great-cto 1.0.166 → 1.0.168

package/dist/archetypes.js

@@ -80,12 +80,25 @@ const RULES = [
         archetype: "commerce",
         score: (d) => {
             let s = 0;
+            // Don't score commerce if fintech signals are stronger (Plaid etc.)
+            if (d.stack.includes("plaid") || d.stack.includes("dwolla") || d.stack.includes("teller"))
+                return 0;
             if (d.stack.includes("stripe"))
-                s += 5;
+                s += 7;
             if (d.stack.includes("shopify"))
-                s += 5;
+                s += 7;
             if (d.stack.includes("braintree"))
+                s += 6;
+            if (d.stack.includes("adyen"))
+                s += 6;
+            if (d.stack.includes("paddle"))
                 s += 5;
+            if (d.stack.includes("lemonsqueezy"))
+                s += 5;
+            // Add small bonus when paired with web framework (real e-commerce, not just SDK)
+            if (s > 0 && (d.stack.includes("next.js") || d.stack.includes("nuxt") ||
+                d.stack.includes("remix") || d.stack.includes("sveltekit")))
+                s += 1;
             return s;
         },
         reason: (d) => {
@@ -96,6 +109,10 @@ const RULES = [
                 payments.push("Shopify");
             if (d.stack.includes("braintree"))
                 payments.push("Braintree");
+            if (d.stack.includes("adyen"))
+                payments.push("Adyen");
+            if (d.stack.includes("paddle"))
+                payments.push("Paddle");
             return `payments SDK detected: ${payments.join(", ")} — PCI-DSS gate mandatory`;
         },
     },
@@ -118,7 +135,49 @@ const RULES = [
         score: (d) => (d.stack.includes("embedded") ? 6 : 0),
         reason: (_d) => "platformio.ini / sdkconfig detected — embedded firmware archetype",
     },
+    // ── agent-product (LLM + vector DB OR multi-agent framework) ────
+    // Higher score than ai-system: this is an autonomous-agent product, not a wrapper
+    {
+        archetype: "agent-product",
+        score: (d) => {
+            const llms = ["anthropic-sdk", "openai-sdk", "google-ai", "aws-bedrock", "cohere"];
+            const vdbs = ["pinecone", "weaviate", "chroma", "qdrant"];
+            const agents = ["langgraph", "crewai", "autogen", "mastra", "mcp"];
+            const hasLlm = llms.some((s) => d.stack.includes(s));
+            const hasVdb = vdbs.some((s) => d.stack.includes(s));
+            const hasAgentFw = agents.some((s) => d.stack.includes(s));
+            let s = 0;
+            if (hasLlm && hasVdb)
+                s += 7; // RAG-style agent
+            if (hasAgentFw)
+                s += 6; // explicit agent framework
+            if (hasLlm && hasAgentFw)
+                s += 2; // bonus
+            // README mining hint
+            if (d.readmeKeywords.includes("agent") || d.readmeKeywords.includes("ai"))
+                s += 1;
+            return s;
+        },
+        reason: (d) => {
+            const bits = [];
+            if (d.stack.includes("langgraph"))
+                bits.push("LangGraph");
+            if (d.stack.includes("crewai"))
+                bits.push("CrewAI");
+            if (d.stack.includes("autogen"))
+                bits.push("AutoGen");
+            if (d.stack.includes("mastra"))
+                bits.push("Mastra");
+            if (d.stack.includes("mcp"))
+                bits.push("MCP SDK");
+            const vdb = ["pinecone", "weaviate", "chroma", "qdrant"].filter((s) => d.stack.includes(s));
+            if (vdb.length)
+                bits.push(`vector DB (${vdb.join(",")})`);
+            return `agent-product detected — ${bits.join(", ")} — agent-eval + isolation + prompt-injection gates required`;
+        },
+    },
     // ── ai-system ────────────────────────────────────
+    // Lower score than agent-product: an LLM-using app without vector DB / agent FW
     {
         archetype: "ai-system",
         score: (d) => {
@@ -127,33 +186,126 @@ const RULES = [
                 s += 4;
             if (d.stack.includes("openai-sdk"))
                 s += 3;
+            if (d.stack.includes("google-ai"))
+                s += 3;
+            if (d.stack.includes("aws-bedrock"))
+                s += 3;
+            if (d.stack.includes("cohere"))
+                s += 2;
+            if (d.stack.includes("replicate"))
+                s += 2;
             if (d.stack.includes("langchain"))
-                s += 4;
+                s += 3;
             if (d.stack.includes("llamaindex"))
-                s += 4;
-            if (d.stack.includes("mcp"))
-                s += 5;
-            if (d.stack.includes("ml"))
                 s += 3;
+            if (d.stack.includes("vercel-ai-sdk"))
+                s += 3;
+            if (d.stack.includes("ml"))
+                s += 2;
+            // Don't double-score if already an agent-product
+            const agents = ["langgraph", "crewai", "autogen", "mastra", "mcp"];
+            if (agents.some((a) => d.stack.includes(a)))
+                s = Math.max(0, s - 2);
+            const vdbs = ["pinecone", "weaviate", "chroma", "qdrant"];
+            if (vdbs.some((v) => d.stack.includes(v)))
+                s = Math.max(0, s - 2);
             return s;
         },
         reason: (d) => {
             const bits = [];
-            if (d.stack.includes("mcp"))
-                bits.push("MCP SDK");
             if (d.stack.includes("anthropic-sdk"))
                 bits.push("Anthropic SDK");
             if (d.stack.includes("openai-sdk"))
                 bits.push("OpenAI SDK");
+            if (d.stack.includes("google-ai"))
+                bits.push("Gemini");
+            if (d.stack.includes("aws-bedrock"))
+                bits.push("AWS Bedrock");
             if (d.stack.includes("langchain"))
                 bits.push("LangChain");
             if (d.stack.includes("llamaindex"))
