@produtype/core 0.73.0 → 0.74.0

package/dist/analyzer/detectAuth.js

@@ -8,6 +8,7 @@ const absenceEvidence_1 = require("./absenceEvidence");
 const fileNames_1 = require("./fileNames");
 const valuesFromPackage_1 = require("./structural/valuesFromPackage");
 const ownershipChecks_1 = require("./structural/ownershipChecks");
+const readingDepth_1 = require("./readingDepth");
 /**
  * In a product that talks to a model, `role` usually means who is speaking.
  *
@@ -376,6 +377,7 @@ async function detectAuth(ctx) {
      * structure and needs no vocabulary at all.
      */
     const structuralOwnership = await (0, ownershipChecks_1.readOwnershipChecks)(ctx.root, sourceFiles);
+    const ownershipUnasked = (0, readingDepth_1.wentUnasked)(structuralOwnership, sourceFiles) && (await (0, ownershipChecks_1.anyFileImportsExpress)(ctx.root, sourceFiles));
     const hasAuth = authDeps.length > 0 || routeSignals.length > 0;
     const hasAuthz = permissionSignals.length > 0 || roleSignals.length > 0;
     const b2bHint = b2bSignals.length > 0;
@@ -451,6 +453,15 @@ async function detectAuth(ctx) {
             // Route-level permission checks no longer stand in for per-record ones: with the
             // needles above narrowed, this clause could only reintroduce what they removed.
             present: resourceLevelSignals.length > 0 || (structuralOwnership ?? []).length > 0,
+            /**
+             * The capability with no package to anchor on, read entirely from structure.
+             *
+             * Without the optional compiler the Express route walk does not happen, and the
+             * only thing left is the vocabulary this detector was written to stop relying on.
+             * `proprieta-in-italiano` turns from `passed` into a false `missing` — a
+             * recommendation to add a check the code already has.
+             */
+            unanswered: ownershipUnasked && resourceLevelSignals.length === 0,
             evidence: (0, absenceEvidence_1.evidenceOrSearch)([
                 ...snippetEvidence(resourceLevelSignals),
                 ...(structuralOwnership ?? []).slice(0, 6).map((check) => ({

