Software health reportschema 0.27.0 · metrics 1.13.0 · 2026-07-25 02:31 UTC

faapi / faapi

TypeScriptMIT★ 0 stars⑂ 0 forkssince Jun 2026View on GitHub ↗

faapi/faapi holds a health index of 48 out of 100, placing it in the At risk band. It scores highest on AI Readiness (73/100) and lowest on Sustainability & Governance (32/100). It was last updated 5 days ago. A single contributor accounts for most of its recent work.

overall / 100

At risk

Software health index

Metrics are grouped into weighted categories on one standardized 1–100 scale. Overall starts as their weighted mean; when public evidence triggers the High-Risk Jurisdiction Policy, the rating is adjusted and receives an At risk ceiling of 49. AI Readiness sits outside the overall score.

Excellent85-100Exemplary; meets essentially all checked criteria

Good70-84Healthy; minor gaps

Moderate50-69Acceptable with notable gaps; review recommended

At risk30-49Significant weaknesses; adoption warrants caution

Critical1-29Severe problems (abandoned, single-maintainer, no hygiene)

Score profile

Each axis is a category. The shape matters more than the average — a healthy subject fills the whole shape, while a spike-and-crater profile means strength in one dimension is masking risk in another.

Ownership

faapiPersonal account

1 follower1 public reposince Mar 2017

This repository is owned by a personal account. A single-owner project carries more continuity risk than an organization-backed one.

Package ecosystems

Registry	Package	Version	Downloads / mo	Versions	Last publish	Tags
npm	@faapi/mcp	1.0.2	1,791	20	5 days ago	—
npm	@faapi/next	1.0.2	3,085	28	5 days ago	—
npm	@faapi/faapi	1.0.2	4,176	29	5 days ago	api framework typescript nodejs middleware ast function-as-api
npm	@faapi/schema	1.0.2	3,120	28	5 days ago	—

Metrics by category

Vitality

Is the project alive — is code being written and are releases shipping?

68Moderate · 22% of overall

Development activity

54Moderate

How it's scored

36/36	Push recency — last push 5 days ago
3.5/36	Commit cadence — 5/52 weeks with commits
14.1/18	Commit volume — 36 commits in the last year
0/10	OpenSSF Scorecard: Maintained — project was created within the last 90 days. Please review its contents carefully

Inputs used

commits_last_year	36
human_commit_share	1
days_since_last_push	5
active_weeks_last_year	5

Release discipline

88Excellent

How it's scored

16.2/27	Ships releases — 3 version tags (no GitHub releases)
36/36	Release recency — latest release 5 days ago
27/27	Release cadence — a release every ~3.3 days
0/10	OpenSSF Scorecard: Signed-Releases — no data

Inputs used

releases_count	3
latest_release_tag	v1.0.2
releases_from_tags	yes
days_since_latest_release	5
mean_days_between_releases	3.3

Excluded from scoring (no data or not applicable): OpenSSF Scorecard: Signed-Releases. Remaining weights renormalized.

Community & Adoption

Does the project have users, downloads, attention, and a welcoming setup for contributors?

35At risk · 18% of overall

Popularity & adoption

1Critical

How it's scored

0/60	Stars — 0 stars
0/25	Forks — 0 forks
0/15	Watchers — 0 watchers

Inputs used

forks	0
stars	0
watchers	0
growth_state	unverified
growth_factor_pct	100
growth_unverified_reason	no_history

Community health

50Moderate

How it's scored

22.5/22.5	README
22.5/22.5	License — recognized license (MIT)
0/18	CONTRIBUTING guide
0/13.5	Code of conduct
0/7.2	Issue template
0/6.3	PR template

Inputs used

has_readme	yes
has_license	yes
has_contributing	no
has_issue_template	no
has_code_of_conduct	no
has_pull_request_template	no

Ecosystem adoption (downloads)

68Moderate

How it's scored

54.5/80	Monthly downloads — 12,172 downloads/month across npm
0/20	Registry dependents — not reported by this ecosystem

Inputs used

packages	@faapi/mcp, @faapi/next, @faapi/faapi, @faapi/schema
dependents	—
ecosystems	npm
total_downloads	—
monthly_downloads	12,172

Excluded from scoring (no data or not applicable): Registry dependents. Remaining weights renormalized.

Sustainability & Governance

Will the project survive its people — bus factor, responsiveness, who backs it, and package upkeep?

32At risk · 24% of overall

Maintainer resilience (bus factor)

10Critical

How it's scored

9/54	Bus factor — 1 contributor(s) cover half of all commits
0/22.5	Commit distribution — top contributor authored 100% of commits
1.4/13.5	Contributor breadth — 1 contributors
0/10	OpenSSF Scorecard: Contributors — project has 0 contributing companies or organizations -- score normalized to 0

Inputs used

bus_factor	1
contributors_sampled	1
top_contributor_share	1

Issue & PR responsiveness

1Critical

How it's scored

0/46.8	Issue resolution — no issues or no data
0/38.3	PR acceptance — no decided pull requests or no data
0/15	OpenSSF Scorecard: Code-Review — Found 0/30 approved changesets -- score normalized to 0

Inputs used

merged_prs	0
open_issues	0
closed_issues	0
issue_closed_ratio	—
closed_unmerged_prs	0

Excluded from scoring (no data or not applicable): Issue resolution, PR acceptance. Remaining weights renormalized.

Ownership & stewardship

33At risk

How it's scored

10/30	Ownership backing — personal (user) account
0/20	Verified domain — not applicable to user accounts
2.2/25	Owner reach — 1 followers of faapi
14.2/25	Track record — 1 public repos, account ~9 yr old

Inputs used

followers	1
owner_type	User
is_verified	—
owner_login	faapi
public_repos	1
account_age_days	3,427

Excluded from scoring (no data or not applicable): Verified domain. Remaining weights renormalized.

Package maintenance

100Excellent

How it's scored

25/25	Published & resolvable — 4 package(s) on npm
35/35	Publish recency — latest publish 5 days ago
20/20	Version history — 29 published versions
20/20	Not deprecated — active, not deprecated or yanked

Inputs used

packages	@faapi/mcp, @faapi/next, @faapi/faapi, @faapi/schema
ecosystems	npm
any_deprecated	no
min_days_since_publish	5

Engineering Quality

Are baseline engineering and documentation practices in place?

65Moderate · 20% of overall

Engineering practices

88Excellent

How it's scored

24/24	CI workflows — 2 workflow(s)
24/24	Tests present
16/16	Linter config — eslint.config.js
0/9.6	Pre-commit hooks
6.4/6.4	.editorconfig
0/20	OpenSSF Scorecard: CI-Tests — no data

Inputs used

has_ci	yes
has_tests	yes
has_editorconfig	yes
has_linter_config	yes
has_precommit_config	no

Excluded from scoring (no data or not applicable): OpenSSF Scorecard: CI-Tests. Remaining weights renormalized.

Documentation

30At risk

How it's scored

30/30	README
0/25	Documentation directory
0/15	Documentation / homepage site
0/10	Repository description
0/10	Topics
0/10	Wiki

Inputs used

topics	—
has_wiki	no
homepage	—
has_readme	yes
has_docs_dir	no
has_description	no

Security

Are visible security and supply-chain practices strong, without unresolved high-risk jurisdiction exposure?

41At risk · 16% of overall

Security posture

26Critical

How it's scored

7.5/7.5	Binary-Artifacts — no binaries found in the repo
0/7.5	Branch-Protection — branch protection not enabled on development/release branches
0/2.5	CI-Tests — no data
0/2.5	CII-Best-Practices — no effort to earn an OpenSSF best practices badge detected
0/7.5	Code-Review — Found 0/30 approved changesets -- score normalized to 0
0/2.5	Contributors — project has 0 contributing companies or organizations -- score normalized to 0
10/10	Dangerous-Workflow — no dangerous workflow patterns detected
0/7.5	Dependency-Update-Tool — no update tool detected
0/5	Fuzzing — project is not fuzzed
2.5/2.5	License — license file detected
0/7.5	Maintained — project was created within the last 90 days. Please review its contents carefully
5/5	Packaging — packaging workflow detected
0/5	Pinned-Dependencies — dependency not pinned by hash detected -- score normalized to 0
0/5	SAST — no SAST tool detected
0/5	Security-Policy — security policy file not detected
0/7.5	Signed-Releases — no data
0/7.5	Token-Permissions — detected GitHub workflow tokens with excessive permissions
0/7.5	Vulnerabilities — 21 existing vulnerabilities detected

Inputs used

source	openssf_scorecard
checks_evaluated	16
scorecard_version	v5.5.0
checks_inconclusive	2
scorecard_aggregate	2.6

Excluded from scoring (no data or not applicable): ci_tests, signed_releases. Remaining weights renormalized.

Dependency advisories

100Excellent

How it's scored

35/35	Direct dependencies free of known advisories — no direct dependency carries a known advisory
25/25	Indirect dependencies free of known advisories — no indirect dependency carries a known advisory
0/40	No advisories left outstanding — no advisory carries a publication date

Inputs used

source	osv
advisories	0
affected_packages	0
assessed_packages	47
unassessed_packages	0
affected_by_severity	none
direct_affected_packages	0

Excluded from scoring (no data or not applicable): No advisories left outstanding. Remaining weights renormalized. Matched the npm:@faapi/faapi@1.0.2 runtime dependency closure — what installing the published package pulls in — 47 packages. Reachability is not analyzed.

AI Readiness

How well is the repo equipped to be developed and maintained with AI coding agents? An independent, experimental badge — weight 0.0, so it is surfaced on its own and does not affect the overall health score.

