@vyuhlabs/dxkit 2.9.4 → 2.11.0

package/dist/baseline/types.d.ts

@@ -9,20 +9,20 @@
  * identity." Each finding has up to several fingerprint axes,
  * differentiated by what they capture:
  *
- *   - **Location fingerprint** — `(canonicalRule, file, lineWindow)`
- *     for code/secret/config/hygiene findings. Locates a finding
- *     in the source tree with ±2 line drift tolerance via bucket
- *     windowing. Stable across small reformat / whitespace edits;
- *     drifts on bigger shifts (closed by git-aware match).
- *   - **Domain fingerprint** — `(package, version, advisoryId)` for
- *     dep-vulns; `(package, version, licenseType)` for licenses;
- *     normalized block hash for jscpd. Captures *what the finding
- *     is about* independent of source position. Drift-immune.
- *   - **Semantic fingerprint** — `(file, symbol)` for coverage gaps
- *     when a symbol is known. Survives any vertical drift within
- *     the symbol body.
- *   - **Content fingerprint** — Sprint 0.x. Normalized snippet
- *     hash; fallback when git history is unreachable.
+ * - **Location fingerprint** — `(canonicalRule, file, lineWindow)`
+ * for code/secret/config/hygiene findings. Locates a finding
+ * in the source tree with ±2 line drift tolerance via bucket
+ * windowing. Stable across small reformat / whitespace edits;
+ * drifts on bigger shifts (closed by git-aware match).
+ * - **Domain fingerprint** — `(package, version, advisoryId)` for
+ * dep-vulns; `(package, version, licenseType)` for licenses;
+ * normalized block hash for jscpd. Captures *what the finding
+ * is about* independent of source position. Drift-immune.
+ * - **Semantic fingerprint** — `(file, symbol)` for coverage gaps
+ * when a symbol is known. Survives any vertical drift within
+ * the symbol body.
+ * - **Content fingerprint** — Sprint 0.x. Normalized snippet
+ * hash; fallback when git history is unreachable.
  *
  * The hash format is identical across axes — 16-char lowercase hex
  * (SHA-1[0:16]). Callers don't need to know which axis a hash came
@@ -34,18 +34,18 @@
  * findings. Each `IdentityInput` discriminant maps 1:1 to an existing
  * gather pipeline:
  *
- *   - `secret` / `code` / `config` — security analyzer's
- *     `SecurityFinding` (gitleaks, semgrep, TLS-bypass registry,
- *     private-key files, env-in-git).
- *   - `dep-vuln` — security analyzer's `DepVulnFinding` (osv-scanner,
- *     npm-audit, pip-audit, cargo-audit, etc.).
- *   - `duplication` — quality analyzer's `CloneGroup` (jscpd).
- *   - `coverage-gap` — coverage-gap report entries (file + symbol
- *     when available, fallback to file + line range).
- *   - `test-gap` — non-test source files flagged by the test-gaps
- *     analyzer.
- *   - `hygiene` — TODO / FIXME / HACK / console-log / any-type
- *     occurrences (per-occurrence identity).
+ * - `secret` / `code` / `config` — security analyzer's
+ * `SecurityFinding` (gitleaks, semgrep, TLS-bypass registry,
+ * private-key files, env-in-git).
+ * - `dep-vuln` — security analyzer's `DepVulnFinding` (osv-scanner,
+ * npm-audit, pip-audit, cargo-audit, etc.).
+ * - `duplication` — quality analyzer's `CloneGroup` (jscpd).
+ * - `coverage-gap` — coverage-gap report entries (file + symbol
+ * when available, fallback to file + line range).
+ * - `test-gap` — non-test source files flagged by the test-gaps
+ * analyzer.
+ * - `hygiene` — TODO / FIXME / HACK / console-log / any-type
+ * occurrences (per-occurrence identity).
  *
  * License attributions are NOT a baseline finding kind. They live in
  * the per-package BoM artifact (`.dxkit/bom.json`) — the canonical
@@ -67,38 +67,76 @@
  */
 export type FindingId = string;
 /**
- * Identity-scheme version. Bumping this minor field will be required
- * if the hashing inputs change in a way that would invalidate stored
- * baselines. v1 is the only scheme today.
+ * Identity-scheme version. Bumped whenever the hashing inputs change in a
+ * way that would invalidate stored baselines / allowlists.
+ *
+ *   - `v1` — the pre-2.11 scheme: code/secret/config hashed
+ *     `(canonicalRule, file, lineWindow)`; dep-vuln hashed
+ *     `(package, installedVersion, id)`.
+ *   - `v2` (current) — content-anchored: code = `(scope, spanHash,
+ *     ordinal)`, secret = salted HMAC, config = `(rule, file)`, all with
+ *     a line-window fallback; dep-vuln = `(package, canonicalAdvisoryId)`.
+ *
+ * `identityFor` can compute EITHER scheme (every shipped scheme's id
+ * function is retained — see `computeFingerprintV1`), which is what lets
+ * the identity migrator build an `old → new` remap and carry allowlist
+ * entries across an upgrade. The version is stamped on the baseline +
+ * allowlist files so a later dxkit can detect the gap and migrate.
+ *
+ * Adding a future `v3`: extend this union, add its branch in
+ * `identityFor`, retain the prior scheme's id function, and the migrator
+ * + `update` handle the rest with no further wiring.
  */
-export type IdentitySchemeVersion = 'v1';
+export type IdentitySchemeVersion = 'v1' | 'v2';
+/** The scheme `identityFor` mints new identities under by default, and the
+ *  version stamped on freshly written baseline / allowlist files. */
+export declare const CURRENT_IDENTITY_SCHEME: IdentitySchemeVersion;
 /**
  * Discriminated union of every finding kind that participates in
  * identity. Producers wrap their per-tool finding shape into one of
  * these before calling `identityFor`.
  *
  * Adding a new finding kind to the dispatch is a three-line change:
- *   1. Add the per-kind interface below.
- *   2. Append the interface name to this union.
- *   3. Add the corresponding case branch in `identityFor`.
+ * 1. Add the per-kind interface below.
+ * 2. Append the interface name to this union.
+ * 3. Add the corresponding case branch in `identityFor`.
  *
  * The hash format is SHA-1[0:16] across every kind — callers store
  * identities in one flat set without tracking provenance.
  */
 export type IdentityInput = SecretIdentityInput | CodeIdentityInput | ConfigIdentityInput | DepVulnIdentityInput | DuplicationIdentityInput | CoverageGapIdentityInput | TestGapIdentityInput | HygieneOffenderIdentityInput | TestFileDegradationIdentityInput | GodFileIdentityInput | StaleFileIdentityInput | LargeFileIdentityInput | SecretHmacIdentityInput | StaleAllowIdentityInput;
+/**
+ * Content anchor for the secret/code/config identity schemes.
+ * Derived from WHAT a finding is, not WHERE it sits, so identity
+ * survives the finding moving lines:
+ * - secret → salted HMAC of the value (`computeSecretHmac`).
+ * - code → `codeContentAnchor(scope, span, ordinal)` — enclosing
+ * symbol + normalized-span hash + in-scope ordinal.
