@bigsteele/the-prospect 0.2.0 → 0.3.1

package/dist/detect/deps 2.js

@@ -1,198 +0,0 @@
-const CONFIG_FILE = /(^|\/)(tailwind|postcss|vite|next|nuxt|astro|svelte|webpack|rollup|babel|jest|vitest|playwright|eslint|prettier|tsup|drizzle|prisma)[^/]*\.(config\.)?(ts|js|mjs|cjs|json)$|(^|\/)\.(eslintrc|babelrc|prettierrc)(\.[a-z]+)?$|(^|\/)(package|turbo|nx|lerna)\.json$/i;
-/** Nested manifests that describe fixtures or vendored copies, not this software. */
-const NOT_A_MANIFEST = /(^|\/)(test|tests|fixtures?|__fixtures__|examples?|templates?)\//i;
-/**
- * Peers of the frameworks whose peers are used by the framework itself, for when
- * node_modules is not installed and the real peerDependencies cannot be read.
- */
-const FRAMEWORK_PEERS = {
-    next: ["react", "react-dom"],
-    gatsby: ["react", "react-dom"],
-    "@remix-run/react": ["react", "react-dom"],
-    expo: ["react", "react-native"],
-    "@monaco-editor/react": ["monaco-editor"],
-    "@tiptap/react": ["@tiptap/pm"],
-    "@tiptap/starter-kit": ["@tiptap/pm"],
-};
-const escapeRe = (s) => s.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
-function importSpecifiers(text) {
-    const out = [];
-    const patterns = [
-        /\bimport\s+(?:[^"'`]*?\s+from\s+)?["']([^"'\n]+)["']/g,
-        /\brequire\(\s*["']([^"'\n]+)["']\s*\)/g,
-        /\bimport\(\s*["']([^"'\n]+)["']\s*\)/g,
-        /\bexport\s+[^"'`\n]*?\s+from\s+["']([^"'\n]+)["']/g,
-    ];
-    for (const re of patterns) {
-        for (const m of text.matchAll(re))
-            out.push(m[1]);
-    }
-    return out;
-}
-/** `@scope/pkg/deep/path` -> `@scope/pkg`; `pkg/deep` -> `pkg`. Relative and URL imports return null. */
-export function packageOf(spec) {
-    if (spec.startsWith(".") || spec.startsWith("/") || /^(node:|https?:|npm:|jsr:)/.test(spec)) {
-        // Deno-style `npm:pkg@1` still names a package worth counting.
-        const npm = /^npm:(@?[^@/]+(?:\/[^@/]+)?)/.exec(spec);
-        return npm ? npm[1] : null;
-    }
-    const parts = spec.split("/");
-    return spec.startsWith("@") ? parts.slice(0, 2).join("/") : parts[0];
-}
-export async function detectDeps(repo) {
-    const manifests = repo.files.filter((f) => /(^|\/)package\.json$/.test(f) && !/node_modules/.test(f) && !NOT_A_MANIFEST.test(f));
-    const declared = [];
-    const scriptsByManifest = new Map();
-    for (const m of manifests) {
-        const text = await repo.read(m);
-        if (!text)
-            continue;
-        let json;
-        try {
-            json = JSON.parse(text);
-        }
-        catch {
-            continue;
-        }
-        scriptsByManifest.set(m, Object.values(json.scripts ?? {}).filter((v) => typeof v === "string"));
-        for (const [dev, block] of [[false, json.dependencies], [true, json.devDependencies]]) {
-            for (const [name, version] of Object.entries(block ?? {})) {
-                declared.push({ name, version, manifest: m, dev, imported_by: 0, config_mentions: 0, no_reference_found: false });
-            }
-        }
-    }
-    if (declared.length === 0)
-        return [];
-    const byName = new Map();
-    for (const d of declared) {
-        const list = byName.get(d.name) ?? [];
-        list.push(d);
-        byName.set(d.name, list);
-    }
-    // Imports: every code file, tests included - a dependency only tests use is
-    // still referenced, and saying otherwise would be the lie this file bans.
-    const codeFiles = repo.files.filter((f) => /\.(ts|tsx|js|jsx|mjs|cjs|css|scss|sass|less|pcss)$/i.test(f) && !/node_modules/.test(f));
-    for (const f of codeFiles) {
-        const text = await repo.read(f);
-        if (!text)
-            continue;
-        const seen = new Set();
-        for (const spec of importSpecifiers(text)) {
-            const pkg = packageOf(spec);
-            if (pkg && !seen.has(pkg)) {
-                seen.add(pkg);
-                for (const d of byName.get(pkg) ?? [])
-                    d.imported_by++;
-            }
-        }
-        // Stylesheets: `@import "tw-animate-css"`, Tailwind 4's `@plugin "pkg"`, and
-        // Sass's `@use` / `@forward`.
-        if (/\.(css|scss|sass|less|pcss)$/i.test(f)) {
-            for (const m of text.matchAll(/@(?:import|plugin|use|forward)\s+(?:url\(\s*)?["']([^"'\n]+)["']/g)) {
-                const pkg = packageOf(m[1].replace(/^~/, ""));
-                if (pkg && !seen.has(pkg)) {
-                    seen.add(pkg);
-                    for (const d of byName.get(pkg) ?? [])
-                        d.imported_by++;
-                }
-            }
-        }
-    }
-    // Config mentions: plugins named as bare strings, and npm scripts that
-    // invoke a package's bin by name.
-    const configs = repo.files.filter((f) => CONFIG_FILE.test(f) && !/node_modules/.test(f));
-    for (const f of configs) {
