sfscanner 0.2.0 → 0.2.1

package/dist/v2/arguments.d.ts

@@ -1,87 +1 @@
-import { ADMITTED_PROFILE_V2, type ScanConfigV2, type ScanSeverityV2 } from './contracts.js';
-import type { V2CommandName } from './help.js';
-export type CliFormatV2 = 'json' | 'ndjson' | 'sarif' | 'table';
-export type CliProfileV2 = typeof ADMITTED_PROFILE_V2.id;
-export type CliTargetEnumV2 = 'UNKNOWN' | 'COMMUNITY' | 'ENTERPRISE' | 'CLOUD' | 'SELF_HOSTED' | 'OWNER' | 'ADMIN' | 'MEMBER' | 'LEGACY' | 'NATIVE';
-export type CliParseErrorCodeV2 = 'NO_COMMAND' | 'UNKNOWN_COMMAND' | 'UNKNOWN_OPTION' | 'MISSING_VALUE' | 'INVALID_VALUE' | 'DUPLICATE_OPTION' | 'UNEXPECTED_ARGUMENT' | 'REMOTE_PATH' | 'RULE_PACK_INVALID' | 'SEMANTIC_CATALOGUE_INVALID' | 'PROFILE_NOT_ADMITTED';
-export type CliParseErrorV2 = Readonly<{
-    code: CliParseErrorCodeV2;
-    message: string;
-    argument?: string;
-}>;
-type ScanCommandV2 = Readonly<{
-    kind: 'scan';
-    schema: 'v2';
-    inputs: readonly string[];
-    format: CliFormatV2;
-    profile: CliProfileV2;
-    failOn: ScanSeverityV2;
-    requireComplete: boolean;
-    concurrency: number;
-    timeoutMs?: number;
-    output?: string;
-    configPath?: string;
-    rules: 'builtin';
-    catalogue: 'builtin';
-    limits: string;
-    target?: string;
-    n8nVersion?: string;
-    edition: 'COMMUNITY' | 'ENTERPRISE' | 'CLOUD' | 'UNKNOWN';
-    deployment: 'SELF_HOSTED' | 'CLOUD' | 'UNKNOWN';
-    role: 'OWNER' | 'ADMIN' | 'MEMBER' | 'UNKNOWN';
-    taskRunner: 'LEGACY' | 'NATIVE' | 'UNKNOWN';
-    communityPackages: readonly string[];
-    configuration: readonly string[];
-    approvedDomains: readonly string[];
-    include: readonly string[];
-    exclude: readonly string[];
-    allowUnsignedDevelopmentRules: boolean;
-    noColor: boolean;
-    cliOverrides: Readonly<Partial<ScanConfigV2>>;
-}>;
-export type CliHelpCommandV2 = Readonly<{
-    kind: 'help';
-    schema: 'v2';
-    command?: V2CommandName;
-}>;
-export type CliCommandV2 = ScanCommandV2 | Readonly<{
-    kind: 'rules';
-    schema: 'v2';
-    format: 'json' | 'table';
-}> | Readonly<{
-    kind: 'explain';
-    schema: 'v2';
-    format: 'json' | 'table';
-    ruleId: string;
-}> | Readonly<{
-    kind: 'profiles';
-    schema: 'v2';
-    format: 'json' | 'table';
-}> | Readonly<{
-    kind: 'validate-config';
-    schema: 'v2';
-    format: 'json' | 'table';
-    path: string;
-}> | Readonly<{
-    kind: 'version';
-    schema: 'v2';
-    format: 'json' | 'table';
-}>;
-type ParsedCommandV2 = CliCommandV2 | CliHelpCommandV2;
-export type CliParseResultV2 = Readonly<{
-    ok: true;
-    command: ParsedCommandV2;
-} | {
-    ok: false;
-    error: CliParseErrorV2;
-}>;
-export type CliArgumentDispatch = Readonly<{
-    mode: 'v1';
-    argv: readonly string[];
-} | {
-    mode: 'v2';
-    result: CliParseResultV2;
-}>;
-export declare function parseArgumentsV2(argv: readonly string[]): CliParseResultV2;
-export declare function parseCliArguments(argv: readonly string[]): CliArgumentDispatch;
-export {};
+export * from "../_types/packages/scanner-cli/src/v2/arguments.js";

package/dist/v2/arguments.js

@@ -62,8 +62,8 @@ function isAdmittedProfileSpecifierV2(value) {
 }
 var BUILTIN_AUTHORITIES_V2 = Object.freeze({
   profile: ADMITTED_PROFILE_V2,
-  rules: Object.freeze({ id: "scanner-core-builtins", version: "2.0.0", digest: "a36d00564bbf8e8c38f05820480782cdc53fdbd3712558850066c4e3f5c3413d", signatureStatus: "VERIFIED" }),
-  semantics: Object.freeze({ id: "scanner-core-builtins", version: "2.2.0", digest: "bc6fdecc34e460b5b01973ef7a8ce06b27b9b100ae03b480110f11f2a63ac328" }),
+  rules: Object.freeze({ id: "scanner-core-builtins", version: "2.0.0", digest: "30bdc8343582b6a4efc13538d3475db87d07fa28bea4027f9e93b813213fd510", signatureStatus: "VERIFIED" }),
+  semantics: Object.freeze({ id: "scanner-core-builtins", version: "2.2.0", digest: "58419339dcf99ed398d2955282662e6f6d37208f62393cafb56818d4a38182d7" }),
   limits: Object.freeze({ schemaVersion: "scanner-limits-v2", digest: "fca787753ca88f71cf0d174427f4ac730a7aef1c823aaf73aa1ea72af92b4077" })
 });
 var PROFILE_MANIFEST_DIGEST_V2 = ADMITTED_PROFILE_V2.digest;
@@ -72,6 +72,13 @@ var BUILTIN_SEMANTICS_AUTHORITY_V2 = BUILTIN_AUTHORITIES_V2.semantics;
 var BUILTIN_LIMITS_AUTHORITY_V2 = BUILTIN_AUTHORITIES_V2.limits;
 var RULE_PACK_DIGEST_V2 = BUILTIN_RULESET_AUTHORITY_V2.digest;
 var SEMANTIC_CATALOGUE_DIGEST_V2 = BUILTIN_SEMANTICS_AUTHORITY_V2.digest;
+var BUILTIN_SCOPED_SEMANTICS_AUTHORITY_V2 = Object.freeze({
+  id: "reviewed-gmail-message-v1",
+  version: "1",
+  digest: "2b21f771d2cf172e33e8f78e5d1deaaefc0a5e8ff45f7d9f252cb8ec321ad56a",
+  sourceReceiptSha256: "2e8b7a2666cfc07c7609fdc9a2bdf01be291195a8b7da0af0f69836a180f8685",
+  sourceReceiptCanonicalDigest: "965de9fabde482dd5a6bcc67299fce8c33232e78c9fdc70053ad588b0f62ba2a"
+});
 var CLI_VERSION_V2 = "0.1.0";
 var CLI_TOOL_V2 = Object.freeze({
   name: "n8n-scan",
@@ -81,7 +88,8 @@ var CLI_TOOL_V2 = Object.freeze({
     version: "2.0.0",
     profile: ADMITTED_PROFILE_V2,
     ruleset: BUILTIN_RULESET_AUTHORITY_V2.digest,
-    semantics: BUILTIN_SEMANTICS_AUTHORITY_V2.digest
+    semantics: BUILTIN_SEMANTICS_AUTHORITY_V2.digest,
+    scopedSemantics: BUILTIN_SCOPED_SEMANTICS_AUTHORITY_V2
   })).digest("hex")
 });
 var DEFAULT_SCAN_CONFIG_V2 = Object.freeze({
@@ -128,7 +136,13 @@ function isApprovedDomainV2(value) {
 // src/v2/path-admission.ts
 var CONTROL = /[\u0000-\u001f\u007f]/u;
 var SCHEME = /^[a-z][a-z\d+.-]*:/iu;
+var DRIVE = /^[a-z]:\//iu;
 var MAX_PATH = 4096;
+function isAbsoluteAdmittedPathV2(value) {
+  const normalized = value.replaceAll("\\", "/");
+  if (normalized.startsWith("//")) return false;
+  return normalized.startsWith("/") || DRIVE.test(normalized);
+}
 function isAdmittedLocalPath(value) {
   return admitLocal(value, false) !== void 0;
 }
@@ -161,8 +175,8 @@ function admitLocal(value, relativeOnly) {
 
 // src/v2/arguments.ts
 var severities = ["CRITICAL", "HIGH", "MEDIUM", "LOW", "INFO"];
-var commands = Object.freeze({ scan: true, rules: true, explain: true, profiles: true, "validate-config": true, version: true, "--version": true });
-var implicitV2Commands = Object.freeze({ rules: true, explain: true, profiles: true, "validate-config": true, version: true });
+var commands = Object.freeze({ scan: true, fix: true, rules: true, explain: true, profiles: true, "validate-config": true, version: true, "--version": true });
+var implicitV2Commands = Object.freeze({ fix: true, rules: true, explain: true, profiles: true, "validate-config": true, version: true });
 var scalarOptions = Object.freeze({ "--format": true, "--profile": true, "--fail-on": true, "--max-concurrency": true, "--concurrency": true, "--timeout": true, "--output": true, "--config": true, "--rules": true, "--catalogue": true, "--limits": true, "--target": true, "--n8n-version": true, "--edition": true, "--deployment": true, "--role": true, "--task-runner": true });
 var repeatableOptions = Object.freeze({ "--community-package": true, "--configuration": true, "--approved-domain": true, "--include": true, "--exclude": true });
 var configFields = Object.freeze({ "--format": "format", "--profile": "profile", "--fail-on": "failOn", "--max-concurrency": "concurrency", "--concurrency": "concurrency", "--output": "output", "--config": "configPath", "--rules": "rules", "--catalogue": "catalogue", "--limits": "limits", "--target": "target", "--approved-domain": "approvedDomains", "--include": "include", "--exclude": "exclude", "inputs": "inputs", "--require-complete": "requireComplete", "--allow-unsigned-development-rules": "allowUnsignedDevelopmentRules", "--no-color": "noColor" });
@@ -176,6 +190,7 @@ function parseArgumentsV2(argv) {
   if (raw === "--help") return success({ kind: "help", schema: "v2" });
   if (commands[raw] !== true) return failure("UNKNOWN_COMMAND", "Unknown v2 command.");
   const kind = raw === "--version" ? "version" : raw;
+  if (kind === "fix") return parseFix(args.slice(1));
   if (kind !== "scan") return parseMetadata(kind, args.slice(1));
   if (args.length === 2 && args[1] === "--help") return success({ kind: "help", schema: "v2", command: "scan" });
   const value = {
@@ -199,7 +214,9 @@ function parseArgumentsV2(argv) {
     include: ["**/*.json"],
     exclude: [".git/**", "node_modules/**"],
     allowUnsignedDevelopmentRules: false,
-    noColor: false
+    noColor: false,
+    auditSupplyChain: false,
+    includeReadiness: false
   };
   const overrides = {};
   const inputs = [];
@@ -222,6 +239,15 @@ function parseArgumentsV2(argv) {
       continue;
     }
     const [name, inline] = splitOption(token);
+    if (name === "--audit-supply-chain" || name === "--include-readiness") {
+      if (inline !== void 0) return failure("INVALID_VALUE", "Boolean option does not accept a value.", name);
+      if (seen.has(name)) return failure("DUPLICATE_OPTION", "Option supplied more than once.", name);
+      const next = args[index + 1];
+      if (next === "true" || next === "false") return failure("INVALID_VALUE", "Boolean option does not accept a value.", name);
+      seen.add(name);
+      value[name === "--include-readiness" ? "includeReadiness" : "auditSupplyChain"] = true;
+      continue;
+    }
     if (name === "--require-complete" || name === "--allow-unsigned-development-rules" || name === "--no-color") {
       if (inline !== void 0 || seen.has(name)) return failure("DUPLICATE_OPTION", "Option supplied more than once.", name);
       seen.add(name);
@@ -261,6 +287,7 @@ function parseArgumentsV2(argv) {
     if (name === "--profile") value.profile = ADMITTED_PROFILE_V2.id;
     if (configFields[name]) overrides[configFields[name]] = ["--max-concurrency", "--concurrency"].includes(name) ? Number(read) : read;
   }
+  if (value.includeReadiness === true && value.format === "sarif") return failure("INVALID_VALUE", "Readiness assessment cannot be projected into SARIF.", "--include-readiness");
   if (value.allowUnsignedDevelopmentRules === true) return failure("RULE_PACK_INVALID", "External rule packs are not admitted in this release.", "--allow-unsigned-development-rules");
   if (inputs.length === 0) return failure("UNEXPECTED_ARGUMENT", "At least one workflow input is required.");
   if (inputs.some((input) => input !== "-" && !isAdmittedLocalPath(input))) return failure("REMOTE_PATH", "Input path is not admitted.");
@@ -297,6 +324,8 @@ function parseArgumentsV2(argv) {
     exclude: repeatable["--exclude"].length > 0 ? arrayFor(repeatable["--exclude"]) : Object.freeze([".git/**", "node_modules/**"]),
     allowUnsignedDevelopmentRules: value.allowUnsignedDevelopmentRules,
     noColor: value.noColor,
+    auditSupplyChain: value.auditSupplyChain === true,
+    includeReadiness: value.includeReadiness,
     cliOverrides
   };
   return success(command);
@@ -309,6 +338,67 @@ function parseCliArguments(argv) {
   const implicit = argv[0] !== void 0 && implicitV2Commands[argv[0]] === true;
   return hasSchema || implicit ? freeze({ mode: "v2", result: parseArgumentsV2(argv) }) : freeze({ mode: "v1", argv: Object.freeze([...argv]) });
 }
+var FIX_OPTIONS = Object.freeze({ "--root": true, "--input": true, "--fix": true, "--mapping": true, "--endpoint-receipt": true });
+var FIX_SELECTION = /^[A-Za-z0-9][A-Za-z0-9._:@-]{0,127}$/u;
+var SUBSTITUTION_LITERAL = /(?:\{\{|\}\}|\$env\b|\$\{|\$[A-Za-z_][A-Za-z0-9_]*\b|%[A-Za-z_][A-Za-z0-9_]*%)/u;
+function fixPathValue(name, read) {
+  if (read === "-") return failure("INVALID_VALUE", "Fix commands require a file path; standard input cannot be re-read.", name);
+  if (SUBSTITUTION_LITERAL.test(read)) return failure("REMOTE_PATH", "Option value is not admitted.", name);
+  const value = normalizeAdmittedPathV2(read, name !== "--root");
+  if (value === void 0) return failure("REMOTE_PATH", "Option value is not admitted.", name);
+  if (name === "--root" && !isAbsoluteAdmittedPathV2(value)) return failure("INVALID_VALUE", "Root must be an absolute local directory.", name);
+  return value;
+}
+function parseFix(args) {
+  const action = args[0];
+  if (action !== "suggest" && action !== "apply") return failure("UNKNOWN_COMMAND", "fix requires the suggest or apply subcommand.");
+  const selected = {};
+  const seen = /* @__PURE__ */ new Set();
+  let confirm = false;
+  for (let index = 1; index < args.length; index += 1) {
+    const token = args[index];
+    if (!token.startsWith("-") || token === "-") return failure("UNEXPECTED_ARGUMENT", "fix accepts options only; positional arguments are not admitted.");
+    const [name, inline] = splitOption(token);
+    if (name === "--confirm") {
+      if (inline !== void 0) return failure("INVALID_VALUE", "Boolean option does not accept a value.", name);
+      if (action !== "apply") return failure("UNEXPECTED_ARGUMENT", "The suggest action does not accept --confirm.", name);
+      if (seen.has(name)) return failure("DUPLICATE_OPTION", "Option supplied more than once.", name);
+      seen.add(name);
+      confirm = true;
+      continue;
+    }
+    if (FIX_OPTIONS[name] !== true) return failure("UNKNOWN_OPTION", "Unknown option.", name);
+    if (seen.has(name)) return failure("DUPLICATE_OPTION", "Option supplied more than once.", name);
+    const read = inline ?? args[index + 1];
+    if (read === void 0 || read.length === 0 || inline === void 0 && read.startsWith("-") && read !== "-") return failure("MISSING_VALUE", "Option requires a value.", name);
+    if (inline === void 0) index += 1;
+    seen.add(name);
+    if (name === "--fix") {
+      if (!FIX_SELECTION.test(read) || /^[A-Za-z][A-Za-z0-9+.-]*:/u.test(read)) return failure("INVALID_VALUE", "Fix selection is invalid.", name);
+      selected.fix = read;
+      continue;
+    }
+    const path = fixPathValue(name, read);
+    if (typeof path !== "string") return path;
+    selected[name === "--root" ? "root" : name === "--input" ? "input" : name === "--mapping" ? "mapping" : "endpointReceipt"] = path;
+  }
+  if (selected.root === void 0) return failure("UNEXPECTED_ARGUMENT", "fix requires exactly one --root.");
+  if (selected.input === void 0) return failure("UNEXPECTED_ARGUMENT", "fix requires exactly one --input.");
+  if (action === "apply" && selected.fix === void 0) return failure("UNEXPECTED_ARGUMENT", "fix apply requires one selected fix.");
