@flow-scanner/lightning-flow-scanner-core 6.0.3

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (128) hide show
  1. package/CONTRIBUTING.md +30 -0
  2. package/LICENSE.md +21 -0
  3. package/README.md +314 -0
  4. package/SECURITY.md +26 -0
  5. package/assets/media/bannerslim.png +0 -0
  6. package/index.d.ts +21 -0
  7. package/index.js +83 -0
  8. package/main/interfaces/AdvancedRuleConfig.d.ts +11 -0
  9. package/main/interfaces/AdvancedRuleConfig.js +4 -0
  10. package/main/interfaces/AdvancedRuleDefintion.d.ts +5 -0
  11. package/main/interfaces/AdvancedRuleDefintion.js +4 -0
  12. package/main/interfaces/AdvancedSuppression.d.ts +21 -0
  13. package/main/interfaces/AdvancedSuppression.js +4 -0
  14. package/main/interfaces/AutoFixable.d.ts +10 -0
  15. package/main/interfaces/AutoFixable.js +4 -0
  16. package/main/interfaces/IExceptions.d.ts +5 -0
  17. package/main/interfaces/IExceptions.js +4 -0
  18. package/main/interfaces/IRuleConfig.d.ts +3 -0
  19. package/main/interfaces/IRuleConfig.js +4 -0
  20. package/main/interfaces/IRuleDefinition.d.ts +17 -0
  21. package/main/interfaces/IRuleDefinition.js +4 -0
  22. package/main/interfaces/IRuleOptions.d.ts +4 -0
  23. package/main/interfaces/IRuleOptions.js +4 -0
  24. package/main/interfaces/IRulesConfig.d.ts +8 -0
  25. package/main/interfaces/IRulesConfig.js +4 -0
  26. package/main/internals/internals.d.ts +17 -0
  27. package/main/internals/internals.js +64 -0
  28. package/main/libs/BuildFlow.d.ts +1 -0
  29. package/main/libs/BuildFlow.js +20 -0
  30. package/main/libs/Compiler.d.ts +8 -0
  31. package/main/libs/Compiler.js +70 -0
  32. package/main/libs/ConvertFlowNodes.d.ts +1 -0
  33. package/main/libs/ConvertFlowNodes.js +14 -0
  34. package/main/libs/DynamicRule.d.ts +5 -0
  35. package/main/libs/DynamicRule.js +19 -0
  36. package/main/libs/FixFlows.d.ts +3 -0
  37. package/main/libs/FixFlows.js +110 -0
  38. package/main/libs/GetRuleDefinitions.d.ts +5 -0
  39. package/main/libs/GetRuleDefinitions.js +81 -0
  40. package/main/libs/ParseFlows.d.ts +2 -0
  41. package/main/libs/ParseFlows.js +111 -0
  42. package/main/libs/Scan2.d.ts +3 -0
  43. package/main/libs/Scan2.js +124 -0
  44. package/main/libs/ScanFlows.d.ts +4 -0
  45. package/main/libs/ScanFlows.js +103 -0
  46. package/main/models/AdvancedRule.d.ts +44 -0
  47. package/main/models/AdvancedRule.js +84 -0
  48. package/main/models/Flow.d.ts +33 -0
  49. package/main/models/Flow.js +277 -0
  50. package/main/models/FlowAttribute.d.ts +7 -0
  51. package/main/models/FlowAttribute.js +34 -0
  52. package/main/models/FlowElement.d.ts +10 -0
  53. package/main/models/FlowElement.js +37 -0
  54. package/main/models/FlowElementConnector.d.ts +15 -0
  55. package/main/models/FlowElementConnector.js +50 -0
  56. package/main/models/FlowMetadata.d.ts +4 -0
  57. package/main/models/FlowMetadata.js +16 -0
  58. package/main/models/FlowNode.d.ts +10 -0
  59. package/main/models/FlowNode.js +169 -0
  60. package/main/models/FlowResource.d.ts +5 -0
  61. package/main/models/FlowResource.js +30 -0
  62. package/main/models/FlowType.d.ts +23 -0
  63. package/main/models/FlowType.js +80 -0
  64. package/main/models/FlowVariable.d.ts +6 -0
  65. package/main/models/FlowVariable.js +31 -0
  66. package/main/models/LoopRuleCommon.d.ts +9 -0
  67. package/main/models/LoopRuleCommon.js +48 -0
  68. package/main/models/ParsedFlow.d.ts +7 -0
  69. package/main/models/ParsedFlow.js +35 -0
  70. package/main/models/ResultDetails.d.ts +10 -0
  71. package/main/models/ResultDetails.js +57 -0
  72. package/main/models/RuleCommon.d.ts +19 -0
  73. package/main/models/RuleCommon.js +48 -0
  74. package/main/models/RuleInfo.d.ts +55 -0
  75. package/main/models/RuleInfo.js +61 -0
  76. package/main/models/RuleResult.d.ts +11 -0
  77. package/main/models/RuleResult.js +44 -0
  78. package/main/models/ScanResult.d.ts +7 -0
  79. package/main/models/ScanResult.js +31 -0
  80. package/main/rules/APIVersion.d.ts +8 -0
  81. package/main/rules/APIVersion.js +86 -0
  82. package/main/rules/ActionCallsInLoop.d.ts +6 -0
  83. package/main/rules/ActionCallsInLoop.js +38 -0
