@produtype/core 0.77.0 → 0.79.0

package/README.md

@@ -176,7 +176,7 @@ _Generated from the analyzer itself — run `npm run docs:stacks` after changing
 
 - **Backend:** Express, Next.js, NestJS, Fastify, Hono, Elysia, Koa, AdonisJS, SvelteKit, Remix, Nuxt, Nitro, Astro, Django, Flask, FastAPI, aiohttp, Litestar, Sanic, Tornado, Starlette, Streamlit, Gradio, Dash, Chainlit, Gin, Echo, Fiber, chi, Gorilla, Beego, Go, Axum, Actix Web, Rocket, Warp, Tide, Poem, Salvo, Tower HTTP, Hyper, Spring Boot, Quarkus, Micronaut, Ktor, Javalin, Vert.x, Dropwizard, Helidon, Rails, Sinatra, Hanami, Roda, Grape, Ruby, Laravel, Symfony, Slim, CodeIgniter, CakePHP, Yii, PHP, ASP.NET Core, .NET
 - **Frontend:** React, Vite, Vue, Nuxt, Svelte, Angular, Astro, Solid, Qwik, Preact, Remix, htmx, Tailwind CSS, Electron
-- **Mobile:** Flutter, React Native, iOS (native), Android (native)
+- **Mobile:** Flutter, React Native, iOS (native), Android (native), SwiftUI, UIKit, Jetpack Compose, Android views
 - **Databases:** Postgres, MySQL, SQLite, SQL Server, MongoDB, Redis, Firestore, DynamoDB, Convex
 - **Hosted data platforms:** Supabase, Firebase, PlanetScale, Neon, Vercel Postgres, Turso, Upstash, DynamoDB, Convex
 - **ORMs:** Prisma, Drizzle, TypeORM, Sequelize, Knex, MikroORM, Kysely, SQLAlchemy, Tortoise, Peewee
@@ -198,6 +198,10 @@ How some of these are decided:
 - **React Native** — the react-native or expo dependency
 - **iOS (native)** — Info.plist, Package.swift, a Podfile or an .xcodeproj in the tree
 - **Android (native)** — AndroidManifest.xml, or build.gradle in either dialect
+- **SwiftUI** — import SwiftUI
+- **UIKit** — import UIKit
+- **Jetpack Compose** — import androidx.compose
+- **Android views** — import androidx.appcompat, or android.app.Activity
 - **Supabase** — recorded alongside the engine it is — Postgres
 - **Firebase** — Firestore
 - **PlanetScale** — MySQL

package/dist/analyzer/catalogue.js

@@ -247,6 +247,10 @@ const LABELS = {
     'react-native': 'React Native',
     ios: 'iOS (native)',
     android: 'Android (native)',
+    swiftui: 'SwiftUI',
+    uikit: 'UIKit',
+    'jetpack compose': 'Jetpack Compose',
+    'android views': 'Android views',
     express: 'Express',
     flask: 'Flask',
     fastapi: 'FastAPI',
@@ -370,6 +374,10 @@ function supportedStacks() {
                 label: 'Android (native)',
                 detectedFrom: 'AndroidManifest.xml, or build.gradle in either dialect',
             },
+            { id: 'swiftui', label: 'SwiftUI', detectedFrom: 'import SwiftUI' },
+            { id: 'uikit', label: 'UIKit', detectedFrom: 'import UIKit' },
+            { id: 'jetpack compose', label: 'Jetpack Compose', detectedFrom: 'import androidx.compose' },
+            { id: 'android views', label: 'Android views', detectedFrom: 'import androidx.appcompat, or android.app.Activity' },
         ],
         databases: entries(['postgres', 'mysql', 'sqlite', 'sqlserver', 'mongodb', 'redis', 'firestore', 'dynamodb', 'convex']),
         dataPlatforms: [

