@vyuhlabs/dxkit 2.9.4 → 2.11.0

package/dist/analyzers/security/scanner-drift.js

@@ -0,0 +1,113 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.detectScannerCoverageDrift = detectScannerCoverageDrift;
+/**
+ * Scanner-coverage drift detection across runs.
+ *
+ * Closes the "my score got worse after fixing things" confusion: when
+ * the active scanner set grows between two runs (e.g. `gitleaks` →
+ * `gitleaks, grep-secrets` + `snyk-code`), the newly-added scanners
+ * surface pre-existing findings that older runs simply couldn't see. The
+ * Security score can drop on an UNCHANGED commit, with nothing in the
+ * report explaining that those findings are newly *visible*, not newly
+ * *introduced*.
+ *
+ * This module compares the current run's scanner set against the most
+ * recent prior vulnerability-scan report persisted under
+ * `.dxkit/reports/`. When the current run added scanners, the report
+ * renders an honest note so a reader attributes any movement to improved
+ * measurement rather than regressed code.
+ *
+ * Read-only + fail-open: an fs or parse problem yields `null` (no note),
+ * never an error — drift disclosure is a nicety, not a gate.
+ */
+const fs = __importStar(require("fs"));
+const path = __importStar(require("path"));
+const PREFIX = 'vulnerability-scan-';
+const SUFFIX = '-detailed.json';
+const DATE_RE = /^\d{4}-\d{2}-\d{2}$/;
+/**
+ * Detect scanners added since the most recent prior vuln-scan report.
+ * Returns `null` when there is no prior report, none is readable, or the
+ * scanner set did not grow (a shrinking or identical set is not the
+ * confusing case this note addresses).
+ *
+ * `currentDate` is this run's report date (YYYY-MM-DD); prior reports on
+ * a strictly earlier date are eligible. Same-day files are skipped: a
+ * report dated today is either this run's own prior invocation (already
+ * the post-expansion set — comparing would hide the drift) or about to
+ * be overwritten, so an earlier day is the honest comparison point.
+ */
+function detectScannerCoverageDrift(repoPath, currentTools, currentDate) {
+    const reportDir = path.join(repoPath, '.dxkit', 'reports');
+    let files;
+    try {
+        files = fs.readdirSync(reportDir);
+    }
+    catch {
+        return null; // no reports dir → first run, nothing to compare
+    }
+    const prior = files
+        .filter((f) => f.startsWith(PREFIX) && f.endsWith(SUFFIX))
+        .map((f) => ({ file: f, date: f.slice(PREFIX.length, f.length - SUFFIX.length) }))
+        .filter((e) => DATE_RE.test(e.date) && e.date < currentDate)
+        .sort((a, b) => (a.date < b.date ? 1 : -1)); // most recent first
+    const currentSet = [...new Set(currentTools)];
+    for (const entry of prior) {
+        const prevTools = readToolsUsed(path.join(reportDir, entry.file));
+        if (!prevTools)
+            continue; // unreadable → try the next-most-recent
+        const prevSet = new Set(prevTools);
+        const added = currentSet.filter((t) => !prevSet.has(t)).sort();
+        // First readable prior report is the comparison point, added-or-not.
+        return added.length > 0 ? { added, previousDate: entry.date } : null;
+    }
+    return null;
+}
+/** Parse `toolsUsed` from a persisted detailed report. Fail-open → null. */
+function readToolsUsed(filePath) {
+    try {
+        const parsed = JSON.parse(fs.readFileSync(filePath, 'utf8'));
+        if (Array.isArray(parsed.toolsUsed)) {
+            return parsed.toolsUsed.filter((t) => typeof t === 'string');
+        }
+    }
+    catch {
+        // unreadable / malformed → skip
+    }
+    return null;
+}
+//# sourceMappingURL=scanner-drift.js.map

package/dist/analyzers/security/scanner-drift.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"scanner-drift.js","sourceRoot":"","sources":["../../../src/analyzers/security/scanner-drift.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AA+CA,gEA6BC;AA5ED;;;;;;;;;;;;;;;;;;;GAmBG;AACH,uCAAyB;AACzB,2CAA6B;AAU7B,MAAM,MAAM,GAAG,qBAAqB,CAAC;AACrC,MAAM,MAAM,GAAG,gBAAgB,CAAC;AAChC,MAAM,OAAO,GAAG,qBAAqB,CAAC;AAEtC;;;;;;;;;;;GAWG;AACH,SAAgB,0BAA0B,CACxC,QAAgB,EAChB,YAA+B,EAC/B,WAAmB;IAEnB,MAAM,SAAS,GAAG,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,QAAQ,EAAE,SAAS,CAAC,CAAC;IAC3D,IAAI,KAAe,CAAC;IACpB,IAAI,CAAC;QACH,KAAK,GAAG,EAAE,CAAC,WAAW,CAAC,SAAS,CAAC,CAAC;IACpC,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC,CAAC,iDAAiD;IAChE,CAAC;IAED,MAAM,KAAK,GAAG,KAAK;SAChB,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,UAAU,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;SACzD,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,EAAE,IAAI,EAAE,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,KAAK,CAAC,MAAM,CAAC,MAAM,EAAE,CAAC,CAAC,MAAM,GAAG,MAAM,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;SACjF,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,IAAI,GAAG,WAAW,CAAC;SAC3D,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,IAAI,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,oBAAoB;IAEnE,MAAM,UAAU,GAAG,CAAC,GAAG,IAAI,GAAG,CAAC,YAAY,CAAC,CAAC,CAAC;IAC9C,KAAK,MAAM,KAAK,IAAI,KAAK,EAAE,CAAC;QAC1B,MAAM,SAAS,GAAG,aAAa,CAAC,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC;QAClE,IAAI,CAAC,SAAS;YAAE,SAAS,CAAC,wCAAwC;QAClE,MAAM,OAAO,GAAG,IAAI,GAAG,CAAC,SAAS,CAAC,CAAC;QACnC,MAAM,KAAK,GAAG,UAAU,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;QAC/D,qEAAqE;QACrE,OAAO,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,YAAY,EAAE,KAAK,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC;IACvE,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED,4EAA4E;AAC5E,SAAS,aAAa,CAAC,QAAgB;IACrC,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,YAAY,CAAC,QAAQ,EAAE,MAAM,CAAC,CAA4B,CAAC;QACxF,IAAI,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,SAAS,CAAC,EAAE,CAAC;YACpC,OAAO,MAAM,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC,CAAC,EAAe,EAAE,CAAC,OAAO,CAAC,KAAK,QAAQ,CAAC,CAAC;QAC5E,CAAC;IACH,CAAC;IAAC,MAAM,CAAC;QACP,gCAAgC;IAClC,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC"}

package/dist/analyzers/security/shallow.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"shallow.d.ts","sourceRoot":"","sources":["../../../src/analyzers/security/shallow.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AACH,OAAO,EAEL,KAAK,kBAAkB,EAGxB,MAAM,eAAe,CAAC;AACvB,OAAO,EAAE,cAAc,EAAE,UAAU,EAAE,MAAM,UAAU,CAAC;AAEtD;;;;;;;;;;;;;;;;;;GAkBG;AACH,wBAAgB,oBAAoB,CAAC,KAAK,EAAE,UAAU,GAAG,kBAAkB,CA8D1E;AAED;;;;;;;GAOG;AACH,wBAAgB,2BAA2B,CAAC,KAAK,EAAE,UAAU,GAAG;IAAE,KAAK,EAAE,MAAM,CAAA;CAAE,CAEhF;AAED;;;;GAIG;AACH,wBAAgB,sBAAsB,CAAC,KAAK,EAAE,UAAU,GAAG,cAAc,CA2CxE"}
+{"version":3,"file":"shallow.d.ts","sourceRoot":"","sources":["../../../src/analyzers/security/shallow.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AACH,OAAO,EAEL,KAAK,kBAAkB,EAGxB,MAAM,eAAe,CAAC;AAEvB,OAAO,EAAE,cAAc,EAAE,UAAU,EAAE,MAAM,UAAU,CAAC;AAEtD;;;;;;;;;;;;;;;;;;GAkBG;AACH,wBAAgB,oBAAoB,CAAC,KAAK,EAAE,UAAU,GAAG,kBAAkB,CAqF1E;AAED;;;;;;;GAOG;AACH,wBAAgB,2BAA2B,CAAC,KAAK,EAAE,UAAU,GAAG;IAAE,KAAK,EAAE,MAAM,CAAA;CAAE,CAEhF;AAED;;;;GAIG;AACH,wBAAgB,sBAAsB,CAAC,KAAK,EAAE,UAAU,GAAG,cAAc,CA2CxE"}

package/dist/analyzers/security/shallow.js

@@ -19,6 +19,7 @@ exports.scoreSecurityDimension = scoreSecurityDimension;
  * same number from the same partitioned inputs.
