mustflow 2.103.10 → 2.103.12

package/dist/cli/script-packs/repo-security-pattern-scan.js

@@ -0,0 +1,150 @@
+import { printUsageError, renderHelp } from '../lib/cli-output.js';
+import { t } from '../lib/i18n.js';
+import { formatCliOptionParseError, getParsedCliStringOption, hasCliOptionToken, hasParsedCliOption, parseCliOptions, } from '../lib/option-parser.js';
+import { resolveMustflowRoot } from '../lib/project-root.js';
+import { inspectSecurityPatternScan, SECURITY_PATTERN_SCAN_SCRIPT_REF, } from '../../core/security-pattern-scan.js';
+const SECURITY_PATTERN_SCAN_OPTIONS = [
+    { name: '--json', kind: 'boolean' },
+    { name: '--max-files', kind: 'string' },
+    { name: '--max-file-bytes', kind: 'string' },
+    { name: '--max-findings', kind: 'string' },
+];
+function parsePositiveInteger(value, option, lang) {
+    if (value === null) {
+        return { value: null };
+    }
+    if (!/^[1-9]\d*$/u.test(value)) {
+        return { value: null, error: t(lang, 'securityPatternScan.error.invalidPositiveInteger', { option, value }) };
+    }
+    const parsed = Number(value);
+    if (!Number.isSafeInteger(parsed)) {
+        return { value: null, error: t(lang, 'securityPatternScan.error.invalidPositiveInteger', { option, value }) };
+    }
+    return { value: parsed };
+}
+export function getRepoSecurityPatternScanHelp(lang = 'en') {
+    return renderHelp({
+        usage: 'mf script-pack run repo/security-pattern-scan scan [path...] [options]',
+        summary: t(lang, 'securityPatternScan.help.summary'),
+        options: [
+            { label: '--max-files <count>', description: t(lang, 'securityPatternScan.help.option.maxFiles') },
+            { label: '--max-file-bytes <bytes>', description: t(lang, 'securityPatternScan.help.option.maxFileBytes') },
+            { label: '--max-findings <count>', description: t(lang, 'securityPatternScan.help.option.maxFindings') },
+            { label: '--json', description: t(lang, 'cli.option.json') },
+            { label: '-h, --help', description: t(lang, 'cli.option.help') },
+        ],
+        examples: [
+            'mf script-pack run repo/security-pattern-scan scan --json',
+            'mf script-pack run repo/security-pattern-scan scan src .github/workflows --json',
+            'mf script-pack run repo/security-pattern-scan scan src/server.ts --max-findings 50 --json',
+        ],
+        exitCodes: [
+            { label: '0', description: t(lang, 'securityPatternScan.help.exit.ok') },
+            { label: '1', description: t(lang, 'securityPatternScan.help.exit.fail') },
+        ],
+    }, lang);
+}
+function parseSecurityPatternScanOptions(args, lang) {
+    const [action, ...rest] = args;
+    const parsed = parseCliOptions(rest, SECURITY_PATTERN_SCAN_OPTIONS, { allowPositionals: true });
+    const json = hasParsedCliOption(parsed, '--json');
+    const maxFiles = parsePositiveInteger(getParsedCliStringOption(parsed, '--max-files'), '--max-files', lang);
+    const maxFileBytes = parsePositiveInteger(getParsedCliStringOption(parsed, '--max-file-bytes'), '--max-file-bytes', lang);
+    const maxFindings = parsePositiveInteger(getParsedCliStringOption(parsed, '--max-findings'), '--max-findings', lang);
+    if (action !== 'scan') {
+        return {
+            action: 'scan',
+            json,
+            paths: parsed.positionals,
+            maxFiles: maxFiles.value,
+            maxFileBytes: maxFileBytes.value,
+            maxFindings: maxFindings.value,
+            error: action
+                ? t(lang, 'securityPatternScan.error.unknownAction', { action })
+                : t(lang, 'securityPatternScan.error.missingAction'),
