@produtype/core 0.2.0

package/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 Denis Billi
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

package/README.md

@@ -0,0 +1,289 @@
+# ProdKit
+
+ProdKit is a deterministic local CLI that analyzes an existing web application repository and generates a production-readiness report or a remediation plan.
+
+It is designed for early-stage and AI-generated apps where architecture and security quality can vary significantly.
+
+ProdKit MVP is read-only: it never modifies the target repository.
+
+## What ProdKit does
+
+ProdKit inspects a target project and detects:
+
+- Frontend framework signals
+- Backend framework signals
+- Database technologies
+- Package manager
+- Docker and Docker Compose presence
+- Environment file and env-usage hygiene
+- Authentication and authorization signals
+- Tenant/organization signals
+- GDPR/privacy signals
+- Security hardening signals
+- Upload exposure signals
+- Billing/Stripe signals
+- Observability/logging signals
+- Background jobs/queue signals
+- Deployment readiness signals
+
+Then it builds a structured production-readiness report with:
+
+- Overall score (0-100)
+- Maturity level (`prototype`, `early`, `partial`, `production_ready`)
+- Findings grouped by category
+- Critical issues and warnings
+- Passed checks
+- Suggested next steps
+- Technical evidence for each finding
+
+From the report, ProdKit can also build a deterministic remediation plan with phases, task priorities, effort estimates, and test suggestions.
+
+## Installation
+
+### Local development install
+
+1. Install dependencies:
+
+```bash
+npm install
+```
+
+2. Build CLI:
+
+```bash
+npm run build
+```
+
+3. Link globally for local usage:
+
+```bash
+npm link
+```
+
+After linking, use:
+
+```bash
+prodkit --help
+```
+
+## Local development
+
+```bash
+npm install
+npm run build
+npm test
+```
+
+Optional lint:
+
+```bash
+npm run lint
+```
+
+## Commands
+
+Diagnostic command:
+
+```bash
+prodkit analyze <path-to-project>
+```
+
+Remediation planning command:
+
+```bash
+prodkit plan <path-to-project>
+```
+
+Options:
+
+- `--format markdown|json` output format for the report or plan payload
+- `--summary` print summary only
+- `--output <path>` write output to file
+- `--profile <name>` evaluate expected product capabilities (`static-site`, `internal-tool`, `b2c-app`, `b2b-saas`, `ai-saas`, `marketplace`, `auto`, `observed-only`)
+- `--fail-under <score>` (analyze only) exit with code 1 if the overall score is below the threshold — useful as a CI quality gate
+- `--min-maturity <level>` (analyze only) exit with code 1 if maturity is below `prototype|early|partial|production_ready`
+- `--ai` (analyze only) add an AI stack/architecture insight — opt-in, advisory only, does not affect the score
+- `--ai-review` (analyze only) add an AI semantic review of fine-grained code issues — opt-in, advisory only, does not affect the score
+
+Optional AI layer:
+
+- **A separate package.** The AI features live in `@produtype/ai`, which is commercial
+  and is not a dependency of this package. An open source install runs the
+  deterministic analysis only, and `--ai` reports that the package is not installed
+  rather than failing.
+- ProdKit stays deterministic, offline, and read-only: nothing here makes a network
+  call.
+- They require an `ANTHROPIC_API_KEY` and the optional `@anthropic-ai/sdk` package (`npm install @anthropic-ai/sdk`). Without them, the deterministic analysis is unaffected.
+- Repository content is redacted of secrets before anything is sent, and AI output is advisory only — it never changes the deterministic score.
+
+Profile warning:
+
+- Without a product profile, ProdKit only scores observed deterministic findings. Use `--profile` to evaluate expected product capabilities.
+
+Inconclusive assessments:
+
+- If no stack signals and no package manifests are detected, the report is marked **inconclusive** and the score is capped at 39 (`prototype`). An unrecognized project is never scored as production ready.
