mustflow 2.84.0 → 2.85.4

package/README.md

@@ -128,9 +128,12 @@ mustflow installs and validates an agent workflow for user projects.
   evidence, and dashboard exports so agents justify new dependencies, helper-style surfaces,
   config/schema churn, and broad structural changes before treating added complexity as free.
 - Lists, suggests, and runs bundled read-only utility scripts through `mf script-pack`, including
-  `code/outline` for source symbol maps, `code/symbol-read` for focused source snippets,
+  `code/outline` for source symbol maps, `code/dependency-graph` for bounded relative import graphs,
+  `code/change-impact` for git-diff impact and verification hints, `code/symbol-read` for focused source snippets,
   `code/route-outline` for Hono, Elysia, Axum, and NestJS route maps, `docs/reference-drift` for stale
   documentation references, `repo/config-chain` for nearby config inheritance,
+  `repo/env-contract` for environment-variable contract drift,
+  `repo/secret-risk-scan` for plausible hardcoded-secret findings without printing values,
   `repo/generated-boundary` for candidate path safety checks, and `core/text-budget`
   for exact file and JSON-field length budgets, so future checks do not sprawl into top-level
   commands.
@@ -292,12 +295,16 @@ mf run mustflow_update_apply
 | `mf script-pack suggest --changed --json` | Rank optional read-only helpers for current changed files without running those helpers or granting command authority. |
 | `mf script-pack suggest --path <path> --phase before_change` | Rank helpers for an explicit path and workflow phase before deciding which script to run. |
 | `mf script-pack run code/outline scan <path...> --json` | Scan supported source files for symbol headers, line ranges, source anchors, return metadata, and content hashes. |
+| `mf script-pack run code/dependency-graph scan <path...> --json` | Trace bounded relative import, export, require, and dynamic import edges for TypeScript and JavaScript source files. |
+| `mf script-pack run code/change-impact analyze --base HEAD --json` | Analyze changed files and return bounded impact candidates, script-pack hints, and verification intent hints. |
 | `mf script-pack run code/symbol-read read <path> --start-line <line> --json` | Read the focused symbol range or bounded source snippet after `code/outline` identifies the relevant location. |
 | `mf script-pack run code/symbol-read read --anchor <id> --json` | Read the conservative target symbol for a structured `mf:anchor` source marker. |
 | `mf script-pack run code/route-outline scan <path...> --json` | Scan Hono, Elysia, Axum, and NestJS files for route methods, paths, handlers, lifecycle chains, line ranges, and content hashes. |
 | `mf script-pack run code/export-diff compare --base HEAD --json` | Compare exported TypeScript or JavaScript declarations, return metadata, and package surface hints against a git base. |
 | `mf script-pack run docs/reference-drift check [path...] --json` | Check documentation references to `mf` commands, script-pack refs, schema files, and repository paths against current local surfaces. |
 | `mf script-pack run repo/config-chain inspect <path...> --json` | Inspect nearby package, TypeScript, ESLint, Vite, Tailwind, test, and mustflow config files plus static inheritance edges without executing dynamic config code. |
+| `mf script-pack run repo/env-contract scan [path...] --json` | Scan code, CI, docs, config, and env examples for environment-variable contract drift without reading or printing real secret env values. |
+| `mf script-pack run repo/secret-risk-scan scan [path...] --json` | Scan code, docs, config, CI, and examples for plausible hardcoded secrets while reporting only redacted fingerprints. |
 | `mf script-pack run repo/generated-boundary check <path...> --json` | Check whether candidate paths cross generated, ignored, protected, vendor, or cache boundaries before or after edits. |
 | `mf script-pack run repo/related-files map <path...> --json` | Map direct imports, importers, same-basename siblings, and nearby config or package boundaries for source navigation. |
 | `mf script-pack run core/text-budget check <path...> --max <count>` | Check exact text length budgets for files using grapheme counts by default. |
@@ -330,7 +337,9 @@ Automation and agents should use `--json` output or `mf api serve --stdio` JSONL
 For script-pack helper selection, start with `mf script-pack suggest --changed --json` or an
 explicit `--path`. The suggestion report is only a ranking aid: it does not run scripts, prove
 verification, or bypass `.mustflow/config/commands.toml`. A common source-orientation flow is
-`code/outline` first, then `code/symbol-read` for the chosen symbol line or source anchor. After
+`code/outline` first, `code/dependency-graph` for relative import impact, then `code/symbol-read`
+for the chosen symbol line or source anchor. After a local diff exists, use `code/change-impact`
+to summarize changed surfaces, likely related files, optional helper scripts, and verification hints. After
 public-ish TypeScript or JavaScript changes, use `code/export-diff` to review exported signatures
 and return metadata against a git base. After docs, schema, CLI, or script-pack surface changes, use
 `docs/reference-drift` to catch stale references before treating docs as synchronized. For

package/dist/cli/commands/script-pack.js

@@ -62,12 +62,16 @@ export function getScriptPackHelp(lang = 'en') {
             'mf script-pack suggest --path src/cli/index.ts --phase before_change',
             'mf script-pack suggest --changed --phase after_change --json',
             'mf script-pack run code/outline scan src --json',
+            'mf script-pack run code/dependency-graph scan src/cli/index.ts --json',
+            'mf script-pack run code/change-impact analyze --base HEAD --json',
             'mf script-pack run code/symbol-read read src/cli/index.ts --start-line 25 --json',
             'mf script-pack run code/route-outline scan src/cli/index.ts --json',
             'mf script-pack run code/export-diff compare --base HEAD~1 --head HEAD --json',
             'mf script-pack run core/text-budget check README.md --max 5000',
