archsync 1.0.0

package/src/core/requestSigning.js

@@ -0,0 +1,16 @@
+// Request Signing for CLI - Task 77
+const crypto = require('crypto');
+
+function signRequest(body, apiKey) {
+  const bodyStr = typeof body === 'string' ? body : JSON.stringify(body);
+  return crypto.createHmac('sha256', apiKey).update(bodyStr).digest('hex');
+}
+
+function verifySignature(body, signature, apiKey) {
+  const expected = signRequest(body, apiKey);
+  try {
+    return crypto.timingSafeEqual(Buffer.from(signature, 'hex'), Buffer.from(expected, 'hex'));
+  } catch { return false; }
+}
+
+module.exports = { signRequest, verifySignature };

package/src/core/schemaBuilder.js

@@ -0,0 +1,230 @@
+import { v4 as uuidv4, v5 as uuidv5 } from 'uuid';
+
+// Stable namespace UUID for ArchSync CLI node identity
+const ARCHSYNC_NS = '6ba7b810-9dad-11d1-80b4-00c04fd430c8'; // UUID namespace (URL)
+
+// Generate a deterministic UUID from an entity's unique identity key.
+// Same entityType+name+system always → same UUID, across all scans.
+function stableId(entityType, name, system) {
+    return uuidv5(`${entityType}:${name}:${system}`, ARCHSYNC_NS);
+}
+
+function stableEdgeId(sourceId, targetId, relation) {
+    return uuidv5(`${sourceId}→${targetId}:${relation}`, ARCHSYNC_NS);
+}
+
+// Build a unified schema from parsed file results.
+// `extraRelations` carries cross-file relations from the relationship engine
+// (route→controller, frontend→API, …) that must be resolved against the same
+// node identity map as the per-file parser relations.
+// Entity types whose identity is their NAME across the whole system —
+// "GET /api/users" referenced from five frontend files must stay one node.
+// Everything else is file-local: two files can each define `main` or `Button`
+// and they must NOT merge into a single node.
+const MERGE_BY_NAME_TYPES = new Set(['api', 'route', 'mount', 'database']);
+
+export function buildSchema(parsedFiles, config = {}, extraRelations = []) {
+    const nodes = [];
+    const edges = [];
+    const nodeMap = new Map();      // identity key → node
+    const nameIndex = new Map();    // "type:name" → node (system-agnostic fallback)
+    const nameOnlyIndex = new Map();// "name" → node (last-resort fallback — a
+                                    // relation's guessed entityType may be wrong,
+                                    // e.g. an import of a widget typed as 'screen')
+    const fileIndex = new Map();    // "type:name:file" → node (exact resolution)
+
+    const identityOf = (entityType, name, system, sourceFile) =>
+        MERGE_BY_NAME_TYPES.has(entityType)
+            ? stableId(entityType, name, system)
+            : stableId(entityType, `${name}@${sourceFile || ''}`, system);
+
+    for (const fileResult of parsedFiles) {
+        for (const entity of fileResult.entities || []) {
+            const entitySystem = entity.system || config.defaultSystem || 'backend';
+            const entityName = entity.name || entity.text || `Unnamed ${entity.entityType}`;
+            const key = identityOf(entity.entityType, entityName, entitySystem, fileResult.filePath);
+
+            if (nodeMap.has(key)) {
+                // Merge data into existing node
+                const existing = nodeMap.get(key);
+                existing.data = { ...existing.data, ...entity.data };
+                if (entity.metadata) {
+                    existing.metadata = { ...existing.metadata, ...entity.metadata };
+                    if (entity.metadata.tags) {
+                        existing.metadata.tags = [...new Set([...(existing.metadata.tags || []), ...entity.metadata.tags])];
+                    }
+                }
+                continue;
+            }
+
+            const node = {
+                id: key,
+                entityType: entity.entityType,
+                system: entitySystem,
+                text: entityName,
+                x: 100 + nodes.length * 180,
+                y: 100 + (nodes.length % 5) * 120,
+                w: entity.w || 160,
+                h: entity.h || 60,
+                style: { shape: 'rounded', bgId: 'default', textId: 'default' },
+                data: entity.data || {},
+                metadata: {
+                    description: entity.description || '',
+                    tags: entity.tags || [],
+                    sourceFile: fileResult.filePath,
+                    parsedAt: new Date().toISOString(),
+                    ...entity.metadata,
+                },
+                isManual: false,
+            };
+
+            nodes.push(node);
+            nodeMap.set(key, node);
+            const nameKey = `${entity.entityType}:${entityName}`;
+            if (!nameIndex.has(nameKey)) nameIndex.set(nameKey, node);
+            if (!nameOnlyIndex.has(entityName)) nameOnlyIndex.set(entityName, node);
+            fileIndex.set(`${entity.entityType}:${entityName}:${fileResult.filePath}`, node);
+        }
+    }
+
+    // ─── Resolve relations → edges ─────────────────────────────
+    // Relations reference entities by (type, name, system). The system on a
+    // relation is best-effort (parsers/engine may not know it), so fall back
+    // to a name-only lookup before giving up.
+    const resolveNode = (entityType, name, system, sourceFile) => {
+        if (!name) return null;
+        // Exact: (type, name, file) — relations from the import-graph pass
+        // carry source files, which disambiguates same-named entities
