@foldrun/core 1.1.3 → 1.3.0

package/LICENSE

@@ -1,202 +1,39 @@
+foldrun proprietary licence
 
-                                 Apache License
-                           Version 2.0, January 2004
-                        http://www.apache.org/licenses/
+Copyright (c) 2026 foldrun. All rights reserved.
 
-   TERMS AND CONDITIONS FOR USE, REPRODUCTION, AND DISTRIBUTION
+This software, its source code and its documentation are the property of
+foldrun. They are licensed, not sold.
 
-   1. Definitions.
+You may install and run the foldrun packages published to npm (`foldrun`
+and `@foldrun/core`) to write, check, run and deploy your own agents,
+flows and workspaces, on your own machines and with the foldrun platform.
+That includes the copies installing and running need, for your own use:
+package caches and mirrors, CI and build machines, container images and
+backups.
 
-      "License" shall mean the terms and conditions for use, reproduction,
-      and distribution as defined by Sections 1 through 9 of this document.
+You may not, except where the law allows it despite this restriction:
+copy, modify, merge, publish, distribute, sublicense, rent or sell the
+software or any part of it; reverse engineer, decompile or disassemble it;
+or use it to build a product or service that competes with foldrun.
 
-      "Licensor" shall mean the copyright owner or entity authorized by
-      the copyright owner that is granting the License.
+What you write with the software (your agents, flows, knowledge and other
+files) is yours.
 
-      "Legal Entity" shall mean the union of the acting entity and all
-      other entities that control, are controlled by, or are under common
-      control with that entity. For the purposes of this definition,
-      "control" means (i) the power, direct or indirect, to cause the
-      direction or management of such entity, whether by contract or
-      otherwise, or (ii) ownership of fifty percent (50%) or more of the
-      outstanding shares, or (iii) beneficial ownership of such entity.
+Third-party components the software includes or installs (its npm
+dependencies) remain under their own licences.
 
-      "You" (or "Your") shall mean an individual or Legal Entity
-      exercising permissions granted by this License.
+This licence ends automatically if you break its terms, and you must then
+stop using the software.
 
-      "Source" form shall mean the preferred form for making modifications,
-      including but not limited to software source code, documentation
-      source, and configuration files.
+Versions published before 17 October 2026 under the Apache License 2.0
+remain available under that licence for those versions only.
 
-      "Object" form shall mean any form resulting from mechanical
-      transformation or translation of a Source form, including but
-      not limited to compiled object code, generated documentation,
-      and conversions to other media types.
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. TO THE EXTENT THE
+LAW ALLOWS, IN NO EVENT SHALL FOLDRUN BE LIABLE FOR ANY CLAIM, DAMAGES OR
+OTHER LIABILITY ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR
+ITS USE.
 
