katman-mcp 0.1.0

package/dist/tools/crawl/scan/framework.js

@@ -0,0 +1,645 @@
+// Framework, builder, rendering verdict, hosting/preview patterns and static dir for katman_scan_code.
+import { existsSync } from "node:fs";
+import path from "node:path";
+import { CSR_ACCEPT, JS_RENDER_NOTE, LOVABLE_CAVEAT, csrFixFor } from "../common/advice.js";
+import { escapeRe } from "../common/text.js";
+import { codeFiles, first, has, hasDir, list, text } from "./project.js";
+const PRIORITY = [
+    "next", "nuxt", "@sveltejs/kit", "astro", "@remix-run/react", "@remix-run/node", "@react-router/dev", "@tanstack/react-start",
+    "@tanstack/start", "@tanstack/solid-start", "gatsby", "@solidjs/start", "solid-start", "@builder.io/qwik-city", "@angular/core",
+    "@docusaurus/core", "vitepress", "vuepress", "@11ty/eleventy", "vike", "vite-plugin-ssr", "waku", "react-scripts", "vite", "react",
+    "vue", "svelte", "solid-js", "preact", "express", "hono", "fastify", "koa", "itty-router", "wrangler",
+];
+function cleanVersion(v) {
+    if (!v)
+        return undefined;
+    const m = v.match(/\d+(\.\d+){0,2}/);
+    return m ? m[0] : undefined;
+}
+export function readPackages(p) {
+    const out = [];
+    for (const rel of p.files.keys()) {
+        if (!/(^|\/)package\.json$/.test(rel) || rel.split("/").length > 4)
+            continue;
+        try {
+            const j = JSON.parse(text(p, rel));
+            const deps = { ...j.dependencies, ...j.devDependencies, ...j.peerDependencies };
+            out.push({
+                rel,
+                dir: path.posix.dirname(rel) === "." ? "" : path.posix.dirname(rel),
+                name: typeof j.name === "string" ? j.name : undefined,
+                deps,
+                scripts: j.scripts ?? {},
+                homepage: typeof j.homepage === "string" ? j.homepage : undefined,
+            });
+        }
+        catch {
+            /* invalid package.json */
+        }
+    }
+    return out;
+}
+function rank(pkg) {
+    const i = PRIORITY.findIndex((d) => d in pkg.deps);
+    return i < 0 ? 999 : i;
+}
+export function choosePrimary(pkgs) {
+    if (!pkgs.length)
+        return undefined;
+    const rootPkg = pkgs.find((x) => x.dir === "");
+    if (rootPkg && rank(rootPkg) < 999)
+        return rootPkg;
+    const pref = /^(apps\/(web|site|www|frontend|marketing|app)|web|site|www|frontend|client|app|marketing|landing)$/;
+    return [...pkgs].sort((a, b) => rank(a) - rank(b) || Number(!pref.test(b.dir)) - Number(!pref.test(a.dir)) || a.dir.length - b.dir.length)[0] ?? rootPkg;
+}
+function F(id, severity, gate, prompt, title, detail, extra = {}) {
+    return { id, title, severity, gate, prompt, detail, ...extra };
+}
+/** Content between the SPA mount point's tags, e.g. <div id="root"></div>. */
+export function spaRootInfo(html) {
+    const m = html.match(/<div[^>]*\bid\s*=\s*["'](root|app|__next|svelte|main|q-app)["'][^>]*>([\s\S]*?)<\/div>/i);
+    if (!m)
+        return undefined;
+    const inner = m[2].replace(/<script[\s\S]*?<\/script>/gi, " ").replace(/<[^>]+>/g, " ").replace(/\s+/g, " ").trim();
+    const words = inner ? inner.split(" ").length : 0;
+    return { empty: words <= 3, words, id: m[1] };
+}
+export function detect(p) {
+    const pkgs = readPackages(p);
+    const pkg = choosePrimary(pkgs);
+    const appDir = pkg?.dir ?? "";
+    const pre = appDir ? `${appDir}/` : "";
+    const J = (rel) => pre + rel;
+    const deps = pkg?.deps ?? {};
+    const hasDep = (d) => d in deps;
+    const ver = (d) => cleanVersion(deps[d]);
+    const ev = [];
+    const findings = [];
+    let fw = { name: "unknown" };
+    let verdict = "unknown";
+    let conf = "low";
+    const cfgOf = (names) => {
+        const rel = first(p, names.map(J));
+        return { rel, t: rel ? text(p, rel) : "" };
+    };
+    const reAt = (s) => new RegExp(`^${escapeRe(pre)}${s}`);
+    const spa = {};
+    // Builder signatures
+    const readme = text(p, first(p, [J("README.md"), "README.md", J("readme.md")]) ?? "");
+    const indexRel = first(p, [J("index.html"), J("public/index.html"), J("src/index.html")]);
+    const indexHtml = indexRel ? text(p, indexRel) : "";
+    let builder;
+    if (hasDep("lovable-tagger") || /lovable\.dev|lovable\.app|lovable project/i.test(readme) || /content=["']Lovable|lovable\.dev\/opengraph|gpteng\.co/i.test(indexHtml))
+        builder = "lovable";
+    else if (hasDir(p, ".bolt") || p.seenDirNames.has(".bolt") || /bolt\.new/i.test(readme))
+        builder = "bolt";
+    else if (/v0\.(dev|app)|v0 by vercel/i.test(readme) || codeFiles(p).slice(0, 400).some((f) => /v0 by Vercel|https:\/\/v0\.(dev|app)\/t\//.test(f.text.slice(0, 3000))))
