mustflow 2.103.10 → 2.103.14

package/dist/cli/commands/script-pack.js

@@ -76,6 +76,7 @@ export function getScriptPackHelp(lang = 'en') {
             'mf script-pack run repo/config-chain inspect src/cli/index.ts --json',
             'mf script-pack run repo/env-contract scan --json',
             'mf script-pack run repo/secret-risk-scan scan src README.md --json',
+            'mf script-pack run repo/security-pattern-scan scan src .github/workflows --json',
             'mf script-pack run repo/generated-boundary check src/cli/index.ts --json',
             'mf script-pack run repo/merge-conflict-scan check --json',
             'mf script-pack run repo/git-ignore-audit audit .env.local dist/app.js --json',
@@ -83,6 +84,7 @@ export function getScriptPackHelp(lang = 'en') {
             'mf script-pack run repo/skill-route-audit audit --json',
             'mf script-pack run repo/version-source inspect --json',
             'mf script-pack run repo/approval-gate check --action git_commit --json',
+            'mf script-pack run repo/deploy-surface inspect --json',
             'mf script-pack run repo/related-files map src/cli/index.ts --json',
             'mf script-pack run core/text-budget --help',
         ],

package/dist/cli/i18n/en.js

@@ -1123,9 +1123,29 @@ Read these files before working:
     "secretRiskScan.error.missingAction": "Specify a secret-risk-scan action: scan",
     "secretRiskScan.error.unknownAction": "Unknown secret-risk-scan action: {action}",
     "secretRiskScan.error.invalidPositiveInteger": "{option} must be a positive safe integer: {value}",
+    "scriptPack.script.securityPatternScan.summary": "Scan repository files for high-signal security code patterns",
+    "securityPatternScan.help.summary": "Scan source, CI, and config files for security code-pattern leads without printing matched source lines or secret values.",
+    "securityPatternScan.help.option.maxFiles": "Maximum number of files to inspect. Default: 1000",
+    "securityPatternScan.help.option.maxFileBytes": "Maximum bytes to read from each inspected file. Default: 262144",
+    "securityPatternScan.help.option.maxFindings": "Maximum number of findings to report. Default: 300",
+    "securityPatternScan.help.exit.ok": "The security-pattern scan completed without blocking findings",
+    "securityPatternScan.help.exit.fail": "The security-pattern scan found invalid input, unreadable files, or security-pattern findings",
+    "securityPatternScan.title": "mustflow security pattern scan",
+    "securityPatternScan.label.files": "Files",
+    "securityPatternScan.label.findings": "Findings",
+    "securityPatternScan.label.categories": "Categories",
+    "securityPatternScan.label.highOrCritical": "High or critical",
+    "securityPatternScan.label.truncated": "Truncated",
+    "securityPatternScan.label.reviewFocus": "Review focus",
+    "securityPatternScan.label.issues": "Issues",
+    "securityPatternScan.clean": "No high-signal security code patterns were found.",
+    "securityPatternScan.error.missingAction": "Specify a security-pattern-scan action: scan",
+    "securityPatternScan.error.unknownAction": "Unknown security-pattern-scan action: {action}",
+    "securityPatternScan.error.invalidPositiveInteger": "{option} must be a positive safe integer: {value}",
     "scriptPack.script.skillRouteAudit.summary": "Audit skill routes, template skill copies, manifest profiles, and i18n metadata for drift",
     "scriptPack.script.versionSource.summary": "Inspect repository version sources before release metadata changes",
     "scriptPack.script.approvalGate.summary": "Check planned actions against repository approval policy gates",
+    "scriptPack.script.deploySurface.summary": "Inspect repository deploy and release surfaces with verification gates",
     "scriptPack.script.mergeConflictScan.summary": "Scan repository files for unresolved Git merge conflict markers",
     "scriptPack.script.gitIgnoreAudit.summary": "Audit Git ignore rules and path visibility evidence",
     "scriptPack.script.manifestLockDrift.summary": "Check manifest-lock file hashes against current repository files",
@@ -1165,6 +1185,19 @@ Read these files before working:
     "approvalGate.error.missingAction": "Specify an approval-gate action: check",
     "approvalGate.error.unknownAction": "Unknown approval-gate action: {action}",
     "approvalGate.error.missingActionType": "Specify at least one --action <type>",
+    "deploySurface.help.summary": "Inspect workflows, package metadata, package scripts, and deploy config files for local deploy or release surfaces.",
+    "deploySurface.help.exit.ok": "The deploy-surface report was generated",
+    "deploySurface.help.exit.fail": "The deploy-surface report found unreadable metadata or invalid input",
+    "deploySurface.title": "mustflow deploy surface",
+    "deploySurface.label.deploySurface": "Deploy surface detected",
+    "deploySurface.label.surfaces": "Surfaces",
+    "deploySurface.label.surfaceDetails": "Surface details",
+    "deploySurface.label.requiredVerification": "Required verification",
+    "deploySurface.label.manualGates": "Manual gates",
+    "deploySurface.label.issues": "Issues",
+    "deploySurface.noSurfaces": "No local deploy or release surface was detected.",
+    "deploySurface.error.missingAction": "Specify a deploy-surface action: inspect",
+    "deploySurface.error.unknownAction": "Unknown deploy-surface action: {action}",
     "mergeConflictScan.help.summary": "Scan changed files or explicit paths for unresolved Git merge conflict markers without printing file content.",
     "mergeConflictScan.help.option.maxFiles": "Maximum files to scan. Default: 1000",
     "mergeConflictScan.help.option.maxFileBytes": "Maximum bytes to read from each file. Default: 524288",

