@produtype/core 0.5.0 → 0.6.0

package/dist/api.d.ts

@@ -11,7 +11,7 @@ export type { ProductionReadinessReport, Finding, MaturityLevel, ReportDiagnosti
 export type { CategoryScore } from './report/categoryScores';
 export type { ExecutiveSummary } from './report/executiveSummary';
 export type { ComplianceObligation, ComplianceFramework } from './report/complianceMapping';
-export type { CapabilityGap } from './expectations/types';
+export type { CapabilityGap, DeclaredIntent } from './expectations/types';
 export type { FindingConfidence, EvidenceQuality } from './report/types';
 export type { RemediationPlan, RemediationTask, RemediationPhase } from './planner/types';
 export type { BuildReportOptions } from './report/buildReport';

package/dist/expectations/evaluateExpectations.d.ts

@@ -1,9 +1,10 @@
 import type { ProjectAnalysis } from '../analyzer/types';
-import type { ExpectationEvaluationOutput, ProductProfile } from './types';
+import type { DeclaredIntent, ExpectationEvaluationOutput, ProductProfile } from './types';
 export declare function evaluateExpectedCapabilities(args: {
     analysis: ProjectAnalysis;
     selectedProfile: Exclude<ProductProfile, 'auto' | 'observed-only'>;
     requestedProfile: ProductProfile;
     inferredProfile?: ProductProfile;
     inferenceConfidence?: 'low' | 'medium' | 'high';
+    declared?: DeclaredIntent;
 }): ExpectationEvaluationOutput;

package/dist/expectations/evaluateExpectations.js

@@ -300,6 +300,55 @@ function confidenceFor(status, profileMode, evidenceQuality) {
         return 'medium';
     return 'low';
 }
+/**
+ * Which capabilities each declaration makes required.
+ *
+ * One declaration usually implies several: saying you handle personal data is saying
+ * you owe consent, export, erasure and a retention position, not one of the four.
+ */
+const DECLARED_CAPABILITIES = {
+    handlesPersonalData: ['gdpr.consent', 'gdpr.export', 'gdpr.erasure', 'gdpr.retention'],
+    hasFileUploads: ['uploads.protection'],
+    requiresTenantIsolation: ['tenancy.organization', 'tenancy.isolation'],
+    hasBilling: ['billing.model', 'billing.webhook-integrity'],
+};
+const IMPORTANCE_RANK = {
+    not_applicable: 0,
+    optional: 1,
+    recommended: 2,
+    required: 3,
+};
+/**
+ * The profile's capabilities, with what the owner declared folded in.
+ *
+ * Raising only, never lowering, and adding a capability the profile does not carry
+ * when the declaration calls for it — a static site that says it takes payments is
+ * asking to be judged on payments, and the static-site profile has nothing to say
+ * about them.
+ */
+function applyDeclarations(capabilities, declared) {
+    if (!declared)
+        return capabilities;
+    const required = new Set();
+    for (const [key, ids] of Object.entries(DECLARED_CAPABILITIES)) {
+        // Only a `true` does anything. `false` is not evidence of absence, and treating it
+        // as such would let anyone switch a finding off by answering a form.
+        if (declared[key] === true)
+            for (const id of ids)
+                required.add(id);
+    }
+    if (required.size === 0)
+        return capabilities;
+    const out = capabilities.map((cap) => required.has(cap.id) && IMPORTANCE_RANK[cap.importance] < IMPORTANCE_RANK.required
+        ? { ...cap, importance: 'required' }
+        : cap);
+    const present = new Set(out.map((cap) => cap.id));
+    for (const id of required) {
+        if (!present.has(id))
+            out.push({ ...productProfiles_1.CAPABILITIES[id], importance: 'required' });
+    }
+    return out;
+}
 function evaluateExpectedCapabilities(args) {
     const profile = (0, productProfiles_1.getProductProfile)(args.selectedProfile);
     const evaluations = [];
@@ -329,7 +378,7 @@ function evaluateExpectedCapabilities(args) {
         recommendedPartial: 0,
     };
     const authDetected = detector(args.analysis, 'auth.core')?.present === true;
-    for (const cap of profile.capabilities) {
+    for (const cap of applyDeclarations(profile.capabilities, args.declared)) {
         let effectiveImportance = cap.importance;
         if (cap.id === 'gdpr.baseline' && profile.id === 'internal-tool' && !authDetected) {
             effectiveImportance = 'not_applicable';

