@produtype/core 0.41.0 → 0.43.0

package/dist/analyzer/absenceEvidence.d.ts

@@ -13,3 +13,16 @@ import type { DetectorEvidence } from './types';
  * would not. That is the difference between a claim and an assertion.
  */
 export declare function searchedFor(what: string, terms: string[], claim?: string): DetectorEvidence[];
+/**
+ * The evidence, or the search that came up empty — never neither.
+ *
+ * Measured across eighty-three repositories: 768 of 2101 findings carried "no direct
+ * evidence captured", and 180 of those were `high`. A reader is told at high severity
+ * that their product has no error reporting, no roles, no tenant isolation, and the
+ * only thing under it is a sentence that reads like an admission of not having looked.
+ *
+ * Every detector already knows what it searched for. This is the one line that makes
+ * it say so, so that a reader whose roles are called `capabilities` can see why they
+ * were missed and tell us we are wrong.
+ */
+export declare function evidenceOrSearch(evidence: DetectorEvidence[], what: string, terms: string[], claim?: string): DetectorEvidence[];

package/dist/analyzer/absenceEvidence.js

@@ -1,6 +1,7 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.searchedFor = searchedFor;
+exports.evidenceOrSearch = evidenceOrSearch;
 /**
  * What was looked for, when nothing was found.
  *
@@ -23,3 +24,18 @@ function searchedFor(what, terms, claim) {
             ...(claim ? { claim } : {}),
         }];
 }
+/**
+ * The evidence, or the search that came up empty — never neither.
+ *
+ * Measured across eighty-three repositories: 768 of 2101 findings carried "no direct
+ * evidence captured", and 180 of those were `high`. A reader is told at high severity
+ * that their product has no error reporting, no roles, no tenant isolation, and the
+ * only thing under it is a sentence that reads like an admission of not having looked.
+ *
+ * Every detector already knows what it searched for. This is the one line that makes
+ * it say so, so that a reader whose roles are called `capabilities` can see why they
+ * were missed and tell us we are wrong.
+ */
+function evidenceOrSearch(evidence, what, terms, claim) {
+    return evidence.length > 0 ? evidence : searchedFor(what, terms, claim);
+}

