mjolnir-qa 6.0.0 → 6.1.0

package/dist/cli.d.mts

@@ -1,4 +1,3 @@
-//#region src/types.d.ts
 /**
  * Mjolnir — canonical types (JSON contract v1, schemaVersion 1).
  *
@@ -739,11 +738,7 @@ interface ForensicVerdictSummary {
   /** INCONCLUSIVE outcome count — a first-class result, not a failure. */
   inconclusive: number;
 }
-//#endregion
-//#region src/engine/tier-policy.d.ts
 type Tier = "core" | "extended" | "quarantine";
-//#endregion
-//#region src/engine/overlap-dedup.d.ts
 /** Per-rule metadata the dedup pass needs, built from RULES. */
 interface OverlapMeta {
   /** Rule IDs this rule can double-report on the same root cause. */
@@ -753,8 +748,6 @@ interface OverlapMeta {
   /** RULES registry order for final tie-breaking. */
   order?: number;
 }
-//#endregion
-//#region src/forensics/classify.d.ts
 declare const FORENSIC_VERDICTS: readonly ["likely-real-defect", "environmental-failure", "infrastructure-failure", "flaky", "retry-dependent", "unstable-construction", "inconclusive"];
 type ForensicVerdict = (typeof FORENSIC_VERDICTS)[number];
 declare const EVIDENCE_STATES: readonly ["exists", "absent", "unsupported", "contradictory", "insufficient"];
@@ -769,8 +762,6 @@ interface ForensicClassification {
     construction: number;
   };
 }
-//#endregion
-//#region src/forensics/types.d.ts
 type RunStatus = "passed" | "failed" | "timedOut" | "skipped" | "interrupted";
 /** Derived per-test reliability facts. */
 interface TestVerdict {
@@ -841,80 +832,6 @@ interface ForensicsReport {
   /** Named reasons for incompleteness (e.g. "size-limit", "cumulative-size-limit", "parse-failure"). */
   incompleteReasons: string[];
 }
-//#endregion
-//#region src/engine/dependency-graph.d.ts
-/**
- * Dependency Graph (ECO-005).
- *
- * Parses package manifests (package.json, pyproject.toml, pom.xml) to
- * build a dependency graph. Supports transitive dependency resolution,
- * dependent lookup, and reachable-file computation from test files.
- */
-interface DependencyNode {
-  path: string;
-  dependencies: string[];
-}
-declare class DependencyGraph {
-  private readonly nodes;
-  addNode(node: DependencyNode): void;
-  getDependencies(path: string): string[];
-  getTransitiveDependencies(path: string): string[];
-  getDependents(path: string): string[];
-  get allPaths(): string[];
-  get size(): number;
-  /** Whether the graph knows this exact key. Reachability must not
-   *  treat "not in the graph" as "nothing to traverse" without saying so. */
-  has(path: string): boolean;
-}
-//#endregion
-//#region src/engine/degradation-ledger.d.ts
-/**
- * One ledger for every silent capability loss.
- *
- * The defect class this exists to kill is not a deprecation warning. It is a
- * `catch` in a DETECTION path that swallows an error and returns a clean
- * default, so the scan still reports `analysisComplete` while quietly running
- * with less capability than the reader was promised. Fifteen such sites were
- * verified in this tree; the AST-layer ones are the worst, because the layer
- * they degrade is the one that keeps prose comments and sample strings from
- * becoming false-positive findings.
- *
- * Two shapes, one rule. The precedent already in the tree is
- * `parserRetryDegradationCount` (`src/engine/tree-sitter-ast.ts`): a counted,
- * readable number rather than a swallowed exception. This generalizes it —
- * every site records a REASON from the closed set below, and the scan result
- * carries the per-reason counts, so "the parser failed" becomes
- * "the AST mask was unavailable for 3 files".
