@produtype/core 0.2.2 → 0.3.0

package/README.md

@@ -4,7 +4,7 @@ ProdKit is a deterministic local CLI that analyzes an existing web application r
 
 It is designed for early-stage and AI-generated apps where architecture and security quality can vary significantly.
 
-ProdKit MVP is read-only: it never modifies the target repository.
+ProdKit is read-only: it never modifies the target repository.
 
 ## What ProdKit does
 
@@ -110,11 +110,13 @@ Optional AI layer:
 - **A separate package.** The AI features live in `@produtype/ai`, which is commercial
   and is not a dependency of this package. An open source install runs the
   deterministic analysis only, and `--ai` reports that the package is not installed
-  rather than failing.
+  rather than failing. That package brings its own model access; nothing needs to be
+  configured here to run the analysis.
 - ProdKit stays deterministic, offline, and read-only: nothing here makes a network
   call.
-- They require an `ANTHROPIC_API_KEY` and the optional `@anthropic-ai/sdk` package (`npm install @anthropic-ai/sdk`). Without them, the deterministic analysis is unaffected.
-- Repository content is redacted of secrets before anything is sent, and AI output is advisory only — it never changes the deterministic score.
+- When `@produtype/ai` is installed, it redacts secrets from repository content before
+  sending anything, and its output stays advisory — it never changes the deterministic
+  score.
 
 Profile warning:
 
@@ -145,145 +147,43 @@ prodkit plan ../my-app --format json
 prodkit plan ../my-app --output prodkit-plan.md
 ```
 
-## Supported stacks in MVP
+## Supported stacks
 
-- Backend: Express, NestJS, Fastify, Next.js (Node); Django, FastAPI, Flask (Python)
-- Frontend: React, Vue, Svelte, Angular, Nuxt, Vite
+- **Backend (Node):** Express, Next.js, NestJS, Fastify, Hono, Elysia, Koa, AdonisJS,
+  SvelteKit, Remix, Nuxt, Nitro
+- **Backend (Python):** Django, FastAPI, Flask, Litestar, Starlette, Sanic, Tornado,
+  aiohttp
+- **Frontend:** React, Vue, Svelte, Angular, Solid, Qwik, Preact, Astro, Nuxt, Remix,
+  Vite, Tailwind, htmx
+- **Databases:** Postgres, MySQL, SQLite, MongoDB, Redis
+- **Hosted data platforms:** Supabase, Firebase, Neon, PlanetScale, Vercel Postgres,
+  Turso, Upstash, DynamoDB, Convex
+- **ORMs:** Prisma, Drizzle, TypeORM, Sequelize, Knex, MikroORM, Kysely, SQLAlchemy,
+  Tortoise, Peewee
 - Generic unknown app fallback
 
-## Acceptance commands
+Two of these distinctions are deliberate rather than incidental.
 
-```bash
-npm install
-npm run build
-npm test
-npm link
-prodkit analyze tests/fixtures/express-basic --format markdown
-prodkit analyze tests/fixtures/express-basic --format json
-prodkit analyze tests/fixtures/express-basic --output report.md
-prodkit plan tests/fixtures/express-basic
-prodkit plan tests/fixtures/express-basic --format json
-prodkit plan tests/fixtures/express-basic --output prodkit-plan.md
-```
+A hosted platform is recorded separately from the engine underneath it. Supabase is
+Postgres and Turso is SQLite, so rules written about an engine keep working without
+knowing about the host, while "this data lives on infrastructure someone else
+operates" stays a question the report can ask on its own.
+
+Astro counts as a backend only when it is configured to serve requests — `output` set
+to `server` or `hybrid`, or an adapter installed. A static Astro site is a static
+site, and is not marked down for missing the things an application needs.
 
 ## Current limitations
 
-- Deterministic heuristics only, with no AI explanation layer yet
+- Deterministic heuristics only: the AI layer is a separate package (see above)
 - Signal-based stack coverage across common Node/Python/JS frameworks + fallback
 - Signal-based detection can produce false positives/negatives
 - Plan output is deterministic and read-only only
-- No cloud dashboard/UI in MVP
+- No cloud dashboard or UI: this package is the CLI and the library
 
 ## Roadmap
 
-1. Deterministic analyzer
-2. Deterministic remediation planning
-3. AI explanation layer
-4. Apply/generate PRs
-5. Cloud GitHub integration
-6. Framework adapters
-7. Dashboard
-
-## Project layout
-
-```text
-prodkit/
-  package.json
-  tsconfig.json
-  README.md
-  src/
-    index.ts
-    cli.ts
-    analyzer/
-    planner/
-    rules/
-    report/
-    utils/
-  tests/
-    fixtures/
-    analyzer.test.ts
-    report.test.ts
-    planner.test.ts
-```
-
-## GitHub Action
-
-Gate a pull request on production readiness:
-
-```yaml
-- uses: denisbilli/prodkit@main
-  with:
-    profile: b2b-saas
-    fail-under: "65"
-```
-
-Inputs: `path`, `profile`, `fail-under`, `min-maturity`, `comment-summary`.
-Outputs: `score`, `maturity`, `launch-ready`.
-
-The executive summary is written to the job summary even when the thresholds fail the
-job — a check that fails without saying why is worse than no check at all.
-
-Requires the package to be published; until then, point the action at a local
-checkout.
-
-## MCP server
-
-ProdKit ships an MCP server so an agent can assess a repository without leaving the
-editor. It exposes the deterministic analysis only, makes no network calls, and the
-code being analysed never leaves the machine.
-
-Tools: `analyze_project`, `plan_remediation`, `compare_profiles`, `list_profiles`.
-
-ProdKit is not on npm yet — the name `prodkit` is taken by an unrelated package — so
-install it from a local checkout:
-
-```bash
-npm install && npm run build && npm link
-```
-
-Claude Code:
-
-```bash
-claude mcp add prodkit -- prodkit-mcp
-```
-
-Or, in a client that reads a JSON config:
-
-```json
-{
-  "mcpServers": {
-    "prodkit": {
-      "command": "prodkit-mcp"
-    }
-  }
-}
-```
-
-`compare_profiles` is the one to reach for first: it scores the same repository
-against every product profile in a single call, which is the question ProdKit exists
-to answer.
-
-## Releases
-
-Published from CI on a version tag, with
-[npm provenance](https://docs.npmjs.com/generating-provenance-statements): the tarball
-is cryptographically linked to the commit and the workflow run that produced it, so it
-can be verified rather than merely trusted. No publish token ever sits on a developer
-machine.
-
-To cut a release:
-
-```bash
-npm version patch   # or minor / major — commits and tags
-git push --follow-tags
-```
-
-The workflow refuses to publish if the tag and `package.json` disagree, and runs a
-check that the commercial AI layer is absent from `dist` before anything leaves.
-Release notes are generated from the commits since the previous tag.
-
-## License
-
-
+Shipped: the deterministic analyzer, deterministic remediation planning, and the
+optional AI layer as `@produtype/ai`.