                 bits.push("LlamaIndex");
+            if (d.stack.includes("vercel-ai-sdk"))
+                bits.push("Vercel AI SDK");
             if (d.stack.includes("ml"))
                 bits.push("ML stack");
-            return `AI/LLM tooling detected (${bits.join(", ")}) — security gate mandatory for prompt injection + output sanitization`;
+            return `AI/LLM tooling detected (${bits.join(", ")}) — prompt injection + output sanitization gates`;
         },
     },
+    // ── fintech (Plaid, banking integrations) ────────
+    {
+        archetype: "fintech",
+        score: (d) => {
+            let s = 0;
+            if (d.stack.includes("plaid"))
+                s += 10;
+            if (d.stack.includes("wise"))
+                s += 9;
+            if (d.stack.includes("dwolla"))
+                s += 9;
+            if (d.stack.includes("teller"))
+                s += 9;
+            if (d.stack.includes("fintech"))
+                s += 7;
+            if (d.readmeKeywords.includes("fintech"))
+                s += 2;
+            return s;
+        },
+        reason: (d) => {
+            const bits = [];
+            if (d.stack.includes("plaid"))
+                bits.push("Plaid");
+            if (d.stack.includes("wise"))
+                bits.push("Wise");
+            if (d.stack.includes("dwolla"))
+                bits.push("Dwolla");
+            if (d.stack.includes("teller"))
+                bits.push("Teller");
+            return `fintech integration: ${bits.join(", ")} — SOX, PCI, KYC/AML compliance gates`;
+        },
+    },
+    // ── healthcare (FHIR/HL7/PHI) ───────────────────
+    {
+        archetype: "healthcare",
+        score: (d) => {
+            let s = 0;
+            if (d.stack.includes("fhir"))
+                s += 7;
+            if (d.stack.includes("hl7"))
+                s += 6;
+            if (d.readmeKeywords.includes("healthcare"))
+                s += 3;
+            return s;
+        },
+        reason: (d) => {
+            const bits = [];
+            if (d.stack.includes("fhir"))
+                bits.push("FHIR");
+            if (d.stack.includes("hl7"))
+                bits.push("HL7");
+            return `healthcare data tooling: ${bits.join(", ")} — HIPAA/PHI handling gates required`;
+        },
+    },
+    // ── cli-tool (explicit CLI: bin field + cli entry) ─
+    {
+        archetype: "cli-tool",
+        score: (d) => {
+            let s = 0;
+            // Explicit cli marker from detect.ts (bin field present)
+            if (d.stack.includes("cli"))
+                s += 6;
+            if (d.codeStructure.hasCliEntry)
+                s += 2;
+            if (d.readmeKeywords.includes("cli"))
+                s += 1;
+            // Penalize if web framework present (CLI + web is rare)
+            const webFw = ["next.js", "express", "fastify", "nestjs", "django", "fastapi", "flask", "hono", "koa"];
+            if (webFw.some((w) => d.stack.includes(w)))
+                s = Math.max(0, s - 4);
+            return s;
+        },
+        reason: (_d) => "package.json bin field + CLI entry detected — argument-parsing, exit-code, --help gates",
+    },
     // ── mobile-app ───────────────────────────────────
     {
         archetype: "mobile-app",
@@ -183,8 +335,34 @@ const RULES = [
     // ── data-platform ────────────────────────────────
     {
         archetype: "data-platform",
-        score: (d) => (d.stack.includes("data-pipeline") ? 4 : 0),
-        reason: (_d) => "data pipeline tooling detected (pandas/airflow/prefect)",
+        score: (d) => {
+            let s = 0;
+            if (d.stack.includes("data-pipeline"))
+                s += 6;
+            if (d.stack.includes("dbt"))
+                s += 3;
+            if (d.stack.includes("dagster"))
+                s += 3;
+            if (d.stack.includes("polars"))
+                s += 2;
+            if (d.stack.includes("iceberg"))
+                s += 3;
+            if (d.stack.includes("duckdb"))
+                s += 2;
+            if (d.readmeKeywords.includes("data"))
+                s += 1;
+            return s;
+        },
+        reason: (d) => {
+            const bits = [];
+            if (d.stack.includes("data-pipeline"))
+                bits.push("pandas/airflow/prefect");
+            if (d.stack.includes("dbt"))
+                bits.push("dbt");
+            if (d.stack.includes("dagster"))
+                bits.push("dagster");
+            return `data pipeline tooling: ${bits.join(", ") || "detected"}`;
+        },
     },
     // ── infra ────────────────────────────────────────
     {
@@ -224,34 +402,70 @@ const RULES = [
         archetype: "web-service",
         score: (d) => {
             let s = 0;
-            const webFrameworks = [
-                "next.js", "react", "vue", "angular", "svelte", "astro",
-                "express", "fastify", "nestjs", "hono",
-                "django", "fastapi", "flask",
-            ];
-            for (const fw of webFrameworks)
+            const serverFrameworks = ["express", "fastify", "nestjs", "hono", "koa",
+                "django", "fastapi", "flask", "gin", "echo", "chi"];
+            const fullstackFw = ["next.js", "nuxt", "remix", "sveltekit", "astro"];
+            const uiOnly = ["react", "vue", "angular", "svelte"];
+            for (const fw of serverFrameworks)
+                if (d.stack.includes(fw))
+                    s += 3;
+            for (const fw of fullstackFw)
+                if (d.stack.includes(fw))
+                    s += 4;
+            // UI-only: weaker signal (could be a library)
+            for (const fw of uiOnly)
                 if (d.stack.includes(fw))
                     s += 1;
             if (s > 0)
-                s += 2; // baseline bonus for any web framework
+                s += 1; // baseline web bonus
+            // Code-structure boost
