@produtype/core 0.3.1 → 0.3.3

package/README.md

@@ -99,7 +99,7 @@ Options:
 - `--format markdown|json` output format for the report or plan payload
 - `--summary` print summary only
 - `--output <path>` write output to file
-- `--profile <name>` evaluate expected product capabilities (`static-site`, `internal-tool`, `b2c-app`, `b2b-saas`, `ai-saas`, `marketplace`, `game`, `client-app`, `auto`, `observed-only`)
+- `--profile <name>` evaluate expected product capabilities (`static-site`, `internal-tool`, `b2c-app`, `b2b-saas`, `ai-saas`, `marketplace`, `game`, `client-app`, `mobile-app`, `auto`, `observed-only`)
 - `--fail-under <score>` (analyze only) exit with code 1 if the overall score is below the threshold — useful as a CI quality gate
 - `--min-maturity <level>` (analyze only) exit with code 1 if maturity is below `prototype|early|partial|production_ready`
 - `--ai` (analyze only) add an AI stack/architecture insight — opt-in, advisory only, does not affect the score
@@ -196,6 +196,20 @@ its own.
 - Plan output is deterministic and read-only only
 - No cloud dashboard or UI: this package is the CLI and the library
 
+## Verifying what you installed
+
+Every release from 0.3.3 onwards is published with npm provenance: an attestation,
+signed during the release workflow, that ties the tarball to the commit and the build
+that produced it.
+
+```bash
+npm view @produtype/core --json | grep -A5 provenance
+```
+
+Releases 0.3.0 to 0.3.2 have no attestation. They were published while this repository
+was private, and provenance is only meaningful when anyone can read the commit it
+points at.
+
 ## Roadmap
 
 Shipped: the deterministic analyzer, deterministic remediation planning, and the

package/dist/analyzer/analyzeProject.js

@@ -45,6 +45,7 @@ const detectDatabase_1 = require("./detectDatabase");
 const detectAudit_1 = require("./detectAudit");
 const detectGame_1 = require("./detectGame");
 const detectClientLogic_1 = require("./detectClientLogic");
+const detectMobile_1 = require("./detectMobile");
 const detectErrorReporting_1 = require("./detectErrorReporting");
 const detectDocker_1 = require("./detectDocker");
 const detectEnv_1 = require("./detectEnv");
@@ -460,7 +461,7 @@ async function analyzeProject(projectPath) {
         npmDeps,
         workspaces,
     };
-    const [pm, frontend, backend, database, docker, env, auth, security, uploads, gdpr, billing, observability, jobs, marketplace, aiSafety, engagement, deployment, audit, game, clientLogic, errorReporting] = await Promise.all([
+    const [pm, frontend, backend, database, docker, env, auth, security, uploads, gdpr, billing, observability, jobs, marketplace, aiSafety, engagement, deployment, audit, game, clientLogic, mobile, errorReporting] = await Promise.all([
         (0, detectPackageManager_1.detectPackageManager)(ctx),
         (0, detectFrontend_1.detectFrontend)(ctx),
         (0, detectBackend_1.detectBackend)(ctx),
@@ -481,6 +482,7 @@ async function analyzeProject(projectPath) {
         (0, detectAudit_1.detectAudit)(ctx),
         (0, detectGame_1.detectGame)(ctx),
         (0, detectClientLogic_1.detectClientLogic)(ctx),
+        (0, detectMobile_1.detectMobile)(ctx),
         (0, detectErrorReporting_1.detectErrorReporting)(ctx),
     ]);
     const detectors = (0, detectStack_1.mergeDetectors)([
@@ -492,6 +494,7 @@ async function analyzeProject(projectPath) {
         audit,
         ...game,
         clientLogic,
+        ...mobile,
         errorReporting,
         docker,
         ...env,

package/dist/analyzer/detectMobile.d.ts

@@ -0,0 +1,3 @@
+import type { DetectorResult } from './types';
+import { type DetectContext } from './detectContext';
+export declare function detectMobile(ctx: DetectContext): Promise<DetectorResult[]>;

