@dockerforge/core 0.1.0

package/src/_engine/backend/src/modules/engine.js

@@ -0,0 +1,219 @@
+'use strict';
+
+const { ingestGitRepo, ingestZip, ingestTree } = require('./ingestion/ingestion');
+const { analyseProject } = require('./analysis/analyser');
+const { generateDockerfile, addPowerDockerfileHeader } = require('./generation/generator');
+const { optimise } = require('./optimisation/optimiser');
+const { securityPass } = require('./security/security');
+const { buildExplanation } = require('./explanation/explainer');
+const { generateCompose } = require('./generation/composeGenerator');
+
+function clampScore(score) {
+  return Math.max(0, Math.min(1, Number(score.toFixed(2))));
+}
+
+function confidenceLabel(score) {
+  if (score >= 0.9) return 'High';
+  if (score >= 0.7) return 'Medium';
+  if (score >= 0.4) return 'Low';
+  return 'Unsupported/Risky';
+}
+
+function collectAssumptions(analysisResult) {
+  return analysisResult.services.flatMap(service =>
+    (service.assumptions || []).map(item => `${service.serviceDir}: ${item}`)
+  );
+}
+
+function buildWarnings({ analysisResult, result, securityNotes }) {
+  const warnings = [];
+  for (const note of securityNotes) {
+    if (/security|warning|avoid|possible|root|latest/i.test(note)) warnings.push(note);
+  }
+  for (const note of result.improvements || []) {
+    if (/verify|must|warning|blocked|assumption|source|healthcheck/i.test(note)) warnings.push(note);
+  }
+  for (const service of analysisResult.services) {
+    if (service.stack === 'python') {
+      warnings.push(`${service.serviceDir}: Python source copy confidence needs review; verify all package, template, static, and migration directories are copied.`);
+    }
+    if (service.stack === 'node' && !service.lockFile) {
+      warnings.push(`${service.serviceDir}: no Node lockfile detected; dependency installs may not be reproducible.`);
+    }
+  }
+  return [...new Set(warnings)];
+}
+
+function scoreConfidence({ analysisResult, warnings }) {
+  let score = 1;
+  const reasons = [];
+  const assumptions = collectAssumptions(analysisResult);
+
+  if (analysisResult.services.length > 1) {
+    score -= 0.04;
+    reasons.push(`${analysisResult.services.length} services detected`);
+  }
+
+  for (const service of analysisResult.services) {
+    if (!service.version) {
+      score -= 0.15;
+      reasons.push(`${service.serviceDir}: runtime version missing`);
+    }
+    if (service.stack === 'node') {
+      if (!service.lockFile) {
+        score -= 0.18;
+        reasons.push(`${service.serviceDir}: lockfile missing`);
+      }
+      if (!service.startCmd || service.startCmd.length === 0) {
+        score -= 0.2;
+        reasons.push(`${service.serviceDir}: start command uncertain`);
+      }
+    }
+    if (service.stack === 'python') {
+      if (!service.entryPoint && !service.appTarget) {
+        score -= 0.2;
+        reasons.push(`${service.serviceDir}: Python entrypoint uncertain`);
+      }
+      if (!service.sourceCopyConfidence || service.sourceCopyConfidence !== 'high') {
+        score -= 0.12;
+        reasons.push(`${service.serviceDir}: Python source copy needs review`);
+      }
+    }
+    if ((service.assumptions || []).length > 0) {
+      score -= Math.min(0.18, service.assumptions.length * 0.06);
+    }
+  }
+
+  const majorWarnings = warnings.filter(w => /security|must|not detected|permission denied|invalid|unsafe/i.test(w));
+  if (majorWarnings.length > 0) {
+    score -= Math.min(0.18, majorWarnings.length * 0.04);
+  }
+
+  const finalScore = clampScore(score);
+  const label = confidenceLabel(finalScore);
+  let reason;
+  if (reasons.length > 0) {
+    reason = reasons.slice(0, 2).join('; ');
+  } else if (assumptions.length > 0) {
+    reason = `${assumptions.length} assumption${assumptions.length === 1 ? '' : 's'} detected.`;
+  } else if (warnings.length > 0) {
+    reason = `${warnings.length} warning${warnings.length === 1 ? '' : 's'} to review.`;
+  } else {
+    reason = 'Stack, runtime, dependencies, and start command were detected with no major warnings.';
+  }
+
+  return { confidence: finalScore, confidenceLabel: label, confidenceReason: reason };
+}
+
+function applyValidationEvidence(confidenceResult, validation) {
+  if (!validation || validation.status === 'skipped') return confidenceResult;
+
+  if (validation.status === 'passed') {
+    const delta = validation.evidence?.runtimePassed ? 0.12 : 0.08;
+    const confidence = clampScore(confidenceResult.confidence + delta);
+    return {
+      confidence,
+      confidenceLabel: confidenceLabel(confidence),
+      confidenceReason: `${confidenceResult.confidenceReason} Build/runtime validated.`,
+    };
+  }
+
+  if (validation.status === 'failed') {
+    const confidence = clampScore(confidenceResult.confidence - 0.2);
+    return {
+      confidence,
+      confidenceLabel: confidenceLabel(confidence),
+      confidenceReason: `${confidenceResult.confidenceReason} Validation failed during ${validation.stage}.`,
+    };
+  }
+
+  return confidenceResult;
+}
+
+/**
+ * Strip BuildKit-specific features from a Dockerfile to produce the simple default output.
