@produtype/core 0.73.0 → 0.75.0

package/dist/analyzer/analyzeProject.js

@@ -651,6 +651,25 @@ async function analyzeProject(projectPath) {
             swiftDeps.push(match[1].toLowerCase());
         }
     }
+    /**
+     * Package.resolved, which is where a Swift project's dependencies are actually
+     * legible.
+     *
+     * `Package.swift` is read above, and on a real application it usually declares the
+     * modules of that package rather than the whole tree: WordPress-iOS resolves 40-odd
+     * packages and `sentry-cocoa` — its crash reporter — appears only here. The lockfile
+     * is data rather than source, it names every transitive dependency, and it is
+     * committed by convention, which makes it the better of the two to read.
+     *
+     * `identity` rather than `location`, because that is the name SPM itself uses and
+     * the one that survives a repository moving host.
+     */
+    for (const file of ownManifests.filter((f) => /(^|\/)Package\.resolved$/.test(f))) {
+        const raw = (await (0, readTextFileSafe_1.readTextFileSafe)(root, file)) ?? '';
+        for (const match of raw.matchAll(/"identity"\s*:\s*"([^"]+)"/g)) {
+            swiftDeps.push(match[1].toLowerCase());
+        }
+    }
     /**
      * .csproj, which is XML rather than JSON or one-entry-per-line.
      *

package/dist/analyzer/detectAuth.js

@@ -8,6 +8,7 @@ const absenceEvidence_1 = require("./absenceEvidence");
 const fileNames_1 = require("./fileNames");
 const valuesFromPackage_1 = require("./structural/valuesFromPackage");
 const ownershipChecks_1 = require("./structural/ownershipChecks");
+const readingDepth_1 = require("./readingDepth");
 /**
  * In a product that talks to a model, `role` usually means who is speaking.
  *
@@ -376,6 +377,7 @@ async function detectAuth(ctx) {
      * structure and needs no vocabulary at all.
      */
     const structuralOwnership = await (0, ownershipChecks_1.readOwnershipChecks)(ctx.root, sourceFiles);
+    const ownershipUnasked = (0, readingDepth_1.wentUnasked)(structuralOwnership, sourceFiles) && (await (0, ownershipChecks_1.anyFileImportsExpress)(ctx.root, sourceFiles));
     const hasAuth = authDeps.length > 0 || routeSignals.length > 0;
     const hasAuthz = permissionSignals.length > 0 || roleSignals.length > 0;
     const b2bHint = b2bSignals.length > 0;
@@ -451,6 +453,15 @@ async function detectAuth(ctx) {
             // Route-level permission checks no longer stand in for per-record ones: with the
             // needles above narrowed, this clause could only reintroduce what they removed.
             present: resourceLevelSignals.length > 0 || (structuralOwnership ?? []).length > 0,
+            /**
+             * The capability with no package to anchor on, read entirely from structure.
+             *
+             * Without the optional compiler the Express route walk does not happen, and the
+             * only thing left is the vocabulary this detector was written to stop relying on.
+             * `proprieta-in-italiano` turns from `passed` into a false `missing` — a
+             * recommendation to add a check the code already has.
+             */
+            unanswered: ownershipUnasked && resourceLevelSignals.length === 0,
             evidence: (0, absenceEvidence_1.evidenceOrSearch)([
                 ...snippetEvidence(resourceLevelSignals),
                 ...(structuralOwnership ?? []).slice(0, 6).map((check) => ({