 
-MIT
+Next: applying fixes as generated pull requests, and a hosted GitHub integration.

package/dist/analyzer/analyzeProject.js

@@ -42,6 +42,7 @@ const detectPackageManager_1 = require("./detectPackageManager");
 const detectFrontend_1 = require("./detectFrontend");
 const detectBackend_1 = require("./detectBackend");
 const detectDatabase_1 = require("./detectDatabase");
+const detectAudit_1 = require("./detectAudit");
 const detectDocker_1 = require("./detectDocker");
 const detectEnv_1 = require("./detectEnv");
 const detectAuth_1 = require("./detectAuth");
@@ -301,7 +302,7 @@ async function analyzeProject(projectPath) {
         npmDeps,
         workspaces,
     };
-    const [pm, frontend, backend, database, docker, env, auth, security, uploads, gdpr, billing, observability, jobs, marketplace, aiSafety, engagement, deployment] = await Promise.all([
+    const [pm, frontend, backend, database, docker, env, auth, security, uploads, gdpr, billing, observability, jobs, marketplace, aiSafety, engagement, deployment, audit] = await Promise.all([
         (0, detectPackageManager_1.detectPackageManager)(ctx),
         (0, detectFrontend_1.detectFrontend)(ctx),
         (0, detectBackend_1.detectBackend)(ctx),
@@ -319,12 +320,15 @@ async function analyzeProject(projectPath) {
         (0, detectAiSafety_1.detectAiSafety)(ctx),
         (0, detectNotifications_1.detectEngagement)(ctx),
         (0, detectDeployment_1.detectDeployment)(ctx),
+        (0, detectAudit_1.detectAudit)(ctx),
     ]);
     const detectors = (0, detectStack_1.mergeDetectors)([
         pm.result,
         frontend.result,
         backend.result,
         database.result,
+        ...database.extra,
+        audit,
         docker,
         ...env,
         ...auth,
@@ -346,6 +350,8 @@ async function analyzeProject(projectPath) {
             frontend: frontend.frameworks,
             backend: backend.frameworks,
             databases: database.databases,
+            dataPlatforms: database.extra.find((d) => d.key === 'stack.dataPlatform')?.details?.platforms ?? [],
+            orms: database.extra.find((d) => d.key === 'stack.orm')?.details?.orms ?? [],
             packageManager: pm.manager,
             packageManagerConfidence: pm.confidence,
             warnings: pm.warnings,

package/dist/analyzer/detectAiSafety.js

@@ -69,6 +69,26 @@ async function detectPromptSafety(ctx) {
         },
     };
 }
+/**
+ * Whether this product calls a model at all.
+ *
+ * Kept separate from the two safety checks because it answers a different question.
+ * Those ask whether an AI product is built safely; this one asks whether it is an AI
+ * product, which is what decides the profile it gets judged against — and profile
+ * inference was working it out by matching words like "model" and "prompt" against
+ * the evidence strings of the billing, API-key and background-job detectors. A
+ * dependency on a model SDK is the thing itself rather than a trace of it.
+ */
+function detectModelProvider(ctx) {
+    const deps = modelDependencies(ctx);
+    return {
+        key: 'ai.modelProvider',
+        present: deps.length > 0,
+        evidence: deps.map((dep) => ({ type: 'dependency', value: dep })),
+        details: { providers: deps },
+    };
+}
 async function detectAiSafety(ctx) {
-    return Promise.all([detectCostControl(ctx), detectPromptSafety(ctx)]);
+    const [costControl, promptSafety] = await Promise.all([detectCostControl(ctx), detectPromptSafety(ctx)]);
+    return [costControl, promptSafety, detectModelProvider(ctx)];
 }

package/dist/analyzer/detectAudit.d.ts

@@ -0,0 +1,3 @@
+import type { DetectorResult } from './types';
+import type { DetectContext } from './detectContext';
+export declare function detectAudit(ctx: DetectContext): Promise<DetectorResult>;

package/dist/analyzer/detectAudit.js

@@ -0,0 +1,62 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.detectAudit = detectAudit;
+const detectContext_1 = require("./detectContext");
+const textSearch_1 = require("../utils/textSearch");
+/**
+ * A durable record of who did what.
+ *
+ * This is not observability, and conflating the two was the bug this replaces:
+ * `audit.baseline` was evaluated from structured logging and a request id, which
+ * answer "can we debug this?" rather than "can we say, months later, who deleted that
+ * organisation?". Logs rotate; an audit trail is meant not to.
+ *
+ * Two kinds of evidence, in order of strength. A place to keep the record — a table or
+ * a model whose name says what it is — and calls that write to it. A table with
+ * nothing writing to it is a good intention; writes with no durable store behind them
+ * are log lines.
+ */
+const AUDIT_DEPS = ['audit-log', '@casl/ability', 'express-winston'];
+const AUDIT_PY_DEPS = ['django-auditlog', 'django-simple-history', 'sqlalchemy-continuum'];
+/** A table or model that exists to hold the record. */
+const AUDIT_STORE = [
+    /CREATE\s+TABLE\s+(?:IF\s+NOT\s+EXISTS\s+)?["'`]?\w*audit\w*/i,
+    /\bmodel\s+\w*Audit\w*\s*\{/i,
+    /class\s+\w*Audit(?:Log|Event|Trail)\w*\b/i,
+    /\b(audit_events?|audit_logs?|auditlog|audit_trail)\b/i,
+];
+/** Calls that write an entry. */
+const AUDIT_WRITE = [
+    /\b(record|write|log|create|append|emit)[A-Z_]?\w*audit\w*\s*\(/i,
+    /\baudit[._]?(log|event|trail)\s*\(/i,
+    /\bauditLog\s*\(/,
+    /\blog_audit\b/i,
+];
+async function detectAudit(ctx) {
+    const evidence = [];
+    const deps = [...(0, detectContext_1.hasAnyDep)(ctx, AUDIT_DEPS), ...(0, detectContext_1.hasAnyPyDep)(ctx, AUDIT_PY_DEPS)];
+    for (const dep of deps)
+        evidence.push({ type: 'dependency', value: dep });
+    // Schema and migration files are where a store is declared, and the analyzer
+    // classifies them as neither source nor config, so they are taken from `all`.
+    const schemaFiles = ctx.files.all.filter((file) => /(^|\/)(schema\.prisma|.*schema\.[cm]?[jt]s|.*\.sql)$/i.test(file));
+    const storeHits = await (0, textSearch_1.searchInFiles)(ctx.root, [...ctx.files.source, ...schemaFiles], AUDIT_STORE, 15);
+    for (const hit of storeHits) {
+        evidence.push({ type: 'snippet', value: hit.snippet, file: hit.file, line: hit.line });
+    }
+    const writeHits = await (0, textSearch_1.searchInFiles)(ctx.root, ctx.files.source, AUDIT_WRITE, 15);
+    for (const hit of writeHits) {
+        evidence.push({ type: 'snippet', value: hit.snippet, file: hit.file, line: hit.line });
+    }
+    const hasStore = storeHits.length > 0 || deps.length > 0;
+    const hasWrites = writeHits.length > 0;
+    // `complete` is what lets the expectation say `present` rather than `partial`: a
+    // store that is written to is a working audit trail, and either half alone is not.
