@vyuhlabs/dxkit 2.5.2 → 2.6.0

package/dist/baseline/types.d.ts

@@ -46,7 +46,13 @@
  *     analyzer.
  *   - `hygiene` — TODO / FIXME / HACK / console-log / any-type
  *     occurrences (per-occurrence identity).
- *   - `license` — package license attributions.
+ *
+ * License attributions are NOT a baseline finding kind. They live in
+ * the per-package BoM artifact (`.dxkit/bom.json`) — the canonical
+ * license inventory carried by `vyuh-dxkit bom`. License findings
+ * are informational, not regression material, and dominated the
+ * baseline (~73% of entries on real customer repos) before being
+ * lifted out.
  */
 /**
  * 16-char lowercase hex fingerprint. Same byte format as the
@@ -79,7 +85,7 @@ export type IdentitySchemeVersion = 'v1';
  * The hash format is SHA-1[0:16] across every kind — callers store
  * identities in one flat set without tracking provenance.
  */
-export type IdentityInput = SecretIdentityInput | CodeIdentityInput | ConfigIdentityInput | DepVulnIdentityInput | DuplicationIdentityInput | CoverageGapIdentityInput | TestGapIdentityInput | HygieneOffenderIdentityInput | LicenseIdentityInput | TestFileDegradationIdentityInput | GodFileIdentityInput | StaleFileIdentityInput | LargeFileIdentityInput | SecretHmacIdentityInput;
+export type IdentityInput = SecretIdentityInput | CodeIdentityInput | ConfigIdentityInput | DepVulnIdentityInput | DuplicationIdentityInput | CoverageGapIdentityInput | TestGapIdentityInput | HygieneOffenderIdentityInput | TestFileDegradationIdentityInput | GodFileIdentityInput | StaleFileIdentityInput | LargeFileIdentityInput | SecretHmacIdentityInput | StaleAllowIdentityInput;
 /** gitleaks + private-key files + similar secret detectors. */
 export interface SecretIdentityInput {
     readonly kind: 'secret';
@@ -190,23 +196,6 @@ export interface HygieneOffenderIdentityInput {
     readonly line: number;
     readonly marker: HygieneMarker;
 }
-/**
- * Package license attribution. Identity includes the license type so
- * a license change on the same `(package, version)` pin registers
- * as a fresh finding — compliance teams want to know if a dependency
- * re-licenses under a different (perhaps more restrictive) license
- * even when no version bump happened.
- */
-export interface LicenseIdentityInput {
-    readonly kind: 'license';
-    readonly package: string;
-    readonly version: string;
-    /** Canonical SPDX identifier (`'MIT'`, `'Apache-2.0'`, `'GPL-3.0'`,
-     *  `'UNKNOWN'`). Producer is the existing license-aggregation
-     *  pipeline; identity is byte-stable as long as the producer
-     *  reports the SPDX id consistently. */
-    readonly licenseType: string;
-}
 /**
  * A test file flagged by the test-gaps analyzer as degraded — present
  * but not actively exercising the system under test. Identity carries
@@ -294,6 +283,32 @@ export interface SecretHmacIdentityInput {
     /** 16-char hex from `computeSecretHmac(secret, repoSalt)`. */
     readonly hmac: string;
 }
+/**
+ * Orphaned inline allowlist annotation — a `dxkit-allow:<category>`
+ * comment in a source file that matches no current finding. The
+ * developer suppressed something that's since been fixed (or the
+ * scanner stopped flagging), and the annotation should be removed.
+ * TypeScript's `@ts-expect-error` proved this pattern: tools that
+ * surface their own stale suppressions as findings force the dev
+ * to clean up, preventing the annotation graveyard.
+ *
+ * Identity is `(file, lineWindow, category)` — same 3-line window
+ * the code-finding fingerprint uses, so formatter / unrelated-edit
+ * line drift doesn't churn identity. Category is part of identity
+ * because a `# dxkit-allow:test-fixture` becoming
+ * `# dxkit-allow:false-positive` (developer reclassified mid-review)
+ * is a semantically different stale-allow.
+ */
+export interface StaleAllowIdentityInput {
+    readonly kind: 'stale-allow';
+    readonly file: string;
+    readonly line: number;
+    /** The category named in the orphaned annotation. Free-form
+     *  string at identity-input level (the canonical
+     *  `AllowlistCategory` union lives in `src/allowlist/categories.ts`
+     *  to avoid a cross-module import here in the baseline types). */
+    readonly category: string;
+}
 /**
  * Per-finding entry stored in a baseline. Carries identity plus the
  * minimum metadata needed for cross-run drift-tolerant matching —
@@ -350,12 +365,6 @@ export type BaselineEntry = {
      *  — populated when the producer can read the file at the
      *  baseline commit. */
     contentHash?: string;
-} | {
-    id: FindingId;
-    kind: 'license';
-    package: string;
-    version: string;
-    licenseType: string;
 } | {
     id: FindingId;
     kind: 'test-file-degradation';
@@ -380,7 +389,45 @@ export type BaselineEntry = {
     tool: string;
     rule: string;
     hmac: string;
-};
+} | {
+    id: FindingId;
+    kind: 'stale-allow';
+    file: string;
+    line: number;
+    category: string;
+} | SanitizedBaselineEntry;
+/**
+ * The full-payload subset of `BaselineEntry` — every variant except
+ * the stripped sanitized shape. Producers emit this shape directly;
+ * sanitization is a write-time transformation, never a producer
+ * concern. Consumers narrowing on `entry.kind` from a `BaselineEntry`
+ * must call `isSanitized` first to reach this shape (or accept the
+ * sanitized variant in the union).
+ */
+export type RichBaselineEntry = Exclude<BaselineEntry, SanitizedBaselineEntry>;
+/**
+ * Stripped per-finding entry — identity + kind only, every other
+ * field dropped. Produced by `sanitizeEntry` for baselines written in
+ * sanitized mode (the public-repo / compliance-conscious posture).
+ *
+ * Sanitization preserves the cross-run matching contract: the
+ * fingerprint `id` is unchanged, the matcher's identity-multiset
+ * pass still works at full confidence. What's lost is the location-
+ * pair pass (no `file` / `line` to compare) and the renderer's
+ * ability to surface human-readable locators (`src/auth/oauth.ts:42`)
+ * — they collapse to `<sanitized>` in `baseline show` output.
+ *
+ * The `sanitized: true` discriminant lets exhaustive switches narrow
+ * to either the rich shape or the stripped shape via the
+ * `isSanitized` guard in `./sanitize.ts`. Adding a new finding kind
+ * doesn't require touching this variant — `kind` is the union of all
+ * non-sanitized kinds, propagated automatically.
+ */
+export interface SanitizedBaselineEntry {
+    readonly id: FindingId;
+    readonly kind: 'secret' | 'code' | 'config' | 'dep-vuln' | 'duplication' | 'coverage-gap' | 'test-gap' | 'hygiene' | 'test-file-degradation' | 'god-file' | 'stale-file' | 'large-file' | 'secret-hmac' | 'stale-allow';
+    readonly sanitized: true;
+}
 /**
  * One pairing decision from the matcher. Carries enough context for
  * the guardrail to render a clear explanation ("this finding was

