great-cto 1.0.169 → 1.1.0

package/dist/archetypes.js

@@ -51,9 +51,9 @@ const RULES = [
             if (d.stack.includes("devtools-api"))
                 s += 7;
             if (d.stack.includes("openapi-spec"))
-                s += 4;
+                s += 8;
             if (d.stack.includes("graphql-schema"))
-                s += 3;
+                s += 6;
             if (d.stack.includes("multi-sdk"))
                 s += 4;
             if (d.stack.includes("stainless"))
@@ -183,25 +183,30 @@ const RULES = [
         score: (d) => {
             let s = 0;
             if (d.stack.includes("anthropic-sdk"))
-                s += 4;
+                s += 6;
             if (d.stack.includes("openai-sdk"))
-                s += 3;
+                s += 5;
             if (d.stack.includes("google-ai"))
-                s += 3;
+                s += 5;
             if (d.stack.includes("aws-bedrock"))
-                s += 3;
+                s += 5;
             if (d.stack.includes("cohere"))
-                s += 2;
+                s += 4;
             if (d.stack.includes("replicate"))
-                s += 2;
+                s += 4;
             if (d.stack.includes("langchain"))
-                s += 3;
+                s += 5;
             if (d.stack.includes("llamaindex"))
-                s += 3;
+                s += 5;
             if (d.stack.includes("vercel-ai-sdk"))
-                s += 3;
+                s += 5;
             if (d.stack.includes("ml"))
                 s += 2;
+            // Combo bonus: using multiple AI providers/frameworks together
+            const aiCount = ["anthropic-sdk", "openai-sdk", "google-ai", "aws-bedrock", "cohere", "replicate", "langchain", "llamaindex", "vercel-ai-sdk"]
+                .filter(x => d.stack.includes(x)).length;
+            if (aiCount >= 2)
+                s += 3;
             // Don't double-score if already an agent-product
             const agents = ["langgraph", "crewai", "autogen", "mastra", "mcp"];
             if (agents.some((a) => d.stack.includes(a)))
@@ -264,6 +269,241 @@ const RULES = [
             return `fintech integration: ${bits.join(", ")} — SOX, PCI, KYC/AML compliance gates`;
         },
     },
+    // ── marketplace (two-sided platform — Stripe Connect / KYC) ────
+    // Stronger than commerce when payouts to sellers + KYC providers detected
+    {
+        archetype: "marketplace",
+        score: (d) => {
+            let s = 0;
+            if (d.stack.includes("stripe-connect"))
+                s += 9;
+            if (d.stack.includes("adyen-marketpay"))
+                s += 9;
+            if (d.stack.includes("persona"))
+                s += 5;
+            if (d.stack.includes("onfido"))
+                s += 5;
+            if (d.stack.includes("sumsub"))
+                s += 5;
+            if (d.readmeKeywords.includes("marketplace") || d.readmeKeywords.includes("two-sided"))
+                s += 4;
+            if (d.readmeKeywords.includes("seller") && d.readmeKeywords.includes("buyer"))
+                s += 3;
+            // Don't score if pure single-merchant commerce
+            if (s > 0 && d.stack.includes("stripe") && !d.stack.includes("stripe-connect"))
+                s += 1;
+            return s;
+        },
+        reason: (d) => {
+            const bits = [];
+            if (d.stack.includes("stripe-connect"))
+                bits.push("Stripe Connect");
+            if (d.stack.includes("adyen-marketpay"))
+                bits.push("Adyen MarketPay");
+            if (d.stack.includes("persona") || d.stack.includes("onfido") || d.stack.includes("sumsub"))
+                bits.push("KYC vendor");
+            return `marketplace / two-sided platform (${bits.join(", ")}) — multi-party payouts + seller KYC + 1099-K + DSA`;
+        },
+    },
+    // ── enterprise-saas (B2B multi-tenant, SSO/SAML/SCIM, audit) ──
+    {
+        archetype: "enterprise-saas",
+        score: (d) => {
