verification-layer 0.27.14 → 0.28.0

package/COMPLIANCE_DELIVERY.md

@@ -0,0 +1,161 @@
+# vlayer Compliance Delivery
+
+`vlayer` can operate as a change-oriented compliance control in addition to a repository scanner. The delivery layer answers a narrower release question:
+
+> Did this software change introduce compliance risk that violates our delivery policy?
+
+The `vlayer-ci` binary is designed for pull requests and deployment pipelines. It keeps existing baseline debt visible without allowing historical findings to make every future pull request fail.
+
+## 1. Create a portable baseline
+
+```bash
+vlayer baseline . -o .vlayer-baseline.json
+```
+
+Baseline format 2.0 stores project-relative paths and stable semantic fingerprints. Line numbers are retained for display but are not part of the fingerprint, so a line shift or a different CI checkout directory does not invalidate the baseline.
+
+Commit `.vlayer-baseline.json` with the repository when you want the current accepted state to be the starting point for change detection.
+
+## 2. Define delivery policy
+
+Create `vlayer.policy.json`:
+
+```json
+{
+  "blockOn": ["critical", "high"],
+  "maxNew": {
+    "medium": 3
+  },
+  "changedFilesOnly": true,
+  "minimumScore": 0,
+  "requireBaseline": true,
+  "failOnExpiredAcknowledgments": true
+}
+```
+
+Policy can also live at `.vlayer/policy.json` or in a `deliveryPolicy` block inside `.vlayerrc.json`. An explicit `--policy` file takes precedence.
+
+### Policy semantics
+
+- `blockOn`: any new active finding at one of these severities blocks deployment.
+- `maxNew`: numeric budget for new findings by severity.
+- `changedFilesOnly`: evaluate newly introduced findings only in files changed by the Git comparison when Git metadata is available.
+- `minimumScore`: optional whole-repository compliance score floor.
+- `requireBaseline`: fail when no baseline is available.
+- `failOnExpiredAcknowledgments`: treat expired exceptions as governance failures.
+
+Acknowledged and inline-suppressed findings are not considered new active risk. Expired acknowledgments do not suppress findings.
+
+## 3. Gate a pull request
+
+```bash
+vlayer-ci guard . \
+  --baseline .vlayer-baseline.json \
+  --policy vlayer.policy.json \
+  --base main \
+  --output vlayer-guard.json
+```
+
+Exit codes:
+
+- `0`: policy passed; deployment is allowed.
+- `2`: scan completed but delivery policy blocked the change.
+- `1`: operational failure.
+
+AI triage is disabled by default for deterministic CI decisions. Use `--ai` only when a team deliberately wants model-assisted triage in the gate.
+
+## 4. Generate audit evidence
+
+```bash
+vlayer-ci evidence . \
+  --baseline .vlayer-baseline.json \
+  --policy vlayer.policy.json \
+  --base main \
+  -o vlayer-evidence.json
+```
+
+The evidence package contains:
+
+- source-control provenance (repository, base/head SHA, branch, author when available),
+- delivery decision and policy reasons,
+- new and resolved finding counts,
+- normalized finding metadata,
+- mapped HIPAA controls,
+- a code-to-control compliance graph,
+- a SHA-256 package hash.
+
+Evidence deliberately excludes source-code context snippets. This reduces the chance that PHI, credentials, or application secrets are copied into an audit artifact.
+
+Verify a stored package:
+
+```bash
+vlayer-ci verify-evidence vlayer-evidence.json
+```
+
+Any modification to the hashed package body causes verification to fail.
+
+## 5. Compliance graph
+
+```bash
+vlayer-ci graph . \
+  --baseline .vlayer-baseline.json \
+  --base main \
+  -o vlayer-compliance-graph.json \
+  --mermaid vlayer-compliance-graph.mmd
+```
+
+The graph relates:
+
+```text
+code -> finding -> HIPAA control -> delivery policy
+              \-> owner
+ evidence ----> finding
+ evidence ----> policy decision
+```
+
+This is a machine-readable foundation for workspace reporting, evidence search, and agent reasoning rather than a UI-only diagram.
+
+## 6. Exception lifecycle
+
+```bash
+vlayer-ci exceptions . --config .vlayerrc.json
+```
+
+The command reports active, expired, and soon-to-expire acknowledgments. It exits `2` when expired exceptions exist so an organization can make exception review a scheduled governance control.
+
+An acknowledgment should include an owner, reason, date, ticket, and expiry whenever practical. Expiry means re-review, not permanent suppression.
+
+## 7. Compliance agent
+
+```bash
+vlayer-ci agent . --baseline .vlayer-baseline.json --base main
+```
+
+The agent command converts the delivery decision into a remediation plan with file, rule, recommendation, and whether a deterministic vlayer fix exists.
+
+To apply only registered deterministic fix strategies and then re-run the gate:
+
+```bash
+vlayer-ci agent . \
+  --baseline .vlayer-baseline.json \
+  --base main \
+  --apply-safe-fixes \
+  --markdown vlayer-remediation.md
+```
+
+`--apply-safe-fixes` mutates source files and should therefore be invoked deliberately on a working branch. It never authorizes an AI-generated arbitrary code change.
+
+## GitHub Actions
+
+A reusable example is included at `templates/github-actions/compliance-gate.yml`.
+
+The important requirements are:
+
+1. Checkout with `fetch-depth: 0` so the base/head comparison is available.
+2. Run `vlayer-ci guard` before deployment.
+3. Generate the evidence package even when the gate blocks.
+4. Upload the guard result and evidence JSON as CI artifacts.
+
+## Security model
+
+The delivery layer is a static-analysis and policy-enforcement system, not a certification authority. A passing gate means the configured automated controls found no change that violates the configured policy. It is not a legal attestation that an organization is HIPAA compliant.

