@produtype/core 0.8.2 → 0.10.2

package/README.md

@@ -174,7 +174,7 @@ prodkit plan ../my-app --output prodkit-plan.md
 
 _Generated from the analyzer itself — run `npm run docs:stacks` after changing a detector._
 
-- **Backend:** Express, Next.js, NestJS, Fastify, Hono, Elysia, Koa, AdonisJS, SvelteKit, Remix, Nuxt, Nitro, Astro, Django, Flask, FastAPI, Litestar, Sanic, Tornado, aiohttp, Starlette, Gin, Echo, Fiber, chi, Gorilla, Beego, Go, Rails, Sinatra, Hanami, Roda, Grape, Ruby, Laravel, Symfony, Slim, CodeIgniter, CakePHP, Yii, PHP, ASP.NET Core, .NET
+- **Backend:** Express, Next.js, NestJS, Fastify, Hono, Elysia, Koa, AdonisJS, SvelteKit, Remix, Nuxt, Nitro, Astro, Django, Flask, FastAPI, Litestar, Sanic, Tornado, aiohttp, Starlette, Streamlit, Gradio, Dash, Chainlit, Gin, Echo, Fiber, chi, Gorilla, Beego, Go, Rails, Sinatra, Hanami, Roda, Grape, Ruby, Laravel, Symfony, Slim, CodeIgniter, CakePHP, Yii, PHP, ASP.NET Core, .NET
 - **Frontend:** React, Vite, Vue, Nuxt, Svelte, Angular, Astro, Solid, Qwik, Preact, Remix, htmx, Tailwind CSS, Electron
 - **Mobile:** Flutter, React Native, iOS (native), Android (native)
 - **Databases:** Postgres, MySQL, SQLite, SQL Server, MongoDB, Redis, Firestore, DynamoDB, Convex

