@produtype/core 1.5.0 → 1.6.0

package/README.md

@@ -191,7 +191,7 @@ prodkit plan ../my-app --output prodkit-plan.md
 
 _Generated from the analyzer itself — run `npm run docs:stacks` after changing a detector._
 
-- **Backend:** Express, Next.js, NestJS, Fastify, Hono, Elysia, Koa, AdonisJS, SvelteKit, Remix, Nuxt, Nitro, Astro, Django, Flask, FastAPI, aiohttp, Litestar, Sanic, Tornado, Starlette, Streamlit, Gradio, Dash, Chainlit, Gin, Echo, Fiber, chi, Gorilla, Beego, Go, Axum, Actix Web, Rocket, Warp, Tide, Poem, Salvo, Tower HTTP, Hyper, Spring Boot, Quarkus, Micronaut, Ktor, Javalin, Vert.x, Dropwizard, Helidon, Rails, Sinatra, Hanami, Roda, Grape, Ruby, Laravel, Symfony, Slim, CodeIgniter, CakePHP, Yii, PHP, ASP.NET Core, Cloudflare Workers
+- **Backend:** Express, Next.js, NestJS, Fastify, Hono, Elysia, Koa, AdonisJS, SvelteKit, Remix, Nuxt, Nitro, Astro, Django, Flask, FastAPI, aiohttp, Litestar, Sanic, Tornado, Starlette, Streamlit, Gradio, Dash, Chainlit, Gin, Echo, Fiber, chi, Gorilla, Beego, Go, Axum, Actix Web, Rocket, Warp, Tide, Poem, Salvo, Tower HTTP, Hyper, Spring Boot, Quarkus, Micronaut, Ktor, Javalin, Vert.x, Dropwizard, Helidon, Rails, Sinatra, Hanami, Roda, Grape, Ruby, Phoenix, Plug, Bandit, Laravel, Symfony, Slim, CodeIgniter, CakePHP, Yii, PHP, ASP.NET Core, Cloudflare Workers
 - **Frontend:** React, Vite, Vue, Nuxt, Svelte, Angular, Astro, Solid, Qwik, Preact, Remix, htmx, Tailwind CSS, Electron
 - **Mobile:** Flutter, React Native, iOS (native), Android (native), SwiftUI, UIKit, Jetpack Compose, Android views
 - **Databases:** Postgres, MySQL, SQLite, SQL Server, MongoDB, Redis, Firestore, DynamoDB, Convex

package/dist/analyzer/absenceEvidence.d.ts

@@ -25,4 +25,15 @@ export declare function searchedFor(what: string, terms: string[], claim?: strin
  * it say so, so that a reader whose roles are called `capabilities` can see why they
  * were missed and tell us we are wrong.
  */
+/**
+ * The same, for a look that needed no reader.
+ *
+ * A search over the list of file names answers whatever language the files are
+ * written in. Separated so that the report can withdraw the claims a blind reader
+ * made without withdrawing the ones anybody could check — see
+ * `onlyEvidencedByASearchThatCouldNotRead` in the report.
+ */
+export declare function searchedFileNamesFor(what: string, terms: string[], claim?: string): DetectorEvidence[];
 export declare function evidenceOrSearch(evidence: DetectorEvidence[], what: string, terms: string[], claim?: string): DetectorEvidence[];
+/** `evidenceOrSearch` for a search that only had to read file names. */
+export declare function evidenceOrFileNameSearch(evidence: DetectorEvidence[], what: string, terms: string[], claim?: string): DetectorEvidence[];

