@produtype/core 0.74.0 → 0.76.0

package/dist/analyzer/analyzeProject.js

@@ -651,6 +651,25 @@ async function analyzeProject(projectPath) {
             swiftDeps.push(match[1].toLowerCase());
         }
     }
+    /**
+     * Package.resolved, which is where a Swift project's dependencies are actually
+     * legible.
+     *
+     * `Package.swift` is read above, and on a real application it usually declares the
+     * modules of that package rather than the whole tree: WordPress-iOS resolves 40-odd
+     * packages and `sentry-cocoa` — its crash reporter — appears only here. The lockfile
+     * is data rather than source, it names every transitive dependency, and it is
+     * committed by convention, which makes it the better of the two to read.
+     *
+     * `identity` rather than `location`, because that is the name SPM itself uses and
+     * the one that survives a repository moving host.
+     */
+    for (const file of ownManifests.filter((f) => /(^|\/)Package\.resolved$/.test(f))) {
+        const raw = (await (0, readTextFileSafe_1.readTextFileSafe)(root, file)) ?? '';
+        for (const match of raw.matchAll(/"identity"\s*:\s*"([^"]+)"/g)) {
+            swiftDeps.push(match[1].toLowerCase());
+        }
+    }
     /**
      * .csproj, which is XML rather than JSON or one-entry-per-line.
      *

