@produtype/core 0.43.0 → 0.45.0

package/dist/analyzer/detectAuth.js

@@ -334,7 +334,7 @@ async function detectAuth(ctx) {
         {
             key: 'auth.2fa',
             present: twoFaDeps.length > 0 || twoFaSignals.length > 0,
-            evidence: [...depEvidence(twoFaDeps), ...snippetEvidence(twoFaSignals)],
+            evidence: (0, absenceEvidence_1.evidenceOrSearch)([...depEvidence(twoFaDeps), ...snippetEvidence(twoFaSignals)], 'a second factor', ['otplib', 'speakeasy', 'notp', 'pyotp', 'django-otp', 'totp', 'authenticator app', 'webauthn', '@simplewebauthn']),
         },
         {
             key: 'auth.apiKeys',

package/dist/analyzer/detectBilling.js

@@ -129,25 +129,25 @@ async function detectBilling(ctx) {
         {
             key: 'billing.webhook.route',
             present: webhookRouteHits.length > 0 || webhookPathHits.length > 0,
-            evidence: [
+            evidence: (0, absenceEvidence_1.evidenceOrSearch)([
                 ...toEvidence(webhookRouteHits),
                 ...webhookPathHits.map((file) => ({ type: 'file', value: file, file })),
-            ],
+            ], 'a route the payment provider calls back', ['/webhook', '/webhooks/stripe', 'a file under a webhook directory']),
         },
         {
             key: 'billing.webhook.rawBody',
             present: rawBodyHits.length > 0,
-            evidence: toEvidence(rawBodyHits),
+            evidence: (0, absenceEvidence_1.evidenceOrSearch)(toEvidence(rawBodyHits), 'the unparsed body a signature is computed over', ['express.raw', 'bodyParser.raw', 'request.text()', 'rawBody', 'await req.arrayBuffer()']),
         },
         {
             key: 'billing.webhook.secret',
             present: secretHits.length > 0,
-            evidence: toEvidence(secretHits),
+            evidence: (0, absenceEvidence_1.evidenceOrSearch)(toEvidence(secretHits), 'the signing secret, read from configuration', ['STRIPE_WEBHOOK_SECRET', 'WEBHOOK_SIGNING_SECRET', 'whsec_']),
         },
         {
             key: 'billing.webhook.signatureValidation',
             present: signatureHits.length > 0,
-            evidence: toEvidence(signatureHits),
+            evidence: (0, absenceEvidence_1.evidenceOrSearch)(toEvidence(signatureHits), 'the signature being checked', ['constructEvent(', 'verifyHeader(', 'Webhook.constructEvent', 'stripe-signature']),
         },
     ];
 }

package/dist/analyzer/detectDocker.js

@@ -2,6 +2,7 @@
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.detectDocker = detectDocker;
 const readTextFileSafe_1 = require("../utils/readTextFileSafe");
+const absenceEvidence_1 = require("./absenceEvidence");
 async function detectDocker(ctx) {
     const evidence = [];
     const dockerfile = ctx.files.all.find((f) => /(^|\/)Dockerfile$/.test(f));
@@ -37,7 +38,7 @@ async function detectDocker(ctx) {
         key: 'infra.docker',
         present: Boolean(dockerfile || composeFile),
         complete: hasHealthcheck,
-        evidence,
+        evidence: (0, absenceEvidence_1.evidenceOrSearch)(evidence, 'a container definition', ['Dockerfile', 'Containerfile', 'docker-compose.yml', 'compose.yaml']),
         details: { dockerfile: Boolean(dockerfile), compose: Boolean(composeFile), hasHealthcheck, hasExpose, services },
     };
 }

package/dist/analyzer/detectJobs.js

@@ -4,6 +4,7 @@ exports.detectJobs = detectJobs;
 const detectContext_1 = require("./detectContext");
 const textSearch_1 = require("../utils/textSearch");
 const readTextFileSafe_1 = require("../utils/readTextFileSafe");
+const absenceEvidence_1 = require("./absenceEvidence");
 /**
  * Work that happens outside a request.
  *
@@ -124,7 +125,7 @@ async function detectJobs(ctx) {
         // A file named `workers/` is only taken as proof alongside something declared in
         // the code: the name is a convention, and conventions are borrowed.
         present: declared,
-        evidence,
+        evidence: (0, absenceEvidence_1.evidenceOrSearch)(evidence, 'work that happens outside a request', ['bullmq', 'bull', 'agenda', 'bee-queue', 'celery', 'rq', 'sidekiq', 'resque', 'graphile-worker', 'a cron schedule', 'a worker entrypoint']),
         details: {
             nodeQueue: nodeDeps.length > 0,
             pythonQueue: pyDeps.length > 0,

