@produtype/core 0.6.0 → 0.7.0

package/dist/analyzer/detectAuth.js

@@ -83,19 +83,32 @@ async function detectAuth(ctx) {
         /organizationId/i,
         /tenantId/i,
         /workspaceId/i,
-        /teamId/i,
     ], 20);
-    const organizationSignals = await (0, textSearch_1.searchInFiles)(ctx.root, sourceFiles, [
-        /organizationId/i,
-        /tenantId/i,
-        /workspaceId/i,
-        /companyId/i,
-        /teamId/i,
-        /organization_id/i,
-        /tenant_id/i,
-        /workspace_id/i,
-    ], 25);
-    const membershipSignals = await (0, textSearch_1.searchInFiles)(ctx.root, sourceFiles, [/memberId/i, /organizationId/i, /tenantId/i, /workspaceId/i, /teamId/i, /companyId/i], 25);
+    /**
+     * Words that only mean tenancy, and words that usually mean something else.
+     *
+     * `organizationId` and `tenantId` are not written by accident. `workspaceId` and
+     * `companyId` are common in SaaS and also in code that talks *about* somebody else's
+     * product, so they are corroborated across files before they count.
+     *
+     * `teamId` was a signal and is gone. In the JavaScript ecosystem it is overwhelmingly
+     * Apple's Developer Team ID: `usebruno/bruno`, a desktop API client with no accounts
+     * of any kind, was classified as a B2B SaaS with high confidence on the strength of
+     * `const teamId = 'W7LPPWA48L'` in its notarization script.
+     */
+    const STRONG_TENANCY = [/organizationId/i, /organization_id/i, /tenantId/i, /tenant_id/i];
+    const WEAK_TENANCY = [/workspaceId/i, /workspace_id/i, /companyId/i];
+    const strongOrganization = await (0, textSearch_1.searchInFiles)(ctx.root, sourceFiles, STRONG_TENANCY, 25);
+    const weakOrganization = await (0, textSearch_1.searchInFiles)(ctx.root, sourceFiles, WEAK_TENANCY, 25);
+    // A weak word never stands on its own, however many files it appears in. Bruno says
+    // `workspaceId` in three — it has workspaces, and they are local folders, not
+    // customers. A tenant boundary is named somewhere by a word that means only that.
+    const organizationSignals = strongOrganization.length > 0
+        ? [...strongOrganization, ...weakOrganization]
+        : [];
+    const strongMembership = await (0, textSearch_1.searchInFiles)(ctx.root, sourceFiles, [/memberId/i, ...STRONG_TENANCY], 25);
+    const weakMembership = await (0, textSearch_1.searchInFiles)(ctx.root, sourceFiles, WEAK_TENANCY, 25);
+    const membershipSignals = strongMembership.length > 0 ? [...strongMembership, ...weakMembership] : [];
     const b2bSignals = await (0, textSearch_1.searchInFiles)(ctx.root, sourceFiles, [
         /stripe/i,
         /subscription/i,

package/dist/analyzer/detectBilling.js

@@ -12,7 +12,18 @@ async function detectBilling(ctx) {
     if (hasStripeDep)
         evidence.push({ type: 'dependency', value: 'stripe' });
     const stripeContextHits = await (0, textSearch_1.searchInFiles)(ctx.root, ctx.files.source, [
-        /\bstripe\b/i,
+        /**
+         * The bare word is not here, on purpose.
+         *
+         * `\bstripe\b` matched `'table-stripe': '#f3f3f3'`, a CSS colour token for
+         * zebra-striped tables, and `{['Stripe API', 'GitHub REST', …]}`, a list of API
+         * names in a design-system demo. Both are in `usebruno/bruno`, a desktop API
+         * client that takes no payments and was reported as a B2B SaaS.
+         *
+         * A project that actually charges people has the dependency, a STRIPE_ variable,
+         * a customer or subscription id, or a webhook path. One that only ever writes
+         * "Stripe" in prose is talking about Stripe, not billing through it.
+         */
         /STRIPE_[A-Z0-9_]+/,
         /stripeCustomerId/i,
         /stripeSubscriptionId/i,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@produtype/core",
-  "version": "0.6.0",
+  "version": "0.7.0",
   "description": "Deterministic CLI and library that analyzes a web application repository and reports how far it is from production-ready for the kind of product it is meant to be.",
   "license": "MIT",
   "bin": {