package/dist/analyzer/analyzeProject.js

@@ -34,6 +34,8 @@ var __importStar = (this && this.__importStar) || (function () {
 })();
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.analyzeProject = analyzeProject;
+const detectPackaging_1 = require("./detectPackaging");
+const importedDependencies_1 = require("./importedDependencies");
 const path = __importStar(require("path"));
 const zod_1 = require("zod");
 const fileScanner_1 = require("../utils/fileScanner");
@@ -151,7 +153,20 @@ function isTestOrExamplePath(file) {
  * application is not fully understood by being readable — but being readable is the
  * difference between a partial reading and none.
  */
-const SOURCE_EXTENSIONS = /\.(ts|tsx|js|jsx|mjs|cjs|py|php|go|rb|java|cs|rs|kt|swift|dart)$/;
+/**
+ * `.html` is here, and it is not decoration.
+ *
+ * Without it a repository whose entire product is one `index.html` with an inline
+ * `<script>` — a browser game, a static site, a prototype — was reported as having zero
+ * source files, no stack, and a score capped at 39 for being unreadable. `PhaserJS-
+ * Spacegame` is exactly that: a complete game, Phaser loaded from a CDN, and nothing
+ * for the analyzer to look at. A hardcoded key in an inline script is also a real
+ * finding, and every text search here was skipping the file it would be in.
+ *
+ * `.vue`, `.svelte` and `.astro` were missing for the same reason: a single-file
+ * component holds the logic, not just the markup.
+ */
+const SOURCE_EXTENSIONS = /\.(ts|tsx|js|jsx|mjs|cjs|py|php|go|rb|java|cs|rs|kt|swift|dart|html?|vue|svelte|astro)$/;
 function pickSource(files) {
     return files.filter((f) => SOURCE_EXTENSIONS.test(f) && !isTestOrExamplePath(f));
 }
@@ -503,6 +518,30 @@ async function analyzeProject(projectPath) {
         mergeDeps(npmDeps, workspace.packageJson?.dependencies);
         mergeDeps(npmDeps, workspace.packageJson?.devDependencies);
     }
+    /**
+     * What the code imports, when nothing declared it.
+     *
+     * Only reached when the manifests for that language produced nothing at all, so a
+     * declared dependency is never overridden by a guess at an import. Seventeen
+     * repositories in the verification corpus were called unreadable on the strength of a
+     * missing manifest while stating their dependencies in the first three lines of their
+     * only source file.
+     */
+    const inferredDependencySources = [];
+    if (pythonDeps.length === 0) {
+        const imported = await (0, importedDependencies_1.pythonImports)(root, sourceFiles);
+        if (imported.length > 0) {
+            pythonDeps.push(...imported);
+            inferredDependencySources.push('Python imports');
+        }
+    }
+    if (Object.keys(npmDeps).length === 0) {
+        const imported = await (0, importedDependencies_1.browserImports)(root, sourceFiles);
+        for (const name of imported)
+            npmDeps[name] = 'imported';
+        if (imported.length > 0)
+            inferredDependencySources.push('script tags and module imports');
+    }
     const workspaceStacks = workspaces.map((workspace) => {
         const wsNpmDeps = {};
         mergeDeps(wsNpmDeps, workspace.packageJson?.dependencies);
@@ -538,7 +577,7 @@ async function analyzeProject(projectPath) {
         npmDeps,
         workspaces,
     };
-    const [pm, frontend, backend, database, docker, env, auth, security, uploads, gdpr, billing, observability, jobs, marketplace, aiSafety, engagement, deployment, audit, game, clientLogic, mobile, errorReporting] = await Promise.all([
+    const [pm, frontend, backend, database, docker, env, auth, security, uploads, gdpr, billing, observability, jobs, marketplace, aiSafety, engagement, deployment, audit, game, clientLogic, mobile, errorReporting, packaging] = await Promise.all([
         (0, detectPackageManager_1.detectPackageManager)(ctx),
         (0, detectFrontend_1.detectFrontend)(ctx),
         (0, detectBackend_1.detectBackend)(ctx),
@@ -561,6 +600,7 @@ async function analyzeProject(projectPath) {
         (0, detectClientLogic_1.detectClientLogic)(ctx),
         (0, detectMobile_1.detectMobile)(ctx),
         (0, detectErrorReporting_1.detectErrorReporting)(ctx),
+        (0, detectPackaging_1.detectPackaging)(ctx),
     ]);
     const detectors = (0, detectStack_1.mergeDetectors)([
         pm.result,
@@ -573,6 +613,7 @@ async function analyzeProject(projectPath) {
         clientLogic,
         ...mobile,
         errorReporting,
+        ...packaging,
         docker,
         ...env,
         ...auth,
@@ -608,6 +649,12 @@ async function analyzeProject(projectPath) {
             warnings: [
                 ...pm.warnings,
                 ...unreadableLanguages(allFiles).map((entry) => `${entry.files} ${entry.language} files were not analysed: this reading covers only part of the repository`),
+                // Said out loud, because a dependency nobody declared is a weaker fact than one
+                // that is pinned in a lockfile, and the reader is entitled to know which of the
+                // two this reading rests on.
+                ...(inferredDependencySources.length > 0
+                    ? [`No dependency manifest was found: dependencies were read from ${inferredDependencySources.join(' and ')}, so versions are unknown.`]
+                    : []),
             ],
             workspaces: workspaceStacks,
             files: allFiles,

package/dist/analyzer/catalogue.js

@@ -71,6 +71,14 @@ exports.PYTHON_BACKEND_FRAMEWORKS = [
     ['tornado', 'tornado'],
     ['aiohttp', 'aiohttp'],
     ['starlette', 'starlette'],
+    /**
+     * These serve an application over HTTP without calling themselves web frameworks,
+     * and a repository built on one was reported as having no backend at all.
+     */
+    ['streamlit', 'streamlit'],
+    ['gradio', 'gradio'],
+    ['dash', 'dash'],
+    ['chainlit', 'chainlit'],
 ];
 /** Frontend frameworks settled by their signature dependency. */
 exports.FRONTEND_FRAMEWORKS = [
@@ -109,6 +117,11 @@ exports.LANGUAGES = [
 ];
 /** Display names for ids the tables above produce. */
 const LABELS = {
+    streamlit: 'Streamlit',
+    gradio: 'Gradio',
+    dash: 'Dash',
+    chainlit: 'Chainlit',
+    html: 'HTML (no framework)',
     next: 'Next.js',
     nestjs: 'NestJS',
     fastify: 'Fastify',

