@bigsteele/the-prospect 0.1.1

package/dist/detect/stack.js

@@ -0,0 +1,164 @@
+import { NOT_RUNTIME } from "../walk.js";
+const HOSTING = [
+    { platform: "Vercel", files: /(^|\/)vercel\.json$|(^|\/)\.vercel\/project\.json$/ },
+    { platform: "Netlify", files: /(^|\/)netlify\.toml$/ },
+    { platform: "Cloudflare (Pages/Workers)", files: /(^|\/)wrangler\.(toml|jsonc?)$/ },
+    { platform: "Fly.io", files: /(^|\/)fly\.toml$/ },
+    { platform: "Render", files: /(^|\/)render\.ya?ml$/ },
+    { platform: "Railway", files: /(^|\/)railway\.(json|toml)$/ },
+    { platform: "Heroku", files: /(^|\/)Procfile$/ },
+    { platform: "Firebase Hosting", files: /(^|\/)firebase\.json$/ },
+    { platform: "AWS Amplify", files: /(^|\/)amplify\.ya?ml$/ },
+];
+const CI = [
+    { platform: "GitHub Actions", files: /^\.github\/workflows\/[^/]+\.ya?ml$/ },
+    { platform: "GitLab CI", files: /(^|\/)\.gitlab-ci\.ya?ml$/ },
+    { platform: "CircleCI", files: /^\.circleci\/config\.ya?ml$/ },
+    { platform: "Jenkins", files: /(^|\/)Jenkinsfile$/ },
+];
+const PUBLISH_MARK = /npm publish|registry-url|id-token|NODE_AUTH_TOKEN/i;
+const DEPLOY_MARK = /wrangler|vercel|netlify|fly deploy|aws s3|aws lambda|gcloud|az webapp|firebase deploy|supabase functions deploy/i;
+const SCRIPT_RUN = /^\s*(npm|npx|yarn|pnpm|node|bun)\b/;
+function parseWorkflow(file, text) {
+    const triggers = [];
+    const onBlock = /(^|\n)(?:on|"on"):\s*([\s\S]*?)(?=\n[a-zA-Z"']|$)/.exec(text)?.[2] ?? "";
+    for (const t of ["push", "pull_request", "schedule", "workflow_dispatch", "release", "tags"]) {
+        if (new RegExp(`(^|\\W)${t}\\s*:`).test(onBlock) || new RegExp(`(^|\\W)${t}\\b`).test(onBlock.split("\n")[0] ?? ""))
+            triggers.push(t);
+    }
+    const runs = [...text.matchAll(/(^|\n)\s*(?:-\s+)?run:\s*(\|?\s*\n?\s*)?([^\n]+)/g)].map((m) => m[3].trim()).filter(Boolean);
+    const publishes = PUBLISH_MARK.test(text);
+    const deploys = DEPLOY_MARK.test(text);
+    const script_only = runs.length > 0 && !publishes && !deploys && runs.every((r) => SCRIPT_RUN.test(r));
+    return { file, triggers, runs: runs.slice(0, 10), publishes, deploys, script_only };
+}
+export async function detectStack(repo) {
+    const platforms = [];
+    const seen = (rules, kind) => {
+        for (const r of rules) {
+            const hits = repo.files.filter((f) => r.files.test(f) && !/fixtures?|templates?|examples?|node_modules/.test(f));
+            if (hits.length)
+                platforms.push({ platform: r.platform, kind, evidence: hits.slice(0, 5) });
+        }
+    };
+    seen(HOSTING, "hosting");
+    seen(CI, "ci");
+    if (repo.files.some((f) => /(^|\/)Dockerfile$|(^|\/)docker-compose\.ya?ml$/.test(f) && !/fixtures?|examples?/.test(f))) {
+        platforms.push({ platform: "Docker", kind: "container", evidence: repo.files.filter((f) => /(^|\/)Dockerfile$|(^|\/)docker-compose\.ya?ml$/.test(f)).slice(0, 3) });
+    }
+    const workflows = [];
+    for (const f of repo.files.filter((x) => /^\.github\/workflows\/[^/]+\.ya?ml$/.test(x))) {
+        const text = await repo.read(f);
+        if (text)
+            workflows.push(parseWorkflow(f, text));
+    }
+    // What the repo already has, for the consolidation map's "keep" side.
+    const has = (p) => platforms.find((x) => x.platform.startsWith(p));
+    // IMPORT-ANCHORED probes, a lesson paid for on the first run: a sibling
+    // scanner's detector source MENTIONS "@upstash/" inside its own regexes,
+    // and a .claude settings file mentions supabase - neither is this product
+    // using the service. Only an import statement (or a live fetch to the
+    // vendor's API host) counts as presence.
+    const imp = (pkg) => new RegExp(`(from\\s+|require\\(\\s*|import\\(\\s*)["']${pkg.replace(/[.*+?^$()|[\]\\]/g, "\\$&")}`);
+    const cloudflareSdk = (await grepAny(repo, imp("@cloudflare/"), 2000)) ?? (await grepAny(repo, /fetch\(\s*[`"']https:\/\/api\.cloudflare\.com/, 2000));
+    const supabase = (await grepAny(repo, imp("@supabase/"), 2000)) ?? (await grepAny(repo, /createClient\([^)]{0,120}\.supabase\.co/, 2000));
+    const clerk = await grepAny(repo, imp("@clerk/"), 2000);
+    const auth0 = await grepAny(repo, imp("@auth0/"), 2000);
+    const s3 = await grepAny(repo, imp("@aws-sdk/client-s3"), 2000);
+    const upstash = await grepAny(repo, imp("@upstash/"), 2000);
+    const searchSaaS = (await grepAny(repo, imp("algoliasearch"), 2000)) ?? (await grepAny(repo, imp("meilisearch"), 2000)) ?? (await grepAny(repo, imp("typesense"), 2000));
+    const consolidations = [];
