peaks-loop 4.0.54 → 4.1.1

package/dist/services/scan/archetype-detection.js

@@ -0,0 +1,315 @@
+/**
+ * Archetype detection primitives (B wave-3 file-size split).
+ *
+ * Extracted verbatim from `archetype-service.ts`: the backend /
+ * monorepo / swagger candidate lists, the archetype-detection
+ * thresholds (PRD-002b slice 2), and the async detectors that probe a
+ * project root for those signals. Values are bytewise-identical to
+ * the original literals. `archetype-service.ts` keeps the decision
+ * functions (`decideArchetype`, `decideFrontendOnly`,
+ * `decideIntegrationMode`) and the public `scanArchetype` entry; the
+ * `frontendOnly` / `frontendOnlyReason` output contract is unchanged.
+ */
+import { readdir, stat } from 'node:fs/promises';
+import { join, relative as relativePath } from 'node:path';
+import { isDirectory, pathExists, readText } from 'peaks-loop-shared/fs';
+export const BACKEND_DEP_NAMES = [
+    'express',
+    'koa',
+    'fastify',
+    '@nestjs/core',
+    '@nestjs/common',
+    'hapi',
+    '@hapi/hapi',
+    'restify',
+    'next' // treated separately for API routes
+];
+export const BACKEND_DIR_CANDIDATES = [
+    'server',
+    'backend',
+    'api',
+    'apps/server',
+    'apps/api',
+    'packages/server',
+    'packages/api'
+];
+export const MONOREPO_CONFIG_FILES = [
+    'pnpm-workspace.yaml',
+    'lerna.json',
+    'turbo.json',
+    'nx.json',
+    'rush.json'
+];
+/**
+ * PRD-002b slice 2 — extract archetype-detection thresholds. Names
+ * describe the meaning; values are bytewise-identical to the original
+ * literals (signaled in commit message).
+ */
+// eslint-disable-next-line no-magic-numbers -- canonical ms-per-day math (1000 * 60s * 60min * 24h)
+export const MS_PER_DAY = 1000 * 60 * 60 * 24;
+export const GREENFIELD_MAX_SRC_FILES = 20;
+export const LEGACY_MIN_SRC_FILES = 20;
+export const LOCKFILE_STALE_DAYS = 180;
+export const GREENFIELD_MAX_LOCKFILE_DAYS = 30;
+export const HIGH_CONFIDENCE_SIGNAL_COUNT = 3;
+export const SWAGGER_CANDIDATE_PATHS = [
+    'swagger.json',
+    'swagger.yaml',
+    'openapi.json',
+    'openapi.yaml',
+    'openapi.yml',
+    'docs/swagger.json',
+    'docs/openapi.json',
+    'docs/openapi.yaml'
+];
+export async function readPackageJsonDeps(projectRoot) {
+    const pkgPath = join(projectRoot, 'package.json');
+    if (!(await pathExists(pkgPath))) {
+        return { exists: false, deps: {} };
+    }
+    try {
+        const raw = await readText(pkgPath);
+        const parsed = JSON.parse(raw);
+        const deps = {
+            ...(parsed.dependencies ?? {}),
+            ...(parsed.devDependencies ?? {}),
+            ...(parsed.peerDependencies ?? {}),
+            ...(parsed.optionalDependencies ?? {})
+        };
+        return { exists: true, deps };
+    }
+    catch {
+        return { exists: true, deps: {} };
+    }
+}
+export async function detectBackendFrameworks(deps) {
+    return BACKEND_DEP_NAMES.filter((name) => name !== 'next' && Object.prototype.hasOwnProperty.call(deps, name));
+}
+/**
+ * Manifests that only a service writes. Language-diverse on purpose: every
+ * other probe in this file is Node-specific, and a repository whose backend is
+ * Go / Java / Kotlin / Python / Ruby / PHP / Rust has no Node manifest at all,
+ * so a Node-only evidence set reported it as `frontendOnly`.
