS;IACT,uBAAuB;IACvB,UAAU;IACV,YAAY;IACZ,YAAY;IACZ,aAAa;CACd,CAAC,CAAC;AAEH;;mCAEmC;AACnC,SAAgB,eAAe,CAAC,GAAW;IACzC,OAAQ,oBAAsC,CAAC,QAAQ,CAAC,GAAG,CAAC;QAC1D,CAAC,CAAE,GAA6B;QAChC,CAAC,CAAC,IAAI,CAAC;AACX,CAAC;AAED;;;;GAIG;AACH,SAAgB,aAAa,CAAC,IAAkB;IAC9C,MAAM,KAAK,GAAa,EAAE,CAAC;IAC3B,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,aAAa,IAAI,CAAC,IAAI,GAAG,CAAC,CAAC,CAAC;IACnD,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IACf,KAAK,CAAC,IAAI,CAAC,kBAAkB,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,KAAK,IAAI,CAAC,IAAI,CAAC,MAAM,IAAI,UAAU,GAAG,CAAC,CAAC;IAClG,KAAK,CAAC,IAAI,CAAC,kBAAkB,IAAI,CAAC,SAAS,EAAE,CAAC,CAAC;IAC/C,KAAK,CAAC,IAAI,CAAC,kBAAkB,IAAI,CAAC,aAAa,EAAE,CAAC,CAAC;IACnD,KAAK,CAAC,IAAI,CAAC,kBAAkB,IAAI,CAAC,QAAQ,CAAC,YAAY,EAAE,CAAC,CAAC;IAC3D,KAAK,CAAC,IAAI,CAAC,kBAAkB,IAAI,CAAC,QAAQ,EAAE,CAAC,CAAC;IAC9C,MAAM,SAAS,GAAG,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,IAAI,EAAE,CAAC;IACjD,IAAI,SAAS,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACzB,KAAK,CAAC,IAAI,CAAC,kBAAkB,SAAS,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,GAAG,CAAC,IAAI,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IAC3F,CAAC;IACD,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IAEf,MAAM,MAAM,GAAG,WAAW,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;IAC1C,MAAM,KAAK,GAAG,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC;IACnC,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,aAAa,KAAK,QAAQ,CAAC,CAAC,CAAC;IACpD,IAAI,KAAK,GAAG,CAAC,EAAE,CAAC;QACd,MAAM,OAAO,GAAG,MAAM,CAAC,OAAO,CAAC,MAAM,CAA2C,CAAC;QACjF,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;QACpC,MAAM,UAAU,GAAG,IAAI,CAAC,GAAG,CAAC,GAAG,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC;QAC/D,KAAK,MAAM,CAAC,IAAI,EAAE,KAAK,CAAC,IAAI,OAAO,EAAE,CAAC;YACpC,KAAK,CAAC,IAAI,CAAC,KAAK,IAAI,CAAC,MAAM,CAAC,UAAU,CAAC,MAAM,KAAK,CAAC,QAAQ,EAAE,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;QAC/E,CAAC;QACD,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;QACf,KAAK,CAAC,IAAI,CAAC,8DAA8D,CAAC,CAAC;IAC7E,CAAC;IACD,OAAO,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AAC1B,CAAC;AAED;;;;;;;;;GASG;AACH,SAAgB,UAAU,CAAC,IAAkB,EAAE,IAA2B;IACxE,MAAM,KAAK,GAAa,EAAE,CAAC;IAC3B,MAAM,QAAQ,GAAG,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,IAAI,CAAC,CAAC;IAC9D,