great-cto 1.0.166 → 1.0.167

package/dist/archetypes.js

@@ -80,12 +80,25 @@ const RULES = [
         archetype: "commerce",
         score: (d) => {
             let s = 0;
+            // Don't score commerce if fintech signals are stronger (Plaid etc.)
+            if (d.stack.includes("plaid") || d.stack.includes("dwolla") || d.stack.includes("teller"))
+                return 0;
             if (d.stack.includes("stripe"))
-                s += 5;
+                s += 7;
             if (d.stack.includes("shopify"))
-                s += 5;
+                s += 7;
             if (d.stack.includes("braintree"))
+                s += 6;
+            if (d.stack.includes("adyen"))
+                s += 6;
+            if (d.stack.includes("paddle"))
                 s += 5;
+            if (d.stack.includes("lemonsqueezy"))
+                s += 5;
+            // Add small bonus when paired with web framework (real e-commerce, not just SDK)
+            if (s > 0 && (d.stack.includes("next.js") || d.stack.includes("nuxt") ||
+                d.stack.includes("remix") || d.stack.includes("sveltekit")))
+                s += 1;
             return s;
         },
         reason: (d) => {
@@ -96,6 +109,10 @@ const RULES = [
                 payments.push("Shopify");
             if (d.stack.includes("braintree"))
                 payments.push("Braintree");
+            if (d.stack.includes("adyen"))
+                payments.push("Adyen");
+            if (d.stack.includes("paddle"))
+                payments.push("Paddle");
             return `payments SDK detected: ${payments.join(", ")} — PCI-DSS gate mandatory`;
         },
     },
@@ -118,7 +135,49 @@ const RULES = [
         score: (d) => (d.stack.includes("embedded") ? 6 : 0),
         reason: (_d) => "platformio.ini / sdkconfig detected — embedded firmware archetype",
     },
+    // ── agent-product (LLM + vector DB OR multi-agent framework) ────
+    // Higher score than ai-system: this is an autonomous-agent product, not a wrapper
+    {
+        archetype: "agent-product",
+        score: (d) => {
+            const llms = ["anthropic-sdk", "openai-sdk", "google-ai", "aws-bedrock", "cohere"];
+            const vdbs = ["pinecone", "weaviate", "chroma", "qdrant"];
+            const agents = ["langgraph", "crewai", "autogen", "mastra", "mcp"];
+            const hasLlm = llms.some((s) => d.stack.includes(s));
+            const hasVdb = vdbs.some((s) => d.stack.includes(s));
+            const hasAgentFw = agents.some((s) => d.stack.includes(s));
+            let s = 0;
+            if (hasLlm && hasVdb)
+                s += 7; // RAG-style agent
+            if (hasAgentFw)
+                s += 6; // explicit agent framework
+            if (hasLlm && hasAgentFw)
+                s += 2; // bonus
+            // README mining hint
+            if (d.readmeKeywords.includes("agent") || d.readmeKeywords.includes("ai"))
+                s += 1;
+            return s;
+        },
+        reason: (d) => {
+            const bits = [];
+            if (d.stack.includes("langgraph"))
+                bits.push("LangGraph");
+            if (d.stack.includes("crewai"))
+                bits.push("CrewAI");
+            if (d.stack.includes("autogen"))
+                bits.push("AutoGen");
+            if (d.stack.includes("mastra"))
+                bits.push("Mastra");
+            if (d.stack.includes("mcp"))
+                bits.push("MCP SDK");
+            const vdb = ["pinecone", "weaviate", "chroma", "qdrant"].filter((s) => d.stack.includes(s));
+            if (vdb.length)
+                bits.push(`vector DB (${vdb.join(",")})`);
+            return `agent-product detected — ${bits.join(", ")} — agent-eval + isolation + prompt-injection gates required`;
+        },
+    },
     // ── ai-system ────────────────────────────────────
+    // Lower score than agent-product: an LLM-using app without vector DB / agent FW
     {
         archetype: "ai-system",
         score: (d) => {
@@ -127,33 +186,126 @@ const RULES = [
                 s += 4;
             if (d.stack.includes("openai-sdk"))
                 s += 3;
+            if (d.stack.includes("google-ai"))
+                s += 3;
+            if (d.stack.includes("aws-bedrock"))
+                s += 3;
+            if (d.stack.includes("cohere"))
+                s += 2;
+            if (d.stack.includes("replicate"))
+                s += 2;
             if (d.stack.includes("langchain"))