  84. package/main/rules/AutoLayout.d.ts +8 -0
  85. package/main/rules/AutoLayout.js +78 -0
  86. package/main/rules/CopyAPIName.d.ts +6 -0
  87. package/main/rules/CopyAPIName.js +82 -0
  88. package/main/rules/CyclomaticComplexity.d.ts +10 -0
  89. package/main/rules/CyclomaticComplexity.js +111 -0
  90. package/main/rules/DMLStatementInLoop.d.ts +6 -0
  91. package/main/rules/DMLStatementInLoop.js +37 -0
  92. package/main/rules/DuplicateDMLOperation.d.ts +8 -0
  93. package/main/rules/DuplicateDMLOperation.js +153 -0
  94. package/main/rules/FlowDescription.d.ts +6 -0
  95. package/main/rules/FlowDescription.js +76 -0
  96. package/main/rules/FlowName.d.ts +7 -0
  97. package/main/rules/FlowName.js +80 -0
  98. package/main/rules/GetRecordAllFields.d.ts +6 -0
  99. package/main/rules/GetRecordAllFields.js +101 -0
  100. package/main/rules/HardcodedId.d.ts +6 -0
  101. package/main/rules/HardcodedId.js +87 -0
  102. package/main/rules/HardcodedUrl.d.ts +6 -0
  103. package/main/rules/HardcodedUrl.js +50 -0
  104. package/main/rules/InactiveFlow.d.ts +6 -0
  105. package/main/rules/InactiveFlow.js +73 -0
  106. package/main/rules/MissingFaultPath.d.ts +12 -0
  107. package/main/rules/MissingFaultPath.js +161 -0
  108. package/main/rules/MissingNullHandler.d.ts +6 -0
  109. package/main/rules/MissingNullHandler.js +152 -0
  110. package/main/rules/ProcessBuilder.d.ts +8 -0
  111. package/main/rules/ProcessBuilder.js +77 -0
  112. package/main/rules/RecursiveAfterUpdate.d.ts +7 -0
  113. package/main/rules/RecursiveAfterUpdate.js +124 -0
  114. package/main/rules/SOQLQueryInLoop.d.ts +6 -0
  115. package/main/rules/SOQLQueryInLoop.js +35 -0
  116. package/main/rules/SameRecordFieldUpdates.d.ts +7 -0
  117. package/main/rules/SameRecordFieldUpdates.js +111 -0
  118. package/main/rules/TriggerOrder.d.ts +7 -0
  119. package/main/rules/TriggerOrder.js +101 -0
  120. package/main/rules/UnconnectedElement.d.ts +7 -0
  121. package/main/rules/UnconnectedElement.js +93 -0
  122. package/main/rules/UnsafeRunningContext.d.ts +6 -0
  123. package/main/rules/UnsafeRunningContext.js +86 -0
  124. package/main/rules/UnusedVariable.d.ts +6 -0
  125. package/main/rules/UnusedVariable.js +100 -0
  126. package/main/store/DefaultRuleStore.d.ts +2 -0
  127. package/main/store/DefaultRuleStore.js +68 -0
  128. package/package.json +88 -0
@@ -0,0 +1,30 @@
1
+ ## Contributing Guidelines
2
+
3
+ Since 2021, the _Lightning Flow Scanner_ has grown from its roots as VS Code tool to empower Salesforce Developers across six free and open-source platforms—from developer tools to native Salesforce App—delivering a unified experience for robust static analysis of Flows. Our dedicated community has shared their expertise to deepen understanding of Flow optimization. Your support can amplify our impact. Here’s how you can contribute:
4
+
5
+ - ⭐ Starring the project to show your support
6
+ - 📢 Sharing our work with your network
7
+ - 💬 Sharing feedback to help us improve
8
+ - 💻 Contributing code to drive innovation
9
+
10
+ ### I have a Question/Feedback
11
+
12
+ For general questions, ideas, or seeking input on topics that might (or might not) turn into issues, we recommend to use our [Discussions](https://github.com/orgs/Flow-Scanner/discussions) forum. This is best for open-ended conversations, brainstorming, and gathering community input before creating a feature request.
13
+
14
+ If it's more specific like a bug or a new feature—use [GitHub Issues](https://github.com/features/issues) instead. Before creating a new issue, please take a moment to search the existing [Issues](/issues) to prevent duplicates. If you find something relevant, adding an upvote helps us understand demand and prioritize better. We've prepared a few templates to guide you through the process of issue reporting:
15
+
16
+ ###### Core Engine - For issues or requests related to the core functionality of the scanner, use the following links to submit your request:
17
+
18
+ - [Report Issue](https://github.com/Flow-Scanner/lightning-flow-scanner-core/issues/new?template=bug_report.md): Report a bug or issue.