+  if (action === "apply" && !confirm) return failure("UNEXPECTED_ARGUMENT", "fix apply requires --confirm.", "--confirm");
+  return success({
+    kind: "fix",
+    schema: "v2",
+    action,
+    format: "json",
+    root: selected.root,
+    input: selected.input,
+    ...selected.fix === void 0 ? {} : { fix: selected.fix },
+    ...selected.mapping === void 0 ? {} : { mapping: selected.mapping },
+    ...selected.endpointReceipt === void 0 ? {} : { endpointReceipt: selected.endpointReceipt },
+    confirm
+  });
+}
 function parseMetadata(kind, args) {
   if (args.length === 1 && args[0] === "--help") return success({ kind: "help", schema: "v2", command: kind });
   let format = "json";

package/dist/v2/arguments.js.map

@@ -1,7 +1,7 @@
 {
   "version": 3,
   "sources": ["../../src/v2/contracts.ts", "../../../scanner-core/src/canonical-json.ts", "../../src/v2/path-admission.ts", "../../src/v2/arguments.ts"],
-  "sourcesContent": ["import { createHash } from 'node:crypto';\nimport { canonicalizeJson } from '@hub/scanner-core/canonical-json';\n\nexport const SCAN_CONFIG_SCHEMA_V2 = 'n8n-scan-config-v2' as const;\nexport type ScanFormatV2 = 'json' | 'ndjson' | 'sarif' | 'table';\nexport type ScanSeverityV2 = 'CRITICAL' | 'HIGH' | 'MEDIUM' | 'LOW' | 'INFO';\nexport type ScanConfigV2 = Readonly<{\n  schemaVersion: typeof SCAN_CONFIG_SCHEMA_V2;\n  format?: ScanFormatV2;\n  profile?: string;\n  output?: string;\n  inputs?: readonly string[];\n  configPath?: string;\n  failOn?: ScanSeverityV2;\n  requireComplete?: boolean;\n  concurrency?: number;\n  rules?: string;\n  catalogue?: string;\n  limits?: string;\n  target?: string;\n  include?: readonly string[];\n  exclude?: readonly string[];\n  approvedDomains?: readonly string[];\n  allowUnsignedDevelopmentRules?: boolean;\n  noColor?: boolean;\n}>;\n\nexport const ADMITTED_PROFILE_V2 = Object.freeze({ id: 'beta-default', version: '2.0.0', digest: '3ca5d69db2554383e22c44afe507cc98e381ea58a7e42aaac0ee8f7497fb4f44' });\n\n/**\n * The profile spellings a caller may write, and the one place they are listed. Both the\n * config loader and the MCP tool read this, so a profile cannot be admitted on one\n * surface and refused on the other; the bare id and its `id@version` pin are the same\n * admission, and both canonicalize to `ADMITTED_PROFILE_V2.id`.\n */\nexport const ADMITTED_PROFILE_SPECIFIERS_V2: readonly string[] = Object.freeze([\n  ADMITTED_PROFILE_V2.id,\n  `${ADMITTED_PROFILE_V2.id}@${ADMITTED_PROFILE_V2.version}`,\n]);\n\nexport function isAdmittedProfileSpecifierV2(value: unknown): value is string {\n  return typeof value === 'string' && ADMITTED_PROFILE_SPECIFIERS_V2.includes(value);\n}\nexport const BUILTIN_AUTHORITIES_V2 = Object.freeze({\n  profile: ADMITTED_PROFILE_V2,\n  rules: Object.freeze({ id: 'scanner-core-builtins', version: '2.0.0', digest: 'a36d00564bbf8e8c38f05820480782cdc53fdbd3712558850066c4e3f5c3413d', signatureStatus: 'VERIFIED' as const }),\n  semantics: Object.freeze({ id: 'scanner-core-builtins', version: '2.2.0', digest: 'bc6fdecc34e460b5b01973ef7a8ce06b27b9b100ae03b480110f11f2a63ac328' }),\n  limits: Object.freeze({ schemaVersion: 'scanner-limits-v2' as const, digest: 'fca787753ca88f71cf0d174427f4ac730a7aef1c823aaf73aa1ea72af92b4077' }),\n});\nexport const PROFILE_MANIFEST_DIGEST_V2 = ADMITTED_PROFILE_V2.digest;\nexport const BUILTIN_RULESET_AUTHORITY_V2 = BUILTIN_AUTHORITIES_V2.rules;\nexport const BUILTIN_SEMANTICS_AUTHORITY_V2 = BUILTIN_AUTHORITIES_V2.semantics;\nexport const BUILTIN_LIMITS_AUTHORITY_V2 = BUILTIN_AUTHORITIES_V2.limits;\nexport const RULE_PACK_DIGEST_V2 = BUILTIN_RULESET_AUTHORITY_V2.digest;\nexport const SEMANTIC_CATALOGUE_DIGEST_V2 = BUILTIN_SEMANTICS_AUTHORITY_V2.digest;\n\n/**\n * One tool identity for every machine surface: the JSON/NDJSON scan envelopes and the\n * rules/explain/profiles metadata documents. The digest folds the admitted engine, profile,\n * ruleset, and semantics authorities, so a re-pin moves every surface together instead of\n * leaving a frozen literal behind on one of them.\n */\nexport const CLI_VERSION_V2 = '0.1.0' as const;\nexport type CliToolIdentityV2 = Readonly<{ name: 'n8n-scan'; version: string; buildDigest: string }>;\nexport const CLI_TOOL_V2: CliToolIdentityV2 = Object.freeze({\n  name: 'n8n-scan',\n  version: CLI_VERSION_V2,\n  buildDigest: createHash('sha256').update(canonicalizeJson({\n    engine: 'secureflow-scanner', version: '2.0.0', profile: ADMITTED_PROFILE_V2,\n    ruleset: BUILTIN_RULESET_AUTHORITY_V2.digest, semantics: BUILTIN_SEMANTICS_AUTHORITY_V2.digest,\n  })).digest('hex'),\n});\n\nexport const DEFAULT_SCAN_CONFIG_V2: ScanConfigV2 = Object.freeze({\n  schemaVersion: SCAN_CONFIG_SCHEMA_V2,\n  format: 'json', profile: ADMITTED_PROFILE_V2.id, failOn: 'INFO', requireComplete: false, concurrency: 1,\n  rules: 'builtin', catalogue: 'builtin', limits: 'builtin',\n  include: Object.freeze(['**/*.json']), exclude: Object.freeze(['.git/**', 'node_modules/**']),\n  approvedDomains: Object.freeze([]),\n  allowUnsignedDevelopmentRules: false, noColor: false,\n});\n\nexport const SCAN_CONFIG_V2_FIELDS = Object.freeze([\n  'schemaVersion', 'format', 'profile', 'output', 'inputs', 'configPath', 'failOn', 'requireComplete', 'concurrency',\n  'rules', 'catalogue', 'limits', 'target', 'include', 'exclude', 'approvedDomains',\n  'allowUnsignedDevelopmentRules', 'noColor',\n] as const);\nexport const SCAN_CONFIG_V2_MAX_STRING = 4096;\nexport const SCAN_CONFIG_V2_MAX_PATTERNS = 1024;\nexport const SCAN_CONFIG_V2_MAX_CONCURRENCY = 16;\nexport const SCAN_CONFIG_V2_MAX_DOMAINS = 1_000;\nexport const DOMAIN_V2 = /^(?=.{1,253}$)(?:[a-z0-9](?:[a-z0-9-]{0,61}[a-z0-9])?\\.)*[a-z0-9](?:[a-z0-9-]{0,61}[a-z0-9])?$/i;\nexport function isApprovedDomainV2(value: unknown): value is string {\n  return typeof value === 'string' && DOMAIN_V2.test(value);\n}\n", "/**\n * Serialize JSON-compatible values with locale-independent object ordering.\n * Arrays retain their input order; they are never treated as sets.\n */\nexport function canonicalizeJson(value: unknown): string {\n  return encodeCanonical(value, new Set<object>());\n}\n\n/** Encode the canonical representation using the platform's UTF-8 encoder. */\nexport function canonicalJsonBytes(value: unknown): Uint8Array {\n  return new TextEncoder().encode(canonicalizeJson(value));\n}\n\nfunction encodeCanonical(value: unknown, seen: Set<object>): string {\n  if (value === null) return 'null';\n  if (typeof value === 'string') return JSON.stringify(value);\n  if (typeof value === 'boolean') return value ? 'true' : 'false';\n  if (typeof value === 'number') {\n    if (!Number.isFinite(value)) throw new TypeError('Cannot encode non-finite number as canonical JSON');\n    return JSON.stringify(Object.is(value, -0) ? 0 : value);\n  }\n  if (typeof value !== 'object' || value === undefined) {\n    throw new TypeError(`Cannot encode ${typeof value} as canonical JSON`);\n  }\n  if (seen.has(value)) throw new TypeError('Cannot encode cyclic value as canonical JSON');\n  seen.add(value);\n\n  try {\n    if (Array.isArray(value)) return encodeArray(value, seen);\n    return encodeObject(value as Record<string, unknown>, seen);\n  } finally {\n    seen.delete(value);\n  }\n}\n\nfunction encodeArray(value: readonly unknown[], seen: Set<object>): string {\n  const values = Array.from({ length: value.length }, (_, index) => {\n    if (!Object.prototype.hasOwnProperty.call(value, index)) {\n      throw new TypeError('Cannot encode sparse array as canonical JSON');\n    }\n    return encodeCanonical(value[index], seen);\n  });\n  return `[${values.join(',')}]`;\n}\n\nfunction encodeObject(value: Record<string, unknown>, seen: Set<object>): string {\n  const prototype = Object.getPrototypeOf(value);\n  if (prototype !== Object.prototype && prototype !== null) {\n    throw new TypeError('Cannot encode a non-plain object as canonical JSON');\n  }\n  if (Object.getOwnPropertySymbols(value).some((symbol) =>\n    Object.prototype.propertyIsEnumerable.call(value, symbol))) {\n    throw new TypeError('Cannot encode symbol properties as canonical JSON');\n  }\n\n  const pairs = Object.keys(value)\n    .sort(compareCanonicalStrings)\n    .map((key) => `${JSON.stringify(key)}:${encodeCanonical(value[key], seen)}`);\n  return `{${pairs.join(',')}}`;\n}\n\nfunction compareCanonicalStrings(left: string, right: string): number {\n  if (left === right) return 0;\n  return left < right ? -1 : 1;\n}\n", "import { posix, win32 } from 'node:path';\n\nconst CONTROL = /[\\u0000-\\u001f\\u007f]/u;\nconst SCHEME = /^[a-z][a-z\\d+.-]*:/iu;\nconst DRIVE = /^[a-z]:\\//iu;\nconst MAX_PATH = 4096;\n\n/** Normalizes backslashes before classifying, so a Windows drive path is absolute in both forms. */\nexport function isAbsoluteAdmittedPathV2(value: string): boolean {\n  const normalized = value.replaceAll('\\\\', '/');\n  if (normalized.startsWith('//')) return false; // UNC and protocol-relative are not local absolutes\n  return normalized.startsWith('/') || DRIVE.test(normalized);\n}\n\nexport function isAdmittedLocalPath(value: unknown): value is string {\n  return admitLocal(value, false) !== undefined;\n}\n\nexport function isAdmittedRelativePath(value: unknown): value is string {\n  return admitLocal(value, true) !== undefined;\n}\n\nexport function normalizeAdmittedPathV2(value: unknown, relativeOnly = false): string | undefined {\n  return admitLocal(value, relativeOnly);\n}\n\nfunction admitLocal(value: unknown, relativeOnly: boolean): string | undefined {\n  if (typeof value !== 'string' || value.length === 0 || value.length > MAX_PATH || CONTROL.test(value)) return undefined;\n  const normalized = value.replaceAll('\\\\', '/');\n  if (normalized.startsWith('//')) return undefined;\n  const drive = /^([a-z]):(?:\\/|$)/iu.exec(normalized);\n  if (SCHEME.test(normalized) && drive === null) return undefined;\n  const absolute = drive !== null || normalized.startsWith('/');\n  if (relativeOnly && absolute) return undefined;\n  const body = drive === null ? normalized : normalized.slice(2);\n  const parts: string[] = [];\n  for (const part of body.split('/')) {\n    if (part === '' || part === '.') continue;\n    if (part === '..') return undefined;\n    parts.push(part);\n  }\n  if (drive !== null) return parts.length === 0 ? `${drive[1]!.toUpperCase()}:/` : `${drive[1]!.toUpperCase()}:/${parts.join('/')}`;\n  if (normalized.startsWith('/')) return parts.length === 0 ? '/' : `/${parts.join('/')}`;\n  if (relativeOnly && parts.length === 0) return undefined;\n  return parts.length === 0 ? '.' : parts.join('/');\n}\n\nexport function admittedLabelV2(raw: string, baseDirectory: string): string {\n  const normalized = normalizeAdmittedPathV2(raw) ?? 'input';\n  if (!isAbsoluteAdmittedPathV2(normalized)) return normalized;\n  const base = normalizeAdmittedPathV2(baseDirectory) ?? '.';\n  if (isAbsoluteAdmittedPathV2(base)) {\n    const relative = relativeAdmitted(base, normalized);\n    if (relative !== undefined && relative !== '..'\n      && !relative.startsWith('../') && !relative.startsWith('/')\n      && !isAbsoluteAdmittedPathV2(relative)) return relative;\n  }\n  const parts = normalized.split('/');\n  return parts[parts.length - 1] || 'input';\n}\n\nexport function toFsPathV2(baseDirectory: string, normalized: string): string {\n  if (isAbsoluteAdmittedPathV2(normalized)) return normalized;\n  const base = baseDirectory.replaceAll('\\\\', '/');\n  if (base === '/' || /^[a-z]:\\/$/iu.test(base)) return `${base}${normalized}`;\n  const trimmed = base.replace(/\\/+$/u, '');\n  return trimmed === '' || trimmed === '.' ? normalized : `${trimmed}/${normalized}`;\n}\n\nexport function isWithinBaseV2(target: string, baseDirectory: string): boolean {\n  const targetPath = normalizeAdmittedPathV2(target);\n  const base = normalizeAdmittedPathV2(baseDirectory);\n  if (targetPath === undefined || base === undefined\n    || !isAbsoluteAdmittedPathV2(targetPath) || !isAbsoluteAdmittedPathV2(base)) return false;\n  const relative = relativeAdmitted(base, targetPath);\n  return relative !== undefined && relative !== '..'\n    && !relative.startsWith('../') && !relative.startsWith('/')\n    && !isAbsoluteAdmittedPathV2(relative);\n}\n\nfunction relativeAdmitted(base: string, target: string): string | undefined {\n  try {\n    if (/^[a-z]:\\//iu.test(base) || /^[a-z]:\\//iu.test(target)) {\n      return win32.relative(base.replaceAll('/', '\\\\'), target.replaceAll('/', '\\\\')).replaceAll('\\\\', '/');\n    }\n    return posix.relative(base, target);\n  } catch { return undefined; }\n}\n", "import { ADMITTED_PROFILE_V2, isAdmittedProfileSpecifierV2, isApprovedDomainV2, type ScanConfigV2, type ScanSeverityV2 } from './contracts.js';\nimport { isAdmittedLocalPath, isAdmittedRelativePath, normalizeAdmittedPathV2 } from './path-admission.js';\nimport type { V2CommandName } from './help.js';\n\nexport type CliFormatV2 = 'json' | 'ndjson' | 'sarif' | 'table';\nexport type CliProfileV2 = typeof ADMITTED_PROFILE_V2.id;\nexport type CliTargetEnumV2 = 'UNKNOWN' | 'COMMUNITY' | 'ENTERPRISE' | 'CLOUD' | 'SELF_HOSTED' | 'OWNER' | 'ADMIN' | 'MEMBER' | 'LEGACY' | 'NATIVE';\nexport type CliParseErrorCodeV2 = 'NO_COMMAND' | 'UNKNOWN_COMMAND' | 'UNKNOWN_OPTION' | 'MISSING_VALUE' | 'INVALID_VALUE' | 'DUPLICATE_OPTION' | 'UNEXPECTED_ARGUMENT' | 'REMOTE_PATH' | 'RULE_PACK_INVALID' | 'SEMANTIC_CATALOGUE_INVALID' | 'PROFILE_NOT_ADMITTED';\nexport type CliParseErrorV2 = Readonly<{ code: CliParseErrorCodeV2; message: string; argument?: string }>;\n\ntype ScanCommandV2 = Readonly<{\n  kind: 'scan'; schema: 'v2'; inputs: readonly string[]; format: CliFormatV2; profile: CliProfileV2; failOn: ScanSeverityV2;\n  requireComplete: boolean; concurrency: number; timeoutMs?: number; output?: string; configPath?: string;\n  rules: 'builtin'; catalogue: 'builtin'; limits: string; target?: string; n8nVersion?: string;\n  edition: 'COMMUNITY' | 'ENTERPRISE' | 'CLOUD' | 'UNKNOWN'; deployment: 'SELF_HOSTED' | 'CLOUD' | 'UNKNOWN';\n  role: 'OWNER' | 'ADMIN' | 'MEMBER' | 'UNKNOWN'; taskRunner: 'LEGACY' | 'NATIVE' | 'UNKNOWN';\n  communityPackages: readonly string[]; configuration: readonly string[]; approvedDomains: readonly string[]; include: readonly string[]; exclude: readonly string[];\n  allowUnsignedDevelopmentRules: boolean; noColor: boolean; cliOverrides: Readonly<Partial<ScanConfigV2>>;\n}>;\nexport type CliHelpCommandV2 = Readonly<{ kind: 'help'; schema: 'v2'; command?: V2CommandName }>;\nexport type CliCommandV2 = ScanCommandV2\n  | Readonly<{ kind: 'rules'; schema: 'v2'; format: 'json' | 'table' }>\n  | Readonly<{ kind: 'explain'; schema: 'v2'; format: 'json' | 'table'; ruleId: string }>\n  | Readonly<{ kind: 'profiles'; schema: 'v2'; format: 'json' | 'table' }>\n  | Readonly<{ kind: 'validate-config'; schema: 'v2'; format: 'json' | 'table'; path: string }>\n  | Readonly<{ kind: 'version'; schema: 'v2'; format: 'json' | 'table' }>;\ntype ParsedCommandV2 = CliCommandV2 | CliHelpCommandV2;\nexport type CliParseResultV2 = Readonly<{ ok: true; command: ParsedCommandV2 } | { ok: false; error: CliParseErrorV2 }>;\nexport type CliArgumentDispatch = Readonly<{ mode: 'v1'; argv: readonly string[] } | { mode: 'v2'; result: CliParseResultV2 }>;\n\nconst severities: readonly ScanSeverityV2[] = ['CRITICAL', 'HIGH', 'MEDIUM', 'LOW', 'INFO'];\nconst commands: Record<string, true> = Object.freeze({ scan: true, rules: true, explain: true, profiles: true, 'validate-config': true, version: true, '--version': true });\nconst implicitV2Commands: Record<string, true> = Object.freeze({ rules: true, explain: true, profiles: true, 'validate-config': true, version: true });\nconst scalarOptions: Record<string, true> = Object.freeze({ '--format': true, '--profile': true, '--fail-on': true, '--max-concurrency': true, '--concurrency': true, '--timeout': true, '--output': true, '--config': true, '--rules': true, '--catalogue': true, '--limits': true, '--target': true, '--n8n-version': true, '--edition': true, '--deployment': true, '--role': true, '--task-runner': true });\nconst repeatableOptions: Record<string, true> = Object.freeze({ '--community-package': true, '--configuration': true, '--approved-domain': true, '--include': true, '--exclude': true });\nconst configFields: Record<string, keyof ScanConfigV2> = Object.freeze({ '--format': 'format', '--profile': 'profile', '--fail-on': 'failOn', '--max-concurrency': 'concurrency', '--concurrency': 'concurrency', '--output': 'output', '--config': 'configPath', '--rules': 'rules', '--catalogue': 'catalogue', '--limits': 'limits', '--target': 'target', '--approved-domain': 'approvedDomains', '--include': 'include', '--exclude': 'exclude', 'inputs': 'inputs', '--require-complete': 'requireComplete', '--allow-unsigned-development-rules': 'allowUnsignedDevelopmentRules', '--no-color': 'noColor' });\nconst overrideOrder: readonly (keyof ScanConfigV2)[] = ['format', 'profile', 'output', 'inputs', 'configPath', 'failOn', 'requireComplete', 'concurrency', 'rules', 'catalogue', 'limits', 'target', 'include', 'exclude', 'approvedDomains', 'allowUnsignedDevelopmentRules', 'noColor'];\n\nexport function parseArgumentsV2(argv: readonly string[]): CliParseResultV2 {\n  const stripped = stripSchema(argv); if (!stripped.ok) return stripped.result;\n  const args = stripped.args; const raw = args[0];\n  if (!raw) return failure('NO_COMMAND', 'A v2 command is required.');\n  if (raw === '--help') return success({ kind: 'help', schema: 'v2' });\n  if (commands[raw] !== true) return failure('UNKNOWN_COMMAND', 'Unknown v2 command.');\n  const kind = raw === '--version' ? 'version' : raw;\n  if (kind !== 'scan') return parseMetadata(kind as Exclude<CliCommandV2['kind'], 'scan' | 'help'>, args.slice(1));\n  if (args.length === 2 && args[1] === '--help') return success({ kind: 'help', schema: 'v2', command: 'scan' });\n  const value: Record<string, unknown> = {\n    kind: 'scan', schema: 'v2', inputs: [], format: 'json', profile: 'beta-default', failOn: 'INFO', requireComplete: false,\n    concurrency: 1, rules: 'builtin', catalogue: 'builtin', limits: 'builtin', edition: 'UNKNOWN', deployment: 'UNKNOWN',\n    role: 'UNKNOWN', taskRunner: 'UNKNOWN', communityPackages: [], configuration: [], include: ['**/*.json'],\n    exclude: ['.git/**', 'node_modules/**'], allowUnsignedDevelopmentRules: false, noColor: false,\n  };\n  const overrides: Record<string, unknown> = {}; const inputs: string[] = []; const repeatable: Record<string, string[]> = { '--community-package': [], '--configuration': [], '--approved-domain': [], '--include': [], '--exclude': [] }; const seen = new Set<string>();\n  for (let index = 1; index < args.length; index += 1) {\n    const token = args[index]!;\n    if (token === '--') {\n      for (const rawInput of args.slice(index + 1)) {\n        const input = rawInput === '-' ? '-' : normalizeAdmittedPathV2(rawInput);\n        if (input === undefined) return failure('REMOTE_PATH', 'Input path is not admitted.');\n        inputs.push(input);\n      }\n      break;\n    }\n    if (token === '-' || !token.startsWith('-')) {\n      const input = token === '-' ? '-' : normalizeAdmittedPathV2(token);\n      if (input === undefined) return failure('REMOTE_PATH', 'Input path is not admitted.');\n      inputs.push(input);\n      continue;\n    }\n    const [name, inline] = splitOption(token);\n    if (name === '--require-complete' || name === '--allow-unsigned-development-rules' || name === '--no-color') {\n      if (inline !== undefined || seen.has(name)) return failure('DUPLICATE_OPTION', 'Option supplied more than once.', name);\n      seen.add(name); value[name === '--require-complete' ? 'requireComplete' : name === '--no-color' ? 'noColor' : 'allowUnsignedDevelopmentRules'] = true; overrides[configFields[name]!] = true; continue;\n    }\n    if (scalarOptions[name] !== true && repeatableOptions[name] !== true) return failure('UNKNOWN_OPTION', 'Unknown option.', name);\n    const duplicateKey = name === '--max-concurrency' ? '--concurrency' : name;\n    if (seen.has(duplicateKey) && scalarOptions[name] === true) return failure('DUPLICATE_OPTION', 'Option supplied more than once.', name);\n    const read = inline === undefined ? args[index + 1] : inline;\n    if (read === undefined || read.length === 0 || (inline === undefined && read.startsWith('-') && !(name === '--output' && read === '-'))) return failure('MISSING_VALUE', 'Option requires a value.', name);\n    if (inline === undefined) index += 1;\n    if (repeatableOptions[name] === true) {\n      if (name === '--approved-domain' && !isApprovedDomainV2(read)) return failure('INVALID_VALUE', 'Approved domain is invalid.', name);\n      if (!isAdmittedRelativePath(read)) return failure('REMOTE_PATH', 'Option value is not admitted.', name);\n      repeatable[name]!.push(read);\n      if (configFields[name]) overrides[configFields[name]!] = Object.freeze([...repeatable[name]!]);\n      continue;\n    }\n    if (name === '--format' && !['json', 'ndjson', 'sarif', 'table'].includes(read)) return failure('INVALID_VALUE', 'Format is invalid.', name);\n    if (name === '--profile' && !isAdmittedProfileSpecifierV2(read)) return failure('PROFILE_NOT_ADMITTED', 'Profile is not admitted.', name);\n    if (name === '--fail-on' && !severities.includes(read as ScanSeverityV2)) return failure('INVALID_VALUE', 'Fail threshold is invalid.', name);\n    if ((name === '--max-concurrency' || name === '--concurrency' || name === '--timeout') && !positiveInteger(read, name === '--timeout' ? 2 ** 31 - 1 : 16)) return failure('INVALID_VALUE', 'Numeric option is invalid.', name);\n    if (name === '--n8n-version' && !/^\\d+\\.\\d+\\.\\d+(?:-[0-9A-Za-z.-]+)?(?:\\+[0-9A-Za-z.-]+)?$/.test(read)) return failure('INVALID_VALUE', 'n8n version is invalid.', name);\n    if (name === '--edition' && !['COMMUNITY', 'ENTERPRISE', 'CLOUD', 'UNKNOWN'].includes(read)) return failure('INVALID_VALUE', 'Edition is invalid.', name);\n    if (name === '--deployment' && !['SELF_HOSTED', 'CLOUD', 'UNKNOWN'].includes(read)) return failure('INVALID_VALUE', 'Deployment is invalid.', name);\n    if (name === '--role' && !['OWNER', 'ADMIN', 'MEMBER', 'UNKNOWN'].includes(read)) return failure('INVALID_VALUE', 'Role is invalid.', name);\n    if (name === '--task-runner' && !['LEGACY', 'NATIVE', 'UNKNOWN'].includes(read)) return failure('INVALID_VALUE', 'Task runner is invalid.', name);\n    if (name === '--rules' || name === '--catalogue') { if (read !== 'builtin') return failure(name === '--rules' ? 'RULE_PACK_INVALID' : 'SEMANTIC_CATALOGUE_INVALID', 'Only built-in authority is available.', name); }\n    else if (['--limits', '--target', '--config'].includes(name) && (read === '-' || !isAdmittedRelativePath(read))) return failure('REMOTE_PATH', 'Option value is not admitted.', name);\n    else if (name === '--output' && read !== '-' && !isAdmittedRelativePath(read)) return failure('REMOTE_PATH', 'Option value is not admitted.', name);\n    else if (['--n8n-version', '--edition', '--deployment', '--role', '--task-runner'].includes(name) && !safeText(read)) return failure('INVALID_VALUE', 'Option value is not admitted.', name);\n    seen.add(duplicateKey); assign(value, name, read); if (name === '--profile') value.profile = ADMITTED_PROFILE_V2.id; if (configFields[name]) overrides[configFields[name]!] = ['--max-concurrency', '--concurrency'].includes(name) ? Number(read) : read;\n  }\n  // No external rule pack is admittable: `--rules`/`--catalogue` accept only the built-in authority,\n  // so the unsigned development escape hatch has nothing it could admit. It is refused as a usage\n  // error instead of being left to imply that a local pack would be loaded.\n  if (value.allowUnsignedDevelopmentRules === true) return failure('RULE_PACK_INVALID', 'External rule packs are not admitted in this release.', '--allow-unsigned-development-rules');\n  if (inputs.length === 0) return failure('UNEXPECTED_ARGUMENT', 'At least one workflow input is required.');\n  if (inputs.some((input) => input !== '-' && !isAdmittedLocalPath(input))) return failure('REMOTE_PATH', 'Input path is not admitted.');\n  if (inputs.includes('-') && inputs.length > 1) return failure('UNEXPECTED_ARGUMENT', 'Standard input cannot be combined with file inputs.');\n  overrides.inputs = Object.freeze([...inputs]);\n  const cliOverrides: Partial<ScanConfigV2> = {}; const sparse = cliOverrides as Record<string, unknown>; for (const field of overrideOrder) if (Object.prototype.hasOwnProperty.call(overrides, field)) sparse[field] = overrides[field];\n  const command: ScanCommandV2 = {\n    kind: 'scan', schema: 'v2', inputs: Object.freeze([...inputs]), format: value.format as CliFormatV2, profile: ADMITTED_PROFILE_V2.id, failOn: value.failOn as ScanSeverityV2, requireComplete: value.requireComplete as boolean, concurrency: value.concurrency as number,\n    ...(typeof value.timeoutMs === 'number' ? { timeoutMs: value.timeoutMs } : {}), ...(typeof value.output === 'string' ? { output: value.output } : {}), ...(typeof value.configPath === 'string' ? { configPath: value.configPath } : {}), rules: value.rules as 'builtin', catalogue: value.catalogue as 'builtin', limits: value.limits as string,\n    ...(typeof value.target === 'string' ? { target: value.target } : {}), ...(typeof value.n8nVersion === 'string' ? { n8nVersion: value.n8nVersion } : {}), edition: value.edition as ScanCommandV2['edition'], deployment: value.deployment as ScanCommandV2['deployment'], role: value.role as ScanCommandV2['role'], taskRunner: value.taskRunner as ScanCommandV2['taskRunner'], communityPackages: arrayFor(repeatable['--community-package']), configuration: arrayFor(repeatable['--configuration']), approvedDomains: arrayFor(repeatable['--approved-domain']), include: repeatable['--include']!.length > 0 ? arrayFor(repeatable['--include']) : Object.freeze(['**/*.json']), exclude: repeatable['--exclude']!.length > 0 ? arrayFor(repeatable['--exclude']) : Object.freeze(['.git/**', 'node_modules/**']), allowUnsignedDevelopmentRules: value.allowUnsignedDevelopmentRules as boolean, noColor: value.noColor as boolean, cliOverrides,\n  };\n  return success(command);\n}\n\nfunction arrayFor(values: readonly string[] | undefined): readonly string[] { return Object.freeze([...(values ?? [])]); }\nexport function parseCliArguments(argv: readonly string[]): CliArgumentDispatch { const hasSchema = hasSchemaMarker(argv); const implicit = argv[0] !== undefined && implicitV2Commands[argv[0]!] === true; return hasSchema || implicit ? freeze({ mode: 'v2', result: parseArgumentsV2(argv) }) : freeze({ mode: 'v1', argv: Object.freeze([...argv]) }); }\nfunction parseMetadata(kind: Exclude<CliCommandV2['kind'], 'scan' | 'help'>, args: readonly string[]): CliParseResultV2 {\n  if (args.length === 1 && args[0] === '--help') return success({ kind: 'help', schema: 'v2', command: kind });\n  let format: 'json' | 'table' = 'json';\n  const rest: string[] = [];\n  let seen = false;\n  for (let index = 0; index < args.length; index += 1) {\n    const token = args[index]!;\n    if (token.startsWith('-')) {\n      const [name, inline] = splitOption(token);\n      if (name !== '--format' || seen) return failure(seen ? 'DUPLICATE_OPTION' : 'UNKNOWN_OPTION', seen ? 'Option supplied more than once.' : 'Unknown option.', name);\n      const value = inline ?? args[++index];\n      if (!value) return failure('MISSING_VALUE', 'Option requires a value.', name);\n      if (value !== 'json' && value !== 'table') return failure('INVALID_VALUE', 'Format is invalid.', name);\n      format = value;\n      seen = true;\n    } else rest.push(token);\n  }\n  if (kind === 'rules' || kind === 'profiles' || kind === 'version') {\n    if (rest.length > 0) return failure('UNEXPECTED_ARGUMENT', 'Command does not accept positional arguments.');\n    return success({ kind, schema: 'v2', format });\n  }\n  if (kind === 'explain') return rest.length === 1 && safeText(rest[0]!) ? success({ kind, schema: 'v2', format, ruleId: rest[0]! }) : failure('UNEXPECTED_ARGUMENT', 'explain requires one rule ID.');\n  if (rest.length !