@universalcms/connect 0.0.0-stage → 0.13.0

package/dist/vendor/project-analysis.mjs

@@ -0,0 +1,498 @@
+import { validateDependencyDiagnostics } from './dependency-diagnostics.mjs';
+
+/**
+ * Local project evidence only. This module runs in browsers and Node without
+ * executing a project's scripts, importing its modules, or contacting a URL.
+ * Reports are integration advice, never authorization or connection proof.
+ */
+export const MAX_ANALYSIS_FILE_BYTES = 128 * 1024;
+export const MAX_ANALYSIS_TOTAL_BYTES = 1024 * 1024;
+const configNames = (name) => ['js', 'mjs', 'cjs', 'ts'].map(extension => `${name}.config.${extension}`);
+const nodeEntries = ['server.js', 'server.mjs', 'server.cjs', 'server.ts', 'app.js', 'app.mjs', 'index.js', 'index.mjs', 'server/index.js', 'server/index.mjs', 'server/index.cjs', 'server/index.ts', 'src/server.js', 'src/server.mjs', 'src/server.ts'];
+export const PROJECT_ANALYSIS_FILES = Object.freeze([
+  'package.json', 'composer.json', 'pnpm-workspace.yaml', 'angular.json',
+  'requirements.txt', 'pyproject.toml', 'Gemfile', 'pom.xml', 'build.gradle', 'build.gradle.kts',
+  ...configNames('next'), ...configNames('nuxt'), ...configNames('astro'), ...configNames('svelte'), ...configNames('vite'),
+  ...nodeEntries,
+]);
+export const PROJECT_ANALYSIS_SIGNALS = Object.freeze({
+  react: 'React dependency', vue: 'Vue dependency', angular: 'Angular dependency',
+  next: 'Next.js dependency and framework command', nuxt: 'Nuxt dependency and framework command',
+  astro: 'Astro dependency and framework command', svelte: 'SvelteKit dependency and framework command',
+  laravel: 'Laravel production Composer dependency', wordpress: 'WordPress production Composer dependency',
+  php: 'PHP runtime Composer requirement', python: 'Python web framework dependency',
+  ruby: 'Ruby on Rails dependency', java: 'Java Spring Boot dependency',
+  node: 'Node server entry, server imports and startup command',
+  nextStatic: 'Literal Next.js static export configuration', astroStatic: 'Literal Astro static output configuration',
+  astroServer: 'Literal Astro server output with Node adapter',
+  nuxtStatic: 'Nuxt generate command without a server startup command',
+  svelteStatic: 'SvelteKit static adapter configuration', svelteNode: 'SvelteKit Node adapter configuration',
+  monorepo: 'Multiple project workspace declaration', dynamic: 'Configuration needs developer inspection',
+});
+export const PROJECT_ANALYSIS_WARNINGS = Object.freeze({
+  unknown: 'A backend or build-time content integration could not be established. Ask the website developer to complete setup.',
+  monorepo: 'This folder contains a workspace. Analyze the individual website project folder instead.',
+  conflict: 'Conflicting framework or backend evidence needs developer review.',
+  invalid: 'A selected project file is invalid or exceeds the analysis limits. Ask the developer to check the project files.',
+  dynamic: 'A configuration uses values that cannot be resolved safely without running code. Ask the developer to confirm the deployment runtime.',
+  frontend: 'A frontend dependency does not identify its backend. Node.js build tools alone are not a Node.js website server.',
+  unverified: 'This identifies project configuration only. Credentials, deployment and CMS connectivity still need verification.',
+});
+const S = PROJECT_ANALYSIS_SIGNALS, W = PROJECT_ANALYSIS_WARNINGS;
+const own = (value, key) => Object.prototype.hasOwnProperty.call(value, key);
+const object = value => value !== null && typeof value === 'object' && !Array.isArray(value);
+const byteLength = value => new TextEncoder().encode(value).byteLength;
+const exactKeys = (value, keys) => object(value) && Object.keys(value).length === keys.length && Object.keys(value).every(key => keys.includes(key));
+const signalNames = new Set(Object.values(S));
+const warningNames = new Set(Object.values(W));
+const allowedFiles = new Set(PROJECT_ANALYSIS_FILES);
+
+function skipQuoted(source, begin, quote) {
+  let index = begin + 1;
+  while (index < source.length) {
+    if (source[index] === '\\') { index += 2; continue; }