package/dist/analyzer/detectBilling.js

@@ -24,7 +24,15 @@ async function detectBilling(ctx) {
          * a customer or subscription id, or a webhook path. One that only ever writes
          * "Stripe" in prose is talking about Stripe, not billing through it.
          */
-        /STRIPE_[A-Z0-9_]+/,
+        /**
+         * A Stripe credential, not any constant whose name begins with those six letters.
+         *
+         * `/STRIPE_[A-Z0-9_]+/` matched `STRIPE_LEN` in Unity's bundled xxHash3, where a
+         * stripe is a block of bytes being hashed, and reported a game as taking
+         * subscriptions. The word is only evidence of billing when it names a key, a
+         * secret, a token or an id.
+         */
+        /STRIPE_(?:[A-Z0-9_]*_)?(?:KEY|SECRET|TOKEN|ID|WEBHOOK|PRICE|ACCOUNT|API)[A-Z0-9_]*/,
         /stripeCustomerId/i,
         /stripeSubscriptionId/i,
         /\/webhooks?\/stripe/i,

package/dist/analyzer/detectClientLogic.js

@@ -71,11 +71,34 @@ async function detectClientLogic(ctx) {
     for (const hit of drawing) {
         evidence.push({ type: 'snippet', value: hit.snippet, file: hit.file, line: hit.line });
     }
+    /**
+     * A render loop. The application is deciding what the screen shows, frame by frame.
+     *
+     * Counted here because canvas drawing on its own was one signal short of the two this
+     * detector needs, so half a dozen browser games in the verification corpus came back
+     * as `static-site` — a brochure page — when their whole product is a loop over a
+     * canvas. A marketing page that animates on scroll uses the same call and has no
+     * canvas, so it still reaches only one signal and is still a static site.
+     */
+    const frameLoop = await (0, textSearch_1.searchInFiles)(ctx.root, ctx.files.source, 
+    /**
+     * `setInterval` is deliberately absent. It was here for one revision and was wrong:
+     * it matched a countdown in a React modal and a polling sync in an API client,
+     * neither of which is the application deciding what the screen shows. Both projects
+     * were real products that this demoted to plain client applications, and a demoted
+     * profile is judged by fewer expectations — so the change quietly raised their
+     * scores. `requestAnimationFrame` means a render loop and nothing else.
+     */
+    [/requestAnimationFrame\s*\(/], 6);
+    for (const hit of frameLoop) {
+        evidence.push({ type: 'snippet', value: hit.snippet, file: hit.file, line: hit.line });
+    }
     const signals = [
         stateDeps.length > 0,
         logicDirs.length > 0,
         persistence.length > 0 || dartStorage.length > 0,
         drawing.length > 0,
+        frameLoop.length > 0,
     ].filter(Boolean).length;
     return {
         key: 'stack.clientLogic',
@@ -83,6 +106,6 @@ async function detectClientLogic(ctx) {
         // banner writing to localStorage, or a marketing page with a hero canvas.
         present: signals >= 2,
         evidence,
-        details: { stateDeps, logicDirs: logicDirs.length, persistence: persistence.length + dartStorage.length, drawing: drawing.length, signals },
+        details: { stateDeps, logicDirs: logicDirs.length, persistence: persistence.length + dartStorage.length, drawing: drawing.length, frameLoop: frameLoop.length, signals },
     };
 }

