great-cto 2.19.0 → 2.20.0

package/dist/archetypes.js

@@ -1068,13 +1068,52 @@ export function pickArchetype(d) {
                 break;
         }
     }
+    // ── Pack hints for low/medium confidence or niche stacks ────────────────
+    // Surfaces domain-specific packs that the archetype alone doesn't capture.
+    const suggestedPacks = confidence !== "high"
+        ? inferPackHints(d)
+        : inferPackHints(d).filter((p) => isNichePack(p)); // always surface niche packs
     return {
         primary: top.archetype,
         confidence,
         rationale: top.reason,
         alternatives,
+        ...(suggestedPacks.length > 0 ? { suggestedPacks } : {}),
     };
 }
+/** Niche packs that should surface even at high confidence */
+function isNichePack(pack) {
+    return ["robotics-pack", "climate-pack", "drug-discovery-pack",
+        "clinical-trials-pack", "em-fintech-pack"].includes(pack);
+}
+/**
+ * Infer likely domain packs from README/infra keywords when the archetype
+ * scorer doesn't have a dedicated high-confidence rule for the domain.
+ */
+function inferPackHints(d) {
+    const hints = [];
+    const kws = new Set([...d.readmeKeywords, ...(d.infraKeywords ?? [])]);
+    const has = (...terms) => terms.some((t) => kws.has(t));
+    if (has("robot", "ros2", "ros 2", "cobot", "drone", "uav"))
+        hints.push("robotics-pack");
+    if (has("carbon", "ghg", "mrv", "emission", "verra", "sbti"))
+        hints.push("climate-pack");
+    if (has("clinical", "ctms", "edc", "cdisc", "randomization", "irb"))
+        hints.push("clinical-trials-pack");
+    if (has("drug discovery", "binding affinity", "admet", "chembl", "alphafold"))
+        hints.push("drug-discovery-pack");
+    if (has("recruit", "hiring", "candidate", "ats", "aedt"))
+        hints.push("hr-ai-pack");
+    if (has("loan", "lending", "bnpl", "underwrit", "fcra"))
+        hints.push("lending-pack");
+    if (has("voice", "telephony", "ivr", "stt", "tts", "outbound call"))
+        hints.push("voice-pack");
+    if (has("india", "upi", "rbi", "mpesa", "gcash", "pix", "cross-border", "remittance"))
+        hints.push("em-fintech-pack");
+    if (has("public api", "api key", "developer portal", "openapi"))
+        hints.push("api-platform-pack");
+    return hints;
+}
 // Compliance hints — auto-suggested based on stack and README.
 export function suggestCompliance(d, archetype) {
     const c = new Set();

package/dist/detect.js

@@ -1004,6 +1004,10 @@ export function detect(dir) {
     const readmeKeywords = mineReadmeKeywords(dir);
     for (const kw of readmeKeywords)
         sig(`readme:${kw}`, "README");
+    // ── Infra signals (Wave 2b) — terraform/env/docker/homepage ──
+    const infraKeywords = mineInfraKeywords(dir, pkg);
+    for (const kw of infraKeywords)
+        sig(`infra:${kw}`, "infra");
     return {
         stack: Array.from(stack).sort(),
         languages: Array.from(languages).sort(),
@@ -1022,6 +1026,7 @@ export function detect(dir) {
         scripts: scriptHints,
         projectSize,
         readmeKeywords,
+        infraKeywords,
     };
 }
 // ── helpers ──────────────────────────────────────────────────
@@ -1208,6 +1213,25 @@ function mineReadmeKeywords(dir) {
         "pdpa", "pdpc", "singapore users", "singaporean users",
         "mas guidelines", "mas tpm", "singpass", "myinfo",
         "singapore data residency",
+        // CA
+        "pipeda", "quebec law 25", "bill 64", "opc canada", "casl",
+        "canadian users", "canada users", "canadian customers", "canadian residents",
+        "osfi", "fintrac", "ca-central", "ca-west", "canada-central",
