Public recordModerate
Software health reportschema 0.27.0 · metrics 1.13.0 · 2026-07-25 14:08 UTC
DoniLite / wrap
OOP backend framework on Hono + Drizzle — Bun-first, vertical-slice, decorator-driven.
DoniLite/wrap holds a health index of 59 out of 100, placing it in the Moderate band. It scores highest on Engineering Quality (81/100) and lowest on Community & Adoption (23/100). It was last updated 4 days ago. A single contributor accounts for most of its recent work.
59
overall / 100Software health index
Metrics are grouped into weighted categories on one standardized 1–100 scale. Overall starts as their weighted mean; when public evidence triggers the High-Risk Jurisdiction Policy, the rating is adjusted and receives an At risk ceiling of 49. AI Readiness sits outside the overall score.
59
Excellent85-100Exemplary; meets essentially all checked criteria
Good70-84Healthy; minor gaps
Moderate50-69Acceptable with notable gaps; review recommended
At risk30-49Significant weaknesses; adoption warrants caution
Critical1-29Severe problems (abandoned, single-maintainer, no hygiene)
Score profile
Each axis is a category. The shape matters more than the average — a healthy subject fills the whole shape, while a spike-and-crater profile means strength in one dimension is masking risk in another.
Ownership
DoniPersonal account
38 followers53 public repossince Jul 2022
This repository is owned by a personal account. A single-owner project carries more continuity risk than an organization-backed one.
Package ecosystems
| Registry | Package | Version | Downloads / mo | Versions | Last publish | Tags |
|---|---|---|---|---|---|---|
| npm | @donilite/wrap | 1.4.4 | 844 | 6 | 9 days ago | bunhonodrizzleframeworkbackendtypescriptdecoratorsvertical-slice |
| npm | @donilite/create-wrap | 1.4.4 | 826 | 6 | 9 days ago | bunhonodrizzlebackendscaffoldtypescriptapi |
Metrics by category
Vitality
Is the project alive — is code being written and are releases shipping?
79
Development activity
65Moderate
How it's scored
| 36/36 | Push recency — last push 4 days ago |
| 3.5/36 | Commit cadence — 5/52 weeks with commits |
| 15.6/18 | Commit volume — 54 commits in the last year |
| 10/10 | OpenSSF Scorecard: Maintained — 30 commit(s) and 3 issue activity found in the last 90 days -- score normalized to 10 |
Inputs used
| commits_last_year | 54 |
| human_commit_share | 1 |
| days_since_last_push | 4 |
| active_weeks_last_year | 5 |
Release discipline
100Excellent
How it's scored
| 27/27 | Ships releases — 5 releases published |
| 36/36 | Release recency — latest release 9 days ago |
| 27/27 | Release cadence — a release every ~2 days |
| 0/10 | OpenSSF Scorecard: Signed-Releases — no data |
Inputs used
| releases_count | 5 |
| latest_release_tag | v1.4.4 |
| releases_from_tags | no |
| days_since_latest_release | 9 |
| mean_days_between_releases | 2 |
Excluded from scoring (no data or not applicable): OpenSSF Scorecard: Signed-Releases. Remaining weights renormalized.
Community & Adoption
Does the project have users, downloads, attention, and a welcoming setup for contributors?
23
Popularity & adoption
1Critical
How it's scored
| 0/60 | Stars — 1 stars |
| 0/25 | Forks — 0 forks |
| 0/15 | Watchers — 0 watchers |
Inputs used
| forks | 0 |
| stars | 1 |
| watchers | 0 |
| growth_state | unverified |
| growth_factor_pct | 100 |
| growth_unverified_reason | no_history |
Community health
25Critical
How it's scored
| 22.5/22.5 | README |
| 0/22.5 | License — no license file detected |
| 0/18 | CONTRIBUTING guide |
| 0/13.5 | Code of conduct |
| 0/7.2 | Issue template |
| 0/6.3 | PR template |
Inputs used
| has_readme | yes |
| has_license | no |
| has_contributing | no |
| has_issue_template | no |
| has_code_of_conduct | no |
| has_pull_request_template | no |
Ecosystem adoption (downloads)
54Moderate
How it's scored
| 43/80 | Monthly downloads — 1,670 downloads/month across npm |
| 0/20 | Registry dependents — not reported by this ecosystem |
Inputs used
| packages | @donilite/wrap, @donilite/create-wrap |
| dependents | — |
| ecosystems | npm |
| total_downloads | — |
| monthly_downloads | 1,670 |
Excluded from scoring (no data or not applicable): Registry dependents. Remaining weights renormalized.
Sustainability & Governance
Will the project survive its people — bus factor, responsiveness, who backs it, and package upkeep?
54
Maintainer resilience (bus factor)
13Critical
How it's scored
| 9/54 | Bus factor — 1 contributor(s) cover half of all commits |
| 0/22.5 | Commit distribution — top contributor authored 100% of commits |
| 1.4/13.5 | Contributor breadth — 1 contributors |
| 3/10 | OpenSSF Scorecard: Contributors — project has 1 contributing companies or organizations -- score normalized to 3 |
Inputs used
| bus_factor | 1 |
| contributors_sampled | 1 |
| top_contributor_share | 1 |
Issue & PR responsiveness
69Moderate
How it's scored
| 31.2/46.8 | Issue resolution — 67% of issues closed |
| 38.2/38.3 | PR acceptance — 2/2 decided PRs merged |
| 0/15 | OpenSSF Scorecard: Code-Review — Found 0/18 approved changesets -- score normalized to 0 |
Inputs used
| merged_prs | 2 |
| open_issues | 1 |
| closed_issues | 2 |
| issue_closed_ratio | 0.667 |
| closed_unmerged_prs | 0 |
Ownership & stewardship
52Moderate
How it's scored
| 10/30 | Ownership backing — personal (user) account |
| 0/20 | Verified domain — not applicable to user accounts |
| 11.4/25 | Owner reach — 38 followers of DoniLite |
| 20.6/25 | Track record — 53 public repos, account ~3 yr old |
Inputs used
| followers | 38 |
| owner_type | User |
| is_verified | — |
| owner_login | DoniLite |
| public_repos | 53 |
| account_age_days | 1,455 |
Excluded from scoring (no data or not applicable): Verified domain. Remaining weights renormalized.
Package maintenance
100Excellent
How it's scored
| 25/25 | Published & resolvable — 2 package(s) on npm |
| 35/35 | Publish recency — latest publish 9 days ago |
| 20/20 | Version history — 6 published versions |
| 20/20 | Not deprecated — active, not deprecated or yanked |
Inputs used
| packages | @donilite/wrap, @donilite/create-wrap |
| ecosystems | npm |
| any_deprecated | no |
| min_days_since_publish | 9 |
Engineering Quality
Are baseline engineering and documentation practices in place?
81
Engineering practices
68Moderate
How it's scored
| 24/24 | CI workflows — 3 workflow(s) |
| 24/24 | Tests present |
| 0/16 | Linter config |
| 0/9.6 | Pre-commit hooks |
| 0/6.4 | .editorconfig |
| 20/20 | OpenSSF Scorecard: CI-Tests — 2 out of 2 merged PRs checked by a CI test -- score normalized to 10 |
Inputs used
| has_ci | yes |
| has_tests | yes |
| has_editorconfig | no |
| has_linter_config | no |
| has_precommit_config | no |
Documentation
100Excellent
How it's scored
| 30/30 | README |
| 25/25 | Documentation directory |
| 15/15 | Documentation / homepage site — https://donilite.github.io/wrap/ |
| 10/10 | Repository description |
| 10/10 | Topics — 5 topics |
| 10/10 | Wiki |
Inputs used
| topics | hono, npm, package, poo, ts |
| has_wiki | yes |
| homepage | https://donilite.github.io/wrap/ |
| has_readme | yes |
| has_docs_dir | yes |
| has_description | yes |
Security
Are visible security and supply-chain practices strong, without unresolved high-risk jurisdiction exposure?
52
Security posture
40At risk
How it's scored
| 7.5/7.5 | Binary-Artifacts — no binaries found in the repo |
| 0/7.5 | Branch-Protection — branch protection not enabled on development/release branches |
| 2.5/2.5 | CI-Tests — 2 out of 2 merged PRs checked by a CI test -- score normalized to 10 |
| 0/2.5 | CII-Best-Practices — no effort to earn an OpenSSF best practices badge detected |
| 0/7.5 | Code-Review — Found 0/18 approved changesets -- score normalized to 0 |
| 0.8/2.5 | Contributors — project has 1 contributing companies or organizations -- score normalized to 3 |
| 10/10 | Dangerous-Workflow — no dangerous workflow patterns detected |
| 0/7.5 | Dependency-Update-Tool — no update tool detected |
| 0/5 | Fuzzing — project is not fuzzed |
| 0/2.5 | License — license file not detected |
| 7.5/7.5 | Maintained — 30 commit(s) and 3 issue activity found in the last 90 days -- score normalized to 10 |
| 5/5 | Packaging — packaging workflow detected |
| 0/5 | Pinned-Dependencies — dependency not pinned by hash detected -- score normalized to 0 |
| 0/5 | SAST — SAST tool is not run on all commits -- score normalized to 0 |
| 0/5 | Security-Policy — security policy file not detected |
| 0/7.5 | Signed-Releases — no data |
| 0/7.5 | Token-Permissions — detected GitHub workflow tokens with excessive permissions |
| 6/7.5 | Vulnerabilities — 2 existing vulnerabilities detected |
Inputs used
| source | openssf_scorecard |
| checks_evaluated | 17 |
| scorecard_version | v5.5.0 |
| checks_inconclusive | 1 |
| scorecard_aggregate | 4 |
Excluded from scoring (no data or not applicable): signed_releases. Remaining weights renormalized.
Dependency advisories
100Excellent
How it's scored
| 35/35 | Direct dependencies free of known advisories — no direct dependency carries a known advisory |
| 25/25 | Indirect dependencies free of known advisories — no indirect dependency carries a known advisory |
| 0/40 | No advisories left outstanding — no advisory carries a publication date |
Inputs used
| source | osv |
| advisories | 0 |
| affected_packages | 0 |
| assessed_packages | 3 |
| unassessed_packages | 0 |
| affected_by_severity | none |
| direct_affected_packages | 0 |
Excluded from scoring (no data or not applicable): No advisories left outstanding. Remaining weights renormalized. Matched the npm:@donilite/wrap@1.4.4 runtime dependency closure — what installing the published package pulls in — 3 packages. Reachability is not analyzed.
AI Readiness
How well is the repo equipped to be developed and maintained with AI coding agents? An independent, experimental badge — weight 0.0, so it is surfaced on its own and does not affect the overall health score.
