mustflow 2.85.4 → 2.99.0

package/dist/core/repo-git-ignore-audit.js

@@ -0,0 +1,302 @@
+import { createHash } from 'node:crypto';
+import { spawnSync } from 'node:child_process';
+import { existsSync, lstatSync, readFileSync } from 'node:fs';
+import os from 'node:os';
+import path from 'node:path';
+import { ensureInside, ensureInsideWithoutSymlinks } from './safe-filesystem.js';
+export const REPO_GIT_IGNORE_AUDIT_PACK_ID = 'repo';
+export const REPO_GIT_IGNORE_AUDIT_SCRIPT_ID = 'git-ignore-audit';
+export const REPO_GIT_IGNORE_AUDIT_SCRIPT_REF = `${REPO_GIT_IGNORE_AUDIT_PACK_ID}/${REPO_GIT_IGNORE_AUDIT_SCRIPT_ID}`;
+const DEFAULT_MAX_PATHS = 200;
+const SOURCE_KINDS = [
+    'repo_gitignore',
+    'git_info_exclude',
+    'core_excludes_file',
+];
+function normalizeRelativePath(value) {
+    return value.replace(/\\/gu, '/').replace(/^\.\/+/u, '').replace(/\/+$/u, '') || '.';
+}
+function sha256(value) {
+    return `sha256:${createHash('sha256').update(value).digest('hex')}`;
+}
+function positiveInteger(value, fallback) {
+    return typeof value === 'number' && Number.isInteger(value) && value > 0 ? value : fallback;
+}
+function runGit(root, args) {
+    const result = spawnSync('git', [...args], {
+        cwd: root,
+        encoding: 'utf8',
+        stdio: ['ignore', 'pipe', 'pipe'],
+        windowsHide: true,
+        maxBuffer: 16 * 1024 * 1024,
+    });
+    return {
+        ok: result.status === 0,
+        status: result.status,
+        stdout: result.stdout ?? '',
+        stderr: result.stderr ?? '',
+    };
+}
+function isInsideGitWorktree(root) {
+    const result = runGit(root, ['rev-parse', '--is-inside-work-tree']);
+    return result.ok && result.stdout.trim() === 'true';
+}
+function parseGitPaths(stdout) {
+    const paths = [];
+    const seen = new Set();
+    for (const line of stdout.split(/\r?\n/u)) {
+        const relativePath = normalizeRelativePath(line.trim());
+        if (!relativePath || relativePath === '.' || seen.has(relativePath)) {
+            continue;
+        }
+        seen.add(relativePath);
+        paths.push(relativePath);
+    }
+    return paths.sort((left, right) => left.localeCompare(right));
+}
+function collectGitChangedFiles(root, issues, findings) {
+    if (!isInsideGitWorktree(root)) {
+        const message = 'Git worktree is unavailable; provide explicit paths to audit.';
+        issues.push(message);
+        findings.push(makeFinding('git_ignore_audit_git_unavailable', 'low', '.', message, null));
+        return [];
+    }
+    const tracked = runGit(root, ['diff', '--name-only', '--diff-filter=ACMRTUXB', 'HEAD', '--']);
+    const untracked = runGit(root, ['ls-files', '--others', '--exclude-standard', '--']);
+    const paths = new Set();
+    if (tracked.ok) {
+        for (const entry of parseGitPaths(tracked.stdout)) {
+            paths.add(entry);
+        }
+    }
+    else {
+        issues.push(`Could not inspect changed tracked files: ${tracked.stderr.trim() || 'git diff failed'}`);
+    }
+    if (untracked.ok) {
+        for (const entry of parseGitPaths(untracked.stdout)) {
+            paths.add(entry);
+        }
+    }
+    else {
+        issues.push(`Could not inspect untracked files: ${untracked.stderr.trim() || 'git ls-files failed'}`);
+    }
+    return [...paths].sort((left, right) => left.localeCompare(right));
+}
+function resolveAuditPaths(root, inputPaths, maxPaths, findings, issues) {
+    const paths = [];
+    const seen = new Set();
+    for (const inputPath of inputPaths) {
+        const absolutePath = path.resolve(root, inputPath);
+        let relativePath;
+        try {
+            ensureInside(root, absolutePath);
+            ensureInsideWithoutSymlinks(root, existsSync(absolutePath) ? absolutePath : path.dirname(absolutePath), {