package/dist/analyzer/detectMobile.js

@@ -0,0 +1,237 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.detectMobile = detectMobile;
+const detectContext_1 = require("./detectContext");
+const readTextFileSafe_1 = require("../utils/readTextFileSafe");
+const textSearch_1 = require("../utils/textSearch");
+/**
+ * Whether this is an application that ships to somebody else's phone, and what that
+ * demands of it.
+ *
+ * A mobile app lands today in `client-app`, which is the closest profile and
+ * underestimates it: that profile asks that the user's work survives, that the bundle
+ * arrives and that crashes are heard about, and asks nothing about the fact that the
+ * code runs on a device its author does not own, behind a review process, on a network
+ * that comes and goes, in a version that may still be installed in a year.
+ *
+ * Five expectations, none of which a web application has:
+ *
+ * **Permissions asked in context.** A camera prompt on first launch is rejected by the
+ * stores before it is rejected by users. The signal is not the permission — every app
+ * declares some — it is whether each declared permission has a purpose string next to
+ * it, which is the thing a reviewer reads.
+ *
+ * **Credentials in the keychain.** On a phone the file system is not a security
+ * boundary: anything in preferences or a plain file is readable on a rooted device and
+ * often in a backup. Tokens belong in Keychain or Keystore.
+ *
+ * **Working offline.** A network that comes and goes is the normal state, not an error
+ * case. An app that renders a spinner in a lift is broken in a way its author never
+ * sees on a desk.
+ *
+ * **Forced updates.** The old client stays installed for months whatever the release
+ * notes say, so the API either keeps supporting it or can tell it to stop.
+ *
+ * **A privacy declaration.** The App Store and Play listings are a public, checkable
+ * commitment, and it is common for them not to match what the code does.
+ */
+/** Files that say which platform this is, without reading their contents. */
+const IOS_MARKERS = [/(^|\/)Info\.plist$/i, /(^|\/)Podfile$/, /\.xcodeproj\//, /(^|\/)Package\.swift$/];
+const ANDROID_MARKERS = [/(^|\/)AndroidManifest\.xml$/i, /(^|\/)build\.gradle(\.kts)?$/];
+/** Dependencies that put a secret somewhere the operating system protects. */
+const SECURE_STORAGE_DEPS = [
+    'flutter_secure_storage',
+    'react-native-keychain',
+    'expo-secure-store',
+    'react-native-encrypted-storage',
+    '@capacitor/preferences',
+    'capacitor-secure-storage-plugin',
+];
+/** Dependencies whose whole purpose is that the app works with no network. */
+const OFFLINE_DEPS = [
+    'sqflite',
+    'drift',
+    'hive',
+    'isar',
+    'objectbox',
+    'realm',
+    'watermelondb',
+    '@nozbe/watermelondb',
+    'react-native-mmkv',
+    '@react-native-async-storage/async-storage',
+    'redux-persist',
+    '@tanstack/query-persist-client-core',
+    'powersync',
+];
+function matchesAny(files, patterns) {
+    return files.filter((file) => patterns.some((pattern) => pattern.test(file)));
+}
+async function detectMobile(ctx) {
+    const iosFiles = matchesAny(ctx.files.all, IOS_MARKERS);
+    const androidFiles = matchesAny(ctx.files.all, ANDROID_MARKERS);
+    const flutterDeps = (0, detectContext_1.hasAnyDartDep)(ctx, ['flutter']);
+    const reactNativeDeps = (0, detectContext_1.hasAnyDep)(ctx, ['react-native', 'expo']);
+    const platforms = [];
+    const platformEvidence = [];
+    if (flutterDeps.length) {
+        platforms.push('flutter');
+        platformEvidence.push({ type: 'dependency', value: 'flutter' });
+    }
+    if (reactNativeDeps.length) {
+        platforms.push('react-native');
+        for (const dep of reactNativeDeps)
