@vyuhlabs/dxkit 2.9.4 → 2.11.0

package/dist/analyzers/security/aggregator.d.ts

@@ -9,46 +9,46 @@
  *
  * The disease this closes (D086 / D087 / D091):
  *
- *   - **D086** Health Security section and standalone vuln-scan Code
- *     Findings table both reported "code findings by severity" but
- *     came up with different numbers (`0C 11H 18M 0L` vs
- *     `0C 17H 14M 0L`) on the same repo. Two consumers, two
- *     aggregation paths, slightly-different inclusion rules.
+ * - **D086** Health Security section and standalone vuln-scan Code
+ * Findings table both reported "code findings by severity" but
+ * came up with different numbers (`0C 11H 18M 0L` vs
+ * `0C 17H 14M 0L`) on the same repo. Two consumers, two
+ * aggregation paths, slightly-different inclusion rules.
  *
- *   - **D087** Vuln-scan exec summary said "Subtotal: 70" (sum of
- *     dep-vuln severity buckets) and the same page later said
- *     "81 advisories" (findings.length). 70 vs 81 on one page.
+ * - **D087** Vuln-scan exec summary said "Subtotal: 70" (sum of
+ * dep-vuln severity buckets) and the same page later said
+ * "81 advisories" (findings.length). 70 vs 81 on one page.
  *
- *   - **D091** A single TLS-bypass root finding surfaced twice in the
- *     Code Findings table (registry-grep at `:74` HIGH, semgrep at
- *     `:72` MEDIUM) because code findings carried no fingerprint and
- *     no cross-tool dedup ran.
+ * - **D091** A single TLS-bypass root finding surfaced twice in the
+ * Code Findings table (registry-grep at `:74` HIGH, semgrep at
+ * `:72` MEDIUM) because code findings carried no fingerprint and
+ * no cross-tool dedup ran.
  *
  * Architectural posture:
  *
- *   - The aggregator sits BETWEEN gather and reports. Gather still
- *     produces raw envelopes (`gatherSecrets`, `gatherFileFindings`,
- *     `gatherCodePatterns`, `gatherTlsBypassFindings`, `gatherDepVulns`);
- *     the aggregator merges + dedups + buckets them into the canonical
- *     shape; consumers read by field name.
+ * - The aggregator sits BETWEEN gather and reports. Gather still
+ * produces raw envelopes (`gatherSecrets`, `gatherFileFindings`,
+ * `gatherCodePatterns`, `gatherTlsBypassFindings`, `gatherDepVulns`);
+ * the aggregator merges + dedups + buckets them into the canonical
+ * shape; consumers read by field name.
  *
- *   - Three separately-named severity buckets (`codeBySeverity`,
- *     `depBySeverity`, `secretsBySeverity`) — the shape forbids any
- *     consumer from accidentally summing cross-axis again.
+ * - Three separately-named severity buckets (`codeBySeverity`,
+ * `depBySeverity`, `secretsBySeverity`) — the shape forbids any
+ * consumer from accidentally summing cross-axis again.
  *
- *   - Two named dep counts (`dependencyAdvisoryUniqueCount` for the
- *     canonical user-facing total; `dependencyFindingsRawCount` for
- *     diagnostic audit). Renderers cannot pick "the wrong number"
- *     without naming which they want.
+ * - Two named dep counts (`dependencyAdvisoryUniqueCount` for the
+ * canonical user-facing total; `dependencyFindingsRawCount` for
+ * diagnostic audit). Renderers cannot pick "the wrong number"
+ * without naming which they want.
  *
- *   - Code findings get a canonical-rule + line-window fingerprint;
- *     cross-tool collisions collapse to ONE CodeFinding with
- *     `keptSeverity = max(severities)` and `producedBy` listing all
- *     contributing tools. The `dedupCollisions` audit trail records
- *     every collapse for `--detailed` visibility.
+ * - Code findings get a canonical-rule + line-window fingerprint;
+ * cross-tool collisions collapse to ONE CodeFinding with
+ * `keptSeverity = max(severities)` and `producedBy` listing all
+ * contributing tools. The `dedupCollisions` audit trail records
+ * every collapse for `--detailed` visibility.
  *
- *   - `provenance` distinguishes "tool ran, 0 findings" from "tool
- *     didn't run" — drives D080-style "(not run: typescript)" labels.
+ * - `provenance` distinguishes "tool ran, 0 findings" from "tool
+ * didn't run" — drives D080-style "(not run: typescript)" labels.
  *
  * G_v4_8 architectural gate (`scripts/check-architecture.sh`) blocks
  * `countBySeverity` / severity-Record accumulator declarations
@@ -56,6 +56,7 @@
  */
 import type { DepVulnFinding } from '../../languages/capabilities/types';
 import type { Severity, SecurityFinding } from './types';
+import type { AllowlistFile } from '../../allowlist/file';
 export type { Severity, FindingCategory, SecurityFinding } from './types';
 /**
  * Per-severity counts. Local copy (avoids cross-module import friction
@@ -73,26 +74,26 @@ export interface SeverityCounts {
  * `SecurityFinding` with the identity + provenance fields the
  * aggregator stamps:
  *
- *   - `fingerprint` — stable 16-char hash of
- *     `(canonicalRule | file | lineWindow)`. Same key across runs;
- *     enables diff tooling and dedup-by-identity downstream.
- *   - `canonicalRule` — normalized rule id from the canonical-rule
- *     registry. Different raw tool/rule pairs that describe the same
- *     root finding collapse to the same `canonicalRule`. Unmapped
- *     pairs pass through as `raw:${tool}:${rule}` — conservative
- *     default; new collapse rules require explicit registry entries.
