@bigsteele/the-prospect 0.1.1

package/dist/detect/deps.js

@@ -0,0 +1,198 @@
+const CONFIG_FILE = /(^|\/)(tailwind|postcss|vite|next|nuxt|astro|svelte|webpack|rollup|babel|jest|vitest|playwright|eslint|prettier|tsup|drizzle|prisma)[^/]*\.(config\.)?(ts|js|mjs|cjs|json)$|(^|\/)\.(eslintrc|babelrc|prettierrc)(\.[a-z]+)?$|(^|\/)(package|turbo|nx|lerna)\.json$/i;
+/** Nested manifests that describe fixtures or vendored copies, not this software. */
+const NOT_A_MANIFEST = /(^|\/)(test|tests|fixtures?|__fixtures__|examples?|templates?)\//i;
+/**
+ * Peers of the frameworks whose peers are used by the framework itself, for when
+ * node_modules is not installed and the real peerDependencies cannot be read.
+ */
+const FRAMEWORK_PEERS = {
+    next: ["react", "react-dom"],
+    gatsby: ["react", "react-dom"],
+    "@remix-run/react": ["react", "react-dom"],
+    expo: ["react", "react-native"],
+    "@monaco-editor/react": ["monaco-editor"],
+    "@tiptap/react": ["@tiptap/pm"],
+    "@tiptap/starter-kit": ["@tiptap/pm"],
+};
+const escapeRe = (s) => s.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
+function importSpecifiers(text) {
+    const out = [];
+    const patterns = [
+        /\bimport\s+(?:[^"'`]*?\s+from\s+)?["']([^"'\n]+)["']/g,
+        /\brequire\(\s*["']([^"'\n]+)["']\s*\)/g,
+        /\bimport\(\s*["']([^"'\n]+)["']\s*\)/g,
+        /\bexport\s+[^"'`\n]*?\s+from\s+["']([^"'\n]+)["']/g,
+    ];
+    for (const re of patterns) {
+        for (const m of text.matchAll(re))
+            out.push(m[1]);
+    }
+    return out;
+}
+/** `@scope/pkg/deep/path` -> `@scope/pkg`; `pkg/deep` -> `pkg`. Relative and URL imports return null. */
+export function packageOf(spec) {
+    if (spec.startsWith(".") || spec.startsWith("/") || /^(node:|https?:|npm:|jsr:)/.test(spec)) {
+        // Deno-style `npm:pkg@1` still names a package worth counting.
+        const npm = /^npm:(@?[^@/]+(?:\/[^@/]+)?)/.exec(spec);
+        return npm ? npm[1] : null;
+    }
+    const parts = spec.split("/");
+    return spec.startsWith("@") ? parts.slice(0, 2).join("/") : parts[0];
+}
+export async function detectDeps(repo) {
+    const manifests = repo.files.filter((f) => /(^|\/)package\.json$/.test(f) && !/node_modules/.test(f) && !NOT_A_MANIFEST.test(f));
+    const declared = [];
+    const scriptsByManifest = new Map();
+    for (const m of manifests) {
+        const text = await repo.read(m);
+        if (!text)
+            continue;
+        let json;
+        try {
+            json = JSON.parse(text);
+        }
+        catch {
+            continue;
+        }
+        scriptsByManifest.set(m, Object.values(json.scripts ?? {}).filter((v) => typeof v === "string"));
+        for (const [dev, block] of [[false, json.dependencies], [true, json.devDependencies]]) {
+            for (const [name, version] of Object.entries(block ?? {})) {
+                declared.push({ name, version, manifest: m, dev, imported_by: 0, config_mentions: 0, no_reference_found: false });
+            }
+        }
+    }
+    if (declared.length === 0)
+        return [];
+    const byName = new Map();
+    for (const d of declared) {
+        const list = byName.get(d.name) ?? [];
+        list.push(d);
