Public recordModerate
Software health reportschema 0.27.0 · metrics 1.13.0 · 2026-07-23 22:33 UTC
timbal-ai / timbal-sdk
timbal-ai/timbal-sdk holds a health index of 55 out of 100, placing it in the Moderate band. It scores highest on Vitality (81/100) and lowest on Community & Adoption (32/100). It was last updated 1 day ago. A single contributor accounts for most of its recent work.
55
overall / 100Software health index
Metrics are grouped into weighted categories on one standardized 1–100 scale. Overall starts as their weighted mean; when public evidence triggers the High-Risk Jurisdiction Policy, the rating is adjusted and receives an At risk ceiling of 49. AI Readiness sits outside the overall score.
55
Excellent85-100Exemplary; meets essentially all checked criteria
Good70-84Healthy; minor gaps
Moderate50-69Acceptable with notable gaps; review recommended
At risk30-49Significant weaknesses; adoption warrants caution
Critical1-29Severe problems (abandoned, single-maintainer, no hygiene)
Score profile
Each axis is a category. The shape matters more than the average — a healthy subject fills the whole shape, while a spike-and-crater profile means strength in one dimension is masking risk in another.
Ownership
Timbal AIOrganization
9 followers11 public repossince May 2024
This repository is backed by an organization — shared, accountable stewardship that can outlive any single maintainer.
Package ecosystems
| Registry | Package | Version | Downloads / mo | Versions | Last publish | Tags |
|---|---|---|---|---|---|---|
| npm | @timbal-ai/timbal-sdk | 0.14.0 | 2,415 | 67 | 5 days ago | timbalsdkapitypescriptanalyticsprojectsplatform |
Metrics by category
Vitality
Is the project alive — is code being written and are releases shipping?
81
Development activity
76Good
How it's scored
| 36/36 | Push recency — last push 1 days ago |
| 11.8/36 | Commit cadence — 17/52 weeks with commits |
| 18/18 | Commit volume — 362 commits in the last year |
| 10/10 | OpenSSF Scorecard: Maintained — 30 commit(s) and 0 issue activity found in the last 90 days -- score normalized to 10 |
Inputs used
| commits_last_year | 362 |
| human_commit_share | 1 |
| days_since_last_push | 1 |
| active_weeks_last_year | 17 |
Release discipline
88Excellent
How it's scored
| 16.2/27 | Ships releases — 3 version tags (no GitHub releases) |
| 36/36 | Release recency — latest release 5 days ago |
| 27/27 | Release cadence — a release every ~21 days |
| 0/10 | OpenSSF Scorecard: Signed-Releases — no data |
Inputs used
| releases_count | 3 |
| latest_release_tag | v0.14.0 |
| releases_from_tags | yes |
| days_since_latest_release | 5 |
| mean_days_between_releases | 21 |
Excluded from scoring (no data or not applicable): OpenSSF Scorecard: Signed-Releases. Remaining weights renormalized.
Community & Adoption
Does the project have users, downloads, attention, and a welcoming setup for contributors?
32
Popularity & adoption
1Critical
How it's scored
| 0/60 | Stars — 2 stars |
| 0/25 | Forks — 0 forks |
| 0/15 | Watchers — 0 watchers |
Inputs used
| forks | 0 |
| stars | 2 |
| watchers | 0 |
| growth_state | unverified |
| growth_factor_pct | 100 |
| growth_unverified_reason | no_history |
Community health
50Moderate
How it's scored
| 22.5/22.5 | README |
| 22.5/22.5 | License — recognized license (Apache-2.0) |
| 0/18 | CONTRIBUTING guide |
| 0/13.5 | Code of conduct |
| 0/7.2 | Issue template |
| 0/6.3 | PR template |
Inputs used
| has_readme | yes |
| has_license | yes |
| has_contributing | no |
| has_issue_template | no |
| has_code_of_conduct | no |
| has_pull_request_template | no |
Ecosystem adoption (downloads)
56Moderate
How it's scored
| 45.1/80 | Monthly downloads — 2,415 downloads/month across npm |
| 0/20 | Registry dependents — not reported by this ecosystem |
Inputs used
| packages | @timbal-ai/timbal-sdk |
| dependents | — |
| ecosystems | npm |
| total_downloads | — |
| monthly_downloads | 2,415 |
Excluded from scoring (no data or not applicable): Registry dependents. Remaining weights renormalized.
Sustainability & Governance
Will the project survive its people — bus factor, responsiveness, who backs it, and package upkeep?
62
Maintainer resilience (bus factor)
18Critical
How it's scored
| 9/54 | Bus factor — 1 contributor(s) cover half of all commits |
| 1.8/22.5 | Commit distribution — top contributor authored 92% of commits |
| 4.1/13.5 | Contributor breadth — 3 contributors |
| 3/10 | OpenSSF Scorecard: Contributors — project has 1 contributing companies or organizations -- score normalized to 3 |
Inputs used
| bus_factor | 1 |
| contributors_sampled | 3 |
| top_contributor_share | 0.922 |
Issue & PR responsiveness
95Excellent
How it's scored
| 0/46.8 | Issue resolution — no issues or no data |
| 35.4/38.3 | PR acceptance — 25/27 decided PRs merged |
| 15/15 | OpenSSF Scorecard: Code-Review — all changesets reviewed |
Inputs used
| merged_prs | 25 |
| open_issues | 0 |
| closed_issues | 0 |
| issue_closed_ratio | — |
| closed_unmerged_prs | 2 |
Excluded from scoring (no data or not applicable): Issue resolution. Remaining weights renormalized.
Ownership & stewardship
50Moderate
How it's scored
| 30/30 | Ownership backing — organization-owned |
| 0/20 | Verified domain |
| 7.2/25 | Owner reach — 9 followers of timbal-ai |
| 12.3/25 | Track record — 11 public repos, account ~2 yr old |
Inputs used
| followers | 9 |
| owner_type | Organization |
| is_verified | — |
| owner_login | timbal-ai |
| public_repos | 11 |
| account_age_days | 805 |
Package maintenance
100Excellent
How it's scored
| 25/25 | Published & resolvable — 1 package(s) on npm |
| 35/35 | Publish recency — latest publish 5 days ago |
| 20/20 | Version history — 67 published versions |
| 20/20 | Not deprecated — active, not deprecated or yanked |
Inputs used
| packages | @timbal-ai/timbal-sdk |
| ecosystems | npm |
| any_deprecated | no |
| min_days_since_publish | 5 |
Engineering Quality
Are baseline engineering and documentation practices in place?
50
Engineering practices
40At risk
How it's scored
| 0/24 | CI workflows |
| 24/24 | Tests present |
| 16/16 | Linter config — eslint.config.js |
| 0/9.6 | Pre-commit hooks |
| 0/6.4 | .editorconfig |
| 0/20 | OpenSSF Scorecard: CI-Tests — 0 out of 6 merged PRs checked by a CI test -- score normalized to 0 |
Inputs used
| has_ci | no |
| has_tests | yes |
| has_editorconfig | no |
| has_linter_config | yes |
| has_precommit_config | no |
Documentation
65Moderate
How it's scored
| 30/30 | README |
| 25/25 | Documentation directory |
| 0/15 | Documentation / homepage site |
| 0/10 | Repository description |
| 0/10 | Topics |
| 10/10 | Wiki |
Inputs used
| topics | — |
| has_wiki | yes |
| homepage | — |
| has_readme | yes |
| has_docs_dir | yes |
| has_description | no |
Security
Are visible security and supply-chain practices strong, without unresolved high-risk jurisdiction exposure?
41
Security posture
41At risk
How it's scored
| 7.5/7.5 | Binary-Artifacts — no binaries found in the repo |
| 0/7.5 | Branch-Protection — no data |
| 0/2.5 | CI-Tests — 0 out of 6 merged PRs checked by a CI test -- score normalized to 0 |
| 0/2.5 | CII-Best-Practices — no effort to earn an OpenSSF best practices badge detected |
| 7.5/7.5 | Code-Review — all changesets reviewed |
| 0.8/2.5 | Contributors — project has 1 contributing companies or organizations -- score normalized to 3 |
| 0/10 | Dangerous-Workflow — no data |
| 0/7.5 | Dependency-Update-Tool — no update tool detected |
| 0/5 | Fuzzing — project is not fuzzed |
| 2.5/2.5 | License — license file detected |
| 7.5/7.5 | Maintained — 30 commit(s) and 0 issue activity found in the last 90 days -- score normalized to 10 |
| 0/5 | Packaging — no data |
| 0/5 | Pinned-Dependencies — no data |
| 0/5 | SAST — SAST tool is not run on all commits -- score normalized to 0 |
| 0/5 | Security-Policy — security policy file not detected |
| 0/7.5 | Signed-Releases — no data |
| 0/7.5 | Token-Permissions — no data |
| 0/7.5 | Vulnerabilities — 15 existing vulnerabilities detected |
Inputs used
| source | openssf_scorecard |
| checks_evaluated | 12 |
| scorecard_version | v5.5.0 |
| checks_inconclusive | 6 |
| scorecard_aggregate | 4.1 |
Excluded from scoring (no data or not applicable): branch_protection, dangerous_workflow, packaging, pinned_dependencies, signed_releases, token_permissions. Remaining weights renormalized.
AI Readiness
How well is the repo equipped to be developed and maintained with AI coding agents? An independent, experimental badge — weight 0.0, so it is surfaced on its own and does not affect the overall health score.
63
Agent context & guidance
40At risk
How it's scored
| 0/45 | Agent instructions — no CLAUDE.md / AGENTS.md / editor rules |
| 0/15 | Machine-readable docs (llms.txt) |
| 40/40 | Legible commit history — 82 of 100 human commits state their intent (structured subject or explanatory body) |
Inputs used
| has_llms_txt | no |
| legible_history_share | 0.82 |
| agent_instruction_files | — |
| agent_instruction_max_bytes | — |
Verify loop (build / test / typecheck)
67Moderate
How it's scored
| 0/18 | One-command bootstrap |
| 22/22 | Automated tests |
| 11/11 | Lint / format config — eslint.config.js |
| 11/11 | Static type checking — tsconfig.json |
| 10/10 | Reproducible environment — lockfile |
| 6/10 | Demonstrated agent practice — 3 of the last 100 commits agent-authored or agent-credited |
| 0/8 | Automated maintenance — no automated dependency updates observed |
| 0/10 | OpenSSF Scorecard: Pinned-Dependencies — no data |
Inputs used
| has_nix | no |
| has_tests | yes |
| lockfiles | package-lock.json |
| has_dockerfile | no |
| typed_language | yes |
| bootstrap_files | — |
| has_devcontainer | no |
| has_linter_config | yes |
| typecheck_configs | tsconfig.json |
| agent_commit_share | 0.03 |
| toolchain_manifests | — |
| dependency_bot_commit_share | 0 |
Excluded from scoring (no data or not applicable): OpenSSF Scorecard: Pinned-Dependencies. Remaining weights renormalized.
Code legibility for models
100Excellent
How it's scored
| 45/45 | Type-checkable code — TypeScript (statically typed) |
| 55/55 | Manageable file sizes — 0/112 source files over 60KB |
Inputs used
| primary_language | TypeScript |
| largest_source_bytes | 50,021 |
| source_files_sampled | 112 |
| oversized_source_files | 0 |
Key facts
2GitHub stars
3contributors
362commits, last 12 months
1days since last push
3releases
1bus factor
0open issues
npmpackage ecosystems
Data collection warnings
- Star history unavailable: GitHub GraphQL error: Resource not accessible by personal access token
- GitHub dependency-graph SBOM unavailable (404); the dependency graph may be disabled for this repository
- deps.dev does not index npm:@timbal-ai/timbal-sdk@0.14.0; advisories assessed against the repository dependency graph instead
More detail
OpenSSF Scorecard 4.1 / 10
4.1aggregate
Independent, tool-agnostic security assessment from the open-source OpenSSF Scorecard. Each check rewards a security practice, not a specific vendor's tool. Checks Scorecard could not determine are marked n/a and excluded from the security score (never counted as zero).
