@diffci.com/diffci 0.1.2 → 0.1.3

package/README.md

@@ -1,11 +1,32 @@
 # DiffCI
 
+[![npm version](https://img.shields.io/npm/v/@diffci.com/diffci.svg)](https://www.npmjs.com/package/@diffci.com/diffci)
+[![npm provenance](https://img.shields.io/badge/npm-provenance-blue)](https://docs.npmjs.com/generating-provenance-statements)
+[![GitHub Action](https://img.shields.io/badge/action-DiffCI%2FDiffCI.com%40v1-blue)](https://github.com/DiffCI/DiffCI.com)
+
 DiffCI is a deterministic, change-aware CI planner: given a commit or PR, it builds a real TypeScript
 dependency graph, computes what's actually reachable from the changed files, and proposes which CI
 tasks/tests could safely be skipped - without ever modifying production CI behavior itself. Every mode
 this repository currently implements is observe-and-compare only; nothing here can cancel, skip, or block
 a real CI run.
 
+Try it in shadow mode:
+
+```bash
+npx @diffci.com/diffci@latest observe
+npx @diffci.com/diffci@latest verify-workflow
+```
+
+Or install it as a non-blocking GitHub Action:
+
+```yaml
+- uses: DiffCI/DiffCI.com@v1
+```
+
+The promise is deliberately narrow: DiffCI observes your CI and reports what it would have selected.
+It does not skip tests, cancel jobs, change required checks, or send reports anywhere unless you
+explicitly configure an endpoint and token.
+
 **This repository moved out of the [DentalPresence.in](https://github.com/adityankale190895/DentalPresence.in)
 monorepo** (previously `diffci/` there) into its own repo on 2026-08-21, once the project outgrew being a
 subfolder. DentalPresence.in remains DiffCI's original dogfooding target - some code (the `planner`
@@ -15,6 +36,10 @@ real third-party repositories.
 
 ## Current state
 
+Language expansion: initial Vue SFC and Go package-level analysis is implemented through repository
+adapters. See [the support matrix and setup requirements](docs/language-support.md) for exact scope,
+fallback behavior, and validation boundaries.
+
 Three completed research stages plus an in-progress prospective-validation stage, in order:
 
 - **Stage 0** - a 2,000-delta historical benchmark across 20 real repositories, run through a real
@@ -43,24 +68,51 @@ Every dated report behind these stages lives in [`docs/research/`](docs/research
 `2026-08-21-stage2-architecture.md` for the fullest current picture of what's built vs not, or the
 Stage 0/1A/1B reports for the historical-validation story.
 
+For the next product milestone, see [`docs/alpha-readiness.md`](docs/alpha-readiness.md). It tracks the
+private-alpha bar: install DiffCI, keep CI unchanged, collect real shadow observations, and render a
+trustworthy potential-savings report.
+
 ## Architecture
 
-- `src/git/` - Git delta analysis (`analyzeGitDelta`): parses a commit range into a structured,
-  serializable `GitDelta`. Project invariant: **failure to analyze must never be interpreted as
-  permission to skip CI** - a failed analysis returns `{ success: false, error }` explicitly, never a
-  silently-empty affected set.
-- `src/repo/` - the dependency graph engine (`buildDependencyGraph`, TypeScript-compiler-backed) and the
-  impact analyzer (`ImpactAnalyzer`) that turns a graph + delta into a confidence-scored, fallback-aware
-  impact result.
-- `src/planner/` - turns an impact result into an `ExecutionPlan` (`DefaultCIPlanner`): which tasks/tests
-  run, which are skip-candidates, and why.
-- `src/research/` - the Stage 0/1 historical benchmark pipeline: repository sampling, the generic
-  (non-DentalPresence-specific) PATH baseline, the opportunity classifier, historical GitHub CI evidence
-  collection with flakiness detection, and the Cloudflare orchestrator (`src/research/cloudflare/`) that
-  runs all of it at scale.
