@bigsteele/the-prospect 0.2.0 → 0.3.0

package/dist/detect/types 2.d.ts

@@ -1,106 +0,0 @@
-/**
- * The fact shapes. Family rule: a field is either read from the repository or
- * absent. Nothing in these types is an opinion; opinions belong to the agent
- * protocol, and every one it forms must cite a field from here.
- *
- * The one register rule encoded structurally: findings carry the honest verb.
- * A dependency is not "unused", it has "no reference found" - the difference
- * is a CLI-only tool that ships to production anyway versus a lie in a report
- * a founder pays attention to.
- */
-/** One declared dependency and every place it was actually seen. */
-export interface DepFact {
-    name: string;
-    version: string;
-    /** Which manifest declared it, repository-relative. */
-    manifest: string;
-    dev: boolean;
-    /** Files whose import/require statements name this package. */
-    imported_by: number;
-    /** Config files that name it as a string (tailwind plugins, postcss, eslint). */
-    config_mentions: number;
-    /**
-     * Why it counts as used without an import or config mention, when that is the
-     * case: "peer of next", "npm script: email dev", "JSX runtime", "native build
-     * (Capacitor)".
-     */
-    required_by?: string;
-    /** True when no import, config mention, script, or package requiring it was found. */
-    no_reference_found: boolean;
-}
-export type VendorCategory = "ai" | "email" | "sms" | "payments" | "database" | "auth" | "storage" | "crm" | "analytics" | "monitoring" | "render" | "search" | "queue" | "maps" | "calendar" | "other";
-/** One external service the code talks to, with the evidence. */
-export interface VendorFact {
-    service: string;
-    category: VendorCategory;
-    /** How it was seen: an SDK import, an outbound URL, an env var NAME. Values never. */
-    evidence: Array<{
-        kind: "sdk" | "url" | "env";
-        what: string;
-        file: string;
-    }>;
-    call_sites: number;
-}
-/** Two or more services doing the same category of work. */
-export interface OverlapFact {
-    category: VendorCategory;
-    services: string[];
-    call_sites: number;
-}
-export type RailCategory = "pdf" | "rate-limiting" | "email-templating" | "auth-session" | "queue-scheduler" | "search" | "payments-logic" | "webhook-plumbing" | "parsing-ocr";
-/** A subsystem built by hand where the market sells a rail. */
-export interface HandrolledFact {
-    rail: RailCategory;
-    files: string[];
-    loc: number;
-    /** high: the file's name and its contents agree. low: contents only. */
-    confidence: "high" | "low";
-    /** The one line of evidence that convinced the detector, with its file. */
-    signal: {
-        file: string;
-        line: string;
-    };
-}
-/** A cluster of near-identical code living in more than one file. */
-export interface DuplicateFact {
-    files: string[];
-    /** Lines in the repeated block, after normalization. */
-    lines: number;
-    /** A header comment says the copy is deliberate ("copied from", "never imported"). */
-    deliberate: boolean;
-    /** First normalized line of the block, so a reader can find it. */
-    opens_with: string;
-}
-/** A runtime file no entrypoint reaches. */
-export interface DeadFact {
-    file: string;
-    loc: number;
-    /** Why the detector believes nothing reaches it. */
-    note: string;
-}
-/** A call whose cost multiplies: per request, per row, or on a clock. */
-export interface CostFact {
-    file: string;
-    shape: "per-request" | "per-row" | "per-schedule";
-    /** What is being called - a vendor host or an SDK call name. */
-    target: string;
-    /** The line that shows the shape (the loop, the handler, the interval). */
-    line: string;
-}
-/** Vocabulary the repository uses about its own domain, ranked by weight.
- *  The CLI never names the industry; it hands the agent the evidence. */
-export interface Fingerprint {
-    terms: Array<{
-        term: string;
-        count: number;
-        sources: string[];
-    }>;
-    /** Where the terms came from: tables, routes, copy, manifest. */
-    note: string;
-}
-export interface NorthStar {
-    sentence: string | null;
-    source: "NORTH-STAR.md" | "planning" | "PRODUCT.md" | "heuristic" | "none";
-    confidence: "high" | "low" | "unknown";
-    note: string;
-}

