@produtype/core 0.7.0 → 0.8.0

package/dist/analyzer/analyzeProject.js

@@ -135,7 +135,10 @@ function parsePyproject(text) {
     return deps;
 }
 function isTestOrExamplePath(file) {
-    return /(^|\/)(__tests__|tests?|test-data|fixtures|frontend-example)(\/|$)/i.test(file)
+    // `__mocks__` was missing, and a mock is the most misleading file in a repository:
+    // `application_fee_percent: null` inside a Stripe fixture made an open-source CRM read
+    // as a marketplace taking a cut. A field set to null is evidence of absence.
+    return /(^|\/)(__tests__|__mocks__|mocks?|tests?|test-data|fixtures|frontend-example)(\/|$)/i.test(file)
         || /(^|\/)test[-_][^/]+\.(ts|tsx|js|jsx|mjs|cjs|py)$/i.test(file)
         || /\.(test|spec)\.(ts|tsx|js|jsx|mjs|cjs|py)$/i.test(file);
 }

package/dist/analyzer/detectMarketplace.js

@@ -36,15 +36,34 @@ async function detectMultiRole(ctx) {
     for (const hit of [...sellerHits, ...buyerHits]) {
         evidence.push({ type: 'snippet', value: hit.snippet, file: hit.file, line: hit.line });
     }
-    const roleFiles = ctx.files.all
-        .filter((file) => /(seller|merchant|storefront)/i.test(file))
-        .slice(0, 20);
+    /**
+     * File names that suggest a supply side — read from the analysed sources, not from
+     * every path in the repository.
+     *
+     * `twentyhq/twenty`, an open-source CRM, ships an example real-estate app whose
+     * `roles/seller.role.ts` matched here. Scanning `files.all` meant any path anywhere
+     * counted, including bundled demos and vendored code.
+     */
+    const roleFiles = scope.filter((file) => /(seller|merchant|storefront)/i.test(file)).slice(0, 20);
     for (const file of roleFiles)
         evidence.push({ type: 'file', value: file });
     // Both sides must appear for a confident signal: a supply-side vocabulary on its own
     // also fits a plain catalogue or CMS, so it downgrades to partial rather than present.
-    const bothSides = sellerHits.length > 0 && buyerHits.length > 0;
-    const oneSide = sellerHits.length > 0 || buyerHits.length > 0 || roleFiles.length > 0;
+    /**
+     * Two sides are not one sentence.
+     *
+     * `documenso`, an open-source document-signing product, came out a marketplace with
+     * high confidence on a single line: a comment in a field-detection schema listing
+     * `"Tenant", "Landlord", "Buyer", "Seller"` as examples of labels found in the
+     * documents its users sign. One line matched both sides, and one line is one
+     * mention.
+     */
+    const vocabularyFiles = new Set([...sellerHits, ...buyerHits].map((hit) => hit.file));
+    const bothSides = sellerHits.length > 0 && buyerHits.length > 0 && vocabularyFiles.size >= 2;
+    // A file name on its own is not a role either. Twenty had four such names and no
+    // buyer or seller vocabulary anywhere in its code, and came out a marketplace:
+    // naming a file is cheaper than building a two-sided product.
+    const oneSide = vocabularyFiles.size >= 2;
     return {
         key: 'marketplace.multiRole',
         present: oneSide,
@@ -78,7 +97,18 @@ async function detectPayout(ctx) {
 }
 async function detectCommission(ctx) {
     const evidence = [];
-    const hits = await (0, textSearch_1.searchInFiles)(ctx.root, ctx.files.source, [/\bcommission/i, /application_fee/i, /\bplatform_?fee/i, /\btake_?rate/i, /\bservice_?fee/i], 20);
+    const hits = await (0, textSearch_1.searchInFiles)(ctx.root, ctx.files.source, [
+        // "Commission" is also an institution. The privacy policy of an open-source CRM
+        // said "European Commission, relying on an adequacy decision" and was read as a
+        // platform taking a cut, sixteen times over.
+        /commission[_\s]?(rate|fee|percent|amount|bps)/i,
+        /(rate|fee|percent|amount)[_\s]?commission/i,
+        /\bcommission[A-Z]/,
+        /application_fee/i,
+        /\bplatform_?fee/i,
+        /\btake_?rate/i,
+        /\bservice_?fee/i,
+    ], 20);
     for (const hit of hits)
         evidence.push({ type: 'snippet', value: hit.snippet, file: hit.file, line: hit.line });
     return {

