burnwatch 0.12.0 → 0.13.0

package/dist/cli.js

@@ -287,8 +287,8 @@ var init_probes = __esm({
 });
 
 // src/cli.ts
-import * as fs5 from "fs";
-import * as path5 from "path";
+import * as fs7 from "fs";
+import * as path7 from "path";
 
 // src/core/config.ts
 import * as fs from "fs";
@@ -502,8 +502,7 @@ function collectEnvVars(projectRoot) {
   for (const envFile of envFiles) {
     try {
       const content = fs3.readFileSync(envFile, "utf-8");
-      const keys = content.split("\n").filter((line) => line.includes("=") && !line.startsWith("#")).map((line) => line.split("=")[0].trim()).filter(Boolean);
-      for (const key of keys) {
+      for (const key of parseEnvKeys(content)) {
         envVars.add(key);
       }
     } catch {
@@ -511,6 +510,19 @@ function collectEnvVars(projectRoot) {
   }
   return envVars;
 }
+function parseEnvKeys(content) {
+  const keys = /* @__PURE__ */ new Set();
+  for (const line of content.split("\n")) {
+    const trimmed = line.trim();
+    if (!trimmed || trimmed.startsWith("#")) continue;
+    const stripped = trimmed.startsWith("export ") ? trimmed.slice(7).trim() : trimmed;
+    const eqIdx = stripped.indexOf("=");
+    if (eqIdx > 0) {
+      keys.add(stripped.slice(0, eqIdx).trim());
+    }
+  }
+  return keys;
+}
 function findEnvFiles(dir, maxDepth) {
   const results = [];
   if (maxDepth <= 0) return results;
@@ -1267,6 +1279,8 @@ function saveSnapshot(brief, projectRoot) {
 
 // src/interactive-init.ts
 import * as readline from "readline";
+import * as fs5 from "fs";
+import "path";
 init_probes();
 function formatUnits(n) {
   if (n >= 1e6) return `${(n / 1e6).toFixed(n % 1e6 === 0 ? 0 : 1)}M`;
@@ -1313,11 +1327,27 @@ function ask(rl, question) {
     });
   });
 }
-function findEnvKey(service) {
+function findEnvKey(service, projectRoot = process.cwd()) {
   for (const pattern of service.envPatterns) {
     const val = process.env[pattern];
     if (val && val.length > 0) return val;
   }
+  if (projectRoot) {
+    const envFiles = findEnvFiles(projectRoot, 3);
+    for (const filePath of envFiles) {
+      try {
+        const content = fs5.readFileSync(filePath, "utf-8");
+        for (const pattern of service.envPatterns) {
+          const regex = new RegExp(`^(?:export\\s+)?${pattern}\\s*=\\s*(.+)$`, "m");
+          const match = content.match(regex);
+          if (match?.[1]) {
+            return match[1].trim().replace(/^["']|["']$/g, "");
+          }
+        }
+      } catch {
+      }
+    }
+  }
   return void 0;
 }
 async function autoConfigureServices(detected) {
@@ -1592,6 +1622,439 @@ async function runInteractiveInit(detected) {
   return { services };
 }
 
+// src/utilization.ts
+import * as fs6 from "fs";
+import * as path6 from "path";
+
+// src/cost-impact.ts
+var SERVICE_CALL_PATTERNS = {
+  anthropic: [
+    /\.messages\.create\s*\(/g,
+    /\.completions\.create\s*\(/g,
+    /anthropic\.\w+\.create\s*\(/g
+  ],
+  openai: [
+    /\.chat\.completions\.create\s*\(/g,
+    /\.completions\.create\s*\(/g,
+    /\.images\.generate\s*\(/g,
+    /\.embeddings\.create\s*\(/g,
+    /openai\.\w+\.create\s*\(/g
+  ],
+  "google-gemini": [
+    /\.generateContent\s*\(/g,
+    /\.generateContentStream\s*\(/g,
+    /model\.generate\w*\s*\(/g
+  ],
+  "voyage-ai": [
+    /\.embed\s*\(/g,
+    /voyageai\.embed\s*\(/g
+  ],
+  scrapfly: [
+    /\.scrape\s*\(/g,
+    /scrapfly\.scrape\s*\(/g,
+    /\.async_scrape\s*\(/g,
+    /ScrapeConfig\s*\(/g
+  ],
+  browserbase: [
+    /\.createSession\s*\(/g,
+    /\.sessions\.create\s*\(/g,
+    /stagehand\.act\s*\(/g,
+    /stagehand\.extract\s*\(/g
+  ],
+  upstash: [
+    /redis\.\w+\s*\(/g,
+    /\.set\s*\(/g,
+    /\.get\s*\(/g,
+    /\.incr\s*\(/g,
+    /\.hset\s*\(/g
+  ],
+  resend: [
+    /resend\.emails\.send\s*\(/g,
+    /\.emails\.send\s*\(/g
+  ],
+  stripe: [
+    /stripe\.charges\.create\s*\(/g,
+    /stripe\.paymentIntents\.create\s*\(/g,
+    /stripe\.checkout\.sessions\.create\s*\(/g
+  ],
+  supabase: [
+    /supabase\.from\s*\(/g,
+    /\.rpc\s*\(/g,
+    /supabase\.storage/g
+  ],
+  inngest: [
+    /inngest\.send\s*\(/g,
+    /\.createFunction\s*\(/g
+  ],
+  posthog: [
+    /posthog\.capture\s*\(/g,
+    /\.capture\s*\(/g
