mustflow 2.84.0 → 2.85.4

package/dist/cli/script-packs/code-dependency-graph.js

@@ -0,0 +1,181 @@
+import { printUsageError, renderHelp } from '../lib/cli-output.js';
+import { t } from '../lib/i18n.js';
+import { formatCliOptionParseError, getParsedCliStringOption, hasCliOptionToken, hasParsedCliOption, parseCliOptions, } from '../lib/option-parser.js';
+import { resolveMustflowRoot } from '../lib/project-root.js';
+import { DEPENDENCY_GRAPH_SCRIPT_REF, inspectDependencyGraph, } from '../../core/dependency-graph.js';
+const DEPENDENCY_GRAPH_OPTIONS = [
+    { name: '--json', kind: 'boolean' },
+    { name: '--max-files', kind: 'string' },
+    { name: '--max-file-bytes', kind: 'string' },
+    { name: '--max-depth', kind: 'string' },
+    { name: '--max-nodes', kind: 'string' },
+    { name: '--max-edges', kind: 'string' },
+];
+function parsePositiveInteger(value, option, lang) {
+    if (value === null) {
+        return { value: null };
+    }
+    if (!/^[1-9]\d*$/u.test(value)) {
+        return { value: null, error: t(lang, 'dependencyGraph.error.invalidPositiveInteger', { option, value }) };
+    }
+    const parsed = Number(value);
+    if (!Number.isSafeInteger(parsed)) {
+        return { value: null, error: t(lang, 'dependencyGraph.error.invalidPositiveInteger', { option, value }) };
+    }
+    return { value: parsed };
+}
+export function getCodeDependencyGraphHelp(lang = 'en') {
+    return renderHelp({
+        usage: 'mf script-pack run code/dependency-graph scan <path...> [options]',
+        summary: t(lang, 'dependencyGraph.help.summary'),
+        options: [
+            { label: '--max-depth <count>', description: t(lang, 'dependencyGraph.help.option.maxDepth') },
+            { label: '--max-files <count>', description: t(lang, 'dependencyGraph.help.option.maxFiles') },
+            { label: '--max-file-bytes <bytes>', description: t(lang, 'dependencyGraph.help.option.maxFileBytes') },
+            { label: '--max-nodes <count>', description: t(lang, 'dependencyGraph.help.option.maxNodes') },
+            { label: '--max-edges <count>', description: t(lang, 'dependencyGraph.help.option.maxEdges') },
+            { label: '--json', description: t(lang, 'cli.option.json') },
+            { label: '-h, --help', description: t(lang, 'cli.option.help') },
+        ],
+        examples: [
+            'mf script-pack run code/dependency-graph scan src/cli/index.ts --json',
+            'mf script-pack run code/dependency-graph scan src/core --max-depth 3 --json',
+            'mf script-pack run code/dependency-graph scan src tests --max-nodes 120 --max-edges 300 --json',
+        ],
+        exitCodes: [
+            { label: '0', description: t(lang, 'dependencyGraph.help.exit.ok') },
+            { label: '1', description: t(lang, 'dependencyGraph.help.exit.fail') },
+        ],
+    }, lang);
+}
+function parseDependencyGraphOptions(args, lang) {
+    const [action, ...rest] = args;
+    const parsed = parseCliOptions(rest, DEPENDENCY_GRAPH_OPTIONS, { allowPositionals: true });
+    const json = hasParsedCliOption(parsed, '--json');
+    const maxFiles = parsePositiveInteger(getParsedCliStringOption(parsed, '--max-files'), '--max-files', lang);
+    const maxFileBytes = parsePositiveInteger(getParsedCliStringOption(parsed, '--max-file-bytes'), '--max-file-bytes', lang);
+    const maxDepth = parsePositiveInteger(getParsedCliStringOption(parsed, '--max-depth'), '--max-depth', lang);
+    const maxNodes = parsePositiveInteger(getParsedCliStringOption(parsed, '--max-nodes'), '--max-nodes', lang);
+    const maxEdges = parsePositiveInteger(getParsedCliStringOption(parsed, '--max-edges'), '--max-edges', lang);
+    const positiveOptions = [maxFiles, maxFileBytes, maxDepth, maxNodes, maxEdges];