package/dist/analyzer/absenceEvidence.js

@@ -1,7 +1,9 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.searchedFor = searchedFor;
+exports.searchedFileNamesFor = searchedFileNamesFor;
 exports.evidenceOrSearch = evidenceOrSearch;
+exports.evidenceOrFileNameSearch = evidenceOrFileNameSearch;
 /**
  * What was looked for, when nothing was found.
  *
@@ -36,6 +38,21 @@ function searchedFor(what, terms, claim) {
  * it say so, so that a reader whose roles are called `capabilities` can see why they
  * were missed and tell us we are wrong.
  */
+/**
+ * The same, for a look that needed no reader.
+ *
+ * A search over the list of file names answers whatever language the files are
+ * written in. Separated so that the report can withdraw the claims a blind reader
+ * made without withdrawing the ones anybody could check — see
+ * `onlyEvidencedByASearchThatCouldNotRead` in the report.
+ */
+function searchedFileNamesFor(what, terms, claim) {
+    return searchedFor(what, terms, claim).map((item) => ({ ...item, overFileNames: true }));
+}
 function evidenceOrSearch(evidence, what, terms, claim) {
     return evidence.length > 0 ? evidence : searchedFor(what, terms, claim);
 }
+/** `evidenceOrSearch` for a search that only had to read file names. */
+function evidenceOrFileNameSearch(evidence, what, terms, claim) {
+    return evidence.length > 0 ? evidence : searchedFileNamesFor(what, terms, claim);
+}

package/dist/analyzer/analyzeProject.js

@@ -595,6 +595,51 @@ async function analyzeProject(projectPath) {
             }
         }
     }
+    /**
+     * mix.exs, read for the packages an Elixir project depends on.
+     *
+     * plausible is 1257 Elixir files and the report had no score at all: no backend, no
+     * database, no package manager, and an honest note saying the language was not read.
+     * The note was the right answer to give while it was true — but Phoenix, Ecto,
+     * bcrypt_elixir, cors_plug and nimble_totp are all in its manifest, and every one of
+     * them is a package name nobody at plausible invented.
+     *
+     * Mix declares dependencies as tuples in a function rather than as a data file:
+     * `{:phoenix, "~> 1.8.2"}` and `{:location, git: "..."}` are both entries, and
+     * `{:credo, "~> 1.7", only: [:dev, :test]}` is one the product does not ship. The
+     * `only:` option is the same distinction `runtimeRustDeps` draws, written in Elixir.
+     *
+     * Read from inside the `deps` function and nowhere else. A tuple beginning with an
+     * atom is ordinary Elixir and appears all over a manifest: plausible's release
+     * configuration holds `{:system, "RELEASE_ROOT", ...}` and its dialyzer settings
+     * `{:no_warn, "priv/plts/dialyzer.plt"}`, and both were being read as packages.
+     * `deps: deps()` in `project/0` is Mix's own convention, so the function is where
+     * the list is.
+     */
+    const elixirDeps = [];
+    const runtimeElixirDeps = [];
+    for (const file of ownManifests.filter((f) => /(^|\/)mix\.exs$/.test(f))) {
+        const raw = (await (0, readTextFileSafe_1.readTextFileSafe)(root, file)) ?? '';
+        /**
+         * An entry can run over several lines — plausible writes four of its OpenTelemetry
+         * dependencies with the git ref on lines of their own — so `only:` is looked for
+         * in the whole tuple rather than on the line that opens it.
+         */
+        const opener = /^(\s*)defp?\s+deps\s+do\s*$/m.exec(raw);
+        if (!opener)
+            continue;
+        const lines = raw.slice(opener.index).split('\n');
+        const closer = lines.findIndex((line, i) => i > 0 && line === `${opener[1]}end`);
+        const block = lines.slice(1, closer === -1 ? undefined : closer).join('\n');
+        const entries = block.matchAll(/\{\s*:([a-z][a-z0-9_]*)\s*(,[\s\S]*?)?\}/g);
+        for (const entry of entries) {
+            const name = entry[1].toLowerCase();
+            const options = entry[2] ?? '';
+            elixirDeps.push(name);
+            if (!/\bonly:\s*(?:\[[^\]]*\]|:[a-z_]+)/.test(options))
+                runtimeElixirDeps.push(name);
+        }
+    }
     /**
      * pubspec.yaml, read for its two dependency blocks.
      *
@@ -868,6 +913,8 @@ async function analyzeProject(projectPath) {
         goDeps: unique(goDeps),
         rustDeps: unique(rustDeps),
         runtimeRustDeps: unique(runtimeRustDeps),
+        elixirDeps: unique(elixirDeps),
+        runtimeElixirDeps: unique(runtimeElixirDeps),
         rubyDeps: unique(rubyDeps),
         dotnetDeps: unique(dotnetDeps),
         dotnetWebSdk,

