@produtype/core 0.3.2 → 0.4.0

package/README.md

@@ -40,6 +40,16 @@ From the report, ProdKit can also build a deterministic remediation plan with ph
 
 ## Installation
 
+```bash
+npm install -g @produtype/core
+prodkit analyze .
+```
+
+The command is `prodkit`; the package is `@produtype/core`. They differ on purpose:
+`prodkit` on npm is an unrelated and actively maintained package, so this one is
+published under the `@produtype` scope. `npm i prodkit` installs somebody else's
+project.
+
 ### Local development install
 
 1. Install dependencies:
@@ -155,7 +165,7 @@ _Generated from the analyzer itself — run `npm run docs:stacks` after changing
 
 - **Backend:** Express, Next.js, NestJS, Fastify, Hono, Elysia, Koa, AdonisJS, SvelteKit, Remix, Nuxt, Nitro, Astro, Django, Flask, FastAPI, Litestar, Sanic, Tornado, aiohttp, Starlette, Gin, Echo, Fiber, chi, Gorilla, Beego, Go, Rails, Sinatra, Hanami, Roda, Grape, Ruby, Laravel, Symfony, Slim, CodeIgniter, CakePHP, Yii, PHP, ASP.NET Core, .NET
 - **Frontend:** React, Vite, Vue, Nuxt, Svelte, Angular, Astro, Solid, Qwik, Preact, Remix, htmx, Tailwind CSS, Electron
-- **Mobile:** Flutter
+- **Mobile:** Flutter, React Native, iOS (native), Android (native)
 - **Databases:** Postgres, MySQL, SQLite, SQL Server, MongoDB, Redis, Firestore, DynamoDB, Convex
 - **Hosted data platforms:** Supabase, Firebase, PlanetScale, Neon, Vercel Postgres, Turso, Upstash, DynamoDB, Convex
 - **ORMs:** Prisma, Drizzle, TypeORM, Sequelize, Knex, MikroORM, Kysely, SQLAlchemy, Tortoise, Peewee
@@ -173,6 +183,9 @@ How some of these are decided:
 - **ASP.NET Core** — the Microsoft.NET.Sdk.Web SDK attribute
 - **.NET** — a .csproj with no web SDK
 - **Flutter** — pubspec.yaml — classified as a client application, not a backend
+- **React Native** — the react-native or expo dependency
+- **iOS (native)** — Info.plist, Package.swift, a Podfile or an .xcodeproj in the tree
+- **Android (native)** — AndroidManifest.xml, or build.gradle in either dialect
 - **Supabase** — recorded alongside the engine it is — Postgres
 - **Firebase** — Firestore
 - **PlanetScale** — MySQL
@@ -196,6 +209,20 @@ its own.
 - Plan output is deterministic and read-only only
 - No cloud dashboard or UI: this package is the CLI and the library
 
+## Verifying what you installed
+
+Every release from 0.3.3 onwards is published with npm provenance: an attestation,
+signed during the release workflow, that ties the tarball to the commit and the build
+that produced it.
+
+```bash
+npm view @produtype/core --json | grep -A5 provenance
+```
+
+Releases 0.3.0 to 0.3.2 have no attestation. They were published while this repository
+was private, and provenance is only meaningful when anyone can read the commit it
+points at.
+
 ## Roadmap
 
