@produtype/core 0.24.0 → 0.25.0

package/dist/analyzer/analyzeProject.d.ts

@@ -1,2 +1,16 @@
 import type { ProjectAnalysis } from './types';
+/**
+ * A path that is not there is not an empty repository.
+ *
+ * This check lived in the command-line tool alone, so every other caller — the MCP
+ * server an assistant drives, the hosted application, anyone using this as a library —
+ * got a report for a directory that does not exist: score 39, "no frontend, backend or
+ * database stack signals were detected", which reads as a verdict on a repository rather
+ * than a typo in a path. The command-line tool refused the same input outright.
+ *
+ * The guard belongs where the work starts, so every surface refuses it the same way.
+ */
+export declare class ProjectPathError extends Error {
+    constructor(message: string);
+}
 export declare function analyzeProject(projectPath: string): Promise<ProjectAnalysis>;

package/dist/analyzer/analyzeProject.js

@@ -33,6 +33,7 @@ var __importStar = (this && this.__importStar) || (function () {
     };
 })();
 Object.defineProperty(exports, "__esModule", { value: true });
+exports.ProjectPathError = void 0;
 exports.analyzeProject = analyzeProject;
 const detectPackaging_1 = require("./detectPackaging");
 const importedDependencies_1 = require("./importedDependencies");
@@ -63,6 +64,7 @@ const detectAiSafety_1 = require("./detectAiSafety");
 const detectNotifications_1 = require("./detectNotifications");
 const detectDeployment_1 = require("./detectDeployment");
 const detectStack_1 = require("./detectStack");
+const promises_1 = require("node:fs/promises");
 const packageJsonSchema = zod_1.z
     .object({
     name: zod_1.z.string().optional(),
@@ -283,8 +285,39 @@ function resolveWorkspacePackageManager(workspace) {
         return { manager: 'pip', confidence: 'manifest', warnings: [] };
     return { manager: 'unknown', confidence: 'unknown', warnings: [] };
 }
+/**
+ * A path that is not there is not an empty repository.
+ *
+ * This check lived in the command-line tool alone, so every other caller — the MCP
+ * server an assistant drives, the hosted application, anyone using this as a library —
+ * got a report for a directory that does not exist: score 39, "no frontend, backend or
+ * database stack signals were detected", which reads as a verdict on a repository rather
+ * than a typo in a path. The command-line tool refused the same input outright.
+ *
+ * The guard belongs where the work starts, so every surface refuses it the same way.
+ */
+class ProjectPathError extends Error {
+    constructor(message) {
+        super(message);
+        this.name = 'ProjectPathError';
+    }
+}
+exports.ProjectPathError = ProjectPathError;
+async function assertReadableDirectory(root) {
+    let stats;
+    try {
+        stats = await (0, promises_1.stat)(root);
+    }
+    catch {
+        throw new ProjectPathError(`Project path does not exist: ${root}`);
+    }
+    if (!stats.isDirectory()) {
+        throw new ProjectPathError(`Project path is not a directory: ${root}`);
+    }
+}
 async function analyzeProject(projectPath) {
     const root = path.resolve(projectPath);
+    await assertReadableDirectory(root);
     const allFiles = await (0, fileScanner_1.scanFiles)({ cwd: root });
     const sourceFiles = pickSource(allFiles);
     const configFiles = pickConfig(allFiles);

package/dist/mcp/server.js

@@ -96,12 +96,40 @@ async function createProdkitMcpServer() {
                 categoryScores: report.categoryScores,
                 compliance: report.compliance,
                 detectedStack: report.detectedStack,
-                criticalIssues: report.criticalIssues.map((finding) => ({
+                /**
+                 * Every finding, not only the critical ones.
+                 *
+                 * This returned `criticalIssues` alone, and most repositories have none — so an
+                 * assistant asking for a report was handed a score, a summary and an empty
+                 * list, while the category table beside it showed six areas with work
+                 * outstanding. The findings are what the report is; the rest describes them.
+                 */
+                findings: report.findings
+                    .filter((finding) => finding.status !== 'passed' && finding.status !== 'unknown')
+                    .map((finding) => ({
                     id: finding.id,
                     title: finding.title,
+                    category: finding.category,
                     severity: finding.severity,
+                    status: finding.status,
+                    confidence: finding.confidence,
+                    description: finding.description,
                     businessImpact: finding.businessImpact,
                     recommendation: finding.recommendation,
+                    /**
+                     * The lines behind the claim, which is the thing this product is for.
+                     *
+                     * Nothing on this surface could show one: an assistant could say "your
+                     * secrets have a fallback" and not where. Trimmed to three, because a
+                     * model reading twenty-five copies of the same import learns nothing the
+                     * first one did not tell it.
+                     */
+                    evidence: finding.evidence.slice(0, 3).map((item) => ({
+                        type: item.type,
+                        value: item.value,
+                        ...(item.file ? { file: item.file } : {}),
+                        ...(item.line ? { line: item.line } : {}),
+                    })),
                 })),
                 gap: report.productProfile?.gap,
             });

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@produtype/core",
-  "version": "0.24.0",
+  "version": "0.25.0",
   "description": "Deterministic CLI and library that analyzes a web application repository and reports how far it is from production-ready for the kind of product it is meant to be.",
   "license": "MIT",
   "bin": {