sp2react 0.1.0__tar.gz

sp2react-0.1.0/CHANGELOG.md

@@ -0,0 +1,19 @@
+# Changelog
+
+All notable changes to `sp2react` are documented here.
+
+## [0.1.0] - 2026-10-29
+
+First public release.
+
+### Added
+- Ten-stage pipeline (inputs, extract, inventory, spec, approve spec, convert, review, test, fix, approve) with gating: a stage only starts when the one before it is done
+- Read-only SharePoint extraction: `.aspx` source, browser-added web parts, Script Editor / Content Editor content and links, JSLink, custom scripts and CSS, list schemas, views, forms, groups, navigation
+- Inventory of jQuery / SPServices behaviour with file:line references (show/hide, read-only, defaults, cascades, PreSaveAction validation, group checks, redirects, REST and SPServices calls)
+- Spec model, deterministic base spec and a coverage gate that blocks approval until every required behaviour is covered and legacy texts are verbatim
+- AI agents (Claude through GitHub Copilot Bridger by default; Anthropic, OpenAI and Azure OpenAI also supported) for spec, page, custom handler, review, fix and database mapping, each validated before its output is accepted
+- Generated React (Vite + TypeScript) + FastAPI app: shared list-form engine driven by the spec, the same rule engine in the browser and the API (checked by shared test vectors), legacy URL redirects, SharePoint groups as roles
+- `data_source: database`: the generated API reads and writes your existing tables (MySQL, SQL Server, PostgreSQL via SQLAlchemy) through a reviewed list-to-table mapping drafted by `sp2react map-db`; filters, sorting and paging run as SQL
+- `data_source: sqlite`: full paged export of list items and attachments, loaded into a SQLite copy
+- Field-by-field reconciliation report between SharePoint lists and the app's data (opt-in in database mode)
+- Network policy: every request is checked against the configured SharePoint and model hosts, including redirects; list items, attachments, people and rendered pages are never read in database mode

sp2react-0.1.0/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 Karthikeyan Balasundaram
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

sp2react-0.1.0/MANIFEST.in

@@ -0,0 +1,10 @@
+include README.md
+include LICENSE
+include CHANGELOG.md
+include SECURITY.md
+recursive-include src/sp2react/agents/prompts *.md
+recursive-include src/sp2react/scaffold *
+recursive-include tests *
+prune examples
+global-exclude __pycache__ *.py[cod] *.db
+exclude CLAUDE.md