+
+## Examples
+
+```bash
+prodkit analyze ../my-app
+prodkit analyze ../my-app --profile b2b-saas
+prodkit analyze ../my-app --profile auto
+prodkit analyze ../my-app --summary
+prodkit analyze ../my-app --format markdown
+prodkit analyze ../my-app --format json
+prodkit analyze ../my-app --output prodkit-report.md
+prodkit analyze tests/fixtures/express-basic --format json --output report.json
+prodkit analyze ../my-app --fail-under 65
+prodkit analyze ../my-app --min-maturity partial
+prodkit plan ../my-app
+prodkit plan ../my-app --profile b2b-saas
+prodkit plan ../my-app --profile observed-only
+prodkit plan ../my-app --format markdown
+prodkit plan ../my-app --format json
+prodkit plan ../my-app --output prodkit-plan.md
+```
+
+## Supported stacks in MVP
+
+- Backend: Express, NestJS, Fastify, Next.js (Node); Django, FastAPI, Flask (Python)
+- Frontend: React, Vue, Svelte, Angular, Nuxt, Vite
+- Generic unknown app fallback
+
+## Acceptance commands
+
+```bash
+npm install
+npm run build
+npm test
+npm link
+prodkit analyze tests/fixtures/express-basic --format markdown
+prodkit analyze tests/fixtures/express-basic --format json
+prodkit analyze tests/fixtures/express-basic --output report.md
+prodkit plan tests/fixtures/express-basic
+prodkit plan tests/fixtures/express-basic --format json
+prodkit plan tests/fixtures/express-basic --output prodkit-plan.md
+```
+
+## Current limitations
+
+- Deterministic heuristics only, with no AI explanation layer yet
+- Signal-based stack coverage across common Node/Python/JS frameworks + fallback
+- Signal-based detection can produce false positives/negatives
+- Plan output is deterministic and read-only only
+- No cloud dashboard/UI in MVP
+
+## Roadmap
+
+1. Deterministic analyzer
+2. Deterministic remediation planning
+3. AI explanation layer
+4. Apply/generate PRs
+5. Cloud GitHub integration
+6. Framework adapters
+7. Dashboard
+
+## Project layout
+
+```text
+prodkit/
+  package.json
+  tsconfig.json
+  README.md
+  src/
+    index.ts
+    cli.ts
+    analyzer/
+    planner/
+    rules/
+    report/
+    utils/
+  tests/
+    fixtures/
+    analyzer.test.ts
+    report.test.ts
+    planner.test.ts
+```
+
+## GitHub Action
+
+Gate a pull request on production readiness:
+
+```yaml
+- uses: denisbilli/prodkit@main
+  with:
+    profile: b2b-saas
+    fail-under: "65"
+```
+
+Inputs: `path`, `profile`, `fail-under`, `min-maturity`, `comment-summary`.
+Outputs: `score`, `maturity`, `launch-ready`.
+
+The executive summary is written to the job summary even when the thresholds fail the
+job — a check that fails without saying why is worse than no check at all.
+
+Requires the package to be published; until then, point the action at a local
+checkout.
+
+## MCP server
+
+ProdKit ships an MCP server so an agent can assess a repository without leaving the
+editor. It exposes the deterministic analysis only, makes no network calls, and the
+code being analysed never leaves the machine.
+
+Tools: `analyze_project`, `plan_remediation`, `compare_profiles`, `list_profiles`.
+
+ProdKit is not on npm yet — the name `prodkit` is taken by an unrelated package — so
+install it from a local checkout:
+
+```bash
+npm install && npm run build && npm link
+```
+
+Claude Code:
+
+```bash
+claude mcp add prodkit -- prodkit-mcp
+```
+
+Or, in a client that reads a JSON config:
+
+```json
+{
+  "mcpServers": {
+    "prodkit": {
+      "command": "prodkit-mcp"
+    }
+  }
+}
+```
+
+`compare_profiles` is the one to reach for first: it scores the same repository
+against every product profile in a single call, which is the question ProdKit exists
+to answer.
+
+## Releases
+
+Published from CI on a version tag, with
+[npm provenance](https://docs.npmjs.com/generating-provenance-statements): the tarball
+is cryptographically linked to the commit and the workflow run that produced it, so it
+can be verified rather than merely trusted. No publish token ever sits on a developer
+machine.
+
+To cut a release:
+
+```bash
+npm version patch   # or minor / major — commits and tags
+git push --follow-tags
+```
+
+The workflow refuses to publish if the tag and `package.json` disagree, and runs a
+check that the commercial AI layer is absent from `dist` before anything leaves.