+        byName.set(d.name, list);
+    }
+    // Imports: every code file, tests included - a dependency only tests use is
+    // still referenced, and saying otherwise would be the lie this file bans.
+    const codeFiles = repo.files.filter((f) => /\.(ts|tsx|js|jsx|mjs|cjs|css|scss|sass|less|pcss)$/i.test(f) && !/node_modules/.test(f));
+    for (const f of codeFiles) {
+        const text = await repo.read(f);
+        if (!text)
+            continue;
+        const seen = new Set();
+        for (const spec of importSpecifiers(text)) {
+            const pkg = packageOf(spec);
+            if (pkg && !seen.has(pkg)) {
+                seen.add(pkg);
+                for (const d of byName.get(pkg) ?? [])
+                    d.imported_by++;
+            }
+        }
+        // Stylesheets: `@import "tw-animate-css"`, Tailwind 4's `@plugin "pkg"`, and
+        // Sass's `@use` / `@forward`.
+        if (/\.(css|scss|sass|less|pcss)$/i.test(f)) {
+            for (const m of text.matchAll(/@(?:import|plugin|use|forward)\s+(?:url\(\s*)?["']([^"'\n]+)["']/g)) {
+                const pkg = packageOf(m[1].replace(/^~/, ""));
+                if (pkg && !seen.has(pkg)) {
+                    seen.add(pkg);
+                    for (const d of byName.get(pkg) ?? [])
+                        d.imported_by++;
+                }
+            }
+        }
+    }
+    // Config mentions: plugins named as bare strings, and npm scripts that
+    // invoke a package's bin by name.
+    const configs = repo.files.filter((f) => CONFIG_FILE.test(f) && !/node_modules/.test(f));
+    for (const f of configs) {
+        const text = await repo.read(f);
+        if (!text)
+            continue;
+        for (const [name, list] of byName) {
+            const bare = name.replace(/^@[^/]+\//, "");
+            if (text.includes(`"${name}"`) || text.includes(`'${name}'`) || new RegExp(`\\b${escapeRe(bare)}\\b`).test(text)) {
+                for (const d of list)
+                    if (d.manifest !== f)
+                        d.config_mentions++;
+            }
+        }
+    }
+    // ── Used without an import ────────────────────────────────────────────────
+    const referenced = (d) => d.imported_by > 0 || d.config_mentions > 0 || !!d.required_by;
+    const installedCache = new Map();
+    const installed = async (d) => {
+        const key = `${d.manifest}|${d.name}`;
+        if (!installedCache.has(key))
+            installedCache.set(key, await repo.installed(d.manifest, d.name));
+        return installedCache.get(key);
+    };
+    // Run by bin name from the declaring manifest's own scripts. The loop above
+    // skips the declaring manifest, because its dependency list names every
+    // package, so its scripts are read here instead. The bin is not always the
+    // package name: react-email installs `email`.
+    for (const d of declared) {
+        if (referenced(d))
+            continue;
+        const scripts = scriptsByManifest.get(d.manifest) ?? [];
+        if (!scripts.length)
+            continue;
+        const bins = new Set([d.name.replace(/^@[^/]+\//, "")]);
+        const inst = await installed(d);
+        if (inst?.bin && typeof inst.bin === "object")
