mustflow 2.84.0 → 2.99.0

package/dist/core/public-json-contracts.js

@@ -248,6 +248,56 @@ const PUBLIC_JSON_SCHEMA_CONTRACTS = [
             '--json',
         ],
     },
+    {
+        id: 'dependency-graph-report',
+        schemaFile: 'dependency-graph-report.schema.json',
+        producer: 'mf script-pack run code/dependency-graph scan <path...> --json',
+        packaged: true,
+        documented: true,
+        installedCommand: [
+            'mf',
+            'script-pack',
+            'run',
+            'code/dependency-graph',
+            'scan',
+            'node_modules/mustflow/dist/cli/index.js',
+            '--json',
+        ],
+    },
+    {
+        id: 'import-cycle-report',
+        schemaFile: 'import-cycle-report.schema.json',
+        producer: 'mf script-pack run code/import-cycle check <path...> --json',
+        packaged: true,
+        documented: true,
+        installedCommand: [
+            'mf',
+            'script-pack',
+            'run',
+            'code/import-cycle',
+            'check',
+            'node_modules/mustflow/dist/cli/index.js',
+            '--json',
+        ],
+        expectedExitCodes: [0, 1],
+    },
+    {
+        id: 'change-impact-report',
+        schemaFile: 'change-impact-report.schema.json',
+        producer: 'mf script-pack run code/change-impact analyze [path...] --json',
+        packaged: true,
+        documented: true,
+        installedCommand: [
+            'mf',
+            'script-pack',
+            'run',
+            'code/change-impact',
+            'analyze',
+            '--base',
+            'HEAD',
+            '--json',
+        ],
+    },
     {
         id: 'code-symbol-read-report',
         schemaFile: 'code-symbol-read-report.schema.json',
@@ -309,6 +359,42 @@ const PUBLIC_JSON_SCHEMA_CONTRACTS = [
         ],
         expectedExitCodes: [0, 1],
     },
+    {
+        id: 'link-integrity-report',
+        schemaFile: 'link-integrity-report.schema.json',
+        producer: 'mf script-pack run docs/link-integrity check [path...] --json',
+        packaged: true,
+        documented: true,
+        installedCommand: [
+            'mf',
+            'script-pack',
+            'run',
+            'docs/link-integrity',
+            'check',
+            'node_modules/mustflow/README.md',
+            'node_modules/mustflow/schemas/README.md',
+            '--json',
+        ],
+        expectedExitCodes: [0, 1],
+    },
+    {
+        id: 'test-performance-report',
+        schemaFile: 'test-performance-report.schema.json',
+        producer: 'mf script-pack run test/performance-report summarize --json',
+        packaged: true,
+        documented: true,
+        installedCommand: ['mf', 'script-pack', 'run', 'test/performance-report', 'summarize', '--json'],
+        expectedExitCodes: [0, 1],
+    },
+    {
+        id: 'test-regression-selector-report',
+        schemaFile: 'test-regression-selector-report.schema.json',
+        producer: 'mf script-pack run test/regression-selector select --json',
+        packaged: true,
+        documented: true,
+        installedCommand: ['mf', 'script-pack', 'run', 'test/regression-selector', 'select', '--json'],
+        expectedExitCodes: [0, 1],
+    },
     {
         id: 'text-budget-report',
         schemaFile: 'text-budget-report.schema.json',
@@ -346,6 +432,69 @@ const PUBLIC_JSON_SCHEMA_CONTRACTS = [
         ],
         expectedExitCodes: [0, 1],
     },
+    {
+        id: 'repo-merge-conflict-scan-report',
+        schemaFile: 'repo-merge-conflict-scan-report.schema.json',
+        producer: 'mf script-pack run repo/merge-conflict-scan check [path...] --json',
+        packaged: true,
+        documented: true,
+        installedCommand: ['mf', 'script-pack', 'run', 'repo/merge-conflict-scan', 'check', '--json'],
+        expectedExitCodes: [0, 1],
+    },
+    {
+        id: 'repo-git-ignore-audit-report',
+        schemaFile: 'repo-git-ignore-audit-report.schema.json',