+        // JP
+        "appi", "personal information protection commission", "ppc japan",
+        "japan users", "japanese users", "japan customers",
+        "fsa japan", "jfsa", "fisc",
+        "ap-northeast-1", "ap-northeast-3", "japan east", "japan west",
+        // CN
+        "pipl", "personal information protection law", "data security law",
+        "mlps", "classified protection", "cyberspace administration",
+        "china users", "chinese users", "mainland china",
+        "pboc", "cn-north", "cn-east", "cn-south", "china-east", "china-north",
+        // KR
+        "pipa korea", "pipa", "personal information protection act korea",
+        "pipc", "isms-p", "kisa", "k-isms",
+        "korea users", "korean users", "south korea users",
+        "fsc korea", "ap-northeast-2", "korea central", "korea south",
     ];
     for (const term of jurisdictionTerms) {
         if (text.includes(term))
@@ -1215,6 +1239,148 @@ function mineReadmeKeywords(dir) {
     }
     return Array.from(kws).sort();
 }
+/**
+ * Mine infra-level jurisdiction signals that README often omits:
+ * - Terraform/Pulumi/CDK region strings (eu-west-1, ap-northeast-2, …)
+ * - .env.example / .env.sample / .env.test AWS_REGION / AZURE_LOCATION / GCP_REGION
+ * - docker-compose.yml TZ= environment variables
+ * - package.json homepage TLD (.de, .fr, .jp, .cn, .kr, .ca, …)
+ *
+ * Returns a flat list of canonical keyword strings that jurisdiction.ts can match.
+ */
+function mineInfraKeywords(dir, pkg) {
+    const kws = new Set();
+    // ── 1. package.json homepage TLD → jurisdiction keyword ──────────────────
+    const homepageTldMap = {
+        ".de": "german users", ".at": "austrian", ".fr": "french users",
+        ".nl": "dutch users", ".es": "spanish users", ".it": "italian users",
+        ".pl": "polish users", ".eu": "eu users",
+        ".co.uk": "uk users", ".uk": "uk users",
+        ".ca": "canadian users",
+        ".jp": "japan users",
+        ".cn": "china users",
+        ".kr": "korea users",
+        ".com.br": "brazil users", ".br": "brazil users",
+        ".com.au": "australia users", ".au": "australia users",
+        ".sg": "singapore users",
+        ".in": "india users",
+    };
+    const homepage = (pkg?.homepage ?? "").toLowerCase();
+    if (homepage) {
+        for (const [tld, kw] of Object.entries(homepageTldMap)) {
+            if (homepage.includes(tld))
+                kws.add(kw);
+        }
+    }
+    // ── 2. .env / docker-compose TZ= → jurisdiction ──────────────────────────
+    const tzRegionMap = [
+        [/tz=europe\//i, "eu users"],
+        [/tz=america\/toronto|tz=canada/i, "canadian users"],
+        [/tz=asia\/tokyo/i, "japan users"],
+        [/tz=asia\/shanghai|tz=asia\/beijing|tz=prc|tz=asia\/hong_kong/i, "china users"],
+        [/tz=asia\/seoul/i, "korea users"],
+        [/tz=asia\/kolkata|tz=asia\/calcutta/i, "india users"],
+        [/tz=america\/sao_paulo/i, "brazil users"],
+        [/tz=australia\//i, "australia users"],
+        [/tz=asia\/singapore/i, "singapore users"],
+        [/tz=europe\/london/i, "uk users"],
+    ];
+    const envFiles = [".env.example", ".env.sample", ".env.test", ".env.local.example",
+        "docker-compose.yml", "docker-compose.yaml",
+        "docker-compose.dev.yml", "docker-compose.prod.yml"];
+    for (const f of envFiles) {
+        const p = join(dir, f);
+        if (!existsSync(p))
+            continue;
+        try {
+            const txt = readFileSync(p, "utf-8").slice(0, 8000).toLowerCase();
+            // AWS_REGION / AZURE_LOCATION / GCP_REGION / REGION