package/dist/analyzer/detectEnv.js

@@ -4,6 +4,7 @@ exports.detectEnv = detectEnv;
 const textSearch_1 = require("../utils/textSearch");
 const lookupTables_1 = require("./structural/lookupTables");
 const secretArguments_1 = require("./structural/secretArguments");
+const readingDepth_1 = require("./readingDepth");
 const WEAK_SECRET_VALUE_RE = /(changeme|your[_-]?secret|fallback-secret(?:-change-in-production)?|change[_-]in[_-]production|your_jwt_secret_key_change_in_production|local[-_]?secret|development[-_]?secret|dev[-_]?secret|not[_-]?for[_-]?production|test123|secret)/i;
 const FALLBACK_SECRET_RE = /(jwt_secret|secret_key|session_secret)\s*[:=]\s*['"][^'"]*(changeme|your[_-]?secret|fallback-secret(?:-change-in-production)?|change[_-]in[_-]production|your_jwt_secret_key_change_in_production|local[-_]?secret|development[-_]?secret|dev[-_]?secret|not[_-]?for[_-]?production|test123|secret)[^'"]*['"]/i;
 const ENV_FALLBACK_RE = /(process\.env\.(JWT_SECRET|SECRET_KEY|SESSION_SECRET)\s*(\|\||\?\?)\s*['"][^'"]*(changeme|your[_-]?secret|fallback-secret(?:-change-in-production)?|change[_-]in[_-]production|your_jwt_secret_key_change_in_production|local[-_]?secret|development[-_]?secret|dev[-_]?secret|not[_-]?for[_-]?production|test123|secret)[^'"]*['"])/i;
@@ -139,6 +140,14 @@ async function detectEnv(ctx) {
         weakSecretEvidence.push({ type: 'snippet', value: `${hit.snippet}  — reaches ${hit.sink}`, file: hit.file, line: hit.line });
         weakSecretByType.unknown.push({ type: 'snippet', value: `${hit.snippet}  — reaches ${hit.sink}`, file: hit.file, line: hit.line });
     }
+    /**
+     * Whether the sink side of the question went unasked.
+     *
+     * Only the reader that *finds* secrets counts here. `lookupTables` going missing makes
+     * this detector noisier, not blinder, and a noisy finding is one a reader can see and
+     * argue with — silence is not.
+     */
+    const secretSinksUnasked = (0, readingDepth_1.wentUnasked)(secretArguments, sourceFiles) && (await (0, secretArguments_1.anyFileReachesASecretSink)(ctx.root, sourceFiles));
     const weakHits = fallbackHits.filter((m) => WEAK_SECRET_VALUE_RE.test(m.snippet)
         && SECRET_ASSIGNMENT_CONTEXT_RE.test(m.snippet)
         && !namesItself(m.snippet)
@@ -167,26 +176,31 @@ async function detectEnv(ctx) {
         {
             key: 'env.secretFallback.jwt',
             present: weakSecretByType.jwt.length > 0,
+            unanswered: secretSinksUnasked && weakSecretByType.jwt.length === 0,
             evidence: weakSecretByType.jwt,
         },
         {
             key: 'env.secretFallback.session',
             present: weakSecretByType.session.length > 0,
+            unanswered: secretSinksUnasked && weakSecretByType.session.length === 0,
             evidence: weakSecretByType.session,
         },
         {
             key: 'env.secretFallback.app',
             present: weakSecretByType.app.length > 0,
+            unanswered: secretSinksUnasked && weakSecretByType.app.length === 0,
             evidence: weakSecretByType.app,
         },
         {
             key: 'env.secretFallback.apiKey',
             present: weakSecretByType.apiKey.length > 0,
+            unanswered: secretSinksUnasked && weakSecretByType.apiKey.length === 0,
             evidence: weakSecretByType.apiKey,
         },
         {
             key: 'env.secretFallback.unknown',
             present: weakSecretByType.unknown.length > 0,
+            unanswered: secretSinksUnasked && weakSecretByType.unknown.length === 0,
             evidence: weakSecretByType.unknown,
             details: { weakSecretEvidence },
         },

package/dist/analyzer/detectSecurity.js

@@ -6,6 +6,7 @@ const readTextFileSafe_1 = require("../utils/readTextFileSafe");
 const textSearch_1 = require("../utils/textSearch");
 const absenceEvidence_1 = require("./absenceEvidence");
 const valuesFromPackage_1 = require("./structural/valuesFromPackage");
+const readingDepth_1 = require("./readingDepth");
 const developmentOnly_1 = require("./developmentOnly");
 /** Lines that decide which origins may call this server. */
 const ORIGIN_HANDLING = [/Access-Control-Allow-Origin/i, /ALLOWED_ORIGINS/, /allowedOrigins/i];
@@ -371,6 +372,16 @@ async function detectSecurity(ctx) {
             helmet,
             rateLimit,
             rateLimitNearAuth,
+            /**
+             * Whether coverage could be established at all.
+             *
+             * Whether a limiter reaches the login is read from the value the package
+             * produces and the paths it is mounted on — a structural question. Without the
+             * optional compiler `mountedPaths` is empty and three fixtures that do throttle
+             * their sign-in drop from `passed` to `partial`, told that nothing shows the
+             * coverage they have.
+             */
+            rateLimitCoverageUnasked: (0, readingDepth_1.wentUnasked)(boundLimiterUses, source) && !rateLimitNearAuth,
             corsLoose: corsLoose.length > 0,
             corsStrict: corsStrict.length > 0,
             webhookSignature: webhookSig.length > 0,