package/dist/baseline/types.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../src/baseline/types.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAiDG;AAEH;;;;;;;;;;GAUG;AACH,MAAM,MAAM,SAAS,GAAG,MAAM,CAAC;AAE/B;;;;GAIG;AACH,MAAM,MAAM,qBAAqB,GAAG,IAAI,CAAC;AAEzC;;;;;;;;;;;;GAYG;AACH,MAAM,MAAM,aAAa,GACrB,mBAAmB,GACnB,iBAAiB,GACjB,mBAAmB,GACnB,oBAAoB,GACpB,wBAAwB,GACxB,wBAAwB,GACxB,oBAAoB,GACpB,4BAA4B,GAC5B,oBAAoB,GACpB,gCAAgC,GAChC,oBAAoB,GACpB,sBAAsB,GACtB,sBAAsB,GACtB,uBAAuB,CAAC;AAE5B,+DAA+D;AAC/D,MAAM,WAAW,mBAAmB;IAClC,QAAQ,CAAC,IAAI,EAAE,QAAQ,CAAC;IACxB,wEAAwE;IACxE,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB;gDAC4C;IAC5C,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,kCAAkC;IAClC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB;6DACyD;IACzD,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;CACvB;AAED,2EAA2E;AAC3E,MAAM,WAAW,iBAAiB;IAChC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;CACvB;AAED,+DAA+D;AAC/D,MAAM,WAAW,mBAAmB;IAClC,QAAQ,CAAC,IAAI,EAAE,QAAQ,CAAC;IACxB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,iDAAiD;IACjD,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;CACvB;AAED,gFAAgF;AAChF,MAAM,WAAW,oBAAoB;IACnC,QAAQ,CAAC,IAAI,EAAE,UAAU,CAAC;IAC1B,gDAAgD;IAChD,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB;0CACsC;IACtC,QAAQ,CAAC,gBAAgB,EAAE,MAAM,GAAG,SAAS,CAAC;IAC9C,qEAAqE;IACrE,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAC;CACrB;AAED,4CAA4C;AAC5C,MAAM,WAAW,wBAAwB;IACvC,QAAQ,CAAC,IAAI,EAAE,aAAa,CAAC;IAC7B;kEAC8D;IAC9D,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB;;;;gEAI4D;IAC5D,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB;;;8CAG0C;IAC1C,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B,yCAAyC;IACzC,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;CAC7B;AAED;;;;;GAKG;AACH,MAAM,WAAW,wBAAwB;IACvC,QAAQ,CAAC,IAAI,EAAE,cAAc,CAAC;IAC9B,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB;;uBAEmB;IACnB,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC;IACzB;kBACc;IACd,QAAQ,CAAC,SAAS,CAAC,EAAE,SAAS,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;CAChD;AAED;;;;;;;;GAQG;AACH,MAAM,MAAM,WAAW,GAAG,UAAU,GAAG,MAAM,GAAG,QAAQ,GAAG,KAAK,CAAC;AAEjE,MAAM,WAAW,oBAAoB;IACnC,QAAQ,CAAC,IAAI,EAAE,UAAU,CAAC;IAC1B,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,IAAI,EAAE,WAAW,CAAC;CAC5B;AAED;;;;;;;GAOG;AACH,MAAM,MAAM,aAAa,GAAG,MAAM,GAAG,OAAO,GAAG,MAAM,GAAG,aAAa,GAAG,UAAU,CAAC;AAEnF,MAAM,WAAW,4BAA4B;IAC3C,QAAQ,CAAC,IAAI,EAAE,SAAS,CAAC;IACzB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,MAAM,EAAE,aAAa,CAAC;CAChC;AAED;;;;;;GAMG;AACH,MAAM,WAAW,oBAAoB;IACnC,QAAQ,CAAC,IAAI,EAAE,SAAS,CAAC;IACzB,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB;;;4CAGwC;IACxC,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;CAC9B;AAED;;;;;;;GAOG;AACH,MAAM,MAAM,yBAAyB,GAAG,eAAe,GAAG,OAAO,GAAG,aAAa,CAAC;AAElF,MAAM,WAAW,gCAAgC;IAC/C,QAAQ,CAAC,IAAI,EAAE,uBAAuB,CAAC;IACvC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,MAAM,EAAE,yBAAyB,CAAC;CAC5C;AAED;;;;;;;GAOG;AACH,MAAM,WAAW,oBAAoB;IACnC,QAAQ,CAAC,IAAI,EAAE,UAAU,CAAC;IAC1B,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;CACvB;AAED;;;;;;GAMG;AACH,MAAM,WAAW,sBAAsB;IACrC,QAAQ,CAAC,IAAI,EAAE,YAAY,CAAC;IAC5B,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB;;;oDAGgD;IAChD,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;CACzB;AAED;;;;;;;;;;GAUG;AACH,MAAM,WAAW,sBAAsB;IACrC,QAAQ,CAAC,IAAI,EAAE,YAAY,CAAC;IAC5B,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