@produtype/core 0.93.0 → 0.95.0

package/dist/analyzer/analyzeProject.js

@@ -185,6 +185,25 @@ function layoutPartOf(file) {
     const root = JVM_MAIN_SOURCE_ROOT.exec(file);
     return root ? file.slice(0, root.index + root[0].length) : file;
 }
+/**
+ * Go names its tests by file, never by directory.
+ *
+ * `_test.go` is the suffix the toolchain compiles separately; a directory called
+ * `mock`, `testing` or `fixtures` is just a package. testify's own `mock/mock.go` —
+ * half of what that library is for — was removed by the rule that drops `mocks/`, and
+ * the analyzer saw 38 of its Go files with the two biggest missing.
+ *
+ * One directory convention is left here, and it is the toolchain's: a directory whose
+ * name begins with `_` or `.` is skipped when building, which is why testify keeps
+ * `_codegen` and `_readme-gofmt` under those names.
+ *
+ * `vendor/` and `testdata/` are not repeated: the file scanner never hands them over
+ * in the first place. Both were written here and both survived being deleted in a
+ * mutation run, which is how the duplication came to light.
+ */
+function isGoToolchainExclusion(file) {
+    return /(^|\/)[_.][^/]+\//.test(file);
+}
 function isTestOrExamplePath(file) {
     // `__mocks__` was missing, and a mock is the most misleading file in a repository:
     // `application_fee_percent: null` inside a Stripe fixture made an open-source CRM read
@@ -192,6 +211,12 @@ function isTestOrExamplePath(file) {
     // `fixtures` was listed and `fixture` was not, so `extra/fixture/authsources.php`
     // made PHP one of the languages of an Elixir analytics product — and of cal.com,
     // which is TypeScript.
+    /**
+     * A Go file answers to Go's conventions and to none of the directory rules below:
+     * every one of those names is a package name there.
+     */
+    if (/\.go$/.test(file))
+        return isGoToolchainExclusion(file) || /_test\.go$/.test(file);
     const layout = layoutPartOf(file);
     return /(^|\/)(__tests__|__mocks__|mocks?|tests?|test-data|fixtures?|frontend-example)(\/|$)/i.test(layout)
         /**

package/dist/analyzer/detectBackend.js

@@ -176,10 +176,22 @@ async function detectBackend(ctx) {
             value: ctx.dotnetWebSdk ? 'a project declaring Microsoft.NET.Sdk.Web' : 'an ASP.NET Core package reference',
         });
     }
-    else if (ctx.dotnetDeps.length > 0 || ctx.files.all.some((f) => /\.csproj$/i.test(f))) {
-        frameworks.push('dotnet');
-        evidence.push({ type: 'note', value: 'a .NET project with no web SDK' });
-    }
+    /**
+     * A `.csproj` with no web SDK used to be listed as a backend called "dotnet", and
+     * that is the same mistake the Rust fallback made before 0.71.0: a project file is
+     * not a server.
+     *
+     * .NET builds libraries, console tools, desktop applications and web services from
+     * the same project format, and `Microsoft.NET.Sdk.Web` is the line that says which.
+     * Moq — a mocking library, 243 C# files — was reported with "Backend: dotnet",
+     * which made it a product with a server, which kept it out of the `library` profile
+     * and got it judged as a client application: asked at `high` for state durability,
+     * asset delivery and browser crash reporting.
+     *
+     * Nothing replaces it. The language is already named in the reading-depth line and
+     * in the package manager, and "this is a .NET project" was never an answer to
+     * "what serves the requests".
+     */
     /**
      * Astro, which is a backend only when it is configured to be one.
      *

