@cejel/cejel 0.1.2 → 0.1.3

package/README.md

@@ -278,9 +278,11 @@ separately produced structured report. We neither score you on evidence the publ
 cannot collect nor award ourselves points for evidence you cannot contest.
 
 **Where we were wrong.** Calibrating this rubric against real repositories — and running the
-board itself like a stranger would — surfaced seven errors in our own tool, all found before
-(or, in one case, on) publication day, and all fixed. We list them because a scoring tool
-that has never been wrong is a scoring tool that has not been checked:
+board itself like a stranger would — surfaced the errors below in our own tool, every one found
+by us and every one fixed. The list is its own count; we do not keep a tally in this sentence,
+because a number typed by hand beside a list that grows is exactly the kind of unchecked claim
+this tool exists to catch. We publish them because a scoring tool that has never been wrong is a
+scoring tool that has not been checked:
 
 - **Django, scored a false critical on dependency hygiene.** We applied application-shaped
   expectations to a library. Archetype now gates the dimension.
@@ -315,6 +317,23 @@ that has never been wrong is a scoring tool that has not been checked:
 - **Version 0.1.1 rejected `--help` and `--version` as unknown flags, and read `-h` as a
   directory path.** Version 0.1.2 handles both aliases before positional-path parsing and
   derives its printed version from the package manifest.
+- **We reported a timing side-channel in our own test fixtures.** Pointed at its own
+  repository, Cejel's secret-handling dimension flagged a "non-constant-time secret
+  comparison" — in string literals inside a test file, the deliberately-insecure example code
+  that exists to prove the detector fires. It read a *file*, not a comparison, and reported a
+  vulnerability in the test written to catch that vulnerability. Two sub-rules of the same
+  dimension held two different private notions of what "production code" meant, and the one
+  that had none was the louder. Version 0.1.3 gives every rule one shared, derived answer to
+  that question, and reports the real line of a real match or nothing at all.
+- **We fixed the COBOL false-verdict, shipped it, and it was still broken.** An earlier release
+  corrected a repository written in a language we cannot read being scored anyway. The fixture
+  that proved the fix contained COBOL and nothing else. The first real COBOL repository we
+  pointed it at — AWS's mainframe credit-card demo — carried nine incidental shell scripts
+  among 329 files, and those nine were enough to short-circuit the abstention path entirely:
+  a 99%-COBOL codebase was scored on its deploy scripts and drew a confident `0.0`,
+  "Unverified". Every real legacy repository has a deploy script, so the fix that passed every
+  test was unreachable for essentially all of them. Recognised source must now be *dominant*,
+  not merely present. **A fixture cleaner than reality proves nothing.**
 
 Every one was a trust failure produced by *us* — false alarms about other people's code,
 silent omissions, inconsistent presentation, or a home-only scoring path — and we would

package/dist/{chunk-MBYVOPJR.js → chunk-QQVCIG4N.js}

@@ -5446,7 +5446,10 @@ var WitanEvidencePointerSchema = external_exports.object({
   label: external_exports.string().min(1).max(180),
   url: external_exports.string().url().optional(),
   path: external_exports.string().min(1).max(700).optional(),
-  line: external_exports.number().int().positive().optional(),
+  // Explicit null means the finding is file-scoped and no real match position was measured —
+  // never a fabricated line (e.g. `1`) standing in for a position the detector never found
+  // (goal_cejel_a2_one_notion_of_production_code_2026-07-13).