+ */
+export const SERVICE_ONLY_MANIFEST_FILES = [
+    'go.mod',
+    'pom.xml',
+    'build.gradle',
+    'build.gradle.kts',
+    'settings.gradle',
+    'settings.gradle.kts',
+    'manage.py',
+    'config.ru',
+    'artisan'
+];
+/**
+ * Manifests a service MAY write and a library or CLI also writes. Counted as
+ * backend evidence only when the file itself names a web framework — the
+ * alternative is a boolean that fires on any Python or Rust directory, which
+ * trades one wrong answer for another.
+ */
+export const CONDITIONAL_SERVICE_MANIFESTS = [
+    ['requirements.txt', /\b(fastapi|flask|django|uvicorn|gunicorn|aiohttp|tornado|starlette)\b/i],
+    ['pyproject.toml', /\b(fastapi|flask|django|uvicorn|gunicorn|aiohttp|tornado|starlette)\b/i],
+    ['Cargo.toml', /\b(actix-web|axum|rocket|warp|tonic|hyper|poem)\b/i],
+    ['Gemfile', /\b(rails|sinatra|hanami|puma|rack)\b/i],
+    ['composer.json', /\b(laravel|symfony|slim)\b/i]
+];
+/** Directories never worth descending into when looking for a service manifest. */
+const MANIFEST_WALK_SKIP_DIRS = new Set([
+    'node_modules',
+    'dist',
+    'build',
+    'out',
+    'coverage',
+    'target',
+    'vendor',
+    '__pycache__',
+    '.git'
+]);
+/**
+ * How deep from the project root a service is allowed to sit before its
+ * manifest stops being counted. Two levels covers the layouts that were
+ * invisible (`apps/gateway/package.json`, `services/checkout/requirements.txt`,
+ * `web/` + `cmd/server`), and a deeper walk would read generated trees.
+ */
+export const SERVICE_MANIFEST_MAX_DEPTH = 2;
+/**
+ * How many leading bytes of a source file are read to find a directive. `'use
+ * server'` must be the first statement, so the head is the whole question, and
+ * reading a bounded head keeps this probe from pulling multi-megabyte files into
+ * memory.
+ */
+const DIRECTIVE_HEAD_BYTES = 400;
+async function readDirSafe(dir) {
+    try {
+        return await readdir(dir, { withFileTypes: true });
+    }
+    catch {
+        // An unreadable directory is not evidence of a backend, and not of its
+        // absence either; the root manifest already carries the project.
+        return [];
+    }
+}
+function relativeFromRoot(projectRoot, dir) {
+    return relativePath(projectRoot, dir).replace(/\\/g, '/');
+}
+function labeled(relative, file) {
+    return relative === '' ? file : `${relative}/${file}`;
+}
+function descendable(entries, dir, depth) {
+    if (depth >= SERVICE_MANIFEST_MAX_DEPTH)
+        return [];
+    return entries
+        .filter((entry) => entry.isDirectory() &&
+        !MANIFEST_WALK_SKIP_DIRS.has(entry.name) &&
+        !entry.name.startsWith('.'))
+        .map((entry) => ({ dir: join(dir, entry.name), depth: depth + 1 }));
+}
+/**
+ * Service manifests sitting in ONE directory: the unmistakable ones by name,
+ * and the shared ones only when the file names a web framework.
+ */
+async function manifestEvidenceInDir(dir, relative, names) {
+    const found = SERVICE_ONLY_MANIFEST_FILES.filter((manifest) => names.has(manifest)).map((manifest) => labeled(relative, manifest));
+    for (const [manifest, pattern] of CONDITIONAL_SERVICE_MANIFESTS) {
+        if (!names.has(manifest))
+            continue;
+        const text = await readText(join(dir, manifest)).catch(() => '');
+        const matched = pattern.exec(text);
+        if (matched !== null) {
+            found.push(`${labeled(relative, manifest)} (${matched[0].toLowerCase()})`);
+        }
+    }
+    return found;
+}
+/**
+ * A nested `package.json` declares its own dependencies, and a workspace root
+ * does not list them. Reading only the root is how an express service under
+ * `apps/` became `frontendOnly`.