package/dist/analyzer/detectEnv.js

@@ -4,6 +4,7 @@ exports.detectEnv = detectEnv;
 const textSearch_1 = require("../utils/textSearch");
 const lookupTables_1 = require("./structural/lookupTables");
 const secretArguments_1 = require("./structural/secretArguments");
+const readingDepth_1 = require("./readingDepth");
 const WEAK_SECRET_VALUE_RE = /(changeme|your[_-]?secret|fallback-secret(?:-change-in-production)?|change[_-]in[_-]production|your_jwt_secret_key_change_in_production|local[-_]?secret|development[-_]?secret|dev[-_]?secret|not[_-]?for[_-]?production|test123|secret)/i;
 const FALLBACK_SECRET_RE = /(jwt_secret|secret_key|session_secret)\s*[:=]\s*['"][^'"]*(changeme|your[_-]?secret|fallback-secret(?:-change-in-production)?|change[_-]in[_-]production|your_jwt_secret_key_change_in_production|local[-_]?secret|development[-_]?secret|dev[-_]?secret|not[_-]?for[_-]?production|test123|secret)[^'"]*['"]/i;
 const ENV_FALLBACK_RE = /(process\.env\.(JWT_SECRET|SECRET_KEY|SESSION_SECRET)\s*(\|\||\?\?)\s*['"][^'"]*(changeme|your[_-]?secret|fallback-secret(?:-change-in-production)?|change[_-]in[_-]production|your_jwt_secret_key_change_in_production|local[-_]?secret|development[-_]?secret|dev[-_]?secret|not[_-]?for[_-]?production|test123|secret)[^'"]*['"])/i;
@@ -139,6 +140,14 @@ async function detectEnv(ctx) {
         weakSecretEvidence.push({ type: 'snippet', value: `${hit.snippet}  — reaches ${hit.sink}`, file: hit.file, line: hit.line });
         weakSecretByType.unknown.push({ type: 'snippet', value: `${hit.snippet}  — reaches ${hit.sink}`, file: hit.file, line: hit.line });
     }
+    /**
+     * Whether the sink side of the question went unasked.
+     *
+     * Only the reader that *finds* secrets counts here. `lookupTables` going missing makes
+     * this detector noisier, not blinder, and a noisy finding is one a reader can see and
+     * argue with — silence is not.
+     */
+    const secretSinksUnasked = (0, readingDepth_1.wentUnasked)(secretArguments, sourceFiles) && (await (0, secretArguments_1.anyFileReachesASecretSink)(ctx.root, sourceFiles));
     const weakHits = fallbackHits.filter((m) => WEAK_SECRET_VALUE_RE.test(m.snippet)
         && SECRET_ASSIGNMENT_CONTEXT_RE.test(m.snippet)
         && !namesItself(m.snippet)
@@ -167,26 +176,31 @@ async function detectEnv(ctx) {
         {
             key: 'env.secretFallback.jwt',
             present: weakSecretByType.jwt.length > 0,
+            unanswered: secretSinksUnasked && weakSecretByType.jwt.length === 0,
             evidence: weakSecretByType.jwt,
         },
         {
             key: 'env.secretFallback.session',
             present: weakSecretByType.session.length > 0,
+            unanswered: secretSinksUnasked && weakSecretByType.session.length === 0,
             evidence: weakSecretByType.session,
         },
         {
             key: 'env.secretFallback.app',
             present: weakSecretByType.app.length > 0,
+            unanswered: secretSinksUnasked && weakSecretByType.app.length === 0,
             evidence: weakSecretByType.app,
         },
         {
             key: 'env.secretFallback.apiKey',
             present: weakSecretByType.apiKey.length > 0,
+            unanswered: secretSinksUnasked && weakSecretByType.apiKey.length === 0,
             evidence: weakSecretByType.apiKey,
         },
         {
             key: 'env.secretFallback.unknown',
             present: weakSecretByType.unknown.length > 0,
+            unanswered: secretSinksUnasked && weakSecretByType.unknown.length === 0,
             evidence: weakSecretByType.unknown,
             details: { weakSecretEvidence },
         },

