@produtype/core 0.76.0 → 0.78.0

package/dist/analyzer/detectBackend.js

@@ -4,31 +4,8 @@ exports.detectBackend = detectBackend;
 const detectContext_1 = require("./detectContext");
 const textSearch_1 = require("../utils/textSearch");
 const readTextFileSafe_1 = require("../utils/readTextFileSafe");
+const languageShare_1 = require("./languageShare");
 const catalogue_1 = require("./catalogue");
-/**
- * How much of the source is written in one language.
- *
- * A manifest says a language is present; a share says it is what the product is made
- * of. The mobile detector has drawn this distinction since a single MAUI client
- * decided the profile of a nine-project .NET solution.
- */
-function languageShare(ctx, extension) {
-    const source = ctx.files.source;
-    if (source.length === 0)
-        return 0;
-    return source.filter((file) => extension.test(file)).length / source.length;
-}
-/**
- * Below this a language is present in the repository without being what serves the
- * requests.
- *
- * windmill is the measurement: two Go files beside 547 Rust ones, 0.05% of its source,
- * and the report said "Backend: go". The line is not tuned to that case — anything
- * under one file in twenty is a client, a script or a sample, and every backend in the
- * verification corpus is far above it. A repository genuinely split between two server
- * languages reports both, which is the right answer for one.
- */
-const MINIMUM_BACKEND_SHARE = 0.05;
 async function detectBackend(ctx) {
     const frameworks = [];
     const evidence = [];
@@ -94,8 +71,8 @@ async function detectBackend(ctx) {
      * "Backend: go". The same share test the mobile detector already uses: a language
      * has to be a real part of what is written here before it names the backend.
      */
-    const goShare = languageShare(ctx, /\.go$/);
-    if (!namedGoFramework && goShare >= MINIMUM_BACKEND_SHARE && ctx.files.all.some((f) => /(^|\/)go\.mod$/.test(f))) {
+    const goShare = (0, languageShare_1.languageShare)(ctx, /\.go$/);
+    if (!namedGoFramework && goShare >= languageShare_1.MINIMUM_LANGUAGE_SHARE && ctx.files.all.some((f) => /(^|\/)go\.mod$/.test(f))) {
         frameworks.push('go');
         evidence.push({ type: 'note', value: 'a Go module with no web framework named in go.mod' });
     }
@@ -157,7 +134,7 @@ async function detectBackend(ctx) {
      * before it names the backend.
      */
     if (!namedRubyFramework
-        && languageShare(ctx, /\.rb$/) >= MINIMUM_BACKEND_SHARE
+        && (0, languageShare_1.languageShare)(ctx, /\.rb$/) >= languageShare_1.MINIMUM_LANGUAGE_SHARE
         && ctx.files.all.some((f) => /(^|\/)Gemfile$/.test(f))) {
         frameworks.push('ruby');
         evidence.push({ type: 'note', value: 'a Gemfile with no web framework in it' });

package/dist/analyzer/detectMobile.js

@@ -354,6 +354,17 @@ async function detectMobile(ctx) {
         {
             key: 'mobile.privacyDeclaration',
             present: privacyFiles.length > 0,
+            /**
+             * On Android the declaration is not in the repository, and never was.
+             *
+             * Apple has required `PrivacyInfo.xcprivacy` in the bundle since 2024, so an iOS
+             * project either has the file or has not made the declaration. Play's data-safety
+             * form is filled in the console: there is no committed artifact to find, and no
+             * convention that puts one in the tree. thunderbird-android was told it was
+             * missing a file it has no way to have — a question this analyzer cannot ask
+             * rather than an answer of no.
+             */
+            unanswered: privacyFiles.length === 0 && !platforms.includes('ios'),
             evidence: (0, absenceEvidence_1.evidenceOrSearch)(privacyFiles.map((file) => ({ type: 'file', value: file, file })), 'the privacy declaration the stores require', ['PrivacyInfo.xcprivacy', 'a data-safety declaration', 'privacy_policy', 'PRIVACY.md']),
         },
     ];