package/dist/baseline.d.ts

@@ -1,12 +1,21 @@
 import type { Finding } from './types.js';
+export declare const BASELINE_VERSION = "2.0";
 export interface BaselineEntry {
+    /** Stable v2 fingerprint. `hash` is retained for backwards compatibility. */
     hash: string;
+    fingerprint?: string;
+    /** Canonical rule family without scanner-generated line suffixes. */
+    ruleId?: string;
     id: string;
+    /** Portable path relative to the scanned project root for v2 baselines. */
     file: string;
+    /** Informational only in v2; line number is not part of the fingerprint. */
     line?: number;
     title: string;
     severity: string;
     category: string;
+    /** Normalized matched code used to distinguish repeated rule families. */
+    anchor?: string;
 }
 export interface Baseline {
     version: string;
@@ -14,31 +23,60 @@ export interface Baseline {
     findings: BaselineEntry[];
 }
 /**
- * Generate a stable hash for a finding
+ * Scanner rules historically embedded source line numbers in some finding IDs
+ * (for example `enc-des-81`). Those suffixes are location metadata, not rule
+ * identity, and therefore must not invalidate a baseline after a refactor.
+ * Upper-case catalog IDs such as `CRED-001` and `HIPAA-2026-001` are preserved.
  */
-export declare function generateFindingHash(finding: Finding): string;
+export declare function canonicalRuleId(id: string): string;
 /**
- * Create a baseline entry from a finding
+ * Build a stable semantic anchor from the matched source line. Context lines
+ * are intentionally whitespace-normalized so formatting-only edits do not
+ * create a new baseline finding.
  */
-export declare function createBaselineEntry(finding: Finding): BaselineEntry;
+export declare function getFindingAnchor(finding: Finding): string;
 /**
- * Load baseline from file
+ * Infer the checkout root from all real finding paths. This keeps the existing
+ * `saveBaseline(path, findings)` API portable without requiring callers to pass
+ * the scan root. When a caller knows the root, passing it explicitly is still
+ * preferred.
+ */
+export declare function inferProjectRoot(findings: Finding[]): string;
+/**
+ * Convert a finding path to a portable project-relative path. Virtual project
+ * findings retain their stable symbolic names.
+ */
+export declare function normalizeFindingFile(finding: Finding, projectRoot?: string): string;
+/**
+ * Generate the v2 finding fingerprint. Source line number is deliberately not
+ * included. The fingerprint is based on portable file path, canonical rule
+ * family, stable title, and matched-code anchor.
+ */
+export declare function generateFindingHash(finding: Finding, projectRoot?: string): string;
+/**
+ * Create a baseline entry from a finding.
+ */
+export declare function createBaselineEntry(finding: Finding, projectRoot?: string): BaselineEntry;
+/**
+ * Load baseline from file.
  */
 export declare function loadBaseline(path: string): Promise<Baseline | null>;
 /**
- * Save baseline to file
+ * Save a portable v2 baseline. `projectRoot` is optional for API compatibility;
+ * when omitted it is inferred from the absolute finding paths.
  */
-export declare function saveBaseline(path: string, findings: Finding[]): Promise<void>;
+export declare function saveBaseline(path: string, findings: Finding[], projectRoot?: string): Promise<void>;
 /**
- * Check if a finding exists in the baseline
+ * Check if a finding exists in a baseline.
  */
-export declare function isInBaseline(finding: Finding, baseline: Baseline): boolean;
+export declare function isInBaseline(finding: Finding, baseline: Baseline, projectRoot?: string): boolean;
 /**
- * Apply baseline to findings
+ * Apply baseline to findings. The root is inferred once for stable v2 hashing,
+ * making a committed baseline portable between developer machines and CI.
  */
-export declare function applyBaseline(findings: Finding[], baseline: Baseline | null): Finding[];
+export declare function applyBaseline(findings: Finding[], baseline: Baseline | null, projectRoot?: string): Finding[];
 /**
- * Get statistics about baseline application
+ * Get statistics about baseline application.
  */
 export declare function getBaselineStats(findings: Finding[]): {
     total: number;

