@dockerforge/core 0.1.0 → 0.1.2

package/README.md

@@ -1,14 +1,18 @@
 # @dockerforge/core
 
-The engine behind DockerForge. Give it a path to a local project and it analyses the stack and
-returns a Dockerfile, a `.dockerignore`, and a Compose file, along with a confidence score and a
-list of suggested improvements. It also lints existing Dockerfiles.
+The engine behind DockerForge. Generate and lint production-grade Dockerfiles from Node. Offline.
 
-Everything runs offline. The package makes no network calls. It only reads the local filesystem
-under the path you give it.
+[![npm](https://img.shields.io/npm/v/@dockerforge/core)](https://www.npmjs.com/package/@dockerforge/core)
+[![license](https://img.shields.io/npm/l/@dockerforge/core)](https://github.com/Mo-ASayed/DockerForge/blob/main/LICENSE)
+[![node](https://img.shields.io/node/v/@dockerforge/core)](https://nodejs.org)
 
-This is the open-source core that [`@dockerforge/cli`](https://www.npmjs.com/package/@dockerforge/cli)
-and the DockerForge cloud both build on. Licensed under Apache-2.0.
+Give it a path to a local project and it analyses the stack and returns a Dockerfile, a
+`.dockerignore`, and a Compose file, along with a confidence score and suggested improvements. It
+also lints existing Dockerfiles. The package makes no network calls; it only reads the local
+filesystem under the path you give it.
+
+Most people should use the [`@dockerforge/cli`](https://www.npmjs.com/package/@dockerforge/cli)
+command line tool. Use this package when you want to call the engine from your own Node code.
 
 ## Install
 
@@ -40,8 +44,8 @@ console.log(result.improvements);   // suggested changes
 | `optimise` | Set to `false` to skip the optimisation pass. |
 | `security` | Set to `false` to skip the security pass. |
 
-`projectPath` is required because this package is offline. Ingesting a remote git URL or a zip
-lives in the DockerForge cloud, not here.
+`projectPath` is required because this package is offline. Ingesting a remote git URL or a zip is
+part of the hosted product, not this package.
 
 ## Lint
 
@@ -55,34 +59,28 @@ console.log(summary.counts); // { critical, high, medium, low, info }
 console.log(summary.worst);  // the highest severity found, or null
 ```
 
-You can also lint a string instead of a file:
+Lint a string instead of a file:
 
 ```js
 await core.lint({ dockerfile: 'FROM node\nUSER root\n' });
 ```
 
-Rules:
-
-| Id | Check | Severity |
-| --- | --- | --- |
-| DF001 | Base image is not pinned (no tag, or `:latest`) | high |
-| DF002 | Final stage runs as root | high |
-| DF003 | `COPY . .` copies the whole build context | high |
-| DF004 | `.dockerignore` is missing or does not exclude `.env` | medium |
-| DF005 | A secret-like value is hardcoded in `ENV` or `ARG` | critical |
-| DF006 | No `WORKDIR` is set in the final stage | low |
+The six rules (`DF001`–`DF006`) are documented in the
+[rules reference](https://github.com/Mo-ASayed/DockerForge/blob/main/docs/rules.md).
 
 ## Errors
 
-The package throws typed errors, each carrying a `.code`:
-
-`PathNotFoundError`, `NotADirectoryError`, `UnsupportedStackError`, `IngestError`, and the base
-`DockerForgeError`. They are exported from the package root:
+The package throws typed errors, each carrying a `.code`: `PathNotFoundError`,
+`NotADirectoryError`, `UnsupportedStackError`, `IngestError`, and the base `DockerForgeError`.
+They are exported from the package root:
 
 ```js
 const { PathNotFoundError } = require('@dockerforge/core');
 ```
 
+See the [programmatic API guide](https://github.com/Mo-ASayed/DockerForge/blob/main/docs/programmatic.md)
+for the full surface.
+
 ## License
 
 Apache-2.0.