68
Agent context & guidance
85Excellent
How it's scored
| 45/45 | Agent instructions — CLAUDE.md, packages/create-wrap/profiles/api-aggregator/files/CLAUDE.md, packages/create-wrap/profiles/fullstack-ssr/files/CLAUDE.md, packages/create-wrap/profiles/gateway/files/CLAUDE.md, packages/create-wrap/profiles/lightweight-api/files/CLAUDE.md, packages/create-wrap/template/CLAUDE.md |
| 0/15 | Machine-readable docs (llms.txt) |
| 40/40 | Legible commit history — 54 of 54 human commits state their intent (structured subject or explanatory body) |
Inputs used
| has_llms_txt | no |
| legible_history_share | 1 |
| agent_instruction_files | CLAUDE.md, packages/create-wrap/profiles/api-aggregator/files/CLAUDE.md, packages/create-wrap/profiles/fullstack-ssr/files/CLAUDE.md, packages/create-wrap/profiles/gateway/files/CLAUDE.md, packages/create-wrap/profiles/lightweight-api/files/CLAUDE.md, packages/create-wrap/template/CLAUDE.md |
| agent_instruction_max_bytes | 9,934 |
Verify loop (build / test / typecheck)
53Moderate
How it's scored
| 0/18 | One-command bootstrap |
| 22/22 | Automated tests |
| 0/11 | Lint / format config |
| 11/11 | Static type checking — packages/create-wrap/profiles/fullstack-ssr/files/tsconfig.json, packages/create-wrap/template/tsconfig.json, packages/wrap/tsconfig.json |
| 10/10 | Reproducible environment — Dockerfile |
| 10/10 | Demonstrated agent practice — 3 of the last 54 commits agent-authored or agent-credited |
| 0/8 | Automated maintenance — no automated dependency updates observed |
| 0/10 | OpenSSF Scorecard: Pinned-Dependencies — dependency not pinned by hash detected -- score normalized to 0 |
Inputs used
| has_nix | no |
| has_tests | yes |
| lockfiles | — |
| has_dockerfile | yes |
| typed_language | yes |
| bootstrap_files | — |
| has_devcontainer | no |
| has_linter_config | no |
| typecheck_configs | packages/create-wrap/profiles/fullstack-ssr/files/tsconfig.json, packages/create-wrap/template/tsconfig.json, packages/wrap/tsconfig.json |
| agent_commit_share | 0.056 |
| toolchain_manifests | — |
| dependency_bot_commit_share | 0 |
Code legibility for models
100Excellent
How it's scored
| 45/45 | Type-checkable code — TypeScript (statically typed) |
| 55/55 | Manageable file sizes — 0/126 source files over 60KB |
Inputs used
| primary_language | TypeScript |
| largest_source_bytes | 27,878 |
| source_files_sampled | 126 |
| oversized_source_files | 0 |
Machine-readable interfaces
40At risk
How it's scored
| 0/40 | API schema (OpenAPI/GraphQL/proto) |
| 0/20 | MCP server |
| 40/40 | Runnable examples — example |
Inputs used
| example_dirs | example |
| has_mcp_signal | no |
| api_schema_files | — |
Key facts
1GitHub stars
1contributors
54commits, last 12 months
4days since last push
5releases
1bus factor
1open issues
npmpackage ecosystems
Data collection warnings
- Star history unavailable: GitHub GraphQL error: Resource not accessible by personal access token
- GitHub dependency-graph SBOM unavailable (404); the dependency graph may be disabled for this repository
More detail
OpenSSF Scorecard 4.0 / 10
4.0aggregate
Independent, tool-agnostic security assessment from the open-source OpenSSF Scorecard. Each check rewards a security practice, not a specific vendor's tool. Checks Scorecard could not determine are marked n/a and excluded from the security score (never counted as zero).
| 10 | Binary-Artifacts | no binaries found in the repo |
| 0 | Branch-Protection | branch protection not enabled on development/release branches |
| 10 | CI-Tests | 2 out of 2 merged PRs checked by a CI test -- score normalized to 10 |
| 0 | CII-Best-Practices | no effort to earn an OpenSSF best practices badge detected |
| 0 | Code-Review | Found 0/18 approved changesets -- score normalized to 0 |
| 3 | Contributors | project has 1 contributing companies or organizations -- score normalized to 3 |
| 10 | Dangerous-Workflow | no dangerous workflow patterns detected |
| 0 | Dependency-Update-Tool | no update tool detected |
| 0 | Fuzzing | project is not fuzzed |
| 0 | License | license file not detected |
| 10 | Maintained | 30 commit(s) and 3 issue activity found in the last 90 days -- score normalized to 10 |
| 10 | Packaging | packaging workflow detected |
| 0 | Pinned-Dependencies | dependency not pinned by hash detected -- score normalized to 0 |
| 0 | SAST | SAST tool is not run on all commits -- score normalized to 0 |
| 0 | Security-Policy | security policy file not detected |
| n/a | Signed-Releases | no releases found |
| 0 | Token-Permissions | detected GitHub workflow tokens with excessive permissions |
| 8 | Vulnerabilities | 2 existing vulnerabilities detected |
Direct dependencies 4
| Registry | Package | Version constraint | Manifest |
|---|---|---|---|
| npm | @clack/prompts | ^1.7.0 | packages/create-wrap/package.json |
| npm | @hono/swagger-ui | ^0.6.1 | packages/wrap/package.json |
| npm | date-fns | ^4.1.0 | packages/wrap/package.json |
| npm | reflect-metadata | ^0.2.2 | packages/wrap/package.json |
All dependencies not collected
The resolved dependency set could not be collected for this report: GitHub dependency-graph SBOM unavailable (404); the dependency graph may be disabled for this repository
Dependency advisories 0
Installing npm:@donilite/wrap@1.4.4 pulls in 3 packages, direct and transitive: 0 carry known advisories, of which 0 are direct dependencies.
No known advisories affect the assessed dependencies.
An advisory means the version recorded in the dependency graph falls inside an advisory’s affected range. Reachability is not analysed, and the graph includes development and test pins — a finding may concern tooling rather than shipped software.
Raw JSON report machine-readable
{
"data": {
"repo": {
"topics": [
"hono",
"npm",
"package",
"poo",
"ts"
],
"is_fork": false,
"size_kb": 408,
"has_wiki": true,
"homepage": "https://donilite.github.io/wrap/",
"languages": {
"TypeScript": 341804
},
"pushed_at": "2026-07-21T06:45:32Z",
"created_at": "2026-01-23T19:25:02Z",
"owner_type": "User",
"updated_at": "2026-07-16T11:49:20Z",
"description": "OOP backend framework on Hono + Drizzle — Bun-first, vertical-slice, decorator-driven.",
"is_archived": false,
"is_disabled": false,
"license_spdx": null,
"default_branch": "main",
"license_spdx_raw": null,
"primary_language": "TypeScript",
"significant_languages": [
"TypeScript"
]
},
"owner": {
"blog": "donilite.me",
"name": "Doni",
"type": "User",
"login": "DoniLite",
"company": null,
"location": "www",
"followers": 38,
"avatar_url": "https://avatars.githubusercontent.com/u/110300389?v=4",
"created_at": "2022-07-30T16:20:13Z",
"is_verified": null,
"public_repos": 53,
"account_age_days": 1455
},
"license": {
"state": "absent",
"spdx_id": null,
"raw_spdx": null,
"file_present": false,
"scorecard_found": false,
"profile_has_license": false
},
"activity": {
"releases": [
{
"tag": "v1.4.4",
"kind": "patch",
"published_at": "2026-07-16T11:23:12Z"
},
{
"tag": "v1.4.3",
"kind": "patch",
"published_at": "2026-07-15T15:09:54Z"
},
{
"tag": "v1.2.2",
"kind": "patch",
"published_at": "2026-07-08T16:02:44Z"
},
{
"tag": "v1.2.1",
"kind": "patch",
"published_at": "2026-07-08T14:46:36Z"
},
{
"tag": "v1.2.0",
"kind": "minor",
"published_at": "2026-07-08T12:51:11Z"
}
],
"recent_commits": [
{
"oid": "2e4d2bac44c69ae95b22eacc7aa794d4d23c53c9",
"body": "Every `bun create @donilite/wrap` / `bunx @donilite/create-wrap`\nmention across READMEs, generated CLAUDE.md files, and the docs site\nnow reads `@latest` explicitly, so copy-pasted commands don't silently\nresolve to a cached/older version via package-manager npx-style\nresolution quirks.",
"is_bot": false,
"headline": "docs: pin create-wrap invocations to @latest",
"author_name": "DoniLite",
"author_login": "DoniLite",
"committed_at": "2026-07-16T11:48:06Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "2ca4e7ededb4a3c9a2f6e35666d322fd2728fd09",
"body": "Builds /docs on every push to main that touches it and publishes to\nGitHub Pages via the official actions/jekyll-build-pages +\ndeploy-pages actions — no Gemfile needed, that build container already\nsupports remote_theme/jekyll-remote-theme. Requires a one-time repo\nsetting: Settings → Pages → Source → \"GitHub Actions\".",
"is_bot": false,
"headline": "ci: deploy the Jekyll docs site to GitHub Pages",
"author_name": "DoniLite",
"author_login": "DoniLite",
"committed_at": "2026-07-16T11:10:32Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "6580a11a0bb19987c24ae24e23b114dba6d5fcb8",
"body": "A just-the-docs site under /docs, deployable as-is via Jekyll CI/CD:\na home page, a getting-started walkthrough, four conceptual guides\n(architecture, auth, offline sync, swagger), and a full API reference\npage per module covering every exported class, function, interface,\nand type with full signatures — plus a CLI reference for create-wrap\nand its five profiles.",
"is_bot": false,
"headline": "docs: add Jekyll-deployable API reference and guide handbook",
"author_name": "DoniLite",
"author_login": "DoniLite",
"committed_at": "2026-07-16T10:58:22Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "2b3df8be814a1061e2c653c2e81ebc705d870af5",
"body": "Every profile gets an LLM guide tailored to what it actually contains:\nthe full-backend template's own CLAUDE.md covers the entity/DTO/\nrepository/service/controller pattern end to end, and each lighter\nprofile's override in profiles/<id>/files/ corrects for what that\nprofile doesn't have (no DB, no\n[…]\nating the full-backend guide wholesale.\n\nVerified via a scratch scaffoldProject() run across all 5 profiles:\nCLAUDE.md is present and its {{APP_NAME}}-style placeholders are\nsubstituted in every case.",
"is_bot": false,
"headline": "feat(create-wrap): scaffold a CLAUDE.md into every generated project",
"author_name": "DoniLite",
"author_login": "DoniLite",
"committed_at": "2026-07-16T10:58:04Z",
"body_truncated": true,
"is_coding_agent": false
},
{
"oid": "b97d158c2e0d8b361300ab97f9a060a4a3b2e6f4",
"body": "An LLM (or human) working in this repo needs orientation that isn't\nderivable by reading code in isolation: the two-package release model,\nwhy route registration is lazy, why packages/wrap ships zero internal\ntests (the template's ~55 tests are the real coverage), and the\nverification commands every change should pass before being done.",
"is_bot": false,
"headline": "docs: add root CLAUDE.md framework guide",
"author_name": "DoniLite",
"author_login": "DoniLite",
"committed_at": "2026-07-16T10:56:37Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "7f27db7d49d2403306bc80a213f61bd04f2537e1",
"body": "`SelectOption` needed a `disabled` field to structurally match clack's\nown option type, and `handleCancel`'s post-narrowing return needed an\nexplicit cast — @types/node was missing as a devDependency for the CLI\npackage's own typecheck to resolve.\n\nCo-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>",
"is_bot": false,
"headline": "fix: typecheck fixes for @clack/prompts option types",
"author_name": "DoniLite",
"author_login": "DoniLite",
"committed_at": "2026-07-16T10:56:25Z",
"body_truncated": false,
"is_coding_agent": true
},
{
"oid": "c8dd2882798d768c20356769840e3ed5589e5408",
"body": "The CLI quit silently right after the first interactive prompt in a\nreal terminal (confirmed live: profile select worked, the Redis-cache\nconfirm that followed did not wait for input). Root cause: readLine()\nused `for await (const line of console)`, breaking out via an early\n`return` inside the loop\n[…]\nles.ts`/`index.ts` needed no changes. Note for whoever uses\nthis: `select()` now navigates with arrow keys + Enter instead of\ntyping a number — clack's standard interaction model, not a numbered\nmenu.",