+    if (source[index++] === quote) break;
+  }
+  return index;
+}
+
+function skipTemplate(source, begin, nesting = 0) {
+  if (nesting > 24) return source.length;
+  let index = begin + 1;
+  while (index < source.length) {
+    if (source[index] === '\\') { index += 2; continue; }
+    if (source[index] === '`') return index + 1;
+    if (source[index] !== '$' || source[index + 1] !== '{') { index++; continue; }
+    index += 2;
+    let depth = 1;
+    while (index < source.length && depth) {
+      const char = source[index];
+      if (char === '"' || char === "'") { index = skipQuoted(source, index, char); continue; }
+      if (char === '`') { index = skipTemplate(source, index, nesting + 1); continue; }
+      if (char === '/' && source[index + 1] === '/') { while (index < source.length && source[index] !== '\n') index++; continue; }
+      if (char === '/' && source[index + 1] === '*') { const end = source.indexOf('*/', index + 2); index = end < 0 ? source.length : end + 2; continue; }
+      if (char === '\\') { index += 2; continue; }
+      if (char === '{') depth++;
+      if (char === '}') depth--;
+      index++;
+    }
+  }
+  return index;
+}
+
+// Small bounded lexical reader: comments and template bodies never count as
+// configuration evidence. No code, regular-expression body or escape is run.
+function tokens(source) {
+  const result = [];
+  for (let i = 0; i < source.length;) {
+    const c = source[i], next = source[i + 1];
+    if (/\s/.test(c)) { i++; continue; }
+    if (c === '/' && next === '/') { while (i < source.length && source[i] !== '\n') i++; continue; }
+    if (c === '/' && next === '*') { const end = source.indexOf('*/', i + 2); i = end < 0 ? source.length : end + 2; continue; }
+    if (c === '/' && (!result.length || ['=', '(', ':', ',', '[', '{', '!', '?', ';', '>', 'return', 'case', 'yield'].includes(result.at(-1)?.value))) {
+      // A regexp may contain quotes, comment-like text and fake source tokens.
+      let inClass = false, closed = false;
+      for (i++; i < source.length; i++) {
+        if (source[i] === '\\') { i++; continue; }
+        if (source[i] === '[') inClass = true;
+        if (source[i] === ']') inClass = false;
+        if (source[i] === '/' && !inClass) { closed = true; i++; while (/[a-z]/i.test(source[i] ?? '') && i < source.length) i++; break; }
+        if (source[i] === '\n' || source[i] === '\r') break;
+      }
+      result.push({ type: closed ? 'regexp' : 'dynamic', value: '' }); continue;
+    }
+    if (c === '`') {
+      i = skipTemplate(source, i);
+      result.push({ type: 'dynamic', value: '' }); continue;
+    }
+    if (c === '"' || c === "'") {
+      let value = '', escaped = false, closed = false;
+      for (i++; i < source.length; i++) {
+        if (source[i] === '\\') { escaped = true; i++; continue; }
+        if (source[i] === c) { i++; closed = true; break; }
+        value += source[i];
+      }
+      result.push({ type: escaped || !closed ? 'dynamic' : 'string', value: escaped || !closed ? '' : value }); continue;
+    }
+    if (/[A-Za-z_$]/.test(c)) {
+      const start = i++;
+      while (i < source.length && /[A-Za-z0-9_$]/.test(source[i])) i++;
+      result.push({ type: 'name', value: source.slice(start, i) }); continue;
+    }
+    if (/\d/.test(c)) {
+      const value = source.slice(i).match(/^\d+(?:\.\d*)?(?:[eE][+-]?\d+)?/)[0];
+      result.push({ type: 'number', value }); i += value.length; continue;
+    }
+    result.push({ type: 'punctuation', value: c }); i++;
+  }
+  return result;
+}
+
+function imported(tokenList, moduleName) {
+  return tokenList.some((token, index) => token.type === 'string' && token.value === moduleName && (
+    tokenList[index - 1]?.value === 'from' ||
+    (tokenList[index - 1]?.value === '(' && ['require', 'import'].includes(tokenList[index - 2]?.value))
+  ));
+}
+
+function defaultImport(tokenList, moduleName) {
+  const matches = [];
+  for (let index = 0; index < tokenList.length; index++) {