+            let s = 0;
+            if (d.stack.includes("workos"))
+                s += 8; // SSO/SCIM-as-a-service
+            if (d.stack.includes("auth0"))
+                s += 6;
+            if (d.stack.includes("okta"))
+                s += 6;
+            if (d.stack.includes("clerk"))
+                s += 4;
+            if (d.stack.includes("samlify"))
+                s += 6;
+            if (d.stack.includes("passport-saml"))
+                s += 6;
+            if (d.stack.includes("scim"))
+                s += 5;
+            if (d.readmeKeywords.includes("multi-tenant") || d.readmeKeywords.includes("multitenant"))
+                s += 4;
+            if (d.readmeKeywords.includes("enterprise") || d.readmeKeywords.includes("b2b"))
+                s += 3;
+            if (d.readmeKeywords.includes("sso") || d.readmeKeywords.includes("saml"))
+                s += 3;
+            // Stripe billing + multi-tenant signals = SaaS
+            if (s > 0 && d.stack.includes("stripe"))
+                s += 1;
+            return s;
+        },
+        reason: (d) => {
+            const bits = [];
+            if (d.stack.includes("workos"))
+                bits.push("WorkOS");
+            if (d.stack.includes("auth0"))
+                bits.push("Auth0");
+            if (d.stack.includes("okta"))
+                bits.push("Okta");
+            if (d.stack.includes("samlify") || d.stack.includes("passport-saml"))
+                bits.push("SAML lib");
+            if (d.stack.includes("scim"))
+                bits.push("SCIM");
+            return `enterprise B2B SaaS (${bits.join(", ")}) — multi-tenant isolation + SSO + audit log + SOC2 mandatory`;
+        },
+    },
+    // ── mlops (model training & lifecycle, distinct from inference) ─
+    {
+        archetype: "mlops",
+        score: (d) => {
+            let s = 0;
+            if (d.stack.includes("mlflow"))
+                s += 7;
+            if (d.stack.includes("wandb"))
+                s += 6;
+            if (d.stack.includes("dvc"))
+                s += 6;
+            if (d.stack.includes("kubeflow"))
+                s += 7;
+            if (d.stack.includes("bentoml"))
+                s += 5;
+            if (d.stack.includes("seldon"))
+                s += 5;
+            if (d.stack.includes("kserve"))
+                s += 5;
+            if (d.stack.includes("sagemaker"))
+                s += 5;
+            if (d.stack.includes("vertex-ai"))
+                s += 5;
+            if (d.stack.includes("ray"))
+                s += 4;
+            if (d.stack.includes("torch") || d.stack.includes("tensorflow"))
+                s += 2;
+            if (d.readmeKeywords.includes("training") && d.readmeKeywords.includes("model"))
+                s += 3;
+            // De-prioritize if pure inference (LLM API only)
+            if (s > 0 && d.stack.includes("anthropic-sdk") && !d.stack.includes("torch") && !d.stack.includes("mlflow"))
+                s -= 2;
+            return s;
+        },
+        reason: (d) => {
+            const bits = [];
+            if (d.stack.includes("mlflow"))
+                bits.push("MLflow");
+            if (d.stack.includes("wandb"))
+                bits.push("W&B");
+            if (d.stack.includes("dvc"))
+                bits.push("DVC");
+            if (d.stack.includes("kubeflow"))
+                bits.push("Kubeflow");
+            if (d.stack.includes("bentoml"))
+                bits.push("BentoML");
+            if (d.stack.includes("torch"))
+                bits.push("PyTorch");
+            if (d.stack.includes("tensorflow"))
+                bits.push("TensorFlow");
+            return `MLOps stack detected (${bits.join(", ")}) — dataset versioning + drift detection + model registry + EU AI Act high-risk gates`;
+        },
+    },
+    // ── streaming (event-driven / Kafka / Flink — distinct from batch data-platform) ─
+    {
+        archetype: "streaming",
