agent-cfml-check 0.1.0

package/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 Yap Wei Jun
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

package/README.md

@@ -0,0 +1,74 @@
+# Agent CFML Check
+
+`agent-cfml-check` is a deterministic, read-only checker for a deliberately bounded CFML structural subset. It is the independent implementation repository for the `agent-cfml-check` entry in the AI-Agent-Tools Hub.
+
+## Current status
+
+Version `0.1.0` contains the first feasibility slice. The current implementation is locally verified for:
+
+- paired CFML tag nesting;
+- `cfelse` and `cfelseif` ownership and ordering;
+- bodyless tags and self-closing bodyless spellings;
+- nested CFML comments;
+- quoted tag attributes, doubled-quote escapes, and comments inside tag expressions;
+- embedded `cfscript` delimiter balance while respecting strings and comments;
+- recognized pure-script `.cfc` files beginning with `component` or `interface`;
+- UTF-8 source metadata, one-based source positions, and zero-based UTF-8 byte ranges;
+- explicit-root path safety, source stability checks, input validation, output limits, nesting limits, finding limits, and time limits;
+- deterministic JSON and text CLI output.
+
+Verification at repository commit `1d5c768`:
+
+- `npm test`: 17/17 passed;
+- `npm run typecheck`: passed;
+- `npm pack --dry-run --json`: passed;
+- capabilities, valid-fixture, and misnested-fixture CLI checks: passed.
+
+This is not yet a published package, a complete CFML parser, or evidence of Lucee/Adobe ColdFusion compatibility. Hub lifecycle and publication status remain outside this repository's locally verified implementation evidence.
+
+## Install and use
+
+```sh
+npm install
+npm test
+npm run typecheck
+npm run build
+node dist/cli/index.js capabilities --json
+node dist/cli/index.js check --root . fixtures/valid.cfm --json
+node dist/cli/index.js check --root . fixtures/misnested.cfm --json
+```
+
+The package requires Node.js `>=18.18.0`. It has no runtime npm dependencies; TypeScript and Node.js type definitions are development dependencies.
+
+The CLI supports:
+
+```text
+agent-cfml-check capabilities [--json] [--pretty]
+agent-cfml-check check --root <directory> <file> [--json] [--pretty]
+```
+
+Check limits can be overridden with `--max-source-bytes`, `--max-nesting`, `--max-findings`, `--max-output-bytes`, and `--time-limit-ms`, subject to the hard caps reported by `capabilities`.
+
+The checker requires one explicit root and one `.cfm` or `.cfc` file. JSON mode emits one envelope on stdout; diagnostics stay on stderr. A completed check with structural violations still exits `0` and reports `data.verdict: "violations"`. Exit `3` means unsupported syntax, insufficient evidence, or a resource limit. Exit `4` means an explicit-root or access-policy rejection. See [SPEC.md](SPEC.md) for the complete contract.
+
+## Safety and boundaries
+
+The checker never executes CFML or JavaScript from the inspected source, follows includes, reads directories as input, uses the network, installs packages, or modifies the inspected source tree. It reads exactly one regular UTF-8 source file under the explicit root, rejects symlink escapes, and fails closed when the bounded profile cannot establish a result.
+
+The supported profile is `cfml-structure-v1`. Unknown/custom/imported tags, optional-body semantics outside the catalog, full expression and runtime semantics, SQL/HTML validity, CFML tag islands inside `cfscript`, and engine behavior are outside the profile or explicitly unverified.
+
+## Repository map
+
+- `src/`: TypeScript implementation;
+- `src/core/source-reader.ts`: root, path, file, encoding, and snapshot checks;
+- `src/core/lexer.ts`: bounded CFML tag and CFScript scanning;
+- `src/core/source-index.ts`: source positions and UTF-8 byte ranges;
+- `src/core/checker.ts`: capabilities, checking, envelopes, and output fitting;
+- `src/cli/index.ts`: CLI argument parsing and rendering;
+- `schema/`: JSON Schema for result envelopes;
+- `fixtures/`: valid and misnested examples;
+- `test/`: implementation and CLI tests;
+- `dist/`: generated package output;
+- `DESIGN.md`, `EPIC.md`, `ROADMAP.md`, `TASK.md`, `GOAL.md`, `PROGRESS.md`, `GOAL_PROMPT.md`, `CHANGELOG.md`: repository design, planning, status, and maintenance documents.
+
+`package.json` currently publishes `dist`, `README.md`, `SPEC.md`, `schema`, and `fixtures`; the design, planning, progress, goal, prompt, and changelog documents remain repository-maintainer documentation. Although `src/index.ts` contains TypeScript exports, installed-package library imports are not documented as supported until `main`/`exports` are added and tested.