+  ],
+  aws: [
+    /\.send\s*\(new\s+\w+Command/g,
+    /s3Client\.send\s*\(/g,
+    /lambdaClient\.send\s*\(/g
+  ],
+  firebase: [
+    /firestore\.\w+\(\s*["']/g,
+    /\.collection\s*\(/g,
+    /\.doc\s*\(/g,
+    /admin\.firestore\(\)/g
+  ],
+  twilio: [
+    /\.messages\.create\s*\(/g,
+    /\.calls\.create\s*\(/g,
+    /twilio\.messages/g
+  ],
+  sendgrid: [
+    /sgMail\.send\s*\(/g,
+    /\.send\s*\(\s*msg/g
+  ],
+  "mongodb-atlas": [
+    /\.find\s*\(/g,
+    /\.insertOne\s*\(/g,
+    /\.insertMany\s*\(/g,
+    /\.updateOne\s*\(/g,
+    /\.aggregate\s*\(/g
+  ],
+  clerk: [
+    /clerkClient\.\w+/g,
+    /auth\(\)/g
+  ],
+  replicate: [
+    /replicate\.run\s*\(/g,
+    /replicate\.predictions\.create\s*\(/g
+  ]
+};
+function detectMultipliers(content) {
+  const multipliers = [];
+  if (/for\s*\(.*;\s*\w+\s*<\s*(\w+)/g.test(content)) {
+    const loopMatch = content.match(/for\s*\(.*;\s*\w+\s*<\s*(\d+)/);
+    if (loopMatch) {
+      const bound = parseInt(loopMatch[1]);
+      if (bound > 1) {
+        multipliers.push({ label: `for loop (${bound} iterations)`, factor: bound });
+      }
+    } else {
+      multipliers.push({ label: "for loop (variable bound)", factor: 10 });
+    }
+  }
+  if (/\.\s*map\s*\(\s*(async\s*)?\(/g.test(content)) {
+    multipliers.push({ label: ".map() iteration", factor: 10 });
+  }
+  if (/\.\s*forEach\s*\(\s*(async\s*)?\(/g.test(content)) {
+    multipliers.push({ label: ".forEach() iteration", factor: 10 });
+  }
+  if (/for\s*\(\s*(const|let|var)\s+\w+\s+(of|in)\s+/g.test(content)) {
+    multipliers.push({ label: "for...of/in loop", factor: 10 });
+  }
+  if (/Promise\.all\s*\(/g.test(content)) {
+    multipliers.push({ label: "Promise.all (parallel batch)", factor: 10 });
+  }
+  if (/cron|schedule|interval|setInterval|every\s+\d+\s*(min|hour|day|sec)/gi.test(content)) {
+    if (/every\s+5\s*min/gi.test(content) || /\*\/5\s+\*\s+\*/g.test(content)) {
+      multipliers.push({ label: "cron: every 5 minutes", factor: 8640 });
+    } else if (/every\s+1?\s*hour/gi.test(content) || /0\s+\*\s+\*\s+\*/g.test(content)) {
+      multipliers.push({ label: "cron: hourly", factor: 720 });
+    } else if (/every\s+1?\s*day/gi.test(content) || /0\s+0\s+\*\s+\*/g.test(content)) {
+      multipliers.push({ label: "cron: daily", factor: 30 });
+    } else {
+      multipliers.push({ label: "scheduled execution", factor: 30 });
+    }
+  }
+  const batchMatch = content.match(/batch[_\s]?size\s*[=:]\s*(\d+)/i);
+  if (batchMatch) {
+    const batchSize = parseInt(batchMatch[1]);
+    if (batchSize > 1) {
+      multipliers.push({ label: `batch size: ${batchSize}`, factor: batchSize });
+    }
+  }
+  return multipliers;
+}
+var GOTCHA_MULTIPLIERS = {
+  scrapfly: {
+    low: 1,
+    high: 25,
+    explanation: "anti-bot bypass consumes 5-25x base credits"
+  },
+  browserbase: {
+    low: 1,
+    high: 5,
+    explanation: "session duration affects cost \u2014 long sessions burn more"
+  },
+  anthropic: {
+    low: 1,
+    high: 60,
+    explanation: "Haiku ~$0.25/MTok vs Opus ~$15/MTok (60x range)"
+  },
+  openai: {
+    low: 1,
+    high: 30,
+    explanation: "GPT-4 mini vs GPT-5 (30x cost range)"
+  },
+  stripe: {
+    low: 1,
+    high: 1.5,
+    explanation: "international cards add 1-1.5% extra"
+  }
+};
+function analyzeCostImpact(filePath, content, projectRoot) {
+  if (!/\.(ts|tsx|js|jsx|mjs|cjs)$/.test(filePath)) {
+    return [];
+  }
+  const registry = loadRegistry(projectRoot);
+  const impacts = [];
+  const multipliers = detectMultipliers(content);
+  for (const [serviceId, patterns] of Object.entries(SERVICE_CALL_PATTERNS)) {
+    let totalCalls = 0;
+    for (const pattern of patterns) {
+      pattern.lastIndex = 0;
+      const matches = content.match(pattern);
+      if (matches) {
+        totalCalls += matches.length;
+      }
+    }
+    if (totalCalls === 0) continue;
+    const service = registry.get(serviceId);
+    if (!service) continue;
+    const multiplierFactor = multipliers.length > 0 ? multipliers.reduce((max, m) => Math.max(max, m.factor), 1) : 1;
+    const baseMonthlyRuns = multipliers.some((m) => m.label.startsWith("cron")) ? 1 : 50;