+        score: (d) => {
+            let s = 0;
+            if (d.stack.includes("kafkajs"))
+                s += 7;
+            if (d.stack.includes("kafka-node"))
+                s += 6;
+            if (d.stack.includes("rdkafka"))
+                s += 7;
+            if (d.stack.includes("kinesis"))
+                s += 6;
+            if (d.stack.includes("pulsar"))
+                s += 6;
+            if (d.stack.includes("flink"))
+                s += 7;
+            if (d.stack.includes("beam"))
+                s += 6;
+            if (d.stack.includes("debezium"))
+                s += 7;
+            if (d.stack.includes("nats"))
+                s += 5;
+            if (d.stack.includes("rabbitmq"))
+                s += 4;
+            if (d.readmeKeywords.includes("streaming") || d.readmeKeywords.includes("event-driven"))
+                s += 2;
+            if (d.readmeKeywords.includes("cdc") || d.readmeKeywords.includes("real-time"))
+                s += 2;
+            return s;
+        },
+        reason: (d) => {
+            const bits = [];
+            if (d.stack.includes("kafkajs") || d.stack.includes("rdkafka") || d.stack.includes("kafka-node"))
+                bits.push("Kafka");
+            if (d.stack.includes("kinesis"))
+                bits.push("Kinesis");
+            if (d.stack.includes("pulsar"))
+                bits.push("Pulsar");
+            if (d.stack.includes("flink"))
+                bits.push("Flink");
+            if (d.stack.includes("beam"))
+                bits.push("Beam");
+            if (d.stack.includes("debezium"))
+                bits.push("Debezium CDC");
+            return `streaming / event-driven stack (${bits.join(", ")}) — exactly-once + backpressure + DLQ + schema evolution gates`;
+        },
+    },
+    // ── cms / content platform (headless CMS, publishing, SEO) ────
+    {
+        archetype: "cms",
+        score: (d) => {
+            let s = 0;
+            if (d.stack.includes("sanity"))
+                s += 9;
+            if (d.stack.includes("contentful"))
+                s += 9;
+            if (d.stack.includes("strapi"))
+                s += 9;
+            if (d.stack.includes("payload"))
+                s += 8;
+            if (d.stack.includes("ghost"))
+                s += 8;
+            if (d.stack.includes("gatsby"))
+                s += 5;
+            if (d.stack.includes("eleventy"))
+                s += 5;
+            if (d.stack.includes("hugo"))
+                s += 5;
+            if (d.stack.includes("astro") && d.readmeKeywords.includes("blog"))
+                s += 4;
+            if (d.stack.includes("next.js") && d.readmeKeywords.includes("blog"))
+                s += 3;
+            if (d.readmeKeywords.includes("cms") || d.readmeKeywords.includes("publishing") || d.readmeKeywords.includes("blog"))
+                s += 2;
+            // De-prioritize if it's clearly an enterprise SaaS app
+            if (s > 0 && (d.stack.includes("workos") || d.stack.includes("samlify")))
+                s -= 3;
+            return s;
+        },
+        reason: (d) => {
+            const bits = [];
+            if (d.stack.includes("sanity"))
+                bits.push("Sanity");
+            if (d.stack.includes("contentful"))
+                bits.push("Contentful");
+            if (d.stack.includes("strapi"))
+                bits.push("Strapi");
+            if (d.stack.includes("payload"))
+                bits.push("Payload");
+            if (d.stack.includes("ghost"))
+                bits.push("Ghost");
+            if (d.stack.includes("gatsby"))
+                bits.push("Gatsby");
+            if (d.stack.includes("eleventy"))
+                bits.push("Eleventy");
+            if (d.stack.includes("hugo"))
+                bits.push("Hugo");
+            return `CMS / publishing stack (${bits.join(", ")}) — schema.org + Core Web Vitals + DMCA + UGC moderation gates`;
+        },