+    return {
+        key: 'audit.trail',
+        present: hasStore || hasWrites,
+        complete: hasStore && hasWrites,
+        evidence,
+        details: { store: hasStore, writes: hasWrites, writeSites: writeHits.length },
+    };
+}

package/dist/analyzer/detectBackend.js

@@ -3,6 +3,7 @@ Object.defineProperty(exports, "__esModule", { value: true });
 exports.detectBackend = detectBackend;
 const detectContext_1 = require("./detectContext");
 const textSearch_1 = require("../utils/textSearch");
+const readTextFileSafe_1 = require("../utils/readTextFileSafe");
 async function detectBackend(ctx) {
     const frameworks = [];
     const evidence = [];
@@ -21,10 +22,25 @@ async function detectBackend(ctx) {
         }
     }
     // Node backend frameworks detected purely from dependencies.
+    //
+    // SvelteKit, Remix and Nuxt appear here as well as in the frontend detector, and
+    // that is not a mistake: they serve their own routes, so a repository built on one
+    // has a backend to be judged even though it also has a UI. Treating them as
+    // frontend-only meant an application with server routes, sessions and database
+    // access was scored as though it had none of them.
     const nodeFrameworkDeps = [
         ['next', 'next'],
         ['nestjs', '@nestjs/core'],
         ['fastify', 'fastify'],
+        ['hono', 'hono'],
+        ['elysia', 'elysia'],
+        ['koa', 'koa'],
+        ['adonis', '@adonisjs/core'],
+        ['sveltekit', '@sveltejs/kit'],
+        ['remix', '@remix-run/node'],
+        ['remix', '@remix-run/server-runtime'],
+        ['nuxt', 'nuxt'],
+        ['nitro', 'nitropack'],
     ];
     for (const [framework, dep] of nodeFrameworkDeps) {
         if ((0, detectContext_1.hasDep)(ctx, dep)) {
@@ -32,6 +48,46 @@ async function detectBackend(ctx) {
             evidence.push({ type: 'dependency', value: dep });
         }
     }
+    /**
+     * Astro, which is a backend only when it is configured to be one.
+     *
+     * Astro builds a static site by default and becomes a server when `output` is set
+     * to `server` or `hybrid`, or when an adapter is installed. Listing it as a backend
+     * unconditionally would be worse than not listing it at all: this tool scores a
+     * project against what its kind of product is expected to have, so a static
+     * brochure site would start being marked down for missing sessions, tenant
+     * isolation and an audit trail it has no reason to want.
+     */
+    if ((0, detectContext_1.hasDep)(ctx, 'astro')) {
+        const configFile = ctx.files.all.find((f) => /(^|\/)astro\.config\.[cm]?[jt]s$/.test(f));
+        const config = configFile ? ((await (0, readTextFileSafe_1.readTextFileSafe)(ctx.root, configFile)) ?? '') : '';
+        const servesRequests = /output\s*:\s*['"](?:server|hybrid)['"]/.test(config)
+            || /adapter\s*:/.test(config)
+            || ctx.files.all.some((f) => /(^|\/)src\/pages\/api\//.test(f));
+        if (servesRequests) {
+            frameworks.push('astro');
+            evidence.push({
+                type: configFile ? 'file' : 'dependency',
+                value: configFile ? `astro configured to serve requests (${configFile})` : 'astro',
+                ...(configFile ? { file: configFile } : {}),
+            });
+        }
+    }
+    // Python backend frameworks detected purely from dependencies. Django, Flask and
+    // FastAPI have their own blocks below because each also has a source-level fallback.
+    const pyFrameworkDeps = [
+        ['litestar', 'litestar'],
+        ['sanic', 'sanic'],
+        ['tornado', 'tornado'],
+        ['aiohttp', 'aiohttp'],
+        ['starlette', 'starlette'],
+    ];
+    for (const [framework, dep] of pyFrameworkDeps) {
+        if ((0, detectContext_1.hasPyDep)(ctx, dep)) {
+            frameworks.push(framework);
+            evidence.push({ type: 'dependency', value: dep });
+        }
+    }
     // Flask
     if ((0, detectContext_1.hasPyDep)(ctx, 'flask')) {
         frameworks.push('flask');

package/dist/analyzer/detectBilling.js

@@ -28,8 +28,57 @@ async function detectBilling(ctx) {
             /router\.post\(\s*['"][^'"]*webhook/i,
         ], 40)
         : [];
+    /**
+     * Routes that exist as a file path rather than as a string in the code.
+     *
+     * The patterns above all look for the URL written out somewhere — `app.post('/webhook')`
+     * and its relatives. In a file-system-routed framework the URL is never written
+     * anywhere: `src/app/api/stripe/webhook/route.ts` IS the route. That covers the
+     * Next.js App Router, Remix, SvelteKit, Nuxt and Astro, so the check reported "no
+     * webhook route" for a correctly verified webhook and marked the whole control
+     * partial.
+     *
+     * A `webhook` path segment is required, not a substring, so `webhooks.test.ts`
+     * beside a handler does not count as a route on its own.
+     */
+    const webhookPathHits = hasStrongStripeSignal
+        ? ctx.files.source.filter((file) => /(?:^|\/)webhooks?(?:\/|\.[cm]?[jt]sx?$)/i.test(file))
+        : [];
+    /**
+     * Reading the body without letting a JSON parser touch it first.
+     *
+     * This used to look for `express.raw(` and `req.rawBody` and nothing else, which
+     * made the check Express-only. A Stripe signature covers the exact bytes that were
+     * sent, so every framework has an idiom for this, and outside Express none of them
+     * mention "raw": a Web-standard handler (Next.js route handlers, Remix, SvelteKit,
+     * Hono, Bun, Deno, Cloudflare Workers) awaits `request.text()`, Django reads
+     * `request.body`, FastAPI awaits `request.body()`, Flask calls
+     * `request.get_data()`. Next.js is the most common stack among the repositories
+     * this tool is pointed at, so the omission failed the case it meets most often —
+     * and it failed it quietly, reporting `partial` on a webhook that was correctly
+     * verified.
+     *
+     * The Web-standard patterns are anchored to a request identifier rather than
+     * matching `.text()` anywhere: a `.text()` on a fetch *response* is a different
+     * thing entirely and is conventionally held in `res` or `response`.
+     */
     const rawBodyHits = hasStrongStripeSignal
-        ? await (0, textSearch_1.searchInFiles)(ctx.root, ctx.files.source, [/express\.raw\(/i, /req\.rawBody/i], 20)
+        ? await (0, textSearch_1.searchInFiles)(ctx.root, ctx.files.source, [
+            // Express, and the body-parser spelling of the same thing.
+            /express\.raw\(/i,
+            /bodyParser\.raw\(/i,
+            /\braw_?[bB]ody\b/,
+            /getRawBody\(/i,
+            // Web-standard Request: Next.js route handlers, Remix, SvelteKit, Hono,
+            // Bun, Deno, Cloudflare Workers.