+    const cf = has("Cloudflare") ?? (cloudflareSdk ? { platform: "Cloudflare", evidence: [cloudflareSdk] } : null);
+    for (const rival of ["Vercel", "Netlify"]) {
+        const r = has(rival);
+        if (cf && r) {
+            consolidations.push({
+                keep: "Cloudflare",
+                candidate: rival,
+                covers: "static hosting and serverless functions (Pages and Workers)",
+                evidence_keep: cf.evidence[0],
+                evidence_candidate: r.evidence[0],
+                note: `Two deploy platforms, two bills, two places a deploy can fail. Is ${rival} carrying anything Cloudflare is not already paid to carry?`,
+            });
+        }
+    }
+    if (supabase && (clerk || auth0)) {
+        const candidate = clerk ? "Clerk" : "Auth0";
+        consolidations.push({
+            keep: "Supabase",
+            candidate,
+            covers: "auth and sessions (included with the database you already pay for)",
+            evidence_keep: supabase,
+            evidence_candidate: (clerk ?? auth0),
+            note: `Supabase Auth ships with the plan the database is on. What is ${candidate} doing that it does not?`,
+        });
+    }
+    if (supabase && s3) {
+        consolidations.push({
+            keep: "Supabase",
+            candidate: "AWS S3",
+            covers: "file storage (included with the database you already pay for)",
+            evidence_keep: supabase,
+            evidence_candidate: s3,
+            note: "If S3 is holding plain uploads, Supabase Storage already holds them under the same bill and the same auth rules.",
+        });
+    }
+    if (supabase && upstash) {
+        consolidations.push({
+            keep: "Supabase (Postgres)",
+            candidate: "Upstash",
+            covers: "queues, schedules and counters (pg_cron, pgmq, or a table)",
+            evidence_keep: supabase,
+            evidence_candidate: upstash,
+            note: "Postgres you already run does queues and schedules at this scale. What is the second datastore buying?",
+        });
+    }
+    if (supabase && searchSaaS) {
+        consolidations.push({
+            keep: "Supabase (Postgres)",
+            candidate: "hosted search",
+            covers: "search (Postgres full-text, tsvector) at small-corpus scale",
+            evidence_keep: supabase,
+            evidence_candidate: searchSaaS,
+            note: "Below roughly a hundred thousand records, the database you already run searches fine. Above it, the vendor earns its bill. Which side is this on?",
+        });
+    }
+    // The npx-instead finding, owner's example one.
+    const scriptOnly = workflows.filter((w) => w.script_only);
+    if (scriptOnly.length) {
+        consolidations.push({
+            keep: "the machine that pushes",
+            candidate: "GitHub Actions minutes",
+            covers: `npm scripts that run anywhere (${scriptOnly.map((w) => w.file.split("/").pop()).join(", ")})`,
+            evidence_keep: "package.json scripts",
+            evidence_candidate: scriptOnly[0].file,
+            note: `${scriptOnly.length} workflow${scriptOnly.length > 1 ? "s" : ""} only run npm scripts. The same line runs free and faster as a pre-push check on the machine that already built the code. Worth keeping CI for the team-wide guarantee, or worth the minutes back?`,
+        });
+    }
+    // Two hosting platforms, or two CI systems: the same paid-twice shape the
+    // vendor detector reports, fed into the same machinery.
+    const overlaps = [];
+    for (const kind of ["hosting", "ci"]) {
+        const list = platforms.filter((p) => p.kind === kind);
+        if (list.length >= 2) {
+            overlaps.push({
+                category: kind,
+                services: list.map((p) => p.platform),
+                call_sites: list.reduce((t, p) => t + p.evidence.length, 0),
+            });
+        }
+    }
+    return { platforms, workflows, consolidations, overlaps };
+}
+/** First RUNTIME file whose text matches; a cheap presence probe. Dot
+ *  directories, docs, fixtures and this package's own tree are excluded by
+ *  the same rule the walker's detectors use. */
+async function grepAny(repo, re, limit) {
+    const files = repo.files.filter((f) => /\.(ts|tsx|js|jsx|mjs|cjs|toml|jsonc?)$/i.test(f) && !NOT_RUNTIME.test(f) && !/node_modules|fixtures?|templates?|(^|\/)package(-lock)?\.json$/.test(f)).slice(0, limit);
+    for (const f of files) {
+        const text = await repo.read(f);
+        if (text && re.test(text))
+            return f;
+    }
+    return null;
+}