+            const awsRegion = txt.match(/(?:aws_region|region)\s*=\s*["']?([a-z0-9-]+)/g) ?? [];
+            for (const m of awsRegion) {
+                const val = m.split(/=\s*["']?/)[1] ?? "";
+                if (/^eu-/.test(val) || /^europe/.test(val))
+                    kws.add("eu users");
+                if (/^ca-/.test(val) || val.includes("canada"))
+                    kws.add("canadian users");
+                if (/^ap-northeast-1$|^ap-northeast-3$/.test(val))
+                    kws.add("japan users");
+                if (/^ap-northeast-2$/.test(val))
+                    kws.add("korea users");
+                if (/^cn-/.test(val) || val.includes("china"))
+                    kws.add("china users");
+                if (/^ap-south-1$/.test(val) || val.includes("india"))
+                    kws.add("india users");
+                if (/^ap-southeast-1$/.test(val))
+                    kws.add("singapore users");
+                if (/^ap-southeast-2$/.test(val))
+                    kws.add("australia users");
+                if (/^sa-east/.test(val))
+                    kws.add("brazil users");
+                if (/^us-/.test(val) || /^us_/.test(val))
+                    kws.add("us users");
+                if (val.includes("uk") || val.includes("europe") && val.includes("west"))
+                    kws.add("uk users");
+            }
+            for (const [re, kw] of tzRegionMap) {
+                if (re.test(txt))
+                    kws.add(kw);
+            }
+        }
+        catch { /* unreadable */ }
+    }
+    // ── 3. Terraform / Pulumi / CloudFormation region strings ─────────────────
+    const tfFiles = [];
+    function collectTf(d, depth) {
+        if (depth > 4)
+            return;
+        const SKIP = new Set(["node_modules", ".git", "dist", ".terraform"]);
+        try {
+            for (const e of readdirSync(d)) {
+                if (SKIP.has(e))
+                    continue;
+                const p = join(d, e);
+                try {
+                    const st = statSync(p);
+                    if (st.isDirectory()) {
+                        collectTf(p, depth + 1);
+                        continue;
+                    }
+                    if (/\.(tf|yaml|yml|json)$/.test(e) && st.size < 200_000)
+                        tfFiles.push(p);
+                }
+                catch { /* skip */ }
+                if (tfFiles.length > 40)
+                    return;
+            }
+        }
+        catch { /* skip */ }
+    }
+    collectTf(dir, 0);
+    const regionPatterns = [
+        [/\beu-west-\d|eu-central-\d|eu-north-\d|eu-south-\d|europe-west\d|europe-north\d|westeurope|northeurope|germanywestcentral|francecentral\b/i, "eu users"],
+        [/\bca-central-\d|canadacentral|canadaeast\b/i, "canadian users"],
+        [/\bap-northeast-1\b|\bjapan-east\b|\bjapaneast\b|\bjapanwest\b/i, "japan users"],
+        [/\bap-northeast-2\b|\bkoreacentral\b|\bkoreasouth\b/i, "korea users"],
+        [/\bcn-north-\d|\bcn-east-\d|\bcn-northwest-\d|\bchinanorth\b|\bchinaeast\b/i, "china users"],
+        [/\bap-south-\d|\bcentralindia\b|\bsouthindia\b|\bwestindia\b/i, "india users"],
+        [/\bap-southeast-1\b|\bsoutheastasia\b/i, "singapore users"],
+        [/\bap-southeast-2\b|\baustralia\b|\baustraliasoutheast\b|\baustraliaeast\b/i, "australia users"],
+        [/\bsa-east-\d|\bbrazilsouth\b|\bbrazilsoutheast\b/i, "brazil users"],
+        [/\buksouth\b|\bukwest\b|\buk-south\b/i, "uk users"],
+        [/\bus-east-\d|\bus-west-\d|\beastus\b|\bwestus\b|\bcentralus\b/i, "us users"],
