@vyuhlabs/dxkit 2.5.2 → 2.7.0

package/dist/allowlist/categories.d.ts

@@ -0,0 +1,120 @@
+/**
+ * Allowlist category taxonomy. Single source of truth for:
+ *   - Which categories exist
+ *   - Which categories require an expiry date
+ *   - Which categories may be expressed via inline source annotation
+ *   - Which categories apply to each `IdentityKind`
+ *   - Which finding kinds support inline annotations at all
+ *
+ * Pure module — no I/O, no analyzer dependencies. Consumed by the
+ * allowlist file reader/writer, the inline-annotation parser, the
+ * CLI, the block-time hint formatter, and the new `allowlistHits`
+ * baseline producer.
+ *
+ * See tmp/2.6-allowlist-design.md for the design discussion.
+ */
+import type { IdentityKind } from '../baseline/producers';
+/**
+ * Single source of truth for category values. The `AllowlistCategory`
+ * union type is derived from this array via `(typeof ...)[number]`,
+ * so adding a new category means appending one string here and every
+ * type-level check (Record-keyed tables, switch exhaustiveness,
+ * function parameter types) auto-updates. No two-place drift.
+ */
+export declare const ALL_CATEGORIES: readonly ["false-positive", "test-fixture", "mitigated-externally", "accepted-risk", "deferred"];
+export type AllowlistCategory = (typeof ALL_CATEGORIES)[number];
+/**
+ * Categories that REQUIRE a finite expiry date. The file-level
+ * allowlist write-path rejects entries in these categories without
+ * an `expiresAt`. The CLI defaults `expiresAt` to 90 days out for
+ * these — see `defaultExpiryDate`.
+ *
+ * Categories OUTSIDE this set represent stable assertions about the
+ * code that don't naturally stale (a test fixture remains a test
+ * fixture; a false positive remains a false positive until the
+ * scanner rule changes). They may carry an `expiresAt` if the
+ * customer chooses, but it's not enforced.
+ */
+export declare const EXPIRING_CATEGORIES: ReadonlySet<AllowlistCategory>;
+/**
+ * Categories that may be expressed via inline source annotation
+ * (`// dxkit-allow:<category> reason="..."`). The complement
+ * (`accepted-risk`, `deferred`) is file-only because those categories
+ * need fields (expiresAt, acknowledgedSeverity) that don't fit
+ * cleanly into a code comment.
+ */
+export declare const INLINE_COMPATIBLE_CATEGORIES: ReadonlySet<AllowlistCategory>;
+/**
+ * Finding kinds that have a stable single-line attachment point and
+ * therefore support inline annotations. Kinds outside this set are
+ * file-only (whole-file findings, cross-file findings, gap findings).
+ *
+ * Inline-compatible:
+ *   - `secret` / `secret-hmac`: the source line is the credential
+ *   - `code` / `config`: the source line is the flagged pattern
+ *   - `dep-vuln`: annotate the import or first-use line
+ *   - `hygiene`: the source line carries the TODO/FIXME/HACK marker
+ *
+ * File-only (no single-line site):
+ *   - `duplication`: two locations across files
+ *   - `coverage-gap` / `test-gap` / `test-file-degradation`: file or
+ *     symbol-range level, not single-line
+ *   - `god-file` / `large-file` / `stale-file`: whole-file findings
+ */
+export declare const INLINE_COMPATIBLE_KINDS: ReadonlySet<IdentityKind>;
+/**
+ * Categories applicable to each `IdentityKind`. Reflects what
+ * suppression rationales the kind can plausibly carry — a
+ * `coverage-gap` is rarely a "false positive" in the same way a
+ * scanner finding is; a `dep-vuln` is rarely a "test fixture."
+ *
+ * The CLI presents the applicable list as a multiple-choice prompt
+ * when the customer runs `vyuh-dxkit allowlist add` against a
+ * finding.
+ *
+ * The `Record<IdentityKind, ...>` ties this table to the canonical
+ * union: TypeScript fails the build when a new `IdentityKind`
+ * variant lands without a corresponding entry here.