+                allowMissingDescendant: true,
+            });
+            relativePath = normalizeRelativePath(path.relative(root, absolutePath));
+        }
+        catch (error) {
+            const message = error instanceof Error ? error.message : String(error);
+            issues.push(`${inputPath}: ${message}`);
+            findings.push(makeFinding('git_ignore_audit_path_outside_root', 'high', inputPath, message, null));
+            continue;
+        }
+        if (seen.has(relativePath)) {
+            continue;
+        }
+        if (paths.length >= maxPaths) {
+            const message = `Git ignore audit reached max_paths ${maxPaths}; remaining paths were skipped.`;
+            issues.push(message);
+            findings.push(makeFinding('git_ignore_audit_max_paths_exceeded', 'high', relativePath, message, null));
+            return paths;
+        }
+        seen.add(relativePath);
+        paths.push(relativePath);
+    }
+    return paths.sort((left, right) => left.localeCompare(right));
+}
+function expandHome(value) {
+    if (value === '~') {
+        return os.homedir();
+    }
+    if (value.startsWith('~/') || value.startsWith('~\\')) {
+        return path.join(os.homedir(), value.slice(2));
+    }
+    return value;
+}
+function readExternalCoreExcludesPath(root) {
+    const local = runGit(root, ['config', '--get', 'core.excludesFile']);
+    if (!local.ok || local.stdout.trim().length === 0) {
+        return null;
+    }
+    return expandHome(local.stdout.trim());
+}
+function makeSource(root, sourcePath, kind, scope) {
+    const absolutePath = scope === 'external' ? path.resolve(expandHome(sourcePath)) : path.join(root, ...sourcePath.split('/'));
+    const exists = existsSync(absolutePath);
+    if (!exists || scope === 'external') {
+        return {
+            path: scope === 'external' ? sourcePath : normalizeRelativePath(sourcePath),
+            kind,
+            exists,
+            scope,
+            sha256: null,
+        };
+    }
+    try {
+        const stats = lstatSync(absolutePath);
+        if (!stats.isFile()) {
+            return { path: normalizeRelativePath(sourcePath), kind, exists: true, scope, sha256: null };
+        }
+        return {
+            path: normalizeRelativePath(sourcePath),
+            kind,
+            exists: true,
+            scope,
+            sha256: sha256(readFileSync(absolutePath)),
+        };
+    }
+    catch {
+        return { path: normalizeRelativePath(sourcePath), kind, exists: true, scope, sha256: null };
+    }
+}
+function inspectIgnoreSources(root) {
+    const sources = [
+        makeSource(root, '.gitignore', 'repo_gitignore', 'repository'),
+        makeSource(root, '.git/info/exclude', 'git_info_exclude', 'local_git'),
+    ];
+    const coreExcludesPath = readExternalCoreExcludesPath(root);
+    if (coreExcludesPath) {
+        sources.push(makeSource(root, coreExcludesPath, 'core_excludes_file', 'external'));
+    }
+    return sources;
+}
+function parseIgnoreMatch(output) {
+    const line = output.split(/\r?\n/u).find((entry) => entry.trim().length > 0);
+    if (!line) {
+        return null;
+    }
+    const tabIndex = line.indexOf('\t');
+    const evidence = tabIndex >= 0 ? line.slice(0, tabIndex) : line;
+    const match = /^(?<sourcePath>.*):(?<sourceLine>\d+):(?<pattern>.*)$/u.exec(evidence);
+    const sourcePath = match?.groups?.sourcePath ?? '';
+    const sourceLine = Number(match?.groups?.sourceLine);
+    const pattern = match?.groups?.pattern ?? '';
+    if (!Number.isInteger(sourceLine) || sourceLine < 1 || pattern.length === 0) {
+        return null;
+    }
+    return { sourcePath: normalizeRelativePath(sourcePath), sourceLine, pattern };
+}
+function checkIgnoreMatch(root, relativePath, issues) {