sp2react-0.1.0/PKG-INFO

@@ -0,0 +1,238 @@
+Metadata-Version: 2.4
+Name: sp2react
+Version: 0.1.0
+Summary: AI-agent pipeline that converts classic SharePoint ASPX/jQuery list forms and pages into a React + FastAPI app on your existing database
+Author: Karthikeyan Balasundaram
+License: MIT
+Project-URL: Homepage, https://github.com/karthikbd/sp2react
+Project-URL: Source Code, https://github.com/karthikbd/sp2react
+Project-URL: Repository, https://github.com/karthikbd/sp2react
+Project-URL: Bug Tracker, https://github.com/karthikbd/sp2react/issues
+Project-URL: Changelog, https://github.com/karthikbd/sp2react/blob/main/CHANGELOG.md
+Project-URL: Documentation, https://github.com/karthikbd/sp2react#readme
+Keywords: sharepoint,sharepoint migration,react,fastapi,jquery,spservices,aspx,list forms,migration,code conversion,ai agents,claude
+Classifier: Development Status :: 3 - Alpha
+Classifier: Intended Audience :: Developers
+Classifier: Topic :: Software Development :: Code Generators
+Classifier: Topic :: Software Development :: Libraries :: Python Modules
+Classifier: Programming Language :: Python :: 3
+Classifier: Programming Language :: Python :: 3.10
+Classifier: Programming Language :: Python :: 3.11
+Classifier: Programming Language :: Python :: 3.12
+Classifier: Programming Language :: Python :: 3.13
+Classifier: License :: OSI Approved :: MIT License
+Classifier: Operating System :: OS Independent
+Requires-Python: >=3.10
+Description-Content-Type: text/markdown
+License-File: LICENSE
+Requires-Dist: pydantic>=2.5
+Requires-Dist: pyyaml>=6.0
+Requires-Dist: requests>=2.31
+Provides-Extra: ntlm
+Requires-Dist: requests-ntlm>=1.2; extra == "ntlm"
+Provides-Extra: db
+Requires-Dist: sqlalchemy>=2.0; extra == "db"
+Provides-Extra: mysql
+Requires-Dist: sqlalchemy>=2.0; extra == "mysql"
+Requires-Dist: pymysql>=1.1; extra == "mysql"
+Provides-Extra: mssql
+Requires-Dist: sqlalchemy>=2.0; extra == "mssql"
+Requires-Dist: pyodbc>=5.0; extra == "mssql"
+Provides-Extra: dev
+Requires-Dist: pytest>=8; extra == "dev"
+Requires-Dist: fastapi>=0.110; extra == "dev"
+Requires-Dist: httpx>=0.27; extra == "dev"
+Requires-Dist: uvicorn>=0.27; extra == "dev"
+Requires-Dist: sqlalchemy>=2.0; extra == "dev"
+Dynamic: license-file
+
+# sp2react
+
+[![PyPI version](https://badge.fury.io/py/sp2react.svg)](https://pypi.org/project/sp2react/)
+[![Python versions](https://img.shields.io/pypi/pyversions/sp2react.svg)](https://pypi.org/project/sp2react/)
+[![License: MIT](https://img.shields.io/badge/License-MIT-yellow.svg)](LICENSE)
+[![OpenSSF Scorecard](https://api.securityscorecards.dev/projects/github.com/karthikbd/sp2react/badge)](https://securityscorecards.dev/viewer/?uri=github.com/karthikbd/sp2react)
+
+Convert classic SharePoint (2013 / 2016 / 2019 / Subscription Edition) list forms and pages built with **ASPX, jQuery and SPServices** into a **React + FastAPI** app that runs on **your existing database**.
+
+Plain code does everything mechanical. AI agents (Claude through your GitHub Copilot **Bridger** by default) do the parts that need judgement. Nothing an agent writes is accepted until it passes automatic checks.
+
+**No business data over HTTP:** in the default `database` mode, list items, attachments and people are never read from SharePoint, and every request is checked against the hosts in your config.
+
+---
+
+## Table of Contents
+
+- [Installation](#installation)
+- [Quick Start](#quick-start)
+- [Configuration](#configuration)
+- [The ten stages](#the-ten-stages)
+- [Your existing database](#your-existing-database)
+- [The generated app](#the-generated-app)
+- [Use it from your own tool](#use-it-from-your-own-tool)
+- [What converts and what does not](#what-converts-and-what-does-not)
+- [Running Tests](#running-tests)
+- [CI / CD](#ci--cd)
+- [Security](#security)
+- [Changelog](#changelog)
+- [License](#license)
+
+---
+
+## Installation
+
+```bash
+pip install "sp2react[mysql]"     # MySQL / MariaDB tables
+pip install "sp2react[mssql]"     # SQL Server tables
