sfscanner 0.1.0 → 0.2.1

package/dist/v2/arguments.d.ts

@@ -1,86 +1 @@
-import { type ScanConfigV2, type ScanSeverityV2 } from './contracts';
-import type { V2CommandName } from './help';
-export type CliFormatV2 = 'json' | 'ndjson' | 'sarif' | 'table';
-export type CliProfileV2 = 'beta-default' | 'beta-hardened';
-export type CliTargetEnumV2 = 'UNKNOWN' | 'COMMUNITY' | 'ENTERPRISE' | 'CLOUD' | 'SELF_HOSTED' | 'OWNER' | 'ADMIN' | 'MEMBER' | 'LEGACY' | 'NATIVE';
-export type CliParseErrorCodeV2 = 'NO_COMMAND' | 'UNKNOWN_COMMAND' | 'UNKNOWN_OPTION' | 'MISSING_VALUE' | 'INVALID_VALUE' | 'DUPLICATE_OPTION' | 'UNEXPECTED_ARGUMENT' | 'REMOTE_PATH' | 'RULE_PACK_INVALID' | 'SEMANTIC_CATALOGUE_INVALID' | 'PROFILE_NOT_ADMITTED';
-export type CliParseErrorV2 = Readonly<{
-    code: CliParseErrorCodeV2;
-    message: string;
-    argument?: string;
-}>;
-type ScanCommandV2 = Readonly<{
-    kind: 'scan';
-    schema: 'v2';
-    inputs: readonly string[];
-    format: CliFormatV2;
-    profile: CliProfileV2;
-    failOn: ScanSeverityV2;
-    requireComplete: boolean;
-    concurrency: number;
-    timeoutMs?: number;
-    output?: string;
-    configPath?: string;
-    rules: 'builtin';
-    catalogue: 'builtin';
-    limits: string;
-    target?: string;
-    n8nVersion?: string;
-    edition: 'COMMUNITY' | 'ENTERPRISE' | 'CLOUD' | 'UNKNOWN';
-    deployment: 'SELF_HOSTED' | 'CLOUD' | 'UNKNOWN';
-    role: 'OWNER' | 'ADMIN' | 'MEMBER' | 'UNKNOWN';
-    taskRunner: 'LEGACY' | 'NATIVE' | 'UNKNOWN';
-    communityPackages: readonly string[];
-    configuration: readonly string[];
-    include: readonly string[];
-    exclude: readonly string[];
-    allowUnsignedDevelopmentRules: boolean;
-    noColor: boolean;
-    cliOverrides: Readonly<Partial<ScanConfigV2>>;
-}>;
-export type CliHelpCommandV2 = Readonly<{
-    kind: 'help';
-    schema: 'v2';
-    command?: V2CommandName;
-}>;
-export type CliCommandV2 = ScanCommandV2 | Readonly<{
-    kind: 'rules';
-    schema: 'v2';
-    format: 'json' | 'table';
-}> | Readonly<{
-    kind: 'explain';
-    schema: 'v2';
-    format: 'json' | 'table';
-    ruleId: string;
-}> | Readonly<{
-    kind: 'profiles';
-    schema: 'v2';
-    format: 'json' | 'table';
-}> | Readonly<{
-    kind: 'validate-config';
-    schema: 'v2';
-    format: 'json' | 'table';
-    path: string;
-}> | Readonly<{
-    kind: 'version';
-    schema: 'v2';
-    format: 'json' | 'table';
-}>;
-type ParsedCommandV2 = CliCommandV2 | CliHelpCommandV2;
-export type CliParseResultV2 = Readonly<{
-    ok: true;
-    command: ParsedCommandV2;
-} | {
-    ok: false;
-    error: CliParseErrorV2;
-}>;
-export type CliArgumentDispatch = Readonly<{
-    mode: 'v1';
-    argv: readonly string[];
-} | {
-    mode: 'v2';
-    result: CliParseResultV2;
-}>;
-export declare function parseArgumentsV2(argv: readonly string[]): CliParseResultV2;
-export declare function parseCliArguments(argv: readonly string[]): CliArgumentDispatch;
-export {};
+export * from "../_types/packages/scanner-cli/src/v2/arguments.js";

package/dist/v2/arguments.js

@@ -1,3 +1,55 @@
+// src/v2/contracts.ts
+import { createHash } from "node:crypto";
+
+// ../scanner-core/src/canonical-json.ts
+function canonicalizeJson(value) {
+  return encodeCanonical(value, /* @__PURE__ */ new Set());
+}
+function encodeCanonical(value, seen) {
+  if (value === null) return "null";
+  if (typeof value === "string") return JSON.stringify(value);
+  if (typeof value === "boolean") return value ? "true" : "false";
+  if (typeof value === "number") {
+    if (!Number.isFinite(value)) throw new TypeError("Cannot encode non-finite number as canonical JSON");
+    return JSON.stringify(Object.is(value, -0) ? 0 : value);