package/dist/analyzer/detectAuth.js

@@ -5,6 +5,7 @@ const detectContext_1 = require("./detectContext");
 const textSearch_1 = require("../utils/textSearch");
 const roleChecks_1 = require("./structural/roleChecks");
 const absenceEvidence_1 = require("./absenceEvidence");
+const fileNames_1 = require("./fileNames");
 /**
  * In a product that talks to a model, `role` usually means who is speaking.
  *
@@ -137,6 +138,11 @@ async function detectAuth(ctx) {
         /hashed?[_-]?(api[_-]?)?key/i,
         /token\s*scope/i,
     ], 20);
+    const passwordResetFiles = (0, fileNames_1.searchFileNames)(sourceFiles, [
+        /(password|pwd)[_-]?(reset|recovery)/i,
+        /(reset|recover)[_-]?password/i,
+        /forgot[_-]?password/i,
+    ]);
     const passwordResetSignals = await (0, textSearch_1.searchInFiles)(ctx.root, sourceFiles, [
         /forgot\s*password/i,
         /password[_-]?reset/i,
@@ -154,6 +160,17 @@ async function detectAuth(ctx) {
         // The same shape in other frameworks that hand you the flow rather than the words.
         /Devise|devise_for/,
         /Auth::routes\(/,
+        /**
+         * The same flow, called recovery.
+         *
+         * supabase/auth is a product whose entire purpose is authentication, and it was
+         * reported as having no password reset. Its file says "Password recovery
+         * requires an email" and names the type `Recovery`: the words "reset" and
+         * "forgot" appear nowhere, because it says the thing differently.
+         */
+        /password\s*recover(y|ing)?/i,
+        /recover(y)?[_-]?password/i,
+        /passwordRecovery/,
     ], 20);
     const emailVerificationSignals = await (0, textSearch_1.searchInFiles)(ctx.root, sourceFiles, [/verify\s*email/i, /email[_-]?verification/i, /confirm\s*email/i, /isEmailVerified/i], 20);
     const sessionSignals = await (0, textSearch_1.searchInFiles)(ctx.root, sourceFiles, [/session/i, /cookie/i, /jwt/i, /refresh\s*token/i, /httpOnly/i], 25);
@@ -295,7 +312,7 @@ async function detectAuth(ctx) {
             key: 'auth.core',
             present: hasAuth,
             complete: hasAuth && hasAuthz,
-            evidence: [...depEvidence(authDeps), ...snippetEvidence(routeSignals)],
+            evidence: (0, absenceEvidence_1.evidenceOrSearch)([...depEvidence(authDeps), ...snippetEvidence(routeSignals)], 'a way for somebody to sign in', ['next-auth', 'passport', 'lucia', '@clerk/', '@supabase/auth', 'django.contrib.auth', 'devise', 'jsonwebtoken', 'a /login or /signin route', 'signIn(', 'authenticate(']),
             details: {
                 hasAuth,
                 hasAuthz,
@@ -309,7 +326,8 @@ async function detectAuth(ctx) {
             key: 'auth.externalIdentityOnly',
             present: managedAuthDeps.length > 0 &&
                 (0, detectContext_1.hasAnyDep)(ctx, ['bcrypt', 'bcryptjs', 'argon2', 'scrypt-kdf', 'passport-local']).length === 0 &&
-                passwordResetSignals.length === 0,
+                passwordResetSignals.length === 0 &&
+                passwordResetFiles.length === 0,
             evidence: depEvidence(managedAuthDeps),
             details: { managedProviders: managedAuthDeps.length },
         },
@@ -321,17 +339,17 @@ async function detectAuth(ctx) {
         {
             key: 'auth.apiKeys',
             present: apiKeySignals.length > 0,
-            evidence: snippetEvidence(apiKeySignals),
+            evidence: (0, absenceEvidence_1.evidenceOrSearch)(snippetEvidence(apiKeySignals), 'keys this product issues and checks', ['x-api-key', 'api_keys.find', 'api_keys.where', 'hashedApiKey', 'token scope']),
         },
         {
             key: 'auth.passwordReset',
-            present: passwordResetSignals.length > 0,
+            present: passwordResetSignals.length > 0 || passwordResetFiles.length > 0,
             // The terms, where nothing matched. "No direct evidence captured" reads like
             // "we did not look"; this lets a reader whose flow is called `recoverAccess`
             // see in one line why it was missed.
-            evidence: passwordResetSignals.length > 0
-                ? snippetEvidence(passwordResetSignals)
-                : (0, absenceEvidence_1.searchedFor)('a password reset flow', ['"forgot password"', 'password_reset', 'password-reset', '"reset token"', 'django.contrib.auth.urls', 'PasswordResetView', 'devise_for', 'Auth::routes(']),
+            evidence: passwordResetSignals.length > 0 || passwordResetFiles.length > 0
+                ? [...snippetEvidence(passwordResetSignals), ...(0, fileNames_1.fileNameEvidence)(passwordResetFiles)]
+                : (0, absenceEvidence_1.searchedFor)('a password reset flow', ['"forgot password"', 'password_reset', 'password-reset', '"reset token"', '"password recovery"', 'django.contrib.auth.urls', 'PasswordResetView', 'devise_for', 'Auth::routes(', 'a file named for password reset or recovery']),
         },
         {
             key: 'auth.emailVerification',
@@ -348,22 +366,22 @@ async function detectAuth(ctx) {
         {
             key: 'authz.roles',
             present: roleSignals.length > 0,
-            evidence: snippetEvidence(roleSignals),
+            evidence: (0, absenceEvidence_1.evidenceOrSearch)(snippetEvidence(roleSignals), 'role checks', ['role ===', 'hasRole', 'isAdmin', 'user.role', 'roles.includes', '@Roles', 'role_required']),
         },
         {
             key: 'authz.permissions',
             present: permissionSignals.length > 0,
-            evidence: snippetEvidence(permissionSignals),
+            evidence: (0, absenceEvidence_1.evidenceOrSearch)(snippetEvidence(permissionSignals), 'permission checks', ['requirePermission', 'permission_classes', 'permissions.py', 'authorize(', 'can(']),
         },
         {
             key: 'authz.resourceLevel',
             present: resourceLevelSignals.length > 0 || permissionSignals.length > 0,
-            evidence: snippetEvidence(resourceLevelSignals),
+            evidence: (0, absenceEvidence_1.evidenceOrSearch)(snippetEvidence(resourceLevelSignals), 'a check that the row belongs to the caller', ['requirePermission', 'permission_classes', 'authorize(', 'canAccess(', 'hasAccessTo(', 'ownerId', 'createdBy', 'req.user.id', 'userId ===']),
         },
         {
             key: 'tenancy.organization',
             present: hasOrganization,
-            evidence: snippetEvidence(organizationSignals),
+            evidence: (0, absenceEvidence_1.evidenceOrSearch)(snippetEvidence(organizationSignals), 'a tenant of its own', ['organizationId', 'organization_id', 'tenantId', 'tenant_id', 'workspaceId', 'accountId']),
             details: {
                 b2bHint,
                 missingTenantRisk: b2bHint && !hasOrganization,
@@ -372,7 +390,7 @@ async function detectAuth(ctx) {
         {
             key: 'tenancy.membership',
             present: membershipSignals.length > 0,
-            evidence: snippetEvidence(membershipSignals),
+            evidence: (0, absenceEvidence_1.evidenceOrSearch)(snippetEvidence(membershipSignals), 'a membership joining a person to a tenant', ['membership', 'organizationMember', 'teamMember', 'workspaceMember', 'memberId with a tenant word beside it']),
         },
     ];
 }