19
+ - [Rule Request](https://github.com/Flow-Scanner/lightning-flow-scanner-core/issues/new?template=rule-request.md): Submit a request for a new rule.
20
+ - [Features/Other](https://github.com/Flow-Scanner/lightning-flow-scanner-core/issues/new): Suggest a new feature.
21
+
22
+ ###### Platforms - For issues or requests related to specific platforms, use the appropriate link below:
23
+
24
+ - [CLI Plugin](https://github.com/Flow-Scanner/lightning-flow-scanner-cli/issues/new)
25
+ - [Copado Plugin](https://github.com/Flow-Scanner/lightning-flow-scanner-copado/issues/new)
26
+ - [GitHub Action](https://github.com/Flow-Scanner/lightning-flow-scanner-action/issues/new)
27
+ - [Salesforce App](https://github.com/Flow-Scanner/lightning-flow-scanner-app/issues/new)
28
+ - [VS Code/Code Builder](https://github.com/Flow-Scanner/lightning-flow-scanner-vsx/issues/new)
29
+
30
+ ###### Thank you
package/LICENSE.md ADDED
@@ -0,0 +1,21 @@
1
+ MIT License
2
+
3
+ Copyright (c) 2025 Ruben Halman, Jun Jose and others
4
+
5
+ Permission is hereby granted, free of charge, to any person obtaining a copy
6
+ of this software and associated documentation files (the "Software"), to deal
7
+ in the Software without restriction, including without limitation the rights
8
+ to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
9
+ copies of the Software, and to permit persons to whom the Software is
10
+ furnished to do so, subject to the following conditions:
11
+
12
+ The above copyright notice and this permission notice shall be included in all
13
+ copies or substantial portions of the Software.
14
+
15
+ THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
16
+ IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
17
+ FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
18
+ AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
19
+ LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
20
+ OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
21
+ SOFTWARE.
package/README.md ADDED
@@ -0,0 +1,314 @@
1
+ <p align="center">
2
+ <a href="https://github.com/Flow-Scanner">
3
+ <img src="assets/media/bannerslim.png" style="width: 43%;" />
4
+ </a>
5
+ </p>
6
+
7
+ <p align="center"><i>A plug-and-play engine for Flow metadata in Node.js & browsers—with 20+ rules to catch unsafe contexts, loop queries, hardcoded IDs, and more.</i></p>
8
+
9
+ - [Default Rules](#default-rules)
10
+ - [Configuration](#configuration)
11
+ - [Defining Severity Levels](#defining-severity-levels)
12
+ - [Configuring Expressions](#configuring-expressions)
13
+ - [Specifying Exceptions](#specifying-exceptions)
14
+ - [Include Beta Rules](#include-beta-rules)
15
+ - [Usage](#Usage)
16
+ - [Installation](#installation)
17
+ - [Core Functions](#core-functions)
18
+ - [Development](#development)
19
+
20
+ ---
21
+
22
+ ## Default Rules
23
+
24
+ <p>📌 <strong>Tip:</strong> To link directly to a specific rule, use the full GitHub anchor link format. Example:</p>
25
+ <p><em><a href="https://github.com/Flow-Scanner/lightning-flow-scanner-core#unsafe-running-context">https://github.com/Flow-Scanner/lightning-flow-scanner-core#unsafe-running-context</a></em></i></p>
26
+
27
+ ### Action Calls In Loop
28
+
29
+ _[ActionCallsInLoop](https://github.com/Flow-Scanner/lightning-flow-scanner-core/tree/main/src/main/rules/ActionCallsInLoop.ts)_ - To prevent exceeding Apex governor limits, it is advisable to consolidate and bulkify your apex calls, utilizing a single action call containing a collection variable at the end of the loop.
30
+
31
+ ### Outdated API Version
32
+
33
+ _[APIVersion](https://github.com/Flow-Scanner/lightning-flow-scanner-core/tree/main/src/main/rules/APIVersion.ts)_ - Introducing newer API components may lead to unexpected issues with older versions of Flows, as they might not align with the underlying mechanics. Starting from API version 50.0, the **Api Version** attribute has been readily available on the Flow Object. To ensure smooth operation and reduce discrepancies between API versions, it is strongly advised to regularly update and maintain them.
34
+
35
+ ### Auto Layout
36
+
37
+ _[AutoLayout](https://github.com/Flow-Scanner/lightning-flow-scanner-core/tree/main/src/main/rules/AutoLayout.ts)_ - With Canvas Mode set to Auto‑Layout, elements are spaced, connected, and aligned automatically, keeping your Flow neatly organized—saving you time.
38
+
39
+ ### Copy API Name
40
+
41
+ _[CopyAPIName](https://github.com/Flow-Scanner/lightning-flow-scanner-core/tree/main/src/main/rules/CopyAPIName.ts)_ - Maintaining multiple elements with a similar name, like `Copy_X_Of_Element`, can diminish the overall readability of your Flow. When copying and pasting these elements, remember to update the API name of the newly created copy.