+pip install "sp2react[ntlm]"      # add for on-premises Windows authentication
+```
+
+Python 3.10+. Node.js 20+ is needed to build the generated React app.
+
+## Quick Start
+
+```bash
+sp2react init                                   # writes sp2react.yaml
+export SP_USERNAME='CORP\me' SP_PASSWORD='...'  # or SP_COOKIE / SP_TOKEN
+export BRIDGER_TOKEN='...'                      # only if Bridger needs one
+export SP2REACT_DB_URL='mysql+pymysql://user:password@db-host:3306/sea'
+
+sp2react doctor                                 # checks SharePoint, lists Bridger's Claude models
+sp2react run --page /sites/SEA/SitePages/Dashboard.aspx --until spec
+#   review sp2react-work/specs/<screen>.coverage.md, then:
+sp2react approve Dashboard
+sp2react map-db                                 # drafts db-mapping.json; review db-mapping.md
+sp2react run --page /sites/SEA/SitePages/Dashboard.aspx --offline
+sp2react status
+```
+
+## Configuration
+
+```yaml
+sharepoint:
+  site_url: https://sharepoint.example.com/sites/SEA
+  auth: ntlm                 # ntlm | cookie | bearer | none ; secrets come from environment variables
+llm:
+  provider: bridger          # bridger | anthropic | openai | azure_openai
+  api_format: anthropic      # how Bridger serves Claude: anthropic (/v1/messages) or openai (/v1/chat/completions)
+  base_url: http://localhost:4141
+  model: claude-sonnet-4     # exact id from `sp2react doctor`
+  api_key_env: BRIDGER_TOKEN
+pipeline:
+  data_source: database      # database | sqlite | sharepoint
+  max_concurrency: 4
+  max_fix_iterations: 5
+database:
+  url_env: SP2REACT_DB_URL
+  mapping: ./db-mapping.json
+security:
+  allowed_hosts: []
+```
+
+## The ten stages
+
+Each stage starts only after the previous one has finished.
+
+| # | Stage | Who | What happens | Checked by |
+|---|---|---|---|---|
+| 1 | inputs | code | config and connectivity | |
+| 2 | extract | code | `.aspx` source, browser-added web parts, Script Editor / Content Editor content, JSLink, custom JS/CSS, list schemas, views, forms, group names, navigation. GET only | manifest of fetched files and errors |
+| 3 | inventory | code | groups each list's New/Edit/Display forms into one screen and finds every jQuery behaviour and data call, with file:line | deterministic |
+| 4 | spec | **agent** | builds the base spec from the schema, then the agent adds the rules that need interpretation | **coverage gate**: every required behaviour covered, legacy texts verbatim, rules valid |
+| 5 | approve_spec | you | read `specs/<screen>.coverage.md` | |
+| 6 | convert | code + **agents** | writes the fixed scaffold in seconds. List forms are rendered by the shared form engine from the spec; agents write only page components and custom handlers, in parallel | import whitelist, no fetch/jQuery/innerHTML, legacy texts present, `tsc` |
+| 7 | review | **agent** | independent parity review | findings fed to fix |
+| 8 | test | code | generated API tests, rule vectors (browser and API engines must agree), `tsc` + `vite build`, data reconciliation | |
+| 9 | fix | **agent** | gets the real compiler and test output and edits only agent-owned files; up to N rounds | re-test |
+| 10 | approve | you | | |
+
+## Your existing database
+
+If your team has already moved the list data into MySQL or SQL Server, the generated FastAPI app reads and writes those tables directly.
+
+1. `sp2react map-db` reads the database **schema only** (tables, columns, types, keys).
+2. It drafts the mapping: each list to a table, each field to a column, lookups to foreign keys, people to a users table or login column, plus created/modified/author/editor/version columns and attachments.
+3. The `dbmap` agent resolves what the draft could not, for example `Countries.Title` migrated as `countries.country_name`.
+4. Validation blocks code generation until every table and column exists and every required field is mapped.
+5. You review `db-mapping.md`, and can edit `db-mapping.json` directly.
+
