launchprep 0.0.1 → 0.1.0

package/src/digest.mjs

@@ -0,0 +1,169 @@
+// Build the block of code the model reads.
+//
+// This is the single most expensive decision in the product. Every token here
+// is written to cache once and then read by every rule-group call, so a digest
+// twice as big costs roughly twice as much for the whole scan. It is also the
+// only defence against someone sending a 2M-token payload to burn our money.
+//
+// The job is not "send the repo". It is "send the parts a question about
+// authorization, tenancy, deletion or spend could possibly be answered from".
+
+// MEASURED, not guessed. 3.5 chars/token is the figure for prose; source code
+// tokenizes far worse - identifiers, punctuation and indentation all split.
+// Checked against messages.countTokens on real digests at three sizes:
+//   estimated  5,981 -> actual   9,321  (1.56x)
+//   estimated 49,991 -> actual  77,175  (1.54x)
+//   estimated 149,995 -> actual 226,891 (1.51x)
+// At 3.5 a "150K cap" admitted 227K tokens, so the cap capped nothing and every
+// cost estimate was about half the real number.
+const CHARS_PER_TOKEN = 2.3;
+export const estimateTokens = (s) => Math.ceil(s.length / CHARS_PER_TOKEN);
+
+// Higher scores are read first. A schema is 200 lines that answer half the
+// tenancy questions; a React component is 400 lines that answer none.
+const RANK = [
+  [/\.(prisma|sql)$/,                                        100, 'schema'],
+  [/(^|\/)(middleware|auth|authz|authorization|session|permissions?|policy|policies|guard|rbac)\.(ts|js|mjs|py|rb|go)$/, 95, 'auth'],
+  [/(^|\/)(middleware|auth|guards?|policies|permissions?)\//, 90, 'auth'],
+  [/(^|\/)api\/.*\/route\.(ts|js)$/,                          85, 'route'],
+  [/(^|\/)(pages\/api|app\/api)\//,                           85, 'route'],
+  [/(^|\/)(routes?|controllers?|handlers?|endpoints?|resolvers?)\//, 80, 'route'],
+  [/(^|\/)(actions?|server)\//,                               75, 'server'],
+  [/\.(server)\.(ts|js)$/,                                    75, 'server'],
+  [/(^|\/)(services?|repositor(y|ies)|queries|db|database|models?|dal)\//, 70, 'data'],
+  [/(^|\/)(jobs?|workers?|queues?|tasks?|cron)\//,            60, 'async'],
+  [/(^|\/)(lib|utils?|helpers?)\//,                           45, 'lib'],
+  [/(next|nuxt|vite|astro|svelte)\.config\.(ts|js|mjs)$/,     55, 'config'],
+  [/(^|\/)(docker-compose.*\.ya?ml|Dockerfile|.*\.tf)$/,      50, 'infra'],
+  [/\.github\/workflows\/.*\.ya?ml$/,                         40, 'ci'],
+  [/(^|\/)package\.json$/,                                    35, 'manifest'],
+];
+
+// Never worth a token.
+const NEVER = [
+  /(^|\/)(test|tests|__tests__|spec|e2e|cypress|fixtures?|mocks?|__mocks__)\//,
+  /\.(test|spec)\.[a-z]+$/,
+  /(^|\/)(node_modules|dist|build|out|coverage|\.next|vendor)\//,
+  /-lock\.(json|yaml)$|\.lock$/,
+  /\.(css|scss|sass|less|svg|png|jpe?g|gif|webp|ico|woff2?|ttf|eot|map|md|txt)$/,
+  /(^|\/)(migrations?)\/.*\/(down|rollback)\.sql$/,
+  /\.min\.(js|css)$/,
+  /(^|\/)(i18n|locales?|translations?)\//,
+];
+
+// The scanner's whole idea is profile -> gate -> check: work out what the app IS
+// before deciding what to ask. The digest ignored that and used one fixed
+// ranking for a static blog and an AI agent platform alike. On tuura that meant
+// lib/agent/ scored 45 - the same as lib/date-helpers/ - so the agent code lost
+// its place to formatting utilities and every AI rule came back "I cannot see
+// the code". Reproducing, in the one new file, the exact mistake the product
+// exists to prevent.
+//
+// Each entry: if the profile fact is true, files matching the pattern get this
+// score instead. Only what the app actually is gets promoted.
