@vyuhlabs/dxkit 2.5.2 → 2.7.0

package/dist/baseline/entry-to-located.js

@@ -17,7 +17,7 @@
  * apply to hygiene markers; the marker IS the canonical name.
  *
  * Kinds without file/line locators (dep-vuln, duplication,
- * coverage-gap, license, test-gap, test-file-degradation, god-file,
+ * coverage-gap, test-gap, test-file-degradation, god-file,
  * stale-file, large-file, secret-hmac) fall through to the matcher's
  * multiset pass — they're paired by exact identity-hash equality,
  * which the matcher already handles without any locator metadata.
@@ -26,13 +26,21 @@ Object.defineProperty(exports, "__esModule", { value: true });
 exports.entryToLocated = entryToLocated;
 exports.entriesToLocated = entriesToLocated;
 const fingerprint_1 = require("../analyzers/tools/fingerprint");
+const sanitize_1 = require("./sanitize");
 /**
  * Build a `LocatedIdentity` from one stored entry. The id is the
  * already-computed identity hash; locator fields are populated for
  * the kinds the matcher's location-pair / content-hash passes can
  * use.
+ *
+ * Sanitized entries (`sanitized: true`) carry only identity + kind;
+ * they short-circuit to identity-only locators because the
+ * location-pair pass has no fields to compare. The matcher's
+ * multiset pass still pairs them at full confidence by id.
  */
 function entryToLocated(entry) {
+    if ((0, sanitize_1.isSanitized)(entry))
+        return { id: entry.id };
     switch (entry.kind) {
         case 'secret':
         case 'code':
@@ -52,10 +60,20 @@ function entryToLocated(entry) {
                 rule: entry.marker,
                 ...(entry.contentHash !== undefined ? { contentHash: entry.contentHash } : {}),
             };
+        case 'stale-allow':
+            // Annotation comments don't have a tool/rule pair — the
+            // "rule" is the annotation's category. Reuse the field so
+            // the matcher's location-pair pass can treat them like other
+            // source-anchored kinds.
+            return {
+                id: entry.id,
+                file: entry.file,
+                line: entry.line,
+                rule: entry.category,
+            };
         case 'dep-vuln':
         case 'duplication':
         case 'coverage-gap':
-        case 'license':
         case 'test-gap':
         case 'test-file-degradation':
         case 'god-file':

package/dist/baseline/entry-to-located.js.map

@@ -1 +1 @@
-{"version":3,"file":"entry-to-located.js","sourceRoot":"","sources":["../../src/baseline/entry-to-located.ts"],"names":[],"mappings":";AAAA;;;;;;;;;;;;;;;;;;;;;;GAsBG;;AAYH,wCAgCC;AAGD,4CAIC;AAjDD,gEAAkE;AAIlE;;;;;GAKG;AACH,SAAgB,cAAc,CAAC,KAAoB;IACjD,QAAQ,KAAK,CAAC,IAAI,EAAE,CAAC;QACnB,KAAK,QAAQ,CAAC;QACd,KAAK,MAAM,CAAC;QACZ,KAAK,QAAQ;YACX,OAAO;gBACL,EAAE,EAAE,KAAK,CAAC,EAAE;gBACZ,IAAI,EAAE,KAAK,CAAC,IAAI;gBAChB,IAAI,EAAE,KAAK,CAAC,IAAI;gBAChB,IAAI,EAAE,IAAA,8BAAgB,EAAC,KAAK,CAAC,IAAI,EAAE,KAAK,CAAC,IAAI,CAAC;gBAC9C,GAAG,CAAC,KAAK,CAAC,WAAW,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,KAAK,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;aAC/E,CAAC;QACJ,KAAK,SAAS;YACZ,OAAO;gBACL,EAAE,EAAE,KAAK,CAAC,EAAE;gBACZ,IAAI,EAAE,KAAK,CAAC,IAAI;gBAChB,IAAI,EAAE,KAAK,CAAC,IAAI;gBAChB,IAAI,EAAE,KAAK,CAAC,MAAM;gBAClB,GAAG,CAAC,KAAK,CAAC,WAAW,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,KAAK,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;aAC/E,CAAC;QACJ,KAAK,UAAU,CAAC;QAChB,KAAK,aAAa,CAAC;QACnB,KAAK,cAAc,CAAC;QACpB,KAAK,SAAS,CAAC;QACf,KAAK,UAAU,CAAC;QAChB,KAAK,uBAAuB,CAAC;QAC7B,KAAK,UAAU,CAAC;QAChB,KAAK,YAAY,CAAC;QAClB,KAAK,YAAY,CAAC;QAClB,KAAK,aAAa;YAChB,OAAO,EAAE,EAAE,EAAE,KAAK,CAAC,EAAE,EAAE,CAAC;IAC5B,CAAC;AACH,CAAC;AAED,qEAAqE;AACrE,SAAgB,gBAAgB,CAC9B,OAAqC;IAErC,OAAO,OAAO,CAAC,GAAG,CAAC,cAAc,CAAC,CAAC;AACrC,CAAC"}
+{"version":3,"file":"entry-to-located.js","sourceRoot":"","sources":["../../src/baseline/entry-to-located.ts"],"names":[],"mappings":";AAAA;;;;;;;;;;;;;;;;;;;;;;GAsBG;;AAkBH,wCA2CC;AAGD,4CAIC;AAlED,gEAAkE;AAElE,yCAAyC;AAGzC;;;;;;;;;;GAUG;AACH,SAAgB,cAAc,CAAC,KAAoB;IACjD,IAAI,IAAA,sBAAW,EAAC,KAAK,CAAC;QAAE,OAAO,EAAE,EAAE,EAAE,KAAK,CAAC,EAAE,EAAE,CAAC;IAChD,QAAQ,KAAK,CAAC,IAAI,EAAE,CAAC;QACnB,KAAK,QAAQ,CAAC;QACd,KAAK,MAAM,CAAC;QACZ,KAAK,QAAQ;YACX,OAAO;gBACL,EAAE,EAAE,KAAK,CAAC,EAAE;gBACZ,IAAI,EAAE,KAAK,CAAC,IAAI;gBAChB,IAAI,EAAE,KAAK,CAAC,IAAI;gBAChB,IAAI,EAAE,IAAA,8BAAgB,EAAC,KAAK,CAAC,IAAI,EAAE,KAAK,CAAC,IAAI,CAAC;gBAC9C,GAAG,CAAC,KAAK,CAAC,WAAW,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,KAAK,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;aAC/E,CAAC;QACJ,KAAK,SAAS;YACZ,OAAO;gBACL,EAAE,EAAE,KAAK,CAAC,EAAE;gBACZ,IAAI,EAAE,KAAK,CAAC,IAAI;gBAChB,IAAI,EAAE,KAAK,CAAC,IAAI;gBAChB,IAAI,EAAE,KAAK,CAAC,MAAM;gBAClB,GAAG,CAAC,KAAK,CAAC,WAAW,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,KAAK,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;aAC/E,CAAC;QACJ,KAAK,aAAa;YAChB,wDAAwD;YACxD,0DAA0D;YAC1D,6DAA6D;YAC7D,yBAAyB;YACzB,OAAO;gBACL,EAAE,EAAE,KAAK,CAAC,EAAE;gBACZ,IAAI,EAAE,KAAK,CAAC,IAAI;gBAChB,IAAI,EAAE,KAAK,CAAC,IAAI;gBAChB,IAAI,EAAE,KAAK,CAAC,QAAQ;aACrB,CAAC;QACJ,KAAK,UAAU,CAAC;QAChB,KAAK,aAAa,CAAC;QACnB,KAAK,cAAc,CAAC;QACpB,KAAK,UAAU,CAAC;QAChB,KAAK,uBAAuB,CAAC;QAC7B,KAAK,UAAU,CAAC;QAChB,KAAK,YAAY,CAAC;QAClB,KAAK,YAAY,CAAC;QAClB,KAAK,aAAa;YAChB,OAAO,EAAE,EAAE,EAAE,KAAK,CAAC,EAAE,EAAE,CAAC;IAC5B,CAAC;AACH,CAAC;AAED,qEAAqE;AACrE,SAAgB,gBAAgB,CAC9B,OAAqC;IAErC,OAAO,OAAO,CAAC,GAAG,CAAC,cAAc,CAAC,CAAC;AACrC,CAAC"}

package/dist/baseline/finding-identity.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"finding-identity.d.ts","sourceRoot":"","sources":["../../src/baseline/finding-identity.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAcH,OAAO,KAAK,EACV,SAAS,EAET,aAAa,EACb,qBAAqB,EAGrB,WAAW,EAGZ,MAAM,SAAS,CAAC;AAEjB;;;;;;;;;;;GAWG;AACH,wBAAgB,WAAW,CACzB,KAAK,EAAE,aAAa,EACpB,OAAO,GAAE,qBAA4B,GACpC,SAAS,CA4CX;AA4KD;;;;;;;;;;;;;;;;;;GAkBG;AACH,wBAAgB,eAAe,CAC7B,KAAK,EAAE,QAAQ,CAAC,SAAS,CAAC,EAC1B,OAAO,EAAE,QAAQ,CAAC,SAAS,CAAC,GAC3B,WAAW,CAyDb"}
+{"version":3,"file":"finding-identity.d.ts","sourceRoot":"","sources":["../../src/baseline/finding-identity.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAcH,OAAO,KAAK,EACV,SAAS,EAET,aAAa,EACb,qBAAqB,EAGrB,WAAW,EAGZ,MAAM,SAAS,CAAC;AAEjB;;;;;;;;;;;GAWG;AACH,wBAAgB,WAAW,CACzB,KAAK,EAAE,aAAa,EACpB,OAAO,GAAE,qBAA4B,GACpC,SAAS,CA4CX;AA0KD;;;;;;;;;;;;;;;;;;GAkBG;AACH,wBAAgB,eAAe,CAC7B,KAAK,EAAE,QAAQ,CAAC,SAAS,CAAC,EAC1B,OAAO,EAAE,QAAQ,CAAC,SAAS,CAAC,GAC3B,WAAW,CAyDb"}

