launchprep 0.0.1 → 0.2.0

package/src/detect.mjs

@@ -0,0 +1,304 @@
+// Profile detection. Every fact carries evidence and a confidence level.
+// LOW confidence never produces a `fail` — the gate turns it into a question.
+import { readPackageJson, allDeps, stripComments, isWorkspaceRoot } from './fs-scan.mjs';
+
+const fact = (value, confidence, evidence = []) => ({ value, confidence, evidence });
+const dep  = (deps, ...names) => names.find(n => deps[n] !== undefined);
+
+// ---------- stack ----------
+function detectFramework(repo, deps) {
+  // ---- python ----
+  if (repo.exists('manage.py') || repo.has(/(^|\/)manage\.py$/))
+    return fact('django', 'high', ['manage.py']);
+  if (repo.grep(/^\s*(DJANGO_SETTINGS_MODULE|INSTALLED_APPS)\s*=/m, /\.py$/).length ||
+      repo.grep(/^\s*[Dd]jango[><=~]/m, /requirements.*\.txt$|Pipfile$|pyproject\.toml$/).length)
+    return fact('django', 'high', ['django settings']);
+  if (repo.grep(/from fastapi|FastAPI\s*\(/, /\.py$/).length)
+    return fact('fastapi', 'high', ['FastAPI import']);
+  if (repo.grep(/from flask import|Flask\s*\(__name__/, /\.py$/).length)
+    return fact('flask', 'high', ['Flask import']);
+
+  // ---- ruby ----
+  const gemfile = repo.read('Gemfile') || repo.find(/(^|\/)Gemfile$/)[0]?.text || '';
+  if (/gem\s+['"]rails['"]/.test(gemfile) || repo.exists('config/application.rb') ||
+      repo.has(/config\/application\.rb$/))
+    return fact('rails', 'high', ['rails in Gemfile']);
+  if (/gem\s+['"]sinatra['"]/.test(gemfile)) return fact('sinatra', 'high', ['sinatra gem']);
+
+  // ---- php ----
+  const composer = repo.read('composer.json') || '';
+  if (repo.exists('artisan') || /laravel\/framework/.test(composer))
+    return fact('laravel', 'high', ['artisan / laravel framework']);
+  if (/symfony\//.test(composer)) return fact('symfony', 'high', ['symfony packages']);
+
+  // ---- javascript ----
+  const byDep = [
+    ['next','next'], ['remix','@remix-run/react'], ['nuxt','nuxt'],
+    ['sveltekit','@sveltejs/kit'], ['nest','@nestjs/core'],
+    ['express','express'], ['fastify','fastify'], ['react-native','react-native'],
+  ];
+  for (const [name, d] of byDep) if (deps[d]) return fact(name, 'high', [`dependency ${d}`]);
+
+  // ---- mobile ----
+  if (repo.exists('pubspec.yaml'))      return fact('flutter', 'high', ['pubspec.yaml']);
+  if (repo.has(/Package\.swift$|\.xcodeproj/)) return fact('swiftui', 'high', ['xcode project']);
+  return fact('other', 'low', []);
+}
+
+// `root` is the whole repo when profiling one package of a monorepo: the app
+// package imports the db package, so its schema lives somewhere else entirely.
