@produtype/core 0.75.0 → 0.77.0

package/dist/analyzer/detectGame.js

@@ -3,6 +3,7 @@ Object.defineProperty(exports, "__esModule", { value: true });
 exports.detectGame = detectGame;
 const detectContext_1 = require("./detectContext");
 const textSearch_1 = require("../utils/textSearch");
+const localStores_1 = require("./localStores");
 const absenceEvidence_1 = require("./absenceEvidence");
 /**
  * Whether this project is a game.
@@ -151,20 +152,42 @@ async function detectStatePersistence(ctx) {
     }
     // A database is the durable half. Read from the stack rather than re-detected, so
     // this agrees with what the report says the data layer is.
-    const durable = ctx.files.all.some((file) => /(^|\/)(schema\.prisma|.*\.sql)$/i.test(file))
+    const serverStore = ctx.files.all.some((file) => /(^|\/)(schema\.prisma|.*\.sql)$/i.test(file))
         || Boolean(ctx.packageJson?.dependencies?.pg)
         || Boolean(ctx.packageJson?.dependencies?.mongoose)
         || Boolean(ctx.packageJson?.dependencies?.['better-sqlite3']);
-    if (durable)
+    /**
+     * On a device, the local store is the durable one.
+     *
+     * This whole check was written for a game in a browser, where `localStorage` is the
+     * partial case because a cleared cache takes the save with it. That reasoning does
+     * not carry to a phone: Core Data and SQLite survive the application being killed,
+     * the device restarting and the person coming back a week later — they are the
+     * durable half there, not the fragile one.
+     *
+     * It is required of the mobile-app profile, and all four real applications measured
+     * came back `partial` on it while keeping everything they own on disk. The failure
+     * this should catch on a phone is different and still caught: state held only in
+     * memory, written nowhere, gone when the operating system reclaims the process.
+     */
+    const deviceStore = await (0, localStores_1.readLocalStores)(ctx, 3);
+    const onDevice = deviceStore.dependencies.length > 0 || deviceStore.uses.length > 0;
+    const durable = serverStore || onDevice;
+    if (serverStore)
         evidence.push({ type: 'note', value: 'a durable store is present' });
+    for (const dep of deviceStore.dependencies)
+        evidence.push({ type: 'dependency', value: dep });
+    for (const use of deviceStore.uses) {
+        evidence.push({ type: 'snippet', value: use.snippet, file: use.file, line: use.line });
+    }
     const saves = clientOnly.length > 0 || saveRoutes.length > 0;
     return {
         key: 'app.stateDurability',
         present: saves || durable,
         // Client storage alone is the partial case: it saves, until it does not.
         complete: durable,
-        evidence: (0, absenceEvidence_1.evidenceOrSearch)(evidence, 'anywhere progress is written down', ['localStorage', 'sessionStorage', 'IndexedDB', 'a save route', 'schema.prisma', 'a .sql file', 'pg', 'mongoose', 'better-sqlite3']),
-        details: { durable, clientStorage: clientOnly.length > 0, saveRoutines: saveRoutes.length },
+        evidence: (0, absenceEvidence_1.evidenceOrSearch)(evidence, 'anywhere progress is written down', ['localStorage', 'sessionStorage', 'IndexedDB', 'a save route', 'schema.prisma', 'a .sql file', 'pg', 'mongoose', 'better-sqlite3', 'Core Data', 'SQLiteOpenHelper', 'Room', 'sqflite']),
+        details: { durable, serverStore, onDevice, clientStorage: clientOnly.length > 0, saveRoutines: saveRoutes.length },
     };
 }
 /**

