@universalcms/connect 0.0.0-stage → 0.1.0

package/dist/vendor/dependency-diagnostics.mjs

@@ -0,0 +1,72 @@
+/** Sanitized dependency advice. Browser-safe: no filesystem, modules or network. */
+export const CMS_DEPENDENCY_NAMES = Object.freeze({
+  sdk: '@universalcms/sdk', react: '@universalcms/react', next: '@universalcms/next',
+});
+const packageKeys = Object.keys(CMS_DEPENDENCY_NAMES);
+const declarations = ['runtime', 'development', 'missing', 'unknown'];
+const installations = ['present', 'missing', 'unknown'];
+const compatibility = ['compatible', 'incompatible', 'unknown'];
+
+function values(value, keys) {
+  if (!value || typeof value !== 'object' || Array.isArray(value)) return null;
+  const descriptors = Object.getOwnPropertyDescriptors(value);
+  if (Object.keys(descriptors).length !== keys.length || keys.some(key => !descriptors[key] || !('value' in descriptors[key]))) return null;
+  return Object.fromEntries(keys.map(key => [key, descriptors[key].value]));
+}
+
+/** Reject arbitrary labels, paths, package versions, credentials and getters. */
+export function validateDependencyDiagnostics(value) {
+  try {
+    const diagnostic = values(value, ['generatedAt', 'packages', 'node']);
+    if (!diagnostic || typeof diagnostic.generatedAt !== 'string' ||
+        !/^\d{4}-\d{2}-\d{2}T\d{2}:\d{2}:\d{2}\.\d{3}Z$/.test(diagnostic.generatedAt) ||
+        new Date(diagnostic.generatedAt).toISOString() !== diagnostic.generatedAt ||
+        !compatibility.includes(diagnostic.node)) return null;
+    const candidates = values(diagnostic.packages, packageKeys);
+    if (!candidates) return null;
+    const packages = {};
+    for (const key of packageKeys) {
+      const candidate = values(candidates[key], ['declared', 'installed', 'compatibility']);
+      if (!candidate || !declarations.includes(candidate.declared) || !installations.includes(candidate.installed) ||
+          !compatibility.includes(candidate.compatibility) ||
+          (candidate.installed !== 'present' && candidate.compatibility !== 'unknown')) return null;
+      packages[key] = { declared: candidate.declared, installed: candidate.installed, compatibility: candidate.compatibility };
+    }
+    if (packages.sdk.compatibility === 'compatible' && diagnostic.node !== 'compatible') return null;
+    if (packages.next.compatibility === 'compatible' && (diagnostic.node !== 'compatible' || packages.sdk.compatibility !== 'compatible')) return null;
+    // The React renderer may run in a browser even when the inspection process
+    // cannot run the credentialed Node client. Its package dependency must exist.
+    if (packages.react.compatibility === 'compatible' && packages.sdk.installed !== 'present') return null;
+    return { generatedAt: diagnostic.generatedAt, packages, node: diagnostic.node };
+  } catch { return null; }
+}
+
+/** A manifest establishes declarations only, never installation or runtime health. */
+export function createManifestDependencyDiagnostics(packageJsonText, now = new Date()) {
+  let manifest = null;
+  try {
+    if (typeof packageJsonText === 'string' && new TextEncoder().encode(packageJsonText).byteLength <= 128 * 1024) {
+      const parsed = JSON.parse(packageJsonText);
+      if (parsed && typeof parsed === 'object' && !Array.isArray(parsed)) manifest = parsed;
+    }
+  } catch { /* Keep declaration confidence unknown, without reflecting source. */ }
+  const sections = ['dependencies', 'devDependencies', 'optionalDependencies'];
+  const own = (value, key) => Object.prototype.hasOwnProperty.call(value, key);
+  const invalidSections = manifest && sections.some(key => own(manifest, key) && (!manifest[key] || typeof manifest[key] !== 'object' || Array.isArray(manifest[key])));
+  const declaration = name => {
+    if (!manifest || invalidSections) return 'unknown';
+    for (const section of sections) {
+      if (manifest[section] && own(manifest[section], name) && (typeof manifest[section][name] !== 'string' || !manifest[section][name].trim())) return 'unknown';
+    }
+    if (['dependencies', 'optionalDependencies'].some(key => manifest[key] && own(manifest[key], name))) return 'runtime';
+    if (manifest.devDependencies && own(manifest.devDependencies, name)) return 'development';
+    return 'missing';
+  };
+  const packages = {};
+  for (const [key, name] of Object.entries(CMS_DEPENDENCY_NAMES)) {
+    const declared = declaration(name);
+    packages[key] = { declared, installed: 'unknown', compatibility: 'unknown' };
+  }
