sfscanner 0.2.0 → 0.2.1

package/dist/_types/packages/scanner-cli/src/v2/arguments.d.ts

@@ -0,0 +1,102 @@
+import { ADMITTED_PROFILE_V2, type ScanConfigV2, type ScanSeverityV2 } from "./contracts.js";
+import type { V2CommandName } from "./help.js";
+export type CliFormatV2 = 'json' | 'ndjson' | 'sarif' | 'table';
+export type CliProfileV2 = typeof ADMITTED_PROFILE_V2.id;
+export type CliTargetEnumV2 = 'UNKNOWN' | 'COMMUNITY' | 'ENTERPRISE' | 'CLOUD' | 'SELF_HOSTED' | 'OWNER' | 'ADMIN' | 'MEMBER' | 'LEGACY' | 'NATIVE';
+export type CliParseErrorCodeV2 = 'NO_COMMAND' | 'UNKNOWN_COMMAND' | 'UNKNOWN_OPTION' | 'MISSING_VALUE' | 'INVALID_VALUE' | 'DUPLICATE_OPTION' | 'UNEXPECTED_ARGUMENT' | 'REMOTE_PATH' | 'RULE_PACK_INVALID' | 'SEMANTIC_CATALOGUE_INVALID' | 'PROFILE_NOT_ADMITTED';
+export type CliParseErrorV2 = Readonly<{
+    code: CliParseErrorCodeV2;
+    message: string;
+    argument?: string;
+}>;
+type ScanCommandV2 = Readonly<{
+    kind: 'scan';
+    schema: 'v2';
+    inputs: readonly string[];
+    format: CliFormatV2;
+    profile: CliProfileV2;
+    failOn: ScanSeverityV2;
+    requireComplete: boolean;
+    concurrency: number;
+    timeoutMs?: number;
+    output?: string;
+    configPath?: string;
+    rules: 'builtin';
+    catalogue: 'builtin';
+    limits: string;
+    target?: string;
+    n8nVersion?: string;
+    edition: 'COMMUNITY' | 'ENTERPRISE' | 'CLOUD' | 'UNKNOWN';
+    deployment: 'SELF_HOSTED' | 'CLOUD' | 'UNKNOWN';
+    role: 'OWNER' | 'ADMIN' | 'MEMBER' | 'UNKNOWN';
+    taskRunner: 'LEGACY' | 'NATIVE' | 'UNKNOWN';
+    communityPackages: readonly string[];
+    configuration: readonly string[];
+    approvedDomains: readonly string[];
+    include: readonly string[];
+    exclude: readonly string[];
+    allowUnsignedDevelopmentRules: boolean;
+    noColor: boolean;
+    auditSupplyChain: boolean;
+    includeReadiness: boolean;
+    cliOverrides: Readonly<Partial<ScanConfigV2>>;
+}>;
+export type CliHelpCommandV2 = Readonly<{
+    kind: 'help';
+    schema: 'v2';
+    command?: V2CommandName;
+}>;
+/** Fix output is JSON-only; the fixed `format` keeps downstream command reducers total. */
+export type CliFixCommandV2 = Readonly<{
+    kind: 'fix';
+    schema: 'v2';
+    action: 'suggest' | 'apply';
+    format: 'json';
+    root: string;
+    input: string;
+    fix?: string;
+    mapping?: string;
+    endpointReceipt?: string;
+    confirm: boolean;
+}>;
+export type CliCommandV2 = ScanCommandV2 | CliFixCommandV2 | Readonly<{
+    kind: 'rules';
+    schema: 'v2';
+    format: 'json' | 'table';
+}> | Readonly<{
+    kind: 'explain';
+    schema: 'v2';
+    format: 'json' | 'table';
+    ruleId: string;
+}> | Readonly<{
+    kind: 'profiles';
+    schema: 'v2';
+    format: 'json' | 'table';
+}> | Readonly<{
+    kind: 'validate-config';
+    schema: 'v2';
+    format: 'json' | 'table';
+    path: string;
+}> | Readonly<{
+    kind: 'version';
+    schema: 'v2';
+    format: 'json' | 'table';
+}>;
+type ParsedCommandV2 = CliCommandV2 | CliHelpCommandV2;
+export type CliParseResultV2 = Readonly<{
+    ok: true;
+    command: ParsedCommandV2;
+} | {
+    ok: false;
+    error: CliParseErrorV2;
+}>;
+export type CliArgumentDispatch = Readonly<{
+    mode: 'v1';
+    argv: readonly string[];
+} | {
+    mode: 'v2';
+    result: CliParseResultV2;
+}>;
+export declare function parseArgumentsV2(argv: readonly string[]): CliParseResultV2;
+export declare function parseCliArguments(argv: readonly string[]): CliArgumentDispatch;
+export {};

