@isomorph.ai/cli 0.2.0

package/dist/src/analyzer.js

@@ -0,0 +1,685 @@
+import { createHash } from "node:crypto";
+import { spawnSync } from "node:child_process";
+import { existsSync } from "node:fs";
+import { lstat, readFile, readdir, stat } from "node:fs/promises";
+import { basename, dirname, join, relative } from "node:path";
+import { sha256 } from "./digest.js";
+import { isEnvExamplePath, isKitCommittedPath, isSourceIntakeExcludedPath } from "./secret-paths.js";
+const ANALYZER_VERSION = "0.1.0";
+const MAX_FILES = 600;
+const MAX_FILE_BYTES = 256_000;
+// The pipeline's own receipts and derived artifacts (`.harbour/`, written into
+// the workspace and the published lineage) are control-plane artifacts, not
+// application files. Keeping them out also makes reruns idempotent after a
+// previous save has written a receipt into the selected workspace.
+const IGNORED_DIRS = new Set([".git", ".harbour", ".isomorph", ".next", ".nuxt", ".svelte-kit", ".turbo", "coverage", "dist", "build", "node_modules", "vendor"]);
+/** The development kit's directory. It commits its declaration, lock, governed-AI inventory and journey checks there (see `isKitCommittedPath`); everything else in it (local state, checks evidence, generated control files) stays out of the package. The inventory is what the pipeline plans a kit app's AI over (data plane 0.78.2.0): the gate writes it under `isomorph check`, the lane refuses an app whose source calls governed AI without it. */
+const KIT_DIR = ".isomorph";
+const KIT_CONTROL_FILES = [`${KIT_DIR}/integrations.json`, `${KIT_DIR}/kit.lock.json`, `${KIT_DIR}/ai-inventory.json`];
+const KIT_CHECKS_DIR = `${KIT_DIR}/checks`;
+const SECRET_FILE_NAMES = new Set([".env", ".env.local", ".env.production", ".env.development", ".npmrc"]);
+const TEXT_EXTENSIONS = new Set([".js", ".jsx", ".ts", ".tsx", ".mjs", ".cjs", ".json", ".html", ".css", ".py", ".rb", ".go", ".rs", ".java", ".cs", ".php", ".md", ".toml", ".yaml", ".yml", ".sh"]);
+function normalizeIncludePath(value) {
+    if (!value || value === ".")
+        return "";
+    if (value.startsWith("/") || value.startsWith("\\") || /^[A-Za-z]:[\\/]/.test(value))
+        throw new Error("ANALYZER_INCLUDE_INVALID: include paths must be relative to the selected app root.");
+    const parts = value.split(/[\\/]+/).filter(Boolean);
+    if (parts.some(part => part === "." || part === ".."))
+        throw new Error("ANALYZER_INCLUDE_INVALID: include paths may not contain traversal segments.");
+    return parts.join("/");
+}
+async function collectIncludedFiles(root, includePaths, output, unknowns) {
+    const normalized = [...new Set(includePaths.map(normalizeIncludePath))];
+    for (const include of normalized) {
+        if (include.split("/").some(part => IGNORED_DIRS.has(part)) && !isKitCommittedPath(include))
+            continue;
+        const absolute = include ? join(root, ...include.split("/")) : root;
+        let info;
+        try {
+            info = await lstat(absolute);
+        }
+        catch {
+            throw new Error(`ANALYZER_INCLUDE_MISSING: include path does not exist: ${include || "."}`);
+        }
+        if (info.isSymbolicLink())
+            throw new Error(`ANALYZER_INCLUDE_UNSAFE: symlink include path is not allowed: ${include || "."}`);
+        if (!info.isFile() && !info.isDirectory())
+            throw new Error(`ANALYZER_INCLUDE_UNSAFE: include path is not a file or directory: ${include}`);
+        let current = root;
+        for (const part of include.split("/").filter(Boolean)) {
+            current = join(current, part);
+            const component = await lstat(current);
+            if (component.isSymbolicLink())
+                throw new Error(`ANALYZER_INCLUDE_UNSAFE: symlink path component is not allowed: ${include}`);
+        }
+        if (info.isDirectory())
+            await collectFiles(root, absolute, output, unknowns);
+        else
+            await collectFile(root, absolute, output);
+    }
+}
+function extension(path) {
+    const index = path.lastIndexOf(".");
+    return index >= 0 ? path.slice(index) : "";
+}
+async function collectFiles(root, current, output, unknowns) {
+    if (output.length >= MAX_FILES)
+        return;
+    const entries = await readdir(current, { withFileTypes: true });
+    for (const entry of entries.sort((a, b) => a.name.localeCompare(b.name))) {
+        if (output.length >= MAX_FILES) {
+            unknowns.push(`file limit reached at ${MAX_FILES} files`);
+            return;
+        }
+        // A linked worktree represents .git as a small pointer file rather than a
+        // directory. It is Git metadata and must stay outside the app boundary in
+        // both checkout layouts.
