sfscanner 0.0.0-stage → 0.2.0

package/dist/v2/commands.d.ts

@@ -0,0 +1,155 @@
+import type { CliCommandV2 } from './arguments.js';
+type CliSeverityV2 = 'CRITICAL' | 'HIGH' | 'MEDIUM' | 'LOW' | 'INFO';
+type CliConfidenceV2 = 'LOW' | 'MEDIUM' | 'HIGH';
+export type CliRuleSummaryV2 = Readonly<{
+    ruleId: string;
+    revision: string;
+    effect: 'SCORING' | 'REPORT_ONLY';
+    severity: CliSeverityV2;
+    confidence: CliConfidenceV2;
+    capabilityId: string;
+    evidenceSchemaId: string;
+    remediationId: string;
+    cweIds: readonly string[];
+    owaspAgenticIds: readonly string[];
+}>;
+export type CliArtifactIdentityV2 = Readonly<{
+    profile: {
+        id: string;
+        version: string;
+    };
+    ruleset: {
+        id: string;
+        version: string;
+        digest: string;
+        signatureStatus: 'VERIFIED' | 'UNVERIFIED';
+    };
+    semantics: {
+        id: string;
+        version: string;
+        digest: string;
+    };
+    target: {
+        edition: 'UNKNOWN';
+        deployment: 'UNKNOWN';
+        role: 'UNKNOWN';
+        taskRunner: 'UNKNOWN';
+        communityPackages: readonly never[];
+        configuration: readonly never[];
+        contextDigest: string;
+    };
+    limits: {
+        schemaVersion: 'scanner-limits-v2';
+        digest: string;
+    };
+}>;
+export type CliRulesDocumentV2 = Readonly<{
+    schemaVersion: 'n8n-scan-rules-v2';
+    tool: ToolV2;
+    artifacts: CliArtifactIdentityV2;
+    rules: readonly CliRuleSummaryV2[];
+}>;
+export type CliExplainDocumentV2 = Readonly<{
+    schemaVersion: 'n8n-scan-explain-v2';
+    tool: ToolV2;
+    artifacts: CliArtifactIdentityV2;
+    rule: CliRuleSummaryV2;
+    prose: ProseV2;
+    evidenceProperties: readonly string[];
+    provenance: {
+        packDigest: string;
+        semanticsDigest: string;
+    };
+}>;
+export type CliProfileSummaryV2 = Readonly<{
+    id: string;
+    version: string;
+    admitted: boolean;
+    advertised: boolean;
+    digest: string;
+    scoringPolicyVersion: string;
+    capabilities: readonly CapabilityV2[];
+}>;
+export type CliProfilesDocumentV2 = Readonly<{
+    schemaVersion: 'n8n-scan-profiles-v2';
+    tool: ToolV2;
+    profiles: readonly CliProfileSummaryV2[];
+}>;
+export type CliVersionDocumentV2 = Readonly<{
+    schemaVersion: 'n8n-scan-version-v2';
+    name: 'n8n-scan';
+    cliVersion: string;
+    engine: {
+        id: 'secureflow-scanner';
+        version: '2.0.0';
+        buildDigest: string;
+    };
+    resultSchemas: readonly ['scanner-result-v1', 'scanner-result-v2'];
+    configSchema: 'n8n-scan-config-v2';
+    rulesetDigest: string;
+    semanticsDigest: string;
+    trustStoreDigest: string;
+    mode: 'offline';
+}>;
+export type CliConfigValidationDocumentV2 = Readonly<{
+    schemaVersion: 'n8n-scan-config-validation-v2';
+    valid: true;
+    artifacts: CliArtifactIdentityV2;
+}>;
+export type CliMetadataDocumentV2 = CliRulesDocumentV2 | CliExplainDocumentV2 | CliProfilesDocumentV2 | CliVersionDocumentV2 | CliConfigValidationDocumentV2;
+export type CliCommandResultV2 = Readonly<{
+    ok: true;
+    document: CliMetadataDocumentV2;
+} | {
+    ok: true;
+    command: Extract<CliCommandV2, {
+        kind: 'scan';
+    }>;
+} | {
+    ok: false;
+    code: 'USAGE';
+    message: string;
+}>;
+type ToolV2 = Readonly<{
+    name: 'n8n-scan';
+    version: string;
+    buildDigest: string;
+}>;
+type ProseV2 = Readonly<{
