feat: detect Drupal extensions, workspace roots, and Payload/Next generated code

.dockerignore

@@ -3,5 +3,6 @@ dist
 launcher/dist
 artifacts
 fixtures/*/artifacts
+fixtures/*/node_modules
 fixtures/php-project/vendor
 .git

.gitignore

@@ -5,8 +5,8 @@ coverage/
 .code-quality-tmp/
 fixtures/*/artifacts/
 fixtures/*/.code-quality-tmp/
-fixtures/ts-project/node_modules/
-fixtures/ts-project/package-lock.json
+fixtures/*/node_modules/
+fixtures/*/package-lock.json
 fixtures/php-project/vendor/
 fixtures/python-project/.venv/
 fixtures/python-project/.import_linter_cache/

README.md

@@ -116,7 +116,7 @@ checks:
       reason: "Architecture rules are not defined yet"
 ```
 
-See [Configuration](docs/configuration.md) for detection, defaults, validation, Drupal behavior, and every key.
+See [Configuration](docs/configuration.md) for detection, defaults, validation, framework profiles (Drupal, Payload/Next), and every key.
 
 ## Documentation
 

docs/checks.md

@@ -93,7 +93,7 @@ Each unused-code tool has its own adapter, version stamp, and baseline:
 
 Knip requires `node_modules/` only when `package.json` declares any dependency field (`dependencies`, `devDependencies`, `peerDependencies`, or `optionalDependencies`). Install with the repository's package manager before checking; the gate reports a missing install directly.
 
-Knip disables configuration-executing plugins, so dependencies referenced only by tool configuration can appear unused and be baselined. Entry heuristics include conventional `index`, `main`, and `cli` files, files below `bin` directories in each source root, repository-level tests and test patterns, and scripts referenced from `package.json`, such as `node scripts/build.ts`.
+Knip disables configuration-executing plugins, so dependencies referenced only by tool configuration can appear unused and be baselined. Entry heuristics include conventional `index`, `main`, and `cli` files, files below `bin` directories in each source root, repository-level tests and test patterns, and scripts referenced from `package.json`, such as `node scripts/build.ts`. Framework entry points detected from static config files (Next app/pages routes, middleware, instrumentation, payload.config, vite/vitest/playwright configs) are added as static entry patterns, and in monorepos the generated configuration declares one Knip workspace per resolved source root owner with workspaces that own no root ignored; plugins stay disabled.
 
 PHP checks require a usable `vendor/` directory containing application dependencies and PHPStan context. Run `composer install` before checking; the gate reports a missing install directly.
 

docs/configuration.md

@@ -53,7 +53,7 @@ Without an explicit `languages` list, code-quality combines detected languages w
 | Python | `pyproject.toml` or `setup.py` | Existing `src/` |
 | Web | `.twig`, `.html`, `.css`, `.scss`, or `.less` below `templates/` or `assets/` | Existing `templates/` and `assets/` directories |
 
-When a manifest detects a language but its default roots contain no source files, configuration loading discovers eligible source directories at depth 1 on every command. It ignores hidden, test, build, dependency, generated, and other conventional non-source directories; `init` records the discovered directories in the generated `paths.<language>`.
+When a manifest detects a language, conventional roots with sources are kept, then workspace roots from manifests are added. TypeScript workspace roots come from `pnpm-workspace.yaml` packages, `package.json` workspaces, and depth-1 directories with their own `package.json`; PHP roots come from `composer.json` autoload `psr-4`, `psr-0`, and `classmap` directories; Python roots come from `[tool.uv.workspace]` members minus `exclude` and `[tool.setuptools.packages.find]` `where`. Declared TypeScript members must contain `package.json`, and declared Python members must contain `pyproject.toml`. Member patterns support literal path segments, `*`, `**`, at most one `*` inside a segment, and `!` negations. The member walk reaches depth three; each manifest pattern is capped at 200 characters and only the first 200 include and first 200 exclude patterns are considered. Leading `./` prefixes, repeated slashes, and `.` path segments are normalized. A member maps to `<member>/src` when it exists. Only directories with source files count. When no conventional root has sources, workspace roots and depth-1 discovered roots are unioned, and a discovered directory containing a workspace root is dropped. A `Notice:` lists added roots, and `init` writes them into the generated `paths.<language>`. A depth-1 directory with its own `package.json`, such as `website/`, becomes a TypeScript root. Depth-1 discovery remains the fallback when nothing else resolves; it ignores hidden, test, build, dependency, generated, and other conventional non-source directories. Drupal projects keep the curated custom module, theme, and profile PHP roots instead of adding Composer autoload roots.
 
 If discovery finds no roots, configuration loading omits the language and prints a `Notice:` explaining how to add `paths.<language>`. An explicitly listed language or explicit path still fails when it contains no source files.
 
@@ -75,6 +75,7 @@ Dependency, virtual-environment, distribution, and artifact directories named `n
 When `composer.json` requires `drupal/core`, `drupal/core-recommended`, or another `drupal/core-*` package, code-quality detects custom code automatically:
 
 - PHP uses existing custom modules, themes, and profiles under `web/` or `docroot/`.
+- PHP checks also scan `.module`, `.theme`, `.install`, `.inc`, `.profile`, and `.engine` files with structural anchors.
 - Web uses custom theme directories.
 - TS/JS adds custom theme directories that contain JavaScript.
 - Ordinary source-root discovery remains the fallback when no custom directory exists.
@@ -91,11 +92,26 @@ exclude:
   - "web/modules/custom/site/generated/**"
 ```
 