+const PROFILE_BOOSTS = [
+  ['calls_llm',        /(^|\/)(ai|llm|agents?|prompts?|completions?|chat|inference|models?)\//i, 92],
+  ['calls_llm',        /(^|\/)[a-z0-9-]*(ai|llm|agent|prompt|completion|anthropic|openai)[a-z0-9-]*\.(ts|tsx|js|mjs|py|rb)$/i, 88],
+  ['has_file_uploads', /(^|\/)(uploads?|attachments?|files?|storage|media)\//i, 88],
+  ['has_file_uploads', /(^|\/)[a-z0-9-]*(upload|attachment|multer|s3|r2|bucket)[a-z0-9-]*\.(ts|tsx|js|mjs|py|rb)$/i, 86],
+  ['has_accounts',     /(^|\/)[a-z0-9-]*(auth|session|token|login|password|jwt)[a-z0-9-]*\.(ts|tsx|js|mjs|py|rb)$/i, 93],
+  ['handles_payments', /(^|\/)[a-z0-9-]*(payment|billing|stripe|checkout|invoice|subscription)[a-z0-9-]*\.(ts|tsx|js|mjs|py|rb)$/i, 88],
+  ['is_multi_tenant',  /(^|\/)[a-z0-9-]*(tenant|org|organization|workspace)[a-z0-9-]*\.(ts|tsx|js|mjs|py|rb)$/i, 88],
+];
+
+function score(path, ctx) {
+  if (NEVER.some(re => re.test(path))) return null;
+  // Prisma's migrations are GENERATED from schema.prisma - a historical log of
+  // every table ever created. On cal.com they are 603 files and would eat the
+  // entire budget, leaving 2 route files, which is where the authorization
+  // bugs actually are. The schema is the current state; the log is not.
+  if (ctx.hasPrisma && /(^|\/)migrations?\//.test(path) && /\.sql$/.test(path)) return null;
+
+  // what this app IS beats where the file happens to sit
+  let boosted = null;
+  for (const [fact, re, n] of PROFILE_BOOSTS) {
+    if (!ctx.profile?.[fact] || !re.test(path)) continue;
+    if (!boosted || n > boosted.n) boosted = { n, kind: fact === 'calls_llm' ? 'ai' : fact.replace(/^(has_|is_|handles_)/, '') };
+  }
+  if (boosted) return boosted;
+
+  for (const [re, n, kind] of RANK) if (re.test(path)) return { n, kind };
+  // unranked server-ish source still beats nothing, but only just
+  if (/\.(ts|tsx|js|jsx|mjs|py|rb|go|php|java|kt|swift)$/.test(path)) return { n: 20, kind: 'other' };
+  return null;
+}
+
+// A single enormous generated file can eat the whole budget alone.
+const MAX_FILE_CHARS = 60_000;
+
+export function buildDigest(repo, { maxTokens = 150_000, profile = {} } = {}) {
+  const ctx = { profile, hasPrisma: repo.files.some(f => /\.prisma$/.test(f.path)) };
+  const ranked = [];
+  for (const f of repo.files) {
+    if (!f.text) continue;
+    const s = score(f.path, ctx);
+    if (!s) continue;
+    ranked.push({ path: f.path, text: f.text, ...s });
+  }
+  // highest value first; within a rank, smaller files first so a 60k monster
+  // never displaces six schemas that would all have fitted
+  ranked.sort((a, b) => b.n - a.n || a.text.length - b.text.length);
+
+  // No single kind may crowd out the others. Without this one category with
+  // hundreds of files takes everything and the scan answers questions nobody
+  // asked while missing the code the rules are actually about.
+  // These must sum to roughly 1.0. The first pass RESERVES each kind its share;
+  // the second spends whatever is left in rank order. If the shares sum to more
+  // than the budget the first pass runs out early and the lowest-ranked kinds
+  // never get their reservation - which is how promoting the AI files knocked
+  // routes from 23 to 8, and routes are where authorization bugs live.