+ * The full version (with mounts, CRA flags, etc.) becomes powerDockerfile.
+ */
+function toSimpleDockerfile(dockerfile) {
+  return dockerfile.split('\n').map(line => {
+    const isRun = /^RUN\s/.test(line);
+    if (!isRun) return line;
+    // Strip --mount=type=cache,... and --mount=type=secret,...
+    line = line.replace(/--mount=type=\w+,\S+\s+/g, '');
+    // Strip CRA build environment prefix (CI=false GENERATE_SOURCEMAP=false ...)
+    line = line.replace(
+      /^(RUN\s+)CI=false GENERATE_SOURCEMAP=false NODE_OPTIONS=--max-old-space-size=\d+ DISABLE_ESLINT_PLUGIN=true\s+/,
+      '$1'
+    );
+    return line;
+  }).join('\n');
+}
+
+
+async function resolveProjectPath(input) {
+  if (input.projectPath) return input.projectPath;
+  if (input.gitUrl) return ingestGitRepo(input.gitUrl, input.workDir, input.pat);
+  if (input.zipPath) return ingestZip(input.zipPath, input.workDir);
+  if (input.fileTree) return ingestTree(input.fileTree, input.workDir);
+  throw new Error('Provide projectPath, gitUrl, zipPath, or fileTree');
+}
+
+async function runDockerfileEngine(input = {}) {
+  const projectPath = await resolveProjectPath(input);
+  const analysisResult = await analyseProject(projectPath, input.hints || {});
+  const primaryService = analysisResult.services[0];
+
+  let result = generateDockerfile(analysisResult);
+  const composeResult = generateCompose(analysisResult);
+
+  if (input.optimise !== false) {
+    result = optimise(result, primaryService);
+  }
+
+  const securityNotes = input.security === false ? [] : securityPass(result, primaryService);
+  const explanation = buildExplanation(primaryService, result, securityNotes);
+  const improvements = [...securityNotes, ...(result.improvements || []), ...(composeResult.improvements || [])];
+  const assumptions = collectAssumptions(analysisResult);
+  const warnings = buildWarnings({ analysisResult, result, securityNotes });
+  const confidence = applyValidationEvidence(
+    scoreConfidence({ analysisResult, warnings }),
+    input.validation
+  );
+
+  const fullDockerfile   = result.dockerfile;
+  const powerDockerfile  = addPowerDockerfileHeader(fullDockerfile);
+  const simpleDockerfile = toSimpleDockerfile(fullDockerfile);
+
+  return {
+    dockerfile: simpleDockerfile,
+    powerDockerfile,
+    validationDockerfile: result.validationDockerfile || null,
+    validationDrift: result.validationDrift || null,
+    dockerignore: result.dockerignore,
+    nginxConf: result.nginxConf || null,
+    compose: composeResult.compose || null,
+    explanation,
+    improvements,
+    warnings,
+    assumptions,
+    validation: input.validation || null,
+    analysis: {
+      services: analysisResult.services.map(service => ({
+        stack: service.stack,
+        role: service.role,
+        serviceDir: service.serviceDir,
+        version: service.version,
+        framework: service.framework || null,
+        port: service.port,
+      })),
+    },
+    ...confidence,
+  };
+}
+
+module.exports = {
+  applyValidationEvidence,
+  runDockerfileEngine,
+  scoreConfidence,
+  buildWarnings,
+};

package/src/_engine/backend/src/modules/explanation/explainer.js

@@ -0,0 +1,78 @@
+// backend/src/modules/explanation/explainer.js
