"use strict";
/**
 * Baseline types — per-finding fingerprints carried in
 * `.dxkit-baseline.json` so the guardrail check can compare today's
 * scan against the recorded baseline.
 *
 * # Identity model
 *
 * dxkit does not treat a single hash as "the finding's stable
 * identity." Each finding has up to several fingerprint axes,
 * differentiated by what they capture:
 *
 *   - **Location fingerprint** — `(canonicalRule, file, lineWindow)`
 *     for code/secret/config/hygiene findings. Locates a finding
 *     in the source tree with ±2 line drift tolerance via bucket
 *     windowing. Stable across small reformat / whitespace edits;
 *     drifts on bigger shifts (closed by git-aware match).
 *   - **Domain fingerprint** — `(package, version, advisoryId)` for
 *     dep-vulns; `(package, version, licenseType)` for licenses;
 *     normalized block hash for jscpd. Captures *what the finding
 *     is about* independent of source position. Drift-immune.
 *   - **Semantic fingerprint** — `(file, symbol)` for coverage gaps
 *     when a symbol is known. Survives any vertical drift within
 *     the symbol body.
 *   - **Content fingerprint** — Sprint 0.x. Normalized snippet
 *     hash; fallback when git history is unreachable.
 *
 * The hash format is identical across axes — 16-char lowercase hex
 * (SHA-1[0:16]). Callers don't need to know which axis a hash came
 * from to use it for set-diff, but the matcher uses the axis
 * structure to layer different match strategies (domain first,
 * then git-aware location, then content fallback, then exact).
 *
 * The identity space mirrors the analyzer shapes that produce
 * findings. Each `IdentityInput` discriminant maps 1:1 to an existing
 * gather pipeline:
 *
 *   - `secret` / `code` / `config` — security analyzer's
 *     `SecurityFinding` (gitleaks, semgrep, TLS-bypass registry,
 *     private-key files, env-in-git).
 *   - `dep-vuln` — security analyzer's `DepVulnFinding` (osv-scanner,
 *     npm-audit, pip-audit, cargo-audit, etc.).
 *   - `duplication` — quality analyzer's `CloneGroup` (jscpd).
 *   - `coverage-gap` — coverage-gap report entries (file + symbol
 *     when available, fallback to file + line range).
 *   - `test-gap` — non-test source files flagged by the test-gaps
 *     analyzer.
 *   - `hygiene` — TODO / FIXME / HACK / console-log / any-type
 *     occurrences (per-occurrence identity).
 *
 * License attributions are NOT a baseline finding kind. They live in
 * the per-package BoM artifact (`.dxkit/bom.json`) — the canonical
 * license inventory carried by `vyuh-dxkit bom`. License findings
 * are informational, not regression material, and dominated the
 * baseline (~73% of entries on real customer repos) before being
 * lifted out.
 */
Object.defineProperty(exports, "__esModule", { value: true });
//# sourceMappingURL=types.js.map