-- `src/shadow/` - the Stage 2 prospective pipeline: event identity (`event-identity.ts`), failure
-  classification, ground-truth reconciliation (`reconcile.ts`) against real CI outcomes, and (written,
-  not yet registered) GitHub App JWT/webhook code (`github-app.ts`).
+DiffCI is now framed as an open-core product:
+
+```text
+DiffCI
+|
+├── Open-source core
+|   ├── DiffCI engine
+|   ├── CLI / npm package
+|   ├── Local analysis
+|   └── Basic GitHub Action
+|       |
+|       └── Tidelift package support
+|
+└── Commercial DiffCI
+    ├── Hosted service / DiffCI Cloud
+    ├── Organization dashboard
+    ├── Historical analytics
+    ├── Advanced CI/CD optimization
+    ├── Enterprise policies
+    ├── Managed runners
+    ├── Team features
+    └── Support / enterprise services
+```
+
+The open-source core is the trust and adoption surface. It runs locally or in the host repository's own
+CI, writes a report, and changes nothing about CI execution. Commercial DiffCI adds hosted history,
+organization views, policy, managed operations, runners, and support. Tidelift belongs to the supported
+open-source package path, not the hosted product feature boundary. See
+[`docs/open-core-packaging.md`](docs/open-core-packaging.md) and
+[`docs/tidelift-package-support.md`](docs/tidelift-package-support.md).
+
+The source tree follows that split:
+
+- `src/git/`, `src/repo/`, `src/planner/`, and `src/client/` are the installable OSS observer path.
+- `action.yml` wraps the observer as a basic non-blocking GitHub Action.
+- `src/research/` and `src/shadow/` run validation, GitHub App shadow observation, and reconciliation.
+- `src/product/`, `src/auth/`, `src/billing/`, `src/ingest/`, `src/ledger/`, `src/runner/`, and
+  `src/usage/` are the commercial/control-plane layer.
+- `docs/oss-boundary.md` records what is allowed into the npm package.
 
 ## Commands
 
@@ -88,11 +140,12 @@ DiffCI is intended to be installable as infrastructure, not only as a hosted sha
 ```
 
 ```bash
-npx @diffci.com/diffci observe
-npx @diffci.com/diffci verify-workflow
+npx @diffci.com/diffci@latest observe
+npx @diffci.com/diffci@latest verify-workflow
 ```
 
-The GitHub App remains the easiest shadow-mode entry point. The GitHub Action and npm CLI establish
-the OSS/package distribution path: DiffCI can become an explicit CI dependency while preserving the
-same observe-only contract. See [`docs/distribution.md`](docs/distribution.md) for the package and
-Action positioning.
+The GitHub Action and npm CLI establish the OSS/package distribution path. The hosted GitHub App and
+DiffCI Cloud build on that trust boundary for teams that want shared reports and history. See
+[`docs/distribution.md`](docs/distribution.md) for the package and Action positioning,
+[`docs/open-core-packaging.md`](docs/open-core-packaging.md) for the commercial split, and
+[`docs/npm-adoption.md`](docs/npm-adoption.md) for copy-paste pilot material.

package/SECURITY.md

@@ -0,0 +1,61 @@
+# Security policy
+
+## Supported project
+
+This policy covers the DiffCI open-source core package, published as `@diffci.com/diffci`.
+
+Covered surfaces:
+
+- `diffci observe`
+- `diffci verify-workflow`
+- the basic GitHub Action in `action.yml`
+- local report generation
+- optional report submission to a configured endpoint and token
+
+Commercial DiffCI, including DiffCI Cloud, hosted dashboards, managed runners, billing, organization
+management, private report access, and enterprise policy features, is separate proprietary software and
+is handled through commercial support channels.
+
+## Supported versions
+
+The supported OSS package line is the latest published npm release. Security fixes are released as a
+new npm version and Git tag.
+
+DiffCI Core requires Node.js `>=22.5.0`.
+
+## Reporting a vulnerability
+
+Do not open a public issue for a suspected vulnerability.
+
+Report security issues by email to:
+
+```text
+security@diffci.com
+```
+
+Include:
+
+- affected package/version;
+- affected command or GitHub Action path;
+- reproduction steps;
+- expected impact;
+- whether any token, report, repository data, or CI behavior is exposed or modified.