package/dist/analyzer/detectPackageManager.js

@@ -1,6 +1,7 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.detectPackageManager = detectPackageManager;
+const languageShare_1 = require("./languageShare");
 /**
  * Manifests outside Node and Python, each one a file this analyzer already parses.
  *
@@ -20,6 +21,15 @@ const OTHER_MANIFESTS = [
     { manager: 'gradle', pattern: /(^|\/)build\.gradle(\.kts)?$/ },
     { manager: 'maven', pattern: /(^|\/)pom\.xml$/ },
     { manager: 'nuget', pattern: /\.(csproj|fsproj|vbproj)$/i },
+    /**
+     * Both Apple ecosystems, added once their manifests were actually being parsed —
+     * `Package.swift` and the Podfile for a long while, `Package.resolved` since 0.75.0.
+     * Until then an iOS application could only ever come out as `npm` or `unknown`,
+     * which is how DuckDuckGo iOS — 1194 Swift files — reported "npm (lockfile)" from a
+     * package.json whose only job is running rollup over one content-blocking script.
+     */
+    { manager: 'swift package manager', pattern: /(^|\/)Package\.(swift|resolved)$/ },
+    { manager: 'cocoapods', pattern: /(^|\/)Podfile$/ },
 ];
 /**
  * The shallowest manifest wins, and list order only breaks a tie.
@@ -33,22 +43,59 @@ const OTHER_MANIFESTS = [
  * the project's; one buried under `sdk/go/` belongs to something the project ships
  * rather than something it is built with.
  */
-function resolveFromOtherManifests(files) {
-    let best = null;
+/**
+ * The language each of these manifests builds, so a share can be asked about it.
+ *
+ * Depth alone decided before, and depth is the wrong question when the shallow
+ * manifest belongs to the build tooling: DuckDuckGo iOS keeps a fastlane `Gemfile` at
+ * its root and its real Swift manifest five directories down inside the `.xcodeproj`,
+ * so the report called a 1194-file iOS application a Ruby project — the same mistake
+ * WordPress-iOS produced one layer up, where the fastlane Gemfile was read as the
+ * backend.
+ */
+const MANIFEST_LANGUAGE = {
+    pub: /\.dart$/,
+    composer: /\.php$/,
+    'go modules': /\.go$/,
+    cargo: /\.rs$/,
+    bundler: /\.rb$/,
+    gradle: /\.(java|kt|kts|scala|groovy)$/,
+    maven: /\.(java|kt|kts|scala|groovy)$/,
+    nuget: /\.(cs|fs|vb)$/,
+    'swift package manager': /\.(swift|m|mm)$/,
+    cocoapods: /\.(swift|m|mm)$/,
+};
+function resolveFromOtherManifests(ctx) {
+    const files = ctx.files.all;
+    const candidates = [];
     OTHER_MANIFESTS.forEach(({ manager, pattern }, order) => {
         for (const file of files) {
             if (!pattern.test(file))
                 continue;
-            const depth = file.split('/').length;
-            if (!best || depth < best.depth || (depth === best.depth && order < best.order)) {
-                best = { manager, file, depth, order };
-            }
+            const extension = MANIFEST_LANGUAGE[manager];
+            candidates.push({
+                manager,
+                file,
+                depth: file.split('/').length,
+                order,
+                share: extension ? (0, languageShare_1.languageShare)(ctx, extension) : 0,
+            });
         }
     });
-    if (!best)
+    if (candidates.length === 0)
         return null;
-    const { manager, file } = best;
-    return { manager, confidence: 'manifest', warnings: [], evidence: [file] };
+    /**
+     * A manifest whose language is really here outranks one that is merely nearer the
+     * root. Where none of them clears the line — a repository of configuration, or one
+     * whose language this analyzer does not count — the old ordering stands, so nothing
+     * that used to resolve stops resolving.
+     */
+    const substantial = candidates.filter((candidate) => candidate.share >= languageShare_1.MINIMUM_LANGUAGE_SHARE);
+    const pool = substantial.length > 0 ? substantial : candidates;
+    const best = pool.reduce((winner, candidate) => candidate.depth < winner.depth || (candidate.depth === winner.depth && candidate.order < winner.order)
+        ? candidate
+        : winner);
+    return { manager: best.manager, confidence: 'manifest', warnings: [], evidence: [best.file] };
 }
 function resolveWorkspaceManager(workspace) {
     const warnings = [];
@@ -91,9 +138,28 @@ async function detectPackageManager(ctx) {
     const fromWorkspaces = rootWorkspace ?? workspaceManagers.find((w) => w.manager !== 'unknown');
     // Node and Python first, because the workspace record is built from their manifests and
     // knows which of several it found. Anything else is resolved from the file list.
-    const selected = fromWorkspaces && fromWorkspaces.manager !== 'unknown'
+    const otherManifest = resolveFromOtherManifests(ctx);
+    /**
+     * A package.json is not always what the project is built with.
+     *
+     * It wins over every other manifest here because the workspace record is richer, and
+     * that was right until it met a repository where Node is the build tooling rather
+     * than the product: DuckDuckGo iOS keeps one to run rollup over a single
+     * content-blocking script, eight JavaScript files against 1194 Swift ones, and the
+     * report said "Package manager: npm (lockfile)".
+     *
+     * The same share test the backend uses, and for the same reason — one file in twenty
+     * is the line below which a language is something the repository contains rather
+     * than something it is made of. Only applied when there is another manifest to
+     * prefer: a repository whose only manifest is a package.json is an npm repository
+     * however little JavaScript it has.
+     */
+    const nodeOrPythonIsTheProduct = (0, languageShare_1.languageShare)(ctx, /\.(ts|tsx|js|jsx|mjs|cjs|py)$/) >= languageShare_1.MINIMUM_LANGUAGE_SHARE;
+    const selected = fromWorkspaces
+        && fromWorkspaces.manager !== 'unknown'
+        && (nodeOrPythonIsTheProduct || !otherManifest)
         ? fromWorkspaces
-        : resolveFromOtherManifests(ctx.files.all) ?? fromWorkspaces;
+        : otherManifest ?? fromWorkspaces;
     if (selected) {
         return {
             manager: selected.manager,