package/dist/baseline.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"baseline.d.ts","sourceRoot":"","sources":["../src/baseline.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,YAAY,CAAC;AAE1C,MAAM,WAAW,aAAa;IAC5B,IAAI,EAAE,MAAM,CAAC;IACb,EAAE,EAAE,MAAM,CAAC;IACX,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,KAAK,EAAE,MAAM,CAAC;IACd,QAAQ,EAAE,MAAM,CAAC;IACjB,QAAQ,EAAE,MAAM,CAAC;CAClB;AAED,MAAM,WAAW,QAAQ;IACvB,OAAO,EAAE,MAAM,CAAC;IAChB,SAAS,EAAE,MAAM,CAAC;IAClB,QAAQ,EAAE,aAAa,EAAE,CAAC;CAC3B;AAED;;GAEG;AACH,wBAAgB,mBAAmB,CAAC,OAAO,EAAE,OAAO,GAAG,MAAM,CAK5D;AAED;;GAEG;AACH,wBAAgB,mBAAmB,CAAC,OAAO,EAAE,OAAO,GAAG,aAAa,CAUnE;AAED;;GAEG;AACH,wBAAsB,YAAY,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,QAAQ,GAAG,IAAI,CAAC,CAQzE;AAED;;GAEG;AACH,wBAAsB,YAAY,CAAC,IAAI,EAAE,MAAM,EAAE,QAAQ,EAAE,OAAO,EAAE,GAAG,OAAO,CAAC,IAAI,CAAC,CAQnF;AAED;;GAEG;AACH,wBAAgB,YAAY,CAAC,OAAO,EAAE,OAAO,EAAE,QAAQ,EAAE,QAAQ,GAAG,OAAO,CAG1E;AAED;;GAEG;AACH,wBAAgB,aAAa,CAAC,QAAQ,EAAE,OAAO,EAAE,EAAE,QAAQ,EAAE,QAAQ,GAAG,IAAI,GAAG,OAAO,EAAE,CAcvF;AAED;;GAEG;AACH,wBAAgB,gBAAgB,CAAC,QAAQ,EAAE,OAAO,EAAE,GAAG;IACrD,KAAK,EAAE,MAAM,CAAC;IACd,QAAQ,EAAE,MAAM,CAAC;IACjB,GAAG,EAAE,MAAM,CAAC;CACb,CASA"}
+{"version":3,"file":"baseline.d.ts","sourceRoot":"","sources":["../src/baseline.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,YAAY,CAAC;AAE1C,eAAO,MAAM,gBAAgB,QAAQ,CAAC;AAQtC,MAAM,WAAW,aAAa;IAC5B,6EAA6E;IAC7E,IAAI,EAAE,MAAM,CAAC;IACb,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,qEAAqE;IACrE,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,EAAE,EAAE,MAAM,CAAC;IACX,2EAA2E;IAC3E,IAAI,EAAE,MAAM,CAAC;IACb,4EAA4E;IAC5E,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,KAAK,EAAE,MAAM,CAAC;IACd,QAAQ,EAAE,MAAM,CAAC;IACjB,QAAQ,EAAE,MAAM,CAAC;IACjB,0EAA0E;IAC1E,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB;AAED,MAAM,WAAW,QAAQ;IACvB,OAAO,EAAE,MAAM,CAAC;IAChB,SAAS,EAAE,MAAM,CAAC;IAClB,QAAQ,EAAE,aAAa,EAAE,CAAC;CAC3B;AAMD;;;;;GAKG;AACH,wBAAgB,eAAe,CAAC,EAAE,EAAE,MAAM,GAAG,MAAM,CAKlD;AAED;;;;GAIG;AACH,wBAAgB,gBAAgB,CAAC,OAAO,EAAE,OAAO,GAAG,MAAM,CAWzD;AAWD;;;;;GAKG;AACH,wBAAgB,gBAAgB,CAAC,QAAQ,EAAE,OAAO,EAAE,GAAG,MAAM,CAkB5D;AAED;;;GAGG;AACH,wBAAgB,oBAAoB,CAAC,OAAO,EAAE,OAAO,EAAE,WAAW,CAAC,EAAE,MAAM,GAAG,MAAM,CAYnF;AAED;;;;GAIG;AACH,wBAAgB,mBAAmB,CAAC,OAAO,EAAE,OAAO,EAAE,WAAW,CAAC,EAAE,MAAM,GAAG,MAAM,CAUlF;AAUD;;GAEG;AACH,wBAAgB,mBAAmB,CAAC,OAAO,EAAE,OAAO,EAAE,WAAW,CAAC,EAAE,MAAM,GAAG,aAAa,CAczF;AAED;;GAEG;AACH,wBAAsB,YAAY,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,QAAQ,GAAG,IAAI,CAAC,CAWzE;AAED;;;GAGG;AACH,wBAAsB,YAAY,CAChC,IAAI,EAAE,MAAM,EACZ,QAAQ,EAAE,OAAO,EAAE,EACnB,WAAW,CAAC,EAAE,MAAM,GACnB,OAAO,CAAC,IAAI,CAAC,CASf;AAwBD;;GAEG;AACH,wBAAgB,YAAY,CAC1B,OAAO,EAAE,OAAO,EAChB,QAAQ,EAAE,QAAQ,EAClB,WAAW,CAAC,EAAE,MAAM,GACnB,OAAO,CAmBT;AAED;;;GAGG;AACH,wBAAgB,aAAa,CAC3B,QAAQ,EAAE,OAAO,EAAE,EACnB,QAAQ,EAAE,QAAQ,GAAG,IAAI,EACzB,WAAW,CAAC,EAAE,MAAM,GACnB,OAAO,EAAE,CAaX;AAED;;GAEG;AACH,wBAAgB,gBAAgB,CAAC,QAAQ,EAAE,OAAO,EAAE,GAAG;IACrD,KAAK,EAAE,MAAM,CAAC;IACd,QAAQ,EAAE,MAAM,CAAC;IACjB,GAAG,EAAE,MAAM,CAAC;CACb,CASA"}

