mustflow 2.75.2 → 2.85.4

package/dist/core/config-loading.js

@@ -6,10 +6,17 @@ export const COMMAND_LIFECYCLES = new Set(['oneshot', 'server', 'watch', 'intera
 export const LONG_RUNNING_LIFECYCLES = new Set(['server', 'watch', 'interactive', 'browser', 'background']);
 export const COMMAND_RUN_POLICIES = new Set(['agent_allowed', 'requires_explicit_user_request', 'manual_only']);
 export const COMMANDS_CONFIG_RELATIVE_PATH = '.mustflow/config/commands.toml';
+export const COMMANDS_CONFIG_DIRECTORY_RELATIVE_PATH = '.mustflow/config';
 export const MUSTFLOW_CONFIG_RELATIVE_PATH = '.mustflow/config/mustflow.toml';
+const COMMAND_INCLUDE_DIRECTORY = 'commands';
+const COMMAND_INCLUDE_ALLOWED_TOP_LEVEL_KEYS = new Set(['intents', 'resources']);
+const WINDOWS_RESERVED_PATH_SEGMENTS = /^(?:con|prn|aux|nul|com[1-9]|lpt[1-9])(?:\..*)?$/iu;
 export function isRecord(value) {
     return typeof value === 'object' && value !== null && !Array.isArray(value);
 }
+function hasOwn(table, key) {
+    return Object.prototype.hasOwnProperty.call(table, key);
+}
 export function resolveMustflowConfigPath(projectRoot, relativePath) {
     return path.join(projectRoot, ...relativePath.split('/'));
 }
@@ -18,6 +25,119 @@ export function readMustflowOwnedTomlFile(projectRoot, relativePath) {
         maxBytes: 256 * 1024,
     }));
 }
+function normalizeCommandIncludePath(rawPath) {
+    return rawPath.trim().replace(/\\/gu, '/');
+}
+function commandIncludePathIsUnsafe(rawPath) {
+    const normalized = normalizeCommandIncludePath(rawPath);
+    const segments = normalized.split('/').filter((segment) => segment.length > 0);
+    return (normalized.length === 0 ||
+        normalized.includes('\0') ||
+        normalized.startsWith('/') ||
+        path.win32.isAbsolute(rawPath) ||
+        path.posix.isAbsolute(normalized) ||
+        segments.some((segment) => segment === '.' || segment === '..' || WINDOWS_RESERVED_PATH_SEGMENTS.test(segment)) ||
+        !normalized.startsWith(`${COMMAND_INCLUDE_DIRECTORY}/`) ||
+        !normalized.endsWith('.toml'));
+}
+function readCommandIncludePathsFromParsed(root) {
+    if (!hasOwn(root, 'include')) {
+        return [];
+    }
+    if (!isRecord(root.include)) {
+        throw new Error(`[include] in ${COMMANDS_CONFIG_RELATIVE_PATH} must be a TOML table`);
+    }
+    const files = root.include.files;
+    if (!Array.isArray(files) || files.some((entry) => typeof entry !== 'string' || entry.trim().length === 0)) {
+        throw new Error(`[include].files in ${COMMANDS_CONFIG_RELATIVE_PATH} must be a string array`);
+    }
+    const normalizedPaths = [];
+    const seen = new Set();
+    for (const file of files) {
+        const normalized = normalizeCommandIncludePath(file);
+        if (commandIncludePathIsUnsafe(file)) {
+            throw new Error(`Command include path "${file}" must be a relative ${COMMAND_INCLUDE_DIRECTORY}/*.toml path under ${COMMANDS_CONFIG_DIRECTORY_RELATIVE_PATH}`);
+        }
+        if (seen.has(normalized)) {
+            throw new Error(`Duplicate command include path "${normalized}" in ${COMMANDS_CONFIG_RELATIVE_PATH}`);
+        }
+        seen.add(normalized);
+        normalizedPaths.push(normalized);
+    }
+    return normalizedPaths;
+}
+export function readCommandContractIncludePaths(projectRoot) {
+    const parsed = readMustflowOwnedTomlFile(projectRoot, COMMANDS_CONFIG_RELATIVE_PATH);
+    if (!isRecord(parsed)) {
+        throw new Error(`${COMMANDS_CONFIG_RELATIVE_PATH} must contain a TOML table`);
+    }
+    return readCommandIncludePathsFromParsed(parsed).map((includePath) => `${COMMANDS_CONFIG_DIRECTORY_RELATIVE_PATH}/${includePath}`);
+}
+function assertCommandIncludeTable(includePath, parsed) {
+    if (!isRecord(parsed)) {
+        throw new Error(`${COMMANDS_CONFIG_DIRECTORY_RELATIVE_PATH}/${includePath} must contain a TOML table`);
+    }