package/dist/analyzer/readingDepth.d.ts

@@ -50,3 +50,21 @@ export declare function readingDepths(sourceFiles: string[], unreadable: Array<{
  * worth a clause; telling them their Go is read by keyword is worth a different one.
  */
 export declare function describeReadingDepth(readings: LanguageReading[], parserAvailable: boolean): string | undefined;
+/**
+ * Whether a parser would have had anything to say about this repository.
+ *
+ * A detector that loses its structural reader has lost nothing on a Go or Python
+ * project — no parser here was ever going to read those — so the missing compiler is
+ * only worth reporting where it would have changed the answer. Same list as the depths
+ * above, for the same reason: adding a language to the structural layer must move both
+ * claims in one commit.
+ */
+export declare function parserCouldHaveRead(sourceFiles: string[]): boolean;
+/**
+ * The question was asked and answered, or it was never asked.
+ *
+ * The structural readers already distinguish the two — `null` for "no parser", `[]` for
+ * "parsed, found nothing" — and every consumer flattened it with `?? []`. This puts the
+ * distinction back where a detector can act on it.
+ */
+export declare function wentUnasked(readerResult: unknown | null, sourceFiles: string[]): boolean;

package/dist/analyzer/readingDepth.js

@@ -2,6 +2,8 @@
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.readingDepths = readingDepths;
 exports.describeReadingDepth = describeReadingDepth;
+exports.parserCouldHaveRead = parserCouldHaveRead;
+exports.wentUnasked = wentUnasked;
 const catalogue_1 = require("./catalogue");
 /**
  * The extensions a parser reads today.
@@ -89,3 +91,25 @@ function describeReadingDepth(readings, parserAvailable) {
             : []),
     ].join(' ');
 }
+/**
+ * Whether a parser would have had anything to say about this repository.
+ *
+ * A detector that loses its structural reader has lost nothing on a Go or Python
+ * project — no parser here was ever going to read those — so the missing compiler is
+ * only worth reporting where it would have changed the answer. Same list as the depths
+ * above, for the same reason: adding a language to the structural layer must move both
+ * claims in one commit.
+ */
+function parserCouldHaveRead(sourceFiles) {
+    return sourceFiles.some((file) => PARSED_EXTENSIONS.test(file));
+}
+/**
+ * The question was asked and answered, or it was never asked.
+ *
+ * The structural readers already distinguish the two — `null` for "no parser", `[]` for
+ * "parsed, found nothing" — and every consumer flattened it with `?? []`. This puts the
+ * distinction back where a detector can act on it.
+ */
+function wentUnasked(readerResult, sourceFiles) {
+    return readerResult === null && parserCouldHaveRead(sourceFiles);
+}

package/dist/analyzer/structural/loadTypeScript.d.ts

@@ -2,6 +2,18 @@ import type * as TypeScriptApi from 'typescript';
 export declare function loadTypeScript(): Promise<typeof TypeScriptApi | null>;
 /** For tests that need to observe both paths without reinstalling anything. */
 export declare function resetTypeScriptCache(): void;
+/**
+ * Pretend the compiler is not installed, for tests of what this analyzer says when it
+ * cannot read structure.
+ *
+ * That path is the ordinary one for anybody running `npx prodkit` against their own
+ * repository, and it went untested for as long as it existed because the test machine
+ * always has the compiler. Mocking the module specifier does not work here: the import
+ * is dynamic and resolves before the mock registry answers, so the first analysis in a
+ * file quietly reads the real compiler. Seeding the same cache the loader reads is the
+ * one seam that behaves identically to the real absence.
+ */
+export declare function pretendTypeScriptIsMissing(): void;
 /**
  * Whether the parser is there, for the report rather than for a reader.
  *

package/dist/analyzer/structural/loadTypeScript.js

@@ -2,6 +2,7 @@
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.loadTypeScript = loadTypeScript;
 exports.resetTypeScriptCache = resetTypeScriptCache;
+exports.pretendTypeScriptIsMissing = pretendTypeScriptIsMissing;
 exports.typeScriptIsAvailable = typeScriptIsAvailable;
 /**
  * The TypeScript compiler, loaded when something needs to read structure rather than text.
@@ -40,6 +41,20 @@ async function loadTypeScript() {
 function resetTypeScriptCache() {
     cached = undefined;
 }
+/**
+ * Pretend the compiler is not installed, for tests of what this analyzer says when it
+ * cannot read structure.
+ *
+ * That path is the ordinary one for anybody running `npx prodkit` against their own
+ * repository, and it went untested for as long as it existed because the test machine
+ * always has the compiler. Mocking the module specifier does not work here: the import
+ * is dynamic and resolves before the mock registry answers, so the first analysis in a
+ * file quietly reads the real compiler. Seeding the same cache the loader reads is the
+ * one seam that behaves identically to the real absence.
+ */
+function pretendTypeScriptIsMissing() {
+    cached = null;
+}
 /**
  * Whether the parser is there, for the report rather than for a reader.
  *

