@produtype/core 0.32.0 → 0.34.0

package/README.md

@@ -174,7 +174,7 @@ prodkit plan ../my-app --output prodkit-plan.md
 
 _Generated from the analyzer itself — run `npm run docs:stacks` after changing a detector._
 
-- **Backend:** Express, Next.js, NestJS, Fastify, Hono, Elysia, Koa, AdonisJS, SvelteKit, Remix, Nuxt, Nitro, Astro, Django, Flask, FastAPI, Litestar, Sanic, Tornado, aiohttp, Starlette, Streamlit, Gradio, Dash, Chainlit, Gin, Echo, Fiber, chi, Gorilla, Beego, Go, Rails, Sinatra, Hanami, Roda, Grape, Ruby, Laravel, Symfony, Slim, CodeIgniter, CakePHP, Yii, PHP, ASP.NET Core, .NET
+- **Backend:** Express, Next.js, NestJS, Fastify, Hono, Elysia, Koa, AdonisJS, SvelteKit, Remix, Nuxt, Nitro, Astro, Django, Flask, FastAPI, aiohttp, Litestar, Sanic, Tornado, Starlette, Streamlit, Gradio, Dash, Chainlit, Gin, Echo, Fiber, chi, Gorilla, Beego, Go, Rails, Sinatra, Hanami, Roda, Grape, Ruby, Laravel, Symfony, Slim, CodeIgniter, CakePHP, Yii, PHP, ASP.NET Core, .NET
 - **Frontend:** React, Vite, Vue, Nuxt, Svelte, Angular, Astro, Solid, Qwik, Preact, Remix, htmx, Tailwind CSS, Electron
 - **Mobile:** Flutter, React Native, iOS (native), Android (native)
 - **Databases:** Postgres, MySQL, SQLite, SQL Server, MongoDB, Redis, Firestore, DynamoDB, Convex
@@ -188,6 +188,7 @@ How some of these are decided:
 - **Django** — manage.py, settings.py and urls.py together
 - **Flask** — the dependency, or an import in the source
 - **FastAPI** — the dependency, or an import in the source
+- **aiohttp** — aiohttp.web in the source — the dependency alone is a client
 - **Go** — a go.mod with no framework in it — net/http is a real answer
 - **Ruby** — a Gemfile with no web framework in it
 - **PHP** — PHP sources with no framework in composer.json

