@produtype/core 0.4.0 → 0.6.0

package/README.md

@@ -45,6 +45,17 @@ npm install -g @produtype/core
 prodkit analyze .
 ```
 
+The MCP server needs one extra package, and only if you use it:
+
+```bash
+npm install @modelcontextprotocol/sdk   # for prodkit-mcp
+```
+
+It is an optional peer dependency rather than a dependency because it brings 164
+packages with it — nine tenths of what this package used to install — for a server most
+people never run, along with network, shell and eval access that the analyzer itself
+does not use. Installing this package alone brings 19.
+
 The command is `prodkit`; the package is `@produtype/core`. They differ on purpose:
 `prodkit` on npm is an unrelated and actively maintained package, so this one is
 published under the `@produtype` scope. `npm i prodkit` installs somebody else's

package/dist/analyzer/analyzeProject.js

@@ -374,10 +374,18 @@ async function analyzeProject(projectPath) {
      * group and artifact, without the version — because every rule downstream asks which
      * library is used, never which release of it.
      *
-     * Version catalogs (`libs.androidx.core.ktx`) are deliberately not resolved. They
-     * name an alias defined in a TOML file, and following it would mean a second reader
-     * for a second format to learn the same fact; a project using them reports fewer
-     * libraries rather than wrong ones.
+     * Version catalogs are read too, from their own file rather than by following the
+     * alias. That decision was made the other way this morning and was wrong in
+     * practice: pointed at android/nowinandroid — Google's own sample, built to
+     * demonstrate offline-first — the analyzer reported no local database, because every
+     * module says `implementation(libs.room.runtime)` and the coordinates live in
+     * `gradle/libs.versions.toml`. Version catalogs are the recommended practice, so
+     * skipping them failed precisely on the projects that follow it.
+     *
+     * No alias resolution is needed: the catalog declares `group` and `name` outright.
+     * The cost is that a library declared in the catalog and used by no module is still
+     * reported, which is the direction to err in — the catalog is the project's own
+     * statement about what it builds with.
      */
     const gradleDeps = [];
     for (const file of allFiles.filter((f) => /(^|\/)build\.gradle(\.kts)?$/.test(f))) {
@@ -388,6 +396,23 @@ async function analyzeProject(projectPath) {
                 gradleDeps.push(`${group}:${artifact}`.toLowerCase());
         }
     }
+    for (const file of allFiles.filter((f) => /(^|\/)libs\.versions\.toml$/.test(f))) {
+        const raw = (await (0, readTextFileSafe_1.readTextFileSafe)(root, file)) ?? '';
+        // Two spellings, both common: group and name as separate keys, or one `module`
+        // holding the coordinate. Order within the line varies, so each is matched on its
+        // own rather than as one pattern per line.
+        for (const line of raw.split('\n')) {
+            const module = /module\s*=\s*["']([^"':]+):([^"']+)["']/.exec(line);
+            if (module) {
+                gradleDeps.push(`${module[1]}:${module[2]}`.toLowerCase());
+                continue;
+            }
+            const group = /group\s*=\s*["']([^"']+)["']/.exec(line);
+            const name = /\bname\s*=\s*["']([^"']+)["']/.exec(line);
+            if (group && name)
+                gradleDeps.push(`${group[1]}:${name[1]}`.toLowerCase());
+        }
+    }
     /**
      * Swift packages, from Package.swift and the Podfile.
