@produtype/core 0.51.0 → 0.52.0

package/dist/analyzer/detectPackageManager.js

@@ -15,18 +15,40 @@ const OTHER_MANIFESTS = [
     { manager: 'pub', pattern: /(^|\/)pubspec\.yaml$/ },
     { manager: 'composer', pattern: /(^|\/)composer\.json$/ },
     { manager: 'go modules', pattern: /(^|\/)go\.mod$/ },
+    { manager: 'cargo', pattern: /(^|\/)Cargo\.toml$/ },
     { manager: 'bundler', pattern: /(^|\/)Gemfile$/ },
     { manager: 'gradle', pattern: /(^|\/)build\.gradle(\.kts)?$/ },
     { manager: 'maven', pattern: /(^|\/)pom\.xml$/ },
     { manager: 'nuget', pattern: /\.(csproj|fsproj|vbproj)$/i },
 ];
+/**
+ * The shallowest manifest wins, and list order only breaks a tie.
+ *
+ * The list was scanned in order, so the first pattern with any match anywhere decided.
+ * A Rust service with a small Go client SDK beside it reported its package manager as
+ * "go modules" while the line above it said the backend was axum — two lines of the
+ * same report disagreeing about what the project is.
+ *
+ * Depth is the signal that was already there. A manifest at the root, or nearer it, is
+ * the project's; one buried under `sdk/go/` belongs to something the project ships
+ * rather than something it is built with.
+ */
 function resolveFromOtherManifests(files) {
-    for (const { manager, pattern } of OTHER_MANIFESTS) {
-        const match = files.find((file) => pattern.test(file));
-        if (match)
-            return { manager, confidence: 'manifest', warnings: [], evidence: [match] };
-    }
-    return null;
+    let best = null;
+    OTHER_MANIFESTS.forEach(({ manager, pattern }, order) => {
+        for (const file of files) {
+            if (!pattern.test(file))
+                continue;
+            const depth = file.split('/').length;
+            if (!best || depth < best.depth || (depth === best.depth && order < best.order)) {
+                best = { manager, file, depth, order };
+            }
+        }
+    });
+    if (!best)
+        return null;
+    const { manager, file } = best;
+    return { manager, confidence: 'manifest', warnings: [], evidence: [file] };
 }
 function resolveWorkspaceManager(workspace) {
     const warnings = [];

package/dist/analyzer/types.d.ts

@@ -10,7 +10,7 @@
  * Only managers whose manifest this analyzer actually reads are named here. A name it
  * cannot back with a parsed file would be a guess from a filename.
  */
-export type PackageManager = 'npm' | 'pnpm' | 'yarn' | 'pip' | 'poetry' | 'python' | 'pub' | 'composer' | 'go modules' | 'bundler' | 'gradle' | 'maven' | 'nuget' | 'unknown';
+export type PackageManager = 'npm' | 'pnpm' | 'yarn' | 'pip' | 'poetry' | 'python' | 'pub' | 'composer' | 'go modules' | 'cargo' | 'bundler' | 'gradle' | 'maven' | 'nuget' | 'unknown';
 export type PackageManagerConfidence = 'lockfile' | 'manifest' | 'inferred' | 'unknown';
 export interface WorkspaceStack {
     root: string;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@produtype/core",
-  "version": "0.51.0",
+  "version": "0.52.0",
   "description": "Deterministic CLI and library that analyzes a web application repository and reports how far it is from production-ready for the kind of product it is meant to be.",
   "license": "MIT",
   "bin": {