-                s += 4;
+                s += 3;
             if (d.stack.includes("llamaindex"))
-                s += 4;
-            if (d.stack.includes("mcp"))
-                s += 5;
-            if (d.stack.includes("ml"))
                 s += 3;
+            if (d.stack.includes("vercel-ai-sdk"))
+                s += 3;
+            if (d.stack.includes("ml"))
+                s += 2;
+            // Don't double-score if already an agent-product
+            const agents = ["langgraph", "crewai", "autogen", "mastra", "mcp"];
+            if (agents.some((a) => d.stack.includes(a)))
+                s = Math.max(0, s - 2);
+            const vdbs = ["pinecone", "weaviate", "chroma", "qdrant"];
+            if (vdbs.some((v) => d.stack.includes(v)))
+                s = Math.max(0, s - 2);
             return s;
         },
         reason: (d) => {
             const bits = [];
-            if (d.stack.includes("mcp"))
-                bits.push("MCP SDK");
             if (d.stack.includes("anthropic-sdk"))
                 bits.push("Anthropic SDK");
             if (d.stack.includes("openai-sdk"))
                 bits.push("OpenAI SDK");
+            if (d.stack.includes("google-ai"))
+                bits.push("Gemini");
+            if (d.stack.includes("aws-bedrock"))
+                bits.push("AWS Bedrock");
             if (d.stack.includes("langchain"))
                 bits.push("LangChain");
             if (d.stack.includes("llamaindex"))
                 bits.push("LlamaIndex");
+            if (d.stack.includes("vercel-ai-sdk"))
+                bits.push("Vercel AI SDK");
             if (d.stack.includes("ml"))
                 bits.push("ML stack");
-            return `AI/LLM tooling detected (${bits.join(", ")}) — security gate mandatory for prompt injection + output sanitization`;
+            return `AI/LLM tooling detected (${bits.join(", ")}) — prompt injection + output sanitization gates`;
         },
     },
+    // ── fintech (Plaid, banking integrations) ────────
+    {
+        archetype: "fintech",
+        score: (d) => {
+            let s = 0;
+            if (d.stack.includes("plaid"))
+                s += 10;
+            if (d.stack.includes("wise"))
+                s += 9;
+            if (d.stack.includes("dwolla"))
+                s += 9;
+            if (d.stack.includes("teller"))
+                s += 9;
+            if (d.stack.includes("fintech"))
+                s += 7;
+            if (d.readmeKeywords.includes("fintech"))
+                s += 2;
+            return s;
+        },
+        reason: (d) => {
+            const bits = [];
+            if (d.stack.includes("plaid"))
+                bits.push("Plaid");
+            if (d.stack.includes("wise"))
+                bits.push("Wise");
+            if (d.stack.includes("dwolla"))
+                bits.push("Dwolla");
+            if (d.stack.includes("teller"))
+                bits.push("Teller");
+            return `fintech integration: ${bits.join(", ")} — SOX, PCI, KYC/AML compliance gates`;
+        },
+    },
+    // ── healthcare (FHIR/HL7/PHI) ───────────────────
+    {
+        archetype: "healthcare",
+        score: (d) => {
+            let s = 0;
+            if (d.stack.includes("fhir"))
+                s += 7;
+            if (d.stack.includes("hl7"))
+                s += 6;
+            if (d.readmeKeywords.includes("healthcare"))
+                s += 3;
+            return s;
+        },
+        reason: (d) => {
+            const bits = [];
+            if (d.stack.includes("fhir"))
+                bits.push("FHIR");
+            if (d.stack.includes("hl7"))
+                bits.push("HL7");
+            return `healthcare data tooling: ${bits.join(", ")} — HIPAA/PHI handling gates required`;
+        },
+    },
+    // ── cli-tool (explicit CLI: bin field + cli entry) ─
+    {
+        archetype: "cli-tool",
+        score: (d) => {
+            let s = 0;
+            // Explicit cli marker from detect.ts (bin field present)
+            if (d.stack.includes("cli"))
+                s += 6;
+            if (d.codeStructure.hasCliEntry)
+                s += 2;
+            if (d.readmeKeywords.includes("cli"))
+                s += 1;
+            // Penalize if web framework present (CLI + web is rare)
+            const webFw = ["next.js", "express", "fastify", "nestjs", "django", "fastapi", "flask", "hono", "koa"];
+            if (webFw.some((w) => d.stack.includes(w)))