package/dist/analyzer/detectFrontend.js

@@ -34,6 +34,25 @@ async function detectFrontend(ctx) {
         frameworks.push('flutter');
         evidence.push({ type: 'dependency', value: 'flutter' });
     }
+    /**
+     * A page is a front end, whether or not a framework built it.
+     *
+     * This list only ever held frameworks, so a repository whose product is `index.html`
+     * plus a script had no front end, no stack, and a report that called it unreadable
+     * and capped its score at 39. Six of them sit in the verification corpus — browser
+     * games and small static sites, each one perfectly legible.
+     *
+     * Recorded only when no framework claimed the project, because saying "react, html"
+     * about a React application is noise: every one of them ships an `index.html`.
+     */
+    if (frameworks.length === 0) {
+        const pages = ctx.files.source.filter((file) => /\.html?$/i.test(file));
+        if (pages.length > 0) {
+            frameworks.push('html');
+            for (const page of pages.slice(0, 3))
+                evidence.push({ type: 'file', value: page, file: page });
+        }
+    }
     const extras = (0, detectContext_1.hasAnyDep)(ctx, ['react-router-dom', 'axios', 'tailwindcss', 'electron']);
     for (const d of extras) {
         frameworks.push(d);

package/dist/analyzer/detectMobile.js

@@ -92,8 +92,23 @@ const OFFLINE_DEPS = [
     '@tanstack/query-persist-client-core',
     'powersync',
 ];
+/**
+ * Paths that contain a platform marker without being a project.
+ *
+ * Every macOS `.bundle`, `.framework`, `.app` and `.dSYM` carries an `Info.plist` by
+ * definition, and build caches are full of them. A Unity game was classified as an iOS
+ * application on the strength of
+ * `Library/BurstCache/JIT/…bundle.dSYM/Contents/Info.plist` — a debug-symbols bundle
+ * inside generated output, in a repository whose own engine had already been detected.
+ *
+ * `Pods`, `DerivedData` and `node_modules` are here for the same reason: they hold
+ * other people's projects, and finding one there says nothing about this one.
+ */
+const GENERATED_OR_VENDORED = /(^|\/)(Library|Pods|DerivedData|build|node_modules|dist|out|\.gradle)(\/|$)|\.(bundle|framework|app|dSYM|xcframework)\//i;
 function matchesAny(files, patterns) {
-    return files.filter((file) => patterns.some((pattern) => pattern.test(file)));
+    return files
+        .filter((file) => !GENERATED_OR_VENDORED.test(file))
+        .filter((file) => patterns.some((pattern) => pattern.test(file)));
 }
 async function detectMobile(ctx) {
     const iosFiles = matchesAny(ctx.files.all, IOS_MARKERS);