== 1 || !isAdmittedRelativePath(rest[0]!)) return failure('UNEXPECTED_ARGUMENT', 'validate-config requires one local file.');\n  return success({ kind, schema: 'v2', format, path: rest[0]! });\n}\nfunction assign(value: Record<string, unknown>, name: string, read: string): void { const fields: Record<string, string> = { '--format': 'format', '--profile': 'profile', '--fail-on': 'failOn', '--max-concurrency': 'concurrency', '--concurrency': 'concurrency', '--timeout': 'timeoutMs', '--output': 'output', '--config': 'configPath', '--rules': 'rules', '--catalogue': 'catalogue', '--limits': 'limits', '--target': 'target', '--n8n-version': 'n8nVersion', '--edition': 'edition', '--deployment': 'deployment', '--role': 'role', '--task-runner': 'taskRunner' }; value[fields[name]!] = ['--max-concurrency', '--concurrency', '--timeout'].includes(name) ? Number(read) : read; }\nfunction splitOption(token: string): [string, string | undefined] { const at = token.indexOf('='); return at < 0 ? [token, undefined] : [token.slice(0, at), token.slice(at + 1)]; }\nfunction positiveInteger(value: string, maximum: number): boolean { if (!/^\\d+$/.test(value)) return false; const number = Number(value); return Number.isSafeInteger(number) && number > 0 && number <= maximum; }\nfunction safeText(value: string): boolean { return value.length > 0 && value.length <= 4096 && !/[\\u0000-\\u001f\\u007f]/.test(value) && !/^(?:[a-z][a-z\\d+.-]*:|\\/|[a-z]:|\\\\\\\\)/i.test(value); }\nfunction hasSchemaMarker(argv: readonly string[]): boolean { for (const token of argv) { if (token === '--') break; if (token === '--schema' || token.startsWith('--schema=')) return true; } return false; }\nfunction stripSchema(argv: readonly string[]): { ok: true; args: readonly string[] } | { ok: false; result: CliParseResultV2 } { const args: string[] = []; let seen = false; for (let index = 0; index < argv.length; index += 1) { const token = argv[index]!; if (token === '--') { args.push(...argv.slice(index)); break; } if (token === '--schema') { if (seen || argv[index + 1] !== 'v2') return { ok: false, result: failure(seen ? 'DUPLICATE_OPTION' : 'INVALID_VALUE', seen ? 'Option supplied more than once.' : 'Schema must be v2.', '--schema') }; seen = true; index += 1; continue; } if (token.startsWith('--schema=')) { if (seen || token.slice(9) !== 'v2') return { ok: false, result: failure(seen ? 'DUPLICATE_OPTION' : 'INVALID_VALUE', seen ? 'Option supplied more than once.' : 'Schema must be v2.', '--schema') }; seen = true; continue; } args.push(token); } return { ok: true, args }; }\nfunction success(command: ParsedCommandV2): CliParseResultV2 { return freeze({ ok: true as const, command }); }\nfunction failure(code: CliParseErrorCodeV2, message: string, argument?: string): CliParseResultV2 { const safe = argument !== undefined && /^--[A-Za-z0-9][A-Za-z0-9-]{0,63}$/.test(argument) ? argument : undefined; return freeze({ ok: false as const, error: { code, message, ...(safe === undefined ? {} : { argument: safe }) } }); }\nfunction freeze<T>(value: T, seen = new WeakSet<object>()): T { if (value && typeof value === 'object') { if (seen.has(value as object)) return value; seen.add(value as object); for (const name of Object.getOwnPropertyNames(value as object)) freeze((value as Record<string, unknown>)[name], seen); Object.freeze(value); } return value; }\n"],
-  "mappings": ";AAAA,SAAS,kBAAkB;;;ACIpB,SAAS,iBAAiB,OAAwB;AACvD,SAAO,gBAAgB,OAAO,oBAAI,IAAY,CAAC;AACjD;AAOA,SAAS,gBAAgB,OAAgB,MAA2B;AAClE,MAAI,UAAU,KAAM,QAAO;AAC3B,MAAI,OAAO,UAAU,SAAU,QAAO,KAAK,UAAU,KAAK;AAC1D,MAAI,OAAO,UAAU,UAAW,QAAO,QAAQ,SAAS;AACxD,MAAI,OAAO,UAAU,UAAU;AAC7B,QAAI,CAAC,OAAO,SAAS,KAAK,EAAG,OAAM,IAAI,UAAU,mDAAmD;AACpG,WAAO,KAAK,UAAU,OAAO,GAAG,OAAO,EAAE,IAAI,IAAI,KAAK;AAAA,EACxD;AACA,MAAI,OAAO,UAAU,YAAY,UAAU,QAAW;AACpD,UAAM,IAAI,UAAU,iBAAiB,OAAO,KAAK,oBAAoB;AAAA,EACvE;AACA,MAAI,KAAK,IAAI,KAAK,EAAG,OAAM,IAAI,UAAU,8CAA8C;AACvF,OAAK,IAAI,KAAK;AAEd,MAAI;AACF,QAAI,MAAM,QAAQ,KAAK,EAAG,QAAO,YAAY,OAAO,IAAI;AACxD,WAAO,aAAa,OAAkC,IAAI;AAAA,EAC5D,UAAE;AACA,SAAK,OAAO,KAAK;AAAA,EACnB;AACF;AAEA,SAAS,YAAY,OAA2B,MAA2B;AACzE,QAAM,SAAS,MAAM,KAAK,EAAE,QAAQ,MAAM,OAAO,GAAG,CAAC,GAAG,UAAU;AAChE,QAAI,CAAC,OAAO,UAAU,eAAe,KAAK,OAAO,KAAK,GAAG;AACvD,YAAM,IAAI,UAAU,8CAA8C;AAAA,IACpE;AACA,WAAO,gBAAgB,MAAM,KAAK,GAAG,IAAI;AAAA,EAC3C,CAAC;AACD,SAAO,IAAI,OAAO,KAAK,GAAG,CAAC;AAC7B;AAEA,SAAS,aAAa,OAAgC,MAA2B;AAC/E,QAAM,YAAY,OAAO,eAAe,KAAK;AAC7C,MAAI,cAAc,OAAO,aAAa,cAAc,MAAM;AACxD,UAAM,IAAI,UAAU,oDAAoD;AAAA,EAC1E;AACA,MAAI,OAAO,sBAAsB,KAAK,EAAE,KAAK,CAAC,WAC5C,OAAO,UAAU,qBAAqB,KAAK,OAAO,MAAM,CAAC,GAAG;AAC5D,UAAM,IAAI,UAAU,mDAAmD;AAAA,EACzE;AAEA,QAAM,QAAQ,OAAO,KAAK,KAAK,EAC5B,KAAK,uBAAuB,EAC5B,IAAI,CAAC,QAAQ,GAAG,KAAK,UAAU,GAAG,CAAC,IAAI,gBAAgB,MAAM,GAAG,GAAG,IAAI,CAAC,EAAE;AAC7E,SAAO,IAAI,MAAM,KAAK,GAAG,CAAC;AAC5B;AAEA,SAAS,wBAAwB,MAAc,OAAuB;AACpE,MAAI,SAAS,MAAO,QAAO;AAC3B,SAAO,OAAO,QAAQ,KAAK;AAC7B;;;AD7DO,IAAM,wBAAwB;AAwB9B,IAAM,sBAAsB,OAAO,OAAO,EAAE,IAAI,gBAAgB,SAAS,SAAS,QAAQ,mEAAmE,CAAC;AAQ9J,IAAM,iCAAoD,OAAO,OAAO;AAAA,EAC7E,oBAAoB;AAAA,EACpB,GAAG,oBAAoB,EAAE,IAAI,oBAAoB,OAAO;AAC1D,CAAC;AAEM,SAAS,6BAA6B,OAAiC;AAC5E,SAAO,OAAO,UAAU,YAAY,+BAA+B,SAAS,KAAK;AACnF;AACO,IAAM,yBAAyB,OAAO,OAAO;AAAA,EAClD,SAAS;AAAA,EACT,OAAO,OAAO,OAAO,EAAE,IAAI,yBAAyB,SAAS,SAAS,QAAQ,oEAAoE,iBAAiB,WAAoB,CAAC;AAAA,EACxL,WAAW,OAAO,OAAO,EAAE,IAAI,yBAAyB,SAAS,SAAS,QAAQ,mEAAmE,CAAC;AAAA,EACtJ,QAAQ,OAAO,OAAO,EAAE,eAAe,qBAA8B,QAAQ,mEAAmE,CAAC;AACnJ,CAAC;AACM,IAAM,6BAA6B,oBAAoB;AACvD,IAAM,+BAA+B,uBAAuB;AAC5D,IAAM,iCAAiC,uBAAuB;AAC9D,IAAM,8BAA8B,uBAAuB;AAC3D,IAAM,sBAAsB,6BAA6B;AACzD,IAAM,+BAA+B,+BAA+B;AAQpE,IAAM,iBAAiB;AAEvB,IAAM,cAAiC,OAAO,OAAO;AAAA,EAC1D,MAAM;AAAA,EACN,SAAS;AAAA,EACT,aAAa,WAAW,QAAQ,EAAE,OAAO,iBAAiB;AAAA,IACxD,QAAQ;AAAA,IAAsB,SAAS;AAAA,IAAS,SAAS;AAAA,IACzD,SAAS,6BAA6B;AAAA,IAAQ,WAAW,+BAA+B;AAAA,EAC1F,CAAC,CAAC,EAAE,OAAO,KAAK;AAClB,CAAC;AAEM,IAAM,yBAAuC,OAAO,OAAO;AAAA,EAChE,eAAe;AAAA,EACf,QAAQ;AAAA,EAAQ,SAAS,oBAAoB;AAAA,EAAI,QAAQ;AAAA,EAAQ,iBAAiB;AAAA,EAAO,aAAa;AAAA,EACtG,OAAO;AAAA,EAAW,WAAW;AAAA,EAAW,QAAQ;AAAA,EAChD,SAAS,OAAO,OAAO,CAAC,WAAW,CAAC;AAAA,EAAG,SAAS,OAAO,OAAO,CAAC,WAAW,iBAAiB,CAAC;AAAA,EAC5F,iBAAiB,OAAO,OAAO,CAAC,CAAC;AAAA,EACjC,+BAA+B;AAAA,EAAO,SAAS;AACjD,CAAC;AAEM,IAAM,wBAAwB,OAAO,OAAO;AAAA,EACjD;AAAA,EAAiB;AAAA,EAAU;AAAA,EAAW;AAAA,EAAU;AAAA,EAAU;AAAA,EAAc;AAAA,EAAU;AAAA,EAAmB;AAAA,EACrG;AAAA,EAAS;AAAA,EAAa;AAAA,EAAU;AAAA,EAAU;AAAA,EAAW;AAAA,EAAW;AAAA,EAChE;AAAA,EAAiC;AACnC,CAAU;AAKH,IAAM,YAAY;AAClB,SAAS,mBAAmB,OAAiC;AAClE,SAAO,OAAO,UAAU,YAAY,UAAU,KAAK,KAAK;AAC1D;;;AE5FA,IAAM,UAAU;AAChB,IAAM,SAAS;AAEf,IAAM,WAAW;AASV,SAAS,oBAAoB,OAAiC;AACnE,SAAO,WAAW,OAAO,KAAK,MAAM;AACtC;AAEO,SAAS,uBAAuB,OAAiC;AACtE,SAAO,WAAW,OAAO,IAAI,MAAM;AACrC;AAEO,SAAS,wBAAwB,OAAgB,eAAe,OAA2B;AAChG,SAAO,WAAW,OAAO,YAAY;AACvC;AAEA,SAAS,WAAW,OAAgB,cAA2C;AAC7E,MAAI,OAAO,UAAU,YAAY,MAAM,WAAW,KAAK,MAAM,SAAS,YAAY,QAAQ,KAAK,KAAK,EAAG,QAAO;AAC9G,QAAM,aAAa,MAAM,WAAW,MAAM,GAAG;AAC7C,MAAI,WAAW,WAAW,IAAI,EAAG,QAAO;AACxC,QAAM,QAAQ,sBAAsB,KAAK,UAAU;AACnD,MAAI,OAAO,KAAK,UAAU,KAAK,UAAU,KAAM,QAAO;AACtD,QAAM,WAAW,UAAU,QAAQ,WAAW,WAAW,GAAG;AAC5D,MAAI,gBAAgB,SAAU,QAAO;AACrC,QAAM,OAAO,UAAU,OAAO,aAAa,WAAW,MAAM,CAAC;AAC7D,QAAM,QAAkB,CAAC;AACzB,aAAW,QAAQ,KAAK,MAAM,GAAG,GAAG;AAClC,QAAI,SAAS,MAAM,SAAS,IAAK;AACjC,QAAI,SAAS,KAAM,QAAO;AAC1B,UAAM,KAAK,IAAI;AAAA,EACjB;AACA,MAAI,UAAU,KAAM,QAAO,MAAM,WAAW,IAAI,GAAG,MAAM,CAAC,EAAG,YAAY,CAAC,OAAO,GAAG,MAAM,CAAC,EAAG,YAAY,CAAC,KAAK,MAAM,KAAK,GAAG,CAAC;AAC/H,MAAI,WAAW,WAAW,GAAG,EAAG,QAAO,MAAM,WAAW,IAAI,MAAM,IAAI,MAAM,KAAK,GAAG,CAAC;AACrF,MAAI,gBAAgB,MAAM,WAAW,EAAG,QAAO;AAC/C,SAAO,MAAM,WAAW,IAAI,MAAM,MAAM,KAAK,GAAG;AAClD;;;ACfA,IAAM,aAAwC,CAAC,YAAY,QAAQ,UAAU,OAAO,MAAM;AAC1F,IAAM,WAAiC,OAAO,OAAO,EAAE,MAAM,MAAM,OAAO,MAAM,SAAS,MAAM,UAAU,MAAM,mBAAmB,MAAM,SAAS,MAAM,aAAa,KAAK,CAAC;AAC1K,IAAM,qBAA2C,OAAO,OAAO,EAAE,OAAO,MAAM,SAAS,MAAM,UAAU,MAAM,mBAAmB,MAAM,SAAS,KAAK,CAAC;AACrJ,IAAM,gBAAsC,OAAO,OAAO,EAAE,YAAY,MAAM,aAAa,MAAM,aAAa,MAAM,qBAAqB,MAAM,iBAAiB,MAAM,aAAa,MAAM,YAAY,MAAM,YAAY,MAAM,WAAW,MAAM,eAAe,MAAM,YAAY,MAAM,YAAY,MAAM,iBAAiB,MAAM,aAAa,MAAM,gBAAgB,MAAM,UAAU,MAAM,iBAAiB,KAAK,CAAC;AAC9Y,IAAM,oBAA0C,OAAO,OAAO,EAAE,uBAAuB,MAAM,mBAAmB,MAAM,qBAAqB,MAAM,aAAa,MAAM,aAAa,KAAK,CAAC;AACvL,IAAM,eAAmD,OAAO,OAAO,EAAE,YAAY,UAAU,aAAa,WAAW,aAAa,UAAU,qBAAqB,eAAe,iBAAiB,eAAe,YAAY,UAAU,YAAY,cAAc,WAAW,SAAS,eAAe,aAAa,YAAY,UAAU,YAAY,UAAU,qBAAqB,mBAAmB,aAAa,WAAW,aAAa,WAAW,UAAU,UAAU,sBAAsB,mBAAmB,sCAAsC,iCAAiC,cAAc,UAAU,CAAC;AACnlB,IAAM,gBAAiD,CAAC,UAAU,WAAW,UAAU,UAAU,cAAc,UAAU,mBAAmB,eAAe,SAAS,aAAa,UAAU,UAAU,WAAW,WAAW,mBAAmB,iCAAiC,SAAS;AAEjR,SAAS,iBAAiB,MAA2C;AAC1E,QAAM,WAAW,YAAY,IAAI;AAAG,MAAI,CAAC,SAAS,GAAI,QAAO,SAAS;AACtE,QAAM,OAAO,SAAS;AAAM,QAAM,MAAM,KAAK,CAAC;AAC9C,MAAI,CAAC,IAAK,QAAO,QAAQ,cAAc,2BAA2B;AAClE,MAAI,QAAQ,SAAU,QAAO,QAAQ,EAAE,MAAM,QAAQ,QAAQ,KAAK,CAAC;AACnE,MAAI,SAAS,GAAG,MAAM,KAAM,QAAO,QAAQ,mBAAmB,qBAAqB;AACnF,QAAM,OAAO,QAAQ,cAAc,YAAY;AAC/C,MAAI,SAAS,OAAQ,QAAO,cAAc,MAAwD,KAAK,MAAM,CAAC,CAAC;AAC/G,MAAI,KAAK,WAAW,KAAK,KAAK,CAAC,MAAM,SAAU,QAAO,QAAQ,EAAE,MAAM,QAAQ,QAAQ,MAAM,SAAS,OAAO,CAAC;AAC7G,QAAM,QAAiC;AAAA,IACrC,MAAM;AAAA,IAAQ,QAAQ;AAAA,IAAM,QAAQ,CAAC;AAAA,IAAG,QAAQ;AAAA,IAAQ,SAAS;AAAA,IAAgB,QAAQ;AAAA,IAAQ,iBAAiB;AAAA,IAClH,aAAa;AAAA,IAAG,OAAO;AAAA,IAAW,WAAW;AAAA,IAAW,QAAQ;AAAA,IAAW,SAAS;AAAA,IAAW,YAAY;AAAA,IAC3G,MAAM;AAAA,IAAW,YAAY;AAAA,IAAW,mBAAmB,CAAC;AAAA,IAAG,eAAe,CAAC;AAAA,IAAG,SAAS,CAAC,WAAW;AAAA,IACvG,SAAS,CAAC,WAAW,iBAAiB;AAAA,IAAG,+BAA+B;AAAA,IAAO,SAAS;AAAA,EAC1F;AACA,QAAM,YAAqC,CAAC;AAAG,QAAM,SAAmB,CAAC;AAAG,QAAM,aAAuC,EAAE,uBAAuB,CAAC,GAAG,mBAAmB,CAAC,GAAG,qBAAqB,CAAC,GAAG,aAAa,CAAC,GAAG,aAAa,CAAC,EAAE;AAAG,QAAM,OAAO,oBAAI,IAAY;AACvQ,WAAS,QAAQ,GAAG,QAAQ,KAAK,QAAQ,SAAS,GAAG;AACnD,UAAM,QAAQ,KAAK,KAAK;AACxB,QAAI,UAAU,MAAM;AAClB,iBAAW,YAAY,KAAK,MAAM,QAAQ,CAAC,GAAG;AAC5C,cAAM,QAAQ,aAAa,MAAM,MAAM,wBAAwB,QAAQ;AACvE,YAAI,UAAU,OAAW,QAAO,QAAQ,eAAe,6BAA6B;AACpF,eAAO,KAAK,KAAK;AAAA,MACnB;AACA;AAAA,IACF;AACA,QAAI,UAAU,OAAO,CAAC,MAAM,WAAW,GAAG,GAAG;AAC3C,YAAM,QAAQ,UAAU,MAAM,MAAM,wBAAwB,KAAK;AACjE,UAAI,UAAU,OAAW,QAAO,QAAQ,eAAe,6BAA6B;AACpF,aAAO,KAAK,KAAK;AACjB;AAAA,IACF;AACA,UAAM,CAAC,MAAM,MAAM,IAAI,YAAY,KAAK;AACxC,QAAI,SAAS,wBAAwB,SAAS,wCAAwC,SAAS,cAAc;AAC3G,UAAI,WAAW,UAAa,KAAK,IAAI,IAAI,EAAG,QAAO,QAAQ,oBAAoB,mCAAmC,IAAI;AACtH,WAAK,IAAI,IAAI;AAAG,YAAM,SAAS,uBAAuB,oBAAoB,SAAS,eAAe,YAAY,+BAA+B,IAAI;AAAM,gBAAU,aAAa,IAAI,CAAE,IAAI;AAAM;AAAA,IAChM;AACA,QAAI,cAAc,IAAI,MAAM,QAAQ,kBAAkB,IAAI,MAAM,KAAM,QAAO,QAAQ,kBAAkB,mBAAmB,IAAI;AAC9H,UAAM,eAAe,SAAS,sBAAsB,kBAAkB;AACtE,QAAI,KAAK,IAAI,YAAY,KAAK,cAAc,IAAI,MAAM,KAAM,QAAO,QAAQ,oBAAoB,mCAAmC,IAAI;AACtI,UAAM,OAAO,WAAW,SAAY,KAAK,QAAQ,CAAC,IAAI;AACtD,QAAI,SAAS,UAAa,KAAK,WAAW,KAAM,WAAW,UAAa,KAAK,WAAW,GAAG,KAAK,EAAE,SAAS,cAAc,SAAS,KAAO,QAAO,QAAQ,iBAAiB,4BAA4B,IAAI;AACzM,QAAI,WAAW,OAAW,UAAS;AACnC,QAAI,kBAAkB,IAAI,MAAM,MAAM;AACpC,UAAI,SAAS,uBAAuB,CAAC,mBAAmB,IAAI,EAAG,QAAO,QAAQ,iBAAiB,+BAA+B,IAAI;AAClI,UAAI,CAAC,uBAAuB,IAAI,EAAG,QAAO,QAAQ,eAAe,iCAAiC,IAAI;AACtG,iBAAW,IAAI,EAAG,KAAK,IAAI;AAC3B,UAAI,aAAa,IAAI,EAAG,WAAU,aAAa,IAAI,CAAE,IAAI,OAAO,OAAO,CAAC,GAAG,WAAW,IAAI,CAAE,CAAC;AAC7F;AAAA,IACF;AACA,QAAI,SAAS,cAAc,CAAC,CAAC,QAAQ,UAAU,SAAS,OAAO,EAAE,SAAS,IAAI,EAAG,QAAO,QAAQ,iBAAiB,sBAAsB,IAAI;AAC3I,QAAI,SAAS,eAAe,CAAC,6BAA6B,IAAI,EAAG,QAAO,QAAQ,wBAAwB,4BAA4B,IAAI;AACxI,QAAI,SAAS,eAAe,CAAC,WAAW,SAAS,IAAsB,EAAG,QAAO,QAAQ,iBAAiB,8BAA8B,IAAI;AAC5I,SAAK,SAAS,uBAAuB,SAAS,mBAAmB,SAAS,gBAAgB,CAAC,gBAAgB,MAAM,SAAS,cAAc,KAAK,KAAK,IAAI,EAAE,EAAG,QAAO,QAAQ,iBAAiB,8BAA8B,IAAI;AAC7N,QAAI,SAAS,mBAAmB,CAAC,2DAA2D,KAAK,IAAI,EAAG,QAAO,QAAQ,iBAAiB,2BAA2B,IAAI;AACvK,QAAI,SAAS,eAAe,CAAC,CAAC,aAAa,cAAc,SAAS,SAAS,EAAE,SAAS,IAAI,EAAG,QAAO,QAAQ,iBAAiB,uBAAuB,IAAI;AACxJ,QAAI,SAAS,kBAAkB,CAAC,CAAC,eAAe,SAAS,SAAS,EAAE,SAAS,IAAI,EAAG,QAAO,QAAQ,iBAAiB,0BAA0B,IAAI;AAClJ,QAAI,SAAS,YAAY,CAAC,CAAC,SAAS,SAAS,UAAU,SAAS,EAAE,SAAS,IAAI,EAAG,QAAO,QAAQ,iBAAiB,oBAAoB,IAAI;AAC1I,QAAI,SAAS,mBAAmB,CAAC,CAAC,UAAU,UAAU,SAAS,EAAE,SAAS,IAAI,EAAG,QAAO,QAAQ,iBAAiB,2BAA2B,IAAI;AAChJ,QAAI,SAAS,aAAa,SAAS,eAAe;AAAE,UAAI,SAAS,UAAW,QAAO,QAAQ,SAAS,YAAY,sBAAsB,8BAA8B,yCAAyC,IAAI;AAAA,IAAG,WAC3M,CAAC,YAAY,YAAY,UAAU,EAAE,SAAS,IAAI,MAAM,SAAS,OAAO,CAAC,uBAAuB,IAAI,GAAI,QAAO,QAAQ,eAAe,iCAAiC,IAAI;AAAA,aAC3K,SAAS,cAAc,SAAS,OAAO,CAAC,uBAAuB,IAAI,EAAG,QAAO,QAAQ,eAAe,iCAAiC,IAAI;AAAA,aACzI,CAAC,iBAAiB,aAAa,gBAAgB,UAAU,eAAe,EAAE,SAAS,IAAI,KAAK,CAAC,SAAS,IAAI,EAAG,QAAO,QAAQ,iBAAiB,iCAAiC,IAAI;AAC3L,SAAK,IAAI,YAAY;AAAG,WAAO,OAAO,MAAM,IAAI;AAAG,QAAI,SAAS,YAAa,OAAM,UAAU,oBAAoB;AAAI,QAAI,aAAa,IAAI,EAAG,WAAU,aAAa,IAAI,CAAE,IAAI,CAAC,qBAAqB,eAAe,EAAE,SAAS,IAAI,IAAI,OAAO,IAAI,IAAI;AAAA,EACvP;AAIA,MAAI,MAAM,kCAAkC,KAAM,QAAO,QAAQ,qBAAqB,yDAAyD,oCAAoC;AACnL,MAAI,OAAO,WAAW,EAAG,QAAO,QAAQ,uBAAuB,0CAA0C;AACzG,MAAI,OAAO,KAAK,CAAC,UAAU,UAAU,OAAO,CAAC,oBAAoB,KAAK,CAAC,EAAG,QAAO,QAAQ,eAAe,6BAA6B;AACrI,MAAI,OAAO,SAAS,GAAG,KAAK,OAAO,SAAS,EAAG,QAAO,QAAQ,uBAAuB,qDAAqD;AAC1I,YAAU,SAAS,OAAO,OAAO,CAAC,GAAG,MAAM,CAAC;AAC5C,QAAM,eAAsC,CAAC;AAAG,QAAM,SAAS;AAAyC,aAAW,SAAS,cAAe,KAAI,OAAO,UAAU,eAAe,KAAK,WAAW,KAAK,EAAG,QAAO,KAAK,IAAI,UAAU,KAAK;AACtO,QAAM,UAAyB;AAAA,IAC7B,MAAM;AAAA,IAAQ,QAAQ;AAAA,IAAM,QAAQ,OAAO,OAAO,CAAC,GAAG,MAAM,CAAC;AAAA,IAAG,QAAQ,MAAM;AAAA,IAAuB,SAAS,oBAAoB;AAAA,IAAI,QAAQ,MAAM;AAAA,IAA0B,iBAAiB,MAAM;AAAA,IAA4B,aAAa,MAAM;AAAA,IACpP,GAAI,OAAO,MAAM,cAAc,WAAW,EAAE,WAAW,MAAM,UAAU,IAAI,CAAC;AAAA,IAAI,GAAI,OAAO,MAAM,WAAW,WAAW,EAAE,QAAQ,MAAM,OAAO,IAAI,CAAC;AAAA,IAAI,GAAI,OAAO,MAAM,eAAe,WAAW,EAAE,YAAY,MAAM,WAAW,IAAI,CAAC;AAAA,IAAI,OAAO,MAAM;AAAA,IAAoB,WAAW,MAAM;AAAA,IAAwB,QAAQ,MAAM;AAAA,IAClU,GAAI,OAAO,MAAM,WAAW,WAAW,EAAE,QAAQ,MAAM,OAAO,IAAI,CAAC;AAAA,IAAI,GAAI,OAAO,MAAM,eAAe,WAAW,EAAE,YAAY,MAAM,WAAW,IAAI,CAAC;AAAA,IAAI,SAAS,MAAM;AAAA,IAAqC,YAAY,MAAM;AAAA,IAA2C,MAAM,MAAM;AAAA,IAA+B,YAAY,MAAM;AAAA,IAA2C,mBAAmB,SAAS,WAAW,qBAAqB,CAAC;AAAA,IAAG,eAAe,SAAS,WAAW,iBAAiB,CAAC;AAAA,IAAG,iBAAiB,SAAS,WAAW,mBAAmB,CAAC;AAAA,IAAG,SAAS,WAAW,WAAW,EAAG,SAAS,IAAI,SAAS,WAAW,WAAW,CAAC,IAAI,OAAO,OAAO,CAAC,WAAW,CAAC;AAAA,IAAG,SAAS,WAAW,WAAW,EAAG,SAAS,IAAI,SAAS,WAAW,WAAW,CAAC,IAAI,OAAO,OAAO,CAAC,WAAW,iBAAiB,CAAC;AAAA,IAAG,+BAA+B,MAAM;AAAA,IAA0C,SAAS,MAAM;AAAA,IAAoB;AAAA,EAC94B;AACA,SAAO,QAAQ,OAAO;AACxB;AAEA,SAAS,SAAS,QAA0D;AAAE,SAAO,OAAO,OAAO,CAAC,GAAI,UAAU,CAAC,CAAE,CAAC;AAAG;AAClH,SAAS,kBAAkB,MAA8C;AAAE,QAAM,YAAY,gBAAgB,IAAI;AAAG,QAAM,WAAW,KAAK,CAAC,MAAM,UAAa,mBAAmB,KAAK,CAAC,CAAE,MAAM;AAAM,SAAO,aAAa,WAAW,OAAO,EAAE,MAAM,MAAM,QAAQ,iBAAiB,IAAI,EAAE,CAAC,IAAI,OAAO,EAAE,MAAM,MAAM,MAAM,OAAO,OAAO,CAAC,GAAG,IAAI,CAAC,EAAE,CAAC;AAAG;AAC5V,SAAS,cAAc,MAAsD,MAA2C;AACtH,MAAI,KAAK,WAAW,KAAK,KAAK,CAAC,MAAM,SAAU,QAAO,QAAQ,EAAE,MAAM,QAAQ,QAAQ,MAAM,SAAS,KAAK,CAAC;AAC3G,MAAI,SAA2B;AAC/B,QAAM,OAAiB,CAAC;AACxB,MAAI,OAAO;AACX,WAAS,QAAQ,GAAG,QAAQ,KAAK,QAAQ,SAAS,GAAG;AACnD,UAAM,QAAQ,KAAK,KAAK;AACxB,QAAI,MAAM,WAAW,GAAG,GAAG;AACzB,YAAM,CAAC,MAAM,MAAM,IAAI,YAAY,KAAK;AACxC,UAAI,SAAS,cAAc,KAAM,QAAO,QAAQ,OAAO,qBAAqB,kBAAkB,OAAO,oCAAoC,mBAAmB,IAAI;AAChK,YAAM,QAAQ,UAAU,KAAK,EAAE,KAAK;AACpC,UAAI,CAAC,MAAO,QAAO,QAAQ,iBAAiB,4BAA4B,IAAI;AAC5E,UAAI,UAAU,UAAU,UAAU,QAAS,QAAO,QAAQ,iBAAiB,sBAAsB,IAAI;AACrG,eAAS;AACT,aAAO;AAAA,IACT,MAAO,MAAK,KAAK,KAAK;AAAA,EACxB;AACA,MAAI,SAAS,WAAW,SAAS,cAAc