+                s = Math.max(0, s - 4);
+            return s;
+        },
+        reason: (_d) => "package.json bin field + CLI entry detected — argument-parsing, exit-code, --help gates",
+    },
     // ── mobile-app ───────────────────────────────────
     {
         archetype: "mobile-app",
@@ -183,8 +335,34 @@ const RULES = [
     // ── data-platform ────────────────────────────────
     {
         archetype: "data-platform",
-        score: (d) => (d.stack.includes("data-pipeline") ? 4 : 0),
-        reason: (_d) => "data pipeline tooling detected (pandas/airflow/prefect)",
+        score: (d) => {
+            let s = 0;
+            if (d.stack.includes("data-pipeline"))
+                s += 6;
+            if (d.stack.includes("dbt"))
+                s += 3;
+            if (d.stack.includes("dagster"))
+                s += 3;
+            if (d.stack.includes("polars"))
+                s += 2;
+            if (d.stack.includes("iceberg"))
+                s += 3;
+            if (d.stack.includes("duckdb"))
+                s += 2;
+            if (d.readmeKeywords.includes("data"))
+                s += 1;
+            return s;
+        },
+        reason: (d) => {
+            const bits = [];
+            if (d.stack.includes("data-pipeline"))
+                bits.push("pandas/airflow/prefect");
+            if (d.stack.includes("dbt"))
+                bits.push("dbt");
+            if (d.stack.includes("dagster"))
+                bits.push("dagster");
+            return `data pipeline tooling: ${bits.join(", ") || "detected"}`;
+        },
     },
     // ── infra ────────────────────────────────────────
     {
@@ -224,34 +402,70 @@ const RULES = [
         archetype: "web-service",
         score: (d) => {
             let s = 0;
-            const webFrameworks = [
-                "next.js", "react", "vue", "angular", "svelte", "astro",
-                "express", "fastify", "nestjs", "hono",
-                "django", "fastapi", "flask",
-            ];
-            for (const fw of webFrameworks)
+            const serverFrameworks = ["express", "fastify", "nestjs", "hono", "koa",
+                "django", "fastapi", "flask", "gin", "echo", "chi"];
+            const fullstackFw = ["next.js", "nuxt", "remix", "sveltekit", "astro"];
+            const uiOnly = ["react", "vue", "angular", "svelte"];
+            for (const fw of serverFrameworks)
+                if (d.stack.includes(fw))
+                    s += 3;
+            for (const fw of fullstackFw)
+                if (d.stack.includes(fw))
+                    s += 4;
+            // UI-only: weaker signal (could be a library)
+            for (const fw of uiOnly)
                 if (d.stack.includes(fw))
                     s += 1;
             if (s > 0)
-                s += 2; // baseline bonus for any web framework
+                s += 1; // baseline web bonus
+            // Code-structure boost
+            if (d.codeStructure.hasRoutesDir)
+                s += 2;
+            if (d.codeStructure.hasServerEntry)
+                s += 2;
+            if (d.scripts.hasStart || d.scripts.hasDev)
+                s += 1;
+            // Penalize if explicitly a library (publishConfig/cli)
+            if (d.stack.includes("library") && !d.codeStructure.hasRoutesDir && !d.codeStructure.hasServerEntry) {
+                s = Math.max(0, s - 3);
+            }
             return s;
         },
         reason: (d) => {
-            const fw = d.stack.find((t) => ["next.js", "react", "vue", "angular", "svelte", "astro", "express", "fastify", "nestjs", "hono", "django", "fastapi", "flask"].includes(t));
-            return `web framework detected: ${fw ?? "unknown"}`;
+            const fw = d.stack.find((t) => ["next.js", "express", "fastify", "nestjs", "hono", "koa",
+                "django", "fastapi", "flask", "gin", "echo"].includes(t));
+            const extras = [];
+            if (d.codeStructure.hasRoutesDir)
+                extras.push("routes/");
+            if (d.codeStructure.hasServerEntry)
+                extras.push("server entry");
+            return `web framework detected: ${fw ?? "unknown"}${extras.length ? " + " + extras.join(", ") : ""}`;
         },
     },
     // ── library (no app framework, just code) ────────
-    // Detection priority: explicit "library" or "cli" stack signal from detect.ts (high confidence)
-    // Fallback: plain runtime + no web/mobile/infra framework (low confidence)