+    },
     // ── healthcare (FHIR/HL7/PHI) ───────────────────
     {
         archetype: "healthcare",
@@ -286,6 +526,72 @@ const RULES = [
             return `healthcare data tooling: ${bits.join(", ")} — HIPAA/PHI handling gates required`;
         },
     },
+    // ── regulated (compliance-first: DORA/NIS2/SOX/FedRAMP — not fintech/healthcare) ──
+    {
+        archetype: "regulated",
+        score: (d) => {
+            let s = 0;
+            // Compliance automation SaaS installed → near-certain regulated industry
+            if (d.stack.includes("compliance-automation"))
+                s += 10;
+            // Compliance documentation structure
+            if (d.stack.includes("compliance-docs"))
+                s += 7;
+            // Audit log package
+            if (d.stack.includes("audit-log"))
+                s += 5;
+            // README regulatory signals
+            const kws = d.readmeKeywords;
+            if (kws.includes("regulated"))
+                s += 5;
+            // FedRAMP / FISMA / CMMC → US federal regulated
+            const fedSignals = ["fedramp", "fisma", "cmmc"];
+            if (fedSignals.some((k) => kws.includes(k)))
+                s += 8;
+            // DORA ICT / NIS2 → EU regulated
+            if (kws.includes("dora ict") || kws.includes("nis2"))
+                s += 6;
+            // SOX compliance (non-fintech context)
+            if (kws.includes("sox compliance") || kws.includes("sarbanes")) {
+                if (!d.stack.includes("plaid") && !d.stack.includes("fintech"))
+                    s += 5;
+            }
+            // Generic compliance/audit signals without stronger domain archetype
+            if (kws.includes("compliance automation") || kws.includes("audit trail"))
+                s += 4;
+            if (kws.includes("iso 27001") || kws.includes("soc 2 type"))
+                s += 3;
+            // Hard exclude: fintech and healthcare have their own dedicated archetypes
+            if (d.stack.includes("plaid") || d.stack.includes("wise") || d.stack.includes("fhir"))
+                s = 0;
+            return s;
+        },
+        reason: (d) => {
+            const bits = [];
+            if (d.stack.includes("compliance-automation"))
+                bits.push("compliance automation (Vanta/Drata/Secureframe)");
+            if (d.stack.includes("compliance-docs"))
+                bits.push("ISMS/risk-register/compliance docs");
+            if (d.stack.includes("audit-log"))
+                bits.push("audit log package");
+            const kws = d.readmeKeywords;
+            if (kws.includes("regulated"))
+                bits.push("regulated-industry README");
+            if (kws.includes("fedramp"))
+                bits.push("FedRAMP");
+            if (kws.includes("fisma"))
+                bits.push("FISMA");
+            if (kws.includes("cmmc"))
+                bits.push("CMMC");
+            if (kws.includes("dora ict"))
+                bits.push("DORA ICT");
+            if (kws.includes("nis2"))
+                bits.push("NIS2");
+            if (kws.includes("sox compliance") || kws.includes("sarbanes"))
+                bits.push("SOX");
+            return `regulated-industry signals (${bits.join(", ")}) — DORA/NIS2/SOX/FedRAMP compliance gates required`;
+        },
+    },
     // ── cli-tool (explicit CLI: bin field + cli entry) ─
     {
         archetype: "cli-tool",
@@ -294,6 +600,9 @@ const RULES = [
             // Explicit cli marker from detect.ts (bin field present)
             if (d.stack.includes("cli"))
                 s += 6;
+            // Python CLI via [project.scripts] / console_scripts entry
+            if (d.stack.includes("python-cli"))
+                s += 7;
             if (d.codeStructure.hasCliEntry)
                 s += 2;
             if (d.readmeKeywords.includes("cli"))
@@ -490,10 +799,11 @@ const RULES = [
 // higher in this list (more specific / domain-bound first).