+## Payload/Next profile
+
+When `next.config.{js,mjs,cjs,ts,mts}` exists at the repository root, or `payload.config.{ts,js,mjs,mts}` exists at the root or under `src/`, code-quality activates the Payload/Next profile for resolved TypeScript sources. For every resolved TypeScript root `<ts-root>`, it excludes:
+
+- `<ts-root>/**/payload-types.ts`
+- `<ts-root>/**/importMap.js`
+- `<ts-root>/**/app/[(]payload[)]/**`
+- `<ts-root>/**/migrations/**`
+- `<ts-root>/**/migrations-*/**`
+- `<ts-root>/**/seed/**`
+- `.next/**`
+- `next-env.d.ts`
+
+A `Notice:` identifies the active Payload/Next defaults. `.next/**` and `next-env.d.ts` remain repository-root exclusions; the generated-code patterns are scoped to TypeScript roots. Dependency-cruiser does not apply exclude globs.
+
 ## What `init` writes
 
 Run `npx @runroom/code-quality init` once the first source and manifest files exist. It writes or updates:
 
-- `.code-quality.yml` with detected languages and paths, unless the file already exists;
+- `.code-quality.yml` with detected languages and resolved paths, including workspace roots, unless the file already exists;
 - missing `quality/<adapter-id>-baseline.json` files while keeping existing snapshots and reporting each as `● Kept existing quality/<adapter-id>-baseline.json`;
 - `.github/workflows/quality.yml`, unless it already exists;
 - a Makefile or an appended target block when safe; and

docs/development.md

@@ -17,7 +17,7 @@ pnpm capture <adapter-id> <fixture-directory>
 | `pnpm verify` | Runs type checking, linting, tests, and the bundle build. |
 | `pnpm build:launcher` | Builds the npm launcher package. |
 | `pnpm docker:build` | Builds the local analysis image. |
-| `pnpm integration` | Exercises the TS, PHP, Python, and web fixture repositories plus deliberate mutations against a locally built image. |
+| `pnpm integration` | Exercises the TS, PHP, Python, web, Drupal, Payload/Next, and monorepo fixture repositories plus deliberate mutations against a locally built image. |
 | `pnpm capture …` | Captures a selected adapter's native output from a pinned image tool for parser tests. |
 
 On its first run, integration installs fixture dependencies through the image. Native-output fixtures preserve the actual supported tool format and feed adapter parser tests.

docs/security.md

@@ -6,7 +6,7 @@ code-quality analyzes untrusted repository content with tools that may execute c
 
 - dependency-cruiser configuration and import-linter imports can execute consumer code inside the container.
 - A reusable-workflow `setup` command, such as `composer install`, executes consumer code inside the job container.
-- Knip runs with configuration-executing plugins disabled, but other supported tools can still load repository configuration where their operation requires it.
+- Knip runs with configuration-executing plugins disabled; its plugin toggles are generated from the complete plugin registry of the pinned Knip version and verified by a test. Framework entry points are matched as static file patterns and parsed, never executed, but other supported tools can still load repository configuration where their operation requires it.
 - Local launcher containers bind-mount the current repository at `/work` read-write.
 