  */
 const scoring_1 = require("../../scoring");
+const annotate_1 = require("../../allowlist/annotate");
 /**
  * Build the canonical `SecurityScoreInput` from the health-side
  * `ScoreInput`. Each field maps to its data source:
@@ -54,9 +55,13 @@ function toSecurityScoreInput(input) {
     // `m.tlsDisabledCount` and `m.evalCount` as separate signals; the
     // aggregate now carries the tls-bypass findings directly (with
     // file/line and post-dedup), so those manual adds are gone.
+    // The score reads the allowlist-adjusted `scoreableCodeBySeverity`
+    // (excludes findings reviewed-and-accepted as false-positive /
+    // test-fixture); reports keep reading the raw `codeBySeverity`. Same
+    // source either way — the aggregator computes both.
     let codeFindings;
     if (c.securityAggregate) {
-        codeFindings = { ...c.securityAggregate.codeBySeverity };
+        codeFindings = { ...c.securityAggregate.scoreableCodeBySeverity };
     }
     else {
         // Legacy fallback (test fixtures, pre-2.4.7 callers without
@@ -86,7 +91,17 @@ function toSecurityScoreInput(input) {
             low: c.depVulns?.counts.low ?? 0,
         };
     return {
-        secretFindings: c.secrets?.findings.length ?? 0,
+        // Secret count for scoring EXCLUDES findings reviewed-and-accepted
+        // as false-positive / test-fixture, so a repo that has triaged its
+        // flagged secrets isn't held at the committed-credentials cap on
+        // noise it has already accepted. Read
+        // from the annotated aggregate when present (its secret category
+        // carries the allowlist status); fall back to the raw capability
+        // count for legacy ScoreInputs with no aggregate. accepted-risk /
+        // deferred are NOT lifted — those accept a real exposure.
+        secretFindings: c.securityAggregate
+            ? c.securityAggregate.findingsByCategory.secret.filter((f) => !(f.allowlisted && (0, annotate_1.allowlistLiftsScore)(f.allowlistCategory))).length
+            : (c.secrets?.findings.length ?? 0),
         privateKeyFiles: m.privateKeyFiles,
         envFilesInGit: m.envFilesInGit,
         codeFindings,
@@ -98,6 +113,13 @@ function toSecurityScoreInput(input) {
         // is a downgrade; an explicit `false` from the gather is the only
         // signal we trust to apply it.
         depVulnsAvailable: c.depVulnsAvailability?.available ?? true,
+        // Same default-true contract as depVulnsAvailable — the
+        // explicit `false` from the gather is the only signal we trust to
+        // apply an uncertainty cap. Closes the asymmetry where a missing
+        // dep scan capped the score but missing secret/code scanners
+        // silently scored as clean.
+        secretsAvailable: c.secretsAvailability?.available ?? true,
+        codePatternsAvailable: c.codePatternsAvailability?.available ?? true,
     };
 }
 /**

package/dist/analyzers/security/shallow.js.map

@@ -1 +1 @@