package/dist/detect/types.d.ts

@@ -0,0 +1,106 @@
+/**
+ * The fact shapes. Family rule: a field is either read from the repository or
+ * absent. Nothing in these types is an opinion; opinions belong to the agent
+ * protocol, and every one it forms must cite a field from here.
+ *
+ * The one register rule encoded structurally: findings carry the honest verb.
+ * A dependency is not "unused", it has "no reference found" - the difference
+ * is a CLI-only tool that ships to production anyway versus a lie in a report
+ * a founder pays attention to.
+ */
+/** One declared dependency and every place it was actually seen. */
+export interface DepFact {
+    name: string;
+    version: string;
+    /** Which manifest declared it, repository-relative. */
+    manifest: string;
+    dev: boolean;
+    /** Files whose import/require statements name this package. */
+    imported_by: number;
+    /** Config files that name it as a string (tailwind plugins, postcss, eslint). */
+    config_mentions: number;
+    /**
+     * Why it counts as used without an import or config mention, when that is the
+     * case: "peer of next", "npm script: email dev", "JSX runtime", "native build
+     * (Capacitor)".
+     */
+    required_by?: string;
+    /** True when no import, config mention, script, or package requiring it was found. */
+    no_reference_found: boolean;
+}
+export type VendorCategory = "ai" | "email" | "sms" | "payments" | "database" | "auth" | "storage" | "crm" | "analytics" | "monitoring" | "render" | "search" | "queue" | "maps" | "calendar" | "hosting" | "ci" | "other";
+/** One external service the code talks to, with the evidence. */
+export interface VendorFact {
+    service: string;
+    category: VendorCategory;
+    /** How it was seen: an SDK import, an outbound URL, an env var NAME. Values never. */
+    evidence: Array<{
+        kind: "sdk" | "url" | "env";
+        what: string;
+        file: string;
+    }>;
+    call_sites: number;
+}
+/** Two or more services doing the same category of work. */
+export interface OverlapFact {
+    category: VendorCategory;
+    services: string[];
+    call_sites: number;
+}
+export type RailCategory = "pdf" | "rate-limiting" | "email-templating" | "auth-session" | "queue-scheduler" | "search" | "payments-logic" | "webhook-plumbing" | "parsing-ocr";
+/** A subsystem built by hand where the market sells a rail. */
+export interface HandrolledFact {
+    rail: RailCategory;
+    files: string[];
+    loc: number;
+    /** high: the file's name and its contents agree. low: contents only. */
+    confidence: "high" | "low";
+    /** The one line of evidence that convinced the detector, with its file. */
+    signal: {
+        file: string;
+        line: string;
+    };
+}
+/** A cluster of near-identical code living in more than one file. */
+export interface DuplicateFact {
+    files: string[];
+    /** Lines in the repeated block, after normalization. */
+    lines: number;
+    /** A header comment says the copy is deliberate ("copied from", "never imported"). */
+    deliberate: boolean;
+    /** First normalized line of the block, so a reader can find it. */
+    opens_with: string;
+}
+/** A runtime file no entrypoint reaches. */
+export interface DeadFact {
+    file: string;
+    loc: number;
+    /** Why the detector believes nothing reaches it. */
+    note: string;
+}
+/** A call whose cost multiplies: per request, per row, or on a clock. */
+export interface CostFact {
+    file: string;
+    shape: "per-request" | "per-row" | "per-schedule";
+    /** What is being called - a vendor host or an SDK call name. */
+    target: string;
+    /** The line that shows the shape (the loop, the handler, the interval). */
+    line: string;
+}
+/** Vocabulary the repository uses about its own domain, ranked by weight.
+ *  The CLI never names the industry; it hands the agent the evidence. */
+export interface Fingerprint {
+    terms: Array<{
+        term: string;
+        count: number;
+        sources: string[];
+    }>;
+    /** Where the terms came from: tables, routes, copy, manifest. */
+    note: string;
+}
+export interface NorthStar {
+    sentence: string | null;
+    source: "NORTH-STAR.md" | "planning" | "PRODUCT.md" | "heuristic" | "none";
+    confidence: "high" | "low" | "unknown";
+    note: string;
+}

