@produtype/core 1.5.0 → 1.7.0

package/README.md

@@ -191,7 +191,7 @@ prodkit plan ../my-app --output prodkit-plan.md
 
 _Generated from the analyzer itself — run `npm run docs:stacks` after changing a detector._
 
-- **Backend:** Express, Next.js, NestJS, Fastify, Hono, Elysia, Koa, AdonisJS, SvelteKit, Remix, Nuxt, Nitro, Astro, Django, Flask, FastAPI, aiohttp, Litestar, Sanic, Tornado, Starlette, Streamlit, Gradio, Dash, Chainlit, Gin, Echo, Fiber, chi, Gorilla, Beego, Go, Axum, Actix Web, Rocket, Warp, Tide, Poem, Salvo, Tower HTTP, Hyper, Spring Boot, Quarkus, Micronaut, Ktor, Javalin, Vert.x, Dropwizard, Helidon, Rails, Sinatra, Hanami, Roda, Grape, Ruby, Laravel, Symfony, Slim, CodeIgniter, CakePHP, Yii, PHP, ASP.NET Core, Cloudflare Workers
+- **Backend:** Express, Next.js, NestJS, Fastify, Hono, Elysia, Koa, AdonisJS, SvelteKit, Remix, Nuxt, Nitro, Astro, Django, Flask, FastAPI, aiohttp, Litestar, Sanic, Tornado, Starlette, Streamlit, Gradio, Dash, Chainlit, Gin, Echo, Fiber, chi, Gorilla, Beego, Go, Axum, Actix Web, Rocket, Warp, Tide, Poem, Salvo, Tower HTTP, Hyper, Spring Boot, Quarkus, Micronaut, Ktor, Javalin, Vert.x, Dropwizard, Helidon, Rails, Sinatra, Hanami, Roda, Grape, Ruby, Phoenix, Plug, Bandit, Laravel, Symfony, Slim, CodeIgniter, CakePHP, Yii, PHP, ASP.NET Core, Cloudflare Workers
 - **Frontend:** React, Vite, Vue, Nuxt, Svelte, Angular, Astro, Solid, Qwik, Preact, Remix, htmx, Tailwind CSS, Electron
 - **Mobile:** Flutter, React Native, iOS (native), Android (native), SwiftUI, UIKit, Jetpack Compose, Android views
 - **Databases:** Postgres, MySQL, SQLite, SQL Server, MongoDB, Redis, Firestore, DynamoDB, Convex

package/dist/analyzer/absenceEvidence.d.ts

@@ -25,4 +25,15 @@ export declare function searchedFor(what: string, terms: string[], claim?: strin
  * it say so, so that a reader whose roles are called `capabilities` can see why they
  * were missed and tell us we are wrong.
  */
+/**
+ * The same, for a look that needed no reader.
+ *
+ * A search over the list of file names answers whatever language the files are
+ * written in. Separated so that the report can withdraw the claims a blind reader
+ * made without withdrawing the ones anybody could check — see
+ * `onlyEvidencedByASearchThatCouldNotRead` in the report.
+ */
+export declare function searchedFileNamesFor(what: string, terms: string[], claim?: string): DetectorEvidence[];
 export declare function evidenceOrSearch(evidence: DetectorEvidence[], what: string, terms: string[], claim?: string): DetectorEvidence[];
+/** `evidenceOrSearch` for a search that only had to read file names. */
+export declare function evidenceOrFileNameSearch(evidence: DetectorEvidence[], what: string, terms: string[], claim?: string): DetectorEvidence[];

package/dist/analyzer/absenceEvidence.js

@@ -1,7 +1,9 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.searchedFor = searchedFor;
+exports.searchedFileNamesFor = searchedFileNamesFor;
 exports.evidenceOrSearch = evidenceOrSearch;
+exports.evidenceOrFileNameSearch = evidenceOrFileNameSearch;
 /**
  * What was looked for, when nothing was found.
  *
@@ -36,6 +38,21 @@ function searchedFor(what, terms, claim) {
  * it say so, so that a reader whose roles are called `capabilities` can see why they
  * were missed and tell us we are wrong.
  */
+/**
+ * The same, for a look that needed no reader.
+ *
+ * A search over the list of file names answers whatever language the files are
+ * written in. Separated so that the report can withdraw the claims a blind reader
+ * made without withdrawing the ones anybody could check — see
+ * `onlyEvidencedByASearchThatCouldNotRead` in the report.
+ */
+function searchedFileNamesFor(what, terms, claim) {
+    return searchedFor(what, terms, claim).map((item) => ({ ...item, overFileNames: true }));
+}
 function evidenceOrSearch(evidence, what, terms, claim) {
     return evidence.length > 0 ? evidence : searchedFor(what, terms, claim);
 }
+/** `evidenceOrSearch` for a search that only had to read file names. */
+function evidenceOrFileNameSearch(evidence, what, terms, claim) {
+    return evidence.length > 0 ? evidence : searchedFileNamesFor(what, terms, claim);
+}