package/dist/analyzer/detectBackend.js

@@ -4,31 +4,8 @@ exports.detectBackend = detectBackend;
 const detectContext_1 = require("./detectContext");
 const textSearch_1 = require("../utils/textSearch");
 const readTextFileSafe_1 = require("../utils/readTextFileSafe");
+const languageShare_1 = require("./languageShare");
 const catalogue_1 = require("./catalogue");
-/**
- * How much of the source is written in one language.
- *
- * A manifest says a language is present; a share says it is what the product is made
- * of. The mobile detector has drawn this distinction since a single MAUI client
- * decided the profile of a nine-project .NET solution.
- */
-function languageShare(ctx, extension) {
-    const source = ctx.files.source;
-    if (source.length === 0)
-        return 0;
-    return source.filter((file) => extension.test(file)).length / source.length;
-}
-/**
- * Below this a language is present in the repository without being what serves the
- * requests.
- *
- * windmill is the measurement: two Go files beside 547 Rust ones, 0.05% of its source,
- * and the report said "Backend: go". The line is not tuned to that case — anything
- * under one file in twenty is a client, a script or a sample, and every backend in the
- * verification corpus is far above it. A repository genuinely split between two server
- * languages reports both, which is the right answer for one.
- */
-const MINIMUM_BACKEND_SHARE = 0.05;
 async function detectBackend(ctx) {
     const frameworks = [];
     const evidence = [];
@@ -94,8 +71,8 @@ async function detectBackend(ctx) {
      * "Backend: go". The same share test the mobile detector already uses: a language
      * has to be a real part of what is written here before it names the backend.
      */
-    const goShare = languageShare(ctx, /\.go$/);
-    if (!namedGoFramework && goShare >= MINIMUM_BACKEND_SHARE && ctx.files.all.some((f) => /(^|\/)go\.mod$/.test(f))) {
+    const goShare = (0, languageShare_1.languageShare)(ctx, /\.go$/);
+    if (!namedGoFramework && goShare >= languageShare_1.MINIMUM_LANGUAGE_SHARE && ctx.files.all.some((f) => /(^|\/)go\.mod$/.test(f))) {
         frameworks.push('go');
         evidence.push({ type: 'note', value: 'a Go module with no web framework named in go.mod' });
     }
@@ -157,7 +134,7 @@ async function detectBackend(ctx) {
      * before it names the backend.
      */
     if (!namedRubyFramework
-        && languageShare(ctx, /\.rb$/) >= MINIMUM_BACKEND_SHARE
+        && (0, languageShare_1.languageShare)(ctx, /\.rb$/) >= languageShare_1.MINIMUM_LANGUAGE_SHARE
         && ctx.files.all.some((f) => /(^|\/)Gemfile$/.test(f))) {
         frameworks.push('ruby');
         evidence.push({ type: 'note', value: 'a Gemfile with no web framework in it' });

package/dist/analyzer/detectFrontend.js

@@ -3,6 +3,7 @@ Object.defineProperty(exports, "__esModule", { value: true });
 exports.detectFrontend = detectFrontend;
 const detectContext_1 = require("./detectContext");
 const catalogue_1 = require("./catalogue");
+const textSearch_1 = require("../utils/textSearch");
 async function detectFrontend(ctx) {
     const frameworks = [];
     const evidence = [];
@@ -34,6 +35,34 @@ async function detectFrontend(ctx) {
         frameworks.push('flutter');
         evidence.push({ type: 'dependency', value: 'flutter' });
     }
+    /**
+     * The user interface a native application actually has.
+     *
+     * Nothing here could name one, so the question fell through to the fallback below
+     * and DuckDuckGo iOS — 1194 Swift files — was reported as "frontend: html", from the
+     * error pages and onboarding documents it ships inside the app. A reader sees that
+     * line and thinks web application.
+     *
+     * `import SwiftUI` and `import androidx.compose.runtime` are module imports the
+     * platform defines; an author who wants the toolkit has no other way to write it.
+     * The frameworks are mutually compatible in practice — an application migrating to
+     * SwiftUI still imports UIKit — so all of them that appear are recorded.
+     */
+    const NATIVE_TOOLKITS = [
+        ['swiftui', /^\s*import\s+SwiftUI\b/m],
+        ['uikit', /^\s*import\s+UIKit\b/m],
+        ['jetpack compose', /^\s*import\s+androidx\.compose\b/m],
+        ['android views', /^\s*import\s+androidx\.appcompat\b|^\s*import\s+android\.app\.Activity\b/m],
+    ];
+    for (const [toolkit, pattern] of NATIVE_TOOLKITS) {
+        const hits = await (0, textSearch_1.searchInFiles)(ctx.root, ctx.files.source, [pattern], 2);
+        if (hits.length === 0)
+            continue;
+        frameworks.push(toolkit);
+        for (const hit of hits.slice(0, 1)) {
+            evidence.push({ type: 'snippet', value: hit.snippet, file: hit.file, line: hit.line });
+        }
+    }
     /**
      * A page is a front end, whether or not a framework built it.
      *