package/package.json

@@ -1,17 +1,17 @@
 {
   "name": "@dockerforge/core",
-  "version": "0.1.0",
-  "description": "DockerForge engine: analyse a local project and generate production-grade Dockerfiles, .dockerignore, and Compose. Offline, no network.",
+  "version": "0.1.2",
+  "description": "DockerForge engine: analyse a local project and generate production-grade Dockerfiles, .dockerignore, and Compose, and lint Dockerfiles. Offline, no network.",
   "license": "Apache-2.0",
   "author": "Docker Forge",
   "homepage": "https://containerise.dev",
   "repository": {
     "type": "git",
-    "url": "git+https://github.com/Mo-ASayed/Apps.git",
-    "directory": "dockerfile-builder/packages/core"
+    "url": "git+https://github.com/Mo-ASayed/DockerForge.git",
+    "directory": "packages/core"
   },
   "bugs": {
-    "url": "https://github.com/Mo-ASayed/Apps/issues"
+    "url": "https://github.com/Mo-ASayed/DockerForge/issues"
   },
   "main": "src/index.js",
   "files": [
@@ -26,15 +26,15 @@
     "access": "public"
   },
   "scripts": {
-    "test": "node --test",
-    "prepack": "node scripts/vendor-engine.js"
+    "test": "node --test"
   },
   "keywords": [
     "docker",
     "dockerfile",
     "containerize",
     "generator",
-    "lint"
+    "lint",
+    "sarif"
   ],
   "dependencies": {
     "adm-zip": "^0.5.10",

package/src/{_engine/backend/src/modules → engine}/analysis/analyser.js

@@ -1,9 +1,9 @@
-// backend/src/modules/analysis/analyser.js
+// Part of the @dockerforge/core engine.
 // Walks the full project tree, finds every service root, analyses each one.
 
 const path = require('path');
 const fs = require('fs-extra');
-const { STACKS, DEFAULT_VERSIONS, DEFAULT_PORTS, ROOT_CONFIG_FILES } = require('../../../../shared/constants');
+const { STACKS, DEFAULT_VERSIONS, DEFAULT_PORTS, ROOT_CONFIG_FILES } = require('../constants');
 
 // ── Constants ────────────────────────────────────────────────────────────────
 
@@ -707,6 +707,36 @@ async function analyseNode(projectPath, files, hints, projectRootPath = null, is
   // Role
   const role = await detectRole(projectPath, pkg);
 
+  // Detect which conventional source directories actually exist on disk, so the
+  // generator copies real directories instead of guessing the layout (e.g. app/ vs src/).
+  const SOURCE_DIR_CANDIDATES = [
+    'src', 'app', 'pages', 'components', 'lib', 'styles',
+    'public', 'server', 'config', 'content', 'i18n', 'locales', 'hooks', 'utils',
+  ];
+  const sourceDirs = [];
+  for (const d of SOURCE_DIR_CANDIDATES) {
+    try { if ((await fs.stat(path.join(projectPath, d))).isDirectory()) sourceDirs.push(d); }
+    catch { /* absent */ }
+  }
+
+  // Detect framework build/runtime config files that exist, so we copy real filenames
+  // instead of guessing a single hard-coded one. Next.js also reads its config at runtime.
+  const FRAMEWORK_CONFIG_CANDIDATES = [
+    'next.config.js', 'next.config.mjs', 'next.config.cjs', 'next.config.ts',
+    'tailwind.config.js', 'tailwind.config.ts', 'tailwind.config.cjs', 'tailwind.config.mjs',
+    'components.json', 'jsconfig.json',
+    'remix.config.js', 'svelte.config.js', 'nuxt.config.ts', 'nuxt.config.js',
+  ];
+  const frameworkConfigFiles = [];
+  for (const f of FRAMEWORK_CONFIG_CANDIDATES) {
+    try { if ((await fs.stat(path.join(projectPath, f))).isFile()) frameworkConfigFiles.push(f); }
+    catch { /* absent */ }
+  }
+  // The config Next.js reads on `next start` (first match wins) — must be in the runtime image.