package/dist/analyzer/languageShare.d.ts

@@ -0,0 +1,20 @@
+import type { DetectContext } from './detectContext';
+/**
+ * How much of a repository's source is written in a given language.
+ *
+ * Extracted from the backend detector, which grew it first: two Go files beside 547
+ * Rust ones made a report say "Backend: go". The same question decides more than one
+ * claim — which language serves the requests, and which ecosystem builds the project —
+ * and the answer should be arrived at the same way in both.
+ */
+export declare function languageShare(ctx: DetectContext, extension: RegExp): number;
+/**
+ * Below this a language is present in the repository without being what it is made of.
+ *
+ * windmill is the measurement: two Go files beside 547 Rust ones, 0.05% of its source,
+ * and the report said "Backend: go". The line is not tuned to that case — anything
+ * under one file in twenty is a client, a script or a sample, and every backend in the
+ * verification corpus is far above it. A repository genuinely split between two
+ * languages reports both, which is the right answer for one.
+ */
+export declare const MINIMUM_LANGUAGE_SHARE = 0.05;

package/dist/analyzer/languageShare.js

@@ -0,0 +1,28 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.MINIMUM_LANGUAGE_SHARE = void 0;
+exports.languageShare = languageShare;
+/**
+ * How much of a repository's source is written in a given language.
+ *
+ * Extracted from the backend detector, which grew it first: two Go files beside 547
+ * Rust ones made a report say "Backend: go". The same question decides more than one
+ * claim — which language serves the requests, and which ecosystem builds the project —
+ * and the answer should be arrived at the same way in both.
+ */
+function languageShare(ctx, extension) {
+    const source = ctx.files.source;
+    if (source.length === 0)
+        return 0;
+    return source.filter((file) => extension.test(file)).length / source.length;
+}
+/**
+ * Below this a language is present in the repository without being what it is made of.
+ *
+ * windmill is the measurement: two Go files beside 547 Rust ones, 0.05% of its source,
+ * and the report said "Backend: go". The line is not tuned to that case — anything
+ * under one file in twenty is a client, a script or a sample, and every backend in the
+ * verification corpus is far above it. A repository genuinely split between two
+ * languages reports both, which is the right answer for one.
+ */
+exports.MINIMUM_LANGUAGE_SHARE = 0.05;

package/dist/analyzer/types.d.ts

@@ -10,7 +10,7 @@
  * Only managers whose manifest this analyzer actually reads are named here. A name it
  * cannot back with a parsed file would be a guess from a filename.
  */
-export type PackageManager = 'npm' | 'pnpm' | 'yarn' | 'pip' | 'poetry' | 'python' | 'pub' | 'composer' | 'go modules' | 'cargo' | 'bundler' | 'gradle' | 'maven' | 'nuget' | 'unknown';
+export type PackageManager = 'npm' | 'pnpm' | 'yarn' | 'pip' | 'poetry' | 'python' | 'pub' | 'composer' | 'go modules' | 'cargo' | 'bundler' | 'gradle' | 'maven' | 'nuget' | 'swift package manager' | 'cocoapods' | 'unknown';
 export type PackageManagerConfidence = 'lockfile' | 'manifest' | 'inferred' | 'unknown';
 export interface WorkspaceStack {
     root: string;

package/dist/expectations/evaluateExpectations.js

@@ -224,6 +224,16 @@ function deriveStatus(analysis, capability) {
                 return 'present';
             if (matches.some((m) => m.present))
                 return 'partial';
+            /**
+             * Nothing found, and at least one detector says it could not look.
+             *
+             * The specific rules in `rules.ts` grew this in 0.74.0 one claim at a time; this
+             * is the same rule for every capability that reaches the generic path. A finding
+             * is only ever weakened by it: `present` and `partial` are decided above, so
+             * blindness can turn `missing` into `unknown` and nothing else.
+             */
+            if (matches.some((m) => m.unanswered))
+                return 'unknown';
             return 'missing';
         }
     }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@produtype/core",
-  "version": "0.76.0",
+  "version": "0.78.0",
   "description": "Deterministic CLI and library that analyzes a web application repository and reports how far it is from production-ready for the kind of product it is meant to be.",
   "license": "MIT",
   "bin": {