package/dist/analyzer/detectPackageManager.js

@@ -1,6 +1,7 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.detectPackageManager = detectPackageManager;
+const languageShare_1 = require("./languageShare");
 /**
  * Manifests outside Node and Python, each one a file this analyzer already parses.
  *
@@ -20,6 +21,15 @@ const OTHER_MANIFESTS = [
     { manager: 'gradle', pattern: /(^|\/)build\.gradle(\.kts)?$/ },
     { manager: 'maven', pattern: /(^|\/)pom\.xml$/ },
     { manager: 'nuget', pattern: /\.(csproj|fsproj|vbproj)$/i },
+    /**
+     * Both Apple ecosystems, added once their manifests were actually being parsed —
+     * `Package.swift` and the Podfile for a long while, `Package.resolved` since 0.75.0.
+     * Until then an iOS application could only ever come out as `npm` or `unknown`,
+     * which is how DuckDuckGo iOS — 1194 Swift files — reported "npm (lockfile)" from a
+     * package.json whose only job is running rollup over one content-blocking script.
+     */
+    { manager: 'swift package manager', pattern: /(^|\/)Package\.(swift|resolved)$/ },
+    { manager: 'cocoapods', pattern: /(^|\/)Podfile$/ },
 ];
 /**
  * The shallowest manifest wins, and list order only breaks a tie.
@@ -33,22 +43,59 @@ const OTHER_MANIFESTS = [
  * the project's; one buried under `sdk/go/` belongs to something the project ships
  * rather than something it is built with.
  */
-function resolveFromOtherManifests(files) {
-    let best = null;
+/**
+ * The language each of these manifests builds, so a share can be asked about it.
+ *
+ * Depth alone decided before, and depth is the wrong question when the shallow
+ * manifest belongs to the build tooling: DuckDuckGo iOS keeps a fastlane `Gemfile` at
+ * its root and its real Swift manifest five directories down inside the `.xcodeproj`,
+ * so the report called a 1194-file iOS application a Ruby project — the same mistake
+ * WordPress-iOS produced one layer up, where the fastlane Gemfile was read as the
+ * backend.
+ */
+const MANIFEST_LANGUAGE = {
+    pub: /\.dart$/,
+    composer: /\.php$/,
+    'go modules': /\.go$/,
+    cargo: /\.rs$/,
+    bundler: /\.rb$/,
+    gradle: /\.(java|kt|kts|scala|groovy)$/,
+    maven: /\.(java|kt|kts|scala|groovy)$/,
+    nuget: /\.(cs|fs|vb)$/,
+    'swift package manager': /\.(swift|m|mm)$/,
+    cocoapods: /\.(swift|m|mm)$/,
+};
+function resolveFromOtherManifests(ctx) {
+    const files = ctx.files.all;
+    const candidates = [];
     OTHER_MANIFESTS.forEach(({ manager, pattern }, order) => {
         for (const file of files) {
             if (!pattern.test(file))
                 continue;
-            const depth = file.split('/').length;
-            if (!best || depth < best.depth || (depth === best.depth && order < best.order)) {
-                best = { manager, file, depth, order };
-            }
+            const extension = MANIFEST_LANGUAGE[manager];
+            candidates.push({
+                manager,
+                file,
+                depth: file.split('/').length,
+                order,
+                share: extension ? (0, languageShare_1.languageShare)(ctx, extension) : 0,
+            });
         }
     });
-    if (!best)
+    if (candidates.length === 0)
         return null;
-    const { manager, file } = best;
-    return { manager, confidence: 'manifest', warnings: [], evidence: [file] };
+    /**
+     * A manifest whose language is really here outranks one that is merely nearer the
+     * root. Where none of them clears the line — a repository of configuration, or one
+     * whose language this analyzer does not count — the old ordering stands, so nothing
+     * that used to resolve stops resolving.
+     */
+    const substantial = candidates.filter((candidate) => candidate.share >= languageShare_1.MINIMUM_LANGUAGE_SHARE);
+    const pool = substantial.length > 0 ? substantial : candidates;
+    const best = pool.reduce((winner, candidate) => candidate.depth < winner.depth || (candidate.depth === winner.depth && candidate.order < winner.order)
+        ? candidate
+        : winner);
+    return { manager: best.manager, confidence: 'manifest', warnings: [], evidence: [best.file] };
 }
 function resolveWorkspaceManager(workspace) {
     const warnings = [];
@@ -91,9 +138,28 @@ async function detectPackageManager(ctx) {
     const fromWorkspaces = rootWorkspace ?? workspaceManagers.find((w) => w.manager !== 'unknown');
     // Node and Python first, because the workspace record is built from their manifests and
     // knows which of several it found. Anything else is resolved from the file list.
-    const selected = fromWorkspaces && fromWorkspaces.manager !== 'unknown'
+    const otherManifest = resolveFromOtherManifests(ctx);
+    /**
+     * A package.json is not always what the project is built with.
+     *
+     * It wins over every other manifest here because the workspace record is richer, and
+     * that was right until it met a repository where Node is the build tooling rather
+     * than the product: DuckDuckGo iOS keeps one to run rollup over a single
+     * content-blocking script, eight JavaScript files against 1194 Swift ones, and the
+     * report said "Package manager: npm (lockfile)".
+     *
+     * The same share test the backend uses, and for the same reason — one file in twenty
+     * is the line below which a language is something the repository contains rather
+     * than something it is made of. Only applied when there is another manifest to
+     * prefer: a repository whose only manifest is a package.json is an npm repository
+     * however little JavaScript it has.
+     */
+    const nodeOrPythonIsTheProduct = (0, languageShare_1.languageShare)(ctx, /\.(ts|tsx|js|jsx|mjs|cjs|py)$/) >= languageShare_1.MINIMUM_LANGUAGE_SHARE;
+    const selected = fromWorkspaces
+        && fromWorkspaces.manager !== 'unknown'
+        && (nodeOrPythonIsTheProduct || !otherManifest)
         ? fromWorkspaces
-        : resolveFromOtherManifests(ctx.files.all) ?? fromWorkspaces;
+        : otherManifest ?? fromWorkspaces;
     if (selected) {
         return {
             manager: selected.manager,