      *

package/dist/api.d.ts

@@ -11,7 +11,7 @@ export type { ProductionReadinessReport, Finding, MaturityLevel, ReportDiagnosti
 export type { CategoryScore } from './report/categoryScores';
 export type { ExecutiveSummary } from './report/executiveSummary';
 export type { ComplianceObligation, ComplianceFramework } from './report/complianceMapping';
-export type { CapabilityGap } from './expectations/types';
+export type { CapabilityGap, DeclaredIntent } from './expectations/types';
 export type { FindingConfidence, EvidenceQuality } from './report/types';
 export type { RemediationPlan, RemediationTask, RemediationPhase } from './planner/types';
 export type { BuildReportOptions } from './report/buildReport';

package/dist/expectations/evaluateExpectations.d.ts

@@ -1,9 +1,10 @@
 import type { ProjectAnalysis } from '../analyzer/types';
-import type { ExpectationEvaluationOutput, ProductProfile } from './types';
+import type { DeclaredIntent, ExpectationEvaluationOutput, ProductProfile } from './types';
 export declare function evaluateExpectedCapabilities(args: {
     analysis: ProjectAnalysis;
     selectedProfile: Exclude<ProductProfile, 'auto' | 'observed-only'>;
     requestedProfile: ProductProfile;
     inferredProfile?: ProductProfile;
     inferenceConfidence?: 'low' | 'medium' | 'high';
+    declared?: DeclaredIntent;
 }): ExpectationEvaluationOutput;

package/dist/expectations/evaluateExpectations.js

@@ -300,6 +300,55 @@ function confidenceFor(status, profileMode, evidenceQuality) {
         return 'medium';
     return 'low';
 }
+/**
+ * Which capabilities each declaration makes required.
+ *
+ * One declaration usually implies several: saying you handle personal data is saying
+ * you owe consent, export, erasure and a retention position, not one of the four.
+ */
+const DECLARED_CAPABILITIES = {
+    handlesPersonalData: ['gdpr.consent', 'gdpr.export', 'gdpr.erasure', 'gdpr.retention'],
+    hasFileUploads: ['uploads.protection'],
+    requiresTenantIsolation: ['tenancy.organization', 'tenancy.isolation'],
+    hasBilling: ['billing.model', 'billing.webhook-integrity'],
+};
+const IMPORTANCE_RANK = {
+    not_applicable: 0,
+    optional: 1,
+    recommended: 2,
+    required: 3,
+};
+/**
+ * The profile's capabilities, with what the owner declared folded in.
+ *
+ * Raising only, never lowering, and adding a capability the profile does not carry
+ * when the declaration calls for it — a static site that says it takes payments is
+ * asking to be judged on payments, and the static-site profile has nothing to say
+ * about them.
+ */
+function applyDeclarations(capabilities, declared) {
+    if (!declared)
+        return capabilities;
+    const required = new Set();
+    for (const [key, ids] of Object.entries(DECLARED_CAPABILITIES)) {
+        // Only a `true` does anything. `false` is not evidence of absence, and treating it
+        // as such would let anyone switch a finding off by answering a form.
+        if (declared[key] === true)
+            for (const id of ids)
+                required.add(id);
+    }
+    if (required.size === 0)
+        return capabilities;
+    const out = capabilities.map((cap) => required.has(cap.id) && IMPORTANCE_RANK[cap.importance] < IMPORTANCE_RANK.required
+        ? { ...cap, importance: 'required' }
+        : cap);
+    const present = new Set(out.map((cap) => cap.id));
+    for (const id of required) {
+        if (!present.has(id))
+            out.push({ ...productProfiles_1.CAPABILITIES[id], importance: 'required' });
+    }
+    return out;
+}
 function evaluateExpectedCapabilities(args) {
     const profile = (0, productProfiles_1.getProductProfile)(args.selectedProfile);
     const evaluations = [];
@@ -329,7 +378,7 @@ function evaluateExpectedCapabilities(args) {
         recommendedPartial: 0,
     };
     const authDetected = detector(args.analysis, 'auth.core')?.present === true;
-    for (const cap of profile.capabilities) {
+    for (const cap of applyDeclarations(profile.capabilities, args.declared)) {
         let effectiveImportance = cap.importance;
         if (cap.id === 'gdpr.baseline' && profile.id === 'internal-tool' && !authDetected) {
             effectiveImportance = 'not_applicable';

package/dist/expectations/productProfiles.d.ts

@@ -16,7 +16,7 @@ type CapabilityBlueprint = Omit<ExpectedCapability, 'importance'>;
  * Every id here must have a case in `deriveStatus` in evaluateExpectations.ts,
  * otherwise it falls back to generic detectorKeys matching.