+            /\b(?:request|req)\.(?:text|arrayBuffer|blob)\(\s*\)/,
+            // Python: Django, FastAPI, Flask.
+            /\brequest\.body\b/,
+            /\brequest\.get_data\(/,
+            /\bawait\s+request\.body\(\s*\)/,
+            // Go's net/http.
+            /io\.ReadAll\(\s*r\.Body\s*\)/,
+        ], 20)
         : [];
     const secretHits = hasStrongStripeSignal
         ? await (0, textSearch_1.searchInFiles)(ctx.root, ctx.files.source, [/STRIPE_WEBHOOK_SECRET/i, /stripeWebhookSecret/i], 20)
@@ -45,6 +94,9 @@ async function detectBilling(ctx) {
     for (const m of [...stripeContextHits, ...webhookRouteHits, ...rawBodyHits, ...secretHits, ...signatureHits]) {
         evidence.push({ type: 'snippet', value: m.snippet, file: m.file, line: m.line });
     }
+    for (const file of webhookPathHits) {
+        evidence.push({ type: 'file', value: file, file });
+    }
     return [
         {
             key: 'billing.stripe',
@@ -56,8 +108,11 @@ async function detectBilling(ctx) {
         },
         {
             key: 'billing.webhook.route',
-            present: webhookRouteHits.length > 0,
-            evidence: toEvidence(webhookRouteHits),
+            present: webhookRouteHits.length > 0 || webhookPathHits.length > 0,
+            evidence: [
+                ...toEvidence(webhookRouteHits),
+                ...webhookPathHits.map((file) => ({ type: 'file', value: file, file })),
+            ],
         },
         {
             key: 'billing.webhook.rawBody',

package/dist/analyzer/detectDatabase.d.ts

@@ -2,5 +2,6 @@ import type { DetectorResult } from './types';
 import { type DetectContext } from './detectContext';
 export declare function detectDatabase(ctx: DetectContext): Promise<{
     result: DetectorResult;
+    extra: DetectorResult[];
     databases: string[];
 }>;

package/dist/analyzer/detectDatabase.js

@@ -3,6 +3,65 @@ Object.defineProperty(exports, "__esModule", { value: true });
 exports.detectDatabase = detectDatabase;
 const detectContext_1 = require("./detectContext");
 const readTextFileSafe_1 = require("../utils/readTextFileSafe");
+/**
+ * Managed data platforms, and the engine each one actually is.
+ *
+ * A repository built with an AI tool often has no database driver at all: the whole
+ * data layer is a hosted service reached over HTTP. Read only for drivers, the
+ * analyzer reported "Detected databases: unknown" for an app whose data layer was
+ * perfectly clear — the first line of the report telling the reader the tool had not
+ * understood their project. Supabase, the default in Lovable, Bolt and v0, was the
+ * most common case of it.
+ *
+ * The engine matters as much as the platform: Supabase is Postgres and Turso is
+ * SQLite, so rules written about an engine keep working without knowing about the
+ * host. The platform is recorded separately, because whether the data sits on
+ * infrastructure someone else operates is its own question for a readiness report.
+ */
+const MANAGED_PLATFORMS = [
+    {
+        platform: 'supabase',
+        engine: 'postgres',
+        npm: ['@supabase/supabase-js', '@supabase/ssr', '@supabase/auth-helpers-nextjs', '@supabase/postgrest-js'],
+        py: ['supabase', 'supabase-py'],
+    },
+    { platform: 'firebase', engine: 'firestore', npm: ['firebase', 'firebase-admin', '@angular/fire'], py: ['firebase-admin'] },
+    { platform: 'planetscale', engine: 'mysql', npm: ['@planetscale/database'], py: [] },
+    { platform: 'neon', engine: 'postgres', npm: ['@neondatabase/serverless'], py: [] },
+    { platform: 'vercel-postgres', engine: 'postgres', npm: ['@vercel/postgres'], py: [] },
+    { platform: 'turso', engine: 'sqlite', npm: ['@libsql/client', 'libsql'], py: ['libsql-client'] },
+    { platform: 'upstash', engine: 'redis', npm: ['@upstash/redis'], py: ['upstash-redis'] },
+    { platform: 'dynamodb', engine: 'dynamodb', npm: ['@aws-sdk/client-dynamodb', 'dynamoose'], py: [] },
+    { platform: 'convex', engine: 'convex', npm: ['convex'], py: [] },
+];
+/**
+ * Object-relational mappers. These prove there is a data layer without naming the
+ * engine, so they are recorded on their own key; where the engine is written in a
+ * schema file, it is read from there below.
+ */
+const ORMS = [
+    { orm: 'prisma', npm: ['@prisma/client', 'prisma'], py: [] },
+    { orm: 'drizzle', npm: ['drizzle-orm'], py: [] },
+    { orm: 'typeorm', npm: ['typeorm'], py: [] },
+    { orm: 'sequelize', npm: ['sequelize'], py: [] },
+    { orm: 'knex', npm: ['knex'], py: [] },
+    { orm: 'mikro-orm', npm: ['@mikro-orm/core'], py: [] },
+    { orm: 'kysely', npm: ['kysely'], py: [] },
+    { orm: 'sqlalchemy', npm: [], py: ['sqlalchemy', 'alembic'] },
+    { orm: 'tortoise', npm: [], py: ['tortoise-orm'] },
+    { orm: 'peewee', npm: [], py: ['peewee'] },
+];
+/** Prisma and Drizzle both write the engine into a config file; this reads it. */
+const SCHEMA_ENGINES = [
+    [/provider\s*=\s*['"]postgresql['"]/i, 'postgres'],
+    [/provider\s*=\s*['"]mysql['"]/i, 'mysql'],
+    [/provider\s*=\s*['"]sqlite['"]/i, 'sqlite'],
+    [/provider\s*=\s*['"]mongodb['"]/i, 'mongodb'],
+    [/provider\s*=\s*['"]cockroachdb['"]/i, 'postgres'],
+    [/dialect\s*:\s*['"]postgresql['"]/i, 'postgres'],
+    [/dialect\s*:\s*['"]mysql['"]/i, 'mysql'],
+    [/dialect\s*:\s*['"]sqlite['"]/i, 'sqlite'],
+];
 async function detectDatabase(ctx) {
     const databases = new Set();
     const evidence = [];
@@ -64,14 +123,64 @@ async function detectDatabase(ctx) {
     }
     // DATABASE_URL env reference
     // (kept lightweight; not adding DB type from this alone)
+    const platforms = new Set();
+    const platformEvidence = [];
+    for (const entry of MANAGED_PLATFORMS) {
+        const hits = [...(0, detectContext_1.hasAnyDep)(ctx, entry.npm), ...(0, detectContext_1.hasAnyPyDep)(ctx, entry.py)];
+        if (!hits.length)
+            continue;
+        platforms.add(entry.platform);
+        if (entry.engine)
+            databases.add(entry.engine);
+        for (const h of hits)
+            platformEvidence.push({ type: 'dependency', value: h });
+    }
+    const orms = new Set();
+    const ormEvidence = [];
+    for (const entry of ORMS) {
+        const hits = [...(0, detectContext_1.hasAnyDep)(ctx, entry.npm), ...(0, detectContext_1.hasAnyPyDep)(ctx, entry.py)];
+        if (!hits.length)
+            continue;
+        orms.add(entry.orm);
+        for (const h of hits)
+            ormEvidence.push({ type: 'dependency', value: h });
+    }
+    // The ORM names the engine in its own schema, which is more reliable than guessing
+    // from a driver that a project using an ORM often does not depend on directly.