package/dist/expectations/productProfiles.d.ts

@@ -16,7 +16,7 @@ type CapabilityBlueprint = Omit<ExpectedCapability, 'importance'>;
  * Every id here must have a case in `deriveStatus` in evaluateExpectations.ts,
  * otherwise it falls back to generic detectorKeys matching.
  */
-declare const CAPABILITIES: {
+export declare const CAPABILITIES: {
     readonly 'auth.baseline': CapabilityBlueprint;
     readonly 'auth.mfa': CapabilityBlueprint;
     readonly 'auth.password-reset': CapabilityBlueprint;

package/dist/expectations/productProfiles.js

@@ -1,6 +1,6 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.productProfiles = void 0;
+exports.productProfiles = exports.CAPABILITIES = void 0;
 exports.productProfileChoices = productProfileChoices;
 exports.getProductProfile = getProductProfile;
 function blueprint(args) {
@@ -17,7 +17,7 @@ function blueprint(args) {
  * Every id here must have a case in `deriveStatus` in evaluateExpectations.ts,
  * otherwise it falls back to generic detectorKeys matching.
  */
-const CAPABILITIES = {
+exports.CAPABILITIES = {
     'auth.baseline': blueprint({
         id: 'auth.baseline',
         title: 'Authentication baseline',
@@ -362,7 +362,7 @@ const CAPABILITIES = {
  */
 function defineProfile(args) {
     const capabilities = Object.entries(args.importance).map(([id, importance]) => ({
-        ...CAPABILITIES[id],
+        ...exports.CAPABILITIES[id],
         importance: importance,
     }));
     return {

package/dist/expectations/types.d.ts

@@ -4,6 +4,24 @@ export type ProductProfile = 'static-site' | 'internal-tool' | 'b2c-app' | 'b2b-
 export type CapabilityImportance = 'required' | 'recommended' | 'optional' | 'not_applicable';
 export type CapabilityStatus = 'present' | 'missing' | 'partial' | 'unknown' | 'not_applicable';
 export type CapabilityCategory = 'auth' | 'authz' | 'tenancy' | 'gdpr' | 'billing' | 'security' | 'uploads' | 'observability' | 'deployment' | 'audit' | 'jobs' | 'client' | 'mobile';
+/**
+ * What the owner says their product does, as distinct from what the code shows.
+ *
+ * A declaration can *add* a duty and can never remove one. Saying "we take payments"
+ * makes the billing capabilities required even where the profile treats them as
+ * optional and even where no Stripe call was found — the statement is evidence about
+ * intent, and a product that intends to charge people has to charge them safely.
+ *
+ * Saying "we have no file uploads" does nothing at all. If an upload route is in the
+ * code, the finding stands: otherwise this is a switch for turning problems off, and a
+ * score with an off switch measures the owner's optimism rather than the product.
+ */
+export interface DeclaredIntent {
+    handlesPersonalData?: boolean;
+    hasFileUploads?: boolean;
+    requiresTenantIsolation?: boolean;
+    hasBilling?: boolean;
+}
 export interface ExpectedCapability {
     id: string;
     title: string;

package/dist/report/buildReport.d.ts

@@ -1,7 +1,16 @@
 import type { ProjectAnalysis } from '../analyzer/types';
 import type { ProductionReadinessReport } from './types';
-import type { ProductProfile } from '../expectations/types';
+import type { DeclaredIntent, ProductProfile } from '../expectations/types';
 export interface BuildReportOptions {
     profile?: ProductProfile;
+    /**
+     * What the owner says the product does.
+     *
+     * Only ever raises an expectation. The cloud application collects these four answers
+     * when a project is created, displayed them as "Product intent", and never passed
+     * them here — so the same report could say "file uploads: No" and raise a critical
+     * about file uploads.
+     */
+    declared?: DeclaredIntent;
 }
 export declare function buildReport(analysis: ProjectAnalysis, options?: BuildReportOptions): ProductionReadinessReport;

package/dist/report/buildReport.js

@@ -87,6 +87,7 @@ function buildReport(analysis, options) {
                     requestedProfile,
                     inferredProfile: inferred.inferredProfile ?? undefined,
                     inferenceConfidence: inferred.confidence,
+                    declared: options?.declared,
                 });
                 productProfile = evaluated.result;
                 expectationFindings = evaluated.findings;
@@ -98,6 +99,7 @@ function buildReport(analysis, options) {
                 analysis,
                 selectedProfile: requestedProfile,
                 requestedProfile,
+                declared: options?.declared,
             });
             productProfile = evaluated.result;
             expectationFindings = evaluated.findings;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@produtype/core",
-  "version": "0.5.0",
+  "version": "0.6.0",
   "description": "Deterministic CLI and library that analyzes a web application repository and reports how far it is from production-ready for the kind of product it is meant to be.",
   "license": "MIT",
   "bin": {