+    const monthlyInvocations = totalCalls * multiplierFactor * baseMonthlyRuns;
+    const gotcha = GOTCHA_MULTIPLIERS[serviceId];
+    const unitRate = service.pricing?.unitRate ?? 0;
+    let costLow;
+    let costHigh;
+    if (unitRate > 0) {
+      costLow = monthlyInvocations * unitRate * (gotcha?.low ?? 1);
+      costHigh = monthlyInvocations * unitRate * (gotcha?.high ?? 1);
+    } else if (service.pricing?.monthlyBase !== void 0) {
+      costLow = 0;
+      costHigh = 0;
+    } else {
+      const typicalCallCosts = {
+        anthropic: 3e-3,
+        // ~$3/MTok * ~1K tokens average
+        openai: 2e-3,
+        "google-gemini": 1e-3,
+        scrapfly: 15e-5,
+        browserbase: 0.01,
+        resend: 1e-3,
+        stripe: 0.3
+      };
+      const perCall = typicalCallCosts[serviceId] ?? 1e-3;
+      costLow = monthlyInvocations * perCall * (gotcha?.low ?? 1);
+      costHigh = monthlyInvocations * perCall * (gotcha?.high ?? 1);
+    }
+    if (costLow === 0 && costHigh === 0) continue;
+    impacts.push({
+      serviceId,
+      serviceName: service.name,
+      filePath,
+      callCount: totalCalls,
+      multipliers: multipliers.map((m) => m.label),
+      multiplierFactor,
+      monthlyInvocations,
+      costLow,
+      costHigh,
+      rangeExplanation: gotcha?.explanation
+    });
+  }
+  return impacts;
+}
+
+// src/utilization.ts
+function utilizationModelPath(projectRoot) {
+  return path6.join(projectDataDir(projectRoot), "utilization.json");
+}
+function readUtilizationModel(projectRoot) {
+  try {
+    const raw = fs6.readFileSync(utilizationModelPath(projectRoot), "utf-8");
+    return JSON.parse(raw);
+  } catch {
+    return {
+      version: 1,
+      updatedAt: (/* @__PURE__ */ new Date()).toISOString(),
+      lastFullScan: null,
+      services: {}
+    };
+  }
+}
+function writeUtilizationModel(model, projectRoot) {
+  const dir = projectDataDir(projectRoot);
+  fs6.mkdirSync(dir, { recursive: true });
+  model.updatedAt = (/* @__PURE__ */ new Date()).toISOString();
+  fs6.writeFileSync(
+    utilizationModelPath(projectRoot),
+    JSON.stringify(model, null, 2) + "\n",
+    "utf-8"
+  );
+}
+function analyzeFileUtilization(filePath, content, projectRoot) {
+  const impacts = analyzeCostImpact(filePath, content, projectRoot);
+  return impacts.map((impact) => ({
+    filePath,
+    serviceId: impact.serviceId,
+    callCount: impact.callCount,
+    multipliers: impact.multipliers,
+    multiplierFactor: impact.multiplierFactor,
+    monthlyInvocations: impact.monthlyInvocations,
+    costLow: impact.costLow,
+    costHigh: impact.costHigh
+  }));
+}
+function updateUtilizationModel(model, filePath, newCallSites, projectRoot) {
+  const registry = loadRegistry(projectRoot);
+  const affectedServices = /* @__PURE__ */ new Set();
+  for (const [serviceId, svc] of Object.entries(model.services)) {
+    const before = svc.callSites.length;
+    svc.callSites = svc.callSites.filter((cs) => cs.filePath !== filePath);
+    if (svc.callSites.length !== before) {
+      affectedServices.add(serviceId);
+    }
+  }
+  for (const cs of newCallSites) {
+    affectedServices.add(cs.serviceId);
+    if (!model.services[cs.serviceId]) {
+      const def = registry.get(cs.serviceId);
+      model.services[cs.serviceId] = {
+        serviceId: cs.serviceId,
+        serviceName: def?.name ?? cs.serviceId,
+        callSites: [],
+        totalMonthlyUnits: 0,
+        unitName: def?.pricing?.unitName ?? "API calls",
+        planIncluded: null,
+        projectedOverage: 0,
+        projectedOverageCost: 0,
+        projectedTotalCost: 0,
+        planBaseCost: def?.pricing?.monthlyBase ?? 0,
+        unitRate: def?.pricing?.unitRate ?? 0
+      };
+    }
+    model.services[cs.serviceId].callSites.push(cs);
+  }
+  for (const serviceId of affectedServices) {
+    recalculateServiceTotals(model, serviceId);
+  }
+  for (const serviceId of Object.keys(model.services)) {
+    if (model.services[serviceId].callSites.length === 0) {
+      delete model.services[serviceId];
+    }
+  }
+}
+function recalculateServiceTotals(model, serviceId) {
+  const svc = model.services[serviceId];
+  if (!svc) return;
+  svc.totalMonthlyUnits = svc.callSites.reduce(