+    for (const key of Object.keys(parsed)) {
+        if (!COMMAND_INCLUDE_ALLOWED_TOP_LEVEL_KEYS.has(key)) {
+            throw new Error(`${COMMANDS_CONFIG_DIRECTORY_RELATIVE_PATH}/${includePath} may define only [intents] and [resources] tables`);
+        }
+    }
+    return parsed;
+}
+function mergeCommandSection(target, source, sectionName, sourceLabel, seenSources) {
+    if (source === undefined) {
+        return;
+    }
+    if (!isRecord(source)) {
+        throw new Error(`${sourceLabel} [${sectionName}] must be a TOML table`);
+    }
+    for (const [name, value] of Object.entries(source)) {
+        const existingSource = seenSources.get(name);
+        if (existingSource) {
+            throw new Error(`Duplicate command ${sectionName.slice(0, -1)} "${name}" in ${sourceLabel}; already defined in ${existingSource}`);
+        }
+        target[name] = value;
+        seenSources.set(name, sourceLabel);
+    }
+}
+export function readResolvedCommandContractToml(projectRoot) {
+    const parsed = readMustflowOwnedTomlFile(projectRoot, COMMANDS_CONFIG_RELATIVE_PATH);
+    if (!isRecord(parsed)) {
+        throw new Error(`${COMMANDS_CONFIG_RELATIVE_PATH} must contain a TOML table`);
+    }
+    if (hasOwn(parsed, 'intents') && !isRecord(parsed.intents)) {
+        throw new Error(`[intents] table in ${COMMANDS_CONFIG_RELATIVE_PATH} must be a TOML table`);
+    }
+    if (hasOwn(parsed, 'resources') && !isRecord(parsed.resources)) {
+        throw new Error(`[resources] table in ${COMMANDS_CONFIG_RELATIVE_PATH} must be a TOML table`);
+    }
+    const merged = { ...parsed };
+    const mergedIntents = {};
+    const mergedResources = {};
+    const intentSources = new Map();
+    const resourceSources = new Map();
+    const includePaths = readCommandIncludePathsFromParsed(parsed);
+    let sawIntentTable = hasOwn(parsed, 'intents');
+    mergeCommandSection(mergedResources, parsed.resources, 'resources', COMMANDS_CONFIG_RELATIVE_PATH, resourceSources);
+    mergeCommandSection(mergedIntents, parsed.intents, 'intents', COMMANDS_CONFIG_RELATIVE_PATH, intentSources);
+    for (const includePath of includePaths) {
+        const includeRelativePath = `${COMMANDS_CONFIG_DIRECTORY_RELATIVE_PATH}/${includePath}`;
+        const includeTable = assertCommandIncludeTable(includePath, readMustflowOwnedTomlFile(projectRoot, includeRelativePath));
+        sawIntentTable = sawIntentTable || hasOwn(includeTable, 'intents');
+        mergeCommandSection(mergedResources, includeTable.resources, 'resources', includeRelativePath, resourceSources);
+        mergeCommandSection(mergedIntents, includeTable.intents, 'intents', includeRelativePath, intentSources);
+    }
+    if (Object.keys(mergedResources).length > 0) {
+        merged.resources = mergedResources;
+    }
+    if (sawIntentTable) {
+        merged.intents = mergedIntents;
+    }
+    else {
+        delete merged.intents;
+    }
+    return merged;
+}
 export function readMustflowConfig(projectRoot) {
     const parsed = readMustflowOwnedTomlFile(projectRoot, MUSTFLOW_CONFIG_RELATIVE_PATH);
     if (!isRecord(parsed)) {
@@ -30,10 +150,7 @@ export function readMustflowConfigIfExists(projectRoot) {
     return existsSync(configPath) ? readMustflowConfig(projectRoot) : undefined;
 }
 export function readCommandContract(projectRoot) {
-    const parsed = readMustflowOwnedTomlFile(projectRoot, COMMANDS_CONFIG_RELATIVE_PATH);
-    if (!isRecord(parsed)) {
-        throw new Error(`${COMMANDS_CONFIG_RELATIVE_PATH} must contain a TOML table`);
-    }
+    const parsed = readResolvedCommandContractToml(projectRoot);
     if (!isRecord(parsed.intents)) {
         throw new Error(`Missing [intents] table in ${COMMANDS_CONFIG_RELATIVE_PATH}`);
     }

package/dist/core/dependency-graph.js

@@ -0,0 +1,490 @@
+import { createHash } from 'node:crypto';
+import { existsSync, lstatSync, readdirSync } from 'node:fs';