+Release notes are generated from the commits since the previous tag.
+
+## License
+
+
+
+MIT

package/dist/analyzer/analyzeProject.d.ts

@@ -0,0 +1,2 @@
+import type { ProjectAnalysis } from './types';
+export declare function analyzeProject(projectPath: string): Promise<ProjectAnalysis>;

package/dist/analyzer/analyzeProject.js

@@ -0,0 +1,365 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.analyzeProject = analyzeProject;
+const path = __importStar(require("path"));
+const zod_1 = require("zod");
+const fileScanner_1 = require("../utils/fileScanner");
+const readTextFileSafe_1 = require("../utils/readTextFileSafe");
+const detectPackageManager_1 = require("./detectPackageManager");
+const detectFrontend_1 = require("./detectFrontend");
+const detectBackend_1 = require("./detectBackend");
+const detectDatabase_1 = require("./detectDatabase");
+const detectDocker_1 = require("./detectDocker");
+const detectEnv_1 = require("./detectEnv");
+const detectAuth_1 = require("./detectAuth");
+const detectSecurity_1 = require("./detectSecurity");
+const detectUploads_1 = require("./detectUploads");
+const detectGdpr_1 = require("./detectGdpr");
+const detectBilling_1 = require("./detectBilling");
+const detectObservability_1 = require("./detectObservability");
+const detectJobs_1 = require("./detectJobs");
+const detectMarketplace_1 = require("./detectMarketplace");
+const detectAiSafety_1 = require("./detectAiSafety");
+const detectNotifications_1 = require("./detectNotifications");
+const detectDeployment_1 = require("./detectDeployment");
+const detectStack_1 = require("./detectStack");
+const packageJsonSchema = zod_1.z
+    .object({
+    name: zod_1.z.string().optional(),
+    version: zod_1.z.string().optional(),
+    dependencies: zod_1.z.record(zod_1.z.string()).optional(),
+    devDependencies: zod_1.z.record(zod_1.z.string()).optional(),
+    scripts: zod_1.z.record(zod_1.z.string()).optional(),
+})
+    .passthrough();
+function parseRequirements(text) {
+    if (!text)
+        return [];
+    return text
+        .split(/\r?\n/)
+        .map((l) => l.trim())
+        .filter((l) => l && !l.startsWith('#'))
+        .map((l) => l.split(/[<=>~![]/)[0].trim().toLowerCase())
+        .filter(Boolean);
+}
+function normalizePyDepSpec(spec) {
+    return spec.split(/[\s<>=!~;[(]/)[0].trim().toLowerCase();
+}
+function parsePyproject(text) {
+    if (!text)
+        return [];
+    const deps = [];
+    let section = '';
+    let inDependencyArray = false;
+    for (const raw of text.split(/\r?\n/)) {
+        const line = raw.trim();
+        if (!line || line.startsWith('#'))
+            continue;
+        const header = line.match(/^\[+([^\]]+)]+$/);
+        if (header) {
+            section = header[1].trim();
+            inDependencyArray = false;
+            continue;
+        }
+        // Poetry-style tables: each key of the section is a dependency name.
+        const isPoetryDepsSection = section === 'tool.poetry.dependencies'
+            || section === 'tool.poetry.dev-dependencies'
+            || /^tool\.poetry\.group\.[^.]+\.dependencies$/.test(section);
+        if (isPoetryDepsSection) {
+            const match = line.match(/^([A-Za-z0-9_.-]+)\s*=/);
+            if (match && match[1].toLowerCase() !== 'python')
+                deps.push(match[1].toLowerCase());
+            continue;
+        }
+        // PEP 621 / uv style: dependency specs live inside string arrays.
+        const isDepArraySection = section === 'project.optional-dependencies'
+            || section === 'dependency-groups'
+            || section === 'tool.uv';
+        if (section === 'project' || isDepArraySection || inDependencyArray) {
+            if (line.includes('include-group'))
+                continue;
+            const startsArray = section === 'project'
+                ? /^dependencies\s*=\s*\[/.test(line)
+                : isDepArraySection && /^[A-Za-z0-9_-]+\s*=\s*\[/.test(line);
+            if (!inDependencyArray && !startsArray)
+                continue;
+            for (const quoted of line.matchAll(/["']([^"']+)["']/g)) {
+                const name = normalizePyDepSpec(quoted[1]);
+                if (name)
+                    deps.push(name);
+            }
+            // Only a closing bracket outside quoted specs ends the array — specs
+            // like "fastapi[standard]>=0.114" contain brackets of their own.