package/dist/_types/packages/scanner-cli/src/v2/cli-runner.d.ts

@@ -0,0 +1,22 @@
+import type { CliCommandV2 } from "./arguments.js";
+/** The scan member only: the internal runner does not dispatch metadata commands. */
+export type PublicScanCommandV2 = Extract<CliCommandV2, {
+    kind: 'scan';
+}>;
+export type PublicRunOptionsV2 = Readonly<{
+    cwd?: string;
+    stdin?: string | Uint8Array | AsyncIterable<Uint8Array | string>;
+    signal?: AbortSignal;
+}>;
+export type PublicRunResultV2 = Readonly<{
+    exitCode: number;
+    stdout: string;
+    stderr: string;
+    document?: unknown;
+}>;
+/**
+ * Library entry. The `sfscanner` bin remains the side-effecting CLI; this wrapper forwards only
+ * the three consumer options, so an internal read/scan/selection hook is never part of the
+ * published surface.
+ */
+export declare function runCliV2(command: PublicScanCommandV2, options?: PublicRunOptionsV2): Promise<PublicRunResultV2>;

package/dist/{v2 → _types/packages/scanner-cli/src/v2}/commands.d.ts

@@ -1,4 +1,4 @@
-import type { CliCommandV2 } from './arguments.js';
+import type { CliCommandV2 } from "./arguments.js";
 type CliSeverityV2 = 'CRITICAL' | 'HIGH' | 'MEDIUM' | 'LOW' | 'INFO';
 type CliConfidenceV2 = 'LOW' | 'MEDIUM' | 'HIGH';
 export type CliRuleSummaryV2 = Readonly<{
@@ -30,6 +30,7 @@ export type CliArtifactIdentityV2 = Readonly<{
         digest: string;
     };
     target: {
+        schemaVersion: 'scanner-target-v3';
         edition: 'UNKNOWN';
         deployment: 'UNKNOWN';
         role: 'UNKNOWN';
@@ -84,7 +85,10 @@ export type CliVersionDocumentV2 = Readonly<{
         version: '2.0.0';
         buildDigest: string;
     };
-    resultSchemas: readonly ['scanner-result-v1', 'scanner-result-v2'];
+    resultSchemas: readonly [
+        'scanner-result-v1',
+        'scanner-result-v2'
+    ];
     configSchema: 'n8n-scan-config-v2';
     rulesetDigest: string;
     semanticsDigest: string;