42
+
43
+ ### Cyclomatic Complexity
44
+
45
+ _[CyclomaticComplexity](https://github.com/Flow-Scanner/lightning-flow-scanner-core/tree/main/src/main/rules/CyclomaticComplexity.ts)_ - The number of loops and decision rules, plus the number of decisions. Use a combination of 1) subflows and 2) breaking flows into multiple concise trigger‑ordered flows to reduce cyclomatic complexity within a single flow, ensuring maintainability and simplicity.
46
+
47
+ ### DML Statement In A Loop
48
+
49
+ _[DMLStatementInLoop](https://github.com/Flow-Scanner/lightning-flow-scanner-core/tree/main/src/main/rules/DMLStatementInLoop.ts)_ - To prevent exceeding Apex governor limits, consolidate all your database operations—record creation, updates, or deletions—at the conclusion of the flow.
50
+
51
+ ### Duplicate DML Operation
52
+
53
+ _[DuplicateDMLOperation](https://github.com/Flow-Scanner/lightning-flow-scanner-core/tree/main/src/main/rules/DuplicateDMLOperation.ts)_ - When a flow executes database changes or actions between two screens, prevent users from navigating backward between screens; otherwise, duplicate database operations may be performed.
54
+
55
+ ### Flow Naming Convention
56
+
57
+ _[FlowName](https://github.com/Flow-Scanner/lightning-flow-scanner-core/tree/main/src/main/rules/FlowName.ts)_ - The readability of a flow is paramount. Establishing a naming convention significantly enhances findability, searchability, and overall consistency. Include at least a domain and a brief description of the flow’s actions, for example `Service_OrderFulfillment`.
58
+
59
+ ### Get Record All Fields
60
+
61
+ _[GetRecordAllFields](https://github.com/Flow-Scanner/lightning-flow-scanner-core/tree/main/src/main/rules/GetRecordAllFields.ts)_ - Following the principle of least privilege (PoLP), avoid using **Get Records** with “Automatically store all fields” unless necessary.
62
+
63
+ ### Hardcoded Id
64
+
65
+ _[HardcodedId](https://github.com/Flow-Scanner/lightning-flow-scanner-core/tree/main/src/main/rules/HardcodedId.ts)_ - Avoid hard‑coding IDs because they are org specific. Instead, pass them into variables at the start of the flow—via merge‑field URL parameters or a **Get Records** element.
66
+
67
+ ### Hardcoded Url
68
+
69
+ _[HardcodedUrl](https://github.com/Flow-Scanner/lightning-flow-scanner-core/tree/main/src/main/rules/HardcodedUrl.ts)_ - Avoid hard‑coding URLs because they are environment specific. Use an `$API` formula (preferred) or environment‑specific sources like custom labels, metadata, or settings.
70
+
71
+ ### Inactive Flow
72
+
73
+ _[InactiveFlow](https://github.com/Flow-Scanner/lightning-flow-scanner-core/tree/main/src/main/rules/InactiveFlow.ts)_ - Like cleaning out your closet: deleting unused flows is essential. Inactive flows can still cause trouble—such as accidentally deleting records during testing, or being activated as subflows.
74
+
75
+ ### Missing Fault Path
76
+
77
+ _[MissingFaultPath](https://github.com/Flow-Scanner/lightning-flow-scanner-core/tree/main/src/main/rules/MissingFaultPath.ts)_ - A flow may fail to execute an operation as intended. By default, the flow displays an error to the user and emails the creator. Customize this behavior by incorporating a Fault Path.
78
+
79
+ ### Missing Flow Description
80
+
81
+ _[FlowDescription](https://github.com/Flow-Scanner/lightning-flow-scanner-core/tree/main/src/main/rules/FlowDescription.ts)_ - Descriptions play a vital role in documentation. We highly recommend including details about where flows are used and their intended purpose.
82
+
83
+ ### Missing Null Handler
84
+
85
+ _[MissingNullHandler](https://github.com/Flow-Scanner/lightning-flow-scanner-core/tree/main/src/main/rules/MissingNullHandler.ts)_ - When a **Get Records** operation finds no data, it returns `null`. Validate data by using a Decision element to check for a non‑null result.
86
+
87
+ ### Process Builder
88
+
89
+ _[ProcessBuilder](https://github.com/Flow-Scanner/lightning-flow-scanner-core/tree/main/src/main/rules/ProcessBuilder.ts)_ - Salesforce is transitioning away from Workflow Rules and Process Builder in favor of Flow. Begin migrating your organization’s automation to Flow.
90
+
91
+ ### Recursive After Update
92
+
93
+ _[RecursiveAfterUpdate](https://github.com/Flow-Scanner/lightning-flow-scanner-core/tree/main/src/main/rules/RecursiveAfterUpdate.ts)_ - After‑update flows are meant for modifying **other** records. Using them on the same record can cause recursion. Consider **before‑save** flows for same‑record updates.
94
+
95
+ ### Same Record Field Updates
96
+
97
+ _[SameRecordFieldUpdates](https://github.com/Flow-Scanner/lightning-flow-scanner-core/tree/main/src/main/rules/SameRecordFieldUpdates.ts)_ - Similar to triggers, **before‑save** contexts can update the same record via `$Record` without invoking DML.