- *
- * The ledger is APPEND-ONLY and process-scoped, which has one consequence
- * worth stating because it is the security-relevant direction: `beginWindow`
- * returns a MARKER, not an ownership claim. Two concurrent `runScan` calls in
- * one process (there is a test that does exactly this,
- * `tests/stress/concurrent-same-process.spec.ts`) each read the records
- * appended after their own marker, so a degradation one scan records may be
- * counted by the other. That can only ever OVER-count — a scan reporting a
- * degradation that happened to a sibling is more cautious than the truth, and
- * never less — so the failure direction is the honest one. The alternative,
- * a sink threaded through every rule context, is a diff across every call site
- * in the tree to fix a problem that cannot make a scan look better than it is.
- */
-/**
- * Every reason a detection path may lose capability.
- *
- * Closed on purpose: a `catch` site that wants a new reason has to add it
- * here, which is the moment a reviewer sees the claim. `tests/contract/
- * no-uncounted-degradation.spec.ts` reads this list and fails on any `catch`
- * in a detection path that neither rethrows, records one of these, nor
- * appears in its allowlist with a stated reason.
- */
-declare const DEGRADATION_REASONS: readonly ["ast-parse-failed", "ast-mask-unavailable", "ast-range-scan-failed", "ci-workflow-listing-unreadable", "workspace-manifest-unreadable", "java-build-listing-unreadable", "rules-tree-listing-unreadable", "trend-record-unparseable", "explain-fixture-unreadable", "explain-workflow-parse-failed", "explain-rule-crash", "rule-doc-rule-crash", "rule-doc-fixture-unreadable", "rule-doc-workflow-parse-failed", "python-manifest-unreadable", "ast-grammar-unavailable", "ast-typescript-parse-failed", "workflow-parse-failed"];
-type DegradationReason = (typeof DEGRADATION_REASONS)[number];
-interface DegradationCount {
-  readonly reason: DegradationReason;
-  readonly count: number;
-}
-//#endregion
-//#region src/discovery/workspace.d.ts
 /**
  * Repository discovery (Sprint-Plan W1-03).
  * Finds project root, parses package.json, detects npm/yarn/pnpm workspaces.
@@ -928,26 +845,6 @@ interface Workspace {
   /** Glob patterns from the root package.json workspaces field. */
   workspaceGlobs: string[];
 }
-//#endregion
-//#region src/discovery/frameworks.d.ts
-/**
- * The catalogued frameworks whose detection is implemented today.
- *
- * Every entry must exist in the inventory — enforced by the parity spec, not
- * by comment.
- */
-declare const DETECTABLE_TEST_FRAMEWORKS: readonly ["jest", "vitest", "playwright"];
-/** The detection output type, in the inventory's vocabulary. */
-type DetectedFramework = (typeof DETECTABLE_TEST_FRAMEWORKS)[number];
-interface FrameworkInfo$1 {
-  /** Detected frameworks, as inventory ids. */
-  frameworks: DetectedFramework[];
-  /** True when no config evidence was found at all. */
-  unknown: boolean;
-}
-declare function detectFrameworks(ws: Workspace): FrameworkInfo$1;
-//#endregion
-//#region src/rules/rule.d.ts
 /**
  * How the rule's primary detection decision is made (Verification Trust
  * Evolution Plan §09.6/§12.1 — the enforced D6 enum, replacing free text):
@@ -1309,14 +1206,6 @@ interface QADoctorRule extends RuleMeta {
   astQuery?: AstQueryHook;
   run: RuleFn;
 }
-//#endregion
-//#region src/discovery/ignores.d.ts
-/** An immutable, per-root resolved ignore matcher (audit R-8). */
-interface IgnoreMatcher {
-  isIgnored(relPath: string): boolean;
-}
-//#endregion
-//#region src/engine/adapter.d.ts
 /** Semantic operations a parsed file exposes to rules. */
 interface ParsedFile {
   path: string;
@@ -1340,98 +1229,6 @@ interface ParsedFile {
    */
   frameworkTags?: readonly string[];
 }
-interface FrameworkInfo {
-  frameworks: string[];
-  unknown: boolean;
-}
-/**
- * The result of the async parse stage (Verification Trust Evolution Plan
- * Phase 0.5, §10): an AST plus its explicit disposal path. The scan
- * pipeline calls `dispose()` exactly once per file, in a
- * finally-equivalent position that runs whether or not rules completed —
- * normal completion, rule crash, per-file budget expiry, or scan abort.
