@produtype/core 0.17.0 → 0.18.1

package/dist/planner/buildPlan.js

@@ -33,6 +33,54 @@ const phaseMeta = {
         description: 'Tasks that are good candidates for safe templates or later AI-assisted remediation.',
     },
 };
+/**
+ * Removes a task whose work is fully described by other tasks in the same plan.
+ *
+ * `gdpr.privacy` says "implement consent, export/erasure workflows, and retention
+ * policies", which is four GDPR capabilities restated as one sentence. Twelve of the
+ * seventy-eight repositories in the verification corpus got that step *and* all of the
+ * steps it summarises: a reader does the work and then meets an item telling them to do
+ * it. The catalogue has recorded the relationship since it was written and nothing read
+ * the field.
+ *
+ * Only when nothing the general task covers is left outstanding: every superseding
+ * capability is either in the plan already or was not a problem in the first place. With
+ * two of four present and the other two still open, the general task is the only step
+ * that reaches them, and dropping it would lose the work.
+ *
+ * The dropped task's finding keeps a step: its id moves onto the tasks that replace it,
+ * so nothing falls out of the plan's account of what it is answering.
+ */
+function dropSupersededTasks(states, actionableFindingIds) {
+    const plannedFindingIds = new Set(states.flatMap((state) => state.task.findingIds));
+    const survivors = [];
+    const reassigned = new Map();
+    for (const state of states) {
+        const superseders = state.supersededBy ?? [];
+        /**
+         * A capability that was never a problem needs no step, so it cannot be the reason
+         * the general task survives — but at least one of them has to be in the plan, or
+         * this task is the only thing pointing at the work. That is the observed-only case:
+         * no expectations ran, so none of the specific steps exist.
+         */
+        const outstanding = superseders.filter((id) => !plannedFindingIds.has(id) && actionableFindingIds.has(id));
+        const anyPlanned = superseders.some((id) => plannedFindingIds.has(id));
+        const fullyCovered = superseders.length > 0 && anyPlanned && outstanding.length === 0;
+        if (!fullyCovered) {
+            survivors.push(state);
+            continue;
+        }
+        for (const findingId of superseders) {
+            reassigned.set(findingId, [...(reassigned.get(findingId) ?? []), ...state.task.findingIds]);
+        }
+    }
+    return survivors.map((state) => {
+        const inherited = state.task.findingIds.flatMap((id) => reassigned.get(id) ?? []);
+        if (inherited.length === 0)
+            return state;
+        return { ...state, task: { ...state.task, findingIds: unique([...state.task.findingIds, ...inherited]) } };
+    });
+}
 function unique(values) {
     return Array.from(new Set(values.filter(Boolean)));
 }
@@ -163,10 +211,11 @@ function buildPlan(report) {
                 task: buildTask(seed, evidenceFiles),
                 phaseId: entry.phaseId,
                 severityRank: severityOrder[finding.severity],
+                supersededBy: entry.supersededBy,
             });
         }
     }
-    const states = sortStates(Array.from(taskStates.values()));
+    const states = sortStates(dropSupersededTasks(Array.from(taskStates.values()), new Set(actionableFindings.map((finding) => finding.id))));
     const tasks = states.map((state) => state.task);
     const phases = buildPhases(states);
     const quickWins = tasks.filter((task) => task.effort === 'small' && (task.risk === 'low' || task.risk === 'medium'));