+    title: string;
+    message: string;
+    explanation: string;
+    whyItMatters: string;
+    possibleImpact: string;
+    remediation: string;
+    remediationSteps: readonly string[];
+}>;
+type CapabilityV2 = Readonly<{
+    id: string;
+    version: string;
+    required: boolean;
+    dependsOn: readonly string[];
+    ruleIds: readonly string[];
+}>;
+export declare function rulesDocumentV2(): CliRulesDocumentV2;
+export declare function explainDocumentV2(ruleId: string): Readonly<{
+    ok: true;
+    document: CliExplainDocumentV2;
+} | {
+    ok: false;
+    code: 'USAGE';
+    message: string;
+}>;
+export declare function profilesDocumentV2(): CliProfilesDocumentV2;
+export declare function versionDocumentV2(): CliVersionDocumentV2;
+export declare function validateConfigDocumentV2(input: unknown, configDirectory?: string): Readonly<{
+    ok: true;
+    document: CliConfigValidationDocumentV2;
+} | {
+    ok: false;
+    code: 'USAGE';
+    message: string;
+}>;
+export declare function isAdmittedConfigPathV2(path: unknown): path is string;
+export declare function runCommandV2(command: CliCommandV2, configInput?: unknown, configDirectory?: string): CliCommandResultV2;
+export {};

package/dist/v2/config.d.ts

@@ -0,0 +1,16 @@
+import { type ScanConfigV2 } from './contracts';
+export type ConfigLoadOptions = Readonly<{
+    configDirectory?: string;
+    cli?: unknown;
+}>;
+export type ConfigLoadResult = Readonly<{
+    ok: true;
+    config: ScanConfigV2;
+} | {
+    ok: false;
+    code: 'INVALID_CONFIG';
+    errors: readonly string[];
+}>;
+export declare function loadExplicitConfig(input: unknown, options?: ConfigLoadOptions): ConfigLoadResult;
+export declare function validateScanConfigV2(input: unknown): ConfigLoadResult;
+export { ADMITTED_PROFILE_V2, BUILTIN_AUTHORITIES_V2, BUILTIN_LIMITS_AUTHORITY_V2, BUILTIN_RULESET_AUTHORITY_V2, BUILTIN_SEMANTICS_AUTHORITY_V2, CLI_TOOL_V2, DEFAULT_SCAN_CONFIG_V2, PROFILE_MANIFEST_DIGEST_V2, RULE_PACK_DIGEST_V2, SCAN_CONFIG_SCHEMA_V2, SEMANTIC_CATALOGUE_DIGEST_V2, type ScanConfigV2, } from './contracts';

package/dist/v2/contracts.d.ts

@@ -0,0 +1,97 @@
+export declare const SCAN_CONFIG_SCHEMA_V2: "n8n-scan-config-v2";
+export type ScanFormatV2 = 'json' | 'ndjson' | 'sarif' | 'table';
+export type ScanSeverityV2 = 'CRITICAL' | 'HIGH' | 'MEDIUM' | 'LOW' | 'INFO';
+export type ScanConfigV2 = Readonly<{
+    schemaVersion: typeof SCAN_CONFIG_SCHEMA_V2;
+    format?: ScanFormatV2;
+    profile?: string;
+    output?: string;
+    inputs?: readonly string[];
+    configPath?: string;
+    failOn?: ScanSeverityV2;
+    requireComplete?: boolean;
+    concurrency?: number;
+    rules?: string;
+    catalogue?: string;
+    limits?: string;
+    target?: string;
+    include?: readonly string[];
+    exclude?: readonly string[];
+    approvedDomains?: readonly string[];
+    allowUnsignedDevelopmentRules?: boolean;
+    noColor?: boolean;
+}>;
+export declare const ADMITTED_PROFILE_V2: Readonly<{
+    id: "beta-default";
+    version: "2.0.0";
+    digest: "3ca5d69db2554383e22c44afe507cc98e381ea58a7e42aaac0ee8f7497fb4f44";
+}>;
+/**
+ * The profile spellings a caller may write, and the one place they are listed. Both the
+ * config loader and the MCP tool read this, so a profile cannot be admitted on one
+ * surface and refused on the other; the bare id and its `id@version` pin are the same
+ * admission, and both canonicalize to `ADMITTED_PROFILE_V2.id`.