;CACvB;AAED;;;;;;;;;;;;;;;;;;GAkBG;AACH,MAAM,WAAW,uBAAuB;IACtC,QAAQ,CAAC,IAAI,EAAE,aAAa,CAAC;IAC7B,4CAA4C;IAC5C,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB;;0BAEsB;IACtB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,8DAA8D;IAC9D,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;CACvB;AAED;;;;;;GAMG;AACH,MAAM,MAAM,aAAa,GACrB;IACE,EAAE,EAAE,SAAS,CAAC;IACd,IAAI,EAAE,QAAQ,GAAG,MAAM,GAAG,QAAQ,CAAC;IACnC,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,MAAM,CAAC;IACb;;;;;oDAKgD;IAChD,WAAW,CAAC,EAAE,MAAM,CAAC;CACtB,GACD;IACE,EAAE,EAAE,SAAS,CAAC;IACd,IAAI,EAAE,UAAU,CAAC;IACjB,OAAO,EAAE,MAAM,CAAC;IAChB,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B,UAAU,EAAE,MAAM,CAAC;CACpB,GACD;IACE,EAAE,EAAE,SAAS,CAAC;IACd,IAAI,EAAE,aAAa,CAAC;IACpB,KAAK,EAAE,MAAM,CAAC;IACd,KAAK,EAAE,MAAM,CAAC;IACd,KAAK,EAAE,MAAM,CAAC;IACd,UAAU,EAAE,MAAM,CAAC;IACnB,UAAU,EAAE,MAAM,CAAC;CACpB,GACD;IACE,EAAE,EAAE,SAAS,CAAC;IACd,IAAI,EAAE,cAAc,CAAC;IACrB,IAAI,EAAE,MAAM,CAAC;IACb,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,SAAS,CAAC,EAAE,SAAS,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;CACvC,GACD;IAAE,EAAE,EAAE,SAAS,CAAC;IAAC,IAAI,EAAE,UAAU,CAAC;IAAC,IAAI,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,WAAW,CAAA;CAAE,GACpE;IACE,EAAE,EAAE,SAAS,CAAC;IACd,IAAI,EAAE,SAAS,CAAC;IAChB,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,MAAM,CAAC;IACb,MAAM,EAAE,aAAa,CAAC;IACtB;;2BAEuB;IACvB,WAAW,CAAC,EAAE,MAAM,CAAC;CACtB,GACD;IAAE,EAAE,EAAE,SAAS,CAAC;IAAC,IAAI,EAAE,SAAS,CAAC;IAAC,OAAO,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,MAAM,CAAC;IAAC,WAAW,EAAE,MAAM,CAAA;CAAE,GACzF;IACE,EAAE,EAAE,SAAS,CAAC;IACd,IAAI,EAAE,uBAAuB,CAAC;IAC9B,IAAI,EAAE,MAAM,CAAC;IACb,MAAM,EAAE,yBAAyB,CAAC;CACnC,GACD;IAAE,EAAE,EAAE,SAAS,CAAC;IAAC,IAAI,EAAE,UAAU,CAAC;IAAC,IAAI,EAAE,MAAM,CAAA;CAAE,GACjD;IAAE,EAAE,EAAE,SAAS,CAAC;IAAC,IAAI,EAAE,YAAY,CAAC;IAAC,IAAI,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAE,GACnE;IAAE,EAAE,EAAE,SAAS,CAAC;IAAC,IAAI,EAAE,YAAY,CAAC;IAAC,IAAI,EAAE,MAAM,CAAA;CAAE,GACnD;IAAE,EAAE,EAAE,SAAS,CAAC;IAAC,IAAI,EAAE,aAAa,CAAC;IAAC,IAAI,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,CAAA;CAAE,CAAC;AAErF;;;;;;;;;;;;;;;GAeG;AACH,MAAM,MAAM,WAAW,GAAG,WAAW,GAAG,WAAW,GAAG,OAAO,GAAG,SAAS,CAAC;AAE1E,MAAM,WAAW,WAAW;IAC1B;+CAC2C;IAC3C,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,kEAAkE;IAClE,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;CACzB;AAED,MAAM,WAAW,SAAS;IACxB,QAAQ,CAAC,OAAO,CAAC,EAAE,SAAS,CAAC;IAC7B,QAAQ,CAAC,SAAS,CAAC,EAAE,SAAS,CAAC;IAC/B,QAAQ,CAAC,MAAM,EAAE,WAAW,CAAC;IAC7B;gEAC4D;IAC5D,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,OAAO,EAAE,aAAa,CAAC,WAAW,CAAC,CAAC;CAC9C;AAED;;;;GAIG;AACH,MAAM,MAAM,eAAe,GAAG,UAAU,GAAG,MAAM,GAAG,QAAQ,GAAG,KAAK,CAAC;AAErE;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA8BG;AACH,MAAM,MAAM,aAAa,GACrB,WAAW,GACX,WAAW,GACX,OAAO,GACP,SAAS,GACT,OAAO,GACP,gBAAgB,GAChB,eAAe,GACf,cAAc,GACd,mBAAmB,GACnB,WAAW,CAAC;AAEhB;;;;;;;;;;;;;;;;;;GAkBG;AACH,MAAM,WAAW,WAAW;IAC1B,QAAQ,CAAC,KAAK,EAAE,aAAa,CAAC,SAAS,CAAC,CAAC;IACzC,QAAQ,CAAC,SAAS,EAAE,aAAa,CAAC,SAAS,CAAC,CAAC;IAC7C,QAAQ,CAAC,KAAK,EAAE,aAAa,CAAC,SAAS,CAAC,CAAC;IACzC,QAAQ,CAAC,OAAO,EAAE,aAAa,CAAC,SAAS,CAAC,CAAC;IAC3C,QAAQ,CAAC,QAAQ,EAAE,OAAO,CAAC;IAC3B,QAAQ,CAAC,cAAc,CAAC,EAAE,MAAM,CAAC;CAClC"}