+        };
+    }
+    if (parsed.error) {
+        return {
+            action,
+            json,
+            paths: parsed.positionals,
+            maxFiles: maxFiles.value,
+            maxFileBytes: maxFileBytes.value,
+            maxFindings: maxFindings.value,
+            error: formatCliOptionParseError(parsed.error, lang),
+        };
+    }
+    for (const candidate of [maxFiles, maxFileBytes, maxFindings]) {
+        if (candidate.error) {
+            return {
+                action,
+                json,
+                paths: parsed.positionals,
+                maxFiles: maxFiles.value,
+                maxFileBytes: maxFileBytes.value,
+                maxFindings: maxFindings.value,
+                error: candidate.error,
+            };
+        }
+    }
+    return {
+        action,
+        json,
+        paths: parsed.positionals,
+        maxFiles: maxFiles.value,
+        maxFileBytes: maxFileBytes.value,
+        maxFindings: maxFindings.value,
+    };
+}
+function renderSecurityPatternScanSummary(report, lang) {
+    const lines = [
+        t(lang, 'securityPatternScan.title'),
+        `${t(lang, 'scriptPack.label.script')}: ${SECURITY_PATTERN_SCAN_SCRIPT_REF}`,
+        `${t(lang, 'label.status')}: ${report.status}`,
+        `${t(lang, 'securityPatternScan.label.files')}: ${report.summary.file_count}`,
+        `${t(lang, 'securityPatternScan.label.findings')}: ${report.summary.finding_count}`,
+        `${t(lang, 'securityPatternScan.label.categories')}: ${report.summary.category_count}`,
+        `${t(lang, 'securityPatternScan.label.highOrCritical')}: ${report.summary.high_or_critical_count}`,
+        `${t(lang, 'securityPatternScan.label.truncated')}: ${report.truncated ? t(lang, 'value.yes') : t(lang, 'value.no')}`,
+    ];
+    if (report.findings.length > 0) {
+        lines.push(t(lang, 'securityPatternScan.label.findings'));
+        for (const finding of report.findings.slice(0, 40)) {
+            const line = finding.line ? `:${finding.line}` : '';
+            const detector = finding.detector ? ` ${finding.detector}` : '';
+            const focus = finding.review_focus ? ` ${t(lang, 'securityPatternScan.label.reviewFocus')}: ${finding.review_focus}` : '';
+            lines.push(`- ${finding.path}${line}: ${finding.code}${detector} (${finding.message})${focus}`);
+        }
+    }
+    if (report.issues.length > 0) {
+        lines.push(t(lang, 'securityPatternScan.label.issues'), ...report.issues.map((issue) => `- ${issue}`));
+    }
+    if (report.findings.length === 0 && report.issues.length === 0) {
+        lines.push(t(lang, 'securityPatternScan.clean'));
+    }
+    return lines.join('\n');
+}
+export function runRepoSecurityPatternScanScript(args, reporter, lang = 'en') {
+    if (hasCliOptionToken(args, '--help', ['-h'])) {
+        reporter.stdout(getRepoSecurityPatternScanHelp(lang));
+        return 0;
+    }
+    const options = parseSecurityPatternScanOptions(args, lang);
+    if (options.error) {
+        printUsageError(reporter, options.error, 'mf script-pack run repo/security-pattern-scan --help', getRepoSecurityPatternScanHelp(lang), lang);
+        return 1;
+    }
+    const report = inspectSecurityPatternScan(resolveMustflowRoot(), {
+        paths: options.paths,
+        maxFiles: options.maxFiles ?? undefined,
+        maxFileBytes: options.maxFileBytes ?? undefined,
+        maxFindings: options.maxFindings ?? undefined,
+    });
+    if (options.json) {
+        reporter.stdout(JSON.stringify(report, null, 2));
+        return report.ok ? 0 : 1;
+    }
+    reporter.stdout(renderSecurityPatternScanSummary(report, lang));