package/dist/expectations/evaluateExpectations.js

@@ -287,19 +287,51 @@ function evidenceQualityFor(detectors) {
     }
     return 'weak';
 }
-function confidenceFor(status, profileMode, evidenceQuality) {
-    if (profileMode !== 'observed-only' && profileMode !== 'auto' && status !== 'unknown') {
-        return 'high';
-    }
-    if (profileMode === 'auto') {
-        return evidenceQuality === 'strong' ? 'medium' : 'low';
-    }
+/**
+ * How sure the analyzer is about *this* finding.
+ *
+ * It used to fold in how the profile was chosen: on `auto` — which is what the hosted
+ * product uses by default — every finding came out low or medium however strong its
+ * evidence. Two different uncertainties were being multiplied into one number, and the
+ * profile's own uncertainty is already reported separately as `inferenceConfidence`.
+ *
+ * An independent review of a real report put it plainly: eleven findings of
+ * thirty-two carried "no direct evidence captured" at low confidence and weak
+ * evidence, and still arrived as critical or high.
+ */
+function confidenceFor(status, evidenceQuality) {
+    // Nothing was determined, so there is nothing to be confident about.
+    if (status === 'unknown')
+        return 'low';
     if (evidenceQuality === 'strong')
         return 'high';
     if (evidenceQuality === 'medium')
         return 'medium';
     return 'low';
 }
+/**
+ * Severity says how bad it would be if true. Confidence says whether it is.
+ *
+ * A reader treats `critical` as "stop and fix this", and spending that word on a claim
+ * the analyzer itself is unsure of is how a tool becomes a checklist nobody trusts.
+ * The claim stays, at the weight the evidence supports.
+ */
+function severityForConfidence(severity, confidence) {
+    if (confidence !== 'low')
+        return severity;
+    /**
+     * `critical` only. Not a ceiling at `medium`, which was the first attempt and was
+     * wrong for a reason worth writing down: a missing capability cannot carry direct
+     * evidence — there is no line to point at for something that is not there — so every
+     * absence reads as low confidence, and capping them all at `medium` would leave the
+     * report unable to say anything is serious.
+     *
+     * What it can stop doing is shouting. `critical` is read as "stop and fix this
+     * before anything else", and the analyzer should not spend that word on a claim it
+     * could not evidence.
+     */
+    return severity === 'critical' ? 'high' : severity;
+}
 /**
  * Which capabilities each declaration makes required.
  *
@@ -390,10 +422,11 @@ function evaluateExpectedCapabilities(args) {
             effectiveImportance = 'not_applicable';
         }
         const findingId = toFindingId(cap, effectiveImportance);
-        const severity = severityFor(cap, status, effectiveImportance);
+        const claimedSeverity = severityFor(cap, status, effectiveImportance);
         const detectorEvidence = evidenceFor(args.analysis, cap).flatMap((d) => d.evidence);
         const quality = evidenceQualityFor(evidenceFor(args.analysis, cap));
-        const confidence = confidenceFor(status, args.requestedProfile, quality);
+        const confidence = confidenceFor(status, quality);
+        const severity = severityForConfidence(claimedSeverity, confidence);
         const evaluation = {
             capabilityId: cap.id,
             title: cap.title,