"is_bot": false,
"headline": "fix: replace hand-rolled interactive prompts with @clack/prompts",
"author_name": "DoniLite",
"author_login": "DoniLite",
"committed_at": "2026-07-16T01:35:13Z",
"body_truncated": true,
"is_coding_agent": false
},
{
"oid": "d31f69bc01f2e1f4bfa70fdd98ecb6f870d0c3d2",
"body": null,
"is_bot": false,
"headline": "fix: update realtime documentation and refactor WebSocket import",
"author_name": "DoniLite",
"author_login": "DoniLite",
"committed_at": "2026-07-15T15:08:23Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "fc316423519714efcdeeaaddab51863454fd59a9",
"body": "Feat/lightweight setup",
"is_bot": false,
"headline": "Merge pull request #2 from DoniLite/feat/lightweight-setup",
"author_name": "Doni",
"author_login": "DoniLite",
"committed_at": "2026-07-13T18:40:51Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "8fb98772b0facb8c1c0c027adfbc62d731773e9c",
"body": "Proxy/gateway profile: an HTTP reverse-proxy example using Hono's\nbuilt-in proxy() helper (hono/proxy — the standard approach, checked it\nexists in the installed hono version rather than assuming), and a\nbest-effort WebSocket proxy helper (src/gateway/ws-proxy.ts) relaying\nframes both directions ove\n[…]\nlly at the module\nlevel (entity.ts, events.ts, dto.ts, database.ts), independent of whether\na DB connection is ever established. Decoupling that is flagged as a\nseparate follow-up, not attempted here.",
"is_bot": false,
"headline": "feat: gateway CLI profile, document the profile-diff mechanics",
"author_name": "DoniLite",
"author_login": "DoniLite",
"committed_at": "2026-07-08T20:12:40Z",
"body_truncated": true,
"is_coding_agent": false
},
{
"oid": "f608686374d0ac1f196b7ff77ba6a5809c4b25fe",
"body": "Backend framework stays TanStack Router/React-agnostic on purpose (that's\na frontend-ecosystem choice, not something @donilite/wrap should mandate)\n— this profile is scaffolding only: it wires TanStack Router's route tree\n(src/ssr/routes.tsx) to a server-side render pass (src/ssr/render.tsx,\nreact-d\n[…]\nserve built assets) intentionally left as a\nfollow-up rather than guessed at unsupervised.\n\nJSON API routes moved under /api (see index.controller.ts) so they don't\ncollide with SSR page paths at \"/\".",
"is_bot": false,
"headline": "feat: fullstack-ssr CLI profile",
"author_name": "DoniLite",
"author_login": "DoniLite",
"committed_at": "2026-07-08T20:10:47Z",
"body_truncated": true,
"is_coding_agent": false
},
{
"oid": "590a1129bd8c670cb45539486fbbe5f6bb974bf3",
"body": "Two DB-free profiles, both scaffolded via the diff mechanism the CLI\ncommit set up: lightweight-api (auth-only, a \"greeting\" feature slice)\nand api-aggregator (services fronting an upstream API, an \"aggregator\"\nfeature slice with fetch injected for testability). Neither pulls in\nPostgres/Redis confi\n[…]\nrarily, so\nhono/etc. hoist the same way packages/create-wrap/template's own\nverification does) and running install/typecheck/lint/test against the\ngenerated output, not just checking files got copied.",
"is_bot": false,
"headline": "feat: lightweight-api and api-aggregator CLI profiles",
"author_name": "DoniLite",
"author_login": "DoniLite",
"committed_at": "2026-07-08T20:09:01Z",
"body_truncated": true,
"is_coding_agent": false
},
{
"oid": "a16c3f407d92d85c53015e9524a36ae0f3259254",
"body": "The CLI only ever asked for a project name and copied one fixed template\n— every project got the full stack (Postgres, Redis, realtime, auth)\nwhether it needed it or not. Rework it into a small interactive wizard\n(src/prompts.ts: numbered-menu select/confirm/text over Bun's stdin,\nhand-rolled rather\n[…]\nhoice) keeps two new\nyes/no follow-ups — Redis cache, realtime websockets — applied as small\ntext edits to the copied template rather than their own file set, since\neach is a single conditional block.",
"is_bot": false,
"headline": "feat: interactive, profile-driven create-wrap CLI",
"author_name": "DoniLite",
"author_login": "DoniLite",
"committed_at": "2026-07-08T20:07:44Z",
"body_truncated": true,
"is_coding_agent": false
},
{
"oid": "8776f4bd410e202cf0ae4ce4f6e5506f77cd1bd4",
"body": "Two things bundled here since they're both about generateSpec()'s tag\nhandling:\n\n1. Bug fix: the top-level `tags` array was built as\n `Array.from(tags).map(tag => ({ name: tag }))`, which silently\n discarded `SwaggerConfig.tags` — callers passing real descriptions for\n their tags never saw the\n[…]\nake on their own tag identity (e.g. \"Parent: Child\"\nby convention) instead of inheriting the parent's tag wholesale. Findings\nalso written up as a comment at the tag-handling site in swagger/index.ts.",
"is_bot": false,
"headline": "fix: swagger drops config.tags descriptions, add per-route tag override",
"author_name": "DoniLite",
"author_login": "DoniLite",
"committed_at": "2026-07-08T17:04:49Z",
"body_truncated": true,
"is_coding_agent": false
},
{
"oid": "e50d12d94293324001ded0469d42a33504efdc47",
"body": "Follow-up to the abstract openApiSecurityScheme() change: update every\ncurrent implementer (JwtCookieAuthController, CombinedAuthController,\nswagger/index.ts's DEFAULT_SECURITY_SCHEMES + securitySchemes local, and\nthe template's hand-rolled LegacyHeaderAuthController test double) to the\nnew strongly-typed return shape instead of Record<string, unknown>.",
"is_bot": false,
"headline": "refactor: retype AuthController implementers to OpenApiSecuritySchemes",
"author_name": "DoniLite",
"author_login": "DoniLite",
"committed_at": "2026-07-08T16:51:39Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "887604fa5ae655a67c5fd5d0f63afd6ea2550e5e",
"body": "openApiSecurityScheme() was a concrete method defaulting to {} and typed\nas Record<string, unknown> — subclasses could silently ship no security\nscheme (producing a misleading/empty securitySchemes block in generated\ndocs) and implementers got no autocomplete/type-checking on the shape\nOpenAPI actua\n[…]\ntly on the OpenAPI 3.0.3 Security\nScheme Object's four `type` variants (http, apiKey, oauth2,\nopenIdConnect). Breaking change, intentional per maintainer — this repo\nis pre-1.0 and actively developed.",
"is_bot": false,
"headline": "feat!: mandatory, strongly-typed AuthController security schemes",
"author_name": "DoniLite",
"author_login": "DoniLite",
"committed_at": "2026-07-08T16:50:40Z",
"body_truncated": true,
"is_coding_agent": false
},
{
"oid": "0d1b19e25d240503049c189d869bc063ba7097c4",
"body": null,
"is_bot": false,
"headline": "fix: simplify GitHub Release title to only include version",
"author_name": "DoniLite",
"author_login": "DoniLite",
"committed_at": "2026-07-08T15:59:33Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "cc297966096ee14bdb05a3e9e53d4d71ec01f77c",
"body": "Reproduces the exact bug shape found in a real downstream project (a\nparent with GET /:id composing a child controller at a static prefix)\nand asserts both directions: the child's route isn't swallowed by the\nparent's :id, and the parent's :id still correctly matches a genuine\nid once the child's own static route doesn't match.",
"is_bot": false,
"headline": "test: cover parent-vs-children route registration order",
"author_name": "DoniLite",
"author_login": "DoniLite",
"committed_at": "2026-07-08T15:45:38Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "36548c0ce5ebf62be244c5f8c178cdd0d2367650",
"body": "A parent controller's own decorated routes were registered eagerly\ninside RouterController's constructor (via super()), which always runs\nbefore the subclass's own constructor body — meaning any\nthis.register(Child) call in that body always mounted the child AFTER\nthe parent's own routes were alread\n[…]\nregisters each controller's own routes strictly after all of\nits children's (recursively, at any nesting depth), and the whole tree\nfinishes with the root controller's own routes registered dead last.",
"is_bot": false,
"headline": "fix: register a controller's own routes after its children, not before",
"author_name": "DoniLite",
"author_login": "DoniLite",
"committed_at": "2026-07-08T15:44:38Z",
"body_truncated": true,
"is_coding_agent": false
},
{
"oid": "51cc4303a1f06d58ef6726f9d4659c7b9ffb422c",
"body": "The release pipeline published both packages to npm but never left any\ntrace on GitHub itself — no Release page, no changelog a consumer\ncould read without digging through commit history. Added as the final\nstep, after both npm publishes succeed, so a Release page never\nannounces a version that didn\n[…]\n\ninto categories (Features/Fixes/...) needs a .github/release.yml with\na changelog.categories config, which doesn't exist yet — left as a\nfollow-up rather than guessing at categories nobody asked for.",
"is_bot": false,
"headline": "feat: create a GitHub Release with auto-generated notes on publish",
"author_name": "DoniLite",
"author_login": "DoniLite",
"committed_at": "2026-07-08T14:41:57Z",
"body_truncated": true,
"is_coding_agent": false
},
{
"oid": "9869f06716128d009d85f4345179462c802bc6bc",
"body": "…omposition\n\nThe existing swagger tests already exercised register() composition\n(IndexController mounting ExampleController as a child) but never\ncaught the mount-path bug because IndexController sits at \"/\" — a\nprefix that contributes nothing when joined, so the bug was invisible\nby coincidence. A\n[…]\nrent with a real basePath composing two\nchildren (one with a register() prefix, one without) and asserts the\nfull resolved path, plus that the old buggy (bare-basePath) path is\nNOT what got generated.",
"is_bot": false,
"headline": "test: catch swagger paths going stale on nested/prefixed controller c…",
"author_name": "DoniLite",
"author_login": "DoniLite",
"committed_at": "2026-07-08T14:37:09Z",
"body_truncated": true,
"is_coding_agent": false
},
{
"oid": "76b9ea1e3acc661242d8f0a03f2d05b9d990899d",
"body": "…n basePath\n\nSwaggerGenerator computed each route's full path from the controller's\nown @Controller basePath alone. That was correct back when every\ncontroller was registered flat on Wrap, but register() composition\n(a controller mounting a child under itself, optionally with a prefix)\nmeans the rea\n[…]\nw mount-tracking map, since the resolver (which also\nlives there to avoid a circular import back into base.controller.ts)\nneeds it to combine a parent's resolved path with a child's own mount\nsegment.",
"is_bot": false,
"headline": "fix: swagger resolves a controller's real mount path, not just its ow…",
"author_name": "DoniLite",
"author_login": "DoniLite",
"committed_at": "2026-07-08T14:36:44Z",
"body_truncated": true,
"is_coding_agent": false
},
{
"oid": "8c9bef8a76841abd4b8c02bf1fdbfa89a9acb9e2",
"body": "npm version \"$VERSION\" --no-git-tag-version fails with \"Version not\nchanged\" when package.json already has that version — which is exactly\nwhat happens when the version bump is committed before tagging (as\nhappened for the v1.2.0 tag: package.json was already at 1.2.0 when\nthe tag was pushed), rather than tagging first and letting CI bump it.\nnpm pkg set version=\"$VERSION\" writes the field unconditionally, so\nboth release flows work.",
"is_bot": false,
"headline": "fix: make the release workflow's version-set step idempotent",
"author_name": "DoniLite",
"author_login": "DoniLite",
"committed_at": "2026-07-08T12:46:51Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "ab9690049dd150f2aea6d61cde67f3a9af0362e4",
"body": "…ap packages",
"is_bot": false,
"headline": "chore: update version to 1.2.0 in package.json for create-wrap and wr…",
"author_name": "DoniLite",
"author_login": "DoniLite",
"committed_at": "2026-07-08T10:49:08Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "82f3ee10493419df1ba4da3e8e20c95998f45ca8",