 ## Container users

fixtures/drupal-project/.code-quality.yml

@@ -0,0 +1,4 @@
+checks:
+  disabled:
+    - id: unused
+      reason: "fixture has no installed Composer dependencies"

fixtures/drupal-project/.github/workflows/quality.yml

@@ -0,0 +1,6 @@
+name: quality
+on: [pull_request, push]
+permissions: { contents: read, packages: read }
+jobs:
+  quality:
+    uses: Runroom/code-quality/.github/workflows/quality.yml@v1

fixtures/drupal-project/Makefile

@@ -0,0 +1,21 @@
+# code-quality — run these through make; `$$PWD` is Make escaping for `$PWD`
+CODE_QUALITY_IMAGE ?= ghcr.io/runroom/code-quality:v1
+# Must be a single image reference; it is interpolated into docker run unquoted.
+CODE_QUALITY = docker run --rm -v "$$PWD:/work" $(CODE_QUALITY_IMAGE)
+
+.PHONY: quality quality-all quality-baseline quality-report quality-doctor
+
+quality:
+	$(CODE_QUALITY) check
+
+quality-all:
+	$(CODE_QUALITY) check --all
+
+quality-baseline:
+	$(CODE_QUALITY) baseline
+
+quality-report:
+	$(CODE_QUALITY) report
+
+quality-doctor:
+	$(CODE_QUALITY) doctor

fixtures/drupal-project/composer.json

@@ -0,0 +1 @@
+{"name":"fixture/drupal","require":{"drupal/core-recommended":"^11"}}

fixtures/drupal-project/quality/php-cognitive-baseline.json

@@ -0,0 +1,6 @@
+{
+  "version": 1,
+  "tool": "phpcs@4.0.4",
+  "configHash": "e0fa6304b2c3e12e85b64f67a40efc89b20573dc649440e738beef4f68e3a3cb",
+  "findings": {}
+}

fixtures/drupal-project/quality/php-complexity-baseline.json

@@ -0,0 +1,6 @@
+{
+  "version": 1,
+  "tool": "phpcs@4.0.4",
+  "configHash": "e0fa6304b2c3e12e85b64f67a40efc89b20573dc649440e738beef4f68e3a3cb",
+  "findings": {}
+}

fixtures/drupal-project/quality/php-duplication-baseline.json

@@ -0,0 +1,6 @@
+{
+  "version": 1,
+  "tool": "jscpd@5.2.0",
+  "configHash": "e0fa6304b2c3e12e85b64f67a40efc89b20573dc649440e738beef4f68e3a3cb",
+  "findings": {}
+}

fixtures/drupal-project/quality/web-duplication-baseline.json

@@ -0,0 +1,6 @@
+{
+  "version": 1,
+  "tool": "jscpd@5.2.0",
+  "configHash": "e0fa6304b2c3e12e85b64f67a40efc89b20573dc649440e738beef4f68e3a3cb",
+  "findings": {}
+}

fixtures/drupal-project/web/modules/custom/demo/demo.install

@@ -0,0 +1,7 @@
+<?php
+
+declare(strict_types=1);
+
+function demo_install(): void
+{
+}

fixtures/drupal-project/web/modules/custom/demo/demo.module

@@ -0,0 +1,18 @@
+<?php
+
+declare(strict_types=1);
+
+function demo_help(string $route_name): string
+{
+    return $route_name === "help" ? "Demo help" : "";
+}
+
+function demo_simple(int $value): int
+{
+    return $value * 2;
+}
+
+function demo_status(): string
+{
+    return "ready";
+}

fixtures/drupal-project/web/modules/custom/demo/src/Demo.php

@@ -0,0 +1,13 @@
+<?php
+
+declare(strict_types=1);
+
+namespace Drupal\demo;
+
+final class Demo
+{
+    public function run(int $value): int
+    {
+        return $value * 2;
+    }
+}

fixtures/drupal-project/web/themes/custom/demo/templates/page.html.twig

@@ -0,0 +1,6 @@
+<main class="page">
+  <h1>{{ page.title }}</h1>
+  <div class="page__content">
+    {{ page.content }}
+  </div>
+</main>

fixtures/monorepo-project/.code-quality.yml

@@ -0,0 +1 @@
+languages: [ts]

