@produtype/core 0.33.1 → 0.35.0

package/dist/analyzer/analyzeProject.js

@@ -160,7 +160,10 @@ function isTestOrExamplePath(file) {
     // `__mocks__` was missing, and a mock is the most misleading file in a repository:
     // `application_fee_percent: null` inside a Stripe fixture made an open-source CRM read
     // as a marketplace taking a cut. A field set to null is evidence of absence.
-    return /(^|\/)(__tests__|__mocks__|mocks?|tests?|test-data|fixtures|frontend-example)(\/|$)/i.test(file)
+    // `fixtures` was listed and `fixture` was not, so `extra/fixture/authsources.php`
+    // made PHP one of the languages of an Elixir analytics product — and of cal.com,
+    // which is TypeScript.
+    return /(^|\/)(__tests__|__mocks__|mocks?|tests?|test-data|fixtures?|frontend-example)(\/|$)/i.test(file)
         || /(^|\/)test[-_][^/]+\.(ts|tsx|js|jsx|mjs|cjs|py)$/i.test(file)
         /**
          * The other half of the convention.
@@ -744,7 +747,16 @@ async function analyzeProject(projectPath) {
                     : []),
             ],
             workspaces: workspaceStacks,
-            files: allFiles,
+            /**
+             * The files this reading actually covers, not every file on disk.
+             *
+             * Built from `allFiles`, a single `extra/fixture/authsources.php` made PHP one of
+             * the languages of an Elixir analytics product and of cal.com, which is
+             * TypeScript. The languages a report names should be the ones it read; test
+             * fixtures and generated output are excluded from the reading and belong out of
+             * this list for the same reason.
+             */
+            files: sourceFiles,
         }),
         packageJson,
         pythonDeps,

package/dist/analyzer/detectAuth.js

@@ -230,8 +230,29 @@ async function detectAuth(ctx) {
      * `const teamId = 'W7LPPWA48L'` in its notarization script.
      */
     const STRONG_TENANCY = [/organizationId/i, /organization_id/i, /tenantId/i, /tenant_id/i];
-    const WEAK_TENANCY = [/workspaceId/i, /workspace_id/i, /companyId/i];
-    const strongOrganization = await (0, textSearch_1.searchInFiles)(ctx.root, sourceFiles, STRONG_TENANCY, 25);
+    const WEAK_TENANCY = [/workspaceId/i, /workspace_id/i, /companyId/i, /teamId/i, /team_id/i];
+    /**
+     * A team that has members is an account.
+     *
+     * "Team" is the third word products use for a tenant, after organization and
+     * workspace — and unlike those two it also means a team: a sports application has
+     * teams and no tenants. Documenso is the case that made it matter: `teamId` in three
+     * hundred and eighty-eight files, `TeamMember` in seventy-nine, `organizationId` in
+     * none, and no tenancy detected at all.
+     *
+     * The pairing is what disambiguates. A membership table beside the team turns a
+     * domain entity into an account boundary, which is the same reasoning the detector
+     * already applies to weak words: never on its own, always with something that means
+     * only one thing.
+     */
+    const teamMembership = await (0, textSearch_1.searchInFiles)(ctx.root, sourceFiles, [/teamMember/i, /team_member/i, /teamMembership/i], 10);
+    const teamAsTenant = teamMembership.length > 0
+        ? await (0, textSearch_1.searchInFiles)(ctx.root, sourceFiles, [/teamId/i, /team_id/i], 25)
+        : [];
+    const strongOrganization = [
+        ...(await (0, textSearch_1.searchInFiles)(ctx.root, sourceFiles, STRONG_TENANCY, 25)),
+        ...teamAsTenant,
+    ];
     const weakOrganization = await (0, textSearch_1.searchInFiles)(ctx.root, sourceFiles, WEAK_TENANCY, 25);
     // A weak word never stands on its own, however many files it appears in. Bruno says
     // `workspaceId` in three — it has workspaces, and they are local folders, not
@@ -248,7 +269,10 @@ async function detectAuth(ctx) {
      * already states the principle: a weak word never stands on its own, however many
      * files it appears in.
      */
-    const strongMembership = await (0, textSearch_1.searchInFiles)(ctx.root, sourceFiles, STRONG_TENANCY, 25);
+    const strongMembership = [
+        ...(await (0, textSearch_1.searchInFiles)(ctx.root, sourceFiles, STRONG_TENANCY, 25)),
+        ...teamAsTenant,
+    ];
     const weakMembership = await (0, textSearch_1.searchInFiles)(ctx.root, sourceFiles, [/memberId/i, ...WEAK_TENANCY], 25);
     const membershipSignals = strongMembership.length > 0 ? [...strongMembership, ...weakMembership] : [];
     const b2bSignals = await (0, textSearch_1.searchInFiles)(ctx.root, sourceFiles, [

package/dist/expectations/productProfiles.js

@@ -692,8 +692,25 @@ exports.productProfiles = {
     }),
     'ai-saas': defineProfile({
         id: 'ai-saas',
-        title: 'AI SaaS',
-        description: 'AI-powered SaaS with async workloads, upload safety, cost exposure and high observability needs.',
+        /**
+         * Named for what the evidence shows, not for what the product is about.
+         *
+         * The signal is a model SDK in the dependencies. That shows a product calls a model;
+         * it does not show that AI is what the product is. Supabase, Mattermost and PostHog
+         * all came back "AI SaaS" — a backend platform, a chat server and an analytics
+         * product, each with one assistant feature somewhere inside it.
+         *
+         * Counting was tried first and settles nothing: dify, a genuine AI platform, touches
+         * a model in 1.2% of its files and supabase in 1.2% too, while PostHog's 1.9% is
+         * higher than both. There is no proportion that separates them.
+         *
+         * What the profile *does* is right either way — it is B2B SaaS plus background
+         * jobs, cost control and prompt safety, and a product with one assistant feature
+         * owes all three for that feature. So the expectations stay and the title stops
+         * claiming more than the dependency proves.
+         */
+        title: 'SaaS that calls a model',
+        description: 'A hosted product that calls a language model somewhere in it: everything a B2B SaaS owes, plus the duties that come with sending somebody else\'s input to a model — a ceiling on what a request can spend, and treating what the model reads as untrusted.',
         importance: {
             'auth.baseline': 'required',
             'auth.mfa': 'recommended',

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@produtype/core",
-  "version": "0.33.1",
+  "version": "0.35.0",
   "description": "Deterministic CLI and library that analyzes a web application repository and reports how far it is from production-ready for the kind of product it is meant to be.",
   "license": "MIT",
   "bin": {