,SAAS,WAAW;AACjE,QAAI,KAAK,SAAS,EAAG,QAAO,QAAQ,uBAAuB,+CAA+C;AAC1G,WAAO,QAAQ,EAAE,MAAM,QAAQ,MAAM,OAAO,CAAC;AAAA,EAC/C;AACA,MAAI,SAAS,UAAW,QAAO,KAAK,WAAW,KAAK,SAAS,KAAK,CAAC,CAAE,IAAI,QAAQ,EAAE,MAAM,QAAQ,MAAM,QAAQ,QAAQ,KAAK,CAAC,EAAG,CAAC,IAAI,QAAQ,uBAAuB,+BAA+B;AACnM,MAAI,KAAK,WAAW,KAAK,CAAC,uBAAuB,KAAK,CAAC,CAAE,EAAG,QAAO,QAAQ,uBAAuB,0CAA0C;AAC5I,SAAO,QAAQ,EAAE,MAAM,QAAQ,MAAM,QAAQ,MAAM,KAAK,CAAC,EAAG,CAAC;AAC/D;AACA,SAAS,OAAO,OAAgC,MAAc,MAAoB;AAAE,QAAM,SAAiC,EAAE,YAAY,UAAU,aAAa,WAAW,aAAa,UAAU,qBAAqB,eAAe,iBAAiB,eAAe,aAAa,aAAa,YAAY,UAAU,YAAY,cAAc,WAAW,SAAS,eAAe,aAAa,YAAY,UAAU,YAAY,UAAU,iBAAiB,cAAc,aAAa,WAAW,gBAAgB,cAAc,UAAU,QAAQ,iBAAiB,aAAa;AAAG,QAAM,OAAO,IAAI,CAAE,IAAI,CAAC,qBAAqB,iBAAiB,WAAW,EAAE,SAAS,IAAI,IAAI,OAAO,IAAI,IAAI;AAAM;AACrqB,SAAS,YAAY,OAA6C;AAAE,QAAM,KAAK,MAAM,QAAQ,GAAG;AAAG,SAAO,KAAK,IAAI,CAAC,OAAO,MAAS,IAAI,CAAC,MAAM,MAAM,GAAG,EAAE,GAAG,MAAM,MAAM,KAAK,CAAC,CAAC;AAAG;AACnL,SAAS,gBAAgB,OAAe,SAA0B;AAAE,MAAI,CAAC,QAAQ,KAAK,KAAK,EAAG,QAAO;AAAO,QAAM,SAAS,OAAO,KAAK;AAAG,SAAO,OAAO,cAAc,MAAM,KAAK,SAAS,KAAK,UAAU;AAAS;AAClN,SAAS,SAAS,OAAwB;AAAE,SAAO,MAAM,SAAS,KAAK,MAAM,UAAU,QAAQ,CAAC,wBAAwB,KAAK,KAAK,KAAK,CAAC,yCAAyC,KAAK,KAAK;AAAG;AAC9L,SAAS,gBAAgB,MAAkC;AAAE,aAAW,SAAS,MAAM;AAAE,QAAI,UAAU,KAAM;AAAO,QAAI,UAAU,cAAc,MAAM,WAAW,WAAW,EAAG,QAAO;AAAA,EAAM;AAAE,SAAO;AAAO;AAC5M,SAAS,YAAY,MAA0G;AAAE,QAAM,OAAiB,CAAC;AAAG,MAAI,OAAO;AAAO,WAAS,QAAQ,GAAG,QAAQ,KAAK,QAAQ,SAAS,GAAG;AAAE,UAAM,QAAQ,KAAK,KAAK;AAAI,QAAI,UAAU,MAAM;AAAE,WAAK,KAAK,GAAG,KAAK,MAAM,KAAK,CAAC;AAAG;AAAA,IAAO;AAAE,QAAI,UAAU,YAAY;AAAE,UAAI,QAAQ,KAAK,QAAQ,CAAC,MAAM,KAAM,QAAO,EAAE,IAAI,OAAO,QAAQ,QAAQ,OAAO,qBAAqB,iBAAiB,OAAO,oCAAoC,sBAAsB,UAAU,EAAE;AAAG,aAAO;AAAM,eAAS;AAAG;AAAA,IAAU;AAAE,QAAI,MAAM,WAAW,WAAW,GAAG;AAAE,UAAI,QAAQ,MAAM,MAAM,CAAC,MAAM,KAAM,QAAO,EAAE,IAAI,OAAO,QAAQ,QAAQ,OAAO,qBAAqB,iBAAiB,OAAO,oCAAoC,sBAAsB,UAAU,EAAE;AAAG,aAAO;AAAM;AAAA,IAAU;AAAE,SAAK,KAAK,KAAK;AAAA,EAAG;AAAE,SAAO,EAAE,IAAI,MAAM,KAAK;AAAG;AAC53B,SAAS,QAAQ,SAA4C;AAAE,SAAO,OAAO,EAAE,IAAI,MAAe,QAAQ,CAAC;AAAG;AAC9G,SAAS,QAAQ,MAA2B,SAAiB,UAAqC;AAAE,QAAM,OAAO,aAAa,UAAa,oCAAoC,KAAK,QAAQ,IAAI,WAAW;AAAW,SAAO,OAAO,EAAE,IAAI,OAAgB,OAAO,EAAE,MAAM,SAAS,GAAI,SAAS,SAAY,CAAC,IAAI,EAAE,UAAU,KAAK,EAAG,EAAE,CAAC;AAAG;AAC1U,SAAS,OAAU,OAAU,OAAO,oBAAI,QAAgB,GAAM;AAAE,MAAI,SAAS,OAAO,UAAU,UAAU;AAAE,QAAI,KAAK,IAAI,KAAe,EAAG,QAAO;AAAO,SAAK,IAAI,KAAe;AAAG,eAAW,QAAQ,OAAO,oBAAoB,KAAe,EAAG,QAAQ,MAAkC,IAAI,GAAG,IAAI;AAAG,WAAO,OAAO,KAAK;AAAA,EAAG;AAAE,SAAO;AAAO;",
+  "sourcesContent": ["import { createHash } from 'node:crypto';\r\nimport { canonicalizeJson } from '@hub/scanner-core/canonical-json';\r\nexport const SCAN_CONFIG_SCHEMA_V2 = 'n8n-scan-config-v2' as const;\r\nexport type ScanFormatV2 = 'json' | 'ndjson' | 'sarif' | 'table';\r\nexport type ScanSeverityV2 = 'CRITICAL' | 'HIGH' | 'MEDIUM' | 'LOW' | 'INFO';\r\nexport type ScanConfigV2 = Readonly<{\r\n  schemaVersion: typeof SCAN_CONFIG_SCHEMA_V2;\r\n  format?: ScanFormatV2;\r\n  profile?: string;\r\n  output?: string;\r\n  inputs?: readonly string[];\r\n  configPath?: string;\r\n  failOn?: ScanSeverityV2;\r\n  requireComplete?: boolean;\r\n  concurrency?: number;\r\n  rules?: string;\r\n  catalogue?: string;\r\n  limits?: string;\r\n  target?: string;\r\n  include?: readonly string[];\r\n  exclude?: readonly string[];\r\n  approvedDomains?: readonly string[];\r\n  allowUnsignedDevelopmentRules?: boolean;\r\n  noColor?: boolean;\r\n}>;\r\n\r\nexport const ADMITTED_PROFILE_V2 = Object.freeze({ id: 'beta-default', version: '2.0.0', digest: '3ca5d69db2554383e22c44afe507cc98e381ea58a7e42aaac0ee8f7497fb4f44' });\r\n\r\n/**\r\n * The profile spellings a caller may write, and the one place they are listed. Both the\r\n * config loader and the MCP tool read this, so a profile cannot be admitted on one\r\n * surface and refused on the other; the bare id and its `id@version` pin are the same\r\n * admission, and both canonicalize to `ADMITTED_PROFILE_V2.id`.\r\n */\r\nexport const ADMITTED_PROFILE_SPECIFIERS_V2: readonly string[] = Object.freeze([\r\n  ADMITTED_PROFILE_V2.id,\r\n  `${ADMITTED_PROFILE_V2.id}@${ADMITTED_PROFILE_V2.version}`,\r\n]);\r\n\r\nexport function isAdmittedProfileSpecifierV2(value: unknown): value is string {\r\n  return typeof value === 'string' && ADMITTED_PROFILE_SPECIFIERS_V2.includes(value);\r\n}\r\nexport const BUILTIN_AUTHORITIES_V2 = Object.freeze({\r\n  profile: ADMITTED_PROFILE_V2,\r\n  rules: Object.freeze({ id: 'scanner-core-builtins', version: '2.0.0', digest: '30bdc8343582b6a4efc13538d3475db87d07fa28bea4027f9e93b813213fd510', signatureStatus: 'VERIFIED' as const }),\r\n  semantics: Object.freeze({ id: 'scanner-core-builtins', version: '2.2.0', digest: '58419339dcf99ed398d2955282662e6f6d37208f62393cafb56818d4a38182d7' }),\r\n  limits: Object.freeze({ schemaVersion: 'scanner-limits-v2' as const, digest: 'fca787753ca88f71cf0d174427f4ac730a7aef1c823aaf73aa1ea72af92b4077' }),\r\n});\r\nexport const PROFILE_MANIFEST_DIGEST_V2 = ADMITTED_PROFILE_V2.digest;\r\nexport const BUILTIN_RULESET_AUTHORITY_V2 = BUILTIN_AUTHORITIES_V2.rules;\r\nexport const BUILTIN_SEMANTICS_AUTHORITY_V2 = BUILTIN_AUTHORITIES_V2.semantics;\r\nexport const BUILTIN_LIMITS_AUTHORITY_V2 = BUILTIN_AUTHORITIES_V2.limits;\r\nexport const RULE_PACK_DIGEST_V2 = BUILTIN_RULESET_AUTHORITY_V2.digest;\r\nexport const SEMANTIC_CATALOGUE_DIGEST_V2 = BUILTIN_SEMANTICS_AUTHORITY_V2.digest;\r\n/** Detached literals: parity checks must detect drift rather than importing live core pins. */\r\nexport const BUILTIN_SCOPED_SEMANTICS_AUTHORITY_V2 = Object.freeze({\r\n  id: 'reviewed-gmail-message-v1', version: '1',\r\n  digest: '2b21f771d2cf172e33e8f78e5d1deaaefc0a5e8ff45f7d9f252cb8ec321ad56a',\r\n  sourceReceiptSha256: '2e8b7a2666cfc07c7609fdc9a2bdf01be291195a8b7da0af0f69836a180f8685',\r\n  sourceReceiptCanonicalDigest: '965de9fabde482dd5a6bcc67299fce8c33232e78c9fdc70053ad588b0f62ba2a',\r\n});\r\n\r\n/**\r\n * One tool identity for every machine surface: the JSON/NDJSON scan envelopes and the\r\n * rules/explain/profiles metadata documents. The digest folds the admitted engine, profile,\r\n * ruleset, and semantics authorities, so a re-pin moves every surface together instead of\r\n * leaving a frozen literal behind on one of them.\r\n */\r\nexport const CLI_VERSION_V2 = '0.1.0' as const;\r\nexport type CliToolIdentityV2 = Readonly<{ name: 'n8n-scan'; version: string; buildDigest: string }>;\r\nexport const CLI_TOOL_V2: CliToolIdentityV2 = Object.freeze({\r\n  name: 'n8n-scan',\r\n  version: CLI_VERSION_V2,\r\n  buildDigest: createHash('sha256').update(canonicalizeJson({\r\n    engine: 'secureflow-scanner', version: '2.0.0', profile: ADMITTED_PROFILE_V2,\r\n    ruleset: BUILTIN_RULESET_AUTHORITY_V2.digest, semantics: BUILTIN_SEMANTICS_AUTHORITY_V2.digest,\r\n    scopedSemantics: BUILTIN_SCOPED_SEMANTICS_AUTHORITY_V2,\r\n  })).digest('hex'),\r\n});\r\n\r\nexport const DEFAULT_SCAN_CONFIG_V2: ScanConfigV2 = Object.freeze({\r\n  schemaVersion: SCAN_CONFIG_SCHEMA_V2,\r\n  format: 'json', profile: ADMITTED_PROFILE_V2.id, failOn: 'INFO', requireComplete: false, concurrency: 1,\r\n  rules: 'builtin', catalogue: 'builtin', limits: 'builtin',\r\n  include: Object.freeze(['**/*.json']), exclude: Object.freeze(['.git/**', 'node_modules/**']),\r\n  approvedDomains: Object.freeze([]),\r\n  allowUnsignedDevelopmentRules: false, noColor: false,\r\n});\r\n\r\nexport const SCAN_CONFIG_V2_FIELDS = Object.freeze([\r\n  'schemaVersion', 'format', 'profile', 'output', 'inputs', 'configPath', 'failOn', 'requireComplete', 'concurrency',\r\n  'rules', 'catalogue', 'limits', 'target', 'include', 'exclude', 'approvedDomains',\r\n  'allowUnsignedDevelopmentRules', 'noColor',\r\n] as const);\r\nexport const SCAN_CONFIG_V2_MAX_STRING = 4096;\r\nexport const SCAN_CONFIG_V2_MAX_PATTERNS = 1024;\r\nexport const SCAN_CONFIG_V2_MAX_CONCURRENCY = 16;\r\nexport const SCAN_CONFIG_V2_MAX_DOMAINS = 1_000;\r\nexport const DOMAIN_V2 = /^(?=.{1,253}$)(?:[a-z0-9](?:[a-z0-9-]{0,61}[a-z0-9])?\\.)*[a-z0-9](?:[a-z0-9-]{0,61}[a-z0-9])?$/i;\r\nexport function isApprovedDomainV2(value: unknown): value is string {\r\n  return typeof value === 'string' && DOMAIN_V2.test(value);\r\n}\r\n", "/**\n * Serialize JSON-compatible values with locale-independent object ordering.\n * Arrays retain their input order; they are never treated as sets.\n */\nexport function canonicalizeJson(value: unknown): string {\n  return encodeCanonical(value, new Set<object>());\n}\n\n/** Encode the canonical representation using the platform's UTF-8 encoder. */\nexport function canonicalJsonBytes(value: unknown): Uint8Array {\n  return new TextEncoder().encode(canonicalizeJson(value));\n}\n\nfunction encodeCanonical(value: unknown, seen: Set<object>): string {\n  if (value === null) return 'null';\n  if (typeof value === 'string') return JSON.stringify(value);\n  if (typeof value === 'boolean') return value ? 'true' : 'false';\n  if (typeof value === 'number') {\n    if (!Number.isFinite(value)) throw new TypeError('Cannot encode non-finite number as canonical JSON');\n    return JSON.stringify(Object.is(value, -0) ? 0 : value);\n  }\n  if (typeof value !== 'object' || value === undefined) {\n    throw new TypeError(`Cannot encode ${typeof value} as canonical JSON`);\n  }\n  if (seen.has(value)) throw new TypeError('Cannot encode cyclic value as canonical JSON');\n  seen.add(value);\n\n  try {\n    if (Array.isArray(value)) return encodeArray(value, seen);\n    return encodeObject(value as Record<string, unknown>, seen);\n  } finally {\n    seen.delete(value);\n  }\n}\n\nfunction encodeArray(value: readonly unknown[], seen: Set<object>): string {\n  const values = Array.from({ length: value.length }, (_, index) => {\n    if (!Object.prototype.hasOwnProperty.call(value, index)) {\n      throw new TypeError('Cannot encode sparse array as canonical JSON');\n    }\n    return encodeCanonical(value[index], seen);\n  });\n  return `[${values.join(',')}]`;\n}\n\nfunction encodeObject(value: Record<string, unknown>, seen: Set<object>): string {\n  const prototype = Object.getPrototypeOf(value);\n  if (prototype !== Object.prototype && prototype !== null) {\n    throw new TypeError('Cannot encode a non-plain object as canonical JSON');\n  }\n  if (Object.getOwnPropertySymbols(value).some((symbol) =>\n    Object.prototype.propertyIsEnumerable.call(value, symbol))) {\n    throw new TypeError('Cannot encode symbol properties as canonical JSON');\n  }\n\n  const pairs = Object.keys(value)\n    .sort(compareCanonicalStrings)\n    .map((key) => `${JSON.stringify(key)}:${encodeCanonical(value[key], seen)}`);\n  return `{${pairs.join(',')}}`;\n}\n\nfunction compareCanonicalStrings(left: string, right: string): number {\n  if (left === right) return 0;\n  return left < right ? -1 : 1;\n}\n", "import { posix, win32 } from 'node:path';\n\nconst CONTROL = /[\\u0000-\\u001f\\u007f]/u;\nconst SCHEME = /^[a-z][a-z\\d+.-]*:/iu;\nconst DRIVE = /^[a-z]:\\//iu;\nconst MAX_PATH = 4096;\n\n/** Normalizes backslashes before classifying, so a Windows drive path is absolute in both forms. */\nexport function isAbsoluteAdmittedPathV2(value: string): boolean {\n  const normalized = value.replaceAll('\\\\', '/');\n  if (normalized.startsWith('//')) return false; // UNC and protocol-relative are not local absolutes\n  return normalized.startsWith('/') || DRIVE.test(normalized);\n}\n\nexport function isAdmittedLocalPath(value: unknown): value is string {\n  return admitLocal(value, false) !== undefined;\n}\n\nexport function isAdmittedRelativePath(value: unknown): value is string {\n  return admitLocal(value, true) !== undefined;\n}\n\nexport function normalizeAdmittedPathV2(value: unknown, relativeOnly = false): string | undefined {\n  return admitLocal(value, relativeOnly);\n}\n\nfunction admitLocal(value: unknown, relativeOnly: boolean): string | undefined {\n  if (typeof value !== 'string' || value.length === 0 || value.length > MAX_PATH || CONTROL.test(value)) return undefined;\n  const normalized = value.replaceAll('\\\\', '/');\n  if (normalized.startsWith('//')) return undefined;\n  const drive = /^([a-z]):(?:\\/|$)/iu.exec(normalized);\n  if (SCHEME.test(normalized) && drive === null) return undefined;\n  const absolute = drive !== null || normalized.startsWith('/');\n  if (relativeOnly && absolute) return undefined;\n  const body = drive === null ? normalized : normalized.slice(2);\n  const parts: string[] = [];\n  for (const part of body.split('/')) {\n    if (part === '' || part === '.') continue;\n    if (part === '..') return undefined;\n    parts.push(part);\n  }\n  if (drive !== null) return parts.length === 0 ? `${drive[1]!.toUpperCase()}:/` : `${drive[1]!.toUpperCase()}:/${parts.join('/')}`;\n  if (normalized.startsWith('/')) return parts.length === 0 ? '/' : `/${parts.join('/')}`;\n  if (relativeOnly && parts.length === 0) return undefined;\n  return parts.length === 0 ? '.' : parts.join('/');\n}\n\nexport function admittedLabelV2(raw: string, baseDirectory: string): string {\n  const normalized = normalizeAdmittedPathV2(raw) ?? 'input';\n  if (!isAbsoluteAdmittedPathV2(normalized)) return normalized;\n  const base = normalizeAdmittedPathV2(baseDirectory) ?? '.';\n  if (isAbsoluteAdmittedPathV2(base)) {\n    const relative = relativeAdmitted(base, normalized);\n    if (relative !== undefined && relative !== '..'\n      && !relative.startsWith('../') && !relative.startsWith('/')\n      && !isAbsoluteAdmittedPathV2(relative)) return relative;\n  }\n  const parts = normalized.split('/');\n  return parts[parts.length - 1] || 'input';\n}\n\nexport function toFsPathV2(baseDirectory: string, normalized: string): string {\n  if (isAbsoluteAdmittedPathV2(normalized)) return normalized;\n  const base = baseDirectory.replaceAll('\\\\', '/');\n  if (base === '/' || /^[a-z]:\\/$/iu.test(base)) return `${base}${normalized}`;\n  const trimmed = base.replace(/\\/+$/u, '');\n  return trimmed === '' || trimmed === '.' ? normalized : `${trimmed}/${normalized}`;\n}\n\nexport function isWithinBaseV2(target: string, baseDirectory: string): boolean {\n  const targetPath = normalizeAdmittedPathV2(target);\n  const base = normalizeAdmittedPathV2(baseDirectory);\n  if (targetPath === undefined || base === undefined\n    || !isAbsoluteAdmittedPathV2(targetPath) || !isAbsoluteAdmittedPathV2(base)) return false;\n  const relative = relativeAdmitted(base, targetPath);\n  return relative !