mustflow 2.75.2 → 2.84.0

package/dist/core/script-pack-suggestions.js

@@ -1,5 +1,14 @@
 import { spawnSync } from 'node:child_process';
 import path from 'node:path';
+const CODE_NAVIGATION_SCRIPT_REFS = new Set([
+    'code/outline',
+    'code/symbol-read',
+    'code/route-outline',
+    'code/export-diff',
+    'repo/related-files',
+]);
+const CONFIG_CHAIN_SURFACES = new Set(['config', 'package', 'source', 'test']);
+const CONFIG_FILE_PATTERN = /(?:^|\/)(?:tsconfig(?:\..*)?\.json|eslint\.config\.[cm]?[jt]s|\.eslintrc(?:\.json)?|\.prettierrc(?:\.json)?|prettier\.config\.[cm]?[jt]s|vite\.config\.[cm]?[jt]s|vitest\.config\.[cm]?[jt]s|tailwind\.config\.[cm]?[jt]s|jest\.config\.[cm]?[jt]s|playwright\.config\.[cm]?[jt]s|astro\.config\.mjs|svelte\.config\.js)$/u;
 export function isScriptPackSuggestionPhase(value) {
     return ['before_change', 'during_change', 'after_change', 'review'].includes(value);
 }
@@ -12,6 +21,9 @@ function uniqueSortedPhases(values) {
 function uniqueSortedSurfaces(values) {
     return uniqueSortedStrings(values);
 }
+function quoteCliArg(value) {
+    return /^[A-Za-z0-9_./:@=-]+$/u.test(value) ? value : JSON.stringify(value);
+}
 function normalizeReportPath(mustflowRoot, value) {
     const absolute = path.resolve(mustflowRoot, value);
     const relative = path.relative(mustflowRoot, absolute);
@@ -31,7 +43,7 @@ export function classifyScriptPackPathSurface(relativePath) {
         normalized.startsWith('.mustflow/state/')) {
         surfaces.push('generated');
     }
-    if (normalized.startsWith('.mustflow/config/') || normalized.startsWith('config/')) {
+    if (normalized.startsWith('.mustflow/config/') || normalized.startsWith('config/') || CONFIG_FILE_PATTERN.test(normalized)) {
         surfaces.push('config');
     }
     if (normalized.startsWith('.mustflow/skills/') || normalized.includes('/.mustflow/skills/')) {
@@ -59,7 +71,8 @@ export function classifyScriptPackPathSurface(relativePath) {
         normalized.startsWith('.github/workflows/')) {
         surfaces.push('package');
     }
-    if (normalized.startsWith('src/') || normalized.endsWith('.ts') || normalized.endsWith('.tsx')) {
+    if (normalized.startsWith('src/') ||
+        /\.(?:astro|cjs|go|js|jsx|mjs|py|rs|svelte|ts|tsx)$/u.test(normalized)) {
         surfaces.push('source');
     }
     return surfaces.length > 0 ? uniqueSortedSurfaces(surfaces) : ['unknown'];
@@ -108,7 +121,7 @@ function surfacesForScript(script) {
     addIf('generated', /generated|protected|vendor|cache|boundary/u);
     addIf('config', /config|command/u);
     addIf('package', /package|release/u);
-    addIf('source', /code|source|path/u);
+    addIf('source', /code|source|symbol/u);
     return uniqueSortedSurfaces(surfaces);
 }
 function confidenceForScore(score) {
@@ -120,14 +133,99 @@ function confidenceForScore(score) {
     }
     return 'low';
 }
+function pathsWithSurface(analyzedPaths, surface) {
+    return analyzedPaths.filter((entry) => entry.surfaces.includes(surface)).map((entry) => entry.path);
+}
+function hasPathWithSurface(analyzedPaths, surface) {
+    return analyzedPaths.some((entry) => entry.surfaces.includes(surface));
+}
+function firstAvailablePath(analyzedPaths, preferredSurfaces) {
+    for (const surface of preferredSurfaces) {
+        const [candidate] = pathsWithSurface(analyzedPaths, surface);
+        if (candidate) {
+            return candidate;
+        }
+    }
+    return analyzedPaths[0]?.path ?? null;
+}
+function createConcretePathHint(commandPrefix, paths, fallbackUsage) {
+    if (paths.length === 0) {
+        return fallbackUsage;
+    }
+    return `${commandPrefix} ${paths.map(quoteCliArg).join(' ')} --json`;
+}
+function createRunHint(script, analyzedPaths) {
+    if (script.ref === 'code/outline') {
+        const sourcePaths = pathsWithSurface(analyzedPaths, 'source');
+        return createConcretePathHint('mf script-pack run code/outline scan', sourcePaths, script.usage);
+    }
+    if (script.ref === 'code/symbol-read') {
+        const sourcePath = firstAvailablePath(analyzedPaths, ['source']);
+        if (sourcePath) {
+            return `After code/outline returns a symbol line or anchor, run: mf script-pack run code/symbol-read read ${quoteCliArg(sourcePath)} --start-line <line> --json`;
+        }
+        return 'After code/outline returns a source anchor, run: mf script-pack run code/symbol-read read --anchor <anchor-id> --json';
+    }
+    if (script.ref === 'code/route-outline') {
+        const sourcePaths = pathsWithSurface(analyzedPaths, 'source');
+        return createConcretePathHint('mf script-pack run code/route-outline scan', sourcePaths, script.usage);
+    }
+    if (script.ref === 'code/export-diff') {
+        const sourcePaths = pathsWithSurface(analyzedPaths, 'source');