+            platformEvidence.push({ type: 'dependency', value: dep });
+    }
+    if (iosFiles.length) {
+        platforms.push('ios');
+        platformEvidence.push({ type: 'file', value: iosFiles[0], file: iosFiles[0] });
+    }
+    if (androidFiles.length) {
+        platforms.push('android');
+        platformEvidence.push({ type: 'file', value: androidFiles[0], file: androidFiles[0] });
+    }
+    const isMobile = platforms.length > 0;
+    /**
+     * Every capability below reports `present: false` when this is not a mobile project,
+     * with no evidence — the profile that asks about them is the only one that applies
+     * them, and a web repository being told it has no Keychain usage would be noise.
+     */
+    if (!isMobile) {
+        return [
+            { key: 'mobile.platform', present: false, evidence: [] },
+            { key: 'mobile.permissions', present: false, evidence: [] },
+            { key: 'mobile.credentialStorage', present: false, evidence: [] },
+            { key: 'mobile.offline', present: false, evidence: [] },
+            { key: 'mobile.forcedUpdate', present: false, evidence: [] },
+            { key: 'mobile.privacyDeclaration', present: false, evidence: [] },
+        ];
+    }
+    // Permissions: declared is not the question, explained is.
+    const permissionEvidence = [];
+    let permissionsExplained = false;
+    for (const file of iosFiles.filter((f) => /Info\.plist$/i.test(f))) {
+        const text = (await (0, readTextFileSafe_1.readTextFileSafe)(ctx.root, file)) ?? '';
+        // Apple's convention: every permission key has a matching UsageDescription whose
+        // value is shown to the person being asked. An empty one passes the compiler and
+        // fails review.
+        const usageKeys = [...text.matchAll(/<key>(NS\w*UsageDescription)<\/key>\s*<string>([^<]*)<\/string>/g)];
+        const explained = usageKeys.filter(([, , reason]) => reason.trim().length > 0);
+        if (explained.length) {
+            permissionsExplained = true;
+            permissionEvidence.push({
+                type: 'file',
+                value: `${explained.length} permission${explained.length === 1 ? '' : 's'} with a reason in ${file}`,
+                file,
+            });
+        }
+        else if (usageKeys.length) {
+            permissionEvidence.push({
+                type: 'file',
+                value: `permissions declared with an empty reason in ${file}`,
+                file,
+            });
+        }
+    }
+    for (const file of androidFiles.filter((f) => /AndroidManifest\.xml$/i.test(f))) {
+        const text = (await (0, readTextFileSafe_1.readTextFileSafe)(ctx.root, file)) ?? '';
+        const declared = [...text.matchAll(/<uses-permission[^>]*android:name="([^"]+)"/g)].map(([, name]) => name);
+        // Android has no purpose strings, so the equivalent evidence is asking at the
+        // moment of use: a runtime request in the code rather than only a manifest entry.
+        if (declared.length) {
+            permissionEvidence.push({
+                type: 'file',
+                value: `${declared.length} permission${declared.length === 1 ? '' : 's'} declared in ${file}`,
+                file,
+            });
+        }
+    }
+    const runtimeRequests = await (0, textSearch_1.searchInFiles)(ctx.root, ctx.files.source, [
+        /requestPermissions?\(/,
+        /ActivityCompat\.requestPermissions/,
+        /shouldShowRequestPermissionRationale/,
+        /Permission\.\w+\.request\(/,
+        /request\(\)\s*;?\s*\/\/\s*permission/,
+        /PermissionsAndroid\.request/,
+        /requestPermissionsAsync/,
+    ], 3);
+    for (const match of runtimeRequests) {
+        permissionsExplained = true;