package/dist/baseline.js

@@ -1,35 +1,140 @@
 import { readFile, writeFile } from 'fs/promises';
 import { createHash } from 'crypto';
+import { dirname, isAbsolute, relative, resolve, sep } from 'path';
+export const BASELINE_VERSION = '2.0';
+const VIRTUAL_FILES = new Set([
+    'project-level',
+    'ASSET-INVENTORY',
+    'PHI-FLOW-MAP',
+]);
+function normalizeSlashes(value) {
+    return value.replace(/\\/g, '/').replace(/^\.\//, '');
+}
+/**
+ * Scanner rules historically embedded source line numbers in some finding IDs
+ * (for example `enc-des-81`). Those suffixes are location metadata, not rule
+ * identity, and therefore must not invalidate a baseline after a refactor.
+ * Upper-case catalog IDs such as `CRED-001` and `HIPAA-2026-001` are preserved.
+ */
+export function canonicalRuleId(id) {
+    if (/^[a-z][a-z0-9-]*-\d+$/.test(id)) {
+        return id.replace(/-\d+$/, '');
+    }
+    return id;
+}
+/**
+ * Build a stable semantic anchor from the matched source line. Context lines
+ * are intentionally whitespace-normalized so formatting-only edits do not
+ * create a new baseline finding.
+ */
+export function getFindingAnchor(finding) {
+    if (!finding.context || finding.context.length === 0)
+        return '';
+    const matched = finding.context.filter(line => line.isMatch);
+    const source = matched.length > 0 ? matched : finding.context;
+    return source
+        .map(line => line.content.trim().toLowerCase().replace(/\s+/g, ' '))
+        .filter(Boolean)
+        .join('\n')
+        .slice(0, 1000);
+}
+function isVirtualFile(file) {
+    return VIRTUAL_FILES.has(file);
+}
+function isInside(root, file) {
+    const rel = relative(root, file);
+    return rel === '' || (!rel.startsWith(`..${sep}`) && rel !== '..' && !isAbsolute(rel));
+}
+/**
+ * Infer the checkout root from all real finding paths. This keeps the existing
+ * `saveBaseline(path, findings)` API portable without requiring callers to pass
+ * the scan root. When a caller knows the root, passing it explicitly is still
+ * preferred.
+ */
+export function inferProjectRoot(findings) {
+    const files = findings
+        .map(f => f.file)
+        .filter(file => isAbsolute(file) && !isVirtualFile(file))
+        .map(file => resolve(file));
+    if (files.length === 0)
+        return process.cwd();
+    let root = dirname(files[0]);
+    for (const file of files.slice(1)) {
+        while (!isInside(root, file)) {
+            const parent = dirname(root);
+            if (parent === root)
+                break;
+            root = parent;
+        }
+    }
+    return root;
+}
 /**
- * Generate a stable hash for a finding
+ * Convert a finding path to a portable project-relative path. Virtual project
+ * findings retain their stable symbolic names.
  */
-export function generateFindingHash(finding) {
-    // Use file path, line number, finding ID, and title to create a stable hash
-    // This allows the same issue at the same location to be matched
+export function normalizeFindingFile(finding, projectRoot) {
+    if (isVirtualFile(finding.file))
+        return finding.file;
+    if (projectRoot && isAbsolute(finding.file)) {
+        const root = resolve(projectRoot);
+        const file = resolve(finding.file);
+        if (isInside(root, file)) {
+            return normalizeSlashes(relative(root, file));
+        }
+    }
+    return normalizeSlashes(finding.file);
+}
+/**
+ * Generate the v2 finding fingerprint. Source line number is deliberately not
+ * included. The fingerprint is based on portable file path, canonical rule
+ * family, stable title, and matched-code anchor.
+ */
+export function generateFindingHash(finding, projectRoot) {
+    const key = [
+        'v2',
+        normalizeFindingFile(finding, projectRoot),
+        canonicalRuleId(finding.id),
+        finding.title.trim().toLowerCase(),
+        getFindingAnchor(finding),
+    ].join('|');
+    return createHash('sha256').update(key).digest('hex').substring(0, 16);
+}
+/**
+ * Legacy v1 hash used only to keep exact same-checkout baselines readable.
+ */
+function generateLegacyFindingHash(finding) {
     const key = `${finding.file}:${finding.line || 0}:${finding.id}:${finding.title}`;
     return createHash('sha256').update(key).digest('hex').substring(0, 16);
 }
 /**
- * Create a baseline entry from a finding
+ * Create a baseline entry from a finding.
  */
-export function createBaselineEntry(finding) {
+export function createBaselineEntry(finding, projectRoot) {
+    const fingerprint = generateFindingHash(finding, projectRoot);
     return {
-        hash: generateFindingHash(finding),
+        hash: fingerprint,
+        fingerprint,
+        ruleId: canonicalRuleId(finding.id),
         id: finding.id,
-        file: finding.file,
+        file: normalizeFindingFile(finding, projectRoot),
         line: finding.line,
         title: finding.title,
         severity: finding.severity,
         category: finding.category,
+        anchor: getFindingAnchor(finding) || undefined,
     };
 }
 /**
- * Load baseline from file
+ * Load baseline from file.
  */
 export async function loadBaseline(path) {
     try {
         const content = await readFile(path, 'utf-8');
         const baseline = JSON.parse(content);
+        if (!baseline || !Array.isArray(baseline.findings) || typeof baseline.version !== 'string') {
+            return null;
+        }
         return baseline;
     }
     catch {
@@ -37,32 +142,69 @@ export async function loadBaseline(path) {
     }
 }
 /**
- * Save baseline to file
+ * Save a portable v2 baseline. `projectRoot` is optional for API compatibility;
+ * when omitted it is inferred from the absolute finding paths.
  */
-export async function saveBaseline(path, findings) {
+export async function saveBaseline(path, findings, projectRoot) {
+    const root = projectRoot ? resolve(projectRoot) : inferProjectRoot(findings);
     const baseline = {
-        version: '1.0',
+        version: BASELINE_VERSION,
         createdAt: new Date().toISOString(),
-        findings: findings.map(createBaselineEntry),
+        findings: findings.map(finding => createBaselineEntry(finding, root)),
     };
     await writeFile(path, JSON.stringify(baseline, null, 2), 'utf-8');
 }
+function pathMatches(entryFile, findingFile) {
+    const expected = normalizeSlashes(entryFile);
+    const actual = normalizeSlashes(findingFile);
+    if (VIRTUAL_FILES.has(expected) || VIRTUAL_FILES.has(actual)) {
+        return expected === actual;
+    }
+    return actual === expected || actual.endsWith(`/${expected}`);
+}
+function semanticEntryMatches(finding, entry) {
+    if (!pathMatches(entry.file, finding.file))
+        return false;
+    if ((entry.ruleId ?? canonicalRuleId(entry.id)) !== canonicalRuleId(finding.id))
+        return false;
+    if (entry.title.trim().toLowerCase() !== finding.title.trim().toLowerCase())
+        return false;
+    const anchor = getFindingAnchor(finding);
+    if (entry.anchor && anchor)
+        return entry.anchor === anchor;
+    return true;
+}
 /**
- * Check if a finding exists in the baseline
+ * Check if a finding exists in a baseline.
  */
-export function isInBaseline(finding, baseline) {
-    const hash = generateFindingHash(finding);
-    return baseline.findings.some(entry => entry.hash === hash);
+export function isInBaseline(finding, baseline, projectRoot) {
+    if (baseline.version.startsWith('2')) {
+        if (projectRoot) {
+            const fingerprint = generateFindingHash(finding, projectRoot);
+            if (baseline.findings.some(entry => (entry.fingerprint ?? entry.hash) === fingerprint)) {
+                return true;
+            }
+        }
+        // Portable fallback: useful when callers do not know the checkout root.
+        return baseline.findings.some(entry => semanticEntryMatches(finding, entry));
+    }
+    // v1 files remain readable on the checkout where they were generated.
+    const legacyHash = generateLegacyFindingHash(finding);
+    if (baseline.findings.some(entry => entry.hash === legacyHash))
+        return true;
+    // Best-effort portability for legacy files while users regenerate to v2.
+    return baseline.findings.some(entry => semanticEntryMatches(finding, entry));
 }
 /**
- * Apply baseline to findings
+ * Apply baseline to findings. The root is inferred once for stable v2 hashing,
+ * making a committed baseline portable between developer machines and CI.
  */
-export function applyBaseline(findings, baseline) {
-    if (!baseline) {
+export function applyBaseline(findings, baseline, projectRoot) {
+    if (!baseline)
         return findings;
-    }
+    const root = projectRoot ?? inferProjectRoot(findings);
     return findings.map(finding => {
-        if (isInBaseline(finding, baseline)) {
+        if (isInBaseline(finding, baseline, root)) {
             return {
                 ...finding,
                 isBaseline: true,
@@ -72,7 +214,7 @@ export function applyBaseline(findings, baseline) {
     });
 }
 /**
- * Get statistics about baseline application
+ * Get statistics about baseline application.
  */
 export function getBaselineStats(findings) {
     const baseline = findings.filter(f => f.isBaseline).length;