+At runtime, OData-style queries from the forms and pages (`$filter`, `$orderby`, `$top`, lookup paths such as `Country/Title`) are translated to SQL. Optimistic concurrency uses your version column if you have one, otherwise the modified timestamp.
+
+To check the earlier migration, set `security.sharepoint_item_reads: true`. `reconciliation.md` then compares every list item with its row, field by field, including orphaned lookups and attachment checksums.
+
+## The generated app
+
+```bash
+cd converted-app/backend && pip install -r requirements.txt pymysql && cp .env.example .env && uvicorn app.main:app
+cd converted-app/frontend && npm install && npm run dev
+```
+
+- Behaviour comes from the spec at runtime. `runtime/rules.ts` (browser) and `app/rules.py` (API) interpret the same rules, and shared vectors keep them in agreement, so a direct API call cannot bypass a rule.
+- The form uses SharePoint's layout, labels and control titles, the legacy site CSS is carried over, and old URLs (`/Lists/X/EditForm.aspx?ID=3&Source=...`) redirect to the new routes.
+- SharePoint groups become roles. Membership comes from your users/groups tables or `data/roles.json`.
+- Authentication: `AUTH_MODE=dev` for local work; `header` behind your gateway, or Entra ID in `app/auth.py`.
+
+## Use it from your own tool
+
+```python
+from sp2react import Pipeline, load_config
+
+p = Pipeline(load_config("sp2react.yaml"), progress=print)
+p.stage_inputs(offline=False)
+p.stage_extract(pages=["SitePages/Dashboard.aspx"], offline=False)
+screens = [s["id"] for s in p.stage_inventory(["SitePages/Dashboard.aspx"])]
+p.stage_spec(screens)
+p.approve("Dashboard", "spec", by="reviewer")
+p.stage_map_db([p.load_spec(s) for s in p.approved_sids()])
+p.stage_convert(screens)
+p.stage_review(screens)
+p.stage_test_and_fix(screens)
+p.state            # also written to sp2react-work/state.json
+```
+
+## What converts and what does not
+
+| Converts | Needs your input, or is not converted yet |
+|---|---|
+| List forms (New/Edit/Display) and their jQuery/SPServices behaviour | Workflows, event receivers, compiled solutions: their code is not reachable over REST. They are flagged; export the definitions or source to convert them |
+| Web part pages (SitePages) with Script Editor / Content Editor JavaScript | InfoPath and Power Apps forms: reported, not converted |
+| Basic list views (columns, sort, row limit) | Views with filters and grouping, document libraries, custom master-page branding, rich grids (sort/search/select/export), modal dialogs: planned |
+| SharePoint groups as roles, old URL redirects | Calculated columns are shown but not recomputed; managed metadata, item-level permissions, alert emails |
+
+Run the inventory on your site first. It shows which pages and scripts were found and what each one does, before you commit to a conversion.
+
+## Running Tests
+
+```bash
+pip install -e ".[dev]"
+python -m pytest tests/ -v
+```
+
+The suite runs against `tests/fixtures/legacy-site`, a fictional Contoso procurement site with jQuery 1.12 / SPServices list forms and a REST-driven dashboard. It covers:
+- a mock SharePoint server that rejects writes,
+- a scripted stand-in for the model, including retry-on-feedback and give-up,
+- a renamed-schema database standing in for an earlier migration,
+- the network policy,
+- all ten stages including the fix loop,
+- a real `npm install` + `tsc` + `vite build` of the generated app.
+
+## CI / CD
+
+- `tests.yml`: runs the test suite on Python 3.10–3.13 on every push and pull request.
+- `python-publish.yml`: on a `v*` tag or a published release, tests, builds and publishes to PyPI through **Trusted Publishing** (OIDC, no stored token).
+- `scorecard.yml`: runs the OpenSSF Scorecard weekly and on every push to `main`.
+
+## Security
+
+See [SECURITY.md](SECURITY.md). In short:
+- Requests go only to the configured SharePoint and model hosts, and SharePoint is read-only.
+- In database mode no list data is read over HTTP and no business data is sent to the model.
+- Secrets come from environment variables only.
+
+## Changelog
+
+See [CHANGELOG.md](CHANGELOG.md).
+
+## License
+
+MIT. See [LICENSE](LICENSE).