+        permissionEvidence.push({ type: 'snippet', value: match.snippet, file: match.file, line: match.line });
+    }
+    const secureStorage = (0, detectContext_1.hasAnyDep)(ctx, SECURE_STORAGE_DEPS);
+    const secureStorageDart = (0, detectContext_1.hasAnyDartDep)(ctx, ['flutter_secure_storage']);
+    const keychainInSource = await (0, textSearch_1.searchInFiles)(ctx.root, ctx.files.source, [/KeychainAccess/, /kSecClass/, /EncryptedSharedPreferences/, /AndroidKeyStore/, /SecItemAdd/], 3);
+    const credentialEvidence = [
+        ...[...secureStorage, ...secureStorageDart].map((dep) => ({ type: 'dependency', value: dep })),
+        ...keychainInSource.map((match) => ({
+            type: 'snippet',
+            value: match.snippet,
+            file: match.file,
+            line: match.line,
+        })),
+    ];
+    const offlineDeps = [...(0, detectContext_1.hasAnyDep)(ctx, OFFLINE_DEPS), ...(0, detectContext_1.hasAnyDartDep)(ctx, OFFLINE_DEPS)];
+    /**
+     * A local database is the strong signal; knowing the network dropped is the weak
+     * one. Both are recorded, because an app that stores nothing but tells the user the
+     * connection is gone is a different thing from one that shows a spinner forever.
+     */
+    const connectivityChecks = await (0, textSearch_1.searchInFiles)(ctx.root, ctx.files.source, [/Connectivity\(\)/, /connectivity_plus/, /NetInfo\./, /navigator\.onLine/, /NWPathMonitor/, /isReachable/], 3);
+    const offlineEvidence = [
+        ...offlineDeps.map((dep) => ({ type: 'dependency', value: dep })),
+        ...connectivityChecks.map((match) => ({
+            type: 'snippet',
+            value: match.snippet,
+            file: match.file,
+            line: match.line,
+        })),
+    ];
+    const forcedUpdate = await (0, textSearch_1.searchInFiles)(ctx.root, ctx.files.source, [
+        /minimum_?[Vv]ersion/,
+        /force_?[Uu]pdate/,
+        /forceUpgrade/,
+        /upgrader/i,
+        /in_app_update/,
+        /AppUpdateManager/,
+        /minimumSupportedVersion/,
+    ], 3);
+    /**
+     * The privacy declaration, which exists as a file in both worlds now: Apple's
+     * PrivacyInfo.xcprivacy since 2024, and the data-safety declaration Play requires.
+     * A repository with neither has made the commitment somewhere no reviewer of this
+     * code can check it against the code.
+     */
+    const privacyFiles = ctx.files.all.filter((file) => /(^|\/)(PrivacyInfo\.xcprivacy|privacy-manifest\.json|data_safety\.ya?ml)$/i.test(file));
+    return [
+        {
+            key: 'mobile.platform',
+            present: true,
+            evidence: platformEvidence,
+            details: { platforms },
+        },
+        {
+            key: 'mobile.permissions',
+            // Declared-and-explained, or asked at the moment of use. A manifest full of
+            // permissions with nothing next to them is the failing case, not the passing one.
+            present: permissionsExplained,
+            evidence: permissionEvidence,
+        },
+        { key: 'mobile.credentialStorage', present: credentialEvidence.length > 0, evidence: credentialEvidence },
+        { key: 'mobile.offline', present: offlineDeps.length > 0, evidence: offlineEvidence },
+        {
+            key: 'mobile.forcedUpdate',
+            present: forcedUpdate.length > 0,
+            evidence: forcedUpdate.map((match) => ({
+                type: 'snippet',
+                value: match.snippet,
+                file: match.file,
+                line: match.line,
+            })),
+        },
+        {
+            key: 'mobile.privacyDeclaration',
+            present: privacyFiles.length > 0,
+            evidence: privacyFiles.map((file) => ({ type: 'file', value: file, file })),
+        },
+    ];
+}

