mustflow 2.84.0 → 2.85.4

package/dist/core/script-pack-suggestions.js

@@ -2,13 +2,14 @@ import { spawnSync } from 'node:child_process';
 import path from 'node:path';
 const CODE_NAVIGATION_SCRIPT_REFS = new Set([
     'code/outline',
+    'code/dependency-graph',
     'code/symbol-read',
     'code/route-outline',
     'code/export-diff',
     'repo/related-files',
 ]);
 const CONFIG_CHAIN_SURFACES = new Set(['config', 'package', 'source', 'test']);
-const CONFIG_FILE_PATTERN = /(?:^|\/)(?:tsconfig(?:\..*)?\.json|eslint\.config\.[cm]?[jt]s|\.eslintrc(?:\.json)?|\.prettierrc(?:\.json)?|prettier\.config\.[cm]?[jt]s|vite\.config\.[cm]?[jt]s|vitest\.config\.[cm]?[jt]s|tailwind\.config\.[cm]?[jt]s|jest\.config\.[cm]?[jt]s|playwright\.config\.[cm]?[jt]s|astro\.config\.mjs|svelte\.config\.js)$/u;
+const CONFIG_FILE_PATTERN = /(?:^|\/)(?:\.env\.(?:example|sample|template|defaults)|\.dev\.vars\.example|tsconfig(?:\..*)?\.json|eslint\.config\.[cm]?[jt]s|\.eslintrc(?:\.json)?|\.prettierrc(?:\.json)?|prettier\.config\.[cm]?[jt]s|vite\.config\.[cm]?[jt]s|vitest\.config\.[cm]?[jt]s|tailwind\.config\.[cm]?[jt]s|jest\.config\.[cm]?[jt]s|playwright\.config\.[cm]?[jt]s|astro\.config\.mjs|svelte\.config\.js)$/u;
 export function isScriptPackSuggestionPhase(value) {
     return ['before_change', 'during_change', 'after_change', 'review'].includes(value);
 }
@@ -166,6 +167,13 @@ function createRunHint(script, analyzedPaths) {
         }
         return 'After code/outline returns a source anchor, run: mf script-pack run code/symbol-read read --anchor <anchor-id> --json';
     }
+    if (script.ref === 'code/dependency-graph') {
+        const sourcePaths = pathsWithSurface(analyzedPaths, 'source');
+        return createConcretePathHint('mf script-pack run code/dependency-graph scan', sourcePaths, script.usage);
+    }
+    if (script.ref === 'code/change-impact') {
+        return 'mf script-pack run code/change-impact analyze --base HEAD --json';
+    }
     if (script.ref === 'code/route-outline') {
         const sourcePaths = pathsWithSurface(analyzedPaths, 'source');
         return createConcretePathHint('mf script-pack run code/route-outline scan', sourcePaths, script.usage);
@@ -200,6 +208,18 @@ function createRunHint(script, analyzedPaths) {
             .map((entry) => entry.path);
         return createConcretePathHint('mf script-pack run repo/config-chain inspect', configPaths, script.usage);
     }
+    if (script.ref === 'repo/env-contract') {
+        const envPaths = analyzedPaths
+            .filter((entry) => entry.surfaces.some((surface) => surface === 'config' || surface === 'source' || surface === 'docs' || surface === 'package'))
+            .map((entry) => entry.path);
+        return createConcretePathHint('mf script-pack run repo/env-contract scan', envPaths, script.usage);
+    }
+    if (script.ref === 'repo/secret-risk-scan') {
+        const secretRiskPaths = analyzedPaths
+            .filter((entry) => entry.surfaces.some((surface) => surface === 'config' || surface === 'source' || surface === 'docs' || surface === 'package' || surface === 'test'))
+            .map((entry) => entry.path);
+        return createConcretePathHint('mf script-pack run repo/secret-risk-scan scan', secretRiskPaths, script.usage);
+    }
     if (script.ref === 'repo/related-files') {
         const relatedPaths = analyzedPaths
             .filter((entry) => entry.surfaces.some((surface) => surface === 'source' || surface === 'test'))

package/dist/core/secret-risk-scan.js

@@ -0,0 +1,440 @@
+import { createHash } from 'node:crypto';
+import { existsSync, lstatSync, readdirSync } from 'node:fs';
+import path from 'node:path';