package/dist/analyzer/structural/ownershipChecks.d.ts

@@ -4,3 +4,11 @@ export interface OwnershipCheck {
     snippet: string;
 }
 export declare function readOwnershipChecks(root: string, files: string[]): Promise<OwnershipCheck[] | null>;
+/**
+ * Whether this reader would have had routes to walk.
+ *
+ * Same reasoning as the secret sinks: a repository that never imports Express has no
+ * route handler whose shape this reader could have read, so its absence changes no
+ * answer there and the report should not call the question unasked.
+ */
+export declare function anyFileImportsExpress(root: string, files: string[]): Promise<boolean>;

package/dist/analyzer/structural/ownershipChecks.js

@@ -1,6 +1,7 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.readOwnershipChecks = readOwnershipChecks;
+exports.anyFileImportsExpress = anyFileImportsExpress;
 const readTextFileSafe_1 = require("../../utils/readTextFileSafe");
 const loadTypeScript_1 = require("./loadTypeScript");
 /**
@@ -153,3 +154,22 @@ async function readOwnershipChecks(root, files) {
     }
     return checks;
 }
+/**
+ * Whether this reader would have had routes to walk.
+ *
+ * Same reasoning as the secret sinks: a repository that never imports Express has no
+ * route handler whose shape this reader could have read, so its absence changes no
+ * answer there and the report should not call the question unasked.
+ */
+async function anyFileImportsExpress(root, files) {
+    for (const file of files) {
+        if (!READABLE.test(file))
+            continue;
+        const text = await (0, readTextFileSafe_1.readTextFileSafe)(root, file);
+        if (!text)
+            continue;
+        if (/(from\s+['"]express['"]|require\(\s*['"]express['"]\s*\))/.test(text))
+            return true;
+    }
+    return false;
+}

package/dist/analyzer/structural/secretArguments.d.ts

@@ -6,3 +6,17 @@ export interface HardcodedSecretArgument {
     sink: string;
 }
 export declare function readHardcodedSecretArguments(root: string, files: string[]): Promise<HardcodedSecretArgument[] | null>;
+/**
+ * Whether this reader would have had anything to read.
+ *
+ * `unanswered` has to mean "the answer depends on the reader that did not run", not
+ * "a reader did not run". The first version marked every JavaScript repository in the
+ * corpus — 79 of 133 — as not assessed for weak secrets, including the ones where a
+ * plain `const JWT_SECRET = 'changeme'` is found by name and the sink-following reader
+ * would have added nothing.
+ *
+ * The reader's own first act is this test: a file that never mentions a signing or
+ * ciphering package has no sink to follow. Where no file does, the missing compiler
+ * costs nothing and the text answer stands on its own.
+ */
+export declare function anyFileReachesASecretSink(root: string, files: string[]): Promise<boolean>;