+ */
+async function workspacePackageEvidence(dir, relative, names, backendDepNames) {
+    if (relative === '' || !names.has('package.json'))
+        return [];
+    const { deps } = await readPackageJsonDeps(dir);
+    return backendDepNames
+        .filter((dep) => dep !== 'next' && Object.prototype.hasOwnProperty.call(deps, dep))
+        .map((dep) => `${relative}: ${dep}`);
+}
+/**
+ * Backend evidence that lives OUTSIDE the root manifest: a workspace package's
+ * own `package.json`, and any non-Node service manifest.
+ *
+ * Returns `dir: evidence` strings (`apps/gateway: express`, `go.mod`,
+ * `services/checkout: requirements.txt`) rather than a boolean, because the
+ * whole defect this probe closes was a verdict that could not say what it saw.
+ */
+export async function detectNestedServiceEvidence(projectRoot, backendDepNames = BACKEND_DEP_NAMES) {
+    const evidence = [];
+    const queue = [{ dir: projectRoot, depth: 0 }];
+    while (queue.length > 0) {
+        const current = queue.shift();
+        if (current === undefined)
+            break;
+        const entries = await readDirSafe(current.dir);
+        const names = new Set(entries.map((entry) => entry.name));
+        const relative = relativeFromRoot(projectRoot, current.dir);
+        evidence.push(...(await manifestEvidenceInDir(current.dir, relative, names)));
+        evidence.push(...(await workspacePackageEvidence(current.dir, relative, names, backendDepNames)));
+        queue.push(...descendable(entries, current.dir, current.depth));
+    }
+    return evidence.sort();
+}
+/** Does this directory tree contain a file opening with `'use server'`? */
+async function hasUseServerFile(rootDir) {
+    const queue = [{ dir: rootDir, depth: 0 }];
+    while (queue.length > 0) {
+        const current = queue.shift();
+        if (current === undefined)
+            break;
+        const entries = await readDirSafe(current.dir);
+        for (const entry of entries) {
+            const full = join(current.dir, entry.name);
+            if (entry.isDirectory())
+                continue;
+            if (!/\.(ts|tsx|js|jsx)$/.test(entry.name))
+                continue;
+            const text = await readText(full).catch(() => '');
+            if (/['"]use server['"]/.test(text.slice(0, DIRECTIVE_HEAD_BYTES)))
+                return true;
+        }
+        queue.push(...descendable(entries, current.dir, current.depth));
+    }
+    return false;
+}
+/**
+ * Next.js server actions: `'use server'` in a file under `app/`. Route handlers
+ * under `pages/api` / `app/api` were the only Next backend the detector knew
+ * about, so a Next app that mutates data through actions — the documented
+ * Next.js way — was reported as having no backend at all.
