mjolnir-qa 3.0.0 → 5.0.0

package/dist/cli.d.mts

@@ -1,3 +1,77 @@
+//#region src/v6/test-doubles.d.ts
+/** How serious the pattern is. Closed enum, so a renderer cannot invent a
+ *  fourth severity at a call site. */
+declare const DOUBLE_RISKS: readonly ["NO_ASSERTION", "DOUBLE_ONLY", "DOUBLE_MIXED", "DOUBLE_SUBJECT"];
+type DoubleRisk = (typeof DOUBLE_RISKS)[number];
+interface DoubleFinding {
+  risk: DoubleRisk;
+  /** How many assertions there are in total. */
+  assertions: number;
+  /** How many are about a double. */
+  doubleAssertions: number;
+  /** How many carry real evidence about the code under test. */
+  substantiatingAssertions: number;
+  /** 0..1 — the share of assertions that prove nothing. */
+  hollowRatio: number;
+  /** The one-line statement a surface can render verbatim. */
+  statement: string;
+}
+/**
+ * A roll-up across a suite. A suite is hollow when *no* test in it
+ * substantiates anything — which is a different and stronger statement
+ * than "some tests are hollow", and the one a user needs at the top of a
+ * report.
+ */
+declare function assessSuite(findings: readonly DoubleFinding[]): {
+  tests: number;
+  hollow: number;
+  substantiating: number;
+  hollowRatio: number;
+  verdict: "SUBSTANTIATED" | "PARTIALLY_HOLLOW" | "HOLLOW";
+};
+//#endregion
+//#region src/v6/tool-coverage.d.ts
+/** What the engine can do with a detected tool. Closed enum, so a
+ *  renderer cannot invent a fifth state. */
+declare const TOOL_COVERAGE_STATES: readonly ["UNDERSTOOD", "DECLARED", "OUT_OF_SCOPE", "IGNORED"];
+type ToolCoverageState = (typeof TOOL_COVERAGE_STATES)[number];
+interface ToolCoverageEntry {
+  name: string;
+  state: ToolCoverageState;
+  /** The census category, when one applies. */
+  category: string | null;
+  /** The census entry id, when the engine has one. */
+  censusId: string | null;
+  /** What the cost of not handling it is, in one sentence. */
+  consequence: string;
+}
+interface BlindSpot {
+  id: string;
+  /** What the engine cannot see. */
+  blindTo: string;
+  /** Why it matters, in one sentence. */
+  consequence: string;
+}
+interface ToolCoverage {
+  /** Every QA tool the probe saw, with what the engine does about it. */
+  tools: readonly ToolCoverageEntry[];
+  counts: Readonly<Record<ToolCoverageState, number>>;
+  /** Tools the engine sees and cannot act on. */
+  unhandled: readonly ToolCoverageEntry[];
+  /**
+   * What the engine cannot see **through**, whether or not the tool is
+   * known. This is the part a user cannot infer, and the part that makes
+   * a green run mean something.
+   */
+  blindSpots: readonly BlindSpot[];
+  /** The double-analysis roll-up, when the caller supplied test data. */
+  suite: ReturnType<typeof assessSuite> | null;
+  /** One line a surface may render verbatim. */
+  statement: string;
+  /** Never a claim of completeness. */
+  complete: false;
+}
+//#endregion
 //#region src/types.d.ts
 /**
  * Mjolnir — canonical types (JSON contract v1, schemaVersion 1).
@@ -235,6 +309,68 @@ interface DimensionScore {
   infos: number;
 }
 type AnalysisStatus = "complete" | "partial";
+/**
+ * The normalized per-test runtime evidence record as it appears in a report
+ * (plan V5-011). Structurally the `EvidenceRecord` from
+ * `src/engine/evidence-core.ts`, restated here so the report schema does not
+ * depend on an engine module's internals — the wire shape is a contract.
+ */
+interface EvidenceRecordShape {
+  source: string;
+  artifact: string;
+  file: string;
+  title: string;
+  line?: number;
+  status: {
+    final: string;
+    failed: boolean;
+    retried: boolean;
+    passedOnRetry: boolean;
+    skipped: boolean;
+    timedOut: boolean;
+  };
+  attempts: number;
+  durationMs: number;
+  errors: string[];
+  attachments: string[];
+  provenance: {
+    core: string;
+    ingest: string;
+  };
+}
+/**
+ * Candidate binding (plan V5-010).