             'mf script-pack run docs/reference-drift check README.md schemas/README.md --json',
             'mf script-pack run repo/config-chain inspect src/cli/index.ts --json',
+            'mf script-pack run repo/env-contract scan --json',
+            'mf script-pack run repo/secret-risk-scan scan src README.md --json',
             'mf script-pack run repo/generated-boundary check src/cli/index.ts --json',
             'mf script-pack run repo/related-files map src/cli/index.ts --json',
             'mf script-pack run core/text-budget --help',

package/dist/cli/i18n/en.js

@@ -774,6 +774,8 @@ Read these files before working:
     "scriptPack.pack.docs.summary": "Documentation reference utility scripts",
     "scriptPack.pack.repo.summary": "Repository-boundary utility scripts",
     "scriptPack.script.codeOutline.summary": "Scan TypeScript and JavaScript files for symbol headers and line ranges",
+    "scriptPack.script.codeDependencyGraph.summary": "Trace relative TypeScript and JavaScript dependency graph edges",
+    "scriptPack.script.codeChangeImpact.summary": "Analyze changed files for impact, script-pack, and verification hints",
     "scriptPack.script.codeSymbolRead.summary": "Read a bounded source snippet by source anchor, symbol line, or explicit line range",
     "scriptPack.script.codeRouteOutline.summary": "Scan Hono, Elysia, Axum, and NestJS route methods, paths, handlers, and lifecycle chains",
     "scriptPack.script.codeExportDiff.summary": "Compare exported source signatures and return metadata across git refs",
@@ -912,6 +914,48 @@ Read these files before working:
     "generatedBoundary.error.missingAction": "Specify a generated-boundary action: check",
     "generatedBoundary.error.unknownAction": "Unknown generated-boundary action: {action}",
     "generatedBoundary.error.missingPath": "Provide at least one path to check",
+    "dependencyGraph.help.summary": "Trace bounded relative import, export, require, and dynamic import edges for TypeScript and JavaScript source files.",
+    "dependencyGraph.help.option.maxDepth": "Maximum dependency depth from target files. Default: 2",
+    "dependencyGraph.help.option.maxFiles": "Maximum number of source files to scan. Default: 1000",
+    "dependencyGraph.help.option.maxFileBytes": "Maximum bytes to read from each source file. Default: 262144",
+    "dependencyGraph.help.option.maxNodes": "Maximum number of graph nodes to report. Default: 300",
+    "dependencyGraph.help.option.maxEdges": "Maximum number of graph edges to report. Default: 800",
+    "dependencyGraph.help.exit.ok": "The dependency graph completed without input or scan-limit findings",
+    "dependencyGraph.help.exit.fail": "The dependency graph found invalid input, unreadable paths, or scan limits",
+    "dependencyGraph.title": "mustflow dependency graph",
+    "dependencyGraph.label.targets": "Targets",
+    "dependencyGraph.label.nodes": "Nodes",
+    "dependencyGraph.label.edges": "Edges",
+    "dependencyGraph.label.cycles": "Cycles",
+    "dependencyGraph.label.truncated": "Truncated",
+    "dependencyGraph.label.cycleList": "Cycle hints",
+    "dependencyGraph.label.findings": "Findings",
+    "dependencyGraph.label.issues": "Issues",
+    "dependencyGraph.clean": "No relative dependency edges were found.",
+    "dependencyGraph.error.missingAction": "Specify a dependency-graph action: scan",
+    "dependencyGraph.error.unknownAction": "Unknown dependency-graph action: {action}",
+    "dependencyGraph.error.missingPath": "Provide at least one path to scan",
+    "dependencyGraph.error.invalidPositiveInteger": "{option} must be a positive safe integer: {value}",
+    "changeImpact.help.summary": "Analyze git changes and return bounded file-impact, script-pack, and verification hints.",
+    "changeImpact.help.option.base": "Git base ref to compare from. Default: HEAD",
+    "changeImpact.help.option.head": "Git head ref to compare to. Omit to compare the base with the working tree.",
+    "changeImpact.help.option.maxFiles": "Maximum number of changed files to inspect. Default: 200",
+    "changeImpact.help.option.maxImpacts": "Maximum number of impact candidates to report. Default: 300",
+    "changeImpact.help.option.maxFileBytes": "Maximum bytes to read from each source file while tracing dependencies. Default: 262144",
+    "changeImpact.help.exit.ok": "The change-impact analysis completed without input or scan-limit findings",
+    "changeImpact.help.exit.fail": "The change-impact analysis found invalid git input or scan limits",
+    "changeImpact.title": "mustflow change impact",
+    "changeImpact.label.changedFiles": "Changed files",
+    "changeImpact.label.impacts": "Impacts",
+    "changeImpact.label.truncated": "Truncated",
+    "changeImpact.label.scriptHints": "Script hints",
+    "changeImpact.label.verificationHints": "Verification hints",
+    "changeImpact.label.findings": "Findings",
+    "changeImpact.label.issues": "Issues",
+    "changeImpact.clean": "No changed files were found for the selected git range.",
+    "changeImpact.error.missingAction": "Specify a change-impact action: analyze",
+    "changeImpact.error.unknownAction": "Unknown change-impact action: {action}",
+    "changeImpact.error.invalidPositiveInteger": "{option} must be a positive safe integer: {value}",
     "relatedFiles.help.summary": "Map direct imports, importers, sibling files, and nearby config boundaries for source-oriented repository navigation.",
     "relatedFiles.help.option.maxFiles": "Maximum number of source or related files to scan. Default: 1000",
     "relatedFiles.help.option.maxFileBytes": "Maximum bytes to read from each source file. Default: 262144",
@@ -948,6 +992,41 @@ Read these files before working:
     "configChain.error.unknownAction": "Unknown config-chain action: {action}",
     "configChain.error.missingPath": "Provide at least one path to inspect",
     "configChain.error.invalidPositiveInteger": "{option} must be a positive safe integer: {value}",
+    "scriptPack.script.envContract.summary": "Scan repository environment-variable contracts without reading secret values",
+    "envContract.help.summary": "Scan code, CI, docs, config, and env examples for environment variable contract drift without printing env values.",