| 10 | Binary-Artifacts | no binaries found in the repo |
| n/a | Branch-Protection | internal error: error during branchesHandler.setup: internal error: some github tokens can't read classic branch protection rules: https://github.com/ossf/scorecard-action/blob/main/docs/authentication/fine-grained-auth-token.md |
| 0 | CI-Tests | 0 out of 6 merged PRs checked by a CI test -- score normalized to 0 |
| 0 | CII-Best-Practices | no effort to earn an OpenSSF best practices badge detected |
| 10 | Code-Review | all changesets reviewed |
| 3 | Contributors | project has 1 contributing companies or organizations -- score normalized to 3 |
| n/a | Dangerous-Workflow | no workflows found |
| 0 | Dependency-Update-Tool | no update tool detected |
| 0 | Fuzzing | project is not fuzzed |
| 10 | License | license file detected |
| 10 | Maintained | 30 commit(s) and 0 issue activity found in the last 90 days -- score normalized to 10 |
| n/a | Packaging | packaging workflow not detected |
| n/a | Pinned-Dependencies | no dependencies found |
| 0 | SAST | SAST tool is not run on all commits -- score normalized to 0 |
| 0 | Security-Policy | security policy file not detected |
| n/a | Signed-Releases | no releases found |
| n/a | Token-Permissions | No tokens found |
| 0 | Vulnerabilities | 15 existing vulnerabilities detected |
All dependencies not collected
The resolved dependency set could not be collected for this report: GitHub dependency-graph SBOM unavailable (404); the dependency graph may be disabled for this repository
Raw JSON report machine-readable
{
"data": {
"repo": {
"topics": [],
"is_fork": false,
"size_kb": 855,
"has_wiki": true,
"homepage": null,
"languages": {
"JavaScript": 2391,
"TypeScript": 992499
},
"pushed_at": "2026-07-22T13:38:07Z",
"created_at": "2025-08-08T08:24:41Z",
"owner_type": "Organization",
"updated_at": "2026-07-22T13:39:26Z",
"description": null,
"is_archived": false,
"is_disabled": false,
"license_spdx": "Apache-2.0",
"default_branch": "main",
"license_spdx_raw": "Apache-2.0",
"primary_language": "TypeScript",
"significant_languages": [
"TypeScript"
]
},
"owner": {
"blog": "https://timbal.ai",
"name": "Timbal AI",
"type": "Organization",
"login": "timbal-ai",
"company": null,
"location": "Spain",
"followers": 9,
"avatar_url": "https://avatars.githubusercontent.com/u/169343108?v=4",
"created_at": "2024-05-09T07:40:43Z",
"is_verified": null,
"public_repos": 11,
"account_age_days": 805
},
"license": {
"state": "standard",
"spdx_id": "Apache-2.0",
"raw_spdx": "Apache-2.0",
"file_present": true,
"scorecard_found": true,
"profile_has_license": true
},
"activity": {
"releases": [
{
"tag": "v0.14.0",
"kind": "minor",
"published_at": "2026-07-18T14:48:19Z"
},
{
"tag": "v0.9.2",
"kind": "patch",
"published_at": "2026-06-25T07:02:51Z"
},
{
"tag": "v0.9.1",
"kind": "patch",
"published_at": "2026-06-06T15:02:55Z"
}
],
"recent_commits": [
{
"oid": "3c32ed6b3c412fdc862b79fc2e4113dc264dd2e9",
"body": "feat(channels): add Microsoft Teams adapter",
"is_bot": false,
"headline": "Merge pull request #27 from timbal-ai/channels/teams",
"author_name": "David Berges",
"author_login": "berges99",
"committed_at": "2026-07-22T13:38:07Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "969ae6b83e071dfb8d54baec714dee87e22ce5ed",
"body": null,
"is_bot": false,
"headline": "fix(channels): strip Teams bot @mentions anywhere, not only leading",
"author_name": "berges99",
"author_login": "berges99",
"committed_at": "2026-07-22T13:33:00Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "082c2aae4625722e1acbfe2f0571bae83fd7a1e6",
"body": null,
"is_bot": false,
"headline": "fix(channels): require activity serviceUrl when Teams JWT pins one",
"author_name": "berges99",
"author_login": "berges99",
"committed_at": "2026-07-22T13:25:51Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "bc14d1d65418219c75eee2605d4fa769592e4e9d",
"body": "…ivities",
"is_bot": false,
"headline": "fix(channels): strip Teams attributed @mentions and drop bot-role act…",
"author_name": "berges99",
"author_login": "berges99",
"committed_at": "2026-07-22T13:16:35Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "701f17fb901eecc3c39da254fe909b423a39c31f",
"body": "Hand-rolled Activity Protocol edge: Bot Connector JWT verify, activity parse, and serviceUrl replies via cached client-credentials tokens.",
"is_bot": false,
"headline": "feat(channels): add Microsoft Teams adapter",
"author_name": "berges99",
"author_login": "berges99",
"committed_at": "2026-07-22T13:09:31Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "eb1340574e61fa0e093ecb5c6ca7d36c21eecb47",
"body": "feat(channels): add WhatsApp Cloud API adapter",
"is_bot": false,
"headline": "Merge pull request #26 from timbal-ai/channels/whatsapp",
"author_name": "David Berges",
"author_login": "berges99",
"committed_at": "2026-07-20T09:18:13Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "269db22af644e2ebd3c0271cb46bfc607949af1d",
"body": "Sticky hub.* query params on the saved callback URL were short-circuiting\nPOSTs before X-Hub-Signature-256, so signed inbound messages never ran.",
"is_bot": false,
"headline": "fix(channels): only honor WhatsApp hub challenge on GET",
"author_name": "berges99",
"author_login": "berges99",
"committed_at": "2026-07-18T16:08:14Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "3ba6df7c358a145185206eb1a78b19e6fc700b35",
"body": "Add whatsapp() with hub challenge (GET), X-Hub-Signature-256 verify,\ntext parse, and Graph send. Wire env/runtime credential materialization,\ndual GET+POST channel routes, and docs/tests. Dogfooded against Meta\ntest number via test-channels.",
"is_bot": false,
"headline": "feat(channels): add WhatsApp Cloud API adapter",
"author_name": "berges99",
"author_login": "berges99",
"committed_at": "2026-07-18T16:01:32Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "9a44f08225efb6ed2ff7e708e67fa2626c40d4fd",
"body": "Automatic MCP",
"is_bot": false,
"headline": "Merge pull request #25 from timbal-ai/feat/mcp",
"author_name": "David Berges",
"author_login": "berges99",
"committed_at": "2026-07-18T14:48:19Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "611ace8beaea1e8aea7832cadb6ce224af9c4131",
"body": "Concurrent refreshPlatformConfig callers join one in-flight promise so\neviction/warm/hooks can't run twice. Plugin name is path-scoped so a\ntransitional .use(timbalAuth()).use(timbalConfigRefresh()) collapses to\none route under Elysia's plugin identity.",
"is_bot": false,
"headline": "fix(auth): single-flight config refresh; dedupe dual mount",
"author_name": "berges99",
"author_login": "berges99",
"committed_at": "2026-07-18T14:44:03Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "af1b7c9adfb7a7326a72ec51851679c61ce03349",
"body": "POST /__timbal/config/refresh is SDK infrastructure (auth + channel\ncache invalidation), not something blueprints should wire. timbalAuth\nnow mounts it automatically; opt out with configRefresh: false.\nStandalone timbalConfigRefresh() remains for hosts that skip auth.",
"is_bot": false,
"headline": "feat(auth): mount config refresh from timbalAuth by default",
"author_name": "berges99",
"author_login": "berges99",
"committed_at": "2026-07-18T14:38:27Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "bef3c452c5c583c8c73def5ed91c25ec97eb5d83",
"body": "… for SSE\n\nSame-host http→https Origins were incorrectly allowed. Accept media\ntypes are case-insensitive per HTTP, so TEXT/EVENT-STREAM now still\nengages progress streaming.",
"is_bot": false,
"headline": "fix(mcp): compare full Origin (incl. scheme); case-insensitive Accept…",
"author_name": "berges99",
"author_login": "berges99",
"committed_at": "2026-07-18T08:17:53Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "bfc3530da9beb7c46c7a8418d5d07387457aa5ea",
"body": "…back\n\nObject-mode bindings now always attach a JSON body — a bodyless POST\nfailed the route's object validator when the agent omitted every\noptional field. Tool discovery's fallback (Elysia without\ngetGlobalRoutes) now walks getParent to the root route table instead\nof reading the plugin's own routes, which contained only the /mcp\ntransport and derived an empty tool set.",
"is_bot": false,
"headline": "fix(mcp): send {} for all-optional body schemas; root-walk route fall…",
"author_name": "berges99",
"author_login": "berges99",
"committed_at": "2026-07-18T08:07:37Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "bc3f4f1afe514e1581f20858e2e3784ccd208207",
"body": "- null path/query args are treated as absent instead of dispatching the\n literal string \"null\"; body args keep null as meaningful JSON.\n- tools/call validates inputSchema.required before dispatch: missing\n path params previously left a literal :param segment in the URL and\n hit a 404 or the wrong\n[…]\nfrom.\n- allowedOrigins now actually works for browsers: OPTIONS preflight\n handler plus Access-Control-Allow-Origin/Credentials + Vary on all\n endpoint responses, echoing only gate-approved origins.",
"is_bot": false,
"headline": "fix(mcp): null arg handling, required-arg validation, real CORS support",
"author_name": "berges99",
"author_login": "berges99",
"committed_at": "2026-07-17T21:27:30Z",
"body_truncated": true,
"is_coding_agent": false
},
{
"oid": "faf3a024b1d147b5bad39a70d830e2d5151f99f2",
"body": "tools/call streams SSE with notifications/progress heartbeats when the\nclient accepts text/event-stream and sends a progressToken (official\nSDK does both when onprogress is set), resetting client timeouts so\nlong workforce runs complete; plain JSON otherwise. Wildcard routes are\nexcluded from tool d\n[…]\ns a 150ms-timeout\nclient surviving a 250ms tool via heartbeats; new hardening suite\ncovers JSON-RPC id quirks, unicode/encoding round-trips, arg collision\nrouting, concurrency, and malformed payloads.",
"is_bot": false,
"headline": "feat(mcp): SSE progress streaming for long tool calls + hardening suite",
"author_name": "berges99",
"author_login": "berges99",
"committed_at": "2026-07-17T19:23:33Z",
"body_truncated": true,
"is_coding_agent": false
},
{
"oid": "d5b15339ed8fc59d45d20bba71a0fa97c75b45d8",
"body": "…units\n\nBuffer.byteLength measured bytes but String.slice cut at UTF-16 code\nunits, so multibyte content could exceed maxResultBytes by up to 3x and\na cut could split a surrogate pair. truncateUtf8() slices the encoded\nbytes and backs off to a UTF-8 sequence boundary, keeping the budget\nexact and the output valid; the marker now reports actual byte counts.",
"is_bot": false,
"headline": "fix(mcp): truncate tool results in UTF-8 byte space, not UTF-16 code …",
"author_name": "berges99",
"author_login": "berges99",
"committed_at": "2026-07-17T19:00:43Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "cd92550c48af70c501e760aafa3201d489586b05",
"body": "…bility\n\nHarden and round out the timbalMcp() plugin, plus README docs:\n\n- Validate Origin on POST /mcp per the Streamable HTTP spec (DNS-\n rebinding defense — matters for local dev where auth is bypassed).\n Same-host and origin-less (non-browser) requests pass; extra browser\n origins via allowed\n[…]\nallow-errors pattern as timbalChannels observers.\n\nDocuments the plugin in the README: opt-in selection, curated\ndetail.mcp identity, options, auth del, client config, and\nderiveMcpTools() inspection.",
"is_bot": false,
"headline": "feat(mcp): origin validation, structured output, result caps, observa…",
"author_name": "berges99",
"author_login": "berges99",
"committed_at": "2026-07-17T18:45:54Z",
"body_truncated": true,
"is_coding_agent": false
},
{
"oid": "ceccc1afb41ab1d694e524a216969bd7538008bd",
"body": null,
"is_bot": false,
"headline": "Bumped versioning",
"author_name": "berges99",
"author_login": "berges99",
"committed_at": "2026-07-17T15:41:48Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "ba4b8e9f49d97473f86a15c24837d68a9fe26355",
"body": "Elysia plugin following the timbalAuth/timbalChannels pattern: mounts a\nstateless Streamable HTTP endpoint (/mcp, JSON-RPC 2.0; protocol\n2025-06-18/2025-03-26/2024-11-05) that maps the app's own routes to MCP\ntools.\n\n- Opt-in only: routes join by swagger tag (include: ['Workforce']) or\n explicit de\n[…]\n suite (official Client +\n reamableHTTPClientTransport against a live server): initialize\n lifecycle, tools/list schemas, dispatch, auth forwarding, error\n shapes.\n\nAlso adds URL to eslint globals.",
"is_bot": false,
"headline": "feat(elysia): timbalMcp() — expose app routes as MCP tools",
"author_name": "berges99",
"author_login": "berges99",
"committed_at": "2026-07-17T15:33:04Z",
"body_truncated": true,
"is_coding_agent": false
},
{
"oid": "1f32f9bf0a424377ef3b8a93f9b98d607bae97e3",
"body": "channels/telegram-files",
"is_bot": false,
"headline": "Merge pull request #24 from timbal-ai/feat/channels",
"author_name": "David Berges",
"author_login": "berges99",
"committed_at": "2026-07-17T15:18:33Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "010827814974fe186e4ecab8d38af56fdd9df113",
"body": "…laims\n\n- Add optional ChannelDelivery.delete; an empty definitive text in\n StreamingReply.finalize now retracts a previously streamed message\n (best-effort, failures swallowed) instead of leaving interim delta\n text on screen when a file-only OUTPUT supersedes the stream to ''.\n Telegram implem\n[…]\n file dropped\n — e.g. data-URL files on an adapter without sendFile). Previously\n dedupe.forget only ran in the error path, so provider redelivery was\n swallowed by a claim that produced no output.",
"is_bot": false,