+ *
+ * The immutable identity of the release candidate a run was produced against.
+ * It is what makes a claim replayable: "this verdict belongs to candidate
+ * X, built from commit Y with lockfile Z" can be re-checked; "this verdict
+ * belongs to whatever was on the machine" cannot.
+ *
+ * Every field is required. A partial binding is worse than none, because a
+ * consumer cannot tell which link is missing — so an unbound run omits the
+ * whole object rather than filling in what it has.
+ */
+interface CandidateBinding {
+  /** The candidate manifest's own id. */
+  manifestId: string;
+  /** WORKING_CANDIDATE | RELEASE_CANDIDATE. */
+  state: "WORKING_CANDIDATE" | "RELEASE_CANDIDATE";
+  /**
+   * The immutable commit this candidate is bound to, or null for a working
+   * candidate — which by definition has no commit yet.
+   */
+  candidateSha: string | null;
+  /** The commit the candidate was branched from. */
+  baseSha: string;
+  /** sha256 of package.json as published for the candidate. */
+  packageSha256: string;
+  /** sha256 of the lockfile as published for the candidate. */
+  lockfileSha256: string;
+  /** Who owns the candidate. "UNASSIGNED" is a real, reportable value. */
+  owner: string;
+  /** NOT_AUTHORIZED | AUTHORIZED. Never inferred from evidence. */
+  releaseAuthorizationState: "NOT_AUTHORIZED" | "AUTHORIZED";
+}
 interface ScanResult {
   schemaVersion: typeof SCHEMA_VERSION;
   /** False when budget expired or files were skipped (§18.3). */
@@ -321,12 +457,42 @@ interface ScanResult {
     durationMs: number;
     /**
      * Named reasons the scan stopped early (audit H-8): "deadline",
-     * "file-cap:<adapter>", "rule-loop-deadline". Present only when
-     * truncation actually happened — absence means the scan is whole.
+     * "file-cap:<adapter>", "rule-loop-deadline", "ast-budget-fallback".
+     * Present only when truncation actually happened — absence means the
+     * scan is whole.
+     *
+     * Open `string[]`, NOT a closed union: a producer may add a member
+     * without a schema bump. The cost of that choice is that a consumer
+     * asserting the EXACT set breaks on every new reason, so assertions
+     * here are containment assertions, never `toEqual([...])`.
+     *
+     * "ast-budget-fallback" specifically means the scan ran out of time
+     * before a file could be analyzed through its adapter's AST stage, and
+     * that file was analyzed by regex instead. It is a capability loss, not
+     * a speed trade, and the count of affected files is in `reasons` as
+     * "ast-budget-fallback-files:<n>".
      */
     truncationReasons?: string[];
     /** Canonical completion reasons, including scope and parser degradation. */
     reasons?: string[];
+    /**
+     * Per-reason counts of capability lost inside a `catch` that returned a
+     * clean default — the degradation ledger (`src/engine/degradation-ledger.ts`).
+     *
+     * Distinct from `truncationReasons`, which means the scan STOPPED, and
+     * from `reasons`, which is a flat string set. This one is structured and
+     * reason-coded so "the AST mask was unavailable for 3 files" and "3 files
+     * were skipped" cannot be confused. Each entry is ALSO surfaced in
+     * `reasons` as `degraded:<reason>:<count>`.
+     *
+     * Present only when at least one degradation happened; absence means the
+     * scan lost no capability to a swallowed error, OR the producer predates
+     * the ledger. A non-empty value always forces `partial: true`.
+     */
+    degradations?: Array<{
+      reason: string;
+      count: number;
+    }>;
     /**
      * Rule executions that threw and were swallowed by crash isolation
      * (audit R-9). 0 means no rule silently failed; absence means the
@@ -367,6 +533,18 @@ interface ScanResult {
     /** The named scope reasons, present only when PARTIAL. */
     reasons?: string[];
   };
+  /**
+   * Tool coverage (v6): which QA tooling this scan actually saw, what the
+   * engine does about it, and what it is blind to.
+   *
+   * Present when the scan ran the ecosystem probe. Additive within
+   * schemaVersion 1; absent when the producer predates this field.