+    (sum, cs) => sum + cs.monthlyInvocations,
+    0
+  );
+  const included = svc.planIncluded ?? 0;
+  svc.projectedOverage = Math.max(0, svc.totalMonthlyUnits - included);
+  svc.projectedOverageCost = svc.projectedOverage * svc.unitRate;
+  svc.projectedTotalCost = svc.planBaseCost + svc.projectedOverageCost;
+}
+var CODE_DIRS = ["src", "app", "lib", "pages", "components", "utils", "services", "hooks", "api", "functions"];
+function buildUtilizationModel(projectRoot) {
+  const model = {
+    version: 1,
+    updatedAt: (/* @__PURE__ */ new Date()).toISOString(),
+    lastFullScan: (/* @__PURE__ */ new Date()).toISOString(),
+    services: {}
+  };
+  const files = findSourceFiles(projectRoot);
+  for (const file of files) {
+    try {
+      const content = fs6.readFileSync(file, "utf-8");
+      const callSites = analyzeFileUtilization(file, content, projectRoot);
+      if (callSites.length > 0) {
+        const relPath = path6.relative(projectRoot, file);
+        const relativeSites = callSites.map((cs) => ({
+          ...cs,
+          filePath: relPath
+        }));
+        updateUtilizationModel(model, relPath, relativeSites, projectRoot);
+      }
+    } catch {
+    }
+  }
+  return model;
+}
+function findSourceFiles(projectRoot) {
+  const files = [];
+  const dirsToScan = [];
+  for (const dir of CODE_DIRS) {
+    const fullPath = path6.join(projectRoot, dir);
+    if (fs6.existsSync(fullPath)) {
+      dirsToScan.push(fullPath);
+    }
+  }
+  try {
+    const entries = fs6.readdirSync(projectRoot, { withFileTypes: true });
+    for (const entry of entries) {
+      if (!entry.isDirectory()) continue;
+      if (entry.name === "node_modules" || entry.name === ".git" || entry.name === "dist" || entry.name.startsWith(".")) continue;
+      const subPkgPath = path6.join(projectRoot, entry.name, "package.json");
+      if (fs6.existsSync(subPkgPath)) {
+        for (const dir of CODE_DIRS) {
+          const fullPath = path6.join(projectRoot, entry.name, dir);
+          if (fs6.existsSync(fullPath)) {
+            dirsToScan.push(fullPath);
+          }
+        }
+      }
+    }
+  } catch {
+  }
+  for (const dir of dirsToScan) {
+    walkDir2(dir, /\.(ts|tsx|js|jsx|mjs|cjs)$/, files);
+  }
+  return files;
+}
+function walkDir2(dir, pattern, results, maxDepth = 5) {
+  if (maxDepth <= 0) return;
+  try {
+    const entries = fs6.readdirSync(dir, { withFileTypes: true });
+    for (const entry of entries) {
+      if (entry.name.startsWith(".") || entry.name === "node_modules") continue;
+      const fullPath = path6.join(dir, entry.name);
+      if (entry.isDirectory()) {
+        walkDir2(fullPath, pattern, results, maxDepth - 1);
+      } else if (pattern.test(entry.name)) {
+        results.push(fullPath);
+      }
+    }
+  } catch {
+  }
+}
+function formatUtilizationSummary(model) {
+  const services = Object.values(model.services).filter(
+    (s) => s.totalMonthlyUnits > 0
+  );
+  if (services.length === 0) {
+    return "\u{1F4CA} No utilization-tracked call sites found in the project.";
+  }
+  const lines = [];
+  lines.push("\u{1F4CA} Utilization scan complete\n");
+  lines.push("| Service | Call Sites | Monthly Units | Plan Included | Overage Cost |");
+  lines.push("|---------|-----------|---------------|---------------|-------------|");
+  for (const svc of services) {
+    const fileCount = new Set(svc.callSites.map((cs) => cs.filePath)).size;
+    const filesStr = `${fileCount} file${fileCount > 1 ? "s" : ""}`;
+    const unitsStr = `${formatCompact2(svc.totalMonthlyUnits)} ${svc.unitName}`;
+    const includedStr = svc.planIncluded !== null ? formatCompact2(svc.planIncluded) : "\u2014";
+    const overageStr = svc.projectedOverageCost > 0 ? `~$${svc.projectedOverageCost.toFixed(2)}/mo` : "$0";
+    lines.push(
+      `| ${svc.serviceName} | ${filesStr} | ${unitsStr} | ${includedStr} | ${overageStr} |`
+    );
+  }
+  return lines.join("\n");
+}
+function formatCompact2(n) {
+  if (n >= 1e6) return `${(n / 1e6).toFixed(n % 1e6 === 0 ? 0 : 1)}M`;
+  if (n >= 1e3) return `${(n / 1e3).toFixed(n % 1e3 === 0 ? 0 : 1)}K`;
+  return String(Math.round(n));
+}
+
 // src/cli.ts
 var args = process.argv.slice(2);
