sfscanner 0.2.0 → 0.2.1

package/dist/v2/privacy-prepare.js

@@ -0,0 +1,232 @@
+// src/v2/privacy-prepare.ts
+var PRIVACY_PREPARE_SCHEMA_V1 = "n8n-workflow-privacy-prepare-v1";
+var PRIVACY_PREPARE_DISCLAIMER_V1 = "Heuristic and rule-bounded privacy preparation. Does NOT guarantee complete secret or PII removal. The raw diff and change excerpts contain the original removed values and are sensitive local review material; never share or upload them.";
+var CREDENTIAL_ID_PLACEHOLDER = "[REDACTED_CREDENTIAL_ID]";
+var CREDENTIAL_NAME_PLACEHOLDER = "[REDACTED_CREDENTIAL_NAME]";
+var HEADER_VALUE_PLACEHOLDER = "[REDACTED_HEADER_VALUE]";
+var INTERNAL_URL_PLACEHOLDER = "https://internal.example.invalid/...";
+var TOKEN_PLACEHOLDER = "[REDACTED_TOKEN]";
+var WEBHOOK_PATH_PLACEHOLDER = "[REDACTED_WEBHOOK_PATH]";
+var WEBHOOK_ID_PLACEHOLDER = "[REDACTED_WEBHOOK_ID]";
+var DEFAULT_INTERNAL_SUFFIXES = Object.freeze([".local", ".internal", ".localdomain", ".lan", ".home.arpa", ".corp", ".intranet"]);
+var WEBHOOK_TYPE = "n8n-nodes-base.webhook";
+var EXCERPT_LIMIT = 80;
+var SENSITIVE_HEADER_NAMES = Object.freeze({
+  authorization: true,
+  "proxy-authorization": true,
+  cookie: true,
+  "set-cookie": true,
+  "x-api-key": true,
+  "x-auth-token": true,
+  "x-access-token": true,
+  "x-secret": true,
+  "x-api-token": true,
+  "api-key": true,
+  apikey: true
+});
+var SECRET_PARAMETER_KEYS = Object.freeze({
+  password: true,
+  passwd: true,
+  apikey: true,
+  api_key: true,
+  token: true,
+  secret: true,
+  clientsecret: true,
+  client_secret: true,
+  privatekey: true,
+  private_key: true,
+  accesstoken: true,
+  access_token: true,
+  refreshtoken: true,
+  refresh_token: true,
+  authorization: true
+});
+var URL_HOST_RE = /^[a-z][a-z0-9+.-]*:\/\/(?:[^/?#@]*@)?(\[[^\]]+\]|[^:/?#]+)/i;
+var EMBEDDED_TOKEN_RULES = Object.freeze([
+  [/([?&](?:access_token|refresh_token|id_token|token|api_key|apikey|key|secret|sig|signature|auth|password|code)=)[^&#\s]+/gi, `$1${TOKEN_PLACEHOLDER}`],
+  [/\bBearer\s+[A-Za-z0-9._~+/=-]+/g, `Bearer ${TOKEN_PLACEHOLDER}`],
+  [/\bBasic\s+[A-Za-z0-9+/=]+/g, `Basic ${TOKEN_PLACEHOLDER}`]
+]);
+var isDict = (value) => typeof value === "object" && value !== null && !Array.isArray(value);
+var defineOwn = (target, key, value) => {
+  Object.defineProperty(target, key, { value, enumerable: true, configurable: true, writable: true });
+};
+var escapePointer = (key) => key.replace(/~/g, "~0").replace(/\//g, "~1");
+var excerpt = (value) => value.length <= EXCERPT_LIMIT ? value : `${value.slice(0, EXCERPT_LIMIT - 3)}...`;
+var cmp = (left, right) => left < right ? -1 : left > right ? 1 : 0;
+function recordChange(changes, path, kind, original, replacement) {
+  if (original !== replacement) changes.push(Object.freeze({ path, kind, originalExcerpt: excerpt(original), replacement }));
+  return replacement;
+}
+function isPrivateIpv4(host) {
+  const parts = host.split(".");
+  if (parts.length !== 4 || parts.some((part) => !/^[0-9]{1,3}$/.test(part))) return false;
+  const octets = parts.map(Number);
+  if (octets.some((octet) => octet > 255)) return false;
+  const first = octets[0] ?? -1;
+  const second = octets[1] ?? -1;
+  return first === 0 || first === 10 || first === 127 || first === 192 && second === 168 || first === 172 && second >= 16 && second <= 31 || first === 169 && second === 254 || first === 100 && second >= 64 && second <= 127;
+}
+var IPV4_MAPPED_RE = /^::ffff:(\d{1,3}(?:\.\d{1,3}){3}|[0-9a-f]{1,4}:[0-9a-f]{1,4})$/i;
+function mappedIpv4(host) {
+  const text = IPV4_MAPPED_RE.exec(host)?.[1];
+  if (text === void 0) return null;
+  if (text.includes(".")) return text;
+  const [high = 0, low = 0] = text.split(":").map((group) => Number.parseInt(group, 16));
+  return [high >> 8, high & 255, low >> 8, low & 255].join(".");
+}
+function isInternalIpv6(host) {
+  const mapped = mappedIpv4(host);
+  if (mapped !== null) return isPrivateIpv4(mapped);
+  if (host === "::" || host === "::1") return true;
+  return /^f[cd][0-9a-f]{2}:/.test(host) || /^fe[89ab][0-9a-f]:/.test(host);
+}
+function isInternalHost(host, suffixes) {
+  const normalized = host.toLowerCase().replace(/^\[|\]$/g, "").replace(/\.+$/, "");
+  if (normalized === "localhost" || normalized === "0.0.0.0") return true;
+  if (normalized.includes(":")) return isInternalIpv6(normalized);
+  if (isPrivateIpv4(normalized)) return true;
+  if (suffixes.some((suffix) => normalized.endsWith(suffix))) return true;
+  return !normalized.includes(".");
+}
+function resolveUrlHost(value) {
+  const match = URL_HOST_RE.exec(value);
+  if (match === null) return "";
+  const fallback = match[1] ?? "";
+  try {
+    return new URL(value).hostname || fallback;
+  } catch {
+    return fallback;
+  }
+}
+function isInternalUrl(value, suffixes) {
+  const host = resolveUrlHost(value);
+  return host.length > 0 && isInternalHost(host, suffixes);
+}
+function sanitizeString(value, path, ctx) {
+  if (value.length === 0) return value;
+  if (isInternalUrl(value, ctx.suffixes)) return recordChange(ctx.changes, path, "INTERNAL_URL", value, ctx.urlPlaceholder);
+  if (!path.includes("/parameters/")) return value;
+  if (SECRET_PARAMETER_KEYS[path.slice(path.lastIndexOf("/") + 1).toLowerCase()] === true) return recordChange(ctx.changes, path, "TOKEN", value, TOKEN_PLACEHOLDER);
+  const scrubbed = EMBEDDED_TOKEN_RULES.reduce((current, [pattern, replacement]) => current.replace(pattern, replacement), value);
+  return scrubbed === value ? value : recordChange(ctx.changes, path, "TOKEN", value, scrubbed);
+}
+function sanitizeValue(value, path, ctx) {
+  if (Array.isArray(value)) return value.map((item, index) => sanitizeValue(item, `${path}/${index}`, ctx));
+  if (isDict(value)) return sanitizeObject(value, path, ctx);