+    ];
+    for (const p of tfFiles) {
+        try {
+            const txt = readFileSync(p, "utf-8").slice(0, 50_000);
+            for (const [re, kw] of regionPatterns) {
+                if (re.test(txt))
+                    kws.add(kw);
+            }
+        }
+        catch { /* skip */ }
+    }
+    return Array.from(kws).sort();
+}
 function safeGlob(dir, pattern, kind = "file") {
     try {
         const entries = readdirSync(dir);

package/dist/jurisdictions.js

@@ -18,6 +18,10 @@ const JURISDICTION_REVIEWERS = {
     "br": ["gdpr-reviewer"], // LGPD mirrors GDPR — same reviewer covers
     "au": ["us-privacy-reviewer"], // Privacy Act 1988 — covered by privacy reviewer
     "sg": ["us-privacy-reviewer"], // PDPA — covered by privacy reviewer
+    "ca": ["us-privacy-reviewer"], // PIPEDA + Quebec Law 25
+    "jp": ["us-privacy-reviewer"], // APPI — covered by privacy reviewer
+    "cn": ["gdpr-reviewer"], // PIPL structure mirrors GDPR concepts
+    "kr": ["us-privacy-reviewer"], // PIPA — covered by privacy reviewer
 };
 const JURISDICTION_GATES = {
     "eu": ["gate:gdpr-dpia", "gate:eu-ai-act-classification"],
@@ -28,6 +32,10 @@ const JURISDICTION_GATES = {
     "br": ["gate:lgpd-dpia"],
     "au": ["gate:au-privacy-act-assessment"],
     "sg": ["gate:pdpa-dpo"],
+    "ca": ["gate:pipeda-pia", "gate:quebec-law25-consent"],
+    "jp": ["gate:appi-third-party-transfer", "gate:appi-ppc-registration"],
+    "cn": ["gate:pipl-consent-framework", "gate:mlps-classification", "gate:pipl-data-localisation"],
+    "kr": ["gate:pipa-isms-p", "gate:pipa-consent-framework"],
 };
 const JURISDICTION_LAWS = {
     "eu": ["GDPR (EU) 2016/679", "EU AI Act 2024/1689", "NIS2 Directive 2022/2555", "ePrivacy Directive"],
@@ -38,6 +46,10 @@ const JURISDICTION_LAWS = {
     "br": ["LGPD (Lei 13.709/2018)", "ANPD resolutions", "Marco Civil da Internet"],
     "au": ["Privacy Act 1988 (Cth)", "Australian Privacy Principles (APPs)", "CDR (if fintech)", "OAIC enforcement"],
     "sg": ["PDPA 2012 (amended 2021)", "MAS TRM Guidelines (if fintech)", "PDPC Advisory Guidelines"],
+    "ca": ["PIPEDA (Personal Information Protection and Electronic Documents Act)", "Quebec Law 25 / Bill 64", "CASL (if email marketing)", "OSFI B-10 (if fintech)"],
+    "jp": ["APPI 2022 (Act on Protection of Personal Information)", "PPC Guidelines", "My Number Act (if govt-adjacent)", "FISC (if fintech)"],
+    "cn": ["PIPL 2021 (Personal Information Protection Law)", "DSL 2021 (Data Security Law)", "MLPS 2.0 (Cybersecurity Classified Protection)", "CBDT (cross-border data transfer rules)", "CAC regulations"],
+    "kr": ["PIPA (Personal Information Protection Act)", "ISMS-P certification (mandatory for large platforms)", "Network Act", "FSC regulations (if fintech)"],
 };
 // ── Signal dictionary ─────────────────────────────────────────────────────
 export const JURISDICTION_SIGNALS = {
@@ -112,15 +124,95 @@ export const JURISDICTION_SIGNALS = {
             "singapore data residency",
         ],
     },
+    "ca": {
+        keywords: [
+            // Privacy law
+            "pipeda", "quebec law 25", "bill 64", "privacy commissioner",
+            "opc canada", "casl", "canadian users", "canada users",
+            "canadian customers", "canadian residents",
+            // Fintech
+            "osfi", "fintrac", "aml canada",
+            // Infra
+            "ca-central", "ca-west", "canada-central",
+        ],
+    },
+    "jp": {
+        keywords: [
+            // Privacy law
+            "appi", "personal information protection commission", "ppc japan",