+        producer: 'mf script-pack run repo/git-ignore-audit audit [path...] --json',
+        packaged: true,
+        documented: true,
+        installedCommand: ['mf', 'script-pack', 'run', 'repo/git-ignore-audit', 'audit', 'AGENTS.md', '--json'],
+        expectedExitCodes: [0, 1],
+    },
+    {
+        id: 'repo-manifest-lock-drift-report',
+        schemaFile: 'repo-manifest-lock-drift-report.schema.json',
+        producer: 'mf script-pack run repo/manifest-lock-drift check [path...] --json',
+        packaged: true,
+        documented: true,
+        installedCommand: ['mf', 'script-pack', 'run', 'repo/manifest-lock-drift', 'check', 'AGENTS.md', '--json'],
+        expectedExitCodes: [0, 1],
+    },
+    {
+        id: 'skill-route-audit-report',
+        schemaFile: 'skill-route-audit-report.schema.json',
+        producer: 'mf script-pack run repo/skill-route-audit audit --json',
+        packaged: true,
+        documented: true,
+        installedCommand: ['mf', 'script-pack', 'run', 'repo/skill-route-audit', 'audit', '--json'],
+        expectedExitCodes: [0, 1],
+    },
+    {
+        id: 'repo-version-source-report',
+        schemaFile: 'repo-version-source-report.schema.json',
+        producer: 'mf script-pack run repo/version-source inspect --json',
+        packaged: true,
+        documented: true,
+        installedCommand: ['mf', 'script-pack', 'run', 'repo/version-source', 'inspect', '--json'],
+        expectedExitCodes: [0, 1],
+    },
+    {
+        id: 'repo-approval-gate-report',
+        schemaFile: 'repo-approval-gate-report.schema.json',
+        producer: 'mf script-pack run repo/approval-gate check --action <type> --json',
+        packaged: true,
+        documented: true,
+        installedCommand: [
+            'mf',
+            'script-pack',
+            'run',
+            'repo/approval-gate',
+            'check',
+            '--action',
+            'git_commit',
+            '--json',
+        ],
+        expectedExitCodes: [0, 1],
+    },
     {
         id: 'config-chain-report',
         schemaFile: 'config-chain-report.schema.json',
@@ -363,6 +512,24 @@ const PUBLIC_JSON_SCHEMA_CONTRACTS = [
         ],
         expectedExitCodes: [0, 1],
     },
+    {
+        id: 'env-contract-report',
+        schemaFile: 'env-contract-report.schema.json',
+        producer: 'mf script-pack run repo/env-contract scan [path...] --json',
+        packaged: true,
+        documented: true,
+        installedCommand: ['mf', 'script-pack', 'run', 'repo/env-contract', 'scan', 'AGENTS.md', '--json'],
+        expectedExitCodes: [0, 1],
+    },
+    {
+        id: 'secret-risk-scan-report',
+        schemaFile: 'secret-risk-scan-report.schema.json',
+        producer: 'mf script-pack run repo/secret-risk-scan scan [path...] --json',
+        packaged: true,
+        documented: true,
+        installedCommand: ['mf', 'script-pack', 'run', 'repo/secret-risk-scan', 'scan', 'AGENTS.md', '--json'],
+        expectedExitCodes: [0, 1],
+    },
     {
         id: 'related-files-report',
         schemaFile: 'related-files-report.schema.json',

package/dist/core/repo-approval-gate.js

@@ -0,0 +1,116 @@
+import { createHash } from 'node:crypto';
+import path from 'node:path';
+import { isRecord, MUSTFLOW_CONFIG_RELATIVE_PATH, readMustflowConfigIfExists, readStringArray, } from './config-loading.js';
+export const REPO_APPROVAL_GATE_PACK_ID = 'repo';
+export const REPO_APPROVAL_GATE_SCRIPT_ID = 'approval-gate';
+export const REPO_APPROVAL_GATE_SCRIPT_REF = `${REPO_APPROVAL_GATE_PACK_ID}/${REPO_APPROVAL_GATE_SCRIPT_ID}`;
+export const REPO_APPROVAL_GATE_POLICY_PATH = MUSTFLOW_CONFIG_RELATIVE_PATH;
+function sha256(value) {
+    return `sha256:${createHash('sha256').update(value).digest('hex')}`;
+}
+function uniqueActions(actions) {
+    const normalized = [];
+    const seen = new Set();
+    for (const action of actions) {
+        const trimmed = action.trim();
+        if (trimmed.length === 0 || seen.has(trimmed)) {
+            continue;
+        }
+        seen.add(trimmed);