+            if (d.codeStructure.hasRoutesDir)
+                s += 2;
+            if (d.codeStructure.hasServerEntry)
+                s += 2;
+            if (d.scripts.hasStart || d.scripts.hasDev)
+                s += 1;
+            // Penalize if explicitly a library (publishConfig/cli)
+            if (d.stack.includes("library") && !d.codeStructure.hasRoutesDir && !d.codeStructure.hasServerEntry) {
+                s = Math.max(0, s - 3);
+            }
             return s;
         },
         reason: (d) => {
-            const fw = d.stack.find((t) => ["next.js", "react", "vue", "angular", "svelte", "astro", "express", "fastify", "nestjs", "hono", "django", "fastapi", "flask"].includes(t));
-            return `web framework detected: ${fw ?? "unknown"}`;
+            const fw = d.stack.find((t) => ["next.js", "express", "fastify", "nestjs", "hono", "koa",
+                "django", "fastapi", "flask", "gin", "echo"].includes(t));
+            const extras = [];
+            if (d.codeStructure.hasRoutesDir)
+                extras.push("routes/");
+            if (d.codeStructure.hasServerEntry)
+                extras.push("server entry");
+            return `web framework detected: ${fw ?? "unknown"}${extras.length ? " + " + extras.join(", ") : ""}`;
         },
     },
     // ── library (no app framework, just code) ────────
-    // Detection priority: explicit "library" or "cli" stack signal from detect.ts (high confidence)
-    // Fallback: plain runtime + no web/mobile/infra framework (low confidence)
+    // Strong signal: detect.ts marked "library" + no web/server structure
     {
         archetype: "library",
         score: (d) => {
-            // Strong signal: detect.ts found library indicators
-            if (d.stack.includes("library") || d.stack.includes("cli")) {
+            const isExplicitLib = d.stack.includes("library");
+            const isExplicitCli = d.stack.includes("cli");
+            // Don't claim library if web-service shape is obvious
+            const looksLikeWebService = d.codeStructure.hasRoutesDir || d.codeStructure.hasServerEntry;
+            if (looksLikeWebService)
+                return 0;
+            // Don't claim library if data-pipeline / ml signals dominate
+            if (d.stack.includes("data-pipeline") || d.stack.includes("ml"))
+                return 0;
+            // Don't claim library if a domain-specific archetype is clearly present
+            const domainSignals = ["plaid", "wise", "dwolla", "fhir", "hl7", "stripe", "shopify", "solidity",
+                "embedded", "unity", "unreal", "godot", "react-native", "expo"];
+            if (domainSignals.some((s) => d.stack.includes(s)))
+                return 0;
+            if (isExplicitLib && !isExplicitCli)
                 return 7;
-            }
-            // Weaker signal: no app framework detected
+            if (isExplicitLib && isExplicitCli)
+                return 4; // cli-tool rule will outscore
+            // Weaker signal: plain runtime + no app framework
             const hasApp = d.stack.some((t) => ["next.js", "django", "fastapi", "flask", "express", "fastify", "nestjs", "hono",
                 "react-native", "expo", "tauri", "capacitor", "flutter",
                 "terraform", "pulumi", "aws-cdk", "helm",
@@ -265,18 +479,35 @@ const RULES = [
             return 0;
         },
         reason: (d) => {
-            if (d.stack.includes("library") || d.stack.includes("cli")) {
-                return "package.json/pyproject/Cargo.toml indicates a publishable library or CLI";
+            if (d.stack.includes("library")) {
+                return "package.json/pyproject/Cargo.toml indicates a publishable library";
             }
             return "no web/mobile/infra framework detected — looks like a library/SDK";
         },
     },
 ];
+// Tie-break priority — when two rules score equally, prefer the one
+// higher in this list (more specific / domain-bound first).
+const TIE_BREAK_PRIORITY = [
+    "browser-extension", "iot-embedded", "web3", "game",
+    "agent-product", "fintech", "healthcare",
+    "commerce", "ai-system", "devtools",
+    "data-platform", "infra", "mobile-app",
+    "cli-tool", "web-service", "library", "regulated", "greenfield",
+];
+function priorityIndex(a) {
+    const i = TIE_BREAK_PRIORITY.indexOf(a);
+    return i < 0 ? TIE_BREAK_PRIORITY.length : i;
+}
 export function pickArchetype(d) {
     const scored = RULES
         .map((r) => ({ archetype: r.archetype, score: r.score(d), reason: r.reason(d) }))
         .filter((r) => r.score > 0)
-        .sort((a, b) => b.score - a.score);
+        .sort((a, b) => {
+        if (b.score !== a.score)
+            return b.score - a.score;
+        return priorityIndex(a.archetype) - priorityIndex(b.archetype);
+    });
     if (scored.length === 0) {
         return {
             primary: "greenfield",
@@ -288,30 +519,58 @@ export function pickArchetype(d) {
     const top = scored[0];
     const nextBest = scored[1]?.score ?? 0;
     const gap = top.score - nextBest;
-    const confidence = top.score >= 5 && gap >= 2 ? "high" :
-        top.score >= 3 ? "medium" : "low";
+    // Confidence: high when score≥6 and gap≥3; medium ≥4; else low
+    const confidence = top.score >= 6 && gap >= 3 ? "high" :
+        top.score >= 4 && gap >= 1 ? "medium" : "low";
+    // Dedupe alternatives, keep top 3
+    const seen = new Set([top.archetype]);
+    const alternatives = [];
+    for (const r of scored.slice(1)) {
+        if (!seen.has(r.archetype)) {
+            seen.add(r.archetype);
+            alternatives.push(r.archetype);
+            if (alternatives.length >= 3)
+                break;
+        }
+    }
     return {
         primary: top.archetype,
         confidence,
         rationale: top.reason,
-        alternatives: scored.slice(1, 4).map((r) => r.archetype),
+        alternatives,
     };
 }
-// Compliance hints — auto-suggested based on stack.