+    return report.ok ? 0 : 1;
+}

package/dist/core/command-env.js

@@ -1,4 +1,4 @@
-import { existsSync } from 'node:fs';
+import { existsSync, realpathSync } from 'node:fs';
 import path from 'node:path';
 import { readString, readStringArray } from './config-loading.js';
 export const COMMAND_ENV_POLICIES = new Set(['inherit', 'minimal', 'allowlist']);
@@ -31,12 +31,30 @@ export const DEFAULT_PROJECT_LOCAL_BIN_BARE_EXECUTABLE_ALLOWLIST = new Set(['mf'
 function getPathEnvKey(env) {
     return Object.keys(env).find((key) => key.toLowerCase() === 'path') ?? 'PATH';
 }
-function sameResolvedPath(left, right) {
-    const resolvedLeft = path.resolve(left);
-    const resolvedRight = path.resolve(right);
-    return process.platform === 'win32'
-        ? resolvedLeft.toLowerCase() === resolvedRight.toLowerCase()
-        : resolvedLeft === resolvedRight;
+function normalizePathForComparison(value) {
+    const resolved = path.resolve(value);
+    if (!existsSync(resolved)) {
+        return resolved;
+    }
+    try {
+        return realpathSync.native(resolved);
+    }
+    catch {
+        return resolved;
+    }
+}
+function pathsEqual(left, right) {
+    return process.platform === 'win32' ? left.toLowerCase() === right.toLowerCase() : left === right;
+}
+function pathEntryCandidates(entry, projectRoot) {
+    if (path.isAbsolute(entry)) {
+        return [entry];
+    }
+    return [path.resolve(projectRoot, entry), path.resolve(entry)];
+}
+function sameResolvedPath(left, right, projectRoot) {
+    const resolvedRight = normalizePathForComparison(right);
+    return pathEntryCandidates(left, projectRoot).some((candidate) => pathsEqual(normalizePathForComparison(candidate), resolvedRight));
 }
 function uniqueEnvNames(values) {
     return [...new Set(values.map((value) => value.trim()).filter((value) => value.length > 0))].sort((left, right) => left.localeCompare(right));
@@ -112,7 +130,7 @@ function removeProjectLocalBinFromPath(env, projectRoot) {
         ...env,
         [pathKey]: currentPath
             .split(path.delimiter)
-            .filter((entry) => entry.length > 0 && !sameResolvedPath(entry, localBinPath))
+            .filter((entry) => entry.length > 0 && !sameResolvedPath(entry, localBinPath, projectRoot))
             .join(path.delimiter),
     };
 }

package/dist/core/public-json-contracts.js

@@ -495,6 +495,15 @@ const PUBLIC_JSON_SCHEMA_CONTRACTS = [
         ],
         expectedExitCodes: [0, 1],
     },
+    {
+        id: 'repo-deploy-surface-report',
+        schemaFile: 'repo-deploy-surface-report.schema.json',
+        producer: 'mf script-pack run repo/deploy-surface inspect --json',
+        packaged: true,
+        documented: true,
+        installedCommand: ['mf', 'script-pack', 'run', 'repo/deploy-surface', 'inspect', '--json'],
+        expectedExitCodes: [0, 1],
+    },
     {
         id: 'config-chain-report',
         schemaFile: 'config-chain-report.schema.json',
@@ -530,6 +539,15 @@ const PUBLIC_JSON_SCHEMA_CONTRACTS = [
         installedCommand: ['mf', 'script-pack', 'run', 'repo/secret-risk-scan', 'scan', 'AGENTS.md', '--json'],
         expectedExitCodes: [0, 1],
     },
+    {
+        id: 'security-pattern-scan-report',
+        schemaFile: 'security-pattern-scan-report.schema.json',
+        producer: 'mf script-pack run repo/security-pattern-scan scan [path...] --json',
+        packaged: true,
+        documented: true,
+        installedCommand: ['mf', 'script-pack', 'run', 'repo/security-pattern-scan', 'scan', 'AGENTS.md', '--json'],
+        expectedExitCodes: [0, 1],
+    },
     {
         id: 'related-files-report',