+ */
+export declare const CATEGORIES_BY_KIND: Readonly<Record<IdentityKind, readonly AllowlistCategory[]>>;
+/**
+ * Whether a (kind, category) tuple may be expressed as an inline
+ * annotation. Both the kind AND the category must be inline-compatible.
+ *
+ * Examples:
+ *   canUseInline('secret', 'test-fixture')      // true
+ *   canUseInline('secret', 'accepted-risk')     // false (category file-only)
+ *   canUseInline('large-file', 'false-positive') // false (kind file-only)
+ *   canUseInline('hygiene', 'accepted-risk')    // false (category file-only)
+ */
+export declare function canUseInline(kind: IdentityKind, category: AllowlistCategory): boolean;
+/**
+ * Whether a category requires `expiresAt` on the file-level entry.
+ * Source of truth for the write-path validation rule.
+ */
+export declare function requiresExpiry(category: AllowlistCategory): boolean;
+/**
+ * Whether a (kind, category) tuple is semantically valid. The CLI
+ * uses this to reject incoherent combinations like
+ * `coverage-gap + false-positive` with a clear error pointing at
+ * the applicable categories for that kind.
+ */
+export declare function isCategoryValidForKind(kind: IdentityKind, category: AllowlistCategory): boolean;
+/**
+ * Number of days into the future the CLI defaults `expiresAt` to
+ * when the customer doesn't specify one. Locked at 90 in Sprint 0
+ * (Snyk + Dependabot industry default). Per-category overrides will
+ * land in `.dxkit/policy.json` (`allowlist.defaultExpiryDays`) in a
+ * follow-up commit if real customer signal demands it.
+ */
+export declare const DEFAULT_EXPIRY_DAYS = 90;
+/**
+ * Compute the default expiry date as an ISO `YYYY-MM-DD` string,
+ * `DEFAULT_EXPIRY_DAYS` from `now`. UTC-anchored to keep the date
+ * stable across timezone-different developers on the same team.
+ *
+ * `now` is injected for deterministic testing — production callers
+ * pass `new Date()` (the default).
+ */
+export declare function defaultExpiryDate(now?: Date): string;
+//# sourceMappingURL=categories.d.ts.map

package/dist/allowlist/categories.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"categories.d.ts","sourceRoot":"","sources":["../../src/allowlist/categories.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AAEH,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,uBAAuB,CAAC;AAE1D;;;;;;GAMG;AACH,eAAO,MAAM,cAAc,kGAMjB,CAAC;AAEX,MAAM,MAAM,iBAAiB,GAAG,CAAC,OAAO,cAAc,CAAC,CAAC,MAAM,CAAC,CAAC;AAEhE;;;;;;;;;;;GAWG;AACH,eAAO,MAAM,mBAAmB,EAAE,WAAW,CAAC,iBAAiB,CAG7D,CAAC;AAEH;;;;;;GAMG;AACH,eAAO,MAAM,4BAA4B,EAAE,WAAW,CAAC,iBAAiB,CAItE,CAAC;AAEH;;;;;;;;;;;;;;;;GAgBG;AACH,eAAO,MAAM,uBAAuB,EAAE,WAAW,CAAC,YAAY,CAO5D,CAAC;AAEH;;;;;;;;;;;;;GAaG;AACH,eAAO,MAAM,kBAAkB,EAAE,QAAQ,CAAC,MAAM,CAAC,YAAY,EAAE,SAAS,iBAAiB,EAAE,CAAC,CA6C3F,CAAC;AAEF;;;;;;;;;GASG;AACH,wBAAgB,YAAY,CAAC,IAAI,EAAE,YAAY,EAAE,QAAQ,EAAE,iBAAiB,GAAG,OAAO,CAErF;AAED;;;GAGG;AACH,wBAAgB,cAAc,CAAC,QAAQ,EAAE,iBAAiB,GAAG,OAAO,CAEnE;AAED;;;;;GAKG;AACH,wBAAgB,sBAAsB,CAAC,IAAI,EAAE,YAAY,EAAE,QAAQ,EAAE,iBAAiB,GAAG,OAAO,CAE/F;AAED;;;;;;GAMG;AACH,eAAO,MAAM,mBAAmB,KAAK,CAAC;AAEtC;;;;;;;GAOG;AACH,wBAAgB,iBAAiB,CAAC,GAAG,GAAE,IAAiB,GAAG,MAAM,CAIhE"}

package/dist/allowlist/categories.js

@@ -0,0 +1,194 @@
+"use strict";
+/**
+ * Allowlist category taxonomy. Single source of truth for:
+ *   - Which categories exist
+ *   - Which categories require an expiry date
+ *   - Which categories may be expressed via inline source annotation
+ *   - Which categories apply to each `IdentityKind`
+ *   - Which finding kinds support inline annotations at all
+ *
+ * Pure module — no I/O, no analyzer dependencies. Consumed by the
+ * allowlist file reader/writer, the inline-annotation parser, the
+ * CLI, the block-time hint formatter, and the new `allowlistHits`
+ * baseline producer.