package/dist/analyzer/detectPackaging.js

@@ -59,7 +59,17 @@ const DOCS_GENERATORS = [
  * of these.
  */
 exports.DOCS_DIRECTORIES = /(^|\/)(docs?|website|playground|examples?|demo|www)\//i;
-const FRONTEND_FILE = /\.(tsx|jsx|vue|svelte|astro)$/;
+/**
+ * `.html` belongs here because the front-end fact counts it.
+ *
+ * The front-end detector falls back to "a page is a front end" and counts `.html`
+ * files, so a library whose only pages are its documentation comes out with a front
+ * end. This test — is every front-end file under a docs directory — looked at
+ * framework extensions only, so it could not see those pages and could not answer
+ * yes. Moq's documentation is plain HTML under `docs/`, and Moq was profiled as a
+ * static site: a mocking library with 243 C# files, judged on its Jekyll theme.
+ */
+const FRONTEND_FILE = /\.(tsx|jsx|vue|svelte|astro|html?)$/;
 /**
  * The published package inside a workspace, if there is one.
  *
@@ -173,7 +183,8 @@ async function detectPackaging(ctx) {
         }
     }
     const hasManifest = ctx.packageJson !== null
-        || all.some((f) => /(^|\/)(pyproject\.toml|setup\.py|go\.mod|Cargo\.toml|composer\.json|\w+\.gemspec)$/i.test(f));
+        || all.some((f) => /(^|\/)(pyproject\.toml|setup\.py|go\.mod|Cargo\.toml|composer\.json|\w+\.gemspec)$/i.test(f))
+        || all.some((f) => /\.(csproj|fsproj|vbproj)$/i.test(f));
     /**
      * A name and a version. Without them nothing can depend on this, whatever else it
      * does right.
@@ -181,12 +192,50 @@ async function detectPackaging(ctx) {
     const named = typeof pkg.name === 'string' && typeof pkg.version === 'string';
     const described = typeof pkg.description === 'string' && pkg.description.length > 0;
     const sourced = pkg.repository !== undefined || pkg.homepage !== undefined;
-    const entrypointCount = nodeEntrypoints.length + (pythonEntrypoints ? 1 : 0);
+    /**
+     * The other ecosystems' way of saying "something else may depend on this".
+     *
+     * Both facts were read from `package.json` and Python packaging alone, so no
+     * library written in anything else could reach the `library` profile. Moq — a
+     * mocking library of 243 C# files, `<PackageId>Moq</PackageId>` and
+     * `<IsPackable>True</IsPackable>` in its csproj — was judged a client application
+     * and asked at `high` for state durability, asset delivery and browser crash
+     * reporting. tokio could not be classified at all.
+     *
+     * Each is the declaration its own toolchain requires to publish: a csproj that
+     * names a package id, a Cargo manifest with a `[package]` name and version beside a
+     * `src/lib.rs`. A crate that says `publish = false` is saying the opposite, and is
+     * not counted.
+     */
+    let dotnetPackageId = false;
+    for (const file of all.filter((f) => /\.(csproj|fsproj|vbproj)$/i.test(f)).slice(0, 12)) {
+        const raw = (await (0, readTextFileSafe_1.readTextFileSafe)(ctx.root, file)) ?? '';
+        if (/<PackageId>|<IsPackable>\s*true\s*<\/IsPackable>|<GeneratePackageOnBuild>\s*true/i.test(raw)) {
+            dotnetPackageId = true;
+        }
+    }
+    let rustCrate = false;
+    for (const file of all.filter((f) => /(^|\/)Cargo\.toml$/.test(f)).slice(0, 8)) {
+        const raw = (await (0, readTextFileSafe_1.readTextFileSafe)(ctx.root, file)) ?? '';
+        if (!/^\s*\[package\]/m.test(raw))
+            continue;
+        if (/^\s*publish\s*=\s*false/m.test(raw))
+            continue;
+        if (!/^\s*name\s*=/m.test(raw) || !/^\s*version\s*=/m.test(raw))
+            continue;
+        const crateRoot = file.replace(/Cargo\.toml$/, '');
+        if (all.some((f) => f === `${crateRoot}src/lib.rs`))
+            rustCrate = true;
+    }
+    const entrypointCount = nodeEntrypoints.length
+        + (pythonEntrypoints ? 1 : 0)
+        + (dotnetPackageId ? 1 : 0)
+        + (rustCrate ? 1 : 0);
     return [
         {
             key: 'packaging.manifest',
             present: hasManifest,
-            complete: hasManifest && (named || pythonEntrypoints),
+            complete: hasManifest && (named || pythonEntrypoints || dotnetPackageId || rustCrate),
             evidence: hasManifest
                 ? [
                     publishedMember
@@ -203,9 +252,11 @@ async function detectPackaging(ctx) {
             evidence: [
                 ...nodeEntrypoints.map((key) => ({ type: 'note', value: `package.json declares "${key}"` })),
                 ...(pythonEntrypoints ? [{ type: 'note', value: 'a Python package or console script declaration' }] : []),
+                ...(dotnetPackageId ? [{ type: 'note', value: 'a project that declares a NuGet package id' }] : []),
+                ...(rustCrate ? [{ type: 'note', value: 'a Cargo package with a library crate root' }] : []),
                 ...(hasTypes ? [{ type: 'note', value: 'TypeScript types are declared' }] : []),
             ],
-            details: { nodeEntrypoints, hasTypes, pythonEntrypoints },
+            details: { nodeEntrypoints, hasTypes, pythonEntrypoints, dotnetPackageId, rustCrate },
         },
         {
             key: 'packaging.license',