+    if (action !== 'scan') {
+        return {
+            action: 'scan',
+            json,
+            paths: parsed.positionals,
+            maxFiles: maxFiles.value,
+            maxFileBytes: maxFileBytes.value,
+            maxDepth: maxDepth.value,
+            maxNodes: maxNodes.value,
+            maxEdges: maxEdges.value,
+            error: action ? t(lang, 'dependencyGraph.error.unknownAction', { action }) : t(lang, 'dependencyGraph.error.missingAction'),
+        };
+    }
+    if (parsed.error) {
+        return {
+            action,
+            json,
+            paths: parsed.positionals,
+            maxFiles: maxFiles.value,
+            maxFileBytes: maxFileBytes.value,
+            maxDepth: maxDepth.value,
+            maxNodes: maxNodes.value,
+            maxEdges: maxEdges.value,
+            error: formatCliOptionParseError(parsed.error, lang),
+        };
+    }
+    for (const candidate of positiveOptions) {
+        if (candidate.error) {
+            return {
+                action,
+                json,
+                paths: parsed.positionals,
+                maxFiles: maxFiles.value,
+                maxFileBytes: maxFileBytes.value,
+                maxDepth: maxDepth.value,
+                maxNodes: maxNodes.value,
+                maxEdges: maxEdges.value,
+                error: candidate.error,
+            };
+        }
+    }
+    if (parsed.positionals.length === 0) {
+        return {
+            action,
+            json,
+            paths: parsed.positionals,
+            maxFiles: maxFiles.value,
+            maxFileBytes: maxFileBytes.value,
+            maxDepth: maxDepth.value,
+            maxNodes: maxNodes.value,
+            maxEdges: maxEdges.value,
+            error: t(lang, 'dependencyGraph.error.missingPath'),
+        };
+    }
+    return {
+        action,
+        json,
+        paths: parsed.positionals,
+        maxFiles: maxFiles.value,
+        maxFileBytes: maxFileBytes.value,
+        maxDepth: maxDepth.value,
+        maxNodes: maxNodes.value,
+        maxEdges: maxEdges.value,
+    };
+}
+function renderDependencyGraphSummary(report, lang) {
+    const lines = [
+        t(lang, 'dependencyGraph.title'),
+        `${t(lang, 'scriptPack.label.script')}: ${DEPENDENCY_GRAPH_SCRIPT_REF}`,
+        `${t(lang, 'label.status')}: ${report.status}`,
+        `${t(lang, 'dependencyGraph.label.targets')}: ${report.targets.length}`,
+        `${t(lang, 'dependencyGraph.label.nodes')}: ${report.nodes.length}`,
+        `${t(lang, 'dependencyGraph.label.edges')}: ${report.edges.length}`,
+        `${t(lang, 'dependencyGraph.label.cycles')}: ${report.cycles.length}`,
+        `${t(lang, 'dependencyGraph.label.truncated')}: ${report.truncated ? t(lang, 'value.yes') : t(lang, 'value.no')}`,
+    ];
+    for (const edge of report.edges.slice(0, 40)) {
+        lines.push(`- ${edge.source_path}:${edge.line} -> ${edge.target_path} (${edge.kind}, ${edge.specifier})`);
+    }
+    if (report.cycles.length > 0) {
+        lines.push(t(lang, 'dependencyGraph.label.cycleList'));
+        for (const cycle of report.cycles) {
+            lines.push(`- ${cycle.join(' -> ')}`);
+        }
+    }
+    if (report.findings.length > 0) {
+        lines.push(t(lang, 'dependencyGraph.label.findings'), ...report.findings.map((finding) => `- ${finding.path}: ${finding.code} (${finding.message})`));
+    }
+    if (report.issues.length > 0) {
+        lines.push(t(lang, 'dependencyGraph.label.issues'), ...report.issues.map((issue) => `- ${issue}`));
+    }
+    if (report.edges.length === 0 && report.findings.length === 0 && report.issues.length === 0) {
+        lines.push(t(lang, 'dependencyGraph.clean'));
+    }
+    return lines.join('\n');
+}
+export function runCodeDependencyGraphScript(args, reporter, lang = 'en') {