+  }
+  if (typeof value !== "object" || value === void 0) {
+    throw new TypeError(`Cannot encode ${typeof value} as canonical JSON`);
+  }
+  if (seen.has(value)) throw new TypeError("Cannot encode cyclic value as canonical JSON");
+  seen.add(value);
+  try {
+    if (Array.isArray(value)) return encodeArray(value, seen);
+    return encodeObject(value, seen);
+  } finally {
+    seen.delete(value);
+  }
+}
+function encodeArray(value, seen) {
+  const values = Array.from({ length: value.length }, (_, index) => {
+    if (!Object.prototype.hasOwnProperty.call(value, index)) {
+      throw new TypeError("Cannot encode sparse array as canonical JSON");
+    }
+    return encodeCanonical(value[index], seen);
+  });
+  return `[${values.join(",")}]`;
+}
+function encodeObject(value, seen) {
+  const prototype = Object.getPrototypeOf(value);
+  if (prototype !== Object.prototype && prototype !== null) {
+    throw new TypeError("Cannot encode a non-plain object as canonical JSON");
+  }
+  if (Object.getOwnPropertySymbols(value).some((symbol) => Object.prototype.propertyIsEnumerable.call(value, symbol))) {
+    throw new TypeError("Cannot encode symbol properties as canonical JSON");
+  }
+  const pairs = Object.keys(value).sort(compareCanonicalStrings).map((key) => `${JSON.stringify(key)}:${encodeCanonical(value[key], seen)}`);
+  return `{${pairs.join(",")}}`;
+}
+function compareCanonicalStrings(left, right) {
+  if (left === right) return 0;
+  return left < right ? -1 : 1;
+}
+
 // src/v2/contracts.ts
 var SCAN_CONFIG_SCHEMA_V2 = "n8n-scan-config-v2";
 var ADMITTED_PROFILE_V2 = Object.freeze({ id: "beta-default", version: "2.0.0", digest: "3ca5d69db2554383e22c44afe507cc98e381ea58a7e42aaac0ee8f7497fb4f44" });
@@ -10,8 +62,8 @@ function isAdmittedProfileSpecifierV2(value) {
 }
 var BUILTIN_AUTHORITIES_V2 = Object.freeze({
   profile: ADMITTED_PROFILE_V2,
-  rules: Object.freeze({ id: "scanner-core-builtins", version: "2.0.0", digest: "a36d00564bbf8e8c38f05820480782cdc53fdbd3712558850066c4e3f5c3413d", signatureStatus: "VERIFIED" }),
-  semantics: Object.freeze({ id: "scanner-core-builtins", version: "2.0.0", digest: "1bb11f63269d427cb28e141dfe0a6a1512e53c298abdb4d6450545ceb56d11c4" }),
+  rules: Object.freeze({ id: "scanner-core-builtins", version: "2.0.0", digest: "30bdc8343582b6a4efc13538d3475db87d07fa28bea4027f9e93b813213fd510", signatureStatus: "VERIFIED" }),
+  semantics: Object.freeze({ id: "scanner-core-builtins", version: "2.2.0", digest: "58419339dcf99ed398d2955282662e6f6d37208f62393cafb56818d4a38182d7" }),
   limits: Object.freeze({ schemaVersion: "scanner-limits-v2", digest: "fca787753ca88f71cf0d174427f4ac730a7aef1c823aaf73aa1ea72af92b4077" })
 });
 var PROFILE_MANIFEST_DIGEST_V2 = ADMITTED_PROFILE_V2.digest;
@@ -20,6 +72,26 @@ var BUILTIN_SEMANTICS_AUTHORITY_V2 = BUILTIN_AUTHORITIES_V2.semantics;
 var BUILTIN_LIMITS_AUTHORITY_V2 = BUILTIN_AUTHORITIES_V2.limits;
 var RULE_PACK_DIGEST_V2 = BUILTIN_RULESET_AUTHORITY_V2.digest;
 var SEMANTIC_CATALOGUE_DIGEST_V2 = BUILTIN_SEMANTICS_AUTHORITY_V2.digest;
+var BUILTIN_SCOPED_SEMANTICS_AUTHORITY_V2 = Object.freeze({
+  id: "reviewed-gmail-message-v1",
+  version: "1",
+  digest: "2b21f771d2cf172e33e8f78e5d1deaaefc0a5e8ff45f7d9f252cb8ec321ad56a",
+  sourceReceiptSha256: "2e8b7a2666cfc07c7609fdc9a2bdf01be291195a8b7da0af0f69836a180f8685",
+  sourceReceiptCanonicalDigest: "965de9fabde482dd5a6bcc67299fce8c33232e78c9fdc70053ad588b0f62ba2a"
+});
+var CLI_VERSION_V2 = "0.1.0";
+var CLI_TOOL_V2 = Object.freeze({
+  name: "n8n-scan",
+  version: CLI_VERSION_V2,
+  buildDigest: createHash("sha256").update(canonicalizeJson({
+    engine: "secureflow-scanner",