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../src/baseline/types.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAuDG;AAEH;;;;;;;;;;GAUG;AACH,MAAM,MAAM,SAAS,GAAG,MAAM,CAAC;AAE/B;;;;GAIG;AACH,MAAM,MAAM,qBAAqB,GAAG,IAAI,CAAC;AAEzC;;;;;;;;;;;;GAYG;AACH,MAAM,MAAM,aAAa,GACrB,mBAAmB,GACnB,iBAAiB,GACjB,mBAAmB,GACnB,oBAAoB,GACpB,wBAAwB,GACxB,wBAAwB,GACxB,oBAAoB,GACpB,4BAA4B,GAC5B,gCAAgC,GAChC,oBAAoB,GACpB,sBAAsB,GACtB,sBAAsB,GACtB,uBAAuB,GACvB,uBAAuB,CAAC;AAE5B,+DAA+D;AAC/D,MAAM,WAAW,mBAAmB;IAClC,QAAQ,CAAC,IAAI,EAAE,QAAQ,CAAC;IACxB,wEAAwE;IACxE,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB;gDAC4C;IAC5C,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,kCAAkC;IAClC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB;6DACyD;IACzD,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;CACvB;AAED,2EAA2E;AAC3E,MAAM,WAAW,iBAAiB;IAChC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;CACvB;AAED,+DAA+D;AAC/D,MAAM,WAAW,mBAAmB;IAClC,QAAQ,CAAC,IAAI,EAAE,QAAQ,CAAC;IACxB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,iDAAiD;IACjD,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;CACvB;AAED,gFAAgF;AAChF,MAAM,WAAW,oBAAoB;IACnC,QAAQ,CAAC,IAAI,EAAE,UAAU,CAAC;IAC1B,gDAAgD;IAChD,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB;0CACsC;IACtC,QAAQ,CAAC,gBAAgB,EAAE,MAAM,GAAG,SAAS,CAAC;IAC9C,qEAAqE;IACrE,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAC;CACrB;AAED,4CAA4C;AAC5C,MAAM,WAAW,wBAAwB;IACvC,QAAQ,CAAC,IAAI,EAAE,aAAa,CAAC;IAC7B;kEAC8D;IAC9D,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB;;;;gEAI4D;IAC5D,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB;;;8CAG0C;IAC1C,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B,yCAAyC;IACzC,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;CAC7B;AAED;;;;;GAKG;AACH,MAAM,WAAW,wBAAwB;IACvC,QAAQ,CAAC,IAAI,EAAE,cAAc,CAAC;IAC9B,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB;;uBAEmB;IACnB,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC;IACzB;kBACc;IACd,QAAQ,CAAC,SAAS,CAAC,EAAE,SAAS,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;CAChD;AAED;;;;;;;;GAQG;AACH,MAAM,MAAM,WAAW,GAAG,UAAU,GAAG,MAAM,GAAG,QAAQ,GAAG,KAAK,CAAC;AAEjE,MAAM,WAAW,oBAAoB;IACnC,QAAQ,CAAC,IAAI,EAAE,UAAU,CAAC;IAC1B,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,IAAI,EAAE,WAAW,CAAC;CAC5B;AAED;;;;;;;GAOG;AACH,MAAM,MAAM,aAAa,GAAG,MAAM,GAAG,OAAO,GAAG,MAAM,GAAG,aAAa,GAAG,UAAU,CAAC;AAEnF,MAAM,WAAW,4BAA4B;IAC3C,QAAQ,CAAC,IAAI,EAAE,SAAS,CAAC;IACzB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,MAAM,EAAE,aAAa,CAAC;CAChC;AAED;;;;;;;GAOG;AACH,MAAM,MAAM,yBAAyB,GAAG,eAAe,GAAG,OAAO,GAAG,aAAa,CAAC;AAElF,MAAM,WAAW,gCAAgC;IAC/C,QAAQ,CAAC,IAAI,EAAE,uBAAuB,CAAC;IACvC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,MAAM,EAAE,yBAAyB,CAAC;CAC5C;AAED;;;;;;;GAOG;AACH,MAAM,WAAW,oBAAoB;IACnC,QAAQ,CAAC,IAAI,EAAE,UAAU,CAAC;IAC1B,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;CACvB;AAED;;;;;;GAMG;AACH,MAAM,WAAW,sBAAsB;IACrC,QAAQ,CAAC,IAAI,EAAE,YAAY,CAAC;IAC5B,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB;;;oDAGgD;IAChD,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;CACzB;AAED;;;;;;;;;;GAUG;AACH,MAAM,WAAW,sBAAsB;IACrC,QAAQ,CAAC,IAAI,EAAE,YAAY,CAAC;IAC5B,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;CACvB;AAED;;;;;;;;;;;;;;;;;;GAkBG;AACH,MAAM,WAAW,uBAAuB;IACtC,QAAQ,CAAC,IAAI,EAAE,aAAa,CAAC;IAC7B,4CAA4C;IAC5C,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB;;0BAEsB;IACtB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,8DAA8D;IAC9D,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;CACvB;AAED;;;;;;;;;;;;;;;GAeG;AACH,MAAM,WAAW,uBAAuB;IACtC,QAAQ,CAAC,IAAI,EAAE,aAAa,CAAC;IAC7B,