package/dist/analyzer/detectErrorReporting.js

@@ -29,9 +29,74 @@ const REPORTER_DEPS = [
     'trackjs',
 ];
 const REPORTER_PY_DEPS = ['sentry-sdk', 'rollbar', 'bugsnag'];
+/**
+ * The same capability, in the ecosystems where the browser does not exist.
+ *
+ * This detector was written for code running in a tab and then made `required` for the
+ * mobile-app profile, where none of what it reads can occur: an iOS application has no
+ * `window.onerror` and no npm dependency. Three real repositories measured — DuckDuckGo
+ * iOS, thunderbird-android, WordPress-iOS — and all three were told at `high` that a
+ * crash on someone's phone reaches nobody. A check whose answer cannot vary is not a
+ * measure.
+ *
+ * Coordinates rather than words, matched as substrings by the helpers: `io.sentry` also
+ * covers `io.sentry:sentry-android`, and `sentry-cocoa` is how SPM names the package
+ * whatever the product is called.
+ */
+const REPORTER_GRADLE_DEPS = [
+    'io.sentry',
+    'com.google.firebase:firebase-crashlytics',
+    'com.bugsnag',
+    'com.microsoft.appcenter:appcenter-crashes',
+    'ch.acra:acra',
+    'io.embrace',
+    'com.datadoghq:dd-sdk-android',
+    'com.instabug',
+];
+const REPORTER_SWIFT_DEPS = [
+    'sentry-cocoa',
+    'sentry-cocoa-spm',
+    'firebase-ios-sdk',
+    'firebasecrashlytics',
+    'bugsnag-cocoa',
+    'appcenter-sdk-apple',
+    'instabug',
+    'embrace-apple-sdk',
+];
+const REPORTER_DART_DEPS = ['sentry_flutter', 'firebase_crashlytics', 'bugsnag_flutter'];
+/**
+ * Handlers the platform defines, which no author names.
+ *
+ * `NSSetUncaughtExceptionHandler` is Foundation, `Thread.setDefaultUncaughtExceptionHandler`
+ * is the JVM, `FlutterError.onError` is Flutter. Each is the one place its platform
+ * lets a program learn that it is about to die, so a call to it is the capability
+ * itself rather than a word that tends to accompany it — thunderbird-android installs
+ * one and was reported as having nothing.
+ *
+ * `SentrySDK.start` and `FirebaseCrashlytics` are here as well as in the dependency
+ * lists: a repository can use a reporter whose manifest is in another repository, and
+ * the call is still a call.
+ */
+const PLATFORM_CRASH_HANDLERS = [
+    /NSSetUncaughtExceptionHandler\s*\(/,
+    // `(` or `{`: Kotlin writes the handler as a trailing lambda, which is how both real
+    // Android applications measured install theirs.
+    /setDefaultUncaughtExceptionHandler\s*[({]/,
+    /FlutterError\s*\.\s*onError\s*=/,
+    /PlatformDispatcher\s*\.\s*instance\s*\.\s*onError\s*=/,
+    /SentrySDK\s*\.\s*start\s*\(/,
+    /Sentry\s*\.\s*init\s*\(/,
+    /FirebaseCrashlytics|Crashlytics\s*\.\s*crashlytics\s*\(/,
+];
 async function detectErrorReporting(ctx) {
     const evidence = [];
-    const deps = [...(0, detectContext_1.hasAnyDep)(ctx, REPORTER_DEPS), ...(0, detectContext_1.hasAnyPyDep)(ctx, REPORTER_PY_DEPS)];
+    const deps = [
+        ...(0, detectContext_1.hasAnyDep)(ctx, REPORTER_DEPS),
+        ...(0, detectContext_1.hasAnyPyDep)(ctx, REPORTER_PY_DEPS),
+        ...(0, detectContext_1.hasAnyGradleDep)(ctx, REPORTER_GRADLE_DEPS),
+        ...(0, detectContext_1.hasAnySwiftDep)(ctx, REPORTER_SWIFT_DEPS),
+        ...(0, detectContext_1.hasAnyDartDep)(ctx, REPORTER_DART_DEPS),
+    ];
     for (const dep of deps)
         evidence.push({ type: 'dependency', value: dep });
     /**
@@ -44,6 +109,7 @@ async function detectErrorReporting(ctx) {
         /window\.addEventListener\s*\(\s*['"]unhandledrejection['"]/,
         /window\.onerror\s*=/,
         /componentDidCatch\s*\([^)]*\)\s*\{[^}]*(fetch|report|log)/s,
+        ...PLATFORM_CRASH_HANDLERS,
     ], 10);
     for (const hit of handlers) {
         evidence.push({ type: 'snippet', value: hit.snippet, file: hit.file, line: hit.line });
@@ -54,7 +120,7 @@ async function detectErrorReporting(ctx) {
         // A reporting service is wired up once and covers everything; a hand-rolled handler
         // usually covers what its author remembered.
         complete: deps.length > 0,
-        evidence: (0, absenceEvidence_1.evidenceOrSearch)(evidence, 'somewhere a crash in the browser is sent', ['@sentry/browser', '@sentry/react', '@bugsnag/js', 'rollbar', 'logrocket', '@datadog/browser-rum', 'sentry-sdk', 'window.onerror', 'addEventListener("error")', 'addEventListener("unhandledrejection")']),
+        evidence: (0, absenceEvidence_1.evidenceOrSearch)(evidence, 'somewhere a crash in the browser is sent', ['@sentry/browser', '@sentry/react', '@bugsnag/js', 'rollbar', 'logrocket', '@datadog/browser-rum', 'sentry-sdk', 'window.onerror', 'addEventListener("error")', 'addEventListener("unhandledrejection")', 'NSSetUncaughtExceptionHandler', 'Thread.setDefaultUncaughtExceptionHandler', 'FlutterError.onError', 'sentry-cocoa', 'io.sentry', 'firebase-crashlytics']),
         details: { services: deps, handlers: handlers.length },
     };
 }