+// Turns analysis + result into a human-readable explanation
+
+const { STACKS } = require('../../../../shared/constants');
+
+function buildExplanation(analysis, result, securityNotes) {
+  const stackNames = {
+    [STACKS.NODE]: 'Node.js',
+    [STACKS.PYTHON]: 'Python',
+    [STACKS.DOTNET]: '.NET',
+  };
+
+  const lines = [];
+
+  lines.push(`**Stack detected:** ${stackNames[analysis.stack]}`);
+  lines.push(`**Runtime version:** ${analysis.version}`);
+
+  // Base image reasoning
+  if (analysis.stack === STACKS.NODE) {
+    lines.push(
+      `**Base image:** \`node:${analysis.version}-alpine\` (Alpine Linux keeps the image small, ~50MB vs ~900MB for the full Debian image).`
+    );
+    lines.push(`**Package manager:** ${analysis.packageManager} (detected from lockfile)`);
+    if (analysis.hasBuild) {
+      lines.push(
+        `**Build strategy:** Multi-stage build. A build container compiles the app, then only the output is copied to a clean runtime container. Dev dependencies never reach production.`
+      );
+    } else {
+      lines.push(
+        `**Build strategy:** Single stage. No build script detected, so all dependencies are installed directly in the runtime container with \`--omit=dev\` to exclude dev packages.`
+      );
+    }
+  }
+
+  if (analysis.stack === STACKS.PYTHON) {
+    lines.push(
+      `**Base image:** \`python:${analysis.version}-slim\` (Debian slim removes most docs and locales, saving ~100MB vs the full image).`
+    );
+    if (analysis.framework) {
+      lines.push(`**Framework detected:** ${analysis.framework}, start command tuned accordingly.`);
+    }
+    lines.push(
+      `**PYTHONDONTWRITEBYTECODE + PYTHONUNBUFFERED set:** prevents .pyc clutter and ensures logs appear immediately in Docker.`
+    );
+  }
+
+  if (analysis.stack === STACKS.DOTNET) {
+    lines.push(
+      `**Base images:** SDK image (\`mcr.microsoft.com/dotnet/sdk:${analysis.version}\`) used to build, then the much smaller ASP.NET runtime image (\`mcr.microsoft.com/dotnet/aspnet:${analysis.version}\`) for production. SDK is ~750MB, runtime is ~220MB.`
+    );
+    lines.push(`**Multi-stage build:** Always used for .NET. The SDK is never shipped to production.`);
+  }
+
+  // Port
+  lines.push(`**Port:** \`${analysis.port}\` exposed`);
+
+  // Security
+  lines.push(`**Security:** Non-root user added. Container does not run as root.`);
+
+  // Cache optimisation
+  lines.push(
+    `**Layer caching:** Lockfile and package manifest are copied before the rest of the app. This means \`docker build\` only re-runs the install step if your dependencies actually changed.`
+  );
+
+  return {
+    summary: lines.join('\n'),
+    stack: stackNames[analysis.stack],
+    version: analysis.version,
+    port: analysis.port,
+    multiStage: analysis.hasBuild,
+    packageManager: analysis.packageManager || null,
+    framework: analysis.framework || null,
+    assumptions: analysis.assumptions || [],
+    securityChecks: securityNotes,
+  };
+}
+
+module.exports = { buildExplanation };

package/src/_engine/backend/src/modules/generation/composeGenerator.js

@@ -0,0 +1,318 @@
+// backend/src/modules/generation/composeGenerator.js
+// Takes the same analysisResult shape as generator.js.