+  line: external_exports.number().int().positive().nullable().optional(),
   contentHash: external_exports.string().min(8).max(160).optional(),
   capturedAt: external_exports.string().datetime({ offset: true }).optional()
 }).strict().refine((value) => Boolean(value.url ?? value.path ?? value.contentHash), {
@@ -6600,6 +6603,7 @@ var BUNDLED_BINARY_EXTENSION_PATTERN = /\.(vsix|zip|tgz|whl|exe|dmg|pkg|msi|jar|
 var DOCS_OR_MEDIA_EXTENSION_PATTERN = /\.(md|mdx|rst|png|jpe?g|gif|svg|webp|ico|pdf)$/i;
 var KNOWN_NON_SOURCE_EXTENSION_PATTERN = /\.(json|jsonc|json5|ya?ml|toml|txt|lock|xml|csv|tsv|ini|cfg|conf|properties|env|sum|mod|graphql|gql|proto|editorconfig|gitignore|gitattributes|npmrc|nvmrc|dockerignore|log|txt\.license)$/i;
 var INGEST_POINTER = "To assess a closed/bundled tool, ingest its scanner output via --ingest <sarif|scorecard>.";
+var SOURCE_DOMINANCE_RATIO_THRESHOLD = 0.2;
 function classifyRepoArchetype(repoFiles) {
   const totalFileCount = repoFiles.length;
   const sourceFileCount = repoFiles.filter((file) => SOURCE_EXTENSION_PATTERN.test(file)).length;
@@ -6611,57 +6615,83 @@ function classifyRepoArchetype(repoFiles) {
       insufficientSourceReason: "Repository has no tracked files \u2014 there is nothing to certify."
     };
   }
-  if (sourceFileCount > 0) {
+  const unrecognisedSourceFiles = collectUnrecognisedSourceFiles(repoFiles);
+  if (sourceFileCount === 0) {
+    const binaryFiles = repoFiles.filter((file) => BUNDLED_BINARY_EXTENSION_PATTERN.test(file));
+    if (binaryFiles.length > 0) {
+      const sample = binaryFiles[0];
+      return {
+        archetype: "binary_only",
+        sourceFileCount,
+        totalFileCount,
+        insufficientSourceReason: `${sourceFileCount} source file(s) found among ${totalFileCount} tracked file(s); repo appears to be a binary/bundled-distribution tree (e.g. ${sample ? basename(sample) : "a packaged artifact"}) \u2014 cejel rates source, not binaries. ${INGEST_POINTER}`
+      };
+    }
+    const docsFiles = repoFiles.filter((file) => DOCS_OR_MEDIA_EXTENSION_PATTERN.test(file));
+    if (docsFiles.length > 0 && docsFiles.length === totalFileCount) {
+      return {
+        archetype: "docs_only",
+        sourceFileCount,
+        totalFileCount,
+        insufficientSourceReason: `${sourceFileCount} source file(s) found among ${totalFileCount} tracked file(s); repo appears to be a docs/distribution tree (README/markdown/media), not a source tree \u2014 cejel rates source, not docs. ${INGEST_POINTER}`
+      };
+    }
+    if (unrecognisedSourceFiles.length > 0) {
+      return unrecognisedEcosystemResult(sourceFileCount, totalFileCount, unrecognisedSourceFiles);
+    }
+    return { archetype: "source", sourceFileCount, totalFileCount };
+  }
+  if (unrecognisedSourceFiles.length === 0) {
     return {
       archetype: isLikelyMonorepo(repoFiles) ? "monorepo" : "source",
       sourceFileCount,
       totalFileCount
     };
   }
-  const binaryFiles = repoFiles.filter((file) => BUNDLED_BINARY_EXTENSION_PATTERN.test(file));
