@vyuhlabs/dxkit 2.9.4 → 2.11.0

package/dist/baseline/migrate.js

@@ -0,0 +1,238 @@
+"use strict";
+/**
+ * Identity-scheme migrator — carries a repo's baseline + allowlist across
+ * a finding-identity scheme change so an upgrade is a single command
+ * instead of a manual re-baseline + re-allowlist.
+ *
+ * The mechanism rests on two properties:
+ *
+ *   1. `identityFor` can compute ANY shipped scheme (see
+ *      `finding-identity.ts`), so for each current finding we can derive
+ *      both its OLD-scheme id and its NEW-scheme id.
+ *   2. A current scan's baseline entries already carry the NEW (current)
+ *      scheme id; recomputing the OLD id from each entry's metadata yields
+ *      an `old → new` remap built from one scan, with no dependency on the
+ *      stale artifact's stored ids.
+ *
+ * From that remap we:
+ *   - rewrite the allowlist's `fingerprint`s onto the new scheme
+ *     (preserving every reviewed suppression decision), and
+ *   - regenerate the baseline with fresh new-scheme ids.
+ *
+ * Allowlist entries whose fingerprint matches neither the remap NOR a
+ * current finding's id are surfaced as `unmapped` (the finding they
+ * suppressed is gone — already-stale entries), never silently dropped.
+ *
+ * This is general across schemes: only the version-VARYING finding kinds
+ * change id between two schemes (everything else maps to itself and is
+ * left untouched), and `identityFor` + the retained prior-scheme id
+ * functions handle any `from → to` pair. A future scheme needs no new
+ * wiring here.
+ */
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.baselineEntryToIdentityInput = baselineEntryToIdentityInput;
+exports.buildIdentityRemap = buildIdentityRemap;
+exports.detectStaleScheme = detectStaleScheme;
+exports.migrateIdentity = migrateIdentity;
+const fs = __importStar(require("fs"));
+const create_1 = require("./create");
+const baseline_file_1 = require("./baseline-file");
+const finding_identity_1 = require("./finding-identity");
+const sanitize_1 = require("./sanitize");
+const types_1 = require("./types");
+const file_1 = require("../allowlist/file");
+/**
+ * Reconstruct the `IdentityInput` a baseline entry was minted from, so its
+ * id can be recomputed under a different scheme. Fidelity is sufficient to
+ * reproduce any scheme's id: `contentAnchor` is intentionally omitted —
+ * only the v2 code/secret path consumes it, and an entry's stored `id`
+ * already IS its current-scheme id (we never recompute the current id, only
+ * the prior one, which no scheme derives from the anchor). Returns
+ * `undefined` for sanitized entries (identity-only, no metadata).
+ */
+function baselineEntryToIdentityInput(entry) {
+    if ((0, sanitize_1.isSanitized)(entry))
+        return undefined;
+    const e = entry;
+    switch (e.kind) {
+        case 'secret':
+        case 'code':
+        case 'config':
+            return { kind: e.kind, tool: e.tool, rule: e.rule, file: e.file, line: e.line };
+        case 'dep-vuln':
+            return {
+                kind: 'dep-vuln',
+                package: e.package,
+                installedVersion: e.installedVersion,
+                id: e.advisoryId,
+            };
+        case 'duplication':
+            return {
+                kind: 'duplication',
+                fileA: e.fileA,
+                fileB: e.fileB,
+                lines: e.lines,
+                startLineA: e.startLineA,
+                startLineB: e.startLineB,
+            };
+        case 'coverage-gap':
+            return { kind: 'coverage-gap', file: e.file, symbol: e.symbol, lineRange: e.lineRange };
+        case 'test-gap':
+            return { kind: 'test-gap', file: e.file, risk: e.risk };
+        case 'hygiene':
+            return { kind: 'hygiene', file: e.file, line: e.line, marker: e.marker };
+        case 'test-file-degradation':
+            return { kind: 'test-file-degradation', file: e.file, status: e.status };
+        case 'god-file':
+            return { kind: 'god-file', file: e.file };
+        case 'stale-file':
+            return { kind: 'stale-file', file: e.file, suffix: e.suffix };
+        case 'large-file':
+            return { kind: 'large-file', file: e.file };
+        case 'secret-hmac':
+            return { kind: 'secret-hmac', tool: e.tool, rule: e.rule, hmac: e.hmac };
+        case 'stale-allow':
+            return { kind: 'stale-allow', file: e.file, line: e.line, category: e.category };
+    }
+}
+/**
+ * Build an `old → new` id remap from a current scan's entries. Each
+ * entry's own `id` is the new (current) scheme id; the old id is
+ * recomputed from its reconstructed input. Only ids that actually change
+ * between the two schemes enter the map — version-independent kinds map to
+ * themselves and are skipped. Pure.
+ */
+function buildIdentityRemap(entries, from) {
+    const remap = new Map();
+    for (const entry of entries) {
+        const input = baselineEntryToIdentityInput(entry);
+        if (!input)
+            continue;
+        // The migrator legitimately recomputes a prior-scheme id to build the
+        // remap — it consumes identity, it doesn't mint a new finding kind.