package/dist/{v2 → _types/packages/scanner-cli/src/v2}/contracts.d.ts

@@ -43,13 +43,13 @@ export declare const BUILTIN_AUTHORITIES_V2: Readonly<{
     rules: Readonly<{
         id: "scanner-core-builtins";
         version: "2.0.0";
-        digest: "a36d00564bbf8e8c38f05820480782cdc53fdbd3712558850066c4e3f5c3413d";
+        digest: "30bdc8343582b6a4efc13538d3475db87d07fa28bea4027f9e93b813213fd510";
         signatureStatus: "VERIFIED";
     }>;
     semantics: Readonly<{
         id: "scanner-core-builtins";
         version: "2.2.0";
-        digest: "bc6fdecc34e460b5b01973ef7a8ce06b27b9b100ae03b480110f11f2a63ac328";
+        digest: "58419339dcf99ed398d2955282662e6f6d37208f62393cafb56818d4a38182d7";
     }>;
     limits: Readonly<{
         schemaVersion: "scanner-limits-v2";
@@ -60,20 +60,28 @@ export declare const PROFILE_MANIFEST_DIGEST_V2: "3ca5d69db2554383e22c44afe507cc
 export declare const BUILTIN_RULESET_AUTHORITY_V2: Readonly<{
     id: "scanner-core-builtins";
     version: "2.0.0";
-    digest: "a36d00564bbf8e8c38f05820480782cdc53fdbd3712558850066c4e3f5c3413d";
+    digest: "30bdc8343582b6a4efc13538d3475db87d07fa28bea4027f9e93b813213fd510";
     signatureStatus: "VERIFIED";
 }>;
 export declare const BUILTIN_SEMANTICS_AUTHORITY_V2: Readonly<{
     id: "scanner-core-builtins";
     version: "2.2.0";
-    digest: "bc6fdecc34e460b5b01973ef7a8ce06b27b9b100ae03b480110f11f2a63ac328";
+    digest: "58419339dcf99ed398d2955282662e6f6d37208f62393cafb56818d4a38182d7";
 }>;
 export declare const BUILTIN_LIMITS_AUTHORITY_V2: Readonly<{
     schemaVersion: "scanner-limits-v2";
     digest: "fca787753ca88f71cf0d174427f4ac730a7aef1c823aaf73aa1ea72af92b4077";
 }>;
-export declare const RULE_PACK_DIGEST_V2: "a36d00564bbf8e8c38f05820480782cdc53fdbd3712558850066c4e3f5c3413d";
-export declare const SEMANTIC_CATALOGUE_DIGEST_V2: "bc6fdecc34e460b5b01973ef7a8ce06b27b9b100ae03b480110f11f2a63ac328";
+export declare const RULE_PACK_DIGEST_V2: "30bdc8343582b6a4efc13538d3475db87d07fa28bea4027f9e93b813213fd510";
+export declare const SEMANTIC_CATALOGUE_DIGEST_V2: "58419339dcf99ed398d2955282662e6f6d37208f62393cafb56818d4a38182d7";
+/** Detached literals: parity checks must detect drift rather than importing live core pins. */
+export declare const BUILTIN_SCOPED_SEMANTICS_AUTHORITY_V2: Readonly<{
+    id: "reviewed-gmail-message-v1";
+    version: "1";
+    digest: "2b21f771d2cf172e33e8f78e5d1deaaefc0a5e8ff45f7d9f252cb8ec321ad56a";
+    sourceReceiptSha256: "2e8b7a2666cfc07c7609fdc9a2bdf01be291195a8b7da0af0f69836a180f8685";
+    sourceReceiptCanonicalDigest: "965de9fabde482dd5a6bcc67299fce8c33232e78c9fdc70053ad588b0f62ba2a";
+}>;
 /**
  * One tool identity for every machine surface: the JSON/NDJSON scan envelopes and the
  * rules/explain/profiles metadata documents. The digest folds the admitted engine, profile,
@@ -88,7 +96,26 @@ export type CliToolIdentityV2 = Readonly<{
 }>;
 export declare const CLI_TOOL_V2: CliToolIdentityV2;
 export declare const DEFAULT_SCAN_CONFIG_V2: ScanConfigV2;
-export declare const SCAN_CONFIG_V2_FIELDS: readonly ["schemaVersion", "format", "profile", "output", "inputs", "configPath", "failOn", "requireComplete", "concurrency", "rules", "catalogue", "limits", "target", "include", "exclude", "approvedDomains", "allowUnsignedDevelopmentRules", "noColor"];
+export declare const SCAN_CONFIG_V2_FIELDS: readonly [
+    "schemaVersion",
+    "format",
+    "profile",
+    "output",
+    "inputs",
+    "configPath",
+    "failOn",
+    "requireComplete",
+    "concurrency",
+    "rules",
+    "catalogue",
+    "limits",
+    "target",
+    "include",
+    "exclude",
+    "approvedDomains",
+    "allowUnsignedDevelopmentRules",
+    "noColor"
+];
 export declare const SCAN_CONFIG_V2_MAX_STRING = 4096;
 export declare const SCAN_CONFIG_V2_MAX_PATTERNS = 1024;
 export declare const SCAN_CONFIG_V2_MAX_CONCURRENCY = 16;

