@produtype/core 0.31.0 → 0.32.0

package/dist/analyzer/detectPackaging.d.ts

@@ -1,3 +1,13 @@
 import type { DetectorResult } from './types';
 import type { DetectContext } from './detectContext';
+/**
+ * Where a documentation site lives when it has no generator of its own.
+ *
+ * A hand-built docs site or a playground sits in a directory named for what it is. This
+ * is only consulted for the front-end files: a `docs/` folder full of Markdown says
+ * nothing either way, and a repository whose application happens to live under `www/`
+ * is not caught because the question asked is whether *every* front-end file is in one
+ * of these.
+ */
+export declare const DOCS_DIRECTORIES: RegExp;
 export declare function detectPackaging(ctx: DetectContext): Promise<DetectorResult[]>;

package/dist/analyzer/detectPackaging.js

@@ -1,8 +1,10 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
+exports.DOCS_DIRECTORIES = void 0;
 exports.detectPackaging = detectPackaging;
 const readTextFileSafe_1 = require("../utils/readTextFileSafe");
 const detectContext_1 = require("./detectContext");
+const readTextFileSafe_2 = require("../utils/readTextFileSafe");
 /**
  * Whether a project is fit to be installed and depended on by someone else.
  *
@@ -55,8 +57,29 @@ const DOCS_GENERATORS = [
  * is not caught because the question asked is whether *every* front-end file is in one
  * of these.
  */
-const DOCS_DIRECTORIES = /^(docs?|website|playground|examples?|demo|www)\//i;
+exports.DOCS_DIRECTORIES = /(^|\/)(docs?|website|playground|examples?|demo|www)\//i;
 const FRONTEND_FILE = /\.(tsx|jsx|vue|svelte|astro)$/;
+/**
+ * The published package inside a workspace, if there is one.
+ *
+ * Named, versioned, not private — the three things npm requires to accept a publish.
+ * A workspace full of private example applications has none, and gets the honest answer
+ * that nothing here is published.
+ */
+async function findPublishedMember(ctx) {
+    const members = ctx.files.all
+        .filter((file) => /(^|\/)package\.json$/.test(file) && file !== 'package.json')
+        .slice(0, 60);
+    for (const file of members) {
+        const manifest = await (0, readTextFileSafe_2.readJsonSafe)(ctx.root, file);
+        if (!manifest)
+            continue;
+        const named = typeof manifest.name === 'string' && typeof manifest.version === 'string';
+        if (named && manifest.private !== true)
+            return { path: file, manifest };
+    }
+    return null;
+}
 async function detectPackaging(ctx) {
     const all = ctx.files.all;
     /**
@@ -71,7 +94,7 @@ async function detectPackaging(ctx) {
     const docsGenerators = [...(0, detectContext_1.hasAnyDep)(ctx, DOCS_GENERATORS), ...(0, detectContext_1.hasAnyPyDep)(ctx, DOCS_GENERATORS)];
     const frontendFiles = ctx.files.source.filter((file) => FRONTEND_FILE.test(file));
     const frontendAllInDocs = frontendFiles.length > 0
-        && frontendFiles.every((file) => DOCS_DIRECTORIES.test(file));
+        && frontendFiles.every((file) => exports.DOCS_DIRECTORIES.test(file));
     const documentationSite = docsGenerators.length > 0 || frontendAllInDocs;
     const licenseFiles = collect(all, LICENSE_FILE);
     const declaredLicense = typeof ctx.packageJson?.license === 'string';
@@ -111,7 +134,33 @@ async function detectPackaging(ctx) {
      * it starts; `types` is how a TypeScript consumer finds it. A Python package says the
      * same thing through `[project.scripts]` or a `packages` argument in setup.py.
      */
-    const pkg = (ctx.packageJson ?? {});
+    const rootPkg = (ctx.packageJson ?? {});
+    /**
+     * In a monorepo the root manifest is not the package.
+     *
+     * zod's root is `private: true` with `workspaces: ["packages/*"]`, no name, no version
+     * and no entry point; `zod` itself is `packages/zod/package.json`, named, versioned
+     * and exported. Reading only the root made the most downloaded validation library on
+     * npm a repository that publishes nothing — and vite the same.
+     *
+     * The published package is looked for among the members, and the first one that is
+     * named, versioned and not private is what this repository ships. Its manifest is
+     * what the evidence points at, so a reader can open the file the claim rests on rather
+     * than a root that says nothing.
+     */
+    /**
+     * Three ways to say the same thing.
+     *
+     * npm and yarn declare workspaces inside `package.json`; pnpm puts them in
+     * `pnpm-workspace.yaml`. Reading only the first meant vite — whose root has no
+     * `workspaces` field at all — was never looked into, and came back as a repository
+     * that publishes nothing.
+     */
+    const workspaceRoot = Array.isArray(rootPkg.workspaces)
+        || (typeof rootPkg.workspaces === 'object' && rootPkg.workspaces !== null)
+        || all.some((file) => /^(pnpm-workspace\.yaml|lerna\.json|nx\.json|turbo\.json)$/.test(file));
+    const publishedMember = workspaceRoot ? await findPublishedMember(ctx) : null;
+    const pkg = publishedMember?.manifest ?? rootPkg;
     const nodeEntrypoints = ['main', 'module', 'exports', 'bin'].filter((key) => pkg[key] !== undefined);
     const hasTypes = pkg.types !== undefined || pkg.typings !== undefined;
     const isPrivate = pkg.private === true;
@@ -137,7 +186,13 @@ async function detectPackaging(ctx) {
             key: 'packaging.manifest',
             present: hasManifest,
             complete: hasManifest && (named || pythonEntrypoints),
-            evidence: hasManifest ? [{ type: 'note', value: named ? 'a manifest with a name and a version' : 'a package manifest' }] : [],
+            evidence: hasManifest
+                ? [
+                    publishedMember
+                        ? { type: 'file', value: `${publishedMember.path} names and versions the published package`, file: publishedMember.path }
+                        : { type: 'note', value: named ? 'a manifest with a name and a version' : 'a package manifest' },
+                ]
+                : [],
             details: { named, described, sourced, private: isPrivate },
         },
         {