+  const SHARE = {
+    schema: 0.10, auth: 0.08, accounts: 0.12, ai: 0.18, route: 0.20,
+    data: 0.12, server: 0.08, file_uploads: 0.06, payments: 0.03,
+    multi_tenant: 0.03,
+  };
+
+  const parts = [];
+  const included = [];
+  const omitted = [];
+  const spentByKind = {};
+  let tokens = 0;
+
+  const take = (f, respectShare) => {
+    let body = f.text;
+    let truncated = false;
+    if (body.length > MAX_FILE_CHARS) { body = body.slice(0, MAX_FILE_CHARS); truncated = true; }
+    const block = `\n──── ${f.path}${truncated ? '  [truncated]' : ''}\n${body}\n`;
+    const cost = estimateTokens(block);
+    if (tokens + cost > maxTokens) return false;
+    if (respectShare && SHARE[f.kind] != null) {
+      const cap = maxTokens * SHARE[f.kind];
+      if ((spentByKind[f.kind] || 0) + cost > cap) return false;
+    }
+    parts.push(block);
+    included.push({ path: f.path, kind: f.kind, tokens: cost });
+    spentByKind[f.kind] = (spentByKind[f.kind] || 0) + cost;
+    tokens += cost;
+    return true;
+  };
+
+  const leftovers = [];
+  for (const f of ranked) if (!take(f, true)) leftovers.push(f);
+  // budget left after every kind hit its ceiling - spend it in rank order
+  for (const f of leftovers) if (!take(f, false)) omitted.push(f.path);
+
+  return {
+    text: parts.join(''),
+    tokens,
+    included,
+    omitted,
+    // what the model must be told it cannot see, or it will reason as though
+    // the absence of an ownership check is proof there isn't one
+    coverage: {
+      filesRead: included.length,
+      filesSkipped: omitted.length,
+      byKind: included.reduce((a, f) => (a[f.kind] = (a[f.kind] || 0) + 1, a), {}),
+      tokensByKind: spentByKind,
+    },
+  };
+}

package/src/fs-scan.mjs

@@ -0,0 +1,118 @@
+// Cheap repo walk. Everything downstream reads from this one pass so we never
+// hit the disk twice for the same file.
+import { readdirSync, readFileSync, statSync, existsSync, lstatSync, realpathSync } from 'node:fs';
+import { join, relative, extname, resolve, sep } from 'node:path';
+
+const SKIP = new Set([
+  'node_modules', '.git', '.next', 'dist', 'build', 'out', 'coverage',
+  '.venv', 'venv', '__pycache__', '.turbo', 'vendor', '.cache', 'target',
+  'site-packages', 'eggs', '.eggs', '.tox', '.bundle', 'storage', 'public',
+]);
+const TEXT = new Set([
+  '.js','.jsx','.ts','.tsx','.mjs','.cjs','.json','.sql','.py','.rb','.go',
+  '.yaml','.yml','.toml','.env','.example','.prisma','.md','.swift','.kt',
+  '.php','.erb','.haml','.slim','.html','.htm','.vue','.svelte','.cfg','.ini',
+  '.rake','.gemspec','.blade','.twig','.tf','.conf',
+  // mobile manifests and robots.txt - MOB-004 and UX-006 cannot see them otherwise
+  '.plist','.xml','.txt'
+]);
+// files that carry no extension but decide what a project is
+const NAMED = new Set([
+  'Gemfile','Rakefile','Procfile','Dockerfile','Makefile','Brewfile',
+  'Gemfile.lock','requirements.txt','Pipfile','manage.py','artisan',
+]);
+const MAX_BYTES = 512 * 1024;
+
+// A symlink named like a source file will otherwise be read straight through:
+// `config.ts -> /etc/passwd` lands its contents in the scan, and from there into
+// a finding. Anything resolving outside the repo is refused.