-      "Work" shall mean the work of authorship, whether in Source or
-      Object form, made available under the License, as indicated by a
-      copyright notice that is included in or attached to the work
-      (an example is provided in the Appendix below).
-
-      "Derivative Works" shall mean any work, whether in Source or Object
-      form, that is based on (or derived from) the Work and for which the
-      editorial revisions, annotations, elaborations, or other modifications
-      represent, as a whole, an original work of authorship. For the purposes
-      of this License, Derivative Works shall not include works that remain
-      separable from, or merely link (or bind by name) to the interfaces of,
-      the Work and Derivative Works thereof.
-
-      "Contribution" shall mean any work of authorship, including
-      the original version of the Work and any modifications or additions
-      to that Work or Derivative Works thereof, that is intentionally
-      submitted to Licensor for inclusion in the Work by the copyright owner
-      or by an individual or Legal Entity authorized to submit on behalf of
-      the copyright owner. For the purposes of this definition, "submitted"
-      means any form of electronic, verbal, or written communication sent
-      to the Licensor or its representatives, including but not limited to
-      communication on electronic mailing lists, source code control systems,
-      and issue tracking systems that are managed by, or on behalf of, the
-      Licensor for the purpose of discussing and improving the Work, but
-      excluding communication that is conspicuously marked or otherwise
-      designated in writing by the copyright owner as "Not a Contribution."
-
-      "Contributor" shall mean Licensor and any individual or Legal Entity
-      on behalf of whom a Contribution has been received by Licensor and
-      subsequently incorporated within the Work.
-
-   2. Grant of Copyright License. Subject to the terms and conditions of
-      this License, each Contributor hereby grants to You a perpetual,
-      worldwide, non-exclusive, no-charge, royalty-free, irrevocable
-      copyright license to reproduce, prepare Derivative Works of,
-      publicly display, publicly perform, sublicense, and distribute the
-      Work and such Derivative Works in Source or Object form.
-
-   3. Grant of Patent License. Subject to the terms and conditions of
-      this License, each Contributor hereby grants to You a perpetual,
-      worldwide, non-exclusive, no-charge, royalty-free, irrevocable
-      (except as stated in this section) patent license to make, have made,
-      use, offer to sell, sell, import, and otherwise transfer the Work,
-      where such license applies only to those patent claims licensable
-      by such Contributor that are necessarily infringed by their
-      Contribution(s) alone or by combination of their Contribution(s)
-      with the Work to which such Contribution(s) was submitted. If You
-      institute patent litigation against any entity (including a
-      cross-claim or counterclaim in a lawsuit) alleging that the Work
-      or a Contribution incorporated within the Work constitutes direct
-      or contributory patent infringement, then any patent licenses
-      granted to You under this License for that Work shall terminate
-      as of the date such litigation is filed.
-
-   4. Redistribution. You may reproduce and distribute copies of the
-      Work or Derivative Works thereof in any medium, with or without
-      modifications, and in Source or Object form, provided that You
-      meet the following conditions:
-
-      (a) You must give any other recipients of the Work or
-          Derivative Works a copy of this License; and
-
-      (b) You must cause any modified files to carry prominent notices
-          stating that You changed the files; and
-
-      (c) You must retain, in the Source form of any Derivative Works
-          that You distribute, all copyright, patent, trademark, and
-          attribution notices from the Source form of the Work,
-          excluding those notices that do not pertain to any part of
-          the Derivative Works; and
-
-      (d) If the Work includes a "NOTICE" text file as part of its
-          distribution, then any Derivative Works that You distribute must
-          include a readable copy of the attribution notices contained
-          within such NOTICE file, excluding those notices that do not
-          pertain to any part of the Derivative Works, in at least one
-          of the following places: within a NOTICE text file distributed
-          as part of the Derivative Works; within the Source form or
-          documentation, if provided along with the Derivative Works; or,
-          within a display generated by the Derivative Works, if and
-          wherever such third-party notices normally appear. The contents
-          of the NOTICE file are for informational purposes only and
-          do not modify the License. You may add Your own attribution
-          notices within Derivative Works that You distribute, alongside
-          or as an addendum to the NOTICE text from the Work, provided
-          that such additional attribution notices cannot be construed
-          as modifying the License.
-
-      You may add Your own copyright statement to Your modifications and
-      may provide additional or different license terms and conditions
-      for use, reproduction, or distribution of Your modifications, or
-      for any such Derivative Works as a whole, provided Your use,
-      reproduction, and distribution of the Work otherwise complies with
-      the conditions stated in this License.
-
-   5. Submission of Contributions. Unless You explicitly state otherwise,
-      any Contribution intentionally submitted for inclusion in the Work
-      by You to the Licensor shall be under the terms and conditions of
-      this License, without any additional terms or conditions.
-      Notwithstanding the above, nothing herein shall supersede or modify
-      the terms of any separate license agreement you may have executed
-      with Licensor regarding such Contributions.
-
-   6. Trademarks. This License does not grant permission to use the trade
-      names, trademarks, service marks, or product names of the Licensor,
-      except as required for reasonable and customary use in describing the
-      origin of the Work and reproducing the content of the NOTICE file.
-
-   7. Disclaimer of Warranty. Unless required by applicable law or
-      agreed to in writing, Licensor provides the Work (and each
-      Contributor provides its Contributions) on an "AS IS" BASIS,
-      WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or
-      implied, including, without limitation, any warranties or conditions
-      of TITLE, NON-INFRINGEMENT, MERCHANTABILITY, or FITNESS FOR A
-      PARTICULAR PURPOSE. You are solely responsible for determining the
-      appropriateness of using or redistributing the Work and assume any
-      risks associated with Your exercise of permissions under this License.
-
-   8. Limitation of Liability. In no event and under no legal theory,
-      whether in tort (including negligence), contract, or otherwise,
-      unless required by applicable law (such as deliberate and grossly
-      negligent acts) or agreed to in writing, shall any Contributor be
-      liable to You for damages, including any direct, indirect, special,
-      incidental, or consequential damages of any character arising as a
-      result of this License or out of the use or inability to use the
-      Work (including but not limited to damages for loss of goodwill,
-      work stoppage, computer failure or malfunction, or any and all
-      other commercial damages or losses), even if such Contributor
-      has been advised of the possibility of such damages.
-
-   9. Accepting Warranty or Additional Liability. While redistributing
-      the Work or Derivative Works thereof, You may choose to offer,
-      and charge a fee for, acceptance of support, warranty, indemnity,
-      or other liability obligations and/or rights consistent with this
-      License. However, in accepting such obligations, You may act only
-      on Your own behalf and on Your sole responsibility, not on behalf
-      of any other Contributor, and only if You agree to indemnify,
-      defend, and hold each Contributor harmless for any liability
-      incurred by, or claims asserted against, such Contributor by reason
-      of your accepting any such warranty or additional liability.
-
-   END OF TERMS AND CONDITIONS
-
-   APPENDIX: How to apply the Apache License to your work.
-
-      To apply the Apache License to your work, attach the following
-      boilerplate notice, with the fields enclosed by brackets "[]"
-      replaced with your own identifying information. (Don't include
-      the brackets!)  The text should be enclosed in the appropriate
-      comment syntax for the file format. We also recommend that a
-      file or class name and description of purpose be included on the
-      same "printed page" as the copyright notice for easier
-      identification within third-party archives.
-
-   Copyright 2026 foldrun contributors
-
-   Licensed under the Apache License, Version 2.0 (the "License");
-   you may not use this file except in compliance with the License.
-   You may obtain a copy of the License at
-
-       http://www.apache.org/licenses/LICENSE-2.0
-
-   Unless required by applicable law or agreed to in writing, software
-   distributed under the License is distributed on an "AS IS" BASIS,
-   WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-   See the License for the specific language governing permissions and
-   limitations under the License.
+Questions: hello@foldrun.io