+  const nextRuntimeConfig = framework === 'nextjs'
+    ? (frameworkConfigFiles.find(f => f.startsWith('next.config.')) || null)
+    : null;
+
   // Detect sibling directories referenced via require('../xxx') in the entry point.
   // These are root-level dirs that sit alongside the service dir and must be COPYed
   // into the image so cross-directory requires resolve at runtime.
@@ -731,6 +761,9 @@ async function analyseNode(projectPath, files, hints, projectRootPath = null, is
     rootBuildDeps,   // root-level dirs imported by vite config via '../dirname' — must be copied before build
     hasScopedPackages,
     siblingDeps,     // root-level dirs referenced via require('../xxx') — must be COPYed into runtime image
+    sourceDirs,           // conventional source dirs that actually exist on disk (real, not guessed)
+    frameworkConfigFiles, // framework build/runtime config files present (next.config, tailwind.config, ...)
+    nextRuntimeConfig,    // the next.config.* file Next.js reads at runtime, or null
     assumptions,
   };
 }

package/src/{_engine/shared → engine}/constants.js

@@ -1,4 +1,4 @@
-// shared/constants.js
+// constants.js (DockerForge engine shared constants)
 // Shared between frontend and backend
 
 const STACKS = {

package/src/{_engine/backend/src/modules → engine}/explanation/explainer.js

@@ -1,7 +1,7 @@
-// backend/src/modules/explanation/explainer.js
+// Part of the @dockerforge/core engine.
 // Turns analysis + result into a human-readable explanation
 
-const { STACKS } = require('../../../../shared/constants');
+const { STACKS } = require('../constants');
 
 function buildExplanation(analysis, result, securityNotes) {
   const stackNames = {

package/src/{_engine/backend/src/modules → engine}/generation/composeGenerator.js

@@ -1,4 +1,4 @@
-// backend/src/modules/generation/composeGenerator.js
+// Part of the @dockerforge/core engine.
 // Takes the same analysisResult shape as generator.js.
 // Returns { compose: string, improvements: string[] }
 'use strict';

package/src/{_engine/backend/src/modules → engine}/generation/generator.js

@@ -1,13 +1,17 @@
-// backend/src/modules/generation/generator.js
+// Part of the @dockerforge/core engine.
 // Accepts { services, sharedDirs } from the analyser.
 // Produces one Dockerfile (multi-stage if needed) + .dockerignore.
 
 const path = require('path');
-const { STACKS, BASE_IMAGES } = require('../../../../shared/constants');
+const { STACKS, BASE_IMAGES } = require('../constants');
 const { isSecretLikeEnvKey, isSecretLikeEnvValue } = require('../security/security');
 
-const STATIC_RUNTIME_IMAGE = 'nginx:1.27-alpine';
 const PNPM_VERSION = '9';
+const STATIC_SERVER_PACKAGE = 'serve@14.2.4';
+
+// Frameworks that produce a long-running Node server (SSR, API routes, dynamic rendering).
+// These run with `next start` / a framework server instead of a generic static file server.