package/dist/analyzer/analyzeProject.js

@@ -87,7 +87,24 @@ function parseRequirements(text) {
 function normalizePyDepSpec(spec) {
     return spec.split(/[\s<>=!~;[(]/)[0].trim().toLowerCase();
 }
+/**
+ * What a Python package installs by default, and what it merely offers.
+ *
+ * `[project.optional-dependencies]` and `[dependency-groups]` are extras: a library that
+ * integrates with FastAPI declares it there, and nobody installing the library gets a
+ * web server. langchain and llama_index declare four web frameworks between them that
+ * way, and were read as web applications — costing langchain the `library` profile and
+ * earning it fifteen high findings about GDPR, billing and tenant isolation.
+ *
+ * Mirrors what `dependencies` and `devDependencies` already do for npm.
+ */
+function parsePyprojectRuntime(text) {
+    return parsePyprojectSections(text, true);
+}
 function parsePyproject(text) {
+    return parsePyprojectSections(text, false);
+}
+function parsePyprojectSections(text, runtimeOnly) {
     if (!text)
         return [];
     const deps = [];
@@ -105,8 +122,8 @@ function parsePyproject(text) {
         }
         // Poetry-style tables: each key of the section is a dependency name.
         const isPoetryDepsSection = section === 'tool.poetry.dependencies'
-            || section === 'tool.poetry.dev-dependencies'
-            || /^tool\.poetry\.group\.[^.]+\.dependencies$/.test(section);
+            || (!runtimeOnly && (section === 'tool.poetry.dev-dependencies'
+                || /^tool\.poetry\.group\.[^.]+\.dependencies$/.test(section)));
         if (isPoetryDepsSection) {
             const match = line.match(/^([A-Za-z0-9_.-]+)\s*=/);
             if (match && match[1].toLowerCase() !== 'python')
@@ -114,9 +131,10 @@ function parsePyproject(text) {
             continue;
         }
         // PEP 621 / uv style: dependency specs live inside string arrays.
-        const isDepArraySection = section === 'project.optional-dependencies'
-            || section === 'dependency-groups'
-            || section === 'tool.uv';
+        const isDepArraySection = !runtimeOnly
+            && (section === 'project.optional-dependencies'
+                || section === 'dependency-groups'
+                || section === 'tool.uv');
         if (section === 'project' || isDepArraySection || inDependencyArray) {
             if (line.includes('include-group'))
                 continue;
@@ -142,7 +160,10 @@ function isTestOrExamplePath(file) {
     // `__mocks__` was missing, and a mock is the most misleading file in a repository:
     // `application_fee_percent: null` inside a Stripe fixture made an open-source CRM read
     // as a marketplace taking a cut. A field set to null is evidence of absence.
-    return /(^|\/)(__tests__|__mocks__|mocks?|tests?|test-data|fixtures|frontend-example)(\/|$)/i.test(file)
+    // `fixtures` was listed and `fixture` was not, so `extra/fixture/authsources.php`
+    // made PHP one of the languages of an Elixir analytics product — and of cal.com,
+    // which is TypeScript.
+    return /(^|\/)(__tests__|__mocks__|mocks?|tests?|test-data|fixtures?|frontend-example)(\/|$)/i.test(file)
         || /(^|\/)test[-_][^/]+\.(ts|tsx|js|jsx|mjs|cjs|py)$/i.test(file)
         /**
          * The other half of the convention.
@@ -366,10 +387,16 @@ async function analyzeProject(projectPath) {
             requirementsDeps: parseRequirements(reqText),
             pyprojectPath: pyprojectFiles.includes(pyprojectPath) ? pyprojectPath : undefined,
             pyprojectDeps: parsePyproject(pyprojectText),
+            pyprojectRuntimeDeps: parsePyprojectRuntime(pyprojectText),
             lockfiles: wsLockfiles,
         });
     }
     const pythonDeps = unique(workspaces.flatMap((w) => [...w.requirementsDeps, ...w.pyprojectDeps]));
+    /**
+     * `requirements.txt` has no notion of an extra, so everything in it counts as shipped.
+     * Only pyproject distinguishes the two.
+     */
+    const runtimePythonDeps = unique(workspaces.flatMap((w) => [...w.requirementsDeps, ...w.pyprojectRuntimeDeps]));
     /**
      * Composer requirements. A published PHP application in the corpus reported a
      * backend of "unknown" because nothing read this file, while 57 source files sat
@@ -577,6 +604,14 @@ async function analyzeProject(projectPath) {
         const imported = await (0, importedDependencies_1.pythonImports)(root, sourceFiles);
         if (imported.length > 0) {
             pythonDeps.push(...imported);
+            /**
+             * An import is use, not an offer.
+             *
+             * These count as shipped as well as present. A repository with no manifest at all
+             * — one `main.py` that imports streamlit — declares nothing optional, and treating
+             * its imports as extras made a Streamlit application unreadable.
+             */
+            runtimePythonDeps.push(...imported);
             inferredDependencySources.push('Python imports');
         }
     }
@@ -610,6 +645,7 @@ async function analyzeProject(projectPath) {
         root,
         files: { all: allFiles, source: sourceFiles, config: configFiles, unreadable: unreadableLanguages(allFiles) },
         runtimeNpmDeps,
+        runtimePythonDeps,
         packageJson,
         pythonDeps,
         phpDeps: unique(phpDeps),
@@ -711,7 +747,16 @@ async function analyzeProject(projectPath) {
                     : []),
             ],
             workspaces: workspaceStacks,
-            files: allFiles,
+            /**
+             * The files this reading actually covers, not every file on disk.
+             *
+             * Built from `allFiles`, a single `extra/fixture/authsources.php` made PHP one of
+             * the languages of an Elixir analytics product and of cal.com, which is
+             * TypeScript. The languages a report names should be the ones it read; test
+             * fixtures and generated output are excluded from the reading and belong out of
+             * this list for the same reason.
+             */
+            files: sourceFiles,
         }),
         packageJson,
         pythonDeps,

package/dist/analyzer/catalogue.js

@@ -69,7 +69,6 @@ exports.PYTHON_BACKEND_FRAMEWORKS = [
     ['litestar', 'litestar'],
     ['sanic', 'sanic'],
     ['tornado', 'tornado'],
-    ['aiohttp', 'aiohttp'],
     ['starlette', 'starlette'],
     /**
      * These serve an application over HTTP without calling themselves web frameworks,
@@ -248,6 +247,16 @@ function supportedStacks() {
             { id: 'django', label: 'Django', detectedFrom: 'manage.py, settings.py and urls.py together' },
             { id: 'flask', label: 'Flask', detectedFrom: 'the dependency, or an import in the source' },
             { id: 'fastapi', label: 'FastAPI', detectedFrom: 'the dependency, or an import in the source' },
+            {
+                id: 'aiohttp',
+                label: 'aiohttp',
+                /**
+                 * Listed separately because the dependency alone does not settle it: aiohttp is
+                 * a client as often as a server, and thousands of packages depend on it to make
+                 * requests. `aiohttp.web` is what says it is being served.
+                 */
+                detectedFrom: 'aiohttp.web in the source — the dependency alone is a client',
+            },
             ...entries(exports.PYTHON_BACKEND_FRAMEWORKS.map(([id]) => id)),
             ...entries(exports.GO_BACKEND_FRAMEWORKS.map(([id]) => id)),
             { id: 'go', label: 'Go', detectedFrom: 'a go.mod with no framework in it — net/http is a real answer' },