+        const fromId = (0, finding_identity_1.identityFor)(input, from); // rule10-producer-ok
+        if (fromId !== entry.id)
+            remap.set(fromId, entry.id);
+    }
+    return remap;
+}
+/**
+ * Detect whether a repo's committed artifacts (baseline + allowlist) were
+ * written under an OLDER identity scheme than the current one, returning
+ * the scheme to migrate FROM (today only `'v1'`), or `null` when
+ * everything is already current / there's nothing to migrate. A
+ * lightweight probe — reads the stamped `identityScheme` (absent ⇒ `'v1'`)
+ * without re-scanning. Used by `vyuh-dxkit update` to decide whether to
+ * run the migrator after an upgrade.
+ */
+function detectStaleScheme(cwd, baselineName = 'main') {
+    const found = new Set();
+    const blPath = (0, baseline_file_1.pathForBaseline)(cwd, baselineName);
+    if (fs.existsSync(blPath)) {
+        try {
+            const raw = JSON.parse(fs.readFileSync(blPath, 'utf8'));
+            found.add(raw.identityScheme ?? 'v1');
+        }
+        catch {
+            /* unreadable baseline — leave migration to an explicit re-baseline */
+        }
+    }
+    const allowlist = (0, file_1.loadAllowlist)(cwd);
+    if (allowlist && allowlist.entries.length > 0)
+        found.add(allowlist.identityScheme ?? 'v1');
+    if (found.has('v1') && types_1.CURRENT_IDENTITY_SCHEME !== 'v1')
+        return 'v1';
+    return null;
+}
+/**
+ * Migrate a repo's baseline + allowlist from `from` scheme to the current
+ * scheme: one scan, rewrite the allowlist through the remap, regenerate
+ * the baseline (only if one exists). Idempotent in spirit — running it
+ * when already current produces an empty remap and a re-stamped baseline.
+ * Returns a summary the caller renders.
+ */
+async function migrateIdentity(opts) {
+    const { cwd } = opts;
+    const to = types_1.CURRENT_IDENTITY_SCHEME;
+    // One scan: entries carry the new-scheme ids; the remap recomputes the
+    // old id per entry.
+    const scan = await (0, create_1.gatherCurrentScan)({ cwd, verbose: opts.verbose });
+    const remap = buildIdentityRemap(scan.findings, opts.from);
+    const currentIds = new Set(scan.findings.map((f) => f.id));
+    // Rewrite the allowlist, preserving reviewed decisions.
+    const allowlist = (0, file_1.loadAllowlist)(cwd);
+    let remapped = 0;
+    let unchanged = 0;
+    const unmapped = [];
+    if (allowlist) {
+        const entries = allowlist.entries.map((entry) => {
+            const next = remap.get(entry.fingerprint);
+            if (next !== undefined) {
+                remapped++;
+                return { ...entry, fingerprint: next };
+            }
+            // Not in the remap: either it already matches a current finding
+            // (version-independent kind / already current scheme) — leave it —
+            // or it matches nothing (the suppressed finding is gone) — flag it.
+            if (currentIds.has(entry.fingerprint))
+                unchanged++;
+            else
+                unmapped.push(entry);
+            return entry;
+        });
+        (0, file_1.saveAllowlist)(cwd, { ...allowlist, identityScheme: to, entries });
+    }
+    // Regenerate the baseline with fresh new-scheme ids + stamped scheme —
+    // but only if one already exists. A repo with no committed baseline
+    // (ref-based posture) shouldn't gain one as a side effect of migrating;
+    // its allowlist still gets remapped above.
+    const baselineName = opts.baselineName ?? 'main';
+    const hasBaseline = fs.existsSync((0, baseline_file_1.pathForBaseline)(cwd, baselineName));
+    const created = hasBaseline