+    "envContract.help.option.maxFiles": "Maximum number of files to inspect. Default: 1000",
+    "envContract.help.option.maxFileBytes": "Maximum bytes to read from each inspected file. Default: 262144",
+    "envContract.help.option.maxKeys": "Maximum number of env keys to report. Default: 300",
+    "envContract.help.exit.ok": "The env contract scan completed without blocking findings",
+    "envContract.help.exit.fail": "The env contract scan found invalid input, unreadable files, or contract findings",
+    "envContract.title": "mustflow env contract",
+    "envContract.label.files": "Files",
+    "envContract.label.keys": "Keys",
+    "envContract.label.findings": "Findings",
+    "envContract.label.truncated": "Truncated",
+    "envContract.label.issues": "Issues",
+    "envContract.clean": "No environment variable references were found.",
+    "envContract.error.missingAction": "Specify an env-contract action: scan",
+    "envContract.error.unknownAction": "Unknown env-contract action: {action}",
+    "envContract.error.invalidPositiveInteger": "{option} must be a positive safe integer: {value}",
+    "scriptPack.script.secretRiskScan.summary": "Scan repository files for plausible secrets without printing secret values",
+    "secretRiskScan.help.summary": "Scan code, docs, config, CI, and examples for plausible hardcoded secrets without printing secret values.",
+    "secretRiskScan.help.option.maxFiles": "Maximum number of files to inspect. Default: 1000",
+    "secretRiskScan.help.option.maxFileBytes": "Maximum bytes to read from each inspected file. Default: 262144",
+    "secretRiskScan.help.option.maxFindings": "Maximum number of findings to report. Default: 200",
+    "secretRiskScan.help.exit.ok": "The secret-risk scan completed without blocking findings",
+    "secretRiskScan.help.exit.fail": "The secret-risk scan found invalid input, unreadable files, or secret-risk findings",
+    "secretRiskScan.title": "mustflow secret risk scan",
+    "secretRiskScan.label.files": "Files",
+    "secretRiskScan.label.findings": "Findings",
+    "secretRiskScan.label.highOrCritical": "High or critical",
+    "secretRiskScan.label.skippedSecretFiles": "Skipped secret files",
+    "secretRiskScan.label.truncated": "Truncated",
+    "secretRiskScan.label.issues": "Issues",
+    "secretRiskScan.clean": "No plausible hardcoded secrets were found.",
+    "secretRiskScan.error.missingAction": "Specify a secret-risk-scan action: scan",
+    "secretRiskScan.error.unknownAction": "Unknown secret-risk-scan action: {action}",
+    "secretRiskScan.error.invalidPositiveInteger": "{option} must be a positive safe integer: {value}",
     "run.help.summary": "Run a configured oneshot command from .mustflow/config/commands.toml.",
     "run.help.option.dryRun": "Print a non-executing command plan",
     "run.help.option.planOnly": "Alias for --dry-run",

package/dist/cli/i18n/es.js

@@ -774,6 +774,8 @@ Lee estos archivos antes de trabajar:
     "scriptPack.pack.docs.summary": "Documentation reference utility scripts",
     "scriptPack.pack.repo.summary": "Repository-boundary utility scripts",
     "scriptPack.script.codeOutline.summary": "Scan TypeScript and JavaScript files for symbol headers and line ranges",
+    "scriptPack.script.codeDependencyGraph.summary": "Trace relative TypeScript and JavaScript dependency graph edges",
+    "scriptPack.script.codeChangeImpact.summary": "Analyze changed files for impact, script-pack, and verification hints",
     "scriptPack.script.codeSymbolRead.summary": "Read a bounded source snippet by source anchor, symbol line, or explicit line range",
     "scriptPack.script.codeRouteOutline.summary": "Scan Hono, Elysia, Axum, and NestJS route methods, paths, handlers, and lifecycle chains",
     "scriptPack.script.codeExportDiff.summary": "Compare exported source signatures and return metadata across git refs",
@@ -912,6 +914,48 @@ Lee estos archivos antes de trabajar:
     "generatedBoundary.error.missingAction": "Specify a generated-boundary action: check",
     "generatedBoundary.error.unknownAction": "Unknown generated-boundary action: {action}",
     "generatedBoundary.error.missingPath": "Provide at least one path to check",
+    "dependencyGraph.help.summary": "Trace bounded relative import, export, require, and dynamic import edges for TypeScript and JavaScript source files.",
+    "dependencyGraph.help.option.maxDepth": "Maximum dependency depth from target files. Default: 2",
+    "dependencyGraph.help.option.maxFiles": "Maximum number of source files to scan. Default: 1000",
+    "dependencyGraph.help.option.maxFileBytes": "Maximum bytes to read from each source file. Default: 262144",
+    "dependencyGraph.help.option.maxNodes": "Maximum number of graph nodes to report. Default: 300",
+    "dependencyGraph.help.option.maxEdges": "Maximum number of graph edges to report. Default: 800",
+    "dependencyGraph.help.exit.ok": "The dependency graph completed without input or scan-limit findings",
+    "dependencyGraph.help.exit.fail": "The dependency graph found invalid input, unreadable paths, or scan limits",
+    "dependencyGraph.title": "mustflow dependency graph",
+    "dependencyGraph.label.targets": "Targets",
+    "dependencyGraph.label.nodes": "Nodes",
+    "dependencyGraph.label.edges": "Edges",
+    "dependencyGraph.label.cycles": "Cycles",
+    "dependencyGraph.label.truncated": "Truncated",
+    "dependencyGraph.label.cycleList": "Cycle hints",
+    "dependencyGraph.label.findings": "Findings",
+    "dependencyGraph.label.issues": "Issues",
+    "dependencyGraph.clean": "No relative dependency edges were found.",
+    "dependencyGraph.error.missingAction": "Specify a dependency-graph action: scan",
+    "dependencyGraph.error.unknownAction": "Unknown dependency-graph action: {action}",
+    "dependencyGraph.error.missingPath": "Provide at least one path to scan",
+    "dependencyGraph.error.invalidPositiveInteger": "{option} must be a positive safe integer: {value}",
+    "changeImpact.help.summary": "Analyze git changes and return bounded file-impact, script-pack, and verification hints.",
+    "changeImpact.help.option.base": "Git base ref to compare from. Default: HEAD",