== undefined && relative !== '..'\n    && !relative.startsWith('../') && !relative.startsWith('/')\n    && !isAbsoluteAdmittedPathV2(relative);\n}\n\nfunction relativeAdmitted(base: string, target: string): string | undefined {\n  try {\n    if (/^[a-z]:\\//iu.test(base) || /^[a-z]:\\//iu.test(target)) {\n      return win32.relative(base.replaceAll('/', '\\\\'), target.replaceAll('/', '\\\\')).replaceAll('\\\\', '/');\n    }\n    return posix.relative(base, target);\n  } catch { return undefined; }\n}\n", "import { ADMITTED_PROFILE_V2, isAdmittedProfileSpecifierV2, isApprovedDomainV2, type ScanConfigV2, type ScanSeverityV2 } from './contracts.js';\nimport { isAbsoluteAdmittedPathV2, isAdmittedLocalPath, isAdmittedRelativePath, normalizeAdmittedPathV2 } from './path-admission.js';\nimport type { V2CommandName } from './help.js';\n\nexport type CliFormatV2 = 'json' | 'ndjson' | 'sarif' | 'table';\nexport type CliProfileV2 = typeof ADMITTED_PROFILE_V2.id;\nexport type CliTargetEnumV2 = 'UNKNOWN' | 'COMMUNITY' | 'ENTERPRISE' | 'CLOUD' | 'SELF_HOSTED' | 'OWNER' | 'ADMIN' | 'MEMBER' | 'LEGACY' | 'NATIVE';\nexport type CliParseErrorCodeV2 = 'NO_COMMAND' | 'UNKNOWN_COMMAND' | 'UNKNOWN_OPTION' | 'MISSING_VALUE' | 'INVALID_VALUE' | 'DUPLICATE_OPTION' | 'UNEXPECTED_ARGUMENT' | 'REMOTE_PATH' | 'RULE_PACK_INVALID' | 'SEMANTIC_CATALOGUE_INVALID' | 'PROFILE_NOT_ADMITTED';\nexport type CliParseErrorV2 = Readonly<{ code: CliParseErrorCodeV2; message: string; argument?: string }>;\n\ntype ScanCommandV2 = Readonly<{\n  kind: 'scan'; schema: 'v2'; inputs: readonly string[]; format: CliFormatV2; profile: CliProfileV2; failOn: ScanSeverityV2;\n  requireComplete: boolean; concurrency: number; timeoutMs?: number; output?: string; configPath?: string;\n  rules: 'builtin'; catalogue: 'builtin'; limits: string; target?: string; n8nVersion?: string;\n  edition: 'COMMUNITY' | 'ENTERPRISE' | 'CLOUD' | 'UNKNOWN'; deployment: 'SELF_HOSTED' | 'CLOUD' | 'UNKNOWN';\n  role: 'OWNER' | 'ADMIN' | 'MEMBER' | 'UNKNOWN'; taskRunner: 'LEGACY' | 'NATIVE' | 'UNKNOWN';\n  communityPackages: readonly string[]; configuration: readonly string[]; approvedDomains: readonly string[]; include: readonly string[]; exclude: readonly string[];\n  allowUnsignedDevelopmentRules: boolean; noColor: boolean; auditSupplyChain: boolean; includeReadiness: boolean; cliOverrides: Readonly<Partial<ScanConfigV2>>;\n}>;\nexport type CliHelpCommandV2 = Readonly<{ kind: 'help'; schema: 'v2'; command?: V2CommandName }>;\n/** Fix output is JSON-only; the fixed `format` keeps downstream command reducers total. */\nexport type CliFixCommandV2 = Readonly<{\n  kind: 'fix'; schema: 'v2'; action: 'suggest' | 'apply'; format: 'json';\n  root: string; input: string; fix?: string; mapping?: string; endpointReceipt?: string; confirm: boolean;\n}>;\nexport type CliCommandV2 = ScanCommandV2\n  | CliFixCommandV2\n  | Readonly<{ kind: 'rules'; schema: 'v2'; format: 'json' | 'table' }>\n  | Readonly<{ kind: 'explain'; schema: 'v2'; format: 'json' | 'table'; ruleId: string }>\n  | Readonly<{ kind: 'profiles'; schema: 'v2'; format: 'json' | 'table' }>\n  | Readonly<{ kind: 'validate-config'; schema: 'v2'; format: 'json' | 'table'; path: string }>\n  | Readonly<{ kind: 'version'; schema: 'v2'; format: 'json' | 'table' }>;\ntype ParsedCommandV2 = CliCommandV2 | CliHelpCommandV2;\nexport type CliParseResultV2 = Readonly<{ ok: true; command: ParsedCommandV2 } | { ok: false; error: CliParseErrorV2 }>;\nexport type CliArgumentDispatch = Readonly<{ mode: 'v1'; argv: readonly string[] } | { mode: 'v2'; result: CliParseResultV2 }>;\n\nconst severities: readonly ScanSeverityV2[] = ['CRITICAL', 'HIGH', 'MEDIUM', 'LOW', 'INFO'];\nconst commands: Record<string, true> = Object.freeze({ scan: true, fix: true, rules: true, explain: true, profiles: true, 'validate-config': true, version: true, '--version': true });\nconst implicitV2Commands: Record<string, true> = Object.freeze({ fix: true, rules: true, explain: true, profiles: true, 'validate-config': true, version: true });\nconst scalarOptions: Record<string, true> = Object.freeze({ '--format': true, '--profile': true, '--fail-on': true, '--max-concurrency': true, '--concurrency': true, '--timeout': true, '--output': true, '--config': true, '--rules': true, '--catalogue': true, '--limits': true, '--target': true, '--n8n-version': true, '--edition': true, '--deployment': true, '--role': true, '--task-runner': true });\nconst repeatableOptions: Record<string, true> = Object.freeze({ '--community-package': true, '--configuration': true, '--approved-domain': true, '--include': true, '--exclude': true });\nconst configFields: Record<string, keyof ScanConfigV2> = Object.freeze({ '--format': 'format', '--profile': 'profile', '--fail-on': 'failOn', '--max-concurrency': 'concurrency', '--concurrency': 'concurrency', '--output': 'output', '--config': 'configPath', '--rules': 'rules', '--catalogue': 'catalogue', '--limits': 'limits', '--target': 'target', '--approved-domain': 'approvedDomains', '--include': 'include', '--exclude': 'exclude', 'inputs': 'inputs', '--require-complete': 'requireComplete', '--allow-unsigned-development-rules': 'allowUnsignedDevelopmentRules', '--no-color': 'noColor' });\nconst overrideOrder: readonly (keyof ScanConfigV2)[] = ['format', 'profile', 'output', 'inputs', 'configPath', 'failOn', 'requireComplete', 'concurrency', 'rules', 'catalogue', 'limits', 'target', 'include', 'exclude', 'approvedDomains', 'allowUnsignedDevelopmentRules', 'noColor'];\n\nexport function parseArgumentsV2(argv: readonly string[]): CliParseResultV2 {\n  const stripped = stripSchema(argv); if (!stripped.ok) return stripped.result;\n  const args = stripped.args; const raw = args[0];\n  if (!raw) return failure('NO_COMMAND', 'A v2 command is required.');\n  if (raw === '--help') return success({ kind: 'help', schema: 'v2' });\n  if (commands[raw] !== true) return failure('UNKNOWN_COMMAND', 'Unknown v2 command.');\n  const kind = raw === '--version' ? 'version' : raw;\n  if (kind === 'fix') return parseFix(args.slice(1));\n  if (kind !== 'scan') return parseMetadata(kind as Exclude<CliCommandV2['kind'], 'scan' | 'help' | 'fix'>, args.slice(1));\n  if (args.length === 2 && args[1] === '--help') return success({ kind: 'help', schema: 'v2', command: 'scan' });\n  const value: Record<string, unknown> = {\n    kind: 'scan', schema: 'v2', inputs: [], format: 'json', profile: 'beta-default', failOn: 'INFO', requireComplete: false,\n    concurrency: 1, rules: 'builtin', catalogue: 'builtin', limits: 'builtin', edition: 'UNKNOWN', deployment: 'UNKNOWN',\n    role: 'UNKNOWN', taskRunner: 'UNKNOWN', communityPackages: [], configuration: [], include: ['**/*.json'],\n    exclude: ['.git/**', 'node_modules/**'], allowUnsignedDevelopmentRules: false, noColor: false, auditSupplyChain: false,\n    includeReadiness: false,\n  };\n  const overrides: Record<string, unknown> = {}; const inputs: string[] = []; const repeatable: Record<string, string[]> = { '--community-package': [], '--configuration': [], '--approved-domain': [], '--include': [], '--exclude': [] }; const seen = new Set<string>();\n  for (let index = 1; index < args.length; index += 1) {\n    const token = args[index]!;\n    if (token === '--') {\n      for (const rawInput of args.slice(index + 1)) {\n        const input = rawInput === '-' ? '-' : normalizeAdmittedPathV2(rawInput);\n        if (input === undefined) return failure('REMOTE_PATH', 'Input path is not admitted.');\n        inputs.push(input);\n      }\n      break;\n    }\n    if (token === '-' || !token.startsWith('-')) {\n      const input = token === '-' ? '-' : normalizeAdmittedPathV2(token);\n      if (input === undefined) return failure('REMOTE_PATH', 'Input path is not admitted.');\n      inputs.push(input);\n      continue;\n    }\n    const [name, inline] = splitOption(token);\n    if (name === '--audit-supply-chain' || name === '--include-readiness') {\n      if (inline !== undefined) return failure('INVALID_VALUE', 'Boolean option does not accept a value.', name);\n      if (seen.has(name)) return failure('DUPLICATE_OPTION', 'Option supplied more than once.', name);\n      const next = args[index + 1];\n      if (next === 'true' || next === 'false') return failure('INVALID_VALUE', 'Boolean option does not accept a value.', name);\n      seen.add(name); value[name === '--include-readiness' ? 'includeReadiness' : 'auditSupplyChain'] = true; continue;\n    }\n    if (name === '--require-complete' || name === '--allow-unsigned-development-rules' || name === '--no-color') {\n      if (inline !== undefined || seen.has(name)) return failure('DUPLICATE_OPTION', 'Option supplied more than once.', name);\n      seen.add(name); value[name === '--require-complete' ? 'requireComplete' : name === '--no-color' ? 'noColor' : 'allowUnsignedDevelopmentRules'] = true; overrides[configFields[name]!] = true; continue;\n    }\n    if (scalarOptions[name] !== true && repeatableOptions[name] !== true) return failure('UNKNOWN_OPTION', 'Unknown option.', name);\n    const duplicateKey = name === '--max-concurrency' ? '--concurrency' : name;\n    if (seen.has(duplicateKey) && scalarOptions[name] === true) return failure('DUPLICATE_OPTION', 'Option supplied more than once.', name);\n    const read = inline === undefined ? args[index + 1] : inline;\n    if (read === undefined || read.length === 0 || (inline === undefined && read.startsWith('-') && !(name === '--output' && read === '-'))) return failure('MISSING_VALUE', 'Option requires a value.', name);\n    if (inline === undefined) index += 1;\n    if (repeatableOptions[name] === true) {\n      if (name === '--approved-domain' && !isApprovedDomainV2(read)) return failure('INVALID_VALUE', 'Approved domain is invalid.', name);\n      if (!isAdmittedRelativePath(read)) return failure('REMOTE_PATH', 'Option value is not admitted.', name);\n      repeatable[name]!.push(read);\n      if (configFields[name]) overrides[configFields[name]!] = Object.freeze([...repeatable[name]!]);\n      continue;\n    }\n    if (name === '--format' && !['json', 'ndjson', 'sarif', 'table'].includes(read)) return failure('INVALID_VALUE', 'Format is invalid.', name);\n    if (name === '--profile' && !isAdmittedProfileSpecifierV2(read)) return failure('PROFILE_NOT_ADMITTED', 'Profile is not admitted.', name);\n    if (name === '--fail-on' && !severities.includes(read as ScanSeverityV2)) return failure('INVALID_VALUE', 'Fail threshold is invalid.', name);\n    if ((name === '--max-concurrency' || name === '--concurrency' || name === '--timeout') && !positiveInteger(read, name === '--timeout' ? 2 ** 31 - 1 : 16)) return failure('INVALID_VALUE', 'Numeric option is invalid.', name);\n    if (name === '--n8n-version' && !/^\\d+\\.\\d+\\.\\d+(?:-[0-9A-Za-z.-]+)?(?:\\+[0-9A-Za-z.-]+)?$/.test(read)) return failure('INVALID_VALUE', 'n8n version is invalid.', name);\n    if (name === '--edition' && !['COMMUNITY', 'ENTERPRISE', 'CLOUD', 'UNKNOWN'].includes(read)) return failure('INVALID_VALUE', 'Edition is invalid.', name);\n    if (name === '--deployment' && !['SELF_HOSTED', 'CLOUD', 'UNKNOWN'].includes(read)) return failure('INVALID_VALUE', 'Deployment is invalid.', name);\n    if (name === '--role' && !['OWNER', 'ADMIN', 'MEMBER', 'UNKNOWN'].includes(read)) return failure('INVALID_VALUE', 'Role is invalid.', name);\n    if (name === '--task-runner' && !['LEGACY', 'NATIVE', 'UNKNOWN'].includes(read)) return failure('INVALID_VALUE', 'Task runner is invalid.', name);\n    if (name === '--rules' || name === '--catalogue') { if (read !== 'builtin') return failure(name === '--rules' ? 'RULE_PACK_INVALID' : 'SEMANTIC_CATALOGUE_INVALID', 'Only built-in authority is available.', name); }\n    else if (['--limits', '--target', '--config'].includes(name) && (read === '-' || !isAdmittedRelativePath(read))) return failure('REMOTE_PATH', 'Option value is not admitted.', name);\n    else if (name === '--output' && read !== '-' && !isAdmittedRelativePath(read)) return failure('REMOTE_PATH', 'Option value is not admitted.', name);\n    else if (['--n8n-version', '--edition', '--deployment', '--role', '--task-runner'].includes(name) && !safeText(read)) return failure('INVALID_VALUE', 'Option value is not admitted.', name);\n    seen.add(duplicateKey); assign(value, name, read); if (name === '--profile') value.profile = ADMITTED_PROFILE_V2.id; if (configFields[name]) overrides[configFields[name]!] = ['--max-concurrency', '--concurrency'].includes(name) ? Number(read) : read;\n  }\n  // No external rule pack is admittable: `--rules`/`--catalogue` accept only the built-in authority,\n  // so the unsigned development escape hatch has nothing it could admit. It is refused as a usage\n  // error instead of being left to imply that a local pack would be loaded.\n  if (value.includeReadiness === true && value.format === 'sarif') return failure('INVALID_VALUE', 'Readiness assessment cannot be projected into SARIF.', '--include-readiness');\n  if (value.allowUnsignedDevelopmentRules === true) return failure('RULE_PACK_INVALID', 'External rule packs are not admitted in this release.', '--allow-unsigned-development-rules');\n  if (inputs.length === 0) return failure('UNEXPECTED_ARGUMENT', 'At least one workflow input is required.');\n  if (inputs.some((input) => input !== '-' && !isAdmittedLocalPath(input))) return failure('REMOTE_PATH', 'Input path is not admitted.');\n  if (inputs.includes('-') && inputs.length > 1) return failure('UNEXPECTED_ARGUMENT', 'Standard input cannot be combined with file inputs.');\n  overrides.inputs = Object.freeze([...inputs]);\n  const cliOverrides: Partial<ScanConfigV2> = {}; const sparse = cliOverrides as Record<string, unknown>; for (const field of overrideOrder) if (Object.prototype.hasOwnProperty.call(overrides, field)) sparse[field] = overrides[field];\n  const command: ScanCommandV2 = {\n    kind: 'scan', schema: 'v2', inputs: Object.freeze([...inputs]), format: value.format as CliFormatV2, profile: ADMITTED_PROFILE_V2.id, failOn: value.failOn as ScanSeverityV2, requireComplete: value.requireComplete as boolean, concurrency: value.concurrency as number,\n    ...(typeof value.timeoutMs === 'number' ? { timeoutMs: value.timeoutMs } : {}), ...(typeof value.output === 'string' ? { output: value.output } : {}), ...