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,aAAa,IAAI,CAAC,IAAI,aAAa,IAAI,EAAE,CAAC,CAAC,CAAC;IACnE,KAAK,CAAC,IAAI,CAAC,kBAAkB,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,CAAC,CAAC;IAC9D,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IACf,IAAI,QAAQ,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC1B,KAAK,CAAC,IAAI,CAAC,0BAA0B,IAAI,IAAI,CAAC,CAAC;QAC/C,OAAO,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAC1B,CAAC;IACD,KAAK,CAAC,IAAI,CACR,MAAM,CAAC,IAAI,CAAC,GAAG,QAAQ,CAAC,MAAM,IAAI,IAAI,IAAI,QAAQ,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,SAAS,EAAE,CAAC,CACzF,CAAC;IACF,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IACf,KAAK,MAAM,KAAK,IAAI,QAAQ,EAAE,CAAC;QAC7B,KAAK,CAAC,IAAI,CAAC,KAAK,KAAK,CAAC,EAAE,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,KAAK,aAAa,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;IACpE,CAAC;IACD,OAAO,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AAC1B,CAAC;AAED;;;;;;GAMG;AACH,SAAgB,UAAU,CACxB,IAAkB,EAClB,UAAqD,EAAE;IAUvD,MAAM,QAAQ,GAAG,OAAO,CAAC,IAAI;QAC3B,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,OAAO,CAAC,IAAI,CAAC;QACtD,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC;IAClB,MAAM,IAAI,GAAiB,EAAE,GAAG,IAAI,EAAE,QAAQ,EAAE,CAAC;IACjD,OAAO;QACL,MAAM,EAAE,4BAAoB;QAC5B,MAAM,EAAE,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,OAAO,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,IAAI;QACpD,QAAQ,EAAE,IAAI;QACd,OAAO,EAAE;YACP,KAAK,EAAE,QAAQ,CAAC,MAAM;YACtB,MAAM,EAAE,WAAW,CAAC,QAAQ,CAAC;SAC9B;KACF,CAAC;AACJ,CAAC;AAED;yDACyD;AACzD,SAAS,WAAW,CAClB,OAAqC;IAErC,MAAM,GAAG,GAAmD,EAAE,CAAC;IAC/D,KAAK,MAAM,CAAC,IAAI,OAAO;QAAE,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC;IAC9D,OAAO,GAAG,CAAC;AACb,CAAC;AAED;;;;;GAKG;AACH,SAAS,aAAa,CAAC,KAAoB;IACzC,QAAQ,KAAK,CAAC,IAAI,EAAE,CAAC;QACnB,KAAK,QAAQ,CAAC;QACd,KAAK,MAAM,CAAC;QACZ,KAAK,QAAQ;YACX,OAAO,GAAG,KAAK,CAAC,IAAI,IAAI,KAAK,CAAC,IAAI,MAAM,KAAK,CAAC,IAAI,IAAI,KAAK,CAAC,IAAI,GAAG,CAAC;QACtE,KAAK,SAAS;YACZ,OAAO,GAAG,KAAK,CAAC,IAAI,IAAI,KAAK,CAAC,IAAI,MAAM,KAAK,CAAC,MAAM,GAAG,CAAC;QAC1D,KAAK,UAAU;YACb,OAAO,GAAG,KAAK,CAAC,OAAO,IAAI,KAAK,CAAC,gBAAgB,IAAI,GAAG,MAAM,KAAK,CAAC,UAAU,GAAG,CAAC;QACpF,KAAK,aAAa;YAChB,OAAO,GAAG,KAAK,CAAC,KAAK,IAAI,KAAK,CAAC,UAAU,QAAQ,KAAK,CAAC,KAAK,IAAI,KAAK,CAAC,UAAU,MAAM,KAAK,CAAC,KAAK,SAAS,CAAC;QAC7G,KAAK,cAAc;YACjB,OAAO,KAAK,CAAC,MAAM