@produtype/core 0.52.0 → 0.53.0

package/dist/analyzer/analyzeProject.js

@@ -188,7 +188,30 @@ function isTestOrExamplePath(file) {
          * band — against a line written to be fake.
          */
         || /[-_]tests?\.(ts|tsx|js|jsx|mjs|cjs|py)$/i.test(file)
-        || /\.(test|spec)\.(ts|tsx|js|jsx|mjs|cjs|py)$/i.test(file);
+        || /\.(test|spec)\.(ts|tsx|js|jsx|mjs|cjs|py)$/i.test(file)
+        /**
+         * Sample code, which is what a documentation repository is made of.
+         *
+         * Every one of ktor-documentation's 435 Kotlin files sits under
+         * `codeSnippets/snippets/`, and the report judged them as a product: nine essential
+         * capabilities missing at `high`, including email verification and GDPR consent,
+         * for a repository that is documentation.
+         *
+         * `examples` was already here in the sense that mattered to Node; `samples` and
+         * `snippets` are the same idea spelled the way the JVM and the Rust ecosystems
+         * spell it. A repository whose every source file is a sample now has no source
+         * files, and says so — which is the honest answer for one.
+         */
+        || /(^|\/)(samples?|snippets?|codesnippets)(\/|$)/i.test(file)
+        /**
+         * Somebody else's code, vendored in.
+         *
+         * meilisearch was reported as using Rocket. Rocket appears once in the repository,
+         * as a dev-dependency of `external-crates/reqwest-eventsource` — a third-party
+         * crate copied in whole. A manifest under a vendor directory is a statement about
+         * that library, not about this product.
+         */
+        || /(^|\/)(vendor|vendored|third[-_]?party|external[-_]crates)(\/|$)/i.test(file);
 }
 /**
  * Extensions the detectors can read.
@@ -367,6 +390,18 @@ async function analyzeProject(projectPath) {
     const configFiles = pickConfig(allFiles);
     const packageJsonRaw = await (0, readTextFileSafe_1.readJsonSafe)(root, 'package.json');
     const packageJson = packageJsonRaw ? packageJsonSchema.parse(packageJsonRaw) : null;
+    /**
+     * The manifests this project owns, without the ones it merely contains.
+     *
+     * A vendored crate, a sample application and a test harness each carry a manifest,
+     * and each says something about itself rather than about the product. meilisearch
+     * was reported as using Rocket on the strength of a dev-dependency inside
+     * `external-crates/reqwest-eventsource` — a third-party library copied in whole.
+     *
+     * The same rule the source list has always used, applied to the file list the
+     * manifest readers walk.
+     */
+    const ownManifests = allFiles.filter((f) => !isTestOrExamplePath(f));
     const packageJsonFiles = allFiles.filter((f) => f.endsWith('package.json'));
     const requirementsFiles = allFiles.filter((f) => /(^|\/)requirements\.txt$/i.test(f));
     const pyprojectFiles = allFiles.filter((f) => /(^|\/)pyproject\.toml$/i.test(f));
@@ -427,7 +462,7 @@ async function analyzeProject(projectPath) {
      * than a wrong answer.
      */
     const goDeps = [];
-    for (const file of allFiles.filter((f) => /(^|\/)go\.mod$/.test(f))) {
+    for (const file of ownManifests.filter((f) => /(^|\/)go\.mod$/.test(f))) {
         const raw = (await (0, readTextFileSafe_1.readTextFileSafe)(root, file)) ?? '';
         for (const line of raw.split('\n')) {