package/dist/analyzer/detectErrorReporting.js

@@ -29,9 +29,74 @@ const REPORTER_DEPS = [
     'trackjs',
 ];
 const REPORTER_PY_DEPS = ['sentry-sdk', 'rollbar', 'bugsnag'];
+/**
+ * The same capability, in the ecosystems where the browser does not exist.
+ *
+ * This detector was written for code running in a tab and then made `required` for the
+ * mobile-app profile, where none of what it reads can occur: an iOS application has no
+ * `window.onerror` and no npm dependency. Three real repositories measured — DuckDuckGo
+ * iOS, thunderbird-android, WordPress-iOS — and all three were told at `high` that a
+ * crash on someone's phone reaches nobody. A check whose answer cannot vary is not a
+ * measure.
+ *
+ * Coordinates rather than words, matched as substrings by the helpers: `io.sentry` also
+ * covers `io.sentry:sentry-android`, and `sentry-cocoa` is how SPM names the package
+ * whatever the product is called.
+ */
+const REPORTER_GRADLE_DEPS = [
+    'io.sentry',
+    'com.google.firebase:firebase-crashlytics',
+    'com.bugsnag',
+    'com.microsoft.appcenter:appcenter-crashes',
+    'ch.acra:acra',
+    'io.embrace',
+    'com.datadoghq:dd-sdk-android',
+    'com.instabug',
+];
+const REPORTER_SWIFT_DEPS = [
+    'sentry-cocoa',
+    'sentry-cocoa-spm',
+    'firebase-ios-sdk',
+    'firebasecrashlytics',
+    'bugsnag-cocoa',
+    'appcenter-sdk-apple',
+    'instabug',
+    'embrace-apple-sdk',
+];
+const REPORTER_DART_DEPS = ['sentry_flutter', 'firebase_crashlytics', 'bugsnag_flutter'];
+/**
+ * Handlers the platform defines, which no author names.
+ *
+ * `NSSetUncaughtExceptionHandler` is Foundation, `Thread.setDefaultUncaughtExceptionHandler`
+ * is the JVM, `FlutterError.onError` is Flutter. Each is the one place its platform
+ * lets a program learn that it is about to die, so a call to it is the capability
+ * itself rather than a word that tends to accompany it — thunderbird-android installs
+ * one and was reported as having nothing.
+ *
+ * `SentrySDK.start` and `FirebaseCrashlytics` are here as well as in the dependency
+ * lists: a repository can use a reporter whose manifest is in another repository, and
+ * the call is still a call.
+ */
+const PLATFORM_CRASH_HANDLERS = [
+    /NSSetUncaughtExceptionHandler\s*\(/,
+    // `(` or `{`: Kotlin writes the handler as a trailing lambda, which is how both real
+    // Android applications measured install theirs.
+    /setDefaultUncaughtExceptionHandler\s*[({]/,
+    /FlutterError\s*\.\s*onError\s*=/,
+    /PlatformDispatcher\s*\.\s*instance\s*\.\s*onError\s*=/,
+    /SentrySDK\s*\.\s*start\s*\(/,
+    /Sentry\s*\.\s*init\s*\(/,
+    /FirebaseCrashlytics|Crashlytics\s*\.\s*crashlytics\s*\(/,
+];
 async function detectErrorReporting(ctx) {
     const evidence = [];
-    const deps = [...(0, detectContext_1.hasAnyDep)(ctx, REPORTER_DEPS), ...(0, detectContext_1.hasAnyPyDep)(ctx, REPORTER_PY_DEPS)];
+    const deps = [
+        ...(0, detectContext_1.hasAnyDep)(ctx, REPORTER_DEPS),
+        ...(0, detectContext_1.hasAnyPyDep)(ctx, REPORTER_PY_DEPS),
+        ...(0, detectContext_1.hasAnyGradleDep)(ctx, REPORTER_GRADLE_DEPS),
+        ...(0, detectContext_1.hasAnySwiftDep)(ctx, REPORTER_SWIFT_DEPS),
+        ...(0, detectContext_1.hasAnyDartDep)(ctx, REPORTER_DART_DEPS),
+    ];
     for (const dep of deps)
         evidence.push({ type: 'dependency', value: dep });
     /**
@@ -44,6 +109,7 @@ async function detectErrorReporting(ctx) {
         /window\.addEventListener\s*\(\s*['"]unhandledrejection['"]/,
         /window\.onerror\s*=/,
         /componentDidCatch\s*\([^)]*\)\s*\{[^}]*(fetch|report|log)/s,
+        ...PLATFORM_CRASH_HANDLERS,
     ], 10);
     for (const hit of handlers) {
         evidence.push({ type: 'snippet', value: hit.snippet, file: hit.file, line: hit.line });
@@ -54,7 +120,7 @@ async function detectErrorReporting(ctx) {
         // A reporting service is wired up once and covers everything; a hand-rolled handler
         // usually covers what its author remembered.
         complete: deps.length > 0,
-        evidence: (0, absenceEvidence_1.evidenceOrSearch)(evidence, 'somewhere a crash in the browser is sent', ['@sentry/browser', '@sentry/react', '@bugsnag/js', 'rollbar', 'logrocket', '@datadog/browser-rum', 'sentry-sdk', 'window.onerror', 'addEventListener("error")', 'addEventListener("unhandledrejection")']),
+        evidence: (0, absenceEvidence_1.evidenceOrSearch)(evidence, 'somewhere a crash in the browser is sent', ['@sentry/browser', '@sentry/react', '@bugsnag/js', 'rollbar', 'logrocket', '@datadog/browser-rum', 'sentry-sdk', 'window.onerror', 'addEventListener("error")', 'addEventListener("unhandledrejection")', 'NSSetUncaughtExceptionHandler', 'Thread.setDefaultUncaughtExceptionHandler', 'FlutterError.onError', 'sentry-cocoa', 'io.sentry', 'firebase-crashlytics']),
         details: { services: deps, handlers: handlers.length },
     };
 }