fixtures/monorepo-project/.github/workflows/quality.yml

@@ -0,0 +1,6 @@
+name: quality
+on: [pull_request, push]
+permissions: { contents: read, packages: read }
+jobs:
+  quality:
+    uses: Runroom/code-quality/.github/workflows/quality.yml@v1

fixtures/monorepo-project/Makefile

@@ -0,0 +1,21 @@
+# code-quality — run these through make; `$$PWD` is Make escaping for `$PWD`
+CODE_QUALITY_IMAGE ?= ghcr.io/runroom/code-quality:v1
+# Must be a single image reference; it is interpolated into docker run unquoted.
+CODE_QUALITY = docker run --rm -v "$$PWD:/work" $(CODE_QUALITY_IMAGE)
+
+.PHONY: quality quality-all quality-baseline quality-report quality-doctor
+
+quality:
+	$(CODE_QUALITY) check
+
+quality-all:
+	$(CODE_QUALITY) check --all
+
+quality-baseline:
+	$(CODE_QUALITY) baseline
+
+quality-report:
+	$(CODE_QUALITY) report
+
+quality-doctor:
+	$(CODE_QUALITY) doctor

fixtures/monorepo-project/apps/web/package.json

@@ -0,0 +1 @@
+{"name":"@fixture/web","private":true,"type":"module"}

fixtures/monorepo-project/apps/web/src/main.ts

@@ -0,0 +1,3 @@
+export function webValue(): string {
+  return "web";
+}

fixtures/monorepo-project/package.json

@@ -0,0 +1 @@
+{"name":"monorepo-fixture","private":true,"type":"module"}

fixtures/monorepo-project/packages/core/package.json

@@ -0,0 +1 @@
+{"name":"@fixture/core","private":true,"type":"module"}

fixtures/monorepo-project/packages/core/src/index.ts

@@ -0,0 +1,3 @@
+export function coreValue(): string {
+  return "core";
+}

fixtures/monorepo-project/pnpm-workspace.yaml

@@ -0,0 +1 @@
+packages: ["packages/*", "apps/*"]

fixtures/monorepo-project/quality/ts-cognitive-baseline.json

@@ -0,0 +1,6 @@
+{
+  "version": 1,
+  "tool": "fallow@3.23.0",
+  "configHash": "a1fc39c1d0e3108d4200b0e7390f3c947bb47f4335d262111a170cee51e2b1dc",
+  "findings": {}
+}

fixtures/monorepo-project/quality/ts-complexity-baseline.json

@@ -0,0 +1,6 @@
+{
+  "version": 1,
+  "tool": "oxlint@1.82.0",
+  "configHash": "a1fc39c1d0e3108d4200b0e7390f3c947bb47f4335d262111a170cee51e2b1dc",
+  "findings": {}
+}

fixtures/monorepo-project/quality/ts-duplication-baseline.json

@@ -0,0 +1,6 @@
+{
+  "version": 1,
+  "tool": "jscpd@5.2.0",
+  "configHash": "a1fc39c1d0e3108d4200b0e7390f3c947bb47f4335d262111a170cee51e2b1dc",
+  "findings": {}
+}

fixtures/monorepo-project/quality/ts-unused-baseline.json

@@ -0,0 +1,6 @@
+{
+  "version": 1,
+  "tool": "knip@6.35.1",
+  "configHash": "a1fc39c1d0e3108d4200b0e7390f3c947bb47f4335d262111a170cee51e2b1dc",
+  "findings": {}
+}

fixtures/monorepo-project/tsconfig.json

@@ -0,0 +1,11 @@
+{
+  "compilerOptions": {
+    "target": "ES2023",
+    "module": "NodeNext",
+    "moduleResolution": "NodeNext",
+    "strict": true,
+    "allowImportingTsExtensions": true,
+    "noEmit": true
+  },
+  "include": ["src"]
+}

fixtures/payload-project/.code-quality.yml

@@ -0,0 +1 @@
+languages: [ts]

fixtures/payload-project/.github/workflows/quality.yml

@@ -0,0 +1,6 @@
+name: quality
+on: [pull_request, push]
+permissions: { contents: read, packages: read }
+jobs:
+  quality:
+    uses: Runroom/code-quality/.github/workflows/quality.yml@v1