+ * - config → `''` (identity is just `(canonicalRule, file)`; a config
+ * finding is inherently line-independent).
+ *
+ * Optional: when absent, `identityFor` falls back to the legacy
+ * line-window hash; when present, the dispatch prefers this anchor and
+ * `line` becomes display metadata only.
+ */
+export type ContentAnchor = string;
 /** gitleaks + private-key files + similar secret detectors. */
 export interface SecretIdentityInput {
     readonly kind: 'secret';
     /** Producer tool name as reported by the analyzer (e.g. 'gitleaks'). */
     readonly tool: string;
     /** Producer-specific rule id. The canonical-rule map collapses
-     *  cross-tool overlaps where they exist. */
+     * cross-tool overlaps where they exist. */
     readonly rule: string;
     /** Project-relative file path. */
     readonly file: string;
     /** 1-based line number. Bucketed to absorb small drift between
-     *  tool versions; see `CODE_FINGERPRINT_LINE_WINDOW`. */
+     * tool versions; see `CODE_FINGERPRINT_LINE_WINDOW`. Display metadata
+     * once `contentAnchor` is present. */
     readonly line: number;
+    /** Salted HMAC of the secret value (Content anchor). Present when
+     * the gather could derive a salt; absent → line-based fallback. */
+    readonly contentAnchor?: ContentAnchor;
 }
 /** semgrep + TLS-bypass registry + per-language code-pattern providers. */
 export interface CodeIdentityInput {
@@ -107,6 +145,9 @@ export interface CodeIdentityInput {
     readonly rule: string;
     readonly file: string;
     readonly line: number;
+    /** `codeContentAnchor(scope, span, ordinal)`. Present when the
+     * aggregator could resolve a span/scope; absent → line-based fallback. */
+    readonly contentAnchor?: ContentAnchor;
 }
 /** Configuration-class findings (e.g. .env tracked in git). */
 export interface ConfigIdentityInput {
@@ -116,6 +157,9 @@ export interface ConfigIdentityInput {
     readonly file: string;
     /** Line 0 acceptable for whole-file findings. */
     readonly line: number;
+    /** `''` for config (identity is `(canonicalRule, file)`). Carried for
+     * uniformity with the other code-side inputs. */
+    readonly contentAnchor?: ContentAnchor;
 }
 /** Dependency-advisory findings (osv-scanner / npm-audit / pip-audit / ...). */
 export interface DepVulnIdentityInput {
@@ -123,28 +167,34 @@ export interface DepVulnIdentityInput {
     /** Package name as reported by the producer. */
     readonly package: string;
     /** Installed version string, when known. Absent for findings produced
-     *  without an accessible lockfile. */
+     * without an accessible lockfile. Display metadata only — NOT part of
+     * the fingerprint (it's environment-dependent; see
+     * `computeFingerprint`). */
     readonly installedVersion: string | undefined;
     /** Advisory id (GHSA / CVE / RUSTSEC / etc.). Producer-canonical. */
     readonly id: string;
+    /** Cross-namespace aliases (CVE / GHSA / OSV / SNYK …) the producer
+     * surfaced. Used to canonicalize identity so the same advisory found
+     * by different scanners shares one fingerprint. */
+    readonly aliases?: readonly string[];
 }
 /** jscpd-style duplicate-block findings. */
 export interface DuplicationIdentityInput {
     readonly kind: 'duplication';
     /** Files on each side of the duplicate pair. Order is normalized
-     *  inside `identityFor` so swapped sides hash identically. */
+     * inside `identityFor` so swapped sides hash identically. */
     readonly fileA: string;
     readonly fileB: string;
     /** Line count of the duplicated block. `lines` is preferred over
-     *  the `tokens` field jscpd also reports because jscpd's JSON
-     *  reporter does not populate `tokens` in practice — it's always
-     *  0, which would degenerate the identity tuple and silently lose
-     *  the "block-size changes → identity changes" property. */
+     * the `tokens` field jscpd also reports because jscpd's JSON
+     * reporter does not populate `tokens` in practice — it's always
+     * 0, which would degenerate the identity tuple and silently lose
+     * the "block-size changes → identity changes" property. */
     readonly lines: number;
     /** Start line of the block on side A. Combined with `startLineB`
-     *  this distinguishes intra-file clones at different positions
-     *  (same `fileA === fileB`, different line ranges) which would
-     *  otherwise collapse to one identity. */
+     * this distinguishes intra-file clones at different positions
+     * (same `fileA === fileB`, different line ranges) which would
+     * otherwise collapse to one identity. */
     readonly startLineA: number;
     /** Start line of the block on side B. */
     readonly startLineB: number;
@@ -159,11 +209,11 @@ export interface CoverageGapIdentityInput {
     readonly kind: 'coverage-gap';
     readonly file: string;
     /** Function / method / class symbol. Present when the gap is
-     *  attributable to a named symbol; absent for line-range-only
-     *  attribution. */
+     * attributable to a named symbol; absent for line-range-only
+     * attribution. */
     readonly symbol?: string;
     /** Inclusive `[startLine, endLine]`. Required when `symbol` is
-     *  absent. */
+     * absent. */
     readonly lineRange?: readonly [number, number];
 }
 /**
@@ -233,9 +283,9 @@ export interface StaleFileIdentityInput {
     readonly kind: 'stale-file';
     readonly file: string;
     /** Lower-case suffix without the leading dot (`'swp'`, `'bak'`,
-     *  `'orig'`, `'tmp'`). The producer derives this from the file
-     *  extension; storing it in identity makes the reason for the
-     *  flag inspectable from the baseline alone. */
+     * `'orig'`, `'tmp'`). The producer derives this from the file
+     * extension; storing it in identity makes the reason for the
+     * flag inspectable from the baseline alone. */
     readonly suffix: string;
 }
 /**
@@ -277,8 +327,8 @@ export interface SecretHmacIdentityInput {
     /** Producer tool name (e.g. 'gitleaks'). */
     readonly tool: string;
     /** Producer-specific rule id. The canonical-rule map applies here
-     *  too: two tools detecting the same secret class collapse to one
-     *  canonical rule. */
+     * too: two tools detecting the same secret class collapse to one
+     * canonical rule. */
     readonly rule: string;
     /** 16-char hex from `computeSecretHmac(secret, repoSalt)`. */
     readonly hmac: string;
@@ -304,9 +354,9 @@ export interface StaleAllowIdentityInput {
     readonly file: string;
     readonly line: number;
     /** The category named in the orphaned annotation. Free-form
-     *  string at identity-input level (the canonical
-     *  `AllowlistCategory` union lives in `src/allowlist/categories.ts`
-     *  to avoid a cross-module import here in the baseline types). */
+     * string at identity-input level (the canonical
+     * `AllowlistCategory` union lives in `src/allowlist/categories.ts`
+     * to avoid a cross-module import here in the baseline types). */
     readonly category: string;
 }
 /**
@@ -324,18 +374,18 @@ export type BaselineEntry = {
     file: string;
     line: number;
     /** 16-char hex hash of normalized context around `line` at
-     *  baseline-create time. Stamped via `computeContentHashFromCommit`;
-     *  the matcher's third pass uses it as a fallback when git-aware
-     *  location matching fails (shallow clones, force-pushed base,
-     *  context survives but line shifts past the fuzz window). Absent
-     *  when the producer couldn't read the file. */
+     * baseline-create time. Stamped via `computeContentHashFromCommit`;
+     * the matcher's third pass uses it as a fallback when git-aware
+     * location matching fails (shallow clones, force-pushed base,
+     * context survives but line shifts past the fuzz window). Absent
+     * when the producer couldn't read the file. */
     contentHash?: string;
     /** Fingerprints of cross-tool / neighbor-bucket / CWE-bridge
-     *  findings that the aggregator collapsed into this one. Carried
-     *  so an allowlist entry keyed on a contributing fingerprint still
-     *  suppresses the merged finding — robust matching against dedup
-     *  nondeterminism between runs. Present only when such a merge
-     *  fired. */
+     * findings that the aggregator collapsed into this one. Carried
+     * so an allowlist entry keyed on a contributing fingerprint still
+     * suppresses the merged finding — robust matching against dedup
+     * nondeterminism between runs. Present only when such a merge
+     * fired. */
     absorbedFingerprints?: readonly string[];
 } | {
     id: FindingId;
@@ -369,8 +419,8 @@ export type BaselineEntry = {
     line: number;
     marker: HygieneMarker;
     /** Same content-hash semantics as the secret/code/config variant
-     *  — populated when the producer can read the file at the
-     *  baseline commit. */
+     * — populated when the producer can read the file at the
+     * baseline commit. */
     contentHash?: string;
 } | {
     id: FindingId;
@@ -444,17 +494,17 @@ export interface SanitizedBaselineEntry {
  * the prose and use the codes for filtering / policy decisions.
