@produtype/core 0.72.0 → 0.74.0

package/dist/analyzer/analyzeProject.js

@@ -65,6 +65,7 @@ const detectNotifications_1 = require("./detectNotifications");
 const detectDeployment_1 = require("./detectDeployment");
 const detectStack_1 = require("./detectStack");
 const promises_1 = require("node:fs/promises");
+const loadTypeScript_1 = require("./structural/loadTypeScript");
 const packageJsonSchema = zod_1.z
     .object({
     name: zod_1.z.string().optional(),
@@ -841,6 +842,7 @@ async function analyzeProject(projectPath) {
     return {
         projectPath: root,
         scannedAt: new Date().toISOString(),
+        parsedStructure: await (0, loadTypeScript_1.typeScriptIsAvailable)(),
         stack: (0, detectStack_1.buildStackInfo)({
             frontend: frontend.frameworks,
             backend: backend.frameworks,

package/dist/analyzer/detectAuth.js

@@ -8,6 +8,7 @@ const absenceEvidence_1 = require("./absenceEvidence");
 const fileNames_1 = require("./fileNames");
 const valuesFromPackage_1 = require("./structural/valuesFromPackage");
 const ownershipChecks_1 = require("./structural/ownershipChecks");
+const readingDepth_1 = require("./readingDepth");
 /**
  * In a product that talks to a model, `role` usually means who is speaking.
  *
@@ -376,6 +377,7 @@ async function detectAuth(ctx) {
      * structure and needs no vocabulary at all.
      */
     const structuralOwnership = await (0, ownershipChecks_1.readOwnershipChecks)(ctx.root, sourceFiles);
+    const ownershipUnasked = (0, readingDepth_1.wentUnasked)(structuralOwnership, sourceFiles) && (await (0, ownershipChecks_1.anyFileImportsExpress)(ctx.root, sourceFiles));
     const hasAuth = authDeps.length > 0 || routeSignals.length > 0;
     const hasAuthz = permissionSignals.length > 0 || roleSignals.length > 0;
     const b2bHint = b2bSignals.length > 0;
@@ -451,6 +453,15 @@ async function detectAuth(ctx) {
             // Route-level permission checks no longer stand in for per-record ones: with the
             // needles above narrowed, this clause could only reintroduce what they removed.
             present: resourceLevelSignals.length > 0 || (structuralOwnership ?? []).length > 0,
+            /**
+             * The capability with no package to anchor on, read entirely from structure.
+             *
+             * Without the optional compiler the Express route walk does not happen, and the
+             * only thing left is the vocabulary this detector was written to stop relying on.
+             * `proprieta-in-italiano` turns from `passed` into a false `missing` — a
+             * recommendation to add a check the code already has.
+             */
+            unanswered: ownershipUnasked && resourceLevelSignals.length === 0,
             evidence: (0, absenceEvidence_1.evidenceOrSearch)([
                 ...snippetEvidence(resourceLevelSignals),
                 ...(structuralOwnership ?? []).slice(0, 6).map((check) => ({