package/dist/analyzer/detectGame.js

@@ -3,6 +3,7 @@ Object.defineProperty(exports, "__esModule", { value: true });
 exports.detectGame = detectGame;
 const detectContext_1 = require("./detectContext");
 const textSearch_1 = require("../utils/textSearch");
+const localStores_1 = require("./localStores");
 const absenceEvidence_1 = require("./absenceEvidence");
 /**
  * Whether this project is a game.
@@ -151,20 +152,42 @@ async function detectStatePersistence(ctx) {
     }
     // A database is the durable half. Read from the stack rather than re-detected, so
     // this agrees with what the report says the data layer is.
-    const durable = ctx.files.all.some((file) => /(^|\/)(schema\.prisma|.*\.sql)$/i.test(file))
+    const serverStore = ctx.files.all.some((file) => /(^|\/)(schema\.prisma|.*\.sql)$/i.test(file))
         || Boolean(ctx.packageJson?.dependencies?.pg)
         || Boolean(ctx.packageJson?.dependencies?.mongoose)
         || Boolean(ctx.packageJson?.dependencies?.['better-sqlite3']);
-    if (durable)
+    /**
+     * On a device, the local store is the durable one.
+     *
+     * This whole check was written for a game in a browser, where `localStorage` is the
+     * partial case because a cleared cache takes the save with it. That reasoning does
+     * not carry to a phone: Core Data and SQLite survive the application being killed,
+     * the device restarting and the person coming back a week later — they are the
+     * durable half there, not the fragile one.
+     *
+     * It is required of the mobile-app profile, and all four real applications measured
+     * came back `partial` on it while keeping everything they own on disk. The failure
+     * this should catch on a phone is different and still caught: state held only in
+     * memory, written nowhere, gone when the operating system reclaims the process.
+     */
+    const deviceStore = await (0, localStores_1.readLocalStores)(ctx, 3);
+    const onDevice = deviceStore.dependencies.length > 0 || deviceStore.uses.length > 0;
+    const durable = serverStore || onDevice;
+    if (serverStore)
         evidence.push({ type: 'note', value: 'a durable store is present' });
+    for (const dep of deviceStore.dependencies)
+        evidence.push({ type: 'dependency', value: dep });
+    for (const use of deviceStore.uses) {
+        evidence.push({ type: 'snippet', value: use.snippet, file: use.file, line: use.line });
+    }
     const saves = clientOnly.length > 0 || saveRoutes.length > 0;
     return {
         key: 'app.stateDurability',
         present: saves || durable,
         // Client storage alone is the partial case: it saves, until it does not.
         complete: durable,
-        evidence: (0, absenceEvidence_1.evidenceOrSearch)(evidence, 'anywhere progress is written down', ['localStorage', 'sessionStorage', 'IndexedDB', 'a save route', 'schema.prisma', 'a .sql file', 'pg', 'mongoose', 'better-sqlite3']),
-        details: { durable, clientStorage: clientOnly.length > 0, saveRoutines: saveRoutes.length },
+        evidence: (0, absenceEvidence_1.evidenceOrSearch)(evidence, 'anywhere progress is written down', ['localStorage', 'sessionStorage', 'IndexedDB', 'a save route', 'schema.prisma', 'a .sql file', 'pg', 'mongoose', 'better-sqlite3', 'Core Data', 'SQLiteOpenHelper', 'Room', 'sqflite']),
+        details: { durable, serverStore, onDevice, clientStorage: clientOnly.length > 0, saveRoutines: saveRoutes.length },
     };
 }
 /**