-{"version":3,"file":"shallow.js","sourceRoot":"","sources":["../../../src/analyzers/security/shallow.ts"],"names":[],"mappings":";;AA0CA,oDA8DC;AAUD,kEAEC;AAOD,wDA2CC;AAtKD;;;;;;;;;;;;;;GAcG;AACH,2CAKuB;AAGvB;;;;;;;;;;;;;;;;;;GAkBG;AACH,SAAgB,oBAAoB,CAAC,KAAiB;IACpD,MAAM,CAAC,GAAG,KAAK,CAAC,OAAO,CAAC;IACxB,MAAM,CAAC,GAAG,KAAK,CAAC,YAAY,CAAC;IAE7B,sEAAsE;IACtE,+DAA+D;IAC/D,mEAAmE;IACnE,gCAAgC;IAChC,EAAE;IACF,sEAAsE;IACtE,oEAAoE;IACpE,mEAAmE;IACnE,iEAAiE;IACjE,iEAAiE;IACjE,kEAAkE;IAClE,+DAA+D;IAC/D,4DAA4D;IAC5D,IAAI,YAA6E,CAAC;IAClF,IAAI,CAAC,CAAC,iBAAiB,EAAE,CAAC;QACxB,YAAY,GAAG,EAAE,GAAG,CAAC,CAAC,iBAAiB,CAAC,cAAc,EAAE,CAAC;IAC3D,CAAC;SAAM,CAAC;QACN,4DAA4D;QAC5D,kEAAkE;QAClE,yDAAyD;QACzD,2DAA2D;QAC3D,iDAAiD;QACjD,YAAY,GAAG,EAAE,QAAQ,EAAE,CAAC,EAAE,IAAI,EAAE,CAAC,EAAE,MAAM,EAAE,CAAC,EAAE,GAAG,EAAE,CAAC,EAAE,CAAC;QAC3D,IAAI,CAAC,CAAC,YAAY,EAAE,CAAC;YACnB,KAAK,MAAM,CAAC,IAAI,CAAC,CAAC,YAAY,CAAC,QAAQ,EAAE,CAAC;gBACxC,YAAY,CAAC,CAAC,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,0FAA0F;YACxH,CAAC;QACH,CAAC;aAAM,CAAC;YACN,YAAY,CAAC,IAAI,IAAI,CAAC,CAAC,SAAS,CAAC;QACnC,CAAC;QACD,YAAY,CAAC,IAAI,IAAI,CAAC,CAAC,gBAAgB,CAAC;IAC1C,CAAC;IAED,kEAAkE;IAClE,+DAA+D;IAC/D,MAAM,SAAS,GAAG,CAAC,CAAC,iBAAiB;QACnC,CAAC,CAAC,CAAC,CAAC,iBAAiB,CAAC,aAAa;QACnC,CAAC,CAAC;YACE,QAAQ,EAAE,CAAC,CAAC,QAAQ,EAAE,MAAM,CAAC,QAAQ,IAAI,CAAC;YAC1C,IAAI,EAAE,CAAC,CAAC,QAAQ,EAAE,MAAM,CAAC,IAAI,IAAI,CAAC;YAClC,MAAM,EAAE,CAAC,CAAC,QAAQ,EAAE,MAAM,CAAC,MAAM,IAAI,CAAC;YACtC,GAAG,EAAE,CAAC,CAAC,QAAQ,EAAE,MAAM,CAAC,GAAG,IAAI,CAAC;SACjC,CAAC;IAEN,OAAO;QACL,cAAc,EAAE,CAAC,CAAC,OAAO,EAAE,QAAQ,CAAC,MAAM,IAAI,CAAC;QAC/C,eAAe,EAAE,CAAC,CAAC,eAAe;QAClC,aAAa,EAAE,CAAC,CAAC,aAAa;QAC9B,YAAY;QACZ,QAAQ,EAAE,SAAS;QACnB,kEAAkE;QAClE,kEAAkE;QAClE,mEAAmE;QACnE,mEAAmE;QACnE,kEAAkE;QAClE,+BAA+B;QAC/B,iBAAiB,EAAE,CAAC,CAAC,oBAAoB,EAAE,SAAS,IAAI,IAAI;KAC7D,CAAC;AACJ,CAAC;AAED;;;;;;;GAOG;AACH,SAAgB,2BAA2B,CAAC,KAAiB;IAC3D,OAAO,IAAA,sBAAY,EAAC,+BAAqB,EAAE,oBAAoB,CAAC,KAAK,CAAC,CAAC,CAAC;AAC1E,CAAC;AAED;;;;GAIG;AACH,SAAgB,sBAAsB,CAAC,KAAiB;IACtD,MAAM,CAAC,GAAG,KAAK,CAAC,OAAO,CAAC;IACxB,MAAM,CAAC,GAAG,KAAK,CAAC,YAAY,CAAC;IAC7B,MAAM,UAAU,GAAG,oBAAoB,CAAC,KAAK,CAAC,CAAC;IAC/C,MAAM,MAAM,GAAG,IAAA,sBAAY,EAAC,+BAAqB,EAAE,UAAU,CAAC,CAAC;IAE/D,MAAM,cAAc,GAAG,UAAU,CAAC,cAAc,CAAC;IACjD,MAAM,EAAE,GAAG,UAAU,CAAC,YAAY,CAAC;IACnC,MAAM,YAAY,GAAG,CAAC,CAAC,QAAQ,EAAE,IAAI,IAAI,IAAI,CAAC;IAC9C,MAAM,EAAE,GAAG,UAAU,CAAC,QAAQ,CAAC;IAE/B,OAAO;QACL,KAAK,EAAE,MAAM,CAAC,KAAK;QACnB,QAAQ,EAAE,GAAG;QACb,MAAM,EAAE,IAAA,yBAAe,EAAC,MAAM,CAAC,KAAK,CAAC;QACrC,QAAQ,EAAE,MAAM,CAAC,QAAQ;QACzB,UAAU,EAAE,MAAM,CAAC,UAAU;QAC7B,WAAW,EAAE,MAAM,CAAC,WAAW;QAC/B,UAAU,EAAE,MAAM,CAAC,UAAU;QAC7B,WAAW,EAAE,MAAM,CAAC,WAAW;QAC/B,UAAU,EAAE,MAAM,CAAC,UAAU;QAC7B,iEAAiE;QACjE,4DAA4D;QAC5D,2DAA2D;QAC3D,6DAA6D;QAC7D,4DAA4D;QAC5D,4DAA4D;QAC5D,2DAA2D;QAC3D,6DAA6D;QAC7D,iBAAiB;QACjB,OAAO,EAAE;YACP,eAAe,EAAE,CAAC,CAAC,eAAe;YAClC,aAAa,EAAE,CAAC,CAAC,aAAa;SAC/B;QACD,OAAO,EACL,GAAG,cAAc,kCAAkC;YACnD,KAAK,UAAU,CAAC,eAAe,4BAA4B;YAC3D,KAAK,EAAE,CAAC,QAAQ,KAAK,EAAE,CAAC,IAAI,KAAK,EAAE,CAAC,MAAM,KAAK,EAAE,CAAC,GAAG,iBAAiB;YACtE,KAAK,UAAU,CAAC,aAAa,4BAA4B;YACzD,uBAAuB,EAAE,CAAC,QAAQ,cAAc,EAAE,CAAC,IAAI,UAAU,EAAE,CAAC,MAAM,YAAY,EAAE,CAAC,GAAG,MAAM;YAClG,CAAC,YAAY,CAAC,CAAC,CAAC,KAAK,YAAY,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC;YAC1C,GAAG;KACN,CAAC;AACJ,CAAC"}
+{"version":3,"file":"shallow.js","sourceRoot":"","sources":["../../../src/analyzers/security/shallow.ts"],"names":[],"mappings":";;AA2CA,oDAqFC;AAUD,kEAEC;AAOD,wDA2CC;AA9LD;;;;;;;;;;;;;;GAcG;AACH,2CAKuB;AACvB,uDAA+D;AAG/D;;;;;;;;;;;;;;;;;;GAkBG;AACH,SAAgB,oBAAoB,CAAC,KAAiB;IACpD,MAAM,CAAC,GAAG,KAAK,CAAC,OAAO,CAAC;IACxB,MAAM,CAAC,GAAG,KAAK,CAAC,YAAY,CAAC;IAE7B,sEAAsE;IACtE,+DAA+D;IAC/D,mEAAmE;IACnE,gCAAgC;IAChC,EAAE;IACF,sEAAsE;IACtE,oEAAoE;IACpE,mEAAmE;IACnE,iEAAiE;IACjE,iEAAiE;IACjE,kEAAkE;IAClE,+DAA+D;IAC/D,4DAA4D;IAC5D,mEAAmE;IACnE,+DAA+D;IAC/D,qEAAqE;IACrE,oDAAoD;IACpD,IAAI,YAA6E,CAAC;IAClF,IAAI,CAAC,CAAC,iBAAiB,EAAE,CAAC;QACxB,YAAY,GAAG,EAAE,GAAG,CAAC,CAAC,iBAAiB,CAAC,uBAAuB,EAAE,CAAC;IACpE,CAAC;SAAM,CAAC;QACN,4DAA4D;QAC5D,kEAAkE;QAClE,yDAAyD;QACzD,2DAA2D;QAC3D,iDAAiD;QACjD,YAAY,GAAG,EAAE,QAAQ,EAAE,CAAC,EAAE,IAAI,EAAE,CAAC,EAAE,MAAM,EAAE,CAAC,EAAE,GAAG,EAAE,CAAC,EAAE,CAAC;QAC3D,IAAI,CAAC,CAAC,YAAY,EAAE,CAAC;YACnB,KAAK,MAAM,CAAC,IAAI,CAAC,CAAC,YAAY,CAAC,QAAQ,EAAE,CAAC;gBACxC,YAAY,CAAC,CAAC,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,0FAA0F;YACxH,CAAC;QACH,CAAC;aAAM,CAAC;YACN,YAAY,CAAC,IAAI,IAAI,CAAC,CAAC,SAAS,CAAC;QACnC,CAAC;QACD,YAAY,CAAC,IAAI,IAAI,CAAC,CAAC,gBAAgB,CAAC;IAC1C,CAAC;IAED,kEAAkE;IAClE,+DAA+D;IAC/D,MAAM,SAAS,GAAG,CAAC,CAAC,iBAAiB;QACnC,CAAC,CAAC,CAAC,CAAC,iBAAiB,CAAC,aAAa;QACnC,CAAC,CAAC;YACE,QAAQ,EAAE,CAAC,CAAC,QAAQ,EAAE,MAAM,CAAC,QAAQ,IAAI,CAAC;YAC1C,IAAI,EAAE,CAAC,CAAC,QAAQ,EAAE,MAAM,CAAC,IAAI,IAAI,CAAC;YAClC,MAAM,EAAE,CAAC,CAAC,QAAQ,EAAE,MAAM,CAAC,MAAM,IAAI,CAAC;YACtC,GAAG,EAAE,CAAC,CAAC,QAAQ,EAAE,MAAM,CAAC,GAAG,IAAI,CAAC;SACjC,CAAC;IAEN,OAAO;QACL,mEAAmE;QACnE,mEAAmE;QACnE,iEAAiE;QACjE,sCAAsC;QACtC,iEAAiE;QACjE,iEAAiE;QACjE,kEAAkE;QAClE,0DAA0D;QAC1D,cAAc,EAAE,CAAC,CAAC,iBAAiB;YACjC,CAAC,CAAC,CAAC,CAAC,iBAAiB,CAAC,kBAAkB,CAAC,MAAM,CAAC,MAAM,CAClD,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,WAAW,IAAI,IAAA,8BAAmB,EAAC,CAAC,CAAC,iBAAiB,CAAC,CAAC,CACpE,CAAC,MAAM;YACV,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,EAAE,QAAQ,CAAC,MAAM,IAAI,CAAC,CAAC;QACrC,eAAe,EAAE,CAAC,CAAC,eAAe;QAClC,aAAa,EAAE,CAAC,CAAC,aAAa;QAC9B,YAAY;QACZ,QAAQ,EAAE,SAAS;QACnB,kEAAkE;QAClE,kEAAkE;QAClE,mEAAmE;QACnE,mEAAmE;QACnE,kEAAkE;QAClE,+BAA+B;QAC/B,iBAAiB,EAAE,CAAC,CAAC,oBAAoB,EAAE,SAAS,IAAI,IAAI;QAC5D,wDAAwD;QACxD,kEAAkE;QAClE,iEAAiE;QACjE,6DAA6D;QAC7D,4BAA4B;QAC5B,gBAAgB,EAAE,CAAC,CAAC,mBAAmB,EAAE,SAAS,IAAI,IAAI;QAC1D,qBAAqB,EAAE,CAAC,CAAC,wBAAwB,EAAE,SAAS,IAAI,IAAI;KACrE,CAAC;AACJ,CAAC;AAED;;;;;;;GAOG;AACH,SAAgB,2BAA2B,CAAC,KAAiB;IAC3D,OAAO,IAAA,sBAAY,EAAC,+BAAqB,EAAE,oBAAoB,CAAC,KAAK,CAAC,CAAC,CAAC;AAC1E,CAAC;AAED;;;;GAIG;AACH,SAAgB,sBAAsB,CAAC,KAAiB;IACtD,MAAM,CAAC,GAAG,KAAK,CAAC,OAAO,CAAC;IACxB,MAAM,CAAC,GAAG,KAAK,CAAC,YAAY,CAAC;IAC7B,MAAM,UAAU,GAAG,oBAAoB,CAAC,KAAK,CAAC,CAAC;IAC/C,MAAM,MAAM,GAAG,IAAA,sBAAY,EAAC,+BAAqB,EAAE,UAAU,CAAC,CAAC;IAE/D,MAAM,cAAc,GAAG,UAAU,CAAC,cAAc,CAAC;IACjD,MAAM,EAAE,GAAG,UAAU,CAAC,YAAY,CAAC;IACnC,MAAM,YAAY,GAAG,CAAC,CAAC,QAAQ,EAAE,IAAI,IAAI,IAAI,CAAC;IAC9C,MAAM,EAAE,GAAG,UAAU,CAAC,QAAQ,CAAC;IAE/B,OAAO;QACL,KAAK,EAAE,MAAM,CAAC,KAAK;QACnB,QAAQ,EAAE,GAAG;QACb,MAAM,EAAE,IAAA,yBAAe,EAAC,MAAM,CAAC,KAAK,CAAC;QACrC,QAAQ,EAAE,MAAM,CAAC,QAAQ;QACzB,UAAU,EAAE,MAAM,CAAC,UAAU;QAC7B,WAAW,EAAE,MAAM,CAAC,WAAW;QAC/B,UAAU,EAAE,MAAM,CAAC,UAAU;QAC7B,WAAW,EAAE,MAAM,CAAC,WAAW;QAC/B,UAAU,EAAE,MAAM,CAAC,UAAU;QAC7B,iEAAiE;QACjE,4DAA4D;QAC5D,2DAA2D;QAC3D,6DAA6D;QAC7D,4DAA4D;QAC5D,4DAA4D;QAC5D,2DAA2D;QAC3D,6DAA6D;QAC7D,iBAAiB;QACjB,OAAO,EAAE;YACP,eAAe,EAAE,CAAC,CAAC,eAAe;YAClC,aAAa,EAAE,CAAC,CAAC,aAAa;SAC/B;QACD,OAAO,EACL,GAAG,cAAc,kCAAkC;YACnD,KAAK,UAAU,CAAC,eAAe,4BAA4B;YAC3D,KAAK,EAAE,CAAC,QAAQ,KAAK,EAAE,CAAC,IAAI,KAAK,EAAE,CAAC,MAAM,KAAK,EAAE,CAAC,GAAG,iBAAiB;YACtE,KAAK,UAAU,CAAC,aAAa,4BAA4B;YACzD,uBAAuB,EAAE,CAAC,QAAQ,cAAc,EAAE,CAAC,IAAI,UAAU,EAAE,CAAC,MAAM,YAAY,EAAE,CAAC,GAAG,MAAM;YAClG,CAAC,YAAY,CAAC,CAAC,CAAC,KAAK,YAAY,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC;YAC1C,GAAG;KACN,CAAC;AACJ,CAAC"}

package/dist/analyzers/security/types.d.ts

@@ -2,6 +2,8 @@
  * Security analyzer types.