+  return typeof value === "string" ? sanitizeString(value, path, ctx) : value;
+}
+function sanitizeCredentials(input, path, ctx) {
+  const out = {};
+  for (const [credentialType, details] of Object.entries(input)) {
+    const typePath = `${path}/${escapePointer(credentialType)}`;
+    if (!isDict(details)) {
+      defineOwn(out, credentialType, sanitizeValue(details, typePath, ctx));
+      continue;
+    }
+    const cleaned = {};
+    for (const [key, raw] of Object.entries(details)) {
+      const valuePath = `${typePath}/${escapePointer(key)}`;
+      if (key === "id" && (typeof raw === "string" || typeof raw === "number") && String(raw).length > 0) {
+        defineOwn(cleaned, key, recordChange(ctx.changes, valuePath, "CREDENTIAL", String(raw), CREDENTIAL_ID_PLACEHOLDER));
+      } else if (key === "name" && typeof raw === "string" && raw.length > 0) {
+        defineOwn(cleaned, key, recordChange(ctx.changes, valuePath, "CREDENTIAL", raw, CREDENTIAL_NAME_PLACEHOLDER));
+      } else {
+        defineOwn(cleaned, key, sanitizeValue(raw, valuePath, ctx));
+      }
+    }
+    defineOwn(out, credentialType, cleaned);
+  }
+  return out;
+}
+function sanitizeObject(input, path, ctx) {
+  const nodeType = typeof input.type === "string" ? input.type : ctx.nodeType;
+  const scoped = { ...ctx, nodeType };
+  const headerName = typeof input.name === "string" ? input.name.trim().toLowerCase() : null;
+  const isHeaderEntry = headerName !== null && path.includes("/headerParameters/parameters/") && SENSITIVE_HEADER_NAMES[headerName] === true;
+  const out = {};
+  for (const [key, raw] of Object.entries(input)) {
+    const childPath = `${path}/${escapePointer(key)}`;
+    if (key === "credentials" && isDict(raw)) {
+      defineOwn(out, key, sanitizeCredentials(raw, childPath, scoped));
+    } else if (isHeaderEntry && key === "value" && typeof raw === "string" && raw.length > 0) {
+      defineOwn(out, key, recordChange(scoped.changes, childPath, "HEADER", raw, HEADER_VALUE_PLACEHOLDER));
+    } else if (key === "webhookId" && typeof raw === "string" && raw.length > 0) {
+      defineOwn(out, key, recordChange(scoped.changes, childPath, "TOKEN", raw, WEBHOOK_ID_PLACEHOLDER));
+    } else if (key === "path" && nodeType === WEBHOOK_TYPE && typeof raw === "string" && raw.length > 0) {
+      defineOwn(out, key, recordChange(scoped.changes, childPath, "TOKEN", raw, WEBHOOK_PATH_PLACEHOLDER));
+    } else {
+      defineOwn(out, key, sanitizeValue(raw, childPath, scoped));
+    }
+  }
+  return out;
+}
+function buildDiff(before, after) {
+  const beforeLines = JSON.stringify(before, null, 2).split("\n");
+  const afterLines = JSON.stringify(after, null, 2).split("\n");
+  const total = Math.max(beforeLines.length, afterLines.length);
+  const hunks = [];
+  let index = 0;
+  while (index < total) {
+    if (beforeLines[index] === afterLines[index]) {
+      index += 1;
+      continue;
+    }
+    const start = index;
+    const removed = [];
+    const added = [];
+    while (index < total && beforeLines[index] !== afterLines[index]) {
+      const beforeLine = beforeLines[index];
+      const afterLine = afterLines[index];
+      if (beforeLine !== void 0) removed.push(beforeLine);
+      if (afterLine !== void 0) added.push(afterLine);
+      index += 1;
+    }
+    hunks.push(`@@ -${start + 1},${removed.length} +${start + 1},${added.length} @@`, ...removed.map((line) => `-${line}`), ...added.map((line) => `+${line}`));
+  }
+  return hunks.length === 0 ? "" : ["--- workflow.before.json", "+++ workflow.after.json", ...hunks].join("\n");
+}
+function readOptions(options) {
+  if (!isDict(options)) throw new TypeError("options must be an object");
+  const unknownKey = Object.keys(options).find((key) => key !== "internalUrlPlaceholder" && key !== "internalHostSuffixes");
+  if (unknownKey !== void 0) throw new TypeError(`unknown option: ${unknownKey}`);
+  const placeholder = options.internalUrlPlaceholder;
+  if (placeholder !== void 0 && (typeof placeholder !== "string" || placeholder.trim().length === 0)) throw new TypeError("internalUrlPlaceholder must be a non-empty string");
+  const suffixes = options.internalHostSuffixes ?? [];
+  if (!Array.isArray(suffixes)) throw new TypeError("internalHostSuffixes must be an array");
+  const extraSuffixes = suffixes.map((suffix) => {
+    const text = typeof suffix === "string" ? suffix.trim().toLowerCase() : "";
+    if (!text.startsWith(".") || text.length < 2) throw new TypeError("internalHostSuffixes entries must be dotted strings");
+    return text;
+  });
+  return { urlPlaceholder: typeof placeholder === "string" ? placeholder : INTERNAL_URL_PLACEHOLDER, extraSuffixes: [...new Set(extraSuffixes)] };
+}
+function prepareWorkflowPrivacy(workflow, options = {}) {
+  if (!isDict(workflow)) throw new TypeError("workflow must be an object");
+  const { urlPlaceholder, extraSuffixes } = readOptions(options);
+  const changes = [];
+  const ctx = { changes, suffixes: [...DEFAULT_INTERNAL_SUFFIXES, ...extraSuffixes], urlPlaceholder, nodeType: null };
+  const prepared = sanitizeObject(workflow, "", ctx);
+  const ordered = changes.sort((left, right) => cmp(left.path, right.path));
+  return Object.freeze({
+    schemaVersion: PRIVACY_PREPARE_SCHEMA_V1,
+    workflow: prepared,
+    changed: ordered.length > 0,
+    changes: Object.freeze(ordered),
+    diff: buildDiff(workflow, prepared),
+    completeRedactionGuaranteed: false,
+    disclaimer: PRIVACY_PREPARE_DISCLAIMER_V1
+  });
+}
+export {
+  CREDENTIAL_ID_PLACEHOLDER,
+  CREDENTIAL_NAME_PLACEHOLDER,
+  HEADER_VALUE_PLACEHOLDER,
+  INTERNAL_URL_PLACEHOLDER,
+  PRIVACY_PREPARE_DISCLAIMER_V1,
+  PRIVACY_PREPARE_SCHEMA_V1,
+  TOKEN_PLACEHOLDER,
+  WEBHOOK_ID_PLACEHOLDER,
+  WEBHOOK_PATH_PLACEHOLDER,
+  prepareWorkflowPrivacy
+};