-        const text = await repo.read(f);
-        if (!text)
-            continue;
-        for (const [name, list] of byName) {
-            const bare = name.replace(/^@[^/]+\//, "");
-            if (text.includes(`"${name}"`) || text.includes(`'${name}'`) || new RegExp(`\\b${escapeRe(bare)}\\b`).test(text)) {
-                for (const d of list)
-                    if (d.manifest !== f)
-                        d.config_mentions++;
-            }
-        }
-    }
-    // ── Used without an import ────────────────────────────────────────────────
-    const referenced = (d) => d.imported_by > 0 || d.config_mentions > 0 || !!d.required_by;
-    const installedCache = new Map();
-    const installed = async (d) => {
-        const key = `${d.manifest}|${d.name}`;
-        if (!installedCache.has(key))
-            installedCache.set(key, await repo.installed(d.manifest, d.name));
-        return installedCache.get(key);
-    };
-    // Run by bin name from the declaring manifest's own scripts. The loop above
-    // skips the declaring manifest, because its dependency list names every
-    // package, so its scripts are read here instead. The bin is not always the
-    // package name: react-email installs `email`.
-    for (const d of declared) {
-        if (referenced(d))
-            continue;
-        const scripts = scriptsByManifest.get(d.manifest) ?? [];
-        if (!scripts.length)
-            continue;
-        const bins = new Set([d.name.replace(/^@[^/]+\//, "")]);
-        const inst = await installed(d);
-        if (inst?.bin && typeof inst.bin === "object")
-            for (const b of Object.keys(inst.bin))
-                bins.add(b);
-        const hit = scripts.find((cmd) => [...bins].some((b) => new RegExp(`(^|[\\s;&|(])${escapeRe(b)}(\\s|$)`).test(cmd)));
-        if (hit)
-            d.required_by = `npm script: ${hit.length > 60 ? `${hit.slice(0, 57)}...` : hit}`;
-    }
-    // The JSX runtime. Every .tsx/.jsx file compiles to an import of `react` (or
-    // whatever jsxImportSource names) that no source file spells out.
-    if (repo.files.some((f) => /\.(tsx|jsx)$/.test(f) && !/node_modules/.test(f))) {
-        let source = "react";
-        for (const tc of repo.files.filter((f) => /(^|\/)(tsconfig|jsconfig)[^/]*\.json$/.test(f) && !NOT_A_MANIFEST.test(f))) {
-            const named = /"jsxImportSource"\s*:\s*"([^"]+)"/.exec((await repo.read(tc)) ?? "")?.[1];
-            if (named) {
-                source = packageOf(named) ?? source;
-                break;
-            }
-        }
-        for (const d of byName.get(source) ?? [])
-            if (!referenced(d))
-                d.required_by = "JSX runtime";
-    }
-    // Capacitor's native build registers every installed plugin from package.json.
-    if (repo.files.some((f) => /(^|\/)capacitor\.config\.(ts|js|json)$/.test(f))) {
-        for (const d of declared) {
-            if (!referenced(d) && /^(@capacitor\/|@capacitor-community\/|cordova-plugin-)/.test(d.name)) {
-                d.required_by = "native build (Capacitor)";
-            }
-        }
-    }
-    // Peers of packages in use. Read from the installed manifest when there is one
-    // (optional peers excluded), from the short framework list when there is not.
-    // Repeated until nothing changes, because a peer can have peers.
-    for (let changed = true; changed;) {
-        changed = false;
-        for (const user of declared) {
-            if (!referenced(user))
-                continue;
-            const inst = await installed(user);
-            const peers = inst
-                ? Object.keys(inst.peerDependencies ?? {}).filter((p) => !inst.peerDependenciesMeta?.[p]?.optional)
-                : (FRAMEWORK_PEERS[user.name] ?? []);
-            for (const peer of peers) {
-                for (const d of byName.get(peer) ?? []) {
-                    // Resolvable from where the user is declared: the same manifest, or the root.
-                    if (referenced(d) || (d.manifest !== user.manifest && d.manifest !== "package.json"))
-                        continue;
-                    d.required_by = `peer of ${user.name}`;
-                    changed = true;
-                }
-            }
-        }
-    }
-    for (const d of declared) {
-        // Types-only and tooling-adjacent packages are referenced by the compiler,
-        // not by an import statement; they never earn the flag.
-        const toolingShaped = /^@types\//.test(d.name) || /(^|-)(cli|eslint|prettier|typescript|vitest|vite|tsx?|husky|lint-staged|concurrently|nodemon)($|-)/.test(d.name);
-        d.no_reference_found = !referenced(d) && !toolingShaped;
-    }
-    return declared.sort((a, b) => Number(b.no_reference_found) - Number(a.no_reference_found) || a.name.localeCompare(b.name));
-}