package/dist/detect/types 2.js

@@ -1,11 +0,0 @@
-/**
- * The fact shapes. Family rule: a field is either read from the repository or
- * absent. Nothing in these types is an opinion; opinions belong to the agent
- * protocol, and every one it forms must cite a field from here.
- *
- * The one register rule encoded structurally: findings carry the honest verb.
- * A dependency is not "unused", it has "no reference found" - the difference
- * is a CLI-only tool that ships to production anyway versus a lie in a report
- * a founder pays attention to.
- */
-export {};

package/dist/walk 2.d.ts

@@ -1,44 +0,0 @@
-export interface Repo {
-    root: string;
-    name: string;
-    /** Every file considered, repository-relative with forward slashes. */
-    files: string[];
-    /** Text of a file, or null when it is not text, too large, an env file, or unreadable. */
-    read(rel: string): Promise<string | null>;
-    /** Files whose path matches. */
-    matching(re: RegExp): string[];
-    /** Directories skipped because they are a repository of their own or a copy of this one. */
-    skipped: string[];
-    /**
-     * The manifest of an INSTALLED package, looked up the way Node resolves it: from
-     * the directory of the manifest that declares it, up to the root. Null when it is
-     * not installed. node_modules is never walked; this reads one file on request.
-     */
-    installed(fromManifest: string, pkg: string): Promise<InstalledManifest | null>;
-}
-export interface InstalledManifest {
-    bin?: string | Record<string, string>;
-    peerDependencies?: Record<string, string>;
-    peerDependenciesMeta?: Record<string, {
-        optional?: boolean;
-    }>;
-}
-export declare function openRepo(root: string): Promise<Repo>;
-/** Files whose text matches; each hit carries the count of matches. Reads at most `limit` files. */
-export declare function grep(repo: Repo, files: string[], re: RegExp, limit?: number): Promise<Array<{
-    file: string;
-    count: number;
-}>>;
-/** Code files only: what the detectors read for behaviour. */
-export declare const CODE: RegExp;
-/** Test files, which describe behaviour but do not run in production. */
-export declare const TEST_FILE: RegExp;
-/**
- * Not the running software: documentation trees, fixtures, golden files, and this
- * auditor's own package when it is audited from inside the repository that holds it.
- * The first run counted the auditor's detector source as an MCP server, a Bedrock
- * integration and a human gate in the host repository.
- */
-export declare const NOT_RUNTIME: RegExp;
-/** Files the detectors read for behaviour: code, in the runtime tree, not tests. */
-export declare function runtimeCode(files: string[]): string[];

