@produtype/core 0.42.0 → 0.43.0

package/dist/analyzer/absenceEvidence.d.ts

@@ -13,3 +13,16 @@ import type { DetectorEvidence } from './types';
  * would not. That is the difference between a claim and an assertion.
  */
 export declare function searchedFor(what: string, terms: string[], claim?: string): DetectorEvidence[];
+/**
+ * The evidence, or the search that came up empty — never neither.
+ *
+ * Measured across eighty-three repositories: 768 of 2101 findings carried "no direct
+ * evidence captured", and 180 of those were `high`. A reader is told at high severity
+ * that their product has no error reporting, no roles, no tenant isolation, and the
+ * only thing under it is a sentence that reads like an admission of not having looked.
+ *
+ * Every detector already knows what it searched for. This is the one line that makes
+ * it say so, so that a reader whose roles are called `capabilities` can see why they
+ * were missed and tell us we are wrong.
+ */
+export declare function evidenceOrSearch(evidence: DetectorEvidence[], what: string, terms: string[], claim?: string): DetectorEvidence[];

package/dist/analyzer/absenceEvidence.js

@@ -1,6 +1,7 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.searchedFor = searchedFor;
+exports.evidenceOrSearch = evidenceOrSearch;
 /**
  * What was looked for, when nothing was found.
  *
@@ -23,3 +24,18 @@ function searchedFor(what, terms, claim) {
             ...(claim ? { claim } : {}),
         }];
 }
+/**
+ * The evidence, or the search that came up empty — never neither.
+ *
+ * Measured across eighty-three repositories: 768 of 2101 findings carried "no direct
+ * evidence captured", and 180 of those were `high`. A reader is told at high severity
+ * that their product has no error reporting, no roles, no tenant isolation, and the
+ * only thing under it is a sentence that reads like an admission of not having looked.
+ *
+ * Every detector already knows what it searched for. This is the one line that makes
+ * it say so, so that a reader whose roles are called `capabilities` can see why they
+ * were missed and tell us we are wrong.
+ */
+function evidenceOrSearch(evidence, what, terms, claim) {
+    return evidence.length > 0 ? evidence : searchedFor(what, terms, claim);
+}

package/dist/analyzer/detectAuth.js

@@ -312,7 +312,7 @@ async function detectAuth(ctx) {
             key: 'auth.core',
             present: hasAuth,
             complete: hasAuth && hasAuthz,
-            evidence: [...depEvidence(authDeps), ...snippetEvidence(routeSignals)],
+            evidence: (0, absenceEvidence_1.evidenceOrSearch)([...depEvidence(authDeps), ...snippetEvidence(routeSignals)], 'a way for somebody to sign in', ['next-auth', 'passport', 'lucia', '@clerk/', '@supabase/auth', 'django.contrib.auth', 'devise', 'jsonwebtoken', 'a /login or /signin route', 'signIn(', 'authenticate(']),
             details: {
                 hasAuth,
                 hasAuthz,
@@ -339,7 +339,7 @@ async function detectAuth(ctx) {
         {
             key: 'auth.apiKeys',
             present: apiKeySignals.length > 0,
-            evidence: snippetEvidence(apiKeySignals),
+            evidence: (0, absenceEvidence_1.evidenceOrSearch)(snippetEvidence(apiKeySignals), 'keys this product issues and checks', ['x-api-key', 'api_keys.find', 'api_keys.where', 'hashedApiKey', 'token scope']),
         },
         {
             key: 'auth.passwordReset',
@@ -366,22 +366,22 @@ async function detectAuth(ctx) {
         {
             key: 'authz.roles',
             present: roleSignals.length > 0,
-            evidence: snippetEvidence(roleSignals),
+            evidence: (0, absenceEvidence_1.evidenceOrSearch)(snippetEvidence(roleSignals), 'role checks', ['role ===', 'hasRole', 'isAdmin', 'user.role', 'roles.includes', '@Roles', 'role_required']),
         },
         {
             key: 'authz.permissions',
             present: permissionSignals.length > 0,
-            evidence: snippetEvidence(permissionSignals),
+            evidence: (0, absenceEvidence_1.evidenceOrSearch)(snippetEvidence(permissionSignals), 'permission checks', ['requirePermission', 'permission_classes', 'permissions.py', 'authorize(', 'can(']),
         },
         {
             key: 'authz.resourceLevel',
             present: resourceLevelSignals.length > 0 || permissionSignals.length > 0,
-            evidence: snippetEvidence(resourceLevelSignals),
+            evidence: (0, absenceEvidence_1.evidenceOrSearch)(snippetEvidence(resourceLevelSignals), 'a check that the row belongs to the caller', ['requirePermission', 'permission_classes', 'authorize(', 'canAccess(', 'hasAccessTo(', 'ownerId', 'createdBy', 'req.user.id', 'userId ===']),
         },
         {
             key: 'tenancy.organization',
             present: hasOrganization,
-            evidence: snippetEvidence(organizationSignals),
+            evidence: (0, absenceEvidence_1.evidenceOrSearch)(snippetEvidence(organizationSignals), 'a tenant of its own', ['organizationId', 'organization_id', 'tenantId', 'tenant_id', 'workspaceId', 'accountId']),
             details: {
                 b2bHint,
                 missingTenantRisk: b2bHint && !hasOrganization,
@@ -390,7 +390,7 @@ async function detectAuth(ctx) {
         {
             key: 'tenancy.membership',
             present: membershipSignals.length > 0,
-            evidence: snippetEvidence(membershipSignals),
+            evidence: (0, absenceEvidence_1.evidenceOrSearch)(snippetEvidence(membershipSignals), 'a membership joining a person to a tenant', ['membership', 'organizationMember', 'teamMember', 'workspaceMember', 'memberId with a tenant word beside it']),
         },
     ];
 }