+ *
+ * See tmp/2.6-allowlist-design.md for the design discussion.
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.DEFAULT_EXPIRY_DAYS = exports.CATEGORIES_BY_KIND = exports.INLINE_COMPATIBLE_KINDS = exports.INLINE_COMPATIBLE_CATEGORIES = exports.EXPIRING_CATEGORIES = exports.ALL_CATEGORIES = void 0;
+exports.canUseInline = canUseInline;
+exports.requiresExpiry = requiresExpiry;
+exports.isCategoryValidForKind = isCategoryValidForKind;
+exports.defaultExpiryDate = defaultExpiryDate;
+/**
+ * Single source of truth for category values. The `AllowlistCategory`
+ * union type is derived from this array via `(typeof ...)[number]`,
+ * so adding a new category means appending one string here and every
+ * type-level check (Record-keyed tables, switch exhaustiveness,
+ * function parameter types) auto-updates. No two-place drift.
+ */
+exports.ALL_CATEGORIES = [
+    'false-positive',
+    'test-fixture',
+    'mitigated-externally',
+    'accepted-risk',
+    'deferred',
+];
+/**
+ * Categories that REQUIRE a finite expiry date. The file-level
+ * allowlist write-path rejects entries in these categories without
+ * an `expiresAt`. The CLI defaults `expiresAt` to 90 days out for
+ * these — see `defaultExpiryDate`.
+ *
+ * Categories OUTSIDE this set represent stable assertions about the
+ * code that don't naturally stale (a test fixture remains a test
+ * fixture; a false positive remains a false positive until the
+ * scanner rule changes). They may carry an `expiresAt` if the
+ * customer chooses, but it's not enforced.
+ */
+exports.EXPIRING_CATEGORIES = new Set([
+    'accepted-risk',
+    'deferred',
+]);
+/**
+ * Categories that may be expressed via inline source annotation
+ * (`// dxkit-allow:<category> reason="..."`). The complement
+ * (`accepted-risk`, `deferred`) is file-only because those categories
+ * need fields (expiresAt, acknowledgedSeverity) that don't fit
+ * cleanly into a code comment.
+ */
+exports.INLINE_COMPATIBLE_CATEGORIES = new Set([
+    'false-positive',
+    'test-fixture',
+    'mitigated-externally',
+]);
+/**
+ * Finding kinds that have a stable single-line attachment point and
+ * therefore support inline annotations. Kinds outside this set are
+ * file-only (whole-file findings, cross-file findings, gap findings).