package/dist/v2/privacy-prepare.js.map

@@ -0,0 +1,7 @@
+{
+  "version": 3,
+  "sources": ["../../src/v2/privacy-prepare.ts"],
+  "sourcesContent": ["/**\n * Opt-in workflow privacy preparation (PD-03): replaces credential references, sensitive\n * authorization headers, internal endpoints, webhook paths and embedded tokens with safe\n * placeholders before an export leaves the operator's machine. The result is a fresh copy plus an\n * exact change list and a reviewable diff; structure is preserved and the input is never mutated.\n * Redaction is heuristic and rule-bounded, so it never guarantees complete secret or PII removal.\n * Pure, deterministic and free of host APIs so the browser worker and CLI share one contract.\n */\nexport const PRIVACY_PREPARE_SCHEMA_V1 = 'n8n-workflow-privacy-prepare-v1' as const;\nexport const PRIVACY_PREPARE_DISCLAIMER_V1 = 'Heuristic and rule-bounded privacy preparation. Does NOT guarantee complete secret or PII removal. The raw diff and change excerpts contain the original removed values and are sensitive local review material; never share or upload them.' as const;\n\nexport const CREDENTIAL_ID_PLACEHOLDER = '[REDACTED_CREDENTIAL_ID]' as const;\nexport const CREDENTIAL_NAME_PLACEHOLDER = '[REDACTED_CREDENTIAL_NAME]' as const;\nexport const HEADER_VALUE_PLACEHOLDER = '[REDACTED_HEADER_VALUE]' as const;\nexport const INTERNAL_URL_PLACEHOLDER = 'https://internal.example.invalid/...' as const;\nexport const TOKEN_PLACEHOLDER = '[REDACTED_TOKEN]' as const;\nexport const WEBHOOK_PATH_PLACEHOLDER = '[REDACTED_WEBHOOK_PATH]' as const;\nexport const WEBHOOK_ID_PLACEHOLDER = '[REDACTED_WEBHOOK_ID]' as const;\n\nexport type PrivacyChangeKind = 'CREDENTIAL' | 'HEADER' | 'INTERNAL_URL' | 'TOKEN';\nexport type PrivacyChange = Readonly<{ path: string; kind: PrivacyChangeKind; originalExcerpt: string; replacement: string }>;\nexport type PrivacyPrepareOptions = Readonly<{ internalUrlPlaceholder?: string; internalHostSuffixes?: readonly string[] }>;\nexport type PrivacyPrepareResult = Readonly<{\n  schemaVersion: typeof PRIVACY_PREPARE_SCHEMA_V1;\n  workflow: Readonly<Record<string, unknown>>;\n  changed: boolean;\n  changes: readonly PrivacyChange[];\n  diff: string;\n  completeRedactionGuaranteed: false;\n  disclaimer: typeof PRIVACY_PREPARE_DISCLAIMER_V1;\n}>;\n\ntype Dict = Readonly<Record<string, unknown>>;\ntype WalkContext = Readonly<{ changes: PrivacyChange[]; suffixes: readonly string[]; urlPlaceholder: string; nodeType: string | null }>;\n\nconst DEFAULT_INTERNAL_SUFFIXES: readonly string[] = Object.freeze(['.local', '.internal', '.localdomain', '.lan', '.home.arpa', '.corp', '.intranet']);\nconst WEBHOOK_TYPE = 'n8n-nodes-base.webhook';\nconst EXCERPT_LIMIT = 80;\nconst SENSITIVE_HEADER_NAMES: Readonly<Record<string, true>> = Object.freeze({\n  authorization: true, 'proxy-authorization': true, cookie: true, 'set-cookie': true, 'x-api-key': true,\n  'x-auth-token': true, 'x-access-token': true, 'x-secret': true, 'x-api-token': true, 'api-key': true, apikey: true,\n});\nconst SECRET_PARAMETER_KEYS: Readonly<Record<string, true>> = Object.freeze({\n  password: true, passwd: true, apikey: true, api_key: true, token: true, secret: true, clientsecret: true, client_secret: true,\n  privatekey: true, private_key: true, accesstoken: true, access_token: true, refreshtoken: true, refresh_token: true, authorization: true,\n});\nconst URL_HOST_RE = /^[a-z][a-z0-9+.-]*:\\/\\/(?:[^/?#@]*@)?(\\[[^\\]]+\\]|[^:/?#]+)/i;\nconst EMBEDDED_TOKEN_RULES: readonly (readonly [RegExp, string])[] = Object.freeze([\n  [/([?&](?:access_token|refresh_token|id_token|token|api_key|apikey|key|secret|sig|signature|auth|password|code)=)[^&#\\s]+/gi, `$1${TOKEN_PLACEHOLDER}`],\n  [/\\bBearer\\s+[A-Za-z0-9._~+/=-]+/g, `Bearer ${TOKEN_PLACEHOLDER}`],\n  [/\\bBasic\\s+[A-Za-z0-9+/=]+/g, `Basic ${TOKEN_PLACEHOLDER}`],\n] as const);\n\nconst isDict = (value: unknown): value is Dict => typeof value === 'object' && value !== null && !Array.isArray(value);\n/** Writes an own enumerable property so keys such as `__proto__` stay data instead of mutating the prototype. */\nconst defineOwn = (target: Record<string, unknown>, key: string, value: unknown): void => {\n  Object.defineProperty(target, key, { value, enumerable: true, configurable: true, writable: true });\n};\nconst escapePointer = (key: string): string => key.replace(/~/g, '~0').replace(/\\//g, '~1');\nconst excerpt = (value: string): string => (value.length <= EXCERPT_LIMIT ? value : `${value.slice(0, EXCERPT_LIMIT - 3)}...`);\nconst cmp = (left: string, right: string): number => (left < right ? -1 : left > right ? 1 : 0);\n\n/** Records a replacement unless the value is already the placeholder, which keeps reruns idempotent. */\nfunction recordChange(changes: PrivacyChange[], path: string, kind: PrivacyChangeKind, original: string, replacement: string): string {\n  if (original !== replacement) changes.push(Object.freeze({ path, kind, originalExcerpt: excerpt(original), replacement }));\n  return replacement;\n}\n\nfunction isPrivateIpv4(host: string): boolean {\n  const parts = host.split('.');\n  if (parts.length !== 4 || parts.some((part) => !/^[0-9]{1,3}$/.test(part))) return false;\n  const octets = parts.map(Number);\n  if (octets.some((octet) => octet > 255)) return false;\n  const first = octets[0] ?? -1;\n  const second = octets[1] ?? -1;\n  return first === 0 || first === 10 || first === 127 || (first === 192 && second === 168) ||\n    (first === 172 && second >= 16 && second <= 31) || (first === 169 && second === 254) ||\n    (first === 100 && second >= 64 && second <= 127);\n}\n\nconst IPV4_MAPPED_RE = /^::ffff:(\\d{1,3}(?:\\.\\d{1,3}){3}|[0-9a-f]{1,4}:[0-9a-f]{1,4})$/i;\n\n/** Reads the IPv4 address behind an `::ffff:` prefix, accepting dotted and hex-pair spellings. */\nfunction mappedIpv4(host: string): string | null {\n  const text = IPV4_MAPPED_RE.exec(host)?.