+            const lineWithoutStrings = line.replace(/["'][^"']*["']/g, '');
+            inDependencyArray = (inDependencyArray || startsArray) && !lineWithoutStrings.includes(']');
+        }
+    }
+    return deps;
+}
+function isTestOrExamplePath(file) {
+    return /(^|\/)(__tests__|tests?|test-data|fixtures|frontend-example)(\/|$)/i.test(file)
+        || /(^|\/)test[-_][^/]+\.(ts|tsx|js|jsx|mjs|cjs|py)$/i.test(file)
+        || /\.(test|spec)\.(ts|tsx|js|jsx|mjs|cjs|py)$/i.test(file);
+}
+function pickSource(files) {
+    return files.filter((f) => /\.(ts|tsx|js|jsx|mjs|cjs|py)$/.test(f) && !isTestOrExamplePath(f));
+}
+function pickConfig(files) {
+    return files.filter((f) => /(package\.json|tsconfig|vite\.config|docker|compose|requirements\.txt|pyproject\.toml|settings\.py|\.env)/i.test(f));
+}
+function workspaceRootFromFile(file) {
+    const i = file.lastIndexOf('/');
+    return i === -1 ? '.' : file.slice(0, i);
+}
+function unique(items) {
+    return Array.from(new Set(items));
+}
+function mergeDeps(target, source) {
+    if (!source)
+        return;
+    for (const [k, v] of Object.entries(source))
+        target[k.toLowerCase()] = v;
+}
+function detectWorkspaceFrontend(npmDeps) {
+    const frameworks = [];
+    if (npmDeps.react || npmDeps['react-dom'])
+        frameworks.push('react');
+    if (npmDeps.vite || npmDeps['@vitejs/plugin-react'])
+        frameworks.push('vite');
+    if (npmDeps.vue)
+        frameworks.push('vue');
+    if (npmDeps.nuxt)
+        frameworks.push('nuxt');
+    if (npmDeps.svelte || npmDeps['@sveltejs/kit'])
+        frameworks.push('svelte');
+    if (npmDeps['@angular/core'])
+        frameworks.push('angular');
+    if (npmDeps.electron)
+        frameworks.push('electron');
+    if (npmDeps['react-router-dom'])
+        frameworks.push('react-router-dom');
+    if (npmDeps.tailwindcss)
+        frameworks.push('tailwindcss');
+    return unique(frameworks);
+}
+function detectWorkspaceBackend(npmDeps, pythonDeps) {
+    const frameworks = [];
+    if (npmDeps.express)
+        frameworks.push('express');
+    if (npmDeps.next)
+        frameworks.push('next');
+    if (npmDeps['@nestjs/core'])
+        frameworks.push('nestjs');
+    if (npmDeps.fastify)
+        frameworks.push('fastify');
+    if (pythonDeps.includes('django'))
+        frameworks.push('django');
+    if (pythonDeps.includes('fastapi'))
+        frameworks.push('fastapi');
+    if (pythonDeps.includes('flask'))
+        frameworks.push('flask');
+    return unique(frameworks);
+}
+function detectWorkspaceDatabases(npmDeps, pythonDeps) {
+    const dbs = [];
+    if (npmDeps.pg || pythonDeps.includes('psycopg2'))
+        dbs.push('postgres');
+    if (npmDeps.redis || npmDeps.ioredis || pythonDeps.includes('redis'))
+        dbs.push('redis');
+    if (npmDeps.mysql2 || pythonDeps.includes('mysqlclient'))
+        dbs.push('mysql');
+    if (npmDeps.mongodb || npmDeps.mongoose)
+        dbs.push('mongodb');
+    if (npmDeps.sqlite3 || npmDeps['better-sqlite3'])
+        dbs.push('sqlite');
+    return unique(dbs);
+}
+function resolveWorkspacePackageManager(workspace) {
+    if (workspace.lockfiles.includes('pnpm-lock.yaml'))
+        return { manager: 'pnpm', confidence: 'lockfile', warnings: [] };
+    if (workspace.lockfiles.includes('package-lock.json'))
+        return { manager: 'npm', confidence: 'lockfile', warnings: [] };
+    if (workspace.lockfiles.includes('yarn.lock'))
+        return { manager: 'yarn', confidence: 'lockfile', warnings: [] };
+    if (workspace.lockfiles.includes('poetry.lock'))