+ */
+export declare const ADMITTED_PROFILE_SPECIFIERS_V2: readonly string[];
+export declare function isAdmittedProfileSpecifierV2(value: unknown): value is string;
+export declare const BUILTIN_AUTHORITIES_V2: Readonly<{
+    profile: Readonly<{
+        id: "beta-default";
+        version: "2.0.0";
+        digest: "3ca5d69db2554383e22c44afe507cc98e381ea58a7e42aaac0ee8f7497fb4f44";
+    }>;
+    rules: Readonly<{
+        id: "scanner-core-builtins";
+        version: "2.0.0";
+        digest: "a36d00564bbf8e8c38f05820480782cdc53fdbd3712558850066c4e3f5c3413d";
+        signatureStatus: "VERIFIED";
+    }>;
+    semantics: Readonly<{
+        id: "scanner-core-builtins";
+        version: "2.2.0";
+        digest: "bc6fdecc34e460b5b01973ef7a8ce06b27b9b100ae03b480110f11f2a63ac328";
+    }>;
+    limits: Readonly<{
+        schemaVersion: "scanner-limits-v2";
+        digest: "fca787753ca88f71cf0d174427f4ac730a7aef1c823aaf73aa1ea72af92b4077";
+    }>;
+}>;
+export declare const PROFILE_MANIFEST_DIGEST_V2: "3ca5d69db2554383e22c44afe507cc98e381ea58a7e42aaac0ee8f7497fb4f44";
+export declare const BUILTIN_RULESET_AUTHORITY_V2: Readonly<{
+    id: "scanner-core-builtins";
+    version: "2.0.0";
+    digest: "a36d00564bbf8e8c38f05820480782cdc53fdbd3712558850066c4e3f5c3413d";
+    signatureStatus: "VERIFIED";
+}>;
+export declare const BUILTIN_SEMANTICS_AUTHORITY_V2: Readonly<{
+    id: "scanner-core-builtins";
+    version: "2.2.0";
+    digest: "bc6fdecc34e460b5b01973ef7a8ce06b27b9b100ae03b480110f11f2a63ac328";
+}>;
+export declare const BUILTIN_LIMITS_AUTHORITY_V2: Readonly<{
+    schemaVersion: "scanner-limits-v2";
+    digest: "fca787753ca88f71cf0d174427f4ac730a7aef1c823aaf73aa1ea72af92b4077";
+}>;
+export declare const RULE_PACK_DIGEST_V2: "a36d00564bbf8e8c38f05820480782cdc53fdbd3712558850066c4e3f5c3413d";
+export declare const SEMANTIC_CATALOGUE_DIGEST_V2: "bc6fdecc34e460b5b01973ef7a8ce06b27b9b100ae03b480110f11f2a63ac328";
+/**
+ * One tool identity for every machine surface: the JSON/NDJSON scan envelopes and the
+ * rules/explain/profiles metadata documents. The digest folds the admitted engine, profile,
+ * ruleset, and semantics authorities, so a re-pin moves every surface together instead of
+ * leaving a frozen literal behind on one of them.
+ */
+export declare const CLI_VERSION_V2: "0.1.0";
+export type CliToolIdentityV2 = Readonly<{
+    name: 'n8n-scan';
+    version: string;
+    buildDigest: string;
+}>;
+export declare const CLI_TOOL_V2: CliToolIdentityV2;
+export declare const DEFAULT_SCAN_CONFIG_V2: ScanConfigV2;
+export declare const SCAN_CONFIG_V2_FIELDS: readonly ["schemaVersion", "format", "profile", "output", "inputs", "configPath", "failOn", "requireComplete", "concurrency", "rules", "catalogue", "limits", "target", "include", "exclude", "approvedDomains", "allowUnsignedDevelopmentRules", "noColor"];
+export declare const SCAN_CONFIG_V2_MAX_STRING = 4096;
+export declare const SCAN_CONFIG_V2_MAX_PATTERNS = 1024;
+export declare const SCAN_CONFIG_V2_MAX_CONCURRENCY = 16;
+export declare const SCAN_CONFIG_V2_MAX_DOMAINS = 1000;
+export declare const DOMAIN_V2: RegExp;
+export declare function isApprovedDomainV2(value: unknown): value is string;

package/dist/v2/exit-reducer.d.ts

@@ -0,0 +1,23 @@
+import type { BatchResultV2 } from './batch-runner';
+import type { ScanSeverityV2 } from './contracts';
+export type ExitReasonV2 = 'UNDER_THRESHOLD' | 'FINDING_THRESHOLD' | 'REQUIRE_COMPLETE' | 'ITEM_FAILURE' | 'USAGE' | 'INTERNAL' | 'CANCELLED';
+export type ExitCodeV2 = 0 | 1 | 2 | 3 | 4 | 130;
+export type ExitReductionV2 = Readonly<{
+    reason: ExitReasonV2;
+    code: ExitCodeV2;
+}>;
+export type ExitReducerOptionsV2 = Readonly<{
+    failOn?: ScanSeverityV2;
+    requireComplete?: boolean;
+    interrupted?: boolean;
+    outputFailed?: boolean;
+}>;
+export type ExitReducerInputV2 = Readonly<{
+    batch: BatchResultV2;
+    failOn?: ScanSeverityV2;
+    requireComplete?: boolean;
+    interrupted?: boolean;
+    outputFailed?: boolean;
+}>;
+export declare function reduceExitV2(batch: BatchResultV2, options?: ExitReducerOptionsV2): ExitReductionV2;
+export declare function reduceExitV2(input: ExitReducerInputV2): ExitReductionV2;

package/dist/v2/help.d.ts

@@ -0,0 +1,33 @@
+export declare const V2_COMMANDS: readonly ["scan", "rules", "explain", "profiles", "validate-config", "version"];
+export type V2CommandName = (typeof V2_COMMANDS)[number];
+export type V2OptionName = '--help' | '--schema' | '--format' | '--profile' | '--fail-on' | '--require-complete' | '--max-concurrency' | '--concurrency' | '--timeout' | '--output' | '--config' | '--rules' | '--catalogue' | '--limits' | '--target' | '--n8n-version' | '--edition' | '--deployment' | '--role' | '--task-runner' | '--community-package' | '--configuration' | '--approved-domain' | '--include' | '--exclude' | '--allow-unsigned-development-rules' | '--no-color';
+export type V2HelpOption = Readonly<{
+    name: V2OptionName;
+    value: string;
+    commands: readonly V2CommandName[];
+    description: string;
+    default?: string;
+}>;
+export declare const V2_OPTIONS: readonly V2HelpOption[];
+/**
+ * The published limit vocabulary, restated because a shipped declaration must not name the private,
+ * unpublished contracts workspace: a strict NodeNext consumer of the packed package fails `TS2307`
+ * on that import. The values below still come from the contract, and the two vocabularies stay
+ * exhaustive against each other at compile time.