             const match = /^\s*(?:require\s+)?([a-z0-9][\w.-]*(?:\.[a-z]{2,})?\/[\w./-]+)\s+v/i.exec(line);
@@ -449,27 +484,44 @@ async function analyzeProject(projectPath) {
      * read.
      */
     const rustDeps = [];
-    for (const file of allFiles.filter((f) => /(^|\/)Cargo\.toml$/.test(f))) {
+    /**
+     * The crates the product ships with, without the ones it only builds and tests with.
+     *
+     * meilisearch was reported as using Rocket, from a `[dev-dependencies]` block. The
+     * same distinction `runtimeNpmDeps` draws for the reason axios taught: a web
+     * framework in dev-dependencies is a test server, and the question "what serves the
+     * requests" is answered by what ships.
+     */
+    const runtimeRustDeps = [];
+    for (const file of ownManifests.filter((f) => /(^|\/)Cargo\.toml$/.test(f))) {
         const raw = (await (0, readTextFileSafe_1.readTextFileSafe)(root, file)) ?? '';
         let inDeps = false;
+        let runtimeSection = false;
         for (const line of raw.split('\n')) {
             const heading = /^\s*\[([^\]]+)\]/.exec(line);
             if (heading) {
                 const section = heading[1].trim();
                 const nested = /^(?:[a-z-]+\.)?(?:dependencies|dev-dependencies|build-dependencies)\.(.+)$/.exec(section);
                 if (nested) {
-                    rustDeps.push(nested[1].trim().toLowerCase());
+                    const crate = nested[1].trim().toLowerCase();
+                    rustDeps.push(crate);
+                    if (/(^|\.)dependencies\./.test(section))
+                        runtimeRustDeps.push(crate);
                     inDeps = false;
                     continue;
                 }
                 inDeps = /(^|\.)(dependencies|dev-dependencies|build-dependencies)$/.test(section);
+                runtimeSection = /(^|\.)dependencies$/.test(section);
                 continue;
             }
             if (!inDeps)
                 continue;
             const entry = /^\s*([A-Za-z0-9_-]+)\s*=/.exec(line);
-            if (entry)
+            if (entry) {
                 rustDeps.push(entry[1].toLowerCase());
+                if (runtimeSection)
+                    runtimeRustDeps.push(entry[1].toLowerCase());
+            }
         }
     }
     /**
@@ -482,7 +534,7 @@ async function analyzeProject(projectPath) {
      * from.
      */
     const dartDeps = [];
-    for (const file of allFiles.filter((f) => /(^|\/)pubspec\.yaml$/.test(f))) {
+    for (const file of ownManifests.filter((f) => /(^|\/)pubspec\.yaml$/.test(f))) {
         const raw = (await (0, readTextFileSafe_1.readTextFileSafe)(root, file)) ?? '';
         let inDeps = false;
         for (const line of raw.split('\n')) {
@@ -543,13 +595,13 @@ async function analyzeProject(projectPath) {
      * no dependencies rather than a wrong answer.
      */
     const gradleDeps = [];
-    for (const file of allFiles.filter((f) => /(^|\/)pom\.xml$/.test(f))) {
+    for (const file of ownManifests.filter((f) => /(^|\/)pom\.xml$/.test(f))) {
         const raw = (await (0, readTextFileSafe_1.readTextFileSafe)(root, file)) ?? '';
         for (const match of raw.matchAll(/<groupId>\s*([^<\s]+)\s*<\/groupId>\s*<artifactId>\s*([^<\s]+)\s*<\/artifactId>/g)) {
             gradleDeps.push(`${match[1]}:${match[2]}`.toLowerCase());
         }
     }