package/dist/analyzer/detectMobile.js

@@ -4,6 +4,7 @@ exports.detectMobile = detectMobile;
 const detectContext_1 = require("./detectContext");
 const readTextFileSafe_1 = require("../utils/readTextFileSafe");
 const textSearch_1 = require("../utils/textSearch");
+const localStores_1 = require("./localStores");
 const absenceEvidence_1 = require("./absenceEvidence");
 /**
  * Whether this is an application that ships to somebody else's phone, and what that
@@ -71,17 +72,6 @@ const SECURE_STORAGE_SWIFT = [
     'square/valet',
     'valet',
 ];
-/** Local databases, by platform, that let an app open without a network. */
-const OFFLINE_GRADLE = ['androidx.room', 'io.realm', 'io.objectbox', 'com.squareup.sqldelight', 'app.cash.sqldelight'];
-const OFFLINE_SWIFT = [
-    'groue/grdb.swift',
-    'grdb.swift',
-    'stephencelis/sqlite.swift',
-    'sqlite.swift',
-    'realm/realm-swift',
-    'realm/realm-cocoa',
-    'realmswift',
-];
 /** Dependencies that put a secret somewhere the operating system protects. */
 const SECURE_STORAGE_DEPS = [
     'flutter_secure_storage',
@@ -91,22 +81,6 @@ const SECURE_STORAGE_DEPS = [
     '@capacitor/preferences',
     'capacitor-secure-storage-plugin',
 ];
-/** Dependencies whose whole purpose is that the app works with no network. */
-const OFFLINE_DEPS = [
-    'sqflite',
-    'drift',
-    'hive',
-    'isar',
-    'objectbox',
-    'realm',
-    'watermelondb',
-    '@nozbe/watermelondb',
-    'react-native-mmkv',
-    '@react-native-async-storage/async-storage',
-    'redux-persist',
-    '@tanstack/query-persist-client-core',
-    'powersync',
-];
 /**
  * Paths that contain a platform marker without being a project.
  *
@@ -303,20 +277,23 @@ async function detectMobile(ctx) {
             line: match.line,
         })),
     ];
-    const offlineDeps = [
-        ...(0, detectContext_1.hasAnyDep)(ctx, OFFLINE_DEPS),
-        ...(0, detectContext_1.hasAnyDartDep)(ctx, OFFLINE_DEPS),
-        ...(0, detectContext_1.hasAnyGradleDep)(ctx, OFFLINE_GRADLE),
-        ...(0, detectContext_1.hasAnySwiftDep)(ctx, OFFLINE_SWIFT),
-    ];
+    const localStores = await (0, localStores_1.readLocalStores)(ctx);
+    const offlineDeps = localStores.dependencies;
     /**
      * A local database is the strong signal; knowing the network dropped is the weak
      * one. Both are recorded, because an app that stores nothing but tells the user the
      * connection is gone is a different thing from one that shows a spinner forever.
      */
     const connectivityChecks = await (0, textSearch_1.searchInFiles)(ctx.root, ctx.files.source, [/Connectivity\(\)/, /connectivity_plus/, /NetInfo\./, /navigator\.onLine/, /NWPathMonitor/, /isReachable/], 3);
+    const platformStores = localStores.uses;
     const offlineEvidence = [
         ...offlineDeps.map((dep) => ({ type: 'dependency', value: dep })),
+        ...platformStores.map((match) => ({
+            type: 'snippet',
+            value: match.snippet,
+            file: match.file,
+            line: match.line,
+        })),
         ...connectivityChecks.map((match) => ({
             type: 'snippet',
             value: match.snippet,
@@ -361,8 +338,8 @@ async function detectMobile(ctx) {
         },
         {
             key: 'mobile.offline',
-            present: offlineDeps.length > 0,
-            evidence: (0, absenceEvidence_1.evidenceOrSearch)(offlineEvidence, 'a local database the app can read with no network', ['sqflite', 'drift', 'hive', 'isar', 'objectbox', 'realm', 'androidx.room', 'sqldelight', 'grdb.swift', 'sqlite.swift']),
+            present: offlineDeps.length > 0 || platformStores.length > 0,
+            evidence: (0, absenceEvidence_1.evidenceOrSearch)(offlineEvidence, 'a local database the app can read with no network', ['sqflite', 'drift', 'hive', 'isar', 'objectbox', 'realm', 'androidx.room', 'sqldelight', 'grdb.swift', 'sqlite.swift', 'NSManagedObjectContext', 'SQLiteOpenHelper', 'getWritableDatabase(']),
         },
         {
             key: 'mobile.forcedUpdate',

package/dist/analyzer/localStores.d.ts

@@ -0,0 +1,40 @@
+import type { DetectContext } from './detectContext';
+/**
+ * Where an application on somebody else's device writes things down.
+ *
+ * One list, read by the two capabilities that both ask this question and used to
+ * answer it differently: `mobile.offline` — can this open with no network — and
+ * `app.state-durability` — does the person's work survive. A second copy would drift,
+ * and it already had: durability was written for a game in a browser and knew only
+ * `localStorage` and four npm packages, so every native application measured came back
+ * `partial` while keeping its data in Core Data or SQLite.
+ */
+/** Local databases declared as dependencies, by ecosystem. */
+export declare const LOCAL_STORE_GRADLE: string[];
+export declare const LOCAL_STORE_SWIFT: string[];
+export declare const LOCAL_STORE_DEPS: string[];
+/**
+ * Storage the platform itself provides, which no dependency list will hold.
+ *
+ * Every entry above is a third-party database, and the two most widely used stores on
+ * these platforms ship with the operating system: Core Data on Apple's,
+ * `SQLiteDatabase` on Android's. Measured on two applications whose whole purpose is
+ * working without a network — WordPress-iOS keeps its posts in Core Data,
+ * thunderbird-android keeps its mail in SQLite — and both were told they store nothing
+ * locally.
+ *
+ * Types the platform defines, not names an author picked: `NSManagedObjectContext`
+ * belongs to Core Data and appears nowhere else, and `getWritableDatabase()` is the one
+ * way an Android application opens its own database.
+ */
+export declare const PLATFORM_LOCAL_STORES: RegExp[];
+export interface LocalStoreReading {
+    dependencies: string[];
+    uses: Array<{
+        file: string;
+        line: number;
+        snippet: string;
+    }>;
+}
+/** Both halves of the question, so a caller can cite whichever it found. */
+export declare function readLocalStores(ctx: DetectContext, limit?: number): Promise<LocalStoreReading>;