+    "changeImpact.help.option.head": "Git head ref to compare to. Omit to compare the base with the working tree.",
+    "changeImpact.help.option.maxFiles": "Maximum number of changed files to inspect. Default: 200",
+    "changeImpact.help.option.maxImpacts": "Maximum number of impact candidates to report. Default: 300",
+    "changeImpact.help.option.maxFileBytes": "Maximum bytes to read from each source file while tracing dependencies. Default: 262144",
+    "changeImpact.help.exit.ok": "The change-impact analysis completed without input or scan-limit findings",
+    "changeImpact.help.exit.fail": "The change-impact analysis found invalid git input or scan limits",
+    "changeImpact.title": "mustflow change impact",
+    "changeImpact.label.changedFiles": "Changed files",
+    "changeImpact.label.impacts": "Impacts",
+    "changeImpact.label.truncated": "Truncated",
+    "changeImpact.label.scriptHints": "Script hints",
+    "changeImpact.label.verificationHints": "Verification hints",
+    "changeImpact.label.findings": "Findings",
+    "changeImpact.label.issues": "Issues",
+    "changeImpact.clean": "No changed files were found for the selected git range.",
+    "changeImpact.error.missingAction": "Specify a change-impact action: analyze",
+    "changeImpact.error.unknownAction": "Unknown change-impact action: {action}",
+    "changeImpact.error.invalidPositiveInteger": "{option} must be a positive safe integer: {value}",
     "relatedFiles.help.summary": "Map direct imports, importers, sibling files, and nearby config boundaries for source-oriented repository navigation.",
     "relatedFiles.help.option.maxFiles": "Maximum number of source or related files to scan. Default: 1000",
     "relatedFiles.help.option.maxFileBytes": "Maximum bytes to read from each source file. Default: 262144",
@@ -948,6 +992,41 @@ Lee estos archivos antes de trabajar:
     "configChain.error.unknownAction": "Unknown config-chain action: {action}",
     "configChain.error.missingPath": "Provide at least one path to inspect",
     "configChain.error.invalidPositiveInteger": "{option} must be a positive safe integer: {value}",
+    "scriptPack.script.envContract.summary": "Scan repository environment-variable contracts without reading secret values",
+    "envContract.help.summary": "Scan code, CI, docs, config, and env examples for environment variable contract drift without printing env values.",
+    "envContract.help.option.maxFiles": "Maximum number of files to inspect. Default: 1000",
+    "envContract.help.option.maxFileBytes": "Maximum bytes to read from each inspected file. Default: 262144",
+    "envContract.help.option.maxKeys": "Maximum number of env keys to report. Default: 300",
+    "envContract.help.exit.ok": "The env contract scan completed without blocking findings",
+    "envContract.help.exit.fail": "The env contract scan found invalid input, unreadable files, or contract findings",
+    "envContract.title": "mustflow env contract",
+    "envContract.label.files": "Files",
+    "envContract.label.keys": "Keys",
+    "envContract.label.findings": "Findings",
+    "envContract.label.truncated": "Truncated",
+    "envContract.label.issues": "Issues",
+    "envContract.clean": "No environment variable references were found.",
+    "envContract.error.missingAction": "Specify an env-contract action: scan",
+    "envContract.error.unknownAction": "Unknown env-contract action: {action}",
+    "envContract.error.invalidPositiveInteger": "{option} must be a positive safe integer: {value}",
+    "scriptPack.script.secretRiskScan.summary": "Scan repository files for plausible secrets without printing secret values",
+    "secretRiskScan.help.summary": "Scan code, docs, config, CI, and examples for plausible hardcoded secrets without printing secret values.",
+    "secretRiskScan.help.option.maxFiles": "Maximum number of files to inspect. Default: 1000",
+    "secretRiskScan.help.option.maxFileBytes": "Maximum bytes to read from each inspected file. Default: 262144",
+    "secretRiskScan.help.option.maxFindings": "Maximum number of findings to report. Default: 200",
+    "secretRiskScan.help.exit.ok": "The secret-risk scan completed without blocking findings",
+    "secretRiskScan.help.exit.fail": "The secret-risk scan found invalid input, unreadable files, or secret-risk findings",
+    "secretRiskScan.title": "mustflow secret risk scan",
+    "secretRiskScan.label.files": "Files",
+    "secretRiskScan.label.findings": "Findings",
+    "secretRiskScan.label.highOrCritical": "High or critical",
+    "secretRiskScan.label.skippedSecretFiles": "Skipped secret files",
+    "secretRiskScan.label.truncated": "Truncated",
+    "secretRiskScan.label.issues": "Issues",
+    "secretRiskScan.clean": "No plausible hardcoded secrets were found.",
+    "secretRiskScan.error.missingAction": "Specify a secret-risk-scan action: scan",
+    "secretRiskScan.error.unknownAction": "Unknown secret-risk-scan action: {action}",
+    "secretRiskScan.error.invalidPositiveInteger": "{option} must be a positive safe integer: {value}",
     "run.help.summary": "Ejecuta un comando configurado de una sola ejecución desde .mustflow/config/commands.toml.",
     "run.help.option.dryRun": "Imprime un plan de comando sin ejecutarlo",
     "run.help.option.planOnly": "Alias de --dry-run",

package/dist/cli/i18n/fr.js

@@ -774,6 +774,8 @@ Lisez ces fichiers avant de travailler :
     "scriptPack.pack.docs.summary": "Documentation reference utility scripts",
     "scriptPack.pack.repo.summary": "Repository-boundary utility scripts",
     "scriptPack.script.codeOutline.summary": "Scan TypeScript and JavaScript files for symbol headers and line ranges",
+    "scriptPack.script.codeDependencyGraph.summary": "Trace relative TypeScript and JavaScript dependency graph edges",
+    "scriptPack.script.codeChangeImpact.summary": "Analyze changed files for impact, script-pack, and verification hints",
     "scriptPack.script.codeSymbolRead.summary": "Read a bounded source snippet by source anchor, symbol line, or explicit line range",
     "scriptPack.script.codeRouteOutline.summary": "Scan Hono, Elysia, Axum, and NestJS route methods, paths, handlers, and lifecycle chains",