+    const schemaFiles = ctx.files.all.filter((f) => /(^|\/)schema\.prisma$/.test(f) || /(^|\/)drizzle\.config\.[cm]?[jt]s$/.test(f));
+    for (const file of schemaFiles) {
+        const text = (await (0, readTextFileSafe_1.readTextFileSafe)(ctx.root, file)) ?? '';
+        for (const [pattern, engine] of SCHEMA_ENGINES) {
+            if (!pattern.test(text))
+                continue;
+            databases.add(engine);
+            ormEvidence.push({ type: 'file', value: `${engine} declared in ${file}`, file });
+        }
+    }
     const dbs = Array.from(databases);
+    const platformList = Array.from(platforms);
+    const ormList = Array.from(orms);
     return {
         databases: dbs,
         result: {
             key: 'stack.database',
             present: dbs.length > 0,
-            evidence,
+            evidence: [...evidence, ...platformEvidence, ...ormEvidence],
             details: { databases: dbs },
         },
+        extra: [
+            {
+                key: 'stack.dataPlatform',
+                present: platformList.length > 0,
+                evidence: platformEvidence,
+                details: { platforms: platformList },
+            },
+            {
+                key: 'stack.orm',
+                present: ormList.length > 0,
+                evidence: ormEvidence,
+                details: { orms: ormList },
+            },
+        ],
     };
 }

package/dist/analyzer/detectEnv.js

@@ -5,6 +5,12 @@ const textSearch_1 = require("../utils/textSearch");
 const WEAK_SECRET_VALUE_RE = /(changeme|your[_-]?secret|fallback-secret(?:-change-in-production)?|change[_-]in[_-]production|your_jwt_secret_key_change_in_production|local[-_]?secret|development[-_]?secret|dev[-_]?secret|not[_-]?for[_-]?production|test123|secret)/i;
 const FALLBACK_SECRET_RE = /(jwt_secret|secret_key|session_secret)\s*[:=]\s*['"][^'"]*(changeme|your[_-]?secret|fallback-secret(?:-change-in-production)?|change[_-]in[_-]production|your_jwt_secret_key_change_in_production|local[-_]?secret|development[-_]?secret|dev[-_]?secret|not[_-]?for[_-]?production|test123|secret)[^'"]*['"]/i;
 const ENV_FALLBACK_RE = /(process\.env\.(JWT_SECRET|SECRET_KEY|SESSION_SECRET)\s*(\|\||\?\?)\s*['"][^'"]*(changeme|your[_-]?secret|fallback-secret(?:-change-in-production)?|change[_-]in[_-]production|your_jwt_secret_key_change_in_production|local[-_]?secret|development[-_]?secret|dev[-_]?secret|not[_-]?for[_-]?production|test123|secret)[^'"]*['"])/i;
+/**
+ * The identifier being assigned has to be a secret. Belt and braces with the anchored
+ * patterns above: a future pattern added to that list cannot reintroduce the problem
+ * of a snippet qualifying on the word "secret" appearing anywhere in it.
+ */
+const SECRET_ASSIGNMENT_CONTEXT_RE = /(JWT_SECRET|SECRET_KEY|SESSION_SECRET|API_KEY|jwt_secret|secret_key|session_secret|api_key)\s*[:=]|process\.env\.[A-Z0-9_]*(SECRET|API_KEY)/;
 const GENERIC_SECRET_ASSIGNMENT_RE = /(JWT_SECRET|SECRET_KEY|SESSION_SECRET|API_KEY)\s*[:=]\s*['"][^'"]+['"]/i;
 function classifySecretFallback(snippet) {
     if (/JWT_SECRET/i.test(snippet))
@@ -38,8 +44,25 @@ async function detectEnv(ctx) {
     for (const m of envReads) {
         evidence.push({ type: 'snippet', value: m.snippet, file: m.file, line: m.line });
     }
-    const fallbackHits = await (0, textSearch_1.searchInFiles)(ctx.root, sourceFiles, [FALLBACK_SECRET_RE, ENV_FALLBACK_RE, /\|\|\s*['"][^'"]+['"]/i, /\?\?\s*['"][^'"]+['"]/i, GENERIC_SECRET_ASSIGNMENT_RE], 30);
-    const weakHits = fallbackHits.filter((m) => WEAK_SECRET_VALUE_RE.test(m.snippet));
+    /**
+     * Only patterns that name a secret. The list used to include a bare
+     * `|| 'anything'` and `?? 'anything'`, which match every nullish default in every
+     * codebase and carry no signal about secrets at all. What qualified such a line as
+     * weak was WEAK_SECRET_VALUE_RE, and that matches the bare word `secret` — so any
+     * line holding a default and the word "secret" anywhere in it was reported.
+     *
+     * That produced `critical`, the loudest severity there is, and one it caps maturity
+     * with. It fired on this very repository, on the string that describes the check;
+     * it would fire the same way on an interface label, a translation file, or any
+     * application with a "secret question" feature. For a product whose pitch is that
+     * every point traces back to a rule and a file you can open, a critical pointing at
+     * a sentence about secrets is the worst possible first impression.
+     *
+     * The three remaining patterns each anchor on a secret-named identifier, which is
+     * the thing actually being claimed.
+     */
+    const fallbackHits = await (0, textSearch_1.searchInFiles)(ctx.root, sourceFiles, [FALLBACK_SECRET_RE, ENV_FALLBACK_RE, GENERIC_SECRET_ASSIGNMENT_RE], 30);
+    const weakHits = fallbackHits.filter((m) => WEAK_SECRET_VALUE_RE.test(m.snippet) && SECRET_ASSIGNMENT_CONTEXT_RE.test(m.snippet));
     for (const m of weakHits) {
         const hitEvidence = { type: 'snippet', value: m.snippet, file: m.file, line: m.line };
         evidence.push(hitEvidence);

package/dist/analyzer/detectFrontend.js

@@ -23,6 +23,12 @@ async function detectFrontend(ctx) {
         ['nuxt', ['nuxt']],
         ['svelte', ['svelte', '@sveltejs/kit']],
         ['angular', ['@angular/core']],
+        ['astro', ['astro']],
+        ['solid', ['solid-js']],
+        ['qwik', ['@builder.io/qwik']],
+        ['preact', ['preact']],
+        ['remix', ['@remix-run/react']],
+        ['htmx', ['htmx.org']],
     ];
     for (const [framework, names] of frameworkDeps) {
         const hits = (0, detectContext_1.hasAnyDep)(ctx, names);

package/dist/analyzer/detectJobs.js

@@ -3,28 +3,135 @@ Object.defineProperty(exports, "__esModule", { value: true });
 exports.detectJobs = detectJobs;
 const detectContext_1 = require("./detectContext");
 const textSearch_1 = require("../utils/textSearch");
+const readTextFileSafe_1 = require("../utils/readTextFileSafe");
+/**
+ * Work that happens outside a request.