+
+## Response target
+
+For the OSS package:
+
+- acknowledge within 3 business days;
+- provide an initial assessment within 7 business days;
+- publish a fix or mitigation plan when the issue is confirmed.
+
+## Security boundaries
+
+DiffCI Core is observation-only. A security issue is especially important if it causes the observer to:
+
+- modify the repository checkout without reporting it;
+- affect another CI job's conclusion;
+- expose tokens or report submission credentials;
+- submit a report to the wrong repository or organization;
+- include source file contents when the report schema says it does not;
+- bypass the OSS package boundary and include commercial/control-plane code.

package/SUPPORT.md

@@ -0,0 +1,47 @@
+# Support policy
+
+## Open-source core
+
+Supported package:
+
+```text
+@diffci.com/diffci
+```
+
+Supported surfaces:
+
+- `diffci observe`
+- `diffci verify-workflow`
+- `diffci version`
+- the basic GitHub Action in `action.yml`
+- local JSON observation reports
+- optional report submission to a configured endpoint and token
+
+Supported runtime:
+
+```text
+Node.js >=22.5.0
+```
+
+The open-source support commitment is limited to the latest published npm release unless a security
+advisory says otherwise.
+
+## Commercial DiffCI
+
+Commercial DiffCI is separate proprietary software. It includes:
+
+- DiffCI Cloud;
+- hosted dashboards and private report access;
+- organization/team management;
+- historical analytics;
+- enterprise policies;
+- managed runners;
+- billing, ledger, and support operations;
+- deployment and control-plane infrastructure.
+
+Those features are not included in Tidelift package support for the OSS dependency.
+
+## Tidelift boundary
+
+Tidelift support, if accepted, should cover the open-source npm package as a dependency. It should not be
+used to represent DiffCI Cloud, managed runners, or enterprise policy features as open source.

package/dist-client/src/client/observe.js

@@ -8,7 +8,8 @@
  *
  * Two properties are load-bearing, and both are enforced here rather than promised:
  *
- * READ-ONLY. The engine modules called below only read (verified: no write in src/repo, src/git). This
+ * READ-ONLY CHECKOUT. Analysis does not modify source; Go metadata can populate tool caches outside
+ * the checkout, with module edits and downloads disabled. This
  * function additionally records HEAD and `git status --porcelain` before and after itself, so a run that
  * DID dirty the tree says so in its own report instead of being discovered weeks later.
  *
@@ -22,7 +23,7 @@ import { execFileSync } from "node:child_process";
 import { createHash } from "node:crypto";
 import { relative, resolve } from "node:path";
 import { analyzeGitDelta } from "../git/git-diff.js";
-import { classifyTypeScriptProject, buildDependencyGraph } from "../repo/graph.js";
+import { classifyRepositoryProject, buildDependencyGraph } from "../repo/graph.js";
 import { ImpactAnalyzer } from "../repo/impact.js";
 import { runPathBaseline } from "../planner/path-baseline.js";
 import { commandSpecToString, planSelectiveTestCommands } from "../planner/test-command.js";
@@ -145,12 +146,12 @@ export async function observe(options) {
         if (!resolved.ok)
             return finish("REFUSED", "context", { reason: resolved.reason });
         range = resolved.range;
-        // The eligibility gate is asked of the graph builder itself (classifyTypeScriptProject), not of a
+        // The eligibility gate is asked of the graph builder itself (classifyRepositoryProject), not of a
         // separate list of conditions that can drift away from it. Phase 01 F3 is what that drift costs.
-        const capability = classifyTypeScriptProject(repoPath);
+        const capability = classifyRepositoryProject(repoPath);
         if (!capability.capable) {
             return finish("REFUSED", "eligibility", {
-                reason: `DiffCI can only analyse TypeScript/JavaScript projects today: ${capability.reason}`,
+                reason: `DiffCI supports TypeScript/JavaScript projects, Vue components, and root Go modules: ${capability.reason}`,
             });
         }
         const deltaResult = await analyzeGitDelta({ baseSha: range.baseSha, headSha: range.headSha, repoPath });

package/dist-client/src/planner/test-command.js

@@ -58,6 +58,29 @@ function buildCommand(framework, packageManager, configFile, paths) {
  * test-discovery.ts already models is carried through to execution rather than flattened.