+            for (const b of Object.keys(inst.bin))
+                bins.add(b);
+        const hit = scripts.find((cmd) => [...bins].some((b) => new RegExp(`(^|[\\s;&|(])${escapeRe(b)}(\\s|$)`).test(cmd)));
+        if (hit)
+            d.required_by = `npm script: ${hit.length > 60 ? `${hit.slice(0, 57)}...` : hit}`;
+    }
+    // The JSX runtime. Every .tsx/.jsx file compiles to an import of `react` (or
+    // whatever jsxImportSource names) that no source file spells out.
+    if (repo.files.some((f) => /\.(tsx|jsx)$/.test(f) && !/node_modules/.test(f))) {
+        let source = "react";
+        for (const tc of repo.files.filter((f) => /(^|\/)(tsconfig|jsconfig)[^/]*\.json$/.test(f) && !NOT_A_MANIFEST.test(f))) {
+            const named = /"jsxImportSource"\s*:\s*"([^"]+)"/.exec((await repo.read(tc)) ?? "")?.[1];
+            if (named) {
+                source = packageOf(named) ?? source;
+                break;
+            }
+        }
+        for (const d of byName.get(source) ?? [])
+            if (!referenced(d))
+                d.required_by = "JSX runtime";
+    }
+    // Capacitor's native build registers every installed plugin from package.json.
+    if (repo.files.some((f) => /(^|\/)capacitor\.config\.(ts|js|json)$/.test(f))) {
+        for (const d of declared) {
+            if (!referenced(d) && /^(@capacitor\/|@capacitor-community\/|cordova-plugin-)/.test(d.name)) {
+                d.required_by = "native build (Capacitor)";
+            }
+        }
+    }
+    // Peers of packages in use. Read from the installed manifest when there is one
+    // (optional peers excluded), from the short framework list when there is not.
+    // Repeated until nothing changes, because a peer can have peers.
+    for (let changed = true; changed;) {
+        changed = false;
+        for (const user of declared) {
+            if (!referenced(user))
+                continue;
+            const inst = await installed(user);
+            const peers = inst
+                ? Object.keys(inst.peerDependencies ?? {}).filter((p) => !inst.peerDependenciesMeta?.[p]?.optional)
+                : (FRAMEWORK_PEERS[user.name] ?? []);
+            for (const peer of peers) {
+                for (const d of byName.get(peer) ?? []) {
+                    // Resolvable from where the user is declared: the same manifest, or the root.
+                    if (referenced(d) || (d.manifest !== user.manifest && d.manifest !== "package.json"))
+                        continue;
+                    d.required_by = `peer of ${user.name}`;
+                    changed = true;
+                }
+            }
+        }
+    }
+    for (const d of declared) {
+        // Types-only and tooling-adjacent packages are referenced by the compiler,
+        // not by an import statement; they never earn the flag.
+        const toolingShaped = /^@types\//.test(d.name) || /(^|-)(cli|eslint|prettier|typescript|vitest|vite|tsx?|husky|lint-staged|concurrently|nodemon)($|-)/.test(d.name);
+        d.no_reference_found = !referenced(d) && !toolingShaped;
+    }
+    return declared.sort((a, b) => Number(b.no_reference_found) - Number(a.no_reference_found) || a.name.localeCompare(b.name));
+}