+  const generatedAt = new Date(now).toISOString();
+  return { generatedAt, packages, node: 'unknown' };
+}

package/dist/vendor/inspect-installed-dependencies.mjs

@@ -0,0 +1,125 @@
+/** Bounded local metadata inspection. Never executes website modules or scripts. */
+import { constants } from 'node:fs';
+import { lstat, open, realpath } from 'node:fs/promises';
+import path from 'node:path';
+import { createManifestDependencyDiagnostics, CMS_DEPENDENCY_NAMES } from './dependency-diagnostics.mjs';
+
+const MAX_METADATA_BYTES = 128 * 1024;
+const packages = [
+  { key: 'sdk', name: CMS_DEPENDENCY_NAMES.sdk, entry: 'dist/index.js', exportCondition: 'default' },
+  { key: 'react', name: CMS_DEPENDENCY_NAMES.react, entry: 'dist/index.js', exportCondition: 'import' },
+  { key: 'next', name: CMS_DEPENDENCY_NAMES.next, entry: 'dist/index.js', exportCondition: 'import' },
+  { key: 'reactPeer', name: 'react', entry: 'index.js' },
+  { key: 'nextPeer', name: 'next', entry: 'dist/server/next.js' },
+];
+const inside = (root, target) => {
+  const relative = path.relative(root, target);
+  return relative !== '..' && !relative.startsWith(`..${path.sep}`) && !path.isAbsolute(relative);
+};
+const plain = value => value !== null && typeof value === 'object' && !Array.isArray(value);
+
+async function readMetadata(filename, directory) {
+  let handle;
+  try {
+    const before = await lstat(filename);
+    if (!before.isFile() || before.isSymbolicLink() || before.size > MAX_METADATA_BYTES || await realpath(filename) !== filename || !inside(directory, filename)) return null;
+    handle = await open(filename, constants.O_RDONLY | constants.O_NOFOLLOW);
+    const opened = await handle.stat(), current = await lstat(filename);
+    if (!opened.isFile() || current.isSymbolicLink() || opened.ino !== current.ino || opened.dev !== current.dev ||
+        opened.size > MAX_METADATA_BYTES || await realpath(filename) !== filename) return null;
+    const buffer = Buffer.alloc(MAX_METADATA_BYTES + 1);
+    let bytes = 0;
+    while (bytes < buffer.length) {
+      const part = await handle.read(buffer, bytes, buffer.length - bytes, bytes);
+      if (!part.bytesRead) break;
+      bytes += part.bytesRead;
+    }
+    if (bytes > MAX_METADATA_BYTES) return null;
+    const parsed = JSON.parse(new TextDecoder('utf-8', { fatal: true }).decode(buffer.subarray(0, bytes)));
+    return plain(parsed) ? parsed : null;
+  } catch { return null; }
+  finally { await handle?.close(); }
+}
+
+function numericVersion(value) {
+  if (typeof value !== 'string') return null;
+  const match = /^(?:v)?(0|[1-9]\d*)\.(0|[1-9]\d*)\.(0|[1-9]\d*)$/.exec(value);
+  if (!match) return null;
+  const numbers = match.slice(1).map(Number);
+  return numbers.every(Number.isSafeInteger) ? numbers : null;
+}
+function nodeCompatibility(value) {
+  const version = numericVersion(value);
+  return !version ? 'unknown' : version[0] > 20 || (version[0] === 20 && version[1] >= 19) ? 'compatible' : 'incompatible';
+}
+function peerCompatibility(value, major, minimumMinor = 0) {
+  const version = numericVersion(value);
+  return !version ? 'unknown' : version[0] === major && version[1] >= minimumMinor ? 'compatible' : 'incompatible';
+}
+function allCompatible(states) {
+  return states.includes('incompatible') ? 'incompatible' : states.every(value => value === 'compatible') ? 'compatible' : 'unknown';
+}
+
+async function inspectPackage(modules, descriptor) {
+  const directory = path.join(modules, ...descriptor.name.split('/'));
+  let info;
+  // Validate a scoped package's parent before even probing its child. A scope
+  // link outside node_modules must not leak whether that external child exists.
+  if (descriptor.name.startsWith('@')) {
+    try {
+      const scope = await realpath(path.dirname(directory));
+      if (!inside(modules, scope) || !(await lstat(scope)).isDirectory()) return { installed: 'unknown', version: null };
+    } catch (error) { return { installed: error.code === 'ENOENT' || error.code === 'ENOTDIR' ? 'missing' : 'unknown', version: null }; }
+  }
+  try { info = await lstat(directory); }
+  catch (error) { return { installed: error.code === 'ENOENT' || error.code === 'ENOTDIR' ? 'missing' : 'unknown', version: null }; }
+  try {
+    if (!info.isDirectory() && !info.isSymbolicLink()) return { installed: 'unknown', version: null };
+    // pnpm stores package directories behind symlinks inside node_modules/.pnpm.
+    // External links and shared workspaces are outside this bounded inspection.