  */
-declare const CAPABILITIES: {
+export declare const CAPABILITIES: {
     readonly 'auth.baseline': CapabilityBlueprint;
     readonly 'auth.mfa': CapabilityBlueprint;
     readonly 'auth.password-reset': CapabilityBlueprint;

package/dist/expectations/productProfiles.js

@@ -1,6 +1,6 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.productProfiles = void 0;
+exports.productProfiles = exports.CAPABILITIES = void 0;
 exports.productProfileChoices = productProfileChoices;
 exports.getProductProfile = getProductProfile;
 function blueprint(args) {
@@ -17,7 +17,7 @@ function blueprint(args) {
  * Every id here must have a case in `deriveStatus` in evaluateExpectations.ts,
  * otherwise it falls back to generic detectorKeys matching.
  */
-const CAPABILITIES = {
+exports.CAPABILITIES = {
     'auth.baseline': blueprint({
         id: 'auth.baseline',
         title: 'Authentication baseline',
@@ -362,7 +362,7 @@ const CAPABILITIES = {
  */
 function defineProfile(args) {
     const capabilities = Object.entries(args.importance).map(([id, importance]) => ({
-        ...CAPABILITIES[id],
+        ...exports.CAPABILITIES[id],
         importance: importance,
     }));
     return {

package/dist/expectations/types.d.ts

@@ -4,6 +4,24 @@ export type ProductProfile = 'static-site' | 'internal-tool' | 'b2c-app' | 'b2b-
 export type CapabilityImportance = 'required' | 'recommended' | 'optional' | 'not_applicable';
 export type CapabilityStatus = 'present' | 'missing' | 'partial' | 'unknown' | 'not_applicable';
 export type CapabilityCategory = 'auth' | 'authz' | 'tenancy' | 'gdpr' | 'billing' | 'security' | 'uploads' | 'observability' | 'deployment' | 'audit' | 'jobs' | 'client' | 'mobile';
+/**
+ * What the owner says their product does, as distinct from what the code shows.
+ *
+ * A declaration can *add* a duty and can never remove one. Saying "we take payments"
+ * makes the billing capabilities required even where the profile treats them as
+ * optional and even where no Stripe call was found — the statement is evidence about
+ * intent, and a product that intends to charge people has to charge them safely.
+ *
+ * Saying "we have no file uploads" does nothing at all. If an upload route is in the
+ * code, the finding stands: otherwise this is a switch for turning problems off, and a
+ * score with an off switch measures the owner's optimism rather than the product.
+ */
+export interface DeclaredIntent {
+    handlesPersonalData?: boolean;
+    hasFileUploads?: boolean;
+    requiresTenantIsolation?: boolean;
+    hasBilling?: boolean;
+}
 export interface ExpectedCapability {
     id: string;
     title: string;

package/dist/mcp/server.d.ts

@@ -1,3 +1,3 @@
-import { McpServer } from '@modelcontextprotocol/sdk/server/mcp.js';
-export declare function createProdkitMcpServer(): McpServer;
+import type { McpServer } from '@modelcontextprotocol/sdk/server/mcp.js';
+export declare function createProdkitMcpServer(): Promise<McpServer>;
 export declare function startProdkitMcpServer(): Promise<void>;

package/dist/mcp/server.js

@@ -2,8 +2,6 @@
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.createProdkitMcpServer = createProdkitMcpServer;
 exports.startProdkitMcpServer = startProdkitMcpServer;
-const mcp_js_1 = require("@modelcontextprotocol/sdk/server/mcp.js");
-const stdio_js_1 = require("@modelcontextprotocol/sdk/server/stdio.js");
 const zod_1 = require("zod");
 const analyzeProject_1 = require("../analyzer/analyzeProject");
 const buildReport_1 = require("../report/buildReport");
@@ -36,8 +34,36 @@ function errorResult(error) {
         content: [{ type: 'text', text: `ProdKit could not analyse that path: ${message}` }],
     };
 }
-function createProdkitMcpServer() {
-    const server = new mcp_js_1.McpServer({ name: 'prodkit', version: version_1.PRODKit_VERSION });
+/**
+ * The MCP SDK, loaded when the server starts rather than when this package is imported.
+ *
+ * It was a plain dependency, and it brought 164 of this package's 183 installed
+ * packages with it — so everyone installing the analyzer as a library or a CLI paid
+ * for a server they may never run, and inherited its supply-chain surface: network,
+ * shell and eval, none of which the analyzer itself does.