- */
-interface ParsedAst {
-  /** Consumed synchronously by rules via `ParsedFile.ast`. */
-  ast: unknown;
-  /** Release WASM/AST resources (`tree.delete()` for tree-sitter). */
-  dispose(): void;
-}
-interface ScanContext {
-  workspace: Workspace;
-  /** Absolute paths of discovered test files. */
-  testFiles: string[];
-  deadline: number;
-  /** Resolved per-scan ignore matcher (audit R-8) — no module globals. */
-  ignoreMatcher: IgnoreMatcher;
-  /** Called once per file that could not be read/analyzed. */
-  onSkippedFile: (reason: string) => void;
-  /**
-   * Called when discovery stops early (audit H-8): deadline expiry or
-   * the per-adapter file cap. The reason is named in analysisStatus.
-   */
-  onDiscoveryTruncated: (reason: string) => void;
-  /** Per-adapter discovery budget (audit H-8). One language can no
-   * longer consume the whole list and starve the others. */
-  maxFiles: number;
-  /** R4c Scope Integrity: counted matcher exclusions (optional — adapters
-   * whose discovery walks sharedWalk pass this through to the counters). */
-  onIgnored?: (path: string) => void;
-  /** R4c Scope Integrity: counted files no adapter claims (optional). */
-  onUnrecognized?: (path: string) => void;
-  /**
-   * Called when a rule throws on a file (audit R-9): crash isolation
-   * stays silent by default, but the scan counts it and `--debug`
-   * surfaces it.
-   */
-  onRuleCrash?: (ruleId: string, file: string, error: unknown) => void;
-}
-interface LanguageAdapter {
-  readonly id: string;
-  readonly extensions: readonly string[];
-  /** Human-readable patterns this adapter searches for (empty-state UX). */
-  readonly testFileGlobs: readonly string[];
-  /** Dependency/output directory names this adapter never enters. */
-  readonly dirSkips: readonly string[];
-  /** Canonical test-file check per ecosystem conventions. */
-  isTestFile(path: string): boolean;
-  detectFrameworks(root: string): FrameworkInfo;
-  discoverTestFiles(ctx: ScanContext): void;
-  /**
-   * Async parse stage (Verification Trust Evolution Plan Phase 0.5, §10):
-   * awaited by the scan pipeline between discovery and rule execution.
-   * `runRules` and every rule stay synchronous and consume the produced
-   * tree via `ParsedFile.ast` — the engine is NOT async end-to-end, only
-   * this one seam is (WASM grammar load is inherently async).
-   *
-   * Contract: resolve to a ParsedAst on success, `undefined` when this
-   * adapter has no AST layer (or parsing failed — rules fall back to the
-   * regex path either way). Never throws.
-   *
-   * May return the result directly as well as a promise: the ts-morph path
-   * (plan V5-021) is synchronous, and forcing it to allocate a promise per
-   * file would be a cost the shared seam has no business imposing. The
-   * pipeline awaits either form.
-   *
-   * Declared as a PROPERTY, not a method signature. A method signature
-   * promises a `this` binding that no adapter uses, and it makes every
-   * consumer that reads `adapter.parseAst` trip the unbound-method rule —
-   * which is a lint error that gets suppressed rather than a design that
-   * gets fixed, so the shape has to say what it means.
-   */
-  parseAst?: (file: ParsedFile) => ParsedAst | undefined | Promise<ParsedAst | undefined>;
-  /**
-   * Run all rules this adapter hosts against one file. `onCrash` is
-   * invoked when a rule throws (audit R-9) — the crash is still
-   * isolated, but never invisible. `budget` (audit P-1) stops rule
-   * execution mid-file when a single file is too expensive to analyze
-   * in full; the caller reports the skip honestly.