package/dist/detect/types 2.d.ts

@@ -1,106 +0,0 @@
-/**
- * The fact shapes. Family rule: a field is either read from the repository or
- * absent. Nothing in these types is an opinion; opinions belong to the agent
- * protocol, and every one it forms must cite a field from here.
- *
- * The one register rule encoded structurally: findings carry the honest verb.
- * A dependency is not "unused", it has "no reference found" - the difference
- * is a CLI-only tool that ships to production anyway versus a lie in a report
- * a founder pays attention to.
- */
-/** One declared dependency and every place it was actually seen. */
-export interface DepFact {
-    name: string;
-    version: string;
-    /** Which manifest declared it, repository-relative. */
-    manifest: string;
-    dev: boolean;
-    /** Files whose import/require statements name this package. */
-    imported_by: number;
-    /** Config files that name it as a string (tailwind plugins, postcss, eslint). */
-    config_mentions: number;
-    /**
-     * Why it counts as used without an import or config mention, when that is the
-     * case: "peer of next", "npm script: email dev", "JSX runtime", "native build
-     * (Capacitor)".
-     */
-    required_by?: string;
-    /** True when no import, config mention, script, or package requiring it was found. */
-    no_reference_found: boolean;
-}
-export type VendorCategory = "ai" | "email" | "sms" | "payments" | "database" | "auth" | "storage" | "crm" | "analytics" | "monitoring" | "render" | "search" | "queue" | "maps" | "calendar" | "other";
-/** One external service the code talks to, with the evidence. */
-export interface VendorFact {
-    service: string;
-    category: VendorCategory;
-    /** How it was seen: an SDK import, an outbound URL, an env var NAME. Values never. */
-    evidence: Array<{
-        kind: "sdk" | "url" | "env";
-        what: string;
-        file: string;
-    }>;
-    call_sites: number;
-}
-/** Two or more services doing the same category of work. */
-export interface OverlapFact {
-    category: VendorCategory;
-    services: string[];
-    call_sites: number;
-}
-export type RailCategory = "pdf" | "rate-limiting" | "email-templating" | "auth-session" | "queue-scheduler" | "search" | "payments-logic" | "webhook-plumbing" | "parsing-ocr";
-/** A subsystem built by hand where the market sells a rail. */
-export interface HandrolledFact {
-    rail: RailCategory;
-    files: string[];
-    loc: number;
-    /** high: the file's name and its contents agree. low: contents only. */
-    confidence: "high" | "low";
-    /** The one line of evidence that convinced the detector, with its file. */
-    signal: {
-        file: string;
-        line: string;
-    };
-}
-/** A cluster of near-identical code living in more than one file. */
-export interface DuplicateFact {
-    files: string[];
-    /** Lines in the repeated block, after normalization. */
-    lines: number;
-    /** A header comment says the copy is deliberate ("copied from", "never imported"). */
-    deliberate: boolean;
-    /** First normalized line of the block, so a reader can find it. */
-    opens_with: string;
-}
-/** A runtime file no entrypoint reaches. */
-export interface DeadFact {
-    file: string;
-    loc: number;
-    /** Why the detector believes nothing reaches it. */
-    note: string;
-}
-/** A call whose cost multiplies: per request, per row, or on a clock. */
-export interface CostFact {
-    file: string;
-    shape: "per-request" | "per-row" | "per-schedule";
-    /** What is being called - a vendor host or an SDK call name. */
-    target: string;
-    /** The line that shows the shape (the loop, the handler, the interval). */
-    line: string;
-}
-/** Vocabulary the repository uses about its own domain, ranked by weight.
- *  The CLI never names the industry; it hands the agent the evidence. */
-export interface Fingerprint {
-    terms: Array<{
-        term: string;
-        count: number;
-        sources: string[];
-    }>;
-    /** Where the terms came from: tables, routes, copy, manifest. */
-    note: string;
-}
-export interface NorthStar {
-    sentence: string | null;
-    source: "NORTH-STAR.md" | "planning" | "PRODUCT.md" | "heuristic" | "none";
-    confidence: "high" | "low" | "unknown";
-    note: string;
-}