+        // (two `main` modules, two `index` files, …).
+        if (entityType && sourceFile) {
+            const scoped = fileIndex.get(`${entityType}:${name}:${sourceFile}`);
+            if (scoped) return scoped;
+        }
+        if (entityType) {
+            const exact = nodeMap.get(identityOf(entityType, name, system || config.defaultSystem || 'backend', sourceFile))
+                || nameIndex.get(`${entityType}:${name}`);
+            if (exact) return exact;
+        }
+        // Last resort: match by name alone. Relations often carry a guessed
+        // entityType (imports default to 'screen') — without this fallback the
+        // edge is silently dropped and the canvas shows no arrow.
+        return nameOnlyIndex.get(name) || null;
+    };
+
+    const allRelations = [
+        ...parsedFiles.flatMap(f => f.relations || []),
+        ...extraRelations,
+    ];
+
+    const seenEdges = new Set();
+    for (const rel of allRelations) {
+        const sourceNode = resolveNode(rel.sourceType, rel.source, rel.sourceSystem, rel.sourceFile);
+        let targetNode = resolveNode(rel.targetType, rel.target, rel.targetSystem, rel.targetFile);
+
+        // Database targets ("Database", "collection:users", model names) are
+        // often referenced by service code without a matching parsed entity —
+        // materialise them so the canvas shows the storage layer.
+        if (sourceNode && !targetNode && ['database', 'model'].includes(rel.targetType)) {
+            const dbSystem = rel.targetSystem || sourceNode.system;
+            const id = stableId(rel.targetType, rel.target, dbSystem);
+            targetNode = {
+                id,
+                entityType: rel.targetType,
+                system: dbSystem,
+                text: rel.target.replace(/^collection:/, ''),
+                x: 100 + nodes.length * 180,
+                y: 100 + (nodes.length % 5) * 120,
+                w: 160,
+                h: 60,
+                style: { shape: 'cylinder', bgId: 'default', textId: 'default' },
+                data: { synthesised: true },
+                metadata: { description: '', tags: [], parsedAt: new Date().toISOString() },
+                isManual: false,
+            };
+            nodes.push(targetNode);
+            nodeMap.set(id, targetNode);
+            nameIndex.set(`${rel.targetType}:${rel.target}`, targetNode);
+        }
+
+        if (!sourceNode || !targetNode || sourceNode.id === targetNode.id) continue;
+
+        const relation = rel.relation || 'uses';
+        const edgeId = stableEdgeId(sourceNode.id, targetNode.id, relation);
+        if (seenEdges.has(edgeId)) continue;
+        seenEdges.add(edgeId);
+        edges.push({
+            id: edgeId,
+            source: sourceNode.id,
+            target: targetNode.id,
+            relation,
+            isCrossSystem: sourceNode.system !== targetNode.system,
+        });
+    }
+
+    const systems = [...new Set(nodes.map(n => n.system))];
+
+    return {
+        // File-level `system` is authoritative for the cross-system merger.
+        // We use the config's defaultSystem (set by `init --framework` or
+        // hand-edited in `.archsync.json`) so the canvas's merger can tag
+        // every node with the correct origin (backend / mobile / web /
+        // admin) without the user having to hand-edit the output.
+        system: config.defaultSystem || 'backend',
+        // Workspace scans contain several systems in one file; the canvas
+        // merger honours per-node `system` when this flag is set.
+        multiSystem: systems.length > 1,
+        systems,
+        nodes,
+        edges,
+        meta: {
+            generatedAt: new Date().toISOString(),
+            source: 'archsync-cli',
+            framework: config.framework || null,
+            fileCount: parsedFiles.length,
+            nodeCount: nodes.length,
+            edgeCount: edges.length,
+        },
+    };
+}
+
+// Compute simple diff between two schemas
+export function diffSchemas(base, incoming) {
+    const diff = { added: [], modified: [], deleted: [], unchanged: [] };
+
+    if (!base && !incoming) return diff;
+    if (!base) {
+        diff.added = (incoming.nodes || []).map(n => ({ ...n, status: 'added' }));
+        return diff;
+    }
+    if (!incoming) {
+        diff.deleted = (base.nodes || []).map(n => ({ ...n, status: 'deleted' }));
+        return diff;
+    }
+
+    const baseMap = new Map((base.nodes || []).map(n => [n.id, n]));
+    const incomingMap = new Map((incoming.nodes || []).map(n => [n.id, n]));
+
+    for (const [id, node] of incomingMap) {
+        if (!baseMap.has(id)) {
+            diff.added.push({ ...node, status: 'added' });
+        } else {
+            const baseNode = baseMap.get(id);
+            const changed = JSON.stringify(baseNode.data) !== JSON.stringify(node.data) ||
+                baseNode.text !== node.text ||
+                baseNode.entityType !== node.entityType;
+            if (changed) {
+                diff.modified.push({ ...node, status: 'modified', previous: baseNode });
+            } else {
+                diff.unchanged.push({ ...node, status: 'unchanged' });
+            }
+        }
+    }
+
+    for (const [id, node] of baseMap) {
+        if (!incomingMap.has(id)) {
+            diff.deleted.push({ ...node, status: 'deleted' });
+        }
+    }
+
+    return diff;
+}