+    const actual = await realpath(directory);
+    if (!inside(modules, actual) || actual === modules || !(await lstat(actual)).isDirectory()) return { installed: 'unknown', version: null };
+    const metadata = await readMetadata(path.join(actual, 'package.json'), actual);
+    if (!metadata || metadata.name !== descriptor.name || typeof metadata.version !== 'string') return { installed: 'unknown', version: null };
+    const entry = path.join(actual, descriptor.entry), entryInfo = await lstat(entry);
+    if (!entryInfo.isFile() || entryInfo.isSymbolicLink() || await realpath(entry) !== entry || !inside(actual, entry)) return { installed: 'unknown', version: null };
+    if (descriptor.exportCondition) {
+      if (!plain(metadata.exports) || !plain(metadata.exports['.']) || metadata.exports['.'][descriptor.exportCondition] !== `./${descriptor.entry}`) return { installed: 'unknown', version: null };
+    } else if (descriptor.name === 'next' && ![`./${descriptor.entry}`, descriptor.entry].includes(metadata.main)) return { installed: 'unknown', version: null };
+    return { installed: 'present', version: metadata.version };
+  } catch { return { installed: 'unknown', version: null }; }
+}
+
+/** Inspect one selected project; public output never contains versions or paths. */
+export async function inspectInstalledDependencies(directory, packageJsonText, { now = new Date(), nodeVersion = process.version } = {}) {
+  const diagnostics = createManifestDependencyDiagnostics(packageJsonText, now);
+  diagnostics.node = nodeCompatibility(nodeVersion);
+  let root;
+  try {
+    const requested = path.resolve(directory), rootInfo = await lstat(requested);
+    if (!rootInfo.isDirectory() || rootInfo.isSymbolicLink()) return diagnostics;
+    root = await realpath(requested);
+  } catch { return diagnostics; }
+  const modules = path.join(root, 'node_modules');
+  let modulesInfo;
+  try { modulesInfo = await lstat(modules); }
+  catch (error) {
+    if (error.code === 'ENOENT' || error.code === 'ENOTDIR') {
+      for (const candidate of Object.values(diagnostics.packages)) candidate.installed = 'missing';
+    }
+    return diagnostics;
+  }
+  try {
+    if (!modulesInfo.isDirectory() || modulesInfo.isSymbolicLink() || await realpath(modules) !== modules) return diagnostics;
+  } catch { return diagnostics; }
+  const observed = {};
+  for (const descriptor of packages) observed[descriptor.key] = await inspectPackage(modules, descriptor);
+  for (const key of Object.keys(CMS_DEPENDENCY_NAMES)) diagnostics.packages[key].installed = observed[key].installed;
+  const release = key => observed[key].installed === 'present' && observed[key].version === '0.1.0' ? 'compatible' : 'unknown';
+  const reactPeer = observed.reactPeer.installed === 'present' ? peerCompatibility(observed.reactPeer.version, 19, 2) : 'unknown';
+  const nextPeer = observed.nextPeer.installed === 'present' ? peerCompatibility(observed.nextPeer.version, 16) : 'unknown';
+  if (observed.sdk.installed === 'present') diagnostics.packages.sdk.compatibility = allCompatible([release('sdk'), diagnostics.node]);
+  if (observed.react.installed === 'present') diagnostics.packages.react.compatibility = allCompatible([release('react'), release('sdk'), reactPeer]);
+  if (observed.next.installed === 'present') diagnostics.packages.next.compatibility = allCompatible([release('next'), release('sdk'), diagnostics.node, reactPeer, nextPeer]);
+  return diagnostics;
+}

package/dist/vendor/project-analysis.mjs

@@ -0,0 +1,446 @@
+import { validateDependencyDiagnostics } from './dependency-diagnostics.mjs';
+
+/**
+ * Local project evidence only. This module runs in browsers and Node without
+ * executing a project's scripts, importing its modules, or contacting a URL.
+ * Reports are integration advice, never authorization or connection proof.
+ */
+export const MAX_ANALYSIS_FILE_BYTES = 128 * 1024;
+export const MAX_ANALYSIS_TOTAL_BYTES = 1024 * 1024;
+const configNames = (name) => ['js', 'mjs', 'cjs', 'ts'].map(extension => `${name}.config.${extension}`);
+const nodeEntries = ['server.js', 'server.mjs', 'server.cjs', 'server.ts', 'app.js', 'app.mjs', 'index.js', 'index.mjs', 'server/index.js', 'server/index.mjs', 'server/index.cjs', 'server/index.ts', 'src/server.js', 'src/server.mjs', 'src/server.ts'];
+export const PROJECT_ANALYSIS_FILES = Object.freeze([
+  'package.json', 'composer.json', 'pnpm-workspace.yaml', 'angular.json',
+  'requirements.txt', 'pyproject.toml', 'Gemfile', 'pom.xml', 'build.gradle', 'build.gradle.kts',
+  ...configNames('next'), ...configNames('nuxt'), ...configNames('astro'), ...configNames('svelte'), ...configNames('vite'),
+  ...nodeEntries,
+]);
+export const PROJECT_ANALYSIS_SIGNALS = Object.freeze({
+  react: 'React dependency', vue: 'Vue dependency', angular: 'Angular dependency',
+  next: 'Next.js dependency and framework command', nuxt: 'Nuxt dependency and framework command',
+  astro: 'Astro dependency and framework command', svelte: 'SvelteKit dependency and framework command',
+  laravel: 'Laravel production Composer dependency', wordpress: 'WordPress production Composer dependency',
+  php: 'PHP runtime Composer requirement', python: 'Python web framework dependency',
+  ruby: 'Ruby on Rails dependency', java: 'Java Spring Boot dependency',
+  node: 'Node server entry, server imports and startup command',
+  nextStatic: 'Literal Next.js static export configuration', astroStatic: 'Literal Astro static output configuration',
+  astroServer: 'Literal Astro server output with Node adapter',
+  nuxtStatic: 'Nuxt generate command without a server startup command',
+  svelteStatic: 'SvelteKit static adapter configuration', svelteNode: 'SvelteKit Node adapter configuration',