+        builder = "v0";
+    else if (existsSync(path.join(p.root, ".replit")) || has(p, "replit.nix") || has(p, "replit.md"))
+        builder = "replit";
+    else if (hasDir(p, ".idx") || p.seenDirNames.has(".idx"))
+        builder = "firebase-studio";
+    const prerenderDeps = ["vite-react-ssg", "vite-prerender-plugin", "vite-plugin-prerender", "@prerenderer/rollup-plugin", "@prerenderer/renderer-puppeteer", "vite-ssg", "react-snap", "vite-plugin-ssr", "prerender-spa-plugin"];
+    const prer = prerenderDeps.filter(hasDep);
+    if (hasDep("next")) {
+        const { rel, t } = cfgOf(["next.config.js", "next.config.mjs", "next.config.ts", "next.config.cjs"]);
+        const appPages = list(p, reAt(String.raw `(src/)?app/(.+/)?page\.(tsx|ts|jsx|js|mdx|md)$`));
+        const pagesPages = list(p, reAt(String.raw `(src/)?pages/.+\.(tsx|ts|jsx|js|mdx|md)$`)).filter((f) => !/\/pages\/(api\/|_app\.|_document\.|_error\.)/.test(f));
+        const router = appPages.length && pagesPages.length ? "app+pages" : appPages.length ? "app" : pagesPages.length ? "pages" : undefined;
+        fw = { name: "next", version: ver("next"), router };
+        if (/output\s*:\s*['"`]export['"`]/.test(t)) {
+            verdict = "ssg";
+            conf = "high";
+            ev.push(`${rel}: output: "export" (static HTML export)`);
+        }
+        else {
+            verdict = "hybrid";
+            conf = "high";
+            ev.push(`Next.js ${ver("next") ?? ""} (${router ?? "no"} router) renders pages on the server (at build time or per request)`);
+            if (/output\s*:\s*['"`]standalone['"`]/.test(t))
+                ev.push(`${rel}: output: "standalone" (Node server)`);
+        }
+        nextClientChecks(p, [...appPages, ...pagesPages], findings, router);
+    }
+    else if (hasDep("nuxt") || hasDep("nuxt3")) {
+        const { rel, t } = cfgOf(["nuxt.config.ts", "nuxt.config.js", "nuxt.config.mjs"]);
+        fw = { name: "nuxt", version: ver("nuxt") ?? ver("nuxt3") };
+        conf = "high";
+        if (/\bssr\s*:\s*false/.test(t) || /mode\s*:\s*['"]spa['"]/.test(t)) {
+            verdict = "csr";
+            ev.push(`${rel}: ssr: false (single-page app)`);
+        }
+        else if (/\btarget\s*:\s*['"]static['"]/.test(t) || (/nuxt\s+generate/.test(pkg?.scripts.generate ?? "") && /generate/.test(pkg?.scripts.build ?? ""))) {
+            verdict = "ssg";
+            ev.push("nuxt generate / target: static (pre-rendered HTML)");
+        }
+        else if (/prerender/.test(t)) {
+            verdict = "hybrid";
+            ev.push(`${rel}: prerender rules (routeRules / nitro.prerender) + server rendering`);
+        }
+        else {
+            verdict = "ssr";
+            ev.push("Nuxt renders on the server by default (ssr: true)");
+        }
+    }
+    else if (hasDep("@sveltejs/kit")) {
+        const { rel, t } = cfgOf(["svelte.config.js", "svelte.config.mjs", "svelte.config.ts"]);
+        const adapter = t.match(/@sveltejs\/adapter-([a-z-]+)/)?.[1] ?? Object.keys(deps).find((d) => d.startsWith("@sveltejs/adapter-"))?.slice(18);
+        fw = { name: "sveltekit", version: ver("@sveltejs/kit") };
+        const layouts = list(p, reAt(String.raw `src/routes/\+layout(\.server)?\.(js|ts)$`)).map((f) => text(p, f)).join("\n");
+        const ssrFalse = /export\s+const\s+ssr\s*=\s*false/.test(layouts);
+        const prerender = /export\s+const\s+prerender\s*=\s*(true|['"]auto['"])/.test(layouts);
+        conf = "high";
+        if (ssrFalse) {
+            verdict = "csr";
+            ev.push("src/routes/+layout: export const ssr = false (client-only)");
+        }
+        else if (adapter === "static") {
+            if (prerender) {
+                verdict = "ssg";
+                ev.push("adapter-static + prerender = true (static HTML)");
+            }
+            else if (/fallback\s*:/.test(t)) {
+                verdict = "csr";
+                conf = "medium";
+                ev.push(`${rel}: adapter-static with a fallback page and no prerender (SPA mode)`);
+            }
+            else {
+                verdict = "ssg";
+                conf = "medium";
+                ev.push("adapter-static (static HTML)");
+            }
+        }
+        else {
+            verdict = prerender ? "hybrid" : "ssr";
+            ev.push(`SvelteKit ${adapter ? `adapter-${adapter}` : ""} renders on the server${prerender ? " (+ prerendered routes)" : ""}`);
+        }
+    }
+    else if (hasDep("astro")) {