package/dist/expectations/profileSignals.d.ts

@@ -57,6 +57,14 @@ export interface ProfileFacts {
      * the product.
      */
     documentationSite: boolean;
+    /**
+     * A server the product ships, as distinct from one its documentation or playgrounds run.
+     *
+     * zod's only workspace with a backend is `packages/docs`. vite's are ten directories
+     * under `playground/`. Both were excluded from the `library` profile by a backend
+     * neither of them ships.
+     */
+    productBackend: boolean;
     /** Somewhere for a consumer to import: main, module, exports, bin, a console script. */
     entrypoints: boolean;
     packagedLicense: boolean;

package/dist/expectations/profileSignals.js

@@ -2,6 +2,25 @@
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.readFacts = readFacts;
 exports.scoreProfiles = scoreProfiles;
+const detectPackaging_1 = require("../analyzer/detectPackaging");
+/**
+ * Whether any backend in this repository belongs to the product.
+ *
+ * A workspace under `docs/`, `playground/` or `examples/` that runs a server is running
+ * it to demonstrate or test something. vite has ten such workspaces, every one of them
+ * an Express server, and none of them vite.
+ *
+ * Where no workspace declares a backend but the repository does, the signal came from
+ * the root and belongs to the product: there is nowhere else for it to come from.
+ */
+function hasProductBackend(analysis) {
+    if (analysis.stack.backend.length === 0)
+        return false;
+    const withBackend = analysis.workspaceStacks.filter((workspace) => workspace.backend.length > 0);
+    if (withBackend.length === 0)
+        return true;
+    return withBackend.some((workspace) => !detectPackaging_1.DOCS_DIRECTORIES.test(`${workspace.root}/`));
+}
 function readFacts(analysis) {
     const sourceHints = analysis.files.source.join('\n');
     const present = (key) => analysis.detectors[key]?.present === true;
@@ -29,6 +48,7 @@ function readFacts(analysis) {
         gameEngine: present('game.engine'),
         publishable: complete('packaging.manifest'),
         documentationSite: present('docs.site'),
+        productBackend: hasProductBackend(analysis),
         entrypoints: present('packaging.entrypoints'),
         packagedLicense: present('packaging.license'),
         tests: present('quality.tests'),
@@ -195,7 +215,7 @@ const RULES = [
         admissible: (f) => f.publishable
             && f.entrypoints
             && (!f.frontend || f.documentationSite)
-            && !f.backend
+            && !f.productBackend
             && f.mobilePlatforms.length === 0,
         signals: [
             { identifies: true, label: 'a manifest that names and versions it', weight: 3, holds: (f) => f.publishable },

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@produtype/core",
-  "version": "0.31.0",
+  "version": "0.32.0",
   "description": "Deterministic CLI and library that analyzes a web application repository and reports how far it is from production-ready for the kind of product it is meant to be.",
   "license": "MIT",
   "bin": {