package/dist/analyzer/detectMobile.js

@@ -367,17 +367,17 @@ async function detectMobile(ctx) {
         {
             key: 'mobile.forcedUpdate',
             present: forcedUpdate.length > 0,
-            evidence: forcedUpdate.map((match) => ({
+            evidence: (0, absenceEvidence_1.evidenceOrSearch)(forcedUpdate.map((match) => ({
                 type: 'snippet',
                 value: match.snippet,
                 file: match.file,
                 line: match.line,
-            })),
+            })), 'a check that the installed version is still supported', ['minimumVersion', 'minSupportedVersion', 'forceUpdate', 'upgrade_required', 'in_app_update', 'AppUpdateManager']),
         },
         {
             key: 'mobile.privacyDeclaration',
             present: privacyFiles.length > 0,
-            evidence: privacyFiles.map((file) => ({ type: 'file', value: file, file })),
+            evidence: (0, absenceEvidence_1.evidenceOrSearch)(privacyFiles.map((file) => ({ type: 'file', value: file, file })), 'the privacy declaration the stores require', ['PrivacyInfo.xcprivacy', 'a data-safety declaration', 'privacy_policy', 'PRIVACY.md']),
         },
     ];
 }

package/dist/analyzer/detectPackaging.js

@@ -253,7 +253,7 @@ async function detectPackaging(ctx) {
             key: 'quality.ci',
             present: ciFiles.length > 0,
             complete: ciFiles.length > 0 && testFiles.length > 0,
-            evidence: ciFiles.map((file) => ({ type: 'file', value: file, file })),
+            evidence: (0, absenceEvidence_1.evidenceOrSearch)(ciFiles.map((file) => ({ type: 'file', value: file, file })), 'anything that runs the tests without being asked', ['.github/workflows/', '.gitlab-ci.yml', '.circleci/config.yml', 'azure-pipelines.yml', 'Jenkinsfile', '.travis.yml']),
             details: { files: ciFiles.length },
         },
     ];

package/dist/cli.js

@@ -98,7 +98,12 @@ function parseMinMaturity(value) {
     return value;
 }
 function enforceThresholds(report, failUnder, minMaturity) {
-    if (failUnder !== undefined && report.overallScore < failUnder) {
+    if (failUnder !== undefined && report.overallScore === null) {
+        // A gate asked for a number and there is none. Passing would say the project
+        // cleared a bar nobody measured it against.
+        throw new Error(`Score gate failed: this report has no score. ${report.inconclusiveReasons?.[0] ?? 'The reading was inconclusive.'}`);
+    }
+    if (failUnder !== undefined && report.overallScore !== null && report.overallScore < failUnder) {
         throw new Error(`Score gate failed: overall score ${report.overallScore} is below --fail-under ${failUnder}.`);
     }
     if (minMaturity !== undefined && maturityOrder.indexOf(report.maturityLevel) < maturityOrder.indexOf(minMaturity)) {
@@ -137,7 +142,7 @@ function summarize(report) {
         `Package manager: ${report.detectedStack.packageManager} (${report.detectedStack.packageManagerConfidence})`,
         report.detectedStack.warnings.length > 0 ? `Warnings: ${report.detectedStack.warnings.join('; ')}` : 'Warnings: none',
         `Workspaces: ${workspaceSummary}`,
-        `Score: ${report.overallScore}/100`,
+        report.overallScore === null ? 'Score: not scored' : `Score: ${report.overallScore}/100`,
         /**
          * The reasons, not a verdict about the project.
          *
@@ -145,8 +150,10 @@ function summarize(report) {
          * "Detected frontend: flutter" — the same summary naming the stack it had just
          * failed to recognise. The report has carried the reasons since the flag existed.
          */
-        `Maturity: ${report.maturityLevel}${report.inconclusive ? ' (INCONCLUSIVE, score capped)' : ''}`,
-        ...(report.inconclusive ? report.inconclusiveReasons.map((reason) => `  - ${reason}`) : []),
+        `Maturity: ${report.maturityLevel}`,
+        ...(report.inconclusive
+            ? ['INCONCLUSIVE — this report has no score, for these reasons:', ...report.inconclusiveReasons.map((reason) => `  - ${reason}`)]
+            : []),
         // Printed next to the score it is not allowed to change, so a reader who knows what
         // their project is can act on it in one step.
         ...(report.productProfile?.profileSuggestion