;gBACjB,CAAC,CAAC,GAAG,KAAK,CAAC,IAAI,IAAI,KAAK,CAAC,MAAM,EAAE;gBACjC,CAAC,CAAC,GAAG,KAAK,CAAC,IAAI,IAAI,KAAK,CAAC,SAAS,EAAE,CAAC,CAAC,CAAC,IAAI,GAAG,IAAI,KAAK,CAAC,SAAS,EAAE,CAAC,CAAC,CAAC,IAAI,GAAG,EAAE,CAAC;QACpF,KAAK,UAAU;YACb,OAAO,GAAG,KAAK,CAAC,IAAI,YAAY,KAAK,CAAC,IAAI,GAAG,CAAC;QAChD,KAAK,SAAS;YACZ,OAAO,GAAG,KAAK,CAAC,OAAO,IAAI,KAAK,CAAC,OAAO,MAAM,KAAK,CAAC,WAAW,GAAG,CAAC;QACrE,KAAK,uBAAuB;YAC1B,OAAO,GAAG,KAAK,CAAC,IAAI,MAAM,KAAK,CAAC,MAAM,GAAG,CAAC;QAC5C,KAAK,UAAU,CAAC;QAChB,KAAK,YAAY;YACf,OAAO,KAAK,CAAC,IAAI,CAAC;QACpB,KAAK,YAAY;YACf,OAAO,GAAG,KAAK,CAAC,IAAI,OAAO,KAAK,CAAC,MAAM,GAAG,CAAC;QAC7C,KAAK,aAAa;YAChB,OAAO,IAAI,KAAK,CAAC,IAAI,IAAI,KAAK,CAAC,IAAI,WAAW,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,EAAE,CAAC;IAC5E,CAAC;AACH,CAAC;AAED,SAAS,QAAQ,CAAC,GAAW;IAC3B,IAAI,CAAC,GAAG;QAAE,OAAO,aAAa,CAAC;IAC/B,OAAO,GAAG,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;AACzB,CAAC"}
+{"version":3,"file":"show.js","sourceRoot":"","sources":["../../src/baseline/show.ts"],"names":[],"mappings":";AAAA;;;;;;;;;;;;;;;;;;;;;GAqBG;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAuCH,0CAIC;AAOD,sCA6BC;AAYD,gCAkBC;AASD,gCAyBC;AA7ID,kDAAoC;AAEpC,yCAAyC;AAGzC;;;;;GAKG;AACU,QAAA,oBAAoB,GAAG,wBAAiC,CAAC;AAEtE;;;;GAIG;AACU,QAAA,YAAY,GAAyC,MAAM,CAAC,MAAM,CAAC;IAC9E,QAAQ;IACR,MAAM;IACN,QAAQ;IACR,UAAU;IACV,aAAa;IACb,cAAc;IACd,UAAU;IACV,SAAS;IACT,uBAAuB;IACvB,UAAU;IACV,YAAY;IACZ,YAAY;IACZ,aAAa;CACd,CAAC,CAAC;AAEH;;mCAEmC;AACnC,SAAgB,eAAe,CAAC,GAAW;IACzC,OAAQ,oBAAsC,CAAC,QAAQ,CAAC,GAAG,CAAC;QAC1D,CAAC,CAAE,GAA6B;QAChC,CAAC,CAAC,IAAI,CAAC;AACX,CAAC;AAED;;;;GAIG;AACH,SAAgB,aAAa,CAAC,IAAkB;IAC9C,MAAM,KAAK,GAAa,EAAE,CAAC;IAC3B,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,aAAa,IAAI,CAAC,IAAI,GAAG,CAAC,CAAC,CAAC;IACnD,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IACf,KAAK,CAAC,IAAI,CAAC,kBAAkB,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,KAAK,IAAI,CAAC,IAAI,CAAC,MAAM,IAAI,UAAU,GAAG,CAAC,CAAC;IAClG,KAAK,CAAC,IAAI,CAAC,kBAAkB,IAAI,CAAC,SAAS,EAAE,CAAC,CAAC;IAC/C,KAAK,CAAC,IAAI,CAAC,kBAAkB,IAAI,CAAC,aAAa,EAAE,CAAC,CAAC;IACnD,KAAK,CAAC,IAAI,CAAC,kBAAkB,IAAI,CAAC,QAAQ,CAAC,YAAY,EAAE,CAAC,CAAC;IAC3D,KAAK,CAAC,IAAI,CAAC,kBAAkB,IAAI,CAAC,QAAQ,EAAE,CAAC,CAAC;IAC9C,MAAM,SAAS,GAAG,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,IAAI,EAAE,CAAC;IACjD,IAAI,SAAS,