+function containedRealPath(root, full) {
+  try {
+    const real = realpathSync(full);
+    const base = realpathSync(root);
+    return (real === base || real.startsWith(base + sep)) ? real : null;
+  } catch { return null; }
+}
+
+export function scanRepo(root, { maxFiles = 6000 } = {}) {
+  const files = [];
+  const rootAbs = resolve(root);
+  const walk = (dir) => {
+    if (files.length >= maxFiles) return;
+    let entries;
+    try { entries = readdirSync(dir, { withFileTypes: true }); } catch { return; }
+    for (const e of entries) {
+      if (files.length >= maxFiles) return;
+      if (e.name.startsWith('.') && !e.name.startsWith('.env') && e.name !== '.github') continue;
+      const full = join(dir, e.name);
+
+      let isLink = false;
+      try { isLink = lstatSync(full).isSymbolicLink(); } catch { continue; }
+      if (isLink && !containedRealPath(rootAbs, full)) {
+        // points outside the repo - record that it exists, never read it
+        files.push({ path: relative(root, full), text: null, skipped: 'symlink-escapes-repo' });
+        continue;
+      }
+
+      if (e.isDirectory()) { if (!SKIP.has(e.name)) walk(full); continue; }
+      const ext = extname(e.name) || (e.name.startsWith('.env') ? '.env' : '');
+      if (!TEXT.has(ext) && !NAMED.has(e.name)) {
+        files.push({ path: relative(root, full), text: null }); continue;
+      }
+      let text = null;
+      try { if (statSync(full).size <= MAX_BYTES) text = readFileSync(full, 'utf8'); } catch {}
+      files.push({ path: relative(root, full), text });
+    }
+  };
+  walk(root);
+  return {
+    root,
+    files,
+    has: (re) => files.some(f => re.test(f.path)),
+    find: (re) => files.filter(f => re.test(f.path)),
+    grep: (re, pathRe = /\.(ts|tsx|js|jsx|mjs|cjs|py|rb|php|erb|sql|prisma|ya?ml)$|(^|\/)(Gemfile|manage\.py|artisan)$/) =>
+      files.filter(f => f.text && pathRe.test(f.path) && re.test(f.text)),
+    exists: (rel) => existsSync(join(root, rel)),
+    read: (rel) => { try { return readFileSync(join(root, rel), 'utf8'); } catch { return null; } },
+  };
+}
+
+export function readPackageJson(repo) {
+  const raw = repo.read('package.json');
+  if (!raw) return null;
+  try { return JSON.parse(raw); } catch { return null; }
+}
+
+// Monorepos put nothing in the root manifest. Union every workspace package.json
+// or we conclude a pnpm/turbo repo has no dependencies at all.
+export function allManifests(repo) {
+  return repo.find(/(^|\/)package\.json$/)
+    .map(f => { try { return JSON.parse(f.text || ''); } catch { return null; } })
+    .filter(Boolean);
+}
+
+export function allDeps(pkgOrRepo) {
+  // accept either a single manifest (legacy) or a repo (monorepo-aware)
+  const manifests = pkgOrRepo && pkgOrRepo.files ? allManifests(pkgOrRepo)
+                  : pkgOrRepo ? [pkgOrRepo] : [];
+  const out = {};
+  for (const m of manifests)
+    Object.assign(out, m.dependencies||{}, m.devDependencies||{}, m.peerDependencies||{});
+  return out;
+}
+
+// Comments describe code; they are not evidence about it. Strip them before
+// matching, or a comment mentioning "diagnosis" classifies a CRM as health data.
+export function stripComments(text) {
+  return text
+    .replace(/\/\*[\s\S]*?\*\//g, ' ')
+    .replace(/(^|[^:])\/\/.*$/gm, '$1')
+    .replace(/^\s*#(?!\[).*$/gm, '')
+    .replace(/^\s*--.*$/gm, '');
+}
+
+export function isWorkspaceRoot(repo) {
+  return repo.exists('pnpm-workspace.yaml') || repo.exists('turbo.json') ||
+         repo.exists('lerna.json') || repo.exists('nx.json') ||
+         !!readPackageJson(repo)?.workspaces;
+}

package/src/gate.mjs

@@ -0,0 +1,103 @@
+// The applicability gate. A rule is evaluated only if every `requires:`
+// predicate holds against the detected profile.