+import path from 'node:path';
+import { ensureInside, ensureInsideWithoutSymlinks, readFileInsideWithoutSymlinks } from './safe-filesystem.js';
+export const DEPENDENCY_GRAPH_PACK_ID = 'code';
+export const DEPENDENCY_GRAPH_SCRIPT_ID = 'dependency-graph';
+export const DEPENDENCY_GRAPH_SCRIPT_REF = `${DEPENDENCY_GRAPH_PACK_ID}/${DEPENDENCY_GRAPH_SCRIPT_ID}`;
+const DEFAULT_MAX_FILE_BYTES = 256 * 1024;
+const DEFAULT_MAX_FILES = 1000;
+const DEFAULT_MAX_DEPTH = 2;
+const DEFAULT_MAX_NODES = 300;
+const DEFAULT_MAX_EDGES = 800;
+const MAX_ISSUES = 50;
+const MAX_CYCLES = 20;
+const SOURCE_EXTENSIONS = ['.ts', '.tsx', '.mts', '.cts', '.js', '.jsx', '.mjs', '.cjs'];
+const RESOLVE_EXTENSIONS = [...SOURCE_EXTENSIONS, '.json'];
+const IGNORED_DIRECTORIES = [
+    '.git',
+    '.mustflow/cache',
+    '.mustflow/state',
+    'node_modules',
+    'dist',
+    'build',
+    'coverage',
+    '.next',
+    '.turbo',
+];
+const ERROR_CODES = new Set([
+    'dependency_graph_path_outside_root',
+    'dependency_graph_unreadable_path',
+]);
+function toPosixPath(value) {
+    return value.replace(/\\/gu, '/');
+}
+function normalizeRelativePath(value) {
+    return toPosixPath(value).replace(/^\.\/+/u, '') || '.';
+}
+function sha256Tagged(value) {
+    return `sha256:${createHash('sha256').update(value).digest('hex')}`;
+}
+function languageForPath(filePath) {
+    switch (path.extname(filePath).toLowerCase()) {
+        case '.ts':
+        case '.mts':
+        case '.cts':
+            return filePath.endsWith('.d.ts') ? 'other' : 'typescript';
+        case '.tsx':
+            return 'tsx';
+        case '.js':
+            return 'javascript';
+        case '.jsx':
+            return 'jsx';
+        case '.mjs':
+            return 'javascript-module';
+        case '.cjs':
+            return 'javascript-commonjs';
+        case '.json':
+            return 'json';
+        default:
+            return 'other';
+    }
+}
+function isSourceLanguage(language) {
+    return language !== 'json' && language !== 'other';
+}
+function isIgnoredDirectory(relativePath) {
+    const normalized = normalizeRelativePath(relativePath);
+    return IGNORED_DIRECTORIES.some((directory) => normalized === directory || normalized.startsWith(`${directory}/`));
+}
+function makeFinding(code, severity, pathValue, message) {
+    return { code, severity, path: pathValue, message };
+}
+function pushIssue(issues, issue) {
+    if (issues.length < MAX_ISSUES) {
+        issues.push(issue);
+    }
+}
+function normalizeTargetPath(projectRoot, targetPath) {
+    const absolutePath = path.resolve(process.cwd(), targetPath);
+    ensureInside(projectRoot, absolutePath);
+    return {
+        absolutePath,
+        relativePath: normalizeRelativePath(path.relative(projectRoot, absolutePath)),
+    };
+}
+function targetKind(absolutePath) {
+    if (!existsSync(absolutePath)) {
+        return { exists: false, kind: 'missing' };
+    }
+    const stats = lstatSync(absolutePath);
+    if (stats.isFile()) {
+        return { exists: true, kind: 'file' };
+    }
+    if (stats.isDirectory()) {
+        return { exists: true, kind: 'directory' };
+    }
+    return { exists: true, kind: 'other' };
+}
+function collectFilesFromDirectory(projectRoot, absoluteDirectory, candidates, findings, issues, policy) {
+    const relativeDirectory = normalizeRelativePath(path.relative(projectRoot, absoluteDirectory));
+    if (isIgnoredDirectory(relativeDirectory)) {
+        return;
+    }
+    let entries;
+    try {
+        ensureInsideWithoutSymlinks(projectRoot, absoluteDirectory);
+        entries = readdirSync(absoluteDirectory, { withFileTypes: true });
+    }
+    catch (error) {
+        const message = error instanceof Error ? error.message : String(error);
+        pushIssue(issues, `${relativeDirectory}: ${message}`);
+        findings.push(makeFinding('dependency_graph_unreadable_path', 'high', relativeDirectory, message));