 var command = args[0];
@@ -1620,6 +2083,9 @@ async function main() {
     case "configure":
       await cmdConfigure();
       break;
+    case "scan":
+      cmdScan();
+      break;
     case "reset":
       cmdReset();
       break;
@@ -1646,10 +2112,10 @@ async function cmdInit() {
   const projectRoot = process.cwd();
   const nonInteractive = flags.has("--non-interactive") || flags.has("--ni");
   const alreadyInitialized = isInitialized(projectRoot);
-  let projectName = path5.basename(projectRoot);
+  let projectName = path7.basename(projectRoot);
   try {
-    const pkgPath = path5.join(projectRoot, "package.json");
-    const pkg = JSON.parse(fs5.readFileSync(pkgPath, "utf-8"));
+    const pkgPath = path7.join(projectRoot, "package.json");
+    const pkg = JSON.parse(fs7.readFileSync(pkgPath, "utf-8"));
     if (pkg.name) projectName = pkg.name;
   } catch {
   }
@@ -1688,8 +2154,8 @@ async function cmdInit() {
     config.services = result.services;
   }
   writeProjectConfig(config, projectRoot);
-  const gitignorePath = path5.join(projectConfigDir(projectRoot), ".gitignore");
-  fs5.writeFileSync(
+  const gitignorePath = path7.join(projectConfigDir(projectRoot), ".gitignore");
+  fs7.writeFileSync(
     gitignorePath,
     [
       "# Burnwatch \u2014 ignore cache and snapshots, keep ledger and config",
@@ -1700,7 +2166,21 @@ async function cmdInit() {
     ].join("\n"),
     "utf-8"
   );
-  console.log("\n\u{1F517} Registering Claude Code hooks...\n");
+  console.log("\u{1F4CA} Scanning for utilization patterns...");
+  try {
+    const model = buildUtilizationModel(projectRoot);
+    writeUtilizationModel(model, projectRoot);
+    const serviceCount = Object.keys(model.services).length;
+    if (serviceCount > 0) {
+      console.log(`   Found call sites for ${serviceCount} service(s).
+`);
+    } else {
+      console.log("   No SDK call sites detected yet.\n");
+    }
+  } catch {
+    console.log("   Utilization scan skipped.\n");
+  }
+  console.log("\u{1F517} Registering Claude Code hooks...\n");
   registerHooks(projectRoot);
   console.log("\nburnwatch initialized.\n");
   if (process.stdin.isTTY) {
@@ -1719,10 +2199,10 @@ async function cmdInterview() {
   if (!isInitialized(projectRoot)) {
     ensureProjectDirs(projectRoot);
     const detected = detectServices(projectRoot);
-    let projectName = path5.basename(projectRoot);
+    let projectName = path7.basename(projectRoot);
     try {
       const pkg = JSON.parse(
-        fs5.readFileSync(path5.join(projectRoot, "package.json"), "utf-8")
+        fs7.readFileSync(path7.join(projectRoot, "package.json"), "utf-8")
       );
       if (pkg.name) projectName = pkg.name;
     } catch {
@@ -1754,20 +2234,19 @@ async function cmdInterview() {
         if (!keySource && !globalKey) keySource = `env:${pattern}`;
       }
     }
-    const envFiles = [".env", ".env.local", ".env.development"];
-    for (const envFile of envFiles) {
+    const envFiles = findEnvFiles(projectRoot, 3);
+    for (const envFilePath of envFiles) {
       try {
-        const envPath = path5.join(projectRoot, envFile);
-        const envContent = fs5.readFileSync(envPath, "utf-8");
+        const envContent = fs7.readFileSync(envFilePath, "utf-8");
+        const envKeys = parseEnvKeys(envContent);
+        const envFileName = path7.relative(projectRoot, envFilePath);
         for (const pattern of definition.envPatterns) {
-          const regex = new RegExp(`^${pattern}=(.+)$`, "m");
-          const match = envContent.match(regex);
-          if (match?.[1]) {
-            const label = `${pattern} (in ${envFile})`;
+          if (envKeys.has(pattern)) {
+            const label = `${pattern} (in ${envFileName})`;
             if (!envKeysFound.some((k) => k.startsWith(pattern))) {
               envKeysFound.push(label);
             }
-            if (!keySource && !globalKey) keySource = `file:${envFile}:${pattern}`;
+            if (!keySource && !globalKey) keySource = `file:${envFileName}:${pattern}`;
           }
         }
       } catch {
@@ -1783,8 +2262,9 @@ async function cmdInterview() {
       const envFile = parts[1];
       const envVar = parts[2];
       try {