[1];\n  if (text === undefined) return null;\n  if (text.includes('.')) return text;\n  const [high = 0, low = 0] = text.split(':').map((group) => Number.parseInt(group, 16));\n  return [high >> 8, high & 0xff, low >> 8, low & 0xff].join('.');\n}\n\nfunction isInternalIpv6(host: string): boolean {\n  const mapped = mappedIpv4(host);\n  if (mapped !== null) return isPrivateIpv4(mapped);\n  if (host === '::' || host === '::1') return true;\n  // Unique-local fc00::/7 and link-local fe80::/10 ranges never route off the local network.\n  return /^f[cd][0-9a-f]{2}:/.test(host) || /^fe[89ab][0-9a-f]:/.test(host);\n}\n\nfunction isInternalHost(host: string, suffixes: readonly string[]): boolean {\n  const normalized = host.toLowerCase().replace(/^\\[|\\]$/g, '').replace(/\\.+$/, '');\n  if (normalized === 'localhost' || normalized === '0.0.0.0') return true;\n  if (normalized.includes(':')) return isInternalIpv6(normalized);\n  if (isPrivateIpv4(normalized)) return true;\n  if (suffixes.some((suffix) => normalized.endsWith(suffix))) return true;\n  return !normalized.includes('.');\n}\n\n/** Resolves a URL host through the WHATWG parser, which canonicalizes octal, dword and hex IPv4 spellings. */\nfunction resolveUrlHost(value: string): string {\n  const match = URL_HOST_RE.exec(value);\n  if (match === null) return '';\n  const fallback = match[1] ?? '';\n  try {\n    return new URL(value).hostname || fallback;\n  } catch {\n    return fallback;\n  }\n}\n\nfunction isInternalUrl(value: string, suffixes: readonly string[]): boolean {\n  const host = resolveUrlHost(value);\n  return host.length > 0 && isInternalHost(host, suffixes);\n}\n\nfunction sanitizeString(value: string, path: string, ctx: WalkContext): string {\n  if (value.length === 0) return value;\n  if (isInternalUrl(value, ctx.suffixes)) return recordChange(ctx.changes, path, 'INTERNAL_URL', value, ctx.urlPlaceholder);\n  if (!path.includes('/parameters/')) return value;\n  if (SECRET_PARAMETER_KEYS[path.slice(path.lastIndexOf('/') + 1).toLowerCase()] === true) return recordChange(ctx.changes, path, 'TOKEN', value, TOKEN_PLACEHOLDER);\n  const scrubbed = EMBEDDED_TOKEN_RULES.reduce((current, [pattern, replacement]) => current.replace(pattern, replacement), value);\n  return scrubbed === value ? value : recordChange(ctx.changes, path, 'TOKEN', value, scrubbed);\n}\n\nfunction sanitizeValue(value: unknown, path: string, ctx: WalkContext): unknown {\n  if (Array.isArray(value)) return value.map((item, index) => sanitizeValue(item, `${path}/${index}`, ctx));\n  if (isDict(value)) return sanitizeObject(value, path, ctx);\n  return typeof value === 'string' ? sanitizeString(value, path, ctx) : value;\n}\n\nfunction sanitizeCredentials(input: Dict, path: string, ctx: WalkContext): Dict {\n  const out: Record<string, unknown> = {};\n  for (const [credentialType, details] of Object.entries(input)) {\n    const typePath = `${path}/${escapePointer(credentialType)}`;\n    if (!isDict(details)) {\n      defineOwn(out, credentialType, sanitizeValue(details, typePath, ctx));\n      continue;\n    }\n    const cleaned: Record<string, unknown> = {};\n    for (const [key, raw] of Object.entries(details)) {\n      const valuePath = `${typePath}/${escapePointer(key)}`;\n      if (key === 'id' && (typeof raw === 'string' || typeof raw === 'number') && String(raw).length > 0) {\n        defineOwn(cleaned, key, recordChange(ctx.changes, valuePath, 'CREDENTIAL', String(raw), CREDENTIAL_ID_PLACEHOLDER));\n      } else if (key === 'name' && typeof raw === 'string' && raw.length > 0) {\n        defineOwn(cleaned, key, recordChange(ctx.changes, valuePath, 'CREDENTIAL', raw, CREDENTIAL_NAME_PLACEHOLDER));\n      } else {\n        defineOwn(cleaned, key, sanitizeValue(raw, valuePath, ctx));\n      }\n    }\n    defineOwn(out, credentialType, cleaned);\n  }\n  return out;\n}\n\nfunction sanitizeObject(input: Dict, path: string, ctx: WalkContext): Dict {\n  const nodeType = typeof input.type === 'string' ? input.type : ctx.nodeType;\n  const scoped: WalkContext = { ...ctx, nodeType };\n  const headerName = typeof input.name === 'string' ? input.name.trim().toLowerCase() : null;\n  const isHeaderEntry = headerName !== null && path.includes('/headerParameters/parameters/') && SENSITIVE_HEADER_NAMES[headerName] === true;\n  const out: Record<string, unknown> = {};\n  for (const [key, raw] of Object.entries(input)) {\n    const childPath = `${path}/${escapePointer(key)}`;\n    if (key === 'credentials' && isDict(raw)) {\n      defineOwn(out, key, sanitizeCredentials(raw, childPath, scoped));\n    } else if (isHeaderEntry && key === 'value' && typeof raw === 'string' && raw.length > 0) {\n      defineOwn(out, key, recordChange(scoped.changes, childPath, 'HEADER', raw, HEADER_VALUE_PLACEHOLDER));\n    } else if (key === 'webhookId' && typeof raw === 'string' && raw.length > 0) {\n      defineOwn(out, key, recordChange(scoped.changes, childPath, 'TOKEN', raw, WEBHOOK_ID_PLACEHOLDER));\n    } else if (key === 'path' && nodeType === WEBHOOK_TYPE && typeof raw === 'string' && raw.length > 0) {\n      defineOwn(out, key, recordChange(scoped.changes, childPath, 'TOKEN', raw, WEBHOOK_PATH_PLACEHOLDER));\n    } else {\n      defineOwn(out, key, sanitizeValue(raw, childPath, scoped));\n    }\n  }\n  return out;\n}\n\n/** Every replacement keeps one JSON line per value, so changed lines diff one-to-one without an LCS pass. */\nfunction buildDiff(before: unknown, after: unknown): string {\n  const beforeLines = JSON.stringify(before, null, 2).split('\\n');\n  const afterLines = JSON.stringify(after, null, 2).split('\\n');\n  const total = Math.max(beforeLines.length, afterLines.length);\n  const hunks: string[] = [];\n  let index = 0;\n  while (index < total) {\n    if (beforeLines[index] === afterLines[index]) { index += 1; continue; }\n    const start = index;\n    const removed: string[] = [];\n    const added: string[] = [];\n    while (index < total && beforeLines[index] !