"body": "Feat/improvement for v 0 2",
"is_bot": false,
"headline": "Merge pull request #1 from DoniLite/feat/improvement-for-v-0-2",
"author_name": "Doni",
"author_login": "DoniLite",
"committed_at": "2026-07-08T10:45:06Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "9e3f19be34dca10a9dfad4ce8379fcb79f19b405",
"body": "auth.test.ts previously only exercised requireRoles (the role-based\nconvenience) and never the generic guard() primitive it's built on —\nadded a route guarded by an arbitrary userId predicate and a test\nasserting the 403/200 split independent of roles, plus identity\nassertions on the cookie-session \n[…]\na whichever delegate\nresolves an identity, falling back correctly when the first can't,\nrejecting when neither can, revoke() reaching every delegate, merged\nsecurity schemes, and the empty-call guard.",
"is_bot": false,
"headline": "test: cover guard(), cookie identity, and AuthController.combine()",
"author_name": "DoniLite",
"author_login": "DoniLite",
"committed_at": "2026-07-08T10:29:45Z",
"body_truncated": true,
"is_coding_agent": false
},
{
"oid": "2f3234d83e849840b0b797272f81d0bc57f3d47f",
"body": "…allback chain\n\nLets an app mix strategies instead of picking exactly one: e.g. cookie\nsessions for browser requests, falling back to a legacy/API-key\ncontroller for clients that can't store cookies.\nAuthController.combine(...controllers) returns a controller whose\nauthenticate() tries each delegate\n[…]\nlobal\nsymbol registry) instead of a module-scoped Symbol() for the same\nreason — WRAP_AUTH_MIDDLEWARE (swagger's route-tagging symbol) moves\nto Symbol.for too, for consistency and the same resilience.",
"is_bot": false,
"headline": "feat: AuthController.combine() — merge multiple auth paradigms as a f…",
"author_name": "DoniLite",
"author_login": "DoniLite",
"committed_at": "2026-07-08T10:28:09Z",
"body_truncated": true,
"is_coding_agent": false
},
{
"oid": "67684d9483733994f2e0c70f83c2cddaa3f70f5e",
"body": "new Date(cursor) silently produces an Invalid Date on a malformed\nstring, which would then feed a comparison the driver may throw on or\nsilently mis-evaluate — findChangedSince and applyBatch both now fail\nfast with a clear error instead. applyBatch also processed its changes\nas separate, independen\n[…]\n back everything applied so far\nin that call; conflicts don't throw, so they still land in the same\ncommit as whatever else in the batch succeeded. Both flagged by\nSourcery's review on PR #1.\n\nCo-Auth",
"is_bot": false,
"headline": "fix: validate sync cursors and make applyBatch atomic",
"author_name": "DoniLite",
"author_login": "DoniLite",
"committed_at": "2026-07-08T10:26:47Z",
"body_truncated": true,
"is_coding_agent": false
},
{
"oid": "6a536222c622dadba9fac4b4a4ffc4758467e922",
"body": "…umeration\n\nObject.keys(arg.req).includes(provider) only matches when the property\nis own-enumerable. testContext()'s req methods happen to be, but a\ncustom test double using getters, Object.defineProperty, or a\ndifferently-shaped mock wouldn't be detected. Checking\ntypeof arg.req[provider] === \"function\" verifies the same thing\n(the double can actually produce a body) without depending on how the\nproperty happens to be defined. Flagged by Sourcery's review on PR #1.",
"is_bot": false,
"headline": "fix: check @ValidateDTO's test-double fallback by callability, not en…",
"author_name": "DoniLite",
"author_login": "DoniLite",
"committed_at": "2026-07-08T10:26:24Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "61d857ca25052de8f53172819ad8ba548cdb0a65",
"body": "…eware\n\nexport const authMiddleware = auth; exported the JwtCookieAuthController\ninstance itself instead of auth.authMiddleware — any code doing\napp.use(\"/admin/*\", authMiddleware) would receive an object instead of\na function and fail at runtime. Regression from the AuthController\nrewrite, caught by Sourcery's review on PR #1.",
"is_bot": false,
"headline": "fix: authMiddleware export was the controller instance, not its middl…",
"author_name": "DoniLite",
"author_login": "DoniLite",
"committed_at": "2026-07-08T10:25:23Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "5a9413653f6bdadda6b31efca71698944f4613e6",
"body": "… greater compatibility",
"is_bot": false,
"headline": "fix: update peer dependency version for @electric-sql/pglite to allow…",
"author_name": "DoniLite",
"author_login": "DoniLite",
"committed_at": "2026-07-08T09:37:24Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "12d2255c5ac98bbd355ccf258c51466a78844e64",
"body": "…ation\n\nNone of tonight's new surface had automated coverage: Wrap itself,\nAuthController/JwtCookieAuthController, the sync methods, and the\nswagger fixes were only exercised by throwaway verification scripts\nduring development. The existing suite also bypassed the real\ncomposition path — example.co\n[…]\n covers the path-param derivation bug fix (plain and\nregex-constrained), AuthController-driven security schemes, and that\nonly routes actually tagged by AuthController middleware get a\nsecurity block.",
"is_bot": false,
"headline": "test: cover Wrap composition, AuthController, sync, and swagger gener…",
"author_name": "DoniLite",
"author_login": "DoniLite",
"committed_at": "2026-07-08T09:33:01Z",
"body_truncated": true,
"is_coding_agent": false
},
{
"oid": "b6a43d3417bae8ec3d671d5de5d63a8c8a36ff1a",
"body": "src/index.ts now composes the app through Wrap instead of hand-rolling\nHono: cors config in, auth registered via .with(), the admin guard via\n.use(\"/admin/*\", ...), swagger via .swagger(), realtime wired through\nthe raw escape hatch (it needs the underlying Hono instance and the\nBun.serve server han\n[…]\nce every controller's Hono app needs to\nagree with what AuthController/Wrap expect (Variables stays what the\napp registers into WrapRegistry — the two are different consumers of\nthe same declaration).",
"is_bot": false,
"headline": "feat: migrate the template onto Wrap/AuthController",
"author_name": "DoniLite",
"author_login": "DoniLite",
"committed_at": "2026-07-08T09:31:14Z",
"body_truncated": true,
"is_coding_agent": false
},
{
"oid": "806cfdfc02ebeb5945b1c3e1c76dfb9f6c775b0e",
"body": "Every generated project hand-wired the same boilerplate in its\nentrypoint: new Hono(), cors/secureHeaders/requestId/bodyLimit,\napp.onError(errorHandler()), app.notFound(...), setupSwagger(...) —\nand still had to import and mount every feature's Hono sub-app\nmanually. Wrap owns all of that: construct\n[…]\ncoped middleware and\ndirect testing (app.request(...)) don't need the escape hatch. .raw\nstays for what genuinely needs the raw Hono instance (realtime\nwebsocket upgrade, a custom Bun.serve topology).",
"is_bot": false,
"headline": "feat: Wrap composition root",
"author_name": "DoniLite",
"author_login": "DoniLite",
"committed_at": "2026-07-08T09:29:01Z",
"body_truncated": true,
"is_coding_agent": false
},
{
"oid": "37e165307297184d88b597b01667c54201bec01b",
"body": "Path params like /:id never showed up in the generated OpenAPI spec —\nthey were only ever added from an explicit route.params option that\nnothing in the codebase actually set. Parameters are now derived from\nthe route path itself (:name and Hono's :name{regex} constrained\nsyntax), with any explicit \n[…]\nke assignability for no reason.\n\nsetupSwaggerUI/setupSwagger forward UI options to @hono/swagger-ui, so\nan app can enable withCredentials/persistAuthorization for cookie-\nsession \"Try it out\" support.",
"is_bot": false,
"headline": "fix: swagger path-param derivation and auth-aware security schemes",
"author_name": "DoniLite",
"author_login": "DoniLite",
"committed_at": "2026-07-08T09:27:57Z",
"body_truncated": true,
"is_coding_agent": false
},
{
"oid": "7e953e9e0afce01b0f1db568abd77a18070ef872",
"body": "…us offline-first sync\n\nBaseController and BaseService forced a CRUD service/repository generic\neven on features that don't need one (health checks, root routes,\norchestration services). RouterController now holds the route-scanning/\nmiddleware-assembly logic on its own — BaseController<Service> ext\n[…]\nied. Deletes in\napplyBatch go through the same soft-delete path as reads so they\nsurface as tombstones, not the repository's hard delete(). BaseService\nforwards both, same pattern as findById/findAll.",
"is_bot": false,
"headline": "feat: controllers/services without a mandatory service/repository, pl…",
"author_name": "DoniLite",
"author_login": "DoniLite",
"committed_at": "2026-07-08T09:27:00Z",
"body_truncated": true,
"is_coding_agent": false
},
{
"oid": "44f9cdaaa5cbf74817a68c88fd88034e7c0870b6",
"body": "createAuth() was a rigid, JWT+cookie-specific function — extending it\nfor any other auth paradigm meant copying it wholesale. AuthController\nis now the real source of truth: an abstract class that only mandates\nauthenticate()/revoke(); the guard shape (authMiddleware) is identical\nacross paradigms s\n[…]\nmodule \"@donilite/wrap\" { interface WrapRegistry { identity: MyShape } }`.\nAppVariables merges identity in automatically so c.get(\"identity\") is\ntyped everywhere without every consumer redeclaring it.",
"is_bot": false,
"headline": "feat: paradigm-agnostic AuthController, decoupled from RBAC",
"author_name": "DoniLite",
"author_login": "DoniLite",
"committed_at": "2026-07-08T09:26:17Z",
"body_truncated": true,
"is_coding_agent": false
},
{
"oid": "54b50ff50e58742f6891cfc06440fcdf9a1af231",
"body": "The check only matched @donilite/wrap/testing's testContext() test\ndouble (a plain object whose req.json/query/formData are own-enumerable\nproperties). Against a real Hono Context, HonoRequest.json()/query()\nlive on the prototype, so Object.keys(c.req) never contains them and\nevery @ValidateDTO-deco\n[…]\ntext().\n\nNow checks `instanceof Context` first (stable across Hono versions,\nunlike sniffing method names on the request object), falling back to\nthe duck-typed check so the test double keeps working.",
"is_bot": false,
"headline": "fix: detect the real Hono Context in @ValidateDTO instead of duck-typing",
"author_name": "DoniLite",
"author_login": "DoniLite",
"committed_at": "2026-07-08T09:24:45Z",
"body_truncated": true,
"is_coding_agent": false
},
{
"oid": "8f8f4f2558ccfd6a341ad47009421143c118c56e",
"body": "Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>",
"is_bot": false,
"headline": "chore: ignore local .claude config directory",
"author_name": "DoniLite",
"author_login": "DoniLite",
"committed_at": "2026-07-08T09:23:33Z",
"body_truncated": false,
"is_coding_agent": true
},
{
"oid": "0adb61b7afe06f5f299a7a96deda66ffd962d248",
"body": "…across controllers and services\n\nEvery hono `Context` call inside the package consuming the `AppVariables` now",
"is_bot": false,
"headline": "refactor: standardize import statements and enhance type definitions …",
"author_name": "DoniLite",
"author_login": "DoniLite",
"committed_at": "2026-07-08T05:11:35Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "54d90960748c0853eae535ff6ce74a3c5bd19b2c",
"body": "packages/create-wrap/template's example controller now answers 400\n'No operation performed' instead of 404 'Not found' on missing\nentities (intentional app-level choice, commit 440edd3). Update the\nDELETE-then-GET test to match; 19/19 tests green.",
"is_bot": false,
"headline": "test: align controller test with the 400 not-found contract",
"author_name": "DoniLite",
"author_login": "DoniLite",
"committed_at": "2026-07-05T18:26:22Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "440edd3a5e7e409441b944419303a6dc4270ae7e",
"body": null,
"is_bot": false,