package/dist/baseline/finding-identity.js

@@ -53,8 +53,6 @@ function identityFor(input, version = 'v1') {
             return computeTestGapIdentity(input.file, input.risk);
         case 'hygiene':
             return computeHygieneIdentity(input.file, input.line, input.marker);
-        case 'license':
-            return computeLicenseIdentity(input.package, input.version, input.licenseType);
         case 'test-file-degradation':
             return computeTestFileDegradationIdentity(input.file, input.status);
         case 'god-file':
@@ -65,6 +63,8 @@ function identityFor(input, version = 'v1') {
             return computeLargeFileIdentity(input.file);
         case 'secret-hmac':
             return computeSecretHmacIdentity(input.tool, input.rule, input.hmac);
+        case 'stale-allow':
+            return computeStaleAllowIdentity(input.file, input.line, input.category);
     }
 }
 /**
@@ -138,17 +138,6 @@ function computeHygieneIdentity(file, line, marker) {
     const input = `hygiene\0v1\0${marker}\0${file}\0${(0, fingerprint_1.lineWindowFor)(line)}`;
     return (0, crypto_1.createHash)('sha1').update(input).digest('hex').slice(0, 16);
 }
-/**
- * Identity for a package license attribution. Includes the license
- * type so a re-licensing event on the same `(package, version)` pin
- * registers as a fresh finding — compliance teams want to be
- * notified when a transitive dep switches from MIT to GPL even
- * without a version bump.
- */
-function computeLicenseIdentity(packageName, version, licenseType) {
-    const input = `license\0v1\0${packageName}\0${version}\0${licenseType}`;
-    return (0, crypto_1.createHash)('sha1').update(input).digest('hex').slice(0, 16);
-}
 /**
  * Identity for a degraded test file. Degradation status is part of
  * identity so transitions between states register as fresh findings
@@ -208,6 +197,19 @@ function computeSecretHmacIdentity(tool, rule, hmac) {
     const input = `secret-hmac\0v1\0${canonicalRule}\0${hmac}`;
     return (0, crypto_1.createHash)('sha1').update(input).digest('hex').slice(0, 16);
 }
+/**
+ * Identity for an orphaned inline allowlist annotation. Line is
+ * bucketed via the canonical 3-line window so small formatter /
+ * unrelated-edit drift doesn't churn identity. Category is part of
+ * identity so reclassifying an annotation (test-fixture →
+ * false-positive on the same source line) registers as a fresh
+ * finding — the new category's appropriateness is a separate
+ * judgment worth surfacing.
+ */
+function computeStaleAllowIdentity(file, line, category) {
+    const input = `stale-allow\0v1\0${file}\0${(0, fingerprint_1.lineWindowFor)(line)}\0${category}`;
+    return (0, crypto_1.createHash)('sha1').update(input).digest('hex').slice(0, 16);
+}
 /**
  * Multiset-aware identity diff — the lowest layer of baseline
  * comparison. Pairs identities by occurrence count, not by presence:

package/dist/baseline/finding-identity.js.map

@@ -1 +1 @@
-{"version":3,"file":"finding-identity.js","sourceRoot":"","sources":["../../src/baseline/finding-identity.ts"],"names":[],"mappings":";AAAA;;;;;;;;;;;GAWG;;AAsCH,kCA+CC;AA+LD,0CA4DC;AA9UD,mCAAoC;AACpC,gEAKwC;AAkBxC;;;;;;;;;;;GAWG;AACH,SAAgB,WAAW,CACzB,KAAoB,EACpB,UAAiC,IAAI;IAErC,IAAI,OAAO,KAAK,IAAI,EAAE,CAAC;QACrB,MAAM,IAAI,KAAK,CAAC,wCAAwC,OAAO,EAAE,CAAC,CAAC;IACrE,CAAC;IACD,QAAQ,KAAK,CAAC,IAAI,EAAE,CAAC;QACnB,KAAK,QAAQ,CAAC;QACd,KAAK,MAAM,CAAC;QACZ,KAAK,QAAQ,CAAC,CAAC,CAAC;YACd,MAAM,aAAa,GAAG,IAAA,8BAAgB,EAAC,KAAK,CAAC,IAAI,EAAE,KAAK,CAAC,IAAI,CAAC,CAAC;YAC/D,OAAO,IAAA,oCAAsB,EAAC,aAAa,EAAE,KAAK,CAAC,IAAI,EAAE,KAAK,CAAC,IAAI,CAAC,CAAC;QACvE,CAAC;QACD,KAAK,UAAU;YACb,OAAO,IAAA,gCAAkB,EAAC;gBACxB,OAAO,EAAE,KAAK,CAAC,OAAO;gBACtB,gBAAgB,EAAE,KAAK,CAAC,gBAAgB;gBACxC,EAAE,EAAE,KAAK,CAAC,EAAE;aACb,CAAC,CAAC;QACL,KAAK,aAAa;YAChB,OAAO,0BAA0B,CAC/B,KAAK,CAAC,KAAK,EACX,KAAK,CAAC,KAAK,EACX,KAAK,CAAC,KAAK,EACX,KAAK,CAAC,UAAU,EAChB,KAAK,CAAC,UAAU,CACjB,CAAC;QACJ,KAAK,cAAc;YACjB,OAAO,0BAA0B,CAAC,KAAK,CAAC,IAAI,EAAE,KAAK,CAAC,MAAM,EAAE,KAAK,CAAC,SAAS,CAAC,CAAC;QAC/E,KAAK,UAAU;YACb,OAAO,sBAAsB,CAAC,KAAK,CAAC,IAAI,EAAE,KAAK,CAAC,IAAI,CAAC,CAAC;QACxD,KAAK,SAAS;YACZ,OAAO,sBAAsB,CAAC,KAAK,CAAC,IAAI,EAAE,KAAK,CAAC,IAAI,EAAE,KAAK,CAAC,MAAM,CAAC,CAAC;QACtE,KAAK,SAAS;YACZ,OAAO,sBAAsB,CAAC,KAAK,CAAC,OAAO,EAAE,KAAK,CAAC,OAAO,EAAE,KAAK,CAAC,WAAW,CAAC,CAAC;QACjF,KAAK,uBAAuB;YAC1B,OAAO,kCAAkC,CAAC,KAAK,CAAC,IAAI,EAAE,KAAK,CAAC,MAAM,CAAC,CAAC;QACtE,KAAK,UAAU;YACb,OAAO,sBAAsB,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;QAC5C,KAAK,YAAY;YACf,OAAO,wBAAwB,CAAC,KAAK,CAAC,IAAI,EAAE,KAAK,CAAC,MAAM,CAAC,CAAC;QAC5D,KAAK,YAAY;YACf,OAAO,wBAAwB,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;QAC9C,KAAK,aAAa;YAChB,OAAO,yBAAyB,CAAC,KAAK,CAAC,IAAI,EAAE,KAAK,CAAC,IAAI,EAAE,KAAK,CAAC,IAAI,CAAC,CAAC;IACzE,CAAC;AACH,CAAC;AAED;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,SAAS,0BAA0B,CACjC,KAAa,EACb,KAAa,EACb,KAAa,EACb,UAAkB,EAClB,UAAkB;IAElB,MAAM,KAAK,GAA4B;QACrC,CAAC,KAAK,EAAE,UAAU,CAAC;QACnB,CAAC,KAAK,EAAE,UAAU,CAAC;KACpB,CAAC;IACF,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IACzE,MAAM,KAAK,GAAG,oBAAoB,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,KAAK,EAAE,CAAC;IAC1G,OAAO,IAAA,mBAAU,EAAC,MAAM,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;AACrE,CAAC;AAED;;;;;;;;;;GAUG;AACH,SAAS,0BAA0B,CACjC,IAAY,EACZ,MAA0B,EAC1B,SAAgD;IAEhD,IAAI,CAAC,MAAM,IAAI,CAAC,SAAS,EAAE,CAAC;QAC1B,MAAM,IAAI,KAAK,CACb,yEAAyE,IAAI,GAAG,CACjF,CAAC;IACJ,CAAC;IACD,MAAM,aAAa,GAAG,MAAM,CAAC,CAAC,CAAC,OAAO,MAAM,EAAE,CAAC,CAAC,CAAC,SAAS,SAAU,CAAC,CAAC,CAAC,IAAI,SAAU,CAAC,CAAC,CAAC,EAAE,CAAC;IAC3F,MAAM,KAAK,GAAG,qBAAqB,IAAI,KAAK,aAAa,EAAE,CAAC;IAC5D,OAAO,IAAA,mBAAU,EAAC,MAAM,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;AACrE,CAAC;AAED;;;;;;GAMG;AACH,SAAS,sBAAsB,CAAC,IAAY,EAAE,IAAiB;IAC7D,MAAM,KAAK,GAAG,iBAAiB,IAAI,KAAK,IAAI,EAAE,CAAC;IAC/C,OAAO,IAAA,mBAAU,EAAC,MAAM,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;AACrE,CAAC;AAED;;;;;;GAMG;AACH,SAAS,sBAAsB,CAAC,IAAY,EAAE,IAAY,EAAE,MAAqB;IAC/E,MAAM,KAAK,GAAG,gBAAgB,MAAM,KAAK,IAAI,KAAK,IAAA,2BAAa,EAAC,IAAI,CAAC,EAAE,CAAC;IACxE,OAAO,IAAA,mBAAU,EAAC,MAAM,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;AACrE,CAAC;AAED;;;;;;GAMG;AACH,SAAS,sBAAsB,CAC7B,WAAmB,EACnB,OAAe,EACf,WAAmB;IAEnB,MAAM,KAAK,GAAG,gBAAgB,WAAW,KAAK,OAAO,KAAK,WAAW,EAAE,CAAC;IACxE,OAAO,IAAA,mBAAU,EAAC,MAAM,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;AACrE,CAAC;AAED;;;;;GAKG;AACH,SAAS,kCAAkC,CACzC,IAAY,EACZ,MAAiC;IAEjC,MAAM,KAAK,GAAG,8BAA8B,IAAI,KAAK,MAAM,EAAE,CAAC;IAC9D,OAAO,IAAA,mBAAU,EAAC,MAAM,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;AACrE,CAAC;AAED;;;;;;GAMG;AACH,SAAS,sBAAsB,CAAC,IAAY;IAC1C,MAAM,KAAK,GAAG,iBAAiB,IAAI,EAAE,CAAC;IACtC,OAAO,IAAA,mBAAU,EAAC,MAAM,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;AACrE,CAAC;AAED;;;;;;;GAOG;AACH,SAAS,wBAAwB,CAAC,IAAY,EAAE,MAAc;IAC5D,MAAM,KAAK,GAAG,mBAAmB,IAAI,KAAK,MAAM,EAAE,CAAC;IACnD,OAAO,IAAA,mBAAU,EAAC,MAAM,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;AACrE,CAAC;AAED;;;;;GAKG;AACH,SAAS,wBAAwB,CAAC,IAAY;IAC5C,MAAM,KAAK,GAAG,mBAAmB,IAAI,EAAE,CAAC;IACxC,OAAO,IAAA,mBAAU,EAAC,MAAM,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;AACrE,CAAC;AAED;;;;;;;;;;GAUG;AACH,SAAS,yBAAyB,CAAC,IAAY,EAAE,IAAY,EAAE,IAAY;IACzE,MAAM,aAAa,GAAG,IAAA,8BAAgB,EAAC,IAAI,EAAE,IAAI,CAAC,CAAC;IACnD,MAAM,KAAK,GAAG,oBAAoB,aAAa,KAAK,IAAI,EAAE,CAAC;IAC3D,OAAO,IAAA,mBAAU,EAAC,MAAM,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;AACrE,CAAC;AAED;;;;;;;;;;;;;;;;;;GAkBG;AACH,SAAgB,eAAe,CAC7B,KAA0B,EAC1B,OAA4B;IAE5B,MAAM,WAAW,GAAG,aAAa,CAAC,KAAK,CAAC,CAAC;IACzC,MAAM,aAAa,GAAG,aAAa,CAAC,OAAO,CAAC,CAAC;IAC7C,MAAM,MAAM,GAAG,IAAI,GAAG,CAAY,CAAC,GAAG,WAAW,CAAC,IAAI,EAAE,EAAE,GAAG,aAAa,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC;IAEpF,MAAM,KAAK,GAAgB,EAAE,CAAC;IAC9B,MAAM,SAAS,GAAgB,EAAE,CAAC;IAClC,MAAM,KAAK,GAAgB,EAAE,CAAC;IAC9B,MAAM,OAAO,GAAgB,EAAE,CAAC;IAChC,MAAM,WAAW,GAAgB;QAC/B,IAAI,EAAE,UAAU;QAChB,MAAM,EAAE,wDAAwD;KACjE,CAAC;IACF,MAAM,SAAS,GAAgB;QAC7B,IAAI,EAAE,gBAAgB;QACtB,MAAM,EAAE,kDAAkD;KAC3D,CAAC;IACF,MAAM,UAAU,GAAgB;QAC9B,IAAI,EAAE,kBAAkB;QACxB,MAAM,EAAE,sDAAsD;KAC/D,CAAC;IAEF,KAAK,MAAM,EAAE,IAAI,MAAM,EAAE,CAAC;QACxB,MAAM,CAAC,GAAG,WAAW,CAAC,GAAG,CAAC,EAAE,CAAC,IAAI,CAAC,CAAC;QACnC,MAAM,CAAC,GAAG,aAAa,CAAC,GAAG,CAAC,EAAE,CAAC,IAAI,CAAC,CAAC;QACrC,MAAM,OAAO,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;QAC/B,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,OAAO,EAAE,CAAC,EAAE,EAAE,CAAC;YACjC,KAAK,CAAC,IAAI,CAAC;gBACT,OAAO,EAAE,EAAE;gBACX,SAAS,EAAE,EAAE;gBACb,MAAM,EAAE,WAAW;gBACnB,UAAU,EAAE,GAAG;gBACf,OAAO,EAAE,CAAC,WAAW,CAAC;aACvB,CAAC,CAAC;YACH,SAAS,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;QACrB,CAAC;QACD,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,CAAC,GAAG,OAAO,EAAE,CAAC,EAAE,EAAE,CAAC;YACrC,KAAK,CAAC,IAAI,CAAC;gBACT,SAAS,EAAE,EAAE;gBACb,MAAM,EAAE,OAAO;gBACf,UAAU,EAAE,GAAG;gBACf,OAAO,EAAE,CAAC,SAAS,CAAC;aACrB,CAAC,CAAC;YACH,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;QACjB,CAAC;QACD,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,CAAC,GAAG,OAAO,EAAE,CAAC,EAAE,EAAE,CAAC;YACrC,KAAK,CAAC,IAAI,CAAC;gBACT,OAAO,EAAE,EAAE;gBACX,MAAM,EAAE,SAAS;gBACjB,UAAU,EAAE,GAAG;gBACf,OAAO,EAAE,CAAC,UAAU,CAAC;aACtB,CAAC,CAAC;YACH,OAAO,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;QACnB,CAAC;IACH,CAAC;IAED,OAAO,EAAE,KAAK,EAAE,SAAS,EAAE,KAAK,EAAE,OAAO,EAAE,QAAQ,EAAE,KAAK,EAAE,CAAC;AAC/D,CAAC;AAED,SAAS,aAAa,CAAC,KAA0B;IAC/C,MAAM,MAAM,GAAG,IAAI,GAAG,EAAqB,CAAC;IAC5C,KAAK,MAAM,EAAE,IAAI,KAAK,EAAE,CAAC;QACvB,MAAM,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;IAC5C,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC"}
