@cmpose/core 0.0.0-stage → 0.1.1

package/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 cmpose contributors
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

package/README.md

@@ -1,3 +1,3 @@
-# Temporary Holding Version
+# @cmpose/core
 
-This version is a temporary placeholder for this package. An operational version to replace this has been submitted for review and is awaiting a staged release.
+The cmpose generator library: it turns the pinned Compose Multiplatform template into a new project (validation, package and name rewrites, optional features and modules). It is the same code cmpose.dev runs. See the README at the root of the cmpose repository for usage and development.

package/package.json

@@ -1,6 +1,40 @@
 {
   "name": "@cmpose/core",
-  "version": "0.0.0-stage",
-  "stub": true,
-  "description": "Temporary package placeholder for staged publishing"
-}
+  "version": "0.1.1",
+  "description": "cmpose project generator core (Compose Multiplatform)",
+  "license": "MIT",
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/Keremturker/cmpose.git",
+    "directory": "packages/core"
+  },
+  "homepage": "https://github.com/Keremturker/cmpose/tree/main/packages/core#readme",
+  "bugs": {
+    "url": "https://github.com/Keremturker/cmpose/issues"
+  },
+  "keywords": [
+    "compose-multiplatform",
+    "kotlin-multiplatform",
+    "kmp",
+    "generator",
+    "scaffold",
+    "android",
+    "ios"
+  ],
+  "main": "src/index.js",
+  "files": [
+    "src"
+  ],
+  "engines": {
+    "node": ">=20"
+  },
+  "scripts": {
+    "test": "node --test test/*.test.js"
+  },
+  "dependencies": {
+    "fs-extra": "^11.3.2"
+  },
+  "publishConfig": {
+    "access": "public"
+  }
+}