- *   - `producedBy` — every raw `tool` that contributed to this
- *     finding. Length > 1 means cross-tool dedup fired.
+ * - `fingerprint` — stable 16-char hash of
+ * `(canonicalRule | file | lineWindow)`. Same key across runs;
+ * enables diff tooling and dedup-by-identity downstream.
+ * - `canonicalRule` — normalized rule id from the canonical-rule
+ * registry. Different raw tool/rule pairs that describe the same
+ * root finding collapse to the same `canonicalRule`. Unmapped
+ * pairs pass through as `raw:${tool}:${rule}` — conservative
+ * default; new collapse rules require explicit registry entries.
+ * - `producedBy` — every raw `tool` that contributed to this
+ * finding. Length > 1 means cross-tool dedup fired.
  */
 export interface CodeFinding extends SecurityFinding {
     fingerprint: string;
     canonicalRule: string;
     producedBy: string[];
     /** Fingerprints of the cross-tool / neighbor-bucket / CWE-bridge
-     *  findings that collapsed into this one, when their own fingerprint
-     *  differed from `fingerprint`. Present only when such a merge fired.
-     *  Lets a suppression keyed on a contributing fingerprint still match
-     *  the merged finding (robust matching against dedup nondeterminism). */
+     * findings that collapsed into this one, when their own fingerprint
+     * differed from `fingerprint`. Present only when such a merge fired.
+     * Lets a suppression keyed on a contributing fingerprint still match
+     * the merged finding (robust matching against dedup nondeterminism). */
     absorbedFingerprints?: string[];
 }
 /**
@@ -129,10 +130,10 @@ export interface AggregateProvenance {
         ran: boolean;
     };
     /** Ingested external-engine provenance. `tools` is the set of
-     *  engines whose findings were ingested this run (e.g. `['codeql']`,
-     *  `['snyk-code']`); `ran` is true when ingestion contributed. Always
-     *  populated by `buildSecurityAggregate`; optional in the type only so
-     *  pre-existing test mocks needn't be rewritten. */
+     * engines whose findings were ingested this run (e.g. `['codeql']`,
+     * `['snyk-code']`); `ran` is true when ingestion contributed. Always
+     * populated by `buildSecurityAggregate`; optional in the type only so
+     * pre-existing test mocks needn't be rewritten. */
     external?: {
         tools: string[];
         ran: boolean;
@@ -157,19 +158,29 @@ export interface AggregateProvenance {
  */
 export interface SecurityAggregate {
     /** Code-pattern findings by severity (semgrep + tls-bypass-registry
-     *  + any future per-pack code-pattern producers), post-dedup. */
+     * + any future per-pack code-pattern producers), post-dedup. */
     codeBySeverity: SeverityCounts;
     /** Dependency advisories by severity, derived from the
-     *  fingerprint-unique advisory set (NOT the per-pack envelope
-     *  count sum). Sums to `dependencyAdvisoryUniqueCount`. */
+     * fingerprint-unique advisory set (NOT the per-pack envelope
+     * count sum). Sums to `dependencyAdvisoryUniqueCount`. */
     depBySeverity: SeverityCounts;
     /** Secret + secret-adjacent findings (gitleaks + private-key files +
-     *  .env-in-git) by severity. Each axis stays separate so consumers
-     *  pick which they own. */
+     * .env-in-git) by severity. Each axis stays separate so consumers
+     * pick which they own. */
     secretsBySeverity: SeverityCounts;
+    /** Code-pattern findings by severity, EXCLUDING findings an active
+     * allowlist entry lifts from the score (`false-positive` /
+     * `test-fixture`). The dimension scorer reads these; reports read the
+     * raw `codeBySeverity`. Equal to `codeBySeverity` when no allowlist
+     * was supplied or none of the findings are score-lifted. */
+    scoreableCodeBySeverity: SeverityCounts;
+    /** Secret + secret-adjacent findings by severity, EXCLUDING
+     * score-lifting allowlisted findings. Scorer reads this; reports read
+     * raw `secretsBySeverity`. */
+    scoreableSecretsBySeverity: SeverityCounts;
     /** Findings partitioned by category, post-dedup. Renderers iterate
-     *  these — never iterate raw envelope arrays. `dependency` is the
-     *  fingerprint-unique advisory set. */
+     * these — never iterate raw envelope arrays. `dependency` is the
+     * fingerprint-unique advisory set. */
     findingsByCategory: {
         secret: ReadonlyArray<CodeFinding>;
         code: ReadonlyArray<CodeFinding>;
@@ -192,7 +203,7 @@ export interface SecurityAggregate {
      */
     dependencyFindingsRawCount: number;
     /** Audit trail of every cross-tool / cross-line-window collapse.
-     *  Empty in the no-collision case. */
+     * Empty in the no-collision case. */
     dedupCollisions: ReadonlyArray<DedupCollision>;
     /** Per-source provenance — drives "(not run: typescript)" labels. */
     provenance: AggregateProvenance;
@@ -214,21 +225,21 @@ export interface SecurityAggregateInput {
         toolUsed: string | null;
     };
     /** Findings ingested from external interprocedural-SAST engines
-     *  (Snyk Code, CodeQL, …) via `src/ingest`. Already mapped to
-     *  `SecurityFinding` with the engine as the `tool`. They join the
-     *  same code-side dedup pipeline as native findings, so a Snyk and a
-     *  semgrep finding on the same line collapse to one `CodeFinding`.