+  monorepo: 'Multiple project workspace declaration', dynamic: 'Configuration needs developer inspection',
+});
+export const PROJECT_ANALYSIS_WARNINGS = Object.freeze({
+  unknown: 'A backend or build-time content integration could not be established. Ask the website developer to complete setup.',
+  monorepo: 'This folder contains a workspace. Analyze the individual website project folder instead.',
+  conflict: 'Conflicting framework or backend evidence needs developer review.',
+  invalid: 'A selected project file is invalid or exceeds the analysis limits. Ask the developer to check the project files.',
+  dynamic: 'A configuration uses values that cannot be resolved safely without running code. Ask the developer to confirm the deployment runtime.',
+  frontend: 'A frontend dependency does not identify its backend. Node.js build tools alone are not a Node.js website server.',
+  unverified: 'This identifies project configuration only. Credentials, deployment and CMS connectivity still need verification.',
+});
+const S = PROJECT_ANALYSIS_SIGNALS, W = PROJECT_ANALYSIS_WARNINGS;
+const own = (value, key) => Object.prototype.hasOwnProperty.call(value, key);
+const object = value => value !== null && typeof value === 'object' && !Array.isArray(value);
+const byteLength = value => new TextEncoder().encode(value).byteLength;
+const exactKeys = (value, keys) => object(value) && Object.keys(value).length === keys.length && Object.keys(value).every(key => keys.includes(key));
+const signalNames = new Set(Object.values(S));
+const warningNames = new Set(Object.values(W));
+const allowedFiles = new Set(PROJECT_ANALYSIS_FILES);
+
+function skipQuoted(source, begin, quote) {
+  let index = begin + 1;
+  while (index < source.length) {
+    if (source[index] === '\\') { index += 2; continue; }
+    if (source[index++] === quote) break;
+  }
+  return index;
+}
+
+function skipTemplate(source, begin, nesting = 0) {
+  if (nesting > 24) return source.length;
+  let index = begin + 1;
+  while (index < source.length) {
+    if (source[index] === '\\') { index += 2; continue; }
+    if (source[index] === '`') return index + 1;
+    if (source[index] !== '$' || source[index + 1] !== '{') { index++; continue; }
+    index += 2;
+    let depth = 1;
+    while (index < source.length && depth) {
+      const char = source[index];
+      if (char === '"' || char === "'") { index = skipQuoted(source, index, char); continue; }
+      if (char === '`') { index = skipTemplate(source, index, nesting + 1); continue; }
+      if (char === '/' && source[index + 1] === '/') { while (index < source.length && source[index] !== '\n') index++; continue; }
+      if (char === '/' && source[index + 1] === '*') { const end = source.indexOf('*/', index + 2); index = end < 0 ? source.length : end + 2; continue; }
+      if (char === '\\') { index += 2; continue; }
+      if (char === '{') depth++;
+      if (char === '}') depth--;
+      index++;
+    }
+  }
+  return index;
+}
+
+// Small bounded lexical reader: comments and template bodies never count as
+// configuration evidence. No code, regular-expression body or escape is run.
+function tokens(source) {
+  const result = [];
+  for (let i = 0; i < source.length;) {
+    const c = source[i], next = source[i + 1];
+    if (/\s/.test(c)) { i++; continue; }
+    if (c === '/' && next === '/') { while (i < source.length && source[i] !== '\n') i++; continue; }
+    if (c === '/' && next === '*') { const end = source.indexOf('*/', i + 2); i = end < 0 ? source.length : end + 2; continue; }
+    if (c === '/' && (!result.length || ['=', '(', ':', ',', '[', '{', '!', '?', ';', '>', 'return', 'case', 'yield'].includes(result.at(-1)?.value))) {
+      // A regexp may contain quotes, comment-like text and fake source tokens.
+      let inClass = false;
+      for (i++; i < source.length; i++) {
+        if (source[i] === '\\') { i++; continue; }
+        if (source[i] === '[') inClass = true;
+        if (source[i] === ']') inClass = false;
+        if (source[i] === '/' && !inClass) { i++; while (/[a-z]/i.test(source[i] ?? '') && i < source.length) i++; break; }
+        if (source[i] === '\n' || source[i] === '\r') break;
+      }
+      result.push({ type: 'dynamic', value: '' }); continue;
+    }
+    if (c === '`') {
+      i = skipTemplate(source, i);
+      result.push({ type: 'dynamic', value: '' }); continue;
+    }
+    if (c === '"' || c === "'") {
+      let value = '', escaped = false, closed = false;
+      for (i++; i < source.length; i++) {
+        if (source[i] === '\\') { escaped = true; i++; continue; }
+        if (source[i] === c) { i++; closed = true; break; }
+        value += source[i];
+      }
+      result.push({ type: escaped || !closed ? 'dynamic' : 'string', value: escaped || !closed ? '' : value }); continue;
+    }
+    if (/[A-Za-z_$]/.test(c)) {
+      const start = i++;
+      while (i < source.length && /[A-Za-z0-9_$]/.test(source[i])) i++;
+      result.push({ type: 'name', value: source.slice(start, i) }); continue;
+    }
+    result.push({ type: 'punctuation', value: c }); i++;
+  }
+  return result;
+}
+
+function imported(tokenList, moduleName) {
+  return tokenList.some((token, index) => token.type === 'string' && token.value === moduleName && (
+    tokenList[index - 1]?.value === 'from' ||
+    (tokenList[index - 1]?.value === '(' && ['require', 'import'].includes(tokenList[index - 2]?.value))
+  ));
+}
+
+function defaultImport(tokenList, moduleName) {
+  const matches = [];
+  for (let index = 0; index < tokenList.length; index++) {