+    // Strong signal: detect.ts marked "library" + no web/server structure
     {
         archetype: "library",
         score: (d) => {
-            // Strong signal: detect.ts found library indicators
-            if (d.stack.includes("library") || d.stack.includes("cli")) {
+            const isExplicitLib = d.stack.includes("library");
+            const isExplicitCli = d.stack.includes("cli");
+            // Don't claim library if web-service shape is obvious
+            const looksLikeWebService = d.codeStructure.hasRoutesDir || d.codeStructure.hasServerEntry;
+            if (looksLikeWebService)
+                return 0;
+            // Don't claim library if data-pipeline / ml signals dominate
+            if (d.stack.includes("data-pipeline") || d.stack.includes("ml"))
+                return 0;
+            // Don't claim library if a domain-specific archetype is clearly present
+            const domainSignals = ["plaid", "wise", "dwolla", "fhir", "hl7", "stripe", "shopify", "solidity",
+                "embedded", "unity", "unreal", "godot", "react-native", "expo"];
+            if (domainSignals.some((s) => d.stack.includes(s)))
+                return 0;
+            if (isExplicitLib && !isExplicitCli)
                 return 7;
-            }
-            // Weaker signal: no app framework detected
+            if (isExplicitLib && isExplicitCli)
+                return 4; // cli-tool rule will outscore
+            // Weaker signal: plain runtime + no app framework
             const hasApp = d.stack.some((t) => ["next.js", "django", "fastapi", "flask", "express", "fastify", "nestjs", "hono",
                 "react-native", "expo", "tauri", "capacitor", "flutter",
                 "terraform", "pulumi", "aws-cdk", "helm",
@@ -265,18 +479,35 @@ const RULES = [
             return 0;
         },
         reason: (d) => {
-            if (d.stack.includes("library") || d.stack.includes("cli")) {
-                return "package.json/pyproject/Cargo.toml indicates a publishable library or CLI";
+            if (d.stack.includes("library")) {
+                return "package.json/pyproject/Cargo.toml indicates a publishable library";
             }
             return "no web/mobile/infra framework detected — looks like a library/SDK";
         },
     },
 ];
+// Tie-break priority — when two rules score equally, prefer the one
+// higher in this list (more specific / domain-bound first).
+const TIE_BREAK_PRIORITY = [
+    "browser-extension", "iot-embedded", "web3", "game",
+    "agent-product", "fintech", "healthcare",
+    "commerce", "ai-system", "devtools",
+    "data-platform", "infra", "mobile-app",
+    "cli-tool", "web-service", "library", "regulated", "greenfield",
+];
+function priorityIndex(a) {
+    const i = TIE_BREAK_PRIORITY.indexOf(a);
+    return i < 0 ? TIE_BREAK_PRIORITY.length : i;
+}
 export function pickArchetype(d) {
     const scored = RULES
         .map((r) => ({ archetype: r.archetype, score: r.score(d), reason: r.reason(d) }))
         .filter((r) => r.score > 0)
-        .sort((a, b) => b.score - a.score);
+        .sort((a, b) => {
+        if (b.score !== a.score)
+            return b.score - a.score;
+        return priorityIndex(a.archetype) - priorityIndex(b.archetype);
+    });
     if (scored.length === 0) {
         return {
             primary: "greenfield",
@@ -288,30 +519,58 @@ export function pickArchetype(d) {
     const top = scored[0];
     const nextBest = scored[1]?.score ?? 0;
     const gap = top.score - nextBest;
-    const confidence = top.score >= 5 && gap >= 2 ? "high" :
-        top.score >= 3 ? "medium" : "low";
+    // Confidence: high when score≥6 and gap≥3; medium ≥4; else low
+    const confidence = top.score >= 6 && gap >= 3 ? "high" :
+        top.score >= 4 && gap >= 1 ? "medium" : "low";
+    // Dedupe alternatives, keep top 3
+    const seen = new Set([top.archetype]);
+    const alternatives = [];
+    for (const r of scored.slice(1)) {
+        if (!seen.has(r.archetype)) {
+            seen.add(r.archetype);
+            alternatives.push(r.archetype);
+            if (alternatives.length >= 3)
+                break;
+        }
+    }
     return {
         primary: top.archetype,
         confidence,
         rationale: top.reason,
-        alternatives: scored.slice(1, 4).map((r) => r.archetype),
+        alternatives,
     };
 }
-// Compliance hints — auto-suggested based on stack.