package/SPEC.md

@@ -0,0 +1,116 @@
+# Agent CFML Check Specification
+
+**Status:** frozen feasibility contract for implementation baseline `1d5c768`
+**Tool version:** `0.1.0`
+**Profile:** `cfml-structure-v1`
+**Envelope schema:** `schema/agent-cfml-check-result-v1.schema.json`
+
+## 1. Scope
+
+The tool performs deterministic, read-only structural checks on exactly one explicitly selected local UTF-8 `.cfm` or `.cfc` file under an explicitly supplied root. It does not execute CFML, resolve includes, inspect a directory as source input, use the network, or modify the inspected source tree.
+
+A completed result proves only the checks listed in that result. It does not prove Lucee or Adobe ColdFusion execution compatibility.
+
+## 2. Operations and interfaces
+
+### CLI operations
+
+```text
+agent-cfml-check capabilities [--json] [--pretty]
+agent-cfml-check check --root <directory> <file> [--json] [--pretty]
+```
+
+`capabilities` reports the profile, operations, extensions, tag catalogue, effective default limits, and exclusions. The CLI does not accept a file, root, or check-limit override for this operation.
+
+`check` requires exactly one explicit root and one `.cfm` or `.cfc` file. `--pretty` requires `--json`. `--help` prints usage and `--version` prints `0.1.0`; neither may be combined with other options.
+
+### TypeScript interface
+
+`src/index.ts` exports `capabilities`, `checkFile`, `DEFAULT_LIMITS`, `HARD_LIMITS`, `normalizeLimits`, and schema types. The source exports exist, but package metadata currently lacks `main`/`exports`; installed-package library imports are not yet a verified contract.
+
+The TypeScript `capabilities(limitsInput)` API may receive limit overrides, while the CLI `capabilities` operation rejects them.
+
+## 3. Supported structures
+
+### Paired bodies
+
+`cfcomponent`, `cffunction`, `cfif`, `cfloop`, `cfoutput`, `cfquery`, `cfsavecontent`, `cfscript`, and `cfsilent` require matching closing tags and cannot be self-closing.
+
+### Branches
+
+`cfelse` and `cfelseif` must belong to the directly open `cfif`. Only one `cfelse` is accepted, and `cfelseif` cannot follow `cfelse`.
+
+### Bodyless tags
+
+`cfargument`, `cfinclude`, `cfqueryparam`, `cfreturn`, and `cfset` are standalone. Ordinary and self-closing spellings are accepted. Closing a bodyless tag is unsupported.
+
+Tag names are case-insensitive. Unknown, custom, imported, and unlisted tags are unsupported.
+
+### Comments, attributes, and scripts
+
+- Nested `<!--- ... --->` CFML comments are ignored for tag detection.
+- Quoted tag attributes respect backslash escapes, doubled quote escapes, and CFML comments inside the tag expression.
+- HTML comments do not suppress CFML tag detection.
+- Embedded `cfscript` respects quoted strings, `//` line comments, and `/* ... */` block comments while checking `()`, `[]`, and `{}`.
+- CFML tag islands inside `cfscript` are unsupported.
+- A `.cfc` beginning with `component` or `interface` after an optional BOM receives the pure-script delimiter check. A `.cfc` without recognized CFML tags or a recognized pure-script entry is incomplete/unsupported.
+
+## 4. Findings
+
+Completed structural findings use these codes:
+
+- `UNEXPECTED_CLOSE`
+- `MISMATCHED_CLOSE`
+- `UNCLOSED_TAG`
+- `INVALID_BRANCH`
+- `UNTERMINATED_STRING`
+- `UNTERMINATED_COMMENT`
+- `UNBALANCED_DELIMITER`
+
