@produtype/core 0.5.0 → 0.7.0

package/dist/analyzer/detectAuth.js

@@ -83,19 +83,32 @@ async function detectAuth(ctx) {
         /organizationId/i,
         /tenantId/i,
         /workspaceId/i,
-        /teamId/i,
     ], 20);
-    const organizationSignals = await (0, textSearch_1.searchInFiles)(ctx.root, sourceFiles, [
-        /organizationId/i,
-        /tenantId/i,
-        /workspaceId/i,
-        /companyId/i,
-        /teamId/i,
-        /organization_id/i,
-        /tenant_id/i,
-        /workspace_id/i,
-    ], 25);
-    const membershipSignals = await (0, textSearch_1.searchInFiles)(ctx.root, sourceFiles, [/memberId/i, /organizationId/i, /tenantId/i, /workspaceId/i, /teamId/i, /companyId/i], 25);
+    /**
+     * Words that only mean tenancy, and words that usually mean something else.
+     *
+     * `organizationId` and `tenantId` are not written by accident. `workspaceId` and
+     * `companyId` are common in SaaS and also in code that talks *about* somebody else's
+     * product, so they are corroborated across files before they count.
+     *
+     * `teamId` was a signal and is gone. In the JavaScript ecosystem it is overwhelmingly
+     * Apple's Developer Team ID: `usebruno/bruno`, a desktop API client with no accounts
+     * of any kind, was classified as a B2B SaaS with high confidence on the strength of
+     * `const teamId = 'W7LPPWA48L'` in its notarization script.
+     */
+    const STRONG_TENANCY = [/organizationId/i, /organization_id/i, /tenantId/i, /tenant_id/i];
+    const WEAK_TENANCY = [/workspaceId/i, /workspace_id/i, /companyId/i];
+    const strongOrganization = await (0, textSearch_1.searchInFiles)(ctx.root, sourceFiles, STRONG_TENANCY, 25);
+    const weakOrganization = await (0, textSearch_1.searchInFiles)(ctx.root, sourceFiles, WEAK_TENANCY, 25);
+    // A weak word never stands on its own, however many files it appears in. Bruno says
+    // `workspaceId` in three — it has workspaces, and they are local folders, not
+    // customers. A tenant boundary is named somewhere by a word that means only that.
+    const organizationSignals = strongOrganization.length > 0
+        ? [...strongOrganization, ...weakOrganization]
+        : [];
+    const strongMembership = await (0, textSearch_1.searchInFiles)(ctx.root, sourceFiles, [/memberId/i, ...STRONG_TENANCY], 25);
+    const weakMembership = await (0, textSearch_1.searchInFiles)(ctx.root, sourceFiles, WEAK_TENANCY, 25);
+    const membershipSignals = strongMembership.length > 0 ? [...strongMembership, ...weakMembership] : [];
     const b2bSignals = await (0, textSearch_1.searchInFiles)(ctx.root, sourceFiles, [
         /stripe/i,
         /subscription/i,

package/dist/analyzer/detectBilling.js

@@ -12,7 +12,18 @@ async function detectBilling(ctx) {
     if (hasStripeDep)
         evidence.push({ type: 'dependency', value: 'stripe' });
     const stripeContextHits = await (0, textSearch_1.searchInFiles)(ctx.root, ctx.files.source, [
-        /\bstripe\b/i,
+        /**
+         * The bare word is not here, on purpose.
+         *
+         * `\bstripe\b` matched `'table-stripe': '#f3f3f3'`, a CSS colour token for
+         * zebra-striped tables, and `{['Stripe API', 'GitHub REST', …]}`, a list of API
+         * names in a design-system demo. Both are in `usebruno/bruno`, a desktop API
+         * client that takes no payments and was reported as a B2B SaaS.
+         *
+         * A project that actually charges people has the dependency, a STRIPE_ variable,
+         * a customer or subscription id, or a webhook path. One that only ever writes
+         * "Stripe" in prose is talking about Stripe, not billing through it.
+         */
         /STRIPE_[A-Z0-9_]+/,
         /stripeCustomerId/i,
         /stripeSubscriptionId/i,