+import { ensureInside, ensureInsideWithoutSymlinks, readFileInsideWithoutSymlinks } from './safe-filesystem.js';
+export const SECRET_RISK_SCAN_PACK_ID = 'repo';
+export const SECRET_RISK_SCAN_SCRIPT_ID = 'secret-risk-scan';
+export const SECRET_RISK_SCAN_SCRIPT_REF = `${SECRET_RISK_SCAN_PACK_ID}/${SECRET_RISK_SCAN_SCRIPT_ID}`;
+const DEFAULT_MAX_FILE_BYTES = 256 * 1024;
+const DEFAULT_MAX_FILES = 1000;
+const DEFAULT_MAX_FINDINGS = 200;
+const MAX_ISSUES = 50;
+const SCAN_EXTENSIONS = [
+    '.ts',
+    '.tsx',
+    '.mts',
+    '.cts',
+    '.js',
+    '.jsx',
+    '.mjs',
+    '.cjs',
+    '.json',
+    '.toml',
+    '.yml',
+    '.yaml',
+    '.md',
+    '.mdx',
+];
+const SECRET_FILE_NAMES = ['.env', '.env.local', '.env.production', '.env.development', '.dev.vars'];
+const ENV_EXAMPLE_NAMES = [
+    '.env.example',
+    '.env.sample',
+    '.env.template',
+    '.env.defaults',
+    '.env.test.example',
+    '.env.local.example',
+    '.dev.vars.example',
+];
+const IGNORED_DIRECTORIES = [
+    '.git',
+    '.mustflow/cache',
+    '.mustflow/state',
+    'node_modules',
+    'dist',
+    'build',
+    'coverage',
+    '.next',
+    '.turbo',
+];
+const ERROR_CODES = new Set([
+    'secret_risk_path_outside_root',
+    'secret_risk_unreadable_path',
+]);
+function normalizeRelativePath(value) {
+    return value.replace(/\\/gu, '/').replace(/^\.\/+/u, '') || '.';
+}
+function fingerprint(value) {
+    return `sha256:${createHash('sha256').update(value).digest('hex').slice(0, 16)}`;
+}
+function sha256Tagged(value) {
+    return `sha256:${createHash('sha256').update(value).digest('hex')}`;
+}
+function pushIssue(issues, issue) {
+    if (issues.length < MAX_ISSUES) {
+        issues.push(issue);
+    }
+}
+function makeFinding(code, severity, pathValue, message, details = {}) {
+    return { code, severity, path: pathValue, message, ...details };
+}
+function isIgnoredDirectory(relativePath) {
+    const normalized = normalizeRelativePath(relativePath);
+    return IGNORED_DIRECTORIES.some((directory) => normalized === directory || normalized.startsWith(`${directory}/`));
+}
+function isSecretFile(relativePath) {
+    return SECRET_FILE_NAMES.includes(path.basename(relativePath).toLowerCase());
+}
+function isEnvExampleFile(relativePath) {
+    return ENV_EXAMPLE_NAMES.includes(path.basename(relativePath).toLowerCase());
+}
+function surfaceForPath(relativePath) {
+    if (isEnvExampleFile(relativePath)) {
+        return 'example';
+    }
+    const normalized = normalizeRelativePath(relativePath);
+    const extension = path.extname(normalized).toLowerCase();
+    if (!SCAN_EXTENSIONS.includes(extension)) {
+        return null;
+    }
+    if (normalized.startsWith('.github/workflows/') || ['.yml', '.yaml'].includes(extension)) {
+        return 'ci';
+    }
+    if (['.md', '.mdx'].includes(extension)) {
+        return 'docs';
+    }
+    if (['.json', '.toml'].includes(extension) || normalized.startsWith('.mustflow/config/')) {
+        return 'config';
+    }
+    return 'code';
+}
+function normalizeTargetPath(projectRoot, targetPath) {
+    const absolutePath = path.resolve(process.cwd(), targetPath);
+    ensureInside(projectRoot, absolutePath);
+    return {
+        absolutePath,
+        relativePath: normalizeRelativePath(path.relative(projectRoot, absolutePath)),
+    };
+}
+function targetKind(absolutePath) {
+    if (!existsSync(absolutePath)) {
+        return { exists: false, kind: 'missing' };
+    }
+    const stats = lstatSync(absolutePath);
+    if (stats.isFile()) {
+        return { exists: true, kind: 'file' };
+    }
+    if (stats.isDirectory()) {
+        return { exists: true, kind: 'directory' };
+    }
+    return { exists: true, kind: 'other' };