-    for (const file of allFiles.filter((f) => /(^|\/)build\.gradle(\.kts)?$/.test(f))) {
+    for (const file of ownManifests.filter((f) => /(^|\/)build\.gradle(\.kts)?$/.test(f))) {
         const raw = (await (0, readTextFileSafe_1.readTextFileSafe)(root, file)) ?? '';
         for (const match of raw.matchAll(/\b(?:implementation|api|compileOnly|runtimeOnly|kapt|ksp|annotationProcessor|testImplementation)\s*[( ]\s*["']([^"']+)["']/g)) {
             const [group, artifact] = match[1].split(':');
@@ -557,7 +609,7 @@ async function analyzeProject(projectPath) {
                 gradleDeps.push(`${group}:${artifact}`.toLowerCase());
         }
     }
-    for (const file of allFiles.filter((f) => /(^|\/)libs\.versions\.toml$/.test(f))) {
+    for (const file of ownManifests.filter((f) => /(^|\/)libs\.versions\.toml$/.test(f))) {
         const raw = (await (0, readTextFileSafe_1.readTextFileSafe)(root, file)) ?? '';
         // Two spellings, both common: group and name as separate keys, or one `module`
         // holding the coordinate. Order within the line varies, so each is matched on its
@@ -586,13 +638,13 @@ async function analyzeProject(projectPath) {
      * CocoaPods is simpler and still in wide use: `pod 'Alamofire'`.
      */
     const swiftDeps = [];
-    for (const file of allFiles.filter((f) => /(^|\/)Package\.swift$/.test(f))) {
+    for (const file of ownManifests.filter((f) => /(^|\/)Package\.swift$/.test(f))) {
         const raw = (await (0, readTextFileSafe_1.readTextFileSafe)(root, file)) ?? '';
         for (const match of raw.matchAll(/\.package\s*\(\s*url:\s*["']https?:\/\/[^"']*?\/([^/"']+?)\/([^/"']+?)(?:\.git)?["']/g)) {
             swiftDeps.push(`${match[1]}/${match[2]}`.toLowerCase());
         }
     }
-    for (const file of allFiles.filter((f) => /(^|\/)Podfile$/.test(f))) {
+    for (const file of ownManifests.filter((f) => /(^|\/)Podfile$/.test(f))) {
         const raw = (await (0, readTextFileSafe_1.readTextFileSafe)(root, file)) ?? '';
         for (const match of raw.matchAll(/^\s*pod\s+["']([^"'/]+)/gm)) {
             swiftDeps.push(match[1].toLowerCase());
@@ -613,7 +665,7 @@ async function analyzeProject(projectPath) {
      */
     const dotnetDeps = [];
     let dotnetWebSdk = false;
-    for (const file of allFiles.filter((f) => /\.(csproj|fsproj|vbproj)$/i.test(f))) {
+    for (const file of ownManifests.filter((f) => /\.(csproj|fsproj|vbproj)$/i.test(f))) {
         const raw = (await (0, readTextFileSafe_1.readTextFileSafe)(root, file)) ?? '';
         if (/Sdk\s*=\s*["']Microsoft\.NET\.Sdk\.Web["']/i.test(raw))
             dotnetWebSdk = true;
@@ -626,7 +678,7 @@ async function analyzeProject(projectPath) {
         }
     }
     const rubyDeps = [];
-    for (const file of allFiles.filter((f) => /(^|\/)Gemfile$/.test(f))) {
+    for (const file of ownManifests.filter((f) => /(^|\/)Gemfile$/.test(f))) {
         const raw = (await (0, readTextFileSafe_1.readTextFileSafe)(root, file)) ?? '';
         for (const line of raw.split('\n')) {
             // Skip commented-out gems, which are otherwise indistinguishable from real ones.
@@ -725,6 +777,7 @@ async function analyzeProject(projectPath) {
         phpDeps: unique(phpDeps),
         goDeps: unique(goDeps),
         rustDeps: unique(rustDeps),
+        runtimeRustDeps: unique(runtimeRustDeps),
         rubyDeps: unique(rubyDeps),
         dotnetDeps: unique(dotnetDeps),
         dotnetWebSdk,