+{"version":3,"file":"finding-identity.js","sourceRoot":"","sources":["../../src/baseline/finding-identity.ts"],"names":[],"mappings":";AAAA;;;;;;;;;;;GAWG;;AAsCH,kCA+CC;AA6LD,0CA4DC;AA5UD,mCAAoC;AACpC,gEAKwC;AAkBxC;;;;;;;;;;;GAWG;AACH,SAAgB,WAAW,CACzB,KAAoB,EACpB,UAAiC,IAAI;IAErC,IAAI,OAAO,KAAK,IAAI,EAAE,CAAC;QACrB,MAAM,IAAI,KAAK,CAAC,wCAAwC,OAAO,EAAE,CAAC,CAAC;IACrE,CAAC;IACD,QAAQ,KAAK,CAAC,IAAI,EAAE,CAAC;QACnB,KAAK,QAAQ,CAAC;QACd,KAAK,MAAM,CAAC;QACZ,KAAK,QAAQ,CAAC,CAAC,CAAC;YACd,MAAM,aAAa,GAAG,IAAA,8BAAgB,EAAC,KAAK,CAAC,IAAI,EAAE,KAAK,CAAC,IAAI,CAAC,CAAC;YAC/D,OAAO,IAAA,oCAAsB,EAAC,aAAa,EAAE,KAAK,CAAC,IAAI,EAAE,KAAK,CAAC,IAAI,CAAC,CAAC;QACvE,CAAC;QACD,KAAK,UAAU;YACb,OAAO,IAAA,gCAAkB,EAAC;gBACxB,OAAO,EAAE,KAAK,CAAC,OAAO;gBACtB,gBAAgB,EAAE,KAAK,CAAC,gBAAgB;gBACxC,EAAE,EAAE,KAAK,CAAC,EAAE;aACb,CAAC,CAAC;QACL,KAAK,aAAa;YAChB,OAAO,0BAA0B,CAC/B,KAAK,CAAC,KAAK,EACX,KAAK,CAAC,KAAK,EACX,KAAK,CAAC,KAAK,EACX,KAAK,CAAC,UAAU,EAChB,KAAK,CAAC,UAAU,CACjB,CAAC;QACJ,KAAK,cAAc;YACjB,OAAO,0BAA0B,CAAC,KAAK,CAAC,IAAI,EAAE,KAAK,CAAC,MAAM,EAAE,KAAK,CAAC,SAAS,CAAC,CAAC;QAC/E,KAAK,UAAU;YACb,OAAO,sBAAsB,CAAC,KAAK,CAAC,IAAI,EAAE,KAAK,CAAC,IAAI,CAAC,CAAC;QACxD,KAAK,SAAS;YACZ,OAAO,sBAAsB,CAAC,KAAK,CAAC,IAAI,EAAE,KAAK,CAAC,IAAI,EAAE,KAAK,CAAC,MAAM,CAAC,CAAC;QACtE,KAAK,uBAAuB;YAC1B,OAAO,kCAAkC,CAAC,KAAK,CAAC,IAAI,EAAE,KAAK,CAAC,MAAM,CAAC,CAAC;QACtE,KAAK,UAAU;YACb,OAAO,sBAAsB,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;QAC5C,KAAK,YAAY;YACf,OAAO,wBAAwB,CAAC,KAAK,CAAC,IAAI,EAAE,KAAK,CAAC,MAAM,CAAC,CAAC;QAC5D,KAAK,YAAY;YACf,OAAO,wBAAwB,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;QAC9C,KAAK,aAAa;YAChB,OAAO,yBAAyB,CAAC,KAAK,CAAC,IAAI,EAAE,KAAK,CAAC,IAAI,EAAE,KAAK,CAAC,IAAI,CAAC,CAAC;QACvE,KAAK,aAAa;YAChB,OAAO,yBAAyB,CAAC,KAAK,CAAC,IAAI,EAAE,KAAK,CAAC,IAAI,EAAE,KAAK,CAAC,QAAQ,CAAC,CAAC;IAC7E,CAAC;AACH,CAAC;AAED;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,SAAS,0BAA0B,CACjC,KAAa,EACb,KAAa,EACb,KAAa,EACb,UAAkB,EAClB,UAAkB;IAElB,MAAM,KAAK,GAA4B;QACrC,CAAC,KAAK,EAAE,UAAU,CAAC;QACnB,CAAC,KAAK,EAAE,UAAU,CAAC;KACpB,CAAC;IACF,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IACzE,MAAM,KAAK,GAAG,oBAAoB,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,KAAK,EAAE,CAAC;IAC1G,OAAO,IAAA,mBAAU,EAAC,MAAM,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;AACrE,CAAC;AAED;;;;;;;;;;GAUG;AACH,SAAS,0BAA0B,CACjC,IAAY,EACZ,MAA0B,EAC1B,SAAgD;IAEhD,IAAI,CAAC,MAAM,IAAI,CAAC,SAAS,EAAE,CAAC;QAC1B,MAAM,IAAI,KAAK,CACb,yEAAyE,IAAI,GAAG,CACjF,CAAC;IACJ,CAAC;IACD,MAAM,aAAa,GAAG,MAAM,CAAC,CAAC,CAAC,OAAO,MAAM,EAAE,CAAC,CAAC,CAAC,SAAS,SAAU,CAAC,CAAC,CAAC,IAAI,SAAU,CAAC,CAAC,CAAC,EAAE,CAAC;IAC3F,MAAM,KAAK,GAAG,qBAAqB,IAAI,KAAK,aAAa,EAAE,CAAC;IAC5D,OAAO,IAAA,mBAAU,EAAC,MAAM,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;AACrE,CAAC;AAED;;;;;;GAMG;AACH,SAAS,sBAAsB,CAAC,IAAY,EAAE,IAAiB;IAC7D,MAAM,KAAK,GAAG,iBAAiB,IAAI,KAAK,IAAI,EAAE,CAAC;IAC/C,OAAO,IAAA,mBAAU,EAAC,MAAM,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;AACrE,CAAC;AAED;;;;;;GAMG;AACH,SAAS,sBAAsB,CAAC,IAAY,EAAE,IAAY,EAAE,MAAqB;IAC/E,MAAM,KAAK,GAAG,gBAAgB,MAAM,KAAK,IAAI,KAAK,IAAA,2BAAa,EAAC,IAAI,CAAC,EAAE,CAAC;IACxE,OAAO,IAAA,mBAAU,EAAC,MAAM,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;AACrE,CAAC;AAED;;;;;GAKG;AACH,SAAS,kCAAkC,CACzC,IAAY,EACZ,MAAiC;IAEjC,MAAM,KAAK,GAAG,8BAA8B,IAAI,KAAK,MAAM,EAAE,CAAC;IAC9D,OAAO,IAAA,mBAAU,EAAC,MAAM,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;AACrE,CAAC;AAED;;;;;;GAMG;AACH,SAAS,sBAAsB,CAAC,IAAY;IAC1C,MAAM,KAAK,GAAG,iBAAiB,IAAI,EAAE,CAAC;IACtC,OAAO,IAAA,mBAAU,EAAC,MAAM,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;AACrE,CAAC;AAED;;;;;;;GAOG;AACH,SAAS,wBAAwB,CAAC,IAAY,EAAE,MAAc;IAC5D,MAAM,KAAK,GAAG,mBAAmB,IAAI,KAAK,MAAM,EAAE,CAAC;IACnD,OAAO,IAAA,mBAAU,EAAC,MAAM,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;AACrE,CAAC;AAED;;;;;GAKG;AACH,SAAS,wBAAwB,CAAC,IAAY;IAC5C,MAAM,KAAK,GAAG,mBAAmB,IAAI,EAAE,CAAC;IACxC,OAAO,IAAA,mBAAU,EAAC,MAAM,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;AACrE,CAAC;AAED;;;;;;;;;;GAUG;AACH,SAAS,yBAAyB,CAAC,IAAY,EAAE,IAAY,EAAE,IAAY;IACzE,MAAM,aAAa,GAAG,IAAA,8BAAgB,EAAC,IAAI,EAAE,IAAI,CAAC,CAAC;IACnD,MAAM,KAAK,GAAG,oBAAoB,aAAa,KAAK,IAAI,EAAE,CAAC;IAC3D,OAAO,IAAA,mBAAU,EAAC,MAAM,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;AACrE,CAAC;AAED;;;;;;;;GAQG;AACH,SAAS,yBAAyB,CAAC,IAAY,EAAE,IAAY,EAAE,QAAgB;IAC7E,MAAM,KAAK,GAAG,oBAAoB,IAAI,KAAK,IAAA,2BAAa,EAAC,IAAI,CAAC,KAAK,QAAQ,EAAE,CAAC;IAC9E,OAAO,IAAA,mBAAU,EAAC,MAAM,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;AACrE,CAAC;AAED;;;;;;;;;;;;;;;;;;GAkBG;AACH,SAAgB,eAAe,CAC7B,KAA0B,EAC1B,OAA4B;IAE5B,MAAM,WAAW,GAAG,aAAa,CAAC,KAAK,CAAC,CAAC;IACzC,MAAM,aAAa,GAAG,aAAa,CAAC,OAAO,CAAC,CAAC;IAC7C,MAAM,MAAM,GAAG,IAAI,GAAG,CAAY,CAAC,GAAG,WAAW,CAAC,IAAI,EAAE,EAAE,GAAG,aAAa,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC;IAEpF,MAAM,KAAK,GAAgB,EAAE,CAAC;IAC9B,MAAM,SAAS,GAAgB,EAAE,CAAC;IAClC,MAAM,KAAK,GAAgB,EAAE,CAAC;IAC9B,MAAM,OAAO,GAAgB,EAAE,CAAC;IAChC,MAAM,WAAW,GAAgB;QAC/B,IAAI,EAAE,UAAU;QAChB,MAAM,EAAE,wDAAwD;KACjE,CAAC;IACF,MAAM,SAAS,GAAgB;QAC7B,IAAI,EAAE,gBAAgB;QACtB,MAAM,EAAE,kDAAkD;KAC3D,CAAC;IACF,MAAM,UAAU,GAAgB;QAC9B,IAAI,EAAE,kBAAkB;QACxB,MAAM,EAAE,sDAAsD;KAC/D,CAAC;IAEF,KAAK,MAAM,EAAE,IAAI,MAAM,EAAE,CAAC;QACxB,MAAM,CAAC,GAAG,WAAW,CAAC,GAAG,CAAC,EAAE,CAAC,IAAI,CAAC,CAAC;QACnC,MAAM,CAAC,GAAG,aAAa,CAAC,GAAG,CAAC,EAAE,CAAC,IAAI,CAAC,CAAC;QACrC,MAAM,OAAO,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;QAC/B,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,OAAO,EAAE,CAAC,EAAE,EAAE,CAAC;YACjC,KAAK,CAAC,IAAI,CAAC;gBACT,OAAO,EAAE,EAAE;gBACX,SAAS,EAAE,EAAE;gBACb,MAAM,EAAE,WAAW;gBACnB,UAAU,EAAE,GAAG;gBACf,OAAO,EAAE,CAAC,WAAW,CAAC;aACvB,CAAC,CAAC;YACH,SAAS,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;QACrB,CAAC;QACD,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,CAAC,GAAG,OAAO,EAAE,CAAC,EAAE,EAAE,CAAC;YACrC,KAAK,CAAC,IAAI,CAAC;gBACT,SAAS,EAAE,EAAE;gBACb,MAAM,EAAE,OAAO;gBACf,UAAU,EAAE,GAAG;gBACf,OAAO,EAAE,CAAC,SAAS,CAAC;aACrB,CAAC,CAAC;YACH,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;QACjB,CAAC;QACD,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,CAAC,GAAG,OAAO,EAAE,CAAC,EAAE,EAAE,CAAC;YACrC,KAAK,CAAC,IAAI,CAAC;gBACT,OAAO,EAAE,EAAE;gBACX,MAAM,EAAE,SAAS;gBACjB,UAAU,EAAE,GAAG;gBACf,OAAO,EAAE,CAAC,UAAU,CAAC;aACtB,CAAC,CAAC;YACH,OAAO,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;QACnB,CAAC;IACH,CAAC;IAED,OAAO,EAAE,KAAK,EAAE,SAAS,EAAE,KAAK,EAAE,OAAO,EAAE,QAAQ,EAAE,KAAK,EAAE,CAAC;AAC/D,CAAC;AAED,SAAS,aAAa,CAAC,KAA0B;IAC/C,MAAM,MAAM,GAAG,IAAI,GAAG,EAAqB,CAAC;IAC5C,KAAK,MAAM,EAAE,IAAI,KAAK,EAAE,CAAC;QACvB,MAAM,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;IAC5C,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC"}