  *
  * `priorId` and `currentId` are both optional because:
- *   - `added`   → only `currentId` is present.
- *   - `removed` → only `priorId` is present.
- *   - `persisted` / `relocated` → both, and they may differ when a
- *      location fingerprint shifted across the line-window boundary
- *      (each "side" has its own hash even though they describe the
- *      same finding).
+ * - `added` → only `currentId` is present.
+ * - `removed` → only `priorId` is present.
+ * - `persisted` / `relocated` → both, and they may differ when a
+ * location fingerprint shifted across the line-window boundary
+ * (each "side" has its own hash even though they describe the
+ * same finding).
  */
 export type MatchStatus = 'persisted' | 'relocated' | 'added' | 'removed';
 export interface MatchReason {
     /** Short code: 'exact-id', 'git-line-exact', 'git-line-fuzz',
-     *  'git-rename', 'multiset-occurrence'. */
+     * 'git-rename', 'multiset-occurrence'. */
     readonly code: string;
     /** Human-readable explanation suitable for end-user rendering. */
     readonly detail: string;
@@ -464,7 +514,7 @@ export interface MatchPair {
     readonly currentId?: FindingId;
     readonly status: MatchStatus;
     /** Confidence in [0, 1]. 1.0 = exact identity; <1.0 = paired via
-     *  a fallback layer (git relocation, line-fuzz, rename). */
+     * a fallback layer (git relocation, line-fuzz, rename). */
     readonly confidence: number;
     readonly reasons: ReadonlyArray<MatchReason>;
 }
@@ -479,26 +529,26 @@ export type FindingSeverity = 'critical' | 'high' | 'medium' | 'low';
  * check can emit. Wider than `MatchStatus` because policy adds context
  * the matcher doesn't have:
  *
- *   - `persisted` / `relocated` / `added` / `removed` — direct
- *     pass-through of the matcher's pair status.
- *   - `fixed` — a `removed` finding that the policy treats as a
- *     positive event (resolution rather than disappearance). Today
- *     this is informational only; Phase 3 distinguishes the two when
- *     `--detailed` flags it.
- *   - `newly_detected` — current-only finding that surfaced because
- *     the scanner / ruleset / advisory DB / policy config changed,
- *     not because a developer introduced new code. Parent category;
- *     `tooling_drift` and `config_drift` are the specific subtypes.
- *   - `tooling_drift` — scanner or advisory-db version differs
- *     between baseline and current. Reclassified `added` is suspect.
- *   - `config_drift` — `.dxkit-ignore` / policy / suppressions hash
- *     differs between runs.
- *   - `probable_existing` — current-only with weak evidence it's
- *     truly new (a prior near-match exists but didn't pair cleanly).
- *     Reserved for the content-hash / semantic fallback layer in
- *     Sprint 0.x.
- *   - `uncertain` — confidence below the per-severity threshold;
- *     the policy can't classify with conviction.
+ * - `persisted` / `relocated` / `added` / `removed` — direct
+ * pass-through of the matcher's pair status.
+ * - `fixed` — a `removed` finding that the policy treats as a
+ * positive event (resolution rather than disappearance). Today
+ * this is informational only; Phase 3 distinguishes the two when
+ * `--detailed` flags it.
+ * - `newly_detected` — current-only finding that surfaced because
+ * the scanner / ruleset / advisory DB / policy config changed,
+ * not because a developer introduced new code. Parent category;
+ * `tooling_drift` and `config_drift` are the specific subtypes.
+ * - `tooling_drift` — scanner or advisory-db version differs
+ * between baseline and current. Reclassified `added` is suspect.
+ * - `config_drift` — `.dxkit-ignore` / policy / suppressions hash
+ * differs between runs.
+ * - `probable_existing` — current-only with weak evidence it's
+ * truly new (a prior near-match exists but didn't pair cleanly).
+ * Reserved for the content-hash / semantic fallback layer in
+ * Sprint 0.x.
+ * - `uncertain` — confidence below the per-severity threshold;
+ * the policy can't classify with conviction.
