mustflow 2.103.16 → 2.103.20

package/dist/core/module-boundary.js

@@ -0,0 +1,523 @@
+import { createHash } from 'node:crypto';
+import { existsSync, lstatSync, readdirSync } from 'node:fs';
+import path from 'node:path';
+import { DEPENDENCY_GRAPH_SCRIPT_REF, inspectDependencyGraph, } from './dependency-graph.js';
+import { DEFAULT_IGNORED_DIRECTORIES, isIgnoredDirectoryPath } from './ignored-directories.js';
+import { ensureInside, ensureInsideWithoutSymlinks, readFileInsideWithoutSymlinks } from './safe-filesystem.js';
+import { parseTomlText } from './toml.js';
+export const MODULE_BOUNDARY_PACK_ID = 'code';
+export const MODULE_BOUNDARY_SCRIPT_ID = 'module-boundary';
+export const MODULE_BOUNDARY_SCRIPT_REF = `${MODULE_BOUNDARY_PACK_ID}/${MODULE_BOUNDARY_SCRIPT_ID}`;
+const DEFAULT_CONFIG_PATH = '.mustflow/config/module-boundaries.toml';
+const DEFAULT_MAX_DEPTH = 20;
+const DEFAULT_MAX_CYCLES = 50;
+const DEFAULT_MAX_SHARED_FILES = 1000;
+const MAX_ISSUES = 50;
+const SOURCE_EXTENSIONS = new Set(['.ts', '.tsx', '.mts', '.cts', '.js', '.jsx', '.mjs', '.cjs']);
+const DEFAULT_ENTRYPOINT_NAMES = ['index.ts', 'index.tsx', 'index.js', 'index.jsx', 'index.mts', 'index.mjs', 'index.cjs', 'index.cts'];
+const ERROR_CODES = new Set([
+    'dependency_graph_path_outside_root',
+    'dependency_graph_unreadable_path',
+    'module_boundary_invalid_config',
+]);
+const NON_BLOCKING_CODES = new Set(['module_boundary_config_missing']);
+function toPosixPath(value) {
+    return value.replace(/\\/gu, '/');
+}
+function normalizeRelativePath(value) {
+    return toPosixPath(value).replace(/^\.\/+/u, '').replace(/\/+/gu, '/') || '.';
+}
+function sha256Tagged(value) {
+    return `sha256:${createHash('sha256').update(value).digest('hex')}`;
+}
+function pushIssue(issues, issue) {
+    if (issues.length < MAX_ISSUES) {
+        issues.push(issue);
+    }
+}
+function makeFinding(code, severity, pathValue, message, extras = {}) {
+    return { code, severity, path: pathValue, message, ...extras };
+}
+function normalizeGraphFinding(finding) {
+    return {
+        code: finding.code,
+        severity: finding.severity,
+        path: finding.path,
+        message: finding.message,
+    };
+}
+function isRecord(value) {
+    return value !== null && typeof value === 'object' && !Array.isArray(value);
+}
+function asRecordArray(value) {
+    if (!Array.isArray(value)) {
+        return [];
+    }
+    return value.filter(isRecord);
+}
+function asStringArray(value) {
+    if (!Array.isArray(value)) {
+        return [];
+    }
+    return value.filter((entry) => typeof entry === 'string').map(normalizeRelativePath);
+}
+function stringField(record, field) {
+    const value = record[field];
+    return typeof value === 'string' && value.trim().length > 0 ? normalizeRelativePath(value) : null;
+}
+function booleanField(record, field, fallback) {
+    return typeof record[field] === 'boolean' ? record[field] : fallback;
+}
+function integerField(record, field) {
+    const value = record[field];
+    return typeof value === 'number' && Number.isSafeInteger(value) && value >= 0 ? value : null;
+}
+function ruleId(record, fallback) {
+    const value = record.id;
+    return typeof value === 'string' && value.trim().length > 0 ? value : fallback;
+}
+function parseLayerRules(raw) {
+    return asRecordArray(raw)
+        .map((entry, index) => {
+        const paths = asStringArray(entry.paths);
+        const denyImports = asStringArray(entry.deny_imports ?? entry.denyImports);
+        if (paths.length === 0 || denyImports.length === 0) {
+            return null;
+        }
+        return { id: ruleId(entry, `layer:${index + 1}`), paths, denyImports };
+    })
+        .filter((entry) => entry !== null);
+}
+function parsePublicEntrypointRules(raw) {
+    return asRecordArray(raw)
+        .map((entry, index) => {
+        const root = stringField(entry, 'root');
+        const entrypoint = stringField(entry, 'entrypoint') ?? stringField(entry, 'entry');
+        if (!root || !entrypoint) {
+            return null;
+        }