package/dist/baseline/modes.d.ts

@@ -0,0 +1,140 @@
+/**
+ * Baseline mode resolution — single source of truth for picking
+ * between `committed-full`, `committed-sanitized`, and `ref-based`.
+ *
+ * # The three modes
+ *
+ *   - **`committed-full`** — Rich entries committed to git under
+ *     `.dxkit/baselines/<name>.json`. The default behavior dxkit
+ *     has had since baselines existed. Best for private repos with
+ *     small teams; the human-readable locator fields make `baseline
+ *     show` and block-time hints maximally useful.
+ *
+ *   - **`committed-sanitized`** — The file is still committed, but
+ *     every entry is stripped to `{ id, kind, sanitized: true }`
+ *     before write (see `./sanitize.ts`). The cross-run matching
+ *     contract is preserved (identity fingerprints are unchanged);
+ *     human-readable locators are gone. Best for compliance-
+ *     conscious private repos where broad internal read access
+ *     makes location disclosures material.
+ *
+ *   - **`ref-based`** — No baseline file is committed. The prior
+ *     side of the guardrail diff is computed at check time from a
+ *     git ref (default: `origin/<default-branch>`) via
+ *     `git worktree add`. Zero disclosure surface; best for public
+ *     repos. Cost is a longer check (gather runs twice — once
+ *     against the ref, once against HEAD).
+ *
+ * # Resolution precedence
+ *
+ *   1. **CLI flag** — `--mode=<X>` (and `--ref=<R>`). Highest
+ *      precedence. Overrides everything else.
+ *   2. **Policy file** — `baseline.mode` / `baseline.ref` in
+ *      `.dxkit/policy.json`. Pins the choice repo-wide so every
+ *      developer + every CI job uses the same posture.
+ *   3. **Visibility-derived default** — probes
+ *      `gh repo view --json visibility` (see `./visibility.ts`)
+ *      and picks:
+ *        - `'public'` → `ref-based`
+ *        - `'private'` / `'internal'` → `committed-full`
+ *        - `'unknown'` → `committed-full` (safe default + warning)
+ *
+ * `committed-sanitized` is never auto-picked. It's the explicit
+ * opt-in for compliance-conscious private repos. The reasoning:
+ *
+ *   - For public repos, sanitized-in-git is strictly worse than
+ *     ref-based — you're still committing the fingerprint set,
+ *     and ref-based gives the same matching contract without
+ *     storing anything.
+ *   - For typical private repos with small teams, full content
+ *     is more useful.
+ *
+ * So sanitized lives between those two extremes and customers
+ * opt in via `policy.json` or `--mode=committed-sanitized`.
+ *
+ * # Why one resolver
+ *
+ * Every consumer (the `baseline create` orchestrator, the
+ * `guardrail check` orchestrator, doctor checks, future modes-
+ * aware tooling) calls `resolveBaselineMode` and reads the
+ * returned `ResolvedMode`. Scattered `if (visibility === 'public')`
+ * branches would drift independently as the rules evolve; this
+ * module is the single edit point.
+ *
+ * Pure module — no I/O of its own. The visibility probe is
+ * injectable via `probeVisibility` so tests can simulate every
+ * path without going through `execSync('gh ...')`.
+ */
+import type { RepoVisibility } from './visibility';
+/** The three modes. Keep this union ordered the same way as
+ *  `BASELINE_MODES` (declared below) so help text + arch checks
+ *  match. */
+export type BaselineMode = 'committed-full' | 'committed-sanitized' | 'ref-based';
+/** Canonical enumeration of the mode strings. Consumers wanting to
+ *  iterate every mode (CLI flag validation, help text, doctor)
+ *  import this rather than re-listing the union members. */
+export declare const BASELINE_MODES: ReadonlyArray<BaselineMode>;
+/** Where the resolver picked the mode from. Surfaced to the
+ *  runtime log + doctor + agent skills so customers see WHY
+ *  `committed-full` was picked over `ref-based`. */
+export type ModeSource = 'cli' | 'policy' | 'auto-public' | 'auto-private' | 'auto-internal' | 'auto-unknown';
+/** Resolution outcome carrying the chosen mode + the audit trail
+ *  + the resolved ref (for ref-based). Consumers read
+ *  `mode` to dispatch and `explanation` to log. */
+export interface ResolvedMode {
+    readonly mode: BaselineMode;
+    readonly source: ModeSource;
+    /** One-line human-readable explanation suitable for the runtime
+     *  log. Always populated. */
+    readonly explanation: string;
+    /** Git ref used when `mode === 'ref-based'`. Resolved from CLI,
+     *  policy, or the repo's default-branch upstream tracking ref.
+     *  Undefined when mode is not ref-based. */
+    readonly ref?: string;
+}
+/** Input shape for the resolver. Every field is optional so the
+ *  same function handles "no flags, no policy" and "explicit
+ *  everything" without branching on call site. */
+export interface ResolveModeOptions {
+    readonly cwd: string;
+    /** Explicit CLI flag value. Highest precedence when present. */
+    readonly cliMode?: BaselineMode;
+    /** `baseline.mode` field from `.dxkit/policy.json`. Second
+     *  precedence. */
+    readonly policyMode?: BaselineMode;
+    /** Explicit CLI ref value (`--ref=<R>`). Only consulted when
+     *  the resolved mode is `ref-based`. */
+    readonly cliRef?: string;
+    /** `baseline.ref` field from `.dxkit/policy.json`. */
+    readonly policyRef?: string;
+    /** Injectable for tests; production omits and the resolver
+     *  calls `detectRepoVisibility` directly. */
+    readonly probeVisibility?: (cwd: string) => RepoVisibility;
+    /** Injectable for tests; production omits and the resolver
+     *  shells out to `git symbolic-ref refs/remotes/origin/HEAD`. */
+    readonly probeDefaultRef?: (cwd: string) => string | undefined;
+}
+/**
+ * Resolve the baseline mode for a given run. Pure over its inputs
+ * apart from the optional probe functions (which default to
+ * `detectRepoVisibility` + `probeOriginHeadRef` and ARE I/O-bound).
+ * The returned `ResolvedMode` carries everything callers need to
+ * dispatch + log.
+ */
+export declare function resolveBaselineMode(opts: ResolveModeOptions): ResolvedMode;
+/**
+ * Probe `git symbolic-ref refs/remotes/origin/HEAD` to learn the
+ * remote's default branch. Returns `'origin/<branch>'` on success,
+ * `undefined` on any failure (no remote, no fetch ever ran, etc.).
+ *
+ * Public for testing — production callers go through
+ * `resolveBaselineMode`'s `opts.probeDefaultRef` injection.
+ */
+export declare function probeOriginHeadRef(cwd: string): string | undefined;
+/**
+ * Parse a string into a `BaselineMode`. Returns `null` for unknown
+ * values so the CLI surfaces a helpful error including the full
+ * accepted list. Used by `--mode=<X>` flag parsing.
+ */
+export declare function parseBaselineMode(raw: string): BaselineMode | null;
+//# sourceMappingURL=modes.d.ts.map

package/dist/baseline/modes.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"modes.d.ts","sourceRoot":"","sources":["../../src/baseline/modes.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAkEG;AAIH,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,cAAc,CAAC;AAEnD;;aAEa;AACb,MAAM,MAAM,YAAY,GAAG,gBAAgB,GAAG,qBAAqB,GAAG,WAAW,CAAC;AAElF;;4DAE4D;AAC5D,eAAO,MAAM,cAAc,EAAE,aAAa,CAAC,YAAY,CAIrD,CAAC;AAEH;;oDAEoD;AACpD,MAAM,MAAM,UAAU,GAClB,KAAK,GACL,QAAQ,GACR,aAAa,GACb,cAAc,GACd,eAAe,GACf,cAAc,CAAC;AAEnB;;mDAEmD;AACnD,MAAM,WAAW,YAAY;IAC3B,QAAQ,CAAC,IAAI,EAAE,YAAY,CAAC;IAC5B,QAAQ,CAAC,MAAM,EAAE,UAAU,CAAC;IAC5B;iCAC6B;IAC7B,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B;;gDAE4C;IAC5C,QAAQ,CAAC,GAAG,CAAC,EAAE,MAAM,CAAC;CACvB;AAED;;kDAEkD;AAClD,MAAM,WAAW,kBAAkB;IACjC,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;IACrB,gEAAgE;IAChE,QAAQ,CAAC,OAAO,CAAC,EAAE,YAAY,CAAC;IAChC;sBACkB;IAClB,QAAQ,CAAC,UAAU,CAAC,EAAE,YAAY,CAAC;IACnC;4CACwC;IACxC,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC;IACzB,sDAAsD;IACtD,QAAQ,CAAC,SAAS,CAAC,EAAE,MAAM,CAAC;IAC5B;iDAC6C;IAC7C,QAAQ,CAAC,eAAe,CAAC,EAAE,CAAC,GAAG,EAAE,MAAM,KAAK,cAAc,CAAC;IAC3D;qEACiE;IACjE,QAAQ,CAAC,eAAe,CAAC,EAAE,CAAC,GAAG,EAAE,MAAM,KAAK,MAAM,GAAG,SAAS,CAAC;CAChE;AAED;;;;;;GAMG;AACH,wBAAgB,mBAAmB,CAAC,IAAI,EAAE,kBAAkB,GAAG,YAAY,CAmB1E;AAqBD;;;;;;;GAOG;AACH,wBAAgB,kBAAkB,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS,CAalE;AAmBD;;;;GAIG;AACH,wBAAgB,iBAAiB,CAAC,GAAG,EAAE,MAAM,GAAG,YAAY,GAAG,IAAI,CAElE"}