package/dist/analyzer/analyzeProject.js

@@ -306,7 +306,7 @@ function isTestOrExamplePath(file) {
  * `.vue`, `.svelte` and `.astro` were missing for the same reason: a single-file
  * component holds the logic, not just the markup.
  */
-const SOURCE_EXTENSIONS = /\.(ts|tsx|js|jsx|mjs|cjs|py|php|go|rb|java|cs|rs|kt|swift|dart|html?|vue|svelte|astro)$/;
+const SOURCE_EXTENSIONS = /\.(ts|tsx|js|jsx|mjs|cjs|py|php|go|rb|java|cs|rs|kt|swift|dart|ex|exs|html?|vue|svelte|astro)$/;
 function pickSource(files) {
     return files.filter((f) => SOURCE_EXTENSIONS.test(f) && !isTestOrExamplePath(f));
 }
@@ -321,7 +321,6 @@ function pickSource(files) {
  * Being wrong is recoverable. Being wrong while announcing no reservations is not.
  */
 const KNOWN_UNREADABLE = [
-    [/\.(ex|exs)$/, 'Elixir'],
     [/\.(scala|sc)$/, 'Scala'],
     [/\.(clj|cljs)$/, 'Clojure'],
     [/\.(cpp|cc|hpp)$/, 'C++'],
@@ -595,6 +594,51 @@ async function analyzeProject(projectPath) {
             }
         }
     }
+    /**
+     * mix.exs, read for the packages an Elixir project depends on.
+     *
+     * plausible is 1257 Elixir files and the report had no score at all: no backend, no
+     * database, no package manager, and an honest note saying the language was not read.
+     * The note was the right answer to give while it was true — but Phoenix, Ecto,
+     * bcrypt_elixir, cors_plug and nimble_totp are all in its manifest, and every one of
+     * them is a package name nobody at plausible invented.
+     *
+     * Mix declares dependencies as tuples in a function rather than as a data file:
+     * `{:phoenix, "~> 1.8.2"}` and `{:location, git: "..."}` are both entries, and
+     * `{:credo, "~> 1.7", only: [:dev, :test]}` is one the product does not ship. The
+     * `only:` option is the same distinction `runtimeRustDeps` draws, written in Elixir.
+     *
+     * Read from inside the `deps` function and nowhere else. A tuple beginning with an
+     * atom is ordinary Elixir and appears all over a manifest: plausible's release
+     * configuration holds `{:system, "RELEASE_ROOT", ...}` and its dialyzer settings
+     * `{:no_warn, "priv/plts/dialyzer.plt"}`, and both were being read as packages.
+     * `deps: deps()` in `project/0` is Mix's own convention, so the function is where
+     * the list is.
+     */
+    const elixirDeps = [];
+    const runtimeElixirDeps = [];
+    for (const file of ownManifests.filter((f) => /(^|\/)mix\.exs$/.test(f))) {
+        const raw = (await (0, readTextFileSafe_1.readTextFileSafe)(root, file)) ?? '';
+        /**
+         * An entry can run over several lines — plausible writes four of its OpenTelemetry
+         * dependencies with the git ref on lines of their own — so `only:` is looked for
+         * in the whole tuple rather than on the line that opens it.
+         */
+        const opener = /^(\s*)defp?\s+deps\s+do\s*$/m.exec(raw);
+        if (!opener)
+            continue;
+        const lines = raw.slice(opener.index).split('\n');
+        const closer = lines.findIndex((line, i) => i > 0 && line === `${opener[1]}end`);
+        const block = lines.slice(1, closer === -1 ? undefined : closer).join('\n');
+        const entries = block.matchAll(/\{\s*:([a-z][a-z0-9_]*)\s*(,[\s\S]*?)?\}/g);
+        for (const entry of entries) {
+            const name = entry[1].toLowerCase();
+            const options = entry[2] ?? '';
+            elixirDeps.push(name);
+            if (!/\bonly:\s*(?:\[[^\]]*\]|:[a-z_]+)/.test(options))
+                runtimeElixirDeps.push(name);
+        }
+    }
     /**
      * pubspec.yaml, read for its two dependency blocks.
      *
@@ -868,6 +912,8 @@ async function analyzeProject(projectPath) {
         goDeps: unique(goDeps),
         rustDeps: unique(rustDeps),
         runtimeRustDeps: unique(runtimeRustDeps),
+        elixirDeps: unique(elixirDeps),
+        runtimeElixirDeps: unique(runtimeElixirDeps),
         rubyDeps: unique(rubyDeps),
         dotnetDeps: unique(dotnetDeps),
         dotnetWebSdk,

package/dist/analyzer/catalogue.d.ts

@@ -46,6 +46,16 @@ export declare const JVM_BACKEND_FRAMEWORKS: Array<[string, string[]]>;
 export declare const JVM_DATABASES: Array<[string, string[]]>;
 /** Ruby frameworks, read from the Gemfile. */
 export declare const RUBY_BACKEND_FRAMEWORKS: Array<[string, string[]]>;
+/**
+ * Elixir frameworks, read from mix.exs.
+ *
+ * Phoenix is the answer in nearly every case. Plug is the layer underneath it and a
+ * real answer on its own — an Elixir service that serves requests without Phoenix
+ * serves them through Plug — and Bandit and Cowboy are the servers that run it.
+ */
+export declare const ELIXIR_BACKEND_FRAMEWORKS: Array<[string, string[]]>;
+/** Elixir data stores, read from mix.exs. */
+export declare const ELIXIR_DATABASES: Array<[string, string[]]>;
 /** PHP frameworks, read from composer.json. */
 export declare const PHP_BACKEND_FRAMEWORKS: Array<[string, string[]]>;
 /**