         schemaFile: 'related-files-report.schema.json',

package/dist/core/repo-deploy-surface.js

@@ -0,0 +1,428 @@
+import { createHash } from 'node:crypto';
+import { existsSync, readdirSync, readFileSync, statSync } from 'node:fs';
+import path from 'node:path';
+export const REPO_DEPLOY_SURFACE_PACK_ID = 'repo';
+export const REPO_DEPLOY_SURFACE_SCRIPT_ID = 'deploy-surface';
+export const REPO_DEPLOY_SURFACE_SCRIPT_REF = `${REPO_DEPLOY_SURFACE_PACK_ID}/${REPO_DEPLOY_SURFACE_SCRIPT_ID}`;
+const DEFAULT_MAX_FILE_BYTES = 256 * 1024;
+const WORKFLOW_DIR = '.github/workflows';
+const WORKFLOW_EXTENSIONS = new Set(['.yml', '.yaml']);
+const CONFIG_SURFACES = [
+    {
+        path: 'wrangler.toml',
+        type: 'cloudflare',
+        match: 'wrangler.toml',
+        requiredVerification: ['Cloudflare deploy or preview verification'],
+        manualGates: ['Cloudflare account, project, and secret configuration'],
+    },
+    {
+        path: 'wrangler.json',
+        type: 'cloudflare',
+        match: 'wrangler.json',
+        requiredVerification: ['Cloudflare deploy or preview verification'],
+        manualGates: ['Cloudflare account, project, and secret configuration'],
+    },
+    {
+        path: 'wrangler.jsonc',
+        type: 'cloudflare',
+        match: 'wrangler.jsonc',
+        requiredVerification: ['Cloudflare deploy or preview verification'],
+        manualGates: ['Cloudflare account, project, and secret configuration'],
+    },
+    {
+        path: 'vercel.json',
+        type: 'vercel',
+        match: 'vercel.json',
+        requiredVerification: ['Vercel preview or production deployment verification'],
+        manualGates: ['Vercel project and environment configuration'],
+    },
+    {
+        path: 'netlify.toml',
+        type: 'netlify',
+        match: 'netlify.toml',
+        requiredVerification: ['Netlify deploy preview or production deployment verification'],
+        manualGates: ['Netlify site and environment configuration'],
+    },
+    {
+        path: 'Dockerfile',
+        type: 'container',
+        match: 'Dockerfile',
+        requiredVerification: ['Container build and image smoke verification'],
+        manualGates: ['Container registry credentials and deployment target'],
+    },
+    {
+        path: 'docker-compose.yml',
+        type: 'container',
+        match: 'docker-compose.yml',
+        requiredVerification: ['Compose configuration and container smoke verification'],
+        manualGates: ['Runtime host, network, and volume configuration'],
+    },
+    {
+        path: 'docker-compose.yaml',
+        type: 'container',
+        match: 'docker-compose.yaml',
+        requiredVerification: ['Compose configuration and container smoke verification'],
+        manualGates: ['Runtime host, network, and volume configuration'],
+    },
+    {
+        path: 'compose.yml',
+        type: 'container',
+        match: 'compose.yml',
+        requiredVerification: ['Compose configuration and container smoke verification'],
+        manualGates: ['Runtime host, network, and volume configuration'],
+    },
+    {
+        path: 'compose.yaml',
+        type: 'container',
+        match: 'compose.yaml',
+        requiredVerification: ['Compose configuration and container smoke verification'],
+        manualGates: ['Runtime host, network, and volume configuration'],
+    },
+];
+function sha256(value) {
+    return `sha256:${createHash('sha256').update(value).digest('hex')}`;
+}
+function normalizeRelativePath(value) {
+    return value.replace(/\\/gu, '/').replace(/^\.\/+/u, '');
+}
+function lineForOffset(content, offset) {
+    let line = 1;
+    for (let index = 0; index < offset; index += 1) {