+        return;
+    }
+    for (const entry of entries) {
+        if (candidates.length >= policy.max_files) {
+            const message = `Dependency graph scan matched more than ${policy.max_files} files; remaining files were skipped.`;
+            pushIssue(issues, `${relativeDirectory}: ${message}`);
+            if (!findings.some((finding) => finding.code === 'dependency_graph_max_files_exceeded')) {
+                findings.push(makeFinding('dependency_graph_max_files_exceeded', 'medium', relativeDirectory, message));
+            }
+            return;
+        }
+        const absoluteEntry = path.join(absoluteDirectory, entry.name);
+        const relativeEntry = normalizeRelativePath(path.relative(projectRoot, absoluteEntry));
+        if (entry.isDirectory()) {
+            collectFilesFromDirectory(projectRoot, absoluteEntry, candidates, findings, issues, policy);
+            continue;
+        }
+        if (!entry.isFile() || !SOURCE_EXTENSIONS.includes(path.extname(entry.name).toLowerCase())) {
+            continue;
+        }
+        candidates.push({ absolutePath: absoluteEntry, relativePath: relativeEntry, language: languageForPath(absoluteEntry) });
+    }
+}
+function collectCandidateFiles(projectRoot, findings, issues, policy) {
+    const candidates = [];
+    collectFilesFromDirectory(projectRoot, projectRoot, candidates, findings, issues, policy);
+    return candidates.slice(0, policy.max_files);
+}
+function lineNumberAtIndex(text, index) {
+    let line = 1;
+    let offset = 0;
+    while (offset < index) {
+        if (text.charCodeAt(offset) === 10) {
+            line += 1;
+        }
+        offset += 1;
+    }
+    return line;
+}
+function extractImportSpecifiers(text) {
+    const results = [];
+    const patterns = [
+        {
+            kind: 'static_import',
+            pattern: /\bimport\s+(?:type\s+)?(?:[^'"]*?\s+from\s+)?['"](?<specifier>[^'"]+)['"]/gu,
+        },
+        {
+            kind: 'static_export',
+            pattern: /\bexport\s+(?:type\s+)?[^'"]*?\s+from\s+['"](?<specifier>[^'"]+)['"]/gu,
+        },
+        {
+            kind: 'dynamic_import',
+            pattern: /\bimport\s*\(\s*['"](?<specifier>[^'"]+)['"]\s*\)/gu,
+        },
+        {
+            kind: 'require',
+            pattern: /\brequire\s*\(\s*['"](?<specifier>[^'"]+)['"]\s*\)/gu,
+        },
+    ];
+    for (const { kind, pattern } of patterns) {
+        for (const match of text.matchAll(pattern)) {
+            const specifier = match.groups?.specifier;
+            if (specifier) {
+                results.push({ specifier, index: match.index ?? 0, kind });
+            }
+        }
+    }
+    return results.sort((left, right) => left.index - right.index || left.specifier.localeCompare(right.specifier));
+}
+function isRelativeSpecifier(specifier) {
+    return specifier.startsWith('./') || specifier.startsWith('../');
+}
+function fileExists(absolutePath) {
+    try {
+        return lstatSync(absolutePath).isFile();
+    }
+    catch {
+        return false;
+    }
+}
+function resolveRelativeImport(projectRoot, sourceAbsolutePath, specifier) {
+    if (!isRelativeSpecifier(specifier)) {
+        return null;
+    }
+    const base = path.resolve(path.dirname(sourceAbsolutePath), specifier);
+    const candidates = [
+        base,
+        ...RESOLVE_EXTENSIONS.map((extension) => `${base}${extension}`),
+        ...RESOLVE_EXTENSIONS.map((extension) => path.join(base, `index${extension}`)),
+    ];
+    for (const candidate of candidates) {
+        try {
+            ensureInside(projectRoot, candidate);
+            if (fileExists(candidate)) {
+                return normalizeRelativePath(path.relative(projectRoot, candidate));
+            }
+        }
+        catch {
+            return null;
+        }
+    }
+    return null;
+}