package/dist/analyzer/catalogue.js

@@ -15,7 +15,7 @@
  * that loses users.
  */
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.LANGUAGES = exports.FRONTEND_FRAMEWORKS = exports.PYTHON_BACKEND_FRAMEWORKS = exports.PHP_BACKEND_FRAMEWORKS = exports.RUBY_BACKEND_FRAMEWORKS = exports.JVM_DATABASES = exports.JVM_BACKEND_FRAMEWORKS = exports.RUST_BACKEND_FRAMEWORKS = exports.GO_BACKEND_FRAMEWORKS = exports.NODE_BACKEND_FRAMEWORKS = void 0;
+exports.LANGUAGES = exports.FRONTEND_FRAMEWORKS = exports.PYTHON_BACKEND_FRAMEWORKS = exports.PHP_BACKEND_FRAMEWORKS = exports.ELIXIR_DATABASES = exports.ELIXIR_BACKEND_FRAMEWORKS = exports.RUBY_BACKEND_FRAMEWORKS = exports.JVM_DATABASES = exports.JVM_BACKEND_FRAMEWORKS = exports.RUST_BACKEND_FRAMEWORKS = exports.GO_BACKEND_FRAMEWORKS = exports.NODE_BACKEND_FRAMEWORKS = void 0;
 exports.labelFor = labelFor;
 exports.hasLabel = hasLabel;
 exports.supportedStacks = supportedStacks;
@@ -110,6 +110,27 @@ exports.RUBY_BACKEND_FRAMEWORKS = [
     ['roda', ['roda']],
     ['grape', ['grape']],
 ];
+/**
+ * Elixir frameworks, read from mix.exs.
+ *
+ * Phoenix is the answer in nearly every case. Plug is the layer underneath it and a
+ * real answer on its own — an Elixir service that serves requests without Phoenix
+ * serves them through Plug — and Bandit and Cowboy are the servers that run it.
+ */
+exports.ELIXIR_BACKEND_FRAMEWORKS = [
+    ['phoenix', ['phoenix']],
+    ['plug', ['plug', 'plug_cowboy']],
+    ['bandit', ['bandit']],
+];
+/** Elixir data stores, read from mix.exs. */
+exports.ELIXIR_DATABASES = [
+    ['postgres', ['postgrex']],
+    ['mysql', ['myxql']],
+    ['sqlite', ['ecto_sqlite3', 'exqlite']],
+    ['clickhouse', ['ecto_ch', 'ch']],
+    ['redis', ['redix']],
+    ['mongodb', ['mongodb_driver']],
+];
 /** PHP frameworks, read from composer.json. */
 exports.PHP_BACKEND_FRAMEWORKS = [
     ['laravel', ['laravel/framework', 'laravel/laravel']],
@@ -172,6 +193,7 @@ exports.LANGUAGES = [
     { id: 'kotlin', label: 'Kotlin', extensions: /\.(kt|kts)$/ },
     { id: 'swift', label: 'Swift', extensions: /\.swift$/ },
     { id: 'dart', label: 'Dart', extensions: /\.dart$/ },
+    { id: 'elixir', label: 'Elixir', extensions: /\.exs?$/ },
 ];
 /** Display names for ids the tables above produce. */
 const LABELS = {
@@ -220,6 +242,10 @@ const LABELS = {
     hanami: 'Hanami',
     roda: 'Roda',
     grape: 'Grape',
+    phoenix: 'Phoenix',
+    plug: 'Plug',
+    bandit: 'Bandit',
+    clickhouse: 'ClickHouse',
     laravel: 'Laravel',
     symfony: 'Symfony',
     slim: 'Slim',
@@ -346,6 +372,7 @@ function supportedStacks() {
             ...entries(exports.JVM_BACKEND_FRAMEWORKS.map(([id]) => id)),
             ...entries(exports.RUBY_BACKEND_FRAMEWORKS.map(([id]) => id)),
             { id: 'ruby', label: 'Ruby', detectedFrom: 'a Gemfile with no web framework in it' },
+            ...entries(exports.ELIXIR_BACKEND_FRAMEWORKS.map(([id]) => id)),
             ...entries(exports.PHP_BACKEND_FRAMEWORKS.map(([id]) => id)),
             { id: 'php', label: 'PHP', detectedFrom: 'PHP sources with no framework in composer.json' },
             { id: 'aspnet-core', label: 'ASP.NET Core', detectedFrom: 'the Microsoft.NET.Sdk.Web SDK attribute' },