  *
  * The enum is the contract Phase 3's guardrail CLI reads. Today's
  * classifier emits a subset — the remaining states are reserved for

package/dist/baseline/types.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../src/baseline/types.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAuDG;AAEH;;;;;;;;;;GAUG;AACH,MAAM,MAAM,SAAS,GAAG,MAAM,CAAC;AAE/B;;;;GAIG;AACH,MAAM,MAAM,qBAAqB,GAAG,IAAI,CAAC;AAEzC;;;;;;;;;;;;GAYG;AACH,MAAM,MAAM,aAAa,GACrB,mBAAmB,GACnB,iBAAiB,GACjB,mBAAmB,GACnB,oBAAoB,GACpB,wBAAwB,GACxB,wBAAwB,GACxB,oBAAoB,GACpB,4BAA4B,GAC5B,gCAAgC,GAChC,oBAAoB,GACpB,sBAAsB,GACtB,sBAAsB,GACtB,uBAAuB,GACvB,uBAAuB,CAAC;AAE5B,+DAA+D;AAC/D,MAAM,WAAW,mBAAmB;IAClC,QAAQ,CAAC,IAAI,EAAE,QAAQ,CAAC;IACxB,wEAAwE;IACxE,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB;gDAC4C;IAC5C,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,kCAAkC;IAClC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB;6DACyD;IACzD,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;CACvB;AAED,2EAA2E;AAC3E,MAAM,WAAW,iBAAiB;IAChC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;CACvB;AAED,+DAA+D;AAC/D,MAAM,WAAW,mBAAmB;IAClC,QAAQ,CAAC,IAAI,EAAE,QAAQ,CAAC;IACxB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,iDAAiD;IACjD,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;CACvB;AAED,gFAAgF;AAChF,MAAM,WAAW,oBAAoB;IACnC,QAAQ,CAAC,IAAI,EAAE,UAAU,CAAC;IAC1B,gDAAgD;IAChD,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB;0CACsC;IACtC,QAAQ,CAAC,gBAAgB,EAAE,MAAM,GAAG,SAAS,CAAC;IAC9C,qEAAqE;IACrE,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAC;CACrB;AAED,4CAA4C;AAC5C,MAAM,WAAW,wBAAwB;IACvC,QAAQ,CAAC,IAAI,EAAE,aAAa,CAAC;IAC7B;kEAC8D;IAC9D,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB;;;;gEAI4D;IAC5D,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB;;;8CAG0C;IAC1C,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B,yCAAyC;IACzC,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;CAC7B;AAED;;;;;GAKG;AACH,MAAM,WAAW,wBAAwB;IACvC,QAAQ,CAAC,IAAI,EAAE,cAAc,CAAC;IAC9B,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB;;uBAEmB;IACnB,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC;IACzB;kBACc;IACd,QAAQ,CAAC,SAAS,CAAC,EAAE,SAAS,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;CAChD;AAED;;;;;;;;GAQG;AACH,MAAM,MAAM,WAAW,GAAG,UAAU,GAAG,MAAM,GAAG,QAAQ,GAAG,KAAK,CAAC;AAEjE,MAAM,WAAW,oBAAoB;IACnC,QAAQ,CAAC,IAAI,EAAE,UAAU,CAAC;IAC1B,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,IAAI,EAAE,WAAW,CAAC;CAC5B;AAED;;;;;;;GAOG;AACH,MAAM,MAAM,aAAa,GAAG,MAAM,GAAG,OAAO,GAAG,MAAM,GAAG,aAAa,GAAG,UAAU,CAAC;AAEnF,MAAM,WAAW,4BAA4B;IAC3C,QAAQ,CAAC,IAAI,EAAE,SAAS,CAAC;IACzB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,MAAM,EAAE,aAAa,CAAC;CAChC;AAED;;;;;;;GAOG;AACH,MAAM,MAAM,yBAAyB,GAAG,eAAe,GAAG,OAAO,GAAG,aAAa,CAAC;AAElF,MAAM,WAAW,gCAAgC;IAC/C,QAAQ,CAAC,IAAI,EAAE,uBAAuB,CAAC;IACvC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,MAAM,EAAE,yBAAyB,CAAC;CAC5C;AAED;;;;;;;GAOG;AACH,MAAM,WAAW,oBAAoB;IACnC,QAAQ,CAAC,IAAI,EAAE,UAAU,CAAC;IAC1B,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;CACvB;AAED;;;;;;GAMG;AACH,MAAM,WAAW,sBAAsB;IACrC,QAAQ,CAAC,IAAI,EAAE,YAAY,CAAC;IAC5B,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB;;;oDAGgD;IAChD,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;CACzB;AAED;;;;;;;;;;GAUG;AACH,MAAM,WAAW,sBAAsB;IACrC,QAAQ,CAAC,IAAI,EAAE,YAAY,CAAC;IAC5B,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;CACvB;AAED;;;;;;;;;;;;;;;;;;GAkBG;AACH,MAAM,WAAW,uBAAuB;IACtC,QAAQ,CAAC,IAAI,EAAE,aAAa,CAAC;IAC7B,4CAA4C;IAC5C,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB;;0BAEsB;IACtB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,8DAA8D;IAC9D,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;CACvB;AAED;;;;;;;;;;;;;;;GAeG;AACH,MAAM,WAAW,uBAAuB;IACtC,QAAQ,CAAC,IAAI,EAAE,aAAa,CAAC;IAC7B,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB;;;sEAGkE;IAClE,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;CAC3B;AAED;;;;;;GAMG;AACH,MAAM,MAAM,aAAa,GACrB;IACE,EAAE,EAAE,SAAS,CAAC;IACd,IAAI,EAAE,QAAQ,GAAG,MAAM,GAAG,QAAQ,CAAC;IACnC,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,MAAM,CAAC;IACb;;;;;oDAKgD;IAChD,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB;;;;;iBAKa;IACb,oBAAoB,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;CAC1C,GACD;IACE,EAAE,EAAE,SAAS,CAAC;IACd,IAAI,EAAE,UAAU,CAAC;IACjB,OAAO,EAAE,MAAM,CAAC;IAChB,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B,UAAU,EAAE,MAAM,CAAC;CACpB,GACD;IACE,EAAE,EAAE,SAAS,CAAC;IACd,IAAI,EAAE,aAAa,CAAC;IACpB,KAAK,EAAE,MAAM,CAAC;IACd,KAAK,EAAE,MAAM,CAAC;IACd,KAAK,EAAE,MAAM,CAAC;IACd,UAAU,EAAE,MAAM,CAAC;IACnB,UAAU,EAAE,MAAM,CAAC;CACpB,GACD;IACE,EAAE,EAAE,SAAS,CAAC;IACd,IAAI,EAAE,cAAc,CAAC;IACrB,IAAI,EAAE,MAAM,CAAC;IACb,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,SAAS,CAAC,EAAE,SAAS,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;CACvC,GACD;IAAE,EAAE,EAAE,SAAS,CAAC;IAAC,IAAI,EAAE,UAAU,CAAC;IAAC,IAAI,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,WAAW,CAAA;CAAE,GACpE;IACE,EAAE,EAAE,SAAS,CAAC;IACd,IAAI,EAAE,SAAS,CAAC;IAChB,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,MAAM,CAAC;IACb,MAAM,EAAE,aAAa,CAAC;IACtB;;2BAEuB;IACvB,WAAW,CAAC,EAAE,MAAM,CAAC;CACtB,GACD;IACE,EAAE,EAAE,SAAS,CAAC;IACd,IAAI,EAAE,uBAAuB,CAAC;IAC9B,IAAI,EAAE,MAAM,CAAC;IACb,MAAM,EAAE,yBAAyB,CAAC;CACnC,GACD;IAAE,EAAE,EAAE,SAAS,CAAC;IAAC,IAAI,EAAE,UAAU,CAAC;IAAC,IAAI,EAAE,MAAM,CAAA;CAAE,GACjD;IAAE,EAAE,EAAE,SAAS,CAAC;IAAC,IAAI,EAAE,YAAY,CAAC;IAAC,IAAI,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAE,GACnE;IAAE,EAAE,EAAE,SAAS,CAAC;IAAC,IAAI,EAAE,YAAY,CAAC;IAAC,IAAI,EAAE,MAAM,CAAA;CAAE,GACnD;IAAE,EAAE,EAAE,SAAS,CAAC;IAAC,IAAI,EAAE,aAAa,CAAC;IAAC,IAAI,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,CAAA;CAAE,GAChF;IAAE,EAAE,EAAE,SAAS,CAAC;IAAC,IAAI,EAAE,aAAa,CAAC;IAAC,IAAI,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,CAAC;IAAC,QAAQ,EAAE,MAAM,CAAA;CAAE,GACpF,sBAAsB,CAAC;AAE3B;;;;;;;GAOG;AACH,MAAM,MAAM,iBAAiB,GAAG,OAAO,CAAC,aAAa,EAAE,sBAAsB,CAAC,CAAC;AAE/E;;;;;;;;;;;;;;;;;GAiBG;AACH,MAAM,WAAW,sBAAsB;IACrC,QAAQ,CAAC,EAAE,EAAE,SAAS,CAAC;IACvB,QAAQ,CAAC,IAAI,EACT,QAAQ,GACR,MAAM,GACN,QAAQ,GACR,UAAU,GACV,aAAa,GACb,cAAc,GACd,UAAU,GACV,SAAS,GACT,uBAAuB,GACvB,UAAU,GACV,YAAY,GACZ,YAAY,GACZ,aAAa,GACb,aAAa,CAAC;IAClB,QAAQ,CAAC,SAAS,EAAE,IAAI,CAAC;CAC1B;AAED;;;;;;;;;;;;;;;GAeG;AACH,MAAM,MAAM,WAAW,GAAG,WAAW,GAAG,WAAW,GAAG,OAAO,GAAG,SAAS,CAAC;AAE1E,MAAM,WAAW,WAAW;IAC1B;+CAC2C;IAC3C,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,kEAAkE;IAClE,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;CACzB;AAED,MAAM,WAAW,SAAS;IACxB,QAAQ,CAAC,OAAO,CAAC,EAAE,SAAS,CAAC;IAC7B,QAAQ,CAAC,SAAS,CAAC,EAAE,SAAS,CAAC;IAC/B,QAAQ,CAAC,MAAM,EAAE,WAAW,CAAC;IAC7B;gEAC4D;IAC5D,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,OAAO,EAAE,aAAa,CAAC,WAAW,CAAC,CAAC;CAC9C;AAED;;;;GAIG;AACH,MAAM,MAAM,eAAe,GAAG,UAAU,GAAG,MAAM,GAAG,QAAQ,GAAG,KAAK,CAAC;AAErE;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA8BG;AACH,MAAM,MAAM,aAAa,GACrB,WAAW,GACX,WAAW,GACX,OAAO,GACP,SAAS,GACT,OAAO,GACP,gBAAgB,GAChB,eAAe,GACf,cAAc,GACd,mBAAmB,GACnB,WAAW,CAAC;AAEhB;;;;;;;;;;;;;;;;;;GAkBG;AACH,MAAM,WAAW,WAAW;IAC1B,QAAQ,CAAC,KAAK,EAAE,aAAa,CAAC,SAAS,CAAC,CAAC;IACzC,QAAQ,CAAC,SAAS,EAAE,aAAa,CAAC,SAAS,CAAC,CAAC;IAC7C,QAAQ,CAAC,KAAK,EAAE,aAAa,CAAC,SAAS,CAAC,CAAC;IACzC,QAAQ,CAAC,OAAO,EAAE,aAAa,CAAC,SAAS,CAAC,CAAC;IAC3C,QAAQ,CAAC,QAAQ,EAAE,OAAO,CAAC;IAC3B,QAAQ,CAAC,cAAc,CAAC,EAAE,MAAM,CAAC;CAClC"}
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../src/baseline/types.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAuDG;AAEH;;;;;;;;;;GAUG;AACH,MAAM,MAAM,SAAS,GAAG,MAAM,CAAC;AAE/B;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,MAAM,MAAM,qBAAqB,GAAG,IAAI,GAAG,IAAI,CAAC;AAEhD;qEACqE;AACrE,eAAO,MAAM,uBAAuB,EAAE,qBAA4B,CAAC;AAEnE;;;;;;;;;;;;GAYG;AACH,MAAM,MAAM,aAAa,GACrB,mBAAmB,GACnB,iBAAiB,GACjB,mBAAmB,GACnB,oBAAoB,GACpB,wBAAwB,GACxB,wBAAwB,GACxB,oBAAoB,GACpB,4BAA4B,GAC5B,gCAAgC,GAChC,oBAAoB,GACpB,sBAAsB,GACtB,sBAAsB,GACtB,uBAAuB,GACvB,uBAAuB,CAAC;AAE5B;;;;;;;;;;;;;GAaG;AACH,MAAM,MAAM,aAAa,GAAG,MAAM,CAAC;AAEnC,+DAA+D;AAC/D,MAAM,WAAW,mBAAmB;IAClC,QAAQ,CAAC,IAAI,EAAE,QAAQ,CAAC;IACxB,wEAAwE;IACxE,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB;+CAC2C;IAC3C,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,kCAAkC;IAClC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB;;0CAEsC;IACtC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB;uEACmE;IACnE,QAAQ,CAAC,aAAa,CAAC,EAAE,aAAa,CAAC;CACxC;AAED,2EAA2E;AAC3E,MAAM,WAAW,iBAAiB;IAChC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB;8EAC0E;IAC1E,QAAQ,CAAC,aAAa,CAAC,EAAE,aAAa,CAAC;CACxC;AAED,+DAA+D;AAC/D,MAAM,WAAW,mBAAmB;IAClC,QAAQ,CAAC,IAAI,EAAE,QAAQ,CAAC;IACxB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,iDAAiD;IACjD,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB;qDACiD;IACjD,QAAQ,CAAC,aAAa,CAAC,EAAE,aAAa,CAAC;CACxC;AAED,gFAAgF;AAChF,MAAM,WAAW,oBAAoB;IACnC,QAAQ,CAAC,IAAI,EAAE,UAAU,CAAC;IAC1B,gDAAgD;IAChD,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB;;;gCAG4B;IAC5B,QAAQ,CAAC,gBAAgB,EAAE,MAAM,GAAG,SAAS,CAAC;IAC9C,qEAAqE;IACrE,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAC;IACpB;;uDAEmD;IACnD,QAAQ,CAAC,OAAO,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;CACtC;AAED,4CAA4C;AAC5C,MAAM,WAAW,wBAAwB;IACvC,QAAQ,CAAC,IAAI,EAAE,aAAa,CAAC;IAC7B;iEAC6D;IAC7D,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB;;;;+DAI2D;IAC3D,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB;;;6CAGyC;IACzC,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B,yCAAyC;IACzC,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;CAC7B;AAED;;;;;GAKG;AACH,MAAM,WAAW,wBAAwB;IACvC,QAAQ,CAAC,IAAI,EAAE,cAAc,CAAC;IAC9B,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB;;sBAEkB;IAClB,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC;IACzB;iBACa;IACb,QAAQ,CAAC,SAAS,CAAC,EAAE,SAAS,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;CAChD;AAED;;;;;;;;GAQG;AACH,MAAM,MAAM,WAAW,GAAG,UAAU,GAAG,MAAM,GAAG,QAAQ,GAAG,KAAK,CAAC;AAEjE,MAAM,WAAW,oBAAoB;IACnC,QAAQ,CAAC,IAAI,EAAE,UAAU,CAAC;IAC1B,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,IAAI,EAAE,WAAW,CAAC;CAC5B;AAED;;;;;;;GAOG;AACH,MAAM,MAAM,aAAa,GAAG,MAAM,GAAG,OAAO,GAAG,MAAM,GAAG,aAAa,GAAG,UAAU,CAAC;AAEnF,MAAM,WAAW,4BAA4B;IAC3C,QAAQ,CAAC,IAAI,EAAE,SAAS,CAAC;IACzB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,MAAM,EAAE,aAAa,CAAC;CAChC;AAED;;;;;;;GAOG;AACH,MAAM,MAAM,yBAAyB,GAAG,eAAe,GAAG,OAAO,GAAG,aAAa,CAAC;AAElF,MAAM,WAAW,gCAAgC;IAC/C,QAAQ,CAAC,IAAI,EAAE,uBAAuB,CAAC;IACvC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,MAAM,EAAE,yBAAyB,CAAC;CAC5C;AAED;;;;;;;GAOG;AACH,MAAM,WAAW,oBAAoB;IACnC,QAAQ,CAAC,IAAI,EAAE,UAAU,CAAC;IAC1B,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;CACvB;AAED;;;;;;GAMG;AACH,MAAM,WAAW,sBAAsB;IACrC,QAAQ,CAAC,IAAI,EAAE,YAAY,CAAC;IAC5B,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB;;;mDAG+C;IAC/C,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;CACzB;AAED;;;;;;;;;;GAUG;AACH,MAAM,WAAW,sBAAsB;IACrC,QAAQ,CAAC,IAAI,EAAE,YAAY,CAAC;IAC5B,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;CACvB;AAED;;;;;;;;;;;;;;;;;;GAkBG;AACH,MAAM,WAAW,uBAAuB;IACtC,QAAQ,CAAC,IAAI,EAAE,aAAa,CAAC;IAC7B,4CAA4C;IAC5C,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB;;yBAEqB;IACrB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,8DAA8D;IAC9D,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;CACvB;AAED;;;;;;;;;;;;;;;GAeG;AACH,MAAM,WAAW,uBAAuB;IACtC,QAAQ,CAAC,IAAI,EAAE,aAAa,CAAC;IAC7B,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB;;;qEAGiE;IACjE,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;CAC3B;AAED;;;;;;GAMG;AACH,MAAM,MAAM,aAAa,GACrB;IACE,EAAE,EAAE,SAAS,CAAC;IACd,IAAI,EAAE,QAAQ,GAAG,MAAM,GAAG,QAAQ,CAAC;IACnC,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,MAAM,CAAC;IACb;;;;;mDAK+C;IAC/C,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB;;;;;gBAKY;IACZ,oBAAoB,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;CAC1C,GACD;IACE,EAAE,EAAE,SAAS,CAAC;IACd,IAAI,EAAE,UAAU,CAAC;IACjB,OAAO,EAAE,MAAM,CAAC;IAChB,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B,UAAU,EAAE,MAAM,CAAC;CACpB,GACD;IACE,EAAE,EAAE,SAAS,CAAC;IACd,IAAI,EAAE,aAAa,CAAC;IACpB,KAAK,EAAE,MAAM,CAAC;IACd,KAAK,EAAE,MAAM,CAAC;IACd,KAAK,EAAE,MAAM,CAAC;IACd,UAAU,EAAE,MAAM,CAAC;IACnB,UAAU,EAAE,MAAM,CAAC;CACpB,GACD;IACE,EAAE,EAAE,SAAS,CAAC;IACd,IAAI,EAAE,cAAc,CAAC;IACrB,IAAI,EAAE,MAAM,CAAC;IACb,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,SAAS,CAAC,EAAE,SAAS,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;CACvC,GACD;IAAE,EAAE,EAAE,SAAS,CAAC;IAAC,IAAI,EAAE,UAAU,CAAC;IAAC,IAAI,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,WAAW,CAAA;CAAE,GACpE;IACE,EAAE,EAAE,SAAS,CAAC;IACd,IAAI,EAAE,SAAS,CAAC;IAChB,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,MAAM,CAAC;IACb,MAAM,EAAE,aAAa,CAAC;IACtB;;0BAEsB;IACtB,WAAW,CAAC,EAAE,MAAM,CAAC;CACtB,GACD;IACE,EAAE,EAAE,SAAS,CAAC;IACd,IAAI,EAAE,uBAAuB,CAAC;IAC9B,IAAI,EAAE,MAAM,CAAC;IACb,MAAM,EAAE,yBAAyB,CAAC;CACnC,GACD;IAAE,EAAE,EAAE,SAAS,CAAC;IAAC,IAAI,EAAE,UAAU,CAAC;IAAC,IAAI,EAAE,MAAM,CAAA;CAAE,GACjD;IAAE,EAAE,EAAE,SAAS,CAAC;IAAC,IAAI,EAAE,YAAY,CAAC;IAAC,IAAI,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAE,GACnE;IAAE,EAAE,EAAE,SAAS,CAAC;IAAC,IAAI,EAAE,YAAY,CAAC;IAAC,IAAI,EAAE,MAAM,CAAA;CAAE,GACnD;IAAE,EAAE,EAAE,SAAS,CAAC;IAAC,IAAI,EAAE,aAAa,CAAC;IAAC,IAAI,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,CAAA;CAAE,GAChF;IAAE,EAAE,EAAE,SAAS,CAAC;IAAC,IAAI,EAAE,aAAa,CAAC;IAAC,IAAI,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,CAAC;IAAC,QAAQ,EAAE,MAAM,CAAA;CAAE,GACpF,sBAAsB,CAAC;AAE3B;;;;;;;GAOG;AACH,MAAM,MAAM,iBAAiB,GAAG,OAAO,CAAC,aAAa,EAAE,sBAAsB,CAAC,CAAC;AAE/E;;;;;;;;;;;;;;;;;GAiBG;AACH,MAAM,WAAW,sBAAsB;IACrC,QAAQ,CAAC,EAAE,EAAE,SAAS,CAAC;IACvB,QAAQ,CAAC,IAAI,EACT,QAAQ,GACR,MAAM,GACN,QAAQ,GACR,UAAU,GACV,aAAa,GACb,cAAc,GACd,UAAU,GACV,SAAS,GACT,uBAAuB,GACvB,UAAU,GACV,YAAY,GACZ,YAAY,GACZ,aAAa,GACb,aAAa,CAAC;IAClB,QAAQ,CAAC,SAAS,EAAE,IAAI,CAAC;CAC1B;AAED;;;;;;;;;;;;;;;GAeG;AACH,MAAM,MAAM,WAAW,GAAG,WAAW,GAAG,WAAW,GAAG,OAAO,GAAG,SAAS,CAAC;AAE1E,MAAM,WAAW,WAAW;IAC1B;8CAC0C;IAC1C,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,kEAAkE;IAClE,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;CACzB;AAED,MAAM,WAAW,SAAS;IACxB,QAAQ,CAAC,OAAO,CAAC,EAAE,SAAS,CAAC;IAC7B,QAAQ,CAAC,SAAS,CAAC,EAAE,SAAS,CAAC;IAC/B,QAAQ,CAAC,MAAM,EAAE,WAAW,CAAC;IAC7B;+DAC2D;IAC3D,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,OAAO,EAAE,aAAa,CAAC,WAAW,CAAC,CAAC;CAC9C;AAED;;;;GAIG;AACH,MAAM,MAAM,eAAe,GAAG,UAAU,GAAG,MAAM,GAAG,QAAQ,GAAG,KAAK,CAAC;AAErE;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA8BG;AACH,MAAM,MAAM,aAAa,GACrB,WAAW,GACX,WAAW,GACX,OAAO,GACP,SAAS,GACT,OAAO,GACP,gBAAgB,GAChB,eAAe,GACf,cAAc,GACd,mBAAmB,GACnB,WAAW,CAAC;AAEhB;;;;;;;;;;;;;;;;;;GAkBG;AACH,MAAM,WAAW,WAAW;IAC1B,QAAQ,CAAC,KAAK,EAAE,aAAa,CAAC,SAAS,CAAC,CAAC;IACzC,QAAQ,CAAC,SAAS,EAAE,aAAa,CAAC,SAAS,CAAC,CAAC;IAC7C,QAAQ,CAAC,KAAK,EAAE,aAAa,CAAC,SAAS,CAAC,CAAC;IACzC,QAAQ,CAAC,OAAO,EAAE,aAAa,CAAC,SAAS,CAAC,CAAC;IAC3C,QAAQ,CAAC,QAAQ,EAAE,OAAO,CAAC;IAC3B,QAAQ,CAAC,cAAc,CAAC,EAAE,MAAM,CAAC;CAClC"}