+const SERVER_RENDERED_FRAMEWORKS = new Set(['nextjs', 'remix', 'sveltekit', 'nuxt']);
 
 function installPnpmGlobalCmd() {
   return `npm install -g pnpm@${PNPM_VERSION}`;
@@ -32,39 +36,20 @@ function runtimeStartCmd(a) {
   return ['node', `${buildOut}/${entry.replace(/^\.\//, '')}`];
 }
 
-function nginxStaticServerBlock(port) {
-  return 'COPY nginx.conf /etc/nginx/conf.d/default.conf';
-}
+function staticServeRuntimeStage(baseImage, port, buildAssetCopyLine, outputDir) {
+  return `FROM ${baseImage}
 
-function nginxConf(port) {
-  return `server {
-    listen ${port};
-    root /usr/share/nginx/html;
-    index index.html;
+WORKDIR /app
 
-    add_header X-Frame-Options "SAMEORIGIN";
-    add_header X-Content-Type-Options "nosniff";
-    add_header Referrer-Policy "strict-origin-when-cross-origin";
+ENV NODE_ENV=production
 
-    location ~* \\.(js|css|png|jpg|jpeg|gif|ico|svg|woff2)$ {
-        expires 1y;
-        add_header Cache-Control "public, immutable";
-    }
+RUN npm install -g ${STATIC_SERVER_PACKAGE} && npm cache clean --force
+${buildAssetCopyLine}
+USER node
 
-    location /health { return 200 "ok"; add_header Content-Type text/plain; }
-    location / { try_files $uri $uri/ /index.html; }
-
-    gzip on;
-    gzip_types text/plain text/css application/json application/javascript
-               text/xml application/xml image/svg+xml font/woff2 application/manifest+json;
-}`.trim();
-}
-
-function nginxNonRootPrepBlock() {
-  return [
-    'RUN mkdir -p /var/cache/nginx/client_temp /var/cache/nginx/proxy_temp /var/cache/nginx/fastcgi_temp /var/cache/nginx/uwsgi_temp /var/cache/nginx/scgi_temp',
-    'RUN touch /var/run/nginx.pid && chown -R nginx:nginx /var/cache/nginx /var/run/nginx.pid /var/log/nginx /etc/nginx/conf.d /usr/share/nginx/html',
-  ].join('\n');
+EXPOSE ${port}
+${simpleHttpHealthcheck(port)}
+CMD ["serve", "-s", "${outputDir}", "-l", "${port}"]`;
 }
 
 function simpleHttpHealthcheck(port) {
@@ -189,6 +174,22 @@ function nodeSourceCopyBlock(a, configCopyLine = '', frontendAssetCopyLine = '')
   return blocks.join('\n');
 }
 
+// Build-stage source copy for Next.js. Copies the config files and source directories that
+// actually exist on disk (detected by the analyser) instead of guessing app/ vs src/.
+function nextSourceCopyBlock(a, rootConfigFiles = []) {
+  const lines = [];
+  const configFiles = [...new Set([
+    ...rootConfigFiles.filter(f => !['package.json', a.lockFile].includes(f)),
+    ...(a.frameworkConfigFiles || []),
+  ])];
+  if (configFiles.length > 0) lines.push(`COPY ${configFiles.join(' ')} ./`);
+  const dirs = (Array.isArray(a.sourceDirs) && a.sourceDirs.length > 0)
+    ? a.sourceDirs
+    : ['app', 'pages', 'components', 'public']; // fallback only if nothing was detected
+  for (const d of dirs) lines.push(`COPY ${d}/ ./${d}/`);
+  return lines.join('\n');
+}
+
 function pythonBuilderImage(a) {
   return a.hasNativeDeps ? `python:${a.version}` : BASE_IMAGES[STACKS.PYTHON](a.version);
 }
@@ -273,6 +274,9 @@ function buildEnvBlock(envVars) {
 }
 
 function buildCommandPrefix(service) {
+  // Server-rendered frameworks (Next.js, Remix, ...) run their own build; the CRA-specific
+  // env prefix (DISABLE_ESLINT_PLUGIN etc.) does not apply and just adds noise.
+  if (SERVER_RENDERED_FRAMEWORKS.has(service.framework)) return '';
   // Fire for CRA regardless of how detection landed — framework='cra', role='frontend',
   // or any build command that invokes react-scripts directly.
   const isReactScripts =
@@ -668,8 +672,7 @@ ENTRYPOINT ["dotnet", "${be.projectName}.dll"]`.trim());
   }
   improvements.push('HEALTHCHECK should probe /health for each runtime service; add a /health endpoint returning 2xx where missing');
 
-  const collectedNginxConf = frontends.length > 0 ? nginxConf(frontends[0].port) : undefined;
-  return { dockerfile, dockerignore, improvements, nginxConf: collectedNginxConf };
+  return { dockerfile, dockerignore, improvements };
 }
 
 // ── Node at root (original behaviour) ───────────────────────────────────────
@@ -690,10 +693,18 @@ function generateNodeRoot(a, envVars = [], rootConfigFiles = []) {
     const buildOut = a.buildOutputDir || 'dist';
     const sourceCopyBlock = nodeSourceCopyBlock(a, configCopyLine, frontendAssetCopyLine);
 
-    // CRA / pure-frontend: runtime is a static file server, not a Node app.