+ */
+export type V2LimitName = 'maxBytes' | 'maxNodes' | 'maxEdges' | 'maxConnectionDepth' | 'maxParameterDepth' | 'maxParameterLeaves' | 'workerDeadlineMs' | 'maxSyntaxNodes' | 'maxDocumentDepth' | 'maxMembersAndElements' | 'maxRawEdges' | 'maxDuplicateKeys' | 'maxDiagnostics' | 'maxStoredSourceSpans' | 'maxSourceWork' | 'maxExpressionTokens' | 'maxCodeSyntaxNodes' | 'maxGraphOperations' | 'maxTaintStates' | 'maxTraceStepsPerFinding' | 'maxFindings' | 'maxRedactionPatches' | 'maxRedactedArtifactBytes' | 'maxEvidenceBytes' | 'maxSerializedResultBytes' | 'maxRuleOperations';
+export declare const V2_LIMITS: Readonly<Record<V2LimitName, number>>;
+export declare const V2_EXIT_CODES: readonly [0, 1, 2, 3, 4, 130];
+export type V2ExitCode = (typeof V2_EXIT_CODES)[number];
+export declare const V2_EXIT_REASONS: readonly ["CANCELLED", "INTERNAL", "USAGE", "FINDING_THRESHOLD", "REQUIRE_COMPLETE", "ITEM_FAILURE", "UNDER_THRESHOLD"];
+export type V2ExitReason = (typeof V2_EXIT_REASONS)[number];
+export declare const V2_CANONICAL_CLAIMS: readonly ["v2 is offline and never initiates network requests (HTTP, DNS, sockets, telemetry, or remote imports).", "Labels and output identities never contain absolute paths or workflow source content.", "File output uses a same-directory temporary file and atomic replace; failures and cancellation preserve the prior file.", "beta-default@2.0.0 is admitted; beta-hardened@2.0.0 is defined but not admitted or selectable.", "No shipped path produces a redacted artifact: maxRedactionPatches and maxRedactedArtifactBytes bound redaction-v2, which is development-only and unwired.", "No shipped path admits an external rule pack: --rules and --catalogue accept only builtin, and --allow-unsigned-development-rules is refused because Ed25519 trust-store admission is deferred.", "Published on npm as sfscanner."];
+export type V2CommandHelp = Readonly<{
+    command: V2CommandName;
+    usage: readonly string[];
+    text: string;
+}>;
+export declare const COMMAND_HELP_V2: Readonly<Record<V2CommandName, string>>;
+export declare const GENERAL_HELP_V2: string;
+export declare const HELP_TEXT_V2: string;
+export declare function getHelpV2(command?: V2CommandName): string;

package/dist/v2/help.js

@@ -0,0 +1,325 @@
+// ../../contracts/exclusion-registry.ts
+var ENTRY_ID_PATTERN = /^[0-9a-f]{16}$/;
+function validateRecord(record) {
+  if (!ENTRY_ID_PATTERN.test(record.id)) {
+    throw new Error(
+      `Exclusion registry record has a malformed id "${record.id}": expected the 16-hex-character output of entryId(kind, ref, path), not a title, slug, or free-text identifier.`
+    );
+  }
+  if (!record.reason.trim()) {
+    throw new Error(`Exclusion registry record for id "${record.id}" has no reason recorded.`);
+  }
+  if (!Number.isFinite(Date.parse(record.excludedAt))) {
+    throw new Error(
+      `Exclusion registry record for id "${record.id}" has an invalid excludedAt timestamp: "${record.excludedAt}".`
+    );
+  }
+}
+function createExclusionRegistry(records) {
+  const seen = /* @__PURE__ */ new Set();
+  for (const record of records) {
+    validateRecord(record);
+    if (seen.has(record.id)) {
+      throw new Error(`Exclusion registry has more than one record for id "${record.id}".`);
+    }
+    seen.add(record.id);
+  }
+  const frozenRecords = Object.freeze(records.map((record) => Object.freeze({ ...record })));
+  const byId = new Map(frozenRecords.map((record) => [record.id, record]));
+  return Object.freeze({
+    records: frozenRecords,
+    isExcluded: (id) => byId.has(id),
+    recordFor: (id) => byId.get(id)
+  });
+}