+}
+function addCandidate(candidates, findings, issues, policy, candidate) {
+    if (candidates.has(candidate.relativePath)) {
+        return;
+    }
+    if (candidates.size >= policy.max_files) {
+        if (!findings.some((finding) => finding.code === 'secret_risk_max_files_exceeded')) {
+            const message = `Secret-risk scan matched more than ${policy.max_files} files; remaining files were skipped.`;
+            pushIssue(issues, message);
+            findings.push(makeFinding('secret_risk_max_files_exceeded', 'medium', candidate.relativePath, message));
+        }
+        return;
+    }
+    candidates.set(candidate.relativePath, candidate);
+}
+function collectFilesFromDirectory(projectRoot, absoluteDirectory, candidates, findings, issues, policy) {
+    const relativeDirectory = normalizeRelativePath(path.relative(projectRoot, absoluteDirectory));
+    if (isIgnoredDirectory(relativeDirectory)) {
+        return;
+    }
+    let entries;
+    try {
+        ensureInsideWithoutSymlinks(projectRoot, absoluteDirectory);
+        entries = readdirSync(absoluteDirectory, { withFileTypes: true });
+    }
+    catch (error) {
+        const message = error instanceof Error ? error.message : String(error);
+        pushIssue(issues, `${relativeDirectory}: ${message}`);
+        findings.push(makeFinding('secret_risk_unreadable_path', 'high', relativeDirectory, message));
+        return;
+    }
+    for (const entry of entries) {
+        const absoluteEntry = path.join(absoluteDirectory, entry.name);
+        const relativeEntry = normalizeRelativePath(path.relative(projectRoot, absoluteEntry));
+        if (entry.isDirectory()) {
+            collectFilesFromDirectory(projectRoot, absoluteEntry, candidates, findings, issues, policy);
+            continue;
+        }
+        if (!entry.isFile()) {
+            continue;
+        }
+        const surface = surfaceForPath(relativeEntry);
+        if (surface || isSecretFile(relativeEntry)) {
+            addCandidate(candidates, findings, issues, policy, { absolutePath: absoluteEntry, relativePath: relativeEntry, surface: surface ?? 'config' });
+        }
+    }
+}
+function lineNumberAtIndex(text, index) {
+    let line = 1;
+    let offset = 0;
+    while (offset < index) {
+        if (text.charCodeAt(offset) === 10) {
+            line += 1;
+        }
+        offset += 1;
+    }
+    return line;
+}
+function looksLikePlaceholder(value) {
+    const normalized = value.trim().replace(/^['"`]|['"`]$/gu, '').toLowerCase();
+    if (normalized.length === 0) {
+        return true;
+    }
+    if (/^(?:example|sample|dummy|fake|test|changeme|change_me|placeholder|todo|null|undefined|your[_-].*|xxx+|\*+)$/u.test(normalized)) {
+        return true;
+    }
+    return ((normalized.startsWith('<') && normalized.endsWith('>')) ||
+        (normalized.startsWith('${') && normalized.endsWith('}')) ||
+        (normalized.startsWith('{{') && normalized.endsWith('}}')));
+}
+function entropyScore(value) {
+    const normalized = value.trim();
+    if (normalized.length === 0) {
+        return 0;
+    }
+    const counts = new Map();
+    for (const character of normalized) {
+        counts.set(character, (counts.get(character) ?? 0) + 1);
+    }
+    let entropy = 0;
+    for (const count of counts.values()) {
+        const probability = count / normalized.length;
+        entropy -= probability * Math.log2(probability);
+    }
+    return entropy;
+}
+function isSecretLikeName(name) {
+    return /(?:SECRET|TOKEN|PASSWORD|PASS|PRIVATE|CREDENTIAL|API[_-]?KEY|ACCESS[_-]?KEY|AUTH|SESSION|SIGNING|WEBHOOK)/iu.test(name);
+}
+function looksLikeSecretValue(value) {