package/dist/analyzer/detectBilling.js

@@ -3,6 +3,7 @@ Object.defineProperty(exports, "__esModule", { value: true });
 exports.detectBilling = detectBilling;
 const detectContext_1 = require("./detectContext");
 const textSearch_1 = require("../utils/textSearch");
+const absenceEvidence_1 = require("./absenceEvidence");
 function toEvidence(matches) {
     return matches.map((m) => ({ type: 'snippet', value: m.snippet, file: m.file, line: m.line }));
 }
@@ -120,7 +121,7 @@ async function detectBilling(ctx) {
         {
             key: 'billing.stripe',
             present: hasStrongStripeSignal,
-            evidence,
+            evidence: (0, absenceEvidence_1.evidenceOrSearch)(evidence, 'a payment integration', ['stripe', '@stripe/stripe-js', 'checkout.sessions.create', 'paddle', 'lemonsqueezy', 'braintree', 'a route under /webhook/stripe']),
             details: {
                 stripe: hasStrongStripeSignal,
             },

package/dist/analyzer/detectDeployment.js

@@ -2,6 +2,7 @@
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.detectDeployment = detectDeployment;
 const textSearch_1 = require("../utils/textSearch");
+const absenceEvidence_1 = require("./absenceEvidence");
 async function detectDeployment(ctx) {
     const evidence = [];
     /**
@@ -77,7 +78,7 @@ async function detectDeployment(ctx) {
         key: 'deployment.readiness',
         present: presentFiles.length > 0 || hits.length > 0,
         complete: prodAware,
-        evidence,
+        evidence: (0, absenceEvidence_1.evidenceOrSearch)(evidence, 'anything that says how this is deployed', ['Dockerfile', 'docker-compose', '.github/workflows/', 'Procfile', 'fly.toml', 'render.yaml', 'NODE_ENV', 'RAILS_ENV', 'ASPNETCORE_ENVIRONMENT', 'a file naming production']),
         details: {
             dockerArtifacts: presentFiles.some((f) => /Dockerfile|compose/.test(f)),
             ci: presentFiles.some((f) => f.startsWith('.github/workflows/')),

package/dist/analyzer/detectErrorReporting.js

@@ -3,6 +3,7 @@ Object.defineProperty(exports, "__esModule", { value: true });
 exports.detectErrorReporting = detectErrorReporting;
 const detectContext_1 = require("./detectContext");
 const textSearch_1 = require("../utils/textSearch");
+const absenceEvidence_1 = require("./absenceEvidence");
 /**
  * Whether a crash reaches the people who can fix it.
  *
@@ -53,7 +54,7 @@ async function detectErrorReporting(ctx) {
         // A reporting service is wired up once and covers everything; a hand-rolled handler
         // usually covers what its author remembered.
         complete: deps.length > 0,
-        evidence,
+        evidence: (0, absenceEvidence_1.evidenceOrSearch)(evidence, 'somewhere a crash in the browser is sent', ['@sentry/browser', '@sentry/react', '@bugsnag/js', 'rollbar', 'logrocket', '@datadog/browser-rum', 'sentry-sdk', 'window.onerror', 'addEventListener("error")', 'addEventListener("unhandledrejection")']),
         details: { services: deps, handlers: handlers.length },
     };
 }