+    if (tokenList[index]?.value === 'import' && tokenList[index + 1]?.type === 'name' && tokenList[index + 2]?.value === 'from' && tokenList[index + 3]?.type === 'string' && tokenList[index + 3]?.value === moduleName) matches.push(tokenList[index + 1].value);
+  }
+  return matches.length === 1 ? matches[0] : null;
+}
+
+function readObject(list, begin, depth = 0) {
+  const properties = Object.create(null);
+  if (depth > 24) return { properties, opaque: true, end: begin };
+  let index = begin + 1, opaque = false;
+  while (index < list.length && list[index]?.value !== '}') {
+    const key = list[index];
+    if (!['string', 'name'].includes(key?.type) || list[index + 1]?.value !== ':' || key.value === '__proto__' || own(properties, key.value)) return { properties, opaque: true, end: index };
+    index += 2;
+    const start = index;
+    const stack = [];
+    while (index < list.length) {
+      const value = list[index].value;
+      if (!stack.length && [',', '}'].includes(value)) break;
+      if (['{', '[', '('].includes(value)) stack.push(value);
+      if (['}', ']', ')'].includes(value)) {
+        const expected = { '}': '{', ']': '[', ')': '(' }[value];
+        if (stack.pop() !== expected) return { properties, opaque: true, end: index };
+      }
+      index++;
+    }
+    const expression = list.slice(start, index);
+    if (!expression.length) opaque = true;
+    let nested = null;
+    if (expression[0]?.value === '{') {
+      nested = readObject(expression, 0, depth + 1);
+      if (nested.opaque || nested.end !== expression.length - 1) opaque = true;
+    }
+    properties[key.value] = { expression, nested };
+    if (list[index]?.value === ',') index++;
+    else if (list[index]?.value !== '}') opaque = true;
+  }
+  if (list[index]?.value !== '}') opaque = true;
+  return { properties, opaque, end: index };
+}
+
+function adapterCall(config, moduleName, nestedKey) {
+  const binding = defaultImport(config.list, moduleName);
+  const properties = nestedKey ? config.properties[nestedKey]?.nested?.properties : config.properties;
+  const expression = properties?.adapter?.expression;
+  // Resolve the actual configured adapter. Merely importing it is insufficient.
+  return !!binding && !!expression && expression[0]?.type === 'name' && expression[0]?.value === binding && expression[1]?.value === '(' && expression.at(-1)?.value === ')' && !expression.some(token => ['?', '=', '&', '|'].includes(token.value));
+}
+
+/** Only literal exported objects are understood. Computed config stays pending. */
+function literalConfig(source, wrapper) {
+  const list = tokens(source);
+  let begin = -1;
+  for (let i = 0; i < list.length; i++) {
+    if (list[i]?.value === 'export' && list[i + 1]?.value === 'default') begin = i + 2;
+    if (list[i]?.value === 'module' && list[i + 1]?.value === '.' && list[i + 2]?.value === 'exports' && list[i + 3]?.value === '=') begin = i + 4;
+  }
+  if (begin < 0) return { literals: {}, properties: {}, opaque: true, list };
+  if (wrapper && list[begin]?.value === wrapper && list[begin + 1]?.value === '(') begin += 2;
+  let aliasEnd = null;
+  // create-next-app emits a typed const followed by `export default config`.
+  // Resolve that one inert alias, never a function call, mutable assignment,
+  // imported runtime value, second declaration or conditional configuration.
+  if (!wrapper && list[begin]?.type === 'name' && list[begin - 1]?.value === 'default') {
+    const name = list[begin].value, declaration = list.findIndex(token => token.value === 'const');
+    const prefix = list.slice(0, declaration);
+    const typeImport = prefix.length === 0 || prefix[0]?.value === 'import' && prefix[1]?.value === 'type' && prefix.filter(token => token.value === 'import').length === 1 && prefix.filter(token => token.value === 'from').length === 1 && prefix.at(-1)?.value === ';' && prefix.at(-2)?.type === 'string' && prefix.at(-2)?.value === 'next' && prefix.at(-3)?.value === 'from' && prefix.slice(2,-3).every(token => token.type === 'name' || ['{','}',','].includes(token.value));
+    let initial = declaration + 2;
+    if (list[initial]?.value === ':') {
+      initial++;
+      // Ordinary type names only. Types are erased, not executed.