+    if (tokenList[index]?.value === 'import' && tokenList[index + 1]?.type === 'name' && tokenList[index + 2]?.value === 'from' && tokenList[index + 3]?.type === 'string' && tokenList[index + 3]?.value === moduleName) matches.push(tokenList[index + 1].value);
+  }
+  return matches.length === 1 ? matches[0] : null;
+}
+
+function readObject(list, begin, depth = 0) {
+  const properties = Object.create(null);
+  if (depth > 24) return { properties, opaque: true, end: begin };
+  let index = begin + 1, opaque = false;
+  while (index < list.length && list[index]?.value !== '}') {
+    const key = list[index];
+    if (!['string', 'name'].includes(key?.type) || list[index + 1]?.value !== ':' || key.value === '__proto__' || own(properties, key.value)) return { properties, opaque: true, end: index };
+    index += 2;
+    const start = index;
+    const stack = [];
+    while (index < list.length) {
+      const value = list[index].value;
+      if (!stack.length && [',', '}'].includes(value)) break;
+      if (['{', '[', '('].includes(value)) stack.push(value);
+      if (['}', ']', ')'].includes(value)) {
+        const expected = { '}': '{', ']': '[', ')': '(' }[value];
+        if (stack.pop() !== expected) return { properties, opaque: true, end: index };
+      }
+      index++;
+    }
+    const expression = list.slice(start, index);
+    if (!expression.length) opaque = true;
+    let nested = null;
+    if (expression[0]?.value === '{') {
+      nested = readObject(expression, 0, depth + 1);
+      if (nested.opaque || nested.end !== expression.length - 1) opaque = true;
+    }
+    properties[key.value] = { expression, nested };
+    if (list[index]?.value === ',') index++;
+    else if (list[index]?.value !== '}') opaque = true;
+  }
+  if (list[index]?.value !== '}') opaque = true;
+  return { properties, opaque, end: index };
+}
+
+function adapterCall(config, moduleName, nestedKey) {
+  const binding = defaultImport(config.list, moduleName);
+  const properties = nestedKey ? config.properties[nestedKey]?.nested?.properties : config.properties;
+  const expression = properties?.adapter?.expression;
+  // Resolve the actual configured adapter. Merely importing it is insufficient.
+  return !!binding && !!expression && expression[0]?.type === 'name' && expression[0]?.value === binding && expression[1]?.value === '(' && expression.at(-1)?.value === ')' && !expression.some(token => ['?', '=', '&', '|'].includes(token.value));
+}
+
+/** Only literal exported objects are understood. Computed config stays pending. */
+function literalConfig(source, wrapper) {
+  const list = tokens(source);
+  let begin = -1;
+  for (let i = 0; i < list.length; i++) {
+    if (list[i]?.value === 'export' && list[i + 1]?.value === 'default') begin = i + 2;
+    if (list[i]?.value === 'module' && list[i + 1]?.value === '.' && list[i + 2]?.value === 'exports' && list[i + 3]?.value === '=') begin = i + 4;
+  }
+  if (begin < 0) return { literals: {}, properties: {}, opaque: true, list };
+  if (wrapper && list[begin]?.value === wrapper && list[begin + 1]?.value === '(') begin += 2;
+  if (list[begin]?.value !== '{') return { literals: {}, properties: {}, opaque: true, list };
+  const parsed = readObject(list, begin), literals = {};
+  let opaque = parsed.opaque;
+  for (const key of ['output', 'ssr', 'preset']) {
+    const expression = parsed.properties[key]?.expression;
+    if (!expression) continue;
+    if (expression.length === 1 && (expression[0].type === 'string' || ['true', 'false'].includes(expression[0].value))) literals[key] = expression[0].value;
+    else opaque = true;
+  }
+  // Assignment, a second export or condition after the object can override it.
+  if (list.slice(parsed.end + 1).some(token => ![')', ';'].includes(token.value))) opaque = true;
+  return { literals, properties: parsed.properties, opaque, list };
+}
+
+function dependency(manifest, name, productionOnly = false) {
+  return (productionOnly ? ['dependencies'] : ['dependencies', 'devDependencies']).some(section =>
+    object(manifest?.[section]) && own(manifest[section], name) && typeof manifest[section][name] === 'string');
+}
+function commands(manifest) {
+  if (!object(manifest?.scripts)) return [];
+  return ['dev', 'start', 'serve', 'build', 'generate', 'preview'].flatMap(key => typeof manifest.scripts[key] === 'string' && manifest.scripts[key].length <= 8192 ? simpleCommands(manifest.scripts[key]) : []);
+}
+
+// Understand ordinary command boundaries and quoted words, never shell
+// expansion/substitution. Text printed by `echo "next build"` is not a command.
+function simpleCommands(source) {
+  const result = [];
+  let command = [], word = '', quote = null, dynamic = false;
+  const endWord = () => { if (word) command.push(word); word = ''; };
+  const endCommand = () => { endWord(); if (command.length && !dynamic) result.push(command); command = []; dynamic = false; };
+  for (let index = 0; index < source.length; index++) {
+    const value = source[index];
+    if (value === '\\' || value === '$' || value === '`' || value === '(' || value === ')') dynamic = true;
+    if (quote) { if (value === quote) quote = null; else word += value; continue; }
+    if (value === '"' || value === "'") { quote = value; continue; }
+    if ([';', '&', '|', '\n', '\r'].includes(value)) { endCommand(); continue; }
+    if (/\s/.test(value)) { endWord(); continue; }
+    if (value === '#') { endCommand(); break; }
+    word += value;
+  }
+  if (quote) dynamic = true;
+  endCommand();
+  return result;
+}
+function commandUsed(scripts, command, operation = '[a-z-]+') {
+  return scripts.some(words => new RegExp(`^(?:${command})$`).test(words[0]) && new RegExp(`^(?:${operation})$`).test(words[1] ?? ''));
+}
+
+// Only known execution-preserving Node options may precede a server entry.