+// Compliance hints — auto-suggested based on stack and README.
 export function suggestCompliance(d, archetype) {
     const c = new Set();
+    // ── archetype defaults ───────────────────────────
     if (archetype === "commerce") {
         c.add("pci-dss");
         c.add("gdpr");
     }
-    if (archetype === "ai-system") {
+    if (archetype === "fintech") {
+        c.add("pci-dss");
+        c.add("sox");
+        c.add("kyc-aml");
+        c.add("gdpr");
+    }
+    if (archetype === "healthcare") {
+        c.add("hipaa");
+        c.add("gdpr");
+        c.add("hitech");
+    }
+    if (archetype === "ai-system" || archetype === "agent-product") {
         c.add("eu-ai-act");
+        // Add OWASP LLM only if it's truly an agent product
+        if (archetype === "agent-product")
+            c.add("owasp-llm-top-10");
     }
     if (archetype === "web3") {
         c.add("soc2");
     }
     if (archetype === "iot-embedded") {
         c.add("iso27001");
+        c.add("etsi-en-303-645");
     }
     if (archetype === "browser-extension") {
         c.add("csp");
@@ -329,10 +588,29 @@ export function suggestCompliance(d, archetype) {
         c.add("soc2-type-2");
         c.add("gdpr");
     }
-    if (d.stack.includes("stripe"))
-        c.add("pci-dss");
-    // Reasonable default for any web service storing user data
     if (archetype === "web-service")
-        c.add("gdpr");
+        c.add("gdpr"); // baseline for user data
+    if (archetype === "cli-tool") { /* CLI tools usually don't have compliance load */ }
+    // ── stack-derived (cross-archetype) ──────────────
+    if (d.stack.includes("stripe") || d.stack.includes("braintree") ||
+        d.stack.includes("adyen") || d.stack.includes("paddle")) {
+        c.add("pci-dss");
+    }
+    if (d.stack.includes("plaid") || d.stack.includes("dwolla") ||
+        d.stack.includes("teller") || d.stack.includes("wise")) {
+        c.add("kyc-aml");
+        c.add("sox");
+    }
+    if (d.stack.includes("fhir") || d.stack.includes("hl7")) {
+        c.add("hipaa");
+        c.add("hitech");
+    }
+    // ── README-derived ───────────────────────────────
+    if (d.readmeKeywords.includes("regulated"))
+        c.add("compliance-required");
+    if (d.readmeKeywords.includes("healthcare"))
+        c.add("hipaa");
+    if (d.readmeKeywords.includes("fintech"))
+        c.add("sox");
     return Array.from(c).sort();
 }

package/dist/bootstrap.js

@@ -25,7 +25,7 @@ export function bootstrap(dir, detection, archetype, compliance, detectionMeta)
 
 primary: ${archetype}
 archetype: ${archetype}
-project_size: medium
+project_size: ${detection.projectSize}
 stack: ${stackLine}
 languages: ${detection.languages.join(", ") || "to be defined"}
 package-manager: ${detection.packageManager ?? "none"}

package/dist/detect.js

@@ -73,7 +73,7 @@ export function detect(dir) {
                 stack.add("openai-sdk");
                 sig("ai", "openai");
             }
-            if (has("@anthropic-ai/sdk")) {
+            if (has("@anthropic-ai/sdk") || has("@anthropic-ai/claude-code")) {
                 stack.add("anthropic-sdk");
                 sig("ai", "anthropic-sdk");
             }
@@ -109,6 +109,39 @@ export function detect(dir) {
                 stack.add("vercel-ai-sdk");
                 sig("ai", "vercel-ai-sdk");
             }
+            // Vector databases (when paired with LLM SDK → agent-product)
+            if (has("@pinecone-database/pinecone")) {
+                stack.add("pinecone");
+                sig("vectordb", "pinecone");
+            }
+            if (has("weaviate-ts-client") || has("weaviate-client")) {
+                stack.add("weaviate");
+                sig("vectordb", "weaviate");
+            }
+            if (has("chromadb")) {
+                stack.add("chroma");
+                sig("vectordb", "chroma");
+            }
+            if (has("@qdrant/js-client-rest")) {
+                stack.add("qdrant");
+                sig("vectordb", "qdrant");
+            }
+            if (has("@google/generative-ai") || has("@google-ai/generativelanguage")) {
+                stack.add("google-ai");
+                sig("ai", "gemini");
+            }
+            if (has("@aws-sdk/client-bedrock-runtime")) {
+                stack.add("aws-bedrock");
+                sig("ai", "bedrock");
+            }
+            if (has("cohere-ai")) {
+                stack.add("cohere");
+                sig("ai", "cohere");
+            }
+            if (has("replicate")) {
+                stack.add("replicate");
+                sig("ai", "replicate");
+            }
             // Payments / commerce
             if (has("stripe") || has("@stripe/stripe-js")) {
                 stack.add("stripe");
@@ -138,6 +171,41 @@ export function detect(dir) {
                 stack.add("polar");
                 sig("commerce", "polar");
             }
+            // Fintech (banking, ACH, regulated payments)
+            if (has("plaid")) {
+                stack.add("plaid");
+                sig("fintech", "plaid");
+            }
+            if (has("@wise-api/api-client") || has("wise")) {
+                stack.add("wise");
+                sig("fintech", "wise");
+            }
+            if (has("dwolla-v2")) {
+                stack.add("dwolla");
+                sig("fintech", "dwolla");
+            }
+            if (has("@teller/teller")) {
+                stack.add("teller");
+                sig("fintech", "teller");
+            }
+            // Stripe Connect/Issuing → fintech (not just commerce)
+            if (has("stripe") && (pkg.name?.includes("bank") || pkg.name?.includes("card"))) {
+                sig("fintech", "stripe-connect");
+                stack.add("fintech");
+            }
+            // Healthcare / FHIR
+            if (has("fhir") || has("fhir.js") || has("@types/fhir")) {
+                stack.add("fhir");
+                sig("healthcare", "fhir");
+            }
+            if (has("@smile-cdr/fhirts")) {
+                stack.add("fhir");