"headline": "fix(channels): retract stale streamed text and release empty dedupe c…",
"author_name": "berges99",
"author_login": "berges99",
"committed_at": "2026-07-17T15:02:55Z",
"body_truncated": true,
"is_coding_agent": false
},
{
"oid": "ee18e2fbe286cd38e12b338a412c73de78f81c7f",
"body": "- Advance session continuity at each delivery milestone (text finalize,\n each file send) instead of once after the file loop. A sendFile\n throwing after the text landed kept the dedupe claim but skipped\n sessions.set, so the next message lost its parentId while redelivery\n stayed blocked — the r\n[…]\nth no text blocks (file-only\n reply) now supersedes accumulated deltas down to '', so pre-tool\n chatter no longer gets sent alongside the files. Non-Message outputs\n keep the accumulation fallback.",
"is_bot": false,
"headline": "fix(channels): session continuity and stale text around reply files",
"author_name": "berges99",
"author_login": "berges99",
"committed_at": "2026-07-17T14:48:07Z",
"body_truncated": true,
"is_coding_agent": false
},
{
"oid": "8850e6f5e4945dad8dbb22d9c1ab0a578977d3d6",
"body": null,
"is_bot": false,
"headline": "0.13.2",
"author_name": "berges99",
"author_login": "berges99",
"committed_at": "2026-07-17T14:37:57Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "e4f1419b4437e40f3c48a2d4322615610035e1fd",
"body": "Inbound: photo/document messages (previously dropped) now parse into\nChannelEvents — caption as text, lazy adapter-authenticated download.\nThe pipeline re-uploads to temp storage (POST /files, service-principal\nauth via TIMBAL_PROJECT_SECRET on deployments) and invokes the workforce\nwith prompt cont\n[…]\nage; file delivery\ncounts toward dedupe claims and session continuity.\n\nPer-attachment fail-soft on ingest; oversized/failed files drop with an\nonError report while the rest of the message still runs.",
"is_bot": false,
"headline": "feat(channels): bidirectional file support for Telegram",
"author_name": "berges99",
"author_login": "berges99",
"committed_at": "2026-07-17T14:37:46Z",
"body_truncated": true,
"is_coding_agent": false
},
{
"oid": "609a9a1b25ced0f790e0b94aece9d155dac0ab93",
"body": "Derive urls",
"is_bot": false,
"headline": "Merge pull request #23 from timbal-ai/feat/channels",
"author_name": "David Berges",
"author_login": "berges99",
"committed_at": "2026-07-17T12:37:59Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "9458efbb2d6f00d36731d0e5f3fcb9fbad55a110",
"body": null,
"is_bot": false,
"headline": "0.13.1",
"author_name": "berges99",
"author_login": "berges99",
"committed_at": "2026-07-17T12:31:06Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "89ce7227fe801a56e25a2aa10073d8de54f1161a",
"body": "…ount\n\nPlatform hosts inject TIMBAL_PROJECT_ENV_ID but not PUBLIC_ORIGIN — resolve\nhttps://e{envId}.{domain}/api for webhooks, and register them on mount so\napps don't need a manual startup call.",
"is_bot": false,
"headline": "feat(channels): derive platform public origin and auto-provision on m…",
"author_name": "berges99",
"author_login": "berges99",
"committed_at": "2026-07-17T12:29:53Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "aba95f05c811bcf163489d5313a2c7756763af19",
"body": "Channels",
"is_bot": false,
"headline": "Merge pull request #22 from timbal-ai/feat/channels",
"author_name": "Pedro Olivares Sánchez",
"author_login": "pedrolivaresanchez",
"committed_at": "2026-07-17T11:44:02Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "bd4a06e335850691e98920a56175f1bd9913fd96",
"body": "Channel credentials move from env vars to the platform. Dynamic-mode\nbinding resolution now consumes the service-principal runtime endpoint\n(GET .../channels/runtime — topology + per-binding credentials, 60s TTL,\nsingle-flight, stale-on-error), so channels added in the UI work with\nzero channel env \n[…]\n default — infrastructure routes authenticate\nthemselves, so no publicPaths ritual and no silent degradation to TTL\nwhen it's forgotten.\n\nProjectChannelSpec gains configured/config/credentials fields.",
"is_bot": false,
"headline": "feat(channels): platform-held credentials + config refresh endpoint",
"author_name": "berges99",
"author_login": "berges99",
"committed_at": "2026-07-17T08:13:52Z",
"body_truncated": true,
"is_coding_agent": false
},
{
"oid": "c3dc2da1e111c1d356120bf89f17bcae9665b729",
"body": "…der}\n\nDrop the bare /channels/{provider} route. One binding per workforce+provider\nfor now; leaves room for a future binding-id segment.",
"is_bot": false,
"headline": "feat(channels): nest webhook paths under /channels/{workforce}/{provi…",
"author_name": "berges99",
"author_login": "berges99",
"committed_at": "2026-07-16T17:04:15Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "e047ed527c96e59043a0e217fb2ca1c803102c72",
"body": "Prevent webhook 500s on misconfigured env, avoid retry duplicates after\npartial delivery, skip session advances on empty replies, keep Telegram\nchat ids as strings, and make splitText safe on whitespace/max<=0.",
"is_bot": false,
"headline": "fix(channels): harden delivery, dedupe, and session edge cases",
"author_name": "berges99",
"author_login": "berges99",
"committed_at": "2026-07-16T16:47:48Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "3a58214df50e20a1c1c05e18ef5d7019d55cb35a",
"body": "A trailing-edge edit timer could fire after finalize and overwrite the\ndefinitive message with stale or length-capped stream text.",
"is_bot": false,
"headline": "fix(channels): cancel pending StreamingReply edits on finalize",
"author_name": "berges99",
"author_login": "berges99",
"committed_at": "2026-07-16T16:16:32Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "2ad7eb2ef511c5b73855a6abce7f1086a852ef59",
"body": null,
"is_bot": false,
"headline": "0.13.0",
"author_name": "berges99",
"author_login": "berges99",
"committed_at": "2026-07-16T15:50:22Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "1d97435811408716e7f807fec72f5cb9503ba78a",
"body": null,
"is_bot": false,
"headline": "0.12.0",
"author_name": "berges99",
"author_login": "berges99",
"committed_at": "2026-07-16T15:50:09Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "eb860cf1e5058227d3d5577e5fe46f24f9aca7a9",
"body": "Connect workforce components to messaging channels via adapters, with\nenv-driven bindings, session continuity, and platform project.channels\nresolution that falls back to env when the field is absent.",
"is_bot": false,
"headline": "feat(channels): add Slack/Telegram adapters and Elysia webhook plugin",
"author_name": "berges99",
"author_login": "berges99",
"committed_at": "2026-07-16T15:50:01Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "b11541709cfe318bc0ca8bf0b713c0a20ea400e0",
"body": "test(auth): pin auth mode in legacy-intent elysia tests after linkage…",
"is_bot": false,
"headline": "Merge pull request #21 from timbal-ai/feat/project-auth-modes",
"author_name": "Pedro Olivares Sánchez",
"author_login": "pedrolivaresanchez",
"committed_at": "2026-06-29T10:55:47Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "9627feec0922e570c78a5971521f637fb4254bed",
"body": null,
"is_bot": false,
"headline": "0.11.2",
"author_name": "berges99",
"author_login": "berges99",
"committed_at": "2026-06-29T10:54:24Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "a5daf1998b60d6ca83cd153b4b230f98a7201407",
"body": "… inference\n\nMode now infers from TIMBAL_PROJECT_ID, so bare timbalAuth() in a describe\nthat sets both TIMBAL_PROJECT_ID and TIMBAL_ORG_ID infers 'platform' and fires\na real getProject() fetch (no mock/override) → 5s timeout.\n\n- 'legacy mode is unaffected' guard test: pin authMode: 'legacy' (its int\n[…]\nOJECT_ID set)' describe: clear TIMBAL_ORG_ID in\n beforeEach/restore in afterEach so the platform→legacy fallback is\n deterministic regardless of the dev's ambient env.\n\nTest-only; no source changes.",
"is_bot": false,
"headline": "test(auth): pin auth mode in legacy-intent elysia tests after linkage…",
"author_name": "berges99",
"author_login": "berges99",
"committed_at": "2026-06-29T10:53:54Z",
"body_truncated": true,
"is_coding_agent": false
},
{
"oid": "a2d29904424d4bceaff92a0c05809928337cd4e4",
"body": "feat(auth): infer plugin auth mode from platform linkage",
"is_bot": false,
"headline": "Merge pull request #20 from timbal-ai/feat/project-auth-modes",
"author_name": "David Berges",
"author_login": "berges99",
"committed_at": "2026-06-29T10:48:50Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "c621b6b06ca2963456993e98b74f031aeaa1e7b8",
"body": null,
"is_bot": false,
"headline": "0.11.1",
"author_name": "berges99",
"author_login": "berges99",
"committed_at": "2026-06-29T10:46:54Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "7a7b54aed9ef91b201d3d4dfe945a91a199f716a",
"body": "resolveAuthMode now falls back to TIMBAL_PROJECT_ID presence instead of\nhardcoding 'legacy': linked deployments (project id set) infer 'platform',\nunlinked/local dev stays 'legacy'. authMode option and TIMBAL_AUTH_MODE env\nremain as forced escape hatches (precedence: option > env > linkage); an\nunre\n[…]\nicitly false).\n\nHarden resolveAuthMode tests to control TIMBAL_PROJECT_ID explicitly and cover\ninference, env/option overrides, and bad-env fallthrough. Update README auth\nmodes section and env table.",
"is_bot": false,
"headline": "feat(auth): infer plugin auth mode from platform linkage",
"author_name": "berges99",
"author_login": "berges99",
"committed_at": "2026-06-29T10:38:43Z",
"body_truncated": true,
"is_coding_agent": false
},
{
"oid": "68592bafd48228c8653b9be1d5e14ab94da2f794",
"body": "Project Auth Modes",
"is_bot": false,
"headline": "Merge pull request #19 from timbal-ai/feat/project-auth-modes",
"author_name": "David Berges",
"author_login": "berges99",
"committed_at": "2026-06-29T09:35:14Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "373b48287ed517563da8d4ee5ca6aa04088f5df4",
"body": "…JECT_ID\n\nresolveTokenFromRequest short-circuited on isLocalDev() (no TIMBAL_PROJECT_ID),\nbut the platform-authenticated gate had already dropped that bypass. Result:\nprojects using an authConfig override without TIMBAL_PROJECT_ID set (local/test)\n401'd every request even with a valid Bearer/cookie,\n[…]\noject\nis now Project | null. Legacy/fallback keep the isLocalDev bypass unchanged.\n\nAdd regression tests covering platform-authed mode with TIMBAL_PROJECT_ID unset\n(valid token → 200, no token → 401).",
"is_bot": false,
"headline": "fix(auth): validate tokens in platform-authed mode without TIMBAL_PRO…",
"author_name": "berges99",
"author_login": "berges99",
"committed_at": "2026-06-29T09:30:16Z",
"body_truncated": true,
"is_coding_agent": false
},
{
"oid": "1d0d4d48e6de7971f2a37d463ab5fa3fd01d4c4a",
"body": null,
"is_bot": false,
"headline": "0.11.0",
"author_name": "berges99",
"author_login": "berges99",
"committed_at": "2026-06-29T09:21:31Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "364e09d790e55ea602fc4ca4879dcd64983444ec",
"body": "…reachable\n\nresolvePublicAppConfig always awaited getCachedProject, so a setup running on\nan authConfig override (gate never hits the platform) still got 503 from\n/config when the platform was down. Now an override tolerates an unreachable\nplatform: try the cached project for a real id/name, else fa\n[…]\nnfig project id. Without an override the project remains the source\nof truth and failures still surface as 503.\n\nTest: override + rejecting fetch -> 200 with override auth + config-derived\nproject id.",
"is_bot": false,
"headline": "fix(auth): GET /config honors authConfig override when platform is un…",
"author_name": "berges99",
"author_login": "berges99",
"committed_at": "2026-06-29T09:11:33Z",
"body_truncated": true,
"is_coding_agent": false
},
{
"oid": "30432308c9415d7383749d7becf98ab72ae09106",
"body": "coerceAuthProviders collapsed a non-empty wire list to [] when it contained\nonly providers the SDK doesn't recognize (e.g. a newer provider or SSO-only\nslugs). authConfigFromProject treats [] as an explicit \"no providers\", so an\nauth-required project could render zero sign-in options and reject ever\n[…]\n explicit [] is still preserved as intentional.\n\nTests: coerceAuthProviders all-unknown -> undefined, and coerceProject ->\nauthConfigFromProject surfaces all known providers instead of an empty login.",
"is_bot": false,
"headline": "fix(auth): don't lock out when auth_providers are all-unknown",
"author_name": "berges99",
"author_login": "berges99",
"committed_at": "2026-06-29T09:02:09Z",
"body_truncated": true,
"is_coding_agent": false
},
{
"oid": "712dea6fb6d9e0641d759dfd9f678d395668fb14",
"body": "Prefer the platform-minted, project-scoped service key over a manual\nTIMBAL_API_KEY so deployed open projects need no hand-set credential.\n\n- ApiClient token precedence: explicit config token > TIMBAL_PROJECT_SECRET >\n TIMBAL_API_KEY > profile file. Purely additive — the var is absent locally\n and\n[…]\nr token, config\n fetch = service secret) in an authenticated project\n- e2e: open-project handler is scoped to the service secret\n\nDocs: TIMBAL_PROJECT_SECRET v-table entry + service-identity section.",
"is_bot": false,
"headline": "feat(auth): consume TIMBAL_PROJECT_SECRET as the service identity",
"author_name": "berges99",
"author_login": "berges99",
"committed_at": "2026-06-29T08:49:31Z",
"body_truncated": true,
"is_coding_agent": false
},
{
"oid": "c625407918b1a0c8b276e53eb8441e5349e3e73e",