-   */
-  runRules(rules: readonly UniversalRule[], file: ParsedFile, emit: (f: Omit<Finding, "ruleId" | "category">, ruleId: string, category: string) => void, onCrash?: (ruleId: string, error: unknown) => void, budget?: {
-    deadline: number;
-    onExceeded: () => void;
-  }): void;
-}
 /**
  * A rule that declares which adapters it supports. Backward compatible:
  * legacy 'test-files' maps to ['typescript'], 'ci-workflows' to
@@ -1471,103 +1268,6 @@ interface UniversalRule {
   detectorRevision?: number;
   run(file: ParsedFile): Array<Omit<Finding, "ruleId" | "category">>;
 }
-//#endregion
-//#region src/engine/evidence-core.d.ts
-/**
- * The core's own version — stamped into every record's provenance so a
- * consumer can tell which normalization contract produced a record.
- * Bump ONLY on a semantic change to the normalization itself.
- */
-declare const EVIDENCE_CORE_VERSION = "evidence-core@1";
-/** Evidence source formats the core understands today (WI-17 adds trace.zip). */
-type EvidenceSource = ForensicsReport["source"];
-/** Normalized per-test runtime evidence (plan WI-2 field contract). */
-interface EvidenceRecord {
-  /** Where this evidence came from (format identity). */
-  source: EvidenceSource;
-  /** Ingested artifact identity — the report path the records derive from. */
-  artifact: string;
-  /** Test identity: file + title (+ declaration line when known). */
-  file: string;
-  title: string;
-  /** 1-based declaration line when the source carries one (JUnit: absent). */
-  line?: number;
-  /** Normalized execution status facts. */
-  status: {
-    /** Last attempt's outcome. */
-    final: RunStatus;
-    /** Failed at least once across attempts. */
-    failed: boolean;
-    /** Executed more than once. */
-    retried: boolean;
-    /** Passed only on attempt >= 2 (TRUE-FLAKE). */
-    passedOnRetry: boolean;
-    skipped: boolean;
-    /** Final attempt timed out. */
-    timedOut: boolean;
-  };
-  /** Number of attempts (retries = attempts − 1). */
-  attempts: number;
-  /** Total duration across attempts. */
-  durationMs: number;
-  /** Error messages, in report order. Empty: not captured by this source yet. */
-  errors: string[];
-  /** Attachment names/paths. Empty: not captured by this source yet (WI-17). */
-  attachments: string[];
-  /** Where the record came from and under which normalization contract. */
-  provenance: {
-    core: typeof EVIDENCE_CORE_VERSION;
-    ingest: "mjolnir.forensics";
-  };
-}
-//#endregion
-//#region src/engine/provenance.d.ts
-type FileProvenance = "unmarked" | "generated-marked" | "codegen-like";
-/** Classify one file's provenance. Pure. */
-declare function classifyProvenance(file: {
-  text: string;
-  codeText?: string;
-}): FileProvenance;
-//#endregion
-//#region src/engine/scan-cache.d.ts
-interface CacheStats {
-  hits: number;
-  misses: number;
-  /** Where the cache lives — reported so `--json` consumers can audit it. */
-  file: string;
-}
-interface ScanCache {
-  readonly stats: CacheStats;
-  lookup(key: string): Finding[] | undefined;
-  store(key: string, findings: Finding[], fileBudgetExceeded: boolean): void;
-  persist(): void;
-}
-//#endregion
-//#region src/config/config.d.ts
-interface IgnoreEntry {
-  ruleId: string;
-  files?: string[];
-  reason: string;
-  /** ISO date; omitted means the suppression has no expiry. */
-  expires?: string;
-}
-interface QADoctorConfig {
-  gate?: "advisory" | "error" | "warning";
-  /** Path globs to skip during discovery (see DEFAULT_IGNORES dialect). */
-  exclude?: string[];
-  severityOverrides?: Record<string, Severity>;
-  ignore?: IgnoreEntry[];
-}
-declare function loadConfig(root: string, options?: {
-  knownRuleIds?: ReadonlySet<string>;
-}): {
-  config: QADoctorConfig;
-  path: string | null;
-  /** Non-fatal notes (e.g. unknown rule IDs in severityOverrides). */
-  warnings: string[];
-};
-//#endregion
-//#region src/lib/glob.d.ts
 /**
  * Whether `path` matches `glob`, in the dialect documented above.
  *
@@ -1578,17 +1278,6 @@ declare function loadConfig(root: string, options?: {
  * the defect that made the whole dialect worth unifying.