package/dist/report/buildReport.js

@@ -161,11 +161,27 @@ function buildReport(analysis, options) {
     // and for the same reason must count. A Unity game and a Phaser game were each
     // identified as games by name and then called unreadable in the same report.
     const gameEngineDetected = analysis.detectors['game.engine']?.present === true;
+    /**
+     * A library is not an unidentified repository.
+     *
+     * The three lists describe an application, and a package has none of them, so
+     * "nothing identified" was true of every library — and it is what makes a report
+     * inconclusive. The `dotnet-library` fixture crossed that line the moment the "a
+     * .csproj is a backend" fallback was removed in the same release: a library with a
+     * NuGet manifest, read correctly, reported as a repository this analyzer could not
+     * make sense of.
+     *
+     * A package manager this analyzer parsed, beside a language it read, identifies a
+     * repository as surely as a web framework does. Loose scripts with no manifest
+     * still answer no.
+     */
+    const packagedInAKnownEcosystem = analysis.stack.packageManager !== 'unknown' && analysis.stack.languages.length > 0;
     const stackDetected = analysis.stack.frontend.length > 0
         || analysis.stack.backend.length > 0
         || analysis.stack.databases.length > 0
         || mobileDetected
-        || gameEngineDetected;
+        || gameEngineDetected
+        || packagedInAKnownEcosystem;
     /**
      * Coverage counts the expectations too, not only the observed rules.
      *

package/dist/rules/rules.js

@@ -169,7 +169,26 @@ exports.rules = [
         category: 'stack',
         severity: 'low',
         evaluate: ({ analysis }) => {
-            const hasStack = analysis.stack.frontend.length > 0 || analysis.stack.backend.length > 0 || analysis.stack.databases.length > 0;
+            /**
+             * A library has no front end, no backend and no database, and it is not
+             * unidentifiable.
+             *
+             * The three lists are what an application is made of, and asking only about
+             * them made every library "generic or unknown to ProdKit" — which on tokio, a
+             * repository of 505 Rust files with a Cargo manifest, was enough to leave the
+             * whole report inconclusive. Removing the "a .csproj is a backend" fallback in
+             * the same release made the `dotnet-library` fixture do the same, which is how
+             * this surfaced.
+             *
+             * What this repository is built with is a fingerprint too: a package manager
+             * this analyzer actually parsed, and a language it actually read. A directory
+             * of loose scripts with no manifest still answers unknown.
+             */
+            const named = analysis.stack.packageManager !== 'unknown' && analysis.stack.languages.length > 0;
+            const hasStack = analysis.stack.frontend.length > 0
+                || analysis.stack.backend.length > 0
+                || analysis.stack.databases.length > 0
+                || named;
             const status = hasStack ? 'passed' : 'unknown';
             return mkFinding({
                 id: 'stack.detected',
@@ -177,14 +196,31 @@ exports.rules = [
                 category: 'stack',
                 status,
                 severity: sevForStatus(status, 'low'),
-                description: hasStack ? 'ProdKit identified known stack signals.' : 'Stack is generic or unknown to ProdKit.',
+                description: hasStack
+                    ? 'ProdKit identified known stack signals.'
+                    : 'Stack is generic or unknown to ProdKit.',
                 recommendation: hasStack
                     ? 'No action required.'
                     : 'Add explicit framework manifests or keep this as generic app baseline.',
+                /**
+                 * A finding that passes has to point at something.
+                 *
+                 * When the three stack lists are empty the arrays below are empty too, so
+                 * letting a package manager satisfy this check produced twenty passing
+                 * findings with nothing under them — which is the one thing
+                 * `everyFindingSaysWhatItLookedFor` exists to stop. The manifest and the
+                 * language are what was read, so they are what is cited.
+                 */
                 evidence: [
                     ...analysis.detectors['stack.frontend']?.evidence ?? [],
                     ...analysis.detectors['stack.backend']?.evidence ?? [],
                     ...analysis.detectors['stack.database']?.evidence ?? [],
+                    ...(named
+                        ? [{
+                                type: 'note',
+                                value: `a ${analysis.stack.packageManager} manifest and ${analysis.stack.languages.join(', ')} sources`,
+                            }]
+                        : []),
                 ],
             });
         },

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@produtype/core",
-  "version": "0.93.0",
+  "version": "0.95.0",
   "description": "Deterministic CLI and library that analyzes a web application repository and reports how far it is from production-ready for the kind of product it is meant to be.",
   "license": "MIT",
   "bin": {