+    const cleaned = value.trim().replace(/^['"`]|['"`]$/gu, '');
+    if (looksLikePlaceholder(cleaned)) {
+        return false;
+    }
+    if (/^(?:sk-[A-Za-z0-9_-]{20,}|ghp_[A-Za-z0-9_]{20,}|github_pat_[A-Za-z0-9_]{20,}|xox[baprs]-[A-Za-z0-9-]{20,}|AKIA[0-9A-Z]{16})$/u.test(cleaned)) {
+        return true;
+    }
+    return cleaned.length >= 24 && entropyScore(cleaned) >= 3.5 && /[A-Za-z]/u.test(cleaned) && /\d/u.test(cleaned);
+}
+function addBoundedFinding(findings, issues, policy, finding) {
+    if (findings.length >= policy.max_findings) {
+        if (!findings.some((entry) => entry.code === 'secret_risk_max_findings_exceeded')) {
+            const message = `Secret-risk scan found more than ${policy.max_findings} findings; remaining findings were skipped.`;
+            pushIssue(issues, message);
+            findings.push(makeFinding('secret_risk_max_findings_exceeded', 'medium', finding.path, message));
+        }
+        return;
+    }
+    findings.push(finding);
+}
+function scanPattern(text, candidate, findings, issues, policy, pattern, create) {
+    for (const match of text.matchAll(pattern)) {
+        const line = lineNumberAtIndex(text, match.index ?? 0);
+        const finding = create(match, line);
+        if (finding) {
+            addBoundedFinding(findings, issues, policy, finding);
+        }
+    }
+}
+function scanPrivateKeyBlocks(text, candidate, findings, issues, policy) {
+    scanPattern(text, candidate, findings, issues, policy, /-----BEGIN [A-Z ]*PRIVATE KEY-----/gu, (match, line) => makeFinding('secret_risk_private_key_block', 'critical', candidate.relativePath, 'Private key block marker found.', {
+        line,
+        detector: 'private_key_block',
+        fingerprint: fingerprint(match[0]),
+    }));
+}
+function scanBearerTokens(text, candidate, findings, issues, policy) {
+    scanPattern(text, candidate, findings, issues, policy, /\bBearer\s+(?<value>[A-Za-z0-9._~+/=-]{24,})\b/gu, (match, line) => {
+        const value = match.groups?.value ?? '';
+        if (!looksLikeSecretValue(value)) {
+            return null;
+        }
+        return makeFinding('secret_risk_bearer_token', 'high', candidate.relativePath, 'Bearer token-like value found.', {
+            line,
+            detector: 'bearer_token',
+            fingerprint: fingerprint(value),
+        });
+    });
+}
+function scanProviderTokens(text, candidate, findings, issues, policy) {
+    const pattern = /\b(?<value>sk-[A-Za-z0-9_-]{20,}|ghp_[A-Za-z0-9_]{20,}|github_pat_[A-Za-z0-9_]{20,}|xox[baprs]-[A-Za-z0-9-]{20,}|AKIA[0-9A-Z]{16})\b/gu;
+    scanPattern(text, candidate, findings, issues, policy, pattern, (match, line) => {
+        const value = match.groups?.value ?? '';
+        if (looksLikePlaceholder(value)) {
+            return null;
+        }
+        return makeFinding('secret_risk_provider_token', 'high', candidate.relativePath, 'Provider token-like value found.', {
+            line,
+            detector: 'provider_token',
+            fingerprint: fingerprint(value),
+        });
+    });
+}
+function scanAssignments(text, candidate, findings, issues, policy) {
+    const pattern = /(?:const|let|var|export\s+const|export\s+let|export\s+var)?\s*(?<name>[A-Za-z_][A-Za-z0-9_.-]*(?:SECRET|TOKEN|PASSWORD|PASS|PRIVATE|CREDENTIAL|API[_-]?KEY|ACCESS[_-]?KEY|AUTH|SESSION|SIGNING|WEBHOOK)[A-Za-z0-9_.-]*)\s*[:=]\s*["'`](?<value>[^"'`\r\n]{8,})["'`]/giu;
+    scanPattern(text, candidate, findings, issues, policy, pattern, (match, line) => {
+        const name = match.groups?.name ?? '';
+        const value = match.groups?.value ?? '';
+        if (!isSecretLikeName(name) || !looksLikeSecretValue(value)) {
+            return null;
+        }