-        const envContent = fs5.readFileSync(path5.join(projectRoot, envFile), "utf-8");
-        const match = envContent.match(new RegExp(`^${envVar}=(.+)$`, "m"));
+        const envContent = fs7.readFileSync(path7.join(projectRoot, envFile), "utf-8");
+        const regex = new RegExp(`^(?:export\\s+)?${envVar}\\s*=\\s*(.+)$`, "m");
+        const match = envContent.match(regex);
         if (match?.[1]) apiKey = match[1].trim().replace(/^["']|["']$/g, "");
       } catch {
       }
@@ -1866,6 +2346,19 @@ async function cmdInterview() {
   serviceStates.sort(
     (a, b) => riskOrder.indexOf(a.riskCategory) - riskOrder.indexOf(b.riskCategory)
   );
+  const utilizationModel = readUtilizationModel(projectRoot);
+  const utilizationSummary = {};
+  for (const [serviceId, svc] of Object.entries(utilizationModel.services)) {
+    if (svc.totalMonthlyUnits > 0) {
+      utilizationSummary[serviceId] = {
+        totalMonthlyUnits: svc.totalMonthlyUnits,
+        unitName: svc.unitName,
+        planIncluded: svc.planIncluded,
+        projectedOverageCost: svc.projectedOverageCost,
+        topCallSites: svc.callSites.sort((a, b) => b.monthlyInvocations - a.monthlyInvocations).slice(0, 5).map((cs) => `${cs.filePath} (${cs.monthlyInvocations})`)
+      };
+    }
+  }
   const output = {
     projectName: config.projectName,
     serviceCount: serviceStates.length,
@@ -1874,11 +2367,13 @@ async function cmdInterview() {
     blindCount: serviceStates.filter((s) => s.tier === "blind").length,
     canGoLiveCount: serviceStates.filter((s) => s.canGoLive).length,
     keysFoundInEnv: serviceStates.filter((s) => s.envKeysFound.length > 0).length,
+    utilization: utilizationSummary,
     services: serviceStates,
     instructions: {
       keyStorage: "burnwatch stores API keys in ~/.config/burnwatch/ (chmod 600) \u2014 never in the project directory. Use --key flag with configure to save keys securely.",
       liveTracking: "Services with hasConnector=true can do LIVE billing tracking when given an API key. Services without a connector can only do CALC (budget threshold alerts).",
-      configureCommand: "burnwatch configure --service <id> [--plan <name>] [--budget <N>] [--key <KEY>] [--exclude]"
+      configureCommand: "burnwatch configure --service <id> [--plan <name>] [--budget <N>] [--key <KEY>] [--exclude]",
+      utilizationNote: "The 'utilization' field shows code-projected usage from SDK call sites. Services with high projectedOverageCost may need plan upgrades or budget alerts."
     }
   };
   if (flags.has("--json")) {
@@ -2182,28 +2677,74 @@ async function cmdReconcile() {
   }
   console.log("");
 }
+function cmdScan() {
+  const projectRoot = process.cwd();
+  if (!isInitialized(projectRoot)) {
+    console.error("burnwatch is not initialized. Run 'burnwatch init' first.");
+    process.exit(1);
+    return;
+  }
+  console.log("\u{1F4CA} Scanning project for utilization patterns...\n");
+  const model = buildUtilizationModel(projectRoot);
+  const config = readProjectConfig(projectRoot);
+  for (const [serviceId, svc] of Object.entries(model.services)) {
+    const tracked = config.services[serviceId];
+    const definition = getService(serviceId, projectRoot);
+    if (tracked?.allowance) {
+      svc.planIncluded = tracked.allowance.included;
+      svc.unitName = tracked.allowance.unitName;
+    }
+    if (definition?.pricing?.unitRate) {
+      svc.unitRate = definition.pricing.unitRate;
+    }
+    if (tracked?.planCost !== void 0) {
+      svc.planBaseCost = tracked.planCost;
+    }
+    svc.projectedOverage = Math.max(0, svc.totalMonthlyUnits - (svc.planIncluded ?? 0));
+    svc.projectedOverageCost = svc.projectedOverage * svc.unitRate;
+    svc.projectedTotalCost = svc.planBaseCost + svc.projectedOverageCost;
+  }
+  writeUtilizationModel(model, projectRoot);
+  console.log(formatUtilizationSummary(model));
+  if (flags.has("--verbose")) {
+    console.log("\nDetailed call sites:\n");
+    for (const svc of Object.values(model.services)) {
+      if (svc.callSites.length === 0) continue;
+      console.log(`  ${svc.serviceName}:`);
+      for (const cs of svc.callSites) {
+        console.log(
