Add an app with an AI prompt

Help me add this one app to VibeBeacon by returning its software inventory as JSON.

First check that you can read this project's package files. A fresh chat is fine if it has access to the project. If you cannot read the files, explain how I can open or attach the project files and stop. Do not guess from a public website address or from chat memory.

Stay in this chat's current app folder only. Do not search parent folders, sibling apps, git history, backups, caches or knowledge-graph folders. Skip node_modules, .git, dist, build, .next, vendor, coverage, graphify, .graphify, .cursor, and any archive, snapshot or history folder that is not this app.

Look at named package and lock files in the project root: package.json, package-lock.json, pnpm-lock.yaml, yarn.lock, bun.lock, requirements.txt, pyproject.toml, poetry.lock, uv.lock, Pipfile.lock, go.mod, Cargo.lock, Gemfile.lock or composer.lock. If this same app has an immediate frontend or backend child folder, you may include those too. Do not recursively search the rest of the workspace.

Open at most 8 package, lock or runtime-pin files (.nvmrc, .python-version). If more candidates appear, stop and tell me to run npx vibebeacon@latest scan from this app's folder.

If gathering would take more than about one minute, or you would print a long repeating package list, stop immediately and give that same CLI command. Do not retry the same search. Do not print progress.

Return one JSON object in the shape below. This is an EXAMPLE ONLY: replace the app name, date and every inventory entry with evidence from my project. Remove example entries that do not apply. Do not copy example versions into my result.

{
  "schemaVersion": 1,
  "generator": {
    "name": "manual",
    "version": "1"
  },
  "generatedAt": "2026-09-07T00:00:00Z",
  "app": {
    "name": "Example app",
    "kind": "web"
  },
  "runtimes": [
    {
      "name": "node",
      "version": "22.11.0",
      "resolved": true
    }
  ],
  "frameworks": [],
  "dependencies": [
    {
      "name": "react",
      "version": "18.3.1",
      "ecosystem": "npm",
      "direct": true,
      "dev": false,
      "resolved": true
    }
  ],
  "services": [],
  "infrastructure": []
}

Rules:
- schemaVersion must be 1. Keep generator as shown. generatedAt must be the current ISO 8601 timestamp with a timezone (for example ending in Z).
- app.name is 1 to 80 characters. app.kind is web, api, mobile, desktop, cli or other. Optional app.hosting and app.aiTools are lists of known service/tool names only. Do not add appId, group or tags for this new app.
- Dependencies need name, version and ecosystem. Allowed ecosystems: npm, PyPI, Go, crates.io, RubyGems, Packagist, Maven, NuGet, Hex, Pub. Names are at most 200 characters and versions at most 100.
- List direct dependencies only, from package.json, pyproject.toml or the equivalent declared dependencies. Take exact versions from the matching current lockfile when present and set resolved: true. Set direct: true. Do not flatten the lockfile. Do not list nested or transitive packages. If only a range is available, use its minimum allowed version and resolved: false. If no version or minimum can be established, omit that dependency. Never use a made-up "latest" or "unknown" version. Do not invent a version.
- This list covers software the app declares. Nested packages need npx vibebeacon@latest scan.
- Runtimes have name and optional version. For a range, use its minimum with resolved: false and a note of at most 200 characters saying the running version may differ. Omit version when unknown. Frameworks have name, optional version, ecosystem and resolved. Services have name only. Infrastructure has name and optional version. Include only evidenced entries.
- Empty arrays mean no inventory was found for that category, not that it is safe. If you cannot find any usable inventory, explain which project files are missing and stop instead of returning an empty example.
- Maximums: 2000 dependencies, 50 runtimes, 100 frameworks, 100 services and 100 infrastructure entries; 512 KB total. If the complete result would exceed these limits, stop and tell me to use VibeBeacon's command-line scanner rather than silently omit entries.
- Do not read .env files, secrets or credentials. Never include source code, file contents, paths, repository URLs, environment values, tokens, private URLs or customer data. Do not add extra fields.
- Do not change any code, install anything, write files, run an upload or make network requests. I will review and submit the JSON myself in VibeBeacon.

Assemble the object privately, then print one JSON object once. Never stream one package per line. Never repeat the list. Return only the complete JSON object, with no markdown fences or explanation, so I can copy it back into VibeBeacon. If access or inventory is missing, give the recovery explanation instead of JSON.

Please return the complete VibeBeacon JSON object from the setup prompt, with no markdown fences or extra text. Include schemaVersion, generator, generatedAt, app and the software inventory from this project. Do not guess missing versions or include secrets.

Scan this project and upload the inventory to VibeBeacon.

I authorise sending the documented scan JSON to https://vibebeacon.app/api/v1/manifests using the credential already configured for VibeBeacon. Payload: schema/generator version, scan date, app identity and optional group/tags, package names, versions, ecosystems, direct/dev/resolved flags, runtimes, frameworks, service/hosting/tool names and workspace counts. No source code, file paths, dependency trees, environment values or credentials in the payload. Do not print or inspect the credential. Do not use an alternative destination without my approval.

Run npx vibebeacon@latest scan --upload --api https://vibebeacon.app from the project root.
If no credential is configured, ask me to run npx vibebeacon@latest login. Never inspect or print it.
Do not read .env files, change dependencies or upload source code. Preserve app identity and scan scope.
Report inventory status, changed alert IDs and reasons, score changes and any pending processing.
Missing packages are not verified fixes. If the command fails, report its safe error and stop.