+        const { rel, t } = cfgOf(["astro.config.mjs", "astro.config.ts", "astro.config.js", "astro.config.cjs", "astro.config.mts"]);
+        const output = t.match(/output\s*:\s*['"](static|server|hybrid)['"]/)?.[1] ?? "static";
+        const adapter = t.match(/@astrojs\/(cloudflare|vercel|netlify|node|deno)/)?.[1];
+        fw = { name: "astro", version: ver("astro") };
+        const pages = list(p, reAt(String.raw `src/pages/.+\.(astro|md|mdx)$`));
+        const preTrue = pages.filter((f) => /export\s+const\s+prerender\s*=\s*true/.test(text(p, f)));
+        const preFalse = pages.filter((f) => /export\s+const\s+prerender\s*=\s*false/.test(text(p, f)));
+        conf = "high";
+        if (output === "server")
+            verdict = preTrue.length ? "hybrid" : "ssr";
+        else if (output === "hybrid")
+            verdict = "hybrid";
+        else
+            verdict = preFalse.length ? "hybrid" : "ssg";
+        ev.push(`${rel ?? "astro"}: output ${output}${adapter ? ` with @astrojs/${adapter}` : ""} — HTML is rendered ${verdict === "ssg" ? "at build time" : "on the server"}`);
+        const clientOnly = codeFiles(p).filter((f) => /\.astro$/.test(f.rel) && /client:only/.test(f.text));
+        if (clientOnly.length) {
+            findings.push(F("scan-astro-client-only", "medium", "read", "P2", `${clientOnly.length} Astro file${clientOnly.length === 1 ? " uses" : "s use"} client:only components`, `client:only islands render nothing on the server; their text is invisible to AI crawlers. ${JS_RENDER_NOTE}`, { files: clientOnly.map((f) => f.rel), fix: "Use client:load/client:visible (server-rendered + hydrated) for anything with text; keep client:only for pure widgets.", accept: CSR_ACCEPT }));
+        }
+    }
+    else if (Object.keys(deps).some((d) => d.startsWith("@remix-run/"))) {
+        fw = { name: "remix", version: ver("@remix-run/react") ?? ver("@remix-run/node") };
+        const { rel, t } = cfgOf(["vite.config.ts", "vite.config.js", "vite.config.mjs"]);
+        conf = "high";
+        if (/remix\s*\(\s*\{[\s\S]*?ssr\s*:\s*false/.test(t)) {
+            verdict = "csr";
+            ev.push(`${rel}: remix({ ssr: false }) (SPA mode)`);
+        }
+        else {
+            verdict = "ssr";
+            ev.push("Remix renders on the server");
+        }
+    }
+    else if (hasDep("@react-router/dev")) {
+        fw = { name: "react-router", version: ver("react-router") ?? ver("@react-router/dev") };
+        const { rel, t } = cfgOf(["react-router.config.ts", "react-router.config.js", "react-router.config.mjs"]);
+        const ssrFalse = /ssr\s*:\s*false/.test(t);
+        const prerender = /prerender\s*:/.test(t);
+        conf = "high";
+        if (ssrFalse && prerender) {
+            verdict = "ssg";
+            ev.push(`${rel}: ssr: false + prerender (static HTML for the listed routes)`);
+        }
+        else if (ssrFalse) {
+            verdict = "csr";
+            ev.push(`${rel}: ssr: false without prerender (SPA mode)`);
+        }
+        else {
+            verdict = prerender ? "hybrid" : "ssr";
+            ev.push(`React Router framework mode renders on the server${prerender ? " (+ prerendered routes)" : ""}`);
+        }
+    }
+    else if (hasDep("@tanstack/react-start") || hasDep("@tanstack/start") || hasDep("@tanstack/solid-start")) {
+        fw = { name: "tanstack-start", version: ver("@tanstack/react-start") ?? ver("@tanstack/start") ?? ver("@tanstack/solid-start") };
+        const { rel, t } = cfgOf(["vite.config.ts", "vite.config.js", "app.config.ts", "app.config.js"]);
+        conf = "high";
+        if (/spa\s*:\s*\{[^}]*enabled\s*:\s*true/.test(t)) {
+            verdict = "csr";
+            conf = "medium";
+            ev.push(`${rel}: TanStack Start SPA mode`);
+        }
+        else {
+            verdict = /prerender\s*:\s*\{[^}]*enabled\s*:\s*true/.test(t) ? "hybrid" : "ssr";
+            ev.push(`TanStack Start renders on the server${verdict === "hybrid" ? " (+ prerender)" : ""}${builder === "lovable" ? " (Lovable apps since 2026-05-13 use it)" : ""}`);
+        }
+    }
+    else if (hasDep("gatsby")) {
+        fw = { name: "gatsby", version: ver("gatsby") };
+        verdict = "ssg";
+        conf = "high";
+        ev.push("Gatsby builds static HTML");
+    }
+    else if (hasDep("@solidjs/start") || hasDep("solid-start")) {
+        fw = { name: "solid-start", version: ver("@solidjs/start") ?? ver("solid-start") };
+        const { rel, t } = cfgOf(["app.config.ts", "app.config.js", "vite.config.ts"]);
+        conf = "high";
+        verdict = /ssr\s*:\s*false/.test(t) ? "csr" : "ssr";
+        ev.push(verdict === "csr" ? `${rel}: ssr: false` : "SolidStart renders on the server");