package/dist/analyzer/detectEnv.js

@@ -4,6 +4,7 @@ exports.detectEnv = detectEnv;
 const textSearch_1 = require("../utils/textSearch");
 const lookupTables_1 = require("./structural/lookupTables");
 const secretArguments_1 = require("./structural/secretArguments");
+const readingDepth_1 = require("./readingDepth");
 const WEAK_SECRET_VALUE_RE = /(changeme|your[_-]?secret|fallback-secret(?:-change-in-production)?|change[_-]in[_-]production|your_jwt_secret_key_change_in_production|local[-_]?secret|development[-_]?secret|dev[-_]?secret|not[_-]?for[_-]?production|test123|secret)/i;
 const FALLBACK_SECRET_RE = /(jwt_secret|secret_key|session_secret)\s*[:=]\s*['"][^'"]*(changeme|your[_-]?secret|fallback-secret(?:-change-in-production)?|change[_-]in[_-]production|your_jwt_secret_key_change_in_production|local[-_]?secret|development[-_]?secret|dev[-_]?secret|not[_-]?for[_-]?production|test123|secret)[^'"]*['"]/i;
 const ENV_FALLBACK_RE = /(process\.env\.(JWT_SECRET|SECRET_KEY|SESSION_SECRET)\s*(\|\||\?\?)\s*['"][^'"]*(changeme|your[_-]?secret|fallback-secret(?:-change-in-production)?|change[_-]in[_-]production|your_jwt_secret_key_change_in_production|local[-_]?secret|development[-_]?secret|dev[-_]?secret|not[_-]?for[_-]?production|test123|secret)[^'"]*['"])/i;
@@ -139,6 +140,14 @@ async function detectEnv(ctx) {
         weakSecretEvidence.push({ type: 'snippet', value: `${hit.snippet}  — reaches ${hit.sink}`, file: hit.file, line: hit.line });
         weakSecretByType.unknown.push({ type: 'snippet', value: `${hit.snippet}  — reaches ${hit.sink}`, file: hit.file, line: hit.line });
     }
+    /**
+     * Whether the sink side of the question went unasked.
+     *
+     * Only the reader that *finds* secrets counts here. `lookupTables` going missing makes
+     * this detector noisier, not blinder, and a noisy finding is one a reader can see and
+     * argue with — silence is not.
+     */
+    const secretSinksUnasked = (0, readingDepth_1.wentUnasked)(secretArguments, sourceFiles) && (await (0, secretArguments_1.anyFileReachesASecretSink)(ctx.root, sourceFiles));
     const weakHits = fallbackHits.filter((m) => WEAK_SECRET_VALUE_RE.test(m.snippet)
         && SECRET_ASSIGNMENT_CONTEXT_RE.test(m.snippet)
         && !namesItself(m.snippet)
@@ -167,26 +176,31 @@ async function detectEnv(ctx) {
         {
             key: 'env.secretFallback.jwt',
             present: weakSecretByType.jwt.length > 0,
+            unanswered: secretSinksUnasked && weakSecretByType.jwt.length === 0,
             evidence: weakSecretByType.jwt,
         },
         {
             key: 'env.secretFallback.session',
             present: weakSecretByType.session.length > 0,
+            unanswered: secretSinksUnasked && weakSecretByType.session.length === 0,
             evidence: weakSecretByType.session,
         },
         {
             key: 'env.secretFallback.app',
             present: weakSecretByType.app.length > 0,
+            unanswered: secretSinksUnasked && weakSecretByType.app.length === 0,
             evidence: weakSecretByType.app,
         },
         {
             key: 'env.secretFallback.apiKey',
             present: weakSecretByType.apiKey.length > 0,
+            unanswered: secretSinksUnasked && weakSecretByType.apiKey.length === 0,
             evidence: weakSecretByType.apiKey,
         },
         {
             key: 'env.secretFallback.unknown',
             present: weakSecretByType.unknown.length > 0,
+            unanswered: secretSinksUnasked && weakSecretByType.unknown.length === 0,
             evidence: weakSecretByType.unknown,
             details: { weakSecretEvidence },
         },

package/dist/analyzer/detectSecurity.js

@@ -6,6 +6,7 @@ const readTextFileSafe_1 = require("../utils/readTextFileSafe");
 const textSearch_1 = require("../utils/textSearch");
 const absenceEvidence_1 = require("./absenceEvidence");
 const valuesFromPackage_1 = require("./structural/valuesFromPackage");
+const readingDepth_1 = require("./readingDepth");
 const developmentOnly_1 = require("./developmentOnly");
 /** Lines that decide which origins may call this server. */
 const ORIGIN_HANDLING = [/Access-Control-Allow-Origin/i, /ALLOWED_ORIGINS/, /allowedOrigins/i];
@@ -371,6 +372,16 @@ async function detectSecurity(ctx) {
             helmet,
             rateLimit,
             rateLimitNearAuth,
+            /**
+             * Whether coverage could be established at all.
+             *
+             * Whether a limiter reaches the login is read from the value the package
+             * produces and the paths it is mounted on — a structural question. Without the
+             * optional compiler `mountedPaths` is empty and three fixtures that do throttle
+             * their sign-in drop from `passed` to `partial`, told that nothing shows the
+             * coverage they have.
+             */
+            rateLimitCoverageUnasked: (0, readingDepth_1.wentUnasked)(boundLimiterUses, source) && !rateLimitNearAuth,
             corsLoose: corsLoose.length > 0,
             corsStrict: corsStrict.length > 0,
             webhookSignature: webhookSig.length > 0,