+          `    ${cs.filePath} \u2014 ${cs.callCount} call(s) \xD7 ${cs.multiplierFactor}x \u2192 ~${cs.monthlyInvocations} invocations/mo`
+        );
+        if (cs.multipliers.length > 0) {
+          console.log(`      Multipliers: ${cs.multipliers.join(", ")}`);
+        }
+      }
+      console.log("");
+    }
+  }
+}
 function cmdReset() {
   const projectRoot = process.cwd();
-  const burnwatchDir = path5.join(projectRoot, ".burnwatch");
-  const claudeSkillsDir = path5.join(projectRoot, ".claude", "skills");
-  if (!fs5.existsSync(burnwatchDir)) {
+  const burnwatchDir = path7.join(projectRoot, ".burnwatch");
+  const claudeSkillsDir = path7.join(projectRoot, ".claude", "skills");
+  if (!fs7.existsSync(burnwatchDir)) {
     console.log("burnwatch is not initialized in this project.");
     return;
   }
-  fs5.rmSync(burnwatchDir, { recursive: true, force: true });
+  fs7.rmSync(burnwatchDir, { recursive: true, force: true });
   console.log(`\u{1F5D1}\uFE0F  Removed ${burnwatchDir}`);
   const skillNames = ["setup-burnwatch", "burnwatch-interview", "spend"];
   for (const skill of skillNames) {
-    const skillDir = path5.join(claudeSkillsDir, skill);
-    if (fs5.existsSync(skillDir)) {
-      fs5.rmSync(skillDir, { recursive: true, force: true });
+    const skillDir = path7.join(claudeSkillsDir, skill);
+    if (fs7.existsSync(skillDir)) {
+      fs7.rmSync(skillDir, { recursive: true, force: true });
     }
   }
   console.log("\u{1F5D1}\uFE0F  Removed burnwatch skills from .claude/skills/");
-  const settingsPath = path5.join(projectRoot, ".claude", "settings.json");
-  if (fs5.existsSync(settingsPath)) {
+  const settingsPath = path7.join(projectRoot, ".claude", "settings.json");
+  if (fs7.existsSync(settingsPath)) {
     try {
-      const settings = JSON.parse(fs5.readFileSync(settingsPath, "utf-8"));
+      const settings = JSON.parse(fs7.readFileSync(settingsPath, "utf-8"));
       const hooks = settings["hooks"];
       if (hooks) {
         for (const [event, hookList] of Object.entries(hooks)) {
@@ -2213,7 +2754,7 @@ function cmdReset() {
           if (hooks[event].length === 0) delete hooks[event];
         }
         if (Object.keys(hooks).length === 0) delete settings["hooks"];
-        fs5.writeFileSync(settingsPath, JSON.stringify(settings, null, 2) + "\n", "utf-8");
+        fs7.writeFileSync(settingsPath, JSON.stringify(settings, null, 2) + "\n", "utf-8");
         console.log("\u{1F5D1}\uFE0F  Removed burnwatch hooks from .claude/settings.json");
       }
     } catch {
@@ -2237,6 +2778,7 @@ Usage:
   burnwatch reconcile                         Scan for untracked services
   burnwatch interview --json                  Export state for agent-driven interview
   burnwatch configure --service <id> [opts]   Agent writes back interview answers
+  burnwatch scan [--verbose]                  Scan project for utilization patterns
   burnwatch reset                             Remove all burnwatch config from this project
 
 Options for 'configure':
@@ -2263,23 +2805,23 @@ Examples:
 }
 function cmdVersion() {
   try {
-    const pkgPath = path5.resolve(
-      path5.dirname(new URL(import.meta.url).pathname),
+    const pkgPath = path7.resolve(
+      path7.dirname(new URL(import.meta.url).pathname),
       "../package.json"
     );
-    const pkg = JSON.parse(fs5.readFileSync(pkgPath, "utf-8"));
+    const pkg = JSON.parse(fs7.readFileSync(pkgPath, "utf-8"));
     console.log(`burnwatch v${pkg.version}`);
   } catch {
     console.log("burnwatch v0.1.0");
   }
 }
 function registerHooks(projectRoot) {
-  const sourceHooksDir = path5.resolve(
-    path5.dirname(new URL(import.meta.url).pathname),
+  const sourceHooksDir = path7.resolve(
+    path7.dirname(new URL(import.meta.url).pathname),
     "hooks"
   );
-  const localHooksDir = path5.join(projectRoot, ".burnwatch", "hooks");
-  fs5.mkdirSync(localHooksDir, { recursive: true });
+  const localHooksDir = path7.join(projectRoot, ".burnwatch", "hooks");
+  fs7.mkdirSync(localHooksDir, { recursive: true });
   const hookFiles = [
     "on-session-start.js",
     "on-prompt.js",
@@ -2287,45 +2829,45 @@ function registerHooks(projectRoot) {
     "on-stop.js"
   ];
   for (const file of hookFiles) {