+        return { id: ruleId(entry, `public_entrypoint:${index + 1}`), root, entrypoint };
+    })
+        .filter((entry) => entry !== null);
+}
+function parseFeatureGroupRules(raw) {
+    return asRecordArray(raw)
+        .map((entry, index) => {
+        const root = stringField(entry, 'root');
+        if (!root) {
+            return null;
+        }
+        const entrypointNames = asStringArray(entry.entrypoint_names ?? entry.entrypointNames);
+        return {
+            id: ruleId(entry, `feature_group:${index + 1}`),
+            root,
+            allowEntrypointImports: booleanField(entry, 'allow_entrypoint_imports', true),
+            entrypointNames: entrypointNames.length > 0 ? entrypointNames : DEFAULT_ENTRYPOINT_NAMES,
+        };
+    })
+        .filter((entry) => entry !== null);
+}
+function parseSharedBudgetRules(raw) {
+    return asRecordArray(raw)
+        .map((entry, index) => {
+        const sharedPath = stringField(entry, 'path');
+        if (!sharedPath) {
+            return null;
+        }
+        return {
+            id: ruleId(entry, `shared_budget:${index + 1}`),
+            path: sharedPath,
+            maxFiles: integerField(entry, 'max_files'),
+            maxExports: integerField(entry, 'max_exports'),
+        };
+    })
+        .filter((entry) => entry !== null);
+}
+function readModuleBoundaryConfig(projectRoot, configPath) {
+    const relativeConfigPath = normalizeRelativePath(configPath);
+    const absoluteConfigPath = path.resolve(projectRoot, relativeConfigPath);
+    const findings = [];
+    const issues = [];
+    try {
+        ensureInside(projectRoot, absoluteConfigPath);
+        ensureInsideWithoutSymlinks(projectRoot, absoluteConfigPath, { allowMissingLeaf: true });
+    }
+    catch (error) {
+        const message = error instanceof Error ? error.message : String(error);
+        return {
+            path: relativeConfigPath,
+            status: 'invalid',
+            layers: [],
+            publicEntrypoints: [],
+            featureGroups: [],
+            sharedBudgets: [],
+            findings: [makeFinding('module_boundary_invalid_config', 'high', relativeConfigPath, message)],
+            issues: [message],
+        };
+    }
+    if (!existsSync(absoluteConfigPath)) {
+        const message = `Module boundary config not found at ${relativeConfigPath}; no boundary rules were enforced.`;
+        return {
+            path: relativeConfigPath,
+            status: 'missing',
+            layers: [],
+            publicEntrypoints: [],
+            featureGroups: [],
+            sharedBudgets: [],
+            findings: [makeFinding('module_boundary_config_missing', 'low', relativeConfigPath, message)],
+            issues: [message],
+        };
+    }
+    let parsed;
+    try {
+        const content = readFileInsideWithoutSymlinks(projectRoot, absoluteConfigPath, { maxBytes: 256 * 1024 }).toString('utf8');
+        parsed = parseTomlText(content);
+    }
+    catch (error) {
+        const message = error instanceof Error ? error.message : String(error);
+        return {
+            path: relativeConfigPath,
+            status: 'invalid',
+            layers: [],
+            publicEntrypoints: [],
+            featureGroups: [],
+            sharedBudgets: [],
+            findings: [makeFinding('module_boundary_invalid_config', 'high', relativeConfigPath, message)],
+            issues: [message],
+        };
+    }
+    if (!isRecord(parsed)) {
+        const message = 'Module boundary config must be a TOML table.';
+        return {
+            path: relativeConfigPath,
+            status: 'invalid',
+            layers: [],
+            publicEntrypoints: [],
+            featureGroups: [],
+            sharedBudgets: [],
+            findings: [makeFinding('module_boundary_invalid_config', 'high', relativeConfigPath, message)],
+            issues: [message],
+        };
+    }
+    const layers = parseLayerRules(parsed.layers);
+    const publicEntrypoints = parsePublicEntrypointRules(parsed.public_entrypoints ?? parsed.publicEntrypoints);