package/dist/mcp/server.js

@@ -201,7 +201,7 @@ async function createProdkitMcpServer() {
                     requiredTotal: report.productProfile?.gap.requiredTotal ?? 0,
                     verdict: report.executiveSummary.verdict,
                 };
-            }).sort((left, right) => right.overallScore - left.overallScore);
+            }).sort((left, right) => (right.overallScore ?? -1) - (left.overallScore ?? -1));
             return textResult({
                 observedOnlyScore: observed.observedScore,
                 detectedStack: observed.detectedStack,

package/dist/planner/types.d.ts

@@ -29,7 +29,8 @@ export interface RemediationPhase {
 export interface RemediationPlan {
     projectPath: string;
     generatedAt: string;
-    score: number;
+    /** `null` where the report could not form a reading. */
+    score: number | null;
     maturityLevel: string;
     summary: string;
     phases: RemediationPhase[];

package/dist/report/buildReport.js

@@ -246,9 +246,19 @@ function buildReport(analysis, options) {
     if (tooLittleAssessed) {
         inconclusiveReasons.push(`Only ${assessedChecks} check${assessedChecks === 1 ? '' : 's'} reached a verdict, which is too few to characterise this project.`);
     }
-    // An unrecognized project has almost no applicable detectors, so the absence
-    // of findings must not be rewarded with a high score: cap it at prototype.
-    const scoreAfterInconclusive = inconclusive ? Math.min(combinedScore, 39) : combinedScore;
+    /**
+     * An inconclusive reading has no score.
+     *
+     * This was a cap at 39, so that an unrecognised project could not be rewarded for
+     * the absence of findings. The intent was right and the output was not: eleven
+     * repositories in the corpus came out at exactly 39, and one of them — a Python
+     * transcription script — had no findings at all. A reader saw "39/100, prototype"
+     * about a repository whose own report said it could not be read.
+     *
+     * `null` is the rule this product applies everywhere else. The reasons already
+     * collected above are the answer in its place.
+     */
+    const scoreAfterInconclusive = combinedScore;
     /**
      * The number obeys the same rule as the label.
      *
@@ -269,10 +279,14 @@ function buildReport(analysis, options) {
      * band can be refused and both must reach the number, not only the label.
      */
     const openCriticals = findings.filter((f) => f.severity === 'critical' && f.status !== 'passed' && f.status !== 'unknown').length;
-    const overallScore = (0, score_1.mayClaimTopBand)(coverage, openCriticals)
-        ? scoreAfterInconclusive
-        : Math.min(scoreAfterInconclusive, score_1.TOP_BAND_CEILING);
-    const maturityLevel = (0, score_1.computeMaturity)(overallScore, coverage, openCriticals);
+    const overallScore = inconclusive
+        ? null
+        : (0, score_1.mayClaimTopBand)(coverage, openCriticals)
+            ? scoreAfterInconclusive
+            : Math.min(scoreAfterInconclusive, score_1.TOP_BAND_CEILING);
+    const maturityLevel = overallScore === null
+        ? 'inconclusive'
+        : (0, score_1.computeMaturity)(overallScore, coverage, openCriticals);
     const findingsByCategory = Object.fromEntries(types_1.CATEGORIES.map((c) => [c, []]));
     for (const f of findings)
         findingsByCategory[f.category].push(f);