package/README.md

@@ -1,8 +1,6 @@
 # foldrun
 
-[![ci](https://github.com/foldrun-io/foldrun-core/actions/workflows/ci.yml/badge.svg)](https://github.com/foldrun-io/foldrun-core/actions/workflows/ci.yml)
 [![npm](https://img.shields.io/npm/v/@foldrun/core)](https://www.npmjs.com/package/@foldrun/core)
-[![licence](https://img.shields.io/badge/licence-Apache--2.0-blue)](LICENSE)
 
 **Agents are just folders. Write them, check them, run them.**
 
@@ -126,14 +124,14 @@ truth.
 webhook triggers, durable runs with full history, a secret store, team access,
 and containers you never touch. Push the folder, it runs.
 
-The format, the CLI and the runtime are open source (Apache-2.0), and the
-hosted platform imports the same core rather than a fork. Writing and checking
+The CLI and the runtime are free to install from npm, and the hosted
+platform imports the same core rather than a fork. Writing and checking
 an agent locally costs nothing and needs no account — that is the on-ramp to
 the host, not a competitor to it.
 
 Where the two differ is operations, not capability. Locally a run happens in
 your terminal; hosted, it survives a restart, retries a failed step, waits days
-for an approval and tells you what it cost. Nothing is held back from the open
+for an approval and tells you what it cost. Nothing is held back from the local
 version to make the hosted one worth buying.
 
