sfscanner 0.0.0-stage → 0.2.0

package/dist/v2/metadata-validation.d.ts

@@ -0,0 +1,4 @@
+import type { CliMetadataDocumentV2 } from './commands.js';
+export declare function checkPlain(o: unknown): Record<string, unknown>;
+export declare function checkDenseArray<T>(arr: unknown): T[];
+export declare function validateDocumentShape(doc: unknown): asserts doc is CliMetadataDocumentV2;

package/dist/v2/ndjson-output.d.ts

@@ -0,0 +1,3 @@
+import type { BatchResultV2 } from './batch-runner';
+import { type ProjectionOptionsV2 } from './json-output';
+export declare function serializeNdjsonV2(batch: BatchResultV2, options?: ProjectionOptionsV2): string;

package/dist/v2/path-admission.d.ts

@@ -0,0 +1,8 @@
+/** Normalizes backslashes before classifying, so a Windows drive path is absolute in both forms. */
+export declare function isAbsoluteAdmittedPathV2(value: string): boolean;
+export declare function isAdmittedLocalPath(value: unknown): value is string;
+export declare function isAdmittedRelativePath(value: unknown): value is string;
+export declare function normalizeAdmittedPathV2(value: unknown, relativeOnly?: boolean): string | undefined;
+export declare function admittedLabelV2(raw: string, baseDirectory: string): string;
+export declare function toFsPathV2(baseDirectory: string, normalized: string): string;
+export declare function isWithinBaseV2(target: string, baseDirectory: string): boolean;

package/dist/v2/scan-config-load.d.ts

@@ -0,0 +1,21 @@
+import { type ScannerLimitsV2 } from '@hub/contracts';
+import type { CliCommandV2 } from './arguments';
+import { type ScanConfigV2 } from './config';
+import type { ProjectionSourceV2 } from './json-output';
+import type { ExitCodeV2 } from './exit-reducer';
+type ScanCommand = Extract<CliCommandV2, {
+    kind: 'scan';
+}>;
+export type LoadedScanConfig = Readonly<{
+    ok: true;
+    config: ScanConfigV2;
+    limitsDocument?: ScannerLimitsV2;
+    targetDocument?: unknown;
+    sources: ProjectionSourceV2;
+}> | Readonly<{
+    ok: false;
+    exitCode: ExitCodeV2;
+    message: string;
+}>;
+export declare function readScanConfig(command: ScanCommand, baseDirectory: string): Promise<LoadedScanConfig>;
+export {};

package/dist/v2/scan-worker-host.d.ts

@@ -0,0 +1,29 @@
+import { Worker } from 'node:worker_threads';
+import type { WorkerHostRun } from './worker-host';
+export type ScanWorkerData = Readonly<{
+    bytes: Uint8Array;
+    profile: Readonly<{
+        id: string;
+        version: string;
+    }>;
+    target?: unknown;
+    limits?: unknown;
+    approvedDomains?: readonly string[];
+}>;
+export type ScanWorkerFactory = () => Worker;
+export type ScanWorkerOptions = Readonly<{
+    timeoutMs?: number;
+    signal?: AbortSignal;
+    workerFactory?: ScanWorkerFactory;
+}>;
+/**
+ * `#sfscanner-worker` is the package's private imports map to the one built
+ * `dist/scan-worker.js`. `createRequire(...).resolve` uses the same native
+ * package-imports resolution as `import.meta.resolve` (unavailable in
+ * vite-node) and checks the target exists, so the same call works from the
+ * root bundle, the v2 subpath bundle, and the unbundled source tree after one
+ * build. A missing asset throws MODULE_NOT_FOUND; there is no fallback.
+ */
+export declare function scanWorkerUrl(): URL;
+export declare function createScanWorker(data: ScanWorkerData): Worker;
+export declare function runScanInWorker<T = unknown>(data: ScanWorkerData, options?: ScanWorkerOptions): Promise<WorkerHostRun<T>>;