package/src/ProjectValidator.js

@@ -0,0 +1,368 @@
+/**
+ * ProjectValidator - Shared validation logic for both frontend and backend
+ * UMD (Universal Module Definition) format for browser and Node.js compatibility
+ */
+(function (root, factory) {
+    if (typeof module !== 'undefined' && module.exports) {
+        // Node.js / CommonJS
+        module.exports = factory();
+    } else {
+        // Browser global
+        root.ProjectValidator = factory();
+    }
+}(typeof self !== 'undefined' ? self : this, function () {
+    'use strict';
+
+    // Default Constants (can be overridden via configure())
+    let MAX_MODULES = 3;
+    let MIN_SDK_MIN = 24;
+    let MIN_SDK_MAX = 36;
+    let IOS_VERSION_MIN = '15.0';
+    let IOS_VERSION_MAX = '26.2';
+    // Package reserved by the template itself (e.g. its own package); none by default
+    let RESERVED_PACKAGE_PREFIX = null;
+
+    // Max lengths for input fields
+    const MAX_LENGTH_PROJECT_NAME = 30;
+    const MAX_LENGTH_APP_NAME = 30;
+    const MAX_LENGTH_PACKAGE_NAME = 50;
+    const MAX_LENGTH_MODULE_NAME = 20;
+    const MAX_LENGTH_BASE_URL = 100;
+
+    // Format regexes: the one place they live (validators below use them; contract.js publishes their sources)
+    const PATTERNS = {
+        projectName: /^[a-zA-Z]+$/,
+        packageName: /^[a-z][a-z0-9]*(\.[a-z][a-z0-9]*){2,}$/,
+        moduleName: /^[a-z][a-z0-9]*$/,
+        iosVersionFormat: /^\d+(\.\d+){1,2}$/
+    };
+
+    // Kotlin hard keywords - cannot be used as package segments or module names
+    const KOTLIN_HARD_KEYWORDS = ['as', 'break', 'class', 'continue', 'do', 'else', 'false', 'for', 'fun', 'if', 'in', 'interface', 'is', 'null', 'object', 'package', 'return', 'super', 'this', 'throw', 'true', 'try', 'typealias', 'typeof', 'val', 'var', 'when', 'while'];
+
+    function isKotlinHardKeyword(word) {
+        return KOTLIN_HARD_KEYWORDS.indexOf(word) !== -1;
+    }
+
+    // Module names the generator cannot use: file processing skips every directory named build
+    // (Gradle output), so feature/build would keep the template package; monetization is the
+    // template's own feature/monetization module (purchases/ads flags); notes is blank's Room demo
+    // (feature/notes)
+    const RESERVED_MODULE_NAMES = ['build', 'monetization', 'notes'];
+
+    /**
+     * Compare two version strings (e.g., '15.0' vs '15.0.1')
+     * @returns {number} - -1 if a < b, 0 if a == b, 1 if a > b
+     */
+    function compareVersions(a, b) {
+        const partsA = a.split('.').map(Number);
+        const partsB = b.split('.').map(Number);
+        const len = Math.max(partsA.length, partsB.length);
+        for (let i = 0; i < len; i++) {
+            const numA = partsA[i] || 0;
+            const numB = partsB[i] || 0;
+            if (numA < numB) return -1;
+            if (numA > numB) return 1;
+        }
+        return 0;
+    }
+
+    const ProjectValidator = {
+        /**
+         * Maximum number of feature modules allowed
+         */
+        MAX_MODULES: MAX_MODULES,
+
+        /**
+         * Configure validation limits (call this on server startup or page load)
+         * @param {Object} config - Configuration object
+         */
+        configure: function (config) {
+            if (config.maxModules !== undefined) MAX_MODULES = config.maxModules;
+            if (config.minSdkMin !== undefined) MIN_SDK_MIN = config.minSdkMin;
+            if (config.minSdkMax !== undefined) MIN_SDK_MAX = config.minSdkMax;
+            if (config.iosVersionMin !== undefined) IOS_VERSION_MIN = config.iosVersionMin;
+            if (config.iosVersionMax !== undefined) IOS_VERSION_MAX = config.iosVersionMax;
+            if (config.reservedPackagePrefix !== undefined) RESERVED_PACKAGE_PREFIX = config.reservedPackagePrefix;
+            // Update exposed constants
+            this.MAX_MODULES = MAX_MODULES;
+            this.MIN_SDK_MIN = MIN_SDK_MIN;
+            this.MIN_SDK_MAX = MIN_SDK_MAX;
+            this.IOS_VERSION_MIN = IOS_VERSION_MIN;
+            this.IOS_VERSION_MAX = IOS_VERSION_MAX;
+            // Update dynamic messages
+            this.messages.maxModulesReached = 'Maximum ' + MAX_MODULES + ' feature modules allowed';
+            this.messages.minSdkInvalid = 'Min SDK must be a number between ' + MIN_SDK_MIN + ' and ' + MIN_SDK_MAX;
+            this.messages.iosVersionInvalid = 'iOS Version must be between ' + IOS_VERSION_MIN + ' and ' + IOS_VERSION_MAX;
+        },
+
+        /**
+         * Get current configuration values
+         * @returns {Object} - Current config values
+         */
+        getConfig: function () {
+            return {
+                maxModules: MAX_MODULES,
+                minSdkMin: MIN_SDK_MIN,
+                minSdkMax: MIN_SDK_MAX,
+                iosVersionMin: IOS_VERSION_MIN,
+                iosVersionMax: IOS_VERSION_MAX,
+                reservedPackagePrefix: RESERVED_PACKAGE_PREFIX
+            };
+        },
+
+        /**
+         * Exposed config values
+         */
+        MIN_SDK_MIN: MIN_SDK_MIN,
+        MIN_SDK_MAX: MIN_SDK_MAX,
+        IOS_VERSION_MIN: IOS_VERSION_MIN,
+        IOS_VERSION_MAX: IOS_VERSION_MAX,
+
+        /**
+         * Max lengths for input fields
+         */
+        MAX_LENGTH_PROJECT_NAME: MAX_LENGTH_PROJECT_NAME,   // Project name
+        MAX_LENGTH_APP_NAME: MAX_LENGTH_APP_NAME,           // App name (user visible)
+        MAX_LENGTH_PACKAGE_NAME: MAX_LENGTH_PACKAGE_NAME,   // Package name (e.g., com.company.app.module)