+ */
+export async function detectNextServerActions(projectRoot) {
+    for (const root of ['app', 'src/app']) {
+        const rootDir = join(projectRoot, root);
+        if (await isDirectory(rootDir)) {
+            if (await hasUseServerFile(rootDir))
+                return true;
+        }
+    }
+    return false;
+}
+export async function detectNextApiRoutes(projectRoot, hasNext) {
+    if (!hasNext) {
+        return false;
+    }
+    const candidates = ['pages/api', 'src/pages/api', 'app/api', 'src/app/api'];
+    for (const candidate of candidates) {
+        if (await isDirectory(join(projectRoot, candidate))) {
+            return true;
+        }
+    }
+    return false;
+}
+export async function detectBackendDirs(projectRoot) {
+    const found = [];
+    for (const candidate of BACKEND_DIR_CANDIDATES) {
+        if (await isDirectory(join(projectRoot, candidate))) {
+            found.push(candidate);
+        }
+    }
+    return found;
+}
+export async function detectSwagger(projectRoot) {
+    const found = [];
+    for (const candidate of SWAGGER_CANDIDATE_PATHS) {
+        if (await pathExists(join(projectRoot, candidate))) {
+            found.push(candidate);
+        }
+    }
+    const protoDir = join(projectRoot, 'proto');
+    if (await isDirectory(protoDir)) {
+        found.push('proto/');
+    }
+    return found;
+}
+export async function detectMonorepoConfigs(projectRoot) {
+    const found = [];
+    for (const file of MONOREPO_CONFIG_FILES) {
+        if (await pathExists(join(projectRoot, file))) {
+            found.push(file);
+        }
+    }
+    return found;
+}
+export async function lockfileAgeDays(projectRoot) {
+    const candidates = ['pnpm-lock.yaml', 'package-lock.json', 'yarn.lock', 'bun.lockb'];
+    for (const candidate of candidates) {
+        const full = join(projectRoot, candidate);
+        if (await pathExists(full)) {
+            const stats = await stat(full);
+            const ageMs = Date.now() - stats.mtimeMs;
+            return Math.floor(ageMs / MS_PER_DAY);
+        }
+    }
+    return null;
+}

package/dist/services/scan/archetype-service.js

@@ -1,107 +1,7 @@
-import { readdir, stat } from 'node:fs/promises';
+import { readdir } from 'node:fs/promises';
 import { join } from 'node:path';
-import { isDirectory, pathExists, readText } from 'peaks-loop-shared/fs';
-const BACKEND_DEP_NAMES = [
-    'express',
-    'koa',
-    'fastify',
-    '@nestjs/core',
-    '@nestjs/common',
-    'hapi',
-    '@hapi/hapi',
-    'restify',
-    'next' // treated separately for API routes
-];
-const BACKEND_DIR_CANDIDATES = ['server', 'backend', 'api', 'apps/server', 'apps/api', 'packages/server', 'packages/api'];
-const MONOREPO_CONFIG_FILES = ['pnpm-workspace.yaml', 'lerna.json', 'turbo.json', 'nx.json', 'rush.json'];
-/**
- * PRD-002b slice 2 — extract archetype-detection thresholds. Names
- * describe the meaning; values are bytewise-identical to the original
- * literals (signaled in commit message).
- */
-// eslint-disable-next-line no-magic-numbers -- canonical ms-per-day math (1000 * 60s * 60min * 24h)
-const MS_PER_DAY = 1000 * 60 * 60 * 24;
-const GREENFIELD_MAX_SRC_FILES = 20;
-const LEGACY_MIN_SRC_FILES = 20;
-const LOCKFILE_STALE_DAYS = 180;
-const GREENFIELD_MAX_LOCKFILE_DAYS = 30;
-const HIGH_CONFIDENCE_SIGNAL_COUNT = 3;
-const SWAGGER_CANDIDATE_PATHS = [
-    'swagger.json',
-    'swagger.yaml',
-    'openapi.json',
-    'openapi.yaml',
-    'openapi.yml',
-    'docs/swagger.json',
-    'docs/openapi.json',
-    'docs/openapi.yaml'
-];
-async function readPackageJsonDeps(projectRoot) {