(typeof value.configPath === 'string' ? { configPath: value.configPath } : {}), rules: value.rules as 'builtin', catalogue: value.catalogue as 'builtin', limits: value.limits as string,\n    ...(typeof value.target === 'string' ? { target: value.target } : {}), ...(typeof value.n8nVersion === 'string' ? { n8nVersion: value.n8nVersion } : {}), edition: value.edition as ScanCommandV2['edition'], deployment: value.deployment as ScanCommandV2['deployment'], role: value.role as ScanCommandV2['role'], taskRunner: value.taskRunner as ScanCommandV2['taskRunner'], communityPackages: arrayFor(repeatable['--community-package']), configuration: arrayFor(repeatable['--configuration']), approvedDomains: arrayFor(repeatable['--approved-domain']), include: repeatable['--include']!.length > 0 ? arrayFor(repeatable['--include']) : Object.freeze(['**/*.json']), exclude: repeatable['--exclude']!.length > 0 ? arrayFor(repeatable['--exclude']) : Object.freeze(['.git/**', 'node_modules/**']), allowUnsignedDevelopmentRules: value.allowUnsignedDevelopmentRules as boolean, noColor: value.noColor as boolean, auditSupplyChain: value.auditSupplyChain === true, includeReadiness: value.includeReadiness as boolean, cliOverrides,\n  };\n  return success(command);\n}\n\nfunction arrayFor(values: readonly string[] | undefined): readonly string[] { return Object.freeze([...(values ?? [])]); }\nexport function parseCliArguments(argv: readonly string[]): CliArgumentDispatch { const hasSchema = hasSchemaMarker(argv); const implicit = argv[0] !== undefined && implicitV2Commands[argv[0]!] === true; return hasSchema || implicit ? freeze({ mode: 'v2', result: parseArgumentsV2(argv) }) : freeze({ mode: 'v1', argv: Object.freeze([...argv]) }); }\nconst FIX_OPTIONS: Record<string, true> = Object.freeze({ '--root': true, '--input': true, '--fix': true, '--mapping': true, '--endpoint-receipt': true });\nconst FIX_SELECTION = /^[A-Za-z0-9][A-Za-z0-9._:@-]{0,127}$/u;\nconst SUBSTITUTION_LITERAL = /(?:\\{\\{|\\}\\}|\\$env\\b|\\$\\{|\\$[A-Za-z_][A-Za-z0-9_]*\\b|%[A-Za-z_][A-Za-z0-9_]*%)/u;\n\n/** Admits one path literal: an absolute local root, or a root-relative input/receipt file. */\nfunction fixPathValue(name: string, read: string): string | CliParseResultV2 {\n  if (read === '-') return failure('INVALID_VALUE', 'Fix commands require a file path; standard input cannot be re-read.', name);\n  if (SUBSTITUTION_LITERAL.test(read)) return failure('REMOTE_PATH', 'Option value is not admitted.', name);\n  const value = normalizeAdmittedPathV2(read, name !== '--root');\n  if (value === undefined) return failure('REMOTE_PATH', 'Option value is not admitted.', name);\n  if (name === '--root' && !isAbsoluteAdmittedPathV2(value)) return failure('INVALID_VALUE', 'Root must be an absolute local directory.', name);\n  return value;\n}\n\n/**\n * Fix surface: `suggest` plans for the whole workflow unless one `--fix` narrows it; `apply`\n * demands one selection plus explicit `--confirm`. Values are path or ID literals only, so\n * credential values, URL substitutions and endpoint settings cannot be passed on the command line.\n */\nfunction parseFix(args: readonly string[]): CliParseResultV2 {\n  const action = args[0];\n  if (action !== 'suggest' && action !== 'apply') return failure('UNKNOWN_COMMAND', 'fix requires the suggest or apply subcommand.');\n  const selected: Record<string, string> = {};\n  const seen = new Set<string>();\n  let confirm = false;\n  for (let index = 1; index < args.length; index += 1) {\n    const token = args[index]!;\n    if (!token.startsWith('-') || token === '-') return failure('UNEXPECTED_ARGUMENT', 'fix accepts options only; positional arguments are not admitted.');\n    const [name, inline] = splitOption(token);\n    if (name === '--confirm') {\n      if (inline !== undefined) return failure('INVALID_VALUE', 'Boolean option does not accept a value.', name);\n      if (action !== 'apply') return failure('UNEXPECTED_ARGUMENT', 'The suggest action does not accept --confirm.', name);\n      if (seen.has(name)) return failure('DUPLICATE_OPTION', 'Option supplied more than once.', name);\n      seen.add(name); confirm = true; continue;\n    }\n    if (FIX_OPTIONS[name] !== true) return failure('UNKNOWN_OPTION', 'Unknown option.', name);\n    if (seen.has(name)) return failure('DUPLICATE_OPTION', 'Option supplied more than once.', name);\n    const read = inline ?? args[index + 1];\n    if (read === undefined || read.length === 0 || (inline === undefined && read.startsWith('-') && read !== '-')) return failure('MISSING_VALUE', 'Option requires a value.', name);\n    if (inline === undefined) index += 1;\n    seen.add(name);\n    if (name === '--fix') {\n      if (!FIX_SELECTION.test(read) || /^[A-Za-z][A-Za-z0-9+.-]*:/u.test(read)) return failure('INVALID_VALUE', 'Fix selection is invalid.', name);\n      selected.fix = read; continue;\n    }\n    const path = fixPathValue(name, read);\n    if (typeof path !== 'string') return path;\n    selected[name === '--root' ? 'root' : name === '--input' ? 'input' : name === '--mapping' ? 'mapping' : 'endpointReceipt'] = path;\n  }\n  if (selected.root === undefined) return failure('UNEXPECTED_ARGUMENT', 'fix requires exactly one --root.');\n  if (selected.input === undefined) return failure('UNEXPECTED_ARGUMENT', 'fix requires exactly one --input.');\n  if (action === 'apply' && selected.fix === undefined) return failure('UNEXPECTED_ARGUMENT', 'fix apply requires one selected fix.');\n  if (action === 'apply' && !confirm) return failure('UNEXPECTED_ARGUMENT', 'fix apply requires --confirm.', '--confirm');\n  return success({\n    kind: 'fix', schema: 'v2', action, format: 'json', root: selected.root, input: selected.input,\n    ...(selected.fix === undefined ? {} : { fix: selected.fix }),\n    ...(selected.mapping === undefined ? {} : { mapping: selected.mapping }),\n    ...(selected.endpointReceipt === undefined ? {} : { endpointReceipt: selected.endpointReceipt }),\n    confirm,\n  });\n}\n\nfunction parseMetadata(kind: Exclude<CliCommandV2['kind'], 'scan' | 'help' | 'fix'>, args: readonly string[]): CliParseResultV2 {\n  if (args.length === 1 && args[0] === '--help') return success({ kind: 'help', schema: 'v2', command: kind });\n  let format: 'json' | 'table' = 'json';\n  const rest: string[] = [];\n  let seen = false;\n  for (let index = 0; index < args.length; index += 1) {\n    const token = args[index]!;\n    if (token.startsWith('-')) {\n      const [name, inline] = splitOption(token);\n      if (name !== '--format' || seen) return failure(seen ? 'DUPLICATE_OPTION' : 'UNKNOWN_OPTION', seen ? 'Option supplied more than once.' : 'Unknown option.', name);\n      const value = inline ?? args[++index];\n      if (!value) return failure('MISSING_VALUE', 'Option requires a value.', name);\n      if (value !== 'json' && value !== 'table') return failure('INVALID_VALUE', 'Format is invalid.', name);\n      format = value;\n      seen = true;\n    } else rest.push(token);\n  }\n  if (kind === 'rules' || kind === 'profiles' || kind === 'version') {\n    if (rest.length > 0) return failure('UNEXPECTED_ARGUMENT', 'Command does not accept positional arguments.');\n    return success({ kind, schema: 'v2', format });\n  }\n  if (kind === 'explain') return rest.length === 1 && safeText(rest[0]!) ? success({ kind, schema: 'v2', format, ruleId: rest[0]! }) : failure('UNEXPECTED_ARGUMENT', 'explain requires one rule ID.');\n  if (rest.length !== 1 || !isAdmittedRelativePath(rest[0]!)) return failure('UNEXPECTED_ARGUMENT', 'validate-config requires one local file.');\n  return success({ kind, schema: 'v2', format, path: rest[0]! });\n}\nfunction assign(value: Record<string, unknown>, name: string, read: string): void { const fields: Record<string, string> = { '--format': 'format', '--profile': 'profile', '--fail-on': 'failOn', '--max-concurrency': 'concurrency', '--concurrency': 'concurrency', '--timeout': 'timeoutMs', '--output': 'output', '--config': 'configPath', '--rules': 'rules', '--catalogue': 'catalogue', '--limits': 'limits', '--target': 'target', '--n8n-version': 'n8nVersion', '--edition': 'edition', '--deployment': 'deployment', '--role': 'role', '--task-runner': 'taskRunner' }; value[fields[name]!] = ['--max-concurrency', '--concurrency', '--timeout'].includes(name) ? Number(read) : read; }\nfunction splitOption(token: string): [string, string | undefined] { const at = token.indexOf('='); return at < 0 ? [token, undefined] : [token.slice(0, at), token.slice(at + 1)]; }\nfunction positiveInteger(value: string, maximum: number): boolean { if (!/^\\d+$/.test(value)) return false; const number = Number(value); return Number.isSafeInteger(number) && number > 0 && number <= maximum; }\nfunction safeText(value: string): boolean { return value.length > 0 && value.length <= 4096 && !/[\\u0000-\\u001f\\u007f]/.test(value) && !/^(?:[a-z][a-z\\d+.-]*:|\\/|[a-z]:|\\\\\\\\)/i.test(value); }\nfunction hasSchemaMarker(argv: readonly string[]): boolean { for (const token of argv) { if (token === '--') break; if (token === '--schema' || token.startsWith('--schema=')) return true; } return false; }\nfunction stripSchema(argv: readonly string[]): { ok: true; args: readonly string[] } | { ok: false; result: CliParseResultV2 } { const args: string[] = []; let seen = false; for (let index = 0; index < argv.length; index += 1) { const token = argv[index]!; if (token === '--') { args.push(...argv.slice(index)); break; } if (token === '--schema') { if (seen || argv[index + 1] !== 'v2') return { ok: false, result: failure(seen ? 'DUPLICATE_OPTION' : 'INVALID_VALUE', seen ? 'Option supplied more than once.' : 'Schema must be v2.', '--schema') }; seen = true; index += 1; continue; } if (token.startsWith('--schema=')) { if (seen || token.slice(9) !== 'v2') return { ok: false, result: failure(seen ? 'DUPLICATE_OPTION' : 'INVALID_VALUE', seen ? 'Option supplied more than once.' : 'Schema must be v2.', '--schema') }; seen = true; continue; } args.push(token); } return { ok: true, args }; }\nfunction success(command: ParsedCommandV2): CliParseResultV2 { return freeze({ ok: true as const, command }); }\nfunction failure(code: CliParseErrorCodeV2, message: string, argument?: string): CliParseResultV2 { const safe = argument !== undefined && /^--[A-Za-z0-9][A-Za-z0-9-]{0,63}$/.test(argument) ? argument : undefined; return freeze({ ok: false as const, error: { code, message, ...(safe === undefined ? {} : { argument: safe }) } }); }\nfunction freeze<T>(value: T, seen = new WeakSet<object>()): T { if (value && typeof value === 'object') { if (seen.has(value as object)) return value; seen.add(value as object); for (const name of Object.getOwnPropertyNames(value as object)) freeze((value as Record<string, unknown>)[name], seen); Object.freeze(value); } return value; }\n"],
+  "mappings": ";AAAA,SAAS,kBAAkB;;;ACIpB,SAAS,iBAAiB,OAAwB;AACvD,SAAO,gBAAgB,OAAO,oBAAI,IAAY,CAAC;AACjD;AAOA,SAAS,gBAAgB,OAAgB,MAA2B;AAClE,MAAI,UAAU,KAAM,QAAO;AAC3B,MAAI,OAAO,UAAU,SAAU,QAAO,KAAK,UAAU,KAAK;AAC1D,MAAI,OAAO,UAAU,UAAW,QAAO,QAAQ,SAAS;AACxD,MAAI,OAAO,UAAU,UAAU;AAC7B,QAAI,CAAC,OAAO,SAAS,KAAK,EAAG,OAAM,IAAI,UAAU,mDAAmD;AACpG,WAAO,KAAK,UAAU,OAAO,GAAG,OAAO,EAAE,IAAI,IAAI,KAAK;AAAA,EACxD;AACA,MAAI,OAAO,UAAU,YAAY,UAAU,QAAW;AACpD,UAAM,IAAI,UAAU,iBAAiB,OAAO,KAAK,oBAAoB;AAAA,EACvE;AACA,MAAI,KAAK,IAAI,KAAK,EAAG,OAAM,IAAI,UAAU,8CAA8C;AACvF,OAAK,IAAI,KAAK;AAEd,MAAI;AACF,QAAI,MAAM,QAAQ,KAAK,EAAG,QAAO,YAAY,OAAO,IAAI;AACxD,WAAO,aAAa,OAAkC,IAAI;AAAA,EAC5D,UAAE;AACA,SAAK,OAAO,KAAK;AAAA,EACnB;AACF;AAEA,SAAS,YAAY,OAA2B,MAA2B;AACzE,QAAM,SAAS,MAAM,KAAK,EAAE,QAAQ,MAAM,OAAO,GAAG,CAAC,GAAG,UAAU;AAChE,QAAI,CAAC,OAAO,UAAU,eAAe,KAAK,OAAO,KAAK,GAAG;AACvD,YAAM,IAAI,UAAU,8CAA8C;AAAA,IACpE;AACA,WAAO,gBAAgB,MAAM,KAAK,GAAG,IAAI;AAAA,EAC3C,CAAC;AACD,SAAO,IAAI,OAAO,KAAK,GAAG,CAAC;AAC7B;AAEA,SAAS,aAAa,OAAgC,MAA2B;AAC/E,QAAM,YAAY,OAAO,eAAe,KAAK;AAC7C,MAAI,cAAc,OAAO,aAAa,cAAc,MAAM;AACxD,UAAM,IAAI,UAAU,oDAAoD;AAAA,EAC1E;AACA,MAAI,OAAO,sBAAsB,KAAK,EAAE,KAAK,CAAC,WAC5C,OAAO,UAAU,qBAAqB,KAAK,OAAO,MAAM,CAAC,GAAG;AAC5D,UAAM,IAAI,UAAU,mDAAmD;AAAA,EACzE;AAEA,QAAM,QAAQ,OAAO,KAAK,KAAK,EAC5B,KAAK,uBAAuB,EAC5B,IAAI,CAAC,QAAQ,GAAG,KAAK,UAAU,GAAG,CAAC,IAAI,gBAAgB,MAAM,GAAG,GAAG,IAAI,CAAC,EAAE;AAC7E,SAAO,IAAI,MAAM,KAAK,GAAG,CAAC;AAC5B;AAEA,SAAS,wBAAwB,MAAc,OAAuB;AACpE,MAAI,SAAS,MAAO,QAAO;AAC3B,SAAO,OAAO,QAAQ,KAAK;AAC7B;;;AD9DO,IAAM,wBAAwB;AAwB9B,IAAM,sBAAsB,OAAO,OAAO,EAAE,IAAI,gBAAgB,SAAS,SAAS,QAAQ,mEAAmE,CAAC;AAQ9J,IAAM,iCAAoD,OAAO,OAAO;AAAA,EAC7E,oBAAoB;AAAA,EACpB,GAAG,oBAAoB,EAAE,IAAI,oBAAoB,OAAO;AAC1D,CAAC;AAEM,SAAS,6BAA6B,OAAiC;AAC5E,SAAO,OAAO,UAAU,YAAY,+BAA+B,SAAS,KAAK;AACnF;AACO,IAAM,yBAAyB,OAAO,OAAO;AAAA,EAClD,SAAS;AAAA,EACT,OAAO,OAAO,OAAO,EAAE,IAAI,yBAAyB,SAAS,SAAS,QAAQ,oEAAoE,iBAAiB,WAAoB,CAAC;AAAA,EACxL,WAAW,OAAO,OAAO,EAAE,IAAI,yBAAyB,SAAS,SAAS,QAAQ,mEAAmE,CAAC;AAAA,EACtJ,QAAQ,OAAO,OAAO,EAAE,eAAe,qBAA8B,QAAQ,mEAAmE,CAAC;AACnJ,CAAC;AACM,IAAM,6BAA6B,oBAAoB;AACvD,IAAM,+BAA+B,uBAAuB;AAC5D,IAAM,iCAAiC,uBAAuB;AAC9D,IAAM,8BAA8B,uBAAuB;AAC3D,IAAM,sBAAsB,6BAA6B;AACzD,IAAM,+BAA+B,+BAA+B;AAEpE,IAAM,wCAAwC,OAAO,OAAO;AAAA,EACjE,IAAI;AAAA,EAA6B,SAAS;AAAA,EAC1C,QAAQ;AAAA,EACR,qBAAqB;AAAA,EACrB,8BAA8B;AAChC,CAAC;AAQM,IAAM,iBAAiB;AAEvB,IAAM,cAAiC,OAAO,OAAO;AAAA,EAC1D,MAAM;AAAA,EACN,SAAS;AAAA,EACT,aAAa,WAAW,QAAQ,EAAE,OAAO,iBAAiB;AAAA,IACxD,QAAQ;AAAA,IAAsB,SAAS;AAAA,IAAS,SAAS;AAAA,IACzD,SAAS,6BAA6B;AAAA,IAAQ,WAAW,+BAA+B;AAAA,IACxF,iBAAiB;AAAA,EACnB,CAAC,CAAC,EAAE,OAAO,KAAK;AAClB,CAAC;AAEM,IAAM,yBAAuC,OAAO,OAAO;AAAA,EAChE,eAAe;AAAA,EACf,QAAQ;AAAA,EAAQ,SAAS,oBAAoB;AAAA,EAAI,QAAQ;AAAA,EAAQ,iBAAiB;AAAA,EAAO,aAAa;AAAA,EACtG,OAAO;AAAA,EAAW,WAAW;AAAA,EAAW,QAAQ;AAAA,EAChD,SAAS,OAAO,OAAO,CAAC,WAAW,CAAC;AAAA,EAAG,SAAS,OAAO,OAAO,CAAC,WAAW,iBAAiB,CAAC;AAAA,EAC5F,iBAAiB,OAAO,OAAO,CAAC,CAAC;AAAA,EACjC,+BAA+B;AAAA,EAAO,SAAS;AACjD,CAAC;AAEM,IAAM,wBAAwB,OAAO,OAAO;AAAA,EACjD;AAAA,EAAiB;AAAA,EAAU;AAAA,EAAW;AAAA,EAAU;AAAA,EAAU;AAAA,EAAc;AAAA,EAAU;AAAA,EAAmB;AAAA,EACrG;AAAA,EAAS;AAAA,EAAa;AAAA,EAAU;AAAA,EAAU;AAAA,EAAW;AAAA,EAAW;AAAA,EAChE;AAAA,EAAiC;AACnC,CAAU;AAKH,IAAM,YAAY;AAClB,SAAS,mBAAmB,OAAiC;AAClE,SAAO,OAAO,UAAU,YAAY,UAAU,KAAK,KAAK;AAC1D;;;AEnGA,IAAM,UAAU;AAChB,IAAM,SAAS;AACf,IAAM,QAAQ;AACd,IAAM,WAAW;AAGV,SAAS,yBAAyB,OAAwB;AAC/D,QAAM,aAAa,MAAM,WAAW,MAAM,GAAG;AAC7C,MAAI,WAAW,WAAW,IAAI,EAAG,QAAO;AACxC,SAAO,WAAW,WAAW,GAAG,KAAK,MAAM,KAAK,UAAU;AAC5D;AAEO,SAAS,oBAAoB,OAAiC;AACnE,SAAO,WAAW,OAAO,KAAK,MAAM;AACtC;AAEO,SAAS,uBAAuB,OAAiC;AACtE,SAAO,WAAW,OAAO,IAAI,MAAM;AACrC;AAEO,SAAS,wBAAwB,OAAgB,eAAe,OAA2B;AAChG,SAAO,WAAW,OAAO,YAAY;AACvC;AAEA,SAAS,WAAW,OAAgB,cAA2C;AAC7E,MAAI,OAAO,UAAU,YAAY,MAAM,WAAW,KAAK,MAAM,SAAS,YAAY,QAAQ,KAAK,KAAK,EAAG,QAAO;AAC9G,QAAM,aAAa,MAAM,WAAW,MAAM,GAAG;AAC7C,MAAI,WAAW,WAAW,IAAI,EAAG,QAAO;AACxC,QAAM,QAAQ,sBAAsB,KAAK,UAAU;AACnD,MAAI,OAAO,KAAK,UAAU,KAAK,UAAU,KAAM,QAAO;AACtD,QAAM,WAAW,UAAU,QAAQ,WAAW,WAAW,GAAG;AAC5D,MAAI,gBAAgB,SAAU,QAAO;AACrC,QAAM,OAAO,UAAU,OAAO,aAAa,WAAW,MAAM,CAAC;AAC7D,QAAM,QAAkB,CAAC;AACzB,aAAW,QAAQ,KAAK,MAAM,GAAG,GAAG;AAClC,QAAI,SAAS,MAAM,SAAS,IAAK;AACjC,QAAI,SAAS,KAAM,QAAO;AAC1B,UAAM,KAAK,IAAI;AAAA,EACjB;AACA,MAAI,UAAU,KAAM,QAAO,MAAM,WAAW,IAAI,GAAG,MAAM,CAAC,EAAG,YAAY,CAAC,OAAO,GAAG,MAAM,CAAC,EAAG,YAAY,CAAC,KAAK,MAAM,KAAK,GAAG,CAAC;AAC/H,MAAI,WAAW,WAAW,GAAG,EAAG,QAAO,MAAM,WAAW,IAAI,MAAM,IAAI,MAAM,KAAK,GAAG,CAAC;AACrF,MAAI,gBAAgB,MAAM,WAAW,EAAG,QAAO;AAC/C,SAAO,MAAM,WAAW,IAAI,MAAM,MAAM,KAAK,GAAG;AAClD;;;ACTA,IAAM,aAAwC,CAAC,YAAY,QAAQ,UAAU,OAAO,MAAM;AAC1F,IAAM,WAAiC,OAAO,OAAO,EAAE,MAAM,MAAM,KAAK,MAAM,OAAO,MAAM,SAAS,MAAM,UAAU,MAAM,mBAAmB,MAAM,SAAS,MAAM,aAAa,KAAK,CAAC;AACrL,IAAM,qBAA2C,OAAO,OAAO,EAAE,KAAK,MAAM,OAAO,MAAM,SAAS,MAAM,UAAU,MAAM,mBAAmB,MAAM,SAAS,KAAK,CAAC;AAChK,IAAM,gBAAsC,OAAO,OAAO,EAAE,YAAY,MAAM,aAAa,MAAM,aAAa,MAAM,qBAAqB,MAAM,iBAAiB,MAAM,aAAa,MAAM,YAAY,MAAM,YAAY,MAAM,WAAW,MAAM,eAAe,MAAM,YAAY,MAAM,YAAY,MAAM,iBAAiB,MAAM,aAAa,MAAM,gBAAgB,MAAM,UAAU,MAAM,iBAAiB,KAAK,CAAC;AAC9Y,IAAM,oBAA0C,OAAO,OAAO,EAAE,uBAAuB,MAAM,mBAAmB,MAAM,qBAAqB,MAAM,aAAa,MAAM,aAAa,KAAK,CAAC;AACvL,IAAM,eAAmD,OAAO,OAAO,EAAE,YAAY,UAAU,aAAa,WAAW,aAAa,UAAU,qBAAqB,eAAe,iBAAiB,eAAe,YAAY,UAAU,YAAY,cAAc,WAAW,SAAS,eAAe,aAAa,YAAY,UAAU,YAAY,UAAU,qBAAqB,mBAAmB,aAAa,WAAW,aAAa,WAAW,UAAU,UAAU,sBAAsB,mBAAmB,sCAAsC,iCAAiC,cAAc,UAAU,CAAC;AACnlB,IAAM,gBAAiD,CAAC,UAAU,WAAW,UAAU,UAAU,cAAc,UAAU,mBAAmB,eAAe,SAAS,aAAa,UAAU,UAAU,WAAW,WAAW,mBAAmB,iCAAiC,SAAS;AAEjR,SAAS,iBAAiB,MAA2C;AAC1E,QAAM,WAAW,YAAY,IAAI;AAAG,MAAI,CAAC,SAAS,GAAI,QAAO,SAAS;AACtE,QAAM,OAAO,SAAS;AAAM,QAAM,MAAM,KAAK,CAAC;AAC9C,MAAI,CAAC,IAAK,QAAO,QAAQ,cAAc,2BAA2B;AAClE,MAAI,QAAQ,SAAU,QAAO,QAAQ,EAAE,MAAM,QAAQ,QAAQ,KAAK,CAAC;AACnE,MAAI,SAAS,GAAG,MAAM,KAAM,QAAO,QAAQ,mBAAmB,qBAAqB;AACnF,QAAM,OAAO,QAAQ,cAAc,YAAY;AAC/C,MAAI,SAAS,MAAO,QAAO,SAAS,KAAK,MAAM,CAAC,CAAC;AACjD,MAAI,SAAS,OAAQ,QAAO,cAAc,MAAgE,KAAK,MAAM,CAAC,CAAC;AACvH,MAAI,KAAK,WAAW,KAAK,KAAK,CAAC,MAAM,SAAU,QAAO,QAAQ,EAAE,MAAM,QAAQ,QAAQ,MAAM,SAAS,OAAO,CAAC;AAC7G,QAAM,QAAiC;AAAA,IACrC,MAAM;AAAA,IAAQ,QAAQ;AAAA,IAAM,QAAQ,CAAC;AAAA,IAAG,QAAQ;AAAA,IAAQ,SAAS;AAAA,IAAgB,QAAQ;AAAA,IAAQ,iBAAiB;AAAA,IAClH,aAAa;AAAA,IAAG,OAAO;AAAA,IAAW,WAAW;AAAA,IAAW,QAAQ;AAAA,IAAW,SAAS;AAAA,IAAW,YAAY;AAAA,IAC3G,MAAM;AAAA,IAAW,YAAY;AAAA,IAAW,mBAAmB,CAAC;AAAA,IAAG,eAAe,CAAC;AAAA,IAAG,SAAS,CAAC,WAAW;AAAA,IACvG,SAAS,CAAC,WAAW,iBAAiB;AAAA,IAAG,+BAA+B;AAAA,IAAO,SAAS;AAAA,IAAO,kBAAkB;AAAA,IACjH,kBAAkB;AAAA,EACpB;AACA,QAAM,YAAqC,CAAC;AAAG,QAAM,SAAmB,CAAC;AAAG,QAAM,aAAuC,EAAE,uBAAuB,CAAC,GAAG,mBAAmB,CAAC,GAAG,qBAAqB,CAAC,GAAG,aAAa,CAAC,GAAG,aAAa,CAAC,EAAE;AAAG,QAAM,OAAO,oBAAI,IAAY;AACvQ,WAAS,QAAQ,GAAG,QAAQ,KAAK,QAAQ,SAAS,GAAG;AACnD,UAAM,QAAQ,KAAK,KAAK;AACxB,QAAI,UAAU,MAAM;AAClB,iBAAW,YAAY,KAAK,MAAM,QAAQ,CAAC,GAAG;AAC5C,cAAM,QAAQ,aAAa,MAAM,MAAM,wBAAwB,QAAQ;AACvE,YAAI,UAAU,OAAW,QAAO,QAAQ,eAAe,6BAA6B;AACpF,eAAO,KAAK,KAAK;AAAA,MACnB;AACA;AAAA,IACF;AACA,QAAI,UAAU,OAAO,CAAC,MAAM,WAAW,GAAG,GAAG;AAC3C,YAAM,QAAQ,UAAU,MAAM,MAAM,wBAAwB,KAAK;AACjE,UAAI,UAAU,OAAW,QAAO,QAAQ,eAAe,6BAA6B;AACpF,aAAO,KAAK,KAAK;AACjB;AAAA,IACF;AACA,UAAM,CAAC,MAAM,MAAM,IAAI,YAAY,KAAK;AACxC,QAAI,SAAS,0BAA0B,SAAS,uBAAuB;AACrE,UAAI,WAAW,OAAW,QAAO,QAAQ,iBAAiB,2CAA2C,IAAI;AACzG,UAAI,KAAK,IAAI,IAAI,EAAG,QAAO,QAAQ,oBAAoB,mCAAmC,IAAI;AAC9F,YAAM,OAAO,KAAK,QAAQ,CAAC;AAC3B,UAAI,SAAS,UAAU,SAAS,QAAS,QAAO,QAAQ,iBAAiB,2CAA2C,IAAI;AACxH,WAAK,IAAI,IAAI;AAAG,YAAM,SAAS,wBAAwB,qBAAqB,kBAAkB,IAAI;AAAM;AAAA,IAC1G;AACA,QAAI,SAAS,wBAAwB,SAAS,wCAAwC,SAAS,cAAc;AAC3G,UAAI,WAAW,UAAa,KAAK,IAAI,IAAI,EAAG,QAAO,QAAQ,oBAAoB,mCAAmC,IAAI;AACtH,WAAK,IAAI,IAAI;AAAG,YAAM,SAAS,uBAAuB,oBAAoB,SAAS,eAAe,YAAY,+BAA+B,IAAI;AAAM,gBAAU,aAAa,IAAI,CAAE,IAAI;AAAM;AAAA,IAChM;AACA,QAAI,cAAc,IAAI,MAAM,QAAQ,kBAAkB,IAAI,MAAM,KAAM,QAAO,QAAQ,kBAAkB,mBAAmB,IAAI;AAC9H,UAAM,eAAe,SAAS,sBAAsB,kBAAkB;AACtE,QAAI,KAAK,IAAI,YAAY,KAAK,cAAc,IAAI,MAAM,KAAM,QAAO,QAAQ,oBAAoB,mCAAmC,IAAI;AACtI,UAAM,OAAO,WAAW,SAAY,KAAK,QAAQ,CAAC,IAAI;AACtD,QAAI,SAAS,UAAa,KAAK,WAAW,KAAM,WAAW,UAAa,KAAK,WAAW,GAAG,KAAK,EAAE,SAAS,cAAc,SAAS,KAAO,QAAO,QAAQ,iBAAiB,4BAA4B,IAAI;AACzM,QAAI,WAAW,OAAW,UAAS;AACnC,QAAI,kBAAkB,IAAI,MAAM,MAAM;AACpC,UAAI,SAAS,uBAAuB,CAAC,mBAAmB,IAAI,EAAG,QAAO,QAAQ,iBAAiB,+BAA+B,IAAI;AAClI,UAAI,CAAC,uBAAuB,IAAI,EAAG,QAAO,QAAQ,eAAe,iCAAiC,IAAI;AACtG,iBAAW,IAAI,EAAG,KAAK,IAAI;AAC3B,UAAI,aAAa,IAAI,EAAG,WAAU,aAAa,IAAI,CAAE,IAAI,OAAO,OAAO,CAAC,GAAG,WAAW,IAAI,CAAE,CAAC;AAC7F;AAAA,IACF;AACA,QAAI,SAAS,cAAc,CAAC,CAAC,QAAQ,UAAU,SAAS,OAAO,EAAE,SAAS,IAAI,EAAG,QAAO,QAAQ,iBAAiB,sBAAsB,IAAI;AAC3I,QAAI,SAAS,eAAe,CAAC,6BAA6B,IAAI,EAAG,QAAO,QAAQ,wBAAwB,4BAA4B,IAAI;AACxI,QAAI,SAAS,eAAe,CAAC,WAAW,SAAS,IAAsB,EAAG,QAAO,QAAQ,iBAAiB,8BAA8B,IAAI;AAC5I,SAAK,SAAS,uBAAuB,SAAS,mBAAmB,SAAS,gBAAgB,CAAC,gBAAgB,MAAM,SAAS,cAAc,KAAK,KAAK,IAAI,EAAE,EAAG,QAAO,QAAQ,iBAAiB,8BAA8B,IAAI;AAC7N,QAAI,SAAS,mBAAmB,CAAC,2DAA2D,KAAK,IAAI,EAAG,QAAO,QAAQ,iBAAiB,2BAA2B,IAAI;AACvK,QAAI,SAAS,eAAe,CAAC,CAAC,aAAa,cAAc,SAAS,SAAS,EAAE,SAAS,IAAI,EAAG,QAAO,QAAQ,iBAAiB,uBAAuB,IAAI;AACxJ,QAAI,SAAS,kBAAkB,CAAC,CAAC,eAAe,SAAS,SAAS,EAAE,SAAS,IAAI,EAAG,QAAO,QAAQ,iBAAiB,0BAA0B,IAAI;AAClJ,QAAI,SAAS,YAAY,CAAC,CAAC,SAAS,SAAS,UAAU,SAAS,EAAE,SAAS,IAAI,EAAG,QAAO,QAAQ,iBAAiB,oBAAoB,IAAI;AAC1I,QAAI,SAAS,mBAAmB,CAAC,CAAC,UAAU,UAAU,SAAS,EAAE,SAAS,IAAI,EAAG,QAAO,QAAQ,iBAAiB,2BAA2B,IAAI;AAChJ,QAAI,SAAS,aAAa,SAAS,eAAe;AAAE,UAAI,SAAS,UAAW,QAAO,QAAQ,SAAS,YAAY,sBAAsB,8BAA8B,yCAAyC,IAAI;AAAA,IAAG,WAC3M,CAAC,YAAY,YAAY,UAAU,EAAE,SAAS,IAAI,MAAM,SAAS,OAAO,CAAC,uBAAuB,IAAI,GAAI,QAAO,QAAQ,eAAe,iCAAiC,IAAI;AAAA,aAC3K,SAAS,cAAc,SAAS,OAAO,CAAC,uBAAuB,IAAI,EAAG,QAAO,QAAQ,eAAe,iCAAiC,IAAI;AAAA,aACzI,CAAC,iBAAiB,aAAa,gBAAgB,UAAU,eAAe,EAAE,SAAS,IAAI,KAAK,CAAC,SAAS,IAAI,EAAG,QAAO,QAAQ,iBAAiB,iCAAiC,IAAI;AAC3L,SAAK,IAAI,YAAY;AAAG,WAAO,OAAO,MAAM,IAAI;AAAG,QAAI,SAAS,YAAa,OAAM,UAAU,oBAAoB;AAAI,QAAI,aAAa,IAAI,EAAG,WAAU,aAAa,IAAI,CAAE,IAAI,CAAC,qBAAqB,eAAe,EAAE,SAAS,IAAI,IAAI,OAAO,IAAI,IAAI;AAAA,EACvP;AAIA,MAAI,MAAM,qBAAqB,QAAQ,MAAM,WAAW,QAAS,QAAO,QAAQ,iBAAiB,wDAAwD,qBAAqB;AAC9K,MAAI,MAAM,kCAAkC,KAAM,QAAO,QAAQ,qBAAqB,yDAAyD,oCAAoC;AACnL,MAAI,OAAO,WAAW,EAAG,QAAO,QAAQ,uBAAuB,0CAA0C;AACzG,MAAI,OAAO,KAAK,CAAC,UAAU,UAAU,OAAO,CAAC,oBAAoB,KAAK,CAAC,EAAG,QAAO,QAAQ,eAAe,6BAA6B;AACrI,MAAI,OAAO,SAAS,GAAG,KAAK,OAAO,SAAS,EAAG,QAAO,QAAQ,uBAAuB,qDAAqD;AAC1I,YAAU,SAAS,OAAO,OAAO,CAAC,GAAG,MAAM,CAAC;AAC5C,QAAM,eAAsC,CAAC;AAAG,QAAM,SAAS;AAAyC,aAAW,SAAS,cAAe,KAAI,OAAO,UAAU,eAAe,KAAK,WAAW,KAAK,EAAG,QAAO,KAAK,IAAI,UAAU,KAAK;AACtO,QAAM,UAAyB;AAAA,IAC7B,MAAM;AAAA,IAAQ,QAAQ;AAAA,IAAM,QAAQ,OAAO,OAAO,CAAC,GAAG,MAAM,CAAC;AAAA,IAAG,QAAQ,MAAM;AAAA,IAAuB,SAAS,oBAAoB;AAAA,IAAI,QAAQ,MAAM;AAAA,IAA0B,iBAAiB,MAAM;AAAA,IAA4B,aAAa,MAAM;AAAA,IACpP,GAAI,OAAO,MAAM,cAAc,WAAW,EAAE,WAAW,MAAM,UAAU,IAAI,CAAC;AAAA,IAAI,GAAI,OAAO,MAAM,WAAW,WAAW,EAAE,QAAQ,MAAM,OAAO,IAAI,CAAC;AAAA,IAAI,GAAI,OAAO,MAAM,eAAe,WAAW,EAAE,YAAY,MAAM,WAAW,IAAI,CAAC;AAAA,IAAI,OAAO,MAAM;AAAA,IAAoB,WAAW,MAAM;AAAA,IAAwB,QAAQ,MAAM;AAAA,IAClU,GAAI,OAAO,MAAM,WAAW,WAAW,EAAE,QAAQ,MAAM,OAAO,IAAI,CAAC;AAAA,IAAI,GAAI,OAAO,MAAM,eAAe,WAAW,EAAE,YAAY,MAAM,WAAW,IAAI,CAAC;AAAA,IAAI,SAAS,MAAM;AAAA,IAAqC,YAAY,MAAM;AAAA,IAA2C,MAAM,MAAM;AAAA,IAA+B,YAAY,MAAM;AAAA,IAA2C,mBAAmB,SAAS,WAAW,qBAAqB,CAAC;AAAA,IAAG,eAAe,SAAS,WAAW,iBAAiB,CAAC;AAAA,IAAG,iBAAiB,SAAS,WAAW,mBAAmB,CAAC;AAAA,IAAG,SAAS,WAAW,WAAW,EAAG,SAAS,IAAI,SAAS,WAAW,WAAW,CAAC,IAAI,OAAO,OAAO,CAAC,WAAW,CAAC;AAAA,IAAG,SAAS,WAAW,WAAW,EAAG,SAAS,IAAI,SAAS,WAAW,WAAW,CAAC,IAAI,OAAO,OAAO,CAAC,WAAW,iBAAiB,CAAC;AAAA,IAAG,+BAA+B,MAAM;AAAA,IAA0C,SAAS,MAAM;AAAA,IAAoB,kBAAkB,MAAM,qBAAqB;AAAA,IAAM,kBAAkB,MAAM;AAAA,IAA6B;AAAA,EACt/B;AACA,SAAO,QAAQ,OAAO;AACxB;AAEA,SAAS,SAAS,QAA0D;AAAE,SAAO,OAAO,OAAO,CAAC,GAAI,UAAU,CAAC,CAAE,CAAC;AAAG;AAClH,SAAS,kBAAkB,MAA8C;AAAE,QAAM,YAAY,gBAAgB,IAAI;AAAG,QAAM,WAAW,KAAK,CAAC,MAAM,UAAa,mBAAmB,KAAK,CAAC,CAAE,MAAM;AAAM,SAAO,aAAa,WAAW,OAAO,EAAE,MAAM,MAAM,QAAQ,iBAAiB,IAAI,EAAE,CAAC,IAAI,OAAO,EAAE,MAAM,MAAM,MAAM,OAAO,OAAO,CAAC,GAAG,IAAI,CAAC,EAAE,CAAC;AAAG;AAC5V,IAAM,cAAoC,OAAO,OAAO,EAAE,UAAU,MAAM,WAAW,MAAM,SAAS,MAAM,aAAa,MAAM,sBAAsB,KAAK,CAAC;AACzJ,IAAM,gBAAgB;AACtB,IAAM,uBAAuB;AAG7B,SAAS,aAAa,MAAc,MAAyC;AAC3E,MAAI,SAAS,IAAK,QAAO,QAAQ,iBAAiB,uEAAuE,IAAI;AAC7H,MAAI,qBAAqB,KAAK,IAAI,EAAG,QAAO,QAAQ,eAAe,iCAAiC,IAAI;AACxG,QAAM,QAAQ,wBAAwB,MAAM,SAAS,QAAQ;AAC7D,MAAI,UAAU,OAAW,QAAO,QAAQ,eAAe,iCAAiC,IAAI;AAC5F,MAAI,SAAS,YAAY,CAAC,yBAAyB,KAAK,EAAG,QAAO,QAAQ,iBAAiB,6CAA6C,IAAI;AAC5I,SAAO;AACT;AAOA,SAAS,SAAS,MAA2C;AAC3D,QAAM,SAAS,KAAK,CAAC;AACrB,MAAI,WAAW,aAAa,WAAW,QAAS,QAAO,QAAQ,mBAAmB,+CAA+C;AACjI,QAAM,WAAmC,CAAC;AAC1C,QAAM,OAAO,oBAAI,IAAY;AAC7B,MAAI,UAAU;AACd,WAAS,QAAQ,GAAG,QAAQ,KAAK,QAAQ,SAAS,GAAG;AACnD,UAAM,QAAQ,KAAK,KAAK;AACxB,QAAI,CAAC,MAAM,WAAW,GAAG,KAAK,UAAU,IAAK,QAAO,QAAQ,uBAAuB,kEAAkE;AACrJ,UAAM,CAAC,MAAM,MAAM,IAAI,YAAY,KAAK;AACxC,QAAI,SAAS,aAAa;AACxB,UAAI,WAAW,OAAW,QAAO,QAAQ,iBAAiB,2CAA2C,IAAI;AACzG,UAAI,WAAW,QAAS,QAAO,QAAQ,uBAAuB,iDAAiD,IAAI;AACnH,UAAI,KAAK,IAAI,IAAI,EAAG,QAAO,QAAQ,oBAAoB,mCAAmC,IAAI;AAC9F,WAAK,IAAI,IAAI;AAAG,gBAAU;AAAM;AAAA,IAClC;AACA,QAAI,YAAY,IAAI,MAAM,KAAM,QAAO,QAAQ,kBAAkB,mBAAmB,IAAI;AACxF,QAAI,KAAK,IAAI,IAAI,EAAG,QAAO,QAAQ,oBAAoB,mCAAmC,IAAI;AAC9F,UAAM,OAAO,UAAU,KAAK,QAAQ,CAAC;AACrC,QAAI,SAAS,UAAa,KAAK,WAAW,KAAM,WAAW,UAAa,KAAK,WAAW,GAAG,KAAK,SAAS,IAAM,QAAO,QAAQ,iBAAiB,4BAA4B,IAAI;AAC/K,QAAI,WAAW,OAAW,UAAS;AACnC,SAAK,IAAI,IAAI;AACb,QAAI,SAAS,SAAS;AACpB,UAAI,CAAC,cAAc,KAAK,IAAI,KAAK,6BAA6B,KAAK,IAAI,EAAG,QAAO,QAAQ,iBAAiB,6BAA6B,IAAI;AAC3I,eAAS,MAAM;AAAM;AAAA,IACvB;AACA,UAAM,OAAO,aAAa,MAAM,IAAI;AACpC,QAAI,OAAO,SAAS,SAAU,QAAO;AACrC,aAAS,SAAS,WAAW,SAAS,SAAS,YAAY,UAAU,SAAS,cAAc,YAAY,iBAAiB,IAAI;AAAA,EAC/H;AACA,MAAI,SAAS,SAAS,OAAW,QAAO,QAAQ,uBAAuB,kCAAkC;AACzG,MAAI,SAAS,UAAU,OAAW,QAAO,QAAQ,uBAAuB,mCAAmC;AAC3G,MAAI,WAAW,WAAW,SAAS,QAAQ,OAAW,QAAO,QAAQ,uBAAuB,sCAAsC;AAClI,MAAI,WAAW,WAAW,CAAC,QAAS,QAAO,QAAQ,uBAAuB,iCAAiC,WAAW;AACtH,SAAO,QAAQ;AAAA,IACb,MAAM;AAAA,IAAO,QAAQ;AAAA,IAAM;AAAA,IAAQ,QAAQ;AAAA,IAAQ,MAAM,SAAS;AAAA,IAAM,OAAO,SAAS;AAAA,IACxF,GAAI,SAAS,QAAQ,SAAY,CAAC,IAAI,EAAE,KAAK,SAAS,IAAI;AAAA,IAC1D,GAAI,SAAS,YAAY,SAAY,CAAC,IAAI,EAAE,SAAS,SAAS,QAAQ;AAAA,IACtE,GAAI,SAAS,oBAAoB,SAAY,CAAC,IAAI,EAAE,iBAAiB,SAAS,gBAAgB;AAAA,IAC9F;AAAA,EACF,CAAC;AACH;AAEA,SAAS,cAAc,MAA8D,MAA2C;AAC9H,MAAI,KAAK,WAAW,KAAK,KAAK,CAAC,MAAM,SAAU,QAAO,QAAQ,EAAE,MAAM,QAAQ,QAAQ,MAAM,SAAS,KAAK,CAAC;AAC3G,MAAI,SAA2B;AAC/B,QAAM,OAAiB,CAAC;AACxB,MAAI,OAAO;AACX,WAAS,QAAQ,GAAG,QAAQ,KAAK,QAAQ,SAAS,GAAG;AACnD,UAAM,QAAQ,KAAK,KAAK;AACxB,QAAI,MAAM,WAAW,GAAG,GAAG;AACzB,YAAM,CAAC,MAAM,MAAM,IAAI,YAAY,KAAK;AACxC,UAAI,SAAS,cAAc,KAAM,QAAO,QAAQ,OAAO,qBAAqB,kBAAkB,OAAO,oCAAoC,mBAAmB,IAAI;AAChK,YAAM,QAAQ,UAAU,KAAK,EAAE,KAAK;AACpC,UAAI,CAAC,MAAO,QAAO,QAAQ,iBAAiB,4BAA4B,IAAI;AAC5E,UAAI,UAAU,UAAU,UAAU,QAAS,QAAO,QAAQ,iBAAiB,sBAAsB,IAAI;AACrG,eAAS;AACT,aAAO;AAAA,IACT,MAAO,MAAK,KAAK,KAAK;AAAA,EACxB;AACA,MAAI,SAAS,WAAW,SAAS,cAAc,SAAS,WAAW;AACjE,QAAI,KAAK,SAAS,EAAG,QAAO,QAAQ,uBAAuB,+CAA+C;AAC1G,WAAO,QAAQ,EAAE,MAAM,QAAQ,MAAM,OAAO,CAAC;AAAA,EAC/C;AACA,MAAI,SAAS,UAAW,QAAO,KAAK,WAAW,KAAK,SAAS,KAAK,CAAC,CAAE,IAAI,QAAQ,EAAE,MAAM,QAAQ,MAAM,QAAQ,QAAQ,KAAK,CAAC,EAAG,CAAC,IAAI,QAAQ,uBAAuB,+BAA+B;AACnM,MAAI,KAAK,WAAW,KAAK,CAAC,uBAAuB,KAAK,CAAC,CAAE,EAAG,QAAO,QAAQ,uBAAuB,0CAA0C;AAC5I,SAAO,QAAQ,EAAE,MAAM,QAAQ,MAAM,QAAQ,MAAM,KAAK,CAAC,EAAG,CAAC;AAC/D;AACA,SAAS,OAAO,OAAgC,MAAc,MAAoB;AAAE,QAAM,SAAiC,EAAE,YAAY,UAAU,aAAa,WAAW,aAAa,UAAU,qBAAqB,eAAe,iBAAiB,eAAe,aAAa,aAAa,YAAY,UAAU,YAAY,cAAc,WAAW,SAAS,eAAe,aAAa,YAAY,UAAU,YAAY,UAAU,iBAAiB,cAAc,aAAa,WAAW,gBAAgB,cAAc,UAAU,QAAQ,iBAAiB,aAAa;AAAG,QAAM,OAAO,IAAI,CAAE,IAAI,CAAC,qBAAqB,iBAAiB,WAAW,EAAE,SAAS,IAAI,IAAI,OAAO,IAAI,IAAI;AAAM;AACrqB,SAAS,YAAY,OAA6C;AAAE,QAAM,KAAK,MAAM,QAAQ,GAAG;AAAG,SAAO,KAAK,IAAI,CAAC,OAAO,MAAS,IAAI,CAAC,MAAM,MAAM,GAAG,EAAE,GAAG,MAAM,MAAM,KAAK,CAAC,CAAC;AAAG;AACnL,SAAS,gBAAgB,OAAe,SAA0B;AAAE,MAAI,CAAC,QAAQ,KAAK,KAAK,EAAG,QAAO;AAAO,QAAM,SAAS,OAAO,KAAK;AAAG,SAAO,OAAO,cAAc,MAAM,KAAK,SAAS,KAAK,UAAU;AAAS;AAClN,SAAS,SAAS,OAAwB;AAAE,SAAO,MAAM,SAAS,KAAK,MAAM,UAAU,QAAQ,CAAC,wBAAwB,KAAK,KAAK,KAAK,CAAC,yCAAyC,KAAK,KAAK;AAAG;AAC9L,SAAS,gBAAgB,MAAkC;AAAE,aAAW,SAAS,MAAM;AAAE,QAAI,UAAU,KAAM;AAAO,QAAI,UAAU,cAAc,MAAM,WAAW,WAAW,EAAG,QAAO;AAAA,EAAM;AAAE,SAAO;AAAO;AAC5M,SAAS,YAAY,MAA0G;AAAE,QAAM,OAAiB,CAAC;AAAG,MAAI,OAAO;AAAO,WAAS,QAAQ,GAAG,QAAQ,KAAK,QAAQ,SAAS,GAAG;AAAE,UAAM,QAAQ,KAAK,KAAK;AAAI,QAAI,UAAU,MAAM;AAAE,WAAK,KAAK,GAAG,KAAK,MAAM,KAAK,CAAC;AAAG;AAAA,IAAO;AAAE,QAAI,UAAU,YAAY;AAAE,UAAI,QAAQ,KAAK,QAAQ,CAAC,MAAM,KAAM,QAAO,EAAE,IAAI,OAAO,QAAQ,QAAQ,OAAO,qBAAqB,iBAAiB,OAAO,oCAAoC,sBAAsB,UAAU,EAAE;AAAG,aAAO;AAAM,eAAS;AAAG;AAAA,IAAU;AAAE,QAAI,MAAM,WAAW,WAAW,GAAG;AAAE,UAAI,QAAQ,MAAM,MAAM,CAAC,MAAM,KAAM,QAAO,EAAE,IAAI,OAAO,QAAQ,QAAQ,OAAO,qBAAqB,iBAAiB,OAAO,oCAAoC,sBAAsB,UAAU,EAAE;AAAG,aAAO;AAAM;AAAA,IAAU;AAAE,SAAK,KAAK,KAAK;AAAA,EAAG;AAAE,SAAO,EAAE,IAAI,MAAM,KAAK;AAAG;AAC53B,SAAS,QAAQ,SAA4C;AAAE,SAAO,OAAO,EAAE,IAAI,MAAe,QAAQ,CAAC;AAAG;AAC9G,SAAS,QAAQ,MAA2B,SAAiB,UAAqC;AAAE,QAAM,OAAO,aAAa,UAAa,oCAAoC,KAAK,QAAQ,IAAI,WAAW;AAAW,SAAO,OAAO,EAAE,IAAI,OAAgB,OAAO,EAAE,MAAM,SAAS,GAAI,SAAS,SAAY,CAAC,IAAI,EAAE,UAAU,KAAK,EAAG,EAAE,CAAC;AAAG;AAC1U,SAAS,OAAU,OAAU,OAAO,oBAAI,QAAgB,GAAM;AAAE,MAAI,SAAS,OAAO,UAAU,UAAU;AAAE,QAAI,KAAK,IAAI,KAAe,EAAG,QAAO;AAAO,SAAK,IAAI,KAAe;AAAG,eAAW,QAAQ,OAAO,oBAAoB,KAAe,EAAG,QAAQ,MAAkC,IAAI,GAAG,IAAI;AAAG,WAAO,OAAO,KAAK;AAAA,EAAG;AAAE,SAAO;AAAO;",
   "names": []
 }

package/dist/v2/cli-runner.d.ts

@@ -1,22 +1 @@
-import type { CliCommandV2 } from './arguments.js';
-/** The scan member only: the internal runner does not dispatch metadata commands. */
-export type PublicScanCommandV2 = Extract<CliCommandV2, {
-    kind: 'scan';
-}>;
-export type PublicRunOptionsV2 = Readonly<{
-    cwd?: string;
-    stdin?: string | Uint8Array | AsyncIterable<Uint8Array | string>;
-    signal?: AbortSignal;
-}>;
-export type PublicRunResultV2 = Readonly<{
-    exitCode: number;
-    stdout: string;
-    stderr: string;
-    document?: unknown;
-}>;
-/**
- * Library entry. The `sfscanner` bin remains the side-effecting CLI; this wrapper forwards only
- * the three consumer options, so an internal read/scan/selection hook is never part of the
- * published surface.
- */
-export declare function runCliV2(command: PublicScanCommandV2, options?: PublicRunOptionsV2): Promise<PublicRunResultV2>;
+export * from "../_types/packages/scanner-cli/src/v2/cli-runner.js";