package/dist/report/executiveSummary.d.ts

@@ -21,7 +21,7 @@ export declare function buildExecutiveSummary(args: {
     profile: ProductExpectationResult | undefined;
     maturity: MaturityLevel;
     observedScore: number;
-    overallScore: number;
+    overallScore: number | null;
     inconclusive: boolean;
     /** Why, when the report could not form a reading. Named in the verdict. */
     inconclusiveReasons?: string[];

package/dist/report/executiveSummary.js

@@ -30,6 +30,7 @@ const CATEGORY_LABEL = {
     docs: 'saying what this is',
 };
 const MATURITY_LABEL = {
+    inconclusive: 'not characterised, because too little of it could be read',
     prototype: 'a prototype',
     early: 'an early build',
     partial: 'partly ready',
@@ -192,9 +193,11 @@ function buildExecutiveSummary(args) {
         }
         return `${label}: ${entry.findingCount} ${entry.findingCount === 1 ? 'issue' : 'issues'} to address`;
     });
-    const scoreExplanation = args.profile
-        ? `${args.observedScore} of 100 on what the code does today, ${args.overallScore} of 100 once measured against what ${args.profile.profileTitle} normally requires.`
-        : `${args.observedScore} of 100 on what the code does today, with no product expectations applied.`;
+    const scoreExplanation = args.overallScore === null
+        ? `Not scored. ${args.inconclusiveReasons?.[0] ?? 'Too little of this repository could be read to characterise it.'}`
+        : args.profile
+            ? `${args.observedScore} of 100 on what the code does today, ${args.overallScore} of 100 once measured against what ${args.profile.profileTitle} normally requires.`
+            : `${args.observedScore} of 100 on what the code does today, with no product expectations applied.`;
     return {
         verdict,
         launchReady,

package/dist/report/markdownReport.js

@@ -42,7 +42,7 @@ function profileSummary(report) {
         `- Description: ${profile.profileDescription}`,
         `- Observed score: ${report.observedScore}/100`,
         `- Expected capability score: ${report.expectedCapabilityScore}/100`,
-        `- Final score: ${report.overallScore}/100`,
+        report.overallScore === null ? '- Final score: not scored' : `- Final score: ${report.overallScore}/100`,
         '- Capability summary:',
         `- Required: ${requiredPresent} present / ${requiredMissing} missing / ${requiredPartial} partial`,
         `- Recommended: ${recommendedPresent} present / ${recommendedMissing} missing / ${recommendedPartial} partial`,
@@ -221,7 +221,7 @@ function renderMarkdown(report) {
         '',
         '## Score',
         '',
-        `- Overall score: ${report.overallScore}/100`,
+        report.overallScore === null ? '- Overall score: not scored' : `- Overall score: ${report.overallScore}/100`,
         `- Observed score: ${report.observedScore}/100`,
         ...(report.expectedCapabilityScore !== undefined ? [`- Expected capability score: ${report.expectedCapabilityScore}/100`] : []),
         `- Maturity level: ${report.maturityLevel}${report.inconclusive ? ' (inconclusive)' : ''}`,
@@ -233,7 +233,7 @@ function renderMarkdown(report) {
          * one of them rested on two verified checks while the other rested on twelve.
          */
         `- Verified: ${report.diagnostics.verifiedChecks} of ${report.diagnostics.assessedChecks} checks that reached a verdict`,
-        ...(report.overallScore > 84 && report.maturityLevel !== 'production_ready'
+        ...(report.overallScore !== null && report.overallScore > 84 && report.maturityLevel !== 'production_ready'
             ? ['- Note: the score is high because little was found, not because much was verified. Too few checks apply to this repository to call it production ready.']
             : []),
         ...(report.inconclusive