package/dist/analyzer/readingDepth.d.ts

@@ -34,12 +34,37 @@ export interface LanguageReading {
 export declare function readingDepths(sourceFiles: string[], unreadable: Array<{
     language: string;
     files: number;
-}>): LanguageReading[];
+}>, parserAvailable: boolean): LanguageReading[];
 /**
  * The sentence a reader needs, or nothing.
  *
  * Silent where everything was parsed: a report that congratulates itself on reading
  * properly is noise. It speaks when some of the reading was shallower than the rest,
  * which is the case that misleads.
+ *
+ * `parserAvailable` separates two shallow readings that look identical in the list and
+ * are not. Go is searched because nothing here will ever parse Go, and a reader can do
+ * nothing about it. JavaScript is searched only when the optional compiler is missing,
+ * and installing it changes the answer — on the fixture corpus, seven repositories of a
+ * hundred and thirty-three answer differently. Telling a reader to install a package is
+ * worth a clause; telling them their Go is read by keyword is worth a different one.
+ */
+export declare function describeReadingDepth(readings: LanguageReading[], parserAvailable: boolean): string | undefined;
+/**
+ * Whether a parser would have had anything to say about this repository.
+ *
+ * A detector that loses its structural reader has lost nothing on a Go or Python
+ * project — no parser here was ever going to read those — so the missing compiler is
+ * only worth reporting where it would have changed the answer. Same list as the depths
+ * above, for the same reason: adding a language to the structural layer must move both
+ * claims in one commit.
+ */
+export declare function parserCouldHaveRead(sourceFiles: string[]): boolean;
+/**
+ * The question was asked and answered, or it was never asked.
+ *
+ * The structural readers already distinguish the two — `null` for "no parser", `[]` for
+ * "parsed, found nothing" — and every consumer flattened it with `?? []`. This puts the
+ * distinction back where a detector can act on it.
  */
-export declare function describeReadingDepth(readings: LanguageReading[]): string | undefined;
+export declare function wentUnasked(readerResult: unknown | null, sourceFiles: string[]): boolean;