 const TIE_BREAK_PRIORITY = [
     "browser-extension", "iot-embedded", "web3", "game",
-    "agent-product", "fintech", "healthcare",
-    "commerce", "ai-system", "devtools",
-    "data-platform", "infra", "mobile-app",
-    "cli-tool", "web-service", "library", "regulated", "greenfield",
+    "agent-product", "fintech", "healthcare", "marketplace",
+    "mlops", "streaming",
+    "commerce", "enterprise-saas", "ai-system", "devtools",
+    "data-platform", "cms", "infra", "mobile-app",
+    "regulated", "cli-tool", "web-service", "library", "greenfield",
 ];
 function priorityIndex(a) {
     const i = TIE_BREAK_PRIORITY.indexOf(a);
@@ -588,9 +898,52 @@ export function suggestCompliance(d, archetype) {
         c.add("soc2-type-2");
         c.add("gdpr");
     }
+    if (archetype === "regulated") {
+        c.add("iso27001");
+        c.add("gdpr");
+        c.add("compliance-required");
+        // FedRAMP/CMMC if US federal signals present
+        const kws = d.readmeKeywords;
+        if (kws.includes("fedramp") || kws.includes("fisma") || kws.includes("cmmc"))
+            c.add("fedramp");
+        if (kws.includes("dora ict") || kws.includes("nis2")) {
+            c.add("dora-ict");
+            c.add("nis2");
+        }
+        if (kws.includes("sox compliance") || kws.includes("sarbanes"))
+            c.add("sox");
+    }
     if (archetype === "web-service")
         c.add("gdpr"); // baseline for user data
     if (archetype === "cli-tool") { /* CLI tools usually don't have compliance load */ }
+    if (archetype === "marketplace") {
+        c.add("pci-dss");
+        c.add("kyc-aml");
+        c.add("gdpr");
+        c.add("dsa-eu");
+        c.add("p2b-eu");
+        c.add("1099-k");
+    }
+    if (archetype === "enterprise-saas") {
+        c.add("soc2-type-2");
+        c.add("iso27001");
+        c.add("gdpr");
+        c.add("ccpa");
+    }
+    if (archetype === "mlops") {
+        c.add("eu-ai-act");
+        c.add("nist-ai-rmf");
+        c.add("iso42001");
+    }
+    if (archetype === "streaming") {
+        c.add("gdpr"); // event retention rules
+    }
+    if (archetype === "cms") {
+        c.add("dmca");
+        c.add("wcag-2.2");
+        c.add("gdpr");
+        c.add("dsa-eu");
+    }
     // ── stack-derived (cross-archetype) ──────────────
     if (d.stack.includes("stripe") || d.stack.includes("braintree") ||
         d.stack.includes("adyen") || d.stack.includes("paddle")) {

package/dist/detect.js

@@ -219,6 +219,89 @@ export function detect(dir) {
             if (has("@workos-inc/node")) {
                 stack.add("workos");
             }
+            if (has("auth0") || has("@auth0/nextjs-auth0") || has("@auth0/auth0-react"))
+                stack.add("auth0");
+            if (has("@okta/okta-auth-js") || has("@okta/oidc-middleware"))
+                stack.add("okta");
+            if (has("samlify"))
+                stack.add("samlify");
+            if (has("passport-saml") || has("@node-saml/passport-saml"))
+                stack.add("passport-saml");
+            if (has("@scim2/core") || has("scim2") || has("scim-patch"))
+                stack.add("scim");
+            // Compliance automation (regulated industry — vanta/drata/secureframe are decisive signals)
+            if (has("vanta") || has("@vanta/agent")) {
+                stack.add("compliance-automation");
+                sig("regulated", "vanta");
+            }
+            if (has("drata-cli") || has("@drata/sdk")) {
+                stack.add("compliance-automation");
+                sig("regulated", "drata");
+            }
+            if (has("secureframe") || has("@secureframe/node")) {
+                stack.add("compliance-automation");
+                sig("regulated", "secureframe");
+            }
+            if (has("tugboat-logic")) {
+                stack.add("compliance-automation");
+                sig("regulated", "tugboat-logic");
+            }
+            // Audit log packages
+            if (has("audit-log") || has("node-audit-logger") || has("winston-audit")) {
+                stack.add("audit-log");
+                sig("regulated", "audit-log");
+            }
+            // Marketplace / KYC providers
+            if (has("@stripe/connect-iframe-loader") || (has("stripe") && (pkg.name?.includes("market") || pkg.name?.includes("connect")))) {