+//
+//   true  -> applies, run the check
+//   false -> skipped, shown with the reason, never counted against the score
+//   null  -> undeterminable, becomes a question, never a failure
+import { createRequire } from 'node:module';
+const require = createRequire(import.meta.url);
+const RULES = require('./rules.json');
+
+export const allRules = () => RULES.rules;
+
+function get(profile, key) {
+  let cur = profile;
+  for (const part of key.split('.')) {
+    if (cur == null || typeof cur !== 'object' || !(part in cur)) return undefined;
+    cur = cur[part];
+  }
+  return cur;
+}
+
+const coerce = (v) => (v === 'true' ? true : v === 'false' ? false : v);
+
+export function evaluate(pred, profile) {
+  const p = String(pred).trim();
+
+  if (p.includes(' or ')) {
+    const parts = p.split(' or ').map(x => evaluate(x, profile));
+    if (parts.some(x => x === true)) return true;
+    return parts.some(x => x === null) ? null : false;
+  }
+
+  let m = p.match(/^([\w.]+)\s+includes any of\s+\[(.+)\]$/);
+  if (m) {
+    const cur = get(profile, m[1]);
+    if (cur == null) return null;
+    const vals = m[2].split(',').map(s => s.trim());
+    return vals.some(v => Array.isArray(cur) ? cur.includes(v) : cur === v);
+  }
+
+  m = p.match(/^([\w.]+)\s+in\s+\[(.+)\]$/);
+  if (m) {
+    const cur = get(profile, m[1]);
+    if (cur === undefined) return null;
+    return m[2].split(',').map(s => s.trim()).includes(cur);
+  }
+
+  m = p.match(/^([\w.]+)\s*(==|!=)\s*(.+)$/);
+  if (m) {
+    const cur = get(profile, m[1]);
+    if (cur === undefined) return null;
+    const val = coerce(m[3].trim());
+    return m[2] === '==' ? cur === val : cur !== val;
+  }
+
+  return null;
+}
+
+export function applies(rule, profile) {
+  const reqs = rule.requires || [];
+  if (!reqs.length) return true;
+  const res = reqs.map(r => evaluate(r, profile));
+  if (res.some(x => x === false)) return false;
+  if (res.some(x => x === null)) return null;
+  return true;
+}
+
+// Why a rule was skipped, in the user's terms rather than predicate syntax.
+export function skipReason(rule, profile) {
+  for (const r of rule.requires || []) {
+    if (evaluate(r, profile) !== false) continue;
+    const key = String(r).match(/^([\w.]+)/)?.[1];
+    const actual = get(profile, key);
+    return `${key} is ${JSON.stringify(actual)}`;
+  }
+  return 'precondition not met';
+}
+
+export function gate(profile) {
+  const evaluated = [], skipped = [], unknown = [];
+  for (const rule of RULES.rules) {
+    const a = applies(rule, profile);
+    if (a === true) evaluated.push(rule);
+    else if (a === false) skipped.push({ rule, reason: skipReason(rule, profile) });
+    else unknown.push(rule);
+  }
+  return { evaluated, skipped, unknown, total: RULES.rules.length };
+}
+
+// Facts that, if answered, would unlock the most currently-unknown rules.
+export function missingFacts(profile, unknown) {
+  const counts = new Map();
+  for (const rule of unknown) {
+    for (const req of rule.requires || []) {
+      for (const sub of String(req).split(' or ')) {
+        if (evaluate(sub, profile) !== null) continue;
+        const key = sub.trim().match(/^([\w.]+)/)?.[1];
+        if (key) counts.set(key, (counts.get(key) || 0) + 1);
+      }
+    }
+  }
+  return [...counts.entries()].sort((a, b) => b[1] - a[1]);
+}

package/src/index.mjs

@@ -0,0 +1,71 @@
+#!/usr/bin/env node
+import { scanRepo } from './fs-scan.mjs';
+import { splitWorkspaces } from './workspace.mjs';
+import { detectProfile, toGateProfile } from './detect.mjs';
+import { gate, missingFacts } from './gate.mjs';
+import { runChecks, runRootChecks } from './checks.mjs';
+import { render } from './report.mjs';
+
+const target = process.argv[2] || process.cwd();
+const asJson = process.argv.includes('--json');
+
+const repo = scanRepo(target, { maxFiles: 12000 });
+const packages = splitWorkspaces(repo);
+
+// Profile and gate every app in the repo. Libraries are profiled too - they
+// simply match very few rules, which is the correct outcome, not a bug.
+const scanned = packages.map(w => {
+  const full = detectProfile(w.view, { root: repo });
+  const profile = toGateProfile(full);
+  const g = gate(profile);
+  const applicableIds = new Set(g.evaluated.map(r => r.id));
+  const findings = runChecks(w.view, profile, applicableIds)
+    .map(f => ({ ...f, file: w.prefix ? `${w.prefix}/${f.file}` : f.file }));
+  return { name: w.name, full, profile, gate: g, findings };
+});
+
+// The app most representative of this repo leads the report.
+const apps = scanned.filter(s => s.profile.surface !== 'library');
+const lead = apps.sort((a, b) => b.gate.evaluated.length - a.gate.evaluated.length)[0] || scanned[0];
+
+// Root-scoped checks see the whole repo, once, regardless of how many
+// workspaces it contains. Gated by the lead app's profile.