+      if (list[initial]?.type !== 'name') initial = -1;
+      else { initial++; while (list[initial]?.value === '.' && list[initial + 1]?.type === 'name') initial += 2; }
+    }
+    const tail = list.slice(begin + 1);
+    if (declaration < 0 || !typeImport || list[declaration + 1]?.value !== name || list[initial]?.value !== '=' || list[initial + 1]?.value !== '{' || tail.some(token => token.value !== ';')) return { literals: {}, properties: {}, opaque: true, list };
+    aliasEnd = begin - 2;
+    begin = initial + 1;
+  }
+  if (list[begin]?.value !== '{') return { literals: {}, properties: {}, opaque: true, list };
+  const parsed = readObject(list, begin), literals = {};
+  let opaque = parsed.opaque;
+  if (aliasEnd !== null) {
+    const literal = (expression, key, depth = 0) => {
+      if (depth > 24 || !expression.length) return false;
+      if (expression.length === 1) return ['string','number'].includes(expression[0].type) || ['true','false','null'].includes(expression[0].value) || key === 'htmlLimitedBots' && expression[0].type === 'regexp';
+      if (expression.length === 2 && ['-','+'].includes(expression[0].value) && expression[1].type === 'number') return true;
+      if (expression[0]?.value === '{') {
+        const object = readObject(expression,0,depth + 1);
+        return !object.opaque && object.end === expression.length - 1 && Object.entries(object.properties).every(([name, property]) => literal(property.expression,name,depth + 1));
+      }
+      if (expression[0]?.value === '[' && expression.at(-1)?.value === ']') {
+        let start = 1, nesting = 0;
+        for (let index = 1; index < expression.length; index++) {
+          const value = expression[index].value;
+          if (index === expression.length - 1 || value === ',' && nesting === 0) {
+            if (start !== index && !literal(expression.slice(start,index),key,depth + 1)) return false;
+            if (start === index && index !== expression.length - 1) return false;
+            start = index + 1;
+          } else if (['{','['].includes(value)) nesting++;
+          else if (['}',']'].includes(value)) nesting--;
+          else if (['(',')'].includes(value)) return false;
+          if (nesting < 0) return false;
+        }
+        return nesting === 0;
+      }
+      return false;
+    };
+    if (list.slice(parsed.end + 1,aliasEnd).some(token => token.value !== ';') || !Object.entries(parsed.properties).every(([name, property]) => literal(property.expression,name))) opaque = true;
+  }
+  for (const key of ['output', 'ssr', 'preset']) {
+    const expression = parsed.properties[key]?.expression;
+    if (!expression) continue;
+    if (expression.length === 1 && (expression[0].type === 'string' || ['true', 'false'].includes(expression[0].value))) literals[key] = expression[0].value;
+    else opaque = true;
+  }
+  // Assignment, a second export or condition after the object can override it.
+  if (aliasEnd === null && list.slice(parsed.end + 1).some(token => ![')', ';'].includes(token.value))) opaque = true;
+  return { literals, properties: parsed.properties, opaque, list };
+}
+
+function dependency(manifest, name, productionOnly = false) {
+  return (productionOnly ? ['dependencies'] : ['dependencies', 'devDependencies']).some(section =>
+    object(manifest?.[section]) && own(manifest[section], name) && typeof manifest[section][name] === 'string');
+}
+function commands(manifest) {
+  if (!object(manifest?.scripts)) return [];
+  return ['dev', 'start', 'serve', 'build', 'generate', 'preview'].flatMap(key => typeof manifest.scripts[key] === 'string' && manifest.scripts[key].length <= 8192 ? simpleCommands(manifest.scripts[key]) : []);
+}
+
+// Understand ordinary command boundaries and quoted words, never shell
+// expansion/substitution. Text printed by `echo "next build"` is not a command.