+        if (entry.name === ".git")
+            continue;
+        if (entry.isDirectory()) {
+            if (!IGNORED_DIRS.has(entry.name))
+                await collectFiles(root, join(current, entry.name), output, unknowns);
+            else if (entry.name === KIT_DIR && current === root)
+                await collectKitFiles(root, output);
+            continue;
+        }
+        if (!entry.isFile())
+            continue;
+        await collectFile(root, join(current, entry.name), output);
+    }
+}
+async function collectKitFiles(root, output) {
+    const paths = [...KIT_CONTROL_FILES];
+    let checks = [];
+    try {
+        checks = await readdir(join(root, ...KIT_CHECKS_DIR.split("/")), { withFileTypes: true });
+    }
+    catch {
+        checks = [];
+    }
+    for (const entry of checks) {
+        const path = `${KIT_CHECKS_DIR}/${entry.name}`;
+        if (isKitCommittedPath(path))
+            paths.push(path);
+    }
+    for (const path of paths.sort()) {
+        const absolute = join(root, ...path.split("/"));
+        let info;
+        try {
+            info = await lstat(absolute);
+        }
+        catch {
+            continue;
+        }
+        if (info.isFile() && !info.isSymbolicLink())
+            await collectFile(root, absolute, output);
+    }
+}
+async function collectFile(root, absolute, output) {
+    const path = relative(root, absolute);
+    if (output.some(file => file.path === path))
+        return;
+    const info = await lstat(absolute);
+    if (!info.isFile() || info.isSymbolicLink())
+        throw new Error("ANALYZER_FILE_UNSAFE: selected app file changed or is not a regular file.");
+    const name = basename(absolute);
+    const fact = { path, basename: name, size: info.size };
+    // Env templates and extensionless shell-context files (Dockerfile, Procfile)
+    // carry env-name evidence; without content they can never produce an ask.
+    const safeExtensionless = isEnvTemplateFile(name) || isShellContextFile(name);
+    if (!SECRET_FILE_NAMES.has(name) && info.size <= MAX_FILE_BYTES && (TEXT_EXTENSIONS.has(extension(name)) || safeExtensionless)) {
+        fact.content = await readFile(absolute, "utf8");
+    }
+    output.push(fact);
+}
+function unique(values) {
+    return [...new Set(values.filter(Boolean))].sort();
+}
+function parsePackageJson(files) {
+    const packageFile = files.find(file => file.path === "package.json" && file.content);
+    const dependencies = [];
+    const scripts = {};
+    if (packageFile?.content) {
+        const parsed = JSON.parse(packageFile.content);
+        dependencies.push(...Object.keys(parsed.dependencies ?? {}), ...Object.keys(parsed.devDependencies ?? {}));
+        Object.assign(scripts, parsed.scripts ?? {});
+        if (parsed.packageManager)
+            dependencies.push(parsed.packageManager.split("@")[0] ?? "");
+    }
+    const packageManagers = unique([
+        files.some(file => file.basename === "package-lock.json") ? "npm" : "",
+        files.some(file => file.basename === "pnpm-lock.yaml") ? "pnpm" : "",
+        files.some(file => file.basename === "yarn.lock") ? "yarn" : "",
+        files.some(file => file.basename === "bun.lockb" || file.basename === "bun.lock") ? "bun" : "",
+        packageFile ? "npm" : ""
+    ]);
+    return { dependencies: unique(dependencies), scripts, packageManagers };
+}
+function detectFramework(dependencies, files) {
+    const deps = new Set(dependencies);
+    if (deps.has("next"))
+        return "nextjs";
+    if (deps.has("@remix-run/react"))
+        return "remix";
+    if (deps.has("@sveltejs/kit"))
+        return "sveltekit";
+    if (deps.has("astro"))