package/dist/analyzer/detectGame.js

@@ -3,6 +3,7 @@ Object.defineProperty(exports, "__esModule", { value: true });
 exports.detectGame = detectGame;
 const detectContext_1 = require("./detectContext");
 const textSearch_1 = require("../utils/textSearch");
+const absenceEvidence_1 = require("./absenceEvidence");
 /**
  * Whether this project is a game.
  *
@@ -162,7 +163,7 @@ async function detectStatePersistence(ctx) {
         present: saves || durable,
         // Client storage alone is the partial case: it saves, until it does not.
         complete: durable,
-        evidence,
+        evidence: (0, absenceEvidence_1.evidenceOrSearch)(evidence, 'anywhere progress is written down', ['localStorage', 'sessionStorage', 'IndexedDB', 'a save route', 'schema.prisma', 'a .sql file', 'pg', 'mongoose', 'better-sqlite3']),
         details: { durable, clientStorage: clientOnly.length > 0, saveRoutines: saveRoutes.length },
     };
 }
@@ -193,7 +194,7 @@ async function detectAssetDelivery(ctx) {
     return {
         key: 'app.assetDelivery',
         present: hits.length > 0 || headerFiles.length > 0,
-        evidence,
+        evidence: (0, absenceEvidence_1.evidenceOrSearch)(evidence, 'anything that lets a browser keep the assets', ['express.static(..., maxAge)', 'Cache-Control: max-age', 'setHeaders:', 'assetPrefix:', 'immutable', '_headers', 'netlify.toml', 'vercel.json']),
         details: { inCode: hits.length, headerFiles: headerFiles.length },
     };
 }

package/dist/analyzer/detectMobile.js

@@ -4,6 +4,7 @@ exports.detectMobile = detectMobile;
 const detectContext_1 = require("./detectContext");
 const readTextFileSafe_1 = require("../utils/readTextFileSafe");
 const textSearch_1 = require("../utils/textSearch");
+const absenceEvidence_1 = require("./absenceEvidence");
 /**
  * Whether this is an application that ships to somebody else's phone, and what that
  * demands of it.
@@ -351,10 +352,18 @@ async function detectMobile(ctx) {
             // Declared-and-explained, or asked at the moment of use. A manifest full of
             // permissions with nothing next to them is the failing case, not the passing one.
             present: permissionsExplained,
-            evidence: permissionEvidence,
+            evidence: (0, absenceEvidence_1.evidenceOrSearch)(permissionEvidence, 'a reason given for each permission asked for', ['NSCameraUsageDescription and the other NS*UsageDescription keys', 'a permission rationale beside uses-permission', 'requestPermissions(', 'Permission.request']),
+        },
+        {
+            key: 'mobile.credentialStorage',
+            present: credentialEvidence.length > 0,
+            evidence: (0, absenceEvidence_1.evidenceOrSearch)(credentialEvidence, 'a secure store for credentials on the device', ['react-native-keychain', 'expo-secure-store', 'flutter_secure_storage', 'KeychainAccess', 'kSecClass', 'EncryptedSharedPreferences', 'AndroidKeyStore', 'SecItemAdd']),
+        },
+        {
+            key: 'mobile.offline',
+            present: offlineDeps.length > 0,
+            evidence: (0, absenceEvidence_1.evidenceOrSearch)(offlineEvidence, 'a local database the app can read with no network', ['sqflite', 'drift', 'hive', 'isar', 'objectbox', 'realm', 'androidx.room', 'sqldelight', 'grdb.swift', 'sqlite.swift']),
         },
-        { key: 'mobile.credentialStorage', present: credentialEvidence.length > 0, evidence: credentialEvidence },
-        { key: 'mobile.offline', present: offlineDeps.length > 0, evidence: offlineEvidence },
         {
             key: 'mobile.forcedUpdate',
             present: forcedUpdate.length > 0,