+                sig("healthcare", "smile-cdr");
+            }
+            if (has("hl7")) {
+                stack.add("hl7");
+                sig("healthcare", "hl7");
+            }
             // Auth
             if (has("next-auth") || has("@auth/core"))
                 stack.add("auth");
@@ -190,17 +258,31 @@ export function detect(dir) {
             }
             // Library detection (npm package intended for distribution)
             // Signals: has "main" or "exports", NOT "private:true", NOT a typical app structure
+            // Negative signal: any backend framework dep → likely a server, not a library
+            const SERVER_FRAMEWORKS = ["express", "fastify", "nestjs", "@nestjs/core", "hono", "koa", "@hapi/hapi", "restify", "polka"];
+            const hasServerFramework = SERVER_FRAMEWORKS.some((f) => has(f));
+            const FULLSTACK_FRAMEWORKS = ["next", "nuxt", "@remix-run/node", "@sveltejs/kit", "astro", "gatsby"];
+            const hasFullstack = FULLSTACK_FRAMEWORKS.some((f) => has(f));
             const isPublishable = !pkg.private && (pkg.main || pkg.exports || pkg.module || pkg.type === "module");
             const hasAppStructure = existsSync(join(dir, "pages")) ||
                 existsSync(join(dir, "app")) ||
                 existsSync(join(dir, "src/pages")) ||
                 existsSync(join(dir, "src/app")) ||
-                existsSync(join(dir, "public/index.html"));
+                existsSync(join(dir, "public/index.html")) ||
+                existsSync(join(dir, "routes")) ||
+                existsSync(join(dir, "src/routes")) ||
+                existsSync(join(dir, "api"));
             const hasBin = !!pkg.bin;
-            if (isPublishable && !hasAppStructure) {
+            // Strong library signal: explicit publishConfig or files field listing dist
+            const hasExplicitLibConfig = !!pkg.publishConfig || (Array.isArray(pkg.files) && !hasServerFramework);
+            if (isPublishable && !hasAppStructure && !hasServerFramework && !hasFullstack) {
                 stack.add("library");
                 sig("library", "package.json");
             }
+            else if (hasExplicitLibConfig && !hasServerFramework && !hasFullstack) {
+                stack.add("library");
+                sig("library", "publishConfig");
+            }
             if (hasBin) {
                 stack.add("cli");
                 sig("library", "bin");
@@ -633,6 +715,63 @@ export function detect(dir) {
         existsSync(join(dir, "azure-pipelines.yml"));
     const hasExistingGreatCto = existsSync(join(dir, ".great_cto", "PROJECT.md")) ||
         existsSync(join(dir, ".great_cto", "SKILL.md"));
+    // ── Code-structure signals (Wave 1) ──────────────────────
+    const hasRoutesDir = existsSync(join(dir, "routes")) ||
+        existsSync(join(dir, "app")) ||
+        existsSync(join(dir, "pages")) ||
+        existsSync(join(dir, "src/api")) ||
+        existsSync(join(dir, "src/routes")) ||
+        existsSync(join(dir, "src/pages")) ||
+        existsSync(join(dir, "src/app")) ||
+        existsSync(join(dir, "api"));
+    const hasCliEntry = existsSync(join(dir, "bin")) ||
+        existsSync(join(dir, "src/cli.ts")) ||
+        existsSync(join(dir, "src/cli.js")) ||
+        existsSync(join(dir, "src/main.ts")) && pkg.bin != null ||
+        existsSync(join(dir, "cmd"));
+    const hasPublicHtml = existsSync(join(dir, "public/index.html")) ||
+        existsSync(join(dir, "index.html")) ||
+        existsSync(join(dir, "src/index.html"));
+    const hasServerEntry = existsSync(join(dir, "server.ts")) || existsSync(join(dir, "server.js")) ||
+        existsSync(join(dir, "server.mjs")) ||
+        existsSync(join(dir, "src/server.ts")) || existsSync(join(dir, "src/server.js")) ||
+        existsSync(join(dir, "app.ts")) || existsSync(join(dir, "app.js")) ||
+        existsSync(join(dir, "src/app.ts")) || existsSync(join(dir, "src/app.js"));
+    const hasMonorepo = existsSync(join(dir, "pnpm-workspace.yaml")) ||
+        existsSync(join(dir, "lerna.json")) ||
+        existsSync(join(dir, "nx.json")) ||
+        existsSync(join(dir, "turbo.json")) ||
+        existsSync(join(dir, "rush.json"));
+    if (hasMonorepo)
+        sig("monorepo", "workspace-config");
+    if (hasRoutesDir)
+        sig("structure", "routes-dir");
+    if (hasCliEntry)
+        sig("structure", "cli-entry");
+    if (hasServerEntry)
+        sig("structure", "server-entry");
+    // ── npm-scripts heuristics (Wave 1) ──────────────────────
+    const scripts = pkg.scripts || {};
+    const scriptHints = {
+        hasStart: !!scripts.start,
+        hasDev: !!scripts.dev,
+        hasBuild: !!scripts.build,
+        hasPublish: !!scripts.prepublishOnly || !!scripts.publish,
+    };
+    if (scriptHints.hasPublish && pkg.publishConfig?.access === "public") {
+        sig("library", "publishConfig");
+        stack.add("library");
+    }
+    // server-ish scripts AND server entry → web-service indicator
+    if ((scriptHints.hasStart || scriptHints.hasDev) && hasServerEntry) {
+        sig("structure", "web-service-shape");
+    }
+    // ── Project size estimate (Wave 3 lite) ──────────────────
+    const projectSize = estimateProjectSize(dir);
+    // ── README mining (Wave 2) ───────────────────────────────
+    const readmeKeywords = mineReadmeKeywords(dir);
+    for (const kw of readmeKeywords)
+        sig(`readme:${kw}`, "README");
     return {
         stack: Array.from(stack).sort(),
         languages: Array.from(languages).sort(),
@@ -641,9 +780,106 @@ export function detect(dir) {
         hasTests,
         hasCI,
         hasExistingGreatCto,
+        codeStructure: {
+            hasRoutesDir,
+            hasCliEntry,
+            hasPublicHtml,
+            hasServerEntry,
+            hasMonorepo,
+        },
+        scripts: scriptHints,
+        projectSize,
+        readmeKeywords,
     };
 }
 // ── helpers ──────────────────────────────────────────────────
+/**
+ * Estimate project size from file count (no LOC, to stay fast).