package/dist/analyzer/structural/secretArguments.js

@@ -1,6 +1,7 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.readHardcodedSecretArguments = readHardcodedSecretArguments;
+exports.anyFileReachesASecretSink = anyFileReachesASecretSink;
 const readTextFileSafe_1 = require("../../utils/readTextFileSafe");
 const loadTypeScript_1 = require("./loadTypeScript");
 /**
@@ -169,3 +170,28 @@ async function readHardcodedSecretArguments(root, files) {
     }
     return found;
 }
+/**
+ * Whether this reader would have had anything to read.
+ *
+ * `unanswered` has to mean "the answer depends on the reader that did not run", not
+ * "a reader did not run". The first version marked every JavaScript repository in the
+ * corpus — 79 of 133 — as not assessed for weak secrets, including the ones where a
+ * plain `const JWT_SECRET = 'changeme'` is found by name and the sink-following reader
+ * would have added nothing.
+ *
+ * The reader's own first act is this test: a file that never mentions a signing or
+ * ciphering package has no sink to follow. Where no file does, the missing compiler
+ * costs nothing and the text answer stands on its own.
+ */
+async function anyFileReachesASecretSink(root, files) {
+    for (const file of files) {
+        if (!READABLE.test(file))
+            continue;
+        const text = await (0, readTextFileSafe_1.readTextFileSafe)(root, file);
+        if (!text)
+            continue;
+        if (SECRET_SINKS.some((sink) => text.includes(sink.package.replace('node:', ''))))
+            return true;
+    }
+    return false;
+}

package/dist/analyzer/types.d.ts

@@ -74,6 +74,25 @@ export interface DetectorResult {
     /** Stable feature key, e.g. 'security.helmet' */
     key: string;
     present: boolean;
+    /**
+     * The question behind this signal could not be asked.
+     *
+     * `present: false` has carried two meanings that a reader would never confuse: "I
+     * looked and it is not there", and "I could not look". The second happens whenever a
+     * signal rests on the optional TypeScript compiler and the compiler is absent — the
+     * ordinary case for `npx prodkit` against somebody else's repository.
+     *
+     * Measured by hiding `node_modules/typescript` and re-running the fixture corpus: 7
+     * of 133 repositories answer differently, and `segreto-in-italiano` reports a
+     * hardcoded signing secret as `passed` rather than `missing`. A verdict of "fine" is
+     * the one direction blindness must never produce.
+     *
+     * Set it only where the missing reader can change the answer, and only alongside
+     * `present: false`: a signal that found the thing found it, whatever else went
+     * unasked. Consumers turn it into `unknown`, which already means "not assessed"
+     * everywhere downstream — the plan skips it and the score leaves it out.
+     */
+    unanswered?: boolean;
     /** When present is true: was the implementation complete? */
     complete?: boolean;
     evidence: DetectorEvidence[];