+function detectDatabase(repo, deps, root) {
+  if (deps['@supabase/supabase-js'] || repo.exists('supabase/config.toml') ||
+      root?.exists('supabase/config.toml'))
+    return fact('supabase', 'high', ['@supabase/supabase-js']);
+
+  const prisma = repo.find(/schema\.prisma$/)[0] || root?.find(/schema\.prisma$/)[0];
+  if (prisma?.text) {
+    const m = prisma.text.match(/provider\s*=\s*"(\w+)"/);
+    if (m) return fact(m[1] === 'postgresql' ? 'postgres' : m[1], 'high', ['prisma schema provider']);
+  }
+  // ORM present but schema elsewhere - still tells us a database exists
+  if (deps['@prisma/client'] || deps['prisma'])
+    return fact('postgres', 'low', ['prisma client, schema not in this package']);
+  if (deps['drizzle-orm']) {
+    const d = (root || repo).grep(/pgTable\s*\(/) .length ? 'postgres'
+            : (root || repo).grep(/mysqlTable\s*\(/).length ? 'mysql'
+            : (root || repo).grep(/sqliteTable\s*\(/).length ? 'sqlite' : 'postgres';
+    return fact(d, 'high', ['drizzle schema']);
+  }
+  if (deps['mongoose']) return fact('mongodb','high',['mongoose']);
+  if (deps['typeorm'] || deps['sequelize']) return fact('postgres','low',['orm present']);
+  if (deps['sqlalchemy'] || deps['SQLAlchemy'] || deps['psycopg2'] || deps['psycopg2-binary'])
+    return fact('postgres','high',['python postgres driver']);
+
+  // django settings.py -> DATABASES ENGINE
+  const dj = repo.grep(/ENGINE['"]?\s*:\s*['"]django\.db\.backends\.(\w+)/, /\.py$/)[0]
+          || root?.grep(/ENGINE['"]?\s*:\s*['"]django\.db\.backends\.(\w+)/, /\.py$/)[0];
+  if (dj) {
+    const m = dj.text.match(/django\.db\.backends\.(\w+)/);
+    const map = { postgresql: 'postgres', postgresql_psycopg2: 'postgres', mysql: 'mysql', sqlite3: 'sqlite', oracle: 'other' };
+    if (m) return fact(map[m[1]] || m[1], 'high', ['django DATABASES engine']);
+  }
+  // rails config/database.yml -> adapter
+  const ry = repo.read('config/database.yml') || root?.read('config/database.yml');
+  if (ry) {
+    const m = ry.match(/adapter:\s*(\w+)/);
+    const map = { postgresql: 'postgres', postgres: 'postgres', mysql2: 'mysql', sqlite3: 'sqlite' };
+    if (m) return fact(map[m[1]] || m[1], 'high', ['rails database.yml adapter']);
+  }
+  // requirements.txt / Gemfile drivers
+  if (repo.grep(/^\s*psycopg2|^\s*asyncpg/m, /requirements.*\.txt$|Pipfile$/).length)
+    return fact('postgres','high',['python postgres driver']);
+  const gem = repo.read('Gemfile') || '';
+  if (/gem\s+['"]pg['"]/.test(gem))     return fact('postgres','high',['pg gem']);
+  if (/gem\s+['"]mysql2['"]/.test(gem)) return fact('mysql','high',['mysql2 gem']);
+  if (dep(deps,'pg','postgres','@neondatabase/serverless')) return fact('postgres','high',['pg driver']);
+  if (dep(deps,'mysql2','mysql'))     return fact('mysql','high',['mysql driver']);
+  if (dep(deps,'mongodb','mongoose')) return fact('mongodb','high',['mongo driver']);
+  if (dep(deps,'better-sqlite3','sqlite3')) return fact('sqlite','high',['sqlite driver']);
+  if (dep(deps,'firebase','firebase-admin')) return fact('firebase','high',['firebase sdk']);
+  return fact('none','low',[]);
+}
+
+function detectAuth(repo, deps) {
+  if (dep(deps,'@clerk/nextjs','@clerk/clerk-react')) return fact('clerk','high',['clerk sdk']);
+  if (dep(deps,'@auth0/nextjs-auth0'))                return fact('auth0','high',['auth0 sdk']);
+  if (dep(deps,'next-auth','@auth/core'))             return fact('nextauth','high',['next-auth']);
+  if (deps['@supabase/supabase-js'] && repo.grep(/auth\.(signIn|signUp|getUser|getSession)/).length)
+    return fact('supabase-auth','high',['supabase auth calls']);
+  const gemf = repo.read('Gemfile') || '';
+  if (/gem\s+['"]devise['"]/.test(gemf)) return fact('devise','high',['devise gem']);
+  if (/has_secure_password/.test((repo.grep(/has_secure_password/, /\.rb$/)[0]||{}).text || ''))
+    return fact('custom','high',['has_secure_password']);
+  if (repo.grep(/django\.contrib\.auth/, /\.py$/).length)