  */
 import type { DepVulnFinding } from '../../languages/capabilities/types';
+import type { AllowlistCategory } from '../../allowlist/categories';
+import type { ScannerCoverageDrift } from './scanner-drift';
 export type Severity = 'critical' | 'high' | 'medium' | 'low';
 export type FindingCategory = 'secret' | 'code' | 'config' | 'dependency';
 export interface SecurityFinding {
@@ -13,6 +15,45 @@ export interface SecurityFinding {
     file: string;
     line: number;
     tool: string;
+    /**
+     * True when an ACTIVE (unexpired) allowlist entry matches this
+     * finding's fingerprint. The finding is still reported in full (raw
+     * counts are unchanged — dxkit's raw-truth model holds), but renderers
+     * surface "(N allowlisted)" alongside the subtotal so a reviewer isn't
+     * alarmed by, e.g., 8 CRITICAL secrets when 7 are accepted test
+     * fixtures. Absent (undefined) when no allowlist exists or no entry
+     * matches. Only code/secret/config findings (which carry a
+     * fingerprint) are annotated; dependency findings are keyed by tuple
+     * through a producer and are out of scope here.
+     */
+    allowlisted?: boolean;
+    /** The matched allowlist entry's category (`test-fixture`,
+     * `false-positive`, `accepted-risk`, ...) so renderers can explain
+     * WHY the finding is suppressed, not just that it is. Present only
+     * when `allowlisted` is true. */
+    allowlistCategory?: AllowlistCategory;
+    /**
+     * Content-anchored identity material. Carried from the gather
+     * boundary through the aggregator so the finding's durable identity
+     * can be anchored to WHAT it is, not WHERE it sits (the line). These
+     * are additive plumbing: until the content-anchored migration the
+     * identity layer still hashes the line; afterward it hashes the
+     * content anchor and `line` becomes display metadata only.
+     *
+     * - `contentAnchor` — the fully-resolved anchor when known at gather:
+     * for secrets it's the salted HMAC of the value; for config it's
+     * `''`. For CODE findings it's NOT set at gather (it needs `scope`
+     * + ordinal); the aggregator stamps it.
+     * - `spanHash` — the 16-char hash of a code finding's normalized
+     * matched span (semgrep gather). Combined with `scope` + ordinal by
+     * the aggregator to build the code `contentAnchor`.
+     * - `scope` — the enclosing symbol (function/class) for a code
+     * finding, attached by the graph scope pre-pass; `''`/absent →
+     * file-level fallback.
+     */
+    contentAnchor?: string;
+    spanHash?: string;
+    scope?: string;
 }
 export interface DepVulnSummary {
     critical: number;
@@ -22,8 +63,8 @@ export interface DepVulnSummary {
     total: number;
     tool: string | null;
     /** Per-advisory detail concatenated across every active pack. Empty
-     *  when no provider returned findings (counts may still be non-zero
-     *  for legacy pack output that only emits aggregate counts). */
+     * when no provider returned findings (counts may still be non-zero
+     * for legacy pack output that only emits aggregate counts). */
     findings: DepVulnFinding[];
     /**
      * D025b (2.4.7): true if at least one active pack's depVulns gather
@@ -53,8 +94,8 @@ export interface SecurityReport {
     branch: string;
     summary: {
         /** Combined code+secret+config severity counts. Preserved for
-         *  backward-compat with detailed report + dashboard consumers
-         *  that already read this shape. */
+         * backward-compat with detailed report + dashboard consumers
+         * that already read this shape. */
         findings: {
             critical: number;
             high: number;
@@ -91,9 +132,28 @@ export interface SecurityReport {
             total: number;
         };
         dependencies: DepVulnSummary;
+        /**
+         * Whether the secret / code-pattern scans actually ran,
+         * from `aggregate.provenance.{secrets,codePatterns}.ran`. The
+         * standalone-side score adapter (`countsFromReport`) plumbs these
+         * into the uncertainty caps, mirroring `dependencies.available` —
+         * a "0 secrets" subtotal printed next to "Sources: (none)" must
+         * not score as a confident clean. Optional: report JSONs saved
+         * before 2.10 lack them (adapter defaults to true).
+         */
+        secretsAvailable?: boolean;
+        codePatternsAvailable?: boolean;
     };
     findings: SecurityFinding[];
     toolsUsed: string[];
     toolsUnavailable: string[];
+    /**
+     * Scanners added since the most recent prior vuln-scan report,
+     * when any. Present only when the active scanner set grew run-over-run
+     * — drives the "coverage expanded; findings newly visible, not newly
+     * introduced" note that explains an otherwise-baffling score change on
+     * an unchanged commit. Absent on a first run or a stable scanner set.