+        MAX_LENGTH_MODULE_NAME: MAX_LENGTH_MODULE_NAME,     // Feature module name
+        MAX_LENGTH_MIN_SDK: 2,          // Max 2 digits (e.g., 36)
+        MAX_LENGTH_IOS_VERSION: 8,      // Max format: xx.xx.xx (e.g., 26.2.1)
+        MAX_LENGTH_BASE_URL: MAX_LENGTH_BASE_URL,           // Network base URL
+
+        /**
+         * Format regexes and name lists (read-only; contract.js publishes them)
+         */
+        patterns: PATTERNS,
+        KOTLIN_HARD_KEYWORDS: KOTLIN_HARD_KEYWORDS,
+        RESERVED_MODULE_NAMES: RESERVED_MODULE_NAMES,
+
+        /**
+         * Validates that the value is a string no longer than max characters
+         * @param {string} value - The value to validate
+         * @param {number} max - Maximum allowed length (inclusive)
+         * @returns {boolean} - True if valid
+         */
+        validateMaxLength: function (value, max) {
+            return typeof value === 'string' && value.length <= max;
+        },
+
+        /**
+         * Validates that the value contains no spaces
+         * @param {string} value - The value to validate
+         * @returns {boolean} - True if valid (no spaces)
+         */
+        validateNoSpaces: function (value) {
+            return !value.includes(' ');
+        },
+
+        /**
+         * Validates App Name (call with the trimmed value) - letters (any script, including
+         * combining marks), digits, spaces and . _ ' - only, no leading/trailing whitespace,
+         * at most MAX_LENGTH_APP_NAME
+         * @param {string} value - The app name to validate
+         * @returns {boolean} - True if valid
+         */
+        validateAppName: function (value) {
+            if (typeof value !== 'string') return false;
+            if (value.length === 0 || value.length > MAX_LENGTH_APP_NAME) return false;
+            if (value.trim() !== value) return false;
+            return /^[\p{L}\p{M}\p{N} ._'-]+$/u.test(value);
+        },
+
+        /**
+         * Validates Package Name format
+         * Must start with a letter, contain at least 3 segments separated by dots,
+         * and use only lowercase letters and numbers. No segment may be a Kotlin hard
+         * keyword, and the reserved package (see configure) and packages under it are rejected.
+         * Example: com.example.app
+         * @param {string} value - The package name to validate
+         * @returns {boolean} - True if valid
+         */
+        validatePackageName: function (value) {
+            if (!PATTERNS.packageName.test(value)) return false;
+            if (value.split('.').some(isKotlinHardKeyword)) return false;
+            if (RESERVED_PACKAGE_PREFIX &&
+                (value === RESERVED_PACKAGE_PREFIX || value.indexOf(RESERVED_PACKAGE_PREFIX + '.') === 0)) {
+                return false;
+            }
+            return true;
+        },
+
+        /**
+         * Validates URL - http(s) only, at most MAX_LENGTH_BASE_URL characters, and free of
+         * characters that would break the generated Kotlin string (" \ $, whitespace, controls)
+         * @param {string} value - The URL to validate
+         * @returns {boolean} - True if valid URL
+         */
+        validateUrl: function (value) {
+            if (typeof value !== 'string') return false;
+            if (value.length > MAX_LENGTH_BASE_URL) return false;
+            if (/["\\$\s\u0000-\u001F\u007F]/.test(value)) return false;
+            try {
+                const url = new URL(value);
+                return url.protocol === 'http:' || url.protocol === 'https:';
+            } catch (_) {
+                return false;
+            }
+        },
+
+        /**
+         * Validates module count against maximum limit
+         * @param {number} count - Number of modules
+         * @returns {boolean} - True if count is valid (at or below limit)
+         */
+        validateModuleCount: function (count) {
+            return count <= MAX_MODULES;
+        },
+
+        /**
+         * Checks if more modules can be added
+         * @param {number} currentCount - Current number of modules
+         * @returns {boolean} - True if can add more modules
+         */
+        canAddModule: function (currentCount) {
+            return currentCount < MAX_MODULES;
+        },
+
+        /**
+         * Validates Project Name - only letters allowed (a-zA-Z)
+         * @param {string} value - The project name to validate
+         * @returns {boolean} - True if valid
+         */
+        validateProjectName: function (value) {
+            return PATTERNS.projectName.test(value);
+        },
+
+        /**
+         * Sanitizes Project Name - removes all non-letter characters
+         * @param {string} value - The input value
+         * @returns {string} - Sanitized value
+         */
+        sanitizeProjectName: function (value) {
+            return value.replace(/[^a-zA-Z]/g, '');
+        },
+
+        /**
+         * Sanitizes Package Name - lowercase, only a-z, 0-9 and . allowed, no consecutive dots
+         * (same character set as validatePackageName, so typing cannot produce a rejected char)
+         * @param {string} value - The input value
+         * @returns {string} - Sanitized value
+         */
+        sanitizePackageName: function (value) {
+            return value.toLowerCase().replace(/[^a-z0-9.]/g, '').replace(/\.{2,}/g, '.');
+        },
+
+        /**
+         * Sanitizes App Name - no leading spaces, no consecutive spaces
+         * @param {string} value - The input value
+         * @returns {string} - Sanitized value