+Each finding contains a message, one-based line/column positions, a zero-based UTF-8 byte range `[start_byte, end_byte)`, and a related opening location or `null`. Findings are ordered by start byte and then code.
+
+## 5. Result envelope
+
+Every JSON result contains `schema_version`, `tool`, `status`, `complete`, `data`, `errors`, `warnings`, and `meta`.
+
+For `status: "ok"`, `complete` is `true`, `errors` is empty, and `data` is present. A completed structural violation remains `status: "ok"`, with `data.verdict: "violations"` and exit `0`.
+
+For `status: "incomplete"` or `"error"`, `complete` is `false`, `data` is `null`, and at least one error is present. No partial success is returned when evidence or a resource limit is insufficient.
+
+Check data contains the profile, source path/SHA-256/byte size/UTF-8/BOM metadata, verdict `pass` or `violations`, checks `tag-nesting`, `branch-structure`, and `cfscript-delimiters`, exclusions, and findings. Capabilities data contains the profile, operations, extensions, supported tags, limits, and exclusions.
+
+## 6. Limits
+
+| Limit | Default | Hard cap |
+|---|---:|---:|
+| `max_source_bytes` | 2 MiB | 16 MiB |
+| `max_nesting` | 256 | 1,024 |
+| `max_findings` | 100 | 1,000 |
+| `max_output_bytes` | 64 KiB | 1 MiB |
+| `time_limit_ms` | 5,000 | 30,000 |
+
+Requested limits must be positive safe integers and cannot exceed hard caps. Reaching a limit returns a fail-closed result rather than partial data.
+
+## 7. Input and safety behavior
+
+The source reader requires `.cfm` or `.cfc`, an existing root and file, realpath containment, a regular file, valid UTF-8, no NUL byte, and an effective source-size limit. It checks size and modification time before and after reading and rejects a changed snapshot. Symlink escapes are rejected.
+
+Known envelope error codes include `INVALID_ARGUMENT`, `INVALID_LIMIT`, `UNSUPPORTED_EXTENSION`, `ROOT_NOT_FOUND`, `FILE_NOT_FOUND`, `PATH_UNRESOLVED`, `FILE_OUTSIDE_ROOT`, `LIMIT_EXCEEDED`, `SOURCE_CHANGED`, `BINARY_INPUT`, `ENCODING_UNSUPPORTED`, `UNSUPPORTED_SYNTAX`, and `INTERNAL_ERROR`.
+
+## 8. Exit codes and output
+
+| Code | Meaning |
+|---:|---|
+| `0` | Completed capabilities or check, including `violations` |
+| `1` | Unexpected internal failure without a safe result |
+| `2` | Invalid argument, limit, extension, or ordinary input rejection |
+| `3` | Unsupported syntax, incomplete evidence, source change, or resource limit |
+| `4` | Explicit-root, path-resolution, or access-policy rejection |
+
+JSON mode emits one envelope on stdout; failure diagnostics are also written to stderr. Pretty JSON is intentionally multi-line but remains one JSON envelope.
+
+## 9. Evidence boundary
+
+The profile does not validate full CFML grammar, expression/type/runtime semantics, HTML, SQL, include expansion, directory/project context, Lucee/Adobe execution, unknown/custom/imported tags, or CFML tag islands inside `cfscript`. Package publication, Hub lifecycle, cross-platform compatibility, and installed-package library imports are also outside current verified evidence.
+
+The repository tests cover CF-01 through CF-13, pure-script `.cfc` handling, and three CLI behaviors. Current local evidence is 17/17 tests, typecheck pass, package dry-run pass, and Windows CLI smoke checks. JSON Schema validation, engine comparison, non-Windows verification, and publication remain pending.