+        return "astro";
+    if (deps.has("vite"))
+        return "vite";
+    if (deps.has("react"))
+        return "react";
+    if (deps.has("express"))
+        return "express";
+    if (files.some(file => file.basename === "requirements.txt" || file.basename === "pyproject.toml"))
+        return "python";
+    return "unknown";
+}
+function detectComponents(framework, dependencies, files) {
+    const deps = new Set(dependencies);
+    const entries = files.map(file => file.path);
+    const components = [];
+    const frontendEntries = entries.filter(path => /^(src|app|pages)\//.test(path) && /\.(tsx|jsx|ts|js|html)$/.test(path)).slice(0, 12);
+    const backendEntries = entries.filter(path => /^(server|api|src\/server|functions)\//.test(path) && /\.(ts|js|mjs|cjs)$/.test(path)).slice(0, 12);
+    if (frontendEntries.length || ["vite", "nextjs", "react", "remix", "sveltekit", "astro"].includes(framework)) {
+        components.push({
+            componentId: "web-frontend",
+            kind: framework === "nextjs" || framework === "remix" ? "SSR_FRONTEND" : "STATIC_FRONTEND",
+            runtime: deps.has("vite") || deps.has("react") || deps.has("next") ? "node" : "unknown",
+            framework,
+            entrypoints: frontendEntries.length ? frontendEntries : ["package.json"]
+        });
+    }
+    if (backendEntries.length || deps.has("express") || deps.has("fastify") || deps.has("hono")) {
+        components.push({
+            componentId: "http-backend",
+            kind: "HTTP_BACKEND",
+            runtime: "node",
+            framework: deps.has("express") ? "express" : deps.has("fastify") ? "fastify" : deps.has("hono") ? "hono" : "unknown",
+            entrypoints: backendEntries.length ? backendEntries : ["package.json"]
+        });
+    }
+    return components.length ? components : [{ componentId: "app", kind: "UNKNOWN", runtime: "unknown", framework, entrypoints: entries.slice(0, 8) }];
+}
+function detectCapabilities(files, dependencies) {
+    const corpus = `${dependencies.join("\n")}\n${files.map(file => `${file.path}\n${file.content ?? ""}`).join("\n")}`;
+    const capabilities = [];
+    if (/auth|oauth|oidc|saml|next-auth|passport|clerk|auth0|supabase/i.test(corpus)) {
+        capabilities.push({ kind: "IDENTITY", providerHint: "existing-auth-code", usage: "Authentication or identity dependency/code detected" });
+    }
+    if (/postgres|mysql|sqlite|prisma|drizzle|sequelize|mongoose|mongodb|redis/i.test(corpus)) {
+        capabilities.push({ kind: "RELATIONAL_DATA", usage: "Database dependency or connection pattern detected" });
+    }
+    if (/s3|blob|bucket|r2|storage/i.test(corpus)) {
+        capabilities.push({ kind: "OBJECT_STORAGE", usage: "Object storage dependency or naming pattern detected" });
+    }
+    if (/openai|anthropic|gemini|model|llm/i.test(corpus)) {
+        capabilities.push({ kind: "MODEL_ENDPOINT", usage: "Model endpoint dependency or naming pattern detected" });
+    }
+    if (/api[_-]?key|fetch\(|axios|external/i.test(corpus)) {
+        capabilities.push({ kind: "EXTERNAL_API", usage: "External API call or credential name pattern detected" });
+    }
+    if (/process\.env|import\.meta\.env|Deno\.env/i.test(corpus)) {
+        capabilities.push({ kind: "SECRETS", usage: "Environment-variable based configuration detected" });
+    }
+    return capabilities;
+}
+/** Env-access idioms recognized in any retained text file. Names only —
+ * capture groups never span a value. */
+const ENV_ACCESS_PATTERNS = [
+    // JS/TS dot access and Deno (original rule).
+    /(?:process\.env\.|import\.meta\.env\.|Deno\.env\.get\(["'])([A-Z0-9_]{3,})/g,
+    // JS/TS bracket access.
