@produtype/core 0.6.0 → 0.7.1

package/dist/analyzer/analyzeProject.js

@@ -135,7 +135,10 @@ function parsePyproject(text) {
     return deps;
 }
 function isTestOrExamplePath(file) {
-    return /(^|\/)(__tests__|tests?|test-data|fixtures|frontend-example)(\/|$)/i.test(file)
+    // `__mocks__` was missing, and a mock is the most misleading file in a repository:
+    // `application_fee_percent: null` inside a Stripe fixture made an open-source CRM read
+    // as a marketplace taking a cut. A field set to null is evidence of absence.
+    return /(^|\/)(__tests__|__mocks__|mocks?|tests?|test-data|fixtures|frontend-example)(\/|$)/i.test(file)
         || /(^|\/)test[-_][^/]+\.(ts|tsx|js|jsx|mjs|cjs|py)$/i.test(file)
         || /\.(test|spec)\.(ts|tsx|js|jsx|mjs|cjs|py)$/i.test(file);
 }

package/dist/analyzer/detectAuth.js

@@ -83,19 +83,32 @@ async function detectAuth(ctx) {
         /organizationId/i,
         /tenantId/i,
         /workspaceId/i,
-        /teamId/i,
     ], 20);
-    const organizationSignals = await (0, textSearch_1.searchInFiles)(ctx.root, sourceFiles, [
-        /organizationId/i,
-        /tenantId/i,
-        /workspaceId/i,
-        /companyId/i,
-        /teamId/i,
-        /organization_id/i,
-        /tenant_id/i,
-        /workspace_id/i,
-    ], 25);
-    const membershipSignals = await (0, textSearch_1.searchInFiles)(ctx.root, sourceFiles, [/memberId/i, /organizationId/i, /tenantId/i, /workspaceId/i, /teamId/i, /companyId/i], 25);
+    /**
+     * Words that only mean tenancy, and words that usually mean something else.
+     *
+     * `organizationId` and `tenantId` are not written by accident. `workspaceId` and
+     * `companyId` are common in SaaS and also in code that talks *about* somebody else's
+     * product, so they are corroborated across files before they count.
+     *
+     * `teamId` was a signal and is gone. In the JavaScript ecosystem it is overwhelmingly
+     * Apple's Developer Team ID: `usebruno/bruno`, a desktop API client with no accounts
+     * of any kind, was classified as a B2B SaaS with high confidence on the strength of
+     * `const teamId = 'W7LPPWA48L'` in its notarization script.
+     */
+    const STRONG_TENANCY = [/organizationId/i, /organization_id/i, /tenantId/i, /tenant_id/i];
+    const WEAK_TENANCY = [/workspaceId/i, /workspace_id/i, /companyId/i];
+    const strongOrganization = await (0, textSearch_1.searchInFiles)(ctx.root, sourceFiles, STRONG_TENANCY, 25);
+    const weakOrganization = await (0, textSearch_1.searchInFiles)(ctx.root, sourceFiles, WEAK_TENANCY, 25);
+    // A weak word never stands on its own, however many files it appears in. Bruno says
+    // `workspaceId` in three — it has workspaces, and they are local folders, not
+    // customers. A tenant boundary is named somewhere by a word that means only that.
+    const organizationSignals = strongOrganization.length > 0
+        ? [...strongOrganization, ...weakOrganization]
+        : [];
+    const strongMembership = await (0, textSearch_1.searchInFiles)(ctx.root, sourceFiles, [/memberId/i, ...STRONG_TENANCY], 25);
+    const weakMembership = await (0, textSearch_1.searchInFiles)(ctx.root, sourceFiles, WEAK_TENANCY, 25);
+    const membershipSignals = strongMembership.length > 0 ? [...strongMembership, ...weakMembership] : [];
     const b2bSignals = await (0, textSearch_1.searchInFiles)(ctx.root, sourceFiles, [
         /stripe/i,
         /subscription/i,