+            "japan users", "japanese users", "japan customers",
+            "my number", "individual number act",
+            // Fintech
+            "fsa japan", "jfsa", "fisc",
+            // Infra
+            "ap-northeast-1", "ap-northeast-3", "japan east", "japan west",
+            "japaneast", "japanwest",
+        ],
+    },
+    "cn": {
+        keywords: [
+            // Privacy / data laws
+            "pipl", "personal information protection law", "data security law",
+            "dsl 2021", "mlps", "classified protection", "cybersecurity law",
+            "cac", "cyberspace administration", "cbdt",
+            "china users", "chinese users", "mainland china",
+            // Cross-border
+            "cross-border data transfer china", "security assessment cac",
+            "standard contract cac", "personal information export",
+            // Fintech
+            "pboc", "nfra", "cbirc", "csrc", "alipay", "wechatpay",
+            // Infra
+            "cn-north", "cn-northwest", "cn-east", "cn-south",
+            "china-east", "china-north", "chinaeast", "chinanorth",
+        ],
+    },
+    "kr": {
+        keywords: [
+            // Privacy / data laws
+            "pipa korea", "pipa", "personal information protection act korea",
+            "pipc", "privacy commissioner korea",
+            "korea users", "korean users", "south korea users",
+            "isms-p", "kisa", "k-isms",
+            // Fintech
+            "fsc korea", "fss korea", "kftc",
+            // Infra
+            "ap-northeast-2", "korea central", "korea south",
+            "koreacentral", "koreasouth",
+        ],
+    },
 };
 // ── Public API ─────────────────────────────────────────────────────────────
+/**
+ * Word-boundary aware keyword match.
+ * Handles both single tokens ("gdpr") and multi-word phrases ("eu ai act").
+ * Multi-word phrases matched as substrings (spaces already serve as boundaries).
+ * Single tokens matched with word-boundary regex to avoid "india" → "indiana".
+ */
+function matchesKeyword(text, kw) {
+    if (kw.includes(" ")) {
+        // Multi-word phrase: substring match is fine (space = implicit boundary)
+        return text.includes(kw);
+    }
+    // Single token: require word boundaries
+    try {
+        return new RegExp(`(?<![a-z0-9_-])${kw.replace(/[.*+?^${}()|[\]\\]/g, "\\$&")}(?![a-z0-9_-])`).test(text);
+    }
+    catch {
+        return text.includes(kw);
+    }
+}
 /** Return jurisdictions whose signals match the detection result. */
 export function suggestJurisdictions(d) {
     const matches = [];
-    const kwLower = d.readmeKeywords.map((k) => k.toLowerCase());
+    // Combine README keywords + infra keywords (both already lowercased)
+    const allKeywords = [
+        ...d.readmeKeywords.map((k) => k.toLowerCase()),
+        ...(d.infraKeywords ?? []).map((k) => k.toLowerCase()),
+    ];
+    const combined = allKeywords.join(" ");
     for (const code of Object.keys(JURISDICTION_SIGNALS)) {
         const { keywords } = JURISDICTION_SIGNALS[code];
-        const matchedKeywords = keywords.filter((kw) => kwLower.includes(kw));
+        const matchedKeywords = keywords.filter((kw) => matchesKeyword(combined, kw));
         if (matchedKeywords.length === 0)
             continue;
         matches.push({

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "great-cto",
-  "version": "2.19.0",
+  "version": "2.20.0",
   "description": "One command install for the great_cto Claude Code plugin. Auto-detects your stack, picks the right archetype, bootstraps PROJECT.md.",
   "keywords": [
     "claude-code",