+     */
+    scannerDrift?: ScannerCoverageDrift;
 }
 //# sourceMappingURL=types.d.ts.map

package/dist/analyzers/security/types.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../../src/analyzers/security/types.ts"],"names":[],"mappings":"AAAA;;GAEG;AACH,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,oCAAoC,CAAC;AAEzE,MAAM,MAAM,QAAQ,GAAG,UAAU,GAAG,MAAM,GAAG,QAAQ,GAAG,KAAK,CAAC;AAE9D,MAAM,MAAM,eAAe,GAAG,QAAQ,GAAG,MAAM,GAAG,QAAQ,GAAG,YAAY,CAAC;AAE1E,MAAM,WAAW,eAAe;IAC9B,QAAQ,EAAE,QAAQ,CAAC;IACnB,QAAQ,EAAE,eAAe,CAAC;IAC1B,GAAG,EAAE,MAAM,CAAC;IACZ,IAAI,EAAE,MAAM,CAAC;IACb,KAAK,EAAE,MAAM,CAAC;IACd,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,MAAM,CAAC;CACd;AAED,MAAM,WAAW,cAAc;IAC7B,QAAQ,EAAE,MAAM,CAAC;IACjB,IAAI,EAAE,MAAM,CAAC;IACb,MAAM,EAAE,MAAM,CAAC;IACf,GAAG,EAAE,MAAM,CAAC;IACZ,KAAK,EAAE,MAAM,CAAC;IACd,IAAI,EAAE,MAAM,GAAG,IAAI,CAAC;IACpB;;oEAEgE;IAChE,QAAQ,EAAE,cAAc,EAAE,CAAC;IAC3B;;;;;;;;;;;OAWG;IACH,SAAS,EAAE,OAAO,CAAC;IACnB;;;;;OAKG;IACH,iBAAiB,EAAE,MAAM,CAAC;CAC3B;AAED,MAAM,WAAW,cAAc;IAC7B,IAAI,EAAE,MAAM,CAAC;IACb,UAAU,EAAE,MAAM,CAAC;IACnB,SAAS,EAAE,MAAM,CAAC;IAClB,MAAM,EAAE,MAAM,CAAC;IACf,OAAO,EAAE;QACP;;4CAEoC;QACpC,QAAQ,EAAE;YAAE,QAAQ,EAAE,MAAM,CAAC;YAAC,IAAI,EAAE,MAAM,CAAC;YAAC,MAAM,EAAE,MAAM,CAAC;YAAC,GAAG,EAAE,MAAM,CAAC;YAAC,KAAK,EAAE,MAAM,CAAA;SAAE,CAAC;QACzF;;;;;;;WAOG;QACH,QAAQ,EAAE;YAAE,QAAQ,EAAE,MAAM,CAAC;YAAC,IAAI,EAAE,MAAM,CAAC;YAAC,MAAM,EAAE,MAAM,CAAC;YAAC,GAAG,EAAE,MAAM,CAAC;YAAC,KAAK,EAAE,MAAM,CAAA;SAAE,CAAC;QACzF;;;;;WAKG;QACH,WAAW,EAAE;YAAE,QAAQ,EAAE,MAAM,CAAC;YAAC,IAAI,EAAE,MAAM,CAAC;YAAC,MAAM,EAAE,MAAM,CAAC;YAAC,GAAG,EAAE,MAAM,CAAC;YAAC,KAAK,EAAE,MAAM,CAAA;SAAE,CAAC;QAC5F,YAAY,EAAE,cAAc,CAAC;KAC9B,CAAC;IACF,QAAQ,EAAE,eAAe,EAAE,CAAC;IAC5B,SAAS,EAAE,MAAM,EAAE,CAAC;IACpB,gBAAgB,EAAE,MAAM,EAAE,CAAC;CAC5B"}
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../../src/analyzers/security/types.ts"],"names":[],"mappings":"AAAA;;GAEG;AACH,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,oCAAoC,CAAC;AACzE,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,4BAA4B,CAAC;AACpE,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,iBAAiB,CAAC;AAE5D,MAAM,MAAM,QAAQ,GAAG,UAAU,GAAG,MAAM,GAAG,QAAQ,GAAG,KAAK,CAAC;AAE9D,MAAM,MAAM,eAAe,GAAG,QAAQ,GAAG,MAAM,GAAG,QAAQ,GAAG,YAAY,CAAC;AAE1E,MAAM,WAAW,eAAe;IAC9B,QAAQ,EAAE,QAAQ,CAAC;IACnB,QAAQ,EAAE,eAAe,CAAC;IAC1B,GAAG,EAAE,MAAM,CAAC;IACZ,IAAI,EAAE,MAAM,CAAC;IACb,KAAK,EAAE,MAAM,CAAC;IACd,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,MAAM,CAAC;IACb;;;;;;;;;;OAUG;IACH,WAAW,CAAC,EAAE,OAAO,CAAC;IACtB;;;qCAGiC;IACjC,iBAAiB,CAAC,EAAE,iBAAiB,CAAC;IACtC;;;;;;;;;;;;;;;;;;OAkBG;IACH,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB;AAED,MAAM,WAAW,cAAc;IAC7B,QAAQ,EAAE,MAAM,CAAC;IACjB,IAAI,EAAE,MAAM,CAAC;IACb,MAAM,EAAE,MAAM,CAAC;IACf,GAAG,EAAE,MAAM,CAAC;IACZ,KAAK,EAAE,MAAM,CAAC;IACd,IAAI,EAAE,MAAM,GAAG,IAAI,CAAC;IACpB;;mEAE+D;IAC/D,QAAQ,EAAE,cAAc,EAAE,CAAC;IAC3B;;;;;;;;;;;OAWG;IACH,SAAS,EAAE,OAAO,CAAC;IACnB;;;;;OAKG;IACH,iBAAiB,EAAE,MAAM,CAAC;CAC3B;AAED,MAAM,WAAW,cAAc;IAC7B,IAAI,EAAE,MAAM,CAAC;IACb,UAAU,EAAE,MAAM,CAAC;IACnB,SAAS,EAAE,MAAM,CAAC;IAClB,MAAM,EAAE,MAAM,CAAC;IACf,OAAO,EAAE;QACP;;2CAEmC;QACnC,QAAQ,EAAE;YAAE,QAAQ,EAAE,MAAM,CAAC;YAAC,IAAI,EAAE,MAAM,CAAC;YAAC,MAAM,EAAE,MAAM,CAAC;YAAC,GAAG,EAAE,MAAM,CAAC;YAAC,KAAK,EAAE,MAAM,CAAA;SAAE,CAAC;QACzF;;;;;;;WAOG;QACH,QAAQ,EAAE;YAAE,QAAQ,EAAE,MAAM,CAAC;YAAC,IAAI,EAAE,MAAM,CAAC;YAAC,MAAM,EAAE,MAAM,CAAC;YAAC,GAAG,EAAE,MAAM,CAAC;YAAC,KAAK,EAAE,MAAM,CAAA;SAAE,CAAC;QACzF;;;;;WAKG;QACH,WAAW,EAAE;YAAE,QAAQ,EAAE,MAAM,CAAC;YAAC,IAAI,EAAE,MAAM,CAAC;YAAC,MAAM,EAAE,MAAM,CAAC;YAAC,GAAG,EAAE,MAAM,CAAC;YAAC,KAAK,EAAE,MAAM,CAAA;SAAE,CAAC;QAC5F,YAAY,EAAE,cAAc,CAAC;QAC7B;;;;;;;;WAQG;QACH,gBAAgB,CAAC,EAAE,OAAO,CAAC;QAC3B,qBAAqB,CAAC,EAAE,OAAO,CAAC;KACjC,CAAC;IACF,QAAQ,EAAE,eAAe,EAAE,CAAC;IAC5B,SAAS,EAAE,MAAM,EAAE,CAAC;IACpB,gBAAgB,EAAE,MAAM,EAAE,CAAC;IAC3B;;;;;;OAMG;IACH,YAAY,CAAC,EAAE,oBAAoB,CAAC;CACrC"}

package/dist/analyzers/tools/fingerprint.d.ts

@@ -6,19 +6,27 @@
  *
  * Two fingerprint families live here:
  *
- *   1. Dependency-advisory fingerprints — stable hash of
- *      `(package, installedVersion, id)`. Used by `gatherDepVulns` +
- *      BoM. Excludes severity / cvssScore / enrichment fields
- *      (epssScore, kev, reachable, riskScore), producer `tool`, and
- *      `upgradeAdvice` / `upgradePlan` so re-scoring the same advisory
- *      against the same install never mints a new identity.