+                stack.add("stripe-connect");
+                sig("marketplace", "stripe-connect");
+            }
+            if (has("@adyen/marketpay"))
+                stack.add("adyen-marketpay");
+            if (has("persona-react") || has("persona-sdk"))
+                stack.add("persona");
+            if (has("@onfido/api") || has("onfido-sdk-ui"))
+                stack.add("onfido");
+            if (has("@sumsub/websdk-react"))
+                stack.add("sumsub");
+            // CMS / publishing
+            if (has("@sanity/client") || has("next-sanity") || has("sanity"))
+                stack.add("sanity");
+            if (has("contentful") || has("@contentful/rich-text-react-renderer"))
+                stack.add("contentful");
+            if (has("strapi") || has("@strapi/strapi"))
+                stack.add("strapi");
+            if (has("payload") || has("@payloadcms/payload"))
+                stack.add("payload");
+            if (has("@tryghost/content-api") || has("ghost"))
+                stack.add("ghost");
+            if (has("gatsby"))
+                stack.add("gatsby");
+            if (has("@11ty/eleventy"))
+                stack.add("eleventy");
+            // Streaming / messaging
+            if (has("kafkajs") || has("@confluentinc/kafka-javascript"))
+                stack.add("kafkajs");
+            if (has("kafka-node"))
+                stack.add("kafka-node");
+            if (has("node-rdkafka"))
+                stack.add("rdkafka");
+            if (has("@aws-sdk/client-kinesis"))
+                stack.add("kinesis");
+            if (has("pulsar-client"))
+                stack.add("pulsar");
+            if (has("apache-flink-statefun"))
+                stack.add("flink");
+            if (has("@google-cloud/dataflow"))
+                stack.add("beam");
+            if (has("debezium"))
+                stack.add("debezium");
+            if (has("nats") || has("nats.ws"))
+                stack.add("nats");
+            if (has("amqplib") || has("amqp-connection-manager"))
+                stack.add("rabbitmq");
+            // MLOps (Python deps detected via pyproject.toml; here we cover Node bridges + Python signal flag)
+            // Most MLOps stacks are Python — detected through pyproject.toml block separately.
             // Databases / ORMs
             if (has("prisma") || has("@prisma/client"))
                 stack.add("prisma");
@@ -358,6 +441,68 @@ export function detect(dir) {
                 stack.add("ml");
                 sig("ml", "python");
             }
+            // MLOps lifecycle (training / registry / serving)
+            if (ihas("mlflow")) {
+                stack.add("mlflow");
+                sig("mlops", "mlflow");
+            }
+            if (ihas("wandb")) {
+                stack.add("wandb");
+                sig("mlops", "wandb");
+            }
+            if (ihas("dvc")) {
+                stack.add("dvc");
+                sig("mlops", "dvc");
+            }
+            if (ihas("kubeflow") || ihas("kfp")) {
+                stack.add("kubeflow");
+                sig("mlops", "kubeflow");
+            }
+            if (ihas("bentoml")) {
+                stack.add("bentoml");
+                sig("mlops", "bentoml");
+            }
+            if (ihas("seldon-core")) {
+                stack.add("seldon");
+                sig("mlops", "seldon");
+            }
+            if (ihas("kserve")) {
+                stack.add("kserve");
+                sig("mlops", "kserve");
+            }
+            if (ihas("sagemaker")) {
+                stack.add("sagemaker");
+                sig("mlops", "sagemaker");
+            }
+            if (ihas("google-cloud-aiplatform") || ihas("vertex")) {
+                stack.add("vertex-ai");
+                sig("mlops", "vertex");
+            }
+            if (ihas("ray[")) {
+                stack.add("ray");
+                sig("mlops", "ray");
+            }
+            // Streaming (Python)
+            if (ihas("confluent-kafka") || ihas("kafka-python")) {
+                stack.add("kafkajs");
+                sig("streaming", "kafka-py");
+            }
+            if (ihas("pyflink") || ihas("apache-flink")) {
+                stack.add("flink");
+                sig("streaming", "flink-py");
+            }