"body": "The route called resolvePublicAppConfig bare, so a cold-cache project-fetch\nfailure threw an unhandled 500 — while the middleware treats the same failure\nas authConfig === null and degrades to legacy gating. Catch it and return a\nretryable 503 {\"error\":\"config_unavailable\"} instead. Never fabricate an auth\npayload (guessing required:false would be a fail-open leak); warm caches still\nfail-soft to last-known-good.",
"is_bot": false,
"headline": "fix(auth): return 503 from GET /config on cold-cache platform failure",
"author_name": "berges99",
"author_login": "berges99",
"committed_at": "2026-06-28T21:46:58Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "0b5b88556168c24603a3a90f3ccc73be7159afa7",
"body": "… the gate\n\nTwo platform-mode correctness fixes:\n\n- coerceProject now normalizes auth_enabled to a definite boolean and FAILS\n CLOSED when the flag is absent (require auth, never silently open a project).\n Maps the legacy use_platform_iam and strips it from the returned Project.\n Previously a mis\n[…]\nlip.\n\nTests: coerce fail-closed/legacy-map/strip cases, plus a /config-vs-gate\ndivergence guard (project flips open->authenticated mid-flight; /config must\nreport the warmed snapshot with no refetch).",
"is_bot": false,
"headline": "fix(auth): fail closed on missing auth_enabled and unify /config with…",
"author_name": "berges99",
"author_login": "berges99",
"committed_at": "2026-06-28T21:42:42Z",
"body_truncated": true,
"is_coding_agent": false
},
{
"oid": "59998aa9e41b01e069b5ae6303ec363fab479f7f",
"body": "…ests\n\nPhase 1 (steps 7-8) of project auth modes, plus the auth_enabled wire rename.\n\n- routes: provider-aware guards in platform mode — /auth/:provider and\n /auth/magic-link reject disabled providers (400), /auth/login 404s for\n open projects and filters the built-in page to enabled providers. Le\n[…]\n.ts validating\n the live wire contract (auth_enabled boolean, auth_providers subset,\n /config end-to-end, no secret leakage).\n- README: platform mode, auth-mode table, GET /config, TIMBAL_AUTH_MODE.",
"is_bot": false,
"headline": "feat(auth): platform auth modes — route guards, /config, end-to-end t…",
"author_name": "berges99",
"author_login": "berges99",
"committed_at": "2026-06-28T21:28:55Z",
"body_truncated": true,
"is_coding_agent": false
},
{
"oid": "a76d60ab418409f212240912de016dccca1f6f2f",
"body": "createConfigRoute serves a browser-safe PublicAppConfig: one getProject()\nround trip, auth config derived from that project (or the authConfig\noverride). timbalAuth mounts it only when authMode==='platform' and\nconfigRoute !== false, and adds the path to publicPaths locally so the\ngate can't block i\n[…]\nt mounted, no\npublic-path change). Custom path via configRoute string; opt out with\nconfigRoute:false. No fail-soft yet (getProject failure -> 500); route\ncaching is a follow-up. +7 integration tests.",
"is_bot": false,
"headline": "feat(auth): add platform-mode GET /config route",
"author_name": "berges99",
"author_login": "berges99",
"committed_at": "2026-06-28T17:39:34Z",
"body_truncated": true,
"is_coding_agent": false
},
{
"oid": "580e25ec9f7badd32eb44287a28dc0f56ed51f33",
"body": "- AuthMode type single-sourced in auth/types; TimbalAuthOptions.authMode\n references it.\n- resolveAuthMode(): option > TIMBAL_AUTH_MODE env > 'legacy'. An\n unrecognized env value is ignored so a typo can't flip a deployment\n into platform mode.\n- resolveAuthConfig(): authConfig override short-circuits (no fetch),\n else the cached platform fetch. Hard failures propagate by design;\n middleware owns the legacy fallback.\n\nNot yet wired into the request path - zero behavior change. +6 tests.",
"is_bot": false,
"headline": "feat(auth): add resolveAuthMode + resolveAuthConfig resolvers",
"author_name": "berges99",
"author_login": "berges99",
"committed_at": "2026-06-28T17:30:31Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "cf633024f20a3569ab0bee456ec0bfe3a5f7ce8c",
"body": "- resolveCacheKey now uses || (matching getProject's resolution) instead\n of ??, so an empty-string ctx orgId/projectId falls through to client\n config. Previously the key (\":\") didn't match the project actually\n fetched, causing misses and cross-call cache fragmentation.\n- Add a generation epoch\n[…]\nrojectAuthConfigCache() can no longer land afterward and\n undo a forced refresh. The .finally also only evicts its own inflight\n entry, never a newer one registered post-clear.\n\n+2 regression tests.",
"is_bot": false,
"headline": "fix(auth): correct auth-config cache key and clear semantics",
"author_name": "berges99",
"author_login": "berges99",
"committed_at": "2026-06-28T17:20:48Z",
"body_truncated": true,
"is_coding_agent": false
},
{
"oid": "2587558b7889b50fdf61ab7150d9995192c5448f",
"body": "- toPublicAppConfig(): whitelist-only PublicAppConfig builder for the\n future GET /config. Never spreads project (no key/repo leak); exposes\n sso availability only, never the connection list (no tenant leak).\n- renderLoginPage(prefix, opts?): optional provider filtering, default\n all four = byte-\n[…]\n literal is untouched.\n- Re-export PublicAppConfig/ProjectAuthConfig/AuthProvider/SsoConnection\n (type-only) from the elysia entry.\n\nStill unused by middleware - zero behavior change. +12 unit tests.",
"is_bot": false,
"headline": "feat(auth): add toPublicAppConfig + provider-filtered login page",
"author_name": "berges99",
"author_login": "berges99",
"committed_at": "2026-06-28T17:05:56Z",
"body_truncated": true,
"is_coding_agent": false
},
{
"oid": "6301f7281639d684895d2e65b2c8b1e0b058ca0c",
"body": "Add the read-side auth-config layer (unused by middleware yet, no\nbehavior change):\n\n- authConfigFromProject(): pure Project -> ProjectAuthConfig mapper.\n enabled <- use_platform_iam; providers <- auth_providers, defaulting\n to all four when absent (keeps today's full login page for older\n platfo\n[…]\n during\n a platform blip instead of failing closed. Throws only when there is\n no prior value.\n- clearProjectAuthConfigCache() for tests/forced refresh.\n\nExported via the auth barrel. 12 unit tests.",
"is_bot": false,
"headline": "feat(auth): derive cached ProjectAuthConfig from platform project",
"author_name": "berges99",
"author_login": "berges99",
"committed_at": "2026-06-28T16:48:18Z",
"body_truncated": true,
"is_coding_agent": false
},
{
"oid": "0ca33eb4c35964bca1af450686025309e8f2e295",
"body": "Platform now returns `auth_providers` on the project payload (GET\n/orgs/:org/projects/:id and /me?project_id=). Add the optional\n`Project.auth_providers` field and a canonical `AuthProvider` union in\ncore types (re-exported from auth/types). `coerceAuthProviders()`\nsanitizes the loose wire `string[]` to the known union, preserving\n`undefined` (absent → default to all) vs `[]` (explicit none) as\ndistinct signals. Field is optional, so existing fixtures and behavior\nare unchanged.",
"is_bot": false,
"headline": "feat(auth): coerce per-project auth_providers from platform",
"author_name": "berges99",
"author_login": "berges99",
"committed_at": "2026-06-28T16:36:15Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "24d2186afe0437430ce92da955991ab2ac003c68",
"body": "Additive types for the project auth-modes work (open vs authenticated):\nAuthProvider, SsoConnection, ProjectAuthConfig, PublicAppConfig, and new\noptional TimbalAuthOptions fields (authMode, authConfig,\nauthConfigCacheTtlMs, configRoute). Protocol-agnostic SSO; public config\nnever enumerates SSO connections. No runtime change — nothing consumes\nthese yet.",
"is_bot": false,
"headline": "feat(auth): add project auth-mode config types",
"author_name": "berges99",
"author_login": "berges99",
"committed_at": "2026-06-28T15:51:34Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "fd953cf8a946aa8aff6d1085fea75c3e48d1a17c",
"body": "feat(tools): remote tool proxy execution layer",
"is_bot": false,
"headline": "Merge pull request #18 from timbal-ai/feat/tools-proxy",
"author_name": "David Berges",
"author_login": "berges99",
"committed_at": "2026-06-28T07:59:51Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "d3405a7caa250866e6c00ae4108c5406d387e3c5",
"body": "Parse integrationId from consent_url when the proxy omits integration_id\ninstead of falling back to the tool name; return a shallow copy from\ntools.list() so array mutations do not leak across callers.",
"is_bot": false,
"headline": "fix(tools): resolve consent integration id safely and copy list cache",
"author_name": "berges99",
"author_login": "berges99",
"committed_at": "2026-06-27T22:00:07Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "13c60cfb8d9c162ceac3a11c4594495929121dd0",
"body": null,
"is_bot": false,
"headline": "Merge branch 'main' into feat/tools-proxy",
"author_name": "David Berges",
"author_login": "berges99",
"committed_at": "2026-06-27T21:57:09Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "3cd1dedf6dc12eb3709e7c6b7fc22491fe65f77d",
"body": "Ignore all files starting with playground (playground.ts, playground-tools.ts, etc.).",
"is_bot": false,
"headline": "chore: gitignore playground* local scratch scripts",
"author_name": "berges99",
"author_login": "berges99",
"committed_at": "2026-06-27T21:49:10Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "acaf62484789d51e38ade140c90d09c2fd01d62b",
"body": "Remove the unused manifest-join helper and IntegrationRequirement type.\nDocument why in tool-integration-recovery.md — use list() + group by provider\nfor now; revisit with CLI scan or Elysia plugin.\n\nSync SDK_VERSION to 0.10.0 for x-timbal-version headers.",
"is_bot": false,
"headline": "refactor(tools): drop requirements() until recovery tooling ships",
"author_name": "berges99",
"author_login": "berges99",
"committed_at": "2026-06-27T21:46:53Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "f8b881a7551910fdc0913c4d88c1911b972def2e",
"body": "Aggregate provider connection with worst-status-wins instead of last-write,\nand treat an explicit empty tools array as \"none\" rather than falling back\nto the full manifest in requirements() and specs().",
"is_bot": false,
"headline": "fix(tools): merge connection status and honor tools: []",
"author_name": "berges99",
"author_login": "berges99",
"committed_at": "2026-06-27T21:41:59Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "1dd80ccd902538b18a80754a29e8caad6a638f34",
"body": null,
"is_bot": false,
"headline": "0.10.0",
"author_name": "berges99",
"author_login": "berges99",
"committed_at": "2026-06-27T21:40:09Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "7a93eb22955360e0577970d06b56c8db2692ab1d",
"body": "`dispatch` forwards `opts` to `run` but never maps the model’s `tool_use.id` to `callId`, so `x-timbal-call-id` is omitted unless callers set it manually. Agent-loop usage loses the natural link between the tool-use block and the proxy request.\n\n```typescript\n */\nasync dispatch(toolUse: ToolUseContent, opts?: ToolRunOptions): Promise<ToolResultContent> {\n const result = await this.run<unknown>(toolUse.name, toolUse.input, opts);\n```",
"is_bot": false,
"headline": "Verify this issue exists and fix it:",
"author_name": "berges99",
"author_login": "berges99",
"committed_at": "2026-06-27T21:40:05Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "b134bad3e60a55f5d3949da50640708111b15ce8",
"body": "Wire may return integration_id as a JSON number; String() it instead of\nfalling back to the tool name so consent recovery targets the right integration.\n\nAdd unit coverage for RemoteTool helpers, manifest tolerance, and proxy edge cases.",
"is_bot": false,
"headline": "fix(tools): coerce numeric integration_id on consent_required",
"author_name": "berges99",
"author_login": "berges99",
"committed_at": "2026-06-27T21:38:33Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "2754b8d3a2489c380f7d093aad927ee5c1667cfb",
"body": "Execute framework tools via the platform proxy (POST /proxies/v1/tools/{name}),\nmirroring the Python tool_proxy: credentials stay server-side. String-first API\nmatching Composio/Pipedream conventions — no handles, no registry.\n\n- timbal.tools.run(name, input, { connectionId }) — proxy execution with\n[…]\nroxyUnavailableError for missing-connection/unavailable proxy responses\n- docs/tool-integration-recovery.md: CLI-scan vs Elysia-plugin recovery options\n\nCo-authored-by: Cursor <cursoragent@cursor.com>",
"is_bot": false,
"headline": "feat(tools): add remote tool proxy execution layer",
"author_name": "berges99",
"author_login": "berges99",
"committed_at": "2026-06-27T21:25:32Z",
"body_truncated": true,
"is_coding_agent": true
},
{
"oid": "ef596890f5e465cb1fd0853921e2b215c19d66c3",
"body": "fix(elysia): type token access on /auth/login handler",
"is_bot": false,
"headline": "Merge pull request #16 from timbal-ai/fix/elysia-login-token-type",
"author_name": "Pedro Olivares Sánchez",
"author_login": "pedrolivaresanchez",
"committed_at": "2026-06-25T07:02:51Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "5af430eb935e37a875e500be3ad7f30fa7b265aa",
"body": "fix(elysia): type token access on /auth/login handler",
"is_bot": false,
"headline": "Merge pull request #16 from timbal-ai/fix/elysia-login-token-type",
"author_name": "Pedro Olivares Sánchez",
"author_login": "pedrolivaresanchez",
"committed_at": "2026-06-25T07:02:51Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "1ba383be3d9dc96a1e3907dd5d196186b621249f",
"body": "The login redirect-when-authenticated handler reads token, which is\ninjected at runtime by the global auth middleware derive. The standalone\nroutes Elysia instance does not see it at the type level, so\ntsc --emitDeclarationOnly (prepublishOnly) failed. Read it via a narrow\ncast to unblock the declaration build. Runtime behavior unchanged.\n\nCo-authored-by: Cursor <cursoragent@cursor.com>",