+        const pathPart = sourcePaths.length > 0 ? ` ${sourcePaths.map(quoteCliArg).join(' ')}` : '';
+        return `mf script-pack run code/export-diff compare${pathPart} --base HEAD --json`;
+    }
+    if (script.ref === 'core/text-budget') {
+        const packageJson = analyzedPaths.find((entry) => entry.path === 'package.json');
+        if (packageJson) {
+            return 'mf script-pack run core/text-budget check package.json --json-pointer /description --max 80 --json';
+        }
+        const textPaths = analyzedPaths
+            .filter((entry) => entry.surfaces.some((surface) => surface === 'docs' || surface === 'package' || surface === 'schema'))
+            .map((entry) => entry.path);
+        return createConcretePathHint('mf script-pack run core/text-budget check', textPaths, script.usage);
+    }
+    if (script.ref === 'docs/reference-drift') {
+        const docsPaths = analyzedPaths
+            .filter((entry) => entry.surfaces.some((surface) => surface === 'docs' || surface === 'schema' || surface === 'package'))
+            .map((entry) => entry.path);
+        return createConcretePathHint('mf script-pack run docs/reference-drift check', docsPaths, script.usage);
+    }
+    if (script.ref === 'repo/generated-boundary') {
+        return createConcretePathHint('mf script-pack run repo/generated-boundary check', analyzedPaths.map((entry) => entry.path), script.usage);
+    }
+    if (script.ref === 'repo/config-chain') {
+        const configPaths = analyzedPaths
+            .filter((entry) => entry.surfaces.some((surface) => CONFIG_CHAIN_SURFACES.has(surface)))
+            .map((entry) => entry.path);
+        return createConcretePathHint('mf script-pack run repo/config-chain inspect', configPaths, script.usage);
+    }
+    if (script.ref === 'repo/related-files') {
+        const relatedPaths = analyzedPaths
+            .filter((entry) => entry.surfaces.some((surface) => surface === 'source' || surface === 'test'))
+            .map((entry) => entry.path);
+        return createConcretePathHint('mf script-pack run repo/related-files map', relatedPaths, script.usage);
+    }
+    return script.usage;
+}
 export function createScriptPackSuggestionReport(mustflowRoot, options) {
     const issues = [];
     const changedPaths = options.changed ? readChangedPaths(mustflowRoot, issues) : [];
     const inputPaths = uniqueSortedStrings([...options.paths, ...changedPaths].map((value) => normalizeReportPath(mustflowRoot, value)));
     const analyzedPaths = inputPaths.map((entry) => ({ path: entry, surfaces: classifyScriptPackPathSurface(entry) }));
     const requestedSurfaces = new Set(analyzedPaths.flatMap((entry) => entry.surfaces));
+    const hasSourcePath = hasPathWithSurface(analyzedPaths, 'source');
     const suggestions = options.scripts
         .map((script) => {
+        if (CODE_NAVIGATION_SCRIPT_REFS.has(script.ref) && inputPaths.length > 0 && !hasSourcePath) {
+            return null;
+        }
+        if (script.ref === 'repo/config-chain' && inputPaths.length > 0) {
+            const hasConfigChainSurface = analyzedPaths.some((entry) => entry.surfaces.some((surface) => CONFIG_CHAIN_SURFACES.has(surface)));
+            if (!hasConfigChainSurface) {
+                return null;
+            }
+        }
         let score = 0;
         const reasons = [];
         const matchedPhases = options.phases.filter((phase) => script.phases.includes(phase));
@@ -150,10 +248,18 @@ export function createScriptPackSuggestionReport(mustflowRoot, options) {
             score += 1;
             reasons.push('Accepts explicit path inputs.');
         }
-        if (script.readOnly && !script.mutates && !script.network) {
+        if (script.ref === 'code/symbol-read' && inputPaths.length > 0) {
+            score = Math.max(1, score - 1);
+            reasons.push('Follow-up helper after code/outline identifies a symbol line or source anchor.');
+        }
+        if (score > 0 && script.readOnly && !script.mutates && !script.network) {
             score += 1;
             reasons.push('Read-only, non-mutating, offline helper.');
         }
+        if (script.ref === 'repo/generated-boundary' && requestedSurfaces.has('generated')) {
+            score += 2;
+            reasons.push('Prioritizes generated-boundary checks for generated paths.');
+        }
         if (score === 0) {
             return null;
         }
@@ -173,7 +279,7 @@ export function createScriptPackSuggestionReport(mustflowRoot, options) {
             risk_level: script.riskLevel,
             cost: script.cost,
             report_schema_file: script.reportSchemaFile,
-            run_hint: script.usage,
+            run_hint: createRunHint(script, analyzedPaths),
         };
     })
         .filter((suggestion) => suggestion !== null)