+ * 1. Dependency-advisory fingerprints — stable hash of
+ * `(package, canonicalAdvisoryId)`. Used by `gatherDepVulns` +
+ * BoM. Excludes severity / cvssScore / enrichment fields
+ * (epssScore, kev, reachable, riskScore), producer `tool`, and
+ * `upgradeAdvice` / `upgradePlan` so re-scoring the same advisory
+ * against the same install never mints a new identity. Crucially
+ * it also excludes `installedVersion`: that value is only known
+ * when the dependency tree is installed (npm-audit reads
+ * node_modules), so a lockfile-only scanner (osv-scanner, or any
+ * gather in a bare git worktree) omits it — and including it forked
+ * the SAME advisory into two identities depending on the scan
+ * environment. The version is display metadata, not identity:
+ * bumping to a still-vulnerable version is the same finding, and
+ * bumping to a fixed version makes the finding disappear on its own.
  *
- *   2. Code/secret/config-finding fingerprints — stable hash of
- *      `(canonicalRule, file, lineWindow)`. The canonical-rule map
- *      collapses cross-tool overlaps (e.g. semgrep + a per-language
- *      grep-based pattern both reporting the same TLS-bypass
- *      construct). The line-window absorbs the small offset between
- *      tools that report the declaration vs. the assignment.
+ * 2. Code/secret/config-finding fingerprints — stable hash of
+ * `(canonicalRule, file, lineWindow)`. The canonical-rule map
+ * collapses cross-tool overlaps (e.g. semgrep + a per-language
+ * grep-based pattern both reporting the same TLS-bypass
+ * construct). The line-window absorbs the small offset between
+ * tools that report the declaration vs. the assignment.
  *
  * Both families share format: 16-char lowercase hex (first 8 bytes of
  * SHA-1). Short enough to embed inline in reports, long enough to make
@@ -27,16 +35,49 @@
  */
 import type { DepVulnFinding } from '../../languages/capabilities/types';
 /**
- * Stable 16-char hex fingerprint for one DepVulnFinding. Input tuple
- * is NUL-separated (not present in any legal package / version / id)
- * so distinct tuples can never collide via concatenation tricks.
+ * Canonical advisory id for dep-vuln identity. Scanners label the same
+ * advisory differently — npm-audit emits an uppercase `GHSA-…`, while
+ * osv-scanner may primary an `OSV-…` / `CVE-…` / `GHSA-…` id and carry
+ * the rest in `aliases`. Collapse them to one token so the SAME
+ * vulnerability fingerprints identically regardless of which tool found
+ * it: prefer GHSA (the namespace every supported scanner shares), then
+ * CVE (the next-best cross-tool token), else the producer's own id.
+ * Lowercased so `GHSA-AB` and `ghsa-ab` don't fork identity.
+ */
+export declare function canonicalAdvisoryId(finding: {
+    readonly id: string;
+    readonly aliases?: readonly string[];
+}): string;
+/**
+ * Stable 16-char hex fingerprint for one DepVulnFinding. Input tuple is
+ * NUL-separated (not present in any legal package name / advisory id) so
+ * distinct tuples can never collide via concatenation tricks.
  *
- * `installedVersion` is normalized to the empty string when absent so
- * version-less findings (rare — some providers omit it when the lock
- * file is missing) still get a deterministic fingerprint instead of
- * mixing an ambient `undefined` into the hash input.
+ * Identity is `(package, canonicalAdvisoryId)` — deliberately NOT the
+ * installed version (see the module header): the version is unavailable
+ * to lockfile-only scanners, so including it forked identity by scan
+ * environment.
  */
-export declare function computeFingerprint(finding: Pick<DepVulnFinding, 'package' | 'installedVersion' | 'id'>): string;
+export declare function computeFingerprint(finding: {
+    readonly package: string;
+    readonly id: string;
+    readonly aliases?: readonly string[];
+}): string;
+/**
+ * Pre-2.11 dependency-advisory fingerprint: `(package, installedVersion,
+ * id)`. Superseded by `computeFingerprint` (which drops the
+ * environment-dependent installed version and canonicalizes the advisory
+ * id), but retained verbatim so the identity-scheme migrator can
+ * recompute a finding's PRIOR-scheme id and remap allowlist entries onto
+ * the current scheme. Never delete a shipped scheme's id function — a
+ * migration from it must always be able to reproduce its output
+ * byte-for-byte. Not used to mint new identities.
+ */
+export declare function computeFingerprintV1(finding: {
+    readonly package: string;
+    readonly installedVersion?: string;
+    readonly id: string;
+}): string;
 /**
  * Stamp `fingerprint` on every finding in place. Called once in
  * `gatherDepVulns` after cross-pack merge + enrichment so every
@@ -99,6 +140,78 @@ export declare function lineWindowFor(line: number): number;
  * code-finding fingerprints share a downstream type contract.
  */
 export declare function computeCodeFingerprint(canonicalRule: string, file: string, line: number): string;
+/**
+ * Normalize a matched code span so cosmetic reformatting (reindentation,
+ * collapsed vs expanded whitespace, trailing space) doesn't re-mint
+ * identity. Runs of whitespace collapse to a single space; ends trimmed.
+ * Deliberately conservative — it does NOT strip comments or rename
+ * identifiers, so a real change to the construct still re-mints.
+ */
+export declare function normalizeSpan(span: string): string;
+/** 16-char hex hash of a normalized matched span. */
+export declare function spanHash(span: string): string;
+/**
+ * Build the content anchor for a CODE finding: `scope\0spanHash\0ordinal`.
+ * `scope` is the enclosing symbol (graph-resolved) or '' (file-level
+ * fallback). `ordinal` is the index among findings sharing the same
+ * `(scope, spanHash)` in document order, so identical constructs in one
+ * scope stay distinct. NUL-separated so the parts can't collide via
+ * concatenation.
+ */
+export declare function codeContentAnchor(scope: string, span: string, ordinal: number): string;
+/**
+ * Build a code content anchor from an ALREADY-HASHED span. The gather
+ * boundary hashes the matched span once (`spanHash`) and carries only
+ * that 16-char digest downstream — never the raw source text — so the
+ * matched code never bloats reports or rides through the dashboard /
+ * JSON surfaces. The aggregator, which knows the enclosing `scope` (from
+ * the graph scope pre-pass) and the in-scope `ordinal`, assembles the
+ * final anchor from that carried digest via this helper. Equivalent to
+ * `codeContentAnchor` when fed `spanHash(span)`.
+ */
+export declare function codeContentAnchorFromHash(scope: string, spanHashHex: string, ordinal: number): string;
+/**
+ * Build the content anchor for a SECRET finding: `secret\0<ordinal>`.
+ * The `(canonicalRule, file)` half of identity already lives in
+ * `computeContentFingerprint`, so the anchor only has to disambiguate
+ * multiple secrets of the same rule in the same file — the ordinal does
+ * that, assigned in document order by the aggregator.
+ *
+ * Crucially it carries NEITHER the captured value NOR the salt. That
+ * makes a secret's per-occurrence identity byte-identical across scanners
+ * (gitleaks' `Secret` field and the grep fallback's capture group differ)
+ * and across environments (the salt resolves differently via env var /
+ * file / root-SHA), which is what a baseline/allowlist needs to stay
+ * matched between a developer's machine and CI. The `secret` prefix
+ * namespaces it away from code anchors (`scope\0spanHash\0ordinal`) so the
+ * two schemes can never collide.