package/dist/detect/duplication.d.ts

@@ -0,0 +1,17 @@
+/**
+ * Near-identical code living in more than one file.
+ *
+ * Rolling window over normalized lines, matched across files. A cluster is
+ * only worth a founder's attention when it is long enough to be a subsystem
+ * rather than an idiom, so the window is thirty lines and idiomatic repeats
+ * (import blocks, generated files) are filtered before hashing.
+ *
+ * Deliberate copies are downgraded, not hidden: this scan's own family
+ * copies its repository walker between packages on purpose, and the header
+ * comment saying so is the difference between a decision and an accident.
+ * A copy that ANNOUNCES itself is architecture; a copy that does not is a
+ * bug that has not happened yet.
+ */
+import type { Repo } from "../walk.js";
+import type { DuplicateFact } from "./types.js";
+export declare function detectDuplication(repo: Repo): Promise<DuplicateFact[]>;

package/dist/detect/duplication.js

@@ -0,0 +1,79 @@
+import { runtimeCode } from "../walk.js";
+const WINDOW = 30;
+const MIN_FILES = 2;
+const GENERATED = /(^|\/)(.*\.gen\.|.*\.generated\.|types\/supabase|database\.types)/i;
+const DELIBERATE = /copied from|never imported|do not import|kept in sync by hand/i;
+/** Strip comments and blank lines; collapse whitespace. Lines too short to
+ *  mean anything (braces, `else {`) stay in the window but are marked so a
+ *  window of pure punctuation cannot match. */
+function normalize(text) {
+    return text
+        .replace(/\/\*[\s\S]*?\*\//g, "")
+        .split("\n")
+        .map((l) => l.replace(/\/\/.*$/, "").trim().replace(/\s+/g, " "))
+        .filter((l) => l.length > 0);
+}
+function meaningful(lines) {
+    return lines.filter((l) => l.length > 12).length >= WINDOW * 0.5;
+}
+export async function detectDuplication(repo) {
+    const files = runtimeCode(repo.files).filter((f) => !GENERATED.test(f));
+    // hash of a window -> the places it occurs
+    const windows = new Map();
+    const fileLines = new Map();
+    const deliberateFiles = new Set();
+    for (const f of files) {
+        const text = await repo.read(f);
+        if (!text)
+            continue;
+        if (DELIBERATE.test(text.slice(0, 600)))
+            deliberateFiles.add(f);
+        const lines = normalize(text);
+        if (lines.length < WINDOW)
+            continue;
+        fileLines.set(f, lines);
+        for (let i = 0; i + WINDOW <= lines.length; i += 5) {
+            const slice = lines.slice(i, i + WINDOW);
+            if (!meaningful(slice))
+                continue;
+            const key = slice.join("\u0001");
+            const list = windows.get(key) ?? [];
+            list.push({ file: f, start: i });
+            windows.set(key, list);
+        }
+    }
+    // Group matching windows into per-file-set clusters, then extend each to
+    // its true length by walking forward while lines keep agreeing.
+    const clusters = new Map();
+    for (const [key, places] of windows) {
+        const distinct = [...new Set(places.map((p) => p.file))];
+        if (distinct.length < MIN_FILES)
+            continue;
+        const id = distinct.sort().join("|");
+        const first = places[0];
+        const a = fileLines.get(first.file);
+        const b0 = places.find((p) => p.file !== first.file);
+        const b = fileLines.get(b0.file);
+        let len = WINDOW;
+        while (first.start + len < a.length &&
+            b0.start + len < b.length &&
+            a[first.start + len] === b[b0.start + len]) {
+            len++;
+        }
+        const cur = clusters.get(id);
+        if (!cur || len > cur.lines) {
+            clusters.set(id, {
+                files: distinct,
+                lines: len,
+                opens_with: (a[first.start] ?? "").slice(0, 100),
+            });
+        }
+    }
+    return [...clusters.values()]
+        .map((c) => ({
+        ...c,
+        deliberate: c.files.every((f) => deliberateFiles.has(f)) || c.files.filter((f) => deliberateFiles.has(f)).length >= c.files.length - 1,
+    }))
+        .sort((x, y) => y.lines - x.lines)
+        .slice(0, 25);
+}

package/dist/detect/fingerprint.d.ts

@@ -0,0 +1,16 @@
+/**
+ * The industry fingerprint: what this repository talks about.
+ *
+ * The CLI never names the industry - a deterministic scanner guessing
+ * "credit repair" from the word "dispute" would be the invented North Star
+ * problem all over again. Instead it collects the repository's own domain
+ * vocabulary - table names, route slugs, manifest prose, the nouns the
+ * schema is built from - ranks it, and hands the agent evidence it can
+ * confirm with the operator in one question.
+ *
+ * Programming vocabulary is stripped hard: "user", "id", "config" and their
+ * relatives fingerprint every repository on earth, which is to say none.
+ */
+import type { Repo } from "../walk.js";
+import type { Fingerprint } from "./types.js";
+export declare function detectFingerprint(repo: Repo): Promise<Fingerprint>;