+    /(?:process\.env|import\.meta\.env)\[["']([A-Z0-9_]{3,})["']\]/g,
+    // Python: os.environ["X"], os.environ.get("X").
+    /\bos\.environ(?:\.get\(\s*|\[)["']([A-Z0-9_]{3,})["']/g,
+    // Go: os.Getenv("X"), os.LookupEnv("X").
+    /\bos\.(?:Getenv|LookupEnv)\(\s*"([A-Z0-9_]{3,})"/g,
+    // Ruby: ENV["X"], ENV.fetch("X").
+    /\bENV(?:\.fetch\(\s*|\[)["']([A-Z0-9_]{3,})["']/g,
+    // Java System.getenv, PHP/C getenv, Python os.getenv — all end in getenv(.
+    /\bgetenv\(\s*["']([A-Z0-9_]{3,})["']/g
+];
+/** Shell parameter expansion: ${X}, ${X:-default}, bare $X. Only applied to
+ * shell-context content (see isShellContextFile) — `${X}` in prose or make
+ * syntax must never become a builder ask. */
+const SHELL_EXPANSION_PATTERN = /\$(?:\{([A-Z0-9_]{3,})(?::?[-=+?][^}]*)?\}|([A-Z0-9_]{3,})\b)/g;
+function isEnvTemplateFile(basename) {
+    return isEnvExamplePath(basename);
+}
+/** Files whose content is shell-like end to end. Markdown and source files are
+ * deliberately absent; Makefiles too (`${X}` there is make-variable syntax). */
+function isShellContextFile(basename) {
+    if (basename === "Dockerfile" || basename.startsWith("Dockerfile."))
+        return true;
+    if (basename === "Procfile")
+        return true;
+    if (basename.endsWith(".sh"))
+        return true;
+    return /^(?:docker-)?compose[^/]*\.ya?ml$/.test(basename);
+}
+function pushMatches(content, pattern, names) {
+    for (const match of content.matchAll(pattern)) {
+        names.push(match[1] ?? match[2] ?? "");
+    }
+}
+function detectEnvNames(files) {
+    const names = [];
+    for (const file of files) {
+        const content = file.content ?? "";
+        for (const pattern of ENV_ACCESS_PATTERNS)
+            pushMatches(content, pattern, names);
+        if (isShellContextFile(file.basename))
+            pushMatches(content, SHELL_EXPANSION_PATTERN, names);
+        // package.json scripts run in a shell; expansion applies to the script
+        // strings alone, never to the raw JSON (dependency names, config values).
+        if (file.basename === "package.json") {
+            try {
+                const scripts = JSON.parse(content).scripts ?? {};
+                for (const value of Object.values(scripts)) {
+                    if (typeof value === "string")
+                        pushMatches(value, SHELL_EXPANSION_PATTERN, names);
+                }
+            }
+            catch { /* Invalid manifests contribute no names. */ }
+        }
+        if (isEnvTemplateFile(file.basename)) {
+            for (const line of content.split(/\r?\n/)) {
+                const envMatch = /^([A-Z0-9_]{3,})=/.exec(line.trim());
+                if (envMatch)
+                    names.push(envMatch[1] ?? "");
+            }
+        }
+    }
+    return unique(names);
+}
+function detectTestCommands(scripts) {
+    return unique([
+        scripts.test ? "npm test" : "",
+        scripts.check ? "npm run check" : "",
+        scripts.lint ? "npm run lint" : ""
+    ]);
+}
+function detectDeployCommands(scripts) {
+    return unique([
+        scripts.build ? "npm run build" : "",
+        scripts.start ? "npm start" : "",
+        scripts.dev ? "npm run dev" : "",
+        scripts.preview ? "npm run preview" : "",
+        scripts.deploy ? "npm run deploy" : ""
+    ]);
+}
+async function detectGitSource(root, fingerprint, options, includedFiles) {
+    const gitRoot = options.sourceBoundary === "root"
+        ? (existsSync(join(root, ".git")) ? root : undefined)
+        : findGitRoot(root);
+    if (!gitRoot || !allDeployableFilesTracked(gitRoot, root, includedFiles)) {
+        const source = {
+            schema: "isomorph.source-ref/1.0",
+            kind: "unversioned_workspace",
+            locator: options.sourceLocator ?? `workspace://${basename(root)}`,
+            revision: fingerprint,
+            recoverable: false
+        };
+        if (options.sourceProvider)
+            source.provider = options.sourceProvider;
+        return source;
+    }
+    const gitDir = await resolveGitDir(gitRoot);
+    const headPath = join(gitDir, "HEAD");
+    let revision = fingerprint;
+    let locator = options.sourceLocator ?? await readFirstRemoteUrl(gitRoot) ?? `git://${basename(gitRoot)}`;