+    return fact('django-auth','high',['django.contrib.auth']);
+  if (dep(deps,'bcrypt','bcryptjs','argon2') ||
+      repo.grep(/(?:from|require\()\s*['"](?:bcrypt|bcryptjs|argon2)/).length)
+    return fact('custom','high',['password hashing import']);
+  return fact('none','low',[]);
+}
+
+function detectHost(repo, deps) {
+  if (repo.exists('vercel.json') || deps['@vercel/analytics']) return fact('vercel','high',['vercel.json']);
+  if (repo.exists('netlify.toml'))  return fact('netlify','high',['netlify.toml']);
+  if (repo.exists('wrangler.toml')) return fact('cloudflare','high',['wrangler.toml']);
+  if (repo.exists('fly.toml'))      return fact('fly','high',['fly.toml']);
+  if (repo.exists('railway.json'))  return fact('railway','high',['railway.json']);
+  if (repo.exists('render.yaml'))   return fact('render','high',['render.yaml']);
+  if (repo.has(/^Dockerfile$|docker-compose\.ya?ml$/)) return fact('vps','low',['Dockerfile — host inferred']);
+  return fact(null,'low',[]);
+}
+
+// ---------- capability facts ----------
+const LLM_DEPS = {
+  '@anthropic-ai/sdk':'anthropic', 'openai':'openai', 'groq-sdk':'groq',
+  '@google/generative-ai':'google', '@mistralai/mistralai':'mistral', 'ollama':'other',
+  'ai':'other', '@ai-sdk/anthropic':'anthropic', '@ai-sdk/openai':'openai',
+};
+function detectLlm(repo, deps) {
+  const providers = [...new Set(Object.entries(LLM_DEPS).filter(([d]) => deps[d]).map(([,p]) => p))];
+  const hits = repo.grep(/api\.(openai|anthropic)\.com|generativelanguage\.googleapis|api\.groq\.com/);
+  if (!providers.length && !hits.length) return { calls_llm: fact(false,'high',[]), providers: fact([], 'high', []) };
+  const ev = providers.length ? [`sdk: ${providers.join(', ')}`] : [`direct call in ${hits[0].path}`];
+  return { calls_llm: fact(true,'high',ev), providers: fact(providers,'high',ev) };
+}
+
+function detectTenancy(repo, hasAccounts) {
+  const RE = /\b(tenant_id|org_id|organization_id|workspace_id|team_id|account_id)\b/;
+  const schema = repo.grep(RE, /\.(sql|prisma)$/);
+  const code   = repo.grep(RE);
+  if (schema.length >= 2 || (schema.length && code.length >= 3))
+    return fact('multi-tenant-shared-db','high',[`tenant key in ${schema.length} schema file(s)`]);
+  if (schema.length || code.length >= 3)
+    return fact('multi-tenant-shared-db','low',['tenant key present but sparse']);
+  if (!hasAccounts) return fact('none','high',['no accounts']);
+  return fact('single-user','low',['accounts present, no tenant key found']);
+}
+
+const PII    = /\b(email|phone|first_?name|last_?name|address|date_?of_?birth|dob|postal|zip_?code)\b/i;
+const FIN    = /\b(card_?number|iban|invoice|amount_cents|stripe_customer|tax_id|vat)\b/i;
+const HEALTH = /\b(diagnosis|patient|medical_record|prescription|icd_?10)\b/i;
+const CHILD  = /\b(parental_consent|guardian|is_minor|age_gate)\b/i;
+// only count matches inside actual schema declarations, with comments removed
+function schemaHits(repo, re) {
+  const files = repo.files.filter(f => f.text && /\.(sql|prisma|ts|py|rb)$/.test(f.path));
+  const hits = [];
+  for (const f of files) {
+    const body = stripComments(f.text);
+    const looksLikeSchema =
+      /pgTable\s*\(|mysqlTable\s*\(|sqliteTable\s*\(|CREATE TABLE|^model\s+\w+\s*\{|class\s+\w+\(.*Model\)/mi.test(body)
+      || /(^|\/)(schema|models?|migrations?|entities)(\/|\.)/i.test(f.path);
+    if (!looksLikeSchema) continue;
+    const m = body.match(new RegExp(re.source, 'gi'));
+    if (m) hits.push({ path: f.path, terms: [...new Set(m.map(x => x.toLowerCase()))] });
+  }
+  return hits;
+}
+function detectSensitivity(repo) {
+  const terms = (hits) => [...new Set(hits.flatMap(h => h.terms))];
+  // high-consequence classifications require corroboration: 2+ distinct terms
+  const health = schemaHits(repo, HEALTH), child = schemaHits(repo, CHILD);
+  if (terms(health).length >= 2) return fact('health','high',[`clinical fields: ${terms(health).join(', ')}`]);