+    const result = runGit(root, ['check-ignore', '-v', '--no-index', '--', relativePath]);
+    if (result.ok) {
+        return parseIgnoreMatch(result.stdout);
+    }
+    if (result.status !== 1 && result.stderr.trim().length > 0) {
+        issues.push(`${relativePath}: ${result.stderr.trim()}`);
+    }
+    return null;
+}
+function isTrackedPath(root, relativePath) {
+    const result = runGit(root, ['ls-files', '--error-unmatch', '--', relativePath]);
+    return result.ok;
+}
+function pathExists(root, relativePath) {
+    return existsSync(path.join(root, ...relativePath.split('/')));
+}
+function makeFinding(code, severity, pathValue, message, match) {
+    return {
+        code,
+        severity,
+        path: pathValue,
+        source_path: match?.sourcePath ?? null,
+        source_line: match?.sourceLine ?? null,
+        pattern: match?.pattern ?? null,
+        message,
+        json_pointer: null,
+        metric: null,
+        actual: null,
+        expected: null,
+    };
+}
+function auditPath(root, relativePath, findings, issues) {
+    const match = checkIgnoreMatch(root, relativePath, issues);
+    const tracked = isTrackedPath(root, relativePath);
+    const exists = pathExists(root, relativePath);
+    const ignored = match !== null;
+    const status = tracked ? 'tracked' : ignored ? 'ignored' : exists ? 'untracked' : 'missing';
+    if (ignored && tracked) {
+        findings.push(makeFinding('git_ignore_audit_tracked_path_matches_ignore', 'low', relativePath, `Tracked path ${relativePath} matches an ignore rule, but Git will keep tracking it.`, match));
+    }
+    else if (ignored) {
+        findings.push(makeFinding('git_ignore_audit_ignored_path', 'medium', relativePath, `Path ${relativePath} is ignored by ${match.sourcePath}:${match.sourceLine}.`, match));
+    }
+    return {
+        path: relativePath,
+        status,
+        tracked,
+        ignored,
+        exists,
+        source_path: match?.sourcePath ?? null,
+        source_line: match?.sourceLine ?? null,
+        pattern: match?.pattern ?? null,
+    };
+}
+function summarize(paths, sources, findings) {
+    return {
+        paths_checked: paths.length,
+        ignored_paths: paths.filter((entry) => entry.ignored).length,
+        tracked_paths: paths.filter((entry) => entry.tracked).length,
+        untracked_paths: paths.filter((entry) => entry.status === 'untracked').length,
+        missing_paths: paths.filter((entry) => entry.status === 'missing').length,
+        ignore_sources: sources.filter((source) => source.exists).length,
+        findings: findings.length,
+    };
+}
+function createInputHash(reportInput) {
+    return sha256(JSON.stringify(reportInput));
+}
+export function auditRepoGitIgnore(projectRoot, options) {
+    const root = path.resolve(projectRoot);
+    const requestedPaths = options.paths.length > 0 ? [...options.paths] : [];
+    const findings = [];
+    const issues = [];
+    const policy = {
+        input_mode: requestedPaths.length > 0 ? 'explicit_paths' : 'git_changed_files',
+        max_paths: positiveInteger(options.maxPaths, DEFAULT_MAX_PATHS),
+        source_kinds: SOURCE_KINDS,
+        tracked_paths_can_match_ignore: true,
+    };
+    const effectivePaths = requestedPaths.length > 0 ? requestedPaths : collectGitChangedFiles(root, issues, findings);
+    const auditTargets = resolveAuditPaths(root, effectivePaths, policy.max_paths, findings, issues);
+    const sources = inspectIgnoreSources(root);
+    const paths = auditTargets.map((entry) => auditPath(root, entry, findings, issues));
+    if (effectivePaths.length === 0 && issues.length === 0) {
+        const message = 'No input paths were available for Git ignore auditing.';
+        findings.push(makeFinding('git_ignore_audit_no_input_paths', 'low', '.', message, null));
+    }