+        return { manager: 'poetry', confidence: 'lockfile', warnings: [] };
+    if (workspace.packageJsonPath)
+        return { manager: 'npm', confidence: 'manifest', warnings: ['package-lock missing'] };
+    if (workspace.pyprojectPath)
+        return { manager: 'poetry', confidence: 'manifest', warnings: [] };
+    if (workspace.requirementsPath)
+        return { manager: 'pip', confidence: 'manifest', warnings: [] };
+    return { manager: 'unknown', confidence: 'unknown', warnings: [] };
+}
+async function analyzeProject(projectPath) {
+    const root = path.resolve(projectPath);
+    const allFiles = await (0, fileScanner_1.scanFiles)({ cwd: root });
+    const sourceFiles = pickSource(allFiles);
+    const configFiles = pickConfig(allFiles);
+    const packageJsonRaw = await (0, readTextFileSafe_1.readJsonSafe)(root, 'package.json');
+    const packageJson = packageJsonRaw ? packageJsonSchema.parse(packageJsonRaw) : null;
+    const packageJsonFiles = allFiles.filter((f) => f.endsWith('package.json'));
+    const requirementsFiles = allFiles.filter((f) => /(^|\/)requirements\.txt$/i.test(f));
+    const pyprojectFiles = allFiles.filter((f) => /(^|\/)pyproject\.toml$/i.test(f));
+    const lockfiles = allFiles.filter((f) => /(^|\/)(pnpm-lock\.yaml|package-lock\.json|yarn\.lock|poetry\.lock)$/i.test(f));
+    const workspaceRoots = new Set(['.']);
+    for (const file of [...packageJsonFiles, ...requirementsFiles, ...pyprojectFiles, ...lockfiles]) {
+        workspaceRoots.add(workspaceRootFromFile(file));
+    }
+    const workspaces = [];
+    for (const wsRoot of Array.from(workspaceRoots).sort()) {
+        const packageJsonPath = wsRoot === '.' ? 'package.json' : `${wsRoot}/package.json`;
+        const requirementsPath = wsRoot === '.' ? 'requirements.txt' : `${wsRoot}/requirements.txt`;
+        const pyprojectPath = wsRoot === '.' ? 'pyproject.toml' : `${wsRoot}/pyproject.toml`;
+        const packageJsonRawForWorkspace = packageJsonFiles.includes(packageJsonPath)
+            ? await (0, readTextFileSafe_1.readJsonSafe)(root, packageJsonPath)
+            : null;
+        const packageJsonForWorkspace = packageJsonRawForWorkspace ? packageJsonSchema.parse(packageJsonRawForWorkspace) : null;
+        const reqText = requirementsFiles.includes(requirementsPath)
+            ? await (0, readTextFileSafe_1.readTextFileSafe)(root, requirementsPath)
+            : null;
+        const pyprojectText = pyprojectFiles.includes(pyprojectPath)
+            ? await (0, readTextFileSafe_1.readTextFileSafe)(root, pyprojectPath)
+            : null;
+        const wsLockfiles = lockfiles
+            .filter((f) => workspaceRootFromFile(f) === wsRoot)
+            .map((f) => f.split('/').pop() ?? f);
+        workspaces.push({
+            root: wsRoot,
+            packageJsonPath: packageJsonFiles.includes(packageJsonPath) ? packageJsonPath : undefined,
+            packageJson: packageJsonForWorkspace,
+            requirementsPath: requirementsFiles.includes(requirementsPath) ? requirementsPath : undefined,
+            requirementsDeps: parseRequirements(reqText),
+            pyprojectPath: pyprojectFiles.includes(pyprojectPath) ? pyprojectPath : undefined,
+            pyprojectDeps: parsePyproject(pyprojectText),
+            lockfiles: wsLockfiles,
+        });
+    }
+    const pythonDeps = unique(workspaces.flatMap((w) => [...w.requirementsDeps, ...w.pyprojectDeps]));
+    const npmDeps = {};
+    for (const workspace of workspaces) {
+        mergeDeps(npmDeps, workspace.packageJson?.dependencies);
+        mergeDeps(npmDeps, workspace.packageJson?.devDependencies);