+        if (content.charCodeAt(index) === 10) {
+            line += 1;
+        }
+    }
+    return line;
+}
+function firstMatchLine(content, pattern) {
+    const match = pattern.exec(content);
+    if (!match || match.index < 0) {
+        return null;
+    }
+    return {
+        line: lineForOffset(content, match.index),
+        match: match[0].trim(),
+    };
+}
+function uniqueStrings(values) {
+    return [...new Set([...values].filter((value) => value.trim().length > 0))].sort((left, right) => left.localeCompare(right));
+}
+function safeReadText(root, relativePath, maxFileBytes, issues) {
+    const absolute = path.join(root, ...normalizeRelativePath(relativePath).split('/'));
+    try {
+        const stats = statSync(absolute);
+        if (!stats.isFile()) {
+            return null;
+        }
+        if (stats.size > maxFileBytes) {
+            issues.push(`${relativePath} exceeds max_file_bytes (${stats.size} > ${maxFileBytes}).`);
+            return null;
+        }
+        return readFileSync(absolute, 'utf8');
+    }
+    catch (error) {
+        const message = error instanceof Error ? error.message : String(error);
+        issues.push(`Could not read ${relativePath}: ${message}`);
+        return null;
+    }
+}
+function listWorkflowFiles(root, issues) {
+    const workflowsPath = path.join(root, ...WORKFLOW_DIR.split('/'));
+    if (!existsSync(workflowsPath)) {
+        return [];
+    }
+    try {
+        return readdirSync(workflowsPath, { withFileTypes: true })
+            .filter((entry) => entry.isFile() && WORKFLOW_EXTENSIONS.has(path.extname(entry.name).toLowerCase()))
+            .map((entry) => `${WORKFLOW_DIR}/${entry.name}`)
+            .sort((left, right) => left.localeCompare(right));
+    }
+    catch (error) {
+        const message = error instanceof Error ? error.message : String(error);
+        issues.push(`Could not list ${WORKFLOW_DIR}: ${message}`);
+        return [];
+    }
+}
+function workflowTrigger(content) {
+    const tagPush = firstMatchLine(content, /\btags(?:-ignore)?:\s*(?:\[[^\]]+\]|.+)/u);
+    if (tagPush) {
+        return `tag push (${tagPush.match})`;
+    }
+    const release = firstMatchLine(content, /^\s*release:\s*$/mu);
+    if (release) {
+        return 'GitHub release event';
+    }
+    const workflowDispatch = firstMatchLine(content, /^\s*workflow_dispatch:\s*$/mu);
+    if (workflowDispatch) {
+        return 'manual workflow_dispatch';
+    }
+    const push = firstMatchLine(content, /^\s*push:\s*$/mu);
+    if (push) {
+        return 'push';
+    }
+    return null;
+}
+function workflowManualGates(content, surfaceType) {
+    const gates = [];
+    if (/^\s*environment:\s*/mu.test(content)) {
+        gates.push('GitHub environment protection may gate this workflow.');
+    }
+    if (/^\s*workflow_dispatch:\s*$/mu.test(content)) {
+        gates.push('Manual workflow_dispatch trigger is available.');
+    }
+    if (surfaceType === 'npm_publish') {
+        gates.push('npm trusted publishing, token, or maintainer permission is required.');
+    }
+    if (surfaceType === 'github_pages') {
+        gates.push('GitHub Pages project settings and permissions may gate publication.');
+    }
+    return uniqueStrings(gates);
+}
+function verificationForWorkflow(surfaceType) {
+    if (surfaceType === 'npm_publish') {
+        return ['release_npm_version_available before tag or publish', 'release_npm_published_verify after publish'];
+    }
+    if (surfaceType === 'github_pages') {
+        return ['docs_validate before deploy', 'published Pages URL smoke check after deploy'];
+    }