+    try {
+        const head = (await readFile(headPath, "utf8")).trim();
+        if (head.startsWith("ref:")) {
+            const ref = head.replace("ref:", "").trim();
+            const commit = await readFile(join(gitDir, ref), "utf8").then(value => value.trim()).catch(() => "");
+            revision = commit ? `${commit}@${fingerprint}` : `${ref}@${fingerprint}`;
+        }
+        else {
+            revision = `${head}@${fingerprint}`;
+        }
+    }
+    catch {
+        revision = fingerprint;
+    }
+    const source = {
+        schema: "isomorph.source-ref/1.0",
+        kind: "connected_repository",
+        locator,
+        revision,
+        recoverable: true
+    };
+    source.provider = options.sourceProvider ?? detectGitProvider(locator);
+    return source;
+}
+function allDeployableFilesTracked(gitRoot, appRoot, includedFiles) {
+    if (includedFiles.length === 0)
+        return false;
+    const appPathFromGitRoot = relative(gitRoot, appRoot);
+    const tracked = spawnSync("git", ["-C", gitRoot, "ls-files", "--", appPathFromGitRoot || "."], {
+        encoding: "utf8"
+    });
+    if (tracked.status !== 0)
+        return false;
+    const trackedPaths = new Set(tracked.stdout.split(/\r?\n/).filter(Boolean));
+    return includedFiles.every(file => {
+        const repoRelativePath = appPathFromGitRoot ? join(appPathFromGitRoot, file) : file;
+        return trackedPaths.has(repoRelativePath);
+    });
+}
+function findGitRoot(start) {
+    let current = start;
+    while (true) {
+        if (existsSync(join(current, ".git")))
+            return current;
+        const parent = dirname(current);
+        if (parent === current)
+            return undefined;
+        current = parent;
+    }
+}
+async function resolveGitDir(gitRoot) {
+    const dotGit = join(gitRoot, ".git");
+    const info = await stat(dotGit);
+    if (info.isDirectory())
+        return dotGit;
+    const content = await readFile(dotGit, "utf8");
+    const match = /^gitdir:\s*(.+)$/m.exec(content);
+    if (!match?.[1])
+        return dotGit;
+    const gitDir = match[1];
+    return gitDir.startsWith("/") ? gitDir : join(gitRoot, gitDir);
+}
+async function readFirstRemoteUrl(gitRoot) {
+    try {
+        const config = await readFile(join(await resolveGitDir(gitRoot), "config"), "utf8");
+        const match = /\[remote "origin"\][\s\S]*?\n\s*url = (.+)/.exec(config) ?? /\[remote "[^"]+"\][\s\S]*?\n\s*url = (.+)/.exec(config);
+        return match?.[1]?.trim();
+    }
+    catch {
+        return undefined;
+    }
+}
+function detectGitProvider(locator) {
+    if (/^(https:\/\/|git@)github\.com[:/]/i.test(locator) || /\/\/github\.com\//i.test(locator))
+        return "github";
+    if (/^(https:\/\/|git@)gitlab\.com[:/]/i.test(locator) || /\/\/gitlab\.com\//i.test(locator))
+        return "gitlab";
+    if (/^(https:\/\/|git@)bitbucket\.org[:/]/i.test(locator) || /\/\/bitbucket\.org\//i.test(locator))
+        return "bitbucket";
+    return "git";
+}
+const MANIFEST_DRIVER_MAP = {
+    pg: "postgres",
+    postgres: "postgres",
+    mssql: "sqlserver",
+    tedious: "sqlserver",
+    "snowflake-sdk": "snowflake",
+    "@google-cloud/bigquery": "bigquery",
+    "@databricks/sql": "databricks",
+    mysql: "mysql",
+    mysql2: "mysql",
+    mongodb: "mongodb",
+    redis: "redis",
+    ioredis: "redis",
+    "@supabase/supabase-js": "supabase"
+};
+const CONNECTION_SCHEME_DRIVERS = {
+    postgres: "postgres",
+    postgresql: "postgres",
+    mysql: "mysql",
+    mongodb: "mongodb",
+    "mongodb+srv": "mongodb",
+    redis: "redis",
+    rediss: "redis"
+};
+const JDBC_SCHEME_DRIVERS = {
+    postgresql: "postgres",
+    sqlserver: "sqlserver",
+    snowflake: "snowflake",
+    mysql: "mysql",
+    bigquery: "bigquery",
+    databricks: "databricks"
+};
+/**
+ * Drivers whose service endpoint is a single fixed global host. Only a driver
+ * that can never point anywhere else belongs here: a BigQuery client names no
+ * host in code or config, so without this its dependency would carry no host
+ * at all, and a hostless dependency is dropped before it ever reaches the
+ * registry — the source could never be matched and the app would deploy with
+ * no grant and no credential.