+// Unknown flags and eval, print, check, preload or loader modes stay pending;
+// skipping arbitrary option values could mistake code or another file for it.
+const nodeEntryFlags = new Set([
+  '--enable-source-maps', '--watch', '--watch-preserve-output',
+  '--no-warnings', '--trace-warnings', '--trace-uncaught',
+]);
+const nodeCondition = /^[A-Za-z0-9][A-Za-z0-9_.:-]*$/;
+function invokesServerEntry(words, entry) {
+  const matches = value => value === entry || value === `./${entry}`;
+  if (['tsx', 'ts-node'].includes(words[0])) return matches(words[1]);
+  if (words[0] !== 'node') return false;
+  for (let index = 1; index < words.length; index++) {
+    const option = words[index];
+    if (option === '--') return matches(words[index + 1]);
+    if (!option.startsWith('-')) return matches(option);
+    if (nodeEntryFlags.has(option)) continue;
+    if (option.startsWith('--conditions=')) {
+      if (!nodeCondition.test(option.slice('--conditions='.length))) return false;
+      continue;
+    }
+    if (option === '--conditions' || option === '-C') {
+      if (!nodeCondition.test(words[index + 1] ?? '')) return false;
+      index++;
+      continue;
+    }
+    return false;
+  }
+  return false;
+}
+
+function composerRequires(manifest, name) {
+  return object(manifest?.require) && own(manifest.require, name) && typeof manifest.require[name] === 'string';
+}
+function evidenceAllowed(file, signal) {
+  if (!allowedFiles.has(file) || !signalNames.has(signal)) return false;
+  if ([S.react, S.vue, S.angular, S.next, S.nuxt, S.astro, S.svelte, S.nuxtStatic].includes(signal)) return file === 'package.json';
+  if ([S.laravel, S.wordpress, S.php].includes(signal)) return file === 'composer.json';
+  if (signal === S.python) return ['requirements.txt', 'pyproject.toml'].includes(file);
+  if (signal === S.ruby) return file === 'Gemfile';
+  if (signal === S.java) return ['pom.xml', 'build.gradle', 'build.gradle.kts'].includes(file);
+  if (signal === S.node) return nodeEntries.includes(file);
+  if (signal === S.monorepo) return ['package.json', 'pnpm-workspace.yaml'].includes(file);
+  if (signal === S.nextStatic) return configNames('next').includes(file);
+  if ([S.astroStatic, S.astroServer].includes(signal)) return configNames('astro').includes(file);
+  if ([S.svelteStatic, S.svelteNode].includes(signal)) return configNames('svelte').includes(file);
+  return signal === S.dynamic && ['next', 'nuxt', 'astro', 'svelte'].some(name => configNames(name).includes(file));
+}
+
+function classify(evidence, invalid = false) {
+  const has = signal => evidence.some(item => item.signal === signal);
+  const frontends = [[S.react, 'React'], [S.vue, 'Vue'], [S.angular, 'Angular']].filter(([signal]) => has(signal)).map(([, name]) => name);
+  let frontend = frontends.length === 1 ? frontends[0] : frontends.length ? 'Unknown' : 'None';
+  const frameworks = [[S.next, 'Next.js'], [S.nuxt, 'Nuxt'], [S.astro, 'Astro'], [S.svelte, 'SvelteKit'], [S.laravel, 'Laravel'], [S.wordpress, 'WordPress']].filter(([signal]) => has(signal)).map(([, name]) => name);
+  // Laravel's React/Vue asset packages do not make its PHP backend into Node.
+  let framework = frameworks.length === 1 ? frameworks[0] : frameworks.length ? 'Custom' : frontends.length === 1 ? frontend : 'Custom';
+  if (framework === 'Next.js' && frontend === 'None') frontend = 'React';
+  if (framework === 'Nuxt' && frontend === 'None') frontend = 'Vue';
+  if (framework === 'SvelteKit' && frontend === 'None') frontend = 'Unknown';
+  const warnings = [];
+  const backends = new Set();
+  if ([S.laravel, S.wordpress, S.php].some(has)) backends.add('php');
+  if (has(S.python)) backends.add('python');
+  if (has(S.ruby)) backends.add('ruby');
+  if (has(S.java)) backends.add('java');
+  if (has(S.node)) backends.add('node');
+  let backend = backends.size === 1 ? [...backends][0] : 'unknown';
+  let runtime = null, rendering = 'unknown';
+  const staticMode = has(S.nextStatic) || has(S.astroStatic) || has(S.svelteStatic) || has(S.nuxtStatic);
+  const serverMode = has(S.node) || has(S.astroServer) || has(S.svelteNode);
+  const inferredNode = (framework === 'Next.js' || framework === 'Nuxt') && !staticMode;
+  if ((serverMode || inferredNode) && backends.size && !backends.has('node')) backends.add('node');
+  const configKinds = new Set(evidence.filter(item => [S.nextStatic, S.astroStatic, S.astroServer, S.svelteStatic, S.svelteNode].includes(item.signal)).map(item => item.signal));
+  const conflict = frameworks.length > 1 || backends.size > 1 || (staticMode && (serverMode || backends.size > 0)) || configKinds.size > 1;
+  if (invalid) warnings.push(W.invalid);
+  if (has(S.monorepo)) warnings.push(W.monorepo);
+  if (conflict) warnings.push(W.conflict);
+  if (has(S.dynamic)) warnings.push(W.dynamic);