package/src/core/schemaDeduplicator.js

@@ -0,0 +1,54 @@
+// Schema Normalization & Deduplication - Task 121
+'use strict';
+
+function normalizeEntityName(name) {
+  return name
+    .replace(/\.(jsx?|tsx?|py|go|java|rb|php)$/i, '') // strip extensions
+    .replace(/^.*[/\\]/, '') // strip path prefixes
+    .replace(/([a-z])([A-Z])/g, '$1 $2') // PascalCase → words
+    .trim();
+}
+
+function deduplicateNodes(nodes) {
+  const seen = new Map(); // normalizedName → first node
+  const idMap = new Map(); // old id → canonical id
+
+  for (const node of nodes) {
+    const normalized = normalizeEntityName(node.name || node.id);
+    if (seen.has(normalized)) {
+      idMap.set(node.id, seen.get(normalized).id);
+    } else {
+      seen.set(normalized, node);
+      idMap.set(node.id, node.id);
+    }
+  }
+
+  return {
+    nodes: [...seen.values()],
+    idMap,
+  };
+}
+
+function remapEdges(edges, idMap) {
+  const seen = new Set();
+  return edges.reduce((acc, edge) => {
+    const source = idMap.get(edge.source) || edge.source;
+    const target = idMap.get(edge.target) || edge.target;
+    if (source === target) return acc; // skip self-loops from merging
+    const key = `${source}→${target}`;
+    if (seen.has(key)) return acc;
+    seen.add(key);
+    acc.push({ ...edge, source, target });
+    return acc;
+  }, []);
+}
+
+function generateDedupReport(originalNodes, deduplicatedNodes) {
+  return {
+    original: originalNodes.length,
+    merged: originalNodes.length - deduplicatedNodes.length,
+    final: deduplicatedNodes.length,
+  };
+}
+
+module.exports = { normalizeEntityName, deduplicateNodes, remapEdges, generateDedupReport };