+function simpleCommands(source) {
+  const result = [];
+  let command = [], word = '', quote = null, dynamic = false;
+  const endWord = () => { if (word) command.push(word); word = ''; };
+  const endCommand = () => { endWord(); if (command.length && !dynamic) result.push(command); command = []; dynamic = false; };
+  for (let index = 0; index < source.length; index++) {
+    const value = source[index];
+    if (value === '\\' || value === '$' || value === '`' || value === '(' || value === ')') dynamic = true;
+    if (quote) { if (value === quote) quote = null; else word += value; continue; }
+    if (value === '"' || value === "'") { quote = value; continue; }
+    if ([';', '&', '|', '\n', '\r'].includes(value)) { endCommand(); continue; }
+    if (/\s/.test(value)) { endWord(); continue; }
+    if (value === '#') { endCommand(); break; }
+    word += value;
+  }
+  if (quote) dynamic = true;
+  endCommand();
+  return result;
+}
+function commandUsed(scripts, command, operation = '[a-z-]+') {
+  return scripts.some(words => new RegExp(`^(?:${command})$`).test(words[0]) && new RegExp(`^(?:${operation})$`).test(words[1] ?? ''));
+}
+
+// Only known execution-preserving Node options may precede a server entry.
+// Unknown flags and eval, print, check, preload or loader modes stay pending;
+// skipping arbitrary option values could mistake code or another file for it.
+const nodeEntryFlags = new Set([
+  '--enable-source-maps', '--watch', '--watch-preserve-output',
+  '--no-warnings', '--trace-warnings', '--trace-uncaught',
+]);
+const nodeCondition = /^[A-Za-z0-9][A-Za-z0-9_.:-]*$/;
+function invokesServerEntry(words, entry) {
+  const matches = value => value === entry || value === `./${entry}`;
+  if (['tsx', 'ts-node'].includes(words[0])) return matches(words[1]);
+  if (words[0] !== 'node') return false;
+  for (let index = 1; index < words.length; index++) {
+    const option = words[index];
+    if (option === '--') return matches(words[index + 1]);
+    if (!option.startsWith('-')) return matches(option);
+    if (nodeEntryFlags.has(option)) continue;
+    if (option.startsWith('--conditions=')) {
+      if (!nodeCondition.test(option.slice('--conditions='.length))) return false;
+      continue;
+    }
+    if (option === '--conditions' || option === '-C') {
+      if (!nodeCondition.test(words[index + 1] ?? '')) return false;
+      index++;
+      continue;
+    }
+    return false;
+  }
+  return false;
+}
+
+function composerRequires(manifest, name) {
+  return object(manifest?.require) && own(manifest.require, name) && typeof manifest.require[name] === 'string';
+}
+function evidenceAllowed(file, signal) {
+  if (!allowedFiles.has(file) || !signalNames.has(signal)) return false;
+  if ([S.react, S.vue, S.angular, S.next, S.nuxt, S.astro, S.svelte, S.nuxtStatic].includes(signal)) return file === 'package.json';
+  if ([S.laravel, S.wordpress, S.php].includes(signal)) return file === 'composer.json';
+  if (signal === S.python) return ['requirements.txt', 'pyproject.toml'].includes(file);
+  if (signal === S.ruby) return file === 'Gemfile';
+  if (signal === S.java) return ['pom.xml', 'build.gradle', 'build.gradle.kts'].includes(file);
+  if (signal === S.node) return nodeEntries.includes(file);
+  if (signal === S.monorepo) return ['package.json', 'pnpm-workspace.yaml'].includes(file);
+  if (signal === S.nextStatic) return configNames('next').includes(file);
+  if ([S.astroStatic, S.astroServer].includes(signal)) return configNames('astro').includes(file);
+  if ([S.svelteStatic, S.svelteNode].includes(signal)) return configNames('svelte').includes(file);
+  return signal === S.dynamic && ['next', 'nuxt', 'astro', 'svelte'].some(name => configNames(name).includes(file));
+}
+
+function classify(evidence, invalid = false) {
+  const has = signal => evidence.some(item => item.signal === signal);
+  const frontends = [[S.react, 'React'], [S.vue, 'Vue'], [S.angular, 'Angular']].filter(([signal]) => has(signal)).map(([, name]) => name);
+  let frontend = frontends.length === 1 ? frontends[0] : frontends.length ? 'Unknown' : 'None';
+  const frameworks = [[S.next, 'Next.js'], [S.nuxt, 'Nuxt'], [S.astro, 'Astro'], [S.svelte, 'SvelteKit'], [S.laravel, 'Laravel'], [S.wordpress, 'WordPress']].filter(([signal]) => has(signal)).map(([, name]) => name);
+  // Laravel's React/Vue asset packages do not make its PHP backend into Node.