+    const summary = summarize(paths, sources, findings);
+    const hasHighFinding = findings.some((finding) => finding.severity === 'high' || finding.severity === 'critical');
+    const status = hasHighFinding || issues.length > 0 ? 'error' : findings.length > 0 ? 'failed' : 'passed';
+    return {
+        schema_version: '1',
+        command: 'script-pack',
+        pack_id: REPO_GIT_IGNORE_AUDIT_PACK_ID,
+        script_id: REPO_GIT_IGNORE_AUDIT_SCRIPT_ID,
+        script_ref: REPO_GIT_IGNORE_AUDIT_SCRIPT_REF,
+        action: 'audit',
+        status,
+        ok: status === 'passed',
+        mustflow_root: root,
+        input: {
+            paths: requestedPaths,
+        },
+        policy,
+        input_hash: createInputHash({ inputPaths: requestedPaths, policy, sources, paths, findings, issues }),
+        summary,
+        sources,
+        paths,
+        findings,
+        issues,
+    };
+}

package/dist/core/repo-manifest-lock-drift.js

@@ -0,0 +1,321 @@
+import { createHash } from 'node:crypto';
+import { existsSync } from 'node:fs';
+import path from 'node:path';
+import { isRecord } from './config-loading.js';
+import { ensureInside, ensureInsideWithoutSymlinks, readFileInsideWithoutSymlinks, readUtf8FileInsideWithoutSymlinks } from './safe-filesystem.js';
+import { parseTomlText } from './toml.js';
+export const REPO_MANIFEST_LOCK_DRIFT_PACK_ID = 'repo';
+export const REPO_MANIFEST_LOCK_DRIFT_SCRIPT_ID = 'manifest-lock-drift';
+export const REPO_MANIFEST_LOCK_DRIFT_SCRIPT_REF = `${REPO_MANIFEST_LOCK_DRIFT_PACK_ID}/${REPO_MANIFEST_LOCK_DRIFT_SCRIPT_ID}`;
+export const REPO_MANIFEST_LOCK_DRIFT_LOCK_PATH = '.mustflow/config/manifest.lock.toml';
+const DEFAULT_MAX_ENTRIES = 500;
+const SHA256_PATTERN = /^sha256:[a-f0-9]{64}$/u;
+function sha256(value) {
+    return `sha256:${createHash('sha256').update(value).digest('hex')}`;
+}
+function positiveInteger(value, fallback) {
+    return typeof value === 'number' && Number.isInteger(value) && value > 0 ? value : fallback;
+}
+function normalizeRelativePath(value) {
+    return value.replace(/\\/gu, '/').replace(/^\.\/+/u, '').replace(/\/+$/u, '') || '.';
+}
+function readOptionalString(value) {
+    return typeof value === 'string' && value.trim().length > 0 ? value : null;
+}
+function parseManifestLock(content) {
+    const raw = parseTomlText(content);
+    if (!isRecord(raw)) {
+        throw new Error('manifest lock must contain a TOML table');
+    }
+    const template = isRecord(raw.template) ? raw.template : {};
+    const files = raw.files;
+    if (!isRecord(files)) {
+        throw new Error('[files] must be a TOML table');
+    }
+    const lockedFiles = [];
+    for (const [relativePath, file] of Object.entries(files)) {
+        if (!isRecord(file)) {
+            throw new Error(`[files.${relativePath}] must be a TOML table`);
+        }
+        lockedFiles.push({
+            relativePath: normalizeRelativePath(relativePath),
+            source: readOptionalString(file.source),
+            lastAction: readOptionalString(file.last_action),
+            contentHash: readOptionalString(file.content_hash),
+        });
+    }
+    return {
+        schemaVersion: readOptionalString(raw.schema_version),
+        templateId: readOptionalString(template.id),
+        templateVersion: readOptionalString(template.version),
+        templateProfile: readOptionalString(template.profile),
+        templateLocale: readOptionalString(template.locale),
+        files: lockedFiles.sort((left, right) => left.relativePath.localeCompare(right.relativePath)),
+    };
+}
+function makeFinding(code, severity, pathValue, message, expectedHash, actualHash) {
+    return {
+        code,
+        severity,
+        path: pathValue,
+        expected_hash: expectedHash,
+        actual_hash: actualHash,