package/dist/detect/types.js

@@ -0,0 +1,11 @@
+/**
+ * The fact shapes. Family rule: a field is either read from the repository or
+ * absent. Nothing in these types is an opinion; opinions belong to the agent
+ * protocol, and every one it forms must cite a field from here.
+ *
+ * The one register rule encoded structurally: findings carry the honest verb.
+ * A dependency is not "unused", it has "no reference found" - the difference
+ * is a CLI-only tool that ships to production anyway versus a lie in a report
+ * a founder pays attention to.
+ */
+export {};

package/dist/detect/vendors.d.ts

@@ -0,0 +1,26 @@
+/**
+ * The vendor roster, and the overlaps.
+ *
+ * The exemplar repo called three AI providers. Not because anyone chose to
+ * pay three vendors for one category of work - because integration number
+ * two and integration number three each arrived inside a feature, and no
+ * ledger existed where the three would ever appear on the same line. This
+ * detector is that ledger: every external service the code talks to, grouped
+ * by what kind of work it does, so paying twice for one job becomes a line
+ * a founder can read.
+ *
+ * Evidence only: SDK imports, outbound URL hosts, environment variable NAMES.
+ * Values are never read - the walker refuses env files outright.
+ */
+import type { Repo } from "../walk.js";
+import type { OverlapFact, VendorFact } from "./types.js";
+export interface VendorReading {
+    vendors: VendorFact[];
+    overlaps: OverlapFact[];
+    /** Hosts called that the map does not recognise - listed, never guessed at. */
+    unrecognised: Array<{
+        host: string;
+        files: string[];
+    }>;
+}
+export declare function detectVendors(repo: Repo): Promise<VendorReading>;