+const rootIds = new Set(lead.gate.evaluated.map(r => r.id));
+const rootFindings = runRootChecks(repo, lead.profile, rootIds);
+
+const allFindings = [...scanned.flatMap(s => s.findings), ...rootFindings];
+const seen = new Set();
+// Each workspace sorts its own findings, but concatenating several workspaces
+// and the root-scoped checks destroys that order - a monorepo would show a LOW
+// from apps/web above a CRITICAL from apps/api. Sort once, at the end.
+const RANK = { critical: 0, high: 1, medium: 2, low: 3 };
+const findings = allFindings
+  .filter(f => {
+    const k = `${f.id}:${f.file}:${f.line}`;
+    if (seen.has(k)) return false;
+    seen.add(k); return true;
+  })
+  .sort((a, b) => RANK[a.severity] - RANK[b.severity]);
+
+// Eleven tier-2 rules have a cheap static approximation that ships free. When
+// one of those finds nothing that is NOT a pass - a pattern cannot see an
+// ownership check that lives in middleware. Reporting it as clean would tell
+// someone they are safe when the check simply could not look. Say so instead.
+const firedIds = new Set(findings.map(f => f.id));
+const shallow = lead.gate.evaluated
+  .filter(r => r.has_static_approximation && !firedIds.has(r.id));
+
+const questions = missingFacts(lead.profile, lead.gate.unknown).slice(0, 3);
+
+if (asJson) {
+  console.log(JSON.stringify({
+    packages: scanned.map(s => ({
+      name: s.name, profile: s.profile,
+      evaluated: s.gate.evaluated.length, skipped: s.gate.skipped.length, unknown: s.gate.unknown.length,
+    })),
+    findings, questions,
+    shallow: shallow.map(r => ({ id: r.id, title: r.title, severity: r.severity })),
+  }, null, 2));
+} else {
+  process.stdout.write(render({ repo: target, scanned, lead, findings, questions, shallow }));
+}

package/src/report.mjs

@@ -0,0 +1,101 @@
+import { BRAND } from './brand.mjs';
+
+const C = { red:'\x1b[31m', yel:'\x1b[33m', blu:'\x1b[34m', gry:'\x1b[90m',
+            bold:'\x1b[1m', dim:'\x1b[2m', grn:'\x1b[32m', cyn:'\x1b[36m', off:'\x1b[0m' };
+const SEV = { critical:[C.red,'CRITICAL'], high:[C.yel,'HIGH'], medium:[C.blu,'MEDIUM'], low:[C.gry,'LOW'] };
+
+const QUESTION = {
+  business_model:  'Who is this for — consumers, businesses, a marketplace, or internal use?',
+  jurisdictions:   'Where are your users? (EU / UK / US / other — this decides which privacy rules apply)',
+  expected_scale:  'How many users do you expect — under 1k, under 100k, or more?',
+  serves_currency: 'Do you charge in more than one currency?',
+  audience_locale: 'Do you serve more than one language or region?',
+};
+
+export function render({ repo, scanned, lead, findings, questions, shallow = [] }) {
+  const L = [];
+  const p = (s = '') => L.push(s);
+  const pr = lead.profile;
+
+  p(`\n${C.bold}${BRAND.name.toUpperCase()}${C.off} ${C.dim}${repo}${C.off}\n`);
+
+  // ---------- what this app is ----------
+  p(`${C.bold}What we found${C.off}`);
+  const ev = (f) => lead.full[f]?.evidence?.[0];
+  const row = (k, v, why) =>
+    p(`  ${C.gry}${k.padEnd(10)}${C.off}${v}${why ? `  ${C.dim}(${why})${C.off}` : ''}`);
+
+  row('Type', pr.surface, ev('surface'));
+  row('Stack', [pr.stack.framework, pr.stack.database, pr.stack.host].filter(Boolean).join(' · ') || '—');
+  row('Accounts', pr.has_accounts ? 'yes' : 'no', ev('has_accounts'));
+  if (pr.tenancy !== 'none') row('Tenancy', pr.tenancy, ev('tenancy'));
+  if (pr.calls_llm) row('AI', (pr.llm_providers || []).join(', ') || 'yes', ev('calls_llm'));
+  if (pr.handles_payments !== 'none') row('Payments', pr.handles_payments);