+ * Skips node_modules, .git, dist, build, .next, target, vendor.
+ */
+function estimateProjectSize(dir) {
+    const SKIP = new Set(["node_modules", ".git", "dist", "build", ".next", ".nuxt",
+        "target", "vendor", ".venv", "venv", "__pycache__", ".cache",
+        "coverage", ".turbo", ".vercel", ".wrangler"]);
+    const SOURCE_EXTS = /\.(ts|tsx|js|jsx|mjs|cjs|py|rs|go|java|kt|swift|rb|php|c|cpp|h|hpp|cs|sol|sql|css|scss|html|md)$/;
+    let count = 0;
+    const MAX = 5000; // hard cap to keep scan O(seconds)
+    function walk(d, depth) {
+        if (count > MAX || depth > 6)
+            return;
+        try {
+            const entries = readdirSync(d);
+            for (const e of entries) {
+                if (count > MAX)
+                    return;
+                if (e.startsWith(".") && depth === 0 && e !== ".github")
+                    continue;
+                if (SKIP.has(e))
+                    continue;
+                const p = join(d, e);
+                try {
+                    const st = statSync(p);
+                    if (st.isDirectory())
+                        walk(p, depth + 1);
+                    else if (st.isFile() && SOURCE_EXTS.test(e))
+                        count++;
+                }
+                catch { /* unreadable */ }
+            }
+        }
+        catch { /* unreadable */ }
+    }
+    walk(dir, 0);
+    if (count < 10)
+        return "nano";
+    if (count < 50)
+        return "small";
+    if (count < 250)
+        return "medium";
+    if (count < 1000)
+        return "large";
+    return "enterprise";
+}
+/**
+ * Extract a small set of categorical keywords from README.md.
+ * Used as a *hint* — not a primary signal.
+ */
+function mineReadmeKeywords(dir) {
+    const kws = new Set();
+    const path = ["README.md", "readme.md", "README.rst", "README"]
+        .map((f) => join(dir, f))
+        .find((p) => existsSync(p));
+    if (!path)
+        return [];
+    let text = "";
+    try {
+        text = readFileSync(path, "utf-8").slice(0, 4000).toLowerCase();
+    }
+    catch {
+        return [];
+    }
+    // Categorical hints — broad strokes, intentionally conservative
+    const buckets = {
+        "ai": ["llm", "gpt", "claude", "anthropic", "openai", "embedding", "rag", "agent ", "agentic"],
+        "agent": ["multi-agent", " agent ", "autonomous", "orchestrat"],
+        "commerce": ["payment", "checkout", "stripe", "subscription", "billing"],
+        "fintech": ["bank", "ach", "fintech", "account number", "ledger", "kyc", "aml"],
+        "healthcare": ["health", "patient", "medical", "fhir", "hipaa", "phi", "ehr"],
+        "web3": ["smart contract", "ethereum", "solidity", "defi", "nft", "wallet"],
+        "iot": ["embedded", "firmware", "iot ", "esp32", "esp8266", "arduino"],
+        "browser-extension": ["chrome extension", "browser extension", "manifest_version"],
+        "library": ["installation", "## install", "## usage", "publish", "npm install"],
+        "cli": ["command-line", "command line", "cli ", "$ npx ", "subcommand"],
+        "data": ["pipeline", "etl ", "warehouse", "dbt", "airflow", "dataset"],
+        "game": ["game ", "gameplay", "player", "level design"],
+        "regulated": ["pci", "hipaa", "soc2", "iso 27001", "gdpr", "compliance"],
+    };
+    for (const [bucket, terms] of Object.entries(buckets)) {
+        if (terms.some((t) => text.includes(t)))
+            kws.add(bucket);
+    }
+    return Array.from(kws).sort();
+}
 function safeGlob(dir, pattern, kind = "file") {
     try {
         const entries = readdirSync(dir);

package/dist/llm-fallback.js

@@ -0,0 +1,178 @@
+// LLM fallback for low-confidence archetype detection.
+//
+// When pickArchetype() returns confidence: "low", we optionally call
+// Anthropic Haiku with the README (first ~2KB) + dependency list and
+// ask for a structured archetype suggestion. Cost: ~$0.001 per call.
+//
+// Privacy:
+//   - Only sends: README first 2KB + dep names (no versions) + stack list.
+//   - Never sends: source code, paths, file names, env vars, repo name.
+//   - User opts in via:
+//       1. ANTHROPIC_API_KEY env var present (implicit), OR
+//       2. --use-llm CLI flag (explicit override even on high confidence)
+//   - Skipped when --no-llm flag, GREATCTO_NO_LLM=1, or no API key.