package/dist/baseline/modes.js

@@ -0,0 +1,179 @@
+"use strict";
+/**
+ * Baseline mode resolution — single source of truth for picking
+ * between `committed-full`, `committed-sanitized`, and `ref-based`.
+ *
+ * # The three modes
+ *
+ *   - **`committed-full`** — Rich entries committed to git under
+ *     `.dxkit/baselines/<name>.json`. The default behavior dxkit
+ *     has had since baselines existed. Best for private repos with
+ *     small teams; the human-readable locator fields make `baseline
+ *     show` and block-time hints maximally useful.
+ *
+ *   - **`committed-sanitized`** — The file is still committed, but
+ *     every entry is stripped to `{ id, kind, sanitized: true }`
+ *     before write (see `./sanitize.ts`). The cross-run matching
+ *     contract is preserved (identity fingerprints are unchanged);
+ *     human-readable locators are gone. Best for compliance-
+ *     conscious private repos where broad internal read access
+ *     makes location disclosures material.
+ *
+ *   - **`ref-based`** — No baseline file is committed. The prior
+ *     side of the guardrail diff is computed at check time from a
+ *     git ref (default: `origin/<default-branch>`) via
+ *     `git worktree add`. Zero disclosure surface; best for public
+ *     repos. Cost is a longer check (gather runs twice — once
+ *     against the ref, once against HEAD).
+ *
+ * # Resolution precedence
+ *
+ *   1. **CLI flag** — `--mode=<X>` (and `--ref=<R>`). Highest
+ *      precedence. Overrides everything else.
+ *   2. **Policy file** — `baseline.mode` / `baseline.ref` in
+ *      `.dxkit/policy.json`. Pins the choice repo-wide so every
+ *      developer + every CI job uses the same posture.
+ *   3. **Visibility-derived default** — probes
+ *      `gh repo view --json visibility` (see `./visibility.ts`)
+ *      and picks:
+ *        - `'public'` → `ref-based`
+ *        - `'private'` / `'internal'` → `committed-full`
+ *        - `'unknown'` → `committed-full` (safe default + warning)
+ *
+ * `committed-sanitized` is never auto-picked. It's the explicit
+ * opt-in for compliance-conscious private repos. The reasoning:
+ *
+ *   - For public repos, sanitized-in-git is strictly worse than
+ *     ref-based — you're still committing the fingerprint set,
+ *     and ref-based gives the same matching contract without
+ *     storing anything.
+ *   - For typical private repos with small teams, full content
+ *     is more useful.
+ *
+ * So sanitized lives between those two extremes and customers
+ * opt in via `policy.json` or `--mode=committed-sanitized`.
+ *
+ * # Why one resolver
+ *
+ * Every consumer (the `baseline create` orchestrator, the
+ * `guardrail check` orchestrator, doctor checks, future modes-
+ * aware tooling) calls `resolveBaselineMode` and reads the
+ * returned `ResolvedMode`. Scattered `if (visibility === 'public')`
+ * branches would drift independently as the rules evolve; this
+ * module is the single edit point.
+ *
+ * Pure module — no I/O of its own. The visibility probe is
+ * injectable via `probeVisibility` so tests can simulate every
+ * path without going through `execSync('gh ...')`.
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.BASELINE_MODES = void 0;
+exports.resolveBaselineMode = resolveBaselineMode;
+exports.probeOriginHeadRef = probeOriginHeadRef;
+exports.parseBaselineMode = parseBaselineMode;
+const child_process_1 = require("child_process");
+const visibility_1 = require("./visibility");
+/** Canonical enumeration of the mode strings. Consumers wanting to
+ *  iterate every mode (CLI flag validation, help text, doctor)
+ *  import this rather than re-listing the union members. */
+exports.BASELINE_MODES = Object.freeze([
+    'committed-full',
+    'committed-sanitized',
+    'ref-based',
+]);
+/**
+ * Resolve the baseline mode for a given run. Pure over its inputs
+ * apart from the optional probe functions (which default to
+ * `detectRepoVisibility` + `probeOriginHeadRef` and ARE I/O-bound).
+ * The returned `ResolvedMode` carries everything callers need to
+ * dispatch + log.
+ */
+function resolveBaselineMode(opts) {
+    if (opts.cliMode !== undefined) {
+        return finalize(opts, opts.cliMode, 'cli');
+    }
+    if (opts.policyMode !== undefined) {
+        return finalize(opts, opts.policyMode, 'policy');
+    }
+    const probe = opts.probeVisibility ?? visibility_1.detectRepoVisibility;
+    const visibility = probe(opts.cwd);
+    switch (visibility) {
+        case 'public':
+            return finalize(opts, 'ref-based', 'auto-public');
+        case 'private':
+            return finalize(opts, 'committed-full', 'auto-private');
+        case 'internal':
+            return finalize(opts, 'committed-full', 'auto-internal');
+        case 'unknown':
+            return finalize(opts, 'committed-full', 'auto-unknown');
+    }
+}
+/**
+ * Internal: stamp the explanation + resolve the ref (for ref-based)
+ * onto the outcome. Centralized so every code path emits the same
+ * shape.
+ */
+function finalize(opts, mode, source) {
+    const explanation = explanationFor(mode, source);
+    if (mode !== 'ref-based')
+        return { mode, source, explanation };
+    const ref = resolveRef(opts);
+    return { mode, source, explanation, ref };
+}
+function resolveRef(opts) {
+    if (opts.cliRef)
+        return opts.cliRef;
+    if (opts.policyRef)
+        return opts.policyRef;
+    const probe = opts.probeDefaultRef ?? probeOriginHeadRef;
+    return probe(opts.cwd) ?? 'origin/main';
+}
+/**
+ * Probe `git symbolic-ref refs/remotes/origin/HEAD` to learn the
+ * remote's default branch. Returns `'origin/<branch>'` on success,
+ * `undefined` on any failure (no remote, no fetch ever ran, etc.).
+ *
+ * Public for testing — production callers go through
+ * `resolveBaselineMode`'s `opts.probeDefaultRef` injection.
+ */
+function probeOriginHeadRef(cwd) {
+    try {
+        const out = (0, child_process_1.execSync)('git symbolic-ref refs/remotes/origin/HEAD', {
+            cwd,
+            stdio: ['ignore', 'pipe', 'pipe'],
+            encoding: 'utf-8',
+        }).trim();
+        // Output shape: "refs/remotes/origin/main" → strip the prefix.
+        if (out.startsWith('refs/remotes/'))
+            return out.slice('refs/remotes/'.length);
+        return undefined;
+    }
+    catch {
+        return undefined;
+    }
+}
+function explanationFor(mode, source) {
+    switch (source) {
+        case 'cli':
+            return `mode=${mode} (--mode flag)`;
+        case 'policy':
+            return `mode=${mode} (.dxkit/policy.json: baseline.mode)`;
+        case 'auto-public':
+            return `mode=${mode} (auto: gh detected a public repo)`;
+        case 'auto-private':
+            return `mode=${mode} (auto: gh detected a private repo)`;
+        case 'auto-internal':
+            return `mode=${mode} (auto: gh detected an internal repo)`;
+        case 'auto-unknown':
+            return `mode=${mode} (auto: visibility not detectable via gh; defaulting to private posture)`;
+    }
+}
+/**
+ * Parse a string into a `BaselineMode`. Returns `null` for unknown
+ * values so the CLI surfaces a helpful error including the full
+ * accepted list. Used by `--mode=<X>` flag parsing.
+ */
+function parseBaselineMode(raw) {
+    return exports.BASELINE_MODES.includes(raw) ? raw : null;
+}
+//# sourceMappingURL=modes.js.map