package/dist/detect/fingerprint.js

@@ -0,0 +1,95 @@
+/** Not this product's own vocabulary: fixtures, templates, examples, and
+ *  sibling scan packages. The first host-repo run fingerprinted a credit-
+ *  repair FIXTURE inside this very package as the host's industry. */
+const NOT_DOMAIN = /(^|\/)(test|tests|__tests__|fixtures?|__fixtures__|templates?|examples?|samples?|golden|node_modules)\//i;
+const STOP = new Set([
+    "the", "a", "an", "and", "or", "for", "with", "from", "this", "that", "your", "our", "are", "was", "has", "have", "will", "can", "not", "all", "any", "new", "get", "set", "use",
+    "user", "users", "id", "ids", "uuid", "data", "item", "items", "list", "lists", "page", "pages", "view", "views", "index", "main", "app", "apps", "config", "configs", "setting", "settings",
+    "table", "column", "row", "rows", "key", "keys", "value", "values", "type", "types", "status", "state", "states", "created", "updated", "deleted", "name", "email", "admin", "auth", "session", "sessions",
+    "token", "tokens", "test", "tests", "fixture", "fixtures", "util", "utils", "helper", "helpers", "component", "components", "hook", "hooks", "lib", "src", "public", "assets", "style", "styles",
+    "error", "errors", "message", "messages", "response", "request", "handler", "route", "routes", "api", "json", "html", "text", "file", "files", "folder", "null", "true", "false", "string", "number", "boolean",
+    "date", "time", "timestamp", "meta", "metadata", "count", "total", "default", "base", "core", "common", "shared", "client", "server", "function", "functions", "edge", "supabase", "react", "vite", "next",
+    "form", "forms", "input", "button", "modal", "card", "label", "field", "fields", "header", "footer", "nav", "layout", "theme", "dark", "light", "mobile", "desktop", "www", "com", "href", "src", "url", "urls",
+]);
+/** Fold plain plurals so "disputes" and "dispute" count as one term. */
+const singular = (w) => w.length > 4 && w.endsWith("s") && !w.endsWith("ss") && !w.endsWith("us") && !w.endsWith("is")
+    ? w.slice(0, -1)
+    : w;
+const splitIdent = (s) => s
+    .replace(/([a-z0-9])([A-Z])/g, "$1 $2")
+    .toLowerCase()
+    .split(/[^a-z]+/)
+    .map(singular)
+    .filter((w) => w.length > 2 && !STOP.has(w));
+export async function detectFingerprint(repo) {
+    const counts = new Map();
+    const bump = (term, weight, source) => {
+        const cur = counts.get(term) ?? { count: 0, sources: new Set() };
+        cur.count += weight;
+        cur.sources.add(source);
+        counts.set(term, cur);
+    };
+    // Schema: the strongest evidence. A table is a decision about the domain.
+    for (const f of repo.files.filter((x) => !NOT_DOMAIN.test(x) && (/(^|\/)(migrations?|schema|db)\/.*\.(sql|prisma)$|schema\.(sql|prisma)$/i.test(x)))) {
+        const text = await repo.read(f);
+        if (!text)
+            continue;
+        for (const m of text.matchAll(/\b(?:create\s+table(?:\s+if\s+not\s+exists)?|model)\s+["`]?(?:public\.)?([a-zA-Z_][a-zA-Z0-9_]*)/gi)) {
+            for (const w of splitIdent(m[1]))
+                bump(w, 5, "schema");
+        }
+        // Columns, whether the DDL is one line per column or one line per table.
+        for (const m of text.matchAll(/[,(\n]\s*["`]?([a-z_][a-z0-9_]*)["`]?\s+(?:text|varchar|int|bigint|boolean|timestamptz?|numeric|jsonb|uuid|date|serial)/gi)) {
+            for (const w of splitIdent(m[1]))
+                bump(w, 2, "schema");
+        }
+    }
+    // Routes: what the product lets a person come and do.
+    for (const f of repo.files.filter((x) => !NOT_DOMAIN.test(x) && /\.(tsx?|jsx?)$/.test(x))) {
+        const text = await repo.read(f);
+        if (!text)
+            continue;
+        for (const m of text.matchAll(/path\s*[:=]\s*["'`]\/([a-z0-9/_:-]{3,60})["'`]|<Route[^>]*path=["'`]\/([a-z0-9/_:-]{3,60})["'`]/gi)) {
+            for (const seg of (m[1] ?? m[2] ?? "").split("/")) {
+                if (seg.startsWith(":"))
+                    continue;
+                for (const w of splitIdent(seg))
+                    bump(w, 3, "routes");
+            }
+        }
+    }
+    // The manifest's own words about itself.
+    for (const f of repo.files.filter((x) => /(^|\/)package\.json$/.test(x) && !NOT_DOMAIN.test(x))) {
+        const text = await repo.read(f);
+        if (!text)
+            continue;
+        try {
+            const j = JSON.parse(text);
+            for (const w of splitIdent(`${j.name ?? ""} ${j.description ?? ""}`))
+                bump(w, 2, "manifest");
+        }
+        catch {
+            // says nothing
+        }
+    }
+    // README prose, lightly weighted: it is advertising, but it is on-topic advertising.
+    const readme = repo.files.find((f) => /^README\.md$/i.test(f));
+    if (readme) {
+        const text = await repo.read(readme);
+        if (text) {
+            for (const w of splitIdent(text.slice(0, 3000)))
+                bump(w, 1, "readme");
+        }
+    }
+    const terms = [...counts.entries()]
+        .map(([term, v]) => ({ term, count: v.count, sources: [...v.sources] }))
+        .filter((t) => t.count >= 4 || t.sources.length >= 2)
+        .sort((a, b) => b.count - a.count)
+        .slice(0, 40);
+    return {
+        terms,
+        note: terms.length >= 8
+            ? "Ranked domain vocabulary from schema, routes, manifest and README. The agent names the industry from this and confirms it with the operator; the scanner never guesses."
+            : "The fingerprint is thin: little schema or route vocabulary to read. The agent must ask the operator what the business is before researching anything.",
+    };
+}