+  let framework = frameworks.length === 1 ? frameworks[0] : frameworks.length ? 'Custom' : frontends.length === 1 ? frontend : 'Custom';
+  if (framework === 'Next.js' && frontend === 'None') frontend = 'React';
+  if (framework === 'Nuxt' && frontend === 'None') frontend = 'Vue';
+  if (framework === 'SvelteKit' && frontend === 'None') frontend = 'Unknown';
+  const warnings = [];
+  const backends = new Set();
+  if ([S.laravel, S.wordpress, S.php].some(has)) backends.add('php');
+  if (has(S.python)) backends.add('python');
+  if (has(S.ruby)) backends.add('ruby');
+  if (has(S.java)) backends.add('java');
+  if (has(S.node)) backends.add('node');
+  let backend = backends.size === 1 ? [...backends][0] : 'unknown';
+  let runtime = null, rendering = 'unknown';
+  const staticMode = has(S.nextStatic) || has(S.astroStatic) || has(S.svelteStatic) || has(S.nuxtStatic);
+  const serverMode = has(S.node) || has(S.astroServer) || has(S.svelteNode);
+  const inferredNode = (framework === 'Next.js' || framework === 'Nuxt') && !staticMode;
+  if ((serverMode || inferredNode) && backends.size && !backends.has('node')) backends.add('node');
+  const configKinds = new Set(evidence.filter(item => [S.nextStatic, S.astroStatic, S.astroServer, S.svelteStatic, S.svelteNode].includes(item.signal)).map(item => item.signal));
+  const conflict = frameworks.length > 1 || backends.size > 1 || (staticMode && (serverMode || backends.size > 0)) || configKinds.size > 1;
+  if (invalid) warnings.push(W.invalid);
+  if (has(S.monorepo)) warnings.push(W.monorepo);
+  if (conflict) warnings.push(W.conflict);
+  if (has(S.dynamic)) warnings.push(W.dynamic);
+  if (!warnings.length) {
+    if (staticMode) { backend = 'none'; runtime = 'static'; rendering = 'static'; }
+    else if (serverMode || inferredNode) { backend = 'node'; runtime = 'node'; rendering = 'server'; }
+    else if (['php', 'python', 'ruby', 'java'].includes(backend)) { runtime = 'rest'; rendering = 'server'; }
+  }
+  if (conflict) { backend = 'unknown'; if (frameworks.length > 1) framework = 'Custom'; }
+  if (!runtime) {
+    if (frontends.length && !backends.size && !frameworks.length) warnings.push(W.frontend);
+    warnings.push(W.unknown);
+  } else warnings.push(W.unverified);
+  return { version: 1, status: runtime ? 'detected' : 'needs-developer', frontend, framework, backend, runtime, rendering, evidence, warnings };
+}
+
+/** @param {Record<string, string>} files Exact allowlisted project-relative names. */
+export function analyzeProjectFiles(files) {
+  const evidence = [], selected = Object.create(null);
+  let total = 0, invalid = !object(files);
+  const add = (file, signal) => { if (!evidence.some(item => item.file === file && item.signal === signal)) evidence.push({ file, signal }); };
+  for (const name of PROJECT_ANALYSIS_FILES) {
+    if (!object(files) || !own(files, name)) continue;
+    const descriptor = Object.getOwnPropertyDescriptor(files, name);
+    const value = descriptor?.value;
+    if (typeof value !== 'string' || value.length > MAX_ANALYSIS_FILE_BYTES || byteLength(value) > MAX_ANALYSIS_FILE_BYTES) { invalid = true; continue; }
+    total += byteLength(value);
+    if (total > MAX_ANALYSIS_TOTAL_BYTES) { invalid = true; continue; }
+    selected[name] = value;
+  }
+  const json = name => {
+    if (!own(selected, name)) return null;
+    try { const value = JSON.parse(selected[name]); if (!object(value)) throw Error(); return value; }
+    catch { invalid = true; return null; }
+  };
+  const pkg = json('package.json'), composer = json('composer.json'), scripts = commands(pkg);
+  if (pkg && own(pkg, 'workspaces') && ((Array.isArray(pkg.workspaces) && pkg.workspaces.length) || (object(pkg.workspaces) && Object.keys(pkg.workspaces).length))) add('package.json', S.monorepo);