package/dist/baseline.js.map

@@ -1 +1 @@
-{"version":3,"file":"baseline.js","sourceRoot":"","sources":["../src/baseline.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,SAAS,EAAE,MAAM,aAAa,CAAC;AAClD,OAAO,EAAE,UAAU,EAAE,MAAM,QAAQ,CAAC;AAmBpC;;GAEG;AACH,MAAM,UAAU,mBAAmB,CAAC,OAAgB;IAClD,4EAA4E;IAC5E,gEAAgE;IAChE,MAAM,GAAG,GAAG,GAAG,OAAO,CAAC,IAAI,IAAI,OAAO,CAAC,IAAI,IAAI,CAAC,IAAI,OAAO,CAAC,EAAE,IAAI,OAAO,CAAC,KAAK,EAAE,CAAC;IAClF,OAAO,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,SAAS,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;AACzE,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,mBAAmB,CAAC,OAAgB;IAClD,OAAO;QACL,IAAI,EAAE,mBAAmB,CAAC,OAAO,CAAC;QAClC,EAAE,EAAE,OAAO,CAAC,EAAE;QACd,IAAI,EAAE,OAAO,CAAC,IAAI;QAClB,IAAI,EAAE,OAAO,CAAC,IAAI;QAClB,KAAK,EAAE,OAAO,CAAC,KAAK;QACpB,QAAQ,EAAE,OAAO,CAAC,QAAQ;QAC1B,QAAQ,EAAE,OAAO,CAAC,QAAQ;KAC3B,CAAC;AACJ,CAAC;AAED;;GAEG;AACH,MAAM,CAAC,KAAK,UAAU,YAAY,CAAC,IAAY;IAC7C,IAAI,CAAC;QACH,MAAM,OAAO,GAAG,MAAM,QAAQ,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC;QAC9C,MAAM,QAAQ,GAAG,IAAI,CAAC,KAAK,CAAC,OAAO,CAAa,CAAC;QACjD,OAAO,QAAQ,CAAC;IAClB,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED;;GAEG;AACH,MAAM,CAAC,KAAK,UAAU,YAAY,CAAC,IAAY,EAAE,QAAmB;IAClE,MAAM,QAAQ,GAAa;QACzB,OAAO,EAAE,KAAK;QACd,SAAS,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;QACnC,QAAQ,EAAE,QAAQ,CAAC,GAAG,CAAC,mBAAmB,CAAC;KAC5C,CAAC;IAEF,MAAM,SAAS,CAAC,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,QAAQ,EAAE,IAAI,EAAE,CAAC,CAAC,EAAE,OAAO,CAAC,CAAC;AACpE,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,YAAY,CAAC,OAAgB,EAAE,QAAkB;IAC/D,MAAM,IAAI,GAAG,mBAAmB,CAAC,OAAO,CAAC,CAAC;IAC1C,OAAO,QAAQ,CAAC,QAAQ,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,KAAK,CAAC,IAAI,KAAK,IAAI,CAAC,CAAC;AAC9D,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,aAAa,CAAC,QAAmB,EAAE,QAAyB;IAC1E,IAAI,CAAC,QAAQ,EAAE,CAAC;QACd,OAAO,QAAQ,CAAC;IAClB,CAAC;IAED,OAAO,QAAQ,CAAC,GAAG,CAAC,OAAO,CAAC,EAAE;QAC5B,IAAI,YAAY,CAAC,OAAO,EAAE,QAAQ,CAAC,EAAE,CAAC;YACpC,OAAO;gBACL,GAAG,OAAO;gBACV,UAAU,EAAE,IAAI;aACjB,CAAC;QACJ,CAAC;QACD,OAAO,OAAO,CAAC;IACjB,CAAC,CAAC,CAAC;AACL,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,gBAAgB,CAAC,QAAmB;IAKlD,MAAM,QAAQ,GAAG,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,MAAM,CAAC;IAC3D,MAAM,KAAK,GAAG,QAAQ,CAAC,MAAM,CAAC;IAE9B,OAAO;QACL,KAAK;QACL,QAAQ;QACR,GAAG,EAAE,KAAK,GAAG,QAAQ;KACtB,CAAC;AACJ,CAAC"}
+{"version":3,"file":"baseline.js","sourceRoot":"","sources":["../src/baseline.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,SAAS,EAAE,MAAM,aAAa,CAAC;AAClD,OAAO,EAAE,UAAU,EAAE,MAAM,QAAQ,CAAC;AACpC,OAAO,EAAE,OAAO,EAAE,UAAU,EAAE,QAAQ,EAAE,OAAO,EAAE,GAAG,EAAE,MAAM,MAAM,CAAC;AAGnE,MAAM,CAAC,MAAM,gBAAgB,GAAG,KAAK,CAAC;AAEtC,MAAM,aAAa,GAAG,IAAI,GAAG,CAAC;IAC5B,eAAe;IACf,iBAAiB;IACjB,cAAc;CACf,CAAC,CAAC;AA0BH,SAAS,gBAAgB,CAAC,KAAa;IACrC,OAAO,KAAK,CAAC,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC,OAAO,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC;AACxD,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,eAAe,CAAC,EAAU;IACxC,IAAI,uBAAuB,CAAC,IAAI,CAAC,EAAE,CAAC,EAAE,CAAC;QACrC,OAAO,EAAE,CAAC,OAAO,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC;IACjC,CAAC;IACD,OAAO,EAAE,CAAC;AACZ,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,gBAAgB,CAAC,OAAgB;IAC/C,IAAI,CAAC,OAAO,CAAC,OAAO,IAAI,OAAO,CAAC,OAAO,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,EAAE,CAAC;IAEhE,MAAM,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;IAC7D,