package/dist/analyzer/localStores.js

@@ -0,0 +1,74 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.PLATFORM_LOCAL_STORES = exports.LOCAL_STORE_DEPS = exports.LOCAL_STORE_SWIFT = exports.LOCAL_STORE_GRADLE = void 0;
+exports.readLocalStores = readLocalStores;
+const detectContext_1 = require("./detectContext");
+const textSearch_1 = require("../utils/textSearch");
+/**
+ * Where an application on somebody else's device writes things down.
+ *
+ * One list, read by the two capabilities that both ask this question and used to
+ * answer it differently: `mobile.offline` — can this open with no network — and
+ * `app.state-durability` — does the person's work survive. A second copy would drift,
+ * and it already had: durability was written for a game in a browser and knew only
+ * `localStorage` and four npm packages, so every native application measured came back
+ * `partial` while keeping its data in Core Data or SQLite.
+ */
+/** Local databases declared as dependencies, by ecosystem. */
+exports.LOCAL_STORE_GRADLE = ['androidx.room', 'io.realm', 'io.objectbox', 'com.squareup.sqldelight', 'app.cash.sqldelight', 'androidx.datastore'];
+exports.LOCAL_STORE_SWIFT = [
+    'groue/grdb.swift',
+    'grdb.swift',
+    'stephencelis/sqlite.swift',
+    'sqlite.swift',
+    'realm/realm-swift',
+    'realm/realm-cocoa',
+    'realmswift',
+];
+exports.LOCAL_STORE_DEPS = [
+    'sqflite',
+    'drift',
+    'hive',
+    'isar',
+    'objectbox',
+    'realm',
+    'watermelondb',
+    '@nozbe/watermelondb',
+    'react-native-mmkv',
+    '@react-native-async-storage/async-storage',
+    'redux-persist',
+    '@tanstack/query-persist-client-core',
+    'powersync',
+];
+/**
+ * Storage the platform itself provides, which no dependency list will hold.
+ *
+ * Every entry above is a third-party database, and the two most widely used stores on
+ * these platforms ship with the operating system: Core Data on Apple's,
+ * `SQLiteDatabase` on Android's. Measured on two applications whose whole purpose is
+ * working without a network — WordPress-iOS keeps its posts in Core Data,
+ * thunderbird-android keeps its mail in SQLite — and both were told they store nothing
+ * locally.
+ *
+ * Types the platform defines, not names an author picked: `NSManagedObjectContext`
+ * belongs to Core Data and appears nowhere else, and `getWritableDatabase()` is the one
+ * way an Android application opens its own database.
+ */
+exports.PLATFORM_LOCAL_STORES = [
+    /NSPersistentContainer|NSManagedObjectContext|NSPersistentStoreCoordinator/,
+    /ModelContainer\s*\(|@Model\b/,
+    /SQLiteOpenHelper|getWritableDatabase\s*\(|getReadableDatabase\s*\(/,
+    /android\.database\.sqlite\.SQLiteDatabase/,
+];
+/** Both halves of the question, so a caller can cite whichever it found. */
+async function readLocalStores(ctx, limit = 3) {
+    return {
+        dependencies: [
+            ...(0, detectContext_1.hasAnyDep)(ctx, exports.LOCAL_STORE_DEPS),
+            ...(0, detectContext_1.hasAnyDartDep)(ctx, exports.LOCAL_STORE_DEPS),
+            ...(0, detectContext_1.hasAnyGradleDep)(ctx, exports.LOCAL_STORE_GRADLE),
+            ...(0, detectContext_1.hasAnySwiftDep)(ctx, exports.LOCAL_STORE_SWIFT),
+        ],
+        uses: await (0, textSearch_1.searchInFiles)(ctx.root, ctx.files.source, exports.PLATFORM_LOCAL_STORES, limit),
+    };
+}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@produtype/core",
-  "version": "0.74.0",
+  "version": "0.76.0",
   "description": "Deterministic CLI and library that analyzes a web application repository and reports how far it is from production-ready for the kind of product it is meant to be.",
   "license": "MIT",
   "bin": {