+  if (!warnings.length) {
+    if (staticMode) { backend = 'none'; runtime = 'static'; rendering = 'static'; }
+    else if (serverMode || inferredNode) { backend = 'node'; runtime = 'node'; rendering = 'server'; }
+    else if (['php', 'python', 'ruby', 'java'].includes(backend)) { runtime = 'rest'; rendering = 'server'; }
+  }
+  if (conflict) { backend = 'unknown'; if (frameworks.length > 1) framework = 'Custom'; }
+  if (!runtime) {
+    if (frontends.length && !backends.size && !frameworks.length) warnings.push(W.frontend);
+    warnings.push(W.unknown);
+  } else warnings.push(W.unverified);
+  return { version: 1, status: runtime ? 'detected' : 'needs-developer', frontend, framework, backend, runtime, rendering, evidence, warnings };
+}
+
+/** @param {Record<string, string>} files Exact allowlisted project-relative names. */
+export function analyzeProjectFiles(files) {
+  const evidence = [], selected = Object.create(null);
+  let total = 0, invalid = !object(files);
+  const add = (file, signal) => { if (!evidence.some(item => item.file === file && item.signal === signal)) evidence.push({ file, signal }); };
+  for (const name of PROJECT_ANALYSIS_FILES) {
+    if (!object(files) || !own(files, name)) continue;
+    const descriptor = Object.getOwnPropertyDescriptor(files, name);
+    const value = descriptor?.value;
+    if (typeof value !== 'string' || value.length > MAX_ANALYSIS_FILE_BYTES || byteLength(value) > MAX_ANALYSIS_FILE_BYTES) { invalid = true; continue; }
+    total += byteLength(value);
+    if (total > MAX_ANALYSIS_TOTAL_BYTES) { invalid = true; continue; }
+    selected[name] = value;
+  }
+  const json = name => {
+    if (!own(selected, name)) return null;
+    try { const value = JSON.parse(selected[name]); if (!object(value)) throw Error(); return value; }
+    catch { invalid = true; return null; }
+  };
+  const pkg = json('package.json'), composer = json('composer.json'), scripts = commands(pkg);
+  if (pkg && own(pkg, 'workspaces') && ((Array.isArray(pkg.workspaces) && pkg.workspaces.length) || (object(pkg.workspaces) && Object.keys(pkg.workspaces).length))) add('package.json', S.monorepo);
+  if (selected['pnpm-workspace.yaml'] && /^\s*packages\s*:/m.test(selected['pnpm-workspace.yaml'])) add('pnpm-workspace.yaml', S.monorepo);
+  if (dependency(pkg, 'react')) add('package.json', S.react);
+  if (dependency(pkg, 'vue')) add('package.json', S.vue);
+  if (dependency(pkg, '@angular/core')) add('package.json', S.angular);
+  if (dependency(pkg, 'next') && commandUsed(scripts, 'next', '(?:dev|build|start)')) add('package.json', S.next);
+  if (dependency(pkg, 'nuxt') && commandUsed(scripts, '(?:nuxt|nuxi)', '(?:dev|build|start|generate|preview)')) add('package.json', S.nuxt);
+  if (dependency(pkg, 'astro') && commandUsed(scripts, 'astro', '(?:dev|build|preview)')) add('package.json', S.astro);
+  if (dependency(pkg, '@sveltejs/kit') && commandUsed(scripts, '(?:vite|svelte-kit)', '(?:dev|build|preview)')) add('package.json', S.svelte);
+  if (composerRequires(composer, 'laravel/framework')) add('composer.json', S.laravel);
+  else if (['johnpbloch/wordpress', 'roots/wordpress', 'roots/wordpress-core'].some(name => composerRequires(composer, name))) add('composer.json', S.wordpress);
+  if (composerRequires(composer, 'php')) add('composer.json', S.php);
+  for (const name of ['requirements.txt', 'pyproject.toml']) {
+    const value = selected[name];
+    if (value && (name === 'requirements.txt' ? /^\s*(?:django|flask|fastapi)(?:\[[a-z, -]+\])?\s*(?:[=<>!~;]|$)/im.test(value.replace(/^\s*#.*$/gm, '')) : /(?:^\s*(?:django|flask|fastapi)\s*=|["'](?:django|flask|fastapi)(?:[=<>!~]|["']))/im.test(value.replace(/^\s*#.*$/gm, '')))) add(name, S.python);
+  }
+  if (selected.Gemfile && /^\s*gem\s+["']rails["'](?:\s|,|$)/m.test(selected.Gemfile)) add('Gemfile', S.ruby);
+  if (selected['pom.xml'] && /<artifactId>\s*spring-boot-starter(?:-[a-z-]+)?\s*<\/artifactId>/.test(selected['pom.xml'].replace(/<!--[\s\S]*?-->/g, ''))) add('pom.xml', S.java);
+  for (const name of ['build.gradle', 'build.gradle.kts']) if (selected[name] && tokens(selected[name]).some(token => token.type === 'string' && token.value.startsWith('org.springframework.boot:spring-boot-starter'))) add(name, S.java);
+
+  for (const name of nodeEntries) {
+    if (!own(selected, name)) continue;
+    if (!scripts.some(words => invokesServerEntry(words, name))) continue;
+    const list = tokens(selected[name]);
+    const serverImports = ['express', 'fastify', 'koa', 'h3'].some(name => dependency(pkg, name, true) && imported(list, name));
+    const httpImports = ['node:http', 'http', 'node:https', 'https'].some(name => imported(list, name));
+    const createsServer = list.some((token, index) => token.value === 'createServer' && list[index + 1]?.value === '(');