package/dist/analyzer/detectMobile.js

@@ -82,6 +82,26 @@ const OFFLINE_SWIFT = [
     'realm/realm-cocoa',
     'realmswift',
 ];
+/**
+ * Local storage the platform itself provides, which no dependency list will hold.
+ *
+ * Every entry in the lists above is a third-party database, and the two most widely
+ * used stores on these platforms ship with the operating system: Core Data on Apple's,
+ * `SQLiteDatabase` on Android's. Measured on two real applications whose whole purpose
+ * is working without a network — WordPress-iOS keeps its posts in Core Data,
+ * thunderbird-android keeps its mail in SQLite — and both were told at `high` that they
+ * store nothing locally.
+ *
+ * These are types the platform defines, not names an author picked: `NSManagedObjectContext`
+ * belongs to Core Data and appears nowhere else, and `getWritableDatabase()` is the one
+ * way an Android application opens its own database.
+ */
+const PLATFORM_LOCAL_STORES = [
+    /NSPersistentContainer|NSManagedObjectContext|NSPersistentStoreCoordinator/,
+    /ModelContainer\s*\(|@Model\b/,
+    /SQLiteOpenHelper|getWritableDatabase\s*\(|getReadableDatabase\s*\(/,
+    /android\.database\.sqlite\.SQLiteDatabase/,
+];
 /** Dependencies that put a secret somewhere the operating system protects. */
 const SECURE_STORAGE_DEPS = [
     'flutter_secure_storage',
@@ -315,8 +335,15 @@ async function detectMobile(ctx) {
      * connection is gone is a different thing from one that shows a spinner forever.
      */
     const connectivityChecks = await (0, textSearch_1.searchInFiles)(ctx.root, ctx.files.source, [/Connectivity\(\)/, /connectivity_plus/, /NetInfo\./, /navigator\.onLine/, /NWPathMonitor/, /isReachable/], 3);
+    const platformStores = await (0, textSearch_1.searchInFiles)(ctx.root, ctx.files.source, PLATFORM_LOCAL_STORES, 3);
     const offlineEvidence = [
         ...offlineDeps.map((dep) => ({ type: 'dependency', value: dep })),
+        ...platformStores.map((match) => ({
+            type: 'snippet',
+            value: match.snippet,
+            file: match.file,
+            line: match.line,
+        })),
         ...connectivityChecks.map((match) => ({
             type: 'snippet',
             value: match.snippet,
@@ -361,8 +388,8 @@ async function detectMobile(ctx) {
         },
         {
             key: 'mobile.offline',
-            present: offlineDeps.length > 0,
-            evidence: (0, absenceEvidence_1.evidenceOrSearch)(offlineEvidence, 'a local database the app can read with no network', ['sqflite', 'drift', 'hive', 'isar', 'objectbox', 'realm', 'androidx.room', 'sqldelight', 'grdb.swift', 'sqlite.swift']),
+            present: offlineDeps.length > 0 || platformStores.length > 0,
+            evidence: (0, absenceEvidence_1.evidenceOrSearch)(offlineEvidence, 'a local database the app can read with no network', ['sqflite', 'drift', 'hive', 'isar', 'objectbox', 'realm', 'androidx.room', 'sqldelight', 'grdb.swift', 'sqlite.swift', 'NSManagedObjectContext', 'SQLiteOpenHelper', 'getWritableDatabase(']),
         },
         {
             key: 'mobile.forcedUpdate',