"headline": "feat: enhance seeder functionality and update API response handling",
"author_name": "DoniLite",
"author_login": "DoniLite",
"committed_at": "2026-07-05T18:06:41Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "ed6c794c176848f989c292e90b7be5366e4191b1",
"body": "typescript-eslint infers tsconfigRootDir from every eslint.config.ts\nloaded in the process when it isn't set explicitly. In this monorepo,\nan editor loading both packages/wrap and packages/create-wrap/template\nin the same session registers two candidates, which throws\n\"multiple candidate TSConfigRootDirs are present\". Pinning it to\neach config file's own directory removes the ambiguity.",
"is_bot": false,
"headline": "fix: pin tsconfigRootDir in each package's eslint config",
"author_name": "DoniLite",
"author_login": "DoniLite",
"committed_at": "2026-07-05T18:06:33Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "65433207218383ddf04fa823fe6a3423d26a6fd6",
"body": "- CI workflow: install, build, typecheck, lint, starter test suite\n (PGlite in-process — no services needed)\n- Release workflow on v* tags: runs the full checks, applies the tag\n version to both packages and publishes @donilite/wrap then\n @donilite/create-wrap through npm Trusted Publishing (OIDC\n[…]\nite/wrap, publishConfig public\n- documentation: framework overview (root), module reference\n (packages/wrap), CLI page (create-wrap) and a rewritten starter\n README matching the current architecture",
"is_bot": false,
"headline": "feat: tag-driven release pipeline and documentation (chantier 5)",
"author_name": "DoniLite",
"author_login": "DoniLite",
"committed_at": "2026-07-05T10:23:12Z",
"body_truncated": true,
"is_coding_agent": false
},
{
"oid": "223524ffa5854c5533053e21519f494aa18046d1",
"body": "… (chantier 4)\n\n- withTransaction(fn): implicit AsyncLocalStorage propagation — every\n repository/service call in the async scope joins the transaction, no\n tx parameter to thread; entity events are buffered until commit\n- entity lifecycle events (created/updated/deleted) emitted by\n BaseReposito\n[…]\nn bootstrap, cacheTtl\n showcased on ExampleRepository, 8 new tests (transactions, cache\n invalidation, events, websocket e2e) — 19 tests total\n\nCo-Authored-By: Claude Fable 5 <noreply@anthropic.com>",
"is_bot": false,
"headline": "feat: cache Redis, realtime WebSocket, transactions and entity events…",
"author_name": "DoniLite",
"author_login": "DoniLite",
"committed_at": "2026-07-05T09:11:29Z",
"body_truncated": true,
"is_coding_agent": true
},
{
"oid": "0dcee6ed6ad3441c999ed0bb164c9f8472cac37d",
"body": "- createTestDatabase({ schema, url? }): in-process PGlite by default\n (no docker), real Postgres via url for e2e; pushes the schema with\n drizzle-kit/api and injects it through setDatabase\n- truncateAll/destroy lifecycle helpers, testContext for direct\n service calls (@ValidateDTO-compatible), re\n[…]\nbecomes a thunk so the\n database is resolved at query time (singletons no longer capture a\n destroyed test database); driver-agnostic WrapDatabase + affected-rows\n extraction compatible with PGlite",
"is_bot": false,
"headline": "feat: test-driven stack — @donilite/wrap/testing (chantier 3.5)",
"author_name": "DoniLite",
"author_login": "DoniLite",
"committed_at": "2026-07-04T21:38:24Z",
"body_truncated": true,
"is_coding_agent": false
},
{
"oid": "e17ae8bd9cf1428fe25db55712697d5a7cedee06",
"body": "- the old template becomes a starter consuming @donilite/wrap:\n bootstrap.ts (env + initializeDatabase first), WrapRegistry\n augmentation in web.factory.ts, createAuth composition, app-owned\n roles/config, secureHeaders + requestId + bodyLimit + app.onError\n- entities live in the feature slice (f\n[…]\nhe create-wrap bin: template copy + placeholders,\n package.json patched at scaffold time (name + real wrap version),\n node_modules/lockfile/env excluded from copies\n- bun workspaces at the repo root",
"is_bot": false,
"headline": "feat: @donilite/create-wrap CLI and starter template (chantier 3)",
"author_name": "DoniLite",
"author_login": "DoniLite",
"committed_at": "2026-07-04T21:37:36Z",
"body_truncated": true,
"is_coding_agent": false
},
{
"oid": "89e4174dc1cff9b38b6e0c0e28ff8617a830f851",
"body": "…rs 1-3)\n\nFramework evolution carried by this package:\n- chantier 1: BaseRepository<Tb> with the drizzle table as single source\n of truth, populate via the relational query builder (typed 'with'),\n BaseService<Repo>, BaseController<Service>, active soft delete\n- chantier 2: zod-backed DTOs derived\n[…]\nction,\n unified onError/handleError mapping, createAuth factory, injectable\n cache/rate-limit stores, configurable storage, Node-loadable (lazy\n bun imports) for drizzle-kit, tsc build (ESM + d.ts)",
"is_bot": false,
"headline": "feat!: extract the framework into the @donilite/wrap package (chantie…",
"author_name": "DoniLite",
"author_login": "DoniLite",
"committed_at": "2026-07-04T21:37:05Z",
"body_truncated": true,
"is_coding_agent": false
},
{
"oid": "1f7c9382200d5ed0d91d5764b0ab5cca38a343d4",
"body": null,
"is_bot": false,
"headline": "deps: Add date-fns dependency.",
"author_name": "Doni Lite",
"author_login": "DoniLite",
"committed_at": "2026-03-19T17:51:07Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "f9abb137551d4b9b4ea5867fec5ffa588c6b9fc6",
"body": "…ent authentication and caching middleware, and refactor data serialization and query building.",
"is_bot": false,
"headline": "feat: add new database, image, updates, and validator helpers, implem…",
"author_name": "Doni Lite",
"author_login": "DoniLite",
"committed_at": "2026-03-19T17:44:40Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "78188496e9f183d0669dcaedba8737d0e9fec565",
"body": "- Updated the `Can` decorator to support role-based access control using Hono middleware.\n- Improved the `Cache` decorator to cache method results with customizable keys and TTL.\n- Refactored metadata handling in decorators for better organization and clarity.\n\nfix(decorators): correct middleware or\n[…]\nfacilitate running multiple seeders in sequence.\n\nfeat(swagger): enhance API documentation generation\n\n- Added security requirements for routes with authentication middleware in Swagger documentation.",
"is_bot": false,
"headline": "feat(decorators): enhance access control and caching mechanisms",
"author_name": "Doni Lite",
"author_login": "DoniLite",
"committed_at": "2026-03-19T17:22:14Z",
"body_truncated": true,
"is_coding_agent": false
},
{
"oid": "938e7dfb69ca0dc02f7114ce903c5da07f2a1fc5",
"body": "…O schema resolution, and add cookie authentication to OpenAPI specification.",
"is_bot": false,
"headline": "feat: Implement multipart/form-data request body handling, improve DT…",
"author_name": "Doni Lite",
"author_login": "DoniLite",
"committed_at": "2026-01-26T19:10:27Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "1153932e993d47cc80728ca3fe72bc681f4e8b99",
"body": "…README.",
"is_bot": false,
"headline": "docs: Update project creation command from `bun create` to `bunx` in …",
"author_name": "Doni Lite",
"author_login": "DoniLite",
"committed_at": "2026-01-23T19:40:18Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "003fa6091cf570698062e5c91c875dcef860f5f0",
"body": null,
"is_bot": false,
"headline": "chore: initial commit",
"author_name": "Doni Lite",
"author_login": "DoniLite",
"committed_at": "2026-01-23T19:28:32Z",
"body_truncated": false,
"is_coding_agent": false
}
],
"releases_count": 5,
"commits_last_year": 54,
"latest_release_at": "2026-07-16T11:23:12Z",
"latest_release_tag": "v1.4.4",
"releases_from_tags": false,
"days_since_last_push": 4,
"active_weeks_last_year": 5,
"days_since_latest_release": 9,
"mean_days_between_releases": 2
},
"community": {
"has_readme": true,
"has_license": false,
"has_description": true,
"has_contributing": false,
"health_percentage": 28,
"has_issue_template": false,
"has_code_of_conduct": false,
"has_pull_request_template": false
},
"ecosystem": {
"packages": [
{
"name": "@donilite/wrap",
"exists": true,
"license": "MIT",
"keywords": [
"bun",
"hono",
"drizzle",
"framework",
"backend",
"typescript",
"decorators",
"vertical-slice"
],
"ecosystem": "npm",
"matches_repo": true,
"registry_url": "https://www.npmjs.com/package/@donilite/wrap",
"is_deprecated": false,
"latest_version": "1.4.4",
"repository_url": "https://github.com/DoniLite/wrap",
"versions_count": 6,
"total_downloads": null,
"dependents_count": null,
"deprecation_note": null,
"maintainers_count": 1,
"monthly_downloads": 844,
"first_published_at": "2026-07-05T18:33:37.131000Z",
"latest_published_at": "2026-07-16T11:23:06.579000Z",
"latest_version_yanked": null,
"days_since_latest_publish": 9
},
{
"name": "@donilite/create-wrap",
"exists": true,
"license": "MIT",
"keywords": [
"bun",
"hono",
"drizzle",
"backend",
"scaffold",
"typescript",
"api"
],
"ecosystem": "npm",
"matches_repo": true,
"registry_url": "https://www.npmjs.com/package/@donilite/create-wrap",
"is_deprecated": false,
"latest_version": "1.4.4",
"repository_url": "https://github.com/DoniLite/wrap",
"versions_count": 6,
"total_downloads": null,
"dependents_count": null,
"deprecation_note": null,
"maintainers_count": 1,
"monthly_downloads": 826,
"first_published_at": "2026-07-05T18:38:06.421000Z",
"latest_published_at": "2026-07-16T11:23:11.218000Z",
"latest_version_yanked": null,
"days_since_latest_publish": 9
}
]
},
"popularity": {
"forks": 0,
"stars": 1,
"watchers": 0,
"fork_history": {
"days": [],
"complete": true,
"collected": 0,
"total_forks": 0
},
"star_history": null,
"open_issues_and_prs": 1
},
"ai_readiness": {
"has_nix": false,
"example_dirs": [
"example"
],
"has_llms_txt": false,
"has_dockerfile": true,
"has_mcp_signal": false,
"bootstrap_files": [],
"api_schema_files": [],
"has_devcontainer": false,
"typecheck_configs": [
"packages/create-wrap/profiles/fullstack-ssr/files/tsconfig.json",
"packages/create-wrap/template/tsconfig.json",
"packages/wrap/tsconfig.json"
],
"toolchain_manifests": [],
"largest_source_bytes": 27878,
"source_files_sampled": 126,
"oversized_source_files": 0,
"agent_instruction_files": [
"CLAUDE.md",
"packages/create-wrap/profiles/api-aggregator/files/CLAUDE.md",
"packages/create-wrap/profiles/fullstack-ssr/files/CLAUDE.md",
"packages/create-wrap/profiles/gateway/files/CLAUDE.md",
"packages/create-wrap/profiles/lightweight-api/files/CLAUDE.md",
"packages/create-wrap/template/CLAUDE.md"
],
"agent_instruction_max_bytes": 9934
},
"dependencies": {
"manifests": [
"package.json"
],
"advisories": {
"error": null,
"scope": "published_package",
"source": "osv",
"findings": [],
"collected": true,
"malicious": [],
"truncated": false,
"by_severity": {},
"advisory_count": 0,
"affected_count": 0,
"assessed_count": 3,
"malicious_count": 0,
"assessed_package": "npm:@donilite/wrap@1.4.4",
"unassessed_count": 0,
"direct_affected_count": 0
},
"ecosystems": [
"npm"
],
"dependencies": [
{
"name": "@clack/prompts",
"manifest": "packages/create-wrap/package.json",
"ecosystem": "npm",
"version_constraint": "^1.7.0"
},
{
"name": "@hono/swagger-ui",
"manifest": "packages/wrap/package.json",
"ecosystem": "npm",
"version_constraint": "^0.6.1"
},
{
"name": "date-fns",
"manifest": "packages/wrap/package.json",
"ecosystem": "npm",
"version_constraint": "^4.1.0"
},
{
"name": "reflect-metadata",
"manifest": "packages/wrap/package.json",
"ecosystem": "npm",
"version_constraint": "^0.2.2"
}
],
"all_dependencies": {
"error": "GitHub dependency-graph SBOM unavailable (404); the dependency graph may be disabled for this repository",
"source": null,
"packages": [],
"collected": false,
"truncated": false,
"total_count": null,
"direct_count": null,
"indirect_count": null
}
},
"maintainership": {
"issues": {
"open_prs": 0,