+ *
+ * `present` used to be satisfied by a bare /queue/i, /worker/i or /cron/i anywhere in
+ * any source file. That matches a breadth-first search holding a `queue`, a browser
+ * `Worker` in frontend code, and the word "cron" in a comment. Measured: a pirate game
+ * was reported as having background jobs because of
+ * `queue: deque[tuple[int, int]] = deque()` in a flood fill, and that single signal was
+ * then enough to have the whole project judged as an AI SaaS.
+ *
+ * Presence now needs something declared rather than mentioned: a dependency on a queue
+ * or scheduler, or a job actually being defined. The loose terms are still collected,
+ * because they are useful context in a report — but context is all they are, and they
+ * no longer decide the answer.
+ */
+const QUEUE_DEPS = [
+    'bull',
+    'bullmq',
+    'node-cron',
+    'agenda',
+    'bee-queue',
+    'kue',
+    'pg-boss',
+    'graphile-worker',
+    'inngest',
+    '@trigger.dev/sdk',
+    '@temporalio/client',
+    '@temporalio/worker',
+    'quirrel',
+    'croner',
+];
+const QUEUE_PY_DEPS = [
+    'celery',
+    'apscheduler',
+    'rq',
+    'dramatiq',
+    'huey',
+    'arq',
+    'prefect',
+    'apache-airflow',
+    'django-q',
+];
+/**
+ * A job being defined. Each of these is a call or a decorator, so none of them match
+ * the word appearing in prose or in an unrelated identifier.
+ *
+ * `new Worker(` is deliberately absent: the browser spells a Web Worker exactly that
+ * way, and a Web Worker is not a background job. Where a queue library is in use, its
+ * dependency has already answered the question.
+ */
+const JOB_DECLARATIONS = [
+    /new\s+Queue\s*\(/,
+    /createQueue\s*\(/,
+    /cron\.schedule\s*\(/,
+    /CronJob\s*\(/,
+    /@shared_task\b/,
+    /@(?:celery|app)\.task\b/,
+    /@periodic_task\b/,
+    /defineJob\s*\(/,
+    /\bschedule\.every\s*\(/,
+    /add_periodic_task\s*\(/,
+];
+/**
+ * A long-running process declared outside the code.
+ *
+ * Not every background worker uses a library. Ours does not: it polls Postgres with
+ * FOR UPDATE SKIP LOCKED and has no queue dependency and no decorator to find. What it
+ * does have — what any shipped worker has — is somewhere that says a second process
+ * exists: a script that starts it, and a service that runs it. Those are declarations
+ * too, and structural ones.
+ *
+ * Requiring the library was a false negative on this product's own repository, which
+ * is a good sign a rule is wrong.
+ */
+const PROCESS_NAME = /^(worker|jobs?|queue|scheduler|cron|consumer)(:|-|_|$)/i;
+/** Files whose name says they hold out-of-request work. */
+const WORKER_FILE = /(^|\/)(workers?|jobs|queues?|tasks)(\/|\.[cm]?[jt]sx?$|\.py$)/i;
 async function detectJobs(ctx) {
     const evidence = [];
-    const nodeDeps = (0, detectContext_1.hasAnyDep)(ctx, ['bull', 'bullmq', 'node-cron', 'agenda']);
-    const pyDeps = (0, detectContext_1.hasAnyPyDep)(ctx, ['celery', 'apscheduler', 'rq']);
-    for (const d of nodeDeps)
-        evidence.push({ type: 'dependency', value: d });
-    for (const d of pyDeps)
-        evidence.push({ type: 'dependency', value: d });
-    const workerFiles = ctx.files.all.filter((f) => /(workers?\/|worker\.|tasks\.py|backup|cleanup)/i.test(f)).slice(0, 20);
-    for (const f of workerFiles)
-        evidence.push({ type: 'file', value: f });
-    const hits = await (0, textSearch_1.searchInFiles)(ctx.root, ctx.files.source, [/queue/i, /worker/i, /cron/i, /celery/i], 20);
-    for (const h of hits)
-        evidence.push({ type: 'snippet', value: h.snippet, file: h.file, line: h.line });
+    const nodeDeps = (0, detectContext_1.hasAnyDep)(ctx, QUEUE_DEPS);
+    const pyDeps = (0, detectContext_1.hasAnyPyDep)(ctx, QUEUE_PY_DEPS);
+    for (const dep of [...nodeDeps, ...pyDeps])
+        evidence.push({ type: 'dependency', value: dep });
+    const workerFiles = ctx.files.all.filter((file) => WORKER_FILE.test(file)).slice(0, 20);
+    for (const file of workerFiles)
+        evidence.push({ type: 'file', value: file, file });
+    // A script that starts a separate process.
+    const scripts = ctx.packageJson?.scripts ?? {};
+    const processScripts = Object.keys(scripts).filter((name) => PROCESS_NAME.test(name) || /(^|\/)workers?\//i.test(String(scripts[name] ?? '')));
+    for (const name of processScripts) {
+        evidence.push({ type: 'note', value: `package.json script "${name}" starts a separate process` });
+    }
+    // A compose service that runs one.
+    const composeFile = ctx.files.all.find((file) => /(^|\/)(docker-compose\.ya?ml|compose\.ya?ml)$/.test(file));
+    const composeText = composeFile ? ((await (0, readTextFileSafe_1.readTextFileSafe)(ctx.root, composeFile)) ?? '') : '';
+    const composeWorker = /^\s{2}(worker|jobs?|scheduler|cron|consumer)[a-z0-9_-]*:/im.test(composeText);
+    if (composeWorker && composeFile) {
+        evidence.push({ type: 'file', value: 'a worker service in compose', file: composeFile });
+    }
+    const declarations = await (0, textSearch_1.searchInFiles)(ctx.root, ctx.files.source, JOB_DECLARATIONS, 20);
+    for (const hit of declarations) {
+        evidence.push({ type: 'snippet', value: hit.snippet, file: hit.file, line: hit.line });
+    }
+    // Collected for the reader, never to decide. A report that says "background jobs
+    // detected" and shows only a variable called `queue` has told the reader nothing
+    // they can act on.