package/dist/api.d.ts

@@ -11,7 +11,7 @@ export type { ProductionReadinessReport, Finding, MaturityLevel, ReportDiagnosti
 export type { CategoryScore } from './report/categoryScores';
 export type { ExecutiveSummary } from './report/executiveSummary';
 export type { ComplianceObligation, ComplianceFramework } from './report/complianceMapping';
-export type { CapabilityGap } from './expectations/types';
+export type { CapabilityGap, DeclaredIntent } from './expectations/types';
 export type { FindingConfidence, EvidenceQuality } from './report/types';
 export type { RemediationPlan, RemediationTask, RemediationPhase } from './planner/types';
 export type { BuildReportOptions } from './report/buildReport';

package/dist/expectations/evaluateExpectations.d.ts

@@ -1,9 +1,10 @@
 import type { ProjectAnalysis } from '../analyzer/types';
-import type { ExpectationEvaluationOutput, ProductProfile } from './types';
+import type { DeclaredIntent, ExpectationEvaluationOutput, ProductProfile } from './types';
 export declare function evaluateExpectedCapabilities(args: {
     analysis: ProjectAnalysis;
     selectedProfile: Exclude<ProductProfile, 'auto' | 'observed-only'>;
     requestedProfile: ProductProfile;
     inferredProfile?: ProductProfile;
     inferenceConfidence?: 'low' | 'medium' | 'high';
+    declared?: DeclaredIntent;
 }): ExpectationEvaluationOutput;

package/dist/expectations/evaluateExpectations.js

@@ -300,6 +300,55 @@ function confidenceFor(status, profileMode, evidenceQuality) {
         return 'medium';
     return 'low';
 }
+/**
+ * Which capabilities each declaration makes required.
+ *
+ * One declaration usually implies several: saying you handle personal data is saying
+ * you owe consent, export, erasure and a retention position, not one of the four.
+ */
+const DECLARED_CAPABILITIES = {
+    handlesPersonalData: ['gdpr.consent', 'gdpr.export', 'gdpr.erasure', 'gdpr.retention'],
+    hasFileUploads: ['uploads.protection'],
+    requiresTenantIsolation: ['tenancy.organization', 'tenancy.isolation'],
+    hasBilling: ['billing.model', 'billing.webhook-integrity'],
+};
+const IMPORTANCE_RANK = {
+    not_applicable: 0,
+    optional: 1,
+    recommended: 2,
+    required: 3,
+};
+/**
+ * The profile's capabilities, with what the owner declared folded in.
+ *
+ * Raising only, never lowering, and adding a capability the profile does not carry
+ * when the declaration calls for it — a static site that says it takes payments is
+ * asking to be judged on payments, and the static-site profile has nothing to say
+ * about them.
+ */
+function applyDeclarations(capabilities, declared) {
+    if (!declared)
+        return capabilities;
+    const required = new Set();
+    for (const [key, ids] of Object.entries(DECLARED_CAPABILITIES)) {
+        // Only a `true` does anything. `false` is not evidence of absence, and treating it
+        // as such would let anyone switch a finding off by answering a form.
+        if (declared[key] === true)
+            for (const id of ids)
+                required.add(id);
+    }
+    if (required.size === 0)
+        return capabilities;
+    const out = capabilities.map((cap) => required.has(cap.id) && IMPORTANCE_RANK[cap.importance] < IMPORTANCE_RANK.required
+        ? { ...cap, importance: 'required' }
+        : cap);
+    const present = new Set(out.map((cap) => cap.id));
+    for (const id of required) {
+        if (!present.has(id))
+            out.push({ ...productProfiles_1.CAPABILITIES[id], importance: 'required' });
+    }
+    return out;
+}
 function evaluateExpectedCapabilities(args) {
     const profile = (0, productProfiles_1.getProductProfile)(args.selectedProfile);
     const evaluations = [];
@@ -329,7 +378,7 @@ function evaluateExpectedCapabilities(args) {
         recommendedPartial: 0,
     };
     const authDetected = detector(args.analysis, 'auth.core')?.present === true;
-    for (const cap of profile.capabilities) {
+    for (const cap of applyDeclarations(profile.capabilities, args.declared)) {
         let effectiveImportance = cap.importance;
         if (cap.id === 'gdpr.baseline' && profile.id === 'internal-tool' && !authDetected) {
             effectiveImportance = 'not_applicable';

package/dist/expectations/productProfiles.d.ts

@@ -16,7 +16,7 @@ type CapabilityBlueprint = Omit<ExpectedCapability, 'importance'>;
  * Every id here must have a case in `deriveStatus` in evaluateExpectations.ts,
  * otherwise it falls back to generic detectorKeys matching.
  */
-declare const CAPABILITIES: {
+export declare const CAPABILITIES: {
     readonly 'auth.baseline': CapabilityBlueprint;
     readonly 'auth.mfa': CapabilityBlueprint;
     readonly 'auth.password-reset': CapabilityBlueprint;