+var EMPTY_EXCLUSION_REGISTRY = createExclusionRegistry([]);
+
+// ../../contracts/limits.ts
+var LIMITS = {
+  maxWorkflowBytes: 1536e3,
+  maxNodes: 5e3,
+  scanTimeoutMs: 3e4,
+  packSize: 250,
+  shardSize: 2e3,
+  maxPublicFindings: 20
+};
+
+// ../../contracts/scanner-limits.ts
+var SCANNER_LIMITS_SCHEMA_VERSION = "scanner-limits-v1";
+var DEFAULT_SCANNER_LIMITS = Object.freeze({
+  schemaVersion: SCANNER_LIMITS_SCHEMA_VERSION,
+  maxBytes: LIMITS.maxWorkflowBytes,
+  maxNodes: LIMITS.maxNodes,
+  maxEdges: 1e4,
+  // Previously declared as a `workflow.ts` option but never wired to any
+  // production caller (see scanner-contract-and-calibration tasks.md P1.1) —
+  // this is the first real default for it.
+  maxConnectionDepth: 64,
+  maxParameterDepth: 64,
+  maxParameterLeaves: 1e4,
+  workerDeadlineMs: LIMITS.scanTimeoutMs
+});
+
+// ../../contracts/scanner-limits-v2.ts
+var SCANNER_LIMITS_V2_SCHEMA_VERSION = "scanner-limits-v2";
+var SCANNER_LIMITS_V2_NUMERIC_FIELDS = [
+  "maxBytes",
+  "maxNodes",
+  "maxEdges",
+  "maxConnectionDepth",
+  "maxParameterDepth",
+  "maxParameterLeaves",
+  "workerDeadlineMs",
+  "maxSyntaxNodes",
+  "maxDocumentDepth",
+  "maxMembersAndElements",
+  "maxRawEdges",
+  "maxDuplicateKeys",
+  "maxDiagnostics",
+  "maxStoredSourceSpans",
+  "maxSourceWork",
+  "maxExpressionTokens",
+  "maxCodeSyntaxNodes",
+  "maxGraphOperations",
+  "maxTaintStates",
+  "maxTraceStepsPerFinding",
+  "maxFindings",
+  "maxRedactionPatches",
+  "maxRedactedArtifactBytes",
+  "maxEvidenceBytes",
+  "maxSerializedResultBytes",
+  "maxRuleOperations"
+];
+var SCANNER_LIMITS_V2_FIELDS = [
+  "schemaVersion",
+  ...SCANNER_LIMITS_V2_NUMERIC_FIELDS
+];
+var DEFAULT_SCANNER_LIMITS_V2 = Object.freeze({
+  ...DEFAULT_SCANNER_LIMITS,
+  schemaVersion: SCANNER_LIMITS_V2_SCHEMA_VERSION,
+  maxSyntaxNodes: 25e4,
+  maxDocumentDepth: 256,
+  maxMembersAndElements: 25e4,
+  maxRawEdges: 5e4,
+  maxDuplicateKeys: 1e3,
+  maxDiagnostics: 1e3,
+  maxStoredSourceSpans: 25e3,
+  maxSourceWork: 1e6,
+  maxExpressionTokens: 1e5,
+  maxCodeSyntaxNodes: 25e4,
+  maxGraphOperations: 1e6,
+  maxTaintStates: 25e4,
+  maxTraceStepsPerFinding: 100,
+  maxFindings: 5e3,
+  maxRedactionPatches: 1e4,
+  maxRedactedArtifactBytes: 1536e3,
+  maxEvidenceBytes: 1536e3,
+  maxSerializedResultBytes: 5e6,
+  maxRuleOperations: 1e6
+});
+var ADMITTED_LIMIT_STATES = Object.freeze({
+  maxBytes: "WIRED",
+  maxNodes: "WIRED",
+  maxEdges: "WIRED",
+  maxConnectionDepth: "WIRED",
+  maxParameterDepth: "WIRED",
+  maxParameterLeaves: "WIRED",
+  workerDeadlineMs: "WIRED",
+  maxSyntaxNodes: "WIRED",
+  maxDocumentDepth: "WIRED",
+  maxMembersAndElements: "WIRED",
+  maxRawEdges: "WIRED",
+  maxDuplicateKeys: "WIRED",
+  maxDiagnostics: "WIRED",
+  maxStoredSourceSpans: "WIRED",
+  maxSourceWork: "WIRED",
+  maxExpressionTokens: "DORMANT",
+  maxCodeSyntaxNodes: "DORMANT",
+  maxGraphOperations: "DORMANT",
+  maxTaintStates: "DORMANT",
+  maxTraceStepsPerFinding: "DORMANT",
+  maxFindings: "WIRED",
+  maxRedactionPatches: "UNWIRED",
+  maxRedactedArtifactBytes: "UNWIRED",
+  maxEvidenceBytes: "WIRED",
+  maxSerializedResultBytes: "WIRED",
+  maxRuleOperations: "WIRED"
+});
+var MEASURED_LIMIT_IDS = [
+  "maxBytes",
+  "maxNodes",
+  "maxEdges",
+  "maxConnectionDepth",
+  "maxParameterDepth",
+  "maxParameterLeaves",
+  "maxSyntaxNodes",
+  "maxRawEdges",
+  "maxDuplicateKeys",
+  "maxDiagnostics",
+  "maxStoredSourceSpans",
+  "maxSourceWork",
+  "maxFindings"
+];
+
+// src/v2/help.ts
+var V2_COMMANDS = Object.freeze([
+  "scan",
+  "rules",
+  "explain",
+  "profiles",
+  "validate-config",