package/dist/analyzer/detectNotifications.js

@@ -3,6 +3,7 @@ Object.defineProperty(exports, "__esModule", { value: true });
 exports.detectEngagement = detectEngagement;
 const detectContext_1 = require("./detectContext");
 const textSearch_1 = require("../utils/textSearch");
+const absenceEvidence_1 = require("./absenceEvidence");
 /**
  * Signals for the two things a consumer product needs that a backend service does not:
  * a way to bring a stranger from signup to first use, and a way to reach them
@@ -50,7 +51,7 @@ async function detectNotifications(ctx) {
         key: 'notifications.transactional',
         present: capable || wired,
         complete: capable && wired,
-        evidence,
+        evidence: (0, absenceEvidence_1.evidenceOrSearch)(evidence, 'a way to tell a user something happened', ['nodemailer', 'resend', '@sendgrid/mail', 'postmark', 'mailgun', 'django.core.mail', 'sendMail(', 'send_mail(', 'firebase-admin messaging', 'an email template file']),
         details: {
             emailDependency: emailDeps.length > 0,
             pushDependency: pushDeps.length > 0,
@@ -72,7 +73,7 @@ async function detectOnboarding(ctx) {
         key: 'onboarding.flow',
         present: strong || hits.length > 0,
         complete: strong,
-        evidence,
+        evidence: (0, absenceEvidence_1.evidenceOrSearch)(evidence, 'anything that takes a new user through a first run', ['onboarding', 'getting-started', 'welcome', 'firstRun', 'setup wizard', 'a file named for onboarding']),
         details: { onboardingFiles: files.length, onboardingSignals: hits.length },
     };
 }

package/dist/analyzer/detectPackaging.js

@@ -5,6 +5,7 @@ exports.detectPackaging = detectPackaging;
 const readTextFileSafe_1 = require("../utils/readTextFileSafe");
 const detectContext_1 = require("./detectContext");
 const readTextFileSafe_2 = require("../utils/readTextFileSafe");
+const absenceEvidence_1 = require("./absenceEvidence");
 /**
  * Whether a project is fit to be installed and depended on by someone else.
  *
@@ -212,7 +213,7 @@ async function detectPackaging(ctx) {
             // answer, and a reader who has one does not need the other to use the code.
             present: licenseFiles.length > 0 || declaredLicense,
             complete: licenseFiles.length > 0 && declaredLicense,
-            evidence: licenseEvidence,
+            evidence: (0, absenceEvidence_1.evidenceOrSearch)(licenseEvidence, 'a licence', ['LICENSE', 'LICENCE', 'COPYING', 'a license field in package.json', 'a license classifier in pyproject.toml']),
             details: { files: licenseFiles.length, declared: declaredLicense },
         },
         {
@@ -234,18 +235,18 @@ async function detectPackaging(ctx) {
             key: 'docs.readme',
             present: readmeFiles.length > 0,
             complete: readmeLength > 400,
-            evidence: readmeFiles.map((file) => ({ type: 'file', value: `${file} (${readmeLength} characters)`, file })),
+            evidence: (0, absenceEvidence_1.evidenceOrSearch)(readmeFiles.map((file) => ({ type: 'file', value: `${file} (${readmeLength} characters)`, file })), 'a readme', ['README', 'README.md', 'README.rst', 'readme.txt']),
             details: { length: readmeLength },
         },
         {
             key: 'quality.tests',
             present: testFiles.length > 0,
             complete: testFiles.length > 0 && (hasTestScript || hasPyTestRunner),
-            evidence: [
+            evidence: (0, absenceEvidence_1.evidenceOrSearch)([
                 ...testFiles.slice(0, 3).map((file) => ({ type: 'file', value: file, file })),
                 ...(hasTestScript ? [{ type: 'note', value: 'an "npm test" script' }] : []),
                 ...(hasPyTestRunner ? [{ type: 'note', value: 'a Python test runner' }] : []),
-            ],
+            ], 'tests', ['a path under test/ or tests/', '*.test.*', '*.spec.*', 'test_*.py', '*_test.go', 'an "npm test" script', 'pytest', 'tox']),
             details: { files: testFiles.length, runner: hasTestScript || hasPyTestRunner },
         },
         {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@produtype/core",
-  "version": "0.42.0",
+  "version": "0.43.0",
   "description": "Deterministic CLI and library that analyzes a web application repository and reports how far it is from production-ready for the kind of product it is meant to be.",
   "license": "MIT",
   "bin": {