package/dist/detect/types 2.js

@@ -1,11 +0,0 @@
-/**
- * The fact shapes. Family rule: a field is either read from the repository or
- * absent. Nothing in these types is an opinion; opinions belong to the agent
- * protocol, and every one it forms must cite a field from here.
- *
- * The one register rule encoded structurally: findings carry the honest verb.
- * A dependency is not "unused", it has "no reference found" - the difference
- * is a CLI-only tool that ships to production anyway versus a lie in a report
- * a founder pays attention to.
- */
-export {};

package/dist/walk 2.d.ts

@@ -1,44 +0,0 @@
-export interface Repo {
-    root: string;
-    name: string;
-    /** Every file considered, repository-relative with forward slashes. */
-    files: string[];
-    /** Text of a file, or null when it is not text, too large, an env file, or unreadable. */
-    read(rel: string): Promise<string | null>;
-    /** Files whose path matches. */
-    matching(re: RegExp): string[];
-    /** Directories skipped because they are a repository of their own or a copy of this one. */
-    skipped: string[];
-    /**
-     * The manifest of an INSTALLED package, looked up the way Node resolves it: from
-     * the directory of the manifest that declares it, up to the root. Null when it is
-     * not installed. node_modules is never walked; this reads one file on request.
-     */
-    installed(fromManifest: string, pkg: string): Promise<InstalledManifest | null>;
-}
-export interface InstalledManifest {
-    bin?: string | Record<string, string>;
-    peerDependencies?: Record<string, string>;
-    peerDependenciesMeta?: Record<string, {
-        optional?: boolean;
-    }>;
-}
-export declare function openRepo(root: string): Promise<Repo>;
-/** Files whose text matches; each hit carries the count of matches. Reads at most `limit` files. */
-export declare function grep(repo: Repo, files: string[], re: RegExp, limit?: number): Promise<Array<{
-    file: string;
-    count: number;
-}>>;
-/** Code files only: what the detectors read for behaviour. */
-export declare const CODE: RegExp;
-/** Test files, which describe behaviour but do not run in production. */
-export declare const TEST_FILE: RegExp;
-/**
- * Not the running software: documentation trees, fixtures, golden files, and this
- * auditor's own package when it is audited from inside the repository that holds it.
- * The first run counted the auditor's detector source as an MCP server, a Bedrock
- * integration and a human gate in the host repository.
- */
-export declare const NOT_RUNTIME: RegExp;
-/** Files the detectors read for behaviour: code, in the runtime tree, not tests. */
-export declare function runtimeCode(files: string[]): string[];