package/dist/api.d.ts

@@ -24,6 +24,8 @@ export { PRODKit_VERSION } from './version';
  * consumer that wants to publish the list should read it from here.
  */
 export { supportedStacks, labelFor } from './analyzer/catalogue';
+export { productProfileChoices, getProductProfile } from './expectations/productProfiles';
+export type { ProfileChoice } from './expectations/productProfiles';
 export type { StackCatalogue, CatalogueEntry } from './analyzer/catalogue';
 /**
  * Safe file reading, exported because consumers that sample a repository need the

package/dist/api.js

@@ -1,6 +1,6 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.readJsonSafe = exports.readTextFileSafe = exports.labelFor = exports.supportedStacks = exports.PRODKit_VERSION = exports.renderJsonPlan = exports.renderMarkdownPlan = exports.buildPlan = exports.renderJson = exports.renderMarkdown = exports.buildReport = exports.analyzeProject = void 0;
+exports.readJsonSafe = exports.readTextFileSafe = exports.getProductProfile = exports.productProfileChoices = exports.labelFor = exports.supportedStacks = exports.PRODKit_VERSION = exports.renderJsonPlan = exports.renderMarkdownPlan = exports.buildPlan = exports.renderJson = exports.renderMarkdown = exports.buildReport = exports.analyzeProject = void 0;
 var analyzeProject_1 = require("./analyzer/analyzeProject");
 Object.defineProperty(exports, "analyzeProject", { enumerable: true, get: function () { return analyzeProject_1.analyzeProject; } });
 var buildReport_1 = require("./report/buildReport");
@@ -27,6 +27,9 @@ Object.defineProperty(exports, "PRODKit_VERSION", { enumerable: true, get: funct
 var catalogue_1 = require("./analyzer/catalogue");
 Object.defineProperty(exports, "supportedStacks", { enumerable: true, get: function () { return catalogue_1.supportedStacks; } });
 Object.defineProperty(exports, "labelFor", { enumerable: true, get: function () { return catalogue_1.labelFor; } });
+var productProfiles_1 = require("./expectations/productProfiles");
+Object.defineProperty(exports, "productProfileChoices", { enumerable: true, get: function () { return productProfiles_1.productProfileChoices; } });
+Object.defineProperty(exports, "getProductProfile", { enumerable: true, get: function () { return productProfiles_1.getProductProfile; } });
 /**
  * Safe file reading, exported because consumers that sample a repository need the
  * same guarantees the analyzer relies on: binaries and oversized files are skipped,

package/dist/cli.js

@@ -46,7 +46,7 @@ const markdownPlan_1 = require("./planner/markdownPlan");
 const jsonPlan_1 = require("./planner/jsonPlan");
 const pathUtils_1 = require("./utils/pathUtils");
 const version_1 = require("./version");
-const allowedProfiles = ['observed-only', 'static-site', 'internal-tool', 'b2c-app', 'b2b-saas', 'ai-saas', 'marketplace', 'game', 'client-app', 'auto'];
+const allowedProfiles = ['observed-only', 'static-site', 'internal-tool', 'b2c-app', 'b2b-saas', 'ai-saas', 'marketplace', 'game', 'client-app', 'mobile-app', 'auto'];
 const maturityOrder = ['prototype', 'early', 'partial', 'production_ready'];
 function normalizeProfile(profile) {
     if (!profile)

package/dist/expectations/productProfiles.d.ts

@@ -42,6 +42,11 @@ declare const CAPABILITIES: {
     readonly 'app.state-durability': CapabilityBlueprint;
     readonly 'app.asset-delivery': CapabilityBlueprint;
     readonly 'client.error-reporting': CapabilityBlueprint;
+    readonly 'mobile.permissions': CapabilityBlueprint;
+    readonly 'mobile.credential-storage': CapabilityBlueprint;
+    readonly 'mobile.offline': CapabilityBlueprint;
+    readonly 'mobile.forced-update': CapabilityBlueprint;
+    readonly 'mobile.privacy-declaration': CapabilityBlueprint;
     readonly 'jobs.background': CapabilityBlueprint;
     readonly 'deployment.readiness': CapabilityBlueprint;
     readonly 'deployment.docker': CapabilityBlueprint;
@@ -56,5 +61,26 @@ declare const CAPABILITIES: {
 };
 export type CapabilityId = keyof typeof CAPABILITIES;
 export declare const productProfiles: Record<Exclude<ProductProfile, 'auto' | 'observed-only'>, ProductProfileDefinition>;
+/**
+ * Every profile a report can be asked for, with the name and sentence a person reads.
+ *
+ * Exported because consumers were keeping their own copy of this list. The cloud
+ * application had its own `ProductProfile` union, its own array for the dropdown and
+ * its own label map — and had fallen three profiles behind, so `game`, `client-app` and
+ * `mobile-app` existed in the analyzer and could not be chosen in the product built on
+ * it. Same failure as the supported-stacks list, one layer up.
+ *
+ * `auto` and `observed-only` are included because they are choices a caller makes even
+ * though they are not profiles with expectations behind them: `auto` asks the analyzer
+ * to decide, `observed-only` asks it not to.
+ */
+export interface ProfileChoice {
+    id: ProductProfile;
+    title: string;
+    description: string;
+    /** Whether expectations exist for it, or it is an instruction about how to judge. */
+    judged: boolean;
+}
+export declare function productProfileChoices(): ProfileChoice[];
 export declare function getProductProfile(profile: Exclude<ProductProfile, 'auto' | 'observed-only'>): ProductProfileDefinition;
 export {};