== afterLines[index]) {\n      const beforeLine = beforeLines[index];\n      const afterLine = afterLines[index];\n      if (beforeLine !== undefined) removed.push(beforeLine);\n      if (afterLine !== undefined) added.push(afterLine);\n      index += 1;\n    }\n    hunks.push(`@@ -${start + 1},${removed.length} +${start + 1},${added.length} @@`, ...removed.map((line) => `-${line}`), ...added.map((line) => `+${line}`));\n  }\n  return hunks.length === 0 ? '' : ['--- workflow.before.json', '+++ workflow.after.json', ...hunks].join('\\n');\n}\n\n/** Validates caller options, which may arrive as untyped JSON, before any redaction runs. */\nfunction readOptions(options: unknown): Readonly<{ urlPlaceholder: string; extraSuffixes: readonly string[] }> {\n  if (!isDict(options)) throw new TypeError('options must be an object');\n  const unknownKey = Object.keys(options).find((key) => key !== 'internalUrlPlaceholder' && key !== 'internalHostSuffixes');\n  if (unknownKey !== undefined) throw new TypeError(`unknown option: ${unknownKey}`);\n  const placeholder = options.internalUrlPlaceholder;\n  if (placeholder !== undefined && (typeof placeholder !== 'string' || placeholder.trim().length === 0)) throw new TypeError('internalUrlPlaceholder must be a non-empty string');\n  const suffixes = options.internalHostSuffixes ?? [];\n  if (!Array.isArray(suffixes)) throw new TypeError('internalHostSuffixes must be an array');\n  // A bare top-level label such as `com` would redact every public host, so a leading dot is required.\n  const extraSuffixes = suffixes.map((suffix: unknown) => {\n    const text = typeof suffix === 'string' ? suffix.trim().toLowerCase() : '';\n    if (!text.startsWith('.') || text.length < 2) throw new TypeError('internalHostSuffixes entries must be dotted strings');\n    return text;\n  });\n  return { urlPlaceholder: typeof placeholder === 'string' ? placeholder : INTERNAL_URL_PLACEHOLDER, extraSuffixes: [...new Set(extraSuffixes)] };\n}\n\n/** Returns a scrubbed deep copy plus the change list and diff; the input workflow is never mutated. */\nexport function prepareWorkflowPrivacy(workflow: unknown, options: PrivacyPrepareOptions = {}): PrivacyPrepareResult {\n  if (!isDict(workflow)) throw new TypeError('workflow must be an object');\n  const { urlPlaceholder, extraSuffixes } = readOptions(options);\n  const changes: PrivacyChange[] = [];\n  const ctx: WalkContext = { changes, suffixes: [...DEFAULT_INTERNAL_SUFFIXES, ...extraSuffixes], urlPlaceholder, nodeType: null };\n  const prepared = sanitizeObject(workflow, '', ctx);\n  const ordered = changes.sort((left, right) => cmp(left.path, right.path));\n  return Object.freeze({\n    schemaVersion: PRIVACY_PREPARE_SCHEMA_V1,\n    workflow: prepared,\n    changed: ordered.length > 0,\n    changes: Object.freeze(ordered),\n    diff: buildDiff(workflow, prepared),\n    completeRedactionGuaranteed: false as const,\n    disclaimer: PRIVACY_PREPARE_DISCLAIMER_V1,\n  });\n}\n"],
+  "mappings": ";AAQO,IAAM,4BAA4B;AAClC,IAAM,gCAAgC;AAEtC,IAAM,4BAA4B;AAClC,IAAM,8BAA8B;AACpC,IAAM,2BAA2B;AACjC,IAAM,2BAA2B;AACjC,IAAM,oBAAoB;AAC1B,IAAM,2BAA2B;AACjC,IAAM,yBAAyB;AAkBtC,IAAM,4BAA+C,OAAO,OAAO,CAAC,UAAU,aAAa,gBAAgB,QAAQ,cAAc,SAAS,WAAW,CAAC;AACtJ,IAAM,eAAe;AACrB,IAAM,gBAAgB;AACtB,IAAM,yBAAyD,OAAO,OAAO;AAAA,EAC3E,eAAe;AAAA,EAAM,uBAAuB;AAAA,EAAM,QAAQ;AAAA,EAAM,cAAc;AAAA,EAAM,aAAa;AAAA,EACjG,gBAAgB;AAAA,EAAM,kBAAkB;AAAA,EAAM,YAAY;AAAA,EAAM,eAAe;AAAA,EAAM,WAAW;AAAA,EAAM,QAAQ;AAChH,CAAC;AACD,IAAM,wBAAwD,OAAO,OAAO;AAAA,EAC1E,UAAU;AAAA,EAAM,QAAQ;AAAA,EAAM,QAAQ;AAAA,EAAM,SAAS;AAAA,EAAM,OAAO;AAAA,EAAM,QAAQ;AAAA,EAAM,cAAc;AAAA,EAAM,eAAe;AAAA,EACzH,YAAY;AAAA,EAAM,aAAa;AAAA,EAAM,aAAa;AAAA,EAAM,cAAc;AAAA,EAAM,cAAc;AAAA,EAAM,eAAe;AAAA,EAAM,eAAe;AACtI,CAAC;AACD,IAAM,cAAc;AACpB,IAAM,uBAA+D,OAAO,OAAO;AAAA,EACjF,CAAC,6HAA6H,KAAK,iBAAiB,EAAE;AAAA,EACtJ,CAAC,mCAAmC,UAAU,iBAAiB,EAAE;AAAA,EACjE,CAAC,8BAA8B,SAAS,iBAAiB,EAAE;AAC7D,CAAU;AAEV,IAAM,SAAS,CAAC,UAAkC,OAAO,UAAU,YAAY,UAAU,QAAQ,CAAC,MAAM,QAAQ,KAAK;AAErH,IAAM,YAAY,CAAC,QAAiC,KAAa,UAAyB;AACxF,SAAO,eAAe,QAAQ,KAAK,EAAE,OAAO,YAAY,MAAM,cAAc,MAAM,UAAU,KAAK,CAAC;AACpG;AACA,IAAM,gBAAgB,CAAC,QAAwB,IAAI,QAAQ,MAAM,IAAI,EAAE,QAAQ,OAAO,IAAI;AAC1F,IAAM,UAAU,CAAC,UAA2B,MAAM,UAAU,gBAAgB,QAAQ,GAAG,MAAM,MAAM,GAAG,gBAAgB,CAAC,CAAC;AACxH,IAAM,MAAM,CAAC,MAAc,UAA2B,OAAO,QAAQ,KAAK,OAAO,QAAQ,IAAI;AAG7F,SAAS,aAAa,SAA0B,MAAc,MAAyB,UAAkB,aAA6B;AACpI,MAAI,aAAa,YAAa,SAAQ,KAAK,OAAO,OAAO,EAAE,MAAM,MAAM,iBAAiB,QAAQ,QAAQ,GAAG,YAAY,CAAC,CAAC;AACzH,SAAO;AACT;AAEA,SAAS,cAAc,MAAuB;AAC5C,QAAM,QAAQ,KAAK,MAAM,GAAG;AAC5B,MAAI,MAAM,WAAW,KAAK,MAAM,KAAK,CAAC,SAAS,CAAC,eAAe,KAAK,IAAI,CAAC,EAAG,QAAO;AACnF,QAAM,SAAS,MAAM,IAAI,MAAM;AAC/B,MAAI,OAAO,KAAK,CAAC,UAAU,QAAQ,GAAG,EAAG,QAAO;AAChD,QAAM,QAAQ,OAAO,CAAC,KAAK;AAC3B,QAAM,SAAS,OAAO,CAAC,KAAK;AAC5B,SAAO,UAAU,KAAK,UAAU,MAAM,UAAU,OAAQ,UAAU,OAAO,WAAW,OACjF,UAAU,OAAO,UAAU,MAAM,UAAU,MAAQ,UAAU,OAAO,WAAW,OAC/E,UAAU,OAAO,UAAU,MAAM,UAAU;AAChD;AAEA,IAAM,iBAAiB;AAGvB,SAAS,WAAW,MAA6B;AAC/C,QAAM,OAAO,eAAe,KAAK,IAAI,IAAI,CAAC;AAC1C,MAAI,SAAS,OAAW,QAAO;AAC/B,MAAI,KAAK,SAAS,GAAG,EAAG,QAAO;AAC/B,QAAM,CAAC,OAAO,GAAG,MAAM,CAAC,IAAI,KAAK,MAAM,GAAG,EAAE,IAAI,CAAC,UAAU,OAAO,SAAS,OAAO,EAAE,CAAC;AACrF,SAAO,CAAC,QAAQ,GAAG,OAAO,KAAM,OAAO,GAAG,MAAM,GAAI,EAAE,KAAK,GAAG;AAChE;AAEA,SAAS,eAAe,MAAuB;AAC7C,QAAM,SAAS,WAAW,IAAI;AAC9B,MAAI,WAAW,KAAM,QAAO,cAAc,MAAM;AAChD,MAAI,SAAS,QAAQ,SAAS,MAAO,QAAO;AAE5C,SAAO,qBAAqB,KAAK,IAAI,KAAK,qBAAqB,KAAK,IAAI;AAC1E;AAEA,SAAS,eAAe,MAAc,UAAsC;AAC1E,QAAM,aAAa,KAAK,YAAY,EAAE,QAAQ,YAAY,EAAE,EAAE,QAAQ,QAAQ,EAAE;AAChF,MAAI,eAAe,eAAe,eAAe,UAAW,QAAO;AACnE,MAAI,WAAW,SAAS,GAAG,EAAG,QAAO,eAAe,UAAU;AAC9D,MAAI,cAAc,UAAU,EAAG,QAAO;AACtC,MAAI,SAAS,KAAK,CAAC,WAAW,WAAW,SAAS,MAAM,CAAC,EAAG,QAAO;AACnE,SAAO,CAAC,WAAW,SAAS,GAAG;AACjC;AAGA,SAAS,eAAe,OAAuB;AAC7C,QAAM,QAAQ,YAAY,KAAK,KAAK;AACpC,MAAI,UAAU,KAAM,QAAO;AAC3B,QAAM,WAAW,MAAM,CAAC,KAAK;AAC7B,MAAI;AACF,WAAO,