73Good · 0% of overall

Agent context & guidance

85Excellent

How it's scored

45/45	Agent instructions — AGENTS.md
0/15	Machine-readable docs (llms.txt)
40/40	Legible commit history — 36 of 36 human commits state their intent (structured subject or explanatory body)

Inputs used

has_llms_txt	no
legible_history_share	1
agent_instruction_files	AGENTS.md
agent_instruction_max_bytes	36,840

Verify loop (build / test / typecheck)

54Moderate

How it's scored

0/18	One-command bootstrap
22/22	Automated tests
11/11	Lint / format config — eslint.config.js
11/11	Static type checking — packages/faapi/fixtures/api-alias/tsconfig.json, packages/faapi/tsconfig.json, packages/mcp/tsconfig.json, packages/next/fixtures/with-nextjs/tsconfig.json, packages/next/tsconfig.json, packages/schema/tsconfig.json
10/10	Reproducible environment — lockfile
0/10	Demonstrated agent practice — no agent-authored commits among the last 36
0/8	Automated maintenance — no automated dependency updates observed
0/10	OpenSSF Scorecard: Pinned-Dependencies — dependency not pinned by hash detected -- score normalized to 0

Inputs used

has_nix	no
has_tests	yes
lockfiles	pnpm-lock.yaml
has_dockerfile	no
typed_language	yes
bootstrap_files	—
has_devcontainer	no
has_linter_config	yes
typecheck_configs	packages/faapi/fixtures/api-alias/tsconfig.json, packages/faapi/tsconfig.json, packages/mcp/tsconfig.json, packages/next/fixtures/with-nextjs/tsconfig.json, packages/next/tsconfig.json, packages/schema/tsconfig.json
agent_commit_share	0
toolchain_manifests	—
dependency_bot_commit_share	0

Code legibility for models

100Excellent

How it's scored

45/45	Type-checkable code — TypeScript (statically typed)
54.7/55	Manageable file sizes — 1/218 source files over 60KB

Inputs used

primary_language	TypeScript
largest_source_bytes	103,924
source_files_sampled	218
oversized_source_files	1

Key facts

0GitHub stars

1contributors

36commits, last 12 months

5days since last push

3releases

1bus factor

0open issues

npmpackage ecosystems

Data collection warnings

GitHub dependency-graph SBOM unavailable (404); the dependency graph may be disabled for this repository

More detail

OpenSSF Scorecard 2.6 / 10

2.6aggregate

Independent, tool-agnostic security assessment from the open-source OpenSSF Scorecard. Each check rewards a security practice, not a specific vendor's tool. Checks Scorecard could not determine are marked n/a and excluded from the security score (never counted as zero).Scorecard v5.5.0 · 2026-07-25 02:31 UTC

10	Binary-Artifacts	no binaries found in the repo
0	Branch-Protection	branch protection not enabled on development/release branches
n/a	CI-Tests	no pull request found
0	CII-Best-Practices	no effort to earn an OpenSSF best practices badge detected
0	Code-Review	Found 0/30 approved changesets -- score normalized to 0
0	Contributors	project has 0 contributing companies or organizations -- score normalized to 0
10	Dangerous-Workflow	no dangerous workflow patterns detected
0	Dependency-Update-Tool	no update tool detected
0	Fuzzing	project is not fuzzed
10	License	license file detected
0	Maintained	project was created within the last 90 days. Please review its contents carefully
10	Packaging	packaging workflow detected
0	Pinned-Dependencies	dependency not pinned by hash detected -- score normalized to 0
0	SAST	no SAST tool detected
0	Security-Policy	security policy file not detected
n/a	Signed-Releases	no releases found
0	Token-Permissions	detected GitHub workflow tokens with excessive permissions
0	Vulnerabilities	21 existing vulnerabilities detected

Direct dependencies 4

Registry	Package	Version constraint	Manifest
npm	esbuild	`^0.25.0`	packages/faapi/package.json
npm	fast-glob	`^3.3.3`	packages/faapi/package.json
npm	typescript	`^5.7.0`	packages/faapi/package.json
npm	ws	`^8.21.0`	packages/faapi/package.json

All dependencies not collected

The resolved dependency set could not be collected for this report: GitHub dependency-graph SBOM unavailable (404); the dependency graph may be disabled for this repository

Dependency advisories 0

Installing npm:@faapi/faapi@1.0.2 pulls in 47 packages, direct and transitive: 0 carry known advisories, of which 0 are direct dependencies.

No known advisories affect the assessed dependencies.

An advisory means the version recorded in the dependency graph falls inside an advisory’s affected range. Reachability is not analysed, and the graph includes development and test pins — a finding may concern tooling rather than shipped software.