+    const mentions = await (0, textSearch_1.searchInFiles)(ctx.root, ctx.files.source, [/\bqueue\b/i, /\bworker\b/i, /\bcron\b/i], 10);
+    for (const hit of mentions) {
+        evidence.push({ type: 'snippet', value: hit.snippet, file: hit.file, line: hit.line });
+    }
+    const declared = nodeDeps.length > 0
+        || pyDeps.length > 0
+        || declarations.length > 0
+        || processScripts.length > 0
+        || composeWorker;
     return {
         key: 'jobs.background',
-        present: nodeDeps.length > 0 || pyDeps.length > 0 || workerFiles.length > 0 || hits.length > 0,
+        // A file named `workers/` is only taken as proof alongside something declared in
+        // the code: the name is a convention, and conventions are borrowed.
+        present: declared,
         evidence,
         details: {
             nodeQueue: nodeDeps.length > 0,
             pythonQueue: pyDeps.length > 0,
             workerFiles: workerFiles.length,
+            declarations: declarations.length,
+            processScripts: processScripts.length,
+            composeWorker,
         },
     };
 }

package/dist/analyzer/detectStack.d.ts

@@ -4,6 +4,8 @@ export declare function buildStackInfo(input: {
     frontend: string[];
     backend: string[];
     databases: string[];
+    dataPlatforms?: string[];
+    orms?: string[];
     packageManager: StackInfo['packageManager'];
     packageManagerConfidence: StackInfo['packageManagerConfidence'];
     warnings: string[];

package/dist/analyzer/detectStack.js

@@ -21,6 +21,8 @@ function buildStackInfo(input) {
         frontend: unique(input.frontend),
         backend: unique(input.backend),
         databases: unique(input.databases),
+        dataPlatforms: unique(input.dataPlatforms ?? []),
+        orms: unique(input.orms ?? []),
         packageManager: input.packageManager,
         packageManagerConfidence: input.packageManagerConfidence,
         warnings: unique(input.warnings),

package/dist/analyzer/types.d.ts

@@ -13,6 +13,13 @@ export interface StackInfo {
     frontend: string[];
     backend: string[];
     databases: string[];
+    /**
+     * Hosted data services: ['supabase'], ['firebase']. Separate from `databases`,
+     * which holds the engine — Supabase appears in both, as 'supabase' here and
+     * 'postgres' there, because it is both.
+     */
+    dataPlatforms: string[];
+    orms: string[];
     languages: string[];
     packageManager: PackageManager;
     packageManagerConfidence: PackageManagerConfidence;

package/dist/cli.js

@@ -117,6 +117,13 @@ function summarize(report) {
         `Detected frontend: ${report.detectedStack.frontend.join(', ') || 'unknown'}`,
         `Detected backend: ${report.detectedStack.backend.join(', ') || 'unknown'}`,
         `Detected databases: ${report.detectedStack.databases.join(', ') || 'unknown'}`,
+        // Named on their own line rather than folded into the databases list. A reader
+        // whose data layer is entirely Supabase needs to see that the tool recognised
+        // Supabase, not only that it worked out the engine underneath is Postgres.
+        ...(report.detectedStack.dataPlatforms.length > 0
+            ? [`Data platform: ${report.detectedStack.dataPlatforms.join(', ')}`]
+            : []),
+        ...(report.detectedStack.orms.length > 0 ? [`ORM: ${report.detectedStack.orms.join(', ')}`] : []),
         `Package manager: ${report.detectedStack.packageManager} (${report.detectedStack.packageManagerConfidence})`,
         report.detectedStack.warnings.length > 0 ? `Warnings: ${report.detectedStack.warnings.join('; ')}` : 'Warnings: none',
         `Workspaces: ${workspaceSummary}`,
@@ -206,8 +213,8 @@ async function runCli(argv = process.argv) {
         .option('--output <path>', 'Output file path (optional)')
         .option('--fail-under <score>', 'Exit with an error if overall score is below this threshold (0-100)')
         .option('--min-maturity <level>', `Exit with an error if maturity is below this level: ${maturityOrder.join('|')}`)
-        .option('--ai', 'Add an AI stack/architecture insight (opt-in; requires ANTHROPIC_API_KEY; advisory only)')
-        .option('--ai-review', 'Add an AI semantic code review of fine-grained issues (opt-in; requires ANTHROPIC_API_KEY; advisory only)')
+        .option('--ai', 'Add an AI stack/architecture insight (opt-in; requires @produtype/ai; advisory only)')
+        .option('--ai-review', 'Add an AI semantic code review of fine-grained issues (opt-in; requires @produtype/ai; advisory only)')
         .action(async (targetPath, options) => {
         const format = options.format === 'json' ? 'json' : 'markdown';
         const formatSpecified = typeof options.format === 'string';

package/dist/expectations/evaluateExpectations.js

@@ -140,12 +140,28 @@ function deriveStatus(analysis, capability) {
             return 'missing';
         }
         case 'audit.baseline': {
+            /**
+             * Read from the audit trail, not from the logs.
+             *
+             * This used to be decided by structured logging and a request id, which answer
+             * "can we debug this?" — a different question from "can we say, months later,
+             * who deleted that organisation?". Logs rotate; an audit trail is meant not to.
+             *
+             * It also could not return `present`. Both branches returned `partial`, so a
+             * project with a complete audit trail was marked down for it permanently, on a
+             * capability the b2b-saas profile asks for.
+             */
+            const trail = detector(analysis, 'audit.trail');
+            if (trail?.present && trail.complete)
+                return 'present';
+            if (trail?.present)
+                return 'partial';
+            // Structured logging with a request id is not an audit trail, but it is not
+            // nothing either: the events can often be reconstructed from it.
             const structured = boolDetail(obs, 'structuredLogging');
             const requestId = boolDetail(obs, 'requestId');
             if (structured && requestId)
                 return 'partial';
-            if (structured || requestId)
-                return 'partial';
             return 'missing';
         }
         case 'jobs.background': {

package/dist/expectations/inferProductProfile.js

@@ -10,18 +10,38 @@ function inferProductProfile(analysis) {
     const tenancy = analysis.detectors['tenancy.organization']?.present === true || analysis.detectors['tenancy.membership']?.present === true;
     const jobs = analysis.detectors['jobs.background']?.present === true;
     const uploads = analysis.detectors['uploads.exposure']?.present === true;
-    const aiEvidence = (analysis.detectors['billing.stripe']?.evidence ?? [])
-        .concat(analysis.detectors['auth.apiKeys']?.evidence ?? [])
-        .concat(analysis.detectors['jobs.background']?.evidence ?? [])
-        .some((e) => /openai|anthropic|claude|gemini|llm|transcrib|generation|prompt|model/i.test(e.value));
+    /**
+     * A dependency on a model SDK, not a word that suggests one.
+     *
+     * This used to match /openai|anthropic|claude|gemini|llm|transcrib|generation|prompt|model/
+     * against the evidence strings of the billing, API-key and background-job detectors.
+     * "model" is in every ORM, "generation" and "prompt" are ordinary English, and the
+     * strings being searched were written to describe something else entirely.