package/dist/analyzer/detectBilling.js

@@ -3,6 +3,7 @@ Object.defineProperty(exports, "__esModule", { value: true });
 exports.detectBilling = detectBilling;
 const detectContext_1 = require("./detectContext");
 const textSearch_1 = require("../utils/textSearch");
+const absenceEvidence_1 = require("./absenceEvidence");
 function toEvidence(matches) {
     return matches.map((m) => ({ type: 'snippet', value: m.snippet, file: m.file, line: m.line }));
 }
@@ -120,7 +121,7 @@ async function detectBilling(ctx) {
         {
             key: 'billing.stripe',
             present: hasStrongStripeSignal,
-            evidence,
+            evidence: (0, absenceEvidence_1.evidenceOrSearch)(evidence, 'a payment integration', ['stripe', '@stripe/stripe-js', 'checkout.sessions.create', 'paddle', 'lemonsqueezy', 'braintree', 'a route under /webhook/stripe']),
             details: {
                 stripe: hasStrongStripeSignal,
             },

package/dist/analyzer/detectDeployment.js

@@ -2,6 +2,7 @@
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.detectDeployment = detectDeployment;
 const textSearch_1 = require("../utils/textSearch");
+const absenceEvidence_1 = require("./absenceEvidence");
 async function detectDeployment(ctx) {
     const evidence = [];
     /**
@@ -77,7 +78,7 @@ async function detectDeployment(ctx) {
         key: 'deployment.readiness',
         present: presentFiles.length > 0 || hits.length > 0,
         complete: prodAware,
-        evidence,
+        evidence: (0, absenceEvidence_1.evidenceOrSearch)(evidence, 'anything that says how this is deployed', ['Dockerfile', 'docker-compose', '.github/workflows/', 'Procfile', 'fly.toml', 'render.yaml', 'NODE_ENV', 'RAILS_ENV', 'ASPNETCORE_ENVIRONMENT', 'a file naming production']),
         details: {
             dockerArtifacts: presentFiles.some((f) => /Dockerfile|compose/.test(f)),
             ci: presentFiles.some((f) => f.startsWith('.github/workflows/')),