+            if (ihas("apache-beam")) {
+                stack.add("beam");
+                sig("streaming", "beam-py");
+            }
+            if (ihas("nats-py")) {
+                stack.add("nats");
+                sig("streaming", "nats-py");
+            }
+            if (ihas("debezium")) {
+                stack.add("debezium");
+                sig("streaming", "debezium");
+            }
             if (ihas("opencv") || ihas("ultralytics") || ihas("detectron2")) {
                 stack.add("computer-vision");
                 sig("ai", "computer-vision");
@@ -394,7 +539,15 @@ export function detect(dir) {
                 existsSync(join(dir, "main.py")) ||
                 existsSync(join(dir, "app.py")) ||
                 existsSync(join(dir, "wsgi.py"));
-            if (isPyLib && !hasPyApp) {
+            // Python CLI signal: pyproject [project.scripts] OR setup.py with entry_points={'console_scripts'}
+            const hasPyCliEntry = pyproject.includes("[project.scripts]") ||
+                pyproject.includes("[tool.poetry.scripts]") ||
+                (existsSync(join(dir, "setup.py")) && readFileSync(join(dir, "setup.py"), "utf-8").includes("console_scripts"));
+            if (hasPyCliEntry) {
+                stack.add("python-cli");
+                sig("cli", "python-script");
+            }
+            if (isPyLib && !hasPyApp && !hasPyCliEntry) {
                 stack.add("library");
                 sig("library", "python");
             }
@@ -768,6 +921,15 @@ export function detect(dir) {
     }
     // ── Project size estimate (Wave 3 lite) ──────────────────
     const projectSize = estimateProjectSize(dir);
+    // ── Compliance / regulated-industry docs (Wave 2 supplement) ──
+    const complianceFiles = ["ISMS.md", "isms.md", "risk-register.md", "DORA.md", "NIS2.md",
+        "bcp.md", "BCP.md", "control-matrix.md", "security-policy.md"];
+    if (complianceFiles.some((f) => existsSync(join(dir, f))) ||
+        existsSync(join(dir, "compliance")) ||
+        existsSync(join(dir, "controls"))) {
+        stack.add("compliance-docs");
+        sig("regulated", "compliance-docs");
+    }
     // ── README mining (Wave 2) ───────────────────────────────
     const readmeKeywords = mineReadmeKeywords(dir);
     for (const kw of readmeKeywords)
@@ -872,7 +1034,10 @@ function mineReadmeKeywords(dir) {
         "cli": ["command-line", "command line", "cli ", "$ npx ", "subcommand"],
         "data": ["pipeline", "etl ", "warehouse", "dbt", "airflow", "dataset"],
         "game": ["game ", "gameplay", "player", "level design"],
-        "regulated": ["pci", "hipaa", "soc2", "iso 27001", "gdpr", "compliance"],
+        "regulated": ["dora ict", "nis2", "fedramp", "fisma", "cmmc", "sox compliance",
+            "sarbanes", "regulated entity", "regulated industry",
+            "compliance automation", "audit trail", "iso 27001",
+            "pci compliance", "soc 2 type", "compliance officer"],
     };
     for (const [bucket, terms] of Object.entries(buckets)) {
         if (terms.some((t) => text.includes(t)))

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "great-cto",
-  "version": "1.0.169",
+  "version": "1.1.0",
   "description": "One command install for the great_cto Claude Code plugin. Auto-detects your stack, picks the right archetype, bootstraps PROJECT.md.",
   "keywords": [
     "claude-code",
@@ -43,14 +43,26 @@
     "startup-tools",
     "solo-founder"
   ],
-  "homepage": "https://github.com/avelikiy/great_cto",
+  "homepage": "https://greatcto.systems",
   "license": "MIT",
-  "author": "avelikiy",
+  "author": {
+    "name": "Alexander Velikiy",
+    "url": "https://hashnode.com/@Greatcto"
+  },
   "repository": {
     "type": "git",
     "url": "git+https://github.com/avelikiy/great_cto.git",
     "directory": "packages/cli"
   },
+  "bugs": {
+    "url": "https://github.com/avelikiy/great_cto/issues"
+  },
+  "funding": [
+    {
+      "type": "github",
+      "url": "https://github.com/sponsors/avelikiy"
+    }
+  ],
   "bin": {
     "great-cto": "index.mjs"
   },
@@ -63,6 +75,7 @@
   "scripts": {
     "build": "tsc",
     "test": "npm run build && node --test tests/*.test.mjs",
+    "test:e2e": "npm run build && node ../../tests/run-archetype-e2e.mjs",
     "prepublishOnly": "npm run build"
   },
   "devDependencies": {