+         */
+        sanitizeAppName: function (value) {
+            return value.replace(/^\s+/, '').replace(/\s{2,}/g, ' ');
+        },
+
+        /**
+         * Sanitizes Module Name - lowercase, a-z and 0-9 allowed, removes leading digits
+         * @param {string} value - The input value
+         * @returns {string} - Sanitized value
+         */
+        sanitizeModuleName: function (value) {
+            let sanitized = value.toLowerCase().replace(/[^a-z0-9]/g, '');
+            // Remove leading digits (module name must start with a letter)
+            while (sanitized.length > 0 && /^[0-9]/.test(sanitized)) {
+                sanitized = sanitized.substring(1);
+            }
+            return sanitized;
+        },
+
+        /**
+         * Validates Module Name - lowercase letters and numbers allowed, must start with letter,
+         * must not be a Kotlin hard keyword (it becomes a package segment) or a reserved name
+         * (RESERVED_MODULE_NAMES)
+         * @param {string} value - The module name to validate
+         * @returns {boolean} - True if valid
+         */
+        validateModuleName: function (value) {
+            return PATTERNS.moduleName.test(value) && value.length > 0 && !isKotlinHardKeyword(value) &&
+                RESERVED_MODULE_NAMES.indexOf(value) === -1;
+        },
+
+        /**
+         * Sanitizes Android Min SDK - only digits allowed
+         * @param {string} value - The input value
+         * @returns {string} - Sanitized value (digits only)
+         */
+        sanitizeMinSdk: function (value) {
+            return value.replace(/[^0-9]/g, '');
+        },
+
+        /**
+         * Validates Android Min SDK - must be a valid number within range
+         * @param {number|string} value - The min SDK value
+         * @returns {boolean} - True if valid (number between MIN_SDK_MIN and MIN_SDK_MAX)
+         */
+        validateMinSdk: function (value) {
+            if (!/^\d{1,2}$/.test(value)) return false;
+            const num = parseInt(value, 10);
+            return num >= MIN_SDK_MIN && num <= MIN_SDK_MAX;
+        },
+
+        /**
+         * Sanitizes iOS Version - only digits and dots, max 2 dots, no consecutive dots
+         * @param {string} value - The input value
+         * @returns {string} - Sanitized value
+         */
+        sanitizeIosVersion: function (value) {
+            // Remove non-digit and non-dot characters
+            let sanitized = value.replace(/[^0-9.]/g, '');
+            // Remove consecutive dots
+            sanitized = sanitized.replace(/\.{2,}/g, '.');
+            // Remove leading dot
+            if (sanitized.startsWith('.')) {
+                sanitized = sanitized.substring(1);
+            }
+            // Limit to max 2 dots (major.minor.patch)
+            const parts = sanitized.split('.');
+            if (parts.length > 3) {
+                sanitized = parts.slice(0, 3).join('.');
+            }
+            return sanitized;
+        },
+
+        /**
+         * Validates iOS Version format and range
+         * @param {string} value - The iOS version string
+         * @returns {boolean} - True if valid format and within range
+         */
+        validateIosVersion: function (value) {
+            // Check format first
+            if (!PATTERNS.iosVersionFormat.test(value)) return false;
+            // Check range
+            return compareVersions(value, IOS_VERSION_MIN) >= 0 &&
+                compareVersions(value, IOS_VERSION_MAX) <= 0;
+        },
+
+        /**
+         * Error messages for validation failures
+         */
+        messages: {
+            projectNameSpaces: 'Project Name cannot contain spaces',
+            projectNameInvalid: 'Project Name must contain only letters (a-z, A-Z)',
+            projectNameTooLong: 'Project Name must be at most ' + MAX_LENGTH_PROJECT_NAME + ' characters',
+            packageNameSpaces: 'Package Name cannot contain spaces',
+            packageNameInvalid: 'Invalid Package Name. Must start with a letter, contain at least two dots (3 segments), and use only lowercase letters and numbers (e.g., com.example.app). Segments cannot be Kotlin keywords (e.g., in, is, object), and the template\'s reserved package (or any package under it) cannot be used.',
+            packageNameTooLong: 'Package Name must be at most ' + MAX_LENGTH_PACKAGE_NAME + ' characters',
+            appNameInvalid: 'App Name must be 1-' + MAX_LENGTH_APP_NAME + ' characters using only letters, numbers, spaces and . _ \' - (no leading or trailing spaces)',
+            urlInvalid: 'Invalid Base URL. Please enter a valid http(s) URL of at most ' + MAX_LENGTH_BASE_URL + ' characters without spaces, quotes, backslashes or $ (e.g., https://api.example.com)',
+            maxModulesReached: 'Maximum ' + MAX_MODULES + ' feature modules allowed',
+            moduleNameInvalid: 'Module name must start with a letter, contain only lowercase letters and numbers (a-z, 0-9), and not be a Kotlin keyword (e.g., in, is, object) or one of the reserved names (' + RESERVED_MODULE_NAMES.join(', ') + ')',
+            moduleNameTooLong: 'Module name must be at most ' + MAX_LENGTH_MODULE_NAME + ' characters',
+            moduleNameDuplicate: 'Each module name can be used only once',
+            minSdkInvalid: 'Min SDK must be a number between ' + MIN_SDK_MIN + ' and ' + MIN_SDK_MAX + '',
+            iosVersionInvalid: 'iOS Version must be between ' + IOS_VERSION_MIN + ' and ' + IOS_VERSION_MAX
+        }
+    };
+
+    return ProjectValidator;
+}));