+    }
+    const workspaceStacks = workspaces.map((workspace) => {
+        const wsNpmDeps = {};
+        mergeDeps(wsNpmDeps, workspace.packageJson?.dependencies);
+        mergeDeps(wsNpmDeps, workspace.packageJson?.devDependencies);
+        const wsPythonDeps = unique([...workspace.requirementsDeps, ...workspace.pyprojectDeps]);
+        const pm = resolveWorkspacePackageManager(workspace);
+        return {
+            root: workspace.root,
+            frontend: detectWorkspaceFrontend(wsNpmDeps),
+            backend: detectWorkspaceBackend(wsNpmDeps, wsPythonDeps),
+            databases: detectWorkspaceDatabases(wsNpmDeps, wsPythonDeps),
+            packageManager: pm.manager,
+            packageManagerConfidence: pm.confidence,
+            warnings: pm.warnings,
+        };
+    }).filter((w) => w.frontend.length > 0
+        || w.backend.length > 0
+        || w.databases.length > 0
+        || w.packageManager !== 'unknown');
+    const ctx = {
+        root,
+        files: { all: allFiles, source: sourceFiles, config: configFiles },
+        packageJson,
+        pythonDeps,
+        npmDeps,
+        workspaces,
+    };
+    const [pm, frontend, backend, database, docker, env, auth, security, uploads, gdpr, billing, observability, jobs, marketplace, aiSafety, engagement, deployment] = await Promise.all([
+        (0, detectPackageManager_1.detectPackageManager)(ctx),
+        (0, detectFrontend_1.detectFrontend)(ctx),
+        (0, detectBackend_1.detectBackend)(ctx),
+        (0, detectDatabase_1.detectDatabase)(ctx),
+        (0, detectDocker_1.detectDocker)(ctx),
+        (0, detectEnv_1.detectEnv)(ctx),
+        (0, detectAuth_1.detectAuth)(ctx),
+        (0, detectSecurity_1.detectSecurity)(ctx),
+        (0, detectUploads_1.detectUploads)(ctx),
+        (0, detectGdpr_1.detectGdpr)(ctx),
+        (0, detectBilling_1.detectBilling)(ctx),
+        (0, detectObservability_1.detectObservability)(ctx),
+        (0, detectJobs_1.detectJobs)(ctx),
+        (0, detectMarketplace_1.detectMarketplace)(ctx),
+        (0, detectAiSafety_1.detectAiSafety)(ctx),
+        (0, detectNotifications_1.detectEngagement)(ctx),
+        (0, detectDeployment_1.detectDeployment)(ctx),
+    ]);
+    const detectors = (0, detectStack_1.mergeDetectors)([
+        pm.result,
+        frontend.result,
+        backend.result,
+        database.result,
+        docker,
+        ...env,
+        ...auth,
+        security,
+        uploads,
+        ...gdpr,
+        ...billing,
+        observability,
+        jobs,
+        ...marketplace,
+        ...aiSafety,
+        ...engagement,
+        deployment,
+    ]);
+    return {
+        projectPath: root,
+        scannedAt: new Date().toISOString(),
+        stack: (0, detectStack_1.buildStackInfo)({
+            frontend: frontend.frameworks,
+            backend: backend.frameworks,
+            databases: database.databases,
+            packageManager: pm.manager,
+            packageManagerConfidence: pm.confidence,
+            warnings: pm.warnings,
+            workspaces: workspaceStacks,
+            files: allFiles,
+        }),
+        packageJson,
+        pythonDeps,
+        workspaceStacks,
+        files: {
+            all: allFiles,
+            source: sourceFiles,
+            config: configFiles,
+        },
+        detectors,
+    };
+}

package/dist/analyzer/detectAiSafety.d.ts

@@ -0,0 +1,3 @@
+import type { DetectorResult } from './types';
+import type { DetectContext } from './detectContext';
+export declare function detectAiSafety(ctx: DetectContext): Promise<DetectorResult[]>;