+  if (terms(child).length  >= 2) return fact('children','high',[`minor/guardian fields: ${terms(child).join(', ')}`]);
+  const fin = schemaHits(repo, FIN), pii = schemaHits(repo, PII);
+  if (terms(fin).length >= 1) return fact('financial','high',[`financial fields: ${terms(fin).slice(0,4).join(', ')}`]);
+  if (terms(pii).length >= 2) return fact('pii','high',[`personal fields: ${terms(pii).slice(0,4).join(', ')}`]);
+  if (terms(pii).length === 1) return fact('pii','low',[`single personal field: ${terms(pii)[0]}`]);
+  return fact('none','low',[]);
+}
+
+function detectUploads(repo, deps) {
+  if (dep(deps,'multer','formidable','busboy','uploadthing','@aws-sdk/client-s3','@uploadcare/upload-client'))
+    return fact(true,'high',['upload library']);
+  if (repo.grep(/storage\.from\([^)]*\)\.upload|multipart\/form-data|new FormData\(\)/).length)
+    return fact(true,'high',['upload call site']);
+  return fact(false,'low',[]);
+}
+
+function detectAccounts(repo, deps, auth) {
+  if (auth.value && auth.value !== 'none') return fact(true,'high',[`auth: ${auth.value}`]);
+  if (repo.grep(/(?:CREATE TABLE\s+(?:IF NOT EXISTS\s+)?["`]?(?:public\.)?(?:users|accounts)|^model\s+(?:User|Account)\b)/mi,
+                /\.(sql|prisma)$/).length) return fact(true,'high',['users table in schema']);
+  if (repo.has(/(login|signin|sign-in|register|signup)/i)) return fact(true,'low',['auth route naming']);
+  return fact(false,'low',[]);
+}
+
+function looksLikeLibrary(repo, framework, deps) {
+  // an app has an entrypoint users reach; a library only has exports
+  const pkg = readPackageJson(repo);
+  const hasAppRoutes =
+    repo.has(/^(src\/)?(app|pages|routes|views)\//) ||
+    repo.has(/^(src\/)?(server|api)\//) ||
+    repo.grep(/createServer\(|app\.listen\(|export const (GET|POST|PUT|DELETE)\b/).length > 0;
+  const isFrameworkApp = ['next','remix','nuxt','sveltekit','express','fastify','nest','django','fastapi','rails','flutter','swiftui','react-native'].includes(framework.value);
+  const exportsOnly = !!(pkg && (pkg.main || pkg.module || pkg.exports || pkg.types) && !pkg.bin);
+  if (isFrameworkApp || hasAppRoutes) return false;
+  if (exportsOnly) return true;
+  // config-only packages (eslint/prettier/tsconfig/tailwind presets)
+  if (pkg && Object.keys(deps).length <= 3 && repo.files.length < 30) return true;
+  return false;
+}
+
+function detectSurface(repo, framework, deps) {
+  const f = framework.value;
+  if (looksLikeLibrary(repo, framework, deps))
+    return fact('library','high',['exports only, no app entrypoint']);
+  if (['swiftui'].includes(f))                 return fact('mobile-ios','high',['xcode project']);
+  if (['flutter','react-native'].includes(f))  return fact('mobile-android','low',['cross-platform mobile']);
+  if (['django','rails','laravel','symfony','flask'].includes(f))
+    return fact('web-app','high',[`${f} application`]);
+  if (['express','fastify','nest','fastapi','sinatra'].includes(f)) return fact('api-only','low',['server framework, no UI framework']);
+  if (['next','remix','nuxt','sveltekit'].includes(f)) {
+    const dynamic = repo.has(/\/(api|actions)\//) || repo.grep(/'use server'/).length;
+    return fact(dynamic ? 'web-app' : 'web-site','low',[dynamic?'server routes present':'no server routes found']);
+  }
+  const pkg = readPackageJson(repo);
+  if (pkg?.bin) return fact('cli','high',['package.json bin']);
+  return fact('web-app','low',[]);
+}
+
+function detectStage(repo, host) {
+  const signals = [];
+  if (host.value) signals.push(`host config (${host.value})`);
+  if (repo.has(/^\.github\/workflows\//)) signals.push('CI workflows');
+  if (repo.exists('.env.production') || repo.exists('.env.prod')) signals.push('production env file');
+  if (signals.length >= 2) return fact('production','low',signals);
+  if (signals.length === 1) return fact('pre-launch','low',signals);
+  return fact('prototype','low',['no deploy signals']);
+}
+
+// ---------- entry ----------
+export function detectProfile(repo, opts = {}) {