package/dist/baseline/types.js

@@ -10,20 +10,20 @@
  * identity." Each finding has up to several fingerprint axes,
  * differentiated by what they capture:
  *
- *   - **Location fingerprint** — `(canonicalRule, file, lineWindow)`
- *     for code/secret/config/hygiene findings. Locates a finding
- *     in the source tree with ±2 line drift tolerance via bucket
- *     windowing. Stable across small reformat / whitespace edits;
- *     drifts on bigger shifts (closed by git-aware match).
- *   - **Domain fingerprint** — `(package, version, advisoryId)` for
- *     dep-vulns; `(package, version, licenseType)` for licenses;
- *     normalized block hash for jscpd. Captures *what the finding
- *     is about* independent of source position. Drift-immune.
- *   - **Semantic fingerprint** — `(file, symbol)` for coverage gaps
- *     when a symbol is known. Survives any vertical drift within
- *     the symbol body.
- *   - **Content fingerprint** — Sprint 0.x. Normalized snippet
- *     hash; fallback when git history is unreachable.
+ * - **Location fingerprint** — `(canonicalRule, file, lineWindow)`
+ * for code/secret/config/hygiene findings. Locates a finding
+ * in the source tree with ±2 line drift tolerance via bucket
+ * windowing. Stable across small reformat / whitespace edits;
+ * drifts on bigger shifts (closed by git-aware match).
+ * - **Domain fingerprint** — `(package, version, advisoryId)` for
+ * dep-vulns; `(package, version, licenseType)` for licenses;
+ * normalized block hash for jscpd. Captures *what the finding
+ * is about* independent of source position. Drift-immune.
+ * - **Semantic fingerprint** — `(file, symbol)` for coverage gaps
+ * when a symbol is known. Survives any vertical drift within
+ * the symbol body.
+ * - **Content fingerprint** — Sprint 0.x. Normalized snippet
+ * hash; fallback when git history is unreachable.
  *
  * The hash format is identical across axes — 16-char lowercase hex
  * (SHA-1[0:16]). Callers don't need to know which axis a hash came
@@ -35,18 +35,18 @@
  * findings. Each `IdentityInput` discriminant maps 1:1 to an existing
  * gather pipeline:
  *
- *   - `secret` / `code` / `config` — security analyzer's
- *     `SecurityFinding` (gitleaks, semgrep, TLS-bypass registry,
- *     private-key files, env-in-git).
- *   - `dep-vuln` — security analyzer's `DepVulnFinding` (osv-scanner,
- *     npm-audit, pip-audit, cargo-audit, etc.).
- *   - `duplication` — quality analyzer's `CloneGroup` (jscpd).
- *   - `coverage-gap` — coverage-gap report entries (file + symbol
- *     when available, fallback to file + line range).
- *   - `test-gap` — non-test source files flagged by the test-gaps
- *     analyzer.
- *   - `hygiene` — TODO / FIXME / HACK / console-log / any-type
- *     occurrences (per-occurrence identity).
+ * - `secret` / `code` / `config` — security analyzer's
+ * `SecurityFinding` (gitleaks, semgrep, TLS-bypass registry,
+ * private-key files, env-in-git).
+ * - `dep-vuln` — security analyzer's `DepVulnFinding` (osv-scanner,
+ * npm-audit, pip-audit, cargo-audit, etc.).
+ * - `duplication` — quality analyzer's `CloneGroup` (jscpd).
+ * - `coverage-gap` — coverage-gap report entries (file + symbol
+ * when available, fallback to file + line range).
+ * - `test-gap` — non-test source files flagged by the test-gaps
+ * analyzer.
+ * - `hygiene` — TODO / FIXME / HACK / console-log / any-type
+ * occurrences (per-occurrence identity).
  *
  * License attributions are NOT a baseline finding kind. They live in
  * the per-package BoM artifact (`.dxkit/bom.json`) — the canonical
@@ -56,4 +56,8 @@
  * lifted out.
  */
 Object.defineProperty(exports, "__esModule", { value: true });
+exports.CURRENT_IDENTITY_SCHEME = void 0;
+/** The scheme `identityFor` mints new identities under by default, and the
+ *  version stamped on freshly written baseline / allowlist files. */
+exports.CURRENT_IDENTITY_SCHEME = 'v2';
 //# sourceMappingURL=types.js.map

package/dist/baseline/types.js.map

@@ -1 +1 @@
-{"version":3,"file":"types.js","sourceRoot":"","sources":["../../src/baseline/types.ts"],"names":[],"mappings":";AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAuDG"}
+{"version":3,"file":"types.js","sourceRoot":"","sources":["../../src/baseline/types.ts"],"names":[],"mappings":";AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAuDG;;;AAsCH;qEACqE;AACxD,QAAA,uBAAuB,GAA0B,IAAI,CAAC"}

package/dist/explore/context-hook.d.ts

@@ -1,42 +1,62 @@
-/**
- * `vyuh-dxkit context-hook` — the Claude Code PreToolUse hook that
- * delivers the token-reduction win passively. Wired into a scaffolded
- * repo's `.claude/settings.json` with a `Grep|Glob` matcher: when an
- * agent is about to search the codebase, this hook injects a slim
- * structural map as `additionalContext` so the agent needs fewer
- * follow-up whole-file reads.
