@produtype/core 0.49.0 → 0.51.0

package/README.md

@@ -174,7 +174,7 @@ prodkit plan ../my-app --output prodkit-plan.md
 
 _Generated from the analyzer itself — run `npm run docs:stacks` after changing a detector._
 
-- **Backend:** Express, Next.js, NestJS, Fastify, Hono, Elysia, Koa, AdonisJS, SvelteKit, Remix, Nuxt, Nitro, Astro, Django, Flask, FastAPI, aiohttp, Litestar, Sanic, Tornado, Starlette, Streamlit, Gradio, Dash, Chainlit, Gin, Echo, Fiber, chi, Gorilla, Beego, Go, Rails, Sinatra, Hanami, Roda, Grape, Ruby, Laravel, Symfony, Slim, CodeIgniter, CakePHP, Yii, PHP, ASP.NET Core, .NET
+- **Backend:** Express, Next.js, NestJS, Fastify, Hono, Elysia, Koa, AdonisJS, SvelteKit, Remix, Nuxt, Nitro, Astro, Django, Flask, FastAPI, aiohttp, Litestar, Sanic, Tornado, Starlette, Streamlit, Gradio, Dash, Chainlit, Gin, Echo, Fiber, chi, Gorilla, Beego, Go, Axum, Actix Web, Rocket, Warp, Tide, Poem, Salvo, Tower HTTP, Spring Boot, Quarkus, Micronaut, Ktor, Javalin, Vert.x, Dropwizard, Helidon, Rails, Sinatra, Hanami, Roda, Grape, Ruby, Laravel, Symfony, Slim, CodeIgniter, CakePHP, Yii, PHP, ASP.NET Core, .NET
 - **Frontend:** React, Vite, Vue, Nuxt, Svelte, Angular, Astro, Solid, Qwik, Preact, Remix, htmx, Tailwind CSS, Electron
 - **Mobile:** Flutter, React Native, iOS (native), Android (native)
 - **Databases:** Postgres, MySQL, SQLite, SQL Server, MongoDB, Redis, Firestore, DynamoDB, Convex

package/dist/analyzer/analyzeProject.js

@@ -435,6 +435,43 @@ async function analyzeProject(projectPath) {
                 goDeps.push(match[1].toLowerCase());
         }
     }
+    /**
+     * Cargo.toml, read for the crates a Rust project depends on.
+     *
+     * windmill's backend is 547 Rust files and the report said "Backend: go", on the
+     * strength of one `go.mod` belonging to a client SDK. Rust was not being read at
+     * all — a whole ecosystem invisible, so a Rust web service could only ever be
+     * reported as whatever else happened to be lying around.
+     *
+     * The same hand-written reader as the others: `[dependencies]` and its variants open
+     * a block, and each entry is a crate name before `=`. A version table written as
+     * `[dependencies.axum]` names the crate in the heading instead, so both shapes are
+     * read.
+     */
+    const rustDeps = [];
+    for (const file of allFiles.filter((f) => /(^|\/)Cargo\.toml$/.test(f))) {
+        const raw = (await (0, readTextFileSafe_1.readTextFileSafe)(root, file)) ?? '';
+        let inDeps = false;
+        for (const line of raw.split('\n')) {
+            const heading = /^\s*\[([^\]]+)\]/.exec(line);
+            if (heading) {
+                const section = heading[1].trim();
+                const nested = /^(?:[a-z-]+\.)?(?:dependencies|dev-dependencies|build-dependencies)\.(.+)$/.exec(section);
+                if (nested) {
+                    rustDeps.push(nested[1].trim().toLowerCase());
+                    inDeps = false;
+                    continue;
+                }
+                inDeps = /(^|\.)(dependencies|dev-dependencies|build-dependencies)$/.test(section);
+                continue;
+            }
+            if (!inDeps)
+                continue;
+            const entry = /^\s*([A-Za-z0-9_-]+)\s*=/.exec(line);
+            if (entry)
+                rustDeps.push(entry[1].toLowerCase());
+        }
+    }
     /**
      * pubspec.yaml, read for its two dependency blocks.
      *
@@ -488,7 +525,30 @@ async function analyzeProject(projectPath) {
      * reported, which is the direction to err in — the catalog is the project's own
      * statement about what it builds with.
      */
+    /**
+     * pom.xml, read for the coordinates a Maven project declares.
+     *
+     * A Spring Boot REST API with Spring Security and PostgreSQL reported no backend and
+     * no database. The manifest was recognised well enough to name the package manager
+     * "maven" and then never opened — the same shape of gap Rust had, in the larger
+     * ecosystem.
+     *
+     * `<parent>` is read alongside `<dependencies>` because that is where Spring Boot
+     * declares itself: `spring-boot-starter-parent` is the single line that makes a
+     * project a Spring Boot project, and a starter listed below it inherits its version
+     * from there rather than stating one.
+     *
+     * Regular expressions rather than an XML parser, for the reason the others give: the
+     * shape being read is two adjacent elements, and a manifest this cannot read yields
+     * no dependencies rather than a wrong answer.
+     */
     const gradleDeps = [];
+    for (const file of allFiles.filter((f) => /(^|\/)pom\.xml$/.test(f))) {
+        const raw = (await (0, readTextFileSafe_1.readTextFileSafe)(root, file)) ?? '';
+        for (const match of raw.matchAll(/<groupId>\s*([^<\s]+)\s*<\/groupId>\s*<artifactId>\s*([^<\s]+)\s*<\/artifactId>/g)) {
+            gradleDeps.push(`${match[1]}:${match[2]}`.toLowerCase());
+        }
+    }
     for (const file of allFiles.filter((f) => /(^|\/)build\.gradle(\.kts)?$/.test(f))) {
         const raw = (await (0, readTextFileSafe_1.readTextFileSafe)(root, file)) ?? '';
         for (const match of raw.matchAll(/\b(?:implementation|api|compileOnly|runtimeOnly|kapt|ksp|annotationProcessor|testImplementation)\s*[( ]\s*["']([^"']+)["']/g)) {
@@ -664,6 +724,7 @@ async function analyzeProject(projectPath) {
         pythonDeps,
         phpDeps: unique(phpDeps),
         goDeps: unique(goDeps),
+        rustDeps: unique(rustDeps),
         rubyDeps: unique(rubyDeps),
         dotnetDeps: unique(dotnetDeps),
         dotnetWebSdk,