package/dist/core/source-anchors.js

@@ -1,7 +1,19 @@
 import { existsSync, readdirSync, readFileSync, realpathSync, statSync } from 'node:fs';
 import path from 'node:path';
 import { SECRET_LIKE_PATTERNS, textContainsSecretLike } from './secret-redaction.js';
-export const SOURCE_ANCHOR_EXTENSIONS = new Set(['.cjs', '.go', '.js', '.jsx', '.mjs', '.py', '.rs', '.ts', '.tsx']);
+export const SOURCE_ANCHOR_EXTENSIONS = new Set([
+    '.astro',
+    '.cjs',
+    '.go',
+    '.js',
+    '.jsx',
+    '.mjs',
+    '.py',
+    '.rs',
+    '.svelte',
+    '.ts',
+    '.tsx',
+]);
 export const SOURCE_ANCHOR_DEFAULT_EXCLUDED_PATH_PARTS = new Set([
     '.git',
     '.mustflow',

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "mustflow",
-  "version": "2.75.2",
+  "version": "2.84.0",
   "description": "Agent workflow documents and CLI for mustflow repository roots.",
   "type": "module",
   "license": "MIT-0",

package/schemas/README.md

@@ -65,14 +65,32 @@ Current schemas:
 - `script-pack-suggestion-report.schema.json`: output of `mf script-pack suggest --json`, containing
   path, skill, phase, and changed-file evidence used to recommend optional script-pack helpers
 - `code-outline-report.schema.json`: output of
-  `mf script-pack run code/outline scan <path...> --json`, containing a bounded TypeScript and
-  JavaScript source outline with file hashes, symbol names, declaration kinds, line ranges,
-  signatures, export flags, source-anchor navigation metadata, static return metadata, and stable
-  input-limit finding codes
+  `mf script-pack run code/outline scan <path...> --json`, containing a bounded source outline with
+  file hashes, language metadata, symbol names, declaration kinds, line ranges, signatures, export
+  flags, source-anchor navigation metadata, static return metadata, and stable input-limit finding
+  codes
 - `code-symbol-read-report.schema.json`: output of
   `mf script-pack run code/symbol-read read <path> --start-line <line> --json`, containing a
-  focused source snippet selected by outline symbol line or explicit line range with file hash,
-  resolved line metadata, optional symbol and static return metadata, and stable range/read finding codes
+  focused source snippet selected by source anchor, outline symbol line, or explicit line range with
+  file hash, resolved line metadata, optional anchor, symbol and static return metadata, and stable
+  range/read finding codes
+- `route-outline-report.schema.json`: output of
+  `mf script-pack run code/route-outline scan <path...> --json`, containing a bounded Hono,
+  Elysia, Axum, and NestJS route outline with file hashes, framework evidence, route methods,
+  route paths, optional handler names, line ranges, lifecycle-chain metadata, and stable input-limit
+  finding codes
+- `export-diff-report.schema.json`: output of
+  `mf script-pack run code/export-diff compare [path...] --json`, containing a bounded git-based
+  comparison of exported TypeScript and JavaScript declarations, signatures, return metadata,
+  package surface hints, and unresolved re-export findings
+- `reference-drift-report.schema.json`: output of
+  `mf script-pack run docs/reference-drift check [path...] --json`, containing checked
+  documentation references to `mf` commands, script-pack refs, schema files, repository paths,
+  and stable stale-reference finding codes
+- `config-chain-report.schema.json`: output of
+  `mf script-pack run repo/config-chain inspect <path...> --json`, containing nearby package,
+  TypeScript, ESLint, Prettier, Vite, Vitest, Tailwind, Jest, Playwright, and mustflow config files
+  with static inheritance, reference, workspace, dynamic-config, path, and content-hash metadata
 - `text-budget-report.schema.json`: output of
   `mf script-pack run core/text-budget check <path...> --json`, containing
   exact text-budget metrics, input content hashes, policy metadata, findings, and JSON Pointer field
@@ -80,6 +98,10 @@ Current schemas:
 - `generated-boundary-report.schema.json`: output of
   `mf script-pack run repo/generated-boundary check <path...> --json`, containing candidate path
   classifications for generated, ignored, protected, vendor, and cache boundaries before or after edits
+- `related-files-report.schema.json`: output of
+  `mf script-pack run repo/related-files map <path...> --json`, containing conservative related-file
+  candidates from direct imports, importers, same-basename siblings, parent configuration files, and
+  package boundaries for source-oriented repository navigation
 - `skill-route-report.schema.json`: output of `mf skill route --json`, containing compact route
   candidates, selected main and adjunct skills, score breakdowns, route read plans, source route
   shards, and optional read-only script-pack helper suggestions without granting command authority

package/schemas/code-outline-report.schema.json

@@ -61,7 +61,7 @@
       "pattern": "^sha256:[a-f0-9]{64}$"
     },
     "language": {
-      "enum": ["typescript", "tsx", "javascript", "jsx", "javascript-module", "javascript-commonjs"]
+      "enum": ["typescript", "tsx", "javascript", "jsx", "javascript-module", "javascript-commonjs", "astro", "svelte", "go", "rust", "python"]
     },
     "symbolKind": {
       "enum": ["function", "class", "interface", "type", "enum", "variable"]