package/dist/analyzer/catalogue.d.ts

@@ -46,6 +46,16 @@ export declare const JVM_BACKEND_FRAMEWORKS: Array<[string, string[]]>;
 export declare const JVM_DATABASES: Array<[string, string[]]>;
 /** Ruby frameworks, read from the Gemfile. */
 export declare const RUBY_BACKEND_FRAMEWORKS: Array<[string, string[]]>;
+/**
+ * Elixir frameworks, read from mix.exs.
+ *
+ * Phoenix is the answer in nearly every case. Plug is the layer underneath it and a
+ * real answer on its own — an Elixir service that serves requests without Phoenix
+ * serves them through Plug — and Bandit and Cowboy are the servers that run it.
+ */
+export declare const ELIXIR_BACKEND_FRAMEWORKS: Array<[string, string[]]>;
+/** Elixir data stores, read from mix.exs. */
+export declare const ELIXIR_DATABASES: Array<[string, string[]]>;
 /** PHP frameworks, read from composer.json. */
 export declare const PHP_BACKEND_FRAMEWORKS: Array<[string, string[]]>;
 /**

package/dist/analyzer/catalogue.js

@@ -15,7 +15,7 @@
  * that loses users.
  */
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.LANGUAGES = exports.FRONTEND_FRAMEWORKS = exports.PYTHON_BACKEND_FRAMEWORKS = exports.PHP_BACKEND_FRAMEWORKS = exports.RUBY_BACKEND_FRAMEWORKS = exports.JVM_DATABASES = exports.JVM_BACKEND_FRAMEWORKS = exports.RUST_BACKEND_FRAMEWORKS = exports.GO_BACKEND_FRAMEWORKS = exports.NODE_BACKEND_FRAMEWORKS = void 0;
+exports.LANGUAGES = exports.FRONTEND_FRAMEWORKS = exports.PYTHON_BACKEND_FRAMEWORKS = exports.PHP_BACKEND_FRAMEWORKS = exports.ELIXIR_DATABASES = exports.ELIXIR_BACKEND_FRAMEWORKS = exports.RUBY_BACKEND_FRAMEWORKS = exports.JVM_DATABASES = exports.JVM_BACKEND_FRAMEWORKS = exports.RUST_BACKEND_FRAMEWORKS = exports.GO_BACKEND_FRAMEWORKS = exports.NODE_BACKEND_FRAMEWORKS = void 0;
 exports.labelFor = labelFor;
 exports.hasLabel = hasLabel;
 exports.supportedStacks = supportedStacks;
@@ -110,6 +110,27 @@ exports.RUBY_BACKEND_FRAMEWORKS = [
     ['roda', ['roda']],
     ['grape', ['grape']],
 ];
+/**
+ * Elixir frameworks, read from mix.exs.
+ *
+ * Phoenix is the answer in nearly every case. Plug is the layer underneath it and a
+ * real answer on its own — an Elixir service that serves requests without Phoenix
+ * serves them through Plug — and Bandit and Cowboy are the servers that run it.
+ */
+exports.ELIXIR_BACKEND_FRAMEWORKS = [
+    ['phoenix', ['phoenix']],
+    ['plug', ['plug', 'plug_cowboy']],
+    ['bandit', ['bandit']],
+];
+/** Elixir data stores, read from mix.exs. */
+exports.ELIXIR_DATABASES = [
+    ['postgres', ['postgrex']],
+    ['mysql', ['myxql']],
+    ['sqlite', ['ecto_sqlite3', 'exqlite']],
+    ['clickhouse', ['ecto_ch', 'ch']],
+    ['redis', ['redix']],
+    ['mongodb', ['mongodb_driver']],
+];
 /** PHP frameworks, read from composer.json. */
 exports.PHP_BACKEND_FRAMEWORKS = [
     ['laravel', ['laravel/framework', 'laravel/laravel']],
@@ -220,6 +241,10 @@ const LABELS = {
     hanami: 'Hanami',
     roda: 'Roda',
     grape: 'Grape',
+    phoenix: 'Phoenix',
+    plug: 'Plug',
+    bandit: 'Bandit',
+    clickhouse: 'ClickHouse',
     laravel: 'Laravel',
     symfony: 'Symfony',
     slim: 'Slim',
@@ -346,6 +371,7 @@ function supportedStacks() {
             ...entries(exports.JVM_BACKEND_FRAMEWORKS.map(([id]) => id)),
             ...entries(exports.RUBY_BACKEND_FRAMEWORKS.map(([id]) => id)),
             { id: 'ruby', label: 'Ruby', detectedFrom: 'a Gemfile with no web framework in it' },
+            ...entries(exports.ELIXIR_BACKEND_FRAMEWORKS.map(([id]) => id)),
             ...entries(exports.PHP_BACKEND_FRAMEWORKS.map(([id]) => id)),
             { id: 'php', label: 'PHP', detectedFrom: 'PHP sources with no framework in composer.json' },
             { id: 'aspnet-core', label: 'ASP.NET Core', detectedFrom: 'the Microsoft.NET.Sdk.Web SDK attribute' },