sp2react-0.1.0/README.md

@@ -0,0 +1,190 @@
+# sp2react
+
+[![PyPI version](https://badge.fury.io/py/sp2react.svg)](https://pypi.org/project/sp2react/)
+[![Python versions](https://img.shields.io/pypi/pyversions/sp2react.svg)](https://pypi.org/project/sp2react/)
+[![License: MIT](https://img.shields.io/badge/License-MIT-yellow.svg)](LICENSE)
+[![OpenSSF Scorecard](https://api.securityscorecards.dev/projects/github.com/karthikbd/sp2react/badge)](https://securityscorecards.dev/viewer/?uri=github.com/karthikbd/sp2react)
+
+Convert classic SharePoint (2013 / 2016 / 2019 / Subscription Edition) list forms and pages built with **ASPX, jQuery and SPServices** into a **React + FastAPI** app that runs on **your existing database**.
+
+Plain code does everything mechanical. AI agents (Claude through your GitHub Copilot **Bridger** by default) do the parts that need judgement. Nothing an agent writes is accepted until it passes automatic checks.
+
+**No business data over HTTP:** in the default `database` mode, list items, attachments and people are never read from SharePoint, and every request is checked against the hosts in your config.
+
+---
+
+## Table of Contents
+
+- [Installation](#installation)
+- [Quick Start](#quick-start)
+- [Configuration](#configuration)
+- [The ten stages](#the-ten-stages)
+- [Your existing database](#your-existing-database)
+- [The generated app](#the-generated-app)
+- [Use it from your own tool](#use-it-from-your-own-tool)
+- [What converts and what does not](#what-converts-and-what-does-not)
+- [Running Tests](#running-tests)
+- [CI / CD](#ci--cd)
+- [Security](#security)
+- [Changelog](#changelog)
+- [License](#license)
+
+---
+
+## Installation
+
+```bash
+pip install "sp2react[mysql]"     # MySQL / MariaDB tables
+pip install "sp2react[mssql]"     # SQL Server tables
+pip install "sp2react[ntlm]"      # add for on-premises Windows authentication
+```
+
+Python 3.10+. Node.js 20+ is needed to build the generated React app.
+
+## Quick Start
+
+```bash
+sp2react init                                   # writes sp2react.yaml
+export SP_USERNAME='CORP\me' SP_PASSWORD='...'  # or SP_COOKIE / SP_TOKEN
+export BRIDGER_TOKEN='...'                      # only if Bridger needs one
+export SP2REACT_DB_URL='mysql+pymysql://user:password@db-host:3306/sea'
+
+sp2react doctor                                 # checks SharePoint, lists Bridger's Claude models
+sp2react run --page /sites/SEA/SitePages/Dashboard.aspx --until spec
+#   review sp2react-work/specs/<screen>.coverage.md, then:
+sp2react approve Dashboard
+sp2react map-db                                 # drafts db-mapping.json; review db-mapping.md
+sp2react run --page /sites/SEA/SitePages/Dashboard.aspx --offline
+sp2react status
+```
+
+## Configuration
+
+```yaml
+sharepoint:
+  site_url: https://sharepoint.example.com/sites/SEA
+  auth: ntlm                 # ntlm | cookie | bearer | none ; secrets come from environment variables
+llm:
+  provider: bridger          # bridger | anthropic | openai | azure_openai
+  api_format: anthropic      # how Bridger serves Claude: anthropic (/v1/messages) or openai (/v1/chat/completions)
+  base_url: http://localhost:4141
+  model: claude-sonnet-4     # exact id from `sp2react doctor`
+  api_key_env: BRIDGER_TOKEN
+pipeline:
+  data_source: database      # database | sqlite | sharepoint
+  max_concurrency: 4
+  max_fix_iterations: 5
+database:
+  url_env: SP2REACT_DB_URL
+  mapping: ./db-mapping.json
+security:
+  allowed_hosts: []
+```
+
+## The ten stages
+
+Each stage starts only after the previous one has finished.
+
+| # | Stage | Who | What happens | Checked by |
+|---|---|---|---|---|
+| 1 | inputs | code | config and connectivity | |
+| 2 | extract | code | `.aspx` source, browser-added web parts, Script Editor / Content Editor content, JSLink, custom JS/CSS, list schemas, views, forms, group names, navigation. GET only | manifest of fetched files and errors |
+| 3 | inventory | code | groups each list's New/Edit/Display forms into one screen and finds every jQuery behaviour and data call, with file:line | deterministic |
+| 4 | spec | **agent** | builds the base spec from the schema, then the agent adds the rules that need interpretation | **coverage gate**: every required behaviour covered, legacy texts verbatim, rules valid |
+| 5 | approve_spec | you | read `specs/<screen>.coverage.md` | |
+| 6 | convert | code + **agents** | writes the fixed scaffold in seconds. List forms are rendered by the shared form engine from the spec; agents write only page components and custom handlers, in parallel | import whitelist, no fetch/jQuery/innerHTML, legacy texts present, `tsc` |
+| 7 | review | **agent** | independent parity review | findings fed to fix |
+| 8 | test | code | generated API tests, rule vectors (browser and API engines must agree), `tsc` + `vite build`, data reconciliation | |
+| 9 | fix | **agent** | gets the real compiler and test output and edits only agent-owned files; up to N rounds | re-test |