98
+
99
+ ### SOQL Query In A Loop
100
+
101
+ _[SOQLQueryInLoop](https://github.com/Flow-Scanner/lightning-flow-scanner-core/tree/main/src/main/rules/SOQLQueryInLoop.ts)_ - To prevent exceeding Apex governor limits, consolidate all SOQL queries at the end of the flow.
102
+
103
+ ### Trigger Order
104
+
105
+ _[TriggerOrder](https://github.com/Flow-Scanner/lightning-flow-scanner-core/tree/main/src/main/rules/TriggerOrder.ts)_ - Guarantee your flow execution order with the **Trigger Order** property introduced in Spring ’22.
106
+
107
+ ### Unconnected Element
108
+
109
+ _[UnconnectedElement](https://github.com/Flow-Scanner/lightning-flow-scanner-core/tree/main/src/main/rules/UnconnectedElement.ts)_ - Avoid unconnected elements that are not used by the flow to keep flows efficient and maintainable.
110
+
111
+ ### Unsafe Running Context
112
+
113
+ _[UnsafeRunningContext](https://github.com/Flow-Scanner/lightning-flow-scanner-core/tree/main/src/main/rules/UnsafeRunningContext.ts)_ - This flow is configured to run in **System Mode without Sharing**, granting all users permission to view and edit all data. This can lead to unsafe data access.
114
+
115
+ ### Unused Variable
116
+
117
+ _[UnusedVariable](https://github.com/Flow-Scanner/lightning-flow-scanner-core/tree/main/src/main/rules/UnusedVariable.ts)_ - To maintain efficiency and manageability, avoid including variables that are never referenced.
118
+
119
+ ---
120
+
121
+ ## Configuration
122
+
123
+ It is recommended to set up configuration and define:
124
+
125
+ - The rules to be executed.
126
+ - The severity of violating any specific rule.
127
+ - Rule properties such as REGEX expressions.
128
+ - Any known exceptions that should be ignored during scanning.
129
+
130
+ ```json
131
+ {
132
+ "rules": {
133
+ // Your rules here
134
+ },
135
+ "exceptions": {
136
+ // Your exceptions here
137
+ }
138
+ }
139
+ ```
140
+
141
+ Using the rules section of your configurations, you can specify the list of rules to be run. Furthermore, you can define the severity and configure expressions of rules. To include rules currently that are currently in beta, set `betarules` to true. Below is a breakdown of the available attributes of rule configuration:
142
+
143
+ ```json
144
+ {
145
+ "rules": {
146
+ "<RuleName>": {
147
+ "severity": "<Severity>",
148
+ "expression": "<Expression>"
149
+ }
150
+ }
151
+ }
152
+ ```
153
+
154
+ ### Defining Severity Levels
155
+
156
+ When the severity is not provided it will be `warning` by default. Other available values for severity are `error` and `note`. Define the severity per rule as shown below:
157
+
158
+ ```json
159
+ {
160
+ "rules": {
161
+ "FlowDescription": {
162
+ "severity": "error"
163
+ },
164
+ "UnusedVariable": {
165
+ "severity": "note"
166
+ }
167
+ }
168
+ }
169
+ ```
170
+
171
+ ### Configuring Expressions
172
+
173
+ Some rules have additional attributes to configure, such as the expression, that will overwrite default values. These can be configured in the same way as severity as shown in the following example.
174
+
175
+ ```json
176
+ {
177
+ "rules": {
178
+ "APIVersion": {
179
+ "severity": "error",
180
+ "expression": "===58"
181
+ },
182
+ "FlowName": {
183
+ "severity": "note",
184
+ "expression": "[A-Za-z0-9]"
185
+ }
186
+ }
187
+ }
188
+ ```
189
+
190
+ ### Specifying Exceptions
191
+
192
+ Specifying exceptions allows you to exclude specific scenarios from rule enforcement. Exceptions can be specified at the flow, rule, or result level to provide fine-grained control. Below is a breakdown of the available attributes of exception configuration:
193
+
194
+ ```json
195
+ {
196
+ "exceptions": {
197
+ "<FlowName>": {
198
+ "<RuleName>": [
199
+ "<ResultName>",
200
+ "<ResultName>",
201
+ ...
202
+ ]
203
+ },
204
+ ...
205
+ }
206
+ }
207
+ ```
208
+
209
+ ### Include Beta Rules
210
+
211
+ New rules are introduced in Beta mode before being added to the default ruleset. To include current Beta rules, enable the optional betamode parameter in your configuration:
212
+
213
+ ```json
214
+ {
215
+ "rules": {
216
+ ...
217
+ },
218
+ "exceptions": {
219
+ ...