  */
 export function planSelectiveTestCommands(profile, selectedPaths) {
+    const blockers = profile.adapterBlockers ?? profile.adapters?.flatMap((adapter) => adapter.blockers) ?? [];
+    if (blockers.length)
+        return { commands: [], groups: [], unroutedPaths: [...selectedPaths], refusalReason: blockers.join("; ") };
+    const goPaths = selectedPaths.filter((path) => path.endsWith(".go"));
+    if (goPaths.length) {
+        const packages = profile.goTestPackages ?? {};
+        const unclaimed = goPaths.filter((path) => !Object.hasOwn(packages, path));
+        if (unclaimed.length)
+            return { commands: [], groups: [], unroutedPaths: unclaimed, refusalReason: "Go test files require verified package metadata" };
+        const jsPlan = planSelectiveTestCommands(profile, selectedPaths.filter((path) => !path.endsWith(".go")));
+        if (jsPlan.refusalReason)
+            return jsPlan;
+        const targets = [...new Set(goPaths.map((path) => packages[path]))].sort();
+        if (targets.some((target) => target !== "." && (!target.startsWith("./") || target.split("/").includes("..") || /[\\\r\n]/.test(target)))) {
+            return { commands: [], groups: [], unroutedPaths: goPaths, refusalReason: "Invalid Go package target" };
+        }
+        const commandSpec = {
+            executable: "go", args: ["test", "-mod=readonly", "-json", "-count=1", ...targets],
+            env: { ...profile.goTestEnvironment, GOTOOLCHAIN: "local", GOPROXY: "off", GOSUMDB: "off", GOWORK: "off" },
+        };
+        const group = { runnerId: "go:test", label: "Go package tests", paths: [...goPaths].sort(), commandSpec };
+        return { commands: [...jsPlan.commands, commandSpec], groups: [...jsPlan.groups, group], unroutedPaths: [] };
+    }
     const paths = [...selectedPaths].sort();
     if (paths.length === 0)
         return { commands: [], groups: [], unroutedPaths: [] };
@@ -120,5 +143,6 @@ function shellEscape(arg) {
     return arg.replace(/([\s'"\\$|&;<>(){}\[\]*?#~`])/g, "\\$1");
 }
 export function commandSpecToString(spec) {
-    return [spec.executable, ...spec.args.map(shellEscape)].join(" ");
+    const environment = Object.entries(spec.env ?? {}).map(([key, value]) => `${shellEscape(key)}=${shellEscape(value)}`);
+    return [...environment, spec.executable, ...spec.args.map(shellEscape)].join(" ");
 }

package/dist-client/src/repo/adapters/go.js

@@ -0,0 +1,154 @@
+import { execFileSync } from "node:child_process";
+import { readFileSync } from "node:fs";
+import { isAbsolute, relative, resolve } from "node:path";
+import { contribution } from "./types.js";
+/** go list emits adjacent JSON objects, not a JSON array or JSONL. */
+export function parseGoList(output) {
+    const packages = [];
+    let start = -1, depth = 0, quoted = false, escaped = false;
+    for (let i = 0; i < output.length; i++) {
+        const c = output[i];
+        if (quoted) {
+            if (escaped)
+                escaped = false;
+            else if (c === "\\")
+                escaped = true;
+            else if (c === '"')
+                quoted = false;
+            continue;
+        }
+        if (c === '"')
+            quoted = true;
+        else if (c === "{") {
+            if (depth++ === 0)
+                start = i;
+        }
+        else if (c === "}") {
+            if (--depth < 0)
+                throw new Error("Invalid go list output");
+            if (depth === 0) {
+                const pkg = JSON.parse(output.slice(start, i + 1));
+                if (typeof pkg.Dir !== "string" || typeof pkg.ImportPath !== "string")
+                    throw new Error("Incomplete Go package metadata");
+                packages.push(pkg);
+            }