package/dist/analyzer/detectAuth.js

@@ -81,6 +81,7 @@ async function detectAuth(ctx) {
         ...(0, detectContext_1.hasAnyRustDep)(ctx, ['oauth2', 'openidconnect']),
         ...(0, detectContext_1.hasAnyGradleDep)(ctx, ['spring-boot-starter-oauth2-client', 'com.okta.spring']),
         ...(0, detectContext_1.hasAnyDotnetDep)(ctx, ['Microsoft.AspNetCore.Authentication.OpenIdConnect', 'Microsoft.Identity.Web']),
+        ...(0, detectContext_1.hasAnyElixirDep)(ctx, ['ueberauth', 'assent', 'openid_connect']),
     ];
     /** And a password of its own, which is what makes a reset flow something to have. */
     const storesAPasswordItself = [
@@ -89,6 +90,7 @@ async function detectAuth(ctx) {
         ...(0, detectContext_1.hasAnyRustDep)(ctx, ['argon2', 'rust-argon2', 'bcrypt', 'scrypt', 'password-hash', 'pbkdf2']),
         ...(0, detectContext_1.hasAnyGradleDep)(ctx, ['spring-security-crypto', 'org.mindrot:jbcrypt']),
         ...(0, detectContext_1.hasAnyDotnetDep)(ctx, ['Microsoft.AspNetCore.Identity']),
+        ...(0, detectContext_1.hasAnyElixirDep)(ctx, ['bcrypt_elixir', 'argon2_elixir', 'pbkdf2_elixir']),
     ];
     /**
      * The packages that do the authenticating, as distinct from the words people use
@@ -120,13 +122,36 @@ async function detectAuth(ctx) {
         '@oslojs/crypto',
         '@auth/core',
     ];
+    /**
+     * The same question in Elixir, where the packages have their own names.
+     *
+     * `bcrypt_elixir` hashes the password, `guardian` and `pow` hold the session,
+     * `ueberauth` hands identity to a provider. plausible declares three of them and
+     * reported no authentication at all, because none of these words appears in any of
+     * the lists above.
+     */
+    const elixirAuthDeps = (0, detectContext_1.hasAnyElixirDep)(ctx, [
+        'bcrypt_elixir',
+        'argon2_elixir',
+        'pbkdf2_elixir',
+        'guardian',
+        'pow',
+        'ueberauth',
+        'assent',
+        'joken',
+    ]);
     const authDeps = [
         ...(0, detectContext_1.hasAnyDep)(ctx, AUTH_PACKAGES),
         ...managedAuthDeps,
         ...managedAuthPyDeps,
+        ...elixirAuthDeps,
     ];
     const sessionDeps = [...(0, detectContext_1.hasAnyDep)(ctx, ['express-session', 'cookie-session']), ...managedAuthDeps];
-    const twoFaDeps = (0, detectContext_1.hasAnyDep)(ctx, ['speakeasy', 'pyotp', 'qrcode', '@simplewebauthn/server', 'otplib']);
+    const twoFaDeps = [
+        ...(0, detectContext_1.hasAnyDep)(ctx, ['speakeasy', 'pyotp', 'qrcode', '@simplewebauthn/server', 'otplib']),
+        /** `nimble_totp` is the Elixir one, and plausible ships it. */
+        ...(0, detectContext_1.hasAnyElixirDep)(ctx, ['nimble_totp']),
+    ];
     const routeSignals = await (0, textSearch_1.searchInFiles)(ctx.root, sourceFiles, [
         /\/(login|register|logout|signin|signup|sign-in|sign-up)\b/i,
         /requireAuth/i,