+   *
+   * complete is always false. A scan that could not see through a test
+   * double must never render as a scan with no blind spots, and that is
+   * the one claim a verification tool cannot make.
+   */
+  toolCoverage?: ToolCoverage;
   /**
    * Run Identity (R4c): the deterministic anchor binding verdict ←
    * evidence ← execution ← scope ← source ← rule(rev). Present when the
@@ -382,6 +560,29 @@ interface ScanResult {
     scoringModelVersion?: string;
     frameworkSupportMatrixVersion?: string;
     commit?: string;
+    /** The worktree tree hash the run was bound to, when known. */
+    tree?: string;
+    /** The lockfile digest the run was bound to, when known. */
+    lockfile?: string;
+    /**
+     * Which identity links this run actually bound (plan V5-010). Derived, not
+     * asserted by each consumer: a claim is replayable only when every link it
+     * depends on is present.
+     *
+     * OPTIONAL on purpose. The machine contract is v1 additive-only, so a
+     * report written before this field existed has none, and a reader that
+     * required it would reject exactly the older artifacts it must tolerate.
+     * Absence means "produced by a build that did not record bindings" — never
+     * "bound to everything".
+     */
+    boundLinks?: Array<"input" | "rules" | "config" | "engine" | "commit" | "tree" | "lockfile" | "candidate">;
+    /**
+     * The release candidate this run is bound to (plan V5-010). Absent for an
+     * ordinary scan of a working tree — a run is not a release candidate, and
+     * saying otherwise would let a local scan stand in for authorized
+     * evidence.
+     */
+    candidate?: CandidateBinding;
   };
   /**
    * Evidence Graph (R4c): the chain-law links (VERDICT ← EVIDENCE ←
@@ -401,6 +602,34 @@ interface ScanResult {
       configFingerprint: string;
       engineVersion: string;
     };
+    /** The release candidate the verdict belongs to, when bound (V5-010). */
+    candidate?: {
+      manifestId: string;
+      candidateSha: string | null;
+    };
+  };
+  /**
+   * The normalized evidence core (plan V5-011).
+   *
+   * Present whenever the run ingested a runtime report. `records` is the
+   * canonical, deterministically-ordered set that every downstream consumer
+   * reads — before this, the core was computed and discarded inside the
+   * pipeline, so a re-derivation had to re-parse the report and could disagree
+   * with the verdict it was supposed to explain.
+   *
+   * Empty `records` with a null `artifact` means no runtime evidence was
+   * found, which is different from a run that found an empty report.
+   */
+  evidence?: {
+    records: Array<EvidenceRecordShape>;
+    counts: {
+      total: number;
+      failed: number;
+      flaky: number;
+      skipped: number;
+      timedOut: number;
+    };
+    artifact: string | null;
   };
   /**
    * Local incremental cache report (Beta-to-Stable plan, M5.2). Present
@@ -639,6 +868,56 @@ declare class DependencyGraph {
   getDependents(path: string): string[];
   get allPaths(): string[];
   get size(): number;
+  /** Whether the graph knows this exact key. Reachability must not
+   *  treat "not in the graph" as "nothing to traverse" without saying so. */
+  has(path: string): boolean;
+}
+//#endregion
+//#region src/engine/degradation-ledger.d.ts
+/**
+ * One ledger for every silent capability loss.
+ *
+ * The defect class this exists to kill is not a deprecation warning. It is a
+ * `catch` in a DETECTION path that swallows an error and returns a clean
+ * default, so the scan still reports `analysisComplete` while quietly running
+ * with less capability than the reader was promised. Fifteen such sites were
+ * verified in this tree; the AST-layer ones are the worst, because the layer
+ * they degrade is the one that keeps prose comments and sample strings from
+ * becoming false-positive findings.
+ *
+ * Two shapes, one rule. The precedent already in the tree is
+ * `parserRetryDegradationCount` (`src/engine/tree-sitter-ast.ts`): a counted,
+ * readable number rather than a swallowed exception. This generalizes it —
+ * every site records a REASON from the closed set below, and the scan result
+ * carries the per-reason counts, so "the parser failed" becomes
+ * "the AST mask was unavailable for 3 files".