+        }
+        else if (depth === 0 && !/\s/.test(c))
+            throw new Error("Unexpected go list output");
+    }
+    if (depth || quoted || !packages.length)
+        throw new Error("Truncated or empty go list output");
+    return packages;
+}
+function internalPath(root, path) {
+    const rel = relative(root, resolve(path)).replace(/\\/g, "/");
+    return rel === ".." || rel.startsWith("../") || isAbsolute(rel) ? undefined : rel;
+}
+export function analyzeGoMetadata(context, output) {
+    const result = contribution(goAdapter);
+    const all = parseGoList(output);
+    if (all.some((pkg) => pkg.Module?.Replace?.Dir && internalPath(context.repoPath, pkg.Module.Replace.Dir) === undefined))
+        result.blockers.push("Go local module replacement lies outside the repository");
+    if (all.some((pkg) => pkg.Error || pkg.Incomplete || pkg.DepsErrors?.length))
+        result.blockers.push("Go package metadata contains errors");
+    const packages = all.filter((pkg) => !pkg.ForTest && !pkg.ImportPath.endsWith(".test") && !pkg.Standard && internalPath(context.repoPath, pkg.Dir) !== undefined);
+    const anchors = new Map();
+    const members = new Map();
+    for (const pkg of packages) {
+        const files = [...(pkg.GoFiles ?? []), ...(pkg.CgoFiles ?? []), ...(pkg.TestGoFiles ?? []), ...(pkg.XTestGoFiles ?? [])];
+        const paths = files.map((file) => internalPath(context.repoPath, resolve(pkg.Dir, file)));
+        if (paths.some((p) => p === undefined)) {
+            result.blockers.push("Go package contains files outside the repository");
+            continue;
+        }
+        const sources = paths;
+        if (!sources.length)
+            continue;
+        anchors.set(pkg.ImportPath, sources[0]);
+        members.set(pkg.ImportPath, sources);
+        result.sourcePaths.push(...sources);
+        if (pkg.CgoFiles?.length)
+            result.blockers.push(`Go ${pkg.ImportPath}: cgo dependencies require full validation`);
+        if (pkg.SFiles?.length || pkg.SysoFiles?.length)
+            result.blockers.push(`Go ${pkg.ImportPath}: native assembly/object dependencies require full validation`);
+        if ([...(pkg.Imports ?? []), ...(pkg.TestImports ?? []), ...(pkg.XTestImports ?? [])].includes("plugin"))
+            result.blockers.push(`Go ${pkg.ImportPath}: runtime plugins require full validation`);
+        for (const file of sources) {
+            if (/^\s*\/\/go:(?:generate|linkname)\b/m.test(readFileSync(resolve(context.repoPath, file), "utf8")))
+                result.blockers.push(`Go ${file}: generated or linked dependencies require full validation`);
+        }
+        const dir = internalPath(context.repoPath, pkg.Dir);
+        for (const test of [...(pkg.TestGoFiles ?? []), ...(pkg.XTestGoFiles ?? [])]) {
+            const path = internalPath(context.repoPath, resolve(pkg.Dir, test));
+            result.testFiles.push(path);
+            result.testPackages[path] = dir ? `./${dir}` : ".";
+        }
+        for (const file of [...(pkg.EmbedFiles ?? []), ...(pkg.TestEmbedFiles ?? []), ...(pkg.XTestEmbedFiles ?? [])]) {
+            const asset = internalPath(context.repoPath, resolve(pkg.Dir, file));
+            if (asset === undefined) {
+                result.blockers.push("Go embedded file escapes repository");
+                continue;
+            }
+            result.assetPaths.push(asset);
+            result.edges.push({ from: sources[0], to: asset, kind: "asset" });
+        }
+    }
+    for (const pkg of packages) {
+        const anchor = anchors.get(pkg.ImportPath);
+        if (!anchor)
+            continue;
+        // A package is the selection unit: every member shares package-level dependencies.