+ *
+ * Inline-compatible:
+ *   - `secret` / `secret-hmac`: the source line is the credential
+ *   - `code` / `config`: the source line is the flagged pattern
+ *   - `dep-vuln`: annotate the import or first-use line
+ *   - `hygiene`: the source line carries the TODO/FIXME/HACK marker
+ *
+ * File-only (no single-line site):
+ *   - `duplication`: two locations across files
+ *   - `coverage-gap` / `test-gap` / `test-file-degradation`: file or
+ *     symbol-range level, not single-line
+ *   - `god-file` / `large-file` / `stale-file`: whole-file findings
+ */
+exports.INLINE_COMPATIBLE_KINDS = new Set([
+    'secret',
+    'secret-hmac',
+    'code',
+    'config',
+    'dep-vuln',
+    'hygiene',
+]);
+/**
+ * Categories applicable to each `IdentityKind`. Reflects what
+ * suppression rationales the kind can plausibly carry — a
+ * `coverage-gap` is rarely a "false positive" in the same way a
+ * scanner finding is; a `dep-vuln` is rarely a "test fixture."
+ *
+ * The CLI presents the applicable list as a multiple-choice prompt
+ * when the customer runs `vyuh-dxkit allowlist add` against a
+ * finding.
+ *
+ * The `Record<IdentityKind, ...>` ties this table to the canonical
+ * union: TypeScript fails the build when a new `IdentityKind`
+ * variant lands without a corresponding entry here.
+ */
+exports.CATEGORIES_BY_KIND = {
+    // Source-level security findings: every category applies
+    secret: ['false-positive', 'test-fixture', 'mitigated-externally', 'accepted-risk', 'deferred'],
+    'secret-hmac': [
+        'false-positive',
+        'test-fixture',
+        'mitigated-externally',
+        'accepted-risk',
+        'deferred',
+    ],
+    code: ['false-positive', 'test-fixture', 'mitigated-externally', 'accepted-risk', 'deferred'],
+    config: ['false-positive', 'test-fixture', 'mitigated-externally', 'accepted-risk', 'deferred'],
+    // Dependency vulnerabilities: rarely a test fixture (the dep is real);
+    // every other category applies
+    'dep-vuln': ['false-positive', 'mitigated-externally', 'accepted-risk', 'deferred'],
+    // Duplicate blocks: occasionally a false positive (jscpd matched
+    // generated code); otherwise accepted-risk or deferred
+    duplication: ['false-positive', 'accepted-risk', 'deferred'],
+    // Coverage / test gaps: not "false-positive" in any practical sense;
+    // only accepted-risk or deferred
+    'coverage-gap': ['accepted-risk', 'deferred'],
+    'test-gap': ['accepted-risk', 'deferred'],
+    'test-file-degradation': ['accepted-risk', 'deferred'],
+    // Whole-file findings: false-positive (file IS not actually large /
+    // stale / god when reviewed); otherwise accepted-risk or deferred
+    'god-file': ['false-positive', 'accepted-risk', 'deferred'],
+    'large-file': ['false-positive', 'accepted-risk', 'deferred'],
+    'stale-file': ['false-positive', 'accepted-risk', 'deferred'],
+    // TODO / FIXME / HACK / console-log / any-type markers: only
+    // accepted-risk or deferred (the marker IS the hygiene issue)
+    hygiene: ['accepted-risk', 'deferred'],
+    // Stale-allow (orphaned inline allowlist annotation): never
+    // allowlisted. The right response is always "remove the stale
+    // annotation" — allowlisting the warning that an annotation is
+    // stale would defeat the entire strict-stale-detection model
+    // (TypeScript's @ts-expect-error pattern). Empty array means the
+    // CLI rejects with a hint pointing at the annotation's source
+    // location.
+    'stale-allow': [],
+};
+/**
+ * Whether a (kind, category) tuple may be expressed as an inline
+ * annotation. Both the kind AND the category must be inline-compatible.
+ *
+ * Examples:
+ *   canUseInline('secret', 'test-fixture')      // true
+ *   canUseInline('secret', 'accepted-risk')     // false (category file-only)
+ *   canUseInline('large-file', 'false-positive') // false (kind file-only)
+ *   canUseInline('hygiene', 'accepted-risk')    // false (category file-only)
+ */
+function canUseInline(kind, category) {
+    return exports.INLINE_COMPATIBLE_KINDS.has(kind) && exports.INLINE_COMPATIBLE_CATEGORIES.has(category);
+}
+/**
+ * Whether a category requires `expiresAt` on the file-level entry.