220
+ },
221
+ "betamode": true
222
+ }
223
+ ```
224
+
225
+ ---
226
+
227
+ ## Usage
228
+
229
+ ### Installation
230
+
231
+ The Lightning Flow Scanner Core can be used as a dependency in Node.js and browser environments, or used as a standalone UMD module. To install:
232
+
233
+ ```bash
234
+ npm install @flow-scanner/lightning-flow-scanner-core
235
+ ```
236
+
237
+ ### Core Functions
238
+
239
+ #### [`getRules(ruleNames?: string[]): IRuleDefinition[]`](https://github.com/Flow-Scanner/lightning-flow-scanner-core/tree/main/src/main/libs/GetRuleDefinitions.ts)
240
+
241
+ _Retrieves rule definitions used in the scanner._
242
+
243
+ #### [`parse(selectedUris: any): Promise<ParsedFlow[]>`](https://github.com/Flow-Scanner/lightning-flow-scanner-core/tree/main/src/main/libs/ParseFlows.ts)
244
+
245
+ _Parses metadata from selected Flow files._
246
+
247
+ #### [`scan(parsedFlows: ParsedFlow[], ruleOptions?: IRulesConfig): ScanResult[]`](https://github.com/Flow-Scanner/lightning-flow-scanner-core/tree/main/src/main/libs/ScanFlows.ts)
248
+
249
+ _Runs rules against parsed flows and returns scan results._
250
+
251
+ #### [`fix(results: ScanResult[]): ScanResult[]`](https://github.com/Flow-Scanner/lightning-flow-scanner-core/tree/main/src/main/libs/FixFlows.ts)
252
+
253
+ _Attempts to apply automatic fixes where available._
254
+
255
+ ---
256
+
257
+ ## Development
258
+
259
+ > This project optionally uses [Volta](https://volta.sh) to manage Node.js versions. Install Volta with:
260
+ >
261
+ > ```sh
262
+ > curl https://get.volta.sh | bash
263
+ > ```
264
+ >
265
+ > Volta will automatically use the Node.js version defined in `package.json`.
266
+
267
+ 1. Clone the repo:
268
+
269
+ ```bash
270
+ git clone https://github.com/Flow-Scanner/lightning-flow-scanner-core.git
271
+ ```
272
+
273
+ 2. Install dependencies:
274
+
275
+ ```bash
276
+ npm install
277
+ ```
278
+
279
+ 3. Build the project:
280
+
281
+ ```bash
282
+ npm run build
283
+ ```
284
+
285
+ 4. Run tests:
286
+
287
+ ```bash
288
+ npm run test
289
+ ```
290
+
291
+ 5. Test as local dependency(Optional):
292
+ To test changes to the core module in the VS Code extension or SF CLI plugin locally, run:
293
+
294
+ ```bash
295
+ npm run link
296
+ ```
297
+
298
+ b) Go to the dependent project (VSX or SF CLI) and use:
299
+
300
+ ```bash
301
+ npm link @flow-scanner/lightning-flow-scanner-core
302
+ ```
303
+
304
+ Your local core module will now replace the installed dependency and update automatically on rebuild.
305
+
306
+ 6. Create a standalone UMD Module(Optional):
307
+
308
+ ```bash
309
+ npm run vite:dist
310
+ ```
311
+
312
+ The resulting file will be available in the `dist` directory as `lightning-flow-scanner-core.umd.js`.
313
+
314
+ ###### Want to help improve Lightning Flow Scanner? See our [Contributing Guidelines](https://github.com/Flow-Scanner/lightning-flow-scanner-core/blob/main/CONTRIBUTING.md).
package/SECURITY.md ADDED
@@ -0,0 +1,26 @@
1
+ # Security Policy for Lightning Flow Scanner
2
+
3
+ ## Security Practices
4
+
5
+ - Code is open-source and peer-reviewed by the community.
6
+ - Vulnerabilities can be reported privately via GitHub security features.
7
+ - Changes to the repository are scanned and reviewed before merging.
8
+ - Tokenless Publishing with scoped npm packages and releases via GitHub Actions Trusted Publishing (OIDC).
9
+
10
+ ## Reporting a Vulnerability
11
+
12
+ If you discover a security vulnerability, please report it using [GitHub vulnerability reporting](https://github.com/Flow-Scanner/lightning-flow-scanner-core/security).
13
+
14
+ ## Data Handling
15
+
16
+ This tool collects zero user data. No credentials, PII, payment info, health data, or user content is ever stored, transmitted, or shared. All analysis runs 100% client-side with no network calls to external services.
17
+
18
+ We temporarily use metadata (e.g., Flow metadata, timestamps) in-memory only for real-time functionality during your session. This data is never stored, logged, or transmitted and is discarded immediately when the session ends.
