sfscanner 0.1.0 → 0.2.0

package/dist/v2/metadata-validation.d.ts

@@ -1,4 +1,4 @@
-import type { CliMetadataDocumentV2 } from './commands';
+import type { CliMetadataDocumentV2 } from './commands.js';
 export declare function checkPlain(o: unknown): Record<string, unknown>;
 export declare function checkDenseArray<T>(arr: unknown): T[];
 export declare function validateDocumentShape(doc: unknown): asserts doc is CliMetadataDocumentV2;

package/dist/v2/path-admission.d.ts

@@ -0,0 +1,8 @@
+/** Normalizes backslashes before classifying, so a Windows drive path is absolute in both forms. */
+export declare function isAbsoluteAdmittedPathV2(value: string): boolean;
+export declare function isAdmittedLocalPath(value: unknown): value is string;
+export declare function isAdmittedRelativePath(value: unknown): value is string;
+export declare function normalizeAdmittedPathV2(value: unknown, relativeOnly?: boolean): string | undefined;
+export declare function admittedLabelV2(raw: string, baseDirectory: string): string;
+export declare function toFsPathV2(baseDirectory: string, normalized: string): string;
+export declare function isWithinBaseV2(target: string, baseDirectory: string): boolean;

package/dist/v2/scan-config-load.d.ts

@@ -0,0 +1,21 @@
+import { type ScannerLimitsV2 } from '@hub/contracts';
+import type { CliCommandV2 } from './arguments';
+import { type ScanConfigV2 } from './config';
+import type { ProjectionSourceV2 } from './json-output';
+import type { ExitCodeV2 } from './exit-reducer';
+type ScanCommand = Extract<CliCommandV2, {
+    kind: 'scan';
+}>;
+export type LoadedScanConfig = Readonly<{
+    ok: true;
+    config: ScanConfigV2;
+    limitsDocument?: ScannerLimitsV2;
+    targetDocument?: unknown;
+    sources: ProjectionSourceV2;
+}> | Readonly<{
+    ok: false;
+    exitCode: ExitCodeV2;
+    message: string;
+}>;
+export declare function readScanConfig(command: ScanCommand, baseDirectory: string): Promise<LoadedScanConfig>;
+export {};

package/dist/v2/scan-worker-host.d.ts

@@ -0,0 +1,29 @@
+import { Worker } from 'node:worker_threads';
+import type { WorkerHostRun } from './worker-host';
+export type ScanWorkerData = Readonly<{
+    bytes: Uint8Array;
+    profile: Readonly<{
+        id: string;
+        version: string;
+    }>;
+    target?: unknown;
+    limits?: unknown;
+    approvedDomains?: readonly string[];
+}>;
+export type ScanWorkerFactory = () => Worker;
+export type ScanWorkerOptions = Readonly<{
+    timeoutMs?: number;
+    signal?: AbortSignal;
+    workerFactory?: ScanWorkerFactory;
+}>;
+/**
+ * `#sfscanner-worker` is the package's private imports map to the one built
+ * `dist/scan-worker.js`. `createRequire(...).resolve` uses the same native
+ * package-imports resolution as `import.meta.resolve` (unavailable in
+ * vite-node) and checks the target exists, so the same call works from the
+ * root bundle, the v2 subpath bundle, and the unbundled source tree after one
+ * build. A missing asset throws MODULE_NOT_FOUND; there is no fallback.
+ */
+export declare function scanWorkerUrl(): URL;
+export declare function createScanWorker(data: ScanWorkerData): Worker;
+export declare function runScanInWorker<T = unknown>(data: ScanWorkerData, options?: ScanWorkerOptions): Promise<WorkerHostRun<T>>;