package/dist/analyzer/detectMobile.js

@@ -4,6 +4,7 @@ exports.detectMobile = detectMobile;
 const detectContext_1 = require("./detectContext");
 const readTextFileSafe_1 = require("../utils/readTextFileSafe");
 const textSearch_1 = require("../utils/textSearch");
+const localStores_1 = require("./localStores");
 const absenceEvidence_1 = require("./absenceEvidence");
 /**
  * Whether this is an application that ships to somebody else's phone, and what that
@@ -71,37 +72,6 @@ const SECURE_STORAGE_SWIFT = [
     'square/valet',
     'valet',
 ];
-/** Local databases, by platform, that let an app open without a network. */
-const OFFLINE_GRADLE = ['androidx.room', 'io.realm', 'io.objectbox', 'com.squareup.sqldelight', 'app.cash.sqldelight'];
-const OFFLINE_SWIFT = [
-    'groue/grdb.swift',
-    'grdb.swift',
-    'stephencelis/sqlite.swift',
-    'sqlite.swift',
-    'realm/realm-swift',
-    'realm/realm-cocoa',
-    'realmswift',
-];
-/**
- * Local storage the platform itself provides, which no dependency list will hold.
- *
- * Every entry in the lists above is a third-party database, and the two most widely
- * used stores on these platforms ship with the operating system: Core Data on Apple's,
- * `SQLiteDatabase` on Android's. Measured on two real applications whose whole purpose
- * is working without a network — WordPress-iOS keeps its posts in Core Data,
- * thunderbird-android keeps its mail in SQLite — and both were told at `high` that they
- * store nothing locally.
- *
- * These are types the platform defines, not names an author picked: `NSManagedObjectContext`
- * belongs to Core Data and appears nowhere else, and `getWritableDatabase()` is the one
- * way an Android application opens its own database.
- */
-const PLATFORM_LOCAL_STORES = [
-    /NSPersistentContainer|NSManagedObjectContext|NSPersistentStoreCoordinator/,
-    /ModelContainer\s*\(|@Model\b/,
-    /SQLiteOpenHelper|getWritableDatabase\s*\(|getReadableDatabase\s*\(/,
-    /android\.database\.sqlite\.SQLiteDatabase/,
-];
 /** Dependencies that put a secret somewhere the operating system protects. */
 const SECURE_STORAGE_DEPS = [
     'flutter_secure_storage',
@@ -111,22 +81,6 @@ const SECURE_STORAGE_DEPS = [
     '@capacitor/preferences',
     'capacitor-secure-storage-plugin',
 ];
-/** Dependencies whose whole purpose is that the app works with no network. */
-const OFFLINE_DEPS = [
-    'sqflite',
-    'drift',
-    'hive',
-    'isar',
-    'objectbox',
-    'realm',
-    'watermelondb',
-    '@nozbe/watermelondb',
-    'react-native-mmkv',
-    '@react-native-async-storage/async-storage',
-    'redux-persist',
-    '@tanstack/query-persist-client-core',
-    'powersync',
-];
 /**
  * Paths that contain a platform marker without being a project.
  *
@@ -323,19 +277,15 @@ async function detectMobile(ctx) {
             line: match.line,
         })),
     ];
-    const offlineDeps = [
-        ...(0, detectContext_1.hasAnyDep)(ctx, OFFLINE_DEPS),
-        ...(0, detectContext_1.hasAnyDartDep)(ctx, OFFLINE_DEPS),
-        ...(0, detectContext_1.hasAnyGradleDep)(ctx, OFFLINE_GRADLE),
-        ...(0, detectContext_1.hasAnySwiftDep)(ctx, OFFLINE_SWIFT),
-    ];
+    const localStores = await (0, localStores_1.readLocalStores)(ctx);
+    const offlineDeps = localStores.dependencies;
     /**
      * A local database is the strong signal; knowing the network dropped is the weak
      * one. Both are recorded, because an app that stores nothing but tells the user the
      * connection is gone is a different thing from one that shows a spinner forever.
      */
     const connectivityChecks = await (0, textSearch_1.searchInFiles)(ctx.root, ctx.files.source, [/Connectivity\(\)/, /connectivity_plus/, /NetInfo\./, /navigator\.onLine/, /NWPathMonitor/, /isReachable/], 3);
-    const platformStores = await (0, textSearch_1.searchInFiles)(ctx.root, ctx.files.source, PLATFORM_LOCAL_STORES, 3);
+    const platformStores = localStores.uses;
     const offlineEvidence = [
         ...offlineDeps.map((dep) => ({ type: 'dependency', value: dep })),
         ...platformStores.map((match) => ({
@@ -404,6 +354,17 @@ async function detectMobile(ctx) {
         {
             key: 'mobile.privacyDeclaration',
             present: privacyFiles.length > 0,
+            /**
+             * On Android the declaration is not in the repository, and never was.
+             *
+             * Apple has required `PrivacyInfo.xcprivacy` in the bundle since 2024, so an iOS
+             * project either has the file or has not made the declaration. Play's data-safety
+             * form is filled in the console: there is no committed artifact to find, and no
+             * convention that puts one in the tree. thunderbird-android was told it was
+             * missing a file it has no way to have — a question this analyzer cannot ask
+             * rather than an answer of no.
+             */
+            unanswered: privacyFiles.length === 0 && !platforms.includes('ios'),
             evidence: (0, absenceEvidence_1.evidenceOrSearch)(privacyFiles.map((file) => ({ type: 'file', value: file, file })), 'the privacy declaration the stores require', ['PrivacyInfo.xcprivacy', 'a data-safety declaration', 'privacy_policy', 'PRIVACY.md']),
         },
     ];