package/dist/cli/index.d.ts

@@ -0,0 +1,2 @@
+#!/usr/bin/env node
+export declare function main(argv?: readonly string[]): number;

package/dist/cli/index.js

@@ -0,0 +1,157 @@
+#!/usr/bin/env node
+import { capabilities, checkFile } from "../core/checker.js";
+import { DEFAULT_LIMITS } from "../core/limits.js";
+import { ToolFailure } from "../schema/errors.js";
+import { pathToFileURL } from "node:url";
+import path from "node:path";
+const HELP = `agent-cfml-check — deterministic, read-only structural checks for a bounded CFML subset
+
+Usage:
+  agent-cfml-check capabilities [--json] [--pretty]
+  agent-cfml-check check --root <directory> <file> [--json] [--pretty]
+
+The checker reads exactly one .cfm or .cfc file under the explicit root. It never
+executes CFML, follows includes, uses the network, or modifies source files.
+`;
+function parseInteger(value, name) {
+    if (!/^\d+$/u.test(value))
+        throw new ToolFailure("INVALID_ARGUMENT", `${name} must be a positive integer`, 2);
+    const parsed = Number(value);
+    if (!Number.isSafeInteger(parsed) || parsed < 1)
+        throw new ToolFailure("INVALID_ARGUMENT", `${name} must be a positive integer`, 2);
+    return parsed;
+}
+function parseArgs(argv) {
+    let operation = null;
+    let file;
+    let root;
+    let json = false;
+    let pretty = false;
+    let help = false;
+    let version = false;
+    const limits = {};
+    const nextValue = (index, flag) => {
+        const value = argv[index + 1];
+        if (value === undefined || value.startsWith("--"))
+            throw new ToolFailure("INVALID_ARGUMENT", `${flag} requires a value`, 2);
+        return value;
+    };
+    for (let index = 0; index < argv.length; index += 1) {
+        const argument = argv[index];
+        if (argument === undefined)
+            continue;
+        if (argument === "--help" || argument === "-h") {
+            help = true;
+            continue;
+        }
+        if (argument === "--version") {
+            version = true;
+            continue;
+        }
+        if (argument === "--json") {
+            json = true;
+            continue;
+        }
+        if (argument === "--pretty") {
+            pretty = true;
+            continue;
+        }
+        if (argument === "--root") {
+            root = nextValue(index, argument);
+            index += 1;
+            continue;
+        }
+        const limitsMap = {
+            "--max-source-bytes": "max_source_bytes",
+            "--max-nesting": "max_nesting",
+            "--max-findings": "max_findings",
+            "--max-output-bytes": "max_output_bytes",
+            "--time-limit-ms": "time_limit_ms",
+        };
+        const limitName = limitsMap[argument];
+        if (limitName !== undefined) {
+            limits[limitName] = parseInteger(nextValue(index, argument), argument);
+            index += 1;
+            continue;
+        }
+        if (argument.startsWith("--"))
+            throw new ToolFailure("INVALID_ARGUMENT", `Unknown flag ${argument}`, 2);
+        if (operation === null && (argument === "capabilities" || argument === "check")) {
+            operation = argument;
+            continue;
+        }
+        if (operation === "check" && file === undefined) {
+            file = argument;
+            continue;
+        }
+        throw new ToolFailure("INVALID_ARGUMENT", "Unexpected positional argument", 2);
+    }
+    if (help && (version || operation !== null || file !== undefined || root !== undefined || json || pretty || Object.keys(limits).length > 0)) {
+        throw new ToolFailure("INVALID_ARGUMENT", "--help cannot be combined with other options", 2);