package/dist/cli/i18n/es.js

@@ -1123,9 +1123,29 @@ Lee estos archivos antes de trabajar:
     "secretRiskScan.error.missingAction": "Specify a secret-risk-scan action: scan",
     "secretRiskScan.error.unknownAction": "Unknown secret-risk-scan action: {action}",
     "secretRiskScan.error.invalidPositiveInteger": "{option} must be a positive safe integer: {value}",
+    "scriptPack.script.securityPatternScan.summary": "Scan repository files for high-signal security code patterns",
+    "securityPatternScan.help.summary": "Scan source, CI, and config files for security code-pattern leads without printing matched source lines or secret values.",
+    "securityPatternScan.help.option.maxFiles": "Maximum number of files to inspect. Default: 1000",
+    "securityPatternScan.help.option.maxFileBytes": "Maximum bytes to read from each inspected file. Default: 262144",
+    "securityPatternScan.help.option.maxFindings": "Maximum number of findings to report. Default: 300",
+    "securityPatternScan.help.exit.ok": "The security-pattern scan completed without blocking findings",
+    "securityPatternScan.help.exit.fail": "The security-pattern scan found invalid input, unreadable files, or security-pattern findings",
+    "securityPatternScan.title": "mustflow security pattern scan",
+    "securityPatternScan.label.files": "Files",
+    "securityPatternScan.label.findings": "Findings",
+    "securityPatternScan.label.categories": "Categories",
+    "securityPatternScan.label.highOrCritical": "High or critical",
+    "securityPatternScan.label.truncated": "Truncated",
+    "securityPatternScan.label.reviewFocus": "Review focus",
+    "securityPatternScan.label.issues": "Issues",
+    "securityPatternScan.clean": "No high-signal security code patterns were found.",
+    "securityPatternScan.error.missingAction": "Specify a security-pattern-scan action: scan",
+    "securityPatternScan.error.unknownAction": "Unknown security-pattern-scan action: {action}",
+    "securityPatternScan.error.invalidPositiveInteger": "{option} must be a positive safe integer: {value}",
     "scriptPack.script.skillRouteAudit.summary": "Audit skill routes, template skill copies, manifest profiles, and i18n metadata for drift",
     "scriptPack.script.versionSource.summary": "Inspect repository version sources before release metadata changes",
     "scriptPack.script.approvalGate.summary": "Check planned actions against repository approval policy gates",
+    "scriptPack.script.deploySurface.summary": "Inspect repository deploy and release surfaces with verification gates",
     "scriptPack.script.mergeConflictScan.summary": "Scan repository files for unresolved Git merge conflict markers",
     "scriptPack.script.gitIgnoreAudit.summary": "Audit Git ignore rules and path visibility evidence",
     "scriptPack.script.manifestLockDrift.summary": "Check manifest-lock file hashes against current repository files",
@@ -1165,6 +1185,19 @@ Lee estos archivos antes de trabajar:
     "approvalGate.error.missingAction": "Specify an approval-gate action: check",
     "approvalGate.error.unknownAction": "Unknown approval-gate action: {action}",
     "approvalGate.error.missingActionType": "Specify at least one --action <type>",
+    "deploySurface.help.summary": "Inspect workflows, package metadata, package scripts, and deploy config files for local deploy or release surfaces.",
+    "deploySurface.help.exit.ok": "The deploy-surface report was generated",
+    "deploySurface.help.exit.fail": "The deploy-surface report found unreadable metadata or invalid input",
+    "deploySurface.title": "mustflow deploy surface",
+    "deploySurface.label.deploySurface": "Deploy surface detected",
+    "deploySurface.label.surfaces": "Surfaces",
+    "deploySurface.label.surfaceDetails": "Surface details",
+    "deploySurface.label.requiredVerification": "Required verification",
+    "deploySurface.label.manualGates": "Manual gates",
+    "deploySurface.label.issues": "Issues",
+    "deploySurface.noSurfaces": "No local deploy or release surface was detected.",
+    "deploySurface.error.missingAction": "Specify a deploy-surface action: inspect",
+    "deploySurface.error.unknownAction": "Unknown deploy-surface action: {action}",
     "mergeConflictScan.help.summary": "Scan changed files or explicit paths for unresolved Git merge conflict markers without printing file content.",
     "mergeConflictScan.help.option.maxFiles": "Maximum files to scan. Default: 1000",
     "mergeConflictScan.help.option.maxFileBytes": "Maximum bytes to read from each file. Default: 524288",