+        normalized.push(trimmed);
+    }
+    return normalized;
+}
+function readApprovalPolicy(projectRoot, issues) {
+    let config;
+    try {
+        config = readMustflowConfigIfExists(projectRoot);
+    }
+    catch (error) {
+        const message = error instanceof Error ? error.message : String(error);
+        issues.push(`Could not read ${REPO_APPROVAL_GATE_POLICY_PATH}: ${message}`);
+    }
+    if (!config) {
+        issues.push(`${REPO_APPROVAL_GATE_POLICY_PATH} is missing.`);
+        return { required_for: [], on_required: null };
+    }
+    if (!isRecord(config.approval)) {
+        issues.push(`[approval] in ${REPO_APPROVAL_GATE_POLICY_PATH} must be a TOML table.`);
+        return { required_for: [], on_required: null };
+    }
+    const approval = config.approval;
+    const requiredFor = readStringArray(approval, 'required_for');
+    if (!requiredFor) {
+        issues.push(`[approval].required_for in ${REPO_APPROVAL_GATE_POLICY_PATH} must be a string array.`);
+    }
+    const onRequired = approval.on_required;
+    if (onRequired !== undefined && typeof onRequired !== 'string') {
+        issues.push(`[approval].on_required in ${REPO_APPROVAL_GATE_POLICY_PATH} must be a string.`);
+    }
+    return {
+        required_for: requiredFor ?? [],
+        on_required: typeof onRequired === 'string' ? onRequired : null,
+    };
+}
+function createDecisions(actionTypes, policy) {
+    const required = new Set(policy.required_for);
+    return actionTypes.map((actionType) => {
+        const approvalRequired = required.has(actionType);
+        return {
+            action_type: actionType,
+            approval_required: approvalRequired,
+            policy_source: approvalRequired ? `${REPO_APPROVAL_GATE_POLICY_PATH}#[approval].required_for` : null,
+            reason: approvalRequired
+                ? `Action "${actionType}" is listed in [approval].required_for.`
+                : `Action "${actionType}" is not listed in [approval].required_for.`,
+        };
+    });
+}
+function createFindings(decisions) {
+    return decisions
+        .filter((decision) => decision.approval_required)
+        .map((decision) => ({
+        code: 'approval_required_for_action',
+        severity: 'high',
+        path: REPO_APPROVAL_GATE_POLICY_PATH,
+        message: `Action "${decision.action_type}" requires explicit approval before proceeding.`,
+        json_pointer: '/approval/required_for',
+        metric: null,
+        actual: null,
+        expected: null,
+    }));
+}
+function createInputHash(reportInput) {
+    return sha256(JSON.stringify(reportInput));
+}
+export function checkRepoApprovalGate(projectRoot, actionTypes) {
+    const root = path.resolve(projectRoot);
+    const actions = uniqueActions(actionTypes);
+    const issues = [];
+    const policy = readApprovalPolicy(root, issues);
+    const decisions = issues.length > 0 ? [] : createDecisions(actions, policy);
+    const findings = createFindings(decisions);
+    const approvalRequired = findings.length > 0;
+    const status = issues.length > 0 ? 'error' : approvalRequired ? 'failed' : 'passed';
+    return {
+        schema_version: '1',
+        command: 'script-pack',
+        pack_id: REPO_APPROVAL_GATE_PACK_ID,
+        script_id: REPO_APPROVAL_GATE_SCRIPT_ID,
+        script_ref: REPO_APPROVAL_GATE_SCRIPT_REF,
+        action: 'check',
+        status,
+        ok: status === 'passed',
+        mustflow_root: root,
+        input: {
+            action_types: actions,
+            policy_path: REPO_APPROVAL_GATE_POLICY_PATH,
+        },
+        input_hash: createInputHash({ actionTypes: actions, policy, decisions, findings, issues }),
+        approval_required: approvalRequired,
+        policy,
+        decisions,
+        findings,
+        issues,
+    };
+}

package/dist/core/repo-git-ignore-audit.js

@@ -0,0 +1,302 @@
+import { createHash } from 'node:crypto';
+import { spawnSync } from 'node:child_process';
+import { existsSync, lstatSync, readFileSync } from 'node:fs';