"merged_prs": 2,
"open_issues": 1,
"closed_ratio": 0.667,
"closed_issues": 2,
"closed_unmerged_prs": 0
},
"bus_factor": 1,
"bot_contributors": 0,
"top_contributors": [
{
"type": "User",
"login": "DoniLite",
"commits": 54,
"avatar_url": "https://avatars.githubusercontent.com/u/110300389?v=4"
}
],
"contributors_sampled": 1,
"top_contributor_share": 1
},
"quality_signals": {
"has_ci": true,
"has_tests": true,
"ci_workflows": [
"ci.yml",
"docs.yml",
"release.yml"
],
"has_docs_dir": true,
"linter_configs": [],
"has_editorconfig": false,
"has_linter_config": false,
"has_precommit_config": false
},
"security_signals": {
"lockfiles": [],
"scorecard": {
"checks": [
{
"name": "Binary-Artifacts",
"score": 10,
"reason": "no binaries found in the repo",
"documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#binary-artifacts"
},
{
"name": "Branch-Protection",
"score": 0,
"reason": "branch protection not enabled on development/release branches",
"documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#branch-protection"
},
{
"name": "CI-Tests",
"score": 10,
"reason": "2 out of 2 merged PRs checked by a CI test -- score normalized to 10",
"documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#ci-tests"
},
{
"name": "CII-Best-Practices",
"score": 0,
"reason": "no effort to earn an OpenSSF best practices badge detected",
"documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#cii-best-practices"
},
{
"name": "Code-Review",
"score": 0,
"reason": "Found 0/18 approved changesets -- score normalized to 0",
"documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#code-review"
},
{
"name": "Contributors",
"score": 3,
"reason": "project has 1 contributing companies or organizations -- score normalized to 3",
"documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#contributors"
},
{
"name": "Dangerous-Workflow",
"score": 10,
"reason": "no dangerous workflow patterns detected",
"documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#dangerous-workflow"
},
{
"name": "Dependency-Update-Tool",
"score": 0,
"reason": "no update tool detected",
"documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#dependency-update-tool"
},
{
"name": "Fuzzing",
"score": 0,
"reason": "project is not fuzzed",
"documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#fuzzing"
},
{
"name": "License",
"score": 0,
"reason": "license file not detected",
"documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#license"
},
{
"name": "Maintained",
"score": 10,
"reason": "30 commit(s) and 3 issue activity found in the last 90 days -- score normalized to 10",
"documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#maintained"
},
{
"name": "Packaging",
"score": 10,
"reason": "packaging workflow detected",
"documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#packaging"
},
{
"name": "Pinned-Dependencies",
"score": 0,
"reason": "dependency not pinned by hash detected -- score normalized to 0",
"documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#pinned-dependencies"
},
{
"name": "SAST",
"score": 0,
"reason": "SAST tool is not run on all commits -- score normalized to 0",
"documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#sast"
},
{
"name": "Security-Policy",
"score": 0,
"reason": "security policy file not detected",
"documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#security-policy"
},
{
"name": "Signed-Releases",
"score": null,
"reason": "no releases found",
"documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#signed-releases"
},
{
"name": "Token-Permissions",
"score": 0,
"reason": "detected GitHub workflow tokens with excessive permissions",
"documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#token-permissions"
},
{
"name": "Vulnerabilities",
"score": 8,
"reason": "2 existing vulnerabilities detected",
"documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#vulnerabilities"
}
],
"commit": "2e4d2bac44c69ae95b22eacc7aa794d4d23c53c9",
"ran_at": "2026-07-25T14:08:11Z",
"aggregate_score": 4,
"scorecard_version": "v5.5.0"
},
"has_codeql_workflow": false,
"has_security_policy": false,
"has_dependabot_config": false
},
"contribution_flow": {
"collected": true,
"ci_last_run_at": "2026-07-16T11:49:04Z",
"oldest_open_prs": [],
"last_merged_pr_at": "2026-07-13T18:40:51Z",
"ci_last_conclusion": "SUCCESS",
"oldest_open_issues": [
{
"number": 5,
"created_at": "2026-07-20T06:38:01Z",
"last_comment_at": null,
"last_comment_author": null
}
]
}
},
"config": {
"disabled_metrics": [],
"disabled_categories": [],
"disabled_components": {}
},
"source": {
"url": "https://github.com/DoniLite/wrap",
"host": "github.com",
"name": "wrap",
"owner": "DoniLite"
},
"metrics": {
"overall": {
"key": "overall",
"band": "moderate",
"name": "Overall health",
"note": null,
"notes": [],
"value": 59,
"inputs": {
"security": 52,
"vitality": 79,
"community": 23,
"governance": 54,
"engineering": 81
},
"components": []
},
"categories": [
{
"key": "vitality",
"band": "good",
"name": "Vitality",
"value": 79,
"weight": 0.22,
"metrics": [
{
"key": "development_activity",
"band": "moderate",
"name": "Development activity",
"note": null,
"notes": [],
"value": 65,
"inputs": {
"commits_last_year": 54,
"human_commit_share": 1,
"days_since_last_push": 4,
"active_weeks_last_year": 5
},
"components": [
{
"key": "push_recency",
"name": "Push recency",
"detail": "last push 4 days ago",
"points": 36,
"status": "met",
"details": [
{
"code": "push_recency",
"params": {
"days": 4
}
}
],
"max_points": 36
},
{
"key": "commit_cadence",
"name": "Commit cadence",
"detail": "5/52 weeks with commits",
"points": 3.5,
"status": "partial",
"details": [
{
"code": "commit_cadence_weeks",
"params": {
"weeks": 5
}
}
],
"max_points": 36
},
{
"key": "commit_volume",
"name": "Commit volume",
"detail": "54 commits in the last year",
"points": 15.6,
"status": "partial",
"details": [
{
"code": "commits_last_year",
"params": {
"count": 54
}
}
],
"max_points": 18
},
{
"key": "openssf_scorecard_maintained",
"name": "OpenSSF Scorecard: Maintained",
"detail": "30 commit(s) and 3 issue activity found in the last 90 days -- score normalized to 10",
"points": 10,
"status": "met",
"details": [],
"max_points": 10
}
]
},
{
"key": "release_discipline",
"band": "excellent",
"name": "Release discipline",
"note": "Excluded from scoring (no data or not applicable): OpenSSF Scorecard: Signed-Releases. Remaining weights renormalized.",
"notes": [
{
"code": "excluded_no_data",
"params": {
"components": [
"openssf_scorecard_signed_releases"
]
}
},
{
"code": "weights_renormalized",
"params": {}
}
],
"value": 100,
"inputs": {
"releases_count": 5,
"latest_release_tag": "v1.4.4",
"releases_from_tags": false,
"days_since_latest_release": 9,
"mean_days_between_releases": 2
},
"components": [
{
"key": "ships_releases",
"name": "Ships releases",
"detail": "5 releases published",
"points": 27,
"status": "met",
"details": [
{
"code": "releases_published",
"params": {
"count": 5
}
}
],
"max_points": 27
},
{
"key": "release_recency",
"name": "Release recency",
"detail": "latest release 9 days ago",
"points": 36,
"status": "met",
"details": [
{
"code": "release_recency",
"params": {
"days": 9
}
}
],
"max_points": 36
},
{
"key": "release_cadence",
"name": "Release cadence",
"detail": "a release every ~2 days",
"points": 27,
"status": "met",
"details": [
{
"code": "release_cadence",
"params": {
"gap": 2
}
}
],
"max_points": 27
},
{
"key": "openssf_scorecard_signed_releases",
"name": "OpenSSF Scorecard: Signed-Releases",
"detail": "no releases found",
"points": 0,
"status": "excluded",
"details": [
{
"code": "no_data",
"params": {}
}
],
"max_points": 10
}
]
},
{
"key": "abandonment",
"band": "excellent",
"name": "Abandonment",
"note": null,
"notes": [],
"value": 100,
"inputs": {
"cap": null,
"state": "maintained",
"guards": [],
"signals": [],
"red_flag": false,
"multiplier_pct": 100,
"declared_reason": null,
"unverified_reason": null,
"unanswered_open_prs": null,
"unanswered_open_issues": null,
"days_since_last_merged_pr": null,
"days_since_last_human_commit": 9,
"days_since_last_human_commit_is_floor": false
},
"components": [
{
"key": "project_is_still_maintained",
"name": "Project is still maintained",
"detail": "last human commit 9 days ago",
"points": 100,
"status": "met",
"details": [
{
"code": "abandonment_maintained",
"params": {
"days": 9
}
}
],
"max_points": 100
}
]
}
],
"description": "Is the project alive — is code being written and are releases shipping?"
},
{
"key": "community",
"band": "critical",
"name": "Community & Adoption",
"value": 23,
"weight": 0.18,
"metrics": [
{
"key": "popularity",
"band": "critical",
"name": "Popularity & adoption",
"note": null,
"notes": [],
"value": 1,
"inputs": {
"forks": 0,
"stars": 1,
"watchers": 0,
"growth_state": "unverified",
"growth_factor_pct": 100,
"growth_unverified_reason": "no_history"
},
"components": [
{
"key": "stars",
"name": "Stars",
"detail": "1 stars",
"points": 0,
"status": "missed",
"details": [
{
"code": "stars",
"params": {
"count": 1
}
}
],
"max_points": 60
},
{
"key": "forks",
"name": "Forks",
"detail": "0 forks",
"points": 0,
"status": "missed",
"details": [
{
"code": "forks",
"params": {
"count": 0
}
}
],
"max_points": 25
},
{
"key": "watchers",
"name": "Watchers",
"detail": "0 watchers",
"points": 0,
"status": "missed",
"details": [
{
"code": "watchers",
"params": {
"count": 0
}
}
],
"max_points": 15
}
]
},
{
"key": "community_health",
"band": "critical",
"name": "Community health",
"note": null,
"notes": [],
"value": 25,
"inputs": {
"has_readme": true,
"has_license": false,
"has_contributing": false,
"has_issue_template": false,
"has_code_of_conduct": false,
"has_pull_request_template": false
},
"components": [
{
"key": "readme",
"name": "README",
"detail": null,
"points": 22.5,
"status": "met",
"details": [],
"max_points": 22.5
},
{
"key": "license",
"name": "License",
"detail": "no license file detected",
"points": 0,
"status": "missed",
"details": [
{
"code": "license_absent",
"params": {}
}
],
"max_points": 22.5
},
{
"key": "contributing_guide",
"name": "CONTRIBUTING guide",
"detail": null,
"points": 0,
"status": "missed",
"details": [],
"max_points": 18
},
{
"key": "code_of_conduct",
"name": "Code of conduct",
"detail": null,
"points": 0,
"status": "missed",
"details": [],
"max_points": 13.5
},
{
"key": "issue_template",
"name": "Issue template",
"detail": null,
"points": 0,
"status": "missed",
"details": [],
"max_points": 7.2
},
{
"key": "pr_template",
"name": "PR template",
"detail": null,
"points": 0,
"status": "missed",
"details": [],
"max_points": 6.3
}
]
},
{
"key": "ecosystem_adoption",
"band": "moderate",
"name": "Ecosystem adoption (downloads)",
"note": "Excluded from scoring (no data or not applicable): Registry dependents. Remaining weights renormalized.",
"notes": [
{
"code": "excluded_no_data",
"params": {
"components": [
"registry_dependents"
]
}
},
{
"code": "weights_renormalized",
"params": {}
}
],
"value": 54,
"inputs": {
"packages": [
"@donilite/wrap",
"@donilite/create-wrap"
],
"dependents": null,
"ecosystems": "npm",
"total_downloads": null,
"monthly_downloads": 1670
},
"components": [
{
"key": "monthly_downloads",
"name": "Monthly downloads",
"detail": "1,670 downloads/month across npm",
"points": 43,
"status": "partial",
"details": [
{
"code": "downloads_monthly",
"params": {
"count": 1670,
"ecosystems": "npm"
}
}
],
"max_points": 80
},
{
"key": "registry_dependents",
"name": "Registry dependents",
"detail": "not reported by this ecosystem",
"points": 0,
"status": "excluded",
"details": [
{
"code": "not_reported_by_this_ecosystem",
"params": {}
}
],
"max_points": 20
}
]
}
],
"description": "Does the project have users, downloads, attention, and a welcoming setup for contributors?"