package/dist/analyzer/detectSecurity.js

@@ -6,6 +6,7 @@ const readTextFileSafe_1 = require("../utils/readTextFileSafe");
 const textSearch_1 = require("../utils/textSearch");
 const absenceEvidence_1 = require("./absenceEvidence");
 const valuesFromPackage_1 = require("./structural/valuesFromPackage");
+const readingDepth_1 = require("./readingDepth");
 const developmentOnly_1 = require("./developmentOnly");
 /** Lines that decide which origins may call this server. */
 const ORIGIN_HANDLING = [/Access-Control-Allow-Origin/i, /ALLOWED_ORIGINS/, /allowedOrigins/i];
@@ -371,6 +372,16 @@ async function detectSecurity(ctx) {
             helmet,
             rateLimit,
             rateLimitNearAuth,
+            /**
+             * Whether coverage could be established at all.
+             *
+             * Whether a limiter reaches the login is read from the value the package
+             * produces and the paths it is mounted on — a structural question. Without the
+             * optional compiler `mountedPaths` is empty and three fixtures that do throttle
+             * their sign-in drop from `passed` to `partial`, told that nothing shows the
+             * coverage they have.
+             */
+            rateLimitCoverageUnasked: (0, readingDepth_1.wentUnasked)(boundLimiterUses, source) && !rateLimitNearAuth,
             corsLoose: corsLoose.length > 0,
             corsStrict: corsStrict.length > 0,
             webhookSignature: webhookSig.length > 0,

package/dist/analyzer/readingDepth.d.ts

@@ -50,3 +50,21 @@ export declare function readingDepths(sourceFiles: string[], unreadable: Array<{
  * worth a clause; telling them their Go is read by keyword is worth a different one.
  */
 export declare function describeReadingDepth(readings: LanguageReading[], parserAvailable: boolean): string | undefined;
+/**
+ * Whether a parser would have had anything to say about this repository.
+ *
+ * A detector that loses its structural reader has lost nothing on a Go or Python
+ * project — no parser here was ever going to read those — so the missing compiler is
+ * only worth reporting where it would have changed the answer. Same list as the depths
+ * above, for the same reason: adding a language to the structural layer must move both
+ * claims in one commit.
+ */
+export declare function parserCouldHaveRead(sourceFiles: string[]): boolean;
+/**
+ * The question was asked and answered, or it was never asked.
+ *
+ * The structural readers already distinguish the two — `null` for "no parser", `[]` for
+ * "parsed, found nothing" — and every consumer flattened it with `?? []`. This puts the
+ * distinction back where a detector can act on it.
+ */
+export declare function wentUnasked(readerResult: unknown | null, sourceFiles: string[]): boolean;

package/dist/analyzer/readingDepth.js

@@ -2,6 +2,8 @@
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.readingDepths = readingDepths;
 exports.describeReadingDepth = describeReadingDepth;
+exports.parserCouldHaveRead = parserCouldHaveRead;
+exports.wentUnasked = wentUnasked;
 const catalogue_1 = require("./catalogue");
 /**
  * The extensions a parser reads today.
@@ -89,3 +91,25 @@ function describeReadingDepth(readings, parserAvailable) {
             : []),
     ].join(' ');
 }
+/**
+ * Whether a parser would have had anything to say about this repository.
+ *
+ * A detector that loses its structural reader has lost nothing on a Go or Python
+ * project — no parser here was ever going to read those — so the missing compiler is
+ * only worth reporting where it would have changed the answer. Same list as the depths
+ * above, for the same reason: adding a language to the structural layer must move both
+ * claims in one commit.
+ */
+function parserCouldHaveRead(sourceFiles) {
+    return sourceFiles.some((file) => PARSED_EXTENSIONS.test(file));
+}
+/**
+ * The question was asked and answered, or it was never asked.
+ *
+ * The structural readers already distinguish the two — `null` for "no parser", `[]` for
+ * "parsed, found nothing" — and every consumer flattened it with `?? []`. This puts the
+ * distinction back where a detector can act on it.
+ */
+function wentUnasked(readerResult, sourceFiles) {
+    return readerResult === null && parserCouldHaveRead(sourceFiles);
+}

package/dist/analyzer/structural/loadTypeScript.d.ts

@@ -2,6 +2,18 @@ import type * as TypeScriptApi from 'typescript';
 export declare function loadTypeScript(): Promise<typeof TypeScriptApi | null>;
 /** For tests that need to observe both paths without reinstalling anything. */
 export declare function resetTypeScriptCache(): void;
+/**
+ * Pretend the compiler is not installed, for tests of what this analyzer says when it
+ * cannot read structure.
+ *
+ * That path is the ordinary one for anybody running `npx prodkit` against their own
+ * repository, and it went untested for as long as it existed because the test machine
+ * always has the compiler. Mocking the module specifier does not work here: the import
+ * is dynamic and resolves before the mock registry answers, so the first analysis in a
+ * file quietly reads the real compiler. Seeding the same cache the loader reads is the
+ * one seam that behaves identically to the real absence.
+ */
+export declare function pretendTypeScriptIsMissing(): void;
 /**
  * Whether the parser is there, for the report rather than for a reader.
  *

