@massu/core 1.5.0 → 1.5.1

package/src/detect/manifest-registry.ts

@@ -0,0 +1,261 @@
+// Copyright (c) 2026 Massu. All rights reserved.
+// Licensed under BSL 1.1 - see LICENSE file for details.
+
+/**
+ * Canonical manifest registry — Plan 1.5.1 §3 deliverable.
+ *
+ * Single source-of-truth for "what manifest files we recognize and how we
+ * read them." Both `package-detector.ts` (init's framework-detection layer)
+ * and `adapters/runner.ts:buildDetectionSignals` (AST adapter signal layer)
+ * consume from THIS registry. Adding a new manifest type = ONE entry; both
+ * consumers automatically pick it up.
+ *
+ * Pre-registry state (1.5.0) had TWO parallel lists that drifted:
+ *   - `package-detector.ts:MANIFEST_FILES` — 11 entries (legacy)
+ *   - `runner.ts:buildDetectionSignals` — 9 manifest reads (extended Phase 7)
+ * Phoenix + ASP.NET were unreachable via `npx massu init` because their
+ * manifest files (mix.exs, *.csproj) were in the runner's list but missing
+ * from package-detector's list. CR-39 violation; closed by this registry.
+ *
+ * Per CR-46 Rule 0 self-attest #3 ("does this add an N+1th alias map?"):
+ * this REPLACES the duplicated lists with one canonical map. The drift-
+ * prevention test `manifest-registry-drift.test.ts` fails the build if a
+ * registry entry is consumed by only one of the two layers.
+ *
+ * Plan 1.5.1 reference:
+ * `~/massu-internal/docs/plans/2026-05-08-1.5.1-init-end-to-end.md`.
+ */
+
+import type { PackageManifest, DetectionWarning, SupportedLanguage } from './package-detector.ts';
+import type { DetectionSignals } from './adapters/types.ts';
+import * as parsers from './package-detector.ts';
+
+/**
+ * The pattern by which the registry recognizes a manifest file:
+ *   - exact filename: `'Gemfile'`, `'mix.exs'`, `'package.json'`
+ *   - extension-glob: `'*.csproj'` (matches any file ending in `.csproj`)
+ * Only these two shapes are supported; arbitrary glob patterns are
+ * intentionally rejected to keep matching cheap and predictable.
+ */
+export type ManifestPattern = string;
+
+/**
+ * Match a candidate filename against a registry pattern.
+ * Returns true if `name` matches `pattern`.
+ */
+export function matchManifestPattern(name: string, pattern: ManifestPattern): boolean {
+  if (pattern.startsWith('*')) {
+    const suffix = pattern.slice(1);
+    if (suffix.includes('*')) {
+      throw new Error(
+        `[manifest-registry] pattern "${pattern}" has more than one wildcard. ` +
+        `Only "*.<ext>" extension-globs are supported.`,
+      );
+    }
+    return name.endsWith(suffix);
+  }
+  return name === pattern;
+}
+
+/**
+ * Parser function signature — matches the existing parse* fns in
+ * package-detector.ts. Returns null on file-not-found or parse failure
+ * (with a warning pushed to `warnings`).
+ */
+export type ManifestParser = (
+  path: string,
+  directory: string,
+  root: string,
+  warnings: DetectionWarning[],
+) => PackageManifest | null;
+
+/**
+ * Single registry entry. One per manifest type.
+ */
+export interface ManifestEntry {
+  /** Recognition pattern (see `ManifestPattern`). */
+  pattern: ManifestPattern;
+  /** Canonical manifest-type tag (matches `PackageManifest.manifestType`). */
+  manifestType: PackageManifest['manifestType'];
+  /** Default language this manifest implies. */
+  language: SupportedLanguage;
+  /** Runtime family hint. */
+  runtime: string;
+  /** Function that reads + parses the file into a `PackageManifest`. */
+  parse: ManifestParser;
+  /**
+   * The DetectionSignals key the runner uses to expose this manifest's
+   * contents to AST adapters. `null` when this manifest doesn't surface
+   * to the AST tier (e.g., requirements.txt is captured via pyprojectToml
+   * sibling already; Package.swift has no AST adapter consumer yet).
+   */
+  signalKey: keyof DetectionSignals | null;
+  /**
+   * Shape the runner stores under `signalKey`. Drives whether the runner
+   * calls `tryReadString` (string) or `tryReadToml` (toml) or
+   * `tryReadJson` (json) when populating signals. Ignored when
+   * `signalKey === null`.
+   */
+  signalShape: 'string' | 'toml' | 'json';
+}
+
+/**
+ * The canonical registry — the SINGLE source-of-truth for "what manifests
+ * we recognize."
+ *
+ * Lazy initializer: package-detector.ts re-exports the parsers we
+ * reference here, so eager top-level evaluation would risk an ESM
+ * circular-import undefined-symbol. Resolution: build the registry on