+import os from 'node:os';
+import path from 'node:path';
+import { ensureInside, ensureInsideWithoutSymlinks } from './safe-filesystem.js';
+export const REPO_GIT_IGNORE_AUDIT_PACK_ID = 'repo';
+export const REPO_GIT_IGNORE_AUDIT_SCRIPT_ID = 'git-ignore-audit';
+export const REPO_GIT_IGNORE_AUDIT_SCRIPT_REF = `${REPO_GIT_IGNORE_AUDIT_PACK_ID}/${REPO_GIT_IGNORE_AUDIT_SCRIPT_ID}`;
+const DEFAULT_MAX_PATHS = 200;
+const SOURCE_KINDS = [
+    'repo_gitignore',
+    'git_info_exclude',
+    'core_excludes_file',
+];
+function normalizeRelativePath(value) {
+    return value.replace(/\\/gu, '/').replace(/^\.\/+/u, '').replace(/\/+$/u, '') || '.';
+}
+function sha256(value) {
+    return `sha256:${createHash('sha256').update(value).digest('hex')}`;
+}
+function positiveInteger(value, fallback) {
+    return typeof value === 'number' && Number.isInteger(value) && value > 0 ? value : fallback;
+}
+function runGit(root, args) {
+    const result = spawnSync('git', [...args], {
+        cwd: root,
+        encoding: 'utf8',
+        stdio: ['ignore', 'pipe', 'pipe'],
+        windowsHide: true,
+        maxBuffer: 16 * 1024 * 1024,
+    });
+    return {
+        ok: result.status === 0,
+        status: result.status,
+        stdout: result.stdout ?? '',
+        stderr: result.stderr ?? '',
+    };
+}
+function isInsideGitWorktree(root) {
+    const result = runGit(root, ['rev-parse', '--is-inside-work-tree']);
+    return result.ok && result.stdout.trim() === 'true';
+}
+function parseGitPaths(stdout) {
+    const paths = [];
+    const seen = new Set();
+    for (const line of stdout.split(/\r?\n/u)) {
+        const relativePath = normalizeRelativePath(line.trim());
+        if (!relativePath || relativePath === '.' || seen.has(relativePath)) {
+            continue;
+        }
+        seen.add(relativePath);
+        paths.push(relativePath);
+    }
+    return paths.sort((left, right) => left.localeCompare(right));
+}
+function collectGitChangedFiles(root, issues, findings) {
+    if (!isInsideGitWorktree(root)) {
+        const message = 'Git worktree is unavailable; provide explicit paths to audit.';
+        issues.push(message);
+        findings.push(makeFinding('git_ignore_audit_git_unavailable', 'low', '.', message, null));
+        return [];
+    }
+    const tracked = runGit(root, ['diff', '--name-only', '--diff-filter=ACMRTUXB', 'HEAD', '--']);
+    const untracked = runGit(root, ['ls-files', '--others', '--exclude-standard', '--']);
+    const paths = new Set();
+    if (tracked.ok) {
+        for (const entry of parseGitPaths(tracked.stdout)) {
+            paths.add(entry);
+        }
+    }
+    else {
+        issues.push(`Could not inspect changed tracked files: ${tracked.stderr.trim() || 'git diff failed'}`);
+    }
+    if (untracked.ok) {
+        for (const entry of parseGitPaths(untracked.stdout)) {
+            paths.add(entry);
+        }
+    }
+    else {
+        issues.push(`Could not inspect untracked files: ${untracked.stderr.trim() || 'git ls-files failed'}`);
+    }
+    return [...paths].sort((left, right) => left.localeCompare(right));
+}
+function resolveAuditPaths(root, inputPaths, maxPaths, findings, issues) {
+    const paths = [];
+    const seen = new Set();
+    for (const inputPath of inputPaths) {
+        const absolutePath = path.resolve(root, inputPath);
+        let relativePath;
+        try {
+            ensureInside(root, absolutePath);
+            ensureInsideWithoutSymlinks(root, existsSync(absolutePath) ? absolutePath : path.dirname(absolutePath), {
+                allowMissingDescendant: true,
+            });
+            relativePath = normalizeRelativePath(path.relative(root, absolutePath));
+        }
+        catch (error) {
+            const message = error instanceof Error ? error.message : String(error);
+            issues.push(`${inputPath}: ${message}`);
+            findings.push(makeFinding('git_ignore_audit_path_outside_root', 'high', inputPath, message, null));
+            continue;
+        }