package/dist/cli/i18n/fr.js

@@ -1123,9 +1123,29 @@ Lisez ces fichiers avant de travailler :
     "secretRiskScan.error.missingAction": "Specify a secret-risk-scan action: scan",
     "secretRiskScan.error.unknownAction": "Unknown secret-risk-scan action: {action}",
     "secretRiskScan.error.invalidPositiveInteger": "{option} must be a positive safe integer: {value}",
+    "scriptPack.script.securityPatternScan.summary": "Scan repository files for high-signal security code patterns",
+    "securityPatternScan.help.summary": "Scan source, CI, and config files for security code-pattern leads without printing matched source lines or secret values.",
+    "securityPatternScan.help.option.maxFiles": "Maximum number of files to inspect. Default: 1000",
+    "securityPatternScan.help.option.maxFileBytes": "Maximum bytes to read from each inspected file. Default: 262144",
+    "securityPatternScan.help.option.maxFindings": "Maximum number of findings to report. Default: 300",
+    "securityPatternScan.help.exit.ok": "The security-pattern scan completed without blocking findings",
+    "securityPatternScan.help.exit.fail": "The security-pattern scan found invalid input, unreadable files, or security-pattern findings",
+    "securityPatternScan.title": "mustflow security pattern scan",
+    "securityPatternScan.label.files": "Files",
+    "securityPatternScan.label.findings": "Findings",
+    "securityPatternScan.label.categories": "Categories",
+    "securityPatternScan.label.highOrCritical": "High or critical",
+    "securityPatternScan.label.truncated": "Truncated",
+    "securityPatternScan.label.reviewFocus": "Review focus",
+    "securityPatternScan.label.issues": "Issues",
+    "securityPatternScan.clean": "No high-signal security code patterns were found.",
+    "securityPatternScan.error.missingAction": "Specify a security-pattern-scan action: scan",
+    "securityPatternScan.error.unknownAction": "Unknown security-pattern-scan action: {action}",
+    "securityPatternScan.error.invalidPositiveInteger": "{option} must be a positive safe integer: {value}",
     "scriptPack.script.skillRouteAudit.summary": "Audit skill routes, template skill copies, manifest profiles, and i18n metadata for drift",
     "scriptPack.script.versionSource.summary": "Inspect repository version sources before release metadata changes",
     "scriptPack.script.approvalGate.summary": "Check planned actions against repository approval policy gates",
+    "scriptPack.script.deploySurface.summary": "Inspect repository deploy and release surfaces with verification gates",
     "scriptPack.script.mergeConflictScan.summary": "Scan repository files for unresolved Git merge conflict markers",
     "scriptPack.script.gitIgnoreAudit.summary": "Audit Git ignore rules and path visibility evidence",
     "scriptPack.script.manifestLockDrift.summary": "Check manifest-lock file hashes against current repository files",
@@ -1165,6 +1185,19 @@ Lisez ces fichiers avant de travailler :
     "approvalGate.error.missingAction": "Specify an approval-gate action: check",
     "approvalGate.error.unknownAction": "Unknown approval-gate action: {action}",
     "approvalGate.error.missingActionType": "Specify at least one --action <type>",
+    "deploySurface.help.summary": "Inspect workflows, package metadata, package scripts, and deploy config files for local deploy or release surfaces.",
+    "deploySurface.help.exit.ok": "The deploy-surface report was generated",
+    "deploySurface.help.exit.fail": "The deploy-surface report found unreadable metadata or invalid input",
+    "deploySurface.title": "mustflow deploy surface",
+    "deploySurface.label.deploySurface": "Deploy surface detected",
+    "deploySurface.label.surfaces": "Surfaces",
+    "deploySurface.label.surfaceDetails": "Surface details",
+    "deploySurface.label.requiredVerification": "Required verification",
+    "deploySurface.label.manualGates": "Manual gates",
+    "deploySurface.label.issues": "Issues",
+    "deploySurface.noSurfaces": "No local deploy or release surface was detected.",
+    "deploySurface.error.missingAction": "Specify a deploy-surface action: inspect",
+    "deploySurface.error.unknownAction": "Unknown deploy-surface action: {action}",
     "mergeConflictScan.help.summary": "Scan changed files or explicit paths for unresolved Git merge conflict markers without printing file content.",
     "mergeConflictScan.help.option.maxFiles": "Maximum files to scan. Default: 1000",
     "mergeConflictScan.help.option.maxFileBytes": "Maximum bytes to read from each file. Default: 524288",