package/dist/_types/packages/scanner-cli/src/v2/help.d.ts

@@ -0,0 +1,64 @@
+export declare const V2_COMMANDS: readonly [
+    "scan",
+    "fix",
+    "rules",
+    "explain",
+    "profiles",
+    "validate-config",
+    "version"
+];
+export type V2CommandName = (typeof V2_COMMANDS)[number];
+export type V2OptionName = '--help' | '--schema' | '--format' | '--profile' | '--fail-on' | '--require-complete' | '--audit-supply-chain' | '--include-readiness' | '--max-concurrency' | '--concurrency' | '--timeout' | '--output' | '--config' | '--rules' | '--catalogue' | '--limits' | '--target' | '--n8n-version' | '--edition' | '--deployment' | '--role' | '--task-runner' | '--community-package' | '--configuration' | '--approved-domain' | '--include' | '--exclude' | '--allow-unsigned-development-rules' | '--no-color' | '--root' | '--input' | '--fix' | '--mapping' | '--endpoint-receipt' | '--confirm';
+export type V2HelpOption = Readonly<{
+    name: V2OptionName;
+    value: string;
+    commands: readonly V2CommandName[];
+    description: string;
+    default?: string;
+}>;
+export declare const V2_OPTIONS: readonly V2HelpOption[];
+/**
+ * The published limit vocabulary, restated because a shipped declaration must not name the private,
+ * unpublished contracts workspace: a strict NodeNext consumer of the packed package fails `TS2307`
+ * on that import. The values below still come from the contract, and the two vocabularies stay
+ * exhaustive against each other at compile time.
+ */
+export type V2LimitName = 'maxBytes' | 'maxNodes' | 'maxEdges' | 'maxConnectionDepth' | 'maxParameterDepth' | 'maxParameterLeaves' | 'workerDeadlineMs' | 'maxSyntaxNodes' | 'maxDocumentDepth' | 'maxMembersAndElements' | 'maxRawEdges' | 'maxDuplicateKeys' | 'maxDiagnostics' | 'maxStoredSourceSpans' | 'maxSourceWork' | 'maxExpressionTokens' | 'maxCodeSyntaxNodes' | 'maxGraphOperations' | 'maxTaintStates' | 'maxTraceStepsPerFinding' | 'maxFindings' | 'maxRedactionPatches' | 'maxRedactedArtifactBytes' | 'maxEvidenceBytes' | 'maxSerializedResultBytes' | 'maxRuleOperations';
+export declare const V2_LIMITS: Readonly<Record<V2LimitName, number>>;
+export declare const V2_EXIT_CODES: readonly [
+    0,
+    1,
+    2,
+    3,
+    4,
+    130
+];
+export type V2ExitCode = (typeof V2_EXIT_CODES)[number];
+export declare const V2_EXIT_REASONS: readonly [
+    "CANCELLED",
+    "INTERNAL",
+    "USAGE",
+    "FINDING_THRESHOLD",
+    "REQUIRE_COMPLETE",
+    "ITEM_FAILURE",
+    "UNDER_THRESHOLD"
+];
+export type V2ExitReason = (typeof V2_EXIT_REASONS)[number];
+export declare const V2_CANONICAL_CLAIMS: readonly [
+    "v2 is offline and never initiates network requests (HTTP, DNS, sockets, telemetry, or remote imports).",
+    "Labels and output identities never contain absolute paths or workflow source content.",
+    "File output uses a same-directory temporary file and atomic replace; failures and cancellation preserve the prior file.",
+    "beta-default@2.0.0 is admitted; beta-hardened@2.0.0 is defined but not admitted or selectable.",
+    "No shipped path produces a redacted artifact: maxRedactionPatches and maxRedactedArtifactBytes bound redaction-v2, which is development-only and unwired.",
+    "No shipped path admits an external rule pack: --rules and --catalogue accept only builtin, and --allow-unsigned-development-rules is refused because Ed25519 trust-store admission is deferred.",
+    "Published on npm as sfscanner."
+];
+export type V2CommandHelp = Readonly<{
+    command: V2CommandName;
+    usage: readonly string[];
+    text: string;
+}>;
+export declare const COMMAND_HELP_V2: Readonly<Record<V2CommandName, string>>;
+export declare const GENERAL_HELP_V2: string;
+export declare const HELP_TEXT_V2: string;
+export declare function getHelpV2(command?: V2CommandName): string;