package/dist/baseline/modes.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"modes.js","sourceRoot":"","sources":["../../src/baseline/modes.ts"],"names":[],"mappings":";AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAkEG;;;AA4EH,kDAmBC;AA6BD,gDAaC;AAwBD,8CAEC;AAjKD,iDAAyC;AACzC,6CAAoD;AAQpD;;4DAE4D;AAC/C,QAAA,cAAc,GAAgC,MAAM,CAAC,MAAM,CAAC;IACvE,gBAAgB;IAChB,qBAAqB;IACrB,WAAW;CACZ,CAAC,CAAC;AAmDH;;;;;;GAMG;AACH,SAAgB,mBAAmB,CAAC,IAAwB;IAC1D,IAAI,IAAI,CAAC,OAAO,KAAK,SAAS,EAAE,CAAC;QAC/B,OAAO,QAAQ,CAAC,IAAI,EAAE,IAAI,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC;IAC7C,CAAC;IACD,IAAI,IAAI,CAAC,UAAU,KAAK,SAAS,EAAE,CAAC;QAClC,OAAO,QAAQ,CAAC,IAAI,EAAE,IAAI,CAAC,UAAU,EAAE,QAAQ,CAAC,CAAC;IACnD,CAAC;IACD,MAAM,KAAK,GAAG,IAAI,CAAC,eAAe,IAAI,iCAAoB,CAAC;IAC3D,MAAM,UAAU,GAAG,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IACnC,QAAQ,UAAU,EAAE,CAAC;QACnB,KAAK,QAAQ;YACX,OAAO,QAAQ,CAAC,IAAI,EAAE,WAAW,EAAE,aAAa,CAAC,CAAC;QACpD,KAAK,SAAS;YACZ,OAAO,QAAQ,CAAC,IAAI,EAAE,gBAAgB,EAAE,cAAc,CAAC,CAAC;QAC1D,KAAK,UAAU;YACb,OAAO,QAAQ,CAAC,IAAI,EAAE,gBAAgB,EAAE,eAAe,CAAC,CAAC;QAC3D,KAAK,SAAS;YACZ,OAAO,QAAQ,CAAC,IAAI,EAAE,gBAAgB,EAAE,cAAc,CAAC,CAAC;IAC5D,CAAC;AACH,CAAC;AAED;;;;GAIG;AACH,SAAS,QAAQ,CAAC,IAAwB,EAAE,IAAkB,EAAE,MAAkB;IAChF,MAAM,WAAW,GAAG,cAAc,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;IACjD,IAAI,IAAI,KAAK,WAAW;QAAE,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,WAAW,EAAE,CAAC;IAC/D,MAAM,GAAG,GAAG,UAAU,CAAC,IAAI,CAAC,CAAC;IAC7B,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,WAAW,EAAE,GAAG,EAAE,CAAC;AAC5C,CAAC;AAED,SAAS,UAAU,CAAC,IAAwB;IAC1C,IAAI,IAAI,CAAC,MAAM;QAAE,OAAO,IAAI,CAAC,MAAM,CAAC;IACpC,IAAI,IAAI,CAAC,SAAS;QAAE,OAAO,IAAI,CAAC,SAAS,CAAC;IAC1C,MAAM,KAAK,GAAG,IAAI,CAAC,eAAe,IAAI,kBAAkB,CAAC;IACzD,OAAO,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,aAAa,CAAC;AAC1C,CAAC;AAED;;;;;;;GAOG;AACH,SAAgB,kBAAkB,CAAC,GAAW;IAC5C,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,IAAA,wBAAQ,EAAC,2CAA2C,EAAE;YAChE,GAAG;YACH,KAAK,EAAE,CAAC,QAAQ,EAAE,MAAM,EAAE,MAAM,CAAC;YACjC,QAAQ,EAAE,OAAO;SAClB,CAAC,CAAC,IAAI,EAAE,CAAC;QACV,+DAA+D;QAC/D,IAAI,GAAG,CAAC,UAAU,CAAC,eAAe,CAAC;YAAE,OAAO,GAAG,CAAC,KAAK,CAAC,eAAe,CAAC,MAAM,CAAC,CAAC;QAC9E,OAAO,SAAS,CAAC;IACnB,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,SAAS,CAAC;IACnB,CAAC;AACH,CAAC;AAED,SAAS,cAAc,CAAC,IAAkB,EAAE,MAAkB;IAC5D,QAAQ,MAAM,EAAE,CAAC;QACf,KAAK,KAAK;YACR,OAAO,QAAQ,IAAI,gBAAgB,CAAC;QACtC,KAAK,QAAQ;YACX,OAAO,QAAQ,IAAI,sCAAsC,CAAC;QAC5D,KAAK,aAAa;YAChB,OAAO,QAAQ,IAAI,oCAAoC,CAAC;QAC1D,KAAK,cAAc;YACjB,OAAO,QAAQ,IAAI,qCAAqC,CAAC;QAC3D,KAAK,eAAe;YAClB,OAAO,QAAQ,IAAI,uCAAuC,CAAC;QAC7D,KAAK,cAAc;YACjB,OAAO,QAAQ,IAAI,0EAA0E,CAAC;IAClG,CAAC;AACH,CAAC;AAED;;;;GAIG;AACH,SAAgB,iBAAiB,CAAC,GAAW;IAC3C,OAAQ,sBAAwC,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,CAAE,GAAoB,CAAC,CAAC,CAAC,IAAI,CAAC;AAChG,CAAC"}

package/dist/baseline/policy.d.ts

@@ -22,7 +22,31 @@
  * Phase 3's baseline-metadata work can light them up incrementally
  * without re-shaping consumer code.
  */
+import type { BaselineMode } from './modes';
 import type { FindingSeverity, FindingStatus, MatchPair, MatchReason } from './types';
+/**
+ * Optional `baseline.*` block in `.dxkit/policy.json`. Pins the
+ * mode + (when ref-based) the comparison ref repo-wide so every
+ * developer + every CI job uses the same posture. Both fields are
+ * optional; when absent the resolver in `./modes.ts` falls back to
+ * visibility-derived defaults.
+ *
+ * Schema example:
+ *
+ *   {
+ *     "baseline": {
+ *       "mode": "ref-based",
+ *       "ref": "origin/main"
+ *     }
+ *   }
+ */
+export interface BaselineSection {
+    readonly mode?: BaselineMode;
+    /** Git ref to compare against in `ref-based` mode. When absent,
+     *  the resolver probes `origin/HEAD` and falls back to
+     *  `'origin/main'`. */
+    readonly ref?: string;
+}
 /**
  * Per-finding-kind overrides that escalate specific guardrail rules
  * beyond the generic `block` / `warn` lists. Each rule maps to a
@@ -87,6 +111,21 @@ export interface BrownfieldPolicy {
      * diff overlap) via `.dxkit/policy.json`.
      */
     readonly addedRequiresChangedLines: ReadonlyArray<string>;
+    /**
+     * Baseline-mode pinning. When absent, the resolver in `./modes.ts`
+     * falls back to visibility-derived defaults
+     * (`'public'` → `ref-based`; `'private'` / `'internal'` /
+     * `'unknown'` → `committed-full`). Customers pin this to lock the
+     * posture across all developers + CI jobs:
+     *
+     *   - `'committed-full'`: rich entries committed (default for
+     *     private repos with small teams).
+     *   - `'committed-sanitized'`: stripped entries committed
+     *     (compliance-conscious private repos).
+     *   - `'ref-based'`: no committed baseline; computed from a git
+     *     ref at check time (default for public repos).
+     */
+    readonly baseline?: BaselineSection;
 }
 /**
  * Default brownfield policy. Captures the conservative posture from
@@ -168,4 +207,29 @@ export declare function classify(pair: MatchPair, policy?: BrownfieldPolicy, con
  * envelope to fill in the fields the classifier reads.
  */
 export declare function classifyAll(pairs: ReadonlyArray<MatchPair>, policy?: BrownfieldPolicy, contextFor?: (pair: MatchPair) => ClassifyContext): ReadonlyArray<ClassifyResult>;
+/** Conventional location for a per-repo brownfield policy. Loaded
+ *  automatically by `resolvePolicy` when present. */
+export declare const DEFAULT_POLICY_FILENAME: string;
+/**
+ * Load a brownfield policy with the three-step resolution order
+ * shared by `createBaseline` and `runGuardrailCheck`:
+ *
+ *   1. `policyPath` (explicit `--policy <p>` flag). Errors if the
+ *      path is supplied but unreadable / malformed.
+ *   2. `<cwd>/.dxkit/policy.json` (conventional). Silently skipped
+ *      when absent so consumers without a policy get the defaults.
+ *   3. `DEFAULT_BROWNFIELD_POLICY` (compiled-in fallback).
+ *
+ * Customer fields shallow-merge over the default. The
+ * `confidence` / `blockRules` blocks deep-merge by key. Unknown
+ * fields are preserved — the classifier ignores what it doesn't
+ * know, so forward-compatible policy files don't break old dxkit.
+ */
+export declare function resolvePolicy(policyPath: string | undefined, cwd: string): BrownfieldPolicy;
+/**
+ * Convenience wrapper for callers that don't take a `--policy`
+ * override (e.g., `createBaseline`). Loads the conventional file if
+ * present; returns defaults otherwise.
+ */
+export declare function loadPolicyFromCwd(cwd: string): BrownfieldPolicy;
 //# sourceMappingURL=policy.d.ts.map