package/dist/analyzer/detectObservability.js

@@ -8,18 +8,31 @@ async function detectObservability(ctx) {
     const logDeps = (0, detectContext_1.hasAnyDep)(ctx, ['winston', 'pino', 'morgan', 'bunyan']);
     const sentryDeps = (0, detectContext_1.hasAnyDep)(ctx, ['@sentry/node', 'sentry-sdk']);
     for (const d of logDeps)
-        evidence.push({ type: 'dependency', value: d });
+        evidence.push({ type: 'dependency', value: d, claim: 'logging' });
     for (const d of sentryDeps)
-        evidence.push({ type: 'dependency', value: d });
+        evidence.push({ type: 'dependency', value: d, claim: 'logging' });
     const hits = await (0, textSearch_1.searchInFiles)(ctx.root, ctx.files.source, [/\/(health|healthz|readyz)\b/i, /x-request-id/i, /correlation-id/i, /error\s*handler/i, /RotatingFileHandler/i], 25);
-    for (const m of hits)
-        evidence.push({ type: 'snippet', value: m.snippet, file: m.file, line: m.line });
+    /**
+     * One search, three answers, so the claim is decided per hit rather than per search.
+     *
+     * A `logger.debug(...)` line was being cited as the evidence for a missing health
+     * endpoint, which is not an argument about health at all. Whichever pattern matched
+     * is what the line is evidence of.
+     */
+    for (const m of hits) {
+        const claim = /\/(health|healthz|readyz)\b/i.test(m.snippet)
+            ? 'health'
+            : /x-request-id|correlation-id/i.test(m.snippet)
+                ? 'request-id'
+                : 'logging';
+        evidence.push({ type: 'snippet', value: m.snippet, file: m.file, line: m.line, claim });
+    }
     // A file-routing framework declares the endpoint as a path, not as a string in
     // source: Next's app/api/health/route.ts contains no "/health" to match. Searching
     // only the text reports hardened applications as having no health check.
     const healthFiles = ctx.files.all.filter((file) => /(^|\/)(health|healthz|readyz|liveness|readiness)(\/route|\.[a-z]+)?$|(^|\/)(health|healthz|readyz)\//i.test(file));
     for (const file of healthFiles)
-        evidence.push({ type: 'file', value: file });
+        evidence.push({ type: 'file', value: file, claim: 'health' });
     const hasHealth = healthFiles.length > 0 || hits.some((h) => /\/(health|healthz|readyz)\b/i.test(h.snippet));
     const hasReqId = hits.some((h) => /x-request-id|correlation-id/i.test(h.snippet));
     // Structured logging without a logging library is still structured logging. What
@@ -27,7 +40,7 @@ async function detectObservability(ctx) {
     // produced them.
     const structuredHits = await (0, textSearch_1.searchInFiles)(ctx.root, ctx.files.source, [/JSON\.stringify\(\s*\{[^}]*level/i, /logger\.(info|warn|error|debug)\s*\(/, /structuredLog/i], 15);
     for (const m of structuredHits)
-        evidence.push({ type: 'snippet', value: m.snippet, file: m.file, line: m.line });
+        evidence.push({ type: 'snippet', value: m.snippet, file: m.file, line: m.line, claim: 'logging' });
     const hasStructuredLogging = logDeps.length > 0 || structuredHits.length > 0;
     return {
         key: 'observability.core',

package/dist/analyzer/detectPackaging.d.ts

@@ -0,0 +1,3 @@
+import type { DetectorResult } from './types';
+import type { DetectContext } from './detectContext';
+export declare function detectPackaging(ctx: DetectContext): Promise<DetectorResult[]>;