package/dist/analyzer/structural/loadTypeScript.js

@@ -2,6 +2,7 @@
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.loadTypeScript = loadTypeScript;
 exports.resetTypeScriptCache = resetTypeScriptCache;
+exports.pretendTypeScriptIsMissing = pretendTypeScriptIsMissing;
 exports.typeScriptIsAvailable = typeScriptIsAvailable;
 /**
  * The TypeScript compiler, loaded when something needs to read structure rather than text.
@@ -40,6 +41,20 @@ async function loadTypeScript() {
 function resetTypeScriptCache() {
     cached = undefined;
 }
+/**
+ * Pretend the compiler is not installed, for tests of what this analyzer says when it
+ * cannot read structure.
+ *
+ * That path is the ordinary one for anybody running `npx prodkit` against their own
+ * repository, and it went untested for as long as it existed because the test machine
+ * always has the compiler. Mocking the module specifier does not work here: the import
+ * is dynamic and resolves before the mock registry answers, so the first analysis in a
+ * file quietly reads the real compiler. Seeding the same cache the loader reads is the
+ * one seam that behaves identically to the real absence.
+ */
+function pretendTypeScriptIsMissing() {
+    cached = null;
+}
 /**
  * Whether the parser is there, for the report rather than for a reader.
  *

package/dist/analyzer/structural/ownershipChecks.d.ts

@@ -4,3 +4,11 @@ export interface OwnershipCheck {
     snippet: string;
 }
 export declare function readOwnershipChecks(root: string, files: string[]): Promise<OwnershipCheck[] | null>;
+/**
+ * Whether this reader would have had routes to walk.
+ *
+ * Same reasoning as the secret sinks: a repository that never imports Express has no
+ * route handler whose shape this reader could have read, so its absence changes no
+ * answer there and the report should not call the question unasked.
+ */
+export declare function anyFileImportsExpress(root: string, files: string[]): Promise<boolean>;

package/dist/analyzer/structural/ownershipChecks.js

@@ -1,6 +1,7 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.readOwnershipChecks = readOwnershipChecks;
+exports.anyFileImportsExpress = anyFileImportsExpress;
 const readTextFileSafe_1 = require("../../utils/readTextFileSafe");
 const loadTypeScript_1 = require("./loadTypeScript");
 /**
@@ -153,3 +154,22 @@ async function readOwnershipChecks(root, files) {
     }
     return checks;
 }
+/**
+ * Whether this reader would have had routes to walk.
+ *
+ * Same reasoning as the secret sinks: a repository that never imports Express has no
+ * route handler whose shape this reader could have read, so its absence changes no
+ * answer there and the report should not call the question unasked.
+ */
+async function anyFileImportsExpress(root, files) {
+    for (const file of files) {
+        if (!READABLE.test(file))
+            continue;
+        const text = await (0, readTextFileSafe_1.readTextFileSafe)(root, file);
+        if (!text)
+            continue;
+        if (/(from\s+['"]express['"]|require\(\s*['"]express['"]\s*\))/.test(text))
+            return true;
+    }
+    return false;
+}

package/dist/analyzer/structural/secretArguments.d.ts

@@ -6,3 +6,17 @@ export interface HardcodedSecretArgument {
     sink: string;
 }
 export declare function readHardcodedSecretArguments(root: string, files: string[]): Promise<HardcodedSecretArgument[] | null>;
+/**
+ * Whether this reader would have had anything to read.
+ *
+ * `unanswered` has to mean "the answer depends on the reader that did not run", not
+ * "a reader did not run". The first version marked every JavaScript repository in the
+ * corpus — 79 of 133 — as not assessed for weak secrets, including the ones where a
+ * plain `const JWT_SECRET = 'changeme'` is found by name and the sink-following reader
+ * would have added nothing.
+ *
+ * The reader's own first act is this test: a file that never mentions a signing or
+ * ciphering package has no sink to follow. Where no file does, the missing compiler
+ * costs nothing and the text answer stands on its own.
+ */
+export declare function anyFileReachesASecretSink(root: string, files: string[]): Promise<boolean>;

