@produtype/core 0.4.0 → 0.5.0

package/README.md

@@ -45,6 +45,17 @@ npm install -g @produtype/core
 prodkit analyze .
 ```
 
+The MCP server needs one extra package, and only if you use it:
+
+```bash
+npm install @modelcontextprotocol/sdk   # for prodkit-mcp
+```
+
+It is an optional peer dependency rather than a dependency because it brings 164
+packages with it — nine tenths of what this package used to install — for a server most
+people never run, along with network, shell and eval access that the analyzer itself
+does not use. Installing this package alone brings 19.
+
 The command is `prodkit`; the package is `@produtype/core`. They differ on purpose:
 `prodkit` on npm is an unrelated and actively maintained package, so this one is
 published under the `@produtype` scope. `npm i prodkit` installs somebody else's

package/dist/analyzer/analyzeProject.js

@@ -374,10 +374,18 @@ async function analyzeProject(projectPath) {
      * group and artifact, without the version — because every rule downstream asks which
      * library is used, never which release of it.
      *
-     * Version catalogs (`libs.androidx.core.ktx`) are deliberately not resolved. They
-     * name an alias defined in a TOML file, and following it would mean a second reader
-     * for a second format to learn the same fact; a project using them reports fewer
-     * libraries rather than wrong ones.
+     * Version catalogs are read too, from their own file rather than by following the
+     * alias. That decision was made the other way this morning and was wrong in
+     * practice: pointed at android/nowinandroid — Google's own sample, built to
+     * demonstrate offline-first — the analyzer reported no local database, because every
+     * module says `implementation(libs.room.runtime)` and the coordinates live in
+     * `gradle/libs.versions.toml`. Version catalogs are the recommended practice, so
+     * skipping them failed precisely on the projects that follow it.
+     *
+     * No alias resolution is needed: the catalog declares `group` and `name` outright.
+     * The cost is that a library declared in the catalog and used by no module is still
+     * reported, which is the direction to err in — the catalog is the project's own
+     * statement about what it builds with.
      */
     const gradleDeps = [];
     for (const file of allFiles.filter((f) => /(^|\/)build\.gradle(\.kts)?$/.test(f))) {
@@ -388,6 +396,23 @@ async function analyzeProject(projectPath) {
                 gradleDeps.push(`${group}:${artifact}`.toLowerCase());
         }
     }
+    for (const file of allFiles.filter((f) => /(^|\/)libs\.versions\.toml$/.test(f))) {
+        const raw = (await (0, readTextFileSafe_1.readTextFileSafe)(root, file)) ?? '';
+        // Two spellings, both common: group and name as separate keys, or one `module`
+        // holding the coordinate. Order within the line varies, so each is matched on its
+        // own rather than as one pattern per line.
+        for (const line of raw.split('\n')) {
+            const module = /module\s*=\s*["']([^"':]+):([^"']+)["']/.exec(line);
+            if (module) {
+                gradleDeps.push(`${module[1]}:${module[2]}`.toLowerCase());
+                continue;
+            }
+            const group = /group\s*=\s*["']([^"']+)["']/.exec(line);
+            const name = /\bname\s*=\s*["']([^"']+)["']/.exec(line);
+            if (group && name)
+                gradleDeps.push(`${group[1]}:${name[1]}`.toLowerCase());
+        }
+    }
     /**
      * Swift packages, from Package.swift and the Podfile.