package/dist/baseline/policy.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"policy.d.ts","sourceRoot":"","sources":["../../src/baseline/policy.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AAEH,OAAO,KAAK,EAAE,eAAe,EAAE,aAAa,EAAE,SAAS,EAAE,WAAW,EAAE,MAAM,SAAS,CAAC;AAEtF;;;;;GAKG;AACH,MAAM,WAAW,oBAAoB;IACnC,kEAAkE;IAClE,QAAQ,CAAC,SAAS,CAAC,EAAE,OAAO,CAAC;IAC7B,4DAA4D;IAC5D,QAAQ,CAAC,mBAAmB,CAAC,EAAE,OAAO,CAAC;IACvC,iEAAiE;IACjE,QAAQ,CAAC,eAAe,CAAC,EAAE,OAAO,CAAC;IACnC,oEAAoE;IACpE,QAAQ,CAAC,kCAAkC,CAAC,EAAE,OAAO,CAAC;IACtD,mEAAmE;IACnE,QAAQ,CAAC,uCAAuC,CAAC,EAAE,OAAO,CAAC;IAC3D,qEAAqE;IACrE,QAAQ,CAAC,wBAAwB,CAAC,EAAE,OAAO,CAAC;IAC5C,wEAAwE;IACxE,QAAQ,CAAC,mCAAmC,CAAC,EAAE,OAAO,CAAC;CACxD;AAED;;;GAGG;AACH,MAAM,WAAW,gBAAgB;IAC/B,QAAQ,CAAC,IAAI,EAAE,YAAY,CAAC;IAC5B,mEAAmE;IACnE,QAAQ,CAAC,KAAK,EAAE,aAAa,CAAC,aAAa,CAAC,CAAC;IAC7C,mDAAmD;IACnD,QAAQ,CAAC,IAAI,EAAE,aAAa,CAAC,aAAa,CAAC,CAAC;IAC5C;;;;;OAKG;IACH,QAAQ,CAAC,UAAU,EAAE,QAAQ,CAAC,MAAM,CAAC,eAAe,EAAE,MAAM,CAAC,CAAC,CAAC;IAC/D,uCAAuC;IACvC,QAAQ,CAAC,UAAU,EAAE,oBAAoB,CAAC;IAC1C;;;;;;;;;;;;;;;;;;;;;OAqBG;IACH,QAAQ,CAAC,yBAAyB,EAAE,aAAa,CAAC,MAAM,CAAC,CAAC;CAC3D;AAED;;;;;;;;;;;GAWG;AACH,eAAO,MAAM,yBAAyB,EAAE,gBA0BtC,CAAC;AAEH;;;;;GAKG;AACH,MAAM,WAAW,eAAe;IAC9B,0CAA0C;IAC1C,QAAQ,CAAC,QAAQ,CAAC,EAAE,eAAe,CAAC;IACpC,sEAAsE;IACtE,QAAQ,CAAC,IAAI,CAAC,EAAE,MAAM,CAAC;IACvB;;uEAEmE;IACnE,QAAQ,CAAC,qBAAqB,CAAC,EAAE,OAAO,CAAC;IACzC;yEACqE;IACrE,QAAQ,CAAC,aAAa,CAAC,EAAE,OAAO,CAAC;IACjC;;;yDAGqD;IACrD,QAAQ,CAAC,oBAAoB,CAAC,EAAE,OAAO,CAAC;IACxC,iEAAiE;IACjE,QAAQ,CAAC,SAAS,CAAC,EAAE,OAAO,CAAC;CAC9B;AAED,mDAAmD;AACnD,MAAM,WAAW,cAAc;IAC7B,QAAQ,CAAC,MAAM,EAAE,aAAa,CAAC;IAC/B;wCACoC;IACpC,QAAQ,CAAC,MAAM,EAAE,OAAO,CAAC;IACzB,gCAAgC;IAChC,QAAQ,CAAC,KAAK,EAAE,OAAO,CAAC;IACxB;kDAC8C;IAC9C,QAAQ,CAAC,OAAO,EAAE,aAAa,CAAC,WAAW,CAAC,CAAC;CAC9C;AAED;;;;;;;;;;;;;;;;;;GAkBG;AACH,wBAAgB,QAAQ,CACtB,IAAI,EAAE,SAAS,EACf,MAAM,GAAE,gBAA4C,EACpD,OAAO,GAAE,eAAoB,GAC5B,cAAc,CAmEhB;AA0DD;;;;;;;GAOG;AACH,wBAAgB,WAAW,CACzB,KAAK,EAAE,aAAa,CAAC,SAAS,CAAC,EAC/B,MAAM,GAAE,gBAA4C,EACpD,UAAU,GAAE,CAAC,IAAI,EAAE,SAAS,KAAK,eAA4B,GAC5D,aAAa,CAAC,cAAc,CAAC,CAE/B"}
+{"version":3,"file":"policy.d.ts","sourceRoot":"","sources":["../../src/baseline/policy.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AAIH,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,SAAS,CAAC;AAC5C,OAAO,KAAK,EAAE,eAAe,EAAE,aAAa,EAAE,SAAS,EAAE,WAAW,EAAE,MAAM,SAAS,CAAC;AAEtF;;;;;;;;;;;;;;;GAeG;AACH,MAAM,WAAW,eAAe;IAC9B,QAAQ,CAAC,IAAI,CAAC,EAAE,YAAY,CAAC;IAC7B;;2BAEuB;IACvB,QAAQ,CAAC,GAAG,CAAC,EAAE,MAAM,CAAC;CACvB;AAED;;;;;GAKG;AACH,MAAM,WAAW,oBAAoB;IACnC,kEAAkE;IAClE,QAAQ,CAAC,SAAS,CAAC,EAAE,OAAO,CAAC;IAC7B,4DAA4D;IAC5D,QAAQ,CAAC,mBAAmB,CAAC,EAAE,OAAO,CAAC;IACvC,iEAAiE;IACjE,QAAQ,CAAC,eAAe,CAAC,EAAE,OAAO,CAAC;IACnC,oEAAoE;IACpE,QAAQ,CAAC,kCAAkC,CAAC,EAAE,OAAO,CAAC;IACtD,mEAAmE;IACnE,QAAQ,CAAC,uCAAuC,CAAC,EAAE,OAAO,CAAC;IAC3D,qEAAqE;IACrE,QAAQ,CAAC,wBAAwB,CAAC,EAAE,OAAO,CAAC;IAC5C,wEAAwE;IACxE,QAAQ,CAAC,mCAAmC,CAAC,EAAE,OAAO,CAAC;CACxD;AAED;;;GAGG;AACH,MAAM,WAAW,gBAAgB;IAC/B,QAAQ,CAAC,IAAI,EAAE,YAAY,CAAC;IAC5B,mEAAmE;IACnE,QAAQ,CAAC,KAAK,EAAE,aAAa,CAAC,aAAa,CAAC,CAAC;IAC7C,mDAAmD;IACnD,QAAQ,CAAC,IAAI,EAAE,aAAa,CAAC,aAAa,CAAC,CAAC;IAC5C;;;;;OAKG;IACH,QAAQ,CAAC,UAAU,EAAE,QAAQ,CAAC,MAAM,CAAC,eAAe,EAAE,MAAM,CAAC,CAAC,CAAC;IAC/D,uCAAuC;IACvC,QAAQ,CAAC,UAAU,EAAE,oBAAoB,CAAC;IAC1C;;;;;;;;;;;;;;;;;;;;;OAqBG;IACH,QAAQ,CAAC,yBAAyB,EAAE,aAAa,CAAC,MAAM,CAAC,CAAC;IAC1D;;;;;;;;;;;;;OAaG;IACH,QAAQ,CAAC,QAAQ,CAAC,EAAE,eAAe,CAAC;CACrC;AAED;;;;;;;;;;;GAWG;AACH,eAAO,MAAM,yBAAyB,EAAE,gBA0BtC,CAAC;AAEH;;;;;GAKG;AACH,MAAM,WAAW,eAAe;IAC9B,0CAA0C;IAC1C,QAAQ,CAAC,QAAQ,CAAC,EAAE,eAAe,CAAC;IACpC,sEAAsE;IACtE,QAAQ,CAAC,IAAI,CAAC,EAAE,MAAM,CAAC;IACvB;;uEAEmE;IACnE,QAAQ,CAAC,qBAAqB,CAAC,EAAE,OAAO,CAAC;IACzC;yEACqE;IACrE,QAAQ,CAAC,aAAa,CAAC,EAAE,OAAO,CAAC;IACjC;;;yDAGqD;IACrD,QAAQ,CAAC,oBAAoB,CAAC,EAAE,OAAO,CAAC;IACxC,iEAAiE;IACjE,QAAQ,CAAC,SAAS,CAAC,EAAE,OAAO,CAAC;CAC9B;AAED,mDAAmD;AACnD,MAAM,WAAW,cAAc;IAC7B,QAAQ,CAAC,MAAM,EAAE,aAAa,CAAC;IAC/B;wCACoC;IACpC,QAAQ,CAAC,MAAM,EAAE,OAAO,CAAC;IACzB,gCAAgC;IAChC,QAAQ,CAAC,KAAK,EAAE,OAAO,CAAC;IACxB;kDAC8C;IAC9C,QAAQ,CAAC,OAAO,EAAE,aAAa,CAAC,WAAW,CAAC,CAAC;CAC9C;AAED;;;;;;;;;;;;;;;;;;GAkBG;AACH,wBAAgB,QAAQ,CACtB,IAAI,EAAE,SAAS,EACf,MAAM,GAAE,gBAA4C,EACpD,OAAO,GAAE,eAAoB,GAC5B,cAAc,CAmEhB;AA0DD;;;;;;;GAOG;AACH,wBAAgB,WAAW,CACzB,KAAK,EAAE,aAAa,CAAC,SAAS,CAAC,EAC/B,MAAM,GAAE,gBAA4C,EACpD,UAAU,GAAE,CAAC,IAAI,EAAE,SAAS,KAAK,eAA4B,GAC5D,aAAa,CAAC,cAAc,CAAC,CAE/B;AAED;qDACqD;AACrD,eAAO,MAAM,uBAAuB,QAAqC,CAAC;AAE1E;;;;;;;;;;;;;;GAcG;AACH,wBAAgB,aAAa,CAAC,UAAU,EAAE,MAAM,GAAG,SAAS,EAAE,GAAG,EAAE,MAAM,GAAG,gBAAgB,CAkC3F;AAED;;;;GAIG;AACH,wBAAgB,iBAAiB,CAAC,GAAG,EAAE,MAAM,GAAG,gBAAgB,CAE/D"}