Raw JSON report machine-readable

{
  "data": {
    "repo": {
      "topics": [],
      "is_fork": false,
      "size_kb": 38016,
      "has_wiki": false,
      "homepage": null,
      "languages": {
        "JavaScript": 2268,
        "TypeScript": 1100973
      },
      "pushed_at": "2026-07-19T04:55:22Z",
      "created_at": "2026-06-27T09:30:28Z",
      "owner_type": "User",
      "updated_at": "2026-07-19T04:55:21Z",
      "description": null,
      "is_archived": false,
      "is_disabled": false,
      "license_spdx": "MIT",
      "default_branch": "main",
      "license_spdx_raw": "MIT",
      "primary_language": "TypeScript",
      "significant_languages": [
        "TypeScript"
      ]
    },
    "owner": {
      "blog": null,
      "name": "faapi",
      "type": "User",
      "login": "faapi",
      "company": null,
      "location": "HangZhou/China",
      "followers": 1,
      "avatar_url": "https://avatars.githubusercontent.com/u/26213241?v=4",
      "created_at": "2017-03-06T04:15:46Z",
      "is_verified": null,
      "public_repos": 1,
      "account_age_days": 3427
    },
    "license": {
      "state": "standard",
      "spdx_id": "MIT",
      "raw_spdx": "MIT",
      "file_present": true,
      "scorecard_found": true,
      "profile_has_license": true
    },
    "activity": {
      "releases": [
        {
          "tag": "v1.0.2",
          "kind": "patch",
          "published_at": "2026-07-19T04:55:07Z"
        },
        {
          "tag": "v1.0.1",
          "kind": "patch",
          "published_at": "2026-07-19T04:25:12Z"
        },
        {
          "tag": "v1.0.0",
          "kind": "major",
          "published_at": "2026-07-12T14:10:41Z"
        }
      ],
      "recent_commits": [
        {
          "oid": "d22d5d3ff97b8d33f801e1350e43c843c8d9a10c",
          "body": "业务方 handler 内 `import { db } from '@/lib/db'` 在 vitest 下 createTestServer\n加载时报 `Cannot find package '@/lib'`——Node 原生 import() 不识别 tsconfig paths\n别名，vi.mock 也只对 Vite module pipeline 生效。\n\nimportWithCacheBust 检测 globalThis.vi.importActual（vitest globals: true 时注入），\n优先走 Vite SSR pipeline：\n- 识别 vitest.c\n[…]\n：\n- testServer.e2e.alias.test.ts：验证别名解析 + 真实模块加载（4 个用例）\n- testServer.e2e.alias.mock.test.ts：验证 vi.mock 生效（3 个用例）\n\n补充单元测试覆盖 importWithCacheBust 的 vitest 路径/缺失回退/异常传播（4 个用例）。\n924 测试 + 4 子包 typecheck 通过。",
          "is_bot": false,
          "headline": "fix(test): createTestServer 在 vitest 下走 Vite pipeline 识别 @/ 别名 + vi.mock",
          "author_name": "lennontu",
          "author_login": "faapi",
          "committed_at": "2026-07-19T04:55:07Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "218585b1cde1a2021e5fa62fa33f1c52a116139f",
          "body": "… / waitForWsOpen\n\n新增四个公开导出，业务方一行代码启动带 schema 校验的真实端口测试服务器，\n并便捷测试 WebSocket 路由。默认禁用 CORS/Helmet/Logger 避免污染断言，\n与 createProdApp + app.inject 互补——专注真实端口 + 自动 schema，无需 build。\n\n- createTestServer(options)：自动 scanRoutes + mkdtemp + generateSchemaFiles +\n  createServer + listen(0)；close() 自动 closeAllConn\n[…]\n- waitForWsOpen(ws, timeout?)：Promise 化等待 open 事件，监听 open/error/close\n  并清理 timer\n\n同时更新 src/testing.md、.trae/skills/faapi-dev/SKILL.md + testing.md\n加入四层测试 API 对比表与 E2E 完整章节。913 测试 + 4 子包 typecheck 通过。",
          "is_bot": false,
          "headline": "feat(test): 公开 E2E 测试 API createTestServer / connectWs / MessageQueue…",
          "author_name": "lennontu",
          "author_login": "faapi",
          "committed_at": "2026-07-19T04:25:12Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "4f644f8119209412c3434921933b7e088211e30a",
          "body": null,
          "is_bot": false,
          "headline": "chore: 补建 v1.0.0 CHANGELOG",
          "author_name": "lennontu",
          "author_login": "faapi",
          "committed_at": "2026-07-12T16:19:04Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "d7438c82ea207ad00bfd6957842a9e08130199af",
          "body": null,
          "is_bot": false,
          "headline": "chore: changelog 改用 @changesets/changelog-git 避免依赖 GITHUB_TOKEN",
          "author_name": "lennontu",
          "author_login": "faapi",
          "committed_at": "2026-07-12T16:15:42Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "3a00f3eda35007490db2c20b3b2d70d891429a28",
          "body": null,
          "is_bot": false,
          "headline": "chore(release): v1.0.0",
          "author_name": "lennontu",
          "author_login": "faapi",
          "committed_at": "2026-07-12T14:10:41Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "856e11fcd11a446a4e3fb3a0e83537e4607f09de",
          "body": null,
          "is_bot": false,
          "headline": "docs: 移除 faapi.config.{env}.ts 历史说明",
          "author_name": "lennontu",
          "author_login": "faapi",
          "committed_at": "2026-07-12T13:55:47Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "64c76d7e61dab21c1360ad0906a4fa384394922f",
          "body": "参考 Next.js 实现新增 loadEnv 模块，启动时加载 .env / .env.local /\n.env.{env} / .env.{env}.local 四级文件到 process.env，faapi.config.ts\n通过 process.env.XXX 读取。删除 compileConfig 中的 env 合并逻辑、\ndeepMerge 死代码，env 决定规则简化为 NODE_ENV || 'development'，\n调用方（devCommand / main.js）在调 loadEnv 之前自行兜底 NODE_ENV。",
          "is_bot": false,
          "headline": "feat(config): 用 .env 系列文件替换 faapi.config.{env}.ts 多环境配置",
          "author_name": "lennontu",
          "author_login": "faapi",
          "committed_at": "2026-07-12T13:21:58Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "991c0b8495ae2643c991ea35a5be991a3a08b0b0",
          "body": "watch 模式下 rebuildRoutes 调 compileDevRoutes 期间,Node 主线程事件循环\n仍处理 HTTP 请求。esbuild 默认写文件(非原子),运行时 loadRouteModule 的\nimport() 可能读到写一半的产物(alias 未重写完)→ Cannot find package\n'@/lib' → 500。\n\n修复:启用 esbuild write: false,拿到 outputFiles 后自行原子写\n(写临时文件 + rename)。rename 在同一文件系统上是原子的(POSIX),\nHTTP 请求要么看到旧完整文件要么看到新完整文件,无半成品窗口。\n\n仅 dev 需要(compileBuildRoutes 是 build 一次性编译,运行时不并发)。",
          "is_bot": false,
          "headline": "fix(dev): compileDevRoutes 原子写消除 watch 竞态 500",
          "author_name": "lennontu",
          "author_login": "faapi",
          "committed_at": "2026-07-10T02:20:38Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "f08a14ece07fb7c278db2d6a66a9320a78b14549",
          "body": "将\"不支持功能反馈\"升级为\"问题反馈与处理流程\",按实战 TODO 模式重构:\n- 三类问题分类:功能缺口/文档错误/行为异常,对应三个 TODO 文件\n- 记录格式强化:加源码依据(文件+行号)、实际行为、验证清单字段\n- 完整处理流程:查源码确认→变通推进→TODO 记录→反馈 faapi→修复验证→删除 TODO\n- 关键原则:记录前必须读 faapi 源码确认问题真实性,避免误判用法错误为框架问题\n- 实战示例:功能缺口/文档错误(body 预读案例)/行为异常三个\n- 反馈渠道:按类型提 issue 或直接 PR(docs 修正低风险无需 issue)",
          "is_bot": false,
          "headline": "docs(skill): 优化 vibe coding 问题反馈与处理流程",
          "author_name": "lennontu",
          "author_login": "faapi",
          "committed_at": "2026-07-09T08:36:47Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "02bea8c96311b0186839e9a15040df2eb3b773f5",
          "body": "faapi 对 POST/PUT/PATCH 始终预读请求体(resolveInput 无条件调用\nrequest.text()),无论 handler 是否声明 body 参数。此前文档错误描述为\n\"不声明 body/form 时框架不预读请求体,可用 ctx.request.json() 自行读取\",\n实际会抛 \"Body has already been read\"。\n\n修正 5 处:\n- sse.md: sendRaw 示例改为声明 body 参数\n- realtime.md: 上游 SSE 透传示例改为声明 body 参数\n- route.md: \"不声明 body/form 时\"章节改为\"POST/PUT/PATCH 的请求体注入\"\n- injection.md: 错误结论行改为\"POST/PUT/PATCH 始终预读请求体\"\n- sse-sendraw.md: changeset 示例改为声明 body 参数\n\n正确用法:声明 body 参数(可用 index signature 允许开放字段透传),\n不能用 ctx.request.json()/.text()。",
          "is_bot": false,
          "headline": "docs: 修正请求体预读行为描述",
          "author_name": "lennontu",
          "author_login": "faapi",
          "committed_at": "2026-07-09T08:27:44Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "a04d0de9b9dc727cedc8a61a2888e409b204976c",
          "body": "LLM 中转平台场景需逐 chunk 透传上游已有的 SSE 原文,现有 send 会再次\n加 data: 前缀导致双重前缀。sendRaw 直接 enqueue 到底层流,不做任何\nSSE 序列化,与 send 同守卫(close/aborted 后静默忽略),可混用。\n\n同时补充 skill 文档:\n- realtime.md: sendRaw API + 上游 SSE 透传示例 + Response(ReadableStream) 流式透传说明\n- route.md/injection.md: 不声明 body/form 时框架不预读请求体\n- SKILL.md/debug.md: 不支持功能反馈机制(维护 faapi-todo.md)",
          "is_bot": false,
          "headline": "feat(sse): 新增 sendRaw 支持原始字节透传",
          "author_name": "lennontu",
          "author_login": "faapi",
          "committed_at": "2026-07-09T07:57:43Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "4e89b9b26d46acc82dc7bf8fcea5ce94ba34d263",
          "body": "- 公开导出 createContext/invokeHandler,业务方可不启动服务器测试 handler\n- zod 从 dependencies 改为 peerDependencies,业务方需自行安装 zod@^4\n- 技能文档补充 zod 安装说明、测试指南与错误排查",
          "is_bot": false,
          "headline": "feat: 公开测试 API 并将 zod 改为 peerDependencies",
          "author_name": "lennontu",
          "author_login": "faapi",
          "committed_at": "2026-07-08T11:51:26Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "b2b338cec0ab0a4391bc3c91b8fea1bb0d905638",
          "body": "与 next build 设计一致——build 不关心端口，启动时由 PORT 环境变量决定。\nmain.js 中 listen() 无参，运行时走 PORT 环境变量或默认 3000。",
          "is_bot": false,
          "headline": "refactor(cli): 移除 faapi build 的 --port 选项",
          "author_name": "lennontu",
          "author_login": "faapi",
          "committed_at": "2026-07-08T03:30:17Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "ede2e849ac755f94e4bb172d83337c10f3a42c31",
          "body": "- 修正 12 个 .ts 文件 JSDoc 残留（.faapi/build → dist、.faapi/dev → .faapi）\n- 修正 generateRoutes.ts 默认参数值（.faapi/build → dist）\n- 修正 6 处文档\"bundle 编译\"→\"逐文件编译（bundle: false）\"\n- 对齐 AGENTS.md §5.3 NODE_ENV define 描述（build 用 define+minifySyntax 死代码消除，dev 运行时读取）\n- 新增 createDevApp.md DDD 文档",
          "is_bot": false,
          "headline": "docs: 对齐产物目录约定与死代码消除描述",
          "author_name": "lennontu",
          "author_login": "faapi",
          "committed_at": "2026-07-07T17:41:29Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "f5b23c65d5018485a21da47afedf0bd770d6f25e",
          "body": "- 产物目录参照 Next.js distDir 模式：CLI `--dist` 为产物根目录（默认 `.faapi`），\n  dev 输出到 `<dist>/dev`，prod 输出到 `<dist>/build`\n- 环境变量 `FAAPI_OUT_DIR` 改名为 `FAAPI_DIST`，内部 API 统一用 `dist` 命名\n- 移除 `appDir` 配置概念：路由源码目录写死 `src/`，不再支持 `--appDir` 选项\n  和 `FAAPI_APP_DIR` 环境变量\n- 删除 `detectAppDir` 自动探测函数（不再需要）\n- 同步更新 AGENTS.md、DDD 文档、技能文档和 changeset",
          "is_bot": false,
          "headline": "refactor(cli): 重命名产物目录约定并移除 appDir 配置",
          "author_name": "lennontu",
          "author_login": "faapi",
          "committed_at": "2026-07-07T16:07:02Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "9a79cdf57fede4e0d6bb63a756dfcd13863be56b",
          "body": "- logger 中间件改为默认启用（与 cors 一致）：undefined/true 启用 logger()，\n  false 禁用，LoggerOptions 自定义；之前 config.logger 是声明未消费的死字段\n- logger 中间件位置：CORS → helmet → logger → 全局中间件 → 目录中间件 → handler\n- logger 的 log 函数改为每次请求读取（options.log ?? console.log），\n  运行时替换 console.log 会生效\n- 完全自定义日志中间件：logger: false + middlewares: [myCustomLogger]\n- 同步更新 logger.md / middleware/README.md / config/README.md /\n  AGENTS.md / faapi-dev skill 文档\n- 新增 e2e 测试覆盖默认启用/false/LoggerOptions/true 四种场景\n- 新增 changeset: @faapi/faapi minor",
          "is_bot": false,
          "headline": "feat(middleware): logger 默认启用并支持覆盖",
          "author_name": "lennontu",
          "author_login": "faapi",
          "committed_at": "2026-07-07T01:15:22Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "2a7b6a3ac7ba60b0ee8c5fe40b7f5f4286baceae",
          "body": null,
          "is_bot": false,
          "headline": "feat: update skills",
          "author_name": "lennontu",
          "author_login": "faapi",
          "committed_at": "2026-07-06T05:50:25Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "a3f70140e1b402aaca65ed2838660fcf0c8f55c9",
          "body": "- AST 类型提取支持字段级 JSDoc 约束标签：@max/@min/@int/@positive/@negative/\n  @nonnegative/@nonpositive/@maxLength/@minLength/@length/@regex/@email/@url/@uuid\n  共 14 个标签,分为数值约束/长度约束/字符串格式约束三类\n- 约束与字段类型不匹配时（如 @max 用于 string）在 AST 提取阶段抛\n  SchemaExtractionError,不降级放行\n- coerce 模式下约束作用在 z.preprocess 内部的 z.X() 上,不影响 c\n[…]\nr,默认 4GB 堆内存不够）\n  - 根 package.json test 加 --workspace-concurrency=1,包间串行执行\n\n- 修复 lint 错误 3 处（createServer.ts let→const、mcpServer.test.ts\n  未使用变量 captured、无意义赋值 pushed）\n\n测试验证：4 包 typecheck 全过,1033 测试全过",
          "is_bot": false,
          "headline": "feat(ast): 支持 JSDoc 约束标签 + 修复文档有效性 + 修复测试 OOM",
          "author_name": "lennontu",
          "author_login": "faapi",
          "committed_at": "2026-07-06T05:00:20Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "22b65a2e3efd6782c23df311c988aefe9a407ab1",
          "body": null,
          "is_bot": false,
          "headline": "fix: 移除 faapi 对 schema 的多余依赖，消除循环 workspace 依赖",
          "author_name": "lennontu",
          "author_login": "faapi",
          "committed_at": "2026-07-05T06:33:36Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "7ba642ed3622138dfbd7d5a5410f50f385e2ebc3",
          "body": "- configTypes.ts: onReady 注释修正，实现在 server.listen 回调中执行\n- configTypes.ts: http2 类型从 boolean 扩展为 Http2Options | boolean\n- middleware.md: ctx 参考表补充遗漏项，移除不存在的 ctx.body\n- devCommand.ts / buildCommand.ts: 修正未使用变量 lint 错误",
          "is_bot": false,
          "headline": "fix: 修复文档/类型/注释与实现不一致的问题",
          "author_name": "lennontu",
          "author_login": "faapi",
          "committed_at": "2026-07-05T06:21:21Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "ca5abac281593d29173dd917a191658c08e311db",
          "body": "- faapi-new-pkg: 5 处 ../../../AGENTS.md 等外部链接改为纯文字描述\n- npm-stable-release: 3 处 file:///Users/... 绝对路径改为纯文字描述\n- faapi-new-pkg: 跨技能引用 ../npm-stable-release/SKILL.md 改为纯文字\n- 所有技能目录不引用技能目录之外的文件",
          "is_bot": false,
          "headline": "docs(skill): 移除技能文档的外部文件引用，确保技能自足可发布",
          "author_name": "lennontu",
          "author_login": "faapi",
          "committed_at": "2026-07-01T16:43:50Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "490edb15699fd02f0fe555dad534406500099b38",
          "body": "- loadConfig 用 esbuild 编译 .ts 配置为临时 .mjs 后 import（bundle: true 支持本地 import）\n- 产物路径基于内容 SHA-1 哈希，内容未变化时跳过编译\n- 移除 cli/index.ts 的 ensureTsx/isTsxPreloaded 逻辑\n- esbuild 从 devDependencies 移到 dependencies\n- 用户项目无需安装 tsx 即可使用 faapi.config.ts\n- 文档同步更新（cli/index.md、loadConfig.md、AGENTS.md 技术栈、faapi-dev 技能等）",
          "is_bot": false,
          "headline": "refactor(cli): 移除 tsx 依赖，config.ts 改由 esbuild 编译加载",
          "author_name": "lennontu",
          "author_login": "faapi",
          "committed_at": "2026-07-01T16:29:12Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "b3822c571edd0b0f73a5a541341ba464d931613c",
          "body": "- AGENTS.md：技术栈区分 tsx（加载 config.ts）与 esbuild（编译路由）\n- faapi-dev/SKILL.md：设计原则不再提 tsx/esbuild 组合\n- faapi-dev/debug.md：Bundler 解析由 esbuild 提供，tsx 不参与路由文件解析",
          "is_bot": false,