-     *  Optional: absent (or empty) yields output identical to a run with
-     *  no ingestion configured. */
+     * (Snyk Code, CodeQL, …) via `src/ingest`. Already mapped to
+     * `SecurityFinding` with the engine as the `tool`. They join the
+     * same code-side dedup pipeline as native findings, so a Snyk and a
+     * semgrep finding on the same line collapse to one `CodeFinding`.
+     * Optional: absent (or empty) yields output identical to a run with
+     * no ingestion configured. */
     external?: {
         findings: SecurityFinding[];
         toolsUsed: string[];
     };
     tlsBypass: SecurityFinding[];
     /** Pattern count from `allTlsBypassPatterns()` — drives the
-     *  `provenance.tlsBypass.ran` flag (ran=false when no patterns were
-     *  registered, NOT when 0 findings matched against a non-empty
-     *  pattern set). */
+     * `provenance.tlsBypass.ran` flag (ran=false when no patterns were
+     * registered, NOT when 0 findings matched against a non-empty
+     * pattern set). */
     tlsBypassPatternCount: number;
     depVulns: {
         findings: DepVulnFinding[];
@@ -236,27 +247,34 @@ export interface SecurityAggregateInput {
         available: boolean;
         unavailableReason: string;
     };
+    /** The repo's allowlist, loaded by the caller (the aggregator stays
+     * pure / does no I/O). When present, each code/secret/config finding
+     * is annotated with its active-allowlist status, and the `scoreable*`
+     * severity buckets exclude findings allowlisted under a category that
+     * lifts the score (`false-positive` / `test-fixture`). Absent/null →
+     * `scoreable*` buckets equal the raw buckets. */
+    allowlist?: AllowlistFile | null;
 }
 /**
  * Build the canonical aggregate from per-gatherer envelopes. Pure
  * function — same input always produces the same output.
  *
  * Dedup pipeline (code-side):
- *   1. Concat raw findings from secrets/fileFindings/codePatterns/tlsBypass.
- *   2. Group by `(canonicalRule, file, lineWindow)` key.
- *   3. For each group:
- *      - Emit ONE `CodeFinding` with `keptSeverity = max(severities)`,
- *        `producedBy` = unique sources.
- *      - If the group had >1 raw finding, record a `DedupCollision`
- *        audit entry.
+ * 1. Concat raw findings from secrets/fileFindings/codePatterns/tlsBypass.
+ * 2. Group by `(canonicalRule, file, lineWindow)` key.
+ * 3. For each group:
+ * - Emit ONE `CodeFinding` with `keptSeverity = max(severities)`,
+ * `producedBy` = unique sources.
+ * - If the group had >1 raw finding, record a `DedupCollision`
+ * audit entry.
  *
  * Dedup pipeline (dep-side):
- *   - Group `depVulns.findings` by `fingerprint`.
- *   - For each group: pick the highest-severity entry as the
- *     representative; severity counts are derived from the unique
- *     set so they match `dependencyAdvisoryUniqueCount`.
- *   - Findings without a fingerprint pass through unchanged (defensive;
- *     `stampFingerprints` in `gatherDepVulns` runs before this).
+ * - Group `depVulns.findings` by `fingerprint`.
+ * - For each group: pick the highest-severity entry as the
+ * representative; severity counts are derived from the unique
+ * set so they match `dependencyAdvisoryUniqueCount`.