package/dist/expectations/productProfiles.js

@@ -1,6 +1,7 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.productProfiles = void 0;
+exports.productProfileChoices = productProfileChoices;
 exports.getProductProfile = getProductProfile;
 function blueprint(args) {
     return args;
@@ -200,11 +201,14 @@ const CAPABILITIES = {
     }),
     'app.state-durability': blueprint({
         id: 'app.state-durability',
-        title: 'Player progress survives the browser',
+        // Worded for every profile that asks it, not only for the one it was written for.
+        // A mobile app was being told its "player progress" had to survive "the browser",
+        // which is two wrong words in a report meant to be believed.
+        title: 'The user\u2019s work survives leaving the app',
         category: 'client',
         detectorKeys: ['app.stateDurability'],
-        description: 'Progress is kept somewhere durable rather than only in browser storage, which is emptied by a cleared cache, a private window or a new device — without the player ever being told the save was not real.',
-        recommendation: 'Persist progress server-side, and treat browser storage as a cache of it rather than as the record.',
+        description: 'What the person has done is kept somewhere durable rather than only in the storage the platform is free to clear — a cleared cache, a private window, a reinstall, a new device — without them ever being told the save was not real.',
+        recommendation: 'Persist progress outside volatile storage, and treat the local copy as a cache of the record rather than as the record.',
     }),
     'app.asset-delivery': blueprint({
         id: 'app.asset-delivery',
@@ -222,6 +226,46 @@ const CAPABILITIES = {
         description: 'On a server a crash is in the logs whether anyone planned for it or not. In code running on someone else\'s device it is not: the screen goes white, the person closes the tab, and nothing records that it happened.',
         recommendation: 'Report unhandled errors and rejections from the browser to a service you actually read.',
     }),
+    'mobile.permissions': blueprint({
+        id: 'mobile.permissions',
+        title: 'Permissions asked in context, with a reason',
+        category: 'mobile',
+        detectorKeys: ['mobile.permissions'],
+        description: 'A permission declared with nothing next to it is a prompt with no explanation. Apple requires a purpose string and reads it in review; Android has none, so the equivalent is asking at the moment of use rather than at launch. An app that asks for the camera on its first screen is refused by the stores before it is refused by users.',
+        recommendation: 'Give every declared permission a purpose string, and request it at the point the feature needs it rather than on startup.',
+    }),
+    'mobile.credential-storage': blueprint({
+        id: 'mobile.credential-storage',
+        title: 'Credentials in the keychain',
+        category: 'mobile',
+        detectorKeys: ['mobile.credentialStorage'],
+        description: 'On a phone the file system is not a security boundary. A token in preferences or a plain file is readable on a rooted device and often present in a backup, which is a different exposure from the same mistake on a server nobody else holds.',
+        recommendation: 'Keep tokens and keys in Keychain or Keystore, through the platform API or a wrapper over it.',
+    }),
+    'mobile.offline': blueprint({
+        id: 'mobile.offline',
+        title: 'It works when the network does not',
+        category: 'mobile',
+        detectorKeys: ['mobile.offline'],
+        description: 'A network that comes and goes is the normal state of a phone, not an error case. An app with no local store renders a spinner in a lift, on a train and in a basement — none of which its author sees at a desk.',
+        recommendation: 'Keep what the person is working on locally, and reconcile with the server when the connection returns.',
+    }),
+    'mobile.forced-update': blueprint({
+        id: 'mobile.forced-update',
+        title: 'The old version can be told to stop',
+        category: 'mobile',
+        detectorKeys: ['mobile.forcedUpdate'],
+        description: 'A web application changes for everyone at once. A client on someone else\u2019s phone stays installed for months whatever the release notes say, so the server either keeps supporting every version it ever shipped or can refuse the ones it no longer does.',