package/dist/analyzer/structural/secretArguments.js

@@ -1,6 +1,7 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.readHardcodedSecretArguments = readHardcodedSecretArguments;
+exports.anyFileReachesASecretSink = anyFileReachesASecretSink;
 const readTextFileSafe_1 = require("../../utils/readTextFileSafe");
 const loadTypeScript_1 = require("./loadTypeScript");
 /**
@@ -169,3 +170,28 @@ async function readHardcodedSecretArguments(root, files) {
     }
     return found;
 }
+/**
+ * Whether this reader would have had anything to read.
+ *
+ * `unanswered` has to mean "the answer depends on the reader that did not run", not
+ * "a reader did not run". The first version marked every JavaScript repository in the
+ * corpus — 79 of 133 — as not assessed for weak secrets, including the ones where a
+ * plain `const JWT_SECRET = 'changeme'` is found by name and the sink-following reader
+ * would have added nothing.
+ *
+ * The reader's own first act is this test: a file that never mentions a signing or
+ * ciphering package has no sink to follow. Where no file does, the missing compiler
+ * costs nothing and the text answer stands on its own.
+ */
+async function anyFileReachesASecretSink(root, files) {
+    for (const file of files) {
+        if (!READABLE.test(file))
+            continue;
+        const text = await (0, readTextFileSafe_1.readTextFileSafe)(root, file);
+        if (!text)
+            continue;
+        if (SECRET_SINKS.some((sink) => text.includes(sink.package.replace('node:', ''))))
+            return true;
+    }
+    return false;
+}

package/dist/analyzer/types.d.ts

@@ -74,6 +74,25 @@ export interface DetectorResult {
     /** Stable feature key, e.g. 'security.helmet' */
     key: string;
     present: boolean;
+    /**
+     * The question behind this signal could not be asked.
+     *
+     * `present: false` has carried two meanings that a reader would never confuse: "I
+     * looked and it is not there", and "I could not look". The second happens whenever a
+     * signal rests on the optional TypeScript compiler and the compiler is absent — the
+     * ordinary case for `npx prodkit` against somebody else's repository.
+     *
+     * Measured by hiding `node_modules/typescript` and re-running the fixture corpus: 7
+     * of 133 repositories answer differently, and `segreto-in-italiano` reports a
+     * hardcoded signing secret as `passed` rather than `missing`. A verdict of "fine" is
+     * the one direction blindness must never produce.
+     *
+     * Set it only where the missing reader can change the answer, and only alongside
+     * `present: false`: a signal that found the thing found it, whatever else went
+     * unasked. Consumers turn it into `unknown`, which already means "not assessed"
+     * everywhere downstream — the plan skips it and the score leaves it out.
+     */
+    unanswered?: boolean;
     /** When present is true: was the implementation complete? */
     complete?: boolean;
     evidence: DetectorEvidence[];