+    version: "2.0.0",
+    profile: ADMITTED_PROFILE_V2,
+    ruleset: BUILTIN_RULESET_AUTHORITY_V2.digest,
+    semantics: BUILTIN_SEMANTICS_AUTHORITY_V2.digest,
+    scopedSemantics: BUILTIN_SCOPED_SEMANTICS_AUTHORITY_V2
+  })).digest("hex")
+});
 var DEFAULT_SCAN_CONFIG_V2 = Object.freeze({
   schemaVersion: SCAN_CONFIG_SCHEMA_V2,
   format: "json",
@@ -32,6 +104,7 @@ var DEFAULT_SCAN_CONFIG_V2 = Object.freeze({
   limits: "builtin",
   include: Object.freeze(["**/*.json"]),
   exclude: Object.freeze([".git/**", "node_modules/**"]),
+  approvedDomains: Object.freeze([]),
   allowUnsignedDevelopmentRules: false,
   noColor: false
 });
@@ -51,18 +124,63 @@ var SCAN_CONFIG_V2_FIELDS = Object.freeze([
   "target",
   "include",
   "exclude",
+  "approvedDomains",
   "allowUnsignedDevelopmentRules",
   "noColor"
 ]);
+var DOMAIN_V2 = /^(?=.{1,253}$)(?:[a-z0-9](?:[a-z0-9-]{0,61}[a-z0-9])?\.)*[a-z0-9](?:[a-z0-9-]{0,61}[a-z0-9])?$/i;
+function isApprovedDomainV2(value) {
+  return typeof value === "string" && DOMAIN_V2.test(value);
+}
+
+// src/v2/path-admission.ts
+var CONTROL = /[\u0000-\u001f\u007f]/u;
+var SCHEME = /^[a-z][a-z\d+.-]*:/iu;
+var DRIVE = /^[a-z]:\//iu;
+var MAX_PATH = 4096;
+function isAbsoluteAdmittedPathV2(value) {
+  const normalized = value.replaceAll("\\", "/");
+  if (normalized.startsWith("//")) return false;
+  return normalized.startsWith("/") || DRIVE.test(normalized);
+}
+function isAdmittedLocalPath(value) {
+  return admitLocal(value, false) !== void 0;
+}
+function isAdmittedRelativePath(value) {
+  return admitLocal(value, true) !== void 0;
+}
+function normalizeAdmittedPathV2(value, relativeOnly = false) {
+  return admitLocal(value, relativeOnly);
+}
+function admitLocal(value, relativeOnly) {
+  if (typeof value !== "string" || value.length === 0 || value.length > MAX_PATH || CONTROL.test(value)) return void 0;
+  const normalized = value.replaceAll("\\", "/");
+  if (normalized.startsWith("//")) return void 0;
+  const drive = /^([a-z]):(?:\/|$)/iu.exec(normalized);
+  if (SCHEME.test(normalized) && drive === null) return void 0;
+  const absolute = drive !== null || normalized.startsWith("/");
+  if (relativeOnly && absolute) return void 0;
+  const body = drive === null ? normalized : normalized.slice(2);
+  const parts = [];
+  for (const part of body.split("/")) {
+    if (part === "" || part === ".") continue;
+    if (part === "..") return void 0;
+    parts.push(part);
+  }
+  if (drive !== null) return parts.length === 0 ? `${drive[1].toUpperCase()}:/` : `${drive[1].toUpperCase()}:/${parts.join("/")}`;
+  if (normalized.startsWith("/")) return parts.length === 0 ? "/" : `/${parts.join("/")}`;
+  if (relativeOnly && parts.length === 0) return void 0;
+  return parts.length === 0 ? "." : parts.join("/");
+}
 
 // src/v2/arguments.ts
 var severities = ["CRITICAL", "HIGH", "MEDIUM", "LOW", "INFO"];
-var commands = Object.freeze({ scan: true, rules: true, explain: true, profiles: true, "validate-config": true, version: true, "--version": true });
-var implicitV2Commands = Object.freeze({ rules: true, explain: true, profiles: true, "validate-config": true, version: true });
+var commands = Object.freeze({ scan: true, fix: true, rules: true, explain: true, profiles: true, "validate-config": true, version: true, "--version": true });
+var implicitV2Commands = Object.freeze({ fix: true, rules: true, explain: true, profiles: true, "validate-config": true, version: true });
 var scalarOptions = Object.freeze({ "--format": true, "--profile": true, "--fail-on": true, "--max-concurrency": true, "--concurrency": true, "--timeout": true, "--output": true, "--config": true, "--rules": true, "--catalogue": true, "--limits": true, "--target": true, "--n8n-version": true, "--edition": true, "--deployment": true, "--role": true, "--task-runner": true });