+    }
+    if (version && (help || operation !== null || file !== undefined || root !== undefined || json || pretty || Object.keys(limits).length > 0)) {
+        throw new ToolFailure("INVALID_ARGUMENT", "--version cannot be combined with other options", 2);
+    }
+    if (help || version)
+        return { operation: "capabilities", file: undefined, root: undefined, json, pretty, limits, help, version };
+    if (operation === null)
+        throw new ToolFailure("INVALID_ARGUMENT", "An operation is required: capabilities or check", 2);
+    if (operation === "capabilities" && (file !== undefined || root !== undefined || Object.keys(limits).length > 0))
+        throw new ToolFailure("INVALID_ARGUMENT", "capabilities does not accept a file, root, or check limits", 2);
+    if (operation === "check" && (file === undefined || root === undefined))
+        throw new ToolFailure("INVALID_ARGUMENT", "check requires --root and one source file", 2);
+    if (pretty && !json)
+        throw new ToolFailure("INVALID_ARGUMENT", "--pretty requires --json", 2);
+    return { operation, file, root, json, pretty, limits, help, version };
+}
+function renderText(envelope) {
+    if (envelope.status !== "ok" || envelope.data === null)
+        return `${envelope.status}: ${envelope.errors.map((error) => `${error.code}: ${error.message}`).join("; ")}\n`;
+    const data = envelope.data;
+    const lines = [`${envelope.tool.id} ${envelope.tool.version}`, `status: ${envelope.status}`, `verdict: ${data.verdict ?? "n/a"}`, `source: ${data.source?.path ?? "n/a"}`, `findings: ${data.findings?.length ?? 0}`];
+    for (const item of data.findings ?? [])
+        lines.push(`  ${item.code} at ${item.location.start.line}:${item.location.start.column}: ${item.message}`);
+    return `${lines.join("\n")}\n`;
+}
+export function main(argv = process.argv.slice(2)) {
+    try {
+        const args = parseArgs(argv);
+        if (args.help) {
+            process.stdout.write(HELP);
+            return 0;
+        }
+        if (args.version) {
+            process.stdout.write(`${"0.1.0"}\n`);
+            return 0;
+        }
+        const result = args.operation === "capabilities"
+            ? { envelope: capabilities(args.limits), exit_code: 0 }
+            : checkFile({ root: args.root, file: args.file, limits: args.limits });
+        if (args.json)
+            process.stdout.write(`${JSON.stringify(result.envelope, null, args.pretty ? 2 : undefined)}\n`);
+        else
+            process.stdout.write(renderText(result.envelope));
+        if (result.envelope.status !== "ok")
+            for (const error of result.envelope.errors)
+                process.stderr.write(`error: ${error.code}: ${error.message}\n`);
+        return result.exit_code;
+    }
+    catch (error) {
+        const failure = error instanceof ToolFailure ? error : new ToolFailure("INTERNAL_ERROR", "The CLI failed without a safe result", 1);
+        const envelope = {
+            schema_version: "1.0.0",
+            tool: { id: "agent-cfml-check", version: "0.1.0" },
+            status: "error",
+            complete: false,
+            data: null,
+            errors: [{ code: failure.code, message: failure.message }],
+            warnings: [],
+            meta: { scope: "CLI invocation", limits: DEFAULT_LIMITS },
+        };
+        process.stdout.write(`${JSON.stringify(envelope)}\n`);
+        process.stderr.write(`error: ${failure.code}: ${failure.message}\n`);
+        return failure.exitCode;
+    }
+}
+if (process.argv[1] !== undefined && pathToFileURL(path.resolve(process.argv[1])).href === import.meta.url)
+    process.exitCode = main();