package/dist/analyzer/detectAuth.js

@@ -81,6 +81,7 @@ async function detectAuth(ctx) {
         ...(0, detectContext_1.hasAnyRustDep)(ctx, ['oauth2', 'openidconnect']),
         ...(0, detectContext_1.hasAnyGradleDep)(ctx, ['spring-boot-starter-oauth2-client', 'com.okta.spring']),
         ...(0, detectContext_1.hasAnyDotnetDep)(ctx, ['Microsoft.AspNetCore.Authentication.OpenIdConnect', 'Microsoft.Identity.Web']),
+        ...(0, detectContext_1.hasAnyElixirDep)(ctx, ['ueberauth', 'assent', 'openid_connect']),
     ];
     /** And a password of its own, which is what makes a reset flow something to have. */
     const storesAPasswordItself = [
@@ -89,6 +90,7 @@ async function detectAuth(ctx) {
         ...(0, detectContext_1.hasAnyRustDep)(ctx, ['argon2', 'rust-argon2', 'bcrypt', 'scrypt', 'password-hash', 'pbkdf2']),
         ...(0, detectContext_1.hasAnyGradleDep)(ctx, ['spring-security-crypto', 'org.mindrot:jbcrypt']),
         ...(0, detectContext_1.hasAnyDotnetDep)(ctx, ['Microsoft.AspNetCore.Identity']),
+        ...(0, detectContext_1.hasAnyElixirDep)(ctx, ['bcrypt_elixir', 'argon2_elixir', 'pbkdf2_elixir']),
     ];
     /**
      * The packages that do the authenticating, as distinct from the words people use
@@ -120,13 +122,36 @@ async function detectAuth(ctx) {
         '@oslojs/crypto',
         '@auth/core',
     ];
+    /**
+     * The same question in Elixir, where the packages have their own names.
+     *
+     * `bcrypt_elixir` hashes the password, `guardian` and `pow` hold the session,
+     * `ueberauth` hands identity to a provider. plausible declares three of them and
+     * reported no authentication at all, because none of these words appears in any of
+     * the lists above.
+     */
+    const elixirAuthDeps = (0, detectContext_1.hasAnyElixirDep)(ctx, [
+        'bcrypt_elixir',
+        'argon2_elixir',
+        'pbkdf2_elixir',
+        'guardian',
+        'pow',
+        'ueberauth',
+        'assent',
+        'joken',
+    ]);
     const authDeps = [
         ...(0, detectContext_1.hasAnyDep)(ctx, AUTH_PACKAGES),
         ...managedAuthDeps,
         ...managedAuthPyDeps,
+        ...elixirAuthDeps,
     ];
     const sessionDeps = [...(0, detectContext_1.hasAnyDep)(ctx, ['express-session', 'cookie-session']), ...managedAuthDeps];
-    const twoFaDeps = (0, detectContext_1.hasAnyDep)(ctx, ['speakeasy', 'pyotp', 'qrcode', '@simplewebauthn/server', 'otplib']);
+    const twoFaDeps = [
+        ...(0, detectContext_1.hasAnyDep)(ctx, ['speakeasy', 'pyotp', 'qrcode', '@simplewebauthn/server', 'otplib']),
+        /** `nimble_totp` is the Elixir one, and plausible ships it. */
+        ...(0, detectContext_1.hasAnyElixirDep)(ctx, ['nimble_totp']),
+    ];
     const routeSignals = await (0, textSearch_1.searchInFiles)(ctx.root, sourceFiles, [
         /\/(login|register|logout|signin|signup|sign-in|sign-up)\b/i,
         /requireAuth/i,

package/dist/analyzer/detectBackend.js

@@ -154,6 +154,22 @@ async function detectBackend(ctx) {
         for (const dep of hits)
             evidence.push({ type: 'dependency', value: dep });
     }
+    /**
+     * Elixir, read from mix.exs.
+     *
+     * No fallback beside it, for Rust's reason rather than Go's: Elixir's standard
+     * library has no HTTP server, so a mix project with no Phoenix, Plug or Bandit in
+     * it is a library or a release tool. Phoenix is what serves the requests when
+     * anything does.
+     */
+    for (const [framework, deps] of catalogue_1.ELIXIR_BACKEND_FRAMEWORKS) {
+        const hits = (0, detectContext_1.hasAnyRuntimeElixirDep)(ctx, deps);
+        if (!hits.length)
+            continue;
+        frameworks.push(framework);
+        for (const dep of hits)
+            evidence.push({ type: 'dependency', value: dep });
+    }
     /**
      * A Gemfile is not a Ruby backend on its own.
      *

package/dist/analyzer/detectContext.d.ts

@@ -28,6 +28,10 @@ export interface DetectContext {
     goDeps: string[];
     /** Crate names from Cargo.toml, lowercase. */
     rustDeps: string[];
+    /** Packages named in mix.exs. */
+    elixirDeps: string[];
+    /** The ones without an `only:` option, so the ones the product ships. */
+    runtimeElixirDeps: string[];
     /** Of those, the ones the product ships with rather than only builds and tests with. */
     runtimeRustDeps: string[];
     /** Gem names from the Gemfile, lowercase. */
@@ -76,6 +80,9 @@ export declare function hasRuntimePyDep(ctx: DetectContext, name: string): boole
 export declare function hasAnyDep(ctx: DetectContext, names: string[]): string[];
 export declare function hasPyDep(ctx: DetectContext, name: string): boolean;
 export declare function hasAnyRustDep(ctx: DetectContext, names: string[]): string[];
+export declare function hasAnyElixirDep(ctx: DetectContext, names: string[]): string[];
+/** The Elixir counterpart: shipped, not merely declared. */
+export declare function hasAnyRuntimeElixirDep(ctx: DetectContext, names: string[]): string[];
 /** The Rust counterpart of `hasRuntimeDep`: shipped, not merely present. */
 export declare function hasAnyRuntimeRustDep(ctx: DetectContext, names: string[]): string[];
 export declare function hasAnyPyDep(ctx: DetectContext, names: string[]): string[];

package/dist/analyzer/detectContext.js

@@ -6,6 +6,8 @@ exports.hasRuntimePyDep = hasRuntimePyDep;
 exports.hasAnyDep = hasAnyDep;
 exports.hasPyDep = hasPyDep;
 exports.hasAnyRustDep = hasAnyRustDep;
+exports.hasAnyElixirDep = hasAnyElixirDep;
+exports.hasAnyRuntimeElixirDep = hasAnyRuntimeElixirDep;
 exports.hasAnyRuntimeRustDep = hasAnyRuntimeRustDep;
 exports.hasAnyPyDep = hasAnyPyDep;
 exports.hasPhpDep = hasPhpDep;
@@ -41,6 +43,13 @@ function hasPyDep(ctx, name) {
 function hasAnyRustDep(ctx, names) {
     return names.filter((name) => ctx.rustDeps.includes(name.toLowerCase()));
 }
+function hasAnyElixirDep(ctx, names) {
+    return names.filter((name) => ctx.elixirDeps.includes(name.toLowerCase()));
+}
+/** The Elixir counterpart: shipped, not merely declared. */
+function hasAnyRuntimeElixirDep(ctx, names) {
+    return names.filter((name) => ctx.runtimeElixirDeps.includes(name.toLowerCase()));
+}
 /** The Rust counterpart of `hasRuntimeDep`: shipped, not merely present. */
 function hasAnyRuntimeRustDep(ctx, names) {
     return names.filter((name) => ctx.runtimeRustDeps.includes(name.toLowerCase()));