+     */
+    const callsAModel = analysis.detectors['ai.modelProvider']?.present === true;
     const sourceHints = analysis.files.source.join('\n');
     const marketplaceHints = /seller|buyer|vendor|listing|order/i.test(sourceHints);
     const adminHints = /admin|\/users|subscription|billing/i.test(sourceHints);
     if (frontendPresent && !backendPresent && !dbPresent && !auth) {
         return { inferredProfile: 'static-site', confidence: 'high', reason: 'Frontend-only structure with no backend/db/auth signals.' };
     }
-    if ((aiEvidence || jobs) && (uploads || backendPresent)) {
-        return { inferredProfile: 'ai-saas', confidence: 'medium', reason: 'AI/job/upload signals suggest AI SaaS workflow.' };
+    /**
+     * Background jobs used to be sufficient here, in `(aiEvidence || jobs)`. They are
+     * orthogonal: every serious application has a queue, and this branch sits second,
+     * ahead of b2b-saas, marketplace and b2c — so an ordinary application with a worker
+     * was judged against the most demanding profile in the catalogue, which accumulates
+     * roughly 185 points of expectation. The score came out wrong for a reason the
+     * reader had no way to see.
+     *
+     * Measured: of ten unrelated local repositories, five were called ai-saas. One was a
+     * pirate game, promoted on a local variable named `queue` in a flood fill.
+     */
+    if (callsAModel && (uploads || jobs || backendPresent)) {
+        return {
+            inferredProfile: 'ai-saas',
+            confidence: 'medium',
+            reason: 'A model SDK dependency with a backend or a processing pipeline.',
+        };
     }
     if (marketplaceHints && billing) {
         return { inferredProfile: 'marketplace', confidence: 'medium', reason: 'Marketplace vocabulary and billing signals detected.' };

package/dist/rules/rules.js

@@ -10,8 +10,26 @@ function statusFromFlags(present, complete) {
         return 'passed';
     return 'unknown';
 }
+/**
+ * `unknown` is not a severity, it is the absence of one.
+ *
+ * A rule that does not apply — the Django DEBUG check on an Express project, say —
+ * returned `unknown` while keeping the severity it would have had if it had applied.
+ * The JSON report therefore carried `severity: 'critical'` on a finding whose own
+ * evidence read "Django stack not detected", and a scan of a repository with no
+ * Python in it published three of them.
+ *
+ * Nothing shipped was misled: every consumer, in the CLI summary, the markdown report
+ * and the cloud, filters `status !== 'unknown'` alongside the severity. But that pair
+ * is written out in four separate places, and each one is a chance to write only half
+ * of it — which anyone reading the JSON from outside this repository, through the MCP
+ * server or the Action, would have no reason to know they had to do at all.
+ *
+ * Carrying `info` makes `severity === 'critical'` a safe question on its own. Scoring
+ * is unaffected: score.ts already skips `unknown` before it looks at severity.
+ */
 function sevForStatus(status, missing) {
-    return status === 'passed' ? 'info' : missing;
+    return status === 'passed' || status === 'unknown' ? 'info' : missing;
 }
 function detectorEvidence(evidence) {
     return evidence && evidence.length > 0 ? evidence : [{ type: 'note', value: 'no direct evidence captured' }];
@@ -69,8 +87,8 @@ exports.rules = [
                 title: 'Application stack fingerprint',
                 category: 'stack',
                 status,
-                severity: status === 'passed' ? 'info' : 'low',
-                description: hasStack ? 'ProdKit identified known stack signals.' : 'Stack is generic/unknown for this MVP.',
+                severity: sevForStatus(status, 'low'),
+                description: hasStack ? 'ProdKit identified known stack signals.' : 'Stack is generic or unknown to ProdKit.',
                 recommendation: hasStack
                     ? 'No action required.'
                     : 'Add explicit framework manifests or keep this as generic app baseline.',
@@ -96,7 +114,7 @@ exports.rules = [
                 title: 'Environment template file',
                 category: 'env',
                 status,
-                severity: status === 'passed' ? 'info' : 'medium',
+                severity: sevForStatus(status, 'medium'),
                 description: missing
                     ? 'The project reads environment variables but no .env.example was detected.'
                     : 'Environment template looks available or env usage was not detected.',
@@ -206,7 +224,7 @@ exports.rules = [
                 title: 'CORS origin restrictions',
                 category: 'security',
                 status,
-                severity: status === 'passed' ? 'info' : status === 'partial' ? 'high' : 'medium',
+                severity: status === 'partial' ? sevForStatus(status, 'high') : sevForStatus(status, 'medium'),
                 description: status === 'passed'
                     ? 'CORS appears configured with explicit origins.'
                     : status === 'partial'
@@ -232,7 +250,7 @@ exports.rules = [
                 title: 'Django DEBUG hardening',
                 category: 'security',
                 status,
-                severity: status === 'passed' ? 'info' : 'critical',
+                severity: sevForStatus(status, 'critical'),
                 description: !isDjango
                     ? 'Django stack not detected.'
                     : debugTrue
@@ -341,7 +359,7 @@ exports.rules = [
                 title: 'Authorization depth',
                 category: 'authz',
                 status,
-                severity: status === 'passed' ? 'info' : 'medium',
+                severity: sevForStatus(status, 'medium'),
                 description: status === 'passed'
                     ? 'Permission-level authorization signals detected.'
                     : status === 'partial'
@@ -372,7 +390,7 @@ exports.rules = [
                 title: 'Tenant and organization boundaries',
                 category: 'tenancy',
                 status,
-                severity: status === 'passed' ? 'info' : status === 'partial' ? 'medium' : 'high',
+                severity: status === 'partial' ? sevForStatus(status, 'medium') : sevForStatus(status, 'high'),
                 description: status === 'unknown'
                     ? (backendDetected
                         ? 'No B2B/SaaS signals detected.'

package/dist/utils/fileScanner.js

@@ -54,6 +54,22 @@ exports.DEFAULT_IGNORE = [
     '**/.turbo/**',
     '**/.cache/**',
     '**/.parcel-cache/**',
+    // Build output that is not literally called `dist`. A bundle is a copy of the
+    // source, so scanning it counts every signal twice and — worse — produces evidence
+    // pointing at a generated file. This product's promise is that a finding names a
+    // file you can open and argue with; `dist-worker/index.js:254` is not that. Found by
+    // analysing prodkit-cloud, whose worker bundle is emitted to `dist-worker/`.
+    '**/dist-*/**',
+    '**/out/**',
+    '**/.output/**',
+    '**/.svelte-kit/**',
+    '**/.astro/**',
+    '**/.nuxt/**',
+    '**/.vercel/**',
+    '**/.netlify/**',
+    '**/target/**',
+    '**/*.min.js',
+    '**/*.bundle.js',
     // Test fixtures are sample applications, often deliberately insecure, and they are
     // not the product. Scanning them makes a repository inherit the stack and the
     // defects of its own test data: prodkit analysing itself reported express, next,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@produtype/core",
-  "version": "0.2.2",
+  "version": "0.3.0",
   "description": "Deterministic CLI and library that analyzes a web application repository and reports how far it is from production-ready for the kind of product it is meant to be.",
   "license": "MIT",
   "bin": {