+  "version"
+]);
+var SCAN = Object.freeze(["scan"]);
+var ALL = V2_COMMANDS;
+var V2_OPTIONS = Object.freeze([
+  { name: "--help", value: "", commands: ALL, description: "Show deterministic help for the selected v2 command." },
+  { name: "--schema", value: "<v2>", commands: ALL, description: "Select the versioned v2 grammar." },
+  { name: "--format", value: "<json|ndjson|sarif|table>", commands: ALL, description: "Select the output format.", default: "json for scan; json for metadata" },
+  { name: "--profile", value: "<beta-default>", commands: SCAN, description: "Select the admitted analysis profile.", default: "beta-default" },
+  { name: "--fail-on", value: "<CRITICAL|HIGH|MEDIUM|LOW|INFO>", commands: SCAN, description: "Fail when a finding meets or exceeds this severity.", default: "INFO" },
+  { name: "--require-complete", value: "", commands: SCAN, description: "Treat DEGRADED analysis as a failure.", default: "false" },
+  { name: "--max-concurrency", value: "<1..16>", commands: SCAN, description: "Bound concurrent inputs; --concurrency is an equivalent spelling.", default: "1" },
+  { name: "--concurrency", value: "<1..16>", commands: SCAN, description: "Bound concurrent inputs; --max-concurrency is an equivalent spelling.", default: "1" },
+  { name: "--timeout", value: "<1..2147483647>", commands: SCAN, description: "Set the per-input timeout in milliseconds.", default: "30000 (workerDeadlineMs)" },
+  { name: "--output", value: "<local-file|->", commands: SCAN, description: "Write to a local file atomically, or use - for stdout.", default: "stdout" },
+  { name: "--config", value: "<local-file>", commands: SCAN, description: "Load one explicit versioned config file." },
+  { name: "--rules", value: "<builtin>", commands: SCAN, description: "Select the embedded built-in ruleset; the only admitted authority.", default: "builtin" },
+  { name: "--catalogue", value: "<builtin>", commands: SCAN, description: "Select the embedded semantic catalogue.", default: "builtin" },
+  { name: "--limits", value: "<local-file|builtin>", commands: SCAN, description: "Select embedded or local scanner limits.", default: "builtin" },
+  { name: "--target", value: "<local-file>", commands: SCAN, description: "Load a local target context." },
+  { name: "--n8n-version", value: "<semver>", commands: SCAN, description: "Set the n8n version fact." },
+  { name: "--edition", value: "<COMMUNITY|ENTERPRISE|CLOUD|UNKNOWN>", commands: SCAN, description: "Set the deployment edition fact.", default: "UNKNOWN" },
+  { name: "--deployment", value: "<SELF_HOSTED|CLOUD|UNKNOWN>", commands: SCAN, description: "Set the deployment fact.", default: "UNKNOWN" },
+  { name: "--role", value: "<OWNER|ADMIN|MEMBER|UNKNOWN>", commands: SCAN, description: "Set the operator role fact.", default: "UNKNOWN" },
+  { name: "--task-runner", value: "<LEGACY|NATIVE|UNKNOWN>", commands: SCAN, description: "Set the task-runner fact.", default: "UNKNOWN" },
+  { name: "--community-package", value: "<package>", commands: SCAN, description: "Record a community package in target context; repeatable." },
+  { name: "--configuration", value: "<name>", commands: SCAN, description: "Record a configuration fact; repeatable." },
+  { name: "--approved-domain", value: "<host>", commands: SCAN, description: "Treat this hostname as approved for UNAPPROVED_DOMAIN; repeatable." },
+  { name: "--include", value: "<posix-glob>", commands: SCAN, description: "Replace config includes with a case-sensitive POSIX glob; repeatable.", default: "**/*.json" },