package/dist/cli/i18n/hi.js

@@ -1123,9 +1123,29 @@ export const hiMessages = {
     "secretRiskScan.error.missingAction": "Specify a secret-risk-scan action: scan",
     "secretRiskScan.error.unknownAction": "Unknown secret-risk-scan action: {action}",
     "secretRiskScan.error.invalidPositiveInteger": "{option} must be a positive safe integer: {value}",
+    "scriptPack.script.securityPatternScan.summary": "Scan repository files for high-signal security code patterns",
+    "securityPatternScan.help.summary": "Scan source, CI, and config files for security code-pattern leads without printing matched source lines or secret values.",
+    "securityPatternScan.help.option.maxFiles": "Maximum number of files to inspect. Default: 1000",
+    "securityPatternScan.help.option.maxFileBytes": "Maximum bytes to read from each inspected file. Default: 262144",
+    "securityPatternScan.help.option.maxFindings": "Maximum number of findings to report. Default: 300",
+    "securityPatternScan.help.exit.ok": "The security-pattern scan completed without blocking findings",
+    "securityPatternScan.help.exit.fail": "The security-pattern scan found invalid input, unreadable files, or security-pattern findings",
+    "securityPatternScan.title": "mustflow security pattern scan",
+    "securityPatternScan.label.files": "Files",
+    "securityPatternScan.label.findings": "Findings",
+    "securityPatternScan.label.categories": "Categories",
+    "securityPatternScan.label.highOrCritical": "High or critical",
+    "securityPatternScan.label.truncated": "Truncated",
+    "securityPatternScan.label.reviewFocus": "Review focus",
+    "securityPatternScan.label.issues": "Issues",
+    "securityPatternScan.clean": "No high-signal security code patterns were found.",
+    "securityPatternScan.error.missingAction": "Specify a security-pattern-scan action: scan",
+    "securityPatternScan.error.unknownAction": "Unknown security-pattern-scan action: {action}",
+    "securityPatternScan.error.invalidPositiveInteger": "{option} must be a positive safe integer: {value}",
     "scriptPack.script.skillRouteAudit.summary": "Audit skill routes, template skill copies, manifest profiles, and i18n metadata for drift",
     "scriptPack.script.versionSource.summary": "Inspect repository version sources before release metadata changes",
     "scriptPack.script.approvalGate.summary": "Check planned actions against repository approval policy gates",
+    "scriptPack.script.deploySurface.summary": "Inspect repository deploy and release surfaces with verification gates",
     "scriptPack.script.mergeConflictScan.summary": "Scan repository files for unresolved Git merge conflict markers",
     "scriptPack.script.gitIgnoreAudit.summary": "Audit Git ignore rules and path visibility evidence",
     "scriptPack.script.manifestLockDrift.summary": "Check manifest-lock file hashes against current repository files",
@@ -1165,6 +1185,19 @@ export const hiMessages = {
     "approvalGate.error.missingAction": "Specify an approval-gate action: check",
     "approvalGate.error.unknownAction": "Unknown approval-gate action: {action}",
     "approvalGate.error.missingActionType": "Specify at least one --action <type>",
+    "deploySurface.help.summary": "Inspect workflows, package metadata, package scripts, and deploy config files for local deploy or release surfaces.",
+    "deploySurface.help.exit.ok": "The deploy-surface report was generated",
+    "deploySurface.help.exit.fail": "The deploy-surface report found unreadable metadata or invalid input",
+    "deploySurface.title": "mustflow deploy surface",
+    "deploySurface.label.deploySurface": "Deploy surface detected",
+    "deploySurface.label.surfaces": "Surfaces",
+    "deploySurface.label.surfaceDetails": "Surface details",
+    "deploySurface.label.requiredVerification": "Required verification",
+    "deploySurface.label.manualGates": "Manual gates",
+    "deploySurface.label.issues": "Issues",
+    "deploySurface.noSurfaces": "No local deploy or release surface was detected.",
+    "deploySurface.error.missingAction": "Specify a deploy-surface action: inspect",
+    "deploySurface.error.unknownAction": "Unknown deploy-surface action: {action}",
     "mergeConflictScan.help.summary": "Scan changed files or explicit paths for unresolved Git merge conflict markers without printing file content.",
     "mergeConflictScan.help.option.maxFiles": "Maximum files to scan. Default: 1000",
     "mergeConflictScan.help.option.maxFileBytes": "Maximum bytes to read from each file. Default: 524288",