package/dist/_types/packages/scanner-cli/src/v2/metadata-output.d.ts

@@ -0,0 +1,37 @@
+import type { CliMetadataDocumentV2 } from "./commands.js";
+import type { CliCommandV2 } from "./arguments.js";
+export type MetadataFormatV2 = 'json' | 'table';
+export type MetadataOutputOptionsV2 = Readonly<{
+    color?: boolean;
+    configDirectory?: string;
+}>;
+export declare function renderMetadataTableV2(document: CliMetadataDocumentV2, _options?: MetadataOutputOptionsV2): string;
+export declare function serializeMetadataJsonV2(document: CliMetadataDocumentV2): string;
+export declare function serializeMetadataV2(document: CliMetadataDocumentV2, format?: MetadataFormatV2, options?: MetadataOutputOptionsV2): string;
+export declare function emitRulesDocumentV2(format?: MetadataFormatV2, options?: MetadataOutputOptionsV2): string;
+export declare function emitExplainDocumentV2(ruleId: string, format?: MetadataFormatV2, options?: MetadataOutputOptionsV2): Readonly<{
+    ok: true;
+    output: string;
+} | {
+    ok: false;
+    code: 'USAGE';
+    message: string;
+}>;
+export declare function emitProfilesDocumentV2(format?: MetadataFormatV2, options?: MetadataOutputOptionsV2): string;
+export declare function emitVersionDocumentV2(format?: MetadataFormatV2, options?: MetadataOutputOptionsV2): string;
+export declare function emitConfigValidationDocumentV2(input: unknown, format?: MetadataFormatV2, options?: MetadataOutputOptionsV2): Readonly<{
+    ok: true;
+    output: string;
+} | {
+    ok: false;
+    code: 'USAGE';
+    message: string;
+}>;
+export declare function emitMetadataCommandResultV2(command: CliCommandV2, configInput?: unknown, options?: MetadataOutputOptionsV2): Readonly<{
+    ok: true;
+    output: string;
+} | {
+    ok: false;
+    code: 'USAGE';
+    message: string;
+}>;