+  { name: "--exclude", value: "<posix-glob>", commands: SCAN, description: "Replace config excludes with a case-sensitive POSIX glob; repeatable.", default: ".git/**, node_modules/**" },
+  { name: "--allow-unsigned-development-rules", value: "", commands: SCAN, description: "Refused: external rule packs are not admitted, so no pack can be selected.", default: "false" },
+  { name: "--no-color", value: "", commands: SCAN, description: "Disable color in human output.", default: "false (also disabled for non-TTY)" }
+]);
+var V2_LIMITS = Object.freeze({
+  maxBytes: DEFAULT_SCANNER_LIMITS_V2.maxBytes,
+  maxNodes: DEFAULT_SCANNER_LIMITS_V2.maxNodes,
+  maxEdges: DEFAULT_SCANNER_LIMITS_V2.maxEdges,
+  maxConnectionDepth: DEFAULT_SCANNER_LIMITS_V2.maxConnectionDepth,
+  maxParameterDepth: DEFAULT_SCANNER_LIMITS_V2.maxParameterDepth,
+  maxParameterLeaves: DEFAULT_SCANNER_LIMITS_V2.maxParameterLeaves,
+  workerDeadlineMs: DEFAULT_SCANNER_LIMITS_V2.workerDeadlineMs,
+  maxSyntaxNodes: DEFAULT_SCANNER_LIMITS_V2.maxSyntaxNodes,
+  maxDocumentDepth: DEFAULT_SCANNER_LIMITS_V2.maxDocumentDepth,
+  maxMembersAndElements: DEFAULT_SCANNER_LIMITS_V2.maxMembersAndElements,
+  maxRawEdges: DEFAULT_SCANNER_LIMITS_V2.maxRawEdges,
+  maxDuplicateKeys: DEFAULT_SCANNER_LIMITS_V2.maxDuplicateKeys,
+  maxDiagnostics: DEFAULT_SCANNER_LIMITS_V2.maxDiagnostics,
+  maxStoredSourceSpans: DEFAULT_SCANNER_LIMITS_V2.maxStoredSourceSpans,
+  maxSourceWork: DEFAULT_SCANNER_LIMITS_V2.maxSourceWork,
+  maxExpressionTokens: DEFAULT_SCANNER_LIMITS_V2.maxExpressionTokens,
+  maxCodeSyntaxNodes: DEFAULT_SCANNER_LIMITS_V2.maxCodeSyntaxNodes,
+  maxGraphOperations: DEFAULT_SCANNER_LIMITS_V2.maxGraphOperations,
+  maxTaintStates: DEFAULT_SCANNER_LIMITS_V2.maxTaintStates,
+  maxTraceStepsPerFinding: DEFAULT_SCANNER_LIMITS_V2.maxTraceStepsPerFinding,
+  maxFindings: DEFAULT_SCANNER_LIMITS_V2.maxFindings,
+  maxRedactionPatches: DEFAULT_SCANNER_LIMITS_V2.maxRedactionPatches,
+  maxRedactedArtifactBytes: DEFAULT_SCANNER_LIMITS_V2.maxRedactedArtifactBytes,
+  maxEvidenceBytes: DEFAULT_SCANNER_LIMITS_V2.maxEvidenceBytes,
+  maxSerializedResultBytes: DEFAULT_SCANNER_LIMITS_V2.maxSerializedResultBytes,
+  maxRuleOperations: DEFAULT_SCANNER_LIMITS_V2.maxRuleOperations
+});
+function limitStateMarker(name) {
+  const state = ADMITTED_LIMIT_STATES[name];
+  if (state === "WIRED") {
+    return MEASURED_LIMIT_IDS.some((id) => id === name) ? " (enforced; usage row)" : " (enforced; no usage row)";
+  }
+  return state === "DORMANT" ? " (dormant in beta-default; hardened-only)" : " (development-only, unwired)";
+}
+var V2_EXIT_CODES = Object.freeze([0, 1, 2, 3, 4, 130]);
+var V2_EXIT_REASONS = Object.freeze([
+  "CANCELLED",
+  "INTERNAL",
+  "USAGE",
+  "FINDING_THRESHOLD",
+  "REQUIRE_COMPLETE",
+  "ITEM_FAILURE",
+  "UNDER_THRESHOLD"
+]);
+var V2_CANONICAL_CLAIMS = Object.freeze([
+  "v2 is offline and never initiates network requests (HTTP, DNS, sockets, telemetry, or remote imports).",
+  "Labels and output identities never contain absolute paths or workflow source content.",
+  "File output uses a same-directory temporary file and atomic replace; failures and cancellation preserve the prior file.",
+  "beta-default@2.0.0 is admitted; beta-hardened@2.0.0 is defined but not admitted or selectable.",
+  "No shipped path produces a redacted artifact: maxRedactionPatches and maxRedactedArtifactBytes bound redaction-v2, which is development-only and unwired.",
+  "No shipped path admits an external rule pack: --rules and --catalogue accept only builtin, and --allow-unsigned-development-rules is refused because Ed25519 trust-store admission is deferred.",
+  "Published on npm as sfscanner."