package/dist/analyzer/localStores.d.ts

@@ -0,0 +1,40 @@
+import type { DetectContext } from './detectContext';
+/**
+ * Where an application on somebody else's device writes things down.
+ *
+ * One list, read by the two capabilities that both ask this question and used to
+ * answer it differently: `mobile.offline` — can this open with no network — and
+ * `app.state-durability` — does the person's work survive. A second copy would drift,
+ * and it already had: durability was written for a game in a browser and knew only
+ * `localStorage` and four npm packages, so every native application measured came back
+ * `partial` while keeping its data in Core Data or SQLite.
+ */
+/** Local databases declared as dependencies, by ecosystem. */
+export declare const LOCAL_STORE_GRADLE: string[];
+export declare const LOCAL_STORE_SWIFT: string[];
+export declare const LOCAL_STORE_DEPS: string[];
+/**
+ * Storage the platform itself provides, which no dependency list will hold.
+ *
+ * Every entry above is a third-party database, and the two most widely used stores on
+ * these platforms ship with the operating system: Core Data on Apple's,
+ * `SQLiteDatabase` on Android's. Measured on two applications whose whole purpose is
+ * working without a network — WordPress-iOS keeps its posts in Core Data,
+ * thunderbird-android keeps its mail in SQLite — and both were told they store nothing
+ * locally.
+ *
+ * Types the platform defines, not names an author picked: `NSManagedObjectContext`
+ * belongs to Core Data and appears nowhere else, and `getWritableDatabase()` is the one
+ * way an Android application opens its own database.
+ */
+export declare const PLATFORM_LOCAL_STORES: RegExp[];
+export interface LocalStoreReading {
+    dependencies: string[];
+    uses: Array<{
+        file: string;
+        line: number;
+        snippet: string;
+    }>;
+}
+/** Both halves of the question, so a caller can cite whichever it found. */
+export declare function readLocalStores(ctx: DetectContext, limit?: number): Promise<LocalStoreReading>;