package/dist/rules/rules.js

@@ -252,7 +252,20 @@ exports.rules = [
                 app?.present ? 'app' : null,
                 apiKey?.present ? 'apiKey' : null,
             ].filter(Boolean).join(', ');
-            const status = weak ? 'missing' : 'passed';
+            /**
+             * A pass this reading did not earn.
+             *
+             * `jwt.sign(payload, 'cambiami')` is found by following the literal into the
+             * signing call, which needs the optional TypeScript compiler. Without it the
+             * search comes back empty and this rule said "No weak fallback secret patterns
+             * detected" — the analyzer's most confident sentence, produced by not looking.
+             * Measured on `segreto-in-italiano`: `missing` becomes `passed`, 47 becomes 62.
+             *
+             * Finding one is still finding one, so `weak` wins: blindness can only ever turn
+             * a clean verdict into no verdict.
+             */
+            const unanswered = [jwt, session, app, apiKey, unknown].some((d) => d?.unanswered);
+            const status = weak ? 'missing' : unanswered ? 'unknown' : 'passed';
             return mkFinding({
                 id: 'security.weak-secret',
                 title: 'Weak/fallback secret values',
@@ -261,7 +274,9 @@ exports.rules = [
                 severity: weak ? 'critical' : 'info',
                 description: weak
                     ? `Hardcoded fallback secrets detected (${weakTypes || 'unknown'} key context).`
-                    : 'No weak fallback secret patterns detected.',
+                    : unanswered
+                        ? 'Not assessed: finding a literal secret where the name gives nothing away means following it into the call that signs with it, and the optional `typescript` peer dependency is not installed. Install it and re-run.'
+                        : 'No weak fallback secret patterns detected.',
                 recommendation: 'Require strong secrets through environment variables with strict startup validation.',
                 /**
                  * A check that passes because it found nothing has to say what it looked for.
@@ -367,9 +382,18 @@ exports.rules = [
              * surface", and now it only says that when something shows it.
              */
             const nearAuth = Boolean(sec?.details?.rateLimitNearAuth);
+            /**
+             * `partial` is a verdict, and blindness has not earned one.
+             *
+             * Coverage is read from the value the limiter package produces and the prefixes
+             * it is mounted on, so without the optional compiler the answer is empty rather
+             * than negative. Three fixtures that do throttle their login were told nothing
+             * showed it.
+             */
+            const coverageUnasked = Boolean(sec?.details?.rateLimitCoverageUnasked);
             const status = !isExpress || !hasAuth
                 ? 'unknown'
-                : nearAuth ? 'passed' : hasRate ? 'partial' : 'missing';
+                : nearAuth ? 'passed' : coverageUnasked && hasRate ? 'unknown' : hasRate ? 'partial' : 'missing';
             return mkFinding({
                 id: 'security.rate-limit-auth',
                 title: 'Authentication rate limiting',
@@ -388,9 +412,11 @@ exports.rules = [
                         ? 'Rate limiting is in place somewhere, but nothing here shows it covering sign-in.'
                         : status === 'missing'
                             ? 'No auth-focused rate limiting detected.'
-                            : !hasAuth
-                                ? 'Nothing here authenticates anybody, so there is no login surface to throttle.'
-                                : 'This check reads Express middleware, and this project does not use it — any throttling it has is somewhere this cannot see.',
+                            : coverageUnasked && hasRate
+                                ? 'Not assessed: this project throttles something, and whether it reaches the login is read from where the limiter is mounted — which needs the optional `typescript` peer dependency. Install it and re-run.'
+                                : !hasAuth
+                                    ? 'Nothing here authenticates anybody, so there is no login surface to throttle.'
+                                    : 'This check reads Express middleware, and this project does not use it — any throttling it has is somewhere this cannot see.',
                 recommendation: 'Apply express-rate-limit (or equivalent) to login/register/password reset endpoints.',
                 /**
                  * The claim is about rate limiting, so the evidence is about rate limiting.
@@ -586,13 +612,22 @@ exports.rules = [
             // A question about who may act on which record needs a system that has records
             // and callers. The auth detector alone was not enough of a gate: it answers from
             // strings, and a package that searches for `requireAuth` contains it.
+            /**
+             * Per-record authorization is read from the shape of a route handler, so the
+             * optional compiler is the whole reading. Without it `proprieta-in-italiano`
+             * turns from `passed` into a false `missing`, and the report recommends adding
+             * a check the code already makes.
+             */
+            const ownershipUnasked = Boolean(resourceLevel?.unanswered) && !hasPermissions && !hasRoles;
             const status = !hasAuth || !hasUserFacingSurface(analysis)
                 ? 'unknown'
                 : hasPermissions || hasResourceLevel
                     ? 'passed'
                     : hasRoles
                         ? 'partial'
-                        : 'missing';
+                        : ownershipUnasked
+                            ? 'unknown'
+                            : 'missing';
             return mkFinding({
                 id: 'authz.resource-level',
                 title: 'Authorization depth',
@@ -607,7 +642,9 @@ exports.rules = [
                             ? 'No resource-level authorization signals detected.'
                             : !hasAuth
                                 ? 'Nothing here authenticates anybody, so there are no callers to authorize.'
-                                : 'Nothing in this repository serves requests, so there are no records to guard.',
+                                : ownershipUnasked
+                                    ? 'Not assessed: a check that compares the record to the caller is recognised by the shape of the route handler, and the optional `typescript` peer dependency is not installed. Install it and re-run.'
+                                    : 'Nothing in this repository serves requests, so there are no records to guard.',
                 recommendation: 'Add policy/resource-level checks beyond coarse role gates.',
                 evidence: [...(roles?.evidence ?? []), ...(permissions?.evidence ?? []), ...(resourceLevel?.evidence ?? [])],
             });

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@produtype/core",
-  "version": "0.73.0",
+  "version": "0.74.0",
   "description": "Deterministic CLI and library that analyzes a web application repository and reports how far it is from production-ready for the kind of product it is meant to be.",
   "license": "MIT",
   "bin": {