 Shipped: the deterministic analyzer, deterministic remediation planning, and the

package/dist/analyzer/analyzeProject.js

@@ -365,6 +365,53 @@ async function analyzeProject(projectPath) {
                 dartDeps.push(match[1].toLowerCase());
         }
     }
+    /**
+     * Gradle, read from build.gradle and build.gradle.kts.
+     *
+     * Both dialects in one reader because the line that matters is nearly the same in
+     * each: `implementation 'group:artifact:version'` in Groovy and
+     * `implementation("group:artifact:version")` in Kotlin. Only the coordinate is kept —
+     * group and artifact, without the version — because every rule downstream asks which
+     * library is used, never which release of it.
+     *
+     * Version catalogs (`libs.androidx.core.ktx`) are deliberately not resolved. They
+     * name an alias defined in a TOML file, and following it would mean a second reader
+     * for a second format to learn the same fact; a project using them reports fewer
+     * libraries rather than wrong ones.
+     */
+    const gradleDeps = [];
+    for (const file of allFiles.filter((f) => /(^|\/)build\.gradle(\.kts)?$/.test(f))) {
+        const raw = (await (0, readTextFileSafe_1.readTextFileSafe)(root, file)) ?? '';
+        for (const match of raw.matchAll(/\b(?:implementation|api|compileOnly|runtimeOnly|kapt|ksp|annotationProcessor|testImplementation)\s*[( ]\s*["']([^"']+)["']/g)) {
+            const [group, artifact] = match[1].split(':');
+            if (group && artifact)
+                gradleDeps.push(`${group}:${artifact}`.toLowerCase());
+        }
+    }
+    /**
+     * Swift packages, from Package.swift and the Podfile.
+     *
+     * Package.swift is Swift source rather than data, so what is read is the one shape
+     * that is always there: `.package(url: "https://github.com/owner/name.git", ...)`.
+     * The owner and repository name are kept, which is how a Swift dependency is
+     * identified in practice — nobody says "the Alamofire product of the Alamofire
+     * package".
+     *
+     * CocoaPods is simpler and still in wide use: `pod 'Alamofire'`.
+     */
+    const swiftDeps = [];
+    for (const file of allFiles.filter((f) => /(^|\/)Package\.swift$/.test(f))) {
+        const raw = (await (0, readTextFileSafe_1.readTextFileSafe)(root, file)) ?? '';
+        for (const match of raw.matchAll(/\.package\s*\(\s*url:\s*["']https?:\/\/[^"']*?\/([^/"']+?)\/([^/"']+?)(?:\.git)?["']/g)) {
+            swiftDeps.push(`${match[1]}/${match[2]}`.toLowerCase());
+        }
+    }
+    for (const file of allFiles.filter((f) => /(^|\/)Podfile$/.test(f))) {
+        const raw = (await (0, readTextFileSafe_1.readTextFileSafe)(root, file)) ?? '';
+        for (const match of raw.matchAll(/^\s*pod\s+["']([^"'/]+)/gm)) {
+            swiftDeps.push(match[1].toLowerCase());
+        }
+    }
     /**
      * .csproj, which is XML rather than JSON or one-entry-per-line.
      *
@@ -458,6 +505,8 @@ async function analyzeProject(projectPath) {
         dotnetDeps: unique(dotnetDeps),
         dotnetWebSdk,
         dartDeps: unique(dartDeps),
+        gradleDeps: unique(gradleDeps),
+        swiftDeps: unique(swiftDeps),
         npmDeps,
         workspaces,
     };

package/dist/analyzer/catalogue.d.ts

@@ -29,6 +29,19 @@ export declare const PHP_BACKEND_FRAMEWORKS: Array<[string, string[]]>;
 export declare const PYTHON_BACKEND_FRAMEWORKS: Array<[string, string]>;
 /** Frontend frameworks settled by their signature dependency. */
 export declare const FRONTEND_FRAMEWORKS: Array<[string, string[]]>;
+/**
+ * Source languages, and the extensions that say so.
+ *
+ * `deriveLanguages` knew about TypeScript, JavaScript and Python, so a Go service or a
+ * Kotlin app reported `languages: []` while the README and the website both claimed
+ * twelve. One table, read by the detector and by the catalogue, is what stops the
+ * claim and the code disagreeing again.
+ */
+export declare const LANGUAGES: Array<{
+    id: string;
+    label: string;
+    extensions: RegExp;
+}>;
 export interface CatalogueEntry {
     /** The identifier the report uses. */
     id: string;