package/src/ciOption.js

@@ -0,0 +1,31 @@
+const { log } = require('./log');
+const fs = require('fs-extra');
+const path = require('path');
+const { removeMarkedBlock } = require('./readmeService');
+
+// ci-optin: GitHub Actions CI is an opt-in for both templates. The template ships
+// .github/workflows/ci.yml and marks its README line <!-- cmpose:ci -->; without the option both go.
+const CI_WORKFLOW = path.join('.github', 'workflows', 'ci.yml');
+
+async function removeIfEmpty(dir) {
+    if (await fs.pathExists(dir) && (await fs.readdir(dir)).length === 0) await fs.remove(dir);
+}
+
+async function applyCiOption(projectPath, ci) {
+    if (ci === true) return;
+    const workflow = path.join(projectPath, CI_WORKFLOW);
+    if (await fs.pathExists(workflow)) {
+        await fs.remove(workflow);
+        await removeIfEmpty(path.dirname(workflow));
+        await removeIfEmpty(path.join(projectPath, '.github'));
+        log.info('✅ Removed the CI workflow (ci option off)');
+    }
+    const readmePath = path.join(projectPath, 'README.md');
+    if (await fs.pathExists(readmePath)) {
+        const readme = await fs.readFile(readmePath, 'utf8');
+        const updated = removeMarkedBlock(readme, 'cmpose:ci');
+        if (updated !== readme) await fs.writeFile(readmePath, updated);
+    }
+}
+
+module.exports = { CI_WORKFLOW, applyCiOption };