-    const pkgPath = join(projectRoot, 'package.json');
-    if (!(await pathExists(pkgPath))) {
-        return { exists: false, deps: {} };
-    }
-    try {
-        const raw = await readText(pkgPath);
-        const parsed = JSON.parse(raw);
-        const deps = {
-            ...(parsed.dependencies ?? {}),
-            ...(parsed.devDependencies ?? {}),
-            ...(parsed.peerDependencies ?? {}),
-            ...(parsed.optionalDependencies ?? {})
-        };
-        return { exists: true, deps };
-    }
-    catch {
-        return { exists: true, deps: {} };
-    }
-}
-async function detectBackendFrameworks(deps) {
-    return BACKEND_DEP_NAMES.filter((name) => name !== 'next' && Object.prototype.hasOwnProperty.call(deps, name));
-}
-async function detectNextApiRoutes(projectRoot, hasNext) {
-    if (!hasNext) {
-        return false;
-    }
-    const candidates = ['pages/api', 'src/pages/api', 'app/api', 'src/app/api'];
-    for (const candidate of candidates) {
-        if (await isDirectory(join(projectRoot, candidate))) {
-            return true;
-        }
-    }
-    return false;
-}
-async function detectBackendDirs(projectRoot) {
-    const found = [];
-    for (const candidate of BACKEND_DIR_CANDIDATES) {
-        if (await isDirectory(join(projectRoot, candidate))) {
-            found.push(candidate);
-        }
-    }
-    return found;
-}
-async function detectSwagger(projectRoot) {
-    const found = [];
-    for (const candidate of SWAGGER_CANDIDATE_PATHS) {
-        if (await pathExists(join(projectRoot, candidate))) {
-            found.push(candidate);
-        }
-    }
-    const protoDir = join(projectRoot, 'proto');
-    if (await isDirectory(protoDir)) {
-        found.push('proto/');
-    }
-    return found;
-}
-async function detectMonorepoConfigs(projectRoot) {
-    const found = [];
-    for (const file of MONOREPO_CONFIG_FILES) {
-        if (await pathExists(join(projectRoot, file))) {
-            found.push(file);
-        }
-    }
-    return found;
-}
+import { isDirectory } from 'peaks-loop-shared/fs';
+import { detectBackendDirs, detectBackendFrameworks, detectMonorepoConfigs, detectNestedServiceEvidence, detectNextApiRoutes, detectNextServerActions, detectSwagger, GREENFIELD_MAX_SRC_FILES, GREENFIELD_MAX_LOCKFILE_DAYS, HIGH_CONFIDENCE_SIGNAL_COUNT, LEGACY_MIN_SRC_FILES, lockfileAgeDays, LOCKFILE_STALE_DAYS, readPackageJsonDeps } from './archetype-detection.js';
 async function countSrcFiles(projectRoot, max = 500) {
     const srcDir = join(projectRoot, 'src');
     if (!(await isDirectory(srcDir))) {
@@ -130,29 +30,42 @@ async function countSrcFiles(projectRoot, max = 500) {
     }
     return count;
 }
-async function lockfileAgeDays(projectRoot) {
-    const candidates = ['pnpm-lock.yaml', 'package-lock.json', 'yarn.lock', 'bun.lockb'];
-    for (const candidate of candidates) {
-        const full = join(projectRoot, candidate);
-        if (await pathExists(full)) {
-            const stats = await stat(full);
-            const ageMs = Date.now() - stats.mtimeMs;
-            return Math.floor(ageMs / MS_PER_DAY);
-        }
-    }
-    return null;
+/**
+ * THE backend predicate — one answer, three callers.
+ *
+ * `decideArchetype`, `decideFrontendOnly` and `decideIntegrationMode` each
+ * spelled the same triple out inline, so a signal added for one of them left
+ * the other two reading a different project. The report then contradicted
+ * itself, which is the failure `54ba0cc4` ("one answer for where frontendOnly
+ * lives") was meant to end but did not. Anything that asks "does this repo
+ * have a backend?" asks here.