+    }
+    else if (hasDep("@builder.io/qwik-city") || hasDep("@builder.io/qwik")) {
+        fw = { name: "qwik", version: ver("@builder.io/qwik") };
+        const isStatic = codeFiles(p).some((f) => /qwik-city\/adapters\/static/.test(f.text));
+        verdict = isStatic ? "ssg" : "ssr";
+        conf = "high";
+        ev.push(isStatic ? "Qwik City static adapter" : "Qwik City renders on the server");
+    }
+    else if (hasDep("@angular/core")) {
+        fw = { name: "angular", version: ver("@angular/core") };
+        const ng = text(p, first(p, [J("angular.json")]) ?? "");
+        if (hasDep("@angular/ssr") || hasDep("@nguniversal/express-engine")) {
+            conf = "high";
+            if (/"outputMode"\s*:\s*"static"/.test(ng) || /"prerender"\s*:\s*true/.test(ng)) {
+                verdict = /"outputMode"\s*:\s*"server"/.test(ng) ? "hybrid" : "ssg";
+            }
+            else
+                verdict = "ssr";
+            ev.push(`@angular/ssr present (${verdict})`);
+        }
+        else {
+            verdict = "csr";
+            conf = "high";
+            ev.push("Angular without @angular/ssr renders in the browser");
+        }
+    }
+    else if (hasDep("@docusaurus/core") || hasDep("vitepress") || hasDep("vuepress") || hasDep("@11ty/eleventy")) {
+        const n = hasDep("@docusaurus/core") ? "docusaurus" : hasDep("vitepress") ? "vitepress" : hasDep("vuepress") ? "vuepress" : "eleventy";
+        fw = { name: n, version: ver(n === "eleventy" ? "@11ty/eleventy" : n === "docusaurus" ? "@docusaurus/core" : n) };
+        verdict = "ssg";
+        conf = "high";
+        ev.push(`${n} builds static HTML`);
+    }
+    else if (hasDep("vike") || hasDep("vite-plugin-ssr") || hasDep("waku")) {
+        fw = { name: hasDep("waku") ? "waku" : "vike", version: ver("vike") ?? ver("vite-plugin-ssr") ?? ver("waku") };
+        const pre2 = codeFiles(p).some((f) => /prerender\s*:\s*(true|\{)/.test(f.text) && /\+config|vite\.config/.test(f.rel));
+        verdict = pre2 ? "ssg" : "ssr";
+        conf = "medium";
+        ev.push(`${fw.name} renders HTML on the server${pre2 ? " / prerenders" : ""}`);
+    }
+    else if (hasDep("react-scripts")) {
+        fw = { name: "cra", version: ver("react-scripts") };
+        if (prer.includes("react-snap") || /react-snap/.test(pkg?.scripts.postbuild ?? "")) {
+            verdict = "ssg";
+            conf = "medium";
+            ev.push("Create React App + react-snap (prerendered at build; react-snap is unmaintained)");
+        }
+        else {
+            verdict = "csr";
+            conf = "high";
+            ev.push("Create React App renders everything in the browser (CRA is deprecated since 2025-02-14)");
+        }
+    }
+    else if (hasDep("vite") || has(p, J("vite.config.ts")) || has(p, J("vite.config.js"))) {
+        const name = hasDep("react") || hasDep("preact") ? "vite-react" : hasDep("vue") ? "vite-vue" : hasDep("svelte") ? "vite-svelte" : hasDep("solid-js") ? "vite-solid" : "vite";
+        fw = { name, version: ver("vite") };
+        if (prer.length) {
+            verdict = "ssg";
+            conf = "medium";
+            ev.push(`${prer.join(", ")}: public routes are prerendered at build time (verify the output HTML has the text)`);
+        }
+        else {
+            verdict = "csr";
+            conf = "high";
+            ev.push(`package.json: vite ${ver("vite") ?? ""}${name === "vite" ? "" : ` + ${name.slice(5)}`} without an SSR framework or prerender plugin`);
+        }
+    }
+    else if (has(p, "hugo.toml") || has(p, "hugo.yaml") || has(p, "hugo.json") || ((has(p, "config.toml") || has(p, "config.yaml")) && (hasDir(p, "layouts") || hasDir(p, "themes")) && hasDir(p, "content"))) {
+        fw = { name: "hugo" };
+        verdict = "ssg";
+        conf = "high";
+        ev.push("Hugo builds static HTML");
+    }
+    else if (has(p, "_config.yml") && (/jekyll/i.test(text(p, "Gemfile")) || hasDir(p, "_layouts") || hasDir(p, "_posts"))) {
+        fw = { name: "jekyll" };
+        verdict = "ssg";
+        conf = "high";
+        ev.push("Jekyll builds static HTML");
+    }
+    else if (has(p, ".eleventy.js") || list(p, /^eleventy\.config\.(js|mjs|cjs)$/).length) {
+        fw = { name: "eleventy" };
+        verdict = "ssg";
+        conf = "high";
+        ev.push("Eleventy builds static HTML");
+    }
+    // SPA shell evidence (index.html) for client-rendered stacks
+    if (indexHtml) {
+        spa.indexHtml = indexRel;
+        const info = spaRootInfo(indexHtml);
+        if (info) {
+            spa.rootEmpty = info.empty;