package/src/contract.js

@@ -0,0 +1,109 @@
+'use strict';
+const crypto = require('crypto');
+const PV = require('./ProjectValidator');
+const LIMITS = require('./limits');
+const { OLD_PACKAGE_NAME } = require('./templateIdentity');
+
+// The one place the skill's contract comes from. Schema values moved here from the skill's
+// sync-contract.sh; featuresConfig.js and the generator read the same objects.
+const SCHEMA = {
+    templateTypes: ['blank', 'showcase'],
+    featuresConfigKeys: ['network', 'networkInspector', 'networkBaseUrl', 'theming', 'multiLang', 'dataStore', 'detekt', 'detektYamlContent', 'purchases', 'ads', 'room'],
+    dependencyRules: {
+        alwaysOn: ['koin', 'navigation'],
+        implies: { networkInspector: ['network'] },        // inspector => network
+        auto: { dataStore: ['theming', 'multiLang'] }      // theming || multiLang => dataStore
+    },
+    // Top-level request options that apply to every template (featuresConfig is blank-only)
+    projectOptions: {
+        ci: { default: false, templates: ['blank', 'showcase'] }
+    },
+    // featuresConfig flag -> core modules it adds (for the anatomy preview tree).
+    // `requires` = all must be true; `requiresAny` = at least one true.
+    anatomy: {
+        always: ['androidApp', 'iosApp', 'shared', 'core/about', 'core/domain', 'core/image', 'core/logging', 'core/presentation', 'core/navigation', 'core/review', 'core/update', 'build-logic'],
+        alwaysNote: 'shared wires Koin (DI) + Navigation, which are always included; core/logging sets up Kermit logging, core/review asks for in-app reviews and core/about shows the version, legal links and licences in every project, core/update checks for app updates, core/image loads images with Coil.',
+        coreModules: {
+            'core/network': { requires: ['network'], note: 'Ktor HTTP client; Coil network images' },
+            'core/designsystem': { requiresAny: ['theming', 'multiLang'], note: 'theme (palette + KtTheme) and/or LocalStringResources' },
+            'core/multilang': { requires: ['multiLang'], note: 'i18n / localization' },
+            'core/database': { requires: ['dataStore'], note: 'DataStore persistence; with theming also the saved Light/Dark/System choice (DarkModeManager)' },
+            'core/purchases': { requires: ['purchases'], note: 'offer / purchase / restore API, RevenueCat KMP (Test Store key: replace before you ship)' },
+            'core/ads': { requires: ['ads'], note: 'AdMob banner/interstitial/rewarded + UMP/ATT consent (test IDs)' },
+            'core/room': { requires: ['room'], note: 'Room KMP database (bundled SQLite): AppDatabase, DAOs, schemas/' }
+        },
+        // featuresConfig flag -> feature modules kept in a blank project (same requires/requiresAny rules).
+        featureModules: {
+            'feature/monetization': { requiresAny: ['purchases', 'ads'], note: 'custom paywall (Compose) and/or ads demo' },
+            'feature/notes': { requires: ['room'], note: 'Notes demo screen on Room (blank only; showcase uses Room for favorites)' }
+        },
+        detektDir: { requires: ['detekt'], path: 'detekt/' },
+        showcaseFeatures: ['feature/home', 'feature/monetization', 'feature/onboarding'],
+        customFeaturePath: 'feature/<name>',
+        customFeatureLayers: ['contract', 'data', 'domain', 'presentation']
+    },
+    // Deep links (<scheme>://<path>): the generator writes the scheme; '' opens the start screen and
+    // '<module>' each generated feature module
+    deepLinks: {
+        scheme: 'projectName, lower case',
+        showcase: ['user/{username}', 'settings'],
+        blank: ['', '<module>']
+    }
+};
+
+function configureValidator(limits = LIMITS) {
+    // The template's own package (and below) cannot be generated: the rename would hit itself
+    PV.configure({
+        minSdkMin: limits.minSdkMin, minSdkMax: limits.minSdkMax,
+        iosVersionMin: limits.iosVersionMin, iosVersionMax: limits.iosVersionMax,
+        maxModules: limits.maxModules,
+        reservedPackagePrefix: OLD_PACKAGE_NAME
+    });
+}
+
+configureValidator();
+
+// serverLimits: the hosted generator's own facts (rate limit, body size); local generation has none
+function contractFacts({ limits = LIMITS, serverLimits = null } = {}) {
+    configureValidator(limits);
+    return {
+        limits: {
+            minSdkMin: limits.minSdkMin,
+            minSdkMax: limits.minSdkMax,
+            iosVersionMin: limits.iosVersionMin,
+            iosVersionMax: limits.iosVersionMax,
+            maxModules: limits.maxModules,
+            ...(serverLimits || {})
+        },
+        maxLengths: {
+            projectName: PV.MAX_LENGTH_PROJECT_NAME,
+            appName: PV.MAX_LENGTH_APP_NAME,
+            packageName: PV.MAX_LENGTH_PACKAGE_NAME,
+            moduleName: PV.MAX_LENGTH_MODULE_NAME,
+            minSdk: PV.MAX_LENGTH_MIN_SDK,
+            iosVersion: PV.MAX_LENGTH_IOS_VERSION,
+            networkBaseUrl: PV.MAX_LENGTH_BASE_URL
+        },
+        regex: Object.fromEntries(Object.entries(PV.patterns).map(([k, re]) => [k, re.source])),
+        kotlinHardKeywords: [...PV.KOTLIN_HARD_KEYWORDS],
+        reservedModuleNames: [...PV.RESERVED_MODULE_NAMES],
+        reservedPackagePrefix: OLD_PACKAGE_NAME,
+        messages: { ...PV.messages },
+        ...SCHEMA
+    };
+}
+
+function stable(value) {
+    if (Array.isArray(value)) return value.map(stable);
+    if (value && typeof value === 'object') {
+        return Object.fromEntries(Object.keys(value).sort().map((k) => [k, stable(value[k])]));
+    }
+    return value;
+}
+
+// Any product's contract: sha256 of the key-sorted JSON, first 12 hex characters
+function hashContract(facts) {
+    return crypto.createHash('sha256').update(JSON.stringify(stable(facts))).digest('hex').slice(0, 12);
+}
+
+module.exports = { SCHEMA, contractFacts, hashContract, configureValidator };