package/src/core/supabaseClient.js

@@ -0,0 +1,68 @@
+import fs from 'fs';
+import path from 'path';
+import { createClient } from '@supabase/supabase-js';
+
+const CONFIG_FILE = '.archsync.json';
+
+// Read local config
+export function readConfig(dir = '.') {
+    const configPath = path.resolve(dir, CONFIG_FILE);
+    if (!fs.existsSync(configPath)) return null;
+    return JSON.parse(fs.readFileSync(configPath, 'utf-8'));
+}
+
+// Write local config
+export function writeConfig(config, dir = '.') {
+    const configPath = path.resolve(dir, CONFIG_FILE);
+    fs.writeFileSync(configPath, JSON.stringify(config, null, 2));
+}
+
+// Get authenticated Supabase client from config
+export function getSupabaseClient(config) {
+    if (!config?.supabase?.url || !config?.supabase?.anonKey) {
+        throw new Error('Supabase not configured. Run `archsync init` first.');
+    }
+    return createClient(config.supabase.url, config.supabase.anonKey);
+}
+
+// Push schema commit
+export async function pushSchemaCommit(client, projectId, branch, schemaJson, message, source = 'cli') {
+    const { data, error } = await client.from('schema_commits').insert({
+        project_id: projectId,
+        branch,
+        schema_json: schemaJson,
+        commit_message: message || `CLI push at ${new Date().toISOString()}`,
+        source,
+    }).select().single();
+
+    if (error) throw error;
+    return data;
+}
+
+// Fetch latest schema for branch
+export async function fetchLatestSchema(client, projectId, branch = 'main') {
+    const { data, error } = await client
+        .from('schema_commits')
+        .select('*')
+        .eq('project_id', projectId)
+        .eq('branch', branch)
+        .order('created_at', { ascending: false })
+        .limit(1)
+        .single();
+
+    if (error && error.code !== 'PGRST116') throw error;
+    return data?.schema_json || null;
+}
+
+// Push diff record
+export async function pushSchemaDiff(client, projectId, baseCommitId, incomingCommitId, diffJson) {
+    const { data, error } = await client.from('schema_diffs').insert({
+        project_id: projectId,
+        base_commit_id: baseCommitId,
+        incoming_commit_id: incomingCommitId,
+        diff_json: diffJson,
+    }).select().single();
+
+    if (error) throw error;
+    return data;
+}