  */
 declare function pathMatchesGlob$1(path: string, glob: string): boolean;
-declare namespace scan_pipeline_d_exports {
-  export { AssembleScanResultInput, CliArgs, DiscoveryResult, EVIDENCE_OVERRIDES$1 as EVIDENCE_OVERRIDES, FileAnalysisResult, KNOWN_RULE_IDS$1 as KNOWN_RULE_IDS, OVERLAP_META_BY_RULE_ID$1 as OVERLAP_META_BY_RULE_ID, PostScanResult, SUITE_INVALIDATING_RULE_IDS$1 as SUITE_INVALIDATING_RULE_IDS, ScanHooks, applyPostScanProcessing, assembleScanResult, buildUniversalRules$1 as buildUniversalRules, discoverAndParseRuntimeReport$1 as discoverAndParseRuntimeReport, discoverTestFilesPhase, fallbackWorkspace$1 as fallbackWorkspace, isValidFindingRecord$1 as isValidFindingRecord, pathMatchesGlob$1 as pathMatchesGlob, runFileAnalysisPhase, runScan$1 as runScan, selectAdapter, summarizeForensicVerdicts };
-}
-/** Registered rule IDs — used to warn on unknown severityOverrides keys (M4). */
-declare const KNOWN_RULE_IDS$1: ReadonlySet<string>;
-/**
- * R6 (Bug Map M-02): per-rule overlap metadata, built from RULES the
- * same way tierByRuleId is — `asUniversal` drops `overlapWith`, so the
- * dedup map must come from the registry directly.
- */
-declare const OVERLAP_META_BY_RULE_ID$1: ReadonlyMap<string, OverlapMeta>;
 declare function buildUniversalRules$1(root: string, strict?: boolean, opts?: {
   /** CLI trust-gate flag (`--enable-plugins`) for this scan. */
   enablePlugins?: boolean;
@@ -1610,13 +1299,6 @@ declare function buildUniversalRules$1(root: string, strict?: boolean, opts?: {
   /** The same rules, named. The count is the disclosure; this is the evidence. */
   withheldRuleIds: string[];
 }>;
-/** Rule-declared evidence-level overrides (Honesty Core). */
-declare const EVIDENCE_OVERRIDES$1: ReadonlyMap<string, string>;
-/**
- * Rules whose findings void the suite's pass claim (RuleMeta.suiteInvalidating).
- * Built from the registry so the scorer never has to import it.
- */
-declare const SUITE_INVALIDATING_RULE_IDS$1: ReadonlySet<string>;
 interface CliArgs {
   target: string;
   json: boolean;
@@ -1837,131 +1519,6 @@ declare function discoverAndParseRuntimeReport$1(scanRoot: string): {
  * caller) — never silently scored.
  */
 declare function isValidFindingRecord$1(f: unknown): f is Omit<Finding, "ruleId" | "category">;
-/**
- * Replace 7-way nested ternary with a linear probe.
- * Returns the adapter whose `isTestFile` matches the path, falling
- * back to the TypeScript adapter (the default language).
- */
-declare function selectAdapter(path: string): LanguageAdapter;
-interface DiscoveryResult {
-  testFiles: string[];
-  stagedSurface: boolean;
-}
-declare function discoverTestFilesPhase(workspace: Workspace, args: CliArgs, hooks: ScanHooks, scanRoot: Workspace, ctx: ScanContext): DiscoveryResult;
-interface FileAnalysisResult {
-  skippedFiles: number;
-  testFileCount: number;
-  testDeclarationCount: number;
-  rulesPartial: boolean;
-  parseFailed: number;
-  parseFallbacks: number;
-  scanned: number;
-  analyzed: number;
-  /**
-   * Files that HAD an AST stage and lost it to the scan deadline, so they
-   * were analyzed by regex alone. Zero for every adapter that declares no
-   * `parseAst` — that is a capability envelope, not a downgrade.