          "headline": "docs: 修正 tsx 角色描述，仅用于加载 faapi.config.ts",
          "author_name": "lennontu",
          "author_login": "faapi",
          "committed_at": "2026-07-01T16:19:02Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "9e567b2b7f12de2d42b962492c05bd208d4220ef",
          "body": "- SKILL.md：dev/prod 对比表更新为 esbuild 编译 + .faapi/dev 产物\n- debug.md：tsx 转译 → esbuild 编译，全量重建 → 增量编译\n- route.md：tsx 转译 → esbuild 编译",
          "is_bot": false,
          "headline": "docs(skill): 同步 faapi-dev 技能至 dev 架构重构后的描述",
          "author_name": "lennontu",
          "author_login": "faapi",
          "committed_at": "2026-07-01T16:00:53Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "ce23482c284d195ec8f2c0227e8b27f563684172",
          "body": "- 删除 extractSchemasForRoutes / typeInfoToSchemaEntry\n- createServer 不再自动提取 schema，由调用方负责加载\n- e2e/单元测试改为 generateSchemaFile + loadSchemaToRegistry\n- 更新文档移除 new Function 描述",
          "is_bot": false,
          "headline": "refactor(validator): 移除 new Function 兜底路径，统一走文件加载",
          "author_name": "lennontu",
          "author_login": "faapi",
          "committed_at": "2026-07-01T15:10:05Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "336269da0abebec39eac753fc99ca1b45a10ab72",
          "body": "修正 9 个文档中与最新架构不一致的描述：\n- dev 模式 schema 来源改为预生成 .faapi/dev/faapi-schema.js（new Function 仅作兜底）\n- parseArgs/README 的 dev 行为改为\"编译 .ts → .faapi/dev/*.js\"\n- 根 README 补充 faapi start 命令\n- createNextServer.md 的生产启动改为 faapi start\n- scanRoutes.md 标注旧模式 CLI 不再使用",
          "is_bot": false,
          "headline": "docs: 同步 dev 架构重构后的 schema 与命令描述",
          "author_name": "lennontu",
          "author_login": "faapi",
          "committed_at": "2026-07-01T14:57:39Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "e2ee43b3744c8075a2f9b20b15560a881524dcdf",
          "body": "参考 Next.js 实现，dev 和 build 都先 esbuild 编译 TypeScript 到中间产物，运行时只加载 .js，不再依赖 tsx 即时转译路由文件。\n\n- 新增 compileRoutes.ts：统一编译模块（dev→.faapi/dev/，build→dist/），含 tsconfig paths 别名重写 esbuild 插件\n- dev 模式：编译 → 扫描产物 → 预生成 schema → 启动 → watch（增量编译 + 热替换路由）\n- start 模式：从 dist/faapi-routes.js 读取清单并水合，加载 dist/faapi-schema\n[…]\nonfig.ts，build 模式不加载配置文件\n- watch 修复：chokidar v4 移除 glob 支持，改为监听 appDir 目录 + ignored 函数过滤\n- 移除 registerPathsHook（别名在编译时由 esbuild 处理，运行时无需 paths resolve hook）\n- 新增 readTsconfig.ts / resolveAlias.ts 工具模块",
          "is_bot": false,
          "headline": "feat(cli): dev 架构重构为编译中间产物模式",
          "author_name": "lennontu",
          "author_login": "faapi",
          "committed_at": "2026-07-01T14:51:21Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "c6dc0f703ea4270b0e5a22de2068ce9ab3d8672c",
          "body": "- 新增 faapi start 命令：生产模式启动，读 dist/faapi-routes.js + dist/faapi-schema.js，不再依赖 NODE_ENV 切换\n- faapi build 生成 dist/faapi-routes.js 路由清单（序列化路由 + 中间件路径），start 时水合还原洋葱模型\n- 重构 tsx 加载为官方 register API，修复 tsx 4.22 兼容\n- 按 mode 兜底设置 NODE_ENV（dev→development, start→production），同步给生态下游如 Next.js\n- FAAPI_ENV 优先级调整为 FAAPI_ENV > NODE_ENV > development\n- scanRoutes 支持 .ts/.js 双扩展名\n- 同步更新 AGENTS.md、CLI 文档与 faapi-dev skill 文档",
          "is_bot": false,
          "headline": "feat(cli): 实现 faapi start 命令与路由清单生成",
          "author_name": "lennontu",
          "author_login": "faapi",
          "committed_at": "2026-07-01T12:05:41Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "0f443f9702c3dc207e0c37ae015d175980410ebe",
          "body": "handler 通过 `ip` 参数名或 `ctx.ip` 接收客户端 IP：\n\n  export function GET(ip: string) {\n    return { clientIp: ip };\n  }\n\nIP 来源优先级：\n1. x-forwarded-for 第一个 IP（反向代理场景）\n2. req.socket.remoteAddress（直连场景）\n\nIPv6 形式 ::ffff:1.2.3.4 规整为 IPv4 1.2.3.4。\nHTTP 和 WebSocket 握手阶段均注入。\n\n- 新增 utils/getClientIp.ts 工具函数 + DDD 文档\n- \n[…]\nntext 接收 ip 参数，存到 ctx.ip\n- PARAM_TYPE_MAP 增加 ip 类型\n- injectParams 增加 case 'ip'\n- createServer.ts / handleWsUpgrade.ts 调用 getClientIp(req)\n- 同步更新 AGENTS.md / faapi-dev skill 注入参数表\n- 新增 changeset（minor）",
          "is_bot": false,
          "headline": "feat(injection): 新增内置注入参数 ip",
          "author_name": "lennontu",
          "author_login": "faapi",
          "committed_at": "2026-06-30T11:42:34Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "4ab8d97fd31172f7e781307f5e5dee6a9479b7a5",
          "body": "- CLI 默认 --app-dir 从 '.' 改为 'src'，默认扫描 src/api/**/*.ts\n- 保留 --app-dir . 回退到项目根目录 api/，向后兼容\n- prod 映射：src → dist/src，. → dist，逻辑无需改\n- 底层 API（scanRoutes/filePathToUrlPath）默认值保留 '.'\n- 同步更新 AGENTS.md / README / faapi-dev skill 全部 7 个文档\n  / next 包文档 / 模块 .md 注释 / parseArgs 测试断言\n- 新增 changeset（minor，可回退非 API 破坏）\n\n动机：与 Next.js src/app 约定对齐，前后端代码统一到 src/ 下",
          "is_bot": false,
          "headline": "feat(cli): 默认 appDir 改为 src，扫描 src/api/**/*.ts",
          "author_name": "lennontu",
          "author_login": "faapi",
          "committed_at": "2026-06-30T09:21:20Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "e9c592b44b6062335c2c80fea5200610915b4022",
          "body": null,
          "is_bot": false,
          "headline": "docs: 修复skill的外部引用",
          "author_name": "lennontu",
          "author_login": "faapi",
          "committed_at": "2026-06-30T06:40:05Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "e24fdb7d05e85634bf2deba0ffcbd0463f0eafe5",
          "body": "- 将 .next/ 加入 .gitignore / .prettierignore / eslint ignores\n- 从 git 移除已入库的 181 个 Next.js dev 构建产物文件\n- vitest CI 模式启用 singleFork + 锁死 maxForks=1，避免 2 核\n  runner 上 fork 子进程被 OOM kill 导致 ERR_IPC_CHANNEL_CLOSED",
          "is_bot": false,
          "headline": "chore: 忽略 .next 构建产物并修复 CI 测试崩溃",
          "author_name": "lennontu",
          "author_login": "faapi",
          "committed_at": "2026-06-30T03:22:26Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "0e994fe07db4574c34670c7f2cc01e252bc4a51d",
          "body": null,
          "is_bot": false,
          "headline": "docs: 删除已完成的验收标准清单",
          "author_name": "lennontu",
          "author_login": "faapi",
          "committed_at": "2026-06-29T19:13:41Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "81038d6ba44226690a31e344f15f73f677f7eeab",
          "body": null,
          "is_bot": false,
          "headline": "feat: fix publish ci error",
          "author_name": "lennontu",
          "author_login": "faapi",
          "committed_at": "2026-06-29T18:24:28Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "568c73bfa5480277d3b7238406b22f63a87e293c",
          "body": null,
          "is_bot": false,
          "headline": "feat: test publish",
          "author_name": "lennontu",
          "author_login": "faapi",
          "committed_at": "2026-06-29T17:51:36Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "3e73182e4faf0e18ff8f97620092e5a872315e84",
          "body": null,
          "is_bot": false,
          "headline": "feat: init",
          "author_name": "lennontu",
          "author_login": "faapi",
          "committed_at": "2026-06-29T17:09:48Z",
          "body_truncated": false,
          "is_coding_agent": false
        }
      ],
      "releases_count": 3,
      "commits_last_year": 36,
      "latest_release_at": "2026-07-19T04:55:07Z",
      "latest_release_tag": "v1.0.2",
      "releases_from_tags": true,
      "days_since_last_push": 5,
      "active_weeks_last_year": 5,
      "days_since_latest_release": 5,
      "mean_days_between_releases": 3.3
    },
    "community": {
      "has_readme": true,
      "has_license": true,
      "has_description": false,
      "has_contributing": false,
      "health_percentage": 28,
      "has_issue_template": false,
      "has_code_of_conduct": false,
      "has_pull_request_template": false
    },
    "ecosystem": {
      "packages": [
        {
          "name": "@faapi/mcp",
          "exists": true,
          "license": "MIT",
          "keywords": [],
          "ecosystem": "npm",
          "matches_repo": true,
          "registry_url": "https://www.npmjs.com/package/@faapi/mcp",
          "is_deprecated": false,
          "latest_version": "1.0.2",
          "repository_url": "https://github.com/faapi/faapi",
          "versions_count": 20,
          "total_downloads": null,
          "dependents_count": null,
          "deprecation_note": null,
          "maintainers_count": 1,
          "monthly_downloads": 1791,
          "first_published_at": "2026-07-06T05:20:59.157000Z",
          "latest_published_at": "2026-07-19T04:56:01.837000Z",
          "latest_version_yanked": null,
          "days_since_latest_publish": 5
        },
        {
          "name": "@faapi/next",
          "exists": true,
          "license": "MIT",
          "keywords": [],
          "ecosystem": "npm",
          "matches_repo": true,
          "registry_url": "https://www.npmjs.com/package/@faapi/next",
          "is_deprecated": false,
          "latest_version": "1.0.2",
          "repository_url": "https://github.com/faapi/faapi",
          "versions_count": 28,
          "total_downloads": null,
          "dependents_count": null,
          "deprecation_note": null,
          "maintainers_count": 1,
          "monthly_downloads": 3085,
          "first_published_at": "2026-06-29T17:24:50.959000Z",
          "latest_published_at": "2026-07-19T04:56:01.844000Z",
          "latest_version_yanked": null,
          "days_since_latest_publish": 5
        },
        {
          "name": "@faapi/faapi",
          "exists": true,
          "license": "MIT",
          "keywords": [
            "api",
            "framework",
            "typescript",
            "nodejs",
            "middleware",
            "ast",
            "function-as-api"
          ],
          "ecosystem": "npm",
          "matches_repo": true,
          "registry_url": "https://www.npmjs.com/package/@faapi/faapi",
          "is_deprecated": false,
          "latest_version": "1.0.2",
          "repository_url": "https://github.com/faapi/faapi",
          "versions_count": 29,
          "total_downloads": null,
          "dependents_count": null,
          "deprecation_note": null,
          "maintainers_count": 1,
          "monthly_downloads": 4176,
          "first_published_at": "2026-06-28T07:38:34.880000Z",
          "latest_published_at": "2026-07-19T04:56:02.602000Z",
          "latest_version_yanked": null,
          "days_since_latest_publish": 5
        },
        {
          "name": "@faapi/schema",
          "exists": true,
          "license": "MIT",
          "keywords": [],
          "ecosystem": "npm",
          "matches_repo": true,
          "registry_url": "https://www.npmjs.com/package/@faapi/schema",
          "is_deprecated": false,
          "latest_version": "1.0.2",
          "repository_url": "https://github.com/faapi/faapi",
          "versions_count": 28,
          "total_downloads": null,
          "dependents_count": null,
          "deprecation_note": null,
          "maintainers_count": 1,
          "monthly_downloads": 3120,
          "first_published_at": "2026-06-28T07:28:25.544000Z",
          "latest_published_at": "2026-07-19T04:56:01.833000Z",
          "latest_version_yanked": null,
          "days_since_latest_publish": 5
        }
      ]
    },
    "popularity": {
      "forks": 0,
      "stars": 0,
      "watchers": 0,
      "fork_history": {
        "days": [],
        "complete": true,
        "collected": 0,
        "total_forks": 0
      },
      "star_history": {
        "days": [],
        "complete": true,
        "collected": 0,
        "total_stars": 0,
        "collected_at": null
      },
      "open_issues_and_prs": 0
    },
    "ai_readiness": {
      "has_nix": false,
      "example_dirs": [],
      "has_llms_txt": false,
      "has_dockerfile": false,
      "has_mcp_signal": false,
      "bootstrap_files": [],
      "api_schema_files": [],
      "has_devcontainer": false,
      "typecheck_configs": [
        "packages/faapi/fixtures/api-alias/tsconfig.json",
        "packages/faapi/tsconfig.json",
        "packages/mcp/tsconfig.json",
        "packages/next/fixtures/with-nextjs/tsconfig.json",
        "packages/next/tsconfig.json",
        "packages/schema/tsconfig.json"
      ],
      "toolchain_manifests": [],
      "largest_source_bytes": 103924,
      "source_files_sampled": 218,
      "oversized_source_files": 1,
      "agent_instruction_files": [
        "AGENTS.md"
      ],
      "agent_instruction_max_bytes": 36840
    },
    "dependencies": {
      "manifests": [
        "package.json"
      ],
      "advisories": {
        "error": null,
        "scope": "published_package",
        "source": "osv",
        "findings": [],
        "collected": true,
        "malicious": [],
        "truncated": false,
        "by_severity": {},
        "advisory_count": 0,
        "affected_count": 0,
        "assessed_count": 47,
        "malicious_count": 0,
        "assessed_package": "npm:@faapi/faapi@1.0.2",
        "unassessed_count": 0,
        "direct_affected_count": 0
      },
      "ecosystems": [
        "npm"
      ],
      "dependencies": [
        {
          "name": "esbuild",
          "manifest": "packages/faapi/package.json",
          "ecosystem": "npm",
          "version_constraint": "^0.25.0"
        },
        {
          "name": "fast-glob",
          "manifest": "packages/faapi/package.json",
          "ecosystem": "npm",
          "version_constraint": "^3.3.3"
        },
        {
          "name": "typescript",
          "manifest": "packages/faapi/package.json",
          "ecosystem": "npm",
          "version_constraint": "^5.7.0"
        },
        {
          "name": "ws",
          "manifest": "packages/faapi/package.json",
          "ecosystem": "npm",
          "version_constraint": "^8.21.0"
        }
      ],
      "all_dependencies": {
        "error": "GitHub dependency-graph SBOM unavailable (404); the dependency graph may be disabled for this repository",
        "source": null,
        "packages": [],
        "collected": false,
        "truncated": false,
        "total_count": null,
        "direct_count": null,
        "indirect_count": null
      }
    },
    "maintainership": {
      "issues": {
        "open_prs": 0,
        "merged_prs": 0,
        "open_issues": 0,
        "closed_ratio": null,
        "closed_issues": 0,
        "closed_unmerged_prs": 0
      },
      "bus_factor": 1,
      "bot_contributors": 0,
      "top_contributors": [
        {
          "type": "User",
          "login": "faapi",
          "commits": 36,
          "avatar_url": "https://avatars.githubusercontent.com/u/26213241?v=4"
        }
      ],
      "contributors_sampled": 1,
      "top_contributor_share": 1
    },
    "quality_signals": {
      "has_ci": true,
      "has_tests": true,
      "ci_workflows": [
        "ci.yml",