+// Compliance hints — auto-suggested based on stack and README.
 export function suggestCompliance(d, archetype) {
     const c = new Set();
+    // ── archetype defaults ───────────────────────────
     if (archetype === "commerce") {
         c.add("pci-dss");
         c.add("gdpr");
     }
-    if (archetype === "ai-system") {
+    if (archetype === "fintech") {
+        c.add("pci-dss");
+        c.add("sox");
+        c.add("kyc-aml");
+        c.add("gdpr");
+    }
+    if (archetype === "healthcare") {
+        c.add("hipaa");
+        c.add("gdpr");
+        c.add("hitech");
+    }
+    if (archetype === "ai-system" || archetype === "agent-product") {
         c.add("eu-ai-act");
+        // Add OWASP LLM only if it's truly an agent product
+        if (archetype === "agent-product")
+            c.add("owasp-llm-top-10");
     }
     if (archetype === "web3") {
         c.add("soc2");
     }
     if (archetype === "iot-embedded") {
         c.add("iso27001");
+        c.add("etsi-en-303-645");
     }
     if (archetype === "browser-extension") {
         c.add("csp");
@@ -329,10 +588,29 @@ export function suggestCompliance(d, archetype) {
         c.add("soc2-type-2");
         c.add("gdpr");
     }
-    if (d.stack.includes("stripe"))
-        c.add("pci-dss");
-    // Reasonable default for any web service storing user data
     if (archetype === "web-service")
-        c.add("gdpr");
+        c.add("gdpr"); // baseline for user data
+    if (archetype === "cli-tool") { /* CLI tools usually don't have compliance load */ }
+    // ── stack-derived (cross-archetype) ──────────────
+    if (d.stack.includes("stripe") || d.stack.includes("braintree") ||
+        d.stack.includes("adyen") || d.stack.includes("paddle")) {
+        c.add("pci-dss");
+    }
+    if (d.stack.includes("plaid") || d.stack.includes("dwolla") ||
+        d.stack.includes("teller") || d.stack.includes("wise")) {
+        c.add("kyc-aml");
+        c.add("sox");
+    }
+    if (d.stack.includes("fhir") || d.stack.includes("hl7")) {
+        c.add("hipaa");
+        c.add("hitech");
+    }
+    // ── README-derived ───────────────────────────────
+    if (d.readmeKeywords.includes("regulated"))
+        c.add("compliance-required");
+    if (d.readmeKeywords.includes("healthcare"))
+        c.add("hipaa");
+    if (d.readmeKeywords.includes("fintech"))
+        c.add("sox");
     return Array.from(c).sort();
 }

package/dist/bootstrap.js

@@ -25,7 +25,7 @@ export function bootstrap(dir, detection, archetype, compliance, detectionMeta)
 
 primary: ${archetype}
 archetype: ${archetype}
-project_size: medium
+project_size: ${detection.projectSize}
 stack: ${stackLine}
 languages: ${detection.languages.join(", ") || "to be defined"}
 package-manager: ${detection.packageManager ?? "none"}

package/dist/detect.js

@@ -73,7 +73,7 @@ export function detect(dir) {
                 stack.add("openai-sdk");
                 sig("ai", "openai");
             }
-            if (has("@anthropic-ai/sdk")) {
+            if (has("@anthropic-ai/sdk") || has("@anthropic-ai/claude-code")) {
                 stack.add("anthropic-sdk");
                 sig("ai", "anthropic-sdk");
             }
@@ -109,6 +109,39 @@ export function detect(dir) {
                 stack.add("vercel-ai-sdk");
                 sig("ai", "vercel-ai-sdk");
             }
+            // Vector databases (when paired with LLM SDK → agent-product)
+            if (has("@pinecone-database/pinecone")) {
+                stack.add("pinecone");
+                sig("vectordb", "pinecone");
+            }
+            if (has("weaviate-ts-client") || has("weaviate-client")) {
+                stack.add("weaviate");
+                sig("vectordb", "weaviate");
+            }
+            if (has("chromadb")) {
+                stack.add("chroma");
+                sig("vectordb", "chroma");
+            }
+            if (has("@qdrant/js-client-rest")) {
+                stack.add("qdrant");
+                sig("vectordb", "qdrant");
+            }