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB;;;sEAGkE;IAClE,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;CAC3B;AAED;;;;;;GAMG;AACH,MAAM,MAAM,aAAa,GACrB;IACE,EAAE,EAAE,SAAS,CAAC;IACd,IAAI,EAAE,QAAQ,GAAG,MAAM,GAAG,QAAQ,CAAC;IACnC,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,MAAM,CAAC;IACb;;;;;oDAKgD;IAChD,WAAW,CAAC,EAAE,MAAM,CAAC;CACtB,GACD;IACE,EAAE,EAAE,SAAS,CAAC;IACd,IAAI,EAAE,UAAU,CAAC;IACjB,OAAO,EAAE,MAAM,CAAC;IAChB,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B,UAAU,EAAE,MAAM,CAAC;CACpB,GACD;IACE,EAAE,EAAE,SAAS,CAAC;IACd,IAAI,EAAE,aAAa,CAAC;IACpB,KAAK,EAAE,MAAM,CAAC;IACd,KAAK,EAAE,MAAM,CAAC;IACd,KAAK,EAAE,MAAM,CAAC;IACd,UAAU,EAAE,MAAM,CAAC;IACnB,UAAU,EAAE,MAAM,CAAC;CACpB,GACD;IACE,EAAE,EAAE,SAAS,CAAC;IACd,IAAI,EAAE,cAAc,CAAC;IACrB,IAAI,EAAE,MAAM,CAAC;IACb,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,SAAS,CAAC,EAAE,SAAS,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;CACvC,GACD;IAAE,EAAE,EAAE,SAAS,CAAC;IAAC,IAAI,EAAE,UAAU,CAAC;IAAC,IAAI,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,WAAW,CAAA;CAAE,GACpE;IACE,EAAE,EAAE,SAAS,CAAC;IACd,IAAI,EAAE,SAAS,CAAC;IAChB,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,MAAM,CAAC;IACb,MAAM,EAAE,aAAa,CAAC;IACtB;;2BAEuB;IACvB,WAAW,CAAC,EAAE,MAAM,CAAC;CACtB,GACD;IACE,EAAE,EAAE,SAAS,CAAC;IACd,IAAI,EAAE,uBAAuB,CAAC;IAC9B,IAAI,EAAE,MAAM,CAAC;IACb,MAAM,EAAE,yBAAyB,CAAC;CACnC,GACD;IAAE,EAAE,EAAE,SAAS,CAAC;IAAC,IAAI,EAAE,UAAU,CAAC;IAAC,IAAI,EAAE,MAAM,CAAA;CAAE,GACjD;IAAE,EAAE,EAAE,SAAS,CAAC;IAAC,IAAI,EAAE,YAAY,CAAC;IAAC,IAAI,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAE,GACnE;IAAE,EAAE,EAAE,SAAS,CAAC;IAAC,IAAI,EAAE,YAAY,CAAC;IAAC,IAAI,EAAE,MAAM,CAAA;CAAE,GACnD;IAAE,EAAE,EAAE,SAAS,CAAC;IAAC,IAAI,EAAE,aAAa,CAAC;IAAC,IAAI,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,CAAA;CAAE,GAChF;IAAE,EAAE,EAAE,SAAS,CAAC;IAAC,IAAI,EAAE,aAAa,CAAC;IAAC,IAAI,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,CAAC;IAAC,QAAQ,EAAE,MAAM,CAAA;CAAE,GACpF,sBAAsB,CAAC;AAE3B;;;;;;;GAOG;AACH,MAAM,MAAM,iBAAiB,GAAG,OAAO,CAAC,aAAa,EAAE,sBAAsB,CAAC,CAAC;AAE/E;;;;;;;;;;;;;;;;;GAiBG;AACH,MAAM,WAAW,sBAAsB;IACrC,QAAQ,CAAC,EAAE,EAAE,SAAS,CAAC;IACvB,QAAQ,CAAC,IAAI,EACT,QAAQ,GACR,MAAM,GACN,QAAQ,GACR,UAAU,GACV,aAAa,GACb,cAAc,GACd,UAAU,GACV,SAAS,GACT,uBAAuB,GACvB,UAAU,GACV,YAAY,GACZ,YAAY,GACZ,aAAa,GACb,aAAa,CAAC;IAClB,QAAQ,CAAC,SAAS,EAAE,IAAI,CAAC;CAC1B;AAED;;;;;;;;;;;;;;;GAeG;AACH,MAAM,MAAM,WAAW,GAAG,WAAW,GAAG,WAAW,GAAG,OAAO,GAAG,SAAS,CAAC;AAE1E,MAAM,WAAW,WAAW;IAC1B;+CAC2C;IAC3C,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,kEAAkE;IAClE,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;CACzB;AAED,MAAM,WAAW,SAAS;IACxB,QAAQ,CAAC,OAAO,CAAC,EAAE,SAAS,CAAC;IAC7B,QAAQ,CAAC,SAAS,CAAC,EAAE,SAAS,CAAC;IAC/B,QAAQ,CAAC,MAAM,EAAE,WAAW,CAAC;IAC7B;gEAC4D;IAC5D,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,OAAO,EAAE,aAAa,CAAC,WAAW,CAAC,CAAC;CAC9C;AAED;;;;GAIG;AACH,MAAM,MAAM,eAAe,GAAG,UAAU,GAAG,MAAM,GAAG,QAAQ,GAAG,KAAK,CAAC;AAErE;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA8BG;AACH,MAAM,MAAM,aAAa,GACrB,WAAW,GACX,WAAW,GACX,OAAO,GACP,SAAS,GACT,OAAO,GACP,gBAAgB,GAChB,eAAe,GACf,cAAc,GACd,mBAAmB,GACnB,WAAW,CAAC;AAEhB;;;;;;;;;;;;;;;;;;GAkBG;AACH,MAAM,WAAW,WAAW;IAC1B,QAAQ,CAAC,KAAK,EAAE,aAAa,CAAC,SAAS,CAAC,CAAC;IACzC,QAAQ,CAAC,SAAS,EAAE,aAAa,CAAC,SAAS,CAAC,CAAC;IAC7C,QAAQ,CAAC,KAAK,EAAE,aAAa,CAAC,SAAS,CAAC,CAAC;IACzC,QAAQ,CAAC,OAAO,EAAE,aAAa,CAAC,SAAS,CAAC,CAAC;IAC3C,QAAQ,CAAC,QAAQ,EAAE,OAAO,CAAC;IAC3B,QAAQ,CAAC,cAAc,CAAC,EAAE,MAAM,CAAC;CAClC"}