+ *
+ * The ledger is APPEND-ONLY and process-scoped, which has one consequence
+ * worth stating because it is the security-relevant direction: `beginWindow`
+ * returns a MARKER, not an ownership claim. Two concurrent `runScan` calls in
+ * one process (there is a test that does exactly this,
+ * `tests/stress/concurrent-same-process.spec.ts`) each read the records
+ * appended after their own marker, so a degradation one scan records may be
+ * counted by the other. That can only ever OVER-count — a scan reporting a
+ * degradation that happened to a sibling is more cautious than the truth, and
+ * never less — so the failure direction is the honest one. The alternative,
+ * a sink threaded through every rule context, is a diff across every call site
+ * in the tree to fix a problem that cannot make a scan look better than it is.
+ */
+/**
+ * Every reason a detection path may lose capability.
+ *
+ * Closed on purpose: a `catch` site that wants a new reason has to add it
+ * here, which is the moment a reviewer sees the claim. `tests/contract/
+ * no-uncounted-degradation.spec.ts` reads this list and fails on any `catch`
+ * in a detection path that neither rethrows, records one of these, nor
+ * appears in its allowlist with a stated reason.
+ */
+declare const DEGRADATION_REASONS: readonly ["ast-parse-failed", "ast-mask-unavailable", "ast-range-scan-failed", "ci-workflow-listing-unreadable", "workspace-manifest-unreadable", "java-build-listing-unreadable", "rules-tree-listing-unreadable", "trend-record-unparseable", "explain-fixture-unreadable", "explain-workflow-parse-failed", "explain-rule-crash", "rule-doc-rule-crash", "rule-doc-fixture-unreadable", "rule-doc-workflow-parse-failed"];
+type DegradationReason = (typeof DEGRADATION_REASONS)[number];
+interface DegradationCount {
+  readonly reason: DegradationReason;
+  readonly count: number;
 }
 //#endregion
 //#region src/discovery/workspace.d.ts
@@ -657,9 +936,18 @@ interface Workspace {
 }
 //#endregion
 //#region src/discovery/frameworks.d.ts
-type TestFramework = "jest" | "vitest" | "playwright";
+/**
+ * The catalogued frameworks whose detection is implemented today.
+ *
+ * Every entry must exist in the inventory — enforced by the parity spec, not
+ * by comment.
+ */
+declare const DETECTABLE_TEST_FRAMEWORKS: readonly ["jest", "vitest", "playwright"];
+/** The detection output type, in the inventory's vocabulary. */
+type DetectedFramework = (typeof DETECTABLE_TEST_FRAMEWORKS)[number];
 interface FrameworkInfo$1 {
-  frameworks: TestFramework[];
+  /** Detected frameworks, as inventory ids. */
+  frameworks: DetectedFramework[];
   /** True when no config evidence was found at all. */
   unknown: boolean;
 }
@@ -991,8 +1279,19 @@ interface LanguageAdapter {
    * Contract: resolve to a ParsedAst on success, `undefined` when this
    * adapter has no AST layer (or parsing failed — rules fall back to the
    * regex path either way). Never throws.
+   *
+   * May return the result directly as well as a promise: the ts-morph path
+   * (plan V5-021) is synchronous, and forcing it to allocate a promise per
+   * file would be a cost the shared seam has no business imposing. The
+   * pipeline awaits either form.
+   *
+   * Declared as a PROPERTY, not a method signature. A method signature
+   * promises a `this` binding that no adapter uses, and it makes every
+   * consumer that reads `adapter.parseAst` trip the unbound-method rule —
+   * which is a lint error that gets suppressed rather than a design that
+   * gets fixed, so the shape has to say what it means.
    */
-  parseAst?(file: ParsedFile): Promise<ParsedAst | undefined>;
+  parseAst?: (file: ParsedFile) => ParsedAst | undefined | Promise<ParsedAst | undefined>;
   /**
    * Run all rules this adapter hosts against one file. `onCrash` is
    * invoked when a rule throws (audit R-9) — the crash is still
@@ -1045,6 +1344,55 @@ interface UniversalRule {
   run(file: ParsedFile): Array<Omit<Finding, "ruleId" | "category">>;
 }
 //#endregion
+//#region src/engine/evidence-core.d.ts
+/**
+ * The core's own version — stamped into every record's provenance so a
+ * consumer can tell which normalization contract produced a record.
+ * Bump ONLY on a semantic change to the normalization itself.