+ */
+const WELL_KNOWN_DRIVER_HOSTS = {
+    bigquery: "bigquery.googleapis.com"
+};
+const DRIVER_BY_WELL_KNOWN_HOST = Object.fromEntries(Object.entries(WELL_KNOWN_DRIVER_HOSTS).map(([driver, host]) => [host, driver]));
+const CONNECTION_STRING_PATTERN = /\b(postgres(?:ql)?|mysql|mongodb(?:\+srv)?|rediss?):\/\/([^\s"'`<>\\]+)/gi;
+const JDBC_PATTERN = /\bjdbc:([a-z0-9]+):\/\/([^\s"'`<>\\]+)/gi;
+const HTTP_URL_PATTERN = /\bhttps?:\/\/([a-z0-9][a-z0-9.-]*\.[a-z]{2,})(?::\d+)?(?=[/"'`\s?#),;]|$)/gi;
+const BARE_HOSTNAME_PATTERN = /^[a-z0-9][a-z0-9.-]*\.[a-z]{2,}(?::\d+)?$/i;
+function isEnvExampleFile(path) {
+    return isEnvExamplePath(path);
+}
+/** Extract the hostname from a connection-string authority, discarding any
+ * credentials, port, path, or query. Never returns secret material. */
+function hostFromAuthority(authority) {
+    const withoutCredentials = authority.split("@").pop() ?? "";
+    const host = withoutCredentials.split(/[/:?#,]/)[0] ?? "";
+    return /^[a-z0-9][a-z0-9.-]*$/i.test(host) ? host.toLowerCase() : undefined;
+}
+function detectManifestDrivers(files) {
+    const drivers = new Set();
+    for (const file of files) {
+        const name = file.path.split("/").pop() ?? file.path;
+        if (!file.content)
+            continue;
+        if (name === "package.json") {
+            try {
+                const parsed = JSON.parse(file.content);
+                for (const dependency of [...Object.keys(parsed.dependencies ?? {}), ...Object.keys(parsed.devDependencies ?? {})]) {
+                    const driver = MANIFEST_DRIVER_MAP[dependency.toLowerCase()];
+                    if (driver)
+                        drivers.add(driver);
+                }
+            }
+            catch {
+                // Malformed manifest: skip, extraction stays best-effort.