-var repeatableOptions = Object.freeze({ "--community-package": true, "--configuration": true, "--include": true, "--exclude": true });
-var configFields = Object.freeze({ "--format": "format", "--profile": "profile", "--fail-on": "failOn", "--max-concurrency": "concurrency", "--concurrency": "concurrency", "--output": "output", "--config": "configPath", "--rules": "rules", "--catalogue": "catalogue", "--limits": "limits", "--target": "target", "--include": "include", "--exclude": "exclude", "inputs": "inputs", "--require-complete": "requireComplete", "--allow-unsigned-development-rules": "allowUnsignedDevelopmentRules", "--no-color": "noColor" });
-var overrideOrder = ["format", "profile", "output", "inputs", "configPath", "failOn", "requireComplete", "concurrency", "rules", "catalogue", "limits", "target", "include", "exclude", "allowUnsignedDevelopmentRules", "noColor"];
+var repeatableOptions = Object.freeze({ "--community-package": true, "--configuration": true, "--approved-domain": true, "--include": true, "--exclude": true });
+var configFields = Object.freeze({ "--format": "format", "--profile": "profile", "--fail-on": "failOn", "--max-concurrency": "concurrency", "--concurrency": "concurrency", "--output": "output", "--config": "configPath", "--rules": "rules", "--catalogue": "catalogue", "--limits": "limits", "--target": "target", "--approved-domain": "approvedDomains", "--include": "include", "--exclude": "exclude", "inputs": "inputs", "--require-complete": "requireComplete", "--allow-unsigned-development-rules": "allowUnsignedDevelopmentRules", "--no-color": "noColor" });
+var overrideOrder = ["format", "profile", "output", "inputs", "configPath", "failOn", "requireComplete", "concurrency", "rules", "catalogue", "limits", "target", "include", "exclude", "approvedDomains", "allowUnsignedDevelopmentRules", "noColor"];
 function parseArgumentsV2(argv) {
   const stripped = stripSchema(argv);
   if (!stripped.ok) return stripped.result;
@@ -72,6 +190,7 @@ function parseArgumentsV2(argv) {
   if (raw === "--help") return success({ kind: "help", schema: "v2" });
   if (commands[raw] !== true) return failure("UNKNOWN_COMMAND", "Unknown v2 command.");
   const kind = raw === "--version" ? "version" : raw;
+  if (kind === "fix") return parseFix(args.slice(1));
   if (kind !== "scan") return parseMetadata(kind, args.slice(1));
   if (args.length === 2 && args[1] === "--help") return success({ kind: "help", schema: "v2", command: "scan" });
   const value = {
@@ -95,24 +214,40 @@ function parseArgumentsV2(argv) {
     include: ["**/*.json"],
     exclude: [".git/**", "node_modules/**"],
     allowUnsignedDevelopmentRules: false,
-    noColor: false
+    noColor: false,
+    auditSupplyChain: false,
+    includeReadiness: false
   };
   const overrides = {};
   const inputs = [];
-  const repeatable = { "--community-package": [], "--configuration": [], "--include": [], "--exclude": [] };
+  const repeatable = { "--community-package": [], "--configuration": [], "--approved-domain": [], "--include": [], "--exclude": [] };
   const seen = /* @__PURE__ */ new Set();
   for (let index = 1; index < args.length; index += 1) {
     const token = args[index];
     if (token === "--") {
-      inputs.push(...args.slice(index + 1));
+      for (const rawInput of args.slice(index + 1)) {
+        const input = rawInput === "-" ? "-" : normalizeAdmittedPathV2(rawInput);
+        if (input === void 0) return failure("REMOTE_PATH", "Input path is not admitted.");
+        inputs.push(input);
+      }
       break;
     }