+function readImportsForFile(projectRoot, candidate, policy, issues) {
+    if (!isSourceLanguage(candidate.language)) {
+        return [];
+    }
+    let buffer;
+    try {
+        buffer = readFileInsideWithoutSymlinks(projectRoot, candidate.absolutePath, { maxBytes: policy.max_file_bytes });
+    }
+    catch (error) {
+        const message = error instanceof Error ? error.message : String(error);
+        pushIssue(issues, `${candidate.relativePath}: ${message}`);
+        return [];
+    }
+    const text = buffer.toString('utf8');
+    return extractImportSpecifiers(text).map((entry) => ({
+        specifier: entry.specifier,
+        line: lineNumberAtIndex(text, entry.index),
+        kind: entry.kind,
+        resolvedPath: resolveRelativeImport(projectRoot, candidate.absolutePath, entry.specifier),
+    }));
+}
+function edgeKey(edge) {
+    return [edge.source_path, edge.target_path, edge.kind, edge.line, edge.specifier].join('\0');
+}
+function addGraphFinding(findings, issues, code, pathValue, message) {
+    if (!findings.some((finding) => finding.code === code)) {
+        findings.push(makeFinding(code, 'medium', pathValue, message));
+        pushIssue(issues, message);
+    }
+}
+function addEdge(edges, edge, policy, findings, issues) {
+    if (edges.has(edgeKey(edge))) {
+        return;
+    }
+    if (edges.size >= policy.max_edges) {
+        addGraphFinding(findings, issues, 'dependency_graph_max_edges_exceeded', edge.source_path, `Dependency graph found more than ${policy.max_edges} edges; remaining edges were skipped.`);
+        return;
+    }
+    edges.set(edgeKey(edge), edge);
+}
+function targetSourceFiles(targets, sourceFiles) {
+    const sources = new Set(sourceFiles.map((file) => file.relativePath));
+    const selected = new Set();
+    for (const target of targets) {
+        if (target.kind === 'file' && sources.has(target.path)) {
+            selected.add(target.path);
+            continue;
+        }
+        if (target.kind !== 'directory') {
+            continue;
+        }
+        const prefix = target.path === '.' ? '' : `${target.path}/`;
+        for (const file of sourceFiles) {
+            if (prefix === '' || file.relativePath.startsWith(prefix)) {
+                selected.add(file.relativePath);
+            }
+        }
+    }
+    return [...selected].sort((left, right) => left.localeCompare(right));
+}
+function dependencyEdgesFor(sourcePath, importMap) {
+    return (importMap.get(sourcePath) ?? [])
+        .filter((reference) => reference.resolvedPath !== null)
+        .map((reference) => ({
+        source_path: sourcePath,
+        target_path: reference.resolvedPath ?? '',
+        specifier: reference.specifier,
+        line: reference.line,
+        kind: reference.kind,
+    }));
+}
+function buildIncludedGraph(startPaths, importMap, importerMap, policy, findings, issues) {
+    const queue = startPaths.map((sourcePath) => ({ sourcePath, depth: 0 }));
+    const nodeDepth = new Map();
+    const edgeMap = new Map();
+    for (const sourcePath of startPaths) {
+        nodeDepth.set(sourcePath, 0);
+    }
+    while (queue.length > 0) {
+        const current = queue.shift();
+        if (!current || current.depth >= policy.max_depth) {
+            continue;
+        }
+        for (const edge of dependencyEdgesFor(current.sourcePath, importMap)) {
+            addEdge(edgeMap, edge, policy, findings, issues);
+            if (!nodeDepth.has(edge.target_path)) {
+                if (nodeDepth.size >= policy.max_nodes) {
+                    addGraphFinding(findings, issues, 'dependency_graph_max_nodes_exceeded', edge.target_path, `Dependency graph found more than ${policy.max_nodes} nodes; remaining nodes were skipped.`);
+                    continue;
+                }
+                nodeDepth.set(edge.target_path, current.depth + 1);