+        return makeFinding('secret_risk_generic_assignment', 'high', candidate.relativePath, 'Secret-like assignment found.', {
+            line,
+            detector: 'generic_assignment',
+            fingerprint: fingerprint(`${name}:${value}`),
+        });
+    });
+}
+function scanEnvExample(text, candidate, findings, issues, policy) {
+    const lines = text.split(/\r?\n/u);
+    for (const [index, line] of lines.entries()) {
+        const match = /^\s*(?:export\s+)?(?<name>[A-Za-z_][A-Za-z0-9_.-]*)\s*=\s*(?<value>.+?)\s*$/u.exec(line);
+        if (!match?.groups) {
+            continue;
+        }
+        const { name, value } = match.groups;
+        if (!isSecretLikeName(name) || !looksLikeSecretValue(value)) {
+            continue;
+        }
+        addBoundedFinding(findings, issues, policy, makeFinding('secret_risk_realistic_env_example', 'medium', candidate.relativePath, 'Env example contains a realistic secret-like value.', {
+            line: index + 1,
+            detector: 'realistic_env_example',
+            fingerprint: fingerprint(`${name}:${value}`),
+        }));
+    }
+}
+function inspectCandidate(projectRoot, candidate, policy, findings, issues) {
+    if (isSecretFile(candidate.relativePath)) {
+        addBoundedFinding(findings, issues, policy, makeFinding('secret_risk_secret_file_skipped', 'low', candidate.relativePath, `${candidate.relativePath} was skipped to avoid reading real secret values.`, {
+            detector: 'secret_file_skipped',
+        }));
+        return;
+    }
+    let text;
+    try {
+        text = readFileInsideWithoutSymlinks(projectRoot, candidate.absolutePath, { maxBytes: policy.max_file_bytes }).toString('utf8');
+    }
+    catch (error) {
+        const message = error instanceof Error ? error.message : String(error);
+        pushIssue(issues, `${candidate.relativePath}: ${message}`);
+        findings.push(makeFinding('secret_risk_unreadable_path', 'high', candidate.relativePath, message));
+        return;
+    }
+    scanPrivateKeyBlocks(text, candidate, findings, issues, policy);
+    scanBearerTokens(text, candidate, findings, issues, policy);
+    scanProviderTokens(text, candidate, findings, issues, policy);
+    scanAssignments(text, candidate, findings, issues, policy);
+    if (candidate.surface === 'example') {
+        scanEnvExample(text, candidate, findings, issues, policy);
+    }
+}
+function secretRiskStatus(findings) {
+    if (findings.some((finding) => ERROR_CODES.has(finding.code))) {
+        return 'error';
+    }
+    if (findings.some((finding) => ['medium', 'high', 'critical'].includes(finding.severity))) {
+        return 'failed';
+    }
+    return 'passed';
+}
+function summarizeSecretRisk(targets, fileCount, findings) {
+    return {
+        target_count: targets.length,
+        file_count: fileCount,
+        finding_count: findings.length,
+        skipped_secret_file_count: findings.filter((finding) => finding.code === 'secret_risk_secret_file_skipped').length,
+        high_or_critical_count: findings.filter((finding) => ['high', 'critical'].includes(finding.severity)).length,
+    };
+}
+function createInputHash(policy, targets, findings, issues) {
+    return sha256Tagged(JSON.stringify({
+        policy,
+        targets,
+        findings: findings.map((finding) => ({
+            code: finding.code,
+            path: finding.path,
+            line: finding.line,
+            detector: finding.detector,
+            fingerprint: finding.fingerprint,
+        })),
+        issues,
+    }));
+}
+export function inspectSecretRiskScan(projectRoot, options = {}) {
+    const root = path.resolve(projectRoot);
+    const policy = {