-  if (binaryFiles.length > 0) {
-    const sample = binaryFiles[0];
+  const dominanceRatio = sourceFileCount / (sourceFileCount + unrecognisedSourceFiles.length);
+  if (dominanceRatio >= SOURCE_DOMINANCE_RATIO_THRESHOLD) {
     return {
-      archetype: "binary_only",
-      sourceFileCount,
-      totalFileCount,
-      insufficientSourceReason: `${sourceFileCount} source file(s) found among ${totalFileCount} tracked file(s); repo appears to be a binary/bundled-distribution tree (e.g. ${sample ? basename(sample) : "a packaged artifact"}) \u2014 cejel rates source, not binaries. ${INGEST_POINTER}`
-    };
-  }
-  const docsFiles = repoFiles.filter((file) => DOCS_OR_MEDIA_EXTENSION_PATTERN.test(file));
-  if (docsFiles.length > 0 && docsFiles.length === totalFileCount) {
-    return {
-      archetype: "docs_only",
-      sourceFileCount,
-      totalFileCount,
-      insufficientSourceReason: `${sourceFileCount} source file(s) found among ${totalFileCount} tracked file(s); repo appears to be a docs/distribution tree (README/markdown/media), not a source tree \u2014 cejel rates source, not docs. ${INGEST_POINTER}`
-    };
-  }
-  const unrecognisedExtensions = collectUnrecognisedSourceExtensions(repoFiles);
-  if (unrecognisedExtensions.length > 0) {
-    const sample = unrecognisedExtensions.slice(0, 6).join(", ");
-    return {
-      archetype: "unrecognised_ecosystem",
+      archetype: isLikelyMonorepo(repoFiles) ? "monorepo" : "source",
       sourceFileCount,
-      totalFileCount,
-      insufficientSourceReason: `Cejel does not yet read this repository's source language(s) (${sample}) \u2014 0 of ${totalFileCount} tracked file(s) matched a recognised source extension. Cejel abstains from a verdict rather than score a language it cannot parse; the Criterion Profile and Measured coverage below show exactly which dimensions were and were not measured. ${INGEST_POINTER}`
+      totalFileCount
     };
   }
-  return { archetype: "source", sourceFileCount, totalFileCount };
+  return unrecognisedEcosystemResult(sourceFileCount, totalFileCount, unrecognisedSourceFiles);
 }
-function collectUnrecognisedSourceExtensions(repoFiles) {
-  const found = /* @__PURE__ */ new Set();
-  for (const file of repoFiles) {
+function collectUnrecognisedSourceFiles(repoFiles) {
+  return repoFiles.filter((file) => {
     const base = basename(file);
-    const match = /\.([a-zA-Z0-9_]+)$/.exec(base);
+    if (!/\.([a-zA-Z0-9_]+)$/.test(base)) return false;
+    if (KNOWN_NON_SOURCE_EXTENSION_PATTERN.test(base)) return false;
+    if (DOCS_OR_MEDIA_EXTENSION_PATTERN.test(base)) return false;
+    if (BUNDLED_BINARY_EXTENSION_PATTERN.test(base)) return false;
+    if (SOURCE_EXTENSION_PATTERN.test(base)) return false;
+    return true;
+  });
+}
+function extensionsByFileCountDescending(files) {
+  const counts = /* @__PURE__ */ new Map();
+  for (const file of files) {
+    const match = /\.([a-zA-Z0-9_]+)$/.exec(basename(file));
     const ext = match?.[1];
     if (!ext) continue;