+            if (verdict === "csr" && info.empty)
+                ev.push(`${indexRel}: <div id="${info.id}"></div> is empty — the page text is drawn by JavaScript`);
+        }
+        const defaults = [];
+        if (/<title>\s*(Vite \+ (React|Vue|Svelte|Preact|TS|React \+ TS)[^<]*|Vite App|React App|lovable-project|Lovable App)\s*<\/title>/i.test(indexHtml))
+            defaults.push(`default <title>: ${indexHtml.match(/<title>([^<]*)<\/title>/i)?.[1]}`);
+        if (/content=["']Lovable Generated Project["']/i.test(indexHtml))
+            defaults.push("meta description \"Lovable Generated Project\"");
+        if (/lovable\.dev\/opengraph-image/i.test(indexHtml))
+            defaults.push("og:image from lovable.dev");
+        if (/name=["']author["'][^>]*content=["']Lovable/i.test(indexHtml))
+            defaults.push("meta author \"Lovable\"");
+        if (defaults.length) {
+            findings.push(F("scan-default-meta", "high", "quote", "P3", "index.html still has the builder's default meta tags", `${indexRel}: ${defaults.join("; ")}. Every URL of a single-page app serves these tags to crawlers that don't run JavaScript.`, { files: [indexRel], fix: "Replace them with the brand's title and one-sentence description, your own 1200×630 og:image, and generate per-page tags (P3).", accept: "No default builder tags remain; each public page has its own title and description in the server HTML" }));
+        }
+    }
+    // Custom server (Workers / Express / Hono …) rendering HTML in code
+    const wr = wranglerInfo(p, appDir);
+    if (fw.name === "unknown") {
+        const serverDeps = ["express", "hono", "fastify", "koa", "itty-router", "@hono/node-server", "h3", "elysia"].filter(hasDep);
+        const htmlFiles = codeFiles(p).filter((f) => /\.(m?[jt]s|[jt]sx|cjs)$/.test(f.rel) && (/<!doctype html/i.test(f.text) || /\bc\.html\(|res\.render\(|['"]content-type['"]\s*:\s*['"]text\/html/i.test(f.text)));
+        // Pages prebuilt into the static folder by a build script (static site generator of its own) vs HTML built per request.
+        const assets = wr.assetsDir ?? "public";
+        const prebuilt = list(p, new RegExp(`^${escapeRe(assets)}/.+\\.html$`)).filter((f) => !/(^|\/)(404|admin|app)\.html$/.test(f));
+        const builder = htmlFiles.find((f) => /(^|\/)(build|generate|prerender|render|gen)[-_.]?(pages|site|static|html)?[^/]*\.(m?[jt]s|cjs)$/i.test(f.rel) && /writeFile|outputFile/.test(f.text) && /\.html/.test(f.text));
+        if ((serverDeps.length || wr.rel) && builder && prebuilt.length >= 3) {
+            fw = { name: "custom-server", router: wr.rel ? "cloudflare-worker" : serverDeps[0] };
+            verdict = "ssg";
+            conf = "high";
+            ev.push(`${prebuilt.length} pages are prebuilt into ${assets}/ by ${builder.rel} and served as static files${wr.rel ? ` by a Cloudflare Worker (${wr.rel})` : ""}`);
+        }
+        else if ((serverDeps.length || wr.rel) && htmlFiles.length) {
+            fw = { name: "custom-server", router: wr.rel ? "cloudflare-worker" : serverDeps[0] };
+            verdict = "ssr";
+            conf = "medium";
+            ev.push(`${wr.rel ? `Cloudflare Worker (${wr.rel}${wr.main ? `, main ${wr.main}` : ""})` : serverDeps.join(", ")} builds HTML in code: ${htmlFiles.slice(0, 3).map((f) => f.rel).join(", ")}`);
+        }
+        else if (wr.assetsDir || !pkg) {
+            const idx = first(p, [wr.assetsDir ? `${wr.assetsDir}/index.html` : "", "index.html", "public/index.html", "src/index.html"].filter(Boolean));
+            const html = idx ? text(p, idx) : "";
+            const info = html ? spaRootInfo(html) : undefined;
+            const htmlCount = list(p, /\.html?$/).filter((f) => !/(^|\/)(node_modules|dist|build)\//.test(f)).length;
+            if (idx && info?.empty && /<script/i.test(html)) {
+                fw = { name: "static-html" };
+                verdict = "csr";
+                conf = "medium";
+                ev.push(`${idx}: empty #${info.id} mount point and scripts — a built single-page app`);
+            }
+            else if (idx || htmlCount) {
+                fw = { name: "static-html" };
+                verdict = "static-html";
+                conf = "high";
+                ev.push(`${htmlCount} HTML file${htmlCount === 1 ? "" : "s"} served as-is`);
+            }
+        }
+    }
+    if (verdict === "unknown")
+        ev.push("No known framework or HTML entry point found");
+    if (verdict === "csr") {