+  const root = opts.root || null;
+  const pkg  = readPackageJson(repo);
+  const deps = allDeps(repo);          // monorepo-aware: unions every workspace manifest
+
+  const framework = detectFramework(repo, deps);
+  const database  = detectDatabase(repo, deps, root);
+  const auth      = detectAuth(repo, deps);
+  const host      = detectHost(repo, deps);
+  const llm       = detectLlm(repo, deps);
+  const accounts  = detectAccounts(repo, deps, auth);
+
+  const f = {
+    surface:          detectSurface(repo, framework, deps),
+    has_accounts:     accounts,
+    calls_llm:        llm.calls_llm,
+    llm_providers:    llm.providers,
+    is_public:        host.value ? fact(true,'low',['deployed to a public host']) : fact(false,'low',[]),
+    data_sensitivity: (() => { const l = detectSensitivity(repo);
+                               return (l.value === 'none' && root) ? detectSensitivity(root) : l; })(),
+    has_file_uploads: detectUploads(repo, deps),
+    tenancy:          (() => { const l = detectTenancy(repo, accounts.value);
+                               return (['none','single-user'].includes(l.value) && root)
+                                 ? detectTenancy(root, accounts.value) : l; })(),
+    stage:            detectStage(repo, host),
+    // cheap extras that gate real rules
+    has_migrations:   repo.has(/migrations?\//) ? fact(true,'high',['migrations dir']) : fact(false,'low',[]),
+    has_ci:           repo.has(/^\.github\/workflows\//) ? fact(true,'high',['github workflows']) : fact(false,'high',[]),
+    sends_email:      dep(deps,'resend','@sendgrid/mail','nodemailer','postmark','@aws-sdk/client-ses')
+                        ? fact(true,'high',['email sdk']) : fact(false,'low',[]),
+    handles_payments: dep(deps,'stripe','@stripe/stripe-js') ? fact('stripe','high',['stripe sdk'])
+                      : dep(deps,'@paddle/paddle-js') ? fact('paddle','high',['paddle sdk'])
+                      : fact('none','low',[]),
+    has_admin_panel:  repo.has(/\/admin\//i) ? fact(true,'low',['admin route']) : fact(false,'low',[]),
+    stack: {
+      framework: framework.value, database: database.value,
+      auth: auth.value, host: host.value,
+    },
+    _stack_evidence: { framework, database, auth, host },
+  };
+  return f;
+}
+
+// flatten to the shape gate.py expects
+export function toGateProfile(f) {
+  const v = (x) => (x && typeof x === 'object' && 'value' in x) ? x.value : x;
+  const out = {};
+  for (const [k, val] of Object.entries(f)) {
+    if (k.startsWith('_') || k === 'stack') continue;
+    out[k] = v(val);
+  }
+  out.stack = f.stack;
+  return out;
+}

package/src/digest.mjs

@@ -0,0 +1,169 @@
+// Build the block of code the model reads.
+//
+// This is the single most expensive decision in the product. Every token here
+// is written to cache once and then read by every rule-group call, so a digest
+// twice as big costs roughly twice as much for the whole scan. It is also the
+// only defence against someone sending a 2M-token payload to burn our money.
+//
+// The job is not "send the repo". It is "send the parts a question about
+// authorization, tenancy, deletion or spend could possibly be answered from".
+
+// MEASURED, not guessed. 3.5 chars/token is the figure for prose; source code
+// tokenizes far worse - identifiers, punctuation and indentation all split.
+// Checked against messages.countTokens on real digests at three sizes:
+//   estimated  5,981 -> actual   9,321  (1.56x)
+//   estimated 49,991 -> actual  77,175  (1.54x)
+//   estimated 149,995 -> actual 226,891 (1.51x)
+// At 3.5 a "150K cap" admitted 227K tokens, so the cap capped nothing and every
+// cost estimate was about half the real number.
+const CHARS_PER_TOKEN = 2.3;
+export const estimateTokens = (s) => Math.ceil(s.length / CHARS_PER_TOKEN);
+
+// Higher scores are read first. A schema is 200 lines that answer half the
+// tenancy questions; a React component is 400 lines that answer none.