package/schemas/code-symbol-read-report.schema.json

@@ -60,7 +60,7 @@
       "pattern": "^sha256:[a-f0-9]{64}$"
     },
     "language": {
-      "enum": ["typescript", "tsx", "javascript", "jsx", "javascript-module", "javascript-commonjs"]
+      "enum": ["typescript", "tsx", "javascript", "jsx", "javascript-module", "javascript-commonjs", "astro", "svelte", "go", "rust", "python"]
     },
     "symbolKind": {
       "enum": ["function", "class", "interface", "type", "enum", "variable"]
@@ -68,9 +68,10 @@
     "policy": {
       "type": "object",
       "additionalProperties": false,
-      "required": ["start_line", "end_line", "context_lines", "max_file_bytes", "max_snippet_lines"],
+      "required": ["anchor_id", "start_line", "end_line", "context_lines", "max_file_bytes", "max_snippet_lines"],
       "properties": {
-        "start_line": { "type": "integer", "minimum": 1 },
+        "anchor_id": { "type": ["string", "null"] },
+        "start_line": { "type": ["integer", "null"], "minimum": 1 },
         "end_line": { "type": ["integer", "null"], "minimum": 1 },
         "context_lines": { "type": "integer", "minimum": 0 },
         "max_file_bytes": { "type": "integer", "minimum": 1 },
@@ -124,6 +125,53 @@
         "content_sha256": { "$ref": "#/$defs/sha256" }
       }
     },
+    "anchor": {
+      "type": "object",
+      "additionalProperties": false,
+      "required": [
+        "id",
+        "path",
+        "line_start",
+        "line_end",
+        "purpose",
+        "search",
+        "invariant",
+        "risk",
+        "navigation_only",
+        "can_instruct_agent",
+        "target_symbol_id",
+        "target_kind",
+        "target_name",
+        "target_start_line"
+      ],
+      "properties": {
+        "id": { "type": "string" },
+        "path": { "type": "string" },
+        "line_start": { "type": "integer", "minimum": 1 },
+        "line_end": { "type": "integer", "minimum": 1 },
+        "purpose": { "type": ["string", "null"] },
+        "search": {
+          "type": "array",
+          "items": { "type": "string" }
+        },
+        "invariant": { "type": ["string", "null"] },
+        "risk": {
+          "type": "array",
+          "items": { "type": "string" }
+        },
+        "navigation_only": { "const": true },
+        "can_instruct_agent": { "const": false },
+        "target_symbol_id": { "type": ["string", "null"] },
+        "target_kind": {
+          "anyOf": [
+            { "$ref": "#/$defs/symbolKind" },
+            { "type": "null" }
+          ]
+        },
+        "target_name": { "type": ["string", "null"] },
+        "target_start_line": { "type": ["integer", "null"], "minimum": 1 }
+      }
+    },
     "target": {
       "type": "object",
       "additionalProperties": false,
@@ -133,12 +181,14 @@
         "sha256",
         "size_bytes",
         "line_count",
+        "requested_anchor_id",
         "requested_start_line",
         "requested_end_line",
         "resolved_start_line",
         "resolved_end_line",
         "context_start_line",
         "context_end_line",
+        "anchor",
         "symbol"
       ],
       "properties": {
@@ -147,12 +197,19 @@
         "sha256": { "$ref": "#/$defs/sha256" },
         "size_bytes": { "type": "integer", "minimum": 0 },
         "line_count": { "type": "integer", "minimum": 0 },
-        "requested_start_line": { "type": "integer", "minimum": 1 },
+        "requested_anchor_id": { "type": ["string", "null"] },
+        "requested_start_line": { "type": ["integer", "null"], "minimum": 1 },
         "requested_end_line": { "type": ["integer", "null"], "minimum": 1 },
         "resolved_start_line": { "type": ["integer", "null"], "minimum": 1 },
         "resolved_end_line": { "type": ["integer", "null"], "minimum": 1 },
         "context_start_line": { "type": ["integer", "null"], "minimum": 1 },
         "context_end_line": { "type": ["integer", "null"], "minimum": 1 },
+        "anchor": {
+          "anyOf": [
+            { "$ref": "#/$defs/anchor" },
+            { "type": "null" }
+          ]
+        },
         "symbol": {
           "anyOf": [
             { "$ref": "#/$defs/symbol" },
@@ -183,6 +240,9 @@
             "code_symbol_read_unreadable_path",
             "code_symbol_read_invalid_range",
             "code_symbol_read_no_symbol_at_line",
+            "code_symbol_read_anchor_not_found",
+            "code_symbol_read_anchor_ambiguous",
+            "code_symbol_read_anchor_without_symbol",
             "code_symbol_read_snippet_too_large"
           ]
         },