package/dist/analyzer/catalogue.d.ts

@@ -17,6 +17,33 @@
 export declare const NODE_BACKEND_FRAMEWORKS: Array<[string, string]>;
 /** Go frameworks, read from go.mod. */
 export declare const GO_BACKEND_FRAMEWORKS: Array<[string, string[]]>;
+/**
+ * Rust frameworks, read from Cargo.toml.
+ *
+ * windmill serves its requests from 547 Rust files and was reported as a Go backend,
+ * because a client SDK in the same repository carries a go.mod and Rust was not read
+ * at all.
+ */
+export declare const RUST_BACKEND_FRAMEWORKS: Array<[string, string[]]>;
+/**
+ * JVM frameworks, read from pom.xml and build.gradle alike.
+ *
+ * A Spring Boot REST API with Spring Security and PostgreSQL reported no backend at
+ * all: the coordinates were never read, and no JVM server framework was ever named.
+ * Coordinates are `group:artifact` in both build systems, so one table serves both.
+ *
+ * `spring-boot-starter-parent` earns its place beside the starters: it is how a Maven
+ * project declares itself a Spring Boot project, and the starters under it inherit
+ * their version from it rather than stating one.
+ */
+export declare const JVM_BACKEND_FRAMEWORKS: Array<[string, string[]]>;
+/**
+ * Databases a JVM project declares by driver.
+ *
+ * The same manifest that names the framework names the database, and a Spring Boot
+ * project with `org.postgresql:postgresql` was reported as having no data layer.
+ */
+export declare const JVM_DATABASES: Array<[string, string[]]>;
 /** Ruby frameworks, read from the Gemfile. */
 export declare const RUBY_BACKEND_FRAMEWORKS: Array<[string, string[]]>;
 /** PHP frameworks, read from composer.json. */