package/dist/analyzer/catalogue.js

@@ -15,7 +15,7 @@
  * that loses users.
  */
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.FRONTEND_FRAMEWORKS = exports.PYTHON_BACKEND_FRAMEWORKS = exports.PHP_BACKEND_FRAMEWORKS = exports.RUBY_BACKEND_FRAMEWORKS = exports.GO_BACKEND_FRAMEWORKS = exports.NODE_BACKEND_FRAMEWORKS = void 0;
+exports.LANGUAGES = exports.FRONTEND_FRAMEWORKS = exports.PYTHON_BACKEND_FRAMEWORKS = exports.PHP_BACKEND_FRAMEWORKS = exports.RUBY_BACKEND_FRAMEWORKS = exports.GO_BACKEND_FRAMEWORKS = exports.NODE_BACKEND_FRAMEWORKS = void 0;
 exports.labelFor = labelFor;
 exports.hasLabel = hasLabel;
 exports.supportedStacks = supportedStacks;
@@ -85,6 +85,28 @@ exports.FRONTEND_FRAMEWORKS = [
     ['remix', ['@remix-run/react']],
     ['htmx', ['htmx.org']],
 ];
+/**
+ * Source languages, and the extensions that say so.
+ *
+ * `deriveLanguages` knew about TypeScript, JavaScript and Python, so a Go service or a
+ * Kotlin app reported `languages: []` while the README and the website both claimed
+ * twelve. One table, read by the detector and by the catalogue, is what stops the
+ * claim and the code disagreeing again.
+ */
+exports.LANGUAGES = [
+    { id: 'typescript', label: 'TypeScript', extensions: /\.(ts|tsx)$/ },
+    { id: 'javascript', label: 'JavaScript', extensions: /\.(js|jsx|mjs|cjs)$/ },
+    { id: 'python', label: 'Python', extensions: /\.py$/ },
+    { id: 'php', label: 'PHP', extensions: /\.php$/ },
+    { id: 'go', label: 'Go', extensions: /\.go$/ },
+    { id: 'ruby', label: 'Ruby', extensions: /\.rb$/ },
+    { id: 'java', label: 'Java', extensions: /\.java$/ },
+    { id: 'csharp', label: 'C#', extensions: /\.cs$/ },
+    { id: 'rust', label: 'Rust', extensions: /\.rs$/ },
+    { id: 'kotlin', label: 'Kotlin', extensions: /\.(kt|kts)$/ },
+    { id: 'swift', label: 'Swift', extensions: /\.swift$/ },
+    { id: 'dart', label: 'Dart', extensions: /\.dart$/ },
+];
 /** Display names for ids the tables above produce. */
 const LABELS = {
     next: 'Next.js',
@@ -133,6 +155,9 @@ const LABELS = {
     tailwindcss: 'Tailwind CSS',
     electron: 'Electron',
     flutter: 'Flutter',
+    'react-native': 'React Native',
+    ios: 'iOS (native)',
+    android: 'Android (native)',
     express: 'Express',
     flask: 'Flask',
     fastapi: 'FastAPI',
@@ -233,6 +258,17 @@ function supportedStacks() {
                 label: 'Flutter',
                 detectedFrom: 'pubspec.yaml — classified as a client application, not a backend',
             },
+            { id: 'react-native', label: 'React Native', detectedFrom: 'the react-native or expo dependency' },
+            {
+                id: 'ios',
+                label: 'iOS (native)',
+                detectedFrom: 'Info.plist, Package.swift, a Podfile or an .xcodeproj in the tree',
+            },
+            {
+                id: 'android',
+                label: 'Android (native)',
+                detectedFrom: 'AndroidManifest.xml, or build.gradle in either dialect',
+            },
         ],
         databases: entries(['postgres', 'mysql', 'sqlite', 'sqlserver', 'mongodb', 'redis', 'firestore', 'dynamodb', 'convex']),
         dataPlatforms: [
@@ -258,6 +294,6 @@ function supportedStacks() {
             'tortoise',
             'peewee',
         ]),
-        languages: entries(['typescript', 'javascript', 'python', 'php', 'go', 'ruby', 'java', 'csharp', 'rust', 'kotlin', 'swift', 'dart']).map((entry) => ({ ...entry, label: labelFor(entry.id) === entry.id ? entry.id.replace(/^\w/, (c) => c.toUpperCase()) : labelFor(entry.id) })),
+        languages: exports.LANGUAGES.map(({ id, label }) => ({ id, label })),
     };
 }

package/dist/analyzer/detectContext.d.ts

@@ -32,6 +32,10 @@ export interface DetectContext {
     dotnetWebSdk: boolean;
     /** Package names from pubspec.yaml, lowercase. */
     dartDeps: string[];
+    /** Gradle coordinates as `group:artifact`, without the version, lowercase. */
+    gradleDeps: string[];
+    /** Swift packages as `owner/repo`, and CocoaPods names, lowercase. */
+    swiftDeps: string[];
     /** Lowercased combined dependency map (deps + devDeps). */
     npmDeps: Record<string, string>;
     workspaces: WorkspaceManifest[];
@@ -54,5 +58,7 @@ export declare function hasAnyRubyDep(ctx: DetectContext, names: string[]): stri
  * `Npgsql.EntityFrameworkCore.PostgreSQL`, and a rule should be able to ask for
  * `Npgsql` without listing every provider package that starts with it.
  */
+export declare function hasAnyGradleDep(ctx: DetectContext, names: string[]): string[];
+export declare function hasAnySwiftDep(ctx: DetectContext, names: string[]): string[];
 export declare function hasAnyDartDep(ctx: DetectContext, names: string[]): string[];
 export declare function hasAnyDotnetDep(ctx: DetectContext, names: string[]): string[];