package/dist/baseline/types.js

@@ -47,7 +47,13 @@
  *     analyzer.
  *   - `hygiene` — TODO / FIXME / HACK / console-log / any-type
  *     occurrences (per-occurrence identity).
- *   - `license` — package license attributions.
+ *
+ * License attributions are NOT a baseline finding kind. They live in
+ * the per-package BoM artifact (`.dxkit/bom.json`) — the canonical
+ * license inventory carried by `vyuh-dxkit bom`. License findings
+ * are informational, not regression material, and dominated the
+ * baseline (~73% of entries on real customer repos) before being
+ * lifted out.
  */
 Object.defineProperty(exports, "__esModule", { value: true });
 //# sourceMappingURL=types.js.map

package/dist/baseline/types.js.map

@@ -1 +1 @@
-{"version":3,"file":"types.js","sourceRoot":"","sources":["../../src/baseline/types.ts"],"names":[],"mappings":";AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAiDG"}
+{"version":3,"file":"types.js","sourceRoot":"","sources":["../../src/baseline/types.ts"],"names":[],"mappings":";AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAuDG"}

package/dist/baseline/visibility.d.ts

@@ -0,0 +1,61 @@
+/**
+ * Repo visibility detection — probes `gh repo view --json visibility`
+ * to learn whether the current repo is public, private, or internal
+ * (GitHub Enterprise's middle tier).
+ *
+ * # Why this module exists
+ *
+ * Baseline mode resolution (see `./modes.ts`) needs the answer to
+ * "is this a public repo?" to pick the right default posture.
+ * Public repos default to `ref-based` (no committed baseline,
+ * zero disclosure); private repos default to `committed-full`.
+ * Without a reliable visibility probe the picker can't be safe-
+ * by-default.
+ *
+ * # Failure semantics
+ *
+ * Every failure path returns `'unknown'` rather than throwing.
+ * Callers treat unknown the same way they treat private — the
+ * safe default. Concrete failure modes:
+ *
+ *   - `gh` binary missing
+ *   - `gh auth` not configured
+ *   - Repo has no GitHub remote
+ *   - Repo is on a non-GitHub host (GitLab, self-hosted)
+ *   - Network failure / API throttling
+ *   - Repo deleted or made inaccessible to the calling user
+ *
+ * None of these warrant a surprise switch to sanitized mode — a
+ * customer's private repo shouldn't suddenly start writing
+ * stripped baselines because `gh auth` lapsed.
+ *
+ * # Caching
+ *
+ * The probe is slow (~500ms cold). Results are cached per-process
+ * by absolute cwd. Tests clear the cache via `clearVisibilityCache`.
+ */
+/**
+ * The visibility states the picker reads. `'internal'` is GitHub
+ * Enterprise's middle tier (visible to org members; not the public).
+ * The mode picker treats internal the same as private — internal
+ * repos are not safe to expose location data on, but they're not
+ * literally public either.
+ */
+export type RepoVisibility = 'public' | 'private' | 'internal' | 'unknown';
+/**
+ * Detect the visibility of the repo rooted at `cwd`. Returns
+ * `'unknown'` on every failure path — never throws. Cached per
+ * absolute cwd for the lifetime of the process.
+ *
+ * Production callers always use this through `resolveBaselineMode`;
+ * direct invocations should be rare. The single-entry contract keeps
+ * the `gh` probe count predictable + makes mocking trivial in tests.
+ */
+export declare function detectRepoVisibility(cwd: string): RepoVisibility;
+/**
+ * Test seam: clear the per-process visibility cache. Production
+ * callers never use this — the cache lives for the entire CLI
+ * invocation and dies with the process.
+ */
+export declare function clearVisibilityCache(): void;
+//# sourceMappingURL=visibility.d.ts.map

package/dist/baseline/visibility.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"visibility.d.ts","sourceRoot":"","sources":["../../src/baseline/visibility.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAmCG;AAKH;;;;;;GAMG;AACH,MAAM,MAAM,cAAc,GAAG,QAAQ,GAAG,SAAS,GAAG,UAAU,GAAG,SAAS,CAAC;AAI3E;;;;;;;;GAQG;AACH,wBAAgB,oBAAoB,CAAC,GAAG,EAAE,MAAM,GAAG,cAAc,CAOhE;AAmBD;;;;GAIG;AACH,wBAAgB,oBAAoB,IAAI,IAAI,CAE3C"}

package/dist/baseline/visibility.js

@@ -0,0 +1,121 @@
+"use strict";
+/**
+ * Repo visibility detection — probes `gh repo view --json visibility`
+ * to learn whether the current repo is public, private, or internal
+ * (GitHub Enterprise's middle tier).
+ *
+ * # Why this module exists
+ *
+ * Baseline mode resolution (see `./modes.ts`) needs the answer to
+ * "is this a public repo?" to pick the right default posture.
+ * Public repos default to `ref-based` (no committed baseline,
+ * zero disclosure); private repos default to `committed-full`.
+ * Without a reliable visibility probe the picker can't be safe-
+ * by-default.
+ *
+ * # Failure semantics
+ *
+ * Every failure path returns `'unknown'` rather than throwing.
+ * Callers treat unknown the same way they treat private — the
+ * safe default. Concrete failure modes:
+ *
+ *   - `gh` binary missing
+ *   - `gh auth` not configured
+ *   - Repo has no GitHub remote
+ *   - Repo is on a non-GitHub host (GitLab, self-hosted)
+ *   - Network failure / API throttling
+ *   - Repo deleted or made inaccessible to the calling user
+ *
+ * None of these warrant a surprise switch to sanitized mode — a
+ * customer's private repo shouldn't suddenly start writing
+ * stripped baselines because `gh auth` lapsed.
+ *
+ * # Caching
+ *
+ * The probe is slow (~500ms cold). Results are cached per-process
+ * by absolute cwd. Tests clear the cache via `clearVisibilityCache`.
+ */
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.detectRepoVisibility = detectRepoVisibility;
+exports.clearVisibilityCache = clearVisibilityCache;
+const child_process_1 = require("child_process");
+const path = __importStar(require("path"));
+const VISIBILITY_CACHE = new Map();
+/**
+ * Detect the visibility of the repo rooted at `cwd`. Returns
+ * `'unknown'` on every failure path — never throws. Cached per
+ * absolute cwd for the lifetime of the process.
+ *
+ * Production callers always use this through `resolveBaselineMode`;
+ * direct invocations should be rare. The single-entry contract keeps
+ * the `gh` probe count predictable + makes mocking trivial in tests.
+ */
+function detectRepoVisibility(cwd) {
+    const cacheKey = path.resolve(cwd);
+    const cached = VISIBILITY_CACHE.get(cacheKey);
+    if (cached !== undefined)
+        return cached;
+    const resolved = detectRepoVisibilityUncached(cwd);
+    VISIBILITY_CACHE.set(cacheKey, resolved);
+    return resolved;
+}
+function detectRepoVisibilityUncached(cwd) {
+    try {
+        const out = (0, child_process_1.execSync)('gh repo view --json visibility', {
+            cwd,
+            stdio: ['ignore', 'pipe', 'pipe'],
+            encoding: 'utf-8',
+            timeout: 5000,
+        });
+        const parsed = JSON.parse(out);
+        const raw = typeof parsed.visibility === 'string' ? parsed.visibility.toLowerCase() : '';
+        if (raw === 'public' || raw === 'private' || raw === 'internal')
+            return raw;
+        return 'unknown';
+    }
+    catch {
+        return 'unknown';
+    }
+}
+/**
+ * Test seam: clear the per-process visibility cache. Production
+ * callers never use this — the cache lives for the entire CLI
+ * invocation and dies with the process.
+ */
+function clearVisibilityCache() {
+    VISIBILITY_CACHE.clear();
+}
+//# sourceMappingURL=visibility.js.map