+        ? await (0, create_1.createBaseline)({ cwd, name: baselineName, force: true, verbose: opts.verbose })
+        : null;
+    return {
+        fromScheme: opts.from,
+        toScheme: to,
+        remapSize: remap.size,
+        allowlistTotal: allowlist?.entries.length ?? 0,
+        allowlistRemapped: remapped,
+        allowlistUnchanged: unchanged,
+        allowlistUnmapped: unmapped,
+        baselinePath: created?.path ?? null,
+    };
+}
+//# sourceMappingURL=migrate.js.map

package/dist/baseline/migrate.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"migrate.js","sourceRoot":"","sources":["../../src/baseline/migrate.ts"],"names":[],"mappings":";AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA6BG;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AA+CH,oEA2CC;AASD,gDAcC;AAWD,8CAqBC;AASD,0CAyDC;AAjND,uCAAyB;AACzB,qCAA6D;AAC7D,mDAAkD;AAClD,yDAAiD;AACjD,yCAAyC;AACzC,mCAAkD;AAOlD,4CAAiE;AAwBjE;;;;;;;;GAQG;AACH,SAAgB,4BAA4B,CAAC,KAAoB;IAC/D,IAAI,IAAA,sBAAW,EAAC,KAAK,CAAC;QAAE,OAAO,SAAS,CAAC;IACzC,MAAM,CAAC,GAAG,KAA0B,CAAC;IACrC,QAAQ,CAAC,CAAC,IAAI,EAAE,CAAC;QACf,KAAK,QAAQ,CAAC;QACd,KAAK,MAAM,CAAC;QACZ,KAAK,QAAQ;YACX,OAAO,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;QAClF,KAAK,UAAU;YACb,OAAO;gBACL,IAAI,EAAE,UAAU;gBAChB,OAAO,EAAE,CAAC,CAAC,OAAO;gBAClB,gBAAgB,EAAE,CAAC,CAAC,gBAAgB;gBACpC,EAAE,EAAE,CAAC,CAAC,UAAU;aACjB,CAAC;QACJ,KAAK,aAAa;YAChB,OAAO;gBACL,IAAI,EAAE,aAAa;gBACnB,KAAK,EAAE,CAAC,CAAC,KAAK;gBACd,KAAK,EAAE,CAAC,CAAC,KAAK;gBACd,KAAK,EAAE,CAAC,CAAC,KAAK;gBACd,UAAU,EAAE,CAAC,CAAC,UAAU;gBACxB,UAAU,EAAE,CAAC,CAAC,UAAU;aACzB,CAAC;QACJ,KAAK,cAAc;YACjB,OAAO,EAAE,IAAI,EAAE,cAAc,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,SAAS,EAAE,CAAC,CAAC,SAAS,EAAE,CAAC;QAC1F,KAAK,UAAU;YACb,OAAO,EAAE,IAAI,EAAE,UAAU,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;QAC1D,KAAK,SAAS;YACZ,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC;QAC3E,KAAK,uBAAuB;YAC1B,OAAO,EAAE,IAAI,EAAE,uBAAuB,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC;QAC3E,KAAK,UAAU;YACb,OAAO,EAAE,IAAI,EAAE,UAAU,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;QAC5C,KAAK,YAAY;YACf,OAAO,EAAE,IAAI,EAAE,YAAY,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC;QAChE,KAAK,YAAY;YACf,OAAO,EAAE,IAAI,EAAE,YAAY,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;QAC9C,KAAK,aAAa;YAChB,OAAO,EAAE,IAAI,EAAE,aAAa,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;QAC3E,KAAK,aAAa;YAChB,OAAO,EAAE,IAAI,EAAE,aAAa,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,QAAQ,EAAE,CAAC,CAAC,QAAQ,EAAE,CAAC;IACrF,CAAC;AACH,CAAC;AAED;;;;;;GAMG;AACH,SAAgB,kBAAkB,CAChC,OAAqC,EACrC,IAA2B;IAE3B,MAAM,KAAK,GAAG,IAAI,GAAG,EAAkB,CAAC;IACxC,KAAK,MAAM,KAAK,IAAI,OAAO,EAAE,CAAC;QAC5B,MAAM,KAAK,GAAG,4BAA4B,CAAC,KAAK,CAAC,CAAC;QAClD,IAAI,CAAC,KAAK;YAAE,SAAS;QACrB,sEAAsE;QACtE,oEAAoE;QACpE,MAAM,MAAM,GAAG,IAAA,8BAAW,EAAC,KAAK,EAAE,IAAI,CAAC,CAAC,CAAC,qBAAqB;QAC9D,IAAI,MAAM,KAAK,KAAK,CAAC,EAAE;YAAE,KAAK,CAAC,GAAG,CAAC,MAAM,EAAE,KAAK,CAAC,EAAE,CAAC,CAAC;IACvD,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED;;;;;;;;GAQG;AACH,SAAgB,iBAAiB,CAC/B,GAAW,EACX,YAAY,GAAG,MAAM;IAErB,MAAM,KAAK,GAAG,IAAI,GAAG,EAAyB,CAAC;IAC/C,MAAM,MAAM,GAAG,IAAA,+BAAe,EAAC,GAAG,EAAE,YAAY,CAAC,CAAC;IAClD,IAAI,EAAE,CAAC,UAAU,CAAC,MAAM,CAAC,EAAE,CAAC;QAC1B,IAAI,CAAC;YACH,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,YAAY,CAAC,MAAM,EAAE,MAAM,CAAC,CAErD,CAAC;YACF,KAAK,CAAC,GAAG,CAAC,GAAG,CAAC,cAAc,IAAI,IAAI,CAAC,CAAC;QACxC,CAAC;QAAC,MAAM,CAAC;YACP,sEAAsE;QACxE,CAAC;IACH,CAAC;IACD,MAAM,SAAS,GAAG,IAAA,oBAAa,EAAC,GAAG,CAAC,CAAC;IACrC,IAAI,SAAS,IAAI,SAAS,CAAC,OAAO,CAAC,MAAM,GAAG,CAAC;QAAE,KAAK,CAAC,GAAG,CAAC,SAAS,CAAC,cAAc,IAAI,IAAI,CAAC,CAAC;IAE3F,IAAI,