-    if (KNOWN_NON_SOURCE_EXTENSION_PATTERN.test(base)) continue;
-    if (DOCS_OR_MEDIA_EXTENSION_PATTERN.test(base)) continue;
-    if (BUNDLED_BINARY_EXTENSION_PATTERN.test(base)) continue;
-    found.add(`.${ext.toLowerCase()}`);
+    const key = `.${ext.toLowerCase()}`;
+    counts.set(key, (counts.get(key) ?? 0) + 1);
   }
-  return [...found].sort();
+  return [...counts.entries()].sort(([extA, countA], [extB, countB]) => countB - countA || extA.localeCompare(extB)).map(([ext]) => ext);
+}
+function unrecognisedEcosystemResult(sourceFileCount, totalFileCount, unrecognisedSourceFiles) {
+  const sample = extensionsByFileCountDescending(unrecognisedSourceFiles).slice(0, 6).join(", ");
+  const candidateCount = sourceFileCount + unrecognisedSourceFiles.length;
+  const dominancePct = candidateCount > 0 ? (sourceFileCount / candidateCount * 100).toFixed(1) : "0.0";
+  const thresholdPct = (SOURCE_DOMINANCE_RATIO_THRESHOLD * 100).toFixed(0);
+  const measuredClause = sourceFileCount > 0 ? `${sourceFileCount} of ${candidateCount} source-shaped file(s) (${dominancePct}%) are in a language Cejel reads \u2014 below the ${thresholdPct}% dominance threshold a score would need to be meaningful (${totalFileCount} tracked files in total; manifests, lockfiles, docs, media and bundled binaries are excluded from both sides of the ratio)` : `0 of ${totalFileCount} tracked file(s) matched a recognised source extension`;
+  return {
+    archetype: "unrecognised_ecosystem",
+    sourceFileCount,
+    totalFileCount,
+    insufficientSourceReason: `Cejel does not yet read this repository's dominant source language(s) (${sample}) \u2014 ${measuredClause}. Cejel abstains from a verdict rather than score a repository whose recognised source is incidental rather than dominant; the Criterion Profile and Measured coverage below show exactly which dimensions were and were not measured. ${INGEST_POINTER}`
+  };
 }
 function isLikelyMonorepo(repoFiles) {
   const packageRoots = new Set(
@@ -7106,7 +7136,8 @@ function collectCryptoHygieneEvidence(repoPath, implFiles) {
   const findings = [];
   let hasSurface = false;
   let insecureFound = false;
-  const timingSafeFile = implFiles.find(
+  const productionImplFiles = implFiles.filter(isProductionSourcePath);
+  const timingSafeFile = productionImplFiles.find(
     (file) => fileContains(repoPath, file, TIMING_SAFE_COMPARE_PATTERN)
   );
   if (timingSafeFile) {
@@ -7120,7 +7151,7 @@ function collectCryptoHygieneEvidence(repoPath, implFiles) {
       )
     );
   }
-  const canonicalSignFile = implFiles.find(
+  const canonicalSignFile = productionImplFiles.find(
     (file) => fileContains(repoPath, file, CANONICAL_SERIALIZE_PATTERN) && fileContains(repoPath, file, SIGN_OR_HMAC_CALL_PATTERN)
   );
   if (canonicalSignFile) {
@@ -7134,20 +7165,31 @@ function collectCryptoHygieneEvidence(repoPath, implFiles) {
       )
     );
   }
-  const insecureCompareFile = implFiles.find(
-    (file) => fileContains(repoPath, file, INSECURE_SECRET_COMPARE_PATTERN)
-  );
+  let insecureCompareFile = null;