 ## This repo, and the others
@@ -150,11 +148,11 @@ Most people want the CLI, not this package — `npm install -g foldrun`.
 | `okf/WHITE-PAPER.md` | hosting OKF: what the spec leaves to hosts |
 | `tests/` | the runtime's tests (`npm test`) |
 
-The command-line tool is its own repository,
-[`foldrun-cli`](https://github.com/foldrun-io/foldrun-cli), and depends on
+The command-line tool is its own package,
+[`foldrun`](https://www.npmjs.com/package/foldrun), and depends on
 this package. The reference documentation is at
-[docs.foldrun.io](https://docs.foldrun.io). The hosted platform's own
-repositories are private; see "Hosting it" below.
+[docs.foldrun.io](https://docs.foldrun.io). Every foldrun repository is
+private; see "Hosting it" below.
 
 ### Templates and workspaces
 
@@ -191,13 +189,9 @@ This package is the framework: everything needed to read a workspace and
 run it on the machine you are on. The platform — the dashboard, a queue and
 its worker, one sandbox per step, a vault, metering, a team — is built on
 it, in a separate package that plugs in through `src/platform.ts`. Nothing
-in this repository imports it, so what is here is exactly what is open.
-
-**Run the platform yourself:** one container, one command —
-[self-hosting/](self-hosting/). Sign up at `localhost:3900`, and
-`foldrun deploy` moves a workspace from your machine to it unchanged. The
-images are the same builds that run foldrun's own installation, published
-under the same versions.
+in this repository imports it. The platform is hosted by foldrun and is not
+distributed; `foldrun deploy` moves a workspace from your machine to it
+unchanged.
 
 ## Requirements
 
@@ -273,4 +267,7 @@ Known gaps: one platform replica per data directory (the web/worker role
 split needs RWX storage), and the dashboard's run lists re-read run files
 per request (fine to thousands of runs).
 
-Apache-2.0.
+## Licence
+
+Proprietary; see [LICENSE](LICENSE). Versions published before 17 October
+2026 were Apache-2.0 and stay so.

package/dist/index.js

@@ -1,11 +1,11 @@
-// @foldrun/core — the open-source runtime.
+// @foldrun/core — the runtime.
 //
 // Everything needed to read a workspace of markdown files and run the agents
 // in it. No server, no database, no account: point it at a folder.
 //
 // The hosted platform imports these same modules. That is deliberate — if the
-// open version were a reduced copy it would rot, and self-hosting would feel
-// like a downgrade instead of a choice. What the platform adds — a queue and
+// local version were a reduced copy it would rot, and running on a laptop
+// would behave differently from running hosted. What the platform adds — a queue and
 // its worker, metering and billing, pods on a cluster, per-account keys in a
 // database, previews, share links, tenancy — lives in its own private package
 // and plugs in through platform.ts. Nothing here imports it.

package/dist/src/deploy.d.ts

@@ -1,4 +1,5 @@
 import { type DeployFile } from "./store.ts";
+import { type ScanFinding, type ScanOptions } from "./scan.ts";
 /**
  * Is this path, relative to a workspace root, one `readTree` would carry?
  *
@@ -69,7 +70,22 @@ export declare function readTree(dir: string): DeployFile[];
  * Returns the problem, or null.
  */
 export declare function unopenedFrontmatter(raw: string): string | null;
+/**
+ * What a deploy says but does not refuse: the structural warnings below, and
+ * the scanner's findings about what should not be in the files at all — a
+ * credential written in, text a reviewer cannot see. The scanner's design
+ * advice (an agent that could leak, an unpinned package) is for `foldrun
+ * check` and the Checks page, not for every deploy's output.
+ */
 export declare function deployWarnings(files: DeployFile[]): DeployIssue[];
+/**
+ * Everything the platform can say about a workspace's files, as findings
+ * with rule ids: what a deploy refuses (errors), what it warns about, and the
+ * whole scanner. The Checks page and `GET …/check` answer with this; `foldrun
+ * check` asks more (it resolves every library and the platform's), so treat
+ * this as the server's view of the same rules, not a second set.
+ */
+export declare function checkFiles(files: DeployFile[], options?: ScanOptions): ScanFinding[];
 export declare function deployIssues(files: DeployFile[]): DeployIssue[];
 /**
  * Runs that make this a bad moment to swap the files under them.