     "scriptPack.script.codeExportDiff.summary": "Compare exported source signatures and return metadata across git refs",
@@ -912,6 +914,48 @@ Lisez ces fichiers avant de travailler :
     "generatedBoundary.error.missingAction": "Specify a generated-boundary action: check",
     "generatedBoundary.error.unknownAction": "Unknown generated-boundary action: {action}",
     "generatedBoundary.error.missingPath": "Provide at least one path to check",
+    "dependencyGraph.help.summary": "Trace bounded relative import, export, require, and dynamic import edges for TypeScript and JavaScript source files.",
+    "dependencyGraph.help.option.maxDepth": "Maximum dependency depth from target files. Default: 2",
+    "dependencyGraph.help.option.maxFiles": "Maximum number of source files to scan. Default: 1000",
+    "dependencyGraph.help.option.maxFileBytes": "Maximum bytes to read from each source file. Default: 262144",
+    "dependencyGraph.help.option.maxNodes": "Maximum number of graph nodes to report. Default: 300",
+    "dependencyGraph.help.option.maxEdges": "Maximum number of graph edges to report. Default: 800",
+    "dependencyGraph.help.exit.ok": "The dependency graph completed without input or scan-limit findings",
+    "dependencyGraph.help.exit.fail": "The dependency graph found invalid input, unreadable paths, or scan limits",
+    "dependencyGraph.title": "mustflow dependency graph",
+    "dependencyGraph.label.targets": "Targets",
+    "dependencyGraph.label.nodes": "Nodes",
+    "dependencyGraph.label.edges": "Edges",
+    "dependencyGraph.label.cycles": "Cycles",
+    "dependencyGraph.label.truncated": "Truncated",
+    "dependencyGraph.label.cycleList": "Cycle hints",
+    "dependencyGraph.label.findings": "Findings",
+    "dependencyGraph.label.issues": "Issues",
+    "dependencyGraph.clean": "No relative dependency edges were found.",
+    "dependencyGraph.error.missingAction": "Specify a dependency-graph action: scan",
+    "dependencyGraph.error.unknownAction": "Unknown dependency-graph action: {action}",
+    "dependencyGraph.error.missingPath": "Provide at least one path to scan",
+    "dependencyGraph.error.invalidPositiveInteger": "{option} must be a positive safe integer: {value}",
+    "changeImpact.help.summary": "Analyze git changes and return bounded file-impact, script-pack, and verification hints.",
+    "changeImpact.help.option.base": "Git base ref to compare from. Default: HEAD",
+    "changeImpact.help.option.head": "Git head ref to compare to. Omit to compare the base with the working tree.",
+    "changeImpact.help.option.maxFiles": "Maximum number of changed files to inspect. Default: 200",
+    "changeImpact.help.option.maxImpacts": "Maximum number of impact candidates to report. Default: 300",
+    "changeImpact.help.option.maxFileBytes": "Maximum bytes to read from each source file while tracing dependencies. Default: 262144",
+    "changeImpact.help.exit.ok": "The change-impact analysis completed without input or scan-limit findings",
+    "changeImpact.help.exit.fail": "The change-impact analysis found invalid git input or scan limits",
+    "changeImpact.title": "mustflow change impact",
+    "changeImpact.label.changedFiles": "Changed files",
+    "changeImpact.label.impacts": "Impacts",
+    "changeImpact.label.truncated": "Truncated",
+    "changeImpact.label.scriptHints": "Script hints",
+    "changeImpact.label.verificationHints": "Verification hints",
+    "changeImpact.label.findings": "Findings",
+    "changeImpact.label.issues": "Issues",
+    "changeImpact.clean": "No changed files were found for the selected git range.",
+    "changeImpact.error.missingAction": "Specify a change-impact action: analyze",
+    "changeImpact.error.unknownAction": "Unknown change-impact action: {action}",
+    "changeImpact.error.invalidPositiveInteger": "{option} must be a positive safe integer: {value}",
     "relatedFiles.help.summary": "Map direct imports, importers, sibling files, and nearby config boundaries for source-oriented repository navigation.",
     "relatedFiles.help.option.maxFiles": "Maximum number of source or related files to scan. Default: 1000",
     "relatedFiles.help.option.maxFileBytes": "Maximum bytes to read from each source file. Default: 262144",
@@ -948,6 +992,41 @@ Lisez ces fichiers avant de travailler :
     "configChain.error.unknownAction": "Unknown config-chain action: {action}",
     "configChain.error.missingPath": "Provide at least one path to inspect",
     "configChain.error.invalidPositiveInteger": "{option} must be a positive safe integer: {value}",
+    "scriptPack.script.envContract.summary": "Scan repository environment-variable contracts without reading secret values",
+    "envContract.help.summary": "Scan code, CI, docs, config, and env examples for environment variable contract drift without printing env values.",
+    "envContract.help.option.maxFiles": "Maximum number of files to inspect. Default: 1000",
+    "envContract.help.option.maxFileBytes": "Maximum bytes to read from each inspected file. Default: 262144",
+    "envContract.help.option.maxKeys": "Maximum number of env keys to report. Default: 300",
+    "envContract.help.exit.ok": "The env contract scan completed without blocking findings",
+    "envContract.help.exit.fail": "The env contract scan found invalid input, unreadable files, or contract findings",
+    "envContract.title": "mustflow env contract",
+    "envContract.label.files": "Files",
+    "envContract.label.keys": "Keys",
+    "envContract.label.findings": "Findings",
+    "envContract.label.truncated": "Truncated",
+    "envContract.label.issues": "Issues",
+    "envContract.clean": "No environment variable references were found.",
+    "envContract.error.missingAction": "Specify an env-contract action: scan",
+    "envContract.error.unknownAction": "Unknown env-contract action: {action}",
+    "envContract.error.invalidPositiveInteger": "{option} must be a positive safe integer: {value}",
+    "scriptPack.script.secretRiskScan.summary": "Scan repository files for plausible secrets without printing secret values",
+    "secretRiskScan.help.summary": "Scan code, docs, config, CI, and examples for plausible hardcoded secrets without printing secret values.",