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,+BAAuB,KAAK,IAAI;QAAE,OAAO,IAAI,CAAC;IACrE,OAAO,IAAI,CAAC;AACd,CAAC;AAED;;;;;;GAMG;AACI,KAAK,UAAU,eAAe,CAAC,IAKrC;IACC,MAAM,EAAE,GAAG,EAAE,GAAG,IAAI,CAAC;IACrB,MAAM,EAAE,GAAG,+BAAuB,CAAC;IAEnC,uEAAuE;IACvE,oBAAoB;IACpB,MAAM,IAAI,GAAG,MAAM,IAAA,0BAAiB,EAAC,EAAE,GAAG,EAAE,OAAO,EAAE,IAAI,CAAC,OAAO,EAAE,CAAC,CAAC;IACrE,MAAM,KAAK,GAAG,kBAAkB,CAAC,IAAI,CAAC,QAAQ,EAAE,IAAI,CAAC,IAAI,CAAC,CAAC;IAC3D,MAAM,UAAU,GAAG,IAAI,GAAG,CAAC,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;IAE3D,wDAAwD;IACxD,MAAM,SAAS,GAAG,IAAA,oBAAa,EAAC,GAAG,CAAC,CAAC;IACrC,IAAI,QAAQ,GAAG,CAAC,CAAC;IACjB,IAAI,SAAS,GAAG,CAAC,CAAC;IAClB,MAAM,QAAQ,GAAqB,EAAE,CAAC;IACtC,IAAI,SAAS,EAAE,CAAC;QACd,MAAM,OAAO,GAAG,SAAS,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE;YAC9C,MAAM,IAAI,GAAG,KAAK,CAAC,GAAG,CAAC,KAAK,CAAC,WAAW,CAAC,CAAC;YAC1C,IAAI,IAAI,KAAK,SAAS,EAAE,CAAC;gBACvB,QAAQ,EAAE,CAAC;gBACX,OAAO,EAAE,GAAG,KAAK,EAAE,WAAW,EAAE,IAAI,EAAE,CAAC;YACzC,CAAC;YACD,gEAAgE;YAChE,mEAAmE;YACnE,oEAAoE;YACpE,IAAI,UAAU,CAAC,GAAG,CAAC,KAAK,CAAC,WAAW,CAAC;gBAAE,SAAS,EAAE,CAAC;;gBAC9C,QAAQ,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;YAC1B,OAAO,KAAK,CAAC;QACf,CAAC,CAAC,CAAC;QACH,IAAA,oBAAa,EAAC,GAAG,EAAE,EAAE,GAAG,SAAS,EAAE,cAAc,EAAE,EAAE,EAAE,OAAO,EAAE,CAAC,CAAC;IACpE,CAAC;IAED,uEAAuE;IACvE,oEAAoE;IACpE,wEAAwE;IACxE,2CAA2C;IAC3C,MAAM,YAAY,GAAG,IAAI,CAAC,YAAY,IAAI,MAAM,CAAC;IACjD,MAAM,WAAW,GAAG,EAAE,CAAC,UAAU,CAAC,IAAA,+BAAe,EAAC,GAAG,EAAE,YAAY,CAAC,CAAC,CAAC;IACtE,MAAM,OAAO,GAAG,WAAW;QACzB,CAAC,CAAC,MAAM,IAAA,uBAAc,EAAC,EAAE,GAAG,EAAE,IAAI,EAAE,YAAY,EAAE,KAAK,EAAE,IAAI,EAAE,OAAO,EAAE,IAAI,CAAC,OAAO,EAAE,CAAC;QACvF,CAAC,CAAC,IAAI,CAAC;IAET,OAAO;QACL,UAAU,EAAE,IAAI,CAAC,IAAI;QACrB,QAAQ,EAAE,EAAE;QACZ,SAAS,EAAE,KAAK,CAAC,IAAI;QACrB,cAAc,EAAE,SAAS,EAAE,OAAO,CAAC,MAAM,IAAI,CAAC;QAC9C,iBAAiB,EAAE,QAAQ;QAC3B,kBAAkB,EAAE,SAAS;QAC7B,iBAAiB,EAAE,QAAQ;QAC3B,YAAY,EAAE,OAAO,EAAE,IAAI,IAAI,IAAI;KACpC,CAAC;AACJ,CAAC"}

package/dist/baseline/producers/security.d.ts

@@ -11,10 +11,10 @@
  * Four `BaselineEntry` kinds are derived here, matching the four
  * categories the aggregator emits:
  *
- *   - `findingsByCategory.secret`    → kind: 'secret'
- *   - `findingsByCategory.code`      → kind: 'code'
- *   - `findingsByCategory.config`    → kind: 'config'
- *   - `findingsByCategory.dependency`→ kind: 'dep-vuln'
+ * - `findingsByCategory.secret` → kind: 'secret'
+ * - `findingsByCategory.code` → kind: 'code'
+ * - `findingsByCategory.config` → kind: 'config'
+ * - `findingsByCategory.dependency`→ kind: 'dep-vuln'
  *
  * The location-based `secret` entries are sufficient for tracking a
  * secret that stays in the same file. The companion `secret-hmac`
@@ -41,13 +41,13 @@ import type { SecurityAggregate } from '../../analyzers/security/aggregator';
 import type { RichBaselineEntry } from '../types';
 export interface SecurityProducerOptions {
     /** Repo path; used by `computeContentHashFromCommit` to invoke
-     *  `git show`. Omitting it disables content-hash stamping. */
+     * `git show`. Omitting it disables content-hash stamping. */
     readonly cwd?: string;
     /** Commit SHA the baseline is anchored to. When the working tree
-     *  has uncommitted changes, callers may pass `'HEAD'` so the hash
-     *  reflects committed state — content-hash matching against a
-     *  later run will still work as long as both sides read the same
-     *  SHA. */
+     * has uncommitted changes, callers may pass `'HEAD'` so the hash
+     * reflects committed state — content-hash matching against a
+     * later run will still work as long as both sides read the same
+     * SHA. */
     readonly commitSha?: string;
 }
 /**