package/dist/src/deploy.js

@@ -34,6 +34,7 @@ import { languageProblem } from "./language.js";
 import { localeProblems } from "./locale.js";
 import { repoDir } from "./gitrepo.js";
 import { entriesNoFollow } from "./paths.js";
+import { filterIgnored, findingFingerprint, ruleForWhere, scanFiles } from "./scan.js";
 /** Directories a deploy never reads out of a source tree. */
 const NOT_SOURCE = new Set([".git", "node_modules", "runs", "outputs", ".foldrun", ".results"]);
 /** Files that are never part of a workspace, whatever directory they sit in. */
@@ -186,7 +187,40 @@ export function unopenedFrontmatter(raw) {
         return null;
     return "the frontmatter has no opening `---`, so none of it is read: the agent runs with no tools and the default model. Add `---` as the first line.";
 }
+/**
+ * What a deploy says but does not refuse: the structural warnings below, and
+ * the scanner's findings about what should not be in the files at all — a
+ * credential written in, text a reviewer cannot see. The scanner's design
+ * advice (an agent that could leak, an unpinned package) is for `foldrun
+ * check` and the Checks page, not for every deploy's output.
+ */
 export function deployWarnings(files) {
+    const scanned = scanFiles(files, { only: ["secret", "content"] })
+        .filter((f) => f.level !== "info")
+        .map((f) => ({ where: `${f.file}${f.line ? `:${f.line}` : ""}`, message: `${f.message} [${f.rule}]` }));
+    return [...structuralWarnings(files), ...scanned];
+}
+/**
+ * Everything the platform can say about a workspace's files, as findings
+ * with rule ids: what a deploy refuses (errors), what it warns about, and the
+ * whole scanner. The Checks page and `GET …/check` answer with this; `foldrun
+ * check` asks more (it resolves every library and the platform's), so treat
+ * this as the server's view of the same rules, not a second set.
+ */
+export function checkFiles(files, options = {}) {
+    const finding = (i, level, kind) => {
+        const m = /^(.*?)(?::(\d+))?(?: .*)?$/.exec(i.where);
+        const file = m?.[1] || i.where;
+        const rule = ruleForWhere(i.where, kind);
+        return { rule, level, file, ...(m?.[2] ? { line: Number(m[2]) } : {}), message: i.message, fingerprint: findingFingerprint(rule, file, i.message) };
+    };
+    const own = [
+        ...deployIssues(files).map((i) => finding(i, "error")),
+        ...structuralWarnings(files).map((i) => finding(i, "warn", i.kind)),
+    ];
+    return [...filterIgnored(own, files), ...scanFiles(files, options)].sort((a, b) => a.file.localeCompare(b.file) || (a.line ?? 0) - (b.line ?? 0) || a.rule.localeCompare(b.rule));
+}
+function structuralWarnings(files) {
     const front = (content) => {
         try {
             return matter(content).data;
@@ -244,7 +278,7 @@ export function deployWarnings(files) {
         }
         for (const w of lintFlow(flow, { agents: agentNames, outwardAgents })) {
             if (w.kind === "outward")
-                out.push({ where: `${f.path}${w.line ? `:${w.line}` : ""}`, message: w.message });
+                out.push({ where: `${f.path}${w.line ? `:${w.line}` : ""}`, message: w.message, kind: "outward" });
         }
     }
     return out;

package/dist/src/platform.d.ts

@@ -4,7 +4,7 @@ import type { EgressHooks } from "./egress.ts";
 export type IsolatedStepRunner = (args: RunInContainerArgs) => Promise<ContainerStepOutcome>;
 /** Who this install is for. `hosted` means someone is paying the operator
  *  for it — a wallet, a plan, a bill. `self-hosted` is everything else: a
- *  laptop, a company's own box, the open-source download. */
+ *  laptop, a dev install, a box nobody bills on. */
 export type Edition = "self-hosted" | "hosted";
 /** What a trigger gate decided. `admit: false` is never an error: the
  *  trigger was received and understood, and the flow's own file says this
@@ -23,9 +23,9 @@ export interface PlatformHooks {
      *  the wallet, top-ups, plan limits, whatever is added next that assumes
      *  a customer — asks before it renders or answers. Default: self-hosted,
      *  which is what a process that never registered a platform is, and what
-     *  the open-source image is unless its operator configures billing. One
-     *  predicate, one place, so "does the community build show X" is a test
-     *  and not an audit. */
+     *  any install is unless its operator configures billing. One predicate,
+     *  one place, so "does an unbilled install show X" is a test and not an
+     *  audit. */
     edition(): Edition;
     /** Put a flow run where a worker will pick it up. Default: start it here, now. */
     enqueueFlowRun(tenant: string, workspace: string, steps: FlowStep[], flowName: string, modelOverride?: string | null, tags?: string[], 