+    const featureGroups = parseFeatureGroupRules(parsed.feature_groups ?? parsed.featureGroups);
+    const sharedBudgets = parseSharedBudgetRules(parsed.shared_budgets ?? parsed.sharedBudgets);
+    if (layers.length + publicEntrypoints.length + featureGroups.length + sharedBudgets.length === 0) {
+        pushIssue(issues, `Module boundary config ${relativeConfigPath} contains no usable rules.`);
+    }
+    return {
+        path: relativeConfigPath,
+        status: 'found',
+        layers,
+        publicEntrypoints,
+        featureGroups,
+        sharedBudgets,
+        findings,
+        issues,
+    };
+}
+function patternToRegExp(pattern) {
+    const normalized = normalizeRelativePath(pattern);
+    const escaped = normalized.replace(/[.+?^${}()|[\]\\]/gu, '\\$&').replace(/\*\*/gu, '\u0000').replace(/\*/gu, '[^/]*');
+    return new RegExp(`^${escaped.replace(/\u0000/gu, '.*')}$`, 'u');
+}
+function matchesPathPattern(pattern, relativePath) {
+    const normalizedPattern = normalizeRelativePath(pattern);
+    const normalizedPath = normalizeRelativePath(relativePath);
+    if (normalizedPattern.endsWith('/**')) {
+        const prefix = normalizedPattern.slice(0, -3);
+        return normalizedPath === prefix || normalizedPath.startsWith(`${prefix}/`);
+    }
+    if (normalizedPattern.includes('*')) {
+        return patternToRegExp(normalizedPattern).test(normalizedPath);
+    }
+    return normalizedPath === normalizedPattern;
+}
+function isInsidePath(root, candidate) {
+    const normalizedRoot = normalizeRelativePath(root);
+    const normalizedCandidate = normalizeRelativePath(candidate);
+    return normalizedCandidate === normalizedRoot || normalizedCandidate.startsWith(`${normalizedRoot}/`);
+}
+function featureSegment(root, candidate) {
+    if (!isInsidePath(root, candidate)) {
+        return null;
+    }
+    const rootPrefix = normalizeRelativePath(root);
+    const rest = normalizeRelativePath(candidate).slice(rootPrefix.length).replace(/^\//u, '');
+    const [segment] = rest.split('/');
+    return segment && segment.length > 0 ? segment : null;
+}
+function isFeatureEntrypoint(rule, targetPath) {
+    const normalized = normalizeRelativePath(targetPath);
+    return rule.entrypointNames.some((entrypointName) => normalized.endsWith(`/${normalizeRelativePath(entrypointName)}`));
+}
+function addEdgeFinding(findings, code, severity, ruleIdValue, edge, message) {
+    findings.push(makeFinding(code, severity, edge.source_path, message, {
+        rule_id: ruleIdValue,
+        source_path: edge.source_path,
+        target_path: edge.target_path,
+        line: edge.line,
+    }));
+}
+function checkLayerRules(config, edges) {
+    const findings = [];
+    for (const rule of config.layers) {
+        for (const edge of edges) {
+            if (!rule.paths.some((pattern) => matchesPathPattern(pattern, edge.source_path))) {
+                continue;
+            }
+            if (!rule.denyImports.some((pattern) => matchesPathPattern(pattern, edge.target_path))) {
+                continue;
+            }
+            addEdgeFinding(findings, 'module_boundary_forbidden_import', 'high', rule.id, edge, `${edge.source_path} imports forbidden boundary ${edge.target_path} by rule ${rule.id}.`);
+        }
+    }
+    return findings;
+}
+function checkPublicEntrypointRules(config, edges) {
+    const findings = [];
+    for (const rule of config.publicEntrypoints) {
+        for (const edge of edges) {
+            if (!isInsidePath(rule.root, edge.target_path) || edge.target_path === normalizeRelativePath(rule.entrypoint)) {
+                continue;
+            }
+            if (isInsidePath(rule.root, edge.source_path)) {
+                continue;
+            }
+            addEdgeFinding(findings, 'module_boundary_public_entry_violation', 'high', rule.id, edge, `${edge.source_path} imports ${edge.target_path} instead of public entrypoint ${rule.entrypoint}.`);
+        }
+    }
+    return findings;
+}
+function checkFeatureGroupRules(config, edges) {
+    const findings = [];