+ * first call (after both modules' top-level evaluations have completed).
+ *
+ * Adding a new manifest type:
+ *   1. Author a new `parseXxx()` function in `package-detector.ts`.
+ *   2. Add an entry to MANIFEST_REGISTRY referencing it.
+ *   3. (If needed) extend `SupportedLanguage` and
+ *      `PackageManifest.manifestType` unions.
+ *   4. Add the new signal field to `DetectionSignals` if the AST adapter
+ *      pipeline needs to read it.
+ *   5. The drift-prevention test will fail until both consumers see the
+ *      new entry.
+ */
+let _registryCache: ManifestEntry[] | null = null;
+
+export function getManifestRegistry(): ManifestEntry[] {
+  if (_registryCache !== null) return _registryCache;
+  _registryCache = [
+    {
+      pattern: 'package.json',
+      manifestType: 'package.json',
+      language: 'typescript',
+      runtime: 'node',
+      parse: parsers.parsePackageJson,
+      signalKey: 'packageJson',
+      signalShape: 'json',
+    },
+    {
+      pattern: 'pyproject.toml',
+      manifestType: 'pyproject.toml',
+      language: 'python',
+      runtime: 'python3',
+      parse: parsers.parsePyproject,
+      signalKey: 'pyprojectToml',
+      signalShape: 'toml',
+    },
+    {
+      pattern: 'requirements.txt',
+      manifestType: 'requirements.txt',
+      language: 'python',
+      runtime: 'python3',
+      parse: parsers.parseRequirementsTxt,
+      // Captured via pyprojectToml sibling already; no separate signal.
+      signalKey: null,
+      signalShape: 'string',
+    },
+    {
+      pattern: 'Pipfile',
+      manifestType: 'Pipfile',
+      language: 'python',
+      runtime: 'python3',
+      parse: parsers.parsePipfile,
+      // Captured via pyprojectToml sibling already; no separate signal.
+      signalKey: null,
+      signalShape: 'string',
+    },
+    {
+      pattern: 'Cargo.toml',
+      manifestType: 'Cargo.toml',
+      language: 'rust',
+      runtime: 'cargo',
+      parse: parsers.parseCargoToml,
+      signalKey: 'cargoToml',
+      signalShape: 'toml',
+    },
+    {
+      pattern: 'Package.swift',
+      manifestType: 'Package.swift',
+      language: 'swift',
+      runtime: 'xcode',
+      parse: parsers.parsePackageSwift,
+      // No AST adapter consumer yet (swift-swiftui doesn't need it).
+      signalKey: null,
+      signalShape: 'string',
+    },
+    {
+      pattern: 'go.mod',
+      manifestType: 'go.mod',
+      language: 'go',
+      runtime: 'go',
+      parse: parsers.parseGoMod,
+      signalKey: 'goMod',
+      signalShape: 'string',
+    },
+    {
+      pattern: 'pom.xml',
+      manifestType: 'pom.xml',
+      language: 'java',
+      runtime: 'jvm',
+      parse: parsers.parsePomXml,
+      signalKey: 'pomXml',
+      signalShape: 'string',
+    },
+    {
+      pattern: 'build.gradle',
+      manifestType: 'build.gradle',
+      language: 'java',
+      runtime: 'jvm',
+      parse: parsers.parseBuildGradle,
+      signalKey: 'gradleBuild',
+      signalShape: 'string',
+    },
+    {
+      pattern: 'build.gradle.kts',
+      manifestType: 'build.gradle',
+      language: 'java',
+      runtime: 'jvm',
+      parse: parsers.parseBuildGradle,
+      signalKey: 'gradleBuild',
+      signalShape: 'string',
+    },
+    {
+      pattern: 'Gemfile',
+      manifestType: 'Gemfile',
+      language: 'ruby',
+      runtime: 'ruby',
+      parse: parsers.parseGemfile,
+      signalKey: 'gemfile',
+      signalShape: 'string',
+    },
+    // Plan 1.5.1 — closes CR-39 violation (1.5.0 init failed for Phoenix
+    // + ASP.NET fixtures). Both rely on AST adapters that already work
+    // in introspect; the gap was solely package-detector unaware of the
+    // manifest filenames.
+    {
+      pattern: 'mix.exs',
+      manifestType: 'mix.exs',
+      language: 'elixir',
+      runtime: 'beam',
+      parse: parsers.parseMixExs,
+      signalKey: 'mixExs',
+      signalShape: 'string',
+    },
+    {
+      pattern: '*.csproj',
+      manifestType: '*.csproj',
+      language: 'csharp',
+      runtime: 'dotnet',
+      parse: parsers.parseCsproj,
+      signalKey: 'csproj',
+      signalShape: 'string',
+    },
+  ];
+  return _registryCache;
+}
+
+/**
+ * Filename list for direct iteration callers (e.g., the existing
+ * package-detector.ts `MANIFEST_FILES` const). Derived from the registry
+ * so it stays in lockstep automatically.
+ */
+export function getManifestPatterns(): ManifestPattern[] {
+  return getManifestRegistry().map((e) => e.pattern);
+}