+ */
+function hasBackendEvidence(detected) {
+    return (detected.hasBackendFramework ||
+        detected.hasNextApiRoutes ||
+        detected.hasNextServerActions ||
+        detected.backendDirsPresent.length > 0 ||
+        detected.nestedServiceEvidence.length > 0);
 }
 function decideArchetype(detected) {
     const signals = [];
-    const hasBackend = detected.hasBackendFramework || detected.hasNextApiRoutes || detected.backendDirsPresent.length > 0;
+    const hasBackend = hasBackendEvidence(detected);
     signals.push({
         name: 'backend-presence',
         matched: hasBackend,
         detail: hasBackend
             ? [
-                detected.backendFrameworks.length > 0 ? `framework: ${detected.backendFrameworks.join(', ')}` : null,
+                detected.backendFrameworks.length > 0
+                    ? `framework: ${detected.backendFrameworks.join(', ')}`
+                    : null,
                 detected.hasNextApiRoutes ? 'next-api-routes' : null,
-                detected.backendDirsPresent.length > 0 ? `dirs: ${detected.backendDirsPresent.join(', ')}` : null
+                detected.hasNextServerActions ? 'next-server-actions' : null,
+                detected.backendDirsPresent.length > 0
+                    ? `dirs: ${detected.backendDirsPresent.join(', ')}`
+                    : null,
+                detected.nestedServiceEvidence.length > 0
+                    ? `nested: ${detected.nestedServiceEvidence.join(', ')}`
+                    : null
             ]
                 .filter(Boolean)
                 .join('; ')
@@ -161,7 +74,9 @@ function decideArchetype(detected) {
     signals.push({
         name: 'swagger-or-proto',
         matched: detected.hasSwaggerOrProto,
-        detail: detected.hasSwaggerOrProto ? detected.swaggerPaths.join(', ') : 'no swagger/openapi/proto'
+        detail: detected.hasSwaggerOrProto
+            ? detected.swaggerPaths.join(', ')
+            : 'no swagger/openapi/proto'
     });
     signals.push({
         name: 'monorepo-config',
@@ -207,15 +122,24 @@ function decideArchetype(detected) {
     const greenfieldSignalCount = greenfieldSignals.filter(Boolean).length;
     // Greenfield must show both a small src AND a fresh/missing lockfile — otherwise an empty-src legacy stub still looks like greenfield.
     if (!hasBackend && greenfieldSignals[0] === true && greenfieldSignals[1] === true) {
-        return { archetype: 'greenfield', confidence: greenfieldSignalCount === HIGH_CONFIDENCE_SIGNAL_COUNT ? 'high' : 'medium', signals };
+        return {
+            archetype: 'greenfield',
+            confidence: greenfieldSignalCount === HIGH_CONFIDENCE_SIGNAL_COUNT ? 'high' : 'medium',
+            signals
+        };
     }
     const legacySignalCount = [
         !hasBackend,
         !detected.hasSwaggerOrProto,
-        (detected.lockfileAgeDays !== null && detected.lockfileAgeDays > LOCKFILE_STALE_DAYS) || detected.srcFileCount >= LEGACY_MIN_SRC_FILES
+        (detected.lockfileAgeDays !== null && detected.lockfileAgeDays > LOCKFILE_STALE_DAYS) ||
+            detected.srcFileCount >= LEGACY_MIN_SRC_FILES
     ].filter(Boolean).length;
     if (!hasBackend && legacySignalCount >= 2) {
-        return { archetype: 'legacy-frontend', confidence: legacySignalCount === HIGH_CONFIDENCE_SIGNAL_COUNT ? 'high' : 'medium', signals };
+        return {
+            archetype: 'legacy-frontend',
+            confidence: legacySignalCount === HIGH_CONFIDENCE_SIGNAL_COUNT ? 'high' : 'medium',
+            signals
+        };
     }
     if (hasBackend) {
         return { archetype: 'legacy-fullstack', confidence: 'medium', signals };
@@ -226,27 +150,24 @@ function decideFrontendOnly(report) {
     if (report.archetype === 'legacy-frontend' || report.archetype === 'frontend-monorepo') {
         return { frontendOnly: true, reason: `archetype=${report.archetype}` };
     }
-    const noBackend = !report.detected.hasBackendFramework && !report.detected.hasNextApiRoutes && report.detected.backendDirsPresent.length === 0;
+    const noBackend = !hasBackendEvidence(report.detected);
     if (noBackend && !report.detected.hasSwaggerOrProto) {
         return { frontendOnly: true, reason: 'no-backend-no-swagger' };
     }
-    if (report.detected.hasBackendFramework || report.detected.hasNextApiRoutes || report.detected.backendDirsPresent.length > 0) {
-        return { frontendOnly: false, reason: 'backend-detected' };
+    if (noBackend) {
+        return { frontendOnly: false, reason: 'swagger-or-proto-present' };
     }
-    return { frontendOnly: false, reason: 'swagger-or-proto-present' };
+    return { frontendOnly: false, reason: 'backend-detected' };
 }
 /**
  * Three frontend integration scenarios, from the signals `detected`
- * already holds. Backend presence uses the SAME triple as
- * `decideArchetype`'s `hasBackend` (framework OR next API routes OR
- * backend dirs) rather than `hasBackendFramework` alone: `next` is
- * deliberately excluded from `backendFrameworks` (:77), so a Next
- * project with `pages/api` is `legacy-fullstack` there and must not be
- * `prd-only` here — one report cannot contradict itself.
