@produtype/core 1.9.1 → 1.10.0

package/dist/utils/textSearch.js

@@ -26,6 +26,36 @@ const blockComments_1 = require("../analyzer/blockComments");
  * and is left alone.
  */
 const PATTERN_DECLARATION = /^(?:const\s+\w+(?:\s*:[^=]+)?\s*=\s*)?\/(?:[^/\\]|\\.)+\/[gimsuy]*\s*[,;]?$/;
+/**
+ * A name given a type, rather than a value.
+ *
+ * pocketbase's report cited three lines for its cross-origin policy: `AllowedOrigins
+ * []string` — a field in a Go struct — `var allowedOrigins []string` in the command
+ * that parses the flag, and `allowedOrigins: Array<string>` in a generated `.d.ts`.
+ * Not one of them is a decision about origins. The line that is,
+ * `config.AllowedOrigins = []string{"*"}` twenty lines further down, was never
+ * reached, so a reader was given three declarations to argue with instead of the
+ * default that actually applies.
+ *
+ * It is the same rule as the regex table above, for the same reason: a declaration
+ * says what a thing is, and this analyzer claims to say what the code does.
+ *
+ * The right-hand side has to look like a type, not a value, because `AllowOrigins:
+ * config.AllowedOrigins,` is a use and reads almost identically. A type starts with a
+ * capital or is one of the primitives, and carries no quotes, no call and no digits —
+ * and an object-literal member ends in a comma, which a field signature does not.
+ */
+/**
+ * `import SwiftUI` has the shape and is not a declaration of anything.
+ *
+ * A keyword followed by a capitalised word reads exactly like a field given a type,
+ * and the first version of this rule hid every Swift and Kotlin import — which is how
+ * the native toolkits are detected, so an iOS application lost its interface. The
+ * statement keywords are excluded by name; `var`, `let` and `readonly` stay, because
+ * those really do introduce a declaration.
+ */
+const STATEMENT_KEYWORD = /^(?:import|package|from|export|return|case|new|type|class|struct|interface|enum|func|fun|def|public|private|protected|internal|throw|throws|extends|implements|use|using|namespace|module|require|await|yield|delete|typeof|instanceof|in|is|as|if|else|for|while|switch|do|try|catch|finally|with|assert|raise|lambda|val|const)\b/;
+const TYPE_DECLARATION = /^(?:var\s+|let\s+|readonly\s+)?\w+\??\s*(?::\s*|\s+)(?:\[\]|\*|Array<|Map<|\bstring\b|\bnumber\b|\bboolean\b|\bbool\b|\bany\b|\bunknown\b|\bvoid\b|[A-Z])[\w.<>[\]|&\s]*;?$/;
 /**
  * Prose about the code, rather than the code.
  *
@@ -56,9 +86,13 @@ const COMMENT_LINE = /^(?:\/\/|\/\*|\*\/?|#(?![![])(?!!)|<!--|--\s)/;
  *
  * Nothing in the shape of the line tells the two apart, so the rule is not made.
  */
+function declaresAType(trimmed) {
+    const withoutDeclarator = trimmed.replace(/^(?:var|let|readonly)\s+/, '');
+    return !STATEMENT_KEYWORD.test(withoutDeclarator) && TYPE_DECLARATION.test(trimmed);
+}
 function declaresRatherThanDoes(line) {
     const trimmed = line.trim();
-    return COMMENT_LINE.test(trimmed) || PATTERN_DECLARATION.test(trimmed);
+    return COMMENT_LINE.test(trimmed) || PATTERN_DECLARATION.test(trimmed) || declaresAType(trimmed);
 }
 /**
  * Whether this line may be quoted back to the reader as something the code does.
@@ -93,6 +127,54 @@ function isCitableLine(line) {
  * on is not worth the one it displaces.
  */
 const MAX_CITABLE_LINE = 500;
+/**
+ * A placeholder is not a value.
+ *
+ * pocketbase was reported as having tenant boundaries — `passed`, which raises a
+ * score — and the only two strong matches in its readable source were
+ * `"Ex. https://login.microsoftonline.com/YOUR_DIRECTORY_TENANT_ID/oauth2/v2.0/authorize"`,
+ * twice, in the help text of the form where somebody configures Microsoft sign-in.