package/schemas/config-chain-report.schema.json

@@ -0,0 +1,187 @@
+{
+  "$schema": "https://json-schema.org/draft/2020-12/schema",
+  "$id": "https://mustflow.github.io/schemas/config-chain-report.schema.json",
+  "title": "mustflow config-chain report",
+  "type": "object",
+  "additionalProperties": false,
+  "required": [
+    "schema_version",
+    "command",
+    "pack_id",
+    "script_id",
+    "script_ref",
+    "action",
+    "status",
+    "ok",
+    "mustflow_root",
+    "policy",
+    "input_hash",
+    "targets",
+    "configs",
+    "edges",
+    "findings",
+    "issues"
+  ],
+  "properties": {
+    "schema_version": { "const": "1" },
+    "command": { "const": "script-pack" },
+    "pack_id": { "const": "repo" },
+    "script_id": { "const": "config-chain" },
+    "script_ref": { "const": "repo/config-chain" },
+    "action": { "const": "inspect" },
+    "status": { "enum": ["passed", "failed", "error"] },
+    "ok": { "type": "boolean" },
+    "mustflow_root": { "type": "string" },
+    "policy": { "$ref": "#/$defs/policy" },
+    "input_hash": { "$ref": "#/$defs/sha256" },
+    "targets": {
+      "type": "array",
+      "items": { "$ref": "#/$defs/target" }
+    },
+    "configs": {
+      "type": "array",
+      "items": { "$ref": "#/$defs/config" }
+    },
+    "edges": {
+      "type": "array",
+      "items": { "$ref": "#/$defs/edge" }
+    },
+    "findings": {
+      "type": "array",
+      "items": { "$ref": "#/$defs/finding" }
+    },
+    "issues": {
+      "type": "array",
+      "items": { "type": "string" }
+    }
+  },
+  "$defs": {
+    "sha256": {
+      "type": "string",
+      "pattern": "^sha256:[a-f0-9]{64}$"
+    },
+    "nullableSha256": {
+      "type": ["string", "null"],
+      "pattern": "^sha256:[a-f0-9]{64}$"
+    },
+    "stringArray": {
+      "type": "array",
+      "items": { "type": "string" }
+    },
+    "policy": {
+      "type": "object",
+      "additionalProperties": false,
+      "required": ["max_file_bytes", "max_configs", "config_names", "ignored_directories"],
+      "properties": {
+        "max_file_bytes": { "type": "integer", "minimum": 1 },
+        "max_configs": { "type": "integer", "minimum": 1 },
+        "config_names": { "$ref": "#/$defs/stringArray" },
+        "ignored_directories": { "$ref": "#/$defs/stringArray" }
+      }
+    },
+    "target": {
+      "type": "object",
+      "additionalProperties": false,
+      "required": ["input", "path", "exists", "kind"],
+      "properties": {
+        "input": { "type": "string" },
+        "path": { "type": "string" },
+        "exists": { "type": ["boolean", "null"] },
+        "kind": { "enum": ["file", "directory", "missing", "other", "unknown"] }
+      }
+    },
+    "kind": {
+      "enum": [
+        "package_json",
+        "tsconfig",
+        "eslint",
+        "prettier",
+        "vite",