+ * already holds. Backend presence is the SAME predicate `decideArchetype`
+ * uses (`hasBackendEvidence`), because one report cannot be
+ * `legacy-fullstack` and `prd-only` at once — a Next project with server
+ * actions, or an express service under `apps/`, is a backend for both.
  */
 function decideIntegrationMode(report) {
-    const hasBackend = report.detected.hasBackendFramework || report.detected.hasNextApiRoutes || report.detected.backendDirsPresent.length > 0;
-    if (hasBackend) {
+    if (hasBackendEvidence(report.detected)) {
         return { integrationMode: 'full-stack', reason: 'backend-detected' };
     }
     if (report.detected.hasSwaggerOrProto) {
@@ -261,6 +182,8 @@ export async function scanArchetype(options) {
     const hasNext = Object.prototype.hasOwnProperty.call(deps, 'next');
     const hasNextApiRoutes = await detectNextApiRoutes(projectRoot, hasNext);
     const backendDirsPresent = await detectBackendDirs(projectRoot);
+    const nestedServiceEvidence = await detectNestedServiceEvidence(projectRoot);
+    const hasNextServerActions = hasNext ? await detectNextServerActions(projectRoot) : false;
     const swaggerPaths = await detectSwagger(projectRoot);
     const monorepoConfigs = await detectMonorepoConfigs(projectRoot);
     const srcFileCount = await countSrcFiles(projectRoot);
@@ -269,6 +192,8 @@ export async function scanArchetype(options) {
         hasPackageJson,
         hasBackendFramework: backendFrameworks.length > 0,
         backendFrameworks,
+        nestedServiceEvidence,
+        hasNextServerActions,
         hasSwaggerOrProto: swaggerPaths.length > 0,
         swaggerPaths,
         hasMonorepoConfig: monorepoConfigs.length > 0,

package/dist/services/scan/diff-scope-service.js

@@ -9,11 +9,7 @@ const PLACEHOLDER_PATTERNS = [
     /^\.{2,}$/, // ...
     /^(?:in-scope|out-of-scope)\s+(?:files|surfaces)/i // bullet that is the template label, not a real path
 ];
-const AUTO_ALLOWED_PATHS = [
-    /^\.peaks\//,
-    /^\.peaks-artifacts\//,
-    /^\.git\//
-];
+const AUTO_ALLOWED_PATHS = [/^\.peaks\//, /^\.peaks-artifacts\//, /^\.git\//];
 const AUTO_ALLOWED_TEST_FILE = /\.(?:test|spec)\.[a-z]+$/i;
 const AUTO_ALLOWED_TEST_DIR = /(?:^|\/)(?:tests?|__tests__|__mocks__|test|spec)\//;
 function isPlaceholder(text) {
@@ -57,14 +53,18 @@ export function globToRegex(pattern) {
     }
     // If the pattern ends with no trailing slash and no extension wildcard, also allow it to match files under the path (treat as dir prefix)
     // E.g. `src/services/login` should match `src/services/login/handler.ts`.