package/dist/cli/i18n/ko.js

@@ -1123,9 +1123,29 @@ export const koMessages = {
     "secretRiskScan.error.missingAction": "Specify a secret-risk-scan action: scan",
     "secretRiskScan.error.unknownAction": "Unknown secret-risk-scan action: {action}",
     "secretRiskScan.error.invalidPositiveInteger": "{option} must be a positive safe integer: {value}",
+    "scriptPack.script.securityPatternScan.summary": "Scan repository files for high-signal security code patterns",
+    "securityPatternScan.help.summary": "Scan source, CI, and config files for security code-pattern leads without printing matched source lines or secret values.",
+    "securityPatternScan.help.option.maxFiles": "Maximum number of files to inspect. Default: 1000",
+    "securityPatternScan.help.option.maxFileBytes": "Maximum bytes to read from each inspected file. Default: 262144",
+    "securityPatternScan.help.option.maxFindings": "Maximum number of findings to report. Default: 300",
+    "securityPatternScan.help.exit.ok": "The security-pattern scan completed without blocking findings",
+    "securityPatternScan.help.exit.fail": "The security-pattern scan found invalid input, unreadable files, or security-pattern findings",
+    "securityPatternScan.title": "mustflow security pattern scan",
+    "securityPatternScan.label.files": "Files",
+    "securityPatternScan.label.findings": "Findings",
+    "securityPatternScan.label.categories": "Categories",
+    "securityPatternScan.label.highOrCritical": "High or critical",
+    "securityPatternScan.label.truncated": "Truncated",
+    "securityPatternScan.label.reviewFocus": "Review focus",
+    "securityPatternScan.label.issues": "Issues",
+    "securityPatternScan.clean": "No high-signal security code patterns were found.",
+    "securityPatternScan.error.missingAction": "Specify a security-pattern-scan action: scan",
+    "securityPatternScan.error.unknownAction": "Unknown security-pattern-scan action: {action}",
+    "securityPatternScan.error.invalidPositiveInteger": "{option} must be a positive safe integer: {value}",
     "scriptPack.script.skillRouteAudit.summary": "Audit skill routes, template skill copies, manifest profiles, and i18n metadata for drift",
     "scriptPack.script.versionSource.summary": "Inspect repository version sources before release metadata changes",
     "scriptPack.script.approvalGate.summary": "Check planned actions against repository approval policy gates",
+    "scriptPack.script.deploySurface.summary": "Inspect repository deploy and release surfaces with verification gates",
     "scriptPack.script.mergeConflictScan.summary": "Scan repository files for unresolved Git merge conflict markers",
     "scriptPack.script.gitIgnoreAudit.summary": "Audit Git ignore rules and path visibility evidence",
     "scriptPack.script.manifestLockDrift.summary": "Check manifest-lock file hashes against current repository files",
@@ -1165,6 +1185,19 @@ export const koMessages = {
     "approvalGate.error.missingAction": "Specify an approval-gate action: check",
     "approvalGate.error.unknownAction": "Unknown approval-gate action: {action}",
     "approvalGate.error.missingActionType": "Specify at least one --action <type>",
+    "deploySurface.help.summary": "Inspect workflows, package metadata, package scripts, and deploy config files for local deploy or release surfaces.",
+    "deploySurface.help.exit.ok": "The deploy-surface report was generated",
+    "deploySurface.help.exit.fail": "The deploy-surface report found unreadable metadata or invalid input",
+    "deploySurface.title": "mustflow deploy surface",
+    "deploySurface.label.deploySurface": "Deploy surface detected",
+    "deploySurface.label.surfaces": "Surfaces",
+    "deploySurface.label.surfaceDetails": "Surface details",
+    "deploySurface.label.requiredVerification": "Required verification",
+    "deploySurface.label.manualGates": "Manual gates",
+    "deploySurface.label.issues": "Issues",
+    "deploySurface.noSurfaces": "No local deploy or release surface was detected.",
+    "deploySurface.error.missingAction": "Specify a deploy-surface action: inspect",
+    "deploySurface.error.unknownAction": "Unknown deploy-surface action: {action}",
     "mergeConflictScan.help.summary": "Scan changed files or explicit paths for unresolved Git merge conflict markers without printing file content.",
     "mergeConflictScan.help.option.maxFiles": "Maximum files to scan. Default: 1000",
     "mergeConflictScan.help.option.maxFileBytes": "Maximum bytes to read from each file. Default: 524288",