+        for (const file of members.get(pkg.ImportPath) ?? []) {
+            if (file !== anchor)
+                result.edges.push({ from: anchor, to: file, kind: "import" }, { from: file, to: anchor, kind: "import" });
+        }
+        for (const imported of [...(pkg.Imports ?? []), ...(pkg.TestImports ?? []), ...(pkg.XTestImports ?? [])]) {
+            const target = anchors.get(imported);
+            if (target && target !== anchor)
+                result.edges.push({ from: anchor, to: target, kind: "import" });
+        }
+    }
+    if (!result.sourcePaths.length)
+        result.blockers.push("Go analysis found no local packages");
+    // Ignored files/build tags, generation and testdata can change the runnable universe.
+    const modeled = new Set([...result.sourcePaths, ...result.assetPaths]);
+    if (context.files.some((file) => file.endsWith(".go") && !modeled.has(file)))
+        result.blockers.push("Go files outside the active build context require full validation");
+    return result;
+}
+export const goAdapter = {
+    id: "go", version: "1", kind: "language",
+    detect: ({ files }) => files.some((file) => file === "go.mod" || file.endsWith(".go")),
+    analyze(context) {
+        const failure = contribution(this);
+        if (!context.files.includes("go.mod") || context.files.some((f) => f === "go.work" || f.endsWith("/go.mod"))) {
+            failure.blockers.push("Go support requires one root go.mod; workspaces and nested modules require full validation");
+            return failure;
+        }
+        try {
+            const env = { ...process.env, GOTOOLCHAIN: "local", GOPROXY: "off", GOSUMDB: "off", GOWORK: "off" };
+            const buildEnv = JSON.parse(execFileSync("go", ["env", "-json", "GOOS", "GOARCH", "CGO_ENABLED", "GOFLAGS"], {
+                cwd: context.repoPath, encoding: "utf8", timeout: 10_000, maxBuffer: 1024 * 1024,
+                windowsHide: true, env, stdio: ["ignore", "pipe", "pipe"],
+            }));
+            if (["GOOS", "GOARCH", "CGO_ENABLED", "GOFLAGS"].some((key) => typeof buildEnv[key] !== "string") || buildEnv.GOFLAGS.trim()) {
+                failure.blockers.push("Go custom build flags or incomplete build context require full validation");
+                return failure;
+            }
+            // No repository code is executed and module manifests must not be modified.
+            const output = execFileSync("go", ["list", "-mod=readonly", "-deps", "-test", "-json", "./..."], {
+                cwd: context.repoPath, encoding: "utf8", timeout: 60_000, maxBuffer: 64 * 1024 * 1024,
+                windowsHide: true,
+                env,
+                stdio: ["ignore", "pipe", "pipe"],
+            });
+            const result = analyzeGoMetadata(context, output);
+            result.executionEnv = { GOOS: buildEnv.GOOS, GOARCH: buildEnv.GOARCH, CGO_ENABLED: buildEnv.CGO_ENABLED, GOFLAGS: "" };
+            return result;
+        }
+        catch {
+            failure.blockers.push("Go metadata unavailable: install Go and repository dependencies before analysis (go list must succeed offline)");
+            return failure;
+        }
+    },
+};

package/dist-client/src/repo/adapters/index.js

@@ -0,0 +1,23 @@
+import { readdirSync } from "node:fs";
+import { join } from "node:path";
+import { goAdapter } from "./go.js";
+import { vueAdapter } from "./vue.js";
+export const REPOSITORY_ADAPTERS = [vueAdapter, goAdapter];
+/** Never follows symlinks or scans dependency/build output directories. */
+export function adapterFiles(root, exclusions = []) {
+    const ignored = new Set([".git", "node_modules", "vendor", ".next", "dist", "build", "coverage", "tmp", "temp"]);
+    const files = [];
+    function walk(dir, prefix) {
+        for (const entry of readdirSync(dir, { withFileTypes: true })) {
+            const path = prefix ? `${prefix}/${entry.name}` : entry.name;
+            if (exclusions.some((excluded) => path === excluded || path.startsWith(`${excluded}/`)))
+                continue;
+            if (entry.isDirectory() && !ignored.has(entry.name))
+                walk(join(dir, entry.name), path);
+            else if (entry.isFile())
+                files.push(path);