-    // react-scripts is a devDep — it won't be present after --production install,
-    // and react-scripts start is a dev server anyway.
-    if (a.role === 'frontend' || a.framework === 'cra') {
+    // Next.js (and other SSR frameworks): a Node server, NOT a static site.
+    // Build with `next build`, then run `next start` on a lean Node runtime. Serving the
+    // .next output via a generic static server would break SSR, API routes, and dynamic rendering.
+    if (a.framework === 'nextjs') {
+      const prodInstall = nodeInstallLine(a.packageManager, true, { hasScopedPackages: a.hasScopedPackages });
+      const nextSrcCopy = nextSourceCopyBlock(a, rootConfigFiles);
+      const hasPublic = Array.isArray(a.sourceDirs) && a.sourceDirs.includes('public');
+      const publicCopy = hasPublic ? `COPY --from=builder /app/public ./public\n` : '';
+      const runtimeConfigCopy = a.nextRuntimeConfig
+        ? `COPY --from=builder /app/${a.nextRuntimeConfig} ./${a.nextRuntimeConfig}\n`
+        : '';
+
       dockerfile = `
 # ─── Stage 1: Build ───────────────────────────────────────
 ${builderFrom(baseImage, 'builder')}
@@ -703,23 +714,62 @@ WORKDIR /app
 COPY ${a.lockFile} package.json ./
 ${buildInstall}
 
-# Copy source
-${sourceCopyBlock}
+# Copy source and build-time config
+${nextSrcCopy}
 RUN ${buildPrefix}${a.buildCommand}
 
 # ─── Stage 2: Runtime ─────────────────────────────────────
-FROM ${STATIC_RUNTIME_IMAGE}
+FROM ${baseImage}
+
+WORKDIR /app
+
+${buildEnvBlock(envVars)}
 
-COPY --from=builder /app/${buildOut} /usr/share/nginx/html
-${nginxStaticServerBlock(a.port)}
+COPY ${a.lockFile} package.json ./
+${prodInstall}
+
+# Next.js runs as a Node server; copy the build output, static assets, and the config it reads at runtime
+COPY --from=builder /app/${buildOut} ./${buildOut}
+${publicCopy}${runtimeConfigCopy}${runtimeUserBlock(true)}
 
+${nodeStopSignalBlock()}
 EXPOSE ${a.port}
 ${simpleHttpHealthcheck(a.port)}
-CMD ["nginx", "-g", "daemon off;"]`.trim();
+CMD ${startCmdJson}`.trim();
+
+      improvements.push('Next.js is built and run as a Node server (next start) so SSR and API routes work — a generic static server image would break them.');
+      improvements.push('Smaller image option: set `output: "standalone"` in next.config, then copy .next/standalone + .next/static instead of installing node_modules.');
+      improvements.push('Only known framework config files are auto-copied — verify any project-specific build config is also COPYed (e.g. sentry.*.config.ts, next-i18next.config).');
+      improvements.push('HEALTHCHECK probes /health, which Next.js does not expose by default — add a health route or point the healthcheck at an existing path.');
+      return { dockerfile, dockerignore: nodeDockerignore(), improvements };
+    }
+
+    // CRA / pure-frontend SPA: runtime is a static file server, not a Node app.
+    // react-scripts is a devDep — it won't be present after --production install,
+    // and react-scripts start is a dev server anyway. Server-rendered frameworks are
+    // explicitly excluded so they never get the static-file-server treatment.