},
{
"key": "governance",
"band": "moderate",
"name": "Sustainability & Governance",
"value": 54,
"weight": 0.24,
"metrics": [
{
"key": "maintainer_resilience",
"band": "critical",
"name": "Maintainer resilience (bus factor)",
"note": null,
"notes": [],
"value": 13,
"inputs": {
"bus_factor": 1,
"contributors_sampled": 1,
"top_contributor_share": 1
},
"components": [
{
"key": "bus_factor",
"name": "Bus factor",
"detail": "1 contributor(s) cover half of all commits",
"points": 9,
"status": "partial",
"details": [
{
"code": "bus_factor",
"params": {
"count": 1
}
}
],
"max_points": 54
},
{
"key": "commit_distribution",
"name": "Commit distribution",
"detail": "top contributor authored 100% of commits",
"points": 0,
"status": "missed",
"details": [
{
"code": "top_contributor_share",
"params": {
"share": 100
}
}
],
"max_points": 22.5
},
{
"key": "contributor_breadth",
"name": "Contributor breadth",
"detail": "1 contributors",
"points": 1.4,
"status": "partial",
"details": [
{
"code": "contributors_sampled",
"params": {
"count": 1
}
}
],
"max_points": 13.5
},
{
"key": "openssf_scorecard_contributors",
"name": "OpenSSF Scorecard: Contributors",
"detail": "project has 1 contributing companies or organizations -- score normalized to 3",
"points": 3,
"status": "partial",
"details": [],
"max_points": 10
}
]
},
{
"key": "responsiveness",
"band": "moderate",
"name": "Issue & PR responsiveness",
"note": null,
"notes": [],
"value": 69,
"inputs": {
"merged_prs": 2,
"open_issues": 1,
"closed_issues": 2,
"issue_closed_ratio": 0.667,
"closed_unmerged_prs": 0
},
"components": [
{
"key": "issue_resolution",
"name": "Issue resolution",
"detail": "67% of issues closed",
"points": 31.2,
"status": "partial",
"details": [
{
"code": "issues_closed_share",
"params": {
"share": 67
}
}
],
"max_points": 46.75
},
{
"key": "pr_acceptance",
"name": "PR acceptance",
"detail": "2/2 decided PRs merged",
"points": 38.2,
"status": "met",
"details": [
{
"code": "decided_prs_merged",
"params": {
"merged": 2,
"decided": 2
}
}
],
"max_points": 38.25
},
{
"key": "openssf_scorecard_code_review",
"name": "OpenSSF Scorecard: Code-Review",
"detail": "Found 0/18 approved changesets -- score normalized to 0",
"points": 0,
"status": "missed",
"details": [],
"max_points": 15
}
]
},
{
"key": "stewardship",
"band": "moderate",
"name": "Ownership & stewardship",
"note": "Excluded from scoring (no data or not applicable): Verified domain. Remaining weights renormalized.",
"notes": [
{
"code": "excluded_no_data",
"params": {
"components": [
"verified_domain"
]
}
},
{
"code": "weights_renormalized",
"params": {}
}
],
"value": 52,
"inputs": {
"followers": 38,
"owner_type": "User",
"is_verified": null,
"owner_login": "DoniLite",
"public_repos": 53,
"account_age_days": 1455
},
"components": [
{
"key": "ownership_backing",
"name": "Ownership backing",
"detail": "personal (user) account",
"points": 10,
"status": "partial",
"details": [
{
"code": "owner_personal",
"params": {}
}
],
"max_points": 30
},
{
"key": "verified_domain",
"name": "Verified domain",
"detail": "not applicable to user accounts",
"points": 0,
"status": "excluded",
"details": [
{
"code": "not_applicable_to_user_accounts",
"params": {}
}
],
"max_points": 20
},
{
"key": "owner_reach",
"name": "Owner reach",
"detail": "38 followers of DoniLite",
"points": 11.4,
"status": "partial",
"details": [
{
"code": "owner_followers",
"params": {
"count": 38,
"login": "DoniLite"
}
}
],
"max_points": 25
},
{
"key": "track_record",
"name": "Track record",
"detail": "53 public repos, account ~3 yr old",
"points": 20.6,
"status": "partial",
"details": [
{
"code": "public_repos",
"params": {
"count": 53
}
},
{
"code": "account_age_years",
"params": {
"years": 3
}
}
],
"max_points": 25
}
]
},
{
"key": "package_maintenance",
"band": "excellent",
"name": "Package maintenance",
"note": null,
"notes": [],
"value": 100,
"inputs": {
"packages": [
"@donilite/wrap",
"@donilite/create-wrap"
],
"ecosystems": "npm",
"any_deprecated": false,
"min_days_since_publish": 9
},
"components": [
{
"key": "published_resolvable",
"name": "Published & resolvable",
"detail": "2 package(s) on npm",
"points": 25,
"status": "met",
"details": [
{
"code": "packages_published",
"params": {
"count": 2,
"ecosystems": "npm"
}
}
],
"max_points": 25
},
{
"key": "publish_recency",
"name": "Publish recency",
"detail": "latest publish 9 days ago",
"points": 35,
"status": "met",
"details": [
{
"code": "publish_recency",
"params": {
"days": 9
}
}
],
"max_points": 35
},
{
"key": "version_history",
"name": "Version history",
"detail": "6 published versions",
"points": 20,
"status": "met",
"details": [
{
"code": "published_versions",
"params": {
"count": 6
}
}
],
"max_points": 20
},
{
"key": "not_deprecated",
"name": "Not deprecated",
"detail": "active, not deprecated or yanked",
"points": 20,
"status": "met",
"details": [
{
"code": "package_not_deprecated",
"params": {}
}
],
"max_points": 20
}
]
}
],
"description": "Will the project survive its people — bus factor, responsiveness, who backs it, and package upkeep?"
},
{
"key": "engineering",
"band": "good",
"name": "Engineering Quality",
"value": 81,
"weight": 0.2,
"metrics": [
{
"key": "engineering_practices",
"band": "moderate",
"name": "Engineering practices",
"note": null,
"notes": [],
"value": 68,
"inputs": {
"has_ci": true,
"has_tests": true,
"has_editorconfig": false,
"has_linter_config": false,
"has_precommit_config": false
},
"components": [
{
"key": "ci_workflows",
"name": "CI workflows",
"detail": "3 workflow(s)",
"points": 24,
"status": "met",
"details": [
{
"code": "ci_workflows",
"params": {
"count": 3
}
}
],
"max_points": 24
},
{
"key": "tests_present",
"name": "Tests present",
"detail": null,
"points": 24,
"status": "met",
"details": [],
"max_points": 24
},
{
"key": "linter_config",
"name": "Linter config",
"detail": null,
"points": 0,
"status": "missed",
"details": [],
"max_points": 16
},
{
"key": "pre_commit_hooks",
"name": "Pre-commit hooks",
"detail": null,
"points": 0,
"status": "missed",
"details": [],
"max_points": 9.6
},
{
"key": "editorconfig",
"name": ".editorconfig",
"detail": null,
"points": 0,
"status": "missed",
"details": [],
"max_points": 6.4
},
{
"key": "openssf_scorecard_ci_tests",
"name": "OpenSSF Scorecard: CI-Tests",
"detail": "2 out of 2 merged PRs checked by a CI test -- score normalized to 10",
"points": 20,
"status": "met",
"details": [],
"max_points": 20
}
]
},
{
"key": "documentation",
"band": "excellent",
"name": "Documentation",
"note": null,
"notes": [],
"value": 100,
"inputs": {
"topics": [
"hono",
"npm",
"package",
"poo",
"ts"
],
"has_wiki": true,
"homepage": "https://donilite.github.io/wrap/",
"has_readme": true,
"has_docs_dir": true,
"has_description": true
},
"components": [
{
"key": "readme",
"name": "README",
"detail": null,
"points": 30,
"status": "met",
"details": [],
"max_points": 30
},
{
"key": "documentation_directory",
"name": "Documentation directory",
"detail": null,
"points": 25,
"status": "met",
"details": [],
"max_points": 25
},
{
"key": "documentation_homepage_site",
"name": "Documentation / homepage site",
"detail": "https://donilite.github.io/wrap/",
"points": 15,
"status": "met",
"details": [],
"max_points": 15
},
{
"key": "repository_description",
"name": "Repository description",
"detail": null,
"points": 10,
"status": "met",
"details": [],
"max_points": 10
},
{
"key": "topics",
"name": "Topics",
"detail": "5 topics",
"points": 10,
"status": "met",
"details": [
{
"code": "topics_count",
"params": {
"count": 5
}
}
],
"max_points": 10
},
{
"key": "wiki",
"name": "Wiki",
"detail": null,
"points": 10,
"status": "met",
"details": [],
"max_points": 10
}
]
}
],
"description": "Are baseline engineering and documentation practices in place?"
},
{
"key": "security",
"band": "moderate",
"name": "Security",
"value": 52,
"weight": 0.16,
"metrics": [
{
"key": "security_posture",
"band": "at_risk",
"name": "Security posture",
"note": "Excluded from scoring (no data or not applicable): Signed-Releases. Remaining weights renormalized.",
"notes": [
{
"code": "excluded_no_data",
"params": {
"components": [
"signed_releases"
]
}
},
{
"code": "weights_renormalized",
"params": {}
}
],
"value": 40,
"inputs": {
"source": "openssf_scorecard",
"checks_evaluated": 17,
"scorecard_version": "v5.5.0",
"checks_inconclusive": 1,
"scorecard_aggregate": 4
},
"components": [
{
"key": "binary_artifacts",
"name": "Binary-Artifacts",
"detail": "no binaries found in the repo",
"points": 7.5,
"status": "met",
"details": [],
"max_points": 7.5
},
{
"key": "branch_protection",
"name": "Branch-Protection",
"detail": "branch protection not enabled on development/release branches",
"points": 0,
"status": "missed",
"details": [],
"max_points": 7.5
},
{
"key": "ci_tests",
"name": "CI-Tests",
"detail": "2 out of 2 merged PRs checked by a CI test -- score normalized to 10",
"points": 2.5,
"status": "met",
"details": [],
"max_points": 2.5
},
{
"key": "cii_best_practices",
"name": "CII-Best-Practices",
"detail": "no effort to earn an OpenSSF best practices badge detected",
"points": 0,
"status": "missed",
"details": [],
"max_points": 2.5
},
{
"key": "code_review",
"name": "Code-Review",
"detail": "Found 0/18 approved changesets -- score normalized to 0",
"points": 0,
"status": "missed",
"details": [],
"max_points": 7.5
},
{
"key": "contributors",
"name": "Contributors",
"detail": "project has 1 contributing companies or organizations -- score normalized to 3",
"points": 0.8,
"status": "partial",
"details": [],
"max_points": 2.5
},
{
"key": "dangerous_workflow",
"name": "Dangerous-Workflow",
"detail": "no dangerous workflow patterns detected",
"points": 10,
"status": "met",
"details": [],
"max_points": 10
},
{
"key": "dependency_update_tool",
"name": "Dependency-Update-Tool",
"detail": "no update tool detected",
"points": 0,
"status": "missed",
"details": [],
"max_points": 7.5
},
{
"key": "fuzzing",
"name": "Fuzzing",
"detail": "project is not fuzzed",
"points": 0,
"status": "missed",
"details": [],
"max_points": 5
},
{
"key": "license",
"name": "License",
"detail": "license file not detected",
"points": 0,
"status": "missed",
"details": [],
"max_points": 2.5
},
{
"key": "maintained",
"name": "Maintained",
"detail": "30 commit(s) and 3 issue activity found in the last 90 days -- score normalized to 10",
"points": 7.5,
"status": "met",
"details": [],
"max_points": 7.5
},
{
"key": "packaging",
"name": "Packaging",
"detail": "packaging workflow detected",
"points": 5,
"status": "met",
"details": [],
"max_points": 5
},
{
"key": "pinned_dependencies",
"name": "Pinned-Dependencies",
"detail": "dependency not pinned by hash detected -- score normalized to 0",
"points": 0,
"status": "missed",
"details": [],
"max_points": 5
},
{
"key": "sast",
"name": "SAST",
"detail": "SAST tool is not run on all commits -- score normalized to 0",
"points": 0,
"status": "missed",
"details": [],
"max_points": 5
},
{
"key": "security_policy",
"name": "Security-Policy",
"detail": "security policy file not detected",
"points": 0,
"status": "missed",
"details": [],
"max_points": 5
},
{
"key": "signed_releases",
"name": "Signed-Releases",
"detail": "no releases found",
"points": 0,
"status": "excluded",
"details": [
{
"code": "no_data",
"params": {}
}
],
"max_points": 7.5
},
{
"key": "token_permissions",