package/dist/_types/packages/scanner-cli/src/v2/preflight-readiness.d.ts

@@ -0,0 +1,108 @@
+import type { PreflightPrerequisitesV1 } from "../../../../contracts/preflight-prerequisite-types.js";
+export type { PreflightCommunityNodeV1, PreflightCredentialV1, PreflightEnvironmentV1, PreflightIntegrationV1, PreflightNodeEvidenceV1, PreflightPrerequisitesV1, PreflightProvenanceV1, PreflightSubworkflowV1, } from "../../../../contracts/preflight-prerequisite-types.js";
+export declare const PREFLIGHT_READINESS_SCHEMA_V1: "n8n-preflight-readiness-v1";
+export declare const PREFLIGHT_SEVERITIES_V1: readonly [
+    "critical",
+    "high",
+    "medium",
+    "low",
+    "info"
+];
+export type PreflightSeverityV1 = (typeof PREFLIGHT_SEVERITIES_V1)[number];
+export type PreflightCompletenessV1 = 'COMPLETE' | 'DEGRADED' | 'INDETERMINATE';
+export type N8nTargetV1 = '1.x' | '2.x';
+export type PreflightCompletenessCodeV1 = 'ANALYSIS_NOT_REPORTED' | 'MALFORMED_NODE_ENTRY' | 'UNKNOWN_NODE_TYPE' | 'UNSUPPORTED_NODE' | 'UNRESOLVED_EDGE' | 'AMBIGUITY' | 'TRUNCATED_ANALYSIS' | 'DYNAMIC_PREREQUISITE_VALUE' | 'PREREQUISITE_INVENTORY_LIMIT' | 'DYNAMIC_ENVIRONMENT_ACCESS' | 'ENVIRONMENT_EVIDENCE_OMITTED';
+export type PreflightTargetCodeV1 = 'FEATURE_NOT_SUPPORTED_BY_TARGET' | 'TYPE_VERSION_NOT_SUPPORTED_BY_TARGET' | 'TYPE_VERSION_UNKNOWN' | 'DEFAULT_NODE_EXCLUSION_CONFIGURATION_UNKNOWN';
+export declare const PREFLIGHT_DISCLAIMER_V1: Readonly<{
+    id: "NOT_SAFETY_CLEARANCE";
+    text: "A clean or low-severity scan is not safety clearance: it does not prove the workflow is bug-free, secure, fully analyzed or runnable, and it does not replace an import, execution, deployment or credential check on the declared target.";
+}>;
+export type PreflightFindingInputV1 = Readonly<{
+    ruleId: string;
+    severity: string;
+    node?: string | null;
+    message?: string | null;
+}>;
+export type PreflightFindingV1 = Readonly<{
+    ruleId: string;
+    severity: PreflightSeverityV1;
+    node: string | null;
+    message: string | null;
+}>;
+export type PreflightAnalysisSignalsV1 = Readonly<{
+    supportedNodes?: number;
+    unsupportedNodes?: number;
+    unresolvedEdges?: number;
+    ambiguities?: number;
+    truncated?: boolean;
+}>;
+export type PreflightCompletenessReasonV1 = Readonly<{
+    code: PreflightCompletenessCodeV1;
+    count: number;
+    detail: string;
+}>;
+export type PlatformCompatibilityFactV1 = Readonly<{
+    featureId: string;
+    description: string;
+    nodeTypes: readonly string[];
+    supportedTargets: readonly N8nTargetV1[];
+    maxTypeVersionByTarget?: Readonly<Partial<Record<N8nTargetV1, string>>>;
+    source: string;
+}>;
+export type PreflightTargetSourceEvidenceV1 = Readonly<{
+    kind: 'PINNED_SOURCE';
+    tag: string;
+    commit: string;
+    path: string;
+    startLine: number;
+    endLine: number;
+    sha256: string;
+}>;
+export type PreflightTargetFindingV1 = Readonly<{
+    code: PreflightTargetCodeV1;
+    featureId: string;
+    subject: string;
+    nodeType: string | null;
+    typeVersion: string | null;
+    source: string;
+    detail: string;
+    pointer?: string;
+    sourceEvidence?: PreflightTargetSourceEvidenceV1;
+}>;
+export type PreflightReadinessOptionsV1 = Readonly<{
+    workflow: unknown;
+    n8nTarget?: N8nTargetV1 | 'UNKNOWN' | null;
+    platformFacts?: readonly PlatformCompatibilityFactV1[];
+    requiredPlatformFeatures?: readonly string[];
+    analysis?: PreflightAnalysisSignalsV1;
+    findings?: readonly PreflightFindingInputV1[];
+    n8nVersion?: string | null;
+}>;
+export type PreflightReadinessReportV1 = Readonly<{
+    schemaVersion: typeof PREFLIGHT_READINESS_SCHEMA_V1;
+    safetyClearance: 'NOT_PROVIDED';
+    disclaimer: typeof PREFLIGHT_DISCLAIMER_V1;
+    completeness: Readonly<{
+        status: PreflightCompletenessV1;
+        reasons: readonly PreflightCompletenessReasonV1[];
+    }>;
+    findings: Readonly<{
+        total: number;
+        bySeverity: Readonly<Record<PreflightSeverityV1, number>>;
+        highestSeverity: PreflightSeverityV1 | null;
+        items: readonly PreflightFindingV1[];
+    }>;
+    prerequisites: PreflightPrerequisitesV1;
+    target: Readonly<{
+        declared: N8nTargetV1 | null;
+        declaredVersion?: string | null;
+        status: 'INDETERMINATE' | 'NO_RECOGNIZED_CHANGE' | 'INCOMPATIBLE' | 'UNKNOWN';
+        migrationTested: false;
+        findings: readonly PreflightTargetFindingV1[];
+        notes: readonly string[];
+    }>;
+}>;
+/** No pinned platform fact is admitted yet, so every compatibility fact must arrive with its own source (B3). */
+export declare const DEFAULT_PLATFORM_FACTS_V1: readonly PlatformCompatibilityFactV1[];
+/** Builds the offline readiness report; the input workflow is never mutated and nothing is executed. */
+export declare function buildPreflightReadinessReport(options: PreflightReadinessOptionsV1): PreflightReadinessReportV1;

