@dockerforge/core 0.1.0 → 0.1.1

package/README.md

@@ -1,14 +1,18 @@
 # @dockerforge/core
 
-The engine behind DockerForge. Give it a path to a local project and it analyses the stack and
-returns a Dockerfile, a `.dockerignore`, and a Compose file, along with a confidence score and a
-list of suggested improvements. It also lints existing Dockerfiles.
+The engine behind DockerForge. Generate and lint production-grade Dockerfiles from Node. Offline.
 
-Everything runs offline. The package makes no network calls. It only reads the local filesystem
-under the path you give it.
+[![npm](https://img.shields.io/npm/v/@dockerforge/core)](https://www.npmjs.com/package/@dockerforge/core)
+[![license](https://img.shields.io/npm/l/@dockerforge/core)](https://github.com/Mo-ASayed/DockerForge/blob/main/LICENSE)
+[![node](https://img.shields.io/node/v/@dockerforge/core)](https://nodejs.org)
 
-This is the open-source core that [`@dockerforge/cli`](https://www.npmjs.com/package/@dockerforge/cli)
-and the DockerForge cloud both build on. Licensed under Apache-2.0.
+Give it a path to a local project and it analyses the stack and returns a Dockerfile, a
+`.dockerignore`, and a Compose file, along with a confidence score and suggested improvements. It
+also lints existing Dockerfiles. The package makes no network calls; it only reads the local
+filesystem under the path you give it.
+
+Most people should use the [`@dockerforge/cli`](https://www.npmjs.com/package/@dockerforge/cli)
+command line tool. Use this package when you want to call the engine from your own Node code.
 
 ## Install
 
@@ -40,8 +44,8 @@ console.log(result.improvements);   // suggested changes
 | `optimise` | Set to `false` to skip the optimisation pass. |
 | `security` | Set to `false` to skip the security pass. |
 
-`projectPath` is required because this package is offline. Ingesting a remote git URL or a zip
-lives in the DockerForge cloud, not here.
+`projectPath` is required because this package is offline. Ingesting a remote git URL or a zip is
+part of the hosted product, not this package.
 
 ## Lint
 
@@ -55,34 +59,28 @@ console.log(summary.counts); // { critical, high, medium, low, info }
 console.log(summary.worst);  // the highest severity found, or null
 ```
 
-You can also lint a string instead of a file:
+Lint a string instead of a file:
 
 ```js
 await core.lint({ dockerfile: 'FROM node\nUSER root\n' });
 ```
 
-Rules:
-
-| Id | Check | Severity |
-| --- | --- | --- |
-| DF001 | Base image is not pinned (no tag, or `:latest`) | high |
-| DF002 | Final stage runs as root | high |
-| DF003 | `COPY . .` copies the whole build context | high |
-| DF004 | `.dockerignore` is missing or does not exclude `.env` | medium |
-| DF005 | A secret-like value is hardcoded in `ENV` or `ARG` | critical |
-| DF006 | No `WORKDIR` is set in the final stage | low |
+The six rules (`DF001`–`DF006`) are documented in the
+[rules reference](https://github.com/Mo-ASayed/DockerForge/blob/main/docs/rules.md).
 
 ## Errors
 
-The package throws typed errors, each carrying a `.code`:
-
-`PathNotFoundError`, `NotADirectoryError`, `UnsupportedStackError`, `IngestError`, and the base
-`DockerForgeError`. They are exported from the package root:
+The package throws typed errors, each carrying a `.code`: `PathNotFoundError`,
+`NotADirectoryError`, `UnsupportedStackError`, `IngestError`, and the base `DockerForgeError`.
+They are exported from the package root:
 