package/dist/detect/vendors.js

@@ -0,0 +1,125 @@
+import { runtimeCode } from "../walk.js";
+/** The map earns a row when a vendor is common enough that a founder would
+ *  recognise the name. Everything else lands in "unrecognised outbound". */
+const KNOWN = [
+    { service: "OpenAI", category: "ai", sdks: /^openai$|^@openai\//, hosts: /(^|\.)api\.openai\.com$/, env: /^OPENAI_/ },
+    { service: "Anthropic", category: "ai", sdks: /^@anthropic-ai\//, hosts: /(^|\.)api\.anthropic\.com$/, env: /^ANTHROPIC_/ },
+    { service: "Google AI (Gemini)", category: "ai", sdks: /^@google\/(generative-ai|genai)$/, hosts: /generativelanguage\.googleapis\.com$/, env: /^(GOOGLE_AI|GEMINI)_/ },
+    { service: "Groq", category: "ai", sdks: /^groq-sdk$/, hosts: /api\.groq\.com$/, env: /^GROQ_/ },
+    { service: "Mistral", category: "ai", sdks: /^@mistralai\//, hosts: /api\.mistral\.ai$/, env: /^MISTRAL_/ },
+    { service: "Replicate", category: "ai", sdks: /^replicate$/, hosts: /api\.replicate\.com$/, env: /^REPLICATE_/ },
+    { service: "ElevenLabs", category: "ai", sdks: /^elevenlabs$|^@elevenlabs\//, hosts: /api\.elevenlabs\.io$/, env: /^ELEVENLABS_/ },
+    { service: "OpenRouter", category: "ai", hosts: /openrouter\.ai$/, env: /^OPENROUTER_/ },
+    { service: "AWS Bedrock", category: "ai", sdks: /^@aws-sdk\/client-bedrock/ },
+    { service: "Resend", category: "email", sdks: /^resend$/, hosts: /api\.resend\.com$/, env: /^RESEND_/ },
+    { service: "SendGrid", category: "email", sdks: /^@sendgrid\//, hosts: /api\.sendgrid\.com$/, env: /^SENDGRID_/ },
+    { service: "Postmark", category: "email", sdks: /^postmark$/, hosts: /api\.postmarkapp\.com$/, env: /^POSTMARK_/ },
+    { service: "Mailgun", category: "email", sdks: /^mailgun/, hosts: /api\.mailgun\.net$/, env: /^MAILGUN_/ },
+    { service: "AWS SES", category: "email", sdks: /^@aws-sdk\/client-ses/ },
+    { service: "Nodemailer (SMTP)", category: "email", sdks: /^nodemailer$/, env: /^SMTP_/ },
+    { service: "Twilio", category: "sms", sdks: /^twilio$/, hosts: /api\.twilio\.com$/, env: /^TWILIO_/ },
+    { service: "Vonage", category: "sms", sdks: /^@vonage\//, env: /^VONAGE_/ },
+    { service: "Stripe", category: "payments", sdks: /^stripe$|^@stripe\//, hosts: /api\.stripe\.com$/, env: /^STRIPE_/ },
+    { service: "PayPal", category: "payments", sdks: /^@paypal\//, hosts: /api(-m)?\.paypal\.com$/, env: /^PAYPAL_/ },
+    { service: "Square", category: "payments", sdks: /^square$/, hosts: /connect\.squareup\.com$/, env: /^SQUARE_/ },
+    { service: "Lemon Squeezy", category: "payments", sdks: /^@lemonsqueezy\//, env: /^LEMONSQUEEZY_/ },
+    { service: "Supabase", category: "database", sdks: /^@supabase\//, hosts: /\.supabase\.co$/, env: /^(SUPABASE|VITE_SUPABASE|NEXT_PUBLIC_SUPABASE)_/ },
+    { service: "Firebase", category: "database", sdks: /^firebase(-admin)?$/, env: /^FIREBASE_/ },
+    { service: "PlanetScale", category: "database", sdks: /^@planetscale\//, env: /^DATABASE_URL$/ },
+    { service: "Neon", category: "database", sdks: /^@neondatabase\//, env: /^NEON_/ },
+    { service: "MongoDB Atlas", category: "database", sdks: /^mongodb$|^mongoose$/, env: /^MONGO(DB)?_/ },
+    { service: "Upstash", category: "queue", sdks: /^@upstash\//, hosts: /upstash\.io$/, env: /^UPSTASH_/ },
+    { service: "Clerk", category: "auth", sdks: /^@clerk\//, env: /^CLERK_/ },
+    { service: "Auth0", category: "auth", sdks: /^auth0$|^@auth0\//, env: /^AUTH0_/ },
+    { service: "Cloudflare", category: "render", sdks: /^@cloudflare\//, hosts: /api\.cloudflare\.com$/, env: /^(CF|CLOUDFLARE)_/ },
+    { service: "AWS S3", category: "storage", sdks: /^@aws-sdk\/client-s3/, env: /^(AWS_S3|S3)_/ },
+    { service: "Uploadthing", category: "storage", sdks: /^uploadthing$|^@uploadthing\//, env: /^UPLOADTHING_/ },
+    { service: "Cloudinary", category: "storage", sdks: /^cloudinary$/, hosts: /api\.cloudinary\.com$/, env: /^CLOUDINARY_/ },
+    { service: "GoHighLevel", category: "crm", hosts: /(services\.)?leadconnectorhq\.com$|rest\.gohighlevel\.com$/, env: /^(GHL|HIGHLEVEL)_/ },
+    { service: "HubSpot", category: "crm", sdks: /^@hubspot\//, hosts: /api\.hubapi\.com$/, env: /^HUBSPOT_/ },
+    { service: "Salesforce", category: "crm", sdks: /^jsforce$/, env: /^(SF|SALESFORCE)_/ },
+    { service: "Airtable", category: "crm", sdks: /^airtable$/, hosts: /api\.airtable\.com$/, env: /^AIRTABLE_/ },
+    { service: "PostHog", category: "analytics", sdks: /^posthog/, hosts: /app\.posthog\.com$/, env: /^POSTHOG_/ },