package/dist/analyzer/detectBackend.js

@@ -154,6 +154,22 @@ async function detectBackend(ctx) {
         for (const dep of hits)
             evidence.push({ type: 'dependency', value: dep });
     }
+    /**
+     * Elixir, read from mix.exs.
+     *
+     * No fallback beside it, for Rust's reason rather than Go's: Elixir's standard
+     * library has no HTTP server, so a mix project with no Phoenix, Plug or Bandit in
+     * it is a library or a release tool. Phoenix is what serves the requests when
+     * anything does.
+     */
+    for (const [framework, deps] of catalogue_1.ELIXIR_BACKEND_FRAMEWORKS) {
+        const hits = (0, detectContext_1.hasAnyRuntimeElixirDep)(ctx, deps);
+        if (!hits.length)
+            continue;
+        frameworks.push(framework);
+        for (const dep of hits)
+            evidence.push({ type: 'dependency', value: dep });
+    }
     /**
      * A Gemfile is not a Ruby backend on its own.
      *

package/dist/analyzer/detectContext.d.ts

@@ -28,6 +28,10 @@ export interface DetectContext {
     goDeps: string[];
     /** Crate names from Cargo.toml, lowercase. */
     rustDeps: string[];
+    /** Packages named in mix.exs. */
+    elixirDeps: string[];
+    /** The ones without an `only:` option, so the ones the product ships. */
+    runtimeElixirDeps: string[];
     /** Of those, the ones the product ships with rather than only builds and tests with. */
     runtimeRustDeps: string[];
     /** Gem names from the Gemfile, lowercase. */
@@ -76,6 +80,9 @@ export declare function hasRuntimePyDep(ctx: DetectContext, name: string): boole
 export declare function hasAnyDep(ctx: DetectContext, names: string[]): string[];
 export declare function hasPyDep(ctx: DetectContext, name: string): boolean;
 export declare function hasAnyRustDep(ctx: DetectContext, names: string[]): string[];
+export declare function hasAnyElixirDep(ctx: DetectContext, names: string[]): string[];
+/** The Elixir counterpart: shipped, not merely declared. */
+export declare function hasAnyRuntimeElixirDep(ctx: DetectContext, names: string[]): string[];
 /** The Rust counterpart of `hasRuntimeDep`: shipped, not merely present. */
 export declare function hasAnyRuntimeRustDep(ctx: DetectContext, names: string[]): string[];
 export declare function hasAnyPyDep(ctx: DetectContext, names: string[]): string[];

package/dist/analyzer/detectContext.js

@@ -6,6 +6,8 @@ exports.hasRuntimePyDep = hasRuntimePyDep;
 exports.hasAnyDep = hasAnyDep;
 exports.hasPyDep = hasPyDep;
 exports.hasAnyRustDep = hasAnyRustDep;
+exports.hasAnyElixirDep = hasAnyElixirDep;
+exports.hasAnyRuntimeElixirDep = hasAnyRuntimeElixirDep;
 exports.hasAnyRuntimeRustDep = hasAnyRuntimeRustDep;
 exports.hasAnyPyDep = hasAnyPyDep;
 exports.hasPhpDep = hasPhpDep;
@@ -41,6 +43,13 @@ function hasPyDep(ctx, name) {
 function hasAnyRustDep(ctx, names) {
     return names.filter((name) => ctx.rustDeps.includes(name.toLowerCase()));
 }
+function hasAnyElixirDep(ctx, names) {
+    return names.filter((name) => ctx.elixirDeps.includes(name.toLowerCase()));
+}
+/** The Elixir counterpart: shipped, not merely declared. */
+function hasAnyRuntimeElixirDep(ctx, names) {
+    return names.filter((name) => ctx.runtimeElixirDeps.includes(name.toLowerCase()));
+}
 /** The Rust counterpart of `hasRuntimeDep`: shipped, not merely present. */
 function hasAnyRuntimeRustDep(ctx, names) {
     return names.filter((name) => ctx.runtimeRustDeps.includes(name.toLowerCase()));