+ * - Findings without a fingerprint pass through unchanged (defensive;
+ * `stampFingerprints` in `gatherDepVulns` runs before this).
  */
 export declare function buildSecurityAggregate(input: SecurityAggregateInput): SecurityAggregate;
 //# sourceMappingURL=aggregator.d.ts.map

package/dist/analyzers/security/aggregator.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"aggregator.d.ts","sourceRoot":"","sources":["../../../src/analyzers/security/aggregator.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAuDG;AAEH,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,oCAAoC,CAAC;AACzE,OAAO,KAAK,EAAE,QAAQ,EAAmB,eAAe,EAAE,MAAM,SAAS,CAAC;AAK1E,YAAY,EAAE,QAAQ,EAAE,eAAe,EAAE,eAAe,EAAE,MAAM,SAAS,CAAC;AAI1E;;;;GAIG;AACH,MAAM,WAAW,cAAc;IAC7B,QAAQ,EAAE,MAAM,CAAC;IACjB,IAAI,EAAE,MAAM,CAAC;IACb,MAAM,EAAE,MAAM,CAAC;IACf,GAAG,EAAE,MAAM,CAAC;CACb;AAED;;;;;;;;;;;;;;;GAeG;AACH,MAAM,WAAW,WAAY,SAAQ,eAAe;IAClD,WAAW,EAAE,MAAM,CAAC;IACpB,aAAa,EAAE,MAAM,CAAC;IACtB,UAAU,EAAE,MAAM,EAAE,CAAC;IACrB;;;;6EAIyE;IACzE,oBAAoB,CAAC,EAAE,MAAM,EAAE,CAAC;CACjC;AAED;;;;;GAKG;AACH,MAAM,WAAW,cAAc;IAC7B,aAAa,EAAE,MAAM,CAAC;IACtB,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,MAAM,CAAC;IACb,YAAY,EAAE,QAAQ,CAAC;IACvB,aAAa,EAAE,aAAa,CAAC;QAC3B,IAAI,EAAE,MAAM,CAAC;QACb,IAAI,EAAE,MAAM,CAAC;QACb,IAAI,EAAE,MAAM,CAAC;QACb,QAAQ,EAAE,QAAQ,CAAC;KACpB,CAAC,CAAC;CACJ;AAED;;;;;GAKG;AACH,MAAM,WAAW,mBAAmB;IAClC,OAAO,EAAE;QAAE,IAAI,EAAE,MAAM,GAAG,IAAI,CAAC;QAAC,GAAG,EAAE,OAAO,CAAA;KAAE,CAAC;IAC/C,YAAY,EAAE;QAAE,IAAI,EAAE,MAAM,GAAG,IAAI,CAAC;QAAC,GAAG,EAAE,OAAO,CAAA;KAAE,CAAC;IACpD;;;;wDAIoD;IACpD,QAAQ,CAAC,EAAE;QAAE,KAAK,EAAE,MAAM,EAAE,CAAC;QAAC,GAAG,EAAE,OAAO,CAAA;KAAE,CAAC;IAC7C,SAAS,EAAE;QAAE,GAAG,EAAE,OAAO,CAAC;QAAC,YAAY,EAAE,MAAM,CAAA;KAAE,CAAC;IAClD,YAAY,EAAE;QAAE,GAAG,EAAE,OAAO,CAAA;KAAE,CAAC;IAC/B,QAAQ,EAAE;QAAE,IAAI,EAAE,MAAM,GAAG,IAAI,CAAC;QAAC,SAAS,EAAE,OAAO,CAAC;QAAC,iBAAiB,EAAE,MAAM,CAAA;KAAE,CAAC;CAClF;AAED;;;;GAIG;AACH,MAAM,WAAW,iBAAiB;IAChC;qEACiE;IACjE,cAAc,EAAE,cAAc,CAAC;IAE/B;;+DAE2D;IAC3D,aAAa,EAAE,cAAc,CAAC;IAE9B;;+BAE2B;IAC3B,iBAAiB,EAAE,cAAc,CAAC;IAElC;;2CAEuC;IACvC,kBAAkB,EAAE;QAClB,MAAM,EAAE,aAAa,CAAC,WAAW,CAAC,CAAC;QACnC,IAAI,EAAE,aAAa,CAAC,WAAW,CAAC,CAAC;QACjC,MAAM,EAAE,aAAa,CAAC,WAAW,CAAC,CAAC;QACnC,UAAU,EAAE,aAAa,CAAC,cAAc,CAAC,CAAC;KAC3C,CAAC;IAEF;;;;;;OAMG;IACH,6BAA6B,EAAE,MAAM,CAAC;IAEtC;;;;;OAKG;IACH,0BAA0B,EAAE,MAAM,CAAC;IAEnC;0CACsC;IACtC,eAAe,EAAE,aAAa,CAAC,cAAc,CAAC,CAAC;IAE/C,qEAAqE;IACrE,UAAU,EAAE,mBAAmB,CAAC;CACjC;AAyCD;;;;;GAKG;AACH,MAAM,WAAW,sBAAsB;IACrC,OAAO,EAAE;QAAE,QAAQ,EAAE,eAAe,EAAE,CAAC;QAAC,QAAQ,EAAE,MAAM,GAAG,IAAI,CAAA;KAAE,CAAC;IAClE,YAAY,EAAE,eAAe,EAAE,CAAC;IAChC,YAAY,EAAE;QAAE,QAAQ,EAAE,eAAe,EAAE,CAAC;QAAC,QAAQ,EAAE,MAAM,GAAG,IAAI,CAAA;KAAE,CAAC;IACvE;;;;;;mCAM+B;IAC/B,QAAQ,CAAC,EAAE;QAAE,QAAQ,EAAE,eAAe,EAAE,CAAC;QAAC,SAAS,EAAE,MAAM,EAAE,CAAA;KAAE,CAAC;IAChE,SAAS,EAAE,eAAe,EAAE,CAAC;IAC7B;;;wBAGoB;IACpB,qBAAqB,EAAE,MAAM,CAAC;IAC9B,QAAQ,EAAE;QACR,QAAQ,EAAE,cAAc,EAAE,CAAC;QAC3B,IAAI,EAAE,MAAM,GAAG,IAAI,CAAC;QACpB,SAAS,EAAE,OAAO,CAAC;QACnB,iBAAiB,EAAE,MAAM,CAAC;KAC3B,CAAC;CACH;AAED;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,wBAAgB,sBAAsB,CAAC,KAAK,EAAE,sBAAsB,GAAG,iBAAiB,CA6QvF"}