package/dist/report/categoryScores.js

@@ -52,7 +52,16 @@ function buildCategoryScores(findings) {
             findingCount: actionable.length,
             criticalCount: actionable.filter((finding) => finding.severity === 'critical').length,
             highCount: actionable.filter((finding) => finding.severity === 'high').length,
-            notAssessed: categoryFindings.length === 0,
+            /**
+             * "I don't know" is not an assessment.
+             *
+             * This was `categoryFindings.length === 0`, so a single `info` finding with
+             * status `unknown` — the analyzer recording that it could not tell — made the
+             * category count as assessed, with zero actionable findings and a score of 100.
+             * A Django school platform with no payments anywhere was reported as having
+             * "no issues found in taking payments", as a strength.
+             */
+            notAssessed: categoryFindings.every((finding) => finding.status === 'unknown'),
         };
     });
 }

package/dist/report/executiveSummary.js

@@ -83,8 +83,19 @@ function buildVerdict(args) {
 }
 function buildStrengths(categoryScores, findings) {
     const passed = findings.filter((finding) => finding.status === 'passed');
+    /**
+     * A strength is something verified, not something absent.
+     *
+     * Filtering on "assessed, scoring well, nothing open" let a category qualify on the
+     * strength of having nothing to say about it. Requiring a passed check means the
+     * report only calls something a strength when it watched it work.
+     */
+    const passedCategories = new Set(passed.map((finding) => finding.category));
     const strongCategories = categoryScores
-        .filter((entry) => !entry.notAssessed && entry.score >= 80 && entry.findingCount === 0)
+        .filter((entry) => !entry.notAssessed
+        && entry.score >= 80
+        && entry.findingCount === 0
+        && passedCategories.has(entry.category))
         .map((entry) => CATEGORY_LABEL[entry.category]);
     const strengths = strongCategories.slice(0, 3).map((label) => `no issues found in ${label}`);
     if (strengths.length === 0 && passed.length > 0) {

package/dist/rules/rules.js

@@ -46,6 +46,23 @@ function evidenceQualityFor(evidence) {
     }
     return 'weak';
 }
+/** Severity is capped by how sure the analyzer is. See the note where it is used. */
+function severityForConfidence(severity, confidence) {
+    if (confidence !== 'low')
+        return severity;
+    /**
+     * `critical` only. Not a ceiling at `medium`, which was the first attempt and was
+     * wrong for a reason worth writing down: a missing capability cannot carry direct
+     * evidence — there is no line to point at for something that is not there — so every
+     * absence reads as low confidence, and capping them all at `medium` would leave the
+     * report unable to say anything is serious.
+     *
+     * What it can stop doing is shouting. `critical` is read as "stop and fix this
+     * before anything else", and the analyzer should not spend that word on a claim it
+     * could not evidence.
+     */
+    return severity === 'critical' ? 'high' : severity;
+}
 function confidenceFor(status, evidenceQuality) {
     if (status === 'passed' && evidenceQuality === 'strong') {
         return 'high';
@@ -60,16 +77,24 @@ function confidenceFor(status, evidenceQuality) {
 }
 function mkFinding(args) {
     const evidenceQuality = evidenceQualityFor(args.evidence);
+    const confidence = confidenceFor(args.status, evidenceQuality);
     return {
         id: args.id,
         title: args.title,
         category: args.category,
         status: args.status,
-        severity: args.severity,
+        /**
+         * The same rule the expectations follow: severity says how bad it would be if true,
+         * confidence says whether it is, and a reader treats `critical` as "stop and fix
+         * this". Spending that word on something the analyzer is unsure of is how a report
+         * stops being believed — and it was doing it on both sides of the report, not only
+         * in the expectation half.
+         */
+        severity: severityForConfidence(args.severity, confidence),
         description: args.description,
         recommendation: args.recommendation,
         evidence: detectorEvidence(args.evidence),
-        confidence: confidenceFor(args.status, evidenceQuality),
+        confidence,
         evidenceQuality,
     };
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@produtype/core",
-  "version": "0.7.0",
+  "version": "0.8.0",
   "description": "Deterministic CLI and library that analyzes a web application repository and reports how far it is from production-ready for the kind of product it is meant to be.",
   "license": "MIT",
   "bin": {