package/dist/analyzer/catalogue.js

@@ -15,7 +15,7 @@
  * that loses users.
  */
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.LANGUAGES = exports.FRONTEND_FRAMEWORKS = exports.PYTHON_BACKEND_FRAMEWORKS = exports.PHP_BACKEND_FRAMEWORKS = exports.RUBY_BACKEND_FRAMEWORKS = exports.GO_BACKEND_FRAMEWORKS = exports.NODE_BACKEND_FRAMEWORKS = void 0;
+exports.LANGUAGES = exports.FRONTEND_FRAMEWORKS = exports.PYTHON_BACKEND_FRAMEWORKS = exports.PHP_BACKEND_FRAMEWORKS = exports.RUBY_BACKEND_FRAMEWORKS = exports.JVM_DATABASES = exports.JVM_BACKEND_FRAMEWORKS = exports.RUST_BACKEND_FRAMEWORKS = exports.GO_BACKEND_FRAMEWORKS = exports.NODE_BACKEND_FRAMEWORKS = void 0;
 exports.labelFor = labelFor;
 exports.hasLabel = hasLabel;
 exports.supportedStacks = supportedStacks;
@@ -43,6 +43,63 @@ exports.GO_BACKEND_FRAMEWORKS = [
     ['gorilla', ['gorilla/mux']],
     ['beego', ['beego/beego']],
 ];
+/**
+ * Rust frameworks, read from Cargo.toml.
+ *
+ * windmill serves its requests from 547 Rust files and was reported as a Go backend,
+ * because a client SDK in the same repository carries a go.mod and Rust was not read
+ * at all.
+ */
+exports.RUST_BACKEND_FRAMEWORKS = [
+    ['axum', ['axum']],
+    ['actix-web', ['actix-web']],
+    ['rocket', ['rocket']],
+    ['warp', ['warp']],
+    ['tide', ['tide']],
+    ['poem', ['poem']],
+    ['salvo', ['salvo']],
+    ['tower-http', ['tower-http']],
+];
+/**
+ * JVM frameworks, read from pom.xml and build.gradle alike.
+ *
+ * A Spring Boot REST API with Spring Security and PostgreSQL reported no backend at
+ * all: the coordinates were never read, and no JVM server framework was ever named.
+ * Coordinates are `group:artifact` in both build systems, so one table serves both.
+ *
+ * `spring-boot-starter-parent` earns its place beside the starters: it is how a Maven
+ * project declares itself a Spring Boot project, and the starters under it inherit
+ * their version from it rather than stating one.
+ */
+exports.JVM_BACKEND_FRAMEWORKS = [
+    ['spring-boot', [
+            'org.springframework.boot:spring-boot-starter-web',
+            'org.springframework.boot:spring-boot-starter-webflux',
+            'org.springframework.boot:spring-boot-starter-parent',
+            'org.springframework.boot:spring-boot-starter',
+        ]],
+    ['quarkus', ['io.quarkus:quarkus-resteasy', 'io.quarkus:quarkus-resteasy-reactive', 'io.quarkus:quarkus-bom']],
+    ['micronaut', ['io.micronaut:micronaut-http-server-netty', 'io.micronaut:micronaut-inject']],
+    ['ktor', ['io.ktor:ktor-server-core', 'io.ktor:ktor-server-netty', 'io.ktor:ktor-server-cio']],
+    ['javalin', ['io.javalin:javalin']],
+    ['vertx', ['io.vertx:vertx-web', 'io.vertx:vertx-core']],
+    ['dropwizard', ['io.dropwizard:dropwizard-core']],
+    ['helidon', ['io.helidon.webserver:helidon-webserver']],
+];
+/**
+ * Databases a JVM project declares by driver.
+ *
+ * The same manifest that names the framework names the database, and a Spring Boot
+ * project with `org.postgresql:postgresql` was reported as having no data layer.
+ */
+exports.JVM_DATABASES = [
+    ['postgres', ['org.postgresql:postgresql', 'io.r2dbc:r2dbc-postgresql']],
+    ['mysql', ['mysql:mysql-connector-java', 'com.mysql:mysql-connector-j']],
+    ['mariadb', ['org.mariadb.jdbc:mariadb-java-client']],
+    ['sqlite', ['org.xerial:sqlite-jdbc']],
+    ['mongodb', ['org.mongodb:mongodb-driver-sync', 'org.mongodb:mongo-java-driver']],
+    ['redis', ['redis.clients:jedis', 'io.lettuce:lettuce-core']],
+];
 /** Ruby frameworks, read from the Gemfile. */
 exports.RUBY_BACKEND_FRAMEWORKS = [
     ['rails', ['rails']],
@@ -138,6 +195,23 @@ const LABELS = {
     chi: 'chi',
     gorilla: 'Gorilla',
     beego: 'Beego',
+    'spring-boot': 'Spring Boot',
+    quarkus: 'Quarkus',
+    micronaut: 'Micronaut',
+    ktor: 'Ktor',
+    javalin: 'Javalin',
+    vertx: 'Vert.x',
+    dropwizard: 'Dropwizard',
+    helidon: 'Helidon',
+    axum: 'Axum',
+    'actix-web': 'Actix Web',
+    rocket: 'Rocket',
+    warp: 'Warp',
+    tide: 'Tide',
+    poem: 'Poem',
+    salvo: 'Salvo',
+    'tower-http': 'Tower HTTP',
+    rust: 'Rust',
     rails: 'Rails',
     sinatra: 'Sinatra',
     hanami: 'Hanami',
@@ -260,6 +334,8 @@ function supportedStacks() {
             ...entries(exports.PYTHON_BACKEND_FRAMEWORKS.map(([id]) => id)),
             ...entries(exports.GO_BACKEND_FRAMEWORKS.map(([id]) => id)),
             { id: 'go', label: 'Go', detectedFrom: 'a go.mod with no framework in it — net/http is a real answer' },
+            ...entries(exports.RUST_BACKEND_FRAMEWORKS.map(([id]) => id)),
+            ...entries(exports.JVM_BACKEND_FRAMEWORKS.map(([id]) => id)),
             ...entries(exports.RUBY_BACKEND_FRAMEWORKS.map(([id]) => id)),
             { id: 'ruby', label: 'Ruby', detectedFrom: 'a Gemfile with no web framework in it' },
             ...entries(exports.PHP_BACKEND_FRAMEWORKS.map(([id]) => id)),