package/dist/analyzer/detectDatabase.js

@@ -109,6 +109,22 @@ async function detectDatabase(ctx) {
                 evidence.push({ type: 'dependency', value: h });
         }
     }
+    /**
+     * Elixir, by driver package.
+     *
+     * Ecto is the query layer and names no store: `postgrex` is what makes it Postgres,
+     * `ecto_ch` what makes it ClickHouse. plausible has both — its application data in
+     * Postgres and its analytics in ClickHouse — and was reported as having no data
+     * layer at all.
+     */
+    for (const [db, names] of catalogue_1.ELIXIR_DATABASES) {
+        const hits = (0, detectContext_1.hasAnyElixirDep)(ctx, names);
+        if (hits.length) {
+            databases.add(db);
+            for (const h of hits)
+                evidence.push({ type: 'dependency', value: h });
+        }
+    }
     const goHits = [
         ['postgres', ['jackc/pgx', 'jackc/pgx/v5', 'lib/pq']],
         ['mysql', ['go-sql-driver/mysql']],

package/dist/analyzer/detectDeployment.js

@@ -78,7 +78,7 @@ async function detectDeployment(ctx) {
         key: 'deployment.readiness',
         present: presentFiles.length > 0 || hits.length > 0,
         complete: prodAware,
-        evidence: (0, absenceEvidence_1.evidenceOrSearch)(evidence, 'anything that says how this is deployed', ['Dockerfile', 'docker-compose', '.github/workflows/', 'Procfile', 'fly.toml', 'render.yaml', 'NODE_ENV', 'RAILS_ENV', 'ASPNETCORE_ENVIRONMENT', 'a file naming production']),
+        evidence: (0, absenceEvidence_1.evidenceOrFileNameSearch)(evidence, 'anything that says how this is deployed', ['Dockerfile', 'docker-compose', '.github/workflows/', 'Procfile', 'fly.toml', 'render.yaml', 'NODE_ENV', 'RAILS_ENV', 'ASPNETCORE_ENVIRONMENT', 'a file naming production']),
         details: {
             dockerArtifacts: presentFiles.some((f) => /Dockerfile|compose/.test(f)),
             ci: presentFiles.some((f) => f.startsWith('.github/workflows/')),

package/dist/analyzer/detectDocker.js

@@ -38,7 +38,7 @@ async function detectDocker(ctx) {
         key: 'infra.docker',
         present: Boolean(dockerfile || composeFile),
         complete: hasHealthcheck,
-        evidence: (0, absenceEvidence_1.evidenceOrSearch)(evidence, 'a container definition', ['Dockerfile', 'Containerfile', 'docker-compose.yml', 'compose.yaml']),
+        evidence: (0, absenceEvidence_1.evidenceOrFileNameSearch)(evidence, 'a container definition', ['Dockerfile', 'Containerfile', 'docker-compose.yml', 'compose.yaml']),
         details: { dockerfile: Boolean(dockerfile), compose: Boolean(composeFile), hasHealthcheck, hasExpose, services },
     };
 }

package/dist/analyzer/detectObservability.js

@@ -30,9 +30,11 @@ const LOGGING_PACKAGES = [
     'debug',
     'npmlog',
 ];
+/** Elixir reaches for a backend rather than a logger: Logger itself is in OTP. */
+const ELIXIR_LOGGING_PACKAGES = ['logger_json', 'logger_file_backend', 'sentry'];
 async function detectObservability(ctx) {
     const evidence = [];
-    const logDeps = (0, detectContext_1.hasAnyDep)(ctx, LOGGING_PACKAGES);
+    const logDeps = [...(0, detectContext_1.hasAnyDep)(ctx, LOGGING_PACKAGES), ...(0, detectContext_1.hasAnyElixirDep)(ctx, ELIXIR_LOGGING_PACKAGES)];
     const sentryDeps = (0, detectContext_1.hasAnyDep)(ctx, ['@sentry/node', 'sentry-sdk']);
     for (const d of logDeps)
         evidence.push({ type: 'dependency', value: d, claim: 'logging' });
@@ -100,6 +102,13 @@ async function detectObservability(ctx) {
         /LoggerFactory\.getLogger|org\.slf4j/,
         /Rails\.logger/,
         /\btracing::(info|warn|error|debug)!|\blog::(info|warn|error)!/,
+        /**
+         * Elixir's, which is one module in the standard library.
+         *
+         * `Logger.info(...)` is how every Phoenix application logs, and `Logger` is
+         * OTP's name rather than anybody's variable.
+         */
+        /\bLogger\.(info|warning|warn|error|debug|notice)\(/,
     ], 15);
     for (const m of structuredHits)
         evidence.push({ type: 'snippet', value: m.snippet, file: m.file, line: m.line, claim: 'logging' });
@@ -140,7 +149,7 @@ async function detectObservability(ctx) {
         evidence.push(...(0, absenceEvidence_1.searchedFor)('a health endpoint', ['/health', '/healthz', '/readyz', 'a health, healthz, readyz, liveness or readiness route file'], 'health'));
     }
     if (!hasAnyLogging) {
-        evidence.push(...(0, absenceEvidence_1.searchedFor)('logging', ['winston', 'pino', 'morgan', 'bunyan', 'Monolog', 'slog', 'zap', 'logrus', 'slf4j', 'Rails.logger', 'tracing::', 'logger.info/warn/error/debug', 'error_log(', 'JSON.stringify with a level field'], 'logging'));
+        evidence.push(...(0, absenceEvidence_1.searchedFor)('logging', ['winston', 'pino', 'morgan', 'bunyan', 'Monolog', 'slog', 'zap', 'logrus', 'slf4j', 'Rails.logger', 'tracing::', 'logger.info/warn/error/debug', 'Logger.info', 'error_log(', 'JSON.stringify with a level field'], 'logging'));
     }
     return {
         key: 'observability.core',