package/dist/analyzer/detectErrorReporting.js

@@ -3,6 +3,7 @@ Object.defineProperty(exports, "__esModule", { value: true });
 exports.detectErrorReporting = detectErrorReporting;
 const detectContext_1 = require("./detectContext");
 const textSearch_1 = require("../utils/textSearch");
+const absenceEvidence_1 = require("./absenceEvidence");
 /**
  * Whether a crash reaches the people who can fix it.
  *
@@ -53,7 +54,7 @@ async function detectErrorReporting(ctx) {
         // A reporting service is wired up once and covers everything; a hand-rolled handler
         // usually covers what its author remembered.
         complete: deps.length > 0,
-        evidence,
+        evidence: (0, absenceEvidence_1.evidenceOrSearch)(evidence, 'somewhere a crash in the browser is sent', ['@sentry/browser', '@sentry/react', '@bugsnag/js', 'rollbar', 'logrocket', '@datadog/browser-rum', 'sentry-sdk', 'window.onerror', 'addEventListener("error")', 'addEventListener("unhandledrejection")']),
         details: { services: deps, handlers: handlers.length },
     };
 }

package/dist/analyzer/detectGame.js

@@ -3,6 +3,7 @@ Object.defineProperty(exports, "__esModule", { value: true });
 exports.detectGame = detectGame;
 const detectContext_1 = require("./detectContext");
 const textSearch_1 = require("../utils/textSearch");
+const absenceEvidence_1 = require("./absenceEvidence");
 /**
  * Whether this project is a game.
  *
@@ -162,7 +163,7 @@ async function detectStatePersistence(ctx) {
         present: saves || durable,
         // Client storage alone is the partial case: it saves, until it does not.
         complete: durable,
-        evidence,
+        evidence: (0, absenceEvidence_1.evidenceOrSearch)(evidence, 'anywhere progress is written down', ['localStorage', 'sessionStorage', 'IndexedDB', 'a save route', 'schema.prisma', 'a .sql file', 'pg', 'mongoose', 'better-sqlite3']),
         details: { durable, clientStorage: clientOnly.length > 0, saveRoutines: saveRoutes.length },
     };
 }
@@ -193,7 +194,7 @@ async function detectAssetDelivery(ctx) {
     return {
         key: 'app.assetDelivery',
         present: hits.length > 0 || headerFiles.length > 0,
-        evidence,
+        evidence: (0, absenceEvidence_1.evidenceOrSearch)(evidence, 'anything that lets a browser keep the assets', ['express.static(..., maxAge)', 'Cache-Control: max-age', 'setHeaders:', 'assetPrefix:', 'immutable', '_headers', 'netlify.toml', 'vercel.json']),
         details: { inCode: hits.length, headerFiles: headerFiles.length },
     };
 }