        "release.yml"
      ],
      "has_docs_dir": false,
      "linter_configs": [
        "eslint.config.js"
      ],
      "has_editorconfig": true,
      "has_linter_config": true,
      "has_precommit_config": false
    },
    "security_signals": {
      "lockfiles": [
        "pnpm-lock.yaml"
      ],
      "scorecard": {
        "checks": [
          {
            "name": "Binary-Artifacts",
            "score": 10,
            "reason": "no binaries found in the repo",
            "documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#binary-artifacts"
          },
          {
            "name": "Branch-Protection",
            "score": 0,
            "reason": "branch protection not enabled on development/release branches",
            "documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#branch-protection"
          },
          {
            "name": "CI-Tests",
            "score": null,
            "reason": "no pull request found",
            "documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#ci-tests"
          },
          {
            "name": "CII-Best-Practices",
            "score": 0,
            "reason": "no effort to earn an OpenSSF best practices badge detected",
            "documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#cii-best-practices"
          },
          {
            "name": "Code-Review",
            "score": 0,
            "reason": "Found 0/30 approved changesets -- score normalized to 0",
            "documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#code-review"
          },
          {
            "name": "Contributors",
            "score": 0,
            "reason": "project has 0 contributing companies or organizations -- score normalized to 0",
            "documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#contributors"
          },
          {
            "name": "Dangerous-Workflow",
            "score": 10,
            "reason": "no dangerous workflow patterns detected",
            "documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#dangerous-workflow"
          },
          {
            "name": "Dependency-Update-Tool",
            "score": 0,
            "reason": "no update tool detected",
            "documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#dependency-update-tool"
          },
          {
            "name": "Fuzzing",
            "score": 0,
            "reason": "project is not fuzzed",
            "documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#fuzzing"
          },
          {
            "name": "License",
            "score": 10,
            "reason": "license file detected",
            "documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#license"
          },
          {
            "name": "Maintained",
            "score": 0,
            "reason": "project was created within the last 90 days. Please review its contents carefully",
            "documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#maintained"
          },
          {
            "name": "Packaging",
            "score": 10,
            "reason": "packaging workflow detected",
            "documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#packaging"
          },
          {
            "name": "Pinned-Dependencies",
            "score": 0,
            "reason": "dependency not pinned by hash detected -- score normalized to 0",
            "documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#pinned-dependencies"
          },
          {
            "name": "SAST",
            "score": 0,
            "reason": "no SAST tool detected",
            "documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#sast"
          },
          {
            "name": "Security-Policy",
            "score": 0,
            "reason": "security policy file not detected",
            "documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#security-policy"
          },
          {
            "name": "Signed-Releases",
            "score": null,
            "reason": "no releases found",
            "documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#signed-releases"
          },
          {
            "name": "Token-Permissions",
            "score": 0,
            "reason": "detected GitHub workflow tokens with excessive permissions",
            "documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#token-permissions"
          },
          {
            "name": "Vulnerabilities",
            "score": 0,
            "reason": "21 existing vulnerabilities detected",
            "documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#vulnerabilities"
          }
        ],
        "commit": "d22d5d3ff97b8d33f801e1350e43c843c8d9a10c",
        "ran_at": "2026-07-25T02:31:31Z",
        "aggregate_score": 2.6,
        "scorecard_version": "v5.5.0"
      },
      "has_codeql_workflow": false,
      "has_security_policy": false,
      "has_dependabot_config": false
    },
    "contribution_flow": {
      "collected": true,
      "ci_last_run_at": "2026-07-19T04:56:07Z",
      "oldest_open_prs": [],
      "last_merged_pr_at": null,
      "ci_last_conclusion": "SUCCESS",
      "oldest_open_issues": []
    }
  },
  "config": {
    "disabled_metrics": [],
    "disabled_categories": [],
    "disabled_components": {}
  },
  "source": {
    "url": "https://github.com/faapi/faapi",
    "host": "github.com",
    "name": "faapi",
    "owner": "faapi"
  },
  "metrics": {
    "overall": {
      "key": "overall",
      "band": "at_risk",
      "name": "Overall health",
      "note": null,
      "notes": [],
      "value": 48,
      "inputs": {
        "security": 41,
        "vitality": 68,
        "community": 35,
        "governance": 32,
        "engineering": 65
      },
      "components": []
    },
    "categories": [
      {
        "key": "vitality",
        "band": "moderate",
        "name": "Vitality",
        "value": 68,
        "weight": 0.22,
        "metrics": [
          {
            "key": "development_activity",
            "band": "moderate",
            "name": "Development activity",
            "note": null,
            "notes": [],
            "value": 54,
            "inputs": {
              "commits_last_year": 36,
              "human_commit_share": 1,
              "days_since_last_push": 5,
              "active_weeks_last_year": 5
            },
            "components": [
              {
                "key": "push_recency",
                "name": "Push recency",
                "detail": "last push 5 days ago",
                "points": 36,
                "status": "met",
                "details": [
                  {
                    "code": "push_recency",
                    "params": {
                      "days": 5
                    }
                  }
                ],
                "max_points": 36
              },
              {
                "key": "commit_cadence",
                "name": "Commit cadence",
                "detail": "5/52 weeks with commits",
                "points": 3.5,
                "status": "partial",
                "details": [
                  {
                    "code": "commit_cadence_weeks",
                    "params": {
                      "weeks": 5
                    }
                  }
                ],
                "max_points": 36
              },
              {
                "key": "commit_volume",
                "name": "Commit volume",
                "detail": "36 commits in the last year",
                "points": 14.1,
                "status": "partial",
                "details": [
                  {
                    "code": "commits_last_year",
                    "params": {
                      "count": 36
                    }
                  }
                ],
                "max_points": 18
              },
              {
                "key": "openssf_scorecard_maintained",
                "name": "OpenSSF Scorecard: Maintained",
                "detail": "project was created within the last 90 days. Please review its contents carefully",
                "points": 0,
                "status": "missed",
                "details": [],
                "max_points": 10
              }
            ]
          },
          {
            "key": "release_discipline",
            "band": "excellent",
            "name": "Release discipline",
            "note": "Excluded from scoring (no data or not applicable): OpenSSF Scorecard: Signed-Releases. Remaining weights renormalized.",
            "notes": [
              {
                "code": "excluded_no_data",
                "params": {
                  "components": [
                    "openssf_scorecard_signed_releases"
                  ]
                }
              },
              {
                "code": "weights_renormalized",
                "params": {}
              }
            ],
            "value": 88,
            "inputs": {
              "releases_count": 3,
              "latest_release_tag": "v1.0.2",
              "releases_from_tags": true,
              "days_since_latest_release": 5,
              "mean_days_between_releases": 3.3
            },
            "components": [
              {
                "key": "ships_releases",
                "name": "Ships releases",
                "detail": "3 version tags (no GitHub releases)",
                "points": 16.2,
                "status": "partial",
                "details": [
                  {
                    "code": "version_tags_no_releases",
                    "params": {
                      "count": 3
                    }
                  }
                ],
                "max_points": 27
              },
              {
                "key": "release_recency",
                "name": "Release recency",
                "detail": "latest release 5 days ago",
                "points": 36,
                "status": "met",
                "details": [
                  {
                    "code": "release_recency",
                    "params": {
                      "days": 5
                    }
                  }
                ],
                "max_points": 36
              },
              {
                "key": "release_cadence",
                "name": "Release cadence",
                "detail": "a release every ~3.3 days",
                "points": 27,
                "status": "met",
                "details": [
                  {
                    "code": "release_cadence",
                    "params": {
                      "gap": 3.3
                    }
                  }
                ],
                "max_points": 27
              },
              {
                "key": "openssf_scorecard_signed_releases",
                "name": "OpenSSF Scorecard: Signed-Releases",
                "detail": "no releases found",
                "points": 0,
                "status": "excluded",
                "details": [
                  {
                    "code": "no_data",
                    "params": {}
                  }
                ],
                "max_points": 10
              }
            ]
          },
          {
            "key": "abandonment",
            "band": "excellent",
            "name": "Abandonment",
            "note": null,
            "notes": [],
            "value": 100,
            "inputs": {
              "cap": null,
              "state": "unverified",
              "guards": [],
              "signals": [],
              "red_flag": false,
              "multiplier_pct": 100,
              "declared_reason": null,
              "unverified_reason": "repository_too_young",
              "unanswered_open_prs": null,
              "unanswered_open_issues": null,
              "days_since_last_merged_pr": null,
              "days_since_last_human_commit": null,
              "days_since_last_human_commit_is_floor": false
            },
            "components": [
              {
                "key": "project_is_still_maintained",
                "name": "Project is still maintained",
                "detail": "maintenance record not established from the collected data",
                "points": 100,
                "status": "met",
                "details": [
                  {
                    "code": "abandonment_unverified",
                    "params": {}
                  }
                ],
                "max_points": 100
              }
            ]
          }
        ],
        "description": "Is the project alive — is code being written and are releases shipping?"
      },
      {
        "key": "community",
        "band": "at_risk",
        "name": "Community & Adoption",
        "value": 35,
        "weight": 0.18,
        "metrics": [
          {
            "key": "popularity",
            "band": "critical",
            "name": "Popularity & adoption",
            "note": null,
            "notes": [],
            "value": 1,
            "inputs": {
              "forks": 0,
              "stars": 0,
              "watchers": 0,
              "growth_state": "unverified",
              "growth_factor_pct": 100,
              "growth_unverified_reason": "no_history"
            },
            "components": [
              {
                "key": "stars",
                "name": "Stars",
                "detail": "0 stars",
                "points": 0,
                "status": "missed",
                "details": [
                  {
                    "code": "stars",
                    "params": {
                      "count": 0
                    }
                  }
                ],
                "max_points": 60
              },
              {
                "key": "forks",
                "name": "Forks",
                "detail": "0 forks",
                "points": 0,
                "status": "missed",
                "details": [
                  {
                    "code": "forks",
                    "params": {
                      "count": 0
                    }
                  }
                ],
                "max_points": 25
              },
              {
                "key": "watchers",
                "name": "Watchers",
                "detail": "0 watchers",
                "points": 0,
                "status": "missed",
                "details": [
                  {
                    "code": "watchers",
                    "params": {
                      "count": 0
                    }
                  }
                ],
                "max_points": 15