-   */
-  astFallbackFiles: number;
-}
-declare function runFileAnalysisPhase(findings: Finding[], testFiles: string[], workspace: Workspace, activeRules: UniversalRule[], hooks: ScanHooks, cache: ScanCache, rulesDigest: string, deadline: number, truncationReasons: Set<string>, declarationsByFile: Map<string, number>, fileProvenance: Array<{
-  path: string;
-  provenance: ReturnType<typeof classifyProvenance>;
-}>, onRuleCrash: (ruleId: string, file: string, error: unknown) => void): Promise<FileAnalysisResult>;
-interface PostScanResult {
-  testDeclarationCount: number;
-  scopeInfo: {
-    scope: "all" | "changed";
-    degraded?: string | undefined;
-  };
-  suppressionCount: number;
-  frameworks: ReturnType<typeof detectFrameworks>;
-  runtimeReportPath: string | undefined;
-  runtimeIncomplete: boolean;
-  /**
-   * The normalized evidence core (V5-011). Persisted rather than discarded,
-   * so every post-ingest projection reads records instead of re-parsing a
-   * report that may have changed underneath it.
-   */
-  evidenceRecords: EvidenceRecord[];
-  /** Aggregate forensic classifications from the ingested runtime report. */
-  forensicVerdicts: ForensicVerdictSummary | undefined;
-  config: ReturnType<typeof loadConfig>["config"];
-}
-/**
- * Summarize forensic classifications from an ingested runtime report
- * (plan §10.4, WAVE 5). Returns undefined when no verdict carries a
- * classification — the machine contract slot stays absent rather than
- * reporting all-zero counts.
- */
-declare function summarizeForensicVerdicts(report: ForensicsReport): ForensicVerdictSummary | undefined;
-declare function applyPostScanProcessing(findings: Finding[], workspace: Workspace, args: CliArgs, hooks: ScanHooks, scanRoot: Workspace, declarationsByFile: Map<string, number>, testDeclarationCount: number, tierByRuleId: Map<string, Tier>, REVISION_BY_RULE_ID: Map<string, number>): PostScanResult;
-interface AssembleScanResultInput {
-  findings: Finding[];
-  testFileCount: number;
-  testDeclarationCount: number;
-  declarationsByFile: Map<string, number>;
-  skippedFiles: number;
-  rulesCrashed: number;
-  truncationReasons: Set<string>;
-  discoveryTruncated: boolean;
-  rulesPartial: boolean;
-  scopeIgnored: number;
-  scopeUnrecognized: number;
-  parseFailed: number;
-  parseFallbacks?: number;
-  /** Files that lost their AST stage to the scan deadline. See completion.ts. */
-  astFallbackFiles?: number;
-  /**
-   * Reason-coded capability losses recorded during this scan's window. See
-   * `src/engine/degradation-ledger.ts` for why the window is an index rather
-   * than an ownership claim.
-   */
-  degradations?: readonly DegradationCount[];
-  /**
-   * Rules removed from the run by the quarantine filter because `--strict`
-   * was absent. Threaded from the rule loader — the only site that knows
-   * the withheld set — into `coverageState`. Never an input to `partial`.
-   */
-  rulesWithheld?: number;
-  /** Rules withheld, named. See `buildUniversalRules`. */
-  withheldRuleIds?: string[];
-  /** Rules that actually ran. The denominator `rulesWithheld` is measured against. */
-  rulesApplied?: number;
-  scanned: number;
-  analyzed?: number;
-  testFiles: string[];
-  workspace: Workspace;
-  scanRoot: Workspace;
-  args: CliArgs;
-  hooks: ScanHooks;
-  cache: ScanCache;
-  REVISION_BY_RULE_ID: Map<string, number>;
-  pluginsLoaded: Array<{
-    name: string;
-    rules: number;
-  }>;
-  scopeInfo: {
-    scope: "all" | "changed";
-    degraded?: string | undefined;
-  };
-  suppressionCount: number;
-  frameworks: ReturnType<typeof detectFrameworks>;
-  runtimeReportPath: string | undefined;
-  runtimeIncomplete?: boolean;
-  evidenceRecords?: EvidenceRecord[];
-  forensicVerdicts: ForensicVerdictSummary | undefined;
-  config: ReturnType<typeof loadConfig>["config"];
-  fileProvenance: Array<{
-    path: string;
-    provenance: ReturnType<typeof classifyProvenance>;
-  }>;
-  started: number;
-  stagedSurface: boolean;
-  /** ECO-005: dependency graph built from project manifests. */
-  dependencyGraph?: DependencyGraph;
-}
-declare function assembleScanResult(o: AssembleScanResultInput): ScanResult;
 /**
  * Testable default scan path core. `hooks` lets callers observe
  * normally-invisible events (swallowed rule crashes) without changing
@@ -1986,11 +1543,7 @@ declare function assembleScanResult(o: AssembleScanResultInput): ScanResult;
  * without threading a Project through every adapter.