package/dist/analyzer/readingDepth.js

@@ -2,6 +2,8 @@
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.readingDepths = readingDepths;
 exports.describeReadingDepth = describeReadingDepth;
+exports.parserCouldHaveRead = parserCouldHaveRead;
+exports.wentUnasked = wentUnasked;
 const catalogue_1 = require("./catalogue");
 /**
  * The extensions a parser reads today.
@@ -11,10 +13,25 @@ const catalogue_1 = require("./catalogue");
  * within a week, which is the failure this file exists to stop somebody else making.
  */
 const PARSED_EXTENSIONS = /\.(ts|tsx|js|jsx|mjs|cjs)$/;
-/** Languages whose files are read as text but never parsed. */
-function depthFor(files) {
+/**
+ * The catalogue labels those extensions carry, so the missing-compiler clause fires for
+ * the languages it can actually do something about and stays quiet on a Go repository.
+ */
+const PARSED_EXTENSIONS_LANGUAGES = new Set(catalogue_1.LANGUAGES.filter(({ extensions }) => ['a.ts', 'a.tsx', 'a.js', 'a.jsx', 'a.mjs', 'a.cjs'].some((name) => extensions.test(name))).map(({ label }) => label));
+/**
+ * Languages whose files are read as text but never parsed.
+ *
+ * The extension says a parser *could* read this file; `parserAvailable` says one
+ * actually did. The optional TypeScript peer is absent on any machine that installed
+ * this package without it — `npx prodkit` against a repository is the ordinary case —
+ * and until this argument existed the report claimed `parsed` there just the same, on
+ * the strength of the file name.
+ */
+function depthFor(files, parserAvailable) {
     if (files.length === 0)
         return 'skipped';
+    if (!parserAvailable)
+        return 'searched';
     return files.every((file) => PARSED_EXTENSIONS.test(file)) ? 'parsed' : 'searched';
 }
 /**
@@ -24,13 +41,13 @@ function depthFor(files) {
  * directory was not read because it was not the project's, which is a different fact and
  * one the reader does not need here.
  */
-function readingDepths(sourceFiles, unreadable) {
+function readingDepths(sourceFiles, unreadable, parserAvailable) {
     const readings = [];
     for (const { label, extensions } of catalogue_1.LANGUAGES) {
         const files = sourceFiles.filter((file) => extensions.test(file));
         if (files.length === 0)
             continue;
-        readings.push({ language: label, files: files.length, depth: depthFor(files) });
+        readings.push({ language: label, files: files.length, depth: depthFor(files, parserAvailable) });
     }
     for (const entry of unreadable) {
         readings.push({ language: entry.language, files: entry.files, depth: 'skipped' });
@@ -43,8 +60,15 @@ function readingDepths(sourceFiles, unreadable) {
  * Silent where everything was parsed: a report that congratulates itself on reading
  * properly is noise. It speaks when some of the reading was shallower than the rest,
  * which is the case that misleads.
+ *
+ * `parserAvailable` separates two shallow readings that look identical in the list and
+ * are not. Go is searched because nothing here will ever parse Go, and a reader can do
+ * nothing about it. JavaScript is searched only when the optional compiler is missing,
+ * and installing it changes the answer — on the fixture corpus, seven repositories of a
+ * hundred and thirty-three answer differently. Telling a reader to install a package is
+ * worth a clause; telling them their Go is read by keyword is worth a different one.
  */
-function describeReadingDepth(readings) {
+function describeReadingDepth(readings, parserAvailable) {
     const searched = readings.filter((entry) => entry.depth === 'searched');
     const skipped = readings.filter((entry) => entry.depth === 'skipped');
     if (searched.length === 0 && skipped.length === 0)
@@ -56,5 +80,36 @@ function describeReadingDepth(readings) {
     if (skipped.length > 0) {
         parts.push(`${skipped.map((entry) => `${entry.language} (${entry.files} files)`).join(', ')} not read at all`);
     }
-    return `How this repository was read: ${parts.join('; ')}. A keyword can appear in a comment, a test fixture or a variable name, so findings in those languages rest on weaker evidence than the ones this analyzer parsed.`;
+    const missingParser = !parserAvailable && readings.some((entry) => PARSED_EXTENSIONS_LANGUAGES.has(entry.language));
+    return [
+        `How this repository was read: ${parts.join('; ')}.`,
+        'A keyword can appear in a comment, a test fixture or a variable name, so findings in those languages rest on weaker evidence than the ones this analyzer parsed.',
+        ...(missingParser
+            ? [
+                'The optional `typescript` peer dependency is not installed, so no JavaScript or TypeScript was parsed here either: every structural question — which literal reaches a signing call, whether a comparison guards a route or picks a label — went unasked. Install it alongside this package and re-run to get those answers.',
+            ]
+            : []),
+    ].join(' ');
+}
+/**
+ * Whether a parser would have had anything to say about this repository.
+ *
+ * A detector that loses its structural reader has lost nothing on a Go or Python
+ * project — no parser here was ever going to read those — so the missing compiler is
+ * only worth reporting where it would have changed the answer. Same list as the depths
+ * above, for the same reason: adding a language to the structural layer must move both
+ * claims in one commit.
+ */
+function parserCouldHaveRead(sourceFiles) {
+    return sourceFiles.some((file) => PARSED_EXTENSIONS.test(file));
+}
+/**
+ * The question was asked and answered, or it was never asked.
+ *
+ * The structural readers already distinguish the two — `null` for "no parser", `[]` for
+ * "parsed, found nothing" — and every consumer flattened it with `?? []`. This puts the
+ * distinction back where a detector can act on it.
+ */
+function wentUnasked(readerResult, sourceFiles) {
+    return readerResult === null && parserCouldHaveRead(sourceFiles);
 }