+//
+// Zero deps: uses native fetch (Node 18+). No @anthropic-ai/sdk import.
+import { existsSync, readFileSync } from "node:fs";
+import { join } from "node:path";
+const ANTHROPIC_API = "https://api.anthropic.com/v1/messages";
+const MODEL = "claude-haiku-4-5"; // cheap + fast; ~$1/M in, $5/M out
+const MAX_README_BYTES = 2048;
+const TIMEOUT_MS = 8000;
+const ALLOWED_ARCHETYPES = [
+    "web-service", "mobile-app", "ai-system", "agent-product",
+    "data-platform", "infra", "library", "cli-tool",
+    "commerce", "fintech", "healthcare", "web3",
+    "iot-embedded", "regulated", "devtools", "browser-extension", "game",
+];
+/**
+ * Whether LLM fallback is available and should be tried for this run.
+ * Returns false silently if no API key, opted out, or running offline.
+ */
+export function shouldUseLlmFallback(opts) {
+    if (opts.forceSkip)
+        return { use: false, reason: "--no-llm flag set" };
+    if (process.env.GREATCTO_NO_LLM === "1")
+        return { use: false, reason: "GREATCTO_NO_LLM=1" };
+    const apiKey = process.env.ANTHROPIC_API_KEY;
+    if (!apiKey)
+        return { use: false, reason: "no ANTHROPIC_API_KEY" };
+    if (opts.forceUse)
+        return { use: true, reason: "--use-llm flag" };
+    if (opts.heuristicConfidence === "low")
+        return { use: true, reason: "low heuristic confidence" };
+    return { use: false, reason: "heuristic confidence is high/medium" };
+}
+/**
+ * Build the prompt sent to the LLM. Kept as a pure function for testing.
+ */
+export function buildPrompt(opts) {
+    const archList = ALLOWED_ARCHETYPES.join(" | ");
+    const readme = opts.readme.slice(0, MAX_README_BYTES).trim() || "(no README)";
+    const stack = opts.stack.length ? opts.stack.join(", ") : "(no detected stack)";
+    const hints = opts.readmeKeywords.length ? opts.readmeKeywords.join(", ") : "(none)";
+    return `You are classifying a software project into one of these archetypes:
+${archList}
+
+DETECTED STACK: ${stack}
+README KEYWORDS: ${hints}
+
+README EXCERPT (first 2KB):
+"""
+${readme}
+"""
+
+Respond with ONLY a JSON object matching this schema (no prose, no markdown):
+{
+  "archetype": "<one value from the list above>",
+  "confidence": "<high|medium|low>",
+  "rationale": "<one sentence, ≤120 chars, explaining the choice>"
+}
+
+Rules:
+- Choose the most specific archetype. fintech beats commerce when banking/ACH is present.
+- agent-product = autonomous LLM agents (LangGraph/CrewAI/MCP), not just a wrapper around an LLM API.
+- ai-system = an app that calls an LLM but is not itself agentic.
+- cli-tool = primary distribution is a command-line binary.
+- library = published as a reusable package, no app shell.
+- If unsure between two, pick the more domain-specific one and use confidence: medium.`;
+}
+/**
+ * Validate the model response and coerce to LlmSuggestion shape.
+ * Returns null if the response is malformed or the archetype is invalid.
+ */
+export function parseLlmResponse(raw) {
+    // Strip code fences if model added them despite instructions
+    const cleaned = raw.trim()
+        .replace(/^```(?:json)?\s*/i, "")
+        .replace(/```\s*$/i, "")
+        .trim();
+    let obj;
+    try {
+        obj = JSON.parse(cleaned);
+    }
+    catch {
+        return null;
+    }
+    if (typeof obj !== "object" || obj === null)
+        return null;
+    const o = obj;
+    const arch = o.archetype;
+    const conf = o.confidence;
+    const rat = o.rationale;
+    if (typeof arch !== "string" || typeof conf !== "string" || typeof rat !== "string")
+        return null;
+    if (!ALLOWED_ARCHETYPES.includes(arch))
+        return null;
+    if (!["high", "medium", "low"].includes(conf))
+        return null;
+    return {
+        archetype: arch,
+        confidence: conf,
+        rationale: rat.slice(0, 200),
+    };
+}
+function readReadme(dir) {
+    const candidates = ["README.md", "readme.md", "README", "README.rst"];
+    for (const f of candidates) {
+        const p = join(dir, f);
+        if (existsSync(p)) {
+            try {
+                return readFileSync(p, "utf-8");
+            }
+            catch {
+                return "";
+            }
+        }
+    }
+    return "";
+}
+/**
+ * Best-effort LLM call. Returns null if anything fails (network, parse,
+ * timeout, rate limit). Never throws — caller is expected to fall back
+ * to the heuristic result silently.