package/src/detect/package-detector.ts

@@ -47,7 +47,9 @@ export type SupportedLanguage =
   | 'swift'
   | 'go'
   | 'java'
-  | 'ruby';
+  | 'ruby'
+  | 'elixir'
+  | 'csharp';
 
 export interface PackageManifest {
   /** Absolute path to the manifest file. */
@@ -81,7 +83,9 @@ export interface PackageManifest {
     | 'go.mod'
     | 'pom.xml'
     | 'build.gradle'
-    | 'Gemfile';
+    | 'Gemfile'
+    | 'mix.exs'
+    | '*.csproj';
 }
 
 export interface DetectionWarning {
@@ -118,19 +122,10 @@ const IGNORED_DIRS = new Set([
   'Pods',
 ]);
 
-const MANIFEST_FILES = [
-  'package.json',
-  'pyproject.toml',
-  'requirements.txt',
-  'Pipfile',
-  'Cargo.toml',
-  'Package.swift',
-  'go.mod',
-  'pom.xml',
-  'build.gradle',
-  'build.gradle.kts',
-  'Gemfile',
-];
+// MANIFEST_FILES removed Plan 1.5.1. The canonical list lives at
+// `manifest-registry.ts:getManifestPatterns()`. `detectManifestsInDir`
+// (below) iterates the registry directly so adding a new manifest type
+// requires only a single registry entry — no second list to keep in sync.
 
 function safeRead(path: string): string | null {
   try {
@@ -153,7 +148,7 @@ function normalizeRelative(root: string, path: string): string {
   return rel.split(/[/\\]/).join('/');
 }
 
-function parsePackageJson(
+export function parsePackageJson(
   path: string,
   directory: string,
   root: string,
@@ -204,7 +199,7 @@ function parsePackageJson(
   };
 }
 
-function parsePyproject(
+export function parsePyproject(
   path: string,
   directory: string,
   root: string,
@@ -323,7 +318,7 @@ function normalizePyDep(spec: string): string {
   return name.trim();
 }
 