+                queue.push({ sourcePath: edge.target_path, depth: current.depth + 1 });
+            }
+        }
+    }
+    for (const sourcePath of [...nodeDepth.keys()]) {
+        for (const edge of importerMap.get(sourcePath) ?? []) {
+            if (nodeDepth.has(edge.source_path)) {
+                addEdge(edgeMap, edge, policy, findings, issues);
+                continue;
+            }
+            if (nodeDepth.size >= policy.max_nodes) {
+                addGraphFinding(findings, issues, 'dependency_graph_max_nodes_exceeded', edge.source_path, `Dependency graph found more than ${policy.max_nodes} nodes; remaining nodes were skipped.`);
+                continue;
+            }
+            nodeDepth.set(edge.source_path, Math.max(1, (nodeDepth.get(sourcePath) ?? 0) + 1));
+            addEdge(edgeMap, edge, policy, findings, issues);
+        }
+    }
+    return {
+        nodeDepth,
+        edges: [...edgeMap.values()].sort((left, right) => left.source_path.localeCompare(right.source_path) ||
+            left.target_path.localeCompare(right.target_path) ||
+            left.line - right.line ||
+            left.kind.localeCompare(right.kind)),
+    };
+}
+function findCycles(edges) {
+    const adjacency = new Map();
+    for (const edge of edges) {
+        const targets = adjacency.get(edge.source_path) ?? [];
+        targets.push(edge.target_path);
+        adjacency.set(edge.source_path, targets);
+    }
+    for (const targets of adjacency.values()) {
+        targets.sort((left, right) => left.localeCompare(right));
+    }
+    const cycles = new Map();
+    const visit = (node, stack, seen) => {
+        if (cycles.size >= MAX_CYCLES) {
+            return;
+        }
+        const existingIndex = stack.indexOf(node);
+        if (existingIndex >= 0) {
+            const cycle = [...stack.slice(existingIndex), node];
+            const body = cycle.slice(0, -1);
+            const sorted = [...body].sort((left, right) => left.localeCompare(right));
+            cycles.set(sorted.join('\0'), cycle);
+            return;
+        }
+        if (seen.has(node)) {
+            return;
+        }
+        seen.add(node);
+        for (const next of adjacency.get(node) ?? []) {
+            visit(next, [...stack, node], seen);
+        }
+    };
+    for (const node of [...adjacency.keys()].sort((left, right) => left.localeCompare(right))) {
+        visit(node, [], new Set());
+    }
+    return [...cycles.values()];
+}
+function dependencyGraphStatus(findings) {
+    if (findings.some((finding) => ERROR_CODES.has(finding.code))) {
+        return 'error';
+    }
+    return findings.length > 0 ? 'failed' : 'passed';
+}
+function createInputHash(policy, targets, nodes, edges, findings, issues) {
+    return sha256Tagged(JSON.stringify({
+        policy,
+        targets,
+        nodes: nodes.map((node) => node.path),
+        edges: edges.map((edge) => [edge.source_path, edge.target_path, edge.kind, edge.line]),
+        findings: findings.map((finding) => ({ code: finding.code, path: finding.path })),
+        issues,
+    }));
+}
+export function inspectDependencyGraph(projectRoot, options) {
+    const root = path.resolve(projectRoot);
+    const policy = {
+        max_file_bytes: options.maxFileBytes ?? DEFAULT_MAX_FILE_BYTES,
+        max_files: options.maxFiles ?? DEFAULT_MAX_FILES,
+        max_depth: options.maxDepth ?? DEFAULT_MAX_DEPTH,
+        max_nodes: options.maxNodes ?? DEFAULT_MAX_NODES,
+        max_edges: options.maxEdges ?? DEFAULT_MAX_EDGES,
+        extensions: [...SOURCE_EXTENSIONS],
+        ignored_directories: [...IGNORED_DIRECTORIES],
+    };
+    const targets = [];
+    const findings = [];
+    const issues = [];
+    for (const targetPath of options.paths) {
+        let absolutePath;
+        let relativePath;
+        try {
+            const normalized = normalizeTargetPath(root, targetPath);
+            absolutePath = normalized.absolutePath;