package/dist/analyzer/detectAuth.js

@@ -230,8 +230,29 @@ async function detectAuth(ctx) {
      * `const teamId = 'W7LPPWA48L'` in its notarization script.
      */
     const STRONG_TENANCY = [/organizationId/i, /organization_id/i, /tenantId/i, /tenant_id/i];
-    const WEAK_TENANCY = [/workspaceId/i, /workspace_id/i, /companyId/i];
-    const strongOrganization = await (0, textSearch_1.searchInFiles)(ctx.root, sourceFiles, STRONG_TENANCY, 25);
+    const WEAK_TENANCY = [/workspaceId/i, /workspace_id/i, /companyId/i, /teamId/i, /team_id/i];
+    /**
+     * A team that has members is an account.
+     *
+     * "Team" is the third word products use for a tenant, after organization and
+     * workspace — and unlike those two it also means a team: a sports application has
+     * teams and no tenants. Documenso is the case that made it matter: `teamId` in three
+     * hundred and eighty-eight files, `TeamMember` in seventy-nine, `organizationId` in
+     * none, and no tenancy detected at all.
+     *
+     * The pairing is what disambiguates. A membership table beside the team turns a
+     * domain entity into an account boundary, which is the same reasoning the detector
+     * already applies to weak words: never on its own, always with something that means
+     * only one thing.
+     */
+    const teamMembership = await (0, textSearch_1.searchInFiles)(ctx.root, sourceFiles, [/teamMember/i, /team_member/i, /teamMembership/i], 10);
+    const teamAsTenant = teamMembership.length > 0
+        ? await (0, textSearch_1.searchInFiles)(ctx.root, sourceFiles, [/teamId/i, /team_id/i], 25)
+        : [];
+    const strongOrganization = [
+        ...(await (0, textSearch_1.searchInFiles)(ctx.root, sourceFiles, STRONG_TENANCY, 25)),
+        ...teamAsTenant,
+    ];
     const weakOrganization = await (0, textSearch_1.searchInFiles)(ctx.root, sourceFiles, WEAK_TENANCY, 25);
     // A weak word never stands on its own, however many files it appears in. Bruno says
     // `workspaceId` in three — it has workspaces, and they are local folders, not
@@ -248,7 +269,10 @@ async function detectAuth(ctx) {
      * already states the principle: a weak word never stands on its own, however many
      * files it appears in.
      */
-    const strongMembership = await (0, textSearch_1.searchInFiles)(ctx.root, sourceFiles, STRONG_TENANCY, 25);
+    const strongMembership = [
+        ...(await (0, textSearch_1.searchInFiles)(ctx.root, sourceFiles, STRONG_TENANCY, 25)),
+        ...teamAsTenant,
+    ];
     const weakMembership = await (0, textSearch_1.searchInFiles)(ctx.root, sourceFiles, [/memberId/i, ...WEAK_TENANCY], 25);
     const membershipSignals = strongMembership.length > 0 ? [...strongMembership, ...weakMembership] : [];
     const b2bSignals = await (0, textSearch_1.searchInFiles)(ctx.root, sourceFiles, [