"name": "Token-Permissions",
"detail": "detected GitHub workflow tokens with excessive permissions",
"points": 0,
"status": "missed",
"details": [],
"max_points": 7.5
},
{
"key": "vulnerabilities",
"name": "Vulnerabilities",
"detail": "2 existing vulnerabilities detected",
"points": 6,
"status": "partial",
"details": [],
"max_points": 7.5
}
]
},
{
"key": "dependency_advisories",
"band": "excellent",
"name": "Dependency advisories",
"note": "Excluded from scoring (no data or not applicable): No advisories left outstanding. Remaining weights renormalized. Matched the npm:@donilite/wrap@1.4.4 runtime dependency closure — what installing the published package pulls in — 3 packages. Reachability is not analyzed.",
"notes": [
{
"code": "excluded_no_data",
"params": {
"components": [
"no_advisories_left_outstanding"
]
}
},
{
"code": "weights_renormalized",
"params": {}
},
{
"code": "advisories_scope_published",
"params": {
"package": "npm:@donilite/wrap@1.4.4",
"assessed": 3
}
},
{
"code": "advisories_reachability",
"params": {}
}
],
"value": 100,
"inputs": {
"source": "osv",
"advisories": 0,
"affected_packages": 0,
"assessed_packages": 3,
"unassessed_packages": 0,
"affected_by_severity": "none",
"direct_affected_packages": 0
},
"components": [
{
"key": "direct_dependencies_free_of_known_advisories",
"name": "Direct dependencies free of known advisories",
"detail": "no direct dependency carries a known advisory",
"points": 35,
"status": "met",
"details": [
{
"code": "no_direct_advisories",
"params": {}
}
],
"max_points": 35
},
{
"key": "indirect_dependencies_free_of_known_advisories",
"name": "Indirect dependencies free of known advisories",
"detail": "no indirect dependency carries a known advisory",
"points": 25,
"status": "met",
"details": [
{
"code": "no_indirect_advisories",
"params": {}
}
],
"max_points": 25
},
{
"key": "no_advisories_left_outstanding",
"name": "No advisories left outstanding",
"detail": "no advisory carries a publication date",
"points": 0,
"status": "excluded",
"details": [
{
"code": "advisories_no_publication_date",
"params": {}
}
],
"max_points": 40
}
]
},
{
"key": "malicious_dependencies",
"band": "excellent",
"name": "Malicious dependencies",
"note": null,
"notes": [],
"value": 100,
"inputs": {
"source": "osv",
"meaning": "reported as a malicious package by the OpenSSF corpus; the remedy is removal or moving off the compromised name, never an upgrade of the same artifact. Versions the registry has since pulled are listed but not scored",
"packages": [],
"red_flag": false,
"assessed_packages": 3,
"malicious_packages": 0,
"direct_malicious_packages": 0,
"withdrawn_malicious_packages": 0,
"installable_malicious_packages": 0
},
"components": [
{
"key": "no_dependency_reported_as_a_malicious_package",
"name": "No dependency reported as a malicious package",
"detail": "no dependency is reported as a malicious package",
"points": 100,
"status": "met",
"details": [
{
"code": "no_malicious_dependencies",
"params": {}
}
],
"max_points": 100
}
]
},
{
"key": "high_risk_jurisdiction_exposure",
"band": "excellent",
"name": "High-Risk Jurisdiction Exposure",
"note": "Only high-confidence self-published location evidence affects this multiplier. Ambiguous matches are review-only; country evidence is not proof of nationality, citizenship, legal registration, malicious intent, or sanctions status.",
"notes": [
{
"code": "jurisdiction_evidence_limits",
"params": {}
}
],
"value": 100,
"inputs": {
"meaning": "self-published location evidence; not nationality or citizenship",
"red_flag": false,
"exposures": [],
"policy_countries": [
"Russia",
"Iran",
"North Korea"
],
"review_only_matches": 0,
"assessed_self_published_locations": 2
},
"components": [
{
"key": "policy_exposure_multiplier",
"name": "Policy exposure multiplier",
"detail": "no confirmed policy-scope location match",
"points": 100,
"status": "met",
"details": [
{
"code": "jurisdiction_no_match",
"params": {}
}
],
"max_points": 100
}
]
}
],
"description": "Are visible security and supply-chain practices strong, with no malicious dependency and no unresolved high-risk jurisdiction exposure?"
},
{
"key": "ai_readiness",
"band": "moderate",
"name": "AI Readiness",
"value": 68,
"weight": 0,
"metrics": [
{
"key": "ai_agent_context",
"band": "excellent",
"name": "Agent context & guidance",
"note": null,
"notes": [],
"value": 85,
"inputs": {
"has_llms_txt": false,
"legible_history_share": 1,
"agent_instruction_files": [
"CLAUDE.md",
"packages/create-wrap/profiles/api-aggregator/files/CLAUDE.md",
"packages/create-wrap/profiles/fullstack-ssr/files/CLAUDE.md",
"packages/create-wrap/profiles/gateway/files/CLAUDE.md",
"packages/create-wrap/profiles/lightweight-api/files/CLAUDE.md",
"packages/create-wrap/template/CLAUDE.md"
],
"agent_instruction_max_bytes": 9934
},
"components": [
{
"key": "agent_instructions",
"name": "Agent instructions",
"detail": "CLAUDE.md, packages/create-wrap/profiles/api-aggregator/files/CLAUDE.md, packages/create-wrap/profiles/fullstack-ssr/files/CLAUDE.md, packages/create-wrap/profiles/gateway/files/CLAUDE.md, packages/create-wrap/profiles/lightweight-api/files/CLAUDE.md, packages/create-wrap/template/CLAUDE.md",
"points": 45,
"status": "met",
"details": [
{
"code": "file_list",
"params": {
"files": "CLAUDE.md, packages/create-wrap/profiles/api-aggregator/files/CLAUDE.md, packages/create-wrap/profiles/fullstack-ssr/files/CLAUDE.md, packages/create-wrap/profiles/gateway/files/CLAUDE.md, packages/create-wrap/profiles/lightweight-api/files/CLAUDE.md, packages/create-wrap/template/CLAUDE.md"
}
}
],
"max_points": 45
},
{
"key": "machine_readable_docs_llms_txt",
"name": "Machine-readable docs (llms.txt)",
"detail": null,
"points": 0,
"status": "missed",
"details": [],
"max_points": 15
},
{
"key": "legible_commit_history",
"name": "Legible commit history",
"detail": "54 of 54 human commits state their intent (structured subject or explanatory body)",
"points": 40,
"status": "met",
"details": [
{
"code": "legible_history",
"params": {
"legible": 54,
"sampled": 54
}
}
],
"max_points": 40
}
]
},
{
"key": "ai_verify_loop",
"band": "moderate",
"name": "Verify loop (build / test / typecheck)",
"note": null,
"notes": [],
"value": 53,
"inputs": {
"has_nix": false,
"has_tests": true,
"lockfiles": [],
"has_dockerfile": true,
"typed_language": true,
"bootstrap_files": [],
"has_devcontainer": false,
"has_linter_config": false,
"typecheck_configs": [
"packages/create-wrap/profiles/fullstack-ssr/files/tsconfig.json",
"packages/create-wrap/template/tsconfig.json",
"packages/wrap/tsconfig.json"
],
"agent_commit_share": 0.056,
"toolchain_manifests": [],
"dependency_bot_commit_share": 0
},
"components": [
{
"key": "one_command_bootstrap",
"name": "One-command bootstrap",
"detail": null,
"points": 0,
"status": "missed",
"details": [],
"max_points": 18
},
{
"key": "automated_tests",
"name": "Automated tests",
"detail": null,
"points": 22,
"status": "met",
"details": [],
"max_points": 22
},
{
"key": "lint_format_config",
"name": "Lint / format config",
"detail": null,
"points": 0,
"status": "missed",
"details": [],
"max_points": 11
},
{
"key": "static_type_checking",
"name": "Static type checking",
"detail": "packages/create-wrap/profiles/fullstack-ssr/files/tsconfig.json, packages/create-wrap/template/tsconfig.json, packages/wrap/tsconfig.json",
"points": 11,
"status": "met",
"details": [
{
"code": "file_list",
"params": {
"files": "packages/create-wrap/profiles/fullstack-ssr/files/tsconfig.json, packages/create-wrap/template/tsconfig.json, packages/wrap/tsconfig.json"
}
}
],
"max_points": 11
},
{
"key": "reproducible_environment",
"name": "Reproducible environment",
"detail": "Dockerfile",
"points": 10,
"status": "met",
"details": [
{
"code": "file_list",
"params": {
"files": "Dockerfile"
}
}
],
"max_points": 10
},
{
"key": "demonstrated_agent_practice",
"name": "Demonstrated agent practice",
"detail": "3 of the last 54 commits agent-authored or agent-credited",
"points": 10,
"status": "met",
"details": [
{
"code": "agent_authored_commits",
"params": {
"count": 3,
"sampled": 54
}
}
],
"max_points": 10
},
{
"key": "automated_maintenance",
"name": "Automated maintenance",
"detail": "no automated dependency updates observed",
"points": 0,
"status": "missed",
"details": [
{
"code": "no_dependency_automation",
"params": {}
}
],
"max_points": 8
},
{
"key": "openssf_scorecard_pinned_dependencies",
"name": "OpenSSF Scorecard: Pinned-Dependencies",
"detail": "dependency not pinned by hash detected -- score normalized to 0",
"points": 0,
"status": "missed",
"details": [],
"max_points": 10
}
]
},
{
"key": "ai_code_legibility",
"band": "excellent",
"name": "Code legibility for models",
"note": null,
"notes": [],
"value": 100,
"inputs": {
"primary_language": "TypeScript",
"largest_source_bytes": 27878,
"source_files_sampled": 126,
"oversized_source_files": 0
},
"components": [
{
"key": "type_checkable_code",
"name": "Type-checkable code",
"detail": "TypeScript (statically typed)",
"points": 45,
"status": "met",
"details": [
{
"code": "statically_typed_language",
"params": {
"language": "TypeScript"
}
}
],
"max_points": 45
},
{
"key": "manageable_file_sizes",
"name": "Manageable file sizes",
"detail": "0/126 source files over 60KB",
"points": 55,
"status": "met",
"details": [
{
"code": "oversized_source_files",
"params": {
"kb": 60,
"sampled": 126,
"oversized": 0
}
}
],
"max_points": 55
}
]
},
{
"key": "ai_interfaces",
"band": "at_risk",
"name": "Machine-readable interfaces",
"note": null,
"notes": [],
"value": 40,
"inputs": {
"example_dirs": [
"example"
],
"has_mcp_signal": false,
"api_schema_files": []
},
"components": [
{
"key": "api_schema_openapi_graphql_proto",
"name": "API schema (OpenAPI/GraphQL/proto)",
"detail": null,
"points": 0,
"status": "missed",
"details": [],
"max_points": 40
},
{
"key": "mcp_server",
"name": "MCP server",
"detail": null,
"points": 0,
"status": "missed",
"details": [],
"max_points": 20
},
{
"key": "runnable_examples",
"name": "Runnable examples",
"detail": "example",
"points": 40,
"status": "met",
"details": [
{
"code": "file_list",
"params": {
"files": "example"
}
}
],
"max_points": 40
}
]
}
],
"description": "How well is the repo equipped to be developed and maintained with AI coding agents? An independent, experimental badge — weight 0.0, so it is surfaced on its own and does not affect the overall health score."
}
],
"metrics_version": "1.13.0"
},
"warnings": [
"Star history unavailable: GitHub GraphQL error: Resource not accessible by personal access token",
"GitHub dependency-graph SBOM unavailable (404); the dependency graph may be disabled for this repository"
],
"report_type": "repository",
"generated_at": "2026-07-25T14:08:20.602591Z",
"schema_version": "0.27.0",
"badge_url": "https://raw.githubusercontent.com/inspect-software/badges/main/v1/d/DoniLite/wrap.svg",
"full_name": "DoniLite/wrap",
"license_state": "absent",
"license_spdx": null
}Scores are signals, not warranties. They reflect publicly visible practices on GitHub — not a code audit, and not a security guarantee.
Missing data is excluded and weights renormalized, never scored as zero. Methodology is versioned and open: metrics v1.13.0, schema v0.27.0 — full methodology · metrics wiki.
How one result sits in the wider record: aggregate statistics — npm.