package/dist/baseline/visibility.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"visibility.js","sourceRoot":"","sources":["../../src/baseline/visibility.ts"],"names":[],"mappings":";AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAmCG;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAyBH,oDAOC;AAwBD,oDAEC;AAxDD,iDAAyC;AACzC,2CAA6B;AAW7B,MAAM,gBAAgB,GAAG,IAAI,GAAG,EAA0B,CAAC;AAE3D;;;;;;;;GAQG;AACH,SAAgB,oBAAoB,CAAC,GAAW;IAC9C,MAAM,QAAQ,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;IACnC,MAAM,MAAM,GAAG,gBAAgB,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;IAC9C,IAAI,MAAM,KAAK,SAAS;QAAE,OAAO,MAAM,CAAC;IACxC,MAAM,QAAQ,GAAG,4BAA4B,CAAC,GAAG,CAAC,CAAC;IACnD,gBAAgB,CAAC,GAAG,CAAC,QAAQ,EAAE,QAAQ,CAAC,CAAC;IACzC,OAAO,QAAQ,CAAC;AAClB,CAAC;AAED,SAAS,4BAA4B,CAAC,GAAW;IAC/C,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,IAAA,wBAAQ,EAAC,gCAAgC,EAAE;YACrD,GAAG;YACH,KAAK,EAAE,CAAC,QAAQ,EAAE,MAAM,EAAE,MAAM,CAAC;YACjC,QAAQ,EAAE,OAAO;YACjB,OAAO,EAAE,IAAI;SACd,CAAC,CAAC;QACH,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAA6B,CAAC;QAC3D,MAAM,GAAG,GAAG,OAAO,MAAM,CAAC,UAAU,KAAK,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,UAAU,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACzF,IAAI,GAAG,KAAK,QAAQ,IAAI,GAAG,KAAK,SAAS,IAAI,GAAG,KAAK,UAAU;YAAE,OAAO,GAAG,CAAC;QAC5E,OAAO,SAAS,CAAC;IACnB,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,SAAS,CAAC;IACnB,CAAC;AACH,CAAC;AAED;;;;GAIG;AACH,SAAgB,oBAAoB;IAClC,gBAAgB,CAAC,KAAK,EAAE,CAAC;AAC3B,CAAC"}

package/dist/cli.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"cli.d.ts","sourceRoot":"","sources":["../src/cli.ts"],"names":[],"mappings":"AA2LA,wBAAsB,GAAG,CAAC,IAAI,EAAE,MAAM,EAAE,GAAG,OAAO,CAAC,IAAI,CAAC,CAugDvD"}
+{"version":3,"file":"cli.d.ts","sourceRoot":"","sources":["../src/cli.ts"],"names":[],"mappings":"AAiNA,wBAAsB,GAAG,CAAC,IAAI,EAAE,MAAM,EAAE,GAAG,OAAO,CAAC,IAAI,CAAC,CA4kDvD"}

package/dist/cli.js

@@ -123,8 +123,11 @@ function printUsage() {
     vyuh-dxkit tools [path]      Show required analysis tools status
     vyuh-dxkit tools install     Interactively install missing tools
     vyuh-dxkit baseline create [path] [--name <name>] [--force]
+                               [--mode=<mode>] [--ref=<ref>]
                                  Capture per-finding identities to .dxkit/baselines/<name>.json
-                                 (read later by guardrail check to gate new regressions)
+                                 (read later by guardrail check to gate new regressions).
+                                 --mode=committed-full|committed-sanitized|ref-based picks
+                                 the on-disk posture; default auto-selects from repo visibility.
     vyuh-dxkit baseline show [path] [--name <n>] [--baseline <path>]
                              [--kind <kind>] [--json]
                                  Pretty-print the on-disk baseline. Default: summary +
@@ -132,14 +135,33 @@ function printUsage() {
                                  emits a schema-banner-wrapped payload.
     vyuh-dxkit guardrail check [path] [--name <n>] [--baseline <path>]
                                [--changed-only] [--policy <path>]
+                               [--mode=<mode>] [--ref=<ref>]
                                [--json | --markdown]
                                  Diff current scan against the named baseline; block on net-new
                                  regressions per brownfield policy. Exit code 1 when blocked.
+                                 --mode/--ref mirror baseline create (override policy.json).
     vyuh-dxkit hooks activate [path]
                                  Idempotently set core.hooksPath = .githooks. Wired into
                                  package.json postinstall by 'init --with-hooks' so every
                                  clone + 'npm install' activates the dxkit hooks
                                  automatically. Safe to run by hand; always exits 0.
+    vyuh-dxkit allowlist add <file:line> --category=<cat> --reason=<text>
+    vyuh-dxkit allowlist add --fingerprint=<id> --kind=<kind> --category=<cat>
+                             --reason=<text> [--expires=<YYYY-MM-DD>]
+                                 Suppress an individual finding with a typed category
+                                 (false-positive / test-fixture / mitigated-externally /
+                                 accepted-risk / deferred) and required reason. Inline
+                                 form inserts a dxkit-allow: annotation; file-level
+                                 form writes to .dxkit/allowlist.json.
+    vyuh-dxkit allowlist list | show <fingerprint> | audit | prune [--dry-run] [--json]
+                                 Review / audit / clean the allowlist. audit surfaces
+                                 expired + soon-to-expire (within 14 days) + missing-
+                                 rationale entries. prune removes expired entries.
+    vyuh-dxkit issue --type=<type> [--about=<text>] [--fingerprint=<id>] [--no-browser]
+                                 Open a pre-filled GitHub Issue against vyuh-labs/dxkit.
+                                 Types: false-positive, missing-finding, bug,
+                                 feature-request, docs. Nothing is submitted until
+                                 you click "Submit" in your browser.
 