      *

package/dist/mcp/server.d.ts

@@ -1,3 +1,3 @@
-import { McpServer } from '@modelcontextprotocol/sdk/server/mcp.js';
-export declare function createProdkitMcpServer(): McpServer;
+import type { McpServer } from '@modelcontextprotocol/sdk/server/mcp.js';
+export declare function createProdkitMcpServer(): Promise<McpServer>;
 export declare function startProdkitMcpServer(): Promise<void>;

package/dist/mcp/server.js

@@ -2,8 +2,6 @@
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.createProdkitMcpServer = createProdkitMcpServer;
 exports.startProdkitMcpServer = startProdkitMcpServer;
-const mcp_js_1 = require("@modelcontextprotocol/sdk/server/mcp.js");
-const stdio_js_1 = require("@modelcontextprotocol/sdk/server/stdio.js");
 const zod_1 = require("zod");
 const analyzeProject_1 = require("../analyzer/analyzeProject");
 const buildReport_1 = require("../report/buildReport");
@@ -36,8 +34,36 @@ function errorResult(error) {
         content: [{ type: 'text', text: `ProdKit could not analyse that path: ${message}` }],
     };
 }
-function createProdkitMcpServer() {
-    const server = new mcp_js_1.McpServer({ name: 'prodkit', version: version_1.PRODKit_VERSION });
+/**
+ * The MCP SDK, loaded when the server starts rather than when this package is imported.
+ *
+ * It was a plain dependency, and it brought 164 of this package's 183 installed
+ * packages with it — so everyone installing the analyzer as a library or a CLI paid
+ * for a server they may never run, and inherited its supply-chain surface: network,
+ * shell and eval, none of which the analyzer itself does.
+ *
+ * The same shape the AI layer uses for the Anthropic SDK: a variable specifier so the
+ * TypeScript build does not need it, a webpackIgnore hint so a bundler does not try to
+ * resolve it, and an error that says exactly what to install when it is absent.
+ */
+const SDK_MCP = '@modelcontextprotocol/sdk/server/mcp.js';
+const SDK_STDIO = '@modelcontextprotocol/sdk/server/stdio.js';
+async function loadMcpSdk() {
+    try {
+        const [mcp, stdio] = await Promise.all([
+            import(/* webpackIgnore: true */ SDK_MCP),
+            import(/* webpackIgnore: true */ SDK_STDIO),
+        ]);
+        return { McpServer: mcp.McpServer, StdioServerTransport: stdio.StdioServerTransport };
+    }
+    catch {
+        throw new Error('The MCP server needs the optional @modelcontextprotocol/sdk package. '
+            + 'Install it alongside this one: npm install @modelcontextprotocol/sdk');
+    }
+}
+async function createProdkitMcpServer() {
+    const { McpServer: Server } = await loadMcpSdk();
+    const server = new Server({ name: 'prodkit', version: version_1.PRODKit_VERSION });
     server.registerTool('list_profiles', {
         title: 'List product profiles',
         description: 'Lists the product profiles ProdKit can evaluate a repository against, with the capabilities each one expects.',
@@ -150,6 +176,7 @@ function createProdkitMcpServer() {
     return server;
 }
 async function startProdkitMcpServer() {
-    const server = createProdkitMcpServer();
-    await server.connect(new stdio_js_1.StdioServerTransport());
+    const { StdioServerTransport } = await loadMcpSdk();
+    const server = await createProdkitMcpServer();
+    await server.connect(new StdioServerTransport());
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@produtype/core",
-  "version": "0.4.0",
+  "version": "0.5.0",
   "description": "Deterministic CLI and library that analyzes a web application repository and reports how far it is from production-ready for the kind of product it is meant to be.",
   "license": "MIT",
   "bin": {
@@ -43,12 +43,20 @@
     "node": ">=18"
   },
   "dependencies": {
-    "@modelcontextprotocol/sdk": "^1.30.0",
     "commander": "^12.1.0",
     "fast-glob": "^3.3.2",
     "zod": "^3.23.8"
   },
+  "peerDependencies": {
+    "@modelcontextprotocol/sdk": "^1.30.0"
+  },
+  "peerDependenciesMeta": {
+    "@modelcontextprotocol/sdk": {
+      "optional": true
+    }
+  },
   "devDependencies": {
+    "@modelcontextprotocol/sdk": "^1.30.0",
     "@types/node": "^22.20.3",
     "@typescript-eslint/eslint-plugin": "^7.16.0",
     "@typescript-eslint/parser": "^7.16.0",