+            if (has("@google/generative-ai") || has("@google-ai/generativelanguage")) {
+                stack.add("google-ai");
+                sig("ai", "gemini");
+            }
+            if (has("@aws-sdk/client-bedrock-runtime")) {
+                stack.add("aws-bedrock");
+                sig("ai", "bedrock");
+            }
+            if (has("cohere-ai")) {
+                stack.add("cohere");
+                sig("ai", "cohere");
+            }
+            if (has("replicate")) {
+                stack.add("replicate");
+                sig("ai", "replicate");
+            }
             // Payments / commerce
             if (has("stripe") || has("@stripe/stripe-js")) {
                 stack.add("stripe");
@@ -138,6 +171,41 @@ export function detect(dir) {
                 stack.add("polar");
                 sig("commerce", "polar");
             }
+            // Fintech (banking, ACH, regulated payments)
+            if (has("plaid")) {
+                stack.add("plaid");
+                sig("fintech", "plaid");
+            }
+            if (has("@wise-api/api-client") || has("wise")) {
+                stack.add("wise");
+                sig("fintech", "wise");
+            }
+            if (has("dwolla-v2")) {
+                stack.add("dwolla");
+                sig("fintech", "dwolla");
+            }
+            if (has("@teller/teller")) {
+                stack.add("teller");
+                sig("fintech", "teller");
+            }
+            // Stripe Connect/Issuing → fintech (not just commerce)
+            if (has("stripe") && (pkg.name?.includes("bank") || pkg.name?.includes("card"))) {
+                sig("fintech", "stripe-connect");
+                stack.add("fintech");
+            }
+            // Healthcare / FHIR
+            if (has("fhir") || has("fhir.js") || has("@types/fhir")) {
+                stack.add("fhir");
+                sig("healthcare", "fhir");
+            }
+            if (has("@smile-cdr/fhirts")) {
+                stack.add("fhir");
+                sig("healthcare", "smile-cdr");
+            }
+            if (has("hl7")) {
+                stack.add("hl7");
+                sig("healthcare", "hl7");
+            }
             // Auth
             if (has("next-auth") || has("@auth/core"))
                 stack.add("auth");
@@ -190,17 +258,31 @@ export function detect(dir) {
             }
             // Library detection (npm package intended for distribution)
             // Signals: has "main" or "exports", NOT "private:true", NOT a typical app structure
+            // Negative signal: any backend framework dep → likely a server, not a library
+            const SERVER_FRAMEWORKS = ["express", "fastify", "nestjs", "@nestjs/core", "hono", "koa", "@hapi/hapi", "restify", "polka"];
+            const hasServerFramework = SERVER_FRAMEWORKS.some((f) => has(f));
+            const FULLSTACK_FRAMEWORKS = ["next", "nuxt", "@remix-run/node", "@sveltejs/kit", "astro", "gatsby"];
+            const hasFullstack = FULLSTACK_FRAMEWORKS.some((f) => has(f));
             const isPublishable = !pkg.private && (pkg.main || pkg.exports || pkg.module || pkg.type === "module");
             const hasAppStructure = existsSync(join(dir, "pages")) ||
                 existsSync(join(dir, "app")) ||
                 existsSync(join(dir, "src/pages")) ||
                 existsSync(join(dir, "src/app")) ||
-                existsSync(join(dir, "public/index.html"));
+                existsSync(join(dir, "public/index.html")) ||
+                existsSync(join(dir, "routes")) ||
+                existsSync(join(dir, "src/routes")) ||
+                existsSync(join(dir, "api"));
             const hasBin = !!pkg.bin;
-            if (isPublishable && !hasAppStructure) {
+            // Strong library signal: explicit publishConfig or files field listing dist
+            const hasExplicitLibConfig = !!pkg.publishConfig || (Array.isArray(pkg.files) && !hasServerFramework);
+            if (isPublishable && !hasAppStructure && !hasServerFramework && !hasFullstack) {