package/dist/analyzer/detectContext.js

@@ -8,6 +8,8 @@ exports.hasPhpDep = hasPhpDep;
 exports.hasAnyPhpDep = hasAnyPhpDep;
 exports.hasAnyGoDep = hasAnyGoDep;
 exports.hasAnyRubyDep = hasAnyRubyDep;
+exports.hasAnyGradleDep = hasAnyGradleDep;
+exports.hasAnySwiftDep = hasAnySwiftDep;
 exports.hasAnyDartDep = hasAnyDartDep;
 exports.hasAnyDotnetDep = hasAnyDotnetDep;
 function hasDep(ctx, name) {
@@ -55,6 +57,16 @@ function hasAnyRubyDep(ctx, names) {
  * `Npgsql.EntityFrameworkCore.PostgreSQL`, and a rule should be able to ask for
  * `Npgsql` without listing every provider package that starts with it.
  */
+function hasAnyGradleDep(ctx, names) {
+    // Substring rather than equality: a coordinate is `androidx.room:room-runtime`, and
+    // a rule asks about `androidx.room` without wanting to name every artifact in it.
+    const wanted = names.map((name) => name.toLowerCase());
+    return ctx.gradleDeps.filter((dep) => wanted.some((name) => dep.includes(name)));
+}
+function hasAnySwiftDep(ctx, names) {
+    const wanted = names.map((name) => name.toLowerCase());
+    return ctx.swiftDeps.filter((dep) => wanted.some((name) => dep.includes(name)));
+}
 function hasAnyDartDep(ctx, names) {
     return hasAnyIn(ctx.dartDeps, names);
 }

package/dist/analyzer/detectMobile.js

@@ -38,6 +38,35 @@ const textSearch_1 = require("../utils/textSearch");
 /** Files that say which platform this is, without reading their contents. */
 const IOS_MARKERS = [/(^|\/)Info\.plist$/i, /(^|\/)Podfile$/, /\.xcodeproj\//, /(^|\/)Package\.swift$/];
 const ANDROID_MARKERS = [/(^|\/)AndroidManifest\.xml$/i, /(^|\/)build\.gradle(\.kts)?$/];
+/** Gradle coordinates that put a secret in the Android keystore rather than in a file. */
+const SECURE_STORAGE_GRADLE = ['androidx.security:security-crypto', 'com.scottyab:secure-preferences'];
+/**
+ * Swift keychain wrappers, named both ways.
+ *
+ * Swift Package Manager identifies a dependency as `owner/repo` and CocoaPods as a
+ * bare pod name, so the same library arrives under two spellings and a list holding
+ * only one of them finds it only half the time — which is how a Podfile declaring
+ * KeychainAccess came back as "no secure storage".
+ */
+const SECURE_STORAGE_SWIFT = [
+    'kishikawakatsumi/keychainaccess',
+    'keychainaccess',
+    'evgenyneu/keychain-swift',
+    'keychainswift',
+    'square/valet',
+    'valet',
+];
+/** Local databases, by platform, that let an app open without a network. */
+const OFFLINE_GRADLE = ['androidx.room', 'io.realm', 'io.objectbox', 'com.squareup.sqldelight', 'app.cash.sqldelight'];
+const OFFLINE_SWIFT = [
+    'groue/grdb.swift',
+    'grdb.swift',
+    'stephencelis/sqlite.swift',
+    'sqlite.swift',
+    'realm/realm-swift',
+    'realm/realm-cocoa',
+    'realmswift',
+];
 /** Dependencies that put a secret somewhere the operating system protects. */
 const SECURE_STORAGE_DEPS = [
     'flutter_secure_storage',
@@ -160,9 +189,16 @@ async function detectMobile(ctx) {
     }
     const secureStorage = (0, detectContext_1.hasAnyDep)(ctx, SECURE_STORAGE_DEPS);
     const secureStorageDart = (0, detectContext_1.hasAnyDartDep)(ctx, ['flutter_secure_storage']);
+    const secureStorageNative = [
+        ...(0, detectContext_1.hasAnyGradleDep)(ctx, SECURE_STORAGE_GRADLE),
+        ...(0, detectContext_1.hasAnySwiftDep)(ctx, SECURE_STORAGE_SWIFT),
+    ];
     const keychainInSource = await (0, textSearch_1.searchInFiles)(ctx.root, ctx.files.source, [/KeychainAccess/, /kSecClass/, /EncryptedSharedPreferences/, /AndroidKeyStore/, /SecItemAdd/], 3);
     const credentialEvidence = [
-        ...[...secureStorage, ...secureStorageDart].map((dep) => ({ type: 'dependency', value: dep })),
+        ...[...secureStorage, ...secureStorageDart, ...secureStorageNative].map((dep) => ({
+            type: 'dependency',
+            value: dep,
+        })),
         ...keychainInSource.map((match) => ({
             type: 'snippet',
             value: match.snippet,
@@ -170,7 +206,12 @@ async function detectMobile(ctx) {
             line: match.line,
         })),
     ];
-    const offlineDeps = [...(0, detectContext_1.hasAnyDep)(ctx, OFFLINE_DEPS), ...(0, detectContext_1.hasAnyDartDep)(ctx, OFFLINE_DEPS)];
+    const offlineDeps = [
+        ...(0, detectContext_1.hasAnyDep)(ctx, OFFLINE_DEPS),
+        ...(0, detectContext_1.hasAnyDartDep)(ctx, OFFLINE_DEPS),
+        ...(0, detectContext_1.hasAnyGradleDep)(ctx, OFFLINE_GRADLE),
+        ...(0, detectContext_1.hasAnySwiftDep)(ctx, OFFLINE_SWIFT),
+    ];
     /**
      * A local database is the strong signal; knowing the network dropped is the weak
      * one. Both are recorded, because an app that stores nothing but tells the user the