+    if (surfaceType === 'github_release') {
+        return ['tag workflow run success', 'GitHub Release asset and metadata verification'];
+    }
+    if (surfaceType === 'container') {
+        return ['container image build', 'registry push and runtime smoke verification'];
+    }
+    if (surfaceType === 'cloudflare') {
+        return ['Cloudflare deploy or preview verification'];
+    }
+    if (surfaceType === 'vercel') {
+        return ['Vercel deploy verification'];
+    }
+    if (surfaceType === 'netlify') {
+        return ['Netlify deploy verification'];
+    }
+    return ['deployment workflow run success', 'post-deploy smoke verification'];
+}
+function addWorkflowSurface(seeds, content, relativePath, surfaceType, pattern, matchFallback) {
+    const match = firstMatchLine(content, pattern);
+    if (!match) {
+        return;
+    }
+    seeds.push({
+        kind: 'github_actions_workflow',
+        surfaceType,
+        path: relativePath,
+        line: match.line,
+        trigger: workflowTrigger(content),
+        confidence: surfaceType === 'generic_deploy' ? 'medium' : 'high',
+        match: match.match || matchFallback,
+        requiredVerification: verificationForWorkflow(surfaceType),
+        manualGates: workflowManualGates(content, surfaceType),
+    });
+}
+function scanWorkflowFile(root, relativePath, maxFileBytes, seeds, issues) {
+    const content = safeReadText(root, relativePath, maxFileBytes, issues);
+    if (content === null) {
+        return;
+    }
+    addWorkflowSurface(seeds, content, relativePath, 'npm_publish', /\b(?:npm|bun|pnpm)\s+publish\b|yarn\s+npm\s+publish\b|JS-DevTools\/npm-publish/u, 'npm publish');
+    addWorkflowSurface(seeds, content, relativePath, 'github_pages', /actions\/deploy-pages|pages:\s*write|github-pages|pages\.github\.io/u, 'GitHub Pages deploy');
+    addWorkflowSurface(seeds, content, relativePath, 'github_release', /softprops\/action-gh-release|gh\s+release\b|actions\/create-release|create-release/u, 'GitHub release');
+    addWorkflowSurface(seeds, content, relativePath, 'container', /docker\/build-push-action|\bdocker\s+(?:build|push)\b|ghcr\.io|container_registry/u, 'container build or push');
+    addWorkflowSurface(seeds, content, relativePath, 'cloudflare', /cloudflare\/wrangler-action|\bwrangler\s+deploy\b/u, 'Cloudflare deploy');
+    addWorkflowSurface(seeds, content, relativePath, 'vercel', /\bvercel\s+(?:deploy|--prod)\b/u, 'Vercel deploy');
+    addWorkflowSurface(seeds, content, relativePath, 'netlify', /\bnetlify\s+deploy\b|actions-netlify/u, 'Netlify deploy');
+    addWorkflowSurface(seeds, content, relativePath, 'generic_deploy', /\bdeploy(?:ment)?\b/u, 'deploy');
+}
+function scanPackageJson(root, maxFileBytes, seeds, issues) {
+    const relativePath = 'package.json';
+    if (!existsSync(path.join(root, relativePath))) {
+        return;
+    }
+    const content = safeReadText(root, relativePath, maxFileBytes, issues);
+    if (content === null) {
+        return;
+    }
+    let parsed;
+    try {
+        parsed = JSON.parse(content);
+    }
+    catch (error) {
+        const message = error instanceof Error ? error.message : String(error);
+        issues.push(`Could not parse ${relativePath}: ${message}`);
+        return;
+    }
+    if (!parsed || typeof parsed !== 'object') {
+        issues.push(`${relativePath} must contain a JSON object.`);
+        return;
+    }
+    const record = parsed;
+    const scripts = record.scripts;
+    if (scripts && typeof scripts === 'object' && !Array.isArray(scripts)) {
+        for (const [scriptName, scriptValue] of Object.entries(scripts)) {
+            if (typeof scriptValue !== 'string') {
