@produtype/core 0.61.0 → 0.62.0

package/dist/analyzer/detectObservability.js

@@ -4,9 +4,35 @@ exports.detectObservability = detectObservability;
 const detectContext_1 = require("./detectContext");
 const textSearch_1 = require("../utils/textSearch");
 const absenceEvidence_1 = require("./absenceEvidence");
+const valuesFromPackage_1 = require("./structural/valuesFromPackage");
+/**
+ * Logging packages, which the ecosystem names and the author does not.
+ *
+ * The list was four long and the search beside it read `logger.` — the author's own
+ * variable. A repository using Roarr, bound to `shout`, was reported as having no
+ * logging at all: wrong package, wrong variable, two ways to miss the same thing.
+ *
+ * A list of package names is still a list, but it is a list of names nobody in the
+ * repository being analysed chose. That is the difference the whole exercise is about.
+ */
+const LOGGING_PACKAGES = [
+    'winston',
+    'pino',
+    'morgan',
+    'bunyan',
+    'roarr',
+    'loglevel',
+    'signale',
+    'consola',
+    'tslog',
+    'log4js',
+    '@logtail/node',
+    'debug',
+    'npmlog',
+];
 async function detectObservability(ctx) {
     const evidence = [];
-    const logDeps = (0, detectContext_1.hasAnyDep)(ctx, ['winston', 'pino', 'morgan', 'bunyan']);
+    const logDeps = (0, detectContext_1.hasAnyDep)(ctx, LOGGING_PACKAGES);
     const sentryDeps = (0, detectContext_1.hasAnyDep)(ctx, ['@sentry/node', 'sentry-sdk']);
     for (const d of logDeps)
         evidence.push({ type: 'dependency', value: d, claim: 'logging' });
@@ -70,6 +96,26 @@ async function detectObservability(ctx) {
     const plainLogging = await (0, textSearch_1.searchInFiles)(ctx.root, ctx.files.source, [/\berror_log\s*\(/, /\bsyslog\s*\(/, /console\.(error|warn)\s*\(/, /\bprintStackTrace\s*\(/], 10);
     for (const m of plainLogging)
         evidence.push({ type: 'snippet', value: m.snippet, file: m.file, line: m.line, claim: 'logging' });
+    /**
+     * Where a value from a logging package is used, whatever it was called.
+     *
+     * `const shout = Roarr.child(...)` then `shout.info(...)` is structured logging, and
+     * the text search cannot see it because `shout` is a name its author invented. The
+     * import is the anchor and the binding is the chain.
+     *
+     * Evidence, not verdict, and the distinction is measured rather than assumed. This
+     * walk can only fire where one of the packages above is imported, and a package that
+     * is imported is a package the manifest declares — workspace manifests included, as
+     * a monorepo fixture confirmed. So it never changes the answer, and the clause that
+     * pretended it might was removed rather than left to look load-bearing.
+     *
+     * What it does change is what the reader is shown: "pino is in your package.json"
+     * becomes "pino is used at server.js:8". The claim was always about the second.
+     */
+    const boundLoggerUses = await (0, valuesFromPackage_1.readPackageValueUses)(ctx.root, ctx.files.source, LOGGING_PACKAGES);
+    for (const use of (boundLoggerUses ?? []).slice(0, 10)) {
+        evidence.push({ type: 'file', value: `a logger from ${logDeps[0] ?? 'a logging package'} is used here`, file: use.file, line: use.line, claim: 'logging' });
+    }
     const hasStructuredLogging = logDeps.length > 0 || structuredHits.length > 0;
     const hasAnyLogging = hasStructuredLogging || plainLogging.length > 0;
     if (!hasHealth) {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@produtype/core",
-  "version": "0.61.0",
+  "version": "0.62.0",
   "description": "Deterministic CLI and library that analyzes a web application repository and reports how far it is from production-ready for the kind of product it is meant to be.",
   "license": "MIT",
   "bin": {