     if (token === "-" || !token.startsWith("-")) {
-      if (!local(token)) return failure("REMOTE_PATH", "Input path is not admitted.");
-      inputs.push(token);
+      const input = token === "-" ? "-" : normalizeAdmittedPathV2(token);
+      if (input === void 0) return failure("REMOTE_PATH", "Input path is not admitted.");
+      inputs.push(input);
       continue;
     }
     const [name, inline] = splitOption(token);
+    if (name === "--audit-supply-chain" || name === "--include-readiness") {
+      if (inline !== void 0) return failure("INVALID_VALUE", "Boolean option does not accept a value.", name);
+      if (seen.has(name)) return failure("DUPLICATE_OPTION", "Option supplied more than once.", name);
+      const next = args[index + 1];
+      if (next === "true" || next === "false") return failure("INVALID_VALUE", "Boolean option does not accept a value.", name);
+      seen.add(name);
+      value[name === "--include-readiness" ? "includeReadiness" : "auditSupplyChain"] = true;
+      continue;
+    }
     if (name === "--require-complete" || name === "--allow-unsigned-development-rules" || name === "--no-color") {
       if (inline !== void 0 || seen.has(name)) return failure("DUPLICATE_OPTION", "Option supplied more than once.", name);
       seen.add(name);
@@ -127,7 +262,8 @@ function parseArgumentsV2(argv) {
     if (read === void 0 || read.length === 0 || inline === void 0 && read.startsWith("-") && !(name === "--output" && read === "-")) return failure("MISSING_VALUE", "Option requires a value.", name);
     if (inline === void 0) index += 1;
     if (repeatableOptions[name] === true) {
-      if (!local(read)) return failure("REMOTE_PATH", "Option value is not admitted.", name);
+      if (name === "--approved-domain" && !isApprovedDomainV2(read)) return failure("INVALID_VALUE", "Approved domain is invalid.", name);
+      if (!isAdmittedRelativePath(read)) return failure("REMOTE_PATH", "Option value is not admitted.", name);
       repeatable[name].push(read);
       if (configFields[name]) overrides[configFields[name]] = Object.freeze([...repeatable[name]]);
       continue;
@@ -143,16 +279,18 @@ function parseArgumentsV2(argv) {
     if (name === "--task-runner" && !["LEGACY", "NATIVE", "UNKNOWN"].includes(read)) return failure("INVALID_VALUE", "Task runner is invalid.", name);
     if (name === "--rules" || name === "--catalogue") {
       if (read !== "builtin") return failure(name === "--rules" ? "RULE_PACK_INVALID" : "SEMANTIC_CATALOGUE_INVALID", "Only built-in authority is available.", name);
-    } else if (["--limits", "--target", "--config"].includes(name) && (read === "-" || !local(read))) return failure("REMOTE_PATH", "Option value is not admitted.", name);
-    else if (name === "--output" && read !== "-" && !local(read)) return failure("REMOTE_PATH", "Option value is not admitted.", name);
+    } else if (["--limits", "--target", "--config"].includes(name) && (read === "-" || !isAdmittedRelativePath(read))) return failure("REMOTE_PATH", "Option value is not admitted.", name);
+    else if (name === "--output" && read !== "-" && !isAdmittedRelativePath(read)) return failure("REMOTE_PATH", "Option value is not admitted.", name);
     else if (["--n8n-version", "--edition", "--deployment", "--role", "--task-runner"].includes(name) && !safeText(read)) return failure("INVALID_VALUE", "Option value is not admitted.", name);
     seen.add(duplicateKey);
     assign(value, name, read);
+    if (name === "--profile") value.profile = ADMITTED_PROFILE_V2.id;
     if (configFields[name]) overrides[configFields[name]] = ["--max-concurrency", "--concurrency"].includes(name) ? Number(read) : read;
   }