package/dist/detect/handrolled.d.ts

@@ -0,0 +1,23 @@
+/**
+ * The buy-vs-build ledger: subsystems written by hand where the market sells
+ * a rail.
+ *
+ * The credit-repair founder parsing PDF credit reports by regex is not lazy.
+ * They built before report-access APIs were table stakes, and since then it
+ * has been nobody's job to notice. The exemplar repo hand-rolled a rate
+ * limiter, an email layer and a PDF pipeline for the same reason: each one
+ * was the fastest path on the day it was written.
+ *
+ * This detector does not say "replace it". Half of hand-rolled code is a
+ * correct decision - control, cost, no vendor risk. It says: here is the
+ * subsystem, here is its size, here is the rail category it competes with.
+ * The agent researches the actual rails; the report offers the trade, with
+ * two options, as a question.
+ *
+ * Precision first. A false "you hand-rolled auth" costs the whole report its
+ * credibility, so every rule needs the file's contents to testify, and most
+ * want the file's name to agree before claiming high confidence.
+ */
+import type { Repo } from "../walk.js";
+import type { HandrolledFact } from "./types.js";
+export declare function detectHandrolled(repo: Repo): Promise<HandrolledFact[]>;

package/dist/detect/handrolled.js

@@ -0,0 +1,112 @@
+import { runtimeCode } from "../walk.js";
+const RULES = [
+    {
+        rail: "pdf",
+        name: /pdf|report.?pars|extract/i,
+        content: /%PDF-|getTextContent|pdftotext|pdf.{0,12}(parse|extract|text)|(parse|extract).{0,12}pdf/i,
+        rail_sdk: /["'](pdf-parse|pdfjs-dist|@pdf-lib|unpdf|pdf2json)["']/,
+    },
+    {
+        rail: "rate-limiting",
+        name: /rate.?limit|throttle/i,
+        content: /rate.?limit/i,
+        requires: /(window|bucket|attempts?|count(er)?)\b[\s\S]{0,300}\b(now|Date\.now|timestamp|expires?|ttl)/i,
+        rail_sdk: /["'](@upstash\/ratelimit|rate-limiter-flexible|express-rate-limit|bottleneck|p-throttle)["']/,
+    },
+    {
+        rail: "email-templating",
+        content: /<(html|body|table)[\s>][\s\S]{0,4000}(sendEmail|sendMail|\.send\(|resend|smtp)/i,
+        rail_sdk: /["'](@react-email|react-email|mjml|maizzle|handlebars)["']/,
+    },
+    {
+        rail: "auth-session",
+        name: /auth|session|token/i,
+        content: /(randomBytes|randomUUID|getRandomValues)[\s\S]{0,400}(session|token)[\s\S]{0,400}(insert|INSERT|set\(|save|store)/i,
+        requires: /(expires?|max.?age|ttl|valid)/i,
+        rail_sdk: /["'](@clerk|@auth0|next-auth|@supabase\/auth|lucia|better-auth|passport)["']/,
+    },
+    {
+        rail: "queue-scheduler",
+        name: /queue|worker|scheduler|cron|jobs?/i,
+        content: /(setInterval|setTimeout)[\s\S]{0,300}(fetch|process|poll|dequeue|claim)|status\s*=\s*["']pending["'][\s\S]{0,400}(update|claim|lock)/i,
+        rail_sdk: /["'](bullmq|bee-queue|agenda|bree|graphile-worker|@trigger\.dev|inngest|temporalio)["']/,
+    },
+    {
+        rail: "search",
+        content: /(ilike|ILIKE|LIKE)\s*\(?\s*["'`]%|\.ilike\(|to_tsvector|\btokeni[sz]e\b[\s\S]{0,200}\bscore\b/i,
+        requires: /(search|query|match|find)/i,