package/dist/v2/table-output.d.ts

@@ -0,0 +1,2 @@
+import type { BatchResultV2 } from './batch-runner';
+export declare function renderTableV2(batch: BatchResultV2): string;

package/dist/v2/worker-host.d.ts

@@ -0,0 +1,24 @@
+export type WorkerHostStatus = 'COMPLETED' | 'FAILED' | 'CANCELLED' | 'TIMEOUT';
+export type WorkerHostRun<T> = Readonly<{
+    status: 'COMPLETED';
+    value: T;
+} | {
+    status: Exclude<WorkerHostStatus, 'COMPLETED'>;
+}>;
+export type SigintSource = Readonly<{
+    on: (event: 'SIGINT', listener: () => void) => unknown;
+    off?: (event: 'SIGINT', listener: () => void) => unknown;
+    removeListener?: (event: 'SIGINT', listener: () => void) => unknown;
+}>;
+export type SigintController = Readonly<{
+    signal: AbortSignal;
+    dispose: () => void;
+}>;
+export type WorkerHostOptions = Readonly<{
+    signal?: AbortSignal;
+    sigint?: SigintSource;
+    timeoutMs?: number;
+    now?: () => number;
+}>;
+export declare function createSigintController(source?: SigintSource): SigintController;
+export declare function runHostedScan<T>(task: () => T | PromiseLike<T>, options?: WorkerHostOptions): Promise<WorkerHostRun<T>>;

package/package.json

@@ -1,6 +1,74 @@
-{
-  "name": "sfscanner",
-  "version": "0.0.0-stage",
-  "stub": true,
-  "description": "Temporary package placeholder for staged publishing"
-}
+{
+  "name": "sfscanner",
+  "version": "0.2.0",
+  "description": "SecureFlow Scanner — Deterministic, offline security & dataflow analyzer for n8n workflows",
+  "keywords": [
+    "n8n",
+    "security",
+    "sast",
+    "sarif",
+    "scanner",
+    "workflow"
+  ],
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/jitwark/n8n-Secureflow.git"
+  },
+  "homepage": "https://github.com/jitwark/n8n-Secureflow#readme",
+  "license": "MIT",
+  "private": false,
+  "type": "module",
+  "engines": {
+    "node": ">=22 <23"
+  },
+  "main": "./dist/index.js",
+  "bin": {
+    "sfscanner": "dist/main.js",
+    "sfscanner-mcp": "dist/mcp.js"
+  },
+  "imports": {
+    "#sfscanner-worker": "./dist/scan-worker.js"
+  },
+  "files": [
+    "dist",
+    "README.md",
+    "LICENSE",
+    "THIRD_PARTY_NOTICES.md"
+  ],
+  "exports": {
+    ".": {
+      "types": "./dist/index.d.ts",
+      "import": "./dist/index.js"
+    },
+    "./v2/arguments": {
+      "types": "./dist/v2/arguments.d.ts",
+      "import": "./dist/v2/arguments.js"
+    },
+    "./v2/cli-runner": {
+      "types": "./dist/v2/cli-runner.d.ts",
+      "import": "./dist/v2/cli-runner.js"
+    },
+    "./v2/help": {
+      "types": "./dist/v2/help.d.ts",
+      "import": "./dist/v2/help.js"
+    },
+    "./v2/metadata-output": {
+      "types": "./dist/v2/metadata-output.d.ts",
+      "import": "./dist/v2/metadata-output.js"
+    }
+  },
+  "scripts": {
+    "build": "node build.mjs",
+    "lint": "eslint .",
+    "test": "vitest run --config vitest.config.ts",
+    "typecheck": "tsc -p tsconfig.json --noEmit"
+  },
+  "devDependencies": {
+    "@hub/contracts": "*",
+    "@hub/scanner-core": "*",
+    "@types/node": "^22.0.0",
+    "esbuild": "^0.28.2",
+    "typescript": "^5.7.2",
+    "vitest": "^4.1.11"
+  }
+}