package/dist/analyzer/detectPackaging.js

@@ -0,0 +1,148 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.detectPackaging = detectPackaging;
+const readTextFileSafe_1 = require("../utils/readTextFileSafe");
+/**
+ * Whether a project is fit to be installed and depended on by someone else.
+ *
+ * Twenty-five of the seventy-seven repositories in the verification corpus received no
+ * profile at all, and a large share of them were libraries and command-line tools:
+ * Meta's llama3 reference implementation, a Markdown converter, a photo editor, this
+ * project's own AI package. Every profile here assumed a running service with users, so
+ * the most common kind of code on a developer's disk had no category — and a product
+ * that sells "judged for the type of product it is" said nothing about what they were.
+ *
+ * What matters for a library is not what matters for a service. Nobody signs in to a
+ * package. What decides whether it is fit to publish is whether it says what it is,
+ * whether it can be imported, whether its licence permits use at all, and whether
+ * anything proves it works.
+ */
+const LICENSE_FILE = /(^|\/)(LICEN[CS]E|COPYING)(\.[a-z]+)?$/i;
+const README_FILE = /(^|\/)README(\.[a-z]+)?$/i;
+const CI_FILE = /(^|\/)(\.github\/workflows\/[^/]+\.ya?ml|\.gitlab-ci\.yml|\.circleci\/config\.yml|azure-pipelines\.yml|Jenkinsfile|\.travis\.yml|\.woodpecker\.ya?ml)$/i;
+/**
+ * A test, as opposed to a file with "test" in its name.
+ *
+ * Deliberately not `/test/`: `src/latest.ts` and `contest.py` both contain it, and a
+ * repository does not get credit for a word.
+ */
+const TEST_FILE = /(^|\/)(tests?|__tests__|spec)\/|\.(test|spec)\.[cm]?[jt]sx?$|(^|\/)test_[^/]+\.py$|[^/]+_test\.(py|go|rb)$/i;
+function collect(files, pattern, limit = 3) {
+    return files.filter((file) => pattern.test(file)).slice(0, limit);
+}
+async function detectPackaging(ctx) {
+    const all = ctx.files.all;
+    const licenseFiles = collect(all, LICENSE_FILE);
+    const declaredLicense = typeof ctx.packageJson?.license === 'string';
+    const licenseEvidence = [
+        ...licenseFiles.map((file) => ({ type: 'file', value: file, file })),
+        ...(declaredLicense ? [{ type: 'note', value: 'a license field in package.json' }] : []),
+    ];
+    const readmeFiles = collect(all, README_FILE);
+    /**
+     * A README that is only a title is not documentation.
+     *
+     * The threshold is deliberately low — enough prose to say what the thing is and how
+     * to install it — because the check is "did anyone write anything", not "is it good".
+     */
+    let readmeLength = 0;
+    for (const file of readmeFiles) {
+        const raw = await (0, readTextFileSafe_1.readTextFileSafe)(ctx.root, file);
+        readmeLength = Math.max(readmeLength, (raw ?? '').trim().length);
+    }
+    const ciFiles = collect(all, CI_FILE);
+    const testFiles = all.filter((file) => TEST_FILE.test(file));
+    /**
+     * A test runner that something actually invokes.
+     *
+     * Test files with no way to run them is a different state from a project with a
+     * `npm test` that a reader can type, so the two are separated: files alone are
+     * `partial`, files plus a runner are `complete`.
+     */
+    const scripts = (ctx.packageJson?.scripts ?? {});
+    const hasTestScript = typeof scripts.test === 'string' && !/no test specified/i.test(scripts.test);
+    const hasPyTestRunner = all.some((f) => /(^|\/)(pytest\.ini|tox\.ini|noxfile\.py)$/i.test(f))
+        || ctx.pythonDeps.some((d) => d === 'pytest' || d === 'nose2' || d === 'unittest2');
+    /**
+     * Whether the package can be installed and imported.
+     *
+     * `main`, `module`, `exports` and `bin` are the four ways a Node package says where
+     * it starts; `types` is how a TypeScript consumer finds it. A Python package says the
+     * same thing through `[project.scripts]` or a `packages` argument in setup.py.
+     */
+    const pkg = (ctx.packageJson ?? {});