package/dist/analyzer/structural/loadTypeScript.d.ts

@@ -2,3 +2,26 @@ import type * as TypeScriptApi from 'typescript';
 export declare function loadTypeScript(): Promise<typeof TypeScriptApi | null>;
 /** For tests that need to observe both paths without reinstalling anything. */
 export declare function resetTypeScriptCache(): void;
+/**
+ * Pretend the compiler is not installed, for tests of what this analyzer says when it
+ * cannot read structure.
+ *
+ * That path is the ordinary one for anybody running `npx prodkit` against their own
+ * repository, and it went untested for as long as it existed because the test machine
+ * always has the compiler. Mocking the module specifier does not work here: the import
+ * is dynamic and resolves before the mock registry answers, so the first analysis in a
+ * file quietly reads the real compiler. Seeding the same cache the loader reads is the
+ * one seam that behaves identically to the real absence.
+ */
+export declare function pretendTypeScriptIsMissing(): void;
+/**
+ * Whether the parser is there, for the report rather than for a reader.
+ *
+ * `readingDepths` printed `parsed` for every `.ts` and `.js` file on the strength of the
+ * extension alone, and said nothing when everything was parsed — so on a machine without
+ * the optional compiler the report was silent in exactly the case it needed to speak.
+ * Measured on the fixture corpus: seven of a hundred and thirty-three repositories
+ * answer differently with the compiler hidden, and one of them reports a hardcoded
+ * signing secret as `passed`.
+ */
+export declare function typeScriptIsAvailable(): Promise<boolean>;

package/dist/analyzer/structural/loadTypeScript.js

@@ -2,6 +2,8 @@
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.loadTypeScript = loadTypeScript;
 exports.resetTypeScriptCache = resetTypeScriptCache;
+exports.pretendTypeScriptIsMissing = pretendTypeScriptIsMissing;
+exports.typeScriptIsAvailable = typeScriptIsAvailable;
 /**
  * The TypeScript compiler, loaded when something needs to read structure rather than text.
  *
@@ -39,3 +41,30 @@ async function loadTypeScript() {
 function resetTypeScriptCache() {
     cached = undefined;
 }
+/**
+ * Pretend the compiler is not installed, for tests of what this analyzer says when it
+ * cannot read structure.
+ *
+ * That path is the ordinary one for anybody running `npx prodkit` against their own
+ * repository, and it went untested for as long as it existed because the test machine
+ * always has the compiler. Mocking the module specifier does not work here: the import
+ * is dynamic and resolves before the mock registry answers, so the first analysis in a
+ * file quietly reads the real compiler. Seeding the same cache the loader reads is the
+ * one seam that behaves identically to the real absence.
+ */
+function pretendTypeScriptIsMissing() {
+    cached = null;
+}
+/**
+ * Whether the parser is there, for the report rather than for a reader.
+ *
+ * `readingDepths` printed `parsed` for every `.ts` and `.js` file on the strength of the
+ * extension alone, and said nothing when everything was parsed — so on a machine without
+ * the optional compiler the report was silent in exactly the case it needed to speak.
+ * Measured on the fixture corpus: seven of a hundred and thirty-three repositories
+ * answer differently with the compiler hidden, and one of them reports a hardcoded
+ * signing secret as `passed`.
+ */
+async function typeScriptIsAvailable() {
+    return (await loadTypeScript()) !== null;
+}

package/dist/analyzer/structural/ownershipChecks.d.ts

@@ -4,3 +4,11 @@ export interface OwnershipCheck {
     snippet: string;
 }
 export declare function readOwnershipChecks(root: string, files: string[]): Promise<OwnershipCheck[] | null>;
+/**
+ * Whether this reader would have had routes to walk.
+ *
+ * Same reasoning as the secret sinks: a repository that never imports Express has no
+ * route handler whose shape this reader could have read, so its absence changes no
+ * answer there and the report should not call the question unasked.
+ */
+export declare function anyFileImportsExpress(root: string, files: string[]): Promise<boolean>;

package/dist/analyzer/structural/ownershipChecks.js

@@ -1,6 +1,7 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.readOwnershipChecks = readOwnershipChecks;
+exports.anyFileImportsExpress = anyFileImportsExpress;
 const readTextFileSafe_1 = require("../../utils/readTextFileSafe");
 const loadTypeScript_1 = require("./loadTypeScript");
 /**
@@ -153,3 +154,22 @@ async function readOwnershipChecks(root, files) {
     }
     return checks;
 }
+/**
+ * Whether this reader would have had routes to walk.
+ *
+ * Same reasoning as the secret sinks: a repository that never imports Express has no
+ * route handler whose shape this reader could have read, so its absence changes no
+ * answer there and the report should not call the question unasked.
+ */
+async function anyFileImportsExpress(root, files) {
+    for (const file of files) {
+        if (!READABLE.test(file))
+            continue;
+        const text = await (0, readTextFileSafe_1.readTextFileSafe)(root, file);
+        if (!text)
+            continue;
+        if (/(from\s+['"]express['"]|require\(\s*['"]express['"]\s*\))/.test(text))
+            return true;
+    }
+    return false;
+}