+]);
+function optionLine(option, command) {
+  const value = option.name === "--format" && command !== void 0 && command !== "scan" ? "<json|table>" : option.value;
+  const syntax = value ? ` ${value}` : "";
+  const defaultText = option.default ? ` Default: ${option.default}.` : "";
+  return `  ${option.name}${syntax}  ${option.description}${defaultText}`;
+}
+function renderCommand(command) {
+  const usage = command === "scan" ? [`sfscanner --schema v2 scan <file|directory|-> [options]`] : command === "explain" ? [`sfscanner --schema v2 explain <rule-id> [--format json|table]`] : command === "validate-config" ? [`sfscanner --schema v2 validate-config <local-file> [--format json|table]`] : [`sfscanner --schema v2 ${command} [--format json|table]`];
+  const options = V2_OPTIONS.filter((option) => option.commands.includes(command));
+  const lines = [`sfscanner v2 ${command}`, "", "Usage:", ...usage, "", "Options:", ...options.map((option) => optionLine(option, command))];
+  if (command === "scan") lines.push("", "Inputs are sorted by normalized relative label; stdin (-) cannot join a batch.");
+  if (command === "profiles") lines.push("", "beta-default is admitted. beta-hardened is defined but not admitted or selectable.");
+  if (command === "validate-config") lines.push("", "Only the explicitly supplied local config file is read.");
+  return Object.freeze({ command, usage: Object.freeze(usage), text: `${lines.join("\n")}
+` });
+}
+var COMMAND_HELP_V2 = Object.freeze(
+  Object.fromEntries(V2_COMMANDS.map((command) => [command, renderCommand(command).text]))
+);
+var generalLines = [
+  "sfscanner \u2014 deterministic offline n8n workflow scanner (v2)",
+  "",
+  "Usage:",
+  "  sfscanner --schema v2 scan <file|directory|-> [options]",
+  "  sfscanner --schema v2 rules [--format json|table]",
+  "  sfscanner --schema v2 explain <rule-id> [--format json|table]",
+  "  sfscanner --schema v2 profiles [--format json|table]",
+  "  sfscanner --schema v2 validate-config <local-file> [--format json|table]",
+  "  sfscanner --schema v2 version [--format json|table]",
+  "",
+  "Commands:",
+  "Defaults:",
+  "  format: json; profile: beta-default; fail-on: INFO; require-complete: false; concurrency: 1 (maximum 16); timeout: 30000ms.",
+  "  include: **/*.json; exclude: .git/**, node_modules/**; rules/catalogue/limits: builtin.",
+  "  target facts: edition UNKNOWN; deployment UNKNOWN; role UNKNOWN; task-runner UNKNOWN.",
+  "",
+  "Profiles:",
+  "  beta-default@2.0.0: admitted and selectable.",
+  "  beta-hardened@2.0.0: defined but not admitted or selectable.",
+  "",
+  "Limits:",
+  ...Object.entries(V2_LIMITS).map(([name, value]) => `  ${name}=${value}${limitStateMarker(name)}`),
+  "",
+  "Exit codes and precedence:",
+  "  130 CANCELLED; 4 INTERNAL; 2 USAGE; 1 FINDING_THRESHOLD or REQUIRE_COMPLETE; 3 ITEM_FAILURE; 0 UNDER_THRESHOLD.",
+  "  Pre-scan usage/configuration/admission failures emit no machine envelope and exit 2; stdout cancellation emits a valid envelope and exits 130.",
+  "  When finding threshold and require-complete both fire, FINDING_THRESHOLD wins. Indeterminate never exits 0.",
+  "",
+  ...V2_CANONICAL_CLAIMS
+];
+var GENERAL_HELP_V2 = `${generalLines.join("\n")}
+`;
+var HELP_TEXT_V2 = GENERAL_HELP_V2;
+function getHelpV2(command) {
+  return command === void 0 ? GENERAL_HELP_V2 : COMMAND_HELP_V2[command];
+}
+export {
+  COMMAND_HELP_V2,
+  GENERAL_HELP_V2,
+  HELP_TEXT_V2,
+  V2_CANONICAL_CLAIMS,
+  V2_COMMANDS,
+  V2_EXIT_CODES,
+  V2_EXIT_REASONS,
+  V2_LIMITS,
+  V2_OPTIONS,
+  getHelpV2
+};