package/dist/analyzer/detectBackend.js

@@ -5,6 +5,30 @@ const detectContext_1 = require("./detectContext");
 const textSearch_1 = require("../utils/textSearch");
 const readTextFileSafe_1 = require("../utils/readTextFileSafe");
 const catalogue_1 = require("./catalogue");
+/**
+ * How much of the source is written in one language.
+ *
+ * A manifest says a language is present; a share says it is what the product is made
+ * of. The mobile detector has drawn this distinction since a single MAUI client
+ * decided the profile of a nine-project .NET solution.
+ */
+function languageShare(ctx, extension) {
+    const source = ctx.files.source;
+    if (source.length === 0)
+        return 0;
+    return source.filter((file) => extension.test(file)).length / source.length;
+}
+/**
+ * Below this a language is present in the repository without being what serves the
+ * requests.
+ *
+ * windmill is the measurement: two Go files beside 547 Rust ones, 0.05% of its source,
+ * and the report said "Backend: go". The line is not tuned to that case — anything
+ * under one file in twenty is a client, a script or a sample, and every backend in the
+ * verification corpus is far above it. A repository genuinely split between two server
+ * languages reports both, which is the right answer for one.
+ */
+const MINIMUM_BACKEND_SHARE = 0.05;
 async function detectBackend(ctx) {
     const frameworks = [];
     const evidence = [];
@@ -63,10 +87,46 @@ async function detectBackend(ctx) {
         for (const dep of hits)
             evidence.push({ type: 'dependency', value: dep });
     }
-    if (!namedGoFramework && ctx.files.all.some((f) => /(^|\/)go\.mod$/.test(f))) {
+    /**
+     * A go.mod is not a Go backend on its own.
+     *
+     * windmill carries one for a client SDK beside 547 Rust files, and the report said
+     * "Backend: go". The same share test the mobile detector already uses: a language
+     * has to be a real part of what is written here before it names the backend.
+     */
+    const goShare = languageShare(ctx, /\.go$/);
+    if (!namedGoFramework && goShare >= MINIMUM_BACKEND_SHARE && ctx.files.all.some((f) => /(^|\/)go\.mod$/.test(f))) {
         frameworks.push('go');
         evidence.push({ type: 'note', value: 'a Go module with no web framework named in go.mod' });
     }
+    /** The JVM, read from pom.xml and build.gradle alike: coordinates are the same shape. */
+    for (const [framework, deps] of catalogue_1.JVM_BACKEND_FRAMEWORKS) {
+        const hits = (0, detectContext_1.hasAnyGradleDep)(ctx, deps);
+        if (!hits.length)
+            continue;
+        frameworks.push(framework);
+        for (const dep of hits)
+            evidence.push({ type: 'dependency', value: dep });
+    }
+    /** Rust, read from Cargo.toml. */
+    let namedRustFramework = false;
+    for (const [framework, deps] of catalogue_1.RUST_BACKEND_FRAMEWORKS) {
+        const hits = (0, detectContext_1.hasAnyRustDep)(ctx, deps);
+        if (!hits.length)
+            continue;
+        namedRustFramework = true;
+        frameworks.push(framework);
+        for (const dep of hits)
+            evidence.push({ type: 'dependency', value: dep });
+    }
+    // Same reasoning as Go: a crate that serves requests from the standard library and a
+    // hand-rolled loop is still a backend, and a Cargo.toml alone is not.
+    if (!namedRustFramework
+        && languageShare(ctx, /\.rs$/) >= MINIMUM_BACKEND_SHARE
+        && ctx.files.all.some((f) => /(^|\/)Cargo\.toml$/.test(f))) {
+        frameworks.push('rust');
+        evidence.push({ type: 'note', value: 'a Cargo manifest with no web framework named in it' });
+    }
     /** Ruby, read from the Gemfile. */
     let namedRubyFramework = false;
     for (const [framework, deps] of catalogue_1.RUBY_BACKEND_FRAMEWORKS) {