+        findings.unshift(F("scan-csr", "critical", "read", "P2", "Page text is rendered in the browser (client-side rendering)", `${JS_RENDER_NOTE} Evidence: ${ev.join("; ")}.${builder === "lovable" ? ` ${LOVABLE_CAVEAT}` : ""}`, { files: [indexRel, pkg?.rel].filter((x) => !!x), fix: csrFixFor(fw.name, fw.router), accept: CSR_ACCEPT }));
+    }
+    const hosting = detectHosting(p, pkg, builder, wr, findings);
+    const domains = collectDomains(p, pkg, wr);
+    if (domains.length)
+        hosting.evidence.push(`custom domain: ${domains.join(", ")}`);
+    fw.builder = builder;
+    return {
+        appDir,
+        pkg,
+        framework: fw,
+        rendering: { verdict, confidence: conf, evidence: ev },
+        hosting,
+        staticDir: staticDirFor(fw.name, appDir, wr.assetsDir, p),
+        domains,
+        spa: { ...spa, spaFallback: spaFallback(p, wr) },
+        findings,
+    };
+}
+function nextClientChecks(p, pageFiles, findings, router) {
+    const clientFetch = pageFiles.filter((f) => {
+        const t = text(p, f);
+        return /^\s*['"]use client['"]/m.test(t.slice(0, 400)) && /useEffect\s*\(/.test(t) && /\b(fetch\(|supabase|axios|useQuery|useSWR|getDocs|firebase|trpc|\.from\(['"])/.test(t);
+    });
+    if (clientFetch.length) {
+        findings.push(F("scan-client-fetch", "medium", "read", "P2", `${clientFetch.length} page${clientFetch.length === 1 ? " fetches its" : "s fetch their"} content in the browser`, `"use client" pages that load text in useEffect ship an empty frame to crawlers. ${JS_RENDER_NOTE}`, { files: clientFetch.slice(0, 10), fix: csrFixFor("next", router), accept: CSR_ACCEPT }));
+    }
+    const ssrFalse = [];
+    const guards = [];
+    for (const f of codeFiles(p)) {
+        const t = f.text;
+        if (/dynamic\s*\([\s\S]{0,200}?ssr\s*:\s*false/.test(t))
+            ssrFalse.push(f.rel);
+        if (/(layout|_app|providers?|root)\.(tsx|jsx|ts|js)$/i.test(f.rel) && /if\s*\(\s*!\s*(mounted|isMounted|hasMounted|isClient|hydrated|isHydrated)\s*\)\s*\{?\s*return\s+(null|<>\s*<\/>)/.test(t))
+            guards.push(f.rel);
+    }
+    if (guards.length) {
+        findings.push(F("scan-mounted-guard", "high", "read", "P2", "A layout/provider renders nothing until the browser mounts", `\`if (!mounted) return null\` in ${guards.join(", ")} makes every page under it empty in the server HTML. ${JS_RENDER_NOTE}`, { files: guards, fix: "Render children on the server; guard only the browser-only widget (theme toggle etc.), not the whole tree.", accept: CSR_ACCEPT }));
+    }
+    if (ssrFalse.length) {
+        findings.push(F("scan-ssr-false", "low", "read", "P2", `${ssrFalse.length} file${ssrFalse.length === 1 ? " loads" : "s load"} components with ssr: false`, "Fine for widgets (maps, editors); any text inside them is missing from the server HTML.", { files: ssrFalse.slice(0, 10), fix: "Keep ssr:false only for non-text widgets.", accept: CSR_ACCEPT }));
+    }
+}
+function wranglerInfo(p, appDir) {
+    const pre = appDir ? `${appDir}/` : "";
+    const rel = first(p, ["wrangler.jsonc", "wrangler.json", "wrangler.toml"].flatMap((n) => [pre + n, n]));
+    if (!rel)
+        return { domains: [] };
+    const t = text(p, rel).replace(/^\s*\/\/.*$/gm, "");
+    const str = (k) => t.match(new RegExp(`["']?${k}["']?\\s*[:=]\\s*["']([^"']+)["']`))?.[1];
+    const bool = (k) => {
+        const m = t.match(new RegExp(`["']?${k}["']?\\s*[:=]\\s*(true|false)`));
+        return m ? m[1] === "true" : undefined;
+    };
+    const assets = t.match(/["']?assets["']?\s*[:=]\s*\{[^}]*?["']?directory["']?\s*[:=]\s*["']([^"']+)["']/)?.[1] ?? t.match(/\[assets\][^[]*?directory\s*=\s*["']([^"']+)["']/)?.[1] ?? t.match(/bucket\s*[:=]\s*["']([^"']+)["']/)?.[1];
+    const domains = [...t.matchAll(/["']?pattern["']?\s*[:=]\s*["']([^"'/*]+?)(?:\/\*)?["']/g)].map((m) => m[1]).filter((d) => /\./.test(d) && !/workers\.dev$/.test(d));
+    return {
+        rel,
+        name: str("name"),
+        main: str("main"),
+        pagesOut: str("pages_build_output_dir"),
+        assetsDir: assets ? path.posix.normalize(pre + assets.replace(/^\.\//, "")).replace(/\/$/, "") : undefined,
+        workersDev: bool("workers_dev"),
+        previewUrls: bool("preview_urls"),
+        notFound: str("not_found_handling"),
+        domains,
+    };
+}
+function spaFallback(p, wr) {
+    if (wr.notFound === "single-page-application")
+        return `${wr.rel}: not_found_handling "single-page-application"`;
+    for (const rel of list(p, /(^|\/)_redirects$/)) {
+        if (/^\s*\/\*\s+\/index\.html\s+200/m.test(text(p, rel)))
+            return `${rel}: /* /index.html 200`;
+    }
+    const v = text(p, first(p, ["vercel.json"]) ?? "");