package/dist/analyzer/detectStack.js

@@ -3,18 +3,15 @@ Object.defineProperty(exports, "__esModule", { value: true });
 exports.deriveLanguages = deriveLanguages;
 exports.buildStackInfo = buildStackInfo;
 exports.mergeDetectors = mergeDetectors;
+const catalogue_1 = require("./catalogue");
 function unique(items) {
     return Array.from(new Set(items));
 }
 function deriveLanguages(files) {
-    const out = [];
-    if (files.some((f) => /\.(ts|tsx)$/.test(f)))
-        out.push('typescript');
-    if (files.some((f) => /\.(js|jsx|mjs|cjs)$/.test(f)))
-        out.push('javascript');
-    if (files.some((f) => /\.py$/.test(f)))
-        out.push('python');
-    return unique(out);
+    // Read from the catalogue rather than from three hand-written lines. It knew about
+    // TypeScript, JavaScript and Python only, so a Go service reported no languages at
+    // all while the README listed twelve.
+    return unique(catalogue_1.LANGUAGES.filter(({ extensions }) => files.some((file) => extensions.test(file))).map(({ id }) => id));
 }
 function buildStackInfo(input) {
     return {

package/dist/report/buildReport.js

@@ -108,14 +108,21 @@ function buildReport(analysis, options) {
     const combinedScore = expectationScore === undefined
         ? observedScore
         : Math.max(0, Math.min(100, Math.round((observedScore * 0.6) + (expectationScore * 0.4))));
+    // A recognised mobile platform counts as a stack signal. Without this an Android
+    // project with an AndroidManifest.xml and a build.gradle was reported as
+    // "inconclusive — no package manifests found", which is the analyzer saying it
+    // understood nothing about a project it had in fact identified, and capping the score
+    // at 39 on that basis.
+    const mobileDetected = analysis.detectors['mobile.platform']?.present === true;
     const stackDetected = analysis.stack.frontend.length > 0
         || analysis.stack.backend.length > 0
-        || analysis.stack.databases.length > 0;
+        || analysis.stack.databases.length > 0
+        || mobileDetected;
     const inconclusive = !stackDetected && analysis.workspaceStacks.length === 0;
     const inconclusiveReasons = [];
     if (inconclusive) {
         inconclusiveReasons.push('No frontend, backend, or database stack signals were detected.');
-        inconclusiveReasons.push('No package manifests (package.json, requirements.txt, pyproject.toml) were found.');
+        inconclusiveReasons.push('No package manifest was found in any format this analyzer reads.');
         if (analysis.files.source.length === 0) {
             inconclusiveReasons.push('No recognizable source files were found.');
         }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@produtype/core",
-  "version": "0.3.2",
+  "version": "0.4.0",
   "description": "Deterministic CLI and library that analyzes a web application repository and reports how far it is from production-ready for the kind of product it is meant to be.",
   "license": "MIT",
   "bin": {