package/dist/_types/packages/scanner-cli/src/v2/privacy-prepare.d.ts

@@ -0,0 +1,39 @@
+/**
+ * Opt-in workflow privacy preparation (PD-03): replaces credential references, sensitive
+ * authorization headers, internal endpoints, webhook paths and embedded tokens with safe
+ * placeholders before an export leaves the operator's machine. The result is a fresh copy plus an
+ * exact change list and a reviewable diff; structure is preserved and the input is never mutated.
+ * Redaction is heuristic and rule-bounded, so it never guarantees complete secret or PII removal.
+ * Pure, deterministic and free of host APIs so the browser worker and CLI share one contract.
+ */
+export declare const PRIVACY_PREPARE_SCHEMA_V1: "n8n-workflow-privacy-prepare-v1";
+export declare const PRIVACY_PREPARE_DISCLAIMER_V1: "Heuristic and rule-bounded privacy preparation. Does NOT guarantee complete secret or PII removal. The raw diff and change excerpts contain the original removed values and are sensitive local review material; never share or upload them.";
+export declare const CREDENTIAL_ID_PLACEHOLDER: "[REDACTED_CREDENTIAL_ID]";
+export declare const CREDENTIAL_NAME_PLACEHOLDER: "[REDACTED_CREDENTIAL_NAME]";
+export declare const HEADER_VALUE_PLACEHOLDER: "[REDACTED_HEADER_VALUE]";
+export declare const INTERNAL_URL_PLACEHOLDER: "https://internal.example.invalid/...";
+export declare const TOKEN_PLACEHOLDER: "[REDACTED_TOKEN]";
+export declare const WEBHOOK_PATH_PLACEHOLDER: "[REDACTED_WEBHOOK_PATH]";
+export declare const WEBHOOK_ID_PLACEHOLDER: "[REDACTED_WEBHOOK_ID]";
+export type PrivacyChangeKind = 'CREDENTIAL' | 'HEADER' | 'INTERNAL_URL' | 'TOKEN';
+export type PrivacyChange = Readonly<{
+    path: string;
+    kind: PrivacyChangeKind;
+    originalExcerpt: string;
+    replacement: string;
+}>;
+export type PrivacyPrepareOptions = Readonly<{
+    internalUrlPlaceholder?: string;
+    internalHostSuffixes?: readonly string[];
+}>;
+export type PrivacyPrepareResult = Readonly<{
+    schemaVersion: typeof PRIVACY_PREPARE_SCHEMA_V1;
+    workflow: Readonly<Record<string, unknown>>;
+    changed: boolean;
+    changes: readonly PrivacyChange[];
+    diff: string;
+    completeRedactionGuaranteed: false;
+    disclaimer: typeof PRIVACY_PREPARE_DISCLAIMER_V1;
+}>;
+/** Returns a scrubbed deep copy plus the change list and diff; the input workflow is never mutated. */
+export declare function prepareWorkflowPrivacy(workflow: unknown, options?: PrivacyPrepareOptions): PrivacyPrepareResult;

package/dist/index.d.ts

@@ -1,4 +1 @@
-export { parseCliArguments } from './v2/arguments.js';
-export { runCliV2, type PublicRunOptionsV2, type PublicRunResultV2, type PublicScanCommandV2, } from './v2/cli-runner.js';
-export { getHelpV2 } from './v2/help.js';
-export { emitMetadataCommandResultV2 } from './v2/metadata-output.js';
+export * from "./_types/packages/scanner-cli/src/index.js";