+ * Source of truth for the write-path validation rule.
+ */
+function requiresExpiry(category) {
+    return exports.EXPIRING_CATEGORIES.has(category);
+}
+/**
+ * Whether a (kind, category) tuple is semantically valid. The CLI
+ * uses this to reject incoherent combinations like
+ * `coverage-gap + false-positive` with a clear error pointing at
+ * the applicable categories for that kind.
+ */
+function isCategoryValidForKind(kind, category) {
+    return exports.CATEGORIES_BY_KIND[kind].includes(category);
+}
+/**
+ * Number of days into the future the CLI defaults `expiresAt` to
+ * when the customer doesn't specify one. Locked at 90 in Sprint 0
+ * (Snyk + Dependabot industry default). Per-category overrides will
+ * land in `.dxkit/policy.json` (`allowlist.defaultExpiryDays`) in a
+ * follow-up commit if real customer signal demands it.
+ */
+exports.DEFAULT_EXPIRY_DAYS = 90;
+/**
+ * Compute the default expiry date as an ISO `YYYY-MM-DD` string,
+ * `DEFAULT_EXPIRY_DAYS` from `now`. UTC-anchored to keep the date
+ * stable across timezone-different developers on the same team.
+ *
+ * `now` is injected for deterministic testing — production callers
+ * pass `new Date()` (the default).
+ */
+function defaultExpiryDate(now = new Date()) {
+    const expires = new Date(now);
+    expires.setUTCDate(expires.getUTCDate() + exports.DEFAULT_EXPIRY_DAYS);
+    return expires.toISOString().slice(0, 10);
+}
+//# sourceMappingURL=categories.js.map

package/dist/allowlist/categories.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"categories.js","sourceRoot":"","sources":["../../src/allowlist/categories.ts"],"names":[],"mappings":";AAAA;;;;;;;;;;;;;;GAcG;;;AAoJH,oCAEC;AAMD,wCAEC;AAQD,wDAEC;AAmBD,8CAIC;AA3LD;;;;;;GAMG;AACU,QAAA,cAAc,GAAG;IAC5B,gBAAgB;IAChB,cAAc;IACd,sBAAsB;IACtB,eAAe;IACf,UAAU;CACF,CAAC;AAIX;;;;;;;;;;;GAWG;AACU,QAAA,mBAAmB,GAAmC,IAAI,GAAG,CAAC;IACzE,eAAe;IACf,UAAU;CACX,CAAC,CAAC;AAEH;;;;;;GAMG;AACU,QAAA,4BAA4B,GAAmC,IAAI,GAAG,CAAC;IAClF,gBAAgB;IAChB,cAAc;IACd,sBAAsB;CACvB,CAAC,CAAC;AAEH;;;;;;;;;;;;;;;;GAgBG;AACU,QAAA,uBAAuB,GAA8B,IAAI,GAAG,CAAe;IACtF,QAAQ;IACR,aAAa;IACb,MAAM;IACN,QAAQ;IACR,UAAU;IACV,SAAS;CACV,CAAC,CAAC;AAEH;;;;;;;;;;;;;GAaG;AACU,QAAA,kBAAkB,GAAiE;IAC9F,yDAAyD;IACzD,MAAM,EAAE,CAAC,gBAAgB,EAAE,cAAc,EAAE,sBAAsB,EAAE,eAAe,EAAE,UAAU,CAAC;IAC/F,aAAa,EAAE;QACb,gBAAgB;QAChB,cAAc;QACd,sBAAsB;QACtB,eAAe;QACf,UAAU;KACX;IACD