+ */
+declare const EVIDENCE_CORE_VERSION = "evidence-core@1";
+/** Evidence source formats the core understands today (WI-17 adds trace.zip). */
+type EvidenceSource = ForensicsReport["source"];
+/** Normalized per-test runtime evidence (plan WI-2 field contract). */
+interface EvidenceRecord {
+  /** Where this evidence came from (format identity). */
+  source: EvidenceSource;
+  /** Ingested artifact identity — the report path the records derive from. */
+  artifact: string;
+  /** Test identity: file + title (+ declaration line when known). */
+  file: string;
+  title: string;
+  /** 1-based declaration line when the source carries one (JUnit: absent). */
+  line?: number;
+  /** Normalized execution status facts. */
+  status: {
+    /** Last attempt's outcome. */
+    final: RunStatus;
+    /** Failed at least once across attempts. */
+    failed: boolean;
+    /** Executed more than once. */
+    retried: boolean;
+    /** Passed only on attempt >= 2 (TRUE-FLAKE). */
+    passedOnRetry: boolean;
+    skipped: boolean;
+    /** Final attempt timed out. */
+    timedOut: boolean;
+  };
+  /** Number of attempts (retries = attempts − 1). */
+  attempts: number;
+  /** Total duration across attempts. */
+  durationMs: number;
+  /** Error messages, in report order. Empty: not captured by this source yet. */
+  errors: string[];
+  /** Attachment names/paths. Empty: not captured by this source yet (WI-17). */
+  attachments: string[];
+  /** Where the record came from and under which normalization contract. */
+  provenance: {
+    core: typeof EVIDENCE_CORE_VERSION;
+    ingest: "mjolnir.forensics";
+  };
+}
+//#endregion
 //#region src/engine/provenance.d.ts
 type FileProvenance = "unmarked" | "generated-marked" | "codegen-like";
 /** Classify one file's provenance. Pure. */
@@ -1072,7 +1420,7 @@ interface IgnoreEntry {
   ruleId: string;
   files?: string[];
   reason: string;
-  /** ISO date; defaults to 90 days from creation (S11). */
+  /** ISO date; omitted means the suppression has no expiry. */
   expires?: string;
 }
 interface QADoctorConfig {
@@ -1298,6 +1646,12 @@ interface FileAnalysisResult {
   parseFallbacks: number;
   scanned: number;
   analyzed: number;
+  /**
+   * Files that HAD an AST stage and lost it to the scan deadline, so they
+   * were analyzed by regex alone. Zero for every adapter that declares no
+   * `parseAst` — that is a capability envelope, not a downgrade.
+   */
+  astFallbackFiles: number;
 }
 declare function runFileAnalysisPhase(findings: Finding[], testFiles: string[], workspace: Workspace, activeRules: UniversalRule[], hooks: ScanHooks, cache: ScanCache, rulesDigest: string, deadline: number, truncationReasons: Set<string>, declarationsByFile: Map<string, number>, fileProvenance: Array<{
   path: string;
@@ -1313,6 +1667,12 @@ interface PostScanResult {
   frameworks: ReturnType<typeof detectFrameworks>;
   runtimeReportPath: string | undefined;
   runtimeIncomplete: boolean;
+  /**
+   * The normalized evidence core (V5-011). Persisted rather than discarded,
+   * so every post-ingest projection reads records instead of re-parsing a
+   * report that may have changed underneath it.
+   */
+  evidenceRecords: EvidenceRecord[];
   /** Aggregate forensic classifications from the ingested runtime report. */
   forensicVerdicts: ForensicVerdictSummary | undefined;
   config: ReturnType<typeof loadConfig>["config"];
@@ -1339,6 +1699,14 @@ interface AssembleScanResultInput {
   scopeUnrecognized: number;
   parseFailed: number;
   parseFallbacks?: number;
+  /** Files that lost their AST stage to the scan deadline. See completion.ts. */
+  astFallbackFiles?: number;
+  /**
+   * Reason-coded capability losses recorded during this scan's window. See
+   * `src/engine/degradation-ledger.ts` for why the window is an index rather
+   * than an ownership claim.