  */
 declare function runScan$1(args: CliArgs, hooks?: ScanHooks): Promise<ScanResult>;
-//#endregion
-//#region src/engine/version.d.ts
-declare const ENGINE_VERSION = "6.0.0";
-//#endregion
-//#region src/cli-io.d.ts
+declare const ENGINE_VERSION = "6.1.0";
 /**
  * Shared process IO sinks (certification-audit Phase 5, G6): the variadic
  * console sinks and the internal-error reporter lived in cli.ts, which
@@ -2003,15 +1556,11 @@ type Output = (...parts: unknown[]) => void;
 export declare const out: Output;
 export declare const err: Output;
 export declare function internalErrorMessage(err: unknown, emit: (s: string) => void, debug: boolean): void;
-//#endregion
-//#region src/claim-evidence.d.ts
 /**
  * The gate level a command applies to its findings. `advisory` is the
  * `--blocking none` posture: findings are reported and never gate.
  */
 type GateLevel = "advisory" | "error" | "warning";
-//#endregion
-//#region src/commands/why.d.ts
 /**
  * Testable why command core. Returns the process exit code.
  * Live mode awaits the real scan; saved-report mode is synchronous.
@@ -2020,8 +1569,6 @@ export declare function runWhyCommand(argv: string[], io?: {
   out: Output;
   err: Output;
 }): Promise<number>;
-//#endregion
-//#region src/cli-handlers.d.ts
 /**
  * Render scan output in the requested format.
  *
@@ -2135,8 +1682,6 @@ export declare function runDoctorPlaywright(argv: string[], io?: {
   out: Output;
   err?: Output;
 }): Promise<number>;
-//#endregion
-//#region src/commands/milestone.d.ts
 export declare function runFrameworkMaturityCommand(argv: string[], io?: {
   out: Output;
   err: Output;
@@ -2157,14 +1702,10 @@ export declare function runCIIntegrityCommand(argv: string[], io?: {
   out: Output;
   err: Output;
 }): Promise<number>;
-//#endregion
-//#region src/commands/doctor-run.d.ts
 export declare function runDoctorCommand(argv: string[], io?: {
   out: Output;
   err: Output;
 }): number;
-//#endregion
-//#region src/commands/handoff.d.ts
 /**
  * Testable handoff command core. Returns the process exit code.
  * `mjolnir handoff [mjolnir.json] [--category <cat>]... [--rules <ids>]`
@@ -2173,8 +1714,6 @@ export declare function runHandoffCommand(argv: string[], io?: {
   out: Output;
   err: Output;
 }): number;
-//#endregion
-//#region src/commands/install-agents.d.ts
 /**
  * Testable install command core. Returns the process exit code.
  * `mjolnir install [--dry-run] [--force]` — probes the given cwd
@@ -2184,8 +1723,6 @@ export declare function runInstallCommand(argv: string[], io?: {
   out: Output;
   err: Output;
 }, cwd?: string): number;
-//#endregion
-//#region src/commands/release-trust.d.ts
 /**
  * CLI verb: `mjolnir ci release-trust [--json] [repo-root]`.