package/dist/walk 2.js

@@ -1,123 +0,0 @@
-// Copied from ai-audit/src/walk.ts, never imported, so the package stays independently
-// deployable (family convention). The only place that touches the filesystem. Walks a repository, skips what is not the
-// project's own code, reads text files under a size cap, and never opens an env file.
-import { readdir, readFile, stat } from "node:fs/promises";
-import { join, relative, sep } from "node:path";
-const SKIP_DIRS = new Set(["node_modules", ".git", "dist", "build", "out", ".next", ".nuxt", ".svelte-kit", ".vercel", ".turbo", "coverage", "vendor", "dist.bak", ".cache", "__pycache__", ".venv", "venv", "target", "test-results", "playwright-report", ".chrome-debug", ".claude-browser"]);
-// Stylesheets are read too: `@import "tw-animate-css"` and Tailwind 4's `@plugin`
-// are how a whole class of packages is used, and a walker that listed .css files
-// but never read them flagged every one of those packages as unreferenced.
-const TEXT = /\.(ts|tsx|js|jsx|mjs|cjs|py|go|rs|rb|php|java|kt|swift|sql|json|jsonc|ya?ml|toml|md|mdx|txt|prisma|graphql|gql|env\.example|sh|css|scss|sass|less|pcss)$/i;
-const ENV_FILE = /(^|\/)\.env(\.[a-z0-9_-]+)?$/i;
-const MAX_BYTES = 512 * 1024;
-const MAX_FILES = 25_000;
-export async function openRepo(root) {
-    const files = [];
-    const skipped = [];
-    const rootName = root.replace(/[\\/]+$/, "").split(/[\\/]/).pop() ?? "";
-    const walk = async (dir, depth) => {
-        let entries;
-        try {
-            entries = await readdir(dir, { withFileTypes: true });
-        }
-        catch {
-            return;
-        }
-        const names = new Set(entries.map((e) => e.name));
-        // A directory below the root that is a repository of its own (its own .git), or a
-        // copy of this one (named like the root, with its own manifest), is not this
-        // software: Brokrr's audit counted a nested Brokrr/ twice and cited both.
-        if (depth > 0 && (names.has(".git") || (dir.split(/[\\/]/).pop() === rootName && names.has("package.json")))) {
-            skipped.push(relative(root, dir).split(sep).join("/"));
-            return;
-        }
-        for (const e of entries.sort((a, b) => a.name.localeCompare(b.name))) {
-            if (files.length >= MAX_FILES)
-                return;
-            const abs = join(dir, e.name);
-            if (e.isSymbolicLink())
-                continue;
-            if (e.isDirectory()) {
-                // dist-demo, build_old, out-web: build output under any suffix.
-                if (SKIP_DIRS.has(e.name) || /^(dist|build|out)([-_.][a-z0-9-]*)?$/i.test(e.name))
-                    continue;
-                await walk(abs, depth + 1);
-            }
-            else if (e.isFile()) {
-                files.push(relative(root, abs).split(sep).join("/"));
-            }
-        }
-    };
-    await walk(root, 0);
-    const cache = new Map();
-    const name = root.replace(/[\\/]+$/, "").split(/[\\/]/).pop() ?? root;
-    return {
-        root,
-        name,
-        files,
-        skipped,
-        async read(rel) {
-            if (cache.has(rel))
-                return cache.get(rel);
-            let text = null;
-            if (TEXT.test(rel) && !ENV_FILE.test(rel)) {
-                try {
-                    const s = await stat(join(root, rel));
-                    if (s.size <= MAX_BYTES)
-                        text = await readFile(join(root, rel), "utf8");
-                }
-                catch {
-                    text = null;
-                }
-            }
-            cache.set(rel, text);
-            return text;
-        },
-        matching(re) {
-            return files.filter((f) => re.test(f));
-        },
-        async installed(fromManifest, pkg) {
-            const parts = fromManifest.split("/").slice(0, -1);
-            for (let i = parts.length; i >= 0; i--) {
-                const abs = join(root, ...parts.slice(0, i), "node_modules", ...pkg.split("/"), "package.json");
-                try {
-                    return JSON.parse(await readFile(abs, "utf8"));
-                }
-                catch {
-                    // not installed at this level
-                }
-            }
-            return null;
-        },
-    };
-}
-/** Files whose text matches; each hit carries the count of matches. Reads at most `limit` files. */
-export async function grep(repo, files, re, limit = 4000) {
-    const out = [];
-    const flags = re.flags.includes("g") ? re.flags : re.flags + "g";
-    const global = new RegExp(re.source, flags);
-    for (const f of files.slice(0, limit)) {
-        const text = await repo.read(f);
-        if (!text)
-            continue;
-        const count = (text.match(global) ?? []).length;
-        if (count > 0)
-            out.push({ file: f, count });
-    }
-    return out;
-}
-/** Code files only: what the detectors read for behaviour. */
-export const CODE = /\.(ts|tsx|js|jsx|mjs|cjs|py|go|rs|rb|php|java|kt|swift)$/i;
-/** Test files, which describe behaviour but do not run in production. */
-export const TEST_FILE = /(^|\.|_|\/)(test|spec|e2e)s?(\.|\/)|(^|\/)__tests__\//i;
-/**
- * Not the running software: documentation trees, fixtures, golden files, and this
- * auditor's own package when it is audited from inside the repository that holds it.
- * The first run counted the auditor's detector source as an MCP server, a Bedrock
- * integration and a human gate in the host repository.
- */
-export const NOT_RUNTIME = /(^|\/)(docs?|fixtures?|__fixtures__|__mocks__|golden|examples?|samples?|packages\/the-prospect)\/|(^|\/)\.(?!well-known\/)[^/]+\//i;
-/** Files the detectors read for behaviour: code, in the runtime tree, not tests. */
-export function runtimeCode(files) {
-    return files.filter((f) => CODE.test(f) && !TEST_FILE.test(f) && !NOT_RUNTIME.test(f));
-}