package/dist/analyzer/structural/secretArguments.d.ts

@@ -6,3 +6,17 @@ export interface HardcodedSecretArgument {
     sink: string;
 }
 export declare function readHardcodedSecretArguments(root: string, files: string[]): Promise<HardcodedSecretArgument[] | null>;
+/**
+ * Whether this reader would have had anything to read.
+ *
+ * `unanswered` has to mean "the answer depends on the reader that did not run", not
+ * "a reader did not run". The first version marked every JavaScript repository in the
+ * corpus — 79 of 133 — as not assessed for weak secrets, including the ones where a
+ * plain `const JWT_SECRET = 'changeme'` is found by name and the sink-following reader
+ * would have added nothing.
+ *
+ * The reader's own first act is this test: a file that never mentions a signing or
+ * ciphering package has no sink to follow. Where no file does, the missing compiler
+ * costs nothing and the text answer stands on its own.
+ */
+export declare function anyFileReachesASecretSink(root: string, files: string[]): Promise<boolean>;

package/dist/analyzer/structural/secretArguments.js

@@ -1,6 +1,7 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.readHardcodedSecretArguments = readHardcodedSecretArguments;
+exports.anyFileReachesASecretSink = anyFileReachesASecretSink;
 const readTextFileSafe_1 = require("../../utils/readTextFileSafe");
 const loadTypeScript_1 = require("./loadTypeScript");
 /**
@@ -169,3 +170,28 @@ async function readHardcodedSecretArguments(root, files) {
     }
     return found;
 }
+/**
+ * Whether this reader would have had anything to read.
+ *
+ * `unanswered` has to mean "the answer depends on the reader that did not run", not
+ * "a reader did not run". The first version marked every JavaScript repository in the
+ * corpus — 79 of 133 — as not assessed for weak secrets, including the ones where a
+ * plain `const JWT_SECRET = 'changeme'` is found by name and the sink-following reader
+ * would have added nothing.
+ *
+ * The reader's own first act is this test: a file that never mentions a signing or
+ * ciphering package has no sink to follow. Where no file does, the missing compiler
+ * costs nothing and the text answer stands on its own.
+ */
+async function anyFileReachesASecretSink(root, files) {
+    for (const file of files) {
+        if (!READABLE.test(file))
+            continue;
+        const text = await (0, readTextFileSafe_1.readTextFileSafe)(root, file);
+        if (!text)
+            continue;
+        if (SECRET_SINKS.some((sink) => text.includes(sink.package.replace('node:', ''))))
+            return true;
+    }
+    return false;
+}

package/dist/analyzer/types.d.ts

@@ -74,6 +74,25 @@ export interface DetectorResult {
     /** Stable feature key, e.g. 'security.helmet' */
     key: string;
     present: boolean;
+    /**
+     * The question behind this signal could not be asked.
+     *
+     * `present: false` has carried two meanings that a reader would never confuse: "I
+     * looked and it is not there", and "I could not look". The second happens whenever a
+     * signal rests on the optional TypeScript compiler and the compiler is absent — the
+     * ordinary case for `npx prodkit` against somebody else's repository.
+     *
+     * Measured by hiding `node_modules/typescript` and re-running the fixture corpus: 7
+     * of 133 repositories answer differently, and `segreto-in-italiano` reports a
+     * hardcoded signing secret as `passed` rather than `missing`. A verdict of "fine" is
+     * the one direction blindness must never produce.
+     *
+     * Set it only where the missing reader can change the answer, and only alongside
+     * `present: false`: a signal that found the thing found it, whatever else went
+     * unasked. Consumers turn it into `unknown`, which already means "not assessed"
+     * everywhere downstream — the plan skips it and the score leaves it out.
+     */
+    unanswered?: boolean;
     /** When present is true: was the implementation complete? */
     complete?: boolean;
     evidence: DetectorEvidence[];
@@ -117,4 +136,12 @@ export interface ProjectAnalysis {
     workspaceStacks: WorkspaceStack[];
     files: ProjectFiles;
     detectors: Record<string, DetectorResult>;
+    /**
+     * Whether the optional TypeScript compiler was there while the detectors ran.
+     *
+     * Carried on the analysis rather than asked for at report time, because it is a fact
+     * about this reading and not about the machine printing it: the report's claim of how
+     * deeply it read has to match what the detectors were actually able to do.
+     */
+    parsedStructure: boolean;
 }