+        rail_sdk: /["'](algoliasearch|meilisearch|typesense|@elastic|flexsearch|minisearch|fuse\.js)["']/,
+    },
+    {
+        rail: "payments-logic",
+        name: /invoice|billing|payment/i,
+        content: /(subtotal|line.?items?|invoice.?number)[\s\S]{0,400}(tax|total|amount)/i,
+        requires: /\*|\+|toFixed|Math\.round/,
+        rail_sdk: /["'](stripe|@stripe|square|@paypal|lemonsqueezy)["']/,
+    },
+    {
+        rail: "webhook-plumbing",
+        content: /(createHmac|timingSafeEqual)[\s\S]{0,400}(signature|x-signature|svix|webhook)/i,
+        rail_sdk: /["'](svix|@hono\/webhook)["']/,
+    },
+    {
+        rail: "parsing-ocr",
+        // Name evidence is REQUIRED here, not optional: two regex calls plus the
+        // word "report" appears in half the codebases on earth. The first host
+        // run cited a repository walker as parsing-ocr on exactly that.
+        name: /pars|extract|scrap|ocr/i,
+        name_required: true,
+        content: /(?:\.(?:match|exec|matchAll)\([\s\S]{0,2000}?){3,}/,
+        requires: /(document|statement|report|invoice|receipt|letter|form|upload)/i,
+        rail_sdk: /["'](tesseract\.js|@azure\/ai-form-recognizer|@aws-sdk\/client-textract|@google-cloud\/documentai)["']/,
+    },
+];
+const countLines = (t) => t.split("\n").length;
+export async function detectHandrolled(repo) {
+    const files = runtimeCode(repo.files);
+    // A rail SDK anywhere in the repository retires that rule everywhere: the
+    // decision to buy was already made, and re-litigating it is noise.
+    const railInUse = new Set();
+    const texts = new Map();
+    for (const f of files) {
+        const text = await repo.read(f);
+        if (!text)
+            continue;
+        texts.set(f, text);
+        for (const r of RULES)
+            if (r.rail_sdk.test(text))
+                railInUse.add(r.rail);
+    }
+    const byRail = new Map();
+    for (const [f, text] of texts) {
+        for (const r of RULES) {
+            if (railInUse.has(r.rail))
+                continue;
+            const m = r.content.exec(text);
+            if (!m)
+                continue;
+            if (r.requires && !r.requires.test(text))
+                continue;
+            const named = r.name ? r.name.test(f) : false;
+            if (r.name_required && !named)
+                continue;
+            const cur = byRail.get(r.rail) ?? { files: new Map(), signal: { file: f, line: "" }, named: false };
+            cur.files.set(f, countLines(text));
+            cur.named = cur.named || named;
+            if (!cur.signal.line) {
+                const at = text.slice(0, m.index).split("\n").length;
+                cur.signal = { file: f, line: `${at}: ${text.split("\n")[at - 1]?.trim().slice(0, 120) ?? ""}` };
+            }
+            byRail.set(r.rail, cur);
+        }
+    }
+    return [...byRail.entries()]
+        .map(([rail, r]) => ({
+        rail,
+        files: [...r.files.keys()].slice(0, 10),
+        loc: [...r.files.values()].reduce((t, n) => t + n, 0),
+        confidence: (r.named ? "high" : "low"),
+        signal: r.signal,
+    }))
+        .sort((a, b) => b.loc - a.loc);
+}