  * Exit contract (frozen set): 0 verdict PASS · 1 verdict non-PASS ·
@@ -2196,39 +1733,27 @@ export declare function runReleaseTrustCommand(argv: string[], io?: {
   out: Output;
   err: Output;
 }): number;
-//#endregion
-//#region src/commands/policy.d.ts
 export declare function runPolicyCommand(argv: string[], io: {
   out: Output;
   err: Output;
 }): Promise<number>;
-//#endregion
-//#region src/commands/analyze.d.ts
 export declare function runAnalyzeCommand(argv: string[], io: {
   out: Output;
   err: Output;
 }): number;
-//#endregion
-//#region src/commands/ci-adapter.d.ts
 export declare function runCiAdapterCommand(argv: string[], io: {
   out: Output;
   err: Output;
 }): number;
-//#endregion
-//#region src/commands/contract-verify.d.ts
 export declare function runContractVerifyCommand(argv: string[], io?: {
   out: Output;
   err: Output;
 }): Promise<number>;
-//#endregion
-//#region src/commands/release-trend.d.ts
 export declare function runTrustTrendCommand(argv: string[], io?: {
   out: Output;
   err: Output;
 }): Promise<number>;
-//#endregion
-//#region src/cli.d.ts
-export declare const runScan: typeof runScan$1, buildUniversalRules: typeof buildUniversalRules$1, fallbackWorkspace: typeof fallbackWorkspace$1, pathMatchesGlob: typeof pathMatchesGlob$1, isValidFindingRecord: typeof isValidFindingRecord$1, discoverAndParseRuntimeReport: typeof discoverAndParseRuntimeReport$1, KNOWN_RULE_IDS: ReadonlySet<string>, OVERLAP_META_BY_RULE_ID: ReadonlyMap<string, OverlapMeta>, EVIDENCE_OVERRIDES: ReadonlyMap<string, string>, SUITE_INVALIDATING_RULE_IDS: ReadonlySet<string>;
+export declare const runScan: typeof runScan$1, buildUniversalRules: typeof buildUniversalRules$1, fallbackWorkspace: typeof fallbackWorkspace$1, pathMatchesGlob: typeof pathMatchesGlob$1, isValidFindingRecord: typeof isValidFindingRecord$1, discoverAndParseRuntimeReport: typeof discoverAndParseRuntimeReport$1, KNOWN_RULE_IDS: ReadonlySet<string>, OVERLAP_META_BY_RULE_ID: ReadonlyMap<string, OverlapMeta>, EVIDENCE_OVERRIDES: ReadonlyMap<string, string>, SUITE_INVALIDATING_RULE_IDS: ReadonlySet<string>, DEFAULT_MAX_DURATION_MS: number, MAX_DURATION_MS: number;
 /** A usage-error detail: the offending token, when one exists. */
 export interface UsageErrorDetail {
   /** The unknown flag or rejected value (e.g. `--nope`, `loud`). */
@@ -2236,9 +1761,17 @@ export interface UsageErrorDetail {
   /** The flag whose value was rejected (`--tone` for `--tone loud`). */
   flag?: string | undefined;
 }
-export declare const DEFAULT_MAX_DURATION_MS = 600000;
-export declare const MAX_DURATION_MS = 3600000;
 export declare function parseArgs(argv: string[], onError?: (detail: UsageErrorDetail) => void): CliArgs | null;
+/**
+ * Scan flags that exist — the "did you mean" candidate pool.
+ *
+ * Every flag `parseArgs` accepts, and nothing it rejects. The pool had
+ * drifted both ways: ten accepted flags were missing, and `--dry-run` and
+ * `--version` were in it although a scan rejects them, so `mjolnir scan
+ * --dry-run` answered `unknown flag "--dry-run"` and then suggested it.
+ * tests/cli/help.spec.ts reads `parseArgs` to hold the two lists together.
+ */
+export declare const KNOWN_SCAN_FLAGS: string[];
 /** Hand-rolled Levenshtein distance (plan M2: no new dependencies). */
 export declare function levenshtein(a: string, b: string): number;
 /** Nearest known flags within distance ≤ 2, nearest first. */
@@ -2304,6 +1837,5 @@ export declare function runHelpCommand(argv: string[], io?: {
   err: Output;
 }): number;
 export declare function isEntryPoint(): boolean;
-//#endregion
 export { ENGINE_VERSION as CLI_VERSION, type CliArgs, type Output, type ScanHooks };
 //# sourceMappingURL=cli.d.mts.map