19
+
20
+ ## Dependencies
21
+
22
+ We actively track and maintain an up-to-date inventory of all third-party dependencies to ensure security and compatibility. Our dependencies include:
23
+
24
+ | Package | License | Purpose |
25
+ | ----------------- | --------------------------------------------------------------------------------- | ---------------------------------------------- |
26
+ | `fast-xml-parser` | [MIT](https://github.com/NaturalIntelligence/fast-xml-parser/blob/master/LICENSE) | Validate XML, Parse XML and Build XML rapidly. |
Binary file
package/index.d.ts ADDED
@@ -0,0 +1,21 @@
1
+ import type { IRuleDefinition } from "./main/interfaces/IRuleDefinition";
2
+ import type { IRulesConfig } from "./main/interfaces/IRulesConfig";
3
+ import { Compiler } from "./main/libs/Compiler";
4
+ import { fix } from "./main/libs/FixFlows";
5
+ import { getBetaRules, getRules } from "./main/libs/GetRuleDefinitions";
6
+ import { parse } from "./main/libs/ParseFlows";
7
+ import { scan } from "./main/libs/ScanFlows";
8
+ import { AdvancedRule } from "./main/models/AdvancedRule";
9
+ import { Flow } from "./main/models/Flow";
10
+ import { FlowAttribute } from "./main/models/FlowAttribute";
11
+ import { FlowElement } from "./main/models/FlowElement";
12
+ import { FlowNode } from "./main/models/FlowNode";
13
+ import { FlowResource } from "./main/models/FlowResource";
14
+ import { FlowType } from "./main/models/FlowType";
15
+ import { FlowVariable } from "./main/models/FlowVariable";
16
+ import { ParsedFlow } from "./main/models/ParsedFlow";
17
+ import { ResultDetails } from "./main/models/ResultDetails";
18
+ import { RuleResult } from "./main/models/RuleResult";
19
+ import { ScanResult } from "./main/models/ScanResult";
20
+ export { AdvancedRule, Compiler, fix, Flow, FlowAttribute, FlowElement, FlowNode, FlowResource, FlowType, FlowVariable, getBetaRules, getRules, parse, ParsedFlow, ResultDetails, RuleResult, scan, ScanResult, };
21
+ export type { IRuleDefinition, IRulesConfig };
package/index.js ADDED
@@ -0,0 +1,83 @@
1
+ "use strict";
2
+ Object.defineProperty(exports, "__esModule", {
3
+ value: true
4
+ });
5
+ function _export(target, all) {
6
+ for(var name in all)Object.defineProperty(target, name, {
7
+ enumerable: true,
8
+ get: Object.getOwnPropertyDescriptor(all, name).get
9
+ });
10
+ }
11
+ _export(exports, {
12
+ get AdvancedRule () {
13
+ return _AdvancedRule.AdvancedRule;
14
+ },
15
+ get Compiler () {
16
+ return _Compiler.Compiler;
17
+ },
18
+ get Flow () {
19
+ return _Flow.Flow;
20
+ },
21
+ get FlowAttribute () {
22
+ return _FlowAttribute.FlowAttribute;
23
+ },
24
+ get FlowElement () {
25
+ return _FlowElement.FlowElement;
26
+ },
27
+ get FlowNode () {
28
+ return _FlowNode.FlowNode;
29
+ },
30
+ get FlowResource () {
31
+ return _FlowResource.FlowResource;
32
+ },
33
+ get FlowType () {
34
+ return _FlowType.FlowType;
35
+ },
36
+ get FlowVariable () {
37
+ return _FlowVariable.FlowVariable;
38
+ },
39
+ get ParsedFlow () {
40
+ return _ParsedFlow.ParsedFlow;
41
+ },
42
+ get ResultDetails () {
43
+ return _ResultDetails.ResultDetails;
44
+ },
45
+ get RuleResult () {
46
+ return _RuleResult.RuleResult;
47
+ },
48
+ get ScanResult () {
49
+ return _ScanResult.ScanResult;
50
+ },
51
+ get fix () {
52
+ return _FixFlows.fix;
53
+ },
54
+ get getBetaRules () {
55
+ return _GetRuleDefinitions.getBetaRules;
56
+ },
57
+ get getRules () {
58
+ return _GetRuleDefinitions.getRules;
59
+ },
60
+ get parse () {
61
+ return _ParseFlows.parse;
62
+ },
63
+ get scan () {
64
+ return _ScanFlows.scan;
65
+ }
66
+ });
67
+ const _Compiler = require("./main/libs/Compiler");
68
+ const _FixFlows = require("./main/libs/FixFlows");
69
+ const _GetRuleDefinitions = require("./main/libs/GetRuleDefinitions");
70
+ const _ParseFlows = require("./main/libs/ParseFlows");
71
+ const _ScanFlows = require("./main/libs/ScanFlows");
72
+ const _AdvancedRule = require("./main/models/AdvancedRule");
73
+ const _Flow = require("./main/models/Flow");
74
+ const _FlowAttribute = require("./main/models/FlowAttribute");
75
+ const _FlowElement = require("./main/models/FlowElement");
76
+ const _FlowNode = require("./main/models/FlowNode");
77
+ const _FlowResource = require("./main/models/FlowResource");
78
+ const _FlowType = require("./main/models/FlowType");
79
+ const _FlowVariable = require("./main/models/FlowVariable");
80
+ const _ParsedFlow = require("./main/models/ParsedFlow");
81
+ const _ResultDetails = require("./main/models/ResultDetails");
82
+ const _RuleResult = require("./main/models/RuleResult");
83
+ const _ScanResult = require("./main/models/ScanResult");
@@ -0,0 +1,11 @@
1
+ export type AdvancedConfig = {
2
+ disabled?: boolean;
3
+ expression?: {
4
+ [key: string]: number | string;
5
+ };
6
+ severity?: string;
7
+ suppressions?: string[];
8
+ };
9
+ export type AdvancedRuleConfig = {
10
+ [ruleName: string]: AdvancedConfig;
11
+ };
@@ -0,0 +1,4 @@
1
+ "use strict";
2
+ Object.defineProperty(exports, "__esModule", {
3
+ value: true
4
+ });
@@ -0,0 +1,5 @@
1
+ import { Flow, RuleResult } from "../internals/internals";
2
+ import { AdvancedConfig } from "./AdvancedRuleConfig";
3
+ export interface AdvancedRuleDefinition {
4
+ execute2(flow: Flow, ruleConfiguration?: AdvancedConfig, userFlowSuppressions?: string[]): RuleResult;
5
+ }
@@ -0,0 +1,4 @@
1
+ "use strict";
2
+ Object.defineProperty(exports, "__esModule", {
3
+ value: true
4
+ });
@@ -0,0 +1,21 @@
1
+ import { RuleResult } from "../models/RuleResult";
2
+ import { AdvancedConfig } from "./AdvancedRuleConfig";
3
+ /**
4
+ * Interface for implementing advanced suppression logic on rule scan results.