+    if (hasCliOptionToken(args, '--help', ['-h'])) {
+        reporter.stdout(getCodeDependencyGraphHelp(lang));
+        return 0;
+    }
+    const options = parseDependencyGraphOptions(args, lang);
+    if (options.error) {
+        printUsageError(reporter, options.error, 'mf script-pack run code/dependency-graph --help', getCodeDependencyGraphHelp(lang), lang);
+        return 1;
+    }
+    const report = inspectDependencyGraph(resolveMustflowRoot(), {
+        paths: options.paths,
+        maxFiles: options.maxFiles ?? undefined,
+        maxFileBytes: options.maxFileBytes ?? undefined,
+        maxDepth: options.maxDepth ?? undefined,
+        maxNodes: options.maxNodes ?? undefined,
+        maxEdges: options.maxEdges ?? undefined,
+    });
+    if (options.json) {
+        reporter.stdout(JSON.stringify(report, null, 2));
+        return report.ok ? 0 : 1;
+    }
+    reporter.stdout(renderDependencyGraphSummary(report, lang));
+    return report.ok ? 0 : 1;
+}

package/dist/cli/script-packs/repo-env-contract.js

@@ -0,0 +1,156 @@
+import { printUsageError, renderHelp } from '../lib/cli-output.js';
+import { t } from '../lib/i18n.js';
+import { formatCliOptionParseError, getParsedCliStringOption, hasCliOptionToken, hasParsedCliOption, parseCliOptions, } from '../lib/option-parser.js';
+import { resolveMustflowRoot } from '../lib/project-root.js';
+import { ENV_CONTRACT_SCRIPT_REF, inspectEnvContract } from '../../core/env-contract.js';
+const ENV_CONTRACT_OPTIONS = [
+    { name: '--json', kind: 'boolean' },
+    { name: '--max-files', kind: 'string' },
+    { name: '--max-file-bytes', kind: 'string' },
+    { name: '--max-keys', kind: 'string' },
+];
+function parsePositiveInteger(value, option, lang) {
+    if (value === null) {
+        return { value: null };
+    }
+    if (!/^[1-9]\d*$/u.test(value)) {
+        return { value: null, error: t(lang, 'envContract.error.invalidPositiveInteger', { option, value }) };
+    }
+    const parsed = Number(value);
+    if (!Number.isSafeInteger(parsed)) {
+        return { value: null, error: t(lang, 'envContract.error.invalidPositiveInteger', { option, value }) };
+    }
+    return { value: parsed };
+}
+export function getRepoEnvContractHelp(lang = 'en') {
+    return renderHelp({
+        usage: 'mf script-pack run repo/env-contract scan [path...] [options]',
+        summary: t(lang, 'envContract.help.summary'),
+        options: [
+            { label: '--max-files <count>', description: t(lang, 'envContract.help.option.maxFiles') },
+            { label: '--max-file-bytes <bytes>', description: t(lang, 'envContract.help.option.maxFileBytes') },
+            { label: '--max-keys <count>', description: t(lang, 'envContract.help.option.maxKeys') },
+            { label: '--json', description: t(lang, 'cli.option.json') },
+            { label: '-h, --help', description: t(lang, 'cli.option.help') },
+        ],
+        examples: [
+            'mf script-pack run repo/env-contract scan --json',
+            'mf script-pack run repo/env-contract scan src .env.example --json',
+            'mf script-pack run repo/env-contract scan .github/workflows README.md --max-keys 120 --json',
+        ],
+        exitCodes: [
+            { label: '0', description: t(lang, 'envContract.help.exit.ok') },
+            { label: '1', description: t(lang, 'envContract.help.exit.fail') },
+        ],
+    }, lang);
+}
+function parseEnvContractOptions(args, lang) {
+    const [action, ...rest] = args;
+    const parsed = parseCliOptions(rest, ENV_CONTRACT_OPTIONS, { allowPositionals: true });
+    const json = hasParsedCliOption(parsed, '--json');
+    const maxFiles = parsePositiveInteger(getParsedCliStringOption(parsed, '--max-files'), '--max-files', lang);