+    if (/"source"\s*:\s*"\/\(\.\*\)"[^}]*"destination"\s*:\s*"\/(index\.html)?"/.test(v))
+        return "vercel.json: rewrite (.*) → /index.html";
+    const n = text(p, first(p, ["netlify.toml"]) ?? "");
+    if (/from\s*=\s*["']\/\*["'][\s\S]{0,80}to\s*=\s*["']\/index\.html["'][\s\S]{0,40}status\s*=\s*200/.test(n))
+        return "netlify.toml: /* → /index.html 200";
+    const fb = text(p, first(p, ["firebase.json"]) ?? "");
+    if (/"source"\s*:\s*"\*\*"[^}]*"destination"\s*:\s*"\/index\.html"/.test(fb))
+        return "firebase.json: ** → /index.html";
+    return undefined;
+}
+function detectHosting(p, pkg, builder, wr, findings) {
+    const evidence = [];
+    const patterns = [];
+    let provider;
+    const name = (wr.name ?? pkg?.name ?? path.basename(p.root)).replace(/^@[^/]+\//, "").toLowerCase().replace(/[^a-z0-9-]/g, "-");
+    const deps = pkg?.deps ?? {};
+    const adapter = (re) => Object.keys(deps).some((d) => re.test(d));
+    let fixText = "";
+    let severity = "medium";
+    if (wr.rel || adapter(/^@astrojs\/cloudflare$|^@sveltejs\/adapter-cloudflare|^@opennextjs\/cloudflare$|^@cloudflare\/next-on-pages$/)) {
+        provider = "cloudflare";
+        if (wr.rel)
+            evidence.push(`${wr.rel}${wr.name ? ` (name: ${wr.name})` : ""}`);
+        if (wr.pagesOut || adapter(/^@cloudflare\/next-on-pages$/)) {
+            patterns.push(`${name}.pages.dev`, `*.${name}.pages.dev`);
+            fixText = `Redirect ${name}.pages.dev to the custom domain (a Bulk Redirect or a check on the host in a Pages Function), or send X-Robots-Tag: noindex there. Preview deployments already get noindex.`;
+        }
+        else if (wr.rel) {
+            if (wr.workersDev !== false)
+                patterns.push(`${name}.<your-subdomain>.workers.dev`);
+            if (wr.previewUrls !== false)
+                patterns.push(`<version>-${name}.<your-subdomain>.workers.dev`);
+            if (wr.workersDev === false && wr.previewUrls === false)
+                evidence.push("workers_dev = false and preview_urls = false: no public *.workers.dev copy");
+            else if (wr.workersDev === false)
+                evidence.push("workers_dev = false");
+            fixText = `Set "workers_dev": false (and "preview_urls": false) in ${wr.rel} once the custom domain works, or have the Worker 301 any *.workers.dev host to the main domain.`;
+            const mentions = codeFiles(p).some((f) => /workers\.dev/.test(f.text));
+            if (mentions && patterns.length) {
+                severity = "low";
+                evidence.push("the code mentions workers.dev (a host redirect may already exist)");
+            }
+        }
+    }
+    if (!provider && (has(p, "vercel.json") || p.seenDirNames.has(".vercel") || adapter(/^@astrojs\/vercel$|^@sveltejs\/adapter-vercel$|^@vercel\/remix$/))) {
+        provider = "vercel";
+        evidence.push(has(p, "vercel.json") ? "vercel.json" : ".vercel/ folder or Vercel adapter");
+        patterns.push(`${name}.vercel.app`, `${name}-*.vercel.app`);
+        fixText = `In Vercel → Settings → Domains, make ${name}.vercel.app redirect (308) to the main domain; keep Deployment Protection on previews (they are noindex by default).`;
+    }
+    if (!provider && (has(p, "netlify.toml") || adapter(/^@astrojs\/netlify$|^@sveltejs\/adapter-netlify$|^@netlify\//) || builder === "bolt")) {
+        provider = "netlify";
+        evidence.push(has(p, "netlify.toml") ? "netlify.toml" : builder === "bolt" ? "Bolt deploys to Netlify" : "Netlify adapter");
+        patterns.push(`${name}.netlify.app`, `deploy-preview-*--${name}.netlify.app`);
+        fixText = `Add a domain-level redirect: https://${name}.netlify.app/* https://<your-domain>/:splat 301! (Netlify sets the primary domain automatically once one is added).`;
+    }
+    if (!provider && has(p, "firebase.json")) {
+        provider = "firebase";
+        const proj = text(p, ".firebaserc").match(/"default"\s*:\s*"([^"]+)"/)?.[1] ?? name;
+        evidence.push("firebase.json");
+        patterns.push(`${proj}.web.app`, `${proj}.firebaseapp.com`);
+        fixText = `Redirect ${proj}.web.app and ${proj}.firebaseapp.com to the custom domain (Hosting → custom domain → redirect).`;
+    }
+    if (builder === "lovable") {
+        provider ??= "lovable";
+        evidence.push("Lovable project");
+        patterns.push(`${name}.lovable.app`, "*.lovableproject.com");
+        fixText ||= "In Lovable → Project settings → Domains, connect the custom domain and make it primary so the lovable.app address redirects to it.";
+    }
+    if (builder === "replit") {