IAAI,IAAI,KAAK,EAAE,YAAY;AAAA,EACpC,QAAQ;AACN,WAAO;AAAA,EACT;AACF;AAEA,SAAS,cAAc,OAAe,UAAsC;AAC1E,QAAM,OAAO,eAAe,KAAK;AACjC,SAAO,KAAK,SAAS,KAAK,eAAe,MAAM,QAAQ;AACzD;AAEA,SAAS,eAAe,OAAe,MAAc,KAA0B;AAC7E,MAAI,MAAM,WAAW,EAAG,QAAO;AAC/B,MAAI,cAAc,OAAO,IAAI,QAAQ,EAAG,QAAO,aAAa,IAAI,SAAS,MAAM,gBAAgB,OAAO,IAAI,cAAc;AACxH,MAAI,CAAC,KAAK,SAAS,cAAc,EAAG,QAAO;AAC3C,MAAI,sBAAsB,KAAK,MAAM,KAAK,YAAY,GAAG,IAAI,CAAC,EAAE,YAAY,CAAC,MAAM,KAAM,QAAO,aAAa,IAAI,SAAS,MAAM,SAAS,OAAO,iBAAiB;AACjK,QAAM,WAAW,qBAAqB,OAAO,CAAC,SAAS,CAAC,SAAS,WAAW,MAAM,QAAQ,QAAQ,SAAS,WAAW,GAAG,KAAK;AAC9H,SAAO,aAAa,QAAQ,QAAQ,aAAa,IAAI,SAAS,MAAM,SAAS,OAAO,QAAQ;AAC9F;AAEA,SAAS,cAAc,OAAgB,MAAc,KAA2B;AAC9E,MAAI,MAAM,QAAQ,KAAK,EAAG,QAAO,MAAM,IAAI,CAAC,MAAM,UAAU,cAAc,MAAM,GAAG,IAAI,IAAI,KAAK,IAAI,GAAG,CAAC;AACxG,MAAI,OAAO,KAAK,EAAG,QAAO,eAAe,OAAO,MAAM,GAAG;AACzD,SAAO,OAAO,UAAU,WAAW,eAAe,OAAO,MAAM,GAAG,IAAI;AACxE;AAEA,SAAS,oBAAoB,OAAa,MAAc,KAAwB;AAC9E,QAAM,MAA+B,CAAC;AACtC,aAAW,CAAC,gBAAgB,OAAO,KAAK,OAAO,QAAQ,KAAK,GAAG;AAC7D,UAAM,WAAW,GAAG,IAAI,IAAI,cAAc,cAAc,CAAC;AACzD,QAAI,CAAC,OAAO,OAAO,GAAG;AACpB,gBAAU,KAAK,gBAAgB,cAAc,SAAS,UAAU,GAAG,CAAC;AACpE;AAAA,IACF;AACA,UAAM,UAAmC,CAAC;AAC1C,eAAW,CAAC,KAAK,GAAG,KAAK,OAAO,QAAQ,OAAO,GAAG;AAChD,YAAM,YAAY,GAAG,QAAQ,IAAI,cAAc,GAAG,CAAC;AACnD,UAAI,QAAQ,SAAS,OAAO,QAAQ,YAAY,OAAO,QAAQ,aAAa,OAAO,GAAG,EAAE,SAAS,GAAG;AAClG,kBAAU,SAAS,KAAK,aAAa,IAAI,SAAS,WAAW,cAAc,OAAO,GAAG,GAAG,yBAAyB,CAAC;AAAA,MACpH,WAAW,QAAQ,UAAU,OAAO,QAAQ,YAAY,IAAI,SAAS,GAAG;AACtE,kBAAU,SAAS,KAAK,aAAa,IAAI,SAAS,WAAW,cAAc,KAAK,2BAA2B,CAAC;AAAA,MAC9G,OAAO;AACL,kBAAU,SAAS,KAAK,cAAc,KAAK,WAAW,GAAG,CAAC;AAAA,MAC5D;AAAA,IACF;AACA,cAAU,KAAK,gBAAgB,OAAO;AAAA,EACxC;AACA,SAAO;AACT;AAEA,SAAS,eAAe,OAAa,MAAc,KAAwB;AACzE,QAAM,WAAW,OAAO,MAAM,SAAS,WAAW,MAAM,OAAO,IAAI;AACnE,QAAM,SAAsB,EAAE,GAAG,KAAK,SAAS;AAC/C,QAAM,aAAa,OAAO,MAAM,SAAS,WAAW,MAAM,KAAK,KAAK,EAAE,YAAY,IAAI;AACtF,QAAM,gBAAgB,eAAe,QAAQ,KAAK,SAAS,+BAA+B,KAAK,uBAAuB,UAAU,MAAM;AACtI,QAAM,MAA+B,CAAC;AACtC,aAAW,CAAC,KAAK,GAAG,KAAK,OAAO,QAAQ,KAAK,GAAG;AAC9C,UAAM,YAAY,GAAG,IAAI,IAAI,cAAc,GAAG,CAAC;AAC/C,QAAI,QAAQ,iBAAiB,OAAO,GAAG,GAAG;AACxC,gBAAU,KAAK,KAAK,oBAAoB,KAAK,WAAW,MAAM,CAAC;AAAA,IACjE,WAAW,iBAAiB,QAAQ,WAAW,OAAO,QAAQ,YAAY,IAAI,SAAS,GAAG;AACxF,gBAAU,KAAK,KAAK,aAAa,OAAO,SAAS,WAAW,UAAU,KAAK,wBAAwB,CAAC;AAAA,IACtG,WAAW,QAAQ,eAAe,OAAO,QAAQ,YAAY,IAAI,SAAS,GAAG;AAC3E,gBAAU,KAAK,KAAK,aAAa,OAAO,SAAS,WAAW,SAAS,KAAK,sBAAsB,CAAC;AAAA,IACnG,WAAW,QAAQ,UAAU,aAAa,gBAAgB,OAAO,QAAQ,YAAY,IAAI,SAAS,GAAG;AACnG,gBAAU,KAAK,KAAK,aAAa,OAAO,SAAS,WAAW,SAAS,KAAK,wBAAwB,CAAC;AAAA,IACrG,OAAO;AACL,gBAAU,KAAK,KAAK,cAAc,KAAK,WAAW,MAAM,CAAC;AAAA,IAC3D;AAAA,EACF;AACA,SAAO;AACT;AAGA,SAAS,UAAU,QAAiB,OAAwB;AAC1D,QAAM,cAAc,KAAK,UAAU,QAAQ,MAAM,CAAC,EAAE,MAAM,IAAI;AAC9D,QAAM,aAAa,KAAK,UAAU,OAAO,MAAM,CAAC,EAAE,MAAM,IAAI;AAC5D,QAAM,QAAQ,KAAK,IAAI,YAAY,QAAQ,WAAW,MAAM;AAC5D,QAAM,QAAkB,CAAC;AACzB,MAAI,QAAQ;AACZ,SAAO,QAAQ,OAAO;AACpB,QAAI,YAAY,KAAK,MAAM,WAAW,KAAK,GAAG;AAAE,eAAS;AAAG;AAAA,IAAU;AACtE,UAAM,QAAQ;AACd,UAAM,UAAoB,CAAC;AAC3B,UAAM,QAAkB,CAAC;AACzB,WAAO,QAAQ,SAAS,YAAY,KAAK,MAAM,WAAW,KAAK,GAAG;AAChE,YAAM,aAAa,YAAY,KAAK;AACpC,YAAM,YAAY,WAAW,KAAK;AAClC,UAAI,eAAe,OAAW,SAAQ,KAAK,UAAU;AACrD,UAAI,cAAc,OAAW,OAAM,KAAK,SAAS;AACjD,eAAS;AAAA,IACX;AACA,UAAM,KAAK,OAAO,QAAQ,CAAC,IAAI,QAAQ,MAAM,KAAK,QAAQ,CAAC,IAAI,MAAM,MAAM,OAAO,GAAG,QAAQ,IAAI,CAAC,SAAS,IAAI,IAAI,EAAE,GAAG,GAAG,MAAM,IAAI,CAAC,SAAS,IAAI,IAAI,EAAE,CAAC;AAAA,EAC5J;AACA,SAAO,MAAM,WAAW,IAAI,KAAK,CAAC,4BAA4B,2BAA2B,GAAG,KAAK,EAAE,KAAK,IAAI;AAC9G;AAGA,SAAS,YAAY,SAA0F;AAC7G,MAAI,CAAC,OAAO,OAAO,EAAG,OAAM,IAAI,UAAU,2BAA2B;AACrE,QAAM,aAAa,OAAO,KAAK,OAAO,EAAE,KAAK,CAAC,QAAQ,QAAQ,4BAA4B,QAAQ,sBAAsB;AACxH,MAAI,eAAe,OAAW,OAAM,IAAI,UAAU,mBAAmB,UAAU,EAAE;AACjF,QAAM,cAAc,QAAQ;AAC5B,MAAI,gBAAgB,WAAc,OAAO,gBAAgB,YAAY,YAAY,KAAK,EAAE,WAAW,GAAI,OAAM,IAAI,UAAU,mDAAmD;AAC9K,QAAM,WAAW,QAAQ,wBAAwB,CAAC;AAClD,MAAI,CAAC,MAAM,QAAQ,QAAQ,EAAG,OAAM,IAAI,UAAU,uCAAuC;AAEzF,QAAM,gBAAgB,SAAS,IAAI,CAAC,WAAoB;AACtD,UAAM,OAAO,OAAO,WAAW,WAAW,OAAO,KAAK,EAAE,YAAY,IAAI;AACxE,QAAI,CAAC,KAAK,WAAW,GAAG,KAAK,KAAK,SAAS,EAAG,OAAM,IAAI,UAAU,qDAAqD;AACvH,WAAO;AAAA,EACT,CAAC;AACD,SAAO,EAAE,gBAAgB,OAAO,gBAAgB,WAAW,cAAc,0BAA0B,eAAe,CAAC,GAAG,IAAI,IAAI,aAAa,CAAC,EAAE;AAChJ;AAGO,SAAS,uBAAuB,UAAmB,UAAiC,CAAC,GAAyB;AACnH,MAAI,CAAC,OAAO,QAAQ,EAAG,OAAM,IAAI,UAAU,4BAA4B;AACvE,QAAM,EAAE,gBAAgB,cAAc,IAAI,YAAY,OAAO;AAC7D,QAAM,UAA2B,CAAC;AAClC,QAAM,MAAmB,EAAE,SAAS,UAAU,CAAC,GAAG,2BAA2B,GAAG,aAAa,GAAG,gBAAgB,UAAU,KAAK;AAC/H,QAAM,WAAW,eAAe,UAAU,IAAI,GAAG;AACjD,QAAM,UAAU,QAAQ,KAAK,CAAC,MAAM,UAAU,IAAI,KAAK,MAAM,MAAM,IAAI,CAAC;AACxE,SAAO,OAAO,OAAO;AAAA,IACnB,eAAe;AAAA,IACf,UAAU;AAAA,IACV,SAAS,QAAQ,SAAS;AAAA,IAC1B,SAAS,OAAO,OAAO,OAAO;AAAA,IAC9B,MAAM,UAAU,UAAU,QAAQ;AAAA,IAClC,6BAA6B;AAAA,IAC7B,YAAY;AAAA,EACd,CAAC;AACH;",
+  "names": []
+}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "sfscanner",
-  "version": "0.2.0",
+  "version": "0.2.1",
   "description": "SecureFlow Scanner — Deterministic, offline security & dataflow analyzer for n8n workflows",
   "keywords": [
     "n8n",
@@ -12,9 +12,9 @@
   ],
   "repository": {
     "type": "git",
-    "url": "git+https://github.com/jitwark/n8n-Secureflow.git"
+    "url": "git+https://github.com/jitwark/sfscanner.git"
   },
-  "homepage": "https://github.com/jitwark/n8n-Secureflow#readme",
+  "homepage": "https://github.com/jitwark/sfscanner#readme",
   "license": "MIT",
   "private": false,
   "type": "module",
@@ -55,6 +55,14 @@
     "./v2/metadata-output": {
       "types": "./dist/v2/metadata-output.d.ts",
       "import": "./dist/v2/metadata-output.js"
+    },
+    "./v2/preflight-readiness": {
+      "types": "./dist/v2/preflight-readiness.d.ts",
+      "import": "./dist/v2/preflight-readiness.js"
+    },
+    "./v2/privacy-prepare": {
+      "types": "./dist/v2/privacy-prepare.d.ts",
+      "import": "./dist/v2/privacy-prepare.js"
     }
   },
   "scripts": {
@@ -69,6 +77,6 @@
     "@types/node": "^22.0.0",
     "esbuild": "^0.28.2",
     "typescript": "^5.7.2",
-    "vitest": "^4.1.11"
+    "vitest": "4.1.12"
   }
 }