+        message,
+        json_pointer: null,
+        metric: null,
+        actual: null,
+        expected: null,
+    };
+}
+function resolveRequestedPaths(root, paths, findings, issues) {
+    const resolved = [];
+    const seen = new Set();
+    for (const inputPath of paths) {
+        const absolutePath = path.resolve(root, inputPath);
+        try {
+            ensureInside(root, absolutePath);
+            ensureInsideWithoutSymlinks(root, existsSync(absolutePath) ? absolutePath : path.dirname(absolutePath), {
+                allowMissingDescendant: true,
+            });
+        }
+        catch (error) {
+            const message = error instanceof Error ? error.message : String(error);
+            issues.push(`${inputPath}: ${message}`);
+            findings.push(makeFinding('manifest_lock_entry_path_outside_root', 'high', inputPath, message, null, null));
+            continue;
+        }
+        const relativePath = normalizeRelativePath(path.relative(root, absolutePath));
+        if (!seen.has(relativePath)) {
+            seen.add(relativePath);
+            resolved.push(relativePath);
+        }
+    }
+    return resolved.sort((left, right) => left.localeCompare(right));
+}
+function shouldCheckEntry(entryPath, requestedPaths) {
+    if (requestedPaths.length === 0) {
+        return true;
+    }
+    return requestedPaths.some((requestedPath) => entryPath === requestedPath || entryPath.startsWith(`${requestedPath}/`));
+}
+function hashProjectFile(root, relativePath) {
+    return sha256(readFileInsideWithoutSymlinks(root, path.join(root, ...relativePath.split('/'))));
+}
+function safeEntryExists(root, relativePath) {
+    const absolutePath = path.join(root, ...relativePath.split('/'));
+    try {
+        ensureInside(root, absolutePath);
+        ensureInsideWithoutSymlinks(root, existsSync(absolutePath) ? absolutePath : path.dirname(absolutePath), {
+            allowMissingDescendant: true,
+        });
+        return existsSync(absolutePath);
+    }
+    catch {
+        return false;
+    }
+}
+function inspectEntry(root, lockedFile, findings) {
+    const relativePath = lockedFile.relativePath;
+    const absolutePath = path.join(root, ...relativePath.split('/'));
+    try {
+        ensureInside(root, absolutePath);
+        ensureInsideWithoutSymlinks(root, existsSync(absolutePath) ? absolutePath : path.dirname(absolutePath), {
+            allowMissingDescendant: true,
+        });
+    }
+    catch (error) {
+        const message = error instanceof Error ? error.message : String(error);
+        findings.push(makeFinding('manifest_lock_entry_path_outside_root', 'high', relativePath, message, lockedFile.contentHash, null));
+        return {
+            path: relativePath,
+            source: lockedFile.source,
+            last_action: lockedFile.lastAction,
+            lock_hash: lockedFile.contentHash,
+            actual_hash: null,
+            exists: false,
+            status: 'unsafe_path',
+        };
+    }
+    if (!lockedFile.contentHash || !SHA256_PATTERN.test(lockedFile.contentHash)) {
+        findings.push(makeFinding('manifest_lock_entry_invalid_hash', 'high', relativePath, `Manifest lock entry ${relativePath} has an invalid content_hash.`, lockedFile.contentHash, null));
+        return {
+            path: relativePath,
+            source: lockedFile.source,
+            last_action: lockedFile.lastAction,
+            lock_hash: lockedFile.contentHash,
+            actual_hash: null,
+            exists: existsSync(absolutePath),
+            status: 'unreadable',
+        };
+    }
+    if (!existsSync(absolutePath)) {
+        findings.push(makeFinding('manifest_lock_entry_missing', 'high', relativePath, `Manifest lock entry ${relativePath} points to a missing file.`, lockedFile.contentHash, null));