+    { service: "Mixpanel", category: "analytics", sdks: /^mixpanel/, env: /^MIXPANEL_/ },
+    { service: "Segment", category: "analytics", sdks: /^@segment\//, env: /^SEGMENT_/ },
+    { service: "Google Analytics", category: "analytics", hosts: /www\.google-analytics\.com$/ },
+    { service: "Sentry", category: "monitoring", sdks: /^@sentry\//, env: /^SENTRY_/ },
+    { service: "Langfuse", category: "monitoring", sdks: /^langfuse/, env: /^LANGFUSE_/ },
+    { service: "Algolia", category: "search", sdks: /^algoliasearch$/, env: /^ALGOLIA_/ },
+    { service: "Meilisearch", category: "search", sdks: /^meilisearch$/, env: /^MEILI/ },
+    { service: "Typesense", category: "search", sdks: /^typesense$/, env: /^TYPESENSE_/ },
+    { service: "Google Maps", category: "maps", sdks: /^@googlemaps\//, hosts: /maps\.googleapis\.com$/, env: /^GOOGLE_MAPS_/ },
+    { service: "Mapbox", category: "maps", sdks: /^mapbox-gl$/, env: /^MAPBOX_/ },
+    { service: "Cal.com", category: "calendar", hosts: /api\.cal\.com$/, env: /^CAL_/ },
+    { service: "Calendly", category: "calendar", hosts: /api\.calendly\.com$/, env: /^CALENDLY_/ },
+];
+/** Hosts that are content, not services: fonts, CDNs of the app's own assets, social links. */
+const NOISE_HOST = /(^|\.)(esm\.sh|cdn\.jsdelivr\.net|unpkg\.com|fonts\.(googleapis|gstatic)\.com|githubusercontent\.com|github\.com|linkedin\.com|x\.com|twitter\.com|instagram\.com|facebook\.com|youtube\.com|tiktok\.com|schema\.org|w3\.org|localhost)$/i;
+export async function detectVendors(repo) {
+    const files = runtimeCode(repo.files);
+    const byService = new Map();
+    const touch = (k, kind, what, file) => {
+        const v = byService.get(k.service) ?? { service: k.service, category: k.category, evidence: [], call_sites: 0 };
+        v.call_sites++;
+        if (v.evidence.length < 8 && !v.evidence.some((e) => e.what === what && e.file === file)) {
+            v.evidence.push({ kind, what, file });
+        }
+        byService.set(k.service, v);
+    };
+    const unknownHosts = new Map();
+    for (const f of files) {
+        const text = await repo.read(f);
+        if (!text)
+            continue;
+        for (const m of text.matchAll(/\bfrom\s+["']([^"'\n]+)["']|\brequire\(\s*["']([^"'\n]+)["']\s*\)/g)) {
+            const spec = (m[1] ?? m[2]);
+            if (spec.startsWith("."))
+                continue;
+            const pkg = spec.replace(/^npm:/, "").split("/").slice(0, spec.startsWith("@") || spec.startsWith("npm:@") ? 2 : 1).join("/");
+            for (const k of KNOWN)
+                if (k.sdks?.test(pkg))
+                    touch(k, "sdk", pkg, f);
+        }
+        for (const m of text.matchAll(/https?:\/\/([a-z0-9][a-z0-9.-]+\.[a-z]{2,})/gi)) {
+            const host = m[1].toLowerCase();
+            if (NOISE_HOST.test(host))
+                continue;
+            const known = KNOWN.find((k) => k.hosts?.test(host));
+            if (known)
+                touch(known, "url", host, f);
+            else {
+                const set = unknownHosts.get(host) ?? new Set();
+                set.add(f);
+                unknownHosts.set(host, set);
+            }
+        }
+        for (const m of text.matchAll(/process\.env\.([A-Z][A-Z0-9_]{2,})|Deno\.env\.get\(\s*["']([A-Z][A-Z0-9_]{2,})["']\s*\)/g)) {
+            const name = (m[1] ?? m[2]);
+            for (const k of KNOWN)
+                if (k.env?.test(name))
+                    touch(k, "env", name, f);
+        }
+    }
+    const vendors = [...byService.values()].sort((a, b) => b.call_sites - a.call_sites);
+    const byCategory = new Map();
+    for (const v of vendors) {
+        const list = byCategory.get(v.category) ?? [];
+        list.push(v);
+        byCategory.set(v.category, list);
+    }
+    const overlaps = [];
+    for (const [category, list] of byCategory) {
+        if (category === "other" || list.length < 2)
+            continue;
+        overlaps.push({
+            category,
+            services: list.map((v) => v.service),
+            call_sites: list.reduce((t, v) => t + v.call_sites, 0),
+        });
+    }
+    const unrecognised = [...unknownHosts.entries()]
+        .map(([host, set]) => ({ host, files: [...set].slice(0, 5) }))
+        .sort((a, b) => b.files.length - a.files.length)
+        .slice(0, 20);
+    return { vendors, overlaps: overlaps.sort((a, b) => b.services.length - a.services.length), unrecognised };
+}