-function parseRequirementsTxt(
+export function parseRequirementsTxt(
   path: string,
   directory: string,
   root: string,
@@ -355,7 +350,7 @@ function parseRequirementsTxt(
   };
 }
 
-function parsePipfile(
+export function parsePipfile(
   path: string,
   directory: string,
   root: string,
@@ -392,7 +387,7 @@ function parsePipfile(
   };
 }
 
-function parseCargoToml(
+export function parseCargoToml(
   path: string,
   directory: string,
   root: string,
@@ -430,7 +425,7 @@ function parseCargoToml(
   };
 }
 
-function parsePackageSwift(
+export function parsePackageSwift(
   path: string,
   directory: string,
   root: string,
@@ -472,7 +467,7 @@ function parsePackageSwift(
   };
 }
 
-function parseGoMod(
+export function parseGoMod(
   path: string,
   directory: string,
   root: string,
@@ -523,7 +518,7 @@ function parseGoMod(
   };
 }
 
-function parsePomXml(
+export function parsePomXml(
   path: string,
   directory: string,
   root: string,
@@ -554,7 +549,7 @@ function parsePomXml(
   };
 }
 
-function parseBuildGradle(
+export function parseBuildGradle(
   path: string,
   directory: string,
   root: string,
@@ -591,7 +586,7 @@ function parseBuildGradle(
   };
 }
 
-function parseGemfile(
+export function parseGemfile(
   path: string,
   directory: string,
   root: string,
@@ -628,54 +623,159 @@ function parseGemfile(
   };
 }
 