package/dist/core/checker.d.ts

@@ -0,0 +1,6 @@
+import type { CapabilitiesData, CheckData, CheckLimits, Envelope, CheckOptions } from "../schema/types.js";
+export declare function capabilities(limitsInput?: Partial<CheckLimits>): Envelope<CapabilitiesData>;
+export declare function checkFile(options: CheckOptions): {
+    envelope: Envelope<CheckData>;
+    exit_code: 0 | 1 | 2 | 3 | 4;
+};

package/dist/core/checker.js

@@ -0,0 +1,94 @@
+import { createHash } from "node:crypto";
+import path from "node:path";
+import { ToolFailure } from "../schema/errors.js";
+import { PROFILE_ID, TOOL_ID, TOOL_VERSION } from "../schema/types.js";
+import { normalizeLimits } from "./limits.js";
+import { loadSource } from "./source-reader.js";
+import { checkPureScriptCfc, PAIRED_TAGS, BRANCH_TAGS, BODYLESS_TAGS } from "./lexer.js";
+function meta(limits) {
+    return { scope: "One explicitly selected local UTF-8 .cfm or .cfc file under an explicit root", limits };
+}
+function emptyEnvelope(status, limits, errors) {
+    return { schema_version: "1.0.0", tool: { id: TOOL_ID, version: TOOL_VERSION }, status, complete: false, data: null, errors, warnings: [], meta: meta(limits) };
+}
+function fitOutput(envelope, limits) {
+    const serialized = JSON.stringify(envelope);
+    if (Buffer.byteLength(serialized, "utf8") <= limits.max_output_bytes)
+        return envelope;
+    const fallback = emptyEnvelope("incomplete", limits, [{ code: "LIMIT_EXCEEDED", message: "The output limit was reached; result data was withheld" }]);
+    if (Buffer.byteLength(JSON.stringify(fallback), "utf8") <= limits.max_output_bytes)
+        return fallback;
+    return { schema_version: "1.0.0", tool: { id: TOOL_ID, version: TOOL_VERSION }, status: "incomplete", complete: false, data: null, errors: [{ code: "LIMIT_EXCEEDED", message: "Output limit exceeded" }], warnings: [], meta: meta(limits) };
+}
+export function capabilities(limitsInput) {
+    const limits = normalizeLimits(limitsInput);
+    return {
+        schema_version: "1.0.0",
+        tool: { id: TOOL_ID, version: TOOL_VERSION },
+        status: "ok",
+        complete: true,
+        data: {
+            profile: PROFILE_ID,
+            operations: ["capabilities", "check"],
+            extensions: [".cfm", ".cfc"],
+            supported_tags: {
+                paired_bodies: [...PAIRED_TAGS].sort(),
+                branches: [...BRANCH_TAGS].sort(),
+                bodyless: [...BODYLESS_TAGS].sort(),
+            },
+            limits,
+            exclusions: [
+                "Full CFML grammar and expression/type/runtime semantics",
+                "HTML validity, SQL correctness, include expansion, and Lucee execution",
+                "Unknown/custom/imported tag libraries and CFML tag islands inside cfscript",
+            ],
+        },
+        errors: [],
+        warnings: [],
+        meta: meta(limits),
+    };
+}
+export function checkFile(options) {
+    let limits;
+    try {
+        limits = normalizeLimits(options.limits);
+    }
+    catch (error) {
+        const fallback = normalizeLimits(undefined);
+        const failure = error instanceof ToolFailure ? error : new ToolFailure("INVALID_LIMIT", "Invalid limits", 2);
+        return { envelope: emptyEnvelope("error", fallback, [{ code: failure.code, message: failure.message }]), exit_code: failure.exitCode };
+    }
+    try {
+        const source = loadSource({ root: options.root, file: options.file, limits });
+        const extension = path.extname(source.relative_path);
+        const scanned = checkPureScriptCfc(source.source, extension, limits);
+        if (scanned.incomplete.length > 0) {
+            return { envelope: fitOutput(emptyEnvelope("incomplete", limits, scanned.incomplete), limits), exit_code: 3 };
+        }
+        const data = {
+            profile: PROFILE_ID,
+            source: {
+                path: source.relative_path,
+                sha256: createHash("sha256").update(source.bytes).digest("hex"),
+                byte_size: source.bytes.byteLength,
+                encoding: "utf-8",
+                bom: source.bom,
+            },
+            verdict: scanned.findings.length === 0 ? "pass" : "violations",
+            checks: ["tag-nesting", "branch-structure", "cfscript-delimiters"],
+            exclusions: [
+                "Expression, type, SQL, HTML, include, and runtime semantics are unverified",
+                "Unknown/custom/imported tags and CFML tag islands inside cfscript are unsupported",
+            ],
+            findings: scanned.findings,
+        };
+        return {
+            envelope: fitOutput({ schema_version: "1.0.0", tool: { id: TOOL_ID, version: TOOL_VERSION }, status: "ok", complete: true, data, errors: [], warnings: [], meta: meta(limits) }, limits),
+            exit_code: 0,
+        };
+    }
+    catch (error) {
+        const failure = error instanceof ToolFailure ? error : new ToolFailure("INTERNAL_ERROR", "The checker failed without a safe result", 1);
+        return { envelope: fitOutput(emptyEnvelope(failure.exitCode === 3 ? "incomplete" : "error", limits, [{ code: failure.code, message: failure.message }]), limits), exit_code: failure.exitCode };
+    }
+}

package/dist/core/lexer.d.ts

@@ -0,0 +1,28 @@
+import type { Finding } from "../schema/types.js";
+export declare const PAIRED_TAGS: Set<string>;
+export declare const BRANCH_TAGS: Set<string>;
+export declare const BODYLESS_TAGS: Set<string>;
+interface ScriptRegion {
+    content_start: number;
+    content_end: number;
+}
+interface ScanResult {
+    findings: Finding[];
+    incomplete: Array<{
+        code: string;
+        message: string;
+    }>;
+    script_regions: ScriptRegion[];
+    saw_cfml_tag: boolean;
+}
+export declare function scanCfml(source: string, limits: {
+    max_nesting: number;
+    max_findings: number;
+    time_limit_ms: number;
+}): ScanResult;
+export declare function checkPureScriptCfc(source: string, extension: string, limits: {
+    max_nesting: number;
+    max_findings: number;
+    time_limit_ms: number;
+}): ScanResult;
+export {};