,IAAI,EAAE,CAAC,gBAAgB,EAAE,cAAc,EAAE,sBAAsB,EAAE,eAAe,EAAE,UAAU,CAAC;IAC7F,MAAM,EAAE,CAAC,gBAAgB,EAAE,cAAc,EAAE,sBAAsB,EAAE,eAAe,EAAE,UAAU,CAAC;IAE/F,uEAAuE;IACvE,+BAA+B;IAC/B,UAAU,EAAE,CAAC,gBAAgB,EAAE,sBAAsB,EAAE,eAAe,EAAE,UAAU,CAAC;IAEnF,iEAAiE;IACjE,uDAAuD;IACvD,WAAW,EAAE,CAAC,gBAAgB,EAAE,eAAe,EAAE,UAAU,CAAC;IAE5D,qEAAqE;IACrE,iCAAiC;IACjC,cAAc,EAAE,CAAC,eAAe,EAAE,UAAU,CAAC;IAC7C,UAAU,EAAE,CAAC,eAAe,EAAE,UAAU,CAAC;IACzC,uBAAuB,EAAE,CAAC,eAAe,EAAE,UAAU,CAAC;IAEtD,oEAAoE;IACpE,kEAAkE;IAClE,UAAU,EAAE,CAAC,gBAAgB,EAAE,eAAe,EAAE,UAAU,CAAC;IAC3D,YAAY,EAAE,CAAC,gBAAgB,EAAE,eAAe,EAAE,UAAU,CAAC;IAC7D,YAAY,EAAE,CAAC,gBAAgB,EAAE,eAAe,EAAE,UAAU,CAAC;IAE7D,6DAA6D;IAC7D,8DAA8D;IAC9D,OAAO,EAAE,CAAC,eAAe,EAAE,UAAU,CAAC;IAEtC,4DAA4D;IAC5D,8DAA8D;IAC9D,+DAA+D;IAC/D,6DAA6D;IAC7D,iEAAiE;IACjE,8DAA8D;IAC9D,YAAY;IACZ,aAAa,EAAE,EAAE;CAClB,CAAC;AAEF;;;;;;;;;GASG;AACH,SAAgB,YAAY,CAAC,IAAkB,EAAE,QAA2B;IAC1E,OAAO,+BAAuB,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,oCAA4B,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;AACzF,CAAC;AAED;;;GAGG;AACH,SAAgB,cAAc,CAAC,QAA2B;IACxD,OAAO,2BAAmB,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;AAC3C,CAAC;AAED;;;;;GAKG;AACH,SAAgB,sBAAsB,CAAC,IAAkB,EAAE,QAA2B;IACpF,OAAO,0BAAkB,CAAC,IAAI,CAAC,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC;AACrD,CAAC;AAED;;;;;;GAMG;AACU,QAAA,mBAAmB,GAAG,EAAE,CAAC;AAEtC;;;;;;;GAOG;AACH,SAAgB,iBAAiB,CAAC,MAAY,IAAI,IAAI,EAAE;IACtD,MAAM,OAAO,GAAG,IAAI,IAAI,CAAC,GAAG,CAAC,CAAC;IAC9B,OAAO,CAAC,UAAU,CAAC,OAAO,CAAC,UAAU,EAAE,GAAG,2BAAmB,CAAC,CAAC;IAC/D,OAAO,OAAO,CAAC,WAAW,EAAE,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;AAC5C,CAAC"}

package/dist/allowlist/cli.d.ts

@@ -0,0 +1,95 @@
+/**
+ * `vyuh-dxkit allowlist <subcommand>` — orchestrates the user-facing
+ * write/read paths over the allowlist module.
+ *
+ * Subcommands (Sprint 1 chunk):
+ *
+ *   - `add <file>:<line>` — inline annotation insertion. Kind-agnostic;
+ *     the annotation grammar carries category + reason only. Refuses
+ *     non-inline-compatible categories (accepted-risk / deferred).
+ *
+ *   - `add --fingerprint=<id> --kind=<kind>` — file-level allowlist
+ *     entry. Persists to `.dxkit/allowlist.json` (or its sanitized
+ *     mode + gitignored reasons sidecar). Required for any
+ *     accepted-risk / deferred suppression OR any kind that lacks a
+ *     stable single-line attachment point.