+  let insecureCompareLine = null;
+  for (const file of implFiles) {
+    const line = findInsecureSecretCompareLine(repoPath, file);
+    if (line != null) {
+      insecureCompareFile = file;
+      insecureCompareLine = line;
+      break;
+    }
+  }
   if (insecureCompareFile) {
-    hasSurface = true;
-    insecureFound = true;
+    const isTestPath = isTestOrFixturePath(insecureCompareFile);
+    if (!isTestPath) {
+      hasSurface = true;
+      insecureFound = true;
+    }
     findings.push({
-      severity: "warning",
-      summary: "A secret/HMAC/signature value appears compared with a plain equality operator instead of a constant-time comparison \u2014 potential timing side-channel.",
-      evidence: evidenceForRelative(
+      severity: isTestPath ? "info" : "warning",
+      summary: isTestPath ? `A secret/HMAC/signature comparison via plain equality appears in a test/fixture file (${insecureCompareFile}) \u2014 likely a test assertion, not a production timing leak; verify.` : "A secret/HMAC/signature value appears compared with a plain equality operator instead of a constant-time comparison \u2014 potential timing side-channel.",
+      evidence: evidenceForRelativeAtLine(
         repoPath,
         insecureCompareFile,
         "artifact",
-        "Non-constant-time secret comparison"
+        "Non-constant-time secret comparison",
+        insecureCompareLine
       )
     });
   }
@@ -7155,16 +7197,25 @@ function collectCryptoHygieneEvidence(repoPath, implFiles) {
     (file) => fileContains(repoPath, file, UNSORTED_JSON_SIGN_PATTERN) && !fileContains(repoPath, file, CANONICAL_SERIALIZE_PATTERN)
   );
   if (unsortedSignFile) {
-    hasSurface = true;
-    insecureFound = true;
+    const isTestPath = isTestOrFixturePath(unsortedSignFile);
+    if (!isTestPath) {
+      hasSurface = true;
+      insecureFound = true;
+    }
+    const unsortedSignLine = findFirstMatchingLine(
+      repoPath,
+      unsortedSignFile,
+      UNSORTED_JSON_SIGN_PATTERN
+    );
     findings.push({
-      severity: "warning",
-      summary: "A signature/HMAC appears computed directly over JSON.stringify output with no canonical key ordering in the same file \u2014 signatures may not verify across equivalent payloads.",
-      evidence: evidenceForRelative(
+      severity: isTestPath ? "info" : "warning",
+      summary: isTestPath ? `Signing over unsorted JSON serialization appears in a test/fixture file (${unsortedSignFile}) \u2014 likely a test assertion, not a production signing gap; verify.` : "A signature/HMAC appears computed directly over JSON.stringify output with no canonical key ordering in the same file \u2014 signatures may not verify across equivalent payloads.",
+      evidence: evidenceForRelativeAtLine(
         repoPath,
         unsortedSignFile,
         "artifact",
-        "Signing over unsorted JSON serialization"
+        "Signing over unsorted JSON serialization",
+        unsortedSignLine
       )
     });
   }
@@ -7880,11 +7931,20 @@ function collectB6PrivilegedOpsGatingEvidence(repoPath, repoFiles) {