+        max_file_bytes: options.maxFileBytes ?? DEFAULT_MAX_FILE_BYTES,
+        max_files: options.maxFiles ?? DEFAULT_MAX_FILES,
+        max_findings: options.maxFindings ?? DEFAULT_MAX_FINDINGS,
+        extensions: [...SCAN_EXTENSIONS],
+        skipped_secret_names: [...SECRET_FILE_NAMES],
+        ignored_directories: [...IGNORED_DIRECTORIES],
+    };
+    const targetInputs = options.paths && options.paths.length > 0 ? options.paths : ['.'];
+    const targets = [];
+    const candidates = new Map();
+    const findings = [];
+    const issues = [];
+    for (const targetPath of targetInputs) {
+        let absolutePath;
+        let relativePath;
+        try {
+            const normalized = normalizeTargetPath(root, targetPath);
+            absolutePath = normalized.absolutePath;
+            relativePath = normalized.relativePath;
+            ensureInsideWithoutSymlinks(root, absolutePath, { allowMissingLeaf: true });
+        }
+        catch (error) {
+            const message = error instanceof Error ? error.message : String(error);
+            pushIssue(issues, message);
+            targets.push({ input: targetPath, path: targetPath, exists: null, kind: 'unknown' });
+            findings.push(makeFinding('secret_risk_path_outside_root', 'high', targetPath, message));
+            continue;
+        }
+        let existence;
+        try {
+            existence = targetKind(absolutePath);
+        }
+        catch (error) {
+            const message = error instanceof Error ? error.message : String(error);
+            pushIssue(issues, `${relativePath}: ${message}`);
+            targets.push({ input: targetPath, path: relativePath, exists: null, kind: 'unknown' });
+            findings.push(makeFinding('secret_risk_unreadable_path', 'high', relativePath, message));
+            continue;
+        }
+        targets.push({ input: targetPath, path: relativePath, exists: existence.exists, kind: existence.kind });
+        if (existence.kind === 'file') {
+            const surface = surfaceForPath(relativePath);
+            if (surface || isSecretFile(relativePath)) {
+                addCandidate(candidates, findings, issues, policy, { absolutePath, relativePath, surface: surface ?? 'config' });
+            }
+        }
+        else if (existence.kind === 'directory') {
+            collectFilesFromDirectory(root, absolutePath, candidates, findings, issues, policy);
+        }
+    }
+    for (const candidate of candidates.values()) {
+        inspectCandidate(root, candidate, policy, findings, issues);
+    }
+    const status = secretRiskStatus(findings);
+    const truncated = findings.some((finding) => ['secret_risk_max_files_exceeded', 'secret_risk_max_findings_exceeded'].includes(finding.code));
+    const summary = summarizeSecretRisk(targets, candidates.size, findings);
+    return {
+        schema_version: '1',
+        command: 'script-pack',
+        pack_id: SECRET_RISK_SCAN_PACK_ID,
+        script_id: SECRET_RISK_SCAN_SCRIPT_ID,
+        script_ref: SECRET_RISK_SCAN_SCRIPT_REF,
+        action: 'scan',
+        status,
+        ok: status === 'passed',
+        mustflow_root: root,
+        policy,
+        input_hash: createInputHash(policy, targets, findings, issues),
+        targets,
+        summary,
+        truncated,
+        findings,
+        issues,
+    };
+}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "mustflow",
-  "version": "2.84.0",
+  "version": "2.85.4",
   "description": "Agent workflow documents and CLI for mustflow repository roots.",
   "type": "module",
   "license": "MIT-0",

package/schemas/README.md

@@ -69,6 +69,14 @@ Current schemas:
   file hashes, language metadata, symbol names, declaration kinds, line ranges, signatures, export
   flags, source-anchor navigation metadata, static return metadata, and stable input-limit finding
   codes
+- `dependency-graph-report.schema.json`: output of
+  `mf script-pack run code/dependency-graph scan <path...> --json`, containing bounded relative
+  TypeScript and JavaScript import graph nodes, edges, cycle hints, target flags, depth, importer
+  counts, policy limits, and stable input-limit finding codes
+- `change-impact-report.schema.json`: output of
+  `mf script-pack run code/change-impact analyze [path...] --json`, containing git-diff changed
+  files, surface classifications, bounded impact candidates, optional script-pack hints,
+  verification intent hints, policy limits, and stable git or input-limit finding codes
 - `code-symbol-read-report.schema.json`: output of
   `mf script-pack run code/symbol-read read <path> --start-line <line> --json`, containing a
   focused source snippet selected by source anchor, outline symbol line, or explicit line range with
@@ -91,6 +99,14 @@ Current schemas:
   `mf script-pack run repo/config-chain inspect <path...> --json`, containing nearby package,
   TypeScript, ESLint, Prettier, Vite, Vitest, Tailwind, Jest, Playwright, and mustflow config files
   with static inheritance, reference, workspace, dynamic-config, path, and content-hash metadata
+- `env-contract-report.schema.json`: output of
+  `mf script-pack run repo/env-contract scan [path...] --json`, containing code, CI, docs, config,
+  and env-example references for environment-variable contract drift without reading secret env files
+  or printing env values
+- `secret-risk-scan-report.schema.json`: output of
+  `mf script-pack run repo/secret-risk-scan scan [path...] --json`, containing plausible
+  hardcoded-secret findings with detector names, paths, line numbers, and redacted fingerprints
+  without printing secret values
 - `text-budget-report.schema.json`: output of
   `mf script-pack run core/text-budget check <path...> --json`, containing
   exact text-budget metrics, input content hashes, policy metadata, findings, and JSON Pointer field

package/schemas/change-impact-report.schema.json

@@ -0,0 +1,150 @@
+{
+  "$schema": "https://json-schema.org/draft/2020-12/schema",
+  "$id": "https://mustflow.github.io/schemas/change-impact-report.schema.json",
+  "title": "mustflow change-impact report",
+  "type": "object",
+  "additionalProperties": false,
+  "required": [
+    "schema_version",
+    "command",
+    "pack_id",
+    "script_id",
+    "script_ref",
+    "action",
+    "status",
+    "ok",
+    "mustflow_root",
+    "policy",
+    "input_hash",
+    "changed_files",
+    "impacts",
+    "script_hints",
+    "verification_hints",
+    "truncated",
+    "findings",
+    "issues"
+  ],
+  "properties": {
+    "schema_version": { "const": "1" },
+    "command": { "const": "script-pack" },
+    "pack_id": { "const": "code" },
+    "script_id": { "const": "change-impact" },
+    "script_ref": { "const": "code/change-impact" },
+    "action": { "const": "analyze" },
+    "status": { "enum": ["passed", "failed", "error"] },
+    "ok": { "type": "boolean" },
+    "mustflow_root": { "type": "string" },
+    "policy": { "$ref": "#/$defs/policy" },
+    "input_hash": { "$ref": "#/$defs/sha256" },
+    "changed_files": { "type": "array", "items": { "$ref": "#/$defs/changedFile" } },
+    "impacts": { "type": "array", "items": { "$ref": "#/$defs/impact" } },
+    "script_hints": { "type": "array", "items": { "$ref": "#/$defs/scriptHint" } },
+    "verification_hints": { "type": "array", "items": { "$ref": "#/$defs/verificationHint" } },
+    "truncated": { "type": "boolean" },