package/dist/baseline/producers/security.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"security.d.ts","sourceRoot":"","sources":["../../../src/baseline/producers/security.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAsCG;AAGH,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,qCAAqC,CAAC;AAE7E,OAAO,KAAK,EACV,iBAAiB,EAKlB,MAAM,UAAU,CAAC;AAElB,MAAM,WAAW,uBAAuB;IACtC;kEAC8D;IAC9D,QAAQ,CAAC,GAAG,CAAC,EAAE,MAAM,CAAC;IACtB;;;;eAIW;IACX,QAAQ,CAAC,SAAS,CAAC,EAAE,MAAM,CAAC;CAC7B;AAED;;;;GAIG;AACH,wBAAgB,kCAAkC,CAChD,SAAS,EAAE,iBAAiB,EAC5B,OAAO,GAAE,uBAA4B,GACpC,iBAAiB,EAAE,CAiGrB"}
+{"version":3,"file":"security.d.ts","sourceRoot":"","sources":["../../../src/baseline/producers/security.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAsCG;AAGH,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,qCAAqC,CAAC;AAE7E,OAAO,KAAK,EACV,iBAAiB,EAKlB,MAAM,UAAU,CAAC;AAElB,MAAM,WAAW,uBAAuB;IACtC;iEAC6D;IAC7D,QAAQ,CAAC,GAAG,CAAC,EAAE,MAAM,CAAC;IACtB;;;;cAIU;IACV,QAAQ,CAAC,SAAS,CAAC,EAAE,MAAM,CAAC;CAC7B;AAED;;;;GAIG;AACH,wBAAgB,kCAAkC,CAChD,SAAS,EAAE,iBAAiB,EAC5B,OAAO,GAAE,uBAA4B,GACpC,iBAAiB,EAAE,CA6GrB"}

package/dist/baseline/producers/security.js

@@ -12,10 +12,10 @@
  * Four `BaselineEntry` kinds are derived here, matching the four
  * categories the aggregator emits:
  *
- *   - `findingsByCategory.secret`    → kind: 'secret'
- *   - `findingsByCategory.code`      → kind: 'code'
- *   - `findingsByCategory.config`    → kind: 'config'
- *   - `findingsByCategory.dependency`→ kind: 'dep-vuln'
+ * - `findingsByCategory.secret` → kind: 'secret'
+ * - `findingsByCategory.code` → kind: 'code'
+ * - `findingsByCategory.config` → kind: 'config'
+ * - `findingsByCategory.dependency`→ kind: 'dep-vuln'
  *
  * The location-based `secret` entries are sufficient for tracking a
  * secret that stays in the same file. The companion `secret-hmac`
@@ -62,6 +62,10 @@ function securityAggregateToBaselineEntries(aggregate, options = {}) {
             rule: f.rule,
             file: f.file,
             line: f.line,
+            // Content-anchored identity: the aggregator stamped the final content anchor (secret HMAC)
+            // on the finding; pass it so identityFor recomputes the SAME id the
+            // finding carries. Absent → identityFor falls back to the line hash.
+            ...(f.contentAnchor !== undefined ? { contentAnchor: f.contentAnchor } : {}),
         };
         const contentHash = stamp(f.file, f.line);
         out.push({
@@ -84,6 +88,9 @@ function securityAggregateToBaselineEntries(aggregate, options = {}) {
             rule: f.rule,
             file: f.file,
             line: f.line,
+            // Content-anchored identity: the (scope, spanHash, ordinal) content anchor the aggregator
+            // built; passing it reproduces the finding's content fingerprint.
+            ...(f.contentAnchor !== undefined ? { contentAnchor: f.contentAnchor } : {}),
         };
         const contentHash = stamp(f.file, f.line);
         out.push({
@@ -106,6 +113,10 @@ function securityAggregateToBaselineEntries(aggregate, options = {}) {
             rule: f.rule,
             file: f.file,
             line: f.line,
+            // Content-anchored identity: config (.env-in-git, whole-file at line 0) stays on the
+            // line-stable path — the aggregator leaves its anchor unset — so this
+            // is normally undefined and identity is unchanged from v1.
+            ...(f.contentAnchor !== undefined ? { contentAnchor: f.contentAnchor } : {}),
         };
         // Whole-file findings (`.env in git`) carry line 0; content-hash
         // is meaningless for them and `stamp` returns undefined.