+{"version":3,"file":"aggregator.d.ts","sourceRoot":"","sources":["../../../src/analyzers/security/aggregator.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAuDG;AAEH,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,oCAAoC,CAAC;AACzE,OAAO,KAAK,EAAE,QAAQ,EAAmB,eAAe,EAAE,MAAM,SAAS,CAAC;AAW1E,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,sBAAsB,CAAC;AAI1D,YAAY,EAAE,QAAQ,EAAE,eAAe,EAAE,eAAe,EAAE,MAAM,SAAS,CAAC;AAI1E;;;;GAIG;AACH,MAAM,WAAW,cAAc;IAC7B,QAAQ,EAAE,MAAM,CAAC;IACjB,IAAI,EAAE,MAAM,CAAC;IACb,MAAM,EAAE,MAAM,CAAC;IACf,GAAG,EAAE,MAAM,CAAC;CACb;AAED;;;;;;;;;;;;;;;GAeG;AACH,MAAM,WAAW,WAAY,SAAQ,eAAe;IAClD,WAAW,EAAE,MAAM,CAAC;IACpB,aAAa,EAAE,MAAM,CAAC;IACtB,UAAU,EAAE,MAAM,EAAE,CAAC;IACrB;;;;4EAIwE;IACxE,oBAAoB,CAAC,EAAE,MAAM,EAAE,CAAC;CACjC;AAED;;;;;GAKG;AACH,MAAM,WAAW,cAAc;IAC7B,aAAa,EAAE,MAAM,CAAC;IACtB,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,MAAM,CAAC;IACb,YAAY,EAAE,QAAQ,CAAC;IACvB,aAAa,EAAE,aAAa,CAAC;QAC3B,IAAI,EAAE,MAAM,CAAC;QACb,IAAI,EAAE,MAAM,CAAC;QACb,IAAI,EAAE,MAAM,CAAC;QACb,QAAQ,EAAE,QAAQ,CAAC;KACpB,CAAC,CAAC;CACJ;AAED;;;;;GAKG;AACH,MAAM,WAAW,mBAAmB;IAClC,OAAO,EAAE;QAAE,IAAI,EAAE,MAAM,GAAG,IAAI,CAAC;QAAC,GAAG,EAAE,OAAO,CAAA;KAAE,CAAC;IAC/C,YAAY,EAAE;QAAE,IAAI,EAAE,MAAM,GAAG,IAAI,CAAC;QAAC,GAAG,EAAE,OAAO,CAAA;KAAE,CAAC;IACpD;;;;uDAImD;IACnD,QAAQ,CAAC,EAAE;QAAE,KAAK,EAAE,MAAM,EAAE,CAAC;QAAC,GAAG,EAAE,OAAO,CAAA;KAAE,CAAC;IAC7C,SAAS,EAAE;QAAE,GAAG,EAAE,OAAO,CAAC;QAAC,YAAY,EAAE,MAAM,CAAA;KAAE,CAAC;IAClD,YAAY,EAAE;QAAE,GAAG,EAAE,OAAO,CAAA;KAAE,CAAC;IAC/B,QAAQ,EAAE;QAAE,IAAI,EAAE,MAAM,GAAG,IAAI,CAAC;QAAC,SAAS,EAAE,OAAO,CAAC;QAAC,iBAAiB,EAAE,MAAM,CAAA;KAAE,CAAC;CAClF;AAED;;;;GAIG;AACH,MAAM,WAAW,iBAAiB;IAChC;oEACgE;IAChE,cAAc,EAAE,cAAc,CAAC;IAE/B;;8DAE0D;IAC1D,aAAa,EAAE,cAAc,CAAC;IAE9B;;8BAE0B;IAC1B,iBAAiB,EAAE,cAAc,CAAC;IAElC;;;;gEAI4D;IAC5D,uBAAuB,EAAE,cAAc,CAAC;IAExC;;kCAE8B;IAC9B,0BAA0B,EAAE,cAAc,CAAC;IAE3C;;0CAEsC;IACtC,kBAAkB,EAAE;QAClB,MAAM,EAAE,aAAa,CAAC,WAAW,CAAC,CAAC;QACnC,IAAI,EAAE,aAAa,CAAC,WAAW,CAAC,CAAC;QACjC,MAAM,EAAE,aAAa,CAAC,WAAW,CAAC,CAAC;QACnC,UAAU,EAAE,aAAa,CAAC,cAAc,CAAC,CAAC;KAC3C,CAAC;IAEF;;;;;;OAMG;IACH,6BAA6B,EAAE,MAAM,CAAC;IAEtC;;;;;OAKG;IACH,0BAA0B,EAAE,MAAM,CAAC;IAEnC;yCACqC;IACrC,eAAe,EAAE,aAAa,CAAC,cAAc,CAAC,CAAC;IAE/C,qEAAqE;IACrE,UAAU,EAAE,mBAAmB,CAAC;CACjC;AAyCD;;;;;GAKG;AACH,MAAM,WAAW,sBAAsB;IACrC,OAAO,EAAE;QAAE,QAAQ,EAAE,eAAe,EAAE,CAAC;QAAC,QAAQ,EAAE,MAAM,GAAG,IAAI,CAAA;KAAE,CAAC;IAClE,YAAY,EAAE,eAAe,EAAE,CAAC;IAChC,YAAY,EAAE;QAAE,QAAQ,EAAE,eAAe,EAAE,CAAC;QAAC,QAAQ,EAAE,MAAM,GAAG,IAAI,CAAA;KAAE,CAAC;IACvE;;;;;;kCAM8B;IAC9B,QAAQ,CAAC,EAAE;QAAE,QAAQ,EAAE,eAAe,EAAE,CAAC;QAAC,SAAS,EAAE,MAAM,EAAE,CAAA;KAAE,CAAC;IAChE,SAAS,EAAE,eAAe,EAAE,CAAC;IAC7B;;;uBAGmB;IACnB,qBAAqB,EAAE,MAAM,CAAC;IAC9B,QAAQ,EAAE;QACR,QAAQ,EAAE,cAAc,EAAE,CAAC;QAC3B,IAAI,EAAE,MAAM,GAAG,IAAI,CAAC;QACpB,SAAS,EAAE,OAAO,CAAC;QACnB,iBAAiB,EAAE,MAAM,CAAC;KAC3B,CAAC;IACF;;;;;qDAKiD;IACjD,SAAS,CAAC,EAAE,aAAa,GAAG,IAAI,CAAC;CAClC;AAED;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,wBAAgB,sBAAsB,CAAC,KAAK,EAAE,sBAAsB,GAAG,iBAAiB,CA2ZvF"}

package/dist/analyzers/security/aggregator.js

@@ -10,46 +10,46 @@
  *
  * The disease this closes (D086 / D087 / D091):
  *
- *   - **D086** Health Security section and standalone vuln-scan Code
- *     Findings table both reported "code findings by severity" but
- *     came up with different numbers (`0C 11H 18M 0L` vs
- *     `0C 17H 14M 0L`) on the same repo. Two consumers, two
- *     aggregation paths, slightly-different inclusion rules.