-    body = (!trimmed.includes("*") && !trimmed.includes("?") && !trimmed.includes("."))
-        ? `${body}(?:/.*)?`
-        : body;
+    body =
+        !trimmed.includes('*') && !trimmed.includes('?') && !trimmed.includes('.')
+            ? `${body}(?:/.*)?`
+            : body;
     return new RegExp(`^${body}$`);
 }
 function classifyPatternLine(raw) {
     // Strip leading "- ", "* ", numbered list, or trailing comments.
-    const cleaned = raw.replace(/^\s*[-*+]\s*/, '').replace(/^\s*\d+\.\s*/, '').trim();
+    const cleaned = raw
+        .replace(/^\s*[-*+]\s*/, '')
+        .replace(/^\s*\d+\.\s*/, '')
+        .trim();
     if (cleaned.length === 0)
         return { pattern: null };
     if (isPlaceholder(cleaned))
@@ -119,10 +119,19 @@ function parseRedLineScope(rdBody) {
 }
 function tryGitChangedFiles(projectRoot, baseRef) {
     try {
-        const trackedRaw = execFileSync('git', ['-C', projectRoot, 'diff', '--name-only', baseRef], { encoding: 'utf8', windowsHide: true });
-        const tracked = trackedRaw.split(/\r?\n/).map((line) => line.trim()).filter(Boolean);
+        const trackedRaw = execFileSync('git', ['-C', projectRoot, 'diff', '--name-only', baseRef], {
+            encoding: 'utf8',
+            windowsHide: true
+        });
+        const tracked = trackedRaw
+            .split(/\r?\n/)
+            .map((line) => line.trim())
+            .filter(Boolean);
         const untrackedRaw = execFileSync('git', ['-C', projectRoot, 'ls-files', '--others', '--exclude-standard'], { encoding: 'utf8', windowsHide: true });
-        const untracked = untrackedRaw.split(/\r?\n/).map((line) => line.trim()).filter(Boolean);
+        const untracked = untrackedRaw
+            .split(/\r?\n/)
+            .map((line) => line.trim())
+            .filter(Boolean);
         return { ok: true, files: Array.from(new Set([...tracked, ...untracked])) };
     }
     catch {
@@ -140,15 +149,26 @@ function isAutoAllowed(path) {
 }
 function classifyFile(path, inScope, outOfScope) {
     if (isAutoAllowed(path)) {
-        return { classification: 'auto-allowed', reason: 'Auto-allowed (test, mock, or Peaks artifact path)' };
+        return {
+            classification: 'auto-allowed',
+            reason: 'Auto-allowed (test, mock, or Peaks artifact path)'
+        };
     }
     const outMatch = outOfScope.find((pattern) => pattern.regex.test(path));
     if (outMatch !== undefined) {
-        return { classification: 'out-of-scope-violation', matchedPattern: outMatch.raw, reason: `Matches explicit out-of-scope pattern "${outMatch.raw}"` };
+        return {
+            classification: 'out-of-scope-violation',
+            matchedPattern: outMatch.raw,
+            reason: `Matches explicit out-of-scope pattern "${outMatch.raw}"`
+        };
     }
     const inMatch = inScope.find((pattern) => pattern.regex.test(path));
     if (inMatch !== undefined) {
-        return { classification: 'in-scope', matchedPattern: inMatch.raw, reason: `Matches in-scope pattern "${inMatch.raw}"` };
+        return {
+            classification: 'in-scope',
+            matchedPattern: inMatch.raw,
+            reason: `Matches in-scope pattern "${inMatch.raw}"`
+        };
     }
     return { classification: 'unclassified', reason: 'Does not match any declared scope pattern' };
 }