package/dist/analyzer/detectPackageManager.js

@@ -18,6 +18,7 @@ const OTHER_MANIFESTS = [
     { manager: 'go modules', pattern: /(^|\/)go\.mod$/ },
     { manager: 'cargo', pattern: /(^|\/)Cargo\.toml$/ },
     { manager: 'bundler', pattern: /(^|\/)Gemfile$/ },
+    { manager: 'mix', pattern: /(^|\/)mix\.exs$/ },
     { manager: 'gradle', pattern: /(^|\/)build\.gradle(\.kts)?$/ },
     { manager: 'maven', pattern: /(^|\/)pom\.xml$/ },
     { manager: 'nuget', pattern: /\.(csproj|fsproj|vbproj)$/i },
@@ -59,6 +60,7 @@ const MANIFEST_LANGUAGE = {
     'go modules': /\.go$/,
     cargo: /\.rs$/,
     bundler: /\.rb$/,
+    mix: /\.exs?$/,
     gradle: /\.(java|kt|kts|scala|groovy)$/,
     maven: /\.(java|kt|kts|scala|groovy)$/,
     nuget: /\.(cs|fs|vb)$/,

package/dist/analyzer/detectSecurity.js

@@ -211,6 +211,23 @@ async function detectSecurity(ctx) {
         /config\.content_security_policy\b/,
         /^\s*config\.force_ssl\s*=\s*true/m,
     ], 20);
+    /**
+     * Reading a header is not setting one.
+     *
+     * plausible ships `tracker/installation_support/check-disallowed-by-csp.js`, whose
+     * whole job is to look at somebody else's `content-security-policy` and tell a user
+     * why the tracker was blocked. Its line `responseHeaders?.['content-security-policy']`
+     * was the evidence behind "security headers: passed" — a tool that inspects other
+     * people's headers credited with setting its own.
+     *
+     * The shape is the anchor, not the file: a header name used as a key into a headers
+     * object is a lookup. Setting one is a call — `put_resp_header`, `setHeader`,
+     * `headers.set`, `add_header` — or an assignment to that subscript, and a line doing
+     * either is left alone.
+     */
+    const READS_A_HEADER = /\[\s*(['"`])[^'"`]+\1\s*\](?!\s*=[^=])/;
+    const SETS_A_HEADER = /put_resp_header|setHeader|set_header|add_header|headers\.(?:set|append)|writeHead/i;
+    const headerSignalsThatSet = headerSignals.filter((hit) => !READS_A_HEADER.test(hit.snippet) || SETS_A_HEADER.test(hit.snippet));
     /**
      * Spring Security, which writes the headers without being asked.
      *
@@ -249,7 +266,7 @@ async function detectSecurity(ctx) {
             claim: 'headers',
         });
     }
-    const helmet = helmetDep || headerSignals.length > 0 || springFilterChain.length > 0;
+    const helmet = helmetDep || headerSignalsThatSet.length > 0 || springFilterChain.length > 0;
     /**
      * The packages the ecosystem names, as distinct from the variables authors do.
      * Shared between the dependency check below and the binding walk further down.
@@ -279,7 +296,9 @@ async function detectSecurity(ctx) {
          * that it does not throttle. The list had grown npm, Python and Rust entries and
          * skipped the ecosystem where the answer is a single well-known name.
          */
-        (0, detectContext_1.hasAnyRubyDep)(ctx, ['rack-attack', 'rack_attack']).length > 0;
+        (0, detectContext_1.hasAnyRubyDep)(ctx, ['rack-attack', 'rack_attack']).length > 0 ||
+        /** Elixir's, which are plugs: `hammer` counts, `plug_attack` and `ex_rated` refuse. */
+        (0, detectContext_1.hasAnyElixirDep)(ctx, ['hammer', 'plug_attack', 'ex_rated', 'pow_ratelimit']).length > 0;
     /**
      * Throttling by what the protocol says, not by what the variable is called.
      *
@@ -404,7 +423,7 @@ async function detectSecurity(ctx) {
         evidence.push({ type: 'dependency', value: 'helmet', claim: 'headers' });
     if (rateLimitDep)
         evidence.push({ type: 'dependency', value: 'rate limiting package', claim: 'rate-limit' });
-    for (const m of headerSignals)
+    for (const m of headerSignalsThatSet)
         evidence.push({ type: 'snippet', value: m.snippet, file: m.file, line: m.line, claim: 'headers' });
     for (const m of issuedRateLimits)
         evidence.push({ type: 'snippet', value: m.snippet, file: m.file, line: m.line, claim: 'rate-limit' });
@@ -578,6 +597,33 @@ async function detectSecurity(ctx) {
         const cited = anyOrigin[0] ?? chosen[0] ?? aspNetCors[0];
         target.push({ file: cited.file, line: cited.line, snippet: cited.snippet.trim().slice(0, 200) });
     }
+    /**
+     * Elixir's, which is a plug in the endpoint or the router.
+     *
+     * `cors_plug` and `corsica` are the two packages, and both are used the same way:
+     * `plug CORSPlug, origin: ["https://app.example.com"]` or `plug Corsica, origins:
+     * "*"`. The module name comes from the package, so it is the anchor; what the
+     * author chose is the value of `origin`.
+     *
+     * `plug` takes parentheses as readily as not — plausible writes `plug(CORSPlug)` in
+     * its endpoint, and a rule that required a space after the keyword could not see
+     * it. Both forms are ordinary Elixir and the formatter leaves either alone.
+     *
+     * `"*"` is the wide-open one. A list, a function or a regex is a decision somebody
+     * made, and the same reflection-versus-allowlist question the other frameworks are
+     * asked. Where the plug names no origin at all, cors_plug's own default is `"*"`,
+     * so silence is the open branch rather than the strict one.
+     */
+    const elixirCorsPackages = (0, detectContext_1.hasAnyElixirDep)(ctx, ['cors_plug', 'corsica']);
+    if (elixirCorsPackages.length > 0) {
+        const elixirSource = source.filter((f) => /\.exs?$/i.test(f));
+        const plugged = await (0, textSearch_1.searchInFiles)(ctx.root, elixirSource, [/\bplug[\s(]+(?:CORSPlug|Corsica)\b/], 5);
+        for (const hit of plugged) {
+            const origin = /origins?:\s*(.+)$/.exec(hit.snippet);
+            const wideOpen = !origin || /^["']\*["']/.test(origin[1].trim());
+            (wideOpen ? corsLoose : corsStrict).push({ file: hit.file, line: hit.line, snippet: hit.snippet.trim().slice(0, 200) });
+        }
+    }
     const django = await (0, djangoSettings_1.findDjangoSettings)(ctx);
     if (django) {
         const middlewareLine = django.text