+const RANK = [
+  [/\.(prisma|sql)$/,                                        100, 'schema'],
+  [/(^|\/)(middleware|auth|authz|authorization|session|permissions?|policy|policies|guard|rbac)\.(ts|js|mjs|py|rb|go)$/, 95, 'auth'],
+  [/(^|\/)(middleware|auth|guards?|policies|permissions?)\//, 90, 'auth'],
+  [/(^|\/)api\/.*\/route\.(ts|js)$/,                          85, 'route'],
+  [/(^|\/)(pages\/api|app\/api)\//,                           85, 'route'],
+  [/(^|\/)(routes?|controllers?|handlers?|endpoints?|resolvers?)\//, 80, 'route'],
+  [/(^|\/)(actions?|server)\//,                               75, 'server'],
+  [/\.(server)\.(ts|js)$/,                                    75, 'server'],
+  [/(^|\/)(services?|repositor(y|ies)|queries|db|database|models?|dal)\//, 70, 'data'],
+  [/(^|\/)(jobs?|workers?|queues?|tasks?|cron)\//,            60, 'async'],
+  [/(^|\/)(lib|utils?|helpers?)\//,                           45, 'lib'],
+  [/(next|nuxt|vite|astro|svelte)\.config\.(ts|js|mjs)$/,     55, 'config'],
+  [/(^|\/)(docker-compose.*\.ya?ml|Dockerfile|.*\.tf)$/,      50, 'infra'],
+  [/\.github\/workflows\/.*\.ya?ml$/,                         40, 'ci'],
+  [/(^|\/)package\.json$/,                                    35, 'manifest'],
+];
+
+// Never worth a token.
+const NEVER = [
+  /(^|\/)(test|tests|__tests__|spec|e2e|cypress|fixtures?|mocks?|__mocks__)\//,
+  /\.(test|spec)\.[a-z]+$/,
+  /(^|\/)(node_modules|dist|build|out|coverage|\.next|vendor)\//,
+  /-lock\.(json|yaml)$|\.lock$/,
+  /\.(css|scss|sass|less|svg|png|jpe?g|gif|webp|ico|woff2?|ttf|eot|map|md|txt)$/,
+  /(^|\/)(migrations?)\/.*\/(down|rollback)\.sql$/,
+  /\.min\.(js|css)$/,
+  /(^|\/)(i18n|locales?|translations?)\//,
+];
+
+// The scanner's whole idea is profile -> gate -> check: work out what the app IS
+// before deciding what to ask. The digest ignored that and used one fixed
+// ranking for a static blog and an AI agent platform alike. On tuura that meant
+// lib/agent/ scored 45 - the same as lib/date-helpers/ - so the agent code lost
+// its place to formatting utilities and every AI rule came back "I cannot see
+// the code". Reproducing, in the one new file, the exact mistake the product
+// exists to prevent.
+//
+// Each entry: if the profile fact is true, files matching the pattern get this
+// score instead. Only what the app actually is gets promoted.
+const PROFILE_BOOSTS = [
+  ['calls_llm',        /(^|\/)(ai|llm|agents?|prompts?|completions?|chat|inference|models?)\//i, 92],
+  ['calls_llm',        /(^|\/)[a-z0-9-]*(ai|llm|agent|prompt|completion|anthropic|openai)[a-z0-9-]*\.(ts|tsx|js|mjs|py|rb)$/i, 88],
+  ['has_file_uploads', /(^|\/)(uploads?|attachments?|files?|storage|media)\//i, 88],
+  ['has_file_uploads', /(^|\/)[a-z0-9-]*(upload|attachment|multer|s3|r2|bucket)[a-z0-9-]*\.(ts|tsx|js|mjs|py|rb)$/i, 86],
+  ['has_accounts',     /(^|\/)[a-z0-9-]*(auth|session|token|login|password|jwt)[a-z0-9-]*\.(ts|tsx|js|mjs|py|rb)$/i, 93],
+  ['handles_payments', /(^|\/)[a-z0-9-]*(payment|billing|stripe|checkout|invoice|subscription)[a-z0-9-]*\.(ts|tsx|js|mjs|py|rb)$/i, 88],
+  ['is_multi_tenant',  /(^|\/)[a-z0-9-]*(tenant|org|organization|workspace)[a-z0-9-]*\.(ts|tsx|js|mjs|py|rb)$/i, 88],
+];
+
+function score(path, ctx) {
+  if (NEVER.some(re => re.test(path))) return null;
+  // Prisma's migrations are GENERATED from schema.prisma - a historical log of
+  // every table ever created. On cal.com they are 603 files and would eat the
+  // entire budget, leaving 2 route files, which is where the authorization
+  // bugs actually are. The schema is the current state; the log is not.