 var CPP_TEST_FRAMEWORK_PATTERN = /<gtest\/gtest\.h>|<catch2\/|<doctest\/|<boost\/test\/|"gtest\/gtest\.h"|"catch2\//;
 var CPP_TEST_MACRO_PATTERN = /\bTEST\s*\(|\bTEST_F\s*\(|\bTEST_CASE\s*\(|\bSECTION\s*\(|\bCATCH_|BOOST_AUTO_TEST_CASE\b|BOOST_FIXTURE_TEST_CASE\b/;
 var CPP_CONTENT_SCAN_LIMIT = 150;
-var TEST_OR_FIXTURE_DIR_PATTERN = /(^|\/)(__tests__|__mocks__|__fixtures__|tests|test|fixtures|testdata|e2e|cypress)(\/|$)/i;
-var TEST_OR_FIXTURE_FILE_PATTERN = /\.(test|spec|stories)\.[^/]+$/i;
+var NON_PRODUCTION_DIR_PATTERN = /(^|\/)(__tests__|__mocks__|__fixtures__|tests?|fixtures?|testdata|e2e|cypress|examples?|samples?|demos?)(\/|$)/i;
+var NON_PRODUCTION_FILE_SUFFIX_PATTERN = /\.(test|spec|stories)\.[^/]+$/i;
 function isTestOrFixturePath(path) {
-  return TEST_OR_FIXTURE_DIR_PATTERN.test(path) || TEST_OR_FIXTURE_FILE_PATTERN.test(path);
+  return NON_PRODUCTION_DIR_PATTERN.test(path) || NON_PRODUCTION_FILE_SUFFIX_PATTERN.test(path);
+}
+function isProductionSourcePath(path) {
+  return !isTestOrFixturePath(path);
 }
+function isTestFile(file) {
+  return /(^|\/)(__tests__|test|tests|spec)\/.*\.(?:[cm]?[jt]sx?|py|go|rs|java|rb|cpp|cc|cxx)$/.test(
+    file
+  ) || /\.(test|spec)\.[cm]?[jt]sx?$/.test(file) || /(^|\/)test_.*\.py$/.test(file) || /_test\.go$/.test(file) || /(^|\/)test_.*\.(cpp|cc|cxx)$/.test(file) || /_(test|tests)\.(cpp|cc|cxx)$/.test(file) || /Tests?\.(java|kt)$/.test(file) || /(_test|_spec)\.(rs|rb|php|swift|kt)$/.test(file);
+}
+var NAME_SHAPED_TEST_FILE_PATTERN = /\.(test|spec)\.[cm]?[jt]sx?$|(^|\/)__tests__\/|(^|\/)test_[^/]*\.py$|(^|\/)tests?\.py$|_test\.go$|(^|\/)test_[^/]*\.(cpp|cc|cxx)$|_(test|tests)\.(cpp|cc|cxx)$|Tests?\.(java|kt)$|(_test|_spec)\.(rs|rb|php|swift|kt)$/;
 var TEST_RUNNER_PATTERN = /\b(vitest|jest|mocha|ava|tap|pytest|go test|cargo test|rspec|phpunit|gradle test|mvn test)\b/i;
 var CI_TEST_COMMAND_PATTERN = /\b(pytest|go\s+test|cargo\s+test|mvn\s+test|gradle\s+test|ctest|make\s+test|jest|vitest|mocha|rspec|phpunit|pnpm\s+test|npm\s+test|yarn\s+test|node\s+--test|node:test)\b/i;
 var CI_LINT_COMMAND_PATTERN = /\b(eslint|pylint|flake8|black|ruff)\b/i;
@@ -7917,7 +7977,28 @@ var HEAVY_TEST_DEPENDENCY_NAME_PATTERN = /^(?:jest|mocha|ava|tape|jasmine|karma)
 var TIMING_SAFE_COMPARE_PATTERN = /\btiming[-_]?safe[-_]?(?:equal|compare)\b|crypto\.timingSafeEqual\s*\(/i;
 var CANONICAL_SERIALIZE_PATTERN = /\bcanonicalize\s*\(|\bcanonicalJson\b|\bstableStringify\s*\(|json-stable-stringify|safe-stable-stringify|\bsortKeys\s*\(/i;
 var SIGN_OR_HMAC_CALL_PATTERN = /\bcreateHmac\s*\(|\bcreateSign\s*\(|\.sign\s*\(/;
-var INSECURE_SECRET_COMPARE_PATTERN = /\b\w*(?:hmac|signature|\bmac|digest)\w*\s*(?:===|!==)\s*(?!['"`]|undefined\b|null\b)\w/i;
+var INSECURE_SECRET_COMPARE_LINE_PATTERN = /\b\w*(?:hmac|signature|\bmac|digest)\w*\s*(===|!==)\s*(?!['"`]|undefined\b|null\b)([\w.]+(?:\s*[-+]\s*\d+)?)/i;
+var NUMERIC_SHAPED_OPERAND_PATTERN = /^-?\d+$|\.(?:length|len|size|count)\b|(?:length|index|idx|offset|count|size|len)$/i;