package/dist/v2/atomic-output.d.ts

@@ -1,34 +0,0 @@
-import type { Stats } from 'node:fs';
-export type AtomicOutputFailureCodeV2 = 'INVALID_CONFIG' | 'SERIALIZATION_FAILED' | 'OUTPUT_WRITE_FAILED' | 'CANCELLED';
-export type AtomicOutputResultV2 = Readonly<{
-    ok: true;
-} | {
-    ok: false;
-    code: AtomicOutputFailureCodeV2;
-    message: string;
-}>;
-export type AtomicOutputHandleV2 = Readonly<{
-    write: (bytes: Uint8Array) => Promise<void>;
-    sync: () => Promise<void>;
-    close: () => Promise<void>;
-}>;
-export type AtomicOutputStatV2 = Pick<Stats, 'isFile' | 'isDirectory' | 'isSymbolicLink'>;
-export type AtomicOutputHostV2 = Readonly<{
-    lstat?: (path: string) => Promise<AtomicOutputStatV2>;
-    realpath?: (path: string) => Promise<string>;
-    open?: (path: string) => Promise<AtomicOutputHandleV2>;
-    write?: (path: string, bytes: Uint8Array) => Promise<void>;
-    sync?: (path: string) => Promise<void>;
-    rename?: (from: string, to: string) => Promise<void>;
-    unlink?: (path: string) => Promise<void>;
-}>;
-export type AtomicOutputOptionsV2 = Readonly<{
-    baseDirectory?: string;
-    inputPaths?: readonly string[];
-    signal?: AbortSignal;
-    maxTempAttempts?: number;
-    host?: AtomicOutputHostV2;
-}>;
-export declare function writeAtomicUtf8V2(target: string, text: string, options?: AtomicOutputOptionsV2): Promise<AtomicOutputResultV2>;
-export declare function writeAtomicBytesV2(target: string, bytes: Uint8Array, options?: AtomicOutputOptionsV2): Promise<AtomicOutputResultV2>;
-export declare function writeAtomicOutputV2(target: string, content: string | Uint8Array, options?: AtomicOutputOptionsV2): Promise<AtomicOutputResultV2>;

package/dist/v2/batch-runner.d.ts

@@ -1,50 +0,0 @@
-import { type ScannerLimitsV2 } from '@hub/contracts';
-import type { ScanWorkflowV2FailureCode, ScanWorkflowV2Result } from '@hub/scanner-core/v2';
-import { type ScanConfigV2 } from './config';
-import { type CliStdin, type InputReadHost, type ReadInputResult } from './input-read';
-import type { SelectedInputV2 } from './input-selection';
-import { type ScanWorkerFactory } from './scan-worker-host';
-import { type SigintSource } from './worker-host';
-export type BatchErrorCodeV2 = ScanWorkflowV2FailureCode | 'INPUT_READ_FAILED';
-export type BatchItemStatusV2 = 'COMPLETED' | 'FAILED' | 'CANCELLED' | 'TIMEOUT';
-export type BatchItemV2 = Readonly<{
-    label: string;
-    status: BatchItemStatusV2;
-    result?: ScanWorkflowV2Result;
-    error?: Readonly<{
-        code: BatchErrorCodeV2;
-    }>;
-}>;
-export type BatchResultV2 = Readonly<{
-    ok: true;
-    items: readonly BatchItemV2[];
-    cancelled: boolean;
-    completed: number;
-    failed: number;
-    concurrency: number;
-}> | Readonly<{
-    ok: false;
-    code: 'INVALID_CONFIG' | 'CANCELLED';
-    message: string;
-}>;
-export type BatchScanV2 = (bytes: Uint8Array, item: SelectedInputV2) => ScanWorkflowV2Result | PromiseLike<ScanWorkflowV2Result>;
-export type BatchReadV2 = (item: SelectedInputV2) => Uint8Array | ReadInputResult | PromiseLike<Uint8Array | ReadInputResult>;
-export type BatchRunnerInput = Readonly<{
-    items: readonly SelectedInputV2[];
-    config: ScanConfigV2;
-    scan?: BatchScanV2;
-    read?: BatchReadV2;
-    stdin?: CliStdin;
-    readHost?: InputReadHost;
-    baseDirectory?: string;
-    maxInputBytes?: number;
-    limitsDocument?: ScannerLimitsV2;
-    targetDocument?: unknown;
-    approvedDomains?: readonly string[];
-    scanWorker?: ScanWorkerFactory;
-    timeoutMs?: number;
-    signal?: AbortSignal;
-    sigint?: SigintSource;
-    now?: () => number;
-}>;
-export declare function runBatchV2(input: BatchRunnerInput): Promise<BatchResultV2>;

package/dist/v2/cli-runner-internal.d.ts

@@ -1,28 +0,0 @@
-import type { CliStdin, InputReadHost } from './input-read';
-import { type InputSelectionHost } from './input-selection';
-import type { CliCommandV2 } from './arguments';
-import { type BatchReadV2, type BatchScanV2 } from './batch-runner';
-import { type CliEnvelopeV2 } from './json-output';
-import { type ExitCodeV2 } from './exit-reducer';
-import type { SigintSource } from './worker-host';
-export type V2CliRunOptions = Readonly<{
-    cwd?: string;
-    stdin?: CliStdin;
-    signal?: AbortSignal;
-    read?: BatchReadV2;
-    scan?: BatchScanV2;
-    readHost?: InputReadHost;
-    selectionHost?: InputSelectionHost;
-    sigint?: SigintSource;
-}>;
-export type V2CliRunResult = Readonly<{
-    exitCode: ExitCodeV2;
-    stdout: string;
-    stderr: string;
-    document?: CliEnvelopeV2 | string;
-}>;
-type ScanCommand = Extract<CliCommandV2, {
-    kind: 'scan';
-}>;
-export declare function runCliV2Internal(command: ScanCommand, options?: V2CliRunOptions): Promise<V2CliRunResult>;
-export {};

package/dist/v2/config.d.ts

@@ -1,16 +0,0 @@
-import { type ScanConfigV2 } from './contracts';
-export type ConfigLoadOptions = Readonly<{
-    configDirectory?: string;
-    cli?: unknown;
-}>;
-export type ConfigLoadResult = Readonly<{
-    ok: true;
-    config: ScanConfigV2;
-} | {
-    ok: false;
-    code: 'INVALID_CONFIG';
-    errors: readonly string[];
-}>;
-export declare function loadExplicitConfig(input: unknown, options?: ConfigLoadOptions): ConfigLoadResult;
-export declare function validateScanConfigV2(input: unknown): ConfigLoadResult;
-export { ADMITTED_PROFILE_V2, BUILTIN_AUTHORITIES_V2, BUILTIN_LIMITS_AUTHORITY_V2, BUILTIN_RULESET_AUTHORITY_V2, BUILTIN_SEMANTICS_AUTHORITY_V2, CLI_TOOL_V2, DEFAULT_SCAN_CONFIG_V2, PROFILE_MANIFEST_DIGEST_V2, RULE_PACK_DIGEST_V2, SCAN_CONFIG_SCHEMA_V2, SEMANTIC_CATALOGUE_DIGEST_V2, type ScanConfigV2, } from './contracts';