package/dist/detect/stack.d.ts

@@ -0,0 +1,66 @@
+/**
+ * The stack cut: platforms whose job another platform you already run can
+ * carry. Owner's own examples, verbatim in the plan: "you don't need GitHub
+ * Actions, you can use npx for what you are doing" and "you don't need
+ * Vercel since you are already using Cloudflare for X". A SaaS-cut audit,
+ * to reduce the bill and the number of places things can break.
+ *
+ * Two kinds of evidence, both deterministic:
+ *
+ *   1. PLATFORMS, read from config files - a vercel.json, a wrangler.toml,
+ *      a netlify.toml, a Procfile, a .github/workflows tree. Two hosting
+ *      platforms is the same "paid twice" finding the vendor detector makes
+ *      for two AI providers, and it feeds the same overlap machinery.
+ *   2. CONSOLIDATION PAIRS, from a versioned house map: you run X, and Y -
+ *      which the configs show you already have - covers X's job. The map
+ *      states only what can be read (both sides exist); whether the kept
+ *      platform's CURRENT offering truly carries the load is the research
+ *      half's job, with a source and a date. The report words every pair
+ *      as a question, never a verdict.
+ *
+ * CI gets special care. A publish workflow with a registry identity is
+ * doing a job a laptop cannot (trusted publishing IS the workflow), and a
+ * workflow that runs on every contributor's push has value one machine
+ * does not. The only workflows flagged are the ones whose every step is an
+ * npm script - the ones a pre-push line runs for free, faster, on the
+ * machine that already built the code.
+ */
+import type { Repo } from "../walk.js";
+import type { OverlapFact } from "./types.js";
+export interface PlatformFact {
+    platform: string;
+    kind: "hosting" | "ci" | "container" | "iac";
+    evidence: string[];
+}
+export interface WorkflowFact {
+    file: string;
+    triggers: string[];
+    /** Every `run:` step, first line each. */
+    runs: string[];
+    /** Publishing identity (id-token, registry, npm publish) - a job a laptop cannot do. */
+    publishes: boolean;
+    /** Deploys somewhere (wrangler, vercel, aws, ...). */
+    deploys: boolean;
+    /** Every run step is an npm/npx/node script - the npx-instead class. */
+    script_only: boolean;
+}
+export interface ConsolidationFact {
+    /** The platform or service the repo already runs, that would remain. */
+    keep: string;
+    /** The candidate to cut. */
+    candidate: string;
+    /** The job the kept one covers. */
+    covers: string;
+    evidence_keep: string;
+    evidence_candidate: string;
+    /** The question the report asks - suggestion register, decided by code. */
+    note: string;
+}
+export interface StackReading {
+    platforms: PlatformFact[];
+    workflows: WorkflowFact[];
+    consolidations: ConsolidationFact[];
+    /** Hosting/CI platform overlaps, same shape the vendor overlaps use. */
+    overlaps: OverlapFact[];
+}
+export declare function detectStack(repo: Repo): Promise<StackReading>;