+            }
+        }
+        else if (name === "requirements.txt") {
+            for (const line of file.content.split(/\r?\n/)) {
+                const requirement = line.trim().split(/[=<>!~\[;\s]/)[0]?.toLowerCase() ?? "";
+                const driver = MANIFEST_DRIVER_MAP[requirement];
+                if (driver)
+                    drivers.add(driver);
+            }
+        }
+    }
+    return drivers;
+}
+function recordHost(hosts, host, driver, envName) {
+    const existing = hosts.get(host) ?? { host, driver: undefined, envNames: new Set() };
+    if (driver && !existing.driver)
+        existing.driver = driver;
+    if (envName)
+        existing.envNames.add(envName);
+    hosts.set(host, existing);
+}
+/** Scan one text fragment for connection strings, JDBC URLs, and http(s)
+ * base URLs, recording hostnames (never credentials or secret values). */
+function scanFragmentForHosts(hosts, fragment, envName) {
+    for (const match of fragment.matchAll(CONNECTION_STRING_PATTERN)) {
+        const driver = CONNECTION_SCHEME_DRIVERS[(match[1] ?? "").toLowerCase()];
+        const host = hostFromAuthority(match[2] ?? "");
+        if (host)
+            recordHost(hosts, host, driver, envName);
+    }
+    for (const match of fragment.matchAll(JDBC_PATTERN)) {
+        const driver = JDBC_SCHEME_DRIVERS[(match[1] ?? "").toLowerCase()];
+        const host = hostFromAuthority(match[2] ?? "");
+        if (host)
+            recordHost(hosts, host, driver, envName);
+    }
+    for (const match of fragment.matchAll(HTTP_URL_PATTERN)) {
+        const host = (match[1] ?? "").toLowerCase();
+        if (host)
+            recordHost(hosts, host, undefined, envName);
+    }
+}
+export function extractDataDependencies(files, declared) {
+    const drivers = detectManifestDrivers(files);
+    const hosts = new Map();
+    for (const file of files) {
+        const content = file.content;
+        if (!content)
+            continue;
+        if (isEnvExampleFile(file.path)) {
+            // Env-example files associate the env var NAME with any hostname found
+            // in its value. Values that are not hostnames/URLs are never emitted.
+            for (const line of content.split(/\r?\n/)) {
+                const envMatch = /^([A-Z0-9_]{3,})=(.*)$/.exec(line.trim());
+                if (!envMatch)
+                    continue;
+                const [, envName, value] = envMatch;
+                const trimmed = (value ?? "").trim().replace(/^["']|["']$/g, "");
+                scanFragmentForHosts(hosts, trimmed, envName);
+                if (BARE_HOSTNAME_PATTERN.test(trimmed)) {
+                    const host = hostFromAuthority(trimmed);
+                    if (host)
+                        recordHost(hosts, host, undefined, envName);
+                }
+            }
+        }
+        else {
+            scanFragmentForHosts(hosts, content, undefined);
+        }
+    }
+    // Classify each host: database when a DB driver or DB connection-string
+    // scheme is implicated for that host, otherwise api. Supabase hosts count
+    // as database when the supabase client library is a declared dependency.
+    const databaseByDriver = new Map();
+    const apiHosts = [];
+    for (const detected of hosts.values()) {
+        let driver = detected.driver;
+        if (!driver && drivers.has("supabase") && /\.supabase\.(?:co|in)$/i.test(detected.host))
+            driver = "supabase";
+        // A well-known service host counts as that driver's host once the client
+        // library is a declared dependency, so the env names sitting beside it
+        // (the credential, the project) ride along as database identifiers rather
+        // than being filed as an unrelated API endpoint.
+        if (!driver) {
+            const wellKnown = DRIVER_BY_WELL_KNOWN_HOST[detected.host.toLowerCase()];
+            if (wellKnown && drivers.has(wellKnown))
+                driver = wellKnown;
+        }
+        if (driver) {
+            const group = databaseByDriver.get(driver) ?? { hosts: new Set(), envNames: new Set() };
+            group.hosts.add(detected.host);
+            for (const envName of detected.envNames)
+                group.envNames.add(envName);
+            databaseByDriver.set(driver, group);
+        }
+        else {
+            apiHosts.push(detected);
+        }
+    }
+    // Manifest drivers with no host still surface as a database entry, carrying
+    // the driver's fixed service host where it has one.
+    for (const driver of drivers) {
+        if (databaseByDriver.has(driver))
+            continue;
+        const wellKnownHost = WELL_KNOWN_DRIVER_HOSTS[driver];
+        databaseByDriver.set(driver, {
+            hosts: new Set(wellKnownHost ? [wellKnownHost] : []),
+            envNames: new Set()
+        });
+    }
+    const detectedEntries = [];
+    for (const [driver, group] of [...databaseByDriver.entries()].sort(([a], [b]) => a.localeCompare(b))) {
+        detectedEntries.push({ kind: "database", identifiers: { hosts: [...group.hosts].sort(), driver, envNames: [...group.envNames].sort() }, origin: "detected" });
+    }
+    for (const detected of apiHosts.sort((a, b) => a.host.localeCompare(b.host))) {
+        detectedEntries.push({ kind: "api", identifiers: { hosts: [detected.host], envNames: [...detected.envNames].sort() }, origin: "detected" });
+    }
+    // Merge declared entries: declared wins on host collision; origin stays
+    // faithful to what the caller supplied (defaulting to "declared").