+ *
+ *   - `list` — print every entry across the file-level allowlist.
+ *     Reads only; no mutation. Honors `--json` for structured output.
+ *
+ *   - `show <fingerprint>` — print one entry's full detail. Falls
+ *     back to a "no entry found" message when the fingerprint isn't
+ *     present.
+ *
+ * Subcommands `audit` and `prune` land in a follow-up commit.
+ *
+ * # Architectural posture
+ *
+ * Every IO goes through `loadAllowlist` / `saveAllowlist` in
+ * `src/allowlist/file.ts` (arch-rule 1 enforces this). Inline
+ * annotation insertion goes through `insertAnnotation` in
+ * `src/allowlist/inline.ts`. Per-kind / per-category validation
+ * goes through `categories.ts` helpers. NO duplicated taxonomy or
+ * IO logic here — this file is pure orchestration.
+ */
+import { DEFAULT_EXPIRY_DAYS } from './categories';
+import { ALLOWLIST_FILENAME, type AllowlistMode } from './file';
+/** Subcommands recognized under `vyuh-dxkit allowlist`. */
+export declare const ALLOWLIST_SUBCOMMANDS: readonly ["add", "list", "show", "audit", "prune"];
+export type AllowlistSubcommand = (typeof ALLOWLIST_SUBCOMMANDS)[number];
+export interface AllowlistAddOpts {
+    /** Positional target. `<file>:<line>` for inline form; absent or a
+     *  bare file path for file-level form (requires `--fingerprint`
+     *  + `--kind`). */
+    readonly target?: string;
+    readonly category?: string;
+    readonly reason?: string;
+    readonly kind?: string;
+    readonly fingerprint?: string;
+    readonly expires?: string;
+    readonly acknowledgedSeverity?: string;
+    readonly addedBy?: string;
+    /** Override the configured mode for this write only. Default
+     *  reads from `.dxkit/policy.json` (out of scope here; this
+     *  module accepts a flag to choose). */
+    readonly mode?: AllowlistMode;
+}
+export interface AllowlistShowOpts {
+    readonly fingerprint?: string;
+    readonly json?: boolean;
+}
+export interface AllowlistListOpts {
+    readonly json?: boolean;
+}
+export interface AllowlistAuditOpts {
+    readonly json?: boolean;
+    /** Soon-to-expire horizon in days (default 14). */
+    readonly soonToExpireDays?: number;
+}
+export interface AllowlistPruneOpts {
+    readonly json?: boolean;
+    /** Don't write; just print what would be removed. */
+    readonly dryRun?: boolean;
+    /** Skip confirmation prompt + write directly. Default behavior
+     *  in Sprint 1 (no interactive prompts in dxkit yet) — the flag
+     *  is accepted for future-proofing. */
+    readonly yes?: boolean;
+}
+/**
+ * Dispatch entry point called from `src/cli.ts`. Validates the
+ * subcommand name + routes to the per-subcommand handler. Unknown
+ * subcommands exit with a clear error and the list of recognized
+ * names.