+        return {
+            path: relativePath,
+            source: lockedFile.source,
+            last_action: lockedFile.lastAction,
+            lock_hash: lockedFile.contentHash,
+            actual_hash: null,
+            exists: false,
+            status: 'missing',
+        };
+    }
+    try {
+        const actualHash = hashProjectFile(root, relativePath);
+        if (actualHash !== lockedFile.contentHash) {
+            findings.push(makeFinding('manifest_lock_hash_mismatch', 'medium', relativePath, `Manifest lock content_hash differs from the current file hash for ${relativePath}.`, lockedFile.contentHash, actualHash));
+            return {
+                path: relativePath,
+                source: lockedFile.source,
+                last_action: lockedFile.lastAction,
+                lock_hash: lockedFile.contentHash,
+                actual_hash: actualHash,
+                exists: true,
+                status: 'hash_mismatch',
+            };
+        }
+        return {
+            path: relativePath,
+            source: lockedFile.source,
+            last_action: lockedFile.lastAction,
+            lock_hash: lockedFile.contentHash,
+            actual_hash: actualHash,
+            exists: true,
+            status: 'clean',
+        };
+    }
+    catch (error) {
+        const message = error instanceof Error ? error.message : String(error);
+        findings.push(makeFinding('manifest_lock_entry_unreadable', 'high', relativePath, message, lockedFile.contentHash, null));
+        return {
+            path: relativePath,
+            source: lockedFile.source,
+            last_action: lockedFile.lastAction,
+            lock_hash: lockedFile.contentHash,
+            actual_hash: null,
+            exists: true,
+            status: 'unreadable',
+        };
+    }
+}
+function summarize(entries, entriesTotal, findings) {
+    return {
+        entries_total: entriesTotal,
+        entries_checked: entries.filter((entry) => entry.status !== 'skipped').length,
+        clean_entries: entries.filter((entry) => entry.status === 'clean').length,
+        missing_entries: entries.filter((entry) => entry.status === 'missing').length,
+        hash_mismatches: entries.filter((entry) => entry.status === 'hash_mismatch').length,
+        unreadable_entries: entries.filter((entry) => entry.status === 'unreadable').length,
+        unsafe_entries: entries.filter((entry) => entry.status === 'unsafe_path').length,
+        skipped_entries: entries.filter((entry) => entry.status === 'skipped').length,
+        findings: findings.length,
+    };
+}
+function createInputHash(reportInput) {
+    return sha256(JSON.stringify(reportInput));
+}
+function createLockMetadata(lock, exists) {
+    return {
+        path: REPO_MANIFEST_LOCK_DRIFT_LOCK_PATH,
+        exists,
+        schema_version: lock?.schemaVersion ?? null,
+        template_id: lock?.templateId ?? null,
+        template_version: lock?.templateVersion ?? null,
+        template_profile: lock?.templateProfile ?? null,
+        template_locale: lock?.templateLocale ?? null,
+        entries_total: lock?.files.length ?? 0,
+    };
+}
+export function checkRepoManifestLockDrift(projectRoot, options) {
+    const root = path.resolve(projectRoot);
+    const findings = [];
+    const issues = [];
+    const requestedPaths = [...options.paths];
+    const policy = {
+        lock_path: REPO_MANIFEST_LOCK_DRIFT_LOCK_PATH,
+        input_mode: requestedPaths.length > 0 ? 'explicit_paths' : 'all_locked_files',
+        max_entries: positiveInteger(options.maxEntries, DEFAULT_MAX_ENTRIES),
+        extra_manifest_file_detection: 'not_authoritative',
+    };
+    const lockPath = path.join(root, ...REPO_MANIFEST_LOCK_DRIFT_LOCK_PATH.split('/'));