MAAM,MAAM,GAAG,OAAO,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,OAAO,CAAC,OAAO,CAAC;IAE9D,OAAO,MAAM;SACV,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC,OAAO,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC;SACnE,MAAM,CAAC,OAAO,CAAC;SACf,IAAI,CAAC,IAAI,CAAC;SACV,KAAK,CAAC,CAAC,EAAE,IAAI,CAAC,CAAC;AACpB,CAAC;AAED,SAAS,aAAa,CAAC,IAAY;IACjC,OAAO,aAAa,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;AACjC,CAAC;AAED,SAAS,QAAQ,CAAC,IAAY,EAAE,IAAY;IAC1C,MAAM,GAAG,GAAG,QAAQ,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;IACjC,OAAO,GAAG,KAAK,EAAE,IAAI,CAAC,CAAC,GAAG,CAAC,UAAU,CAAC,KAAK,GAAG,EAAE,CAAC,IAAI,GAAG,KAAK,IAAI,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC;AACzF,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,gBAAgB,CAAC,QAAmB;IAClD,MAAM,KAAK,GAAG,QAAQ;SACnB,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC;SAChB,MAAM,CAAC,IAAI,CAAC,EAAE,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,aAAa,CAAC,IAAI,CAAC,CAAC;SACxD,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC;IAE9B,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,OAAO,CAAC,GAAG,EAAE,CAAC;IAE7C,IAAI,IAAI,GAAG,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;IAC7B,KAAK,MAAM,IAAI,IAAI,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC;QAClC,OAAO,CAAC,QAAQ,CAAC,IAAI,EAAE,IAAI,CAAC,EAAE,CAAC;YAC7B,MAAM,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;YAC7B,IAAI,MAAM,KAAK,IAAI;gBAAE,MAAM;YAC3B,IAAI,GAAG,MAAM,CAAC;QAChB,CAAC;IACH,CAAC;IAED,OAAO,IAAI,CAAC;AACd,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,oBAAoB,CAAC,OAAgB,EAAE,WAAoB;IACzE,IAAI,aAAa,CAAC,OAAO,CAAC,IAAI,CAAC;QAAE,OAAO,OAAO,CAAC,IAAI,CAAC;IAErD,IAAI,WAAW,IAAI,UAAU,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,CAAC;QAC5C,MAAM,IAAI,GAAG,OAAO,CAAC,WAAW,CAAC,CAAC;QAClC,MAAM,IAAI,GAAG,OAAO,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;QACnC,IAAI,QAAQ,CAAC,IAAI,EAAE,IAAI,CAAC,EAAE,CAAC;YACzB,OAAO,gBAAgB,CAAC,QAAQ,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC,CAAC;QAChD,CAAC;IACH,CAAC;IAED,OAAO,gBAAgB,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;AACxC,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,mBAAmB,CAAC,OAAgB,EAAE,WAAoB;IACxE,MAAM,GAAG,GAAG;QACV,IAAI;QACJ,oBAAoB,CAAC,OAAO,EAAE,WAAW,CAAC;QAC1C,eAAe,CAAC,OAAO,CAAC,EAAE,CAAC;QAC3B,OAAO,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE;QAClC,gBAAgB,CAAC,OAAO,CAAC;KAC1B,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IAEZ,OAAO,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,SAAS,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;AACzE,CAAC;AAED;;GAEG;AACH,SAAS,yBAAyB,CAAC,OAAgB;IACjD,MAAM,GAAG,GAAG,GAAG,OAAO,CAAC,IAAI,IAAI,OAAO,CAAC,IAAI,IAAI,CAAC,IAAI,OAAO,CAAC,EAAE,IAAI,OAAO,CAAC,KAAK,EAAE,CAAC;IAClF,OAAO,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,SAAS,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;AACzE,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,mBAAmB,CAAC,OAAgB,EAAE,WAAoB;IACxE,MAAM,WAAW,GAAG,mBAAmB,CAAC,OAAO,EAAE,WAAW,CAAC,CAAC;IAC9D,OAAO;QACL,IAAI,EAAE,WAAW;QACjB,WAAW;QACX,MAAM,EAAE,eAAe,CAAC,OAAO,CAAC,EAAE,CAAC;QACnC,EAAE,EAAE,OAAO,CAAC,EAAE;QACd,IAAI,EAAE,oBAAoB,CAAC,OAAO,EAAE,WAAW,CAAC;QAChD,IAAI,EAAE,OAAO,CAAC,IAAI;QAClB,KAAK,EAAE,OAAO,CAAC,KAAK;QACpB,QAAQ,EAAE,OAAO,CAAC,QAAQ;QAC1B,QAAQ,EAAE,OAAO,CAAC,QAAQ;QAC1B,MAAM,EAAE,gBAAgB,CAAC,OAAO,CAAC,IAAI,SAAS;KAC/C,CAAC;AACJ,CAAC;AAED;;GAEG;AACH,MAAM,CAAC,KAAK,UAAU,YAAY,CAAC,IAAY;IAC7C,IAAI,CAAC;QACH,MAAM,OAAO,GAAG,MAAM,QAAQ,