+ * - **D086** Health Security section and standalone vuln-scan Code
+ * Findings table both reported "code findings by severity" but
+ * came up with different numbers (`0C 11H 18M 0L` vs
+ * `0C 17H 14M 0L`) on the same repo. Two consumers, two
+ * aggregation paths, slightly-different inclusion rules.
  *
- *   - **D087** Vuln-scan exec summary said "Subtotal: 70" (sum of
- *     dep-vuln severity buckets) and the same page later said
- *     "81 advisories" (findings.length). 70 vs 81 on one page.
+ * - **D087** Vuln-scan exec summary said "Subtotal: 70" (sum of
+ * dep-vuln severity buckets) and the same page later said
+ * "81 advisories" (findings.length). 70 vs 81 on one page.
  *
- *   - **D091** A single TLS-bypass root finding surfaced twice in the
- *     Code Findings table (registry-grep at `:74` HIGH, semgrep at
- *     `:72` MEDIUM) because code findings carried no fingerprint and
- *     no cross-tool dedup ran.
+ * - **D091** A single TLS-bypass root finding surfaced twice in the
+ * Code Findings table (registry-grep at `:74` HIGH, semgrep at
+ * `:72` MEDIUM) because code findings carried no fingerprint and
+ * no cross-tool dedup ran.
  *
  * Architectural posture:
  *
- *   - The aggregator sits BETWEEN gather and reports. Gather still
- *     produces raw envelopes (`gatherSecrets`, `gatherFileFindings`,
- *     `gatherCodePatterns`, `gatherTlsBypassFindings`, `gatherDepVulns`);
- *     the aggregator merges + dedups + buckets them into the canonical
- *     shape; consumers read by field name.
+ * - The aggregator sits BETWEEN gather and reports. Gather still
+ * produces raw envelopes (`gatherSecrets`, `gatherFileFindings`,
+ * `gatherCodePatterns`, `gatherTlsBypassFindings`, `gatherDepVulns`);
+ * the aggregator merges + dedups + buckets them into the canonical
+ * shape; consumers read by field name.
  *
- *   - Three separately-named severity buckets (`codeBySeverity`,
- *     `depBySeverity`, `secretsBySeverity`) — the shape forbids any
- *     consumer from accidentally summing cross-axis again.
+ * - Three separately-named severity buckets (`codeBySeverity`,
+ * `depBySeverity`, `secretsBySeverity`) — the shape forbids any
+ * consumer from accidentally summing cross-axis again.
  *
- *   - Two named dep counts (`dependencyAdvisoryUniqueCount` for the
- *     canonical user-facing total; `dependencyFindingsRawCount` for
- *     diagnostic audit). Renderers cannot pick "the wrong number"
- *     without naming which they want.
+ * - Two named dep counts (`dependencyAdvisoryUniqueCount` for the
+ * canonical user-facing total; `dependencyFindingsRawCount` for
+ * diagnostic audit). Renderers cannot pick "the wrong number"
+ * without naming which they want.
  *
- *   - Code findings get a canonical-rule + line-window fingerprint;
- *     cross-tool collisions collapse to ONE CodeFinding with
- *     `keptSeverity = max(severities)` and `producedBy` listing all
- *     contributing tools. The `dedupCollisions` audit trail records
- *     every collapse for `--detailed` visibility.
+ * - Code findings get a canonical-rule + line-window fingerprint;
+ * cross-tool collisions collapse to ONE CodeFinding with
+ * `keptSeverity = max(severities)` and `producedBy` listing all
+ * contributing tools. The `dedupCollisions` audit trail records
+ * every collapse for `--detailed` visibility.
  *
- *   - `provenance` distinguishes "tool ran, 0 findings" from "tool
- *     didn't run" — drives D080-style "(not run: typescript)" labels.
+ * - `provenance` distinguishes "tool ran, 0 findings" from "tool
+ * didn't run" — drives D080-style "(not run: typescript)" labels.
  *
  * G_v4_8 architectural gate (`scripts/check-architecture.sh`) blocks
  * `countBySeverity` / severity-Record accumulator declarations
@@ -58,6 +58,7 @@
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.buildSecurityAggregate = buildSecurityAggregate;
 const fingerprint_1 = require("../tools/fingerprint");
+const annotate_1 = require("../../allowlist/annotate");
 // ─── Canonical-rule registry ──────────────────────────────────────────────
 /**
  * Maps raw `(tool, rule)` pairs to a canonical rule id. Two raw
@@ -94,21 +95,21 @@ function bumpCounts(counts, severity) {
  * function — same input always produces the same output.
  *
  * Dedup pipeline (code-side):
- *   1. Concat raw findings from secrets/fileFindings/codePatterns/tlsBypass.
- *   2. Group by `(canonicalRule, file, lineWindow)` key.
- *   3. For each group:
- *      - Emit ONE `CodeFinding` with `keptSeverity = max(severities)`,
- *        `producedBy` = unique sources.
- *      - If the group had >1 raw finding, record a `DedupCollision`
- *        audit entry.
+ * 1. Concat raw findings from secrets/fileFindings/codePatterns/tlsBypass.
+ * 2. Group by `(canonicalRule, file, lineWindow)` key.
+ * 3. For each group:
+ * - Emit ONE `CodeFinding` with `keptSeverity = max(severities)`,
+ * `producedBy` = unique sources.
+ * - If the group had >1 raw finding, record a `DedupCollision`
+ * audit entry.
  *
  * Dedup pipeline (dep-side):
- *   - Group `depVulns.findings` by `fingerprint`.