+    "secretRiskScan.help.option.maxFiles": "Maximum number of files to inspect. Default: 1000",
+    "secretRiskScan.help.option.maxFileBytes": "Maximum bytes to read from each inspected file. Default: 262144",
+    "secretRiskScan.help.option.maxFindings": "Maximum number of findings to report. Default: 200",
+    "secretRiskScan.help.exit.ok": "The secret-risk scan completed without blocking findings",
+    "secretRiskScan.help.exit.fail": "The secret-risk scan found invalid input, unreadable files, or secret-risk findings",
+    "secretRiskScan.title": "mustflow secret risk scan",
+    "secretRiskScan.label.files": "Files",
+    "secretRiskScan.label.findings": "Findings",
+    "secretRiskScan.label.highOrCritical": "High or critical",
+    "secretRiskScan.label.skippedSecretFiles": "Skipped secret files",
+    "secretRiskScan.label.truncated": "Truncated",
+    "secretRiskScan.label.issues": "Issues",
+    "secretRiskScan.clean": "No plausible hardcoded secrets were found.",
+    "secretRiskScan.error.missingAction": "Specify a secret-risk-scan action: scan",
+    "secretRiskScan.error.unknownAction": "Unknown secret-risk-scan action: {action}",
+    "secretRiskScan.error.invalidPositiveInteger": "{option} must be a positive safe integer: {value}",
     "run.help.summary": "Exécute une commande configurée à exécution unique depuis .mustflow/config/commands.toml.",
     "run.help.option.dryRun": "Imprime un plan de commande sans l'exécuter",
     "run.help.option.planOnly": "Alias de --dry-run",

package/dist/cli/i18n/hi.js

@@ -774,6 +774,8 @@ export const hiMessages = {
     "scriptPack.pack.docs.summary": "Documentation reference utility scripts",
     "scriptPack.pack.repo.summary": "Repository-boundary utility scripts",
     "scriptPack.script.codeOutline.summary": "Scan TypeScript and JavaScript files for symbol headers and line ranges",
+    "scriptPack.script.codeDependencyGraph.summary": "Trace relative TypeScript and JavaScript dependency graph edges",
+    "scriptPack.script.codeChangeImpact.summary": "Analyze changed files for impact, script-pack, and verification hints",
     "scriptPack.script.codeSymbolRead.summary": "Read a bounded source snippet by source anchor, symbol line, or explicit line range",
     "scriptPack.script.codeRouteOutline.summary": "Scan Hono, Elysia, Axum, and NestJS route methods, paths, handlers, and lifecycle chains",
     "scriptPack.script.codeExportDiff.summary": "Compare exported source signatures and return metadata across git refs",
@@ -912,6 +914,48 @@ export const hiMessages = {
     "generatedBoundary.error.missingAction": "Specify a generated-boundary action: check",
     "generatedBoundary.error.unknownAction": "Unknown generated-boundary action: {action}",
     "generatedBoundary.error.missingPath": "Provide at least one path to check",
+    "dependencyGraph.help.summary": "Trace bounded relative import, export, require, and dynamic import edges for TypeScript and JavaScript source files.",
+    "dependencyGraph.help.option.maxDepth": "Maximum dependency depth from target files. Default: 2",
+    "dependencyGraph.help.option.maxFiles": "Maximum number of source files to scan. Default: 1000",
+    "dependencyGraph.help.option.maxFileBytes": "Maximum bytes to read from each source file. Default: 262144",
+    "dependencyGraph.help.option.maxNodes": "Maximum number of graph nodes to report. Default: 300",
+    "dependencyGraph.help.option.maxEdges": "Maximum number of graph edges to report. Default: 800",
+    "dependencyGraph.help.exit.ok": "The dependency graph completed without input or scan-limit findings",
+    "dependencyGraph.help.exit.fail": "The dependency graph found invalid input, unreadable paths, or scan limits",
+    "dependencyGraph.title": "mustflow dependency graph",
+    "dependencyGraph.label.targets": "Targets",
+    "dependencyGraph.label.nodes": "Nodes",
+    "dependencyGraph.label.edges": "Edges",
+    "dependencyGraph.label.cycles": "Cycles",
+    "dependencyGraph.label.truncated": "Truncated",
+    "dependencyGraph.label.cycleList": "Cycle hints",
+    "dependencyGraph.label.findings": "Findings",
+    "dependencyGraph.label.issues": "Issues",
+    "dependencyGraph.clean": "No relative dependency edges were found.",
+    "dependencyGraph.error.missingAction": "Specify a dependency-graph action: scan",
+    "dependencyGraph.error.unknownAction": "Unknown dependency-graph action: {action}",
+    "dependencyGraph.error.missingPath": "Provide at least one path to scan",
+    "dependencyGraph.error.invalidPositiveInteger": "{option} must be a positive safe integer: {value}",
+    "changeImpact.help.summary": "Analyze git changes and return bounded file-impact, script-pack, and verification hints.",
+    "changeImpact.help.option.base": "Git base ref to compare from. Default: HEAD",
+    "changeImpact.help.option.head": "Git head ref to compare to. Omit to compare the base with the working tree.",
+    "changeImpact.help.option.maxFiles": "Maximum number of changed files to inspect. Default: 200",
+    "changeImpact.help.option.maxImpacts": "Maximum number of impact candidates to report. Default: 300",
+    "changeImpact.help.option.maxFileBytes": "Maximum bytes to read from each source file while tracing dependencies. Default: 262144",
+    "changeImpact.help.exit.ok": "The change-impact analysis completed without input or scan-limit findings",
+    "changeImpact.help.exit.fail": "The change-impact analysis found invalid git input or scan limits",
+    "changeImpact.title": "mustflow change impact",
+    "changeImpact.label.changedFiles": "Changed files",
+    "changeImpact.label.impacts": "Impacts",
+    "changeImpact.label.truncated": "Truncated",
+    "changeImpact.label.scriptHints": "Script hints",
+    "changeImpact.label.verificationHints": "Verification hints",
+    "changeImpact.label.findings": "Findings",
+    "changeImpact.label.issues": "Issues",
+    "changeImpact.clean": "No changed files were found for the selected git range.",
+    "changeImpact.error.missingAction": "Specify a change-impact action: analyze",
+    "changeImpact.error.unknownAction": "Unknown change-impact action: {action}",