package/dist/rules/rules.js

@@ -252,7 +252,20 @@ exports.rules = [
                 app?.present ? 'app' : null,
                 apiKey?.present ? 'apiKey' : null,
             ].filter(Boolean).join(', ');
-            const status = weak ? 'missing' : 'passed';
+            /**
+             * A pass this reading did not earn.
+             *
+             * `jwt.sign(payload, 'cambiami')` is found by following the literal into the
+             * signing call, which needs the optional TypeScript compiler. Without it the
+             * search comes back empty and this rule said "No weak fallback secret patterns
+             * detected" — the analyzer's most confident sentence, produced by not looking.
+             * Measured on `segreto-in-italiano`: `missing` becomes `passed`, 47 becomes 62.
+             *
+             * Finding one is still finding one, so `weak` wins: blindness can only ever turn
+             * a clean verdict into no verdict.
+             */
+            const unanswered = [jwt, session, app, apiKey, unknown].some((d) => d?.unanswered);
+            const status = weak ? 'missing' : unanswered ? 'unknown' : 'passed';
             return mkFinding({
                 id: 'security.weak-secret',
                 title: 'Weak/fallback secret values',
@@ -261,7 +274,9 @@ exports.rules = [
                 severity: weak ? 'critical' : 'info',
                 description: weak
                     ? `Hardcoded fallback secrets detected (${weakTypes || 'unknown'} key context).`
-                    : 'No weak fallback secret patterns detected.',
+                    : unanswered
+                        ? 'Not assessed: finding a literal secret where the name gives nothing away means following it into the call that signs with it, and the optional `typescript` peer dependency is not installed. Install it and re-run.'
+                        : 'No weak fallback secret patterns detected.',
                 recommendation: 'Require strong secrets through environment variables with strict startup validation.',
                 /**
                  * A check that passes because it found nothing has to say what it looked for.
@@ -367,9 +382,18 @@ exports.rules = [
              * surface", and now it only says that when something shows it.
              */
             const nearAuth = Boolean(sec?.details?.rateLimitNearAuth);
+            /**
+             * `partial` is a verdict, and blindness has not earned one.
+             *
+             * Coverage is read from the value the limiter package produces and the prefixes
+             * it is mounted on, so without the optional compiler the answer is empty rather
+             * than negative. Three fixtures that do throttle their login were told nothing
+             * showed it.
+             */
+            const coverageUnasked = Boolean(sec?.details?.rateLimitCoverageUnasked);
             const status = !isExpress || !hasAuth
                 ? 'unknown'
-                : nearAuth ? 'passed' : hasRate ? 'partial' : 'missing';
+                : nearAuth ? 'passed' : coverageUnasked && hasRate ? 'unknown' : hasRate ? 'partial' : 'missing';
             return mkFinding({
                 id: 'security.rate-limit-auth',
                 title: 'Authentication rate limiting',
@@ -388,9 +412,11 @@ exports.rules = [
                         ? 'Rate limiting is in place somewhere, but nothing here shows it covering sign-in.'
                         : status === 'missing'
                             ? 'No auth-focused rate limiting detected.'
-                            : !hasAuth
-                                ? 'Nothing here authenticates anybody, so there is no login surface to throttle.'
-                                : 'This check reads Express middleware, and this project does not use it — any throttling it has is somewhere this cannot see.',
+                            : coverageUnasked && hasRate
+                                ? 'Not assessed: this project throttles something, and whether it reaches the login is read from where the limiter is mounted — which needs the optional `typescript` peer dependency. Install it and re-run.'
+                                : !hasAuth
+                                    ? 'Nothing here authenticates anybody, so there is no login surface to throttle.'
+                                    : 'This check reads Express middleware, and this project does not use it — any throttling it has is somewhere this cannot see.',
                 recommendation: 'Apply express-rate-limit (or equivalent) to login/register/password reset endpoints.',
                 /**
                  * The claim is about rate limiting, so the evidence is about rate limiting.
@@ -586,13 +612,22 @@ exports.rules = [
             // A question about who may act on which record needs a system that has records
             // and callers. The auth detector alone was not enough of a gate: it answers from
             // strings, and a package that searches for `requireAuth` contains it.
+            /**
+             * Per-record authorization is read from the shape of a route handler, so the
+             * optional compiler is the whole reading. Without it `proprieta-in-italiano`
+             * turns from `passed` into a false `missing`, and the report recommends adding
+             * a check the code already makes.
+             */
+            const ownershipUnasked = Boolean(resourceLevel?.unanswered) && !hasPermissions && !hasRoles;
             const status = !hasAuth || !hasUserFacingSurface(analysis)
                 ? 'unknown'
                 : hasPermissions || hasResourceLevel
                     ? 'passed'
                     : hasRoles
                         ? 'partial'
-                        : 'missing';
+                        : ownershipUnasked
+                            ? 'unknown'
+                            : 'missing';
             return mkFinding({
                 id: 'authz.resource-level',
                 title: 'Authorization depth',
@@ -607,7 +642,9 @@ exports.rules = [
                             ? 'No resource-level authorization signals detected.'
                             : !hasAuth
                                 ? 'Nothing here authenticates anybody, so there are no callers to authorize.'
-                                : 'Nothing in this repository serves requests, so there are no records to guard.',
+                                : ownershipUnasked
+                                    ? 'Not assessed: a check that compares the record to the caller is recognised by the shape of the route handler, and the optional `typescript` peer dependency is not installed. Install it and re-run.'
+                                    : 'Nothing in this repository serves requests, so there are no records to guard.',
                 recommendation: 'Add policy/resource-level checks beyond coarse role gates.',
                 evidence: [...(roles?.evidence ?? []), ...(permissions?.evidence ?? []), ...(resourceLevel?.evidence ?? [])],
             });

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@produtype/core",
-  "version": "0.73.0",
+  "version": "0.75.0",
   "description": "Deterministic CLI and library that analyzes a web application repository and reports how far it is from production-ready for the kind of product it is meant to be.",
   "license": "MIT",
   "bin": {