+    "findings": { "type": "array", "items": { "$ref": "#/$defs/finding" } },
+    "issues": { "type": "array", "items": { "type": "string" } }
+  },
+  "$defs": {
+    "sha256": { "type": "string", "pattern": "^sha256:[a-f0-9]{64}$" },
+    "surface": {
+      "enum": ["source", "test", "docs", "schema", "config", "package", "template", "workflow", "i18n", "unknown"]
+    },
+    "policy": {
+      "type": "object",
+      "additionalProperties": false,
+      "required": [
+        "base_ref",
+        "head_ref",
+        "compare_worktree",
+        "max_files",
+        "max_impacts",
+        "max_file_bytes",
+        "path_filters"
+      ],
+      "properties": {
+        "base_ref": { "type": "string" },
+        "head_ref": { "type": ["string", "null"] },
+        "compare_worktree": { "type": "boolean" },
+        "max_files": { "type": "integer", "minimum": 1 },
+        "max_impacts": { "type": "integer", "minimum": 1 },
+        "max_file_bytes": { "type": "integer", "minimum": 1 },
+        "path_filters": { "type": "array", "items": { "type": "string" } }
+      }
+    },
+    "changedFile": {
+      "type": "object",
+      "additionalProperties": false,
+      "required": ["path", "previous_path", "status", "surface"],
+      "properties": {
+        "path": { "type": "string" },
+        "previous_path": { "type": ["string", "null"] },
+        "status": { "enum": ["added", "modified", "deleted", "renamed", "type_changed", "untracked"] },
+        "surface": { "$ref": "#/$defs/surface" }
+      }
+    },
+    "impact": {
+      "type": "object",
+      "additionalProperties": false,
+      "required": ["path", "exists", "surface", "relationship", "confidence", "reason", "source_path"],
+      "properties": {
+        "path": { "type": "string" },
+        "exists": { "type": "boolean" },
+        "surface": { "$ref": "#/$defs/surface" },
+        "relationship": {
+          "enum": [
+            "changed_file",
+            "imports_changed_file",
+            "sibling_test",
+            "sibling_source",
+            "contract_doc",
+            "contract_test",
+            "package_surface",
+            "workflow_surface"
+          ]
+        },
+        "confidence": { "type": "number", "minimum": 0, "maximum": 1 },
+        "reason": { "type": "string" },
+        "source_path": { "type": "string" }
+      }
+    },
+    "scriptHint": {
+      "type": "object",
+      "additionalProperties": false,
+      "required": ["script_ref", "command", "reason", "confidence"],
+      "properties": {
+        "script_ref": { "type": "string" },
+        "command": { "type": "string" },
+        "reason": { "type": "string" },
+        "confidence": { "type": "number", "minimum": 0, "maximum": 1 }
+      }
+    },
+    "verificationHint": {
+      "type": "object",
+      "additionalProperties": false,
+      "required": ["intent", "reason", "confidence"],
+      "properties": {
+        "intent": { "type": "string" },
+        "reason": { "type": "string" },
+        "confidence": { "type": "number", "minimum": 0, "maximum": 1 }
+      }
+    },
+    "finding": {
+      "type": "object",
+      "additionalProperties": false,
+      "required": ["code", "severity", "message", "path"],
+      "properties": {
+        "code": {
+          "enum": [
+            "change_impact_git_unavailable",
+            "change_impact_invalid_ref",
+            "change_impact_max_files_exceeded",
+            "change_impact_max_impacts_exceeded"
+          ]
+        },
+        "severity": { "enum": ["low", "medium", "high", "critical"] },
+        "message": { "type": "string" },
+        "path": { "type": "string" }
+      }
+    }
+  }
+}