@produtype/core 0.37.0 → 0.38.0

package/dist/report/buildReport.js

@@ -14,6 +14,7 @@ const evidenceDigest_1 = require("./evidenceDigest");
 const complianceMapping_1 = require("./complianceMapping");
 const executiveSummary_1 = require("./executiveSummary");
 const remediationCatalog_1 = require("../planner/remediationCatalog");
+const detectPackaging_1 = require("../analyzer/detectPackaging");
 // Derived from the union in report/types.ts, so a new category cannot be missed here.
 function bySeverityPriority(f) {
     const order = {
@@ -50,6 +51,27 @@ function determineExpectationMode(requestedProfile, productProfile, expectationS
     }
     return 'explicit-profile';
 }
+/**
+ * A finding whose every citation is in the documentation site or a playground.
+ *
+ * Medusa was told its CORS policy was open, evidenced from `www/apps/cloud/`, and that
+ * its Stripe webhook handling was unverified, evidenced from the documentation's
+ * `sidebar.mjs` — the navigation menu that lists a page about webhooks. Vite keeps ten
+ * Express servers under `playground/` for the same kind of reason.
+ *
+ * These are not false matches: the lines are there. They are matches about something
+ * other than the product, and a report that cannot tell the two apart tells its reader
+ * to go and fix a documentation site.
+ *
+ * Only where the repository has source outside those directories. A documentation site
+ * that *is* the product keeps every finding it earns.
+ */
+function onlyEvidencedInDocumentation(finding, hasProductSource) {
+    if (!hasProductSource)
+        return false;
+    const cited = finding.evidence.filter((item) => item.file);
+    return cited.length > 0 && cited.every((item) => detectPackaging_1.DOCS_DIRECTORIES.test(item.file));
+}
 function buildReport(analysis, options) {
     const observedFindings = (0, ruleEngine_1.runRules)(analysis);
     const observedScore = (0, score_1.computeScore)(observedFindings);
@@ -109,7 +131,23 @@ function buildReport(analysis, options) {
             expectationScore = evaluated.result.score;
         }
     }
-    const findings = (0, evidenceDigest_1.withEvidenceDigest)((0, businessImpact_1.withBusinessImpact)([...observedFindings, ...expectationFindings].sort((a, b) => bySeverityPriority(a) - bySeverityPriority(b))));
+    /**
+     * Whether this repository is more than its documentation.
+     *
+     * If every source file lives under `docs/` or `website/`, the documentation is the
+     * product and its findings are the product's.
+     */
+    const hasProductSource = analysis.files.source.some((file) => !detectPackaging_1.DOCS_DIRECTORIES.test(file));
+    const findings = (0, evidenceDigest_1.withEvidenceDigest)((0, businessImpact_1.withBusinessImpact)([...observedFindings, ...expectationFindings]
+        .map((finding) => onlyEvidencedInDocumentation(finding, hasProductSource)
+        ? {
+            ...finding,
+            status: 'unknown',
+            severity: 'info',
+            description: `${finding.description} Every line behind this is in the documentation site or a playground rather than in the product, so nothing here says the product does it.`,
+        }
+        : finding)
+        .sort((a, b) => bySeverityPriority(a) - bySeverityPriority(b))));
     const combinedScore = expectationScore === undefined
         ? observedScore
         : Math.max(0, Math.min(100, Math.round((observedScore * 0.6) + (expectationScore * 0.4))));

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@produtype/core",
-  "version": "0.37.0",
+  "version": "0.38.0",
   "description": "Deterministic CLI and library that analyzes a web application repository and reports how far it is from production-ready for the kind of product it is meant to be.",
   "license": "MIT",
   "bin": {