+function lineHasInsecureSecretCompare(line) {
+  const match = INSECURE_SECRET_COMPARE_LINE_PATTERN.exec(line);
+  const operand = match?.[2];
+  if (!operand) return false;
+  return !NUMERIC_SHAPED_OPERAND_PATTERN.test(operand.trim());
+}
+function findInsecureSecretCompareLine(repoPath, file) {
+  const fullPath = join3(repoPath, file);
+  if (!isRegularFile(fullPath)) return null;
+  const lines = readFileSync6(fullPath, "utf8").split("\n");
+  const index = lines.findIndex((line) => lineHasInsecureSecretCompare(line));
+  return index === -1 ? null : index + 1;
+}
+function findFirstMatchingLine(repoPath, file, pattern) {
+  const fullPath = join3(repoPath, file);
+  if (!isRegularFile(fullPath)) return null;
+  const lines = readFileSync6(fullPath, "utf8").split("\n");
+  const index = lines.findIndex((line) => pattern.test(line));
+  return index === -1 ? null : index + 1;
+}
 var UNSORTED_JSON_SIGN_PATTERN = /\.update\s*\(\s*JSON\.stringify\s*\(|\.sign\s*\([^)]*JSON\.stringify\s*\(/;
 var KILL_SWITCH_NAME_FRAGMENT = "kill[_-]?switch|emergency[_-]?stop|circuit[_-]?breaker|safety[_-]?(?:toggle|gate|switch)|governance[_-]?(?:toggle|gate)";
 var KILL_SWITCH_NAME_PATTERN = new RegExp(`\\b(?:${KILL_SWITCH_NAME_FRAGMENT})\\b`, "i");
@@ -8071,11 +8152,6 @@ function shouldSkipDir(name) {
 function isHardExcludedPath(path) {
   return HARD_EXCLUDED_PATH_PATTERN.test(path);
 }
-function isTestFile(file) {
-  return /(^|\/)(__tests__|test|tests|spec)\/.*\.(?:[cm]?[jt]sx?|py|go|rs|java|rb|cpp|cc|cxx)$/.test(
-    file
-  ) || /\.(test|spec)\.[cm]?[jt]sx?$/.test(file) || /(^|\/)test_.*\.py$/.test(file) || /_test\.go$/.test(file) || /(^|\/)test_.*\.(cpp|cc|cxx)$/.test(file) || /_(test|tests)\.(cpp|cc|cxx)$/.test(file) || /Tests?\.(java|kt)$/.test(file) || /(_test|_spec)\.(rs|rb|php|swift|kt)$/.test(file);
-}
 function collectContentBasedCppTestFiles(repoPath, repoFiles) {
   const candidates = repoFiles.filter((file) => /\.(cpp|cc|cxx)$/.test(file) && !isTestFile(file)).slice(0, CPP_CONTENT_SCAN_LIMIT);
   return candidates.filter((file) => {
@@ -8095,7 +8171,6 @@ var JS_TEST_ASSERTION_PATTERN = /(expect\(|assert\.|should\.|toEqual\(|toBe\(|as
 var CPP_TEST_ASSERTION_PATTERN = /\bEXPECT_|ASSERT_EQ\b|ASSERT_TRUE\b|ASSERT_FALSE\b|\bREQUIRE\s*\(|\bCHECK\s*\(|\bTEST\s*\(|\bTEST_F\s*\(|\bTEST_CASE\s*\(|\bSECTION\s*\(/;
 var MULTI_ECOSYSTEM_TEST_ASSERTION_PATTERN = /\.assert[A-Z_]\w*\s*\(|\bassert[A-Z]\w*\s*\(|\bpytest\.raises\b|\bself\.fail\s*\(|\bt\.(?:Error|Errorf|Fatal|Fatalf|Fail|FailNow)\b|\brequire\.[A-Z]\w*\s*\(|\b(?:debug_)?assert(?:_eq|_ne)?!\s*\(|\bassert_\w+\b|\$this->assert\w+\s*\(/;
 var SUITE_LEVEL_SKIP_PATTERN = /\b(?:describe|suite|context)\.skip\s*\(/;
-var NAME_SHAPED_TEST_FILE_PATTERN = /\.(test|spec)\.[cm]?[jt]sx?$|(^|\/)__tests__\/|(^|\/)test_[^/]*\.py$|(^|\/)tests?\.py$|_test\.go$|(^|\/)test_[^/]*\.(cpp|cc|cxx)$|_(test|tests)\.(cpp|cc|cxx)$|Tests?\.(java|kt)$|(_test|_spec)\.(rs|rb|php|swift|kt)$/;
 function measureNonHollowTestShare(repoPath, files) {
   let nonHollowCount = 0;
   let ratedCount = 0;