+  if (ctx.hasPrisma && /(^|\/)migrations?\//.test(path) && /\.sql$/.test(path)) return null;
+
+  // what this app IS beats where the file happens to sit
+  let boosted = null;
+  for (const [fact, re, n] of PROFILE_BOOSTS) {
+    if (!ctx.profile?.[fact] || !re.test(path)) continue;
+    if (!boosted || n > boosted.n) boosted = { n, kind: fact === 'calls_llm' ? 'ai' : fact.replace(/^(has_|is_|handles_)/, '') };
+  }
+  if (boosted) return boosted;
+
+  for (const [re, n, kind] of RANK) if (re.test(path)) return { n, kind };
+  // unranked server-ish source still beats nothing, but only just
+  if (/\.(ts|tsx|js|jsx|mjs|py|rb|go|php|java|kt|swift)$/.test(path)) return { n: 20, kind: 'other' };
+  return null;
+}
+
+// A single enormous generated file can eat the whole budget alone.
+const MAX_FILE_CHARS = 60_000;
+
+export function buildDigest(repo, { maxTokens = 150_000, profile = {} } = {}) {
+  const ctx = { profile, hasPrisma: repo.files.some(f => /\.prisma$/.test(f.path)) };
+  const ranked = [];
+  for (const f of repo.files) {
+    if (!f.text) continue;
+    const s = score(f.path, ctx);
+    if (!s) continue;
+    ranked.push({ path: f.path, text: f.text, ...s });
+  }
+  // highest value first; within a rank, smaller files first so a 60k monster
+  // never displaces six schemas that would all have fitted
+  ranked.sort((a, b) => b.n - a.n || a.text.length - b.text.length);
+
+  // No single kind may crowd out the others. Without this one category with
+  // hundreds of files takes everything and the scan answers questions nobody
+  // asked while missing the code the rules are actually about.
+  // These must sum to roughly 1.0. The first pass RESERVES each kind its share;
+  // the second spends whatever is left in rank order. If the shares sum to more
+  // than the budget the first pass runs out early and the lowest-ranked kinds
+  // never get their reservation - which is how promoting the AI files knocked
+  // routes from 23 to 8, and routes are where authorization bugs live.
+  const SHARE = {
+    schema: 0.10, auth: 0.08, accounts: 0.12, ai: 0.18, route: 0.20,
+    data: 0.12, server: 0.08, file_uploads: 0.06, payments: 0.03,
+    multi_tenant: 0.03,
+  };
+
+  const parts = [];
+  const included = [];
+  const omitted = [];
+  const spentByKind = {};
+  let tokens = 0;
+
+  const take = (f, respectShare) => {
+    let body = f.text;
+    let truncated = false;
+    if (body.length > MAX_FILE_CHARS) { body = body.slice(0, MAX_FILE_CHARS); truncated = true; }
+    const block = `\n──── ${f.path}${truncated ? '  [truncated]' : ''}\n${body}\n`;
+    const cost = estimateTokens(block);
+    if (tokens + cost > maxTokens) return false;
+    if (respectShare && SHARE[f.kind] != null) {
+      const cap = maxTokens * SHARE[f.kind];
+      if ((spentByKind[f.kind] || 0) + cost > cap) return false;
+    }
+    parts.push(block);
+    included.push({ path: f.path, kind: f.kind, tokens: cost });
+    spentByKind[f.kind] = (spentByKind[f.kind] || 0) + cost;
+    tokens += cost;
+    return true;
+  };
+
+  const leftovers = [];
+  for (const f of ranked) if (!take(f, true)) leftovers.push(f);
+  // budget left after every kind hit its ceiling - spend it in rank order
+  for (const f of leftovers) if (!take(f, false)) omitted.push(f.path);
+
+  return {
+    text: parts.join(''),
+    tokens,
+    included,
+    omitted,
+    // what the model must be told it cannot see, or it will reason as though
+    // the absence of an ownership check is proof there isn't one
+    coverage: {
+      filesRead: included.length,
+      filesSkipped: omitted.length,
+      byKind: included.reduce((a, f) => (a[f.kind] = (a[f.kind] || 0) + 1, a), {}),
+      tokensByKind: spentByKind,
+    },
+  };
+}