+        "vitest",
+        "tailwind",
+        "jest",
+        "playwright",
+        "mustflow",
+        "other"
+      ]
+    },
+    "format": {
+      "enum": ["json", "jsonc", "javascript", "typescript", "yaml", "toml", "unknown"]
+    },
+    "config": {
+      "type": "object",
+      "additionalProperties": false,
+      "required": [
+        "path",
+        "kind",
+        "format",
+        "source",
+        "sha256",
+        "size_bytes",
+        "parseable",
+        "dynamic",
+        "package_name",
+        "workspaces",
+        "scripts",
+        "extends",
+        "references",
+        "include",
+        "exclude",
+        "compiler_options",
+        "summary"
+      ],
+      "properties": {
+        "path": { "type": "string" },
+        "kind": { "$ref": "#/$defs/kind" },
+        "format": { "$ref": "#/$defs/format" },
+        "source": { "enum": ["target", "parent", "discovered"] },
+        "sha256": { "$ref": "#/$defs/nullableSha256" },
+        "size_bytes": { "type": ["integer", "null"], "minimum": 0 },
+        "parseable": { "type": "boolean" },
+        "dynamic": { "type": "boolean" },
+        "package_name": { "type": ["string", "null"] },
+        "workspaces": { "$ref": "#/$defs/stringArray" },
+        "scripts": { "$ref": "#/$defs/stringArray" },
+        "extends": { "$ref": "#/$defs/stringArray" },
+        "references": { "$ref": "#/$defs/stringArray" },
+        "include": { "$ref": "#/$defs/stringArray" },
+        "exclude": { "$ref": "#/$defs/stringArray" },
+        "compiler_options": { "$ref": "#/$defs/stringArray" },
+        "summary": { "$ref": "#/$defs/stringArray" }
+      }
+    },
+    "edge": {
+      "type": "object",
+      "additionalProperties": false,
+      "required": ["from_path", "to_path", "kind", "specifier", "resolved"],
+      "properties": {
+        "from_path": { "type": "string" },
+        "to_path": { "type": ["string", "null"] },
+        "kind": { "enum": ["parent_config", "extends", "reference", "workspace"] },
+        "specifier": { "type": "string" },
+        "resolved": { "type": "boolean" }
+      }
+    },
+    "finding": {
+      "type": "object",
+      "additionalProperties": false,
+      "required": ["code", "severity", "message", "path"],
+      "properties": {
+        "code": {
+          "enum": [
+            "config_chain_path_outside_root",
+            "config_chain_unreadable_path",
+            "config_chain_parse_error",
+            "config_chain_dynamic_config",
+            "config_chain_external_reference",
+            "config_chain_missing_reference",
+            "config_chain_max_configs_exceeded"
+          ]
+        },
+        "severity": { "enum": ["low", "medium", "high", "critical"] },
+        "message": { "type": "string" },
+        "path": { "type": "string" }
+      }
+    }
+  }
+}