package/src/core/workspaceDetector.js

@@ -0,0 +1,113 @@
+import fs from 'fs';
+import path from 'path';
+
+/**
+ * Workspace Detector — finds independent projects (Node backend, Flutter
+ * app, React admin, …) living side-by-side under one parent directory so a
+ * single `archsync scan --workspace` can scan and cross-link all of them.
+ */
+
+const SKIP_DIRS = new Set([
+    'node_modules', '.git', 'dist', 'build', 'coverage', '.next', '.turbo',
+    '.cache', '.dart_tool', '.idea', '.vscode', 'ios', 'android', 'windows',
+    'linux', 'macos', '.archsync',
+]);
+
+const BACKEND_FRAMEWORKS = new Set(['node', 'express', 'nestjs']);
+
+/** Detect the framework of a single project directory, or null if it isn't one. */
+export function detectProjectFramework(dir) {
+    if (fs.existsSync(path.join(dir, 'pubspec.yaml'))) return 'flutter';
+    if (fs.existsSync(path.join(dir, 'next.config.js')) || fs.existsSync(path.join(dir, 'next.config.mjs'))) return 'nextjs';
+
+    const pkgPath = path.join(dir, 'package.json');
+    if (!fs.existsSync(pkgPath)) return null;
+    try {
+        const pkg = JSON.parse(fs.readFileSync(pkgPath, 'utf-8'));
+        const deps = { ...pkg.dependencies, ...pkg.devDependencies };
+        if (deps['react'] || deps['react-dom']) return 'react';
+        if (deps['@nestjs/core']) return 'nestjs';
+        if (deps['express'] || deps['fastify']) return 'express';
+        return 'node';
+    } catch {
+        return null;
+    }
+}
+
+/** Sanitise a directory name into a canvas-friendly system label. */
+function toSystemLabel(dirName) {
+    return dirName.toLowerCase().replace(/[^a-z0-9_-]+/g, '_').replace(/^_+|_+$/g, '') || 'system';
+}
+
+/**
+ * Scan the immediate children of `rootDir` (plus the root itself) for
+ * projects. Backend projects get the canonical 'backend' system label so the
+ * canvas's cross-system inference recognises them; frontends keep their
+ * directory name (e.g. mobile_app, admin) — anything not named
+ * backend/server/api is treated as a frontend by the merger.
+ *
+ * @returns {Array<{ name, path, framework, system }>}
+ */
+export function detectWorkspaceProjects(rootDir) {
+    const candidates = [];
+
+    let entries = [];
+    try {
+        entries = fs.readdirSync(rootDir, { withFileTypes: true });
+    } catch {
+        return [];
+    }
+
+    for (const entry of entries) {
+        if (!entry.isDirectory() || SKIP_DIRS.has(entry.name) || entry.name.startsWith('.')) continue;
+        const full = path.join(rootDir, entry.name);
+        const framework = detectProjectFramework(full);
+        if (framework) candidates.push({ name: entry.name, path: full, framework });
+    }
+
+    // The root itself can be a project (e.g. backend at root, app/ and admin/
+    // nested inside) — but a bare workspace manifest doesn't count.
+    const rootFramework = detectProjectFramework(rootDir);
+    if (rootFramework) {
+        let isWorkspaceManifest = false;
+        try {
+            const pkg = JSON.parse(fs.readFileSync(path.join(rootDir, 'package.json'), 'utf-8'));
+            isWorkspaceManifest = !!pkg.workspaces;
+        } catch { /* pubspec or unreadable — treat as a real project */ }
+        if (!isWorkspaceManifest) {
+            candidates.unshift({ name: path.basename(rootDir), path: rootDir, framework: rootFramework });
+        }
+    }
+
+    // Assign system labels: first backend project is 'backend'; everything
+    // else (and additional backends) uses its directory name.
+    const used = new Set();
+    return candidates.map(c => {
+        let system = BACKEND_FRAMEWORKS.has(c.framework) ? 'backend' : toSystemLabel(c.name);
+        if (used.has(system)) system = toSystemLabel(c.name);
+        let suffix = 2;
+        const base = system;
+        while (used.has(system)) system = `${base}_${suffix++}`;
+        used.add(system);
+        return { ...c, system };
+    });
+}
+
+/** Per-framework glob patterns so a Flutter project doesn't drag in build JS, etc. */
+export function includePatternsFor(framework) {
+    switch (framework) {
+        case 'flutter': return ['lib/**/*.dart'];
+        case 'react':
+        case 'nextjs': return ['**/*.{js,jsx,ts,tsx}'];
+        // Backend projects come in every language — scan them all; the
+        // parser registry routes each extension to the right parser.
+        default: return ['**/*.{js,ts,py,go,java,kt}'];
+    }
+}
+
+export const WORKSPACE_EXCLUDES = [
+    '**/node_modules/**', '**/build/**', '**/dist/**', '**/.dart_tool/**',
+    '**/ios/**', '**/android/**', '**/windows/**', '**/linux/**', '**/macos/**',
+    '**/.next/**', '**/coverage/**', '**/*.test.*', '**/*.spec.*',
+    '**/test/**', '**/tests/**', '**/__tests__/**',
+];