package/dist/analyzer/detectBackend.js

@@ -150,14 +150,40 @@ async function detectBackend(ctx) {
     }
     // Python backend frameworks detected purely from dependencies. Django, Flask and
     // FastAPI have their own blocks below because each also has a source-level fallback.
+    /**
+     * Shipped, not offered as an extra — the Python half of the same rule.
+     *
+     * llama_index declares tornado, starlette, flask and fastapi among its optional
+     * integrations, and was read as running all four.
+     */
     for (const [framework, dep] of catalogue_1.PYTHON_BACKEND_FRAMEWORKS) {
-        if ((0, detectContext_1.hasPyDep)(ctx, dep)) {
+        if ((0, detectContext_1.hasRuntimePyDep)(ctx, dep)) {
             frameworks.push(framework);
             evidence.push({ type: 'dependency', value: dep });
         }
     }
+    /**
+     * aiohttp is a client as often as it is a server.
+     *
+     * Thousands of packages depend on it to make HTTP requests; langchain is one, and was
+     * read as having a backend because of it — which cost it the `library` profile and
+     * earned it fifteen high findings about GDPR, billing and tenant isolation. The
+     * dependency says the library is present. Only `aiohttp.web` says it is being served.
+     *
+     * The source alone is enough, as elsewhere: a project that serves without declaring
+     * the dependency is still serving.
+     */
+    if ((0, detectContext_1.hasRuntimePyDep)(ctx, 'aiohttp')) {
+        const serving = await (0, textSearch_1.searchInFiles)(ctx.root, ctx.files.source.filter((file) => /\.py$/.test(file)), [/aiohttp\.web/, /web\.Application\(/, /web\.RouteTableDef/, /from aiohttp import web/], 3);
+        if (serving.length) {
+            frameworks.push('aiohttp');
+            for (const match of serving) {
+                evidence.push({ type: 'snippet', value: match.snippet, file: match.file, line: match.line });
+            }
+        }
+    }
     // Flask
-    if ((0, detectContext_1.hasPyDep)(ctx, 'flask')) {
+    if ((0, detectContext_1.hasRuntimePyDep)(ctx, 'flask')) {
         frameworks.push('flask');
         evidence.push({ type: 'dependency', value: 'flask' });
     }
@@ -171,7 +197,7 @@ async function detectBackend(ctx) {
         }
     }
     // FastAPI
-    if ((0, detectContext_1.hasPyDep)(ctx, 'fastapi')) {
+    if ((0, detectContext_1.hasRuntimePyDep)(ctx, 'fastapi')) {
         frameworks.push('fastapi');
         evidence.push({ type: 'dependency', value: 'fastapi' });
     }
@@ -192,7 +218,7 @@ async function detectBackend(ctx) {
     const settingsFile = ctx.files.all.find((f) => f.endsWith('settings.py'));
     if (settingsFile)
         djangoSignals.push({ type: 'file', value: settingsFile });
-    if ((0, detectContext_1.hasPyDep)(ctx, 'django'))
+    if ((0, detectContext_1.hasRuntimePyDep)(ctx, 'django'))
         djangoSignals.push({ type: 'dependency', value: 'django' });
     if (ctx.files.all.some((f) => f.endsWith('urls.py'))) {
         djangoSignals.push({ type: 'file', value: ctx.files.all.find((f) => f.endsWith('urls.py')) });

package/dist/analyzer/detectContext.d.ts

@@ -7,6 +7,8 @@ export interface WorkspaceManifest {
     requirementsDeps: string[];
     pyprojectPath?: string;
     pyprojectDeps: string[];
+    /** Of those, the ones installed by default rather than offered as an extra. */
+    pyprojectRuntimeDeps: string[];
     lockfiles: string[];
 }
 export interface DetectContext {
@@ -47,6 +49,14 @@ export interface DetectContext {
      * a backend, which kept it out of the `library` profile it plainly belongs to.
      */
     runtimeNpmDeps: Record<string, string>;
+    /**
+     * Python packages installed by default, without the extras.
+     *
+     * A library that integrates with FastAPI declares it under
+     * `[project.optional-dependencies]`, and nobody installing the library gets a web
+     * server. Used for the same single question as `runtimeNpmDeps`.
+     */
+    runtimePythonDeps: string[];
     workspaces: WorkspaceManifest[];
 }
 export declare function hasDep(ctx: DetectContext, name: string): boolean;
@@ -57,6 +67,8 @@ export declare function hasDep(ctx: DetectContext, name: string): boolean;
  * question "does this repository serve requests" is answered by what it ships.
  */
 export declare function hasRuntimeDep(ctx: DetectContext, name: string): boolean;
+/** The Python counterpart: shipped, not merely offered as an extra. */
+export declare function hasRuntimePyDep(ctx: DetectContext, name: string): boolean;
 export declare function hasAnyDep(ctx: DetectContext, names: string[]): string[];
 export declare function hasPyDep(ctx: DetectContext, name: string): boolean;
 export declare function hasAnyPyDep(ctx: DetectContext, names: string[]): string[];

package/dist/analyzer/detectContext.js

@@ -2,6 +2,7 @@
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.hasDep = hasDep;
 exports.hasRuntimeDep = hasRuntimeDep;
+exports.hasRuntimePyDep = hasRuntimePyDep;
 exports.hasAnyDep = hasAnyDep;
 exports.hasPyDep = hasPyDep;
 exports.hasAnyPyDep = hasAnyPyDep;
@@ -25,6 +26,10 @@ function hasDep(ctx, name) {
 function hasRuntimeDep(ctx, name) {
     return Object.prototype.hasOwnProperty.call(ctx.runtimeNpmDeps, name.toLowerCase());
 }
+/** The Python counterpart: shipped, not merely offered as an extra. */
+function hasRuntimePyDep(ctx, name) {
+    return ctx.runtimePythonDeps.includes(name.toLowerCase());
+}
 function hasAnyDep(ctx, names) {
     return names.filter((n) => hasDep(ctx, n));
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@produtype/core",
-  "version": "0.32.0",
+  "version": "0.34.0",
   "description": "Deterministic CLI and library that analyzes a web application repository and reports how far it is from production-ready for the kind of product it is meant to be.",
   "license": "MIT",
   "bin": {