+/**
+ * Parse a `mix.exs` (Elixir / Mix) file. Plan 1.5.1 — closes CR-39
+ * gap where Phoenix projects failed `npx massu init` with "no languages
+ * detected" because the package-detector layer didn't recognize the
+ * manifest. The AST adapter at `detect/adapters/phoenix.ts` was already
+ * shipped in 1.5.0 and works correctly when given a SourceFile[] directly.
+ *
+ * mix.exs is Elixir source (not a declarative format), but for detection
+ * purposes we extract `{:dep, "~> X.Y"}` style declarations via a regex
+ * scan. False-positive risk is low (any `{:atom, ...}` pattern that's
+ * NOT a dep is rare in mix.exs files outside the deps function).
+ */
+export function parseMixExs(
+  path: string,
+  directory: string,
+  root: string,
+  _warnings: DetectionWarning[],
+): PackageManifest | null {
+  const raw = safeRead(path);
+  if (raw === null) return null;
+  const deps: string[] = [];
+  // Match `{:dep_name, ...}` — atom name as first tuple element.
+  const depPattern = /\{\s*:([a-z][a-z0-9_]*)\s*,/g;
+  let m: RegExpExecArray | null;
+  while ((m = depPattern.exec(raw)) !== null) {
+    if (!deps.includes(m[1])) deps.push(m[1]);
+  }
+  // Best-effort `app: :name` extraction (the `def project` block usually
+  // declares this).
+  const appMatch = /\bapp\s*:\s*:([a-z][a-z0-9_]*)/.exec(raw);
+  const name = appMatch ? appMatch[1] : null;
+  return {
+    path,
+    relativePath: normalizeRelative(root, path),
+    directory,
+    language: 'elixir',
+    runtime: 'beam',
+    name,
+    version: null,
+    dependencies: deps,
+    devDependencies: [],
+    scripts: [],
+    manifestType: 'mix.exs',
+  };
+}
+
+/**
+ * Parse a `*.csproj` (C# / .NET project) file. Plan 1.5.1 — closes CR-39
+ * gap where ASP.NET projects failed `npx massu init`. The AST adapter at
+ * `detect/adapters/aspnet.ts` was already shipped in 1.5.0 and works
+ * correctly.
+ *
+ * .csproj is XML; we use a lightweight regex scan rather than pulling
+ * an XML parser because the only fields we need are `<PackageReference
+ * Include="X" />` (deps) and the `Sdk="..."` attribute (framework hint).
+ * Full XML parsing would be over-engineered for this surface and risks
+ * adding a dependency for marginal gain.
+ */
+export function parseCsproj(
+  path: string,
+  directory: string,
+  root: string,
+  _warnings: DetectionWarning[],
+): PackageManifest | null {
+  const raw = safeRead(path);
+  if (raw === null) return null;
+  const deps: string[] = [];
+  // Match `<PackageReference Include="Foo.Bar" ... />` (Include attribute
+  // value is the package id; the Version attribute is captured but we
+  // discard it since runtime/build distinction isn't expressed via
+  // this schema).
+  const pkgRefPattern = /<PackageReference\s+[^>]*Include\s*=\s*"([^"]+)"/gi;
+  let m: RegExpExecArray | null;
+  while ((m = pkgRefPattern.exec(raw)) !== null) {
+    if (!deps.includes(m[1])) deps.push(m[1]);
+  }
+  // The `<Project Sdk="Microsoft.NET.Sdk.Web">` attribute is a strong
+  // ASP.NET Core indicator that doesn't appear as a PackageReference.
+  // Surface it as a dep so framework-detector rules (which match against
+  // the deps set) can fire on it. Same downstream consumer; no new
+  // signal channel needed.
+  const sdkMatch = /<Project\s+[^>]*Sdk\s*=\s*"([^"]+)"/i.exec(raw);
+  if (sdkMatch && !deps.includes(sdkMatch[1])) {
+    deps.push(sdkMatch[1]);
+  }
+  // Best-effort name from filename (Foo.csproj → "Foo").
+  const fname = path.split(/[/\\]/).pop() ?? '';
+  const name = fname.endsWith('.csproj') ? fname.slice(0, -'.csproj'.length) : null;
+  return {
+    path,
+    relativePath: normalizeRelative(root, path),
+    directory,
+    language: 'csharp',
+    runtime: 'dotnet',
+    name,
+    version: null,
+    dependencies: deps,
+    devDependencies: [],
+    scripts: [],
+    manifestType: '*.csproj',
+  };
+}
+
 function detectManifestsInDir(
   dir: string,
   root: string,
   warnings: DetectionWarning[]
 ): PackageManifest[] {
+  // Plan 1.5.1: dispatch via the canonical MANIFEST_REGISTRY (single
+  // source-of-truth). The previous hand-rolled MANIFEST_FILES list +
+  // switch statement led to drift with runner.ts:buildDetectionSignals
+  // (Phoenix + ASP.NET were unreachable). Closed by registry.
+  // Lazy import to avoid ESM cycle; getManifestRegistry() is itself
+  // lazy-initialized.
+  const { getManifestRegistry, matchManifestPattern } = registryModule;
   const out: PackageManifest[] = [];
-  for (const fname of MANIFEST_FILES) {
-    const path = join(dir, fname);
-    if (!existsSync(path)) continue;
-    let m: PackageManifest | null = null;
-    switch (fname) {
-      case 'package.json':
-        m = parsePackageJson(path, dir, root, warnings);
-        break;
-      case 'pyproject.toml':
-        m = parsePyproject(path, dir, root, warnings);
-        break;
-      case 'requirements.txt':
-        m = parseRequirementsTxt(path, dir, root, warnings);
-        break;
-      case 'Pipfile':
-        m = parsePipfile(path, dir, root, warnings);
-        break;
-      case 'Cargo.toml':
-        m = parseCargoToml(path, dir, root, warnings);
-        break;
-      case 'Package.swift':
-        m = parsePackageSwift(path, dir, root, warnings);
-        break;
-      case 'go.mod':
-        m = parseGoMod(path, dir, root, warnings);
-        break;
-      case 'pom.xml':
-        m = parsePomXml(path, dir, root, warnings);
-        break;
-      case 'build.gradle':
-      case 'build.gradle.kts':
-        m = parseBuildGradle(path, dir, root, warnings);
-        break;
-      case 'Gemfile':
-        m = parseGemfile(path, dir, root, warnings);
-        break;
+  let dirEntries: string[] | null = null;
+  for (const entry of getManifestRegistry()) {
+    if (!entry.pattern.startsWith('*')) {
+      // Exact-filename pattern: O(1) existence check.
+      const path = join(dir, entry.pattern);
+      if (!existsSync(path)) continue;
+      const m = entry.parse(path, dir, root, warnings);
+      if (m !== null) out.push(m);
+    } else {
+      // Extension-glob pattern: scan dir for matches. Lazy-readdir so
+      // we pay the cost only when at least one glob entry exists.
+      if (dirEntries === null) {
+        try {
+          dirEntries = readdirSync(dir);
+        } catch {
+          dirEntries = [];
+        }
+      }
+      for (const fname of dirEntries) {
+        if (!matchManifestPattern(fname, entry.pattern)) continue;
+        const path = join(dir, fname);
+        if (!existsSync(path)) continue;
+        const m = entry.parse(path, dir, root, warnings);
+        if (m !== null) out.push(m);
+      }
     }
-    if (m !== null) out.push(m);
   }
   return out;
 }
 