+    "changeImpact.error.invalidPositiveInteger": "{option} must be a positive safe integer: {value}",
     "relatedFiles.help.summary": "Map direct imports, importers, sibling files, and nearby config boundaries for source-oriented repository navigation.",
     "relatedFiles.help.option.maxFiles": "Maximum number of source or related files to scan. Default: 1000",
     "relatedFiles.help.option.maxFileBytes": "Maximum bytes to read from each source file. Default: 262144",
@@ -948,6 +992,41 @@ export const hiMessages = {
     "configChain.error.unknownAction": "Unknown config-chain action: {action}",
     "configChain.error.missingPath": "Provide at least one path to inspect",
     "configChain.error.invalidPositiveInteger": "{option} must be a positive safe integer: {value}",
+    "scriptPack.script.envContract.summary": "Scan repository environment-variable contracts without reading secret values",
+    "envContract.help.summary": "Scan code, CI, docs, config, and env examples for environment variable contract drift without printing env values.",
+    "envContract.help.option.maxFiles": "Maximum number of files to inspect. Default: 1000",
+    "envContract.help.option.maxFileBytes": "Maximum bytes to read from each inspected file. Default: 262144",
+    "envContract.help.option.maxKeys": "Maximum number of env keys to report. Default: 300",
+    "envContract.help.exit.ok": "The env contract scan completed without blocking findings",
+    "envContract.help.exit.fail": "The env contract scan found invalid input, unreadable files, or contract findings",
+    "envContract.title": "mustflow env contract",
+    "envContract.label.files": "Files",
+    "envContract.label.keys": "Keys",
+    "envContract.label.findings": "Findings",
+    "envContract.label.truncated": "Truncated",
+    "envContract.label.issues": "Issues",
+    "envContract.clean": "No environment variable references were found.",
+    "envContract.error.missingAction": "Specify an env-contract action: scan",
+    "envContract.error.unknownAction": "Unknown env-contract action: {action}",
+    "envContract.error.invalidPositiveInteger": "{option} must be a positive safe integer: {value}",
+    "scriptPack.script.secretRiskScan.summary": "Scan repository files for plausible secrets without printing secret values",
+    "secretRiskScan.help.summary": "Scan code, docs, config, CI, and examples for plausible hardcoded secrets without printing secret values.",
+    "secretRiskScan.help.option.maxFiles": "Maximum number of files to inspect. Default: 1000",
+    "secretRiskScan.help.option.maxFileBytes": "Maximum bytes to read from each inspected file. Default: 262144",
+    "secretRiskScan.help.option.maxFindings": "Maximum number of findings to report. Default: 200",
+    "secretRiskScan.help.exit.ok": "The secret-risk scan completed without blocking findings",
+    "secretRiskScan.help.exit.fail": "The secret-risk scan found invalid input, unreadable files, or secret-risk findings",
+    "secretRiskScan.title": "mustflow secret risk scan",
+    "secretRiskScan.label.files": "Files",
+    "secretRiskScan.label.findings": "Findings",
+    "secretRiskScan.label.highOrCritical": "High or critical",
+    "secretRiskScan.label.skippedSecretFiles": "Skipped secret files",
+    "secretRiskScan.label.truncated": "Truncated",
+    "secretRiskScan.label.issues": "Issues",
+    "secretRiskScan.clean": "No plausible hardcoded secrets were found.",
+    "secretRiskScan.error.missingAction": "Specify a secret-risk-scan action: scan",
+    "secretRiskScan.error.unknownAction": "Unknown secret-risk-scan action: {action}",
+    "secretRiskScan.error.invalidPositiveInteger": "{option} must be a positive safe integer: {value}",
     "run.help.summary": ".mustflow/config/commands.toml से कॉन्फ़िगर की गई एक-बार चलने वाली कमांड चलाएँ।",
     "run.help.option.dryRun": "कमांड चलाए बिना उसका plan प्रिंट करें",
     "run.help.option.planOnly": "--dry-run का alias",

package/dist/cli/i18n/ko.js

@@ -774,6 +774,8 @@ export const koMessages = {
     "scriptPack.pack.docs.summary": "Documentation reference utility scripts",
     "scriptPack.pack.repo.summary": "Repository-boundary utility scripts",
     "scriptPack.script.codeOutline.summary": "TypeScript와 JavaScript 파일에서 symbol header와 라인 범위를 스캔합니다",
+    "scriptPack.script.codeDependencyGraph.summary": "Trace relative TypeScript and JavaScript dependency graph edges",
+    "scriptPack.script.codeChangeImpact.summary": "Analyze changed files for impact, script-pack, and verification hints",
     "scriptPack.script.codeSymbolRead.summary": "source anchor, symbol 라인, 또는 명시 라인 범위로 제한된 소스 snippet을 읽습니다",
     "scriptPack.script.codeRouteOutline.summary": "Hono, Elysia, Axum, NestJS route method, path, handler, lifecycle chain을 스캔합니다",
     "scriptPack.script.codeExportDiff.summary": "git ref 사이의 exported source signature와 return metadata를 비교합니다",
@@ -912,6 +914,48 @@ export const koMessages = {
     "generatedBoundary.error.missingAction": "Specify a generated-boundary action: check",
     "generatedBoundary.error.unknownAction": "Unknown generated-boundary action: {action}",
     "generatedBoundary.error.missingPath": "Provide at least one path to check",
+    "dependencyGraph.help.summary": "Trace bounded relative import, export, require, and dynamic import edges for TypeScript and JavaScript source files.",
+    "dependencyGraph.help.option.maxDepth": "Maximum dependency depth from target files. Default: 2",
+    "dependencyGraph.help.option.maxFiles": "Maximum number of source files to scan. Default: 1000",
+    "dependencyGraph.help.option.maxFileBytes": "Maximum bytes to read from each source file. Default: 262144",
+    "dependencyGraph.help.option.maxNodes": "Maximum number of graph nodes to report. Default: 300",
+    "dependencyGraph.help.option.maxEdges": "Maximum number of graph edges to report. Default: 800",
+    "dependencyGraph.help.exit.ok": "The dependency graph completed without input or scan-limit findings",
+    "dependencyGraph.help.exit.fail": "The dependency graph found invalid input, unreadable paths, or scan limits",
+    "dependencyGraph.title": "mustflow dependency graph",
+    "dependencyGraph.label.targets": "Targets",