+ */
+export declare function runAllowlist(cwd: string, subcommand: string | undefined, args: {
+    positionalAfter?: string;
+    values: Record<string, unknown>;
+}): Promise<void>;
+export declare function runAllowlistAdd(cwd: string, opts: AllowlistAddOpts): Promise<void>;
+export declare function runAllowlistList(cwd: string, opts: AllowlistListOpts): Promise<void>;
+export declare function runAllowlistShow(cwd: string, opts: AllowlistShowOpts): Promise<void>;
+export declare function runAllowlistAudit(cwd: string, opts: AllowlistAuditOpts): Promise<void>;
+export declare function runAllowlistPrune(cwd: string, opts: AllowlistPruneOpts): Promise<void>;
+export { DEFAULT_EXPIRY_DAYS };
+export { ALLOWLIST_FILENAME };
+//# sourceMappingURL=cli.d.ts.map

package/dist/allowlist/cli.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"cli.d.ts","sourceRoot":"","sources":["../../src/allowlist/cli.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAiCG;AASH,OAAO,EAEL,mBAAmB,EAMpB,MAAM,cAAc,CAAC;AACtB,OAAO,EACL,kBAAkB,EAalB,KAAK,aAAa,EAEnB,MAAM,QAAQ,CAAC;AAGhB,2DAA2D;AAC3D,eAAO,MAAM,qBAAqB,oDAAqD,CAAC;AACxF,MAAM,MAAM,mBAAmB,GAAG,CAAC,OAAO,qBAAqB,CAAC,CAAC,MAAM,CAAC,CAAC;AAEzE,MAAM,WAAW,gBAAgB;IAC/B;;uBAEmB;IACnB,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,IAAI,CAAC,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,WAAW,CAAC,EAAE,MAAM,CAAC;IAC9B,QAAQ,CAAC,OAAO,CAAC,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,oBAAoB,CAAC,EAAE,MAAM,CAAC;IACvC,QAAQ,CAAC,OAAO,CAAC,EAAE,MAAM,CAAC;IAC1B;;4CAEwC;IACxC,QAAQ,CAAC,IAAI,CAAC,EAAE,aAAa,CAAC;CAC/B;AAED,MAAM,WAAW,iBAAiB;IAChC,QAAQ,CAAC,WAAW,CAAC,EAAE,MAAM,CAAC;IAC9B,QAAQ,CAAC,IAAI,CAAC,EAAE,OAAO,CAAC;CACzB;AAED,MAAM,WAAW,iBAAiB;IAChC,QAAQ,CAAC,IAAI,CAAC,EAAE,OAAO,CAAC;CACzB;AAED,MAAM,WAAW,kBAAkB;IACjC,QAAQ,CAAC,IAAI,CAAC,EAAE,OAAO,CAAC;IACxB,mDAAmD;IACnD,QAAQ,CAAC,gBAAgB,CAAC,EAAE,MAAM,CAAC;CACpC;AAED,MAAM,WAAW,kBAAkB;IACjC,QAAQ,CAAC,IAAI,CAAC,EAAE,OAAO,CAAC;IACxB,qDAAqD;IACrD,QAAQ,CAAC,MAAM,CAAC,EAAE,OAAO,CAAC;IAC1B;;2CAEuC;IACvC,QAAQ,CAAC,GAAG,CAAC,EAAE,OAAO,CAAC;CACxB;AAED;;;;;GAKG;AACH,wBAAsB,YAAY,CAChC,GAAG,EAAE,MAAM,EACX,UAAU,EAAE,MAAM,GAAG,SAAS,EAC9B,IAAI,EAAE;IACJ,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CACjC,GACA,OAAO,CAAC,IAAI,CAAC,CA4Cf;AAID,wBAAsB,eAAe,CAAC,GAAG,EAAE,MAAM,EAAE,IAAI,EAAE,gBAAgB,GAAG,OAAO,CAAC,IAAI,CAAC,CAqBxF;AAyHD,wBAAsB,gBAAgB,CAAC,GAAG,EAAE,MAAM,EAAE,IAAI,EAAE,iBAAiB,GAAG,OAAO,CAAC,IAAI,CAAC,CAuB1F;AAID,wBAAsB,gBAAgB,CAAC,GAAG,EAAE,MAAM,EAAE,IAAI,EAAE,iBAAiB,GAAG,OAAO,CAAC,IAAI,CAAC,CA8B1F;AAID,wBAAsB,iBAAiB,CAAC,GAAG,EAAE,MAAM,EAAE,IAAI,EAAE,kBAAkB,GAAG,OAAO,CAAC,IAAI,CAAC,CAsE5F;AAID,wBAAsB,iBAAiB,CAAC,GAAG,EAAE,MAAM,EAAE,IAAI,EAAE,kBAAkB,GAAG,OAAO,CAAC,IAAI,CAAC,CAmC5F;AAuGD,OAAO,EAAE,mBAAmB,EAAE,CAAC;AAG/B,OAAO,EAAE,kBAAkB,EAAE,CAAC"}