 ```js
 const { PathNotFoundError } = require('@dockerforge/core');
 ```
 
+See the [programmatic API guide](https://github.com/Mo-ASayed/DockerForge/blob/main/docs/programmatic.md)
+for the full surface.
+
 ## License
 
 Apache-2.0.

package/package.json

@@ -1,17 +1,17 @@
 {
   "name": "@dockerforge/core",
-  "version": "0.1.0",
-  "description": "DockerForge engine: analyse a local project and generate production-grade Dockerfiles, .dockerignore, and Compose. Offline, no network.",
+  "version": "0.1.1",
+  "description": "DockerForge engine: analyse a local project and generate production-grade Dockerfiles, .dockerignore, and Compose, and lint Dockerfiles. Offline, no network.",
   "license": "Apache-2.0",
   "author": "Docker Forge",
   "homepage": "https://containerise.dev",
   "repository": {
     "type": "git",
-    "url": "git+https://github.com/Mo-ASayed/Apps.git",
-    "directory": "dockerfile-builder/packages/core"
+    "url": "git+https://github.com/Mo-ASayed/DockerForge.git",
+    "directory": "packages/core"
   },
   "bugs": {
-    "url": "https://github.com/Mo-ASayed/Apps/issues"
+    "url": "https://github.com/Mo-ASayed/DockerForge/issues"
   },
   "main": "src/index.js",
   "files": [
@@ -26,15 +26,15 @@
     "access": "public"
   },
   "scripts": {
-    "test": "node --test",
-    "prepack": "node scripts/vendor-engine.js"
+    "test": "node --test"
   },
   "keywords": [
     "docker",
     "dockerfile",
     "containerize",
     "generator",
-    "lint"
+    "lint",
+    "sarif"
   ],
   "dependencies": {
     "adm-zip": "^0.5.10",

package/src/{_engine/backend/src/modules → engine}/analysis/analyser.js

@@ -1,9 +1,9 @@
-// backend/src/modules/analysis/analyser.js
+// Part of the @dockerforge/core engine.
 // Walks the full project tree, finds every service root, analyses each one.
 
 const path = require('path');
 const fs = require('fs-extra');
-const { STACKS, DEFAULT_VERSIONS, DEFAULT_PORTS, ROOT_CONFIG_FILES } = require('../../../../shared/constants');
+const { STACKS, DEFAULT_VERSIONS, DEFAULT_PORTS, ROOT_CONFIG_FILES } = require('../constants');
 
 // ── Constants ────────────────────────────────────────────────────────────────
 

package/src/{_engine/shared → engine}/constants.js

@@ -1,4 +1,4 @@
-// shared/constants.js
+// constants.js (DockerForge engine shared constants)
 // Shared between frontend and backend
 
 const STACKS = {

package/src/{_engine/backend/src/modules → engine}/explanation/explainer.js

@@ -1,7 +1,7 @@
-// backend/src/modules/explanation/explainer.js
+// Part of the @dockerforge/core engine.
 // Turns analysis + result into a human-readable explanation
 
-const { STACKS } = require('../../../../shared/constants');
+const { STACKS } = require('../constants');
 
 function buildExplanation(analysis, result, securityNotes) {
   const stackNames = {

package/src/{_engine/backend/src/modules → engine}/generation/composeGenerator.js

@@ -1,4 +1,4 @@
-// backend/src/modules/generation/composeGenerator.js
+// Part of the @dockerforge/core engine.
 // Takes the same analysisResult shape as generator.js.
 // Returns { compose: string, improvements: string[] }
 'use strict';

package/src/{_engine/backend/src/modules → engine}/generation/generator.js

@@ -1,9 +1,9 @@
-// backend/src/modules/generation/generator.js
+// Part of the @dockerforge/core engine.
 // Accepts { services, sharedDirs } from the analyser.
 // Produces one Dockerfile (multi-stage if needed) + .dockerignore.
 
 const path = require('path');
-const { STACKS, BASE_IMAGES } = require('../../../../shared/constants');
+const { STACKS, BASE_IMAGES } = require('../constants');
 const { isSecretLikeEnvKey, isSecretLikeEnvValue } = require('../security/security');
 
 const STATIC_RUNTIME_IMAGE = 'nginx:1.27-alpine';

package/src/{_engine/backend/src/modules → engine}/ingestion/ingestion.js

@@ -1,10 +1,10 @@
-// backend/src/modules/ingestion/ingestion.js
+// Part of the @dockerforge/core engine.
 // Fetches repo file tree + key files via provider APIs — no git binary needed.
 // Works on Vercel, Railway, Render, etc.
 
 const path = require('path');
 const fs = require('fs-extra');
-const { IGNORED_DIRS, ROOT_CONFIG_FILES } = require('../../../../shared/constants');
+const { IGNORED_DIRS, ROOT_CONFIG_FILES } = require('../constants');
 
 const IGNORED_SET = new Set(IGNORED_DIRS);
 

package/src/{_engine/backend/src/modules → engine}/optimisation/optimiser.js

@@ -1,4 +1,4 @@
-// backend/src/modules/optimisation/optimiser.js
+// Part of the @dockerforge/core engine.
 // Post-generation pass: check for obvious wins, add notes
 
 function optimise(result, analysis) {

package/src/{_engine/backend/src/modules → engine}/security/security.js

@@ -1,4 +1,4 @@
-// backend/src/modules/security/security.js
+// Part of the @dockerforge/core engine.
 // Checks for common Dockerfile security issues
 
 function hasTaggedImage(image) {

package/src/index.js

@@ -1,27 +1,20 @@
 'use strict';
 
-// @dockerforge/core - thin facade (Chunk 0.3).
+// @dockerforge/core - the offline DockerForge engine, public surface.
 //
-// This re-exports the CURRENT engine in backend/src/modules/* UNCHANGED. We do not move
-// internals yet (that happens gradually, file-by-file, behind the existing ~600 tests).
-// What this file fixes is the PUBLIC SURFACE: it is exactly the contract in
-// docs/contracts/core-contract.md. The CLI and the Cloud API code against this, not against
-// backend/src/modules paths.
+// Given a path to a local project, it analyses the stack and generates a Dockerfile,
+// a .dockerignore, and a Compose file, and it lints existing Dockerfiles. This file is the
+// stable public API (see docs/contracts/core-contract.md). The engine itself lives under
+// ./engine.
 //
 // No-network guarantee: this module performs zero outbound network calls. It only reads the
 // local filesystem under the resolved project path. Remote ingestion (git URL / zip URL) is
-// intentionally NOT exposed here - that adapter lives on the proprietary cloud side.
+// intentionally NOT exposed here - that adapter lives in the proprietary cloud.
 
 const path = require('path');
 const fs = require('fs-extra');
 
-// Engine resolution: a published tarball vendors the engine under ./_engine (see
-// scripts/vendor-engine.js, run at prepack). In the monorepo (dev/test) that dir does not
-// exist, so we fall back to the canonical backend/ source. Same code either way.
-const _vendoredEngine = require('path').join(__dirname, '_engine', 'backend', 'src', 'modules', 'engine.js');
-const engine = require('fs').existsSync(_vendoredEngine)
-  ? require(_vendoredEngine)
-  : require('../../../backend/src/modules/engine');
+const engine = require('./engine');
 const errors = require('./errors');
 const { lint } = require('./lint');