- *   - For each group: pick the highest-severity entry as the
- *     representative; severity counts are derived from the unique
- *     set so they match `dependencyAdvisoryUniqueCount`.
- *   - Findings without a fingerprint pass through unchanged (defensive;
- *     `stampFingerprints` in `gatherDepVulns` runs before this).
+ * - Group `depVulns.findings` by `fingerprint`.
+ * - For each group: pick the highest-severity entry as the
+ * representative; severity counts are derived from the unique
+ * set so they match `dependencyAdvisoryUniqueCount`.
+ * - Findings without a fingerprint pass through unchanged (defensive;
+ * `stampFingerprints` in `gatherDepVulns` runs before this).
  */
 function buildSecurityAggregate(input) {
     // ─── Code-side dedup ────────────────────────────────────────────────
@@ -179,14 +180,8 @@ function buildSecurityAggregate(input) {
                 rule: f.rule,
                 line: f.line,
                 severity: f.severity,
+                spanHash: f.spanHash,
             });
-            // Record the merged finding's own fingerprint when it differs
-            // from the representative — that's the identity a suppression
-            // might have been keyed on in a run where the merge landed the
-            // other way around.
-            if (naturalFingerprint !== existing.fingerprint) {
-                existing.absorbedFingerprints.add(naturalFingerprint);
-            }
             // Prefer the lower line number as the canonical line — semgrep
             // typically reports the declaration (earlier line) while
             // registry-grep reports the assignment; the declaration is the
@@ -197,6 +192,9 @@ function buildSecurityAggregate(input) {
                 existing.rule = f.rule;
                 existing.tool = f.tool;
                 existing.cwe = f.cwe || existing.cwe;
+                // Keep the anchor material aligned with the chosen representative.
+                existing.spanHash = f.spanHash;
+                existing.scope = f.scope;
             }
         }
         else {
@@ -211,6 +209,8 @@ function buildSecurityAggregate(input) {
                 rule: f.rule,
                 title: f.title,
                 tool: f.tool,
+                spanHash: f.spanHash,
+                scope: f.scope,
                 producedBy: new Set([f.tool]),
                 raws: [
                     {
@@ -218,9 +218,9 @@ function buildSecurityAggregate(input) {
                         rule: f.rule,
                         line: f.line,
                         severity: f.severity,
+                        spanHash: f.spanHash,
                     },
                 ],
-                absorbedFingerprints: new Set(),
             });
         }
         // Index this finding's CWE + location → its group, so a later
@@ -228,6 +228,66 @@ function buildSecurityAggregate(input) {
         if (f.cwe)
             byCweLoc.set(cweLocKey(f.cwe, f.file, f.line), fingerprint);
     }
+    // ─── Ordinal assignment ────────────────────────────────────────
+    // Findings sharing one anchor bucket get a stable in-document-order
+    // ordinal so identical constructs stay distinct:
+    //   • code groups sharing (file, scope, spanHash) — three
+    //     `eval(userInput)` in one function stay three findings;
+    //   • secret groups sharing (file) — two leaked credentials in one file
+    //     stay two findings. Keyed on file ALONE (not the per-tool rule):
+    //     secret identity discriminates on the tool-independent
+    //     SECRET_CANONICAL_RULE, so the ordinal must be unique per file
+    //     across every secret regardless of which scanner/rule found it.
+    // Config (file-stable line 0) and anchorless findings need no ordinal.
+    // The bucket key is prefixed by category so the code and secret
+    // namespaces can never collide. Deterministic regardless of Map
+    // iteration order: sorted by line, then by the line-based group key.
+    const ordinalBuckets = new Map();
+    for (const g of groups.values()) {
+        let key;
+        if (g.category === 'code' && g.spanHash !== undefined) {
+            key = `code\0${g.file}\0${g.scope ?? ''}\0${g.spanHash}`;
+        }
+        else if (g.category === 'secret') {
+            key = `secret\0${g.file}`;
+        }
+        if (key !== undefined) {
+            const list = ordinalBuckets.get(key) ?? [];
+            list.push(g);
+            ordinalBuckets.set(key, list);
+        }
+    }
+    for (const list of ordinalBuckets.values()) {
+        list.sort((a, b) => a.line - b.line ||
+            (a.fingerprint < b.fingerprint ? -1 : a.fingerprint > b.fingerprint ? 1 : 0));
+        list.forEach((g, i) => {
+            g.ordinal = i;
+        });
+    }
+    // The durable content anchor for a group (scheme v2), or undefined when
+    // none is resolvable → line-window fallback. Secrets: (ordinal) alone —
+    // value/salt-free, so identity is tool- and environment-independent.
+    // Code: (scope, spanHash, ordinal) when a span was captured. Config +
+    // anchorless: undefined (config's line-0 identity is already
+    // (canonicalRule, file)-stable, so it stays on the line path unchanged).
+    const anchorFor = (g) => {
+        if (g.category === 'secret')
+            return (0, fingerprint_1.secretContentAnchor)(g.ordinal ?? 0);
+        if (g.category === 'code' && g.spanHash !== undefined) {
+            return (0, fingerprint_1.codeContentAnchorFromHash)(g.scope ?? '', g.spanHash, g.ordinal ?? 0);
+        }
+        return undefined;
+    };
+    const fingerprintFor = (canonicalRule, file, line, anchor) => anchor !== undefined
+        ? (0, fingerprint_1.computeContentFingerprint)(canonicalRule, file, anchor)
+        : (0, fingerprint_1.computeCodeFingerprint)(canonicalRule, file, line);
+    // The rule discriminator used for IDENTITY (not display/grouping).