package/dist/cli/i18n/zh.js

@@ -1123,9 +1123,29 @@ export const zhMessages = {
     "secretRiskScan.error.missingAction": "Specify a secret-risk-scan action: scan",
     "secretRiskScan.error.unknownAction": "Unknown secret-risk-scan action: {action}",
     "secretRiskScan.error.invalidPositiveInteger": "{option} must be a positive safe integer: {value}",
+    "scriptPack.script.securityPatternScan.summary": "Scan repository files for high-signal security code patterns",
+    "securityPatternScan.help.summary": "Scan source, CI, and config files for security code-pattern leads without printing matched source lines or secret values.",
+    "securityPatternScan.help.option.maxFiles": "Maximum number of files to inspect. Default: 1000",
+    "securityPatternScan.help.option.maxFileBytes": "Maximum bytes to read from each inspected file. Default: 262144",
+    "securityPatternScan.help.option.maxFindings": "Maximum number of findings to report. Default: 300",
+    "securityPatternScan.help.exit.ok": "The security-pattern scan completed without blocking findings",
+    "securityPatternScan.help.exit.fail": "The security-pattern scan found invalid input, unreadable files, or security-pattern findings",
+    "securityPatternScan.title": "mustflow security pattern scan",
+    "securityPatternScan.label.files": "Files",
+    "securityPatternScan.label.findings": "Findings",
+    "securityPatternScan.label.categories": "Categories",
+    "securityPatternScan.label.highOrCritical": "High or critical",
+    "securityPatternScan.label.truncated": "Truncated",
+    "securityPatternScan.label.reviewFocus": "Review focus",
+    "securityPatternScan.label.issues": "Issues",
+    "securityPatternScan.clean": "No high-signal security code patterns were found.",
+    "securityPatternScan.error.missingAction": "Specify a security-pattern-scan action: scan",
+    "securityPatternScan.error.unknownAction": "Unknown security-pattern-scan action: {action}",
+    "securityPatternScan.error.invalidPositiveInteger": "{option} must be a positive safe integer: {value}",
     "scriptPack.script.skillRouteAudit.summary": "Audit skill routes, template skill copies, manifest profiles, and i18n metadata for drift",
     "scriptPack.script.versionSource.summary": "Inspect repository version sources before release metadata changes",
     "scriptPack.script.approvalGate.summary": "Check planned actions against repository approval policy gates",
+    "scriptPack.script.deploySurface.summary": "Inspect repository deploy and release surfaces with verification gates",
     "scriptPack.script.mergeConflictScan.summary": "Scan repository files for unresolved Git merge conflict markers",
     "scriptPack.script.gitIgnoreAudit.summary": "Audit Git ignore rules and path visibility evidence",
     "scriptPack.script.manifestLockDrift.summary": "Check manifest-lock file hashes against current repository files",
@@ -1165,6 +1185,19 @@ export const zhMessages = {
     "approvalGate.error.missingAction": "Specify an approval-gate action: check",
     "approvalGate.error.unknownAction": "Unknown approval-gate action: {action}",
     "approvalGate.error.missingActionType": "Specify at least one --action <type>",
+    "deploySurface.help.summary": "Inspect workflows, package metadata, package scripts, and deploy config files for local deploy or release surfaces.",
+    "deploySurface.help.exit.ok": "The deploy-surface report was generated",
+    "deploySurface.help.exit.fail": "The deploy-surface report found unreadable metadata or invalid input",
+    "deploySurface.title": "mustflow deploy surface",
+    "deploySurface.label.deploySurface": "Deploy surface detected",
+    "deploySurface.label.surfaces": "Surfaces",
+    "deploySurface.label.surfaceDetails": "Surface details",
+    "deploySurface.label.requiredVerification": "Required verification",
+    "deploySurface.label.manualGates": "Manual gates",
+    "deploySurface.label.issues": "Issues",
+    "deploySurface.noSurfaces": "No local deploy or release surface was detected.",
+    "deploySurface.error.missingAction": "Specify a deploy-surface action: inspect",
+    "deploySurface.error.unknownAction": "Unknown deploy-surface action: {action}",
     "mergeConflictScan.help.summary": "Scan changed files or explicit paths for unresolved Git merge conflict markers without printing file content.",
     "mergeConflictScan.help.option.maxFiles": "Maximum files to scan. Default: 1000",
     "mergeConflictScan.help.option.maxFileBytes": "Maximum bytes to read from each file. Default: 524288",