              }
            ]
          },
          {
            "key": "community_health",
            "band": "moderate",
            "name": "Community health",
            "note": null,
            "notes": [],
            "value": 50,
            "inputs": {
              "has_readme": true,
              "has_license": true,
              "has_contributing": false,
              "has_issue_template": false,
              "has_code_of_conduct": false,
              "has_pull_request_template": false
            },
            "components": [
              {
                "key": "readme",
                "name": "README",
                "detail": null,
                "points": 22.5,
                "status": "met",
                "details": [],
                "max_points": 22.5
              },
              {
                "key": "license",
                "name": "License",
                "detail": "recognized license (MIT)",
                "points": 22.5,
                "status": "met",
                "details": [
                  {
                    "code": "license_standard",
                    "params": {}
                  },
                  {
                    "code": "license_spdx",
                    "params": {
                      "spdx": "MIT"
                    }
                  }
                ],
                "max_points": 22.5
              },
              {
                "key": "contributing_guide",
                "name": "CONTRIBUTING guide",
                "detail": null,
                "points": 0,
                "status": "missed",
                "details": [],
                "max_points": 18
              },
              {
                "key": "code_of_conduct",
                "name": "Code of conduct",
                "detail": null,
                "points": 0,
                "status": "missed",
                "details": [],
                "max_points": 13.5
              },
              {
                "key": "issue_template",
                "name": "Issue template",
                "detail": null,
                "points": 0,
                "status": "missed",
                "details": [],
                "max_points": 7.2
              },
              {
                "key": "pr_template",
                "name": "PR template",
                "detail": null,
                "points": 0,
                "status": "missed",
                "details": [],
                "max_points": 6.3
              }
            ]
          },
          {
            "key": "ecosystem_adoption",
            "band": "moderate",
            "name": "Ecosystem adoption (downloads)",
            "note": "Excluded from scoring (no data or not applicable): Registry dependents. Remaining weights renormalized.",
            "notes": [
              {
                "code": "excluded_no_data",
                "params": {
                  "components": [
                    "registry_dependents"
                  ]
                }
              },
              {
                "code": "weights_renormalized",
                "params": {}
              }
            ],
            "value": 68,
            "inputs": {
              "packages": [
                "@faapi/mcp",
                "@faapi/next",
                "@faapi/faapi",
                "@faapi/schema"
              ],
              "dependents": null,
              "ecosystems": "npm",
              "total_downloads": null,
              "monthly_downloads": 12172
            },
            "components": [
              {
                "key": "monthly_downloads",
                "name": "Monthly downloads",
                "detail": "12,172 downloads/month across npm",
                "points": 54.5,
                "status": "partial",
                "details": [
                  {
                    "code": "downloads_monthly",
                    "params": {
                      "count": 12172,
                      "ecosystems": "npm"
                    }
                  }
                ],
                "max_points": 80
              },
              {
                "key": "registry_dependents",
                "name": "Registry dependents",
                "detail": "not reported by this ecosystem",
                "points": 0,
                "status": "excluded",
                "details": [
                  {
                    "code": "not_reported_by_this_ecosystem",
                    "params": {}
                  }
                ],
                "max_points": 20
              }
            ]
          }
        ],
        "description": "Does the project have users, downloads, attention, and a welcoming setup for contributors?"
      },
      {
        "key": "governance",
        "band": "at_risk",
        "name": "Sustainability & Governance",
        "value": 32,
        "weight": 0.24,
        "metrics": [
          {
            "key": "maintainer_resilience",
            "band": "critical",
            "name": "Maintainer resilience (bus factor)",
            "note": null,
            "notes": [],
            "value": 10,
            "inputs": {
              "bus_factor": 1,
              "contributors_sampled": 1,
              "top_contributor_share": 1
            },
            "components": [
              {
                "key": "bus_factor",
                "name": "Bus factor",
                "detail": "1 contributor(s) cover half of all commits",
                "points": 9,
                "status": "partial",
                "details": [
                  {
                    "code": "bus_factor",
                    "params": {
                      "count": 1
                    }
                  }
                ],
                "max_points": 54
              },
              {
                "key": "commit_distribution",
                "name": "Commit distribution",
                "detail": "top contributor authored 100% of commits",
                "points": 0,
                "status": "missed",
                "details": [
                  {
                    "code": "top_contributor_share",
                    "params": {
                      "share": 100
                    }
                  }
                ],
                "max_points": 22.5
              },
              {
                "key": "contributor_breadth",
                "name": "Contributor breadth",
                "detail": "1 contributors",
                "points": 1.4,
                "status": "partial",
                "details": [
                  {
                    "code": "contributors_sampled",
                    "params": {
                      "count": 1
                    }
                  }
                ],
                "max_points": 13.5
              },
              {
                "key": "openssf_scorecard_contributors",
                "name": "OpenSSF Scorecard: Contributors",
                "detail": "project has 0 contributing companies or organizations -- score normalized to 0",
                "points": 0,
                "status": "missed",
                "details": [],
                "max_points": 10
              }
            ]
          },
          {
            "key": "responsiveness",
            "band": "critical",
            "name": "Issue & PR responsiveness",
            "note": "Excluded from scoring (no data or not applicable): Issue resolution, PR acceptance. Remaining weights renormalized.",
            "notes": [
              {
                "code": "excluded_no_data",
                "params": {
                  "components": [
                    "issue_resolution",
                    "pr_acceptance"
                  ]
                }
              },
              {
                "code": "weights_renormalized",
                "params": {}
              }
            ],
            "value": 1,
            "inputs": {
              "merged_prs": 0,
              "open_issues": 0,
              "closed_issues": 0,
              "issue_closed_ratio": null,
              "closed_unmerged_prs": 0
            },
            "components": [
              {
                "key": "issue_resolution",
                "name": "Issue resolution",
                "detail": "no issues or no data",
                "points": 0,
                "status": "excluded",
                "details": [
                  {
                    "code": "no_issues_or_data",
                    "params": {}
                  }
                ],
                "max_points": 46.75
              },
              {
                "key": "pr_acceptance",
                "name": "PR acceptance",
                "detail": "no decided pull requests or no data",
                "points": 0,
                "status": "excluded",
                "details": [
                  {
                    "code": "no_decided_prs_or_data",
                    "params": {}
                  }
                ],
                "max_points": 38.25
              },
              {
                "key": "openssf_scorecard_code_review",
                "name": "OpenSSF Scorecard: Code-Review",
                "detail": "Found 0/30 approved changesets -- score normalized to 0",
                "points": 0,
                "status": "missed",
                "details": [],
                "max_points": 15
              }
            ]
          },
          {
            "key": "stewardship",
            "band": "at_risk",
            "name": "Ownership & stewardship",
            "note": "Excluded from scoring (no data or not applicable): Verified domain. Remaining weights renormalized.",
            "notes": [
              {
                "code": "excluded_no_data",
                "params": {
                  "components": [
                    "verified_domain"
                  ]
                }
              },
              {
                "code": "weights_renormalized",
                "params": {}
              }
            ],
            "value": 33,
            "inputs": {
              "followers": 1,
              "owner_type": "User",
              "is_verified": null,
              "owner_login": "faapi",
              "public_repos": 1,
              "account_age_days": 3427
            },
            "components": [
              {
                "key": "ownership_backing",
                "name": "Ownership backing",
                "detail": "personal (user) account",
                "points": 10,
                "status": "partial",
                "details": [
                  {
                    "code": "owner_personal",
                    "params": {}
                  }
                ],
                "max_points": 30
              },
              {
                "key": "verified_domain",
                "name": "Verified domain",
                "detail": "not applicable to user accounts",
                "points": 0,
                "status": "excluded",
                "details": [
                  {
                    "code": "not_applicable_to_user_accounts",
                    "params": {}
                  }
                ],
                "max_points": 20
              },
              {
                "key": "owner_reach",
                "name": "Owner reach",
                "detail": "1 followers of faapi",
                "points": 2.2,
                "status": "partial",
                "details": [
                  {
                    "code": "owner_followers",
                    "params": {
                      "count": 1,
                      "login": "faapi"
                    }
                  }
                ],
                "max_points": 25
              },
              {
                "key": "track_record",
                "name": "Track record",
                "detail": "1 public repos, account ~9 yr old",
                "points": 14.2,
                "status": "partial",
                "details": [
                  {
                    "code": "public_repos",
                    "params": {
                      "count": 1
                    }
                  },
                  {
                    "code": "account_age_years",
                    "params": {
                      "years": 9
                    }
                  }
                ],
                "max_points": 25
              }
            ]
          },
          {
            "key": "package_maintenance",
            "band": "excellent",
            "name": "Package maintenance",
            "note": null,
            "notes": [],
            "value": 100,
            "inputs": {
              "packages": [
                "@faapi/mcp",
                "@faapi/next",
                "@faapi/faapi",
                "@faapi/schema"
              ],
              "ecosystems": "npm",
              "any_deprecated": false,
              "min_days_since_publish": 5
            },
            "components": [
              {
                "key": "published_resolvable",
                "name": "Published & resolvable",
                "detail": "4 package(s) on npm",
                "points": 25,
                "status": "met",
                "details": [
                  {
                    "code": "packages_published",
                    "params": {
                      "count": 4,
                      "ecosystems": "npm"
                    }
                  }
                ],
                "max_points": 25
              },
              {
                "key": "publish_recency",
                "name": "Publish recency",
                "detail": "latest publish 5 days ago",
                "points": 35,
                "status": "met",
                "details": [
                  {
                    "code": "publish_recency",
                    "params": {
                      "days": 5
                    }
                  }
                ],
                "max_points": 35
              },
              {
                "key": "version_history",
                "name": "Version history",
                "detail": "29 published versions",
                "points": 20,
                "status": "met",
                "details": [
                  {
                    "code": "published_versions",
                    "params": {
                      "count": 29
                    }
                  }
                ],
                "max_points": 20
              },
              {
                "key": "not_deprecated",