+    const nodeEntrypoints = ['main', 'module', 'exports', 'bin'].filter((key) => pkg[key] !== undefined);
+    const hasTypes = pkg.types !== undefined || pkg.typings !== undefined;
+    const isPrivate = pkg.private === true;
+    let pythonEntrypoints = false;
+    for (const file of all.filter((f) => /(^|\/)(pyproject\.toml|setup\.py|setup\.cfg)$/i.test(f)).slice(0, 4)) {
+        const raw = (await (0, readTextFileSafe_1.readTextFileSafe)(ctx.root, file)) ?? '';
+        if (/\[project\.scripts\]|\[project\.gui-scripts\]|console_scripts|entry_points|packages\s*=|\[project\]/i.test(raw)) {
+            pythonEntrypoints = true;
+        }
+    }
+    const hasManifest = ctx.packageJson !== null
+        || all.some((f) => /(^|\/)(pyproject\.toml|setup\.py|go\.mod|Cargo\.toml|composer\.json|\w+\.gemspec)$/i.test(f));
+    /**
+     * A name and a version. Without them nothing can depend on this, whatever else it
+     * does right.
+     */
+    const named = typeof pkg.name === 'string' && typeof pkg.version === 'string';
+    const described = typeof pkg.description === 'string' && pkg.description.length > 0;
+    const sourced = pkg.repository !== undefined || pkg.homepage !== undefined;
+    const entrypointCount = nodeEntrypoints.length + (pythonEntrypoints ? 1 : 0);
+    return [
+        {
+            key: 'packaging.manifest',
+            present: hasManifest,
+            complete: hasManifest && (named || pythonEntrypoints),
+            evidence: hasManifest ? [{ type: 'note', value: named ? 'a manifest with a name and a version' : 'a package manifest' }] : [],
+            details: { named, described, sourced, private: isPrivate },
+        },
+        {
+            key: 'packaging.entrypoints',
+            present: entrypointCount > 0,
+            complete: entrypointCount > 0 && (hasTypes || pythonEntrypoints),
+            evidence: [
+                ...nodeEntrypoints.map((key) => ({ type: 'note', value: `package.json declares "${key}"` })),
+                ...(pythonEntrypoints ? [{ type: 'note', value: 'a Python package or console script declaration' }] : []),
+                ...(hasTypes ? [{ type: 'note', value: 'TypeScript types are declared' }] : []),
+            ],
+            details: { nodeEntrypoints, hasTypes, pythonEntrypoints },
+        },
+        {
+            key: 'packaging.license',
+            // A licence file and a declared licence say the same thing; either alone is an
+            // answer, and a reader who has one does not need the other to use the code.
+            present: licenseFiles.length > 0 || declaredLicense,
+            complete: licenseFiles.length > 0 && declaredLicense,
+            evidence: licenseEvidence,
+            details: { files: licenseFiles.length, declared: declaredLicense },
+        },
+        {
+            key: 'docs.readme',
+            present: readmeFiles.length > 0,
+            complete: readmeLength > 400,
+            evidence: readmeFiles.map((file) => ({ type: 'file', value: `${file} (${readmeLength} characters)`, file })),
+            details: { length: readmeLength },
+        },
+        {
+            key: 'quality.tests',
+            present: testFiles.length > 0,
+            complete: testFiles.length > 0 && (hasTestScript || hasPyTestRunner),
+            evidence: [
+                ...testFiles.slice(0, 3).map((file) => ({ type: 'file', value: file, file })),
+                ...(hasTestScript ? [{ type: 'note', value: 'an "npm test" script' }] : []),
+                ...(hasPyTestRunner ? [{ type: 'note', value: 'a Python test runner' }] : []),
+            ],
+            details: { files: testFiles.length, runner: hasTestScript || hasPyTestRunner },
+        },
+        {
+            key: 'quality.ci',
+            present: ciFiles.length > 0,
+            complete: ciFiles.length > 0 && testFiles.length > 0,
+            evidence: ciFiles.map((file) => ({ type: 'file', value: file, file })),
+            details: { files: ciFiles.length },
+        },
+    ];
+}