+        provider ??= "replit";
+        evidence.push("Replit project (.replit)");
+        patterns.push(`${name}.replit.app`, "*.replit.dev");
+        fixText ||= "Link the custom domain in Replit Deployments and redirect the replit.app address to it (or send noindex there).";
+    }
+    const others = [
+        ["render.yaml", "render", [`${name}.onrender.com`]],
+        ["fly.toml", "fly", [`${name}.fly.dev`]],
+        ["railway.json", "railway", ["*.up.railway.app"]],
+        ["railway.toml", "railway", ["*.up.railway.app"]],
+        ["amplify.yml", "aws-amplify", ["*.amplifyapp.com"]],
+        ["staticwebapp.config.json", "azure-static-web-apps", ["*.azurestaticapps.net"]],
+    ];
+    for (const [file, prov, pats] of others) {
+        if (!provider && has(p, file)) {
+            provider = prov;
+            evidence.push(file);
+            patterns.push(...pats);
+            fixText = "Redirect the platform's default address to the custom domain (301) or send noindex there.";
+        }
+    }
+    if (!provider && (has(p, "CNAME") || list(p, /^\.github\/workflows\/.+\.ya?ml$/).some((f) => /actions\/deploy-pages|peaceiris\/actions-gh-pages/.test(text(p, f))))) {
+        provider = "github-pages";
+        evidence.push(has(p, "CNAME") ? "CNAME file" : "GitHub Pages workflow");
+        patterns.push("<user>.github.io");
+        fixText = "GitHub Pages redirects <user>.github.io to the custom domain automatically when CNAME is set; make sure it is.";
+    }
+    const hostRedirect = codeFiles(p).find((f) => {
+        const t = f.text;
+        const m = t.match(/\b(?:url|u|request\.url|new URL\([^)]*\))\.(?:host|hostname)\s*!==?\s*[^\n]{1,80}/);
+        return !!m && /redirect\(|Response\.redirect|\b30[178]\b/.test(t.slice(m.index, m.index + 400));
+    });
+    if (hostRedirect && patterns.length) {
+        severity = "info";
+        evidence.push(`${hostRedirect.rel} redirects requests on other hosts to the canonical host (verify: katman_audit_site preview_urls)`);
+    }
+    if (patterns.length) {
+        findings.push(F("scan-preview-urls", severity, "read", "P11", `Preview/default addresses may serve an indexable copy (${provider})`, `${patterns.join(", ")}. If they stay open after the custom domain is connected, Google sees two copies of the site and may pick the wrong canonical; robots.txt alone doesn't fix it. ${evidence.join("; ")}.`, { fix: fixText, accept: "Each preview/default address 301-redirects to the main domain or answers with noindex (katman_audit_site with preview_urls passes)" }));
+    }
+    return { provider, previewPatterns: patterns, evidence };
+}
+function staticDirFor(framework, appDir, assetsDir, p) {
+    const pre = appDir ? `${appDir}/` : "";
+    if (assetsDir)
+        return assetsDir;
+    switch (framework) {
+        case "sveltekit":
+        case "hugo":
+        case "gatsby":
+        case "docusaurus":
+            return `${pre}static`;
+        case "jekyll":
+        case "eleventy":
+            return appDir || ".";
+        case "vitepress":
+            return `${pre}docs/public`;
+        case "nuxt":
+            return hasDir(p, `${pre}public`) || !hasDir(p, `${pre}static`) ? `${pre}public` : `${pre}static`;
+        case "static-html":
+            return hasDir(p, `${pre}public`) && has(p, `${pre}public/index.html`) ? `${pre}public` : appDir || ".";
+        case "unknown":
+            return hasDir(p, `${pre}public`) ? `${pre}public` : hasDir(p, `${pre}static`) ? `${pre}static` : undefined;
+        default:
+            return `${pre}public`;
+    }
+}
+function collectDomains(p, pkg, wr) {
+    const out = new Set(wr.domains);
+    const cname = text(p, "CNAME").trim();
+    if (cname && /^[a-z0-9.-]+\.[a-z]{2,}$/i.test(cname))
+        out.add(cname);
+    if (pkg?.homepage && /^https?:\/\//.test(pkg.homepage)) {
+        try {
+            out.add(new URL(pkg.homepage).hostname);
+        }
+        catch {
+            /* ignore */
+        }
+    }
+    for (const rel of list(p, /(^|\/)(astro\.config\.[mc]?[jt]s|next-sitemap\.config\.[mc]?js|nuxt\.config\.[jt]s|svelte\.config\.js|gatsby-config\.[jt]s|docusaurus\.config\.[jt]s)$/)) {
+        for (const m of text(p, rel).matchAll(/(?:site|siteUrl|url)\s*:\s*['"`](https?:\/\/[^'"`/]+)/g)) {
+            try {
+                const h = new URL(m[1]).hostname;
+                if (!/localhost|example\.com|127\.0\.0\.1/.test(h))
+                    out.add(h);
+            }
+            catch {
+                /* ignore */
+            }
+        }
+    }
+    return [...out].filter((d) => !/^www\./.test(d) || !out.has(d.slice(4)));
+}