+  if (selected['pnpm-workspace.yaml'] && /^\s*packages\s*:/m.test(selected['pnpm-workspace.yaml'])) add('pnpm-workspace.yaml', S.monorepo);
+  if (dependency(pkg, 'react')) add('package.json', S.react);
+  if (dependency(pkg, 'vue')) add('package.json', S.vue);
+  if (dependency(pkg, '@angular/core')) add('package.json', S.angular);
+  if (dependency(pkg, 'next') && commandUsed(scripts, 'next', '(?:dev|build|start)')) add('package.json', S.next);
+  if (dependency(pkg, 'nuxt') && commandUsed(scripts, '(?:nuxt|nuxi)', '(?:dev|build|start|generate|preview)')) add('package.json', S.nuxt);
+  if (dependency(pkg, 'astro') && commandUsed(scripts, 'astro', '(?:dev|build|preview)')) add('package.json', S.astro);
+  if (dependency(pkg, '@sveltejs/kit') && commandUsed(scripts, '(?:vite|svelte-kit)', '(?:dev|build|preview)')) add('package.json', S.svelte);
+  if (composerRequires(composer, 'laravel/framework')) add('composer.json', S.laravel);
+  else if (['johnpbloch/wordpress', 'roots/wordpress', 'roots/wordpress-core'].some(name => composerRequires(composer, name))) add('composer.json', S.wordpress);
+  if (composerRequires(composer, 'php')) add('composer.json', S.php);
+  for (const name of ['requirements.txt', 'pyproject.toml']) {
+    const value = selected[name];
+    if (value && (name === 'requirements.txt' ? /^\s*(?:django|flask|fastapi)(?:\[[a-z, -]+\])?\s*(?:[=<>!~;]|$)/im.test(value.replace(/^\s*#.*$/gm, '')) : /(?:^\s*(?:django|flask|fastapi)\s*=|["'](?:django|flask|fastapi)(?:[=<>!~]|["']))/im.test(value.replace(/^\s*#.*$/gm, '')))) add(name, S.python);
+  }
+  if (selected.Gemfile && /^\s*gem\s+["']rails["'](?:\s|,|$)/m.test(selected.Gemfile)) add('Gemfile', S.ruby);
+  if (selected['pom.xml'] && /<artifactId>\s*spring-boot-starter(?:-[a-z-]+)?\s*<\/artifactId>/.test(selected['pom.xml'].replace(/<!--[\s\S]*?-->/g, ''))) add('pom.xml', S.java);
+  for (const name of ['build.gradle', 'build.gradle.kts']) if (selected[name] && tokens(selected[name]).some(token => token.type === 'string' && token.value.startsWith('org.springframework.boot:spring-boot-starter'))) add(name, S.java);
+
+  for (const name of nodeEntries) {
+    if (!own(selected, name)) continue;
+    if (!scripts.some(words => invokesServerEntry(words, name))) continue;
+    const list = tokens(selected[name]);
+    const serverImports = ['express', 'fastify', 'koa', 'h3'].some(name => dependency(pkg, name, true) && imported(list, name));
+    const httpImports = ['node:http', 'http', 'node:https', 'https'].some(name => imported(list, name));
+    const createsServer = list.some((token, index) => token.value === 'createServer' && list[index + 1]?.value === '(');
+    const listens = list.some((token, index) => token.value === 'listen' && list[index + 1]?.value === '(');
+    if (listens && (serverImports || (httpImports && createsServer))) add(name, S.node);
+  }
+
+  const has = signal => evidence.some(item => item.signal === signal);
+  for (const [name, wrapper, frameworkSignal] of [['next', null, S.next], ['nuxt', 'defineNuxtConfig', S.nuxt], ['astro', 'defineConfig', S.astro], ['svelte', null, S.svelte]]) {
+    if (!has(frameworkSignal)) continue;
+    const found = configNames(name).filter(file => own(selected, file));
+    for (const file of found) {
+      const config = literalConfig(selected[file], wrapper);
+      const { literals, opaque, list } = config;
+      if (opaque || found.length > 1) { add(file, S.dynamic); continue; }
+      if (name === 'next' && literals.output === 'export') add(file, S.nextStatic);
+      if (name === 'next' && literals.output && !['export', 'standalone'].includes(literals.output)) add(file, S.dynamic);
+      if (name === 'nuxt' && (literals.ssr === 'false' || list.some(token => token.value === 'preset'))) add(file, S.dynamic);
+      if (name === 'astro') {