+        }
+    }
+    walk(root, "");
+    return files.sort();
+}

package/dist-client/src/repo/adapters/types.js

@@ -0,0 +1,3 @@
+export function contribution(adapter) {
+    return { id: adapter.id, version: adapter.version, sourcePaths: [], assetPaths: [], edges: [], virtualSources: [], testFiles: [], testPackages: {}, blockers: [] };
+}

package/dist-client/src/repo/adapters/vue.js

@@ -0,0 +1,63 @@
+import { readFileSync } from "node:fs";
+import { join } from "node:path";
+import { compileScript, compileTemplate, parse } from "@vue/compiler-sfc";
+import { contribution } from "./types.js";
+/** Explicit Vue SFC imports. Runtime component registries and preprocessors require full CI. */
+export const vueAdapter = {
+    id: "vue", version: "1", kind: "framework",
+    detect: ({ files }) => files.some((file) => file.endsWith(".vue")),
+    analyze(context) {
+        const result = contribution(this);
+        const dependencies = [...context.profile.packageJson.dependencies, ...context.profile.packageJson.devDependencies];
+        if (dependencies.includes("nuxt") || context.files.some((file) => /(?:^|\/)nuxt\.config\./.test(file))) {
+            result.blockers.push("Nuxt implicit routes and auto-imports require a dedicated framework adapter");
+        }
+        for (const path of context.files.filter((file) => file.endsWith(".vue"))) {
+            result.sourcePaths.push(path);
+            const block = (reason) => result.blockers.push(`Vue ${path}: ${reason}`);
+            try {
+                const { descriptor, errors } = parse(readFileSync(join(context.repoPath, path), "utf8"), { filename: path });
+                if (errors.length)
+                    block("component parse failed");
+                if (descriptor.customBlocks.length)
+                    block("custom blocks require a framework plugin");
+                const blocks = [descriptor.script, descriptor.scriptSetup, descriptor.template, ...descriptor.styles].filter((b) => b !== null);
+                for (const b of blocks) {
+                    if (b.src)
+                        block("external SFC blocks are not yet modeled");
+                    if (b.lang && !["js", "ts", "jsx", "tsx", "html", "css"].includes(b.lang))
+                        block(`unsupported preprocessor ${b.lang}`);
+                }
+                const script = descriptor.script || descriptor.scriptSetup
+                    ? compileScript(descriptor, { id: path }) : undefined;
+                let source = script?.content ?? "";
+                if (/\bimport\.meta\.glob(?:Eager)?\s*\(/.test(source))
+                    block("glob imports require bundler dependency expansion");
+                if (descriptor.template && !descriptor.template.src && !descriptor.template.lang) {
+                    const template = compileTemplate({
+                        source: descriptor.template.content, filename: path, id: path,
+                        compilerOptions: { bindingMetadata: script?.bindings },
+                    });
+                    if (template.errors.length)
+                        block("template compilation failed");
+                    // These calls represent dependencies supplied at runtime, outside the import graph.
+                    if (/\b_resolve(?:DynamicComponent|Component|Directive)\s*\(/.test(template.code))
+                        block("runtime component/directive resolution requires full validation");
+                    source += `\n${template.code}`;
+                }
+                else if (descriptor.template)
+                    block("external or preprocessed template requires full validation");
+                for (const style of descriptor.styles) {
+                    // CSS imports/URLs may be rewritten by arbitrary bundler plugins. Do not guess.
+                    if (/@import\b|url\s*\(/i.test(style.content))
+                        block("style imports or URLs require full validation");
+                }
+                result.virtualSources.push({ path, source });
+            }
+            catch {
+                block("component could not be analyzed");
+            }
+        }
+        return result;
+    },
+};