package/dist/index.d.ts

@@ -0,0 +1,36 @@
+import { type StackReading } from "./detect/stack.js";
+import { type ProspectScore } from "./score.js";
+import type { CostFact, DeadFact, DepFact, DuplicateFact, Fingerprint, HandrolledFact, NorthStar, OverlapFact, VendorFact } from "./detect/types.js";
+export { toMarkdown, secretShaped } from "./report.js";
+export { checkReport } from "./check.js";
+export type { ProspectScore } from "./score.js";
+export interface Prospect {
+    format: "bigsteele-prospect/1";
+    brand: "The Prospect";
+    version: string;
+    app: string;
+    generated: string;
+    north_star: NorthStar;
+    deps: DepFact[];
+    vendors: VendorFact[];
+    overlaps: OverlapFact[];
+    unrecognised_hosts: Array<{
+        host: string;
+        files: string[];
+    }>;
+    stack: StackReading;
+    handrolled: HandrolledFact[];
+    duplicates: DuplicateFact[];
+    dead: DeadFact[];
+    cost_surfaces: CostFact[];
+    fingerprint: Fingerprint;
+    score: ProspectScore;
+    totals: {
+        files: number;
+        runtime_files: number;
+        runtime_deps: number;
+        entrypoints: number;
+    };
+}
+export declare const VERSION = "0.1.1";
+export declare function runProspect(root: string): Promise<Prospect>;