+            relativePath = normalized.relativePath;
+            ensureInsideWithoutSymlinks(root, absolutePath, { allowMissingLeaf: true });
+        }
+        catch (error) {
+            const message = error instanceof Error ? error.message : String(error);
+            pushIssue(issues, message);
+            targets.push({ input: targetPath, path: targetPath, exists: null, kind: 'unknown', language: 'other' });
+            findings.push(makeFinding('dependency_graph_path_outside_root', 'high', targetPath, message));
+            continue;
+        }
+        try {
+            const existence = targetKind(absolutePath);
+            targets.push({
+                input: targetPath,
+                path: relativePath,
+                exists: existence.exists,
+                kind: existence.kind,
+                language: languageForPath(absolutePath),
+            });
+        }
+        catch (error) {
+            const message = error instanceof Error ? error.message : String(error);
+            pushIssue(issues, `${relativePath}: ${message}`);
+            targets.push({ input: targetPath, path: relativePath, exists: null, kind: 'unknown', language: 'other' });
+            findings.push(makeFinding('dependency_graph_unreadable_path', 'high', relativePath, message));
+        }
+    }
+    const sourceFiles = collectCandidateFiles(root, findings, issues, policy);
+    const sourceByPath = new Map(sourceFiles.map((file) => [file.relativePath, file]));
+    const importMap = new Map();
+    const importerMap = new Map();
+    for (const file of sourceFiles) {
+        const references = readImportsForFile(root, file, policy, issues);
+        importMap.set(file.relativePath, references);
+        for (const edge of dependencyEdgesFor(file.relativePath, importMap)) {
+            const importers = importerMap.get(edge.target_path) ?? [];
+            importers.push(edge);
+            importerMap.set(edge.target_path, importers);
+        }
+    }
+    const startPaths = targetSourceFiles(targets, sourceFiles);
+    const graph = buildIncludedGraph(startPaths, importMap, importerMap, policy, findings, issues);
+    const targetSet = new Set(startPaths);
+    const importCount = new Map();
+    const importerCount = new Map();
+    for (const edge of graph.edges) {
+        importCount.set(edge.source_path, (importCount.get(edge.source_path) ?? 0) + 1);
+        importerCount.set(edge.target_path, (importerCount.get(edge.target_path) ?? 0) + 1);
+    }
+    const nodes = [...graph.nodeDepth.entries()]
+        .map(([nodePath, depth]) => ({
+        path: nodePath,
+        language: sourceByPath.get(nodePath)?.language ?? languageForPath(nodePath),
+        target: targetSet.has(nodePath),
+        depth,
+        import_count: importCount.get(nodePath) ?? 0,
+        importer_count: importerCount.get(nodePath) ?? 0,
+    }))
+        .sort((left, right) => left.depth - right.depth || left.path.localeCompare(right.path));
+    const cycles = findCycles(graph.edges);
+    const status = dependencyGraphStatus(findings);
+    return {
+        schema_version: '1',
+        command: 'script-pack',
+        pack_id: DEPENDENCY_GRAPH_PACK_ID,
+        script_id: DEPENDENCY_GRAPH_SCRIPT_ID,
+        script_ref: DEPENDENCY_GRAPH_SCRIPT_REF,
+        action: 'scan',
+        status,
+        ok: status === 'passed',
+        mustflow_root: root,
+        policy,
+        input_hash: createInputHash(policy, targets, nodes, graph.edges, findings, issues),
+        targets,
+        nodes,
+        edges: graph.edges,
+        cycles,
+        truncated: findings.some((finding) => [
+            'dependency_graph_max_files_exceeded',
+            'dependency_graph_max_nodes_exceeded',
+            'dependency_graph_max_edges_exceeded',
+        ].includes(finding.code)),
+        findings,
+        issues,
+    };
+}