+    "dependencyGraph.label.nodes": "Nodes",
+    "dependencyGraph.label.edges": "Edges",
+    "dependencyGraph.label.cycles": "Cycles",
+    "dependencyGraph.label.truncated": "Truncated",
+    "dependencyGraph.label.cycleList": "Cycle hints",
+    "dependencyGraph.label.findings": "Findings",
+    "dependencyGraph.label.issues": "Issues",
+    "dependencyGraph.clean": "No relative dependency edges were found.",
+    "dependencyGraph.error.missingAction": "Specify a dependency-graph action: scan",
+    "dependencyGraph.error.unknownAction": "Unknown dependency-graph action: {action}",
+    "dependencyGraph.error.missingPath": "Provide at least one path to scan",
+    "dependencyGraph.error.invalidPositiveInteger": "{option} must be a positive safe integer: {value}",
+    "changeImpact.help.summary": "Analyze git changes and return bounded file-impact, script-pack, and verification hints.",
+    "changeImpact.help.option.base": "Git base ref to compare from. Default: HEAD",
+    "changeImpact.help.option.head": "Git head ref to compare to. Omit to compare the base with the working tree.",
+    "changeImpact.help.option.maxFiles": "Maximum number of changed files to inspect. Default: 200",
+    "changeImpact.help.option.maxImpacts": "Maximum number of impact candidates to report. Default: 300",
+    "changeImpact.help.option.maxFileBytes": "Maximum bytes to read from each source file while tracing dependencies. Default: 262144",
+    "changeImpact.help.exit.ok": "The change-impact analysis completed without input or scan-limit findings",
+    "changeImpact.help.exit.fail": "The change-impact analysis found invalid git input or scan limits",
+    "changeImpact.title": "mustflow change impact",
+    "changeImpact.label.changedFiles": "Changed files",
+    "changeImpact.label.impacts": "Impacts",
+    "changeImpact.label.truncated": "Truncated",
+    "changeImpact.label.scriptHints": "Script hints",
+    "changeImpact.label.verificationHints": "Verification hints",
+    "changeImpact.label.findings": "Findings",
+    "changeImpact.label.issues": "Issues",
+    "changeImpact.clean": "No changed files were found for the selected git range.",
+    "changeImpact.error.missingAction": "Specify a change-impact action: analyze",
+    "changeImpact.error.unknownAction": "Unknown change-impact action: {action}",
+    "changeImpact.error.invalidPositiveInteger": "{option} must be a positive safe integer: {value}",
     "relatedFiles.help.summary": "Map direct imports, importers, sibling files, and nearby config boundaries for source-oriented repository navigation.",
     "relatedFiles.help.option.maxFiles": "Maximum number of source or related files to scan. Default: 1000",
     "relatedFiles.help.option.maxFileBytes": "Maximum bytes to read from each source file. Default: 262144",
@@ -948,6 +992,41 @@ export const koMessages = {
     "configChain.error.unknownAction": "Unknown config-chain action: {action}",
     "configChain.error.missingPath": "Provide at least one path to inspect",
     "configChain.error.invalidPositiveInteger": "{option} must be a positive safe integer: {value}",
+    "scriptPack.script.envContract.summary": "Scan repository environment-variable contracts without reading secret values",
+    "envContract.help.summary": "Scan code, CI, docs, config, and env examples for environment variable contract drift without printing env values.",
+    "envContract.help.option.maxFiles": "Maximum number of files to inspect. Default: 1000",
+    "envContract.help.option.maxFileBytes": "Maximum bytes to read from each inspected file. Default: 262144",
+    "envContract.help.option.maxKeys": "Maximum number of env keys to report. Default: 300",
+    "envContract.help.exit.ok": "The env contract scan completed without blocking findings",
+    "envContract.help.exit.fail": "The env contract scan found invalid input, unreadable files, or contract findings",
+    "envContract.title": "mustflow env contract",
+    "envContract.label.files": "Files",
+    "envContract.label.keys": "Keys",
+    "envContract.label.findings": "Findings",
+    "envContract.label.truncated": "Truncated",
+    "envContract.label.issues": "Issues",
+    "envContract.clean": "No environment variable references were found.",
+    "envContract.error.missingAction": "Specify an env-contract action: scan",
+    "envContract.error.unknownAction": "Unknown env-contract action: {action}",
+    "envContract.error.invalidPositiveInteger": "{option} must be a positive safe integer: {value}",
+    "scriptPack.script.secretRiskScan.summary": "Scan repository files for plausible secrets without printing secret values",
+    "secretRiskScan.help.summary": "Scan code, docs, config, CI, and examples for plausible hardcoded secrets without printing secret values.",
+    "secretRiskScan.help.option.maxFiles": "Maximum number of files to inspect. Default: 1000",
+    "secretRiskScan.help.option.maxFileBytes": "Maximum bytes to read from each inspected file. Default: 262144",
+    "secretRiskScan.help.option.maxFindings": "Maximum number of findings to report. Default: 200",
+    "secretRiskScan.help.exit.ok": "The secret-risk scan completed without blocking findings",
+    "secretRiskScan.help.exit.fail": "The secret-risk scan found invalid input, unreadable files, or secret-risk findings",
+    "secretRiskScan.title": "mustflow secret risk scan",
+    "secretRiskScan.label.files": "Files",
+    "secretRiskScan.label.findings": "Findings",
+    "secretRiskScan.label.highOrCritical": "High or critical",
+    "secretRiskScan.label.skippedSecretFiles": "Skipped secret files",
+    "secretRiskScan.label.truncated": "Truncated",
+    "secretRiskScan.label.issues": "Issues",
+    "secretRiskScan.clean": "No plausible hardcoded secrets were found.",
+    "secretRiskScan.error.missingAction": "Specify a secret-risk-scan action: scan",
+    "secretRiskScan.error.unknownAction": "Unknown secret-risk-scan action: {action}",
+    "secretRiskScan.error.invalidPositiveInteger": "{option} must be a positive safe integer: {value}",
     "run.help.summary": ".mustflow/config/commands.toml에 설정된 일회성 명령을 실행합니다.",
     "run.help.option.dryRun": "실행하지 않고 명령 계획을 출력합니다",
     "run.help.option.planOnly": "--dry-run과 같은 동작입니다",