package/dist/cli/lib/script-pack-registry.js

@@ -453,6 +453,35 @@ export const SCRIPT_PACKS = [
                 reportSchemaFile: 'secret-risk-scan-report.schema.json',
                 loadRunner: async () => (await import('../script-packs/repo-secret-risk-scan.js')).runRepoSecretRiskScanScript,
             },
+            {
+                packId: 'repo',
+                id: 'security-pattern-scan',
+                ref: scriptRef('repo', 'security-pattern-scan'),
+                usage: 'mf script-pack run repo/security-pattern-scan scan [path...] [options]',
+                summaryKey: 'scriptPack.script.securityPatternScan.summary',
+                actions: ['scan'],
+                useWhen: [
+                    'Scan source, CI, and config files for high-signal security code patterns without printing matched source lines or secret values.',
+                    'Review filesystem, command, injection, browser, token, session, parser, logging, access-control, and transport-security pattern leads before source-to-sink review.',
+                ],
+                phases: ['before_change', 'after_change', 'review'],
+                readOnly: true,
+                mutates: false,
+                network: false,
+                inputs: ['path', 'max_files', 'max_file_bytes', 'max_findings'],
+                outputs: ['human_summary', 'json_report', 'security_pattern_findings', 'review_focus'],
+                relatedSkills: [
+                    'api-access-control-review',
+                    'file-upload-security-review',
+                    'security-flow-review',
+                    'security-privacy-review',
+                    'security-regression-tests',
+                ],
+                riskLevel: 'medium',
+                cost: 'low',
+                reportSchemaFile: 'security-pattern-scan-report.schema.json',
+                loadRunner: async () => (await import('../script-packs/repo-security-pattern-scan.js')).runRepoSecurityPatternScanScript,
+            },
             {
                 packId: 'repo',
                 id: 'generated-boundary',
@@ -655,6 +684,34 @@ export const SCRIPT_PACKS = [
                 reportSchemaFile: 'repo-approval-gate-report.schema.json',
                 loadRunner: async () => (await import('../script-packs/repo-approval-gate.js')).runRepoApprovalGateScript,
             },
+            {
+                packId: 'repo',
+                id: 'deploy-surface',
+                ref: scriptRef('repo', 'deploy-surface'),
+                usage: 'mf script-pack run repo/deploy-surface inspect [options]',
+                summaryKey: 'scriptPack.script.deploySurface.summary',
+                actions: ['inspect'],
+                useWhen: [
+                    'Inspect local workflows, package metadata, package scripts, and deploy config files before claiming push, tag, release, or deploy follow-up is available.',
+                    'Review detected deploy surfaces with trigger, required verification, and manual gate evidence after repository changes.',
+                ],
+                phases: ['before_change', 'after_change', 'review'],
+                readOnly: true,
+                mutates: false,
+                network: false,
+                inputs: [],
+                outputs: ['human_summary', 'json_report', 'deploy_surfaces', 'required_verification', 'manual_gates'],
+                relatedSkills: [
+                    'completion-evidence-gate',
+                    'deployment-rollout-safety-review',
+                    'public-json-contract-change',
+                    'release-publish-change',
+                ],
+                riskLevel: 'low',
+                cost: 'low',
+                reportSchemaFile: 'repo-deploy-surface-report.schema.json',
+                loadRunner: async () => (await import('../script-packs/repo-deploy-surface.js')).runRepoDeploySurfaceScript,
+            },
             {
                 packId: 'repo',
                 id: 'related-files',