@@ -129,6 +140,7 @@ function securityAggregateToBaselineEntries(aggregate, options = {}) {
             package: f.package,
             installedVersion: f.installedVersion,
             id: f.id,
+            ...(f.aliases !== undefined ? { aliases: f.aliases } : {}),
         };
         const entry = {
             id: (0, finding_identity_1.identityFor)(input),

package/dist/baseline/producers/security.js.map

@@ -1 +1 @@
-{"version":3,"file":"security.js","sourceRoot":"","sources":["../../../src/baseline/producers/security.ts"],"names":[],"mappings":";AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAsCG;;AA8BH,gFAoGC;AAhID,kDAA+D;AAE/D,0DAAkD;AAqBlD;;;;GAIG;AACH,SAAgB,kCAAkC,CAChD,SAA4B,EAC5B,UAAmC,EAAE;IAErC,MAAM,GAAG,GAAwB,EAAE,CAAC;IACpC,MAAM,KAAK,GAAG,CAAC,IAAY,EAAE,IAAY,EAAsB,EAAE;QAC/D,IAAI,CAAC,OAAO,CAAC,GAAG,IAAI,CAAC,OAAO,CAAC,SAAS,IAAI,IAAI,IAAI,CAAC;YAAE,OAAO,SAAS,CAAC;QACtE,MAAM,IAAI,GAAG,IAAA,2CAA4B,EAAC,OAAO,CAAC,GAAG,EAAE,OAAO,CAAC,SAAS,EAAE,IAAI,EAAE,IAAI,CAAC,CAAC;QACtF,OAAO,IAAI,IAAI,SAAS,CAAC;IAC3B,CAAC,CAAC;IAEF,KAAK,MAAM,CAAC,IAAI,SAAS,CAAC,kBAAkB,CAAC,MAAM,EAAE,CAAC;QACpD,MAAM,KAAK,GAAwB;YACjC,IAAI,EAAE,QAAQ;YACd,IAAI,EAAE,CAAC,CAAC,IAAI;YACZ,IAAI,EAAE,CAAC,CAAC,IAAI;YACZ,IAAI,EAAE,CAAC,CAAC,IAAI;YACZ,IAAI,EAAE,CAAC,CAAC,IAAI;SACb,CAAC;QACF,MAAM,WAAW,GAAG,KAAK,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC;QAC1C,GAAG,CAAC,IAAI,CAAC;YACP,EAAE,EAAE,IAAA,8BAAW,EAAC,KAAK,CAAC;YACtB,IAAI,EAAE,QAAQ;YACd,IAAI,EAAE,CAAC,CAAC,IAAI;YACZ,IAAI,EAAE,CAAC,CAAC,IAAI;YACZ,IAAI,EAAE,CAAC,CAAC,IAAI;YACZ,IAAI,EAAE,CAAC,CAAC,IAAI;YACZ,GAAG,CAAC,WAAW,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YACrD,GAAG,CAAC,CAAC,CAAC,oBAAoB,IAAI,CAAC,CAAC,oBAAoB,CAAC,MAAM,GAAG,CAAC;gBAC7D,CAAC,CAAC,EAAE,oBAAoB,EAAE,CAAC,CAAC,oBAAoB,EAAE;gBAClD,CAAC,CAAC,EAAE,CAAC;SACR,CAAC,CAAC;IACL,CAAC;IAED,KAAK,MAAM,CAAC,IAAI,SAAS,CAAC,kBAAkB,CAAC,IAAI,EAAE,CAAC;QAClD,MAAM,KAAK,GAAsB;YAC/B,IAAI,EAAE,MAAM;YACZ,IAAI,EAAE,CAAC,CAAC,IAAI;YACZ,IAAI,EAAE,CAAC,CAAC,IAAI;YACZ,IAAI,EAAE,CAAC,CAAC,IAAI;YACZ,IAAI,EAAE,CAAC,CAAC,IAAI;SACb,CAAC;QACF,MAAM,WAAW,GAAG,KAAK,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC;QAC1C,GAAG,CAAC,IAAI,CAAC;YACP,EAAE,EAAE,IAAA,8BAAW,EAAC,KAAK,CAAC;YACtB,IAAI,EAAE,MAAM;YACZ,IAAI,EAAE,CAAC,CAAC,IAAI;YACZ,IAAI,EAAE,CAAC,CAAC,IAAI;YACZ,IAAI,EAAE,CAAC,CAAC,IAAI;YACZ,IAAI,EAAE,CAAC,CAAC,IAAI;YACZ,GAAG,CAAC,WAAW,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YACrD,GAAG,CAAC,CAAC,CAAC,oBAAoB,IAAI,CAAC,CAAC,oBAAoB,CAAC,MAAM,GAAG,CAAC;gBAC7D,CAAC,CAAC,EAAE,oBAAoB,EAAE,CAAC,CAAC,oBAAoB,EAAE;gBAClD,CAAC,CAAC,EAAE,CAAC;SACR,CAAC,CAAC;IACL,CAAC;IAED,KAAK,MAAM,CAAC,IAAI,SAAS,CAAC,kBAAkB,CAAC,MAAM,EAAE,CAAC;QACpD,MAAM,KAAK,GAAwB;YACjC,IAAI,EAAE,QAAQ;YACd,IAAI,EAAE,CAAC,CAAC,IAAI;YACZ,IAAI,EAAE,CAAC,CAAC,IAAI;YACZ,IAAI,EAAE,CAAC,CAAC,IAAI;YACZ,IAAI,EAAE,CAAC,CAAC,IAAI;SACb,CAAC;QACF,iEAAiE;QACjE,yDAAyD;QACzD,MAAM,WAAW,GAAG,KAAK,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC;QAC1C,GAAG,CAAC,IAAI,CAAC;YACP,EAAE,EAAE,IAAA,8BAAW,EAAC,KAAK,CAAC;YACtB,IAAI,EAAE,QAAQ;YACd,IAAI,EAAE,CAAC,CAAC,IAAI;YACZ,IAAI,EAAE,CAAC,CAAC,IAAI;YACZ,IAAI,EAAE,CAAC,CAAC,IAAI;YACZ,IAAI,EAAE,CAAC,CAAC,IAAI;YACZ,GAAG,CAAC,WAAW,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YACrD,GAAG,CAAC,CAAC,CAAC,oBAAoB,IAAI,CAAC,CAAC,oBAAoB,CAAC,MAAM,GAAG,CAAC;gBAC7D,CAAC,CAAC,EAAE,oBAAoB,EAAE,CAAC,CAAC,oBAAoB,EAAE;gBAClD,CAAC,CAAC,EAAE,CAAC;SACR,CAAC,CAAC;IACL,CAAC;IAED,KAAK,MAAM,CAAC,IAAI,SAAS,CAAC,kBAAkB,CAAC,UAAU,EAAE,CAAC;QACxD,MAAM,KAAK,GAAyB;YAClC,IAAI,EAAE,UAAU;YAChB,OAAO,EAAE,CAAC,CAAC,OAAO;YAClB,gBAAgB,EAAE,CAAC,CAAC,gBAAgB;YACpC,EAAE,EAAE,CAAC,CAAC,EAAE;SACT,CAAC;QACF,MAAM,KAAK,GAAsB;YAC/B,EAAE,EAAE,IAAA,8BAAW,EAAC,KAAK,CAAC;YACtB,IAAI,EAAE,UAAU;YAChB,OAAO,EAAE,CAAC,CAAC,OAAO;YAClB,UAAU,EAAE,CAAC,CAAC,EAAE;YAChB,GAAG,CAAC,CAAC,CAAC,gBAAgB,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,gBAAgB,EAAE,CAAC,CAAC,gBAAgB,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SACtF,CAAC;QACF,GAAG,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IAClB,CAAC;IAED,OAAO,GAAG,CAAC;AACb,CAAC"}
+{"version":3,"file":"security.js","sourceRoot":"","sources":["../../../src/baseline/producers/security.ts"],"names":[],"mappings":";AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAsCG;;AA8BH,gFAgHC;AA5ID,kDAA+D;AAE/D,0DAAkD;AAqBlD;;;;GAIG;AACH,SAAgB,kCAAkC,CAChD,SAA4B,EAC5B,UAAmC,EAAE;IAErC,MAAM,GAAG,GAAwB,EAAE,CAAC;IACpC,MAAM,KAAK,GAAG,CAAC,IAAY,EAAE,IAAY,EAAsB,EAAE;QAC/D,IAAI,CAAC,OAAO,CAAC,GAAG,IAAI,CAAC,OAAO,CAAC,SAAS,IAAI,IAAI,IAAI,CAAC;YAAE,OAAO,SAAS,CAAC;QACtE,MAAM,IAAI,GAAG,IAAA,2CAA4B,EAAC,OAAO,CAAC,GAAG,EAAE,OAAO,CAAC,SAAS,EAAE,IAAI,EAAE,IAAI,CAAC,CAAC;QACtF,OAAO,IAAI,IAAI,SAAS,CAAC;IAC3B,CAAC,CAAC;IAEF,KAAK,MAAM,CAAC,IAAI,SAAS,CAAC,kBAAkB,CAAC,MAAM,EAAE,CAAC;QACpD,MAAM,KAAK,GAAwB;YACjC,IAAI,EAAE,QAAQ;YACd,IAAI,EAAE,CAAC,CAAC,IAAI;YACZ,IAAI,EAAE,CAAC,CAAC,IAAI;YACZ,IAAI,EAAE,CAAC,CAAC,IAAI;YACZ,IAAI,EAAE,CAAC,CAAC,IAAI;YACZ,2FAA2F;YAC3F,oEAAoE;YACpE,qEAAqE;YACrE,GAAG,CAAC,CAAC,CAAC,aAAa,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,aAAa,EAAE,CAAC,CAAC,aAAa,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SAC7E,CAAC;QACF,MAAM,WAAW,GAAG,KAAK,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC;QAC1C,GAAG,CAAC,IAAI,CAAC;YACP,EAAE,EAAE,IAAA,8BAAW,EAAC,KAAK,CAAC;YACtB,IAAI,EAAE,QAAQ;YACd,IAAI,EAAE,CAAC,CAAC,IAAI;YACZ,IAAI,EAAE,CAAC,CAAC,IAAI;YACZ,IAAI,EAAE,CAAC,CAAC,IAAI;YACZ,IAAI,EAAE,CAAC,CAAC,IAAI;YACZ,GAAG,CAAC,WAAW,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YACrD,GAAG,CAAC,CAAC,CAAC,oBAAoB,IAAI,CAAC,CAAC,oBAAoB,CAAC,MAAM,GAAG,CAAC;gBAC7D,CAAC,CAAC,EAAE,oBAAoB,EAAE,CAAC,CAAC,oBAAoB,EAAE;gBAClD,CAAC,CAAC,EAAE,CAAC;SACR,CAAC,CAAC;IACL,CAAC;IAED,KAAK,MAAM,CAAC,IAAI,SAAS,CAAC,kBAAkB,CAAC,IAAI,EAAE,CAAC;QAClD,MAAM,KAAK,GAAsB;YAC/B,IAAI,EAAE,MAAM;YACZ,IAAI,EAAE,CAAC,CAAC,IAAI;YACZ,IAAI,EAAE,CAAC,CAAC,IAAI;YACZ,IAAI,EAAE,CAAC,CAAC,IAAI;YACZ,IAAI,EAAE,CAAC,CAAC,IAAI;YACZ,0FAA0F;YAC1F,kEAAkE;YAClE,GAAG,CAAC,CAAC,CAAC,aAAa,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,aAAa,EAAE,CAAC,CAAC,aAAa,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SAC7E,CAAC;QACF,MAAM,WAAW,GAAG,KAAK,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC;QAC1C,GAAG,CAAC,IAAI,CAAC;YACP,EAAE,EAAE,IAAA,8BAAW,EAAC,KAAK,CAAC;YACtB,IAAI,EAAE,MAAM;YACZ,IAAI,EAAE,CAAC,CAAC,IAAI;YACZ,IAAI,EAAE,CAAC,CAAC,IAAI;YACZ,IAAI,EAAE,CAAC,CAAC,IAAI;YACZ,IAAI,EAAE,CAAC,CAAC,IAAI;YACZ,GAAG,CAAC,WAAW,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YACrD,GAAG,CAAC,CAAC,CAAC,oBAAoB,IAAI,CAAC,CAAC,oBAAoB,CAAC,MAAM,GAAG,CAAC;gBAC7D,CAAC,CAAC,EAAE,oBAAoB,EAAE,CAAC,CAAC,oBAAoB,EAAE;gBAClD,CAAC,CAAC,EAAE,CAAC;SACR,CAAC,CAAC;IACL,CAAC;IAED,KAAK,MAAM,CAAC,IAAI,SAAS,CAAC,kBAAkB,CAAC,MAAM,EAAE,CAAC;QACpD,MAAM,KAAK,GAAwB;YACjC,IAAI,EAAE,QAAQ;YACd,IAAI,EAAE,CAAC,CAAC,IAAI;YACZ,IAAI,EAAE,CAAC,CAAC,IAAI;YACZ,IAAI,EAAE,CAAC,CAAC,IAAI;YACZ,IAAI,EAAE,CAAC,CAAC,IAAI;YACZ,qFAAqF;YACrF,sEAAsE;YACtE,2DAA2D;YAC3D,GAAG,CAAC,CAAC,CAAC,aAAa,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,aAAa,EAAE,CAAC,CAAC,aAAa,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SAC7E,CAAC;QACF,iEAAiE;QACjE,yDAAyD;QACzD,MAAM,WAAW,GAAG,KAAK,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC;QAC1C,GAAG,CAAC,IAAI,CAAC;YACP,EAAE,EAAE,IAAA,8BAAW,EAAC,KAAK,CAAC;YACtB,IAAI,EAAE,QAAQ;YACd,IAAI,EAAE,CAAC,CAAC,IAAI;YACZ,IAAI,EAAE,CAAC,CAAC,IAAI;YACZ,IAAI,EAAE,CAAC,CAAC,IAAI;YACZ,IAAI,EAAE,CAAC,CAAC,IAAI;YACZ,GAAG,CAAC,WAAW,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YACrD,GAAG,CAAC,CAAC,CAAC,oBAAoB,IAAI,CAAC,CAAC,oBAAoB,CAAC,MAAM,GAAG,CAAC;gBAC7D,CAAC,CAAC,EAAE,oBAAoB,EAAE,CAAC,CAAC,oBAAoB,EAAE;gBAClD,CAAC,CAAC,EAAE,CAAC;SACR,CAAC,CAAC;IACL,CAAC;IAED,KAAK,MAAM,CAAC,IAAI,SAAS,CAAC,kBAAkB,CAAC,UAAU,EAAE,CAAC;QACxD,MAAM,KAAK,GAAyB;YAClC,IAAI,EAAE,UAAU;YAChB,OAAO,EAAE,CAAC,CAAC,OAAO;YAClB,gBAAgB,EAAE,CAAC,CAAC,gBAAgB;YACpC,EAAE,EAAE,CAAC,CAAC,EAAE;YACR,GAAG,CAAC,CAAC,CAAC,OAAO,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SAC3D,CAAC;QACF,MAAM,KAAK,GAAsB;YAC/B,EAAE,EAAE,IAAA,8BAAW,EAAC,KAAK,CAAC;YACtB,IAAI,EAAE,UAAU;YAChB,OAAO,EAAE,CAAC,CAAC,OAAO;YAClB,UAAU,EAAE,CAAC,CAAC,EAAE;YAChB,GAAG,CAAC,CAAC,CAAC,gBAAgB,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,gBAAgB,EAAE,CAAC,CAAC,gBAAgB,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SACtF,CAAC;QACF,GAAG,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IAClB,CAAC;IAED,OAAO,GAAG,CAAC;AACb,CAAC"}