package/dist/expectations/productProfiles.js

@@ -1,6 +1,6 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.productProfiles = void 0;
+exports.productProfiles = exports.CAPABILITIES = void 0;
 exports.productProfileChoices = productProfileChoices;
 exports.getProductProfile = getProductProfile;
 function blueprint(args) {
@@ -17,7 +17,7 @@ function blueprint(args) {
  * Every id here must have a case in `deriveStatus` in evaluateExpectations.ts,
  * otherwise it falls back to generic detectorKeys matching.
  */
-const CAPABILITIES = {
+exports.CAPABILITIES = {
     'auth.baseline': blueprint({
         id: 'auth.baseline',
         title: 'Authentication baseline',
@@ -362,7 +362,7 @@ const CAPABILITIES = {
  */
 function defineProfile(args) {
     const capabilities = Object.entries(args.importance).map(([id, importance]) => ({
-        ...CAPABILITIES[id],
+        ...exports.CAPABILITIES[id],
         importance: importance,
     }));
     return {

package/dist/expectations/types.d.ts

@@ -4,6 +4,24 @@ export type ProductProfile = 'static-site' | 'internal-tool' | 'b2c-app' | 'b2b-
 export type CapabilityImportance = 'required' | 'recommended' | 'optional' | 'not_applicable';
 export type CapabilityStatus = 'present' | 'missing' | 'partial' | 'unknown' | 'not_applicable';
 export type CapabilityCategory = 'auth' | 'authz' | 'tenancy' | 'gdpr' | 'billing' | 'security' | 'uploads' | 'observability' | 'deployment' | 'audit' | 'jobs' | 'client' | 'mobile';
+/**
+ * What the owner says their product does, as distinct from what the code shows.
+ *
+ * A declaration can *add* a duty and can never remove one. Saying "we take payments"
+ * makes the billing capabilities required even where the profile treats them as
+ * optional and even where no Stripe call was found — the statement is evidence about
+ * intent, and a product that intends to charge people has to charge them safely.
+ *
+ * Saying "we have no file uploads" does nothing at all. If an upload route is in the
+ * code, the finding stands: otherwise this is a switch for turning problems off, and a
+ * score with an off switch measures the owner's optimism rather than the product.
+ */
+export interface DeclaredIntent {
+    handlesPersonalData?: boolean;
+    hasFileUploads?: boolean;
+    requiresTenantIsolation?: boolean;
+    hasBilling?: boolean;
+}
 export interface ExpectedCapability {
     id: string;
     title: string;

package/dist/report/buildReport.d.ts

@@ -1,7 +1,16 @@
 import type { ProjectAnalysis } from '../analyzer/types';
 import type { ProductionReadinessReport } from './types';
-import type { ProductProfile } from '../expectations/types';
+import type { DeclaredIntent, ProductProfile } from '../expectations/types';
 export interface BuildReportOptions {
     profile?: ProductProfile;
+    /**
+     * What the owner says the product does.
+     *
+     * Only ever raises an expectation. The cloud application collects these four answers
+     * when a project is created, displayed them as "Product intent", and never passed
+     * them here — so the same report could say "file uploads: No" and raise a critical
+     * about file uploads.
+     */
+    declared?: DeclaredIntent;
 }
 export declare function buildReport(analysis: ProjectAnalysis, options?: BuildReportOptions): ProductionReadinessReport;

package/dist/report/buildReport.js

@@ -87,6 +87,7 @@ function buildReport(analysis, options) {
                     requestedProfile,
                     inferredProfile: inferred.inferredProfile ?? undefined,
                     inferenceConfidence: inferred.confidence,
+                    declared: options?.declared,
                 });
                 productProfile = evaluated.result;
                 expectationFindings = evaluated.findings;
@@ -98,6 +99,7 @@ function buildReport(analysis, options) {
                 analysis,
                 selectedProfile: requestedProfile,
                 requestedProfile,
+                declared: options?.declared,
             });
             productProfile = evaluated.result;
             expectationFindings = evaluated.findings;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@produtype/core",
-  "version": "0.5.0",
+  "version": "0.7.0",
   "description": "Deterministic CLI and library that analyzes a web application repository and reports how far it is from production-ready for the kind of product it is meant to be.",
   "license": "MIT",
   "bin": {