"is_bot": false,
"headline": "fix(elysia): type token access on /auth/login handler",
"author_name": "berges99",
"author_login": "berges99",
"committed_at": "2026-06-25T07:00:30Z",
"body_truncated": false,
"is_coding_agent": true
},
{
"oid": "5dcc298891c4597c94c659bb15467d38575c5815",
"body": "The login redirect-when-authenticated handler reads token, which is\ninjected at runtime by the global auth middleware derive. The standalone\nroutes Elysia instance does not see it at the type level, so\ntsc --emitDeclarationOnly (prepublishOnly) failed. Read it via a narrow\ncast to unblock the declaration build. Runtime behavior unchanged.\n\nCo-authored-by: Cursor <cursoragent@cursor.com>",
"is_bot": false,
"headline": "fix(elysia): type token access on /auth/login handler",
"author_name": "berges99",
"author_login": "berges99",
"committed_at": "2026-06-25T07:00:30Z",
"body_truncated": false,
"is_coding_agent": true
},
{
"oid": "d116e021152fa1cda2d37509d1df076966f9cee1",
"body": "…ticated\n\nfeat(elysia): redirect authenticated users away from /auth/login",
"is_bot": false,
"headline": "Merge pull request #15 from timbal-ai/auth-login-redirect-when-authen…",
"author_name": "David Berges",
"author_login": "berges99",
"committed_at": "2026-06-25T06:53:07Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "ed054377bb7c6b4924d46ddcea76679ae2ff30f6",
"body": "…ticated\n\nfeat(elysia): redirect authenticated users away from /auth/login",
"is_bot": false,
"headline": "Merge pull request #15 from timbal-ai/auth-login-redirect-when-authen…",
"author_name": "David Berges",
"author_login": "berges99",
"committed_at": "2026-06-25T06:53:07Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "86f66a15249e8ddb0a01284554f6a5367e95b00f",
"body": null,
"is_bot": false,
"headline": "0.9.2",
"author_name": "berges99",
"author_login": "berges99",
"committed_at": "2026-06-25T06:48:13Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "38779ada8cb0d34d7f40c1fcbaa2b228b6bd5e11",
"body": null,
"is_bot": false,
"headline": "0.9.2",
"author_name": "berges99",
"author_login": "berges99",
"committed_at": "2026-06-25T06:48:13Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "4b7a1ee707a3d8eb5d74b0bf21750ae4d6c1f969",
"body": null,
"is_bot": false,
"headline": "0.9.1",
"author_name": "berges99",
"author_login": "berges99",
"committed_at": "2026-06-25T06:46:26Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "ac8418fa7e405e99c595a25e194fec227a5535a5",
"body": null,
"is_bot": false,
"headline": "0.9.1",
"author_name": "berges99",
"author_login": "berges99",
"committed_at": "2026-06-25T06:46:26Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "9d7a8c02683e1565119aa401ecace82a33626042",
"body": "Standard SaaS behavior — an authenticated user hitting /auth/login now\n302s to return_to (validated, same-origin) or afterLoginRedirect instead\nof seeing the login form. Reorders middleware before routes so the login\nhandler sees the resolved token. Adds open-redirect guard + tests.",
"is_bot": false,
"headline": "feat(elysia): redirect authenticated users away from /auth/login",
"author_name": "berges99",
"author_login": "berges99",
"committed_at": "2026-06-25T06:45:20Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "3cd3b9c88716c968954af59dd8e4323c28b11ff2",
"body": "Standard SaaS behavior — an authenticated user hitting /auth/login now\n302s to return_to (validated, same-origin) or afterLoginRedirect instead\nof seeing the login form. Reorders middleware before routes so the login\nhandler sees the resolved token. Adds open-redirect guard + tests.",
"is_bot": false,
"headline": "feat(elysia): redirect authenticated users away from /auth/login",
"author_name": "berges99",
"author_login": "berges99",
"committed_at": "2026-06-25T06:45:20Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "fcedb6674279070cdfe37b4bf4b2e425a37d1e03",
"body": "Redesign built-in login page to match platform styling",
"is_bot": false,
"headline": "Merge pull request #13 from timbal-ai/redesign-login-page",
"author_name": "David Berges",
"author_login": "berges99",
"committed_at": "2026-06-06T14:51:52Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "9dbde336c93fde08ed1a0a5b8e750bf8a0daceae",
"body": "Redesign built-in login page to match platform styling",
"is_bot": false,
"headline": "Merge pull request #13 from timbal-ai/redesign-login-page",
"author_name": "David Berges",
"author_login": "berges99",
"committed_at": "2026-06-06T14:51:52Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "ab62c7c194810bb15a25b955e900787d65d1c2bb",
"body": "Align the default auth login template with the platform look while keeping OAuth, magic link, and redirect behavior unchanged.",
"is_bot": false,
"headline": "Redesign built-in login page to match platform styling.",
"author_name": "Pedro Olivares",
"author_login": "pedrolivaresanchez",
"committed_at": "2026-06-06T14:34:51Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "b5309855a6d247f329d934d28efc278d37809eab",
"body": "Align the default auth login template with the platform look while keeping OAuth, magic link, and redirect behavior unchanged.",
"is_bot": false,
"headline": "Redesign built-in login page to match platform styling.",
"author_name": "Pedro Olivares",
"author_login": "pedrolivaresanchez",
"committed_at": "2026-06-06T14:34:51Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "148ca73144706afd7226a8e2830cef8eb3548d7e",
"body": "Feat/integrations catalog",
"is_bot": false,
"headline": "Merge pull request #12 from timbal-ai/feat/integrations-catalog",
"author_name": "Pedro Olivares Sánchez",
"author_login": "pedrolivaresanchez",
"committed_at": "2026-05-27T10:29:47Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "8c5d7ec1220bfef8eea589de995e64b765e11fc3",
"body": "Feat/integrations catalog",
"is_bot": false,
"headline": "Merge pull request #12 from timbal-ai/feat/integrations-catalog",
"author_name": "Pedro Olivares Sánchez",
"author_login": "pedrolivaresanchez",
"committed_at": "2026-05-27T10:29:47Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "1f59dc08a5022dd34874960d1b659dfdb0fea4df",
"body": null,
"is_bot": false,
"headline": "0.9.0",
"author_name": "berges99",
"author_login": "berges99",
"committed_at": "2026-05-27T10:18:35Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "7535e2cb58d7531d69062758e32ea2f4cc10da18",
"body": null,
"is_bot": false,
"headline": "0.9.0",
"author_name": "berges99",
"author_login": "berges99",
"committed_at": "2026-05-27T10:18:35Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "0b7a17bca8244e48f32bddd386a00efc69da84cf",
"body": "Adds the disconnect surface to both connection types:\n\n- timbal.integrations.personal.get(id).revoke()\n POST /orgs/{org}/integrations/{id}/revoke — idempotent (204 even\n when already disconnected). Shell row stays; next vend throws\n IntegrationConsentRequiredError so the user can re-consent.\n- ti\n[…]\nblock at the top of ## Integrations\nshowing the full enable→connect→vend arc; reinforces the\ncatalog.enable() prereq on both shared and personal connect\nsections; documents revoke / delete under each.",
"is_bot": false,
"headline": "feat(integrations): per-row disconnect (personal.revoke / shared.delete)",
"author_name": "berges99",
"author_login": "berges99",
"committed_at": "2026-05-27T10:18:00Z",
"body_truncated": true,
"is_coding_agent": false
},
{
"oid": "58b440cda4263b2ec1f40f42a2d9fbe27d64e837",
"body": "Adds the disconnect surface to both connection types:\n\n- timbal.integrations.personal.get(id).revoke()\n POST /orgs/{org}/integrations/{id}/revoke — idempotent (204 even\n when already disconnected). Shell row stays; next vend throws\n IntegrationConsentRequiredError so the user can re-consent.\n- ti\n[…]\nblock at the top of ## Integrations\nshowing the full enable→connect→vend arc; reinforces the\ncatalog.enable() prereq on both shared and personal connect\nsections; documents revoke / delete under each.",
"is_bot": false,
"headline": "feat(integrations): per-row disconnect (personal.revoke / shared.delete)",
"author_name": "berges99",
"author_login": "berges99",
"committed_at": "2026-05-27T10:18:00Z",
"body_truncated": true,
"is_coding_agent": false
},
{
"oid": "4ce136cd9673f841cb47a9ed1fcdeadbe6366084",
"body": "Mirrors the personal slice but for org-wide (\"shared\") rows. Adds the\nper-row resource view plus typed sugar for the bimodal /connect\nendpoint.\n\n- timbal.integrations.shared.get(id) → SharedConnectionRef\n (sync, stateless; mirrors personal.get pattern)\n- ref.token() vend, returns discriminated unio\n[…]\nsult,\nSharedConnectCredentialsResult, SharedConnectResult, SharedTokenVend.\n\n+11 unit tests, +4 integration tests against the dev API. README\n\tupdated with full connect/vend examples for both flavors.",
"is_bot": false,
"headline": "feat(integrations): shared connect + vend (OAuth & credentials)",
"author_name": "berges99",
"author_login": "berges99",
"committed_at": "2026-05-27T09:20:55Z",
"body_truncated": true,
"is_coding_agent": false
},
{
"oid": "ab12264d71592af11c7bbe6bfdbab143dcac37e3",
"body": "Mirrors the personal slice but for org-wide (\"shared\") rows. Adds the\nper-row resource view plus typed sugar for the bimodal /connect\nendpoint.\n\n- timbal.integrations.shared.get(id) → SharedConnectionRef\n (sync, stateless; mirrors personal.get pattern)\n- ref.token() vend, returns discriminated unio\n[…]\nsult,\nSharedConnectCredentialsResult, SharedConnectResult, SharedTokenVend.\n\n+11 unit tests, +4 integration tests against the dev API. README\n\tupdated with full connect/vend examples for both flavors.",
"is_bot": false,
"headline": "feat(integrations): shared connect + vend (OAuth & credentials)",
"author_name": "berges99",
"author_login": "berges99",
"committed_at": "2026-05-27T09:20:55Z",
"body_truncated": true,
"is_coding_agent": false
},
{
"oid": "0827b3eff2789e759d70a3dbaeef972050a3da22",
"body": "Adds the per-row resource view and OAuth wiring for personal\nintegrations, sitting on top of the existing list/byProvider section.\n\n- timbal.integrations.personal.get(id) → PersonalConnectionRef\n (sync, stateless; mirrors kbs.get(id) → KB)\n- ref.token() vend the caller's access tok\n[…]\ntypes: PersonalTokenVend, PersonalConsentOptions,\nPersonalConsentResponse, PersonalUseResult.\n\n+14 unit tests, +5 integration tests against the dev API.\nREADME updated with full vend/consent examples.",
"is_bot": false,
"headline": "feat(integrations): personal token vending + OAuth consent flow",
"author_name": "berges99",
"author_login": "berges99",
"committed_at": "2026-05-27T09:07:52Z",
"body_truncated": true,
"is_coding_agent": false
},
{
"oid": "064fb0e56ed403a31d09759896368365e03ceb0e",
"body": "Adds the per-row resource view and OAuth wiring for personal\nintegrations, sitting on top of the existing list/byProvider section.\n\n- timbal.integrations.personal.get(id) → PersonalConnectionRef\n (sync, stateless; mirrors kbs.get(id) → KB)\n- ref.token() vend the caller's access tok\n[…]\ntypes: PersonalTokenVend, PersonalConsentOptions,\nPersonalConsentResponse, PersonalUseResult.\n\n+14 unit tests, +5 integration tests against the dev API.\nREADME updated with full vend/consent examples.",
"is_bot": false,
"headline": "feat(integrations): personal token vending + OAuth consent flow",
"author_name": "berges99",
"author_login": "berges99",
"committed_at": "2026-05-27T09:07:52Z",
"body_truncated": true,
"is_coding_agent": false
},
{
"oid": "008b04229bea85ff3ac2d80706b47b80a272d90b",
"body": "…rface\n\nSecond slice of the integrations surface — read-only list/iterate/byProvider\nfor both connection_mode variants. Mirrors the Stripe-style shape already\nused by timbal.integrations.catalog.\n\nSub-accessors (lazy singletons on IntegrationsSection):\n\n- timbal.integrations.shared — org-wide con\n[…]\nit tests (50 total in integrations.test.ts) + 9 new live\nintegration tests (16 total) against api.dev.timbal.ai including the\nmulti-page shared.iterate() drain and the numeric → string token coercion.",
"is_bot": false,
"headline": "feat(integrations): add timbal.integrations.{shared,personal} list su…",
"author_name": "berges99",
"author_login": "berges99",
"committed_at": "2026-05-27T08:55:29Z",
"body_truncated": true,
"is_coding_agent": false
},
{
"oid": "1de2df9fb988cb8befe8cd65929b571baad7bcdb",
"body": "…rface\n\nSecond slice of the integrations surface — read-only list/iterate/byProvider\nfor both connection_mode variants. Mirrors the Stripe-style shape already\nused by timbal.integrations.catalog.\n\nSub-accessors (lazy singletons on IntegrationsSection):\n\n- timbal.integrations.shared — org-wide con\n[…]\nit tests (50 total in integrations.test.ts) + 9 new live\nintegration tests (16 total) against api.dev.timbal.ai including the\nmulti-page shared.iterate() drain and the numeric → string token coercion.",
"is_bot": false,
"headline": "feat(integrations): add timbal.integrations.{shared,personal} list su…",
"author_name": "berges99",
"author_login": "berges99",
"committed_at": "2026-05-27T08:55:29Z",
"body_truncated": true,
"is_coding_agent": false
},
{
"oid": "9d6c363135149efbbf9aba76bf4d19f9d5e2881f",