- *
- * THE CONTRACT IS FAIL-OPEN + ADDITIVE. This hook can only ever ADD
- * context; it never blocks the tool, never replaces grep output, and
- * stays a silent no-op (exit 0, no stdout) on ANY problem — missing
- * graph.json, parse error, no keyword match, unreadable stdin. So
- * Claude Code behaves exactly as it does today whenever the graph is
- * absent or unhelpful; the hook is pure upside.
- *
- * Claude Code passes the tool call as JSON on stdin
- * (`{ tool_name, tool_input: { pattern, ... }, ... }`) and reads a
- * JSON object on stdout with `hookSpecificOutput.additionalContext`.
- */
-import { type ContextResult } from './queries';
+import { type ContextResult, type FileSummary } from './queries';
 import type { Graph } from './types';
+/** What the agent's tool call resolved to: a specific file, or a search term. */
+type HookTarget = {
+    kind: 'file';
+    file: string;
+} | {
+    kind: 'pattern';
+    pattern: string;
+};
 /**
- * Entry point for `case 'context-hook'`. Reads stdin, runs the query,
- * writes the hook output. Wrapped so nothing it does can fail the
- * tool call: every failure path resolves to a silent no-op.
+ * Entry point for `case 'context-hook'`. Reads stdin, resolves the
+ * target, runs the query, writes the hook output. Wrapped so nothing it
+ * does can fail the tool call: every failure path resolves to a silent
+ * no-op.
  */
 export declare function runContextHook(cwd: string): Promise<void>;
+/** The fields of the PreToolUse payload the hook consumes. */
+interface HookPayload {
+    toolName?: string;
+    toolInput: Record<string, unknown>;
+    sessionId?: string;
+}
+/** Parse the raw stdin JSON into the subset of fields the hook needs. */
+export declare function parsePayload(rawStdin: string): HookPayload | undefined;
+/**
+ * Decide what to inject context about, given the tool the agent invoked.
+ * Returns undefined (→ no-op) for tools/inputs we can't confidently map.
+ */
+export declare function resolveHookTarget(payload: HookPayload, graph: Graph, cwd: string): HookTarget | undefined;
+/**
+ * Extract a grep/rg target from a Bash command. Prefers a concrete
+ * source file named in the command (→ that file's structural summary);
+ * otherwise falls back to the search pattern (→ symbol-name match). Only
+ * fires for recognised search tools so an arbitrary Bash command is a
+ * clean no-op.
+ */
+export declare function parseBashForTarget(command: string, graph: Graph, cwd: string): HookTarget | undefined;
+/**
+ * Compact `additionalContext` body for a FILE target: the file's
+ * symbols, who depends on it (caller files), and what it reaches into
+ * (callee files). Terser than the CLI's markdown — the hook pays this on
+ * every read. Leads with provenance + a best-effort caveat so the agent
+ * calibrates trust.
+ */
+export declare function formatFileContext(summary: FileSummary, graph: Graph): string;
 /**
- * Extract the search keyword from the PreToolUse payload. Both Grep
- * and Glob carry it on `tool_input.pattern`. Returns undefined for
- * anything we can't confidently read (→ no-op upstream).
+ * Extract the search keyword from a Grep/Glob-style payload. Both carry
+ * it on `tool_input.pattern`. Returns undefined for anything we can't
+ * confidently read (→ no-op upstream).
  */
 export declare function extractPattern(rawStdin: string): string | undefined;
 /**
- * Compact `additionalContext` body. Terser than the CLI's markdown
- * (the hook pays this cost on every grep): an anchor line, blast
- * radius, and the top symbols grouped by their leading community.
+ * Compact `additionalContext` body for a PATTERN target. Terser than the
+ * CLI's markdown (the hook pays this cost on every grep): an anchor line,
+ * blast radius, and the top symbols grouped by their leading community.
  * Leads with a one-line provenance + best-effort caveat so the agent
  * calibrates trust.
  */
 export declare function formatHookContext(result: ContextResult, graph: Graph): string;
+export {};
 //# sourceMappingURL=context-hook.d.ts.map

package/dist/explore/context-hook.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"context-hook.d.ts","sourceRoot":"","sources":["../../src/explore/context-hook.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;GAkBG;AAEH,OAAO,EAAgB,KAAK,aAAa,EAAE,MAAM,WAAW,CAAC;AAE7D,OAAO,KAAK,EAAE,KAAK,EAAE,MAAM,SAAS,CAAC;AAKrC;;;;GAIG;AACH,wBAAsB,cAAc,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CA0B/D;AAED;;;;GAIG;AACH,wBAAgB,cAAc,CAAC,QAAQ,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS,CAcnE;AAED;;;;;;GAMG;AACH,wBAAgB,iBAAiB,CAAC,MAAM,EAAE,aAAa,EAAE,KAAK,EAAE,KAAK,GAAG,MAAM,CAiC7E"}
+{"version":3,"file":"context-hook.d.ts","sourceRoot":"","sources":["../../src/explore/context-hook.ts"],"names":[],"mappings":"AA2CA,OAAO,EAAkC,KAAK,aAAa,EAAE,KAAK,WAAW,EAAE,MAAM,WAAW,CAAC;AAEjG,OAAO,KAAK,EAAE,KAAK,EAAE,MAAM,SAAS,CAAC;AAKrC,iFAAiF;AACjF,KAAK,UAAU,GAAG;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,CAAA;CAAE,GAAG;IAAE,IAAI,EAAE,SAAS,CAAC;IAAC,OAAO,EAAE,MAAM,CAAA;CAAE,CAAC;AAExF;;;;;GAKG;AACH,wBAAsB,cAAc,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAmD/D;AAED,8DAA8D;AAC9D,UAAU,WAAW;IACnB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,SAAS,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IACnC,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB;AAED,yEAAyE;AACzE,wBAAgB,YAAY,CAAC,QAAQ,EAAE,MAAM,GAAG,WAAW,GAAG,SAAS,CAkBtE;AAED;;;GAGG;AACH,wBAAgB,iBAAiB,CAC/B,OAAO,EAAE,WAAW,EACpB,KAAK,EAAE,KAAK,EACZ,GAAG,EAAE,MAAM,GACV,UAAU,GAAG,SAAS,CAqBxB;AAED;;;;;;GAMG;AACH,wBAAgB,kBAAkB,CAChC,OAAO,EAAE,MAAM,EACf,KAAK,EAAE,KAAK,EACZ,GAAG,EAAE,MAAM,GACV,UAAU,GAAG,SAAS,CA2BxB;AAiBD;;;;;;GAMG;AACH,wBAAgB,iBAAiB,CAAC,OAAO,EAAE,WAAW,EAAE,KAAK,EAAE,KAAK,GAAG,MAAM,CA4C5E;AA8CD;;;;GAIG;AACH,wBAAgB,cAAc,CAAC,QAAQ,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS,CAcnE;AAED;;;;;;GAMG;AACH,wBAAgB,iBAAiB,CAAC,MAAM,EAAE,aAAa,EAAE,KAAK,EAAE,KAAK,GAAG,MAAM,CAiC7E"}