+    const maxFileBytes = parsePositiveInteger(getParsedCliStringOption(parsed, '--max-file-bytes'), '--max-file-bytes', lang);
+    const maxKeys = parsePositiveInteger(getParsedCliStringOption(parsed, '--max-keys'), '--max-keys', lang);
+    if (action !== 'scan') {
+        return {
+            action: 'scan',
+            json,
+            paths: parsed.positionals,
+            maxFiles: maxFiles.value,
+            maxFileBytes: maxFileBytes.value,
+            maxKeys: maxKeys.value,
+            error: action ? t(lang, 'envContract.error.unknownAction', { action }) : t(lang, 'envContract.error.missingAction'),
+        };
+    }
+    if (parsed.error) {
+        return {
+            action,
+            json,
+            paths: parsed.positionals,
+            maxFiles: maxFiles.value,
+            maxFileBytes: maxFileBytes.value,
+            maxKeys: maxKeys.value,
+            error: formatCliOptionParseError(parsed.error, lang),
+        };
+    }
+    for (const candidate of [maxFiles, maxFileBytes, maxKeys]) {
+        if (candidate.error) {
+            return {
+                action,
+                json,
+                paths: parsed.positionals,
+                maxFiles: maxFiles.value,
+                maxFileBytes: maxFileBytes.value,
+                maxKeys: maxKeys.value,
+                error: candidate.error,
+            };
+        }
+    }
+    return {
+        action,
+        json,
+        paths: parsed.positionals,
+        maxFiles: maxFiles.value,
+        maxFileBytes: maxFileBytes.value,
+        maxKeys: maxKeys.value,
+    };
+}
+function renderEnvContractSummary(report, lang) {
+    const lines = [
+        t(lang, 'envContract.title'),
+        `${t(lang, 'scriptPack.label.script')}: ${ENV_CONTRACT_SCRIPT_REF}`,
+        `${t(lang, 'label.status')}: ${report.status}`,
+        `${t(lang, 'envContract.label.files')}: ${report.summary.file_count}`,
+        `${t(lang, 'envContract.label.keys')}: ${report.summary.key_count}`,
+        `${t(lang, 'envContract.label.findings')}: ${report.findings.length}`,
+        `${t(lang, 'envContract.label.truncated')}: ${report.truncated ? t(lang, 'value.yes') : t(lang, 'value.no')}`,
+    ];
+    for (const entry of report.keys.slice(0, 40)) {
+        const flags = [
+            entry.used_in_code ? 'code' : null,
+            entry.declared_in_example ? 'example' : null,
+            entry.documented ? 'docs' : null,
+            entry.referenced_in_ci ? 'ci' : null,
+            entry.secret_like ? 'secret-like' : null,
+            entry.public_like ? 'public-like' : null,
+        ].filter((flag) => flag !== null);
+        lines.push(`- ${entry.key}: ${flags.join(', ') || t(lang, 'value.none')} (${entry.source_count})`);
+    }
+    if (report.findings.length > 0) {
+        lines.push(t(lang, 'envContract.label.findings'));
+        for (const finding of report.findings.slice(0, 40)) {
+            const key = finding.key ? ` ${finding.key}` : '';
+            lines.push(`- ${finding.path}:${key} ${finding.code} (${finding.message})`);
+        }
+    }
+    if (report.issues.length > 0) {
+        lines.push(t(lang, 'envContract.label.issues'), ...report.issues.map((issue) => `- ${issue}`));
+    }
+    if (report.keys.length === 0 && report.findings.length === 0 && report.issues.length === 0) {
+        lines.push(t(lang, 'envContract.clean'));
+    }
+    return lines.join('\n');
+}
+export function runRepoEnvContractScript(args, reporter, lang = 'en') {
+    if (hasCliOptionToken(args, '--help', ['-h'])) {
+        reporter.stdout(getRepoEnvContractHelp(lang));
+        return 0;
+    }
+    const options = parseEnvContractOptions(args, lang);
+    if (options.error) {