+ *
+ * The same shape the AI layer uses for the Anthropic SDK: a variable specifier so the
+ * TypeScript build does not need it, a webpackIgnore hint so a bundler does not try to
+ * resolve it, and an error that says exactly what to install when it is absent.
+ */
+const SDK_MCP = '@modelcontextprotocol/sdk/server/mcp.js';
+const SDK_STDIO = '@modelcontextprotocol/sdk/server/stdio.js';
+async function loadMcpSdk() {
+    try {
+        const [mcp, stdio] = await Promise.all([
+            import(/* webpackIgnore: true */ SDK_MCP),
+            import(/* webpackIgnore: true */ SDK_STDIO),
+        ]);
+        return { McpServer: mcp.McpServer, StdioServerTransport: stdio.StdioServerTransport };
+    }
+    catch {
+        throw new Error('The MCP server needs the optional @modelcontextprotocol/sdk package. '
+            + 'Install it alongside this one: npm install @modelcontextprotocol/sdk');
+    }
+}
+async function createProdkitMcpServer() {
+    const { McpServer: Server } = await loadMcpSdk();
+    const server = new Server({ name: 'prodkit', version: version_1.PRODKit_VERSION });
     server.registerTool('list_profiles', {
         title: 'List product profiles',
         description: 'Lists the product profiles ProdKit can evaluate a repository against, with the capabilities each one expects.',
@@ -150,6 +176,7 @@ function createProdkitMcpServer() {
     return server;
 }
 async function startProdkitMcpServer() {
-    const server = createProdkitMcpServer();
-    await server.connect(new stdio_js_1.StdioServerTransport());
+    const { StdioServerTransport } = await loadMcpSdk();
+    const server = await createProdkitMcpServer();
+    await server.connect(new StdioServerTransport());
 }

package/dist/report/buildReport.d.ts

@@ -1,7 +1,16 @@
 import type { ProjectAnalysis } from '../analyzer/types';
 import type { ProductionReadinessReport } from './types';
-import type { ProductProfile } from '../expectations/types';
+import type { DeclaredIntent, ProductProfile } from '../expectations/types';
 export interface BuildReportOptions {
     profile?: ProductProfile;
+    /**
+     * What the owner says the product does.
+     *
+     * Only ever raises an expectation. The cloud application collects these four answers
+     * when a project is created, displayed them as "Product intent", and never passed
+     * them here — so the same report could say "file uploads: No" and raise a critical
+     * about file uploads.
+     */
+    declared?: DeclaredIntent;
 }
 export declare function buildReport(analysis: ProjectAnalysis, options?: BuildReportOptions): ProductionReadinessReport;

package/dist/report/buildReport.js

@@ -87,6 +87,7 @@ function buildReport(analysis, options) {
                     requestedProfile,
                     inferredProfile: inferred.inferredProfile ?? undefined,
                     inferenceConfidence: inferred.confidence,
+                    declared: options?.declared,
                 });
                 productProfile = evaluated.result;
                 expectationFindings = evaluated.findings;
@@ -98,6 +99,7 @@ function buildReport(analysis, options) {
                 analysis,
                 selectedProfile: requestedProfile,
                 requestedProfile,
+                declared: options?.declared,
             });
             productProfile = evaluated.result;
             expectationFindings = evaluated.findings;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@produtype/core",
-  "version": "0.4.0",
+  "version": "0.6.0",
   "description": "Deterministic CLI and library that analyzes a web application repository and reports how far it is from production-ready for the kind of product it is meant to be.",
   "license": "MIT",
   "bin": {
@@ -43,12 +43,20 @@
     "node": ">=18"
   },
   "dependencies": {
-    "@modelcontextprotocol/sdk": "^1.30.0",
     "commander": "^12.1.0",
     "fast-glob": "^3.3.2",
     "zod": "^3.23.8"
   },
+  "peerDependencies": {
+    "@modelcontextprotocol/sdk": "^1.30.0"
+  },
+  "peerDependenciesMeta": {
+    "@modelcontextprotocol/sdk": {
+      "optional": true
+    }
+  },
   "devDependencies": {
+    "@modelcontextprotocol/sdk": "^1.30.0",
     "@types/node": "^22.20.3",
     "@typescript-eslint/eslint-plugin": "^7.16.0",
     "@typescript-eslint/parser": "^7.16.0",