+    const isStaticSpa = (a.role === 'frontend' || a.framework === 'cra')
+      && !SERVER_RENDERED_FRAMEWORKS.has(a.framework);
+    if (isStaticSpa) {
+      dockerfile = `
+# ─── Stage 1: Build ───────────────────────────────────────
+${builderFrom(baseImage, 'builder')}
+
+WORKDIR /app
+
+COPY ${a.lockFile} package.json ./
+${buildInstall}
+
+# Copy source
+${sourceCopyBlock}
+RUN ${buildPrefix}${a.buildCommand}
+
+# ─── Stage 2: Runtime ─────────────────────────────────────
+${staticServeRuntimeStage(baseImage, a.port, `COPY --from=builder /app/${buildOut} ./${buildOut}`, buildOut)}`.trim();
 
       const validationDockerfile = dockerfile;
-      improvements.push(`Frontend-only: built then served with ${STATIC_RUNTIME_IMAGE}. No Node runtime or node_modules in final image.`);
-      return withValidationVariant({ dockerfile, dockerignore: nodeDockerignore(), nginxConf: nginxConf(a.port), improvements }, validationDockerfile);
+      improvements.push(`Frontend-only: built then served with ${STATIC_SERVER_PACKAGE} as the non-root node user.`);
+      return withValidationVariant({ dockerfile, dockerignore: nodeDockerignore(), improvements }, validationDockerfile);
 
     } else {
       const pruneCmd = nodePruneLine(a.packageManager);
@@ -807,8 +857,9 @@ function generateNodeSub(a, dir, sharedDirs, staticAssets = [], rootConfigFiles
 
   let dockerfile;
 
-  if (a.hasBuild && a.role === 'frontend') {
-    // Frontend build → serve static via nginx
+  if (a.hasBuild && a.role === 'frontend' && !SERVER_RENDERED_FRAMEWORKS.has(a.framework)) {
+    // Static SPA build → serve the compiled output. Server-rendered frameworks (Next.js, Remix, ...)
+    // are excluded here and fall through to the Node-server runtime branch below.
     const stageName = 'build';
 
     // When lock file is at project root, copy root files + service package.json and
@@ -883,18 +934,11 @@ ${sourceCopy}
 ${sharedConfigCopy}${buildRun}
 
 # ─── Stage 2: Serve ───────────────────────────────────────
-FROM ${STATIC_RUNTIME_IMAGE}
-
-COPY --from=${stageName} ${buildOutput} /usr/share/nginx/html
-${nginxStaticServerBlock(a.port)}
-
-EXPOSE ${a.port}
-${simpleHttpHealthcheck(a.port)}
-CMD ["nginx", "-g", "daemon off;"]`.trim();
+${staticServeRuntimeStage(baseImage, a.port, `COPY --from=${stageName} ${buildOutput} ./${a.buildOutputDir || 'build'}`, a.buildOutputDir || 'build')}`.trim();
 
     const validationDockerfile = dockerfile;
-    improvements.push(`Frontend-only: built then served with ${STATIC_RUNTIME_IMAGE}. If a backend also serves the files, merge into one multi-service build.`);
-    return withValidationVariant({ dockerfile, dockerignore: nodeDockerignore(), nginxConf: nginxConf(a.port), improvements }, validationDockerfile);
+    improvements.push(`Frontend-only: built then served with ${STATIC_SERVER_PACKAGE} as the non-root node user. If a backend also serves the files, merge into one multi-service build.`);
+    return withValidationVariant({ dockerfile, dockerignore: nodeDockerignore(), improvements }, validationDockerfile);
 
 
   } else {

package/src/{_engine/backend/src/modules/engine.js → engine/index.js}

@@ -132,7 +132,7 @@ function applyValidationEvidence(confidenceResult, validation) {
 
 /**
  * Strip BuildKit-specific features from a Dockerfile to produce the simple default output.
- * The full version (with mounts, CRA flags, etc.) becomes powerDockerfile.
+ * Build environment prefixes stay in both outputs because they are part of the recipe.