package/dist/analyzer/detectBilling.js

@@ -12,7 +12,18 @@ async function detectBilling(ctx) {
     if (hasStripeDep)
         evidence.push({ type: 'dependency', value: 'stripe' });
     const stripeContextHits = await (0, textSearch_1.searchInFiles)(ctx.root, ctx.files.source, [
-        /\bstripe\b/i,
+        /**
+         * The bare word is not here, on purpose.
+         *
+         * `\bstripe\b` matched `'table-stripe': '#f3f3f3'`, a CSS colour token for
+         * zebra-striped tables, and `{['Stripe API', 'GitHub REST', …]}`, a list of API
+         * names in a design-system demo. Both are in `usebruno/bruno`, a desktop API
+         * client that takes no payments and was reported as a B2B SaaS.
+         *
+         * A project that actually charges people has the dependency, a STRIPE_ variable,
+         * a customer or subscription id, or a webhook path. One that only ever writes
+         * "Stripe" in prose is talking about Stripe, not billing through it.
+         */
         /STRIPE_[A-Z0-9_]+/,
         /stripeCustomerId/i,
         /stripeSubscriptionId/i,

package/dist/analyzer/detectMarketplace.js

@@ -36,15 +36,34 @@ async function detectMultiRole(ctx) {
     for (const hit of [...sellerHits, ...buyerHits]) {
         evidence.push({ type: 'snippet', value: hit.snippet, file: hit.file, line: hit.line });
     }
-    const roleFiles = ctx.files.all
-        .filter((file) => /(seller|merchant|storefront)/i.test(file))
-        .slice(0, 20);
+    /**
+     * File names that suggest a supply side — read from the analysed sources, not from
+     * every path in the repository.
+     *
+     * `twentyhq/twenty`, an open-source CRM, ships an example real-estate app whose
+     * `roles/seller.role.ts` matched here. Scanning `files.all` meant any path anywhere
+     * counted, including bundled demos and vendored code.
+     */
+    const roleFiles = scope.filter((file) => /(seller|merchant|storefront)/i.test(file)).slice(0, 20);
     for (const file of roleFiles)
         evidence.push({ type: 'file', value: file });
     // Both sides must appear for a confident signal: a supply-side vocabulary on its own
     // also fits a plain catalogue or CMS, so it downgrades to partial rather than present.
-    const bothSides = sellerHits.length > 0 && buyerHits.length > 0;
-    const oneSide = sellerHits.length > 0 || buyerHits.length > 0 || roleFiles.length > 0;
+    /**
+     * Two sides are not one sentence.
+     *
+     * `documenso`, an open-source document-signing product, came out a marketplace with
+     * high confidence on a single line: a comment in a field-detection schema listing
+     * `"Tenant", "Landlord", "Buyer", "Seller"` as examples of labels found in the
+     * documents its users sign. One line matched both sides, and one line is one
+     * mention.
+     */
+    const vocabularyFiles = new Set([...sellerHits, ...buyerHits].map((hit) => hit.file));
+    const bothSides = sellerHits.length > 0 && buyerHits.length > 0 && vocabularyFiles.size >= 2;
+    // A file name on its own is not a role either. Twenty had four such names and no
+    // buyer or seller vocabulary anywhere in its code, and came out a marketplace:
+    // naming a file is cheaper than building a two-sided product.
+    const oneSide = vocabularyFiles.size >= 2;
     return {
         key: 'marketplace.multiRole',
         present: oneSide,
@@ -78,7 +97,18 @@ async function detectPayout(ctx) {
 }
 async function detectCommission(ctx) {
     const evidence = [];
-    const hits = await (0, textSearch_1.searchInFiles)(ctx.root, ctx.files.source, [/\bcommission/i, /application_fee/i, /\bplatform_?fee/i, /\btake_?rate/i, /\bservice_?fee/i], 20);
+    const hits = await (0, textSearch_1.searchInFiles)(ctx.root, ctx.files.source, [
+        // "Commission" is also an institution. The privacy policy of an open-source CRM
+        // said "European Commission, relying on an adequacy decision" and was read as a
+        // platform taking a cut, sixteen times over.
+        /commission[_\s]?(rate|fee|percent|amount|bps)/i,
+        /(rate|fee|percent|amount)[_\s]?commission/i,
+        /\bcommission[A-Z]/,
+        /application_fee/i,
+        /\bplatform_?fee/i,
+        /\btake_?rate/i,
+        /\bservice_?fee/i,
+    ], 20);
     for (const hit of hits)
         evidence.push({ type: 'snippet', value: hit.snippet, file: hit.file, line: hit.line });
     return {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@produtype/core",
-  "version": "0.6.0",
+  "version": "0.7.1",
   "description": "Deterministic CLI and library that analyzes a web application repository and reports how far it is from production-ready for the kind of product it is meant to be.",
   "license": "MIT",
   "bin": {