package/dist/analyzer/detectDatabase.js

@@ -109,6 +109,22 @@ async function detectDatabase(ctx) {
                 evidence.push({ type: 'dependency', value: h });
         }
     }
+    /**
+     * Elixir, by driver package.
+     *
+     * Ecto is the query layer and names no store: `postgrex` is what makes it Postgres,
+     * `ecto_ch` what makes it ClickHouse. plausible has both — its application data in
+     * Postgres and its analytics in ClickHouse — and was reported as having no data
+     * layer at all.
+     */
+    for (const [db, names] of catalogue_1.ELIXIR_DATABASES) {
+        const hits = (0, detectContext_1.hasAnyElixirDep)(ctx, names);
+        if (hits.length) {
+            databases.add(db);
+            for (const h of hits)
+                evidence.push({ type: 'dependency', value: h });
+        }
+    }
     const goHits = [
         ['postgres', ['jackc/pgx', 'jackc/pgx/v5', 'lib/pq']],
         ['mysql', ['go-sql-driver/mysql']],

package/dist/analyzer/detectDeployment.js

@@ -78,7 +78,7 @@ async function detectDeployment(ctx) {
         key: 'deployment.readiness',
         present: presentFiles.length > 0 || hits.length > 0,
         complete: prodAware,
-        evidence: (0, absenceEvidence_1.evidenceOrSearch)(evidence, 'anything that says how this is deployed', ['Dockerfile', 'docker-compose', '.github/workflows/', 'Procfile', 'fly.toml', 'render.yaml', 'NODE_ENV', 'RAILS_ENV', 'ASPNETCORE_ENVIRONMENT', 'a file naming production']),
+        evidence: (0, absenceEvidence_1.evidenceOrFileNameSearch)(evidence, 'anything that says how this is deployed', ['Dockerfile', 'docker-compose', '.github/workflows/', 'Procfile', 'fly.toml', 'render.yaml', 'NODE_ENV', 'RAILS_ENV', 'ASPNETCORE_ENVIRONMENT', 'a file naming production']),
         details: {
             dockerArtifacts: presentFiles.some((f) => /Dockerfile|compose/.test(f)),
             ci: presentFiles.some((f) => f.startsWith('.github/workflows/')),

package/dist/analyzer/detectDocker.js

@@ -38,7 +38,7 @@ async function detectDocker(ctx) {
         key: 'infra.docker',
         present: Boolean(dockerfile || composeFile),
         complete: hasHealthcheck,
-        evidence: (0, absenceEvidence_1.evidenceOrSearch)(evidence, 'a container definition', ['Dockerfile', 'Containerfile', 'docker-compose.yml', 'compose.yaml']),
+        evidence: (0, absenceEvidence_1.evidenceOrFileNameSearch)(evidence, 'a container definition', ['Dockerfile', 'Containerfile', 'docker-compose.yml', 'compose.yaml']),
         details: { dockerfile: Boolean(dockerfile), compose: Boolean(composeFile), hasHealthcheck, hasExpose, services },
     };
 }

package/dist/analyzer/detectPackageManager.js

@@ -18,6 +18,7 @@ const OTHER_MANIFESTS = [
     { manager: 'go modules', pattern: /(^|\/)go\.mod$/ },
     { manager: 'cargo', pattern: /(^|\/)Cargo\.toml$/ },
     { manager: 'bundler', pattern: /(^|\/)Gemfile$/ },
+    { manager: 'mix', pattern: /(^|\/)mix\.exs$/ },
     { manager: 'gradle', pattern: /(^|\/)build\.gradle(\.kts)?$/ },
     { manager: 'maven', pattern: /(^|\/)pom\.xml$/ },
     { manager: 'nuget', pattern: /\.(csproj|fsproj|vbproj)$/i },
@@ -59,6 +60,7 @@ const MANIFEST_LANGUAGE = {
     'go modules': /\.go$/,
     cargo: /\.rs$/,
     bundler: /\.rb$/,
+    mix: /\.exs?$/,
     gradle: /\.(java|kt|kts|scala|groovy)$/,
     maven: /\.(java|kt|kts|scala|groovy)$/,
     nuget: /\.(cs|fs|vb)$/,