package/dist/analyzer/detectGdpr.js

@@ -3,11 +3,20 @@ Object.defineProperty(exports, "__esModule", { value: true });
 exports.detectGdpr = detectGdpr;
 const textSearch_1 = require("../utils/textSearch");
 const absenceEvidence_1 = require("./absenceEvidence");
+const fileNames_1 = require("./fileNames");
 function toEvidence(matches) {
     return matches.map((m) => ({ type: 'snippet', value: m.snippet, file: m.file, line: m.line }));
 }
 async function detectGdpr(ctx) {
     const consent = await (0, textSearch_1.searchInFiles)(ctx.root, ctx.files.source, [/cookie[-_ ]?consent/i, /consentGiven/i, /privacyConsent/i, /gdprConsent/i], 20);
+    /**
+     * The same duty, in the words each ecosystem actually uses.
+     *
+     * The list was written in one dialect. Article 20 is `exportUserData` in a Node
+     * application and `UserExport` in a Rails one; article 17 is `deleteAccount` here
+     * and `UserAnonymizer` there. Discourse ships both and was told it had neither,
+     * at `high` — which is the severity a reader acts on.
+     */
     const exportRoute = await (0, textSearch_1.searchInFiles)(ctx.root, ctx.files.source, [
         /\/gdpr\/export\b/i,
         /exportUserData/i,
@@ -16,8 +25,40 @@ async function detectGdpr(ctx) {
         /rightToAccess/i,
         /data portability/i,
         /export personal data/i,
+        /user[_-]?export/i,
+        /export[_-]?(user|account|profile)\b/i,
+        /download (your|my) data/i,
+    ], 20);
+    const exportFiles = (0, fileNames_1.searchFileNames)(ctx.files.source, [
+        /user[_-]?export/i,
+        /(data|account|profile)[_-]?export/i,
+        /export[_-]?(user|account|personal)/i,
+    ]);
+    const erasure = await (0, textSearch_1.searchInFiles)(ctx.root, ctx.files.source, [
+        /erasure/i,
+        /delete account/i,
+        /right to be forgotten/i,
+        /delete user data/i,
+        /delete personal data/i,
+        /**
+         * Anonymisation, which is how a forum satisfies article 17 without losing the
+         * thread. Discourse's is `UserAnonymizer` and it was told it had no erasure.
+         */
+        /anonymi[sz]e[_-]?(user|account)/i,
+        /user[_-]?anonymi[sz]/i,
     ], 20);
-    const erasure = await (0, textSearch_1.searchInFiles)(ctx.root, ctx.files.source, [/erasure/i, /delete account/i, /right to be forgotten/i, /delete user data/i, /delete personal data/i], 20);
+    /**
+     * `deleteUser(id)` is not article 17 — it is every admin screen ever written, and
+     * as a line it matched a teaching exercise about `git log -S "deleteUser"` and a
+     * function that removes a cloud provider account. A file *named* for deleting
+     * accounts is a different thing: somebody built a feature and called it that.
+     */
+    const erasureFiles = (0, fileNames_1.searchFileNames)(ctx.files.source, [
+        /user[_-]?anonymi[sz]/i,
+        /anonymi[sz]er/i,
+        /(account|user)[_-]?deletion/i,
+        /(delete|erase)[_-]?(account|my[_-]?data)/i,
+    ]);
     const retention = await (0, textSearch_1.searchInFiles)(ctx.root, ctx.files.source, [
         /(gdpr|privacy).*(retention|purge|delete)/i,
         /(retention|purge|delete).*(personal data|user data|data subject)/i,
@@ -44,13 +85,17 @@ async function detectGdpr(ctx) {
         },
         {
             key: 'gdpr.export.route',
-            present: exportRoute.length > 0,
-            evidence: evidenceOr(exportRoute, 'export'),
+            present: exportRoute.length > 0 || exportFiles.length > 0,
+            evidence: exportRoute.length > 0 || exportFiles.length > 0
+                ? [...toEvidence(exportRoute), ...(0, fileNames_1.fileNameEvidence)(exportFiles)]
+                : evidenceOr(exportRoute, 'export'),
         },
         {
             key: 'gdpr.erasure.route',
-            present: erasure.length > 0,
-            evidence: evidenceOr(erasure, 'erasure'),
+            present: erasure.length > 0 || erasureFiles.length > 0,
+            evidence: erasure.length > 0 || erasureFiles.length > 0
+                ? [...toEvidence(erasure), ...(0, fileNames_1.fileNameEvidence)(erasureFiles)]
+                : evidenceOr(erasure, 'erasure'),
         },
         {
             key: 'gdpr.retention.job',

package/dist/analyzer/detectMobile.js

@@ -4,6 +4,7 @@ exports.detectMobile = detectMobile;
 const detectContext_1 = require("./detectContext");
 const readTextFileSafe_1 = require("../utils/readTextFileSafe");
 const textSearch_1 = require("../utils/textSearch");
+const absenceEvidence_1 = require("./absenceEvidence");
 /**
  * Whether this is an application that ships to somebody else's phone, and what that
  * demands of it.
@@ -351,10 +352,18 @@ async function detectMobile(ctx) {
             // Declared-and-explained, or asked at the moment of use. A manifest full of
             // permissions with nothing next to them is the failing case, not the passing one.
             present: permissionsExplained,
-            evidence: permissionEvidence,
+            evidence: (0, absenceEvidence_1.evidenceOrSearch)(permissionEvidence, 'a reason given for each permission asked for', ['NSCameraUsageDescription and the other NS*UsageDescription keys', 'a permission rationale beside uses-permission', 'requestPermissions(', 'Permission.request']),
+        },
+        {
+            key: 'mobile.credentialStorage',
+            present: credentialEvidence.length > 0,
+            evidence: (0, absenceEvidence_1.evidenceOrSearch)(credentialEvidence, 'a secure store for credentials on the device', ['react-native-keychain', 'expo-secure-store', 'flutter_secure_storage', 'KeychainAccess', 'kSecClass', 'EncryptedSharedPreferences', 'AndroidKeyStore', 'SecItemAdd']),
+        },
+        {
+            key: 'mobile.offline',
+            present: offlineDeps.length > 0,
+            evidence: (0, absenceEvidence_1.evidenceOrSearch)(offlineEvidence, 'a local database the app can read with no network', ['sqflite', 'drift', 'hive', 'isar', 'objectbox', 'realm', 'androidx.room', 'sqldelight', 'grdb.swift', 'sqlite.swift']),
         },
-        { key: 'mobile.credentialStorage', present: credentialEvidence.length > 0, evidence: credentialEvidence },
-        { key: 'mobile.offline', present: offlineDeps.length > 0, evidence: offlineEvidence },
         {
             key: 'mobile.forcedUpdate',
             present: forcedUpdate.length > 0,