fixtures/payload-project/Makefile

@@ -0,0 +1,21 @@
+# code-quality — run these through make; `$$PWD` is Make escaping for `$PWD`
+CODE_QUALITY_IMAGE ?= ghcr.io/runroom/code-quality:v1
+# Must be a single image reference; it is interpolated into docker run unquoted.
+CODE_QUALITY = docker run --rm -v "$$PWD:/work" $(CODE_QUALITY_IMAGE)
+
+.PHONY: quality quality-all quality-baseline quality-report quality-doctor
+
+quality:
+	$(CODE_QUALITY) check
+
+quality-all:
+	$(CODE_QUALITY) check --all
+
+quality-baseline:
+	$(CODE_QUALITY) baseline
+
+quality-report:
+	$(CODE_QUALITY) report
+
+quality-doctor:
+	$(CODE_QUALITY) doctor

fixtures/payload-project/next.config.mjs

@@ -0,0 +1,3 @@
+/** @type {import("next").NextConfig} */
+const config = {};
+export default config;

fixtures/payload-project/package.json

@@ -0,0 +1 @@
+{"name":"payload-fixture","private":true,"type":"module","dependencies":{"next":"file:stubs/next","payload":"file:stubs/payload"},"devDependencies":{"vitest":"file:stubs/vitest","@playwright/test":"file:stubs/playwright-test"}}

fixtures/payload-project/playwright.config.ts

@@ -0,0 +1,3 @@
+import { defineConfig } from "@playwright/test";
+
+export default defineConfig({});

fixtures/payload-project/quality/ts-cognitive-baseline.json

@@ -0,0 +1,6 @@
+{
+  "version": 1,
+  "tool": "fallow@3.23.0",
+  "configHash": "38b0f0af9a11119a26c1815b8d15c587b61191194c80a6fdb4575ac3397b1d93",
+  "findings": {}
+}

fixtures/payload-project/quality/ts-complexity-baseline.json

@@ -0,0 +1,6 @@
+{
+  "version": 1,
+  "tool": "oxlint@1.82.0",
+  "configHash": "38b0f0af9a11119a26c1815b8d15c587b61191194c80a6fdb4575ac3397b1d93",
+  "findings": {}
+}

fixtures/payload-project/quality/ts-duplication-baseline.json

@@ -0,0 +1,6 @@
+{
+  "version": 1,
+  "tool": "jscpd@5.2.0",
+  "configHash": "38b0f0af9a11119a26c1815b8d15c587b61191194c80a6fdb4575ac3397b1d93",
+  "findings": {}
+}

fixtures/payload-project/quality/ts-unused-baseline.json

@@ -0,0 +1,6 @@
+{
+  "version": 1,
+  "tool": "knip@6.35.1",
+  "configHash": "38b0f0af9a11119a26c1815b8d15c587b61191194c80a6fdb4575ac3397b1d93",
+  "findings": {}
+}

fixtures/payload-project/src/app/(payload)/layout.tsx

@@ -0,0 +1,4 @@
+// Generated by Payload. Do not edit.
+export default function PayloadLayout(): string {
+  return "payload";
+}

fixtures/payload-project/src/app/layout.tsx

@@ -0,0 +1,3 @@
+export default function Page(): string {
+  return "page";
+}

fixtures/payload-project/src/app/page.tsx

@@ -0,0 +1,3 @@
+export default function Page(): string {
+  return "page";
+}

fixtures/payload-project/src/collections/Users.ts

@@ -0,0 +1 @@
+export const Users = { slug: "users", fields: [] };

fixtures/payload-project/src/migrations/20260101_000000.ts

@@ -0,0 +1 @@
+export async function up(): Promise<void> {}

fixtures/payload-project/src/payload-types.ts

@@ -0,0 +1,3 @@
+export interface User {
+  id: string;
+}

fixtures/payload-project/src/payload.config.ts

@@ -0,0 +1,4 @@
+import { buildConfig } from "payload";
+import { Users } from "./collections/Users.ts";
+
+export default buildConfig({ collections: [Users] });

fixtures/payload-project/src/seed/seed.ts

@@ -0,0 +1 @@
+export async function seed(): Promise<void> {}

fixtures/payload-project/stubs/next/index.d.ts

@@ -0,0 +1 @@
+export type NextConfig = Record<string, unknown>;