+        if (seen.has(relativePath)) {
+            continue;
+        }
+        if (paths.length >= maxPaths) {
+            const message = `Git ignore audit reached max_paths ${maxPaths}; remaining paths were skipped.`;
+            issues.push(message);
+            findings.push(makeFinding('git_ignore_audit_max_paths_exceeded', 'high', relativePath, message, null));
+            return paths;
+        }
+        seen.add(relativePath);
+        paths.push(relativePath);
+    }
+    return paths.sort((left, right) => left.localeCompare(right));
+}
+function expandHome(value) {
+    if (value === '~') {
+        return os.homedir();
+    }
+    if (value.startsWith('~/') || value.startsWith('~\\')) {
+        return path.join(os.homedir(), value.slice(2));
+    }
+    return value;
+}
+function readExternalCoreExcludesPath(root) {
+    const local = runGit(root, ['config', '--get', 'core.excludesFile']);
+    if (!local.ok || local.stdout.trim().length === 0) {
+        return null;
+    }
+    return expandHome(local.stdout.trim());
+}
+function makeSource(root, sourcePath, kind, scope) {
+    const absolutePath = scope === 'external' ? path.resolve(expandHome(sourcePath)) : path.join(root, ...sourcePath.split('/'));
+    const exists = existsSync(absolutePath);
+    if (!exists || scope === 'external') {
+        return {
+            path: scope === 'external' ? sourcePath : normalizeRelativePath(sourcePath),
+            kind,
+            exists,
+            scope,
+            sha256: null,
+        };
+    }
+    try {
+        const stats = lstatSync(absolutePath);
+        if (!stats.isFile()) {
+            return { path: normalizeRelativePath(sourcePath), kind, exists: true, scope, sha256: null };
+        }
+        return {
+            path: normalizeRelativePath(sourcePath),
+            kind,
+            exists: true,
+            scope,
+            sha256: sha256(readFileSync(absolutePath)),
+        };
+    }
+    catch {
+        return { path: normalizeRelativePath(sourcePath), kind, exists: true, scope, sha256: null };
+    }
+}
+function inspectIgnoreSources(root) {
+    const sources = [
+        makeSource(root, '.gitignore', 'repo_gitignore', 'repository'),
+        makeSource(root, '.git/info/exclude', 'git_info_exclude', 'local_git'),
+    ];
+    const coreExcludesPath = readExternalCoreExcludesPath(root);
+    if (coreExcludesPath) {
+        sources.push(makeSource(root, coreExcludesPath, 'core_excludes_file', 'external'));
+    }
+    return sources;
+}
+function parseIgnoreMatch(output) {
+    const line = output.split(/\r?\n/u).find((entry) => entry.trim().length > 0);
+    if (!line) {
+        return null;
+    }
+    const tabIndex = line.indexOf('\t');
+    const evidence = tabIndex >= 0 ? line.slice(0, tabIndex) : line;
+    const match = /^(?<sourcePath>.*):(?<sourceLine>\d+):(?<pattern>.*)$/u.exec(evidence);
+    const sourcePath = match?.groups?.sourcePath ?? '';
+    const sourceLine = Number(match?.groups?.sourceLine);
+    const pattern = match?.groups?.pattern ?? '';
+    if (!Number.isInteger(sourceLine) || sourceLine < 1 || pattern.length === 0) {
+        return null;
+    }
+    return { sourcePath: normalizeRelativePath(sourcePath), sourceLine, pattern };
+}
+function checkIgnoreMatch(root, relativePath, issues) {
+    const result = runGit(root, ['check-ignore', '-v', '--no-index', '--', relativePath]);
+    if (result.ok) {
+        return parseIgnoreMatch(result.stdout);
+    }
+    if (result.status !== 1 && result.stderr.trim().length > 0) {
+        issues.push(`${relativePath}: ${result.stderr.trim()}`);
+    }
+    return null;
+}
+function isTrackedPath(root, relativePath) {
+    const result = runGit(root, ['ls-files', '--error-unmatch', '--', relativePath]);
+    return result.ok;
+}
+function pathExists(root, relativePath) {
+    return existsSync(path.join(root, ...relativePath.split('/')));
+}
+function makeFinding(code, severity, pathValue, message, match) {
+    return {
+        code,
+        severity,