package/dist/analyzer/detectNotifications.js

@@ -3,6 +3,7 @@ Object.defineProperty(exports, "__esModule", { value: true });
 exports.detectEngagement = detectEngagement;
 const detectContext_1 = require("./detectContext");
 const textSearch_1 = require("../utils/textSearch");
+const absenceEvidence_1 = require("./absenceEvidence");
 /**
  * Signals for the two things a consumer product needs that a backend service does not:
  * a way to bring a stranger from signup to first use, and a way to reach them
@@ -50,7 +51,7 @@ async function detectNotifications(ctx) {
         key: 'notifications.transactional',
         present: capable || wired,
         complete: capable && wired,
-        evidence,
+        evidence: (0, absenceEvidence_1.evidenceOrSearch)(evidence, 'a way to tell a user something happened', ['nodemailer', 'resend', '@sendgrid/mail', 'postmark', 'mailgun', 'django.core.mail', 'sendMail(', 'send_mail(', 'firebase-admin messaging', 'an email template file']),
         details: {
             emailDependency: emailDeps.length > 0,
             pushDependency: pushDeps.length > 0,
@@ -72,7 +73,7 @@ async function detectOnboarding(ctx) {
         key: 'onboarding.flow',
         present: strong || hits.length > 0,
         complete: strong,
-        evidence,
+        evidence: (0, absenceEvidence_1.evidenceOrSearch)(evidence, 'anything that takes a new user through a first run', ['onboarding', 'getting-started', 'welcome', 'firstRun', 'setup wizard', 'a file named for onboarding']),
         details: { onboardingFiles: files.length, onboardingSignals: hits.length },
     };
 }

package/dist/analyzer/detectPackaging.js

@@ -5,6 +5,7 @@ exports.detectPackaging = detectPackaging;
 const readTextFileSafe_1 = require("../utils/readTextFileSafe");
 const detectContext_1 = require("./detectContext");
 const readTextFileSafe_2 = require("../utils/readTextFileSafe");
+const absenceEvidence_1 = require("./absenceEvidence");
 /**
  * Whether a project is fit to be installed and depended on by someone else.
  *
@@ -212,7 +213,7 @@ async function detectPackaging(ctx) {
             // answer, and a reader who has one does not need the other to use the code.
             present: licenseFiles.length > 0 || declaredLicense,
             complete: licenseFiles.length > 0 && declaredLicense,
-            evidence: licenseEvidence,
+            evidence: (0, absenceEvidence_1.evidenceOrSearch)(licenseEvidence, 'a licence', ['LICENSE', 'LICENCE', 'COPYING', 'a license field in package.json', 'a license classifier in pyproject.toml']),
             details: { files: licenseFiles.length, declared: declaredLicense },
         },
         {
@@ -234,18 +235,18 @@ async function detectPackaging(ctx) {
             key: 'docs.readme',
             present: readmeFiles.length > 0,
             complete: readmeLength > 400,
-            evidence: readmeFiles.map((file) => ({ type: 'file', value: `${file} (${readmeLength} characters)`, file })),
+            evidence: (0, absenceEvidence_1.evidenceOrSearch)(readmeFiles.map((file) => ({ type: 'file', value: `${file} (${readmeLength} characters)`, file })), 'a readme', ['README', 'README.md', 'README.rst', 'readme.txt']),
             details: { length: readmeLength },
         },
         {
             key: 'quality.tests',
             present: testFiles.length > 0,
             complete: testFiles.length > 0 && (hasTestScript || hasPyTestRunner),
-            evidence: [
+            evidence: (0, absenceEvidence_1.evidenceOrSearch)([
                 ...testFiles.slice(0, 3).map((file) => ({ type: 'file', value: file, file })),
                 ...(hasTestScript ? [{ type: 'note', value: 'an "npm test" script' }] : []),
                 ...(hasPyTestRunner ? [{ type: 'note', value: 'a Python test runner' }] : []),
-            ],
+            ], 'tests', ['a path under test/ or tests/', '*.test.*', '*.spec.*', 'test_*.py', '*_test.go', 'an "npm test" script', 'pytest', 'tox']),
             details: { files: testFiles.length, runner: hasTestScript || hasPyTestRunner },
         },
         {