package/dist/src/run-container.d.ts

@@ -239,7 +239,7 @@ export declare const SHARED_RUNTIMES = "/opt/foldrun-runtimes/shared/.runtimes";
  * as a trusted local file, which is precisely the path gVisor, the capability
  * drop and the egress policy all exist to close. Disk is the cheaper thing to
  * spend. One volume per tenant keeps that boundary; each carries a
- * `foldrun.io/tenant` label so it can be found and pruned (self-hosting/README.md).
+ * `foldrun.io/tenant` label so it can be found and pruned.
  *
  * The venvs inside carry the runner's own absolute paths, distinct from the
  * host's `<tenant>/.runtimes` cache — two roots, so a hit is always a real hit.

package/dist/src/run-container.js

@@ -345,7 +345,7 @@ const DOCKER_VOLUME_NAME = /^[a-zA-Z0-9][a-zA-Z0-9_.-]*$/;
  * as a trusted local file, which is precisely the path gVisor, the capability
  * drop and the egress policy all exist to close. Disk is the cheaper thing to
  * spend. One volume per tenant keeps that boundary; each carries a
- * `foldrun.io/tenant` label so it can be found and pruned (self-hosting/README.md).
+ * `foldrun.io/tenant` label so it can be found and pruned.
  *
  * The venvs inside carry the runner's own absolute paths, distinct from the
  * host's `<tenant>/.runtimes` cache — two roots, so a hit is always a real hit.