+// Returns { compose: string, improvements: string[] }
+'use strict';
+
+// ── Infra detection patterns ──────────────────────────────────────────────────
+
+const INFRA_PATTERNS = {
+  postgres: [
+    'DATABASE_URL', 'POSTGRES_URL', 'POSTGRES_HOST', 'DB_HOST',
+    'DATABASE_HOST', 'POSTGRESQL_URL', 'PG_HOST', 'PGHOST',
+  ],
+  redis: [
+    'REDIS_URL', 'REDIS_HOST', 'REDIS_URI', 'REDIS_TLS_URL',
+  ],
+  mongo: [
+    'MONGO_URI', 'MONGODB_URI', 'MONGODB_URL', 'MONGO_URL', 'MONGO_HOST',
+  ],
+  rabbitmq: [
+    'RABBITMQ_URL', 'AMQP_URL', 'RABBITMQ_HOST',
+  ],
+};
+
+const INFRA_SERVICES = {
+  postgres: {
+    name: 'db',
+    image: 'postgres:16-alpine',
+    ports: ['5432:5432'],
+    environment: [
+      'POSTGRES_USER=${POSTGRES_USER:?POSTGRES_USER must be set}',
+      'POSTGRES_PASSWORD=${POSTGRES_PASSWORD:?POSTGRES_PASSWORD must be set}',
+      'POSTGRES_DB=${POSTGRES_DB:?POSTGRES_DB must be set}',
+    ],
+    volume: 'postgres_data:/var/lib/postgresql/data',
+    volumeName: 'postgres_data',
+    healthcheck: {
+      test: '["CMD-SHELL", "pg_isready -U postgres"]',
+      interval: '5s',
+      timeout: '5s',
+      retries: 5,
+    },
+  },
+  redis: {
+    name: 'redis',
+    image: 'redis:7-alpine',
+    ports: ['6379:6379'],
+    environment: [],
+    volume: 'redis_data:/data',
+    volumeName: 'redis_data',
+    healthcheck: {
+      test: '["CMD", "redis-cli", "ping"]',
+      interval: '5s',
+      timeout: '5s',
+      retries: 5,
+    },
+  },
+  mongo: {
+    name: 'mongo',
+    image: 'mongo:7',
+    ports: ['27017:27017'],
+    environment: [
+      'MONGO_INITDB_ROOT_USERNAME=${MONGO_INITDB_ROOT_USERNAME:?MONGO_INITDB_ROOT_USERNAME must be set}',
+      'MONGO_INITDB_ROOT_PASSWORD=${MONGO_INITDB_ROOT_PASSWORD:?MONGO_INITDB_ROOT_PASSWORD must be set}',
+    ],
+    volume: 'mongo_data:/data/db',
+    volumeName: 'mongo_data',
+    healthcheck: {
+      test: '["CMD", "mongosh", "--eval", "db.adminCommand(\'ping\')"]',
+      interval: '10s',
+      timeout: '5s',
+      retries: 5,
+    },
+  },
+  rabbitmq: {
+    name: 'rabbitmq',
+    image: 'rabbitmq:3-management-alpine',
+    ports: ['5672:5672', '15672:15672'],
+    environment: [
+      'RABBITMQ_DEFAULT_USER=${RABBITMQ_DEFAULT_USER:?RABBITMQ_DEFAULT_USER must be set}',
+      'RABBITMQ_DEFAULT_PASS=${RABBITMQ_DEFAULT_PASS:?RABBITMQ_DEFAULT_PASS must be set}',
+    ],
+    volume: 'rabbitmq_data:/var/lib/rabbitmq',
+    volumeName: 'rabbitmq_data',
+    healthcheck: {
+      test: '["CMD", "rabbitmq-diagnostics", "ping"]',
+      interval: '10s',
+      timeout: '5s',
+      retries: 5,
+    },
+  },
+};
+
+// ── Env var rewriting ─────────────────────────────────────────────────────────
+
+const INFRA_REWRITES = {
+  postgres: {
+    DATABASE_URL:      'postgresql://${POSTGRES_USER:?POSTGRES_USER must be set}:${POSTGRES_PASSWORD:?POSTGRES_PASSWORD must be set}@db:5432/${POSTGRES_DB:?POSTGRES_DB must be set}',
+    POSTGRES_URL:      'postgresql://${POSTGRES_USER:?POSTGRES_USER must be set}:${POSTGRES_PASSWORD:?POSTGRES_PASSWORD must be set}@db:5432/${POSTGRES_DB:?POSTGRES_DB must be set}',
+    POSTGRES_HOST:     'db',
+    DB_HOST:           'db',
+    DATABASE_HOST:     'db',
+    POSTGRESQL_URL:    'postgresql://${POSTGRES_USER:?POSTGRES_USER must be set}:${POSTGRES_PASSWORD:?POSTGRES_PASSWORD must be set}@db:5432/${POSTGRES_DB:?POSTGRES_DB must be set}',
+    PG_HOST:           'db',
+    PGHOST:            'db',
+    PGUSER:            '${POSTGRES_USER:?POSTGRES_USER must be set}',
+    PGPASSWORD:        '${POSTGRES_PASSWORD:?POSTGRES_PASSWORD must be set}',