package/dist/analyzer/languageShare.d.ts

@@ -0,0 +1,20 @@
+import type { DetectContext } from './detectContext';
+/**
+ * How much of a repository's source is written in a given language.
+ *
+ * Extracted from the backend detector, which grew it first: two Go files beside 547
+ * Rust ones made a report say "Backend: go". The same question decides more than one
+ * claim — which language serves the requests, and which ecosystem builds the project —
+ * and the answer should be arrived at the same way in both.
+ */
+export declare function languageShare(ctx: DetectContext, extension: RegExp): number;
+/**
+ * Below this a language is present in the repository without being what it is made of.
+ *
+ * windmill is the measurement: two Go files beside 547 Rust ones, 0.05% of its source,
+ * and the report said "Backend: go". The line is not tuned to that case — anything
+ * under one file in twenty is a client, a script or a sample, and every backend in the
+ * verification corpus is far above it. A repository genuinely split between two
+ * languages reports both, which is the right answer for one.
+ */
+export declare const MINIMUM_LANGUAGE_SHARE = 0.05;

package/dist/analyzer/languageShare.js

@@ -0,0 +1,28 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.MINIMUM_LANGUAGE_SHARE = void 0;
+exports.languageShare = languageShare;
+/**
+ * How much of a repository's source is written in a given language.
+ *
+ * Extracted from the backend detector, which grew it first: two Go files beside 547
+ * Rust ones made a report say "Backend: go". The same question decides more than one
+ * claim — which language serves the requests, and which ecosystem builds the project —
+ * and the answer should be arrived at the same way in both.
+ */
+function languageShare(ctx, extension) {
+    const source = ctx.files.source;
+    if (source.length === 0)
+        return 0;
+    return source.filter((file) => extension.test(file)).length / source.length;
+}
+/**
+ * Below this a language is present in the repository without being what it is made of.
+ *
+ * windmill is the measurement: two Go files beside 547 Rust ones, 0.05% of its source,
+ * and the report said "Backend: go". The line is not tuned to that case — anything
+ * under one file in twenty is a client, a script or a sample, and every backend in the
+ * verification corpus is far above it. A repository genuinely split between two
+ * languages reports both, which is the right answer for one.
+ */
+exports.MINIMUM_LANGUAGE_SHARE = 0.05;

package/dist/analyzer/types.d.ts

@@ -10,7 +10,7 @@
  * Only managers whose manifest this analyzer actually reads are named here. A name it
  * cannot back with a parsed file would be a guess from a filename.
  */
-export type PackageManager = 'npm' | 'pnpm' | 'yarn' | 'pip' | 'poetry' | 'python' | 'pub' | 'composer' | 'go modules' | 'cargo' | 'bundler' | 'gradle' | 'maven' | 'nuget' | 'unknown';
+export type PackageManager = 'npm' | 'pnpm' | 'yarn' | 'pip' | 'poetry' | 'python' | 'pub' | 'composer' | 'go modules' | 'cargo' | 'bundler' | 'gradle' | 'maven' | 'nuget' | 'swift package manager' | 'cocoapods' | 'unknown';
 export type PackageManagerConfidence = 'lockfile' | 'manifest' | 'inferred' | 'unknown';
 export interface WorkspaceStack {
     root: string;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@produtype/core",
-  "version": "0.77.0",
+  "version": "0.79.0",
   "description": "Deterministic CLI and library that analyzes a web application repository and reports how far it is from production-ready for the kind of product it is meant to be.",
   "license": "MIT",
   "bin": {