+    const declaredEntries = (declared ?? []).map(entry => ({
+        kind: entry.kind,
+        identifiers: {
+            hosts: [...new Set(entry.identifiers.hosts.map(host => host.toLowerCase()))].sort(),
+            ...(entry.identifiers.driver ? { driver: entry.identifiers.driver } : {}),
+            envNames: [...new Set(entry.identifiers.envNames)].sort()
+        },
+        origin: entry.origin ?? "declared"
+    }));
+    const declaredHosts = new Set(declaredEntries.flatMap(entry => entry.identifiers.hosts));
+    const merged = [...declaredEntries];
+    for (const entry of detectedEntries) {
+        const hadHosts = entry.identifiers.hosts.length > 0;
+        const survivingHosts = entry.identifiers.hosts.filter(host => !declaredHosts.has(host));
+        if (hadHosts && survivingHosts.length === 0)
+            continue;
+        merged.push({ ...entry, identifiers: { ...entry.identifiers, hosts: survivingHosts } });
+    }
+    return merged;
+}
+/** Additive export: run the analyzer's existing env-name detection over an
+ * in-memory {path, content} file list (e.g. files unpacked from an upload). */
+export function detectEnvironmentVariableNames(files) {
+    return detectEnvNames(files.map(file => ({
+        path: file.path,
+        basename: file.path.split("/").pop() ?? file.path,
+        size: file.content?.length ?? 0,
+        ...(file.content !== undefined ? { content: file.content } : {})
+    })));
+}
+export async function scanWorkspace(root, options = {}) {
+    const rootInfo = await lstat(root);
+    if (rootInfo.isSymbolicLink() || !rootInfo.isDirectory())
+        throw new Error("ANALYZER_ROOT_INVALID: selected app root must be a real directory.");
+    const unknowns = [];
+    const files = [];
+    if (options.includePaths?.length)
+        await collectIncludedFiles(root, options.includePaths, files, unknowns);
+    else
+        await collectFiles(root, root, files, unknowns);
+    const scopedFiles = files.sort((a, b) => a.path.localeCompare(b.path));
+    if (options.includePaths?.length && scopedFiles.length === 0)
+        throw new Error("ANALYZER_INCLUDE_EMPTY: the declared include paths contain no eligible files.");
+    const fingerprintInput = scopedFiles.map(file => `${file.path}:${file.size}:${file.content ? createHash("sha256").update(file.content).digest("hex") : "unread"}`).join("\n");
+    const workspaceFingerprint = await sha256(fingerprintInput);
+    const { dependencies, scripts, packageManagers } = parsePackageJson(scopedFiles);
+    const framework = detectFramework(dependencies, scopedFiles);
+    // Secret-bearing files remain visible only in the exclusion policy. They
+    // must never be part of the deployable/source-control file boundary.
+    const includedFiles = scopedFiles
+        .filter(file => !SECRET_FILE_NAMES.has(file.basename) && !isSourceIntakeExcludedPath(file.path))
+        .map(file => file.path)
+        .sort();
+    const graphWithoutDigest = {
+        schema: "isomorph.application-graph/1.0",
+        workspaceFingerprint,
+        source: await detectGitSource(root, workspaceFingerprint, options, includedFiles),
+        deploymentScope: {
+            appRoot: basename(root),
+            includedFiles,
+            excludedDirectories: [...IGNORED_DIRS].sort(),
+            excludedSecretFiles: [...SECRET_FILE_NAMES].sort(),
+            deployCommands: detectDeployCommands(scripts)
+        },
+        components: detectComponents(framework, dependencies, scopedFiles),
+        capabilities: detectCapabilities(scopedFiles, dependencies),
+        packageManagers,
+        dependencyNames: dependencies,
+        environmentVariableNames: detectEnvNames(scopedFiles),
+        testCommands: detectTestCommands(scripts),
+        analysis: {
+            analyzerVersion: ANALYZER_VERSION,
+            coverage: unknowns.length ? "PARTIAL" : "COMPLETE_FOR_SUPPORTED_MANIFESTS",
+            unknowns
+        }
+    };
+    return { ...graphWithoutDigest, graphDigest: await sha256(graphWithoutDigest) };
+}