+ */
+export async function suggestArchetypeFromLlm(opts) {
+    const readme = readReadme(opts.dir);
+    const prompt = buildPrompt({
+        readme,
+        stack: opts.detection.stack,
+        readmeKeywords: opts.detection.readmeKeywords,
+    });
+    const ctrl = new AbortController();
+    const timer = setTimeout(() => ctrl.abort(), TIMEOUT_MS);
+    try {
+        const res = await fetch(ANTHROPIC_API, {
+            method: "POST",
+            headers: {
+                "x-api-key": opts.apiKey,
+                "anthropic-version": "2023-06-01",
+                "content-type": "application/json",
+            },
+            body: JSON.stringify({
+                model: MODEL,
+                max_tokens: 256,
+                temperature: 0,
+                messages: [{ role: "user", content: prompt }],
+            }),
+            signal: ctrl.signal,
+        });
+        clearTimeout(timer);
+        if (!res.ok)
+            return null;
+        const body = (await res.json());
+        const text = body.content?.find((c) => c.type === "text")?.text;
+        if (!text)
+            return null;
+        const parsed = parseLlmResponse(text);
+        if (!parsed)
+            return null;
+        return {
+            ...parsed,
+            conflictsWithHeuristic: parsed.archetype !== opts.heuristicArchetype,
+        };
+    }
+    catch {
+        return null;
+    }
+}

package/dist/main.js

@@ -17,6 +17,7 @@ import { install, findInstalledVersions } from "./installer.js";
 import { enableGreatCto } from "./settings.js";
 import { bootstrap } from "./bootstrap.js";
 import { resolveTelemetryConsent, sendInstallPing } from "./telemetry.js";
+import { shouldUseLlmFallback, suggestArchetypeFromLlm } from "./llm-fallback.js";
 import { readFileSync } from "node:fs";
 import { dirname, join } from "node:path";
 import { fileURLToPath } from "node:url";
@@ -44,6 +45,8 @@ function parseArgs(argv) {
         archetype: null,
         version: null,
         noTelemetry: false,
+        useLlm: false,
+        noLlm: false,
     };
     const rest = [];
     for (let i = 0; i < argv.length; i++) {
@@ -68,6 +71,10 @@ function parseArgs(argv) {
             args.boardNoOpen = true;
         else if (a === "--no-telemetry")
             args.noTelemetry = true;
+        else if (a === "--use-llm")
+            args.useLlm = true;
+        else if (a === "--no-llm")
+            args.noLlm = true;
         else if (a === "board")
             args.command = "board";
         else if (a === "register")
@@ -191,11 +198,17 @@ ${bold("Options:")}
       --dry-run          Show what would be done without doing it
       --force            Reinstall even if already present
       --archetype NAME   Override detected archetype
-                         (${cyan("web-service|mobile-app|ai-system|agent-product|commerce|web3|")}
-                          ${cyan("data-platform|infra|library|iot-embedded|regulated|")}
-                          ${cyan("devtools|browser-extension|game")})
+                         (${cyan("web-service|mobile-app|ai-system|agent-product|commerce|fintech|")}
+                          ${cyan("healthcare|web3|data-platform|infra|library|cli-tool|")}
+                          ${cyan("iot-embedded|regulated|devtools|browser-extension|game")})
       --version-tag VER  Pin to specific great_cto version (default: latest)
       --dir PATH         Run against a different directory (default: cwd)
+      --use-llm          Force LLM (Anthropic Haiku) archetype suggestion
+                         even when heuristic confidence is high
+      --no-llm           Skip LLM suggestion (run heuristic only)
+                         Or set ${cyan("GREATCTO_NO_LLM=1")}
+      --no-telemetry     Skip anonymous install ping
+                         Or set ${cyan("GREATCTO_NO_TELEMETRY=1")}
   -h, --help             Show this help
   -v, --version          Show great-cto CLI version
 
@@ -254,6 +267,61 @@ async function runInit(args) {
         alternatives = pick.alternatives;
         confidence = pick.confidence;
     }
+    // ── 2b. LLM fallback for low-confidence detections (Wave 4) ──────
+    if (!args.archetype) {
+        const llmDecision = shouldUseLlmFallback({
+            heuristicConfidence: confidence,
+            forceUse: args.useLlm,
+            forceSkip: args.noLlm,
+        });
+        if (llmDecision.use) {
+            const apiKey = process.env.ANTHROPIC_API_KEY;
+            if (apiKey) {
+                log(`  ${dim("→ low confidence — asking Anthropic Haiku for second opinion...")}`);
+                const llm = await suggestArchetypeFromLlm({
+                    dir: args.dir,
+                    detection,
+                    heuristicArchetype: archetype,
+                    apiKey,
+                });
+                if (llm) {
+                    if (llm.conflictsWithHeuristic) {
+                        log("");
+                        log(`  ${bold("AI suggests:")} ${cyan(llm.archetype)} ${dim(`(${llm.confidence})`)}`);
+                        log(`  ${dim("AI rationale:")} ${llm.rationale}`);
+                        log(`  ${bold("Heuristic says:")} ${cyan(archetype)} ${dim(`(${confidence})`)}`);
+                        if (!args.yes) {
+                            const accept = await confirm(`Use AI suggestion ${cyan(llm.archetype)} instead of ${cyan(archetype)}?`, true);
+                            if (accept) {
+                                archetype = llm.archetype;
+                                rationale = `(AI) ${llm.rationale}`;
+                                confidence = llm.confidence;
+                                if (!alternatives.includes(archetype)) {
+                                    alternatives = [archetype, ...alternatives.filter((a) => a !== archetype)].slice(0, 3);
+                                }
+                            }
+                        }
+                        else {
+                            // --yes: silently take AI suggestion only if it bumps confidence
+                            if (llm.confidence !== "low") {
+                                archetype = llm.archetype;
+                                rationale = `(AI) ${llm.rationale}`;
+                                confidence = llm.confidence;
+                            }
+                        }
+                    }
+                    else if (llm.confidence !== "low") {
+                        // AI agrees → bump confidence, refine rationale
+                        confidence = llm.confidence;
+                        rationale = `${rationale} (AI confirmed: ${llm.rationale})`;
+                    }
+                }
+                else {
+                    log(`  ${dim("(LLM call failed, keeping heuristic)")}`);
+                }
+            }
+        }
+    }
     const compliance = suggestCompliance(detection, archetype);
     log(`  ${dim("archetype:")} ${cyan(archetype)} ${dim(`(confidence: ${confidence})`)}`);
     log(`  ${dim("rationale:")} ${rationale}`);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "great-cto",
-  "version": "1.0.166",
+  "version": "1.0.168",
   "description": "One command install for the great_cto Claude Code plugin. Auto-detects your stack, picks the right archetype, bootstraps PROJECT.md.",
   "keywords": [
     "claude-code",