+    for (const rule of config.featureGroups) {
+        for (const edge of edges) {
+            const sourceFeature = featureSegment(rule.root, edge.source_path);
+            const targetFeature = featureSegment(rule.root, edge.target_path);
+            if (!sourceFeature || !targetFeature || sourceFeature === targetFeature) {
+                continue;
+            }
+            if (rule.allowEntrypointImports && isFeatureEntrypoint(rule, edge.target_path)) {
+                continue;
+            }
+            addEdgeFinding(findings, 'module_boundary_feature_direct_import', 'medium', rule.id, edge, `${edge.source_path} imports another feature internals at ${edge.target_path} by rule ${rule.id}.`);
+        }
+    }
+    return findings;
+}
+function isSourceFile(relativePath) {
+    const extension = path.extname(relativePath).toLowerCase();
+    return SOURCE_EXTENSIONS.has(extension) && !relativePath.endsWith('.d.ts');
+}
+function isIgnored(relativePath) {
+    return isIgnoredDirectoryPath(normalizeRelativePath(relativePath), DEFAULT_IGNORED_DIRECTORIES);
+}
+function collectSourceFiles(projectRoot, absoluteDirectory, maxFiles, issues) {
+    const candidates = [];
+    const visit = (directoryPath) => {
+        if (candidates.length >= maxFiles) {
+            return;
+        }
+        const relativeDirectory = normalizeRelativePath(path.relative(projectRoot, directoryPath));
+        if (isIgnored(relativeDirectory)) {
+            return;
+        }
+        let entries;
+        try {
+            ensureInsideWithoutSymlinks(projectRoot, directoryPath);
+            entries = readdirSync(directoryPath, { withFileTypes: true });
+        }
+        catch (error) {
+            pushIssue(issues, `${relativeDirectory}: ${error instanceof Error ? error.message : String(error)}`);
+            return;
+        }
+        for (const entry of entries) {
+            if (candidates.length >= maxFiles) {
+                return;
+            }
+            const absoluteEntryPath = path.join(directoryPath, entry.name);
+            const relativeEntryPath = normalizeRelativePath(path.relative(projectRoot, absoluteEntryPath));
+            if (entry.isDirectory()) {
+                visit(absoluteEntryPath);
+                continue;
+            }
+            if (entry.isFile() && isSourceFile(relativeEntryPath)) {
+                candidates.push({ absolutePath: absoluteEntryPath, relativePath: relativeEntryPath });
+            }
+        }
+    };
+    visit(absoluteDirectory);
+    return candidates;
+}
+function countExports(projectRoot, file, maxFileBytes, issues) {
+    try {
+        const text = readFileInsideWithoutSymlinks(projectRoot, file.absolutePath, { maxBytes: maxFileBytes }).toString('utf8');
+        return [...text.matchAll(/\bexport\s+(?:type\s+)?(?:\{|\*|default|class|function|const|let|var|interface|type|enum)\b/gu)].length;
+    }
+    catch (error) {
+        pushIssue(issues, `${file.relativePath}: ${error instanceof Error ? error.message : String(error)}`);
+        return 0;
+    }
+}
+function checkSharedBudgets(projectRoot, config, policy, issues) {
+    const metrics = [];
+    const findings = [];
+    for (const rule of config.sharedBudgets) {
+        const absoluteSharedPath = path.resolve(projectRoot, rule.path);
+        let files = [];
+        try {
+            ensureInside(projectRoot, absoluteSharedPath);
+            if (existsSync(absoluteSharedPath) && lstatSync(absoluteSharedPath).isDirectory()) {
+                files = collectSourceFiles(projectRoot, absoluteSharedPath, policy.max_shared_files, issues);
+            }
+        }
+        catch (error) {
+            pushIssue(issues, `${rule.path}: ${error instanceof Error ? error.message : String(error)}`);
+        }
+        const exportCount = files.reduce((count, file) => count + countExports(projectRoot, file, policy.max_file_bytes, issues), 0);
+        const metric = {
+            rule_id: rule.id,
+            path: rule.path,
+            file_count: files.length,
+            export_count: exportCount,