+// Imported lazily-via-namespace to break the ESM cycle (manifest-registry
+// imports parsers from THIS module). The namespace import is hoisted to
+// the top of the module by ESM, but the named members are resolved on
+// access — by the time `detectManifestsInDir` runs, the registry module's
+// top-level evaluation has completed.
+import * as registryModule from './manifest-registry.ts';
+
 function listSubdirs(dir: string): string[] {
   try {
     return readdirSync(dir, { withFileTypes: true })

package/src/detect/source-dir-detector.ts

@@ -90,6 +90,9 @@ const EXTENSIONS: Record<SupportedLanguage, string[]> = {
   go: ['go'],
   java: ['java', 'kt'],
   ruby: ['rb'],
+  // Plan 1.5.1 — closing CR-39 init gap for Phoenix + ASP.NET projects.
+  elixir: ['ex', 'exs'],
+  csharp: ['cs'],
 };
 
 const TEST_FILE_PATTERNS: Record<SupportedLanguage, RegExp[]> = {
@@ -101,6 +104,10 @@ const TEST_FILE_PATTERNS: Record<SupportedLanguage, RegExp[]> = {
   go: [/_test\.go$/],
   java: [/Test[^/]*\.(java|kt)$/, /[^/]*Test\.(java|kt)$/],
   ruby: [/_spec\.rb$/, /_test\.rb$/],
+  // Phoenix/ExUnit canonical: `test/**_test.exs`. ASP.NET / xUnit
+  // canonical: `*Tests.cs` or `*.Tests/...`.
+  elixir: [/_test\.exs$/, /\/test\//],
+  csharp: [/Tests?\.cs$/, /\.Tests?\//],
 };
 
 const TEST_DIR_KEYWORDS = ['tests', 'test', '__tests__', 'spec', 'specs'];

package/src/security/registry-pubkey.generated.ts

@@ -1,4 +1,4 @@
-// AUTO-GENERATED by scripts/bundle-pubkey.mjs at 2026-05-08T15:19:53.775Z.
+// AUTO-GENERATED by scripts/bundle-pubkey.mjs at 2026-05-08T19:39:50.956Z.
 // Source pem: packages/core/security/registry-pubkey.pem
 // RAW-bytes sha256: 3b6226d036c472e533110d11a7d0cd2773ce1d7d4f1003517d5bd69c5418ed4c
 // DO NOT EDIT — regenerate via `node scripts/bundle-pubkey.mjs` or

package/templates/aspnet/massu.config.yaml

@@ -26,7 +26,11 @@ framework:
         - Models
 
 paths:
-  source: src
+  # ASP.NET Core convention: code lives at project root by default
+  # (Controllers/, Pages/, Models/, Program.cs). `src/` is not canonical
+  # — projects opt into it explicitly. Default to `.` so fresh `npx
+  # massu init` doesn't fail on `paths.source 'src' does not exist`.
+  source: .
   aliases: {}
 
 toolPrefix: massu