   ${logger.bold('Init options:')}
     --dx-only                 Just .claude/ + CLAUDE.md (default)
@@ -251,6 +273,20 @@ async function run(argv) {
             target: { type: 'string' },
             'dry-run': { type: 'boolean', default: false },
             plan: { type: 'boolean', default: false },
+            // allowlist flags (allowlist add | list | show | audit | prune)
+            category: { type: 'string' },
+            reason: { type: 'string' },
+            fingerprint: { type: 'string' },
+            expires: { type: 'string' },
+            'acknowledged-severity': { type: 'string' },
+            'added-by': { type: 'string' },
+            mode: { type: 'string' },
+            ref: { type: 'string' },
+            'soon-days': { type: 'string' },
+            // issue flags
+            type: { type: 'string' },
+            about: { type: 'string' },
+            'no-browser': { type: 'boolean', default: false },
         },
         allowPositionals: true,
         strict: false,
@@ -1350,19 +1386,36 @@ async function run(argv) {
             if (subCommand === 'create') {
                 const targetPath = resolveRepoPath(positionals[2]);
                 const { createBaseline } = await Promise.resolve().then(() => __importStar(require('./baseline/create')));
+                const { parseBaselineMode } = await Promise.resolve().then(() => __importStar(require('./baseline/modes')));
                 logger.header('vyuh-dxkit baseline create');
                 logger.info(`Capturing baseline for ${targetPath}...`);
                 const startTime = Date.now();
+                const cliModeRaw = values.mode;
+                const cliMode = cliModeRaw !== undefined ? parseBaselineMode(cliModeRaw) : undefined;
+                if (cliModeRaw !== undefined && cliMode === null) {
+                    logger.fail(`Unknown --mode value: ${cliModeRaw}. ` +
+                        `Expected one of: committed-full, committed-sanitized, ref-based.`);
+                    process.exit(1);
+                }
                 try {
                     const result = await createBaseline({
                         cwd: targetPath,
                         name: values.name,
                         force: !!values.force,
                         verbose: !!values.verbose,
+                        cliMode: cliMode ?? undefined,
+                        cliRef: values.ref,
                     });
                     const elapsed = ((Date.now() - startTime) / 1000).toFixed(1);
-                    const rel = path.relative(targetPath, result.path);
-                    logger.success(`Wrote ${rel} — ${result.file.findings.length} findings, salt: ${result.file.saltMode} (${elapsed}s)`);
+                    logger.info(`Baseline ${result.mode.explanation}`);
+                    if (result.mode.mode === 'ref-based') {
+                        logger.success(`Ref-based mode: no file written. Guardrail check will compare against ${result.mode.ref} on demand (${elapsed}s)`);
+                    }
+                    else if (result.path && result.file) {
+                        const rel = path.relative(targetPath, result.path);
+                        const tag = result.mode.mode === 'committed-sanitized' ? ' (sanitized)' : '';
+                        logger.success(`Wrote ${rel}${tag} — ${result.file.findings.length} findings, salt: ${result.file.saltMode} (${elapsed}s)`);
+                    }
                 }
                 catch (err) {
                     logger.fail(err.message);
@@ -1423,6 +1476,14 @@ async function run(argv) {
             const targetPath = resolveRepoPath(positionals[2]);
             const { runGuardrailCheck } = await Promise.resolve().then(() => __importStar(require('./baseline/check')));
             const { renderConsole, renderJson, renderMarkdown } = await Promise.resolve().then(() => __importStar(require('./baseline/check-renderers')));
+            const { parseBaselineMode } = await Promise.resolve().then(() => __importStar(require('./baseline/modes')));
+            const cliModeRaw = values.mode;
+            const cliMode = cliModeRaw !== undefined ? parseBaselineMode(cliModeRaw) : undefined;
+            if (cliModeRaw !== undefined && cliMode === null) {
+                logger.fail(`Unknown --mode value: ${cliModeRaw}. ` +
+                    `Expected one of: committed-full, committed-sanitized, ref-based.`);
+                process.exit(1);
+            }
             if (!values.json)
                 logger.header('vyuh-dxkit guardrail check');
             if (!values.json)
@@ -1436,7 +1497,11 @@ async function run(argv) {
                     changedOnly: !!values['changed-only'],
                     policyPath: values.policy,
                     verbose: !!values.verbose,
+                    cliMode: cliMode ?? undefined,
+                    cliRef: values.ref,
                 });
+                if (!values.json)
+                    logger.info(`Baseline ${result.mode.explanation}`);
                 const elapsed = ((Date.now() - startTime) / 1000).toFixed(1);
                 if (values.json) {
                     await emitJson(renderJson(result));
@@ -1486,6 +1551,26 @@ async function run(argv) {
             });
             break;
         }
+        case 'allowlist': {
+            const { runAllowlist } = await Promise.resolve().then(() => __importStar(require('./allowlist/cli')));
+            // positionals[1] = subcommand (add | list | show)
+            // positionals[2] = optional target (file:line for add, fingerprint for show)
+            await runAllowlist(cwd, positionals[1], {
+                positionalAfter: positionals[2],
+                values: values,
+            });
+            break;
+        }
+        case 'issue': {
+            const { runIssueSubmit } = await Promise.resolve().then(() => __importStar(require('./issue-cli')));
+            await runIssueSubmit(cwd, {
+                type: values.type,
+                fingerprint: values.fingerprint,
+                about: values.about,
+                noBrowser: !!values['no-browser'],
+            });
+            break;
+        }
         default:
             console.error(`Unknown command: ${command}`);
             printUsage();