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC;QAC9C,MAAM,QAAQ,GAAG,IAAI,CAAC,KAAK,CAAC,OAAO,CAAa,CAAC;QACjD,IAAI,CAAC,QAAQ,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAC,IAAI,OAAO,QAAQ,CAAC,OAAO,KAAK,QAAQ,EAAE,CAAC;YAC3F,OAAO,IAAI,CAAC;QACd,CAAC;QACD,OAAO,QAAQ,CAAC;IAClB,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,YAAY,CAChC,IAAY,EACZ,QAAmB,EACnB,WAAoB;IAEpB,MAAM,IAAI,GAAG,WAAW,CAAC,CAAC,CAAC,OAAO,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC,gBAAgB,CAAC,QAAQ,CAAC,CAAC;IAC7E,MAAM,QAAQ,GAAa;QACzB,OAAO,EAAE,gBAAgB;QACzB,SAAS,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;QACnC,QAAQ,EAAE,QAAQ,CAAC,GAAG,CAAC,OAAO,CAAC,EAAE,CAAC,mBAAmB,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC;KACtE,CAAC;IAEF,MAAM,SAAS,CAAC,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,QAAQ,EAAE,IAAI,EAAE,CAAC,CAAC,EAAE,OAAO,CAAC,CAAC;AACpE,CAAC;AAED,SAAS,WAAW,CAAC,SAAiB,EAAE,WAAmB;IACzD,MAAM,QAAQ,GAAG,gBAAgB,CAAC,SAAS,CAAC,CAAC;IAC7C,MAAM,MAAM,GAAG,gBAAgB,CAAC,WAAW,CAAC,CAAC;IAE7C,IAAI,aAAa,CAAC,GAAG,CAAC,QAAQ,CAAC,IAAI,aAAa,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC;QAC7D,OAAO,QAAQ,KAAK,MAAM,CAAC;IAC7B,CAAC;IAED,OAAO,MAAM,KAAK,QAAQ,IAAI,MAAM,CAAC,QAAQ,CAAC,IAAI,QAAQ,EAAE,CAAC,CAAC;AAChE,CAAC;AAED,SAAS,oBAAoB,CAAC,OAAgB,EAAE,KAAoB;IAClE,IAAI,CAAC,WAAW,CAAC,KAAK,CAAC,IAAI,EAAE,OAAO,CAAC,IAAI,CAAC;QAAE,OAAO,KAAK,CAAC;IACzD,IAAI,CAAC,KAAK,CAAC,MAAM,IAAI,eAAe,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC,KAAK,eAAe,CAAC,OAAO,CAAC,EAAE,CAAC;QAAE,OAAO,KAAK,CAAC;IAC9F,IAAI,KAAK,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,KAAK,OAAO,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE;QAAE,OAAO,KAAK,CAAC;IAE1F,MAAM,MAAM,GAAG,gBAAgB,CAAC,OAAO,CAAC,CAAC;IACzC,IAAI,KAAK,CAAC,MAAM,IAAI,MAAM;QAAE,OAAO,KAAK,CAAC,MAAM,KAAK,MAAM,CAAC;IAE3D,OAAO,IAAI,CAAC;AACd,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,YAAY,CAC1B,OAAgB,EAChB,QAAkB,EAClB,WAAoB;IAEpB,IAAI,QAAQ,CAAC,OAAO,CAAC,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC;QACrC,IAAI,WAAW,EAAE,CAAC;YAChB,MAAM,WAAW,GAAG,mBAAmB,CAAC,OAAO,EAAE,WAAW,CAAC,CAAC;YAC9D,IAAI,QAAQ,CAAC,QAAQ,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC,KAAK,CAAC,WAAW,IAAI,KAAK,CAAC,IAAI,CAAC,KAAK,WAAW,CAAC,EAAE,CAAC;gBACvF,OAAO,IAAI,CAAC;YACd,CAAC;QACH,CAAC;QAED,wEAAwE;QACxE,OAAO,QAAQ,CAAC,QAAQ,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,oBAAoB,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC,CAAC;IAC/E,CAAC;IAED,sEAAsE;IACtE,MAAM,UAAU,GAAG,yBAAyB,CAAC,OAAO,CAAC,CAAC;IACtD,IAAI,QAAQ,CAAC,QAAQ,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,KAAK,CAAC,IAAI,KAAK,UAAU,CAAC;QAAE,OAAO,IAAI,CAAC;IAE5E,yEAAyE;IACzE,OAAO,QAAQ,CAAC,QAAQ,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,oBAAoB,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC,CAAC;AAC/E,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,aAAa,CAC3B,QAAmB,EACnB,QAAyB,EACzB,WAAoB;IAEpB,IAAI,CAAC,QAAQ;QAAE,OAAO,QAAQ,CAAC;IAE/B,MAAM,IAAI,GAAG,WAAW,IAAI,gBAAgB,CAAC,QAAQ,CAAC,CAAC;IACvD,OAAO,QAAQ,CAAC,GAAG,CAAC,OAAO,CAAC,EAAE;QAC5B,IAAI,YAAY,CAAC,OAAO,EAAE,QAAQ,EAAE,IAAI,CAAC,EAAE,CAAC;YAC1C,OAAO;gBACL,GAAG,OAAO;gBACV,UAAU,EAAE,IAAI;aACjB,CAAC;QACJ,CAAC;QACD,OAAO,OAAO,CAAC;IACjB,CAAC,CAAC,CAAC;AACL,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,gBAAgB,CAAC,QAAmB;IAKlD,MAAM,QAAQ,GAAG,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,MAAM,CAAC;IAC3D,MAAM,KAAK,GAAG,QAAQ,CAAC,MAAM,CAAC;IAE9B,OAAO;QACL,KAAK;QACL,QAAQ;QACR,GAAG,EAAE,KAAK,GAAG,QAAQ;KACtB,CAAC;AACJ,CAAC"}