+                continue;
+            }
+            const lowerName = scriptName.toLowerCase();
+            const lowerValue = scriptValue.toLowerCase();
+            const releaseLike = /(?:^|:)(?:deploy|release|publish|prepublishonly|postpublish)$/u.test(lowerName);
+            const commandLike = /\b(?:npm|bun|pnpm)\s+publish\b|yarn\s+npm\s+publish\b|\b(?:wrangler|vercel|netlify)\s+deploy\b|\bgh\s+release\b/u.test(lowerValue);
+            if (!releaseLike && !commandLike) {
+                continue;
+            }
+            const surfaceType = lowerValue.includes('wrangler')
+                ? 'cloudflare'
+                : lowerValue.includes('vercel')
+                    ? 'vercel'
+                    : lowerValue.includes('netlify')
+                        ? 'netlify'
+                        : lowerName.includes('publish') || lowerValue.includes('publish')
+                            ? 'npm_publish'
+                            : lowerName.includes('release') || lowerValue.includes('gh release')
+                                ? 'package_release'
+                                : 'generic_deploy';
+            const line = firstMatchLine(content, new RegExp(`"${scriptName.replace(/[.*+?^${}()|[\]\\]/gu, '\\$&')}"\\s*:`, 'u'));
+            seeds.push({
+                kind: 'package_script',
+                surfaceType,
+                path: relativePath,
+                line: line?.line ?? null,
+                trigger: `package script: ${scriptName}`,
+                confidence: commandLike ? 'high' : 'medium',
+                match: `${scriptName}: ${scriptValue}`,
+                requiredVerification: verificationForWorkflow(surfaceType),
+                manualGates: surfaceType === 'npm_publish'
+                    ? ['npm trusted publishing, token, or maintainer permission is required.']
+                    : [],
+            });
+        }
+    }
+    if (typeof record.name === 'string' &&
+        typeof record.version === 'string' &&
+        record.private !== true &&
+        (record.publishConfig || record.bin || record.exports)) {
+        const line = firstMatchLine(content, /"publishConfig"|"bin"|"exports"/u);
+        seeds.push({
+            kind: 'package_metadata',
+            surfaceType: 'npm_publish',
+            path: relativePath,
+            line: line?.line ?? null,
+            trigger: 'package metadata',
+            confidence: record.publishConfig ? 'high' : 'medium',
+            match: line?.match ?? 'publishable package metadata',
+            requiredVerification: ['release_npm_version_available before publish', 'release_npm_published_verify after publish'],
+            manualGates: ['npm trusted publishing, token, or maintainer permission is required.'],
+        });
+    }
+}
+function scanConfigSurfaces(root, seeds) {
+    for (const candidate of CONFIG_SURFACES) {
+        if (!existsSync(path.join(root, ...candidate.path.split('/')))) {
+            continue;
+        }
+        seeds.push({
+            kind: 'deploy_config',
+            surfaceType: candidate.type,
+            path: candidate.path,
+            line: null,
+            trigger: null,
+            confidence: 'medium',
+            match: candidate.match,
+            requiredVerification: candidate.requiredVerification,
+            manualGates: candidate.manualGates,
+        });
+    }
+}
+function seedId(seed, index) {
+    return `${seed.kind}:${seed.surfaceType}:${seed.path}:${seed.line ?? 0}:${index}`;
+}
+function toSurface(seed, index) {
+    return {
+        id: seedId(seed, index),
+        kind: seed.kind,
+        surface_type: seed.surfaceType,