package/dist/analyzer/detectSecurity.js

@@ -66,13 +66,13 @@ async function detectSecurity(ctx) {
     const rateLimitSignals = await (0, textSearch_1.searchInFiles)(ctx.root, source, [/rateLimit\s*\(/, /rate_?limit/i, /Retry-After/i, /\b429\b/, /TooManyRequests/i], 20);
     const rateLimit = rateLimitDep || rateLimitSignals.length > 0;
     if (helmetDep)
-        evidence.push({ type: 'dependency', value: 'helmet' });
+        evidence.push({ type: 'dependency', value: 'helmet', claim: 'headers' });
     if (rateLimitDep)
-        evidence.push({ type: 'dependency', value: 'rate limiting package' });
+        evidence.push({ type: 'dependency', value: 'rate limiting package', claim: 'rate-limit' });
     for (const m of headerSignals)
-        evidence.push({ type: 'snippet', value: m.snippet, file: m.file, line: m.line });
+        evidence.push({ type: 'snippet', value: m.snippet, file: m.file, line: m.line, claim: 'headers' });
     for (const m of rateLimitSignals)
-        evidence.push({ type: 'snippet', value: m.snippet, file: m.file, line: m.line });
+        evidence.push({ type: 'snippet', value: m.snippet, file: m.file, line: m.line, claim: 'rate-limit' });
     const corsLoose = [];
     const corsStrict = [];
     for (const file of source) {
@@ -96,18 +96,18 @@ async function detectSecurity(ctx) {
         corsStrict.push(...detected.strict);
     }
     for (const m of corsLoose)
-        evidence.push({ type: 'snippet', value: m.snippet, file: m.file, line: m.line });
+        evidence.push({ type: 'snippet', value: m.snippet, file: m.file, line: m.line, claim: 'cors' });
     for (const m of corsStrict)
-        evidence.push({ type: 'snippet', value: m.snippet, file: m.file, line: m.line });
+        evidence.push({ type: 'snippet', value: m.snippet, file: m.file, line: m.line, claim: 'cors' });
     const webhookSig = await (0, textSearch_1.searchInFiles)(ctx.root, source, [/constructEvent\(/, /webhook.*signature/i], 10);
     const bodyLimit = await (0, textSearch_1.searchInFiles)(ctx.root, source, [/express\.json\(\s*\{[^}]*limit\s*:/i], 10);
     const contentTypeCheck = await (0, textSearch_1.searchInFiles)(ctx.root, source, [/content-type/i, /req\.is\(/], 10);
     for (const m of webhookSig)
-        evidence.push({ type: 'snippet', value: m.snippet, file: m.file, line: m.line });
+        evidence.push({ type: 'snippet', value: m.snippet, file: m.file, line: m.line, claim: 'webhook-signature' });
     for (const m of bodyLimit)
-        evidence.push({ type: 'snippet', value: m.snippet, file: m.file, line: m.line });
+        evidence.push({ type: 'snippet', value: m.snippet, file: m.file, line: m.line, claim: 'body-size' });
     for (const m of contentTypeCheck)
-        evidence.push({ type: 'snippet', value: m.snippet, file: m.file, line: m.line });
+        evidence.push({ type: 'snippet', value: m.snippet, file: m.file, line: m.line, claim: 'content-type' });
     const djangoSettings = ctx.files.all.find((f) => f.endsWith('settings.py'));
     let djangoDebugTrue = false;
     let djangoSecureCookies = true;
@@ -115,15 +115,15 @@ async function detectSecurity(ctx) {
         const text = (await (0, readTextFileSafe_1.readTextFileSafe)(ctx.root, djangoSettings)) ?? '';
         if (/DEBUG\s*=\s*True/.test(text)) {
             djangoDebugTrue = true;
-            evidence.push({ type: 'snippet', value: 'DEBUG = True', file: djangoSettings });
+            evidence.push({ type: 'snippet', value: 'DEBUG = True', file: djangoSettings, claim: 'django-debug' });
         }
         const insecureSession = /SESSION_COOKIE_SECURE\s*=\s*False/.test(text);
         const insecureCsrf = /CSRF_COOKIE_SECURE\s*=\s*False/.test(text);
         djangoSecureCookies = !(insecureSession || insecureCsrf);
         if (insecureSession)
-            evidence.push({ type: 'snippet', value: 'SESSION_COOKIE_SECURE = False', file: djangoSettings });
+            evidence.push({ type: 'snippet', value: 'SESSION_COOKIE_SECURE = False', file: djangoSettings, claim: 'django-cookies' });
         if (insecureCsrf)
-            evidence.push({ type: 'snippet', value: 'CSRF_COOKIE_SECURE = False', file: djangoSettings });
+            evidence.push({ type: 'snippet', value: 'CSRF_COOKIE_SECURE = False', file: djangoSettings, claim: 'django-cookies' });
     }
     return {
         key: 'security.core',

package/dist/analyzer/importedDependencies.d.ts

@@ -0,0 +1,9 @@
+/** Packages a Python project imports, when no requirements file declared any. */
+export declare function pythonImports(root: string, sourceFiles: string[]): Promise<string[]>;
+/**
+ * Packages a browser project loads, when no package.json declared any.
+ *
+ * A game served as `index.html` plus two scripts has no package manager and never will;
+ * its dependency list is the set of `<script src>` tags at the top of the page.
+ */
+export declare function browserImports(root: string, sourceFiles: string[]): Promise<string[]>;