+        printUsageError(reporter, options.error, 'mf script-pack run repo/env-contract --help', getRepoEnvContractHelp(lang), lang);
+        return 1;
+    }
+    const report = inspectEnvContract(resolveMustflowRoot(), {
+        paths: options.paths,
+        maxFiles: options.maxFiles ?? undefined,
+        maxFileBytes: options.maxFileBytes ?? undefined,
+        maxKeys: options.maxKeys ?? undefined,
+    });
+    if (options.json) {
+        reporter.stdout(JSON.stringify(report, null, 2));
+        return report.ok ? 0 : 1;
+    }
+    reporter.stdout(renderEnvContractSummary(report, lang));
+    return report.ok ? 0 : 1;
+}

package/dist/cli/script-packs/repo-secret-risk-scan.js

@@ -0,0 +1,147 @@
+import { printUsageError, renderHelp } from '../lib/cli-output.js';
+import { t } from '../lib/i18n.js';
+import { formatCliOptionParseError, getParsedCliStringOption, hasCliOptionToken, hasParsedCliOption, parseCliOptions, } from '../lib/option-parser.js';
+import { resolveMustflowRoot } from '../lib/project-root.js';
+import { inspectSecretRiskScan, SECRET_RISK_SCAN_SCRIPT_REF } from '../../core/secret-risk-scan.js';
+const SECRET_RISK_SCAN_OPTIONS = [
+    { name: '--json', kind: 'boolean' },
+    { name: '--max-files', kind: 'string' },
+    { name: '--max-file-bytes', kind: 'string' },
+    { name: '--max-findings', kind: 'string' },
+];
+function parsePositiveInteger(value, option, lang) {
+    if (value === null) {
+        return { value: null };
+    }
+    if (!/^[1-9]\d*$/u.test(value)) {
+        return { value: null, error: t(lang, 'secretRiskScan.error.invalidPositiveInteger', { option, value }) };
+    }
+    const parsed = Number(value);
+    if (!Number.isSafeInteger(parsed)) {
+        return { value: null, error: t(lang, 'secretRiskScan.error.invalidPositiveInteger', { option, value }) };
+    }
+    return { value: parsed };
+}
+export function getRepoSecretRiskScanHelp(lang = 'en') {
+    return renderHelp({
+        usage: 'mf script-pack run repo/secret-risk-scan scan [path...] [options]',
+        summary: t(lang, 'secretRiskScan.help.summary'),
+        options: [
+            { label: '--max-files <count>', description: t(lang, 'secretRiskScan.help.option.maxFiles') },
+            { label: '--max-file-bytes <bytes>', description: t(lang, 'secretRiskScan.help.option.maxFileBytes') },
+            { label: '--max-findings <count>', description: t(lang, 'secretRiskScan.help.option.maxFindings') },
+            { label: '--json', description: t(lang, 'cli.option.json') },
+            { label: '-h, --help', description: t(lang, 'cli.option.help') },
+        ],
+        examples: [
+            'mf script-pack run repo/secret-risk-scan scan --json',
+            'mf script-pack run repo/secret-risk-scan scan src README.md --json',
+            'mf script-pack run repo/secret-risk-scan scan .env.example docs --max-findings 50 --json',
+        ],
+        exitCodes: [
+            { label: '0', description: t(lang, 'secretRiskScan.help.exit.ok') },
+            { label: '1', description: t(lang, 'secretRiskScan.help.exit.fail') },
+        ],
+    }, lang);
+}
+function parseSecretRiskScanOptions(args, lang) {
+    const [action, ...rest] = args;
+    const parsed = parseCliOptions(rest, SECRET_RISK_SCAN_OPTIONS, { allowPositionals: true });
+    const json = hasParsedCliOption(parsed, '--json');
+    const maxFiles = parsePositiveInteger(getParsedCliStringOption(parsed, '--max-files'), '--max-files', lang);
+    const maxFileBytes = parsePositiveInteger(getParsedCliStringOption(parsed, '--max-file-bytes'), '--max-file-bytes', lang);
+    const maxFindings = parsePositiveInteger(getParsedCliStringOption(parsed, '--max-findings'), '--max-findings', lang);
+    if (action !== 'scan') {
+        return {
+            action: 'scan',
+            json,