+            max_files: rule.maxFiles,
+            max_exports: rule.maxExports,
+        };
+        metrics.push(metric);
+        const fileExceeded = rule.maxFiles !== null && files.length > rule.maxFiles;
+        const exportExceeded = rule.maxExports !== null && exportCount > rule.maxExports;
+        if (fileExceeded || exportExceeded) {
+            const parts = [
+                fileExceeded ? `${files.length} files exceeds max_files ${rule.maxFiles}` : null,
+                exportExceeded ? `${exportCount} exports exceeds max_exports ${rule.maxExports}` : null,
+            ].filter((entry) => entry !== null);
+            findings.push(makeFinding('module_boundary_shared_budget_exceeded', 'medium', rule.path, `Shared budget exceeded for ${rule.path}: ${parts.join('; ')}.`, { rule_id: rule.id }));
+        }
+    }
+    return { metrics, findings };
+}
+function cycleId(paths) {
+    return `cycle:${createHash('sha256').update(paths.join('\0')).digest('hex').slice(0, 12)}`;
+}
+function cycleFindings(graph, maxCycles) {
+    const cycles = graph.cycles.slice(0, maxCycles).map((cyclePaths) => ({
+        cycle_id: cycleId(cyclePaths),
+        path_count: Math.max(0, cyclePaths.length - 1),
+        paths: cyclePaths,
+    }));
+    const findings = cycles.map((cycle) => makeFinding('module_boundary_import_cycle_detected', 'high', cycle.paths[0] ?? '.', `Import cycle detected: ${cycle.paths.join(' -> ')}`, { cycle_id: cycle.cycle_id }));
+    return { cycles, findings };
+}
+function ruleSummaries(config, findings, cycles) {
+    const rules = [];
+    const countFor = (ruleIdValue) => findings.filter((finding) => finding.rule_id === ruleIdValue).length;
+    for (const rule of config.layers) {
+        rules.push({ rule_id: rule.id, kind: 'layer_deny', finding_count: countFor(rule.id) });
+    }
+    for (const rule of config.publicEntrypoints) {
+        rules.push({ rule_id: rule.id, kind: 'public_entrypoint', finding_count: countFor(rule.id) });
+    }
+    for (const rule of config.featureGroups) {
+        rules.push({ rule_id: rule.id, kind: 'feature_direct_import', finding_count: countFor(rule.id) });
+    }
+    for (const rule of config.sharedBudgets) {
+        rules.push({ rule_id: rule.id, kind: 'shared_budget', finding_count: countFor(rule.id) });
+    }
+    rules.push({ rule_id: 'import-cycle', kind: 'import_cycle', finding_count: cycles.length });
+    return rules;
+}
+function moduleBoundaryStatus(findings) {
+    if (findings.some((finding) => ERROR_CODES.has(finding.code))) {
+        return 'error';
+    }
+    return findings.some((finding) => !NON_BLOCKING_CODES.has(finding.code)) ? 'failed' : 'passed';
+}
+function createInputHash(policy, config, graph, rules, cycles, sharedMetrics, findings, issues) {
+    return sha256Tagged(JSON.stringify({
+        policy,
+        config,
+        graph_input_hash: graph.input_hash,
+        rules,
+        cycles: cycles.map((cycle) => ({ cycle_id: cycle.cycle_id, paths: cycle.paths })),
+        sharedMetrics,
+        findings: findings.map((finding) => ({
+            code: finding.code,
+            path: finding.path,
+            rule_id: finding.rule_id,
+            cycle_id: finding.cycle_id,
+        })),
+        issues,
+    }));
+}
+export function inspectModuleBoundaries(projectRoot, options) {
+    const root = path.resolve(projectRoot);
+    const configPath = normalizeRelativePath(options.configPath ?? DEFAULT_CONFIG_PATH);
+    const graph = inspectDependencyGraph(root, {
+        paths: options.paths,
+        maxFiles: options.maxFiles,
+        maxFileBytes: options.maxFileBytes,
+        maxDepth: options.maxDepth ?? DEFAULT_MAX_DEPTH,
+        maxNodes: options.maxNodes,
+        maxEdges: options.maxEdges,
+    });
+    const policy = {
+        ...graph.policy,
+        config_path: configPath,
+        max_cycles: options.maxCycles ?? DEFAULT_MAX_CYCLES,
+        max_shared_files: options.maxSharedFiles ?? DEFAULT_MAX_SHARED_FILES,
+    };
+    const config = readModuleBoundaryConfig(root, configPath);