                "name": "Not deprecated",
                "detail": "active, not deprecated or yanked",
                "points": 20,
                "status": "met",
                "details": [
                  {
                    "code": "package_not_deprecated",
                    "params": {}
                  }
                ],
                "max_points": 20
              }
            ]
          }
        ],
        "description": "Will the project survive its people — bus factor, responsiveness, who backs it, and package upkeep?"
      },
      {
        "key": "engineering",
        "band": "moderate",
        "name": "Engineering Quality",
        "value": 65,
        "weight": 0.2,
        "metrics": [
          {
            "key": "engineering_practices",
            "band": "excellent",
            "name": "Engineering practices",
            "note": "Excluded from scoring (no data or not applicable): OpenSSF Scorecard: CI-Tests. Remaining weights renormalized.",
            "notes": [
              {
                "code": "excluded_no_data",
                "params": {
                  "components": [
                    "openssf_scorecard_ci_tests"
                  ]
                }
              },
              {
                "code": "weights_renormalized",
                "params": {}
              }
            ],
            "value": 88,
            "inputs": {
              "has_ci": true,
              "has_tests": true,
              "has_editorconfig": true,
              "has_linter_config": true,
              "has_precommit_config": false
            },
            "components": [
              {
                "key": "ci_workflows",
                "name": "CI workflows",
                "detail": "2 workflow(s)",
                "points": 24,
                "status": "met",
                "details": [
                  {
                    "code": "ci_workflows",
                    "params": {
                      "count": 2
                    }
                  }
                ],
                "max_points": 24
              },
              {
                "key": "tests_present",
                "name": "Tests present",
                "detail": null,
                "points": 24,
                "status": "met",
                "details": [],
                "max_points": 24
              },
              {
                "key": "linter_config",
                "name": "Linter config",
                "detail": "eslint.config.js",
                "points": 16,
                "status": "met",
                "details": [
                  {
                    "code": "file_list",
                    "params": {
                      "files": "eslint.config.js"
                    }
                  }
                ],
                "max_points": 16
              },
              {
                "key": "pre_commit_hooks",
                "name": "Pre-commit hooks",
                "detail": null,
                "points": 0,
                "status": "missed",
                "details": [],
                "max_points": 9.6
              },
              {
                "key": "editorconfig",
                "name": ".editorconfig",
                "detail": null,
                "points": 6.4,
                "status": "met",
                "details": [],
                "max_points": 6.4
              },
              {
                "key": "openssf_scorecard_ci_tests",
                "name": "OpenSSF Scorecard: CI-Tests",
                "detail": "no pull request found",
                "points": 0,
                "status": "excluded",
                "details": [
                  {
                    "code": "no_data",
                    "params": {}
                  }
                ],
                "max_points": 20
              }
            ]
          },
          {
            "key": "documentation",
            "band": "at_risk",
            "name": "Documentation",
            "note": null,
            "notes": [],
            "value": 30,
            "inputs": {
              "topics": [],
              "has_wiki": false,
              "homepage": null,
              "has_readme": true,
              "has_docs_dir": false,
              "has_description": false
            },
            "components": [
              {
                "key": "readme",
                "name": "README",
                "detail": null,
                "points": 30,
                "status": "met",
                "details": [],
                "max_points": 30
              },
              {
                "key": "documentation_directory",
                "name": "Documentation directory",
                "detail": null,
                "points": 0,
                "status": "missed",
                "details": [],
                "max_points": 25
              },
              {
                "key": "documentation_homepage_site",
                "name": "Documentation / homepage site",
                "detail": null,
                "points": 0,
                "status": "missed",
                "details": [],
                "max_points": 15
              },
              {
                "key": "repository_description",
                "name": "Repository description",
                "detail": null,
                "points": 0,
                "status": "missed",
                "details": [],
                "max_points": 10
              },
              {
                "key": "topics",
                "name": "Topics",
                "detail": null,
                "points": 0,
                "status": "missed",
                "details": [],
                "max_points": 10
              },
              {
                "key": "wiki",
                "name": "Wiki",
                "detail": null,
                "points": 0,
                "status": "missed",
                "details": [],
                "max_points": 10
              }
            ]
          }
        ],
        "description": "Are baseline engineering and documentation practices in place?"
      },
      {
        "key": "security",
        "band": "at_risk",
        "name": "Security",
        "value": 41,
        "weight": 0.16,
        "metrics": [
          {
            "key": "security_posture",
            "band": "critical",
            "name": "Security posture",
            "note": "Excluded from scoring (no data or not applicable): CI-Tests, Signed-Releases. Remaining weights renormalized.",
            "notes": [
              {
                "code": "excluded_no_data",
                "params": {
                  "components": [
                    "ci_tests",
                    "signed_releases"
                  ]
                }
              },
              {
                "code": "weights_renormalized",
                "params": {}
              }
            ],
            "value": 26,
            "inputs": {
              "source": "openssf_scorecard",
              "checks_evaluated": 16,
              "scorecard_version": "v5.5.0",
              "checks_inconclusive": 2,
              "scorecard_aggregate": 2.6
            },
            "components": [
              {
                "key": "binary_artifacts",
                "name": "Binary-Artifacts",
                "detail": "no binaries found in the repo",
                "points": 7.5,
                "status": "met",
                "details": [],
                "max_points": 7.5
              },
              {
                "key": "branch_protection",
                "name": "Branch-Protection",
                "detail": "branch protection not enabled on development/release branches",
                "points": 0,
                "status": "missed",
                "details": [],
                "max_points": 7.5
              },
              {
                "key": "ci_tests",
                "name": "CI-Tests",
                "detail": "no pull request found",
                "points": 0,
                "status": "excluded",
                "details": [
                  {
                    "code": "no_data",
                    "params": {}
                  }
                ],
                "max_points": 2.5
              },
              {
                "key": "cii_best_practices",
                "name": "CII-Best-Practices",
                "detail": "no effort to earn an OpenSSF best practices badge detected",
                "points": 0,
                "status": "missed",
                "details": [],
                "max_points": 2.5
              },
              {
                "key": "code_review",
                "name": "Code-Review",
                "detail": "Found 0/30 approved changesets -- score normalized to 0",
                "points": 0,
                "status": "missed",
                "details": [],
                "max_points": 7.5
              },
              {
                "key": "contributors",
                "name": "Contributors",
                "detail": "project has 0 contributing companies or organizations -- score normalized to 0",
                "points": 0,
                "status": "missed",
                "details": [],
                "max_points": 2.5
              },
              {
                "key": "dangerous_workflow",
                "name": "Dangerous-Workflow",
                "detail": "no dangerous workflow patterns detected",
                "points": 10,
                "status": "met",
                "details": [],
                "max_points": 10
              },
              {
                "key": "dependency_update_tool",
                "name": "Dependency-Update-Tool",
                "detail": "no update tool detected",
                "points": 0,
                "status": "missed",
                "details": [],
                "max_points": 7.5
              },
              {
                "key": "fuzzing",
                "name": "Fuzzing",
                "detail": "project is not fuzzed",
                "points": 0,
                "status": "missed",
                "details": [],
                "max_points": 5
              },
              {
                "key": "license",
                "name": "License",
                "detail": "license file detected",
                "points": 2.5,
                "status": "met",
                "details": [],
                "max_points": 2.5
              },
              {
                "key": "maintained",
                "name": "Maintained",
                "detail": "project was created within the last 90 days. Please review its contents carefully",
                "points": 0,
                "status": "missed",
                "details": [],
                "max_points": 7.5
              },
              {
                "key": "packaging",
                "name": "Packaging",
                "detail": "packaging workflow detected",
                "points": 5,
                "status": "met",
                "details": [],
                "max_points": 5
              },
              {
                "key": "pinned_dependencies",
                "name": "Pinned-Dependencies",
                "detail": "dependency not pinned by hash detected -- score normalized to 0",
                "points": 0,
                "status": "missed",
                "details": [],
                "max_points": 5
              },
              {
                "key": "sast",
                "name": "SAST",
                "detail": "no SAST tool detected",
                "points": 0,
                "status": "missed",
                "details": [],
                "max_points": 5
              },
              {
                "key": "security_policy",
                "name": "Security-Policy",
                "detail": "security policy file not detected",
                "points": 0,
                "status": "missed",
                "details": [],
                "max_points": 5
              },
              {
                "key": "signed_releases",
                "name": "Signed-Releases",
                "detail": "no releases found",
                "points": 0,
                "status": "excluded",
                "details": [
                  {
                    "code": "no_data",
                    "params": {}
                  }
                ],
                "max_points": 7.5
              },
              {
                "key": "token_permissions",
                "name": "Token-Permissions",
                "detail": "detected GitHub workflow tokens with excessive permissions",
                "points": 0,
                "status": "missed",
                "details": [],
                "max_points": 7.5
              },
              {
                "key": "vulnerabilities",
                "name": "Vulnerabilities",
                "detail": "21 existing vulnerabilities detected",
                "points": 0,
                "status": "missed",
                "details": [],
                "max_points": 7.5
              }
            ]
          },
          {
            "key": "dependency_advisories",
            "band": "excellent",
            "name": "Dependency advisories",
            "note": "Excluded from scoring (no data or not applicable): No advisories left outstanding. Remaining weights renormalized. Matched the npm:@faapi/faapi@1.0.2 runtime dependency closure — what installing the published package pulls in — 47 packages. Reachability is not analyzed.",
            "notes": [
              {
                "code": "excluded_no_data",
                "params": {
                  "components": [
                    "no_advisories_left_outstanding"
                  ]
                }
              },
              {
                "code": "weights_renormalized",
                "params": {}
              },
              {
                "code": "advisories_scope_published",
                "params": {
                  "package": "npm:@faapi/faapi@1.0.2",
                  "assessed": 47
                }
              },
              {
                "code": "advisories_reachability",
                "params": {}
              }
            ],
            "value": 100,
            "inputs": {
              "source": "osv",
              "advisories": 0,
              "affected_packages": 0,
              "assessed_packages": 47,
              "unassessed_packages": 0,
              "affected_by_severity": "none",
              "direct_affected_packages": 0
            },