package/dist/walk 2.js

@@ -1,123 +0,0 @@
-// Copied from ai-audit/src/walk.ts, never imported, so the package stays independently
-// deployable (family convention). The only place that touches the filesystem. Walks a repository, skips what is not the
-// project's own code, reads text files under a size cap, and never opens an env file.
-import { readdir, readFile, stat } from "node:fs/promises";
-import { join, relative, sep } from "node:path";
-const SKIP_DIRS = new Set(["node_modules", ".git", "dist", "build", "out", ".next", ".nuxt", ".svelte-kit", ".vercel", ".turbo", "coverage", "vendor", "dist.bak", ".cache", "__pycache__", ".venv", "venv", "target", "test-results", "playwright-report", ".chrome-debug", ".claude-browser"]);
-// Stylesheets are read too: `@import "tw-animate-css"` and Tailwind 4's `@plugin`
-// are how a whole class of packages is used, and a walker that listed .css files
-// but never read them flagged every one of those packages as unreferenced.
-const TEXT = /\.(ts|tsx|js|jsx|mjs|cjs|py|go|rs|rb|php|java|kt|swift|sql|json|jsonc|ya?ml|toml|md|mdx|txt|prisma|graphql|gql|env\.example|sh|css|scss|sass|less|pcss)$/i;
-const ENV_FILE = /(^|\/)\.env(\.[a-z0-9_-]+)?$/i;
-const MAX_BYTES = 512 * 1024;
-const MAX_FILES = 25_000;
-export async function openRepo(root) {
-    const files = [];
-    const skipped = [];
-    const rootName = root.replace(/[\\/]+$/, "").split(/[\\/]/).pop() ?? "";
-    const walk = async (dir, depth) => {
-        let entries;
-        try {
-            entries = await readdir(dir, { withFileTypes: true });
-        }
-        catch {
-            return;
-        }
-        const names = new Set(entries.map((e) => e.name));
-        // A directory below the root that is a repository of its own (its own .git), or a
-        // copy of this one (named like the root, with its own manifest), is not this
-        // software: Brokrr's audit counted a nested Brokrr/ twice and cited both.
-        if (depth > 0 && (names.has(".git") || (dir.split(/[\\/]/).pop() === rootName && names.has("package.json")))) {
-            skipped.push(relative(root, dir).split(sep).join("/"));
-            return;
-        }
-        for (const e of entries.sort((a, b) => a.name.localeCompare(b.name))) {
-            if (files.length >= MAX_FILES)
-                return;
-            const abs = join(dir, e.name);
-            if (e.isSymbolicLink())
-                continue;
-            if (e.isDirectory()) {
-                // dist-demo, build_old, out-web: build output under any suffix.
-                if (SKIP_DIRS.has(e.name) || /^(dist|build|out)([-_.][a-z0-9-]*)?$/i.test(e.name))
-                    continue;
-                await walk(abs, depth + 1);
-            }
-            else if (e.isFile()) {
-                files.push(relative(root, abs).split(sep).join("/"));
-            }
-        }
-    };
-    await walk(root, 0);
-    const cache = new Map();
-    const name = root.replace(/[\\/]+$/, "").split(/[\\/]/).pop() ?? root;
-    return {
-        root,
-        name,
-        files,
-        skipped,
-        async read(rel) {
-            if (cache.has(rel))
-                return cache.get(rel);
-            let text = null;
-            if (TEXT.test(rel) && !ENV_FILE.test(rel)) {
-                try {
-                    const s = await stat(join(root, rel));
-                    if (s.size <= MAX_BYTES)
-                        text = await readFile(join(root, rel), "utf8");
-                }
-                catch {
-                    text = null;
-                }
-            }
-            cache.set(rel, text);
-            return text;
-        },
-        matching(re) {
-            return files.filter((f) => re.test(f));
-        },
-        async installed(fromManifest, pkg) {
-            const parts = fromManifest.split("/").slice(0, -1);
-            for (let i = parts.length; i >= 0; i--) {
-                const abs = join(root, ...parts.slice(0, i), "node_modules", ...pkg.split("/"), "package.json");
-                try {
-                    return JSON.parse(await readFile(abs, "utf8"));
-                }
-                catch {
-                    // not installed at this level
-                }
-            }
-            return null;
-        },
-    };
-}
-/** Files whose text matches; each hit carries the count of matches. Reads at most `limit` files. */
-export async function grep(repo, files, re, limit = 4000) {
-    const out = [];
-    const flags = re.flags.includes("g") ? re.flags : re.flags + "g";
-    const global = new RegExp(re.source, flags);
-    for (const f of files.slice(0, limit)) {
-        const text = await repo.read(f);
-        if (!text)
-            continue;
-        const count = (text.match(global) ?? []).length;
-        if (count > 0)
-            out.push({ file: f, count });
-    }
-    return out;
-}
-/** Code files only: what the detectors read for behaviour. */
-export const CODE = /\.(ts|tsx|js|jsx|mjs|cjs|py|go|rs|rb|php|java|kt|swift)$/i;
-/** Test files, which describe behaviour but do not run in production. */
-export const TEST_FILE = /(^|\.|_|\/)(test|spec|e2e)s?(\.|\/)|(^|\/)__tests__\//i;
-/**
- * Not the running software: documentation trees, fixtures, golden files, and this
- * auditor's own package when it is audited from inside the repository that holds it.
- * The first run counted the auditor's detector source as an MCP server, a Bedrock
- * integration and a human gate in the host repository.
- */
-export const NOT_RUNTIME = /(^|\/)(docs?|fixtures?|__fixtures__|__mocks__|golden|examples?|samples?|packages\/the-prospect)\/|(^|\/)\.(?!well-known\/)[^/]+\//i;
-/** Files the detectors read for behaviour: code, in the runtime tree, not tests. */
-export function runtimeCode(files) {
-    return files.filter((f) => CODE.test(f) && !TEST_FILE.test(f) && !NOT_RUNTIME.test(f));
-}