package/dist/v2/exit-reducer.d.ts

@@ -1,23 +0,0 @@
-import type { BatchResultV2 } from './batch-runner';
-import type { ScanSeverityV2 } from './contracts';
-export type ExitReasonV2 = 'UNDER_THRESHOLD' | 'FINDING_THRESHOLD' | 'REQUIRE_COMPLETE' | 'ITEM_FAILURE' | 'USAGE' | 'INTERNAL' | 'CANCELLED';
-export type ExitCodeV2 = 0 | 1 | 2 | 3 | 4 | 130;
-export type ExitReductionV2 = Readonly<{
-    reason: ExitReasonV2;
-    code: ExitCodeV2;
-}>;
-export type ExitReducerOptionsV2 = Readonly<{
-    failOn?: ScanSeverityV2;
-    requireComplete?: boolean;
-    interrupted?: boolean;
-    outputFailed?: boolean;
-}>;
-export type ExitReducerInputV2 = Readonly<{
-    batch: BatchResultV2;
-    failOn?: ScanSeverityV2;
-    requireComplete?: boolean;
-    interrupted?: boolean;
-    outputFailed?: boolean;
-}>;
-export declare function reduceExitV2(batch: BatchResultV2, options?: ExitReducerOptionsV2): ExitReductionV2;
-export declare function reduceExitV2(input: ExitReducerInputV2): ExitReductionV2;

package/dist/v2/input-read.d.ts

@@ -1,26 +0,0 @@
-import type { SelectedInputV2 } from './input-selection';
-export declare const DEFAULT_MAX_INPUT_BYTES = 1536000;
-export type CliStdin = string | Uint8Array | AsyncIterable<Uint8Array | string>;
-export type InputReadHost = Readonly<{
-    readFile: (path: string, maxBytes?: number) => Promise<Uint8Array>;
-}>;
-export declare const defaultInputReadHost: InputReadHost;
-export type ReadInputOptions = Readonly<{
-    stdin?: CliStdin;
-    maxBytes?: number;
-    baseDirectory?: string;
-    host?: InputReadHost;
-}>;
-export type ReadInputSuccess = Readonly<{
-    ok: true;
-    bytes: Uint8Array;
-    label: string;
-}>;
-export type ReadInputFailure = Readonly<{
-    ok: false;
-    code: 'WORKFLOW_TOO_LARGE' | 'INPUT_READ_FAILED' | 'INVALID_CONFIG';
-    message: string;
-    label: string;
-}>;
-export type ReadInputResult = ReadInputSuccess | ReadInputFailure;
-export declare function readInputBytes(input: SelectedInputV2 | string, options?: ReadInputOptions): Promise<ReadInputResult>;

package/dist/v2/input-selection.d.ts

@@ -1,38 +0,0 @@
-export type HostEntry = Readonly<{
-    name: string;
-    isDirectory: () => boolean;
-    isFile: () => boolean;
-    isSymbolicLink: () => boolean;
-}>;
-export type InputSelectionHost = Readonly<{
-    readdir: (path: string) => Promise<readonly HostEntry[]>;
-    stat: (path: string) => Promise<Pick<HostEntry, 'isDirectory' | 'isFile' | 'isSymbolicLink'>>;
-    lstat: (path: string) => Promise<Pick<HostEntry, 'isDirectory' | 'isFile' | 'isSymbolicLink'>>;
-    realpath: (path: string) => Promise<string>;
-}>;
-export declare const defaultInputSelectionHost: InputSelectionHost;
-export type CollectInputsOptions = Readonly<{
-    inputs: readonly string[];
-    include?: readonly string[];
-    exclude?: readonly string[];
-    baseDirectory?: string;
-    outputPath?: string;
-    host?: InputSelectionHost;
-    signal?: AbortSignal;
-}>;
-export type SelectedInputV2 = Readonly<{
-    label: string;
-    realPath?: string;
-    isStdin: boolean;
-}>;
-export type CollectInputsResult = Readonly<{
-    ok: true;
-    inputs: readonly SelectedInputV2[];
-}> | Readonly<{
-    ok: false;
-    code: 'INVALID_CONFIG' | 'INPUT_READ_FAILED' | 'CANCELLED';
-    message: string;
-}>;
-export declare function collectInputs(options: CollectInputsOptions): Promise<CollectInputsResult>;
-export declare function detectOutputCollision(outputPath: string, inputs: readonly SelectedInputV2[], host?: InputSelectionHost, baseDir?: string, signal?: AbortSignal): Promise<boolean>;
-export declare function compilePosixGlob(pattern: string): RegExp;

package/dist/v2/json-output.d.ts

@@ -1,97 +0,0 @@
-import { type ScannerResultV2 } from '@hub/contracts/scanner-v2-result';
-import type { BatchErrorCodeV2, BatchResultV2 } from './batch-runner';
-export type ProjectionFormatV2 = 'json' | 'ndjson' | 'sarif' | 'table';
-export type ProjectionSourceV2 = Readonly<{
-    profile: 'BUILT_IN' | 'CONFIG' | 'CLI';
-    rules: 'BUILT_IN' | 'CONFIG' | 'CLI';
-    semantics: 'BUILT_IN' | 'CONFIG' | 'CLI';
-    limits: 'BUILT_IN' | 'CONFIG' | 'CLI';
-    target: 'DEFAULT' | 'CONFIG' | 'CLI';
-    unsignedDevelopment: 'DEFAULT' | 'CONFIG' | 'CLI';
-}>;
-export type ProjectionOptionsV2 = Readonly<{
-    format: ProjectionFormatV2;
-    profile: string;
-    failOn: 'CRITICAL' | 'HIGH' | 'MEDIUM' | 'LOW' | 'INFO';
-    requireComplete: boolean;
-    concurrency: number;
-    allowUnsignedDevelopmentRules: boolean;
-    sources: ProjectionSourceV2;
-}>;
-type ArtifactV2 = Readonly<{
-    profile: {
-        id: string;
-        version: string;
-    };
-    ruleset: {
-        id: string;
-        version: string;
-        digest: string;
-        signatureStatus: 'VERIFIED' | 'UNVERIFIED';
-    };
-    semantics: {
-        id: string;
-        version: string;
-        digest: string;
-    };
-    target: ScannerResultV2['target'];
-    limits: {
-        schemaVersion: 'scanner-limits-v2';
-        digest: string;
-    };
-}>;
-type CliErrorCodeV2 = BatchErrorCodeV2 | 'OUTPUT_WRITE_FAILED';
-type CliErrorV2 = Readonly<{
-    kind: 'INPUT' | 'INCOMPLETE' | 'INTERNAL' | 'CANCELLED';
-    code: CliErrorCodeV2;
-    message: string;
-}>;
-type CliItemV2 = Readonly<{
-    input: string;
-    ok: true;
-    result: ScannerResultV2;
-} | {
-    input: string;
-    ok: false;
-    error: CliErrorV2;
-}>;
-type SummaryV2 = Readonly<{
-    total: number;
-    complete: number;
-    degraded: number;
-    indeterminate: number;
-    inputErrors: number;
-    internalErrors: number;
-    cancelled: number;
-    findings: number;
-}>;
-export type CliEnvelopeV2 = Readonly<{
-    schemaVersion: 'n8n-scan-v2';
-    tool: Readonly<{
-        name: 'n8n-scan';
-        version: string;
-        buildDigest: string;
-    }>;
-    artifacts: ArtifactV2;
-    invocation: Readonly<{
-        schema: 'v2';
-        format: 'json' | 'ndjson' | 'sarif' | 'table';
-        profile: string;
-        failOn: 'CRITICAL' | 'HIGH' | 'MEDIUM' | 'LOW' | 'INFO';
-        requireComplete: boolean;
-        concurrency: number;
-        allowUnsignedDevelopmentRules: boolean;
-        sources: ProjectionSourceV2;
-    }>;
-    results: readonly CliItemV2[];
-    summary: SummaryV2;
-    exitReason: 'UNDER_THRESHOLD' | 'FINDING_THRESHOLD' | 'REQUIRE_COMPLETE' | 'ITEM_FAILURE' | 'USAGE' | 'INTERNAL' | 'CANCELLED';
-}>;
-export type ProjectedBatchV2 = Readonly<{
-    envelope: CliEnvelopeV2;
-    items: readonly CliItemV2[];
-}>;
-export declare const DEFAULT_PROJECTION_OPTIONS: ProjectionOptionsV2;
-export declare function serializeEnvelopeV2(batch: BatchResultV2, options?: ProjectionOptionsV2): string;
-export declare function projectBatchV2(batch: BatchResultV2, options?: ProjectionOptionsV2 | ProjectionFormatV2): ProjectedBatchV2;
-export {};

package/dist/v2/metadata-validation.d.ts

@@ -1,4 +0,0 @@
-import type { CliMetadataDocumentV2 } from './commands.js';
-export declare function checkPlain(o: unknown): Record<string, unknown>;
-export declare function checkDenseArray<T>(arr: unknown): T[];
-export declare function validateDocumentShape(doc: unknown): asserts doc is CliMetadataDocumentV2;