package/dist/analyzer/detectContext.d.ts

@@ -26,6 +26,8 @@ export interface DetectContext {
     phpDeps: string[];
     /** Module paths from go.mod, lowercase. */
     goDeps: string[];
+    /** Crate names from Cargo.toml, lowercase. */
+    rustDeps: string[];
     /** Gem names from the Gemfile, lowercase. */
     rubyDeps: string[];
     /** PackageReference and FrameworkReference names from .csproj, lowercase. */
@@ -71,6 +73,7 @@ export declare function hasRuntimeDep(ctx: DetectContext, name: string): boolean
 export declare function hasRuntimePyDep(ctx: DetectContext, name: string): boolean;
 export declare function hasAnyDep(ctx: DetectContext, names: string[]): string[];
 export declare function hasPyDep(ctx: DetectContext, name: string): boolean;
+export declare function hasAnyRustDep(ctx: DetectContext, names: string[]): string[];
 export declare function hasAnyPyDep(ctx: DetectContext, names: string[]): string[];
 export declare function hasPhpDep(ctx: DetectContext, name: string): boolean;
 export declare function hasAnyPhpDep(ctx: DetectContext, names: string[]): string[];

package/dist/analyzer/detectContext.js

@@ -5,6 +5,7 @@ exports.hasRuntimeDep = hasRuntimeDep;
 exports.hasRuntimePyDep = hasRuntimePyDep;
 exports.hasAnyDep = hasAnyDep;
 exports.hasPyDep = hasPyDep;
+exports.hasAnyRustDep = hasAnyRustDep;
 exports.hasAnyPyDep = hasAnyPyDep;
 exports.hasPhpDep = hasPhpDep;
 exports.hasAnyPhpDep = hasAnyPhpDep;
@@ -36,6 +37,9 @@ function hasAnyDep(ctx, names) {
 function hasPyDep(ctx, name) {
     return ctx.pythonDeps.includes(name.toLowerCase());
 }
+function hasAnyRustDep(ctx, names) {
+    return names.filter((name) => ctx.rustDeps.includes(name.toLowerCase()));
+}
 function hasAnyPyDep(ctx, names) {
     return names.filter((n) => hasPyDep(ctx, n));
 }

package/dist/analyzer/detectDatabase.js

@@ -3,6 +3,7 @@ Object.defineProperty(exports, "__esModule", { value: true });
 exports.detectDatabase = detectDatabase;
 const detectContext_1 = require("./detectContext");
 const readTextFileSafe_1 = require("../utils/readTextFileSafe");
+const catalogue_1 = require("./catalogue");
 /**
  * Managed data platforms, and the engine each one actually is.
  *
@@ -94,6 +95,20 @@ async function detectDatabase(ctx) {
                 evidence.push({ type: 'dependency', value: h });
         }
     }
+    /**
+     * The JVM, by driver coordinate.
+     *
+     * The same manifest that names Spring Boot names PostgreSQL, and a Spring Boot API
+     * with `org.postgresql:postgresql` in its pom was reported as having no data layer.
+     */
+    for (const [db, names] of catalogue_1.JVM_DATABASES) {
+        const hits = (0, detectContext_1.hasAnyGradleDep)(ctx, names);
+        if (hits.length) {
+            databases.add(db);
+            for (const h of hits)
+                evidence.push({ type: 'dependency', value: h });
+        }
+    }
     const goHits = [
         ['postgres', ['jackc/pgx', 'jackc/pgx/v5', 'lib/pq']],
         ['mysql', ['go-sql-driver/mysql']],

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@produtype/core",
-  "version": "0.49.0",
+  "version": "0.51.0",
   "description": "Deterministic CLI and library that analyzes a web application repository and reports how far it is from production-ready for the kind of product it is meant to be.",
   "license": "MIT",
   "bin": {