+    PGDATABASE:        '${POSTGRES_DB:?POSTGRES_DB must be set}',
+    POSTGRES_USER:     '${POSTGRES_USER:?POSTGRES_USER must be set}',
+    POSTGRES_PASSWORD: '${POSTGRES_PASSWORD:?POSTGRES_PASSWORD must be set}',
+    POSTGRES_DB:       '${POSTGRES_DB:?POSTGRES_DB must be set}',
+  },
+  redis: {
+    REDIS_URL:     'redis://redis:6379',
+    REDIS_HOST:    'redis',
+    REDIS_URI:     'redis://redis:6379',
+    REDIS_TLS_URL: 'redis://redis:6379',
+    REDIS_PORT:    '6379',
+  },
+  mongo: {
+    MONGO_URI:                  'mongodb://${MONGO_INITDB_ROOT_USERNAME:?MONGO_INITDB_ROOT_USERNAME must be set}:${MONGO_INITDB_ROOT_PASSWORD:?MONGO_INITDB_ROOT_PASSWORD must be set}@mongo:27017/appdb',
+    MONGODB_URI:                'mongodb://${MONGO_INITDB_ROOT_USERNAME:?MONGO_INITDB_ROOT_USERNAME must be set}:${MONGO_INITDB_ROOT_PASSWORD:?MONGO_INITDB_ROOT_PASSWORD must be set}@mongo:27017/appdb',
+    MONGODB_URL:                'mongodb://${MONGO_INITDB_ROOT_USERNAME:?MONGO_INITDB_ROOT_USERNAME must be set}:${MONGO_INITDB_ROOT_PASSWORD:?MONGO_INITDB_ROOT_PASSWORD must be set}@mongo:27017/appdb',
+    MONGO_URL:                  'mongodb://${MONGO_INITDB_ROOT_USERNAME:?MONGO_INITDB_ROOT_USERNAME must be set}:${MONGO_INITDB_ROOT_PASSWORD:?MONGO_INITDB_ROOT_PASSWORD must be set}@mongo:27017/appdb',
+    MONGO_HOST:                 'mongo',
+    MONGO_INITDB_ROOT_USERNAME: '${MONGO_INITDB_ROOT_USERNAME:?MONGO_INITDB_ROOT_USERNAME must be set}',
+    MONGO_INITDB_ROOT_PASSWORD: '${MONGO_INITDB_ROOT_PASSWORD:?MONGO_INITDB_ROOT_PASSWORD must be set}',
+  },
+  rabbitmq: {
+    RABBITMQ_URL:  'amqp://${RABBITMQ_DEFAULT_USER:?RABBITMQ_DEFAULT_USER must be set}:${RABBITMQ_DEFAULT_PASS:?RABBITMQ_DEFAULT_PASS must be set}@rabbitmq:5672',
+    AMQP_URL:      'amqp://guest:guest@rabbitmq:5672',
+    RABBITMQ_HOST: 'rabbitmq',
+  },
+};
+
+// ── Infra detection ───────────────────────────────────────────────────────────
+
+/**
+ * @param {Array<{key: string}>} envVars
+ * @returns {Set<string>}
+ */
+function detectInfra(envVars) {
+  const found = new Set();
+  const keys = new Set(envVars.map(v => v.key));
+  for (const [type, patterns] of Object.entries(INFRA_PATTERNS)) {
+    if (patterns.some(p => keys.has(p))) {
+      found.add(type);
+    }
+  }
+  return found;
+}
+
+// ── YAML helpers ──────────────────────────────────────────────────────────────
+
+function indent(str, spaces) {
+  const pad = ' '.repeat(spaces);
+  return str.split('\n').map(l => (l.trim() === '' ? '' : pad + l)).join('\n');
+}
+
+function healthcheckBlock(hc) {
+  return [
+    `healthcheck:`,
+    `  test: ${hc.test}`,
+    `  interval: ${hc.interval}`,
+    `  timeout: ${hc.timeout}`,
+    `  retries: ${hc.retries}`,
+  ].join('\n');
+}
+
+// ── Rewrite env vars for a service ───────────────────────────────────────────
+
+function buildEnvLines(envVars, detectedInfra) {
+  const rewrites = {};
+  for (const type of detectedInfra) {
+    Object.assign(rewrites, INFRA_REWRITES[type]);
+  }
+
+  const lines = [];
+  lines.push('NODE_ENV=production');
+
+  for (const { key, value } of envVars) {
+    if (key === 'NODE_ENV') continue;
+    if (rewrites[key]) {
+      lines.push(`${key}=${rewrites[key]}`);
+    } else {
+      lines.push(`${key}=${value || ''}`);
+    }
+  }
+
+  return lines;
+}
+
+// ── Service name helpers ──────────────────────────────────────────────────────
+
+function serviceNameFromDir(serviceDir) {
+  if (!serviceDir || serviceDir === '.') return 'app';
+  return serviceDir.replace(/\//g, '-').replace(/[^a-z0-9-]/gi, '').toLowerCase();