@@ -8450,7 +8525,6 @@ function isExplicitDeployTarget(file) {
   return /^(vercel|netlify|fly|render|railway)\.(json|toml|ya?ml)$/.test(file) || /^docker-compose\.ya?ml$/.test(file) || /^Procfile$/.test(file) || /^app\.ya?ml$/.test(file) || /^serverless\.ya?ml$/.test(file) || /^(k8s|kubernetes|manifests?)\/.+\.ya?ml$/i.test(file) || /^(charts?|helm)\/.+\.ya?ml$/i.test(file);
 }
 var MAIN_ENTRYPOINT_FILE_PATTERN = /(^|\/)(main|server|app|wsgi|asgi|index|entry|start|run)\.(ts|tsx|js|jsx|mjs|cjs|py|go|rs)$/i;
-var EXAMPLE_OR_TEST_DIR_PATTERN = /(?:^|\/)(examples?|samples?|demos?|tests?|__tests__|spec|fixtures?)(?:\/|$)/i;
 var SERVER_ENTRYPOINT_PATTERN = /\bapp\.listen\s*\(|\bserver\.listen\s*\(\s*(?:PORT|port|\d+)|http\.ListenAndServe\s*\(|http\.ListenAndServeTLS\s*\(|axum::Server(?:::|\.)|actix_web::HttpServer(?:::|\.)|uvicorn\.run\s*\(/;
 var CI_DEPLOY_JOB_PATTERN = /(?:^\s{2,4}deploy\s*:|\b(?:fly|heroku|vercel|netlify|railway|render)\s+deploy\b|kubectl\s+apply\b|helm\s+(?:install|upgrade|deploy)\b|docker\s+push\b)/im;
 function isDeployableService(repoPath, repoFiles) {
@@ -8467,9 +8541,7 @@ function detectServerEntrypoint(repoPath, repoFiles) {
   return findServerEntrypointFile(repoPath, repoFiles) !== null;
 }
 function findServerEntrypointFile(repoPath, repoFiles) {
-  const candidates = repoFiles.filter(
-    (file) => MAIN_ENTRYPOINT_FILE_PATTERN.test(file) && !EXAMPLE_OR_TEST_DIR_PATTERN.test(file)
-  ).slice(0, 30);
+  const candidates = repoFiles.filter((file) => MAIN_ENTRYPOINT_FILE_PATTERN.test(file) && isProductionSourcePath(file)).slice(0, 30);
   return candidates.find((file) => fileContains(repoPath, file, SERVER_ENTRYPOINT_PATTERN)) ?? null;
 }
 function isHealthCheckSignalFile(repoPath, file) {
@@ -8818,6 +8890,17 @@ function evidenceForRelative(repoPath, path, kind, label) {
     } : {}
   };
 }
+function evidenceForRelativeAtLine(repoPath, path, kind, label, line) {
+  const fullPath = join3(repoPath, path);
+  const contents = isRegularFile(fullPath) ? readFileSync6(fullPath, "utf8") : "";
+  return {
+    kind,
+    label,
+    path,
+    line,
+    ...contents ? { contentHash: createHash("sha256").update(contents).digest("hex") } : {}
+  };
+}
 function metric(name, label, value, max, weight, unit, description, kind) {
   return {
     name,

package/dist/index.js

@@ -5,7 +5,7 @@ import {
   renderWitanBadgeSvg,
   renderWitanHtmlReport,
   runCejelScan
-} from "./chunk-MBYVOPJR.js";
+} from "./chunk-QQVCIG4N.js";
 
 // src/index.ts
 import { mkdirSync, readFileSync, realpathSync, writeFileSync } from "fs";

package/dist/mcp/index.js

@@ -10,7 +10,7 @@ import {
   renderWitanBadgeSvg,
   renderWitanHtmlReport,
   runCejelScan
-} from "../chunk-MBYVOPJR.js";
+} from "../chunk-QQVCIG4N.js";
 
 // ../../node_modules/.pnpm/ajv@8.20.0/node_modules/ajv/dist/compile/codegen/code.js
 var require_code = __commonJS({

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@cejel/cejel",
-  "version": "0.1.2",
+  "version": "0.1.3",
   "publishConfig": {
     "access": "public"
   },