package/dist/cli/script-packs/repo-deploy-surface.js

@@ -0,0 +1,98 @@
+import { printUsageError, renderHelp } from '../lib/cli-output.js';
+import { t } from '../lib/i18n.js';
+import { formatCliOptionParseError, hasCliOptionToken, hasParsedCliOption, parseCliOptions, } from '../lib/option-parser.js';
+import { resolveMustflowRoot } from '../lib/project-root.js';
+import { inspectRepoDeploySurface, REPO_DEPLOY_SURFACE_SCRIPT_REF, } from '../../core/repo-deploy-surface.js';
+const REPO_DEPLOY_SURFACE_OPTIONS = [{ name: '--json', kind: 'boolean' }];
+export function getRepoDeploySurfaceHelp(lang = 'en') {
+    return renderHelp({
+        usage: 'mf script-pack run repo/deploy-surface inspect [options]',
+        summary: t(lang, 'deploySurface.help.summary'),
+        options: [
+            { label: '--json', description: t(lang, 'cli.option.json') },
+            { label: '-h, --help', description: t(lang, 'cli.option.help') },
+        ],
+        examples: [
+            'mf script-pack run repo/deploy-surface inspect',
+            'mf script-pack run repo/deploy-surface inspect --json',
+        ],
+        exitCodes: [
+            { label: '0', description: t(lang, 'deploySurface.help.exit.ok') },
+            { label: '1', description: t(lang, 'deploySurface.help.exit.fail') },
+        ],
+    }, lang);
+}
+function parseRepoDeploySurfaceOptions(args, lang) {
+    const [action, ...rest] = args;
+    const parsed = parseCliOptions(rest, REPO_DEPLOY_SURFACE_OPTIONS, { allowPositionals: false });
+    const json = hasParsedCliOption(parsed, '--json');
+    if (action !== 'inspect') {
+        return {
+            action: 'inspect',
+            json,
+            error: action
+                ? t(lang, 'deploySurface.error.unknownAction', { action })
+                : t(lang, 'deploySurface.error.missingAction'),
+        };
+    }
+    if (parsed.error) {
+        return { action, json, error: formatCliOptionParseError(parsed.error, lang) };
+    }
+    return { action, json };
+}
+function renderRepoDeploySurfaceSummary(report, lang) {
+    const lines = [
+        t(lang, 'deploySurface.title'),
+        `${t(lang, 'scriptPack.label.script')}: ${REPO_DEPLOY_SURFACE_SCRIPT_REF}`,
+        `${t(lang, 'label.status')}: ${report.status}`,
+        `${t(lang, 'deploySurface.label.deploySurface')}: ${report.has_deploy_surface ? t(lang, 'value.yes') : t(lang, 'value.no')}`,
+        `${t(lang, 'deploySurface.label.surfaces')}: ${report.summary.surface_count}`,
+        `${t(lang, 'deploySurface.label.requiredVerification')}: ${report.summary.required_verification_count}`,
+        `${t(lang, 'deploySurface.label.manualGates')}: ${report.summary.manual_gate_count}`,
+    ];
+    if (report.surfaces.length > 0) {
+        lines.push(t(lang, 'deploySurface.label.surfaceDetails'));
+        for (const surface of report.surfaces) {
+            const location = surface.line === null ? surface.path : `${surface.path}:${surface.line}`;
+            const trigger = surface.trigger === null ? '' : `, trigger ${surface.trigger}`;
+            lines.push(`- ${surface.surface_type} (${surface.kind}) at ${location}${trigger}`);
+        }
+    }
+    if (report.required_verification.length > 0) {
+        lines.push(t(lang, 'deploySurface.label.requiredVerification'));
+        for (const verification of report.required_verification) {
+            lines.push(`- ${verification}`);
+        }
+    }
+    if (report.manual_gates.length > 0) {
+        lines.push(t(lang, 'deploySurface.label.manualGates'));
+        for (const gate of report.manual_gates) {
+            lines.push(`- ${gate}`);
+        }
+    }
+    if (report.issues.length > 0) {
+        lines.push(t(lang, 'deploySurface.label.issues'), ...report.issues.map((issue) => `- ${issue}`));
+    }
+    if (!report.has_deploy_surface && report.issues.length === 0) {
+        lines.push(t(lang, 'deploySurface.noSurfaces'));
+    }
+    return lines.join('\n');
+}
+export function runRepoDeploySurfaceScript(args, reporter, lang = 'en') {
+    if (hasCliOptionToken(args, '--help', ['-h'])) {
+        reporter.stdout(getRepoDeploySurfaceHelp(lang));
+        return 0;
+    }
+    const options = parseRepoDeploySurfaceOptions(args, lang);
+    if (options.error) {
+        printUsageError(reporter, options.error, 'mf script-pack run repo/deploy-surface --help', getRepoDeploySurfaceHelp(lang), lang);
+        return 1;
+    }
+    const report = inspectRepoDeploySurface(resolveMustflowRoot());
+    if (options.json) {
+        reporter.stdout(JSON.stringify(report, null, 2));
+        return report.ok ? 0 : 1;
+    }
+    reporter.stdout(renderRepoDeploySurfaceSummary(report, lang));
+    return report.ok ? 0 : 1;
+}