+    const normalizedRequestedPaths = resolveRequestedPaths(root, requestedPaths, findings, issues);
+    let lock = null;
+    if (!existsSync(lockPath)) {
+        const message = `Manifest lock is missing: ${REPO_MANIFEST_LOCK_DRIFT_LOCK_PATH}`;
+        findings.push(makeFinding('manifest_lock_missing', 'high', REPO_MANIFEST_LOCK_DRIFT_LOCK_PATH, message, null, null));
+        issues.push(message);
+    }
+    else {
+        try {
+            ensureInside(root, lockPath);
+            ensureInsideWithoutSymlinks(root, lockPath);
+            lock = parseManifestLock(readUtf8FileInsideWithoutSymlinks(root, lockPath, { maxBytes: 1024 * 1024 }));
+        }
+        catch (error) {
+            const message = error instanceof Error ? error.message : String(error);
+            findings.push(makeFinding('manifest_lock_invalid', 'high', REPO_MANIFEST_LOCK_DRIFT_LOCK_PATH, message, null, null));
+            issues.push(`Invalid manifest lock: ${message}`);
+        }
+    }
+    const entries = [];
+    if (lock) {
+        let maxEntriesFindingReported = false;
+        for (const lockedFile of lock.files) {
+            if (!shouldCheckEntry(lockedFile.relativePath, normalizedRequestedPaths)) {
+                entries.push({
+                    path: lockedFile.relativePath,
+                    source: lockedFile.source,
+                    last_action: lockedFile.lastAction,
+                    lock_hash: lockedFile.contentHash,
+                    actual_hash: null,
+                    exists: safeEntryExists(root, lockedFile.relativePath),
+                    status: 'skipped',
+                });
+                continue;
+            }
+            if (entries.filter((entry) => entry.status !== 'skipped').length >= policy.max_entries) {
+                if (!maxEntriesFindingReported) {
+                    const message = `Manifest lock drift check reached max_entries ${policy.max_entries}; remaining entries were skipped.`;
+                    findings.push(makeFinding('manifest_lock_max_entries_exceeded', 'high', lockedFile.relativePath, message, lockedFile.contentHash, null));
+                    maxEntriesFindingReported = true;
+                }
+                entries.push({
+                    path: lockedFile.relativePath,
+                    source: lockedFile.source,
+                    last_action: lockedFile.lastAction,
+                    lock_hash: lockedFile.contentHash,
+                    actual_hash: null,
+                    exists: safeEntryExists(root, lockedFile.relativePath),
+                    status: 'skipped',
+                });
+                continue;
+            }
+            entries.push(inspectEntry(root, lockedFile, findings));
+        }
+    }
+    const lockMetadata = createLockMetadata(lock, existsSync(lockPath));
+    const summary = summarize(entries, lockMetadata.entries_total, findings);
+    const hasHighFinding = findings.some((finding) => finding.severity === 'high' || finding.severity === 'critical');
+    const status = issues.length > 0 || hasHighFinding ? 'error' : findings.length > 0 ? 'failed' : 'passed';
+    return {
+        schema_version: '1',
+        command: 'script-pack',
+        pack_id: REPO_MANIFEST_LOCK_DRIFT_PACK_ID,
+        script_id: REPO_MANIFEST_LOCK_DRIFT_SCRIPT_ID,
+        script_ref: REPO_MANIFEST_LOCK_DRIFT_SCRIPT_REF,
+        action: 'check',
+        status,
+        ok: status === 'passed',
+        mustflow_root: root,
+        input: {
+            paths: requestedPaths,
+        },
+        policy,
+        input_hash: createInputHash({ inputPaths: requestedPaths, policy, lock: lockMetadata, summary, entries, findings, issues }),
+        lock: lockMetadata,
+        summary,
+        entries,
+        findings,
+        issues,
+    };
+}