-    const src = path5.join(sourceHooksDir, file);
-    const dest = path5.join(localHooksDir, file);
+    const src = path7.join(sourceHooksDir, file);
+    const dest = path7.join(localHooksDir, file);
     try {
-      fs5.copyFileSync(src, dest);
+      fs7.copyFileSync(src, dest);
       const mapSrc = src + ".map";
-      if (fs5.existsSync(mapSrc)) {
-        fs5.copyFileSync(mapSrc, dest + ".map");
+      if (fs7.existsSync(mapSrc)) {
+        fs7.copyFileSync(mapSrc, dest + ".map");
       }
     } catch (err) {
       console.error(`   Warning: Could not copy hook ${file}: ${err instanceof Error ? err.message : err}`);
     }
   }
   console.log(`   Hook scripts copied to ${localHooksDir}`);
-  const sourceSkillsDir = path5.resolve(
-    path5.dirname(new URL(import.meta.url).pathname),
+  const sourceSkillsDir = path7.resolve(
+    path7.dirname(new URL(import.meta.url).pathname),
     "../skills"
   );
   const skillNames = ["setup-burnwatch", "burnwatch-interview", "spend"];
-  const claudeSkillsDir = path5.join(projectRoot, ".claude", "skills");
+  const claudeSkillsDir = path7.join(projectRoot, ".claude", "skills");
   for (const skillName of skillNames) {
-    const srcSkill = path5.join(sourceSkillsDir, skillName, "SKILL.md");
-    const destDir = path5.join(claudeSkillsDir, skillName);
-    const destSkill = path5.join(destDir, "SKILL.md");
+    const srcSkill = path7.join(sourceSkillsDir, skillName, "SKILL.md");
+    const destDir = path7.join(claudeSkillsDir, skillName);
+    const destSkill = path7.join(destDir, "SKILL.md");
     try {
-      if (fs5.existsSync(srcSkill)) {
-        fs5.mkdirSync(destDir, { recursive: true });
-        fs5.copyFileSync(srcSkill, destSkill);
+      if (fs7.existsSync(srcSkill)) {
+        fs7.mkdirSync(destDir, { recursive: true });
+        fs7.copyFileSync(srcSkill, destSkill);
       }
     } catch (err) {
       console.error(`   Warning: Could not copy skill ${skillName}: ${err instanceof Error ? err.message : err}`);
     }
   }
   console.log(`   Skills installed to ${claudeSkillsDir}`);
-  const claudeDir = path5.join(projectRoot, ".claude");
-  const settingsPath = path5.join(claudeDir, "settings.json");
-  fs5.mkdirSync(claudeDir, { recursive: true });
+  const claudeDir = path7.join(projectRoot, ".claude");
+  const settingsPath = path7.join(claudeDir, "settings.json");
+  fs7.mkdirSync(claudeDir, { recursive: true });
   let settings = {};
   try {
-    const existing = fs5.readFileSync(settingsPath, "utf-8");
+    const existing = fs7.readFileSync(settingsPath, "utf-8");
     settings = JSON.parse(existing);
     console.log(`   Merging into existing ${settingsPath}`);
   } catch {
@@ -2341,7 +2883,7 @@ function registerHooks(projectRoot) {
     hooks: [
       {
         type: "command",
-        command: `node "${path5.join(hooksDir, "on-session-start.js")}"`,
+        command: `node "${path7.join(hooksDir, "on-session-start.js")}"`,
         timeout: 15
       }
     ]
@@ -2354,7 +2896,7 @@ function registerHooks(projectRoot) {
       hooks: [
         {
           type: "command",
-          command: `node "${path5.join(hooksDir, "on-prompt.js")}"`,
+          command: `node "${path7.join(hooksDir, "on-prompt.js")}"`,
           timeout: 5
         }
       ]
@@ -2366,7 +2908,7 @@ function registerHooks(projectRoot) {
     hooks: [
       {
         type: "command",
-        command: `node "${path5.join(hooksDir, "on-file-change.js")}"`,
+        command: `node "${path7.join(hooksDir, "on-file-change.js")}"`,
         timeout: 5
       }
     ]
@@ -2376,14 +2918,14 @@ function registerHooks(projectRoot) {
     hooks: [
       {
         type: "command",
-        command: `node "${path5.join(hooksDir, "on-stop.js")}"`,
+        command: `node "${path7.join(hooksDir, "on-stop.js")}"`,
         timeout: 15,
         async: true
       }
     ]
   });
   settings["hooks"] = hooks;
-  fs5.writeFileSync(settingsPath, JSON.stringify(settings, null, 2) + "\n", "utf-8");
+  fs7.writeFileSync(settingsPath, JSON.stringify(settings, null, 2) + "\n", "utf-8");
   console.log(`   Hooks registered in ${settingsPath}`);
 }
 function addHookIfMissing(hookArray, _eventName, hookConfig) {