package/dist/delivery/diff.d.ts

@@ -0,0 +1,10 @@
+import type { Finding } from '../types.js';
+import type { Baseline } from '../baseline.js';
+import type { FindingDelta } from './types.js';
+/**
+ * Build the change-oriented view used by CI policy evaluation. Findings already
+ * marked by `scan(..., baselineFile)` are treated as existing debt; active
+ * findings outside the baseline are new risk.
+ */
+export declare function buildFindingDelta(findings: Finding[], projectRoot: string, changedFiles: string[], baseline: Baseline | null): FindingDelta;
+//# sourceMappingURL=diff.d.ts.map

package/dist/delivery/diff.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"diff.d.ts","sourceRoot":"","sources":["../../src/delivery/diff.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,aAAa,CAAC;AAC3C,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,gBAAgB,CAAC;AAK/C,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,YAAY,CAAC;AAc/C;;;;GAIG;AACH,wBAAgB,iBAAiB,CAC/B,QAAQ,EAAE,OAAO,EAAE,EACnB,WAAW,EAAE,MAAM,EACnB,YAAY,EAAE,MAAM,EAAE,EACtB,QAAQ,EAAE,QAAQ,GAAG,IAAI,GACxB,YAAY,CA2Bd"}

package/dist/delivery/diff.js

@@ -0,0 +1,41 @@
+import { generateFindingHash, normalizeFindingFile, } from '../baseline.js';
+const VIRTUAL_FILES = new Set(['project-level', 'ASSET-INVENTORY', 'PHI-FLOW-MAP']);
+function isActive(finding) {
+    return !finding.suppressed && !finding.acknowledged;
+}
+function isChangedFile(finding, projectRoot, changed) {
+    const file = normalizeFindingFile(finding, projectRoot);
+    if (VIRTUAL_FILES.has(file))
+        return true;
+    return changed.has(file);
+}
+/**
+ * Build the change-oriented view used by CI policy evaluation. Findings already
+ * marked by `scan(..., baselineFile)` are treated as existing debt; active
+ * findings outside the baseline are new risk.
+ */
+export function buildFindingDelta(findings, projectRoot, changedFiles, baseline) {
+    const changed = new Set(changedFiles.map(file => file.replace(/\\/g, '/')));
+    const active = findings.filter(isActive);
+    const baselineFindings = active.filter(finding => finding.isBaseline === true);
+    const newFindings = active.filter(finding => finding.isBaseline !== true);
+    const newFindingsInChangedFiles = changed.size === 0
+        ? newFindings
+        : newFindings.filter(finding => isChangedFile(finding, projectRoot, changed));
+    let resolvedFindings = baseline?.findings.filter(() => false) ?? [];
+    if (baseline?.version.startsWith('2')) {
+        const currentFingerprints = new Set(findings.map(finding => generateFindingHash(finding, projectRoot)));
+        resolvedFindings = baseline.findings.filter(entry => {
+            const fingerprint = entry.fingerprint ?? entry.hash;
+            return !currentFingerprints.has(fingerprint);
+        });
+    }
+    return {
+        newFindings,
+        newFindingsInChangedFiles,
+        baselineFindings,
+        resolvedFindings,
+        changedFiles: [...changed],
+    };
+}
+//# sourceMappingURL=diff.js.map

package/dist/delivery/diff.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"diff.js","sourceRoot":"","sources":["../../src/delivery/diff.ts"],"names":[],"mappings":"AAEA,OAAO,EACL,mBAAmB,EACnB,oBAAoB,GACrB,MAAM,gBAAgB,CAAC;AAGxB,MAAM,aAAa,GAAG,IAAI,GAAG,CAAC,CAAC,eAAe,EAAE,iBAAiB,EAAE,cAAc,CAAC,CAAC,CAAC;AAEpF,SAAS,QAAQ,CAAC,OAAgB;IAChC,OAAO,CAAC,OAAO,CAAC,UAAU,IAAI,CAAC,OAAO,CAAC,YAAY,CAAC;AACtD,CAAC;AAED,SAAS,aAAa,CAAC,OAAgB,EAAE,WAAmB,EAAE,OAAoB;IAChF,MAAM,IAAI,GAAG,oBAAoB,CAAC,OAAO,EAAE,WAAW,CAAC,CAAC;IACxD,IAAI,aAAa,CAAC,GAAG,CAAC,IAAI,CAAC;QAAE,OAAO,IAAI,CAAC;IACzC,OAAO,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;AAC3B,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,iBAAiB,CAC/B,QAAmB,EACnB,WAAmB,EACnB,YAAsB,EACtB,QAAyB;IAEzB,MAAM,OAAO,GAAG,IAAI,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC,IAAI,CAAC,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC,CAAC,CAAC;IAC5E,MAAM,MAAM,GAAG,QAAQ,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;IACzC,MAAM,gBAAgB,GAAG,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,EAAE,CAAC,OAAO,CAAC,UAAU,KAAK,IAAI,CAAC,CAAC;IAC/E,MAAM,WAAW,GAAG,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,EAAE,CAAC,OAAO,CAAC,UAAU,KAAK,IAAI,CAAC,CAAC;IAC1E,MAAM,yBAAyB,GAAG,OAAO,CAAC,IAAI,KAAK,CAAC;QAClD,CAAC,CAAC,WAAW;QACb,CAAC,CAAC,WAAW,CAAC,MAAM,CAAC,OAAO,CAAC,EAAE,CAAC,aAAa,CAAC,OAAO,EAAE,WAAW,EAAE,OAAO,CAAC,CAAC,CAAC;IAEhF,IAAI,gBAAgB,GAAG,QAAQ,EAAE,QAAQ,CAAC,MAAM,CAAC,GAAG,EAAE,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC;IACpE,IAAI,QAAQ,EAAE,OAAO,CAAC,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC;QACtC,MAAM,mBAAmB,GAAG,IAAI,GAAG,CACjC,QAAQ,CAAC,GAAG,CAAC,OAAO,CAAC,EAAE,CAAC,mBAAmB,CAAC,OAAO,EAAE,WAAW,CAAC,CAAC,CACnE,CAAC;QACF,gBAAgB,GAAG,QAAQ,CAAC,QAAQ,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE;YAClD,MAAM,WAAW,GAAG,KAAK,CAAC,WAAW,IAAI,KAAK,CAAC,IAAI,CAAC;YACpD,OAAO,CAAC,mBAAmB,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC;QAC/C,CAAC,CAAC,CAAC;IACL,CAAC;IAED,OAAO;QACL,WAAW;QACX,yBAAyB;QACzB,gBAAgB;QAChB,gBAAgB;QAChB,YAAY,EAAE,CAAC,GAAG,OAAO,CAAC;KAC3B,CAAC;AACJ,CAAC"}

package/dist/delivery/evidence.d.ts

@@ -0,0 +1,11 @@
+import type { EvidencePackage, GuardResult } from './types.js';
+export declare function hashEvidencePayload(value: unknown): string;
+/**
+ * Create a machine-readable evidence package without embedding source context
+ * lines. This intentionally minimizes the risk of copying PHI or secrets into
+ * compliance artifacts while preserving rule, file, decision, and provenance.
+ */
+export declare function buildEvidencePackage(projectPath: string, guard: GuardResult): EvidencePackage;
+export declare function saveEvidencePackage(path: string, evidence: EvidencePackage): Promise<void>;
+export declare function verifyEvidencePackage(evidence: EvidencePackage): boolean;
+//# sourceMappingURL=evidence.d.ts.map

package/dist/delivery/evidence.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"evidence.d.ts","sourceRoot":"","sources":["../../src/delivery/evidence.ts"],"names":[],"mappings":"AASA,OAAO,KAAK,EAAmB,eAAe,EAAE,WAAW,EAAE,MAAM,YAAY,CAAC;AAehF,wBAAgB,mBAAmB,CAAC,KAAK,EAAE,OAAO,GAAG,MAAM,CAG1D;AAED;;;;GAIG;AACH,wBAAgB,oBAAoB,CAClC,WAAW,EAAE,MAAM,EACnB,KAAK,EAAE,WAAW,GACjB,eAAe,CAuDjB;AAED,wBAAsB,mBAAmB,CAAC,IAAI,EAAE,MAAM,EAAE,QAAQ,EAAE,eAAe,GAAG,OAAO,CAAC,IAAI,CAAC,CAEhG;AAED,wBAAgB,qBAAqB,CAAC,QAAQ,EAAE,eAAe,GAAG,OAAO,CAGxE"}