                 stack.add("library");
                 sig("library", "package.json");
             }
+            else if (hasExplicitLibConfig && !hasServerFramework && !hasFullstack) {
+                stack.add("library");
+                sig("library", "publishConfig");
+            }
             if (hasBin) {
                 stack.add("cli");
                 sig("library", "bin");
@@ -633,6 +715,63 @@ export function detect(dir) {
         existsSync(join(dir, "azure-pipelines.yml"));
     const hasExistingGreatCto = existsSync(join(dir, ".great_cto", "PROJECT.md")) ||
         existsSync(join(dir, ".great_cto", "SKILL.md"));
+    // ── Code-structure signals (Wave 1) ──────────────────────
+    const hasRoutesDir = existsSync(join(dir, "routes")) ||
+        existsSync(join(dir, "app")) ||
+        existsSync(join(dir, "pages")) ||
+        existsSync(join(dir, "src/api")) ||
+        existsSync(join(dir, "src/routes")) ||
+        existsSync(join(dir, "src/pages")) ||
+        existsSync(join(dir, "src/app")) ||
+        existsSync(join(dir, "api"));
+    const hasCliEntry = existsSync(join(dir, "bin")) ||
+        existsSync(join(dir, "src/cli.ts")) ||
+        existsSync(join(dir, "src/cli.js")) ||
+        existsSync(join(dir, "src/main.ts")) && pkg.bin != null ||
+        existsSync(join(dir, "cmd"));
+    const hasPublicHtml = existsSync(join(dir, "public/index.html")) ||
+        existsSync(join(dir, "index.html")) ||
+        existsSync(join(dir, "src/index.html"));
+    const hasServerEntry = existsSync(join(dir, "server.ts")) || existsSync(join(dir, "server.js")) ||
+        existsSync(join(dir, "server.mjs")) ||
+        existsSync(join(dir, "src/server.ts")) || existsSync(join(dir, "src/server.js")) ||
+        existsSync(join(dir, "app.ts")) || existsSync(join(dir, "app.js")) ||
+        existsSync(join(dir, "src/app.ts")) || existsSync(join(dir, "src/app.js"));
+    const hasMonorepo = existsSync(join(dir, "pnpm-workspace.yaml")) ||
+        existsSync(join(dir, "lerna.json")) ||
+        existsSync(join(dir, "nx.json")) ||
+        existsSync(join(dir, "turbo.json")) ||
+        existsSync(join(dir, "rush.json"));
+    if (hasMonorepo)
+        sig("monorepo", "workspace-config");
+    if (hasRoutesDir)
+        sig("structure", "routes-dir");
+    if (hasCliEntry)
+        sig("structure", "cli-entry");
+    if (hasServerEntry)
+        sig("structure", "server-entry");
+    // ── npm-scripts heuristics (Wave 1) ──────────────────────
+    const scripts = pkg.scripts || {};
+    const scriptHints = {
+        hasStart: !!scripts.start,
+        hasDev: !!scripts.dev,
+        hasBuild: !!scripts.build,
+        hasPublish: !!scripts.prepublishOnly || !!scripts.publish,
+    };
+    if (scriptHints.hasPublish && pkg.publishConfig?.access === "public") {
+        sig("library", "publishConfig");
+        stack.add("library");
+    }
+    // server-ish scripts AND server entry → web-service indicator
+    if ((scriptHints.hasStart || scriptHints.hasDev) && hasServerEntry) {
+        sig("structure", "web-service-shape");
+    }
+    // ── Project size estimate (Wave 3 lite) ──────────────────
+    const projectSize = estimateProjectSize(dir);
+    // ── README mining (Wave 2) ───────────────────────────────
+    const readmeKeywords = mineReadmeKeywords(dir);
+    for (const kw of readmeKeywords)
+        sig(`readme:${kw}`, "README");
     return {
         stack: Array.from(stack).sort(),
         languages: Array.from(languages).sort(),
@@ -641,9 +780,106 @@ export function detect(dir) {
         hasTests,
         hasCI,
         hasExistingGreatCto,
+        codeStructure: {
+            hasRoutesDir,
+            hasCliEntry,
+            hasPublicHtml,
+            hasServerEntry,
+            hasMonorepo,
+        },
+        scripts: scriptHints,
+        projectSize,
+        readmeKeywords,
     };
 }
 // ── helpers ──────────────────────────────────────────────────
+/**
+ * Estimate project size from file count (no LOC, to stay fast).