package/package.json

@@ -1,67 +1,74 @@
-{
-  "name": "sfscanner",
-  "version": "0.1.0",
-  "description": "SecureFlow Scanner — Deterministic, offline security & dataflow analyzer for n8n workflows",
-  "keywords": [
-    "n8n",
-    "security",
-    "sast",
-    "sarif",
-    "scanner",
-    "workflow"
-  ],
-  "repository": {
-    "type": "git",
-    "url": "git+https://github.com/jitwark/n8n-Secureflow.git"
-  },
-  "homepage": "https://github.com/jitwark/n8n-Secureflow#readme",
-  "license": "MIT",
-  "private": false,
-  "type": "module",
-  "engines": {
-    "node": ">=22 <23"
-  },
-  "main": "./dist/main.js",
-  "bin": {
-    "sfscanner": "dist/main.js",
-    "sfscanner-mcp": "dist/mcp.js"
-  },
-  "files": [
-    "dist",
-    "README.md",
-    "LICENSE",
-    "THIRD_PARTY_NOTICES.md"
-  ],
-  "exports": {
-    "./v2/arguments": {
-      "types": "./dist/v2/arguments.d.ts",
-      "import": "./dist/v2/arguments.js"
-    },
-    "./v2/cli-runner": {
-      "types": "./dist/v2/cli-runner.d.ts",
-      "import": "./dist/v2/cli-runner.js"
-    },
-    "./v2/help": {
-      "types": "./dist/v2/help.d.ts",
-      "import": "./dist/v2/help.js"
-    },
-    "./v2/metadata-output": {
-      "types": "./dist/v2/metadata-output.d.ts",
-      "import": "./dist/v2/metadata-output.js"
-    }
-  },
-  "scripts": {
-    "build": "node build.mjs",
-    "lint": "eslint .",
-    "test": "vitest run --config vitest.config.ts",
-    "typecheck": "tsc -p tsconfig.json --noEmit"
-  },
-  "devDependencies": {
-    "@hub/contracts": "*",
-    "@hub/scanner-core": "*",
-    "@types/node": "^22.0.0",
-    "esbuild": "^0.28.2",
-    "typescript": "^5.7.2",
-    "vitest": "^4.1.11"
-  }
-}
+{
+  "name": "sfscanner",
+  "version": "0.2.0",
+  "description": "SecureFlow Scanner — Deterministic, offline security & dataflow analyzer for n8n workflows",
+  "keywords": [
+    "n8n",
+    "security",
+    "sast",
+    "sarif",
+    "scanner",
+    "workflow"
+  ],
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/jitwark/n8n-Secureflow.git"
+  },
+  "homepage": "https://github.com/jitwark/n8n-Secureflow#readme",
+  "license": "MIT",
+  "private": false,
+  "type": "module",
+  "engines": {
+    "node": ">=22 <23"
+  },
+  "main": "./dist/index.js",
+  "bin": {
+    "sfscanner": "dist/main.js",
+    "sfscanner-mcp": "dist/mcp.js"
+  },
+  "imports": {
+    "#sfscanner-worker": "./dist/scan-worker.js"
+  },
+  "files": [
+    "dist",
+    "README.md",
+    "LICENSE",
+    "THIRD_PARTY_NOTICES.md"
+  ],
+  "exports": {
+    ".": {
+      "types": "./dist/index.d.ts",
+      "import": "./dist/index.js"
+    },
+    "./v2/arguments": {
+      "types": "./dist/v2/arguments.d.ts",
+      "import": "./dist/v2/arguments.js"
+    },
+    "./v2/cli-runner": {
+      "types": "./dist/v2/cli-runner.d.ts",
+      "import": "./dist/v2/cli-runner.js"
+    },
+    "./v2/help": {
+      "types": "./dist/v2/help.d.ts",
+      "import": "./dist/v2/help.js"
+    },
+    "./v2/metadata-output": {
+      "types": "./dist/v2/metadata-output.d.ts",
+      "import": "./dist/v2/metadata-output.js"
+    }
+  },
+  "scripts": {
+    "build": "node build.mjs",
+    "lint": "eslint .",
+    "test": "vitest run --config vitest.config.ts",
+    "typecheck": "tsc -p tsconfig.json --noEmit"
+  },
+  "devDependencies": {
+    "@hub/contracts": "*",
+    "@hub/scanner-core": "*",
+    "@types/node": "^22.0.0",
+    "esbuild": "^0.28.2",
+    "typescript": "^5.7.2",
+    "vitest": "^4.1.11"
+  }
+}