+        recommendation: 'Send a minimum supported version from the server and have the client act on it.',
+    }),
+    'mobile.privacy-declaration': blueprint({
+        id: 'mobile.privacy-declaration',
+        title: 'The privacy declaration is in the repository',
+        category: 'mobile',
+        detectorKeys: ['mobile.privacyDeclaration'],
+        description: 'The App Store and Play listings are a public, checkable commitment about what the app collects. Written in a dashboard rather than kept beside the code, it stops matching what the code does, and nobody reviewing the code can tell.',
+        recommendation: 'Keep the privacy manifest (PrivacyInfo.xcprivacy, or the data-safety declaration) in the repository, next to what it describes.',
+    }),
     'jobs.background': blueprint({
         id: 'jobs.background',
         title: 'Background jobs or queue processing',
@@ -438,6 +482,48 @@ exports.productProfiles = {
             'deployment.docker': 'recommended',
         },
     }),
+    /**
+     * An application that ships to somebody else's phone.
+     *
+     * It used to land in `client-app`, which is the nearest profile and underestimates
+     * it: that one asks that the user's work survives, that the bundle arrives and that
+     * crashes are heard about, and asks nothing about the fact that this code runs on a
+     * device its author does not own, behind a review process, on a network that comes
+     * and goes, in a version that may still be installed in a year.
+     *
+     * What it deliberately does not ask for, exactly as client-app does not: tenants,
+     * an audit trail, a billing path. A mobile app is a client. The five capabilities
+     * that are its own are the ones no web application has.
+     */
+    'mobile-app': defineProfile({
+        id: 'mobile-app',
+        title: 'Mobile application',
+        description: 'An app installed on a device its author does not own, shipped through a store.',
+        importance: {
+            'mobile.permissions': 'required',
+            'mobile.credential-storage': 'required',
+            'mobile.offline': 'required',
+            'mobile.forced-update': 'recommended',
+            'mobile.privacy-declaration': 'recommended',
+            'app.state-durability': 'required',
+            'client.error-reporting': 'required',
+            // The bundle is delivered by the store, not by us — so asset delivery, which
+            // client-app requires, is not this profile's problem.
+            'app.asset-delivery': 'optional',
+            'auth.baseline': 'optional',
+            'gdpr.export': 'optional',
+            'gdpr.erasure': 'optional',
+            'security.rate-limit': 'optional',
+            'uploads.protection': 'optional',
+            // Neither of these is a mobile application's problem when the repository is only
+            // the app: a store ships it rather than a pipeline deploying it, and the logs
+            // that matter are on a server that lives somewhere else. Asking for them
+            // produces findings nobody can act on, which is what this profile exists to
+            // avoid.
+            'observability.logging': 'optional',
+            'deployment.readiness': 'optional',
+        },
+    }),
     'b2c-app': defineProfile({
         id: 'b2c-app',
         title: 'B2C App',
@@ -578,6 +664,29 @@ exports.productProfiles = {
         },
     }),
 };
+function productProfileChoices() {
+    const defined = Object.keys(exports.productProfiles).map((id) => ({
+        id: exports.productProfiles[id].id,
+        title: exports.productProfiles[id].title,
+        description: exports.productProfiles[id].description,
+        judged: true,
+    }));
+    return [
+        {
+            id: 'auto',
+            title: 'Detect automatically',
+            description: 'Let the analyzer decide what kind of product this is, and say how sure it is.',
+            judged: false,
+        },
+        ...defined,
+        {
+            id: 'observed-only',
+            title: 'Observed only',
+            description: 'Score what the code has, without asking what a product of any kind would need.',
+            judged: false,
+        },
+    ];
+}
 function getProductProfile(profile) {
     return exports.productProfiles[profile];
 }