+    const listens = list.some((token, index) => token.value === 'listen' && list[index + 1]?.value === '(');
+    if (listens && (serverImports || (httpImports && createsServer))) add(name, S.node);
+  }
+
+  const has = signal => evidence.some(item => item.signal === signal);
+  for (const [name, wrapper, frameworkSignal] of [['next', null, S.next], ['nuxt', 'defineNuxtConfig', S.nuxt], ['astro', 'defineConfig', S.astro], ['svelte', null, S.svelte]]) {
+    if (!has(frameworkSignal)) continue;
+    const found = configNames(name).filter(file => own(selected, file));
+    for (const file of found) {
+      const config = literalConfig(selected[file], wrapper);
+      const { literals, opaque, list } = config;
+      if (opaque || found.length > 1) { add(file, S.dynamic); continue; }
+      if (name === 'next' && literals.output === 'export') add(file, S.nextStatic);
+      if (name === 'next' && literals.output && !['export', 'standalone'].includes(literals.output)) add(file, S.dynamic);
+      if (name === 'nuxt' && (literals.ssr === 'false' || list.some(token => token.value === 'preset'))) add(file, S.dynamic);
+      if (name === 'astro') {
+        if (literals.output === 'static') add(file, S.astroStatic);
+        else if (literals.output === 'server' && dependency(pkg, '@astrojs/node') && adapterCall(config, '@astrojs/node')) add(file, S.astroServer);
+        else add(file, S.dynamic);
+      }
+      if (name === 'svelte') {
+        const staticAdapter = dependency(pkg, '@sveltejs/adapter-static') && adapterCall(config, '@sveltejs/adapter-static', 'kit');
+        const nodeAdapter = dependency(pkg, '@sveltejs/adapter-node') && adapterCall(config, '@sveltejs/adapter-node', 'kit');
+        if (staticAdapter) add(file, S.svelteStatic);
+        if (nodeAdapter) add(file, S.svelteNode);
+        if (!staticAdapter && !nodeAdapter) add(file, S.dynamic);
+      }
+    }
+  }
+  if (has(S.nuxt) && commandUsed(scripts, '(?:nuxt|nuxi)', 'generate') && !commandUsed(scripts, '(?:nuxt|nuxi)', '(?:start|preview)') && !scripts.some(words => words[0] === 'node')) add('package.json', S.nuxtStatic);
+  return classify(evidence, invalid);
+}
+
+/** Strict imported-report validation: arbitrary text and inconsistent advice fail closed. */
+export function validateProjectAnalysis(value) {
+  const keys = ['version', 'status', 'frontend', 'framework', 'backend', 'runtime', 'rendering', 'evidence', 'warnings'];
+  if (!object(value) || ![1, 2].includes(value.version) || !exactKeys(value, value.version === 2 ? [...keys, 'diagnostics'] : keys)) return null;
+  const diagnostics = value.version === 2 ? validateDependencyDiagnostics(value.diagnostics) : null;
+  if (value.version === 2 && !diagnostics) return null;
+  if (!Array.isArray(value.evidence) || value.evidence.length > 64 || !Array.isArray(value.warnings) || value.warnings.length > 8) return null;
+  const evidence = [], seen = new Set();
+  for (const item of value.evidence) {
+    if (!exactKeys(item, ['file', 'signal']) || typeof item.file !== 'string' || typeof item.signal !== 'string' || !evidenceAllowed(item.file, item.signal)) return null;
+    const identity = `${item.file}:${item.signal}`;
+    if (seen.has(identity)) return null;
+    seen.add(identity); evidence.push({ file: item.file, signal: item.signal });
+  }
+  if (value.warnings.some(warning => typeof warning !== 'string' || !warningNames.has(warning)) || new Set(value.warnings).size !== value.warnings.length) return null;
+  const has = signal => evidence.some(item => item.signal === signal);
+  if ((has(S.nextStatic) && !has(S.next)) || ((has(S.astroStatic) || has(S.astroServer)) && !has(S.astro)) || ((has(S.svelteStatic) || has(S.svelteNode)) && !has(S.svelte)) || (has(S.nuxtStatic) && !has(S.nuxt))) return null;
+  for (const item of evidence) if (item.signal === S.dynamic) {
+    const needed = [['next', S.next], ['nuxt', S.nuxt], ['astro', S.astro], ['svelte', S.svelte]].find(([name]) => configNames(name).includes(item.file))?.[1];
+    if (!needed || !has(needed)) return null;
+  }
+  const expected = classify(evidence, value.warnings.includes(W.invalid));
+  for (const key of ['status', 'frontend', 'framework', 'backend', 'runtime', 'rendering']) if (value[key] !== expected[key]) return null;
+  if (JSON.stringify(value.warnings) !== JSON.stringify(expected.warnings)) return null;
+  return diagnostics ? { ...expected, version: 2, diagnostics } : expected;
+}
+
+/** Framework identity may be clear even when a frontend's backend is still unknown. */
+export function detectedProjectFramework(value) {
+  const report = validateProjectAnalysis(value);
+  if (!report || report.framework === 'Custom' || report.warnings.some(warning => [W.invalid, W.monorepo, W.conflict, W.dynamic].includes(warning))) return null;
+  return report.framework;
+}