            "components": [
              {
                "key": "direct_dependencies_free_of_known_advisories",
                "name": "Direct dependencies free of known advisories",
                "detail": "no direct dependency carries a known advisory",
                "points": 35,
                "status": "met",
                "details": [
                  {
                    "code": "no_direct_advisories",
                    "params": {}
                  }
                ],
                "max_points": 35
              },
              {
                "key": "indirect_dependencies_free_of_known_advisories",
                "name": "Indirect dependencies free of known advisories",
                "detail": "no indirect dependency carries a known advisory",
                "points": 25,
                "status": "met",
                "details": [
                  {
                    "code": "no_indirect_advisories",
                    "params": {}
                  }
                ],
                "max_points": 25
              },
              {
                "key": "no_advisories_left_outstanding",
                "name": "No advisories left outstanding",
                "detail": "no advisory carries a publication date",
                "points": 0,
                "status": "excluded",
                "details": [
                  {
                    "code": "advisories_no_publication_date",
                    "params": {}
                  }
                ],
                "max_points": 40
              }
            ]
          },
          {
            "key": "malicious_dependencies",
            "band": "excellent",
            "name": "Malicious dependencies",
            "note": null,
            "notes": [],
            "value": 100,
            "inputs": {
              "source": "osv",
              "meaning": "reported as a malicious package by the OpenSSF corpus; the remedy is removal or moving off the compromised name, never an upgrade of the same artifact. Versions the registry has since pulled are listed but not scored",
              "packages": [],
              "red_flag": false,
              "assessed_packages": 47,
              "malicious_packages": 0,
              "direct_malicious_packages": 0,
              "withdrawn_malicious_packages": 0,
              "installable_malicious_packages": 0
            },
            "components": [
              {
                "key": "no_dependency_reported_as_a_malicious_package",
                "name": "No dependency reported as a malicious package",
                "detail": "no dependency is reported as a malicious package",
                "points": 100,
                "status": "met",
                "details": [
                  {
                    "code": "no_malicious_dependencies",
                    "params": {}
                  }
                ],
                "max_points": 100
              }
            ]
          },
          {
            "key": "high_risk_jurisdiction_exposure",
            "band": "excellent",
            "name": "High-Risk Jurisdiction Exposure",
            "note": "Only high-confidence self-published location evidence affects this multiplier. Ambiguous matches are review-only; country evidence is not proof of nationality, citizenship, legal registration, malicious intent, or sanctions status.",
            "notes": [
              {
                "code": "jurisdiction_evidence_limits",
                "params": {}
              }
            ],
            "value": 100,
            "inputs": {
              "meaning": "self-published location evidence; not nationality or citizenship",
              "red_flag": false,
              "exposures": [],
              "policy_countries": [
                "Russia",
                "Iran",
                "North Korea"
              ],
              "review_only_matches": 0,
              "assessed_self_published_locations": 2
            },
            "components": [
              {
                "key": "policy_exposure_multiplier",
                "name": "Policy exposure multiplier",
                "detail": "no confirmed policy-scope location match",
                "points": 100,
                "status": "met",
                "details": [
                  {
                    "code": "jurisdiction_no_match",
                    "params": {}
                  }
                ],
                "max_points": 100
              }
            ]
          }
        ],
        "description": "Are visible security and supply-chain practices strong, with no malicious dependency and no unresolved high-risk jurisdiction exposure?"
      },
      {
        "key": "ai_readiness",
        "band": "good",
        "name": "AI Readiness",
        "value": 73,
        "weight": 0,
        "metrics": [
          {
            "key": "ai_agent_context",
            "band": "excellent",
            "name": "Agent context & guidance",
            "note": null,
            "notes": [],
            "value": 85,
            "inputs": {
              "has_llms_txt": false,
              "legible_history_share": 1,
              "agent_instruction_files": [
                "AGENTS.md"
              ],
              "agent_instruction_max_bytes": 36840
            },
            "components": [
              {
                "key": "agent_instructions",
                "name": "Agent instructions",
                "detail": "AGENTS.md",
                "points": 45,
                "status": "met",
                "details": [
                  {
                    "code": "file_list",
                    "params": {
                      "files": "AGENTS.md"
                    }
                  }
                ],
                "max_points": 45
              },
              {
                "key": "machine_readable_docs_llms_txt",
                "name": "Machine-readable docs (llms.txt)",
                "detail": null,
                "points": 0,
                "status": "missed",
                "details": [],
                "max_points": 15
              },
              {
                "key": "legible_commit_history",
                "name": "Legible commit history",
                "detail": "36 of 36 human commits state their intent (structured subject or explanatory body)",
                "points": 40,
                "status": "met",
                "details": [
                  {
                    "code": "legible_history",
                    "params": {
                      "legible": 36,
                      "sampled": 36
                    }
                  }
                ],
                "max_points": 40
              }
            ]
          },
          {
            "key": "ai_verify_loop",
            "band": "moderate",
            "name": "Verify loop (build / test / typecheck)",
            "note": null,
            "notes": [],
            "value": 54,
            "inputs": {
              "has_nix": false,
              "has_tests": true,
              "lockfiles": [
                "pnpm-lock.yaml"
              ],
              "has_dockerfile": false,
              "typed_language": true,
              "bootstrap_files": [],
              "has_devcontainer": false,
              "has_linter_config": true,
              "typecheck_configs": [
                "packages/faapi/fixtures/api-alias/tsconfig.json",
                "packages/faapi/tsconfig.json",
                "packages/mcp/tsconfig.json",
                "packages/next/fixtures/with-nextjs/tsconfig.json",
                "packages/next/tsconfig.json",
                "packages/schema/tsconfig.json"
              ],
              "agent_commit_share": 0,
              "toolchain_manifests": [],
              "dependency_bot_commit_share": 0
            },
            "components": [
              {
                "key": "one_command_bootstrap",
                "name": "One-command bootstrap",
                "detail": null,
                "points": 0,
                "status": "missed",
                "details": [],
                "max_points": 18
              },
              {
                "key": "automated_tests",
                "name": "Automated tests",
                "detail": null,
                "points": 22,
                "status": "met",
                "details": [],
                "max_points": 22
              },
              {
                "key": "lint_format_config",
                "name": "Lint / format config",
                "detail": "eslint.config.js",
                "points": 11,
                "status": "met",
                "details": [
                  {
                    "code": "file_list",
                    "params": {
                      "files": "eslint.config.js"
                    }
                  }
                ],
                "max_points": 11
              },
              {
                "key": "static_type_checking",
                "name": "Static type checking",
                "detail": "packages/faapi/fixtures/api-alias/tsconfig.json, packages/faapi/tsconfig.json, packages/mcp/tsconfig.json, packages/next/fixtures/with-nextjs/tsconfig.json, packages/next/tsconfig.json, packages/schema/tsconfig.json",
                "points": 11,
                "status": "met",
                "details": [
                  {
                    "code": "file_list",
                    "params": {
                      "files": "packages/faapi/fixtures/api-alias/tsconfig.json, packages/faapi/tsconfig.json, packages/mcp/tsconfig.json, packages/next/fixtures/with-nextjs/tsconfig.json, packages/next/tsconfig.json, packages/schema/tsconfig.json"
                    }
                  }
                ],
                "max_points": 11
              },
              {
                "key": "reproducible_environment",
                "name": "Reproducible environment",
                "detail": "lockfile",
                "points": 10,
                "status": "met",
                "details": [
                  {
                    "code": "file_list",
                    "params": {
                      "files": "lockfile"
                    }
                  }
                ],
                "max_points": 10
              },
              {
                "key": "demonstrated_agent_practice",
                "name": "Demonstrated agent practice",
                "detail": "no agent-authored commits among the last 36",
                "points": 0,
                "status": "missed",
                "details": [
                  {
                    "code": "no_agent_authored_commits",
                    "params": {
                      "sampled": 36
                    }
                  }
                ],
                "max_points": 10
              },
              {
                "key": "automated_maintenance",
                "name": "Automated maintenance",
                "detail": "no automated dependency updates observed",
                "points": 0,
                "status": "missed",
                "details": [
                  {
                    "code": "no_dependency_automation",
                    "params": {}
                  }
                ],
                "max_points": 8
              },
              {
                "key": "openssf_scorecard_pinned_dependencies",
                "name": "OpenSSF Scorecard: Pinned-Dependencies",
                "detail": "dependency not pinned by hash detected -- score normalized to 0",
                "points": 0,
                "status": "missed",
                "details": [],
                "max_points": 10
              }
            ]
          },
          {
            "key": "ai_code_legibility",
            "band": "excellent",
            "name": "Code legibility for models",
            "note": null,
            "notes": [],
            "value": 100,
            "inputs": {
              "primary_language": "TypeScript",
              "largest_source_bytes": 103924,
              "source_files_sampled": 218,
              "oversized_source_files": 1
            },
            "components": [
              {
                "key": "type_checkable_code",
                "name": "Type-checkable code",
                "detail": "TypeScript (statically typed)",
                "points": 45,
                "status": "met",
                "details": [
                  {
                    "code": "statically_typed_language",
                    "params": {
                      "language": "TypeScript"
                    }
                  }
                ],
                "max_points": 45
              },
              {
                "key": "manageable_file_sizes",
                "name": "Manageable file sizes",
                "detail": "1/218 source files over 60KB",
                "points": 54.7,
                "status": "partial",
                "details": [
                  {
                    "code": "oversized_source_files",
                    "params": {
                      "kb": 60,
                      "sampled": 218,
                      "oversized": 1
                    }
                  }
                ],
                "max_points": 55
              }
            ]
          }
        ],
        "description": "How well is the repo equipped to be developed and maintained with AI coding agents? An independent, experimental badge — weight 0.0, so it is surfaced on its own and does not affect the overall health score."
      }
    ],
    "metrics_version": "1.13.0"
  },
  "warnings": [
    "GitHub dependency-graph SBOM unavailable (404); the dependency graph may be disabled for this repository"
  ],
  "report_type": "repository",
  "generated_at": "2026-07-25T02:31:36.859682Z",
  "schema_version": "0.27.0",
  "badge_url": "https://raw.githubusercontent.com/inspect-software/badges/main/v1/f/faapi/faapi.svg",
  "full_name": "faapi/faapi",
  "license_state": "standard",
  "license_spdx": "MIT"
}

Scores are signals, not warranties. They reflect publicly visible practices on GitHub — not a code audit, and not a security guarantee.

Missing data is excluded and weights renormalized, never scored as zero. Methodology is versioned and open: metrics v1.13.0, schema v0.27.0 — full methodology · metrics wiki.

How one result sits in the wider record: aggregate statistics — npm.

Software health index

Score profile

Ownership

Package ecosystems

Metrics by category

Key facts

Data collection warnings

More detail

Related records