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACzB,KAAK,CAAC,IAAI,CAAC,kBAAkB,SAAS,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,GAAG,CAAC,IAAI,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IAC3F,CAAC;IACD,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IAEf,MAAM,MAAM,GAAG,WAAW,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;IAC1C,MAAM,KAAK,GAAG,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC;IACnC,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,aAAa,KAAK,QAAQ,CAAC,CAAC,CAAC;IACpD,IAAI,KAAK,GAAG,CAAC,EAAE,CAAC;QACd,MAAM,OAAO,GAAG,MAAM,CAAC,OAAO,CAAC,MAAM,CAA2C,CAAC;QACjF,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;QACpC,MAAM,UAAU,GAAG,IAAI,CAAC,GAAG,CAAC,GAAG,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC;QAC/D,KAAK,MAAM,CAAC,IAAI,EAAE,KAAK,CAAC,IAAI,OAAO,EAAE,CAAC;YACpC,KAAK,CAAC,IAAI,CAAC,KAAK,IAAI,CAAC,MAAM,CAAC,UAAU,CAAC,MAAM,KAAK,CAAC,QAAQ,EAAE,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;QAC/E,CAAC;QACD,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;QACf,KAAK,CAAC,IAAI,CAAC,8DAA8D,CAAC,CAAC;IAC7E,CAAC;IACD,OAAO,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AAC1B,CAAC;AAED;;;;;;;;;GASG;AACH,SAAgB,UAAU,CAAC,IAAkB,EAAE,IAA2B;IACxE,MAAM,KAAK,GAAa,EAAE,CAAC;IAC3B,MAAM,QAAQ,GAAG,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,IAAI,CAAC,CAAC;IAC9D,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,aAAa,IAAI,CAAC,IAAI,aAAa,IAAI,EAAE,CAAC,CAAC,CAAC;IACnE,KAAK,CAAC,IAAI,CAAC,kBAAkB,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,CAAC,CAAC;IAC9D,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IACf,IAAI,QAAQ,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC1B,KAAK,CAAC,IAAI,CAAC,0BAA0B,IAAI,IAAI,CAAC,CAAC;QAC/C,OAAO,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAC1B,CAAC;IACD,KAAK,CAAC,IAAI,CACR,MAAM,CAAC,IAAI,CAAC,GAAG,QAAQ,CAAC,MAAM,IAAI,IAAI,IAAI,QAAQ,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,SAAS,EAAE,CAAC,CACzF,CAAC;IACF,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IACf,KAAK,MAAM,KAAK,IAAI,QAAQ,EAAE,CAAC;QAC7B,KAAK,CAAC,IAAI,CAAC,KAAK,KAAK,CAAC,EAAE,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,KAAK,aAAa,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;IACpE,CAAC;IACD,OAAO,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AAC1B,CAAC;AAED;;;;;;GAMG;AACH,SAAgB,UAAU,CACxB,IAAkB,EAClB,UAAqD,EAAE;IAUvD,MAAM,QAAQ,GAAG,OAAO,CAAC,IAAI;QAC3B,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,OAAO,CAAC,IAAI,CAAC;QACtD,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC;IAClB,MAAM,IAAI,GAAiB,EAAE,GAAG,IAAI,EAAE,QAAQ,EAAE,CAAC;IACjD,OAAO;QACL,MAAM,EAAE,4BAAoB;QAC5B,MAAM,EAAE,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,OAAO,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,IAAI;QACpD,QAAQ,EAAE,IAAI;QACd,OAAO,EAAE;YACP,KAAK,EAAE,QAAQ,CAAC,MAAM;YACtB,MAAM,EAAE,WAAW,CAAC,QAAQ,CAAC;SAC9B;KACF,CAAC;AACJ,CAAC;AAED;yDACyD;AACzD,SAAS,WAAW,CAClB,OAAqC;IAErC,MAAM,GAAG,GAAmD,EAAE,CAAC;IAC/D,KAAK,MAAM,CAAC,IAAI,OAAO;QAAE,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC;IAC9D,OAAO,GAAG,CAAC;AACb,CAAC;AAED;;;;;;;;;GASG;AACH,SAAS,aAAa,CAAC,KAAoB;IACzC,IAAI,IAAA,sBAAW,EAAC,KAAK,CAAC;QAAE,OAAO,aAAa,CAAC;IAC7C,QAAQ,KAAK,CAAC,IAAI,EAAE,CAAC;QACnB,KAAK,QAAQ,CAAC;QACd,KAAK,MAAM,CAAC;QACZ,KAAK,QAAQ;YACX,OAAO,GAAG,KAAK,CAAC,IAAI,IAAI,KAAK,CAAC,IAAI,MAAM,KAAK,CAAC,IAAI,IAAI,KAAK,CAAC,IAAI,GAAG,CAAC;QACtE,KAAK,SAAS;YACZ,OAAO,GAAG,KAAK,CAAC,IAAI,IAAI,KAAK,CAAC,IAAI,MAAM,KAAK,CAAC,MAAM,GAAG,CAAC;QAC1D,KAAK,UAAU;YACb,OAAO,GAAG,KAAK,CAAC,OAAO,IAAI,KAAK,CAAC,gBAAgB,IAAI,GAAG,MAAM,KAAK,CAAC,UAAU,GAAG,CAAC;QACpF,KAAK,aAAa;YAChB,OAAO,GAAG,KAAK,CAAC,KAAK,IAAI,KAAK,CAAC,UAAU,QAAQ,KAAK,CAAC,KAAK,IAAI,KAAK,CAAC,UAAU,MAAM,KAAK,CAAC,KAAK,SAAS,CAAC;QAC7G,KAAK,cAAc;YACjB,OAAO,KAAK,CAAC,MAAM;gBACjB,CAAC,CAAC,GAAG,KAAK,CAAC,IAAI,IAAI,KAAK,CAAC,MAAM,EAAE;gBACjC,CAAC,CAAC,GAAG,KAAK,CAAC,IAAI,IAAI,KAAK,CAAC,SAAS,EAAE,CAAC,CAAC,CAAC,IAAI,GAAG,IAAI,KAAK,CAAC,SAAS,EAAE,CAAC,CAAC,CAAC,IAAI,GAAG,EAAE,CAAC;QACpF,KAAK,UAAU;YACb,OAAO,GAAG,KAAK,CAAC,IAAI,YAAY,KAAK,CAAC,IAAI,GAAG,CAAC;QAChD,KAAK,uBAAuB;YAC1B,OAAO,GAAG,KAAK,CAAC,IAAI,MAAM,KAAK,CAAC,MAAM,GAAG,CAAC;QAC5C,KAAK,UAAU,CAAC;QAChB,KAAK,YAAY;YACf,OAAO,KAAK,CAAC,IAAI,CAAC;QACpB,KAAK,YAAY;YACf,OAAO,GAAG,KAAK,CAAC,IAAI,OAAO,KAAK,CAAC,MAAM,GAAG,CAAC;QAC7C,KAAK,aAAa;YAChB,OAAO,IAAI,KAAK,CAAC,IAAI,IAAI,KAAK,CAAC,IAAI,WAAW,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,EAAE,CAAC;QAC1E,KAAK,aAAa;YAChB,OAAO,GAAG,KAAK,CAAC,IAAI,IAAI,KAAK,CAAC,IAAI,wBAAwB,KAAK,CAAC,QAAQ,GAAG,CAAC;IAChF,CAAC;AACH,CAAC;AAED,SAAS,QAAQ,CAAC,GAAW;IAC3B,IAAI,CAAC,GAAG;QAAE,OAAO,aAAa,CAAC;IAC/B,OAAO,GAAG,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;AACzB,CAAC"}