5
+ *
6
+ * @remarks
7
+ * This interface defines a contract for classes or objects that provide suppression capabilities
8
+ * for rule results, potentially modifying or filtering the results based on custom logic and optional configuration.
9
+ *
10
+ * @interface
11
+ */
12
+ export interface AdvancedSuppression {
13
+ /**
14
+ * Suppresses or modifies a given rule scan result based on advanced configuration.
15
+ *
16
+ * @param scanResult - The result of a rule scan to be potentially suppressed or altered.
17
+ * @param ruleConfiguration - Optional advanced configuration that may influence suppression logic.
18
+ * @returns The (potentially) suppressed or modified rule result.
19
+ */
20
+ suppress(scanResult: RuleResult, ruleConfiguration?: AdvancedConfig): RuleResult;
21
+ }
@@ -0,0 +1,4 @@
1
+ "use strict";
2
+ Object.defineProperty(exports, "__esModule", {
3
+ value: true
4
+ });
@@ -0,0 +1,10 @@
1
+ import { Flow } from "../internals/internals";
2
+ /**
3
+ * Interface representing an entity capable of automatically fixing a Flow.
4
+ *
5
+ * Implementations of this interface provide a `fix` method that takes a {@link Flow}
6
+ * object as input and returns a new or modified {@link Flow} with applied fixes.
7
+ */
8
+ export interface AutoFixable {
9
+ fix(flow: Flow): Flow;
10
+ }
@@ -0,0 +1,4 @@
1
+ "use strict";
2
+ Object.defineProperty(exports, "__esModule", {
3
+ value: true
4
+ });
@@ -0,0 +1,5 @@
1
+ export interface IExceptions {
2
+ [exceptionName: string]: {
3
+ [property: string]: any[];
4
+ };
5
+ }
@@ -0,0 +1,4 @@
1
+ "use strict";
2
+ Object.defineProperty(exports, "__esModule", {
3
+ value: true
4
+ });
@@ -0,0 +1,3 @@
1
+ export interface IRuleConfig {
2
+ severity?: string;
3
+ }
@@ -0,0 +1,4 @@
1
+ "use strict";
2
+ Object.defineProperty(exports, "__esModule", {
3
+ value: true
4
+ });
@@ -0,0 +1,17 @@
1
+ import { Flow } from "../models/Flow";
2
+ import { RuleResult } from "../models/RuleResult";
3
+ export interface IRuleDefinition {
4
+ autoFixable: boolean;
5
+ description: string;
6
+ docRefs: Array<{
7
+ label: string;
8
+ path: string;
9
+ }>;
10
+ execute(flow: Flow, ruleOptions?: {}): RuleResult;
11
+ isConfigurable: boolean;
12
+ label: string;
13
+ name: string;
14
+ severity?: string;
15
+ supportedTypes: string[];
16
+ uri?: string;
17
+ }
@@ -0,0 +1,4 @@
1
+ "use strict";
2
+ Object.defineProperty(exports, "__esModule", {
3
+ value: true
4
+ });
@@ -0,0 +1,4 @@
1
+ import { IRuleConfig } from "./IRuleConfig";
2
+ export interface IRuleOptions {
3
+ [ruleName: string]: IRuleConfig;
4
+ }
@@ -0,0 +1,4 @@
1
+ "use strict";
2
+ Object.defineProperty(exports, "__esModule", {
3
+ value: true
4
+ });
@@ -0,0 +1,8 @@
1
+ import { AdvancedRuleConfig } from "./AdvancedRuleConfig";
2
+ import { IExceptions } from "./IExceptions";
3
+ import { IRuleOptions } from "./IRuleOptions";
4
+ export interface IRulesConfig {
5
+ betamode?: boolean;
6
+ exceptions?: IExceptions;
7
+ rules?: AdvancedRuleConfig | IRuleOptions;
8
+ }
@@ -0,0 +1,4 @@
1
+ "use strict";
2
+ Object.defineProperty(exports, "__esModule", {
3
+ value: true
4
+ });