package/dist/analyzer/fileNames.d.ts

@@ -0,0 +1,33 @@
+import type { DetectorEvidence } from './types';
+/**
+ * What a file is called, as evidence about what the product does.
+ *
+ * This analyzer reads the inside of files and never the names on them. Discourse was
+ * told it offers no way to export or erase personal data while shipping
+ * `app/models/user_export.rb` and `app/services/user_anonymizer.rb`; supabase/auth was
+ * told it has no password reset while shipping `internal/api/recover.go`. In each case
+ * the concept is named most clearly in the one place nothing was looking.
+ *
+ * It is weaker evidence than a line and it is honest about that: the citation is the
+ * file, with no line number, because a file name is not a line. It is also
+ * language-neutral in a way no list of words can be — `user_export.rb`,
+ * `UserExportService.java` and `export_user.py` are one pattern.
+ *
+ * The limit is low on purpose: a Django project has ten templates named for the
+ * password reset and the reader needs to see two, not ten.
+ *
+ * Matched on the path with its extension removed, so a pattern never has to know
+ * whether it is looking at Ruby or Go.
+ */
+export interface FileNameMatch {
+    file: string;
+}
+export declare function searchFileNames(files: string[], patterns: RegExp[], limit?: number): FileNameMatch[];
+/**
+ * The evidence line for a file name.
+ *
+ * `type: 'file'` and no `line`, which is what distinguishes it from a snippet: the
+ * reader is being pointed at a file to open, not at a line to read. The alternative —
+ * claiming line 1 — is the mistake this analyzer spent a release removing.
+ */
+export declare function fileNameEvidence(matches: FileNameMatch[], claim?: string): DetectorEvidence[];

package/dist/analyzer/fileNames.js

@@ -0,0 +1,31 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.searchFileNames = searchFileNames;
+exports.fileNameEvidence = fileNameEvidence;
+function searchFileNames(files, patterns, limit = 4) {
+    const matches = [];
+    for (const file of files) {
+        if (matches.length >= limit)
+            break;
+        const withoutExtension = file.replace(/\.[A-Za-z0-9]+$/, '');
+        if (patterns.some((pattern) => pattern.test(withoutExtension))) {
+            matches.push({ file });
+        }
+    }
+    return matches;
+}
+/**
+ * The evidence line for a file name.
+ *
+ * `type: 'file'` and no `line`, which is what distinguishes it from a snippet: the
+ * reader is being pointed at a file to open, not at a line to read. The alternative —
+ * claiming line 1 — is the mistake this analyzer spent a release removing.
+ */
+function fileNameEvidence(matches, claim) {
+    return matches.map((m) => ({
+        type: 'file',
+        value: `a file named ${m.file}`,
+        file: m.file,
+        ...(claim ? { claim } : {}),
+    }));
+}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@produtype/core",
-  "version": "0.41.0",
+  "version": "0.43.0",
   "description": "Deterministic CLI and library that analyzes a web application repository and reports how far it is from production-ready for the kind of product it is meant to be.",
   "license": "MIT",
   "bin": {