+}
+
+// ── Main entry ────────────────────────────────────────────────────────────────
+
+/**
+ * @param {object} analysisResult — same shape returned by analyseProject
+ * @returns {{ compose: string, improvements: string[] }}
+ */
+function generateCompose({ services, envVars = [], sharedDirs = [] }) {
+  const improvements = [];
+  const detectedInfra = detectInfra(envVars);
+
+  const appServiceBlocks = [];
+  const infraDependencies = [...detectedInfra].map(t => INFRA_SERVICES[t].name);
+
+  for (const svc of services) {
+    const name = serviceNameFromDir(svc.serviceDir);
+
+    const envLines = buildEnvLines(envVars, detectedInfra);
+
+    const lines = [
+      `${name}:`,
+      `  build:`,
+      `    context: .`,
+      `    dockerfile: Dockerfile`,
+    ];
+
+    lines.push(`  ports:`);
+    lines.push(`    - "${svc.port}:${svc.port}"`);
+
+    if (envLines.length > 0) {
+      lines.push(`  environment:`);
+      for (const l of envLines) {
+        lines.push(`    - ${l}`);
+      }
+    }
+
+    if (infraDependencies.length > 0) {
+      lines.push(`  depends_on:`);
+      for (const dep of infraDependencies) {
+        lines.push(`    ${dep}:`);
+        lines.push(`      condition: service_healthy`);
+      }
+    }
+
+    lines.push(`  networks:`);
+    lines.push(`    - app-network`);
+    lines.push(`  restart: unless-stopped`);
+
+    appServiceBlocks.push(lines.join('\n'));
+  }
+
+  const infraServiceBlocks = [];
+  const volumeNames = [];
+
+  for (const type of detectedInfra) {
+    const cfg = INFRA_SERVICES[type];
+    const lines = [
+      `${cfg.name}:`,
+      `  image: ${cfg.image}`,
+    ];
+
+    if (cfg.ports.length > 0) {
+      lines.push(`  ports:`);
+      for (const p of cfg.ports) {
+        lines.push(`    - "${p}"`);
+      }
+    }
+
+    if (cfg.environment.length > 0) {
+      lines.push(`  environment:`);
+      for (const e of cfg.environment) {
+        lines.push(`    - ${e}`);
+      }
+    }
+
+    lines.push(`  volumes:`);
+    lines.push(`    - ${cfg.volume}`);
+    lines.push(indent(healthcheckBlock(cfg.healthcheck), 2));
+    lines.push(`  networks:`);
+    lines.push(`    - app-network`);
+    lines.push(`  restart: unless-stopped`);
+
+    infraServiceBlocks.push(lines.join('\n'));
+    volumeNames.push(cfg.volumeName);
+  }
+
+  const allBlocks = [...appServiceBlocks, ...infraServiceBlocks];
+
+  let yaml = `# Generated by Dockerforge — https://containerise.dev\n`;
+  yaml += `# Run: docker compose up --build\n\n`;
+  yaml += `services:\n`;
+  for (const block of allBlocks) {
+    yaml += indent(block, 2) + '\n\n';
+  }
+
+  yaml += `networks:\n`;
+  yaml += `  app-network:\n`;
+  yaml += `    driver: bridge\n`;
+
+  if (volumeNames.length > 0) {
+    yaml += `\nvolumes:\n`;
+    for (const v of volumeNames) {
+      yaml += `  ${v}:\n`;
+    }
+  }
+
+  if (detectedInfra.size > 0) {
+    improvements.push(`Detected infra from env vars: ${[...detectedInfra].join(', ')} — added as Compose services with healthchecks`);
+  }
+  if (envVars.some(v => !v.hasDefault)) {
+    improvements.push('Some env vars have no default value — fill them in docker-compose.yml before running');
+  }
+  improvements.push('For production, replace build: with image: tags pointing at your registry');
+  if (services.some(s => s.role === 'frontend')) {
+    improvements.push('Frontend service: consider adding a reverse proxy (nginx) to route traffic in production');
+  }
+
+  return { compose: yaml.trim(), improvements };
+}
+
+module.exports = { generateCompose, detectInfra };