+  if (value.includeReadiness === true && value.format === "sarif") return failure("INVALID_VALUE", "Readiness assessment cannot be projected into SARIF.", "--include-readiness");
   if (value.allowUnsignedDevelopmentRules === true) return failure("RULE_PACK_INVALID", "External rule packs are not admitted in this release.", "--allow-unsigned-development-rules");
   if (inputs.length === 0) return failure("UNEXPECTED_ARGUMENT", "At least one workflow input is required.");
-  if (inputs.some((input) => !local(input))) return failure("REMOTE_PATH", "Input path is not admitted.");
+  if (inputs.some((input) => input !== "-" && !isAdmittedLocalPath(input))) return failure("REMOTE_PATH", "Input path is not admitted.");
   if (inputs.includes("-") && inputs.length > 1) return failure("UNEXPECTED_ARGUMENT", "Standard input cannot be combined with file inputs.");
   overrides.inputs = Object.freeze([...inputs]);
   const cliOverrides = {};
@@ -163,7 +301,7 @@ function parseArgumentsV2(argv) {
     schema: "v2",
     inputs: Object.freeze([...inputs]),
     format: value.format,
-    profile: value.profile,
+    profile: ADMITTED_PROFILE_V2.id,
     failOn: value.failOn,
     requireComplete: value.requireComplete,
     concurrency: value.concurrency,
@@ -181,10 +319,13 @@ function parseArgumentsV2(argv) {
     taskRunner: value.taskRunner,
     communityPackages: arrayFor(repeatable["--community-package"]),
     configuration: arrayFor(repeatable["--configuration"]),
+    approvedDomains: arrayFor(repeatable["--approved-domain"]),
     include: repeatable["--include"].length > 0 ? arrayFor(repeatable["--include"]) : Object.freeze(["**/*.json"]),
     exclude: repeatable["--exclude"].length > 0 ? arrayFor(repeatable["--exclude"]) : Object.freeze([".git/**", "node_modules/**"]),
     allowUnsignedDevelopmentRules: value.allowUnsignedDevelopmentRules,
     noColor: value.noColor,
+    auditSupplyChain: value.auditSupplyChain === true,
+    includeReadiness: value.includeReadiness,
     cliOverrides
   };
   return success(command);
@@ -197,6 +338,67 @@ function parseCliArguments(argv) {
   const implicit = argv[0] !== void 0 && implicitV2Commands[argv[0]] === true;
   return hasSchema || implicit ? freeze({ mode: "v2", result: parseArgumentsV2(argv) }) : freeze({ mode: "v1", argv: Object.freeze([...argv]) });
 }
+var FIX_OPTIONS = Object.freeze({ "--root": true, "--input": true, "--fix": true, "--mapping": true, "--endpoint-receipt": true });
+var FIX_SELECTION = /^[A-Za-z0-9][A-Za-z0-9._:@-]{0,127}$/u;
+var SUBSTITUTION_LITERAL = /(?:\{\{|\}\}|\$env\b|\$\{|\$[A-Za-z_][A-Za-z0-9_]*\b|%[A-Za-z_][A-Za-z0-9_]*%)/u;
+function fixPathValue(name, read) {
+  if (read === "-") return failure("INVALID_VALUE", "Fix commands require a file path; standard input cannot be re-read.", name);
+  if (SUBSTITUTION_LITERAL.test(read)) return failure("REMOTE_PATH", "Option value is not admitted.", name);
+  const value = normalizeAdmittedPathV2(read, name !== "--root");
+  if (value === void 0) return failure("REMOTE_PATH", "Option value is not admitted.", name);
+  if (name === "--root" && !isAbsoluteAdmittedPathV2(value)) return failure("INVALID_VALUE", "Root must be an absolute local directory.", name);
+  return value;
+}
+function parseFix(args) {
+  const action = args[0];
+  if (action !== "suggest" && action !== "apply") return failure("UNKNOWN_COMMAND", "fix requires the suggest or apply subcommand.");
+  const selected = {};
+  const seen = /* @__PURE__ */ new Set();
+  let confirm = false;
+  for (let index = 1; index < args.length; index += 1) {
+    const token = args[index];
+    if (!token.startsWith("-") || token === "-") return failure("UNEXPECTED_ARGUMENT", "fix accepts options only; positional arguments are not admitted.");