+        if (literals.output === 'static') add(file, S.astroStatic);
+        else if (literals.output === 'server' && dependency(pkg, '@astrojs/node') && adapterCall(config, '@astrojs/node')) add(file, S.astroServer);
+        else add(file, S.dynamic);
+      }
+      if (name === 'svelte') {
+        const staticAdapter = dependency(pkg, '@sveltejs/adapter-static') && adapterCall(config, '@sveltejs/adapter-static', 'kit');
+        const nodeAdapter = dependency(pkg, '@sveltejs/adapter-node') && adapterCall(config, '@sveltejs/adapter-node', 'kit');
+        if (staticAdapter) add(file, S.svelteStatic);
+        if (nodeAdapter) add(file, S.svelteNode);
+        if (!staticAdapter && !nodeAdapter) add(file, S.dynamic);
+      }
+    }
+  }
+  if (has(S.nuxt) && commandUsed(scripts, '(?:nuxt|nuxi)', 'generate') && !commandUsed(scripts, '(?:nuxt|nuxi)', '(?:start|preview)') && !scripts.some(words => words[0] === 'node')) add('package.json', S.nuxtStatic);
+  return classify(evidence, invalid);
+}
+
+/** Strict imported-report validation: arbitrary text and inconsistent advice fail closed. */
+export function validateProjectAnalysis(value) {
+  const keys = ['version', 'status', 'frontend', 'framework', 'backend', 'runtime', 'rendering', 'evidence', 'warnings'];
+  if (!object(value) || ![1, 2].includes(value.version) || !exactKeys(value, value.version === 2 ? [...keys, 'diagnostics'] : keys)) return null;
+  const diagnostics = value.version === 2 ? validateDependencyDiagnostics(value.diagnostics) : null;
+  if (value.version === 2 && !diagnostics) return null;
+  if (!Array.isArray(value.evidence) || value.evidence.length > 64 || !Array.isArray(value.warnings) || value.warnings.length > 8) return null;
+  const evidence = [], seen = new Set();
+  for (const item of value.evidence) {
+    if (!exactKeys(item, ['file', 'signal']) || typeof item.file !== 'string' || typeof item.signal !== 'string' || !evidenceAllowed(item.file, item.signal)) return null;
+    const identity = `${item.file}:${item.signal}`;
+    if (seen.has(identity)) return null;
+    seen.add(identity); evidence.push({ file: item.file, signal: item.signal });
+  }
+  if (value.warnings.some(warning => typeof warning !== 'string' || !warningNames.has(warning)) || new Set(value.warnings).size !== value.warnings.length) return null;
+  const has = signal => evidence.some(item => item.signal === signal);
+  if ((has(S.nextStatic) && !has(S.next)) || ((has(S.astroStatic) || has(S.astroServer)) && !has(S.astro)) || ((has(S.svelteStatic) || has(S.svelteNode)) && !has(S.svelte)) || (has(S.nuxtStatic) && !has(S.nuxt))) return null;
+  for (const item of evidence) if (item.signal === S.dynamic) {
+    const needed = [['next', S.next], ['nuxt', S.nuxt], ['astro', S.astro], ['svelte', S.svelte]].find(([name]) => configNames(name).includes(item.file))?.[1];
+    if (!needed || !has(needed)) return null;
+  }
+  const expected = classify(evidence, value.warnings.includes(W.invalid));
+  for (const key of ['status', 'frontend', 'framework', 'backend', 'runtime', 'rendering']) if (value[key] !== expected[key]) return null;
+  if (JSON.stringify(value.warnings) !== JSON.stringify(expected.warnings)) return null;
+  return diagnostics ? { ...expected, version: 2, diagnostics } : expected;
+}
+
+/** Framework identity may be clear even when a frontend's backend is still unknown. */
+export function detectedProjectFramework(value) {
+  const report = validateProjectAnalysis(value);
+  if (!report || report.framework === 'Custom' || report.warnings.some(warning => [W.invalid, W.monorepo, W.conflict, W.dynamic].includes(warning))) return null;
+  return report.framework;
+}

package/dist/vendor/react-LICENSE.txt

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) Meta Platforms, Inc. and affiliates.
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.