+ * Skips node_modules, .git, dist, build, .next, target, vendor.
+ */
+function estimateProjectSize(dir) {
+    const SKIP = new Set(["node_modules", ".git", "dist", "build", ".next", ".nuxt",
+        "target", "vendor", ".venv", "venv", "__pycache__", ".cache",
+        "coverage", ".turbo", ".vercel", ".wrangler"]);
+    const SOURCE_EXTS = /\.(ts|tsx|js|jsx|mjs|cjs|py|rs|go|java|kt|swift|rb|php|c|cpp|h|hpp|cs|sol|sql|css|scss|html|md)$/;
+    let count = 0;
+    const MAX = 5000; // hard cap to keep scan O(seconds)
+    function walk(d, depth) {
+        if (count > MAX || depth > 6)
+            return;
+        try {
+            const entries = readdirSync(d);
+            for (const e of entries) {
+                if (count > MAX)
+                    return;
+                if (e.startsWith(".") && depth === 0 && e !== ".github")
+                    continue;
+                if (SKIP.has(e))
+                    continue;
+                const p = join(d, e);
+                try {
+                    const st = statSync(p);
+                    if (st.isDirectory())
+                        walk(p, depth + 1);
+                    else if (st.isFile() && SOURCE_EXTS.test(e))
+                        count++;
+                }
+                catch { /* unreadable */ }
+            }
+        }
+        catch { /* unreadable */ }
+    }
+    walk(dir, 0);
+    if (count < 10)
+        return "nano";
+    if (count < 50)
+        return "small";
+    if (count < 250)
+        return "medium";
+    if (count < 1000)
+        return "large";
+    return "enterprise";
+}
+/**
+ * Extract a small set of categorical keywords from README.md.
+ * Used as a *hint* — not a primary signal.
+ */
+function mineReadmeKeywords(dir) {
+    const kws = new Set();
+    const path = ["README.md", "readme.md", "README.rst", "README"]
+        .map((f) => join(dir, f))
+        .find((p) => existsSync(p));
+    if (!path)
+        return [];
+    let text = "";
+    try {
+        text = readFileSync(path, "utf-8").slice(0, 4000).toLowerCase();
+    }
+    catch {
+        return [];
+    }
+    // Categorical hints — broad strokes, intentionally conservative
+    const buckets = {
+        "ai": ["llm", "gpt", "claude", "anthropic", "openai", "embedding", "rag", "agent ", "agentic"],
+        "agent": ["multi-agent", " agent ", "autonomous", "orchestrat"],
+        "commerce": ["payment", "checkout", "stripe", "subscription", "billing"],
+        "fintech": ["bank", "ach", "fintech", "account number", "ledger", "kyc", "aml"],
+        "healthcare": ["health", "patient", "medical", "fhir", "hipaa", "phi", "ehr"],
+        "web3": ["smart contract", "ethereum", "solidity", "defi", "nft", "wallet"],
+        "iot": ["embedded", "firmware", "iot ", "esp32", "esp8266", "arduino"],
+        "browser-extension": ["chrome extension", "browser extension", "manifest_version"],
+        "library": ["installation", "## install", "## usage", "publish", "npm install"],
+        "cli": ["command-line", "command line", "cli ", "$ npx ", "subcommand"],
+        "data": ["pipeline", "etl ", "warehouse", "dbt", "airflow", "dataset"],
+        "game": ["game ", "gameplay", "player", "level design"],
+        "regulated": ["pci", "hipaa", "soc2", "iso 27001", "gdpr", "compliance"],
+    };
+    for (const [bucket, terms] of Object.entries(buckets)) {
+        if (terms.some((t) => text.includes(t)))
+            kws.add(bucket);
+    }
+    return Array.from(kws).sort();
+}
 function safeGlob(dir, pattern, kind = "file") {
     try {
         const entries = readdirSync(dir);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "great-cto",
-  "version": "1.0.166",
+  "version": "1.0.167",
   "description": "One command install for the great_cto Claude Code plugin. Auto-detects your stack, picks the right archetype, bootstraps PROJECT.md.",
   "keywords": [
     "claude-code",