+| 10 | approve | you | | |
+
+## Your existing database
+
+If your team has already moved the list data into MySQL or SQL Server, the generated FastAPI app reads and writes those tables directly.
+
+1. `sp2react map-db` reads the database **schema only** (tables, columns, types, keys).
+2. It drafts the mapping: each list to a table, each field to a column, lookups to foreign keys, people to a users table or login column, plus created/modified/author/editor/version columns and attachments.
+3. The `dbmap` agent resolves what the draft could not, for example `Countries.Title` migrated as `countries.country_name`.
+4. Validation blocks code generation until every table and column exists and every required field is mapped.
+5. You review `db-mapping.md`, and can edit `db-mapping.json` directly.
+
+At runtime, OData-style queries from the forms and pages (`$filter`, `$orderby`, `$top`, lookup paths such as `Country/Title`) are translated to SQL. Optimistic concurrency uses your version column if you have one, otherwise the modified timestamp.
+
+To check the earlier migration, set `security.sharepoint_item_reads: true`. `reconciliation.md` then compares every list item with its row, field by field, including orphaned lookups and attachment checksums.
+
+## The generated app
+
+```bash
+cd converted-app/backend && pip install -r requirements.txt pymysql && cp .env.example .env && uvicorn app.main:app
+cd converted-app/frontend && npm install && npm run dev
+```
+
+- Behaviour comes from the spec at runtime. `runtime/rules.ts` (browser) and `app/rules.py` (API) interpret the same rules, and shared vectors keep them in agreement, so a direct API call cannot bypass a rule.
+- The form uses SharePoint's layout, labels and control titles, the legacy site CSS is carried over, and old URLs (`/Lists/X/EditForm.aspx?ID=3&Source=...`) redirect to the new routes.
+- SharePoint groups become roles. Membership comes from your users/groups tables or `data/roles.json`.
+- Authentication: `AUTH_MODE=dev` for local work; `header` behind your gateway, or Entra ID in `app/auth.py`.
+
+## Use it from your own tool
+
+```python
+from sp2react import Pipeline, load_config
+
+p = Pipeline(load_config("sp2react.yaml"), progress=print)
+p.stage_inputs(offline=False)
+p.stage_extract(pages=["SitePages/Dashboard.aspx"], offline=False)
+screens = [s["id"] for s in p.stage_inventory(["SitePages/Dashboard.aspx"])]
+p.stage_spec(screens)
+p.approve("Dashboard", "spec", by="reviewer")
+p.stage_map_db([p.load_spec(s) for s in p.approved_sids()])
+p.stage_convert(screens)
+p.stage_review(screens)
+p.stage_test_and_fix(screens)
+p.state            # also written to sp2react-work/state.json
+```
+
+## What converts and what does not
+
+| Converts | Needs your input, or is not converted yet |
+|---|---|
+| List forms (New/Edit/Display) and their jQuery/SPServices behaviour | Workflows, event receivers, compiled solutions: their code is not reachable over REST. They are flagged; export the definitions or source to convert them |
+| Web part pages (SitePages) with Script Editor / Content Editor JavaScript | InfoPath and Power Apps forms: reported, not converted |
+| Basic list views (columns, sort, row limit) | Views with filters and grouping, document libraries, custom master-page branding, rich grids (sort/search/select/export), modal dialogs: planned |
+| SharePoint groups as roles, old URL redirects | Calculated columns are shown but not recomputed; managed metadata, item-level permissions, alert emails |
+
+Run the inventory on your site first. It shows which pages and scripts were found and what each one does, before you commit to a conversion.
+
+## Running Tests
+
+```bash
+pip install -e ".[dev]"
+python -m pytest tests/ -v
+```
+
+The suite runs against `tests/fixtures/legacy-site`, a fictional Contoso procurement site with jQuery 1.12 / SPServices list forms and a REST-driven dashboard. It covers:
+- a mock SharePoint server that rejects writes,
+- a scripted stand-in for the model, including retry-on-feedback and give-up,
+- a renamed-schema database standing in for an earlier migration,
+- the network policy,
+- all ten stages including the fix loop,
+- a real `npm install` + `tsc` + `vite build` of the generated app.
+
+## CI / CD
+
+- `tests.yml`: runs the test suite on Python 3.10–3.13 on every push and pull request.
+- `python-publish.yml`: on a `v*` tag or a published release, tests, builds and publishes to PyPI through **Trusted Publishing** (OIDC, no stored token).
+- `scorecard.yml`: runs the OpenSSF Scorecard weekly and on every push to `main`.
+
+## Security
+
+See [SECURITY.md](SECURITY.md). In short:
+- Requests go only to the configured SharePoint and model hosts, and SharePoint is read-only.
+- In database mode no list data is read over HTTP and no business data is sent to the model.
+- Secrets come from environment variables only.
+
+## Changelog
+
+See [CHANGELOG.md](CHANGELOG.md).
+
+## License
+
+MIT. See [LICENSE](LICENSE).