package/dist/src/scan.d.ts

@@ -0,0 +1,174 @@
+export type ScanLevel = "error" | "warn" | "info";
+export type ScanCategory = "secret" | "security" | "content" | "supply-chain" | "config";
+export interface ScanRule {
+    id: string;
+    category: ScanCategory;
+    level: ScanLevel;
+    /** One line, for a rule list. */
+    title: string;
+    /** Why it matters and what to do instead — the rule's docs, in short. */
+    help: string;
+    /** OWASP Top 10 for Agentic Applications (2026) ids it guards against. */
+    owasp?: string[];
+}
+export interface ScanFile {
+    /** Relative to the workspace root (`agents/x/agent.md`), or `library/…`. */
+    path: string;
+    content: string;
+}
+export interface ScanFinding {
+    rule: string;
+    level: ScanLevel;
+    file: string;
+    /** 1-indexed; absent for a finding about the whole file. */
+    line?: number;
+    message: string;
+    /** Stable across edits elsewhere in the file: rule + file + line text. */
+    fingerprint: string;
+}
+export interface ScanOptions {
+    /** Tool names whose definition says `outward: true` — the CLI and the
+     *  deploy resolve these across the library; the scanner also finds the
+     *  workspace's own among the files it is given. */
+    outwardTools?: Iterable<string>;
+    /** Only these rule ids (or categories, `secret`, `security`, …). */
+    only?: string[];
+    /** The account AGENTS.md's `network:` — the level above the workspace's,
+     *  which the files of one workspace do not carry. */
+    accountNetwork?: unknown;
+}
+export declare const OWASP_URL = "https://genai.owasp.org/resource/owasp-top-10-for-agentic-applications-for-2026";
+export declare const SCAN_RULES: readonly ScanRule[];
+/**
+ * The rules `foldrun check` and the deploy have always had — "will this
+ * run?" — given ids so a finding from them can be filtered, ignored,
+ * baselined and carried in SARIF like the scanner's. Coarse on purpose, one
+ * per kind of file; the message says exactly what is wrong. Their level is
+ * each problem's own, so it is not fixed here.
+ */
+export declare const CHECK_RULES: readonly (Omit<ScanRule, "level"> & {
+    level?: ScanLevel;
+})[];
+/** The rule id of a check or deploy problem, from where it was found and
+ *  the flow lint's tag when it has one. */
+export declare function ruleForWhere(where: string, kind?: string): string;
+/** The rule behind an id — the scanner's or check's own — or undefined. */
+export declare function scanRule(id: string): (Omit<ScanRule, "level"> & {
+    level?: ScanLevel;
+}) | undefined;
+/** Where a rule's docs live — one page, an anchor per rule. */
+export declare function ruleDocsUrl(id: string): string;
+/** rule + file + the text that was flagged, normalised. Not the line number:
+ *  a baseline must survive a paragraph added above the finding. */
+export declare function findingFingerprint(rule: string, file: string, text: string): string;
+/** What a finding may show of a secret: enough to find it, not to use it. */
+export declare function redactSecret(secret: string): string;
+/** The text with every credential in it redacted — for a finding that
+ *  quotes source, so no message ever carries a key whole. */
+export declare function redactText(text: string): string;
+/** The known field a key was probably meant to be, or null. */
+export declare function nearestField(key: string, known: readonly string[]): string | null;
+/**
+ * Every finding in these files, ignores applied. Findings are sorted by file
+ * then line, and one rule says one thing once per line.
+ */
+export declare function scanFiles(files: ScanFile[], options?: ScanOptions): ScanFinding[];
+/**
+ * Drop the findings a `foldrun-ignore` comment (with a reason) covers — for
+ * findings that did not come from scanFiles, such as check's own rules, so
+ * one comment syntax works for every rule. Ignores without a reason are
+ * reported by scanFiles itself, once.
+ */
+export declare function filterIgnored<T extends {
+    rule: string;
+    file: string;
+    line?: number;
+}>(findings: T[], files: ScanFile[]): T[];
+export interface ScanBaseline {
+    version: 1;
+    /** When it was written — for a person reading the file, not for matching. */
+    created?: string;
+    findings: {
+        rule: string;
+        file: string;
+        fingerprint: string;
+    }[];
+}
+/** A baseline that accepts every finding here as known. */
+export declare function makeBaseline(findings: Pick<ScanFinding, "rule" | "file" | "fingerprint">[], created?: string): ScanBaseline;
+/** Findings not in the baseline, and how many it hid. A baseline that does
+ *  not parse hides nothing — failing open would hide every new finding. */
+export declare function applyBaseline<T extends Pick<ScanFinding, "rule" | "file" | "fingerprint">>(findings: T[], baseline: unknown): {
+    kept: T[];
+    baselined: number;
+};
+export interface SarifFinding {
+    rule: string;
+    level: ScanLevel;
+    file: string;
+    line?: number;
+    message: string;
+    fingerprint: string;
+}
+export declare function toSarif(findings: SarifFinding[], opts?: {
+    version?: string;
+    rules?: {
+        id: string;
+        title: string;
+        help?: string;
+    }[];
+    root?: string;
+}): {
+    $schema: string;
+    version: string;
+    runs: {
+        tool: {
+            driver: {
+                name: string;
+                informationUri: string;
+                version?: string | undefined;
+                rules: {
+                    id: string;
+                    name: string;
+                    shortDescription: {
+                        text: string;
+                    };
+                    help?: {
+                        text: string;
+                    } | undefined;
+                    helpUri: string;
+                    properties: {
+                        tags: string[];
+                    };
+                }[];
+            };
+        };
+        originalUriBaseIds?: {
+            SRCROOT: {
+                uri: string;
+            };
+        } | undefined;
+        results: {
+            ruleId: string;
+            ruleIndex: number;
+            level: string;
+            message: {
+                text: string;
+            };
+            locations: {
+                physicalLocation: {
+                    artifactLocation: {
+                        uri: string;
+                        uriBaseId?: string | undefined;
+                    };
+                    region?: {
+                        startLine: number;
+                    } | undefined;
+                };
+            }[];
+            partialFingerprints: {
+                "foldrun/v1": string;
+            };
+        }[];
+    }[];
+};