+    const issues = [...graph.issues, ...config.issues];
+    const boundaryFindings = [
+        ...graph.findings.map(normalizeGraphFinding),
+        ...config.findings,
+        ...checkLayerRules(config, graph.edges),
+        ...checkPublicEntrypointRules(config, graph.edges),
+        ...checkFeatureGroupRules(config, graph.edges),
+    ];
+    const shared = checkSharedBudgets(root, config, policy, issues);
+    const cycles = cycleFindings(graph, policy.max_cycles);
+    const findings = [...boundaryFindings, ...shared.findings, ...cycles.findings];
+    const configSummary = {
+        path: config.path,
+        status: config.status,
+        layer_rule_count: config.layers.length,
+        public_entrypoint_rule_count: config.publicEntrypoints.length,
+        feature_group_rule_count: config.featureGroups.length,
+        shared_budget_rule_count: config.sharedBudgets.length,
+    };
+    const rules = ruleSummaries(config, findings, cycles.cycles);
+    const status = moduleBoundaryStatus(findings);
+    const truncated = graph.truncated || graph.cycles.length > cycles.cycles.length;
+    return {
+        schema_version: '1',
+        command: 'script-pack',
+        pack_id: MODULE_BOUNDARY_PACK_ID,
+        script_id: MODULE_BOUNDARY_SCRIPT_ID,
+        script_ref: MODULE_BOUNDARY_SCRIPT_REF,
+        action: 'check',
+        status,
+        ok: status === 'passed',
+        mustflow_root: root,
+        policy,
+        input_hash: createInputHash(policy, configSummary, graph, rules, cycles.cycles, shared.metrics, findings, issues),
+        config: configSummary,
+        targets: graph.targets,
+        graph: {
+            script_ref: DEPENDENCY_GRAPH_SCRIPT_REF,
+            status: graph.status,
+            node_count: graph.nodes.length,
+            edge_count: graph.edges.length,
+            cycle_hint_count: graph.cycles.length,
+            truncated: graph.truncated,
+        },
+        rules,
+        cycles: cycles.cycles,
+        shared_metrics: shared.metrics,
+        truncated,
+        findings,
+        issues,
+    };
+}

package/dist/core/public-json-contracts.js

@@ -15,6 +15,23 @@ const PUBLIC_JSON_SCHEMA_CONTRACTS = [
         documented: true,
         installedCommand: ['mf', 'doctor', '--json'],
     },
+    {
+        id: 'check-report',
+        schemaFile: 'check-report.schema.json',
+        producer: 'mf check --json',
+        packaged: true,
+        documented: true,
+        installedCommand: ['mf', 'check', '--json'],
+        expectedExitCodes: [0, 1],
+    },
+    {
+        id: 'status-report',
+        schemaFile: 'status-report.schema.json',
+        producer: 'mf status --json',
+        packaged: true,
+        documented: true,
+        installedCommand: ['mf', 'status', '--json'],
+    },
     {
         id: 'context-report',
         schemaFile: 'context-report.schema.json',
@@ -215,6 +232,22 @@ const PUBLIC_JSON_SCHEMA_CONTRACTS = [
         documented: true,
         installedCommand: ['mf', 'script-pack', 'list', '--json'],
     },
+    {
+        id: 'index-report',
+        schemaFile: 'index-report.schema.json',
+        producer: 'mf index --dry-run --json',
+        packaged: true,
+        documented: true,
+        installedCommand: ['mf', 'index', '--dry-run', '--json'],
+    },
+    {
+        id: 'search-report',
+        schemaFile: 'search-report.schema.json',
+        producer: 'mf search <query> --json',
+        packaged: true,
+        documented: true,
+        installedCommand: ['mf', 'search', 'mustflow', '--json'],
+    },
     {
         id: 'script-pack-suggestion-report',
         schemaFile: 'script-pack-suggestion-report.schema.json',
@@ -281,6 +314,23 @@ const PUBLIC_JSON_SCHEMA_CONTRACTS = [
         ],
         expectedExitCodes: [0, 1],
     },
+    {
+        id: 'module-boundary-report',
+        schemaFile: 'module-boundary-report.schema.json',
+        producer: 'mf script-pack run code/module-boundary check <path...> --json',
+        packaged: true,
+        documented: true,
+        installedCommand: [