package/dist/analyzer/proseLines.d.ts

@@ -1,5 +1,5 @@
 /**
- * The lines of a Python file that are a docstring rather than code.
+ * The lines of a Python or Elixir file that are prose rather than code.
  *
  * This analyzer has skipped comments since the day it read its own prose about Stripe
  * as evidence that it takes payments. The rule looks for a line marker — `#`, `//`,

package/dist/analyzer/proseLines.js

@@ -2,7 +2,7 @@
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.proseLines = proseLines;
 /**
- * The lines of a Python file that are a docstring rather than code.
+ * The lines of a Python or Elixir file that are prose rather than code.
  *
  * This analyzer has skipped comments since the day it read its own prose about Stripe
  * as evidence that it takes payments. The rule looks for a line marker — `#`, `//`,
@@ -20,6 +20,8 @@ exports.proseLines = proseLines;
  * has nothing before it but indentation.
  */
 function proseLines(file, text) {
+    if (/\.exs?$/i.test(file))
+        return elixirDocLines(text);
     const prose = new Set();
     if (!/\.py$/i.test(file))
         return prose;
@@ -54,3 +56,37 @@ function proseLines(file, text) {
     }
     return prose;
 }
+/**
+ * Elixir writes its prose as a module attribute, and the rest is a heredoc.
+ *
+ * `@moduledoc """ ... """` is the same trap as a Python docstring with a different
+ * marker: the interior lines begin with whatever the author was saying, and nothing
+ * about them says they are not code. Phoenix generators put one at the top of every
+ * controller, context and channel, so a repository has thousands.
+ *
+ * Anchored on Elixir's own attribute names — `@moduledoc`, `@doc`, `@typedoc`,
+ * `@shortdoc` — rather than on the heredoc, because `@query """SELECT ..."""` is data
+ * assigned to a name and a hardcoded secret could live in one. Same distinction the
+ * Python reader draws, made by a different marker.
+ */
+function elixirDocLines(text) {
+    const prose = new Set();
+    const lines = text.split(/\r?\n/);
+    let open = false;
+    for (let i = 0; i < lines.length; i++) {
+        const line = lines[i];
+        if (open) {
+            prose.add(i + 1);
+            if (/"""/.test(line))
+                open = false;
+            continue;
+        }
+        const doc = /^\s*@(?:module|type|short)?doc\s+(?:~[A-Za-z])?"""/.exec(line);
+        if (!doc)
+            continue;
+        prose.add(i + 1);
+        /** A heredoc cannot close on its opening line, so the block is always open here. */
+        open = true;
+    }
+    return prose;
+}

package/dist/analyzer/types.d.ts

@@ -10,7 +10,7 @@
  * Only managers whose manifest this analyzer actually reads are named here. A name it
  * cannot back with a parsed file would be a guess from a filename.
  */
-export type PackageManager = 'npm' | 'pnpm' | 'yarn' | 'pip' | 'poetry' | 'python' | 'pub' | 'composer' | 'go modules' | 'cargo' | 'bundler' | 'gradle' | 'maven' | 'nuget' | 'swift package manager' | 'cocoapods' | 'unknown';
+export type PackageManager = 'npm' | 'pnpm' | 'yarn' | 'pip' | 'poetry' | 'python' | 'pub' | 'composer' | 'go modules' | 'cargo' | 'bundler' | 'gradle' | 'maven' | 'nuget' | 'swift package manager' | 'cocoapods' | 'mix' | 'unknown';
 export type PackageManagerConfidence = 'lockfile' | 'manifest' | 'inferred' | 'unknown';
 export interface WorkspaceStack {
     root: string;
@@ -52,6 +52,15 @@ export interface DetectorEvidence {
      * the reader can check and disagree with.
      */
     type: 'file' | 'dependency' | 'snippet' | 'note' | 'search';
+    /**
+     * For a `search`: whether it read the source text or only the list of file names.
+     *
+     * "No Dockerfile" is true of a repository in any language, because the file list is
+     * readable whatever is inside the files. "No security headers" is a claim about what
+     * the code does, and a language this analyzer cannot read cannot answer it. Only the
+     * second kind is withdrawn where most of the repository went unread.
+     */
+    overFileNames?: boolean;
     value: string;
     file?: string;
     line?: number;