package/dist/analyzer/detectBackend.js

@@ -111,7 +111,7 @@ async function detectBackend(ctx) {
     /** Rust, read from Cargo.toml. */
     let namedRustFramework = false;
     for (const [framework, deps] of catalogue_1.RUST_BACKEND_FRAMEWORKS) {
-        const hits = (0, detectContext_1.hasAnyRustDep)(ctx, deps);
+        const hits = (0, detectContext_1.hasAnyRuntimeRustDep)(ctx, deps);
         if (!hits.length)
             continue;
         namedRustFramework = true;

package/dist/analyzer/detectContext.d.ts

@@ -28,6 +28,8 @@ export interface DetectContext {
     goDeps: string[];
     /** Crate names from Cargo.toml, lowercase. */
     rustDeps: string[];
+    /** Of those, the ones the product ships with rather than only builds and tests with. */
+    runtimeRustDeps: string[];
     /** Gem names from the Gemfile, lowercase. */
     rubyDeps: string[];
     /** PackageReference and FrameworkReference names from .csproj, lowercase. */
@@ -74,6 +76,8 @@ export declare function hasRuntimePyDep(ctx: DetectContext, name: string): boole
 export declare function hasAnyDep(ctx: DetectContext, names: string[]): string[];
 export declare function hasPyDep(ctx: DetectContext, name: string): boolean;
 export declare function hasAnyRustDep(ctx: DetectContext, names: string[]): string[];
+/** The Rust counterpart of `hasRuntimeDep`: shipped, not merely present. */
+export declare function hasAnyRuntimeRustDep(ctx: DetectContext, names: string[]): string[];
 export declare function hasAnyPyDep(ctx: DetectContext, names: string[]): string[];
 export declare function hasPhpDep(ctx: DetectContext, name: string): boolean;
 export declare function hasAnyPhpDep(ctx: DetectContext, names: string[]): string[];

package/dist/analyzer/detectContext.js

@@ -6,6 +6,7 @@ exports.hasRuntimePyDep = hasRuntimePyDep;
 exports.hasAnyDep = hasAnyDep;
 exports.hasPyDep = hasPyDep;
 exports.hasAnyRustDep = hasAnyRustDep;
+exports.hasAnyRuntimeRustDep = hasAnyRuntimeRustDep;
 exports.hasAnyPyDep = hasAnyPyDep;
 exports.hasPhpDep = hasPhpDep;
 exports.hasAnyPhpDep = hasAnyPhpDep;
@@ -40,6 +41,10 @@ function hasPyDep(ctx, name) {
 function hasAnyRustDep(ctx, names) {
     return names.filter((name) => ctx.rustDeps.includes(name.toLowerCase()));
 }
+/** The Rust counterpart of `hasRuntimeDep`: shipped, not merely present. */
+function hasAnyRuntimeRustDep(ctx, names) {
+    return names.filter((name) => ctx.runtimeRustDeps.includes(name.toLowerCase()));
+}
 function hasAnyPyDep(ctx, names) {
     return names.filter((n) => hasPyDep(ctx, n));
 }

package/dist/report/executiveSummary.js

@@ -134,10 +134,23 @@ function buildVerdict(args) {
             launchReady: null,
         };
     }
-    if (!args.profile) {
+    /**
+     * No profile applied is not a profile satisfied.
+     *
+     * An inconclusive inference produces a profile record with an empty gap — nothing
+     * required, so nothing missing — and the verdict read "This project covers
+     * everything expected of Auto (inconclusive). What remains is refinement, not
+     * blockers." meilisearch, a search engine somebody self-hosts, was told it was ready
+     * to launch because no expectations had been applied to it.
+     *
+     * It is the same mistake as every other one this run has found, in the strongest
+     * possible direction: absence read as satisfaction.
+     */
+    if (!args.profile || args.profile.selectedProfile === 'auto') {
         return {
             verdict: `Judged on its code alone, this project looks like ${MATURITY_LABEL[args.maturity]}. Choose a product profile to see what it would still need to launch.`,
-            launchReady: args.maturity === 'production_ready',
+            // Launch readiness is a question about a profile. Without one it was not asked.
+            launchReady: args.profile ? null : args.maturity === 'production_ready',
         };
     }
     const { gap, profileTitle } = args.profile;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@produtype/core",
-  "version": "0.52.0",
+  "version": "0.53.0",
   "description": "Deterministic CLI and library that analyzes a web application repository and reports how far it is from production-ready for the kind of product it is meant to be.",
   "license": "MIT",
   "bin": {