+  if (pr.data_sensitivity !== 'none') row('Data', pr.data_sensitivity, ev('data_sensitivity'));
+  row('Stage', pr.stage, ev('stage'));
+
+  if (scanned.length > 1) {
+    const apps = scanned.filter(s => s.profile.surface !== 'library');
+    const libs = scanned.length - apps.length;
+    p(`\n  ${C.dim}Monorepo — ${apps.length} app${apps.length === 1 ? '' : 's'}` +
+      `${libs ? ` and ${libs} shared package${libs === 1 ? '' : 's'}` : ''}, each checked on its own:${C.off}`);
+    for (const s of apps.slice(0, 6))
+      p(`    ${C.dim}${s.name.padEnd(26)} ${s.profile.surface.padEnd(11)} ${s.gate.evaluated.length} checks${C.off}`);
+  }
+
+  // ---------- findings ----------
+  p(`\n${C.bold}Findings${C.off}`);
+  if (!findings.length) {
+    p(`  ${C.grn}Nothing found by the deterministic checks.${C.off}`);
+    p(`  ${C.dim}These are the fast, free checks — deeper ones need a review pass.${C.off}`);
+  } else {
+    const counts = findings.reduce((a, f) => (a[f.severity] = (a[f.severity] || 0) + 1, a), {});
+    // severity order, not whatever order they happened to arrive in
+    const summary = ['critical', 'high', 'medium', 'low']
+      .filter(k => counts[k]).map(k => `${counts[k]} ${k}`).join(' · ');
+    p(`  ${C.dim}${summary}${C.off}`);
+    for (const f of findings.slice(0, 25)) {
+      const [col, label] = SEV[f.severity];
+      p(`\n  ${col}${C.bold}${label}${C.off}  ${f.title}`);
+      p(`  ${C.gry}${f.file}:${f.line}${C.off}`);
+      p(`      ${f.detail}`);
+      p(`      ${C.grn}Fix${C.off}  ${f.fix}`);
+    }
+    if (findings.length > 25) p(`\n  ${C.dim}… and ${findings.length - 25} more${C.off}`);
+  }
+
+  // ---------- checked, but only as far as a program can see ----------
+  if (shallow.length) {
+    p(`\n${C.bold}${shallow.length} check${shallow.length === 1 ? '' : 's'} went only as deep as a pattern can${C.off}`);
+    p(`  ${C.dim}These found nothing. That is not the same as being safe — a pattern`);
+    p(`  cannot tell whether an ownership check lives in middleware or a guard.${C.off}`);
+    for (const r of shallow.slice(0, 6))
+      p(`  ${C.cyn}~${C.off} ${C.gry}${r.id.padEnd(11)}${C.off}${r.title}`);
+    if (shallow.length > 6) p(`  ${C.dim}  … and ${shallow.length - 6} more${C.off}`);
+    p(`  ${C.dim}A deep scan reads the actual path these take through your code.${C.off}`);
+  }
+
+  // ---------- what we did not check, and why ----------
+  const g = lead.gate;
+  p(`\n${C.bold}Coverage${C.off}`);
+  p(`  ${C.bold}${g.evaluated.length}${C.off} of ${g.total} checks apply to this app`);
+  p(`  ${C.dim}${g.skipped.length} skipped — they don't fit what you built${C.off}`);
+
+  const bySkipFact = {};
+  for (const s of g.skipped) {
+    const k = s.reason.split(' is ')[0];
+    bySkipFact[k] = (bySkipFact[k] || 0) + 1;
+  }
+  for (const [f, n] of Object.entries(bySkipFact).sort((a, b) => b[1] - a[1]).slice(0, 4))
+    p(`      ${C.dim}${String(n).padStart(3)} because ${f} is ${JSON.stringify(lead.profile[f] ?? lead.profile.stack?.[f.split('.').pop()])}${C.off}`);
+
+  // ---------- the three questions ----------
+  if (questions.length) {
+    p(`\n${C.bold}${g.unknown.length} more checks need ${questions.length} answer${questions.length === 1 ? '' : 's'}${C.off}`);
+    for (const [factName, n] of questions)
+      p(`  ${C.cyn}?${C.off} ${QUESTION[factName] || factName}  ${C.dim}(unlocks ${n})${C.off}`);
+  }
+
+  p(`\n  ${C.dim}Anything above wrong? Correct it and the checks adjust.${C.off}\n`);
+  return L.join('\n');
+}