+        path: pathValue,
+        source_path: match?.sourcePath ?? null,
+        source_line: match?.sourceLine ?? null,
+        pattern: match?.pattern ?? null,
+        message,
+        json_pointer: null,
+        metric: null,
+        actual: null,
+        expected: null,
+    };
+}
+function auditPath(root, relativePath, findings, issues) {
+    const match = checkIgnoreMatch(root, relativePath, issues);
+    const tracked = isTrackedPath(root, relativePath);
+    const exists = pathExists(root, relativePath);
+    const ignored = match !== null;
+    const status = tracked ? 'tracked' : ignored ? 'ignored' : exists ? 'untracked' : 'missing';
+    if (ignored && tracked) {
+        findings.push(makeFinding('git_ignore_audit_tracked_path_matches_ignore', 'low', relativePath, `Tracked path ${relativePath} matches an ignore rule, but Git will keep tracking it.`, match));
+    }
+    else if (ignored) {
+        findings.push(makeFinding('git_ignore_audit_ignored_path', 'medium', relativePath, `Path ${relativePath} is ignored by ${match.sourcePath}:${match.sourceLine}.`, match));
+    }
+    return {
+        path: relativePath,
+        status,
+        tracked,
+        ignored,
+        exists,
+        source_path: match?.sourcePath ?? null,
+        source_line: match?.sourceLine ?? null,
+        pattern: match?.pattern ?? null,
+    };
+}
+function summarize(paths, sources, findings) {
+    return {
+        paths_checked: paths.length,
+        ignored_paths: paths.filter((entry) => entry.ignored).length,
+        tracked_paths: paths.filter((entry) => entry.tracked).length,
+        untracked_paths: paths.filter((entry) => entry.status === 'untracked').length,
+        missing_paths: paths.filter((entry) => entry.status === 'missing').length,
+        ignore_sources: sources.filter((source) => source.exists).length,
+        findings: findings.length,
+    };
+}
+function createInputHash(reportInput) {
+    return sha256(JSON.stringify(reportInput));
+}
+export function auditRepoGitIgnore(projectRoot, options) {
+    const root = path.resolve(projectRoot);
+    const requestedPaths = options.paths.length > 0 ? [...options.paths] : [];
+    const findings = [];
+    const issues = [];
+    const policy = {
+        input_mode: requestedPaths.length > 0 ? 'explicit_paths' : 'git_changed_files',
+        max_paths: positiveInteger(options.maxPaths, DEFAULT_MAX_PATHS),
+        source_kinds: SOURCE_KINDS,
+        tracked_paths_can_match_ignore: true,
+    };
+    const effectivePaths = requestedPaths.length > 0 ? requestedPaths : collectGitChangedFiles(root, issues, findings);
+    const auditTargets = resolveAuditPaths(root, effectivePaths, policy.max_paths, findings, issues);
+    const sources = inspectIgnoreSources(root);
+    const paths = auditTargets.map((entry) => auditPath(root, entry, findings, issues));
+    if (effectivePaths.length === 0 && issues.length === 0) {
+        const message = 'No input paths were available for Git ignore auditing.';
+        findings.push(makeFinding('git_ignore_audit_no_input_paths', 'low', '.', message, null));
+    }
+    const summary = summarize(paths, sources, findings);
+    const hasHighFinding = findings.some((finding) => finding.severity === 'high' || finding.severity === 'critical');
+    const status = hasHighFinding || issues.length > 0 ? 'error' : findings.length > 0 ? 'failed' : 'passed';
+    return {
+        schema_version: '1',
+        command: 'script-pack',
+        pack_id: REPO_GIT_IGNORE_AUDIT_PACK_ID,
+        script_id: REPO_GIT_IGNORE_AUDIT_SCRIPT_ID,
+        script_ref: REPO_GIT_IGNORE_AUDIT_SCRIPT_REF,
+        action: 'audit',
+        status,
+        ok: status === 'passed',
+        mustflow_root: root,
+        input: {
+            paths: requestedPaths,
+        },
+        policy,
+        input_hash: createInputHash({ inputPaths: requestedPaths, policy, sources, paths, findings, issues }),
+        summary,
+        sources,
+        paths,
+        findings,
+        issues,
+    };
+}