package/dist/report/buildReport.js

@@ -127,15 +127,6 @@ function buildReport(analysis, options) {
         || analysis.stack.databases.length > 0
         || mobileDetected
         || gameEngineDetected;
-    const inconclusive = !stackDetected && analysis.workspaceStacks.length === 0;
-    const inconclusiveReasons = [];
-    if (inconclusive) {
-        inconclusiveReasons.push('No frontend, backend, or database stack signals were detected.');
-        inconclusiveReasons.push('No package manifest was found in any format this analyzer reads.');
-        if (analysis.files.source.length === 0) {
-            inconclusiveReasons.push('No recognizable source files were found.');
-        }
-    }
     /**
      * Coverage counts the expectations too, not only the observed rules.
      *
@@ -150,6 +141,35 @@ function buildReport(analysis, options) {
     const assessedChecks = findings.filter((f) => f.status !== 'unknown').length
         + Math.max(applicableExpectations - expectationFindings.length, 0);
     const coverage = { passed: passedChecksForMaturity, assessed: assessedChecks };
+    const nothingIdentified = !stackDetected && analysis.workspaceStacks.length === 0;
+    /**
+     * Too little reached a verdict to say anything about this project.
+     *
+     * The flag used to ask whether a manifest existed, and the claim it makes is about
+     * what was learned. Two repositories with the same three verdicts came out at 39 and
+     * at 84, and the only difference between them was a `requirements.txt`: a Python
+     * script with one was judged, an equally small one without it was called unreadable.
+     *
+     * Five is where the corpus splits. Of seventy-eight repositories, eleven reach four
+     * verdicts or fewer and thirty reach ten or more; not one lands in between. Four
+     * verdicts cannot characterise a product, however many files it has.
+     */
+    const tooLittleAssessed = assessedChecks < score_1.MIN_ASSESSED_FOR_A_READING;
+    const inconclusive = nothingIdentified || tooLittleAssessed;
+    // Each reason says which of the two it was, because they call for different things:
+    // one is a repository this analyzer cannot read, the other is one there is barely
+    // anything to read.
+    const inconclusiveReasons = [];
+    if (nothingIdentified) {
+        inconclusiveReasons.push('No frontend, backend, or database stack signals were detected.');
+        inconclusiveReasons.push('No package manifest was found in any format this analyzer reads.');
+        if (analysis.files.source.length === 0) {
+            inconclusiveReasons.push('No recognizable source files were found.');
+        }
+    }
+    if (tooLittleAssessed) {
+        inconclusiveReasons.push(`Only ${assessedChecks} check${assessedChecks === 1 ? '' : 's'} reached a verdict, which is too few to characterise this project.`);
+    }
     // An unrecognized project has almost no applicable detectors, so the absence
     // of findings must not be rewarded with a high score: cap it at prototype.
     const scoreAfterInconclusive = inconclusive ? Math.min(combinedScore, 39) : combinedScore;

package/dist/report/score.d.ts

@@ -10,6 +10,16 @@ export interface ScoreCoverage {
     passed: number;
     assessed: number;
 }
+/**
+ * The fewest verdicts that can carry a reading at all.
+ *
+ * Below this the report has nothing to characterise: not a weak product, but a project
+ * this analyzer barely had anything to say about. In a corpus of seventy-eight
+ * repositories, eleven reach four verdicts or fewer and thirty reach ten or more —
+ * nothing lands in between, so the line sits in the gap rather than in the middle of a
+ * distribution.
+ */
+export declare const MIN_ASSESSED_FOR_A_READING = 5;
 /**
  * The highest score a report can reach when it may not claim the top band.
  *

package/dist/report/score.js

@@ -1,6 +1,6 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.TOP_BAND_CEILING = void 0;
+exports.TOP_BAND_CEILING = exports.MIN_ASSESSED_FOR_A_READING = void 0;
 exports.computeScore = computeScore;
 exports.coverageSupportsTopBand = coverageSupportsTopBand;
 exports.mayClaimTopBand = mayClaimTopBand;
@@ -28,6 +28,16 @@ function computeScore(findings) {
  * nothing.
  */
 const MIN_VERIFIED_FOR_PRODUCTION = 6;
+/**
+ * The fewest verdicts that can carry a reading at all.
+ *
+ * Below this the report has nothing to characterise: not a weak product, but a project
+ * this analyzer barely had anything to say about. In a corpus of seventy-eight
+ * repositories, eleven reach four verdicts or fewer and thirty reach ten or more —
+ * nothing lands in between, so the line sits in the gap rather than in the middle of a
+ * distribution.
+ */
+exports.MIN_ASSESSED_FOR_A_READING = 5;
 /**
  * The highest score a report can reach when it may not claim the top band.
  *

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@produtype/core",
-  "version": "0.17.0",
+  "version": "0.18.1",
   "description": "Deterministic CLI and library that analyzes a web application repository and reports how far it is from production-ready for the kind of product it is meant to be.",
   "license": "MIT",
   "bin": {