+   */
+  degradations?: readonly DegradationCount[];
   scanned: number;
   analyzed?: number;
   testFiles: string[];
@@ -1360,6 +1728,7 @@ interface AssembleScanResultInput {
   frameworks: ReturnType<typeof detectFrameworks>;
   runtimeReportPath: string | undefined;
   runtimeIncomplete?: boolean;
+  evidenceRecords?: EvidenceRecord[];
   forensicVerdicts: ForensicVerdictSummary | undefined;
   config: ReturnType<typeof loadConfig>["config"];
   fileProvenance: Array<{
@@ -1393,7 +1762,7 @@ declare function runScan$1(args: CliArgs, hooks?: ScanHooks): Promise<ScanResult
  * scripts/sync-sarif-version.cjs and guarded by the version-consistency
  * spec. cli.ts re-exports this as CLI_VERSION.
  */
-declare const ENGINE_VERSION = "3.0.0";
+declare const ENGINE_VERSION = "5.0.0";
 //#endregion
 //#region src/cli-io.d.ts
 /**
@@ -1575,11 +1944,17 @@ export declare function runReleaseTrustCommand(argv: string[], io?: {
  * Entry point for `mjolnir business-case`.
  *
  * Flags:
- *   --industry <type>    Industry cost profile (default/fintech/healthcare/...)
- *   --history <months>   Use git history for the last N months (estimates from
- *                        actual scan improvements, not projections)
- *   --projected <months> Show projected savings over N months
+ *   --incident-cost <n>  The cost of ONE false-green incident in your
+ *                        organisation. Until you supply it, no dollar
+ *                        figure is printed at all.
  *   --strict             Include quarantine-tier findings
+ *
+ * `--history` and `--projected` are GONE. Both promised arithmetic this
+ * tool cannot do: `--history` claimed to estimate from actual scan
+ * improvements while reading no history at all, and `--projected` divided
+ * the total by six and called the quotient a monthly rate. A flag that
+ * does not do what its help says is worse than no flag, because the help
+ * is the promise.
  */
 export declare function runBusinessCaseCommand(argv: string[], io?: {
   out: Output;
@@ -1623,7 +1998,7 @@ export declare function runPolicyCommand(argv: string[], io: {
 export declare function runQuarantineCommand(argv: string[], io: {
   out: Output;
   err: Output;
-}): Promise<number>;
+}): number;
 //#endregion
 //#region src/commands/analyze.d.ts
 export declare function runAnalyzeCommand(argv: string[], io: {
@@ -1699,7 +2074,7 @@ export declare const MAX_DURATION_MS = 3600000;
 export declare function parseArgs(argv: string[], onError?: (detail: UsageErrorDetail) => void): CliArgs | null;
 /** Hand-rolled Levenshtein distance (plan M2: no new dependencies). */
 export declare function levenshtein(a: string, b: string): number;
-/** Nearest known flags within distance ≤ 2, nearest first. */
+/** Nearest known flags within distance ≤ 2, nearest first. */
 export declare function nearestFlags(flag: string, max?: number): string[];
 /**
  * Friendly usage error (plan M2, exit 10 preserved): nearest-flag
@@ -1724,9 +2099,14 @@ export declare function parseArgsOrUsage(argv: string[], io: {
  */
 export declare function validateScanTarget(target: string, err: Output): number | null;
 /**
- * Exit-code decision for a finished scan under the given gate level
- * (audit H-7): the previously-dead config.gate field now selects which
- * severities block. Advisory (E0) findings never gate at any level.
+ * Exit-code decision for findings only (audit H-7): the previously-dead
+ * config.gate field selects which severities block. Advisory (E0) findings
+ * never gate at any level.
+ *
+ * This is a findings-only view of the one exit matrix in `claim-evidence`.
+ * Callers that have just finished an ANALYSIS must use `scanExitCode`
+ * instead — this function cannot see `partial`, and a truncated scan with
+ * zero findings is exactly the case that turns a bug into a green build.
  */
 export declare function exitForFindings(findings: readonly Finding[], gate: "advisory" | "error" | "warning"): number;
 /** Testable `ci install` handler. Returns the process exit code. */
@@ -1756,4 +2136,5 @@ export declare function runHelpCommand(argv: string[], io?: {
 }): number;
 export declare function isEntryPoint(): boolean;
 //#endregion
-export { ENGINE_VERSION as CLI_VERSION, type CliArgs, type Output, type ScanHooks };
+export { ENGINE_VERSION as CLI_VERSION, type CliArgs, type Output, type ScanHooks };
+//# sourceMappingURL=cli.d.mts.map