"body": "…ble/disable)\n\nFirst slice of the integrations surface — the org-scoped catalog layer\n(GET /integrations?org_id, POST /orgs/{org}/integrations/{enable,disable}).\nMirrors the Stripe-style shape used by timbal.kbs:\n\n- timbal.integrations is a lazy singleton on Timbal\n- .catalog is a lazy singleton on \n[…]\nking).\n\nTests: 28 unit (mocked apiClient) + 9 live integration tests against\napi.dev.timbal.ai including a disable round-trip that re-enables the\nprovider in finally{} to keep shared org state intact.",
"is_bot": false,
"headline": "feat(integrations): add timbal.integrations.catalog (list/iterate/ena…",
"author_name": "berges99",
"author_login": "berges99",
"committed_at": "2026-05-27T08:27:51Z",
"body_truncated": true,
"is_coding_agent": false
},
{
"oid": "0b774d32755314a373c0b2fa3748edfd0d710760",
"body": "…ble/disable)\n\nFirst slice of the integrations surface — the org-scoped catalog layer\n(GET /integrations?org_id, POST /orgs/{org}/integrations/{enable,disable}).\nMirrors the Stripe-style shape used by timbal.kbs:\n\n- timbal.integrations is a lazy singleton on Timbal\n- .catalog is a lazy singleton on \n[…]\nking).\n\nTests: 28 unit (mocked apiClient) + 9 live integration tests against\napi.dev.timbal.ai including a disable round-trip that re-enables the\nprovider in finally{} to keep shared org state intact.",
"is_bot": false,
"headline": "feat(integrations): add timbal.integrations.catalog (list/iterate/ena…",
"author_name": "berges99",
"author_login": "berges99",
"committed_at": "2026-05-27T08:27:51Z",
"body_truncated": true,
"is_coding_agent": false
},
{
"oid": "6ebfd4a0ec2021061c3644056ebf2b59d7c58c24",
"body": null,
"is_bot": false,
"headline": "0.8.0",
"author_name": "berges99",
"author_login": "berges99",
"committed_at": "2026-05-26T13:10:23Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "bcb040c70be85bebfe7ff8cc99de60bffbb1a49b",
"body": null,
"is_bot": false,
"headline": "0.8.0",
"author_name": "berges99",
"author_login": "berges99",
"committed_at": "2026-05-26T13:10:23Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "29f964961771fe50ff3db71a4cd6be788efc9f1a",
"body": "Feat/kb create directory",
"is_bot": false,
"headline": "Merge pull request #11 from timbal-ai/feat/kb-create-directory",
"author_name": "Pedro Olivares Sánchez",
"author_login": "pedrolivaresanchez",
"committed_at": "2026-05-26T13:00:57Z",
"body_truncated": false,
"is_coding_agent": false
}
],
"releases_count": 3,
"commits_last_year": 362,
"latest_release_at": "2026-07-18T14:48:19Z",
"latest_release_tag": "v0.14.0",
"releases_from_tags": true,
"days_since_last_push": 1,
"active_weeks_last_year": 17,
"days_since_latest_release": 5,
"mean_days_between_releases": 21
},
"community": {
"has_readme": true,
"has_license": true,
"has_description": false,
"has_contributing": false,
"health_percentage": 37,
"has_issue_template": false,
"has_code_of_conduct": false,
"has_pull_request_template": false
},
"ecosystem": {
"packages": [
{
"name": "@timbal-ai/timbal-sdk",
"exists": true,
"license": "Apache-2.0",
"keywords": [
"timbal",
"sdk",
"api",
"typescript",
"analytics",
"projects",
"platform"
],
"ecosystem": "npm",
"matches_repo": true,
"registry_url": "https://www.npmjs.com/package/@timbal-ai/timbal-sdk",
"is_deprecated": false,
"latest_version": "0.14.0",
"repository_url": "https://github.com/timbal-ai/timbal-sdk",
"versions_count": 67,
"total_downloads": null,
"dependents_count": null,
"deprecation_note": null,
"maintainers_count": 2,
"monthly_downloads": 2415,
"first_published_at": "2025-08-07T10:04:42.494000Z",
"latest_published_at": "2026-07-18T14:50:09.878000Z",
"latest_version_yanked": null,
"days_since_latest_publish": 5
}
]
},
"popularity": {
"forks": 0,
"stars": 2,
"watchers": 0,
"fork_history": {
"days": [],
"complete": true,
"collected": 0,
"total_forks": 0
},
"star_history": null,
"open_issues_and_prs": 0
},
"ai_readiness": {
"has_nix": false,
"example_dirs": [],
"has_llms_txt": false,
"has_dockerfile": false,
"has_mcp_signal": false,
"bootstrap_files": [],
"api_schema_files": [],
"has_devcontainer": false,
"typecheck_configs": [
"tsconfig.json"
],
"toolchain_manifests": [],
"largest_source_bytes": 50021,
"source_files_sampled": 112,
"oversized_source_files": 0,
"agent_instruction_files": [],
"agent_instruction_max_bytes": null
},
"dependencies": {
"manifests": [
"package.json"
],
"advisories": {
"error": null,
"scope": null,
"source": null,
"findings": [],
"collected": false,
"malicious": [],
"truncated": false,
"by_severity": {},
"advisory_count": 0,
"affected_count": 0,
"assessed_count": 0,
"malicious_count": 0,
"assessed_package": null,
"unassessed_count": 0,
"direct_affected_count": 0
},
"ecosystems": [
"npm"
],
"dependencies": [],
"all_dependencies": {
"error": "GitHub dependency-graph SBOM unavailable (404); the dependency graph may be disabled for this repository",
"source": null,
"packages": [],
"collected": false,
"truncated": false,
"total_count": null,
"direct_count": null,
"indirect_count": null
}
},
"maintainership": {
"issues": {
"open_prs": 0,
"merged_prs": 25,
"open_issues": 0,
"closed_ratio": null,
"closed_issues": 0,
"closed_unmerged_prs": 2
},
"bus_factor": 1,
"bot_contributors": 0,
"top_contributors": [
{
"type": "User",
"login": "berges99",
"commits": 333,
"avatar_url": "https://avatars.githubusercontent.com/u/32134944?v=4"
},
{
"type": "User",
"login": "pedrolivaresanchez",
"commits": 26,
"avatar_url": "https://avatars.githubusercontent.com/u/95417064?v=4"
},
{
"type": "User",
"login": "bpb02",
"commits": 2,
"avatar_url": "https://avatars.githubusercontent.com/u/125968805?v=4"
}
],
"contributors_sampled": 3,
"top_contributor_share": 0.922
},
"quality_signals": {
"has_ci": false,
"has_tests": true,
"ci_workflows": [],
"has_docs_dir": true,
"linter_configs": [
"eslint.config.js"
],
"has_editorconfig": false,
"has_linter_config": true,
"has_precommit_config": false
},
"security_signals": {
"lockfiles": [
"package-lock.json"
],
"scorecard": {
"checks": [
{
"name": "Binary-Artifacts",
"score": 10,
"reason": "no binaries found in the repo",
"documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#binary-artifacts"
},
{
"name": "Branch-Protection",
"score": null,
"reason": "internal error: error during branchesHandler.setup: internal error: some github tokens can't read classic branch protection rules: https://github.com/ossf/scorecard-action/blob/main/docs/authentication/fine-grained-auth-token.md",
"documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#branch-protection"
},
{
"name": "CI-Tests",
"score": 0,
"reason": "0 out of 6 merged PRs checked by a CI test -- score normalized to 0",
"documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#ci-tests"
},
{
"name": "CII-Best-Practices",
"score": 0,
"reason": "no effort to earn an OpenSSF best practices badge detected",
"documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#cii-best-practices"
},
{
"name": "Code-Review",
"score": 10,
"reason": "all changesets reviewed",
"documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#code-review"
},
{
"name": "Contributors",
"score": 3,
"reason": "project has 1 contributing companies or organizations -- score normalized to 3",
"documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#contributors"
},
{
"name": "Dangerous-Workflow",
"score": null,
"reason": "no workflows found",
"documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#dangerous-workflow"
},
{
"name": "Dependency-Update-Tool",
"score": 0,
"reason": "no update tool detected",
"documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#dependency-update-tool"
},
{
"name": "Fuzzing",
"score": 0,
"reason": "project is not fuzzed",
"documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#fuzzing"
},
{
"name": "License",
"score": 10,
"reason": "license file detected",
"documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#license"
},
{
"name": "Maintained",
"score": 10,
"reason": "30 commit(s) and 0 issue activity found in the last 90 days -- score normalized to 10",
"documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#maintained"
},
{
"name": "Packaging",
"score": null,
"reason": "packaging workflow not detected",
"documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#packaging"
},
{
"name": "Pinned-Dependencies",
"score": null,
"reason": "no dependencies found",
"documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#pinned-dependencies"
},
{
"name": "SAST",
"score": 0,
"reason": "SAST tool is not run on all commits -- score normalized to 0",
"documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#sast"
},
{
"name": "Security-Policy",
"score": 0,
"reason": "security policy file not detected",
"documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#security-policy"
},
{
"name": "Signed-Releases",
"score": null,
"reason": "no releases found",
"documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#signed-releases"
},
{
"name": "Token-Permissions",
"score": null,
"reason": "No tokens found",
"documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#token-permissions"
},
{
"name": "Vulnerabilities",
"score": 0,
"reason": "15 existing vulnerabilities detected",
"documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#vulnerabilities"
}
],
"commit": "3c32ed6b3c412fdc862b79fc2e4113dc264dd2e9",
"ran_at": "2026-07-23T22:33:22Z",
"aggregate_score": 4.1,
"scorecard_version": "v5.5.0"
},
"has_codeql_workflow": false,
"has_security_policy": false,
"has_dependabot_config": false
},
"contribution_flow": {
"collected": true,
"ci_last_run_at": "2026-07-22T13:38:09Z",
"oldest_open_prs": [],
"last_merged_pr_at": "2026-07-22T13:38:07Z",
"ci_last_conclusion": null,
"oldest_open_issues": []
}
},
"config": {
"disabled_metrics": [],
"disabled_categories": [],
"disabled_components": {}
},
"source": {
"url": "https://github.com/timbal-ai/timbal-sdk",
"host": "github.com",
"name": "timbal-sdk",
"owner": "timbal-ai"
},
"metrics": {
"overall": {
"key": "overall",
"band": "moderate",
"name": "Overall health",
"note": null,
"notes": [],
"value": 55,
"inputs": {
"security": 41,
"vitality": 81,
"community": 32,
"governance": 62,
"engineering": 50
},
"components": []
},
"categories": [
{
"key": "vitality",
"band": "good",
"name": "Vitality",
"value": 81,
"weight": 0.22,
"metrics": [
{
"key": "development_activity",
"band": "good",
"name": "Development activity",
"note": null,
"notes": [],
"value": 76,
"inputs": {
"commits_last_year": 362,
"human_commit_share": 1,
"days_since_last_push": 1,
"active_weeks_last_year": 17
},
"components": [
{
"key": "push_recency",
"name": "Push recency",
"detail": "last push 1 days ago",
"points": 36,
"status": "met",
"details": [
{
"code": "push_recency",
"params": {
"days": 1
}
}
],
"max_points": 36
},
{
"key": "commit_cadence",
"name": "Commit cadence",
"detail": "17/52 weeks with commits",
"points": 11.8,
"status": "partial",
"details": [
{
"code": "commit_cadence_weeks",
"params": {
"weeks": 17
}
}
],
"max_points": 36
},
{
"key": "commit_volume",
"name": "Commit volume",
"detail": "362 commits in the last year",
"points": 18,
"status": "met",
"details": [
{
"code": "commits_last_year",
"params": {
"count": 362
}
}
],
"max_points": 18
},
{
"key": "openssf_scorecard_maintained",
"name": "OpenSSF Scorecard: Maintained",
"detail": "30 commit(s) and 0 issue activity found in the last 90 days -- score normalized to 10",
"points": 10,
"status": "met",
"details": [],
"max_points": 10
}
]
},
{
"key": "release_discipline",
"band": "excellent",
"name": "Release discipline",
"note": "Excluded from scoring (no data or not applicable): OpenSSF Scorecard: Signed-Releases. Remaining weights renormalized.",
"notes": [
{
"code": "excluded_no_data",
"params": {
"components": [
"openssf_scorecard_signed_releases"
]
}
},
{
"code": "weights_renormalized",
"params": {}
}
],
"value": 88,
"inputs": {
"releases_count": 3,
"latest_release_tag": "v0.14.0",
"releases_from_tags": true,
"days_since_latest_release": 5,
"mean_days_between_releases": 21
},
"components": [
{
"key": "ships_releases",
"name": "Ships releases",
"detail": "3 version tags (no GitHub releases)",
"points": 16.2,
"status": "partial",
"details": [
{
"code": "version_tags_no_releases",
"params": {
"count": 3
}
}
],
"max_points": 27
},
{
"key": "release_recency",
"name": "Release recency",
"detail": "latest release 5 days ago",
"points": 36,
"status": "met",
"details": [
{
"code": "release_recency",
"params": {
"days": 5
}
}
],
"max_points": 36
},
{
"key": "release_cadence",
"name": "Release cadence",
"detail": "a release every ~21 days",
"points": 27,
"status": "met",
"details": [
{
"code": "release_cadence",
"params": {
"gap": 21
}
}
],
"max_points": 27
},
{
"key": "openssf_scorecard_signed_releases",
"name": "OpenSSF Scorecard: Signed-Releases",
"detail": "no releases found",
"points": 0,
"status": "excluded",
"details": [
{
"code": "no_data",
"params": {}
}
],
"max_points": 10
}
]
},
{
"key": "abandonment",
"band": "excellent",
"name": "Abandonment",
"note": null,
"notes": [],
"value": 100,
"inputs": {
"cap": null,
"state": "maintained",
"guards": [],
"signals": [],
"red_flag": false,
"multiplier_pct": 100,
"declared_reason": null,
"unverified_reason": null,
"unanswered_open_prs": null,
"unanswered_open_issues": null,
"days_since_last_merged_pr": null,
"days_since_last_human_commit": 1,
"days_since_last_human_commit_is_floor": false
},
"components": [
{
"key": "project_is_still_maintained",
"name": "Project is still maintained",
"detail": "last human commit 1 days ago",
"points": 100,
"status": "met",
"details": [
{
"code": "abandonment_maintained",
"params": {
"days": 1
}
}
],
"max_points": 100
}
]
}
],
"description": "Is the project alive — is code being written and are releases shipping?"