+ *
+ * The value HMAC is not lost — the separate `secret-hmac` identity kind
+ * still pins it, for recognizing the same value relocating across files.
+ */
+export declare function secretContentAnchor(ordinal: number): string;
+/**
+ * The tool-independent rule discriminator for SECRET identity. Unlike code
+ * findings — where two different rules firing on one construct are two
+ * distinct findings, so the rule must stay in identity — every secret
+ * detection means the same thing ("a hardcoded/leaked credential", CWE-798).
+ * Folding them onto one constant makes a secret's identity independent of
+ * WHICH scanner found it and under what rule name (gitleaks `aws-access-key`
+ * vs the grep fallback's `hardcoded-password` describe the same leak). Used
+ * in place of `canonicalRuleFor(tool, rule)` when fingerprinting secrets;
+ * the per-tool canonical rule is still used for intra-run dedup grouping and
+ * survives on the finding as display metadata.
+ */
+export declare const SECRET_CANONICAL_RULE = "canonical:secret";
+/**
+ * Content-anchored finding fingerprint (scheme v2). Identity is
+ * `(canonicalRule, file, contentAnchor)` — the anchor carries the
+ * stable, location-independent content (built by the caller per kind:
+ * secret=HMAC, code=`codeContentAnchor(...)`, config=''). A finding that
+ * moves to a new line keeps its fingerprint; it re-mints only when the
+ * matched content (or, for code, its enclosing symbol) changes.
+ */
+export declare function computeContentFingerprint(canonicalRule: string, file: string, contentAnchor: string): string;
 /**
  * HMAC-SHA256 of a detected secret value, keyed by a per-repo salt.
  * The output is 16-char lowercase hex (first 8 bytes of the 32-byte

package/dist/analyzers/tools/fingerprint.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"fingerprint.d.ts","sourceRoot":"","sources":["../../../src/analyzers/tools/fingerprint.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;GA0BG;AAGH,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,oCAAoC,CAAC;AAEzE;;;;;;;;;GASG;AACH,wBAAgB,kBAAkB,CAChC,OAAO,EAAE,IAAI,CAAC,cAAc,EAAE,SAAS,GAAG,kBAAkB,GAAG,IAAI,CAAC,GACnE,MAAM,CAGR;AAED;;;;;;;;;GASG;AACH,wBAAgB,iBAAiB,CAAC,QAAQ,EAAE,cAAc,EAAE,GAAG,IAAI,CAIlE;AAED;;;;;;;;;GASG;AACH,wBAAgB,mBAAmB,CAAC,QAAQ,EAAE,aAAa,CAAC,cAAc,CAAC,GAAG,MAAM,EAAE,CAMrF;AAID;;;;;;;;;;GAUG;AACH,eAAO,MAAM,kBAAkB,EAAE,WAAW,CAAC,MAAM,EAAE,MAAM,CAmBzD,CAAC;AAEH,kEAAkE;AAClE,wBAAgB,gBAAgB,CAAC,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,MAAM,CAEnE;AAED;;;;;;GAMG;AACH,eAAO,MAAM,4BAA4B,IAAI,CAAC;AAE9C;;;;;;;;;GASG;AACH,wBAAgB,aAAa,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAElD;AAED;;;;;GAKG;AACH,wBAAgB,sBAAsB,CAAC,aAAa,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,MAAM,CAGhG;AAID;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AACH,wBAAgB,iBAAiB,CAAC,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,MAAM,CAEtE"}
+{"version":3,"file":"fingerprint.d.ts","sourceRoot":"","sources":["../../../src/analyzers/tools/fingerprint.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAkCG;AAGH,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,oCAAoC,CAAC;AAEzE;;;;;;;;;GASG;AACH,wBAAgB,mBAAmB,CAAC,OAAO,EAAE;IAC3C,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAC;IACpB,QAAQ,CAAC,OAAO,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;CACtC,GAAG,MAAM,CAST;AAED;;;;;;;;;GASG;AACH,wBAAgB,kBAAkB,CAAC,OAAO,EAAE;IAC1C,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAC;IACpB,QAAQ,CAAC,OAAO,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;CACtC,GAAG,MAAM,CAGT;AAED;;;;;;;;;GASG;AACH,wBAAgB,oBAAoB,CAAC,OAAO,EAAE;IAC5C,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,gBAAgB,CAAC,EAAE,MAAM,CAAC;IACnC,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAC;CACrB,GAAG,MAAM,CAGT;AAED;;;;;;;;;GASG;AACH,wBAAgB,iBAAiB,CAAC,QAAQ,EAAE,cAAc,EAAE,GAAG,IAAI,CAIlE;AAED;;;;;;;;;GASG;AACH,wBAAgB,mBAAmB,CAAC,QAAQ,EAAE,aAAa,CAAC,cAAc,CAAC,GAAG,MAAM,EAAE,CAMrF;AAID;;;;;;;;;;GAUG;AACH,eAAO,MAAM,kBAAkB,EAAE,WAAW,CAAC,MAAM,EAAE,MAAM,CAmBzD,CAAC;AAEH,kEAAkE;AAClE,wBAAgB,gBAAgB,CAAC,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,MAAM,CAEnE;AAED;;;;;;GAMG;AACH,eAAO,MAAM,4BAA4B,IAAI,CAAC;AAE9C;;;;;;;;;GASG;AACH,wBAAgB,aAAa,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAElD;AAED;;;;;GAKG;AACH,wBAAgB,sBAAsB,CAAC,aAAa,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,MAAM,CAGhG;AAwCD;;;;;;GAMG;AACH,wBAAgB,aAAa,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAElD;AAED,qDAAqD;AACrD,wBAAgB,QAAQ,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAE7C;AAED;;;;;;;GAOG;AACH,wBAAgB,iBAAiB,CAAC,KAAK,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,GAAG,MAAM,CAEtF;AAED;;;;;;;;;GASG;AACH,wBAAgB,yBAAyB,CACvC,KAAK,EAAE,MAAM,EACb,WAAW,EAAE,MAAM,EACnB,OAAO,EAAE,MAAM,GACd,MAAM,CAER;AAED;;;;;;;;;;;;;;;;;;GAkBG;AACH,wBAAgB,mBAAmB,CAAC,OAAO,EAAE,MAAM,GAAG,MAAM,CAE3D;AAED;;;;;;;;;;;GAWG;AACH,eAAO,MAAM,qBAAqB,qBAAqB,CAAC;AAExD;;;;;;;GAOG;AACH,wBAAgB,yBAAyB,CACvC,aAAa,EAAE,MAAM,EACrB,IAAI,EAAE,MAAM,EACZ,aAAa,EAAE,MAAM,GACpB,MAAM,CAGR;AAID;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AACH,wBAAgB,iBAAiB,CAAC,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,MAAM,CAEtE"}