package/dist/report/types.d.ts

@@ -45,7 +45,16 @@ export interface Finding {
      */
     businessImpact?: string;
 }
-export type MaturityLevel = 'prototype' | 'early' | 'partial' | 'production_ready';
+/**
+ * `inconclusive` is a band of its own, not the bottom of the scale.
+ *
+ * A repository this analyzer could not read is not a prototype. It used to be called
+ * one, with a score of 39 beside it — the cap applied so that absence of findings
+ * could not be rewarded — and eleven repositories in the corpus came out at exactly
+ * 39: a wake-word engine, a database manager, an Advent of Code repository. One of
+ * them had no findings at all. The number was not measuring them; it was the cap.
+ */
+export type MaturityLevel = 'inconclusive' | 'prototype' | 'early' | 'partial' | 'production_ready';
 export type ExpectationMode = 'observed-only' | 'explicit-profile' | 'auto-applied' | 'auto-inconclusive';
 import type { LanguageReading } from '../analyzer/readingDepth';
 export interface ReportDiagnostics {
@@ -81,7 +90,12 @@ export interface ProductionReadinessReport {
     generatedAt: string;
     observedScore: number;
     expectedCapabilityScore?: number;
-    overallScore: number;
+    /**
+     * `null` where the reading is inconclusive, which is the same rule this product
+     * applies everywhere else: a number that was not measured is not reported. The
+     * reasons in `inconclusiveReasons` are the answer in its place.
+     */
+    overallScore: number | null;
     maturityLevel: MaturityLevel;
     inconclusive: boolean;
     inconclusiveReasons: string[];

package/dist/rules/rules.js

@@ -263,7 +263,18 @@ exports.rules = [
                     ? `Hardcoded fallback secrets detected (${weakTypes || 'unknown'} key context).`
                     : 'No weak fallback secret patterns detected.',
                 recommendation: 'Require strong secrets through environment variables with strict startup validation.',
-                evidence: weakEvidence,
+                /**
+                 * A check that passes because it found nothing has to say what it looked for.
+                 *
+                 * This was the most repeated line in the product: 175 reports said "no weak
+                 * fallback secret patterns detected" with nothing underneath, which tells the
+                 * reader neither how hard it looked nor whether their own placeholder would
+                 * have been caught. A negative result is only worth something when the search
+                 * behind it is visible.
+                 */
+                evidence: weakEvidence.length > 0
+                    ? weakEvidence
+                    : (0, absenceEvidence_1.searchedFor)('hardcoded fallback secrets', ['changeme', 'your-secret', 'dev-secret', 'local-secret', 'change-in-production', 'test123', 'a secret assigned a literal beside jwt_secret, secret_key or session_secret']),
             });
         },
     },
@@ -438,7 +449,11 @@ exports.rules = [
                         ? 'Django settings contain DEBUG=True.'
                         : 'No DEBUG=True signal found.',
                 recommendation: 'Set DEBUG=False for non-local environments and enforce via environment variables.',
-                evidence: !isDjango ? [{ type: 'note', value: 'Django stack not detected' }] : evidenceForClaim(sec?.evidence, 'django-debug'),
+                evidence: !isDjango
+                    ? [{ type: 'note', value: 'Django stack not detected' }]
+                    : evidenceForClaim(sec?.evidence, 'django-debug').length > 0
+                        ? evidenceForClaim(sec?.evidence, 'django-debug')
+                        : (0, absenceEvidence_1.searchedFor)('DEBUG left on', ['a line reading DEBUG = True in the settings Django actually loads, outside any if settings.DEBUG block']),
             });
         },
     },
@@ -464,7 +479,11 @@ exports.rules = [
                         ? 'Secure cookie settings appear configured.'
                         : 'SESSION/CSRF secure cookie flags are weak.',
                 recommendation: 'Enable SESSION_COOKIE_SECURE and CSRF_COOKIE_SECURE in production.',
-                evidence: !isDjango ? [{ type: 'note', value: 'Django stack not detected' }] : evidenceForClaim(sec?.evidence, 'django-cookies'),
+                evidence: !isDjango
+                    ? [{ type: 'note', value: 'Django stack not detected' }]
+                    : evidenceForClaim(sec?.evidence, 'django-cookies').length > 0
+                        ? evidenceForClaim(sec?.evidence, 'django-cookies')
+                        : (0, absenceEvidence_1.searchedFor)('cookies left insecure', ['SESSION_COOKIE_SECURE = False', 'CSRF_COOKIE_SECURE = False']),
             });
         },
     },

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@produtype/core",
-  "version": "0.43.0",
+  "version": "0.45.0",
   "description": "Deterministic CLI and library that analyzes a web application repository and reports how far it is from production-ready for the kind of product it is meant to be.",
   "license": "MIT",
   "bin": {