},
{
"key": "community",
"band": "at_risk",
"name": "Community & Adoption",
"value": 32,
"weight": 0.18,
"metrics": [
{
"key": "popularity",
"band": "critical",
"name": "Popularity & adoption",
"note": null,
"notes": [],
"value": 1,
"inputs": {
"forks": 0,
"stars": 2,
"watchers": 0,
"growth_state": "unverified",
"growth_factor_pct": 100,
"growth_unverified_reason": "no_history"
},
"components": [
{
"key": "stars",
"name": "Stars",
"detail": "2 stars",
"points": 0,
"status": "missed",
"details": [
{
"code": "stars",
"params": {
"count": 2
}
}
],
"max_points": 60
},
{
"key": "forks",
"name": "Forks",
"detail": "0 forks",
"points": 0,
"status": "missed",
"details": [
{
"code": "forks",
"params": {
"count": 0
}
}
],
"max_points": 25
},
{
"key": "watchers",
"name": "Watchers",
"detail": "0 watchers",
"points": 0,
"status": "missed",
"details": [
{
"code": "watchers",
"params": {
"count": 0
}
}
],
"max_points": 15
}
]
},
{
"key": "community_health",
"band": "moderate",
"name": "Community health",
"note": null,
"notes": [],
"value": 50,
"inputs": {
"has_readme": true,
"has_license": true,
"has_contributing": false,
"has_issue_template": false,
"has_code_of_conduct": false,
"has_pull_request_template": false
},
"components": [
{
"key": "readme",
"name": "README",
"detail": null,
"points": 22.5,
"status": "met",
"details": [],
"max_points": 22.5
},
{
"key": "license",
"name": "License",
"detail": "recognized license (Apache-2.0)",
"points": 22.5,
"status": "met",
"details": [
{
"code": "license_standard",
"params": {}
},
{
"code": "license_spdx",
"params": {
"spdx": "Apache-2.0"
}
}
],
"max_points": 22.5
},
{
"key": "contributing_guide",
"name": "CONTRIBUTING guide",
"detail": null,
"points": 0,
"status": "missed",
"details": [],
"max_points": 18
},
{
"key": "code_of_conduct",
"name": "Code of conduct",
"detail": null,
"points": 0,
"status": "missed",
"details": [],
"max_points": 13.5
},
{
"key": "issue_template",
"name": "Issue template",
"detail": null,
"points": 0,
"status": "missed",
"details": [],
"max_points": 7.2
},
{
"key": "pr_template",
"name": "PR template",
"detail": null,
"points": 0,
"status": "missed",
"details": [],
"max_points": 6.3
}
]
},
{
"key": "ecosystem_adoption",
"band": "moderate",
"name": "Ecosystem adoption (downloads)",
"note": "Excluded from scoring (no data or not applicable): Registry dependents. Remaining weights renormalized.",
"notes": [
{
"code": "excluded_no_data",
"params": {
"components": [
"registry_dependents"
]
}
},
{
"code": "weights_renormalized",
"params": {}
}
],
"value": 56,
"inputs": {
"packages": [
"@timbal-ai/timbal-sdk"
],
"dependents": null,
"ecosystems": "npm",
"total_downloads": null,
"monthly_downloads": 2415
},
"components": [
{
"key": "monthly_downloads",
"name": "Monthly downloads",
"detail": "2,415 downloads/month across npm",
"points": 45.1,
"status": "partial",
"details": [
{
"code": "downloads_monthly",
"params": {
"count": 2415,
"ecosystems": "npm"
}
}
],
"max_points": 80
},
{
"key": "registry_dependents",
"name": "Registry dependents",
"detail": "not reported by this ecosystem",
"points": 0,
"status": "excluded",
"details": [
{
"code": "not_reported_by_this_ecosystem",
"params": {}
}
],
"max_points": 20
}
]
}
],
"description": "Does the project have users, downloads, attention, and a welcoming setup for contributors?"
},
{
"key": "governance",
"band": "moderate",
"name": "Sustainability & Governance",
"value": 62,
"weight": 0.24,
"metrics": [
{
"key": "maintainer_resilience",
"band": "critical",
"name": "Maintainer resilience (bus factor)",
"note": null,
"notes": [],
"value": 18,
"inputs": {
"bus_factor": 1,
"contributors_sampled": 3,
"top_contributor_share": 0.922
},
"components": [
{
"key": "bus_factor",
"name": "Bus factor",
"detail": "1 contributor(s) cover half of all commits",
"points": 9,
"status": "partial",
"details": [
{
"code": "bus_factor",
"params": {
"count": 1
}
}
],
"max_points": 54
},
{
"key": "commit_distribution",
"name": "Commit distribution",
"detail": "top contributor authored 92% of commits",
"points": 1.8,
"status": "partial",
"details": [
{
"code": "top_contributor_share",
"params": {
"share": 92
}
}
],
"max_points": 22.5
},
{
"key": "contributor_breadth",
"name": "Contributor breadth",
"detail": "3 contributors",
"points": 4.1,
"status": "partial",
"details": [
{
"code": "contributors_sampled",
"params": {
"count": 3
}
}
],
"max_points": 13.5
},
{
"key": "openssf_scorecard_contributors",
"name": "OpenSSF Scorecard: Contributors",
"detail": "project has 1 contributing companies or organizations -- score normalized to 3",
"points": 3,
"status": "partial",
"details": [],
"max_points": 10
}
]
},
{
"key": "responsiveness",
"band": "excellent",
"name": "Issue & PR responsiveness",
"note": "Excluded from scoring (no data or not applicable): Issue resolution. Remaining weights renormalized.",
"notes": [
{
"code": "excluded_no_data",
"params": {
"components": [
"issue_resolution"
]
}
},
{
"code": "weights_renormalized",
"params": {}
}
],
"value": 95,
"inputs": {
"merged_prs": 25,
"open_issues": 0,
"closed_issues": 0,
"issue_closed_ratio": null,
"closed_unmerged_prs": 2
},
"components": [
{
"key": "issue_resolution",
"name": "Issue resolution",
"detail": "no issues or no data",
"points": 0,
"status": "excluded",
"details": [
{
"code": "no_issues_or_data",
"params": {}
}
],
"max_points": 46.75
},
{
"key": "pr_acceptance",
"name": "PR acceptance",
"detail": "25/27 decided PRs merged",
"points": 35.4,
"status": "partial",
"details": [
{
"code": "decided_prs_merged",
"params": {
"merged": 25,
"decided": 27
}
}
],
"max_points": 38.25
},
{
"key": "openssf_scorecard_code_review",
"name": "OpenSSF Scorecard: Code-Review",
"detail": "all changesets reviewed",
"points": 15,
"status": "met",
"details": [],
"max_points": 15
}
]
},
{
"key": "stewardship",
"band": "moderate",
"name": "Ownership & stewardship",
"note": null,
"notes": [],
"value": 50,
"inputs": {
"followers": 9,
"owner_type": "Organization",
"is_verified": null,
"owner_login": "timbal-ai",
"public_repos": 11,
"account_age_days": 805
},
"components": [
{
"key": "ownership_backing",
"name": "Ownership backing",
"detail": "organization-owned",
"points": 30,
"status": "met",
"details": [
{
"code": "owner_organization",
"params": {}
}
],
"max_points": 30
},
{
"key": "verified_domain",
"name": "Verified domain",
"detail": null,
"points": 0,
"status": "missed",
"details": [],
"max_points": 20
},
{
"key": "owner_reach",
"name": "Owner reach",
"detail": "9 followers of timbal-ai",
"points": 7.2,
"status": "partial",
"details": [
{
"code": "owner_followers",
"params": {
"count": 9,
"login": "timbal-ai"
}
}
],
"max_points": 25
},
{
"key": "track_record",
"name": "Track record",
"detail": "11 public repos, account ~2 yr old",
"points": 12.3,
"status": "partial",
"details": [
{
"code": "public_repos",
"params": {
"count": 11
}
},
{
"code": "account_age_years",
"params": {
"years": 2
}
}
],
"max_points": 25
}
]
},
{
"key": "package_maintenance",
"band": "excellent",
"name": "Package maintenance",
"note": null,
"notes": [],
"value": 100,
"inputs": {
"packages": [
"@timbal-ai/timbal-sdk"
],
"ecosystems": "npm",
"any_deprecated": false,
"min_days_since_publish": 5
},
"components": [
{
"key": "published_resolvable",
"name": "Published & resolvable",
"detail": "1 package(s) on npm",
"points": 25,
"status": "met",
"details": [
{
"code": "packages_published",
"params": {
"count": 1,
"ecosystems": "npm"
}
}
],
"max_points": 25
},
{
"key": "publish_recency",
"name": "Publish recency",
"detail": "latest publish 5 days ago",
"points": 35,
"status": "met",
"details": [
{
"code": "publish_recency",
"params": {
"days": 5
}
}
],
"max_points": 35
},
{
"key": "version_history",
"name": "Version history",
"detail": "67 published versions",
"points": 20,
"status": "met",
"details": [
{
"code": "published_versions",
"params": {
"count": 67
}
}
],
"max_points": 20
},
{
"key": "not_deprecated",
"name": "Not deprecated",
"detail": "active, not deprecated or yanked",
"points": 20,
"status": "met",
"details": [
{
"code": "package_not_deprecated",
"params": {}
}
],
"max_points": 20
}
]
}
],
"description": "Will the project survive its people — bus factor, responsiveness, who backs it, and package upkeep?"
},
{
"key": "engineering",
"band": "moderate",
"name": "Engineering Quality",
"value": 50,
"weight": 0.2,
"metrics": [
{
"key": "engineering_practices",
"band": "at_risk",
"name": "Engineering practices",
"note": null,
"notes": [],
"value": 40,
"inputs": {
"has_ci": false,
"has_tests": true,
"has_editorconfig": false,
"has_linter_config": true,
"has_precommit_config": false
},
"components": [
{
"key": "ci_workflows",
"name": "CI workflows",
"detail": null,
"points": 0,
"status": "missed",
"details": [],
"max_points": 24
},
{
"key": "tests_present",
"name": "Tests present",
"detail": null,
"points": 24,
"status": "met",
"details": [],
"max_points": 24
},
{
"key": "linter_config",
"name": "Linter config",
"detail": "eslint.config.js",
"points": 16,
"status": "met",
"details": [
{
"code": "file_list",
"params": {
"files": "eslint.config.js"
}
}
],
"max_points": 16
},
{
"key": "pre_commit_hooks",
"name": "Pre-commit hooks",
"detail": null,
"points": 0,
"status": "missed",
"details": [],
"max_points": 9.6
},
{
"key": "editorconfig",
"name": ".editorconfig",
"detail": null,
"points": 0,
"status": "missed",
"details": [],
"max_points": 6.4
},
{
"key": "openssf_scorecard_ci_tests",
"name": "OpenSSF Scorecard: CI-Tests",
"detail": "0 out of 6 merged PRs checked by a CI test -- score normalized to 0",
"points": 0,
"status": "missed",
"details": [],
"max_points": 20
}
]
},
{
"key": "documentation",
"band": "moderate",
"name": "Documentation",
"note": null,
"notes": [],
"value": 65,
"inputs": {
"topics": [],
"has_wiki": true,
"homepage": null,
"has_readme": true,
"has_docs_dir": true,
"has_description": false
},
"components": [
{
"key": "readme",
"name": "README",
"detail": null,
"points": 30,
"status": "met",
"details": [],
"max_points": 30
},
{
"key": "documentation_directory",
"name": "Documentation directory",
"detail": null,
"points": 25,
"status": "met",
"details": [],
"max_points": 25
},
{
"key": "documentation_homepage_site",
"name": "Documentation / homepage site",
"detail": null,
"points": 0,
"status": "missed",
"details": [],
"max_points": 15
},
{
"key": "repository_description",
"name": "Repository description",
"detail": null,
"points": 0,
"status": "missed",
"details": [],
"max_points": 10
},
{
"key": "topics",
"name": "Topics",
"detail": null,
"points": 0,
"status": "missed",
"details": [],
"max_points": 10
},
{
"key": "wiki",
"name": "Wiki",
"detail": null,
"points": 10,
"status": "met",
"details": [],
"max_points": 10
}
]
}
],
"description": "Are baseline engineering and documentation practices in place?"