package/dist/v2/sarif-helpers.d.ts

@@ -1,69 +0,0 @@
-import { type ScannerResultV2 } from '@hub/contracts/scanner-v2-result';
-import type { SourceSpanV2, SubjectV2 } from '@hub/contracts/scanner-v2-source';
-import type { BatchSarifInputV2, SarifV2Limits } from './sarif-output';
-export type Bounds = {
-    rules: number;
-    results: number;
-    notifications: number;
-    taxonomies: number;
-    taxa: number;
-    tags: number;
-    flows: number;
-    steps: number;
-};
-export type NotifItem = {
-    code: string;
-    level: 'warning' | 'error';
-    location?: Record<string, unknown>;
-    locKey: string;
-    id?: string;
-    label?: string;
-};
-export type BatchId = {
-    engineId: string;
-    engineVersion: string;
-    engineBuildDigest: string;
-    profileId: string;
-    profileVersion: string;
-    rulesetId: string;
-    rulesetVersion: string;
-    rulesetDigest: string;
-    rulesetSig: string;
-    semanticsId: string;
-    semanticsVersion: string;
-    semanticsDigest: string;
-    targetContextDigest: string;
-    targetEdition: string;
-    targetDeployment: string;
-    targetRole: string;
-    targetTaskRunner: string;
-    limitsSchemaVersion: string;
-    limitsDigest: string;
-};
-export type InputIdentity = {
-    rawUri: unknown;
-    label: string;
-};
-export declare const FALLBACK: Bounds;
-export declare const SEV_ORDER: Record<string, number>;
-export declare const LEVELS: Record<string, 'error' | 'warning' | 'note'>;
-export declare const ALLOWED_ERRORS: Set<string>;
-export declare const prop: (v: unknown, k: string) => unknown;
-export declare const inv: () => never;
-export declare function checkResult(r: unknown): ScannerResultV2;
-export declare function inputIdentity(value: unknown): InputIdentity;
-export declare function extractItems(input: BatchSarifInputV2): {
-    items: readonly unknown[];
-    repoRoot?: string;
-    selRoot?: string;
-    limits?: SarifV2Limits;
-};
-export declare function safePath(v: unknown): v is string;
-export declare function safeUri(raw: unknown, repoRoot?: string, selRoot?: string): string | undefined;
-export declare function readPos(v: unknown): SourceSpanV2['start'] | undefined;
-export declare function readSpan(source: unknown): SourceSpanV2 | undefined;
-export declare function subjectKey(s: SubjectV2): string;
-export declare function subjectSpan(subj: SubjectV2): SourceSpanV2 | undefined;
-export declare function physical(uri: string, s: SourceSpanV2): Record<string, unknown>;
-export declare function freeze<T>(v: T, seen?: WeakSet<object>): T;
-export declare function sameId(a: BatchId, b: BatchId): boolean;

package/dist/v2/sarif-output.d.ts

@@ -1,40 +0,0 @@
-import type { ScannerResultV2 } from '@hub/contracts/scanner-v2-result';
-export type SarifLog = Readonly<{
-    version: '2.1.0';
-    $schema: string;
-    runs: readonly SarifRun[];
-}>;
-export type SarifRun = Readonly<{
-    tool: {
-        driver: Record<string, unknown>;
-    };
-    results: readonly Record<string, unknown>[];
-    invocations: readonly Record<string, unknown>[];
-    taxonomies?: readonly Record<string, unknown>[];
-}>;
-export type SarifV2Limits = Readonly<{
-    maxRules?: number;
-    maxResults?: number;
-    maxNotifications?: number;
-    maxTaxonomies?: number;
-    maxTaxa?: number;
-    maxTags?: number;
-    maxFlows?: number;
-    maxTraceSteps?: number;
-}>;
-export type BatchSarifEnvelopeV2 = Readonly<{
-    items?: readonly unknown[];
-    results?: readonly unknown[];
-    input?: Readonly<{
-        label: string;
-        uri?: string;
-    }>;
-    result?: ScannerResultV2;
-    repositoryRoot?: string;
-    selectionRoot?: string;
-    limits?: SarifV2Limits;
-}>;
-export type BatchSarifInputV2 = BatchSarifEnvelopeV2 | readonly unknown[];
-export declare function buildBatchSarifV2(input: BatchSarifInputV2): SarifLog;
-export declare function buildSarifV2(input: BatchSarifInputV2): SarifLog;
-export declare function serializeSarifV2(input: BatchSarifInputV2): string;