feat(typescript-recipes): add vendor intelligence recipe

[georgeatparallel]

What this adds

This PR adds a local TypeScript recipe for researching vendor risk and keeping the result current with Parallel.

It has three commands:

• bootstrap researches each vendor, applies a deterministic risk policy, and starts a snapshot Monitor.
• check-updates reads new Monitor events and runs focused follow-up research when a change crosses the review threshold.
• cleanup cancels the Monitors recorded in local state.

The README explains what each command does, when it consumes credits, what a successful result looks like, and how to recover after an interrupted command. The implementation uses the current TypeScript SDK and V1 Monitor API.

Why it is local

The earlier version in #37 combined n8n workflows, a TypeScript layer, and a hosted Next.js/Supabase app. That gave readers several implementations of the same workflow and a lot of infrastructure to set up.

This version keeps one implementation and one local state file. A reader needs Node.js and a Parallel API key; there is no database, frontend, webhook, or deployment step. Because there is no hosted demo, the Cookbook now supports websiteUrl: null and hides the Demo button for verified local recipes.

This PR supersedes #37 and keeps Sahith's attribution in the Cookbook registry.

Try it

The normal checks do not call the Parallel API:

cd typescript-recipes/parallel-vendor-intelligence
npm ci
npm run validate
npm audit --audit-level=high

To use the recipe, copy .env.example to .env, add PARALLEL_API_KEY, and run:

npm run --silent bootstrap | jq
# Leave the Monitor active. Run this later to process new events:
npm run --silent check-updates | jq
# Run this when you are finished monitoring:
npm run --silent cleanup | jq

The opt-in live test consumes credits. It researches Cloudflare, creates a snapshot Monitor, checks for updates, cancels every Monitor it created, and confirms the remote status:

npm run test:live

Verified

• A fresh Node.js 20 install passes the TypeScript check and all 106 deterministic tests.
• The dependency audit reports no vulnerabilities.
• Package, schema, secret, and repository pre-commit checks pass.
• A production run completed a real core Task and lite Monitor lifecycle, including confirmed cancellation.