+            'mf',
+            'script-pack',
+            'run',
+            'code/module-boundary',
+            'check',
+            'node_modules/mustflow/dist/cli/index.js',
+            '--json',
+        ],
+        expectedExitCodes: [0, 1],
+    },
     {
         id: 'change-impact-report',
         schemaFile: 'change-impact-report.schema.json',

package/dist/core/script-pack-suggestions.js

@@ -4,6 +4,7 @@ const CODE_NAVIGATION_SCRIPT_REFS = new Set([
     'code/outline',
     'code/dependency-graph',
     'code/import-cycle',
+    'code/module-boundary',
     'code/symbol-read',
     'code/route-outline',
     'code/export-diff',
@@ -197,6 +198,10 @@ function createRunHint(script, analyzedPaths) {
         const sourcePaths = pathsWithSurface(analyzedPaths, 'source');
         return createConcretePathHint('mf script-pack run code/import-cycle check', sourcePaths, script.usage);
     }
+    if (script.ref === 'code/module-boundary') {
+        const sourcePaths = pathsWithSurface(analyzedPaths, 'source');
+        return createConcretePathHint('mf script-pack run code/module-boundary check', sourcePaths, script.usage);
+    }
     if (script.ref === 'code/change-impact') {
         return 'mf script-pack run code/change-impact analyze --base HEAD --json';
     }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "mustflow",
-  "version": "2.103.16",
+  "version": "2.103.20",
   "description": "Agent workflow documents and CLI for mustflow repository roots.",
   "type": "module",
   "license": "MIT-0",

package/schemas/README.md

@@ -6,6 +6,10 @@ mustflow files and command output.
 Current schemas:
 
 - `doctor-report.schema.json`: output of `mf doctor --json`
+- `check-report.schema.json`: output of `mf check --json`, containing base or strict validation
+  issues, warnings, stable issue details, and exit-code aligned `ok` status
+- `status-report.schema.json`: output of `mf status --json`, containing installed-entrypoint
+  status, manifest-lock status, changed and missing locked files, issues, and template identity
 - `adapter-compatibility-report.schema.json`: output of `mf adapters status --json`
 - `context-report.schema.json`: output of `mf context --json`, including context trust metadata, prompt-cache profiles, and optional cache audit data
 - `workspace-summary.schema.json`: output of `mf api workspace-summary --json`
@@ -62,6 +66,10 @@ Current schemas:
   script-pack ids, script refs, action names, usage strings, workflow phases, read-only and
   side-effect flags, input and output capability labels, related skill names, cost and risk hints,
   and associated report schemas
+- `index-report.schema.json`: output of `mf index --json`, including dry-run and write status,
+  local index counts, search backend metadata, source-index status, and indexed path summaries
+- `search-report.schema.json`: output of `mf search <query> --json`, containing bounded local
+  workflow or source search results with authority, cache-layer, navigation-only, and match metadata
 - `script-pack-suggestion-report.schema.json`: output of `mf script-pack suggest --json`, containing
   path, skill, phase, and changed-file evidence used to recommend optional script-pack helpers
 - `code-outline-report.schema.json`: output of
@@ -77,6 +85,10 @@ Current schemas:
   `mf script-pack run code/import-cycle check <path...> --json`, containing bounded relative
   TypeScript and JavaScript import cycles with exact cycle paths, import line evidence, policy
   limits, and stable cycle or input-limit finding codes
+- `module-boundary-report.schema.json`: output of
+  `mf script-pack run code/module-boundary check <path...> --json`, containing configured module
+  boundary rule findings for layer deny rules, public entrypoints, feature-to-feature imports,
+  shared/common budgets, and import cycles
 - `change-impact-report.schema.json`: output of
   `mf script-pack run code/change-impact analyze [path...] --json`, containing git-diff changed
   files, surface classifications, bounded impact candidates, script-pack hints with related