+    // Secrets fold onto the tool-independent SECRET_CANONICAL_RULE so the same
+    // leak fingerprints identically no matter which scanner/rule found it;
+    // code/config keep their per-tool canonical rule. Mirrors the secret
+    // branch in `identityFor` so the aggregator's stamped fingerprint and the
+    // baseline producer's recomputed id always agree.
+    const identityRuleFor = (g) => g.category === 'secret' ? fingerprint_1.SECRET_CANONICAL_RULE : g.canonicalRule;
     const codeFindingsByCategory = {
         secret: [],
         code: [],
@@ -237,6 +297,28 @@ function buildSecurityAggregate(input) {
     const secretsBySeverity = emptyCounts();
     const dedupCollisions = [];
     for (const g of groups.values()) {
+        const anchor = anchorFor(g);
+        const identityRule = identityRuleFor(g);
+        const fingerprint = fingerprintFor(identityRule, g.file, g.line, anchor);
+        // Absorbed fingerprints: the content fingerprint each merged raw WOULD
+        // have had as representative (its own span/HMAC, the group's scope +
+        // ordinal). Lets a suppression keyed on a contributing finding's
+        // identity still match after the representative flips between runs.
+        // Secrets fold onto SECRET_CANONICAL_RULE and a per-file ordinal, so
+        // every secret raw in a group resolves to the SAME fingerprint — nothing
+        // to absorb (the cross-tool divergence this guarded against is gone).
+        const absorbed = new Set();
+        for (const raw of g.raws) {
+            const rawCanonical = g.category === 'secret' ? fingerprint_1.SECRET_CANONICAL_RULE : (0, fingerprint_1.canonicalRuleFor)(raw.tool, raw.rule);
+            let rawAnchor;
+            if (g.category === 'secret')
+                rawAnchor = (0, fingerprint_1.secretContentAnchor)(g.ordinal ?? 0);
+            else if (g.category === 'code' && raw.spanHash !== undefined)
+                rawAnchor = (0, fingerprint_1.codeContentAnchorFromHash)(g.scope ?? '', raw.spanHash, g.ordinal ?? 0);
+            const rawFp = fingerprintFor(rawCanonical, g.file, raw.line, rawAnchor);
+            if (rawFp !== fingerprint)
+                absorbed.add(rawFp);
+        }
         const finding = {
             severity: g.severity,
             category: g.category,
@@ -246,12 +328,15 @@ function buildSecurityAggregate(input) {
             file: g.file,
             line: g.line,
             tool: g.tool,
-            fingerprint: g.fingerprint,
+            fingerprint,
             canonicalRule: g.canonicalRule,
             producedBy: [...g.producedBy].sort(),
-            ...(g.absorbedFingerprints.size > 0
-                ? { absorbedFingerprints: [...g.absorbedFingerprints].sort() }
-                : {}),
+            // Content-anchored identity: stamp the FINAL content anchor (the producer reads it back to
+            // recompute the same identity). Omitted when absent (→ line fallback).
+            ...(anchor !== undefined ? { contentAnchor: anchor } : {}),
+            ...(g.spanHash !== undefined ? { spanHash: g.spanHash } : {}),
+            ...(g.scope !== undefined ? { scope: g.scope } : {}),
+            ...(absorbed.size > 0 ? { absorbedFingerprints: [...absorbed].sort() } : {}),
         };
         if (g.category === 'secret') {
             codeFindingsByCategory.secret.push(finding);
@@ -279,6 +364,31 @@ function buildSecurityAggregate(input) {
             });
         }
     }
+    // ─── Allowlist annotation + scoreable buckets ───────────────────────
+    // Mark every code/secret/config finding an active allowlist entry
+    // covers (renderers show "(N allowlisted)"), then derive the
+    // score-only buckets that EXCLUDE findings allowlisted under a
+    // category that lifts the score. This is what lets a repo that has
+    // reviewed-and-accepted its findings (false-positive / test-fixture)
+    // score honestly instead of staying capped on noise — while still
+    // counting accepted-risk / deferred, which accept a real exposure.
+    const allCodeSideFindings = [
+        ...codeFindingsByCategory.secret,
+        ...codeFindingsByCategory.code,
+        ...codeFindingsByCategory.config,
+    ];
+    (0, annotate_1.annotateFindingsWithAllowlist)(allCodeSideFindings, input.allowlist ?? null);
+    const scoreableCodeBySeverity = emptyCounts();
+    const scoreableSecretsBySeverity = emptyCounts();
+    const scoreLifted = (f) => !!f.allowlisted && (0, annotate_1.allowlistLiftsScore)(f.allowlistCategory);
+    for (const f of codeFindingsByCategory.code) {
+        if (!scoreLifted(f))
+            bumpCounts(scoreableCodeBySeverity, f.severity);
+    }
+    for (const f of [...codeFindingsByCategory.secret, ...codeFindingsByCategory.config]) {
+        if (!scoreLifted(f))
+            bumpCounts(scoreableSecretsBySeverity, f.severity);
+    }
     // ─── Dep-side dedup ─────────────────────────────────────────────────
     // Group by fingerprint. Findings without a fingerprint (defensive
     // path — shouldn't happen post-`stampFingerprints`) get a synthetic
@@ -338,6 +448,8 @@ function buildSecurityAggregate(input) {
         codeBySeverity,
         depBySeverity,
         secretsBySeverity,
+        scoreableCodeBySeverity,
+        scoreableSecretsBySeverity,
         findingsByCategory: {
             secret: codeFindingsByCategory.secret,
             code: codeFindingsByCategory.code,