sp2react-0.1.0/SECURITY.md

@@ -0,0 +1,47 @@
+# Security Policy
+
+## Supported Versions
+
+| Version | Supported |
+|---------|-----------|
+| 0.1.x   | ✅ Active  |
+
+## Reporting a Vulnerability
+
+**Please do not open a public GitHub issue for security vulnerabilities.**
+
+Report vulnerabilities privately via GitHub's [Security Advisories](https://github.com/karthikbd/sp2react/security/advisories/new).
+
+You can expect:
+- **Acknowledgement** within 48 hours
+- **Status update** within 7 days
+- **Fix or mitigation** as soon as reasonably possible, coordinated with a disclosure date
+
+## Network access
+
+`sp2react` has no telemetry, no update check and no third-party calls. It opens HTTP connections to exactly two kinds of host, both named in your `sp2react.yaml`:
+
+| Host | Why | What is sent / received |
+|------|-----|-------------------------|
+| `sharepoint.site_url` | Read the site being converted | GET requests only (the client refuses any other verb). Page source, web part definitions, custom scripts/CSS, list schemas, views, group names, navigation |
+| `llm.base_url` (Bridger, or the provider you chose) | AI agent calls | Page source, scripts, list schemas and the draft spec or code under review |
+
+Every request, and every redirect hop, is checked against that allowlist before it is sent (`sp2react/net.py`); anything else raises `NetworkPolicyError`. Extra hosts must be added explicitly under `security.allowed_hosts`.
+
+## Business data
+
+With `pipeline.data_source: database` (the default):
+- list items, attachments, site users and rendered pages are **never read** from SharePoint; the client raises `ItemReadBlocked` if anything tries
+- group membership is not read (group names only)
+- no business data is sent to the model; prompts contain code and schema only
+- `sp2react map-db` reads your database **schema** (tables, columns, types, keys) over the database driver; it does not read rows
+
+Item reads over HTTP happen only when you set `data_source: sqlite` (sp2react migrates the data itself) or explicitly enable `security.sharepoint_item_reads: true` to reconcile the lists with your tables.
+
+## Secrets
+
+Credentials are read from environment variables named in the config (`SP_USERNAME`/`SP_PASSWORD`, `SP_COOKIE`, `SP_TOKEN`, the model token, the database URL). They are never written to the workspace, the generated app or agent transcripts.
+
+## Generated application
+
+The generated FastAPI app ships with `AUTH_MODE=dev` (an `X-User` header) for local testing only. Before deployment, use `AUTH_MODE=header` behind an authenticating gateway, or replace `app/auth.py` with Entra ID token validation.