package/dist/analyzer/detectSecurity.js

@@ -279,7 +279,9 @@ async function detectSecurity(ctx) {
          * that it does not throttle. The list had grown npm, Python and Rust entries and
          * skipped the ecosystem where the answer is a single well-known name.
          */
-        (0, detectContext_1.hasAnyRubyDep)(ctx, ['rack-attack', 'rack_attack']).length > 0;
+        (0, detectContext_1.hasAnyRubyDep)(ctx, ['rack-attack', 'rack_attack']).length > 0 ||
+        /** Elixir's, which are plugs: `hammer` counts, `plug_attack` and `ex_rated` refuse. */
+        (0, detectContext_1.hasAnyElixirDep)(ctx, ['hammer', 'plug_attack', 'ex_rated', 'pow_ratelimit']).length > 0;
     /**
      * Throttling by what the protocol says, not by what the variable is called.
      *

package/dist/analyzer/types.d.ts

@@ -10,7 +10,7 @@
  * Only managers whose manifest this analyzer actually reads are named here. A name it
  * cannot back with a parsed file would be a guess from a filename.
  */
-export type PackageManager = 'npm' | 'pnpm' | 'yarn' | 'pip' | 'poetry' | 'python' | 'pub' | 'composer' | 'go modules' | 'cargo' | 'bundler' | 'gradle' | 'maven' | 'nuget' | 'swift package manager' | 'cocoapods' | 'unknown';
+export type PackageManager = 'npm' | 'pnpm' | 'yarn' | 'pip' | 'poetry' | 'python' | 'pub' | 'composer' | 'go modules' | 'cargo' | 'bundler' | 'gradle' | 'maven' | 'nuget' | 'swift package manager' | 'cocoapods' | 'mix' | 'unknown';
 export type PackageManagerConfidence = 'lockfile' | 'manifest' | 'inferred' | 'unknown';
 export interface WorkspaceStack {
     root: string;
@@ -52,6 +52,15 @@ export interface DetectorEvidence {
      * the reader can check and disagree with.
      */
     type: 'file' | 'dependency' | 'snippet' | 'note' | 'search';
+    /**
+     * For a `search`: whether it read the source text or only the list of file names.
+     *
+     * "No Dockerfile" is true of a repository in any language, because the file list is
+     * readable whatever is inside the files. "No security headers" is a claim about what
+     * the code does, and a language this analyzer cannot read cannot answer it. Only the
+     * second kind is withdrawn where most of the repository went unread.
+     */
+    overFileNames?: boolean;
     value: string;
     file?: string;
     line?: number;