package/dist/expectations/profileSignals.d.ts

@@ -40,6 +40,8 @@ export interface ProfileFacts {
     containerised: boolean;
     gameEngine: boolean;
     gameSignals: number;
+    /** Ships to a phone: Flutter, React Native, or an iOS/Android project in the tree. */
+    mobilePlatforms: string[];
     sourceFiles: number;
 }
 export declare function readFacts(analysis: ProjectAnalysis): ProfileFacts;

package/dist/expectations/profileSignals.js

@@ -26,6 +26,7 @@ function readFacts(analysis) {
         containerised: present('deployment.docker'),
         gameEngine: present('game.engine'),
         gameSignals: Number(analysis.detectors['game.engine']?.details?.supportingSignals ?? 0),
+        mobilePlatforms: analysis.detectors['mobile.platform']?.details?.platforms ?? [],
         sourceFiles: analysis.files.source.length,
     };
 }
@@ -77,6 +78,33 @@ const RULES = [
             { label: 'accounts to manage', weight: -1, holds: (f) => f.auth },
         ],
     },
+    {
+        /**
+         * A mobile application refines client-app for the same reason `game` does: it is a
+         * client, and the expectations that separate it are ones no web application has.
+         *
+         * The platform is what identifies it, and one signal is enough — a repository with
+         * an AndroidManifest.xml is an Android application, and no amount of other evidence
+         * makes it less one. What the rest of the signals do is separate a real app from a
+         * web project that happens to carry a Capacitor shell.
+         */
+        profile: 'mobile-app',
+        refines: 'client-app',
+        admissible: (f) => f.mobilePlatforms.length > 0 && !f.tenancy,
+        signals: [
+            { identifies: true, label: 'a mobile project in the repository', weight: 5, holds: (f) => f.mobilePlatforms.length > 0 },
+            {
+                identifies: true,
+                label: 'built for both iOS and Android',
+                weight: 1,
+                holds: (f) => f.mobilePlatforms.includes('ios') && f.mobilePlatforms.includes('android'),
+            },
+            { label: 'enough code to be an application', weight: 1, holds: (f) => f.sourceFiles > 12 },
+            // A backend in the same repository does not stop it being a mobile app, but a
+            // repository that is mostly a server with a thin client is a server.
+            { label: 'a server of its own in the same repository', weight: -1, holds: (f) => f.backend && f.database },
+        ],
+    },
     {
         profile: 'game',
         refines: 'client-app',

package/dist/expectations/types.d.ts

@@ -1,9 +1,9 @@
 import type { DetectorEvidence } from '../analyzer/types';
 import type { Finding } from '../report/types';
-export type ProductProfile = 'static-site' | 'internal-tool' | 'b2c-app' | 'b2b-saas' | 'ai-saas' | 'game' | 'client-app' | 'marketplace' | 'auto' | 'observed-only';
+export type ProductProfile = 'static-site' | 'internal-tool' | 'b2c-app' | 'b2b-saas' | 'ai-saas' | 'game' | 'client-app' | 'mobile-app' | 'marketplace' | 'auto' | 'observed-only';
 export type CapabilityImportance = 'required' | 'recommended' | 'optional' | 'not_applicable';
 export type CapabilityStatus = 'present' | 'missing' | 'partial' | 'unknown' | 'not_applicable';
-export type CapabilityCategory = 'auth' | 'authz' | 'tenancy' | 'gdpr' | 'billing' | 'security' | 'uploads' | 'observability' | 'deployment' | 'audit' | 'jobs' | 'client';
+export type CapabilityCategory = 'auth' | 'authz' | 'tenancy' | 'gdpr' | 'billing' | 'security' | 'uploads' | 'observability' | 'deployment' | 'audit' | 'jobs' | 'client' | 'mobile';
 export interface ExpectedCapability {
     id: string;
     title: string;

package/dist/report/executiveSummary.js

@@ -21,6 +21,7 @@ const CATEGORY_LABEL = {
     audit: 'traceability of sensitive actions',
     observability: 'knowing what happens in production',
     client: 'saving work and loading the app',
+    mobile: 'running on somebody else\u2019s phone',
     jobs: 'background processing',
     deployment: 'deploying repeatably',
 };

package/dist/report/types.d.ts

@@ -16,7 +16,7 @@ export type EvidenceQuality = 'weak' | 'medium' | 'strong';
  * because the array had never heard of it. Deriving one from the other makes that
  * impossible rather than merely unlikely.
  */
-export declare const CATEGORIES: readonly ["meta", "stack", "env", "auth", "authz", "tenancy", "gdpr", "security", "uploads", "billing", "audit", "observability", "client", "jobs", "deployment"];
+export declare const CATEGORIES: readonly ["meta", "stack", "env", "auth", "authz", "tenancy", "gdpr", "security", "uploads", "billing", "audit", "observability", "client", "mobile", "jobs", "deployment"];
 export type Category = (typeof CATEGORIES)[number];
 export interface Finding {
     id: string;

package/dist/report/types.js

@@ -24,6 +24,7 @@ exports.CATEGORIES = [
     'audit',
     'observability',
     'client',
+    'mobile',
     'jobs',
     'deployment',
 ];

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@produtype/core",
-  "version": "0.3.1",
+  "version": "0.3.3",
   "description": "Deterministic CLI and library that analyzes a web application repository and reports how far it is from production-ready for the kind of product it is meant to be.",
   "license": "MIT",
   "bin": {