+    const [name, inline] = splitOption(token);
+    if (name === "--confirm") {
+      if (inline !== void 0) return failure("INVALID_VALUE", "Boolean option does not accept a value.", name);
+      if (action !== "apply") return failure("UNEXPECTED_ARGUMENT", "The suggest action does not accept --confirm.", name);
+      if (seen.has(name)) return failure("DUPLICATE_OPTION", "Option supplied more than once.", name);
+      seen.add(name);
+      confirm = true;
+      continue;
+    }
+    if (FIX_OPTIONS[name] !== true) return failure("UNKNOWN_OPTION", "Unknown option.", name);
+    if (seen.has(name)) return failure("DUPLICATE_OPTION", "Option supplied more than once.", name);
+    const read = inline ?? args[index + 1];
+    if (read === void 0 || read.length === 0 || inline === void 0 && read.startsWith("-") && read !== "-") return failure("MISSING_VALUE", "Option requires a value.", name);
+    if (inline === void 0) index += 1;
+    seen.add(name);
+    if (name === "--fix") {
+      if (!FIX_SELECTION.test(read) || /^[A-Za-z][A-Za-z0-9+.-]*:/u.test(read)) return failure("INVALID_VALUE", "Fix selection is invalid.", name);
+      selected.fix = read;
+      continue;
+    }
+    const path = fixPathValue(name, read);
+    if (typeof path !== "string") return path;
+    selected[name === "--root" ? "root" : name === "--input" ? "input" : name === "--mapping" ? "mapping" : "endpointReceipt"] = path;
+  }
+  if (selected.root === void 0) return failure("UNEXPECTED_ARGUMENT", "fix requires exactly one --root.");
+  if (selected.input === void 0) return failure("UNEXPECTED_ARGUMENT", "fix requires exactly one --input.");
+  if (action === "apply" && selected.fix === void 0) return failure("UNEXPECTED_ARGUMENT", "fix apply requires one selected fix.");
+  if (action === "apply" && !confirm) return failure("UNEXPECTED_ARGUMENT", "fix apply requires --confirm.", "--confirm");
+  return success({
+    kind: "fix",
+    schema: "v2",
+    action,
+    format: "json",
+    root: selected.root,
+    input: selected.input,
+    ...selected.fix === void 0 ? {} : { fix: selected.fix },
+    ...selected.mapping === void 0 ? {} : { mapping: selected.mapping },
+    ...selected.endpointReceipt === void 0 ? {} : { endpointReceipt: selected.endpointReceipt },
+    confirm
+  });
+}
 function parseMetadata(kind, args) {
   if (args.length === 1 && args[0] === "--help") return success({ kind: "help", schema: "v2", command: kind });
   let format = "json";
@@ -219,7 +421,7 @@ function parseMetadata(kind, args) {
     return success({ kind, schema: "v2", format });
   }
   if (kind === "explain") return rest.length === 1 && safeText(rest[0]) ? success({ kind, schema: "v2", format, ruleId: rest[0] }) : failure("UNEXPECTED_ARGUMENT", "explain requires one rule ID.");
-  if (rest.length !== 1 || !local(rest[0])) return failure("UNEXPECTED_ARGUMENT", "validate-config requires one local file.");
+  if (rest.length !== 1 || !isAdmittedRelativePath(rest[0])) return failure("UNEXPECTED_ARGUMENT", "validate-config requires one local file.");
   return success({ kind, schema: "v2", format, path: rest[0] });
 }
 function assign(value, name, read) {
@@ -238,9 +440,6 @@ function positiveInteger(value, maximum) {
 function safeText(value) {
   return value.length > 0 && value.length <= 4096 && !/[\u0000-\u001f\u007f]/.test(value) && !/^(?:[a-z][a-z\d+.-]*:|\/|[a-z]:|\\\\)/i.test(value);
 }
-function local(value) {
-  return safeText(value) && !/^(?:[a-z][a-z\d+.-]*:|\/|[a-z]:|\\\\)/i.test(value);
-}
 function hasSchemaMarker(argv) {
   for (const token of argv) {
     if (token === "--") break;