package/dist/index.js

@@ -0,0 +1,93 @@
+/**
+ * The Prospect - a prospector's read of your codebase and your market.
+ *
+ * Two lanes, one law. Lane 1 subtracts: dependencies that do no work, code
+ * no entrypoint reaches, the same block living in several files, two
+ * vendors doing one job, subsystems hand-rolled where a rail now exists.
+ * Lane 2 adds: what the industry ships that the code shows this product is
+ * missing - and Lane 2 is the agent protocol's job, because it takes
+ * research with sources and dates, which a deterministic offline scanner
+ * must not fake.
+ *
+ * The order of detection is the order of trust. Dependencies and vendors
+ * are read first because they are ledgers - closest to money and hardest
+ * to argue with. Reachability and duplication next: mechanical, checkable.
+ * The fingerprint last, because it is evidence for a question the agent
+ * asks the operator, never an answer.
+ *
+ * Standalone is law (owner, 2026-09-12): one npx on a cold repository
+ * produces the full Step 0 and the full report. No sibling scan installed,
+ * run, or required.
+ */
+import { openRepo } from "./walk.js";
+import { runtimeCode } from "./walk.js";
+import { detectDeps } from "./detect/deps.js";
+import { detectVendors } from "./detect/vendors.js";
+import { detectHandrolled } from "./detect/handrolled.js";
+import { detectDuplication } from "./detect/duplication.js";
+import { detectDeadweight } from "./detect/deadweight.js";
+import { detectCosts } from "./detect/costs.js";
+import { detectFingerprint } from "./detect/fingerprint.js";
+import { detectStack } from "./detect/stack.js";
+import { readNorthStar } from "./northstar.js";
+import { scoreProspect } from "./score.js";
+export { toMarkdown, secretShaped } from "./report.js";
+export { checkReport } from "./check.js";
+export const VERSION = "0.1.1";
+export async function runProspect(root) {
+    const repo = await openRepo(root);
+    const runtime = runtimeCode(repo.files);
+    const [deps, vendorsReading, handrolled, duplicates, deadReading, costs, fingerprint, northStar, stack] = await Promise.all([
+        detectDeps(repo),
+        detectVendors(repo),
+        detectHandrolled(repo),
+        detectDuplication(repo),
+        detectDeadweight(repo),
+        detectCosts(repo),
+        detectFingerprint(repo),
+        readNorthStar(repo),
+        detectStack(repo),
+    ]);
+    // A vendor SDK that is DECLARED but never referenced is a bill with no
+    // work behind it - the score's hardest floor.
+    const vendorSdkNames = new Set(vendorsReading.vendors.flatMap((v) => v.evidence.filter((e) => e.kind === "sdk").map((e) => e.what)));
+    const unusedPaid = deps.find((d) => !d.dev && d.no_reference_found && /^(openai|stripe|twilio|resend|@sendgrid\/|@anthropic-ai\/|@clerk\/|algoliasearch|cloudinary)/.test(d.name))?.name ?? null;
+    void vendorSdkNames;
+    const allOverlaps = [...vendorsReading.overlaps, ...stack.overlaps];
+    const score = scoreProspect({
+        deps,
+        overlaps: allOverlaps,
+        consolidations: stack.consolidations,
+        handrolled,
+        duplicates,
+        dead: deadReading.dead,
+        costs,
+        runtime_files: runtime.length,
+        unused_paid_service: unusedPaid,
+    });
+    return {
+        format: "bigsteele-prospect/1",
+        brand: "The Prospect",
+        version: VERSION,
+        app: repo.name,
+        generated: new Date().toISOString().slice(0, 10),
+        north_star: northStar,
+        deps,
+        vendors: vendorsReading.vendors,
+        overlaps: allOverlaps,
+        stack,
+        unrecognised_hosts: vendorsReading.unrecognised,
+        handrolled,
+        duplicates,
+        dead: deadReading.dead,
+        cost_surfaces: costs,
+        fingerprint,
+        score,
+        totals: {
+            files: repo.files.length,
+            runtime_files: runtime.length,
+            runtime_deps: deps.filter((d) => !d.dev).length,
+            entrypoints: deadReading.entrypoints,
+        },
+    };
+}

package/dist/northstar.d.ts

@@ -0,0 +1,11 @@
+/**
+ * The North Star, read rather than written. Adapted from wiremap's reader
+ * (copied, never imported - family convention). The Prospect is judgment-
+ * heavy in its second half, which makes the deterministic half's honesty
+ * matter MORE, not less: a made-up mission here would tilt every R&D
+ * suggestion the agent researches later. It reads one and names its source,
+ * or it says UNKNOWN and the protocol derives one with the operator.
+ */
+import type { Repo } from "./walk.js";
+import type { NorthStar } from "./detect/types.js";
+export declare function readNorthStar(repo: Repo): Promise<NorthStar>;