sp2react-0.1.0/pyproject.toml

@@ -0,0 +1,62 @@
+[build-system]
+requires = ["setuptools>=68", "wheel"]
+build-backend = "setuptools.build_meta"
+
+[project]
+name = "sp2react"
+version = "0.1.0"
+authors = [{name = "Karthikeyan Balasundaram"}]
+description = "AI-agent pipeline that converts classic SharePoint ASPX/jQuery list forms and pages into a React + FastAPI app on your existing database"
+readme = "README.md"
+requires-python = ">=3.10"
+license = {text = "MIT"}
+keywords = [
+    "sharepoint", "sharepoint migration", "react", "fastapi", "jquery", "spservices",
+    "aspx", "list forms", "migration", "code conversion", "ai agents", "claude",
+]
+classifiers = [
+    "Development Status :: 3 - Alpha",
+    "Intended Audience :: Developers",
+    "Topic :: Software Development :: Code Generators",
+    "Topic :: Software Development :: Libraries :: Python Modules",
+    "Programming Language :: Python :: 3",
+    "Programming Language :: Python :: 3.10",
+    "Programming Language :: Python :: 3.11",
+    "Programming Language :: Python :: 3.12",
+    "Programming Language :: Python :: 3.13",
+    "License :: OSI Approved :: MIT License",
+    "Operating System :: OS Independent",
+]
+dependencies = [
+    "pydantic>=2.5",
+    "pyyaml>=6.0",
+    "requests>=2.31",
+]
+
+[project.optional-dependencies]
+ntlm = ["requests-ntlm>=1.2"]
+db = ["sqlalchemy>=2.0"]
+mysql = ["sqlalchemy>=2.0", "pymysql>=1.1"]
+mssql = ["sqlalchemy>=2.0", "pyodbc>=5.0"]
+dev = ["pytest>=8", "fastapi>=0.110", "httpx>=0.27", "uvicorn>=0.27", "sqlalchemy>=2.0"]
+
+[project.scripts]
+sp2react = "sp2react.cli:main"
+
+[project.urls]
+Homepage = "https://github.com/karthikbd/sp2react"
+"Source Code" = "https://github.com/karthikbd/sp2react"
+Repository = "https://github.com/karthikbd/sp2react"
+"Bug Tracker" = "https://github.com/karthikbd/sp2react/issues"
+Changelog = "https://github.com/karthikbd/sp2react/blob/main/CHANGELOG.md"
+Documentation = "https://github.com/karthikbd/sp2react#readme"
+
+[tool.setuptools.packages.find]
+where = ["src"]
+include = ["sp2react*"]
+
+[tool.setuptools.package-data]
+sp2react = ["agents/prompts/*.md", "scaffold/*.json", "scaffold/templates/**/*"]
+
+[tool.pytest.ini_options]
+testpaths = ["tests"]

sp2react-0.1.0/setup.cfg

@@ -0,0 +1,4 @@
+[egg_info]
+tag_build = 
+tag_date = 0
+

sp2react-0.1.0/src/sp2react/__init__.py

@@ -0,0 +1,18 @@
+"""sp2react: convert classic SharePoint ASPX/jQuery list forms and pages into React + FastAPI with AI agents.
+
+Python API:
+    from sp2react import Pipeline, load_config
+    p = Pipeline(load_config("sp2react.yaml"))
+    p.run(pages=["SitePages/Dashboard.aspx"])
+"""
+__version__ = "0.1.0"
+
+
+def __getattr__(name):
+    if name == "Pipeline":
+        from .pipeline import Pipeline
+        return Pipeline
+    if name == "load_config":
+        from .config import load_config
+        return load_config
+    raise AttributeError(name)