+            paths: parsed.positionals,
+            maxFiles: maxFiles.value,
+            maxFileBytes: maxFileBytes.value,
+            maxFindings: maxFindings.value,
+            error: action ? t(lang, 'secretRiskScan.error.unknownAction', { action }) : t(lang, 'secretRiskScan.error.missingAction'),
+        };
+    }
+    if (parsed.error) {
+        return {
+            action,
+            json,
+            paths: parsed.positionals,
+            maxFiles: maxFiles.value,
+            maxFileBytes: maxFileBytes.value,
+            maxFindings: maxFindings.value,
+            error: formatCliOptionParseError(parsed.error, lang),
+        };
+    }
+    for (const candidate of [maxFiles, maxFileBytes, maxFindings]) {
+        if (candidate.error) {
+            return {
+                action,
+                json,
+                paths: parsed.positionals,
+                maxFiles: maxFiles.value,
+                maxFileBytes: maxFileBytes.value,
+                maxFindings: maxFindings.value,
+                error: candidate.error,
+            };
+        }
+    }
+    return {
+        action,
+        json,
+        paths: parsed.positionals,
+        maxFiles: maxFiles.value,
+        maxFileBytes: maxFileBytes.value,
+        maxFindings: maxFindings.value,
+    };
+}
+function renderSecretRiskScanSummary(report, lang) {
+    const lines = [
+        t(lang, 'secretRiskScan.title'),
+        `${t(lang, 'scriptPack.label.script')}: ${SECRET_RISK_SCAN_SCRIPT_REF}`,
+        `${t(lang, 'label.status')}: ${report.status}`,
+        `${t(lang, 'secretRiskScan.label.files')}: ${report.summary.file_count}`,
+        `${t(lang, 'secretRiskScan.label.findings')}: ${report.summary.finding_count}`,
+        `${t(lang, 'secretRiskScan.label.highOrCritical')}: ${report.summary.high_or_critical_count}`,
+        `${t(lang, 'secretRiskScan.label.skippedSecretFiles')}: ${report.summary.skipped_secret_file_count}`,
+        `${t(lang, 'secretRiskScan.label.truncated')}: ${report.truncated ? t(lang, 'value.yes') : t(lang, 'value.no')}`,
+    ];
+    if (report.findings.length > 0) {
+        lines.push(t(lang, 'secretRiskScan.label.findings'));
+        for (const finding of report.findings.slice(0, 40)) {
+            const line = finding.line ? `:${finding.line}` : '';
+            const detector = finding.detector ? ` ${finding.detector}` : '';
+            lines.push(`- ${finding.path}${line}: ${finding.code}${detector} (${finding.message})`);
+        }
+    }
+    if (report.issues.length > 0) {
+        lines.push(t(lang, 'secretRiskScan.label.issues'), ...report.issues.map((issue) => `- ${issue}`));
+    }
+    if (report.findings.length === 0 && report.issues.length === 0) {
+        lines.push(t(lang, 'secretRiskScan.clean'));
+    }
+    return lines.join('\n');
+}
+export function runRepoSecretRiskScanScript(args, reporter, lang = 'en') {
+    if (hasCliOptionToken(args, '--help', ['-h'])) {
+        reporter.stdout(getRepoSecretRiskScanHelp(lang));
+        return 0;
+    }
+    const options = parseSecretRiskScanOptions(args, lang);
+    if (options.error) {
+        printUsageError(reporter, options.error, 'mf script-pack run repo/secret-risk-scan --help', getRepoSecretRiskScanHelp(lang), lang);
+        return 1;
+    }
+    const report = inspectSecretRiskScan(resolveMustflowRoot(), {
+        paths: options.paths,
+        maxFiles: options.maxFiles ?? undefined,
+        maxFileBytes: options.maxFileBytes ?? undefined,
+        maxFindings: options.maxFindings ?? undefined,
+    });
+    if (options.json) {
+        reporter.stdout(JSON.stringify(report, null, 2));
+        return report.ok ? 0 : 1;
+    }
+    reporter.stdout(renderSecretRiskScanSummary(report, lang));
+    return report.ok ? 0 : 1;
+}