+ * Microsoft Entra calls its directory a tenant; the string is telling a reader where
+ * to paste theirs. pocketbase has no organizations at all, and the rest of that
+ * finding was Apple's developer `teamId`, a weak word that cannot stand alone.
+ *
+ * `YOUR_SOMETHING` is the convention for "replace this", in documentation, in example
+ * configuration and in the help text beside a field. This analyzer already knows the
+ * shape: `your[_-]?secret` has been in the weak-secret list since the beginning.
+ *
+ * The token around the match is what decides, not the line. A line may hold a
+ * placeholder and a real value both, and only the matched one is being judged.
+ */
+const PLACEHOLDER_TOKEN = /^(?:your|my|sample|example|placeholder|changeme|todo|xxx+)[_-]/i;
+function insideAPlaceholder(line, index, length) {
+    let start = index;
+    while (start > 0 && /[A-Za-z0-9_-]/.test(line[start - 1]))
+        start--;
+    let end = index + length;
+    while (end < line.length && /[A-Za-z0-9_-]/.test(line[end]))
+        end++;
+    return PLACEHOLDER_TOKEN.test(line.slice(start, end));
+}
+/**
+ * Where a needle first matches, or -1. Shared so that both searches below judge a
+ * match the same way.
+ */
+function findNeedle(line, needle) {
+    if (typeof needle === 'string') {
+        const index = line.indexOf(needle);
+        return index === -1 ? null : { index, length: needle.length };
+    }
+    const found = new RegExp(needle.source, needle.flags.replace('g', '')).exec(line);
+    return found ? { index: found.index, length: found[0].length } : null;
+}
+function matchesHere(line, needles) {
+    for (const needle of needles) {
+        const found = findNeedle(line, needle);
+        if (found && !insideAPlaceholder(line, found.index, found.length))
+            return true;
+    }
+    return false;
+}
 /**
  * The lines of one already-read file that match, with the same hygiene the file
  * search applies: no comments, no pattern tables, no minified lines.
@@ -123,12 +205,8 @@ function matchLines(text, needles, file = '') {
             continue;
         if (declaresRatherThanDoes(line))
             continue;
-        for (const n of needles) {
-            const hit = typeof n === 'string' ? line.includes(n) : n.test(line);
-            if (hit) {
-                matches.push({ file, line: i + 1, snippet: line.trim().slice(0, 200) });
-                break;
-            }
+        if (matchesHere(line, needles)) {
+            matches.push({ file, line: i + 1, snippet: line.trim().slice(0, 200) });
         }
     }
     return matches;
@@ -171,14 +249,10 @@ async function searchInFiles(root, files, needles, limit = 25, keep) {
                 continue;
             if (declaresRatherThanDoes(line))
                 continue;
-            for (const n of needles) {
-                const hit = typeof n === 'string' ? line.includes(n) : n.test(line);
-                if (hit) {
-                    const match = { file, line: i + 1, snippet: line.trim().slice(0, 200) };
-                    if (!keep || keep(match))
-                        matches.push(match);
-                    break;
-                }
+            if (matchesHere(line, needles)) {
+                const match = { file, line: i + 1, snippet: line.trim().slice(0, 200) };
+                if (!keep || keep(match))
+                    matches.push(match);
             }
             if (matches.length >= limit)
                 break;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@produtype/core",
-  "version": "1.9.1",
+  "version": "1.10.0",
   "description": "Deterministic CLI and library that analyzes a web application repository and reports how far it is from production-ready for the kind of product it is meant to be.",
   "license": "MIT",
   "bin": {
@@ -37,7 +37,7 @@
     "docs:stacks": "npm run build && node scripts/sync-readme-stacks.mjs",
     "prepare": "npm run build",
     "clean": "node -e \"require('fs').rmSync('dist',{recursive:true,force:true})\"",
-    "prepublishOnly": "npm run build && node scripts/assert-no-ai.mjs && npm test"
+    "prepublishOnly": "npm run build && npm run lint && node scripts/assert-no-ai.mjs && npm test"
   },
   "engines": {
     "node": ">=18"