  */
 function toSimpleDockerfile(dockerfile) {
   return dockerfile.split('\n').map(line => {
@@ -140,11 +140,6 @@ function toSimpleDockerfile(dockerfile) {
     if (!isRun) return line;
     // Strip --mount=type=cache,... and --mount=type=secret,...
     line = line.replace(/--mount=type=\w+,\S+\s+/g, '');
-    // Strip CRA build environment prefix (CI=false GENERATE_SOURCEMAP=false ...)
-    line = line.replace(
-      /^(RUN\s+)CI=false GENERATE_SOURCEMAP=false NODE_OPTIONS=--max-old-space-size=\d+ DISABLE_ESLINT_PLUGIN=true\s+/,
-      '$1'
-    );
     return line;
   }).join('\n');
 }

package/src/{_engine/backend/src/modules → engine}/ingestion/ingestion.js

@@ -1,10 +1,10 @@
-// backend/src/modules/ingestion/ingestion.js
+// Part of the @dockerforge/core engine.
 // Fetches repo file tree + key files via provider APIs — no git binary needed.
 // Works on Vercel, Railway, Render, etc.
 
 const path = require('path');
 const fs = require('fs-extra');
-const { IGNORED_DIRS, ROOT_CONFIG_FILES } = require('../../../../shared/constants');
+const { IGNORED_DIRS, ROOT_CONFIG_FILES } = require('../constants');
 
 const IGNORED_SET = new Set(IGNORED_DIRS);
 

package/src/{_engine/backend/src/modules → engine}/optimisation/optimiser.js

@@ -1,4 +1,4 @@
-// backend/src/modules/optimisation/optimiser.js
+// Part of the @dockerforge/core engine.
 // Post-generation pass: check for obvious wins, add notes
 
 function optimise(result, analysis) {

package/src/{_engine/backend/src/modules → engine}/security/security.js

@@ -1,4 +1,4 @@
-// backend/src/modules/security/security.js
+// Part of the @dockerforge/core engine.
 // Checks for common Dockerfile security issues
 
 function hasTaggedImage(image) {

package/src/index.js

@@ -1,27 +1,20 @@
 'use strict';
 
-// @dockerforge/core - thin facade (Chunk 0.3).
+// @dockerforge/core - the offline DockerForge engine, public surface.
 //
-// This re-exports the CURRENT engine in backend/src/modules/* UNCHANGED. We do not move
-// internals yet (that happens gradually, file-by-file, behind the existing ~600 tests).
-// What this file fixes is the PUBLIC SURFACE: it is exactly the contract in
-// docs/contracts/core-contract.md. The CLI and the Cloud API code against this, not against
-// backend/src/modules paths.
+// Given a path to a local project, it analyses the stack and generates a Dockerfile,
+// a .dockerignore, and a Compose file, and it lints existing Dockerfiles. This file is the
+// stable public API (see docs/contracts/core-contract.md). The engine itself lives under
+// ./engine.
 //
 // No-network guarantee: this module performs zero outbound network calls. It only reads the
 // local filesystem under the resolved project path. Remote ingestion (git URL / zip URL) is
-// intentionally NOT exposed here - that adapter lives on the proprietary cloud side.
+// intentionally NOT exposed here - that adapter lives in the proprietary cloud.
 
 const path = require('path');
 const fs = require('fs-extra');
 
-// Engine resolution: a published tarball vendors the engine under ./_engine (see
-// scripts/vendor-engine.js, run at prepack). In the monorepo (dev/test) that dir does not
-// exist, so we fall back to the canonical backend/ source. Same code either way.
-const _vendoredEngine = require('path').join(__dirname, '_engine', 'backend', 'src', 'modules', 'engine.js');
-const engine = require('fs').existsSync(_vendoredEngine)
-  ? require(_vendoredEngine)
-  : require('../../../backend/src/modules/engine');
+const engine = require('./engine');
 const errors = require('./errors');
 const { lint } = require('./lint');