package/dist/report/buildReport.js

@@ -373,7 +373,8 @@ function buildReport(analysis, options) {
          * its severity. A keyword match in Go and a parsed guard in TypeScript were being
          * presented with the same confidence.
          */
-        readingDepth: (0, readingDepth_1.readingDepths)(analysis.files.source, analysis.files.unreadable),
+        readingDepth: (0, readingDepth_1.readingDepths)(analysis.files.source, analysis.files.unreadable, analysis.parsedStructure),
+        parsedStructure: analysis.parsedStructure,
         detectors: detectorDiagnostics(analysis),
         selectedProfile: requestedProfile,
         inferredProfile: productProfile?.inferredProfile,

package/dist/report/markdownReport.js

@@ -274,8 +274,8 @@ function renderMarkdown(report) {
          * confidence, and nothing in the report distinguished them. Silent when everything
          * was parsed: a report congratulating itself on reading properly is noise.
          */
-        ...((0, readingDepth_1.describeReadingDepth)(report.diagnostics.readingDepth)
-            ? [`- ${(0, readingDepth_1.describeReadingDepth)(report.diagnostics.readingDepth)}`]
+        ...((0, readingDepth_1.describeReadingDepth)(report.diagnostics.readingDepth, report.diagnostics.parsedStructure)
+            ? [`- ${(0, readingDepth_1.describeReadingDepth)(report.diagnostics.readingDepth, report.diagnostics.parsedStructure)}`]
             : []),
         `- Expectation mode: ${report.diagnostics.expectationMode}`,
         `- ProdKit version: ${report.diagnostics.prodkitVersion}`,

package/dist/report/types.d.ts

@@ -74,6 +74,14 @@ export interface ReportDiagnostics {
      * fact, and the reader is entitled to know which one they have.
      */
     readingDepth: LanguageReading[];
+    /**
+     * Whether the optional TypeScript compiler was loaded for this reading.
+     *
+     * Two readings with the same `readingDepth` list are not the same reading: JavaScript
+     * shows as `searched` only when the compiler was missing, and that is the one a reader
+     * can fix.
+     */
+    parsedStructure: boolean;
     detectors: Array<{
         id: string;
         status: 'completed' | 'skipped';