},
{
"key": "security",
"band": "at_risk",
"name": "Security",
"value": 41,
"weight": 0.16,
"metrics": [
{
"key": "security_posture",
"band": "at_risk",
"name": "Security posture",
"note": "Excluded from scoring (no data or not applicable): Branch-Protection, Dangerous-Workflow, Packaging, Pinned-Dependencies, Signed-Releases, Token-Permissions. Remaining weights renormalized.",
"notes": [
{
"code": "excluded_no_data",
"params": {
"components": [
"branch_protection",
"dangerous_workflow",
"packaging",
"pinned_dependencies",
"signed_releases",
"token_permissions"
]
}
},
{
"code": "weights_renormalized",
"params": {}
}
],
"value": 41,
"inputs": {
"source": "openssf_scorecard",
"checks_evaluated": 12,
"scorecard_version": "v5.5.0",
"checks_inconclusive": 6,
"scorecard_aggregate": 4.1
},
"components": [
{
"key": "binary_artifacts",
"name": "Binary-Artifacts",
"detail": "no binaries found in the repo",
"points": 7.5,
"status": "met",
"details": [],
"max_points": 7.5
},
{
"key": "branch_protection",
"name": "Branch-Protection",
"detail": "internal error: error during branchesHandler.setup: internal error: some github tokens can't read classic branch protection rules: https://github.com/ossf/scorecard-action/blob/main/docs/authentication/fine-grained-auth-token.md",
"points": 0,
"status": "excluded",
"details": [
{
"code": "no_data",
"params": {}
}
],
"max_points": 7.5
},
{
"key": "ci_tests",
"name": "CI-Tests",
"detail": "0 out of 6 merged PRs checked by a CI test -- score normalized to 0",
"points": 0,
"status": "missed",
"details": [],
"max_points": 2.5
},
{
"key": "cii_best_practices",
"name": "CII-Best-Practices",
"detail": "no effort to earn an OpenSSF best practices badge detected",
"points": 0,
"status": "missed",
"details": [],
"max_points": 2.5
},
{
"key": "code_review",
"name": "Code-Review",
"detail": "all changesets reviewed",
"points": 7.5,
"status": "met",
"details": [],
"max_points": 7.5
},
{
"key": "contributors",
"name": "Contributors",
"detail": "project has 1 contributing companies or organizations -- score normalized to 3",
"points": 0.8,
"status": "partial",
"details": [],
"max_points": 2.5
},
{
"key": "dangerous_workflow",
"name": "Dangerous-Workflow",
"detail": "no workflows found",
"points": 0,
"status": "excluded",
"details": [
{
"code": "no_data",
"params": {}
}
],
"max_points": 10
},
{
"key": "dependency_update_tool",
"name": "Dependency-Update-Tool",
"detail": "no update tool detected",
"points": 0,
"status": "missed",
"details": [],
"max_points": 7.5
},
{
"key": "fuzzing",
"name": "Fuzzing",
"detail": "project is not fuzzed",
"points": 0,
"status": "missed",
"details": [],
"max_points": 5
},
{
"key": "license",
"name": "License",
"detail": "license file detected",
"points": 2.5,
"status": "met",
"details": [],
"max_points": 2.5
},
{
"key": "maintained",
"name": "Maintained",
"detail": "30 commit(s) and 0 issue activity found in the last 90 days -- score normalized to 10",
"points": 7.5,
"status": "met",
"details": [],
"max_points": 7.5
},
{
"key": "packaging",
"name": "Packaging",
"detail": "packaging workflow not detected",
"points": 0,
"status": "excluded",
"details": [
{
"code": "no_data",
"params": {}
}
],
"max_points": 5
},
{
"key": "pinned_dependencies",
"name": "Pinned-Dependencies",
"detail": "no dependencies found",
"points": 0,
"status": "excluded",
"details": [
{
"code": "no_data",
"params": {}
}
],
"max_points": 5
},
{
"key": "sast",
"name": "SAST",
"detail": "SAST tool is not run on all commits -- score normalized to 0",
"points": 0,
"status": "missed",
"details": [],
"max_points": 5
},
{
"key": "security_policy",
"name": "Security-Policy",
"detail": "security policy file not detected",
"points": 0,
"status": "missed",
"details": [],
"max_points": 5
},
{
"key": "signed_releases",
"name": "Signed-Releases",
"detail": "no releases found",
"points": 0,
"status": "excluded",
"details": [
{
"code": "no_data",
"params": {}
}
],
"max_points": 7.5
},
{
"key": "token_permissions",
"name": "Token-Permissions",
"detail": "No tokens found",
"points": 0,
"status": "excluded",
"details": [
{
"code": "no_data",
"params": {}
}
],
"max_points": 7.5
},
{
"key": "vulnerabilities",
"name": "Vulnerabilities",
"detail": "15 existing vulnerabilities detected",
"points": 0,
"status": "missed",
"details": [],
"max_points": 7.5
}
]
},
{
"key": "high_risk_jurisdiction_exposure",
"band": "excellent",
"name": "High-Risk Jurisdiction Exposure",
"note": "Only high-confidence self-published location evidence affects this multiplier. Ambiguous matches are review-only; country evidence is not proof of nationality, citizenship, legal registration, malicious intent, or sanctions status.",
"notes": [
{
"code": "jurisdiction_evidence_limits",
"params": {}
}
],
"value": 100,
"inputs": {
"meaning": "self-published location evidence; not nationality or citizenship",
"red_flag": false,
"exposures": [],
"policy_countries": [
"Russia",
"Iran",
"North Korea"
],
"review_only_matches": 0,
"assessed_self_published_locations": 2
},
"components": [
{
"key": "policy_exposure_multiplier",
"name": "Policy exposure multiplier",
"detail": "no confirmed policy-scope location match",
"points": 100,
"status": "met",
"details": [
{
"code": "jurisdiction_no_match",
"params": {}
}
],
"max_points": 100
}
]
}
],
"description": "Are visible security and supply-chain practices strong, with no malicious dependency and no unresolved high-risk jurisdiction exposure?"
},
{
"key": "ai_readiness",
"band": "moderate",
"name": "AI Readiness",
"value": 63,
"weight": 0,
"metrics": [
{
"key": "ai_agent_context",
"band": "at_risk",
"name": "Agent context & guidance",
"note": null,
"notes": [],
"value": 40,
"inputs": {
"has_llms_txt": false,
"legible_history_share": 0.82,
"agent_instruction_files": [],
"agent_instruction_max_bytes": null
},
"components": [
{
"key": "agent_instructions",
"name": "Agent instructions",
"detail": "no CLAUDE.md / AGENTS.md / editor rules",
"points": 0,
"status": "missed",
"details": [
{
"code": "no_agent_instructions",
"params": {}
}
],
"max_points": 45
},
{
"key": "machine_readable_docs_llms_txt",
"name": "Machine-readable docs (llms.txt)",
"detail": null,
"points": 0,
"status": "missed",
"details": [],
"max_points": 15
},
{
"key": "legible_commit_history",
"name": "Legible commit history",
"detail": "82 of 100 human commits state their intent (structured subject or explanatory body)",
"points": 40,
"status": "met",
"details": [
{
"code": "legible_history",
"params": {
"legible": 82,
"sampled": 100
}
}
],
"max_points": 40
}
]
},
{
"key": "ai_verify_loop",
"band": "moderate",
"name": "Verify loop (build / test / typecheck)",
"note": "Excluded from scoring (no data or not applicable): OpenSSF Scorecard: Pinned-Dependencies. Remaining weights renormalized.",
"notes": [
{
"code": "excluded_no_data",
"params": {
"components": [
"openssf_scorecard_pinned_dependencies"
]
}
},
{
"code": "weights_renormalized",
"params": {}
}
],
"value": 67,
"inputs": {
"has_nix": false,
"has_tests": true,
"lockfiles": [
"package-lock.json"
],
"has_dockerfile": false,
"typed_language": true,
"bootstrap_files": [],
"has_devcontainer": false,
"has_linter_config": true,
"typecheck_configs": [
"tsconfig.json"
],
"agent_commit_share": 0.03,
"toolchain_manifests": [],
"dependency_bot_commit_share": 0
},
"components": [
{
"key": "one_command_bootstrap",
"name": "One-command bootstrap",
"detail": null,
"points": 0,
"status": "missed",
"details": [],
"max_points": 18
},
{
"key": "automated_tests",
"name": "Automated tests",
"detail": null,
"points": 22,
"status": "met",
"details": [],
"max_points": 22
},
{
"key": "lint_format_config",
"name": "Lint / format config",
"detail": "eslint.config.js",
"points": 11,
"status": "met",
"details": [
{
"code": "file_list",
"params": {
"files": "eslint.config.js"
}
}
],
"max_points": 11
},
{
"key": "static_type_checking",
"name": "Static type checking",
"detail": "tsconfig.json",
"points": 11,
"status": "met",
"details": [
{
"code": "file_list",
"params": {
"files": "tsconfig.json"
}
}
],
"max_points": 11
},
{
"key": "reproducible_environment",
"name": "Reproducible environment",
"detail": "lockfile",
"points": 10,
"status": "met",
"details": [
{
"code": "file_list",
"params": {
"files": "lockfile"
}
}
],
"max_points": 10
},
{
"key": "demonstrated_agent_practice",
"name": "Demonstrated agent practice",
"detail": "3 of the last 100 commits agent-authored or agent-credited",
"points": 6,
"status": "partial",
"details": [
{
"code": "agent_authored_commits",
"params": {
"count": 3,
"sampled": 100
}
}
],
"max_points": 10
},
{
"key": "automated_maintenance",
"name": "Automated maintenance",
"detail": "no automated dependency updates observed",
"points": 0,
"status": "missed",
"details": [
{
"code": "no_dependency_automation",
"params": {}
}
],
"max_points": 8
},
{
"key": "openssf_scorecard_pinned_dependencies",
"name": "OpenSSF Scorecard: Pinned-Dependencies",
"detail": "no dependencies found",
"points": 0,
"status": "excluded",
"details": [
{
"code": "no_data",
"params": {}
}
],
"max_points": 10
}
]
},
{
"key": "ai_code_legibility",
"band": "excellent",
"name": "Code legibility for models",
"note": null,
"notes": [],
"value": 100,
"inputs": {
"primary_language": "TypeScript",
"largest_source_bytes": 50021,
"source_files_sampled": 112,
"oversized_source_files": 0
},
"components": [
{
"key": "type_checkable_code",
"name": "Type-checkable code",
"detail": "TypeScript (statically typed)",
"points": 45,
"status": "met",
"details": [
{
"code": "statically_typed_language",
"params": {
"language": "TypeScript"
}
}
],
"max_points": 45
},
{
"key": "manageable_file_sizes",
"name": "Manageable file sizes",
"detail": "0/112 source files over 60KB",
"points": 55,
"status": "met",
"details": [
{
"code": "oversized_source_files",
"params": {
"kb": 60,
"sampled": 112,
"oversized": 0
}
}
],
"max_points": 55
}
]
}
],
"description": "How well is the repo equipped to be developed and maintained with AI coding agents? An independent, experimental badge — weight 0.0, so it is surfaced on its own and does not affect the overall health score."
}
],
"metrics_version": "1.13.0"
},
"warnings": [
"Star history unavailable: GitHub GraphQL error: Resource not accessible by personal access token",
"GitHub dependency-graph SBOM unavailable (404); the dependency graph may be disabled for this repository",
"deps.dev does not index npm:@timbal-ai/timbal-sdk@0.14.0; advisories assessed against the repository dependency graph instead"
],
"report_type": "repository",
"generated_at": "2026-07-23T22:33:41.404043Z",
"schema_version": "0.27.0",
"badge_url": "https://raw.githubusercontent.com/inspect-software/badges/main/v1/t/timbal-ai/timbal-sdk.svg",
"full_name": "timbal-ai/timbal-sdk",
"license_state": "standard",
"license_spdx": "Apache-2.0"
}Scores are signals, not warranties. They reflect publicly visible practices on GitHub — not a code audit, and not a security guarantee.
Missing data is excluded and weights renormalized, never scored as zero. Methodology is versioned and open: metrics v1.13.0, schema v0.27.0 — full methodology · metrics wiki.
How one result sits in the wider record: aggregate statistics — npm.