package/dist/report/buildReport.js

@@ -72,6 +72,33 @@ function onlyEvidencedInDocumentation(finding, hasProductSource) {
     const cited = finding.evidence.filter((item) => item.file);
     return cited.length > 0 && cited.every((item) => detectPackaging_1.DOCS_DIRECTORIES.test(item.file));
 }
+/**
+ * A verdict nothing could have reached.
+ *
+ * Teaching the analyzer to read `mix.exs` gave it plausible's backend, its two data
+ * stores and its password hashing — all from package names nobody there invented. It
+ * also turned every other capability from `unknown` into `missing`: no CORS, no
+ * security headers, no health endpoint, no consent, each at `high`, about 1257 Elixir
+ * files the analyzer had not opened. The guard that used to hold those back was an
+ * accident — with no backend detected, the rules said nothing here serves requests —
+ * and naming the backend removed it.
+ *
+ * So it is said properly. Where most of a repository is a language this analyzer does
+ * not read, a finding whose only evidence is the search that found nothing is a
+ * question that went unasked, and `unknown` is the answer. A finding still holding a
+ * dependency, a file or a line stands: `bcrypt_elixir` in the manifest is evidence
+ * whatever language the rest of the repository is in, and so is a search over the list
+ * of file names: "no Dockerfile" is true of a repository in any language, because the
+ * names are readable whatever is inside the files.
+ *
+ * This is the same rule as the documentation one above, for the same reason. Blindness
+ * may turn a verdict into no verdict; it may never turn it into the opposite verdict.
+ */
+function onlyEvidencedByASearchThatCouldNotRead(finding) {
+    if (finding.status === 'passed' || finding.status === 'unknown')
+        return false;
+    return finding.evidence.every((item) => item.type === 'search' && !item.overFileNames);
+}
 function buildReport(analysis, options) {
     const observedFindings = (0, ruleEngine_1.runRules)(analysis);
     const observedScore = (0, score_1.computeScore)(observedFindings);
@@ -138,15 +165,30 @@ function buildReport(analysis, options) {
      * product and its findings are the product's.
      */
     const hasProductSource = analysis.files.source.some((file) => !detectPackaging_1.DOCS_DIRECTORIES.test(file));
+    /**
+     * Read here as well as below, because it decides what the findings may claim and not
+     * only whether the report carries a score.
+     */
+    const unreadableFileCount = analysis.files.unreadable.reduce((total, entry) => total + entry.files, 0);
+    const mostlyUnreadable = unreadableFileCount > analysis.files.source.length;
+    const [largestUnreadable] = [...analysis.files.unreadable].sort((left, right) => right.files - left.files);
     const findings = (0, evidenceDigest_1.withEvidenceDigest)((0, businessImpact_1.withBusinessImpact)([...observedFindings, ...expectationFindings]
-        .map((finding) => onlyEvidencedInDocumentation(finding, hasProductSource)
+        .map((finding) => mostlyUnreadable && onlyEvidencedByASearchThatCouldNotRead(finding)
         ? {
             ...finding,
             status: 'unknown',
             severity: 'info',
-            description: `${finding.description} Every line behind this is in the documentation site or a playground rather than in the product, so nothing here says the product does it.`,
+            description: `${finding.description} Most of this repository is written in ${largestUnreadable?.language ?? 'a language'}, which this analyzer does not read, so nothing here was in a position to answer.`,
+            recommendation: '',
         }
-        : finding)
+        : onlyEvidencedInDocumentation(finding, hasProductSource)
+            ? {
+                ...finding,
+                status: 'unknown',
+                severity: 'info',
+                description: `${finding.description} Every line behind this is in the documentation site or a playground rather than in the product, so nothing here says the product does it.`,
+            }
+            : finding)
         .sort((a, b) => bySeverityPriority(a) - bySeverityPriority(b))));
     const combinedScore = expectationScore === undefined
         ? observedScore
@@ -241,8 +283,7 @@ function buildReport(analysis, options) {
      * this was written on crosses the line, and the first public repository that did was
      * the sixth one tried.
      */
-    const unreadableFiles = analysis.files.unreadable.reduce((total, entry) => total + entry.files, 0);
-    const mostlyUnreadable = unreadableFiles > analysis.files.source.length;
+    const unreadableFiles = unreadableFileCount;
     const inconclusive = nothingIdentified || tooLittleAssessed || mostlyUnreadable;
     // Each reason says which of the two it was, because they call for different things:
     // one is a repository this analyzer cannot read, the other is one there is barely
@@ -256,7 +297,7 @@ function buildReport(analysis, options) {
         }
     }
     if (mostlyUnreadable) {
-        const [largest] = [...analysis.files.unreadable].sort((left, right) => right.files - left.files);
+        const largest = largestUnreadable;
         inconclusiveReasons.push(`Most of this repository is written in ${largest.language}, which this analyzer does not read: ${unreadableFiles} of its files were skipped and ${analysis.files.source.length} were read.`);
     }
     if (tooLittleAssessed) {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@produtype/core",
-  "version": "1.5.0",
+  "version": "1.6.0",
   "description": "Deterministic CLI and library that analyzes a web application repository and reports how far it is from production-ready for the kind of product it is meant to be.",
   "license": "MIT",
   "bin": {