package/dist/rules/rules.js

@@ -252,7 +252,20 @@ exports.rules = [
                 app?.present ? 'app' : null,
                 apiKey?.present ? 'apiKey' : null,
             ].filter(Boolean).join(', ');
-            const status = weak ? 'missing' : 'passed';
+            /**
+             * A pass this reading did not earn.
+             *
+             * `jwt.sign(payload, 'cambiami')` is found by following the literal into the
+             * signing call, which needs the optional TypeScript compiler. Without it the
+             * search comes back empty and this rule said "No weak fallback secret patterns
+             * detected" — the analyzer's most confident sentence, produced by not looking.
+             * Measured on `segreto-in-italiano`: `missing` becomes `passed`, 47 becomes 62.
+             *
+             * Finding one is still finding one, so `weak` wins: blindness can only ever turn
+             * a clean verdict into no verdict.
+             */
+            const unanswered = [jwt, session, app, apiKey, unknown].some((d) => d?.unanswered);
+            const status = weak ? 'missing' : unanswered ? 'unknown' : 'passed';
             return mkFinding({
                 id: 'security.weak-secret',
                 title: 'Weak/fallback secret values',
@@ -261,7 +274,9 @@ exports.rules = [
                 severity: weak ? 'critical' : 'info',
                 description: weak
                     ? `Hardcoded fallback secrets detected (${weakTypes || 'unknown'} key context).`
-                    : 'No weak fallback secret patterns detected.',
+                    : unanswered
+                        ? 'Not assessed: finding a literal secret where the name gives nothing away means following it into the call that signs with it, and the optional `typescript` peer dependency is not installed. Install it and re-run.'
+                        : 'No weak fallback secret patterns detected.',
                 recommendation: 'Require strong secrets through environment variables with strict startup validation.',
                 /**
                  * A check that passes because it found nothing has to say what it looked for.
@@ -367,9 +382,18 @@ exports.rules = [
              * surface", and now it only says that when something shows it.
              */
             const nearAuth = Boolean(sec?.details?.rateLimitNearAuth);
+            /**
+             * `partial` is a verdict, and blindness has not earned one.
+             *
+             * Coverage is read from the value the limiter package produces and the prefixes
+             * it is mounted on, so without the optional compiler the answer is empty rather
+             * than negative. Three fixtures that do throttle their login were told nothing
+             * showed it.
+             */
+            const coverageUnasked = Boolean(sec?.details?.rateLimitCoverageUnasked);
             const status = !isExpress || !hasAuth
                 ? 'unknown'
-                : nearAuth ? 'passed' : hasRate ? 'partial' : 'missing';
+                : nearAuth ? 'passed' : coverageUnasked && hasRate ? 'unknown' : hasRate ? 'partial' : 'missing';
             return mkFinding({
                 id: 'security.rate-limit-auth',
                 title: 'Authentication rate limiting',
@@ -388,9 +412,11 @@ exports.rules = [
                         ? 'Rate limiting is in place somewhere, but nothing here shows it covering sign-in.'
                         : status === 'missing'
                             ? 'No auth-focused rate limiting detected.'
-                            : !hasAuth
-                                ? 'Nothing here authenticates anybody, so there is no login surface to throttle.'
-                                : 'This check reads Express middleware, and this project does not use it — any throttling it has is somewhere this cannot see.',
+                            : coverageUnasked && hasRate
+                                ? 'Not assessed: this project throttles something, and whether it reaches the login is read from where the limiter is mounted — which needs the optional `typescript` peer dependency. Install it and re-run.'
+                                : !hasAuth
+                                    ? 'Nothing here authenticates anybody, so there is no login surface to throttle.'
+                                    : 'This check reads Express middleware, and this project does not use it — any throttling it has is somewhere this cannot see.',
                 recommendation: 'Apply express-rate-limit (or equivalent) to login/register/password reset endpoints.',
                 /**
                  * The claim is about rate limiting, so the evidence is about rate limiting.
@@ -586,13 +612,22 @@ exports.rules = [
             // A question about who may act on which record needs a system that has records
             // and callers. The auth detector alone was not enough of a gate: it answers from
             // strings, and a package that searches for `requireAuth` contains it.
+            /**
+             * Per-record authorization is read from the shape of a route handler, so the
+             * optional compiler is the whole reading. Without it `proprieta-in-italiano`
+             * turns from `passed` into a false `missing`, and the report recommends adding
+             * a check the code already makes.
+             */
+            const ownershipUnasked = Boolean(resourceLevel?.unanswered) && !hasPermissions && !hasRoles;
             const status = !hasAuth || !hasUserFacingSurface(analysis)
                 ? 'unknown'
                 : hasPermissions || hasResourceLevel
                     ? 'passed'
                     : hasRoles
                         ? 'partial'
-                        : 'missing';
+                        : ownershipUnasked
+                            ? 'unknown'
+                            : 'missing';
             return mkFinding({
                 id: 'authz.resource-level',
                 title: 'Authorization depth',
@@ -607,7 +642,9 @@ exports.rules = [
                             ? 'No resource-level authorization signals detected.'
                             : !hasAuth
                                 ? 'Nothing here authenticates anybody, so there are no callers to authorize.'
-                                : 'Nothing in this repository serves requests, so there are no records to guard.',
+                                : ownershipUnasked
+                                    ? 'Not assessed: a check that compares the record to the caller is recognised by the shape of the route handler, and the optional `typescript` peer dependency is not installed. Install it and re-run.'
+                                    : 'Nothing in this repository serves requests, so there are no records to guard.',
                 recommendation: 'Add policy/resource-level checks beyond coarse role gates.',
                 evidence: [...(roles?.evidence ?? []), ...(permissions?.evidence ?? []), ...(resourceLevel?.evidence ?? [])],
             });

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@produtype/core",
-  "version": "0.72.0",
+  "version": "0.74.0",
   "description": "Deterministic CLI and library that analyzes a web application repository and reports how far it is from production-ready for the kind of product it is meant to be.",
   "license": "MIT",
   "bin": {