package/dist/report/buildReport.js

@@ -72,6 +72,33 @@ function onlyEvidencedInDocumentation(finding, hasProductSource) {
     const cited = finding.evidence.filter((item) => item.file);
     return cited.length > 0 && cited.every((item) => detectPackaging_1.DOCS_DIRECTORIES.test(item.file));
 }
+/**
+ * A verdict nothing could have reached.
+ *
+ * Teaching the analyzer to read `mix.exs` gave it plausible's backend, its two data
+ * stores and its password hashing — all from package names nobody there invented. It
+ * also turned every other capability from `unknown` into `missing`: no CORS, no
+ * security headers, no health endpoint, no consent, each at `high`, about 1257 Elixir
+ * files the analyzer had not opened. The guard that used to hold those back was an
+ * accident — with no backend detected, the rules said nothing here serves requests —
+ * and naming the backend removed it.
+ *
+ * So it is said properly. Where most of a repository is a language this analyzer does
+ * not read, a finding whose only evidence is the search that found nothing is a
+ * question that went unasked, and `unknown` is the answer. A finding still holding a
+ * dependency, a file or a line stands: `bcrypt_elixir` in the manifest is evidence
+ * whatever language the rest of the repository is in, and so is a search over the list
+ * of file names: "no Dockerfile" is true of a repository in any language, because the
+ * names are readable whatever is inside the files.
+ *
+ * This is the same rule as the documentation one above, for the same reason. Blindness
+ * may turn a verdict into no verdict; it may never turn it into the opposite verdict.
+ */
+function onlyEvidencedByASearchThatCouldNotRead(finding) {
+    if (finding.status === 'passed' || finding.status === 'unknown')
+        return false;
+    return finding.evidence.every((item) => item.type === 'search' && !item.overFileNames);
+}
 function buildReport(analysis, options) {
     const observedFindings = (0, ruleEngine_1.runRules)(analysis);
     const observedScore = (0, score_1.computeScore)(observedFindings);
@@ -138,15 +165,30 @@ function buildReport(analysis, options) {
      * product and its findings are the product's.
      */
     const hasProductSource = analysis.files.source.some((file) => !detectPackaging_1.DOCS_DIRECTORIES.test(file));
+    /**
+     * Read here as well as below, because it decides what the findings may claim and not
+     * only whether the report carries a score.
+     */
+    const unreadableFileCount = analysis.files.unreadable.reduce((total, entry) => total + entry.files, 0);
+    const mostlyUnreadable = unreadableFileCount > analysis.files.source.length;
+    const [largestUnreadable] = [...analysis.files.unreadable].sort((left, right) => right.files - left.files);
     const findings = (0, evidenceDigest_1.withEvidenceDigest)((0, businessImpact_1.withBusinessImpact)([...observedFindings, ...expectationFindings]
-        .map((finding) => onlyEvidencedInDocumentation(finding, hasProductSource)
+        .map((finding) => mostlyUnreadable && onlyEvidencedByASearchThatCouldNotRead(finding)
         ? {
             ...finding,
             status: 'unknown',
             severity: 'info',
-            description: `${finding.description} Every line behind this is in the documentation site or a playground rather than in the product, so nothing here says the product does it.`,
+            description: `${finding.description} Most of this repository is written in ${largestUnreadable?.language ?? 'a language'}, which this analyzer does not read, so nothing here was in a position to answer.`,
+            recommendation: '',
         }
-        : finding)
+        : onlyEvidencedInDocumentation(finding, hasProductSource)
+            ? {
+                ...finding,
+                status: 'unknown',
+                severity: 'info',
+                description: `${finding.description} Every line behind this is in the documentation site or a playground rather than in the product, so nothing here says the product does it.`,
+            }
+            : finding)
         .sort((a, b) => bySeverityPriority(a) - bySeverityPriority(b))));
     const combinedScore = expectationScore === undefined
         ? observedScore
@@ -241,8 +283,7 @@ function buildReport(analysis, options) {
      * this was written on crosses the line, and the first public repository that did was
      * the sixth one tried.
      */
-    const unreadableFiles = analysis.files.unreadable.reduce((total, entry) => total + entry.files, 0);
-    const mostlyUnreadable = unreadableFiles > analysis.files.source.length;
+    const unreadableFiles = unreadableFileCount;
     const inconclusive = nothingIdentified || tooLittleAssessed || mostlyUnreadable;
     // Each reason says which of the two it was, because they call for different things:
     // one is a repository this analyzer cannot read, the other is one there is barely
@@ -256,7 +297,7 @@ function buildReport(analysis, options) {
         }
     }
     if (mostlyUnreadable) {
-        const [largest] = [...analysis.files.unreadable].sort((left, right) => right.files - left.files);
+        const largest = largestUnreadable;
         inconclusiveReasons.push(`Most of this repository is written in ${largest.language}, which this analyzer does not read: ${unreadableFiles} of its files were skipped and ${analysis.files.source.length} were read.`);
     }
     if (tooLittleAssessed) {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@produtype/core",
-  "version": "1.5.0",
+  "version": "1.7.0",
   "description": "Deterministic CLI and library that analyzes a web application repository and reports how far it is from production-ready for the kind of product it is meant to be.",
   "license": "MIT",
   "bin": {