package/dist/analyzer/localStores.js

@@ -0,0 +1,74 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.PLATFORM_LOCAL_STORES = exports.LOCAL_STORE_DEPS = exports.LOCAL_STORE_SWIFT = exports.LOCAL_STORE_GRADLE = void 0;
+exports.readLocalStores = readLocalStores;
+const detectContext_1 = require("./detectContext");
+const textSearch_1 = require("../utils/textSearch");
+/**
+ * Where an application on somebody else's device writes things down.
+ *
+ * One list, read by the two capabilities that both ask this question and used to
+ * answer it differently: `mobile.offline` — can this open with no network — and
+ * `app.state-durability` — does the person's work survive. A second copy would drift,
+ * and it already had: durability was written for a game in a browser and knew only
+ * `localStorage` and four npm packages, so every native application measured came back
+ * `partial` while keeping its data in Core Data or SQLite.
+ */
+/** Local databases declared as dependencies, by ecosystem. */
+exports.LOCAL_STORE_GRADLE = ['androidx.room', 'io.realm', 'io.objectbox', 'com.squareup.sqldelight', 'app.cash.sqldelight', 'androidx.datastore'];
+exports.LOCAL_STORE_SWIFT = [
+    'groue/grdb.swift',
+    'grdb.swift',
+    'stephencelis/sqlite.swift',
+    'sqlite.swift',
+    'realm/realm-swift',
+    'realm/realm-cocoa',
+    'realmswift',
+];
+exports.LOCAL_STORE_DEPS = [
+    'sqflite',
+    'drift',
+    'hive',
+    'isar',
+    'objectbox',
+    'realm',
+    'watermelondb',
+    '@nozbe/watermelondb',
+    'react-native-mmkv',
+    '@react-native-async-storage/async-storage',
+    'redux-persist',
+    '@tanstack/query-persist-client-core',
+    'powersync',
+];
+/**
+ * Storage the platform itself provides, which no dependency list will hold.
+ *
+ * Every entry above is a third-party database, and the two most widely used stores on
+ * these platforms ship with the operating system: Core Data on Apple's,
+ * `SQLiteDatabase` on Android's. Measured on two applications whose whole purpose is
+ * working without a network — WordPress-iOS keeps its posts in Core Data,
+ * thunderbird-android keeps its mail in SQLite — and both were told they store nothing
+ * locally.
+ *
+ * Types the platform defines, not names an author picked: `NSManagedObjectContext`
+ * belongs to Core Data and appears nowhere else, and `getWritableDatabase()` is the one
+ * way an Android application opens its own database.
+ */
+exports.PLATFORM_LOCAL_STORES = [
+    /NSPersistentContainer|NSManagedObjectContext|NSPersistentStoreCoordinator/,
+    /ModelContainer\s*\(|@Model\b/,
+    /SQLiteOpenHelper|getWritableDatabase\s*\(|getReadableDatabase\s*\(/,
+    /android\.database\.sqlite\.SQLiteDatabase/,
+];
+/** Both halves of the question, so a caller can cite whichever it found. */
+async function readLocalStores(ctx, limit = 3) {
+    return {
+        dependencies: [
+            ...(0, detectContext_1.hasAnyDep)(ctx, exports.LOCAL_STORE_DEPS),
+            ...(0, detectContext_1.hasAnyDartDep)(ctx, exports.LOCAL_STORE_DEPS),
+            ...(0, detectContext_1.hasAnyGradleDep)(ctx, exports.LOCAL_STORE_GRADLE),
+            ...(0, detectContext_1.hasAnySwiftDep)(ctx, exports.LOCAL_STORE_SWIFT),
+        ],
+        uses: await (0, textSearch_1.searchInFiles)(ctx.root, ctx.files.source, exports.PLATFORM_LOCAL_STORES, limit),
+    };
+}

package/dist/expectations/evaluateExpectations.js

@@ -224,6 +224,16 @@ function deriveStatus(analysis, capability) {
                 return 'present';
             if (matches.some((m) => m.present))
                 return 'partial';
+            /**
+             * Nothing found, and at least one detector says it could not look.
+             *
+             * The specific rules in `rules.ts` grew this in 0.74.0 one claim at a time; this
+             * is the same rule for every capability that reaches the generic path. A finding
+             * is only ever weakened by it: `present` and `partial` are decided above, so
+             * blindness can turn `missing` into `unknown` and nothing else.
+             */
+            if (matches.some((m) => m.unanswered))
+                return 'unknown';
             return 'missing';
         }
     }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@produtype/core",
-  "version": "0.75.0",
+  "version": "0.77.0",
   "description": "Deterministic CLI and library that analyzes a web application repository and reports how far it is from production-ready for the kind of product it is meant to be.",
   "license": "MIT",
   "bin": {