+        path: seed.path,
+        line: seed.line,
+        trigger: seed.trigger,
+        confidence: seed.confidence,
+        evidence: {
+            path: seed.path,
+            line: seed.line,
+            match: seed.match,
+        },
+        required_verification: uniqueStrings(seed.requiredVerification),
+        manual_gates: uniqueStrings(seed.manualGates),
+    };
+}
+function createFindings(surfaces) {
+    return surfaces.map((surface) => ({
+        code: 'deploy_surface_detected',
+        severity: surface.confidence === 'high' ? 'medium' : 'low',
+        path: surface.path,
+        message: `Detected ${surface.surface_type} deploy surface in ${surface.path}.`,
+        json_pointer: null,
+        metric: null,
+        actual: null,
+        expected: null,
+    }));
+}
+function createSummary(surfaces) {
+    return {
+        has_deploy_surface: surfaces.length > 0,
+        surface_count: surfaces.length,
+        workflow_count: surfaces.filter((surface) => surface.kind === 'github_actions_workflow').length,
+        package_script_count: surfaces.filter((surface) => surface.kind === 'package_script').length,
+        config_file_count: surfaces.filter((surface) => surface.kind === 'deploy_config').length,
+        package_metadata_count: surfaces.filter((surface) => surface.kind === 'package_metadata').length,
+        manual_gate_count: uniqueStrings(surfaces.flatMap((surface) => surface.manual_gates)).length,
+        required_verification_count: uniqueStrings(surfaces.flatMap((surface) => surface.required_verification)).length,
+    };
+}
+function createInputHash(reportInput) {
+    return sha256(JSON.stringify(reportInput));
+}
+export function inspectRepoDeploySurface(projectRoot) {
+    const root = path.resolve(projectRoot);
+    const issues = [];
+    const maxFileBytes = DEFAULT_MAX_FILE_BYTES;
+    const scannedPaths = new Set();
+    const seeds = [];
+    for (const workflowPath of listWorkflowFiles(root, issues)) {
+        scannedPaths.add(workflowPath);
+        scanWorkflowFile(root, workflowPath, maxFileBytes, seeds, issues);
+    }
+    scannedPaths.add('package.json');
+    scanPackageJson(root, maxFileBytes, seeds, issues);
+    for (const candidate of CONFIG_SURFACES) {
+        scannedPaths.add(candidate.path);
+    }
+    scanConfigSurfaces(root, seeds);
+    const surfaces = seeds.map(toSurface).sort((left, right) => left.path.localeCompare(right.path) || left.id.localeCompare(right.id));
+    const summary = createSummary(surfaces);
+    const requiredVerification = uniqueStrings(surfaces.flatMap((surface) => surface.required_verification));
+    const manualGates = uniqueStrings(surfaces.flatMap((surface) => surface.manual_gates));
+    const findings = createFindings(surfaces);
+    const status = issues.length > 0 ? 'error' : 'passed';
+    return {
+        schema_version: '1',
+        command: 'script-pack',
+        pack_id: REPO_DEPLOY_SURFACE_PACK_ID,
+        script_id: REPO_DEPLOY_SURFACE_SCRIPT_ID,
+        script_ref: REPO_DEPLOY_SURFACE_SCRIPT_REF,
+        action: 'inspect',
+        status,
+        ok: status === 'passed',
+        mustflow_root: root,
+        input: {
+            scanned_paths: uniqueStrings(scannedPaths),
+            max_file_bytes: maxFileBytes,
+        },
+        input_hash: createInputHash({ summary, surfaces, requiredVerification, manualGates, findings, issues }),
+        has_deploy_surface: summary.has_deploy_surface,
+        summary,
+        surfaces,
+        required_verification: requiredVerification,
+        manual_gates: manualGates,
+        findings,
+        issues,
+    };
+}