@produtype/core 0.99.0 → 1.1.0

package/README.md

@@ -21,20 +21,33 @@ ProdKit inspects a target project and detects:
 - GDPR/privacy signals
 - Security hardening signals
 - Upload exposure signals
-- Billing/Stripe signals
+- Billing signals: payment processors declared in any manifest this reads
 - Observability/logging signals
 - Background jobs/queue signals
 - Deployment readiness signals
 
 Then it builds a structured production-readiness report with:
 
-- Overall score (0-100)
-- Maturity level (`prototype`, `early`, `partial`, `production_ready`)
+- Overall score (0-100), or `null` where too little of the repository could be read
+  to characterise it
+- Maturity level (`inconclusive`, `prototype`, `early`, `partial`, `production_ready`)
 - Findings grouped by category
 - Critical issues and warnings
 - Passed checks
 - Suggested next steps
-- Technical evidence for each finding
+- Technical evidence for each finding — a file and a line you can open, not a summary
+
+Two things the report says about its own reading, because a finding is only worth what
+the reading behind it is:
+
+- **How deeply each language was read.** A syntax tree answered the question, or a
+  keyword search did, or the language was not read at all — and the report names which,
+  per language. The optional `typescript` peer dependency decides whether JavaScript and
+  TypeScript are parsed; without it they are searched as text, and the report says so
+  rather than claiming otherwise.
+- **Which questions could not be asked.** A check whose answer depends on a reader that
+  could not run comes back `unknown`, never `passed` and never `missing`. Blindness can
+  turn a verdict into no verdict; it is not allowed to turn one into its opposite.
 
 From the report, ProdKit can also build a deterministic remediation plan with phases, task priorities, effort estimates, and test suggestions.
 
@@ -145,7 +158,11 @@ Profile warning:
 
 Inconclusive assessments:
 
-- If no stack signals and no package manifests are detected, the report is marked **inconclusive** and the score is capped at 39 (`prototype`). An unrecognized project is never scored as production ready.
+- Where nothing identifies the repository, where too few checks reach a verdict, or
+  where most of it is written in a language this cannot read, the report is marked
+  **inconclusive** and there is no score at all: `overallScore` is `null` and the
+  maturity level is `inconclusive`. It used to cap the score at 39 instead, which was
+  a number standing where an answer was missing.
 
 ## Examples
 
@@ -220,8 +237,12 @@ its own.
 ## Current limitations
 
 - Deterministic heuristics only: the AI layer is a separate package (see above)
-- Signal-based stack coverage across common Node/Python/JS frameworks + fallback
-- Signal-based detection can produce false positives/negatives
+- JavaScript and TypeScript are parsed when the optional `typescript` peer dependency is
+  installed; every other language is read as text, matched against what its frameworks
+  and its standard library define. The report states which of the two it did.
+- Signal-based detection can produce false positives and false negatives. Where a
+  reading rests on something this could not check, the answer is `unknown` rather than a
+  guess.
 - Plan output is deterministic and read-only only
 - No cloud dashboard or UI: this package is the CLI and the library
 

package/dist/analyzer/detectPackaging.js

@@ -267,6 +267,12 @@ async function detectPackaging(ctx) {
             jvmPublication = true;
         }
     }
+    const tauriConfigs = all.filter((file) => /(^|\/)tauri\.conf\.json$/.test(file));
+    const desktopBundle = [
+        ...(0, detectContext_1.hasAnyDep)(ctx, ['electron', 'electron-builder', '@tauri-apps/api', '@tauri-apps/cli'])
+            .map((dep) => ({ type: 'dependency', value: dep })),
+        ...tauriConfigs.slice(0, 2).map((file) => ({ type: 'file', value: file, file })),
+    ];
     const entrypointCount = nodeEntrypoints.length
         + (pythonEntrypoints ? 1 : 0)
         + (dotnetPackageId ? 1 : 0)
@@ -326,6 +332,24 @@ async function detectPackaging(ctx) {
                 : frontendFiles.slice(0, 5).map((file) => ({ type: 'file', value: file, file })),
             details: { generators: docsGenerators, frontendFiles: frontendFiles.length, allUnderDocs: frontendAllInDocs },
         },
+        {
+            /**
+             * An application that ships as a desktop bundle, not as a page.
+             *
+             * `electron` in the manifest and a `tauri.conf.json` in the tree are the two
+             * ways a project says its product is installed rather than visited. Both are
+             * the toolchain's own names: electron-builder reads the first, the Tauri CLI
+             * reads the second.
+             *
+             * Recorded here so the profile can stop asking a desktop application how it
+             * caches assets over HTTP — the question a Unity game stopped being asked in
+             * 0.84.0, for the same reason. marktext, an Electron editor, was told at `high`
+             * that it has no asset-delivery policy.
+             */
+            key: 'packaging.desktopBundle',
+            present: desktopBundle.length > 0,
+            evidence: desktopBundle,
+        },
         {
             key: 'docs.readme',
             present: readmeFiles.length > 0,

package/dist/expectations/evaluateExpectations.js

@@ -227,6 +227,17 @@ function deriveStatus(analysis, capability) {
         case 'app.asset-delivery': {
             if (detector(analysis, 'game.engine')?.details?.nativeEngine === true)
                 return 'not_applicable';
+            /**
+             * And the same for an application that is installed rather than visited.
+             *
+             * marktext ships as an Electron bundle and yaak as a Tauri one; their assets are
+             * inside the download, and `Cache-Control` has nobody to talk to. This is the
+             * native-game case again, arrived at from the other direction — the first time
+             * from a `ProjectVersion.txt`, this time from `electron` in a manifest and a
+             * `tauri.conf.json` in the tree.
+             */
+            if (detector(analysis, 'packaging.desktopBundle')?.present === true)
+                return 'not_applicable';
             return detector(analysis, 'app.assetDelivery')?.present ? 'present' : 'missing';
         }
         case 'jobs.background': {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@produtype/core",
-  "version": "0.99.0",
+  "version": "1.1.0",
   "description": "Deterministic CLI and library that analyzes a web application repository and reports how far it is from production-ready for the kind of product it is meant to be.",
   "license": "MIT",
   "bin": {